diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn index 92f0d843c1..ca2b15930d 100644 --- a/.acrolinx-config.edn +++ b/.acrolinx-config.edn @@ -1,2 +1,64 @@ {:allowed-branchname-matches ["master"] - :allowed-filename-matches ["windows/"]} + :allowed-filename-matches ["windows/"] + + :targets + { + :counts { + ;;:spelling 10 + ;;:grammar 3 + ;;:total 15 ;; absolute flag count but i don't know the difference between this and issues + ;;:issues 15 ;; coming from the platform, will need to be tested. + } + :scores { + ;;:terminology 100 + :qualityscore 65 ;; Confirmed with Hugo that you just comment out the single score and leave the structure in place + ;;:spelling 40 + } + } + + :guidance-profile "d2b6c2c8-00ee-47f1-8d10-b280cc3434c1" ;; Profile ID for "M365-specific" + + :acrolinx-check-settings + { + "languageId" "en" + "ruleSetName" "Standard" + "requestedFlagTypes" ["SPELLING" "GRAMMAR" "STYLE" + "TERMINOLOGY_DEPRECATED" + "TERMINOLOGY_VALID" + "VOICE_GUIDANCE" + ] + "termSetNames" ["M365" "Products" "Microsoft"] + } + + :template-header + + " +## Acrolinx Scorecards + +**The minimum Acrolinx topic score of 65 is required for all MARVEL content merged to the default branch.** + +If you need a scoring exception for content in this PR, add the *Sign off* and the *Acrolinx exception* labels to the PR. The PubOps Team will review the exception request and may take one or more of the following actions: + +- Work with you to resolve the issues requiring the exception. +- Escalate the exception request to the Acrolinx Review Team for review. +- Approve the exception and work with the GitHub Admin Team to merge the PR to the default branch. + +For more information about the exception criteria and exception process, see [Minimum Acrolinx topic scores for publishing](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-min-score?branch=master). + +Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology: + +| Article | Score | Issues | Scorecard | Processed | +| ------- | ----- | ------ | --------- | --------- | +" + + :template-change + "| ${s/file} | ${acrolinx/qualityscore} | ${acrolinx/flags/issues} | [link](${acrolinx/scorecard}) | ${s/status} | +" + + :template-footer + " +**More info about Acrolinx** + +Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see [Use the Visual Studio Code extension to run Acrolinx locally](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-vscode?branch=master). +" +} diff --git a/.gitignore b/.gitignore index f774b7e22a..9841e0daea 100644 --- a/.gitignore +++ b/.gitignore @@ -5,8 +5,11 @@ obj/ _site/ Tools/NuGet/ .optemp/ - - +*.db +.DS_Store +*.ini +_themes*/ +common/ .openpublishing.build.mdproj .openpublishing.buildcore.ps1 packages.config diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 195bd1e6bf..3e1c1d1d11 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -8,7 +8,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -40,7 +40,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -56,23 +56,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "mdop", - "build_source_folder": "mdop", - "build_output_subfolder": "mdop", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -88,7 +72,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -120,7 +104,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -136,39 +120,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "surface", - "build_source_folder": "devices/surface", - "build_output_subfolder": "surface", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "surface-hub", - "build_source_folder": "devices/surface-hub", - "build_output_subfolder": "surface-hub", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -200,7 +152,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -232,7 +184,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -280,7 +232,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -444,7 +396,7 @@ "" ], "git_repository_url_open_to_public_contributors": "https://github.com/MicrosoftDocs/windows-itpro-docs", - "git_repository_branch_open_to_public_contributors": "master", + "git_repository_branch_open_to_public_contributors": "public", "skip_source_output_uploading": false, "need_preview_pull_request": true, "resolve_user_profile_using_github": true, @@ -480,5 +432,8 @@ } }, "need_generate_pdf": false, - "need_generate_intellisense": false -} \ No newline at end of file + "need_generate_intellisense": false, + "docs_build_engine": { + "name": "docfx_v3" + } +} diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 89eeea7716..9e3480430e 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,15166 +1,16514 @@ { -"redirections": [ -{ -"source_path": "windows/application-management/msix-app-packaging-tool-walkthrough.md", -"redirect_url": "https://docs.microsoft.com/windows/msix/mpt-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/windows-update-sources.md", -"redirect_url": "/windows/deployment/update/how-windows-update-works", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/hardware-and-software-requirements.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/security-enhancements-microsoft-edge.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/new-policies.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/intelligence/av-tests.md", -"redirect_url": "/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/intelligence/transparency-report.md", -"redirect_url": "/windows/security/threat-protection/intelligence/av-tests", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-windows-insider-for-business-aad.md", -"redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-add", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-windows-insider-for-business-faq.md", -"redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/encrypted-hard-drive.md", -"redirect_url": "/windows/security/information-protection/encrypted-hard-drive", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/secure-the-windows-10-boot-process.md", -"redirect_url": "/windows/security/information-protection/secure-the-windows-10-boot-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md", -"redirect_url": "/windows/security/information-protection/tpm/change-the-tpm-owner-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md", -"redirect_url": "/windows/security/information-protection/tpm/how-windows-uses-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/manage-tpm-commands.md", -"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/manage-tpm-lockout.md", -"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/tpm-fundamentals.md", -"redirect_url": "/windows/security/information-protection/tpm/tpm-fundamentals", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/tpm-recommendations.md", -"redirect_url": "/windows/security/information-protection/tpm/tpm-recommendations", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-overview.md", -"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", -"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-top-node", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-windows-insider-for-business.md", -"redirect_url": "/windows-insider/at-work-pro/wip-4-biz-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agress.md", -"redirect_url": "/windows/security/threat-protectionsecurity-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/administer-applocker-using-mdm.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/administer-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-architecture-and-components.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-functions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-overview.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-policies-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-policies-design-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-policy-use-scenarios.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-processes-and-interactions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-settings.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-technical-reference.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-the-application-identity-service.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-the-appLocker-reference-device.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-your-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/delete-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/determine-your-application-control-objectives.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/dll-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/document-your-application-list.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/document-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/edit-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/edit-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/enable-the-dll-rule-collection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/enforce-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/executable-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/how-applocker-works-techref.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-manually.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/monitor-application-usage-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/optimize-applocker-performance.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/plan-for-applocker-policy-management.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/refresh-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/requirements-to-use-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/script-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/security-considerations-for-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/select-types-of-rules-to-create.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/test-and-update-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/tools-to-use-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-applocker-enforcement-settings.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-behavior.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-collections.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/using-event-viewer-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/what-is-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/windows-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/working-with-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/working-with-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-enable-virtualization-based-security.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/enable-virtualization-based-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-family-options.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/graphics.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/graphics", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/prerelease", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/advanced-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/alerts-queue", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/apis-intro.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/apis-intro", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/api-hello-world.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/api-hello-world", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/attack-simulations", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/automated-investigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/basic-permissions", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/community", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/view-incidents-queue.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configuration-score", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-siem", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-splunk", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/data-retention-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/deprecate.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/deprecate", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/evaluate-atp.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/event-error-codes", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/investigate-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/investigate-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/investigate-ip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/investigate-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/investigate-user", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/licensing", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machine-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machine-reports", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machine-tags", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-edr.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-edr", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/management-apis.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/management-apis", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-incidents", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/mssp-support", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/offboard-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/onboard-configure", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/onboard", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/overview-hunting", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/partner-applications.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/partner-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/portal-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/preferences-setup", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/prerelease.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/prerelease", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/prerelease.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/prerelease", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/preview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/preview-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/python-example-code", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/rbac", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/response-actions", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-detection-test", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/service-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/time-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", - "redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-overview.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/use", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/user-roles", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/whats-new-in-microsoft-defender-atp", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-security-center", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/block-untrusted-fonts-in-enterprise.md", -"redirect_url": "/windows/security/threat-protection/block-untrusted-fonts-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/change-history-for-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/change-history-for-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md", -"redirect_url": "/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md", -"redirect_url": "/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", -"redirect_url": "/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", -"redirect_url": "/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/access-this-computer-from-the-network.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-duration.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-lockout-duration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-lockout-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-threshold.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-policies.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-administrator-account-status.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-guest-account-status.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-rename-administrator-account.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-rename-guest-account.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/add-workstations-to-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/administer-security-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/allow-log-on-locally.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/allow-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/back-up-files-and-directories.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/bypass-traverse-checking.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/change-the-system-time.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/change-the-system-time", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/change-the-time-zone.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/change-the-time-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-a-pagefile.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-a-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-a-token-object.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-a-token-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-global-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-global-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-permanent-shared-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-symbolic-links.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-symbolic-links", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/debug-programs.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/debug-programs", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-service.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-locally.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enforce-password-history.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/enforce-password-history", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/generate-security-audits.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/generate-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/increase-a-process-working-set.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/increase-scheduling-priority.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/kerberos-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/kerberos-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/load-and-unload-device-drivers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/lock-pages-in-memory.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/log-on-as-a-batch-job.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/log-on-as-a-service.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/manage-auditing-and-security-log.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-password-age.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/minimum-password-age.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/minimum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/minimum-password-length.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/minimum-password-length", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/modify-an-object-label.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/modify-an-object-label", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/modify-firmware-environment-values.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-list-manager-policies.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-list-manager-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/password-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/password-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/profile-single-process.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/profile-single-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/profile-system-performance.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/profile-system-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/remove-computer-from-docking-station.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/replace-a-process-level-token.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/restore-files-and-directories.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/restore-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-options.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/security-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-policy-settings-reference.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shut-down-the-system.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/shut-down-the-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/synchronize-directory-service-data.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-settings-optional-subsystems.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-rights-assignment.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-rights-assignment", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/device-guard-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/device-guard/device-guard-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md", -"redirect_url": "/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md", -"redirect_url": "/windows/security/threat-protection/auditing/advanced-security-auditing.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-account-lockout.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-application-generated.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-application-group-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-audit-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-authentication-policy-change.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-authorization-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-certification-services.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-computer-account-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-credential-validation.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-detailed-file-share.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-directory-service-access.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-directory-service-changes.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-directory-service-replication.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-distribution-group-management.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-dpapi-activity.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-file-share.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-file-system.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-group-membership.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-handle-manipulation.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-ipsec-driver.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-kernel-object.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-logoff.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-logon.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-network-policy-server.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-account-logon-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-other-account-management-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-other-object-access-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-policy-change-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-system-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-pnp-activity.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-process-creation.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-process-termination.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-registry.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-removable-storage.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-rpc-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-sam.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-security-group-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-security-state-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-security-system-extension.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-special-logon.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-system-integrity.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-user-account-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-user-device-claims.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-account-management.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-logon-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-object-access.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-privilege-use.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-process-tracking.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-system-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-security-audit-policies.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1100.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-1102.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1104.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-1105.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1108.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4608.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4610.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4611.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4612.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4614.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4615.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4616.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4618.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4621.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4622.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4624.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4625.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4626.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4627.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4634.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4647.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4648.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4649.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4656.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4657.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4658.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4660.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4661.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4662.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4663.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4664.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4670.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4671.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4672.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4673.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4674.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4675.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4688.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4689.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4690.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4691.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4692.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4693.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4694.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4695.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4696.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4697.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4698.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4699.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4700.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4701.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4702.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4703.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4704.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4705.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4706.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4707.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4713.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4714.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4715.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4716.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4717.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4718.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4719.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4720.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4722.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4723.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4724.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4725.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4726.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4731.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4732.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4733.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4734.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4735.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4738.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4739.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4740.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4741.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4742.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4743.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4749.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4750.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4751.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4752.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4753.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4764.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4765.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4766.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4767.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4768.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4769.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4770.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4771.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4772.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4773.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4774.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4775.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4776.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4777.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4778.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4779.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4780.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4781.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4782.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4793.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4794.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4798.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4799.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4800.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4801.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4802.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4803.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4816.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4817.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4818.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4819.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4826.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4864.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4865.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4866.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4867.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4902.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4904.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4905.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4906.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4907.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4908.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4909.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4910.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4911.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4912.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4913.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4928.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4929.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4930.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4931.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4932.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4933.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4934.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4935.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4936.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4937.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4944.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4945.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4946.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4947.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4948.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4949.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4950.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4951.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4952.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4953.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4954.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4956.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4957.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4958.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4964.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4985.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5024.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5025.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5027.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5028.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5029.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5030.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5031.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5032.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5033.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5034.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5035.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5037.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5038.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5039.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5051.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5056.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5057.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5058.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5059.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5060.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5061.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5062.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5063.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5064.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5065.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5066.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5067.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5068.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5069.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5070.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5136.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5137.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5138.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5139.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5140.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5141.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5142.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5143.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5144.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5145.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5148.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5149.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5150.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5151.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5152.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5153.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5154.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5155.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5156.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5157.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5158.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5159.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5168.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5376.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5377.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5378.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5447.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5632.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5633.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5712.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5888.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5889.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5890.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6144.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6145.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6281.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6400.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6401.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6402.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6403.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6404.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6405.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6406.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6407.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6408.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6409.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6410.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6416.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6419.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6420.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6421.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6422.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6423.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6424.md", -"redirect_url": "/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-claim-types.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/other-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md", -"redirect_url": "/windows/security/threat-protection/auditing/security-auditing-overview.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", -"redirect_url": "/windows/security/threat-protection/auditing/view-the-security-event-log.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md", -"redirect_url": "/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "/windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/administer-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/administer-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-architecture-and-components.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-architecture-and-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-functions.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-functions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-overview.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policies-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-policies-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policies-design-guide.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-policies-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policy-use-scenarios.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-policy-use-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-processes-and-interactions.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-processes-and-interactions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-settings.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-technical-reference.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-the-application-identity-service.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-the-application-identity-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-the-appLocker-reference-device.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-the-appLocker-reference-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-for-packaged-apps.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-planning-document.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-your-applocker-planning-document", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-your-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/delete-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/applocker/delete-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "/windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/deploy-the-applocker-policy-into-production.md", -"redirect_url": "/windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "/windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-your-application-control-objectives.md", -"redirect_url": "/windows/security/threat-protection/applocker/determine-your-application-control-objectives", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "/windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/dll-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/dll-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-application-control-management-processes.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-your-application-control-management-processes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-application-list.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-your-application-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/edit-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/edit-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/edit-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/edit-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/enable-the-dll-rule-collection.md", -"redirect_url": "/windows/security/threat-protection/applocker/enable-the-dll-rule-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/enforce-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/enforce-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/executable-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/executable-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "/windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/how-applocker-works-techref.md", -"redirect_url": "/windows/security/threat-protection/applocker/how-applocker-works-techref", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "/windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/manage-packaged-apps-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/merge-applocker-policies-manually.md", -"redirect_url": "/windows/security/threat-protection/applocker/merge-applocker-policies-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/monitor-application-usage-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/monitor-application-usage-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/optimize-applocker-performance.md", -"redirect_url": "/windows/security/threat-protection/applocker/optimize-applocker-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/plan-for-applocker-policy-management.md", -"redirect_url": "/windows/security/threat-protection/applocker/plan-for-applocker-policy-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/refresh-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/refresh-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/requirements-for-deploying-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/requirements-to-use-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/requirements-to-use-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "/windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/script-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/script-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/security-considerations-for-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/security-considerations-for-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/select-types-of-rules-to-create.md", -"redirect_url": "/windows/security/threat-protection/applocker/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/test-and-update-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/test-and-update-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/tools-to-use-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/tools-to-use-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-enforcement-settings.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-applocker-enforcement-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-policy-design-decisions.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-behavior.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-collections.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-collections", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-condition-types.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-exceptions.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "/windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "/windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/using-event-viewer-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/using-event-viewer-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/what-is-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/what-is-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/windows-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/windows-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/working-with-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/working-with-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/working-with-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/change-history-for-device-security.md", -"redirect_url": "/windows/security/threat-protection/change-history-for-device-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/enable-virtualization-based-protection-of-code-integrity.md", -"redirect_url": "/windows/security/threat-protection/enable-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/get-support-for-security-baselines.md", -"redirect_url": "/windows/security/threat-protection/get-support-for-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", -"redirect_url": "/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-compliance-toolkit-10.md", -"redirect_url": "/windows/security/threat-protection/security-compliance-toolkit-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/windows-10-mobile-security-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-10-mobile-security-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/windows-security-baselines.md", -"redirect_url": "/windows/security/threat-protection/windows-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/app-behavior-with-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/app-behavior-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/limitations-with-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/limitations-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/overview-create-wip-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/using-owa-with-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/using-owa-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/encrypted-hard-drive.md", -"redirect_url": "/windows/security/hardware-protection/encrypted-hard-drive", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/secure-the-windows-10-boot-process.md", -"redirect_url": "/windows/security/hardware-protection/secure-the-windows-10-boot-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "/windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/change-the-tpm-owner-password.md", -"redirect_url": "/windows/securityhardware-protection/tpm/change-the-tpm-owner-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/how-windows-uses-the-tpm.md", -"redirect_url": "/windows/securityhardware-protection/tpm/how-windows-uses-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "/windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/manage-tpm-commands.md", -"redirect_url": "/windows/security/hardware-protection/tpm/manage-tpm-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/manage-tpm-lockout.md", -"redirect_url": "/windows/security/hardware-protection/tpm/manage-tpm-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "/windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/tpm-fundamentals.md", -"redirect_url": "/windows/security/hardware-protection/tpm/tpm-fundamentals", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/tpm-recommendations.md", -"redirect_url": "/windows/security/hardware-protection/tpm/tpm-recommendations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-overview.md", -"redirect_url": "/windows/security/hardware-protection/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-top-node.md", -"redirect_url": "/windows/security/hardware-protection/tpm/trusted-platform-module-top-node", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bcd-settings-and-bitlocker.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-basic-deployment.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-basic-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-countermeasures.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-group-policy-settings.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-management-for-enterprises.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-overview.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", -"redirect_url": "/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", -"redirect_url": "/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-credential-theft-mitigation-guide-abstract.md", -"redirect_url": "/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/change-history-for-access-protection.md", -"redirect_url": "/windows/security/identity-protection/change-history-for-access-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/configure-s-mime.md", -"redirect_url": "/windows/security/identity-protection/configure-s-mime", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/enterprise-certificate-pinning.md", -"redirect_url": "/windows/security/identity-protection/enterprise-certificate-pinning", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/installing-digital-certificates-on-windows-10-mobile.md", -"redirect_url": "/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/remote-credential-guard.md", -"redirect_url": "/windows/security/identity-protection/remote-credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/basic-firewall-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/boundary-zone-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/boundary-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/boundary-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-group-policy-objects.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-authentication-methods.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-authentication-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-windows-firewall-log.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-a-group-account-in-active-directory.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-a-group-policy-object.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-a-group-policy-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-authentication-request-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-icmp-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-port-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-outbound-port-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/documenting-the-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/documenting-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/enable-predefined-inbound-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/enable-predefined-outbound-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/encryption-zone-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/encryption-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/encryption-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/exempt-icmp-from-authentication.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/exemption-list.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/exemption-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/firewall-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/firewall-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/firewall-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/firewall-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-other-relevant-information.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-the-information-you-need.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-boundary.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-encryption.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-firewall.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolated-domain-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/isolated-domain-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolated-domain.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolating-apps-on-your-network.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/link-the-gpo-to-the-domain.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-certificate-based-authentication.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-domain-isolation-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-gpo-deployment.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-gpo-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-network-access-groups.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-network-access-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-server-isolation-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-the-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-the-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/procedures-used-in-this-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/server-isolation-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", -"redirect_url": "/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-authentication.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-auto-trigger-profile.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-auto-trigger-profile", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-conditional-access.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-connection-type.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-connection-type", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-guide.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-name-resolution.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-name-resolution", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-profile-options.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-profile-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-routing.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-routing", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-security-features.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-security-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-overview.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/how-user-account-control-works.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/how-user-account-control-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-overview.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/user-account-control-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-security-policy-settings.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-debugging-information.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-debugging-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-events.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-removal-policy-service.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-tools-and-settings.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-and-remote-desktop-services.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-architecture.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-certificate-propagation-service.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-and-password-changes.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-and-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-biometrics-in-enterprise.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-adfs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-policy-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-cert-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-guide.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-key-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-errors-during-pin-creation.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-event-300.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-event-300", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-features.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-how-it-works.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-identity-verification.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-adfs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-manage-in-organization.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-manage-in-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-overview.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-planning-guide.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-planning-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-prepare-people-to-use.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/additional-mitigations.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/additional-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-considerations.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-how-it-works.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-known-issues.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-known-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-manage.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-manage", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-not-protected-scenarios.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-protection-limits.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-requirements.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-scripts.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/access-control.md", -"redirect_url": "/windows/security/identity-protection/access-control/access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/active-directory-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/active-directory-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/active-directory-security-groups.md", -"redirect_url": "/windows/security/identity-protection/access-control/active-directory-security-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/dynamic-access-control.md", -"redirect_url": "/windows/security/identity-protection/access-control/dynamic-access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/local-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/microsoft-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/security-identifiers.md", -"redirect_url": "/windows/security/identity-protection/access-control/security-identifiers", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/security-principals.md", -"redirect_url": "/windows/security/identity-protection/access-control/security-principals", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/service-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/service-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/special-identities.md", -"redirect_url": "/windows/security/identity-protection/access-control/special-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-steps.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md", -"redirect_url": "/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", -"redirect_url": "/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface/surface-device-compatibility-with-windows-10-ltsb.md", -"redirect_url": "/devices/surface/surface-device-compatibility-with-windows-10-ltsc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/windows-diagnostic-data-1709.md", -"redirect_url": "/windows/configuration/windows-diagnostic-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/EventName.md", -"redirect_url": "/windows/configuration/enhanced-telemetry-windows-analytics-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "education/windows/windows-10-pro-to-pro-edu-upgrade.md", -"redirect_url": "/education/windows/switch-to-pro-education", -"redirect_document_id": false -}, -{ -"source_path": "education/windows/switch-to-pro-education.md", -"redirect_url": "/education/windows/change-to-pro-education", -"redirect_document_id": true -}, -{ - "source_path": "education/windows/swithc-to-pro-de.md", - "redirect_url": "/education/windows/switch-to-pro-education", - "redirect_document_id": false + "redirections": [ + { + "source_path": "security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering", + "redirect_document_id": true }, -{ -"source_path": "windows/client-management/mdm/policy-admx-backed.md", -"redirect_url": "/windows/client-management/mdm/policy-configuration-service-provider", -"redirect_document_id": true -}, -{ -"source_path": "windows/client-management/mdm/policy-csp-location.md", -"redirect_url": "/windows/client-management/mdm/policy-configuration-service-provider", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/configure-windows-defender-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-pua-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/get-started-with-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-block-at-first-sight.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-enhanced-notifications.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-7.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface/surface-diagnostic-toolkit.md", -"redirect_url": "/surface/index", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface/manage-surface-dock-firmware-updates.md", -"redirect_url": "devices/surface/update", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md", -"redirect_url": "/surface-hub/finishing-your-surface-hub-meeting", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-microsoft-layout-app.md", -"redirect_url": "/hololens/hololens-microsoft-dynamics-365-layout-app", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-microsoft-dynamics-365-layout-app.md", -"redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/layout/", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-microsoft-remote-assist-app.md", -"redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-public-preview-apps.md", -"redirect_url": "https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", -"redirect_url": "/surface-hub/provisioning-packages-for-surface-hub", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md", -"redirect_url": "/surface-hub/admin-group-management-for-surface-hub", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/surface-hub-administrators-guide.md", -"redirect_url": "/surface-hub/index", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/intro-to-surface-hub.md", -"redirect_url": "/surface-hub/index", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/waas-quick-start.md", -"redirect_url": "/windows/deployment/update/waas-quick-start", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-overview.md", -"redirect_url": "/windows/deployment/update/waas-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-servicing-strategy-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-strategy-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-deployment-rings-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-deployment-rings-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-branches-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-compliance-monitor.md", -"redirect_url": "/windows/deployment/update/update-compliance-monitor", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-compliance-get-started.md", -"redirect_url": "/windows/deployment/update/update-compliance-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-compliance-using.md", -"redirect_url": "/windows/deployment/update/update-compliance-using", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-optimize-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-optimize-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-delivery-optimization.md", -"redirect_url": "/windows/deployment/update/waas-delivery-optimization", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-branchcache.md", -"redirect_url": "/windows/deployment/update/waas-branchcache", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-mobile-updates.md", -"redirect_url": "/windows/deployment/update/waas-mobile-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-manage-updates-wufb.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-configure-wufb.md", -"redirect_url": "/windows/deployment/update/waas-configure-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-integrate-wufb.md", -"redirect_url": "/windows/deployment/update/waas-integrate-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-wufb-group-policy.md", -"redirect_url": "/windows/deployment/update/waas-wufb-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-wufb-intune.md", -"redirect_url": "/windows/deployment/update/waas-wufb-intune.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-manage-updates-wsus.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wsus", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-manage-updates-configuration-manager.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-restart.md", -"redirect_url": "/windows/deployment/update/waas-restart", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-update-windows-10.md", -"redirect_url": "/windows/deployment/update/index", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lockdown-features-windows-10.md", -"redirect_url": "/windows/configuration/lockdown-features-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/set-up-shared-or-guest-pc.md", -"redirect_url": "/windows/configuration/set-up-shared-or-guest-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "/windows/configuration/kiosk-shared-pc", -"redirect_document_id": false -}, -{ -"source_path": "windows/configuration/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "/windows/configuration/kiosk-shared-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", -"redirect_url": "/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/guidelines-for-assigned-access-app.md", -"redirect_url": "/windows/configuration/guidelines-for-assigned-access-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lock-down-windows-10-to-specific-apps.md", -"redirect_url": "/windows/configuration/lock-down-windows-10-to-specific-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", -"redirect_url": "/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lockdown-xml.md", -"redirect_url": "/windows/configuration/mobile-devices/lockdown-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/settings-that-can-be-locked-down.md", -"redirect_url": "/windows/configuration/mobile-devices/settings-that-can-be-locked-down", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/product-ids-in-windows-10-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-tips-and-suggestions.md", -"redirect_url": "/windows/configuration/manage-tips-and-suggestions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-10-start-layout-options-and-policies.md", -"redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-windows-10-taskbar.md", -"redirect_url": "/windows/configuration//configure-windows-10-taskbar", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-and-export-start-layout.md", -"redirect_url": "/windows/configuration//customize-and-export-start-layout", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/start-layout-xml-desktop.md", -"redirect_url": "/windows/configuration/start-layout-xml-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/start-layout-xml-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/start-layout-xml-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-windows-10-start-screens-by-using-group-policy.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-testing-scenarios.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-1.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-2.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-3.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-4.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-5.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-6.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-o365.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-o365", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-crm.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-crm", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-powerbi.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-powerbi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-voice-commands.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-policy-settings.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-feedback.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-feedback", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/stop-employees-from-using-the-windows-store.md", -"redirect_url": "/windows/configuration/stop-employees-from-using-the-windows-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/stop-employees-from-using-the-windows-store.md", -"redirect_url": "/windows/configuration/stop-employees-from-using-microsoft-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-devices-without-mdm.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/changes-to-start-policies-in-windows-10.md", -"redirect_url": "/windows/configuration/changes-to-start-policies-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/how-it-pros-can-use-configuration-service-providers.md", -"redirect_url": "/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lock-down-windows-10.md", -"redirect_url": "/windows/configuration/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-wifi-sense-in-enterprise.md", -"redirect_url": "/windows/configuration/manage-wifi-sense-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-how-it-works.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-install-icd.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-install-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-create-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-create-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-apply-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-apply-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-uninstall-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-uninstall-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provision-pcs-for-initial-deployment.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provision-pcs-with-apps-and-certificates.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-with-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-script-to-install-app.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-script-to-install-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-nfc.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-nfc", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-command-line.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-command-line", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-multivariant.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-multivariant", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-edp-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-edp-policy-using-sccm.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-vpn-and-edp-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-enable-phone-signin.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/deploy-edp-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/guidance-and-best-practices-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/overview-create-edp-policy.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/overview-create-wip-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-enterprise-data-using-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/testing-scenarios-for-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/wip-enterprise-overview.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/enlightened-microsoft-apps-and-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/update-windows-10-images-with-provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": false -}, -{ -"source_path": "windows/deploy/upgrade-analytics-prepare-your-environment.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-identify-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-release-notes.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-review-site-discovery.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-additional-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md", -"redirect_url": "https://technet.microsoft.com/library/jj635854.aspx", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md", -"redirect_url": "/windows/device-security/device-guard/device-guard-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/device-guard-certification-and-compliance.md", -"redirect_url": "/windows/device-security/device-guard/device-guard-deployment-guide", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-enable-phone-signin", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md", -"redirect_url": "/windows/device-security/device-guard/device-guard-deployment-guide", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/implement-microsoft-passport-in-your-organization.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-manage-in-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-identity-verification-using-microsoft-passport.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-passport-and-password-changes.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-and-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-passport-errors-during-pin-creation.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-passport-guide.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/passport-event-300.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-event-300", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/prepare-people-to-use-microsoft-passport.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-prepare-people-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/why-a-pin-is-better-than-a-password.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-hello-in-enterprise.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business#manage-apps-in-your-inventory", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/app-inventory-management-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-microsoft-store-for-business", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/application-development-for-windows-as-a-service.md", -"redirect_url": "https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-accessibility.md", -"redirect_url": "/windows/application-management/app-v/appv-getting-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-accessing-the-client-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-using-the-client-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/disconnect-your-organization-from-microsoft.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/introduction-to-windows-10-servicing.md", -"redirect_url": "/windows/deployment/update/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-cortana-in-enterprise.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-overview.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/manage-inventory-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-accessibility.md", -"redirect_url": "/windows/configuration/ue-v/uev-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-privacy-statement.md", -"redirect_url": "/windows/configuration/ue-v/uev-security-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/act-community-ratings-and-process.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/act-database-configuration.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-database-migration.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-deployment-options.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-glossary.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/activating-and-closing-windows-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-lps-share-permissions.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-operatingsystem-application-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-operatingsystem-computer-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-operatingsystem-device-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-product-and-documentation-resources.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-settings-dialog-box-preferences-tab.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-settings-dialog-box-settings-tab.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-toolbar-icons-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-tools-packages-and-services.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-user-interface-reference.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/adding-or-editing-an-issue.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/adding-or-editing-a-solution.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/analyzing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/application-dialog-box.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/categorizing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/chromebook-migration-guide.md", -"redirect_url": "edu/windows/chromebook-migration-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/common-compatibility-issues.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/compatibility-monitor-users-guide.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/computer-dialog-box.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/configuring-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-and-editing-issues-and-solutions.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-an-inventory-collector-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-a-runtime-analysis-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/customizing-your-report-views.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deciding-which-applications-to-test.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deleting-a-data-collection-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deploying-an-inventory-collector-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deploying-a-runtime-analysis-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deploy-windows-10-in-a-school.md", -"redirect_url": "/edu/windows/deploy-windows-10-in-a-school", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/example-filter-queries.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/exporting-a-data-collection-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/filtering-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/fixing-compatibility-issues.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/identifying-computers-for-inventory-collection.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/integration-with-management-solutions-.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/internet-explorer-web-site-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/labeling-data-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/log-file-locations-for-data-collection-packages.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/managing-your-data-collection-packages.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/organizational-tasks-for-each-report-type.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/organizing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/prioritizing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/ratings-icons-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/resolving-an-issue.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/saving-opening-and-exporting-reports.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/selecting-the-send-and-receive-status-for-an-application.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/selecting-your-compatibility-rating.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/selecting-your-deployment-status.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/sending-and-receiving-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/settings-for-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/setup-and-deployment.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/software-requirements-for-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/software-requirements-for-rap.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/taking-inventory-of-your-organization.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/testing-compatibility-on-the-target-platform.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-act-database-issues.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-the-act-configuration-wizard.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-the-act-log-processing-service.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/using-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/using-compatibility-monitor-to-send-feedback.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/viewing-your-compatibility-reports.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/websiteurl-dialog-box.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/welcome-to-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/whats-new-in-act-60.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/windows-10-guidance-for-education-environments.md", -"redirect_url": "/edu/windows/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-servicing-options.md", -"redirect_url": "/windows/deployment/update/waas-overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/windows-update-for-business.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/applocker.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/bitlocker.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/change-history-for-what-s-new-in-windows-10.md", -"redirect_url": "/windows/whats-new/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/credential-guard.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/device-guard-overview.md", -"redirect_url": "/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/device-management.md", -"redirect_url": "/windows/client-management/index", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/edge-ie11-whats-new-overview.md", -"redirect_url": "/microsoft-edge/deploy/enterprise-guidance-using-microsoft-edge-and-ie11", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/edp-whats-new-overview.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/lockdown-features-windows-10.md", -"redirect_url": "/windows/configuration/lockdown-features-windows-10", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/microsoft-passport.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/new-provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/security-auditing.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/trusted-platform-module.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/user-account-control.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/windows-spotlight.md", -"redirect_url": "/windows/configuration/windows-spotlight", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/microsoft-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/windows-update-for-business.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/windows-10-security-guide.md", -"redirect_url": "/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/security.md", -"redirect_url": "/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": false -}, -{ -"source_path": "windows/configure/basic-level-windows-diagnostic-events-and-fields-1703.md", -"redirect_url": "/windows/configuration/basic-level-windows-diagnostic-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/change-history-for-configure-windows-10.md", -"redirect_url": "/windows/configuration/change-history-for-configure-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/changes-to-start-policies-in-windows-10.md", -"redirect_url": "/windows/configuration/changes-to-start-policies-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-devices-without-mdm.md", -"redirect_url": "/windows/configuration/configure-devices-without-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/configure-devices-without-mdm.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/configure-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-windows-10-taskbar.md", -"redirect_url": "/windows/configuration/configure-windows-10-taskbar", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-crm.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-crm", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-feedback.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-feedback", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-o365.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-o365", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-overview.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-policy-settings.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-powerbi.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-powerbi", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-1.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-2.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-3.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-4.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-5.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-6.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-7.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-testing-scenarios.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-voice-commands.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-and-export-start-layout.md", -"redirect_url": "/windows/configuration/customize-and-export-start-layout", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-windows-10-start-screens-by-using-group-policy.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/guidelines-for-assigned-access-app.md", -"redirect_url": "/windows/configuration/guidelines-for-assigned-access-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/how-it-pros-can-use-configuration-service-providers.md", -"redirect_url": "/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/kiosk-shared-pc.md", -"redirect_url": "/windows/configuration/kiosk-shared-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/kiosk-shared-pc.md", -"redirect_url": "/windows/configuration/kiosk-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/setup-kiosk-digital-signage.md", -"redirect_url": "/windows/configuration/kiosk-single-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/multi-app-kiosk-xml.md", -"redirect_url": "/windows/configuration/kiosk-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/multi-app-kiosk-troubleshoot.md", -"redirect_url": "/windows/configuration/kiosk-troubleshoot", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lock-down-windows-10-to-specific-apps.md", -"redirect_url": "/windows/configuration/lock-down-windows-10-to-specific-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lock-down-windows-10.md", -"redirect_url": "/windows/configuration/lock-down-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lockdown-features-windows-10.md", -"redirect_url": "/windows/configuration/lockdown-features-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lockdown-xml.md", -"redirect_url": "/windows/configuration/mobile-devices/lockdown-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/manage-tips-and-suggestions.md", -"redirect_url": "/windows/configuration/manage-tips-and-suggestions", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/manage-wifi-sense-in-enterprise.md", -"redirect_url": "/windows/configuration/manage-wifi-sense-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/mobile-lockdown-designer.md", -"redirect_url": "/windows/configuration/mobile-devices/mobile-lockdown-designer", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/product-ids-in-windows-10-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provision-pcs-for-initial-deployment.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provision-pcs-with-apps-and-certificates.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provision-pcs-with-apps.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-with-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-apply-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-apply-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-command-line.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-command-line", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-configure-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/provisioning-configure-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-create-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-create-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-how-it-works.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-install-icd.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-install-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-multivariant.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-multivariant", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-nfc.md", -"redirect_url": "/windows/configuration/mobile-devices/provisioning-nfc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-package-splitter.md", -"redirect_url": "/windows/configuration/mobile-devices/provisioning-package-splitter", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-powershell.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-script-to-install-app.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-script-to-install-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-uninstall-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-uninstall-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "/windows/configuration/set-up-a-device-for-anyone-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", -"redirect_url": "/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", -"redirect_document_id": true -}, -{ - "source_path": "windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", - "redirect_url": "/windows/configuration/setup-kiosk-digital-signage", - "redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", -"redirect_url": "/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-shared-or-guest-pc.md", -"redirect_url": "/windows/configuration/set-up-shared-or-guest-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/settings-that-can-be-locked-down.md", -"redirect_url": "/windows/configuration/mobile-devices/settings-that-can-be-locked-down", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-layout-xml-desktop.md", -"redirect_url": "/windows/configuration/start-layout-xml-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-layout-xml-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/start-layout-xml-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-secondary-tiles.md", -"redirect_url": "/windows/configuration/start-secondary-tiles", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-taskbar-lockscreen.md", -"redirect_url": "/windows/configuration/start-taskbar-lockscreen", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/start-taskbar-lockscreen.md", -"redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/stop-employees-from-using-the-windows-store.md", -"redirect_url": "/windows/configuration/stop-employees-from-using-the-windows-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/windows-10-start-layout-options-and-policies.md", -"redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/windows-diagnostic-data-1703.md", -"redirect_url": "/windows/configuration/windows-diagnostic-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/windows-spotlight.md", -"redirect_url": "/windows/configuration/windows-spotlight", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-spotlight.md", -"redirect_url": "/windows/configuration/windows-spotlight", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-forest-by-proxy-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-forest-by-proxy-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-forest-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-forest-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-using-active-directory-based-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-using-key-management-service-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-using-key-management-service-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-windows-10-clients-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-windows-10-clients-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/active-directory-based-activation-overview.md", -"redirect_url": "/windows/deployment/volume-activation/active-directory-based-activation-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-manage-products-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/add-manage-products-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-remove-computers-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/add-remove-computers-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-remove-product-key-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/add-remove-product-key-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/assign-applications-using-roles-in-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/assign-applications-using-roles-in-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/change-history-for-deploy-windows-10.md", -"redirect_url": "/windows/deployment/change-history-for-deploy-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-a-pxe-server-to-load-windows-pe.md", -"redirect_url": "/windows/deployment/configure-a-pxe-server-to-load-windows-pe", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-client-computers-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/configure-client-computers-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-2013-for-userexit-scripts.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-2013-for-userexit-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-2013-settings.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-2013-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-deployment-share-rules.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-for-userexit-scripts.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-settings.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-a-windows-10-reference-image.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-a-windows-10-image-using-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-whats-new.md", -"redirect_url": "/windows/deployment/deploy-whats-new", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-windows-to-go.md", -"redirect_url": "/windows/deployment/deploy-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/getting-started-with-the-user-state-migration-tool.md", -"redirect_url": "/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/import-export-vamt-data.md", -"redirect_url": "/windows/deployment/volume-activation/import-export-vamt-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-configure-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-configure-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-kms-client-key-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-kms-client-key-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-product-key-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-product-key-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/integrate-configuration-manager-with-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/integrate-configuration-manager-with-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/introduction-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/introduction-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/key-features-in-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/key-features-in-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/key-features-in-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/key-features-in-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/kms-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/kms-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/local-reactivation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/local-reactivation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-activations-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/manage-activations-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-product-keys-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/manage-product-keys-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-vamt-data.md", -"redirect_url": "/windows/deployment/volume-activation/manage-vamt-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-analytics.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-readiness.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/mbr-to-gpt.md", -"redirect_url": "/windows/deployment/mbr-to-gpt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/mdt-2013-lite-touch-components.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/mdt-2013-lite-touch-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/mdt-lite-touch-components.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/migrate-application-settings.md", -"redirect_url": "/windows/deployment/usmt/migrate-application-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/migration-store-types-overview.md", -"redirect_url": "/windows/deployment/usmt/migration-store-types-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/monitor-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/monitor-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/offline-migration-reference.md", -"redirect_url": "/windows/deployment/usmt/offline-migration-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/online-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/online-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/plan-for-volume-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/plan-for-volume-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/proxy-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/proxy-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/refresh-a-windows-7-computer-with-windows-10.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/remove-products-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/remove-products-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/resolve-windows-10-upgrade-errors.md", -"redirect_url": "/windows/deployment/upgrade/resolve-windows-10-upgrade-errors", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/scenario-kms-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/scenario-kms-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/scenario-online-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/scenario-online-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/scenario-proxy-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/scenario-proxy-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/set-up-mdt-2013-for-bitlocker.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/set-up-mdt-2013-for-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/set-up-mdt-for-bitlocker.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/sideload-apps-in-windows-10.md", -"redirect_url": "/windows/application-management/sideload-apps-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/troubleshoot-upgrade-analytics.md", -"redirect_url": "/windows/deployment/upgrade/troubleshoot-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/troubleshoot-upgrade-readiness.md", -"redirect_url": "/windows/deployment/upgrade/troubleshoot-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/understanding-migration-xml-files.md", -"redirect_url": "/windows/deployment/usmt/understanding-migration-xml-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/update-product-status-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/update-product-status-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-additional-insights.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-additional-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-architecture.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-deploy-windows.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deploy-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-deployment-script.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deployment-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-get-started.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-identify-apps.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-identify-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-requirements.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-resolve-issues.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-resolve-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-upgrade-overview.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-additional-insights.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-additional-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-architecture.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-deploy-windows.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deploy-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-deployment-script.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deployment-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-get-started.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-identify-apps.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-identify-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-release-notes.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-release-notes", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-requirements.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-resolve-issues.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-resolve-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-upgrade-overview.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-windows-phone-8-1-to-10.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-the-volume-activation-management-tool-client.md", -"redirect_url": "/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md", -"redirect_url": "/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-upgrade-readiness-to-manage-windows-upgrades.md", -"redirect_url": "/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-vamt-in-windows-powershell.md", -"redirect_url": "/windows/deployment/volume-activation/use-vamt-in-windows-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-web-services-in-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-web-services-in-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-best-practices.md", -"redirect_url": "/windows/deployment/usmt/usmt-best-practices", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-choose-migration-store-type.md", -"redirect_url": "/windows/deployment/usmt/usmt-choose-migration-store-type", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-command-line-syntax.md", -"redirect_url": "/windows/deployment/usmt/usmt-command-line-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-common-issues.md", -"redirect_url": "/windows/deployment/usmt/usmt-common-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-common-migration-scenarios.md", -"redirect_url": "/windows/deployment/usmt/usmt-common-migration-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-configxml-file.md", -"redirect_url": "/windows/deployment/usmt/usmt-configxml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-conflicts-and-precedence.md", -"redirect_url": "/windows/deployment/usmt/usmt-conflicts-and-precedence", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-custom-xml-examples.md", -"redirect_url": "/windows/deployment/usmt/usmt-custom-xml-examples", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-customize-xml-files.md", -"redirect_url": "/windows/deployment/usmt/usmt-customize-xml-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-determine-what-to-migrate.md", -"redirect_url": "/windows/deployment/usmt/usmt-determine-what-to-migrate", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-estimate-migration-store-size.md", -"redirect_url": "/windows/deployment/usmt/usmt-estimate-migration-store-size", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-exclude-files-and-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-exclude-files-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md", -"redirect_url": "/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-faq.md", -"redirect_url": "/windows/deployment/usmt/usmt-faq", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-general-conventions.md", -"redirect_url": "/windows/deployment/usmt/usmt-general-conventions", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-hard-link-migration-store.md", -"redirect_url": "/windows/deployment/usmt/usmt-hard-link-migration-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-how-it-works.md", -"redirect_url": "/windows/deployment/usmt/usmt-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-how-to.md", -"redirect_url": "/windows/deployment/usmt/usmt-how-to", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-application-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-application-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-file-types-files-and-folders.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-file-types-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-operating-system-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-operating-system-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-users.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-include-files-and-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-include-files-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-loadstate-syntax.md", -"redirect_url": "/windows/deployment/usmt/usmt-loadstate-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-log-files.md", -"redirect_url": "/windows/deployment/usmt/usmt-log-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-migrate-efs-files-and-certificates.md", -"redirect_url": "/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-migrate-user-accounts.md", -"redirect_url": "/windows/deployment/usmt/usmt-migrate-user-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-migration-store-encryption.md", -"redirect_url": "/windows/deployment/usmt/usmt-migration-store-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-overview.md", -"redirect_url": "/windows/deployment/usmt/usmt-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-plan-your-migration.md", -"redirect_url": "/windows/deployment/usmt/usmt-plan-your-migration", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-recognized-environment-variables.md", -"redirect_url": "/windows/deployment/usmt/usmt-recognized-environment-variables", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-reference.md", -"redirect_url": "/windows/deployment/usmt/usmt-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-requirements.md", -"redirect_url": "/windows/deployment/usmt/usmt-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-reroute-files-and-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-reroute-files-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-resources.md", -"redirect_url": "/windows/deployment/usmt/usmt-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-return-codes.md", -"redirect_url": "/windows/deployment/usmt/usmt-return-codes", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-scanstate-syntax.md", -"redirect_url": "/windows/deployment/usmt/usmt-scanstate-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-technical-reference.md", -"redirect_url": "/windows/deployment/usmt/usmt-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-test-your-migration.md", -"redirect_url": "/windows/deployment/usmt/usmt-test-your-migration", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-topics.md", -"redirect_url": "/windows/deployment/usmt/usmt-topics", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-troubleshooting.md", -"redirect_url": "/windows/deployment/usmt/usmt-troubleshooting", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-utilities.md", -"redirect_url": "/windows/deployment/usmt/usmt-utilities", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-what-does-usmt-migrate.md", -"redirect_url": "/windows/deployment/usmt/usmt-what-does-usmt-migrate", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-xml-elements-library.md", -"redirect_url": "/windows/deployment/usmt/usmt-xml-elements-library", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-xml-reference.md", -"redirect_url": "/windows/deployment/usmt/usmt-xml-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/vamt-known-issues.md", -"redirect_url": "/windows/deployment/volume-activation/vamt-known-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/vamt-requirements.md", -"redirect_url": "/windows/deployment/volume-activation/vamt-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/vamt-step-by-step.md", -"redirect_url": "/windows/deployment/volume-activation/vamt-step-by-step", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/verify-the-condition-of-a-compressed-migration-store.md", -"redirect_url": "/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/volume-activation-management-tool.md", -"redirect_url": "/windows/deployment/volume-activation/volume-activation-management-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/volume-activation-windows-10.md", -"redirect_url": "/windows/deployment/volume-activation/volume-activation-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-deployment-scenarios.md", -"redirect_url": "/windows/deployment/windows-10-deployment-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-deployment-tools-reference.md", -"redirect_url": "/windows/deployment/windows-10-deployment-tools-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-edition-upgrades.md", -"redirect_url": "/windows/deployment/upgrade/windows-10-edition-upgrades", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-enterprise-e3-overview.md", -"redirect_url": "/windows/deployment/windows-10-enterprise-e3-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-poc-mdt.md", -"redirect_url": "/windows/deployment/windows-10-poc-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-poc-sc-config-mgr.md", -"redirect_url": "/windows/deployment/windows-10-poc-sc-config-mgr", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-poc.md", -"redirect_url": "/windows/deployment/windows-10-poc", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-upgrade-paths.md", -"redirect_url": "/windows/deployment/upgrade/windows-10-upgrade-paths", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-adk-scenarios-for-it-pros.md", -"redirect_url": "/windows/deployment/windows-adk-scenarios-for-it-pros", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-deployment-scenarios-and-tools.md", -"redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-upgrade-and-migration-considerations.md", -"redirect_url": "/windows/deployment/upgrade/windows-upgrade-and-migration-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/xml-file-requirements.md", -"redirect_url": "/windows/deployment/usmt/xml-file-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/access-control.md", -"redirect_url": "/windows/access-protection/access-control/access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/access-credential-manager-as-a-trusted-caller.md", -"redirect_url": "/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/access-this-computer-from-the-network.md", -"redirect_url": "/windows/device-security/security-policy-settings/access-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-lockout-duration.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-lockout-duration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-lockout-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-lockout-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-lockout-threshold.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-policies.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-administrator-account-status.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-administrator-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-block-microsoft-accounts.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-guest-account-status.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-guest-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-rename-administrator-account.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-rename-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-rename-guest-account.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-rename-guest-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/act-as-part-of-the-operating-system.md", -"redirect_url": "/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/active-directory-accounts.md", -"redirect_url": "/windows/access-protection/access-control/active-directory-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/active-directory-security-groups.md", -"redirect_url": "/windows/access-protection/access-control/active-directory-security-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-workstations-to-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/add-workstations-to-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/additional-mitigations.md", -"redirect_url": "/windows/access-protection/credential-guard/additional-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/adjust-memory-quotas-for-a-process.md", -"redirect_url": "/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/administer-applocker.md", -"redirect_url": "/windows/device-security/applocker/administer-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/administer-security-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/administer-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/device-security/auditing/advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-security-auditing-faq.md", -"redirect_url": "/windows/device-security/auditing/advanced-security-auditing-faq", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-security-auditing.md", -"redirect_url": "/windows/device-security/auditing/advanced-security-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/allow-log-on-locally.md", -"redirect_url": "/windows/device-security/security-policy-settings/allow-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/allow-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/app-behavior-with-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/app-behavior-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", -"redirect_url": "/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-architecture-and-components.md", -"redirect_url": "/windows/device-security/applocker/applocker-architecture-and-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-functions.md", -"redirect_url": "/windows/device-security/applocker/applocker-functions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-overview.md", -"redirect_url": "/windows/device-security/applocker/applocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-policies-deployment-guide.md", -"redirect_url": "/windows/device-security/applocker/applocker-policies-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-policies-design-guide.md", -"redirect_url": "/windows/device-security/applocker/applocker-policies-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-policy-use-scenarios.md", -"redirect_url": "/windows/device-security/applocker/applocker-policy-use-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-processes-and-interactions.md", -"redirect_url": "/windows/device-security/applocker/applocker-processes-and-interactions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-settings.md", -"redirect_url": "/windows/device-security/applocker/applocker-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-technical-reference.md", -"redirect_url": "/windows/device-security/applocker/applocker-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md", -"redirect_url": "/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/assign-security-group-filters-to-the-gpo.md", -"redirect_url": "/windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-account-lockout.md", -"redirect_url": "/windows/device-security/auditing/audit-account-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-application-generated.md", -"redirect_url": "/windows/device-security/auditing/audit-application-generated", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-application-group-management.md", -"redirect_url": "/windows/device-security/auditing/audit-application-group-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-audit-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-audit-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-audit-the-access-of-global-system-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-authentication-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-authentication-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-authorization-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-authorization-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-central-access-policy-staging.md", -"redirect_url": "/windows/device-security/auditing/audit-central-access-policy-staging", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-certification-services.md", -"redirect_url": "/windows/device-security/auditing/audit-certification-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-computer-account-management.md", -"redirect_url": "/windows/device-security/auditing/audit-computer-account-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-credential-validation.md", -"redirect_url": "/windows/device-security/auditing/audit-credential-validation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-detailed-directory-service-replication.md", -"redirect_url": "/windows/device-security/auditing/audit-detailed-directory-service-replication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-detailed-file-share.md", -"redirect_url": "/windows/device-security/auditing/audit-detailed-file-share", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-directory-service-access.md", -"redirect_url": "/windows/device-security/auditing/audit-directory-service-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-directory-service-changes.md", -"redirect_url": "/windows/device-security/auditing/audit-directory-service-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-directory-service-replication.md", -"redirect_url": "/windows/device-security/auditing/audit-directory-service-replication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-distribution-group-management.md", -"redirect_url": "/windows/device-security/auditing/audit-distribution-group-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-dpapi-activity.md", -"redirect_url": "/windows/device-security/auditing/audit-dpapi-activity", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-file-share.md", -"redirect_url": "/windows/device-security/auditing/audit-file-share", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-file-system.md", -"redirect_url": "/windows/device-security/auditing/audit-file-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-filtering-platform-connection.md", -"redirect_url": "/windows/device-security/auditing/audit-filtering-platform-connection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-filtering-platform-packet-drop.md", -"redirect_url": "/windows/device-security/auditing/audit-filtering-platform-packet-drop", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-filtering-platform-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-filtering-platform-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-group-membership.md", -"redirect_url": "/windows/device-security/auditing/audit-group-membership", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-handle-manipulation.md", -"redirect_url": "/windows/device-security/auditing/audit-handle-manipulation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-driver.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-driver", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-extended-mode.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-extended-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-main-mode.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-main-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-quick-mode.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-quick-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-kerberos-authentication-service.md", -"redirect_url": "/windows/device-security/auditing/audit-kerberos-authentication-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-kerberos-service-ticket-operations.md", -"redirect_url": "/windows/device-security/auditing/audit-kerberos-service-ticket-operations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-kernel-object.md", -"redirect_url": "/windows/device-security/auditing/audit-kernel-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-logoff.md", -"redirect_url": "/windows/device-security/auditing/audit-logoff", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-logon.md", -"redirect_url": "/windows/device-security/auditing/audit-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-mpssvc-rule-level-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-network-policy-server.md", -"redirect_url": "/windows/device-security/auditing/audit-network-policy-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-non-sensitive-privilege-use.md", -"redirect_url": "/windows/device-security/auditing/audit-non-sensitive-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-account-logon-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-account-logon-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-account-management-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-account-management-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-logonlogoff-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-logonlogoff-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-object-access-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-object-access-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-policy-change-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-policy-change-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-privilege-use-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-privilege-use-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-system-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-system-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-pnp-activity.md", -"redirect_url": "/windows/device-security/auditing/audit-pnp-activity", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-process-creation.md", -"redirect_url": "/windows/device-security/auditing/audit-process-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-process-termination.md", -"redirect_url": "/windows/device-security/auditing/audit-process-termination", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-registry.md", -"redirect_url": "/windows/device-security/auditing/audit-registry", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-removable-storage.md", -"redirect_url": "/windows/device-security/auditing/audit-removable-storage", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-rpc-events.md", -"redirect_url": "/windows/device-security/auditing/audit-rpc-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-sam.md", -"redirect_url": "/windows/device-security/auditing/audit-sam", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-security-group-management.md", -"redirect_url": "/windows/device-security/auditing/audit-security-group-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-security-state-change.md", -"redirect_url": "/windows/device-security/auditing/audit-security-state-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-security-system-extension.md", -"redirect_url": "/windows/device-security/auditing/audit-security-system-extension", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-sensitive-privilege-use.md", -"redirect_url": "/windows/device-security/auditing/audit-sensitive-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-special-logon.md", -"redirect_url": "/windows/device-security/auditing/audit-special-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-system-integrity.md", -"redirect_url": "/windows/device-security/auditing/audit-system-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-user-account-management.md", -"redirect_url": "/windows/device-security/auditing/audit-user-account-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-user-device-claims.md", -"redirect_url": "/windows/device-security/auditing/audit-user-device-claims", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/back-up-files-and-directories.md", -"redirect_url": "/windows/device-security/security-policy-settings/back-up-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-account-logon-events.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-account-logon-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-account-management.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-account-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-directory-service-access.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-directory-service-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-logon-events.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-logon-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-object-access.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-object-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-policy-change.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-privilege-use.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-process-tracking.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-process-tracking", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-system-events.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-system-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-firewall-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-security-audit-policies.md", -"redirect_url": "/windows/device-security/auditing/basic-security-audit-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-security-audit-policy-settings.md", -"redirect_url": "/windows/device-security/auditing/basic-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bcd-settings-and-bitlocker.md", -"redirect_url": "/windows/device-security/bitlocker/bcd-settings-and-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-basic-deployment.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-basic-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-countermeasures.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-countermeasures", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-device-encryption-overview-windows-10.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-frequently-asked-questions.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-frequently-asked-questions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-group-policy-settings.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-how-to-enable-network-unlock.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-overview.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-recovery-guide-plan.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-recovery-guide-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/block-untrusted-fonts-in-enterprise.md", -"redirect_url": "/windows/threat-protection/block-untrusted-fonts-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/boundary-zone-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/boundary-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/boundary-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bypass-traverse-checking.md", -"redirect_url": "/windows/device-security/security-policy-settings/bypass-traverse-checking", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/certificate-based-isolation-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-rules-from-request-to-require-mode.md", -"redirect_url": "/windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-the-system-time.md", -"redirect_url": "/windows/device-security/security-policy-settings/change-the-system-time", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-the-time-zone.md", -"redirect_url": "/windows/device-security/security-policy-settings/change-the-time-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-the-tpm-owner-password.md", -"redirect_url": "/windows/device-security/tpm/change-the-tpm-owner-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-basic-firewall-settings.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-group-policy-objects.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-group-policy-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-inbound-firewall-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-outbound-firewall-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/command-line-arguments-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configuration-management-reference-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-authentication-methods.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-authentication-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-data-protection-quick-mode-settings.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-key-exchange-main-mode-settings.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-network-connections-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-notifications-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-protection-features-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-remediation-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-s-mime.md", -"redirect_url": "/windows/access-protection/configure-s-mime", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-application-identity-service.md", -"redirect_url": "/windows/device-security/applocker/configure-the-application-identity-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-appLocker-reference-device.md", -"redirect_url": "/windows/device-security/applocker/configure-the-appLocker-reference-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-rules-to-require-encryption.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-windows-firewall-log.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-the-windows-firewall-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-workstation-authentication-certificate-template.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-windows-defender-antivirus-features.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md", -"redirect_url": "/windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md", -"redirect_url": "/windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md", -"redirect_url": "/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-group-account-in-active-directory.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-a-group-account-in-active-directory", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-group-policy-object.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-a-group-policy-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-pagefile.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-a-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-for-packaged-apps.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-for-packaged-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-token-object.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-a-token-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-authentication-exemption-list-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-authentication-request-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-authentication-request-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-inbound-icmp-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-inbound-icmp-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-inbound-port-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-inbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-inbound-program-or-service-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-outbound-port-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-outbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-outbound-program-or-service-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-and-verify-an-efs-dra-certificate.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-applocker-default-rules.md", -"redirect_url": "/windows/device-security/applocker/create-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-global-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-global-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-inbound-rules-to-support-rpc.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-permanent-shared-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-permanent-shared-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-symbolic-links.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-symbolic-links", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-wip-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-wip-policy-using-sccm.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-wmi-filters-for-the-gpo.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-your-applocker-planning-document.md", -"redirect_url": "/windows/device-security/applocker/create-your-applocker-planning-document", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-your-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/create-your-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-your-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/create-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-considerations.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-how-it-works.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-manage.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-manage", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-not-protected-scenarios.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-not-protected-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-protection-limits.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-protection-limits", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-requirements.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-scripts.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/customize-run-review-remediate-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/debug-programs.md", -"redirect_url": "/windows/device-security/security-policy-settings/debug-programs", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/delete-an-applocker-rule.md", -"redirect_url": "/windows/device-security/applocker/delete-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-access-to-this-computer-from-the-network.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-as-a-batch-job.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-as-a-service.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-locally.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md", -"redirect_url": "/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-code-integrity-policies-steps.md", -"redirect_url": "/windows/device-security/device-guard/deploy-code-integrity-policies-steps", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md", -"redirect_url": "/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-the-applocker-policy-into-production.md", -"redirect_url": "/windows/device-security/applocker/deploy-the-applocker-policy-into-production", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-wip-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deployment-vdi-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md", -"redirect_url": "/windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determine-your-application-control-objectives.md", -"redirect_url": "/windows/device-security/applocker/determine-your-application-control-objectives", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determining-the-trusted-state-of-your-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/device-guard-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-allow-undock-without-having-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dll-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/dll-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-your-application-control-management-processes.md", -"redirect_url": "/windows/device-security/applocker/document-your-application-control-management-processes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-your-application-list.md", -"redirect_url": "/windows/device-security/applocker/document-your-application-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-your-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/document-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/documenting-the-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/documenting-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-controller-ldap-server-signing-requirements.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-isolation-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/domain-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-disable-machine-account-password-changes.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-maximum-machine-account-password-age.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dynamic-access-control.md", -"redirect_url": "/windows/access-protection/access-control/dynamic-access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/edit-an-applocker-policy.md", -"redirect_url": "/windows/device-security/applocker/edit-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/edit-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/edit-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", -"redirect_url": "/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-predefined-inbound-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/enable-predefined-inbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-predefined-outbound-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/enable-predefined-outbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-the-dll-rule-collection.md", -"redirect_url": "/windows/device-security/applocker/enable-the-dll-rule-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/encrypted-hard-drive.md", -"redirect_url": "/windows/device-security/encrypted-hard-drive", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/encryption-zone-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/encryption-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/encryption-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enforce-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/enforce-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enforce-password-history.md", -"redirect_url": "/windows/device-security/security-policy-settings/enforce-password-history", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enforce-user-logon-restrictions.md", -"redirect_url": "/windows/device-security/security-policy-settings/enforce-user-logon-restrictions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enlightened-microsoft-apps-and-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enterprise-certificate-pinning.md", -"redirect_url": "/windows/access-protection/enterprise-certificate-pinning", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/evaluate-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md", -"redirect_url": "/windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1100.md", -"redirect_url": "/windows/device-security/auditing/event-1100", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1102.md", -"redirect_url": "/windows/device-security/auditing/event-1102", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1104.md", -"redirect_url": "/windows/device-security/auditing/event-1104", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1105.md", -"redirect_url": "/windows/device-security/auditing/event-1105", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1108.md", -"redirect_url": "/windows/device-security/auditing/event-1108", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4608.md", -"redirect_url": "/windows/device-security/auditing/event-4608", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4610.md", -"redirect_url": "/windows/device-security/auditing/event-4610", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4611.md", -"redirect_url": "/windows/device-security/auditing/event-4611", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4612.md", -"redirect_url": "/windows/device-security/auditing/event-4612", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4614.md", -"redirect_url": "/windows/device-security/auditing/event-4614", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4615.md", -"redirect_url": "/windows/device-security/auditing/event-4615", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4616.md", -"redirect_url": "/windows/device-security/auditing/event-4616", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4618.md", -"redirect_url": "/windows/device-security/auditing/event-4618", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4621.md", -"redirect_url": "/windows/device-security/auditing/event-4621", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4622.md", -"redirect_url": "/windows/device-security/auditing/event-4622", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4624.md", -"redirect_url": "/windows/device-security/auditing/event-4624", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4625.md", -"redirect_url": "/windows/device-security/auditing/event-4625", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4626.md", -"redirect_url": "/windows/device-security/auditing/event-4626", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4627.md", -"redirect_url": "/windows/device-security/auditing/event-4627", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4634.md", -"redirect_url": "/windows/device-security/auditing/event-4634", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4647.md", -"redirect_url": "/windows/device-security/auditing/event-4647", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4648.md", -"redirect_url": "/windows/device-security/auditing/event-4648", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4649.md", -"redirect_url": "/windows/device-security/auditing/event-4649", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4656.md", -"redirect_url": "/windows/device-security/auditing/event-4656", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4657.md", -"redirect_url": "/windows/device-security/auditing/event-4657", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4658.md", -"redirect_url": "/windows/device-security/auditing/event-4658", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4660.md", -"redirect_url": "/windows/device-security/auditing/event-4660", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4661.md", -"redirect_url": "/windows/device-security/auditing/event-4661", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4662.md", -"redirect_url": "/windows/device-security/auditing/event-4662", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4663.md", -"redirect_url": "/windows/device-security/auditing/event-4663", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4664.md", -"redirect_url": "/windows/device-security/auditing/event-4664", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4670.md", -"redirect_url": "/windows/device-security/auditing/event-4670", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4671.md", -"redirect_url": "/windows/device-security/auditing/event-4671", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4672.md", -"redirect_url": "/windows/device-security/auditing/event-4672", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4673.md", -"redirect_url": "/windows/device-security/auditing/event-4673", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4674.md", -"redirect_url": "/windows/device-security/auditing/event-4674", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4675.md", -"redirect_url": "/windows/device-security/auditing/event-4675", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4688.md", -"redirect_url": "/windows/device-security/auditing/event-4688", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4689.md", -"redirect_url": "/windows/device-security/auditing/event-4689", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4690.md", -"redirect_url": "/windows/device-security/auditing/event-4690", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4691.md", -"redirect_url": "/windows/device-security/auditing/event-4691", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4692.md", -"redirect_url": "/windows/device-security/auditing/event-4692", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4693.md", -"redirect_url": "/windows/device-security/auditing/event-4693", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4694.md", -"redirect_url": "/windows/device-security/auditing/event-4694", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4695.md", -"redirect_url": "/windows/device-security/auditing/event-4695", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4696.md", -"redirect_url": "/windows/device-security/auditing/event-4696", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4697.md", -"redirect_url": "/windows/device-security/auditing/event-4697", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4698.md", -"redirect_url": "/windows/device-security/auditing/event-4698", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4699.md", -"redirect_url": "/windows/device-security/auditing/event-4699", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4700.md", -"redirect_url": "/windows/device-security/auditing/event-4700", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4701.md", -"redirect_url": "/windows/device-security/auditing/event-4701", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4702.md", -"redirect_url": "/windows/device-security/auditing/event-4702", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4703.md", -"redirect_url": "/windows/device-security/auditing/event-4703", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4704.md", -"redirect_url": "/windows/device-security/auditing/event-4704", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4705.md", -"redirect_url": "/windows/device-security/auditing/event-4705", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4706.md", -"redirect_url": "/windows/device-security/auditing/event-4706", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4707.md", -"redirect_url": "/windows/device-security/auditing/event-4707", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4713.md", -"redirect_url": "/windows/device-security/auditing/event-4713", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4714.md", -"redirect_url": "/windows/device-security/auditing/event-4714", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4715.md", -"redirect_url": "/windows/device-security/auditing/event-4715", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4716.md", -"redirect_url": "/windows/device-security/auditing/event-4716", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4717.md", -"redirect_url": "/windows/device-security/auditing/event-4717", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4718.md", -"redirect_url": "/windows/device-security/auditing/event-4718", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4719.md", -"redirect_url": "/windows/device-security/auditing/event-4719", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4720.md", -"redirect_url": "/windows/device-security/auditing/event-4720", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4722.md", -"redirect_url": "/windows/device-security/auditing/event-4722", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4723.md", -"redirect_url": "/windows/device-security/auditing/event-4723", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4724.md", -"redirect_url": "/windows/device-security/auditing/event-4724", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4725.md", -"redirect_url": "/windows/device-security/auditing/event-4725", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4726.md", -"redirect_url": "/windows/device-security/auditing/event-4726", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4731.md", -"redirect_url": "/windows/device-security/auditing/event-4731", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4732.md", -"redirect_url": "/windows/device-security/auditing/event-4732", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4733.md", -"redirect_url": "/windows/device-security/auditing/event-4733", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4734.md", -"redirect_url": "/windows/device-security/auditing/event-4734", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4735.md", -"redirect_url": "/windows/device-security/auditing/event-4735", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4738.md", -"redirect_url": "/windows/device-security/auditing/event-4738", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4739.md", -"redirect_url": "/windows/device-security/auditing/event-4739", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4740.md", -"redirect_url": "/windows/device-security/auditing/event-4740", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4741.md", -"redirect_url": "/windows/device-security/auditing/event-4741", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4742.md", -"redirect_url": "/windows/device-security/auditing/event-4742", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4743.md", -"redirect_url": "/windows/device-security/auditing/event-4743", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4749.md", -"redirect_url": "/windows/device-security/auditing/event-4749", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4750.md", -"redirect_url": "/windows/device-security/auditing/event-4750", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4751.md", -"redirect_url": "/windows/device-security/auditing/event-4751", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4752.md", -"redirect_url": "/windows/device-security/auditing/event-4752", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4753.md", -"redirect_url": "/windows/device-security/auditing/event-4753", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4764.md", -"redirect_url": "/windows/device-security/auditing/event-4764", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4765.md", -"redirect_url": "/windows/device-security/auditing/event-4765", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4766.md", -"redirect_url": "/windows/device-security/auditing/event-4766", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4767.md", -"redirect_url": "/windows/device-security/auditing/event-4767", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4768.md", -"redirect_url": "/windows/device-security/auditing/event-4768", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4769.md", -"redirect_url": "/windows/device-security/auditing/event-4769", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4770.md", -"redirect_url": "/windows/device-security/auditing/event-4770", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4771.md", -"redirect_url": "/windows/device-security/auditing/event-4771", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4772.md", -"redirect_url": "/windows/device-security/auditing/event-4772", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4773.md", -"redirect_url": "/windows/device-security/auditing/event-4773", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4774.md", -"redirect_url": "/windows/device-security/auditing/event-4774", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4775.md", -"redirect_url": "/windows/device-security/auditing/event-4775", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4776.md", -"redirect_url": "/windows/device-security/auditing/event-4776", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4777.md", -"redirect_url": "/windows/device-security/auditing/event-4777", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4778.md", -"redirect_url": "/windows/device-security/auditing/event-4778", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4779.md", -"redirect_url": "/windows/device-security/auditing/event-4779", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4780.md", -"redirect_url": "/windows/device-security/auditing/event-4780", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4781.md", -"redirect_url": "/windows/device-security/auditing/event-4781", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4782.md", -"redirect_url": "/windows/device-security/auditing/event-4782", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4793.md", -"redirect_url": "/windows/device-security/auditing/event-4793", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4794.md", -"redirect_url": "/windows/device-security/auditing/event-4794", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4798.md", -"redirect_url": "/windows/device-security/auditing/event-4798", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4799.md", -"redirect_url": "/windows/device-security/auditing/event-4799", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4800.md", -"redirect_url": "/windows/device-security/auditing/event-4800", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4801.md", -"redirect_url": "/windows/device-security/auditing/event-4801", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4802.md", -"redirect_url": "/windows/device-security/auditing/event-4802", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4803.md", -"redirect_url": "/windows/device-security/auditing/event-4803", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4816.md", -"redirect_url": "/windows/device-security/auditing/event-4816", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4817.md", -"redirect_url": "/windows/device-security/auditing/event-4817", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4818.md", -"redirect_url": "/windows/device-security/auditing/event-4818", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4819.md", -"redirect_url": "/windows/device-security/auditing/event-4819", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4826.md", -"redirect_url": "/windows/device-security/auditing/event-4826", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4864.md", -"redirect_url": "/windows/device-security/auditing/event-4864", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4865.md", -"redirect_url": "/windows/device-security/auditing/event-4865", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4866.md", -"redirect_url": "/windows/device-security/auditing/event-4866", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4867.md", -"redirect_url": "/windows/device-security/auditing/event-4867", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4902.md", -"redirect_url": "/windows/device-security/auditing/event-4902", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4904.md", -"redirect_url": "/windows/device-security/auditing/event-4904", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4905.md", -"redirect_url": "/windows/device-security/auditing/event-4905", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4906.md", -"redirect_url": "/windows/device-security/auditing/event-4906", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4907.md", -"redirect_url": "/windows/device-security/auditing/event-4907", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4908.md", -"redirect_url": "/windows/device-security/auditing/event-4908", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4909.md", -"redirect_url": "/windows/device-security/auditing/event-4909", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4910.md", -"redirect_url": "/windows/device-security/auditing/event-4910", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4911.md", -"redirect_url": "/windows/device-security/auditing/event-4911", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4912.md", -"redirect_url": "/windows/device-security/auditing/event-4912", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4913.md", -"redirect_url": "/windows/device-security/auditing/event-4913", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4928.md", -"redirect_url": "/windows/device-security/auditing/event-4928", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4929.md", -"redirect_url": "/windows/device-security/auditing/event-4929", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4930.md", -"redirect_url": "/windows/device-security/auditing/event-4930", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4931.md", -"redirect_url": "/windows/device-security/auditing/event-4931", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4932.md", -"redirect_url": "/windows/device-security/auditing/event-4932", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4933.md", -"redirect_url": "/windows/device-security/auditing/event-4933", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4934.md", -"redirect_url": "/windows/device-security/auditing/event-4934", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4935.md", -"redirect_url": "/windows/device-security/auditing/event-4935", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4936.md", -"redirect_url": "/windows/device-security/auditing/event-4936", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4937.md", -"redirect_url": "/windows/device-security/auditing/event-4937", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4944.md", -"redirect_url": "/windows/device-security/auditing/event-4944", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4945.md", -"redirect_url": "/windows/device-security/auditing/event-4945", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4946.md", -"redirect_url": "/windows/device-security/auditing/event-4946", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4947.md", -"redirect_url": "/windows/device-security/auditing/event-4947", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4948.md", -"redirect_url": "/windows/device-security/auditing/event-4948", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4949.md", -"redirect_url": "/windows/device-security/auditing/event-4949", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4950.md", -"redirect_url": "/windows/device-security/auditing/event-4950", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4951.md", -"redirect_url": "/windows/device-security/auditing/event-4951", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4952.md", -"redirect_url": "/windows/device-security/auditing/event-4952", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4953.md", -"redirect_url": "/windows/device-security/auditing/event-4953", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4954.md", -"redirect_url": "/windows/device-security/auditing/event-4954", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4956.md", -"redirect_url": "/windows/device-security/auditing/event-4956", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4957.md", -"redirect_url": "/windows/device-security/auditing/event-4957", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4958.md", -"redirect_url": "/windows/device-security/auditing/event-4958", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4964.md", -"redirect_url": "/windows/device-security/auditing/event-4964", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4985.md", -"redirect_url": "/windows/device-security/auditing/event-4985", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5024.md", -"redirect_url": "/windows/device-security/auditing/event-5024", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5025.md", -"redirect_url": "/windows/device-security/auditing/event-5025", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5027.md", -"redirect_url": "/windows/device-security/auditing/event-5027", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5028.md", -"redirect_url": "/windows/device-security/auditing/event-5028", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5029.md", -"redirect_url": "/windows/device-security/auditing/event-5029", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5030.md", -"redirect_url": "/windows/device-security/auditing/event-5030", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5031.md", -"redirect_url": "/windows/device-security/auditing/event-5031", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5032.md", -"redirect_url": "/windows/device-security/auditing/event-5032", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5033.md", -"redirect_url": "/windows/device-security/auditing/event-5033", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5034.md", -"redirect_url": "/windows/device-security/auditing/event-5034", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5035.md", -"redirect_url": "/windows/device-security/auditing/event-5035", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5037.md", -"redirect_url": "/windows/device-security/auditing/event-5037", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5038.md", -"redirect_url": "/windows/device-security/auditing/event-5038", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5039.md", -"redirect_url": "/windows/device-security/auditing/event-5039", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5051.md", -"redirect_url": "/windows/device-security/auditing/event-5051", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5056.md", -"redirect_url": "/windows/device-security/auditing/event-5056", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5057.md", -"redirect_url": "/windows/device-security/auditing/event-5057", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5058.md", -"redirect_url": "/windows/device-security/auditing/event-5058", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5059.md", -"redirect_url": "/windows/device-security/auditing/event-5059", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5060.md", -"redirect_url": "/windows/device-security/auditing/event-5060", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5061.md", -"redirect_url": "/windows/device-security/auditing/event-5061", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5062.md", -"redirect_url": "/windows/device-security/auditing/event-5062", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5063.md", -"redirect_url": "/windows/device-security/auditing/event-5063", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5064.md", -"redirect_url": "/windows/device-security/auditing/event-5064", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5065.md", -"redirect_url": "/windows/device-security/auditing/event-5065", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5066.md", -"redirect_url": "/windows/device-security/auditing/event-5066", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5067.md", -"redirect_url": "/windows/device-security/auditing/event-5067", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5068.md", -"redirect_url": "/windows/device-security/auditing/event-5068", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5069.md", -"redirect_url": "/windows/device-security/auditing/event-5069", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5070.md", -"redirect_url": "/windows/device-security/auditing/event-5070", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5136.md", -"redirect_url": "/windows/device-security/auditing/event-5136", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5137.md", -"redirect_url": "/windows/device-security/auditing/event-5137", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5138.md", -"redirect_url": "/windows/device-security/auditing/event-5138", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5139.md", -"redirect_url": "/windows/device-security/auditing/event-5139", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5140.md", -"redirect_url": "/windows/device-security/auditing/event-5140", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5141.md", -"redirect_url": "/windows/device-security/auditing/event-5141", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5142.md", -"redirect_url": "/windows/device-security/auditing/event-5142", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5143.md", -"redirect_url": "/windows/device-security/auditing/event-5143", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5144.md", -"redirect_url": "/windows/device-security/auditing/event-5144", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5145.md", -"redirect_url": "/windows/device-security/auditing/event-5145", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5148.md", -"redirect_url": "/windows/device-security/auditing/event-5148", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5149.md", -"redirect_url": "/windows/device-security/auditing/event-5149", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5150.md", -"redirect_url": "/windows/device-security/auditing/event-5150", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5151.md", -"redirect_url": "/windows/device-security/auditing/event-5151", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5152.md", -"redirect_url": "/windows/device-security/auditing/event-5152", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5153.md", -"redirect_url": "/windows/device-security/auditing/event-5153", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5154.md", -"redirect_url": "/windows/device-security/auditing/event-5154", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5155.md", -"redirect_url": "/windows/device-security/auditing/event-5155", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5156.md", -"redirect_url": "/windows/device-security/auditing/event-5156", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5157.md", -"redirect_url": "/windows/device-security/auditing/event-5157", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5158.md", -"redirect_url": "/windows/device-security/auditing/event-5158", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5159.md", -"redirect_url": "/windows/device-security/auditing/event-5159", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5168.md", -"redirect_url": "/windows/device-security/auditing/event-5168", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5376.md", -"redirect_url": "/windows/device-security/auditing/event-5376", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5377.md", -"redirect_url": "/windows/device-security/auditing/event-5377", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5378.md", -"redirect_url": "/windows/device-security/auditing/event-5378", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5447.md", -"redirect_url": "/windows/device-security/auditing/event-5447", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5632.md", -"redirect_url": "/windows/device-security/auditing/event-5632", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5633.md", -"redirect_url": "/windows/device-security/auditing/event-5633", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5712.md", -"redirect_url": "/windows/device-security/auditing/event-5712", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5888.md", -"redirect_url": "/windows/device-security/auditing/event-5888", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5889.md", -"redirect_url": "/windows/device-security/auditing/event-5889", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5890.md", -"redirect_url": "/windows/device-security/auditing/event-5890", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6144.md", -"redirect_url": "/windows/device-security/auditing/event-6144", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6145.md", -"redirect_url": "/windows/device-security/auditing/event-6145", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6281.md", -"redirect_url": "/windows/device-security/auditing/event-6281", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6400.md", -"redirect_url": "/windows/device-security/auditing/event-6400", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6401.md", -"redirect_url": "/windows/device-security/auditing/event-6401", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6402.md", -"redirect_url": "/windows/device-security/auditing/event-6402", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6403.md", -"redirect_url": "/windows/device-security/auditing/event-6403", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6404.md", -"redirect_url": "/windows/device-security/auditing/event-6404", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6405.md", -"redirect_url": "/windows/device-security/auditing/event-6405", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6406.md", -"redirect_url": "/windows/device-security/auditing/event-6406", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6407.md", -"redirect_url": "/windows/device-security/auditing/event-6407", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6408.md", -"redirect_url": "/windows/device-security/auditing/event-6408", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6409.md", -"redirect_url": "/windows/device-security/auditing/event-6409", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6410.md", -"redirect_url": "/windows/device-security/auditing/event-6410", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6416.md", -"redirect_url": "/windows/device-security/auditing/event-6416", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6419.md", -"redirect_url": "/windows/device-security/auditing/event-6419", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6420.md", -"redirect_url": "/windows/device-security/auditing/event-6420", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6421.md", -"redirect_url": "/windows/device-security/auditing/event-6421", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6422.md", -"redirect_url": "/windows/device-security/auditing/event-6422", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6423.md", -"redirect_url": "/windows/device-security/auditing/event-6423", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6424.md", -"redirect_url": "/windows/device-security/auditing/event-6424", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/executable-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/executable-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/exempt-icmp-from-authentication.md", -"redirect_url": "/windows/access-protection/windows-firewall/exempt-icmp-from-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/exemption-list.md", -"redirect_url": "/windows/access-protection/windows-firewall/exemption-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/file-system-global-object-access-auditing.md", -"redirect_url": "/windows/device-security/auditing/file-system-global-object-access-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/firewall-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/firewall-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/firewall-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/firewall-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/force-shutdown-from-a-remote-system.md", -"redirect_url": "/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-information-about-your-active-directory-deployment.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-information-about-your-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-information-about-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-other-relevant-information.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-other-relevant-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-the-information-you-need.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-the-information-you-need", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/generate-security-audits.md", -"redirect_url": "/windows/device-security/security-policy-settings/generate-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-boundary.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-boundary", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-encryption.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-firewall.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-isolateddomain-clients.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-isolateddomain-servers.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/guidance-and-best-practices-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-and-password-changes.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-and-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-biometrics-in-enterprise.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-errors-during-pin-creation.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-event-300.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-event-300", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-how-it-works.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-identity-verification.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-manage-in-organization.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-manage-in-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-prepare-people-to-use.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-prepare-people-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-why-pin-is-better-than-password.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-applocker-works-techref.md", -"redirect_url": "/windows/device-security/applocker/how-applocker-works-techref", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-to-configure-security-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", -"redirect_url": "/windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-user-account-control-works.md", -"redirect_url": "/windows/access-protection/user-account-control/how-user-account-control-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", -"redirect_url": "/windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/impersonate-a-client-after-authentication.md", -"redirect_url": "/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md", -"redirect_url": "/windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "/windows/device-security/applocker/import-an-applocker-policy-from-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/increase-a-process-working-set.md", -"redirect_url": "/windows/device-security/security-policy-settings/increase-a-process-working-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/increase-scheduling-priority.md", -"redirect_url": "/windows/device-security/security-policy-settings/increase-scheduling-priority", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md", -"redirect_url": "/windows/access-protection/installing-digital-certificates-on-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-do-not-display-last-user-name.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-machine-inactivity-limit.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-require-smart-card.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-require-smart-card", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-smart-card-removal-behavior.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/isolated-domain-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/isolated-domain-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/isolated-domain.md", -"redirect_url": "/windows/access-protection/windows-firewall/isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/isolating-apps-on-your-network.md", -"redirect_url": "/windows/access-protection/windows-firewall/isolating-apps-on-your-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/kerberos-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/kerberos-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/limitations-with-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/limitations-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/link-the-gpo-to-the-domain.md", -"redirect_url": "/windows/access-protection/windows-firewall/link-the-gpo-to-the-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/load-and-unload-device-drivers.md", -"redirect_url": "/windows/device-security/security-policy-settings/load-and-unload-device-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/local-accounts.md", -"redirect_url": "/windows/access-protection/access-control/local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/lock-pages-in-memory.md", -"redirect_url": "/windows/device-security/security-policy-settings/lock-pages-in-memory", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/log-on-as-a-batch-job.md", -"redirect_url": "/windows/device-security/security-policy-settings/log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/log-on-as-a-service.md", -"redirect_url": "/windows/device-security/security-policy-settings/log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maintain-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-auditing-and-security-log.md", -"redirect_url": "/windows/device-security/security-policy-settings/manage-auditing-and-security-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-packaged-apps-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/manage-packaged-apps-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-tpm-commands.md", -"redirect_url": "/windows/device-security/tpm/manage-tpm-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-tpm-lockout.md", -"redirect_url": "/windows/device-security/tpm/manage-tpm-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-updates-baselines-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/mandatory-settings-for-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-lifetime-for-service-ticket.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-password-age.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/merge-applocker-policies-manually.md", -"redirect_url": "/windows/device-security/applocker/merge-applocker-policies-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-accounts.md", -"redirect_url": "/windows/access-protection/access-control/microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/minimum-password-age.md", -"redirect_url": "/windows/device-security/security-policy-settings/minimum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/minimum-password-length.md", -"redirect_url": "/windows/device-security/security-policy-settings/minimum-password-length", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/modify-an-object-label.md", -"redirect_url": "/windows/device-security/security-policy-settings/modify-an-object-label", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/modify-firmware-environment-values.md", -"redirect_url": "/windows/device-security/security-policy-settings/modify-firmware-environment-values", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", -"redirect_url": "/windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-application-usage-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/monitor-application-usage-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md", -"redirect_url": "/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-claim-types.md", -"redirect_url": "/windows/device-security/auditing/monitor-claim-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-resource-attribute-definitions.md", -"redirect_url": "/windows/device-security/auditing/monitor-resource-attribute-definitions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-use-of-removable-storage-devices.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md", -"redirect_url": "/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-allow-anonymous-sidname-translation.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-list-manager-policies.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-list-manager-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-lan-manager-authentication-level.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-ldap-client-signing-requirements.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/optimize-applocker-performance.md", -"redirect_url": "/windows/device-security/applocker/optimize-applocker-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/other-events.md", -"redirect_url": "/windows/device-security/auditing/other-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md", -"redirect_url": "/windows/threat-protection/override-mitigation-options-for-app-related-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/overview-create-wip-policy.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/overview-create-wip-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md", -"redirect_url": "/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/password-must-meet-complexity-requirements.md", -"redirect_url": "/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/password-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/password-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/perform-volume-maintenance-tasks.md", -"redirect_url": "/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/plan-for-applocker-policy-management.md", -"redirect_url": "/windows/device-security/applocker/plan-for-applocker-policy-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md", -"redirect_url": "/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md", -"redirect_url": "/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-certificate-based-authentication.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-certificate-based-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-domain-isolation-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-domain-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-gpo-deployment.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-gpo-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-isolation-groups-for-the-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-network-access-groups.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-network-access-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-server-isolation-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-server-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-the-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-the-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md", -"redirect_url": "/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/prevent-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/procedures-used-in-this-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/procedures-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/profile-single-process.md", -"redirect_url": "/windows/device-security/security-policy-settings/profile-single-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/profile-system-performance.md", -"redirect_url": "/windows/device-security/security-policy-settings/profile-system-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-devices-from-unwanted-network-traffic.md", -"redirect_url": "/windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-enterprise-data-using-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", -"redirect_url": "/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", -"redirect_url": "/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/recommended-network-definitions-for-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md", -"redirect_url": "/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", -"redirect_url": "/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/refresh-an-applocker-policy.md", -"redirect_url": "/windows/device-security/applocker/refresh-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/registry-global-object-access-auditing.md", -"redirect_url": "/windows/device-security/auditing/registry-global-object-access-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/remote-credential-guard.md", -"redirect_url": "/windows/access-protection/remote-credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/remove-computer-from-docking-station.md", -"redirect_url": "/windows/device-security/security-policy-settings/remove-computer-from-docking-station", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/replace-a-process-level-token.md", -"redirect_url": "/windows/device-security/security-policy-settings/replace-a-process-level-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/report-monitor-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md", -"redirect_url": "/windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/requirements-for-deploying-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/requirements-for-deploying-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/requirements-to-use-applocker.md", -"redirect_url": "/windows/device-security/applocker/requirements-to-use-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/reset-account-lockout-counter-after.md", -"redirect_url": "/windows/device-security/security-policy-settings/reset-account-lockout-counter-after", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restore-files-and-directories.md", -"redirect_url": "/windows/device-security/security-policy-settings/restore-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restrict-access-to-only-trusted-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md", -"redirect_url": "/windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/review-scan-results-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/run-scan-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "/windows/device-security/applocker/run-the-automatically-generate-rules-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/script-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/script-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/secpol-advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md", -"redirect_url": "/windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-auditing-overview.md", -"redirect_url": "/windows/device-security/auditing/security-auditing-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-considerations-for-applocker.md", -"redirect_url": "/windows/device-security/applocker/security-considerations-for-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-identifiers.md", -"redirect_url": "/windows/access-protection/access-control/security-identifiers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-options.md", -"redirect_url": "/windows/device-security/security-policy-settings/security-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-policy-settings-reference.md", -"redirect_url": "/windows/device-security/security-policy-settings/security-policy-settings-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-principals.md", -"redirect_url": "/windows/access-protection/access-control/security-principals", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/select-types-of-rules-to-create.md", -"redirect_url": "/windows/device-security/applocker/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/server-isolation-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/server-isolation-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/server-isolation-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/server-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/server-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/service-accounts.md", -"redirect_url": "/windows/access-protection/access-control/service-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/shut-down-the-system.md", -"redirect_url": "/windows/device-security/security-policy-settings/shut-down-the-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md", -"redirect_url": "/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-and-remote-desktop-services.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-and-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-architecture.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-certificate-propagation-service.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-certificate-propagation-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-certificate-requirements-and-enumeration.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-debugging-information.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-debugging-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-events.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-group-policy-and-registry-settings.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-how-smart-card-sign-in-works-in-windows.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-removal-policy-service.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-removal-policy-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-smart-cards-for-windows-service.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-tools-and-settings.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-tools-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-windows-smart-card-technical-reference.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/special-identities.md", -"redirect_url": "/windows/access-protection/access-control/special-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/store-passwords-using-reversible-encryption.md", -"redirect_url": "/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/synchronize-directory-service-data.md", -"redirect_url": "/windows/device-security/security-policy-settings/synchronize-directory-service-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-settings-optional-subsystems.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-settings-optional-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/take-ownership-of-files-or-other-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/test-and-update-an-applocker-policy.md", -"redirect_url": "/windows/device-security/applocker/test-and-update-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/testing-scenarios-for-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/tools-to-use-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/tools-to-use-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/tpm-fundamentals.md", -"redirect_url": "/windows/device-security/tpm/tpm-fundamentals", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/tpm-recommendations.md", -"redirect_url": "/windows/device-security/tpm/tpm-recommendations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/trusted-platform-module-overview.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/trusted-platform-module-top-node.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-top-node", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md", -"redirect_url": "/windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-applocker-enforcement-settings.md", -"redirect_url": "/windows/device-security/applocker/understand-applocker-enforcement-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-applocker-policy-design-decisions.md", -"redirect_url": "/windows/device-security/applocker/understand-applocker-policy-design-decisions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "/windows/device-security/applocker/understand-the-applocker-policy-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-default-rules.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-behavior.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-collections.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-collections", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-condition-types.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-condition-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-exceptions.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-exceptions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-windows-firewall-with-advanced-security-design-process.md", -"redirect_url": "/windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-group-policy-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-intune-config-manager-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", -"redirect_url": "/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-wmi-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md", -"redirect_url": "/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-overview.md", -"redirect_url": "/windows/access-protection/user-account-control/user-account-control-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-security-policy-settings.md", -"redirect_url": "/windows/access-protection/user-account-control/user-account-control-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-rights-assignment.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-rights-assignment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", -"redirect_url": "/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-event-viewer-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/using-event-viewer-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-owa-with-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/using-owa-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/verify-that-network-traffic-is-authenticated.md", -"redirect_url": "/windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/view-the-security-event-log.md", -"redirect_url": "/windows/device-security/auditing/view-the-security-event-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-deploy-virtual-smart-cards.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-evaluate-security.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-get-started.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-overview.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-tpmvscmgr.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-understanding-and-evaluating.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-use-virtual-smart-cards.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-authentication.md", -"redirect_url": "/windows/access-protection/vpn/vpn-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-auto-trigger-profile.md", -"redirect_url": "/windows/access-protection/vpn/vpn-auto-trigger-profile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-conditional-access.md", -"redirect_url": "/windows/access-protection/vpn/vpn-conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-connection-type.md", -"redirect_url": "/windows/access-protection/vpn/vpn-connection-type", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-guide.md", -"redirect_url": "/windows/access-protection/vpn/vpn-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-name-resolution.md", -"redirect_url": "/windows/access-protection/vpn/vpn-name-resolution", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-profile-options.md", -"redirect_url": "/windows/access-protection/vpn/vpn-profile-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-routing.md", -"redirect_url": "/windows/access-protection/vpn/vpn-routing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-security-features.md", -"redirect_url": "/windows/access-protection/vpn/vpn-security-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/what-is-applocker.md", -"redirect_url": "/windows/device-security/applocker/what-is-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md", -"redirect_url": "/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-10-mobile-security-guide.md", -"redirect_url": "/windows/device-security/windows-10-mobile-security-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md", -"redirect_url": "/windows/access-protection/windows-credential-theft-mitigation-guide-abstract", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-antivirus-compatibility.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-antivirus-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-offline.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-offline", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-security-center-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", -"redirect_url": "/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", -"redirect_url": "/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-installer-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/windows-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-security-baselines.md", -"redirect_url": "/windows/device-security/windows-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/wip-app-enterprise-context.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/wip-app-enterprise-context", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/working-with-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/working-with-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/working-with-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/acquire-apps-windows-store-for-business.md", -"redirect_url": "/microsoft-store/acquire-apps-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/acquire-apps-windows-store-for-business.md", -"redirect_url": "/microsoft-store/acquire-apps-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/add-unsigned-app-to-code-integrity-policy.md", -"redirect_url": "/microsoft-store/add-unsigned-app-to-code-integrity-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/administrative-tools-in-windows-10.md", -"redirect_url": "/windows/client-management/administrative-tools-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/app-inventory-management-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/apps-in-windows-store-for-business.md", -"redirect_url": "/microsoft-store/apps-in-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/apps-in-windows-store-for-business.md", -"redirect_url": "/microsoft-store/apps-in-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-about-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-about-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-administering-appv-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-administering-appv-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-administering-virtual-applications-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-allow-administrators-to-enable-connection-groups.md", -"redirect_url": "/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-application-publishing-and-client-interaction.md", -"redirect_url": "/windows/application-management/app-v/appv-application-publishing-and-client-interaction", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-apply-the-user-configuration-file-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-batch-sequencing.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-batch-sequencing", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-batch-updating.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-batch-updating", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-clean-unpublished-packages.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-clean-unpublished-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-provision-a-vm.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-provision-a-vm", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-available-mdm-settings.md", -"redirect_url": "/windows/application-management/app-v/appv-available-mdm-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-capacity-planning.md", -"redirect_url": "/windows/application-management/app-v/appv-capacity-planning", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-client-configuration-settings.md", -"redirect_url": "/windows/application-management/app-v/appv-client-configuration-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-configure-access-to-packages-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md", -"redirect_url": "/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md", -"redirect_url": "/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-connect-to-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-connect-to-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-connection-group-file.md", -"redirect_url": "/windows/application-management/app-v/appv-connection-group-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-connection-group-virtual-environment.md", -"redirect_url": "/windows/application-management/app-v/appv-connection-group-virtual-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-connection-group.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-connection-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-package-accelerator-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-package-accelerator.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-package-accelerator", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-virtual-application-package-package-accelerator.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-and-use-a-project-template.md", -"redirect_url": "/windows/application-management/app-v/appv-create-and-use-a-project-template", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-creating-and-managing-virtualized-applications.md", -"redirect_url": "/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-delete-a-connection-group.md", -"redirect_url": "/windows/application-management/app-v/appv-delete-a-connection-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-delete-a-package-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-delete-a-package-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-appv-databases-with-sql-scripts.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-the-appv-server-with-a-script.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-the-appv-server.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-the-appv-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-microsoft-office-2013-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-microsoft-office-2016-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-the-appv-sequencer-and-client.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-the-appv-server.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deployment-checklist.md", -"redirect_url": "/windows/application-management/app-v/appv-deployment-checklist", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-dynamic-configuration.md", -"redirect_url": "/windows/application-management/app-v/appv-dynamic-configuration", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-enable-the-app-v-desktop-client.md", -"redirect_url": "/windows/application-management/app-v/appv-enable-the-app-v-desktop-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-evaluating-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-evaluating-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-for-windows.md", -"redirect_url": "/windows/application-management/app-v/appv-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-getting-started.md", -"redirect_url": "/windows/application-management/app-v/appv-getting-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-high-level-architecture.md", -"redirect_url": "/windows/application-management/app-v/appv-high-level-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-management-server-on-a-standalone-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-sequencer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-sequencer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md", -"redirect_url": "/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-maintaining-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-maintaining-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-managing-connection-groups.md", -"redirect_url": "/windows/application-management/app-v/appv-managing-connection-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-migrating-to-appv-from-a-previous-version.md", -"redirect_url": "/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-modify-an-existing-virtual-application-package.md", -"redirect_url": "/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-modify-client-configuration-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-modify-client-configuration-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-move-the-appv-server-to-another-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-operations.md", -"redirect_url": "/windows/application-management/app-v/appv-operations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-performance-guidance.md", -"redirect_url": "/windows/application-management/app-v/appv-performance-guidance", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-checklist.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-checklist", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-folder-redirection-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-folder-redirection-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-appv-server-deployment.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-appv-server-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-high-availability-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-high-availability-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-sequencer-and-client-deployment.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-using-appv-with-office.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-using-appv-with-office", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-to-deploy-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-to-deploy-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-preparing-your-environment.md", -"redirect_url": "/windows/application-management/app-v/appv-preparing-your-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-prerequisites.md", -"redirect_url": "/windows/application-management/app-v/appv-prerequisites", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-publish-a-connection-group.md", -"redirect_url": "/windows/application-management/app-v/appv-publish-a-connection-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-publish-a-packages-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-register-and-unregister-a-publishing-server-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-release-notes-for-appv-for-windows-1703.md", -"redirect_url": "/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-release-notes-for-appv-for-windows.md", -"redirect_url": "/windows/application-management/app-v/appv-release-notes-for-appv-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-reporting.md", -"redirect_url": "/windows/application-management/app-v/appv-reporting", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-running-locally-installed-applications-inside-a-virtual-environment.md", -"redirect_url": "/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-security-considerations.md", -"redirect_url": "/windows/application-management/app-v/appv-security-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-sequence-a-new-application.md", -"redirect_url": "/windows/application-management/app-v/appv-sequence-a-new-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-sequence-a-package-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-sequence-a-package-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-supported-configurations.md", -"redirect_url": "/windows/application-management/app-v/appv-supported-configurations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-technical-reference.md", -"redirect_url": "/windows/application-management/app-v/appv-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-troubleshooting.md", -"redirect_url": "/windows/application-management/app-v/appv-troubleshooting", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md", -"redirect_url": "/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-using-the-client-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-using-the-client-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-viewing-appv-server-publishing-metadata.md", -"redirect_url": "/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/assign-apps-to-employees.md", -"redirect_url": "/microsoft-store/assign-apps-to-employees", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "/microsoft-store/configure-mdm-provider-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "/microsoft-store/configure-mdm-provider-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/connect-to-remote-aadj-pc.md", -"redirect_url": "/windows/client-management/connect-to-remote-aadj-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/device-guard-signing-portal.md", -"redirect_url": "/microsoft-store/device-guard-signing-portal", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-apps-from-your-private-store.md", -"redirect_url": "/microsoft-store/distribute-apps-from-your-private-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-apps-with-management-tool.md", -"redirect_url": "/microsoft-store/distribute-apps-with-management-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-offline-apps.md", -"redirect_url": "/microsoft-store/distribute-offline-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/find-and-acquire-apps-overview.md", -"redirect_url": "/microsoft-store/find-and-acquire-apps-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/group-policies-for-enterprise-and-education-editions.md", -"redirect_url": "/windows/client-management/group-policies-for-enterprise-and-education-editions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/join-windows-10-mobile-to-azure-active-directory.md", -"redirect_url": "/windows/client-management/join-windows-10-mobile-to-azure-active-directory", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-access-to-private-store.md", -"redirect_url": "/microsoft-store/manage-access-to-private-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-apps-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/manage-apps-windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-apps-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/manage-apps-microsoft-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-corporate-devices.md", -"redirect_url": "/windows/client-management/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-orders-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-orders-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-orders-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-orders-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-private-store-settings.md", -"redirect_url": "/microsoft-store/manage-private-store-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-settings-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-settings-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-settings-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-settings-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-users-and-groups-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-users-and-groups-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-windows-10-in-your-organization-modern-management.md", -"redirect_url": "/windows/client-management/manage-windows-10-in-your-organization-modern-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/mandatory-user-profile.md", -"redirect_url": "/windows/client-management/mandatory-user-profile", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/new-policies-for-windows-10.md", -"redirect_url": "/windows/client-management/new-policies-for-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/prerequisites-windows-store-for-business.md", -"redirect_url": "/microsoft-store/prerequisites-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/prerequisites-windows-store-for-business.md", -"redirect_url": "/microsoft-store/prerequisites-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/reset-a-windows-10-mobile-device.md", -"redirect_url": "/windows/client-management/reset-a-windows-10-mobile-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "/microsoft-store/roles-and-permissions-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "/microsoft-store/roles-and-permissions-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/settings-reference-windows-store-for-business.md", -"redirect_url": "/microsoft-store/settings-reference-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/settings-reference-windows-store-for-business.md", -"redirect_url": "/microsoft-store/settings-reference-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/sign-code-integrity-policy-with-device-guard-signing.md", -"redirect_url": "/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/sign-up-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/sign-up-windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/sign-up-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/sign-up-microsoft-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/sign-up-windows-store-for-business.md", -"redirect_url": "/microsoft-store/sign-up-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/sign-up-windows-store-for-business.md", -"redirect_url": "/microsoft-store/sign-up-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/troubleshoot-windows-store-for-business.md", -"redirect_url": "/microsoft-store/troubleshoot-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/troubleshoot-windows-store-for-business.md", -"redirect_url": "/microsoft-store/troubleshoot-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md", -"redirect_url": "/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-administering-uev.md", -"redirect_url": "/windows/configuration/ue-v/uev-administering-uev", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-application-template-schema-reference.md", -"redirect_url": "/windows/configuration/ue-v/uev-application-template-schema-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md", -"redirect_url": "/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-configuring-uev-with-group-policy-objects.md", -"redirect_url": "/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md", -"redirect_url": "/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-deploy-required-features.md", -"redirect_url": "/windows/configuration/ue-v/uev-deploy-required-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-deploy-uev-for-custom-applications.md", -"redirect_url": "/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-for-windows.md", -"redirect_url": "/windows/configuration/ue-v/uev-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-getting-started.md", -"redirect_url": "/windows/configuration/ue-v/uev-getting-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-manage-administrative-backup-and-restore.md", -"redirect_url": "/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-manage-configurations.md", -"redirect_url": "/windows/configuration/ue-v/uev-manage-configurations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md", -"redirect_url": "/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md", -"redirect_url": "/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-migrating-settings-packages.md", -"redirect_url": "/windows/configuration/ue-v/uev-migrating-settings-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-prepare-for-deployment.md", -"redirect_url": "/windows/configuration/ue-v/uev-prepare-for-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-release-notes-1607.md", -"redirect_url": "/windows/configuration/ue-v/uev-release-notes-1607", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-security-considerations.md", -"redirect_url": "/windows/configuration/ue-v/uev-security-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-sync-methods.md", -"redirect_url": "/windows/configuration/ue-v/uev-sync-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-sync-trigger-events.md", -"redirect_url": "/windows/configuration/ue-v/uev-sync-trigger-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-synchronizing-microsoft-office-with-uev.md", -"redirect_url": "/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-technical-reference.md", -"redirect_url": "/windows/configuration/ue-v/uev-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-troubleshooting.md", -"redirect_url": "/windows/configuration/ue-v/uev-troubleshooting", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-upgrade-uev-from-previous-releases.md", -"redirect_url": "/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-using-uev-with-application-virtualization-applications.md", -"redirect_url": "/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-whats-new-in-uev-for-windows.md", -"redirect_url": "/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md", -"redirect_url": "/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-windows-store-for-business-account-settings.md", -"redirect_url": "/microsoft-store/update-windows-store-for-business-account-settings", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/update-windows-store-for-business-account-settings.md", -"redirect_url": "/microsoft-store/update-microsoft-store-for-business-account-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-10-mobile-and-mdm.md", -"redirect_url": "/windows/client-management/windows-10-mobile-and-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-libraries.md", -"redirect_url": "/windows/client-management/windows-libraries", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/working-with-line-of-business-apps.md", -"redirect_url": "/microsoft-store/working-with-line-of-business-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/act-technical-reference.md", -"redirect_url": "/windows/deployment/planning/act-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/applying-filters-to-data-in-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/available-data-types-and-operators-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/best-practice-recommendations-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/best-practice-recommendations-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/change-history-for-plan-for-windows-10-deployment.md", -"redirect_url": "/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/compatibility-administrator-users-guide.md", -"redirect_url": "/windows/deployment/planning/compatibility-administrator-users-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/compatibility-fix-database-management-strategies-and-deployment.md", -"redirect_url": "/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md", -"redirect_url": "/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/deployment-considerations-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/deployment-considerations-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/device-dialog-box.md", -"redirect_url": "/windows/deployment/planning/device-dialog-box", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/fixing-applications-by-using-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/fixing-applications-by-using-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md", -"redirect_url": "/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/prepare-your-organization-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/prepare-your-organization-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/security-and-data-protection-considerations-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/showing-messages-generated-by-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/showing-messages-generated-by-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/sua-users-guide.md", -"redirect_url": "/windows/deployment/planning/sua-users-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/tabs-on-the-sua-tool-interface.md", -"redirect_url": "/windows/deployment/planning/tabs-on-the-sua-tool-interface", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/testing-your-application-mitigation-packages.md", -"redirect_url": "/windows/deployment/planning/testing-your-application-mitigation-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/understanding-and-using-compatibility-fixes.md", -"redirect_url": "/windows/deployment/planning/understanding-and-using-compatibility-fixes", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-compatibility-administrator-tool.md", -"redirect_url": "/windows/deployment/planning/using-the-compatibility-administrator-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-sdbinstexe-command-line-tool.md", -"redirect_url": "/windows/deployment/planning/using-the-sdbinstexe-command-line-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/using-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-sua-wizard.md", -"redirect_url": "/windows/deployment/planning/using-the-sua-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/viewing-the-events-screen-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-compatibility.md", -"redirect_url": "/windows/deployment/planning/windows-10-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-deployment-considerations.md", -"redirect_url": "/windows/deployment/planning/windows-10-deployment-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-enterprise-faq-itpro.md", -"redirect_url": "/windows/deployment/planning/windows-10-enterprise-faq-itpro", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-infrastructure-requirements.md", -"redirect_url": "/windows/deployment/planning/windows-10-infrastructure-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-to-go-frequently-asked-questions.md", -"redirect_url": "/windows/deployment/planning/windows-to-go-frequently-asked-questions", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-to-go-overview.md", -"redirect_url": "/windows/deployment/planning/windows-to-go-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/change-history-for-update-windows-10.md", -"redirect_url": "/windows/deployment/update/change-history-for-update-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/update-compliance-get-started.md", -"redirect_url": "/windows/deployment/update/update-compliance-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/update-compliance-monitor.md", -"redirect_url": "/windows/deployment/update/update-compliance-monitor", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/update-compliance-using.md", -"redirect_url": "/windows/deployment/update/update-compliance-using", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-branchcache.md", -"redirect_url": "/windows/deployment/update/waas-branchcache", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-configure-wufb.md", -"redirect_url": "/windows/deployment/update/waas-configure-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-delivery-optimization.md", -"redirect_url": "/windows/deployment/update/waas-delivery-optimization", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-deployment-rings-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-deployment-rings-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-integrate-wufb.md", -"redirect_url": "/windows/deployment/update/waas-integrate-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-manage-updates-configuration-manager.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-manage-updates-wsus.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wsus", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-manage-updates-wufb.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-mobile-updates.md", -"redirect_url": "/windows/deployment/update/waas-mobile-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-optimize-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-optimize-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-overview.md", -"redirect_url": "/windows/deployment/update/waas-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-quick-start.md", -"redirect_url": "/windows/deployment/update/waas-quick-start", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-restart.md", -"redirect_url": "/windows/deployment/update/waas-restart", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-branches-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-servicing-strategy-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-strategy-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-windows-insider-for-business-aad.md", -"redirect_url": "/windows/deployment/update/waas-windows-insider-for-business-aad", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-windows-insider-for-business.md", -"redirect_url": "/windows/deployment/update/waas-windows-insider-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-wufb-group-policy.md", -"redirect_url": "/windows/deployment/update/waas-wufb-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-wufb-intune.md", -"redirect_url": "/windows/deployment/update/waas-wufb-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-settings-app-with-group-policy.md", -"redirect_url": "/windows/client-management/manage-settings-app-with-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/client-management/mdm/create-a-custom-configuration-service-provider.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/client-management/mdm/design-a-custom-windows-csp.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/iconfigserviceprovider2.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/iconfigserviceprovider2getnode.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnode.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodeadd.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodeclear.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodecopy.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodedeletechild.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodedeleteproperty.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodeexecute.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetchildnodenames.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetproperty.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetpropertyidentifiers.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetvalue.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodemove.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodesetproperty.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodesetvalue.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodetransactioning.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspvalidate.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md", -"redirect_url": "/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/collect-wip-audit-event-logs.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-managed-installer-for-device-guard.md", -"redirect_url": "/windows/device-security/device-guard/deploy-managed-installer-for-device-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-data-sharing.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-data-sharing", -"redirect_document_id": true -}, -{ -"source_path": "windows/index.md", -"redirect_url": "/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/index.md", -"redirect_url": "/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/index.md", -"redirect_url": "/windows/deployment/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/index.md", -"redirect_url": "/windows/deployment/planning/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/index.md", -"redirect_url": "/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-store-for-business.md", -"redirect_url": "/microsoft-store/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/index.md", -"redirect_url": "/windows/deployment/update/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/index.md", -"redirect_url": "/windows/configuration/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-technologies.md", -"redirect_url": "/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "education/get-started/index.md", -"redirect_url": "/education/get-started/get-started-with-microsoft-education", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-10-enterprise-security-guides.md", -"redirect_url": "/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-history-for-keep-windows-10-secure.md", -"redirect_url": "/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/change-history-for-manage-and-update-windows-10.md", -"redirect_url": "/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-channels-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-10-enterprise-activation-subscription.md", -"redirect_url": "/windows/deployment/windows-10-enterprise-subscription-activation", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-10-auto-pilot.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-10-autopilot", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/privacy/basic-level-windows-diagnostic-events-and-fields.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/configure-windows-diagnostic-data-in-your-organization.md", -"redirect_url": "/windows/privacy/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/diagnostic-data-viewer-overview.md", -"redirect_url": "/windows/privacy/diagnostic-data-viewer-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md", -"redirect_url": "/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/gdpr-win10-whitepaper.md", -"redirect_url": "/windows/privacy/gdpr-win10-whitepaper", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/manage-windows-endpoints-version-1709.md", -"redirect_url": "/windows/privacy/manage-windows-endpoints", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/windows-diagnostic-data-1703.md", -"redirect_url": "/windows/privacy/windows-diagnostic-data-1703", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/windows-diagnostic-data.md", -"redirect_url": "/windows/privacy/windows-diagnostic-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/upgrade/windows-10-edition-downgrades.md", -"redirect_url": "/windows/deployment/upgrade/windows-10-edition-upgrades", -"redirect_document_id": true -}, -{ -"source_path": "education/windows/windows-automatic-redeployment.md", -"redirect_url": "/education/windows/autopilot-reset", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-10-autopilot.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-autopilot", -"redirect_document_id": true -}, -{ -"source_path": "windows/privacy/manage-windows-endpoints.md", -"redirect_url": "/windows/privacy/manage-windows-1809-endpoints", -"redirect_document_id": true -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/use-apis.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp", -"redirect_document_id": false - }, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-list.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-alerts", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-file-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-filemachineaction-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-filemachineactions-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/get-machineaction-object", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-started.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machine", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/isolate-machine", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-av-scan", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-user-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/incidents-queue.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/incidents-queue", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicator-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/threat-analytics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/threat-analytics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/files", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machineaction", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machineactionsnote.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/ti-indicator", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/update-alert", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/user-alert-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/user", -"source_path": "windows/deployment/planning/windows-10-fall-creators-deprecation.md", -"redirect_url": "/windows/deployment/planning/windows-10-1709-removed-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/planning/windows-10-creators-update-deprecation.md", -"redirect_url": "/windows/deployment/planning/windows-10-1703-removed-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/manage-indicators", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-10-enterprise-subscription-activation.md", -"redirect_url": "/windows/deployment/windows-10-subscription-activation", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": true -}, -{ -"source_path": "windows/hub/windows-10-landing.yml", -"redirect_url": "/windows/windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-autopilot-requirements#networking-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-autopilot-requirements#licensing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-autopilot-requirements#configuration-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/user-driven-aad.md", -"redirect_url": "/windows/deployment/windows-autopilot/user-driven#user-driven-mode-for-azure-active-directory-join", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/user-driven-hybrid.md", -"redirect_url": "/windows/deployment/windows-autopilot/user-driven#user-driven-mode-for-hybrid-azure-active-directory-join", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/intune-connector.md", -"redirect_url": "https://docs.microsoft.com/intune/windows-autopilot-hybrid", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-autopilot-reset#reset-devices-with-remote-windows-autopilot-reset", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-local.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-autopilot-reset#reset-devices-with-local-windows-autopilot-reset", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/configure-autopilot.md", -"redirect_url": "/windows/deployment/windows-autopilot/add-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/administer.md", -"redirect_url": "/windows/deployment/windows-autopilot/add-devices#registering-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/hub/release-information.md", -"redirect_url": "/windows/release-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-10-architecture-posters.md", -"redirect_url": "/windows/deployment/windows-10-deployment-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/index.md", -"redirect_url": "/windows/security/threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md", -"redirect_url": "/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", -"redirect_document_id": true -} -] + { + "source_path": "devices/hololens/hololens-whats-new.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-release-notes", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-upgrade-enterprise.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-requirements#upgrade-to-windows-holographic-for-business", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-install-localized.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-install-localized", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-install-apps.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-setup.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-setup", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-use-apps.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-home#using-apps-on-hololens", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-get-apps.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-spaces-on-hololens.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-spaces", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-clicker.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-clicker-restart-recover.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker#restart-or-recover-the-clicker", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-find-and-save-files.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-data", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-management-overview.md", + "redirect_url": "https://docs.microsoft.com/hololens", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/manage-surface-pro-3-firmware-updates.md", + "redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/update.md", + "redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/ios-privacy-statement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ios-privacy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-ios-privacy-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ios-privacy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": false + }, + { + "source_path": "browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/windows-update-sources.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/how-windows-update-works", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/update-compliance-perspectives.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", + "redirect_document_id": true + }, + { + "source_path": "browsers/edge/hardware-and-software-requirements.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge", + "redirect_document_id": true + }, + { + "source_path": "browsers/edge/security-enhancements-microsoft-edge.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp", + "redirect_document_id": true + }, + { + "source_path": "browsers/edge/new-policies.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/intelligence/av-tests.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/security/mtp/top-scoring-industry-tests", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": true + }, + { + "source_path": "windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/intelligence/transparency-report.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/av-tests", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/waas-windows-insider-for-business-aad.md", + "redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-add", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-windows-insider-for-business-faq.md", + "redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/encrypted-hard-drive.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/encrypted-hard-drive", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/secure-the-windows-10-boot-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/secure-the-windows-10-boot-process", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/how-windows-uses-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/manage-tpm-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/manage-tpm-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/tpm-fundamentals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/tpm-recommendations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-recommendations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-top-node", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/waas-windows-insider-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agress.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protectionsecurity-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/applocker/administer-applocker-using-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/administer-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-architecture-and-components.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-functions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-policies-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-policies-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-policy-use-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-processes-and-interactions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-the-application-identity-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-the-appLocker-reference-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-your-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/delete-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/determine-your-application-control-objectives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/dll-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/document-your-application-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/document-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/edit-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/edit-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/enable-the-dll-rule-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/enforce-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/applocker/executable-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/how-applocker-works-techref.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/monitor-application-usage-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/optimize-applocker-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/plan-for-applocker-policy-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/refresh-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/requirements-to-use-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/script-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/security-considerations-for-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/select-types-of-rules-to-create.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/test-and-update-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/tools-to-use-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-applocker-enforcement-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-collections.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/using-event-viewer-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/what-is-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/windows-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/working-with-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/working-with-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-enable-virtualization-based-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/enable-virtualization-based-security", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", + "redirect_url": "hhttps://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-family-options.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/microsoft-defender-atp/customize-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-views", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/graphics.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/apis-intro.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/api-hello-world.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-hello-world", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-simulations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/community", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-siem", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-splunk", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-siem", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/deprecate.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/deprecate", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/evaluate-atp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-error-codes", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-files", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-ip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-user", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/licensing", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-reports", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-tags", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-edr.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-edr", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/management-apis.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-incidents", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mssp-support", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-configure", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/configuration-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/partner-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/partner-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/portal-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/use-apis.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preferences-setup", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/prerelease.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/prerelease", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/prerelease.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/python-example-code", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/python-example-code.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/rbac", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/response-actions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/response-actions", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-detection-test", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/service-status", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/time-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/whats-new-in-microsoft-defender-atp", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-security-center", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/block-untrusted-fonts-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/block-untrusted-fonts-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/change-history-for-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", + "redirect_url": "https://www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/access-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-lockout-duration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-duration", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-lockout-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-administrator-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-guest-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-rename-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-rename-guest-account.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/add-workstations-to-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/administer-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/allow-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/back-up-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/bypass-traverse-checking.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/change-the-system-time.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-system-time", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/change-the-time-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-time-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-a-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-a-token-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-token-object", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-global-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-global-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-permanent-shared-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-symbolic-links.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-symbolic-links", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": false + }, + { + "source_path": "windows/device-security/security-policy-settings/debug-programs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/debug-programs", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/enforce-password-history.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-password-history", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/generate-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/generate-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/increase-a-process-working-set.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/increase-scheduling-priority.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/kerberos-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/kerberos-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/load-and-unload-device-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/lock-pages-in-memory.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/manage-auditing-and-security-log.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/minimum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/minimum-password-length.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-length", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/modify-an-object-label.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-an-object-label", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/modify-firmware-environment-values.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-list-manager-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-list-manager-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/password-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/profile-single-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-single-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/profile-system-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-system-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/remove-computer-from-docking-station.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/replace-a-process-level-token.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/restore-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/restore-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/security-options.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-options", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/security-policy-settings-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/shut-down-the-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shut-down-the-system", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/synchronize-directory-service-data.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-settings-optional-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-rights-assignment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-rights-assignment", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/device-guard-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/device-guard-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-account-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-application-generated", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-application-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-authentication-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-authorization-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-certification-services", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-computer-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-detailed-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-distribution-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-dpapi-activity.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-file-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-connection", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-group-membership.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-handle-manipulation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-ipsec-driver.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-extended-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-quick-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-kernel-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-logoff", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-network-policy-server.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-account-management-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-object-access-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-policy-change-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-privilege-use-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-pnp-activity", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-process-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-process-termination", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-registry.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-removable-storage", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-rpc-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sam", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-security-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-state-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-security-system-extension.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-special-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-system-integrity", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-user-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-user-device-claims", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-object-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-process-tracking", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-1100.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1102", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-1104.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1105", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-1108.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4608", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4610.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4611", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4612.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4614", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4615.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4616", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4618.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4621", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4622.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4624", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4625.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4626", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4627.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4634", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4647.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4648", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4649.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4656", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4657.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4658", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4660.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4661", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4662.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4663", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4664.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4671.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4672", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4673.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4674", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4675.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4688", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4689.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4690", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4691.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4692", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4693.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4694", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4695.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4696", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4697.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4698", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4699.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4700", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4701.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4702", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4703.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4704", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4705.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4706", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4707.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4713", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4714.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4715", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4716.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4717", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4718.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4719", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4720.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4722", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4723.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4724", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4725.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4726", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4731.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4732", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4733.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4734", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4735.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4738", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4739.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4740", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4741.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4742", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4743.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4749", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4750.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4751", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4752.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4753", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4764.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4765", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4766.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4767", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4768.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4769", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4770.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4771", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4772.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4773", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4774.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4775", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4776.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4777", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4778.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4779", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4780.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4781", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4782.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4793", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4794.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4798", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4799.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4800", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4801.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4802", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4803.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4816", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4817.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4818", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4819.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4826", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4864.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4865", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4866.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4867", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4902.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4904", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4905.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4906", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4907.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4908", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4909.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4910", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4911.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4912", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4913.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4928", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4929.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4930", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4931.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4932", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4933.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4934", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4935.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4936", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4937.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4944", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4945.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4946", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4947.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4948", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4949.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4950", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4951.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4952", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4953.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4954", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4956.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4957", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4958.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4964", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4985.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5024", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5025.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5027", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5028.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5029", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5030.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5031", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5032.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5033", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5034.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5035", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5037.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5038", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5039.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5051", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5056.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5057", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5058.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5059", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5060.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5061", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5062.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5063", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5064.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5065", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5066.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5067", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5068.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5069", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5070.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5136", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5137.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5138", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5139.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5140", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5141.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5142", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5143.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5144", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5145.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5148", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5149.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5150", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5151.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5152", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5153.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5154", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5155.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5156", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5157.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5158", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5159.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5168", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5376.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5377", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5378.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5447", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5632.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5633", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5712.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5888", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5889.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5890", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6144.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6145", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6281.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6400", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6401.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6402", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6403.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6404", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6405.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6406", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6407.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6408", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6409.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6410", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6416.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6419", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6420.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6421", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6422.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6423", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6424.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/file-system-global-object-access-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-claim-types", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/other-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/security-auditing-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/view-the-security-event-log", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/administer-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/administer-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-architecture-and-components.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-architecture-and-components", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-functions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-functions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-policies-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-policies-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-policy-use-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policy-use-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-processes-and-interactions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-processes-and-interactions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-the-application-identity-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-application-identity-service", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-the-appLocker-reference-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-appLocker-reference-device", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-for-packaged-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-your-applocker-planning-document.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-planning-document", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-your-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/delete-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/delete-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/deploy-the-applocker-policy-into-production.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/determine-your-application-control-objectives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-your-application-control-objectives", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/dll-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/dll-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-your-application-control-management-processes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-control-management-processes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-your-application-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-list", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/edit-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/edit-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/enable-the-dll-rule-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enable-the-dll-rule-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/enforce-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enforce-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/executable-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/executable-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/how-applocker-works-techref.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/how-applocker-works-techref", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/manage-packaged-apps-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/merge-applocker-policies-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/monitor-application-usage-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/monitor-application-usage-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/optimize-applocker-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/optimize-applocker-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/plan-for-applocker-policy-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/plan-for-applocker-policy-management", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/refresh-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/refresh-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/requirements-for-deploying-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/requirements-to-use-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-to-use-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/script-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/script-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/security-considerations-for-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/security-considerations-for-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/select-types-of-rules-to-create.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/test-and-update-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-and-update-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/tools-to-use-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/tools-to-use-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-applocker-enforcement-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-enforcement-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-applocker-policy-design-decisions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-collections.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-collections", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-condition-types.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-exceptions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/using-event-viewer-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-event-viewer-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/what-is-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/what-is-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/windows-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/windows-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/working-with-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/working-with-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/change-history-for-device-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-device-security", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/enable-virtualization-based-protection-of-code-integrity.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/enable-virtualization-based-protection-of-code-integrity", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/get-support-for-security-baselines.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/get-support-for-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-compliance-toolkit-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/windows-10-mobile-security-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-10-mobile-security-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/windows-security-baselines.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/app-behavior-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/app-behavior-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/limitations-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/limitations-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/using-owa-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/using-owa-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/encrypted-hard-drive.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/encrypted-hard-drive", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/secure-the-windows-10-boot-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/secure-the-windows-10-boot-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/change-the-tpm-owner-password.md", + "redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/change-the-tpm-owner-password", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/how-windows-uses-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/how-windows-uses-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/manage-tpm-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/manage-tpm-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/tpm-fundamentals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-fundamentals", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/tpm-recommendations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-recommendations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/trusted-platform-module-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/trusted-platform-module-top-node.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-top-node", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bcd-settings-and-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-basic-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-basic-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-countermeasures.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-management-for-enterprises.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-credential-theft-mitigation-guide-abstract.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/change-history-for-access-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/change-history-for-access-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/configure-s-mime.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/configure-s-mime", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/enterprise-certificate-pinning.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/enterprise-certificate-pinning", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/installing-digital-certificates-on-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/remote-credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/boundary-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-group-policy-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-authentication-methods.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-authentication-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-the-windows-firewall-log.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-a-group-account-in-active-directory.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-a-group-policy-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-policy-object", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-authentication-request-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-inbound-icmp-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-inbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-outbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/documenting-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/documenting-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/enable-predefined-inbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/enable-predefined-outbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/encryption-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/exempt-icmp-from-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/exemption-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exemption-list", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/firewall-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/firewall-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-other-relevant-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-the-information-you-need.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-boundary.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/isolated-domain-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/isolating-apps-on-your-network.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/link-the-gpo-to-the-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-certificate-based-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-domain-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-gpo-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-gpo-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-network-access-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-network-access-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-server-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-the-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-the-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/procedures-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/server-isolation-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-auto-trigger-profile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-auto-trigger-profile", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-conditional-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-connection-type.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-connection-type", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-name-resolution.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-name-resolution", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-profile-options.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-routing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-routing", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-security-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-security-features", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/how-user-account-control-works.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/how-user-account-control-works", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/user-account-control-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/user-account-control-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-debugging-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-debugging-information", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-events", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-removal-policy-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-tools-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-and-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-certificate-propagation-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-and-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-and-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-biometrics-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-adfs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-deployment-cert-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-deployment-key-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-errors-during-pin-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-event-300.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-identity-verification.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-adfs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-manage-in-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-planning-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-planning-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-prepare-people-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/additional-mitigations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/additional-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-known-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-manage.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-not-protected-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-protection-limits.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/active-directory-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/active-directory-security-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/dynamic-access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/dynamic-access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/security-identifiers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-identifiers", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/security-principals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-principals", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/service-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/service-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/special-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/special-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-steps.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", + "redirect_document_id": true + }, + { + "source_path": "devices/surface/surface-device-compatibility-with-windows-10-ltsb.md", + "redirect_url": "https://docs.microsoft.com/surface/surface-device-compatibility-with-windows-10-ltsc", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/windows-diagnostic-data-1709.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/EventName.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/enhanced-telemetry-windows-analytics-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "education/windows/windows-10-pro-to-pro-edu-upgrade.md", + "redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", + "redirect_document_id": false + }, + { + "source_path": "education/windows/switch-to-pro-education.md", + "redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", + "redirect_document_id": false + }, + { + "source_path": "education/windows/swithc-to-pro-de.md", + "redirect_url": "https://docs.microsoft.com/education/windows/switch-to-pro-education", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-admx-backed.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", + "redirect_document_id": true + }, + { + "source_path": "windows/client-management/mdm/policy-csp-location.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/configure-windows-defender-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-pua-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/get-started-with-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-block-at-first-sight.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-enhanced-notifications.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-7.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", + "redirect_document_id": true + }, + { + "source_path": "devices/surface/surface-diagnostic-toolkit.md", + "redirect_url": "https://docs.microsoft.com/surface/index", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/manage-surface-dock-firmware-updates.md", + "redirect_url": "https://docs.microsoft.com/surface/indexdevices/surface/update", + "redirect_document_id": false + }, + { + "source_path": "devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/finishing-your-surface-hub-meeting", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-microsoft-layout-app.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-microsoft-dynamics-365-layout-app", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-microsoft-dynamics-365-layout-app.md", + "redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/layout/", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-microsoft-remote-assist-app.md", + "redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/", + "redirect_document_id": true + }, + { + "source_path": "devices/hololens/hololens-public-preview-apps.md", + "redirect_url": "https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-restart-recover.md", + "redirect_url": "/hololens/hololens-recovery", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/holographic-photos-and-video.md", + "redirect_url": "/hololens/holographic-photos-and-videos", + "redirect_document_id": false + }, + { + "source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub", + "redirect_document_id": true + }, + { + "source_path": "devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/admin-group-management-for-surface-hub", + "redirect_document_id": true + }, + { + "source_path": "devices/surface-hub/surface-hub-administrators-guide.md", + "redirect_url": "/surface-hub/index", + "redirect_document_id": true + }, + { + "source_path": "devices/surface-hub/intro-to-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/index", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/waas-quick-start.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-servicing-strategy-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-deployment-rings-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-servicing-branches-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-compliance-monitor.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-compliance-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/update-compliance-wdav-status.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-compliance-using.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-optimize-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-delivery-optimization.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-branchcache.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-mobile-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-manage-updates-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-configure-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-integrate-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-wufb-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-wufb-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune.md", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-manage-updates-wsus.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-manage-updates-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-restart.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-update-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/configure-windows-telemetry-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lockdown-features-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/set-up-shared-or-guest-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/set-up-a-device-for-anyone-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/set-up-a-device-for-anyone-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/guidelines-for-assigned-access-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lock-down-windows-10-to-specific-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lockdown-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/settings-that-can-be-locked-down.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/product-ids-in-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-tips-and-suggestions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-10-start-layout-options-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-windows-10-taskbar.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration//configure-windows-10-taskbar", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-and-export-start-layout.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration//customize-and-export-start-layout", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/start-layout-xml-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/start-layout-xml-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-windows-10-start-screens-by-using-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-testing-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-1.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-2.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-3.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-4.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-5.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-6.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-o365.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-crm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-powerbi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-voice-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-feedback.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/stop-employees-from-using-the-windows-store.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/stop-employees-from-using-the-windows-store.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-devices-without-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/changes-to-start-policies-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/how-it-pros-can-use-configuration-service-providers.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lock-down-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-wifi-sense-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-install-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-create-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-apply-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-uninstall-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provision-pcs-for-initial-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provision-pcs-with-apps-and-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-script-to-install-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-nfc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-nfc", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-command-line.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-multivariant.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-edp-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-edp-policy-using-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-vpn-and-edp-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-enable-phone-signin.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/deploy-edp-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/guidance-and-best-practices-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/overview-create-edp-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-enterprise-data-using-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/testing-scenarios-for-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/wip-enterprise-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/enlightened-microsoft-apps-and-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/update-windows-10-images-with-provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/deploy/upgrade-analytics-prepare-your-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-release-notes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-review-site-discovery.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md", + "redirect_url": "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj635854(v=ws.11)", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/device-guard-certification-and-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-enable-phone-signin", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/implement-microsoft-passport-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-identity-verification-using-microsoft-passport.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-passport-and-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-passport-errors-during-pin-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-passport-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/passport-event-300.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/prepare-people-to-use-microsoft-passport.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/why-a-pin-is-better-than-a-password.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-hello-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/app-inventory-managemement-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/app-inventory-management-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/application-development-for-windows-as-a-service.md", + "redirect_url": "https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-accessibility.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-accessing-the-client-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/disconnect-your-organization-from-microsoft.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/introduction-to-windows-10-servicing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-cortana-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/manage-inventory-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/app-inventory-managemement-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-accessibility.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-privacy-statement.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/act-community-ratings-and-process.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/act-database-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-database-migration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-deployment-options.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-glossary.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/activating-and-closing-windows-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-lps-share-permissions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-operatingsystem-application-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-operatingsystem-computer-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-operatingsystem-device-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-product-and-documentation-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-settings-dialog-box-preferences-tab.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-settings-dialog-box-settings-tab.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-toolbar-icons-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-tools-packages-and-services.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-user-interface-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/adding-or-editing-an-issue.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/adding-or-editing-a-solution.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/analyzing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/application-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/categorizing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/chromebook-migration-guide.md", + "redirect_url": "edu/windows/chromebook-migration-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/common-compatibility-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/compatibility-monitor-users-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/computer-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/configuring-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-and-editing-issues-and-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-an-inventory-collector-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-a-runtime-analysis-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/customizing-your-report-views.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deciding-which-applications-to-test.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deleting-a-data-collection-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deploying-an-inventory-collector-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deploying-a-runtime-analysis-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deploy-windows-10-in-a-school.md", + "redirect_url": "/edu/windows/deploy-windows-10-in-a-school", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/example-filter-queries.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/exporting-a-data-collection-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/filtering-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/fixing-compatibility-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/identifying-computers-for-inventory-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/integration-with-management-solutions-.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/internet-explorer-web-site-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/labeling-data-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/log-file-locations-for-data-collection-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/managing-your-data-collection-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/organizational-tasks-for-each-report-type.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/organizing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/prioritizing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/ratings-icons-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/resolving-an-issue.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/saving-opening-and-exporting-reports.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/selecting-the-send-and-receive-status-for-an-application.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/selecting-your-compatibility-rating.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/selecting-your-deployment-status.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/sending-and-receiving-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/settings-for-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/setup-and-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/software-requirements-for-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/software-requirements-for-rap.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/taking-inventory-of-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/testing-compatibility-on-the-target-platform.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-act-database-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-the-act-configuration-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-the-act-log-processing-service.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/using-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/using-compatibility-monitor-to-send-feedback.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/viewing-your-compatibility-reports.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/websiteurl-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/welcome-to-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/whats-new-in-act-60.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/windows-10-guidance-for-education-environments.md", + "redirect_url": "https://docs.microsoft.com/education/windows", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-servicing-options.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/windows-update-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/change-history-for-what-s-new-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/index", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/device-guard-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/device-management.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/index", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/edge-ie11-whats-new-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/edp-whats-new-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/lockdown-features-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/microsoft-passport.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/new-provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/security-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/trusted-platform-module.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/user-account-control.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/windows-spotlight.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/microsoft-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/windows-update-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-10-security-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/security.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/basic-level-windows-diagnostic-events-and-fields-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/change-history-for-configure-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/change-history-for-configure-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/changes-to-start-policies-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-devices-without-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-devices-without-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/configure-devices-without-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/configure-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-windows-10-taskbar.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-10-taskbar", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-windows-telemetry-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/configure-windows-telemetry-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-crm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-feedback.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-o365.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-powerbi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-1.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-2.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-3.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-4.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-5.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-6.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-7.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-testing-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-voice-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-and-export-start-layout.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-windows-10-start-screens-by-using-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/guidelines-for-assigned-access-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/how-it-pros-can-use-configuration-service-providers.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/kiosk-shared-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/kiosk-shared-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/setup-kiosk-digital-signage.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-single-app", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/multi-app-kiosk-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/multi-app-kiosk-troubleshoot.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lock-down-windows-10-to-specific-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lock-down-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lockdown-features-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lockdown-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/manage-tips-and-suggestions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/manage-wifi-sense-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/mobile-lockdown-designer.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/mobile-lockdown-designer", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/product-ids-in-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provision-pcs-for-initial-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provision-pcs-with-apps-and-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provision-pcs-with-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-apply-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-command-line.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-configure-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-configure-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-create-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-install-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-multivariant.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-nfc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-nfc", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-package-splitter.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-package-splitter", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-script-to-install-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-uninstall-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-a-device-for-anyone-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-device-for-anyone-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-shared-or-guest-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/settings-that-can-be-locked-down.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-layout-xml-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-layout-xml-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-secondary-tiles.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-secondary-tiles", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-taskbar-lockscreen.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-taskbar-lockscreen", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/start-taskbar-lockscreen.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/stop-employees-from-using-the-windows-store.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/windows-10-start-layout-options-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/windows-diagnostic-data-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/windows-spotlight.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-spotlight.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-forest-by-proxy-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-by-proxy-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-forest-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-using-active-directory-based-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-using-key-management-service-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-key-management-service-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-windows-10-clients-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-windows-10-clients-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/active-directory-based-activation-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/active-directory-based-activation-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-manage-products-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-manage-products-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-remove-computers-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-computers-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-remove-product-key-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-product-key-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/assign-applications-using-roles-in-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/assign-applications-using-roles-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/change-history-for-deploy-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/change-history-for-deploy-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-a-pxe-server-to-load-windows-pe.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/configure-a-pxe-server-to-load-windows-pe", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-client-computers-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/configure-client-computers-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-2013-for-userexit-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-for-userexit-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-2013-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-deployment-share-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-for-userexit-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-a-windows-10-reference-image.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-a-windows-10-image-using-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-whats-new.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-whats-new", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/getting-started-with-the-user-state-migration-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/import-export-vamt-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/import-export-vamt-data", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-configure-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-configure-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-kms-client-key-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-kms-client-key-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-product-key-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-product-key-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/introduction-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/introduction-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/key-features-in-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/key-features-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/kms-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/kms-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/local-reactivation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/local-reactivation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-activations-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-activations-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-product-keys-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-product-keys-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-vamt-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-vamt-data", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-analytics.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-readiness.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/mbr-to-gpt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/mbr-to-gpt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/mdt-2013-lite-touch-components.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-2013-lite-touch-components", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/mdt-lite-touch-components.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/migrate-application-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migrate-application-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/migration-store-types-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migration-store-types-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/monitor-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/monitor-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/offline-migration-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/offline-migration-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/online-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/online-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/plan-for-volume-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/proxy-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/proxy-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/refresh-a-windows-7-computer-with-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/remove-products-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/remove-products-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/resolve-windows-10-upgrade-errors.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/resolve-windows-10-upgrade-errors", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/scenario-kms-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-kms-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/scenario-online-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-online-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/scenario-proxy-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-proxy-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/set-up-mdt-2013-for-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-2013-for-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/set-up-mdt-for-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/sideload-apps-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/sideload-apps-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/troubleshoot-upgrade-analytics.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/troubleshoot-upgrade-readiness.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/deploy/understanding-migration-xml-files.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/understanding-migration-xml-files", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/update-product-status-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/update-product-status-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-additional-insights.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-deploy-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-deployment-script.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-identify-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-resolve-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-upgrade-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-additional-insights.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-deploy-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-deployment-script.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-identify-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-release-notes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-release-notes", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-resolve-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-upgrade-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-windows-phone-8-1-to-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-the-volume-activation-management-tool-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-upgrade-readiness-to-manage-windows-upgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", + "redirect_document_id": false + }, + { + "source_path": "windows/deploy/use-vamt-in-windows-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-vamt-in-windows-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-web-services-in-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-web-services-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-best-practices.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-best-practices", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-choose-migration-store-type.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-choose-migration-store-type", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-command-line-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-command-line-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-common-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-common-migration-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-migration-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-configxml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-configxml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-conflicts-and-precedence.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-conflicts-and-precedence", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-custom-xml-examples.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-custom-xml-examples", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-customize-xml-files.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-customize-xml-files", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-determine-what-to-migrate.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-determine-what-to-migrate", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-estimate-migration-store-size.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-estimate-migration-store-size", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-exclude-files-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-exclude-files-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-faq.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-faq", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-general-conventions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-general-conventions", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-hard-link-migration-store.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-hard-link-migration-store", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-how-to.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-to", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-application-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-application-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-file-types-files-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-file-types-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-operating-system-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-operating-system-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-users.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-users", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-include-files-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-include-files-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-loadstate-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-loadstate-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-log-files.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-migrate-efs-files-and-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-migrate-user-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-user-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-migration-store-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migration-store-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-plan-your-migration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-plan-your-migration", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-recognized-environment-variables.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-recognized-environment-variables", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-reroute-files-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reroute-files-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-return-codes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-scanstate-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-scanstate-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-test-your-migration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-test-your-migration", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-topics.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-topics", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-utilities.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-utilities", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-what-does-usmt-migrate.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-what-does-usmt-migrate", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-xml-elements-library.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-elements-library", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-xml-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/vamt-known-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-known-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/vamt-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/vamt-step-by-step.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-step-by-step", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/verify-the-condition-of-a-compressed-migration-store.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/volume-activation-management-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-management-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/volume-activation-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-deployment-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-deployment-tools-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-tools-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-edition-upgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-enterprise-e3-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-e3-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-poc-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-poc-sc-config-mgr.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-sc-config-mgr", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-poc.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-upgrade-paths.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-upgrade-paths", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-adk-scenarios-for-it-pros.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-adk-scenarios-for-it-pros", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-deployment-scenarios-and-tools.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-upgrade-and-migration-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-upgrade-and-migration-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/xml-file-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/xml-file-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/access-credential-manager-as-a-trusted-caller.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/access-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-lockout-duration.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-duration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-lockout-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-administrator-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-administrator-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-block-microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-guest-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-guest-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-rename-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-rename-guest-account.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-guest-account", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/act-as-part-of-the-operating-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/active-directory-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/active-directory-security-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-security-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-workstations-to-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/add-workstations-to-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/additional-mitigations.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/additional-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/adjust-memory-quotas-for-a-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/administer-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/administer-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/administer-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/administer-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/advanced-security-auditing-faq.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing-faq", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/advanced-security-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/allow-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/allow-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/app-behavior-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/app-behavior-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-architecture-and-components.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-architecture-and-components", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-functions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-functions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-policies-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-policies-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-policy-use-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policy-use-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-processes-and-interactions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-processes-and-interactions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/assign-security-group-filters-to-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-account-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-account-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-application-generated.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-generated", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-application-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-audit-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-audit-the-access-of-global-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-authentication-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authentication-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-authorization-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authorization-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-central-access-policy-staging.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-central-access-policy-staging", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-certification-services.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-certification-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-computer-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-computer-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-credential-validation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-credential-validation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-detailed-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-directory-service-replication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-detailed-file-share.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-directory-service-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-replication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-distribution-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-distribution-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-dpapi-activity.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-dpapi-activity", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-file-share.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-file-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-filtering-platform-connection.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-connection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-filtering-platform-packet-drop.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-packet-drop", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-filtering-platform-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-group-membership.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-group-membership", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-handle-manipulation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-handle-manipulation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-driver.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-driver", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-extended-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-extended-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-main-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-main-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-quick-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-quick-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-kerberos-authentication-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-authentication-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-kerberos-service-ticket-operations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-service-ticket-operations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-kernel-object.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kernel-object", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-logoff.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logoff", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-mpssvc-rule-level-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-network-policy-server.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-network-policy-server", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-non-sensitive-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-non-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-account-management-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-management-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-logonlogoff-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-logonlogoff-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-object-access-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-object-access-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-policy-change-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-policy-change-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-privilege-use-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-privilege-use-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-system-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-pnp-activity.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-pnp-activity", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-process-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-process-termination.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-termination", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-registry.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-registry", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-removable-storage.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-removable-storage", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-rpc-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-rpc-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-sam.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sam", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-security-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-security-state-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-state-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-security-system-extension.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-system-extension", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-sensitive-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-special-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-special-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-system-integrity.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-system-integrity", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-user-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-user-device-claims.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-device-claims", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/back-up-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/back-up-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-directory-service-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-object-access.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-object-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-process-tracking.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-process-tracking", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-system-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-security-audit-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bcd-settings-and-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bcd-settings-and-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-basic-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-basic-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-countermeasures.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-countermeasures", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-device-encryption-overview-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-frequently-asked-questions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-frequently-asked-questions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-how-to-enable-network-unlock.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-recovery-guide-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-recovery-guide-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/block-untrusted-fonts-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/block-untrusted-fonts-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/boundary-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bypass-traverse-checking.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/bypass-traverse-checking", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/certificate-based-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-rules-from-request-to-require-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-the-system-time.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-system-time", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-the-time-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-time-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-the-tpm-owner-password.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/change-the-tpm-owner-password", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-basic-firewall-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-group-policy-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-group-policy-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-inbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-outbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/choose-the-right-bitlocker-countermeasure.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/command-line-arguments-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configuration-management-reference-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-an-applocker-policy-for-audit-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-authentication-methods.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-authentication-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-data-protection-quick-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-email-notifications-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-exceptions-for-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-key-exchange-main-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-network-connections-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-notifications-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-protection-features-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-remediation-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-s-mime.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/configure-s-mime", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-application-identity-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-application-identity-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-appLocker-reference-device.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-appLocker-reference-device", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-rules-to-require-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-windows-firewall-log.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-windows-firewall-log", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-workstation-authentication-certificate-template.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-windows-defender-antivirus-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-group-account-in-active-directory.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-account-in-active-directory", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-group-policy-object.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-policy-object", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-for-packaged-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-for-packaged-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-that-uses-a-path-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-token-object.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-token-object", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-authentication-exemption-list-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-authentication-request-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-request-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-inbound-icmp-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-icmp-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-inbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-inbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-outbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-outbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-and-verify-an-efs-dra-certificate.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-global-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-global-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-inbound-rules-to-support-rpc.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-permanent-shared-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-permanent-shared-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-symbolic-links.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-symbolic-links", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-vpn-and-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-wip-policy-using-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-wmi-filters-for-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-your-applocker-planning-document.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-planning-document", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-your-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-manage.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-manage", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-not-protected-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-not-protected-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-protection-limits.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-protection-limits", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/customize-run-review-remediate-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/debug-programs.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/debug-programs", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/delete-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/delete-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-access-to-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-code-integrity-policies-steps.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-steps", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-the-applocker-policy-into-production.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-the-applocker-policy-into-production", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deployment-vdi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determine-your-application-control-objectives.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-your-application-control-objectives", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determining-the-trusted-state-of-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/device-guard-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-allow-undock-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dll-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/dll-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-your-application-control-management-processes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-control-management-processes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-your-application-list.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-list", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/documenting-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/documenting-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-controller-ldap-server-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-disable-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-maximum-machine-account-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dynamic-access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/dynamic-access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/edit-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/edit-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-predefined-inbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-inbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-predefined-outbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-outbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-the-dll-rule-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enable-the-dll-rule-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/encrypted-hard-drive.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/encrypted-hard-drive", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/encryption-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enforce-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enforce-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enforce-password-history.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-password-history", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enforce-user-logon-restrictions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-user-logon-restrictions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enlightened-microsoft-apps-and-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enterprise-certificate-pinning.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/enterprise-certificate-pinning", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/evaluate-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1100.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1100", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1102.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1102", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1104.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1104", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1105.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1105", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1108.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1108", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4608.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4608", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4610.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4610", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4611.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4611", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4612.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4612", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4614.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4614", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4615.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4615", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4616.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4616", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4618.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4618", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4621.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4621", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4622.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4622", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4624.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4624", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4625.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4625", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4626.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4626", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4627.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4627", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4634.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4634", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4647.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4647", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4648.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4648", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4649.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4649", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4656.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4656", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4657.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4657", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4658.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4658", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4660.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4660", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4661.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4661", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4662.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4662", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4663.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4663", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4664.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4664", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4670.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4670", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4671.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4671", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4672.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4672", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4673.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4673", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4674.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4674", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4675.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4675", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4688.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4688", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4689.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4689", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4690.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4690", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4691.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4691", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4692.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4692", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4693.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4693", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4694.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4694", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4695.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4695", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4696.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4696", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4697.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4697", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4698.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4698", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4699.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4699", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4700.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4700", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4701.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4701", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4702.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4702", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4703.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4703", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4704.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4704", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4705.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4705", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4706.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4706", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4707.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4707", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4713.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4713", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4714.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4714", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4715.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4715", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4716.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4716", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4717.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4717", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4718.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4718", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4719.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4719", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4720.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4720", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4722.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4722", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4723.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4723", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4724.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4724", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4725.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4725", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4726.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4726", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4731.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4731", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4732.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4732", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4733.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4733", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4734.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4734", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4735.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4735", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4738.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4738", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4739.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4739", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4740.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4740", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4741.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4741", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4742.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4742", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4743.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4743", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4749.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4749", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4750.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4750", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4751.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4751", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4752.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4752", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4753.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4753", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4764.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4764", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4765.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4765", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4766.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4766", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4767.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4767", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4768.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4768", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4769.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4769", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4770.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4770", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4771.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4771", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4772.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4772", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4773.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4773", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4774.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4774", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4775.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4775", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4776.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4776", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4777.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4777", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4778.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4778", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4779.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4779", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4780.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4780", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4781.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4781", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4782.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4782", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4793.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4793", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4794.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4794", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4798.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4798", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4799.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4799", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4800.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4800", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4801.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4801", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4802.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4802", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4803.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4803", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4816.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4816", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4817.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4817", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4818.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4818", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4819.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4819", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4826.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4826", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4864.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4864", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4865.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4865", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4866.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4866", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4867.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4867", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4902.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4902", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4904.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4904", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4905.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4905", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4906.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4906", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4907.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4907", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4908.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4908", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4909.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4909", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4910.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4910", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4911.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4911", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4912.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4912", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4913.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4913", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4928.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4928", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4929.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4929", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4930.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4930", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4931.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4931", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4932.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4932", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4933.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4933", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4934.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4934", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4935.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4935", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4936.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4936", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4937.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4937", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4944.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4944", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4945.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4945", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4946.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4946", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4947.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4947", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4948.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4948", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4949.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4949", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4950.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4950", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4951.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4951", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4952.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4952", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4953.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4953", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4954.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4954", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4956.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4956", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4957.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4957", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4958.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4958", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4964.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4964", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4985.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4985", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5024.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5024", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5025.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5025", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5027.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5027", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5028.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5028", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5029.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5029", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5030.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5030", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5031.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5031", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5032.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5032", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5033.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5033", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5034.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5034", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5035.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5035", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5037.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5037", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5038.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5038", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5039.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5039", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5051.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5051", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5056.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5056", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5057.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5057", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5058.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5058", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5059.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5059", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5060.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5060", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5061.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5061", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5062.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5062", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5063.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5063", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5064.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5064", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5065.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5065", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5066.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5066", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5067.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5067", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5068.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5068", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5069.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5069", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5070.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5070", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5136.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5136", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5137.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5137", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5138.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5138", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5139.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5139", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5140.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5140", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5141.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5141", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5142.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5142", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5143.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5143", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5144.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5144", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5145.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5145", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5148.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5148", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5149.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5149", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5150.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5150", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5151.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5151", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5152.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5152", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5153.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5153", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5154.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5154", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5155.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5155", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5156.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5156", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5157.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5157", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5158.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5158", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5159.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5159", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5168.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5168", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5376.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5376", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5377.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5377", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5378.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5378", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5447.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5447", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5632.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5632", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5633.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5633", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5712.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5712", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5888.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5888", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5889.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5889", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5890.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5890", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6144.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6144", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6145.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6145", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6281.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6281", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6400.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6400", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6401.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6401", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6402.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6402", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6403.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6403", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6404.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6404", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6405.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6405", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6406.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6406", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6407.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6407", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6408.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6408", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6409.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6409", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6410.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6410", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6416.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6416", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6419.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6419", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6420.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6420", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6421.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6421", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6422.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6422", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6423.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6423", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6424.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6424", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/executable-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/executable-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/exempt-icmp-from-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exempt-icmp-from-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/exemption-list.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exemption-list", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/export-an-applocker-policy-from-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/file-system-global-object-access-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/file-system-global-object-access-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/firewall-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/firewall-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/force-shutdown-from-a-remote-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-information-about-your-active-directory-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-information-about-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-other-relevant-information.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-other-relevant-information", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-the-information-you-need.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-the-information-you-need", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/generate-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/generate-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-boundary.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-boundary", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-isolateddomain-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-isolateddomain-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/guidance-and-best-practices-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-and-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-biometrics-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-errors-during-pin-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-event-300.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-identity-verification.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-manage-in-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-prepare-people-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-why-pin-is-better-than-password.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-applocker-works-techref.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/how-applocker-works-techref", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-to-configure-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-user-account-control-works.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/how-user-account-control-works", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/impersonate-a-client-after-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/import-an-applocker-policy-from-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-from-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/import-an-applocker-policy-into-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/increase-a-process-working-set.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-a-process-working-set", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/increase-scheduling-priority.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-scheduling-priority", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/installing-digital-certificates-on-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-do-not-display-last-user-name.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-machine-inactivity-limit.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-require-smart-card.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-smart-card", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-smart-card-removal-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/isolated-domain-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/isolating-apps-on-your-network.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolating-apps-on-your-network", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/kerberos-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/kerberos-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/limitations-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/limitations-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/link-the-gpo-to-the-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/link-the-gpo-to-the-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/load-and-unload-device-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/load-and-unload-device-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/lock-pages-in-memory.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/lock-pages-in-memory", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-auditing-and-security-log.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/manage-auditing-and-security-log", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-packaged-apps-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/manage-packaged-apps-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-tpm-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-tpm-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-updates-baselines-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/mandatory-settings-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-lifetime-for-service-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/merge-applocker-policies-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/minimum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/minimum-password-length.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-length", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/modify-an-object-label.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-an-object-label", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/modify-firmware-environment-values.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-firmware-environment-values", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-application-usage-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/monitor-application-usage-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-claim-types.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-claim-types", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-resource-attribute-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-resource-attribute-definitions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-use-of-removable-storage-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-allow-anonymous-sidname-translation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-list-manager-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-list-manager-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-lan-manager-authentication-level.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-ldap-client-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/optimize-applocker-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/optimize-applocker-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/other-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/other-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/override-mitigation-options-for-app-related-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/overview-create-wip-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/password-must-meet-complexity-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/password-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/perform-volume-maintenance-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/plan-for-applocker-policy-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/plan-for-applocker-policy-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-certificate-based-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-certificate-based-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-domain-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-domain-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-gpo-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-gpo-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-isolation-groups-for-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-network-access-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-network-access-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-server-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-server-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-the-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-the-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/prevent-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/preview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/procedures-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/procedures-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/profile-single-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-single-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/profile-system-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-system-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-devices-from-unwanted-network-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-enterprise-data-using-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/recommended-network-definitions-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/refresh-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/refresh-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/registry-global-object-access-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/registry-global-object-access-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/remote-credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/remote-credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/remove-computer-from-docking-station.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/remove-computer-from-docking-station", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/replace-a-process-level-token.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/replace-a-process-level-token", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/report-monitor-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/requirements-for-deploying-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-for-deploying-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/requirements-to-use-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-to-use-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/reset-account-lockout-counter-after.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/reset-account-lockout-counter-after", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restore-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/restore-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restrict-access-to-only-trusted-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/review-scan-results-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/run-scan-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/run-the-automatically-generate-rules-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/run-the-automatically-generate-rules-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/script-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/script-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/secpol-advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-auditing-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/security-auditing-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-considerations-for-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/security-considerations-for-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-identifiers.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-identifiers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-options.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-options", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-policy-settings-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-principals.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-principals", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/select-types-of-rules-to-create.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/server-isolation-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/server-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/service-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/service-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/service-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/shut-down-the-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shut-down-the-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-and-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-and-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-certificate-propagation-service.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-propagation-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-certificate-requirements-and-enumeration.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-debugging-information.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-debugging-information", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-events.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-group-policy-and-registry-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-how-smart-card-sign-in-works-in-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-removal-policy-service.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-removal-policy-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-smart-cards-for-windows-service.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-tools-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-tools-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-windows-smart-card-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/special-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/special-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/store-passwords-using-reversible-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/synchronize-directory-service-data.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/synchronize-directory-service-data", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-settings-optional-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-optional-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/take-ownership-of-files-or-other-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/test-and-update-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-and-update-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/testing-scenarios-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/tools-to-use-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/tools-to-use-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/tpm-fundamentals.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-fundamentals", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/tpm-recommendations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-recommendations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/trusted-platform-module-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/trusted-platform-module-services-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/trusted-platform-module-top-node.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-top-node", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-applocker-enforcement-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-enforcement-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-applocker-policy-design-decisions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-policy-design-decisions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-the-applocker-policy-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-the-applocker-policy-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-collections.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-collections", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-condition-types.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-condition-types", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-exceptions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-exceptions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-windows-firewall-with-advanced-security-design-process.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-group-policy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-intune-config-manager-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-wmi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-rights-assignment.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-rights-assignment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-event-viewer-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-event-viewer-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-owa-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/using-owa-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/verify-that-network-traffic-is-authenticated.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/view-the-security-event-log.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/view-the-security-event-log", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-deploy-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-evaluate-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-tpmvscmgr.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-understanding-and-evaluating.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-use-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-auto-trigger-profile.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-auto-trigger-profile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-conditional-access.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-connection-type.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-connection-type", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-name-resolution.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-name-resolution", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-profile-options.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-profile-options", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-routing.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-routing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-security-features.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-security-features", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/what-is-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/what-is-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-10-mobile-security-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/windows-10-mobile-security-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-credential-theft-mitigation-guide-abstract", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-antivirus-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-antivirus-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-offline.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/windows-defender-offline", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-security-center-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/windows-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-security-baselines.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/windows-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/wip-app-enterprise-context.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/wip-app-enterprise-context", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/working-with-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/working-with-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/acquire-apps-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/acquire-apps-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/add-unsigned-app-to-code-integrity-policy.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/add-unsigned-app-to-code-integrity-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/administrative-tools-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/administrative-tools-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/app-inventory-management-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/apps-in-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/apps-in-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-about-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-about-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-administering-appv-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-appv-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-administering-virtual-applications-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-allow-administrators-to-enable-connection-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-application-publishing-and-client-interaction.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-application-publishing-and-client-interaction", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-apply-the-user-configuration-file-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-batch-sequencing.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-sequencing", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-batch-updating.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-updating", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-clean-unpublished-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-clean-unpublished-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-provision-a-vm.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-provision-a-vm", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-available-mdm-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-available-mdm-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-capacity-planning.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-capacity-planning", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-client-configuration-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-client-configuration-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-configure-access-to-packages-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-connect-to-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connect-to-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-connection-group-file.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-file", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-connection-group-virtual-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-virtual-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-connection-group.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-package-accelerator-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-package-accelerator.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-virtual-application-package-package-accelerator.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-and-use-a-project-template.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-and-use-a-project-template", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-creating-and-managing-virtualized-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-delete-a-connection-group.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-connection-group", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-delete-a-package-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-package-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-appv-databases-with-sql-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-the-appv-server-with-a-script.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-the-appv-server.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-microsoft-office-2013-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-microsoft-office-2016-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-the-appv-sequencer-and-client.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-the-appv-server.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-server", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deployment-checklist.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deployment-checklist", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-dynamic-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-dynamic-configuration", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-enable-the-app-v-desktop-client.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-the-app-v-desktop-client", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-evaluating-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-evaluating-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-getting-started.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-high-level-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-high-level-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-management-server-on-a-standalone-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-sequencer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-sequencer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-maintaining-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-maintaining-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-managing-connection-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-managing-connection-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-migrating-to-appv-from-a-previous-version.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-modify-an-existing-virtual-application-package.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-modify-client-configuration-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-client-configuration-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-move-the-appv-server-to-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-operations.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-operations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-performance-guidance.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-performance-guidance", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-checklist.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-checklist", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-folder-redirection-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-folder-redirection-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-appv-server-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv-server-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-high-availability-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-high-availability-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-sequencer-and-client-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-using-appv-with-office.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-using-appv-with-office", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-to-deploy-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-preparing-your-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-preparing-your-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-prerequisites.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-prerequisites", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-publish-a-connection-group.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-connection-group", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-publish-a-packages-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-register-and-unregister-a-publishing-server-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-release-notes-for-appv-for-windows-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-release-notes-for-appv-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-reporting.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-reporting", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-running-locally-installed-applications-inside-a-virtual-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-security-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-security-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-sequence-a-new-application.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-new-application", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-sequence-a-package-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-package-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-supported-configurations.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-supported-configurations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-using-the-client-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-viewing-appv-server-publishing-metadata.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/assign-apps-to-employees.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/assign-apps-to-employees", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-mdm-provider-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/configure-mdm-provider-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/connect-to-remote-aadj-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/connect-to-remote-aadj-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/device-guard-signing-portal.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/device-guard-signing-portal", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-apps-from-your-private-store.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/distribute-apps-to-your-employees-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-apps-with-management-tool.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-with-management-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-offline-apps.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-offline-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/find-and-acquire-apps-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/find-and-acquire-apps-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/group-policies-for-enterprise-and-education-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/group-policies-for-enterprise-and-education-editions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/join-windows-10-mobile-to-azure-active-directory.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/join-windows-10-mobile-to-azure-active-directory", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-access-to-private-store.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-access-to-private-store", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-apps-windows-store-for-business-overview.md", + "redirect_url": "/microsoft-store/manage-apps-windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-apps-windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-apps-microsoft-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-corporate-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-orders-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-orders-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-private-store-settings.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-private-store-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-settings-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-settings-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-users-and-groups-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-users-and-groups-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-windows-10-in-your-organization-modern-management.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/mandatory-user-profile.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mandatory-user-profile", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/new-policies-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/new-policies-for-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/prerequisites-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/prerequisites-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/reset-a-windows-10-mobile-device.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/reset-a-windows-10-mobile-device", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/roles-and-permissions-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/roles-and-permissions-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/settings-reference-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/settings-reference-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/sign-code-integrity-policy-with-device-guard-signing.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/sign-up-windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/sign-up-windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/sign-up-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/sign-up-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/troubleshoot-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/troubleshoot-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-microsoft-store-for-business", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-administering-uev.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-application-template-schema-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-application-template-schema-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-configuring-uev-with-group-policy-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-deploy-required-features.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-required-features", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-deploy-uev-for-custom-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-getting-started.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-manage-administrative-backup-and-restore.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-manage-configurations.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-configurations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-migrating-settings-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-migrating-settings-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-prepare-for-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-prepare-for-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-release-notes-1607.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-release-notes-1607", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-security-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-sync-methods.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-sync-trigger-events.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-trigger-events", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-synchronizing-microsoft-office-with-uev.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-upgrade-uev-from-previous-releases.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-using-uev-with-application-virtualization-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-whats-new-in-uev-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-windows-store-for-business-account-settings.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/update-windows-store-for-business-account-settings", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/update-windows-store-for-business-account-settings.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings", + "redirect_document_id": false + }, + { + "source_path": "store-for-business/work-with-partner-microsoft-store-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/commerce/manage-partners", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/windows-10-mobile-and-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-libraries.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/windows-libraries", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/working-with-line-of-business-apps.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/act-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/act-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/applying-filters-to-data-in-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/available-data-types-and-operators-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/best-practice-recommendations-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/best-practice-recommendations-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/change-history-for-plan-for-windows-10-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/compatibility-administrator-users-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-administrator-users-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/compatibility-fix-database-management-strategies-and-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/deployment-considerations-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/deployment-considerations-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/device-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/device-dialog-box", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/fixing-applications-by-using-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/fixing-applications-by-using-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/prepare-your-organization-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/prepare-your-organization-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/security-and-data-protection-considerations-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/showing-messages-generated-by-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/showing-messages-generated-by-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/sua-users-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/sua-users-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/tabs-on-the-sua-tool-interface.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/tabs-on-the-sua-tool-interface", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/testing-your-application-mitigation-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/testing-your-application-mitigation-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/understanding-and-using-compatibility-fixes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/understanding-and-using-compatibility-fixes", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-compatibility-administrator-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-compatibility-administrator-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-sdbinstexe-command-line-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sdbinstexe-command-line-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-sua-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/viewing-the-events-screen-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-deployment-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-deployment-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-enterprise-faq-itpro.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-infrastructure-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-infrastructure-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-to-go-frequently-asked-questions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-frequently-asked-questions", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-to-go-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/update/change-history-for-update-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/change-history-for-update-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/update/update-compliance-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/update/update-compliance-monitor.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", + "redirect_document_id": true + }, + { + "source_path": "windows/update/update-compliance-using.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-branchcache.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-configure-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-delivery-optimization.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-deployment-rings-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-integrate-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-manage-updates-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-manage-updates-wsus.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-manage-updates-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/update/waas-mobile-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-optimize-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-quick-start.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-restart.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-servicing-branches-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-servicing-strategy-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-windows-insider-for-business-aad.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business-aad", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-windows-insider-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-wufb-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-settings-app-with-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/manage-settings-app-with-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/client-management/mdm/create-a-custom-configuration-service-provider.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/client-management/mdm/design-a-custom-windows-csp.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/iconfigserviceprovider2.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/iconfigserviceprovider2getnode.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnode.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodeadd.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodeclear.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodecopy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodedeletechild.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodedeleteproperty.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodeexecute.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetchildnodenames.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetproperty.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetpropertyidentifiers.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetvalue.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodemove.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodesetproperty.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodesetvalue.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodetransactioning.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspvalidate.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-surface-hub", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-iot-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-iot-core.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-iot-core", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-iot-core.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-hololens2.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-hololens2", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-hololens2.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-development-edition", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-development-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-commercial-suite", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-commercial-suite.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-admx-backed.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-admx-backed", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-admx-backed.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-admx-backed", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-that-can-be-set-using-eas.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/collect-wip-audit-event-logs.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-managed-installer-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-managed-installer-for-device-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-data-sharing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-data-sharing", + "redirect_document_id": true + }, + { + "source_path": "windows/index.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/index.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/index.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/index", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/index.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/index", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/index.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/index", + "redirect_document_id": true + }, + { + "source_path": "windows/update/index.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/index.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/index", + "redirect_document_id": true + }, + { + "source_path": "browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md", + "redirect_url": "https://docs.microsoft.com/internet-explorer/kb-support/ie-edge-faqs", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/security-technologies.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "education/get-started/index.md", + "redirect_url": "/education/get-started/get-started-with-microsoft-education", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-10-enterprise-security-guides.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-history-for-keep-windows-10-secure.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/change-history-for-manage-and-update-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/waas-servicing-branches-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-10-enterprise-activation-subscription.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-10-auto-pilot.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/privacy/basic-level-windows-diagnostic-events-and-fields.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/configure-windows-diagnostic-data-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/diagnostic-data-viewer-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/gdpr-win10-whitepaper.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/gdpr-win10-whitepaper", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/manage-windows-endpoints-version-1709.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/windows-diagnostic-data-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data-1703", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/windows-diagnostic-data.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/upgrade/windows-10-edition-downgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", + "redirect_document_id": true + }, + { + "source_path": "education/windows/windows-automatic-redeployment.md", + "redirect_url": "https://docs.microsoft.com/education/windows/autopilot-reset", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-10-autopilot.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot", + "redirect_document_id": false + }, + { + "source_path": "windows/privacy/manage-windows-endpoints.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-2004-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alerts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-information", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineaction-object", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineactions-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineaction-object", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/index", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/isolate-machine", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-av-scan", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-information", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicator-by-id-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-analytics", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/files", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineaction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machineactionsnote.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ti-indicator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/update-alert", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/incidents-queue.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/incidents-queue", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/use-apis.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/user-alert-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-fall-creators-deprecation.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1709-removed-features", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-creators-update-deprecation.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1703-removed-features", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-10-enterprise-subscription-activation.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation", + "redirect_document_id": true + }, + { + "source_path": "windows/hub/windows-10-landing.yml", + "redirect_url": "https://docs.microsoft.com/windows/windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/user-driven-aad.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/user-driven-hybrid.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/intune-connector.md", + "redirect_url": "https://docs.microsoft.com/intune/windows-autopilot-hybrid", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-local.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/configure-autopilot.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/administer.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/hub/release-information.md", + "redirect_url": "https://docs.microsoft.com/windows/release-information", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-10-architecture-posters.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/index.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection", + "redirect_document_id": true + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md", + "redirect_url": "https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", + "redirect_document_id": true + }, + { + "source_path": "education/get-started/change-history-ms-edu-get-started.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/get-started-with-microsoft-education.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/configure-microsoft-store-for-education.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/enable-microsoft-teams.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/finish-setup-and-other-tasks.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/inclusive-classroom-it-admin.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/inclusive-classroom-it-admin", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/set-up-office365-edu-tenant.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/set-up-windows-10-education-devices.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/set-up-windows-education-devices.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/use-intune-for-education.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/surface-dock-updater.md", + "redirect_url": "/surface/surface-dock-firmware-update", + "redirect_document_id": true + }, + { + "source_path": "education/get-started/use-school-data-sync.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew", + "redirect_document_id": true + }, + { + "source_path": "windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-exclusions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-pua", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-perf.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-kext.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-privacy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-4-enterprise-devops-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-5-enterprise-administrator-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/product-brief.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/licensing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/release-information/status-windows-10-1703.yml", + "redirect_url": "https://docs.microsoft.com/windows/release-information/windows-message-center", + "redirect_document_id": true + }, + { + "source_path": "windows/release-information/resolved-issues-windows-10-1703.yml", + "redirect_url": "https://docs.microsoft.com/windows/release-information/windows-message-center", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1703-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1709-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1803-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md", + "redirect_url": "/surface/manage-surface-driver-and-firmware-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-1809-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1903-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-azure-portal.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-FAQ-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-get-started.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-overview.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-privacy.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/device-health-get-started.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/device-health-monitor.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/device-health-using.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-additional-insights.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-architecture.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-data-sharing.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-deployment-script.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-deploy-windows.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-get-started.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-identify-apps.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-requirements.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-resolve-issues.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-target-new-OS.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-manage-updates-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#mdt-lite-touch-components", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/key-features-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#key-features-in-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/upgrade-to-windows-10-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-a-task-sequence-with-configuration-manager-and-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/create-a-task-sequence-with-configuration-manager-and-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager#procedures", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/upgrade-to-windows-10-with-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/get-started-with-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", + "redirect_document_id": false + }, + { + "source_path": "surface/step-by-step-surface-deployment-accelerator.md", + "redirect_url": "https://docs.microsoft.com/surface/microsoft-surface-deployment-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode", + "redirect_document_id": true + }, + { + "source_path": "devices/surface/using-the-sda-deployment-share.md", + "redirect_url": "https://docs.microsoft.com/surface/microsoft-surface-deployment-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/gov", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/office-365-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/windows-defender-offline", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/privacy/gdpr-win10-whitepaper.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": true + }, + { + "source_path": "windows/privacy/gdpr-it-guidance.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": false + }, + { + "source_path": "windows/privacy/windows-personal-data-services-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/add-devices.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/add-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-device-guidelines.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-device-guidelines", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-faq.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-faq", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-mbr.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-mbr", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-support.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-support", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-update.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-update", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/bitlocker.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/deployment-process.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/dfci-management.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/dfci-management", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/enrollment-status.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/enrollment-status", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/existing-devices.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/existing-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/known-issues.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/known-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/policy-conflicts.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/policy-conflicts", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/profiles.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/profiles", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/registration-auth.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/registration-auth", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/self-deploying.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/self-deploying", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/user-driven.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/user-driven", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/white-glove.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/white-glove", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-reset", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-scenarios.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-whats-new.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-whats-new", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot", + "redirect_document_id": true + }, + { + "source_path": "windows/hub/windows-10.yml", + "redirect_url": "https://docs.microsoft.com/windows/windows-10", + "redirect_document_id": false + } + ] } diff --git a/.vscode/extensions.json b/.vscode/extensions.json deleted file mode 100644 index af02986a5a..0000000000 --- a/.vscode/extensions.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "recommendations": [ - "docsmsft.docs-authoring-pack" - ] -} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json index e7f59d08ec..f66a07d2e4 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,7 +1,5 @@ { - "cSpell.words": [ - "kovter", - "kovter's", - "poshspy" - ] + "cSpell.words": [ + "emie" + ] } \ No newline at end of file diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000000..7fc05fbd5b --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1,5 @@ +docfx.json @microsoftdocs/officedocs-admin +.openpublishing.build.ps1 @microsoftdocs/officedocs-admin +.openpublishing.publish.config.json @microsoftdocs/officedocs-admin +CODEOWNERS @microsoftdocs/officedocs-admin +.acrolinx-config.edn @microsoftdocs/officedocs-admin diff --git a/ThirdPartyNotices b/ThirdPartyNotices index a0bd09d68f..faceb5a528 100644 --- a/ThirdPartyNotices +++ b/ThirdPartyNotices @@ -7,7 +7,7 @@ see the [LICENSE](LICENSE) file, and grant you a license to any code in the repo Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. -Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653. +Microsoft's general trademark guidelines can be found at https://go.microsoft.com/fwlink/?LinkID=254653. Privacy information can be found at https://privacy.microsoft.com/en-us/ diff --git a/browsers/edge/TOC.md b/browsers/edge/TOC.md index 3314f77577..bae1f59877 100644 --- a/browsers/edge/TOC.md +++ b/browsers/edge/TOC.md @@ -28,6 +28,6 @@ ## [Change history for Microsoft Edge](change-history-for-microsoft-edge.md) -## [Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.md) +## [Microsoft Edge Frequently Asked Questions (FAQ)](microsoft-edge-faq.yml) diff --git a/browsers/edge/about-microsoft-edge.md b/browsers/edge/about-microsoft-edge.md index c9801bd936..e0085148dd 100644 --- a/browsers/edge/about-microsoft-edge.md +++ b/browsers/edge/about-microsoft-edge.md @@ -1,166 +1,169 @@ ---- -title: Microsoft Edge system and language requirements -description: Overview information about Microsoft Edge, the default browser for Windows 10. This topic includes links to other Microsoft Edge topics. -ms.assetid: 70377735-b2f9-4b0b-9658-4cf7c1d745bb -ms.reviewer: -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.prod: edge -ms.mktglfcycl: general -ms.topic: reference -ms.sitesec: library -title: Microsoft Edge for IT Pros -ms.localizationpriority: medium -ms.date: 10/02/2018 ---- - -# Microsoft Edge system and language requirements ->Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile - -Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. - - ->[!IMPORTANT] ->The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don’t include Microsoft Edge or many other Universal Windows Platform (UWP) apps. Systems running the LTSB operating systems do not support these apps because their services get frequently updated with new functionality. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11. - - -## Minimum system requirements -Some of the components might also need additional system resources. Check the component's documentation for more information. - - -| Item | Minimum requirements | -|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Computer/processor | 1 gigahertz (GHz) or faster (32-bit (x86) or 64-bit (x64)) | -| Operating system |

Note
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | -| Memory |

| -| Hard drive space | | -| DVD drive | DVD-ROM drive (if installing from a DVD-ROM) | -| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | -| Graphics card | Microsoft DirectX 9 or later with Windows Display Driver Model (WDDM) 1.0 driver | -| Peripherals | Internet connection and a compatible pointing device | - ---- - - -## Supported languages - -Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/en-us/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. - -If the extension does not work after install, restart Microsoft Edge. If the extension still does not work, provide feedback through the Feedback Hub. - - -| Language | Country/Region | Code | -|----------------------------------------------------|-----------------------------------------|----------------| -| Afrikaans (South Africa) | South Africa | af-ZA | -| Albanian (Albania) | Albania | sq-AL | -| Amharic | Ethiopia | am-ET | -| Arabic (Saudi Arabia) | Saudi Arabia | ar-SA | -| Armenian | Armenia | hy-AM | -| Assamese | India | as-IN | -| Azerbaijani (Latin, Azerbaijan) | Azerbaijan | az-Latn-AZ | -| Bangla (Bangladesh) | Bangladesh | bn-BD | -| Bangla (India) | India | bn-IN | -| Basque (Basque) | Spain | eu-ES | -| Belarusian (Belarus) | Belarus | be-BY | -| Bosnian (Latin) | Bosnia and Herzegovina | bs-Latn-BA | -| Bulgarian (Bulgaria) | Bulgaria | bg-BG | -| Catalan (Catalan) | Spain | ca-ES | -| Central Kurdish (Arabic) | Iraq | ku-Arab-IQ | -| Cherokee (Cherokee) | United States | chr-Cher-US | -| Chinese (Hong Kong SAR) | Hong Kong Special Administrative Region | zh-HK | -| Chinese (Simplified, China) | People's Republic of China | zh-CN | -| Chinese (Traditional, Taiwan) | Taiwan | zh-TW | -| Croatian (Croatia) | Croatia | hr-HR | -| Czech (Czech Republic) | Czech Republic | cs-CZ | -| Danish (Denmark) | Denmark | da-DK | -| Dari | Afghanistan | prs-AF | -| Dutch (Netherlands) | Netherlands | nl-NL | -| English (United Kingdom) | United Kingdom | en-GB | -| English (United States) | United States | en-US | -| Estonian (Estonia) | Estonia | et-EE | -| Filipino (Philippines) | Philippines | fil-PH | -| Finnish (Finland) | Finland | fi_FI | -| French (Canada) | Canada | fr-CA | -| French (France) | France | fr-FR | -| Galician (Galician) | Spain | gl-ES | -| Georgian | Georgia | ka-GE | -| German (Germany) | Germany | de-DE | -| Greek (Greece) | Greece | el-GR | -| Gujarati | India | gu-IN | -| Hausa (Latin, Nigeria) | Nigeria | ha-Latn-NG | -| Hebrew (Israel) | Israel | he-IL | -| Hindi (India) | India | hi-IN | -| Hungarian (Hungary) | Hungary | hu-HU | -| Icelandic | Iceland | is-IS | -| Igbo | Nigeria | ig-NG | -| Indonesian (Indonesia) | Indonesia | id-ID | -| Irish | Ireland | ga-IE | -| isiXhosa | South Africa | xh-ZA | -| isiZulu | South Africa | zu-ZA | -| Italian (Italy) | Italy | it-IT | -| Japanese (Japan) | Japan | ja-JP | -| Kannada | India | kn-IN | -| Kazakh (Kazakhstan) | Kazakhstan | kk-KZ | -| Khmer (Cambodia) | Cambodia | km-KH | -| K'iche' | Guatemala | quc-Latn-GT | -| Kinyarwanda | Rwanda | rw-RW | -| KiSwahili | Kenya, Tanzania | sw-KE | -| Konkani | India | kok-IN | -| Korean (Korea) | Korea | ko-KR | -| Kyrgyz | Kyrgyzstan | ky-KG | -| Lao (Laos) | Lao P.D.R. | lo-LA | -| Latvian (Latvia) | Latvia | lv-LV | -| Lithuanian (Lithuania) | Lithuania | lt-LT | -| Luxembourgish (Luxembourg) | Luxembourg | lb-LU | -| Macedonian (Former Yugoslav Republic of Macedonia) | Macedonia (FYROM) | mk-MK | -| Malay (Malaysia) | Malaysia, Brunei, and Singapore | ms-MY | -| Malayalam | India | ml-IN | -| Maltese | Malta | mt-MT | -| Maori | New Zealand | mi-NZ | -| Marathi | India | mr-IN | -| Mongolian (Cyrillic) | Mongolia | mn-MN | -| Nepali | Federal Democratic Republic of Nepal | ne-NP | -| Norwegian (Nynorsk) | Norway | nn-NO | -| Norwegian, Bokmål (Norway) | Norway | nb-NO | -| Odia | India | or-IN | -| Polish (Poland) | Poland | pl-PL | -| Portuguese (Brazil) | Brazil | pt-BR | -| Portuguese (Portugal) | Portugal | pt-PT | -| Punjabi | India | pa-IN | -| Punjabi (Arabic) | Pakistan | pa-Arab-PK | -| Quechua | Peru | quz-PE | -| Romanian (Romania) | Romania | ro-RO | -| Russian (Russia) | Russia | ru-RU | -| Scottish Gaelic | United Kingdom | gd-GB | -| Serbian (Cyrillic, Bosnia, and Herzegovina) | Bosnia and Herzegovina | sr-Cyrl-BA | -| Serbian (Cyrillic, Serbia) | Serbia | sr-Cyrl-RS | -| Serbian (Latin, Serbia) | Serbia | sr-Latn-RS | -| Sesotho sa Leboa | South Africa | nso-ZA | -| Setswana (South Africa) | South Africa and Botswana | tn-ZA | -| Sindhi (Arabic) | Pakistan | sd-Arab-PK | -| Sinhala | Sri Lanka | si-LK | -| Slovak (Slovakia) | Slovakia | sk-SK | -| Slovenian (Slovenia) | Slovenia | sl-SL | -| Spanish (Mexico) | Mexico | es-MX | -| Spanish (Spain, International Sort) | Spain | en-ES | -| Swedish (Sweden) | Sweden | sv-SE | -| Tajik (Cyrillic) | Tajikistan | tg-Cyrl-TJ | -| Tamil (India) | India and Sri Lanka | ta-IN | -| Tatar | Russia | tt-RU | -| Telugu | India | te-IN | -| Thai (Thailand) | Thailand | th-TH | -| Tigrinya (Ethiopia) | Ethiopia | ti-ET | -| Turkish (Turkey) | Turkey | tr-TR | -| Turkmen | Turkmenistan | tk-TM | -| Ukrainian (Ukraine) | Ukraine | uk-UA | -| Urdu | Pakistan | ur-PK | -| Uyghur | People's Republic of China | ug-CN | -| Uzbek (Latin, Uzbekistan) | Uzbekistan | uz-Latn-UZ | -| Valencian | Spain | ca-ES-valencia | -| Vietnamese | Vietnam | vi-VN | -| Welsh | United Kingdom | cy-GB | -| Wolof | Senegal | wo-SN | -| Yoruba | Nigeria | yo-NG | - ---- +--- +title: Microsoft Edge system and language requirements +description: Overview information about Microsoft Edge, the default browser for Windows 10. This topic includes links to other Microsoft Edge topics. +ms.assetid: 70377735-b2f9-4b0b-9658-4cf7c1d745bb +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.prod: edge +ms.mktglfcycl: general +ms.topic: reference +ms.sitesec: library +ms.localizationpriority: medium +ms.date: 10/02/2018 +--- + +# Microsoft Edge system and language requirements +> Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. + + +> [!IMPORTANT] +> The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don’t include Microsoft Edge or many other Universal Windows Platform (UWP) apps. Systems running the LTSB operating systems do not support these apps because their services get frequently updated with new functionality. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11. + + +## Minimum system requirements +Some of the components might also need additional system resources. Check the component's documentation for more information. + + +| Item | Minimum requirements | +|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer/processor | 1 gigahertz (GHz) or faster (32-bit (x86) or 64-bit (x64)) | +| Operating system |

Note
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | +| Memory |

| +| Hard drive space | | +| DVD drive | DVD-ROM drive (if installing from a DVD-ROM) | +| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | +| Graphics card | Microsoft DirectX 9 or later with Windows Display Driver Model (WDDM) 1.0 driver | +| Peripherals | Internet connection and a compatible pointing device | + +--- + + +## Supported languages + +Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. + +If the extension does not work after install, restart Microsoft Edge. If the extension still does not work, provide feedback through the Feedback Hub. + + +| Language | Country/Region | Code | +|----------------------------------------------------|-----------------------------------------|----------------| +| Afrikaans (South Africa) | South Africa | af-ZA | +| Albanian (Albania) | Albania | sq-AL | +| Amharic | Ethiopia | am-ET | +| Arabic (Saudi Arabia) | Saudi Arabia | ar-SA | +| Armenian | Armenia | hy-AM | +| Assamese | India | as-IN | +| Azerbaijani (Latin, Azerbaijan) | Azerbaijan | az-Latn-AZ | +| Bangla (Bangladesh) | Bangladesh | bn-BD | +| Bangla (India) | India | bn-IN | +| Basque (Basque) | Spain | eu-ES | +| Belarusian (Belarus) | Belarus | be-BY | +| Bosnian (Latin) | Bosnia and Herzegovina | bs-Latn-BA | +| Bulgarian (Bulgaria) | Bulgaria | bg-BG | +| Catalan (Catalan) | Spain | ca-ES | +| Central Kurdish (Arabic) | Iraq | ku-Arab-IQ | +| Cherokee (Cherokee) | United States | chr-Cher-US | +| Chinese (Hong Kong SAR) | Hong Kong Special Administrative Region | zh-HK | +| Chinese (Simplified, China) | People's Republic of China | zh-CN | +| Chinese (Traditional, Taiwan) | Taiwan | zh-TW | +| Croatian (Croatia) | Croatia | hr-HR | +| Czech (Czech Republic) | Czech Republic | cs-CZ | +| Danish (Denmark) | Denmark | da-DK | +| Dari | Afghanistan | prs-AF | +| Dutch (Netherlands) | Netherlands | nl-NL | +| English (United Kingdom) | United Kingdom | en-GB | +| English (United States) | United States | en-US | +| Estonian (Estonia) | Estonia | et-EE | +| Filipino (Philippines) | Philippines | fil-PH | +| Finnish (Finland) | Finland | fi_FI | +| French (Canada) | Canada | fr-CA | +| French (France) | France | fr-FR | +| Galician (Galician) | Spain | gl-ES | +| Georgian | Georgia | ka-GE | +| German (Germany) | Germany | de-DE | +| Greek (Greece) | Greece | el-GR | +| Gujarati | India | gu-IN | +| Hausa (Latin, Nigeria) | Nigeria | ha-Latn-NG | +| Hebrew (Israel) | Israel | he-IL | +| Hindi (India) | India | hi-IN | +| Hungarian (Hungary) | Hungary | hu-HU | +| Icelandic | Iceland | is-IS | +| Igbo | Nigeria | ig-NG | +| Indonesian (Indonesia) | Indonesia | id-ID | +| Irish | Ireland | ga-IE | +| isiXhosa | South Africa | xh-ZA | +| isiZulu | South Africa | zu-ZA | +| Italian (Italy) | Italy | it-IT | +| Japanese (Japan) | Japan | ja-JP | +| Kannada | India | kn-IN | +| Kazakh (Kazakhstan) | Kazakhstan | kk-KZ | +| Khmer (Cambodia) | Cambodia | km-KH | +| K'iche' | Guatemala | quc-Latn-GT | +| Kinyarwanda | Rwanda | rw-RW | +| KiSwahili | Kenya, Tanzania | sw-KE | +| Konkani | India | kok-IN | +| Korean (Korea) | Korea | ko-KR | +| Kyrgyz | Kyrgyzstan | ky-KG | +| Lao (Laos) | Lao P.D.R. | lo-LA | +| Latvian (Latvia) | Latvia | lv-LV | +| Lithuanian (Lithuania) | Lithuania | lt-LT | +| Luxembourgish (Luxembourg) | Luxembourg | lb-LU | +| Macedonian (Former Yugoslav Republic of Macedonia) | Macedonia (FYROM) | mk-MK | +| Malay (Malaysia) | Malaysia, Brunei, and Singapore | ms-MY | +| Malayalam | India | ml-IN | +| Maltese | Malta | mt-MT | +| Maori | New Zealand | mi-NZ | +| Marathi | India | mr-IN | +| Mongolian (Cyrillic) | Mongolia | mn-MN | +| Nepali | Federal Democratic Republic of Nepal | ne-NP | +| Norwegian (Nynorsk) | Norway | nn-NO | +| Norwegian, Bokmål (Norway) | Norway | nb-NO | +| Odia | India | or-IN | +| Polish (Poland) | Poland | pl-PL | +| Portuguese (Brazil) | Brazil | pt-BR | +| Portuguese (Portugal) | Portugal | pt-PT | +| Punjabi | India | pa-IN | +| Punjabi (Arabic) | Pakistan | pa-Arab-PK | +| Quechua | Peru | quz-PE | +| Romanian (Romania) | Romania | ro-RO | +| Russian (Russia) | Russia | ru-RU | +| Scottish Gaelic | United Kingdom | gd-GB | +| Serbian (Cyrillic, Bosnia, and Herzegovina) | Bosnia and Herzegovina | sr-Cyrl-BA | +| Serbian (Cyrillic, Serbia) | Serbia | sr-Cyrl-RS | +| Serbian (Latin, Serbia) | Serbia | sr-Latn-RS | +| Sesotho sa Leboa | South Africa | nso-ZA | +| Setswana (South Africa) | South Africa and Botswana | tn-ZA | +| Sindhi (Arabic) | Pakistan | sd-Arab-PK | +| Sinhala | Sri Lanka | si-LK | +| Slovak (Slovakia) | Slovakia | sk-SK | +| Slovenian (Slovenia) | Slovenia | sl-SL | +| Spanish (Mexico) | Mexico | es-MX | +| Spanish (Spain, International Sort) | Spain | en-ES | +| Swedish (Sweden) | Sweden | sv-SE | +| Tajik (Cyrillic) | Tajikistan | tg-Cyrl-TJ | +| Tamil (India) | India and Sri Lanka | ta-IN | +| Tatar | Russia | tt-RU | +| Telugu | India | te-IN | +| Thai (Thailand) | Thailand | th-TH | +| Tigrinya (Ethiopia) | Ethiopia | ti-ET | +| Turkish (Turkey) | Turkey | tr-TR | +| Turkmen | Turkmenistan | tk-TM | +| Ukrainian (Ukraine) | Ukraine | uk-UA | +| Urdu | Pakistan | ur-PK | +| Uyghur | People's Republic of China | ug-CN | +| Uzbek (Latin, Uzbekistan) | Uzbekistan | uz-Latn-UZ | +| Valencian | Spain | ca-ES-valencia | +| Vietnamese | Vietnam | vi-VN | +| Welsh | United Kingdom | cy-GB | +| Wolof | Senegal | wo-SN | +| Yoruba | Nigeria | yo-NG | + +--- diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 18890c69ed..48d52140c5 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -1,221 +1,225 @@ ---- -description: You can customize your organization’s browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. -ms.assetid: 2e849894-255d-4f68-ae88-c2e4e31fa165 -ms.reviewer: -author: eavena -ms.author: eravena -audience: itpro manager: dansimp -ms.prod: edge -ms.mktglfcycl: explore -ms.topic: reference -ms.sitesec: library -title: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros) -ms.localizationpriority: medium ---- - -# Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge - -> Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile - -You can customize your organization’s browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. For example, you can set up multiple security settings in a Group Policy Object (GPO) linked to a domain, and then apply those settings to every computer in the domain. - -Other policy settings in Microsoft Edge include allowing Adobe Flash content to play automatically, provision a favorites list, set default search engine, and more. You configure a Group Policy setting in the Administrative Templates folders, which are registry-based policy settings that Group Policy enforces. Group Policy stores these settings in a specific registry location, which users cannot change. Also, Group Policy-aware Windows features and applications look for these settings in the registry, and if found the policy setting gets used instead of the regular settings. - -**_You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor:_** - -      *Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\* - -When you edit a Group Policy setting, you have the following configuration options: - -- **Enabled** - writes the policy setting to the registry with a value that enables it. -- **Disabled** - writes the policy setting to the registry with a value that disables it. -- **Not configured** - leaves the policy setting undefined. Group Policy does not write the policy setting to the registry and has no impact on computers or users. - -Some policy settings have additional options you can configure. For example, if you want to set the default search engine, set the Start page, or configure the Enterprise Mode Site List, you would type the URL. - - -## Allow a shared books folder -[!INCLUDE [allow-shared-folder-books-include.md](includes/allow-shared-folder-books-include.md)] - -## Allow Address bar drop-down list suggestions -[!INCLUDE [allow-address-bar-suggestions-include.md](includes/allow-address-bar-suggestions-include.md)] - -## Allow Adobe Flash -[!INCLUDE [allow-adobe-flash-include.md](includes/allow-adobe-flash-include.md)] - -## Allow clearing browsing data on exit -[!INCLUDE [allow-clearing-browsing-data-include.md](includes/allow-clearing-browsing-data-include.md)] - -## Allow configuration updates for the Books Library -[!INCLUDE [allow-config-updates-books-include.md](includes/allow-config-updates-books-include.md)] - -## Allow Cortana -[!INCLUDE [allow-cortana-include.md](includes/allow-cortana-include.md)] - -## Allow Developer Tools -[!INCLUDE [allow-dev-tools-include.md](includes/allow-dev-tools-include.md)] - -## Allow extended telemetry for the Books tab -[!INCLUDE [allow-ext-telemetry-books-tab-include.md](includes/allow-ext-telemetry-books-tab-include.md)] - -## Allow Extensions -[!INCLUDE [allow-extensions-include.md](includes/allow-extensions-include.md)] - -## Allow fullscreen mode -[!INCLUDE [allow-full-screen-include](includes/allow-full-screen-include.md)] - -## Allow InPrivate browsing -[!INCLUDE [allow-inprivate-browsing-include.md](includes/allow-inprivate-browsing-include.md)] - -## Allow Microsoft Compatibility List -[!INCLUDE [allow-microsoft-compatibility-list-include.md](includes/allow-microsoft-compatibility-list-include.md)] - -## Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed -[!INCLUDE [allow-prelaunch-include](includes/allow-prelaunch-include.md)] - -## Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed -[!INCLUDE [allow-tab-preloading-include](includes/allow-tab-preloading-include.md)] - -## Allow printing -[!INCLUDE [allow-printing-include.md](includes/allow-printing-include.md)] - -## Allow Saving History -[!INCLUDE [allow-saving-history-include.md](includes/allow-saving-history-include.md)] - -## Allow search engine customization -[!INCLUDE [allow-search-engine-customization-include.md](includes/allow-search-engine-customization-include.md)] - -## Allow sideloading of Extensions -[!INCLUDE [allow-sideloading-extensions-include.md](includes/allow-sideloading-extensions-include.md)] - -## Allow web content on New Tab page -[!INCLUDE [allow-web-content-new-tab-page-include.md](includes/allow-web-content-new-tab-page-include.md)] - -## Always show the Books Library in Microsoft Edge -[!INCLUDE [always-enable-book-library-include.md](includes/always-enable-book-library-include.md)] - -## Configure additional search engines -[!INCLUDE [configure-additional-search-engines-include.md](includes/configure-additional-search-engines-include.md)] - -## Configure Autofill -[!INCLUDE [configure-autofill-include.md](includes/configure-autofill-include.md)] - -## Configure collection of browsing data for Microsoft 365 Analytics -[!INCLUDE [configure-browser-telemetry-for-m365-analytics-include](includes/configure-browser-telemetry-for-m365-analytics-include.md)] - -## Configure cookies -[!INCLUDE [configure-cookies-include.md](includes/configure-cookies-include.md)] - -## Configure Do Not Track -[!INCLUDE [configure-do-not-track-include.md](includes/configure-do-not-track-include.md)] - -## Configure Favorites -[!INCLUDE [configure-favorites-include.md](includes/configure-favorites-include.md)] - -## Configure Favorites Bar -[!INCLUDE [configure-favorites-bar-include.md](includes/configure-favorites-bar-include.md)] - -## Configure Home Button -[!INCLUDE [configure-home-button-include.md](includes/configure-home-button-include.md)] - -## Configure kiosk mode -[!INCLUDE [configure-microsoft-edge-kiosk-mode-include.md](includes/configure-microsoft-edge-kiosk-mode-include.md)] - -## Configure kiosk reset after idle timeout -[!INCLUDE [configure-edge-kiosk-reset-idle-timeout-include.md](includes/configure-edge-kiosk-reset-idle-timeout-include.md)] - -## Configure Open Microsoft Edge With -[!INCLUDE [configure-open-edge-with-include.md](includes/configure-open-edge-with-include.md)] - -## Configure Password Manager -[!INCLUDE [configure-password-manager-include.md](includes/configure-password-manager-include.md)] - -## Configure Pop-up Blocker -[!INCLUDE [configure-pop-up-blocker-include.md](includes/configure-pop-up-blocker-include.md)] - -## Configure search suggestions in Address bar -[!INCLUDE [configure-search-suggestions-address-bar-include.md](includes/configure-search-suggestions-address-bar-include.md)] - -## Configure Start pages -[!INCLUDE [configure-start-pages-include.md](includes/configure-start-pages-include.md)] - -## Configure the Adobe Flash Click-to-Run setting -[!INCLUDE [configure-adobe-flash-click-to-run-include.md](includes/configure-adobe-flash-click-to-run-include.md)] - -## Configure the Enterprise Mode Site List -[!INCLUDE [configure-enterprise-mode-site-list-include.md](includes/configure-enterprise-mode-site-list-include.md)] - -## Configure Windows Defender SmartScreen -[!INCLUDE [configure-windows-defender-smartscreen-include.md](includes/configure-windows-defender-smartscreen-include.md)] - -## Disable lockdown of Start pages -[!INCLUDE [disable-lockdown-of-start-pages-include.md](includes/disable-lockdown-of-start-pages-include.md)] - -## Do not sync -[!INCLUDE [do-not-sync-include.md](includes/do-not-sync-include.md)] - -## Do not sync browser settings -[!INCLUDE [do-not-sync-browser-settings-include.md](includes/do-not-sync-browser-settings-include.md)] - -## Keep favorites in sync between Internet Explorer and Microsoft Edge -[!INCLUDE [keep-fav-sync-ie-edge-include.md](includes/keep-fav-sync-ie-edge-include.md)] - -## Prevent access to the about:flags page -[!INCLUDE [prevent-access-about-flag-include.md](includes/prevent-access-about-flag-include.md)] - -## Prevent bypassing Windows Defender SmartScreen prompts for files -[!INCLUDE [prevent-bypassing-win-defender-files-include.md](includes/prevent-bypassing-win-defender-files-include.md)] - -## Prevent bypassing Windows Defender SmartScreen prompts for sites -[!INCLUDE [prevent-bypassing-win-defender-sites-include.md](includes/prevent-bypassing-win-defender-sites-include.md)] - -## Prevent certificate error overrides -[!INCLUDE [prevent-certificate-error-overrides-include.md](includes/prevent-certificate-error-overrides-include.md)] - -## Prevent changes to Favorites on Microsoft Edge -[!INCLUDE [prevent-changes-to-favorites-include.md](includes/prevent-changes-to-favorites-include.md)] - -## Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start -[!INCLUDE [prevent-live-tile-pinning-start-include](includes/prevent-live-tile-pinning-start-include.md)] - -## Prevent the First Run webpage from opening on Microsoft Edge -[!INCLUDE [prevent-first-run-webpage-open-include.md](includes/prevent-first-run-webpage-open-include.md)] - -## Prevent turning off required extensions -[!INCLUDE [prevent-turning-off-required-extensions-include.md](includes/prevent-turning-off-required-extensions-include.md)] - -## Prevent users from turning on browser syncing -[!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](includes/prevent-users-to-turn-on-browser-syncing-include.md)] - -## Prevent using Localhost IP address for WebRTC -[!INCLUDE [prevent-localhost-address-for-webrtc-include.md](includes/prevent-localhost-address-for-webrtc-include.md)] - -## Provision Favorites -[!INCLUDE [provision-favorites-include](includes/provision-favorites-include.md)] - -## Send all intranet sites to Internet Explorer 11 -[!INCLUDE [send-all-intranet-sites-ie-include.md](includes/send-all-intranet-sites-ie-include.md)] - -## Set default search engine -[!INCLUDE [set-default-search-engine-include.md](includes/set-default-search-engine-include.md)] - -## Set Home Button URL -[!INCLUDE [set-home-button-url-include](includes/set-home-button-url-include.md)] - -## Set New Tab page URL -[!INCLUDE [set-new-tab-url-include.md](includes/set-new-tab-url-include.md)] - -## Show message when opening sites in Internet Explorer -[!INCLUDE [show-message-opening-sites-ie-include](includes/show-message-opening-sites-ie-include.md)] - -## Unlock Home Button -[!INCLUDE [unlock-home-button-include.md](includes/unlock-home-button-include.md)] - - - -## Related topics -- [Mobile Device Management (MDM) settings](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) -- [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921) -- [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922) -- [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923) -- [Group Policy and Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=617924). +--- +description: You can customize your organization's browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. +ms.assetid: 2e849894-255d-4f68-ae88-c2e4e31fa165 +ms.reviewer: +author: dansimp +ms.author: dansimp +audience: itpro +manager: dansimp +ms.prod: edge +ms.mktglfcycl: explore +ms.topic: reference +ms.sitesec: library +title: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros) +ms.localizationpriority: medium +--- + +# Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge + +> Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +You can customize your organization's browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. For example, you can set up multiple security settings in a Group Policy Object (GPO) linked to a domain, and then apply those settings to every computer in the domain. + +Other policy settings in Microsoft Edge include allowing Adobe Flash content to play automatically, provision a favorites list, set default search engine, and more. You configure a Group Policy setting in the Administrative Templates folders, which are registry-based policy settings that Group Policy enforces. Group Policy stores these settings in a specific registry location, which users cannot change. Also, Group Policy-aware Windows features and applications look for these settings in the registry, and if found the policy setting gets used instead of the regular settings. + +**_You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor:_** + +      *Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\* + +When you edit a Group Policy setting, you have the following configuration options: + +- **Enabled** - writes the policy setting to the registry with a value that enables it. +- **Disabled** - writes the policy setting to the registry with a value that disables it. +- **Not configured** - leaves the policy setting undefined. Group Policy does not write the policy setting to the registry and has no impact on computers or users. + +Some policy settings have additional options you can configure. For example, if you want to set the default search engine, set the Start page, or configure the Enterprise Mode Site List, you would type the URL. + + +## Allow a shared books folder +[!INCLUDE [allow-shared-folder-books-include.md](includes/allow-shared-folder-books-include.md)] + +## Allow Address bar drop-down list suggestions +[!INCLUDE [allow-address-bar-suggestions-include.md](includes/allow-address-bar-suggestions-include.md)] + +## Allow Adobe Flash +[!INCLUDE [allow-adobe-flash-include.md](includes/allow-adobe-flash-include.md)] + +## Allow clearing browsing data on exit +[!INCLUDE [allow-clearing-browsing-data-include.md](includes/allow-clearing-browsing-data-include.md)] + +## Allow configuration updates for the Books Library +[!INCLUDE [allow-config-updates-books-include.md](includes/allow-config-updates-books-include.md)] + +## Allow Cortana +[!INCLUDE [allow-cortana-include.md](includes/allow-cortana-include.md)] + +## Allow Developer Tools +[!INCLUDE [allow-dev-tools-include.md](includes/allow-dev-tools-include.md)] + +## Allow extended telemetry for the Books tab +[!INCLUDE [allow-ext-telemetry-books-tab-include.md](includes/allow-ext-telemetry-books-tab-include.md)] + +## Allow Extensions +[!INCLUDE [allow-extensions-include.md](includes/allow-extensions-include.md)] + +## Allow fullscreen mode +[!INCLUDE [allow-full-screen-include](includes/allow-full-screen-include.md)] + +## Allow InPrivate browsing +[!INCLUDE [allow-inprivate-browsing-include.md](includes/allow-inprivate-browsing-include.md)] + +## Allow Microsoft Compatibility List +[!INCLUDE [allow-microsoft-compatibility-list-include.md](includes/allow-microsoft-compatibility-list-include.md)] + +## Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed +[!INCLUDE [allow-prelaunch-include](includes/allow-prelaunch-include.md)] + +## Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed +[!INCLUDE [allow-tab-preloading-include](includes/allow-tab-preloading-include.md)] + +## Allow printing +[!INCLUDE [allow-printing-include.md](includes/allow-printing-include.md)] + +## Allow Saving History +[!INCLUDE [allow-saving-history-include.md](includes/allow-saving-history-include.md)] + +## Allow search engine customization +[!INCLUDE [allow-search-engine-customization-include.md](includes/allow-search-engine-customization-include.md)] + +## Allow sideloading of Extensions +[!INCLUDE [allow-sideloading-extensions-include.md](includes/allow-sideloading-extensions-include.md)] + +## Allow web content on New Tab page +[!INCLUDE [allow-web-content-new-tab-page-include.md](includes/allow-web-content-new-tab-page-include.md)] + +## Always show the Books Library in Microsoft Edge +[!INCLUDE [always-enable-book-library-include.md](includes/always-enable-book-library-include.md)] + +## Configure additional search engines +[!INCLUDE [configure-additional-search-engines-include.md](includes/configure-additional-search-engines-include.md)] + +## Configure Autofill +[!INCLUDE [configure-autofill-include.md](includes/configure-autofill-include.md)] + +## Configure collection of browsing data for Microsoft 365 Analytics +[!INCLUDE [configure-browser-telemetry-for-m365-analytics-include](includes/configure-browser-telemetry-for-m365-analytics-include.md)] + +## Configure cookies +[!INCLUDE [configure-cookies-include.md](includes/configure-cookies-include.md)] + +## Configure Do Not Track +[!INCLUDE [configure-do-not-track-include.md](includes/configure-do-not-track-include.md)] + +## Configure Favorites +[!INCLUDE [configure-favorites-include.md](includes/configure-favorites-include.md)] + +## Configure Favorites Bar +[!INCLUDE [configure-favorites-bar-include.md](includes/configure-favorites-bar-include.md)] + +## Configure Home Button +[!INCLUDE [configure-home-button-include.md](includes/configure-home-button-include.md)] + +## Configure kiosk mode +[!INCLUDE [configure-microsoft-edge-kiosk-mode-include.md](includes/configure-microsoft-edge-kiosk-mode-include.md)] + +## Configure kiosk reset after idle timeout +[!INCLUDE [configure-edge-kiosk-reset-idle-timeout-include.md](includes/configure-edge-kiosk-reset-idle-timeout-include.md)] + +## Configure Open Microsoft Edge With +[!INCLUDE [configure-open-edge-with-include.md](includes/configure-open-edge-with-include.md)] + +## Configure Password Manager +[!INCLUDE [configure-password-manager-include.md](includes/configure-password-manager-include.md)] + +## Configure Pop-up Blocker +[!INCLUDE [configure-pop-up-blocker-include.md](includes/configure-pop-up-blocker-include.md)] + +## Configure search suggestions in Address bar +[!INCLUDE [configure-search-suggestions-address-bar-include.md](includes/configure-search-suggestions-address-bar-include.md)] + +## Configure Start pages +[!INCLUDE [configure-start-pages-include.md](includes/configure-start-pages-include.md)] + +## Configure the Adobe Flash Click-to-Run setting +[!INCLUDE [configure-adobe-flash-click-to-run-include.md](includes/configure-adobe-flash-click-to-run-include.md)] + +## Configure the Enterprise Mode Site List +[!INCLUDE [configure-enterprise-mode-site-list-include.md](includes/configure-enterprise-mode-site-list-include.md)] + +## Configure Windows Defender SmartScreen +[!INCLUDE [configure-windows-defender-smartscreen-include.md](includes/configure-windows-defender-smartscreen-include.md)] + +## Disable lockdown of Start pages +[!INCLUDE [disable-lockdown-of-start-pages-include.md](includes/disable-lockdown-of-start-pages-include.md)] + +## Do not sync +[!INCLUDE [do-not-sync-include.md](includes/do-not-sync-include.md)] + +## Do not sync browser settings +[!INCLUDE [do-not-sync-browser-settings-include.md](includes/do-not-sync-browser-settings-include.md)] + +## Keep favorites in sync between Internet Explorer and Microsoft Edge +[!INCLUDE [keep-fav-sync-ie-edge-include.md](includes/keep-fav-sync-ie-edge-include.md)] + +## Prevent access to the about:flags page +[!INCLUDE [prevent-access-about-flag-include.md](includes/prevent-access-about-flag-include.md)] + +## Prevent bypassing Windows Defender SmartScreen prompts for files +[!INCLUDE [prevent-bypassing-win-defender-files-include.md](includes/prevent-bypassing-win-defender-files-include.md)] + +## Prevent bypassing Windows Defender SmartScreen prompts for sites +[!INCLUDE [prevent-bypassing-win-defender-sites-include.md](includes/prevent-bypassing-win-defender-sites-include.md)] + +## Prevent certificate error overrides +[!INCLUDE [prevent-certificate-error-overrides-include.md](includes/prevent-certificate-error-overrides-include.md)] + +## Prevent changes to Favorites on Microsoft Edge +[!INCLUDE [prevent-changes-to-favorites-include.md](includes/prevent-changes-to-favorites-include.md)] + +## Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start +[!INCLUDE [prevent-live-tile-pinning-start-include](includes/prevent-live-tile-pinning-start-include.md)] + +## Prevent the First Run webpage from opening on Microsoft Edge +[!INCLUDE [prevent-first-run-webpage-open-include.md](includes/prevent-first-run-webpage-open-include.md)] + +## Prevent turning off required extensions +[!INCLUDE [prevent-turning-off-required-extensions-include.md](includes/prevent-turning-off-required-extensions-include.md)] + +## Prevent users from turning on browser syncing +[!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](includes/prevent-users-to-turn-on-browser-syncing-include.md)] + +## Prevent using Localhost IP address for WebRTC +[!INCLUDE [prevent-localhost-address-for-webrtc-include.md](includes/prevent-localhost-address-for-webrtc-include.md)] + +## Provision Favorites +[!INCLUDE [provision-favorites-include](includes/provision-favorites-include.md)] + +## Send all intranet sites to Internet Explorer 11 +[!INCLUDE [send-all-intranet-sites-ie-include.md](includes/send-all-intranet-sites-ie-include.md)] + +## Set default search engine +[!INCLUDE [set-default-search-engine-include.md](includes/set-default-search-engine-include.md)] + +## Set Home Button URL +[!INCLUDE [set-home-button-url-include](includes/set-home-button-url-include.md)] + +## Set New Tab page URL +[!INCLUDE [set-new-tab-url-include.md](includes/set-new-tab-url-include.md)] + +## Show message when opening sites in Internet Explorer +[!INCLUDE [show-message-opening-sites-ie-include](includes/show-message-opening-sites-ie-include.md)] + +## Unlock Home Button +[!INCLUDE [unlock-home-button-include.md](includes/unlock-home-button-include.md)] + + + +## Related topics +- [Mobile Device Management (MDM) settings](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) +- [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921) +- [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922) +- [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923) +- [Group Policy and Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=617924). diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index 19530f7f71..af27551fc8 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -1,102 +1,104 @@ ---- -title: Change history for Microsoft Edge (Microsoft Edge for IT Pros) -description: Discover what's new and updated in the Microsoft Edge for both Windows 10 and Windows 10 Mobile. -ms.prod: edge -ms.topic: reference -ms.mktglfcycl: explore -ms.sitesec: library -ms.localizationpriority: medium -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.date: 10/02/2018 -ms.reviewer: ---- - -# Change history for Microsoft Edge -Discover what's new and updated in the Microsoft Edge for both Windows 10 and Windows 10 Mobile. - - -#### [2018](#tab/2018/) -## October 2018 - -The Microsoft Edge team introduces new group policies and MDM settings for Microsoft Edge on Windows 10. The new policies let you enable/disable -full-screen mode, printing, favorites bar, saving history. You can also prevent certificate error overrides, and configure the New Tab page, Home button, and startup options, as well as manage extensions. - -We have discontinued the **Configure Favorites** group policy, so use the [Provision Favorites](available-policies.md#provision-favorites) policy instead. - ->>You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: ->> ->>      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - - - -| **New or updated** | **Group Policy** | **Description** | -|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------| -| New | [Allow fullscreen mode](group-policies/browser-settings-management-gp.md#allow-fullscreen-mode) | [!INCLUDE [allow-fullscreen-mode-shortdesc](shortdesc/allow-fullscreen-mode-shortdesc.md)] | -| New | [Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-pre-launch-at-windows-startup-when-the-system-is-idle-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-prelaunch-shortdesc](shortdesc/allow-prelaunch-shortdesc.md)] | -| New | [Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-tab-preloading-shortdesc](shortdesc/allow-tab-preloading-shortdesc.md)] | -| New | [Allow printing](group-policies/browser-settings-management-gp.md#allow-printing) | [!INCLUDE [allow-printing-shortdesc](shortdesc/allow-printing-shortdesc.md)] | -| New | [Allow Saving History](group-policies/browser-settings-management-gp.md#allow-saving-history) | [!INCLUDE [allow-saving-history-shortdesc](shortdesc/allow-saving-history-shortdesc.md)] | -| New | [Allow sideloading of Extensions](group-policies/extensions-management-gp.md#allow-sideloading-of-extensions) | [!INCLUDE [allow-sideloading-of-extensions-shortdesc](shortdesc/allow-sideloading-of-extensions-shortdesc.md)] | -| New | [Configure collection of browsing data for Microsoft 365 Analytics](group-policies/telemetry-management-gp.md#configure-collection-of-browsing-data-for-microsoft-365-analytics) | [!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)] | -| New | [Configure Favorites Bar](group-policies/favorites-management-gp.md#configure-favorites-bar) | [!INCLUDE [configure-favorites-bar-shortdesc](shortdesc/configure-favorites-bar-shortdesc.md)] | -| New | [Configure Home Button](group-policies/home-button-gp.md#configure-home-button) | [!INCLUDE [configure-home-button-shortdesc](shortdesc/configure-home-button-shortdesc.md)] | -| New | [Configure kiosk mode](available-policies.md#configure-kiosk-mode) | [!INCLUDE [configure-kiosk-mode-shortdesc](shortdesc/configure-kiosk-mode-shortdesc.md)] | -| New | [Configure kiosk reset after idle timeout](available-policies.md#configure-kiosk-reset-after-idle-timeout) | [!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] | -| New | [Configure Open Microsoft Edge With](group-policies/start-pages-gp.md#configure-open-microsoft-edge-with) | [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] | -| New | [Prevent certificate error overrides](group-policies/security-privacy-management-gp.md#prevent-certificate-error-overrides) | [!INCLUDE [prevent-certificate-error-overrides-shortdesc](shortdesc/prevent-certificate-error-overrides-shortdesc.md)] | -| New | [Prevent users from turning on browser syncing](group-policies/sync-browser-settings-gp.md#prevent-users-from-turning-on-browser-syncing) | [!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] | -| New | [Prevent turning off required extensions](group-policies/extensions-management-gp.md#prevent-turning-off-required-extensions) | [!INCLUDE [prevent-turning-off-required-extensions-shortdesc](shortdesc/prevent-turning-off-required-extensions-shortdesc.md)] | -| New | [Set Home Button URL](group-policies/home-button-gp.md#set-home-button-url) | [!INCLUDE [set-home-button-url-shortdesc](shortdesc/set-home-button-url-shortdesc.md)] | -| New | [Set New Tab page URL](group-policies/new-tab-page-settings-gp.md#set-new-tab-page-url) | [!INCLUDE [set-new-tab-url-shortdesc](shortdesc/set-new-tab-url-shortdesc.md)] | -| Updated | [Show message when opening sites in Internet Explorer](group-policies/interoperability-enterprise-guidance-gp.md#show-message-when-opening-sites-in-internet-explorer) | [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] | -| New | [Unlock Home Button](group-policies/home-button-gp.md#unlock-home-button) | [!INCLUDE [unlock-home-button-shortdesc](shortdesc/unlock-home-button-shortdesc.md)] | - -#### [2017](#tab/2017/) -## September 2017 - -|New or changed topic | Description | -|---------------------|-------------| -|[Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros](microsoft-edge-faq.md) | New | - -## February 2017 - -|New or changed topic | Description | -|----------------------|-------------| -|[Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](available-policies.md) |Added new Group Policy and MDM settings for the Windows Insider Program. Reformatted for easier readability outside of scrolling table. | - - -#### [2016](#tab/2016/) -## November 2016 - -|New or changed topic | Description | -|----------------------|-------------| -|[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added the infographic image and a download link.| -|[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) |Added a note about the 65 second wait before checking for a newer version of the site list .XML file. | -|[Available policies for Microsoft Edge](available-policies.md) |Added notes to the Configure the Enterprise Mode Site List Group Policy and the EnterpriseModeSiteList MDM policy about the 65 second wait before checking for a newer version of the site list .XML file. | -|Microsoft Edge - Deployment Guide for IT Pros |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | -|[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | - -## July 2016 - -|New or changed topic | Description | -|----------------------|-------------| -|[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)| Updated to include a note about the Long Term Servicing Branch (LTSB). | -|[Enterprise guidance about using Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) | Content moved from What's New section. | -|[Available policies for Microsoft Edge](available-policies.md) |Updated | - - -## June 2016 - -|New or changed topic | Description | -|----------------------|-------------| -|[Security enhancements for Microsoft Edge](security-enhancements-microsoft-edge.md) |New | - -## May 2016 - -|New or changed topic | Description | -|----------------------|-------------| -|[Available Policies for Microsoft Edge](available-policies.md) | Added new policies and the Supported versions column for Windows 10 Insider Preview. | - -* * * +--- +title: Change history for Microsoft Edge (Microsoft Edge for IT Pros) +description: Discover what's new and updated in the Microsoft Edge for both Windows 10 and Windows 10 Mobile. +ms.prod: edge +ms.topic: reference +ms.mktglfcycl: explore +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro +manager: dansimp +author: dansimp +ms.date: 10/02/2018 +ms.author: dansimp +--- + +# Change history for Microsoft Edge +Discover what's new and updated in the Microsoft Edge for both Windows 10 and Windows 10 Mobile. + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +#### [2018](#tab/2018/) +## October 2018 + +The Microsoft Edge team introduces new group policies and MDM settings for Microsoft Edge on Windows 10. The new policies let you enable/disable +full-screen mode, printing, favorites bar, saving history. You can also prevent certificate error overrides, and configure the New Tab page, Home button, and startup options, as well as manage extensions. + +We have discontinued the **Configure Favorites** group policy, so use the [Provision Favorites](available-policies.md#provision-favorites) policy instead. + +>>You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: +>> +>>      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + + + +| **New or updated** | **Group Policy** | **Description** | +|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------| +| New | [Allow fullscreen mode](group-policies/browser-settings-management-gp.md#allow-fullscreen-mode) | [!INCLUDE [allow-fullscreen-mode-shortdesc](shortdesc/allow-fullscreen-mode-shortdesc.md)] | +| New | [Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-pre-launch-at-windows-startup-when-the-system-is-idle-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-prelaunch-shortdesc](shortdesc/allow-prelaunch-shortdesc.md)] | +| New | [Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-tab-preloading-shortdesc](shortdesc/allow-tab-preloading-shortdesc.md)] | +| New | [Allow printing](group-policies/browser-settings-management-gp.md#allow-printing) | [!INCLUDE [allow-printing-shortdesc](shortdesc/allow-printing-shortdesc.md)] | +| New | [Allow Saving History](group-policies/browser-settings-management-gp.md#allow-saving-history) | [!INCLUDE [allow-saving-history-shortdesc](shortdesc/allow-saving-history-shortdesc.md)] | +| New | [Allow sideloading of Extensions](group-policies/extensions-management-gp.md#allow-sideloading-of-extensions) | [!INCLUDE [allow-sideloading-of-extensions-shortdesc](shortdesc/allow-sideloading-of-extensions-shortdesc.md)] | +| New | [Configure collection of browsing data for Microsoft 365 Analytics](group-policies/telemetry-management-gp.md#configure-collection-of-browsing-data-for-microsoft-365-analytics) | [!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)] | +| New | [Configure Favorites Bar](group-policies/favorites-management-gp.md#configure-favorites-bar) | [!INCLUDE [configure-favorites-bar-shortdesc](shortdesc/configure-favorites-bar-shortdesc.md)] | +| New | [Configure Home Button](group-policies/home-button-gp.md#configure-home-button) | [!INCLUDE [configure-home-button-shortdesc](shortdesc/configure-home-button-shortdesc.md)] | +| New | [Configure kiosk mode](available-policies.md#configure-kiosk-mode) | [!INCLUDE [configure-kiosk-mode-shortdesc](shortdesc/configure-kiosk-mode-shortdesc.md)] | +| New | [Configure kiosk reset after idle timeout](available-policies.md#configure-kiosk-reset-after-idle-timeout) | [!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] | +| New | [Configure Open Microsoft Edge With](group-policies/start-pages-gp.md#configure-open-microsoft-edge-with) | [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] | +| New | [Prevent certificate error overrides](group-policies/security-privacy-management-gp.md#prevent-certificate-error-overrides) | [!INCLUDE [prevent-certificate-error-overrides-shortdesc](shortdesc/prevent-certificate-error-overrides-shortdesc.md)] | +| New | [Prevent users from turning on browser syncing](group-policies/sync-browser-settings-gp.md#prevent-users-from-turning-on-browser-syncing) | [!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] | +| New | [Prevent turning off required extensions](group-policies/extensions-management-gp.md#prevent-turning-off-required-extensions) | [!INCLUDE [prevent-turning-off-required-extensions-shortdesc](shortdesc/prevent-turning-off-required-extensions-shortdesc.md)] | +| New | [Set Home Button URL](group-policies/home-button-gp.md#set-home-button-url) | [!INCLUDE [set-home-button-url-shortdesc](shortdesc/set-home-button-url-shortdesc.md)] | +| New | [Set New Tab page URL](group-policies/new-tab-page-settings-gp.md#set-new-tab-page-url) | [!INCLUDE [set-new-tab-url-shortdesc](shortdesc/set-new-tab-url-shortdesc.md)] | +| Updated | [Show message when opening sites in Internet Explorer](group-policies/interoperability-enterprise-guidance-gp.md#show-message-when-opening-sites-in-internet-explorer) | [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] | +| New | [Unlock Home Button](group-policies/home-button-gp.md#unlock-home-button) | [!INCLUDE [unlock-home-button-shortdesc](shortdesc/unlock-home-button-shortdesc.md)] | + +#### [2017](#tab/2017/) +## September 2017 + +|New or changed topic | Description | +|---------------------|-------------| +|[Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros](microsoft-edge-faq.yml) | New | + +## February 2017 + +|New or changed topic | Description | +|----------------------|-------------| +|[Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](available-policies.md) |Added new Group Policy and MDM settings for the Windows Insider Program. Reformatted for easier readability outside of scrolling table. | + + +#### [2016](#tab/2016/) +## November 2016 + +|New or changed topic | Description | +|----------------------|-------------| +|[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added the infographic image and a download link.| +|[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) |Added a note about the 65 second wait before checking for a newer version of the site list .XML file. | +|[Available policies for Microsoft Edge](available-policies.md) |Added notes to the Configure the Enterprise Mode Site List Group Policy and the EnterpriseModeSiteList MDM policy about the 65 second wait before checking for a newer version of the site list .XML file. | +|Microsoft Edge - Deployment Guide for IT Pros |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | +|[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | + +## July 2016 + +|New or changed topic | Description | +|----------------------|-------------| +|[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)| Updated to include a note about the Long Term Servicing Branch (LTSB). | +|[Enterprise guidance about using Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) | Content moved from What's New section. | +|[Available policies for Microsoft Edge](available-policies.md) |Updated | + + +## June 2016 + +|New or changed topic | Description | +|----------------------|-------------| +|[Security enhancements for Microsoft Edge](security-enhancements-microsoft-edge.md) |New | + +## May 2016 + +|New or changed topic | Description | +|----------------------|-------------| +|[Available Policies for Microsoft Edge](available-policies.md) | Added new policies and the Supported versions column for Windows 10 Insider Preview. | + +* * * diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index 730c9d7ac2..640106062b 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -34,15 +34,15 @@ "ms.topic": "article", "manager": "laurawi", "ms.prod": "edge", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.microsoft-edge", "folder_relative_path_in_docset": "./" } - } + }, + "titleSuffix": "Edge" }, "externalReference": [], "template": "op.html", diff --git a/browsers/edge/edge-technical-demos.md b/browsers/edge/edge-technical-demos.md index 8326776612..d8eb14bd02 100644 --- a/browsers/edge/edge-technical-demos.md +++ b/browsers/edge/edge-technical-demos.md @@ -1,38 +1,39 @@ ---- -title: Microsoft Edge training and demonstrations -ms.reviewer: -audience: itpro manager: dansimp -description: Get access to training and demonstrations for Microsoft Edge. -ms.prod: edge -ms.topic: article -ms.manager: elizapo -author: msdmaguire -ms.author: dmaguire -ms.localizationpriority: high ---- - -# Microsoft Edge training and demonstrations - -Explore security and compatibility features of Microsoft Edge, and get tips to increase manageability, productivity, and support for legacy apps. - -## Virtual labs - -Microsoft Hands-On Labs let you experience a software product or technology using a cloud-based private virtual machine environment. Get free access to one or more virtual machines, with no additional software or setup required. - -Check out the **Use Internet Explorer Enterprise Mode to fix compatibility issues (WS00137)" on the [self-paced labs site](https://www.microsoft.com/handsonlabs/SelfPacedLabs/?storyGuid=e4155067-2c7e-4b46-8496-eca38bedca02). - -## Features and functionality - -Find out more about new and improved features of Microsoft Edge, and how you can leverage them to bring increased productivity, security, manageability, and support for legacy apps to your secure, modern desktop. - -### Building a faster browser: Behind the scenes improvements in Microsoft Edge - -Get a behind the scenes look at Microsoft Edge and the improvements we've made to make it faster and more efficient. - -> [!VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es14/player] - -### Building a safer browser: Four guards to keep users safe - -Learn about our security strategy and how we use the Four Guards to keep your users safe while they browse the Internet. - -> [!VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es03/player] +--- +title: Microsoft Edge training and demonstrations +ms.reviewer: +audience: itpro +manager: dansimp +description: Get access to training and demonstrations for Microsoft Edge. +ms.prod: edge +ms.topic: article +ms.manager: dansimp +author: dansimp +ms.author: dansimp +ms.localizationpriority: high +--- + +# Microsoft Edge training and demonstrations + +Explore security and compatibility features of Microsoft Edge, and get tips to increase manageability, productivity, and support for legacy apps. + +## Virtual labs + +Microsoft Hands-On Labs let you experience a software product or technology using a cloud-based private virtual machine environment. Get free access to one or more virtual machines, with no additional software or setup required. + +Check out the **Use Internet Explorer Enterprise Mode to fix compatibility issues (WS00137)" on the [self-paced labs site](https://www.microsoft.com/handsonlabs/SelfPacedLabs/?storyGuid=e4155067-2c7e-4b46-8496-eca38bedca02). + +## Features and functionality + +Find out more about new and improved features of Microsoft Edge, and how you can leverage them to bring increased productivity, security, manageability, and support for legacy apps to your secure, modern desktop. + +### Building a faster browser: Behind the scenes improvements in Microsoft Edge + +Get a behind the scenes look at Microsoft Edge and the improvements we've made to make it faster and more efficient. + +> [!VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es14/player] + +### Building a safer browser: Four guards to keep users safe + +Learn about our security strategy and how we use the Four Guards to keep your users safe while they browse the Internet. + +> [!VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es03/player] diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index c7882f76e7..40444da9f6 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -4,8 +4,8 @@ ms.assetid: 89c75f7e-35ca-4ca8-96fa-b3b498b53bE4 ms.reviewer: audience: itpro manager: dansimp -author: eavena -ms.author: eravena +author: dansimp +ms.author: dansimp ms.manager: dansimp ms.prod: edge ms.topic: reference @@ -20,6 +20,9 @@ ms.localizationpriority: medium > Applies to: Windows 10 +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + If you have specific websites and apps that have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites open in Internet Explorer 11 automatically. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to automatically open using IE11 with the **Send all intranet sites to IE** group policy. Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. @@ -41,7 +44,7 @@ If you're having trouble deciding whether Microsoft Edge is right for your organ |Microsoft Edge |IE11 | |---------|---------| -|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. | +|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. | ## Configure the Enterprise Mode Site List diff --git a/browsers/edge/group-policies/address-bar-settings-gp.md b/browsers/edge/group-policies/address-bar-settings-gp.md index d29ed1ca88..d718092a90 100644 --- a/browsers/edge/group-policies/address-bar-settings-gp.md +++ b/browsers/edge/group-policies/address-bar-settings-gp.md @@ -1,33 +1,37 @@ ---- -title: Microsoft Edge - Address bar group policies -description: Microsoft Edge, by default, shows a list of search suggestions in the address bar. You can minimize network connections from Microsoft Edge to Microsoft services, hiding the functionality of the Address bar drop-down list. -services: -keywords: -ms.localizationpriority: medium -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -ms.topic: reference -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library ---- - -# Address bar - -Microsoft Edge, by default, shows a list of search suggestions in the address bar. You can minimize network connections from Microsoft Edge to Microsoft services by hiding the functionality of the Address bar drop-down list. - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - - - -## Allow Address bar drop-down list suggestions -[!INCLUDE [allow-address-bar-suggestions-include.md](../includes/allow-address-bar-suggestions-include.md)] - -## Configure search suggestions in Address bar -[!INCLUDE [configure-search-suggestions-address-bar-include.md](../includes/configure-search-suggestions-address-bar-include.md)] - +--- +title: Microsoft Edge - Address bar group policies +description: Microsoft Edge, by default, shows a list of search suggestions in the address bar. You can minimize network connections from Microsoft Edge to Microsoft services, hiding the functionality of the Address bar drop-down list. +services: +keywords: +ms.localizationpriority: medium +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.topic: reference +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Address bar + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge, by default, shows a list of search suggestions in the address bar. You can minimize network connections from Microsoft Edge to Microsoft services by hiding the functionality of the Address bar drop-down list. + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + + + +## Allow Address bar drop-down list suggestions +[!INCLUDE [allow-address-bar-suggestions-include.md](../includes/allow-address-bar-suggestions-include.md)] + +## Configure search suggestions in Address bar +[!INCLUDE [configure-search-suggestions-address-bar-include.md](../includes/configure-search-suggestions-address-bar-include.md)] + diff --git a/browsers/edge/group-policies/adobe-settings-gp.md b/browsers/edge/group-policies/adobe-settings-gp.md index 6efc8ee3f8..7d9d3e6652 100644 --- a/browsers/edge/group-policies/adobe-settings-gp.md +++ b/browsers/edge/group-policies/adobe-settings-gp.md @@ -1,35 +1,39 @@ ---- -title: Microsoft Edge - Adobe Flash group policies -description: Adobe Flash Player still has a significant presence on the internet, such as digital ads. However, open standards, such as HTML5, provide many of the capabilities and functionalities becoming an alternative for content on the web. With Adobe no longer supporting Flash after 2020, Microsoft has started to phase out Flash from Microsoft Edge by adding the Configure the Adobe Flash Click-to-Run setting group policy giving you a way to control the list of websites that have permission to run Adobe Flash content. -services: -keywords: -ms.localizationpriority: medium -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -ms.topic: reference -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library ---- - -# Adobe Flash - -Adobe Flash Player still has a significant presence on the internet, such as digital ads. However, open standards, such as HTML5, provide many of the capabilities and functionalities becoming an alternative for content on the web. With Adobe no longer supporting Flash after 2020, Microsoft has started to phase out Flash from Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting](#configure-the-adobe-flash-click-to-run-setting) group policy giving you a way to control the list of websites that have permission to run Adobe Flash content. - -To learn more about Microsoft’s plan for phasing out Flash from Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash]( https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). - - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Allow Adobe Flash -[!INCLUDE [allow-adobe-flash-include.md](../includes/allow-adobe-flash-include.md)] - - -## Configure the Adobe Flash Click-to-Run setting -[!INCLUDE [configure-adobe-flash-click-to-run-include.md](../includes/configure-adobe-flash-click-to-run-include.md)] - +--- +title: Microsoft Edge - Adobe Flash group policies +description: Adobe Flash Player still has a significant presence on the internet, such as digital ads. However, open standards, such as HTML5, provide many of the capabilities and functionalities becoming an alternative for content on the web. With Adobe no longer supporting Flash after 2020, Microsoft has started to phase out Flash from Microsoft Edge by adding the Configure the Adobe Flash Click-to-Run setting group policy giving you a way to control the list of websites that have permission to run Adobe Flash content. +services: +keywords: +ms.localizationpriority: medium +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.topic: reference +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Adobe Flash + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Adobe Flash Player still has a significant presence on the internet, such as digital ads. However, open standards, such as HTML5, provide many of the capabilities and functionalities becoming an alternative for content on the web. With Adobe no longer supporting Flash after 2020, Microsoft has started to phase out Flash from Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting](#configure-the-adobe-flash-click-to-run-setting) group policy giving you a way to control the list of websites that have permission to run Adobe Flash content. + +To learn more about Microsoft’s plan for phasing out Flash from Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash]( https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). + + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Allow Adobe Flash +[!INCLUDE [allow-adobe-flash-include.md](../includes/allow-adobe-flash-include.md)] + + +## Configure the Adobe Flash Click-to-Run setting +[!INCLUDE [configure-adobe-flash-click-to-run-include.md](../includes/configure-adobe-flash-click-to-run-include.md)] + diff --git a/browsers/edge/group-policies/books-library-management-gp.md b/browsers/edge/group-policies/books-library-management-gp.md index 633b5b8b51..b2689d9638 100644 --- a/browsers/edge/group-policies/books-library-management-gp.md +++ b/browsers/edge/group-policies/books-library-management-gp.md @@ -1,37 +1,41 @@ ---- -title: Microsoft Edge - Books Library group policies -description: Microsoft Edge decreases the amount of storage used by book files by downloading them to a shared folder. You can also allow Microsoft Edge to update the configuration data for the library automatically. -services: -keywords: -ms.localizationpriority: medium -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -ms.topic: reference -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library ---- - -# Books Library - -Microsoft Edge decreases the amount of storage used by book files by downloading them to a shared folder in Windows. You can configure Microsoft Edge to update the configuration data for the library automatically or gather diagnostic data, such as usage data. - - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Allow a shared books folder -[!INCLUDE [allow-shared-folder-books-include.md](../includes/allow-shared-folder-books-include.md)] - -## Allow configuration updates for the Books Library -[!INCLUDE [allow-config-updates-books-include.md](../includes/allow-config-updates-books-include.md)] - -## Allow extended telemetry for the Books tab -[!INCLUDE [allow-ext-telemetry-books-tab-include.md](../includes/allow-ext-telemetry-books-tab-include.md)] - -## Always show the Books Library in Microsoft Edge -[!INCLUDE [always-enable-book-library-include.md](../includes/always-enable-book-library-include.md)] +--- +title: Microsoft Edge - Books Library group policies +description: Microsoft Edge decreases the amount of storage used by book files by downloading them to a shared folder. You can also allow Microsoft Edge to update the configuration data for the library automatically. +services: +keywords: +ms.localizationpriority: medium +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.topic: reference +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Books Library + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge decreases the amount of storage used by book files by downloading them to a shared folder in Windows. You can configure Microsoft Edge to update the configuration data for the library automatically or gather diagnostic data, such as usage data. + + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Allow a shared books folder +[!INCLUDE [allow-shared-folder-books-include.md](../includes/allow-shared-folder-books-include.md)] + +## Allow configuration updates for the Books Library +[!INCLUDE [allow-config-updates-books-include.md](../includes/allow-config-updates-books-include.md)] + +## Allow extended telemetry for the Books tab +[!INCLUDE [allow-ext-telemetry-books-tab-include.md](../includes/allow-ext-telemetry-books-tab-include.md)] + +## Always show the Books Library in Microsoft Edge +[!INCLUDE [always-enable-book-library-include.md](../includes/always-enable-book-library-include.md)] diff --git a/browsers/edge/group-policies/browser-settings-management-gp.md b/browsers/edge/group-policies/browser-settings-management-gp.md index 296b99b037..2301806f5f 100644 --- a/browsers/edge/group-policies/browser-settings-management-gp.md +++ b/browsers/edge/group-policies/browser-settings-management-gp.md @@ -1,52 +1,56 @@ ---- -title: Microsoft Edge - Browser experience group policies -description: Not only do the other Microsoft Edge group policies enhance the browsing experience, but we must also talk about some of the most common or somewhat common browsing experiences. For example, printing web content is a common browsing experience. However, if you want to prevent users from printing web content, Microsoft Edge has a group policy that allows you to prevent printing. -services: -keywords: -ms.localizationpriority: medium -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -ms.topic: reference -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library ---- - -# Browser experience - -Not only do the other Microsoft Edge group policies enhance the browsing experience, but we also want to mention some of the other and common browsing experiences. For example, printing web content is a common browsing experience. However, if you want to prevent users from printing web content, Microsoft Edge has a group policy that allows you to prevent printing. The same goes for Pop-up Blocker; Microsoft Edge has a group policy that lets you prevent pop-up windows or let users choose to use Pop-up Blocker. You can use any one of the following group policies to continue enhancing the browsing experience for your users. - - - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Allow clearing browsing data on exit -[!INCLUDE [allow-clearing-browsing-data-include](../includes/allow-clearing-browsing-data-include.md)] - -## Allow fullscreen mode -[!INCLUDE [allow-full-screen-include](../includes/allow-full-screen-include.md)] - -## Allow printing -[!INCLUDE [allow-printing-include](../includes/allow-printing-include.md)] - -## Allow Saving History -[!INCLUDE [allow-saving-history-include](../includes/allow-saving-history-include.md)] - -## Configure Autofill -[!INCLUDE [configure-autofill-include](../includes/configure-autofill-include.md)] - -## Configure Pop-up Blocker -[!INCLUDE [configure-pop-up-blocker-include](../includes/configure-pop-up-blocker-include.md)] - -## Do not sync -[!INCLUDE [do-not-sync-include](../includes/do-not-sync-include.md)] - -To learn about the policies to sync the browser settings, see [Sync browser settings](sync-browser-settings-gp.md). - - - +--- +title: Microsoft Edge - Browser experience group policies +description: Not only do the other Microsoft Edge group policies enhance the browsing experience, but we must also talk about some of the most common or somewhat common browsing experiences. For example, printing web content is a common browsing experience. However, if you want to prevent users from printing web content, Microsoft Edge has a group policy that allows you to prevent printing. +services: +keywords: +ms.localizationpriority: medium +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.topic: reference +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Browser experience + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Not only do the other Microsoft Edge group policies enhance the browsing experience, but we also want to mention some of the other and common browsing experiences. For example, printing web content is a common browsing experience. However, if you want to prevent users from printing web content, Microsoft Edge has a group policy that allows you to prevent printing. The same goes for Pop-up Blocker; Microsoft Edge has a group policy that lets you prevent pop-up windows or let users choose to use Pop-up Blocker. You can use any one of the following group policies to continue enhancing the browsing experience for your users. + + + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Allow clearing browsing data on exit +[!INCLUDE [allow-clearing-browsing-data-include](../includes/allow-clearing-browsing-data-include.md)] + +## Allow fullscreen mode +[!INCLUDE [allow-full-screen-include](../includes/allow-full-screen-include.md)] + +## Allow printing +[!INCLUDE [allow-printing-include](../includes/allow-printing-include.md)] + +## Allow Saving History +[!INCLUDE [allow-saving-history-include](../includes/allow-saving-history-include.md)] + +## Configure Autofill +[!INCLUDE [configure-autofill-include](../includes/configure-autofill-include.md)] + +## Configure Pop-up Blocker +[!INCLUDE [configure-pop-up-blocker-include](../includes/configure-pop-up-blocker-include.md)] + +## Do not sync +[!INCLUDE [do-not-sync-include](../includes/do-not-sync-include.md)] + +To learn about the policies to sync the browser settings, see [Sync browser settings](sync-browser-settings-gp.md). + + + diff --git a/browsers/edge/group-policies/developer-settings-gp.md b/browsers/edge/group-policies/developer-settings-gp.md index a5d7e4f42b..67c6d1284c 100644 --- a/browsers/edge/group-policies/developer-settings-gp.md +++ b/browsers/edge/group-policies/developer-settings-gp.md @@ -1,31 +1,34 @@ ---- -title: Microsoft Edge - Developer tools -description: Microsoft Edge, by default, allows users to use the F12 developer tools as well as access the about:flags page. You can prevent users from using the F12 developer tools or from accessing the about:flags page. -services: -keywords: -ms.localizationpriority: medium -manager: dougkim -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.topic: reference -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library ---- - -# Developer tools - -Microsoft Edge, by default, allows users to use the F12 developer tools as well as access the about:flags page. You can prevent users from using the F12 developer tools or from accessing the about:flags page. - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Allow Developer Tools -[!INCLUDE [allow-dev-tools-include](../includes/allow-dev-tools-include.md)] - -## Prevent access to the about:flags page -[!INCLUDE [prevent-access-about-flag-include](../includes/prevent-access-about-flag-include.md)] +--- +title: Microsoft Edge - Developer tools +description: Microsoft Edge, by default, allows users to use the F12 developer tools as well as access the about:flags page. You can prevent users from using the F12 developer tools or from accessing the about:flags page. +services: +keywords: +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.topic: reference +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Developer tools + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge, by default, allows users to use the F12 developer tools as well as access the about:flags page. You can prevent users from using the F12 developer tools or from accessing the about:flags page. + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Allow Developer Tools +[!INCLUDE [allow-dev-tools-include](../includes/allow-dev-tools-include.md)] + +## Prevent access to the about:flags page +[!INCLUDE [prevent-access-about-flag-include](../includes/prevent-access-about-flag-include.md)] diff --git a/browsers/edge/group-policies/extensions-management-gp.md b/browsers/edge/group-policies/extensions-management-gp.md index 5230bc5f52..dc9b9406b4 100644 --- a/browsers/edge/group-policies/extensions-management-gp.md +++ b/browsers/edge/group-policies/extensions-management-gp.md @@ -1,33 +1,37 @@ ---- -title: Microsoft Edge - Extensions group policies -description: Currently, Microsoft Edge allows users to add or personalize, and uninstall extensions. You can prevent users from uninstalling extensions or sideloading of extensions, which does not prevent sideloading using Add-AppxPackage via PowerShell. Allowing sideloading of extensions installs and runs unverified extensions. -services: -keywords: -ms.localizationpriority: medium -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -ms.topic: reference -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library ---- - -# Extensions - -Currently, Microsoft Edge allows users to add or personalize, and uninstall extensions. You can prevent users from uninstalling extensions or sideloading of extensions, which does not prevent sideloading using Add-AppxPackage via PowerShell. Allowing sideloading of extensions installs and runs unverified extensions. - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Allow Extensions -[!INCLUDE [allow-extensions-include](../includes/allow-extensions-include.md)] - -## Allow sideloading of extensions -[!INCLUDE [allow-sideloading-extensions-include](../includes/allow-sideloading-extensions-include.md)] - -## Prevent turning off required extensions -[!INCLUDE [prevent-turning-off-required-extensions-include](../includes/prevent-turning-off-required-extensions-include.md)] +--- +title: Microsoft Edge - Extensions group policies +description: Currently, Microsoft Edge allows users to add or personalize, and uninstall extensions. You can prevent users from uninstalling extensions or sideloading of extensions, which does not prevent sideloading using Add-AppxPackage via PowerShell. Allowing sideloading of extensions installs and runs unverified extensions. +services: +keywords: +ms.localizationpriority: medium +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.topic: reference +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Extensions + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Currently, Microsoft Edge allows users to add or personalize, and uninstall extensions. You can prevent users from uninstalling extensions or sideloading of extensions, which does not prevent sideloading using Add-AppxPackage via PowerShell. Allowing sideloading of extensions installs and runs unverified extensions. + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Allow Extensions +[!INCLUDE [allow-extensions-include](../includes/allow-extensions-include.md)] + +## Allow sideloading of extensions +[!INCLUDE [allow-sideloading-extensions-include](../includes/allow-sideloading-extensions-include.md)] + +## Prevent turning off required extensions +[!INCLUDE [prevent-turning-off-required-extensions-include](../includes/prevent-turning-off-required-extensions-include.md)] diff --git a/browsers/edge/group-policies/favorites-management-gp.md b/browsers/edge/group-policies/favorites-management-gp.md index 6ba684a843..c8584e28f5 100644 --- a/browsers/edge/group-policies/favorites-management-gp.md +++ b/browsers/edge/group-policies/favorites-management-gp.md @@ -1,39 +1,43 @@ ---- -title: Microsoft Edge - Favorites group policies -description: Configure Microsoft Edge to either show or hide the favorites bar on all pages. Microsoft Edge hides the favorites bar by default but shows the favorites bar on the Start and New tab pages. Also, by default, the favorites bar toggle, in Settings, is set to Off but enabled allowing users to make changes. -services: -keywords: -ms.localizationpriority: medium -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -ms.topic: reference -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library ---- - -# Favorites - -You can customize the favorites bar, for example, you can turn off features such as Save a Favorite and Import settings, and hide or show the favorites bar on all pages. Another customization you can make is provisioning a standard list of favorites, including folders, to appear in addition to the user’s favorites. If it’s important to keep the favorites in both IE11 and Microsoft Edge synced, you can turn on syncing where changes to the list of favorites in one browser reflect in the other. - ->[!TIP] ->You can find the Favorites under C:\\Users\\<_username_>\\Favorites. - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Configure Favorites Bar -[!INCLUDE [configure-favorites-bar-include](../includes/configure-favorites-bar-include.md)] - -## Keep favorites in sync between Internet Explorer and Microsoft Edge -[!INCLUDE [keep-fav-sync-ie-edge-include](../includes/keep-fav-sync-ie-edge-include.md)] - -## Prevent changes to Favorites on Microsoft Edge -[!INCLUDE [prevent-changes-to-favorites-include](../includes/prevent-changes-to-favorites-include.md)] - -## Provision Favorites -[!INCLUDE [provision-favorites-include](../includes/provision-favorites-include.md)] +--- +title: Microsoft Edge - Favorites group policies +description: Configure Microsoft Edge to either show or hide the favorites bar on all pages. Microsoft Edge hides the favorites bar by default but shows the favorites bar on the Start and New tab pages. Also, by default, the favorites bar toggle, in Settings, is set to Off but enabled allowing users to make changes. +services: +keywords: +ms.localizationpriority: medium +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.topic: reference +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Favorites + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +You can customize the favorites bar, for example, you can turn off features such as Save a Favorite and Import settings, and hide or show the favorites bar on all pages. Another customization you can make is provisioning a standard list of favorites, including folders, to appear in addition to the user’s favorites. If it’s important to keep the favorites in both IE11 and Microsoft Edge synced, you can turn on syncing where changes to the list of favorites in one browser reflect in the other. + +> [!TIP] +> You can find the Favorites under C:\\Users\\<_username_>\\Favorites. + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Configure Favorites Bar +[!INCLUDE [configure-favorites-bar-include](../includes/configure-favorites-bar-include.md)] + +## Keep favorites in sync between Internet Explorer and Microsoft Edge +[!INCLUDE [keep-fav-sync-ie-edge-include](../includes/keep-fav-sync-ie-edge-include.md)] + +## Prevent changes to Favorites on Microsoft Edge +[!INCLUDE [prevent-changes-to-favorites-include](../includes/prevent-changes-to-favorites-include.md)] + +## Provision Favorites +[!INCLUDE [provision-favorites-include](../includes/provision-favorites-include.md)] diff --git a/browsers/edge/group-policies/home-button-gp.md b/browsers/edge/group-policies/home-button-gp.md index f9db9cbcb3..8f498a5d58 100644 --- a/browsers/edge/group-policies/home-button-gp.md +++ b/browsers/edge/group-policies/home-button-gp.md @@ -1,47 +1,51 @@ ---- -title: Microsoft Edge - Home button group policies -description: Microsoft Edge shows the home button, by default, and by clicking it the Start page loads. With the relevant Home button policies, you can configure the Home button to load the New tab page or a specific page. You can also configure Microsoft Edge to hide the home button. -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.date: 10/02/2018 -ms.reviewer: -ms.localizationpriority: medium -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library -ms.topic: reference ---- - -# Home button - -Microsoft Edge shows the home button, by default, and by clicking it the Start page loads. With the relevant Home button policies, you can configure the Home button to load the New tab page or a specific page. You can also configure Microsoft Edge to hide the home button. - -## Relevant group policies - -- [Configure Home Button](#configure-home-button) -- [Set Home Button URL](#set-home-button-url) -- [Unlock Home Button](#unlock-home-button) - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Configuration options - -![Show home button and load Start page or New Tab page](../images/home-button-start-new-tab-page-v4-sm.png) - -![Show home button and load custom URL](../images/home-buttom-custom-url-v4-sm.png) - -![Hide home button](../images/home-button-hide-v4-sm.png) - - -## Configure Home Button -[!INCLUDE [configure-home-button-include.md](../includes/configure-home-button-include.md)] - -## Set Home Button URL -[!INCLUDE [set-home-button-url-include](../includes/set-home-button-url-include.md)] - -## Unlock Home Button -[!INCLUDE [unlock-home-button-include.md](../includes/unlock-home-button-include.md)] - +--- +title: Microsoft Edge - Home button group policies +description: Microsoft Edge shows the home button, by default, and by clicking it the Start page loads. With the relevant Home button policies, you can configure the Home button to load the New tab page or a specific page. You can also configure Microsoft Edge to hide the home button. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.localizationpriority: medium +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +ms.topic: reference +--- + +# Home button + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge shows the home button, by default, and by clicking it the Start page loads. With the relevant Home button policies, you can configure the Home button to load the New tab page or a specific page. You can also configure Microsoft Edge to hide the home button. + +## Relevant group policies + +- [Configure Home Button](#configure-home-button) +- [Set Home Button URL](#set-home-button-url) +- [Unlock Home Button](#unlock-home-button) + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Configuration options + +![Show home button and load Start page or New Tab page](../images/home-button-start-new-tab-page-v4-sm.png) + +![Show home button and load custom URL](../images/home-buttom-custom-url-v4-sm.png) + +![Hide home button](../images/home-button-hide-v4-sm.png) + + +## Configure Home Button +[!INCLUDE [configure-home-button-include.md](../includes/configure-home-button-include.md)] + +## Set Home Button URL +[!INCLUDE [set-home-button-url-include](../includes/set-home-button-url-include.md)] + +## Unlock Home Button +[!INCLUDE [unlock-home-button-include.md](../includes/unlock-home-button-include.md)] + diff --git a/browsers/edge/group-policies/index.yml b/browsers/edge/group-policies/index.yml index 7ee2caf174..8fb16843d8 100644 --- a/browsers/edge/group-policies/index.yml +++ b/browsers/edge/group-policies/index.yml @@ -1,231 +1,80 @@ -### YamlMime:YamlDocument +### YamlMime:Landing -documentType: LandingData - -title: Microsoft Edge group policies +title: Microsoft Edge Legacy group policies # < 60 chars +summary: Microsoft Edge Legacy works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. # < 160 chars metadata: - - document_id: - - title: Microsoft Edge group policies - - description: Learn how to configure group policies in Microsoft Edge on Windows 10. - - text: Some of the features in Microsoft Edge gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. - - keywords: Microsoft Edge, Windows 10, Windows 10 Mobile - + title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars. + keywords: Microsoft Edge Legacy, Windows 10, Windows 10 Mobile ms.localizationpriority: medium - + ms.prod: edge author: shortpatti - ms.author: pashort - - ms.date: 10/02/2018 - - ms.topic: article - + ms.topic: landing-page ms.devlang: na - -sections: - -- title: - -- items: - - - type: markdown - - text: Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. - -- items: - - - type: list - - style: cards - - className: cardsE - - columns: 3 - - items: - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/address-bar-settings-gp - - html:

Learn how you can configure Microsoft Edge to show search suggestions in the address bar.

- - image: - - src: https://docs.microsoft.com/media/common/i_http.svg - - title: Address bar - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/adobe-settings-gp - - html:

Learn how you can configure Microsoft Edge to load Adobe Flash content automatically.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Adobe Flash - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/books-library-management-gp - - html:

Learn how you can set up and use the books library, such as using a shared books folder for students and teachers.

- - image: - - src: https://docs.microsoft.com/media/common/i_library.svg - - title: Books Library - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/browser-settings-management-gp - - html:

Learn how you can customize the browser settings, such as printing and saving browsing history, plus more.

- - image: - - src: https://docs.microsoft.com/media/common/i_management.svg - - title: Browser experience - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/developer-settings-gp - - html:

Learn how to configure Microsoft Edge for development and testing.

- - image: - - src: https://docs.microsoft.com/media/common/i_config-tools.svg - - title: Developer tools - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/extensions-management-gp - - html:

Learn how you can configure Microsoft Edge to either prevent or allow users to install and run unverified extensions.

- - image: - - src: https://docs.microsoft.com/media/common/i_extensions.svg - - title: Extensions - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/favorites-management-gp - - html:

Learn how you can provision a standard favorites list as well as keep the favorites lists in sync between IE11 and Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_link.svg - - title: Favorites - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/home-button-gp - - html:

Learn how you can customize the home button or hide it.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Home button - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp - - html:

Learn how you use Microsoft Edge and Internet Explorer together for a full browsing experience.

- - image: - - src: https://docs.microsoft.com/media/common/i_management.svg - - title: Interoperability and enterprise guidance - - - href: https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy - - html:

Learn how Microsoft Edge kiosk mode works with assigned access to let IT administrators create a tailored browsing experience designed for kiosk devices.

- - image: - - src: https://docs.microsoft.com/media/common/i_categorize.svg - - title: Kiosk mode deployment in Microsoft Edge - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/new-tab-page-settings-gp - - html:

Learn how to configure the New Tab page in Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: New Tab page - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/prelaunch-preload-gp - - html:

Learn how pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Prelaunch Microsoft Edge and preload tabs - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/search-engine-customization-gp - - html:

Learn how you can set the default search engine and configure additional ones.

- - image: - - src: https://docs.microsoft.com/media/common/i_search.svg - - title: Search engine customization - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp - - html:

Learn how you can keep your environment and users safe from attacks.

- - image: - - src: https://docs.microsoft.com/media/common/i_security-management.svg - - title: Security and privacy - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/start-pages-gp - - html:

Learn how to configure the Start pages in Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Start page - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/sync-browser-settings-gp - - html:

Learn how to you can prevent the "browser" group from syncing and prevent users from turning on the Sync your Settings toggle.

- - image: - - src: https://docs.microsoft.com/media/common/i_sync.svg - - title: Sync browser - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/telemetry-management-gp - - html:

Learn how you can configure Microsoft Edge to collect certain data.

- - image: - - src: https://docs.microsoft.com/media/common/i_data-collection.svg - - title: Telemetry and data collection - - - href: https://docs.microsoft.com/microsoft-edge/deploy/available-policies - - html:

View all available group policies for Microsoft Edge on Windows 10.

- - image: - - src: https://docs.microsoft.com/media/common/i_policy.svg - - title: All group policies + ms.date: 08/28/2020 #Required; mm/dd/yyyy format. + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: What's new + linkLists: + - linkListType: whats-new + links: + - text: Documentation for Microsoft Edge version 77 or later + url: https://docs.microsoft.com/DeployEdge/ + - text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021 + url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 + + # Card (optional) + - title: Group policies configure guidance part 1 + linkLists: + - linkListType: reference + links: + - text: All group policies + url: /microsoft-edge/deploy/available-policies + - text: Address bar + url: /microsoft-edge/deploy/group-policies/address-bar-settings-gp + - text: Adobe Flash + url: /microsoft-edge/deploy/group-policies/adobe-settings-gp + - text: Books Library + url: /microsoft-edge/deploy/group-policies/books-library-management-gp + - text: Browser experience + url: /microsoft-edge/deploy/group-policies/browser-settings-management-gp + - text: Developer tools + url: /microsoft-edge/deploy/group-policies/developer-settings-gp + - text: Extensions + url: /microsoft-edge/deploy/group-policies/extensions-management-gp + - text: Favorites + url: /microsoft-edge/deploy/group-policies/favorites-management-gp + - text: Home button + url: /microsoft-edge/deploy/group-policies/home-button-gp + + # Card (optional) + - title: Group policies configure guidance part 2 + linkLists: + - linkListType: reference + links: + - text: Interoperability and enterprise mode + url: /microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp + - text: New Tab page + url: /microsoft-edge/deploy/group-policies/new-tab-page-settings-gp + - text: Kiosk mode deployment in Microsoft Edge + url: /microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy + - text: Prelaunch Microsoft Edge and preload tabs + url: /microsoft-edge/deploy/group-policies/prelaunch-preload-gp + - text: Search engine customization + url: /microsoft-edge/deploy/group-policies/search-engine-customization-gp + - text: Security and privacy + url: /microsoft-edge/deploy/group-policies/security-privacy-management-gp + - text: Start page + url: /microsoft-edge/deploy/group-policies/start-pages-gp + - text: Sync browser + url: /microsoft-edge/deploy/group-policies/sync-browser-settings-gp + - text: Telemetry and data collection + url: /microsoft-edge/deploy/group-policies/telemetry-management-gp + diff --git a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md index 24dc169b1a..bd34273cc4 100644 --- a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md +++ b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md @@ -1,79 +1,81 @@ ---- -title: Microsoft Edge - Interoperability and enterprise mode guidance -description: Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. -ms.localizationpriority: medium -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.date: 10/02/2018 -ms.reviewer: -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library -ms.topic: reference ---- - -# Interoperability and enterprise mode guidance - -Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. - ->[!TIP] ->If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. - -**Technology not supported by Microsoft Edge** - - -- ActiveX controls - -- Browser Helper Objects - -- VBScript - -- x-ua-compatible headers - -- \ tags - -- Legacy document modes - -If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. - -Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. - -## Relevant group policies - - -1. [Configure the Enterprise Mode Site List](#configure-the-enterprise-mode-site-list) - -2. [Send all intranet sites to Internet Explorer 11](#send-all-intranet-sites-to-internet-explorer-11) - -3. [Show message when opening sites in Internet Explorer](#show-message-when-opening-sites-in-internet-explorer) - -4. [(IE11 policy) Send all sites not included in the Enterprise Mode Site List to Microsoft Edge](#ie11-policy-send-all-sites-not-included-in-the-enterprise-mode-site-list-to-microsoft-edge) - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Configuration options - -![Use Enterprise Mode with Microsoft Edge to improve compatibility](../images/use-enterprise-mode-with-microsoft-edge-sm.png) - - -## Configure the Enterprise Mode Site List - -[!INCLUDE [configure-enterprise-mode-site-list-include](../includes/configure-enterprise-mode-site-list-include.md)] - - -## Send all intranet sites to Internet Explorer 11 - -[!INCLUDE [send-all-intranet-sites-ie-include](../includes/send-all-intranet-sites-ie-include.md)] - - -## Show message when opening sites in Internet Explorer - -[!INCLUDE [show-message-opening-sites-ie-include](../includes/show-message-opening-sites-ie-include.md)] - - -## (IE11 policy) Send all sites not included in the Enterprise Mode Site List to Microsoft Edge - -[!INCLUDE [ie11-send-all-sites-not-in-site-list-include](../includes/ie11-send-all-sites-not-in-site-list-include.md)] +--- +title: Microsoft Edge - Interoperability and enterprise mode guidance +description: Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. +ms.localizationpriority: medium +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +ms.topic: reference +--- + +# Interoperability and enterprise mode guidance + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. + +> [!TIP] +> If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. + +**Technology not supported by Microsoft Edge** + +- ActiveX controls + +- Browser Helper Objects + +- VBScript + +- x-ua-compatible headers + +- \ tags + +- Legacy document modes + +If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. + +Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. + +## Relevant group policies + +1. [Configure the Enterprise Mode Site List](#configure-the-enterprise-mode-site-list) + +2. [Send all intranet sites to Internet Explorer 11](#send-all-intranet-sites-to-internet-explorer-11) + +3. [Show message when opening sites in Internet Explorer](#show-message-when-opening-sites-in-internet-explorer) + +4. [(IE11 policy) Send all sites not included in the Enterprise Mode Site List to Microsoft Edge](#ie11-policy-send-all-sites-not-included-in-the-enterprise-mode-site-list-to-microsoft-edge) + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Configuration options + +![Use Enterprise Mode with Microsoft Edge to improve compatibility](../images/use-enterprise-mode-with-microsoft-edge-sm.png) + + +## Configure the Enterprise Mode Site List + +[!INCLUDE [configure-enterprise-mode-site-list-include](../includes/configure-enterprise-mode-site-list-include.md)] + + +## Send all intranet sites to Internet Explorer 11 + +[!INCLUDE [send-all-intranet-sites-ie-include](../includes/send-all-intranet-sites-ie-include.md)] + + +## Show message when opening sites in Internet Explorer + +[!INCLUDE [show-message-opening-sites-ie-include](../includes/show-message-opening-sites-ie-include.md)] + + +## (IE11 policy) Send all sites not included in the Enterprise Mode Site List to Microsoft Edge + +[!INCLUDE [ie11-send-all-sites-not-in-site-list-include](../includes/ie11-send-all-sites-not-in-site-list-include.md)] diff --git a/browsers/edge/group-policies/new-tab-page-settings-gp.md b/browsers/edge/group-policies/new-tab-page-settings-gp.md index 7e0cf5f89e..28d551cfac 100644 --- a/browsers/edge/group-policies/new-tab-page-settings-gp.md +++ b/browsers/edge/group-policies/new-tab-page-settings-gp.md @@ -1,46 +1,50 @@ ---- -title: Microsoft Edge - New Tab page group policies -description: Microsoft Edge loads the default New tab page by default. With the relevant New Tab policies, you can set a URL to load in the New Tab page and prevent users from making changes. You can also load a blank page instead or let the users choose what loads. -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.date: 10/02/2018 -ms.reviewer: -ms.localizationpriority: medium -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library -ms.topic: reference ---- - - -# New Tab page - -Microsoft Edge loads the default New tab page by default. With the relevant New Tab policies, you can set a URL to load in the New Tab page and prevent users from making changes. You can also load a blank page instead or let the users choose what loads. - ->[!NOTE] ->New tab pages do not load while running InPrivate mode. - -## Relevant group policies - -- [Set New Tab page URL](#set-new-tab-page-url) -- [Allow web content on New Tab page](#allow-web-content-on-new-tab-page) - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Configuration options - -![Load the default New Tab page](../images/load-default-new-tab-page-sm.png) - -![Load a blank page instead of the default New Tab page](../images/load-blank-page-not-new-tab-page-sm.png) - -![Let users choose what loads](../images/users-choose-new-tab-page-sm.png) - - -## Set New Tab page URL -[!INCLUDE [set-new-tab-url-include](../includes/set-new-tab-url-include.md)] - -## Allow web content on New Tab page -[!INCLUDE [allow-web-content-new-tab-page-include](../includes/allow-web-content-new-tab-page-include.md)] +--- +title: Microsoft Edge - New Tab page group policies +description: Microsoft Edge loads the default New tab page by default. With the relevant New Tab policies, you can set a URL to load in the New Tab page and prevent users from making changes. You can also load a blank page instead or let the users choose what loads. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.localizationpriority: medium +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +ms.topic: reference +--- + + +# New Tab page + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge loads the default New tab page by default. With the relevant New Tab policies, you can set a URL to load in the New Tab page and prevent users from making changes. You can also load a blank page instead or let the users choose what loads. + +> [!NOTE] +> New tab pages do not load while running InPrivate mode. + +## Relevant group policies + +- [Set New Tab page URL](#set-new-tab-page-url) +- [Allow web content on New Tab page](#allow-web-content-on-new-tab-page) + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Configuration options + +![Load the default New Tab page](../images/load-default-new-tab-page-sm.png) + +![Load a blank page instead of the default New Tab page](../images/load-blank-page-not-new-tab-page-sm.png) + +![Let users choose what loads](../images/users-choose-new-tab-page-sm.png) + + +## Set New Tab page URL +[!INCLUDE [set-new-tab-url-include](../includes/set-new-tab-url-include.md)] + +## Allow web content on New Tab page +[!INCLUDE [allow-web-content-new-tab-page-include](../includes/allow-web-content-new-tab-page-include.md)] diff --git a/browsers/edge/group-policies/prelaunch-preload-gp.md b/browsers/edge/group-policies/prelaunch-preload-gp.md index 7ff02e7924..5c4bf7c5fe 100644 --- a/browsers/edge/group-policies/prelaunch-preload-gp.md +++ b/browsers/edge/group-policies/prelaunch-preload-gp.md @@ -3,8 +3,8 @@ title: Microsoft Edge - Prelaunch and tab preload group policies description: Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge. audience: itpro manager: dansimp -ms.author: eravena -author: eavena +ms.author: dansimp +author: dansimp ms.prod: edge ms.reviewer: ms.localizationpriority: medium @@ -13,6 +13,9 @@ ms.topic: reference # Prelaunch Microsoft Edge and preload tabs in the background +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge. You can also configure Microsoft Edge to prevent Microsoft Edge from pre-launching. Additionally, Microsoft Edge preloads the Start and New Tab pages during Windows sign in, which minimizes the amount of time required to start Microsoft Edge and load a new tab. You can also configure Microsoft Edge to prevent preloading of tabs. diff --git a/browsers/edge/group-policies/search-engine-customization-gp.md b/browsers/edge/group-policies/search-engine-customization-gp.md index 6d4876ef46..480d0e275f 100644 --- a/browsers/edge/group-policies/search-engine-customization-gp.md +++ b/browsers/edge/group-policies/search-engine-customization-gp.md @@ -1,10 +1,10 @@ --- title: Microsoft Edge - Search engine customization group policies -description: Microsoft Edge, by default, uses the search engine specified in App settings, which lets users make changes. You can prevent users from making changes and still use the search engine specified in App settings by disabling the Allow search engine customization policy. You can also use the policy-set search engine specified in the OpenSearch XML file in which you can configure up to five additional search engines and setting any one of them as the default. +description: Microsoft Edge, by default, uses the search engine specified in App settings, which lets users make changes. You can prevent users from making changes and still use the search engine specified in App settings by disabling the Allow search engine customization policy. You can also use the policy-set search engine specified in the OpenSearch XML file in which you can configure up to five additional search engines and setting any one of them as the default. audience: itpro manager: dansimp -ms.author: eravena -author: eavena +ms.author: dansimp +author: dansimp ms.prod: edge ms.reviewer: ms.localizationpriority: medium @@ -13,6 +13,9 @@ ms.topic: reference # Search engine customization +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge, by default, uses the search engine specified in App settings, which lets users make changes. You can prevent users from making changes and still use the search engine specified in App settings by disabling the Allow search engine customization policy. You can also use the policy-set search engine specified in the OpenSearch XML file in which you can configure up to five additional search engines and setting any one of them as the default. ## Relevant group policies diff --git a/browsers/edge/group-policies/security-privacy-management-gp.md b/browsers/edge/group-policies/security-privacy-management-gp.md index 67e656daa8..033d73b50e 100644 --- a/browsers/edge/group-policies/security-privacy-management-gp.md +++ b/browsers/edge/group-policies/security-privacy-management-gp.md @@ -1,74 +1,78 @@ ---- -title: Microsoft Edge - Security and privacy group policies -description: Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows. While most websites are safe, some sites have been designed to steal personal information or gain access to your system’s resources. -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.date: 10/02/2018 -ms.reviewer: -ms.localizationpriority: medium -ms.topic: reference ---- - -# Security and privacy - -Microsoft Edge is designed with improved security in mind, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows. Because Microsoft Edge is designed like a Universal Windows app, changing the browser to an app, it fundamentally changes the process model so that both the outer manager process and the different content processes all live within app container sandboxes. - -Microsoft Edge runs in 64-bit not just by default, but anytime it’s running on a 64-bit operating system. Because Microsoft Edge doesn’t support legacy ActiveX controls or 3rd-party binary extensions, there’s no longer a reason to run 32-bit processes on a 64-bit system. - -The value of running 64-bit all the time is that it strengthens Windows Address Space Layout Randomization (ASLR), randomizing the memory layout of the browser processes, making it much harder for attackers to hit precise memory locations. In turn, 64-bit processes make ASLR much more effective by making the address space exponentially larger and, therefore, more difficult for attackers to find sensitive memory components. - -For more details on the security features in Microsoft Edge, see [Help protect against web-based security threats](#help-protect-against-web-based-security-threats) below. - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Configure cookies -[!INCLUDE [configure-cookies-include](../includes/configure-cookies-include.md)] - -## Configure Password Manager -[!INCLUDE [configure-password-manager-include](../includes/configure-password-manager-include.md)] - -## Configure Windows Defender SmartScreen -[!INCLUDE [configure-windows-defender-smartscreen-include](../includes/configure-windows-defender-smartscreen-include.md)] - -## Prevent bypassing Windows Defender SmartScreen prompts for files -[!INCLUDE [prevent-bypassing-win-defender-files-include](../includes/prevent-bypassing-win-defender-files-include.md)] - -## Prevent bypassing Windows Defender SmartScreen prompts for sites -[!INCLUDE [prevent-bypassing-win-defender-sites-include](../includes/prevent-bypassing-win-defender-sites-include.md)] - -## Prevent certificate error overrides -[!INCLUDE [prevent-certificate-error-overrides-include](../includes/prevent-certificate-error-overrides-include.md)] - -## Prevent using Localhost IP address for WebRTC -[!INCLUDE [prevent-localhost-address-for-webrtc-include](../includes/prevent-localhost-address-for-webrtc-include.md)] - - -## Help protect against web-based security threats - -While most websites are safe, some sites have been intentionally designed to steal sensitive and private information or gain access to your system’s resources. You can help protect against threats by using strong security protocols to ensure against such threats. - -Thieves use things like _phishing_ attacks to convince someone to enter personal information, such as a banking password, into a website that looks like a legitimate bank but isn't. Attempts to identify legitimate websites through the HTTPS lock symbol and the EV Cert green bar have met with only limited success since attackers are too good at faking legitimate experiences for many people to notice the difference. - -Another method thieves often use _hacking_ to attack a system through malformed content that exploits subtle flaws in the browser or various browser extensions. This exploit lets an attacker run code on a device, taking over a browsing session, and perhaps the entire device. - -Microsoft Edge addresses these threats to help make browsing the web a safer experience. - - -| Feature | Description | -|-----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **[Windows Hello](https://blogs.windows.com/bloggingwindows/2015/03/17/making-windows-10-more-personal-and-more-secure-with-windows-hello/)** | Microsoft Edge is the first browser to natively support Windows Hello to authenticate the user and the website with asymmetric cryptography technology, powered by early implementation of the [Web Authentication (formerly FIDO 2.0 Web API) specification](https://w3c.github.io/webauthn/). | -| **Microsoft SmartScreen** | Defends against phishing by performing reputation checks on sites visited and blocking any sites that are thought to be a phishing site. SmartScreen also helps to defend against installing malicious software, drive-by attacks, or file downloads, even from trusted sites. Drive-by attacks are malicious web-based attacks that compromise your system by targeting security vulnerabilities in commonly used software and may be hosted on trusted sites. | -| **Certificate Reputation system** | Collects data about certificates in use, detecting new certificates and flagging fraudulent certificates automatically, and sends the data to Microsoft. The systems and tools in place include | -| **Microsoft EdgeHTML and modern web standards** | Microsoft Edge uses Microsoft EdgeHTML as the rendering engine. This engine focuses on modern standards letting web developers build and maintain a consistent site across all modern browsers. It also helps to defend against hacking through these security standards features:

**NOTE:** Both Microsoft Edge and Internet Explorer 11 support HSTS. | -| **Code integrity and image loading restrictions** | Microsoft Edge content processes support code integrity and image load restrictions, helping to prevent malicious DLLs from loading or injecting into the content processes. Only [properly signed images](https://blogs.windows.com/msedgedev/2015/11/17/microsoft-edge-module-code-integrity/) are allowed to load into Microsoft Edge. Binaries on remote devices (such as UNC or WebDAV) can’t load. | -| **Memory corruption mitigations** | Memory corruption attacks frequently happen to apps written in C or C++ don’t provide safety or buffer overflow protection. When an attacker provides malformed input to a program, the program’s memory becomes corrupt allowing the attacker to take control of the program. Although attackers have adapted and invented new ways to attack, we’ve responded with memory safety defenses, mitigating the most common forms of attack, including and especially [use-after-free (UAF)](https://cwe.mitre.org/data/definitions/416.html) vulnerabilities. | -| **Memory Garbage Collector (MemGC) mitigation** | MemGC replaces Memory Protector and helps to protect the browser from UAF vulnerabilities. MemGC frees up memory from the programmer and automating it. Only freeing memory when the automation detects no references left pointing to a given block of memory. | -| **Control Flow Guard** | Attackers use memory corruption attacks to gain control of the CPU program counter to jump to any code location they want. Control Flow Guard, a Microsoft Visual Studio technology, compiles checks around code that performs indirect jumps based on a pointer. Those jumps get restricted to function entry points with known addresses only making attacker take-overs must more difficult constraining where an attack jumps. | -| **All web content runs in an app container sandbox** | Microsoft Edge takes the sandbox even farther, running its content processes in containers not just by default, but all of the time. Microsoft Edge doesn’t support 3rd party binary extensions, so there is no reason for it to run outside of the container, making Microsoft Edge more secure. | -| **Extension model and HTML5 support** | Microsoft Edge does not support binary extensions because they can bring code and data into the browser’s processes without any protection. So if anything goes wrong, the entire browser itself can be compromised or go down. We encourage everyone to use our scripted HTML5-based extension model. For more info about the new extensions, see the [Microsoft Edge Developer Center](https://developer.microsoft.com/microsoft-edge/extensions/). | -| **Reduced attack surfaces** | Microsoft Edge does not support VBScript, JScript, VML, Browser Helper Objects, Toolbars, ActiveX controls, and [document modes](https://msdn.microsoft.com/library/jj676915.aspx). Many IE browser vulnerabilities only appear in legacy document modes, so removing support reduced attack surface making the browser more secure.

It also means that it’s not as backward compatible. With this reduced backward compatibility, Microsoft Edge automatically falls back to Internet Explorer 11 for any apps that need backward compatibility. This fall back happens when you use the Enterprise Mode Site List. | - ---- +--- +title: Microsoft Edge - Security and privacy group policies +description: Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows. While most websites are safe, some sites have been designed to steal personal information or gain access to your system’s resources. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.localizationpriority: medium +ms.topic: reference +--- + +# Security and privacy + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge is designed with improved security in mind, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows. Because Microsoft Edge is designed like a Universal Windows app, changing the browser to an app, it fundamentally changes the process model so that both the outer manager process and the different content processes all live within app container sandboxes. + +Microsoft Edge runs in 64-bit not just by default, but anytime it’s running on a 64-bit operating system. Because Microsoft Edge doesn’t support legacy ActiveX controls or 3rd-party binary extensions, there’s no longer a reason to run 32-bit processes on a 64-bit system. + +The value of running 64-bit all the time is that it strengthens Windows Address Space Layout Randomization (ASLR), randomizing the memory layout of the browser processes, making it much harder for attackers to hit precise memory locations. In turn, 64-bit processes make ASLR much more effective by making the address space exponentially larger and, therefore, more difficult for attackers to find sensitive memory components. + +For more details on the security features in Microsoft Edge, see [Help protect against web-based security threats](#help-protect-against-web-based-security-threats) below. + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Configure cookies +[!INCLUDE [configure-cookies-include](../includes/configure-cookies-include.md)] + +## Configure Password Manager +[!INCLUDE [configure-password-manager-include](../includes/configure-password-manager-include.md)] + +## Configure Windows Defender SmartScreen +[!INCLUDE [configure-windows-defender-smartscreen-include](../includes/configure-windows-defender-smartscreen-include.md)] + +## Prevent bypassing Windows Defender SmartScreen prompts for files +[!INCLUDE [prevent-bypassing-win-defender-files-include](../includes/prevent-bypassing-win-defender-files-include.md)] + +## Prevent bypassing Windows Defender SmartScreen prompts for sites +[!INCLUDE [prevent-bypassing-win-defender-sites-include](../includes/prevent-bypassing-win-defender-sites-include.md)] + +## Prevent certificate error overrides +[!INCLUDE [prevent-certificate-error-overrides-include](../includes/prevent-certificate-error-overrides-include.md)] + +## Prevent using Localhost IP address for WebRTC +[!INCLUDE [prevent-localhost-address-for-webrtc-include](../includes/prevent-localhost-address-for-webrtc-include.md)] + + +## Help protect against web-based security threats + +While most websites are safe, some sites have been intentionally designed to steal sensitive and private information or gain access to your system’s resources. You can help protect against threats by using strong security protocols to ensure against such threats. + +Thieves use things like _phishing_ attacks to convince someone to enter personal information, such as a banking password, into a website that looks like a legitimate bank but isn't. Attempts to identify legitimate websites through the HTTPS lock symbol and the EV Cert green bar have met with only limited success since attackers are too good at faking legitimate experiences for many people to notice the difference. + +Another method thieves often use _hacking_ to attack a system through malformed content that exploits subtle flaws in the browser or various browser extensions. This exploit lets an attacker run code on a device, taking over a browsing session, and perhaps the entire device. + +Microsoft Edge addresses these threats to help make browsing the web a safer experience. + + +| Feature | Description | +|-----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **[Windows Hello](https://blogs.windows.com/bloggingwindows/2015/03/17/making-windows-10-more-personal-and-more-secure-with-windows-hello/)** | Microsoft Edge is the first browser to natively support Windows Hello to authenticate the user and the website with asymmetric cryptography technology, powered by early implementation of the [Web Authentication (formerly FIDO 2.0 Web API) specification](https://w3c.github.io/webauthn/). | +| **Microsoft SmartScreen** | Defends against phishing by performing reputation checks on sites visited and blocking any sites that are thought to be a phishing site. SmartScreen also helps to defend against installing malicious software, drive-by attacks, or file downloads, even from trusted sites. Drive-by attacks are malicious web-based attacks that compromise your system by targeting security vulnerabilities in commonly used software and may be hosted on trusted sites. | +| **Certificate Reputation system** | Collects data about certificates in use, detecting new certificates and flagging fraudulent certificates automatically, and sends the data to Microsoft. The systems and tools in place include

| +| **Microsoft EdgeHTML and modern web standards** | Microsoft Edge uses Microsoft EdgeHTML as the rendering engine. This engine focuses on modern standards letting web developers build and maintain a consistent site across all modern browsers. It also helps to defend against hacking through these security standards features:

**NOTE:** Both Microsoft Edge and Internet Explorer 11 support HSTS. | +| **Code integrity and image loading restrictions** | Microsoft Edge content processes support code integrity and image load restrictions, helping to prevent malicious DLLs from loading or injecting into the content processes. Only [properly signed images](https://blogs.windows.com/msedgedev/2015/11/17/microsoft-edge-module-code-integrity/) are allowed to load into Microsoft Edge. Binaries on remote devices (such as UNC or WebDAV) can’t load. | +| **Memory corruption mitigations** | Memory corruption attacks frequently happen to apps written in C or C++ don’t provide safety or buffer overflow protection. When an attacker provides malformed input to a program, the program’s memory becomes corrupt allowing the attacker to take control of the program. Although attackers have adapted and invented new ways to attack, we’ve responded with memory safety defenses, mitigating the most common forms of attack, including and especially [use-after-free (UAF)](https://cwe.mitre.org/data/definitions/416.html) vulnerabilities. | +| **Memory Garbage Collector (MemGC) mitigation** | MemGC replaces Memory Protector and helps to protect the browser from UAF vulnerabilities. MemGC frees up memory from the programmer and automating it. Only freeing memory when the automation detects no references left pointing to a given block of memory. | +| **Control Flow Guard** | Attackers use memory corruption attacks to gain control of the CPU program counter to jump to any code location they want. Control Flow Guard, a Microsoft Visual Studio technology, compiles checks around code that performs indirect jumps based on a pointer. Those jumps get restricted to function entry points with known addresses only making attacker take-overs must more difficult constraining where an attack jumps. | +| **All web content runs in an app container sandbox** | Microsoft Edge takes the sandbox even farther, running its content processes in containers not just by default, but all of the time. Microsoft Edge doesn’t support 3rd party binary extensions, so there is no reason for it to run outside of the container, making Microsoft Edge more secure. | +| **Extension model and HTML5 support** | Microsoft Edge does not support binary extensions because they can bring code and data into the browser’s processes without any protection. So if anything goes wrong, the entire browser itself can be compromised or go down. We encourage everyone to use our scripted HTML5-based extension model. For more info about the new extensions, see the [Microsoft Edge Developer Center](https://developer.microsoft.com/microsoft-edge/extensions/). | +| **Reduced attack surfaces** | Microsoft Edge does not support VBScript, JScript, VML, Browser Helper Objects, Toolbars, ActiveX controls, and [document modes](https://msdn.microsoft.com/library/jj676915.aspx). Many IE browser vulnerabilities only appear in legacy document modes, so removing support reduced attack surface making the browser more secure.

It also means that it’s not as backward compatible. With this reduced backward compatibility, Microsoft Edge automatically falls back to Internet Explorer 11 for any apps that need backward compatibility. This fall back happens when you use the Enterprise Mode Site List. | + +--- diff --git a/browsers/edge/group-policies/start-pages-gp.md b/browsers/edge/group-policies/start-pages-gp.md index ce15044aad..5ea55bba9f 100644 --- a/browsers/edge/group-policies/start-pages-gp.md +++ b/browsers/edge/group-policies/start-pages-gp.md @@ -1,43 +1,47 @@ ---- -title: Microsoft Edge - Start pages group policies -description: Microsoft Edge loads the pages specified in App settings as the default Start pages. With the relevant Start pages policies, you can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.localizationpriority: medium -ms.date: 10/02/2018 -ms.reviewer: -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library -ms.topic: reference ---- - -# Start pages - -Microsoft Edge loads the pages specified in App settings as the default Start pages. With the relevant Start pages policies, you can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. - -## Relevant group policies - -- [Configure Open Microsoft Edge With](#configure-open-microsoft-edge-with) -- [Configure Start Pages](#configure-start-pages) -- [Disable Lockdown of Start pages](#disable-lockdown-of-start-pages) - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Configuration options - -![Load URLs defined in Configure Start pages](../images/load-urls-defined-in-configure-open-edge-with-sm.png) - - -## Configure Open Microsoft Edge With -[!INCLUDE [configure-open-edge-with-include](../includes/configure-open-edge-with-include.md)] - -## Configure Start Pages -[!INCLUDE [configure-start-pages-include](../includes/configure-start-pages-include.md)] - -## Disable Lockdown of Start pages -[!INCLUDE [disable-lockdown-of-start-pages-include](../includes/disable-lockdown-of-start-pages-include.md)] - +--- +title: Microsoft Edge - Start pages group policies +description: Microsoft Edge loads the pages specified in App settings as the default Start pages. With the relevant Start pages policies, you can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +ms.date: 10/02/2018 +ms.reviewer: +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +ms.topic: reference +--- + +# Start pages + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge loads the pages specified in App settings as the default Start pages. With the relevant Start pages policies, you can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. + +## Relevant group policies + +- [Configure Open Microsoft Edge With](#configure-open-microsoft-edge-with) +- [Configure Start Pages](#configure-start-pages) +- [Disable Lockdown of Start pages](#disable-lockdown-of-start-pages) + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Configuration options + +![Load URLs defined in Configure Start pages](../images/load-urls-defined-in-configure-open-edge-with-sm.png) + + +## Configure Open Microsoft Edge With +[!INCLUDE [configure-open-edge-with-include](../includes/configure-open-edge-with-include.md)] + +## Configure Start Pages +[!INCLUDE [configure-start-pages-include](../includes/configure-start-pages-include.md)] + +## Disable Lockdown of Start pages +[!INCLUDE [disable-lockdown-of-start-pages-include](../includes/disable-lockdown-of-start-pages-include.md)] + diff --git a/browsers/edge/group-policies/sync-browser-settings-gp.md b/browsers/edge/group-policies/sync-browser-settings-gp.md index 86ed0db6fc..d948b2c862 100644 --- a/browsers/edge/group-policies/sync-browser-settings-gp.md +++ b/browsers/edge/group-policies/sync-browser-settings-gp.md @@ -1,45 +1,48 @@ ---- -title: Microsoft Edge - Sync browser settings -description: By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.date: 10/02/2018 -ms.reviewer: -ms.localizationpriority: medium -ms.topic: reference ---- - -# Sync browser settings - - -By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. You can configure Microsoft Edge to prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. - - -## Relevant policies -- [Do not sync browser settings](#do-not-sync-browser-settings) -- [Prevent users from turning on browser syncing](#prevent-users-from-turning-on-browser-syncing) - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Configuration options - -![Sync browser settings automatically](../images/sync-browser-settings-automatically-sm.png) - -![Prevent syncing of browser settings](../images/prevent-syncing-browser-settings-sm.png) - - -### Verify the configuration -To verify the settings: -1. In the upper-right corner of Microsoft Edge, click **More** \(**...**\). -2. Click **Settings**. -3. Under Account, see if the setting is toggled on or off.

![Verify configuration](../images/sync-settings.PNG) - - -## Do not sync browser settings -[!INCLUDE [do-not-sync-browser-settings-include](../includes/do-not-sync-browser-settings-include.md)] - -## Prevent users from turning on browser syncing -[!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](../includes/prevent-users-to-turn-on-browser-syncing-include.md)] +--- +title: Microsoft Edge - Sync browser settings +description: By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.localizationpriority: medium +ms.topic: reference +--- + +# Sync browser settings + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. You can configure Microsoft Edge to prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. + + +## Relevant policies +- [Do not sync browser settings](#do-not-sync-browser-settings) +- [Prevent users from turning on browser syncing](#prevent-users-from-turning-on-browser-syncing) + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Configuration options + +![Sync browser settings automatically](../images/sync-browser-settings-automatically-sm.png) + +![Prevent syncing of browser settings](../images/prevent-syncing-browser-settings-sm.png) + + +### Verify the configuration +To verify the settings: +1. In the upper-right corner of Microsoft Edge, click **More** \(**...**\). +2. Click **Settings**. +3. Under Account, see if the setting is toggled on or off.

![Verify configuration](../images/sync-settings.png) + + +## Do not sync browser settings +[!INCLUDE [do-not-sync-browser-settings-include](../includes/do-not-sync-browser-settings-include.md)] + +## Prevent users from turning on browser syncing +[!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](../includes/prevent-users-to-turn-on-browser-syncing-include.md)] diff --git a/browsers/edge/group-policies/telemetry-management-gp.md b/browsers/edge/group-policies/telemetry-management-gp.md index 3de0998564..fb3329f960 100644 --- a/browsers/edge/group-policies/telemetry-management-gp.md +++ b/browsers/edge/group-policies/telemetry-management-gp.md @@ -1,31 +1,35 @@ ---- -title: Microsoft Edge - Telemetry and data collection group policies -description: Microsoft Edge gathers diagnostic data, intranet history, internet history, tracking information of sites visited, and Live Tile metadata. You can configure Microsoft Edge to collect all or none of this information. -audience: itpro manager: dansimp -ms.author: eravena -author: eavena -ms.date: 10/02/2018 -ms.reviewer: -ms.localizationpriority: medium -ms.topic: reference ---- - -# Telemetry and data collection - -Microsoft Edge gathers diagnostic data, intranet history, internet history, tracking information of sites visited, and Live Tile metadata. You can configure Microsoft Edge to collect all or none of this information. - -You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** - -## Allow extended telemetry for the Books tab -[!INCLUDE [allow-ext-telemetry-books-tab-include.md](../includes/allow-ext-telemetry-books-tab-include.md)] - -## Configure collection of browsing data for Microsoft 365 Analytics -[!INCLUDE [configure-browser-telemetry-for-m365-analytics-include](../includes/configure-browser-telemetry-for-m365-analytics-include.md)] - -## Configure Do Not Track -[!INCLUDE [configure-do-not-track-include.md](../includes/configure-do-not-track-include.md)] - -## Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start -[!INCLUDE [prevent-live-tile-pinning-start-include](../includes/prevent-live-tile-pinning-start-include.md)] +--- +title: Microsoft Edge - Telemetry and data collection group policies +description: Microsoft Edge gathers diagnostic data, intranet history, internet history, tracking information of sites visited, and Live Tile metadata. You can configure Microsoft Edge to collect all or none of this information. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +ms.localizationpriority: medium +ms.topic: reference +--- + +# Telemetry and data collection + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge gathers diagnostic data, intranet history, internet history, tracking information of sites visited, and Live Tile metadata. You can configure Microsoft Edge to collect all or none of this information. + +You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** + +## Allow extended telemetry for the Books tab +[!INCLUDE [allow-ext-telemetry-books-tab-include.md](../includes/allow-ext-telemetry-books-tab-include.md)] + +## Configure collection of browsing data for Microsoft 365 Analytics +[!INCLUDE [configure-browser-telemetry-for-m365-analytics-include](../includes/configure-browser-telemetry-for-m365-analytics-include.md)] + +## Configure Do Not Track +[!INCLUDE [configure-do-not-track-include.md](../includes/configure-do-not-track-include.md)] + +## Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start +[!INCLUDE [prevent-live-tile-pinning-start-include](../includes/prevent-live-tile-pinning-start-include.md)] diff --git a/browsers/edge/images/allow-smart-screen-validation.PNG b/browsers/edge/images/allow-smart-screen-validation.png similarity index 100% rename from browsers/edge/images/allow-smart-screen-validation.PNG rename to browsers/edge/images/allow-smart-screen-validation.png diff --git a/browsers/edge/images/sync-settings.PNG b/browsers/edge/images/sync-settings.png similarity index 100% rename from browsers/edge/images/sync-settings.PNG rename to browsers/edge/images/sync-settings.png diff --git a/browsers/edge/img-microsoft-edge-infographic-lg.md b/browsers/edge/img-microsoft-edge-infographic-lg.md index 2a2ca7e399..84a79eea55 100644 --- a/browsers/edge/img-microsoft-edge-infographic-lg.md +++ b/browsers/edge/img-microsoft-edge-infographic-lg.md @@ -1,15 +1,18 @@ ---- -description: A full-sized view of the Microsoft Edge infographic. -title: Full-sized view of the Microsoft Edge infographic -ms.date: 11/10/2016 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: eravena -author: eavena ---- - -Return to: [Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md)
-Download image: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/en-us/download/details.aspx?id=53892) - -![Full-sized Microsoft Edge infographic](images/img-microsoft-edge-infographic-lg.png) - +--- +description: A full-sized view of the Microsoft Edge infographic. +title: Full-sized view of the Microsoft Edge infographic +ms.date: 11/10/2016 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +--- + +# Microsoft Edge Infographic + +Return to: [Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md)
+Download image: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/download/details.aspx?id=53892) + +![Full-sized Microsoft Edge infographic](images/img-microsoft-edge-infographic-lg.png) + diff --git a/browsers/edge/includes/configure-autofill-include.md b/browsers/edge/includes/configure-autofill-include.md index 1ef991e263..c67f992071 100644 --- a/browsers/edge/includes/configure-autofill-include.md +++ b/browsers/edge/includes/configure-autofill-include.md @@ -3,7 +3,8 @@ author: eavena ms.author: eravena ms.date: 10/02/2018 ms.reviewer: -audience: itpro manager: dansimp +audience: itpro +manager: dansimp ms.prod: edge ms.topic: include --- @@ -19,8 +20,8 @@ ms.topic: include | Group Policy | MDM | Registry | Description | Most restricted | |---------------------------------|:-----:|:--------:|-----------------------------------|:------------------------------------------------:| | Not configured
**(default)** | Blank | Blank | Users can choose to use Autofill. | | -| Disabled | 0 | no | Prevented. | ![Most restricted value](../images/check-gn.png) | -| Enabled | 1 | yes | Allowed. | | +| Disabled | 0 | 0 | Prevented. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Allowed. | | --- diff --git a/browsers/edge/includes/configure-home-button-include.md b/browsers/edge/includes/configure-home-button-include.md index 3082d3014b..90f6acdac2 100644 --- a/browsers/edge/includes/configure-home-button-include.md +++ b/browsers/edge/includes/configure-home-button-include.md @@ -1,61 +1,59 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/28/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Show home button and load the Start page)* - - -[!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] - - -### Supported values - -| Group Policy | MDM | Registry | Description | -|---------------------------------------------|:---:|:--------:|----------------------------------------------------------------| -| Disabled or not configured
**(default)** | 0 | 0 | Load the Start page. | -| Enabled | 1 | 1 | Load the New Tab page. | -| Enabled | 2 | 2 | Load the custom URL defined in the Set Home Button URL policy. | -| Enabled | 3 | 3 | Hide the home button. | - ---- - - ->[!TIP] ->If you want to make changes to this policy:

  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Home Button -- **GP name:** ConfigureHomeButton -- **GP element:** ConfigureHomeButtonDropdown -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ConfigureHomeButton -- **Value type:** REG_DWORD - -### Related policies - -- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] - -- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] - - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/28/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +> *Supported versions: Microsoft Edge on Windows 10, version 1809*
+> *Default setting: Disabled or not configured (Show home button and load the Start page)* + + +[!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] + + +### Supported values + +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:---:|:--------:|----------------------------------------------------------------| +| Disabled or not configured
**(default)** | 0 | 0 | Load the Start page. | +| Enabled | 1 | 1 | Load the New Tab page. | +| Enabled | 2 | 2 | Load the custom URL defined in the Set Home Button URL policy. | +| Enabled | 3 | 3 | Hide the home button. | + +--- + + +> [!TIP] +> If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
+ +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Home Button +- **GP name:** ConfigureHomeButton +- **GP element:** ConfigureHomeButtonDropdown +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ConfigureHomeButton +- **Value type:** REG_DWORD + +### Related policies + +- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] +- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] + +
diff --git a/browsers/edge/includes/configure-open-edge-with-include.md b/browsers/edge/includes/configure-open-edge-with-include.md index a86cf568ce..273b7fdea4 100644 --- a/browsers/edge/includes/configure-open-edge-with-include.md +++ b/browsers/edge/includes/configure-open-edge-with-include.md @@ -1,68 +1,63 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled (A specific page or pages)* - -[!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] - -**Version 1703 or later:**
If you don't want to send traffic to Microsoft, use the \ value, which honors both domain and non domain-joined devices when it's the only configured URL. - -**version 1809:**
When you enable this policy (Configure Open Microsoft Edge With) and select an option, and also enable the Configure Start Pages policy, Microsoft Edge ignores the Configure Start Page policy.

- -### Supported values - -| Group Policy | MDM | Registry | Description | -|--------------------------|:-----:|:--------:|---------------------------------------------------------------------------------------------------------------------------------------------| -| Not configured | Blank | Blank | If you don't configure this policy and you enable the Disable Lockdown of Start Pages policy, users can change or customize the Start page. | -| Enabled | 0 | 0 | Load the Start page. | -| Enabled | 1 | 1 | Load the New Tab page. | -| Enabled | 2 | 2 | Load the previous pages. | -| Enabled
**(default)** | 3 | 3 | Load a specific page or pages. | - ---- - - ->[!TIP] ->If you want to make changes to this policy:

  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Open Microsoft Edge With -- **GP name:** ConfigureOpenMicrosoftEdgeWith -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureOpenEdgeWith -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ConfigureOpenEdgeWith -- **Value type:** REG_DWORD - -### Related policies - -- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] - -- [Disable lockdown of Start pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] - - - - - ---- +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +> *Supported versions: Microsoft Edge on Windows 10, version 1809*
+> *Default setting: Enabled (A specific page or pages)* + +[!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] + +**Version 1703 or later:**
If you don't want to send traffic to Microsoft, use the \ value, which honors both domain and non domain-joined devices when it's the only configured URL. + +**version 1809:**
When you enable this policy (Configure Open Microsoft Edge With) and select an option, and also enable the Configure Start Pages policy, Microsoft Edge ignores the Configure Start Page policy.

+ +### Supported values + +| Group Policy | MDM | Registry | Description | +|--------------------------|:-----:|:--------:|---------------------------------------------------------------------------------------------------------------------------------------------| +| Not configured | Blank | Blank | If you don't configure this policy and you enable the Disable Lockdown of Start Pages policy, users can change or customize the Start page. | +| Enabled | 0 | 0 | Load the Start page. | +| Enabled | 1 | 1 | Load the New Tab page. | +| Enabled | 2 | 2 | Load the previous pages. | +| Enabled
**(default)** | 3 | 3 | Load a specific page or pages. | + +--- + +> [!TIP] +> If you want to make changes to this policy:

  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
+ + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Open Microsoft Edge With +- **GP name:** ConfigureOpenMicrosoftEdgeWith +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureOpenEdgeWith +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ConfigureOpenEdgeWith +- **Value type:** REG_DWORD + +### Related policies + +- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] +- [Disable lockdown of Start pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] + + +--- diff --git a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md index d86492ba81..375951a25c 100644 --- a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md +++ b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md @@ -1,50 +1,51 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Enabled (Turned on)* - -[!INCLUDE [configure-windows-defender-smartscreen-shortdesc](../shortdesc/configure-windows-defender-smartscreen-shortdesc.md)] - -### Supported values - -| Group Policy | MDM | Registry | Description | Most restricted | -|----------------|:-----:|:--------:|-----------------------------------------------------------------------------------------------|:------------------------------------------------:| -| Not configured | Blank | Blank | Users can choose to use Windows Defender SmartScreen. | | -| Disabled | 0 | 0 | Turned off. Do not protect users from potential threats and prevent users from turning it on. | | -| Enabled | 1 | 1 | Turned on. Protect users from potential threats and prevent users from turning it off. | ![Most restricted value](../images/check-gn.png) | - ---- - -To verify Windows Defender SmartScreen is turned off (disabled): -1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. -2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.PNG) - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Windows Defender SmartScreen -- **GP name:** AllowSmartScreen -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter -- **Value name:** EnabledV9 -- **Value type:** REG_DWORD - -


+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Enabled (Turned on)* + +[!INCLUDE [configure-windows-defender-smartscreen-shortdesc](../shortdesc/configure-windows-defender-smartscreen-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|----------------|:-----:|:--------:|-----------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Not configured | Blank | Blank | Users can choose to use Windows Defender SmartScreen. | | +| Disabled | 0 | 0 | Turned off. Do not protect users from potential threats and prevent users from turning it on. | | +| Enabled | 1 | 1 | Turned on. Protect users from potential threats and prevent users from turning it off. | ![Most restricted value](../images/check-gn.png) | + +--- + +To verify Windows Defender SmartScreen is turned off (disabled): +1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. +2. Verify the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.png) + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Windows Defender SmartScreen +- **GP name:** AllowSmartScreen +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter +- **Value name:** EnabledV9 +- **Value type:** REG_DWORD + +


diff --git a/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md b/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md index d64fe44479..4ec95259a1 100644 --- a/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md +++ b/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md @@ -13,8 +13,8 @@ ms.topic: include By default, all sites open the currently active browser. With this policy, you can automatically open all sites not included in the Enterprise Mode Site List in Microsoft Edge. When you enable this policy, you must also turn on the Internet Explorer\Use the Enterprise Mode IE website list policy and include at least one site in the Enterprise Mode Site List. ->[!NOTE] ->If you’ve also enabled the Microsoft Edge [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11) policy, all intranet sites continue to open in Internet Explorer 11. +> [!NOTE] +> If you’ve also enabled the Microsoft Edge [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11) policy, all intranet sites continue to open in Internet Explorer 11. You can find the group policy settings in the following location of the Group Policy Editor: diff --git a/browsers/edge/includes/prevent-turning-off-required-extensions-include.md b/browsers/edge/includes/prevent-turning-off-required-extensions-include.md index e1a4a50a05..897dc4f9bb 100644 --- a/browsers/edge/includes/prevent-turning-off-required-extensions-include.md +++ b/browsers/edge/includes/prevent-turning-off-required-extensions-include.md @@ -1,59 +1,60 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Allowed)* - -[!INCLUDE [prevent-turning-off-required-extensions-shortdesc](../shortdesc/prevent-turning-off-required-extensions-shortdesc.md)] - -### Supported values - -| Group Policy | Description | -|---------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Disabled or not configured
**(default)** | Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. | -| Enabled | Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office extension prevents users from turning it off:

*Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe*

After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the [Allow Developer Tools](../group-policies/developer-settings-gp.md#allow-developer-tools) policy, then this policy does not prevent users from debugging and altering the logic on an extension. | - ---- - - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent turning off required extensions -- **GP name:** PreventTurningOffRequiredExtensions -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** [Experience/PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventturningoffrequiredextensions) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensions -- **Data type:** String - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Extensions -- **Value name:** PreventTurningOffRequiredExtensions -- **Value type:** REG_SZ - -### Related policies -[Allow Developer Tools](../available-policies.md#allow-developer-tools): [!INCLUDE [allow-developer-tools-shortdesc](../shortdesc/allow-developer-tools-shortdesc.md)] - - -### Related topics - -- [Find a package family name (PFN) for per-app VPN](https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn): There are two ways to find a PFN so that you can configure a per-app VPN. -- [How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/windows-store-for-business): The Microsoft Store for Business gives you a place to find and purchase apps for your organization, individually, or in volume. By connecting the store to Microsoft Intune, you can manage volume-purchased apps from the Azure portal. -- [How to assign apps to groups with Microsoft Intune](https://docs.microsoft.com/intune/apps-deploy): Apps can be assigned to devices whether or not Intune manages them. -- [Manage apps from the Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business): Configuration Manager supports managing Microsoft Store for Business apps on both Windows 10 devices with the Configuration Manager client, and also Windows 10 devices enrolled with Microsoft Intune. -- [How to add Windows line-of-business (LOB) apps to Microsoft Intune](https://docs.microsoft.com/intune/lob-apps-windows): A line-of-business (LOB) app is one that you add from an app installation file. Typically, these types of apps are written in-house. - -


+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Disabled or not configured (Allowed)* + +[!INCLUDE [prevent-turning-off-required-extensions-shortdesc](../shortdesc/prevent-turning-off-required-extensions-shortdesc.md)] + +### Supported values + +| Group Policy | Description | +|---------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Disabled or not configured
**(default)** | Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. | +| Enabled | Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office extension prevents users from turning it off:

*Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe*

After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the [Allow Developer Tools](../group-policies/developer-settings-gp.md#allow-developer-tools) policy, then this policy does not prevent users from debugging and altering the logic on an extension. | + +--- + + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent turning off required extensions +- **GP name:** PreventTurningOffRequiredExtensions +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** [Experience/PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventturningoffrequiredextensions) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensions +- **Data type:** String + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Extensions +- **Value name:** PreventTurningOffRequiredExtensions +- **Value type:** REG_SZ + +### Related policies +[Allow Developer Tools](../available-policies.md#allow-developer-tools): [!INCLUDE [allow-developer-tools-shortdesc](../shortdesc/allow-developer-tools-shortdesc.md)] + + +### Related topics + +- [Find a package family name (PFN) for per-app VPN](https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn): There are two ways to find a PFN so that you can configure a per-app VPN. +- [How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/windows-store-for-business): The Microsoft Store for Business gives you a place to find and purchase apps for your organization, individually, or in volume. By connecting the store to Microsoft Intune, you can manage volume-purchased apps from the Azure portal. +- [How to assign apps to groups with Microsoft Intune](https://docs.microsoft.com/intune/apps-deploy): Apps can be assigned to devices whether or not Intune manages them. +- [Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business): Configuration Manager supports managing Microsoft Store for Business apps on both Windows 10 devices with the Configuration Manager client, and also Windows 10 devices enrolled with Microsoft Intune. +- [How to add Windows line-of-business (LOB) apps to Microsoft Intune](https://docs.microsoft.com/intune/lob-apps-windows): A line-of-business (LOB) app is one that you add from an app installation file. Typically, these types of apps are written in-house. + +


diff --git a/browsers/edge/includes/provision-favorites-include.md b/browsers/edge/includes/provision-favorites-include.md index fdb0016715..739f15e3be 100644 --- a/browsers/edge/includes/provision-favorites-include.md +++ b/browsers/edge/includes/provision-favorites-include.md @@ -1,52 +1,53 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Disabled or not configured (Customizable)* - -[!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] - - ->[!IMPORTANT] ->Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. - -### Supported values - -| Group Policy | Description | Most restricted | -|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| -| Disabled or not configured
**(default)** | Users can customize the favorites list, such as adding folders, or adding and removing favorites. | | -| Enabled | Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file** and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
| ![Most restricted value](../images/check-gn.png) | - ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Provision Favorites -- **GP name:** ConfiguredFavorites -- **GP element:** ConfiguredFavoritesPrompt -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites -- **Data type:** String - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Favorites -- **Value name:** ConfiguredFavorites -- **Value type:** REG_SZ - -### Related policies -[Keep favorites in sync between Internet Explorer and Microsoft Edge](../available-policies.md#keep-favorites-in-sync-between-internet-explorer-and-microsoft-edge): [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +> *Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+> *Default setting: Disabled or not configured (Customizable)* + +[!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] + + +> [!IMPORTANT] +> Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. + +### Supported values + +| Group Policy | Description | Most restricted | +|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | Users can customize the favorites list, such as adding folders, or adding and removing favorites. | | +| Enabled | Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file** and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
| ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Provision Favorites +- **GP name:** ConfiguredFavorites +- **GP element:** ConfiguredFavoritesPrompt +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites +- **Data type:** String + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Favorites +- **Value name:** ConfiguredFavorites +- **Value type:** REG_SZ + +### Related policies +[Keep favorites in sync between Internet Explorer and Microsoft Edge](../available-policies.md#keep-favorites-in-sync-between-internet-explorer-and-microsoft-edge): [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] + +
diff --git a/browsers/edge/includes/send-all-intranet-sites-ie-include.md b/browsers/edge/includes/send-all-intranet-sites-ie-include.md index 2d8195f03e..0f909d31d7 100644 --- a/browsers/edge/includes/send-all-intranet-sites-ie-include.md +++ b/browsers/edge/includes/send-all-intranet-sites-ie-include.md @@ -1,62 +1,63 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled or not configured* - -[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] - ->[!TIP] ->Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. - - -### Supported values - -| Group Policy | MDM | Registry | Description | Most restricted | -|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| -| Disabled or not configured
**(default)** | 0 | 0 | All sites, including intranet sites, open in Microsoft Edge automatically. | ![Most restricted value](../images/check-gn.png) | -| Enabled | 1 | 1 | Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy opens all intranet sites in IE11 automatically, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file**

  2. Click **Enable** and then refresh the policy to view the affected sites in Microsoft Edge.

    A message opens stating that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | - ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Send all intranet sites to Internet Explorer 11 -- **GP name:** SendIntranetTraffictoInternetExplorer -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** SendIntranetTraffictoInternetExplorer -- **Value type:** REG_DWORD - -### Related Policies -- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] - -- [Show message when opening sites in Internet Explorer](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] - - -### Related topics -- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. - -- [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). Learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. - -- [Use the Enterprise Mode Site List Manager](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager). You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +> *Supported versions: Microsoft Edge on Windows 10*
+> *Default setting: Disabled or not configured* + +[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] + +> [!TIP] +> Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. + + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | All sites, including intranet sites, open in Microsoft Edge automatically. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy opens all intranet sites in IE11 automatically, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file**

  2. Click **Enable** and then refresh the policy to view the affected sites in Microsoft Edge.

    A message opens stating that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Send all intranet sites to Internet Explorer 11 +- **GP name:** SendIntranetTraffictoInternetExplorer +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** SendIntranetTraffictoInternetExplorer +- **Value type:** REG_DWORD + +### Related Policies +- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] + +- [Show message when opening sites in Internet Explorer](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] + + +### Related topics +- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. + +- [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). Learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. + +- [Use the Enterprise Mode Site List Manager](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager). You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. + +
diff --git a/browsers/edge/index.yml b/browsers/edge/index.yml index 0afcf97eb7..0533a4dcb2 100644 --- a/browsers/edge/index.yml +++ b/browsers/edge/index.yml @@ -1,163 +1,93 @@ -### YamlMime:YamlDocument +### YamlMime:Landing -documentType: LandingData - -title: Microsoft Edge Group Policy configuration options +title: Microsoft Edge Group Legacy Policy configuration options # < 60 chars +summary: Learn how to deploy and configure group policies in Microsoft Edge Legacy on Windows 10. Some of the features coming to Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. # < 160 chars metadata: - - document_id: - - title: Microsoft Edge Group Policy configuration options - - description: - - text: Learn how to deploy and configure group policies in Microsoft Edge on Windows 10. Some of the features coming to Microsoft Edge gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. - - keywords: Microsoft Edge, Windows 10 - + title: Microsoft Edge Group Legacy Policy configuration options # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. # Required; article description that is displayed in search results. < 160 chars. + ms.prod: microsoft-edge + keywords: Microsoft Edge Legacy, Windows 10 ms.localizationpriority: medium - - author: shortpatti - - ms.author: pashort - - ms.date: 08/09/2018 - - ms.topic: article - - ms.devlang: na - -sections: - -- title: - -- items: - - - type: markdown - - text: Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. - -- items: - - - type: list - - style: cards - - className: cardsE - - columns: 3 - - items: - - - href: https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge - - html:

Learn more about the latest group policies and features added to Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_whats-new.svg - - title: What's new - - - href: https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge - - html:

Learn about the system requirements and language support for Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_overview.svg - - title: System requirements and supported languages - - - href: https://www.microsoft.com/en-us/WindowsForBusiness/Compare - - html:

Learn about the supported features & functionality in each Windows edition.

- - image: - - src: https://docs.microsoft.com/media/common/i_config-tools.svg - - title: Compare Windows 10 Editions - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp - - html:

Learn how Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows.

- - image: - - src: https://docs.microsoft.com/media/common/i_security-management.svg - - title: Security & protection - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp - - html:

Learn how you can use the Enterprise Mode site list for websites and apps that have compatibility problems in Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_management.svg - - title: Interoperability & enterprise guidance - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/index - - html:

Learn about the advanced VPN features you can add to improve the security and availability of your VPN connection.

- - image: - - src: https://docs.microsoft.com/media/common/i_policy.svg - - title: Group policies & configuration options - -- items: - - - type: list - - style: cards - - className: cardsL - - items: - - - title: Microsoft Edge resources - - html:

Minimum system requirements

- -

Supported languages

- -

Document change history

- -

Compare Windows 10 Editions

- -

Microsoft Edge Dev blog

- -

Microsoft Edge Dev on Twitter

- -

Microsoft Edge changelog

- -

Measuring the impact of Microsoft Edge

- - - title: IE11 resources - - html:

Deploy Internet Explorer 11 (IE11) - IT Pros

- -

Internet Explorer Administration Kit 11 (IEAK 11)

- -

Download Internet Explorer 11

- - - title: Additional resources - - html:

Group Policy and the Group Policy Management Console (GPMC)

- -

Group Policy and the Local Group Policy Editor

- -

Group Policy and the Advanced Group Policy Management (AGPM)

- -

Group Policy and Windows PowerShell

- - - - - - + ms.topic: landing-page # Required + ms.collection: collection # Optional; Remove if no collection is used. + author: shortpatti #Required; your GitHub user alias, with correct capitalization. + ms.author: pashort #Required; microsoft alias of author; optional team alias. + ms.date: 07/07/2020 #Required; mm/dd/yyyy format. + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: About Microsoft Edge + linkLists: + - linkListType: whats-new + links: + - text: Documentation for Microsoft Edge version 77 or later + url: /DeployEdge + - text: Microsoft 365 apps say farewell to Internet Explorer 11 and Windows 10 sunsets Microsoft Edge Legacy + url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 + - text: Latest group policies and features added to Microsoft Edge + url: /microsoft-edge/deploy/change-history-for-microsoft-edge + - linkListType: overview + links: + - text: System requirements and supported languages + url: /microsoft-edge/deploy/about-microsoft-edge + - text: Compare Windows 10 editions + url: https://www.microsoft.com/en-us/WindowsForBusiness/Compare + - text: Security & protection + url: /microsoft-edge/deploy/group-policies/security-privacy-management-gp + - text: Interoperability & enterprise guidance + url: /microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp + - text: Group policies & configuration options + url: /microsoft-edge/deploy/group-policies/ + + # Card (optional) + - title: Microsoft Edge resources + linkLists: + - linkListType: overview + links: + - text: Minimum system requirements + url: /microsoft-edge/deploy/about-microsoft-edge#minimum-system-requirements + - text: Supported languages + url: /microsoft-edge/deploy/about-microsoft-edge#supported-languages + - text: Document change history + url: /microsoft-edge/deploy/change-history-for-microsoft-edge + - text: Microsoft Edge Dev blog + url: https://blogs.windows.com/msedgedev + - text: Microsoft Edge Dev on Twitter + url: /microsoft-edge/deploy/about-microsoft-edge#supported-languages + - text: Microsoft Edge changelog + url: /microsoft-edge/deploy/change-history-for-microsoft-edge + - text: Measuring the impact of Microsoft Edge + url: https://blogs.windows.com/msedgedev + + # Card (optional) + - title: IE11 resources + linkLists: + - linkListType: overview + links: + - text: Deploy Internet Explorer 11 (IE11) - IT Pros + url: https://go.microsoft.com/fwlink/p/?LinkId=760644 + - text: Internet Explorer Administration Kit 11 (IEAK 11) + url: /internet-explorer/ie11-ieak + - linkListType: download + links: + - text: Download Internet Explorer 11 + url: https://go.microsoft.com/fwlink/p/?linkid=290956 + + # Card (optional) + - title: Additional resources + linkLists: + - linkListType: overview + links: + - text: Group Policy and the Group Policy Management Console (GPMC) + url: https://go.microsoft.com/fwlink/p/?LinkId=617921 + - text: Group Policy and the Local Group Policy Editor + url: https://go.microsoft.com/fwlink/p/?LinkId=617922 + - text: Group Policy and the Advanced Group Policy Management (AGPM) + url: https://go.microsoft.com/fwlink/p/?LinkId=617923 + - text: Group Policy and Windows PowerShell + url: https://go.microsoft.com/fwlink/p/?LinkId=617924 diff --git a/browsers/edge/managing-group-policy-admx-files.md b/browsers/edge/managing-group-policy-admx-files.md index f749992d29..11dede91d3 100644 --- a/browsers/edge/managing-group-policy-admx-files.md +++ b/browsers/edge/managing-group-policy-admx-files.md @@ -1,26 +1,27 @@ ---- -title: Managing group policy ADMX files -description: Learn how to centrally administer and incorporate ADMX files when editing the administrative template policy settings inside a local or domain-based Group Policy object. -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.prod: edge -ms.sitesec: library -ms.localizationpriority: medium -ms.date: 10/19/2018 ---- - -# Managing group policy ADMX files - ->Applies to: Microsoft Edge on Windows 10 - -ADMX files, which are registry-based policy settings provide an XML-based structure for defining the display of the Administrative Template policy settings in the Group Policy Object Editor. The ADMX files replace ADM files, which used a different markup language. - ->[!NOTE] ->The administrative tools you use—Group Policy Object Editor and Group Policy Management Console—remain mostly unchanged. In the majority of situations, you won’t notice the presence of ADMX files during your day-to-day Group Policy administration tasks. - -Unlike ADM files, ADMX files are not stored in individual GPOs by default; however, this behavior supports less common scenarios. For domain-based enterprises, you can create a central store location of ADMX files accessible by anyone with permission to create or edit GPOs. Group Policy tools continue to recognize other earlier ADM files you have in your existing environment. The Group Policy Object Editor automatically reads and displays Administrative Template policy settings from both the ADMX and ADM files. - -Some situations require a better understanding of how ADMX files are structured and the location of the files. In this article, we show you how ADMX files are incorporated when editing Administrative Template policy settings in a local or domain-based Group Policy object (GPO). +--- +title: Managing group policy ADMX files +description: Learn how to centrally administer and incorporate ADMX files when editing the administrative template policy settings inside a local or domain-based Group Policy object. +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.prod: edge +ms.sitesec: library +ms.localizationpriority: medium +ms.date: 10/19/2018 +--- + +# Managing group policy ADMX files + +>Applies to: Microsoft Edge on Windows 10 + +ADMX files, which are registry-based policy settings provide an XML-based structure for defining the display of the Administrative Template policy settings in the Group Policy Object Editor. The ADMX files replace ADM files, which used a different markup language. + +> [!NOTE] +> The administrative tools you use—Group Policy Object Editor and Group Policy Management Console—remain mostly unchanged. In the majority of situations, you won’t notice the presence of ADMX files during your day-to-day Group Policy administration tasks. + +Unlike ADM files, ADMX files are not stored in individual GPOs by default; however, this behavior supports less common scenarios. For domain-based enterprises, you can create a central store location of ADMX files accessible by anyone with permission to create or edit GPOs. Group Policy tools continue to recognize other earlier ADM files you have in your existing environment. The Group Policy Object Editor automatically reads and displays Administrative Template policy settings from both the ADMX and ADM files. + +Some situations require a better understanding of how ADMX files are structured and the location of the files. In this article, we show you how ADMX files are incorporated when editing Administrative Template policy settings in a local or domain-based Group Policy object (GPO). diff --git a/browsers/edge/microsoft-edge-faq.md b/browsers/edge/microsoft-edge-faq.md deleted file mode 100644 index e73d7bb1a6..0000000000 --- a/browsers/edge/microsoft-edge-faq.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros -ms.reviewer: -audience: itpro manager: dansimp -description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. -author: msdmaguire -ms.author: dmaguire -ms.prod: edge -ms.topic: article -ms.mktglfcycl: general -ms.sitesec: library -ms.localizationpriority: medium ---- - -# Frequently Asked Questions (FAQs) for IT Pros - ->Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile - -## How can I get the next major version of Microsoft Edge, based on Chromium? -In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). - -## What’s the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? -Microsoft Edge is the default browser for all Windows 10 devices. It’s built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. - -For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). - -## Does Microsoft Edge work with Enterprise Mode? -[Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. - -## How do I customize Microsoft Edge and related settings for my organization? -You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/) for a list of policies currently available for Microsoft Edge and configuration information. Note that the preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. - -## Is Adobe Flash supported in Microsoft Edge? -Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we’ve started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](https://docs.microsoft.com/microsoft-edge/deploy/available-policies#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. - -To learn more about Microsoft’s plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). - -## Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? -No. Microsoft Edge doesn’t support ActiveX controls and BHOs like Silverlight or Java. If you’re running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and standards support. - -## How often will Microsoft Edge be updated? -In Windows 10, we’re delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. - -## How can I provide feedback on Microsoft Edge? -Microsoft Edge is an evergreen browser - we’ll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. - -## Will Internet Explorer 11 continue to receive updates? -We’re committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it’s installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. - -## How do I find out what version of Microsoft Edge I have? -In the upper right corner of Microsoft Edge, click the ellipses icon (**...**), and then click **Settings**. Look in the **About Microsoft Edge** section to find your version. - -## What is Microsoft EdgeHTML? -Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform. (As opposed to *Microsoft Edge, based on Chromium*.) diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml new file mode 100644 index 0000000000..751f40f4ea --- /dev/null +++ b/browsers/edge/microsoft-edge-faq.yml @@ -0,0 +1,74 @@ +### YamlMime:FAQ +metadata: + title: Microsoft Edge - Frequently Asked Questions (FAQ) for IT Pros + ms.reviewer: + audience: itpro + manager: dansimp + description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. + author: dansimp + ms.author: dansimp + ms.prod: edge + ms.topic: article + ms.mktglfcycl: general + ms.sitesec: library + ms.localizationpriority: medium + +title: Frequently Asked Questions (FAQ) for IT Pros +summary: | + Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile + + > [!NOTE] + > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + + +sections: + - name: Ignored + questions: + - question: How can I get the next major version of Microsoft Edge, based on Chromium? + answer: | + In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). + + - question: What's the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? + answer: | + Microsoft Edge is the default browser for all Windows 10 devices. It's built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. + + For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). + + - question: Does Microsoft Edge work with Enterprise Mode? + answer: | + [Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. + + - question: How do I customize Microsoft Edge and related settings for my organization? + answer: | + You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/) for a list of policies currently available for Microsoft Edge and configuration information. Note that the preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. + + - question: Is Adobe Flash supported in Microsoft Edge? + answer: | + Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we've started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](https://docs.microsoft.com/microsoft-edge/deploy/available-policies#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. + + To learn more about Microsoft's plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). + + - question: Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? + answer: | + No, Microsoft Edge doesn't support ActiveX controls and Browser Helper Objects (BHOs) like Silverlight or Java. If you're running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in Internet Explorer 11. Internet Explorer 11 offers additional security, manageability, performance, backward compatibility, and standards support. + + - question: How often will Microsoft Edge be updated? + answer: | + In Windows 10, we're delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. + + - question: How can I provide feedback on Microsoft Edge? + answer: | + Microsoft Edge is an evergreen browser - we'll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. + + - question: Will Internet Explorer 11 continue to receive updates? + answer: | + We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. + + - question: How do I find out which version of Microsoft Edge I have? + answer: | + In the upper-right corner of Microsoft Edge, select the ellipses icon (**...**), and then select **Settings**. Look in the **About Microsoft Edge** section to find your version. + + - question: What is Microsoft EdgeHTML? + answer: | + Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform (as opposed to *Microsoft Edge, based on Chromium*). + diff --git a/browsers/edge/microsoft-edge-forrester.md b/browsers/edge/microsoft-edge-forrester.md index 2407ccef53..23c3505440 100644 --- a/browsers/edge/microsoft-edge-forrester.md +++ b/browsers/edge/microsoft-edge-forrester.md @@ -1,36 +1,37 @@ ---- -title: Forrester Total Economic Impact - Microsoft Edge -ms.reviewer: -audience: itpro manager: dansimp -description: Review the results of the Microsoft Edge study carried out by Forrester Research -ms.prod: edge -ms.topic: article -author: msdmaguire -ms.author: dmaguire -ms.localizationpriority: high ---- -# Measuring the impact of Microsoft Edge - Total Economic Impact (TEI) of Microsoft Edge - -Forrester Research measures the return on investment (ROI) of Microsoft Edge in its latest TEI report and survey. Browse and download these free resources to learn about the impact Microsoft Edge can have in your organization, including significant cost savings in reduced browser help desk tickets and improved browser security, to increased speed, performance, and user productivity. - -## Forrester report video summary -View a brief overview of the Forrester TEI case study that Microsoft commissioned to examine the value your organization can achieve by utilizing Microsoft Edge: - -> ![VIDEO ] - -## Forrester Study report - -Forrester interviewed several customers with more than six months of experience using Microsoft Edge – all customers reported improvements in browser security, increased user productivity, and efficiencies gained in supporting the software. - -[Download the full report](https://www.microsoft.com/download/details.aspx?id=55847) - -## Forrester Study report infographic -Get a graphical summary of the TEI of Microsoft Edge Forrester Study report and highlights of the three-year financial impact of Microsoft Edge. - -[Download the report infographic](https://www.microsoft.com/download/details.aspx?id=55956) - -## Forrester survey infographic - -Forrester surveyed 168 customers using Microsoft Edge form the US, Germany, UK, and Japan, ranging in size from 500 to over 100,000 employees. This document is an abridged version of this survey commissioned by Microsoft and delivery by Forrester consulting. - -[Download the survey infographic](https://www.microsoft.com/download/details.aspx?id=53892) +--- +title: Forrester Total Economic Impact - Microsoft Edge +ms.reviewer: +audience: itpro +manager: dansimp +description: Review the results of the Microsoft Edge study carried out by Forrester Research +ms.prod: edge +ms.topic: article +author: dansimp +ms.author: dansimp +ms.localizationpriority: high +--- +# Measuring the impact of Microsoft Edge - Total Economic Impact (TEI) of Microsoft Edge + +Forrester Research measures the return on investment (ROI) of Microsoft Edge in its latest TEI report and survey. Browse and download these free resources to learn about the impact Microsoft Edge can have in your organization, including significant cost savings in reduced browser help desk tickets and improved browser security, to increased speed, performance, and user productivity. + +## Forrester report video summary +View a brief overview of the Forrester TEI case study that Microsoft commissioned to examine the value your organization can achieve by utilizing Microsoft Edge: + +> ![VIDEO ] + +## Forrester Study report + +Forrester interviewed several customers with more than six months of experience using Microsoft Edge – all customers reported improvements in browser security, increased user productivity, and efficiencies gained in supporting the software. + +[Download the full report](https://www.microsoft.com/download/details.aspx?id=55847) + +## Forrester Study report infographic +Get a graphical summary of the TEI of Microsoft Edge Forrester Study report and highlights of the three-year financial impact of Microsoft Edge. + +[Download the report infographic](https://www.microsoft.com/download/details.aspx?id=55956) + +## Forrester survey infographic + +Forrester surveyed 168 customers using Microsoft Edge form the US, Germany, UK, and Japan, ranging in size from 500 to over 100,000 employees. This document is an abridged version of this survey commissioned by Microsoft and delivery by Forrester consulting. + +[Download the survey infographic](https://www.microsoft.com/download/details.aspx?id=53892) diff --git a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md index 9781a1de92..d906bfc6ce 100644 --- a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md +++ b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md @@ -1,36 +1,45 @@ --- -title: Deploy Microsoft Edge kiosk mode -description: Microsoft Edge kiosk mode works with assigned access to allow IT admins to create a tailored browsing experience designed for kiosk devices. To use Microsoft Edge kiosk mode, you must configure Microsoft Edge as an application in assigned access. -ms.assetid: -ms.reviewer: +title: Deploy Microsoft Edge Legacy kiosk mode +description: Microsoft Edge Legacy kiosk mode works with assigned access to allow IT admins to create a tailored browsing experience designed for kiosk devices. To use Microsoft Edge Legacy kiosk mode, you must configure Microsoft Edge Legacy as an application in assigned access. +ms.assetid: +ms.reviewer: audience: itpro manager: dansimp -author: eavena -ms.author: eravena +author: dansimp +ms.author: dansimp ms.prod: edge ms.sitesec: library ms.topic: article ms.localizationpriority: medium -ms.date: 10/29/2018 +ms.date: 01/17/2020 --- -# Deploy Microsoft Edge kiosk mode +# Deploy Microsoft Edge Legacy kiosk mode +> [!IMPORTANT] +> Microsoft 365 apps and services will not support Internet Explorer 11 starting August 17, 2021 (Microsoft Teams will not support Internet Explorer 11 earlier, starting November 30, 2020). [Learn more](https://aka.ms/AA97tsw). Please note that Internet Explorer 11 will remain a supported browser. Internet Explorer 11 is a component of the Windows operating system and [follows the Lifecycle Policy](https://docs.microsoft.com/lifecycle/faq/internet-explorer-microsoft-edge) for the product on which it is installed. ->Applies to: Microsoft Edge on Windows 10, version 1809 ->Professional, Enterprise, and Education +> Applies to: Microsoft Edge Legacy (version 45 and earlier) on Windows 10, version 1809 or later +> Professional, Enterprise, and Education -In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge in kiosk mode. +> [!NOTE] +> You've reached the documentation for Microsoft Edge Legacy (version 45 and earlier.) To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). For information about kiosk mode in the new version of Microsoft Edge, see [Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-kiosk-mode). -In this topic, you learn how to configure the behavior of Microsoft Edge when it's running in kiosk mode with assigned access. You also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or other MDM service. +In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge Legacy as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge Legacy in kiosk mode. -At the end of this topic, you can find a list of [supported policies](#supported-policies-for-kiosk-mode) for kiosk mode and a [feature comparison](#feature-comparison-of-kiosk-mode-and-kiosk-browser-app) of the kiosk mode policy and kiosk browser app. You also find instructions on how to provide us feedback or get support. +In this topic, you'll learn: + +- How to configure the behavior of Microsoft Edge Legacy when it's running in kiosk mode with assigned access. +- What's required to run Microsoft Edge Legacy kiosk mode on your kiosk devices. +- You'll also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or an other MDM service. + +At the end of this topic, you can find a list of [supported policies](#supported-policies-for-kiosk-mode) for kiosk mode and a [feature comparison](#feature-comparison-of-kiosk-mode-and-kiosk-browser-app) of the kiosk mode policy and kiosk browser app. You also find instructions on how to provide us feedback or get support. ## Kiosk mode configuration types ->**Policy** = Configure kiosk mode (ConfigureKioskMode) +> **Policy** = Configure kiosk mode (ConfigureKioskMode) -Microsoft Edge kiosk mode supports four configurations types that depend on how Microsoft Edge is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. +Microsoft Edge Legacy kiosk mode supports four configurations types that depend on how Microsoft Edge Legacy is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. - Learn about [creating a kiosk experience](https://docs.microsoft.com/windows-hardware/customize/enterprise/create-a-kiosk-image) @@ -41,15 +50,17 @@ Microsoft Edge kiosk mode supports four configurations types that depend on how - Learn about configuring a more secure kiosk experience: [Other settings to lock down](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#other-settings-to-lock-down). -### Important things to remember before getting started +### Important things to note before getting started -- The public browsing kiosk types run Microsoft Edge InPrivate mode to protect user data with a browsing experience designed for public kiosks. +- There are [required steps to follow](#setup- required-for-microsoft-edge-legacy-kiosk-mode) in order to use the following Microsoft Edge Legacy kiosk mode types either alongside the new version of Microsoft Edge or prevent the new version of Microsoft Edge from being installed on your kiosk device. -- Microsoft Edge kiosk mode has a built-in timer to help keep data safe in public browsing sessions. When the idle time (no user activity) meets the time limit, a confirmation message prompts the user to continue, and if no user activity Microsoft Edge resets the session to the default URL. By default, the idle timer is 5 minutes, but you can choose a value of your own. +- The public browsing kiosk types run Microsoft Edge Legacy InPrivate mode to protect user data with a browsing experience designed for public kiosks. + +- Microsoft Edge Legacy kiosk mode has a built-in timer to help keep data safe in public browsing sessions. When the idle time (no user activity) meets the time limit, a confirmation message prompts the user to continue, and if no user activity Microsoft Edge Legacy resets the session to the default URL. By default, the idle timer is 5 minutes, but you can choose a value of your own. - Optionally, you can define a single URL for the Home button, Start page, and New Tab page. See [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode) to learn more. -- No matter which configuration type you choose, you must set up Microsoft Edge in assigned access; otherwise, Microsoft Edge ignores the settings in this policy (Configure kiosk mode/ConfigureKioskMode).

Learn more about assigned access: +- No matter which configuration type you choose, you must set up Microsoft Edge Legacy in assigned access; otherwise, Microsoft Edge Legacy ignores the settings in this policy (Configure kiosk mode/ConfigureKioskMode).

Learn more about assigned access: - [Configure kiosk and shared devices running Windows desktop editions](https://aka.ms/E489vw). @@ -58,36 +69,48 @@ Microsoft Edge kiosk mode supports four configurations types that depend on how - [Guidelines for choosing an app for assigned access (kiosk mode)](https://aka.ms/Ul7dw3). -### Supported configuration types +### Supported configuration types [!INCLUDE [configure-kiosk-mode-supported-values-include](includes/configure-kiosk-mode-supported-values-include.md)] -## Set up Microsoft Edge kiosk mode +## Set up Microsoft Edge Legacy kiosk mode -Now that you're familiar with the different kiosk mode configurations and have the one you want to use in mind, you can use one of the following methods to set up Microsoft Edge kiosk mode: +Now that you're familiar with the different kiosk mode configurations and have the one you want to use in mind, you can use one of the following methods to set up Microsoft Edge Legacy kiosk mode: -- **Windows Settings.** Use only to set up a couple of single-app devices because you perform these steps physically on each device. For a multi-app kiosk device, use Microsoft Intune or other MDM service. +- **Windows Settings.** Use only to set up a couple of single-app devices because you perform these steps physically on each device. For a multi-app kiosk device, use Microsoft Intune or other MDM service. -- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). +- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge Legacy kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). ### Prerequisites -- Microsoft Edge on Windows 10, version 1809 (Professional, Enterprise, and Education). +- Microsoft Edge Legacy on Windows 10, version 1809 (Professional, Enterprise, and Education). + +- See [Setup required for Microsoft Edge Legacy kiosk mode](#setup-required-for-microsoft-edge-legacy-kiosk-mode). - URL to load when the kiosk launches. The URL that you provide sets the Home button, Start page, and New Tab page. -- _**For Microsoft Intune or other MDM service**_, you must have the AppUserModelID (AUMID) to set up Microsoft Edge: - +- _**For Microsoft Intune or other MDM service**_, you must have the AppUserModelID (AUMID) to set up Microsoft Edge Legacy: + ``` Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge ``` +### Setup required for Microsoft Edge Legacy kiosk mode + +When the new version of Microsoft Edge Stable channel is installed, Microsoft Edge Legacy is hidden and all attempts to launch Microsoft Edge Legacy are redirected to the new version of Microsoft Edge. + +To continue using Microsoft Edge Legacy kiosk mode on your kiosk devices take one of the following actions: + +- If you plan to install Microsoft Edge Stable channel, want to allow it to be installed, or it is already installed on your kiosk device set the Microsoft Edge [Allow Microsoft Edge Side by Side browser experience](https://docs.microsoft.com/DeployEdge/microsoft-edge-update-policies#allowsxs) policy to **Enabled**. +- To prevent Microsoft Edge Stable channel from being installed on your kiosk devices deploy the Microsoft Edge [Allow installation default](https://docs.microsoft.com/DeployEdge/microsoft-edge-update-policies#installdefault) policy for Stable channel or consider using the [Blocker toolkit](https://docs.microsoft.com/DeployEdge/microsoft-edge-blocker-toolkit) to disable automatic delivery of Microsoft Edge. + +> [!NOTE] +> For more information about accessing Microsoft Edge Legacy after installing Microsoft Edge, see [How to access the old version of Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-sysupdate-access-old-edge). ### Use Windows Settings -Windows Settings is the simplest and the only way to set up one or a couple of single-app devices. - +Windows Settings is the simplest and the only way to set up one or a couple of single-app devices. 1. On the kiosk device, open Windows Settings, and in the search field type **kiosk** and then select **Set up a kiosk (assigned access)**. @@ -95,13 +118,13 @@ Windows Settings is the simplest and the only way to set up one or a couple of s 3. Type a name to create a new kiosk account, or choose an existing account from the populated list and click **Next**. -4. On the **Choose a kiosk app** page, select **Microsoft Edge** and then click **Next**. +4. On the **Choose a kiosk app** page, select **Microsoft Edge Legacy** and then click **Next**. -5. Select how Microsoft Edge displays when running in kiosk mode: +5. Select how Microsoft Edge Legacy displays when running in kiosk mode: - - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data. + - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge Legacy InPrivate protecting user data. - - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge, protecting user data. + - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge Legacy, protecting user data. 6. Select **Next**. @@ -115,48 +138,48 @@ Windows Settings is the simplest and the only way to set up one or a couple of s 11. Restart the kiosk device and sign in with the local kiosk account to validate the configuration. -**_Congratulations!_**

You’ve just finished setting up a single-app kiosk device using Windows Settings. +**_Congratulations!_**

You’ve just finished setting up a single-app kiosk device using Windows Settings. -**_What's next?_** +**_What's next?_** - User your new kiosk device.

OR

-- Make changes to your kiosk device. In Windows Settings, on the **Set up a kiosk** page, make your changes to **Choose a kiosk mode** and **Set up Microsoft Edge**. +- Make changes to your kiosk device. In Windows Settings, on the **Set up a kiosk** page, make your changes to **Choose a kiosk mode** and **Set up Microsoft Edge Legacy**. ---- +--- ### Use Microsoft Intune or other MDM service -With this method, you can use Microsoft Intune or other MDM services to configure Microsoft Edge kiosk mode in assigned access and how it behaves on a kiosk device. To learn about a few app fundamentals and requirements before adding them to Intune, see [Add apps to Microsoft Intune](https://docs.microsoft.com/intune/apps-add). +With this method, you can use Microsoft Intune or other MDM services to configure Microsoft Edge Legacy kiosk mode in assigned access and how it behaves on a kiosk device. To learn about a few app fundamentals and requirements before adding them to Intune, see [Add apps to Microsoft Intune](https://docs.microsoft.com/intune/apps-add). ->[!IMPORTANT] ->If you are using a local account as a kiosk account in Microsoft Intune, make sure to sign into this account and then sign out before configuring the kiosk device. +> [!IMPORTANT] +> If you are using a local account as a kiosk account in Microsoft Intune, make sure to sign into this account and then sign out before configuring the kiosk device. 1. In Microsoft Intune or other MDM service, configure [AssignedAccess](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to prevent users from accessing the file system, running executables, or other apps. -2. Configure the following MDM settings to setup Microsoft Edge kiosk mode on the kiosk device and then restart the device. +2. Configure the following MDM settings to setup Microsoft Edge Legacy kiosk mode on the kiosk device and then restart the device. | | | |---|---| - | **[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)**

![](images/icon-thin-line-computer.png) | Configure the display mode for Microsoft Edge as a kiosk app.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode

**Data type:** Integer

**Allowed values:**

  • **Single-app kiosk experience**
    • **0** - Digital signage and interactive display
    • **1** - InPrivate Public browsing
  • **Multi-app kiosk experience**
    • **0** - Normal Microsoft Edge running in assigned access
    • **1** - InPrivate public browsing with other apps
| - | **[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)**

![](images/icon-thin-line-computer.png) | Change the time in minutes from the last user activity before Microsoft Edge kiosk mode resets the user's session.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout

**Data type:** Integer

**Allowed values:**

  • **0** - No idle timer
  • **1-1440 (5 minutes is the default)** - Set reset on idle timer
| - | **[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages)**

![](images/icon-thin-line-computer.png) | Set one or more start pages, URLs, to load when Microsoft Edge launches.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages

**Data type:** String

**Allowed values:**

Enter one or more URLs, for example,
   \\ | + | **[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)**

![](images/icon-thin-line-computer.png) | Configure the display mode for Microsoft Edge Legacy as a kiosk app.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode

**Data type:** Integer

**Allowed values:**

  • **Single-app kiosk experience**
    • **0** - Digital signage and interactive display
    • **1** - InPrivate Public browsing
  • **Multi-app kiosk experience**
    • **0** - Normal Microsoft Edge Legacy running in assigned access
    • **1** - InPrivate public browsing with other apps
| + | **[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)**

![](images/icon-thin-line-computer.png) | Change the time in minutes from the last user activity before Microsoft Edge Legacy kiosk mode resets the user's session.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout

**Data type:** Integer

**Allowed values:**

  • **0** - No idle timer
  • **1-1440 (5 minutes is the default)** - Set reset on idle timer
| + | **[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages)**

![](images/icon-thin-line-computer.png) | Set one or more start pages, URLs, to load when Microsoft Edge Legacy launches.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages

**Data type:** String

**Allowed values:**

Enter one or more URLs, for example,
   \\ | | **[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)**

![](images/icon-thin-line-computer.png) | Configure how the Home Button behaves.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton

**Data type:** Integer

**Allowed values:**

  • **0 (default)** - Not configured. Show home button, and load the default Start page.
  • **1** - Enabled. Show home button and load New Tab page
  • **2** - Enabled. Show home button & set a specific page.
  • **3** - Enabled. Hide the home button.
| | **[SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)**

![](images/icon-thin-line-computer.png) | If you set ConfigureHomeButton to 2, configure the home button URL.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.bing.com | | **[SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)**

![](images/icon-thin-line-computer.png) | Set a custom URL for the New Tab page.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.msn.com | - -**_Congratulations!_**

You’ve just finished setting up a kiosk or digital signage with policies for Microsoft Edge kiosk mode using Microsoft Intune or other MDM service. -**_What's next?_**

Now it's time to use your new kiosk device. Sign into the device with the kiosk account selected to run Microsoft Edge kiosk mode. +**_Congratulations!_**

You’ve just finished setting up a kiosk or digital signage with policies for Microsoft Edge Legacy kiosk mode using Microsoft Intune or other MDM service. + +**_What's next?_**

Now it's time to use your new kiosk device. Sign into the device with the kiosk account selected to run Microsoft Edge Legacy kiosk mode. --- ## Supported policies for kiosk mode -Use any of the Microsoft Edge policies listed below to enhance the kiosk experience depending on the Microsoft Edge kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). +Use any of the Microsoft Edge Legacy policies listed below to enhance the kiosk experience depending on the Microsoft Edge Legacy kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). Make sure to check with your provider for instructions. @@ -230,17 +253,18 @@ Make sure to check with your provider for instructions.        ![Not supported](images/148766.png) = Not applicable or not supported
       ![Supported](images/148767.png) = Supported ---- +--- ## Feature comparison of kiosk mode and kiosk browser app -In the following table, we show you the features available in both Microsoft Edge kiosk mode and Kiosk Browser app available in Microsoft Store. Both kiosk mode and kiosk browser app work in assigned access. + +In the following table, we show you the features available in both Microsoft Edge Legacy kiosk mode and Kiosk Browser app available in Microsoft Store. Both kiosk mode and kiosk browser app work in assigned access. -| **Feature** | **Microsoft Edge kiosk mode** | **Microsoft Kiosk browser app** | +| **Feature** | **Microsoft Edge Legacy kiosk mode** | **Microsoft Kiosk browser app** | |-----------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------:| | Print support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | | Multi-tab support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Allow/Block URL support | ![Supported](images/148767.png)

*\*For Microsoft Edge kiosk mode use* Windows Defender Firewall. Microsoft kiosk browser has custom policy support. | ![Supported](images/148767.png) | +| Allow/Block URL support | ![Not Supported](images/148766.png) | ![Supported](images/148767.png) | | Configure Home Button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | | Set Start page(s) URL | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*Same as Home button URL* | | Set New Tab page URL | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | @@ -252,15 +276,12 @@ In the following table, we show you the features available in both Microsoft Edg | SKU availability | Windows 10 October 2018 Update
Professional, Enterprise, and Education | Windows 10 April 2018 Update
Professional, Enterprise, and Education | **\*Windows Defender Firewall**

-To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both. For more details, see [Windows Defender Firewall with Advanced Security Deployment](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide). +To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both, using IP addresses. For more details, see [Windows Defender Firewall with Advanced Security Deployment Guide](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide). --- ## Provide feedback or get support -To provide feedback on Microsoft Edge kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. +To provide feedback on Microsoft Edge Legacy kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. **_For multi-app kiosk only._** If you have set up the Feedback Hub in assigned access, you can you submit the feedback from the device running Microsoft Edge in kiosk mode in which you can include diagnostic logs. In the Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. - - - diff --git a/browsers/edge/microsoft-edge.yml b/browsers/edge/microsoft-edge.yml index 341292cab7..797d881911 100644 --- a/browsers/edge/microsoft-edge.yml +++ b/browsers/edge/microsoft-edge.yml @@ -1,61 +1,144 @@ -### YamlMime:YamlDocument +### YamlMime:Landing + +title: Microsoft Edge Legacy # < 60 chars +summary: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # < 160 chars -documentType: LandingData -title: Microsoft Edge metadata: - document_id: - title: Microsoft Edge - description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. + title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars. keywords: Microsoft Edge, issues, fixes, announcements, Windows Server, advisories + ms.prod: edge ms.localizationpriority: medium author: lizap ms.author: elizapo manager: dougkim - ms.topic: article + ms.topic: landing-page ms.devlang: na + ms.date: 08/19/2020 #Required; mm/dd/yyyy format. -sections: -- items: - - type: markdown - text: " - Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. - " -- title: What's new -- items: - - type: markdown - text: " - Find out the latest and greatest news on Microsoft Edge.
- -

**The latest in Microsoft Edge**
See what's new for users and developers in the next update to Microsoft Edge - now available with the Windows 10 April 2018 update!
Find out more

**Evaluate the impact**
Review the latest Forrester Total Economic Impact (TEI) report to learn about the impact Microsoft Edge can have in your organization.
Download the reports

**Microsoft Edge for iOS and Android**
Microsoft Edge brings familiar features across your PC and phone, which allows browsing to go with you, no matter what device you use.
Learn more

**Application Guard**
Microsoft Edge with Windows Defender Application Guard is the most secure browser on Windows 10 Enterprise.
Learn more
- " -- title: Compatibility -- items: - - type: markdown - text: " - Even if you still have legacy apps in your organization, you can default to the secure, modern experience of Microsoft Edge and provide a consistent level of compatibility with existing legacy applications.
- -

**Test your site on Microsoft Edge**
Test your site on Microsoft Edge for free instantly, with remote browser testing powered by BrowserStack. You can also use the linting tool sonarwhal to assess your site's accessibility, speed, security, and more.
Test your site on Microsoft Edge for free on BrowserStack
Use sonarwhal to improve your website.

**Improve compatibility with Enterprise Mode**
With Enterprise Mode you can use Microsoft Edge as your default browser, while ensuring apps continue working on IE11.
Use Enterprise mode to improve compatibility
Turn on Enterprise Mode and use a site list
Enterprise Site List Portal
Ultimate browser strategy on Windows 10

**Web Application Compatibility Lab Kit**
The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge.
Find out more
- " -- title: Security -- items: - - type: markdown - text: " - Microsoft Edge uses Windows Hello and SmartScreen to defend against phishing and malware. Take a look at some of the additional features behind the strong defense that Microsoft Edge provides against web-based attacks.
- -

**NSS Labs web browser security reports**
See the results of two global tests measuring how effective browsers are at protecting against socially engineered malware and phishing attacks.
Download the reports

**Microsoft Edge sandbox**
See how Microsoft Edge has significantly reduced the attack surface of the sandbox by configuring the app container to further reduce its privilege.
Find out more

**Windows Defender SmartScreen**
Manage your organization's computer settings with Group Policy and MDM settings to display a warning page to employees or block a site entirely.
Read the docs
- " -- title: Deployment and end user readiness -- items: - - type: markdown - text: " - Find resources and learn about features to help you deploy Microsoft Edge in your organization to get your users up and running quickly.
- -

**Deployment**
Find resources, learn about features, and get answers to commonly asked questions to help you deploy Microsoft Edge in your organization.
Microsoft Edge deployment guide
Microsoft Edge FAQ
System requirements and language support
Group Policy and MDM settings in Microsoft Edge
Download the Web Application Compatibility Lab Kit
Microsoft Edge training and demonstrations

**End user readiness**
Help your users get started on Microsoft Edge quickly and learn about features like tab management, instant access to Office files, and more.
Quick Start: Microsoft Edge (PDF, .98 MB)
Find it faster with Microsoft Edge (PDF, 605 KB)
Use Microsoft Edge to collaborate (PDF, 468 KB)
Import bookmarks
Password management
Microsoft Edge tips and tricks (video, 20:26)
- " -- title: Stay informed -- items: - - type: markdown - text: " - -

**Sign up for the Windows IT Pro Insider**
Get the latest tools, tips, and expert guidance on deployment, management, security, and more.
Learn more

**Microsoft Edge Dev blog**
Keep up with the latest browser trends, security tips, and news for IT professionals.
Read the blog

**Microsoft Edge Dev on Twitter**
Get the latest news and updates from the Microsoft Web Platform team.
Visit Twitter
- " +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: What's new + linkLists: + - linkListType: whats-new + links: + - text: Documentation for Microsoft Edge version 77 or later + url: https://docs.microsoft.com/DeployEdge/ + - text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021 + url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 + - text: The latest in Microsoft Edge + url: https://blogs.windows.com/msedgedev/2018/04/30/edgehtml-17-april-2018-update/#C7jCBdbPSG6bCXHr.97 + - text: Microsoft Edge for iOS and Android + url: https://blogs.windows.com/windowsexperience/2017/11/30/microsoft-edge-now-available-for-ios-and-android + - text: Application Guard + url: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview + - linkListType: download + links: + - text: Evaluate the impact + url: /microsoft-edge/deploy/microsoft-edge-forrester + + # Card (optional) + - title: Test your site on Microsoft Edge + linkLists: + - linkListType: overview + links: + - text: Test your site on Microsoft Edge for free on BrowserStack + url: https://developer.microsoft.com/microsoft-edge/tools/remote/ + - text: Use sonarwhal to improve your website + url: https://sonarwhal.com/ + + # Card (optional) + - title: Improve compatibility with Enterprise Mode + linkLists: + - linkListType: how-to-guide + links: + - text: Use Enterprise mode to improve compatibility + url: /microsoft-edge/deploy/emie-to-improve-compatibility + - text: Turn on Enterprise Mode and use a site list + url: https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list + - text: Enterprise Site List Portal + url: https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal + + # Card (optional) + - title: Web Application Compatibility Lab Kit + linkLists: + - linkListType: overview + links: + - text: Overview + url: /microsoft-edge/deploy/emie-to-improve-compatibility + + # Card (optional) + - title: Security + linkLists: + - linkListType: download + links: + - text: NSS Labs web browser security reports + url: https://www.microsoft.com/download/details.aspx?id=54773 + - linkListType: overview + links: + - text: Microsoft Edge sandbox + url: https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/ + - text: Windows Defender SmartScreen + url: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview + + # Card (optional) + - title: Deployment + linkLists: + - linkListType: overview + links: + - text: Microsoft Edge deployment guide + url: /microsoft-edge/deploy/ + - text: Microsoft Edge FAQ + url: /microsoft-edge/deploy/microsoft-edge-faq + - text: System requirements and language support + url: /microsoft-edge/deploy/hardware-and-software-requirements + - text: Group Policy and MDM settings in Microsoft Edge + url: /microsoft-edge/deploy/available-policies + - text: Microsoft Edge training and demonstrations + url: /microsoft-edge/deploy/edge-technical-demos + - linkListType: download + links: + - text: Web Application Compatibility Lab Kit + url: https://www.microsoft.com/itpro/microsoft-edge/web-app-compat-toolkit + + # Card (optional) + - title: End user readiness + linkLists: + - linkListType: video + links: + - text: Microsoft Edge tips and tricks (video, 20:26) + url: https://myignite.microsoft.com/sessions/56630?source=sessions + - linkListType: download + links: + - text: Quick Start - Microsoft Edge (PDF, .98 MB) + url: https://go.microsoft.com/fwlink/?linkid=825648 + - text: Find it faster with Microsoft Edge (PDF, 605 KB) + url: https://go.microsoft.com/fwlink/?linkid=825661 + - text: Use Microsoft Edge to collaborate (PDF, 468 KB) + url: https://go.microsoft.com/fwlink/?linkid=825653 + - text: Group Policy and MDM settings in Microsoft Edge + url: /microsoft-edge/deploy/available-policies + - text: Microsoft Edge training and demonstrations + url: /microsoft-edge/deploy/edge-technical-demos + - linkListType: how-to-guide + links: + - text: Import bookmarks + url: https://microsoftedgetips.microsoft.com/2/39 + - text: Password management + url: https://microsoftedgetips.microsoft.com/2/18 + + # Card (optional) + - title: Stay informed + linkLists: + - linkListType: overview + links: + - text: Sign up for the Windows IT Pro Insider + url: https://aka.ms/windows-it-pro-insider + - text: Microsoft Edge Dev blog + url: https://blogs.windows.com/msedgedev + - text: Microsoft Edge Dev on Twitter + url: https://twitter.com/MSEdgeDev diff --git a/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md b/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md index 6ca44ca392..ecfa4c5ca0 100644 --- a/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md +++ b/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md @@ -1,11 +1,12 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge does not use a shared folder by default but downloads book files to a per-user folder for each user. With this policy, you can configure Microsoft Edge to store books from the Books Library to a default, shared folder in Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads books to a shared folder after user action to download the book to their device, which allows them to remove downloaded books at any time. For this policy to work correctly, you must also enable the **Allow a Windows app to share application data between users** group policy. Also, the users must be signed in with a school or work account. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge does not use a shared folder by default but downloads book files to a per-user folder for each user. With this policy, you can configure Microsoft Edge to store books from the Books Library to a default, shared folder in Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads books to a shared folder after user action to download the book to their device, which allows them to remove downloaded books at any time. For this policy to work correctly, you must also enable the **Allow a Windows app to share application data between users** group policy. Also, the users must be signed in with a school or work account. diff --git a/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md b/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md index 4b4897683a..116864a49f 100644 --- a/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md +++ b/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md @@ -1,11 +1,12 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge shows the Address bar drop-down list and makes it available by default, which takes precedence over the Configure search suggestions in Address bar policy. We recommend disabling this policy if you want to minimize network connections from Microsoft Edge to Microsoft service, which hides the functionality of the Address bar drop-down list. When you disable this policy, Microsoft Edge also disables the _Show search and site suggestions as I type_ toggle in Settings. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge shows the Address bar drop-down list and makes it available by default, which takes precedence over the Configure search suggestions in Address bar policy. We recommend disabling this policy if you want to minimize network connections from Microsoft Edge to Microsoft service, which hides the functionality of the Address bar drop-down list. When you disable this policy, Microsoft Edge also disables the _Show search and site suggestions as I type_ toggle in Settings. diff --git a/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md b/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md index bd2d105ef2..dca6cf6233 100644 --- a/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md +++ b/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md @@ -1,11 +1,12 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Adobe Flash is integrated with Microsoft Edge and runs Adobe Flash content by default. With this policy, you can configure Microsoft Edge to prevent Adobe Flash content from running. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Adobe Flash is integrated with Microsoft Edge and runs Adobe Flash content by default. With this policy, you can configure Microsoft Edge to prevent Adobe Flash content from running. diff --git a/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md b/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md index 373cac8619..af3d4fefef 100644 --- a/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md +++ b/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md @@ -1,11 +1,12 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge does not clear the browsing data on exit by default, but users can configure the _Clear browsing data_ option in Settings. Browsing data includes information you entered in forms, passwords, and even the websites visited. With this policy, you can configure Microsoft Edge to clear the browsing data automatically each time Microsoft Edge closes. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge does not clear the browsing data on exit by default, but users can configure the _Clear browsing data_ option in Settings. Browsing data includes information you entered in forms, passwords, and even the websites visited. With this policy, you can configure Microsoft Edge to clear the browsing data automatically each time Microsoft Edge closes. diff --git a/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md b/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md index 4775e4ba3e..40a927c882 100644 --- a/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md +++ b/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md @@ -1,11 +1,12 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge automatically updates the configuration data for the Books library. Disabling this policy prevents Microsoft Edge from updating the configuration data. If Microsoft receives feedback about the amount of data about the Books library, the data comes as a JSON file. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge automatically updates the configuration data for the Books library. Disabling this policy prevents Microsoft Edge from updating the configuration data. If Microsoft receives feedback about the amount of data about the Books library, the data comes as a JSON file. diff --git a/browsers/edge/shortdesc/allow-cortana-shortdesc.md b/browsers/edge/shortdesc/allow-cortana-shortdesc.md index 5975b2b148..fbfa0f13b0 100644 --- a/browsers/edge/shortdesc/allow-cortana-shortdesc.md +++ b/browsers/edge/shortdesc/allow-cortana-shortdesc.md @@ -1,11 +1,12 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Since Microsoft Edge is integration with Cortana, Microsoft Edge allows users to use Cortana voice assistant by default. With this policy, you can configure Microsoft Edge to prevent users from using Cortana but can still search to find items on their device. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Since Microsoft Edge is integration with Cortana, Microsoft Edge allows users to use Cortana voice assistant by default. With this policy, you can configure Microsoft Edge to prevent users from using Cortana but can still search to find items on their device. diff --git a/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md b/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md index 4084a7dfde..9d134d4a38 100644 --- a/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md +++ b/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md @@ -1,11 +1,12 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge allows users to use the F12 developer tools to build and debug web pages by default. With this policy, you can configure Microsoft Edge to prevent users from using the F12 developer tools. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge allows users to use the F12 developer tools to build and debug web pages by default. With this policy, you can configure Microsoft Edge to prevent users from using the F12 developer tools. diff --git a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md index 91065aa687..35f4b5ac73 100644 --- a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md +++ b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md @@ -1,12 +1,13 @@ --- author: dansimp ms.author: dansimp -ms.date: 10/02/2018 +ms.date: 04/23/2020 ms.reviewer: -audience: itpro manager: dansimp +audience: itpro +manager: dansimp ms.prod: edge ms.topic: include --- -[Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy): -This document describes the supported mechanisms for extending or modifying the behavior or user experience of Microsoft Edge and Internet Explorer or the content displayed by these browsers. Any technique not explicitly listed in this document is considered **unsupported**. +[Microsoft browser extension policy](https://docs.microsoft.com/legal/microsoft-edge/microsoft-browser-extension-policy): +This article describes the supported mechanisms for extending or modifying the behavior or user experience of Microsoft Edge and Internet Explorer, or the content these browsers display. Techniques that aren't explicitly listed in this article are considered to be **unsupported**. diff --git a/browsers/edge/troubleshooting-microsoft-edge.md b/browsers/edge/troubleshooting-microsoft-edge.md index ba351d8b48..5479f689f3 100644 --- a/browsers/edge/troubleshooting-microsoft-edge.md +++ b/browsers/edge/troubleshooting-microsoft-edge.md @@ -1,37 +1,37 @@ ---- -title: Troubleshoot Microsoft Edge -description: -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.prod: edge -ms.sitesec: library -title: Deploy Microsoft Edge kiosk mode -ms.localizationpriority: medium -ms.date: 10/15/2018 ---- - -# Troubleshoot Microsoft Edge - - -## Microsoft Edge and IPv6 -We are aware of the known issue with Microsoft Edge and all UWP-based apps, such as Store, Mail, Feedback Hub, and so on. It only happens if you have disabled IPv6 (not recommended), so a temporary workaround is to enable it. - -## Microsoft Edge hijacks .PDF and .HTM files - - - -## Citrix Receiver in Microsoft Edge kiosk mode -If you want to deliver applications to users via Citrix through Microsoft Edge, you must create the kiosk user account and then log into the account to install Citrix Receiver BEFORE setting up assigned access. - -1. Create the kiosk user account. -2. Log into the account. -3. Install Citrix Receiver. -4. Set up assigned access. - - -## Missing SettingSync.admx and SettingSync.adml files - -Make sure to [download](https://www.microsoft.com/en-us/download/windows.aspx) the latest templates to C:\windows\policydefinitions\. +--- +title: Troubleshoot Microsoft Edge +description: +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.prod: edge +ms.sitesec: library +ms.localizationpriority: medium +ms.date: 10/15/2018 +--- + +# Troubleshoot Microsoft Edge + + +## Microsoft Edge and IPv6 +We are aware of the known issue with Microsoft Edge and all UWP-based apps, such as Store, Mail, Feedback Hub, and so on. It only happens if you have disabled IPv6 (not recommended), so a temporary workaround is to enable it. + +## Microsoft Edge hijacks .PDF and .HTM files + + + +## Citrix Receiver in Microsoft Edge kiosk mode +If you want to deliver applications to users via Citrix through Microsoft Edge, you must create the kiosk user account and then log into the account to install Citrix Receiver BEFORE setting up assigned access. + +1. Create the kiosk user account. +2. Log into the account. +3. Install Citrix Receiver. +4. Set up assigned access. + + +## Missing SettingSync.admx and SettingSync.adml files + +Make sure to [download](https://www.microsoft.com/download/windows.aspx) the latest templates to C:\windows\policydefinitions\. diff --git a/browsers/edge/use-powershell-to manage-group-policy.md b/browsers/edge/use-powershell-to manage-group-policy.md index 4427c17e84..1b6d2e9338 100644 --- a/browsers/edge/use-powershell-to manage-group-policy.md +++ b/browsers/edge/use-powershell-to manage-group-policy.md @@ -1,29 +1,29 @@ ---- -title: Use Windows PowerShell to manage group policy -description: -ms.prod: edge -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -title: Security enhancements for Microsoft Edge (Microsoft Edge for IT Pros) -ms.localizationpriority: medium -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: eravena -author: eavena ---- - -# Use Windows PowerShell to manage group policy - -Windows PowerShell supports group policy automation of the same tasks you perform in Group Policy Management Console (GPMC) for domain-based group policy objects (GPOs): - -- Maintain GPOs (GPO creation, removal, backup, and import) -- Associate GPOs with Active Directory service containers (group policy link creation, update, and removal) -- Set permissions on GPOs -- Modify inheritance flags on Active Directory organization units (OUs) and domains -- Configure registry-based policy settings and group policy preferences registry settings (update, retrieval, and removal) -- Create starter GPOs - - - +--- +title: Use Windows PowerShell to manage group policy +description: +ms.prod: edge +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +--- + +# Use Windows PowerShell to manage group policy + +Windows PowerShell supports group policy automation of the same tasks you perform in Group Policy Management Console (GPMC) for domain-based group policy objects (GPOs): + +- Maintain GPOs (GPO creation, removal, backup, and import) +- Associate GPOs with Active Directory service containers (group policy link creation, update, and removal) +- Set permissions on GPOs +- Modify inheritance flags on Active Directory organization units (OUs) and domains +- Configure registry-based policy settings and group policy preferences registry settings (update, retrieval, and removal) +- Create starter GPOs + + + diff --git a/browsers/edge/web-app-compat-toolkit.md b/browsers/edge/web-app-compat-toolkit.md index b502df7292..00e7a02d51 100644 --- a/browsers/edge/web-app-compat-toolkit.md +++ b/browsers/edge/web-app-compat-toolkit.md @@ -1,57 +1,58 @@ ---- -title: Web Application Compatibility lab kit -ms.reviewer: -audience: itpro manager: dansimp -description: Learn how to use the web application compatibility toolkit for Microsoft Edge. -ms.prod: edge -ms.topic: article -ms.manager: elizapo -author: eavena -ms.author: eravena -ms.localizationpriority: high ---- - -# Web Application Compatibility lab kit - ->Updated: October, 2017 - -Upgrading web applications to modern standards is the best long-term solution to ensure compatibility with today’s web browsers, but using backward compatibility can save time and money. Internet Explorer 11 has features that can ease your browser and operating system upgrades, reducing web application testing and remediation costs. On Windows 10, you can standardize on Microsoft Edge for faster, safer browsing and fall back to Internet Explorer 11 just for sites that need backward compatibility. - -The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge. It walks you through how to configure and set up Enterprise Mode, leverage Enterprise Site Discovery, test web apps using the F12 developer tools, and manage the Enterprise Mode Site List. - -The Web Application Compatibility Lab Kit includes: - -- A pre-configured Windows 7 and Windows 10 virtual lab environment with: - - Windows 7 Enterprise Evaluation - - Windows 10 Enterprise Evaluation (version 1607) - - Enterprise Mode Site List Manager - - Enterprise Site Discovery Toolkit -- A "lite" lab option to run the lab on your own Windows 7 or Windows 10 operating system -- A step-by-step lab guide -- A web application compatibility overview video -- A white paper and IT Showcase studies - -Depending on your environment, your web apps may "just work” using the methods described below. Visit [Microsoft Edge Dev](https://developer.microsoft.com/microsoft-edge/) for tools and guidance for web developers. - -There are two versions of the lab kit available: - -- Full version (8 GB) - includes a complete virtual lab environment -- Lite version (400 MB) - includes guidance for running the Lab Kit on your own Windows 7 or Windows 10 operating system - -The Web Application Compatibility Lab Kit is also available in the following languages: - -- Chinese (Simplified) -- Chinese (Traditional) -- French -- German -- Italian -- Japanese -- Korean -- Portuguese (Brazil) -- Russian -- Spanish - -[DOWNLOAD THE LAB KIT](https://www.microsoft.com/evalcenter/evaluate-windows-10-web-application-compatibility-lab) - ->[!TIP] ->Please use a broad bandwidth to download this content to enhance your downloading experience. Lab environment requires 8 GB of available memory and 100 GB of free disk space. +--- +title: Web Application Compatibility lab kit +ms.reviewer: +audience: itpro +manager: dansimp +description: Learn how to use the web application compatibility toolkit for Microsoft Edge. +ms.prod: edge +ms.topic: article +ms.manager: dansimp +author: dansimp +ms.author: dansimp +ms.localizationpriority: high +--- + +# Web Application Compatibility lab kit + +> Updated: October, 2017 + +Upgrading web applications to modern standards is the best long-term solution to ensure compatibility with today’s web browsers, but using backward compatibility can save time and money. Internet Explorer 11 has features that can ease your browser and operating system upgrades, reducing web application testing and remediation costs. On Windows 10, you can standardize on Microsoft Edge for faster, safer browsing and fall back to Internet Explorer 11 just for sites that need backward compatibility. + +The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge. It walks you through how to configure and set up Enterprise Mode, leverage Enterprise Site Discovery, test web apps using the F12 developer tools, and manage the Enterprise Mode Site List. + +The Web Application Compatibility Lab Kit includes: + +- A pre-configured Windows 7 and Windows 10 virtual lab environment with: + - Windows 7 Enterprise Evaluation + - Windows 10 Enterprise Evaluation (version 1607) + - Enterprise Mode Site List Manager + - Enterprise Site Discovery Toolkit +- A "lite" lab option to run the lab on your own Windows 7 or Windows 10 operating system +- A step-by-step lab guide +- A web application compatibility overview video +- A white paper and IT Showcase studies + +Depending on your environment, your web apps may "just work” using the methods described below. Visit [Microsoft Edge Dev](https://developer.microsoft.com/microsoft-edge/) for tools and guidance for web developers. + +There are two versions of the lab kit available: + +- Full version (8 GB) - includes a complete virtual lab environment +- Lite version (400 MB) - includes guidance for running the Lab Kit on your own Windows 7 or Windows 10 operating system + +The Web Application Compatibility Lab Kit is also available in the following languages: + +- Chinese (Simplified) +- Chinese (Traditional) +- French +- German +- Italian +- Japanese +- Korean +- Portuguese (Brazil) +- Russian +- Spanish + +[DOWNLOAD THE LAB KIT](https://www.microsoft.com/evalcenter/evaluate-windows-10-web-application-compatibility-lab) + +> [!TIP] +> Please use a broad bandwidth to download this content to enhance your downloading experience. Lab environment requires 8 GB of available memory and 100 GB of free disk space. diff --git a/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md b/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md index 6b9f2add8d..08d914e629 100644 --- a/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md @@ -3,14 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to add employees to the Enterprise Mode Site List Portal. -author: eavena +author: dansimp ms.prod: ie11 title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Add employees to the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index 5b336bc92e..39adf2816d 100644 --- a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index 7561149048..b4da3f64f5 100644 --- a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2). -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 10/24/2017 diff --git a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index ccb69e9415..55b2dcd28a 100644 --- a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index d07284e3b6..c1a7aee9b8 100644 --- a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/administrative-templates-and-ie11.md b/browsers/enterprise-mode/administrative-templates-and-ie11.md index 48dceffb10..d92810ceb5 100644 --- a/browsers/enterprise-mode/administrative-templates-and-ie11.md +++ b/browsers/enterprise-mode/administrative-templates-and-ie11.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: security description: Administrative templates and Internet Explorer 11 -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md index 16c6da5049..fd58f63df5 100644 --- a/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md @@ -3,14 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. -author: eavena +author: dansimp ms.prod: ie11 title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Approve a change request using the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md index ad4f6bbe08..7696eedaca 100644 --- a/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md +++ b/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md @@ -8,8 +8,8 @@ ms.prod: ie11 ms.mktglfcycl: deploy ms.pagetype: appcompat ms.sitesec: library -author: eavena -ms.author: eravena +author: dansimp +ms.author: dansimp ms.date: 08/14/2017 ms.localizationpriority: low --- diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index 15560fccc7..4fc4fb1ecc 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -2,12 +2,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Collect data using Enterprise Site Discovery ms.sitesec: library ms.date: 07/27/2017 @@ -48,7 +48,7 @@ Before you start, you need to make sure you have the following: - IETelemetry.mof file - - Sample System Center 2012 report templates + - Sample Configuration Manager report templates You must use System Center 2012 R2 Configuration Manager or later for these samples to work. diff --git a/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md b/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md index 070ab271f9..807cc8d2c8 100644 --- a/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md @@ -3,14 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes. -author: eavena +author: dansimp ms.prod: ie11 title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Use the Settings page to finish setting up the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md index 99f9640e54..867bb143b8 100644 --- a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md @@ -3,30 +3,30 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to create a change request within the Enterprise Mode Site List Portal. -author: eavena +author: dansimp ms.prod: ie11 title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Create a change request using the Enterprise Mode Site List Portal **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) Employees assigned to the Requester role can create a change request. A change request is used to tell the Approvers and the Administrator that a website needs to be added or removed from the Enterprise Mode Site List. The employee can navigate to each stage of the process by using the workflow links provided at the top of each page of the portal. ->[!Important] ->Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. +> [!Important] +> Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. **To create a new change request** 1. The Requester (an employee that has been assigned the Requester role) signs into the Enterprise Mode Site List Portal, and clicks **Create new request**. @@ -36,7 +36,7 @@ Employees assigned to the Requester role can create a change request. A change r 2. Fill out the required fields, based on the group and the app, including: - **Group name.** Select the name of your group from the dropdown box. - + - **App name.** Type the name of the app you want to add, delete, or update in the Enterprise Mode Site List. - **Search all apps.** If you can't remember the name of your app, you can click **Search all apps** and search the list. @@ -58,16 +58,16 @@ Employees assigned to the Requester role can create a change request. A change r - **App best viewed in.** Select the best browser experience for the app. This can be Internet Explorer 5 through Internet Explorer 11 or one of the IE7Enterprise or IE8Enterprise modes. - **Is an x-ua tag used?** Select **Yes** or **No** whether an x-ua-compatible tag is used by the app. For more info about x-ua-compatible tags, see the topics in [Defining document compatibility](https://msdn.microsoft.com/library/cc288325(v=vs.85).aspx). - + 4. Click **Save and continue** to save the request and get the app info sent to the pre-production environment site list for testing. - + A message appears that the request was successful, including a **Request ID** number, saying that the change is being made to the pre-production environment site list. 5. The Requester gets an email with a batch script, that when run, configures their test machine for the pre-production environment, along with the necessary steps to make sure the changed info is correct. - **If the change is correct.** The Requester asks the approvers to approve the change request by selecting **Successful** and clicking **Send for approval**. - + - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. ## Next steps -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. +After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md). diff --git a/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 90cef488cc..ad225f2556 100644 --- a/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -3,12 +3,12 @@ ms.localizationpriority: low description: Delete a single site from your global Enterprise Mode site list. ms.pagetype: appcompat ms.mktglfcycl: deploy -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index 8a17c64622..403690d64f 100644 --- a/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/enterprise-mode-features-include.md b/browsers/enterprise-mode/enterprise-mode-features-include.md index 8090fc9ba8..9da0e79778 100644 --- a/browsers/enterprise-mode/enterprise-mode-features-include.md +++ b/browsers/enterprise-mode/enterprise-mode-features-include.md @@ -1,4 +1,5 @@ ### Enterprise Mode features + Enterprise Mode includes the following features: - **Improved web app and website compatibility.** Through improved emulation, Enterprise Mode lets many legacy web apps run unmodified on IE11, supporting several site patterns that aren’t currently supported by existing document modes. @@ -8,9 +9,9 @@ Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microso - **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools. - >[!Important] - >All centrally-made decisions override any locally-made choices. + > [!Important] + > All centrally-made decisions override any locally-made choices. - **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites. -- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. \ No newline at end of file +- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. diff --git a/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md b/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md index 9d297faa8d..ae103d5802 100644 --- a/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md +++ b/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md index 503be19c75..634fd7cd91 100644 --- a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md index 135d5914f0..70694a3df2 100644 --- a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 12/04/2017 diff --git a/browsers/enterprise-mode/enterprise-mode.md b/browsers/enterprise-mode/enterprise-mode.md index 9e9f2933fe..30d32a8d1a 100644 --- a/browsers/enterprise-mode/enterprise-mode.md +++ b/browsers/enterprise-mode/enterprise-mode.md @@ -3,8 +3,8 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: security description: Use this section to learn about how to turn on Enterprise Mode. -author: eavena -ms.author: eravena +author: dansimp +ms.author: dansimp ms.prod: edge ms.assetid: ms.reviewer: diff --git a/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md index fe2074f29f..4f4cbb32bb 100644 --- a/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index a0d0943e07..a1d5a8a76b 100644 --- a/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Instructions about how to clear all of the sites from your global Enterprise Mode site list. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md index 91bb223310..91ff0fab17 100644 --- a/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md +++ b/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Instructions about how to remove sites from a local compatibility view list. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md index 5a278479ec..4e7e10efde 100644 --- a/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md +++ b/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Instructions about how to remove sites from a local Enterprise Mode site list. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md index 5019258eca..2cb578171f 100644 --- a/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md b/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md index 455ae58820..c946663dda 100644 --- a/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md @@ -3,14 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal. -author: eavena +author: dansimp ms.prod: ie11 title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Schedule approved change requests for production using the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index cebf4c013d..bf7e73664e 100644 --- a/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Search to see if a specific site already appears in your global Enterprise Mode site list. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md index 1be38336f5..47322f0c03 100644 --- a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Set up and turn on Enterprise Mode logging and data collection in your organization. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-portal.md b/browsers/enterprise-mode/set-up-enterprise-mode-portal.md index c69c8bd895..ff7107b46a 100644 --- a/browsers/enterprise-mode/set-up-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/set-up-enterprise-mode-portal.md @@ -3,14 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to set up the Enterprise Mode Site List Portal for your organization. -author: eavena +author: dansimp ms.prod: ie11 title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Set up the Enterprise Mode Site List Portal @@ -35,8 +35,8 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all 2. Install the Node.js® package manager, [npm](https://www.npmjs.com/). - >[!Note] - >You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source. + > [!NOTE] + > You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source. 3. Open File Explorer and then open the **EMIEWebPortal/** folder. @@ -105,8 +105,8 @@ Create a new Application Pool and the website, by using the IIS Manager. 9. Double-click the **Authentication** icon, right-click on **Windows Authentication**, and then click **Enable**. - >[!Note] - >You must also make sure that **Anonymous Authentication** is marked as **Enabled**. + > [!NOTE] + > You must also make sure that **Anonymous Authentication** is marked as **Enabled**. 10. Return to the **<website_name> Home** pane, and double-click the **Connection Strings** icon. @@ -116,8 +116,8 @@ Create a new Application Pool and the website, by using the IIS Manager. - **Initial catalog.** The name of your database. - >[!Note] - >Step 3 of this topic provides the steps to create your database. + > [!NOTE] + > Step 3 of this topic provides the steps to create your database. ## Step 3 - Create and prep your database Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables. @@ -216,8 +216,8 @@ Register the EMIEScheduler tool and service for production site list changes. 1. Open File Explorer and go to EMIEWebPortal.SchedulerService\EMIEWebPortal.SchedulerService in your deployment directory, and then copy the **App_Data**, **bin**, and **Logs** folders to a separate folder. For example, C:\EMIEService\. - >[!Important] - >If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files. + > [!IMPORTANT] + > If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files. 2. In Visual Studio start the Developer Command Prompt as an administrator, and then change the directory to the location of the InstallUtil.exe file. For example, _C:\Windows\Microsoft.NET\Framework\v4.0.30319_. diff --git a/browsers/enterprise-mode/turn-off-enterprise-mode.md b/browsers/enterprise-mode/turn-off-enterprise-mode.md index ce1f04eaa1..d34ccca8ce 100644 --- a/browsers/enterprise-mode/turn-off-enterprise-mode.md +++ b/browsers/enterprise-mode/turn-off-enterprise-mode.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: How to turn Enterprise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md index 1a704aa67e..4651adf5cf 100644 --- a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md @@ -1,8 +1,8 @@ Before you can use a site list with Enterprise Mode, you must turn the functionality on and set up the system for centralized control. By allowing centralized control, you can create one global list of websites that render using Enterprise Mode. Approximately 65 seconds after Internet Explorer 11 starts, it looks for a properly formatted site list. If a new site list if found, with a different version number than the active list, IE11 loads and uses the newer version. After the initial check, IE11 won’t look for an updated list again until you restart the browser. ->[!NOTE] ->We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode. +> [!NOTE] +> We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode. **Group Policy** diff --git a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md index a8e5413241..b34f9be63f 100644 --- a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Turn on local user control and logging for Enterprise Mode. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/use-the-enterprise-mode-portal.md b/browsers/enterprise-mode/use-the-enterprise-mode-portal.md index 2b3d7225f2..010448c58d 100644 --- a/browsers/enterprise-mode/use-the-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/use-the-enterprise-mode-portal.md @@ -9,8 +9,8 @@ ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena -author: eavena +ms.author: dansimp +author: dansimp --- # Use the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md index bcef67f64d..f68c42ca3c 100644 --- a/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 12/04/2017 diff --git a/browsers/enterprise-mode/using-enterprise-mode.md b/browsers/enterprise-mode/using-enterprise-mode.md index 79575fbf26..c6f3e6048e 100644 --- a/browsers/enterprise-mode/using-enterprise-mode.md +++ b/browsers/enterprise-mode/using-enterprise-mode.md @@ -3,12 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: security description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode. -author: eavena +author: dansimp ms.prod: ie11 ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md b/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md index e003e6bc01..3e06b8b806 100644 --- a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md @@ -3,32 +3,32 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal. -author: eavena +author: dansimp ms.prod: ie11 title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Verify your changes using the Enterprise Mode Site List Portal **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) ->[!Important] ->This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. +> [!Important] +> This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. The Requester successfully submits a change request to the Enterprise Mode Site List Portal and then gets an email, including: -- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. +- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. - **Test steps**. The suggested steps about how to test the change request details to make sure they're accurate in the pre-production environment. diff --git a/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md b/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md index 5751efc6ef..8387697841 100644 --- a/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md @@ -3,14 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal. -author: eavena +author: dansimp ms.prod: ie11 title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # Verify the change request update in the production environment using the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md b/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md index f81d244053..6ae2c865ea 100644 --- a/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md +++ b/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md @@ -3,14 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal. -author: eavena +author: dansimp ms.prod: ie11 title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: eravena +ms.author: dansimp --- # View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal diff --git a/browsers/includes/helpful-topics-include.md b/browsers/includes/helpful-topics-include.md index 9d4ab636ca..0a0f72e971 100644 --- a/browsers/includes/helpful-topics-include.md +++ b/browsers/includes/helpful-topics-include.md @@ -24,7 +24,7 @@ ms.topic: include - [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) -- [Microsoft Services Support](https://www.microsoft.com/en-us/microsoftservices/support.aspx) +- [Microsoft Services Support](https://www.microsoft.com/microsoftservices/support.aspx) - [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) diff --git a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md index 22464cc569..31961c97a1 100644 --- a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md +++ b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md @@ -1,22 +1,23 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. - ->[!IMPORTANT] ->Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. - -1. In the Enterprise Mode Site List Manager, click **File \> Import**. - -2. Go to the exported .EMIE file.

For example, `C:\users\\documents\sites.emie` - -1. Click **Open**. - -2. Review the alert message about all of your entries being overwritten and click **Yes**. +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. + +> [!IMPORTANT] +> Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. + +1. In the Enterprise Mode Site List Manager, click **File \> Import**. + +2. Go to the exported .EMIE file.

For example, `C:\users\\documents\sites.emie` + +1. Click **Open**. + +2. Review the alert message about all of your entries being overwritten and click **Yes**. diff --git a/browsers/includes/interoperability-goals-enterprise-guidance.md b/browsers/includes/interoperability-goals-enterprise-guidance.md index 04470d33af..407e07bf91 100644 --- a/browsers/includes/interoperability-goals-enterprise-guidance.md +++ b/browsers/includes/interoperability-goals-enterprise-guidance.md @@ -26,8 +26,8 @@ You must continue using IE11 if web apps use any of the following: If you have uninstalled IE11, you can download it from the Microsoft Store or the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. ->[!TIP] ->If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=620714). +> [!TIP] +> If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=620714). |Technology |Why it existed |Why we don't need it anymore | @@ -38,4 +38,3 @@ If you have uninstalled IE11, you can download it from the Microsoft Store or th --- - diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index c2812cb730..060f6ffb99 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -47,6 +47,7 @@ #### [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) #### [Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) #### [Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +#### [Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager](ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md) ### [Use the Enterprise Mode Site List Portal](ie11-deploy-guide/use-the-enterprise-mode-portal.md) #### [Set up the Enterprise Mode Site List Portal](ie11-deploy-guide/set-up-enterprise-mode-portal.md) ##### [Use the Settings page to finish setting up the Enterprise Mode Site List Portal](ie11-deploy-guide/configure-settings-enterprise-mode-portal.md) @@ -186,3 +187,5 @@ ### [IExpress Wizard command-line options](ie11-ieak/iexpress-command-line-options.md) ### [Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) +## KB Troubleshoot +### [Internet Explorer and Microsoft Edge FAQ for IT Pros](kb-support/ie-edge-faqs.md) diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 934ad0e5f6..576a1de28f 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -7,6 +7,7 @@ "**/*.yml" ], "exclude": [ + "**/includes/**", "**/obj/**" ] } @@ -30,15 +31,15 @@ "ms.topic": "article", "manager": "laurawi", "ms.date": "04/05/2017", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.internet-explorer", "folder_relative_path_in_docset": "./" } - } + }, + "titleSuffix": "Internet Explorer" }, "externalReference": [], "template": "op.html", diff --git a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md index 8fe62f2f79..f09832c403 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md @@ -1,49 +1,53 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: How to use Group Policy to install ActiveX controls. -author: dansimp -ms.prod: ie11 -ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and ActiveX installation - -ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: - -- Get the ActiveX control if it's not already installed. - -- Download the installation package. - -- Perform trust verification on the object. - -- Prompt for installation permission, using the IE Information Bar. - -During installation, the rendering page registers and invokes the control, so that after installation, any standard user can invoke the control. - -**Important**
ActiveX control installation requires administrator-level permissions. - -## Group Policy for the ActiveX Installer Service - -You use the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. The AXIS-related settings can be changed using either the Group Policy Management Console (GPMC) or the Local Group Policy Editor, and include: - -- **Approved Installation Sites for ActiveX Controls.** A list of approved installation sites used by AXIS to determine whether it can install a particular ActiveX control. - -- **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. - -For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: How to use Group Policy to install ActiveX controls. +author: dansimp +ms.prod: ie11 +ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy and ActiveX installation + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: + +- Get the ActiveX control if it's not already installed. + +- Download the installation package. + +- Perform trust verification on the object. + +- Prompt for installation permission, using the IE Information Bar. + +During installation, the rendering page registers and invokes the control, so that after installation, any standard user can invoke the control. + +**Important**
ActiveX control installation requires administrator-level permissions. + +## Group Policy for the ActiveX Installer Service + +You use the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. The AXIS-related settings can be changed using either the Group Policy Management Console (GPMC) or the Local Group Policy Editor, and include: + +- **Approved Installation Sites for ActiveX Controls.** A list of approved installation sites used by AXIS to determine whether it can install a particular ActiveX control. + +- **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. + +For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md index 664bc596e1..455bae28bd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md @@ -1,68 +1,72 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to add employees to the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp ---- - -# Add employees to the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. - -The available roles are: - -- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. - -- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. - -**To add an employee to the Enterprise Mode Site List Portal** -1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. - - The **Employee management** page appears. - -2. Click **Add a new employee**. - - The **Add a new employee** page appears. - -3. Fill out the fields for each employee, including: - - - **Email.** Add the employee's email address. - - - **Name.** This box autofills based on the email address. - - - **Role.** Pick a single role for the employee, based on the list above. - - - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. - - - **Comments.** Add optional comments about the employee. - - - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - -**To export all employees to an Excel spreadsheet** -1. On the **Employee management** page, click **Export to Excel**. - -2. Save the EnterpriseModeUsersList.xlsx file. - - The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how to add employees to the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Add employees to the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. + +The available roles are: + +- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. + +- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. + +- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. + +- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. + +**To add an employee to the Enterprise Mode Site List Portal** +1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. + + The **Employee management** page appears. + +2. Click **Add a new employee**. + + The **Add a new employee** page appears. + +3. Fill out the fields for each employee, including: + + - **Email.** Add the employee's email address. + + - **Name.** This box autofills based on the email address. + + - **Role.** Pick a single role for the employee, based on the list above. + + - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. + + - **Comments.** Add optional comments about the employee. + + - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. + +4. Click **Save**. + +**To export all employees to an Excel spreadsheet** +1. On the **Employee management** page, click **Export to Excel**. + +2. Save the EnterpriseModeUsersList.xlsx file. + + The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index 8ead60630e..57c8991c7d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -1,112 +1,116 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -author: dansimp -ms.prod: ie11 -ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. - -If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file -You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

**Important**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema -You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -Each XML file must include: - -- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser. - -- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

**Important**
If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. - -- <docMode> tag.This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -### Enterprise Mode v.1 XML schema example -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -``` - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

-Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. +author: dansimp +ms.prod: ie11 +ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 8.1 +- Windows 7 + +You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. + +If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). + +## Create an Enterprise Mode site list (TXT) file +You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

**Important**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. + +You must separate each site using commas or carriage returns. For example: + +``` +microsoft.com, bing.com, bing.com/images +``` +**-OR-** + +``` +microsoft.com +bing.com +bing.com/images +``` + +## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema +You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +Each XML file must include: + +- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser. + +- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

**Important**
If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. + +- <docMode> tag.This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +### Enterprise Mode v.1 XML schema example +The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +``` + + + www.cpandl.com + www.woodgrovebank.com + adatum.com + contoso.com + relecloud.com + /about + + fabrikam.com + /products + + + + contoso.com + /travel + + fabrikam.com + /products + + + +``` + +To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. + +## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) +After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). + + **To add multiple sites** + +1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. + +2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

+Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +3. Click **OK** to close the **Bulk add sites to the list** menu. + +4. On the **File** menu, click **Save to XML**, and save your file.

+You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index f351c57bb9..37ef55dea6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -7,7 +7,8 @@ author: dansimp ms.prod: ie11 ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd ms.reviewer: -audience: itpro manager: dansimp +audience: itpro +manager: dansimp ms.author: dansimp title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) ms.sitesec: library @@ -15,7 +16,10 @@ ms.date: 10/24/2017 --- -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) +# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + **Applies to:** @@ -62,15 +66,15 @@ Each XML file must include: The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). -``` +```xml - + EnterpriseSitelistManager 10240 20150728.135021 - + IE8Enterprise MSEdge @@ -115,8 +119,3 @@ After you’ve added all of your sites to the tool and saved the file to XML, yo - [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) - [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index 8b8435daff..8c5e4b4426 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -1,66 +1,70 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. - -

Note
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager. - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. -

Note
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

-Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

-Administrators can only see comments while they’re in this tool. - -4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. - -The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - -Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. Click **Save** to validate your website and to add it to the site list for your enterprise.

- If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

- You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. +author: dansimp +ms.prod: ie11 +ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 8.1 +- Windows 7 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. + +

Note
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager. + +## Adding a site to your compatibility list +You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. +

Note
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2). + + **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** + +1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. + +2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

+Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. + +3. Type any comments about the website into the **Notes about URL** box.

+Administrators can only see comments while they’re in this tool. + +4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. + +The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. + +Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +5. Click **Save** to validate your website and to add it to the site list for your enterprise.

+ If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. + +6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

+ You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index 46a8edef5e..63f0d7bd6f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -7,7 +7,8 @@ author: dansimp ms.prod: ie11 ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b ms.reviewer: -audience: itpro manager: dansimp +audience: itpro +manager: dansimp ms.author: dansimp title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) ms.sitesec: library @@ -15,7 +16,10 @@ ms.date: 07/27/2017 --- -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) +# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + **Applies to:** @@ -57,16 +61,20 @@ You can add individual sites to your compatibility list by using the Enterprise 5. In conjunction with the compatibility mode, you'll need to use the **Open in** box to pick which browser opens the site. - - **IE11**. Opens the site in IE11, regardless of which browser is opened by the employee. + - **IE11**. Opens the site in IE11, regardless of which browser is opened by the employee. If you have enabled [Internet Explorer mode integration on Microsoft Edge](https://docs.microsoft.com/deployedge/edge-ie-mode), this option will open sites in Internet Explorer mode. - **MSEdge**. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee. - **None**. Opens in whatever browser the employee chooses. -6. Click **Save** to validate your website and to add it to the site list for your enterprise.

+6. If you have enabled [Internet Explorer mode integration on Microsoft Edge](https://docs.microsoft.com/deployedge/edge-ie-mode), and you have sites that still need to opened in the standalone Internet Explorer 11 application, you can check the box for **Standalone IE**. This checkbox is only relevant when associated to 'Open in' IE11. Checking the box when 'Open In' is set to MSEdge or None will not change browser behavior. + +7. The checkbox **Allow Redirect** applies to the treatment of server side redirects. If you check this box, server side redirects will open in the browser specified by the open-in tag. For more information, see [here](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance#updated-schema-attributes). + +8. Click **Save** to validate your website and to add it to the site list for your enterprise.

If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. -7. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

+9. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). ## Next steps diff --git a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md index f08c08fcdb..23bb9ee14a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md @@ -1,82 +1,86 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Administrative templates and Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Administrative templates and Internet Explorer 11 - -Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: - -- What registry locations correspond to each setting. - -- What value options or restrictions are associated with each setting. - -- The default value for many settings. - -- Text explanations about each setting and the supported version of Internet Explorer. - -For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). - -## What are Administrative Templates? -Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: - -- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. - -- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. - -## How do I store Administrative Templates? -As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). -

Important
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see Scenario 1: Editing the Local GPO Using ADMX Files. - -## Administrative Templates-related Group Policy settings -When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. -

Note
You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the PolicyDefinitions folder on this computer. - -IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: - -- Computer Configuration\\Administrative Templates\\Windows Components\\ - -- User Configuration\\Administrative Templates\\Windows Components\\ - - -|Catalog |Description | -| ------------------------------------------------ | --------------------------------------------| -|IE |Turns standard IE configuration on and off. | -|Internet Explorer\Accelerators |Sets up and manages Accelerators. | -|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | -|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | -|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| -|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | -|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | -|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | -|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | -|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | -|Internet Explorer\Privacy |Turns various privacy-related features on and off. | -|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | -|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | -|RSS Feeds |Sets up and manages RSS feeds in the browser. | - - -## Editing Group Policy settings -Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: - -- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. - -- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. - -## Related topics -- [Administrative templates (.admx) for Windows 10 April 2018 Update](https://www.microsoft.com/download/details.aspx?id=56880) -- [Administrative templates (.admx) for Windows 10 October 2018 Update](https://www.microsoft.com/download/details.aspx?id=57576) -- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Administrative templates and Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Administrative templates and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: + +- What registry locations correspond to each setting. + +- What value options or restrictions are associated with each setting. + +- The default value for many settings. + +- Text explanations about each setting and the supported version of Internet Explorer. + +For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). + +## What are Administrative Templates? +Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: + +- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. + +- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. + +## How do I store Administrative Templates? +As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). +

Important
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see Scenario 1: Editing the Local GPO Using ADMX Files. + +## Administrative Templates-related Group Policy settings +When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. +

Note
You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the PolicyDefinitions folder on this computer. + +IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: + +- Computer Configuration\\Administrative Templates\\Windows Components\\ + +- User Configuration\\Administrative Templates\\Windows Components\\ + + +|Catalog |Description | +| ------------------------------------------------ | --------------------------------------------| +|IE |Turns standard IE configuration on and off. | +|Internet Explorer\Accelerators |Sets up and manages Accelerators. | +|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | +|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | +|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| +|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | +|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | +|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | +|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | +|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | +|Internet Explorer\Privacy |Turns various privacy-related features on and off. | +|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | +|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | +|RSS Feeds |Sets up and manages RSS feeds in the browser. | + + +## Editing Group Policy settings +Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: + +- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. + +- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. + +## Related topics +- [Administrative templates (.admx) for Windows 10 April 2018 Update](https://www.microsoft.com/download/details.aspx?id=56880) +- [Administrative templates (.admx) for Windows 10 October 2018 Update](https://www.microsoft.com/download/details.aspx?id=57576) +- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) diff --git a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md index 977e17394e..07687792a3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md @@ -1,62 +1,66 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp ---- - -# Approve a change request using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. - -## Approve or reject a change request -The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. - -**To approve or reject a change request** -1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. - - The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. - -2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. - -3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. - - An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. - - -## Send a reminder to the Approver(s) group -If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. - -- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. - - An email is sent to the selected Approver(s). - - -## View rejected change requests -The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. - -**To view the rejected change request** - -- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. - - All rejected change requests appear, with role assignment determining which ones are visible. - - -## Next steps -After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Approve a change request using the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. + +## Approve or reject a change request +The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. + +**To approve or reject a change request** +1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. + + The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. + +2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. + +3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. + + An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. + + +## Send a reminder to the Approver(s) group +If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. + +- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. + + An email is sent to the selected Approver(s). + + +## View rejected change requests +The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. + +**To view the rejected change request** + +- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. + + All rejected change requests appear, with role assignment determining which ones are visible. + + +## Next steps +After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md index d45374e404..7dbfc19776 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md @@ -1,62 +1,66 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration and auto proxy problems with Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration and auto proxy problems with Internet Explorer 11 -You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. - -## Branding changes aren't distributed using automatic configuration -If you've turned on the **Disable external branding of Internet Explorer** Group Policy Object, you won't be able to use automatic configuration to distribute your branding changes to your users' computers. When this object is turned on, it prevents the branding of IE by a non-Microsoft company or entity, such as an Internet service provider or Internet content provider. For more information about automatic configuration, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) and [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). For more information about Group Policy settings, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - -## Proxy server setup issues -If you experience issues while setting up your proxy server, you can try these troubleshooting steps: - -- Check to make sure the proxy server address is right. - -- Check that both **Automatically detect settings** and **Automatic configuration** are turned on in the browser. - -- Check that the browser is pointing to the right automatic configuration script location. - - **To check your proxy server address** - -1. On the **Tools** menu, click **Internet Options**, and then **Connections**. - -2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. - -3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). - - **To check that you've turned on the correct settings** - -4. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -5. Click **Settings** or **LAN Settings**. - -6. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

**Note**
If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. - - **To check that you're pointing to the correct automatic configuration script location** - -7. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -8. Click **Settings** or **LAN Settings**. - -9. In the **Automatic configuration** area, check that you've chosen the **Use automatic configuration script** box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto configuration and auto proxy problems with Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto configuration and auto proxy problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. + +## Branding changes aren't distributed using automatic configuration +If you've turned on the **Disable external branding of Internet Explorer** Group Policy Object, you won't be able to use automatic configuration to distribute your branding changes to your users' computers. When this object is turned on, it prevents the branding of IE by a non-Microsoft company or entity, such as an Internet service provider or Internet content provider. For more information about automatic configuration, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) and [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). For more information about Group Policy settings, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). + +## Proxy server setup issues +If you experience issues while setting up your proxy server, you can try these troubleshooting steps: + +- Check to make sure the proxy server address is right. + +- Check that both **Automatically detect settings** and **Automatic configuration** are turned on in the browser. + +- Check that the browser is pointing to the right automatic configuration script location. + + **To check your proxy server address** + +1. On the **Tools** menu, click **Internet Options**, and then **Connections**. + +2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. + +3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). + + **To check that you've turned on the correct settings** + +4. On the **Tools** menu, click **Internet Options**, and then click **Connections**. + +5. Click **Settings** or **LAN Settings**. + +6. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

**Note**
If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. + + **To check that you're pointing to the correct automatic configuration script location** + +7. On the **Tools** menu, click **Internet Options**, and then click **Connections**. + +8. Click **Settings** or **LAN Settings**. + +9. In the **Automatic configuration** area, check that you've chosen the **Use automatic configuration script** box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md index 1b9a0ba9c8..82857ac50e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md @@ -1,74 +1,78 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration settings for Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration settings for Internet Explorer 11 -Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

**Important**
You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -## Adding the automatic configuration registry key -For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

**Important**
Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. - - **To add the registry key** - -1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. - -2. Right-click the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl` subkey, point to **New**, and then click **Key**. - -3. Enter the new key name, `FEATURE\AUTOCONFIG\BRANDING`, and then press Enter. - -4. Right-click `FEATURE\AUTOCONFIG\BRANDING`, point to **New**, and then click **DWORD (32-bit) Value**. - -5. Enter the new DWORD value name, **iexplore.exe**, and then press Enter. - -6. Right-click **iexplore.exe**, and then click **Modify**. - -7. In the **Value data** box, enter **1**, and then click **OK**. - -8. Exit the registry editor. - -## Updating your automatic configuration settings -After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. -

Important
Your branding changes won't be added or updated if you've previously chosen the Disable external branding of IE setting in the User Configuration\Administrative Templates\Windows Components\Internet Explorer Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the Group Policy TechCenter. - - **To update your settings** - -1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** check box to allow automatic detection of browser settings. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that automatic configuration only happens when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). - -## Locking your automatic configuration settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing Automatic Configuration settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Disable changing Automatic Configuration settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto configuration settings for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto configuration settings for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

**Important**
You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). + +## Adding the automatic configuration registry key +For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

**Important**
Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. + + **To add the registry key** + +1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. + +2. Right-click the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl` subkey, point to **New**, and then click **Key**. + +3. Enter the new key name, `FEATURE\AUTOCONFIG\BRANDING`, and then press Enter. + +4. Right-click `FEATURE\AUTOCONFIG\BRANDING`, point to **New**, and then click **DWORD (32-bit) Value**. + +5. Enter the new DWORD value name, **iexplore.exe**, and then press Enter. + +6. Right-click **iexplore.exe**, and then click **Modify**. + +7. In the **Value data** box, enter **1**, and then click **OK**. + +8. Exit the registry editor. + +## Updating your automatic configuration settings +After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. +

Important
Your branding changes won't be added or updated if you've previously chosen the Disable external branding of IE setting in the User Configuration\Administrative Templates\Windows Components\Internet Explorer Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the Group Policy TechCenter. + + **To update your settings** + +1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +2. Choose the **Automatically detect configuration settings** check box to allow automatic detection of browser settings. + +3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: + + - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that automatic configuration only happens when the computer restarts. + + - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. + + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. + +If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). + +## Locking your automatic configuration settings +You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. + +- **Using Microsoft Active Directory.** Choose **Disable changing Automatic Configuration settings** from the Administrative Templates setting. + +- **Not Using Active Directory.** Choose the **Disable changing Automatic Configuration settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md index 6d58aac85b..3e2c898988 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md @@ -1,55 +1,59 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto detect settings Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto detect settings Internet Explorer 11 -After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. - -Automatic detection works even if the browser wasn't originally set up or installed by the administrator. - -- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. - -- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses.

**Note**
DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. - -## Updating your automatic detection settings -To use automatic detection, you have to set up your DHCP and DNS servers.

**Note**
Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. - - **To turn on automatic detection for DHCP servers** - -1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). - - **To turn on automatic detection for DNS servers** - -4. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -5. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. - -6. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651). - -7. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto detect settings Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto detect settings Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. + +Automatic detection works even if the browser wasn't originally set up or installed by the administrator. + +- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. + +- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses.

**Note**
DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. + +## Updating your automatic detection settings +To use automatic detection, you have to set up your DHCP and DNS servers.

**Note**
Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. + + **To turn on automatic detection for DHCP servers** + +1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. + +2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). + +3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). + + **To turn on automatic detection for DNS servers** + +4. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +5. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. + +6. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651). + +7. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md index bd7bd5c030..f285933bcb 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md @@ -1,50 +1,54 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto proxy configuration settings for Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto proxy configuration settings for Internet Explorer 11 -Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. - -## Updating your auto-proxy settings -You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. - - **To update your settings** - -1. Create a script file with your proxy information, copying it to a server location. - -2. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that updates only happen when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of the .ins file you want to use for automatic configuration. For more information about setting up **Automatic Configuration**, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md). - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script. This script runs whenever IE11 makes a network request and can include multiple proxy servers for each protocol type.

**Important**
IE11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -## Locking your auto-proxy settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto proxy configuration settings for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto proxy configuration settings for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. + +## Updating your auto-proxy settings +You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. + + **To update your settings** + +1. Create a script file with your proxy information, copying it to a server location. + +2. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: + + - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that updates only happen when the computer restarts. + + - **Automatic Configuration URL (.INS file) box:** Type the location of the .ins file you want to use for automatic configuration. For more information about setting up **Automatic Configuration**, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md). + + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script. This script runs whenever IE11 makes a network request and can include multiple proxy servers for each protocol type.

**Important**
IE11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. + +## Locking your auto-proxy settings +You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. + +- **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. + +- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md index 12bd5502e3..17f6488e0a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md +++ b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md @@ -1,43 +1,47 @@ ---- -title: Blocked out-of-date ActiveX controls -description: This page is periodically updated with new ActiveX controls blocked by this feature. -author: dansimp -ms.author: dansimp -audience: itpro manager: dansimp -ms.date: 05/10/2018 -ms.topic: article -ms.prod: ie11 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -ms.assetid: '' -ms.reviewer: -ms.sitesec: library ---- - -# Blocked out-of-date ActiveX controls - -ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_. - -We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list. - -You will receive a notification if a webpage tries to load one of the following of ActiveX control versions: - -**Java** - -| Java 2 Platform, Standard Edition (J2SE) 1.4, everything below (but not including) update 43 | -|----------------------------------------------------------------------------------------------| -| J2SE 5.0, everything below (but not including) update 99 | -| Java SE 6, everything below (but not including) update 181 | -| Java SE 7, everything below (but not including) update 171 | -| Java SE 8, everything below (but not including) update 161 | -| Java SE 9, everything below (but not including) update 4 | - -**Silverlight** - - -| Everything below (but not including) Silverlight 5.1.50907.0 | -|--------------------------------------------------------------| -| | - -For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864). +--- +title: Blocked out-of-date ActiveX controls +description: This page is periodically updated with new ActiveX controls blocked by this feature. +author: dansimp +ms.author: dansimp +audience: itpro +manager: dansimp +ms.date: 05/10/2018 +ms.topic: article +ms.prod: ie11 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +ms.assetid: '' +ms.reviewer: +ms.sitesec: library +--- + +# Blocked out-of-date ActiveX controls + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_. + +We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list. + +You will receive a notification if a webpage tries to load one of the following of ActiveX control versions: + +**Java** + +| Java 2 Platform, Standard Edition (J2SE) 1.4, everything below (but not including) update 43 | +|----------------------------------------------------------------------------------------------| +| J2SE 5.0, everything below (but not including) update 99 | +| Java SE 6, everything below (but not including) update 181 | +| Java SE 7, everything below (but not including) update 171 | +| Java SE 8, everything below (but not including) update 161 | +| Java SE 9, everything below (but not including) update 4 | + +**Silverlight** + + +| Everything below (but not including) Silverlight 5.1.50907.0 | +|--------------------------------------------------------------| +| | + +For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864). diff --git a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md index fe61c67cf5..9aca832f3e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md +++ b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: performance -description: Browser cache changes and roaming profiles -author: dansimp -ms.prod: ie11 -ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/16/2017 ---- - - -# Browser cache changes and roaming profiles -We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. - -You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Microsoft Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). - -To get the best results while using roaming profiles, we strongly recommend the following: - -- Create a separate roaming repository for each domain account that uses roaming. - -- Restrict roaming user profiles so they work on only one computer at a time. Using a single roaming profile on multiple computers isn’t supported (via console or Remote Desktop) and can cause unpredictable results, including cookie loss. - -- Allow all computers that let users sign-on with a roaming profile have identical IE cookie policies and settings. - -- Make sure to delete the user’s local roaming profile at sign off for any computer using user profile roaming. You can do this by turning on the **Delete cached copies of roaming profiles** Group Policy Object. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: performance +description: Browser cache changes and roaming profiles +author: dansimp +ms.prod: ie11 +ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 10/16/2017 +--- + + +# Browser cache changes and roaming profiles + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. + +You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Microsoft Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). + +To get the best results while using roaming profiles, we strongly recommend the following: + +- Create a separate roaming repository for each domain account that uses roaming. + +- Restrict roaming user profiles so they work on only one computer at a time. Using a single roaming profile on multiple computers isn’t supported (via console or Remote Desktop) and can cause unpredictable results, including cookie loss. + +- Allow all computers that let users sign-on with a roaming profile have identical IE cookie policies and settings. + +- Make sure to delete the user’s local roaming profile at sign off for any computer using user profile roaming. You can do this by turning on the **Delete cached copies of roaming profiles** Group Policy Object. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md index d3cae2a67a..f358312bbc 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md @@ -1,56 +1,60 @@ ---- -ms.localizationpriority: medium -title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) -description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile. -ms.mktglfcycl: deploy -ms.prod: ie11 -ms.sitesec: library -author: dansimp -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp ---- - - -# Change history for Internet Explorer 11 -This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. - -## April 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md)|Updates to the Enterprise Mode section to include info about the Enterprise Mode Site List Portal. | - -## March 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to add the Allow VBScript to run in Internet Explorer and the Hide the button (next to the New Tab button) that opens Microsoft Edge settings. | - -## November 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.| - -## August 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | - -## July 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | - -## June 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | - - -## May 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | - +--- +ms.localizationpriority: medium +title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) +description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile. +ms.mktglfcycl: deploy +ms.prod: ie11 +ms.sitesec: library +author: dansimp +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + + +# Change history for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. + +## April 2017 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md)|Updates to the Enterprise Mode section to include info about the Enterprise Mode Site List Portal. | + +## March 2017 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to add the Allow VBScript to run in Internet Explorer and the Hide the button (next to the New Tab button) that opens Microsoft Edge settings. | + +## November 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.| + +## August 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | + +## July 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | + +## June 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | + + +## May 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | + diff --git a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md index 0b2d9ff141..9b4b3e6f1f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md +++ b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md @@ -1,51 +1,55 @@ ---- -title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) -description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. -ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: ie11 -ms.mktglfcycl: deploy -ms.pagetype: appcompat -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.date: 08/14/2017 -ms.localizationpriority: medium ---- - - -# Check for a new Enterprise Mode site list xml file - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. - -**How Internet Explorer 11 looks for an updated site list** - -1. Internet Explorer starts up and looks for an updated site list in the following places: - - 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. - - 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. - - 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. - -2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

**Note**
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. - -   - -  - -  - - - +--- +title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) +description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. +ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: ie11 +ms.mktglfcycl: deploy +ms.pagetype: appcompat +ms.sitesec: library +author: dansimp +ms.author: dansimp +ms.date: 08/14/2017 +ms.localizationpriority: medium +--- + + +# Check for a new Enterprise Mode site list xml file + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. + +**How Internet Explorer 11 looks for an updated site list** + +1. Internet Explorer starts up and looks for an updated site list in the following places: + + 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. + + 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. + + 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. + +2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

**Note**
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. + +   + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md index c35d115df7..810264c501 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md @@ -1,31 +1,35 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to deploy Internet Explorer 11 (IE11) -author: dansimp -ms.prod: ie11 -ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to deploy Internet Explorer 11 (IE11) -In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. - -## In this section - -| Topic | Description | -|------------------------------------------------------------- | ------------------------------------------------------ | -|[Deploy IE11 using Automatic Version Synchronization (AVS)](deploy-ie11-using-automatic-version-synchronization-avs.md) |Guidance about how to deploy your custom browser packages using Automatic Version Synchronization (AVS). | -|[Deploy IE11 using software distribution tools](deploy-ie11-using-software-distribution-tools.md) |Guidance about how to deploy your custom browser packages using System Center 2012 R2, Windows Server Update Services (WSUS), Group Policy software installation, or Microsoft Deployment toolkit (MDT). | - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Choose how to deploy Internet Explorer 11 (IE11) +author: dansimp +ms.prod: ie11 +ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Choose how to deploy Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. + +## In this section + +| Topic | Description | +|------------------------------------------------------------- | ------------------------------------------------------ | +|[Deploy IE11 using Automatic Version Synchronization (AVS)](deploy-ie11-using-automatic-version-synchronization-avs.md) |Guidance about how to deploy your custom browser packages using Automatic Version Synchronization (AVS). | +|[Deploy IE11 using software distribution tools](deploy-ie11-using-software-distribution-tools.md) |Guidance about how to deploy your custom browser packages using System Center 2012 R2, Windows Server Update Services (WSUS), Group Policy software installation, or Microsoft Deployment toolkit (MDT). | + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md index a430073e9d..72a5766494 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md @@ -1,37 +1,41 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to install Internet Explorer 11 (IE11) -author: dansimp -ms.prod: ie11 -ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to install Internet Explorer 11 (IE11) -Before you install Internet Explorer 11, you should: - -- **Migrate Group Policy Objects.** Decide if your Group Policy Objects should migrate to the new version. - -- **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. - -- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. - -- **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune). - - - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Choose how to install Internet Explorer 11 (IE11) +author: dansimp +ms.prod: ie11 +ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Choose how to install Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Before you install Internet Explorer 11, you should: + +- **Migrate Group Policy Objects.** Decide if your Group Policy Objects should migrate to the new version. + +- **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. + +- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. + +- **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. + + - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/cloud-platform/microsoft-intune). + + - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index 12049fdcb9..0ffe059374 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Collect data using Enterprise Site Discovery +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md index 502c425b80..db62af6aab 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md @@ -1,97 +1,101 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes. -author: lomayor -ms.prod: ie11 -title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# Use the Settings page to finish setting up the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The **Settings** page lets anyone with Administrator rights set up groups and roles, set up the Enterprise Mode Site List Portal environment, and choose the freeze dates for production changes. - -## Use the Environment settings area -This area lets you specify the location of your production and pre-production environments, where to store your attachments, your settings location, and the website domain for email notifications. - -**To add location info** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Environment settings** area of the page, provide the info for your **Pre-production environment**, your **Production environment**, your **Attachments location**, your **Settings location**, and your **Website domain for email notifications**. - -3. Click **Credentials** to add the appropriate domain, user name, and password for each location, and then click **OK**. - -## Use the Group and role settings area -After you set up your email credentials, you'll be able to add or edit your Group info, along with picking which roles must be Approvers for the group. - -**To add a new group and determine the required change request Approvers** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Group and role settings** area of the page, click **Group details**. - - The **Add or edit group names** box appears. - -3. Click the **Add group** tab, and then add the following info: - - - **New group name.** Type name of your new group. - - - **Group head email.** Type the email address for the primary contact for the group. - - - **Group head name.** This box automatically fills, based on the email address. - - - **Active.** Click the check box to make the group active in the system. If you want to keep the group in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - - -**To set a group's required Approvers** -1. In the **Group and role settings** area of the page, choose the group name you want to update with Approvers from the **Group name** box. - -2. In the **Required approvers** area, choose which roles are required to approve a change request for the group. You can choose one or many roles. - - - **App Manager.** All employees in the selected group must get change request approval by someone assigned this role. - - You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. - - - **Group Head.** All employees in the selected group must get change request approval by someone assigned this role. - - You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. - - - **Administrator.** All employees in the selected group must get change request approval by someone assigned this role. - -## Use the Freeze production changes area -This optional area lets you specify a period when your employees must stop adding changes to the current Enterprise Mode Site List. This must include both a start and an end date. - -**To add the start and end dates** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Freeze production changes** area of the page, use the calendars to provide the **Freeze start date** and the **Freeze end date**. Your employees can't add apps to the production Enterprise Mode Site List during this span of time. - -3. Click **Save**. - -## Related topics -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) - -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes. +author: dansimp +ms.prod: ie11 +title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Use the Settings page to finish setting up the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +The **Settings** page lets anyone with Administrator rights set up groups and roles, set up the Enterprise Mode Site List Portal environment, and choose the freeze dates for production changes. + +## Use the Environment settings area +This area lets you specify the location of your production and pre-production environments, where to store your attachments, your settings location, and the website domain for email notifications. + +**To add location info** +1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. + + The **Settings** page appears. + +2. In the **Environment settings** area of the page, provide the info for your **Pre-production environment**, your **Production environment**, your **Attachments location**, your **Settings location**, and your **Website domain for email notifications**. + +3. Click **Credentials** to add the appropriate domain, user name, and password for each location, and then click **OK**. + +## Use the Group and role settings area +After you set up your email credentials, you'll be able to add or edit your Group info, along with picking which roles must be Approvers for the group. + +**To add a new group and determine the required change request Approvers** +1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. + + The **Settings** page appears. + +2. In the **Group and role settings** area of the page, click **Group details**. + + The **Add or edit group names** box appears. + +3. Click the **Add group** tab, and then add the following info: + + - **New group name.** Type name of your new group. + + - **Group head email.** Type the email address for the primary contact for the group. + + - **Group head name.** This box automatically fills, based on the email address. + + - **Active.** Click the check box to make the group active in the system. If you want to keep the group in the system, but you want to prevent access, clear this check box. + +4. Click **Save**. + + +**To set a group's required Approvers** +1. In the **Group and role settings** area of the page, choose the group name you want to update with Approvers from the **Group name** box. + +2. In the **Required approvers** area, choose which roles are required to approve a change request for the group. You can choose one or many roles. + + - **App Manager.** All employees in the selected group must get change request approval by someone assigned this role. + + You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. + + - **Group Head.** All employees in the selected group must get change request approval by someone assigned this role. + + You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. + + - **Administrator.** All employees in the selected group must get change request approval by someone assigned this role. + +## Use the Freeze production changes area +This optional area lets you specify a period when your employees must stop adding changes to the current Enterprise Mode Site List. This must include both a start and an end date. + +**To add the start and end dates** +1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. + + The **Settings** page appears. + +2. In the **Freeze production changes** area of the page, use the calendars to provide the **Freeze start date** and the **Freeze end date**. Your employees can't add apps to the production Enterprise Mode Site List during this span of time. + +3. Click **Save**. + +## Related topics +- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) + +- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) + +- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md index 24e93d73e5..ad4441c9e3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md @@ -1,73 +1,78 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to create a change request within the Enterprise Mode Site List Portal. -author: lomayor -ms.prod: ie11 -title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# Create a change request using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Employees assigned to the Requester role can create a change request. A change request is used to tell the Approvers and the Administrator that a website needs to be added or removed from the Enterprise Mode Site List. The employee can navigate to each stage of the process by using the workflow links provided at the top of each page of the portal. - ->[!Important] ->Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. - -**To create a new change request** -1. The Requester (an employee that has been assigned the Requester role) signs into the Enterprise Mode Site List Portal, and clicks **Create new request**. - - The **Create new request** page appears. - -2. Fill out the required fields, based on the group and the app, including: - - - **Group name.** Select the name of your group from the dropdown box. - - - **App name.** Type the name of the app you want to add, delete, or update in the Enterprise Mode Site List. - - - **Search all apps.** If you can't remember the name of your app, you can click **Search all apps** and search the list. - - - **Add new app.** If your app isn't listed, you can click **Add new app** to add it to the list. - - - **Requested by.** Automatically filled in with your name. - - - **Description.** Add descriptive info about the app. - - - **Requested change.** Select whether you want to **Add to EMIE**, **Delete from EMIE**, or **Update to EMIE**. - - - **Reason for request.** Select the best reason for why you want to update, delete, or add the app. - - - **Business impact (optional).** An optional area where you can provide info about the business impact of this app and the change. - - - **App location (URL).** The full URL location to the app, starting with https:// or https://. - - - **App best viewed in.** Select the best browser experience for the app. This can be Internet Explorer 5 through Internet Explorer 11 or one of the IE7Enterprise or IE8Enterprise modes. - - - **Is an x-ua tag used?** Select **Yes** or **No** whether an x-ua-compatible tag is used by the app. For more info about x-ua-compatible tags, see the topics in [Defining document compatibility](https://msdn.microsoft.com/library/cc288325(v=vs.85).aspx). - -4. Click **Save and continue** to save the request and get the app info sent to the pre-production environment site list for testing. - - A message appears that the request was successful, including a **Request ID** number, saying that the change is being made to the pre-production environment site list. - -5. The Requester gets an email with a batch script, that when run, configures their test machine for the pre-production environment, along with the necessary steps to make sure the changed info is correct. - - - **If the change is correct.** The Requester asks the approvers to approve the change request by selecting **Successful** and clicking **Send for approval**. - - - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. - -## Next steps -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how to create a change request within the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Create a change request using the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Employees assigned to the Requester role can create a change request. A change request is used to tell the Approvers and the Administrator that a website needs to be added or removed from the Enterprise Mode Site List. The employee can navigate to each stage of the process by using the workflow links provided at the top of each page of the portal. + +> [!Important] +> Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. + +**To create a new change request** +1. The Requester (an employee that has been assigned the Requester role) signs into the Enterprise Mode Site List Portal, and clicks **Create new request**. + + The **Create new request** page appears. + +2. Fill out the required fields, based on the group and the app, including: + + - **Group name.** Select the name of your group from the dropdown box. + + - **App name.** Type the name of the app you want to add, delete, or update in the Enterprise Mode Site List. + + - **Search all apps.** If you can't remember the name of your app, you can click **Search all apps** and search the list. + + - **Add new app.** If your app isn't listed, you can click **Add new app** to add it to the list. + + - **Requested by.** Automatically filled in with your name. + + - **Description.** Add descriptive info about the app. + + - **Requested change.** Select whether you want to **Add to EMIE**, **Delete from EMIE**, or **Update to EMIE**. + + - **Reason for request.** Select the best reason for why you want to update, delete, or add the app. + + - **Business impact (optional).** An optional area where you can provide info about the business impact of this app and the change. + + - **App location (URL).** The full URL location to the app, starting with https:// or https://. + + - **App best viewed in.** Select the best browser experience for the app. This can be Internet Explorer 5 through Internet Explorer 11 or one of the IE7Enterprise or IE8Enterprise modes. + + - **Is an x-ua tag used?** Select **Yes** or **No** whether an x-ua-compatible tag is used by the app. For more info about x-ua-compatible tags, see the topics in [Defining document compatibility](https://msdn.microsoft.com/library/cc288325(v=vs.85).aspx). + +4. Click **Save and continue** to save the request and get the app info sent to the pre-production environment site list for testing. + + A message appears that the request was successful, including a **Request ID** number, saying that the change is being made to the pre-production environment site list. + +5. The Requester gets an email with a batch script, that when run, configures their test machine for the pre-production environment, along with the necessary steps to make sure the changed info is correct. + + - **If the change is correct.** The Requester asks the approvers to approve the change request by selecting **Successful** and clicking **Send for approval**. + + - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. + +## Next steps + +After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md index c69b357557..395703b43d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md @@ -1,43 +1,47 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Create packages for multiple operating systems or languages -author: lomayor -ms.prod: ie11 -ms.assetid: 44051f9d-63a7-43bf-a427-d0a0a1c717da -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Create packages for multiple operating systems or languages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Create packages for multiple operating systems or languages -You'll create multiple versions of your custom browser package if: - -- You support more than 1 version of Windows®. - -- You support more than 1 language. - -- You have custom installation packages with only minor differences. Like, having a different phone number. - - **To create a new package** - -1. Create an installation package using the Internet Explorer Customization Wizard 11, as described in the [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md) topic. - -2. Go to your **CIE/Custom** folder and rename the `Install.ins`file. For example, if you need a version for employees in Texas, rename the file to Texas.ins. - -3. Run the wizard again, using the Custom folder as the destination directory.

-**Important**
-Except for the **Title bar** text, **Favorites**, **Links bar**, **Home page**, and **Search bar**, keep all of your wizard settings the same for all of your build computers. - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Create packages for multiple operating systems or languages +author: dansimp +ms.prod: ie11 +ms.assetid: 44051f9d-63a7-43bf-a427-d0a0a1c717da +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Create packages for multiple operating systems or languages (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Create packages for multiple operating systems or languages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You'll create multiple versions of your custom browser package if: + +- You support more than 1 version of Windows®. + +- You support more than 1 language. + +- You have custom installation packages with only minor differences. Like, having a different phone number. + + **To create a new package** + +1. Create an installation package using the Internet Explorer Customization Wizard 11, as described in the [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md) topic. + +2. Go to your **CIE/Custom** folder and rename the `Install.ins`file. For example, if you need a version for employees in Texas, rename the file to Texas.ins. + +3. Run the wizard again, using the Custom folder as the destination directory.

+**Important**
+Except for the **Title bar** text, **Favorites**, **Links bar**, **Home page**, and **Search bar**, keep all of your wizard settings the same for all of your build computers. + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md index d5ebc1d49f..342b139714 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md @@ -1,44 +1,48 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Customize Internet Explorer 11 installation packages -author: lomayor -ms.prod: ie11 -ms.assetid: 10a14a09-673b-4f8b-8d12-64036135e7fd -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Customize Internet Explorer 11 installation packages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Customize Internet Explorer 11 installation packages -You can customize Internet Explorer 11 to support various browser behaviors, multiple operating system versions and languages, and Setup information (.inf) files. - -|Topic |Description | -|------------------------------------------------------------------------|----------------------------------------------------| -|[Using IEAK 11 to create packages](using-ieak11-to-create-install-packages.md) |How to use the Internet Explorer Administration Kit 11 (IEAK 11) and the IE Customization Wizard 11 to set up, configure, deploy, and maintain IE11. | -|[Create packages for multiple operating systems or languages](create-install-packages-for-multiple-operating-systems-or-languages.md) |How to create multiple versions of your custom installation package, to support multiple operating systems or languages. | -|[Using .INF files to create packages](using-inf-files-to-create-install-packages.md) |How to use the Microsoft® Windows Setup Engine to automate setup tasks and customize your component installations. | - - - -In addition, you can configure IE before, during, or after deployment, using these tools: - -- **IE Administration Kit 11 (IEAK 11)**. Creates customized installation packages that can be deployed through your software distribution system. For more information about the IEAK 11, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). - -- **Group Policy**. Configures and enforces IE11 settings. For more information about settings and configuration options, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - -- **Unattend.xml**. Customizes some of the IE settings during your Windows installation. This option only applies if you're updating a Windows image with IE11.

**Note**
-You'll only see the new IE11 Unattend.xml settings if your Unattend.xml file's associated with a Windows image that includes the IE11 update. For more information about editing and using the Unattend.xml file, see [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788). For more information about using the Windows System Image Manager, see [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789). - -   - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Customize Internet Explorer 11 installation packages +author: dansimp +ms.prod: ie11 +ms.assetid: 10a14a09-673b-4f8b-8d12-64036135e7fd +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Customize Internet Explorer 11 installation packages (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Customize Internet Explorer 11 installation packages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You can customize Internet Explorer 11 to support various browser behaviors, multiple operating system versions and languages, and Setup information (.inf) files. + +|Topic |Description | +|------------------------------------------------------------------------|----------------------------------------------------| +|[Using IEAK 11 to create packages](using-ieak11-to-create-install-packages.md) |How to use the Internet Explorer Administration Kit 11 (IEAK 11) and the IE Customization Wizard 11 to set up, configure, deploy, and maintain IE11. | +|[Create packages for multiple operating systems or languages](create-install-packages-for-multiple-operating-systems-or-languages.md) |How to create multiple versions of your custom installation package, to support multiple operating systems or languages. | +|[Using .INF files to create packages](using-inf-files-to-create-install-packages.md) |How to use the Microsoft® Windows Setup Engine to automate setup tasks and customize your component installations. | + + + +In addition, you can configure IE before, during, or after deployment, using these tools: + +- **IE Administration Kit 11 (IEAK 11)**. Creates customized installation packages that can be deployed through your software distribution system. For more information about the IEAK 11, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). + +- **Group Policy**. Configures and enforces IE11 settings. For more information about settings and configuration options, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). + +- **Unattend.xml**. Customizes some of the IE settings during your Windows installation. This option only applies if you're updating a Windows image with IE11.

**Note**
+You'll only see the new IE11 Unattend.xml settings if your Unattend.xml file's associated with a Windows image that includes the IE11 update. For more information about editing and using the Unattend.xml file, see [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788). For more information about using the Windows System Image Manager, see [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789). + +   + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 71d871cad1..843d917596 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -1,49 +1,53 @@ ---- -ms.localizationpriority: medium -description: Delete a single site from your global Enterprise Mode site list. -ms.pagetype: appcompat -ms.mktglfcycl: deploy -author: lomayor -ms.prod: ie11 -ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - - - **To delete a single site from your global Enterprise Mode site list** - -- From the Enterprise Mode Site List Manager, pick the site you want to delete, and then click **Delete**.
-The site is permanently removed from your list. - -If you delete a site by mistake, you’ll need to manually add it back using the instructions in the following topics, based on operating system. - -- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) - -- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - +--- +ms.localizationpriority: medium +description: Delete a single site from your global Enterprise Mode site list. +ms.pagetype: appcompat +ms.mktglfcycl: deploy +author: dansimp +ms.prod: ie11 +ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + + + **To delete a single site from your global Enterprise Mode site list** + +- From the Enterprise Mode Site List Manager, pick the site you want to delete, and then click **Delete**.
+The site is permanently removed from your list. + +If you delete a site by mistake, you’ll need to manually add it back using the instructions in the following topics, based on operating system. + +- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) + +- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md index 21baca9a6b..0f0c56de35 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md @@ -1,35 +1,39 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). -author: lomayor -ms.prod: ie11 -ms.assetid: f51224bd-3371-4551-821d-1d62310e3384 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) -You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). - -## What is Automatic Version Synchronization? -Automatic Version Synchronization (AVS) lets you use the Internet Explorer Administration Kit 11 (IEAK 11) to synchronize the IE11 setup files on a local computer with the latest setup files on the web. - -You must synchronize the setup files at least once on the local computer, for each language and operating system combination, before proceeding through the rest of the wizard. If your packages have more than one version of IE, you need to keep the versions in separate component download folders, which can be pointed to from the **File Locations** page of the IEAK 11. For more information about using the AVS feature, see [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](../ie11-ieak/auto-version-sync-ieak11-wizard.md) -. - -## Related topics -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) -- [Customize Internet Explorer 11 installation packages](customize-ie11-install-packages.md) - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). +author: dansimp +ms.prod: ie11 +ms.assetid: f51224bd-3371-4551-821d-1d62310e3384 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + +# Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). + +## What is Automatic Version Synchronization? +Automatic Version Synchronization (AVS) lets you use the Internet Explorer Administration Kit 11 (IEAK 11) to synchronize the IE11 setup files on a local computer with the latest setup files on the web. + +You must synchronize the setup files at least once on the local computer, for each language and operating system combination, before proceeding through the rest of the wizard. If your packages have more than one version of IE, you need to keep the versions in separate component download folders, which can be pointed to from the **File Locations** page of the IEAK 11. For more information about using the AVS feature, see [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](../ie11-ieak/auto-version-sync-ieak11-wizard.md) +. + +## Related topics +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) +- [Customize Internet Explorer 11 installation packages](customize-ie11-install-packages.md) + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md index 1df03c3f05..c3940fbefd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md @@ -1,33 +1,37 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Deploy Internet Explorer 11 using software distribution tools -author: lomayor -ms.prod: ie11 -ms.assetid: fd027775-651a-41e1-8ec3-d32eca876d8a -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Deploy Internet Explorer 11 using software distribution tools (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Deploy Internet Explorer 11 using software distribution tools -If you already manage software distribution and updates on your network through software distribution tools, you can also use these tools for ongoing deployments of Internet Explorer. Software distribution tools include: - -- **System Center R2 2012 System Center 2012 R2 Configuration Manager.** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664). - -- **Windows Server Update Services (WSUS).** Download a single copy of the IE11 updates, caching them to local servers so your users' computers can receive the updates directly from the WSUS servers, instead of through Windows Update. For more information about using this tool, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). - -- **Group Policy Software Installation.** Deploy and install IE11 on your user's computers through a combination of Group Policy and Microsoft Active Directory. For more information about using this tool, see [Group Policy Software Installation overview](https://go.microsoft.com/fwlink/p/?LinkId=296365). - -- **Microsoft Deployment Toolkit (MDT).** Add the IE11 update to your deployment share, using MDT to update your previously-deployed Windows image. For more information about using this tool, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkID=331148). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Deploy Internet Explorer 11 using software distribution tools +author: dansimp +ms.prod: ie11 +ms.assetid: fd027775-651a-41e1-8ec3-d32eca876d8a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Deploy Internet Explorer 11 using software distribution tools (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Deploy Internet Explorer 11 using software distribution tools + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +If you already manage software distribution and updates on your network through software distribution tools, you can also use these tools for ongoing deployments of Internet Explorer. Software distribution tools include: + +- **System Center R2 2012 System Center 2012 R2 Configuration Manager.** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664). + +- **Windows Server Update Services (WSUS).** Download a single copy of the IE11 updates, caching them to local servers so your users' computers can receive the updates directly from the WSUS servers, instead of through Windows Update. For more information about using this tool, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). + +- **Group Policy Software Installation.** Deploy and install IE11 on your user's computers through a combination of Group Policy and Microsoft Active Directory. For more information about using this tool, see [Group Policy Software Installation overview](https://go.microsoft.com/fwlink/p/?LinkId=296365). + +- **Microsoft Deployment Toolkit (MDT).** Add the IE11 update to your deployment share, using MDT to update your previously-deployed Windows image. For more information about using this tool, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkID=331148). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md index acb447d590..0177418299 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md @@ -1,121 +1,125 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: You can pin websites to the Windows 8.1 taskbar for quick access using the Microsoft Deployment Toolkit (MDT) 2013. -author: lomayor -ms.prod: ie11 -ms.assetid: 24f4dcac-9032-4fe8-bf6d-2d712d61cb0c -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can pin websites to the Windows 8.1 taskbar for quick access. You pin a website simply by dragging its tab to the taskbar. Some websites can also extend the icon’s Jump List. - -The ability to pin websites to the Windows 8.1 taskbar can help make end users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to users. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=398474). - -## Deploying pinned websites in MDT 2013 -This topic requires that you have a complete MDT 2013 deployment share that contains Windows 8.1 which comes with Internet Explorer 11. If you’re deploying to Windows 7 clients and need to learn how to add IE11 to an MDT 2013 deployment share as an update, see [Installing Internet Explorer 11 using Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=398475) in the TechNet library. - -Deploying pinned websites in MDT 2013 is a 4-step process: - -1. Create a .website file for each website that you want to deploy. When you pin a website to the taskbar, Windows 8.1 creates a .website file that describes how the icon should look and feel. - -2. Copy the .website files to your deployment share. - -3. Copy the .website files to your target computers. - -4. Edit the task sequence of your Unattend.xml answer files to pin the websites to the taskbar. In particular, you want to add each .website file to the **TaskbarLinks** item in Unattend.xml during oobeSystem phase. You can add up to six .website files to the **TaskbarLinks** item. - -Pinned websites are immediately available to every user who logs on to the computer although the user must click each icon to populate its Jump List. - -**Important**
-To follow the examples in this topic, you’ll need to pin the Bing (https://www.bing.com/) and MSN (https://www.msn.com/) websites to the taskbar. - -### Step 1: Creating .website files -The first step is to create a .website file for each website that you want to pin to the Windows 8.1 taskbar during deployment. A .website file is like a shortcut, except it’s a plain text file that describes not only the website’s URL but also how the icon looks. - - **To create each .website file** - -1. Open the website in IE11. - -2. Drag the website’s tab and drop it on the Windows 8.1 taskbar. - -3. Go to `%USERPROFILE%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar` in Windows Explorer, and copy the bing.website and msn.website files to your desktop. - -### Step 2: Copying the .website files to the deployment share -Next, you must enable your deployment share to copy the bing.website and msn.website files to the **Start** menu on each target computer. - - **To copy .website files to the deployment share** - -1. Open your MDT 2013 deployment share in Windows Explorer. - -2. In the `$OEM$` folder, create the path `$1\Users\Public\Public Links`. If the `$OEM$` folder doesn’t exist, create it at the root of your deployment share. - -3. Copy the bing.website and msn.website files from your desktop to `$OEM$\$1\Users\Public\Public Links` in your deployment share. - -### Step 3: Copying .website files to target computers -After your operating system is installed on the target computer, you need to copy the .website files over so they can be pinned to the taskbar. - - **To copy .website files to target computers** - -1. In the **Deployment Workbench** of MDT 2013, open the deployment share containing the task sequence during which you want to deploy pinned websites, and then click **Task Sequences**. - -2. In the right pane of the **Deployment Workbench**, right-click your task sequence (create a new one if you don’t have one yet), and click **Properties**. - -3. In the **Task Sequence** tab, click the **Postinstall** folder, click **General** from the **Add** button, and then click **Run Command Line**. - -4. Rename the newly created item to *Copy Files* and move it up to the top of the **Postinstall** folder. - -5. In the **Command Line** box enter the following text, `xcopy "%DEPLOYROOT%\$OEM$\$1" "%OSDisk%\" /yqe`. - -6. Click the **Apply** button to save your changes. - -### Step 4: Pinning .website files to the Taskbar -With the .website files ready to copy to the **Public Links** folder on target computers for all users, the last step is to edit the Unattend.xml answer files to pin those .website files to the taskbar. You will need to complete the following steps for each task sequence during which you want to pin these websites to the taskbar. - - **To pin .website files to the Taskbar** - -1. Open the Windows System Image Manager (Windows SIM). - -2. On the **OS Info** tab, click **Edit Unattend.xml** to open the Unattend.xml file. - -2. In the **Windows Image** pane, under **Components** and then **Microsoft-Windows-Shell-Setup**, right-click **TaskbarLinks**, and then click **Add Setting to Pass 7 oobeSystem**. - -3. In the **TaskbarLinks Properties** pane, add the relative path to the target computer’s (not the deployment share’s) .website files that you created earlier. You can add up to six links to the **TaskbarLinks** item. For example, `%PUBLIC%\Users\Public\Public Links\Bing.website` and `%PUBLIC%\Users\Public\Public Links\MSN.website` - -4. On the **File** menu, click **Save Answer File**, and then close Windows SIM. - -5. To close the task sequence, click **OK**. - -## Updating intranet websites for pinning -The MDT 2013 deployment share and task sequences are now ready to pin websites to the taskbar during deployment. This pinning feature can include intranet sites important in your organization. - -You can make your intranet websites act more like applications by extending them to fully support the Windows 8.1 taskbar. This includes creating custom Jump Lists, thumbnail previews, and notifications. For info about extending your intranet websites, see [Pinned Sites Developer Documentation](https://go.microsoft.com/fwlink/p/?LinkId=398484) on MSDN. For more ideas about what to pin, see [Add-ons](https://go.microsoft.com/fwlink/p/?LinkId=398483) in the Internet Explorer Gallery. - -## Related topics -- [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788) -- [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789) -- [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148) -- [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669) - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: You can pin websites to the Windows 8.1 taskbar for quick access using the Microsoft Deployment Toolkit (MDT) 2013. +author: dansimp +ms.prod: ie11 +ms.assetid: 24f4dcac-9032-4fe8-bf6d-2d712d61cb0c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can pin websites to the Windows 8.1 taskbar for quick access. You pin a website simply by dragging its tab to the taskbar. Some websites can also extend the icon’s Jump List. + +The ability to pin websites to the Windows 8.1 taskbar can help make end users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to users. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=398474). + +## Deploying pinned websites in MDT 2013 +This topic requires that you have a complete MDT 2013 deployment share that contains Windows 8.1 which comes with Internet Explorer 11. If you’re deploying to Windows 7 clients and need to learn how to add IE11 to an MDT 2013 deployment share as an update, see [Installing Internet Explorer 11 using Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=398475) in the TechNet library. + +Deploying pinned websites in MDT 2013 is a 4-step process: + +1. Create a .website file for each website that you want to deploy. When you pin a website to the taskbar, Windows 8.1 creates a .website file that describes how the icon should look and feel. + +2. Copy the .website files to your deployment share. + +3. Copy the .website files to your target computers. + +4. Edit the task sequence of your Unattend.xml answer files to pin the websites to the taskbar. In particular, you want to add each .website file to the **TaskbarLinks** item in Unattend.xml during oobeSystem phase. You can add up to six .website files to the **TaskbarLinks** item. + +Pinned websites are immediately available to every user who logs on to the computer although the user must click each icon to populate its Jump List. + +**Important**
+To follow the examples in this topic, you’ll need to pin the Bing (https://www.bing.com/) and MSN (https://www.msn.com/) websites to the taskbar. + +### Step 1: Creating .website files +The first step is to create a .website file for each website that you want to pin to the Windows 8.1 taskbar during deployment. A .website file is like a shortcut, except it’s a plain text file that describes not only the website’s URL but also how the icon looks. + + **To create each .website file** + +1. Open the website in IE11. + +2. Drag the website’s tab and drop it on the Windows 8.1 taskbar. + +3. Go to `%USERPROFILE%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar` in Windows Explorer, and copy the bing.website and msn.website files to your desktop. + +### Step 2: Copying the .website files to the deployment share +Next, you must enable your deployment share to copy the bing.website and msn.website files to the **Start** menu on each target computer. + + **To copy .website files to the deployment share** + +1. Open your MDT 2013 deployment share in Windows Explorer. + +2. In the `$OEM$` folder, create the path `$1\Users\Public\Public Links`. If the `$OEM$` folder doesn’t exist, create it at the root of your deployment share. + +3. Copy the bing.website and msn.website files from your desktop to `$OEM$\$1\Users\Public\Public Links` in your deployment share. + +### Step 3: Copying .website files to target computers +After your operating system is installed on the target computer, you need to copy the .website files over so they can be pinned to the taskbar. + + **To copy .website files to target computers** + +1. In the **Deployment Workbench** of MDT 2013, open the deployment share containing the task sequence during which you want to deploy pinned websites, and then click **Task Sequences**. + +2. In the right pane of the **Deployment Workbench**, right-click your task sequence (create a new one if you don’t have one yet), and click **Properties**. + +3. In the **Task Sequence** tab, click the **Postinstall** folder, click **General** from the **Add** button, and then click **Run Command Line**. + +4. Rename the newly created item to *Copy Files* and move it up to the top of the **Postinstall** folder. + +5. In the **Command Line** box enter the following text, `xcopy "%DEPLOYROOT%\$OEM$\$1" "%OSDisk%\" /yqe`. + +6. Click the **Apply** button to save your changes. + +### Step 4: Pinning .website files to the Taskbar +With the .website files ready to copy to the **Public Links** folder on target computers for all users, the last step is to edit the Unattend.xml answer files to pin those .website files to the taskbar. You will need to complete the following steps for each task sequence during which you want to pin these websites to the taskbar. + + **To pin .website files to the Taskbar** + +1. Open the Windows System Image Manager (Windows SIM). + +2. On the **OS Info** tab, click **Edit Unattend.xml** to open the Unattend.xml file. + +2. In the **Windows Image** pane, under **Components** and then **Microsoft-Windows-Shell-Setup**, right-click **TaskbarLinks**, and then click **Add Setting to Pass 7 oobeSystem**. + +3. In the **TaskbarLinks Properties** pane, add the relative path to the target computer’s (not the deployment share’s) .website files that you created earlier. You can add up to six links to the **TaskbarLinks** item. For example, `%PUBLIC%\Users\Public\Public Links\Bing.website` and `%PUBLIC%\Users\Public\Public Links\MSN.website` + +4. On the **File** menu, click **Save Answer File**, and then close Windows SIM. + +5. To close the task sequence, click **OK**. + +## Updating intranet websites for pinning +The MDT 2013 deployment share and task sequences are now ready to pin websites to the taskbar during deployment. This pinning feature can include intranet sites important in your organization. + +You can make your intranet websites act more like applications by extending them to fully support the Windows 8.1 taskbar. This includes creating custom Jump Lists, thumbnail previews, and notifications. For info about extending your intranet websites, see [Pinned Sites Developer Documentation](https://go.microsoft.com/fwlink/p/?LinkId=398484) on MSDN. For more ideas about what to pin, see [Add-ons](https://go.microsoft.com/fwlink/p/?LinkId=398483) in the Internet Explorer Gallery. + +## Related topics +- [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788) +- [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789) +- [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148) +- [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669) + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index d892799770..e8d1ec3d7d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -1,61 +1,65 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. -author: lomayor -ms.prod: ie11 -ms.assetid: 00cb1f39-2b20-4d37-9436-62dc03a6320b -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Deprecated document modes and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Deprecated document modes and Internet Explorer 11 - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. Starting with Windows 10, we’re deprecating document modes. - -This means that while Internet Explorer 11 will continue to support document modes, Microsoft Edge won’t. And because of that, it also means that if you want to use Microsoft Edge, you’re going to have to update your legacy webpages and apps to support modern features, browsers, and devices. - ->**Note**
->For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953). - -## What is document mode? -Each release after Internet Explorer 8 has helped with the transition by introducing additional document modes that emulated previously supported versions, while also introducing support for features defined by industry standards. During this time, numerous websites and apps were updated to the latest and greatest industry standards, while many other sites and apps continued to simply rely on document modes to work properly. - -Because our goal with Microsoft Edge is to give users the best site and app viewing experience possible, we’ve decided to stop support for document modes. All websites and apps using legacy features and code will need to be updated to rely on the new modern standards and practices. - -If you have legacy sites and apps that can’t be updated to modern standards, you can continue to use IE11 and document modes. We recommend that you use the **IE11 Standards document mode** because it represents the highest support available for modern standards. You should also use the HTML5 document type declaration to turn on the latest supported standards while using IE11:``. - -## Document modes and IE11 -The compatibility improvements made in IE11 lets older websites just work in the latest standards mode, by default, without requiring emulation of the previous browser behavior. Because older websites are now just working, we’ve decided that Internet Explorer 10 document mode will be the last new document mode. Instead, developers will need to move to using the IE11 document mode going forward. - -## Document mode selection flowchart -This flowchart shows how IE11 works when document modes are used. - -![Flowchart detailing how document modes are chosen in IE11](images/docmode-decisions-sm.png)
-[Click this link to enlarge image](img-ie11-docmode-lg.md) - -## Known Issues with Internet Explorer 8 document mode in Enterprise Mode -The default document mode for Enterprise Mode is Internet Explorer 8. While this mode provides a strong emulation of that browser, it isn’t an exact match. For example, Windows Internet Explorer 9 fundamentally changed how document modes work with iframes and document modes can’t undo architectural changes. It’s also a known issue that Windows 10 supports GDI font rendering while using Enterprise Mode, but uses natural metrics once outside of Enterprise Mode. - -## Related topics -- [Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. +author: dansimp +ms.prod: ie11 +ms.assetid: 00cb1f39-2b20-4d37-9436-62dc03a6320b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Deprecated document modes and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + +# Deprecated document modes and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. Starting with Windows 10, we’re deprecating document modes. + +This means that while Internet Explorer 11 will continue to support document modes, Microsoft Edge won’t. And because of that, it also means that if you want to use Microsoft Edge, you’re going to have to update your legacy webpages and apps to support modern features, browsers, and devices. + +>**Note**
+>For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953). + +## What is document mode? +Each release after Internet Explorer 8 has helped with the transition by introducing additional document modes that emulated previously supported versions, while also introducing support for features defined by industry standards. During this time, numerous websites and apps were updated to the latest and greatest industry standards, while many other sites and apps continued to simply rely on document modes to work properly. + +Because our goal with Microsoft Edge is to give users the best site and app viewing experience possible, we’ve decided to stop support for document modes. All websites and apps using legacy features and code will need to be updated to rely on the new modern standards and practices. + +If you have legacy sites and apps that can’t be updated to modern standards, you can continue to use IE11 and document modes. We recommend that you use the **IE11 Standards document mode** because it represents the highest support available for modern standards. You should also use the HTML5 document type declaration to turn on the latest supported standards while using IE11:``. + +## Document modes and IE11 +The compatibility improvements made in IE11 lets older websites just work in the latest standards mode, by default, without requiring emulation of the previous browser behavior. Because older websites are now just working, we’ve decided that Internet Explorer 10 document mode will be the last new document mode. Instead, developers will need to move to using the IE11 document mode going forward. + +## Document mode selection flowchart +This flowchart shows how IE11 works when document modes are used. + +![Flowchart detailing how document modes are chosen in IE11](images/docmode-decisions-sm.png)
+[Click this link to enlarge image](img-ie11-docmode-lg.md) + +## Known Issues with Internet Explorer 8 document mode in Enterprise Mode +The default document mode for Enterprise Mode is Internet Explorer 8. While this mode provides a strong emulation of that browser, it isn’t an exact match. For example, Windows Internet Explorer 9 fundamentally changed how document modes work with iframes and document modes can’t undo architectural changes. It’s also a known issue that Windows 10 supports GDI font rendering while using Enterprise Mode, but uses natural metrics once outside of Enterprise Mode. + +## Related topics +- [Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index 6f6339d452..29574ab860 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -1,53 +1,57 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. -author: lomayor -ms.prod: ie11 -ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. - -If you need to edit a lot of websites, you probably don’t want to do it one at a time. Instead, you can edit your saved XML or TXT file and add the sites back again. For information about how to do this, depending on your operating system and schema version, see [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md). - - **To change how your page renders** - -1. In the Enterprise Mode Site List Manager, double-click the site you want to change. - -2. Change the comment or the compatibility mode option. - -3. Click **Save** to validate your changes and to add the updated information to your site list.
-If your change passes validation, it’s added to the global site list. If the update doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the update or ignore the validation problem and add it to your list anyway. For more information about fixing validation issues, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -4. On the **File** menu, click **Save to XML**, and save the updated file.
-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. +author: dansimp +ms.prod: ie11 +ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. + +If you need to edit a lot of websites, you probably don’t want to do it one at a time. Instead, you can edit your saved XML or TXT file and add the sites back again. For information about how to do this, depending on your operating system and schema version, see [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md). + + **To change how your page renders** + +1. In the Enterprise Mode Site List Manager, double-click the site you want to change. + +2. Change the comment or the compatibility mode option. + +3. Click **Save** to validate your changes and to add the updated information to your site list.
+If your change passes validation, it’s added to the global site list. If the update doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the update or ignore the validation problem and add it to your list anyway. For more information about fixing validation issues, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). + +4. On the **File** menu, click **Save to XML**, and save the updated file.
+You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md index 4e5e30e18a..e21f3e41ed 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md @@ -1,110 +1,114 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Enable and disable add-ons using administrative templates and group policy -ms.author: lomayor -author: lomayor -ms.prod: ie11 -ms.assetid: c6fe1cd3-0bfc-4d23-8016-c9601f674c0b -ms.reviewer: -audience: itpro manager: dansimp -title: Enable and disable add-ons using administrative templates and group policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 4/12/2018 ---- - - -# Enable and disable add-ons using administrative templates and group policy -Add-ons let your employees personalize Internet Explorer. You can manage IE add-ons using Group Policy and Group Policy templates. - -There are four types of add-ons: - -- **Search Providers.** Type a term and see suggestions provided by your search provider. - -- **Accelerators.** Highlight text on a web page and then click the blue **Accelerator** icon to email, map, search, translate, or do many other tasks. - -- **Web Slices.** Subscribe to parts of a website to get real-time information on the Favorites bar. - -- **Toolbars.** Add features (like stock tickers) to your browser. - -## Using the Local Group Policy Editor to manage group policy objects -You can use the Local Group Policy Editor to change how add-ons work in your organization. - - **To manage add-ons** - -1. In the Local Group Policy Editor, go to `Computer Configuration\Administrative Templates\Windows Components\Internet Explorer`. - -2. Change any or all of these settings to match your company’s policy and requirements. - - - Turn off add-on performance notifications - - - Automatically activate newly installed add-ons - - - Do not allow users to enable or disable add-ons - -3. Go into the **Internet Control Panel\\Advance Page** folder, where you can change: - - - Do not allow resetting IE settings - - - Allow third-party browser extensions - -4. Go into the **Security Features\\Add-on Management** folder, where you can change: - - - Add-on List - - - Deny all add-ons unless specifically allowed in the Add-on List - - - Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects - -5. Close the Local Group Policy Editor when you’re done. - -## Using the CLSID and Administrative Templates to manage group policy objects -Every add-on has a Class ID (CLSID) that you use to enable and disable specific add-ons, using Group Policy and Administrative Templates. - - **To manage add-ons** - -1. Get the CLSID for the add-on you want to enable or disable: - - 1. Open IE, click **Tools**, and then click **Manage Add-ons**. - - 2. Double-click the add-on you want to change. - - 3. In the More Information dialog, click **Copy** and then click **Close**. - - 4. Open Notepad and paste the information for the add-on. - - 5. On the Manage Add-ons windows, click **Close**. - - 6. On the Internet Options dialog, click **Close** and then close IE. - -2. From the copied information, select and copy just the **Class ID** value. - - >[!NOTE] - >You want to copy the curly brackets as well as the CLSID: **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**. - -3. Open the Group Policy Management Editor and go to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. -
**-OR-**
-Open the Local Group Policy Editor and go to: User Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. - -4. Open the **Add-on List** Group Policy Object, select **Enabled**, and then click **Show**.
The Show Contents dialog appears. - -6. In **Value Name**, paste the Class ID for your add-on, for example, **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**. - -6. In **Value**, enter one of the following: - - - **0**. The add-on is disabled and your employees can’t change it. - - - **1**. The add-on is enabled and your employees can’t change it. - - - **2**. The add-on is enabled and your employees can change it. - -7. Close the Show Contents dialog. - -7. In the Group Policy editor, go to: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer. - -8. Double-click **Automatically activate/enable newly installed add-ons** and select **Enabled**.

Enabling turns off the message prompting you to Enable or Don't enable the add-on. - -7. Click **OK** twice to close the Group Policy editor. - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Enable and disable add-ons using administrative templates and group policy +ms.author: dansimp +author: dansimp +ms.prod: ie11 +ms.assetid: c6fe1cd3-0bfc-4d23-8016-c9601f674c0b +ms.reviewer: +audience: itpro +manager: dansimp +title: Enable and disable add-ons using administrative templates and group policy (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 4/12/2018 +--- + + +# Enable and disable add-ons using administrative templates and group policy + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Add-ons let your employees personalize Internet Explorer. You can manage IE add-ons using Group Policy and Group Policy templates. + +There are four types of add-ons: + +- **Search Providers.** Type a term and see suggestions provided by your search provider. + +- **Accelerators.** Highlight text on a web page and then click the blue **Accelerator** icon to email, map, search, translate, or do many other tasks. + +- **Web Slices.** Subscribe to parts of a website to get real-time information on the Favorites bar. + +- **Toolbars.** Add features (like stock tickers) to your browser. + +## Using the Local Group Policy Editor to manage group policy objects +You can use the Local Group Policy Editor to change how add-ons work in your organization. + + **To manage add-ons** + +1. In the Local Group Policy Editor, go to `Computer Configuration\Administrative Templates\Windows Components\Internet Explorer`. + +2. Change any or all of these settings to match your company’s policy and requirements. + + - Turn off add-on performance notifications + + - Automatically activate newly installed add-ons + + - Do not allow users to enable or disable add-ons + +3. Go into the **Internet Control Panel\\Advance Page** folder, where you can change: + + - Do not allow resetting IE settings + + - Allow third-party browser extensions + +4. Go into the **Security Features\\Add-on Management** folder, where you can change: + + - Add-on List + + - Deny all add-ons unless specifically allowed in the Add-on List + + - Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects + +5. Close the Local Group Policy Editor when you’re done. + +## Using the CLSID and Administrative Templates to manage group policy objects +Every add-on has a Class ID (CLSID) that you use to enable and disable specific add-ons, using Group Policy and Administrative Templates. + + **To manage add-ons** + +1. Get the CLSID for the add-on you want to enable or disable: + + 1. Open IE, click **Tools**, and then click **Manage Add-ons**. + + 2. Double-click the add-on you want to change. + + 3. In the More Information dialog, click **Copy** and then click **Close**. + + 4. Open Notepad and paste the information for the add-on. + + 5. On the Manage Add-ons windows, click **Close**. + + 6. On the Internet Options dialog, click **Close** and then close IE. + +2. From the copied information, select and copy just the **Class ID** value. + + > [!NOTE] + > You want to copy the curly brackets as well as the CLSID: **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**. + +3. Open the Group Policy Management Editor and go to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. +
**-OR-**
+Open the Local Group Policy Editor and go to: User Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. + +4. Open the **Add-on List** Group Policy Object, select **Enabled**, and then click **Show**.
The Show Contents dialog appears. + +6. In **Value Name**, paste the Class ID for your add-on, for example, **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**. + +6. In **Value**, enter one of the following: + + - **0**. The add-on is disabled and your employees can’t change it. + + - **1**. The add-on is enabled and your employees can’t change it. + + - **2**. The add-on is enabled and your employees can change it. + +7. Close the Show Contents dialog. + +7. In the Group Policy editor, go to: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer. + +8. Double-click **Automatically activate/enable newly installed add-ons** and select **Enabled**.

Enabling turns off the message prompting you to Enable or Don't enable the add-on. + +7. Click **OK** twice to close the Group Policy editor. + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md index d1ac1a3190..7f00307378 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md @@ -1,30 +1,34 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Enhanced Protected Mode problems with Internet Explorer -author: lomayor -ms.prod: ie11 -ms.assetid: 15890ad1-733d-4f7e-a318-10399b389f45 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Enhanced Protected Mode problems with Internet Explorer (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enhanced Protected Mode problems with Internet Explorer -Enhanced Protected Mode further restricts Protected Mode to deny potential attackers access to sensitive or personal information. If this feature is turned on, users might start to see errors asking them to turn it off, like **This webpage wants to run "npctrl.dll. If you trust this site, you can disable Enhanced Protected Mode for this site to run the control**. If your users click the **Disable** box, Enhanced Protected Mode is turned off for only the single visit to that specific site. After the user leaves the site, Enhanced Protected Mode is automatically turned back on. - -You can use your company’s Group Policy to turn Enhanced Protected Mode on or off for all users. For more information, see the [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md) information in this guide. - -For more information about Enhanced Protected Mode, see the [Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=267512) post on IEBlog, and both the [Understanding Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=282662) and the [Enhanced Protected Mode and Local Files](https://go.microsoft.com/fwlink/p/?LinkId=282663) blog posts on IEInternals. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Enhanced Protected Mode problems with Internet Explorer +author: dansimp +ms.prod: ie11 +ms.assetid: 15890ad1-733d-4f7e-a318-10399b389f45 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Enhanced Protected Mode problems with Internet Explorer (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Enhanced Protected Mode problems with Internet Explorer + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Enhanced Protected Mode further restricts Protected Mode to deny potential attackers access to sensitive or personal information. If this feature is turned on, users might start to see errors asking them to turn it off, like **This webpage wants to run "npctrl.dll. If you trust this site, you can disable Enhanced Protected Mode for this site to run the control**. If your users click the **Disable** box, Enhanced Protected Mode is turned off for only the single visit to that specific site. After the user leaves the site, Enhanced Protected Mode is automatically turned back on. + +You can use your company’s Group Policy to turn Enhanced Protected Mode on or off for all users. For more information, see the [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md) information in this guide. + +For more information about Enhanced Protected Mode, see the [Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=267512) post on IEBlog, and both the [Understanding Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=282662) and the [Enhanced Protected Mode and Local Files](https://go.microsoft.com/fwlink/p/?LinkId=282663) blog posts on IEInternals. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md index 2059dff44a..e5e3c31095 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md @@ -1,55 +1,59 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company. -author: lomayor -ms.prod: ie11 -ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enterprise Mode for Internet Explorer 11 - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. - -## In this section - -|Topic |Description | -|---------------------------------------------------------------|-----------------------------------------------------------------------------------| -|[Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)|Includes descriptions of the features of Enterprise Mode. | -|[Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) |Guidance about how to turn on local control of Enterprise Mode and how to use ASP or the GitHub sample to collect data from your local computers. | -|[Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) |Guidance about how to turn on Enterprise Mode and set up a site list, using Group Policy or the registry. | -|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | -|[Check for a new Enterprise Mode site list xml file](check-for-new-enterprise-mode-site-list-xml-file.md) |Guidance about how the Enterprise Mode functionality looks for your updated site list. | -|[Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) |Guidance about how to turn on local control of Enterprise Mode, using Group Policy or the registry.| -|[Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) |Guidance about how to use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | -|[Use the Enterprise Mode Site List Portal](use-the-enterprise-mode-portal.md) |Guidance about how to set up and use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | -|[Using Enterprise Mode](using-enterprise-mode.md) |Guidance about how to turn on either IE7 Enterprise Mode or IE8 Enterprise Mode. | -|[Fix web compatibility issues using document modes and the Enterprise Mode Site List](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) |Guidance about how to decide and test whether to use document modes or Enterprise Mode to help fix compatibility issues. | -|[Remove sites from a local Enterprise Mode site list](remove-sites-from-a-local-enterprise-mode-site-list.md) |Guidance about how to remove websites from a device's local Enterprise Mode site list. | -|[Remove sites from a local compatibility view list](remove-sites-from-a-local-compatibililty-view-list.md) |Guidance about how to remove websites from a device's local compatibility view list. | -|[Turn off Enterprise Mode](turn-off-enterprise-mode.md) |Guidance about how to stop using your site list and how to turn off local control, using Group Policy or the registry. | - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company. +author: dansimp +ms.prod: ie11 +ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Enterprise Mode for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Use the topics in this section to learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. + +## In this section + +|Topic |Description | +|---------------------------------------------------------------|-----------------------------------------------------------------------------------| +|[Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)|Includes descriptions of the features of Enterprise Mode. | +|[Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) |Guidance about how to turn on local control of Enterprise Mode and how to use ASP or the GitHub sample to collect data from your local computers. | +|[Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) |Guidance about how to turn on Enterprise Mode and set up a site list, using Group Policy or the registry. | +|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | +|[Check for a new Enterprise Mode site list xml file](check-for-new-enterprise-mode-site-list-xml-file.md) |Guidance about how the Enterprise Mode functionality looks for your updated site list. | +|[Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) |Guidance about how to turn on local control of Enterprise Mode, using Group Policy or the registry.| +|[Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) |Guidance about how to use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | +|[Use the Enterprise Mode Site List Portal](use-the-enterprise-mode-portal.md) |Guidance about how to set up and use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | +|[Using Enterprise Mode](using-enterprise-mode.md) |Guidance about how to turn on either IE7 Enterprise Mode or IE8 Enterprise Mode. | +|[Fix web compatibility issues using document modes and the Enterprise Mode Site List](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) |Guidance about how to decide and test whether to use document modes or Enterprise Mode to help fix compatibility issues. | +|[Remove sites from a local Enterprise Mode site list](remove-sites-from-a-local-enterprise-mode-site-list.md) |Guidance about how to remove websites from a device's local Enterprise Mode site list. | +|[Remove sites from a local compatibility view list](remove-sites-from-a-local-compatibililty-view-list.md) |Guidance about how to remove websites from a device's local compatibility view list. | +|[Turn off Enterprise Mode](turn-off-enterprise-mode.md) |Guidance about how to stop using your site list and how to turn off local control, using Group Policy or the registry. | + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index 3e8e129b3d..6832c2797b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -1,236 +1,271 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. -author: lomayor -ms.prod: ie11 -ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enterprise Mode schema v.1 guidance - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Use the Enterprise Mode Site List Manager (schema v.1) to create and update your Enterprise Mode site list for devices running the v.1 version of the schema, or the Enterprise Mode Site List Manager (schema v.2) to create and update your Enterprise Mode site list for devices running the v.2 version of the schema. We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. - -## Enterprise Mode schema v.1 example -The following is an example of the Enterprise Mode schema v.1. This schema can run on devices running Windows 7 and Windows 8.1. - -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both https://contoso.com and https://contoso.com. - -``` xml - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -### Schema elements -This table includes the elements used by the Enterprise Mode schema. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ElementDescriptionSupported browser
<rules>Root node for the schema. -

Example -

-<rules version="205">
-  <emie>
-    <domain>contoso.com</domain>
-  </emie>
-</rules>
Internet Explorer 11 and Microsoft Edge
<emie>The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied. -

Example -

-<rules version="205">
-  <emie>
-    <domain>contoso.com</domain>
-  </emie>
-</rules>
--or- -

For IPv6 ranges:

<rules version="205">
-  <emie>
-    <domain>[10.122.34.99]:8080</domain>
-  </emie>
-  </rules>
--or- -

For IPv4 ranges:

<rules version="205">
-  <emie>
-    <domain>10.122.34.99:8080</domain>
-  </emie>
-  </rules>
Internet Explorer 11 and Microsoft Edge
<docMode>The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied. -

Example -

-<rules version="205">
-  <docMode>
-    <domain docMode="7">contoso.com</domain>
-  </docMode>
-</rules>
Internet Explorer 11
<domain>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element. -

Example -

-<emie>
-  <domain>contoso.com:8080</domain>
-</emie>
Internet Explorer 11 and Microsoft Edge
<path>A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section. -

Example -

-<emie>
-  <domain exclude="true">fabrikam.com
-    <path exclude="false">/products</path>
-  </domain>
-</emie>

-Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam.com/products does.

Internet Explorer 11 and Microsoft Edge
- -### Schema attributes -This table includes the attributes used by the Enterprise Mode schema. - - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeDescriptionSupported browser
<version>Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.Internet Explorer 11 and Microsoft Edge
<exclude>Specifies the domain or path excluded from applying the behavior and is supported on the <domain> and <path> elements. -

Example -

-<emie>
-  <domain exclude="false">fabrikam.com
-    <path exclude="true">/products</path>
-  </domain>
-</emie>

-Where https://fabrikam.com uses IE8 Enterprise Mode, but https://fabrikam.com/products does not.

Internet Explorer 11 and Microsoft Edge
<docMode>Specifies the document mode to apply. This attribute is only supported on <domain> or <path> elements in the <docMode> section. -

Example -

-<docMode>
-  <domain exclude="false">fabrikam.com
-    <path docMode="7">/products</path>
-  </domain>
-</docMode>
Internet Explorer 11
- -### Using Enterprise Mode and document mode together -If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain. - -For example, say you want all of the sites in the contoso.com domain to open using IE8 Enterprise Mode, except test.contoso.com, which needs to open in document mode 11. Because Enterprise Mode takes precedence over document mode, if you want test.contoso.com to open using document mode, you'll need to explicitly add it as an exclusion to the <emie> parent node. - -```xml - - - contoso.com - test.contoso.com - - - test.contoso.com - - -``` - -### What not to include in your schema -We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: -- Don’t use protocols. For example, `https://`, `https://`, or custom protocols. They break parsing. -- Don’t use wildcards. -- Don’t use query strings, ampersands break parsing. - -## How to use trailing slashes -You can use trailing slashes at the path-level, but not at the domain-level: -- **Domain-level.** Don’t add trailing slashes to a domain, it breaks parsing. -- **Path-level.** Adding a trailing slash to a path means that the path ends at that point. By not adding a trailing slash, the rule applies to all of the sub-paths. - -**Example** - -``` xml -contoso.com - /about/ - -``` -In this example, `contoso.com/about/careers` will use the default version of Internet Explorer, even though `contoso.com/about/` uses Enterprise Mode. - - -## How to target specific sites -If you want to target specific sites in your organization. - -|Targeted site |Example |Explanation | -|--------------|--------|------------| -|You can specify subdomains in the domain tag. |<docMode>
<domain docMode="5">contoso.com</domain>
<domain docMode="9">info.contoso.com</domain>
<docMode>
|

  • contoso.com uses document mode 5.
  • info.contoso.com uses document mode 9.
  • test.contoso.com also uses document mode 5.
| -|You can specify exact URLs by listing the full path. |<emie>
<domain exclude="false">bing.com</domain>
<domain exclude="false" forceCompatView="true">contoso.com</domain>
<emie>
|
  • bing.com uses IE8 Enterprise Mode.
  • contoso.com uses IE7 Enterprise Mode.
| -|You can nest paths underneath domains. |<emie>
<domain exclude="true">contoso.com
<path exclude="false">/about</path>
<path exclude="true">
/about/business</path>
</domain>
</emie>
|
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, except contoso.com/about/business, which will load in the default version of IE.
| -|You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored. |<emie>
<domain exclude="true">contoso.com
<path>/about
<path exclude="true">/business</path>
</path>
</domain>
</emie>
|
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
| +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. +author: dansimp +ms.prod: ie11 +ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Enterprise Mode schema v.1 guidance + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 + +Use the Enterprise Mode Site List Manager (schema v.1) to create and update your Enterprise Mode site list for devices running the v.1 version of the schema, or the Enterprise Mode Site List Manager (schema v.2) to create and update your Enterprise Mode site list for devices running the v.2 version of the schema. We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). + +If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. + +## Enterprise Mode schema v.1 example +The following is an example of the Enterprise Mode schema v.1. This schema can run on devices running Windows 7 and Windows 8.1. + +> [!IMPORTANT] +> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both http://contoso.com and https://contoso.com. + +```xml + + + www.cpandl.com + www.woodgrovebank.com + adatum.com + contoso.com + relecloud.com + /about + + fabrikam.com + /products + + + + contoso.com + /travel + + fabrikam.com + /products + + + +``` + +### Schema elements +This table includes the elements used by the Enterprise Mode schema. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ElementDescriptionSupported browser
<rules>Root node for the schema. +

Example +

+<rules version="205">
+  <emie>
+    <domain>contoso.com</domain>
+  </emie>
+</rules>
Internet Explorer 11 and Microsoft Edge
<emie>The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied. +

Example +

+<rules version="205">
+  <emie>
+    <domain>contoso.com</domain>
+  </emie>
+</rules>
+-or- +

For IPv6 ranges:

<rules version="205">
+  <emie>
+    <domain>[10.122.34.99]:8080</domain>
+  </emie>
+  </rules>
+-or- +

For IPv4 ranges:

<rules version="205">
+  <emie>
+    <domain>10.122.34.99:8080</domain>
+  </emie>
+  </rules>
Internet Explorer 11 and Microsoft Edge
<docMode>The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied. +

Example +

+<rules version="205">
+  <docMode>
+    <domain docMode="7">contoso.com</domain>
+  </docMode>
+</rules>
Internet Explorer 11
<domain>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element. +

Example +

+<emie>
+  <domain>contoso.com:8080</domain>
+</emie>
Internet Explorer 11 and Microsoft Edge
<path>A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section. +

Example +

+<emie>
+  <domain exclude="true">fabrikam.com
+    <path exclude="false">/products</path>
+  </domain>
+</emie>

+Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam.com/products does.

Internet Explorer 11 and Microsoft Edge
+ +### Schema attributes +This table includes the attributes used by the Enterprise Mode schema. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
AttributeDescriptionSupported browser
versionSpecifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.Internet Explorer 11 and Microsoft Edge
excludeSpecifies the domain or path excluded from applying Enterprise Mode. This attribute is only supported on the <domain> and <path> elements in the <emie> section. If this attribute is absent, it defaults to false. +
+

Example:

+
+<emie>
+  <domain exclude="false">fabrikam.com
+    <path exclude="true">/products</path>
+  </domain>
+</emie>

+Where https://fabrikam.com uses IE8 Enterprise Mode, but https://fabrikam.com/products does not.

Internet Explorer 11
docModeSpecifies the document mode to apply. This attribute is only supported on <domain> or <path> elements in the <docMode> section. +
+

Example:

+
+<docMode>
+  <domain>fabrikam.com
+    <path docMode="9">/products</path>
+  </domain>
+</docMode>

+Where https://fabrikam.com loads in IE11 document mode, but https://fabrikam.com/products uses IE9 document mode.

Internet Explorer 11
doNotTransitionSpecifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false. +
+

Example:

+
+<emie>
+  <domain doNotTransition="false">fabrikam.com
+    <path doNotTransition="true">/products</path>
+  </domain>
+</emie>

+Where https://fabrikam.com opens in the IE11 browser, but https://fabrikam.com/products loads in the current browser (eg. Microsoft Edge).

Internet Explorer 11 and Microsoft Edge
forceCompatViewSpecifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false. +
+

Example:

+
+<emie>
+  <domain exclude="true">fabrikam.com
+    <path forceCompatView="true">/products</path>
+  </domain>
+</emie>

+Where https://fabrikam.com does not use Enterprise Mode, but https://fabrikam.com/products uses IE7 Enterprise Mode.

Internet Explorer 11
+ +### Using Enterprise Mode and document mode together +If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain. + +For example, say you want all of the sites in the contoso.com domain to open using IE8 Enterprise Mode, except test.contoso.com, which needs to open in document mode 11. Because Enterprise Mode takes precedence over document mode, if you want test.contoso.com to open using document mode, you'll need to explicitly add it as an exclusion to the <emie> parent node. + +```xml + + + contoso.com + test.contoso.com + + + test.contoso.com + + +``` + +### What not to include in your schema +We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: +- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. +- Don’t use wildcards. +- Don’t use query strings, ampersands break parsing. + +## How to use trailing slashes +You can use trailing slashes at the path-level, but not at the domain-level: +- **Domain-level.** Don’t add trailing slashes to a domain, it breaks parsing. +- **Path-level.** Adding a trailing slash to a path means that the path ends at that point. By not adding a trailing slash, the rule applies to all of the sub-paths. + +**Example** + +```xml +contoso.com + /about/ + +``` +In this example, `contoso.com/about/careers` will use the default version of Internet Explorer, even though `contoso.com/about/` uses Enterprise Mode. + + +## How to target specific sites +If you want to target specific sites in your organization. + +|Targeted site |Example |Explanation | +|--------------|--------|------------| +|You can specify subdomains in the domain tag. |<docMode>
<domain docMode="5">contoso.com</domain>
<domain docMode="9">info.contoso.com</domain>
<docMode>
|
  • contoso.com uses document mode 5.
  • info.contoso.com uses document mode 9.
  • test.contoso.com also uses document mode 5.
| +|You can specify exact URLs by listing the full path. |<emie>
<domain exclude="false">bing.com</domain>
<domain exclude="false" forceCompatView="true">contoso.com</domain>
<emie>
|
  • bing.com uses IE8 Enterprise Mode.
  • contoso.com uses IE7 Enterprise Mode.
| +|You can nest paths underneath domains. |<emie>
<domain exclude="true">contoso.com
<path exclude="false">/about</path>
<path exclude="true">
/about/business</path>
</domain>
</emie>
|
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, except contoso.com/about/business, which will load in the default version of IE.
| +|You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored. |<emie>
<domain exclude="true">contoso.com
<path>/about
<path exclude="true">/business</path>
</path>
</domain>
</emie>
|
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
| diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md index 17e4e860cf..299c6c093f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md @@ -3,13 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -author: lomayor +author: dansimp ms.prod: ie11 ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 ms.reviewer: audience: itpro manager: dansimp -ms.author: lomayor +ms.author: dansimp title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 12/04/2017 @@ -18,6 +18,9 @@ ms.date: 12/04/2017 # Enterprise Mode schema v.2 guidance +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 @@ -26,8 +29,8 @@ ms.date: 12/04/2017 Use the Enterprise Mode Site List Manager to create and update your site list for devices running Windows 7, Windows 8.1, and Windows 10, using the version 2.0 (v.2) of the Enterprise Mode schema. If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. -**Important**
-If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). +> [!IMPORTANT] +> If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). ## Enterprise Mode schema v.2 updates Because of the schema changes, you can't combine the old version (v.1) with the new version (v.2) of the schema. If you look at your XML file, you can tell which version you're using by: @@ -41,24 +44,24 @@ You can continue to use the v.1 version of the schema on Windows 10, but you wo ### Enterprise Mode v.2 schema example The following is an example of the v.2 version of the Enterprise Mode schema. -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both https://contoso.com and https://contoso.com. +> [!IMPORTANT] +> Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both http://contoso.com and https://contoso.com. -``` xml +```xml - + EnterpriseSitelistManager 10240 20150728.135021 - + IE8Enterprise MSEdge - default + Default IE11 @@ -66,14 +69,15 @@ Make sure that you don't specify a protocol when adding your URLs. Using a URL l IE11 - default + Default IE11 - default - none + Default + None IE8Enterprise" + None IE7 @@ -214,7 +218,7 @@ In this example, if https://contoso.com and https://contoso.com. +Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both http://contoso.com and https://contoso.com.

Example

 <site url="contoso.com:8080">
@@ -232,26 +236,26 @@ These v.1 version schema attributes have been deprecated in the v.2 version of t
 
-
-
+
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -259,44 +263,43 @@ These v.1 version schema attributes have been deprecated in the v.2 version of t
 
Deprecated attributeNew attributeDeprecated element/attributeNew element Replacement example
<forceCompatView>forceCompatView <compat-mode>Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>Replace forceCompatView="true" with <compat-mode>IE7Enterprise</compat-mode>
<docMode>docMode <compat-mode>Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>Replace docMode="IE5" with <compat-mode>IE5</compat-mode>
<doNotTransition>doNotTransition <open-in>Replace <doNotTransition="true"> with <open-in>none</open-in>Replace doNotTransition="true" with <open-in>none</open-in>
<domain> and <path>Replace:
 <emie>
-  <domain exclude="false">contoso.com</domain>
+  <domain>contoso.com</domain>
 </emie>
With:
 <site url="contoso.com"/>
   <compat-mode>IE8Enterprise</compat-mode>
+  <open-in>IE11</open-in>
 </site>
-AND-

Replace:

 <emie>
-  <domain exclude="true">contoso.com
-     <path exclude="false" forceCompatView="true">/about</path>
+  <domain exclude="true" doNotTransition="true">
+    contoso.com
+    <path forceCompatView="true">/about</path>
   </domain>
 </emie>
With:
 <site url="contoso.com/about">
   <compat-mode>IE7Enterprise</compat-mode>
+  <open-in>IE11</open-in>
 </site>
While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features. -**Important**
-Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema. +> [!IMPORTANT] +> Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema. ### What not to include in your schema We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: -- Don’t use protocols. For example, https://, https://, or custom protocols. They break parsing. +- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. - Don’t use wildcards. - Don’t use query strings, ampersands break parsing. ## Related topics - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md index abb8513201..ce2f14b162 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md @@ -1,49 +1,53 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. -author: lomayor -ms.prod: ie11 -ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Export your Enterprise Mode site list from the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. This file includes all of your URLs, including your compatibility mode selections and should be stored somewhere safe. If your list gets deleted by mistake you can easily import this file and return everything back to when this file was last saved. - -**Important**
  -This file is not intended for distribution to your managed devices. Instead, it is only for transferring data and comments from one manager to another. For example, if one administrator leaves and passes the existing data to another administrator. Internet Explorer doesn’t read this file. - - **To export your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Export**. - -2. Export the file to your selected location. For example, `C:\Users\\Documents\sites.emie`. - -## Related topics - -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. +author: dansimp +ms.prod: ie11 +ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Export your Enterprise Mode site list from the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. This file includes all of your URLs, including your compatibility mode selections and should be stored somewhere safe. If your list gets deleted by mistake you can easily import this file and return everything back to when this file was last saved. + +**Important**
  +This file is not intended for distribution to your managed devices. Instead, it is only for transferring data and comments from one manager to another. For example, if one administrator leaves and passes the existing data to another administrator. Internet Explorer doesn’t read this file. + + **To export your compatibility list** + +1. On the **File** menu of the Enterprise Mode Site List Manager, click **Export**. + +2. Export the file to your selected location. For example, `C:\Users\\Documents\sites.emie`. + +## Related topics + +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md index a48b0e5732..a5abdb8400 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md @@ -1,109 +1,113 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site. -author: lomayor -ms.prod: ie11 -ms.assetid: 4b21bb27-aeac-407f-ae58-ab4c6db2baf6 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Fix web compatibility issues using document modes and the Enterprise Mode site list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix web compatibility issues using document modes and the Enterprise Mode site list -The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site. This addition to the site list is a continuation of our commitment to help you upgrade and stay up-to-date on the latest version of Internet Explorer, while still preserving your investments in existing apps. - -## What does this mean for me? -Enterprises can have critical apps that are coded explicitly for a specific browser version and that might not be in their direct control, making it very difficult and expensive to update to modern standards or newer browser versions. Because you can decide which URLs should open using specific document modes, this update helps ensure better compatibility, faster upgrades, and reduced testing and fixing costs. - -## How does this fix work? -You can continue to use your legacy and orphaned web apps, by specifying a document mode in the centralized Enterprise Mode site list. Then, when IE11 goes to a site on your list, the browser loads the page in the specified document mode just as it would if it were specified through an X-UA-Compatible meta tag on the site. For more information about document modes and X-UA-compatible headers, see [Defining document compatibility](https://go.microsoft.com/fwlink/p/?LinkId=518412). - -**Important**
-Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. - -### When do I use document modes versus Enterprise Mode? -While the `` functionality provides great compatibility for you on Windows Internet Explorer 8 or Windows Internet Explorer 7, the new `` capabilities can help you stay up-to-date regardless of which versions of IE are running in your environment. Because of this, we recommend starting your testing process like this: - -- If your enterprise primarily uses Internet Explorer 8 or Internet Explorer 7 start testing using Enterprise Mode. - -- If your enterprise primarily uses Windows Internet Explorer 9 or Internet Explorer 10, start testing using the various document modes. - -Because you might have multiple versions of IE deployed, you might need to use both Enterprise Mode and document modes to effectively move to IE11. - -### Test your sites for document mode compatibility -To see if this fix might help you, run through this process one step at a time, for each of your problematic sites: - -1. Go to a site having compatibility problems, press **F12** to open the **F12 Developer Tools**, and go to the **Emulation** tool. - - ![Emulation tool showing document mode selection](images/docmode-f12.png) - -2. Starting with the **11 (Default)** option, test your broken scenario.
-If that doesn’t work, continue down to the next lowest document mode, stopping as soon as you find a document mode that fixes your problems. For more information about the Emulation tool, see [Emulate browsers, screen sizes, and GPS locations](https://go.microsoft.com/fwlink/p/?LinkId=518417). - -3. If none of the document modes fix your issue, change the **Browser Profile** to **Enterprise**, pick the mode you want to test with starting with **8** (IE8 Enterprise Mode), and then test your broken scenario. - -### Add your site to the Enterprise Mode site list -After you’ve figured out the document mode that fixes your compatibility problems, you can add the site to your Enterprise Mode site list. - -**Note**
-There are two versions of the Enterprise Mode site list schema and the Enterprise Mode Site List Manager, based on your operating system. For more info about the schemas, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) or [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). For more info about the different site list management tools, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). - - **To add your site to the site list** - -1. Open the Enterprise Mode Site List Manager, and click **Add**. - - ![Enterprise Mode Site List Manager, showing the available modes](images/emie-listmgr.png) - -2. Add the **URL** and pick the document mode from the **Launch in** box. This should be the same document mode you found fixed your problems while testing the site.
-Similar to Enterprise Mode, you can specify a document mode for a particular web path—such as contoso.com/ERP—or at a domain level. In the above, the entire contoso.com domain loads in Enterprise Mode, while microsoft.com is forced to load into IE8 Document Mode and bing.com loads in IE11. - -**Note**
-For more information about Enterprise Mode, see [What is Enterprise Mode?](what-is-enterprise-mode.md) For more information about the Enterprise Mode Site List Manager and how to add sites to your site list, see [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). - - -### Review your Enterprise Mode site list -Take a look at your Enterprise Mode site list and make sure everything is the way you want it. The next step will be to turn the list on and start to use it in your company. The Enterprise Mode Site List Manager will look something like: - -![Enterprise Mode Site List Manager, showing the different modes](images/emie-sitelistmgr.png) - -And the underlying XML code will look something like: - -``` xml - - - bing.com/images - www.msn.com/news - - - - timecard - tar - msdn.microsoft.com - - -``` - -### Turn on Enterprise Mode and using your site list -If you haven’t already turned on Enterprise Mode for your company, you’ll need to do that. You can turn on Enterprise Mode using Group Policy or your registry. For specific instructions and details, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Turn off default Compatibility View for your intranet sites -By default, IE11 uses the **Display intranet sites in Compatibility View** setting. However, we’ve heard your feedback and know that you might want to turn this functionality off so you can continue to upgrade your web apps to more modern standards. - -To help you move forward, you can now use the Enterprise Mode site list to specify sites or web paths to use the IE7 document mode, which goes down to IE5 “Quirks” mode if the page doesn’t have an explicit `DOCTYPE` tag. Using this document mode effectively helps you provide the Compatibility View functionality for single sites or a group of sites, which after thorough testing, can help you turn off Compatibility View as the default setting for your intranet sites. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site. +author: dansimp +ms.prod: ie11 +ms.assetid: 4b21bb27-aeac-407f-ae58-ab4c6db2baf6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Fix web compatibility issues using document modes and the Enterprise Mode site list (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Fix web compatibility issues using document modes and the Enterprise Mode site list + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site. This addition to the site list is a continuation of our commitment to help you upgrade and stay up-to-date on the latest version of Internet Explorer, while still preserving your investments in existing apps. + +## What does this mean for me? +Enterprises can have critical apps that are coded explicitly for a specific browser version and that might not be in their direct control, making it very difficult and expensive to update to modern standards or newer browser versions. Because you can decide which URLs should open using specific document modes, this update helps ensure better compatibility, faster upgrades, and reduced testing and fixing costs. + +## How does this fix work? +You can continue to use your legacy and orphaned web apps, by specifying a document mode in the centralized Enterprise Mode site list. Then, when IE11 goes to a site on your list, the browser loads the page in the specified document mode just as it would if it were specified through an X-UA-Compatible meta tag on the site. For more information about document modes and X-UA-compatible headers, see [Defining document compatibility](https://go.microsoft.com/fwlink/p/?LinkId=518412). + +**Important**
+Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. + +### When do I use document modes versus Enterprise Mode? +While the `` functionality provides great compatibility for you on Windows Internet Explorer 8 or Windows Internet Explorer 7, the new `` capabilities can help you stay up-to-date regardless of which versions of IE are running in your environment. Because of this, we recommend starting your testing process like this: + +- If your enterprise primarily uses Internet Explorer 8 or Internet Explorer 7 start testing using Enterprise Mode. + +- If your enterprise primarily uses Windows Internet Explorer 9 or Internet Explorer 10, start testing using the various document modes. + +Because you might have multiple versions of IE deployed, you might need to use both Enterprise Mode and document modes to effectively move to IE11. + +### Test your sites for document mode compatibility +To see if this fix might help you, run through this process one step at a time, for each of your problematic sites: + +1. Go to a site having compatibility problems, press **F12** to open the **F12 Developer Tools**, and go to the **Emulation** tool. + + ![Emulation tool showing document mode selection](images/docmode-f12.png) + +2. Starting with the **11 (Default)** option, test your broken scenario.
+If that doesn’t work, continue down to the next lowest document mode, stopping as soon as you find a document mode that fixes your problems. For more information about the Emulation tool, see [Emulate browsers, screen sizes, and GPS locations](https://go.microsoft.com/fwlink/p/?LinkId=518417). + +3. If none of the document modes fix your issue, change the **Browser Profile** to **Enterprise**, pick the mode you want to test with starting with **8** (IE8 Enterprise Mode), and then test your broken scenario. + +### Add your site to the Enterprise Mode site list +After you’ve figured out the document mode that fixes your compatibility problems, you can add the site to your Enterprise Mode site list. + +**Note**
+There are two versions of the Enterprise Mode site list schema and the Enterprise Mode Site List Manager, based on your operating system. For more info about the schemas, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) or [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). For more info about the different site list management tools, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). + + **To add your site to the site list** + +1. Open the Enterprise Mode Site List Manager, and click **Add**. + + ![Enterprise Mode Site List Manager, showing the available modes](images/emie-listmgr.png) + +2. Add the **URL** and pick the document mode from the **Launch in** box. This should be the same document mode you found fixed your problems while testing the site.
+Similar to Enterprise Mode, you can specify a document mode for a particular web path—such as contoso.com/ERP—or at a domain level. In the above, the entire contoso.com domain loads in Enterprise Mode, while microsoft.com is forced to load into IE8 Document Mode and bing.com loads in IE11. + +**Note**
+For more information about Enterprise Mode, see [What is Enterprise Mode?](what-is-enterprise-mode.md) For more information about the Enterprise Mode Site List Manager and how to add sites to your site list, see [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). + + +### Review your Enterprise Mode site list +Take a look at your Enterprise Mode site list and make sure everything is the way you want it. The next step will be to turn the list on and start to use it in your company. The Enterprise Mode Site List Manager will look something like: + +![Enterprise Mode Site List Manager, showing the different modes](images/emie-sitelistmgr.png) + +And the underlying XML code will look something like: + +``` xml + + + bing.com/images + www.msn.com/news + + + + timecard + tar + msdn.microsoft.com + + +``` + +### Turn on Enterprise Mode and using your site list +If you haven’t already turned on Enterprise Mode for your company, you’ll need to do that. You can turn on Enterprise Mode using Group Policy or your registry. For specific instructions and details, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +## Turn off default Compatibility View for your intranet sites +By default, IE11 uses the **Display intranet sites in Compatibility View** setting. However, we’ve heard your feedback and know that you might want to turn this functionality off so you can continue to upgrade your web apps to more modern standards. + +To help you move forward, you can now use the Enterprise Mode site list to specify sites or web paths to use the IE7 document mode, which goes down to IE5 “Quirks” mode if the page doesn’t have an explicit `DOCTYPE` tag. Using this document mode effectively helps you provide the Compatibility View functionality for single sites or a group of sites, which after thorough testing, can help you turn off Compatibility View as the default setting for your intranet sites. + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md index 852ac4ae6c..54da1d4ba1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md @@ -1,48 +1,52 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: When you add multiple sites to your Enterprise Mode site list entries, they’re validated by the Enterprise Mode Site List Manager before they’re entered into your global list. -author: lomayor -ms.prod: ie11 -ms.assetid: 9f80e39f-dcf1-4124-8931-131357f31d67 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Fix validation problems using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix validation problems using the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -When you add multiple sites to your Enterprise Mode site list entries, they’re validated by the Enterprise Mode Site List Manager before they’re entered into your global list. If a site doesn’t pass validation, you’ll have a couple of options to address it. - -There are typically 3 types of errors you’ll see: - -- **Validation**. The site caused a validation error. Typically these occur because of typos, malformed URLs, or access-related issues. You can pick the site, click **Add to list** to ignore the problem and accept the site to your site list, or you can click **OK** to keep the site off of your site list. - -- **Duplicate**. The site already exists in the global compatibility list with a different compatibility mode. For example, the site was originally rendered in Enterprise Mode, but this update is for Default IE. You can pick the site, click **Add to list** to ignore the problem and accept the change to your site list, or you can click **OK** to keep your original compatibility mode. - -- **Redirection**. This is the least common type of validation error. Typically in this situation, a site redirects from an easy-to-remember URL to a longer URL. Like `\\tar` redirects to `\\timecard`. You can add the short URL or you can add both the short and long versions to your list.
-Another possibility is that redirection happens multiple times, with an intermediary site experiencing compatibility issues. For example, an employee types a short URL that then redirects multiple times, finally ending up on a non-intranet site. In this situation, you might want to add the intermediary URLs to your Enterprise Mode site list, in case there’s logic in one of them that has compatibility issues. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: When you add multiple sites to your Enterprise Mode site list entries, they’re validated by the Enterprise Mode Site List Manager before they’re entered into your global list. +author: dansimp +ms.prod: ie11 +ms.assetid: 9f80e39f-dcf1-4124-8931-131357f31d67 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Fix validation problems using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Fix validation problems using the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +When you add multiple sites to your Enterprise Mode site list entries, they’re validated by the Enterprise Mode Site List Manager before they’re entered into your global list. If a site doesn’t pass validation, you’ll have a couple of options to address it. + +There are typically 3 types of errors you’ll see: + +- **Validation**. The site caused a validation error. Typically these occur because of typos, malformed URLs, or access-related issues. You can pick the site, click **Add to list** to ignore the problem and accept the site to your site list, or you can click **OK** to keep the site off of your site list. + +- **Duplicate**. The site already exists in the global compatibility list with a different compatibility mode. For example, the site was originally rendered in Enterprise Mode, but this update is for Default IE. You can pick the site, click **Add to list** to ignore the problem and accept the change to your site list, or you can click **OK** to keep your original compatibility mode. + +- **Redirection**. This is the least common type of validation error. Typically in this situation, a site redirects from an easy-to-remember URL to a longer URL. Like `\\tar` redirects to `\\timecard`. You can add the short URL or you can add both the short and long versions to your list.
+Another possibility is that redirection happens multiple times, with an intermediary site experiencing compatibility issues. For example, an employee types a short URL that then redirects multiple times, finally ending up on a non-intranet site. In this situation, you might want to add the intermediary URLs to your Enterprise Mode site list, in case there’s logic in one of them that has compatibility issues. + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md index 859cf8fbb7..93486e7113 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md @@ -1,43 +1,47 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview about Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: 63a7ef4a-6de2-4d08-aaba-0479131e3406 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 -Advanced Group Policy Management (AGPM) is an add-on license that available for the Microsoft Desktop Optimization Pack (MDOP). This license gives you change control and a role assignment-model that helps optimize Group Policy management and reduce the risk of widespread failures. - -From AGPM you can: - -- **Edit GPOs outside of your production environment.** Your GPOs are stored in an outside archive for editing, reviewing, and approving. Then, when you deploy, AGPM moves the GPOs to your production environment. - -- **Assign roles to your employees.** You can assign 3 roles to your employees or groups, including: - - - **Reviewer.** Can view and compare GPOs in the archive. This role can't edit or deploy GPOs. - - - **Editor.** Can view, compare, check-in and out, and edit GPOs in the archive. This role can also request GPO deployment. - - - **Approver.** Can approve GPO creation and deployment to the production environment. - -- **Manage your GPO lifecycle with change control features.** You can use the available version-control, history, and auditing features to help you manage your GPOs while moving through your archive, to your editing process, and finally to your GPO deployment. - -**Note**
-For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/en-us/download/details.aspx?id=13975). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Overview about Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 63a7ef4a-6de2-4d08-aaba-0479131e3406 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Advanced Group Policy Management (AGPM) is an add-on license that available for the Microsoft Desktop Optimization Pack (MDOP). This license gives you change control and a role assignment-model that helps optimize Group Policy management and reduce the risk of widespread failures. + +From AGPM you can: + +- **Edit GPOs outside of your production environment.** Your GPOs are stored in an outside archive for editing, reviewing, and approving. Then, when you deploy, AGPM moves the GPOs to your production environment. + +- **Assign roles to your employees.** You can assign 3 roles to your employees or groups, including: + + - **Reviewer.** Can view and compare GPOs in the archive. This role can't edit or deploy GPOs. + + - **Editor.** Can view, compare, check-in and out, and edit GPOs in the archive. This role can also request GPO deployment. + + - **Approver.** Can approve GPO creation and deployment to the production environment. + +- **Manage your GPO lifecycle with change control features.** You can use the available version-control, history, and auditing features to help you manage your GPOs while moving through your archive, to your editing process, and finally to your GPO deployment. + +**Note**
+For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/download/details.aspx?id=13975). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md index 3c121b3e5e..e1e763af4c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md @@ -1,48 +1,52 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview about Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: ae3d227d-3da7-46b8-8a61-c71bfeae0c63 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 -A Microsoft Management Console (MMC)-based tool that uses scriptable interfaces to manage Group Policy. The 32-bit and 64-bit versions are included with Windows Server R2 with Service Pack 1 (SP1) and Windows Server 2012 R2. - -## Why use the GPMC? -The GPMC lets you: - -- Import, export, copy, paste, backup and restore GPOs. - -- Search for existing GPOs. - -- Create reports, including providing the Resultant Set of Policy (RSoP) data in HTML reports that you can save and print. - -- Use simulated RSoP data to prototype your Group Policy before implementing it in the production environment. - -- Obtain RSoP data to view your GPO interactions and to troubleshoot your Group Policy deployment. - -- Create migration tables to let you import and copy GPOs across domains and across forests. Migration tables are files that map references to users, groups, computers, and Universal Naming Convention (UNC) paths in the source GPO to new values in the destination GPO. - -- Create scriptable interfaces to support all of the operations available within the GPMC. You can't use scripts to edit individual policy settings in a GPO. - -For more information about the GPMC, see [Group Policy Management Console](https://go.microsoft.com/fwlink/p/?LinkId=214515) on TechNet. - -## Searching for Group Policy settings -To search for Group Policy settings in the Group Policy Management Console (GPMC), use the [Group Policy Search tool](https://go.microsoft.com/fwlink/p/?LinkId=279857). To find the Group Policy settings, click **Windows Components**, and then click **Internet Explorer**. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Overview about Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: ae3d227d-3da7-46b8-8a61-c71bfeae0c63 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +A Microsoft Management Console (MMC)-based tool that uses scriptable interfaces to manage Group Policy. The 32-bit and 64-bit versions are included with Windows Server R2 with Service Pack 1 (SP1) and Windows Server 2012 R2. + +## Why use the GPMC? +The GPMC lets you: + +- Import, export, copy, paste, backup and restore GPOs. + +- Search for existing GPOs. + +- Create reports, including providing the Resultant Set of Policy (RSoP) data in HTML reports that you can save and print. + +- Use simulated RSoP data to prototype your Group Policy before implementing it in the production environment. + +- Obtain RSoP data to view your GPO interactions and to troubleshoot your Group Policy deployment. + +- Create migration tables to let you import and copy GPOs across domains and across forests. Migration tables are files that map references to users, groups, computers, and Universal Naming Convention (UNC) paths in the source GPO to new values in the destination GPO. + +- Create scriptable interfaces to support all of the operations available within the GPMC. You can't use scripts to edit individual policy settings in a GPO. + +For more information about the GPMC, see [Group Policy Management Console](https://go.microsoft.com/fwlink/p/?LinkId=214515) on TechNet. + +## Searching for Group Policy settings +To search for Group Policy settings in the Group Policy Management Console (GPMC), use the [Group Policy Search tool](https://go.microsoft.com/fwlink/p/?LinkId=279857). To find the Group Policy settings, click **Windows Components**, and then click **Internet Explorer**. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md index 574b7f8895..7e8c419582 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md @@ -1,48 +1,52 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use the topics in this section to learn about Group Policy and how to use it to manage Internet Explorer. -author: lomayor -ms.prod: ie11 -ms.assetid: 50383d3f-9ac9-4a30-8852-354b6eb9434a -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy and Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and Internet Explorer 11 (IE11) - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn about Group Policy and how to use it to manage Internet Explorer. - -## In this section - -|Topic |Description | -|----------------------------------------------------|-----------------------------------------------------------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Info about many of the new group policy settings added for Internet Explorer 11. | -|[Group Policy management tools](group-policy-objects-and-ie11.md) |Guidance about how to use Microsoft Active Directory Domain Services (AD DS) to manage your Group Policy settings. | -|[ActiveX installation using group policy](activex-installation-using-group-policy.md) |Info about using the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. | -|[Group Policy and compatibility with Internet Explorer 11](group-policy-compatibility-with-ie11.md) |Our Group Policy recommendations for security, performance, and compatibility with previous versions of IE, regardless of which Zone the website is in. | -|[Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md) |Info about Group Policy preferences, as compared to Group Policy settings. | -|[Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md) |Info about Administrative Templates, including where to store them and the related Group Policy settings. | -|[Enable and disable add\-ons using administrative templates and group policy](enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) |Guidance about how to use your local Group Policy editor or the CLSID and Administrative Templates to manage your Group Policy objects. - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Use the topics in this section to learn about Group Policy and how to use it to manage Internet Explorer. +author: dansimp +ms.prod: ie11 +ms.assetid: 50383d3f-9ac9-4a30-8852-354b6eb9434a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy and Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy and Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Use the topics in this section to learn about Group Policy and how to use it to manage Internet Explorer. + +## In this section + +|Topic |Description | +|----------------------------------------------------|-----------------------------------------------------------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Info about many of the new group policy settings added for Internet Explorer 11. | +|[Group Policy management tools](group-policy-objects-and-ie11.md) |Guidance about how to use Microsoft Active Directory Domain Services (AD DS) to manage your Group Policy settings. | +|[ActiveX installation using group policy](activex-installation-using-group-policy.md) |Info about using the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. | +|[Group Policy and compatibility with Internet Explorer 11](group-policy-compatibility-with-ie11.md) |Our Group Policy recommendations for security, performance, and compatibility with previous versions of IE, regardless of which Zone the website is in. | +|[Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md) |Info about Group Policy preferences, as compared to Group Policy settings. | +|[Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md) |Info about Administrative Templates, including where to store them and the related Group Policy settings. | +|[Enable and disable add\-ons using administrative templates and group policy](enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) |Guidance about how to use your local Group Policy editor or the CLSID and Administrative Templates to manage your Group Policy objects. + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md index 36176c7bde..dce572d812 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md @@ -1,36 +1,40 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: 6fc30e91-efac-4ba5-9ee2-fa77dcd36467 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, the Local Group Policy Editor, and Internet Explorer 11 -A Microsoft Management Console (MMC)-based tool that manages both computer and user-related configurations for an individual computer policy. This tool is included with Windows® 7 Service Pack 1 (SP1) and Windows 8.1. - -Here's a list of the policy settings you can use, based on the configuration type. For more info, see [Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=294912). - -|Computer configuration |User configuration | -|-----------------------|-------------------| -|Windows settings:
  • Name Resolution policy
  • Scripts (Startup/Shutdown)
  • Deployed printers
  • Security settings
  • Policy-based Quality of Service (QoS)
|Windows settings:
  • Scripts (Startup/Shutdown)
  • Deployed printers
  • Security settings
  • Policy-based Quality of Service (QoS)

| -|Administrative templates:
  • Control Panel
  • Network
  • Printers
  • Server
  • System
  • Windows components
  • All settings

|Administrative templates:
  • Control Panel
  • Desktop
  • Network
  • Shared folders
  • Start menu and taskbar
  • System
  • Windows components
  • All settings
| - - -  - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 6fc30e91-efac-4ba5-9ee2-fa77dcd36467 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy, the Local Group Policy Editor, and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +A Microsoft Management Console (MMC)-based tool that manages both computer and user-related configurations for an individual computer policy. This tool is included with Windows® 7 Service Pack 1 (SP1) and Windows 8.1. + +Here's a list of the policy settings you can use, based on the configuration type. For more info, see [Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=294912). + +|Computer configuration |User configuration | +|-----------------------|-------------------| +|Windows settings:
  • Name Resolution policy
  • Scripts (Startup/Shutdown)
  • Deployed printers
  • Security settings
  • Policy-based Quality of Service (QoS)
|Windows settings:
  • Scripts (Startup/Shutdown)
  • Deployed printers
  • Security settings
  • Policy-based Quality of Service (QoS)

| +|Administrative templates:
  • Control Panel
  • Network
  • Printers
  • Server
  • System
  • Windows components
  • All settings

|Administrative templates:
  • Control Panel
  • Desktop
  • Network
  • Shared folders
  • Start menu and taskbar
  • System
  • Windows components
  • All settings
| + + +  + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md index 5e66dc9f4c..12b360b126 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Group Policy suggestions for compatibility with Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: 7482c99f-5d79-4344-9e1c-aea9f0a68e18 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and compatibility with Internet Explorer 11 -Internet Explorer 11 has many Group Policy entries that can be configured for keeping your environment managed and safe. This table includes all of our recommendations around security, performance, and compatibility with the previous versions of Internet Explorer, regardless of which Zone the website is in. - -|Activity |Location |Setting the policy object | -|---------------------------------|----------------------------------------------|-------------------------------------------------------------------------| -|Turn on Compatibility View for all intranet zones |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Turn on IE Standards Mode for local intranet** , and then click **Disabled**. | -|Turn on Compatibility View for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Windows Internet Explorer 7 sites** , and then click **Enabled**.Users will be able to add or remove sites manually to their local Compatibility View list, but they won’t be able to remove the sites you specifically added. | -|Turn on Quirks mode for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Quirks Mode sites**, and then click **Enabled**. | -|Ensure your users are using the most up-to-date version of Microsoft’s compatibility list. |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Include updated Web site lists from Microsoft**, and then click **Enabled**. | -|Restrict users from making security zone configuration changes. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel` |Double-click **Disable the Security Page**, and then click **Enabled**. | -|Control which security zone settings are applied to specific websites. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel\Security Page` |Double-click **Site to Zone Assignment List**, click **Enabled**, and then enter your list of websites and their applicable security zones. | -|Turn off Data Execution Prevention (DEP). |`Administrative Templates\ Windows Components\Internet Explorer\Security Features` |Double-click **Turn off Data Execution Prevention**, and then click **Enabled**. | - -  - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Group Policy suggestions for compatibility with Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 7482c99f-5d79-4344-9e1c-aea9f0a68e18 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy and compatibility with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Internet Explorer 11 has many Group Policy entries that can be configured for keeping your environment managed and safe. This table includes all of our recommendations around security, performance, and compatibility with the previous versions of Internet Explorer, regardless of which Zone the website is in. + +|Activity |Location |Setting the policy object | +|---------------------------------|----------------------------------------------|-------------------------------------------------------------------------| +|Turn on Compatibility View for all intranet zones |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Turn on IE Standards Mode for local intranet** , and then click **Disabled**. | +|Turn on Compatibility View for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Windows Internet Explorer 7 sites** , and then click **Enabled**.Users will be able to add or remove sites manually to their local Compatibility View list, but they won’t be able to remove the sites you specifically added. | +|Turn on Quirks mode for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Quirks Mode sites**, and then click **Enabled**. | +|Ensure your users are using the most up-to-date version of Microsoft’s compatibility list. |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Include updated Web site lists from Microsoft**, and then click **Enabled**. | +|Restrict users from making security zone configuration changes. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel` |Double-click **Disable the Security Page**, and then click **Enabled**. | +|Control which security zone settings are applied to specific websites. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel\Security Page` |Double-click **Site to Zone Assignment List**, click **Enabled**, and then enter your list of websites and their applicable security zones. | +|Turn off Data Execution Prevention (DEP). |`Administrative Templates\ Windows Components\Internet Explorer\Security Features` |Double-click **Turn off Data Execution Prevention**, and then click **Enabled**. | + +  + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md index 494906c975..3eafec01ac 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md @@ -1,55 +1,59 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview of the available Group Policy management tools -author: lomayor -ms.prod: ie11 -ms.assetid: e33bbfeb-6b80-4e71-8bba-1d0369a87312 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy management tools (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy management tools -Group Policy, based on Microsoft Active Directory Domain Services (AD DS), lets you manage your organization's computer and user settings as part of your Group Policy objects (GPOs), which are added and changed in the Group Policy Management Console (GPMC). GPOs can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. The most effective way to target a specific GPO is to use Windows Management Instrumentation (WMI) filters. Like, creating a WMI filter that applies a GPO only to computers with a specific make and model. - -By using Group Policy, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple Internet Explorer 11 security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. - -**Note**
   -For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. - -## Managing settings with GPOs -After deploying IE11 to your organization, you can continue to manage the browser settings by using Active Directory Domain Services (AD DS) together with the following Group Policy-related setting management groups: - -- [Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md). Used to manage registry-based policies and options. - -- [Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md). Used to set up and manage options that can be changed by the user after installation. - -**Note**
-Whenever possible, we recommend that you manage IE11 using Administrative Templates, because these settings are always written to secure policy branches in the registry. In addition, we recommend that you deploy using standard user accounts instead of letting your users log on to their computers as administrators. This helps to prevent your users from making unwanted changes to their systems or overriding Group Policy settings. - - -Users won't be able to use the IE11 user interface or the registry to change any managed settings on their computers. However, they will be able to change many of the preferences associated with the settings you set up using the Internet Explorer Administration Kit 11 (IEAK 11). - -## Which GPO tool should I use? -You can use any of these tools to create, manage, view, and troubleshoot Group Policy objects (GPOs). For information about each, see: - -- [Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11](group-policy-and-group-policy-mgmt-console-ie11.md). Provides a single location to manage all GPOs, WMI filters, and Group Policy–related permissions across multiple forests in an organization. - -- [Group Policy, the Local Group Policy Editor, and Internet Explorer 11](group-policy-and-local-group-policy-editor-ie11.md). Provides a user interface that lets you edit settings within individual GPOs. - -- [Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11](group-policy-and-advanced-group-policy-mgmt-ie11.md). An add-on license for the Microsoft Desktop Optimization Pack (MDOP) that helps to extend Group Policy for Software Assurance customers. - -- [Group Policy, Windows Powershell, and Internet Explorer 11](group-policy-windows-powershell-ie11.md). A command-line shell and scripting language that helps automate Windows and application administration on a single computer locally, or across many computers remotely. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Overview of the available Group Policy management tools +author: dansimp +ms.prod: ie11 +ms.assetid: e33bbfeb-6b80-4e71-8bba-1d0369a87312 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy management tools (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy management tools + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Group Policy, based on Microsoft Active Directory Domain Services (AD DS), lets you manage your organization's computer and user settings as part of your Group Policy objects (GPOs), which are added and changed in the Group Policy Management Console (GPMC). GPOs can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. The most effective way to target a specific GPO is to use Windows Management Instrumentation (WMI) filters. Like, creating a WMI filter that applies a GPO only to computers with a specific make and model. + +By using Group Policy, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple Internet Explorer 11 security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. + +**Note**
   +For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. + +## Managing settings with GPOs +After deploying IE11 to your organization, you can continue to manage the browser settings by using Active Directory Domain Services (AD DS) together with the following Group Policy-related setting management groups: + +- [Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md). Used to manage registry-based policies and options. + +- [Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md). Used to set up and manage options that can be changed by the user after installation. + +**Note**
+Whenever possible, we recommend that you manage IE11 using Administrative Templates, because these settings are always written to secure policy branches in the registry. In addition, we recommend that you deploy using standard user accounts instead of letting your users log on to their computers as administrators. This helps to prevent your users from making unwanted changes to their systems or overriding Group Policy settings. + + +Users won't be able to use the IE11 user interface or the registry to change any managed settings on their computers. However, they will be able to change many of the preferences associated with the settings you set up using the Internet Explorer Administration Kit 11 (IEAK 11). + +## Which GPO tool should I use? +You can use any of these tools to create, manage, view, and troubleshoot Group Policy objects (GPOs). For information about each, see: + +- [Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11](group-policy-and-group-policy-mgmt-console-ie11.md). Provides a single location to manage all GPOs, WMI filters, and Group Policy–related permissions across multiple forests in an organization. + +- [Group Policy, the Local Group Policy Editor, and Internet Explorer 11](group-policy-and-local-group-policy-editor-ie11.md). Provides a user interface that lets you edit settings within individual GPOs. + +- [Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11](group-policy-and-advanced-group-policy-mgmt-ie11.md). An add-on license for the Microsoft Desktop Optimization Pack (MDOP) that helps to extend Group Policy for Software Assurance customers. + +- [Group Policy, Windows Powershell, and Internet Explorer 11](group-policy-windows-powershell-ie11.md). A command-line shell and scripting language that helps automate Windows and application administration on a single computer locally, or across many computers remotely. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md index 473be60b15..938e3e036e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Info about Group Policy preferences versus Group Policy settings -author: lomayor -ms.prod: ie11 -ms.assetid: f2264c97-7f09-4f28-bb5c-58ab80dcc6ee -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group policy preferences and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group policy preferences and Internet Explorer 11 -Group Policy preferences are less strict than Group Policy settings, based on: - -| |Group Policy preferences |Group Policy settings | -|-----|-------------------------|----------------------| -|Enforcement |
  • Not enforced
  • Has the user interface turned on
  • Can only be refreshed or applied once
|
  • Enforced
  • Has the user interface turned off
  • Can be refreshed multiple times
| -|Flexibility |Lets you create preference items for registry settings, files, and folders. |
  • Requires app support
  • Needs you to create Administrative Templates for new policy settings
  • Won't let you create policy settings to manage files and folders
| -|Local Group Policy |Not available |Available -|Awareness |Supports apps that aren't Group Policy-aware |Requires apps to be Group Policy-aware | -|Storage |
  • Overwrites the original settings
  • Removing the preference doesn't restore the original setting
|
  • Doesn't overwrite the original settings
  • Stored in the Policy branches of the registry
  • Removing the setting restores the original setting
| -|Targeting and filtering |
  • Targeting is specific, with a user interface for each type of targeting item
  • Supports targeting at the individual preference item level
|
  • Filtering is based on Windows Management Instrumentation (WMI), and requires writing WMI queries
  • Supports filtering at the Group Policy Object (GPO) level
| - - -For more information about Group Policy preferences, see the [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=279876). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Info about Group Policy preferences versus Group Policy settings +author: dansimp +ms.prod: ie11 +ms.assetid: f2264c97-7f09-4f28-bb5c-58ab80dcc6ee +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group policy preferences and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group policy preferences and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Group Policy preferences are less strict than Group Policy settings, based on: + +| |Group Policy preferences |Group Policy settings | +|-----|-------------------------|----------------------| +|Enforcement |
  • Not enforced
  • Has the user interface turned on
  • Can only be refreshed or applied once
|
  • Enforced
  • Has the user interface turned off
  • Can be refreshed multiple times
| +|Flexibility |Lets you create preference items for registry settings, files, and folders. |
  • Requires app support
  • Needs you to create Administrative Templates for new policy settings
  • Won't let you create policy settings to manage files and folders
| +|Local Group Policy |Not available |Available +|Awareness |Supports apps that aren't Group Policy-aware |Requires apps to be Group Policy-aware | +|Storage |
  • Overwrites the original settings
  • Removing the preference doesn't restore the original setting
|
  • Doesn't overwrite the original settings
  • Stored in the Policy branches of the registry
  • Removing the setting restores the original setting
| +|Targeting and filtering |
  • Targeting is specific, with a user interface for each type of targeting item
  • Supports targeting at the individual preference item level
|
  • Filtering is based on Windows Management Instrumentation (WMI), and requires writing WMI queries
  • Supports filtering at the Group Policy Object (GPO) level
| + + +For more information about Group Policy preferences, see the [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=279876). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md index 65ae07a3ce..26cf3ae659 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md @@ -1,29 +1,33 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Links to troubleshooting topics and log files that can help address Group Policy problems with Internet Explorer 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 0da0d9a9-200c-46c4-96be-630e82de017b -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy problems with Internet Explorer 11 -If you're having problems with Group Policy and Internet Explorer 11, or if you're looking for high-level information about the concepts and techniques used to troubleshoot Group Policy, as well as links to detailed reference topics, procedures, and troubleshooting scenario guides, see [Group Policy Analysis and Troubleshooting Overview](https://go.microsoft.com/fwlink/p/?LinkId=279872). - -## Group Policy Object-related Log Files -You can use the Event Viewer to review Group Policy-related messages in the **Windows Logs**, **System** file. All of the Group Policy-related events are shown with a source of **GroupPolicy**. For more information about the Event Viewer, see [What information appears in event logs? (Event Viewer)](https://go.microsoft.com/fwlink/p/?LinkId=294917). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Links to troubleshooting topics and log files that can help address Group Policy problems with Internet Explorer 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 0da0d9a9-200c-46c4-96be-630e82de017b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +If you're having problems with Group Policy and Internet Explorer 11, or if you're looking for high-level information about the concepts and techniques used to troubleshoot Group Policy, as well as links to detailed reference topics, procedures, and troubleshooting scenario guides, see [Group Policy Analysis and Troubleshooting Overview](https://go.microsoft.com/fwlink/p/?LinkId=279872). + +## Group Policy Object-related Log Files +You can use the Event Viewer to review Group Policy-related messages in the **Windows Logs**, **System** file. All of the Group Policy-related events are shown with a source of **GroupPolicy** + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md index 7c53292112..cd9e8a1740 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md @@ -1,49 +1,53 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Instructions about how to create and configure shortcut preference extensions to file system objects, URLs, and shell objects. -author: lomayor -ms.prod: ie11 -ms.assetid: c6fbf990-13e4-4be7-9f08-5bdd43179b3b -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy, Shortcut Extensions, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, Shortcut Extensions, and Internet Explorer 11 -Group Policy includes the Shortcuts preference extension, which lets you configure shortcuts to: - -- **File system objects.** Traditional shortcuts that link to apps, files, folders, drives, shares, or computers. For example, linking a shortcut to an app from the **Start** screen. - -- **URLs.** Shortcuts to webpages or FTP sites. For example, a link to your intranet site from your employee's **Favorites** folder. - -- **Shell objects.** Shortcuts to objects that appear in the shell namespace, such as printers, desktop items, Control Panel items, the Recycle Bin, and so on. - -## How do I configure shortcuts? -You can create and configure shortcuts for any domain-based Group Policy Object (GPO) in the Group Policy Management Console (GPMC). - - **To create a new Shortcut preference item** - -1. Open GPMC, right-click the Group Policy object that needs the new shortcut extension, and click **Edit**. - -2. From **Computer Configuration** or **User Configuration**, go to **Preferences**, and then go to **Windows Settings**. - -3. Right-click **Shortcuts**, click **New**, and then choose **Shortcut**. - -4. Choose what the shortcut should do, including **Create**, **Delete**, **Replace**, or **Update**. - -5. Type the required shortcut settings and your comments into the **Description** box, and click **OK**. - -For more information about shortcut extensions, including step-by-step guidance, see [Shortcuts Extension](https://go.microsoft.com/fwlink/p/?LinkId=214525) and [Configure a Shortcut Item](https://go.microsoft.com/fwlink/p/?LinkId=301837). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Instructions about how to create and configure shortcut preference extensions to file system objects, URLs, and shell objects. +author: dansimp +ms.prod: ie11 +ms.assetid: c6fbf990-13e4-4be7-9f08-5bdd43179b3b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy, Shortcut Extensions, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy, Shortcut Extensions, and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Group Policy includes the Shortcuts preference extension, which lets you configure shortcuts to: + +- **File system objects.** Traditional shortcuts that link to apps, files, folders, drives, shares, or computers. For example, linking a shortcut to an app from the **Start** screen. + +- **URLs.** Shortcuts to webpages or FTP sites. For example, a link to your intranet site from your employee's **Favorites** folder. + +- **Shell objects.** Shortcuts to objects that appear in the shell namespace, such as printers, desktop items, Control Panel items, the Recycle Bin, and so on. + +## How do I configure shortcuts? +You can create and configure shortcuts for any domain-based Group Policy Object (GPO) in the Group Policy Management Console (GPMC). + + **To create a new Shortcut preference item** + +1. Open GPMC, right-click the Group Policy object that needs the new shortcut extension, and click **Edit**. + +2. From **Computer Configuration** or **User Configuration**, go to **Preferences**, and then go to **Windows Settings**. + +3. Right-click **Shortcuts**, click **New**, and then choose **Shortcut**. + +4. Choose what the shortcut should do, including **Create**, **Delete**, **Replace**, or **Update**. + +5. Type the required shortcut settings and your comments into the **Description** box, and click **OK**. + +For more information about shortcut extensions, including step-by-step guidance, see [Shortcuts Extension](https://go.microsoft.com/fwlink/p/?LinkId=214525) and [Configure a Shortcut Item](https://go.microsoft.com/fwlink/p/?LinkId=301837). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md index dcea0b00e6..6f57e982ec 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview about how Group Policy works with Windows Powershell and Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: e3607cde-a498-4e04-9daa-b331412967fc -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Group Policy, Windows Powershell, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, Windows Powershell, and Internet Explorer 11 -Your domain-joined Group Policy Objects (GPOs) can use any of Group Policy-related “cmdlets” that run within Windows PowerShell. - -Each cmdlet is a single-function command-line tool that can: - -- Create, edit, remove, back up, and import GPOs. - -- Create, update, and remove Group Policy links. - -- Set inheritance flags and permissions on organizational units (OU) and domains. - -- Configure registry-based policy settings and registry settings for Group Policy preferences. - -For more info about PowerShell and Group Policy management, see [Use Windows PowerShell to Manage Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=276828). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Overview about how Group Policy works with Windows Powershell and Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: e3607cde-a498-4e04-9daa-b331412967fc +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Group Policy, Windows Powershell, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy, Windows Powershell, and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Your domain-joined Group Policy Objects (GPOs) can use any of Group Policy-related “cmdlets” that run within Windows PowerShell. + +Each cmdlet is a single-function command-line tool that can: + +- Create, edit, remove, back up, and import GPOs. + +- Create, update, and remove Group Policy links. + +- Set inheritance flags and permissions on organizational units (OU) and domains. + +- Configure registry-based policy settings and registry settings for Group Policy preferences. + +For more info about PowerShell and Group Policy management, see [Use Windows PowerShell to Manage Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=276828). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md index 4e3fdb4baa..edcb50cb9e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md +++ b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md @@ -1,142 +1,146 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: -author: lomayor -ms.author: lomayor -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -title: Internet Explorer 11 delivery through automatic updates -ms.sitesec: library -ms.date: 05/22/2018 ---- - -# Internet Explorer 11 delivery through automatic updates -Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. - -- [Automatic updates delivery process](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#automatic-updates-delivery-process) - -- [Internet Explorer 11 automatic upgrades](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#internet-explorer-11-automatic-upgrades) - -- [Options for blocking automatic delivery](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#options-for-blocking-automatic-delivery) - -- [Availability of Internet Explorer 11](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#availability-of-internet-explorer-11) - -- [Prevent automatic installation of Internet Explorer 11 with WSUS](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#prevent-automatic-installation-of-internet-explorer-11-with-wsus) - -## Automatic updates delivery process - -Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11 -to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their -current version of Internet Explorer. - -Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel. - ->[!Note] ->If a user installs Internet Explorer 11 and then removes it, it won’t be re-offered to that computer through Automatic Updates. Instead, the user will have to manually re-install the app. - -## Internet Explorer 11 automatic upgrades - -Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11. - -Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update. - -## Options for blocking automatic delivery - -If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following: - -- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). - - >[!Note] - >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.md). - -- **Use an update management solution to control update deployment.** - If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit. - - >[!Note] - >If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. This scenario is discussed in detail in the Knowledge Base article [here](https://support.microsoft.com/kb/946202). - -Additional information on Internet Explorer 11, including a Readiness Toolkit, technical overview, in-depth feature summary, and Internet Explorer 11 download is available on the [Internet Explorer 11 page of the Microsoft Edge IT Center](https://technet.microsoft.com/microsoft-edge/dn262703.aspx). - -## Availability of Internet Explorer 11 - -Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the System Center Configuration Manager, Microsoft Systems Management Server, and WSUS. - -## Prevent automatic installation of Internet Explorer 11 with WSUS - -Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to: - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft - Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves an update that is classified as - Update Rollup, and then click **Edit.** - - >[!Note] - >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - - >[!Note] - >The properties for this rule will resemble the following:
  • When an update is in Update Rollups
  • Approve the update for all computers
- -6. Clear the **Update Rollup** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box.

After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed. - -8. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -9. Expand *ComputerName*, and then click **Synchronizations**. - -10. Click **Synchronize Now**. - -11. Expand *ComputerName*, expand **Updates**, and then click **All Updates**. - -12. Choose **Unapproved** in the **Approval**drop down box. - -13. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update. - - >[!Note] - >There may be multiple updates, depending on the imported language and operating system updates. - -**Optional** - -If you need to reset your Update Rollups packages to auto-approve, do this: - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves updates of different classifications, and then click **Edit**. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - -6. Check the **Update Rollups** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box. - ->[!Note] ->Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved. - - -## Additional resources - -- [Automatic delivery process](what-is-the-internet-explorer-11-blocker-toolkit.md#automatic-delivery-process) - -- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) - -- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) - -- [Internet Explorer 11 delivery through automatic updates](https://technet.microsoft.com/microsoft-edge/dn449235) - -- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +ms.pagetype: security +description: +author: dansimp +ms.author: dansimp +ms.manager: dansimp +ms.prod: ie11 +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +title: Internet Explorer 11 delivery through automatic updates +ms.sitesec: library +ms.date: 05/22/2018 +--- + +# Internet Explorer 11 delivery through automatic updates + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. + +- [Automatic updates delivery process](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#automatic-updates-delivery-process) + +- [Internet Explorer 11 automatic upgrades](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#internet-explorer-11-automatic-upgrades) + +- [Options for blocking automatic delivery](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#options-for-blocking-automatic-delivery) + +- [Availability of Internet Explorer 11](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#availability-of-internet-explorer-11) + +- [Prevent automatic installation of Internet Explorer 11 with WSUS](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#prevent-automatic-installation-of-internet-explorer-11-with-wsus) + +## Automatic updates delivery process + +Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11 +to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their +current version of Internet Explorer. + +Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel. + +> [!NOTE] +> If a user installs Internet Explorer 11 and then removes it, it won’t be re-offered to that computer through Automatic Updates. Instead, the user will have to manually re-install the app. + +## Internet Explorer 11 automatic upgrades + +Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11. + +Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update. + +## Options for blocking automatic delivery + +If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following: + +- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). + + > [!NOTE] + > The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.md). + +- **Use an update management solution to control update deployment.** + If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [Microsoft Endpoint Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit. + + > [!NOTE] + > If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. This scenario is discussed in detail in the Knowledge Base article [here](https://support.microsoft.com/kb/946202). + +Additional information on Internet Explorer 11, including a Readiness Toolkit, technical overview, in-depth feature summary, and Internet Explorer 11 download is available on the [Internet Explorer 11 page of the Microsoft Edge IT Center](https://technet.microsoft.com/microsoft-edge/dn262703.aspx). + +## Availability of Internet Explorer 11 + +Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the Microsoft Endpoint Configuration Manager and WSUS. + +## Prevent automatic installation of Internet Explorer 11 with WSUS + +Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to: + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft + Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Options**. + +3. Click **Automatic Approvals**. + +4. Click the rule that automatically approves an update that is classified as + Update Rollup, and then click **Edit.** + + > [!NOTE] + > If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else. + +5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. + + > [!NOTE] + > The properties for this rule will resemble the following:

  • When an update is in Update Rollups
  • Approve the update for all computers
+ +6. Clear the **Update Rollup** check box, and then click **OK**. + +7. Click **OK** to close the **Automatic Approvals** dialog box.

After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed. + +8. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +9. Expand *ComputerName*, and then click **Synchronizations**. + +10. Click **Synchronize Now**. + +11. Expand *ComputerName*, expand **Updates**, and then click **All Updates**. + +12. Choose **Unapproved** in the **Approval** drop down box. + +13. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update. + + > [!NOTE] + > There may be multiple updates, depending on the imported language and operating system updates. + +**Optional** + +If you need to reset your Update Rollups packages to auto-approve, do this: + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Options**. + +3. Click **Automatic Approvals**. + +4. Click the rule that automatically approves updates of different classifications, and then click **Edit**. + +5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. + +6. Check the **Update Rollups** check box, and then click **OK**. + +7. Click **OK** to close the **Automatic Approvals** dialog box. + +> [!NOTE] +> Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved. + + +## Additional resources + +- [Automatic delivery process](what-is-the-internet-explorer-11-blocker-toolkit.md#automatic-delivery-process) + +- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) + +- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) + +- [Internet Explorer 11 delivery through automatic updates](https://technet.microsoft.com/microsoft-edge/dn449235) + +- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/configmgrhardwareinventory.png b/browsers/internet-explorer/ie11-deploy-guide/images/configmgrhardwareinventory.png index d2508016be..7626296e87 100644 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/configmgrhardwareinventory.png and b/browsers/internet-explorer/ie11-deploy-guide/images/configmgrhardwareinventory.png differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md index 48331957e3..30de0a2c97 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md +++ b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md @@ -1,16 +1,22 @@ ---- -description: A full-sized view of how document modes are chosen in IE11. -title: Full-sized flowchart detailing how document modes are chosen in IE11 -author: lomayor -ms.date: 04/19/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
- -

- Full-sized flowchart detailing how document modes are chosen in IE11 -

- +--- +description: A full-sized view of how document modes are chosen in IE11. +title: Full-sized flowchart detailing how document modes are chosen in IE11 +author: dansimp +ms.date: 04/19/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Full-sized flowchart detailing how document modes are chosen in IE11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
+ +

+ Full-sized flowchart detailing how document modes are chosen in IE11 +

+ diff --git a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md index add9fe0016..f585e3210d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md @@ -1,50 +1,54 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. -author: lomayor -ms.prod: ie11 -ms.assetid: cacd5d68-700b-4a96-b4c9-ca2c40c1ac5f -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Import your Enterprise Mode site list to the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Import your Enterprise Mode site list to the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. - -**Important**   -Importing your file overwrites everything that’s currently in the tool, so make sure it’s what you really mean to do. - - **To import your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Import**. - -2. Go to your exported .EMIE file (for example, `C:\users\\documents\sites.emie`), and then click **Open**. - -3. Review the alert message about all of your entries being overwritten. If you still want to import the file, click **Yes**. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. +author: dansimp +ms.prod: ie11 +ms.assetid: cacd5d68-700b-4a96-b4c9-ca2c40c1ac5f +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Import your Enterprise Mode site list to the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Import your Enterprise Mode site list to the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. + +**Important**   +Importing your file overwrites everything that’s currently in the tool, so make sure it’s what you really mean to do. + + **To import your compatibility list** + +1. On the **File** menu of the Enterprise Mode Site List Manager, click **Import**. + +2. Go to your exported .EMIE file (for example, `C:\users\\documents\sites.emie`), and then click **Open**. + +3. Review the alert message about all of your entries being overwritten. If you still want to import the file, click **Yes**. + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/index.md b/browsers/internet-explorer/ie11-deploy-guide/index.md index 6d5935a29b..c40ba230ff 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/index.md +++ b/browsers/internet-explorer/ie11-deploy-guide/index.md @@ -1,18 +1,22 @@ --- ms.mktglfcycl: deploy description: Use this guide to learn about the several options and processes you'll need to consider while you're planning for, deploying, and customizing Internet Explorer 11 for your employee's devices. -author: shortpatti +author: dansimp +ms.author: dansimp ms.prod: ie11 ms.assetid: bddc2d97-c38d-45c5-9588-1f5bbff2e9c3 title: Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.localizationpriority: medium -ms.date: 07/27/2017 +manager: dansimp --- # Internet Explorer 11 (IE11) - Deployment Guide for IT Pros +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md index f5e959c3c4..47a4d07569 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md @@ -1,44 +1,48 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. -author: lomayor -ms.prod: ie11 -ms.assetid: caca18c1-d5c4-4404-84f8-d02bc562915f -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install and Deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install and Deploy Internet Explorer 11 (IE11) - -**Applies to:** - -- Windows 10 -- Windows 8.1 Update -- Windows 7 with Service Pack 1 (SP1) -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. You can also find more info about your virtualization options for legacy apps. - -## In this section - -|Topic |Description | -|------|------------| -|[Customize Internet Explorer 11 installation packages](customize-ie11-install-packages.md) |Guidance about how to use .INF files or the IE Administration Kit 11 (IEAK 11) to create custom packages and about how to create those packages for multiple operating systems. | -|[Choose how to install Internet Explorer 11 (IE11)](choose-how-to-install-ie11.md) |Guidance for the different ways you can install IE, including using System Center 2012 R2 Configuration Manager, Windows Server Update Services (WSUS), Microsoft Intune, your network, the operating system deployment system, or third-party tools. | -|[Choose how to deploy Internet Explorer 11 (IE11)](choose-how-to-deploy-ie11.md) |Guidance about how to deploy your custom version of IE using Automatic Version Synchronization (AVS) or using your software distribution tools. | -|[Virtualization and compatibility with Internet Explorer 11](virtualization-and-compatibility-with-ie11.md) |Info about the Microsoft-supported options for virtualizing web apps. | - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. +author: dansimp +ms.prod: ie11 +ms.assetid: caca18c1-d5c4-4404-84f8-d02bc562915f +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Install and Deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install and Deploy Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 Update +- Windows 7 with Service Pack 1 (SP1) +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. You can also find more info about your virtualization options for legacy apps. + +## In this section + +|Topic |Description | +|------|------------| +|[Customize Internet Explorer 11 installation packages](customize-ie11-install-packages.md) |Guidance about how to use .INF files or the IE Administration Kit 11 (IEAK 11) to create custom packages and about how to create those packages for multiple operating systems. | +|[Choose how to install Internet Explorer 11 (IE11)](choose-how-to-install-ie11.md) |Guidance for the different ways you can install IE, including using System Center 2012 R2 Configuration Manager, Windows Server Update Services (WSUS), Microsoft Intune, your network, the operating system deployment system, or third-party tools. | +|[Choose how to deploy Internet Explorer 11 (IE11)](choose-how-to-deploy-ie11.md) |Guidance about how to deploy your custom version of IE using Automatic Version Synchronization (AVS) or using your software distribution tools. | +|[Virtualization and compatibility with Internet Explorer 11](virtualization-and-compatibility-with-ie11.md) |Info about the Microsoft-supported options for virtualizing web apps. | + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md index 25226f2ad0..027cf25129 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md @@ -2,12 +2,12 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: How to add and deploy the Internet Explorer 11 update using Microsoft Intune. -author: lomayor +author: dansimp ms.prod: ie11 ms.assetid: b2dfc08c-78af-4c22-8867-7be3b92b1616 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp title: Install Internet Explorer 11 (IE11) using Microsoft Intune (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -15,6 +15,9 @@ ms.date: 07/27/2017 # Install Internet Explorer 11 (IE11) using Microsoft Intune + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Internet Explorer 11 is available as an update in Microsoft Intune. Microsoft Intune uses Windows cloud services to help you manage updates, monitor and protect your computers, provide remote assistance, track hardware and software inventory, and set security policies. For more information, see the [Documentation Library for Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301805). ## Adding and deploying the IE11 package diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md index 5046293535..c6bd4e15e8 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md @@ -1,59 +1,63 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using Microsoft Deployment Toolkit (MDT) and your Windows images. -author: lomayor -ms.prod: ie11 -ms.assetid: e16f9144-170c-4964-a62d-0d1a16f4cd1f -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images - -You can install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images. - -You'll need to extract the .cab file for each supported operating system and platform combination and the .msu file for each prerequisite update. Download the IE11 update and prerequisites here: - -- [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=279697) - -- [Microsoft Update Catalog](https://go.microsoft.com/fwlink/p/?LinkId=214287) - -After you install the .msu file updates, you'll need to add them to your MDT deployment. You'll also need to extract the IE11 .cab update file from the IE11 installation package, using the `/x` command-line option. For example, `IE11-Windows6.1-x64-en-us.exe /x:c:\ie11cab`. - -## Installing IE11 using Microsoft Deployment Toolkit (MDT) - -MDT adds IE11 to your Windows images, regardless whether you are creating or deploying a customized or non-customized image. MDT also lets you perform offline servicing during the System Center 2012 R2 Configuration Manager task sequence, letting you add IE11 before starting Windows. For info, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?linkid=331148). - - **To add IE11 to a MDT deployment share** - -1. Right-click **Packages** from each **Deployment Shares** location, and then click **Import OS Packages**. - -2. Go to the **Specify Directory** page, search for your folder with your update files (.cab and .msu) for import, and click **Next**. - -3. Go to the **Summary** page and click **Next**.

-MDT starts importing your update files.

**Note**
Ignore any warnings that say, "Skipping invalid CAB file". This shows up because the **Import OS Packages** wizard skips the IE11\_Support.cab file, which isn't an actual update file. - -4. After the import finishes, click **Finish**. - -### Offline servicing with MDT - -You can add the IE11 update while you're performing offline servicing, or slipstreaming, of your Windows images. This method lets you deploy IE11 without needing any additional installation after you've deployed Windows. - -These articles have step-by-step details about adding packages to your Windows images: - -- For Windows 8.1, see [Add or Remove Packages Offline Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=276791). - -- For Windows 7 SP1, see [Add or Remove Packages Offline](https://go.microsoft.com/fwlink/p/?LinkId=214490). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to install the Internet Explorer 11 update using Microsoft Deployment Toolkit (MDT) and your Windows images. +author: dansimp +ms.prod: ie11 +ms.assetid: e16f9144-170c-4964-a62d-0d1a16f4cd1f +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +You can install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images. + +You'll need to extract the .cab file for each supported operating system and platform combination and the .msu file for each prerequisite update. Download the IE11 update and prerequisites here: + +- [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=279697) + +- [Microsoft Update Catalog](https://go.microsoft.com/fwlink/p/?LinkId=214287) + +After you install the .msu file updates, you'll need to add them to your MDT deployment. You'll also need to extract the IE11 .cab update file from the IE11 installation package, using the `/x` command-line option. For example, `IE11-Windows6.1-x64-en-us.exe /x:c:\ie11cab`. + +## Installing IE11 using Microsoft Deployment Toolkit (MDT) + +MDT adds IE11 to your Windows images, regardless whether you are creating or deploying a customized or non-customized image. MDT also lets you perform offline servicing during the System Center 2012 R2 Configuration Manager task sequence, letting you add IE11 before starting Windows. For info, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?linkid=331148). + + **To add IE11 to a MDT deployment share** + +1. Right-click **Packages** from each **Deployment Shares** location, and then click **Import OS Packages**. + +2. Go to the **Specify Directory** page, search for your folder with your update files (.cab and .msu) for import, and click **Next**. + +3. Go to the **Summary** page and click **Next**.

+MDT starts importing your update files.

**Note**
Ignore any warnings that say, "Skipping invalid CAB file". This shows up because the **Import OS Packages** wizard skips the IE11\_Support.cab file, which isn't an actual update file. + +4. After the import finishes, click **Finish**. + +### Offline servicing with MDT + +You can add the IE11 update while you're performing offline servicing, or slipstreaming, of your Windows images. This method lets you deploy IE11 without needing any additional installation after you've deployed Windows. + +These articles have step-by-step details about adding packages to your Windows images: + +- For Windows 8.1, see [Add or Remove Packages Offline Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=276791). + +- For Windows 7 SP1, see [Add or Remove Packages Offline](https://go.microsoft.com/fwlink/p/?LinkId=214490). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md index 4d91b89af4..e08ca5dffe 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: How to install the Internet Explorer 11 update using System Center 2012 R2 Configuration Manager -author: lomayor -ms.prod: ie11 -ms.assetid: 9ede9722-29b3-4cb7-956d-ffa91e7bedbd -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager -You can install Internet Explorer 11 (IE11) by using [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?linkid=276664). Complete these steps for each operating system and platform combination. - - **To install IE11** - -1. Download and approve the [System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md). - -2. Create a software distribution package that includes the IE11 installation package. - -3. Create a program that includes the command-line needed to run the IE11 installation package. To run the package silently, without restarting and without checking the Internet for updates, use:`ie11_package.exe /quiet /norestart /update-no`. - -4. Move the installation package to your distribution points, and then advertise the package. - -You can also use System Center Essentials 2010 to deploy IE11 installation packages. For info, see [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?linkid=395200) and the [System Center Essentials 2010 Operations Guide](https://go.microsoft.com/fwlink/p/?LinkId=214266). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: How to install the Internet Explorer 11 update using System Center 2012 R2 Configuration Manager +author: dansimp +ms.prod: ie11 +ms.assetid: 9ede9722-29b3-4cb7-956d-ffa91e7bedbd +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You can install Internet Explorer 11 (IE11) by using [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?linkid=276664). Complete these steps for each operating system and platform combination. + + **To install IE11** + +1. Download and approve the [System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md). + +2. Create a software distribution package that includes the IE11 installation package. + +3. Create a program that includes the command-line needed to run the IE11 installation package. To run the package silently, without restarting and without checking the Internet for updates, use:`ie11_package.exe /quiet /norestart /update-no`. + +4. Move the installation package to your distribution points, and then advertise the package. + +You can also use System Center Essentials 2010 to deploy IE11 installation packages. For info, see [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?linkid=395200) and the [System Center Essentials 2010 Operations Guide](https://go.microsoft.com/fwlink/p/?LinkId=214266). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md index 2dfe51cdf9..d0d9d17be1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md @@ -1,42 +1,46 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using your network -author: lomayor -ms.prod: ie11 -ms.assetid: 85f6429d-947a-4031-8f93-e26110a35828 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install Internet Explorer 11 (IE11) using your network (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using your network -You can install Internet Explorer 11 (IE11) over your network by putting your custom IE11 installation package in a shared network folder and letting your employees run the Setup program on their own computers. You can create the network folder structure manually, or you can run Internet Explorer Administration Kit 11 (IEAK 11). - -**Note**
If you support multiple architectures and operating systems, create a subfolder for each combination. If you support multiple languages, create a subfolder for each localized installation file. - - **To manually create the folder structure** - -- Copy your custom IE11 installation file into a folder on your network, making sure it's available to your employees. - - **To create the folder structure using IEAK 11** - -- Run the Internet Explorer Customization Wizard 11 in IEAK 11, using the **Full Installation Package** option.

- The wizard automatically puts your custom installation files in your `\\Flat` folder. Where the `` is the location of your other build files. - -**Note**
Use the localized versions of the IE Customization Wizard 11 to create localized IE11 installation packages. - -## Related topics -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to install the Internet Explorer 11 update using your network +author: dansimp +ms.prod: ie11 +ms.assetid: 85f6429d-947a-4031-8f93-e26110a35828 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Install Internet Explorer 11 (IE11) using your network (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install Internet Explorer 11 (IE11) using your network + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You can install Internet Explorer 11 (IE11) over your network by putting your custom IE11 installation package in a shared network folder and letting your employees run the Setup program on their own computers. You can create the network folder structure manually, or you can run Internet Explorer Administration Kit 11 (IEAK 11). + +**Note**
If you support multiple architectures and operating systems, create a subfolder for each combination. If you support multiple languages, create a subfolder for each localized installation file. + + **To manually create the folder structure** + +- Copy your custom IE11 installation file into a folder on your network, making sure it's available to your employees. + + **To create the folder structure using IEAK 11** + +- Run the Internet Explorer Customization Wizard 11 in IEAK 11, using the **Full Installation Package** option.

+ The wizard automatically puts your custom installation files in your `\\Flat` folder. Where the `` is the location of your other build files. + +**Note**
Use the localized versions of the IE Customization Wizard 11 to create localized IE11 installation packages. + +## Related topics +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md index 063f5c2aa2..d593de27c6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md @@ -1,50 +1,54 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using third-party tools and command-line options. -author: lomayor -ms.prod: ie11 -ms.assetid: 30190c66-49f7-4ca4-8b57-a47656aa0c7e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install Internet Explorer 11 (IE11) using third-party tools (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using third-party tools -You can install Internet Explorer 11 (IE11) using third-party electronic software distribution (ESD) systems and these command-line options: - -## Setup Modes - -|Command-line options |Description | -|---------------------|------------------------------------------------------| -|`/passive` |Installs without customer involvement. | -|`/quiet` |Installs without customer involvement and without showing the UI. | - -## Setup Options - -|Command-line options |Description | -|---------------------|------------------------------------------------------| -|`/update-no` |Installs without checking for updates.

**Important**
If you don't use this option, you'll need an Internet connection to finish your installation. | -|`/no-default` |Installs without making IE11 the default web browser. | -|`/closeprograms` |Automatically closes running programs. | - - -## Restart Options - -|Command-line options |Description | -|---------------------|------------------------------------------------------| -|`/norestart` |Installs without restarting the computer. | -|`/forcerestart` |Installs and restarts after installation. | - -  - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to install the Internet Explorer 11 update using third-party tools and command-line options. +author: dansimp +ms.prod: ie11 +ms.assetid: 30190c66-49f7-4ca4-8b57-a47656aa0c7e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Install Internet Explorer 11 (IE11) using third-party tools (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install Internet Explorer 11 (IE11) using third-party tools + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You can install Internet Explorer 11 (IE11) using third-party electronic software distribution (ESD) systems and these command-line options: + +## Setup Modes + +|Command-line options |Description | +|---------------------|------------------------------------------------------| +|`/passive` |Installs without customer involvement. | +|`/quiet` |Installs without customer involvement and without showing the UI. | + +## Setup Options + +|Command-line options |Description | +|---------------------|------------------------------------------------------| +|`/update-no` |Installs without checking for updates.

**Important**
If you don't use this option, you'll need an Internet connection to finish your installation. | +|`/no-default` |Installs without making IE11 the default web browser. | +|`/closeprograms` |Automatically closes running programs. | + + +## Restart Options + +|Command-line options |Description | +|---------------------|------------------------------------------------------| +|`/norestart` |Installs without restarting the computer. | +|`/forcerestart` |Installs and restarts after installation. | + +  + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md index aba6187431..662514e102 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md @@ -1,52 +1,56 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using Windows Server Update Services (WSUS)' -author: lomayor -ms.prod: ie11 -ms.assetid: 6cbd6797-c670-4236-8423-e0919478f2ce -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) -Windows Server Update Services (WSUS) lets you download a single copy of the Microsoft product update and cache it on your local WSUS servers. You can then configure your computers to get the update from your local servers instead of Windows Update. For more information about WSUS, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). - - **To import from Windows Update to WSUS** - -1. Open your WSUS admin site. For example, `https:///WSUSAdmin/`.

- Where `` is the name of your WSUS server. - -2. Choose the top server node or the **Updates** node, and then click **Import Updates**. - -3. To get the updates, install the Microsoft Update Catalog ActiveX control. - -4. Search for Internet Explorer 11 and add its contents to your basket. - -5. After you're done browsing, go to your basket and click **Import**. - - You can also download the updates without importing them by unchecking the **Import directly into Windows Server Update Services** box. - - **To approve Internet Explorer in WSUS for installation** - -6. Open your WSUS admin site and check the **Review synchronization settings** box from the **To Do** list. - -7. Click **Synchronize now** to sync your WSUS server with Windows Update, and then click **Updates** from the navigation bar. - -8. Enter **Internet Explorer 11** into the **Search Contains** box, and then click **Apply**. - -9. Choose the right version of IE11 for your operating system, and click **Approve for installation**. - -10. Click each computer group you want to set up for the WSUS server, picking the right approval level, and then click **OK**. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to install the Internet Explorer 11 update using Windows Server Update Services (WSUS)' +author: dansimp +ms.prod: ie11 +ms.assetid: 6cbd6797-c670-4236-8423-e0919478f2ce +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Windows Server Update Services (WSUS) lets you download a single copy of the Microsoft product update and cache it on your local WSUS servers. You can then configure your computers to get the update from your local servers instead of Windows Update. For more information about WSUS, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). + + **To import from Windows Update to WSUS** + +1. Open your WSUS admin site. For example, `https:///WSUSAdmin/`.

+ Where `` is the name of your WSUS server. + +2. Choose the top server node or the **Updates** node, and then click **Import Updates**. + +3. To get the updates, install the Microsoft Update Catalog ActiveX control. + +4. Search for Internet Explorer 11 and add its contents to your basket. + +5. After you're done browsing, go to your basket and click **Import**. + + You can also download the updates without importing them by unchecking the **Import directly into Windows Server Update Services** box. + + **To approve Internet Explorer in WSUS for installation** + +6. Open your WSUS admin site and check the **Review synchronization settings** box from the **To Do** list. + +7. Click **Synchronize now** to sync your WSUS server with Windows Update, and then click **Updates** from the navigation bar. + +8. Enter **Internet Explorer 11** into the **Search Contains** box, and then click **Apply**. + +9. Choose the right version of IE11 for your operating system, and click **Approve for installation**. + +10. Click each computer group you want to set up for the WSUS server, picking the right approval level, and then click **OK**. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md index 29b3b5ca55..3e6ffbfad8 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md @@ -1,61 +1,65 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to fix potential installation problems with Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: 3ae77745-86ac-40a9-a37d-eebbf37661a3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install problems with Internet Explorer 11 -Most Internet Explorer 11 installations are straightforward and work the way they should. But it's possible that you might have problems. - -If you do, you can: - -- Check that you meet the minimum operating system requirements and have the prerequisites installed. - -- Check that there are no other updates or restarts waiting. - -- Temporarily turn off your antispyware and antivirus software. - -- Try another IE11 installer. For example from [Windows Update](https://go.microsoft.com/fwlink/p/?LinkId=302315) or from the [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=327753) website. - -- Review the `IE11_main.log` file in the `\Windows` folder. This log file has information about each installation and is appended for each subsequent installation. - -- Make sure you use the same download server URLs that you entered during the Setup process. - -## Internet Explorer didn't finish installing -If Internet Explorer doesn't finish installing, it might mean that Windows Update wasn't able to install an associated update, that you have a previous, unsupported version of IE installed, or that there's a problem with your copy of IE. We recommend you try this: - - **To fix this issue** - -1. Uninstall IE: - - 1. In the Control Panel, open the **Programs and Features** box, scroll down to IE11, and then click **Uninstall**. - - 2. After the uninstall finishes, restart your computer. - -2. Run [Windows Update](https://go.microsoft.com/fwlink/p/?LinkId=302315), clicking **Check for updates**. - -3. Check the list for IE11. If it's included in the list of updates for download, exclude it before you update your computer.

-If you get an error during the Windows Update process, see [Fix the problem with Microsoft Windows Update that is not working](https://go.microsoft.com/fwlink/p/?LinkId=302316). - -4. Restart your computer, making sure all of your the updates are finished. - -5. Try to reinstall IE11 from either Windows Update (if you saw it in Step 3) or from the [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=327753) website. - - - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to fix potential installation problems with Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 3ae77745-86ac-40a9-a37d-eebbf37661a3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Install problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Most Internet Explorer 11 installations are straightforward and work the way they should. But it's possible that you might have problems. + +If you do, you can: + +- Check that you meet the minimum operating system requirements and have the prerequisites installed. + +- Check that there are no other updates or restarts waiting. + +- Temporarily turn off your antispyware and antivirus software. + +- Try another IE11 installer. For example from [Windows Update](https://go.microsoft.com/fwlink/p/?LinkId=302315) or from the [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=327753) website. + +- Review the `IE11_main.log` file in the `\Windows` folder. This log file has information about each installation and is appended for each subsequent installation. + +- Make sure you use the same download server URLs that you entered during the Setup process. + +## Internet Explorer didn't finish installing +If Internet Explorer doesn't finish installing, it might mean that Windows Update wasn't able to install an associated update, that you have a previous, unsupported version of IE installed, or that there's a problem with your copy of IE. We recommend you try this: + + **To fix this issue** + +1. Uninstall IE: + + 1. In the Control Panel, open the **Programs and Features** box, scroll down to IE11, and then click **Uninstall**. + + 2. After the uninstall finishes, restart your computer. + +2. Run [Windows Update](https://go.microsoft.com/fwlink/p/?LinkId=302315), clicking **Check for updates**. + +3. Check the list for IE11. If it's included in the list of updates for download, exclude it before you update your computer.

+If you get an error during the Windows Update process, see [Fix the problem with Microsoft Windows Update that is not working](https://go.microsoft.com/fwlink/p/?LinkId=302316). + +4. Restart your computer, making sure all of your the updates are finished. + +5. Try to reinstall IE11 from either Windows Update (if you saw it in Step 3) or from the [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=327753) website. + + + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md index cf102f1c8f..803fc7fb83 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md @@ -1,42 +1,46 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to fix intranet search problems with Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: 3ee71d93-d9d2-48e1-899e-07932c73faa6 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Fix intranet search problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix intranet search problems with Internet Explorer 11 -After upgrading to Internet Explorer 11, you might experience search issues while using your intranet site. - -## Why is my intranet redirecting me to search results? -IE11 works differently with search, based on whether your organization is domain-joined. - -- **Domain-joined computers.** A single word entry is treated as a search term. However, IE11 also checks for available intranet sites and offers matches through the **Notification bar**. If you select **Yes** from the **Notification bar** to navigate to the intranet site, IE11 associates that word with the site so that the next time you type in the intranet site name, inline auto-complete will resolve to the intranet site address. - -- **Non-domain-joined computers.** A single word entry is treated as an intranet site. However, if the term doesn't resolve to a site, IE11 then treats the entry as a search term and opens your default search provider. - -To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like `contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. - - **To enable single-word intranet search** - -1. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. - -2. Click **Advanced**, check the **Go to an intranet site for a single word entry in the Address bar** box, and then click **OK**. - -If you'd like your entire organization to have single word entries default to an intranet site, you can turn on the **Go to an intranet site for a single word entry in the Address bar** Group Policy. With this policy turned on, a search for `contoso` automatically resolves to `https://contoso`. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to fix intranet search problems with Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 3ee71d93-d9d2-48e1-899e-07932c73faa6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Fix intranet search problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Fix intranet search problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +After upgrading to Internet Explorer 11, you might experience search issues while using your intranet site. + +## Why is my intranet redirecting me to search results? +IE11 works differently with search, based on whether your organization is domain-joined. + +- **Domain-joined computers.** A single word entry is treated as a search term. However, IE11 also checks for available intranet sites and offers matches through the **Notification bar**. If you select **Yes** from the **Notification bar** to navigate to the intranet site, IE11 associates that word with the site so that the next time you type in the intranet site name, inline auto-complete will resolve to the intranet site address. + +- **Non-domain-joined computers.** A single word entry is treated as an intranet site. However, if the term doesn't resolve to a site, IE11 then treats the entry as a search term and opens your default search provider. + +To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like `contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. + + **To enable single-word intranet search** + +1. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. + +2. Click **Advanced**, check the **Go to an intranet site for a single word entry in the Address bar** box, and then click **OK**. + +If you'd like your entire organization to have single word entries default to an intranet site, you can turn on the **Go to an intranet site for a single word entry in the Address bar** Group Policy. With this policy turned on, a search for `contoso` automatically resolves to `https://contoso`. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md index a464bbc679..66b29a20c4 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md +++ b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md @@ -1,42 +1,46 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for Internet Explorer. -author: lomayor -ms.prod: ie11 -ms.assetid: eb3cce62-fc7b-41e3-97b6-2916b85bcf55 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Manage Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Manage Internet Explorer 11 - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for Internet Explorer. - -## In this section - -|Topic |Description | -|------|------------| -|[Auto detect settings Internet Explorer 11](auto-detect-settings-for-ie11.md) |Guidance about how to update your automatic detection of DHCP and DNS servers. | -|[Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) |Guidance about how to add, update and lock your auto configuration settings. | -|[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. |  - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for Internet Explorer. +author: dansimp +ms.prod: ie11 +ms.assetid: eb3cce62-fc7b-41e3-97b6-2916b85bcf55 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Manage Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Manage Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for Internet Explorer. + +## In this section + +|Topic |Description | +|------|------------| +|[Auto detect settings Internet Explorer 11](auto-detect-settings-for-ie11.md) |Guidance about how to update your automatic detection of DHCP and DNS servers. | +|[Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) |Guidance about how to add, update and lock your auto configuration settings. | +|[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. |  + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md index 6c19898cf3..e0dbd2bdab 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md @@ -1,98 +1,102 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: IEM-configured settings have been deprecated for Internet Explorer 10 and newer. Use this topic to learn where to go to fix the affected settings through Group Policy Preferences, Administrative Templates (.admx), or the IEAK. -author: lomayor -ms.prod: ie11 -ms.assetid: 89084e01-4e3f-46a6-b90e-48ee58d6821c -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Missing Internet Explorer Maintenance settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Missing Internet Explorer Maintenance settings for Internet Explorer 11 - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The Internet Explorer Maintenance (IEM) settings have been deprecated in favor of Group Policy Preferences, Administrative Templates (.admx), and the IE Administration Kit 11 (IEAK 11). - -Because of this change, your IEM-configured settings will no longer work on computers running Internet Explorer 10 or newer. To fix this, you need to update the affected settings using Group Policy Preferences, Administrative Templates (.admx), or IE Administration Kit 11 (IEAK 11). - -Because Group Policy Preferences and IEAK 11 run using asynchronous processes, you should choose to use only one of the tools within each group of settings. For example, using only IEAK 11 in the **Security** settings or Group Policy Preferences within the **Internet Zone** settings. Also, it's important to remember that policy is enforced and can't be changed by the user, while preferences are configured, but can be changed by the user. - -For more information about all of the new options and Group Policy, see: - -- [Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md) - -- [Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md) - -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) - -- [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=279876) - -- [Group Policy ADMX Syntax Reference Guide](https://go.microsoft.com/fwlink/p/?LinkId=276830) - -- [Enable and Disable Settings in a Preference Item](https://go.microsoft.com/fwlink/p/?LinkId=282671) - -## IEM replacements -The IEM settings have replacements you can use in either Group Policy Preferences or IEAK 11. - -### Browser user interface replacements - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Browser title |Lets you customize the text that shows up in the title bar of the browser.|On the **Browser User Interface** page of IEAK 11, click **Customize Title Bars**, and then type the text that appears on the title bar of the **Title Bar Text** box.

Your text is appended to the text," Microsoft Internet Explorer provided by". | -|Browser toolbar customizations (background and buttons) |Lets you customize the buttons on the browser toolbar.

  • **Buttons.** Customizes the buttons on the Internet Explorer 11 toolbar.
  • **Background.** No longer available.
|On the **Browser User Interface** page of IEAK 11, click **Add**, type your new toolbar caption, action, and icon, and if the button should appear by default, and then click **OK**. You can also edit, remove, or delete an existing toolbar button from this page. | -|Custom logo and animated bitmaps |Lets you replace the static and animated logos in the upper-right corner of the IE window with customized logos. |This setting isn't available anymore. | - - -### Connection replacements - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Connection settings|Lets you import your connection settings from a previously set up computer. These settings define how your employees interact with the connection settings on the **System Polices and Restrictions** page. You can also remove old dial-up connections settings from your employee's computers.|In the **Internet Settings Group Policy Preferences** dialog box, click the **Connections** tab, and set up your proxy settings.

-OR-

On the **Connection Settings** page of IEAK 11, change your connection settings, including importing your current connection settings and deleting existing dial-up connection settings (as needed). | -|Automatic browser configuration |Lets you update your employee's computer after you've deployed IE11, by specifying a URL to an .ins file, an auto-proxy URL, or both. You can decide when the update occurs, in minutes. Typing zero, or not putting in any number, means that automatic configuration only happens after the browser is started and used to go to a page. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Automatic Configuration** tab, and then add your URL.

On the **Automatic Configuration** page of IEAK 11, modify the configuration settings, including providing the URL to an .ins file or an auto-proxy site. | -|Proxy settings |Lets you specify your proxy servers. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Connections** tab, click **LAN Settings**, and then choose whether to turn on automatic detection of your configuration settings and if you want to use proxy servers.

-OR-

On the **Proxy Settings** page of IEAK 11, turn on your proxy settings, adding your proxy server addresses and exceptions. | -|User Agent string |Lets the browser provide identification to visited servers. This string is often used to keep Internet traffic statistics. |This setting isn't available anymore. | - -### URLs replacements - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Favorites and links |Lets you use custom URLs for the **Favorites** and **Links** folders. You can also specify the folder order, disable IE Suggested Sites, and import an existing folder structure. |On the **Favorites, Favorites Bar and Feeds** page of IEAK 11, add your custom URLs to the **Favorites**, **Favorites Bar**, or **RSS Feeds** folders, or create new folders.

You can also edit, test, or remove your URLs, sort the list order, or disable IE Suggested Sites. | -|Important URLs |Lets you add custom **Home** pages that can open different tabs. You can also add a **Support** page that shows up when an employee clicks online Help.|In the **Internet Settings Group Policy Preferences** dialog box, click the **General** tab, and add your custom **Home** page.

On the **Important URLs - Home page and Support** page of IEAK 11, add the custom URLs to your **Home** and **Support** pages.

You can also click to retain the previous home page information when the user upgrades to a newer version of IE. | - -### Security Zones and Content Ratings - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Security zones |Lets you change your security settings, by zone |In the **Internet Settings Group Policy Preferences** dialog box, click the **Security** tab, and update your security settings, based on zone.

-OR-

On the **Security and Privacy Settings** page of IEAK 11, choose your **Security Zones and Privacy** setting, changing it, as necessary. | -|Content ratings |Lets you change your content ratings so your employees can't view sites with risky content. |On the **Security and Privacy Settings** page of IEAK 11, choose your **Content Ratings** setting, changing it, as necessary. | -|Authenticode settings |Lets you pick your trustworthy software publishers and stop your employees from adding new, untrusted publishers while browsing. |These settings aren't available anymore. | - -### Programs - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Programs |Lets you import your default program settings, which specify the programs Windows uses for each Internet service. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Programs** tab, and choose how to open IE11 links.

-OR-

On the **Programs** page of IEAK 11, choose whether to customize or import your program settings. | - -#### Advanced IEM settings -The Advanced IEM settings, including Corporate and Internet settings, were also deprecated. However, they also have replacements you can use in either Group Policy Preferences or IEAK 11. - -**Note**
Advanced IEM Settings were shown under **Programs** and only available when running in **Preference** mode. - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Corporate settings |Specifies the location of the file with the settings you use to make IE work best in your organization. |On the Additional Settings page of IEAK 11, expand Corporate Settings, and then customize how your organization handles temporary Internet files, code downloads, menu items, and toolbar buttons. | -|Internet settings |Specifies the location of the file that includes your default IE settings. |In the Internet Settings Group Policy Preferences dialog box, click the Advanced tab, and then update your Internet-related settings, as required

-OR-

On the Additional Settings page of IEAK 11, expand Internet Settings, and then customize your default values in the Internet Options dialog box. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: IEM-configured settings have been deprecated for Internet Explorer 10 and newer. Use this topic to learn where to go to fix the affected settings through Group Policy Preferences, Administrative Templates (.admx), or the IEAK. +author: dansimp +ms.prod: ie11 +ms.assetid: 89084e01-4e3f-46a6-b90e-48ee58d6821c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Missing Internet Explorer Maintenance settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Missing Internet Explorer Maintenance settings for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +The Internet Explorer Maintenance (IEM) settings have been deprecated in favor of Group Policy Preferences, Administrative Templates (.admx), and the IE Administration Kit 11 (IEAK 11). + +Because of this change, your IEM-configured settings will no longer work on computers running Internet Explorer 10 or newer. To fix this, you need to update the affected settings using Group Policy Preferences, Administrative Templates (.admx), or IE Administration Kit 11 (IEAK 11). + +Because Group Policy Preferences and IEAK 11 run using asynchronous processes, you should choose to use only one of the tools within each group of settings. For example, using only IEAK 11 in the **Security** settings or Group Policy Preferences within the **Internet Zone** settings. Also, it's important to remember that policy is enforced and can't be changed by the user, while preferences are configured, but can be changed by the user. + +For more information about all of the new options and Group Policy, see: + +- [Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md) + +- [Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md) + +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) + +- [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=279876) + +- [Group Policy ADMX Syntax Reference Guide](https://go.microsoft.com/fwlink/p/?LinkId=276830) + +- [Enable and Disable Settings in a Preference Item](https://go.microsoft.com/fwlink/p/?LinkId=282671) + +## IEM replacements +The IEM settings have replacements you can use in either Group Policy Preferences or IEAK 11. + +### Browser user interface replacements + +|IEM setting |Description |Replacement tool | +|------------|------------|-----------------| +|Browser title |Lets you customize the text that shows up in the title bar of the browser.|On the **Browser User Interface** page of IEAK 11, click **Customize Title Bars**, and then type the text that appears on the title bar of the **Title Bar Text** box.

Your text is appended to the text," Microsoft Internet Explorer provided by". | +|Browser toolbar customizations (background and buttons) |Lets you customize the buttons on the browser toolbar.

  • **Buttons.** Customizes the buttons on the Internet Explorer 11 toolbar.
  • **Background.** No longer available.
|On the **Browser User Interface** page of IEAK 11, click **Add**, type your new toolbar caption, action, and icon, and if the button should appear by default, and then click **OK**. You can also edit, remove, or delete an existing toolbar button from this page. | +|Custom logo and animated bitmaps |Lets you replace the static and animated logos in the upper-right corner of the IE window with customized logos. |This setting isn't available anymore. | + + +### Connection replacements + +|IEM setting |Description |Replacement tool | +|------------|------------|-----------------| +|Connection settings|Lets you import your connection settings from a previously set up computer. These settings define how your employees interact with the connection settings on the **System Polices and Restrictions** page. You can also remove old dial-up connections settings from your employee's computers.|In the **Internet Settings Group Policy Preferences** dialog box, click the **Connections** tab, and set up your proxy settings.

-OR-

On the **Connection Settings** page of IEAK 11, change your connection settings, including importing your current connection settings and deleting existing dial-up connection settings (as needed). | +|Automatic browser configuration |Lets you update your employee's computer after you've deployed IE11, by specifying a URL to an .ins file, an auto-proxy URL, or both. You can decide when the update occurs, in minutes. Typing zero, or not putting in any number, means that automatic configuration only happens after the browser is started and used to go to a page. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Automatic Configuration** tab, and then add your URL.

On the **Automatic Configuration** page of IEAK 11, modify the configuration settings, including providing the URL to an .ins file or an auto-proxy site. | +|Proxy settings |Lets you specify your proxy servers. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Connections** tab, click **LAN Settings**, and then choose whether to turn on automatic detection of your configuration settings and if you want to use proxy servers.

-OR-

On the **Proxy Settings** page of IEAK 11, turn on your proxy settings, adding your proxy server addresses and exceptions. | +|User Agent string |Lets the browser provide identification to visited servers. This string is often used to keep Internet traffic statistics. |This setting isn't available anymore. | + +### URLs replacements + +|IEM setting |Description |Replacement tool | +|------------|------------|-----------------| +|Favorites and links |Lets you use custom URLs for the **Favorites** and **Links** folders. You can also specify the folder order, disable IE Suggested Sites, and import an existing folder structure. |On the **Favorites, Favorites Bar and Feeds** page of IEAK 11, add your custom URLs to the **Favorites**, **Favorites Bar**, or **RSS Feeds** folders, or create new folders.

You can also edit, test, or remove your URLs, sort the list order, or disable IE Suggested Sites. | +|Important URLs |Lets you add custom **Home** pages that can open different tabs. You can also add a **Support** page that shows up when an employee clicks online Help.|In the **Internet Settings Group Policy Preferences** dialog box, click the **General** tab, and add your custom **Home** page.

On the **Important URLs - Home page and Support** page of IEAK 11, add the custom URLs to your **Home** and **Support** pages.

You can also click to retain the previous home page information when the user upgrades to a newer version of IE. | + +### Security Zones and Content Ratings + +|IEM setting |Description |Replacement tool | +|------------|------------|-----------------| +|Security zones |Lets you change your security settings, by zone |In the **Internet Settings Group Policy Preferences** dialog box, click the **Security** tab, and update your security settings, based on zone.

-OR-

On the **Security and Privacy Settings** page of IEAK 11, choose your **Security Zones and Privacy** setting, changing it, as necessary. | +|Content ratings |Lets you change your content ratings so your employees can't view sites with risky content. |On the **Security and Privacy Settings** page of IEAK 11, choose your **Content Ratings** setting, changing it, as necessary. | +|Authenticode settings |Lets you pick your trustworthy software publishers and stop your employees from adding new, untrusted publishers while browsing. |These settings aren't available anymore. | + +### Programs + +|IEM setting |Description |Replacement tool | +|------------|------------|-----------------| +|Programs |Lets you import your default program settings, which specify the programs Windows uses for each Internet service. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Programs** tab, and choose how to open IE11 links.

-OR-

On the **Programs** page of IEAK 11, choose whether to customize or import your program settings. | + +#### Advanced IEM settings +The Advanced IEM settings, including Corporate and Internet settings, were also deprecated. However, they also have replacements you can use in either Group Policy Preferences or IEAK 11. + +**Note**
Advanced IEM Settings were shown under **Programs** and only available when running in **Preference** mode. + +|IEM setting |Description |Replacement tool | +|------------|------------|-----------------| +|Corporate settings |Specifies the location of the file with the settings you use to make IE work best in your organization. |On the Additional Settings page of IEAK 11, expand Corporate Settings, and then customize how your organization handles temporary Internet files, code downloads, menu items, and toolbar buttons. | +|Internet settings |Specifies the location of the file that includes your default IE settings. |In the Internet Settings Group Policy Preferences dialog box, click the Advanced tab, and then update your Internet-related settings, as required

-OR-

On the Additional Settings page of IEAK 11, expand Internet Settings, and then customize your default values in the Internet Options dialog box. | + diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md index ea68f25a40..faa927931e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md +++ b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md @@ -1,53 +1,57 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Internet Explorer 11 uses the latest standards mode, which simplifies web page compatibility for users by removing the **Compatibility View** button and reducing the number of compatibility options in the F12 developer tools for developers. -author: lomayor -ms.prod: ie11 -ms.assetid: 501c96c9-9f03-4913-9f4b-f67bd9edbb61 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Missing the Compatibility View Button (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Missing the Compatibility View Button - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Compatibility View was introduced in Windows Internet Explorer 8 to help existing content continue to work with Windows Internet Explorer 7, while developers updated their content to support modern interoperable web standards. Since then, the Internet Explorer web platform, and the web itself, have changed so that most public web content looks for standards-based features instead of IE 7-compatible behavior. - -Thanks to these changes, using Internet Explorer 11 in the latest standards mode is more compatible with the web than ever before. As a result, IE11 simplifies web page compatibility for users by removing the **Compatibility View** button and reducing the number of compatibility options in the F12 developer tools for developers. - -## What happened to the Compatibility View button? -In previous versions of IE, the **Compatibility View** button would attempt to fix a broken standards-based website, by getting the page to appear like it did in Internet Explorer 7. Today however, more standards-based websites are broken by attempting to appear like they did in Internet Explorer 7. So instead of implementing and using Compatibility View, developers are updating their server configuration to add X-UA-Compatible meta tags, which forces the content to the “edge”, making the **Compatibility View** button disappear. In support of these changes, the Compatibility View button has been completely removed for IE11. - -## What if I still need Compatibility View? -There might be extenuating circumstances in your company, which require you to continue to use Compatibility View. In this situation, this process should be viewed strictly as a workaround. You should work with the website vendor to make sure that the affected pages are updated to match the latest web standards. The functionality described here is currently deprecated and will be removed at a time in the future. - -**Important**
This functionality is only available in Internet Explorer for the desktop. - - **To change your Compatibility View settings** - -1. Open Internet Explorer for the desktop, click **Tools**, and then click **Compatibility View settings**. - -2. In the **Compatibility View Settings** box, add the problematic website URL, and then click **Add**.

-Compatibility View is turned on for this single website, for this specific computer. - -3. Decide if you want your intranet sites displayed using Compatibility View, decide whether to use Microsoft compatibility lists, and then click **Close**. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: Internet Explorer 11 uses the latest standards mode, which simplifies web page compatibility for users by removing the **Compatibility View** button and reducing the number of compatibility options in the F12 developer tools for developers. +author: dansimp +ms.prod: ie11 +ms.assetid: 501c96c9-9f03-4913-9f4b-f67bd9edbb61 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Missing the Compatibility View Button (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Missing the Compatibility View Button + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Compatibility View was introduced in Windows Internet Explorer 8 to help existing content continue to work with Windows Internet Explorer 7, while developers updated their content to support modern interoperable web standards. Since then, the Internet Explorer web platform, and the web itself, have changed so that most public web content looks for standards-based features instead of IE 7-compatible behavior. + +Thanks to these changes, using Internet Explorer 11 in the latest standards mode is more compatible with the web than ever before. As a result, IE11 simplifies web page compatibility for users by removing the **Compatibility View** button and reducing the number of compatibility options in the F12 developer tools for developers. + +## What happened to the Compatibility View button? +In previous versions of IE, the **Compatibility View** button would attempt to fix a broken standards-based website, by getting the page to appear like it did in Internet Explorer 7. Today however, more standards-based websites are broken by attempting to appear like they did in Internet Explorer 7. So instead of implementing and using Compatibility View, developers are updating their server configuration to add X-UA-Compatible meta tags, which forces the content to the “edge”, making the **Compatibility View** button disappear. In support of these changes, the Compatibility View button has been completely removed for IE11. + +## What if I still need Compatibility View? +There might be extenuating circumstances in your company, which require you to continue to use Compatibility View. In this situation, this process should be viewed strictly as a workaround. You should work with the website vendor to make sure that the affected pages are updated to match the latest web standards. The functionality described here is currently deprecated and will be removed at a time in the future. + +**Important**
This functionality is only available in Internet Explorer for the desktop. + + **To change your Compatibility View settings** + +1. Open Internet Explorer for the desktop, click **Tools**, and then click **Compatibility View settings**. + +2. In the **Compatibility View Settings** box, add the problematic website URL, and then click **Add**.

+Compatibility View is turned on for this single website, for this specific computer. + +3. Decide if you want your intranet sites displayed using Compatibility View, decide whether to use Microsoft compatibility lists, and then click **Close**. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md index df476d43ad..6c68a1ec01 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md @@ -1,33 +1,43 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: How to turn managed browser hosting controls back on in Internet Explorer 11. -author: lomayor -ms.prod: ie11 -ms.assetid: b0b7f60f-9099-45ab-84f4-4ac64d7bcb43 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: .NET Framework problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# .NET Framework problems with Internet Explorer 11 -If you’re having problems launching your legacy apps while running Internet Explorer 11, it’s most likely because Internet Explorer no longer starts apps that use managed browser hosting controls, like in .NET Framework 1.1 and 2.0. - - **To turn managed browser hosting controls back on** - -1. **For x86 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - -2. **For 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - -For more information, see the [Web Applications](https://go.microsoft.com/fwlink/p/?LinkId=308903) section of the Application Compatibility in the .NET Framework 4.5 page. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: How to turn managed browser hosting controls back on in Internet Explorer 11. +author: dansimp +ms.prod: ie11 +ms.assetid: b0b7f60f-9099-45ab-84f4-4ac64d7bcb43 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: .NET Framework problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# .NET Framework problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +## Summary + +If you’re having problems launching your legacy apps while running Internet Explorer 11, it’s most likely because Internet Explorer no longer starts apps that use managed browser hosting controls, like in .NET Framework 1.1 and 2.0. + + **To turn managed browser hosting controls back on** + +1. **For x86 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. + +2. **For 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. + +## More information + +IEHost is a Microsoft .NET Framework 1.1-based technology that provides a better model than ActiveX controls to host controls within the browser. The IEHost controls are lightweight and are operated under the .NET security model where they are operated inside a sandbox.  + +From the .NET Framework 4, we remove the IEHost.dll file for the following reasons: + +- IEHost/HREF-EXE-style controls are exposed to the Internet. This poses a high security risk, and most customers who install the Framework are benefiting very little from this security risk. +- Managed hosting controls and invoking random ActiveX controls may be unsafe, and this risk cannot be countered in the .NET Framework. Therefore, the ability to host is disabled. We strongly suggest that IEHost should be disabled in any production environment. +- Potential security vulnerabilities and assembly versioning conflicts in the default application domain. By relying on COM Interop wrappers to load your assembly, it is implicitly loaded in the default application domain. If other browser extensions do the same function, they have the risks in the default application domain such as disclosing information, and so on. If you are not using strong-named assemblies as dependencies, type loading exceptions can occur. You cannot freely configure the common language runtime (CLR), because you do not own the host process, and you cannot run any code before your extension is loaded. + +For more information about .NET Framework application compatibility, see [Application compatibility in the .NET Framework](/dotnet/framework/migration-guide/application-compatibility). diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md index c1cd3ac8b3..9b8ab9eb33 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md @@ -1,74 +1,78 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: New group policy settings for Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: 669cc1a6-e2cb-403f-aa31-c1de52a615d1 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: New group policy settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# New group policy settings for Internet Explorer 11 -Internet Explorer 11 gives you some new Group Policy settings to help you manage your company's web browser configurations, including: - - -| Policy | Category Path | Supported on | Explanation | -|-----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow IE to use the HTTP2 network protocol | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE uses the HTTP2 network protocol. HTTP2 works with HTTP requests to optimize the latency of network requests through compression, multiplexing, and prioritization.

If you enable this policy setting, IE uses the HTTP2 network protocol.

If you disable this policy setting, IE won't use the HTTP2 network protocol.

If you don't configure this policy setting, users can turn this behavior on or off, using the **Internet Explorer Advanced Internet Options** settings. The default is on. | -| Allow IE to use the SPDY/3 network protocol | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether Internet Explorer uses the SPDY/3 network protocol. SPDY/3 works with HTTP requests to optimize the latency of network requests through compression, multiplexing and prioritization.

If you enable this policy setting, Internet Explorer uses the SPDY/3 network protocol.

If you disable this policy setting, Internet Explorer won't use the SPDY/3 network protocol.

If you don't configure this policy setting, users can turn this behavior on or off, on the **Advanced\* tab of the \*\*Internet Options** dialog box. The default is on.

**Note**
We've replaced the SPDY/3 protocol with the HTTP2 protocol in Windows 10. You can configure the HTTP2 protocol by using the **Allow IE to use the HTTP2 network protocol** setting. | -| Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10 | This policy setting allows IE to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user’s keystrokes are sent to Microsoft through Microsoft services.

If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.

If you disable this policy setting, users won’t receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.

If you don’t configure this policy setting, users can change the **Suggestions** setting on the **Settings** charm. | -| Allow only approved domains to use the TDC ActiveX control |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
| IE11 in Windows 10 | This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the **Internet** and **Restricted Sites** security zones.

If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.

If you disable this policy setting, users can run the TDC Active X control from all sites in the specified zone. | -| Allow SSL3 Fallback | Administrative Templates\Windows Components\Internet Explorer\Security Features | Internet Explorer 11 on Windows 10 | This policy setting allows you to stop websites from falling back to using Secure Socket Layer (SSL) 3.0 or lower, if Transport Layer Security (TLS) 1.0 or higher, fails. This setting doesn’t affect which security protocols are enabled.

If you enable this policy setting and a website fails while using the TLS 1.0 or higher security protocols, Internet Explorer will try to fallback and use SSL 3.0 or lower security protocols.

If you disable or don’t configure this setting, Internet Explorer uses the default system protocols.

**Important:**
By default, SSL 3.0 is disabled. If you choose to enable SSL 3.0, we recommend that you disable or don't configure this setting to help mitigate potential man-in-the-middle attacks. | -| Allow VBScript to run in Internet Explorer |

  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Internet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Intranet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Local Machine Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Internet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Intranet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Local Machine Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Restricted Sites Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Trusted Sites Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Restricted Sites Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Trusted Sites Zone
| Internet Explorer 11 | This policy setting lets you decide whether VBScript can run on pages in specific Internet Explorer zones.

If you enable this policy setting (default), you must also pick one of the following options from the Options box:

  • Enable. VBScript runs on pages in specific zones, without any interaction.
  • Prompt. Employees are prompted whether to allow VBScript to run in the zone.
  • Disable. VBScript is prevented from running in the zone.

If you disable or don’t configure this policy setting, VBScript runs without any interaction in the specified zone. | -| Always send Do Not Track header | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | At least Internet Explorer 10 | This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.

If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.

**In Internet Explorer 9 and 10:**
If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.

**In at least IE11:**
If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.

If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced\* tab of the \*\*Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. | -| Don't run antimalware programs against ActiveX controls
(Internet, Restricted Zones) |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
| IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. | -| Don't run antimalware programs against ActiveX controls
(Intranet, Trusted, Local Machine Zones) |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
| IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. | -| Hide the button (next to the New Tab button) that opens Microsoft Edge | User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ | IE11 on Windows 10, version 1703 | This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | -| Let users turn on and use Enterprise Mode from the **Tools** menu | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10 | This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.

If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.

If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. | -| Limit Site Discovery output by Domain | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.

**Note:**
You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | -| Limit Site Discovery output by Zone | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.

To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

  • 0 – Restricted Sites zone
  • 0 – Internet zone
  • 0 – Trusted Sites zone
  • 0 – Local Intranet zone
  • 0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
  • 0 – Restricted Sites zone
  • 0 – Internet zone
  • 0 – Trusted Sites zone
  • 1 – Local Intranet zone
  • 0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
  • 1 – Restricted Sites zone
  • 0 – Internet zone
  • 1 – Trusted Sites zone
  • 1 – Local Intranet zone
  • 1 – Local Machine zone

**Note:**
You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | -| Prevent deleting ActiveX Filtering, Tracking Protection and Do Not Track data | Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History | At least Windows Internet Explorer 9 | **In Internet Explorer 9 and Internet Explorer 10:**
This policy setting prevents users from deleting ActiveX Filtering and Tracking Protection data, which includes the list of websites for which the user has chosen to disable ActiveX Filtering or Tracking Protection. In addition, Tracking Protection data is also collected if users turn on the **Personalized Tracking Protection List**, which blocks third-party items while the user is browsing.

**In IE11:**
This policy setting prevents users from deleting ActiveX Filtering, Tracking Protection data, and Do Not Track exceptions, stored in the **Delete Browsing History** dialog box, for visited websites.

If you enable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is preserved when the user clicks **Delete**.

If you disable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is deleted when the user clicks **Delete**.

If you don’t configure this policy setting, users can turn this feature on and off, determining whether to delete ActiveX Filtering, Tracking Protection, and Do Not Track data when clicking **Delete**. | -| Send all sites not included in the Enterprise Mode Site List to Microsoft Edge | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1607 | This policy setting lets you decide whether to open all sites that aren’t specified to open in IE11 by the Enterprise Mode site list, to open in Microsoft Edge.

If you enable this policy setting, you must also enable the Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list policy setting and you must include at least one site in the Enterprise Mode site list.

If you disable or don't configure this policy setting, all sites will open based on the currently active browser.

**Note:**
If you’ve also enabled the Administrative Templates\Windows Components\Microsoft Edge\Send all intranet sites to Internet Explorer 11 policy setting, then all intranet sites will continue to open in Internet Explorer 11. | -| Show message when opening sites in Microsoft Edge using Enterprise Mode | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1607 | This policy setting lets you decide whether employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.

If you enable this policy setting, employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.

If you disable or don't configure this policy setting, the default app behavior occurs and no additional page appears. | -| Turn off automatic download of the ActiveX VersionList | Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management | At least Windows Internet Explorer 8 | This policy setting allows you to decide whether Internet Explorer automatically downloads updated versions of Microsoft's VersionList.XML file. This file tells Internet Explorer whether to stop specific ActiveX controls from loading.

If you enable this policy setting, Internet Explorer stops automatically downloading updated versions of the VersionList.XML file.

If you disable or don’t configure this setting, Internet Explorer continues to download updated versions of the VersionList.XML file.

**Important:**
Stopping this file from updating breaks the out-of-date ActiveX control blocking feature, potentially compromising the security of the device. For more info, see the Out-of-Date ActiveX Control Blocking () topic. | -| Turn off loading websites and content in the background to optimize performance | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether Internet Explorer preemptively loads websites and content in the background, speeding up performance such that when the user clicks a hyperlink, the background page seamlessly switches into view.

If you enable this policy setting, IE doesn't load any websites or content in the background.

If you disable this policy setting, IE preemptively loads websites and content in the background.

If you don’t configure this policy setting, users can turn this behavior on or off, using IE settings. This feature is turned on by default. | -| Turn off phone number detection | Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing | IE11 on Windows 10 | This policy setting determines whether phone numbers are recognized and turned into hyperlinks, which can be used to invoke the default phone application on the system.

If you enable this policy setting, phone number detection is turned off. Users won’t be able to modify this setting.

If you disable this policy setting, phone number detection is turned on. Users won’t be able to modify this setting.

If you don't configure this policy setting, users can turn this behavior on or off, using IE settings. The default is on. | -| Turn off sending URL path as UTF-8 | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\URL Encoding | At least Windows Internet Explorer 7 | This policy setting determines whether to let IE send the path portion of a URL using the UTF-8 standard. This standard defines characters so they're readable in any language and lets you exchange Internet addresses (URLs) with characters included in any language.

If you enable this policy setting, UTF-8 is not allowed. Users won't be able to change this setting.

If you disable this policy setting, UTF-8 is allowed. Users won't be able to change this setting.

If you don't configure this policy setting, users can turn this behavior on or off. | -| Turn off sending UTF-8 query strings for URLs | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE uses 8-bit Unicode Transformation Format (UTF-8) to encode query strings in URLs before sending them to servers or to proxy servers.

If you enable this policy setting, you must specify when to use UTF-8 to encode query strings:

  • **0.** Never encode query strings.
  • **1.** Only encode query strings for URLs that aren't in the Intranet zone.
  • **2.** Only encode query strings for URLs that are in the Intranet zone.
  • **3.** Always encode query strings.

If you disable or don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Options settings. The default is to encode all query strings in UTF-8. | -| Turn off the ability to launch report site problems using a menu option | Administrative Templates\Windows Components\Internet Explorer\Browser menus | Internet Explorer 11 | This policy setting allows you to manage whether users can start the **eport Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu.

If you enable this policy setting, users won’t be able to start the **Report Site Problems** dialog box from the Internet Explorer settings or the Tools menu.

If you disable or don’t configure this policy setting, users will be able to start the **Report Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu. | -| Turn off the flip ahead with page prediction feature | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | At least Internet Explorer 10 on Windows 8 | This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.

If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn’t loaded into the background.

If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.

If you don’t configure this setting, users can turn this behavior on or off, using the **Settings** charm.

**Note**
Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn’t available for Internet Explorer for the desktop. | -| Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you enable this policy setting, IE11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you disable this policy setting, IE11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you don't configure this policy setting, users can turn this feature on or off using IE settings. This feature is turned off by default.

**Important**
When using 64-bit processes, some ActiveX controls and toolbars might not be available. | -| Turn on Site Discovery WMI output | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to manage the WMI output functionality of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an WMI class, which can be aggregated by using a client-management solution, such as System Center Configuration Manager.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an WMI class.

**Note:**
Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. | -| Turn on Site Discovery XML output | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to manage the XML output functionality of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an XML file, stored in your specified location.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an XML file.

**Note:**
Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. | -| Use the Enterprise Mode IE website list | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1511 | This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode, instead of Standard mode, because of compatibility issues. Users can’t edit this list.

If you enable this policy setting, Internet Explorer downloads the Enterprise Mode website list from the `HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE`\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode hive, opening all included websites using Enterprise Mode. We recommend storing and downloading your list from a secure web server `(https://)`, to help protect against data tampering.

If you disable or don’t configure this policy setting, Internet Explorer opens all websites using **Standard** mode. | - -## Removed Group Policy settings -IE11 no longer supports these Group Policy settings: - -- Turn on Internet Explorer 7 Standards Mode - -- Turn off Compatibility View button - -- Turn off Quick Tabs functionality - -- Turn off the quick pick menu - -- Use large icons for command buttons - -## Viewing your policy settings -After you've finished updating and deploying your Group Policy, you can use the Resultant Set of Policy (RSoP) snap-in to view your settings. - -**To use the RSoP snap-in** - -1. Open and run the Resultant Set of Policy (RSoP) wizard, specifying the information you want to see. - -2. Open your wizard results in the Group Policy Management Console (GPMC).

-For complete instructions about how to add, open, and use RSoP, see [Use the RSoP Snap-in](https://go.microsoft.com/fwlink/p/?LinkId=395201) - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: New group policy settings for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 669cc1a6-e2cb-403f-aa31-c1de52a615d1 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: New group policy settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# New group policy settings for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Internet Explorer 11 gives you some new Group Policy settings to help you manage your company's web browser configurations, including: + + +| Policy | Category Path | Supported on | Explanation | +|-----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Allow IE to use the HTTP2 network protocol | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE uses the HTTP2 network protocol. HTTP2 works with HTTP requests to optimize the latency of network requests through compression, multiplexing, and prioritization.

If you enable this policy setting, IE uses the HTTP2 network protocol.

If you disable this policy setting, IE won't use the HTTP2 network protocol.

If you don't configure this policy setting, users can turn this behavior on or off, using the **Internet Explorer Advanced Internet Options** settings. The default is on. | +| Allow IE to use the SPDY/3 network protocol | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether Internet Explorer uses the SPDY/3 network protocol. SPDY/3 works with HTTP requests to optimize the latency of network requests through compression, multiplexing and prioritization.

If you enable this policy setting, Internet Explorer uses the SPDY/3 network protocol.

If you disable this policy setting, Internet Explorer won't use the SPDY/3 network protocol.

If you don't configure this policy setting, users can turn this behavior on or off, on the **Advanced\* tab of the \*\*Internet Options** dialog box. The default is on.

**Note**
We've replaced the SPDY/3 protocol with the HTTP2 protocol in Windows 10. You can configure the HTTP2 protocol by using the **Allow IE to use the HTTP2 network protocol** setting. | +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10 | This policy setting allows IE to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user’s keystrokes are sent to Microsoft through Microsoft services.

If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.

If you disable this policy setting, users won’t receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.

If you don’t configure this policy setting, users can change the **Suggestions** setting on the **Settings** charm. | +| Allow only approved domains to use the TDC ActiveX control |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
| IE11 in Windows 10 | This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the **Internet** and **Restricted Sites** security zones.

If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.

If you disable this policy setting, users can run the TDC Active X control from all sites in the specified zone. | +| Allow SSL3 Fallback | Administrative Templates\Windows Components\Internet Explorer\Security Features | Internet Explorer 11 on Windows 10 | This policy setting allows you to stop websites from falling back to using Secure Socket Layer (SSL) 3.0 or lower, if Transport Layer Security (TLS) 1.0 or higher, fails. This setting doesn’t affect which security protocols are enabled.

If you enable this policy setting and a website fails while using the TLS 1.0 or higher security protocols, Internet Explorer will try to fallback and use SSL 3.0 or lower security protocols.

If you disable or don’t configure this setting, Internet Explorer uses the default system protocols.

**Important:**
By default, SSL 3.0 is disabled. If you choose to enable SSL 3.0, we recommend that you disable or don't configure this setting to help mitigate potential man-in-the-middle attacks. | +| Allow VBScript to run in Internet Explorer |

  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Internet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Intranet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Local Machine Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Internet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Intranet Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Local Machine Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Restricted Sites Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Trusted Sites Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Restricted Sites Zone
  • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Trusted Sites Zone
| Internet Explorer 11 | This policy setting lets you decide whether VBScript can run on pages in specific Internet Explorer zones.

If you enable this policy setting (default), you must also pick one of the following options from the Options box:

  • Enable. VBScript runs on pages in specific zones, without any interaction.
  • Prompt. Employees are prompted whether to allow VBScript to run in the zone.
  • Disable. VBScript is prevented from running in the zone.

If you disable or don’t configure this policy setting, VBScript runs without any interaction in the specified zone. | +| Always send Do Not Track header | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | At least Internet Explorer 10 | This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.

If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.

**In Internet Explorer 9 and 10:**
If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.

**In at least IE11:**
If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.

If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced\* tab of the \*\*Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. | +| Don't run antimalware programs against ActiveX controls
(Internet, Restricted Zones) |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
| IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. | +| Don't run antimalware programs against ActiveX controls
(Intranet, Trusted, Local Machine Zones) |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
| IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. | +| Hide the button (next to the New Tab button) that opens Microsoft Edge | User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ | IE11 on Windows 10, version 1703 | This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | +| Let users turn on and use Enterprise Mode from the **Tools** menu | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10 | This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.

If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.

If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. | +| Limit Site Discovery output by Domain | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.

**Note:**
You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | +| Limit Site Discovery output by Zone | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.

To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

  • 0 – Restricted Sites zone
  • 0 – Internet zone
  • 0 – Trusted Sites zone
  • 0 – Local Intranet zone
  • 0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
  • 0 – Restricted Sites zone
  • 0 – Internet zone
  • 0 – Trusted Sites zone
  • 1 – Local Intranet zone
  • 0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
  • 1 – Restricted Sites zone
  • 0 – Internet zone
  • 1 – Trusted Sites zone
  • 1 – Local Intranet zone
  • 1 – Local Machine zone

**Note:**
You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | +| Prevent deleting ActiveX Filtering, Tracking Protection and Do Not Track data | Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History | At least Windows Internet Explorer 9 | **In Internet Explorer 9 and Internet Explorer 10:**
This policy setting prevents users from deleting ActiveX Filtering and Tracking Protection data, which includes the list of websites for which the user has chosen to disable ActiveX Filtering or Tracking Protection. In addition, Tracking Protection data is also collected if users turn on the **Personalized Tracking Protection List**, which blocks third-party items while the user is browsing.

**In IE11:**
This policy setting prevents users from deleting ActiveX Filtering, Tracking Protection data, and Do Not Track exceptions, stored in the **Delete Browsing History** dialog box, for visited websites.

If you enable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is preserved when the user clicks **Delete**.

If you disable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is deleted when the user clicks **Delete**.

If you don’t configure this policy setting, users can turn this feature on and off, determining whether to delete ActiveX Filtering, Tracking Protection, and Do Not Track data when clicking **Delete**. | +| Send all sites not included in the Enterprise Mode Site List to Microsoft Edge | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1607 | This policy setting lets you decide whether to open all sites that aren’t specified to open in IE11 by the Enterprise Mode site list, to open in Microsoft Edge.

If you enable this policy setting, you must also enable the Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list policy setting and you must include at least one site in the Enterprise Mode site list.

If you disable or don't configure this policy setting, all sites will open based on the currently active browser.

**Note:**
If you’ve also enabled the Administrative Templates\Windows Components\Microsoft Edge\Send all intranet sites to Internet Explorer 11 policy setting, then all intranet sites will continue to open in Internet Explorer 11. | +| Show message when opening sites in Microsoft Edge using Enterprise Mode | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1607 | This policy setting lets you decide whether employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.

If you enable this policy setting, employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.

If you disable or don't configure this policy setting, the default app behavior occurs and no additional page appears. | +| Turn off automatic download of the ActiveX VersionList | Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management | At least Windows Internet Explorer 8 | This policy setting allows you to decide whether Internet Explorer automatically downloads updated versions of Microsoft's VersionList.XML file. This file tells Internet Explorer whether to stop specific ActiveX controls from loading.

If you enable this policy setting, Internet Explorer stops automatically downloading updated versions of the VersionList.XML file.

If you disable or don’t configure this setting, Internet Explorer continues to download updated versions of the VersionList.XML file.

**Important:**
Stopping this file from updating breaks the out-of-date ActiveX control blocking feature, potentially compromising the security of the device. For more info, see the Out-of-Date ActiveX Control Blocking () topic. | +| Turn off loading websites and content in the background to optimize performance | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether Internet Explorer preemptively loads websites and content in the background, speeding up performance such that when the user clicks a hyperlink, the background page seamlessly switches into view.

If you enable this policy setting, IE doesn't load any websites or content in the background.

If you disable this policy setting, IE preemptively loads websites and content in the background.

If you don’t configure this policy setting, users can turn this behavior on or off, using IE settings. This feature is turned on by default. | +| Turn off phone number detection | Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing | IE11 on Windows 10 | This policy setting determines whether phone numbers are recognized and turned into hyperlinks, which can be used to invoke the default phone application on the system.

If you enable this policy setting, phone number detection is turned off. Users won’t be able to modify this setting.

If you disable this policy setting, phone number detection is turned on. Users won’t be able to modify this setting.

If you don't configure this policy setting, users can turn this behavior on or off, using IE settings. The default is on. | +| Turn off sending URL path as UTF-8 | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\URL Encoding | At least Windows Internet Explorer 7 | This policy setting determines whether to let IE send the path portion of a URL using the UTF-8 standard. This standard defines characters so they're readable in any language and lets you exchange Internet addresses (URLs) with characters included in any language.

If you enable this policy setting, UTF-8 is not allowed. Users won't be able to change this setting.

If you disable this policy setting, UTF-8 is allowed. Users won't be able to change this setting.

If you don't configure this policy setting, users can turn this behavior on or off. | +| Turn off sending UTF-8 query strings for URLs | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE uses 8-bit Unicode Transformation Format (UTF-8) to encode query strings in URLs before sending them to servers or to proxy servers.

If you enable this policy setting, you must specify when to use UTF-8 to encode query strings:

  • **0.** Never encode query strings.
  • **1.** Only encode query strings for URLs that aren't in the Intranet zone.
  • **2.** Only encode query strings for URLs that are in the Intranet zone.
  • **3.** Always encode query strings.

If you disable or don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Options settings. The default is to encode all query strings in UTF-8. | +| Turn off the ability to launch report site problems using a menu option | Administrative Templates\Windows Components\Internet Explorer\Browser menus | Internet Explorer 11 | This policy setting allows you to manage whether users can start the **eport Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu.

If you enable this policy setting, users won’t be able to start the **Report Site Problems** dialog box from the Internet Explorer settings or the Tools menu.

If you disable or don’t configure this policy setting, users will be able to start the **Report Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu. | +| Turn off the flip ahead with page prediction feature | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | At least Internet Explorer 10 on Windows 8 | This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.

If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn’t loaded into the background.

If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.

If you don’t configure this setting, users can turn this behavior on or off, using the **Settings** charm.

**Note**
Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn’t available for Internet Explorer for the desktop. | +| Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you enable this policy setting, IE11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you disable this policy setting, IE11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you don't configure this policy setting, users can turn this feature on or off using IE settings. This feature is turned off by default.

**Important**
When using 64-bit processes, some ActiveX controls and toolbars might not be available. | +| Turn on Site Discovery WMI output | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to manage the WMI output functionality of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an WMI class, which can be aggregated by using a client-management solution, such as Microsoft Endpoint Configuration Manager.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an WMI class.

**Note:**
Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. | +| Turn on Site Discovery XML output | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to manage the XML output functionality of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an XML file, stored in your specified location.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an XML file.

**Note:**
Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. | +| Use the Enterprise Mode IE website list | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1511 | This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode, instead of Standard mode, because of compatibility issues. Users can’t edit this list.

If you enable this policy setting, Internet Explorer downloads the Enterprise Mode website list from the `HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE`\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode hive, opening all included websites using Enterprise Mode. We recommend storing and downloading your list from a secure web server `(https://)`, to help protect against data tampering.

If you disable or don’t configure this policy setting, Internet Explorer opens all websites using **Standard** mode. | + +## Removed Group Policy settings +IE11 no longer supports these Group Policy settings: + +- Turn on Internet Explorer 7 Standards Mode + +- Turn off Compatibility View button + +- Turn off Quick Tabs functionality + +- Turn off the quick pick menu + +- Use large icons for command buttons + +## Viewing your policy settings +After you've finished updating and deploying your Group Policy, you can use the Resultant Set of Policy (RSoP) snap-in to view your settings. + +**To use the RSoP snap-in** + +1. Open and run the Resultant Set of Policy (RSoP) wizard, specifying the information you want to see. + +2. Open your wizard results in the Group Policy Management Console (GPMC).

+For complete instructions about how to add, open, and use RSoP, see [Use the RSoP Snap-in](https://go.microsoft.com/fwlink/p/?LinkId=395201) + diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md index 32665259c3..a2f12352fd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md @@ -1,205 +1,212 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use out-of-date ActiveX control blocking to help you know when IE prevents a webpage from loading outdated ActiveX controls and to update the outdated control, so that it’s safer to use. -author: lomayor -ms.author: lomayor -ms.prod: ie11 -ms.assetid: e61866bb-1ff1-4a8d-96f2-61d3534e8199 -ms.reviewer: -audience: itpro manager: dansimp -title: Out-of-date ActiveX control blocking (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 05/10/2018 ---- - - -# Out-of-date ActiveX control blocking - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) -- Windows Vista SP2 - -ActiveX controls are small apps that let websites provide content, like videos, games, and let you interact with content like toolbars. Unfortunately, because many ActiveX controls aren’t automatically updated, they can become outdated as new versions are released. It’s very important that you keep your ActiveX controls up-to-date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a new security feature, called *out-of-date ActiveX control blocking*. - -Out-of-date ActiveX control blocking lets you: - -- Know when IE prevents a webpage from loading common, but outdated ActiveX controls. - -- Interact with other parts of the webpage that aren’t affected by the outdated control. - -- Update the outdated control, so that it’s up-to-date and safer to use. - -The out-of-date ActiveX control blocking feature works with all [Security Zones](https://go.microsoft.com/fwlink/p/?LinkId=403863), except the Local Intranet Zone and the Trusted Sites Zone. - -It also works with these operating system and IE combinations: - -|Windows operating system |IE version | -|----------------------------------------|---------------------------------| -|Windows 10 |All supported versions of IE.
Microsoft Edge doesn't support ActiveX controls. | -|Windows 8.1 and Windows 8.1 Update |All supported versions of IE | -|Windows 7 SP1 |All supported versions of IE | -|Windows Server 2012 |All supported versions of IE | -|Windows Server 2008 R2 SP1 |All supported versions of IE | -|Windows Server 2008 SP2 |Windows Internet Explorer 9 only | -|Windows Vista SP2 |Windows Internet Explorer 9 only | - -For more info about this new feature, see the [Internet Explorer begins blocking out-of-date ActiveX controls](https://go.microsoft.com/fwlink/p/?LinkId=507691) blog. To see the complete list of out-of-date Active controls blocked by this feature, see [Blocked out-of-date ActiveX controls](blocked-out-of-date-activex-controls.md). - - -## What does the out-of-date ActiveX control blocking notification look like? -When IE blocks an outdated ActiveX control, you’ll see a notification bar similar to this, depending on your version of IE: - -**Internet Explorer 9 through Internet Explorer 11** - -![Warning about outdated activex controls (ie9+)](images/outdatedcontrolwarning.png) - -**Windows Internet Explorer 8** - -![Warning about outdated activex controls (ie8)](images/ieoutdatedcontrolwarning.png) - -Out-of-date ActiveX control blocking also gives you a security warning that tells you if a webpage tries to launch specific outdated apps, outside of IE: - -![Warning about outdated activex controls outside ie](images/ieoutdatedcontroloutsideofie.png) - - -## How do I fix an outdated ActiveX control or app? -From the notification about the outdated ActiveX control, you can go to the control’s website to download its latest version. - - **To get the updated ActiveX control** - -1. From the notification bar, tap or click **Update**.

-IE opens the ActiveX control’s website. - -2. Download the latest version of the control. - -**Security Note:**
If you don’t fully trust a site, you shouldn’t allow it to load an outdated ActiveX control. However, although we don’t recommend it, you can view the missing webpage content by tapping or clicking **Run this time**. This option runs the ActiveX control without updating or fixing the problem. The next time you visit a webpage running the same outdated ActiveX control, you’ll get the notification again. - - **To get the updated app** - -1. From the security warning, tap or click **Update** link.

-IE opens the app’s website. - -2. Download the latest version of the app. - -**Security Note:**
If you don’t fully trust a site, you shouldn’t allow it to launch an outdated app. However, although we don’t recommend it, you can let the webpage launch the app by tapping or clicking **Allow**. This option opens the app without updating or fixing the problem. The next time you visit a webpage running the same outdated app, you’ll get the notification again. - -## How does IE decide which ActiveX controls to block? -IE uses Microsoft’s versionlist.xml or versionlistWin7.xml file to determine whether an ActiveX control should be stopped from loading. These files are updated with newly-discovered out-of-date ActiveX controls, which IE automatically downloads to your local copy of the file. - -You can see your copy of the file here `%LOCALAPPDATA%\Microsoft\Internet Explorer\VersionManager\versionlist.xml` or you can view Microsoft’s version, based on your operating system and version of IE, here: -- [Internet Explorer 11 on Windows 7 SP1 or Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?LinkId=798230) -- [All other configurations](https://go.microsoft.com/fwlink/p/?LinkId=403864) - -**Security Note:**
Although we strongly recommend against it, if you don’t want your computer to automatically download the updated version list from Microsoft, run the following command from a command prompt: - -``` -reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v DownloadVersionList /t REG_DWORD /d 0 /f -``` -Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. Use this configuration option at your own risk. - -## Out-of-date ActiveX control blocking on managed devices -Out-of-date ActiveX control blocking includes four new Group Policy settings that you can use to manage your web browser configuration, based on your domain controller. You can download the administrative templates, including the new settings, from the [Administrative templates (.admx) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=746579) page or the [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) page, depending on your operating system. - -### Group Policy settings -Here’s a list of the new Group Policy info, including the settings, location, requirements, and Help text strings. All of these settings can be set in either the Computer Configuration or User Configuration scope, but Computer Configuration takes precedence over User Configuration. - -**Important**
-Out-of-date ActiveX control blocking is turned off in the Local Intranet Zone and the Trusted Sites Zone; therefore, intranet websites and line-of-business apps will continue to use out-of-date ActiveX controls without disruption. - -|Setting |Category path |Supported on |Help text | -|--------|--------------|-------------|----------| -|Turn on ActiveX control logging in IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting determines whether IE saves log information for ActiveX controls.

If you enable this setting, IE logs ActiveX control information (including the source URI that loaded the control and whether it was blocked) to a local file.

If you disable or don't configure this setting, IE won't log ActiveX control information.

Note that you can turn this setting on or off regardless of the **Turn off blocking of outdated ActiveX controls for IE** or **Turn off blocking of outdated ActiveX controls for IE on specific domains** settings. | -|Remove the **Run this time** button for outdated ActiveX controls in IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management`|Internet Explorer 8 through IE11 |This setting allows you stop users from seeing the **Run this time** button and from running specific outdated ActiveX controls in IE.

If you enable this setting, users won't see the **Run this time** button on the warning message that appears when IE blocks an outdated ActiveX control.

If you disable or don't configure this setting, users will see the **Run this time** button on the warning message that appears when IE blocks an outdated ActiveX control. Clicking this button lets the user run the outdated ActiveX control once. | -|Turn off blocking of outdated ActiveX controls for IE on specific domains |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting allows you to manage a list of domains on which IE will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

If you enable this setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in IE. Each domain entry must be formatted like one of the following:

  • **"domainname.TLD".** For example, if you want to include `*.contoso.com/*`, use "contoso.com".
  • **"hostname".** For example, if you want to include `https://example`, use "example".
  • **"file:///path/filename.htm"**. For example, use `file:///C:/Users/contoso/Desktop/index.htm`.

If you disable or don't configure this setting, the list is deleted and IE continues to block specific outdated ActiveX controls on all domains in the Internet Zone. | -|Turn off blocking of outdated ActiveX controls for IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting determines whether IE blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

If you enable this setting, IE stops blocking outdated ActiveX controls.

If you disable or don't configure this setting, IE continues to block specific outdated ActiveX controls. | -|Remove the **Update** button in the out-of-date ActiveX control blocking notification for IE |This functionality is only available through the registry |Internet Explorer 8 through IE11 |This setting determines whether the out-of-date ActiveX control blocking notification shows the **Update** button. This button points users to update specific out-of-date ActiveX controls in IE. | - - -If you don't want to use Group Policy, you can also turn these settings on or off using the registry. You can update the registry manually. - -|Setting |Registry setting | -|-------------------------|----------------------------------------------------------------| -|Turn on ActiveX control logging in IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v AuditModeEnabled /t REG_DWORD /d 1 /f`

Where:

  • **0 or not configured.** Logs ActiveX control information (including the source URI that loaded the control and whether it was blocked) to a local file.
  • **1.** Logs ActiveX control information.
| -|Remove **Run this time** button for outdated ActiveX controls in IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v RunThisTimeEnabled /t REG_DWORD /d 0 /f`

Where:

  • **0.** Removes the **Run this time** button.
  • **1 or not configured.** Leaves the **Run this time** button.
| -|Turn off blocking of outdated ActiveX controls for IE on specific domains |reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\Domain" /v contoso.com /t REG_SZ /f

Where:

  • **contoso.com.** A single domain on which outdated ActiveX controls won't be blocked in IE. Use a new `reg add` command for each domain you wish to add to the **Allow** list.
| -|Turn off blocking of outdated ActiveX controls for IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v VersionCheckEnabled /t REG_DWORD /d 0 /f`

Where:

  • **0.** Stops blocking outdated ActiveX controls.
  • **1 or not configured.** Continues to block specific outdated ActiveX controls.
| -|Remove the **Update** button in the out-of-date ActiveX control blocking notification for IE |`reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v UpdateEnabled /t REG_DWORD /d 0 /f`

Where:

  • **0.** Removes the **Update** button
  • **1 or not configured.** Leaves the **Update** button.
- -## Inventory your ActiveX controls -You can inventory the ActiveX controls being used in your company, by turning on the **Turn on ActiveX control logging in IE** setting: - -- **Windows 10:** Through a comma-separated values (.csv) file or through a local Windows Management Instrumentation (WMI) class. - -- **All other versions of Microsoft Windows:** Through a .csv file only. - - -### Inventory your ActiveX controls by using a .CSV file -If you decide to inventory the ActiveX controls being used in your company by turning on the **Turn on ActiveX control logging in IE** setting, IE logs the ActiveX control information to the `%LOCALAPPDATA%\Microsoft\Internet Explorer\AuditMode\VersionAuditLog.csv` file. - -Here’s a detailed example and description of what’s included in the VersionAuditLog.csv file. - -|Source URI |File path |Product version |File version |Allowed/Blocked |Reason |EPM-compatible | -|-----------|----------|----------------|-------------|----------------|-------|---------------| -|`https://contoso.com/test1.html` |C:\Windows\System32\Macromed\Flash\Flash.ocx |14.0.0.125 |14.0.0.125 |Allowed |Not in blocklist |EPM-compatible | -|`https://contoso.com/test2.html` |C:\Program Files\Java\jre6\bin\jp2iexp.dll |6.0.410.2 |6.0.410.2 |Blocked |Out of date |Not EPM-compatible | - -**Where:** -- **Source URI.** The URL of the page that loaded the ActiveX control. - -- **File path.** The location of the binary that implements the ActiveX control. - -- **Product version.** The product version of the binary that implements the ActiveX control. - -- **File version.** The file version of the binary that implements the ActiveX control. - -- **Allowed/Blocked** Whether IE blocked the ActiveX control. - -- **Enhanced Protected Mode (EPM)-compatible.** Whether the loaded ActiveX control is compatible with [Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=403865).

**Note**
Enhanced Protected Mode isn’t supported on Internet Explorer 9 or earlier versions of IE. Therefore, if you’re using Internet Explorer 8 or Internet Explorer 9, all ActiveX controls will always be marked as not EPM-compatible. - -- **Reason.** The ActiveX control can be blocked or allowed for any of these reasons: - -|Reason |Corresponds to |Description | -|-------------------------|---------------|-------------------------------------------------| -|Version not in blocklist |Allowed |The version of the loaded ActiveX control is explicitly allowed by the IE version list. | -|Trusted domain |Allowed |The ActiveX control was loaded on a domain listed in the **Turn off blocking of outdated ActiveX controls for IE on specific domains** setting. | -|File doesn’t exist |Allowed |The loaded ActiveX control is missing required binaries to run correctly. | -|Out-of-date |Blocked |The loaded ActiveX control is explicitly blocked by the IE version list because it is out-of-date. | -|Not in blocklist |Allowed |The loaded ActiveX control isn’t in the IE version list. | -|Managed by policy |Allowed |The loaded ActiveX control is managed by a Group Policy setting that isn’t listed here, and will be managed in accordance with that Group Policy setting. | -|Trusted Site Zone or intranet |Allowed |The ActiveX control was loaded in the Trusted Sites Zone or the Local Intranet Zone. | -|Hardblocked |Blocked |The loaded ActiveX control is blocked in IE because it contains known security vulnerabilities. | -|Unknown |Allowed or blocked |None of the above apply. | - -### Inventory your ActiveX controls by using a local WMI class -For Windows 10 you also have the option to log your inventory info to a local WMI class. Info logged to this class includes all of info you get from the .csv file, plus the CLSID of the loaded ActiveX control or the name of any apps started from an ActiveX control. - -#### Before you begin -Before you can use WMI to inventory your ActiveX controls, you need to [download the configuration package (.zip file)](https://go.microsoft.com/fwlink/p/?LinkId=616971), which includes: - -- **ConfigureWMILogging.ps1**. A Windows PowerShell script. - -- **ActiveXWMILogging.mof**. A managed object file. - -Before running the PowerShell script, you must copy both the .ps1 and .mof file to the same directory location, on the client computer. - - **To configure IE to use WMI logging** - -1. Open your Group Policy editor and turn on the `Administrative Templates\Windows Components\Internet Explorer\Turn on ActiveX control logging in IE` setting. - -2. On the client device, start PowerShell in elevated mode (using admin privileges) and run `ConfigureWMILogging.ps1` by by-passing the PowerShell execution policy, using this command: - ``` - powershell –ExecutionPolicy Bypass .\ConfigureWMILogging.ps1 - ``` - For more info, see [about_Execution_Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). - -3. **Optional:** Set up your domain firewall for WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md). - -The inventory info appears in the WMI class, `IEAXControlBlockingAuditInfo`, located in the WMI namespace, *root\\cimv2\\IETelemetry*. To collect the inventory info from your client computers, we recommend using System Center 2012 R2 Configuration Manager or any agent that can access the WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md). - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Use out-of-date ActiveX control blocking to help you know when IE prevents a webpage from loading outdated ActiveX controls and to update the outdated control, so that it’s safer to use. +author: dansimp +ms.author: dansimp +ms.prod: ie11 +ms.assetid: e61866bb-1ff1-4a8d-96f2-61d3534e8199 +ms.reviewer: +audience: itpro +manager: dansimp +title: Out-of-date ActiveX control blocking (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 05/10/2018 +--- + + +# Out-of-date ActiveX control blocking + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows Vista SP2 + +ActiveX controls are small apps that let websites provide content, like videos, games, and let you interact with content like toolbars. Unfortunately, because many ActiveX controls aren’t automatically updated, they can become outdated as new versions are released. It’s very important that you keep your ActiveX controls up-to-date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a new security feature, called *out-of-date ActiveX control blocking*. + +Out-of-date ActiveX control blocking lets you: + +- Know when IE prevents a webpage from loading common, but outdated ActiveX controls. + +- Interact with other parts of the webpage that aren’t affected by the outdated control. + +- Update the outdated control, so that it’s up-to-date and safer to use. + +The out-of-date ActiveX control blocking feature works with all [Security Zones](https://go.microsoft.com/fwlink/p/?LinkId=403863), except the Local Intranet Zone and the Trusted Sites Zone. + +It also works with these operating system and IE combinations: + +|Windows operating system |IE version | +|----------------------------------------|---------------------------------| +|Windows 10 |All supported versions of IE.
Microsoft Edge doesn't support ActiveX controls. | +|Windows 8.1 and Windows 8.1 Update |All supported versions of IE | +|Windows 7 SP1 |All supported versions of IE | +|Windows Server 2012 |All supported versions of IE | +|Windows Server 2008 R2 SP1 |All supported versions of IE | +|Windows Server 2008 SP2 |Windows Internet Explorer 9 only | +|Windows Vista SP2 |Windows Internet Explorer 9 only | + +For more info about this new feature, see the [Internet Explorer begins blocking out-of-date ActiveX controls](https://go.microsoft.com/fwlink/p/?LinkId=507691) blog. To see the complete list of out-of-date Active controls blocked by this feature, see [Blocked out-of-date ActiveX controls](blocked-out-of-date-activex-controls.md). + + +## What does the out-of-date ActiveX control blocking notification look like? +When IE blocks an outdated ActiveX control, you’ll see a notification bar similar to this, depending on your version of IE: + +**Internet Explorer 9 through Internet Explorer 11** + +![Warning about outdated activex controls (ie9+)](images/outdatedcontrolwarning.png) + +**Windows Internet Explorer 8** + +![Warning about outdated activex controls (ie8)](images/ieoutdatedcontrolwarning.png) + +Out-of-date ActiveX control blocking also gives you a security warning that tells you if a webpage tries to launch specific outdated apps, outside of IE: + +![Warning about outdated activex controls outside ie](images/ieoutdatedcontroloutsideofie.png) + + +## How do I fix an outdated ActiveX control or app? +From the notification about the outdated ActiveX control, you can go to the control’s website to download its latest version. + + **To get the updated ActiveX control** + +1. From the notification bar, tap or click **Update**.

+IE opens the ActiveX control’s website. + +2. Download the latest version of the control. + +**Security Note:**
If you don’t fully trust a site, you shouldn’t allow it to load an outdated ActiveX control. However, although we don’t recommend it, you can view the missing webpage content by tapping or clicking **Run this time**. This option runs the ActiveX control without updating or fixing the problem. The next time you visit a webpage running the same outdated ActiveX control, you’ll get the notification again. + + **To get the updated app** + +1. From the security warning, tap or click **Update** link.

+IE opens the app’s website. + +2. Download the latest version of the app. + +**Security Note:**
If you don’t fully trust a site, you shouldn’t allow it to launch an outdated app. However, although we don’t recommend it, you can let the webpage launch the app by tapping or clicking **Allow**. This option opens the app without updating or fixing the problem. The next time you visit a webpage running the same outdated app, you’ll get the notification again. + +## How does IE decide which ActiveX controls to block? +IE uses Microsoft’s versionlist.xml or versionlistWin7.xml file to determine whether an ActiveX control should be stopped from loading. These files are updated with newly-discovered out-of-date ActiveX controls, which IE automatically downloads to your local copy of the file. + +You can see your copy of the file here `%LOCALAPPDATA%\Microsoft\Internet Explorer\VersionManager\versionlist.xml` or you can view Microsoft’s version, based on your operating system and version of IE, here: +- [Internet Explorer 11 on Windows 7 SP1 or Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?LinkId=798230) +- [All other configurations](https://go.microsoft.com/fwlink/p/?LinkId=403864) + +**Security Note:**
Although we strongly recommend against it, if you don’t want your computer to automatically download the updated version list from Microsoft, run the following command from a command prompt: + +``` +reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v DownloadVersionList /t REG_DWORD /d 0 /f +``` +Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. Use this configuration option at your own risk. + +## Out-of-date ActiveX control blocking + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + on managed devices +Out-of-date ActiveX control blocking includes four new Group Policy settings that you can use to manage your web browser configuration, based on your domain controller. You can download the administrative templates, including the new settings, from the [Administrative templates (.admx) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=746579) page or the [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) page, depending on your operating system. + +### Group Policy settings +Here’s a list of the new Group Policy info, including the settings, location, requirements, and Help text strings. All of these settings can be set in either the Computer Configuration or User Configuration scope, but Computer Configuration takes precedence over User Configuration. + +**Important**
+Out-of-date ActiveX control blocking is turned off in the Local Intranet Zone and the Trusted Sites Zone; therefore, intranet websites and line-of-business apps will continue to use out-of-date ActiveX controls without disruption. + +|Setting |Category path |Supported on |Help text | +|--------|--------------|-------------|----------| +|Turn on ActiveX control logging in IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting determines whether IE saves log information for ActiveX controls.

If you enable this setting, IE logs ActiveX control information (including the source URI that loaded the control and whether it was blocked) to a local file.

If you disable or don't configure this setting, IE won't log ActiveX control information.

Note that you can turn this setting on or off regardless of the **Turn off blocking of outdated ActiveX controls for IE** or **Turn off blocking of outdated ActiveX controls for IE on specific domains** settings. | +|Remove the **Run this time** button for outdated ActiveX controls in IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management`|Internet Explorer 8 through IE11 |This setting allows you stop users from seeing the **Run this time** button and from running specific outdated ActiveX controls in IE.

If you enable this setting, users won't see the **Run this time** button on the warning message that appears when IE blocks an outdated ActiveX control.

If you disable or don't configure this setting, users will see the **Run this time** button on the warning message that appears when IE blocks an outdated ActiveX control. Clicking this button lets the user run the outdated ActiveX control once. | +|Turn off blocking of outdated ActiveX controls for IE on specific domains |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting allows you to manage a list of domains on which IE will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

If you enable this setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in IE. Each domain entry must be formatted like one of the following:

  • **"domainname.TLD".** For example, if you want to include `*.contoso.com/*`, use "contoso.com".
  • **"hostname".** For example, if you want to include `https://example`, use "example".
  • **"file:///path/filename.htm"**. For example, use `file:///C:/Users/contoso/Desktop/index.htm`.

If you disable or don't configure this setting, the list is deleted and IE continues to block specific outdated ActiveX controls on all domains in the Internet Zone. | +|Turn off blocking of outdated ActiveX controls for IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting determines whether IE blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

If you enable this setting, IE stops blocking outdated ActiveX controls.

If you disable or don't configure this setting, IE continues to block specific outdated ActiveX controls. | +|Remove the **Update** button in the out-of-date ActiveX control blocking notification for IE |This functionality is only available through the registry |Internet Explorer 8 through IE11 |This setting determines whether the out-of-date ActiveX control blocking notification shows the **Update** button. This button points users to update specific out-of-date ActiveX controls in IE. | + + +If you don't want to use Group Policy, you can also turn these settings on or off using the registry. You can update the registry manually. + +|Setting |Registry setting | +|-------------------------|----------------------------------------------------------------| +|Turn on ActiveX control logging in IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v AuditModeEnabled /t REG_DWORD /d 1 /f`

Where:

  • **0 or not configured.** Logs ActiveX control information (including the source URI that loaded the control and whether it was blocked) to a local file.
  • **1.** Logs ActiveX control information.
| +|Remove **Run this time** button for outdated ActiveX controls in IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v RunThisTimeEnabled /t REG_DWORD /d 0 /f`

Where:

  • **0.** Removes the **Run this time** button.
  • **1 or not configured.** Leaves the **Run this time** button.
| +|Turn off blocking of outdated ActiveX controls for IE on specific domains |reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\Domain" /v contoso.com /t REG_SZ /f

Where:

  • **contoso.com.** A single domain on which outdated ActiveX controls won't be blocked in IE. Use a new `reg add` command for each domain you wish to add to the **Allow** list.
| +|Turn off blocking of outdated ActiveX controls for IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v VersionCheckEnabled /t REG_DWORD /d 0 /f`

Where:

  • **0.** Stops blocking outdated ActiveX controls.
  • **1 or not configured.** Continues to block specific outdated ActiveX controls.
| +|Remove the **Update** button in the out-of-date ActiveX control blocking notification for IE |`reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v UpdateEnabled /t REG_DWORD /d 0 /f`

Where:

  • **0.** Removes the **Update** button
  • **1 or not configured.** Leaves the **Update** button.
+ +## Inventory your ActiveX controls +You can inventory the ActiveX controls being used in your company, by turning on the **Turn on ActiveX control logging in IE** setting: + +- **Windows 10:** Through a comma-separated values (.csv) file or through a local Windows Management Instrumentation (WMI) class. + +- **All other versions of Microsoft Windows:** Through a .csv file only. + + +### Inventory your ActiveX controls by using a .CSV file +If you decide to inventory the ActiveX controls being used in your company by turning on the **Turn on ActiveX control logging in IE** setting, IE logs the ActiveX control information to the `%LOCALAPPDATA%\Microsoft\Internet Explorer\AuditMode\VersionAuditLog.csv` file. + +Here’s a detailed example and description of what’s included in the VersionAuditLog.csv file. + +|Source URI |File path |Product version |File version |Allowed/Blocked |Reason |EPM-compatible | +|-----------|----------|----------------|-------------|----------------|-------|---------------| +|`https://contoso.com/test1.html` |C:\Windows\System32\Macromed\Flash\Flash.ocx |14.0.0.125 |14.0.0.125 |Allowed |Not in blocklist |EPM-compatible | +|`https://contoso.com/test2.html` |C:\Program Files\Java\jre6\bin\jp2iexp.dll |6.0.410.2 |6.0.410.2 |Blocked |Out of date |Not EPM-compatible | + +**Where:** +- **Source URI.** The URL of the page that loaded the ActiveX control. + +- **File path.** The location of the binary that implements the ActiveX control. + +- **Product version.** The product version of the binary that implements the ActiveX control. + +- **File version.** The file version of the binary that implements the ActiveX control. + +- **Allowed/Blocked** Whether IE blocked the ActiveX control. + +- **Enhanced Protected Mode (EPM)-compatible.** Whether the loaded ActiveX control is compatible with [Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=403865).

**Note**
Enhanced Protected Mode isn’t supported on Internet Explorer 9 or earlier versions of IE. Therefore, if you’re using Internet Explorer 8 or Internet Explorer 9, all ActiveX controls will always be marked as not EPM-compatible. + +- **Reason.** The ActiveX control can be blocked or allowed for any of these reasons: + +|Reason |Corresponds to |Description | +|-------------------------|---------------|-------------------------------------------------| +|Version not in blocklist |Allowed |The version of the loaded ActiveX control is explicitly allowed by the IE version list. | +|Trusted domain |Allowed |The ActiveX control was loaded on a domain listed in the **Turn off blocking of outdated ActiveX controls for IE on specific domains** setting. | +|File doesn’t exist |Allowed |The loaded ActiveX control is missing required binaries to run correctly. | +|Out-of-date |Blocked |The loaded ActiveX control is explicitly blocked by the IE version list because it is out-of-date. | +|Not in blocklist |Allowed |The loaded ActiveX control isn’t in the IE version list. | +|Managed by policy |Allowed |The loaded ActiveX control is managed by a Group Policy setting that isn’t listed here, and will be managed in accordance with that Group Policy setting. | +|Trusted Site Zone or intranet |Allowed |The ActiveX control was loaded in the Trusted Sites Zone or the Local Intranet Zone. | +|Hardblocked |Blocked |The loaded ActiveX control is blocked in IE because it contains known security vulnerabilities. | +|Unknown |Allowed or blocked |None of the above apply. | + +### Inventory your ActiveX controls by using a local WMI class +For Windows 10 you also have the option to log your inventory info to a local WMI class. Info logged to this class includes all of info you get from the .csv file, plus the CLSID of the loaded ActiveX control or the name of any apps started from an ActiveX control. + +#### Before you begin +Before you can use WMI to inventory your ActiveX controls, you need to [download the configuration package (.zip file)](https://go.microsoft.com/fwlink/p/?LinkId=616971), which includes: + +- **ConfigureWMILogging.ps1**. A Windows PowerShell script. + +- **ActiveXWMILogging.mof**. A managed object file. + +Before running the PowerShell script, you must copy both the .ps1 and .mof file to the same directory location, on the client computer. + + **To configure IE to use WMI logging** + +1. Open your Group Policy editor and turn on the `Administrative Templates\Windows Components\Internet Explorer\Turn on ActiveX control logging in IE` setting. + +2. On the client device, start PowerShell in elevated mode (using admin privileges) and run `ConfigureWMILogging.ps1` by by-passing the PowerShell execution policy, using this command: + ``` + powershell –ExecutionPolicy Bypass .\ConfigureWMILogging.ps1 + ``` + For more info, see [about_Execution_Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). + +3. **Optional:** Set up your domain firewall for WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md). + +The inventory info appears in the WMI class, `IEAXControlBlockingAuditInfo`, located in the WMI namespace, *root\\cimv2\\IETelemetry*. To collect the inventory info from your client computers, we recommend using System Center 2012 R2 Configuration Manager or any agent that can access the WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md). + diff --git a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md index 7b0af11274..fbcbcbadb9 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md @@ -1,73 +1,77 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Possible solutions to the problems you might encounter after installing IE11, such as crashing or seeming slow, getting into an unusable state, or problems with adaptive streaming and DRM playback. -author: lomayor -ms.prod: ie11 -ms.assetid: c4b75ad3-9c4a-4dd2-9fed-69f776f542e6 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Problems after installing Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/16/2017 ---- - - -# Problems after installing Internet Explorer 11 -After you install Internet Explorer 11 in your organization, you might run into the following issues. By following these suggestions, you should be able to fix them. - -## Internet Explorer is in an unusable state -If IE11 gets into an unusable state on an employee's computer, you can use the **Reset Internet Explorer Settings (RIES)** feature to restore the default settings for many of the browser features, including: - -- Search scopes - -- Appearance settings - -- Toolbars - -- ActiveX® controls (resets to the opt-in state, unless they're pre-approved) - -- Branding settings created with IEAK 11 - -RIES does not: - -- Clear the Favorites list, RSS feeds, or Web slices. - -- Reset connection or proxy settings. - -- Affect the applied Administrative Template Group Policy settings. - -RIES turns off all custom toolbars, browser extensions, and customizations installed with IE11. If you change your mind, you can turn each of the customizations back on through the **Manage Add-ons** dialog box. For more information about resetting IE settings, see [How to Reset Internet Explorer Settings](https://go.microsoft.com/fwlink/p/?LinkId=214528). - -## IE is crashing or seems slow -If you notice that CPU usage is running higher than normal, or that IE is frequently crashing or slowing down, you should check your browser add-ons and video card. By default, IE11 uses graphics processing unit (GPU) rendering mode. However, some outdated video cards and video drivers don't support GPU hardware acceleration. If IE11 determines that your current video card or video driver doesn't support GPU hardware acceleration, it'll use Software Rendering mode. - - **To check your browser add-ons** - -1. Start IE11 in **No Add-ons mode** by running the **Run** command from the **Start** menu, and then typing `iexplore.exe -extoff` into the box. - -2. Check if IE still crashes.

- If the browser doesn't crash, open Internet Explorer for the desktop, click the **Tools** menu, and click **Manage Add-ons**. - -3. Click **Toolbars and Extensions**, click each toolbar or extension, clicking **Disable** to turn off all of the browser extensions and toolbars. - -4. Restart IE11. Go back to the **Manage Add-Ons** window and turn on each item, one-by-one.

- After you turn each item back on, see if IE crashes or slows down. Doing it this way will help you identify the add-on that's causing IE to crash. After you've figured out which add-on was causing the problem, turn it off until you have an update from the manufacturer. - - **To check for Software Rendering mode** - -5. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. - -6. On the **Advanced** tab, go to the **Accelerated graphics** section, and then turn on Software Rendering mode by choosing the **Use software rendering instead of GPU rendering** box.

- If the **Use software rendering instead of GPU rendering** option is greyed out, it means that your current video card or video driver doesn't support GPU hardware acceleration. For more information, see [Windows 10 Support](https://go.microsoft.com/fwlink/?LinkId=746588). - -## Adaptive streaming and DRM playback don’t work with Windows Server 2012 R2 -IE11 in Windows Server 2012 R2 doesn’t include media features like adaptive streaming or Digital Rights Management (DRM) playback. To add these features, you’ll need to download and install the Media Feature Pack from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=320789), as well as an app that uses PlayReady DRM from the Microsoft Store, such as the Xbox Music app or Xbox Video app. The app must be installed to specifically turn on DRM features, while all other media features are installed with the Media Feature Pack. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: Possible solutions to the problems you might encounter after installing IE11, such as crashing or seeming slow, getting into an unusable state, or problems with adaptive streaming and DRM playback. +author: dansimp +ms.prod: ie11 +ms.assetid: c4b75ad3-9c4a-4dd2-9fed-69f776f542e6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Problems after installing Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 10/16/2017 +--- + + +# Problems after installing Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +After you install Internet Explorer 11 in your organization, you might run into the following issues. By following these suggestions, you should be able to fix them. + +## Internet Explorer is in an unusable state +If IE11 gets into an unusable state on an employee's computer, you can use the **Reset Internet Explorer Settings (RIES)** feature to restore the default settings for many of the browser features, including: + +- Search scopes + +- Appearance settings + +- Toolbars + +- ActiveX® controls (resets to the opt-in state, unless they're pre-approved) + +- Branding settings created with IEAK 11 + +RIES does not: + +- Clear the Favorites list, RSS feeds, or Web slices. + +- Reset connection or proxy settings. + +- Affect the applied Administrative Template Group Policy settings. + +RIES turns off all custom toolbars, browser extensions, and customizations installed with IE11. If you change your mind, you can turn each of the customizations back on through the **Manage Add-ons** dialog box. For more information about resetting IE settings, see [How to Reset Internet Explorer Settings](https://go.microsoft.com/fwlink/p/?LinkId=214528). + +## IE is crashing or seems slow +If you notice that CPU usage is running higher than normal, or that IE is frequently crashing or slowing down, you should check your browser add-ons and video card. By default, IE11 uses graphics processing unit (GPU) rendering mode. However, some outdated video cards and video drivers don't support GPU hardware acceleration. If IE11 determines that your current video card or video driver doesn't support GPU hardware acceleration, it'll use Software Rendering mode. + + **To check your browser add-ons** + +1. Start IE11 in **No Add-ons mode** by running the **Run** command from the **Start** menu, and then typing `iexplore.exe -extoff` into the box. + +2. Check if IE still crashes.

+ If the browser doesn't crash, open Internet Explorer for the desktop, click the **Tools** menu, and click **Manage Add-ons**. + +3. Click **Toolbars and Extensions**, click each toolbar or extension, clicking **Disable** to turn off all of the browser extensions and toolbars. + +4. Restart IE11. Go back to the **Manage Add-Ons** window and turn on each item, one-by-one.

+ After you turn each item back on, see if IE crashes or slows down. Doing it this way will help you identify the add-on that's causing IE to crash. After you've figured out which add-on was causing the problem, turn it off until you have an update from the manufacturer. + + **To check for Software Rendering mode** + +5. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. + +6. On the **Advanced** tab, go to the **Accelerated graphics** section, and then turn on Software Rendering mode by choosing the **Use software rendering instead of GPU rendering** box.

+ If the **Use software rendering instead of GPU rendering** option is greyed out, it means that your current video card or video driver doesn't support GPU hardware acceleration. For more information, see [Windows 10 Support](https://go.microsoft.com/fwlink/?LinkId=746588). + +## Adaptive streaming and DRM playback don’t work with Windows Server 2012 R2 +IE11 in Windows Server 2012 R2 doesn’t include media features like adaptive streaming or Digital Rights Management (DRM) playback. To add these features, you’ll need to download and install the Media Feature Pack from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=320789), as well as an app that uses PlayReady DRM from the Microsoft Store, such as the Xbox Music app or Xbox Video app. The app must be installed to specifically turn on DRM features, while all other media features are installed with the Media Feature Pack. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index f77ef953c0..4c973ffad6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -1,48 +1,52 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to clear all of the sites from your global Enterprise Mode site list. -author: lomayor -ms.prod: ie11 -ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can clear all of the sites from your global Enterprise Mode site list. - -**Important**   -This is a permanent removal and erases everything. However, if you determine it was a mistake, and you saved an XML copy of your list, you can add the file again by following the steps in the [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md), depending on your operating system. - - **To clear your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Clear list**. - -2. Click **Yes** in the warning message.

Your sites are all cleared from your list. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Instructions about how to clear all of the sites from your global Enterprise Mode site list. +author: dansimp +ms.prod: ie11 +ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can clear all of the sites from your global Enterprise Mode site list. + +**Important**   +This is a permanent removal and erases everything. However, if you determine it was a mistake, and you saved an XML copy of your list, you can add the file again by following the steps in the [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md), depending on your operating system. + + **To clear your compatibility list** + +1. On the **File** menu of the Enterprise Mode Site List Manager, click **Clear list**. + +2. Click **Yes** in the warning message.

Your sites are all cleared from your list. + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md index b682c46207..f30c495bb3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md @@ -1,42 +1,46 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to remove sites from a local compatibility view list. -author: lomayor -ms.prod: ie11 -ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove sites from a local compatibility view list - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Remove websites that were added to a local compatibility view list by mistake or because they no longer have compatibility problems. - - **To remove sites from a local compatibility view list** - -1. Open Internet Explorer 11, click **Tools**, and then click **Compatibility View Settings**. - -2. Pick the site to remove, and then click **Remove**.

-Sites can only be removed one at a time. If one is removed by mistake, it can be added back using this same box and the **Add** section. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Instructions about how to remove sites from a local compatibility view list. +author: dansimp +ms.prod: ie11 +ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Remove sites from a local compatibility view list + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Remove websites that were added to a local compatibility view list by mistake or because they no longer have compatibility problems. + + **To remove sites from a local compatibility view list** + +1. Open Internet Explorer 11, click **Tools**, and then click **Compatibility View Settings**. + +2. Pick the site to remove, and then click **Remove**.

+Sites can only be removed one at a time. If one is removed by mistake, it can be added back using this same box and the **Add** section. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md index 6cfccfd925..93b323b78a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md @@ -1,58 +1,62 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to remove sites from a local Enterprise Mode site list. -author: lomayor -ms.prod: ie11 -ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove sites from a local Enterprise Mode site list - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Remove websites that were added to a local Enterprise Mode site list by mistake or because the sites no longer have compatibility problems. - -**Note**
The changes described in this topic only impact sites added to a local Enterprise Mode site list and not the list of sites deployed to all employees by an administrator. Employees can't delete sites added to the list by an administrator. - -  **To remove single sites from a local Enterprise Mode site list** - -1. Open Internet Explorer 11 and go to the site you want to remove. - -2. Click **Tools**, and then click **Enterprise Mode**.

-The checkmark disappears from next to Enterprise Mode and the site is removed from the list. - -**Note**
If the site is removed by mistake, it can be added back by clicking **Enterprise Mode** again. - - **To remove all sites from a local Enterprise Mode site list** - -1. Open IE11, click **Tools**, and then click **Internet options**. - -2. Click the **Delete** button from the **Browsing history** area. - -3. Click the box next to **Cookies and website data**, and then click **Delete**. - -**Note**
This removes all of the sites from a local Enterprise Mode site list. - -   - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Instructions about how to remove sites from a local Enterprise Mode site list. +author: dansimp +ms.prod: ie11 +ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Remove sites from a local Enterprise Mode site list + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Remove websites that were added to a local Enterprise Mode site list by mistake or because the sites no longer have compatibility problems. + +**Note**
The changes described in this topic only impact sites added to a local Enterprise Mode site list and not the list of sites deployed to all employees by an administrator. Employees can't delete sites added to the list by an administrator. + +  **To remove single sites from a local Enterprise Mode site list** + +1. Open Internet Explorer 11 and go to the site you want to remove. + +2. Click **Tools**, and then click **Enterprise Mode**.

+The checkmark disappears from next to Enterprise Mode and the site is removed from the list. + +**Note**
If the site is removed by mistake, it can be added back by clicking **Enterprise Mode** again. + + **To remove all sites from a local Enterprise Mode site list** + +1. Open IE11, click **Tools**, and then click **Internet options**. + +2. Click the **Delete** button from the **Browsing history** area. + +3. Click the box next to **Cookies and website data**, and then click **Delete**. + +**Note**
This removes all of the sites from a local Enterprise Mode site list. + +   + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md new file mode 100644 index 0000000000..acfe82d2a5 --- /dev/null +++ b/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md @@ -0,0 +1,50 @@ +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: How to use Site List Manager to review neutral sites for IE mode +author: dansimp +ms.prod: ie11 +ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager +ms.sitesec: library +ms.date: 04/02/2020 +--- + +# Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8 +- Windows Server 2012 R2 +- Microsoft Edge version 77 or later + +> [!NOTE] +> This feature is available on the Enterprise Mode Site List Manager version 11.0. + +## Overview + +While converting your site from v.1 schema to v.2 schema using the latest version of the Enterprise Mode Site List Manager, sites with the *doNotTransition=true* in v.1 convert to *open-in=None* in the v.2 schema, which is characterized as a "neutral site". This is the expected behavior for conversion unless you are using Internet Explorer mode (IE mode). When IE mode is enabled, only authentication servers that are used for modern and legacy sites should be set as neutral sites. For more information, see [Configure neutral sites](https://docs.microsoft.com/deployedge/edge-ie-mode-sitelist#configure-neutral-sites). Otherwise, a site meant to open in Edge might potentially be tagged as neutral, which results in inconsistent experiences for users. + +The Enterprise Mode Site List Manager provides the ability to flag sites that are listed as neutral sites, but might have been added in error. This check is automatically performed when you are converting from v.1 to v.2 through the tool. This check might flag sites even if there was no prior schema conversion. + +## Flag neutral sites + +To identify neutral sites to review: + +1. In the Enterprise Mode Site List Manager (schema v.2), click **File > Flag neutral sites**. +2. If selecting this option has no effect, there are no sites that needs to be reviewed. Otherwise, you will see a message **"Engine neutral sites flagged for review"**. When a site is flagged, you can assess if the site needs to be removed entirely, or if it needs the open-in attribute changed from None to MSEdge. +3. If you believe that a flagged site is correctly configured, you can edit the site entry and click on **"Clear Flag"**. Once you select that option for a site, it will not be flagged again. + +## Related topics + +- [About IE Mode](https://docs.microsoft.com/deployedge/edge-ie-mode) +- [Configure neutral sites](https://docs.microsoft.com/deployedge/edge-ie-mode-sitelist#configure-neutral-sites) diff --git a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md index 48ead2d656..7b80dd178d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md @@ -1,46 +1,50 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. -author: lomayor -ms.prod: ie11 -ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Save your site list to XML in the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. - - **To save your list as XML** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Save to XML**. - -2. Save the file to the location you specified in your Enterprise Mode registry key, set up when you turned on Enterprise Mode for use in your company. For information about the Enterprise Mode registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md).

-The first time a user starts Internet Explorer 11 on a managed device; Internet Explorer will look for a new version of the site list at the specified location. If the browser finds an updated site list, IE downloads the new XML site list and uses it. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. +author: dansimp +ms.prod: ie11 +ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Save your site list to XML in the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. + + **To save your list as XML** + +1. On the **File** menu of the Enterprise Mode Site List Manager, click **Save to XML**. + +2. Save the file to the location you specified in your Enterprise Mode registry key, set up when you turned on Enterprise Mode for use in your company. For information about the Enterprise Mode registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md).

+The first time a user starts Internet Explorer 11 on a managed device; Internet Explorer will look for a new version of the site list at the specified location. If the browser finds an updated site list, IE downloads the new XML site list and uses it. + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md index b2a83dc360..4d5e66ec80 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md @@ -1,53 +1,57 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal. -author: lomayor -ms.prod: ie11 -title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# Schedule approved change requests for production using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is approved, the original Requester can schedule the change for the production environment. The change can be immediate or set for a future time. - -**To schedule an immediate change** -1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. - -2. The Requester clicks the **Approved** status for the change request. - - The **Schedule changes** page appears. - -3. The Requester clicks **Now**, and then clicks **Save**. - - The update is scheduled to immediately update the production environment, and an email is sent to the Requester. After the update finishes, the Requester is asked to verify the changes. - - -**To schedule the change for a different day or time** -1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. - -2. The Requester clicks the **Approved** status for the change request. - - The **Schedule changes** page appears. - -3. The Requester clicks **Schedule**, sets the **Preferred day**, **Preferred start time**, and the **Preferred end time**, and then clicks **Save**. - - The update is scheduled to update the production environment on that day and time and an email is sent to the Requester. After the update finishes, the Requester will be asked to verify the changes. - - -## Next steps -After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itprom +manager: dansimp +ms.author: dansimp +--- + +# Schedule approved change requests for production using the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After a change request is approved, the original Requester can schedule the change for the production environment. The change can be immediate or set for a future time. + +**To schedule an immediate change** +1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. + +2. The Requester clicks the **Approved** status for the change request. + + The **Schedule changes** page appears. + +3. The Requester clicks **Now**, and then clicks **Save**. + + The update is scheduled to immediately update the production environment, and an email is sent to the Requester. After the update finishes, the Requester is asked to verify the changes. + + +**To schedule the change for a different day or time** +1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. + +2. The Requester clicks the **Approved** status for the change request. + + The **Schedule changes** page appears. + +3. The Requester clicks **Schedule**, sets the **Preferred day**, **Preferred start time**, and the **Preferred end time**, and then clicks **Save**. + + The update is scheduled to update the production environment on that day and time and an email is sent to the Requester. After the update finishes, the Requester will be asked to verify the changes. + + +## Next steps +After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 985b416947..f96a952626 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -1,44 +1,48 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Search to see if a specific site already appears in your global Enterprise Mode site list. -author: lomayor -ms.prod: ie11 -ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Search your Enterprise Mode site list in the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can search to see if a specific site already appears in your global Enterprise Mode site list so you don’t try to add it again. - - **To search your compatibility list** - -- From the Enterprise Mode Site List Manager, type part of the URL into the **Search** box.

- The search query searches all of the text. For example, entering *“micro”* will return results like, www.microsoft.com, microsoft.com, and microsoft.com/images. Wildcard characters aren’t supported. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Search to see if a specific site already appears in your global Enterprise Mode site list. +author: dansimp +ms.prod: ie11 +ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Search your Enterprise Mode site list in the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can search to see if a specific site already appears in your global Enterprise Mode site list so you don’t try to add it again. + + **To search your compatibility list** + +- From the Enterprise Mode Site List Manager, type part of the URL into the **Search** box.

+ The search query searches all of the text. For example, entering *“micro”* will return results like, `www.microsoft.com`, `microsoft.com`, and `microsoft.com/images`. Wildcard characters aren’t supported. + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index 829f920161..6edccdda73 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use the Group Policy setting, Set a default associations configuration file, to set the default browser for your company devices running Windows 10. -author: lomayor -ms.prod: ie11 -ms.assetid: f486c9db-0dc9-4cd6-8a0b-8cb872b1d361 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Set the default browser using Group Policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Set the default browser using Group Policy -You can use the Group Policy setting, **Set a default associations configuration file**, to set the default browser for your company devices running Windows 10. - - **To set the default browser as Internet Explorer 11** - -1. Open your Group Policy editor and go to the **Computer Configuration\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

-Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). - - ![set default associations group policy setting](images/setdefaultbrowsergp.png) - -2. Click **Enabled**, and then in the **Options** area, type the location to your default associations configuration file.

-If this setting is turned on and your employee's device is domain-joined, this file is processed and default associations are applied at logon. If this setting isn't configured or is turned off, or if your employee's device isn't domain-joined, no default associations are applied at logon. - -Your employees can change this setting by changing the Internet Explorer default value from the **Set Default Programs** area of the Control Panel. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Use the Group Policy setting, Set a default associations configuration file, to set the default browser for your company devices running Windows 10. +author: dansimp +ms.prod: ie11 +ms.assetid: f486c9db-0dc9-4cd6-8a0b-8cb872b1d361 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Set the default browser using Group Policy (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Set the default browser using Group Policy + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You can use the Group Policy setting, **Set a default associations configuration file**, to set the default browser for your company devices running Windows 10. + + **To set the default browser as Internet Explorer 11** + +1. Open your Group Policy editor and go to the **Computer Configuration\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

+Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). + + ![set default associations group policy setting](images/setdefaultbrowsergp.png) + +2. Click **Enabled**, and then in the **Options** area, type the location to your default associations configuration file.

+If this setting is turned on and your employee's device is domain-joined, this file is processed and default associations are applied at logon. If this setting isn't configured or is turned off, or if your employee's device isn't domain-joined, no default associations are applied at logon. + +Your employees can change this setting by changing the Internet Explorer default value from the **Set Default Programs** area of the Control Panel. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md index ea77e11d87..94f9336c89 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md @@ -1,160 +1,164 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Set up and turn on Enterprise Mode logging and data collection in your organization. -author: lomayor -ms.prod: ie11 -ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Set up Enterprise Mode logging and data collection - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. - -![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) - -The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. - -![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) - -Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. - -## Using ASP to collect your data -When you turn logging on, you need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. - - **To set up an endpoint server** - -1. Configure an IIS server to work with your Enterprise Mode data collection process. If you’re unsure how to set up IIS, see the [IIS installation webpage](https://go.microsoft.com/fwlink/p/?LinkId=507609). - -2. Open Internet Information Services (IIS) and turn on the ASP components from the **Add Roles and Features Wizard**, **Server Roles** page.

- This lets you create an ASP form that accepts the incoming POST messages. - -3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - - ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) - -4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - - ![IIS Manager, setting logging options](images/ie-emie-logging.png) - -5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

- Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. - -6. Apply these changes to your default website and close the IIS Manager. - -7. Put your EmIE.asp file into the root of the web server, using this command: - - ``` - <% @ LANGUAGE=javascript %> - <% - Response.AppendToLog(" ;" + Request.Form("URL") + " ;" + Request.Form("EnterpriseMode")); - %> - ``` - This code logs your POST fields to your IIS log file, where you can review all of the collected data. - - -### IIS log file information -This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. - -![Enterprise Mode log file](images/ie-emie-logfile.png) - - -## Using the GitHub sample to collect your data -Microsoft has created the [EMIE-Data-Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) that shows how to collect your Enterprise Mode reports. This sample only shows how to collect data, it doesn’t show how to aggregate the data into your Enterprise Mode site list.

-This sample starts with you turning on Enterprise Mode and logging (either through Group Policy, or by manually setting the EnterpriseMode registry key) so that your users can use Enterprise Mode locally. For the steps to do this, go to [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -**Note**
If you decide to manually change the registry key, you can change the **Enable** setting to `[deployment url]/api/records/`, which automatically sends your reports to this page. - -### Setting up, collecting, and viewing reports -For logging, you’re going to need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. These POST messages go into your database, aggregating the report data by URL, giving you the total number of reports where users turned on Enterprise Mode, the total number of reports where users turned off Enterprise Mode, and the date of the last report. - - **To set up the sample** - -1. Set up a server to collect your Enterprise Mode information from your users. - -2. Go to the Internet Explorer/[EMIE-Data_Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) page on GitHub and tap or click the **Download ZIP** button to download the complete project. - -3. Open Microsoft Visual Studio 2013 with Update 2, and then open the PhoneHomeSample.sln file. - -4. On the **Build** menu, tap or click **Build Solution**.

- The required packages are automatically downloaded and included in the solution. - - **To set up your endpoint server** - -5. Right-click on the name, PhoneHomeSample, and click **Publish**. - - ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) - -6. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. - - **Important**
- Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - - ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) - - After you finish the publishing process, you need to test to make sure the app deployed successfully. - - **To test, deploy, and use the app** - -7. Open a registry editor on the computer where you deployed the app, go to the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` key, and change the **Enable** string to: - - ``` "Enable"="https:///api/records/" - ``` - Where `` points to your deployment URL. - -8. After you’re sure your deployment works, you can deploy it to your users using one of the following: - - - Turn on the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting, putting your `` information into the **Options** box. - - - Deploy the registry key in Step 3 using System Center or other management software. - -9. Get your users to visit websites, turning Enterprise Mode on or off locally, as necessary. - - **To view the report results** - -- Go to `https:///List` to see the report results.

-If you’re already on the webpage, you’ll need to refresh the page to see the results. - - ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) - - -### Troubleshooting publishing errors -If you have errors while you’re publishing your project, you should try to update your packages. - - **To update your packages** - -1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - - ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) - -2. Click **Updates** on the left side of the tool, and click the **Update All** button.

-You may need to do some additional package cleanup to remove older package versions. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Set up and turn on Enterprise Mode logging and data collection in your organization. +author: dansimp +ms.prod: ie11 +ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Set up Enterprise Mode logging and data collection + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. + +![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) + +The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. + +![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) + +Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. + +## Using ASP to collect your data +When you turn logging on, you need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. + + **To set up an endpoint server** + +1. Configure an IIS server to work with your Enterprise Mode data collection process. If you’re unsure how to set up IIS, see the [IIS installation webpage](https://go.microsoft.com/fwlink/p/?LinkId=507609). + +2. Open Internet Information Services (IIS) and turn on the ASP components from the **Add Roles and Features Wizard**, **Server Roles** page.

+ This lets you create an ASP form that accepts the incoming POST messages. + +3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. + + ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) + +4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. + + ![IIS Manager, setting logging options](images/ie-emie-logging.png) + +5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

+ Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. + +6. Apply these changes to your default website and close the IIS Manager. + +7. Put your EmIE.asp file into the root of the web server, using this command: + + ``` + <% @ LANGUAGE=javascript %> + <% + Response.AppendToLog(" ;" + Request.Form("URL") + " ;" + Request.Form("EnterpriseMode")); + %> + ``` + This code logs your POST fields to your IIS log file, where you can review all of the collected data. + + +### IIS log file information +This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. + +![Enterprise Mode log file](images/ie-emie-logfile.png) + + +## Using the GitHub sample to collect your data +Microsoft has created the [EMIE-Data-Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) that shows how to collect your Enterprise Mode reports. This sample only shows how to collect data, it doesn’t show how to aggregate the data into your Enterprise Mode site list.

+This sample starts with you turning on Enterprise Mode and logging (either through Group Policy, or by manually setting the EnterpriseMode registry key) so that your users can use Enterprise Mode locally. For the steps to do this, go to [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +**Note**
If you decide to manually change the registry key, you can change the **Enable** setting to `[deployment url]/api/records/`, which automatically sends your reports to this page. + +### Setting up, collecting, and viewing reports +For logging, you’re going to need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. These POST messages go into your database, aggregating the report data by URL, giving you the total number of reports where users turned on Enterprise Mode, the total number of reports where users turned off Enterprise Mode, and the date of the last report. + + **To set up the sample** + +1. Set up a server to collect your Enterprise Mode information from your users. + +2. Go to the Internet Explorer/[EMIE-Data_Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) page on GitHub and tap or click the **Download ZIP** button to download the complete project. + +3. Open Microsoft Visual Studio 2013 with Update 2, and then open the PhoneHomeSample.sln file. + +4. On the **Build** menu, tap or click **Build Solution**.

+ The required packages are automatically downloaded and included in the solution. + + **To set up your endpoint server** + +5. Right-click on the name, PhoneHomeSample, and click **Publish**. + + ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) + +6. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. + + **Important**
+ Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  + + ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) + + After you finish the publishing process, you need to test to make sure the app deployed successfully. + + **To test, deploy, and use the app** + +7. Open a registry editor on the computer where you deployed the app, go to the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` key, and change the **Enable** string to: + + ``` "Enable"="https:///api/records/" + ``` + Where `` points to your deployment URL. + +8. After you’re sure your deployment works, you can deploy it to your users using one of the following: + + - Turn on the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting, putting your `` information into the **Options** box. + + - Deploy the registry key in Step 3 using System Center or other management software. + +9. Get your users to visit websites, turning Enterprise Mode on or off locally, as necessary. + + **To view the report results** + +- Go to `https:///List` to see the report results.

+If you’re already on the webpage, you’ll need to refresh the page to see the results. + + ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) + + +### Troubleshooting publishing errors +If you have errors while you’re publishing your project, you should try to update your packages. + + **To update your packages** + +1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. + + ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) + +2. Click **Updates** on the left side of the tool, and click the **Update All** button.

+You may need to do some additional package cleanup to remove older package versions. + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [What is Enterprise Mode?](what-is-enterprise-mode.md) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md index 469464c98f..c022c08569 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md @@ -1,227 +1,231 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to set up the Enterprise Mode Site List Portal for your organization. -author: lomayor -ms.prod: ie11 -title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# Set up the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -Before you can begin using the Enterprise Mode Site List Portal, you must set up your environment. - -## Step 1 - Copy the deployment folder to the web server -You must download the deployment folder (**EMIEWebPortal/**), which includes all of the source code for the website, from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) site to your web server. - -**To download the source code** -1. Download the deployment folder from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) source code to your web server. - -2. Install the Node.js® package manager, [npm](https://www.npmjs.com/). - - >[!Note] - >You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source. - -3. Open File Explorer and then open the **EMIEWebPortal/** folder. - -4. Press and hold **Shift**, right-click the window, then click **Open PowerShell window here**. - -5. Type _npm i_ into the command prompt, then press **Enter**. - - Installs the npm package manager and bulk adds all the third-party libraries back into your codebase. - -6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution. - - >[!Note] - >Step 3 of this topic provides the steps to create your database. - -7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager. - -## Step 2 - Create the Application Pool and website, by using IIS -Create a new Application Pool and the website, by using the IIS Manager. - -**To create a new Application Pool** -1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Application Pools**, then click **Add Application Pool**. - - The **Add Application Pool** box appears. - -2. In the **Add Application Pool** box, enter the following info: - - - **Name.** Type the name of your new application pool. For example, _EMIEWebAppPool_. - - - **.NET CLR version.** Pick the version of .NET CLR used by your application pool from the drop-down box. It must be version 4.0 or higher. - - - **Managed pipeline mode.** Pick **Integrated** from the drop-down box. IIS uses the integrated IIS and ASP.NET request-processing pipeline for managed content. - -3. Click **OK**. - -4. Select your new application pool from the **Application Pool** pane, click **Advanced Settings** from the **Edit Application Pool** area of the **Actions** pane. - - The **Advanced Settings** box appears. - -5. Make sure your **Identity** value is **ApplicationPoolIdentity**, click **OK**, and then close the box. - -6. Open File Explorer and go to your deployment directory, created in Step 1. For example, _D:\EMIEWebApp_. - -7. Right-click on the directory, click **Properties**, and then click the **Security** tab. - -8. Add your new application pool to the list (for example, _IIS AppPool\EMIEWebAppPool_) with **Full control access**, making sure the location searches the local computer. - -9. Add **Everyone** to the list with **Read & execute access**. - -**To create the website** -1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Sites**, then click **Add Website**. - - The **Add Website** box appears. - -2. In the **Add Website** box, type the name of your website into the **Site name** box. For example, _EMIEWebApp_, and then click **Select**. - - The **Select Application Pool** box appears. - -4. Pick the name of the application pool created earlier in this step, and then click **OK**. For example, _EMIEWebAppPool_. - -5. In the **Physical path** box, browse to your folder that contains your deployment directory. For example, _D:\EMIEWebApp_. - -6. Set up your **Binding**, including your **Binding Type**, **IP address**, and **Port**, as appropriate for your organization. - -7. Clear the **Start Website immediately** check box, and then click **OK**. - -8. In IIS Manager, expand your local computer, and then double-click your new website. For example, _EMIEWebApp_. - - The **<website_name> Home** pane appears. - -9. Double-click the **Authentication** icon, right-click on **Windows Authentication**, and then click **Enable**. - - >[!Note] - >You must also make sure that **Anonymous Authentication** is marked as **Enabled**. - -## Step 3 - Create and prep your database -Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables. - -**To create and prep your database** -1. Start SQL Server Management Studio. - -2. Open **Object Explorer** and then connect to an instance of the SQL Server Database Engine. - -3. Expand the instance, right-click on **Databases**, and then click **New Database**. - -4. Type a database name. For example, _EMIEDatabase_. - -5. Leave all default values for the database files, and then click **OK**. - -6. Open the **DatabaseScripts/Create DB Tables/1_CreateEMIETables.sql** query file, located in the deployment directory. - -7. Replace the database name placeholder with the database name you created earlier. For example, _EMIEDatabase_. - -8. Run the query. - -## Step 4 - Map your Application Pool to a SQL Server role -Map your ApplicationPoolIdentity to your database, adding the db_owner role. - -**To map your ApplicationPoolIdentity to a SQL Server role** -1. Start SQL Server Management Studio and connect to your database. - -2. Expand the database instance and then open the server-level **Security** folder. - - > [!IMPORTANT] - > Make sure you open the **Security** folder at the server level and not for the database. - -3. Right-click **Logins**, and then click **New Login**. - - The **Login-New** dialog box appears. - -4. Type the following into the **Login name** box, based on your server instance type: - - - **Local SQL Server instance.** If you have a local SQL Server instance, where IIS and SQL Server are on the same server, type the name of your Application Pool. For example, _IIS AppPool\EMIEWebAppPool_. - - - **Remote SQL Server instance.** If you have a remote SQL Server instance, where IIS and SQL Server are on different servers, type `Domain\ServerName$`. - - > [!IMPORTANT] - > Don't click **Search** in the **Login name** box. Login name searches will resolve to a ServerName\AppPool Name account and SQL Server Management Studio won't be able to resolve the account's virtual Security ID (SID). - -5. Click **User Mapping** from the **Select a page** pane, click the checkbox for your database (for example, _EMIEDatabase_) from the **Users mapped to this login** pane, and then click **db_owner** from the list of available roles in the **Database role membership** pane. - -6. Click **OK**. - -## Step 5 - Restart the Application Pool and website -Using the IIS Manager, you must restart both your Application Pool and your website. - -**To restart your Application Pool and website** -1. In IIS Manager, expand your local computer in the **Connections** pane, select your website, then click **Restart** from the **Manage Website** pane. - -2. In the **Connections** pane, select your Application Pool, and then click **Recycle** from the **Application Pool Tasks** pane. - -## Step 6 - Registering as an administrator -After you've created your database and website, you'll need to register yourself (or another employee) as an administrator for the Enterprise Mode Site List Portal. - -**To register as an administrator** -1. Open Microsoft Edge and type your website URL into the Address bar. For example, https://emieportal:8085. - -2. Click **Register now**. - -3. Type your name or alias into the **Email** box, making sure it matches the info in the drop-down box. - -4. Click **Administrator** from the **Role** box, and then click **Save**. - -5. Append your website URL with `/#/EMIEAdminConsole` in the Address bar to go to your administrator console. For example, https://emieportal:8085/#/EMIEAdminConsole. - - A dialog box appears, prompting you for the system user name and password. The default user name is EMIEAdmin and the default password is Admin123. We strongly recommend that you change the password by using the **Change password** link as soon as you're done with your first visit. - -6. Select your name from the available list, and then click **Activate**. - -7. Go to the Enterprise Mode Site List Portal Home page and sign in. - -## Step 7 - Configure the SMTP server and port for email notification -After you've set up the portal, you need to configure your SMTP server and port for email notifications from the system. - -**To set up your SMTP server and port for emails** -1. Open Visual Studio, and then open the web.config file from your deployment directory. - -2. Update the SMTP server and port info with your info, using this format: - - ``` - - - ``` -3. Open the **Settings** page in the Enterprise Mode Site List Portal, and then update the email account and password info. - -## Step 8 - Register the scheduler service -Register the EMIEScheduler tool and service for production site list changes. - -**To register the scheduler service** - -1. Open File Explorer and go to EMIEWebPortal.SchedulerService\EMIEWebPortal.SchedulerService in your deployment directory, and then copy the **App_Data**, **bin**, and **Logs** folders to a separate folder. For example, C:\EMIEService\. - - >[!Important] - >If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files. - -2. In Visual Studio start the Developer Command Prompt as an administrator, and then change the directory to the location of the InstallUtil.exe file. For example, _C:\Windows\Microsoft.NET\Framework\v4.0.30319_. - -3. Run the command, `InstallUtil ""`. For example, _InstallUtil "C:\EMIEService\bin\Debug\EMIEWebPortal.SchedulerService.exe"._ - - You'll be asked for your user name and password for the service. - -4. Open the **Run** command, type `Services.msc`, and then start the EMIEScheduler service. - -## Related topics -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) - -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how to set up the Enterprise Mode Site List Portal for your organization. +author: dansimp +ms.prod: ie11 +title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Set up the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. + +Before you can begin using the Enterprise Mode Site List Portal, you must set up your environment. + +## Step 1 - Copy the deployment folder to the web server +You must download the deployment folder (**EMIEWebPortal/**), which includes all of the source code for the website, from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) site to your web server. + +**To download the source code** +1. Download the deployment folder from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) source code to your web server. + +2. Install the Node.js® package manager, [npm](https://www.npmjs.com/). + + > [!NOTE] + > You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source. + +3. Open File Explorer and then open the **EMIEWebPortal/** folder. + +4. Press and hold **Shift**, right-click the window, then click **Open PowerShell window here**. + +5. Type _npm i_ into the command prompt, then press **Enter**. + + Installs the npm package manager and bulk adds all the third-party libraries back into your codebase. + +6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution. + + > [!NOTE] + > Step 3 of this topic provides the steps to create your database. + +7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager. + +## Step 2 - Create the Application Pool and website, by using IIS +Create a new Application Pool and the website, by using the IIS Manager. + +**To create a new Application Pool** +1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Application Pools**, then click **Add Application Pool**. + + The **Add Application Pool** box appears. + +2. In the **Add Application Pool** box, enter the following info: + + - **Name.** Type the name of your new application pool. For example, _EMIEWebAppPool_. + + - **.NET CLR version.** Pick the version of .NET CLR used by your application pool from the drop-down box. It must be version 4.0 or higher. + + - **Managed pipeline mode.** Pick **Integrated** from the drop-down box. IIS uses the integrated IIS and ASP.NET request-processing pipeline for managed content. + +3. Click **OK**. + +4. Select your new application pool from the **Application Pool** pane, click **Advanced Settings** from the **Edit Application Pool** area of the **Actions** pane. + + The **Advanced Settings** box appears. + +5. Make sure your **Identity** value is **ApplicationPoolIdentity**, click **OK**, and then close the box. + +6. Open File Explorer and go to your deployment directory, created in Step 1. For example, _D:\EMIEWebApp_. + +7. Right-click on the directory, click **Properties**, and then click the **Security** tab. + +8. Add your new application pool to the list (for example, _IIS AppPool\EMIEWebAppPool_) with **Full control access**, making sure the location searches the local computer. + +9. Add **Everyone** to the list with **Read & execute access**. + +**To create the website** +1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Sites**, then click **Add Website**. + + The **Add Website** box appears. + +2. In the **Add Website** box, type the name of your website into the **Site name** box. For example, _EMIEWebApp_, and then click **Select**. + + The **Select Application Pool** box appears. + +4. Pick the name of the application pool created earlier in this step, and then click **OK**. For example, _EMIEWebAppPool_. + +5. In the **Physical path** box, browse to your folder that contains your deployment directory. For example, _D:\EMIEWebApp_. + +6. Set up your **Binding**, including your **Binding Type**, **IP address**, and **Port**, as appropriate for your organization. + +7. Clear the **Start Website immediately** check box, and then click **OK**. + +8. In IIS Manager, expand your local computer, and then double-click your new website. For example, _EMIEWebApp_. + + The **<website_name> Home** pane appears. + +9. Double-click the **Authentication** icon, right-click on **Windows Authentication**, and then click **Enable**. + + > [!NOTE] + > You must also make sure that **Anonymous Authentication** is marked as **Enabled**. + +## Step 3 - Create and prep your database +Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables. + +**To create and prep your database** +1. Start SQL Server Management Studio. + +2. Open **Object Explorer** and then connect to an instance of the SQL Server Database Engine. + +3. Expand the instance, right-click on **Databases**, and then click **New Database**. + +4. Type a database name. For example, _EMIEDatabase_. + +5. Leave all default values for the database files, and then click **OK**. + +6. Open the **DatabaseScripts/Create DB Tables/1_CreateEMIETables.sql** query file, located in the deployment directory. + +7. Replace the database name placeholder with the database name you created earlier. For example, _EMIEDatabase_. + +8. Run the query. + +## Step 4 - Map your Application Pool to a SQL Server role +Map your ApplicationPoolIdentity to your database, adding the db_owner role. + +**To map your ApplicationPoolIdentity to a SQL Server role** +1. Start SQL Server Management Studio and connect to your database. + +2. Expand the database instance and then open the server-level **Security** folder. + + > [!IMPORTANT] + > Make sure you open the **Security** folder at the server level and not for the database. + +3. Right-click **Logins**, and then click **New Login**. + + The **Login-New** dialog box appears. + +4. Type the following into the **Login name** box, based on your server instance type: + + - **Local SQL Server instance.** If you have a local SQL Server instance, where IIS and SQL Server are on the same server, type the name of your Application Pool. For example, _IIS AppPool\EMIEWebAppPool_. + + - **Remote SQL Server instance.** If you have a remote SQL Server instance, where IIS and SQL Server are on different servers, type `Domain\ServerName$`. + + > [!IMPORTANT] + > Don't click **Search** in the **Login name** box. Login name searches will resolve to a ServerName\AppPool Name account and SQL Server Management Studio won't be able to resolve the account's virtual Security ID (SID). + +5. Click **User Mapping** from the **Select a page** pane, click the checkbox for your database (for example, _EMIEDatabase_) from the **Users mapped to this login** pane, and then click **db_owner** from the list of available roles in the **Database role membership** pane. + +6. Click **OK**. + +## Step 5 - Restart the Application Pool and website +Using the IIS Manager, you must restart both your Application Pool and your website. + +**To restart your Application Pool and website** +1. In IIS Manager, expand your local computer in the **Connections** pane, select your website, then click **Restart** from the **Manage Website** pane. + +2. In the **Connections** pane, select your Application Pool, and then click **Recycle** from the **Application Pool Tasks** pane. + +## Step 6 - Registering as an administrator +After you've created your database and website, you'll need to register yourself (or another employee) as an administrator for the Enterprise Mode Site List Portal. + +**To register as an administrator** +1. Open Microsoft Edge and type your website URL into the Address bar. For example, https://emieportal:8085. + +2. Click **Register now**. + +3. Type your name or alias into the **Email** box, making sure it matches the info in the drop-down box. + +4. Click **Administrator** from the **Role** box, and then click **Save**. + +5. Append your website URL with `/#/EMIEAdminConsole` in the Address bar to go to your administrator console. For example, https://emieportal:8085/#/EMIEAdminConsole. + + A dialog box appears, prompting you for the system user name and password. The default user name is EMIEAdmin and the default password is Admin123. We strongly recommend that you change the password by using the **Change password** link as soon as you're done with your first visit. + +6. Select your name from the available list, and then click **Activate**. + +7. Go to the Enterprise Mode Site List Portal Home page and sign in. + +## Step 7 - Configure the SMTP server and port for email notification +After you've set up the portal, you need to configure your SMTP server and port for email notifications from the system. + +**To set up your SMTP server and port for emails** +1. Open Visual Studio, and then open the web.config file from your deployment directory. + +2. Update the SMTP server and port info with your info, using this format: + + ``` + + + ``` +3. Open the **Settings** page in the Enterprise Mode Site List Portal, and then update the email account and password info. + +## Step 8 - Register the scheduler service +Register the EMIEScheduler tool and service for production site list changes. + +**To register the scheduler service** + +1. Open File Explorer and go to EMIEWebPortal.SchedulerService\EMIEWebPortal.SchedulerService in your deployment directory, and then copy the **App_Data**, **bin**, and **Logs** folders to a separate folder. For example, C:\EMIEService\. + + > [!IMPORTANT] + > If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files. + +2. In Visual Studio start the Developer Command Prompt as an administrator, and then change the directory to the location of the InstallUtil.exe file. For example, _C:\Windows\Microsoft.NET\Framework\v4.0.30319_. + +3. Run the command, `InstallUtil ""`. For example, _InstallUtil "C:\EMIEService\bin\Debug\EMIEWebPortal.SchedulerService.exe"._ + + You'll be asked for your user name and password for the service. + +4. Open the **Run** command, type `Services.msc`, and then start the EMIEScheduler service. + +## Related topics +- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) + +- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) + +- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md index 2e0ad0a745..70d197c391 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md @@ -1,66 +1,70 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: appcompat -description: Reviewing log files to learn more about potential setup problems with Internet Explorer 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 2cd79988-17d1-4317-bee9-b3ae2dd110a0 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Setup problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Setup problems with Internet Explorer 11 -Installing Internet Explorer creates the following log files, which are stored in the Windows installation folder (typically, the C:\\Windows folder): - -- `IE11_main.log` - -- `IE11_NR_Setup.log` - -- `IE11_uninst.log` - -- `cbs*.log` - -- `WU_ IE11_LangPacks.log` - -These log files continuously record the entire process from the moment the IE setup program starts running until the last .cab file is downloaded, including error codes. The possible error codes are: - -|Error code |Description | -|-----------|-------------------------------------------| -|0 |Success | -|1460 |Timeout | -|3010 |Success, reboot required | -|40001 |USER_ERROR_CANNOT_OPEN_LOG_FILE | -|40003 |USER_ERROR_CANNOT_INITIALIZE_APPLICATION | -|40004 |USER_ERROR_OLD_OS_VERSION | -|40005 |USER_ERROR_WRONG_PLATFORM | -|40006 |USER_ERROR_BAD_SPVERSION | -|40007 |USER_ERROR_MISSING_REQUIRED_PREREQUISITE | -|40008 |USER_ERROR_IE_GREATERVERSION_INSTALLED | -|40010 |USER_ERROR_BAD_LANGUAGE | -|40012 |USER_ERROR_CRYPTO_VALIDATION_FAILED | -|40013 |USER_ERROR_ALREADY_INSTALLED | -|40015 |USER_ERROR_WRONG_OS | -|40016 |USER_ERROR_EXTRACTION_FAILED | -|40019 |USER_ERROR_WINDOWS_PRERELEASE_NOT_SUPPORTED | -|40021 |USER_ERROR_UNSUPPORTED_VIDEO_HARDWARE | -|40022 |USER_ERROR_UNSUPPORTED_VIDEO_DRIVER | -|40023 |USER_ERROR_PREREQUISITE_INSTALL_FAILED | -|40024 |USER_ERROR_NEUTRAL_CAB_DOWNLOAD_FAILED | -|40025 |USER_ERROR_NEUTRAL_CAB_INSTALL_FAILED | -|41001 |USER_ERROR_UNKNOWN | -|50005 |USER_SUCCESS_USER_CANCELLED | - -  - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +ms.pagetype: appcompat +description: Reviewing log files to learn more about potential setup problems with Internet Explorer 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 2cd79988-17d1-4317-bee9-b3ae2dd110a0 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Setup problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Setup problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Installing Internet Explorer creates the following log files, which are stored in the Windows installation folder (typically, the C:\\Windows folder): + +- `IE11_main.log` + +- `IE11_NR_Setup.log` + +- `IE11_uninst.log` + +- `cbs*.log` + +- `WU_ IE11_LangPacks.log` + +These log files continuously record the entire process from the moment the IE setup program starts running until the last .cab file is downloaded, including error codes. The possible error codes are: + +|Error code |Description | +|-----------|-------------------------------------------| +|0 |Success | +|1460 |Timeout | +|3010 |Success, reboot required | +|40001 |USER_ERROR_CANNOT_OPEN_LOG_FILE | +|40003 |USER_ERROR_CANNOT_INITIALIZE_APPLICATION | +|40004 |USER_ERROR_OLD_OS_VERSION | +|40005 |USER_ERROR_WRONG_PLATFORM | +|40006 |USER_ERROR_BAD_SPVERSION | +|40007 |USER_ERROR_MISSING_REQUIRED_PREREQUISITE | +|40008 |USER_ERROR_IE_GREATERVERSION_INSTALLED | +|40010 |USER_ERROR_BAD_LANGUAGE | +|40012 |USER_ERROR_CRYPTO_VALIDATION_FAILED | +|40013 |USER_ERROR_ALREADY_INSTALLED | +|40015 |USER_ERROR_WRONG_OS | +|40016 |USER_ERROR_EXTRACTION_FAILED | +|40019 |USER_ERROR_WINDOWS_PRERELEASE_NOT_SUPPORTED | +|40021 |USER_ERROR_UNSUPPORTED_VIDEO_HARDWARE | +|40022 |USER_ERROR_UNSUPPORTED_VIDEO_DRIVER | +|40023 |USER_ERROR_PREREQUISITE_INSTALL_FAILED | +|40024 |USER_ERROR_NEUTRAL_CAB_DOWNLOAD_FAILED | +|40025 |USER_ERROR_NEUTRAL_CAB_INSTALL_FAILED | +|41001 |USER_ERROR_UNKNOWN | +|50005 |USER_SUCCESS_USER_CANCELLED | + +  + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md index 66bf4edda5..37b7bc16cf 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md @@ -1,61 +1,65 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Lists the minimum system requirements and supported languages for Internet Explorer 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 27185e3d-c486-4e4a-9c51-5cb317c0006d -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: System requirements and language support for Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# System requirements and language support for Internet Explorer 11 (IE11) - -**Applies to:** - -- Windows 10 -- Windows 8.1 Update -- Windows 7 with Service Pack 1 (SP1) -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Internet Explorer 11 is available for a number of systems and languages. This topic provides info about the minimum system requirements and language support. - -## Minimum system requirements for IE11 -IE11 is pre-installed on Windows 8.1, Windows 10, and Windows Server 2012 R2 and is listed here for reference. For more info about IE11 on Windows 10, see [Browser: Microsoft Edge and Internet Explorer 11](https://technet.microsoft.com/library/mt156988.aspx). - -**Important**
  -IE11 isn't supported on Windows 8 or Windows Server 2012. - -Some of the components in this table might also need additional system resources. Check the component's documentation for more information. - - -| Item | Minimum requirements | -|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Computer/processor | 1 gigahertz (GHz) 32-bit (x86) or 64-bit (x64) | -| Operating system |

  • Windows 10 (32-bit or 64-bit)
  • Windows 8.1 Update (32-bit or 64-bit)
  • Windows 7 with SP1 (32-bit or 64-bit)
  • Windows Server 2012 R2
  • Windows Server 2008 R2 with SP1 (64-bit only)
| -| Memory |
  • Windows 10 (32-bit)-1 GB
  • Windows 10 (64-bit)-2 GB
  • Windows 8.1 Update (32-bit)-1 GB
  • Windows 8.1 Update (64-bit)-2 GB
  • Windows 7 with SP1 (32-bit or 64-bit)-512 MB
  • Windows Server 2012 R2-512 MB
  • Windows Server 2008 R2 with SP1 (64-bit only)-512 MB
| -| Hard drive space |
  • Windows 10 (32-bit)-16 GB
  • Windows 10 (64-bit)-20 GB
  • Windows 8.1 Update (32-bit)-16 GB
  • Windows 8.1 Update (64-bit)-20 GB
  • Windows 7 with SP1 (32-bit)-70 MB
  • Windows 7 with SP1 (64-bit)-120 MB
  • Windows Server 2012 R2-32 GB
  • Windows Server 2008 R2 with SP1 (64-bit only)-200 MB
    • | -| Drive | CD-ROM drive (if installing from a CD-ROM) | -| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | -| Peripherals | Internet connection and a compatible pointing device | - -## Support for .NET Framework -You might experience start up issues where IE11 fails to launch an application that uses managed browser hosting controls with your legacy apps. This is because, starting with Internet Explorer 10, the browser started blocking legacy apps from using the .NET Framework 1.1 and 2.0. To fix this problem, see [.NET Framework problems with Internet Explorer 11](net-framework-problems-with-ie11.md). - -## Support for multiple languages -IE11 is available in 108 languages for Windows 8.1 and Windows 10 and in 97 languages for Windows 7 with SP1. For the list of languages and download links, see [Available language packs based on operating system](https://go.microsoft.com/fwlink/p/?LinkId=281818). - -Computers running localized versions of Windows should run the same version of IE11. For example, if your employees use the Spanish edition of Windows, you should deploy the Spanish version of IE11. On the other hand, if your employees use multiple localized versions of Windows, like Spanish, French, and Catalan, you should install IE11 in one of the languages, and then install language packs for the others. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Lists the minimum system requirements and supported languages for Internet Explorer 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 27185e3d-c486-4e4a-9c51-5cb317c0006d +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: System requirements and language support for Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# System requirements and language support for Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 Update +- Windows 7 with Service Pack 1 (SP1) +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Internet Explorer 11 is available for a number of systems and languages. This topic provides info about the minimum system requirements and language support. + +## Minimum system requirements for IE11 +IE11 is pre-installed on Windows 8.1, Windows 10, and Windows Server 2012 R2 and is listed here for reference. For more info about IE11 on Windows 10, see [Browser: Microsoft Edge and Internet Explorer 11](https://technet.microsoft.com/library/mt156988.aspx). + +**Important**
        +IE11 isn't supported on Windows 8 or Windows Server 2012. + +Some of the components in this table might also need additional system resources. Check the component's documentation for more information. + + +| Item | Minimum requirements | +|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer/processor | 1 gigahertz (GHz) 32-bit (x86) or 64-bit (x64) | +| Operating system |
      • Windows 10 (32-bit or 64-bit)
      • Windows 8.1 Update (32-bit or 64-bit)
      • Windows 7 with SP1 (32-bit or 64-bit)
      • Windows Server 2012 R2
      • Windows Server 2008 R2 with SP1 (64-bit only)
      | +| Memory |
      • Windows 10 (32-bit)-1 GB
      • Windows 10 (64-bit)-2 GB
      • Windows 8.1 Update (32-bit)-1 GB
      • Windows 8.1 Update (64-bit)-2 GB
      • Windows 7 with SP1 (32-bit or 64-bit)-512 MB
      • Windows Server 2012 R2-512 MB
      • Windows Server 2008 R2 with SP1 (64-bit only)-512 MB
      | +| Hard drive space |
      • Windows 10 (32-bit)-16 GB
      • Windows 10 (64-bit)-20 GB
      • Windows 8.1 Update (32-bit)-16 GB
      • Windows 8.1 Update (64-bit)-20 GB
      • Windows 7 with SP1 (32-bit)-70 MB
      • Windows 7 with SP1 (64-bit)-120 MB
      • Windows Server 2012 R2-32 GB
      • Windows Server 2008 R2 with SP1 (64-bit only)-200 MB
        • | +| Drive | CD-ROM drive (if installing from a CD-ROM) | +| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | +| Peripherals | Internet connection and a compatible pointing device | + +## Support for .NET Framework +You might experience start up issues where IE11 fails to launch an application that uses managed browser hosting controls with your legacy apps. This is because, starting with Internet Explorer 10, the browser started blocking legacy apps from using the .NET Framework 1.1 and 2.0. To fix this problem, see [.NET Framework problems with Internet Explorer 11](net-framework-problems-with-ie11.md). + +## Support for multiple languages +IE11 is available in 108 languages for Windows 8.1 and Windows 10 and in 97 languages for Windows 7 with SP1. For the list of languages and download links, see [Available language packs based on operating system](https://go.microsoft.com/fwlink/p/?LinkId=281818). + +Computers running localized versions of Windows should run the same version of IE11. For example, if your employees use the Spanish edition of Windows, you should deploy the Spanish version of IE11. On the other hand, if your employees use multiple localized versions of Windows, like Spanish, French, and Catalan, you should install IE11 in one of the languages, and then install language packs for the others. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md index 00029e6c5b..14bd40e745 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md +++ b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md @@ -1,135 +1,139 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List. -author: lomayor -ms.author: lomayor -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -title: Tips and tricks to manage Internet Explorer compatibility -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# Tips and tricks to manage Internet Explorer compatibility - -Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List. - -Jump to: -- [Tips for IT professionals](#tips-for-it-professionals) -- [Tips for web developers](#tips-for-web-developers) - -[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) can be very effective in providing backward compatibility for older web apps. The Enterprise Mode Site List includes the ability to put any web app in any document mode, include IE8 and IE7 Enterprise Modes, without changing a single line of code on the website. - -![Internet Explorer Enterprise Modes and document modes](images/img-enterprise-mode-site-list-xml.jpg) - -Sites in the \ section can be rendered in any document mode, as shown in blue above. Some sites designed for older versions of Internet Explorer may require better backward compatibility, and these can leverage the \ section of the Enterprise Mode Site List. IE8 Enterprise Mode provides higher-fidelity emulation for Internet Explorer 8 by using, among other improvements, the original Internet Explorer 8 user agent string. IE7 Enterprise Mode further improves emulation by adding Compatibility View. - -Compatibility View, first introduced with Internet Explorer 8, is basically a switch. If a webpage has no DOCTYPE, that page will be rendered in Internet Explorer 5 mode. If there is a DOCTYPE, the page will be rendered in Internet Explorer 7 mode. You can effectively get Compatibility View by specifying Internet Explorer 7 in the \ section, as this falls back to Internet Explorer 5 automatically if there's no DOCTYPE, or you can use IE7 Enterprise Mode for even better emulation. - -## Tips for IT professionals - -### Inventory your sites - -Upgrading to a new browser can be a time-consuming and potentially costly venture. To help reduce these costs, you can download the [Enterprise Site Discovery Toolkit](https://www.microsoft.com/download/details.aspx?id=44570), which can help you prioritize which sites you should be testing based on their usage in your enterprise. For example, if the data shows that no one is visiting a particular legacy web app, you may not need to test or fix it. The toolkit is supported on Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. The toolkit also gives you information about which document mode a page runs in your current browser so you can better understand how to fix that site if it breaks in a newer version of the browser. - -Once you know which sites to test and fix, the following remediation methods may help fix your compatibility issues in Internet Explorer 11 and Windows 10. - -### If you're on Internet Explorer 8 and upgrading to Internet Explorer 11: - -Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 8 documents modes, as well as IE8 Enterprise Mode and IE7 Enterprise Mode. - -- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 8 mode. This is because "edge" in Internet Explorer 8 meant Internet Explorer 8 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. - -- Sites without a DOCTYPE in zones other than Intranet will default to QME (or "interoperable quirks") rather than Internet Explorer 5 Quirks and may need to be set to Internet Explorer 5 mode. - -- Some sites may need to be added to both Enterprise Mode and Compatibility View to work. You can do this by adding the site to IE7 Enterprise Mode. - -### If you're on Internet Explorer 9 and upgrading to Internet Explorer 11: - -Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 9 document modes. - -- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 9 mode. This is because "edge" in Internet Explorer 9 meant Internet Explorer 9 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. - -- Sites without a DOCTYPE in zones other than Intranet will default to Interoperable Quirks rather than Internet Explorer 5 Quirks and may need to be set to Internet Explorer 5 mode. - -- If your sites worked in Internet Explorer 9, you won't need IE8 Enterprise Mode or IE7 Enterprise Mode. - -### If you're on Internet Explorer 10 and upgrading to Internet Explorer 11: - -Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 10 modes. - -- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 10 mode. This is because "edge" in Internet Explorer 10 meant Internet Explorer 10 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. - -- If your sites worked in Internet Explorer 10, you won't need IE8 Enterprise Mode or IE7 Enterprise Mode. - -### If you're on Internet Explorer 11 and upgrading to Windows 10: - -You're all set! You shouldn’t need to make any changes. - -## Tips for web developers - -If your website worked in an older version of Internet Explorer, but no longer works in Internet Explorer 11, you may need to update the site. Here are the set of steps you should take to find the appropriate remediation strategy. - -### Try document modes - -To see if the site works in the Internet Explorer 5, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, or Internet Explorer 11 document modes: - -- Open the site in Internet Explorer 11, load the F12 tools by pressing the **F12** key or by selecting **F12 Developer Tools** from the **Tools** menu, and select the **Emulation** tab. - - ![F12 Developer Tools Emulation tab](images/img-f12-developer-tools-emulation.jpg) - -- Run the site in each document mode until you find the mode in which the site works. - - >[!NOTE] - >You will need to make sure the User agent string dropdown matches the same browser version as the Document mode dropdown. For example, if you were testing to see if the site works in Internet Explorer 10, you should update the Document mode dropdown to 10 and the User agent string dropdown to Internet Explorer 10. - -- If you find a mode in which your site works, you will need to add the site domain, sub-domain, or URL to the Enterprise Mode Site List for the document mode in which the site works, or ask the IT administrator to do so. You can add the *x-ua-compatible* meta tag or HTTP header as well. - -### Try IE8 Enterprise Mode - -If a document mode didn't fix your site, try IE8 Enterprise Mode, which benefits sites written for Internet Explorer 5, Internet Explorer 7, and Internet Explorer 8 document modes. - -- Enable the **Let users turn on and use Enterprise Mode from the Tools menu** policy locally on your machine. To do this: - - - Search for and run **gpedit.msc** - - - Navigate to **Computer Configuration** \> **Administrative Template** \> **Windows Components** \> **Internet Explorer**. - - - Enable the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting. - - After making this change, run **gpupdate.exe /force** to make sure the setting is applied locally. You should also make sure to disable this setting once you're done testing. Alternately, you can use a regkey; see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) for more information. - -- Restart Internet Explorer 11 and open the site you're testing, then go to **Emulation** tab in the **F12 Developer Tools** and select **Enterprise** from the **Browser profile** dropdown. If the site works, inform the IT administrator that the site needs to be added to the IE8 Enterprise Mode section. - -### Try IE7 Enterprise Mode - -If IE8 Enterprise Mode doesn't work, IE7 Enterprise Mode will give you the Compatibility View behavior that shipped with Internet Explorer 8 with Enterprise Mode. To try this approach: - -- Go to the **Tools** menu, select **Compatibility View Settings**, and add the site to the list. - -- Go to **Emulation** tab in the **F12 Developer Tools** and select **Enterprise** from the **Browser profile** dropdown. - -If the site works, inform the IT administrator that the site needs to be added to the IE7 Enterprise Mode section.\ - ->[!NOTE] ->Adding the same Web path to the Enterprise Mode and sections of the Enterprise Mode Site List will not work, but we will address this in a future update. - -### Update the site for modern web standards - -We recommend that enterprise customers focus their new development on established, modern web standards for better performance and interoperability across devices, and avoid developing sites in older Internet Explorer document modes. We often hear that, due to fact that the Intranet zone defaults to Compatibility View, web developers inadvertently create new sites in the Internet Explorer 7 or Internet Explorer 5 modes in the Intranet zone, depending on whether or not they used a DOCTYPE. As you move your web apps to modern standards, you can enable the **Turn on Internet Explorer Standards Mode for local intranet** Group Policy setting and add those sites that need Internet Explorer 5 or Internet Explorer 7 modes to the Site List. Of course, it is always a good idea to test the app to ensure that these settings work for your environment. - -## Related resources - -- [Document modes](https://msdn.microsoft.com/library/dn384051(v=vs.85).aspx) -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) -- [Enterprise Site Discovery Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=44570) -- [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List. +author: dansimp +ms.author: dansimp +ms.prod: ie11 +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +title: Tips and tricks to manage Internet Explorer compatibility +ms.sitesec: library +ms.date: 05/10/2018 +--- + +# Tips and tricks to manage Internet Explorer compatibility + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List. + +Jump to: +- [Tips for IT professionals](#tips-for-it-professionals) +- [Tips for web developers](#tips-for-web-developers) + +[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) can be very effective in providing backward compatibility for older web apps. The Enterprise Mode Site List includes the ability to put any web app in any document mode, include IE8 and IE7 Enterprise Modes, without changing a single line of code on the website. + +![Internet Explorer Enterprise Modes and document modes](images/img-enterprise-mode-site-list-xml.jpg) + +Sites in the \ section can be rendered in any document mode, as shown in blue above. Some sites designed for older versions of Internet Explorer may require better backward compatibility, and these can leverage the \ section of the Enterprise Mode Site List. IE8 Enterprise Mode provides higher-fidelity emulation for Internet Explorer 8 by using, among other improvements, the original Internet Explorer 8 user agent string. IE7 Enterprise Mode further improves emulation by adding Compatibility View. + +Compatibility View, first introduced with Internet Explorer 8, is basically a switch. If a webpage has no DOCTYPE, that page will be rendered in Internet Explorer 5 mode. If there is a DOCTYPE, the page will be rendered in Internet Explorer 7 mode. You can effectively get Compatibility View by specifying Internet Explorer 7 in the \ section, as this falls back to Internet Explorer 5 automatically if there's no DOCTYPE, or you can use IE7 Enterprise Mode for even better emulation. + +## Tips for IT professionals + +### Inventory your sites + +Upgrading to a new browser can be a time-consuming and potentially costly venture. To help reduce these costs, you can download the [Enterprise Site Discovery Toolkit](https://www.microsoft.com/download/details.aspx?id=44570), which can help you prioritize which sites you should be testing based on their usage in your enterprise. For example, if the data shows that no one is visiting a particular legacy web app, you may not need to test or fix it. The toolkit is supported on Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. The toolkit also gives you information about which document mode a page runs in your current browser so you can better understand how to fix that site if it breaks in a newer version of the browser. + +Once you know which sites to test and fix, the following remediation methods may help fix your compatibility issues in Internet Explorer 11 and Windows 10. + +### If you're on Internet Explorer 8 and upgrading to Internet Explorer 11: + +Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 8 documents modes, as well as IE8 Enterprise Mode and IE7 Enterprise Mode. + +- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 8 mode. This is because "edge" in Internet Explorer 8 meant Internet Explorer 8 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. + +- Sites without a DOCTYPE in zones other than Intranet will default to QME (or "interoperable quirks") rather than Internet Explorer 5 Quirks and may need to be set to Internet Explorer 5 mode. + +- Some sites may need to be added to both Enterprise Mode and Compatibility View to work. You can do this by adding the site to IE7 Enterprise Mode. + +### If you're on Internet Explorer 9 and upgrading to Internet Explorer 11: + +Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 9 document modes. + +- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 9 mode. This is because "edge" in Internet Explorer 9 meant Internet Explorer 9 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. + +- Sites without a DOCTYPE in zones other than Intranet will default to Interoperable Quirks rather than Internet Explorer 5 Quirks and may need to be set to Internet Explorer 5 mode. + +- If your sites worked in Internet Explorer 9, you won't need IE8 Enterprise Mode or IE7 Enterprise Mode. + +### If you're on Internet Explorer 10 and upgrading to Internet Explorer 11: + +Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 10 modes. + +- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 10 mode. This is because "edge" in Internet Explorer 10 meant Internet Explorer 10 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. + +- If your sites worked in Internet Explorer 10, you won't need IE8 Enterprise Mode or IE7 Enterprise Mode. + +### If you're on Internet Explorer 11 and upgrading to Windows 10: + +You're all set! You shouldn’t need to make any changes. + +## Tips for web developers + +If your website worked in an older version of Internet Explorer, but no longer works in Internet Explorer 11, you may need to update the site. Here are the set of steps you should take to find the appropriate remediation strategy. + +### Try document modes + +To see if the site works in the Internet Explorer 5, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, or Internet Explorer 11 document modes: + +- Open the site in Internet Explorer 11, load the F12 tools by pressing the **F12** key or by selecting **F12 Developer Tools** from the **Tools** menu, and select the **Emulation** tab. + + ![F12 Developer Tools Emulation tab](images/img-f12-developer-tools-emulation.jpg) + +- Run the site in each document mode until you find the mode in which the site works. + + > [!NOTE] + > You will need to make sure the User agent string dropdown matches the same browser version as the Document mode dropdown. For example, if you were testing to see if the site works in Internet Explorer 10, you should update the Document mode dropdown to 10 and the User agent string dropdown to Internet Explorer 10. + +- If you find a mode in which your site works, you will need to add the site domain, sub-domain, or URL to the Enterprise Mode Site List for the document mode in which the site works, or ask the IT administrator to do so. You can add the *x-ua-compatible* meta tag or HTTP header as well. + +### Try IE8 Enterprise Mode + +If a document mode didn't fix your site, try IE8 Enterprise Mode, which benefits sites written for Internet Explorer 5, Internet Explorer 7, and Internet Explorer 8 document modes. + +- Enable the **Let users turn on and use Enterprise Mode from the Tools menu** policy locally on your machine. To do this: + + - Search for and run **gpedit.msc** + + - Navigate to **Computer Configuration** \> **Administrative Template** \> **Windows Components** \> **Internet Explorer**. + + - Enable the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting. + + After making this change, run **gpupdate.exe /force** to make sure the setting is applied locally. You should also make sure to disable this setting once you're done testing. Alternately, you can use a regkey; see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) for more information. + +- Restart Internet Explorer 11 and open the site you're testing, then go to **Emulation** tab in the **F12 Developer Tools** and select **Enterprise** from the **Browser profile** dropdown. If the site works, inform the IT administrator that the site needs to be added to the IE8 Enterprise Mode section. + +### Try IE7 Enterprise Mode + +If IE8 Enterprise Mode doesn't work, IE7 Enterprise Mode will give you the Compatibility View behavior that shipped with Internet Explorer 8 with Enterprise Mode. To try this approach: + +- Go to the **Tools** menu, select **Compatibility View Settings**, and add the site to the list. + +- Go to **Emulation** tab in the **F12 Developer Tools** and select **Enterprise** from the **Browser profile** dropdown. + +If the site works, inform the IT administrator that the site needs to be added to the IE7 Enterprise Mode section.\ + +> [!NOTE] +> Adding the same Web path to the Enterprise Mode and sections of the Enterprise Mode Site List will not work, but we will address this in a future update. + +### Update the site for modern web standards + +We recommend that enterprise customers focus their new development on established, modern web standards for better performance and interoperability across devices, and avoid developing sites in older Internet Explorer document modes. We often hear that, due to fact that the Intranet zone defaults to Compatibility View, web developers inadvertently create new sites in the Internet Explorer 7 or Internet Explorer 5 modes in the Intranet zone, depending on whether or not they used a DOCTYPE. As you move your web apps to modern standards, you can enable the **Turn on Internet Explorer Standards Mode for local intranet** Group Policy setting and add those sites that need Internet Explorer 5 or Internet Explorer 7 modes to the Site List. Of course, it is always a good idea to test the app to ensure that these settings work for your environment. + +## Related resources + +- [Document modes](https://msdn.microsoft.com/library/dn384051(v=vs.85).aspx) +- [What is Enterprise Mode?](what-is-enterprise-mode.md) +- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) +- [Enterprise Site Discovery Toolkit](https://www.microsoft.com/download/details.aspx?id=44570) +- [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) +- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md index 55e4491ac7..bf8ceeb867 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md @@ -1,52 +1,56 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with Internet Explorer. -author: lomayor -ms.prod: ie11 -ms.assetid: 0361c1a6-3faa-42b2-a588-92439eebeeab -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Troubleshoot Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Troubleshoot Internet Explorer 11 (IE11) - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with Internet Explorer. - -## In this section - -|Topic |Description | -|-------|--------------| -|[Setup problems with Internet Explorer 11](setup-problems-with-ie11.md) |Guidance about how to find and understand the error log files created when setup runs. | -|[Install problems with Internet Explorer 11](install-problems-with-ie11.md) |Guidance about how to address potential problems when IE doesn’t finish installing. | -|[Problems after installing Internet Explorer 11](problems-after-installing-ie11.md) |Guidance about how to troubleshoot and help fix instability problems, where IE crashes or seems slow or where Digital Rights Management (DRM) playback doesn’t work. | -|[Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md) |Guidance about how to troubleshoot and help fix problems where branding changes aren’t distributed or where you’re experiencing proxy server setup problems. | -|[User interface problems with Internet Explorer 11](user-interface-problems-with-ie11.md) |Guidance about changes to the IE Customization Wizard, security zones, Favorites, Command, and Status bars, and the search box. | -|[Group Policy problems with Internet Explorer 11](group-policy-problems-ie11.md) |Guidance about how to find the Group Policy Object-related log files for troubleshooting. | -|[.NET Framework problems with Internet Explorer 11](net-framework-problems-with-ie11.md) |Guidance about how to turn managed browser hosting controls back on. | -|[Enhanced Protected Mode problems with Internet Explorer](enhanced-protected-mode-problems-with-ie11.md) |Guidance about how to turn off Enhanced Protected Mode to address compatibility issues. | -|[Fix font rendering problems by turning off natural metrics](turn-off-natural-metrics.md) |Guidance about how to turn off natural metrics to address font rendering problems. | -|[Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md) |Guidance about how to turn on single-word intranet searches in the address bar. | -|[Browser cache changes and roaming profiles](browser-cache-changes-and-roaming-profiles.md) |Guidance about changes we’ve made to the browser cache to improve the performance, flexibility, reliability, and scalability and how to get the best results while using a roaming profile. | - -  - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with Internet Explorer. +author: dansimp +ms.prod: ie11 +ms.assetid: 0361c1a6-3faa-42b2-a588-92439eebeeab +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Troubleshoot Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Troubleshoot Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with Internet Explorer. + +## In this section + +|Topic |Description | +|-------|--------------| +|[Setup problems with Internet Explorer 11](setup-problems-with-ie11.md) |Guidance about how to find and understand the error log files created when setup runs. | +|[Install problems with Internet Explorer 11](install-problems-with-ie11.md) |Guidance about how to address potential problems when IE doesn’t finish installing. | +|[Problems after installing Internet Explorer 11](problems-after-installing-ie11.md) |Guidance about how to troubleshoot and help fix instability problems, where IE crashes or seems slow or where Digital Rights Management (DRM) playback doesn’t work. | +|[Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md) |Guidance about how to troubleshoot and help fix problems where branding changes aren’t distributed or where you’re experiencing proxy server setup problems. | +|[User interface problems with Internet Explorer 11](user-interface-problems-with-ie11.md) |Guidance about changes to the IE Customization Wizard, security zones, Favorites, Command, and Status bars, and the search box. | +|[Group Policy problems with Internet Explorer 11](group-policy-problems-ie11.md) |Guidance about how to find the Group Policy Object-related log files for troubleshooting. | +|[.NET Framework problems with Internet Explorer 11](net-framework-problems-with-ie11.md) |Guidance about how to turn managed browser hosting controls back on. | +|[Enhanced Protected Mode problems with Internet Explorer](enhanced-protected-mode-problems-with-ie11.md) |Guidance about how to turn off Enhanced Protected Mode to address compatibility issues. | +|[Fix font rendering problems by turning off natural metrics](turn-off-natural-metrics.md) |Guidance about how to turn off natural metrics to address font rendering problems. | +|[Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md) |Guidance about how to turn on single-word intranet searches in the address bar. | +|[Browser cache changes and roaming profiles](browser-cache-changes-and-roaming-profiles.md) |Guidance about changes we’ve made to the browser cache to improve the performance, flexibility, reliability, and scalability and how to get the best results while using a roaming profile. | + +  + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md index d193f26c68..7e4561fa2a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md @@ -1,80 +1,84 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: How to turn Enterprise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it. -author: lomayor -ms.prod: ie11 -ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Turn off Enterprise Mode - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -It’s important that you test the sites you’re adding, or considering removing, from your Enterprise Mode site list. To make this testing easier, you can turn off the site list or the entire Enterprise Mode functionality. For example, you might have an intranet site on your list that you’ve upgraded to be compatible with the new web standards . If you test the site while the site list is active, Internet Explorer 11 will automatically switch to Enterprise Mode. By turning off the site list, you can see what the page actually looks like and decide whether to remove it from your site list. - -In addition, if you no longer want your users to be able to turn Enterprise Mode on locally, you can remove Enterprise Mode from the local **Tools** menu. - -**Important**
          -Turning off both of these features turns off Enterprise Mode for your company. Turning off Enterprise Mode also causes any websites included in your employee’s manual site lists to not appear in Enterprise Mode. - - **To turn off the site list using Group Policy** - -1. Open your Group Policy editor, like Group Policy Management Console (GPMC). - -2. Go to the **Use the Enterprise Mode IE website list** setting, and then click **Disabled**.

          - Enterprise Mode will no longer look for the site list, effectively turning off Enterprise Mode. However, if you previously turned on local control for your employees, Enterprise Mode will still be available from the **Tools** menu. You need to turn that part of the functionality off separately. - - **To turn off local control using Group Policy** - -3. Open your Group Policy editor, like Group Policy Management Console (GPMC). - -4. Go to the **Let users turn on and use Enterprise Mode from the Tools menu** setting, and then click **Disable**. - -5. Enterprise Mode no longer shows up on the **Tools** menu for your employees. However, if you are still using an Enterprise Mode site list, all of the globally listed sites will still appear in Enterprise Mode. If you want to turn off all of Enterprise Mode, you will need to also turn off the site list functionality. - - **To turn off the site list using the registry** - -6. Open a registry editor, such as regedit.exe. - -7. Go to `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **SiteList** value.

          - You can also use HKEY_LOCAL_MACHINE, depending whether you want to turn off the Enterprise Mode site list for users or for computers. - -8. Close all and restart all instances of Internet Explorer.

          - IE11 stops looking at the site list for rendering instructions. However, Enterprise Mode is still available to your users locally (if it was turned on). - - **To turn off local control using the registry** - -9. Open a registry editor, such as regedit.exe. - -10. Go `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **Enable** value.

          - You can also use HKEY_CURRENT_USER, depending whether you want to turn off Enterprise Mode for users or for computers. - -11. Close and restart all instances of IE.

          - Enterprise Mode is no longer a user option on the **Tools** menu in IE11. However, IE11 still looks at the site list (if it was turned on). - -## Related topics -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) -- [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: How to turn Enterprise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it. +author: dansimp +ms.prod: ie11 +ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Turn off Enterprise Mode + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +It’s important that you test the sites you’re adding, or considering removing, from your Enterprise Mode site list. To make this testing easier, you can turn off the site list or the entire Enterprise Mode functionality. For example, you might have an intranet site on your list that you’ve upgraded to be compatible with the new web standards . If you test the site while the site list is active, Internet Explorer 11 will automatically switch to Enterprise Mode. By turning off the site list, you can see what the page actually looks like and decide whether to remove it from your site list. + +In addition, if you no longer want your users to be able to turn Enterprise Mode on locally, you can remove Enterprise Mode from the local **Tools** menu. + +**Important**
          +Turning off both of these features turns off Enterprise Mode for your company. Turning off Enterprise Mode also causes any websites included in your employee’s manual site lists to not appear in Enterprise Mode. + + **To turn off the site list using Group Policy** + +1. Open your Group Policy editor, like Group Policy Management Console (GPMC). + +2. Go to the **Use the Enterprise Mode IE website list** setting, and then click **Disabled**.

          + Enterprise Mode will no longer look for the site list, effectively turning off Enterprise Mode. However, if you previously turned on local control for your employees, Enterprise Mode will still be available from the **Tools** menu. You need to turn that part of the functionality off separately. + + **To turn off local control using Group Policy** + +3. Open your Group Policy editor, like Group Policy Management Console (GPMC). + +4. Go to the **Let users turn on and use Enterprise Mode from the Tools menu** setting, and then click **Disable**. + +5. Enterprise Mode no longer shows up on the **Tools** menu for your employees. However, if you are still using an Enterprise Mode site list, all of the globally listed sites will still appear in Enterprise Mode. If you want to turn off all of Enterprise Mode, you will need to also turn off the site list functionality. + + **To turn off the site list using the registry** + +6. Open a registry editor, such as regedit.exe. + +7. Go to `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **SiteList** value.

          + You can also use HKEY_LOCAL_MACHINE, depending whether you want to turn off the Enterprise Mode site list for users or for computers. + +8. Close all and restart all instances of Internet Explorer.

          + IE11 stops looking at the site list for rendering instructions. However, Enterprise Mode is still available to your users locally (if it was turned on). + + **To turn off local control using the registry** + +9. Open a registry editor, such as regedit.exe. + +10. Go `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **Enable** value.

          + You can also use HKEY_CURRENT_USER, depending whether you want to turn off Enterprise Mode for users or for computers. + +11. Close and restart all instances of IE.

          + Enterprise Mode is no longer a user option on the **Tools** menu in IE11. However, IE11 still looks at the site list (if it was turned on). + +## Related topics +- [What is Enterprise Mode?](what-is-enterprise-mode.md) +- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) +- [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md index 890640ae36..178085c2ad 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md @@ -1,37 +1,41 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Turn off natural metrics for Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: e31a27d7-662e-4106-a3d2-c6b0531961d5 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Fix font rendering problems by turning off natural metrics (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix font rendering problems by turning off natural metrics -By default, Internet Explorer 11 uses “natural metrics”. Natural metrics use inter-pixel spacing that creates more accurately rendered and readable text, avoiding many common font rendering problems with Windows Internet Explorer 9 or older sites. - -However, you might find that many intranet sites need you to use Windows Graphics Device Interface (GDI) metrics. To avoid potential compatibility issues, you must turn off natural metrics for those sites. - - **To turn off natural metrics** - -- Add the following HTTP header to each site: `X-UA-TextLayoutMetrics: gdi` - -

          -OR-

          - -- Add the following <meta> tag to each site: `` - -Turning off natural metrics automatically turns on GDI metrics. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: Turn off natural metrics for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: e31a27d7-662e-4106-a3d2-c6b0531961d5 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Fix font rendering problems by turning off natural metrics (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Fix font rendering problems by turning off natural metrics + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +By default, Internet Explorer 11 uses “natural metrics”. Natural metrics use inter-pixel spacing that creates more accurately rendered and readable text, avoiding many common font rendering problems with Windows Internet Explorer 9 or older sites. + +However, you might find that many intranet sites need you to use Windows Graphics Device Interface (GDI) metrics. To avoid potential compatibility issues, you must turn off natural metrics for those sites. + + **To turn off natural metrics** + +- Add the following HTTP header to each site: `X-UA-TextLayoutMetrics: gdi` + +

          -OR-

          + +- Add the following <meta> tag to each site: `` + +Turning off natural metrics automatically turns on GDI metrics. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md index 1a6823e2db..8c84054dc3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md @@ -1,75 +1,69 @@ ---- -title: Turn on Enterprise Mode and use a site list (Internet Explorer 11 for IT Pros) -description: How to turn on Enterprise Mode and specify a site list. -ms.assetid: 800e9c5a-57a6-4d61-a38a-4cb972d833e1 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: ie11 -ms.mktglfcycl: deploy -ms.pagetype: appcompat -ms.sitesec: library -author: lomayor -ms.author: lomayor -ms.date: 08/14/2017 -ms.localizationpriority: medium - - - - - ---- - - -# Turn on Enterprise Mode and use a site list - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Before you can use a site list with Enterprise Mode, you need to turn the functionality on and set up the system for centralized control. By allowing centralized control, you can create one global list of websites that render using Enterprise Mode. Approximately 65 seconds after Internet Explorer 11 starts, it looks for a properly formatted site list. If a new site list if found, with a different version number than the active list, IE11 loads and uses the newer version. After the initial check, IE11 won’t look for an updated list again until you restart the browser. - ->[!NOTE] ->We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode. - - **To turn on Enterprise Mode using Group Policy** - -1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.

          - Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - - ![local group policy editor for using a site list](images/ie-emie-grouppolicysitelist.png) - -2. Click **Enabled**, and then in the **Options** area, type the location to your site list. - - **To turn on Enterprise Mode using the registry** - -3. **For only the local user:** Open a registry editor, like regedit.exe and go to `HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. -

          -OR-

          - For all users on the device: Open a registry editor, like regedit.exe and go to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode. - -4. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example: - - ![enterprise mode with site list in the registry](images/ie-emie-registrysitelist.png) - - - **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"` - - - **Local network:** `"SiteList"="\\network\shares\sites.xml"` - - - **Local file:** `"SiteList"="file:///c:\\Users\\\\Documents\\testList.xml"` - - All of your managed devices must have access to this location if you want them to be able to access and use Enterprise Mode and your site list. For information about how to create and use an Enterprise Mode site list, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) - - - - - - +--- +title: Turn on Enterprise Mode and use a site list (Internet Explorer 11 for IT Pros) +description: How to turn on Enterprise Mode and specify a site list. +ms.assetid: 800e9c5a-57a6-4d61-a38a-4cb972d833e1 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: ie11 +ms.mktglfcycl: deploy +ms.pagetype: appcompat +ms.sitesec: library +author: dansimp +ms.author: dansimp +ms.date: 08/14/2017 +ms.localizationpriority: medium +--- + + +# Turn on Enterprise Mode and use a site list + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Before you can use a site list with Enterprise Mode, you need to turn the functionality on and set up the system for centralized control. By allowing centralized control, you can create one global list of websites that render using Enterprise Mode. Approximately 65 seconds after Internet Explorer 11 starts, it looks for a properly formatted site list. If a new site list if found, with a different version number than the active list, IE11 loads and uses the newer version. After the initial check, IE11 won’t look for an updated list again until you restart the browser. + +> [!NOTE] +> We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode. + + **To turn on Enterprise Mode using Group Policy** + +1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.

          + Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. + + ![local group policy editor for using a site list](images/ie-emie-grouppolicysitelist.png) + +2. Click **Enabled**, and then in the **Options** area, type the location to your site list. + + **To turn on Enterprise Mode using the registry** + +3. **For only the local user:** Open a registry editor, like regedit.exe and go to `HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. +

          -OR-

          + For all users on the device: Open a registry editor, like regedit.exe and go to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode. + +4. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example: + + ![enterprise mode with site list in the registry](images/ie-emie-registrysitelist.png) + + - **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"` + + - **Local network:** `"SiteList"="\\network\shares\sites.xml"` + + - **Local file:** `"SiteList"="file:///c:\\Users\\\\Documents\\testList.xml"` + + All of your managed devices must have access to this location if you want them to be able to access and use Enterprise Mode and your site list. For information about how to create and use an Enterprise Mode site list, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) +- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) + diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md index 2f52fdfba2..b4db0fb7a4 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -1,64 +1,68 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Turn on local user control and logging for Enterprise Mode. -author: lomayor -ms.prod: ie11 -ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Turn on local control and logging for Enterprise Mode - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can turn on local control of Enterprise Mode so that your users can turn Enterprise Mode on from the **Tools** menu. Turning on this feature also adds the **Enterprise** browser profile to the **Emulation** tab of the F12 developer tools. - -Besides turning on this feature, you also have the option to provide a URL for Enterprise Mode logging. If you turn logging on, Internet Explorer initiates a simple POST back to the supplied address, including the URL and a specification that **EnterpriseMode** was turned on or off through the **Tools** menu. - - **To turn on local control of Enterprise Mode using Group Policy** - -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - - ![group policy editor with emie setting](images/ie-emie-editpolicy.png) - -2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. - - **To turn on local control of Enterprise Mode using the registry** - -3. Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. - -4. In the right pane, right-click and click **New**, click **String Value**, and then name the new value **Enable**. - -5. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - - ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) - -Your **Value data** location can be any of the following types: - -- **URL location (like, https://www.emieposturl.com/api/records or https://localhost:13000)**. IE sends a POST message to the URL every time a change is made to Enterprise Mode from the **Tools** menu.

          **Important**
          - The `https://www.emieposturl.com/api/records` example will only work if you’ve downloaded the sample discussed in the [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) topic. If you don’t have the sample, you won’t have the web API. -- **Local network location (like, https://emieposturl/)**. IE sends a POST message to your specified local network location every time a change is made to Enterprise Mode from the **Tools** menu. -- **Empty string**. If you leave the **Value data** box blank; your employees will be able to turn Enterprise Mode on and off from the **Tools** menu, but you won’t collect any logging data. - -For information about how to collect the data provided when your employees turn Enterprise Mode on or off from the **Tools** menu, see [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md). - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Turn on local user control and logging for Enterprise Mode. +author: dansimp +ms.prod: ie11 +ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Turn on local control and logging for Enterprise Mode + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can turn on local control of Enterprise Mode so that your users can turn Enterprise Mode on from the **Tools** menu. Turning on this feature also adds the **Enterprise** browser profile to the **Emulation** tab of the F12 developer tools. + +Besides turning on this feature, you also have the option to provide a URL for Enterprise Mode logging. If you turn logging on, Internet Explorer initiates a simple POST back to the supplied address, including the URL and a specification that **EnterpriseMode** was turned on or off through the **Tools** menu. + + **To turn on local control of Enterprise Mode using Group Policy** + +1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. + + ![group policy editor with emie setting](images/ie-emie-editpolicy.png) + +2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. + + **To turn on local control of Enterprise Mode using the registry** + +3. Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. + +4. In the right pane, right-click and click **New**, click **String Value**, and then name the new value **Enable**. + +5. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. + + ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) + +Your **Value data** location can be any of the following types: + +- **URL location (like, https://www.emieposturl.com/api/records or https://localhost:13000)**. IE sends a POST message to the URL every time a change is made to Enterprise Mode from the **Tools** menu.

          **Important**
          + The `https://www.emieposturl.com/api/records` example will only work if you’ve downloaded the sample discussed in the [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) topic. If you don’t have the sample, you won’t have the web API. +- **Local network location (like, https://emieposturl/)**. IE sends a POST message to your specified local network location every time a change is made to Enterprise Mode from the **Tools** menu. +- **Empty string**. If you leave the **Value data** box blank; your employees will be able to turn Enterprise Mode on and off from the **Tools** menu, but you won’t collect any logging data. + +For information about how to collect the data provided when your employees turn Enterprise Mode on or off from the **Tools** menu, see [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md). + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md index a4121ee693..750bca0e82 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md @@ -1,50 +1,54 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: High-level info about some of the new and updated features for Internet Explorer 11. -author: lomayor -ms.prod: ie11 -ms.assetid: f53c6f04-7c60-40e7-9fc5-312220f08156 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: List of updated features and tools - Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# List of updated features and tools - Internet Explorer 11 (IE11) - -**Applies to:** - -- Windows 10 -- Windows 8.1 Update -- Windows 7 with Service Pack 1 (SP1) -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Internet Explorer 11 includes several new features and tools. This topic includes high-level info about the each of them. - -## Updated features and tools -- **Updated web standards.** WebGL, Canvas 2D L2 extensions, fullscreen API, encrypted media extensions, media source extensions, CSS flexible box layout module, mutation observers, like DOM4 and 5.3. - -- **Enhanced Protected Mode.** Extends Protected Mode to further restrict the ability of an attacker to access sensitive or personal information in personal and corporate environments. This feature is turned off by default. For more info, see [Enhanced Protected Mode problems with Internet Explorer](enhanced-protected-mode-problems-with-ie11.md). - -- **Enterprise Mode.** Enterprise Mode, a compatibility mode that runs on IE11 on Windows 8.1 Update and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. For more info, see [What is Enterprise Mode?](what-is-enterprise-mode.md) - -- **Out-of-date ActiveX control blocking**. Helps to keep your ActiveX controls up-to-date, because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. For more info, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md). - -- **Do Not Track (DNT) exceptions.** IE11 lets websites ask whether to track users as they browse a website. If the user approves the request, IE records an exception to the "Do Not Track" rule and sends headers to the website that allow tracking. By respecting these headers and requesting exceptions to the default privacy settings, website owners can develop a trusted relationship with their users about privacy. For more info, see [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md). - -- **IE Administration Kit (IEAK).** Lets you create custom, branded versions of IE11. For more info and to download the tool, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). - -- **Unattend Settings.** Lets you update the Unattend.xml file, to customize the home page, favorites, search providers, feeds, Accelerators, Web Slices, and settings for top result searches. For more info, see the [Unattend Settings: Microsoft-Windows-IE-InternetExplorer](https://go.microsoft.com/fwlink/p/?LinkId=263709). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: High-level info about some of the new and updated features for Internet Explorer 11. +author: dansimp +ms.prod: ie11 +ms.assetid: f53c6f04-7c60-40e7-9fc5-312220f08156 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: List of updated features and tools - Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# List of updated features and tools - Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 Update +- Windows 7 with Service Pack 1 (SP1) +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Internet Explorer 11 includes several new features and tools. This topic includes high-level info about the each of them. + +## Updated features and tools +- **Updated web standards.** WebGL, Canvas 2D L2 extensions, fullscreen API, encrypted media extensions, media source extensions, CSS flexible box layout module, mutation observers, like DOM4 and 5.3. + +- **Enhanced Protected Mode.** Extends Protected Mode to further restrict the ability of an attacker to access sensitive or personal information in personal and corporate environments. This feature is turned off by default. For more info, see [Enhanced Protected Mode problems with Internet Explorer](enhanced-protected-mode-problems-with-ie11.md). + +- **Enterprise Mode.** Enterprise Mode, a compatibility mode that runs on IE11 on Windows 8.1 Update and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. For more info, see [What is Enterprise Mode?](what-is-enterprise-mode.md) + +- **Out-of-date ActiveX control blocking**. Helps to keep your ActiveX controls up-to-date, because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. For more info, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md). + +- **Do Not Track (DNT) exceptions.** IE11 lets websites ask whether to track users as they browse a website. If the user approves the request, IE records an exception to the "Do Not Track" rule and sends headers to the website that allow tracking. By respecting these headers and requesting exceptions to the default privacy settings, website owners can develop a trusted relationship with their users about privacy. For more info, see [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md). + +- **IE Administration Kit (IEAK).** Lets you create custom, branded versions of IE11. For more info and to download the tool, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). + +- **Unattend Settings.** Lets you update the Unattend.xml file, to customize the home page, favorites, search providers, feeds, Accelerators, Web Slices, and settings for top result searches. For more info, see the [Unattend Settings: Microsoft-Windows-IE-InternetExplorer](https://go.microsoft.com/fwlink/p/?LinkId=263709). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md index ad67aa915b..fe55abfdc6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md @@ -1,84 +1,88 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Portal. -ms.prod: ie11 -title: Use the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -author: lomayor ---- - -# Use the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -You can use IE11 and the Enterprise Mode Site List Portal to manage your Enterprise Mode Site List, hosted by the app, with multiple users. - -## Minimum system requirements for portal and test machines -Some of the components in this table might also need additional system resources. Check the component's documentation for more information. - -|Item |Description | -|-----|------------| -|Operating system |Windows 7 or later | -|Memory |16 GB RAM | -|Hard drive space |At least 8 GB of free space, formatted using the NTFS file system for better security | -|Active Directory (AD) |Devices must be domain-joined | -|SQL Server |Microsoft SQL Server Enterprise Edition 2012 or later | -|Visual Studio |Visual Studio 2015 or later | -|Node.js® package manager |npm Developer version or higher | -|Additional server infrastructure |Internet Information Service (IIS) 6.0 or later | - -## Role assignments and available actions -Admins can assign roles to employees for the Enterprise Mode Site List Portal, allowing the employees to perform specific actions, as described in this table. - -|Role assignment |Available actions | -|----------------|------------------| -|Requester |

          • Create a change request


          • Validate changes in the pre-production environment


          • Rollback pre-production and production changes in case of failure


          • Send approval requests


          • View own requests


          • Sign off and close own requests
          | -|Approver

          (includes the App Manager and Group Head roles) |
          • All of the Requester actions, plus:


          • Approve requests
          | -|Administrator |
          • All of the Requester and Approver actions, plus:


          • Add employees to the portal


          • Assign employee roles


          • Approve registrations to the portal


          • Configure portal settings (for example, determine the freeze schedule, determine the pre-production and production XML paths, and determine the attachment upload location)


          • Use the standalone Enterprise Mode Site List Manager page


          • View reports
          | - -## Enterprise Mode Site List Portal workflow by employee role -The following workflow describes how to use the Enterprise Mode Site List Portal. - -1. [The Requester submits a change request for an app](create-change-request-enterprise-mode-portal.md) - -2. [The Requester tests the change request info, verifying its accuracy](verify-changes-preprod-enterprise-mode-portal.md) - -3. [The Approver(s) group accepts the change request](approve-change-request-enterprise-mode-portal.md) - -4. [The Requester schedules the change for the production environment](schedule-production-change-enterprise-mode-portal.md) - -5. [The change is verified against the production site list and signed off](verify-changes-production-enterprise-mode-portal.md) - - -## Related topics -- [Set up the Enterprise Mode Site List Portal](set-up-enterprise-mode-portal.md) - -- [Workflow-based processes for employees using the Enterprise Mode Site List Portal](workflow-processes-enterprise-mode-portal.md) - -- [How to use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) - -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Portal. +ms.prod: ie11 +title: Use the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: dansimp +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +--- + +# Use the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. + +The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. + +You can use IE11 and the Enterprise Mode Site List Portal to manage your Enterprise Mode Site List, hosted by the app, with multiple users. + +## Minimum system requirements for portal and test machines +Some of the components in this table might also need additional system resources. Check the component's documentation for more information. + +|Item |Description | +|-----|------------| +|Operating system |Windows 7 or later | +|Memory |16 GB RAM | +|Hard drive space |At least 8 GB of free space, formatted using the NTFS file system for better security | +|Active Directory (AD) |Devices must be domain-joined | +|SQL Server |Microsoft SQL Server Enterprise Edition 2012 or later | +|Visual Studio |Visual Studio 2015 or later | +|Node.js® package manager |npm Developer version or higher | +|Additional server infrastructure |Internet Information Service (IIS) 6.0 or later | + +## Role assignments and available actions +Admins can assign roles to employees for the Enterprise Mode Site List Portal, allowing the employees to perform specific actions, as described in this table. + +|Role assignment |Available actions | +|----------------|------------------| +|Requester |
          • Create a change request


          • Validate changes in the pre-production environment


          • Rollback pre-production and production changes in case of failure


          • Send approval requests


          • View own requests


          • Sign off and close own requests
          | +|Approver

          (includes the App Manager and Group Head roles) |
          • All of the Requester actions, plus:


          • Approve requests
          | +|Administrator |
          • All of the Requester and Approver actions, plus:


          • Add employees to the portal


          • Assign employee roles


          • Approve registrations to the portal


          • Configure portal settings (for example, determine the freeze schedule, determine the pre-production and production XML paths, and determine the attachment upload location)


          • Use the standalone Enterprise Mode Site List Manager page


          • View reports
          | + +## Enterprise Mode Site List Portal workflow by employee role +The following workflow describes how to use the Enterprise Mode Site List Portal. + +1. [The Requester submits a change request for an app](create-change-request-enterprise-mode-portal.md) + +2. [The Requester tests the change request info, verifying its accuracy](verify-changes-preprod-enterprise-mode-portal.md) + +3. [The Approver(s) group accepts the change request](approve-change-request-enterprise-mode-portal.md) + +4. [The Requester schedules the change for the production environment](schedule-production-change-enterprise-mode-portal.md) + +5. [The change is verified against the production site list and signed off](verify-changes-production-enterprise-mode-portal.md) + + +## Related topics +- [Set up the Enterprise Mode Site List Portal](set-up-enterprise-mode-portal.md) + +- [Workflow-based processes for employees using the Enterprise Mode Site List Portal](workflow-processes-enterprise-mode-portal.md) + +- [How to use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) + +- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) + +- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md index 34f58b78f4..cbfcfecf93 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md @@ -1,70 +1,76 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager. -author: lomayor -ms.prod: ie11 -ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 12/04/2017 ---- - - -# Use the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. - -## Enterprise Mode Site List Manager versions -There are currently two versions of the Enterprise Site List Manager, both based on your schema and operating system. Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) tool, based on your operating system. - -|Schema version |Operating system |Enterprise Site List Manager version | -|-----------------|---------------|------------------------------------| -|Enterprise Mode schema, version 2 (v.2) |Windows 10
          -OR-
          Windows 8.1
          -OR-
          Windows 7|Uses the Enterprise Mode Site List Manager (schema v.2) and the v.2 version of the schema. If you import a v.1 version schema into the Enterprise Mode Site List Manager (schema v.2), the XML is saved into the v.2 version of the schema.

          For more info about the v.2 version of the schema, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md).| -|Enterprise Mode schema, version 1 (v.1) |Windows 10
          -OR-
          Windows 8.1
          -OR-
          Windows 7|Uses the Enterprise Mode Site List Manager (schema v.1) and the v.1 version of the schema.

          For more info about the v.1 version of the schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md)| - -## Using the Enterprise Mode Site List Manager -The following topics give you more information about the things that you can do with the Enterprise Mode Site List Manager. - -|Topic |Description | -|------|------------| -|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.2). | -|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.1). | -|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the Enterprise Mode Site List Manager (schema v.2). | -|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the WEnterprise Mode Site List Manager (schema v.1). | -|[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) |How to edit the compatibility mode for specific websites.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) |How to fix common site list validation errors.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to look to see if a site is already in your global Enterprise Mode site list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Save your site list to XML in the Enterprise Mode Site List Manager](save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) |How to save a site list as XML, so you can deploy and use it with your managed systems.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) |How to export your site list so you can transfer your data and contents to someone else.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](import-into-the-enterprise-mode-site-list-manager.md) |How to import your site list to replace a corrupted or out-of-date list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete a website from your site list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete all of the websites in a site list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | - -## Related topics - - -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager. +author: dansimp +ms.prod: ie11 +ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 12/04/2017 +--- + + +# Use the Enterprise Mode Site List Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. + +You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. + +## Enterprise Mode Site List Manager versions +There are currently two versions of the Enterprise Site List Manager, both based on your schema and operating system. Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) tool, based on your operating system. + +|Schema version |Operating system |Enterprise Site List Manager version | +|-----------------|---------------|------------------------------------| +|Enterprise Mode schema, version 2 (v.2) |Windows 10
          -OR-
          Windows 8.1
          -OR-
          Windows 7|Uses the Enterprise Mode Site List Manager (schema v.2) and the v.2 version of the schema. If you import a v.1 version schema into the Enterprise Mode Site List Manager (schema v.2), the XML is saved into the v.2 version of the schema.

          For more info about the v.2 version of the schema, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md).| +|Enterprise Mode schema, version 1 (v.1) |Windows 10
          -OR-
          Windows 8.1
          -OR-
          Windows 7|Uses the Enterprise Mode Site List Manager (schema v.1) and the v.1 version of the schema.

          For more info about the v.1 version of the schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md)| + +## Using the Enterprise Mode Site List Manager +The following topics give you more information about the things that you can do with the Enterprise Mode Site List Manager. + +|Topic |Description | +|------|------------| +|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.2). | +|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.1). | +|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the Enterprise Mode Site List Manager (schema v.2). | +|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the WEnterprise Mode Site List Manager (schema v.1). | +|[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) |How to edit the compatibility mode for specific websites.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +|[Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) |How to fix common site list validation errors.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +|[Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager](review-neutral-sites-with-site-list-manager.md) |How to flag sites listed as neutral, to ensure that they are intentional and not a result of schema conversion. This topic applies to the Enterprise Mode Site List Manager version 11.0 or later. | +|[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to look to see if a site is already in your global Enterprise Mode site list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +|[Save your site list to XML in the Enterprise Mode Site List Manager](save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) |How to save a site list as XML, so you can deploy and use it with your managed systems.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +|[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) |How to export your site list so you can transfer your data and contents to someone else.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +|[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](import-into-the-enterprise-mode-site-list-manager.md) |How to import your site list to replace a corrupted or out-of-date list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +|[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete a website from your site list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +|[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete all of the websites in a site list.

          This topic applies to both versions of the Enterprise Mode Site List Manager. | +| [Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager](review-neutral-sites-with-site-list-manager.md)|How to flag sites listed as neutral, to ensure that they are intentional and not a result of schema conversion.

          This topic applies to the latest version of the Enterprise Mode Site List Manager. + +## Related topics + + +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) +- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md index 992abebb63..b7669cf1ca 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md @@ -1,58 +1,54 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Info about where features went in the IEAK11, where the Favorites, Command, and Status bars went, and where the search bar went. -author: lomayor -ms.prod: ie11 -ms.assetid: 7324faff-ccb6-4e14-ad91-af12dbca575e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: User interface problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# User interface problems with Internet Explorer 11 -Some of the features in both Internet Explorer 11 and IEAK 11 have moved around. Here are some of the more common changes. - -## Where did features go in the Internet Explorer Customization Wizard 11? -Various installation or set up choices can prevent you from seeing certain pages in the Internet Explorer Customization Wizard 11. If, after going through the entire Wizard you still haven't found the screen you were looking for, try: - -- Making sure you picked the right version of IEAK 11 during installation. Most administrators should pick the **Internal** version, which has more screens and options available. - -- Making sure you picked all of the features you wanted from the **Feature Selection** page of the IE Customization Wizard 11. If you don't pick a feature, the associated page won't appear. - -## Where are the security zone settings? -You can see your security zone settings by opening Internet Explorer for the desktop, clicking **Internet Options** from the **Tools** menu, and then clicking **Security**. - -## Where did the Favorites, Command, and Status bars go? -For IE11, the UI has been changed to provide just the controls needed to support essential functionality, hiding anything considered non-essential, such as the **Favorites Bar**, **Command Bar**, **Menu Bar**, and **Status Bar**. This is intended to help focus users on the content of the page, rather than the browser itself. However, if you want these bars to appear, you can turn them back on using Group Policy settings. - - **To turn the toolbars back on** - -- Right click in the IE toolbar heading and choose to turn on the **Command bar**, **Favorites bar**, and **Status bar** from the menu. -

          -OR-

          - In IE, press ALT+V to show the View menu, press T to enter the Toolbars menu, and then press: - - - **C** to turn on the **Command Bar** - - - **F** to turn on the **Favorites Bar** - - - **S** to turn on the **Status Bar** - -## Where did the search box go? -IE11 uses the **One Box** feature, which lets users type search terms directly into the **Address bar**. Any text entered into the **Address bar** that doesn't appear to be a URL is automatically sent to the currently selected search provider. - ->[!NOTE] ->Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md). - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: Info about where features went in the IEAK11, where the Favorites, Command, and Status bars went, and where the search bar went. +author: dansimp +ms.prod: ie11 +ms.assetid: 7324faff-ccb6-4e14-ad91-af12dbca575e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: User interface problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# User interface problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Some of the features in both Internet Explorer 11 and IEAK 11 have moved around. Here are some of the more common changes. + +## Where did features go in the Internet Explorer Customization Wizard 11? +Various installation or set up choices can prevent you from seeing certain pages in the Internet Explorer Customization Wizard 11. If, after going through the entire Wizard you still haven't found the screen you were looking for, try: + +- Making sure you picked the right version of IEAK 11 during installation. Most administrators should pick the **Internal** version, which has more screens and options available. + +- Making sure you picked all of the features you wanted from the **Feature Selection** page of the IE Customization Wizard 11. If you don't pick a feature, the associated page won't appear. + +## Where are the security zone settings? +You can see your security zone settings by opening Internet Explorer for the desktop, clicking **Internet Options** from the **Tools** menu, and then clicking **Security**. + +## Where did the Favorites, Command, and Status bars go? +For IE11, the UI has been changed to provide just the controls needed to support essential functionality, hiding anything considered non-essential, such as the **Favorites Bar**, **Command Bar**, **Menu Bar**, and **Status Bar**. This is intended to help focus users on the content of the page, rather than the browser itself. However, if you want these bars to appear, you can turn them back on using Group Policy settings. + + **To turn the toolbars back on** + +- Right click in the IE toolbar heading and choose to turn on the **Command bar**, **Favorites bar**, and **Status bar** from the menu. +

          -OR-

          + In IE, press ALT+V to show the View menu, press T to enter the Toolbars menu, and then press: + + - **C** to turn on the **Command Bar** + + - **F** to turn on the **Favorites Bar** + + - **S** to turn on the **Status Bar** + +## Where did the search box go? +IE11 uses the **One Box** feature, which lets users type search terms directly into the **Address bar**. Any text entered into the **Address bar** that doesn't appear to be a URL is automatically sent to the currently selected search provider. + +> [!NOTE] +> Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md). + diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md index 2368c10f34..677f1c974a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md @@ -1,60 +1,64 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode. -author: lomayor -ms.prod: ie11 -ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using IE7 Enterprise Mode or IE8 Enterprise Mode - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode gives you a way for your legacy websites and apps to run using emulated versions of Windows Internet Explorer 7 or Windows Internet Explorer 8, while your new sites and apps run using Internet Explorer 11, including modern standards and features. - -Although it’s called IE7 Enterprise Mode, it actually turns on Enterprise Mode along with Internet Explorer 7 or Microsoft Internet Explorer 5 Compatibility View. Compatibility View chooses which document mode to use based on whether there’s a `DOCTYPE` tag in your code: - -- **DOCTYPE tag found.** Webpages render using the Internet Explorer 7 document mode. -- **No DOCTYPE tag found.** Webpages render using the Internet Explorer 5 document mode. - -**Important**
          -Because we’ve added the IE7 Enterprise Mode option, we’ve had to rename the original functionality of Enterprise Mode to be IE8 Enterprise Mode. We’ve also replaced Edge Mode with IE11 Document Mode, so you can explicitly use IE11 on Windows 10. - -## Turning on and using IE7 Enterprise Mode or IE8 Enterprise Mode -For instructions about how to add IE7 Enterprise Mode or IE8 Enterprise Mode to your webpages and apps, see: - -- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) - -- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) - -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) - -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) - -For instructions and more info about how to fix your compatibility issues using Enterprise Mode, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode. +author: dansimp +ms.prod: ie11 +ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Using IE7 Enterprise Mode or IE8 Enterprise Mode + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Enterprise Mode gives you a way for your legacy websites and apps to run using emulated versions of Windows Internet Explorer 7 or Windows Internet Explorer 8, while your new sites and apps run using Internet Explorer 11, including modern standards and features. + +Although it’s called IE7 Enterprise Mode, it actually turns on Enterprise Mode along with Internet Explorer 7 or Microsoft Internet Explorer 5 Compatibility View. Compatibility View chooses which document mode to use based on whether there’s a `DOCTYPE` tag in your code: + +- **DOCTYPE tag found.** Webpages render using the Internet Explorer 7 document mode. +- **No DOCTYPE tag found.** Webpages render using the Internet Explorer 5 document mode. + +**Important**
          +Because we’ve added the IE7 Enterprise Mode option, we’ve had to rename the original functionality of Enterprise Mode to be IE8 Enterprise Mode. We’ve also replaced Edge Mode with IE11 Document Mode, so you can explicitly use IE11 on Windows 10. + +## Turning on and using IE7 Enterprise Mode or IE8 Enterprise Mode +For instructions about how to add IE7 Enterprise Mode or IE8 Enterprise Mode to your webpages and apps, see: + +- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) + +- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) + +- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) + +- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) + +For instructions and more info about how to fix your compatibility issues using Enterprise Mode, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md index d744070926..7015595563 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md @@ -1,66 +1,70 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use IEAK 11 while planning, customizing, and building the custom installation package. -author: lomayor -ms.prod: ie11 -ms.assetid: af93742f-f955-44ab-bfa2-7bf0c99045d3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages -Internet Explorer Administration Kit 11 (IEAK 11) helps you set up, deploy, and maintain Internet Explorer 11. - -**Note**
          IEAK 11 works in network environments, with or without Microsoft Active Directory. - -  - -## Plan, Customize, and Build with the IEAK 11 -Consider these activities while planning, customizing, and building the custom installation package. - -### Plan -Before you begin, you should: - -- **Check the operating system requirements.** Check that the requirements for the computer you're building your installation package from, and the computers you're installing IE11 to, all meet the system requirements for IEAK 11 and IE11. For Internet Explorer requirements, see [System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md). For IEAK 11 requirements, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). - -- **Decide on your distribution method.** Decide how to distribute your custom installation package: Windows Update, System Center System Center 2012 R2 Configuration Manager, or your network. - -- **Gather URLs and branding and custom graphics.** Collect the URLs for your company's own **Home**, **Search**, and **Support** pages, plus any custom branding and graphic files for the browser toolbar button and the **Favorites** list icons. - -- **Identify trusted network servers.** Decide which servers your employees should use to install the custom IE package. These servers need to be listed as trusted sites. - -- **Set up automatic detection and configuration settings.** Decide whether to automatically customize IE11 the first time it's started. - -- **Identify custom components for uninstallation.** Decide whether to include any custom uninstallation programs. Uninstallation programs let your employees remove your custom components through **Uninstall or change a program** in the Control Panel. - -- **Identify ActiveX controls.** Decide if you'll use ActiveX controls in your company. If you already use ActiveX, you should get an inventory of your active controls. - -### Customize and build -After installing IE11 and the IEAK 11, you should: - -- **Prepare your build computer.** Create your build environment on the computer you're using to build the custom package. - -- **Create your branding and custom graphics.** If you don't have any, create custom branding and graphic files for the browser toolbar button and icons in your **Favorites** list. - -- **Specify your servers as trusted sites.** Identify your installation servers as trusted sites, in the **Trusted sites zone** of the **Internet Options** box. - -- **Turn on automatic detection and configuration settings (Optional).** Set up your network so that IE is automatically customized the first time it's started. - -- **Set up custom components for uninstallation.** Create the custom .inf file you'll use to register your custom uninstallation programs. - -- **Set up ActiveX controls.** Add any new ActiveX controls to the Axaa.adm file, using a text editor. - -- **Create a custom browser package.** Create your custom installation package, using IE Customization Wizard 11. For more information about using the wizard, see [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use IEAK 11 while planning, customizing, and building the custom installation package. +author: dansimp +ms.prod: ie11 +ms.assetid: af93742f-f955-44ab-bfa2-7bf0c99045d3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Internet Explorer Administration Kit 11 (IEAK 11) helps you set up, deploy, and maintain Internet Explorer 11. + +**Note**
          IEAK 11 works in network environments, with or without Microsoft Active Directory. + +  + +## Plan, Customize, and Build with the IEAK 11 +Consider these activities while planning, customizing, and building the custom installation package. + +### Plan +Before you begin, you should: + +- **Check the operating system requirements.** Check that the requirements for the computer you're building your installation package from, and the computers you're installing IE11 to, all meet the system requirements for IEAK 11 and IE11. For Internet Explorer requirements, see [System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md). For IEAK 11 requirements, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). + +- **Decide on your distribution method.** Decide how to distribute your custom installation package: Windows Update, Microsoft Endpoint Configuration Manager, or your network. + +- **Gather URLs and branding and custom graphics.** Collect the URLs for your company's own **Home**, **Search**, and **Support** pages, plus any custom branding and graphic files for the browser toolbar button and the **Favorites** list icons. + +- **Identify trusted network servers.** Decide which servers your employees should use to install the custom IE package. These servers need to be listed as trusted sites. + +- **Set up automatic detection and configuration settings.** Decide whether to automatically customize IE11 the first time it's started. + +- **Identify custom components for uninstallation.** Decide whether to include any custom uninstallation programs. Uninstallation programs let your employees remove your custom components through **Uninstall or change a program** in the Control Panel. + +- **Identify ActiveX controls.** Decide if you'll use ActiveX controls in your company. If you already use ActiveX, you should get an inventory of your active controls. + +### Customize and build +After installing IE11 and the IEAK 11, you should: + +- **Prepare your build computer.** Create your build environment on the computer you're using to build the custom package. + +- **Create your branding and custom graphics.** If you don't have any, create custom branding and graphic files for the browser toolbar button and icons in your **Favorites** list. + +- **Specify your servers as trusted sites.** Identify your installation servers as trusted sites, in the **Trusted sites zone** of the **Internet Options** box. + +- **Turn on automatic detection and configuration settings (Optional).** Set up your network so that IE is automatically customized the first time it's started. + +- **Set up custom components for uninstallation.** Create the custom .inf file you'll use to register your custom uninstallation programs. + +- **Set up ActiveX controls.** Add any new ActiveX controls to the Axaa.adm file, using a text editor. + +- **Create a custom browser package.** Create your custom installation package, using IE Customization Wizard 11. For more information about using the wizard, see [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md index a49bf820ae..afc27104af 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md @@ -1,45 +1,49 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use Setup Information (.inf) files to create installation packages. -author: lomayor -ms.prod: ie11 -ms.assetid: 04fa2ba8-8d84-4af6-ab99-77e4f1961b0e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Using Setup Information (.inf) files to create packages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using Setup Information (.inf) files to create install packages -IEAK 11 uses Setup information (.inf) files to provide uninstallation instructions. Uninstallation instructions let your employees remove components, like files, registry entries, or shortcuts, through the **Uninstall or change a program** box. For details about .inf files, see [INF File Sections and Directives](https://go.microsoft.com/fwlink/p/?LinkId=327959). - - **To add uninstallation instructions to the .inf files** - -- Open the Registry Editor (regedit.exe) and add these registry keys: - ``` - HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description" - HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString",,"command-line" - ``` - Where **"description"** is the name that shows up in the **Uninstall or change a program** box and **"command-line"** is the command that runs after the component is picked. -

          Note
          - Make sure your script removes the uninstallation registry key, too. Otherwise, the component name will continue to show up in the Uninstall or change a program. - -## Limitations -.Inf files have limitations: - -- You can't delete directories. - -- You can't use **RenFiles** to move a file to a different location, it only lets you rename a file in its existing location. For detailed information, see [INF RenFiles Directive](https://go.microsoft.com/fwlink/p/?LinkId=298508). - -- You can't use **CopyFiles** to copy a file to another place on your hard drive, it can only copy files from the source disk to the destination directory. For information, see [INF CopyFiles Directive](https://go.microsoft.com/fwlink/p/?LinkId=298510). - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use Setup Information (.inf) files to create installation packages. +author: dansimp +ms.prod: ie11 +ms.assetid: 04fa2ba8-8d84-4af6-ab99-77e4f1961b0e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Using Setup Information (.inf) files to create packages (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Using Setup Information (.inf) files to create install packages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +IEAK 11 uses Setup information (.inf) files to provide uninstallation instructions. Uninstallation instructions let your employees remove components, like files, registry entries, or shortcuts, through the **Uninstall or change a program** box. For details about .inf files, see [INF File Sections and Directives](https://go.microsoft.com/fwlink/p/?LinkId=327959). + + **To add uninstallation instructions to the .inf files** + +- Open the Registry Editor (regedit.exe) and add these registry keys: + ``` + HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description" + HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString",,"command-line" + ``` + Where **"description"** is the name that shows up in the **Uninstall or change a program** box and **"command-line"** is the command that runs after the component is picked. +

          Note
          + Make sure your script removes the uninstallation registry key, too. Otherwise, the component name will continue to show up in the Uninstall or change a program. + +## Limitations +.Inf files have limitations: + +- You can't delete directories. + +- You can't use **RenFiles** to move a file to a different location, it only lets you rename a file in its existing location. For detailed information, see [INF RenFiles Directive](https://go.microsoft.com/fwlink/p/?LinkId=298508). + +- You can't use **CopyFiles** to copy a file to another place on your hard drive, it can only copy files from the source disk to the destination directory. For information, see [INF CopyFiles Directive](https://go.microsoft.com/fwlink/p/?LinkId=298510). + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md index 5c7c0a3d23..a31c831abd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md @@ -1,70 +1,74 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal. -author: lomayor -ms.prod: ie11 -title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# Verify your changes using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - ->[!Important] ->This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. - -The Requester successfully submits a change request to the Enterprise Mode Site List Portal and then gets an email, including: - -- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. - -- **Test steps**. The suggested steps about how to test the change request details to make sure they're accurate in the pre-production environment. - -- **EMIE_Reset**. A batch file that when run, reverts the changes made to the pre-production registry. - -## Verify and send the change request to Approvers -The Requester tests the changes and then goes back into the Enterprise Mode Site List Portal, **Pre-production verification** page to verify whether the testing was successful. - -**To verify changes and send to the Approver(s)** -1. On the **Pre-production verification** page, the Requester clicks **Successful** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. - -2. The Requester reviews the pre-defined Approver(s), and then clicks **Send for approval**. - - The Requester, the Approver group, and the Administrator group all get an email, stating that the change request is waiting for approval. - - -**To rollback your pre-production changes** -1. On the **Pre-production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. - -2. Add a description about the issue into the **Issue description** box, and then click **Send failure details**. - - The change request and issue info are sent to the Administrators. - -3. The Requester clicks **Roll back** to roll back the changes in the pre-production environment. - - After the Requester rolls back the changes, the request can be updated and re-submitted. - - -## View rolled back change requests -The original Requester and the Administrator(s) group can view the rolled back change requests. - -**To view the rolled back change request** - -- In the Enterprise Mode Site List Portal, click **Rolled back** from the left pane. - - All rolled back change requests appear, with role assignment determining which ones are visible. - -## Next steps -If the change request is certified as successful, the Requester must next send it to the Approvers for approval. For the Approver-related steps, see the [Approve a change request using the Enterprise Mode Site List Portal](approve-change-request-enterprise-mode-portal.md) topic. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Verify your changes using the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +> [!Important] +> This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. + +The Requester successfully submits a change request to the Enterprise Mode Site List Portal and then gets an email, including: + +- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. + +- **Test steps**. The suggested steps about how to test the change request details to make sure they're accurate in the pre-production environment. + +- **EMIE_Reset**. A batch file that when run, reverts the changes made to the pre-production registry. + +## Verify and send the change request to Approvers +The Requester tests the changes and then goes back into the Enterprise Mode Site List Portal, **Pre-production verification** page to verify whether the testing was successful. + +**To verify changes and send to the Approver(s)** +1. On the **Pre-production verification** page, the Requester clicks **Successful** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. + +2. The Requester reviews the pre-defined Approver(s), and then clicks **Send for approval**. + + The Requester, the Approver group, and the Administrator group all get an email, stating that the change request is waiting for approval. + + +**To rollback your pre-production changes** +1. On the **Pre-production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. + +2. Add a description about the issue into the **Issue description** box, and then click **Send failure details**. + + The change request and issue info are sent to the Administrators. + +3. The Requester clicks **Roll back** to roll back the changes in the pre-production environment. + + After the Requester rolls back the changes, the request can be updated and re-submitted. + + +## View rolled back change requests +The original Requester and the Administrator(s) group can view the rolled back change requests. + +**To view the rolled back change request** + +- In the Enterprise Mode Site List Portal, click **Rolled back** from the left pane. + + All rolled back change requests appear, with role assignment determining which ones are visible. + +## Next steps +If the change request is certified as successful, the Requester must next send it to the Approvers for approval. For the Approver-related steps, see the [Approve a change request using the Enterprise Mode Site List Portal](approve-change-request-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md index 5678e10583..1ccd3e4d0c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md @@ -1,45 +1,49 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal. -author: lomayor -ms.prod: ie11 -title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# Verify the change request update in the production environment using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -## Verify and sign off on the update in the production environment -The Requester tests the changes in the production environment and then goes back into the Enterprise Mode Site List Portal, **Production verification** page to verify whether the testing was successful. - -**To verify the changes and sign off** -- On the **Production verification** page, the Requester clicks **Successful**, optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results, optionally includes a description of the change, and then clicks **Sign off**. - - The Requester, Approver group, and Administrator group all get an email, stating that the change request has been signed off. - - -**To rollback production changes** -1. On the **Production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results. - -2. Add a description about the issue into the **Change description** box, and then click **Send failure details**. - - The info is sent to the Administrators. - -3. The Requester clicks **Roll back** to roll back the changes in the production environment. - - After the Requester rolls back the changes, the request is automatically handled in the production and pre-production environment site lists. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Verify the change request update in the production environment using the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +## Verify and sign off on the update in the production environment +The Requester tests the changes in the production environment and then goes back into the Enterprise Mode Site List Portal, **Production verification** page to verify whether the testing was successful. + +**To verify the changes and sign off** +- On the **Production verification** page, the Requester clicks **Successful**, optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results, optionally includes a description of the change, and then clicks **Sign off**. + + The Requester, Approver group, and Administrator group all get an email, stating that the change request has been signed off. + + +**To rollback production changes** +1. On the **Production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results. + +2. Add a description about the issue into the **Change description** box, and then click **Send failure details**. + + The info is sent to the Administrators. + +3. The Requester clicks **Roll back** to roll back the changes in the production environment. + + After the Requester rolls back the changes, the request is automatically handled in the production and pre-production environment site lists. + diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md index 3c60851368..9aa736bacb 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md @@ -1,41 +1,45 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal. -author: lomayor -ms.prod: ie11 -title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Any employee with access to the Enterprise Mode Site List Portal can view the apps included in the current Enterprise Mode Site List. - -**To view the active Enterprise Mode Site List** -1. Open the Enterprise Mode Site List Portal and click the **Production sites list** icon in the upper-right area of the page. - - The **Production sites list** page appears, with each app showing its URL, the compatibility mode to use, and the assigned browser to open the site. - -2. Click any URL to view the actual site, using the compatibility mode and opening in the correct browser. - - -**To export the active Enterprise Mode Site List** -1. On the **Production sites list** page, click **Export**. - -2. Save the ProductionSiteList.xlsx file. - - The Excel file includes all apps in the current Enterprise Mode Site List, including URL, compatibility mode, and assigned browser. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Any employee with access to the Enterprise Mode Site List Portal can view the apps included in the current Enterprise Mode Site List. + +**To view the active Enterprise Mode Site List** +1. Open the Enterprise Mode Site List Portal and click the **Production sites list** icon in the upper-right area of the page. + + The **Production sites list** page appears, with each app showing its URL, the compatibility mode to use, and the assigned browser to open the site. + +2. Click any URL to view the actual site, using the compatibility mode and opening in the correct browser. + + +**To export the active Enterprise Mode Site List** +1. On the **Production sites list** page, click **Export**. + +2. Save the ProductionSiteList.xlsx file. + + The Excel file includes all apps in the current Enterprise Mode Site List, including URL, compatibility mode, and assigned browser. diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md index 30db2d2faa..f2db72080d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md @@ -1,53 +1,57 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how an Administrator can view the available Enterprise Mode reports from the Enterprise Mode Site List Portal. -author: lomayor -ms.prod: ie11 -title: View the available Enterprise Mode reports from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - -# View the available Enterprise Mode reports from the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Administrators can view the Microsoft-provided Enterprise Mode reports from the Enterprise Mode Site List Portal. - -**To view the reports** -1. Open the Enterprise Mode Site List Portal and click the **Enterprise Mode reports** icon in the upper-right area of the page. - - The **Enterprise Mode reports** page appears, with each app showing its URL, the compatibility mode to use, and the assigned browser to open the site. - -2. Use the calendars to provide the **From date** and **To date**, determining the span of time the report covers. - -3. Click **Apply**. - - The reports all change to reflect the appropriate timeframe and group, including: - - - **Total number of websites in the site list.** A box at the top of the reports page that tells you the total number of websites included in the Enterprise Mode Sit List. - - - **All websites by docmode.** Shows how many change requests exist, based on the different doc modes included in the **App best viewed in** field. - - - **All websites by browser.** Shows how many apps require which browser, including **IE11**, **MSEdge**, or **None**. - - - **All requests by status.** Shows how many change requests exist, based on each status. - - - **All requests by change type.** Shows how many change requests exist, based on the **Requested change** field. - - - **Request status by group.** Shows how many change requests exist, based on both group and status. - - - **Reasons for request.** Shows how many change request reasons exist, based on the **Reason for request** field. - - - **Requested changes by app name.** Shows what specific apps were **Added to site list**, **Deleted from site list**, or **Updated from site list**. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how an Administrator can view the available Enterprise Mode reports from the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: View the available Enterprise Mode reports from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# View the available Enterprise Mode reports from the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Administrators can view the Microsoft-provided Enterprise Mode reports from the Enterprise Mode Site List Portal. + +**To view the reports** +1. Open the Enterprise Mode Site List Portal and click the **Enterprise Mode reports** icon in the upper-right area of the page. + + The **Enterprise Mode reports** page appears, with each app showing its URL, the compatibility mode to use, and the assigned browser to open the site. + +2. Use the calendars to provide the **From date** and **To date**, determining the span of time the report covers. + +3. Click **Apply**. + + The reports all change to reflect the appropriate timeframe and group, including: + + - **Total number of websites in the site list.** A box at the top of the reports page that tells you the total number of websites included in the Enterprise Mode Sit List. + + - **All websites by docmode.** Shows how many change requests exist, based on the different doc modes included in the **App best viewed in** field. + + - **All websites by browser.** Shows how many apps require which browser, including **IE11**, **MSEdge**, or **None**. + + - **All requests by status.** Shows how many change requests exist, based on each status. + + - **All requests by change type.** Shows how many change requests exist, based on the **Requested change** field. + + - **Request status by group.** Shows how many change requests exist, based on both group and status. + + - **Reasons for request.** Shows how many change request reasons exist, based on the **Reason for request** field. + + - **Requested changes by app name.** Shows what specific apps were **Added to site list**, **Deleted from site list**, or **Updated from site list**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md index e83c91bf67..771f7b3439 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md @@ -1,36 +1,40 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: virtualization -description: Virtualization and compatibility with Internet Explorer 11 -author: lomayor -ms.prod: ie11 -ms.assetid: b0388c04-2584-4b6d-a7a8-4e0476773a80 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Virtualization and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Virtualization and compatibility with Internet Explorer 11 -If your company is considering upgrading to the latest version of Internet Explorer, but is hesitant because of a large number of web apps that need to be tested and moved, we recommend that you consider virtualization. Virtualization lets you set up a virtual environment where you can run earlier versions of IE. - -**Important**
          -We strongly suggest that while you're using virtualization, you also update your web apps so they run natively in the newer version of IE. For more information about how to update your code, see the [Internet Explorer 11 Compatibility Cookbook (Windows)](https://go.microsoft.com/fwlink/p/?LinkId=279707) to learn about the developer features that have been changed or deprecated since Internet Explorer 10. - -The Microsoft-supported options for virtualizing web apps are: - -- **Microsoft Enterprise Desktop Virtualization (MED-V).** Uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. For more information, see [MED-V](https://go.microsoft.com/fwlink/p/?LinkId=271653). - -- **Client Hyper-V.** Uses the same virtualization technology previously available in Windows Server, but now installed for Windows 8.1. For more information, see [Client Hyper-V](https://go.microsoft.com/fwlink/p/?LinkId=271654).

          -For more information about virtualization options, see [Microsoft Desktop Virtualization](https://go.microsoft.com/fwlink/p/?LinkId=271662). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: virtualization +description: Virtualization and compatibility with Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: b0388c04-2584-4b6d-a7a8-4e0476773a80 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Virtualization and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Virtualization and compatibility with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +If your company is considering upgrading to the latest version of Internet Explorer, but is hesitant because of a large number of web apps that need to be tested and moved, we recommend that you consider virtualization. Virtualization lets you set up a virtual environment where you can run earlier versions of IE. + +**Important**
          +We strongly suggest that while you're using virtualization, you also update your web apps so they run natively in the newer version of IE. For more information about how to update your code, see the [Internet Explorer 11 Compatibility Cookbook (Windows)](https://go.microsoft.com/fwlink/p/?LinkId=279707) to learn about the developer features that have been changed or deprecated since Internet Explorer 10. + +The Microsoft-supported options for virtualizing web apps are: + +- **Microsoft Enterprise Desktop Virtualization (MED-V).** Uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. For more information, see [MED-V](https://go.microsoft.com/fwlink/p/?LinkId=271653). + +- **Client Hyper-V.** Uses the same virtualization technology previously available in Windows Server, but now installed for Windows 8.1. For more information, see [Client Hyper-V](https://go.microsoft.com/fwlink/p/?LinkId=271654).

          +For more information about virtualization options, see [Microsoft Desktop Virtualization](https://go.microsoft.com/fwlink/p/?LinkId=271662). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md index 0212685d25..b9fb67f961 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md @@ -1,168 +1,175 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Info about the features included in Enterprise Mode with Internet Explorer 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 3c77e9f3-eb21-46d9-b5aa-f9b2341cfefa -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Enterprise Mode and the Enterprise Mode Site List (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/25/2018 ---- - - -# Enterprise Mode and the Enterprise Mode Site List - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Internet Explorer and Microsoft Edge can work together to support your legacy web apps, while still defaulting to the higher bar for security and modern experiences enabled by Microsoft Edge. Working with multiple browsers can be difficult, particularly if you have a substantial number of internal sites. To help manage this dual-browser experience, we are introducing a new web tool specifically targeted towards larger organizations: the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). - -## Available dual-browser experiences -If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. - -Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. - ->[!TIP] -> If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. - -For Windows 10 and Windows 10 Mobile, Microsoft Edge is the default browser experience. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. - - -## What is Enterprise Mode? -Enterprise Mode, a compatibility mode that runs on Internet Explorer 11 on Windows 10, Windows 8.1, and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8. Running in this mode helps to avoid many of the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -Many customers identify web app compatibility as a significant cost to upgrading because web apps need to be tested and upgraded before adopting a new browser. The improved compatibility provided by Enterprise Mode can help give customers confidence to upgrade to IE11, letting customers benefit from modern web standards, increased performance, improved security, and better reliability. - -### Enterprise Mode features -Enterprise Mode includes the following features: - -- **Improved web app and website compatibility.** Through improved emulation, Enterprise Mode lets many legacy web apps run unmodified on IE11, supporting several site patterns that aren’t currently supported by existing document modes. - -- **Tool-based management for website lists.** Use the Enterprise Mode Site List Manager to add website domains and domain paths and to specify whether a site renders using Enterprise Mode. -Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378), based on your operating system and schema. - -- **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools. - - >[!Important] - >All centrally-made decisions override any locally-made choices. - -- **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites. - -- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. - -## Enterprise Mode and the Enterprise Mode Site List XML file -The Enterprise Mode Site List is an XML document that specifies a list of sites, their compat mode, and their intended browser. Using [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853), you can automatically start a webpage using a specific browser. In the case of IE11, the webpage can also be launched in a specific compat mode, so it always renders correctly. Your employees can easily view this site list by typing _about:compat_ in either Microsoft Edge or IE11. - -Starting with Windows 10, version 1511 (also known as the Anniversary Update), you can also [restrict IE11 to only the legacy web apps that need it](https://blogs.windows.com/msedgedev/2016/05/19/edge14-ie11-better-together/), automatically sending sites not included in the Enterprise Mode Site List to Microsoft Edge. - -### Site list xml file -This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypflug/9e9961de771d2fcbd86b#file-emie-v2-schema-xml). There are equivalent Enterprise Mode Site List policies for both [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility) and [Internet Explorer 11](turn-on-enterprise-mode-and-use-a-site-list.md). The Microsoft Edge list is used to determine which sites should open in IE11; while the IE11 list is used to determine the compat mode for a site, and which sites should open in Microsoft Edge. We recommend using one list for both browsers, where each policy points to the same XML file location. - -```xml - - - - EnterpriseSiteListManager - 10586 - 20150728.135021 - - - - IE8Enterprise - IE11 - - - default - IE11 - - - IE7Enterprise - IE11 - - - - - IE8Enterprise" - IE11 - - - IE7 - IE11 - - - IE7 - IE11 - - - -``` - -## Enterprise Mode Site List Manager and the Enterprise Mode Site List Portal tools -You can build and manage your Enterprise Mode Site List is by using any generic text editor. However, we’ve also provided a couple tools that can make that process even easier. - -### Enterprise Mode Site List Manager -This tool helps you create error-free XML documents with simple n+1 versioning and URL verification. We recommend using this tool if your site list is relatively small. For more info about this tool, see the Use the [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - -There are 2 versions of this tool, both supported on Windows 7, Windows 8.1, and Windows 10: - -- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501). This is an older version of the schema that you must use if you want to create and update your Enterprise Mode Site List for devices running the v.1 version of the schema. - - We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974). The updated version of the schema, including new functionality. You can use this version of the schema to create and update your Enterprise Mode Site List for devices running the v.2 version of the schema. - - If you open a v.1 version of your Enterprise Mode Site List using this version, it will update the schema to v.2, automatically. For more info, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -If your list is too large to add individual sites, or if you have more than one person managing the site list, we recommend using the Enterprise Site List Portal. - -### Enterprise Mode Site List Portal -The [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. - -In addition to all the functionality of the Enterprise Mode Site List Manager tool, the Enterprise Mode Site List Portal helps you: - -- Manage site lists from any device supporting Windows 7 or greater. - -- Submit change requests. - -- Operate offline through an on-premise solution. - -- Provide role-based governance. - -- Test configuration settings before releasing to a live environment. - -Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -Because the tool is open-source, the source code is readily available for examination and experimentation. We encourage you to [fork the code, submit pull requests, and send us your feedback](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal)! For more info about the Enterprise Mode Site List Portal, see the [Use the Enterprise Mode Site List Portal](use-the-enterprise-mode-portal.md) topics. - -## Related topics - -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Technical guidance, tools, and resources on Enterprise browsing](https://technet.microsoft.com/ie) - -- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501) - -- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974) - -- [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - -- [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) - -- [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) - -- [Microsoft Services Support](https://www.microsoft.com/en-us/microsoftservices/support.aspx) - -- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Info about the features included in Enterprise Mode with Internet Explorer 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 3c77e9f3-eb21-46d9-b5aa-f9b2341cfefa +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Enterprise Mode and the Enterprise Mode Site List (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 10/25/2018 +--- + + +# Enterprise Mode and the Enterprise Mode Site List + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Internet Explorer and Microsoft Edge can work together to support your legacy web apps, while still defaulting to the higher bar for security and modern experiences enabled by Microsoft Edge. Working with multiple browsers can be difficult, particularly if you have a substantial number of internal sites. To help manage this dual-browser experience, we are introducing a new web tool specifically targeted towards larger organizations: the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). + +## Available dual-browser experiences +If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. + +Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. + +> [!TIP] +> If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. + +For Windows 10 and Windows 10 Mobile, Microsoft Edge is the default browser experience. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. + + +## What is Enterprise Mode? +Enterprise Mode, a compatibility mode that runs on Internet Explorer 11 on Windows 10, Windows 8.1, and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8. Running in this mode helps to avoid many of the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. + +Many customers identify web app compatibility as a significant cost to upgrading because web apps need to be tested and upgraded before adopting a new browser. The improved compatibility provided by Enterprise Mode can help give customers confidence to upgrade to IE11, letting customers benefit from modern web standards, increased performance, improved security, and better reliability. + +### Enterprise Mode features +Enterprise Mode includes the following features: + +- **Improved web app and website compatibility.** Through improved emulation, Enterprise Mode lets many legacy web apps run unmodified on IE11, supporting several site patterns that aren’t currently supported by existing document modes. + +- **Tool-based management for website lists.** Use the Enterprise Mode Site List Manager to add website domains and domain paths and to specify whether a site renders using Enterprise Mode. +Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378), based on your operating system and schema. + +- **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools. + + > [!Important] + > All centrally-made decisions override any locally-made choices. + +- **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites. + +- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. + +## Enterprise Mode and the Enterprise Mode Site List + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + XML file +The Enterprise Mode Site List is an XML document that specifies a list of sites, their compat mode, and their intended browser. Using [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853), you can automatically start a webpage using a specific browser. In the case of IE11, the webpage can also be launched in a specific compat mode, so it always renders correctly. Your employees can easily view this site list by typing _about:compat_ in either Microsoft Edge or IE11. + +Starting with Windows 10, version 1511 (also known as the Anniversary Update), you can also [restrict IE11 to only the legacy web apps that need it](https://blogs.windows.com/msedgedev/2016/05/19/edge14-ie11-better-together/), automatically sending sites not included in the Enterprise Mode Site List to Microsoft Edge. + +### Site list xml file +This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypflug/9e9961de771d2fcbd86b#file-emie-v2-schema-xml). There are equivalent Enterprise Mode Site List policies for both [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility) and [Internet Explorer 11](turn-on-enterprise-mode-and-use-a-site-list.md). The Microsoft Edge list is used to determine which sites should open in IE11; while the IE11 list is used to determine the compat mode for a site, and which sites should open in Microsoft Edge. We recommend using one list for both browsers, where each policy points to the same XML file location. + +```xml + + + + EnterpriseSiteListManager + 10586 + 20150728.135021 + + + + IE8Enterprise + IE11 + + + Default + IE11 + + + IE7Enterprise + IE11 + + + + + IE8Enterprise" + IE11 + + + IE7 + IE11 + + + IE7 + IE11 + + + +``` + +## Enterprise Mode Site List Manager and the Enterprise Mode Site List Portal tools +You can build and manage your Enterprise Mode Site List is by using any generic text editor. However, we’ve also provided a couple tools that can make that process even easier. + +### Enterprise Mode Site List Manager +This tool helps you create error-free XML documents with simple n+1 versioning and URL verification. We recommend using this tool if your site list is relatively small. For more info about this tool, see the Use the [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. + +There are 2 versions of this tool, both supported on Windows 7, Windows 8.1, and Windows 10: + +- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501). This is an older version of the schema that you must use if you want to create and update your Enterprise Mode Site List for devices running the v.1 version of the schema. + + We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). + +- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974). The updated version of the schema, including new functionality. You can use this version of the schema to create and update your Enterprise Mode Site List for devices running the v.2 version of the schema. + + If you open a v.1 version of your Enterprise Mode Site List using this version, it will update the schema to v.2, automatically. For more info, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +If your list is too large to add individual sites, or if you have more than one person managing the site list, we recommend using the Enterprise Site List Portal. + +### Enterprise Mode Site List Portal +The [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. + +In addition to all the functionality of the Enterprise Mode Site List Manager tool, the Enterprise Mode Site List Portal helps you: + +- Manage site lists from any device supporting Windows 7 or greater. + +- Submit change requests. + +- Operate offline through an on-premise solution. + +- Provide role-based governance. + +- Test configuration settings before releasing to a live environment. + +Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. + +Because the tool is open-source, the source code is readily available for examination and experimentation. We encourage you to [fork the code, submit pull requests, and send us your feedback](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal)! For more info about the Enterprise Mode Site List Portal, see the [Use the Enterprise Mode Site List Portal](use-the-enterprise-mode-portal.md) topics. + +## Related topics + +- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) + +- [Technical guidance, tools, and resources on Enterprise browsing](https://technet.microsoft.com/ie) + +- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501) + +- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974) + +- [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) + +- [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) + +- [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) + +- [Microsoft Services Support](https://www.microsoft.com/microsoftservices/support.aspx) + +- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md index 2343973365..1fd67f656b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md @@ -1,152 +1,156 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: How to download and use the Internet Explorer 11 Blocker Toolkit to turn off the automatic delivery of IE11 through the Automatic Updates feature of Windows Update. -author: lomayor -ms.author: lomayor -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: fafeaaee-171c-4450-99f7-5cc7f8d7ba91 -ms.reviewer: -audience: itpro manager: dansimp -title: What is the Internet Explorer 11 Blocker Toolkit? (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 05/10/2018 ---- - - -# What is the Internet Explorer 11 Blocker Toolkit? - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The Internet Explorer 11 Blocker Toolkit lets you turn off the automatic delivery of IE11 through the **Automatic Updates** feature of Windows Update. - ->[!IMPORTANT] ->The IE11 Blocker Toolkit does not stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you have installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11. - -## Install the toolkit - -1. Download the IE11 Blocker Toolkit from [Toolkit to Disable Automatic Delivery of Internet Explorer 11](https://go.microsoft.com/fwlink/p/?LinkId=327745). - -2. Accept the license agreement and store the included four files on your local computer. - -3. Start an elevated Command Prompt by going to **Start**>**All Programs**>**Accessories**> right-clicking on **Command Prompt**, and then choosing **Run as Administrator**. - -4. In the Command Prompt, change to the location where you put the 4 files. - -5. In the Command Prompt, type `ie11_blocker.cmd /B` and press Enter.

          -Wait for the message, **Blocking deployment of IE11 on the local machine. The operation completed successfully.** - -6. Close the Command Prompt. - -For answers to frequently asked questions, see [Internet Explorer 11 Blocker Toolkit: Frequently Asked Questions](https://go.microsoft.com/fwlink/p/?LinkId=314063). - -## Automatic updates -Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. - -### Automatic delivery process -Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11 to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their current version of Internet Explorer. - -Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel.  - -### Internet Explorer 11 automatic upgrades - -Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11. - -Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update. - -### Options for blocking automatic delivery - -If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following: - -- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). - - >[!NOTE] - >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11). - -- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit. - ->[!NOTE] ->If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. - - -### Prevent automatic installation of Internet Explorer 11 with WSUS - -Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to: - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click **Edit.** - - >[!NOTE] - >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - - >[!NOTE] - >The properties for this rule will resemble the following:

          • When an update is in Update Rollups
          • Approve the update for all computers
          - -6. Clear the **Update Rollup** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box. - -After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed. - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Synchronizations**. - -3. Click **Synchronize Now**. - -4. Expand *ComputerName*, expand **Updates**, and then click **All Updates**. - -5. Choose **Unapproved** in the **Approval**drop down box. - -6. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update. - ->[!NOTE] ->There may be multiple updates, depending on the imported language and operating system updates. - -### Optional - Reset update rollups packages to auto-approve - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves updates of different classifications, and then click **Edit**. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - -6. Check the **Update Rollups** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box. - ->[!NOTE] ->Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved. - - - -## Additional resources - -- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) - -- [Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions](../ie11-faq/faq-ie11-blocker-toolkit.md) - -- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) - -- [Internet Explorer 11 delivery through automatic updates](ie11-delivery-through-automatic-updates.md) - -- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +ms.pagetype: security +description: How to download and use the Internet Explorer 11 Blocker Toolkit to turn off the automatic delivery of IE11 through the Automatic Updates feature of Windows Update. +author: dansimp +ms.author: dansimp +ms.manager: elizapo +ms.prod: ie11 +ms.assetid: fafeaaee-171c-4450-99f7-5cc7f8d7ba91 +ms.reviewer: +audience: itpro +manager: dansimp +title: What is the Internet Explorer 11 Blocker Toolkit? (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 05/10/2018 +--- + + +# What is the Internet Explorer 11 Blocker Toolkit? + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +The Internet Explorer 11 Blocker Toolkit lets you turn off the automatic delivery of IE11 through the **Automatic Updates** feature of Windows Update. + +> [!IMPORTANT] +> The IE11 Blocker Toolkit does not stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you have installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11. + +## Install the toolkit + +1. Download the IE11 Blocker Toolkit from [Toolkit to Disable Automatic Delivery of Internet Explorer 11](https://go.microsoft.com/fwlink/p/?LinkId=327745). + +2. Accept the license agreement and store the included four files on your local computer. + +3. Start an elevated Command Prompt by going to **Start**>**All Programs**>**Accessories**> right-clicking on **Command Prompt**, and then choosing **Run as Administrator**. + +4. In the Command Prompt, change to the location where you put the 4 files. + +5. In the Command Prompt, type `ie11_blocker.cmd /B` and press Enter.

          +Wait for the message, **Blocking deployment of IE11 on the local machine. The operation completed successfully.** + +6. Close the Command Prompt. + +For answers to frequently asked questions, see [Internet Explorer 11 Blocker Toolkit: Frequently Asked Questions](https://go.microsoft.com/fwlink/p/?LinkId=314063). + +## Automatic updates +Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. + +### Automatic delivery process +Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11 to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their current version of Internet Explorer. + +Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel.  + +### Internet Explorer 11 automatic upgrades + +Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11. + +Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update. + +### Options for blocking automatic delivery + +If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following: + +- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). + + > [!NOTE] + >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11). + +- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit. + +> [!NOTE] +> If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. + + +### Prevent automatic installation of Internet Explorer 11 with WSUS + +Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to: + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Options**. + +3. Click **Automatic Approvals**. + +4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click **Edit.** + + > [!NOTE] + > If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else. + +5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. + + > [!NOTE] + > The properties for this rule will resemble the following:

          • When an update is in Update Rollups
          • Approve the update for all computers
          + +6. Clear the **Update Rollup** check box, and then click **OK**. + +7. Click **OK** to close the **Automatic Approvals** dialog box. + +After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed. + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Synchronizations**. + +3. Click **Synchronize Now**. + +4. Expand *ComputerName*, expand **Updates**, and then click **All Updates**. + +5. Choose **Unapproved** in the **Approval**drop down box. + +6. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update. + +> [!NOTE] +> There may be multiple updates, depending on the imported language and operating system updates. + +### Optional - Reset update rollups packages to auto-approve + +1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. + +2. Expand *ComputerName*, and then click **Options**. + +3. Click **Automatic Approvals**. + +4. Click the rule that automatically approves updates of different classifications, and then click **Edit**. + +5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. + +6. Check the **Update Rollups** check box, and then click **OK**. + +7. Click **OK** to close the **Automatic Approvals** dialog box. + +> [!NOTE] +> Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved. + + + +## Additional resources + +- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) + +- [Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions](../ie11-faq/faq-ie11-blocker-toolkit.md) + +- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) + +- [Internet Explorer 11 delivery through automatic updates](ie11-delivery-through-automatic-updates.md) + +- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) diff --git a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md index e9ee67796d..dd8e3bcce6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md @@ -1,46 +1,50 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn how to perform all of the workflow-related processes in the Enterprise Mode Site List Portal. -author: lomayor -ms.prod: ie11 -title: Workflow-based processes for employees using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor ---- - - -# Workflow-based processes for employees using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to perform the available Enterprise Mode Site List Portal processes, based on workflow. - -## In this section -|Topic |Description | -|---------------------------------------------------------------|-----------------------------------------------------------------------------------| -|[Create a change request using the Enterprise Mode Site List Portal](create-change-request-enterprise-mode-portal.md)|Details about how the Requester creates a change request in the Enterprise Mode Site List Portal.| -|[Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md)|Details about how the Requester tests a change request in the pre-production environment of the Enterprise Mode Site List Portal.| -|[Approve a change request using the Enterprise Mode Site List Portal](approve-change-request-enterprise-mode-portal.md)|Details about how the Approver(s) approve a change request in the Enterprise Mode Site List Portal.| -|[Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md)|Details about how the Requester schedules the approved change request update in the Enterprise Mode Site List Portal.| -|[Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md)|Details about how the Requester tests an update in the production environment of the Enterprise Mode Site List Portal.| -|[View the apps currently on the Enterprise Mode Site List](view-apps-enterprise-mode-site-list.md)|Details about how anyone with access to the portal can review the apps already on the active Enterprise Mode Site List.| -|[View the available Enterprise Mode reports from the Enterprise Mode Site List Portal](view-enterprise-mode-reports-for-portal.md) |Details about how the Administrator can view the view the Microsoft-provided Enterprise Mode reports from the Enterprise Mode Site List Portal. | - - -## Related topics -- [Set up the Enterprise Mode Site List Portal](set-up-enterprise-mode-portal.md) - -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Use the topics in this section to learn how to perform all of the workflow-related processes in the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Workflow-based processes for employees using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + + +# Workflow-based processes for employees using the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Use the topics in this section to learn how to perform the available Enterprise Mode Site List Portal processes, based on workflow. + +## In this section +|Topic |Description | +|---------------------------------------------------------------|-----------------------------------------------------------------------------------| +|[Create a change request using the Enterprise Mode Site List Portal](create-change-request-enterprise-mode-portal.md)|Details about how the Requester creates a change request in the Enterprise Mode Site List Portal.| +|[Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md)|Details about how the Requester tests a change request in the pre-production environment of the Enterprise Mode Site List Portal.| +|[Approve a change request using the Enterprise Mode Site List Portal](approve-change-request-enterprise-mode-portal.md)|Details about how the Approver(s) approve a change request in the Enterprise Mode Site List Portal.| +|[Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md)|Details about how the Requester schedules the approved change request update in the Enterprise Mode Site List Portal.| +|[Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md)|Details about how the Requester tests an update in the production environment of the Enterprise Mode Site List Portal.| +|[View the apps currently on the Enterprise Mode Site List](view-apps-enterprise-mode-site-list.md)|Details about how anyone with access to the portal can review the apps already on the active Enterprise Mode Site List.| +|[View the available Enterprise Mode reports from the Enterprise Mode Site List Portal](view-enterprise-mode-reports-for-portal.md) |Details about how the Administrator can view the view the Microsoft-provided Enterprise Mode reports from the Enterprise Mode Site List Portal. | + + +## Related topics +- [Set up the Enterprise Mode Site List Portal](set-up-enterprise-mode-portal.md) + +- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) + +- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md index 9230c868d0..c27e670fd6 100644 --- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md +++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md @@ -1,203 +1,207 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: explore -description: Frequently asked questions about Internet Explorer 11 for IT Pros -author: lomayor -ms.prod: ie11 -ms.assetid: 140e7d33-584a-44da-8c68-6c1d568e1de3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Internet Explorer 11 - FAQ for IT Pros (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/16/2017 ---- - - -# Internet Explorer 11 - FAQ for IT Pros -Answering frequently asked questions about Internet Explorer 11 (IE11) features, operating system support, integration with the Windows operating system, Group Policy, and general configuration. - -## Frequently Asked Questions - -**Q: What operating system does IE11 run on?** - -- Windows 10 - -- Windows 8.1 - -- Windows Server 2012 R2 - -- Windows 7 with Service Pack 1 (SP1) - -- Windows Server 2008 R2 with Service Pack 1 (SP1) - - -**Q: How do I install IE11 on Windows 10, Windows 8.1, or Windows Server 2012 R2?**
          -IE11 is preinstalled with Windows 8.1 and Windows Server 2012 R2. No additional action is required. - -**Q: How do I install IE11 on Windows 7 with SP1 or Windows Server 2008 R2 with SP1?**
          -You can install IE11 on computers running either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. To download IE11, see the IE11 [home page](https://go.microsoft.com/fwlink/p/?LinkId=290956). - -**Q: How does IE11 integrate with Windows 8.1?**
          -IE11 is the default handler for the HTTP and HTTPS protocols and the default browser for Windows 8.1. There are two experiences in Windows 8.1: Internet Explorer and Internet Explorer for the desktop. IE is the default browser for touch-first, immersive experiences. Internet Explorer for the desktop provides a more traditional window and tab management experience. The underlying platform of IE11 is fully interoperable across both IE and the familiar Internet Explorer for the desktop, letting developers write the same markup for both experiences. - -**Q: What are the new or improved security features?**
          -IE11 offers improvements to Enhanced Protected Mode, password manager, and other security features. IE11 also turns on Transport Layer Security (TLS) 1.2 by default. - -**Q: How is Microsoft supporting modern web standards, such as WebGL?**
          -Microsoft is committed to providing an interoperable web by supporting modern web standards. Doing this lets developers use the same markup across web browsers, helping to reduce development and support costs.

          -Supported web standards include: - -- Web Graphics Library (WebGL) - -- Canvas 2D L2 extensions, including image smoothing using the nearest neighbor, dashed lines, and fill rules - -- Fullscreen API - -- Encrypted media extensions - -- Media source extensions - -- CSS flexible box layout module - -- And mutation observers like DOM4 and 5.3 - -For more information about specific changes and additions, see the [IE11 guide for developers](https://go.microsoft.com/fwlink/p/?LinkId=313188). - -**Q: What test tools exist to test for potential application compatibility issues?**
          -The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://go.microsoft.com/fwlink/p/?LinkId=313189). In addition, you can use the new [F12 Developer Tools](https://go.microsoft.com/fwlink/p/?LinkId=313190) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge. - -**Q: Why am I having problems launching my legacy apps with Internet Explorer 11**?
          -It’s most likely because IE no longer starts apps that use managed browser hosting controls, like in the .NET Framework 1.1 and 2.0. You can get IE11 to use managed browser hosting controls again, by: - -- **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - -- **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - -For more information, see the [Web Applications](https://go.microsoft.com/fwlink/p/?LinkId=308903) section of the Application Compatibility in the .NET Framework 4.5 page. - -**Q: Is there a compatibility list for IE?**
          -Yes. You can review the XML-based [compatibility version list](https://go.microsoft.com/fwlink/p/?LinkId=403864). - -**Q: What is Enterprise Mode?**
          -Enterprise Mode is a compatibility mode designed for Enterprises. This mode lets websites render using a modified browser configuration that’s designed to avoid the common compatibility problems associated with web apps written and tested on older versions of IE, like Windows Internet Explorer 7 or Windows Internet Explorer 8.

          -For more information, see [Turn on Enterprise Mode and use a site list](../ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md). - -**Q: What is the Enterprise Mode Site List Manager tool?**
          -Enterprise Mode Site List Manager tool gives you a way to add websites to your Enterprise Mode site list, without having to manually code XML.

          -For more information, see all of the topics in [Use the Enterprise Mode Site List Manager](../ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md). - -**Q: Are browser plug-ins supported in IE11?**
          -The immersive version of IE11 provides an add-on–free experience, so browser plugins won't load and dependent content won't be displayed. This doesn't apply to Internet Explorer for the desktop. For more information, see [Browsing Without Plug-ins](https://go.microsoft.com/fwlink/p/?LinkId=242587). However, Internet Explorer for the desktop and IE11 on Windows 7 with SP1 do support browser plugins, including ActiveX controls such as Adobe Flash and Microsoft Silverlight. - -**Q: Is Adobe Flash supported on IE11?**
          -Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both IE and Internet Explorer for the desktop. Users can turn this feature on or off using the **Manage Add-ons** dialog box, while administrators can turn this feature on or off using the Group Policy setting, **Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects**.

          -**Important**
          -The preinstalled version of Adobe Flash isn't supported on IE11 running on either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. However, you can still download and install the separate Adobe Flash plug-in. - -**Q: Can I replace IE11 on Windows 8.1 with an earlier version?**
          -No. Windows 8.1 doesn't support any of the previous versions of IE. - -**Q: Are there any new Group Policy settings in IE11?**
          -IE11 includes all of the previous Group Policy settings you've used to manage and control web browser configuration since Internet Explorer 9. It also includes the following new Group Policy settings, supporting new features: - -- Turn off Page Prediction - -- Turn on the swiping motion for Internet Explorer for the desktop - -- Allow Microsoft services to provide more relevant and personalized search results - -- Turn off phone number detection - -- Allow IE to use the SPDY/3 network protocol - -- Let users turn on and use Enterprise Mode from the **Tools** menu - -- Use the Enterprise Mode IE website list - -For more information, see [New group policy settings for IE11](../ie11-deploy-guide/new-group-policy-settings-for-ie11.md). - - -**Q: Where can I get more information about IE11 for IT pros?**
          -Visit the [Springboard Series for Microsoft Browsers](https://go.microsoft.com/fwlink/p/?LinkId=313191) webpage on TechNet. - - - -**Q: Can I customize settings for IE on Windows 8.1?**
          -Settings can be customized in the following ways: - -- IE11 **Settings** charm. - -- IE11-related Group Policy settings. - -- IEAK 11 for settings shared by both IE and Internet Explorer for the desktop. - -**Q: Can I make Internet Explorer for the desktop my default browsing experience?**
          -Group Policy settings can be set to open either IE or Internet Explorer for the desktop as the default browser experience. Individual users can configure their own settings in the **Programs** tab of **Internet Options**. The following table shows the settings and results:

          - -|Setting |Result | -|--------|-------| -|Let IE decide |Links open in the same type of experience from where they're launched. For example, clicking a link from a Microsoft Store app, opens IE. However, clicking a link from a desktop app, opens Internet Explorer for the desktop. | -|Always in IE11 |Links always open in IE. | -|Always in Internet Explorer for the desktop |Links always open in Internet Explorer for the desktop. | - - -**Q. Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** -Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. - -IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: - -| | | | -|---------|---------|---------| -|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | -|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | -|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | -|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | -|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | -|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | -|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | -|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | - - - - -**Q. What are the different modes available for the Internet Explorer Customization Wizard?** -The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [Determine the licensing version and features to use in IEAK 11](../ie11-ieak/licensing-version-and-features-ieak11.md). - -The following table displays which pages are available in IEAK 11, based on the licensing mode: - -| **Wizard Pages** | **External** | **Internal** | -|-------------------------------------------|--------------|--------------| -| Welcome to the IEAK | Yes | Yes | -| File Locations | Yes | Yes | -| Platform Selection | Yes | Yes | -| Language Selection | Yes | Yes | -| Package Type Selection | Yes | Yes | -| Feature Selection | Yes | Yes | -| Automatic Version Synchronization | Yes | Yes | -| Custom Components | Yes | Yes | -| Corporate Install | No | Yes | -| User Experience | No | Yes | -| Browser User Interface | Yes | Yes | -| Search Providers | Yes | Yes | -| Important URLs - Home page and Support | Yes | Yes | -| Accelerators | Yes | Yes | -| Favorites, Favorites Bar, and Feeds | Yes | Yes | -| Browsing Options | No | Yes | -| First Run Wizard and Welcome Page Options | Yes | Yes | -| Compatibility View | Yes | Yes | -| Connection Manager | Yes | Yes | -| Connection Settings | Yes | Yes | -| Automatic Configuration | No | Yes | -| Proxy Settings | Yes | Yes | -| Security and Privacy Settings | No | Yes | -| Add a Root Certificate | Yes | No | -| Programs | Yes | Yes | -| Additional Settings | No | Yes | -| Wizard Complete | Yes | Yes | - - -## Related topics -- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) +--- +ms.localizationpriority: medium +ms.mktglfcycl: explore +description: Frequently asked questions about Internet Explorer 11 for IT Pros +author: dansimp +ms.prod: ie11 +ms.assetid: 140e7d33-584a-44da-8c68-6c1d568e1de3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Internet Explorer 11 - FAQ for IT Pros (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 10/16/2017 +--- + + +# Internet Explorer 11 - FAQ for IT Pros + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Answering frequently asked questions about Internet Explorer 11 (IE11) features, operating system support, integration with the Windows operating system, Group Policy, and general configuration. + +## Frequently Asked Questions + +**Q: What operating system does IE11 run on?** + +- Windows 10 + +- Windows 8.1 + +- Windows Server 2012 R2 + +- Windows 7 with Service Pack 1 (SP1) + +- Windows Server 2008 R2 with Service Pack 1 (SP1) + + +**Q: How do I install IE11 on Windows 10, Windows 8.1, or Windows Server 2012 R2?**
          +IE11 is preinstalled with Windows 8.1 and Windows Server 2012 R2. No additional action is required. + +**Q: How do I install IE11 on Windows 7 with SP1 or Windows Server 2008 R2 with SP1?**
          +You can install IE11 on computers running either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. To download IE11, see the IE11 [home page](https://go.microsoft.com/fwlink/p/?LinkId=290956). + +**Q: How does IE11 integrate with Windows 8.1?**
          +IE11 is the default handler for the HTTP and HTTPS protocols and the default browser for Windows 8.1. There are two experiences in Windows 8.1: Internet Explorer and Internet Explorer for the desktop. IE is the default browser for touch-first, immersive experiences. Internet Explorer for the desktop provides a more traditional window and tab management experience. The underlying platform of IE11 is fully interoperable across both IE and the familiar Internet Explorer for the desktop, letting developers write the same markup for both experiences. + +**Q: What are the new or improved security features?**
          +IE11 offers improvements to Enhanced Protected Mode, password manager, and other security features. IE11 also turns on Transport Layer Security (TLS) 1.2 by default. + +**Q: How is Microsoft supporting modern web standards, such as WebGL?**
          +Microsoft is committed to providing an interoperable web by supporting modern web standards. Doing this lets developers use the same markup across web browsers, helping to reduce development and support costs.

          +Supported web standards include: + +- Web Graphics Library (WebGL) + +- Canvas 2D L2 extensions, including image smoothing using the nearest neighbor, dashed lines, and fill rules + +- Fullscreen API + +- Encrypted media extensions + +- Media source extensions + +- CSS flexible box layout module + +- And mutation observers like DOM4 and 5.3 + +For more information about specific changes and additions, see the [IE11 guide for developers](https://go.microsoft.com/fwlink/p/?LinkId=313188). + +**Q: What test tools exist to test for potential application compatibility issues?**
          +The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://go.microsoft.com/fwlink/p/?LinkId=313189). In addition, you can use the new [F12 Developer Tools](https://go.microsoft.com/fwlink/p/?LinkId=313190) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge. + +**Q: Why am I having problems launching my legacy apps with Internet Explorer 11**?
          +It’s most likely because IE no longer starts apps that use managed browser hosting controls, like in the .NET Framework 1.1 and 2.0. You can get IE11 to use managed browser hosting controls again, by: + +- **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. + +- **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. + +For more information, see the [Web Applications](https://go.microsoft.com/fwlink/p/?LinkId=308903) section of the Application Compatibility in the .NET Framework 4.5 page. + +**Q: Is there a compatibility list for IE?**
          +Yes. You can review the XML-based [compatibility version list](https://go.microsoft.com/fwlink/p/?LinkId=403864). + +**Q: What is Enterprise Mode?**
          +Enterprise Mode is a compatibility mode designed for Enterprises. This mode lets websites render using a modified browser configuration that’s designed to avoid the common compatibility problems associated with web apps written and tested on older versions of IE, like Windows Internet Explorer 7 or Windows Internet Explorer 8.

          +For more information, see [Turn on Enterprise Mode and use a site list](../ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md). + +**Q: What is the Enterprise Mode Site List Manager tool?**
          +Enterprise Mode Site List Manager tool gives you a way to add websites to your Enterprise Mode site list, without having to manually code XML.

          +For more information, see all of the topics in [Use the Enterprise Mode Site List Manager](../ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md). + +**Q: Are browser plug-ins supported in IE11?**
          +The immersive version of IE11 provides an add-on–free experience, so browser plugins won't load and dependent content won't be displayed. This doesn't apply to Internet Explorer for the desktop. For more information, see [Browsing Without Plug-ins](https://go.microsoft.com/fwlink/p/?LinkId=242587). However, Internet Explorer for the desktop and IE11 on Windows 7 with SP1 do support browser plugins, including ActiveX controls such as Adobe Flash and Microsoft Silverlight. + +**Q: Is Adobe Flash supported on IE11?**
          +Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both IE and Internet Explorer for the desktop. Users can turn this feature on or off using the **Manage Add-ons** dialog box, while administrators can turn this feature on or off using the Group Policy setting, **Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects**.

          +**Important**
          +The preinstalled version of Adobe Flash isn't supported on IE11 running on either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. However, you can still download and install the separate Adobe Flash plug-in. + +**Q: Can I replace IE11 on Windows 8.1 with an earlier version?**
          +No. Windows 8.1 doesn't support any of the previous versions of IE. + +**Q: Are there any new Group Policy settings in IE11?**
          +IE11 includes all of the previous Group Policy settings you've used to manage and control web browser configuration since Internet Explorer 9. It also includes the following new Group Policy settings, supporting new features: + +- Turn off Page Prediction + +- Turn on the swiping motion for Internet Explorer for the desktop + +- Allow Microsoft services to provide more relevant and personalized search results + +- Turn off phone number detection + +- Allow IE to use the SPDY/3 network protocol + +- Let users turn on and use Enterprise Mode from the **Tools** menu + +- Use the Enterprise Mode IE website list + +For more information, see [New group policy settings for IE11](../ie11-deploy-guide/new-group-policy-settings-for-ie11.md). + + +**Q: Where can I get more information about IE11 for IT pros?**
          +Visit the [Springboard Series for Microsoft Browsers](https://go.microsoft.com/fwlink/p/?LinkId=313191) webpage on TechNet. + + + +**Q: Can I customize settings for IE on Windows 8.1?**
          +Settings can be customized in the following ways: + +- IE11 **Settings** charm. + +- IE11-related Group Policy settings. + +- IEAK 11 for settings shared by both IE and Internet Explorer for the desktop. + +**Q: Can I make Internet Explorer for the desktop my default browsing experience?**
          +Group Policy settings can be set to open either IE or Internet Explorer for the desktop as the default browser experience. Individual users can configure their own settings in the **Programs** tab of **Internet Options**. The following table shows the settings and results:

          + +|Setting |Result | +|--------|-------| +|Let IE decide |Links open in the same type of experience from where they're launched. For example, clicking a link from a Microsoft Store app, opens IE. However, clicking a link from a desktop app, opens Internet Explorer for the desktop. | +|Always in IE11 |Links always open in IE. | +|Always in Internet Explorer for the desktop |Links always open in Internet Explorer for the desktop. | + + +**Q. Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** +Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. + +IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: + +| | | | +|---------|---------|---------| +|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | +|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | +|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | +|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | +|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | +|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | +|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | +|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | + + + + +**Q. What are the different modes available for the Internet Explorer Customization Wizard?** +The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [Determine the licensing version and features to use in IEAK 11](../ie11-ieak/licensing-version-and-features-ieak11.md). + +The following table displays which pages are available in IEAK 11, based on the licensing mode: + +| **Wizard Pages** | **External** | **Internal** | +|-------------------------------------------|--------------|--------------| +| Welcome to the IEAK | Yes | Yes | +| File Locations | Yes | Yes | +| Platform Selection | Yes | Yes | +| Language Selection | Yes | Yes | +| Package Type Selection | Yes | Yes | +| Feature Selection | Yes | Yes | +| Automatic Version Synchronization | Yes | Yes | +| Custom Components | Yes | Yes | +| Corporate Install | No | Yes | +| User Experience | No | Yes | +| Browser User Interface | Yes | Yes | +| Search Providers | Yes | Yes | +| Important URLs - Home page and Support | Yes | Yes | +| Accelerators | Yes | Yes | +| Favorites, Favorites Bar, and Feeds | Yes | Yes | +| Browsing Options | No | Yes | +| First Run Wizard and Welcome Page Options | Yes | Yes | +| Compatibility View | Yes | Yes | +| Connection Manager | Yes | Yes | +| Connection Settings | Yes | Yes | +| Automatic Configuration | No | Yes | +| Proxy Settings | Yes | Yes | +| Security and Privacy Settings | No | Yes | +| Add a Root Certificate | Yes | No | +| Programs | Yes | Yes | +| Additional Settings | No | Yes | +| Wizard Complete | Yes | Yes | + + +## Related topics +- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643) +- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) diff --git a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md index 392e7cc26e..cf59b670d6 100644 --- a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md +++ b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md @@ -1,120 +1,124 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: explore -description: Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. -author: lomayor -ms.author: lomayor -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions - -Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. - ->[!Important] ->If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or System Center 2012 Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment. - -- [Automatic updates delivery process](#automatic-updates-delivery-process) - -- [How the Internet Explorer 11 Blocker Toolkit works](#how-the-internet-explorer-11-blocker-toolkit-works) - -- [Internet Explorer 11 Blocker Toolkit and other update services](#internet-explorer-11-blocker-toolkit-and-other-update-services) - -## Automatic Updates delivery process - - -**Q. Which users will receive Internet Explorer 11 as an important update?** -A. Users running either Windows 7 with Service Pack 1 (SP1) or the 64-bit version of Windows Server 2008 R2 with Service Pack 1 (SP1) will receive Internet Explorer 11 as an important update, if Automatic Updates are turned on. Windows Update is manually run. Automatic Updates will automatically download and install the Internet Explorer 11 files if it’s turned on. For more information about how Internet Explorer works with Automatic Updates and information about other deployment blocking options, see [Internet Explorer 11 Delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md). - -**Q. When is the Blocker Toolkit available?** -A. The Blocker Toolkit is currently available from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). - -**Q. What tools can I use to manage Windows Updates and Microsoft Updates in my company?** -A. We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You can also use the more advanced configuration management tool, [System Center 2012 Configuration Manager](https://technet.microsoft.com/library/gg682041.aspx). - -**Q. How long does the blocker mechanism work?** -A. The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts as long as the registry key value isn’t removed or changed. - -**Q. Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of Automatic Updates?** -A. Automatic Updates provide you with ongoing critical security and reliability updates. Turning this feature off can leave your computers more vulnerable. Instead, we suggest that you use an update management solution, such as WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers. - -The Internet Explorer 11 Blocker Toolkit safely allows Internet Explorer 11 to download and install in companies that can’t use WSUS, Configuration Manager, or -other update management solution. - -**Q. Why don’t we just block URL access to Windows Update or Microsoft Update?** -A. Blocking the Windows Update or Microsoft Update URLs also stops delivery of critical security and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable. - -## How the Internet Explorer 11 Blocker Toolkit works - -**Q. How should I test the Internet Explorer 11 Blocker Toolkit in my company?** -A. Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additional impact or side effects to your environment. No additional testing should be necessary. - -**Q. What’s the registry key used to block delivery of Internet Explorer 11?** -A. HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0 - -**Q. What’s the registry key name and values?** -The registry key name is **DoNotAllowIE11**, where: - -- A value of **1** turns off the automatic delivery of Internet Explorer 11 using Automatic Updates and turns off the Express install option. - -- Not providing a registry key, or using a value of anything other than **1**, lets the user install Internet Explorer 11 through Automatic Updates or a - manual update. - -**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11?** -A. No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users can still download and install Internet Explorer 11 from the Microsoft Download Center or from external media. - -**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11?** -A. Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. - -**Q. How does the provided script work?** -A. The script accepts one of two command line options: - -- **Block:** Creates the registry key that stops Internet Explorer 11 from installing through Automatic Updates. - -- **Unblock:** Removes the registry key that stops Internet Explorer 11 from installing through Automatic Updates. - -**Q. What’s the ADM template file used for?** -A. The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company. - -**Q. Is the tool localized?** -A. No. The tool isn’t localized, it’s only available in English (en-us). However, it does work, without any modifications, on any language edition of the supported operating systems. - -## Internet Explorer 11 Blocker Toolkit and other update services - -**Q: Is there a version of the Internet Explorer Blocker Toolkit that will prevent automatic installation of IE11?**
          -Yes. The IE11 Blocker Toolkit is available for download. For more information, see [Toolkit to Disable Automatic Delivery of IE11](https://go.microsoft.com/fwlink/p/?LinkId=328195) on the Microsoft Download Center. - -**Q. Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like WSUS?** -A. No. You can still deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies that don’t use upgrade management solutions. - -**Q. If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company?** -A. You only need to change your settings if: - -- You use WSUS to manage updates and allow auto-approvals for Update Rollup installation. - - -and- - -- You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed. - - -and- - -- You don’t want to upgrade your older versions of Internet Explorer to Internet Explorer 11 right now. - -If these scenarios apply to your company, see [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) for more information on how to prevent automatic installation. - - -## Additional resources - -- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) - -- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) - -- [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) - -- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) +--- +ms.localizationpriority: medium +ms.mktglfcycl: explore +description: Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. +author: dansimp +ms.author: dansimp +ms.prod: ie11 +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions +ms.sitesec: library +ms.date: 05/10/2018 +--- + +# Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. + +> [!Important] +> If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or System Center 2012 Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment. + +- [Automatic updates delivery process](#automatic-updates-delivery-process) + +- [How the Internet Explorer 11 Blocker Toolkit works](#how-the-internet-explorer-11-blocker-toolkit-works) + +- [Internet Explorer 11 Blocker Toolkit and other update services](#internet-explorer-11-blocker-toolkit-and-other-update-services) + +## Automatic Updates delivery process + + +**Q. Which users will receive Internet Explorer 11 as an important update?** +A. Users running either Windows 7 with Service Pack 1 (SP1) or the 64-bit version of Windows Server 2008 R2 with Service Pack 1 (SP1) will receive Internet Explorer 11 as an important update, if Automatic Updates are turned on. Windows Update is manually run. Automatic Updates will automatically download and install the Internet Explorer 11 files if it’s turned on. For more information about how Internet Explorer works with Automatic Updates and information about other deployment blocking options, see [Internet Explorer 11 Delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md). + +**Q. When is the Blocker Toolkit available?** +A. The Blocker Toolkit is currently available from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). + +**Q. What tools can I use to manage Windows Updates and Microsoft Updates in my company?** +A. We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You can also use the more advanced configuration management tool, [System Center 2012 Configuration Manager](https://technet.microsoft.com/library/gg682041.aspx). + +**Q. How long does the blocker mechanism work?** +A. The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts as long as the registry key value isn’t removed or changed. + +**Q. Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of Automatic Updates?** +A. Automatic Updates provide you with ongoing critical security and reliability updates. Turning this feature off can leave your computers more vulnerable. Instead, we suggest that you use an update management solution, such as WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers. + +The Internet Explorer 11 Blocker Toolkit safely allows Internet Explorer 11 to download and install in companies that can’t use WSUS, Configuration Manager, or +other update management solution. + +**Q. Why don’t we just block URL access to Windows Update or Microsoft Update?** +A. Blocking the Windows Update or Microsoft Update URLs also stops delivery of critical security and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable. + +## How the Internet Explorer 11 Blocker Toolkit works + +**Q. How should I test the Internet Explorer 11 Blocker Toolkit in my company?** +A. Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additional impact or side effects to your environment. No additional testing should be necessary. + +**Q. What’s the registry key used to block delivery of Internet Explorer 11?** +A. HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0 + +**Q. What’s the registry key name and values?** +The registry key name is **DoNotAllowIE11**, where: + +- A value of **1** turns off the automatic delivery of Internet Explorer 11 using Automatic Updates and turns off the Express install option. + +- Not providing a registry key, or using a value of anything other than **1**, lets the user install Internet Explorer 11 through Automatic Updates or a + manual update. + +**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11?** +A. No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users can still download and install Internet Explorer 11 from the Microsoft Download Center or from external media. + +**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11?** +A. Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. + +**Q. How does the provided script work?** +A. The script accepts one of two command line options: + +- **Block:** Creates the registry key that stops Internet Explorer 11 from installing through Automatic Updates. + +- **Unblock:** Removes the registry key that stops Internet Explorer 11 from installing through Automatic Updates. + +**Q. What’s the ADM template file used for?** +A. The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company. + +**Q. Is the tool localized?** +A. No. The tool isn’t localized, it’s only available in English (en-us). However, it does work, without any modifications, on any language edition of the supported operating systems. + +## Internet Explorer 11 Blocker Toolkit and other update services + +**Q: Is there a version of the Internet Explorer Blocker Toolkit that will prevent automatic installation of IE11?**
          +Yes. The IE11 Blocker Toolkit is available for download. For more information, see [Toolkit to Disable Automatic Delivery of IE11](https://go.microsoft.com/fwlink/p/?LinkId=328195) on the Microsoft Download Center. + +**Q. Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like WSUS?** +A. No. You can still deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies that don’t use upgrade management solutions. + +**Q. If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company?** +A. You only need to change your settings if: + +- You use WSUS to manage updates and allow auto-approvals for Update Rollup installation. + + -and- + +- You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed. + + -and- + +- You don’t want to upgrade your older versions of Internet Explorer to Internet Explorer 11 right now. + +If these scenarios apply to your company, see [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) for more information on how to prevent automatic installation. + + +## Additional resources + +- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) + +- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) + +- [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) + +- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) diff --git a/browsers/internet-explorer/ie11-faq/faq-ieak11.md b/browsers/internet-explorer/ie11-faq/faq-ieak11.md index 3af0ec2d32..929acbed39 100644 --- a/browsers/internet-explorer/ie11-faq/faq-ieak11.md +++ b/browsers/internet-explorer/ie11-faq/faq-ieak11.md @@ -1,120 +1,124 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. -author: lomayor -ms.author: lomayor -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -title: IEAK 11 - Frequently Asked Questions -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# IEAK 11 - Frequently Asked Questions - -Get answers to commonly asked questions about the Internet Explorer Administration Kit 11 (IEAK 11), and find links to additional material you might find helpful. - -**What is IEAK 11?** - -IEAK 11 enables you to customize, brand, and distribute customized Internet Explorer 11 browser packages across an organization. Download the kit from the [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md). - -**What are the supported operating systems?** - -You can customize and install IEAK 11 on the following supported operating systems: - -- Windows 8 - -- Windows Server 2012 - -- Windows 7 Service Pack 1 (SP1) - -- Windows Server 2008 R2 Service Pack 1 (SP1) - ->[!Note] ->IEAK 11 does not support building custom packages for Windows RT. - - -**What can I customize with IEAK 11?** - -The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable. - ->[!Note] ->Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package. - -**Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** -Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. - ->[!Note] ->IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md). - -**Q: Is there a version of the Internet Explorer Administration Kit (IEAK) supporting IE11?**
          -Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources: - -- [Internet Explorer Administration Kit Information and Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214250) on the Internet Explorer TechCenter. - -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) - -**What are the different modes available for the Internet Explorer Customization Wizard?** -The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [What IEAK can do for you](../ie11-ieak/what-ieak-can-do-for-you.md). - -The following table displays which pages are available in IEAK 11, based on the licensing mode: - -| **Wizard Pages** | **External** | **Internal** | -|-------------------------------------------|--------------|--------------| -| Welcome to the IEAK | Yes | Yes | -| File Locations | Yes | Yes | -| Platform Selection | Yes | Yes | -| Language Selection | Yes | Yes | -| Package Type Selection | Yes | Yes | -| Feature Selection | Yes | Yes | -| Automatic Version Synchronization | Yes | Yes | -| Custom Components | Yes | Yes | -| Corporate Install | No | Yes | -| User Experience | No | Yes | -| Browser User Interface | Yes | Yes | -| Search Providers | Yes | Yes | -| Important URLs - Home page and Support | Yes | Yes | -| Accelerators | Yes | Yes | -| Favorites, Favorites Bar, and Feeds | Yes | Yes | -| Browsing Options | No | Yes | -| First Run Wizard and Welcome Page Options | Yes | Yes | -| Compatibility View | Yes | Yes | -| Connection Manager | Yes | Yes | -| Connection Settings | Yes | Yes | -| Automatic Configuration | No | Yes | -| Proxy Settings | Yes | Yes | -| Security and Privacy Settings | No | Yes | -| Add a Root Certificate | Yes | No | -| Programs | Yes | Yes | -| Additional Settings | No | Yes | -| Wizard Complete | Yes | Yes | - - -**Q. Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** -Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. - -IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: - -| | | | -|---------|---------|---------| -|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | -|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | -|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | -|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | -|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | -|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | -|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | -|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | - - -## Additional resources - -[Download IEAK 11](https://technet.microsoft.com/microsoft-edge/bb219517) -[IEAK 11 overview](https://technet.microsoft.com/microsoft-edge/dn532244) -[IEAK 11 product documentation](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) -[IEAK 11 licensing guidelines](../ie11-ieak/licensing-version-and-features-ieak11.md) +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +ms.pagetype: security +description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. +author: dansimp +ms.author: dansimp +ms.manager: elizapo +ms.prod: ie11 +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +title: IEAK 11 - Frequently Asked Questions +ms.sitesec: library +ms.date: 05/10/2018 +--- + +# IEAK 11 - Frequently Asked Questions + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Get answers to commonly asked questions about the Internet Explorer Administration Kit 11 (IEAK 11), and find links to additional material you might find helpful. + +**What is IEAK 11?** + +IEAK 11 enables you to customize, brand, and distribute customized Internet Explorer 11 browser packages across an organization. Download the kit from the [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md). + +**What are the supported operating systems?** + +You can customize and install IEAK 11 on the following supported operating systems: + +- Windows 8 + +- Windows Server 2012 + +- Windows 7 Service Pack 1 (SP1) + +- Windows Server 2008 R2 Service Pack 1 (SP1) + +> [!NOTE] +> IEAK 11 does not support building custom packages for Windows RT. + + +**What can I customize with IEAK 11?** + +The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable. + +> [!NOTE] +> Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package. + +**Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** +Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. + +> [!NOTE] +> IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md). + +**Q: Is there a version of the Internet Explorer Administration Kit (IEAK) supporting IE11?**
          +Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources: + +- [Internet Explorer Administration Kit Information and Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214250) on the Internet Explorer TechCenter. + +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) + +**What are the different modes available for the Internet Explorer Customization Wizard?** +The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [What IEAK can do for you](../ie11-ieak/what-ieak-can-do-for-you.md). + +The following table displays which pages are available in IEAK 11, based on the licensing mode: + +| **Wizard Pages** | **External** | **Internal** | +|-------------------------------------------|--------------|--------------| +| Welcome to the IEAK | Yes | Yes | +| File Locations | Yes | Yes | +| Platform Selection | Yes | Yes | +| Language Selection | Yes | Yes | +| Package Type Selection | Yes | Yes | +| Feature Selection | Yes | Yes | +| Automatic Version Synchronization | Yes | Yes | +| Custom Components | Yes | Yes | +| Corporate Install | No | Yes | +| User Experience | No | Yes | +| Browser User Interface | Yes | Yes | +| Search Providers | Yes | Yes | +| Important URLs - Home page and Support | Yes | Yes | +| Accelerators | Yes | Yes | +| Favorites, Favorites Bar, and Feeds | Yes | Yes | +| Browsing Options | No | Yes | +| First Run Wizard and Welcome Page Options | Yes | Yes | +| Compatibility View | Yes | Yes | +| Connection Manager | Yes | Yes | +| Connection Settings | Yes | Yes | +| Automatic Configuration | No | Yes | +| Proxy Settings | Yes | Yes | +| Security and Privacy Settings | No | Yes | +| Add a Root Certificate | Yes | No | +| Programs | Yes | Yes | +| Additional Settings | No | Yes | +| Wizard Complete | Yes | Yes | + + +**Q. Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** +Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. + +IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: + +| | | | +|---------|---------|---------| +|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | +|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | +|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | +|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | +|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | +|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | +|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | +|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | + + +## Additional resources + +[Download IEAK 11](https://technet.microsoft.com/microsoft-edge/bb219517) +[IEAK 11 overview](https://technet.microsoft.com/microsoft-edge/dn532244) +[IEAK 11 product documentation](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) +[IEAK 11 licensing guidelines](../ie11-ieak/licensing-version-and-features-ieak11.md) diff --git a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md index 2927489c83..40a7886b0a 100644 --- a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md @@ -1,45 +1,49 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Accelerators page in the IEAK 11 Customization Wizard to add accelerators to employee devices. -author: lomayor -ms.prod: ie11 -ms.assetid: 208305ad-1bcd-42f3-aca3-0ad1dda7048b -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Accelerators page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Accelerators page in the IEAK 11 Wizard -The **Accelerators** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add accelerators to your employee computers. Accelerators are contextual menu options that can quickly get to a web service from any webpage. For example, an accelerator can look up a highlighted word in the dictionary or a selected location on a map. - -**Note**
          -The customizations you make on this page apply only to Internet Explorer for the desktop. - - **To use the Accelerators page** - -1. Click **Import** to automatically import your existing accelerators from your current version of IE into this list. - -2. Click **Add** to add more accelerators.

          -The **Add Accelerator** box appears. - -3. Use the **Browse** button to go to your custom accelerator XML file. - -4. Check the **Set this Accelerator as the default for the category** box if you want this accelerator to be the default value that shows up for the category. - -5. Click **Edit** to change your accelerator information, click **Set Default** to make an accelerator the default value for a category, or **Remove** to delete an accelerator. - -6. Click **Next** to go to the [Favorites, Favorites Bar, and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) page or **Back** to go to the [Important URLs - Home Page and Support](important-urls-home-page-and-support-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Accelerators page in the IEAK 11 Customization Wizard to add accelerators to employee devices. +author: dansimp +ms.prod: ie11 +ms.assetid: 208305ad-1bcd-42f3-aca3-0ad1dda7048b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Accelerators page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Accelerators page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Accelerators** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add accelerators to your employee computers. Accelerators are contextual menu options that can quickly get to a web service from any webpage. For example, an accelerator can look up a highlighted word in the dictionary or a selected location on a map. + +**Note**
          +The customizations you make on this page apply only to Internet Explorer for the desktop. + + **To use the Accelerators page** + +1. Click **Import** to automatically import your existing accelerators from your current version of IE into this list. + +2. Click **Add** to add more accelerators.

          +The **Add Accelerator** box appears. + +3. Use the **Browse** button to go to your custom accelerator XML file. + +4. Check the **Set this Accelerator as the default for the category** box if you want this accelerator to be the default value that shows up for the category. + +5. Click **Edit** to change your accelerator information, click **Set Default** to make an accelerator the default value for a category, or **Remove** to delete an accelerator. + +6. Click **Next** to go to the [Favorites, Favorites Bar, and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) page or **Back** to go to the [Important URLs - Home Page and Support](important-urls-home-page-and-support-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md index a0d56ae1d9..b4d0459c78 100644 --- a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md @@ -1,52 +1,56 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use IEAK 11 to add and approve ActiveX controls for your organization. -author: lomayor -ms.prod: ie11 -ms.assetid: 33040bd1-f0e4-4541-9fbb-16e0c76752ab -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Add and approve ActiveX controls using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add and approve ActiveX controls using IEAK 11 -There are two main approaches to how you can control the use of ActiveX controls in your company. For more info about ActiveX controls, including how to manage the controls using Group Policy, see [Group Policy and ActiveX installation](../ie11-deploy-guide/activex-installation-using-group-policy.md) in the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). - -**Note**
          -ActiveX controls are supported in Internet Explorer for the desktop for Windows 7 and Windows 8.1. They are not supported on the immersive version of Internet Explorer for Windows 8.1. - -## Scenario 1: Limited Internet-only use of ActiveX controls -While you might not care about your employees using ActiveX controls while on your intranet sites, you probably do want to limit ActiveX usage while your employee is on the Internet. By specifying and pre-approving a set of generic controls for use on the Internet, you’re able to let your employees use the Internet, but you can still limit your company’s exposure to potentially hazardous, non-approved ActiveX controls. - -For example, your employees need to access an important Internet site, such as for a business partner or service provider, but there are ActiveX controls on their page. To make sure the site is accessible and functions the way it should, you can visit the site to review the controls, adding them as new entries to your `\Windows\Downloaded Program Files` folder. Then, as part of your browser package, you can enable and approve these ActiveX controls to run on this specific site; while all additional controls are blocked. - -**To add and approve ActiveX controls** - -1. In IE, click **Tools**, and then **Internet Options**. - -2. On the **Security** tab, click the zone that needs to change, and click **Custom Level**. - -3. Go to **Run ActiveX controls and plug-ins**, and then click **Administrator approved**. - -4. Repeat the last two steps until you have configured all the zones you want. - -5. When you run the IEAK 11 Customization Wizard to create a custom package, you'll use the [Additional Settings](additional-settings-ieak11-wizard.md) page, clicking each folder to expand its contents. Then select the check boxes for the controls you want to approve. - -## Scenario 2: Restricted use of ActiveX controls -You can get a higher degree of management over ActiveX controls by listing each of them out and then allowing the browser to use only that set of controls. The biggest challenge to using this method is the extra effort you need to put into figuring out all of the controls, and then actually listing them out. Because of that, we only recommend this approach if your complete set of controls is relatively small. - -After you decide which controls you want to allow, you can specify them as approved by zone, using the process described in the first scenario. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use IEAK 11 to add and approve ActiveX controls for your organization. +author: dansimp +ms.prod: ie11 +ms.assetid: 33040bd1-f0e4-4541-9fbb-16e0c76752ab +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Add and approve ActiveX controls using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add and approve ActiveX controls using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +There are two main approaches to how you can control the use of ActiveX controls in your company. For more info about ActiveX controls, including how to manage the controls using Group Policy, see [Group Policy and ActiveX installation](../ie11-deploy-guide/activex-installation-using-group-policy.md) in the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). + +**Note**
          +ActiveX controls are supported in Internet Explorer for the desktop for Windows 7 and Windows 8.1. They are not supported on the immersive version of Internet Explorer for Windows 8.1. + +## Scenario 1: Limited Internet-only use of ActiveX controls +While you might not care about your employees using ActiveX controls while on your intranet sites, you probably do want to limit ActiveX usage while your employee is on the Internet. By specifying and pre-approving a set of generic controls for use on the Internet, you’re able to let your employees use the Internet, but you can still limit your company’s exposure to potentially hazardous, non-approved ActiveX controls. + +For example, your employees need to access an important Internet site, such as for a business partner or service provider, but there are ActiveX controls on their page. To make sure the site is accessible and functions the way it should, you can visit the site to review the controls, adding them as new entries to your `\Windows\Downloaded Program Files` folder. Then, as part of your browser package, you can enable and approve these ActiveX controls to run on this specific site; while all additional controls are blocked. + +**To add and approve ActiveX controls** + +1. In IE, click **Tools**, and then **Internet Options**. + +2. On the **Security** tab, click the zone that needs to change, and click **Custom Level**. + +3. Go to **Run ActiveX controls and plug-ins**, and then click **Administrator approved**. + +4. Repeat the last two steps until you have configured all the zones you want. + +5. When you run the IEAK 11 Customization Wizard to create a custom package, you'll use the [Additional Settings](additional-settings-ieak11-wizard.md) page, clicking each folder to expand its contents. Then select the check boxes for the controls you want to approve. + +## Scenario 2: Restricted use of ActiveX controls +You can get a higher degree of management over ActiveX controls by listing each of them out and then allowing the browser to use only that set of controls. The biggest challenge to using this method is the extra effort you need to put into figuring out all of the controls, and then actually listing them out. Because of that, we only recommend this approach if your complete set of controls is relatively small. + +After you decide which controls you want to allow, you can specify them as approved by zone, using the process described in the first scenario. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md index 72e79f106f..c04501eea7 100644 --- a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md @@ -1,29 +1,33 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK. -author: lomayor -ms.prod: ie11 -ms.assetid: 7ae4e747-49d2-4551-8790-46a61b5fe838 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Add a Root Certificate page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Add a Root Certificate page in the IEAK 11 Wizard -We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK. - -Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK. +author: dansimp +ms.prod: ie11 +ms.assetid: 7ae4e747-49d2-4551-8790-46a61b5fe838 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Add a Root Certificate page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Add a Root Certificate page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK. + +Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md index 2a15fe18e9..ebff04a24a 100644 --- a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md @@ -1,41 +1,45 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Additional Settings page in IEAK 11 Customization Wizard for additional settings that relate to your employee’s desktop, operating system, and security. -author: lomayor -ms.prod: ie11 -ms.assetid: c90054af-7b7f-4b00-b55b-5e5569f65f25 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Additional Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Additional Settings page in the IEAK 11 Wizard -The **Additional Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you pick additional custom, corporate, and Internet settings that relate to your employee’s desktop, operating system, and security. If you don’t change a setting, it’ll be ignored. - -The additional settings appear in administration (.adm) files that are stored in your `:\Program Files\Windows IEAK 11\policies` folder. You can also create your own .adm files with options that can be configured using the wizard. Any edits you make to your own .adm file are stored as .ins files, which are used to build the .inf files for your custom install package. - -You can store your user settings in a central location so your employees that log on from computer to computer can use them. For example if you have an employee that requires low security using a computer that’s typically operated by someone that needs more restrictive permissions. - -You’ll only see this page if you are running the **Internal** version of the IE Customization Wizard 11. - -**To use the Additional Settings page** - -1. Double-click **Custom Settings**, **Corporate Settings**, or **Internet Settings**, and review the included policy or restriction settings. - -2. Pick the setting you want to change, and then update its details. - -3. Click **Next** to go to the [Wizard Complete-Next Steps](wizard-complete-ieak11-wizard.md) page or **Back** to go to the [Programs](programs-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Additional Settings page in IEAK 11 Customization Wizard for additional settings that relate to your employee’s desktop, operating system, and security. +author: dansimp +ms.prod: ie11 +ms.assetid: c90054af-7b7f-4b00-b55b-5e5569f65f25 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Additional Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Additional Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Additional Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you pick additional custom, corporate, and Internet settings that relate to your employee’s desktop, operating system, and security. If you don’t change a setting, it’ll be ignored. + +The additional settings appear in administration (.adm) files that are stored in your `:\Program Files\Windows IEAK 11\policies` folder. You can also create your own .adm files with options that can be configured using the wizard. Any edits you make to your own .adm file are stored as .ins files, which are used to build the .inf files for your custom install package. + +You can store your user settings in a central location so your employees that log on from computer to computer can use them. For example if you have an employee that requires low security using a computer that’s typically operated by someone that needs more restrictive permissions. + +You’ll only see this page if you are running the **Internal** version of the IE Customization Wizard 11. + +**To use the Additional Settings page** + +1. Double-click **Custom Settings**, **Corporate Settings**, or **Internet Settings**, and review the included policy or restriction settings. + +2. Pick the setting you want to change, and then update its details. + +3. Click **Next** to go to the [Wizard Complete-Next Steps](wizard-complete-ieak11-wizard.md) page or **Back** to go to the [Programs](programs-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md index 5c77b9bc67..879c328e43 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md @@ -1,59 +1,63 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Automatic Configuration page in the IEAK 11 Customization Wizard to add URLs to auto-configure IE. -author: lomayor -ms.prod: ie11 -ms.assetid: de5b1dbf-6e4d-4f86-ae08-932f14e606b0 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Automatic Configuration page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Automatic Configuration page in the IEAK 11 Wizard -The **Automatic Configuration** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you provide URLs to the files that’ll automatically configure Internet Explorer 11 for a group of employees or devices. - -**Note**
          -This page only appears if you’re using the **Internal** version of the wizard. - -You can set your proxy settings using Internet setting (.ins) files. You can also configure and maintain your advanced proxy settings using JScript (.js), JavaScript (.jvs), or proxy auto-configuration (.pac) script files. When you provide an auto-proxy script, IE dynamically determines whether to connect directly to a host or to use a proxy server. - -You can use the Domain Name System (DNS) and the Dynamic Host Configuration Protocol (DHCP) naming systems to detect and change a browser’s settings automatically when the employee first starts IE on the network. For more info, see [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md), or refer to the product documentation for your DNS and DHCP software packages. - -**To check the existing settings on your employee’s devices** - -1. Open IE, click **Tools**, click **Internet Options**, and then click the **Connections** tab. - -2. Click **LAN Settings** and make sure that the **Use automatic configuration script** box is selected, confirming the path and name of the file in the **Address** box. - -**To use the Automatic Configuration page** - -1. Check the **Automatically detect configuration settings** box to automatically detect browser settings. - -2. Check the **Enable Automatic Configuration** box if you plan to automatically change your IE settings after deployment, using configuration files. You can then: - - - Type the length of time (in minutes) for how often settings are to be applied in your company. Putting zero (**0**), or nothing, in this box will cause automatic configuration to only happen when the computer’s restarted. - - - Type the location to your .ins file. You can edit this file directly to make any necessary changes. - - The updates will take effect the next time your employee starts IE, or during your next scheduled update. - - - Type the location to your automatic proxy script file. - - **Note**
          - If you specify URLs for both auto-config and auto-proxy, the auto-proxy URL will be incorporated into the .ins file. The correct form for the URL is `https://share/test.ins`. - -3. Click **Next** to go to the [Proxy Settings](proxy-settings-ieak11-wizard.md) page or **Back** to go to the [Connection Settings](connection-settings-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Automatic Configuration page in the IEAK 11 Customization Wizard to add URLs to auto-configure IE. +author: dansimp +ms.prod: ie11 +ms.assetid: de5b1dbf-6e4d-4f86-ae08-932f14e606b0 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Automatic Configuration page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Automatic Configuration page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Automatic Configuration** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you provide URLs to the files that’ll automatically configure Internet Explorer 11 for a group of employees or devices. + +**Note**
          +This page only appears if you’re using the **Internal** version of the wizard. + +You can set your proxy settings using Internet setting (.ins) files. You can also configure and maintain your advanced proxy settings using JScript (.js), JavaScript (.jvs), or proxy auto-configuration (.pac) script files. When you provide an auto-proxy script, IE dynamically determines whether to connect directly to a host or to use a proxy server. + +You can use the Domain Name System (DNS) and the Dynamic Host Configuration Protocol (DHCP) naming systems to detect and change a browser’s settings automatically when the employee first starts IE on the network. For more info, see [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md), or refer to the product documentation for your DNS and DHCP software packages. + +**To check the existing settings on your employee’s devices** + +1. Open IE, click **Tools**, click **Internet Options**, and then click the **Connections** tab. + +2. Click **LAN Settings** and make sure that the **Use automatic configuration script** box is selected, confirming the path and name of the file in the **Address** box. + +**To use the Automatic Configuration page** + +1. Check the **Automatically detect configuration settings** box to automatically detect browser settings. + +2. Check the **Enable Automatic Configuration** box if you plan to automatically change your IE settings after deployment, using configuration files. You can then: + + - Type the length of time (in minutes) for how often settings are to be applied in your company. Putting zero (**0**), or nothing, in this box will cause automatic configuration to only happen when the computer’s restarted. + + - Type the location to your .ins file. You can edit this file directly to make any necessary changes. + + The updates will take effect the next time your employee starts IE, or during your next scheduled update. + + - Type the location to your automatic proxy script file. + + **Note**
          + If you specify URLs for both auto-config and auto-proxy, the auto-proxy URL will be incorporated into the .ins file. The correct form for the URL is `https://share/test.ins`. + +3. Click **Next** to go to the [Proxy Settings](proxy-settings-ieak11-wizard.md) page or **Back** to go to the [Connection Settings](connection-settings-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md index e858e5228b..7d4f9344c9 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md @@ -1,62 +1,66 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to set up automatic detection for DHCP or DNS servers using IEAK 11 in your organization. -author: lomayor -ms.prod: ie11 -ms.assetid: c6bfe7c4-f452-406f-b47e-b7f0d8c44ae1 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Set up auto detection for DHCP or DNS servers using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Set up auto detection for DHCP or DNS servers using IEAK 11 -Set up your network to automatically detect and customize Internet Explorer 11 when it’s first started. Automatic detection is supported on both Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS), letting your servers detect and set up your employee’s browser settings from a central location, using a configuration URL (.ins file) or a JavaScript proxy configuration file (.js, .jvs, or .pac). - -Before you can set up your environment to use automatic detection, you need to turn the feature on. - -**To turn on the automatic detection feature** - -- Open Internet Explorer Administration Kit 11 (IEAK 11), run the IE Customization Wizard 11 and on the **Automatic Configuration** page, check **Automatically detect configuration settings**. For more information, see [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md). - -## Automatic detection on DHCP and DNS servers -Automatic detection works even if the browser wasn't originally set up or installed by the administrator. - -- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. -

          Note
          - Your DHCP servers must support the DHCPINFORM message, to obtain the DHCP options. - -- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses. To use this, you have to set up either the host record or the CNAME alias record in the DNS database file. -

          Note
          - DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. - -**To set up automatic detection for DHCP servers** - -- Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). - - **Examples:**
          - `https://www.microsoft.com/webproxy.pac`
          - `https://marketing/config.ins`
          - `https://123.4.567.8/account.pac`

          - For more detailed info about how to set up your DHCP server, see your server documentation. - -**To set up automatic detection for DNS servers** - -1. In your DNS database file, the file that’s used to associate your host (computer) names to static IP addresses in a zone, you need to create a host record named, **WPAD**. This record contains entries for all of the hosts that require static mappings, such as workstations, name servers, and mail servers. It also has the IP address to the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

          The syntax is:
          - ` IN A `
          - `corserv IN A 192.55.200.143`
          - `nameserver2 IN A 192.55.200.2`
          - `mailserver1 IN A 192.55.200.51` -

          -OR-

          - Create a canonical name (CNAME) alias record, named WPAD. This record lets you use more than one name to point to a single host, letting you host both an FTP server and a web server on the same computer. It also includes the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

          - Note
          For more info about creating a WPAD entry, see Creating a WPAD entry in DNS. - -2. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file. - -**Note**
          -IE11 creates a default URL template based on the host name,**wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to set up automatic detection for DHCP or DNS servers using IEAK 11 in your organization. +author: dansimp +ms.prod: ie11 +ms.assetid: c6bfe7c4-f452-406f-b47e-b7f0d8c44ae1 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Set up auto detection for DHCP or DNS servers using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Set up auto detection for DHCP or DNS servers using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Set up your network to automatically detect and customize Internet Explorer 11 when it’s first started. Automatic detection is supported on both Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS), letting your servers detect and set up your employee’s browser settings from a central location, using a configuration URL (.ins file) or a JavaScript proxy configuration file (.js, .jvs, or .pac). + +Before you can set up your environment to use automatic detection, you need to turn the feature on. + +**To turn on the automatic detection feature** + +- Open Internet Explorer Administration Kit 11 (IEAK 11), run the IE Customization Wizard 11 and on the **Automatic Configuration** page, check **Automatically detect configuration settings**. For more information, see [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md). + +## Automatic detection on DHCP and DNS servers +Automatic detection works even if the browser wasn't originally set up or installed by the administrator. + +- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. +

          Note
          + Your DHCP servers must support the DHCPINFORM message, to obtain the DHCP options. + +- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses. To use this, you have to set up either the host record or the CNAME alias record in the DNS database file. +

          Note
          + DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. + +**To set up automatic detection for DHCP servers** + +- Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). + + **Examples:**
          + `https://www.microsoft.com/webproxy.pac`
          + `https://marketing/config.ins`
          + `https://123.4.567.8/account.pac`

          + For more detailed info about how to set up your DHCP server, see your server documentation. + +**To set up automatic detection for DNS servers** + +1. In your DNS database file, the file that’s used to associate your host (computer) names to static IP addresses in a zone, you need to create a host record named, **WPAD**. This record contains entries for all of the hosts that require static mappings, such as workstations, name servers, and mail servers. It also has the IP address to the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

          The syntax is:
          + ` IN A `
          + `corserv IN A 192.55.200.143`
          + `nameserver2 IN A 192.55.200.2`
          + `mailserver1 IN A 192.55.200.51` +

          -OR-

          + Create a canonical name (CNAME) alias record, named WPAD. This record lets you use more than one name to point to a single host, letting you host both an FTP server and a web server on the same computer. It also includes the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

          + Note
          For more info about creating a WPAD entry, see Creating a WPAD entry in DNS. + +2. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file. + +**Note**
          +IE11 creates a default URL template based on the host name,**wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. + diff --git a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md index 9a3f704cf0..b4565ed485 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md @@ -1,48 +1,52 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Automatic Version Synchronization page in the IEAK 11 Customization Wizard to download the IE11 Setup file each time you run the Wizard. -author: lomayor -ms.prod: ie11 -ms.assetid: bfc7685f-843b-49c3-8b9b-07e69705840c -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Automatic Version Synchronization page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Automatic Version Synchronization page in the IEAK 11 Wizard -The **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 runs the synchronization process every time you run the wizard, downloading the Internet Explorer 11 Setup file to your computer. The Setup file includes the required full and express packages. - -**Important**
          -You must run the **Automatic Version Synchronization** page once for each operating system and language combination of IE. - -The **Automatic Version Synchronization** page tells you: - -- **Version available on your machine**. The version of IE11 that’s running on the computer that’s also running the IE Customization Wizard 11. - -- **Latest version available on web**. The most recently released version of the IE Customization Wizard 11. To get this value, the wizard compares the version of IE on your computer to the latest version of IE on the **Downloads** site. If the versions are different, you’ll be asked to update your version of IE. - -- **Disk space required**. The amount of space on your hard drive needed to update the browser. - -- **Disk space available**. The amount of hard drive space available on the computer that’s running the IE Customization Wizard 11. - - -**To use the Automatic Version Synchronization page** - -1. Click **Synchronize**.

          -You might receive a security warning before downloading your Setup file, asking if you want to continue. Click **Run** to continue. - -2. Click **Next** to go to the [Custom Components](custom-components-ieak11-wizard.md) page or **Back** to go to the [Feature Selection](feature-selection-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Automatic Version Synchronization page in the IEAK 11 Customization Wizard to download the IE11 Setup file each time you run the Wizard. +author: dansimp +ms.prod: ie11 +ms.assetid: bfc7685f-843b-49c3-8b9b-07e69705840c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Automatic Version Synchronization page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Automatic Version Synchronization page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 runs the synchronization process every time you run the wizard, downloading the Internet Explorer 11 Setup file to your computer. The Setup file includes the required full and express packages. + +**Important**
          +You must run the **Automatic Version Synchronization** page once for each operating system and language combination of IE. + +The **Automatic Version Synchronization** page tells you: + +- **Version available on your machine**. The version of IE11 that’s running on the computer that’s also running the IE Customization Wizard 11. + +- **Latest version available on web**. The most recently released version of the IE Customization Wizard 11. To get this value, the wizard compares the version of IE on your computer to the latest version of IE on the **Downloads** site. If the versions are different, you’ll be asked to update your version of IE. + +- **Disk space required**. The amount of space on your hard drive needed to update the browser. + +- **Disk space available**. The amount of hard drive space available on the computer that’s running the IE Customization Wizard 11. + + +**To use the Automatic Version Synchronization page** + +1. Click **Synchronize**.

          +You might receive a security warning before downloading your Setup file, asking if you want to continue. Click **Run** to continue. + +2. Click **Next** to go to the [Custom Components](custom-components-ieak11-wizard.md) page or **Back** to go to the [Feature Selection](feature-selection-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md index 9bea8f5c1c..7271837b2e 100644 --- a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md @@ -1,39 +1,43 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: A list of steps to follow before you start to create your custom browser installation packages. -author: lomayor -ms.author: lomayor -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: 6ed182b0-46cb-4865-9563-70825be9a5e4 -ms.reviewer: -audience: itpro manager: dansimp -title: Before you start using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 04/24/2018 ---- - - -# Before you start using IEAK 11 - -Before you run IEAK 11 and the Customization Wizard, make sure you have met the following requirements: - -- Have you determined which licensing version of the Internet Explorer Administration Kit 11 to install? For info, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). - -- Do you meet the necessary hardware and software requirements? See [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md). - -- Have you gotten all of the URLs needed to customize your **Home**, **Search**, and **Support** pages? See [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md). - -- Have you reviewed the security features to determine how to set up and manage them? See [Security features and IEAK 11](security-and-ieak11.md). - -- Have you created a test lab, where you can run the test version of your browser package to make sure it runs properly? - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: A list of steps to follow before you start to create your custom browser installation packages. +author: dansimp +ms.author: dansimp +ms.manager: elizapo +ms.prod: ie11 +ms.assetid: 6ed182b0-46cb-4865-9563-70825be9a5e4 +ms.reviewer: +audience: itpro +manager: dansimp +title: Before you start using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 04/24/2018 +--- + + +# Before you start using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Before you run IEAK 11 and the Customization Wizard, make sure you have met the following requirements: + +- Have you determined which licensing version of the Internet Explorer Administration Kit 11 to install? For info, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). + +- Do you meet the necessary hardware and software requirements? See [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md). + +- Have you gotten all of the URLs needed to customize your **Home**, **Search**, and **Support** pages? See [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md). + +- Have you reviewed the security features to determine how to set up and manage them? See [Security features and IEAK 11](security-and-ieak11.md). + +- Have you created a test lab, where you can run the test version of your browser package to make sure it runs properly? + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md index 7f9c6d989e..351b1bbb76 100644 --- a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md @@ -1,54 +1,58 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Branding\] .INS file setting to set up your custom branding and setup info in your browser install package. -author: lomayor -ms.prod: ie11 -ms.assetid: cde600c6-29cf-4bd3-afd1-21563d2642df -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Branding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Branding .INS file to create custom branding and setup info -Info about the custom branding and setup information in your browser package. - -|Name |Value | Description | -|-----------|--------------------------------|--------------------------------------------------------------| -|Add on URL | `` |The add-on URL for the product updates command in the browser.| -|BrowserDefault|

          • **0.** Locks down Internet Explorer as the default browser.
          • **1.** Preserves the existing default browser.
          • **2.** Lets the employee decide the default browser.
          | Determines the default browser behavior. | -|CMBitmapName | `` | The file name for the Connection Manager custom bitmap. | -|CMBitmapPath | `` | The full file path to the Connection Manager custom bitmap file. | -|CMProfileName| `` | The name of the Connection Manager profile. | -|CMProfilePath| `` | The full file path to the Connection Manager profile. | -|CMUseCustom |
          • **0.** Don’t use a custom Connection Manager profile.
          • **1.** Use a custom Connection Manager profile.
          | Determines whether to use a custom Connection Manager profile. | -|CompanyName |`` |The name of the company with a valid IEAK 11 license, building this .ins file. | -|EncodeFavs |
          • **0.** Don’t encode the section.
          • **1.** Encode the section.
          |Determines whether to encode the **[Favorites]** section for versions of IE earlier than 5.0. | -|FavoritesDelete |*hexadecimal:* `0x89` |Lets you remove all existing Favorites and Quick Links. | -|FavoritesOnTop |
          • **0.** Don’t put the new item at the top of the **Favorites** menu.
          • **1.** Put the new item at the top of the **Favorites** menu.
          |Determines whether to put new favorite items at the top of the menu. | -|IE4 Welcome Msg |
          • **0.** Don’t go to a **Welcome** page the first time the browser is opened.
          • **1.** Go to a **Welcome** page the first time the browser is opened.
          |Determines whether a **Welcome** page appears. | -|Language ID |`` |Code value for the language used. | -|Language Locale |`` |The locale of the version of IE being customized, as denoted by a four-letter string — for example, EN-us for English. | -|NoIELite |
          • **0.** Don’t optimize the Active Setup Wizard.
          • **1.** Optimize the Active Setup Wizard for download, using existing files, as possible.
          |Determines whether to optimize the Active Setup Wizard for download. | -|SilentInstall |
          • **0.** Run Windows Update Setup interactively.
          • **1.** Run Windows Update Setup non-interactively, but show progress and error messages to the employee.
          |Determines whether Windows Update Setup runs interactively on the employee’s computer.

          **Note**
          This only appears for the **Internal** version of the IEAK 11. | -|StealthInstall |

          • **0.** Run Windows Update Setup showing progress and error messages to the employee.
          • **1.** Run Windows Update Setup without showing error messages to the employee.
          |Determines whether Windows Update Setup shows error messages and dialog boxes.

          **Note**
          This only appears for the **Internal** version of the IEAK 11. | -|Toolbar Bitmap |`` |Full path to the icon bitmap that appears on the browser toolbar. | -|Type |

          • **1.** Internal version. For use on a corporate intranet or network.
          • **2.** External version. For use by ISPs, ICPs, or Developers.
          |The version of IEAK 11 being used. | -|User Agent |`` |String to be appended to the default User Agent string. | -|Version |`` |Version number of the browser. For example, `6,0,0,1`. | -|WebIntegrated |
          • **0.** Don’t include the 4.x integrated shell in your custom package.
          • **1.** Include the 4.x integrated shell in your custom package.
          |Determines whether the IE 4.x integrated shell is included in this package. | -|Win32DownloadSite |`` |URL from where your employees will download the IEsetup.exe file. | -|Window_Title |`` |Customized window title for IE. | -|Window_Title_CN |`` |Company name to be appended to the window title. | -|WizardVersion |`` |Version of the IEAK that created the .ins file. For example, `6.00.0707.2800`. | - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[Branding\] .INS file setting to set up your custom branding and setup info in your browser install package. +author: dansimp +ms.prod: ie11 +ms.assetid: cde600c6-29cf-4bd3-afd1-21563d2642df +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Branding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Branding .INS file to create custom branding and setup info + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about the custom branding and setup information in your browser package. + +|Name |Value | Description | +|-----------|--------------------------------|--------------------------------------------------------------| +|Add on URL | `` |The add-on URL for the product updates command in the browser.| +|BrowserDefault|
          • **0.** Locks down Internet Explorer as the default browser.
          • **1.** Preserves the existing default browser.
          • **2.** Lets the employee decide the default browser.
          | Determines the default browser behavior. | +|CMBitmapName | `` | The file name for the Connection Manager custom bitmap. | +|CMBitmapPath | `` | The full file path to the Connection Manager custom bitmap file. | +|CMProfileName| `` | The name of the Connection Manager profile. | +|CMProfilePath| `` | The full file path to the Connection Manager profile. | +|CMUseCustom |
          • **0.** Don’t use a custom Connection Manager profile.
          • **1.** Use a custom Connection Manager profile.
          | Determines whether to use a custom Connection Manager profile. | +|CompanyName |`` |The name of the company with a valid IEAK 11 license, building this .ins file. | +|EncodeFavs |
          • **0.** Don’t encode the section.
          • **1.** Encode the section.
          |Determines whether to encode the **[Favorites]** section for versions of IE earlier than 5.0. | +|FavoritesDelete |*hexadecimal:* `0x89` |Lets you remove all existing Favorites and Quick Links. | +|FavoritesOnTop |
          • **0.** Don’t put the new item at the top of the **Favorites** menu.
          • **1.** Put the new item at the top of the **Favorites** menu.
          |Determines whether to put new favorite items at the top of the menu. | +|IE4 Welcome Msg |
          • **0.** Don’t go to a **Welcome** page the first time the browser is opened.
          • **1.** Go to a **Welcome** page the first time the browser is opened.
          |Determines whether a **Welcome** page appears. | +|Language ID |`` |Code value for the language used. | +|Language Locale |`` |The locale of the version of IE being customized, as denoted by a four-letter string — for example, EN-us for English. | +|NoIELite |
          • **0.** Don’t optimize the Active Setup Wizard.
          • **1.** Optimize the Active Setup Wizard for download, using existing files, as possible.
          |Determines whether to optimize the Active Setup Wizard for download. | +|SilentInstall |
          • **0.** Run Windows Update Setup interactively.
          • **1.** Run Windows Update Setup non-interactively, but show progress and error messages to the employee.
          |Determines whether Windows Update Setup runs interactively on the employee’s computer.

          **Note**
          This only appears for the **Internal** version of the IEAK 11. | +|StealthInstall |

          • **0.** Run Windows Update Setup showing progress and error messages to the employee.
          • **1.** Run Windows Update Setup without showing error messages to the employee.
          |Determines whether Windows Update Setup shows error messages and dialog boxes.

          **Note**
          This only appears for the **Internal** version of the IEAK 11. | +|Toolbar Bitmap |`` |Full path to the icon bitmap that appears on the browser toolbar. | +|Type |

          • **1.** Internal version. For use on a corporate intranet or network.
          • **2.** External version. For use by ISPs, ICPs, or Developers.
          |The version of IEAK 11 being used. | +|User Agent |`` |String to be appended to the default User Agent string. | +|Version |`` |Version number of the browser. For example, `6,0,0,1`. | +|WebIntegrated |
          • **0.** Don’t include the 4.x integrated shell in your custom package.
          • **1.** Include the 4.x integrated shell in your custom package.
          |Determines whether the IE 4.x integrated shell is included in this package. | +|Win32DownloadSite |`` |URL from where your employees will download the IEsetup.exe file. | +|Window_Title |`` |Customized window title for IE. | +|Window_Title_CN |`` |Company name to be appended to the window title. | +|WizardVersion |`` |Version of the IEAK that created the .ins file. For example, `6.00.0707.2800`. | + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md index ab8937ec4a..0116384f6d 100644 --- a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md @@ -1,56 +1,60 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Browser User Interface page in the IEAK 11 Customization Wizard to change the toolbar buttons and the title bar. -author: lomayor -ms.prod: ie11 -ms.assetid: c4a18dcd-2e9c-4b5b-bcc5-9b9361a79f0d -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Browser User Interface page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Browser User Interface page in the IEAK 11 Wizard -The **Browser User Interface** page of the Internet Explorer Customization Wizard 11 lets you change the toolbar buttons and the title bar text in IE. - -**Note**
          The customizations you make on this page apply only to Internet Explorer for the desktop. - - **To use the Browser User Interface page** - -1. Check the **Customize Title Bars** box so you can add your custom text to the **Title Bar Text** box.

          -The text shows up in the title bar as **IE provided by** <*your_custom_text*>. - -2. Check the **Delete existing toolbar buttons, if present** box so you can delete all of the toolbar buttons in your employee’s browser, except for the standard buttons installed with IE (which can’t be removed). - -**Note**
          Only Administrators can use this option. - -3. Click **Add** to add new toolbar buttons.

          - The **Browser Toolbar Button Information** box appears. - -4. In the **Toolbar caption** box, type the text that shows up when an employee hovers over your custom button. We recommend no more than 10 characters. - -5. In the **Toolbar action** box, browse to your script or executable file that runs when an employee clicks your custom button. - -6. In the **Toolbar icon** box, browse to the icon file that represents your button while active. This icon must be 20x20 pixels. - -7. Check the **This button should be shown on the toolbar by default** box so your custom button shows by default.

          - This box should be cleared if you want to offer a custom set of buttons, but want your employees to choose whether or not to use them. In this situation, your buttons will show up in the **Customize Toolbars** dialog box, under **Available toolbar buttons**. Your employees can get to this dialog box in IE by clicking **Tools** from the **Command Bar**, clicking **Toolbars**, and then clicking **Customize**. - -8. Click **OK.** - -9. Click **Edit** to change your custom toolbar button or **Remove** to delete the button. The removed button will disappear from your employee’s computer after you apply the updated customization. Only custom toolbar buttons can be removed. - -10. Click **Next** to go to the [Search Providers](search-providers-ieak11-wizard.md) page or **Back** to go to the [User Experience](user-experience-ieak11-wizard.md) page. - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Browser User Interface page in the IEAK 11 Customization Wizard to change the toolbar buttons and the title bar. +author: dansimp +ms.prod: ie11 +ms.assetid: c4a18dcd-2e9c-4b5b-bcc5-9b9361a79f0d +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Browser User Interface page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Browser User Interface page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Browser User Interface** page of the Internet Explorer Customization Wizard 11 lets you change the toolbar buttons and the title bar text in IE. + +**Note**
          The customizations you make on this page apply only to Internet Explorer for the desktop. + + **To use the Browser User Interface page** + +1. Check the **Customize Title Bars** box so you can add your custom text to the **Title Bar Text** box.

          +The text shows up in the title bar as **IE provided by** <*your_custom_text*>. + +2. Check the **Delete existing toolbar buttons, if present** box so you can delete all of the toolbar buttons in your employee’s browser, except for the standard buttons installed with IE (which can’t be removed). + +**Note**
          Only Administrators can use this option. + +3. Click **Add** to add new toolbar buttons.

          + The **Browser Toolbar Button Information** box appears. + +4. In the **Toolbar caption** box, type the text that shows up when an employee hovers over your custom button. We recommend no more than 10 characters. + +5. In the **Toolbar action** box, browse to your script or executable file that runs when an employee clicks your custom button. + +6. In the **Toolbar icon** box, browse to the icon file that represents your button while active. This icon must be 20x20 pixels. + +7. Check the **This button should be shown on the toolbar by default** box so your custom button shows by default.

          + This box should be cleared if you want to offer a custom set of buttons, but want your employees to choose whether or not to use them. In this situation, your buttons will show up in the **Customize Toolbars** dialog box, under **Available toolbar buttons**. Your employees can get to this dialog box in IE by clicking **Tools** from the **Command Bar**, clicking **Toolbars**, and then clicking **Customize**. + +8. Click **OK.** + +9. Click **Edit** to change your custom toolbar button or **Remove** to delete the button. The removed button will disappear from your employee’s computer after you apply the updated customization. Only custom toolbar buttons can be removed. + +10. Click **Next** to go to the [Search Providers](search-providers-ieak11-wizard.md) page or **Back** to go to the [User Experience](user-experience-ieak11-wizard.md) page. + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md index 56922b0838..05fb2324f7 100644 --- a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md @@ -1,39 +1,43 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Use the \[BrowserToolbars\] .INS file setting to customize your Internet Explorer toolbar and buttons. -author: lomayor -ms.prod: ie11 -ms.assetid: 83af0558-9df3-4c2e-9350-44f7788efa6d -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons -Info about how to customize the Internet Explorer toolbar. - -|Name |Value |Description | -|-----------|---------------------------|-------------| -|Action0 |`` |Path and file name for the executable (.exe) file that's associated with your custom toolbar button. | -|Caption0 |`` |Text that appears as the caption for your custom toolbar button. | -|DeleteButtons |

          • **0.** Don’t delete the existing custom toolbar buttons.
          • **1.** Delete the existing custom toolbar buttons.
          |Determines whether to delete the existing custom toolbar buttons. | -|HotIcon0 |`` |An icon (.ico) file that appears highlighted on the button when the pointer is moved over it. | -|Icon0 |`` |An icon (.ico) file that appears dimmed on the button when the pointer isn’t moved over it. | -|Show0 |
          • **0.** Don’t show the button by default.
          • **1.** Show the button by default.
          |Determines whether to show the new button on the toolbar by default. | -|ToolTipText0 |`` |Tooltip text for the custom toolbar button. | - -  - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Use the \[BrowserToolbars\] .INS file setting to customize your Internet Explorer toolbar and buttons. +author: dansimp +ms.prod: ie11 +ms.assetid: 83af0558-9df3-4c2e-9350-44f7788efa6d +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about how to customize the Internet Explorer toolbar. + +|Name |Value |Description | +|-----------|---------------------------|-------------| +|Action0 |`` |Path and file name for the executable (.exe) file that's associated with your custom toolbar button. | +|Caption0 |`` |Text that appears as the caption for your custom toolbar button. | +|DeleteButtons |
          • **0.** Don’t delete the existing custom toolbar buttons.
          • **1.** Delete the existing custom toolbar buttons.
          |Determines whether to delete the existing custom toolbar buttons. | +|HotIcon0 |`` |An icon (.ico) file that appears highlighted on the button when the pointer is moved over it. | +|Icon0 |`` |An icon (.ico) file that appears dimmed on the button when the pointer isn’t moved over it. | +|Show0 |
          • **0.** Don’t show the button by default.
          • **1.** Show the button by default.
          |Determines whether to show the new button on the toolbar by default. | +|ToolTipText0 |`` |Tooltip text for the custom toolbar button. | + +  + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md index d96bb1744c..3214ea32c0 100644 --- a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md @@ -2,13 +2,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: How to use the Browsing Options page in the IEAK 11 Customization Wizard to manage items in the Favorites, Favorites Bar, and Feeds section. -author: lomayor +author: dansimp ms.prod: ie11 ms.assetid: d6bd71ba-5df3-4b8c-8bb5-dcbc50fd974e ms.reviewer: audience: itpro manager: dansimp -ms.author: lomayor +ms.author: dansimp title: Use the Browsing Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Browsing Options page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Browsing Options** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you decide how you want to manage items in the **Favorites, Favorites Bar, and Feeds** section, including the Microsoft-provided default items. The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. diff --git a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md index 0d0a0bde19..321f45caf5 100644 --- a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md @@ -1,26 +1,30 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[CabSigning\] .INS file setting to customize the digital signature info for your apps. -author: lomayor -ms.prod: ie11 -ms.assetid: 098707e9-d712-4297-ac68-7d910ca8f43b -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the CabSigning .INS file to customize the digital signature info for your apps (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the CabSigning .INS file to customize the digital signature info for your apps -Info about how to customize the digital signature info for your apps. - -|Name |Value |Description | -|-----------|---------------------------|-------------| -|InfoURL |`` |URL that appears on the **Certificate** dialog box. | -|Name |`` |Company name associated with the certificate. | -|pvkFile |`` |File path to the privacy key file. | -|spcFile |`` |File path to the certificate file.| - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[CabSigning\] .INS file setting to customize the digital signature info for your apps. +author: dansimp +ms.prod: ie11 +ms.assetid: 098707e9-d712-4297-ac68-7d910ca8f43b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the CabSigning .INS file to customize the digital signature info for your apps (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the CabSigning .INS file to customize the digital signature info for your apps + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about how to customize the digital signature info for your apps. + +|Name |Value |Description | +|-----------|---------------------------|-------------| +|InfoURL |`` |URL that appears on the **Certificate** dialog box. | +|Name |`` |Company name associated with the certificate. | +|pvkFile |`` |File path to the privacy key file. | +|spcFile |`` |File path to the certificate file.| + diff --git a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md index 7e05be2556..b6138064be 100644 --- a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md @@ -1,22 +1,26 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: We’re sorry. We’ve removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 51d8f80e-93a5-41e4-9478-b8321458bc30 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Compatibility View page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Compatibility View page in the IEAK 11 Wizard -We’re sorry. We’ve changed the way Compatibility View works in Internet Explorer 11 and have removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11. For more info about the changes we’ve made to the Compatibility View functionality, see [Missing the Compatibility View Button](../ie11-deploy-guide/missing-the-compatibility-view-button.md). - -Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: We’re sorry. We’ve removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 51d8f80e-93a5-41e4-9478-b8321458bc30 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Compatibility View page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Compatibility View page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +We’re sorry. We’ve changed the way Compatibility View works in Internet Explorer 11 and have removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11. For more info about the changes we’ve made to the Compatibility View functionality, see [Missing the Compatibility View Button](../ie11-deploy-guide/missing-the-compatibility-view-button.md). + +Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. + diff --git a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md index 3fbf4b4276..e9051c955b 100644 --- a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md @@ -1,21 +1,25 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: We’re sorry. We’ve removed all of the functionality included on the **Connection Manager** page of the Internet Explorer Customization Wizard 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 1edaa7db-cf6b-4f94-b65f-0feff3d4081a -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Connection Manager page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Connection Manager page in the IEAK 11 Wizard -We're sorry. We've removed all of the functionality included on the Connection Manager page of the Internet Explorer Customization Wizard 11. - -Click **Next** to go to the [Connection Settings](connection-settings-ieak11-wizard.md) page or **Back** to go to the [Compatibility View](compat-view-ieak11-wizard.md) page. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: We’re sorry. We’ve removed all of the functionality included on the **Connection Manager** page of the Internet Explorer Customization Wizard 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 1edaa7db-cf6b-4f94-b65f-0feff3d4081a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Connection Manager page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Connection Manager page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +We're sorry. We've removed all of the functionality included on the Connection Manager page of the Internet Explorer Customization Wizard 11. + +Click **Next** to go to the [Connection Settings](connection-settings-ieak11-wizard.md) page or **Back** to go to the [Compatibility View](compat-view-ieak11-wizard.md) page. + diff --git a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md index 1d7f645f31..bc00c58bec 100644 --- a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md @@ -1,41 +1,45 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Connection Settings page in IEAK 11 Customization Wizard to import and preset connection settings on your employee’s computers. -author: lomayor -ms.prod: ie11 -ms.assetid: dc93ebf7-37dc-47c7-adc3-067d07de8b78 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Connection Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Connection Settings page in the IEAK 11 Wizard -The **Connection Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you import the connection settings from your computer, to preset the connection settings on your employee’s computers. - -**Note**
          Using the options on the **Additional Settings** page of the wizard, you can let your employees change their connection settings. For more information see the [Additional Settings](additional-settings-ieak11-wizard.md) page. You can also customize additional connection settings using the **Automatic Configuration** page in the wizard. For more information see the [Automatic Configuration](auto-config-ieak11-wizard.md) page. - -**To view your current connection settings** - -1. Open IE, click the **Tools** menu, click **Internet Options**, and then click the **Connections** tab. - -2. Click **Settings** to view your dial-up settings and click **LAN Settings** to view your network settings. - -**To use the Connection Settings page** - -1. Decide if you want to customize your connection settings. You can pick: - - - **Do not customize Connection Settings.** Pick this option if you don’t want to preset your employee’s connection settings. - - - **Import the current Connection Settings from this machine.** Pick this option to import your connection settings from your computer and use them as the preset for your employee’s connection settings. - - **Note**
          If you want to change any of your settings later, you can click **Modify Settings** to open the **Internet Properties** box, click the **Connection Settings** tab, and make your changes. - -2. Check the **Delete existing Dial-up Connection Settings** box to clear any existing settings on your employee’s computers. - -3. Click **Next** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page or **Back** to go to the [Connection Manager](connection-mgr-ieak11-wizard.md) page. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Connection Settings page in IEAK 11 Customization Wizard to import and preset connection settings on your employee’s computers. +author: dansimp +ms.prod: ie11 +ms.assetid: dc93ebf7-37dc-47c7-adc3-067d07de8b78 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Connection Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Connection Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Connection Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you import the connection settings from your computer, to preset the connection settings on your employee’s computers. + +**Note**
          Using the options on the **Additional Settings** page of the wizard, you can let your employees change their connection settings. For more information see the [Additional Settings](additional-settings-ieak11-wizard.md) page. You can also customize additional connection settings using the **Automatic Configuration** page in the wizard. For more information see the [Automatic Configuration](auto-config-ieak11-wizard.md) page. + +**To view your current connection settings** + +1. Open IE, click the **Tools** menu, click **Internet Options**, and then click the **Connections** tab. + +2. Click **Settings** to view your dial-up settings and click **LAN Settings** to view your network settings. + +**To use the Connection Settings page** + +1. Decide if you want to customize your connection settings. You can pick: + + - **Do not customize Connection Settings.** Pick this option if you don’t want to preset your employee’s connection settings. + + - **Import the current Connection Settings from this machine.** Pick this option to import your connection settings from your computer and use them as the preset for your employee’s connection settings. + + **Note**
          If you want to change any of your settings later, you can click **Modify Settings** to open the **Internet Properties** box, click the **Connection Settings** tab, and make your changes. + +2. Check the **Delete existing Dial-up Connection Settings** box to clear any existing settings on your employee’s computers. + +3. Click **Next** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page or **Back** to go to the [Connection Manager](connection-mgr-ieak11-wizard.md) page. + diff --git a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md index 2f510429c0..0e7777a64e 100644 --- a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md @@ -1,26 +1,30 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Use the \[ConnectionSettings\] .INS file setting to specify the network connection settings needed to install your custom package. -author: lomayor -ms.prod: ie11 -ms.assetid: 41410300-6ddd-43b2-b9e2-0108a2221355 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the ConnectionSettings .INS file to review the network connections for install (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the ConnectionSettings .INS file to review the network connections for install -Info about the network connection settings used to install your custom package. This section creates a common configuration on all of your employee’s computers. - -|Name |Value |Description | -|-----------|---------------------------|-------------| -|ConnectName0 |`` |Name for the connection. | -|ConnectName1 |`` |Secondary name for the connection. | -|DeleteConnectionSettings |
          • **0.** Don’t remove the connection settings during installation.
          • **1.** Remove the connection settings during installation.

            **Note**
            This only appears for the **Internal** version of the IEAK 11.

          |Determines whether to remove the existing connection settings during installation of your custom package. | -|Option |
          • **0.** Don’t let employees import connection settings.
          • **1.** Let employees import connection settings.
          |Determines whether an employee can import connection settings into the Internet Explorer Customization Wizard. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Use the \[ConnectionSettings\] .INS file setting to specify the network connection settings needed to install your custom package. +author: dansimp +ms.prod: ie11 +ms.assetid: 41410300-6ddd-43b2-b9e2-0108a2221355 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the ConnectionSettings .INS file to review the network connections for install (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the ConnectionSettings .INS file to review the network connections for install + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about the network connection settings used to install your custom package. This section creates a common configuration on all of your employee’s computers. + +|Name |Value |Description | +|-----------|---------------------------|-------------| +|ConnectName0 |`` |Name for the connection. | +|ConnectName1 |`` |Secondary name for the connection. | +|DeleteConnectionSettings |
          • **0.** Don’t remove the connection settings during installation.
          • **1.** Remove the connection settings during installation.

            **Note**
            This only appears for the **Internal** version of the IEAK 11.

          |Determines whether to remove the existing connection settings during installation of your custom package. | +|Option |
          • **0.** Don’t let employees import connection settings.
          • **1.** Let employees import connection settings.
          |Determines whether an employee can import connection settings into the Internet Explorer Customization Wizard. | + diff --git a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md index 5dab4acabf..0befbc922f 100644 --- a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md @@ -1,24 +1,28 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: How to create your folder structure on the computer that you’ll use to build your custom browser package. -author: lomayor -ms.prod: ie11 -ms.assetid: e0d05a4c-099f-4f79-a069-4aa1c28a1080 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Create the build computer folder structure using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Create the build computer folder structure using IEAK 11 -Create your build environment on the computer that you’ll use to build your custom browser package. Your license agreement determines your folder structure and which version of Internet Explorer Administration Kit 11 (IEAK 11) you’ll use: **Internal** or **External**. - -|Name |Version |Description | -|-----------------|----------------------|---------------------------------------------------------| -|`\` |Internal and External |The main, placeholder folder used for all files built by IEAK or that you referenced in your custom package.| -|`\\Dist` |Internal only |Destination directory for your files. You’ll only need this folder if you’re creating your browser package on a network drive. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: How to create your folder structure on the computer that you’ll use to build your custom browser package. +author: dansimp +ms.prod: ie11 +ms.assetid: e0d05a4c-099f-4f79-a069-4aa1c28a1080 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Create the build computer folder structure using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Create the build computer folder structure using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Create your build environment on the computer that you’ll use to build your custom browser package. Your license agreement determines your folder structure and which version of Internet Explorer Administration Kit 11 (IEAK 11) you’ll use: **Internal** or **External**. + +|Name |Version |Description | +|-----------------|----------------------|---------------------------------------------------------| +|`\` |Internal and External |The main, placeholder folder used for all files built by IEAK or that you referenced in your custom package.| +|`\\Dist` |Internal only |Destination directory for your files. You’ll only need this folder if you’re creating your browser package on a network drive. | + diff --git a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md index ee5455e665..e2a0fb48a9 100644 --- a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md @@ -1,27 +1,31 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Review this list of tasks and references before you create and deploy your Internet Explorer 11 custom install packages. -author: lomayor -ms.prod: ie11 -ms.assetid: fe71c603-bf07-41e1-a477-ade5b28c9fb3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Tasks and references to consider before creating and deploying custom packages using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Tasks and references to consider before creating and deploying custom packages using IEAK 11 -Review this list of tasks and references to help you use the Internet Explorer Administration Kit 11 (IEAK 11) to set up, deploy, and manage Internet Explorer 11 in your company. - -|Task |References | -|----------------------------------------|--------------------------------------------------------------| -|Review concepts and requirements, including info about the version and features you'll use. |
          • [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md)
          • [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md)
          • [Before you start using IEAK 11](before-you-create-custom-pkgs-ieak11.md)
          | -|Prep your environment and get all of the info you'll need for running IEAK 11 |
          • [Create the build computer folder structure using IEAK 11](create-build-folder-structure-ieak11.md)
          • [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md)
          • [Before you install your package over your network using IEAK 11](prep-network-install-with-ieak11.md)
          • [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md)
          • [Register an uninstall app for custom components using IEAK 11](register-uninstall-app-ieak11.md)
          • [Add and approve ActiveX controls using the IEAK 11](add-and-approve-activex-controls-ieak11.md)
          • [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ieak11-wizard-custom-options.md)
          • [Security features and IEAK 11](security-and-ieak11.md)
          | -|Run the Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard |
          • [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md)
          • [Use the Platform Selection page in the IEAK 11 Wizard](platform-selection-ieak11-wizard.md)
          • [Use the Language Selection page in the IEAK 11 Wizard](language-selection-ieak11-wizard.md)
          • [Use the Package Type Selection page in the IEAK 11 Wizard](pkg-type-selection-ieak11-wizard.md)
          • [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md)
          • [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](auto-version-sync-ieak11-wizard.md)
          • [Use the Custom Components page in the IEAK 11 Wizard](custom-components-ieak11-wizard.md)
          • [Use the Internal Install page in the IEAK 11 Wizard](internal-install-ieak11-wizard.md)
          • [Use the User Experience page in the IEAK 11 Wizard](user-experience-ieak11-wizard.md)
          • [Use the Browser User Interface page in the IEAK 11 Wizard](browser-ui-ieak11-wizard.md)
          • [Use the Search Providers page in the IEAK 11 Wizard](search-providers-ieak11-wizard.md)
          • [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md)
          • [Use the Accelerators page in the IEAK 11 Wizard](accelerators-ieak11-wizard.md)
          • [Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](favorites-favoritesbar-and-feeds-ieak11-wizard.md)
          • [Use the Browsing Options page in the IEAK 11 Wizard](browsing-options-ieak11-wizard.md)
          • [Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](first-run-and-welcome-page-ieak11-wizard.md)
          • [Use the Compatibility View page in the IEAK 11 Wizard](compat-view-ieak11-wizard.md)
          • [Use the Connection Manager page in the IEAK 11 Wizard](connection-mgr-ieak11-wizard.md)
          • [Use the Connection Settings page in the IEAK 11 Wizard](connection-settings-ieak11-wizard.md)
          • [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md)
          • [Use the Proxy Settings page in the IEAK 11 Wizard](proxy-settings-ieak11-wizard.md)
          • [Use the Security and Privacy Settings page in the IEAK 11 Wizard](security-and-privacy-settings-ieak11-wizard.md)
          • [Use the Add a Root Certificate page in the IEAK 11 Wizard](add-root-certificate-ieak11-wizard.md)
          • [Use the Programs page in the IEAK 11 Wizard](programs-ieak11-wizard.md)
          • [Use the Additional Settings page in the IEAK 11 Wizard](additional-settings-ieak11-wizard.md)
          • [Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](wizard-complete-ieak11-wizard.md)
          | -|Review your policy settings and create multiple versions of your install package. |
          • [Create multiple versions of your custom package using IEAK 11](create-multiple-browser-packages-ieak11.md)
          • [Use the RSoP snap-in to review policy settings](rsop-snapin-for-policy-settings-ieak11.md)

            **Note**
            For deployment instructions, additional troubleshooting, and post-installation management, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)

          | -|Review the general IEAK Customization Wizard 11 information, which applies throughout the process. |
          • [Troubleshoot custom package and IEAK 11 problems](troubleshooting-custom-browser-pkg-ieak11.md)
          • [File types used or created by IEAK 11](file-types-ieak11.md)
          • [Customize Automatic Search using IEAK 11](customize-automatic-search-for-ie.md)
          • [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md)
          • [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md)
          • [Use proxy auto-configuration (.pac) files with IEAK 11](proxy-auto-config-examples.md)
          • [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md)
          | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Review this list of tasks and references before you create and deploy your Internet Explorer 11 custom install packages. +author: dansimp +ms.prod: ie11 +ms.assetid: fe71c603-bf07-41e1-a477-ade5b28c9fb3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Tasks and references to consider before creating and deploying custom packages using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Tasks and references to consider before creating and deploying custom packages using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Review this list of tasks and references to help you use the Internet Explorer Administration Kit 11 (IEAK 11) to set up, deploy, and manage Internet Explorer 11 in your company. + +|Task |References | +|----------------------------------------|--------------------------------------------------------------| +|Review concepts and requirements, including info about the version and features you'll use. |
          • [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md)
          • [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md)
          • [Before you start using IEAK 11](before-you-create-custom-pkgs-ieak11.md)
          | +|Prep your environment and get all of the info you'll need for running IEAK 11 |
          • [Create the build computer folder structure using IEAK 11](create-build-folder-structure-ieak11.md)
          • [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md)
          • [Before you install your package over your network using IEAK 11](prep-network-install-with-ieak11.md)
          • [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md)
          • [Register an uninstall app for custom components using IEAK 11](register-uninstall-app-ieak11.md)
          • [Add and approve ActiveX controls using the IEAK 11](add-and-approve-activex-controls-ieak11.md)
          • [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ieak11-wizard-custom-options.md)
          • [Security features and IEAK 11](security-and-ieak11.md)
          | +|Run the Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard |
          • [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md)
          • [Use the Platform Selection page in the IEAK 11 Wizard](platform-selection-ieak11-wizard.md)
          • [Use the Language Selection page in the IEAK 11 Wizard](language-selection-ieak11-wizard.md)
          • [Use the Package Type Selection page in the IEAK 11 Wizard](pkg-type-selection-ieak11-wizard.md)
          • [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md)
          • [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](auto-version-sync-ieak11-wizard.md)
          • [Use the Custom Components page in the IEAK 11 Wizard](custom-components-ieak11-wizard.md)
          • [Use the Internal Install page in the IEAK 11 Wizard](internal-install-ieak11-wizard.md)
          • [Use the User Experience page in the IEAK 11 Wizard](user-experience-ieak11-wizard.md)
          • [Use the Browser User Interface page in the IEAK 11 Wizard](browser-ui-ieak11-wizard.md)
          • [Use the Search Providers page in the IEAK 11 Wizard](search-providers-ieak11-wizard.md)
          • [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md)
          • [Use the Accelerators page in the IEAK 11 Wizard](accelerators-ieak11-wizard.md)
          • [Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](favorites-favoritesbar-and-feeds-ieak11-wizard.md)
          • [Use the Browsing Options page in the IEAK 11 Wizard](browsing-options-ieak11-wizard.md)
          • [Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](first-run-and-welcome-page-ieak11-wizard.md)
          • [Use the Compatibility View page in the IEAK 11 Wizard](compat-view-ieak11-wizard.md)
          • [Use the Connection Manager page in the IEAK 11 Wizard](connection-mgr-ieak11-wizard.md)
          • [Use the Connection Settings page in the IEAK 11 Wizard](connection-settings-ieak11-wizard.md)
          • [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md)
          • [Use the Proxy Settings page in the IEAK 11 Wizard](proxy-settings-ieak11-wizard.md)
          • [Use the Security and Privacy Settings page in the IEAK 11 Wizard](security-and-privacy-settings-ieak11-wizard.md)
          • [Use the Add a Root Certificate page in the IEAK 11 Wizard](add-root-certificate-ieak11-wizard.md)
          • [Use the Programs page in the IEAK 11 Wizard](programs-ieak11-wizard.md)
          • [Use the Additional Settings page in the IEAK 11 Wizard](additional-settings-ieak11-wizard.md)
          • [Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](wizard-complete-ieak11-wizard.md)
          | +|Review your policy settings and create multiple versions of your install package. |
          • [Create multiple versions of your custom package using IEAK 11](create-multiple-browser-packages-ieak11.md)
          • [Use the RSoP snap-in to review policy settings](rsop-snapin-for-policy-settings-ieak11.md)

            **Note**
            For deployment instructions, additional troubleshooting, and post-installation management, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)

          | +|Review the general IEAK Customization Wizard 11 information, which applies throughout the process. |
          • [Troubleshoot custom package and IEAK 11 problems](troubleshooting-custom-browser-pkg-ieak11.md)
          • [File types used or created by IEAK 11](file-types-ieak11.md)
          • [Customize Automatic Search using IEAK 11](customize-automatic-search-for-ie.md)
          • [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md)
          • [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md)
          • [Use proxy auto-configuration (.pac) files with IEAK 11](proxy-auto-config-examples.md)
          • [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md)
          | + diff --git a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md index 896d25732d..5d88bfa81a 100644 --- a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Steps to create multiple versions of your custom browser if you support more than 1 version of Windows, more than 1 language, or have different features in each package. -author: lomayor -ms.prod: ie11 -ms.assetid: 4c5f3503-8c69-4691-ae97-1523091ab333 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Create multiple versions of your custom package using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Create multiple versions of your custom package using IEAK 11 -You'll need to create multiple versions of your custom browser package if: - -- You support more than 1 version of the Windows operating system. - -- You support more than 1 language. - -- You have custom installation packages with only minor differences. For example, having a different phone number or a different set of URLs in the **Favorites** folder. - -The Internet Explorer Customization Wizard 11 stores your original settings in the Install.ins file and will show them each time you re-open the wizard. For more info about .ins files, see [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md). - -**To create multiple versions of your browser package** - -1. Use the Internet Explorer Customization Wizard 11 to create a custom browser package. For more info about how to run the wizard, start with the [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md) topic. - -2. Go to the Cie\Custom folder and rename the Install.ins file to a name that reflects the version. Like, if you need a version for your employees in Texas, you could name the file Texas.ins. - -3. Run the wizard again, choosing the newly renamed folder as the destination directory for your output files.

          -**Important**
          Except for the **Title bar** text, **Favorites**, **Links bar**, **Home** page, and **Search bar**, we recommend that you keep all of your wizard settings the same for all of your build computers. - -4. Repeat this process until you’ve created a package for each version of your custom installation package. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Steps to create multiple versions of your custom browser if you support more than 1 version of Windows, more than 1 language, or have different features in each package. +author: dansimp +ms.prod: ie11 +ms.assetid: 4c5f3503-8c69-4691-ae97-1523091ab333 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Create multiple versions of your custom package using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Create multiple versions of your custom package using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You'll need to create multiple versions of your custom browser package if: + +- You support more than 1 version of the Windows operating system. + +- You support more than 1 language. + +- You have custom installation packages with only minor differences. For example, having a different phone number or a different set of URLs in the **Favorites** folder. + +The Internet Explorer Customization Wizard 11 stores your original settings in the Install.ins file and will show them each time you re-open the wizard. For more info about .ins files, see [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md). + +**To create multiple versions of your browser package** + +1. Use the Internet Explorer Customization Wizard 11 to create a custom browser package. For more info about how to run the wizard, start with the [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md) topic. + +2. Go to the Cie\Custom folder and rename the Install.ins file to a name that reflects the version. Like, if you need a version for your employees in Texas, you could name the file Texas.ins. + +3. Run the wizard again, choosing the newly renamed folder as the destination directory for your output files.

          +**Important**
          Except for the **Title bar** text, **Favorites**, **Links bar**, **Home** page, and **Search bar**, we recommend that you keep all of your wizard settings the same for all of your build computers. + +4. Repeat this process until you’ve created a package for each version of your custom installation package. + diff --git a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md index a74479dce6..ba3904ae39 100644 --- a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md +++ b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md @@ -1,29 +1,33 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use Setup information (.inf) files to uninstall custom components from your custom browser packages. -author: lomayor -ms.prod: ie11 -ms.assetid: 8257aa41-58de-4339-81dd-9f2ffcc10a08 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use Setup information (.inf) files to uninstall custom components (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use uninstallation .INF files to uninstall custom components -The Internet Explorer Administration Kit 11 (IEAK 11) uses Setup information (.inf) files to provide installation instructions for your custom browser packages. You can also use this file to uninstall your custom components by removing the files, registry entries, and shortcuts, and adding your custom component to the list of programs that can be uninstalled from **Uninstall or change a program**. - -**To uninstall your custom components** - -1. Open the Registry Editor and add a new key and value to:
          `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description"`

          -Where *description* is the string that’s shown in the **Uninstall or change a program** box. - -2. Add another new key and value to:
          `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString”",,"command-line"`

          -Where *command-line* is the command that’s run when the component is picked from the **Uninstall or change a program** box. - -Your uninstall script must also remove your key from under the **Uninstall** registry key, so that your component no longer appears in the **Uninstall or change a program** after uninstallation. You can also run just a section of an .inf file by using the Setupx.dll InstallHinfSection entry point. To make this work, your installation script must copy the .inf file to the Windows\Inf folder for your custom component. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use Setup information (.inf) files to uninstall custom components from your custom browser packages. +author: dansimp +ms.prod: ie11 +ms.assetid: 8257aa41-58de-4339-81dd-9f2ffcc10a08 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use Setup information (.inf) files to uninstall custom components (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use uninstallation .INF files to uninstall custom components + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The Internet Explorer Administration Kit 11 (IEAK 11) uses Setup information (.inf) files to provide installation instructions for your custom browser packages. You can also use this file to uninstall your custom components by removing the files, registry entries, and shortcuts, and adding your custom component to the list of programs that can be uninstalled from **Uninstall or change a program**. + +**To uninstall your custom components** + +1. Open the Registry Editor and add a new key and value to:
          `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description"`

          +Where *description* is the string that’s shown in the **Uninstall or change a program** box. + +2. Add another new key and value to:
          `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString”",,"command-line"`

          +Where *command-line* is the command that’s run when the component is picked from the **Uninstall or change a program** box. + +Your uninstall script must also remove your key from under the **Uninstall** registry key, so that your component no longer appears in the **Uninstall or change a program** after uninstallation. You can also run just a section of an .inf file by using the Setupx.dll InstallHinfSection entry point. To make this work, your installation script must copy the .inf file to the Windows\Inf folder for your custom component. + diff --git a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md index faf527ba94..1a981a5a16 100644 --- a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md @@ -1,60 +1,64 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Custom Components page in the IEAK 11 Customization Wizard to add additional components for your employees to install with IE. -author: lomayor -ms.prod: ie11 -ms.assetid: 38a2b90f-c324-4dc8-ad30-8cd3e3e901d7 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Custom Components page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Custom Components page in the IEAK 11 Wizard -The **Custom Components** page of the Internet Explorer Customization Wizard 11 lets you add up to 10 additional components that your employees can install at the same time they install IE. These components can be created by Microsoft or your organization as either compressed cabinet (.cab) or self-extracting executable (.exe) files. If you’re using Microsoft components, make sure you have the latest version and software patches from the [Microsoft Support](https://go.microsoft.com/fwlink/p/?LinkId=258658) site. To include Microsoft Update components, you must bundle the associated files into a custom component. - -**Important**
          You should sign any custom code that’s being downloaded over the Internet. The default settings of Internet Explorer 11 will automatically reject any unsigned code. For more info about digitally signing custom components, see [Security features and IEAK 11](security-and-ieak11.md). - -**To use the Custom Component page** - -1. Click **Add**.

          -The **Add a Custom Component** box appears. - -2. Type in the name of your component and then browse to the location of your file (either .cab or .exe). - -3. Pick when to install the component. This can be before IE, after IE, or after the computer restarts.

          -**Important**
          You should install your component before IE if you need to run a batch file to configure your employee settings. You should install your component after IE if you plan to install software updates.  - -4. Check the **Only install if IE is installed successfully** box if your component should only install if IE installs successfully. For example, if you’re installing a security update that requires IE. - -5. If your component is a .cab file, you must provide the extraction command into the **Command** box. - -6. If your component has its own globally unique identifier (GUID), replace the value in the **GUID** box. Otherwise, keep the automatically generated GUID. - -7. Describe your component using up to 511 characters in the **Description** box. - -8. Type any command-line options that need to run while installing your component into the **Parameters** box. For example, if you want your component to install silently, without prompts. For more info about using options, see [IExpress command-line options](iexpress-command-line-options.md). - -9. Type the value that Microsoft Update Setup uses to check that the component installed successfully into the **Uninstall Key** box. This check is done by comparing your value to the value in the `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ApplicationName` key. - -10. Type a numeric serial number for your component into the **Version** box, using this format: *xxxx*, *xxxxxx*, *xxxx*, *xxxx*. - -11. Click **Add**.

          -The boxes clear and you can add another component. Click **Cancel** to go back to the **Custom Components** page. - -12. Click **Edit** to change your custom component information, **Verify** to make sure the component is digitally signed, or **Remove** to delete the component from your custom installation package. - -13. Click **Next** to go to the [Internal Install](internal-install-ieak11-wizard.md) page or **Back** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Custom Components page in the IEAK 11 Customization Wizard to add additional components for your employees to install with IE. +author: dansimp +ms.prod: ie11 +ms.assetid: 38a2b90f-c324-4dc8-ad30-8cd3e3e901d7 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Custom Components page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Custom Components page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Custom Components** page of the Internet Explorer Customization Wizard 11 lets you add up to 10 additional components that your employees can install at the same time they install IE. These components can be created by Microsoft or your organization as either compressed cabinet (.cab) or self-extracting executable (.exe) files. If you’re using Microsoft components, make sure you have the latest version and software patches from the [Microsoft Support](https://go.microsoft.com/fwlink/p/?LinkId=258658) site. To include Microsoft Update components, you must bundle the associated files into a custom component. + +**Important**
          You should sign any custom code that’s being downloaded over the Internet. The default settings of Internet Explorer 11 will automatically reject any unsigned code. For more info about digitally signing custom components, see [Security features and IEAK 11](security-and-ieak11.md). + +**To use the Custom Component page** + +1. Click **Add**.

          +The **Add a Custom Component** box appears. + +2. Type in the name of your component and then browse to the location of your file (either .cab or .exe). + +3. Pick when to install the component. This can be before IE, after IE, or after the computer restarts.

          +**Important**
          You should install your component before IE if you need to run a batch file to configure your employee settings. You should install your component after IE if you plan to install software updates.  + +4. Check the **Only install if IE is installed successfully** box if your component should only install if IE installs successfully. For example, if you’re installing a security update that requires IE. + +5. If your component is a .cab file, you must provide the extraction command into the **Command** box. + +6. If your component has its own globally unique identifier (GUID), replace the value in the **GUID** box. Otherwise, keep the automatically generated GUID. + +7. Describe your component using up to 511 characters in the **Description** box. + +8. Type any command-line options that need to run while installing your component into the **Parameters** box. For example, if you want your component to install silently, without prompts. For more info about using options, see [IExpress command-line options](iexpress-command-line-options.md). + +9. Type the value that Microsoft Update Setup uses to check that the component installed successfully into the **Uninstall Key** box. This check is done by comparing your value to the value in the `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ApplicationName` key. + +10. Type a numeric serial number for your component into the **Version** box, using this format: *xxxx*, *xxxxxx*, *xxxx*, *xxxx*. + +11. Click **Add**.

          +The boxes clear and you can add another component. Click **Cancel** to go back to the **Custom Components** page. + +12. Click **Edit** to change your custom component information, **Verify** to make sure the component is digitally signed, or **Remove** to delete the component from your custom installation package. + +13. Click **Next** to go to the [Internal Install](internal-install-ieak11-wizard.md) page or **Back** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md index b40640dffa..7a5556235d 100644 --- a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md @@ -1,24 +1,28 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Use the \[CustomBranding\] .INS file setting to specify the location of your branding cabinet (.cab) file. -author: lomayor -ms.prod: ie11 -ms.assetid: 9c74e239-65c5-4aa5-812f-e0ed80c5c2b0 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the CustomBranding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the CustomBranding .INS file to create custom branding and setup info -Provide the URL to your branding cabinet (.cab) file. - - -| Name | Value | Description | -|----------|------------------|------------------------------------------------------------------------------------------------------------------------| -| Branding | `` | The location of your branding cabinet (.cab) file. For example, https://www.<your_server>.net/cabs/branding.cab. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Use the \[CustomBranding\] .INS file setting to specify the location of your branding cabinet (.cab) file. +author: dansimp +ms.prod: ie11 +ms.assetid: 9c74e239-65c5-4aa5-812f-e0ed80c5c2b0 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the CustomBranding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the CustomBranding .INS file to create custom branding and setup info + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Provide the URL to your branding cabinet (.cab) file. + + +| Name | Value | Description | +|----------|------------------|------------------------------------------------------------------------------------------------------------------------| +| Branding | `` | The location of your branding cabinet (.cab) file. For example, https://www.<your_server>.net/cabs/branding.cab. | + diff --git a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md index 5f3eac4aaa..9ed59cf64e 100644 --- a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md +++ b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md @@ -1,103 +1,107 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: manage -description: Customize Automatic Search in Internet Explorer so that your employees can type a single word into the Address box to search for frequently used pages. -author: lomayor -ms.prod: ie11 -ms.assetid: 694e2f92-5e08-49dc-b83f-677d61fa918a -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Customize Automatic Search using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Customize Automatic Search for Internet Explorer using IEAK 11 -Internet Explorer lets websites advertise any search provider that uses the open search standard described at the A9 website ( [OpenSearch 1.1 Draft 5](https://go.microsoft.com/fwlink/p/?LinkId=208582)). When IE detects new search providers, the **Search** box becomes active and adds the new providers to the drop-down list of providers. - -Using the **Administrative Templates** section of Group Policy, you can prevent the search box from appearing, you can add a list of acceptable search providers, or you can restrict your employee’s ability to add or remove search providers. - -## Automatic Search Configuration -You can customize Automatic Search so that your employees can type a single word into the **Address** box to search for frequently used pages. For example, you can let a commonly used webpage about invoices appear if an employee types *invoice* into the **Address** box, even if the URL doesn’t include the term. If a website can’t be associated with the term, or if there are multiple matches, a webpage appears showing the top search results. - -**To set up Automatic Search** - -1. Create a script (.asp) file that conditionally looks for search terms, and post it to an intranet server here: https://ieautosearch/response.asp?MT=%1&srch=%2.

          - For info about the acceptable values for the *%1* and *%2* parameters, see the [Automatic Search parameters](#automatic-search-parameters). For an example of the script file, see the [Sample Automatic Search script](#sample-automatic-search-script).

          - **Important**
          If you aren’t using IIS in your company, you’ll need to remap this URL to your script file’s location. - -2. On the **Additional Settings** page of the IEAK 11, click **Internet Settings**, and then click **Advanced Settings**. - -3. Go to the section labeled **Searching** and type *intranet* into the **Search Provider Keyword** box. - -**To redirect to a different site than the one provided by the search results** - -- In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Just go to the most likely site**. - -**To disable Automatic Search** - -- In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Do not search from the address bar**. - -### Automatic Search parameters -You must replace the Automatic Search script file parameters, *%1* and *%2* so they’re part of the actual URL. - -|Parameter |Value | -|----------|--------------------------------------------------------| -|1% |The text string typed by an employee into the **Address** bar. | -|2% |The type of search chosen by an employee. This can include:

          • **3.** Display the results and go to the most likely site.
          • **2.** Go to the most likely site.
          • **1.** Display the results in the main window.
          • **0.** Don't search from the **Address** box.
          | - -### Sample Automatic Search script -This is a VBScript-based sample of an .asp Automatic Search script. - -``` -<%@ Language=VBScript %> -<% -' search holds the words typed in the Address bar -' by the user, without the "go" or -' "find" or any delimiters like -' "+" for spaces. -' If the user typed -' "Apple pie," search = "Apple pie." -' If the user typed -' "find Apple pie," search = "Apple pie." - -search = Request.QueryString("MT") -search = UCase(search) -searchOption = Request.QueryString("srch") - -' This is a simple if/then/else -' to redirect the browser to the site -' of your choice based on what the -' user typed. -' Example: expense report is an intranet page -' about filling out an expense report - -if (search = "NEW HIRE") then -Response.Redirect("https://admin/hr/newhireforms.htm") -elseif (search = "LIBRARY CATALOG") then -Response.Redirect("https://library/catalog") -elseif (search = "EXPENSE REPORT") then -Response.Redirect("https://expense") -elseif (search = "LUNCH MENU") then -Response.Redirect("https://cafe/menu/") -else - -' If there is not a match, use the -' default IE autosearch server -Response.Redirect("https://auto.search.msn.com/response.asp?MT=" -+ search + "&srch=" + searchOption + -"&prov=&utf8") -end if -%> -``` - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: manage +description: Customize Automatic Search in Internet Explorer so that your employees can type a single word into the Address box to search for frequently used pages. +author: dansimp +ms.prod: ie11 +ms.assetid: 694e2f92-5e08-49dc-b83f-677d61fa918a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Customize Automatic Search using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Customize Automatic Search for Internet Explorer using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Internet Explorer lets websites advertise any search provider that uses the open search standard described at the A9 website ( [OpenSearch 1.1 Draft 5](https://go.microsoft.com/fwlink/p/?LinkId=208582)). When IE detects new search providers, the **Search** box becomes active and adds the new providers to the drop-down list of providers. + +Using the **Administrative Templates** section of Group Policy, you can prevent the search box from appearing, you can add a list of acceptable search providers, or you can restrict your employee’s ability to add or remove search providers. + +## Automatic Search Configuration +You can customize Automatic Search so that your employees can type a single word into the **Address** box to search for frequently used pages. For example, you can let a commonly used webpage about invoices appear if an employee types *invoice* into the **Address** box, even if the URL doesn’t include the term. If a website can’t be associated with the term, or if there are multiple matches, a webpage appears showing the top search results. + +**To set up Automatic Search** + +1. Create a script (.asp) file that conditionally looks for search terms, and post it to an intranet server here: https://ieautosearch/response.asp?MT=%1&srch=%2.

          + For info about the acceptable values for the *%1* and *%2* parameters, see the [Automatic Search parameters](#automatic-search-parameters). For an example of the script file, see the [Sample Automatic Search script](#sample-automatic-search-script).

          + **Important**
          If you aren’t using IIS in your company, you’ll need to remap this URL to your script file’s location. + +2. On the **Additional Settings** page of the IEAK 11, click **Internet Settings**, and then click **Advanced Settings**. + +3. Go to the section labeled **Searching** and type *intranet* into the **Search Provider Keyword** box. + +**To redirect to a different site than the one provided by the search results** + +- In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Just go to the most likely site**. + +**To disable Automatic Search** + +- In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Do not search from the address bar**. + +### Automatic Search parameters +You must replace the Automatic Search script file parameters, *%1* and *%2* so they’re part of the actual URL. + +|Parameter |Value | +|----------|--------------------------------------------------------| +|1% |The text string typed by an employee into the **Address** bar. | +|2% |The type of search chosen by an employee. This can include:

          • **3.** Display the results and go to the most likely site.
          • **2.** Go to the most likely site.
          • **1.** Display the results in the main window.
          • **0.** Don't search from the **Address** box.
          | + +### Sample Automatic Search script +This is a VBScript-based sample of an .asp Automatic Search script. + +``` +<%@ Language=VBScript %> +<% +' search holds the words typed in the Address bar +' by the user, without the "go" or +' "find" or any delimiters like +' "+" for spaces. +' If the user typed +' "Apple pie," search = "Apple pie." +' If the user typed +' "find Apple pie," search = "Apple pie." + +search = Request.QueryString("MT") +search = UCase(search) +searchOption = Request.QueryString("srch") + +' This is a simple if/then/else +' to redirect the browser to the site +' of your choice based on what the +' user typed. +' Example: expense report is an intranet page +' about filling out an expense report + +if (search = "NEW HIRE") then +Response.Redirect("https://admin/hr/newhireforms.htm") +elseif (search = "LIBRARY CATALOG") then +Response.Redirect("https://library/catalog") +elseif (search = "EXPENSE REPORT") then +Response.Redirect("https://expense") +elseif (search = "LUNCH MENU") then +Response.Redirect("https://cafe/menu/") +else + +' If there is not a match, use the +' default IE autosearch server +Response.Redirect("https://auto.search.msn.com/response.asp?MT=" ++ search + "&srch=" + searchOption + +"&prov=&utf8") +end if +%> +``` + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md index d3bee115a5..7d0a2f9882 100644 --- a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md @@ -1,28 +1,32 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[ExtRegInf\] .INS file setting to specify your Setup information (.inf) files and the installation mode for your custom components. -author: lomayor -ms.prod: ie11 -ms.assetid: 53148422-d784-44dc-811d-ef814b86a4c6 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the ExtRegInf .INS file to specify your installation files and mode (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the ExtRegInf .INS file to specify installation files and mode -Info about how to specify your Setup information (.inf) files and the installation mode for your custom components. - -|Name |Value |Description | -|-----------|---------|------------------------------------------------------------------------------------------------------------------| -|Chat |*string* |The name of the .inf file and the install mode for components. For example, *,chat.inf,DefaultInstall. | -|Conf |*string* |The name of the .inf file and the install mode for components. For example, *,conf.inf,DefaultInstall. | -|Inetres |*string* |The name of the .inf file and the install mode for components. For example, *,inetres.inf,DefaultInstall. | -|Inetset |*string* |The name of the .inf file and the install mode for components. For example, *,inetset.inf,DefaultInstall. | -|Subs |*string* |The name of the .inf file and the install mode for components. For example, *,subs.inf,DefaultInstall. | -|ConnectionSettings |*string* |The name of the .inf file and the install mode for components. For example, *,connect.inf,DefaultInstall. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[ExtRegInf\] .INS file setting to specify your Setup information (.inf) files and the installation mode for your custom components. +author: dansimp +ms.prod: ie11 +ms.assetid: 53148422-d784-44dc-811d-ef814b86a4c6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the ExtRegInf .INS file to specify your installation files and mode (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the ExtRegInf .INS file to specify installation files and mode + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about how to specify your Setup information (.inf) files and the installation mode for your custom components. + +|Name |Value |Description | +|-----------|---------|------------------------------------------------------------------------------------------------------------------| +|Chat |*string* |The name of the .inf file and the install mode for components. For example, *,chat.inf,DefaultInstall. | +|Conf |*string* |The name of the .inf file and the install mode for components. For example, *,conf.inf,DefaultInstall. | +|Inetres |*string* |The name of the .inf file and the install mode for components. For example, *,inetres.inf,DefaultInstall. | +|Inetset |*string* |The name of the .inf file and the install mode for components. For example, *,inetset.inf,DefaultInstall. | +|Subs |*string* |The name of the .inf file and the install mode for components. For example, *,subs.inf,DefaultInstall. | +|ConnectionSettings |*string* |The name of the .inf file and the install mode for components. For example, *,connect.inf,DefaultInstall. | + diff --git a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md index e077a6fbed..030dc054d2 100644 --- a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md @@ -1,109 +1,113 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Favorites, Favorites Bar, and Feeds page in IEAK 11 Customization Wizard to add links, web slices, and feeds to your custom browser package. -author: lomayor -ms.prod: ie11 -ms.assetid: 84afa831-5642-4b8f-b7df-212a53ec8fc7 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard -The **Favorites, Favorites Bar, and Feeds** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add: - -- **Links.** Used so your employees can quickly connect with your important websites. These links can appear in the **Links** folder or on the **Favorites Bar**. - -- **Web Slices.** Used so your employees can subscribe to a section of a webpage, tracking information as it changes, such as for weather reports, stock prices, or the progress of an auction item. - -- **Feeds.** Used so your employees can quickly access your recommended RSS feeds. While you can’t import a folder of RSS feeds, you can add new links. - -Although we provide default items in the **Favorites, Favorites Bar, and Feeds** area, you can remove any of the items, add more items, or add new folders and links as part of your custom package. The customizations you make on this page only apply to Internet Explorer for the desktop. - -**To work with Favorites** - -1. To import your existing folder of links, pick **Favorites**, and then click **Import**. - -2. Go to your existing link folder, most likely in the `\Users\\Favorites` folder, and then click **OK**.

          -The links are imported and added to the **Favorites, Favorites Bar, and Feeds** page, beneath the **Favorites** folder. - -3. To add a new favorite link, pick **Favorites**, and then click **Add URL**.

          -The **Details** box appears. - -4. Type the new link name in the **Name** box. - -5. Type the new URL in the **URL** box. - -6. Optionally, you can add a 16x16 pixel icon to your link by adding the location in the **Icon** box. - -7. Click **OK**. - -8. To add a new **Favorites** folder, pick **Favorites**, and then click **Add Folder**.

          -The **Details** box appears. - -9. Type the folder name into the **Name** box, and then click **OK**. - -10. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **Favorites** item. - -11. If you have multiple **Favorites** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. - -12. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. - -13. Continue with the next procedures in this topic to add additional **Favorites Bar** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. - -**To work with the Favorites Bar** - -1. To import your existing folder of links, pick **Favorites Bar**, and then click **Import**. - -2. Go to your existing link folder, most likely in the `\Users\\Favorites\Favorites Bar` folder, and then click **OK**.

          -The links are imported and added to the **Favorites, Favorites Bar, and Feeds** page, beneath the **Favorites Bar** folder. - -3. To add a new link to the **Favorites Bar**, pick **Favorites Bar**, and then click **Add URL**.

          -The **Details** box appears. - -4. Type the new quick link name in the **Name** box. - -5. Type the new URL in the **URL** box. - -6. Optionally, you can add a 16x16 pixel icon to your link by adding the location in the **Icon** box. - -7. Pick whether your link is a simple **Link**, a **Feed**, or a **Web Slice**, and then click **OK**. - -8. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **Favorites Bar** item. - -9. If you have multiple **Favorites Bar** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. - -10. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. - -11. Continue with the next procedures in this topic to add additional **Favorites** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. - -**To work with RSS Feeds** - -1. To add a new link to the **RSS Feeds**, pick **Favorites Bar**, and then click **Add URL**.

          -The **Details** box appears. - -2. Type the new link name in the **Name** box. - -3. Type the new URL in the **URL** box, and then click **OK**. - -4. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **RSS Feeds** item. - -5. If you have multiple **RSS Feeds** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. - -6. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. - -7. Continue with the next procedures in this topic to add additional **Favorites** or **Favorites Bar** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Favorites, Favorites Bar, and Feeds page in IEAK 11 Customization Wizard to add links, web slices, and feeds to your custom browser package. +author: dansimp +ms.prod: ie11 +ms.assetid: 84afa831-5642-4b8f-b7df-212a53ec8fc7 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Favorites, Favorites Bar, and Feeds** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add: + +- **Links.** Used so your employees can quickly connect with your important websites. These links can appear in the **Links** folder or on the **Favorites Bar**. + +- **Web Slices.** Used so your employees can subscribe to a section of a webpage, tracking information as it changes, such as for weather reports, stock prices, or the progress of an auction item. + +- **Feeds.** Used so your employees can quickly access your recommended RSS feeds. While you can’t import a folder of RSS feeds, you can add new links. + +Although we provide default items in the **Favorites, Favorites Bar, and Feeds** area, you can remove any of the items, add more items, or add new folders and links as part of your custom package. The customizations you make on this page only apply to Internet Explorer for the desktop. + +**To work with Favorites** + +1. To import your existing folder of links, pick **Favorites**, and then click **Import**. + +2. Go to your existing link folder, most likely in the `\Users\\Favorites` folder, and then click **OK**.

          +The links are imported and added to the **Favorites, Favorites Bar, and Feeds** page, beneath the **Favorites** folder. + +3. To add a new favorite link, pick **Favorites**, and then click **Add URL**.

          +The **Details** box appears. + +4. Type the new link name in the **Name** box. + +5. Type the new URL in the **URL** box. + +6. Optionally, you can add a 16x16 pixel icon to your link by adding the location in the **Icon** box. + +7. Click **OK**. + +8. To add a new **Favorites** folder, pick **Favorites**, and then click **Add Folder**.

          +The **Details** box appears. + +9. Type the folder name into the **Name** box, and then click **OK**. + +10. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **Favorites** item. + +11. If you have multiple **Favorites** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. + +12. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. + +13. Continue with the next procedures in this topic to add additional **Favorites Bar** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. + +**To work with the Favorites Bar** + +1. To import your existing folder of links, pick **Favorites Bar**, and then click **Import**. + +2. Go to your existing link folder, most likely in the `\Users\\Favorites\Favorites Bar` folder, and then click **OK**.

          +The links are imported and added to the **Favorites, Favorites Bar, and Feeds** page, beneath the **Favorites Bar** folder. + +3. To add a new link to the **Favorites Bar**, pick **Favorites Bar**, and then click **Add URL**.

          +The **Details** box appears. + +4. Type the new quick link name in the **Name** box. + +5. Type the new URL in the **URL** box. + +6. Optionally, you can add a 16x16 pixel icon to your link by adding the location in the **Icon** box. + +7. Pick whether your link is a simple **Link**, a **Feed**, or a **Web Slice**, and then click **OK**. + +8. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **Favorites Bar** item. + +9. If you have multiple **Favorites Bar** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. + +10. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. + +11. Continue with the next procedures in this topic to add additional **Favorites** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. + +**To work with RSS Feeds** + +1. To add a new link to the **RSS Feeds**, pick **Favorites Bar**, and then click **Add URL**.

          +The **Details** box appears. + +2. Type the new link name in the **Name** box. + +3. Type the new URL in the **URL** box, and then click **OK**. + +4. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **RSS Feeds** item. + +5. If you have multiple **RSS Feeds** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. + +6. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. + +7. Continue with the next procedures in this topic to add additional **Favorites** or **Favorites Bar** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md index cd9cbf7a91..ac736e20df 100644 --- a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md @@ -1,26 +1,30 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[FavoritesEx\] .INS file setting to specify your Favorites icon file, whether Favorites is available offline, and your Favorites URLs. -author: lomayor -ms.prod: ie11 -ms.assetid: 55de376a-d442-478e-8978-3b064407b631 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the FavoritesEx .INS file for your Favorites icon and URLs (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the FavoritesEx .INS file for your Favorites icon and URLs -Info about where you store your **Favorites** icon file, whether your **Favorites** are available offline, and the URLs for each **Favorites** site. - -|Name |Value |Description | -|----------------|-----------------------|--------------------------------------------------------------------------| -|IconFile1 |`` |An icon (.ico file) that represents the **Favorites** item you’re adding. | -|Offline1 |

          • **0.** Makes the **Favorites** item unavailable for offline browsing.
          • **1.** Makes the **Favorites** item available for offline browsing.
          |Determines if the **Favorites** item is available for offline browsing. | -|Title1 |`` |Title for the **Favorites** item. | -|Url1 |`` |URL to the **Favorites** item. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[FavoritesEx\] .INS file setting to specify your Favorites icon file, whether Favorites is available offline, and your Favorites URLs. +author: dansimp +ms.prod: ie11 +ms.assetid: 55de376a-d442-478e-8978-3b064407b631 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the FavoritesEx .INS file for your Favorites icon and URLs (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the FavoritesEx .INS file for your Favorites icon and URLs + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about where you store your **Favorites** icon file, whether your **Favorites** are available offline, and the URLs for each **Favorites** site. + +|Name |Value |Description | +|----------------|-----------------------|--------------------------------------------------------------------------| +|IconFile1 |`` |An icon (.ico file) that represents the **Favorites** item you’re adding. | +|Offline1 |
          • **0.** Makes the **Favorites** item unavailable for offline browsing.
          • **1.** Makes the **Favorites** item available for offline browsing.
          |Determines if the **Favorites** item is available for offline browsing. | +|Title1 |`` |Title for the **Favorites** item. | +|Url1 |`` |URL to the **Favorites** item. | + diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md index 78294cd509..f72747f486 100644 --- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md @@ -1,64 +1,67 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company. -author: lomayor -ms.prod: ie11 -ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Feature Selection page in the IEAK 11 Wizard -The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: - -- **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. - -- **Internal Install.** Lets you decide to install the latest updates, run the malicious Software Removal Tool, and set IE11 as the default browser. - -- **Connection Manager.** Lets you import your Connection Manager Profiles, created by the Connection Manager Administration Kit (CMAK). - -- **Browser User Interface.** Lets you change the toolbar buttons, the title bar, and the general look of the browser. - -- **Search Providers.** Lets you add, remove, and pick a new default search provider for IE11. - -- **Important URLs – Home Page and Support.** Lets you choose multiple **Home** pages that open in different tabs in IE. You can also use this page to change the **Welcome** and **Online Support** pages. - -- **Accelerators.** Lets you import, add, edit, or remove Accelerators, the contextual services that give you quick access to external services from any webpage. - -- **Favorites, Favorites Bar, and Feeds.** Lets you pick which favorites, web slices, and feeds are installed with your custom installation package. - -- **Browsing Options.** Lets you pick how you delete items in the Favorites, Favorites Bar, and Feeds folders, and whether to add the Microsoft default items. - -- **Compatibility View.** Lets you decide whether IE renders content using compatibility mode or standards mode. - -- **Connections Customization.** Lets you set up and deploy custom connections. - -- **Security Zones and Content Ratings.** Lets you control what your employees can view and what’s downloaded to their computer. - -- **Programs.** Lets you pick the default program that’s used automatically by email, HTML, newsgroups, Internet calls, calendars, and contact lists. - -- **Additional Settings.** Lets you pre-set and lockdown specific functionality on your employee’s computer. - -**Note**
          Your choices on this page determine what wizard pages appear. - -**To use the Feature Selection page** - -1. Check the box next to each feature you want to include in your custom installation package.

          -You can also click **Select All** to add, or **Clear All** to remove, all of the features. - -2. Click **Next** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page or **Back** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company. +author: dansimp +ms.prod: ie11 +ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +--- + + +# Use the Feature Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: + +- **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. + +- **Internal Install.** Lets you decide to install the latest updates, run the malicious Software Removal Tool, and set IE11 as the default browser. + +- **Connection Manager.** Lets you import your Connection Manager Profiles, created by the Connection Manager Administration Kit (CMAK). + +- **Browser User Interface.** Lets you change the toolbar buttons, the title bar, and the general look of the browser. + +- **Search Providers.** Lets you add, remove, and pick a new default search provider for IE11. + +- **Important URLs – Home Page and Support.** Lets you choose multiple **Home** pages that open in different tabs in IE. You can also use this page to change the **Welcome** and **Online Support** pages. + +- **Accelerators.** Lets you import, add, edit, or remove Accelerators, the contextual services that give you quick access to external services from any webpage. + +- **Favorites, Favorites Bar, and Feeds.** Lets you pick which favorites, web slices, and feeds are installed with your custom installation package. + +- **Browsing Options.** Lets you pick how you delete items in the Favorites, Favorites Bar, and Feeds folders, and whether to add the Microsoft default items. + +- **Compatibility View.** Lets you decide whether IE renders content using compatibility mode or standards mode. + +- **Connections Customization.** Lets you set up and deploy custom connections. + +- **Security Zones and Content Ratings.** Lets you control what your employees can view and what’s downloaded to their computer. + +- **Programs.** Lets you pick the default program that’s used automatically by email, HTML, newsgroups, Internet calls, calendars, and contact lists. + +- **Additional Settings.** Lets you pre-set and lockdown specific functionality on your employee’s computer. + +**Note**
          Your choices on this page determine what wizard pages appear. + +**To use the Feature Selection page** + +1. Check the box next to each feature you want to include in your custom installation package.

          +You can also click **Select All** to add, or **Clear All** to remove, all of the features. + +2. Click **Next** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page or **Back** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md index 2fa0b58cc8..0aee908cd4 100644 --- a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md @@ -1,55 +1,59 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the File Locations page in the IEAK 11 Customization Wizard to change the location of your install package and IE11 folders. -author: lomayor -ms.prod: ie11 -ms.assetid: bd0620e1-0e07-4560-95ac-11888c2c389e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the File Locations page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the File Locations page in the IEAK 11 Wizard -The **File Locations** page of the Internet Explorer Customization Wizard 11 lets you change the location of your folders, including: - -- Where you’ll create and store your custom installation package. - -- Where you’ll download and store Internet Explorer 11. - -**Important**
          -You can create a custom installation package on your hard drive and move it to an Internet or intranet server, or you can create it directly on a server. If you create the package on a web server that’s running from your hard drive, use the path to the web server as the destination folder location. Whatever location you choose, it must be protected by appropriate access control lists (ACLs). If the location is not protected, the custom package may be tampered with. - -**To use the File Locations page** - -1. Browse to the location where you’ll store your finished custom IE installation package and the related subfolders.

          -**Note**
          Subfolders are created for each language version, based on operating system and media type. For example, if your destination folder is `C:\Inetpub\Wwwroot\Cie\Dist`, then the English-language version is created as `C:\Inetpub\Wwwroot\Cie\Dist\Flat\Win32\En` subfolders. - -2. Click **Advanced Options**.

          -The **Advanced Options** box opens and lets you change how the wizard downloads and gets files, and how it imports settings from your .ins file. - -3. Check the box letting IE Customization Wizard 11 look for the latest components, using Automatic Version Synchronization.

          -This option lets the wizard connect to the IE **Downloads** page to look for updated versions of IE since you last ran the wizard.

          -**Important**
          -You must run Automatic Version Synchronization at least once to check for updated components. - -4. Browse to your .ins file location, and then click **Open**.

          -By importing settings from an .ins file, you can re-use existing configurations. This saves you time if your packages have the same or similar settings. - -5. Browse to your component download folder.

          -Automatic Version Synchronization automatically checks the component download folder to see if you have the latest version of IE. To keep this folder up-to-date, you shouldn’t change its location. However, if you want to keep both a previous version of IE and the latest version, we recommend you download the components to a different location. - -6. Click **OK** to close the **Advanced Options** box, and then click **Next** to go to the [Platform Selection](platform-selection-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the File Locations page in the IEAK 11 Customization Wizard to change the location of your install package and IE11 folders. +author: dansimp +ms.prod: ie11 +ms.assetid: bd0620e1-0e07-4560-95ac-11888c2c389e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the File Locations page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the File Locations page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **File Locations** page of the Internet Explorer Customization Wizard 11 lets you change the location of your folders, including: + +- Where you’ll create and store your custom installation package. + +- Where you’ll download and store Internet Explorer 11. + +**Important**
          +You can create a custom installation package on your hard drive and move it to an Internet or intranet server, or you can create it directly on a server. If you create the package on a web server that’s running from your hard drive, use the path to the web server as the destination folder location. Whatever location you choose, it must be protected by appropriate access control lists (ACLs). If the location is not protected, the custom package may be tampered with. + +**To use the File Locations page** + +1. Browse to the location where you’ll store your finished custom IE installation package and the related subfolders.

          +**Note**
          Subfolders are created for each language version, based on operating system and media type. For example, if your destination folder is `C:\Inetpub\Wwwroot\Cie\Dist`, then the English-language version is created as `C:\Inetpub\Wwwroot\Cie\Dist\Flat\Win32\En` subfolders. + +2. Click **Advanced Options**.

          +The **Advanced Options** box opens and lets you change how the wizard downloads and gets files, and how it imports settings from your .ins file. + +3. Check the box letting IE Customization Wizard 11 look for the latest components, using Automatic Version Synchronization.

          +This option lets the wizard connect to the IE **Downloads** page to look for updated versions of IE since you last ran the wizard.

          +**Important**
          +You must run Automatic Version Synchronization at least once to check for updated components. + +4. Browse to your .ins file location, and then click **Open**.

          +By importing settings from an .ins file, you can re-use existing configurations. This saves you time if your packages have the same or similar settings. + +5. Browse to your component download folder.

          +Automatic Version Synchronization automatically checks the component download folder to see if you have the latest version of IE. To keep this folder up-to-date, you shouldn’t change its location. However, if you want to keep both a previous version of IE and the latest version, we recommend you download the components to a different location. + +6. Click **OK** to close the **Advanced Options** box, and then click **Next** to go to the [Platform Selection](platform-selection-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md index 5dd8eff9da..616e3b9938 100644 --- a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md @@ -1,37 +1,41 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Review the file types that are created and used by tools in the Internet Explorer Administration Kit 11 (IEAK 11). -author: lomayor -ms.prod: ie11 -ms.assetid: e5735074-3e9b-4a00-b1a7-b8fd8baca327 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: File types used or created by IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# File types used or created by IEAK 11 -A list of the file types used or created by tools in IEAK 11: - -|File type |Description | -|----------|-------------------------| -|.adm | An admin file (located at `:\Program Files\Windows IEAK 11\policies`), used by Group Policy to define the system policies and restrictions for Windows. You can use the IEAK 11 to change these settings. | -|.bat |An ASCII text file that contains a sequence of operating system commands, including the parameters and operators supported by the batch command language. When you run the batch file from a command prompt, the computer processes each command sequentially. | -|.bmp, .gif, .jpeg, and .jpg |Image files you can use to customize your toolbar button and favorites list icons. For info, see the [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md) page. | -|.cab |A compressed cabinet (.cab) file, created by the Internet Explorer Customization Wizard 11 to store your custom component files. We highly recommend that your .cab files be signed for security purposes. For more info, see the [Security features and IEAK 11](security-and-ieak11.md) page. | -|.cif |A component info file (IESetup.cif), identifying the new or updated components you're going to install with Internet Explorer. Each component file has an associated *ComponentID* that's used by Windows Update Setup to determine whether a new component or an update exists. | -|.cmp |Connection profile files that are created by the Connection Manager Administration Kit (CMAK). | -|.cms |Service provider files, created by the CMAK tool to specify the configuration of the phone book and many of the other functions of your service profiles. | -|.exe |Executable files that control the setup process, by installing the .cab files that install the custom browser package on your employee's devices. | -|.inf |Setup information files that provide installation instructions for your custom browser packages. For more info, see the [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md) page. | -|.ins |Internet Settings files that specify how to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. For more info, see the [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md) page. | -|.pac |Proxy auto-configuration script files that determine whether to connect directly to a host or to use a proxy server. For more info, see the [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md) page. | -|.js and .jvs |JScript and JavaScript files that let you configure and maintain your advanced proxy settings. For more info, see the [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md) page. | -|.pvk |A file format used by some certification authorities to store the private key of the digital certificate. The public part of the digital certificate is stored in an SPC file, while the private part is stored in the PVK file. For more info, see the **Understanding certificates** section of the [Security features and IEAK 11](security-and-ieak11.md) page. | -|.sed |Connection profile files, created by the CMAK tool, including the instructions for building the self-extracting executable (.exe) file for your service profiles.

          **Important**
          You must never edit a .sed file. | -|.spc |The software publishing certificate file, which includes:

          • The name and other identifying information of the owner of the certificate.
          • The public key associated with the certificate.
          • The serial number.
          • The length of time the certificate is valid.
          • The digital signature of the certification authority that issued the certificate.
          | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Review the file types that are created and used by tools in the Internet Explorer Administration Kit 11 (IEAK 11). +author: dansimp +ms.prod: ie11 +ms.assetid: e5735074-3e9b-4a00-b1a7-b8fd8baca327 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: File types used or created by IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# File types used or created by IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +A list of the file types used or created by tools in IEAK 11: + +|File type |Description | +|----------|-------------------------| +|.adm | An admin file (located at `:\Program Files\Windows IEAK 11\policies`), used by Group Policy to define the system policies and restrictions for Windows. You can use the IEAK 11 to change these settings. | +|.bat |An ASCII text file that contains a sequence of operating system commands, including the parameters and operators supported by the batch command language. When you run the batch file from a command prompt, the computer processes each command sequentially. | +|.bmp, .gif, .jpeg, and .jpg |Image files you can use to customize your toolbar button and favorites list icons. For info, see the [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md) page. | +|.cab |A compressed cabinet (.cab) file, created by the Internet Explorer Customization Wizard 11 to store your custom component files. We highly recommend that your .cab files be signed for security purposes. For more info, see the [Security features and IEAK 11](security-and-ieak11.md) page. | +|.cif |A component info file (IESetup.cif), identifying the new or updated components you're going to install with Internet Explorer. Each component file has an associated *ComponentID* that's used by Windows Update Setup to determine whether a new component or an update exists. | +|.cmp |Connection profile files that are created by the Connection Manager Administration Kit (CMAK). | +|.cms |Service provider files, created by the CMAK tool to specify the configuration of the phone book and many of the other functions of your service profiles. | +|.exe |Executable files that control the setup process, by installing the .cab files that install the custom browser package on your employee's devices. | +|.inf |Setup information files that provide installation instructions for your custom browser packages. For more info, see the [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md) page. | +|.ins |Internet Settings files that specify how to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. For more info, see the [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md) page. | +|.pac |Proxy auto-configuration script files that determine whether to connect directly to a host or to use a proxy server. For more info, see the [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md) page. | +|.js and .jvs |JScript and JavaScript files that let you configure and maintain your advanced proxy settings. For more info, see the [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md) page. | +|.pvk |A file format used by some certification authorities to store the private key of the digital certificate. The public part of the digital certificate is stored in an SPC file, while the private part is stored in the PVK file. For more info, see the **Understanding certificates** section of the [Security features and IEAK 11](security-and-ieak11.md) page. | +|.sed |Connection profile files, created by the CMAK tool, including the instructions for building the self-extracting executable (.exe) file for your service profiles.

          **Important**
          You must never edit a .sed file. | +|.spc |The software publishing certificate file, which includes:

          • The name and other identifying information of the owner of the certificate.
          • The public key associated with the certificate.
          • The serial number.
          • The length of time the certificate is valid.
          • The digital signature of the certification authority that issued the certificate.
          | + diff --git a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md index 68b255a273..9d6fe74f8a 100644 --- a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md @@ -1,44 +1,48 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the First Run Wizard and Welcome Page Options page in the IEAK 11 Customization Wizard to set what your employee’s see the first time they log on to IE, based on their operating system. -author: lomayor -ms.prod: ie11 -ms.assetid: 85f856a6-b707-48a9-ba99-3a6e898276a9 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard -The **First Run Wizard and Welcome Page Options** page of the Internet Explorer Customization Wizard 11 lets you decide what your employee’s see the first time they log on to IE, based on their operating system. - -- **Windows 8.1 Update and newer.** No longer includes a **Welcome** page, so if you pick the **Use Internet Explorer 11 Welcome Page** or the **Use a custom Welcome page** option, IEAK creates an initial **Home** page that loads before all other **Home** pages, as the first tab. This only applies to the Internet Explorer for the desktop. - -- **Windows 7 SP1.** You can disable the first run page for Windows 7 SP1 and then pick a custom **Welcome** page to show instead. If you don’t customize the settings on this page, your employees will see the default IE **Welcome** page. - -**To use the First Run Wizard and Welcome Page Options page** - -1. Check the **Use IE11 First Run wizard (recommended)** box to use the default First Run wizard in IE.

          -Clearing this box lets you use the IE11 **Welcome** page or your custom **Welcome** page. - -2. If you cleared the First Run wizard box, you can decide which **Welcome** page to use: - - - **Use IE11 Welcome Page.** Check this box if you want to use the default IE11 **Welcome** page. - - - **Use a custom Welcome Page.** Check this box if you want to use a custom **Welcome** page. If you choose this option, you need to add the URL to your custom page. - -3. Click **Next** to go to the [Compatibility View](compat-view-ieak11-wizard.md) page or **Back** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the First Run Wizard and Welcome Page Options page in the IEAK 11 Customization Wizard to set what your employee’s see the first time they log on to IE, based on their operating system. +author: dansimp +ms.prod: ie11 +ms.assetid: 85f856a6-b707-48a9-ba99-3a6e898276a9 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **First Run Wizard and Welcome Page Options** page of the Internet Explorer Customization Wizard 11 lets you decide what your employee’s see the first time they log on to IE, based on their operating system. + +- **Windows 8.1 Update and newer.** No longer includes a **Welcome** page, so if you pick the **Use Internet Explorer 11 Welcome Page** or the **Use a custom Welcome page** option, IEAK creates an initial **Home** page that loads before all other **Home** pages, as the first tab. This only applies to the Internet Explorer for the desktop. + +- **Windows 7 SP1.** You can disable the first run page for Windows 7 SP1 and then pick a custom **Welcome** page to show instead. If you don’t customize the settings on this page, your employees will see the default IE **Welcome** page. + +**To use the First Run Wizard and Welcome Page Options page** + +1. Check the **Use IE11 First Run wizard (recommended)** box to use the default First Run wizard in IE.

          +Clearing this box lets you use the IE11 **Welcome** page or your custom **Welcome** page. + +2. If you cleared the First Run wizard box, you can decide which **Welcome** page to use: + + - **Use IE11 Welcome Page.** Check this box if you want to use the default IE11 **Welcome** page. + + - **Use a custom Welcome Page.** Check this box if you want to use a custom **Welcome** page. If you choose this option, you need to add the URL to your custom page. + +3. Click **Next** to go to the [Compatibility View](compat-view-ieak11-wizard.md) page or **Back** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md index d811730cee..e3d95badec 100644 --- a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md @@ -1,28 +1,32 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Customization guidelines for your Internet Explorer toolbar button and Favorites List icons. -author: lomayor -ms.prod: ie11 -ms.assetid: bddc8f23-9ac1-449d-ad71-f77f43ae3b5c -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Customize the toolbar button and Favorites List icons using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Customize the Toolbar button and Favorites List icons using IEAK 11 -Use these customization guidelines to change the browser toolbar button and the **Favorites List** icons, using your own branding and graphics. - -**Important**
          Check your license agreement to make sure this customization is available. - -|Graphic |Type and description | -|-----------------------|----------------------------------------------------------------------| -|Browser toolbar button |2 icon (.ico) files with color images for active and inactive states. | -|Favorites List icons |1 icon (.ico) file for each new URL. | - -Your icons must use the .ico file extension, no other image file extension works. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Customization guidelines for your Internet Explorer toolbar button and Favorites List icons. +author: dansimp +ms.prod: ie11 +ms.assetid: bddc8f23-9ac1-449d-ad71-f77f43ae3b5c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Customize the toolbar button and Favorites List icons using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Customize the Toolbar button and Favorites List icons using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Use these customization guidelines to change the browser toolbar button and the **Favorites List** icons, using your own branding and graphics. + +**Important**
          Check your license agreement to make sure this customization is available. + +|Graphic |Type and description | +|-----------------------|----------------------------------------------------------------------| +|Browser toolbar button |2 icon (.ico) files with color images for active and inactive states. | +|Favorites List icons |1 icon (.ico) file for each new URL. | + +Your icons must use the .ico file extension, no other image file extension works. + diff --git a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md index 59cb1d693e..2da43b7f38 100644 --- a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md @@ -1,52 +1,56 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: List of supported hardware and software requirements for Internet Explorer 11 and the Internet Explorer Administration Kit 11. -author: lomayor -ms.prod: ie11 -ms.assetid: c50b86dc-7184-43d1-8daf-e750eb88dabb -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Hardware and software requirements for Internet Explorer 11 and the IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Hardware and software requirements for Internet Explorer 11 and the IEAK 11 -Before you can use the Internet Explorer Administration Kit 11 and the Internet Explorer Customization Wizard 11, you must first install Internet Explorer 11. For more info about installing IE11, see the [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md) page. - -## Hardware requirements -Before you start the Internet Explorer Customization Wizard 11, you must check to see how much disk space you have on the drive you're going to use to build the IE11 install package. This drive can be on the same device as the one running the wizard; it just needs to have a secure destination folder. - -Before you start to create your install package, you must meet all of the [Internet Explorer 11 requirements](../ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md), plus: - -- Up to 100 megabytes (MB) of disk space, depending on how many components you include in the installation package. - -- An additional 100 MB of disk space for each custom installation package built. Different media types are considered separate packages. - -## Software requirements -The device you're going to use to build your install packages must be running Internet Explorer 11, on one of these operating systems: - -- Windows 10

          However, you must use the Windows 8.1 target platform and only the "Configuration-only package" is available. - -- Windows 8.1 - -- Windows Server 2012 R2 - -- Windows® 7 Service Pack 1 (SP1) - -- Windows Server 2008 R2 (SP1) - -**Important**
          -The device you're going to use to run IEAK 11 must be running the same version of the operating system as the device where you'll build your install packages. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: List of supported hardware and software requirements for Internet Explorer 11 and the Internet Explorer Administration Kit 11. +author: dansimp +ms.prod: ie11 +ms.assetid: c50b86dc-7184-43d1-8daf-e750eb88dabb +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Hardware and software requirements for Internet Explorer 11 and the IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Hardware and software requirements for Internet Explorer 11 and the IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Before you can use the Internet Explorer Administration Kit 11 and the Internet Explorer Customization Wizard 11, you must first install Internet Explorer 11. For more info about installing IE11, see the [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md) page. + +## Hardware requirements +Before you start the Internet Explorer Customization Wizard 11, you must check to see how much disk space you have on the drive you're going to use to build the IE11 install package. This drive can be on the same device as the one running the wizard; it just needs to have a secure destination folder. + +Before you start to create your install package, you must meet all of the [Internet Explorer 11 requirements](../ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md), plus: + +- Up to 100 megabytes (MB) of disk space, depending on how many components you include in the installation package. + +- An additional 100 MB of disk space for each custom installation package built. Different media types are considered separate packages. + +## Software requirements +The device you're going to use to build your install packages must be running Internet Explorer 11, on one of these operating systems: + +- Windows 10

          However, you must use the Windows 8.1 target platform and only the "Configuration-only package" is available. + +- Windows 8.1 + +- Windows Server 2012 R2 + +- Windows® 7 Service Pack 1 (SP1) + +- Windows Server 2008 R2 (SP1) + +**Important**
          +The device you're going to use to run IEAK 11 must be running the same version of the operating system as the device where you'll build your install packages. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md index 26d3c2806d..6c46e306f3 100644 --- a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md @@ -1,32 +1,36 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[HideCustom\] .INS file setting to decide whether to hide the GUID for each custom component. -author: lomayor -ms.prod: ie11 -ms.assetid: e673f7b1-c3aa-4072-92b0-20c6dc3d9277 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the HideCustom .INS file to hide the GUID for each custom component (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the HideCustom .INS file to hide the GUID for each custom component -Info about whether to hide the globally unique identifier (GUID) for each of your custom components. - -|Name |Value |Description | -|------|-------------------------------------------------------------------------------------|-----------------------------------------------| -|GUID |

          • **0.** Component isn't hidden.
          • **1.** Component is hidden.
          |Determines whether this is a hidden component. | - - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[HideCustom\] .INS file setting to decide whether to hide the GUID for each custom component. +author: dansimp +ms.prod: ie11 +ms.assetid: e673f7b1-c3aa-4072-92b0-20c6dc3d9277 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the HideCustom .INS file to hide the GUID for each custom component (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the HideCustom .INS file to hide the GUID for each custom component + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about whether to hide the globally unique identifier (GUID) for each of your custom components. + +|Name |Value |Description | +|------|-------------------------------------------------------------------------------------|-----------------------------------------------| +|GUID |
          • **0.** Component isn't hidden.
          • **1.** Component is hidden.
          |Determines whether this is a hidden component. | + + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md index 66973a3a25..c9d24160a9 100644 --- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md +++ b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md @@ -1,68 +1,72 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Reference about the command-line options and return codes for Internet Explorer Setup. -author: lomayor -ms.prod: ie11 -ms.assetid: 40c23024-cb5d-4902-ad1b-6e8a189a699f -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Internet Explorer Setup command-line options and return codes (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Internet Explorer Setup command-line options and return codes -You can use command-line options along with a tool like IExpress to package your custom version of Internet Explorer and to perform a batch installation across your organization. - -## IE Setup command-line options -These command-line options work with IE Setup: - -`[/help] [/passive | /quiet] [/update-no] [/no-default] [/nobackup] [/ieak-full: | /ieak-branding: ] [/norestart | /forcerestart] [/log: ` - -|Parameter (Setup modes) |Description | -|------------------------|-------------------------------------------------------------------------------------------------| -|`/passive` |Runs the install without requiring input from the employee, showing progress and error messages. | -|`/quiet` |Identical to `/passive`, but doesn't show any of the progress or error messages to the employee. | -

          - -|Parameter (Setup options) |Description | -|--------------------------|-------------------------------------------------------------------------------------------------| -|`/update-no` |Doesn't look for Internet Explorer updates. | -|`/no-default` |Doesn't make Internet Explorer the default browser. | -|`/no-backup` |Doesn't back up the files necessary to uninstall IE. | -|`/ieak-full` |Reserved for use by the IEAK 11. | -|`/ieak-branding` |Reserved for use by the IEAK 11. | -

          - -|Parameter (Restart options) |Description | -|----------------------------|--------------------------------------------| -|`/norestart` |Doesn't restart after installation. | -|`/forcerestart` |Restarts after installation. | -

          - -|Parameter (miscellaneous options) |Description | -|----------------------------------|--------------------------------------------| -|`/help` |Provides help info. Can't be used with any other option. | -|`/log ` |Creates a log file about the installation process, at the specified location. | - - -## Windows Setup return and status codes -Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged inside your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. - -|Subkey |Data type |Value | -|---------|----------|---------------------------------------| -|Complete |String |0 = Success | -|Complete |String |0x80100003 = Files are missing for the requested installation. | -|Complete |String |0x80100001 = Setup partially succeeded. One or more components weren’t downloaded or installed. Check the **FailedComponents** subkey for the list of components. | -|Complete |String |0x80100002 = Setup partially succeeded, but the employee cancelled Setup. One or more components weren’t downloaded or installed. Check the **FailedComponents** subkey for the list of components. | -|FailedComponents |MultiSZ |``Null``Component1 | -|InstallStatus |Binary |0 = Install completed successfully. | -|InstallStatus |Binary |1 = Suspend Setup.
          The employee cancelled Setup and is then asked to confirm:

          • 2 = No, don’t cancel. Resume Setup.
          • 3 = Yes, cancel confirmed. Quit Setup as soon as possible.

          **Important**
          If the cancellation is confirmed, Setup will quit as soon as all of the in-progress tasks are done, like copying or extracting files. | - -## Related topics -- [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md) -- [Express Wizard command-line options](iexpress-command-line-options.md) - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Reference about the command-line options and return codes for Internet Explorer Setup. +author: dansimp +ms.prod: ie11 +ms.assetid: 40c23024-cb5d-4902-ad1b-6e8a189a699f +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Internet Explorer Setup command-line options and return codes (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Internet Explorer Setup command-line options and return codes + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You can use command-line options along with a tool like IExpress to package your custom version of Internet Explorer and to perform a batch installation across your organization. + +## IE Setup command-line options +These command-line options work with IE Setup: + +`[/help] [/passive | /quiet] [/update-no] [/no-default] [/nobackup] [/ieak-full: | /ieak-branding: ] [/norestart | /forcerestart] [/log: ` + +|Parameter (Setup modes) |Description | +|------------------------|-------------------------------------------------------------------------------------------------| +|`/passive` |Runs the install without requiring input from the employee, showing progress and error messages. | +|`/quiet` |Identical to `/passive`, but doesn't show any of the progress or error messages to the employee. | +

          + +|Parameter (Setup options) |Description | +|--------------------------|-------------------------------------------------------------------------------------------------| +|`/update-no` |Doesn't look for Internet Explorer updates. | +|`/no-default` |Doesn't make Internet Explorer the default browser. | +|`/no-backup` |Doesn't back up the files necessary to uninstall IE. | +|`/ieak-full` |Reserved for use by the IEAK 11. | +|`/ieak-branding` |Reserved for use by the IEAK 11. | +

          + +|Parameter (Restart options) |Description | +|----------------------------|--------------------------------------------| +|`/norestart` |Doesn't restart after installation. | +|`/forcerestart` |Restarts after installation. | +

          + +|Parameter (miscellaneous options) |Description | +|----------------------------------|--------------------------------------------| +|`/help` |Provides help info. Can't be used with any other option. | +|`/log ` |Creates a log file about the installation process, at the specified location. | + + +## Windows Setup return and status codes +Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged inside your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. + +|Subkey |Data type |Value | +|---------|----------|---------------------------------------| +|Complete |String |0 = Success | +|Complete |String |0x80100003 = Files are missing for the requested installation. | +|Complete |String |0x80100001 = Setup partially succeeded. One or more components weren’t downloaded or installed. Check the **FailedComponents** subkey for the list of components. | +|Complete |String |0x80100002 = Setup partially succeeded, but the employee cancelled Setup. One or more components weren’t downloaded or installed. Check the **FailedComponents** subkey for the list of components. | +|FailedComponents |MultiSZ |``Null``Component1 | +|InstallStatus |Binary |0 = Install completed successfully. | +|InstallStatus |Binary |1 = Suspend Setup.
          The employee cancelled Setup and is then asked to confirm:

          • 2 = No, don’t cancel. Resume Setup.
          • 3 = Yes, cancel confirmed. Quit Setup as soon as possible.

          **Important**
          If the cancellation is confirmed, Setup will quit as soon as all of the in-progress tasks are done, like copying or extracting files. | + +## Related topics +- [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md) +- [Express Wizard command-line options](iexpress-command-line-options.md) + diff --git a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md index 956404de2f..1d8b34786a 100644 --- a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md +++ b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md @@ -1,51 +1,55 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. Use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. -author: lomayor -ms.author: lomayor -ms.manager: dougkim -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -title: Internet Explorer Administration Kit (IEAK) information and downloads -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# Internet Explorer Administration Kit (IEAK) information and downloads - ->Applies to: Windows 10 - -The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. To find more information on the IEAK, see [What IEAK can do for you](what-ieak-can-do-for-you.md). - - -## Internet Explorer Administration Kit 11 (IEAK 11) - -[IEAK 11 documentation](index.md) - -[IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) - -[IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) - -[Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](before-you-create-custom-pkgs-ieak11.md) - -## Download IEAK - -To download, choose to **Open** the download or **Save** it to your hard drive first. - - -| | | | -|---------|---------|---------| -|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | -|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | -|[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) | -|[Chinese (Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) | -|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | -|[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) | -|[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) | -|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +ms.pagetype: security +description: The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. Use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. +author: dansimp +ms.author: dansimp +ms.manager: dougkim +ms.prod: ie11 +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +title: Internet Explorer Administration Kit (IEAK) information and downloads +ms.sitesec: library +ms.date: 05/10/2018 +--- + +# Internet Explorer Administration Kit (IEAK) information and downloads + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +>Applies to: Windows 10 + +The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. To find more information on the IEAK, see [What IEAK can do for you](what-ieak-can-do-for-you.md). + + +## Internet Explorer Administration Kit 11 (IEAK 11) + +[IEAK 11 documentation](index.md) + +[IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) + +[IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) + +[Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](before-you-create-custom-pkgs-ieak11.md) + +## Download IEAK + +To download, choose to **Open** the download or **Save** it to your hard drive first. + + +| | | | +|---------|---------|---------| +|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | +|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | +|[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) | +|[Chinese (Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) | +|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | +|[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) | +|[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) | +|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | + + diff --git a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md index 8890f6d65b..0aa9964807 100644 --- a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md +++ b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md @@ -1,44 +1,48 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Review the options available to help you customize your browser install packages for deployment to your employee's devices. -author: lomayor -ms.prod: ie11 -ms.assetid: 4b804da3-c3ac-4b60-ab1c-99536ff6e31b -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options -Use the Internet Explorer Administration Kit 11 (IEAK 11) and the Internet Explorer Customization Wizard 11 to customize your browser install packages for deployment to your employee's devices. - -## IE Customization Wizard 11 options -IEAK 11 lets you customize a lot of Internet Explorer 11, including the IE and Internet Explorer for the desktop experiences. For more info about the experiences, see [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). For info about which pages appear in the **Internal** or **External** version of IE Customization Wizard 11, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). - -|Internet Explorer Customization Wizard 11 page |Browser experience |Description | -|-----------------------------------------------|------------------------------------|-----------------------------| -|[Custom Components](custom-components-ieak11-wizard.md) |Internet Explorer for the desktop |Add up to 10 additional components that your employees can install at the same time they install IE. | -|[Internal install](internal-install-ieak11-wizard.md) |Internet Explorer for the desktop |Choose to set IE11 as the default browser.

          **Note**
          This only applies to IE11 on Windows 7 SP1 | -|[User Experience](user-experience-ieak11-wizard.md) |Internet Explorer for the desktop |Control the installation and restart experience for your employees.

          This only applies to IE11 on Windows 7 SP1 | -|[Browser user interface](browser-ui-ieak11-wizard.md) |Internet Explorer for the desktop |Customize your title bars and toolbar buttons. | -|[Search Providers](search-providers-ieak11-wizard.md) |Both |Import and add Search providers. | -|[Important URLs – Home page and Support](important-urls-home-page-and-support-ieak11-wizard.md) |The **Support** page is supported by both experiences. The **Home** page is only supported on Internet Explorer for the desktop. |Add URLs for your **Home** and **Support** pages. | -|[Accelerators](accelerators-ieak11-wizard.md) |Internet Explorer for the desktop |Import and add default accelerators. | -|[Favorites, Favorites Bar and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) |Internet Explorer for the desktop |Import and add items to the **Favorites** folder, the **Favorites Bar**, and the **Feeds** folder.

          **Note**
          You can turn off the entire **Suggested Sites** feature from this page. | -|[Browsing Options](browsing-options-ieak11-wizard.md) |Doesn't apply. The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. |Choose how to manage items in the **Favorites** folder, the **Favorites Bar**, and the **Feeds** folder. You can also turn off the Microsoft-default Favorites, Web slices, links, feeds, and accelerators. | -|[First Run Wizard and Welcome Page Options](first-run-and-welcome-page-ieak11-wizard.md) |Internet Explorer for the desktop |Decide if the First Run wizard appears the first time an employee starts IE. You can also use the IE11 **Welcome** page, or link to a custom **Welcome** page. | -|[Compatibility View](compat-view-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. For more information, see [Missing the Compatibility View Button](../ie11-deploy-guide/missing-the-compatibility-view-button.md). | -|[Connection Manager](connection-mgr-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. | -|[Connection Settings](connection-settings-ieak11-wizard.md) |Both |Choose whether to customize your connection settings. You can also choose to delete old dial-up connection settings. | -|[Automatic Configuration](auto-config-ieak11-wizard.md) |Both |Choose whether to automatically detect configuration settings and whether to turn on and customize automatic configuration. | -|[Proxy Settings](proxy-settings-ieak11-wizard.md) |Both |Turn on and set up your proxy servers.

          **Note**
          We don't support Gopher Server anymore. | -|[Add a Root Certification](add-root-certificate-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. | -|[Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) |The **Security Zones and Privacy** settings are supported by both experiences. The **Content Ratings** are only supported on Internet Explorer for the desktop. |Decide if you want to:

          • Customize your security zones and privacy settings
          • -OR-

          • Import your current security zones and privacy settings
          • -AND-

          • Customize your content ratings settings
          • -OR-

          • Import your current content ratings settings
          | -|[Programs](programs-ieak11-wizard.md) |Internet Explorer for the desktop |Decide your default programs or import your current settings. | -|[Additional Settings](additional-settings-ieak11-wizard.md) |Both |Decide how to set up multiple IE settings that appear in the **Internet Options** box. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Review the options available to help you customize your browser install packages for deployment to your employee's devices. +author: dansimp +ms.prod: ie11 +ms.assetid: 4b804da3-c3ac-4b60-ab1c-99536ff6e31b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Use the Internet Explorer Administration Kit 11 (IEAK 11) and the Internet Explorer Customization Wizard 11 to customize your browser install packages for deployment to your employee's devices. + +## IE Customization Wizard 11 options +IEAK 11 lets you customize a lot of Internet Explorer 11, including the IE and Internet Explorer for the desktop experiences. For more info about the experiences, see [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). For info about which pages appear in the **Internal** or **External** version of IE Customization Wizard 11, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). + +|Internet Explorer Customization Wizard 11 page |Browser experience |Description | +|-----------------------------------------------|------------------------------------|-----------------------------| +|[Custom Components](custom-components-ieak11-wizard.md) |Internet Explorer for the desktop |Add up to 10 additional components that your employees can install at the same time they install IE. | +|[Internal install](internal-install-ieak11-wizard.md) |Internet Explorer for the desktop |Choose to set IE11 as the default browser.

          **Note**
          This only applies to IE11 on Windows 7 SP1 | +|[User Experience](user-experience-ieak11-wizard.md) |Internet Explorer for the desktop |Control the installation and restart experience for your employees.

          This only applies to IE11 on Windows 7 SP1 | +|[Browser user interface](browser-ui-ieak11-wizard.md) |Internet Explorer for the desktop |Customize your title bars and toolbar buttons. | +|[Search Providers](search-providers-ieak11-wizard.md) |Both |Import and add Search providers. | +|[Important URLs – Home page and Support](important-urls-home-page-and-support-ieak11-wizard.md) |The **Support** page is supported by both experiences. The **Home** page is only supported on Internet Explorer for the desktop. |Add URLs for your **Home** and **Support** pages. | +|[Accelerators](accelerators-ieak11-wizard.md) |Internet Explorer for the desktop |Import and add default accelerators. | +|[Favorites, Favorites Bar and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) |Internet Explorer for the desktop |Import and add items to the **Favorites** folder, the **Favorites Bar**, and the **Feeds** folder.

          **Note**
          You can turn off the entire **Suggested Sites** feature from this page. | +|[Browsing Options](browsing-options-ieak11-wizard.md) |Doesn't apply. The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. |Choose how to manage items in the **Favorites** folder, the **Favorites Bar**, and the **Feeds** folder. You can also turn off the Microsoft-default Favorites, Web slices, links, feeds, and accelerators. | +|[First Run Wizard and Welcome Page Options](first-run-and-welcome-page-ieak11-wizard.md) |Internet Explorer for the desktop |Decide if the First Run wizard appears the first time an employee starts IE. You can also use the IE11 **Welcome** page, or link to a custom **Welcome** page. | +|[Compatibility View](compat-view-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. For more information, see [Missing the Compatibility View Button](../ie11-deploy-guide/missing-the-compatibility-view-button.md). | +|[Connection Manager](connection-mgr-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. | +|[Connection Settings](connection-settings-ieak11-wizard.md) |Both |Choose whether to customize your connection settings. You can also choose to delete old dial-up connection settings. | +|[Automatic Configuration](auto-config-ieak11-wizard.md) |Both |Choose whether to automatically detect configuration settings and whether to turn on and customize automatic configuration. | +|[Proxy Settings](proxy-settings-ieak11-wizard.md) |Both |Turn on and set up your proxy servers.

          **Note**
          We don't support Gopher Server anymore. | +|[Add a Root Certification](add-root-certificate-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. | +|[Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) |The **Security Zones and Privacy** settings are supported by both experiences. The **Content Ratings** are only supported on Internet Explorer for the desktop. |Decide if you want to:

          • Customize your security zones and privacy settings
          • -OR-

          • Import your current security zones and privacy settings
          • -AND-

          • Customize your content ratings settings
          • -OR-

          • Import your current content ratings settings
          | +|[Programs](programs-ieak11-wizard.md) |Internet Explorer for the desktop |Decide your default programs or import your current settings. | +|[Additional Settings](additional-settings-ieak11-wizard.md) |Both |Decide how to set up multiple IE settings that appear in the **Internet Options** box. | + diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md index d36ca26c63..57128dfefe 100644 --- a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md +++ b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md @@ -1,43 +1,47 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Reference about the command-line options for the IExpress Wizard. -author: lomayor -ms.prod: ie11 -ms.assetid: aa16d738-1067-403c-88b3-bada12cf9752 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: IExpress Wizard command-line options (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -**Applies to:** -- Windows Server 2008 R2 with SP1 - -# IExpress Wizard command-line options -Use command-line options with the IExpress Wizard (IExpress.exe) to control your Internet Explorer custom browser package extraction process. - -These command-line options work with IExpress:
          -`Ie11setup /c:"ie11wzd "` - -|Parameter |Action | -|----------|--------------------------------------------------------------------------------------------| -|`/q` |Specifies quiet mode, hiding all of the prompts, while files are being extracted. This option won’t suppress prompts during Setup. | -|`/q:u` |Specifies user-quiet mode, letting some of the progress and error messages appear to the employee. | -|`/q:a` |Specifies administrator-quiet mode, hiding all of the progress and error messages from the employee. | -|`/t:` |Specifies where to store your extracted files. | -|`/c:` |Extracts all of the files without installing them. If `t:/` isn’t used, you’ll be prompted for a storage folder. | -|`/c:` |Specifies the UNC path and name of the Setup .inf or .exe file. | -|`/r:n` |Never restarts the computer after installation. | -|`/r:a` |Always restarts the computer after installation. | -|`/r:s` |Restarts the computer after installation without prompting the employee. | - -For more information, see [Command-line switches for IExpress software update packages](https://go.microsoft.com/fwlink/p/?LinkId=317973). - -## Related topics -- [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md) -- [Internet Explorer Setup command-line options and return codes](ie-setup-command-line-options-and-return-codes.md) - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Reference about the command-line options for the IExpress Wizard. +author: dansimp +ms.prod: ie11 +ms.assetid: aa16d738-1067-403c-88b3-bada12cf9752 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: IExpress Wizard command-line options (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + +# IExpress Wizard command-line options + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** +- Windows Server 2008 R2 with SP1 + +Use command-line options with the IExpress Wizard (IExpress.exe) to control your Internet Explorer custom browser package extraction process. + +These command-line options work with IExpress:
          +`Ie11setup /c:"ie11wzd "` + +|Parameter |Action | +|----------|--------------------------------------------------------------------------------------------| +|`/q` |Specifies quiet mode, hiding all of the prompts, while files are being extracted. This option won’t suppress prompts during Setup. | +|`/q:u` |Specifies user-quiet mode, letting some of the progress and error messages appear to the employee. | +|`/q:a` |Specifies administrator-quiet mode, hiding all of the progress and error messages from the employee. | +|`/t:` |Specifies where to store your extracted files. | +|`/c:` |Extracts all of the files without installing them. If `t:/` isn’t used, you’ll be prompted for a storage folder. | +|`/c:` |Specifies the UNC path and name of the Setup .inf or .exe file. | +|`/r:n` |Never restarts the computer after installation. | +|`/r:a` |Always restarts the computer after installation. | +|`/r:s` |Restarts the computer after installation without prompting the employee. | + +For more information, see [Command-line switches for IExpress software update packages](https://go.microsoft.com/fwlink/p/?LinkId=317973). + +## Related topics +- [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md) +- [Internet Explorer Setup command-line options and return codes](ie-setup-command-line-options-and-return-codes.md) + diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md index ced5d1a708..fe4bb3a985 100644 --- a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md +++ b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md @@ -1,72 +1,76 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the IExpress Wizard on Windows Server 2008 R2 with SP1 to create self-extracting files to run your custom Internet Explorer Setup program. -author: lomayor -ms.prod: ie11 -ms.assetid: 5100886d-ec88-4c1c-8cd7-be00da874c57 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: IExpress Wizard for Windows Server 2008 R2 with SP1 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# IExpress Wizard for Windows Server 2008 R2 with SP1 -Use the IExpress Wizard and its associated command-line options to create self-extracting files that automatically run your custom Internet Explorer Setup (.inf or .exe file) program that’s contained inside. - -## IExpress Wizard location -The IExpress Wizard (Iexpress.exe) is included as part of Windows Server 2008 R2 with Service Pack 1 (SP1), in the `:\Windows\System32` folder. The wizard uses a self-extraction directive (.sed) file to store your package’s information. When you run the wizard, you have the option to start with an existing .sed file or to create a new one. - -## IExpress Wizard features -The IExpress Wizard: - -- Performs silent, unattended installations of your custom IE packages. - -- Supports upgrading IE without removing previous installations. - -- Supports repeated updating or performing clean installations of the same IE build. - -## IExpress Wizard settings -The IExpress Wizard lets you: - -- Decide whether the self-installing package is for administrators or for general employees. - -- Set multiple ways to run the installation command, such as in normal or silent mode. - -- Determine whether the IExpress dynamic-link libraries (.dll files) are updated on an employee’s computer. - -- Determine the compatibility of the installation package, based on the operating system version range, the browser version range, or any application version range. - -- Update and add files to the IExpress package, using the UPDFILE tool, without having to rebuild the package. - -- Replace Runonce with RunOnceEx (if the newer version of Iernonce.dll exists); giving you control over the job run order and status display. - -- Let corporate administrators set up support for roaming employees. - -- Let Internet Content Providers (ICPs) and Internet Service Providers (ISPs) generate packages for preconfigured desktops with custom, current content. - -- Save disk space by cleaning up the hard drive when running in Setup, uninstallation, and maintenance modes. - -- Provide support for multiple download sites. - -- Provide support for internal and external development, customization, expandability, and enhanced debugging. - -- Provide support for the extended character set, beyond single-byte characters (SBCS). - -- Provide support for using the .inf file format to download Internet components. For more information, see [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md). - -## Related topics -- [IExpress command-line options](iexpress-command-line-options.md) -- [Internet Explorer Setup command-line options and return codes](ie-setup-command-line-options-and-return-codes.md) - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the IExpress Wizard on Windows Server 2008 R2 with SP1 to create self-extracting files to run your custom Internet Explorer Setup program. +author: dansimp +ms.prod: ie11 +ms.assetid: 5100886d-ec88-4c1c-8cd7-be00da874c57 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: IExpress Wizard for Windows Server 2008 R2 with SP1 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# IExpress Wizard for Windows Server 2008 R2 with SP1 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Use the IExpress Wizard and its associated command-line options to create self-extracting files that automatically run your custom Internet Explorer Setup (.inf or .exe file) program that’s contained inside. + +## IExpress Wizard location +The IExpress Wizard (Iexpress.exe) is included as part of Windows Server 2008 R2 with Service Pack 1 (SP1), in the `:\Windows\System32` folder. The wizard uses a self-extraction directive (.sed) file to store your package’s information. When you run the wizard, you have the option to start with an existing .sed file or to create a new one. + +## IExpress Wizard features +The IExpress Wizard: + +- Performs silent, unattended installations of your custom IE packages. + +- Supports upgrading IE without removing previous installations. + +- Supports repeated updating or performing clean installations of the same IE build. + +## IExpress Wizard settings +The IExpress Wizard lets you: + +- Decide whether the self-installing package is for administrators or for general employees. + +- Set multiple ways to run the installation command, such as in normal or silent mode. + +- Determine whether the IExpress dynamic-link libraries (.dll files) are updated on an employee’s computer. + +- Determine the compatibility of the installation package, based on the operating system version range, the browser version range, or any application version range. + +- Update and add files to the IExpress package, using the UPDFILE tool, without having to rebuild the package. + +- Replace Runonce with RunOnceEx (if the newer version of Iernonce.dll exists); giving you control over the job run order and status display. + +- Let corporate administrators set up support for roaming employees. + +- Let Internet Content Providers (ICPs) and Internet Service Providers (ISPs) generate packages for preconfigured desktops with custom, current content. + +- Save disk space by cleaning up the hard drive when running in Setup, uninstallation, and maintenance modes. + +- Provide support for multiple download sites. + +- Provide support for internal and external development, customization, expandability, and enhanced debugging. + +- Provide support for the extended character set, beyond single-byte characters (SBCS). + +- Provide support for using the .inf file format to download Internet components. For more information, see [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md). + +## Related topics +- [IExpress command-line options](iexpress-command-line-options.md) +- [Internet Explorer Setup command-line options and return codes](ie-setup-command-line-options-and-return-codes.md) + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md index 6e1ac8e67a..b32b5bacab 100644 --- a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md @@ -1,39 +1,43 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Important URLs - Home Page and Support page in the IEAK 11 Customization Wizard to choose one or more **Home** pages and an online support page for your customized version of IE. -author: lomayor -ms.prod: ie11 -ms.assetid: 19e34879-ba9d-41bf-806a-3b9b9b752fc1 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard -The **Important URLS – Home Page and Support** page of the Internet Explorer Customization Wizard 11 lets you choose one or more **Home** pages and an online support page for your customized version of IE. - -**To use the Important URLS – Home Page and Support page** - -1. In the **Add a homepage URL** box, type the URL to the page your employees go to when they click the **Home** button, and then click **Add**.

          -If you add multiple **Home** pages, each page appears on a separate tab in the browser. If you don’t add a custom **Home** page, IE uses https://www.msn.com by default. If you want to delete an existing page, click the URL and then click **Remove**. - -2. Check the **Retain previous Home Page (Upgrade)** box if you have employees with previous versions of IE, who need to keep their **Home** page settings when the browser is updated. - -3. Check the **Online support page URL** box to type in the URL to your own support page. Customizing the support page is only supported in Internet Explorer for the desktop. - -4. Click **Next** to go to the [Accelerators](accelerators-ieak11-wizard.md) page or **Back** to go to the [Search Providers](search-providers-ieak11-wizard.md) page. - - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Important URLs - Home Page and Support page in the IEAK 11 Customization Wizard to choose one or more **Home** pages and an online support page for your customized version of IE. +author: dansimp +ms.prod: ie11 +ms.assetid: 19e34879-ba9d-41bf-806a-3b9b9b752fc1 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Important URLS – Home Page and Support** page of the Internet Explorer Customization Wizard 11 lets you choose one or more **Home** pages and an online support page for your customized version of IE. + +**To use the Important URLS – Home Page and Support page** + +1. In the **Add a homepage URL** box, type the URL to the page your employees go to when they click the **Home** button, and then click **Add**.

          +If you add multiple **Home** pages, each page appears on a separate tab in the browser. If you don’t add a custom **Home** page, IE uses https://www.msn.com by default. If you want to delete an existing page, click the URL and then click **Remove**. + +2. Check the **Retain previous Home Page (Upgrade)** box if you have employees with previous versions of IE, who need to keep their **Home** page settings when the browser is updated. + +3. Check the **Online support page URL** box to type in the URL to your own support page. Customizing the support page is only supported in Internet Explorer for the desktop. + +4. Click **Next** to go to the [Accelerators](accelerators-ieak11-wizard.md) page or **Back** to go to the [Search Providers](search-providers-ieak11-wizard.md) page. + + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md index ea51efa9dc..946a42e72a 100644 --- a/browsers/internet-explorer/ie11-ieak/index.md +++ b/browsers/internet-explorer/ie11-ieak/index.md @@ -1,24 +1,28 @@ --- ms.mktglfcycl: plan description: IEAK 11 - Internet Explorer Administration Kit 11 Users Guide -author: shortpatti +author: dansimp +ms.author: dansimp ms.prod: ie11 ms.assetid: 847bd7b4-d5dd-4e10-87b5-4d7d3a99bbac title: Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library ms.localizationpriority: medium -ms.date: 07/27/2017 +manager: dansimp --- # Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide -The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. Use this guide to learn about the several options and processes you'll need to consider while you're using the Internet Explorer Administration Kit 11 (IEAK 11) to customize, deploy, and manage Internet Explorer 11 for your employee's devices. ->[!IMPORTANT] ->Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary. +> [!IMPORTANT] +> Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary. ## Included technology @@ -40,7 +44,7 @@ IE11 and IEAK 11 offers differing experiences between Windows 7 and Windows 8.1 ## Related topics - [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) -- [Download IEAK 11](ieak-information-and-downloads.md) +- [Download IEAK 11](ieak-information-and-downloads.md) - [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) - [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) - [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md) diff --git a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md index 59969fe56f..6936f198d0 100644 --- a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md @@ -1,39 +1,43 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Internal Install page in the IEAK 11 Customization Wizard to customize Setup for the default browser and the latest browser updates. -author: lomayor -ms.prod: ie11 -ms.assetid: 33d078e3-75b8-455b-9126-f0d272ed676f -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Internal Install page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Internal Install page in the IEAK 11 Wizard -The **Internal Install** page of the Internet Explorer Customization Wizard 11 lets you customize Setup for the default browser and the latest browser updates, based on your company’s guidelines. - -**Note**
          The customizations made on this page only apply to Internet Explorer for the desktop on Windows 7. - -**To use the Internal Install page** - -1. Pick either: - - - **Allow user to choose.** Lets your employees pick their own default browser.

          -OR-

          - - - **Do not set IE as the default browser.** Won’t set IE as the default browser. However, your employees can still make IE the default. - -2. Click **Next** to go to the [User Experience](user-experience-ieak11-wizard.md) page or **Back** to go to the [Custom Components](custom-components-ieak11-wizard.md). - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Internal Install page in the IEAK 11 Customization Wizard to customize Setup for the default browser and the latest browser updates. +author: dansimp +ms.prod: ie11 +ms.assetid: 33d078e3-75b8-455b-9126-f0d272ed676f +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Internal Install page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Internal Install page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Internal Install** page of the Internet Explorer Customization Wizard 11 lets you customize Setup for the default browser and the latest browser updates, based on your company’s guidelines. + +**Note**
          The customizations made on this page only apply to Internet Explorer for the desktop on Windows 7. + +**To use the Internal Install page** + +1. Pick either: + + - **Allow user to choose.** Lets your employees pick their own default browser.

          -OR-

          + + - **Do not set IE as the default browser.** Won’t set IE as the default browser. However, your employees can still make IE the default. + +2. Click **Next** to go to the [User Experience](user-experience-ieak11-wizard.md) page or **Back** to go to the [Custom Components](custom-components-ieak11-wizard.md). + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md index 58fd70a9aa..666c5f8b17 100644 --- a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md @@ -1,23 +1,27 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[ISP_Security\] .INS file setting to add the root certificate for your custom Internet Explorer package. -author: lomayor -ms.prod: ie11 -ms.assetid: 4eca2de5-7071-45a2-9c99-75115be00d06 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the ISP_Security .INS file to add your root certificate (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the ISP_Security .INS file to add your root certificate -Info about where you store the root certificate you’re adding to your custom package. - -|Name |Value |Description | -|---------------|-----------------------|------------------------------------------------------------------------------------------| -|RootCertPath |`` |Location and name of the root certificate you want to add to your custom install package. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[ISP_Security\] .INS file setting to add the root certificate for your custom Internet Explorer package. +author: dansimp +ms.prod: ie11 +ms.assetid: 4eca2de5-7071-45a2-9c99-75115be00d06 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the ISP_Security .INS file to add your root certificate (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the ISP_Security .INS file to add your root certificate + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about where you store the root certificate you’re adding to your custom package. + +|Name |Value |Description | +|---------------|-----------------------|------------------------------------------------------------------------------------------| +|RootCertPath |`` |Location and name of the root certificate you want to add to your custom install package. | + diff --git a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md index a266fcba98..a343a30e51 100644 --- a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md @@ -1,37 +1,41 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Language Selection page in the IEAK 11 Customization Wizard to choose the language for your IEAK 11 custom package. -author: lomayor -ms.prod: ie11 -ms.assetid: f9d4ab57-9b1d-4cbc-9398-63f4938df1f6 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Language Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Language Selection page in the IEAK 11 Wizard -The **Language Selection** page of the Internet Explorer Customization Wizard 11 lets you choose the language for your Internet Explorer Administration Kit 11 (IEAK 11) custom package. You can create custom Internet Explorer 11 packages in any of the languages your operating system version is available in. - -**Important**
          Make sure that the language of your IEAK 11 installation matches the language of your custom IE11 package. If the languages don’t match, IEAK 11 won’t work properly. - -**To use the Language Selection page** - -1. Pick the language you want your custom IE11 installation package to use.

          -You can support as many languages as you want, but each localized version must be in its own install package.

          -**Note**
          To keep your settings across multiple versions of the package, you can pick the same destination folder for all versions. The different language versions are then saved in separate subfolders within that destination folder. Like, for an English version, `C:\Cie\Build1\Flat\Win32_WIN8\en-US\` and for a German version, `C:\Cie\Build1\Flat\Win32_WIN8\de-DE\`. - -2. Click **Next** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page or **Back** to go to the [Platform Selection](platform-selection-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Language Selection page in the IEAK 11 Customization Wizard to choose the language for your IEAK 11 custom package. +author: dansimp +ms.prod: ie11 +ms.assetid: f9d4ab57-9b1d-4cbc-9398-63f4938df1f6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Language Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Language Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Language Selection** page of the Internet Explorer Customization Wizard 11 lets you choose the language for your Internet Explorer Administration Kit 11 (IEAK 11) custom package. You can create custom Internet Explorer 11 packages in any of the languages your operating system version is available in. + +**Important**
          Make sure that the language of your IEAK 11 installation matches the language of your custom IE11 package. If the languages don’t match, IEAK 11 won’t work properly. + +**To use the Language Selection page** + +1. Pick the language you want your custom IE11 installation package to use.

          +You can support as many languages as you want, but each localized version must be in its own install package.

          +**Note**
          To keep your settings across multiple versions of the package, you can pick the same destination folder for all versions. The different language versions are then saved in separate subfolders within that destination folder. Like, for an English version, `C:\Cie\Build1\Flat\Win32_WIN8\en-US\` and for a German version, `C:\Cie\Build1\Flat\Win32_WIN8\de-DE\`. + +2. Click **Next** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page or **Back** to go to the [Platform Selection](platform-selection-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index 7a6e3d009f..4c14f5ec98 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -2,11 +2,11 @@ ms.localizationpriority: medium ms.mktglfcycl: plan description: Learn about the version of the IEAK 11 you should run, based on your license agreement. -author: lomayor -ms.author: lomayor +author: dansimp +ms.author: dansimp ms.prod: ie11 ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) @@ -16,13 +16,16 @@ ms.date: 10/23/2018 # Determine the licensing version and features to use in IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + In addition to the Software License Terms for the Internet Explorer Administration Kit 11 (IEAK 11, referred to as the "software"), these Guidelines further define how you may and may not use the software to create versions of Internet Explorer 11 with optional customizations (referred to as the "customized browser") for internal use and distribution in accordance with the IEAK 11 Software License Terms. IEAK 11 is for testing purposes only and is not intended to be used in a production environment. During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment. - **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you are an ISP or an ICP, your license agreement also states that you must show the Internet Explorer logo on your packaging and promotional goods, as well as on your website. - >[!IMPORTANT] - >Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. + > [!IMPORTANT] + > Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. - **Internal Distribution via a Corporate Intranet.** This version is for network admins that plan to directly deploy IE11 into a corporate environment. @@ -64,10 +67,10 @@ During installation, you must pick a version of IEAK 11, either **External** or Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. -- **External Distribution** +- **External Distribution** This mode is available to anyone who wants to create a customized browser for distribution outside their company (for example, websites, magazines, retailers, non-profit organizations, independent hardware vendors, independent software vendors, Internet service providers, Internet content providers, software developers, and marketers). -- **Internal Distribution** +- **Internal Distribution** This mode is available to companies for the creation and distribution of a customized browser only to their employees over a corporate intranet. The table below identifies which customizations you may or may not perform based on the mode you selected. @@ -100,8 +103,8 @@ Support for some of the Internet Explorer settings on the wizard pages varies de Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. -- **External Distribution** +- **External Distribution** You shall use commercially reasonable efforts to maintain the quality of (i) any non-Microsoft software distributed with Internet Explorer 11, and (ii) any media used for distribution (for example, optical media, flash drives), at a level that meets or exceeds the highest industry standards. If you distribute add-ons with Internet Explorer 11, those add-ons must comply with the [Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy). -- **Internal Distribution - corporate intranet** +- **Internal Distribution - corporate intranet** The software is solely for use by your employees within your company's organization and affiliated companies through your corporate intranet. Neither you nor any of your employees may permit redistribution of the software to or for use by third parties other than for third parties such as consultants, contractors, and temporary staff accessing your corporate intranet. diff --git a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md index 2aa91f6753..f628def610 100644 --- a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md @@ -1,23 +1,27 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Media\] .INS file setting to specify the types of media on which your custom install package is available. -author: lomayor -ms.prod: ie11 -ms.assetid: c57bae60-d520-49a9-a77d-da43f7ebe5b8 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Media .INS file to specify your install media (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Media .INS file to specify your install media -The types of media on which your custom install package is available. - -|Name |Value |Description | -|-----|------|-----------------| -|Build_LAN |

          • **0.** Don’t create the LAN-based installation package.
          • **1.** Create the LAN-based installation package.
          |Determines whether you want to create a LAN-based installation package. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[Media\] .INS file setting to specify the types of media on which your custom install package is available. +author: dansimp +ms.prod: ie11 +ms.assetid: c57bae60-d520-49a9-a77d-da43f7ebe5b8 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Media .INS file to specify your install media (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Media .INS file to specify your install media + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The types of media on which your custom install package is available. + +|Name |Value |Description | +|-----|------|-----------------| +|Build_LAN |
          • **0.** Don’t create the LAN-based installation package.
          • **1.** Create the LAN-based installation package.
          |Determines whether you want to create a LAN-based installation package. | + diff --git a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md index 6cd52f789f..ae7b3c6150 100644 --- a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md @@ -1,39 +1,43 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Package Type Selection page in the IEAK 11 Customization Wizard to pick the media type you’ll use to distribute your custom package. -author: lomayor -ms.prod: ie11 -ms.assetid: dd91f788-d05e-4f45-9fd5-d951abf04f2c -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Package Type Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Package Type Selection page in the IEAK 11 Wizard -The **Package Type Selection** page of the Internet Explorer Customization Wizard 11 lets you pick which type of media you’ll use to distribute your custom installation package. You can pick more than one type, if you need it. - -**Important**
          You can't create a full installation package for deployment to Windows 10 computers. That option only works for computers running Windows 7 or Windows 8.1. - -**To use the File Locations page** - -1. Check the **Full Installation Package** box if you’re going to build your package on, or move your package to, a local area network (LAN). This media package includes the Internet Explorer 11 installation files, and is named **IE11-Setup-Full.exe**, in the `\\FLAT\\` folder.

          -OR-

            - -2. Check the **Configuration-only package** box if you want to update an existing installation of IE11. This media package is named **IE11- Setup-Branding.exe**, in the `\\BrndOnly\\` folder.

          -You can distribute this file on any media format or server. It customizes the IE11 features without re-installing IE.

          -**Important**
          You can’t include custom components in a configuration-only package. - -3. Click **Next** to go to the [Feature Selection](feature-selection-ieak11-wizard.md) page or **Back** to go to the [Language Selection](language-selection-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Package Type Selection page in the IEAK 11 Customization Wizard to pick the media type you’ll use to distribute your custom package. +author: dansimp +ms.prod: ie11 +ms.assetid: dd91f788-d05e-4f45-9fd5-d951abf04f2c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Package Type Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Package Type Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Package Type Selection** page of the Internet Explorer Customization Wizard 11 lets you pick which type of media you’ll use to distribute your custom installation package. You can pick more than one type, if you need it. + +**Important**
          You can't create a full installation package for deployment to Windows 10 computers. That option only works for computers running Windows 7 or Windows 8.1. + +**To use the File Locations page** + +1. Check the **Full Installation Package** box if you’re going to build your package on, or move your package to, a local area network (LAN). This media package includes the Internet Explorer 11 installation files, and is named **IE11-Setup-Full.exe**, in the `\\FLAT\\` folder.

          -OR-

            + +2. Check the **Configuration-only package** box if you want to update an existing installation of IE11. This media package is named **IE11- Setup-Branding.exe**, in the `\\BrndOnly\\` folder.

          +You can distribute this file on any media format or server. It customizes the IE11 features without re-installing IE.

          +**Important**
          You can’t include custom components in a configuration-only package. + +3. Click **Next** to go to the [Feature Selection](feature-selection-ieak11-wizard.md) page or **Back** to go to the [Language Selection](language-selection-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md index a3c0045275..67d9caac65 100644 --- a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md @@ -2,12 +2,12 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: How to use the Platform Selection page in the IEAK 11 Customization Wizard to pick the specs for your employee devices that will get the install package. -author: lomayor +author: dansimp ms.prod: ie11 ms.assetid: 9cbf5abd-86f7-42b6-9810-0b606bbe8218 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp title: Use the Platform Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -15,6 +15,9 @@ ms.date: 07/27/2017 # Use the Platform Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Platform Selection** page of the Internet Explorer Customization Wizard 11 lets you pick the operating system and architecture (32-bit or 64-bit) for the devices on which you’re going to install the custom installation package. **To use the Platform Selection page** diff --git a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md index 56252cfd10..4720c446af 100644 --- a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md @@ -1,35 +1,39 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Learn about what you need to do before you deploy your custom browser package using IEAK 11 over your network. -author: lomayor -ms.prod: ie11 -ms.assetid: 2c66d22a-4a94-47cc-82ab-7274abe1dfd6 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Before you install your package over your network using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Before you install your package over your network using IEAK 11 -Employees can install the custom browser package using a network server. However, you must either lower the intranet security level or make the server a trusted site. - -**To lower your intranet security** - -1. In Internet Explorer 11, click **Tools**, **Internet Options**, and then the **Security** tab. - -2. Click **Local intranet**, and then **Sites**. - -3. Uncheck **Automatically detect intranet network**, uncheck **Include all network paths (UNC)**, and then click **OK**. - -**To make your server a trusted site** - -1. From the **Security** tab, click **Trusted sites**, and then **Sites**. - -2. Type the location of the server with the downloadable custom browser package, and then click **Add**. - -3. Repeat this step for every server that will include the custom browser package for download. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Learn about what you need to do before you deploy your custom browser package using IEAK 11 over your network. +author: dansimp +ms.prod: ie11 +ms.assetid: 2c66d22a-4a94-47cc-82ab-7274abe1dfd6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Before you install your package over your network using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Before you install your package over your network using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Employees can install the custom browser package using a network server. However, you must either lower the intranet security level or make the server a trusted site. + +**To lower your intranet security** + +1. In Internet Explorer 11, click **Tools**, **Internet Options**, and then the **Security** tab. + +2. Click **Local intranet**, and then **Sites**. + +3. Uncheck **Automatically detect intranet network**, uncheck **Include all network paths (UNC)**, and then click **OK**. + +**To make your server a trusted site** + +1. From the **Security** tab, click **Trusted sites**, and then **Sites**. + +2. Type the location of the server with the downloadable custom browser package, and then click **Add**. + +3. Repeat this step for every server that will include the custom browser package for download. + diff --git a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md index 8b0ff1ece4..acfbbc74ae 100644 --- a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md @@ -2,12 +2,12 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: How to use the Programs page in the IEAK 11 Customization Wizard to pick the default programs to use for Internet services. -author: lomayor +author: dansimp ms.prod: ie11 ms.assetid: f715668f-a50d-4db0-b578-e6526fbfa1fc ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp title: Use the Programs page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -15,6 +15,9 @@ ms.date: 07/27/2017 # Use the Programs page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Programs** page of the Internet Explorer Customization Wizard 11 lets you pick the default programs to use for Internet services, like email, contact lists, and newsgroups, by importing settings from your computer. **Important**
          The customizations you make on this page only apply to Internet Explorer for the desktop. diff --git a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md index 347e753856..56a0823f9a 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md @@ -1,181 +1,185 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Learn about how to use a proxy auto-configuration (.pac) file to specify an automatic proxy URL. -author: lomayor -ms.prod: ie11 -ms.assetid: 6c94708d-71bd-44bd-a445-7e6763b374ae -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use proxy auto-configuration (.pac) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use proxy auto-configuration (.pac) files with IEAK 11 -These are various ways you can use a proxy auto-configuration (.pac) file to specify an automatic proxy URL. We've included some examples here to help guide you, but you'll need to change the proxy names, port numbers, and IP addresses to match your organization's info. - -Included examples: -- [Example 1: Connect directly if the host is local](#example-1-connect-directly-if-the-host-is-local) -- [Example 2: Connect directly if the host is inside the firewall](#example-2-connect-directly-if-the-host-is-inside-the-firewall) -- [Example 3: Connect directly if the host name is resolvable](#example-3-connect-directly-if-the-host-name-is-resolvable) -- [Example 4: Connect directly if the host is in specified subnet](#example-4-connect-directly-if-the-host-is-in-specified-subnet) -- [Example 5: Determine the connection type based on the host domain](#example-5-determine-the-connection-type-based-on-the-host-domain) -- [Example 6: Determine the connection type based on the protocol](#example-6-determine-the-connection-type-based-on-the-protocol) -- [Example 7: Determine the proxy server based on the host name matching the IP address](#example-7-determine-the-proxy-server-based-on-the-host-name-matching-the-ip-address) -- [Example 8: Connect using a proxy server if the host IP address matches the specified IP address](#example-8-connect-using-a-proxy-server-if-the-host-ip-address-matches-the-specified-ip-address) -- [Example 9: Connect using a proxy server if there are periods in the host name](#example-9-connect-using-a-proxy-server-if-there-are-periods-in-the-host-name) -- [Example 10: Connect using a proxy server based on specific days of the week](#example-10-connect-using-a-proxy-server-based-on-specific-days-of-the-week) - - -## Example 1: Connect directly if the host is local -In this example, if the host is local, it can connect directly. However, if the server isn't local, it must connect through a proxy server. Specifically, the `isPlainHostName` function looks to see if there are any periods (.) in the host name. If the function finds periods, it means the host isn’t local and it returns false. Otherwise, the function returns true. - -``` javascript -function FindProxyForURL(url, host) - { - if (isPlainHostName(host)) - return "DIRECT"; - else - return "PROXY proxy:80"; - } -``` -## Example 2: Connect directly if the host is inside the firewall -In this example, if the host is inside the firewall, it can connect directly. However, if the server is outside the firewall, it must connect through a proxy server. Specifically, the `localHostOrDomainIs` function only runs for URLs in the local domain. If the host domain name matches the provided domain information, the `dnsDomainIs` function returns true. - -``` javascript -function FindProxyForURL(url, host) - { - if ((isPlainHostName(host) || - dnsDomainIs(host, ".company.com")) && - !localHostOrDomainIs(host, "www.company.com") && - !localHostOrDoaminIs(host, "home.company.com")) - return "DIRECT"; - else - return "PROXY proxy:80"; -} -``` -## Example 3: Connect directly if the host name is resolvable -In this example, if the host name can be resolved, it can connect directly. However, if the name can’t be resolved, the server must connect through a proxy server. Specifically, this function requests the DNS server to resolve the host name it's passed. If the name can be resolved, a direct connection is made. If it can't, the connection is made using a proxy. This is particularly useful when an internal DNS server is used to resolve all internal host names. - -**Important**
          The `isResolvable` function queries a Domain Name System (DNS) server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. - -``` javascript -function FindProxyForURL(url, host) - { - if (isResolvable(host)) - return "DIRECT"; - else - return "PROXY proxy:80"; - } -``` - -## Example 4: Connect directly if the host is in specified subnet -In this example, if the host is in a specified subnet, it can connect directly. However, if the server is outside of the specified subnet, it must connect through a proxy server. Specifically, the `isInNet` (host, pattern, mask) function returns true if the host IP address matches the specified pattern. The mask indicates which part of the IP address to match (255=match, 0=ignore). - -**Important**
          The `isInNet` function queries a DNS server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. - -``` javascript -function FindProxyForURL(url, host) - { - if (isInNet(host, "999.99.9.9", "255.0.255.0")) - return "DIRECT"; - else - return "PROXY proxy:80"; - } -``` -## Example 5: Determine the connection type based on the host domain -In this example, if the host is local, the server can connect directly. However, if the host isn’t local, this function determines which proxy to use based on the host domain. Specifically, the `shExpMatch(str, shexp)` function returns true if `str` matches the `shexp` using shell expression patterns. This is particularly useful when the host domain name is one of the criteria for proxy selection. - -``` javascript -function FindProxyForURL(url, host) - { - if (isPlainHostName(host)) - return "DIRECT"; - else if (shExpMatch(host, "*.com")) - return "PROXY comproxy:80"; - else if (shExpMatch(host, "*.edu")) - return "PROXY eduproxy:80"; - else - return "PROXY proxy"; - } -``` -## Example 6: Determine the connection type based on the protocol -In this example, the in-use protocol is extracted from the server and used to make a proxy selection. If no protocol match occurs, the server is directly connected. Specifically the `substring` function extracts the specified number of characters from a string. This is particularly useful when protocol is one of the criteria for proxy selection. - -``` javascript -function FindProxyForURL(url, host) - { - if (url.substring(0, 5) == "http:") { - return "PROXY proxy:80"; - } - else if (url.substring(0, 4) == "ftp:") { - return "PROXY fproxy:80"; - } - else if (url.substring(0, 6) == "https:") { - return "PROXY secproxy:8080"; - } - else { - return "DIRECT"; - } - } -``` -## Example 7: Determine the proxy server based on the host name matching the IP address -In this example, the proxy server is selected by translating the host name into an IP address and then comparing the address to a specified string. - -**Important** 
          The `dnsResolve` function queries a DNS server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. - -``` javascript -function FindProxyForURL(url, host) - { - if (dnsResolve(host) == "999.99.99.999") { // = https://secproxy - return "PROXY secproxy:8080"; - } - else { - return "PROXY proxy:80"; - } - } -``` -## Example 8: Connect using a proxy server if the host IP address matches the specified IP address -In this example, the proxy server is selected by explicitly getting the IP address and then comparing it to a specified string. If no protocol match occurs, the server makes a direct connection. Specifically, the `myIpAddress` function returns the IP address (in integer-period format) for the host that the browser is running on. - -``` javascript -function FindProxyForURL(url, host) - { - if (myIpAddress() == "999.99.999.99") { - return "PROXY proxy:80"; - } - else { - return "DIRECT"; - } - } -``` -## Example 9: Connect using a proxy server if there are periods in the host name -In this example, the function looks to see if there are periods (.) in the host name. If there are any periods, the connection occurs using a proxy server. If there are no periods, a direct connection occurs. Specifically, the `dnsDomainLevels` function returns an integer equal to the number of periods in the host name. - -**Note**
          This is another way to determine connection types based on host name characteristics. - -``` javascript -function FindProxyForURL(url, host) - { - if (dnsDomainLevels(host) > 0) { // if the number of periods in host > 0 - return "PROXY proxy:80"; - } - return "DIRECT"; - } -``` -## Example 10: Connect using a proxy server based on specific days of the week -In this example, the function decides whether to connect to a proxy server, based on the days of the week. Connecting on days that don’t fall between the specified date parameters let the server make a direct connection. Specifically the `weekdayRange(day1 [,day2] [,GMT] )` function returns whether the current system time falls within the range specified by the parameters `day1`, `day2`, and `GMT`. Only the first parameter is required. The GMT parameter presumes time values are in Greenwich Mean Time rather than the local time zone. This function is particularly useful for situations where you want to use a proxy server for heavy traffic times, but allow a direct connection when traffic is light. - -``` javascript -function FindProxyForURL(url, host) - { - if(weekdayRange("WED", "SAT", "GMT")) - return "PROXY proxy:80"; - else - return "DIRECT"; - } -``` - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Learn about how to use a proxy auto-configuration (.pac) file to specify an automatic proxy URL. +author: dansimp +ms.prod: ie11 +ms.assetid: 6c94708d-71bd-44bd-a445-7e6763b374ae +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use proxy auto-configuration (.pac) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use proxy auto-configuration (.pac) files with IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +These are various ways you can use a proxy auto-configuration (.pac) file to specify an automatic proxy URL. We've included some examples here to help guide you, but you'll need to change the proxy names, port numbers, and IP addresses to match your organization's info. + +Included examples: +- [Example 1: Connect directly if the host is local](#example-1-connect-directly-if-the-host-is-local) +- [Example 2: Connect directly if the host is inside the firewall](#example-2-connect-directly-if-the-host-is-inside-the-firewall) +- [Example 3: Connect directly if the host name is resolvable](#example-3-connect-directly-if-the-host-name-is-resolvable) +- [Example 4: Connect directly if the host is in specified subnet](#example-4-connect-directly-if-the-host-is-in-specified-subnet) +- [Example 5: Determine the connection type based on the host domain](#example-5-determine-the-connection-type-based-on-the-host-domain) +- [Example 6: Determine the connection type based on the protocol](#example-6-determine-the-connection-type-based-on-the-protocol) +- [Example 7: Determine the proxy server based on the host name matching the IP address](#example-7-determine-the-proxy-server-based-on-the-host-name-matching-the-ip-address) +- [Example 8: Connect using a proxy server if the host IP address matches the specified IP address](#example-8-connect-using-a-proxy-server-if-the-host-ip-address-matches-the-specified-ip-address) +- [Example 9: Connect using a proxy server if there are periods in the host name](#example-9-connect-using-a-proxy-server-if-there-are-periods-in-the-host-name) +- [Example 10: Connect using a proxy server based on specific days of the week](#example-10-connect-using-a-proxy-server-based-on-specific-days-of-the-week) + + +## Example 1: Connect directly if the host is local +In this example, if the host is local, it can connect directly. However, if the server isn't local, it must connect through a proxy server. Specifically, the `isPlainHostName` function looks to see if there are any periods (.) in the host name. If the function finds periods, it means the host isn’t local and it returns false. Otherwise, the function returns true. + +``` javascript +function FindProxyForURL(url, host) + { + if (isPlainHostName(host)) + return "DIRECT"; + else + return "PROXY proxy:80"; + } +``` +## Example 2: Connect directly if the host is inside the firewall +In this example, if the host is inside the firewall, it can connect directly. However, if the server is outside the firewall, it must connect through a proxy server. Specifically, the `localHostOrDomainIs` function only runs for URLs in the local domain. If the host domain name matches the provided domain information, the `dnsDomainIs` function returns true. + +``` javascript +function FindProxyForURL(url, host) + { + if ((isPlainHostName(host) || + dnsDomainIs(host, ".company.com")) && + !localHostOrDomainIs(host, "www.company.com") && + !localHostOrDoaminIs(host, "home.company.com")) + return "DIRECT"; + else + return "PROXY proxy:80"; +} +``` +## Example 3: Connect directly if the host name is resolvable +In this example, if the host name can be resolved, it can connect directly. However, if the name can’t be resolved, the server must connect through a proxy server. Specifically, this function requests the DNS server to resolve the host name it's passed. If the name can be resolved, a direct connection is made. If it can't, the connection is made using a proxy. This is particularly useful when an internal DNS server is used to resolve all internal host names. + +**Important**
          The `isResolvable` function queries a Domain Name System (DNS) server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. + +``` javascript +function FindProxyForURL(url, host) + { + if (isResolvable(host)) + return "DIRECT"; + else + return "PROXY proxy:80"; + } +``` + +## Example 4: Connect directly if the host is in specified subnet +In this example, if the host is in a specified subnet, it can connect directly. However, if the server is outside of the specified subnet, it must connect through a proxy server. Specifically, the `isInNet` (host, pattern, mask) function returns true if the host IP address matches the specified pattern. The mask indicates which part of the IP address to match (255=match, 0=ignore). + +**Important**
          The `isInNet` function queries a DNS server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. + +``` javascript +function FindProxyForURL(url, host) + { + if (isInNet(host, "999.99.9.9", "255.0.255.0")) + return "DIRECT"; + else + return "PROXY proxy:80"; + } +``` +## Example 5: Determine the connection type based on the host domain +In this example, if the host is local, the server can connect directly. However, if the host isn’t local, this function determines which proxy to use based on the host domain. Specifically, the `shExpMatch(str, shexp)` function returns true if `str` matches the `shexp` using shell expression patterns. This is particularly useful when the host domain name is one of the criteria for proxy selection. + +``` javascript +function FindProxyForURL(url, host) + { + if (isPlainHostName(host)) + return "DIRECT"; + else if (shExpMatch(host, "*.com")) + return "PROXY comproxy:80"; + else if (shExpMatch(host, "*.edu")) + return "PROXY eduproxy:80"; + else + return "PROXY proxy"; + } +``` +## Example 6: Determine the connection type based on the protocol +In this example, the in-use protocol is extracted from the server and used to make a proxy selection. If no protocol match occurs, the server is directly connected. Specifically the `substring` function extracts the specified number of characters from a string. This is particularly useful when protocol is one of the criteria for proxy selection. + +``` javascript +function FindProxyForURL(url, host) + { + if (url.substring(0, 5) == "http:") { + return "PROXY proxy:80"; + } + else if (url.substring(0, 4) == "ftp:") { + return "PROXY fproxy:80"; + } + else if (url.substring(0, 6) == "https:") { + return "PROXY secproxy:8080"; + } + else { + return "DIRECT"; + } + } +``` +## Example 7: Determine the proxy server based on the host name matching the IP address +In this example, the proxy server is selected by translating the host name into an IP address and then comparing the address to a specified string. + +**Important** 
          The `dnsResolve` function queries a DNS server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. + +``` javascript +function FindProxyForURL(url, host) + { + if (dnsResolve(host) == "999.99.99.999") { // = https://secproxy + return "PROXY secproxy:8080"; + } + else { + return "PROXY proxy:80"; + } + } +``` +## Example 8: Connect using a proxy server if the host IP address matches the specified IP address +In this example, the proxy server is selected by explicitly getting the IP address and then comparing it to a specified string. If no protocol match occurs, the server makes a direct connection. Specifically, the `myIpAddress` function returns the IP address (in integer-period format) for the host that the browser is running on. + +``` javascript +function FindProxyForURL(url, host) + { + if (myIpAddress() == "999.99.999.99") { + return "PROXY proxy:80"; + } + else { + return "DIRECT"; + } + } +``` +## Example 9: Connect using a proxy server if there are periods in the host name +In this example, the function looks to see if there are periods (.) in the host name. If there are any periods, the connection occurs using a proxy server. If there are no periods, a direct connection occurs. Specifically, the `dnsDomainLevels` function returns an integer equal to the number of periods in the host name. + +**Note**
          This is another way to determine connection types based on host name characteristics. + +``` javascript +function FindProxyForURL(url, host) + { + if (dnsDomainLevels(host) > 0) { // if the number of periods in host > 0 + return "PROXY proxy:80"; + } + return "DIRECT"; + } +``` +## Example 10: Connect using a proxy server based on specific days of the week +In this example, the function decides whether to connect to a proxy server, based on the days of the week. Connecting on days that don’t fall between the specified date parameters let the server make a direct connection. Specifically the `weekdayRange(day1 [,day2] [,GMT] )` function returns whether the current system time falls within the range specified by the parameters `day1`, `day2`, and `GMT`. Only the first parameter is required. The GMT parameter presumes time values are in Greenwich Mean Time rather than the local time zone. This function is particularly useful for situations where you want to use a proxy server for heavy traffic times, but allow a direct connection when traffic is light. + +``` javascript +function FindProxyForURL(url, host) + { + if(weekdayRange("WED", "SAT", "GMT")) + return "PROXY proxy:80"; + else + return "DIRECT"; + } +``` + diff --git a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md index 5b10604a11..9def48f2d3 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md @@ -1,30 +1,34 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Proxy\] .INS file setting to define whether to use a proxy server. -author: lomayor -ms.prod: ie11 -ms.assetid: 30b03c2f-e3e5-48d2-9007-e3fd632f3c18 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Proxy .INS file to specify a proxy server (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Proxy .INS file to specify a proxy server -Info about whether to use a proxy server. If yes, this also includes the host names for the proxy server. - -|Name |Value |Description | -|-----|------|------------| -|FTP_Proxy_Server |`` |The host name for the FTP proxy server. | -|Gopher_Proxy_Server |`` |We no longer support Gopher Server. | -|HTTP_Proxy_Server |`` |The host name for the HTTP proxy server. | -|Proxy_Enable |

          • **0.** Don’t use a proxy server.
          • **1.** Use a proxy server.
          |Determines whether to use a proxy server. | -|Proxy_Override |`` |The host name for the proxy server. For example, ``. | -|Secure_Proxy_Server |`` |The host name for the secure proxy server. | -|Socks_Proxy_Server |`` |The host name for the SOCKS proxy server. | -|Use_Same_Proxy |
          • **0.** Don’t use the same proxy server for all services.
          • **1.** Use the same proxy server for all services.
          |Determines whether to use a single proxy server for all services. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[Proxy\] .INS file setting to define whether to use a proxy server. +author: dansimp +ms.prod: ie11 +ms.assetid: 30b03c2f-e3e5-48d2-9007-e3fd632f3c18 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Proxy .INS file to specify a proxy server (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Proxy .INS file to specify a proxy server + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about whether to use a proxy server. If yes, this also includes the host names for the proxy server. + +|Name |Value |Description | +|-----|------|------------| +|FTP_Proxy_Server |`` |The host name for the FTP proxy server. | +|Gopher_Proxy_Server |`` |We no longer support Gopher Server. | +|HTTP_Proxy_Server |`` |The host name for the HTTP proxy server. | +|Proxy_Enable |
          • **0.** Don’t use a proxy server.
          • **1.** Use a proxy server.
          |Determines whether to use a proxy server. | +|Proxy_Override |`` |The host name for the proxy server. For example, ``. | +|Secure_Proxy_Server |`` |The host name for the secure proxy server. | +|Socks_Proxy_Server |`` |The host name for the SOCKS proxy server. | +|Use_Same_Proxy |
          • **0.** Don’t use the same proxy server for all services.
          • **1.** Use the same proxy server for all services.
          |Determines whether to use a single proxy server for all services. | + diff --git a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md index 8ee40e8323..ba113af6cc 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md @@ -1,55 +1,59 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Proxy Settings page in the IEAK 11 Customization Wizard to pick the proxy servers used to connect to required services. -author: lomayor -ms.prod: ie11 -ms.assetid: 1fa1eee3-e97d-41fa-a48c-4a6e0dc8b544 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Proxy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Proxy Settings page in the IEAK 11 Wizard -The **Proxy Settings** page of the Internet Explorer Customization Wizard 11 lets you pick the proxy servers used by your employees to connect for services required by the custom install package. - -Using a proxy server lets you limit access to the Internet. You can also use the **Additional Settings** page of the wizard to further restrict your employees from changing the proxy settings. - -**To use the Proxy Settings page** - -1. Check the **Enable proxy settings** box if you want to use proxy servers for any of your services. - -2. Type the address of the proxy server you want to use for your services into the **Address of proxy** box. In most cases, a single proxy server is used for all of your services.

          -Proxy locations that don’t begin with a protocol (like, https:// or ftp://) are assumed to be a CERN-type HTTP proxy. For example, the entry *proxy* is treated the same as the entry `https://proxy`. - -3. Type the port for each service. The default value is *80*. - -4. Check the **Use the same proxy server for all addresses** box to use the same proxy server settings for all of your services. - -5. Type any services that shouldn’t use a proxy server into the **Do not use proxy server for addresses beginning with** box.

          -When filling out your exceptions, keep in mind: - - - Proxy bypass entries can begin with a protocol type, such as https://, https://, or ftp://. However, if a protocol type is used, the exception entry applies only to requests for that protocol. - - - Protocol values are not case sensitive and you can use a wildcard character (*) in place of zero or more characters. - - - You must use a semicolon between your entries. - - - This list is limited to **2064** characters. - -6. Check the **Do not use proxy server for local (intranet) addresses** to bypass your proxy servers for all addresses on your intranet. - -7. Click **Next** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page or **Back** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Proxy Settings page in the IEAK 11 Customization Wizard to pick the proxy servers used to connect to required services. +author: dansimp +ms.prod: ie11 +ms.assetid: 1fa1eee3-e97d-41fa-a48c-4a6e0dc8b544 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Proxy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Proxy Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Proxy Settings** page of the Internet Explorer Customization Wizard 11 lets you pick the proxy servers used by your employees to connect for services required by the custom install package. + +Using a proxy server lets you limit access to the Internet. You can also use the **Additional Settings** page of the wizard to further restrict your employees from changing the proxy settings. + +**To use the Proxy Settings page** + +1. Check the **Enable proxy settings** box if you want to use proxy servers for any of your services. + +2. Type the address of the proxy server you want to use for your services into the **Address of proxy** box. In most cases, a single proxy server is used for all of your services.

          +Proxy locations that don’t begin with a protocol (like, https:// or ftp://) are assumed to be a CERN-type HTTP proxy. For example, the entry *proxy* is treated the same as the entry `https://proxy`. + +3. Type the port for each service. The default value is *80*. + +4. Check the **Use the same proxy server for all addresses** box to use the same proxy server settings for all of your services. + +5. Type any services that shouldn’t use a proxy server into the **Do not use proxy server for addresses beginning with** box.

          +When filling out your exceptions, keep in mind: + + - Proxy bypass entries can begin with a protocol type, such as https://, https://, or ftp://. However, if a protocol type is used, the exception entry applies only to requests for that protocol. + + - Protocol values are not case sensitive and you can use a wildcard character (*) in place of zero or more characters. + + - You must use a semicolon between your entries. + + - This list is limited to **2064** characters. + +6. Check the **Do not use proxy server for local (intranet) addresses** to bypass your proxy servers for all addresses on your intranet. + +7. Click **Next** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page or **Back** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md index 0a26a051db..f3b4414183 100644 --- a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md @@ -1,28 +1,32 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Learn how to register an uninstall app for your custom components, using IEAK 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 4da1d408-af4a-4c89-a491-d6f005fd5005 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Register an uninstall app for custom components using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.date: 07/27/2017 ---- - - -# Register an uninstall app for custom components using IEAK 11 -Register the uninstall apps for any custom components you’ve included in your Internet Explorer 11 package. Registering these apps lets your employees remove the components later, using **Uninstall or change a program** in the Control Panel. - -## Register your uninstallation program -While you’re running your custom component setup process, your app can add information to the subkeys in the `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ApplicationName` registry key, registering your uninstallation program. - -**Note**
          IE11 also uses this registry key to verify that the component installed successfully during setup. - -|Subkey |Data type |Value | -|-------|----------|-----------| -|DisplayName |*string* |Friendly name for your uninstall app. This name must match your **Uninstall Key** in the **Add a Custom Component** page of the Internet Explorer Customization Wizard 11. For more info, see the [Custom Components](custom-components-ieak11-wizard.md) page. | -|UninstallString |*string* |Full command-line text, including the path, to uninstall your component. You must not use a batch file or a sub-process. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Learn how to register an uninstall app for your custom components, using IEAK 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 4da1d408-af4a-4c89-a491-d6f005fd5005 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Register an uninstall app for custom components using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.date: 07/27/2017 +--- + + +# Register an uninstall app for custom components using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Register the uninstall apps for any custom components you’ve included in your Internet Explorer 11 package. Registering these apps lets your employees remove the components later, using **Uninstall or change a program** in the Control Panel. + +## Register your uninstallation program +While you’re running your custom component setup process, your app can add information to the subkeys in the `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ApplicationName` registry key, registering your uninstallation program. + +**Note**
          IE11 also uses this registry key to verify that the component installed successfully during setup. + +|Subkey |Data type |Value | +|-------|----------|-----------| +|DisplayName |*string* |Friendly name for your uninstall app. This name must match your **Uninstall Key** in the **Add a Custom Component** page of the Internet Explorer Customization Wizard 11. For more info, see the [Custom Components](custom-components-ieak11-wizard.md) page. | +|UninstallString |*string* |Full command-line text, including the path, to uninstall your component. You must not use a batch file or a sub-process. | + diff --git a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md index db2bad72cd..340327e916 100644 --- a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md @@ -1,46 +1,50 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: manage -description: Learn how to use the Resultant Set of Policy (RSoP) snap-in to view your policy settings. -author: lomayor -ms.prod: ie11 -ms.assetid: 0f21b320-e879-4a06-8589-aae6fc264666 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the RSoP snap-in to review policy settings (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using the Resultant Set of Policy (RSoP) snap-in to review policy settings -After you’ve deployed your custom Internet Explorer package to your employees, you can use the Resultant Set of Policy (RSoP) snap-in to view your created policy settings. The RSoP snap-in is a two-step process. First, you run the RSoP wizard to determine what information should be viewed. Second, you open the specific items in the console window to view the settings. For complete instructions about how to use RSoP, see [Resultant Set of Policy](https://go.microsoft.com/fwlink/p/?LinkId=259479). - -**To add the RSoP snap-in** - -1. On the **Start** screen, type *MMC*.

          -The Microsoft Management Console opens. - -2. Click **File**, and then click **Add/Remove Snap-in**. - -3. In the **Available snap-ins** window, go down to the **Resultant Set of Policy** snap-in option, click **Add**, and then click **OK**.

          -You’re now ready to use the RSoP snap-in from the console. - -**To use the RSoP snap-in** - -1. Right-click **Resultant Set of Policy** and then click **Generate RSoP Data**.

          -You’ll only need to go through the resulting RSoP Wizard first time you run the snap-in. - -2. Click **Next** on the **Welcome** screen. - -3. Under **Computer Configuration**, click **Administrative Templates**, click **Windows Components**, click **IE**, and then click the feature you want to review the policy settings for. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: manage +description: Learn how to use the Resultant Set of Policy (RSoP) snap-in to view your policy settings. +author: dansimp +ms.prod: ie11 +ms.assetid: 0f21b320-e879-4a06-8589-aae6fc264666 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the RSoP snap-in to review policy settings (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Using the Resultant Set of Policy (RSoP) snap-in to review policy settings + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +After you’ve deployed your custom Internet Explorer package to your employees, you can use the Resultant Set of Policy (RSoP) snap-in to view your created policy settings. The RSoP snap-in is a two-step process. First, you run the RSoP wizard to determine what information should be viewed. Second, you open the specific items in the console window to view the settings. For complete instructions about how to use RSoP, see [Resultant Set of Policy](https://go.microsoft.com/fwlink/p/?LinkId=259479). + +**To add the RSoP snap-in** + +1. On the **Start** screen, type *MMC*.

          +The Microsoft Management Console opens. + +2. Click **File**, and then click **Add/Remove Snap-in**. + +3. In the **Available snap-ins** window, go down to the **Resultant Set of Policy** snap-in option, click **Add**, and then click **OK**.

          +You’re now ready to use the RSoP snap-in from the console. + +**To use the RSoP snap-in** + +1. Right-click **Resultant Set of Policy** and then click **Generate RSoP Data**.

          +You’ll only need to go through the resulting RSoP Wizard first time you run the snap-in. + +2. Click **Next** on the **Welcome** screen. + +3. Under **Computer Configuration**, click **Administrative Templates**, click **Windows Components**, click **IE**, and then click the feature you want to review the policy settings for. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md index 2f2c8052cf..c092a2101b 100644 --- a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md @@ -1,56 +1,60 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Search Providers page in the IEAK 11 Customization Wizard to add additional providers and set the default. -author: lomayor -ms.prod: ie11 -ms.assetid: 48cfaba5-f4c0-493c-b656-445311b7bc52 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Search Providers page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Search Providers page in the IEAK 11 Wizard -The **Search Providers** page of the Internet Explorer Customization Wizard 11 lets you add a default search provider (typically, Bing®) and additional providers to your custom version of IE. - -**Note**
          The Internet Explorer Customization Wizard 11 offers improved and extended search settings. However, you can still optionally include support for Search Suggestions and Favicons, as well as Accelerator previews by using an .ins file from a previous version of IEAK. - -**To use the Search Providers page** - -1. Click **Import** to automatically import your existing search providers from your current version of IE into this list. - -2. Click **Add** to add more providers.

          -The **Search Provider** box appears. - -3. In the **Display Name** box, type the text that appears in the **Search Options** menu for the search provider. - -4. In the **URL** box, type the full URL to the search provider, including the https:// prefix. - -5. In the **Favicon URL** box, type the full URL to any icon to associate with your provider. - -6. In the **Suggestions URL (XML)** box, type the associated search suggestions in XML format. - -7. In the **Suggestions URL (JSON)** box, type the associated search suggestions in JavaScript Object Notation format. - -8. In the **Accelerator Preview URL** box, type the associated Accelerator preview URL for each provider, if it’s necessary. - -9. Check the **Display Search Suggestions for this provider** box to turn on search suggestions for the provider, and then click **OK**. - -10. Check the **Search Guide URL Customization** box if you’re going to add your search providers to a custom webpage for your employees. Then, type the URL to the custom webpage in the text box. - -11. Click **Edit** to change your search provider information, click **Set Default** to make a search provider the default for your employees, or **Remove** to delete a search provider. - -12. Click **Next** to go to the [Important URLs - Home Page and Support](important-urls-home-page-and-support-ieak11-wizard.md) page or **Back** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Search Providers page in the IEAK 11 Customization Wizard to add additional providers and set the default. +author: dansimp +ms.prod: ie11 +ms.assetid: 48cfaba5-f4c0-493c-b656-445311b7bc52 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Search Providers page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Search Providers page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Search Providers** page of the Internet Explorer Customization Wizard 11 lets you add a default search provider (typically, Bing®) and additional providers to your custom version of IE. + +**Note**
          The Internet Explorer Customization Wizard 11 offers improved and extended search settings. However, you can still optionally include support for Search Suggestions and Favicons, as well as Accelerator previews by using an .ins file from a previous version of IEAK. + +**To use the Search Providers page** + +1. Click **Import** to automatically import your existing search providers from your current version of IE into this list. + +2. Click **Add** to add more providers.

          +The **Search Provider** box appears. + +3. In the **Display Name** box, type the text that appears in the **Search Options** menu for the search provider. + +4. In the **URL** box, type the full URL to the search provider, including the https:// prefix. + +5. In the **Favicon URL** box, type the full URL to any icon to associate with your provider. + +6. In the **Suggestions URL (XML)** box, type the associated search suggestions in XML format. + +7. In the **Suggestions URL (JSON)** box, type the associated search suggestions in JavaScript Object Notation format. + +8. In the **Accelerator Preview URL** box, type the associated Accelerator preview URL for each provider, if it’s necessary. + +9. Check the **Display Search Suggestions for this provider** box to turn on search suggestions for the provider, and then click **OK**. + +10. Check the **Search Guide URL Customization** box if you’re going to add your search providers to a custom webpage for your employees. Then, type the URL to the custom webpage in the text box. + +11. Click **Edit** to change your search provider information, click **Set Default** to make a search provider the default for your employees, or **Remove** to delete a search provider. + +12. Click **Next** to go to the [Important URLs - Home Page and Support](important-urls-home-page-and-support-ieak11-wizard.md) page or **Back** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md index 9db3006a23..336ad87ef1 100644 --- a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md @@ -1,65 +1,69 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Learn about the security features available in Internet Explorer 11 and IEAK 11. -author: lomayor -ms.prod: ie11 -ms.assetid: 5b64c9cb-f8da-411a-88e4-fa69dea473e2 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Security features and IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Security features and IEAK 11 -Use Internet Explorer in conjunction with your new and existing security measures, to make sure the computers in your company aren’t compromised while on the Internet. - -## Enhanced Protection Mode -Extends Protected Mode to further restrict the ability of an attacker to access sensitive or personal information in personal and corporate environments, including: - -- Restricting access to higher-level processes in the AppContainer. - -- Improving security against memory safety exploits in 64-bit tab processes. - -This feature is turned off by default. For more info, see [Enhanced Protected Mode problems with Internet Explorer](../ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md). - -## Certificates and Digital Signatures -Web browsers have security features that help protect users from downloading harmful programs. Depending on the security level and the platform that you are using, the user may be prevented from, or warned against, downloading programs that are not digitally signed. Digital signatures show users where programs come from, verify that the programs have not been altered, and ensure that users do not receive unnecessary warnings when installing the custom browser. - -Because of this, the custom .cab files created by the Internet Explorer Customization Wizard should be signed, unless you pre-configure the Local intranet zone with a Low security setting. Any custom components you distribute with your browser package for these platforms should also be signed. - -### Understanding digital certificates -To sign your package and custom programs digitally, you must first obtain a digital certificate. You can obtain a certificate from a certification authority or a privately-controlled certificate server. For more info about obtaining certificates or setting up a certificate server, see the following: - -- Microsoft-trusted certification authorities ([Windows root certificate program requirements](https://go.microsoft.com/fwlink/p/?LinkId=759697)). - -- Certificates overview documentation ([Certificates](https://go.microsoft.com/fwlink/p/?LinkId=759698)). - -- Microsoft Active Directory Certificate Services ( [Active Directory Certificate Services](https://go.microsoft.com/fwlink/p/?LinkId=259521)). - -- Enterprise public key infrastructure (PKI) snap-in documentation ([Enterprise PKI](https://go.microsoft.com/fwlink/p/?LinkId=259526)). - -After you get a certificate, you should note the public and private keys, which are a matched set of keys that are created by the software publisher for encryption and decryption. They are generated on your device at the time the certificate is requested, and your private key is never sent to the certification authority or any other party. - -### Understanding code signing -Code signing varies, depening on how you plan to distribute your custom install package. - -- **If you plan to distribute custom packages over the Internet**, you must sign all custom components and the CMAK profile package (if used). Before you start the Internet Explorer Customization Wizard, make sure that both are signed. Typically, their respective manufacturers will have signed them. Otherwise, you can sign these using the Sign Tool (SignTool.exe) ( [SignTool.exe (Sign Tool)](https://go.microsoft.com/fwlink/p/?LinkId=71298)) or use the File Signing Tool (Signcode.exe) ([Signcode.exe (File Signing Tool)](https://go.microsoft.com/fwlink/p/?LinkId=71299)). You should read the documentation included with these tools for more info about all of the signing options.

          -In addition, after you run the Internet Explorer Customization Wizard, we highly recommend that you sign the IEAK package and the branding.cab file (if you are using it separately from the package). You can do this also using the tools mentioned above. For more information, download Code-Signing Best Practices ([Code-Signing Best Practices](https://go.microsoft.com/fwlink/p/?LinkId=71300)). - -- **If you plan to distribute your custom packages over an intranet**, sign the custom files or preconfigure the Local intranet zone with a Low security setting, because the default security setting does not allow users to download unsigned programs or code. - -### Understanding your private key -Your device creates two keys during the enrollment process of your digital certificate. One is a public key, which is sent to anyone you want to communicate with, and one is a private key, which is stored on your local device and must be kept secret. You use the private key to encrypt your data and the corresponding public key to decrypt it. - -You must keep your private key, private. To do this, we recommend: - -- **Separate test and release signing.** Set up a parallel code signing infrastructure, using test certificates created by an internal test root certificate authority. This helps to ensure that your certificates aren’t stored on an insecure build system, reducing the likelihood that they will be compromised. - -- **Tamper-proof storage.** Save your private keys on secure, tamper-proof hardware devices. - -- **Security.** Protect your private keys using physical security measures, such as cameras and card readers. - +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Learn about the security features available in Internet Explorer 11 and IEAK 11. +author: dansimp +ms.prod: ie11 +ms.assetid: 5b64c9cb-f8da-411a-88e4-fa69dea473e2 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Security features and IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Security features and IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Use Internet Explorer in conjunction with your new and existing security measures, to make sure the computers in your company aren’t compromised while on the Internet. + +## Enhanced Protection Mode +Extends Protected Mode to further restrict the ability of an attacker to access sensitive or personal information in personal and corporate environments, including: + +- Restricting access to higher-level processes in the AppContainer. + +- Improving security against memory safety exploits in 64-bit tab processes. + +This feature is turned off by default. For more info, see [Enhanced Protected Mode problems with Internet Explorer](../ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md). + +## Certificates and Digital Signatures +Web browsers have security features that help protect users from downloading harmful programs. Depending on the security level and the platform that you are using, the user may be prevented from, or warned against, downloading programs that are not digitally signed. Digital signatures show users where programs come from, verify that the programs have not been altered, and ensure that users do not receive unnecessary warnings when installing the custom browser. + +Because of this, the custom .cab files created by the Internet Explorer Customization Wizard should be signed, unless you pre-configure the Local intranet zone with a Low security setting. Any custom components you distribute with your browser package for these platforms should also be signed. + +### Understanding digital certificates +To sign your package and custom programs digitally, you must first obtain a digital certificate. You can obtain a certificate from a certification authority or a privately-controlled certificate server. For more info about obtaining certificates or setting up a certificate server, see the following: + +- Microsoft-trusted certification authorities ([Windows root certificate program requirements](https://go.microsoft.com/fwlink/p/?LinkId=759697)). + +- Certificates overview documentation ([Certificates](https://go.microsoft.com/fwlink/p/?LinkId=759698)). + +- Microsoft Active Directory Certificate Services ( [Active Directory Certificate Services](https://go.microsoft.com/fwlink/p/?LinkId=259521)). + +- Enterprise public key infrastructure (PKI) snap-in documentation ([Enterprise PKI](https://go.microsoft.com/fwlink/p/?LinkId=259526)). + +After you get a certificate, you should note the public and private keys, which are a matched set of keys that are created by the software publisher for encryption and decryption. They are generated on your device at the time the certificate is requested, and your private key is never sent to the certification authority or any other party. + +### Understanding code signing +Code signing varies, depening on how you plan to distribute your custom install package. + +- **If you plan to distribute custom packages over the Internet**, you must sign all custom components and the CMAK profile package (if used). Before you start the Internet Explorer Customization Wizard, make sure that both are signed. Typically, their respective manufacturers will have signed them. Otherwise, you can sign these using the Sign Tool (SignTool.exe) ( [SignTool.exe (Sign Tool)](https://go.microsoft.com/fwlink/p/?LinkId=71298)) or use the File Signing Tool (Signcode.exe) ([Signcode.exe (File Signing Tool)](https://go.microsoft.com/fwlink/p/?LinkId=71299)). You should read the documentation included with these tools for more info about all of the signing options.

          +In addition, after you run the Internet Explorer Customization Wizard, we highly recommend that you sign the IEAK package and the branding.cab file (if you are using it separately from the package). You can do this also using the tools mentioned above. For more information, download Code-Signing Best Practices ([Code-Signing Best Practices](https://go.microsoft.com/fwlink/p/?LinkId=71300)). + +- **If you plan to distribute your custom packages over an intranet**, sign the custom files or preconfigure the Local intranet zone with a Low security setting, because the default security setting does not allow users to download unsigned programs or code. + +### Understanding your private key +Your device creates two keys during the enrollment process of your digital certificate. One is a public key, which is sent to anyone you want to communicate with, and one is a private key, which is stored on your local device and must be kept secret. You use the private key to encrypt your data and the corresponding public key to decrypt it. + +You must keep your private key, private. To do this, we recommend: + +- **Separate test and release signing.** Set up a parallel code signing infrastructure, using test certificates created by an internal test root certificate authority. This helps to ensure that your certificates aren’t stored on an insecure build system, reducing the likelihood that they will be compromised. + +- **Tamper-proof storage.** Save your private keys on secure, tamper-proof hardware devices. + +- **Security.** Protect your private keys using physical security measures, such as cameras and card readers. + diff --git a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md index 007b61208d..c78a131719 100644 --- a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md @@ -1,43 +1,47 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Security and Privacy Settings page in the IEAK 11 Customization Wizard to manage your security zones, privacy settings, and content ratings. -author: lomayor -ms.prod: ie11 -ms.assetid: cb7cd1df-6a79-42f6-b3a1-8ae467053f82 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Security and Privacy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Security and Privacy Settings page in the IEAK 11 Wizard -The **Security and Privacy Settings** page of the Internet Explorer Customization Wizard 11 lets you manage your security zones, privacy settings, and content ratings. These settings help restrict the types of content your employees can access from the Internet, including any content that might be considered offensive or otherwise inappropriate in a corporate setting. - -**To use the Security and Privacy Settings page** - -1. Decide if you want to customize your security zones and privacy settings. You can pick: - - - **Do not customize security zones and privacy.** Pick this option if you don’t want to customize your security zones and privacy settings. - - - **Import the current security zones and privacy.** Pick this option to import your security zone and privacy settings from your computer and use them as the preset for your employee’s settings.

          **Note**
          To change your settings, click **Modify Settings** to open the **Internet Properties** box, and then click the **Security** and **Privacy** tabs to make your changes. - -2. Decide if you want to customize your content ratings. You can pick: - - - **Do not customize content ratings.** Pick this option if you don’t want to customize content ratings. - - - **Import the current content ratings settings.** Pick this option to import your content rating settings from your computer and use them as the preset for your employee’s settings.

          **Note**
          Not all Internet content is rated. If you choose to allow users to view unrated sites, some of those sites could contain inappropriate material. To change your settings, click **Modify Settings** to open the **Content Advisor** box, where you can make your changes. - -3. Click **Next** to go to the [Add a Root Certificate](add-root-certificate-ieak11-wizard.md) page or **Back** to go to the [Proxy Settings](proxy-settings-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Security and Privacy Settings page in the IEAK 11 Customization Wizard to manage your security zones, privacy settings, and content ratings. +author: dansimp +ms.prod: ie11 +ms.assetid: cb7cd1df-6a79-42f6-b3a1-8ae467053f82 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Security and Privacy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Security and Privacy Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Security and Privacy Settings** page of the Internet Explorer Customization Wizard 11 lets you manage your security zones, privacy settings, and content ratings. These settings help restrict the types of content your employees can access from the Internet, including any content that might be considered offensive or otherwise inappropriate in a corporate setting. + +**To use the Security and Privacy Settings page** + +1. Decide if you want to customize your security zones and privacy settings. You can pick: + + - **Do not customize security zones and privacy.** Pick this option if you don’t want to customize your security zones and privacy settings. + + - **Import the current security zones and privacy.** Pick this option to import your security zone and privacy settings from your computer and use them as the preset for your employee’s settings.

          **Note**
          To change your settings, click **Modify Settings** to open the **Internet Properties** box, and then click the **Security** and **Privacy** tabs to make your changes. + +2. Decide if you want to customize your content ratings. You can pick: + + - **Do not customize content ratings.** Pick this option if you don’t want to customize content ratings. + + - **Import the current content ratings settings.** Pick this option to import your content rating settings from your computer and use them as the preset for your employee’s settings.

          **Note**
          Not all Internet content is rated. If you choose to allow users to view unrated sites, some of those sites could contain inappropriate material. To change your settings, click **Modify Settings** to open the **Content Advisor** box, where you can make your changes. + +3. Click **Next** to go to the [Add a Root Certificate](add-root-certificate-ieak11-wizard.md) page or **Back** to go to the [Proxy Settings](proxy-settings-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md index 74e61ad2bb..b4fd0c45b2 100644 --- a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md @@ -1,27 +1,31 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Security Imports\] .INS file setting to decide whether to import security info to your custom package. -author: lomayor -ms.prod: ie11 -ms.assetid: 19791c44-aaa7-4f37-9faa-85cbdf29f68e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Security Imports .INS file to import security info (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Security Imports .INS file to import security info -Info about how to import security information from your local device to your custom package. - -|Name |Value |Description | -|-----|------|------------| -|ImportAuthCode |

          • **0.** Don’t import the existing settings.
          • **1.** Import the existing settings.
          |Whether to import the existing Authenticode settings. | -|ImportRatings |
          • **0.** Don’t import the existing settings.
          • **1.** Import the existing settings.
          |Whether to import the existing Content Ratings settings. | -|ImportSecZones |
          • **0.** Don’t import the existing settings.
          • **1.** Import the existing settings.
          |Whether to import the existing Security Zone settings. | -|ImportSiteCert |
          • **0.** Don’t import the existing authorities.
          • **1.** Import the existing authorities.
          |Whether to import the existing site certification authorities. | -|Win16SiteCerts |
          • **0.** Don’t use the site certificates.
          • **1.** Use the site certificates.
          |Whether to use site certificates for computers running 16-bit versions of Windows. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[Security Imports\] .INS file setting to decide whether to import security info to your custom package. +author: dansimp +ms.prod: ie11 +ms.assetid: 19791c44-aaa7-4f37-9faa-85cbdf29f68e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Security Imports .INS file to import security info (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Security Imports .INS file to import security info + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about how to import security information from your local device to your custom package. + +|Name |Value |Description | +|-----|------|------------| +|ImportAuthCode |
          • **0.** Don’t import the existing settings.
          • **1.** Import the existing settings.
          |Whether to import the existing Authenticode settings. | +|ImportRatings |
          • **0.** Don’t import the existing settings.
          • **1.** Import the existing settings.
          |Whether to import the existing Content Ratings settings. | +|ImportSecZones |
          • **0.** Don’t import the existing settings.
          • **1.** Import the existing settings.
          |Whether to import the existing Security Zone settings. | +|ImportSiteCert |
          • **0.** Don’t import the existing authorities.
          • **1.** Import the existing authorities.
          |Whether to import the existing site certification authorities. | +|Win16SiteCerts |
          • **0.** Don’t use the site certificates.
          • **1.** Use the site certificates.
          |Whether to use site certificates for computers running 16-bit versions of Windows. | + diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md index 228805f528..e4fcd7c739 100644 --- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md @@ -1,123 +1,127 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Info about some of the known issues using the Internet Exporer Customization Wizard and a custom Internet Explorer install package. -author: lomayor -ms.author: lomayor -ms.prod: ie11 -ms.assetid: 9e22cc61-6c63-4cab-bfdf-6fe49db945e4 -ms.reviewer: -audience: itpro manager: dansimp -title: Troubleshoot custom package and IEAK 11 problems (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Troubleshoot custom package and IEAK 11 problems -While the Internet Explorer Customization Wizard has been around for quite a while, there are still some known issues that you might encounter while deploying or managing your custom IE install package. - -## I am unable to locate some of the wizard pages -The most common reasons you will not see certain pages is because: - -- **Your licensing agreement with Microsoft.** Your licensing agreement determines whether you install the **Internal** or **External** version of the Internet Explorer Customization Wizard, and there are different features available for each version. For info about which features are available for each version, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). - -- **Your choice of operating system.** Depending on the operating system you picked from the **Platform Selection** page of the wizard, you might not see all of the pages. Some features aren’t available for all operating systems. For more information, see [Use the Platform Selection page in the IEAK 11 Wizard](platform-selection-ieak11-wizard.md). - -- **Your choice of features.** Depending on what you selected from the **Feature Selection** page of the wizard, you might not see all of the pages. You need to make sure that the features you want to customize are all checked. For more information, see [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md). - -## Internet Explorer Setup fails on user's devices -Various issues can cause problems during Setup, including missing files, trust issues, or URL monikers. You can troubleshoot these issues by reviewing the Setup log file, located at `IE11\_main.log` from the **Windows** folder (typically, `C:\Windows`). The log file covers the entire Setup process from the moment IE11Setup.exe starts until the last .cab file finishes, providing error codes that you can use to help determine the cause of the failure. - -### Main.log file codes - -|Code |Description | -|-----|------------| -|0 |Initializing, making a temporary folder, and checking disk space. | -|1 |Checking for all dependencies. | -|2 |Downloading files from the server. | -|3 |Copying files from download location to the temporary installation folder. | -|4 |Restarting download and retrying Setup, because of a time-out error or other download error. | -|5 |Checking trust and checking permissions. | -|6 |Extracting files. | -|7 |Running Setup program (an .inf or .exe file). | -|8 |Installation is finished. | -|9 |Download finished, and all files are downloaded. | - -### Main.log error codes - -|Code |Description | -|-----|------------| -|80100003 |Files are missing from the download folder during installation. | -|800bxxxx |An error code starting with 800b is a trust failure. | -|800Cxxxx |An error code starting with 800C is a Urlmon.dll failure. | - - -## Internet Explorer Setup connection times out -Internet Explorer Setup can switch servers during the installation process to maintain maximum throughput or to recover from a non-responsive download site (you receive less than 1 byte in 2 minutes). If the connection times out, but Setup is able to connect to the next download site on the list, your download starts over. If however the connection times out and Setup can’t connect to a different server, it’ll ask if you want to stop the installation or try again. - -To address connection issues (for example, as a result of server problems) where Setup can’t locate another download site by default, we recommend you overwrite your first download server using this workaround: - -``` syntax -\ie11setup.exe /C:"ie11wzd.exe /S:""\ie11setup.exe"" /L:""https://your_Web_server/your_Web_site/ie11sites.dat""" -``` - -Where `` represents the folder location where you stored IE11setup.exe. - -## Users cannot uninstall IE -If you cannot uninstall IE using **Uninstall or change a program** in the Control Panel, it could be because the uninstall information is not on the computer. To fix this issue, you should: - -1. Review the uninstall log file, IE11Uninst.log, located in the `C:\Windows` folder. This log file covers the entire uninstallation process, including every file change, every registry change, and any dialog boxes that are shown. - -2. Try to manually uninstall IE. Go to the backup folder, `:\Windows\$ie11$`, and run the uninstall file, `Spunist.exe`. - -  -## The Internet Explorer Customization Wizard 11 does not work with user names that user double-byte character sets -The customization wizard does not work with user names that use double-byte character sets, such as Chinese or Japanese. To fix this, set the **TEMP** and **TMP** environmental variables to a path that does not use these characters (for example, C:\temp). - -1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. -2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory. - -  -## Unicode characters are not supported in IEAK 11 path names -While Unicode characters, such as Emoji, are supported for organization names and other branding items, you must not use Unicode characters in any paths associated with running the Internet Explorer Customization Wizard 11. This includes paths to your IEAK 11 installation and to the storage location for your custom packages after they're built. - -## Internet Explorer branding conflicts when using both Unattend and IEAK 11 to customize Internet Explorer settings -Using both Unattend settings and an IEAK custom package to modify a user's version of Internet Explorer 11 might cause a user to lose personalized settings during an upgrade. For example, many manufacturers configure Internet Explorer using Unattend settings. If a user purchases a laptop, and then signs up for Internet service, their Internet Service Provider (ISP) might provide a version of Internet Explorer that has been branded (for example, with a custom homepage for that ISP) using Internet Explorer Customization Wizard 11. If that user later upgrades to a new version of Internet Explorer, the Unattend settings from the laptop manufacturer will be reapplied, overwriting any settings that the user configured for themselves (such as their homepage). - - -## IEAK 11 does not correctly apply the Delete all existing items under Favorites, Favorites Bar and Feeds option -The Internet Explorer Customization Wizard 11 does not correctly apply the **Delete all existing items under Favorites**, **Favorites Bar and Feeds** option, available on the **Browsing Options** page. - -Selecting to include this feature in your customized Internet Explorer package enables the deletion of existing items in the **Favorites** and **Favorites Bar** areas, but it doesn't enable deletion in the **Feeds** area. In addition, this setting adds a new favorite, titled “Web Slice Gallery” to the **Favorites Bar**. - -## F1 does not activate Help on Automatic Version Synchronization page -Pressing the **F1** button on the **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 does not display the **Help** page. Clicking the **Help** button enables you to open the Help system and view information about this page. - -## Certificate installation does not work on IEAK 11 -IEAK 11 doesn't install certificates added using the Add a Root Certificate page of the Internet Explorer Customization Wizard 11. Administrators can manually install certificates using the Certificates Microsoft Management Console snap-in (Certmgr.msc) or using the command-line tool, Certificate Manager (Certmgr.exe). - ->[!NOTE] ->This applies only when using the External licensing mode of IEAK 11. - -## The Additional Settings page appears in the wrong language when using a localized version of IEAK 11 -When using IEAK 11 in other languages, the settings on the Additional Settings page appear in the language of the target platform, regardless of the IEAK 11 language. - ->[!NOTE] ->This applies only when using the Internal licensing mode of IEAK 11. - -To work around this issue, run the customization wizard following these steps: -1. On the **Language Selection** page, select the language that matches the language of your installed IEAK 11. -2. Click **Next**, and then click **Synchronize** on the Automatic Version Synchronization page. -3. After synchronization is complete, cancel the wizard. -4. Repeat these steps for each platform on the Platform Selection page. - -After performing these steps, you must still do the following each time you synchronize a new language and platform: -1. Open File Explorer to the Program Files\Windows IEAK 11 or Program Files (x86)\Windows IEAK 11 folder. -2. Open the **Policies** folder, and then open the appropriate platform folder. -3. Copy the contents of the matching-language folder into the new language folder. - -After completing these steps, the Additional Settings page matches your wizard’s language. - -## Unable to access feeds stored in a subfolder -Adding feeds using the **Favorites**, **Favorites Bar**, and **Feeds** page of the Internet Explorer 11 Customization Wizard requires that the feeds be stored in a single folder. Creating two levels of folders, and creating the feed in the subfolder, causes the feed to fail. +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +description: Info about some of the known issues using the Internet Exporer Customization Wizard and a custom Internet Explorer install package. +author: dansimp +ms.author: dansimp +ms.prod: ie11 +ms.assetid: 9e22cc61-6c63-4cab-bfdf-6fe49db945e4 +ms.reviewer: +audience: itpro +manager: dansimp +title: Troubleshoot custom package and IEAK 11 problems (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Troubleshoot custom package and IEAK 11 problems + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +While the Internet Explorer Customization Wizard has been around for quite a while, there are still some known issues that you might encounter while deploying or managing your custom IE install package. + +## I am unable to locate some of the wizard pages +The most common reasons you will not see certain pages is because: + +- **Your licensing agreement with Microsoft.** Your licensing agreement determines whether you install the **Internal** or **External** version of the Internet Explorer Customization Wizard, and there are different features available for each version. For info about which features are available for each version, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). + +- **Your choice of operating system.** Depending on the operating system you picked from the **Platform Selection** page of the wizard, you might not see all of the pages. Some features aren’t available for all operating systems. For more information, see [Use the Platform Selection page in the IEAK 11 Wizard](platform-selection-ieak11-wizard.md). + +- **Your choice of features.** Depending on what you selected from the **Feature Selection** page of the wizard, you might not see all of the pages. You need to make sure that the features you want to customize are all checked. For more information, see [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md). + +## Internet Explorer Setup fails on user's devices +Various issues can cause problems during Setup, including missing files, trust issues, or URL monikers. You can troubleshoot these issues by reviewing the Setup log file, located at `IE11\_main.log` from the **Windows** folder (typically, `C:\Windows`). The log file covers the entire Setup process from the moment IE11Setup.exe starts until the last .cab file finishes, providing error codes that you can use to help determine the cause of the failure. + +### Main.log file codes + +|Code |Description | +|-----|------------| +|0 |Initializing, making a temporary folder, and checking disk space. | +|1 |Checking for all dependencies. | +|2 |Downloading files from the server. | +|3 |Copying files from download location to the temporary installation folder. | +|4 |Restarting download and retrying Setup, because of a time-out error or other download error. | +|5 |Checking trust and checking permissions. | +|6 |Extracting files. | +|7 |Running Setup program (an .inf or .exe file). | +|8 |Installation is finished. | +|9 |Download finished, and all files are downloaded. | + +### Main.log error codes + +|Code |Description | +|-----|------------| +|80100003 |Files are missing from the download folder during installation. | +|800bxxxx |An error code starting with 800b is a trust failure. | +|800Cxxxx |An error code starting with 800C is a Urlmon.dll failure. | + + +## Internet Explorer Setup connection times out +Internet Explorer Setup can switch servers during the installation process to maintain maximum throughput or to recover from a non-responsive download site (you receive less than 1 byte in 2 minutes). If the connection times out, but Setup is able to connect to the next download site on the list, your download starts over. If however the connection times out and Setup can’t connect to a different server, it’ll ask if you want to stop the installation or try again. + +To address connection issues (for example, as a result of server problems) where Setup can’t locate another download site by default, we recommend you overwrite your first download server using this workaround: + +``` syntax +\ie11setup.exe /C:"ie11wzd.exe /S:""\ie11setup.exe"" /L:""https://your_Web_server/your_Web_site/ie11sites.dat""" +``` + +Where `` represents the folder location where you stored IE11setup.exe. + +## Users cannot uninstall IE +If you cannot uninstall IE using **Uninstall or change a program** in the Control Panel, it could be because the uninstall information is not on the computer. To fix this issue, you should: + +1. Review the uninstall log file, IE11Uninst.log, located in the `C:\Windows` folder. This log file covers the entire uninstallation process, including every file change, every registry change, and any dialog boxes that are shown. + +2. Try to manually uninstall IE. Go to the backup folder, `:\Windows\$ie11$`, and run the uninstall file, `Spunist.exe`. + +  +## The Internet Explorer Customization Wizard 11 does not work with user names that user double-byte character sets +The customization wizard does not work with user names that use double-byte character sets, such as Chinese or Japanese. To fix this, set the **TEMP** and **TMP** environmental variables to a path that does not use these characters (for example, C:\temp). + +1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. +2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory. + +  +## Unicode characters are not supported in IEAK 11 path names +While Unicode characters, such as Emoji, are supported for organization names and other branding items, you must not use Unicode characters in any paths associated with running the Internet Explorer Customization Wizard 11. This includes paths to your IEAK 11 installation and to the storage location for your custom packages after they're built. + +## Internet Explorer branding conflicts when using both Unattend and IEAK 11 to customize Internet Explorer settings +Using both Unattend settings and an IEAK custom package to modify a user's version of Internet Explorer 11 might cause a user to lose personalized settings during an upgrade. For example, many manufacturers configure Internet Explorer using Unattend settings. If a user purchases a laptop, and then signs up for Internet service, their Internet Service Provider (ISP) might provide a version of Internet Explorer that has been branded (for example, with a custom homepage for that ISP) using Internet Explorer Customization Wizard 11. If that user later upgrades to a new version of Internet Explorer, the Unattend settings from the laptop manufacturer will be reapplied, overwriting any settings that the user configured for themselves (such as their homepage). + + +## IEAK 11 does not correctly apply the Delete all existing items under Favorites, Favorites Bar and Feeds option +The Internet Explorer Customization Wizard 11 does not correctly apply the **Delete all existing items under Favorites**, **Favorites Bar and Feeds** option, available on the **Browsing Options** page. + +Selecting to include this feature in your customized Internet Explorer package enables the deletion of existing items in the **Favorites** and **Favorites Bar** areas, but it doesn't enable deletion in the **Feeds** area. In addition, this setting adds a new favorite, titled “Web Slice Gallery” to the **Favorites Bar**. + +## F1 does not activate Help on Automatic Version Synchronization page +Pressing the **F1** button on the **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 does not display the **Help** page. Clicking the **Help** button enables you to open the Help system and view information about this page. + +## Certificate installation does not work on IEAK 11 +IEAK 11 doesn't install certificates added using the Add a Root Certificate page of the Internet Explorer Customization Wizard 11. Administrators can manually install certificates using the Certificates Microsoft Management Console snap-in (Certmgr.msc) or using the command-line tool, Certificate Manager (Certmgr.exe). + +> [!NOTE] +> This applies only when using the External licensing mode of IEAK 11. + +## The Additional Settings page appears in the wrong language when using a localized version of IEAK 11 +When using IEAK 11 in other languages, the settings on the Additional Settings page appear in the language of the target platform, regardless of the IEAK 11 language. + +> [!NOTE] +> This applies only when using the Internal licensing mode of IEAK 11. + +To work around this issue, run the customization wizard following these steps: +1. On the **Language Selection** page, select the language that matches the language of your installed IEAK 11. +2. Click **Next**, and then click **Synchronize** on the Automatic Version Synchronization page. +3. After synchronization is complete, cancel the wizard. +4. Repeat these steps for each platform on the Platform Selection page. + +After performing these steps, you must still do the following each time you synchronize a new language and platform: +1. Open File Explorer to the Program Files\Windows IEAK 11 or Program Files (x86)\Windows IEAK 11 folder. +2. Open the **Policies** folder, and then open the appropriate platform folder. +3. Copy the contents of the matching-language folder into the new language folder. + +After completing these steps, the Additional Settings page matches your wizard’s language. + +## Unable to access feeds stored in a subfolder +Adding feeds using the **Favorites**, **Favorites Bar**, and **Feeds** page of the Internet Explorer 11 Customization Wizard requires that the feeds be stored in a single folder. Creating two levels of folders, and creating the feed in the subfolder, causes the feed to fail. diff --git a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md index 965fda174e..06a1d3c029 100644 --- a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md @@ -1,40 +1,44 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[URL\] .INS file setting to decide whether to use an auto-configured proxy server. -author: dansimp -ms.prod: ie11 -ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the URL .INS file to use an auto-configured proxy server -Info about whether to use an auto-configured proxy server. If yes, this also includes the URLs to the pages that appear when your employees first connect to that server. - -|Name |Value |Description | -|-----|------|------------| -|AutoConfig |
          • **0.** Don’t automatically configure the browser.
          • **1.** Automatically configure the browser.
          |Determines whether to automatically configure the customized browser on your employee’s device. | -|AutoConfigJSURL |`` |The URL for the proxy auto-config file (.js or .jvs) | -|AutoConfigTime |*integer* |Automatically configures the browser on your employee’s device after its run for a specified length of time. | -|AutoConfigURL |`` |The URL for the proxy auto-config (.pac) file. | -|FirstHomePage |`` |The page (URL) that appears the first time the custom browser is opened on the employee’s device. | -|Help_Page |`` |The URL to your internal technical support site. | -|Home_Page |`` |The URL to your default **Home** page. | -|NoWelcome |
          • **0.** Display the **Welcome** page.
          • **1.** Don’t display the **Welcome** page.
          |Determines whether to show the **Welcome** page the first time the browser’s used on an employee’s device. | -|Quick_Link_1 |`` |The URL to your first Quick Link. | -|Quick_Link_1_Name |`` |The name of the site associated with Quick_Link_1. | -|Quick_Link_2 |`` |The URL to your second Quick Link. | -|Quick_Link_2_Name |`` |The name of the site associated with Quick_Link_2. | -|Quick_Link_X |`` |The URL to another Quick Link. | -|Quick_Link_X_Icon |`` |A Quick Links icon (.ico) file. | -|Quick_Link_X_Name |`` |The name of the site associated with another Quick Link. | -|Quick_Link_X_Offline |
          • **0.** Don’t make the Quick Links available offline.
          • **1.** Make the Quick Links available offline.
          |Determines whether to make the Quick Links available for offline browsing. | -|Search_Page |`` |The URL to the default search page. | -|UseLocalIns |
          • **0.** Don’t use a local .ins file.
          • **1.** Use a local .ins file.
          |Determines whether to use a local Internet Settings (.ins) file | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[URL\] .INS file setting to decide whether to use an auto-configured proxy server. +author: dansimp +ms.prod: ie11 +ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the URL .INS file to use an auto-configured proxy server + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about whether to use an auto-configured proxy server. If yes, this also includes the URLs to the pages that appear when your employees first connect to that server. + +|Name |Value |Description | +|-----|------|------------| +|AutoConfig |
          • **0.** Don’t automatically configure the browser.
          • **1.** Automatically configure the browser.
          |Determines whether to automatically configure the customized browser on your employee’s device. | +|AutoConfigJSURL |`` |The URL for the proxy auto-config file (.js or .jvs) | +|AutoConfigTime |*integer* |Automatically configures the browser on your employee’s device after its run for a specified length of time. | +|AutoConfigURL |`` |The URL for the proxy auto-config (.pac) file. | +|FirstHomePage |`` |The page (URL) that appears the first time the custom browser is opened on the employee’s device. | +|Help_Page |`` |The URL to your internal technical support site. | +|Home_Page |`` |The URL to your default **Home** page. | +|NoWelcome |
          • **0.** Display the **Welcome** page.
          • **1.** Don’t display the **Welcome** page.
          |Determines whether to show the **Welcome** page the first time the browser’s used on an employee’s device. | +|Quick_Link_1 |`` |The URL to your first Quick Link. | +|Quick_Link_1_Name |`` |The name of the site associated with Quick_Link_1. | +|Quick_Link_2 |`` |The URL to your second Quick Link. | +|Quick_Link_2_Name |`` |The name of the site associated with Quick_Link_2. | +|Quick_Link_X |`` |The URL to another Quick Link. | +|Quick_Link_X_Icon |`` |A Quick Links icon (.ico) file. | +|Quick_Link_X_Name |`` |The name of the site associated with another Quick Link. | +|Quick_Link_X_Offline |
          • **0.** Don’t make the Quick Links available offline.
          • **1.** Make the Quick Links available offline.
          |Determines whether to make the Quick Links available for offline browsing. | +|Search_Page |`` |The URL to the default search page. | +|UseLocalIns |
          • **0.** Don’t use a local .ins file.
          • **1.** Use a local .ins file.
          |Determines whether to use a local Internet Settings (.ins) file | + diff --git a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md index ed8f2be8f1..364daedbbc 100644 --- a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md @@ -1,60 +1,64 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the User Experience page in the IEAK 11 Customization Wizard to decide user interaction with the Setup process. -author: dansimp -ms.prod: ie11 -ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the User Experience page in the IEAK 11 Wizard -The **User Experience** page of the Internet Explorer Customization Wizard 11 lets you decide how much you want your employees to interact with the custom package’s Setup process. - -**Note**
          You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.

          The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7. - -**To use the User Experience page** - -1. Choose how your employee should interact with Setup, including: - - - **Interactive installation**. Lets your employees change installation options while installing your custom package. This experience shows all of the progress and error messages throughout the process. - - - **Hands-free installation**. Lets you make all of the decisions for your employees. However, they’ll still see all of the progress and error messages throughout the process. - - - **Completely silent installation**. Lets you make all of the decisions for your employees and hides all of the progress and error messages. Because this mode is completely silent, if the installation fails, your employees won’t know and they won’t be able to run the installation package again. -

          Both the hands-free and completely silent installation options will: - - - Answer prompts so Setup can continue. - - - Accept the license agreement. - - - Determine that Internet Explorer 11 is installed and not just downloaded. - - - Perform your specific installation type. - - - Install IE in the default location, unless it is already installed. In that case, the new version of the browser is installed in the same location as the previous version. - -2. Choose if your employee’s device will restart at the end of Setup. - - - **Default**. Prompts your employees to restart after installing IE. - - - **No restart**. Doesn’t restart the computer after installing IE. The employee will have to manually restart later. - - - **Force restart**. Automatically restarts the computer after installing IE. - -3. Click **Next** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page or **Back** to go to the [Internal Install](internal-install-ieak11-wizard.md) page. - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the User Experience page in the IEAK 11 Customization Wizard to decide user interaction with the Setup process. +author: dansimp +ms.prod: ie11 +ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the User Experience page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **User Experience** page of the Internet Explorer Customization Wizard 11 lets you decide how much you want your employees to interact with the custom package’s Setup process. + +**Note**
          You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.

          The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7. + +**To use the User Experience page** + +1. Choose how your employee should interact with Setup, including: + + - **Interactive installation**. Lets your employees change installation options while installing your custom package. This experience shows all of the progress and error messages throughout the process. + + - **Hands-free installation**. Lets you make all of the decisions for your employees. However, they’ll still see all of the progress and error messages throughout the process. + + - **Completely silent installation**. Lets you make all of the decisions for your employees and hides all of the progress and error messages. Because this mode is completely silent, if the installation fails, your employees won’t know and they won’t be able to run the installation package again. +

          Both the hands-free and completely silent installation options will: + + - Answer prompts so Setup can continue. + + - Accept the license agreement. + + - Determine that Internet Explorer 11 is installed and not just downloaded. + + - Perform your specific installation type. + + - Install IE in the default location, unless it is already installed. In that case, the new version of the browser is installed in the same location as the previous version. + +2. Choose if your employee’s device will restart at the end of Setup. + + - **Default**. Prompts your employees to restart after installing IE. + + - **No restart**. Doesn’t restart the computer after installing IE. The employee will have to manually restart later. + + - **Force restart**. Automatically restarts the computer after installing IE. + +3. Click **Next** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page or **Back** to go to the [Internal Install](internal-install-ieak11-wizard.md) page. + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md index 3efd12ffa8..c9bb888bed 100644 --- a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md +++ b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md @@ -1,37 +1,41 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Info about how to use Internet Settings (.ins) files and the IEAK 11 to configure your custom browser package. -author: dansimp -ms.prod: ie11 -ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using Internet Settings (.INS) files with IEAK 11 -Use the Internet Settings (.ins) files and the Internet Explorer Administration Kit 11 (IEAK 11) to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. - -Here's a list of the available .INS file settings: - -|Setting |Description | -|-----------------------------------------|------------------------------------------------------------------------------| -|[Branding](branding-ins-file-setting.md) |Customize the branding and setup information in your browser package. | -|[BrowserToolbars](browsertoolbars-ins-file-setting.md) |Customize the appearance of the IE toolbar. | -|[CabSigning](cabsigning-ins-file-setting.md) |Digital signature information for your programs. | -|[ConnectionSettings](connectionsettings-ins-file-setting.md) |Info about the networking connection settings used to install your custom package. | -|[CustomBranding](custombranding-ins-file-setting.md) |URL location to your branding cabinet (.cab) file. | -|[ExtRegInf](extreginf-ins-file-setting.md) |Names of your Setup information (.inf) files and the installation mode for components. | -|[FavoritesEx](favoritesex-ins-file-setting.md) |Add a path to your icon file for **Favorites**, decide whether **Favorites** are available offline, and add URLs to each**Favorites** site. | -|[HideCustom](hidecustom-ins-file-setting.md) |Whether to hide the globally unique identifier (GUID) for each custom component. | -|[ISP_Security](isp-security-ins-file-setting.md) |The root certificate you’re adding to your custom package. | -|[Media](media-ins-file-setting.md) |Types of media in which your custom installation package is available. | -|[Proxy](proxy-ins-file-setting.md) |Whether to use a proxy server. | -|[Security Imports](security-imports-ins-file-setting.md) |Whether to import security information for your custom package. | -|[URL](url-ins-file-setting.md) |Whether to use an auto-configured proxy server. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Info about how to use Internet Settings (.ins) files and the IEAK 11 to configure your custom browser package. +author: dansimp +ms.prod: ie11 +ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Using Internet Settings (.INS) files with IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Use the Internet Settings (.ins) files and the Internet Explorer Administration Kit 11 (IEAK 11) to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. + +Here's a list of the available .INS file settings: + +|Setting |Description | +|-----------------------------------------|------------------------------------------------------------------------------| +|[Branding](branding-ins-file-setting.md) |Customize the branding and setup information in your browser package. | +|[BrowserToolbars](browsertoolbars-ins-file-setting.md) |Customize the appearance of the IE toolbar. | +|[CabSigning](cabsigning-ins-file-setting.md) |Digital signature information for your programs. | +|[ConnectionSettings](connectionsettings-ins-file-setting.md) |Info about the networking connection settings used to install your custom package. | +|[CustomBranding](custombranding-ins-file-setting.md) |URL location to your branding cabinet (.cab) file. | +|[ExtRegInf](extreginf-ins-file-setting.md) |Names of your Setup information (.inf) files and the installation mode for components. | +|[FavoritesEx](favoritesex-ins-file-setting.md) |Add a path to your icon file for **Favorites**, decide whether **Favorites** are available offline, and add URLs to each**Favorites** site. | +|[HideCustom](hidecustom-ins-file-setting.md) |Whether to hide the globally unique identifier (GUID) for each custom component. | +|[ISP_Security](isp-security-ins-file-setting.md) |The root certificate you’re adding to your custom package. | +|[Media](media-ins-file-setting.md) |Types of media in which your custom installation package is available. | +|[Proxy](proxy-ins-file-setting.md) |Whether to use a proxy server. | +|[Security Imports](security-imports-ins-file-setting.md) |Whether to import security information for your custom package. | +|[URL](url-ins-file-setting.md) |Whether to use an auto-configured proxy server. | + diff --git a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md index 5e8b4e979e..d62e11e507 100644 --- a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md +++ b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md @@ -1,68 +1,72 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. -author: dansimp -ms.author: dansimp -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -title: What IEAK can do for you -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# What IEAK can do for you - -Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. - -IEAK 10 and newer includes the ability to install using one of the following installation modes: - -- Internal - -- External - -## IEAK 11 users -Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. - -IEAK 10 and newer includes the ability to install using one of the following installation modes: -- Internal -- External - ->[!NOTE] ->IEAK 11 works in network environments, with or without Microsoft Active Directory service. - - -### Corporations -IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality. - -Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older). - -### Internet service providers -IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package. - -ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older). - -### Internet content providers -IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use. - -ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older) - -### Independent software vendors -IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar. - -ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older). - -## Additional resources - -- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) -- [Download IEAK 11](ieak-information-and-downloads.md) -- [IEAK 11 overview](index.md) -- [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) -- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) -- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) -- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643) +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +ms.pagetype: security +description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. +author: dansimp +ms.author: dansimp +ms.manager: elizapo +ms.prod: ie11 +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +title: What IEAK can do for you +ms.sitesec: library +ms.date: 05/10/2018 +--- + +# What IEAK can do for you + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. + +IEAK 10 and newer includes the ability to install using one of the following installation modes: + +- Internal + +- External + +## IEAK 11 users +Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. + +IEAK 10 and newer includes the ability to install using one of the following installation modes: +- Internal +- External + +> [!NOTE] +> IEAK 11 works in network environments, with or without Microsoft Active Directory service. + + +### Corporations +IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality. + +Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older). + +### Internet service providers +IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package. + +ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older). + +### Internet content providers +IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use. + +ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older) + +### Independent software vendors +IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar. + +ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older). + +## Additional resources + +- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) +- [Download IEAK 11](ieak-information-and-downloads.md) +- [IEAK 11 overview](index.md) +- [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) +- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) +- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md) +- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) +- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643) diff --git a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md index e81b0eedea..03de7ed423 100644 --- a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md @@ -1,31 +1,35 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Wizard Complete - Next Steps page in the IEAK 11 Customization Wizard to build your custom Internet Explorer install package. -author: dansimp -ms.prod: ie11 -ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard -The **Wizard Complete – Next Steps** page of the Internet Explorer Customization Wizard 11 lets you build your custom installation package, after you click **Finish**. - -In most cases, your next steps will be to prepare your files for installation from your network or from another distribution method. If you haven’t already done it, you’ll need to digitally sign any program or .cab files that are going to be distributed over the Internet or over an intranet that isn’t configured to allow downloads. - -After that, the steps you’ll use to distribute your customized browser will vary, depending on your version of IEAK (Internal or External) and the media you’re using to distribute the package. For more information, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Wizard Complete - Next Steps page in the IEAK 11 Customization Wizard to build your custom Internet Explorer install package. +author: dansimp +ms.prod: ie11 +ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Wizard Complete – Next Steps** page of the Internet Explorer Customization Wizard 11 lets you build your custom installation package, after you click **Finish**. + +In most cases, your next steps will be to prepare your files for installation from your network or from another distribution method. If you haven’t already done it, you’ll need to digitally sign any program or .cab files that are going to be distributed over the Internet or over an intranet that isn’t configured to allow downloads. + +After that, the steps you’ll use to distribute your customized browser will vary, depending on your version of IEAK (Internal or External) and the media you’re using to distribute the package. For more information, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). + +  + +  + + + + + diff --git a/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md b/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md new file mode 100644 index 0000000000..96a04e5f70 --- /dev/null +++ b/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md @@ -0,0 +1,13 @@ +--- +author: pamgreen-msft +ms.author: pamgreen +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: pamgreen +ms.prod: ie11 +ms.topic: include +--- + +> [!IMPORTANT] +> Microsoft 365 apps and services will not support Internet Explorer 11 starting August 17, 2021 (Microsoft Teams will not support Internet Explorer 11 earlier, starting November 30, 2020). [Learn more](https://aka.ms/AA97tsw). Please note that Internet Explorer 11 will remain a supported browser. Internet Explorer 11 is a component of the Windows operating system and [follows the Lifecycle Policy](https://docs.microsoft.com/lifecycle/faq/internet-explorer-microsoft-edge) for the product on which it is installed. \ No newline at end of file diff --git a/browsers/internet-explorer/index.md b/browsers/internet-explorer/index.md index ad64db8744..6c3085d888 100644 --- a/browsers/internet-explorer/index.md +++ b/browsers/internet-explorer/index.md @@ -1,7 +1,8 @@ --- ms.mktglfcycl: deploy description: The landing page for IE11 that lets you access the documentation. -author: shortpatti +author: dansimp +ms.author: dansimp ms.prod: ie11 title: Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) assetid: be3dc32e-80d9-4d9f-a802-c7db6c50dbe0 diff --git a/browsers/internet-explorer/internet-explorer.yml b/browsers/internet-explorer/internet-explorer.yml index 5007545950..7a2759960e 100644 --- a/browsers/internet-explorer/internet-explorer.yml +++ b/browsers/internet-explorer/internet-explorer.yml @@ -1,69 +1,174 @@ -### YamlMime:YamlDocument +### YamlMime:Landing -documentType: LandingData -title: Internet Explorer 11 +title: Internet Explorer 11 documentation +summary: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. metadata: - document_id: - title: Internet Explorer 11 - description: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. - keywords: Internet Explorer 11. IE11 - ms.localizationpriority: medium - author: lizap + title: Internet Explorer 11 documentation + description: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. + ms.topic: landing-page + author: lizap ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na + ms.date: 07/06/2020 -sections: -- items: - - type: markdown - text: " - Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. - " -- title: Explore -- items: - - type: markdown - text: " - Find tools, step-by-step guides, updates, and other resources to help you get started.
          - -

          **Get started**
          Get information om tools, frequently asked questions, requirements, and guidelines.
          IE11 features and tools
          System requirements and language support
          Frequently asked questions
          Internet Explorer 11 deployment guide
          Use Enterprise Mode to improve compatibility
          Lifecycle FAQ - Internet Explorer

          **Downloads and tools**
          Find tools and resources to help you address compatibility and get up to date.
          Download IE11 with Windows 10
          Enterprise Mode Site List Manager (schema, v.2)
          Web Application Compatibility Lab Kit
          Cumulative security updates for Internet Explorer 11

          **Find training**
          Find online training and hands-on labs for common configuration and management tasks.
          Getting started with Windows 10 for IT professionals
          Windows 10: Top Features for IT Pros
          Manage and modernize Internet Explorer with Enterprise Mode
          Virtual Lab: Enterprise Mode
          - " -- title: Plan -- items: - - type: markdown - text: " - Find information and tips to help you assess compatibility and prioritize processes as you plan for Internet Explorer 11.
          - -

          **Get started with compatibility**
          Find out how to extend your company's investment in older web apps through higher compatibility with older rendering engines while moving forward to a more modern browser like Internet Explorer 11.
          What is Enterprise Mode?
          Tips and tricks to manage Internet Explorer compatibility
          Download the Enterprise Site Discovery Toolkit
          Collect data using Enterprise Site Discovery
          Manage Windows upgrades with Upgrade Readiness
          Demo: Plan and manage Windows 10 upgrades and feature updates with Upgrade Readiness

          **Using Enterprise Mode**
          Learn how to avoid the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer by using Enterprise Mode.
          Turn on Enterprise Mode and use a site list
          Add sites to the Enterprise Mode site list
          Edit the Enterprise Mode site list
          Turn on local control and logging for Enterprise Mode
          - " -- title: Deploy -- items: - - type: markdown - text: " - Find the resources you need to successfully deploy Internet Explorer 11 in your organization.
          - -

          **Customize Internet Explorer 11**
          The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after deployment.
          Download IEAK 11
          IEAK 11 user's guide
          Frequently asked questions about IEAK 11
          Customization and distribution guidelines

          **Install Internet Explorer 11**
          Explore the different options for installation.
          Through Automatic Updates (recommended)
          As part of an operating system deployment
          Over the network
          With System Center 2012 R2 Configuration Manager
          With Windows Server Update Services (WSUS)
          With Microsoft Intune
          With third-party tools
          - " -- title: Manage -- items: - - type: markdown - text: " - Find everything you need to manage Internet Explorer 11 effectively in your organization. Get information on Group Policy, blocked out-of-date ActiveX controls, scripts, and more.
          - -

          **Enforce settings with Group Policy**
          Learn how to use Group Policy to enforce settings on the computers in your organization.
          Group Policy for beginners
          New Group Policy settings for IE11
          Administrative templates for IE11

          **Standardize with Group Policy preferences**
          Group Policy preferences simplify deployment and standardize configurations, but unlike Group Policy, they can later be changed by users.
          Group Policy preferences for IE11
          Configure Group Policy preferences

          **Blocked out-of-date ActiveX controls**
          Find out more about the out-of-date ActiveX control blocking security feature available in Internet Explorer.
          Blocked out-of-date ActiveX controls
          Out-of-date ActiveX control blocking
          Update to block out-of-date ActiveX controls in Internet Explorer

          **Scripts for IT professionals**
          Find scripts to help you save time and automate common tasks.
          Batch loop: Check is a process running, if yes, wait in loop
          Script to join user to AD with automatic Local user Profile Migration
          Find-IE Citrix receiver Version
          See all scripts
          - " -- title: Support -- items: - - type: markdown - text: " - Get help from product specialists and community experts, and find solutions to commonly encountered issues.
          - -

          **Troubleshoot common issues**
          Find solutions to common issues and get tips from Microsoft product teams and community experts.
          Change or reset Internet Explorer settings
          Troubleshoot custom package and IEAK 11 problems
          Troubleshoot problems with setup, installation, auto configuration, and more
          Disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone

          **Find answers and community support**
          Find FAQs or visit the forums to ask a question or find answers.
          Lifecycle FAQ - Internet Explorer
          Frequently asked questions about IEAK 11
          Microsoft Edge FAQ
          Internet Explorer 8, 9, 10, 11 forum
          Internet Explorer development forums
          Windows 8.1 forums
          Windows 10: General (includes Microsoft Edge)

          **Contact Microsoft for additional help**
          Explore the support options that are available from Microsoft.
          Contact a Microsoft support professional
          Support options for Microsoft Partners
          Microsoft Services Premier Support
          Microsoft Small Business Support Center
          General support
          - " -- title: Stay informed -- items: - - type: markdown - text: " - -

          **Sign up for the Windows IT Pro Insider**
          Get the latest tools, tips, and expert guidance on deployment, management, security, and more.
          Learn more

          **Microsoft Edge Dev blog**
          Keep up with the latest browser trends, security tips, and news for IT professionals.
          Read the blog

          **Microsoft Edge Dev on Twitter**
          Get the latest news and updates from the Microsoft Web Platform team.
          Visit Twitter
          - " +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card + - title: Explore + linkLists: + - linkListType: get-started + links: + - text: IE11 features and tools + url: /internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11 + - text: System requirements and language support + url: /internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11 + - text: Frequently asked questions + url: /internet-explorer/ie11-faq/faq-for-it-pros-ie11 + - text: Internet Explorer 11 deployment guide + url: /internet-explorer/ie11-deploy-guide/ + - text: Use Enterprise Mode to improve compatibility + url: /microsoft-edge/deploy/emie-to-improve-compatibility + - text: Lifecycle FAQ - Internet Explorer + url: https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer + - linkListType: download + links: + - text: Download IE11 with Windows 10 + url: https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise + - text: Enterprise Mode Site List Manager (schema, v.2) + url: https://www.microsoft.com/download/details.aspx?id=49974 + - text: Cumulative security updates for Internet Explorer 11 + url: https://www.catalog.update.microsoft.com/Search.aspx?q=cumulative%20security%20update%20for%20internet%20explorer%2011 + - linkListType: learn + links: + - text: Getting started with Windows 10 for IT professionals + url: https://mva.microsoft.com/training-courses/getting-started-with-windows-10-for-it-professionals-10629?l=fCowqpy8_5905094681 + - text: 'Windows 10: Top Features for IT Pros' + url: https://mva.microsoft.com/training-courses/windows-10-top-features-for-it-pros-16319?l=xBnT2ihhC_7306218965 + - text: Manage and modernize Internet Explorer with Enterprise Mode + url: https://channel9.msdn.com/events/teched/newzealand/2014/pcit307 + - text: 'Virtual Lab: Enterprise Mode' + url: https://www.microsoft.com/handsonlabs/SelfPacedLabs/?storyGuid=e4155067-2c7e-4b46-8496-eca38bedca02 + + # Card + - title: Plan + linkLists: + - linkListType: get-started + links: + - text: What is Enterprise Mode? + url: /internet-explorer/ie11-deploy-guide/what-is-enterprise-mode + - text: Tips and tricks to manage Internet Explorer compatibility + url: /internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility + - text: Download the Enterprise Site Discovery Toolkit + url: https://www.microsoft.com/download/details.aspx?id=44570 + - text: Collect data using Enterprise Site Discovery + url: /internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery + - text: Manage Windows upgrades with Upgrade Readiness + url: /windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness + - text: 'Demo: Plan and manage Windows 10 upgrades and feature updates with' + url: https://techcommunity.microsoft.com/t5/Microsoft-Ignite-Content-2017/Windows-Analytics-Plan-and-manage-Windows-10-upgrades-and/td-p/98639 + - linkListType: how-to-guide + links: + - text: Turn on Enterprise Mode and use a site list + url: /internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list + - text: Add sites to the Enterprise Mode site list + url: /internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool + - text: Edit the Enterprise Mode site list + url: /internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager + - text: Turn on local control and logging for Enterprise Mode + url: /internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode + + # Card + - title: Deploy + linkLists: + - linkListType: get-started + links: + - text: IEAK 11 user's guide + url: /internet-explorer/ie11-ieak/ + - text: Download IEAK 11 + url: /internet-explorer/ie11-ieak/ieak-information-and-downloads + - text: Frequently asked questions about IEAK 11 + url: /internet-explorer/ie11-faq/faq-ieak11 + - text: Customization and distribution guidelines + url: /internet-explorer/ie11-ieak/licensing-version-and-features-ieak11#customization-guidelines + - linkListType: deploy + links: + - text: Install Internet Explorer 11 through automatic updates (recommended) + url: /internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates + - text: Install Internet Explorer 11 as part of an operating system deployment + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems + - text: Install Internet Explorer 11 over the network + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-the-network + - text: Install Internet Explorer 11 with System Center 2012 R2 Configuration Manager + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager + - text: Install Internet Explorer 11 with Windows Server Update Services (WSUS) + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus + - text: Install Internet Explorer 11 with Microsoft Intune + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune + - text: Install Internet Explorer 11 with third-party tools + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools + + # Card + - title: Manage + linkLists: + - linkListType: tutorial + links: + - text: Group Policy for beginners + url: /previous-versions/windows/it-pro/windows-7/hh147307(v=ws.10) + - text: New Group Policy settings for IE11 + url: /internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11 + - text: Administrative templates for IE11 + url: https://www.microsoft.com/download/details.aspx?id=40905 + - text: Group Policy preferences for IE11 + url: /internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11 + - text: Configure Group Policy preferences + url: https://support.microsoft.com/help/2898604/how-to-configure-group-policy-preference-settings-for-internet-explorer-11-in-windows-8.1-or-windows-server-2012-r2 + - text: Blocked out-of-date ActiveX controls + url: /internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls + - text: Out-of-date ActiveX control blocking + url: /internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking + - text: Update to block out-of-date ActiveX controls in Internet Explorer + url: https://support.microsoft.com/help/2991000/update-to-block-out-of-date-activex-controls-in-internet-explorer + - text: Script to join user to AD with automatic Local user Profile Migration + url: https://gallery.technet.microsoft.com/scriptcenter/script-to-join-active-7b16d9d3 + - text: Scripts for IT professionals + url: https://gallery.technet.microsoft.com/scriptcenter/site/search?query=Microsoft%20Edge%20or%20Internet + + # Card + - title: Support + linkLists: + - linkListType: get-started + links: + - text: Change or reset Internet Explorer settings + url: https://support.microsoft.com/help/17441/windows-internet-explorer-change-reset-settings + - text: Troubleshoot problems with setup, installation, auto configuration, and more + url: /internet-explorer/ie11-deploy-guide/troubleshoot-ie11 + - text: Disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone + url: https://support.microsoft.com/help/4012494/option-to-disable-vbscript-execution-in-internet-explorer-for-internet + - text: Frequently asked questions about IEAK 11 + url: /internet-explorer/ie11-faq/faq-ieak11 + - text: Internet Explorer 8, 9, 10, 11 forum + url: https://social.technet.microsoft.com/forums/ie/home?forum=ieitprocurrentver + - text: Contact a Microsoft support professional + url: https://support.microsoft.com/contactus + - text: Support options for Microsoft Partners + url: https://mspartner.microsoft.com/Pages/Support/get-support.aspx + - text: Microsoft Services Premier Support + url: https://www.microsoft.com/en-us/microsoftservices/support.aspx + - text: Microsoft Small Business Support Center + url: https://smallbusiness.support.microsoft.com/product/internet-explorer + - text: General support + url: https://support.microsoft.com/products/internet-explorer + + # Card + - title: Stay informed + linkLists: + - linkListType: get-started + links: + - text: Sign up for the Windows IT Pro Insider + url: https://aka.ms/windows-it-pro-insider + - text: Microsoft Edge Dev blog + url: https://blogs.windows.com/msedgedev + - text: Microsoft Edge Dev on Twitter + url: https://twitter.com/MSEdgeDev diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.md b/browsers/internet-explorer/kb-support/ie-edge-faqs.md new file mode 100644 index 0000000000..5c29be5126 --- /dev/null +++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.md @@ -0,0 +1,220 @@ +--- +title: IE and Microsoft Edge FAQ for IT Pros +description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. +audience: ITPro +manager: msmets +author: ramakoni1 +ms.author: ramakoni +ms.reviewer: ramakoni, DEV_Triage +ms.prod: internet-explorer +ms.technology: +ms.topic: kb-support +ms.custom: CI=111020 +ms.localizationpriority: medium +ms.date: 01/23/2020 +--- +# Internet Explorer and Microsoft Edge frequently asked questions (FAQ) for IT Pros + +## Cookie-related questions + +### What is a cookie? + +An HTTP cookie (the web cookie or browser cookie) is a small piece of data that a server sends to the user's web browser. The web browser may store the cookie and return it to the server together with the next request. For example, a cookie might be used to indicate whether two requests come from the same browser in order to allow the user to remain logged-in. The cookie records stateful information for the stateless HTTP protocol. + +### How does Internet Explorer handle cookies? + +For more information about how Internet Explorer handles cookies, see the following articles: + +- [Beware Cookie Sharing in Cross-Zone Scenarios](https://blogs.msdn.microsoft.com/ieinternals/2011/03/10/beware-cookie-sharing-in-cross-zone-scenarios/) +- [A Quick Look at P3P](https://blogs.msdn.microsoft.com/ieinternals/2013/09/17/a-quick-look-at-p3p/) +- [Internet Explorer Cookie Internals FAQ](https://blogs.msdn.microsoft.com/ieinternals/2009/08/20/internet-explorer-cookie-internals-faq/) +- [Privacy Beyond Blocking Cookies](https://blogs.msdn.microsoft.com/ie/2008/08/25/privacy-beyond-blocking-cookies-bringing-awareness-to-third-party-content/) +- [Description of Cookies](https://support.microsoft.com/help/260971/description-of-cookies) + +### Where does Internet Explorer store cookies? + +To see where Internet Explorer stores its cookies, follow these steps: + +1. Start File Explorer. +2. Select **Views** \> **Change folder and search options**. +3. In the **Folder Options** dialog box, select **View**. +4. In **Advanced settings**, select **Do not show hidden files, folders, or drivers**. +5. Clear **Hide protected operation system files (Recommended)**. +6. Select **Apply**. +7. Select **OK**. + +The following are the folder locations where the cookies are stored: + +**In Windows 10** +C:\Users\username\AppData\Local\Microsoft\Windows\INetCache + +**In Windows 8 and Windows 8.1** +C:\Users\username\AppData\Local\Microsoft\Windows\INetCookies + +**In Windows 7** +C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies +C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies\Low + +### What is the per-domain cookie limit? + +Since the June 2018 cumulative updates for Internet Explorer and Microsoft Edge, the per-domain cookie limit is increased from 50 to 180 for both browsers. The cookies vary by path. So, if the same cookie is set for the same domain but for different paths, it's essentially a new cookie. + +There's still a 5 Kilobytes (KB) limit on the size of the cookie header that is sent out. This limit can cause some cookies to be lost after they exceed that value. + +The JavaScript limitation was updated to 10 KB from 4 KB. + +For more information, see [Internet Explorer Cookie Internals (FAQ)](https://blogs.msdn.microsoft.com/ieinternals/2009/08/20/internet-explorer-cookie-internals-faq/). + +#### Additional information about cookie limits + +**What does the Cookie RFC allow?** +RFC 2109 defines how cookies should be implemented, and it defines minimum values that browsers support. According to the RFC, browsers would ideally have no limits on the size and number of cookies that a browser can handle. To meet the specifications, the user agent should support the following: + +- At least 300 cookies total +- At least 20 cookies per unique host or domain name + +For practicality, individual browser makers set a limit on the total number of cookies that any one domain or unique host can set. They also limit the total number of cookies that can be stored on a computer. + +### Cookie size limit per domain + +Some browsers also limit the amount of space that any one domain can use for cookies. This means that if your browser sets a limit of 4,096 bytes per domain for cookies, 4,096 bytes is the maximum available space in that domain even though you can set up to 180 cookies. + +## Proxy Auto Configuration (PAC)-related questions + +### Is an example Proxy Auto Configuration (PAC) file available? + +Here is a simple PAC file: + +```vb +function FindProxyForURL(url, host) +{ + return "PROXY proxyserver:portnumber"; +} +``` + +> [!NOTE] +> The previous PAC always returns the **proxyserver:portnumber** proxy. + +For more information about how to write a PAC file and about the different functions in a PAC file, see [the FindProxyForURL website](https://findproxyforurl.com/). + +**Third-party information disclaimer** +The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. + +### How to improve performance by using PAC scripts + +- [Browser is slow to respond when you use an automatic configuration script](https://support.microsoft.com/help/315810/browser-is-slow-to-respond-when-you-use-an-automatic-configuration-scr) +- [Optimizing performance with automatic Proxyconfiguration scripts (PAC)](https://blogs.msdn.microsoft.com/askie/2014/02/07/optimizing-performance-with-automatic-proxyconfiguration-scripts-pac/) + +## Other questions + +### How to set home and start pages in Microsoft Edge and allow user editing + +For more information, see the following blog article: + +[How do I set the home page in Microsoft Edge?](https://blogs.msdn.microsoft.com/askie/2017/10/04/how-do-i-set-the-home-page-in-edge/) + +### How to add sites to the Enterprise Mode (EMIE) site list + +For more information about how to add sites to an EMIE list, see [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool). + +### What is Content Security Policy (CSP)? + +By using [Content Security Policy](https://docs.microsoft.com/microsoft-edge/dev-guide/security/content-security-policy), you create an allow list of sources of trusted content in the HTTP headers. You also pre-approve certain servers for content that is loaded into a webpage, and instruct the browser to execute or render only resources from those sources. You can use this technique to prevent malicious content from being injected into sites. + +Content Security Policy is supported in all versions of Microsoft Edge. It lets web developers lock down the resources that can be used by their web application. This helps prevent [cross-site scripting](https://en.wikipedia.org/wiki/Cross-site_scripting) attacks that remain a common vulnerability on the web. However, the first version of Content Security Policy was difficult to implement on websites that used inline script elements that either pointed to script sources or contained script directly. + +CSP2 makes these scenarios easier to manage by adding support for nonces and hashes for script and style resources. A nonce is a cryptographically strong random value that is generated on each page load that appears in both the CSP policy and in the script tags on the page. Using nonces can help minimize the need to maintain a list of allowed source URL values while also allowing trusted scripts that are declared in script elements to run. + +For more information, see the following articles: + +- [Introducing support for Content Security Policy Level 2](https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/) +- [Content Security Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) + +### Where to find Internet Explorer security zones registry entries + +Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](https://support.microsoft.com/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users). + +This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11. + +The default Zone Keys are stored in the following locations: + +- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones +- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones + +### Why don't HTML5 videos play in Internet Explorer 11? + +To play HTML5 videos in the Internet Zone, use the default settings or make sure that the registry key value of **2701** under **Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3** is set to **0**. + +- 0 (the default value): Allow +- 3: Disallow + +This key is read by the **URLACTION\_ALLOW\_AUDIO\_VIDEO 0x00002701** URL action flag that determines whether media elements (audio and video) are allowed in pages in a URL security zone. + +For more information, see [Unable to play HTML5 Videos in IE](https://blogs.msdn.microsoft.com/askie/2014/12/31/unable-to-play-html5-videos-in-ie/). + +For Windows 10 N and Windows KN editions, you must also download the feature pack that is discussed in [Media feature pack for Windows 10 N and Windows 10 KN editions](https://support.microsoft.com/help/3010081/media-feature-pack-for-windows-10-n-and-windows-10-kn-editions). + +For more information about how to check Windows versions, see [Which version of Windows operating system am I running?](https://support.microsoft.com/help/13443/windows-which-version-am-i-running) + +### What is the Enterprise Mode Site List Portal? + +This is a new feature to add sites to your enterprise mode site list XML. For more information, see [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). + +### What is Enterprise Mode Feature? + +For more information about this topic, see [Enterprise Mode and the Enterprise Mode Site List](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode). + +### Where can I obtain a list of HTTP Status codes? + +For information about this list, see [HTTP Status Codes](https://docs.microsoft.com/windows/win32/winhttp/http-status-codes). + +### What is end of support for Internet Explorer 11? + +Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed. + +For more information, see [Lifecycle FAQ — Internet Explorer and Edge](https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer). + +### How to configure TLS (SSL) for Internet Explorer + +For more information about how to configure TLS/SSL for Internet Explorer, see [Group Policy Setting to configure TLS/SSL](https://gpsearch.azurewebsites.net/#380). + +### What is Site to Zone? + +Site to Zone usually refers to one of the following: + +**Site to Zone Assignment List** +This is a Group Policy policy setting that can be used to add sites to the various security zones. + +The Site to Zone Assignment List policy setting associates sites to zones by using the following values for the Internet security zones: + +- Intranet zone +- Trusted Sites zone +- Internet zone +- Restricted Sites zone + +If you set this policy setting to **Enabled**, you can enter a list of sites and their related zone numbers. By associating a site to a zone, you can make sure that the security settings for the specified zone are applied to the site. + +**Site to Zone Mapping** +Site to Zone Mapping is stored as the name of the key. The protocol is a registry value that has a number that assigns it to the corresponding zone. Internet Explorer will read from the following registry subkeys for the sites that are deployed through the Site to Zone assignment list: + +- HKEY\_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap +- HKEY\_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey + +**Site to Zone Assignment List policy** +This policy setting is available for both Computer Configuration and User Configuration: + +- Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page +- User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page + +**References** +[How to configure Internet Explorer security zone sites using group polices](https://blogs.msdn.microsoft.com/askie/2012/06/05/how-to-configure-internet-explorer-security-zone-sites-using-group-polices/) + +### What are the limits for MaxConnectionsPerServer, MaxConnectionsPer1_0Server for the current versions of Internet Explorer? + +For more information about these settings and limits, see [Connectivity Enhancements in Windows Internet Explorer 8](https://docs.microsoft.com/previous-versions/cc304129(v=vs.85)). + +### What is the MaxConnectionsPerProxy setting, and what are the maximum allowed values for this setting? + +The **MaxConnectionsPerProxy** setting controls the number of connections that a single-user client can maintain to a given host by using a proxy server. + +For more information, see [Understanding Connection Limits and New Proxy Connection Limits in WinInet and Internet Explorer](https://blogs.msdn.microsoft.com/jpsanders/2009/06/29/understanding-connection-limits-and-new-proxy-connection-limits-in-wininet-and-internet-explorer/). diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md deleted file mode 100644 index 36cbb30a09..0000000000 --- a/devices/hololens/TOC.md +++ /dev/null @@ -1,36 +0,0 @@ -# [Microsoft HoloLens](index.md) -# [What's new in HoloLens](hololens-whats-new.md) -# [Set up HoloLens](hololens-setup.md) - -# Deploy HoloLens in a commercial environment -## [Overview and deployment planning](hololens-requirements.md) -## [Configure HoloLens using a provisioning package](hololens-provisioning.md) -## [Enroll HoloLens in MDM](hololens-enroll-mdm.md) - -# Device Management -## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) -## [Install localized version of HoloLens](hololens-install-localized.md) -## [Manage updates to HoloLens](hololens-updates.md) -## [Restore HoloLens 2 using Advanced Recovery Companion](hololens-recovery.md) -## [Use the HoloLens Clicker](hololens-clicker.md) -## [Restart, reset, or recover the HoloLens](hololens-restart-recover.md) -## [Restart or recover the HoloLens clicker](hololens-clicker-restart-recover.md) - -# Application Management -## [Install apps on HoloLens](hololens-install-apps.md) -## [Share HoloLens with multiple people](hololens-multiple-users.md) -## [Cortana on HoloLens](hololens-cortana.md) -## [Get apps for HoloLens](hololens-get-apps.md) -## [Use apps on HoloLens](hololens-use-apps.md) -## [Use HoloLens offline](hololens-offline.md) -## [Spaces on HoloLens](hololens-spaces-on-hololens.md) - -# User/Access Management -## [Set up single application access](hololens-kiosk.md) -## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) -## [How HoloLens stores data for spaces](hololens-spaces.md) -## [Find and save files](hololens-find-and-save-files.md) - -# [Insider preview for Microsoft HoloLens](hololens-insider.md) -# [Change history for Microsoft HoloLens documentation](change-history-hololens.md) - diff --git a/devices/hololens/breadcrumb/toc.yml b/devices/hololens/breadcrumb/toc.yml deleted file mode 100644 index 2ac60b3585..0000000000 --- a/devices/hololens/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Hololens - tocHref: /hololens - topicHref: /hololens/index \ No newline at end of file diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md deleted file mode 100644 index b886719944..0000000000 --- a/devices/hololens/change-history-hololens.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Change history for Microsoft HoloLens documentation -ms.reviewer: -manager: dansimp -description: This topic lists new and updated topics for HoloLens. -keywords: change history -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Change history for Microsoft HoloLens documentation - -This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md). - -## April 2019 - -New or changed topic | Description ---- | --- -[Restore HoloLens 2 using Advanced Recovery Companion](hololens-recovery.md) | New - -## November 2018 - -New or changed topic | Description ---- | --- -[How HoloLens stores data for spaces](hololens-spaces.md) | New - -## Windows 10 Holographic for Business, version 1809 - -The topics in this library have been updated for Windows 10 Holographic for Business, version 1809. - - -## October 2018 - -New or changed topic | Description ---- | --- -[Preview new mixed reality apps for HoloLens](hololens-public-preview-apps.md) | Removed, and redirected to [Mixed reality apps](https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps) -[Microsoft Remote Assist app](hololens-microsoft-remote-assist-app.md) | Removed, and redirected to [Overview of Dynamics 365 Remote Assist](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/) -[Microsoft Dynamics 365 Layout app](hololens-microsoft-dynamics-365-layout-app.md) | Removed, and redirected to [Overview of Dynamics 365 Layout](https://docs.microsoft.com/dynamics365/mixed-reality/layout/) -[Insider preview for Microsoft HoloLens](hololens-insider.md) | Added instructions for opting out of Insider builds. - - -## July 2018 - -New or changed topic | Description ---- | --- -Insider preview for Microsoft HoloLens | New (topic retired on release of Windows 10, version 1809) - -## June 2018 - -New or changed topic | Description ---- | --- -[HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md#pin) | Added instructions for creating a sign-in PIN. - -## May 2018 - -New or changed topic | Description ---- | --- -[Preview new mixed reality apps for HoloLens](hololens-public-preview-apps.md) | New -[Microsoft Remote Assist app](hololens-microsoft-remote-assist-app.md) | New -[Microsoft Layout app](hololens-microsoft-layout-app.md) | New -[Set up HoloLens in kiosk mode](hololens-kiosk.md) | Added instructions for setting up a guest account for kiosk mode. - -## Windows 10 Holographic for Business, version 1803 - -The topics in this library have been updated for Windows 10 Holographic for Business, version 1803. The following new topics have been added: - -- [What's new in Microsoft HoloLens](hololens-whats-new.md) -- [Manage updates to HoloLens](hololens-updates.md) -- [Share HoloLens with multiple people](hololens-multiple-users.md) - - -## February 2018 - -New or changed topic | Description ---- | --- -[Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) | Replaced the instructions for upgrading to Windows Holographic for Business using Microsoft Intune with a link to the new Intune topic. - -## December 2017 - -New or changed topic | Description ---- | --- -[Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | New - -## May 2017 - -| New or changed topic | Description | -| --- | --- | -| [Microsoft HoloLens in the enterprise: requirements](hololens-requirements.md) | Changed title to **Microsoft HoloLens in the enterprise: requirements and FAQ**, added questions and answers in new [FAQ section](hololens-requirements.md#faq-for-hololens) | - -## January 2017 - -| New or changed topic | Description | -| --- | --- | -| All topics | Changed all references from **Windows Holographic Enterprise** to **Windows Holographic for Business** | diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index 7cda17b22f..5228341de6 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -17,7 +17,8 @@ { "files": [ "**/*.png", - "**/*.jpg" + "**/*.jpg", + "**/*.gif" ], "exclude": [ "**/obj/**", @@ -42,14 +43,23 @@ "./": { "depot_name": "Win.itpro-hololens", "folder_relative_path_in_docset": "./" + } + } - } }, "fileMetadata": {}, - "template": [ - null - ], + "template": [], "dest": "devices/hololens", "markdownEngineName": "markdig" - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ] } diff --git a/devices/hololens/hololens-clicker-restart-recover.md b/devices/hololens/hololens-clicker-restart-recover.md deleted file mode 100644 index 81c7ffc704..0000000000 --- a/devices/hololens/hololens-clicker-restart-recover.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Restart or recover the HoloLens clicker -description: Things to try if the HoloLens clicker is unresponsive or isn’t working well. -ms.assetid: 13406eca-e2c6-4cfc-8ace-426ff8f837f4 -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Restart or recover the HoloLens clicker - -Here are some things to try if the HoloLens clicker is unresponsive or isn’t working well. - -## Restart the clicker - -Use the tip of a pen to press and hold the [pairing button](https://support.microsoft.com/en-us/help/12646). - -![Hold the pairing button](images/recover-clicker-1.png) - -At the same time, click and hold the clicker for 15 seconds. If the clicker was already paired with your HoloLens, it will stay paired after it restarts. - -![Hold the clicker](images/recover-clicker-2.png) - -If the clicker won't turn on or restart, try charging it using the HoloLens charger. If the battery is very low, it might take a few minutes for the white indicator light to turn on. - -## Re-pair the clicker - -Go to Settings > Devices and select the clicker. Select Remove, wait a few seconds, then pair the clicker again. - -## Recover the clicker - -If restarting and re-pairing the clicker don’t fix the problem, the Windows Device Recovery Tool can help you recover it. The recovery process may take some time, and the latest version of the clicker software will be installed. To use the tool, you’ll need a computer running Windows 10 or later with at least 4 GB of free storage space. - -To recover the clicker: - -1. Download and install the [Windows Device Recovery Tool](https://dev.azure.com/ContentIdea/ContentIdea/_queries/query/8a004dbe-73f8-4a32-94bc-368fc2f2a895/) on your computer. -1. Connect the clicker to your computer using the Micro USB cable that came with your HoloLens. -1. Run the Windows Device Recovery Tool and follow the instructions. - -If the clicker isn’t automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode. diff --git a/devices/hololens/hololens-clicker.md b/devices/hololens/hololens-clicker.md deleted file mode 100644 index 8ec7e8077b..0000000000 --- a/devices/hololens/hololens-clicker.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Use the HoloLens Clicker -description: -ms.assetid: 7d4a30fd-cf1d-4c9a-8eb1-1968ccecbe59 -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Use the HoloLens Clicker - -The clicker was designed specifically for HoloLens and gives you another way to interact with holograms. It comes with HoloLens, in a separate box. Use it in place of hand gestures to select, scroll, move, and resize. - -![The HoloLens Clicker](images/use-hololens-clicker-1.png) - -## Hold the clicker - -To put on the clicker, slide the loop over your ring or middle finger with the Micro USB port toward your wrist. Rest your thumb in the indentation. - -![How to hold the Clicker](images/use-hololens-clicker-2.png) - -## Clicker gestures - -Clicker gestures are small wrist rotations, not the larger movements used for HoloLens hand gestures. And HoloLens will recognize your gestures and clicks even if the clicker is outside the [gesture frame](https://support.microsoft.com/help/12644), so you can hold the clicker in the position that's most comfortable for you​. - -- **Select**. To select a hologram, button, or other element, gaze at it, then click. - -- **Click and hold**. Click and hold your thumb down on the button to do some of the same things you would with tap and hold, like move or resize a hologram. - -- **Scroll**. On the app bar, select **Scroll Tool**. Click and hold, then rotate the clicker up, down, left, or right. To scroll faster, move your hand farther from the center of the scroll tool. - -- **Zoom**. On the app bar, select **Zoom Tool**. Click and hold, then rotate the clicker up to zoom in, or down to zoom out. - ->[!TIP] ->In Microsoft Edge, gaze at a page and double-click to zoom in or out. - -## Pair and charge the clicker - -To pair the clicker with your HoloLens, see [Pair Bluetooth devices](https://support.microsoft.com/help/12636). - -When the clicker battery is low, the battery indicator will blink amber. Plug the Micro USB cable into a USB power supply to charge the device. - -## Indicator lights - -Here's what the lights on the clicker mean. - -- **Blinking white**. The clicker is in pairing mode. - -- **Fast-blinking white**. Pairing was successful. - -- **Solid white**. The clicker is charging. - -- **Blinking amber**. The battery is low. - -- **Solid amber**. The clicker ran into an error and you'll need to restart it. While pressing the pairing button, click and hold for 15 seconds. - ->[!NOTE] ->If the clicker doesn't respond or won't start, see [Restart or recover the HoloLens clicker](https://support.microsoft.com/help/15555/hololens-restart-or-recover-the-hololens-clicker). diff --git a/devices/hololens/hololens-cortana.md b/devices/hololens/hololens-cortana.md deleted file mode 100644 index dfe9539b1b..0000000000 --- a/devices/hololens/hololens-cortana.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Cortana on HoloLens -description: Cortana can help you do all kinds of things on your HoloLens -ms.assetid: fd96fb0e-6759-4dbe-be1f-58bedad66fed -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Cortana on HoloLens - -Cortana can help you do all kinds of things on your HoloLens, from searching the web to shutting down your device. To get her attention, select Cortana on Start or say "Hey Cortana" anytime. - -![Hey Cortana!](images/cortana-on-hololens.png) - -## What do I say to Cortana - -Here are some things you can try saying (remember to say "Hey Cortana" first): - -- What can I say? -- Increase the volume. -- Decrease the brightness. -- Shut down. -- Restart. -- Go to sleep. -- Mute. -- Launch ``. -- Move `` here (gaze at the spot you want the app to move to). -- Go to Start. -- Take a picture. -- Start recording. (Starts recording a video.) -- Stop recording. (Stops recording a video.) -- Call ``. (Requires Skype.) -- What time is it? -- Show me the latest NBA scores. -- How much battery do I have left? -- Tell me a joke. - ->[!NOTE] ->- Some Cortana features you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens Development Edition. Cortana on HoloLens is English only, and the Cortana experience may vary among regions. ->- Cortana is on the first time you use HoloLens. You can turn her off in Cortana's settings. In the All apps list, select Cortana > Settings. Then turn off Cortana can give you suggestions, ideas, reminders, alerts, and more. ->- If Cortana isn't responding to "Hey Cortana," go to Cortana's settings and check to make sure she's on. ->- If you turn Cortana off, "Hey Cortana" voice commands won't be available, but you'll still be able to use other commands (like "Select" and "Place"). diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md deleted file mode 100644 index 838674f0dc..0000000000 --- a/devices/hololens/hololens-encryption.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Enable Bitlocker encryption for HoloLens (HoloLens) -description: Enable Bitlocker device encryption to protect files stored on the HoloLens -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 01/26/2019 -ms.reviewer: -manager: dansimp ---- - -# Enable encryption for HoloLens - -You can enable [BitLocker device encryption](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) to protect files and information stored on the HoloLens. Device encryption helps protect your data by encrypting it using AES-CBC 128 encryption method, which is equivalent to [EncryptionMethodByDriveType method 3](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype) in the BitLocker configuration service provider (CSP). Only someone with the right encryption key (such as a password) can decrypt it or perform a data recovery. - - - -## Enable device encryption using MDM - -You can use your mobile device management (MDM) provider to apply a policy that requires device encryption. The policy used is the [Security/RequireDeviceEncryption setting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-security#security-requiredeviceencryption) in the Policy CSP. - -[See instructions for enabling device encryption using Microsoft Intune.](https://docs.microsoft.com/intune/compliance-policy-create-windows#windows-holographic-for-business) - -For other MDM tools, see your MDM provider's documentation for instructions. If your MDM provider requires custom URI for device encryption, use the following configuration: - -- **Name**: a name of your choice -- **Description**: optional -- **OMA-URI**: `./Vendor/MSFT/Policy/Config/Security/RequireDeviceEncryption` -- **Data type**: integer -- **Value**: `1` - -## Enable device encryption using a provisioning package - -Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device. - -### Create a provisioning package that upgrades the Windows Holographic edition and enables encryption - -1. [Create a provisioning package for HoloLens.](hololens-provisioning.md) - -2. Go to **Runtime settings** > **Policies** > **Security**, and select **RequireDeviceEncryption**. - - ![Require device encryption setting configured to yes](images/device-encryption.png) - -2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. - - >[!NOTE] - >You can configure [additional settings in the provisioning package](hololens-provisioning.md). - -3. On the **File** menu, click **Save**. - -4. Read the warning that project files may contain sensitive information, and click **OK**. - - >[!IMPORTANT] - >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -3. On the **Export** menu, click **Provisioning package**. - -4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**. - -5. Set a value for **Package Version**. - - >[!TIP] - >You can make changes to existing packages and change the version number to update previously applied packages. - -6. On the **Select security details for the provisioning package**, click **Next**. - -7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. - - Optionally, you can click Browse to change the default output location. - -8. Click **Next**. - -9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. - -10. When the build completes, click **Finish**. - - -### Apply the provisioning package to HoloLens - -1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box). - -2. Briefly press and release the **Volume Down** and **Power** buttons simultaneously. - -3. HoloLens will show up as a device in File Explorer on the PC. - -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup. - ->[!NOTE] ->If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package. - -## Verify device encryption - -Encryption is silent on HoloLens. To verify the device encryption status: - -- On HoloLens, go to **Settings** > **System** > **About**. **BitLocker** is **enabled** if the device is encrypted. - -![About screen showing BitLocker enabled](images/about-encryption.png) diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md deleted file mode 100644 index 7f5f3200e8..0000000000 --- a/devices/hololens/hololens-enroll-mdm.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Enroll HoloLens in MDM (HoloLens) -description: Enroll HoloLens in mobile device management (MDM) for easier management of multiple devices. -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp ---- - -# Enroll HoloLens in MDM - -You can manage multiple Microsoft HoloLens devices simultaneously using solutions like [Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business). You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business), the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens), and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies). - ->[!NOTE] ->Mobile device management (MDM), including the VPN, Bitlocker, and kiosk mode features, is only available when you [upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md). - - -## Requirements - Your organization will need to have mobile device management (MDM) set up in order to manage HoloLens devices. Your MDM provider can be Microsoft Intune or a 3rd party provider that uses Microsoft MDM APIs. - -## Auto-enrollment in MDM - -If your organization uses Azure Active Directory (Azure AD) and an MDM solution that accepts an AAD token for authentication (currently, only supported in Microsoft Intune and AirWatch), your IT admin can configure Azure AD to automatically allow MDM enrollment after the user signs in with their Azure AD account. [Learn how to configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) - -When auto-enrollment is enabled, no additional manual enrollment is needed. When the user signs in with an Azure AD account, the device is enrolled in MDM after completing the first-run experience. - -## Enroll through Settings app - - When the device is not enrolled in MDM during the first-run experience, the user can manually enroll the device with the organization's MDM server using the Settings app. - -1. Go to **Settings** > **Accounts** > **Work access**. - -2. Select **Enroll into device management** and enter your organizational account. You will be redirected to your organization's sign in page. - -4. Upon successful authentication to the MDM server, a success message is shown. - -Your device is now enrolled with your MDM server. The device will need to restart to acquire policies, certificates, and apps. The Settings app will now reflect that the device is enrolled in device management. diff --git a/devices/hololens/hololens-find-and-save-files.md b/devices/hololens/hololens-find-and-save-files.md deleted file mode 100644 index ba459eff13..0000000000 --- a/devices/hololens/hololens-find-and-save-files.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Find and save files on HoloLens -description: Use File Explorer on HoloLens to view and manage files on your device -ms.assetid: 77d2e357-f65f-43c8-b62f-6cd9bf37070a -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Find and save files on HoloLens - -Files you create on HoloLens, including Office documents, photos, and videos, are saved to your HoloLens. To view and manage them, you can use the File Explorer app on HoloLens or File Explorer on your PC. To sync photos and other files to the cloud, use the OneDrive app on HoloLens. - -## View files on HoloLens - -Use File Explorer on HoloLens to view and manage files on your device, including 3D objects, documents, and pictures. Go to Start > All apps > File Explorer on HoloLens to get started. - ->[!TIP] ->If there are no files listed in File Explorer, select **This Device** in the top left pane. - -## View HoloLens files on your PC - -To see your HoloLens files in File Explorer on your PC: - -1. Sign in to HoloLens, then plug it into the PC using the USB cable that came with the HoloLens. - -1. Select **Open Device to view files with File Explorer**, or open File Explorer on the PC and navigate to the device. - ->[!TIP] ->To see info about your HoloLens, right-click the device name in File Explorer on your PC, then select **Properties**. - -## Sync to the cloud - -To sync photos and other files from your HoloLens to the cloud, install and set up OneDrive on HoloLens. To get OneDrive, search for it in the Microsoft Store on your HoloLens. - ->[!TIP] ->HoloLens doesn't back up app files and data, so it's a good idea to save your important stuff to OneDrive. That way, if you reset your device or uninstall an app, your info will be backed up. diff --git a/devices/hololens/hololens-get-apps.md b/devices/hololens/hololens-get-apps.md deleted file mode 100644 index cd14341075..0000000000 --- a/devices/hololens/hololens-get-apps.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Get apps for HoloLens -description: The Microsoft Store is your source for apps and games that work with HoloLens. -ms.assetid: cbe9aa3a-884f-4a92-bf54-8d4917bc3435 -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Get apps for HoloLens - -The Microsoft Store is your source for apps and games that work with HoloLens. When you go to the Store on your HoloLens, any apps you see there will run on it. - -Apps on HoloLens use either 2D view or holographic view. Apps with 2D view look like windows and can be positioned all around you. Apps that use holographic view surround you and become the only app you see. - -## Get apps - -Open the Microsoft Store from the Start menu. Then browse for apps and games (or use your voice to search​), select the microphone on the HoloLens keyboard, and start talking. - -To download apps, you'll need to be signed in with a Microsoft account. To buy them, you'll need a payment method associated with the Microsoft account you use on your HoloLens. To set up a payment method, go to [account.microsoft.com](http://account.microsoft.com/) and select **Payment & billing** > **Payment options** > **Add a payment option**. - -## Find your apps - -Once you've installed an app, you'll find it in the All apps list​ (Start > All apps ). Keep apps handy by [pinning them to Start](https://support.microsoft.com/help/12638). - -App updates are automatic, and they're free. - ->[!NOTE] ->- To purchase apps in the Store, the billing address for your payment method must match the country or region your HoloLens is set to. ->- Some apps may not be available in all countries and regions. diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md deleted file mode 100644 index 5eaf9ad296..0000000000 --- a/devices/hololens/hololens-insider.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Insider preview for Microsoft HoloLens (HoloLens) -description: It’s simple to get started with Insider builds and to provide valuable feedback for our next major operating system update for HoloLens. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 10/23/2018 -ms.reviewer: -manager: dansimp ---- - -# Insider preview for Microsoft HoloLens - -Welcome to the latest Insider Preview builds for HoloLens! It’s simple to get started and provide valuable feedback for our next major operating system update for HoloLens. - -## How do I install the Insider builds? - -On a device running the Windows 10 April 2018 Update, go to Settings -> Update & Security -> Windows Insider Program and select Get started. Link the account you used to register as a Windows Insider. - -Then, select **Active development of Windows**, choose whether you’d like to receive **Fast** or **Slow** builds, and review the program terms. - -Select **Confirm -> Restart Now** to finish up. After your device has rebooted, go to **Settings -> Update & Security -> Check for updates** to get the latest build. - -## How do I stop receiving Insider builds? - -If you no longer want to receive Insider builds of Windows Holographic, you can opt out when your HoloLens is running a production build, or you can [recover your device](https://docs.microsoft.com/windows/mixed-reality/reset-or-recover-your-hololens#perform-a-full-device-recovery) using the Windows Device Recovery Tool to recover your device to a non-Insider version of Windows Holographic. - -To verify that your HoloLens is running a production build: -- Go to **Settings > System > About**, and find the build number. -- If the build number is 10.0.17763.1, your HoloLens is running a production build. [See the list of production build numbers.](https://www.microsoft.com/itpro/windows-10/release-information) - -To opt out of Insider builds: -- On a HoloLens running a production build, go to **Settings > Update & Security > Windows Insider Program**, and select **Stop Insider builds**. -- Follow the instructions to opt out your device. - - - -## Note for developers - -You are welcome and encouraged to try developing your applications using Insider builds of HoloLens. Check out the [HoloLens Developer Documentation](https://developer.microsoft.com/windows/mixed-reality/development) to get started. Those same instructions work with Insider builds of HoloLens. You can use the same builds of Unity and Visual Studio that you're already using for HoloLens development. - -## Provide feedback and report issues - -Please use [the Feedback Hub app](https://docs.microsoft.com/windows/mixed-reality/give-us-feedback) on your HoloLens or Windows 10 PC to provide feedback and report issues. Using Feedback Hub ensures that all necessary diagnostics information is included to help our engineers quickly debug and resolve the problem. Issues with the Chinese and Japanese version of HoloLens should be reported the same way. - ->[!NOTE] ->Be sure to accept the prompt that asks whether you’d like Feedback Hub to access your Documents folder (select **Yes** when prompted). - diff --git a/devices/hololens/hololens-install-apps.md b/devices/hololens/hololens-install-apps.md deleted file mode 100644 index c4f9c80521..0000000000 --- a/devices/hololens/hololens-install-apps.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Install apps on HoloLens (HoloLens) -description: The recommended way to install apps on HoloLens is to use Microsoft Store for Business. -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 10/23/2018 -ms.reviewer: -manager: dansimp ---- - -# Install apps on HoloLens - -The recommended way to install Universal Windows Platform (UWP) apps on HoloLens is to use Microsoft Store for Business. You can make your own [line-of-business application](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps) available through Microsoft Store for Business. - -You can also deploy apps using your mobile device management (MDM) provider or use the Windows Device Portal to install apps. - -## Use Microsoft Store for Business to deploy apps to HoloLens - -Microsoft Store for Business is a private Microsoft Store for your enterprise. People in your organization can open the Store app and select your private Store to install apps that you have made available to them. - -![How Microsoft Store for Business appears in Store app](images/wsfb-private.png) - -In your Microsoft Store for Business dashboard, you can also download apps to distribute to devices that aren't connected to the Internet, plus add line-of-business (LOB) apps for distribution. - -### Requirements - -- You need to be a global administrator for your Azure Active Directory (Azure AD) tenant. - - >[!TIP] - >You can create an Azure AD account and tenant as part of the Store for Business sign-up process. - -- End users need Azure AD accounts when they access Store for Business content from Windows-based devices. - -### Microsoft Store for Business process - -1. [Sign up for Microsoft Store for Business.](https://technet.microsoft.com/itpro/windows/manage/sign-up-windows-store-for-business) -2. [Assign roles and permissions for managing your Store for Business.](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business) -3. (Optional) [Configure Microsoft Store for Business to work with your MDM provider.](https://technet.microsoft.com/itpro/windows/manage/configure-mdm-provider-windows-store-for-business) -3. [Get apps for your Store for Business.](https://technet.microsoft.com/itpro/windows/manage/acquire-apps-windows-store-for-business) -4. [Distribute apps to your employees.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-to-your-employees-windows-store-for-business) - -### Install apps on HoloLens from Microsoft Store for Business - -The method that you use to install an app from your Microsoft Store for Business on HoloLens depends on the distribution method that you choose. - -| Distribution method | To install on HoloLens| -| --- | --- | -| [Using private store](https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store) | Open the Store app and select the tab for your organization to choose from available apps. | -| Using MDM | [You can configure MDM to synchronize your Store for Business inventory.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool)

          See the **Important** note in [Use MDM to deploy apps to HoloLens.](#use-mdm-to-deploy-apps-to-hololens) | - - - -## Use MDM to deploy apps to HoloLens - ->[!IMPORTANT] ->Online-licensed apps cannot be deployed with Microsoft Store for Business on HoloLens via an MDM provider. If attempted, apps will remain in “downloading” state. Instead, you can use your MDM provider to deploy MDM-hosted apps to HoloLens, or deploy offline-licensed apps to HoloLens via Store for Business - - -You can deploy UWP apps to HoloLens using your MDM provider. For Intune instructions, see [Deploy apps in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/add-apps). - -Using Intune, you can also [monitor your app deployment](https://docs.microsoft.com/intune/deploy-use/monitor-apps-in-microsoft-intune). - - - -## Use the Windows Device Portal to install apps on HoloLens - ->[!IMPORTANT] ->When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. - -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). - -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. - - >[!TIP] - >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). - -4. In the Windows Device Portal, click **Apps**. - - ![App Manager](images/apps.png) - -5. In **Install app**, select an **app package** from a folder on your computer or network. If the app package requires additional software, such as dependency frameworks, select **I want to specify framework packages**. - -6. In **Deploy**, click **Go** to deploy the app package and added dependencies to the connected HoloLens. - - - - - - diff --git a/devices/hololens/hololens-install-localized.md b/devices/hololens/hololens-install-localized.md deleted file mode 100644 index 0d3b2aecfb..0000000000 --- a/devices/hololens/hololens-install-localized.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Install localized versions of HoloLens (HoloLens) -description: Learn how to install the Chinese or Japanese versions of HoloLens -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 11/13/2018 -ms.reviewer: -manager: dansimp ---- - -# Install localized versions of HoloLens - -In order to switch to the Chinese or Japanese version of HoloLens, you’ll need to download the build for the language on a PC and then install it on your HoloLens using the Windows Device Recovery Tool (WDRT). - ->[!IMPORTANT] ->Installing the Chinese or Japanese builds of HoloLens using WDRT will delete existing data, like personal files and settings, from your HoloLens. - - -2. On your PC, download and install [the Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379). -3. Download the package for the language you want to your PC: [Simplified Chinese](https://aka.ms/hololensdownload-ch) or [Japanese](https://aka.ms/hololensdownload-jp). -4. When the download is finished, select **File Explorer > Downloads**. Right-click the zipped folder you just downloaded, and select **Extract all... > Extract** to unzip it. -5. Connect your HoloLens to your PC using the micro-USB cable it came with. (Even if you've been using other cables to connect your HoloLens, this one works best.)  -6. The tool will automatically detect your HoloLens. Select the Microsoft HoloLens tile. -7. On the next screen, select **Manual package selection** and choose the installation file contained in the folder you unzipped in step 4. (Look for a file with the extension “.ffu”.) -8. Select **Install software** and follow the instructions to finish installing. -9. Once the build is installed, HoloLens setup will start automatically. Put on the device and follow the setup directions. - -When you’re done with setup, go to **Settings -> Update & Security -> Windows Insider Program** and check that you’re configured to receive the latest preview builds. The Chinese/Japanese version of HoloLens will be kept up-to-date with the latest preview builds via the Windows Insider Program the same way the English version is. - -## Note for language support - -- You can’t change the system language between English, Japanese, and Chinese using the Settings app. Flashing a new build is the only supported way to change the device system language. -- While you can enter Simplified Chinese / Japanese text using the on-screen Pinyin keyboard, typing in Simplified Chinese / Japanese using a Bluetooth hardware keyboard is not supported at this time. However, on Chinese/Japanese HoloLens, you can continue to use a BT keyboard to type in English (the ~ key on a hardware keyboard toggles the keyboard to type in English). diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md deleted file mode 100644 index b648efe898..0000000000 --- a/devices/hololens/hololens-kiosk.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Set up HoloLens in kiosk mode (HoloLens) -description: Use a kiosk configuration to lock down the apps on HoloLens. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 11/13/2018 -ms.reviewer: -manager: dansimp ---- - -# Set up HoloLens in kiosk mode - - - -In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#add-guest-access-to-the-kiosk-configuration-optional) - -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. - -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the bloom gesture and Cortana are disabled, and placed apps aren't shown in the user's surroundings. - -The following table lists the device capabilities in the different kiosk modes. - -Kiosk mode | Voice and Bloom commands | Quick actions menu | Camera and video | Miracast ---- | --- | --- | --- | --- -Single-app kiosk | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) -Multi-app kiosk | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) with **Home** and **Volume** (default)

          Photo and video buttons shown in Quick actions menu if the Camera app is enabled in the kiosk configuration.

          Miracast is shown if the Camera app and device picker app are enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app is enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app and device picker app are enabled in the kiosk configuration. - ->[!NOTE] ->Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. - -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. - ->[!WARNING] ->The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. -> ->Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - -For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#setup-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. - -For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. - -## Start layout for HoloLens - -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#setup-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. - ->[!NOTE] ->Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. - -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You will select this file when you configure the kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - ->[!NOTE] ->If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` - -### Start layout for a provisioning package - -You will [create an XML file](#setup-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. - -```xml - - - - - - - - - - - - - - - ]]> - - -``` - -## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803) - -For HoloLens devices that are managed by Microsoft Intune, you [create a device profile](https://docs.microsoft.com/intune/device-profile-create) and configure the [Kiosk settings](https://docs.microsoft.com/intune/kiosk-settings). - -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -## Setup kiosk mode using a provisioning package (Windows 10, version 1803) - -Process: -1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) - -### Create a kiosk configuration XML file - -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: - -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. -- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. - -#### Add guest access to the kiosk configuration (optional) - -In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. - -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: - -```xml - - - - - - -``` - -### Add the kiosk configuration XML file to a provisioning package - -1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -2. Choose **Advanced provisioning**. -3. Name your project, and click **Next**. -4. Choose **Windows 10 Holographic** and click **Next**. -5. Select **Finish**. The workspace for your package opens. -6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. -7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created. - - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) - -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. -10. On the **File** menu, select **Save.** -11. On the **Export** menu, select **Provisioning package**. -12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -13. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. - -15. Click **Next**. - -16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - - -### Apply the provisioning package to HoloLens - -1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box). - -3. HoloLens will show up as a device in File Explorer on the PC. - -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE. - - -## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803) - -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. - - >[!IMPORTANT] - >When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). - -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. - - >[!TIP] - >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). - -4. In the Windows Device Portal, click **Kiosk Mode**. - - ![Kiosk Mode](images/kiosk.png) - - >[!NOTE] - >The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md). - -5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. - - -## Kiosk app recommendations - -- You cannot select Microsoft Edge, Microsoft Store, or the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app and the File Explorer app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - -## More information - - - -Watch how to configure a kiosk in a provisioning package. ->[!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false] diff --git a/devices/hololens/hololens-multiple-users.md b/devices/hololens/hololens-multiple-users.md deleted file mode 100644 index d4aac40795..0000000000 --- a/devices/hololens/hololens-multiple-users.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Share HoloLens with multiple people (HoloLens) -description: You can configure HoloLens to be shared by multiple Azure Active Directory accounts. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 04/30/2018 -ms.reviewer: -manager: dansimp ---- - -# Share HoloLens with multiple people - - -A HoloLens device can be shared by multiple Azure Active Directory (Azure AD) accounts, each with their own user settings and user data on the device. - -**Prerequisite**: The HoloLens device must be running Windows 10, version 1803, and be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md). - -During setup, you must select **My work or school owns it** and sign in with an Azure AD account. After setup, ensure that **Other People** appears in **Settings** > **Accounts**. - -Other people can use the HoloLens device by signing in with their Azure AD account credentials. To switch users, press the power button once to go to standby and then press the power button again to return to the lock screen, or select the user tile on the upper right of the pins panel to sign out the current user. - ->[!NOTE] ->Each subsequent user will need to perform [Calibration](https://developer.microsoft.com/windows/mixed-reality/calibration) in order to set their correct interpupillary distance (PD) for the device while signed in. - -To see users on the device or to remove a user from the device, go to **Settings** > **Accounts** > **Other users**. - - - - diff --git a/devices/hololens/hololens-offline.md b/devices/hololens/hololens-offline.md deleted file mode 100644 index 49190e6907..0000000000 --- a/devices/hololens/hololens-offline.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Use HoloLens offline -description: To set up HoloLens, you'll need to connect to a Wi-Fi network -ms.assetid: b86f603c-d25f-409b-b055-4bbc6edcd301 -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Use HoloLens offline - -To set up HoloLens, you'll need to connect to a Wi-Fi network—the setup tutorial will show you how. - -## HoloLens limitations - -After your HoloLens is set up, you can use it without a Wi-Fi connection, but apps that use Internet connections may have limited capabilities when you use HoloLens offline. diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md deleted file mode 100644 index 5e85f10bec..0000000000 --- a/devices/hololens/hololens-provisioning.md +++ /dev/null @@ -1,200 +0,0 @@ ---- -title: Configure HoloLens using a provisioning package (HoloLens) -description: Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 11/13/2018 -ms.reviewer: -manager: dansimp ---- - -# Configure HoloLens using a provisioning package - - - -[Windows provisioning](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages) makes it easy for IT administrators to configure end-user devices without imaging. Windows Configuration Designer is a tool for configuring images and runtime settings which are then built into provisioning packages. - -Some of the HoloLens configurations that you can apply in a provisioning package: -- Upgrade to Windows Holographic for Business -- Set up a local account -- Set up a Wi-Fi connection -- Apply certificates to the device - -To create provisioning packages, you must install Windows Configuration Designer [from Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22) or [from the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). If you install Windows Configurations Designer from the Windows ADK, select **Configuration Designer** from the **Select the features you want to install** dialog box. - - - - -## Create a provisioning package for HoloLens using the HoloLens wizard - -The HoloLens wizard helps you configure the following settings in a provisioning package: - -- Upgrade to the enterprise edition - - >[!NOTE] - >Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md). - -- Configure the HoloLens first experience (OOBE) -- Configure Wi-Fi network -- Enroll device in Azure Active Directory or create a local account -- Add certificates -- Enable Developer Mode - ->[!WARNING] ->You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. - -Provisioning packages can include management instructions and policies, customization of network connections and policies, and more. - -> [!TIP] -> Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc. - - -### Create the provisioning package - -Use the Windows Configuration Designer tool to create a provisioning package. - -1. Open Windows Configuration Designer (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). - -2. Click **Provision HoloLens devices**. - - ![ICD start options](images/icd-create-options-1703.png) - -3. Name your project and click **Finish**. - -4. Read the instructions on the **Getting started** page and select **Next**. The pages for desktop provisioning will walk you through the following steps. - -> [!IMPORTANT] -> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -### Configure settings - - - - - - - - - -
          step oneset up device

          Browse to and select the enterprise license file to upgrade the HoloLens edition.

          You can also toggle Yes or No to hide parts of the first experience.

          To set up the device without the need to connect to a Wi-Fi network, toggle Skip Wi-Fi setup to On.

          Select a region and timezone in which the device will be used.
          Select enterprise licence file and configure OOBE
          step two set up network

          In this section, you can enter the details of the Wi-Fi wireless network that the device should connect to automatically. To do this, select On, enter the SSID, the network type (Open or WPA2-Personal), and (if WPA2-Personal) the password for the wireless network.
          Enter network SSID and type
          step three account management

          You can enroll the device in Azure Active Directory, or create a local account on the device

          Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions.

          To create a local account, select that option and enter a user name and password.

          Important: (For Windows 10, version 1607 only) If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.
          join  Azure AD or create a local  account
          step four add certificates

          To provision the device with a certificate, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.
          add a certificate
          step five Developer Setup

          Toggle Yes or No to enable Developer Mode on the HoloLens. Learn more about Developer Mode.
          Enable Developer Mode
          step six finish

          Do not set a password to protect your provisioning package. If the provisioning package is protected by a password, provisioning the HoloLens device will fail.
          Protect your package
          - -After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. - - **Next step**: [How to apply a provisioning package](#apply) - - -## Create a provisioning package for HoloLens using advanced provisioning - ->[!NOTE] ->Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md). - -1. On the Windows Configuration Designer start page, select **Advanced provisioning**. -2. In the **Enter project details** window, specify a name for your project and the location for your project. Optionally, enter a brief description to describe your project. - -3. Click **Next**. - -4. In the **Choose which settings to view and configure** window, select **Windows 10 Holographic**, and then click **Next**. - -6. Click **Finish**. - -7. Expand **Runtime settings** and customize the package with any of the settings [described below](#what-you-can-configure). - - >[!IMPORTANT] - >(For Windows 10, version 1607 only) If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens#perform_a_full_device_recovery). - -8. On the **File** menu, click **Save**. - -4. Read the warning that project files may contain sensitive information, and click **OK**. - - >[!IMPORTANT] - >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -3. On the **Export** menu, click **Provisioning package**. - -4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**. - -5. Set a value for **Package Version**. - - >[!TIP] - >You can make changes to existing packages and change the version number to update previously applied packages. - -6. On the **Select security details for the provisioning package**, click **Next**. - - >[!WARNING] - >If you encrypt the provisioning package, provisioning the HoloLens device will fail. - -7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows Configuration Designer uses the project folder as the output location. - - Optionally, you can click **Browse** to change the default output location. - -8. Click **Next**. - -9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. - -10. When the build completes, click **Finish**. - - -## Apply a provisioning package to HoloLens during setup - -1. Connect the device via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box). - -2. Briefly press and release the **Volume Down** and **Power** buttons simultaneously. (This step isn't needed in Windows 10, version 1803.) - -3. HoloLens will show up as a device in File Explorer on the PC. - -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE. - ->[!NOTE] ->If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package. - -## Apply a provisioning package to HoloLens after setup - ->[!NOTE] ->Windows 10, version 1809 only - -On your PC: -1. Create a provisioning package as described at [Create a provisioning package for HoloLens using the HoloLens wizard](hololens-provisioning.md). -2. Connect the HoloLens device via USB to a PC. HoloLens will show up as a device in File Explorer on the PC. -3. Drag and drop the provisioning package to the Documents folder on the HoloLens. - -On your HoloLens: -1. Go to **Settings > Accounts > Access work or school**. -2. In **Related Settings**, select **Add or remove a provisioning package**. -3. On the next page, select **Add a package** to launch the file picker and select your provisioning package. If the folder is empty, make sure you select **This Device** and select **Documents**. - -After your package has been applied, it will show in the list of **Installed packages**. To view package details or to remove the package from the device, select the listed package. - -## What you can configure - -Provisioning packages make use of configuration service providers (CSPs). If you're not familiar with CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers). - -In Windows Configuration Designer, when you create a provisioning package for Windows Holographic, the settings in **Available customizations** are based on [CSPs that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens). The following table describes settings that you might want to configure for HoloLens. - -![Common runtime settings for HoloLens](images/icd-settings.png) - -| Setting | Description | -| --- | --- | -| **Certificates** | Deploy a certificate to HoloLens. | -| **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens. | -| **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens-upgrade-enterprise.md) | -| **Policies** | Allow or prevent developer mode on HoloLens. [Policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies) | - ->[!NOTE] ->App installation (**UniversalAppInstall**) using a provisioning package is not currently supported for HoloLens. - - - - - - - diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md deleted file mode 100644 index b0f40d77cc..0000000000 --- a/devices/hololens/hololens-recovery.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Restore HoloLens 2 using Advanced Recovery Companion -ms.reviewer: -manager: dansimp -description: How to use Advanced Recovery Companion to flash an image to HoloLens 2. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Restore HoloLens 2 using Advanced Recovery Companion - ->[!TIP] ->If you're having issues with HoloLens (the first device released), see [Restart, reset, or recover HoloLens](https://support.microsoft.com/help/13452/hololens-restart-reset-or-recover-hololens). Advanced Recovery Companion is only supported for HoloLens 2. - ->[!WARNING] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -The Advanced Recovery Companion is a new app in Microsoft Store that you can use to restore the operating system image to your HoloLens device. - -When your HoloLens 2 is unresponsive, not running properly, or is experiencing software or update problems, try these things in order: - -1. [Restart](#restart-hololens-2) the HoloLens 2. -2. [Reset](#reset-hololens-2) the HoloLens 2. -3. [Recover](#recover-hololens-2) the HoloLens 2. - ->[!IMPORTANT] ->Resetting or recovering your HoloLens will erase all of your personal data, including apps, games, photos, and settings. You won’t be able to restore a backup once the reset is complete. - -## Restart HoloLens 2 - -A device restart can often "fix" a computer issue. First, say "Hey Cortana, restart the device." - -If you’re still having problems, press the power button for 4 seconds, until all of the battery indicators fade out. Wait 1 minute, then press the power button again to turn on the device. - -If neither of those things works, force restart the device. Hold down the power button for 10 seconds. Release it and wait 30 seconds, then press the power button again to turn on the device. - -## Reset HoloLens 2 - -If the device is still having a problem after restart, use reset to return the HoloLens 2 to factory settings. - -To reset your HoloLens 2, go to **Settings > Update > Reset** and select **Reset device**. - ->[!NOTE] ->The battery needs at least 40 percent charge to reset. - -## Recover HoloLens 2 - -If the device is still having a problem after reset, you can use Advanced Recovery Companion to flash the device with a new image. - -1. On your computer, get [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from Microsoft Store. -2. Connect HoloLens 2 to your computer. -3. Start Advanced Recovery Companion. -4. On the **Welcome** page, select your device. -5. On the **Device info** page, select **Install software** to install the default package. (If you have a Full Flash Update (FFU) image that you want to install instead, select **Manual package selection**.) -6. Software installation will begin. Do not use the device or disconnect the cable during installation. When you see the **Installation finished** page, you can disconnect and use your device. - ->[!NOTE] ->[Learn about FFU image file formats.](https://docs.microsoft.com/windows-hardware/manufacture/desktop/wim-vs-ffu-image-file-formats) diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md deleted file mode 100644 index 0ff5596fa3..0000000000 --- a/devices/hololens/hololens-requirements.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: HoloLens in the enterprise requirements and FAQ (HoloLens) -description: Requirements and FAQ for general use, Wi-Fi, and device management for HoloLens in the enterprise. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 06/04/2018 -ms.reviewer: -manager: dansimp ---- - -# Microsoft HoloLens in the enterprise: requirements and FAQ - -When you develop for HoloLens, there are [system requirements and tools](https://developer.microsoft.com/windows/mixed-reality/install_the_tools) that you need. In an enterprise environment, there are also a few requirements to use and manage HoloLens which are listed below. - -## Requirements - -### General use -- Microsoft account or Azure Active Directory (Azure AD) account -- Wi-Fi network to set up HoloLens - ->[!NOTE] ->After you set up HoloLens, you can use it offline [with some limitations](https://support.microsoft.com/help/12645/hololens-use-hololens-offline). - - -### Supported wireless network EAP methods -- PEAP-MS-CHAPv2 -- PEAP-TLS -- TLS -- TTLS-CHAP -- TTLS-CHAPv2 -- TTLS-MS-CHAPv2 -- TTLS-PAP -- TTLS-TLS - -### Device management -- Users have Azure AD accounts with [Intune license assigned](https://docs.microsoft.com/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune-step-4) -- Wi-Fi network -- Intune or a 3rd party mobile device management (MDM) provider that uses Microsoft MDM APIs - -### Upgrade to Windows Holographic for Business -- HoloLens Enterprise license XML file - - -## FAQ for HoloLens - - -#### Is Windows Hello for Business supported on HoloLens? - -Windows Hello for Business (using a PIN to sign in) is supported for HoloLens. To allow Windows Hello for Business PIN sign-in on HoloLens: - -1. The HoloLens device must be [managed by MDM](hololens-enroll-mdm.md). -2. You must enable Windows Hello for Business for the device. ([See instructions for Microsoft Intune.](https://docs.microsoft.com/intune/windows-hello)) -3. On HoloLens, the user can then set up a PIN from **Settings** > **Sign-in Options** > **Add PIN**. - ->[!NOTE] ->Users who sign in with a Microsoft account can also set up a PIN in **Settings** > **Sign-in Options** > **Add PIN**. This PIN is associated with [Windows Hello](https://support.microsoft.com/help/17215/windows-10-what-is-hello), rather than [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview). - -#### Does the type of account change the sign-in behavior? - -Yes, the behavior for the type of account impacts the sign-in behavior. If you apply policies for sign-in, the policy is always respected. If no policy for sign-in is applied, these are the default behaviors for each account type. - -- Microsoft account: signs in automatically -- Local account: always asks for password, not configurable in **Settings** -- Azure AD: asks for password by default; configurable by **Settings** to no longer ask for password. - ->[!NOTE] ->Inactivity timers are currently not supported, which means that the **AllowIdleReturnWithoutPassword** policy is respected only when the device goes into StandBy. - - -#### How do I remove a HoloLens device from the Intune dashboard? - -You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard. - - -## Related resources - -[Getting started with Azure Active Directory Premium](https://azure.microsoft.com/documentation/articles/active-directory-get-started-premium/) - -[Get started with Intune](https://docs.microsoft.com/intune/understand-explore/get-started-with-a-30-day-trial-of-microsoft-intune) - -[Enroll devices for management in Intune](https://docs.microsoft.com/intune/deploy-use/enroll-devices-in-microsoft-intune#supported-device-platforms) - -[Azure AD editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/) - diff --git a/devices/hololens/hololens-restart-recover.md b/devices/hololens/hololens-restart-recover.md deleted file mode 100644 index 9bf0cddb37..0000000000 --- a/devices/hololens/hololens-restart-recover.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Restart, reset, or recover HoloLens -description: Restart, reset, or recover HoloLens -ms.assetid: 9a546416-1648-403c-9e0c-742171b8812e -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Restart, reset, or recover HoloLens - -Here are some things to try if your HoloLens is unresponsive, isn’t running well, or is experiencing software or update problems. - -## Restart your HoloLens - -If your HoloLens isn’t running well or is unresponsive, try the following things. - -First, try restarting the device: say, "Hey Cortana, restart the device." - -If you’re still having problems, press the power button for 4 seconds, until all of the battery indicators fade out. Wait 1 minute, then press the power button again to turn on the device. - -If neither of those things works, force restart the device. Hold down the power button for 10 seconds. Release it and wait 30 seconds, then press the power button again to turn on the device. - -## Reset or recover your HoloLens - -If restarting your HoloLens doesn’t help, another option is to reset it. If resetting it doesn’t fix the problem, the Windows Device Recovery Tool can help you recover your device. - ->[!IMPORTANT] ->Resetting or recovering your HoloLens will erase all of your personal data, including apps, games, photos, and settings. You won’t be able to restore a backup once the reset is complete. - -## Reset - -Resetting your HoloLens keeps the version of the Windows Holographic software that’s installed on it and returns everything else to factory settings. - -To reset your HoloLens, go to **Settings** > **Update** > **Reset** and select **Reset device**. The battery will need to have at least a 40 percent charge remaining to reset. - -## Recover using the Windows Device Recovery Tool - -Before you use this tool, determine if restarting or resetting your HoloLens fixes the problem. The recovery process may take some time, and the latest version of the Windows Holographic software approved for your HoloLens will be installed. - -To use the tool, you’ll need a computer running Windows 10 or later, with at least 4 GB of free storage space. Please note that you can’t run this tool on a virtual machine. -To recover your HoloLens - -1. Download and install the [Windows Device Recovery Tool](https://dev.azure.com/ContentIdea/ContentIdea/_queries/query/8a004dbe-73f8-4a32-94bc-368fc2f2a895/) on your computer. -1. Connect the clicker to your computer using the Micro USB cable that came with your HoloLens. -1. Run the Windows Device Recovery Tool and follow the instructions. - -If the clicker isn’t automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode. diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md deleted file mode 100644 index 77bb29070f..0000000000 --- a/devices/hololens/hololens-setup.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Set up a new HoloLens -description: This guide walks through first time set up. You'll need a Wi-Fi network and either a Microsoft (MSA) or Azure Active Directory (AAD) account. -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: quickstart -ms.localizationpriority: medium -ms.date: 07/14/2019 ---- - -# Set up HoloLens for the first time - -Follow along to set up a HoloLens for the first time. At the end of this quickstart, you'll be able to use HoloLens and navigate HoloLens settings on-device. - -This is a high level unboxing guide to become familiar with HoloLens. -See [Set up HoloLens in the enterprise](hololens-requirements.md) to configure HoloLens for scale enterprise deployment and ongoing device management. - -## Prerequisites - -- Internet access. - - Wi-Fi is the easiest way to do first set up on both HoloLens and HoloLens 2. It can be an open Wi-Fi or password-protected Wi-Fi network; the Wi-Fi network does not need to provide access to enterprise resources or intranet sites. - - HoloLens 2 can connect to the internet via ethernet and a USB-C adapter. -- a user account - Microsoft (MSA) or Azure Active Directory (AAD) - -## Prepare for first-boot - -Become familiar with the HoloLens hardware and prepare to turn your HoloLens on for the first time. - -1. Be sure your HoloLens is [charged](https://support.microsoft.com/help/12627) -1. [Adjust fit](https://support.microsoft.com/help/12632) for a comfortable fit. -1. [Turn on HoloLens](https://support.microsoft.com/help/12642). You will be guided through a calibration procedure and how to perform [the gestures](https://support.microsoft.com/help/12644/hololens-use-gestures) that you will use to operate HoloLens. - -## Set up your HoloLens - -Set up your HoloLens and your user account. - -1. Connect to the internet (select Wi-Fi). -1. Sign in to your user account. You'll choose between **My work or school owns it** and **I own it**. - - When you choose **My work or school owns it**, you sign in with an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens will be enrolled in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app). - 1. Enter your organizational account. - 2. Accept privacy statement. - 3. Sign in using your Azure AD credentials. This may redirect to your organization's sign-in page. - 4. Continue with device setup. - - When you choose **I own it**, you sign in with a Microsoft account. After setup is complete, you can [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app). - 1. Enter your Microsoft account. - 2. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process. -1. The device sets your time zone based on information obtained from the Wi-Fi network. -1. Follow the first-start guides to learn how to interact with holograms, control the HoloLens with your voice, and access the start menu. - -Congratulations! Setup is complete and you can begin using HoloLens. - -## Explore HoloLens - -### Check out on-device settings and desktop - -HoloLens doesn't have an on-device command line. With that in mind, the settings section in HoloLens plays an important role in diagnosing problems on-device. Understanding the information available to HoloLens users will pay dividends when troubleshooting or configuring the device. - -Open settings by opening the start menu and clicking on the **Settings** in the top bar. You can also ask Cortana to open settings. - -Follow [this guide](https://docs.microsoft.com/windows/mixed-reality/navigating-the-windows-mixed-reality-home) to navigate around the HoloLens home. - -### Connect bluetooth devices - -Connecting a bluetooth keyboard makes typing on HoloLens as efficient as a Windows PC. - -[Connect a bluetooth keyboard or clicker](https://support.microsoft.com/en-us/help/12636). - -## Next steps - -Start planning for HoloLens at scale with HoloLens' enterprise management features. - -> [!div class="nextstepaction"] -> [HoloLens in the enterprise](hololens-requirements.md) \ No newline at end of file diff --git a/devices/hololens/hololens-spaces-on-hololens.md b/devices/hololens/hololens-spaces-on-hololens.md deleted file mode 100644 index 5c04bb7c3e..0000000000 --- a/devices/hololens/hololens-spaces-on-hololens.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Spaces on HoloLens -description: HoloLens blends holograms with your world -ms.assetid: bd55ecd1-697a-4b09-8274-48d1499fcb0b -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Spaces on HoloLens - -HoloLens blends holograms with your world, mapping your surroundings to remember where you place your apps and content. - ->[!NOTE] ->For your HoloLens to work properly, HoloLens Wi-Fi needs to be turned on, though it doesn't have to be connected to a network. - -## Tips for setting up your space - -HoloLens works best in certain kinds of environments. Choose a room with adequate light and plenty of space. Avoid dark spaces and rooms with a lot of dark, shiny, or translucent surfaces (for instance, mirrors or gauzy curtains). - ->[!NOTE] ->HoloLens is optimized for indoor use. Use it in a safe place with no tripping hazards. [More on safety](https://support.microsoft.com/help/4023454/safety-information). - -## Mapping your space - -When HoloLens starts mapping your surroundings, you'll see a mesh graphic spreading over the space. - -To help HoloLens learn a space, walk around the space and gaze around you. Air tap in a space to light up the mesh and see what's been mapped. - -If your space changes significantly—for example, if a piece of furniture is moved—you might need to walk around the space and gaze around you so HoloLens can relearn it. - ->[!NOTE] ->If HoloLens is having trouble mapping your space or you're have difficulty placing holograms, see [HoloLens and holograms: FAQ](https://support.microsoft.com/help/13456/hololens-and-holograms-faq). diff --git a/devices/hololens/hololens-spaces.md b/devices/hololens/hololens-spaces.md deleted file mode 100644 index 3df4ee1cc8..0000000000 --- a/devices/hololens/hololens-spaces.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How HoloLens stores data for spaces (HoloLens) -description: -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 11/05/2018 -ms.reviewer: -manager: dansimp ---- - -# How HoloLens stores data for spaces - -In the Windows 10, version 1803 update for Microsoft HoloLens, the mapping data for [spaces](https://support.microsoft.com/help/13760/hololens-spaces-on-hololens) is stored in a local database. - -The map database is not exposed to a user of the device, even when plugged into a PC or when using the File Explorer app. When BitLocker is enabled, the stored map data is also encrypted with the entire volume. - -Holograms that are anchored within the same map section are considered to be “nearby” in the current space. - - -## Frequently asked questions - -**How can I remove map data and known spaces from the HoloLens?** - -There are two options for deleting map data in **Settings > System > Holograms**: - -- Select **Remove nearby holograms** to delete nearby holograms, clearing the map data and anchored holograms for the current space. A brand new map section would be created and stored in the database for that location while the device is used there. This option can be used to clear the map data for work without affecting any map data from home, for example. -- Select **Remove all holograms** to delete all holograms, clearing all locally stored map data and anchored holograms. No holograms will be rediscovered and any holograms need to be newly placed. - ->[!NOTE] ->When you remove nearby or all holograms, HoloLens immediately starts scanning and mapping the current space. - -**How does Wi-Fi data get used by HoloLens and where is the data stored?** - -As long as Wi-Fi is enabled, map data will be correlated with nearby Wi-Fi access points. There is no difference in behavior if a network is connected or just nearby. Network characteristics are not sent to Microsoft, and all Wi-Fi references are kept local on the HoloLens. - -Wi-Fi characteristics are stored locally to help correlate hologram locations and map sections stored within HoloLens’ database of known spaces. It’s inaccessible to users, and not sent to Microsoft via the cloud or via telemetry. - - - -**Does HoloLens need to be connected to the internet?** - -No, internet connectivity is not required. Observed Wi-Fi access points are obtained without being connected or authenticated. It does not change functionality if the access points are internet connected or intranet/local only. - - - - - -**Since HoloLens no longer requires you to select a space when Wi-Fi is disabled, how does it find the space automatically?** - -If Wi-Fi is disabled, the space search can still happen; HoloLens will need to search more of the map data within the spaces database, and finding holograms can take longer. - -HoloLens will sense and remember spaces even when Wi-Fi is disabled, by securely storing the sensor data when holograms are placed. Without the Wi-Fi info, the space and holograms may be slower to recognize at a later time, as the HoloLens needs to compare active scans to all hologram anchors and map sections stored on the device in order to locate the correct portion of the map. - -HoloLens will visually compare the current scanning data from the sensors to locally stored map sections in the entire spaces database. It will locate holograms faster if the Wi-Fi characteristics can be found, to narrow down the number of spaces to compare. - - - - -  - - - -## Related topics - -- [Environment considerations for HoloLens](https://docs.microsoft.com/windows/mixed-reality/environment-considerations-for-hololens) -- [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping-design) -- [HoloLens and holograms: FAQ](https://support.microsoft.com/help/13456/hololens-and-holograms-faq) diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md deleted file mode 100644 index 418cfce2d9..0000000000 --- a/devices/hololens/hololens-updates.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Manage updates to HoloLens (HoloLens) -description: Administrators can use mobile device management to manage updates to HoloLens devices. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 04/30/2018 -ms.reviewer: -manager: dansimp ---- - -# Manage updates to HoloLens - ->**Looking for how to get the latest update? See [Update HoloLens](https://support.microsoft.com/help/12643/hololens-update-hololens).** - ->[!NOTE] ->HoloLens devices must be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md) to manage updates. - -For a complete list of Update policies, see [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#a-href-idhololenspoliciesapolicies-supported-by-windows-holographic-for-business). - -To configure how and when updates are applied, use the following policies: -- [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) -- [Update/ScheduledInstallDay](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday) -- [Update/ScheduledInstallTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime) - -To turn off the automatic check for updates, set the following policy to value **5** – Turn off Automatic Updates: -- [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) - -In Microsoft Intune, you can use **Automatic Update Behavior** to change this policy. (See [Manage software updates in Microsoft Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure)) - -For devices on Windows 10, version 1607 only: You can use the following update policies to configure devices to get updates from Windows Server Update Service (WSUS) instead of Windows Update: - -- [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice) -- [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval) -- [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl) - - - -## Related topics - -- [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#a-href-idhololenspoliciesapolicies-supported-by-windows-holographic-for-business) -- [Manage software updates in Microsoft Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure) diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md deleted file mode 100644 index 57bf3d0e04..0000000000 --- a/devices/hololens/hololens-upgrade-enterprise.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Unlock Windows Holographic for Business features (HoloLens) -description: HoloLens provides extra features designed for business when you upgrade to Windows Holographic for Business. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 07/09/2018 -ms.reviewer: -manager: dansimp ---- - -# Unlock Windows Holographic for Business features - - - -Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the [Commercial Suite](https://docs.microsoft.com/windows/mixed-reality/commercial-features), which provides extra features designed for business. - -When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic for Business. This license can be applied to the device either through the organization's [mobile device management (MDM) provider](#edition-upgrade-using-mdm) or a [provisioning package](#edition-upgrade-using-a-provisioning-package). - ->[!TIP] ->In Windows 10, version 1803, you can tell that the HoloLens has been upgraded to the business edition in **Settings** > **System**. - - - -## Edition upgrade using MDM - -The enterprise license can be applied by any MDM provider that supports the [WindowsLicensing configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904983.aspx). The latest version of the Microsoft MDM API will support WindowsLicensing CSP. - -For step-by-step instructions for upgrading HoloLens using Microsoft Intune, see [Upgrade devices running Windows Holographic to Windows Holographic for Business](https://docs.microsoft.com/intune/holographic-upgrade). - - On other MDM providers, the specific steps for setting up and deploying the policy might vary. - - - -## Edition upgrade using a provisioning package - -Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device. - -### Create a provisioning package that upgrades the Windows Holographic edition - -1. [Create a provisioning package for HoloLens.](hololens-provisioning.md) - -2. Go to **Runtime settings** > **EditionUpgrade**, and select **EditionUpgradeWithLicense**. - - ![Upgrade edition with license setting selected](images/icd1.png) - -2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. - - >[!NOTE] - >You can configure [additional settings in the provisioning package](hololens-provisioning.md). - -3. On the **File** menu, click **Save**. - -4. Read the warning that project files may contain sensitive information, and click **OK**. - - >[!IMPORTANT] - >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -3. On the **Export** menu, click **Provisioning package**. - -4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**. - -5. Set a value for **Package Version**. - - >[!TIP] - >You can make changes to existing packages and change the version number to update previously applied packages. - -6. On the **Select security details for the provisioning package**, click **Next**. - -7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. - - Optionally, you can click **Browse** to change the default output location. - -8. Click **Next**. - -9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. - -10. When the build completes, click **Finish**. - - -### Apply the provisioning package to HoloLens - -1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box). HoloLens will show up as a device in File Explorer on the PC. - - >[!NOTE] - >If the HoloLens device is running Windows 10, version 1607 or earlier, briefly press and release the **Volume Down** and **Power** buttons simultaneously to open File Explorer. - -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup. - - - - - diff --git a/devices/hololens/hololens-use-apps.md b/devices/hololens/hololens-use-apps.md deleted file mode 100644 index e3d0aba0a9..0000000000 --- a/devices/hololens/hololens-use-apps.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Use apps on HoloLens -description: Apps on HoloLens use either 2D view or holographic view. -ms.assetid: 6bd124c4-731c-4bcc-86c7-23f9b67ff616 -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Use apps on HoloLens - -Apps on HoloLens use either 2D view or holographic view. Apps with 2D view look like windows, and apps with holographic view surround you and become the only app you see. - -## Open apps - -You'll find your apps either pinned to Start or in the All apps list. To get to the All apps list, use the bloom gesture to go to Start, then select **All apps**. - -On Start or in the All apps list, select an app. It will open in a good position for viewing. - ->[!NOTE] ->- Up to three 2D app windows can be active at a time. You can open more, but only three will remain active. ->- Each open app can have one active window at a time, except Microsoft Edge, which can have up to three. ->- If you're having problems with apps, make sure there's enough light in your space, and walk around so HoloLens has a current scan. If you keep having trouble, see [HoloLens and holograms: FAQ](https://support.microsoft.com/help/13456/hololens-and-holograms-faq) for more info. - -## Move, resize, and rotate apps - -After opening an app, you can [change its position and size](https://support.microsoft.com/help/12634). - -## Close apps - -To close an app that uses 2D view, gaze at it, then select **Close**. - -To close an app that uses holographic view, use the bloom gesture to leave holographic view, then select **Close**. diff --git a/devices/hololens/hololens-whats-new.md b/devices/hololens/hololens-whats-new.md deleted file mode 100644 index c250d1c12c..0000000000 --- a/devices/hololens/hololens-whats-new.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: What's new in Microsoft HoloLens (HoloLens) -description: Windows Holographic for Business gets new features in Windows 10, version 1809. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 11/13/2018 -ms.reviewer: -manager: dansimp ---- - -# What's new in Microsoft HoloLens - -## Windows 10, version 1809 for Microsoft HoloLens - -### For everyone - -Feature | Details ---- | --- -Quick actions menu | When you're in an app, the Bloom gesture will now open a Quick actions menu to give you quick access to commonly used system features without having to leave the app. See [Set up HoloLens in kiosk mode](hololens-kiosk.md) for information about the Quick actions menu in kiosk mode.

          ![sample of the Quick actions menu](images/minimenu.png) -Stop video capture from the Start or quick actions menu | If you start video capture from the Start menu or quick actions menu, you’ll be able to stop recording from the same place. (Don’t forget, you can always do this with voice commands too.) -Project to a Miracast-enabled device | Project your HoloLens content to a nearby Surface device or TV/Monitor if using Microsoft Display adapter. On **Start**, select **Connect**, and then select the device you want to project to. **Note:** You can deploy HoloLens to use Miracast projection without enabling developer mode. -New notifications | View and respond to notification toasts on HoloLens, just like you do on a PC. Gaze to respond to or dismiss them (or if you’re in an immersive experience, use the bloom gesture). -HoloLens overlays (file picker, keyboard, dialogs, etc.) | You’ll now see overlays such as the keyboard, dialogs, file picker, etc. when using immersive apps. -Visual feedback overlay UI for volume change | When you use the volume up/down buttons on your HoloLens you’ll see a visual display of the volume level. -New UI for device boot | A loading indicator was added during the boot process to provide visual feedback that the system is loading. Reboot your device to see the new loading indicator—it’s between the "Hello" message and the Windows boot logo. -Share UX: Nearby Sharing | Addition of the Windows Nearby Sharing experience, allowing you to share a capture with a nearby Windows device. When you capture a photo or video on HoloLens (or use the share button from an app such as Microsoft Edge), select a nearby Windows device to share with. -Share from Microsoft Edge | Share button is now available on Microsoft Edge windows on HoloLens. In Microsoft Edge, select **Share**. Use the HoloLens share picker to share web content. - - - -### For administrators - - -| Feature | Details | -|-----------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [Enable post-setup provisioning](hololens-provisioning.md) | You can now apply a runtime provisioning package at any time using **Settings**. | -| Assigned access with Azure AD groups | You can now use Azure AD groups for configuration of Windows assigned access to set up single or multi-app kiosk configuration. | -| PIN sign-in on profile switch from sign-in screen | PIN sign-in is now available for **Other User**.  | -| Sign in with Web Credential Provider using password | You can now select the Globe sign-in option to launch web sign-in with your password. From the sign-in screen, select **Sign-In options** and select the Globe option to launch web sign-in. Enter your user name if needed, then your password.
          **Note:** You can choose to bypass any PIN/Smartcard options when prompted during web sign-in.  | -| Read device hardware info through MDM so devices can be tracked by serial # | IT administrators can see and track HoloLens by device serial number in their MDM console. Refer to your MDM documentation for feature availability and instructions. | -| Set HoloLens device name through MDM (rename) |  IT administrators can see and rename HoloLens devices in their MDM console. Refer to your MDM documentation for feature availability and instructions. | - -### For international customers - - -Feature | Details ---- | --- -Localized Chinese and Japanese builds | Use HoloLens with localized user interface for Simplified Chinese or Japanese, including localized Pinyin keyboard, dictation, and voice commands. -Speech Synthesis (TTS) | Speech synthesis feature now supports Chinese, Japanese, and English. - -[Learn how to install the Chinese and Japanese versions of HoloLens.](hololens-install-localized.md) - - - -## Windows 10, version 1803 for Microsoft HoloLens - -Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. This update introduces the following changes: - -- Previously, you could only verify that upgrade license for Commercial Suite had been applied to your HoloLens device by checking to see if VPN was an available option on the device. Now, **Settings** > **System** will display **Windows Holographic for Business** after the upgrade license is applied. [Learn how to unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md). - -- You can view the operating system build number in device properties in the File Explorer app and in the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq). - -- Provisioning a HoloLens device is now easier with the new **Provision HoloLens devices** wizard in the Windows Configuration Designer tool. In the wizard, you can configure the setup experience and network connections, set developer mode, and obtain bulk Azure AD tokens. [Learn how to use the simple provisioning wizard for HoloLens](hololens-provisioning.md#wizard). - - ![Provisioning HoloLens devices](images/provision-hololens-devices.png) - -- When you create a local account in a provisioning package, the password no longer expires every 42 days. - -- You can [configure HoloLens as a single-app or multi-app kiosk](hololens-kiosk.md). Multi-app kiosk mode lets you set up a HoloLens to only run the apps that you specify, and prevents users from making changes. - -- Media Transfer Protocol (MTP) is enabled so that you can connect the HoloLens device to a PC by USB and transfer files between HoloLens and the PC. You can also use the File Explorer app to move and delete files from within HoloLens. - -- Previously, after you signed in to the device with an Azure Active Directory (Azure AD) account, you then had to **Add work access** in **Settings** to get access to corporate resources. Now, you sign in with an Azure AD account and enrollment happens automatically. - -- Before you sign in, you can choose the network icon below the password field to choose a different Wi-Fi network to connect to. You can also connect to a guest network, such as at a hotel, conference center, or business. - -- You can now easily [share HoloLens with multiple people](hololens-multiple-users.md) using Azure AD accounts. - -- When setup or sign-in fails, choose the new **Collect info** option to get diagnostic logs for troubleshooting. - -- Individual users can sync their corporate email without enrolling their device in mobile device management (MDM). You can use the device with a Microsoft Account, download and install the Mail app, and add an email account directly. - -- You can check the MDM sync status for a device in **Settings** > **Accounts** > **Access Work or School** > **Info**. In the **Device sync status** section, you can start a sync, see areas managed by MDM, and create and export an advanced diagnostics report. - - - - - -## Additional resources - -- [Reset or recover your HoloLens](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens) -- [Restart, reset, or recover HoloLens](https://support.microsoft.com/help/13452/hololens-restart-reset-or-recover-hololens) -- [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business) - diff --git a/devices/hololens/images/about-encryption.png b/devices/hololens/images/about-encryption.png deleted file mode 100644 index 348e493503..0000000000 Binary files a/devices/hololens/images/about-encryption.png and /dev/null differ diff --git a/devices/hololens/images/account-management-details.png b/devices/hololens/images/account-management-details.png deleted file mode 100644 index 20816830a4..0000000000 Binary files a/devices/hololens/images/account-management-details.png and /dev/null differ diff --git a/devices/hololens/images/account-management.PNG b/devices/hololens/images/account-management.PNG deleted file mode 100644 index da53cb74b8..0000000000 Binary files a/devices/hololens/images/account-management.PNG and /dev/null differ diff --git a/devices/hololens/images/add-certificates-details.PNG b/devices/hololens/images/add-certificates-details.PNG deleted file mode 100644 index 966a826a46..0000000000 Binary files a/devices/hololens/images/add-certificates-details.PNG and /dev/null differ diff --git a/devices/hololens/images/add-certificates.PNG b/devices/hololens/images/add-certificates.PNG deleted file mode 100644 index 7a16dffd26..0000000000 Binary files a/devices/hololens/images/add-certificates.PNG and /dev/null differ diff --git a/devices/hololens/images/adk-install.png b/devices/hololens/images/adk-install.png deleted file mode 100644 index c087d3bae5..0000000000 Binary files a/devices/hololens/images/adk-install.png and /dev/null differ diff --git a/devices/hololens/images/apps.png b/devices/hololens/images/apps.png deleted file mode 100644 index 4e00aa96fc..0000000000 Binary files a/devices/hololens/images/apps.png and /dev/null differ diff --git a/devices/hololens/images/backicon.png b/devices/hololens/images/backicon.png deleted file mode 100644 index 3007e448b1..0000000000 Binary files a/devices/hololens/images/backicon.png and /dev/null differ diff --git a/devices/hololens/images/check_blu.png b/devices/hololens/images/check_blu.png deleted file mode 100644 index d5c703760f..0000000000 Binary files a/devices/hololens/images/check_blu.png and /dev/null differ diff --git a/devices/hololens/images/check_grn.png b/devices/hololens/images/check_grn.png deleted file mode 100644 index f9f04cd6bd..0000000000 Binary files a/devices/hololens/images/check_grn.png and /dev/null differ diff --git a/devices/hololens/images/checklistbox.gif b/devices/hololens/images/checklistbox.gif deleted file mode 100644 index cbcf4a4f11..0000000000 Binary files a/devices/hololens/images/checklistbox.gif and /dev/null differ diff --git a/devices/hololens/images/checklistdone.png b/devices/hololens/images/checklistdone.png deleted file mode 100644 index 7e53f74d0e..0000000000 Binary files a/devices/hololens/images/checklistdone.png and /dev/null differ diff --git a/devices/hololens/images/checkmark.png b/devices/hololens/images/checkmark.png deleted file mode 100644 index f9f04cd6bd..0000000000 Binary files a/devices/hololens/images/checkmark.png and /dev/null differ diff --git a/devices/hololens/images/cortana-on-hololens.png b/devices/hololens/images/cortana-on-hololens.png deleted file mode 100644 index 6205d3d2fd..0000000000 Binary files a/devices/hololens/images/cortana-on-hololens.png and /dev/null differ diff --git a/devices/hololens/images/crossmark.png b/devices/hololens/images/crossmark.png deleted file mode 100644 index 69432ff71c..0000000000 Binary files a/devices/hololens/images/crossmark.png and /dev/null differ diff --git a/devices/hololens/images/developer-setup-details.png b/devices/hololens/images/developer-setup-details.png deleted file mode 100644 index d445bf5759..0000000000 Binary files a/devices/hololens/images/developer-setup-details.png and /dev/null differ diff --git a/devices/hololens/images/developer-setup.png b/devices/hololens/images/developer-setup.png deleted file mode 100644 index a7e49873b0..0000000000 Binary files a/devices/hololens/images/developer-setup.png and /dev/null differ diff --git a/devices/hololens/images/device-encryption.PNG b/devices/hololens/images/device-encryption.PNG deleted file mode 100644 index 651429dfe0..0000000000 Binary files a/devices/hololens/images/device-encryption.PNG and /dev/null differ diff --git a/devices/hololens/images/doneicon.png b/devices/hololens/images/doneicon.png deleted file mode 100644 index d80389f35b..0000000000 Binary files a/devices/hololens/images/doneicon.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-assign.png b/devices/hololens/images/encrypt-assign.png deleted file mode 100644 index f5b0c85a3c..0000000000 Binary files a/devices/hololens/images/encrypt-assign.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-create-profile.png b/devices/hololens/images/encrypt-create-profile.png deleted file mode 100644 index b0f06ef40f..0000000000 Binary files a/devices/hololens/images/encrypt-create-profile.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-custom.png b/devices/hololens/images/encrypt-custom.png deleted file mode 100644 index b3635e9ee4..0000000000 Binary files a/devices/hololens/images/encrypt-custom.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-oma-uri.png b/devices/hololens/images/encrypt-oma-uri.png deleted file mode 100644 index e2754b7db4..0000000000 Binary files a/devices/hololens/images/encrypt-oma-uri.png and /dev/null differ diff --git a/devices/hololens/images/finish-details.png b/devices/hololens/images/finish-details.png deleted file mode 100644 index ff3f53e5c8..0000000000 Binary files a/devices/hololens/images/finish-details.png and /dev/null differ diff --git a/devices/hololens/images/finish.PNG b/devices/hololens/images/finish.PNG deleted file mode 100644 index 975caba764..0000000000 Binary files a/devices/hololens/images/finish.PNG and /dev/null differ diff --git a/devices/hololens/images/five.png b/devices/hololens/images/five.png deleted file mode 100644 index 961f0e15b7..0000000000 Binary files a/devices/hololens/images/five.png and /dev/null differ diff --git a/devices/hololens/images/four.png b/devices/hololens/images/four.png deleted file mode 100644 index 0fef213b37..0000000000 Binary files a/devices/hololens/images/four.png and /dev/null differ diff --git a/devices/hololens/images/hololens.png b/devices/hololens/images/hololens.png deleted file mode 100644 index ce54ae4281..0000000000 Binary files a/devices/hololens/images/hololens.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render-medium.png b/devices/hololens/images/hololens2-side-render-medium.png deleted file mode 100644 index d4650c05e2..0000000000 Binary files a/devices/hololens/images/hololens2-side-render-medium.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render-small.png b/devices/hololens/images/hololens2-side-render-small.png deleted file mode 100644 index a1a612e05a..0000000000 Binary files a/devices/hololens/images/hololens2-side-render-small.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render-xs.png b/devices/hololens/images/hololens2-side-render-xs.png deleted file mode 100644 index 08d5f966cd..0000000000 Binary files a/devices/hololens/images/hololens2-side-render-xs.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render.png b/devices/hololens/images/hololens2-side-render.png deleted file mode 100644 index 143fb8fc50..0000000000 Binary files a/devices/hololens/images/hololens2-side-render.png and /dev/null differ diff --git a/devices/hololens/images/icd-create-options-1703.PNG b/devices/hololens/images/icd-create-options-1703.PNG deleted file mode 100644 index 007e740683..0000000000 Binary files a/devices/hololens/images/icd-create-options-1703.PNG and /dev/null differ diff --git a/devices/hololens/images/icd-export-menu.png b/devices/hololens/images/icd-export-menu.png deleted file mode 100644 index 20bd5258eb..0000000000 Binary files a/devices/hololens/images/icd-export-menu.png and /dev/null differ diff --git a/devices/hololens/images/icd-install.PNG b/devices/hololens/images/icd-install.PNG deleted file mode 100644 index a0c80683ff..0000000000 Binary files a/devices/hololens/images/icd-install.PNG and /dev/null differ diff --git a/devices/hololens/images/icd-settings.png b/devices/hololens/images/icd-settings.png deleted file mode 100644 index 111b7f38c7..0000000000 Binary files a/devices/hololens/images/icd-settings.png and /dev/null differ diff --git a/devices/hololens/images/icd-simple-edit.png b/devices/hololens/images/icd-simple-edit.png deleted file mode 100644 index 421159ac17..0000000000 Binary files a/devices/hololens/images/icd-simple-edit.png and /dev/null differ diff --git a/devices/hololens/images/icd1.PNG b/devices/hololens/images/icd1.PNG deleted file mode 100644 index 25f905d4fe..0000000000 Binary files a/devices/hololens/images/icd1.PNG and /dev/null differ diff --git a/devices/hololens/images/intune1.PNG b/devices/hololens/images/intune1.PNG deleted file mode 100644 index c87c58d36a..0000000000 Binary files a/devices/hololens/images/intune1.PNG and /dev/null differ diff --git a/devices/hololens/images/intune2.PNG b/devices/hololens/images/intune2.PNG deleted file mode 100644 index 61ca386c3c..0000000000 Binary files a/devices/hololens/images/intune2.PNG and /dev/null differ diff --git a/devices/hololens/images/intune3.png b/devices/hololens/images/intune3.png deleted file mode 100644 index 39a812a1a7..0000000000 Binary files a/devices/hololens/images/intune3.png and /dev/null differ diff --git a/devices/hololens/images/kiosk.png b/devices/hololens/images/kiosk.png deleted file mode 100644 index 9cc771c779..0000000000 Binary files a/devices/hololens/images/kiosk.png and /dev/null differ diff --git a/devices/hololens/images/launchicon.png b/devices/hololens/images/launchicon.png deleted file mode 100644 index d469c68a2c..0000000000 Binary files a/devices/hololens/images/launchicon.png and /dev/null differ diff --git a/devices/hololens/images/minimenu.png b/devices/hololens/images/minimenu.png deleted file mode 100644 index 7aa0018011..0000000000 Binary files a/devices/hololens/images/minimenu.png and /dev/null differ diff --git a/devices/hololens/images/multiappassignedaccesssettings.png b/devices/hololens/images/multiappassignedaccesssettings.png deleted file mode 100644 index 86e2e0a451..0000000000 Binary files a/devices/hololens/images/multiappassignedaccesssettings.png and /dev/null differ diff --git a/devices/hololens/images/one.png b/devices/hololens/images/one.png deleted file mode 100644 index 7766e7d470..0000000000 Binary files a/devices/hololens/images/one.png and /dev/null differ diff --git a/devices/hololens/images/provision-hololens-devices.png b/devices/hololens/images/provision-hololens-devices.png deleted file mode 100644 index c5ece7102f..0000000000 Binary files a/devices/hololens/images/provision-hololens-devices.png and /dev/null differ diff --git a/devices/hololens/images/recover-clicker-1.png b/devices/hololens/images/recover-clicker-1.png deleted file mode 100644 index ad54e6ee09..0000000000 Binary files a/devices/hololens/images/recover-clicker-1.png and /dev/null differ diff --git a/devices/hololens/images/recover-clicker-2.png b/devices/hololens/images/recover-clicker-2.png deleted file mode 100644 index d7a9d6fd0d..0000000000 Binary files a/devices/hololens/images/recover-clicker-2.png and /dev/null differ diff --git a/devices/hololens/images/set-up-device-details.PNG b/devices/hololens/images/set-up-device-details.PNG deleted file mode 100644 index 7325e06e86..0000000000 Binary files a/devices/hololens/images/set-up-device-details.PNG and /dev/null differ diff --git a/devices/hololens/images/set-up-device.PNG b/devices/hololens/images/set-up-device.PNG deleted file mode 100644 index 577117a26a..0000000000 Binary files a/devices/hololens/images/set-up-device.PNG and /dev/null differ diff --git a/devices/hololens/images/set-up-network-details-desktop.PNG b/devices/hololens/images/set-up-network-details-desktop.PNG deleted file mode 100644 index 83911ccbd0..0000000000 Binary files a/devices/hololens/images/set-up-network-details-desktop.PNG and /dev/null differ diff --git a/devices/hololens/images/set-up-network.PNG b/devices/hololens/images/set-up-network.PNG deleted file mode 100644 index 19fd3ff7bb..0000000000 Binary files a/devices/hololens/images/set-up-network.PNG and /dev/null differ diff --git a/devices/hololens/images/seven.png b/devices/hololens/images/seven.png deleted file mode 100644 index 285a92df0b..0000000000 Binary files a/devices/hololens/images/seven.png and /dev/null differ diff --git a/devices/hololens/images/six.png b/devices/hololens/images/six.png deleted file mode 100644 index e8906332ec..0000000000 Binary files a/devices/hololens/images/six.png and /dev/null differ diff --git a/devices/hololens/images/three.png b/devices/hololens/images/three.png deleted file mode 100644 index 887fa270d7..0000000000 Binary files a/devices/hololens/images/three.png and /dev/null differ diff --git a/devices/hololens/images/two.png b/devices/hololens/images/two.png deleted file mode 100644 index b8c2d52eaf..0000000000 Binary files a/devices/hololens/images/two.png and /dev/null differ diff --git a/devices/hololens/images/use-hololens-clicker-1.png b/devices/hololens/images/use-hololens-clicker-1.png deleted file mode 100644 index ad54e6ee09..0000000000 Binary files a/devices/hololens/images/use-hololens-clicker-1.png and /dev/null differ diff --git a/devices/hololens/images/use-hololens-clicker-2.png b/devices/hololens/images/use-hololens-clicker-2.png deleted file mode 100644 index d7a9d6fd0d..0000000000 Binary files a/devices/hololens/images/use-hololens-clicker-2.png and /dev/null differ diff --git a/devices/hololens/images/uwp-dependencies.PNG b/devices/hololens/images/uwp-dependencies.PNG deleted file mode 100644 index 4e2563169f..0000000000 Binary files a/devices/hololens/images/uwp-dependencies.PNG and /dev/null differ diff --git a/devices/hololens/images/uwp-license.PNG b/devices/hololens/images/uwp-license.PNG deleted file mode 100644 index ccb5cf7cf4..0000000000 Binary files a/devices/hololens/images/uwp-license.PNG and /dev/null differ diff --git a/devices/hololens/images/windows-device-portal-home-page.png b/devices/hololens/images/windows-device-portal-home-page.png deleted file mode 100644 index 55e4b0eaad..0000000000 Binary files a/devices/hololens/images/windows-device-portal-home-page.png and /dev/null differ diff --git a/devices/hololens/images/wizard-steps.png b/devices/hololens/images/wizard-steps.png deleted file mode 100644 index d97bae9a05..0000000000 Binary files a/devices/hololens/images/wizard-steps.png and /dev/null differ diff --git a/devices/hololens/images/wsfb-private.png b/devices/hololens/images/wsfb-private.png deleted file mode 100644 index 35ce83829b..0000000000 Binary files a/devices/hololens/images/wsfb-private.png and /dev/null differ diff --git a/devices/hololens/index.md b/devices/hololens/index.md deleted file mode 100644 index 5aee70afdb..0000000000 --- a/devices/hololens/index.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Microsoft HoloLens (HoloLens) -description: Landing page for HoloLens commercial and enterprise management. -ms.prod: hololens -ms.sitesec: library -ms.assetid: 0947f5b3-8f0f-42f0-aa27-6d2cad51d040 -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: medium -ms.date: 07/14/2019 ---- - -# Microsoft HoloLens - - - -
          -

          Microsoft HoloLens is the first fully self-contained holographic computer running Windows 10.

          - -

          Now, with the introduction of HoloLens 2, every device provides commercial ready management enhanced by the reliability, security, and scalability of cloud and AI services from Microsoft.

          - -

          To learn more about HoloLens 2 for developers, check out the mixed reality developer documentation.

          - -
          HoloLens 2 side view
          - -## Guides in this section - -| Guide | Description | -| --- | --- | -| [Get started with HoloLens](hololens-setup.md) | Set up HoloLens for the first time. | -| [Deploy HoloLens in a commercial environment](hololens-requirements.md) | Configure HoloLens for scale enterprise deployment and ongoing device management. | -| [Install and manage applications on HoloLens](hololens-install-apps.md) |Install and manage important applications on HoloLens at scale. | -| [Recover and troubleshoot HoloLens issues](https://support.microsoft.com/products/hololens) | Learn how to gather logs from HoloLens, recover a misbehaving device, or reset HoloLens when necessary. | -| [Get support](https://support.microsoft.com/products/hololens) |Connect with Microsoft support resources for HoloLens in enterprise. | - -## Quick reference by topic - -| Topic | Description | -| --- | --- | -| [What's new in Microsoft HoloLens](hololens-whats-new.md) | Discover new features in the latest updates. | -| [Configure HoloLens using a provisioning package](hololens-provisioning.md) | Provisioning packages make it easy for IT administrators to configure HoloLens devices without imaging | -| [HoloLens MDM support](hololens-enroll-mdm.md) | Manage multiple HoloLens devices simultaneously using Mobile Device Management (MDM) solutions like Microsoft Intune. | -| [HoloLens update management](hololens-updates.md) | Use mobile device management (MDM) policies to configure settings for updates. | -| [HoloLens user management](hololens-multiple-users.md) | Multiple users can shared a HoloLens device by using their Azure Active Directory accounts. | -| [HoloLens application access management](hololens-kiosk.md) | Manage application access for different user groups. | -| [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | Learn how to use Bitlocker device encryption to protect files and information stored on the HoloLens. | -| [Install localized version of HoloLens](hololens-install-localized.md) | Configure HoloLens for different locale. | - -## Related resources - -* [Documentation for Holographic app development](https://developer.microsoft.com/windows/mixed-reality/development) -* [HoloLens Commercial Suite](https://www.microsoft.com/microsoft-hololens/hololens-commercial) -* [HoloLens release notes](https://developer.microsoft.com/en-us/windows/mixed-reality/release_notes) diff --git a/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md b/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md deleted file mode 100644 index 3254e13d6c..0000000000 --- a/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: General Data Privacy Regulation and Surface Hub -description: Informs users who are subject to EU data protection laws of their options regarding how to delete or restrict diagnostic data produced by Surface Hub. -ms.assetid: 087713CF-631D-477B-9CC6-EFF939DE0186 -ms.reviewer: -manager: -keywords: GDPR -ms.prod: surface-hub -ms.sitesec: library -author: Teresa-MOTIV -ms.author: v-tea -ms.topic: article -ms.localizationpriority: medium ---- - -# General Data Privacy Regulation and Surface Hub - -In May 2018, a European privacy law, the General Data Protection Regulation (GDPR), took effect. The GDPR imposes new rules on companies, government agencies, non-profits, and other organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents. - -Surface Hub customers concerned about privacy under the new GDPR regulations can manage their device privacy with the following options that are provided by Microsoft: - -* **Option 1:** Surface Hub devices in regions enforcing GDPR regulations will install KB4284830 when publicly available to automatically reduce diagnostic data emission to basic. Customers opting to provide a higher level of diagnostic data can use the Surface Hub Settings application or Mobile Device Management to override the default basic setting. - -* **Option 2:** Surface Hub customers who want to remove any existing diagnostic data can download the **Surface Hub Delete Diagnostic Data** application from the Microsoft Store. This app will allow customers to request deletion of associated diagnostic data directly from their Surface Hub device. - -Microsoft has extensive expertise in protecting data, championing privacy, and complying with complex regulations, and currently complies with both EU-U.S. Privacy Shield and EU Model Clauses. We believe that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We want to help you focus on your core business while efficiently preparing for the GDPR. - diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md deleted file mode 100644 index cc71b5adf8..0000000000 --- a/devices/surface-hub/TOC.md +++ /dev/null @@ -1,127 +0,0 @@ -# [Microsoft Surface Hub](index.md) - -# Surface Hub 2S - -## Overview -### [What's new in Surface Hub 2S for IT admins](surface-hub-2s-whats-new.md) -### [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) -### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md) -### [Adjust Surface Hub 2S brightness, volume, and input](surface-hub-2s-onscreen-display.md) - -## Plan -### [Surface Hub 2S Site Readiness Guide](surface-hub-2s-site-readiness-guide.md) -#### [Site planning for Surface Hub 2S](surface-hub-2s-site-planning.md) -#### [Surface Hub 2S quick start](surface-hub-2s-quick-start.md) -#### [Install and mount Surface Hub 2S](surface-hub-2s-install-mount.md) -#### [Customize wall mount of Surface Hub 2S](surface-hub-2s-custom-install.md) -#### [Setup worksheet](setup-worksheet-surface-hub.md) -#### [Surface Hub 2S ports and keypad overview](surface-hub-2s-port-keypad-overview.md) -#### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md) -### [Prepare your environment for Microsoft Surface Hub 2S](surface-hub-2s-prepare-environment.md) -### [Configure Easy Authentication for Surface Hub 2S](surface-hub-2s-phone-authenticate.md) - -## Deploy -### [First time setup for Surface Hub 2S](surface-hub-2s-setup.md) -### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md) -### [Surface Hub 2S deployment checklist](surface-hub-2s-deploy-checklist.md) -### [Surface Hub 2S adoption toolkit](surface-hub-2s-adoption-kit.md) -### [Create Surface Hub 2S device account](surface-hub-2s-account.md) -### [Create provisioning packages for Surface Hub 2S](surface-hub-2s-deploy.md) -### [Deploy apps to Surface Hub 2S using Intune](surface-hub-2s-deploy-apps-intune.md) -### [Create Surface Hub 2S on-premises accounts with PowerShell](surface-hub-2s-onprem-powershell.md) - -## Manage -### [Manage Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md) -### [Local management for Surface Hub 2S settings](local-management-surface-hub-settings.md) -### [Manage device account password rotation](surface-hub-2s-manage-passwords.md) -### [Manage Windows updates](manage-windows-updates-for-surface-hub.md) -### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) -### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) -### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) -### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md) - -## Secure -### [Secure and manage Surface Hub 2S with SEMM and UEFI](surface-hub-2s-secure-with-uefi-semm.md) -### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) - -## Support -### [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md) -### [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) -### [How to pack and ship your Surface Hub 2S for service](surface-hub-2s-pack-components.md) -### [Change history](surface-hub-2s-change-history.md) - -# Surface Hub -## Overview -### [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md) -### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md) - -## Plan -### [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md) -### [Surface Hub Site Readiness Guide](surface-hub-site-readiness-guide.md) -### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md) - -## Deploy -### [Create and test a device account](create-and-test-a-device-account-surface-hub.md) -#### [Online deployment](online-deployment-surface-hub-device-accounts.md) -#### [On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md) -#### [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) -#### [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) -#### [Online or hybrid deployment using Skype Hybrid Voice environment](skype-hybrid-voice.md) -#### [Create a device account using UI](create-a-device-account-using-office-365.md) -#### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) -#### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md) -#### [Password management](password-management-for-surface-hub-device-accounts.md) -#### [Create provisioning packages](provisioning-packages-for-surface-hub.md) -#### [Admin group management](admin-group-management-for-surface-hub.md) -### [Set up Microsoft Surface Hub](set-up-your-surface-hub.md) -#### [Setup worksheet](setup-worksheet-surface-hub.md) -#### [First-run program](first-run-program-surface-hub.md) - -## Manage -### [Manage Microsoft Surface Hub](manage-surface-hub.md) -### [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) -### [Remote Surface Hub management](remote-surface-hub-management.md) -#### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) -#### [Monitor your Surface Hub](monitor-surface-hub.md) -#### [Windows updates](manage-windows-updates-for-surface-hub.md) -### [Manage Surface Hub settings](manage-surface-hub-settings.md) -#### [Local management for Surface Hub settings](local-management-surface-hub-settings.md) -#### [Accessibility](accessibility-surface-hub.md) -#### [Change the Surface Hub device account](change-surface-hub-device-account.md) -#### [Device reset](device-reset-surface-hub.md) -#### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md) -#### [Wireless network management](wireless-network-management-for-surface-hub.md) -### [Implement Quality of Service on Surface Hub](surface-hub-qos.md) -### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) -### [Configure Surface Hub Start menu](surface-hub-start-menu.md) -### [Set up and use Microsoft Whiteboard](whiteboard-collaboration.md) -### [End a Surface Hub meeting with End session](i-am-done-finishing-your-surface-hub-meeting.md) -### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) -### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) -### [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) -### [Using a room control system](use-room-control-system-with-surface-hub.md) - -## Secure -### [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) -### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) -### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) - -## Support -### [Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) -### [Surface Hub SSD replacement](surface-hub-ssd-replacement.md) - -### [Top support solutions for Surface Hub](support-solutions-surface-hub.md) -### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md) -### [Surface Hub Update History](surface-hub-update-history.md) -### [Known issues and additional information about Microsoft Surface Hub](known-issues-and-additional-info-about-surface-hub.md) -### [How to use cloud recovery for BitLocker on a Surface Hub](use-cloud-recovery-for-bitlocker-on-surfacehub.md) -### [Using the Surface Hub Hardware Diagnostic Tool to test a device account](use-surface-hub-diagnostic-test-device-account.md) -### [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) -### [Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel](surfacehub-miracast-not-supported-europe-japan-israel.md) -### [What to do if the Connect app in Surface Hub exits unexpectedly](connect-app-in-surface-hub-unexpectedly-exits.md) -### [Surface Hub may install updates and restart outside maintenance hours](surface-hub-installs-updates-and-restarts-outside-maintenance-hours.md) -### [General Data Privacy Regulation and Surface Hub](general-data-privacy-regulation-and-surface-hub.md) -### [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) -### [Technical information for 55” Microsoft Surface Hub](surface-hub-technical-55.md) -### [Technical information for 84” Microsoft Surface Hub](surface-hub-technical-84.md) -### [Change history for Surface Hub](change-history-surface-hub.md) diff --git a/devices/surface-hub/accessibility-surface-hub.md b/devices/surface-hub/accessibility-surface-hub.md deleted file mode 100644 index 031501c2b4..0000000000 --- a/devices/surface-hub/accessibility-surface-hub.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Accessibility (Surface Hub) -description: Accessibility settings for the Microsoft Surface Hub can be changed by using the Settings app. You'll find them under Ease of Access. Your Surface Hub has the same accessibility options as Windows 10. -ms.assetid: 1D44723B-1162-4DF6-99A2-8A3F24443442 -ms.reviewer: -manager: dansimp -keywords: Accessibility settings, Settings app, Ease of Access -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Accessibility (Surface Hub) - -Microsoft Surface Hub has the same accessibility options as Windows 10. - - -## Default accessibility settings - -The full list of accessibility settings are available to IT admins in the **Settings** app. The default accessibility settings for Surface Hub include: - -| Accessibility feature | Default settings | -| --------------------- | ----------------- | -| Magnifier | Off | -| High contrast | No theme selected | -| Closed captions | Defaults selected for Font and Background and window | -| Keyboard | **On-screen Keyboard**, **Sticky Keys**, **Toggle Keys**, and **Filter Keys** are all off. | -| Mouse | Defaults selected for **Pointer size**, **Pointer color** and **Mouse keys**. | -| Other options | Defaults selected for **Visual options** and **Touch feedback**. | - -The accessibility feature Narrator is not available in the **Settings** app. By default, Narrator is turned off. To change the default settings for Narrator, perform the following steps using a keyboard and mouse. - -1. Dismiss the Welcome screen. -2. Open **Quick Actions** > **Ease of Access** from the status bar. - - ![Screenshot of Ease of Access tile](images/ease-of-access.png) - -3. Turn Narrator on. -4. Click **Task Switcher**. -5. Select **Narrator Settings** from Task Switcher. You can now edit the default Narrator settings. - -Additionally, these accessibility features and apps are returned to default settings when users press [End session](finishing-your-surface-hub-meeting.md): -- Narrator -- Magnifier -- High contrast -- Filter keys -- Sticky keys -- Toggle keys -- Mouse keys - - -## Change accessibility settings during a meeting - -During a meeting, users can toggle accessibility features and apps in a couple ways: -- [Keyboard shortcuts](https://support.microsoft.com/help/13813/windows-10-microsoft-surface-hub-keyboard-shortcuts) -- **Quick Actions** > **Ease of Access** from the status bar - -> ![Image showing Quick Action center on Surface Hub](images/sh-quick-action.png) - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) diff --git a/devices/surface-hub/admin-group-management-for-surface-hub.md b/devices/surface-hub/admin-group-management-for-surface-hub.md deleted file mode 100644 index 8125113887..0000000000 --- a/devices/surface-hub/admin-group-management-for-surface-hub.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Admin group management (Surface Hub) -description: Every Microsoft Surface Hub can be configured individually by opening the Settings app on the device. -ms.assetid: FA67209E-B355-4333-B903-482C4A3BDCCE -ms.reviewer: -manager: dansimp -keywords: admin group management, Settings app, configure Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Admin group management (Surface Hub) - - -Every Surface Hub can be configured locally using the Settings app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app. - - -## Admin Group Management - -You can set up administrator accounts for the device in one of three ways: - -- Create a local admin account -- Domain join the device to Active Directory (AD) -- Azure Active Directory (Azure AD) join the device - - -### Create a local admin account - -To create a local admin, [choose to use a local admin during first run](first-run-program-surface-hub.md#use-a-local-admin). This will create a single local admin account on the Surface Hub with the username and password of your choice. Use these credentials to open the Settings app. - -Note that the local admin account information is not backed by any directory service. We recommend you only choose a local admin if the device does not have access to Active Directory (AD) or Azure Active Directory (Azure AD). If you decide to change the local admin’s password, you can do so in Settings. However, if you want to change from using the local admin account to using a group from your domain or Azure AD tenant, then you’ll need to [reset the device](device-reset-surface-hub.md) and go through the first-time program again. - -### Domain join the device to Active Directory (AD) - -You can domain join the Surface Hub to your AD domain to allow users from a specified security group to configure settings. During first run, choose to use [Active Directory Domain Services](first-run-program-surface-hub.md#use-active-directory-domain-services). You'll need to provide credentials that are capable of joining the domain of your choice, and the name of an existing security group. Anyone who is a member of that security group can enter their credentials and unlock Settings. - -#### What happens when you domain join your Surface Hub? -Surface Hubs use domain join to: -- Grant admin rights to members of a specified security group in AD. -- Backup the device's BitLocker recovery key by storing it under the computer object in AD. See [Save your BitLocker key](save-bitlocker-key-surface-hub.md) for details. -- Synchronize the system clock with the domain controller for encrypted communication - -Surface Hub does not support applying group policies or certificates from the domain controller. - -> [!NOTE] -> If your Surface Hub loses trust with the domain (for example, if you remove the Surface Hub from the domain after it is domain joined), you won't be able to authenticate into the device and open up Settings. If you decide to remove the trust relationship of the Surface Hub with your domain, [reset the device](device-reset-surface-hub.md) first. - - -### Azure Active Directory (Azure AD) join the device - -You can Azure AD join the Surface Hub to allow IT pros from your Azure AD tenant to configure settings. During first run, choose to use [Microsoft Azure Active Directory](first-run-program-surface-hub.md#use-microsoft-azure-active-directory). You will need to provide credentials that are capable of joining the Azure AD tenant of your choice. After you successfully Azure AD join, the appropriate people will be granted admin rights on the device. - -By default, all **global administrators** will be given admin rights on an Azure AD joined Surface Hub. With **Azure AD Premium** or **Enterprise Mobility Suite (EMS)**, you can add additional administrators: -1. In the [Azure classic portal](https://manage.windowsazure.com/), click **Active Directory**, and then click the name of your organization's directory. -2. On the **Configure** page, under **Devices** > **Additional administrators on Azure AD joined devices**, click **Selected**. -3. Click **Add**, and select the users you want to add as administrators on your Surface Hub and other Azure AD joined devices. -4. When you have finished, click the checkmark button to save your change. - -#### What happens when you Azure AD join your Surface Hub? -Surface Hubs use Azure AD join to: -- Grant admin rights to the appropriate users in your Azure AD tenant. -- Backup the device's BitLocker recovery key by storing it under the account that was used to Azure AD join the device. See [Save your BitLocker key](save-bitlocker-key-surface-hub.md) for details. - -### Automatic enrollment via Azure Active Directory join - -Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory. - -For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment). - -### Which should I choose? - -If your organization is using AD or Azure AD, we recommend you either domain join or Azure AD join, primarily for security reasons. People will be able to authenticate and unlock Settings with their own credentials, and can be moved in or out of the security groups associated with your domain. - -| Option | Requirements | Which credentials can be used to access the Settings app? | -|---------------------------------------------------|-----------------------------------------|-------| -| Create a local admin account | None | The user name and password specified during first run | -| Domain join to Active Directory (AD) | Your organization uses AD | Any AD user from a specific security group in your domain | -| Azure Active Directory (Azure AD) join the device | Your organization uses Azure AD Basic | Global administrators only | -|   | Your organization uses Azure AD Premium or Enterprise Mobility Suite (EMS) | Global administrators and additional administrators | - - diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md deleted file mode 100644 index 00620b9f7c..0000000000 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ /dev/null @@ -1,1692 +0,0 @@ ---- -title: PowerShell for Surface Hub (Surface Hub) -description: PowerShell scripts to help set up and manage your Microsoft Surface Hub. -ms.assetid: 3EF48F63-8E4C-4D74-ACD5-461F1C653784 -ms.reviewer: -manager: dansimp -keywords: PowerShell, set up Surface Hub, manage Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/10/2018 -ms.localizationpriority: medium ---- - -# PowerShell for Surface Hub - - -PowerShell scripts to help set up and manage your Microsoft Surface Hub. - -- [PowerShell scripts for Surface Hub admins](#scripts-for-admins) - - [Create an on-premises account](#create-on-premises-ps-scripts) - - [Create a device account using Office 365](#create-os356-ps-scripts) - - [Account verification script](#acct-verification-ps-scripts) - - [Enable Skype for Business (EnableSfb.ps1)](#enable-sfb-ps-scripts) -- [Useful cmdlets](#useful-cmdlets) - - [Creating a Surface Hub-compatible Exchange ActiveSync policy](#create-compatible-as-policy) - - [Allowing device IDs for ActiveSync](#whitelisting-device-ids-cmdlet) - - [Auto-accepting and declining meeting requests](#auto-accept-meetings-cmdlet) - - [Accepting external meeting requests](#accept-ext-meetings-cmdlet) - - -## Prerequisites - -To successfully execute these PowerShell scripts, you will need to install the following prerequisites: - -- [Microsoft Online Services Sign-in Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950) -- [Microsoft Azure Active Directory Module for Windows PowerShell (64-bit version)](https://www.powershellgallery.com/packages/MSOnline/1.1.183.17) -- [Windows PowerShell Module for Skype for Business Online](https://www.microsoft.com/download/details.aspx?id=39366) - -## PowerShell scripts for Surface Hub administrators - - -What do the scripts do? - -- Create device accounts for setups using pure single-forest on-premises (Microsoft Exchange and Skype 2013 and later only) or online (Microsoft Office 365), that are configured correctly for your Surface Hub. -- Validate existing device accounts for any setup (on-premises or online) to make sure they're compatible with Surface Hub. -- Provide a base template for anyone wanting to create their own device account creation or validation scripts. - -What do you need in order to run the scripts? - -- Remote PowerShell access to your organization's domain or tenant, Exchange servers, and Skype for Business servers. -- Admin credentials for your organization's domain or tenant, Exchange servers, and Skype for Business servers. - ->[!NOTE] ->Whether you’re creating a new account or modifying an already-existing account, the validation script will verify that your device account is configured correctly. You should always run the validation script before adding a device account to Surface Hub. - -  - -## Running the scripts - - -The account creation scripts will: - -- Ask for administrator credentials -- Create device accounts in your domain/tenant -- Create or assign a Surface Hub-compatible ActiveSync policy to the device account(s) -- Set various attributes for the created account(s) in Exchange and Skype for Business. -- Assign licenses and permissions to the created account(s) - -These are the attributes that are set by the scripts: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CmdletAttributeValue

          Set-Mailbox

          RoomMailboxPassword

          User-provided

          EnableRoomMailboxAccount

          True

          Type

          Room

          Set-CalendarProcessing

          AutomateProcessing

          AutoAccept

          RemovePrivateProperty

          False

          DeleteSubject

          False

          DeleteComments

          False

          AddOrganizerToSubject

          False

          AddAdditionalResponse

          True

          AdditionalResponse

          "This is a Surface Hub room!"

          New-MobileDeviceMailboxPolicy

          PasswordEnabled

          False

          AllowNonProvisionableDevices

          True

          Enable-CSMeetingRoom

          RegistrarPool

          User-provided

          SipAddress

          Set to the User Principal Name (UPN) of the device account

          Set-MsolUserLicense (O365 only)

          AddLicenses

          User-provided

          Set-MsolUser (O365 only)

          PasswordNeverExpires

          True

          Set-AdUser (On-prem only)

          Enabled

          True

          Set-AdUser (On-prem only)

          PasswordNeverExpires

          True

          - -  - -## Account creation scripts - - -These scripts will create a device account for you. You can use the [Account verification script](#acct-verification-ps-scripts) to make sure they ran correctly. - -The account creation scripts cannot modify an already existing account, but can be used to help you understand which cmdlets need to be run to configure the existing account correctly. - -### Create an on-premises account - -Creates an account as described in [On-premises deployment](on-premises-deployment-surface-hub-device-accounts.md). - -```PowerShell -# SHAccountCreateOnPrem.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" -$status = @{} - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessExchange) - { - Remove-PSSession $sessExchange - } - if ($sessCS) - { - Remove-PSSession $sessCS - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor Red -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor Green -} - -function PrintAction($strMsg) -{ - Write-Host $strMsg -ForegroundColor Cyan -} - - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - -## Collect account data ## -$credNewAccount = (Get-Credential -Message "Enter the desired UPN and password for this new account") -$strUpn = $credNewAccount.UserName -$strDisplayName = Read-Host "Please enter the display name you would like to use for $strUpn" -if (!$credNewAccount -Or [System.String]::IsNullOrEmpty($strDisplayName) -Or [System.String]::IsNullOrEmpty($credNewAccount.UserName) -Or $credNewAccount.Password.Length -le 0) -{ - CleanupAndFail "Please enter all of the requested data to continue." - exit 1 -} - - -## Sign in to remote powershell for exchange and lync online ## - -$credExchange = $null -$credExchange=Get-Credential -Message "Enter credentials of an Exchange user with mailbox creation rights" -if (!$credExchange) -{ - CleanupAndFail("Valid credentials are required to create and prepare the account."); -} -$strExchangeServer = Read-Host "Please enter the FQDN of your exchange server (e.g. exch.contoso.com)" - -# Lync info -$credLync = Get-Credential -Message "Enter credentials of a Skype for Business admin (or cancel if they are the same as Exchange)" -if (!$credLync) -{ - $credLync = $credExchange -} -$strLyncFQDN = Read-Host "Please enter the FQDN of your Lync server (e.g. lync.contoso.com) or enter to use [$strExchangeServer]" -if ([System.String]::IsNullOrEmpty($strLyncFQDN)) -{ - $strLyncFQDN = $strExchangeServer -} - - -PrintAction "Connecting to remote sessions. This can occasionally take a while - please do not enter input..." -try -{ - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $credExchange -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue -} -catch -{ - CleanupAndFail("Failed to connect to exchange. Please check your credentials and try again. If this continues to fail, you may not have permission for remote powershell - if not, please perform the setup manually. Error message: $_") -} -PrintSuccess "Connected to Remote Exchange Shell" - -try -{ - $sessLync = New-PSSession -Credential $credLync -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue -} -catch -{ - CleanupAndFail("Failed to connect to Lync. Please check your credentials and try again. Error message: $_") -} -PrintSuccess "Connected to Lync Server Remote PowerShell" - - -Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue -Import-PSSession $sessLync -AllowClobber -WarningAction SilentlyContinue - -## Create the Exchange mailbox ## -# Note: These exchange commandlets do not always throw their errors as exceptions - -# Because Get-Mailbox will throw an error if the mailbox is not found -$Error.Clear() -PrintAction "Creating a new account..." -try -{ - $mailbox = $null - $mailbox = (New-Mailbox -UserPrincipalName $credNewAccount.UserName -Alias $credNewAccount.UserName.substring(0,$credNewAccount.UserName.indexOf('@')) -room -Name $strDisplayName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true) -} catch { } -ExitIfError "Failed to create a new mailbox on exchange."; -$status["Mailbox Setup"] = "Successfully created a mailbox for the new account" - - -$strEmail = $mailbox.WindowsEmailAddress -PrintSuccess "The following mailbox has been created for this room: $strEmail" - - -## Create or retrieve a policy that will be applied to surface hub devices ## -# The policy disables requiring a device password so that the SurfaceHub does not need to be lockable to use Active Sync -$strPolicy = Read-Host 'Please enter the name for a new Surface Hub ActiveSync policy that will be created and applied to this account. -We will configure that policy to be compatible with Surface Hub devices. -If this script has been used before, please enter the name of the existing policy.' - -$easpolicy = $null -try { - $easpolicy = Get-MobileDeviceMailboxPolicy $strPolicy -} -catch {} - -if ($easpolicy) -{ - if (!$easpolicy.PasswordEnabled -and ($easpolicy.AllowNonProvisionableDevices -eq $null -or $easpolicy.AllowNonProvisionableDevices )) - { - PrintSuccess "An existing policy has been found and will be applied to this account." - } - else - { - PrintError "The policy you provided is incompatible with the surface hub." - $easpolicy = $null - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account because the policy was invalid." - } -} -else -{ - $Error.Clear() - PrintAction "Creating policy..." - $easpolicy = New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false -AllowNonProvisionableDevices $true - if ($easpolicy) - { - PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts." - } - else - { - PrintError "Could not create $strPolicy" - } -} - -if ($easpolicy) -{ - # Convert mailbox to user type so we can apply the policy (necessary) - # Sometimes it takes a while for this change to take affect so we have some nasty retry loops - $Error.Clear(); - try - { - Set-Mailbox $credNewAccount.UserName -Type Regular - } catch {} - if ($Error) - { - $Error.Clear() - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - } - else - { - # Loop until resource type goes away, up to 5 times - for ($i = 0; $i -lt 5 -And (Get-Mailbox $credNewAccount.UserName).ResourceType; $i++) - { - Start-Sleep -s 5 - } - # If the mailbox is still a Room we cannot apply the policy - if (!((Get-Mailbox $credNewAccount.UserName).ResourceType)) - { - $Error.Clear() - # Set policy for account - Set-CASMailbox $credNewAccount.UserName -ActiveSyncMailboxPolicy $strPolicy - if (!$Error) - { - $status["ActiveSync Policy"] = "Successfully applied $strPolicy to the account" - } - else - { - $status["ActiveSync Policy"] = "Failed to apply the EAS policy to the account." - } - $Error.Clear() - - # Convert back to room mailbox - Set-Mailbox $credNewAccount.UserName -Type Room - # Loop until resource type goes back to room - for ($i = 0; ($i -lt 5) -And ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room"); $i++) - { - Start-Sleep -s 5 - } - if ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room") - { - # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable. - $status["Mailbox Setup"] = "A mailbox was created but we could not set it to a room resource type." - } - else - { - try - { - Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - } catch { } - if ($Error) - { - $status["Mailbox Setup"] = "A room mailbox was created but we could not set its password." - } - $Error.Clear() - } - - } - } -} -PrintSuccess "Account creation completed." - -PrintAction "Setting calendar processing rules..." - -$Error.Clear(); -## Prepare the calendar for automatic meeting responses ## -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -AutomateProcessing AutoAccept -} catch { } -if ($Error) -{ - $status["Calendar Acceptance"] = "Failed to configure the account to automatically accept/decline meeting requests" -} -else -{ - $status["Calendar Acceptance"] = "Successfully configured the account to automatically accept/decline meeting requests" -} - - -$Error.Clear() -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -RemovePrivateProperty $false -AddOrganizerToSubject $false -AddAdditionalResponse $true -DeleteSubject $false -DeleteComments $false -AdditionalResponse "This is a Surface Hub room!" -} catch { } -if ($Error) -{ - $status["Calendar Response Configuration"] = "Failed to configure the account's response properties" -} -else -{ - $status["Calendar Response Configuration"] = "Successfully configured the account's response properties" -} - -$Error.Clear() -## Configure the Account to not expire ## -PrintAction "Configuring password not to expire..." -Start-Sleep -s 20 -try -{ - Set-AdUser $mailbox.UserPrincipalName -PasswordNeverExpires $true -Enabled $true -} -catch -{ - -} - -if ($Error) -{ - $status["Password Expiration Policy"] = "Failed to set the password to never expire" -} -else -{ - $status["Password Expiration Policy"] = "Successfully set the password to never expire" -} - -PrintSuccess "Completed Exchange configuration" - -## Setup Skype for Business. This is somewhat optional and if it fails we SfbEnable can be used later ## -PrintAction "Configuring account for Skype for Business." - -# Getting registrar pool -$strRegPool = $strLyncFQDN -$Error.Clear() -$strRegPoolEntry = Read-Host "Enter a Skype for Business Registrar Pool, or leave blank to use [$strRegPool]" -if (![System.String]::IsNullOrEmpty($strRegPoolEntry)) -{ - $strRegPool = $strRegPoolEntry -} - -# Try to SfB-enable the account. Note that it may not work right away as the account needs to propagate to active directory -PrintAction "Enabling Skype for Business..." -Start-Sleep -s 10 -$Error.Clear() -try { - Enable-CsMeetingRoom -Identity $credNewAccount.UserName -RegistrarPool $strRegPool -SipAddressType EmailAddress -} -catch { } - -if ($Error) -{ - $status["Skype for Business Account Setup"] = "Failed to setup the Skype for Business meeting room - you can run EnableSfb.ps1 to try again." - $Error.Clear(); -} -else -{ - $status["Skype for Business Account Setup"] = "Successfully enabled account as a Skype for Business meeting room" -} - -Write-Host - -## Cleanup and print results ## -Cleanup -$strDisplay = $mailbox.DisplayName -$strUsr = $credNewAccount.UserName -PrintAction "Summary for creation of $strUsr ($strDisplay)" -if ($status.Count -gt 0) -{ - ForEach($k in $status.Keys) - { - $v = $status[$k] - $color = "yellow" - if ($v[0] -eq "S") { $color = "green" } - elseif ($v[0] -eq "F") - { - $color = "red" - $v += " Go to https://aka.ms/shubtshoot" - } - - Write-Host -NoNewline $k -ForegroundColor $color - Write-Host -NoNewline ": " - Write-Host $v - } -} -else -{ - PrintError "The account could not be created" -} -``` - -### Create a device account using Office 365 - -Creates an account as described in [Create a device account using Office 365](create-a-device-account-using-office-365.md) - -```PowerShell -# SHAccountCreateO365.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" -$status = @{} - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessExchange) - { - Remove-PSSession $sessExchange - } - if ($sessCS) - { - Remove-PSSession $sessCS - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor Red -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor Green -} - -function PrintAction($strMsg) -{ - Write-Host $strMsg -ForegroundColor Cyan -} - - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - - -## Check dependencies ## -try { - Import-Module LyncOnlineConnector - Import-Module MSOnline -} -catch -{ - PrintError "Some dependencies are missing" - PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366" - PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" - CleanupAndFail -} - - - -## Collect account data ## -$credNewAccount = (Get-Credential -Message "Enter the desired UPN and password for this new account") -$strUpn = $credNewAccount.UserName -$strDisplayName = Read-Host "Please enter the display name you would like to use for $strUpn" -if (!$credNewAccount -Or [System.String]::IsNullOrEmpty($strDisplayName) -Or [System.String]::IsNullOrEmpty($credNewAccount.UserName) -Or $credNewAccount.Password.Length -le 0) -{ - CleanupAndFail "Please enter all of the requested data to continue." - exit 1 -} - - -## Sign in to remote powershell for exchange and lync online ## -$credAdmin = $null -$credAdmin=Get-Credential -Message "Enter credentials of an Exchange and Skype for Business admin" -if (!$credadmin) -{ - CleanupAndFail "Valid admin credentials are required to create and prepare the account." -} -PrintAction "Connecting to remote sessions. This can occasionally take a while - please do not enter input..." -try -{ - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $credAdmin -AllowRedirection -Authentication basic -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -WarningAction SilentlyContinue -} -catch -{ - CleanupAndFail "Failed to connect to exchange. Please check your credentials and try again. Error message: $_" -} - -try -{ - $sessCS = New-CsOnlineSession -Credential $credAdmin -} -catch -{ - CleanupAndFail "Failed to connect to Skype for Business Online Datacenter. Please check your credentials and try again. Error message: $_" -} - -try -{ - Connect-MsolService -Credential $credAdmin -} -catch -{ - CleanupAndFail "Failed to connect to Azure Active Directory. Please check your credentials and try again. Error message: $_" -} - -Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue -Import-PSSession $sessCS -AllowClobber -WarningAction SilentlyContinue - -## Create the Exchange mailbox ## -# Note: These exchange commandlets do not always throw their errors as exceptions - -# Because Get-Mailbox will throw an error if the mailbox is not found -$Error.Clear() -PrintAction "Creating a new account..." -try -{ - $mailbox = $null - $mailbox = (New-Mailbox -MicrosoftOnlineServicesID $credNewAccount.UserName -room -Name $strDisplayName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true) -} catch { } -ExitIfError "Failed to create a new mailbox on exchange."; -$status["Mailbox Setup"] = "Successfully created a mailbox for the new account" - - -$strEmail = $mailbox.WindowsEmailAddress -PrintSuccess "The following mailbox has been created for this room: $strEmail" - - -## Create or retrieve a policy that will be applied to surface hub devices ## -# The policy disables requiring a device password so that the SurfaceHub does not need to be lockable to use Active Sync -$strPolicy = Read-Host 'Please enter the name for a new Surface Hub ActiveSync policy that will be created and applied to this account. -We will configure that policy to be compatible with Surface Hub devices. -If this script has been used before, please enter the name of the existing policy.' - -$easpolicy = $null -try { - $easpolicy = Get-MobileDeviceMailboxPolicy $strPolicy -} -catch {} - -if ($easpolicy) -{ - if (!$easpolicy.PasswordEnabled -and ($easpolicy.AllowNonProvisionableDevices -eq $null -or $easpolicy.AllowNonProvisionableDevices )) - { - PrintSuccess "An existing policy has been found and will be applied to this account." - } - else - { - PrintError "The policy you provided is incompatible with the surface hub." - $easpolicy = $null - $status["ActiveSync Policy"] = "Failed to apply the EAS policy to the account because the policy was invalid." - } -} -else -{ - $Error.Clear() - PrintAction "Creating policy..." - $easpolicy = New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false -AllowNonProvisionableDevices $true - if ($easpolicy) - { - PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts." - } - else - { - PrintError "Could not create $strPolicy" - } -} - -if ($easpolicy) -{ - # Convert mailbox to user type so we can apply the policy (necessary) - # Sometimes it takes a while for this change to take affect so we have some nasty retry loops - $Error.Clear(); - try - { - Set-Mailbox $credNewAccount.UserName -Type Regular - } catch {} - if ($Error) - { - $Error.Clear() - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - PrintError "Failed to convert to regular account" - } - else - { - # Loop until resource type goes away, up to 5 times - for ($i = 0; $i -lt 5 -And (Get-Mailbox $credNewAccount.UserName).ResourceType; $i++) - { - Start-Sleep -s 5 - } - # If the mailbox is still a Room we cannot apply the policy - if (!((Get-Mailbox $credNewAccount.UserName).ResourceType)) - { - $Error.Clear() - # Set policy for account - Set-CASMailbox $credNewAccount.UserName -ActiveSyncMailboxPolicy $strPolicy - if (!$Error) - { - $status["Device Password Policy"] = "Successfully applied $strPolicy to the account" - } - else - { - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - PrintError "Failed to apply policy" - } - $Error.Clear() - - # Convert back to room mailbox - Set-Mailbox $credNewAccount.UserName -Type Room - # Loop until resource type goes back to room - for ($i = 0; ($i -lt 5) -And ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room"); $i++) - { - Start-Sleep -s 5 - } - if ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room") - { - # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable. - $status["Mailbox Setup"] = "A mailbox was created but we could not set it to a room resource type." - } - else - { - Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - if ($Error) - { - $status["Mailbox Setup"] = "A room mailbox was created but we could not set its password." - } - $Error.Clear() - } - - } - } -} -else -{ - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - PrintError "Failed to obtain policy" -} -PrintSuccess "Account creation completed." - -PrintAction "Setting calendar processing rules..." - -$Error.Clear(); -## Prepare the calendar for automatic meeting responses ## -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -AutomateProcessing AutoAccept -} catch { } -if ($Error) -{ - $status["Calendar Acceptance"] = "Failed to configure the account to automatically accept/decline meeting requests" -} -else -{ - $status["Calendar Acceptance"] = "Successfully configured the account to automatically accept/decline meeting requests" -} - - -$Error.Clear() -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -RemovePrivateProperty $false -AddOrganizerToSubject $false -AddAdditionalResponse $true -DeleteSubject $false -DeleteComments $false -AdditionalResponse "This is a Surface Hub room!" -} catch { } -if ($Error) -{ - $status["Calendar Response Configuration"] = "Failed to configure the account's response properties" -} -else -{ - $status["Calendar Response Configuration"] = "Successfully configured the account's response properties" -} - -$Error.Clear() -## Configure the Account to not expire ## -PrintAction "Configuring password not to expire..." -try -{ - Set-MsolUser -UserPrincipalName $credNewAccount.UserName -PasswordNeverExpires $true -} -catch -{ - -} - -if ($Error) -{ - $status["Password Expiration Policy"] = "Failed to set the password to never expire" -} -else -{ - $status["Password Expiration Policy"] = "Successfully set the password to never expire" -} - -PrintSuccess "Completed Exchange configuration" - -## Setup Skype for Business. This is somewhat optional and if it fails we SfbEnable can be used later ## -PrintAction "Configuring account for Skype for Business." - -# Getting registrar pool -$strRegPool = $null -try { - $strRegPool = (Get-CsTenant).TenantPoolExtension -} -catch {} -$Error.Clear() -if (![System.String]::IsNullOrEmpty($strRegPool)) -{ - $strRegPool = $strRegPool.Substring($strRegPool[0].IndexOf(':') + 1) -} -<# -$strRegPoolEntry = Read-Host "Enter a Skype for Business Registrar Pool, or leave blank to use [$strRegPool]" -if (![System.String]::IsNullOrEmpty($strRegPoolEntry)) -{ - $strRegPool = $strRegPoolEntry -} -#> - -# Try to SfB-enable the account. Note that it may not work right away as the account needs to propagate to active directory -PrintAction "Enabling Skype for Business on $strRegPool" -Start-Sleep -s 10 -$Error.Clear() -try { - Enable-CsMeetingRoom -Identity $credNewAccount.UserName -RegistrarPool $strRegPool -SipAddressType EmailAddress -} -catch { } - -if ($Error) -{ - $status["Skype for Business Account Setup"] = "Failed to setup the Skype for Business meeting room - you can run EnableSfb.ps1 to try again." - $Error.Clear(); -} -else -{ - $status["Skype for Business Account Setup"] = "Successfully enabled account as a Skype for Business meeting room" -} - -## Now we need to assign a Skype for Business license to the account ## -# Assign a license to thes -$countryCode = (Get-CsTenant).CountryAbbreviation -$loc = Read-Host "Please enter the usage location for this device account (where the account is being used). This is a 2-character code that is used to assign licenses (e.g. $countryCode)" -try { - $Error.Clear() - Set-MsolUser -UserPrincipalName $credNewAccount.UserName -UsageLocation $loc -} -catch{} -if ($Error) -{ - $status["Office 365 License"] = "Failed to assign an Office 365 license to the account" - $Error.Clear() -} -else -{ - PrintAction "We found the following licenses available for your tenant:" - $skus = (Get-MsolAccountSku | Where-Object { !$_.AccountSkuID.Contains("INTUNE"); }) - $i = 1 - $skus | % { - Write-Host -NoNewline $i - Write-Host -NoNewLine ": AccountSKUID: " - Write-Host -NoNewLine $_.AccountSkuid - Write-Host -NoNewLine " Active Units: " - Write-Host -NoNewLine $_.ActiveUnits - Write-Host -NoNewLine " Consumed Units: " - Write-Host $_.ConsumedUnits - $i++ - } - $iLicenseIndex = 0; - do - { - $iLicenseIndex = Read-Host 'Choose the number for the SKU you want to pick' - } while ($iLicenseIndex -lt 1 -or $iLicenseIndex -gt $skus.Length) - $strLicenses = $skus[$iLicenseIndex - 1].AccountSkuId - - if (![System.String]::IsNullOrEmpty($strLicenses)) - { - try - { - $Error.Clear() - Set-MsolUserLicense -UserPrincipalName $credNewAccount.UserName -AddLicenses $strLicenses - } - catch - { - - } - if ($Error) - { - $Error.Clear() - $status["Office 365 License"] = "Failed to add a license to the account. Make sure you have remaining licenses." - } - else - { - $status["Office 365 License"] = "Successfully added license to the account" - } - } - else - { - $status["Office 365 License"] = "You opted not to install a license on this account" - } -} - - -Write-Host - -## Cleanup and print results ## -Cleanup -$strDisplay = $mailbox.DisplayName -$strUsr = $credNewAccount.UserName -PrintAction "Summary for creation of $strUsr ($strDisplay)" -if ($status.Count -gt 0) -{ - ForEach($k in $status.Keys) - { - $v = $status[$k] - $color = "yellow" - if ($v[0] -eq "S") { $color = "green" } - elseif ($v[0] -eq "F") - { - $color = "red" - $v += " Go to https://aka.ms/shubtshoot for help" - } - - Write-Host -NoNewline $k -ForegroundColor $color - Write-Host -NoNewline ": " - Write-Host $v - } -} -else -{ - PrintError "The account could not be created" -} -``` - -## Account verification script - - -This script will validate the previously-created device account on a Surface Hub, no matter which method was used to create it. This script is basically pass/fail. If one of the test errors out, it will show a detailed error message, but if all tests pass, the end result will be a summary report. For example, you might see: - -``` syntax -15 tests executed -0 failures -2 warnings -15 passed -``` - -Details of specific settings will not be shown. - -```PowerShell -# SHAccountValidate.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" - - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessEx) - { - Remove-PSSession $sessEx - } - if ($sessSfb) - { - Remove-PSSession $sessSfb - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor "red" -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor "green" -} - -function PrintAction($strMsg) -{ - Write-Host $strMsg -ForegroundColor Cyan -} - - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - -$strUpn = Read-Host "What is the email address of the account you wish to validate?" -if (!$strUpn.Contains('@')) -{ - CleanupAndFail "$strUpn is not a valid email address" -} -$strExServer = Read-Host "What is your exchange server? (leave blank for online tenants)" -if ($strExServer.Equals("")) -{ - $fExIsOnline = $true -} -else -{ - $fExIsOnline = $false -} -$credEx = Get-Credential -Message "Please provide exchange user credentials" - -$strRegistrarPool = Read-Host ("What is the Skype for Business registrar pool for $strUpn" + "? (leave blank for online tenants)") -$fSfbIsOnline = $strRegistrarPool.Equals("") - -$fHasOnPrem = $true -if ($fSfbIsOnline -and $fExIsOnline) -{ - do - { - $strHasOnPrem = (Read-Host "Do you have an on-premises Active Directory (Y/N) (No if your domain services are hosted entirely online)").ToUpper() - } while ($strHasOnPrem -ne "Y" -and $strHasOnPrem -ne "N") - $fHasOnPrem = $strHasOnPrem.Equals("Y") -} - -$fHasOnline = $false -if ($fSfbIsOnline -or $fExIsOnline) -{ - $fHasOnline = $true -} - -if ($fSfbIsOnline) -{ - try { - Import-Module LyncOnlineConnector - } - catch - { - CleanupAndFail "To verify Skype for Business in online tenants you need the Lync Online Connector module from http://www.microsoft.com/download/details.aspx?id=39366" - } -} -else -{ - $credSfb = (Get-Credential -Message "Please enter Skype for Business admin credentials") -} - -if ($fHasOnline) -{ - $credSfb = $credEx - try { - Import-Module MSOnline - } - catch - { - CleanupAndFail "To verify accounts in online tenants you need the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" - } -} - -PrintAction "Connecting to Exchange Powershell Session..." -[System.Management.Automation.Runspaces.AuthenticationMechanism] $authType = [System.Management.Automation.Runspaces.AuthenticationMechanism]::Kerberos -if ($fExIsOnline) -{ - $authType = [System.Management.Automation.Runspaces.AuthenticationMechanism]::Basic -} -try -{ - $sessEx = $null - if ($fExIsOnline) - { - $sessEx = New-PSSession -ConfigurationName microsoft.exchange -Credential $credEx -AllowRedirection -Authentication $authType -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -WarningAction SilentlyContinue - } - else - { - $sessEx = New-PSSession -ConfigurationName microsoft.exchange -Credential $credEx -AllowRedirection -Authentication $authType -ConnectionUri https://$strExServer/powershell -WarningAction SilentlyContinue - } -} -catch -{ -} - -if (!$sessEx) -{ - CleanupAndFail "Connecting to Exchange Powershell failed, please validate your server is accessible and credentials are correct" -} - -PrintSuccess "Connected to Exchange Powershell Session" - -PrintAction "Connecting to Skype for Business Powershell Session..." - -if ($fSfbIsOnline) -{ - $sessSfb = New-CsOnlineSession -Credential $credSfb -} -else -{ - $sessSfb = New-PSSession -Credential $credSfb -ConnectionURI "https://$strRegistrarPool/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue -} - -if (!$sessSfb) -{ - CleanupAndFail "Connecting to Skype for Business Powershell failed, please validate your server is accessible and credentials are correct" -} - -PrintSuccess "Connected to Skype for Business Powershell" - -if ($fHasOnline) -{ - $credMsol = $null - if ($fExIsOnline) - { - $credMsol = $credEx - } - elseif ($fSfbIsOnline) - { - $credMsol = $credSfb - } - else - { - CleanupAndFail "Internal error - could not determine MS Online credentials" - } - try - { - PrintAction "Connecting to Azure Active Directory Services..." - Connect-MsolService -Credential $credMsol - PrintSuccess "Connected to Azure Active Directory Services" - } - catch - { - # This really shouldn't happen unless there is a network error - CleanupAndFail "Failed to connect to MSOnline" - } -} - - -PrintAction "Importing remote sessions into the local session..." -try -{ - $importEx = Import-PSSession $sessEx -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking - $importSfb = Import-PSSession $sessSfb -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking -} -catch -{ -} -if (!$importEx -or !$importSfb) -{ - CleanupAndFail "Import failed" -} -PrintSuccess "Import successful" - - -$mailbox = $null -try -{ - $mailbox = Get-Mailbox -Identity $strUpn -} -catch -{ -} - -if (!$mailbox) -{ - CleanupAndFail "Account exists check failed. Unable to find the mailbox for $strUpn - please make sure the Exchange account exists on $strExServer" -} - -$exchange = $null -if (!$fExIsOnline) -{ - $exchange = Get-ExchangeServer - if (!$exchange -or !$exchange.IsE14OrLater) - { - CleanupAndFail "A compatible exchange server version was not found. Please use at least exchange 2010." - } -} - - -$strAlias = $mailbox.UserPrincipalName -$strDisplayName = $mailbox.DisplayName - -$strLinkedAccount = $strLinkedDomain = $strLinkedUser = $strLinkedServer = $null -$credLinkedDomain = $Null -if (!$fExIsOnline -and ![System.String]::IsNullOrEmpty($mailbox.LinkedMasterAccount) -and !$mailbox.LinkedMasterAccount.EndsWith("\SELF")) -{ - $strLinkedAccount = $mailbox.LinkedMasterAccount - $strLinkedDomain = $strLinkedAccount.substring(0,$strLinkedAccount.IndexOf('\')) - $strLinkedUser = $strLinkedAccount.substring($strLinkedAccount.IndexOf('\') + 1) - $strLinkedServer = Read-Host "What is the domain controller for the $strLinkedDomain" - $credLinkedDomain = (Get-Credential -Message "Please provide credentials for $strLinkedDomain") -} - - - - - - - -Write-Host -Write-Host -Write-Host -PrintAction "Performing verification checks on $strDisplayName..." -$Global:iTotalFailures = 0 -$global:iTotalWarnings = 0 -$Global:iTotalPasses = 0 - -function Validate() -{ - Param( - [string]$Test, - [bool] $Condition, - [string]$FailureMsg, - [switch]$WarningOnly - ) - - Write-Host -NoNewline -ForegroundColor White $Test.PadRight(100,'.') - if ($Condition) - { - Write-Host -ForegroundColor Green "Passed" - $global:iTotalPasses++ - } - else - { - if ($WarningOnly) - { - Write-Host -ForegroundColor Yellow ("Warning: "+$FailureMsg) - $global:iTotalWarnings++ - } - else - { - Write-Host -ForegroundColor Red ("Failed: "+$FailureMsg) - $global:iTotalFailures++ - } - } -} - -## Exchange ## - -Validate -WarningOnly -Test "The mailbox $strUpn is enabled as a room account" -Condition ($mailbox.RoomMailboxAccountEnabled -eq $True) -FailureMsg "RoomMailboxEnabled - without a device account, the Surface Hub will not be able to use various key features." -$calendarProcessing = Get-CalendarProcessing -Identity $strUpn -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -Validate -Test "The mailbox $strUpn is configured to accept meeting requests" -Condition ($calendarProcessing -ne $null -and $calendarProcessing.AutomateProcessing -eq 'AutoAccept') -FailureMsg "AutomateProcessing - the Surface Hub will not be able to send mail or sync its calendar." -Validate -WarningOnly -Test "The mailbox $strUpn will not delete meeting comments" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.DeleteComments) -FailureMsg "DeleteComments - the Surface Hub may be missing some meeting information on the welcome screen and Skype." -Validate -WarningOnly -Test "The mailbox $strUpn keeps private meetings private" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.RemovePrivateProperty) -FailureMsg "RemovePrivateProperty - the Surface Hub will make show private meetings." -Validate -Test "The mailbox $strUpn keeps meeting subjects" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.DeleteSubject) -FailureMsg "DeleteSubject - the Surface Hub will not keep meeting subject information." -Validate -WarningOnly -Test "The mailbox $strUpn does not prepend meeting organizers to subjects" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.AddOrganizerToSubject) -FailureMsg "AddOrganizerToSubject - the Surface Hub will not display meeting subjects as intended." - -if ($fExIsOnline) -{ - #No online specifics -} -else -{ - #No onprem specifics -} - -#ActiveSync -$casMailbox = Get-Casmailbox $strUpn -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -Validate -Test "The mailbox $strUpn has a mailbox policy" -Condition ($casMailbox -ne $null) -FailureMsg "PasswordEnabled - unable to find policy - the Surface Hub will not be able to send mail or sync its calendar." -if ($casMailbox) -{ - $policy = $null - if ($fExIsOnline -or $exchange.IsE15OrLater) - { - $strPolicy = $casMailbox.ActiveSyncMailboxPolicy - $policy = Get-MobileDeviceMailboxPolicy -Identity $strPolicy -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - Validate -Test "The policy $strPolicy does not require a device password" -Condition ($policy.PasswordEnabled -ne $True) -FailureMsg "PasswordEnabled - policy requires a device password - the Surface Hub will not be able to send mail or sync its calendar." - } - else - { - $strPolicy = $casMailbox.ActiveSyncMailboxPolicy - $policy = Get-ActiveSyncMailboxPolicy -Identity $strPolicy -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - Validate -Test "The policy $strPolicy does not require a device password" -Condition ($policy.PasswordEnabled -ne $True) -FailureMsg "PasswordEnabled - policy requires a device password - the Surface Hub will not be able to send mail or sync its calendar." - } - - if ($policy -ne $null) - { - Validate -Test "The policy $strPolicy allows non-provisionable devices" -Condition ($policy.AllowNonProvisionableDevices -eq $null -or $policy.AllowNonProvisionableDevices -eq $true) -FailureMsg "AllowNonProvisionableDevices - policy will not allow the SurfaceHub to sync" - } - -} - - -# Check the default access level -$orgSettings = Get-ActiveSyncOrganizationSettings -$strDefaultAccessLevel = $orgSettings.DefaultAccessLevel -Validate -Test "ActiveSync devices are allowed" -Condition ($strDefaultAccessLevel -eq 'Allow') -FailureMsg "DeviceType Windows Mail is accessible - devices are not allowed by default - the surface hub will not be able to send mail or sync its calendar." - -# Check if there exists a device access rule that bans the device type Windows Mail -$blockingRules = Get-ActiveSyncDeviceAccessRule | where {($_.AccessLevel -eq 'Block' -or $_.AccessLevel -eq 'Quarantine') -and $_.Characteristic -eq 'DeviceType'-and $_.QueryString -eq 'WindowsMail'} -Validate -Test "Windows mail devices are not blocked or quarantined" -Condition ($blockingRules -eq $null -or $blockingRules.Length -eq 0) -FailureMsg "DeviceType Windows Mail is accessible - devices are blocked or quarantined - the surface hub will not be able to send mail or sync its calendar." - -## End Exchange ## - - - -## SfB ## -$strLyncIdentity = $null -if ($fSfbIsOnline) -{ - $strLyncIdentity = $strUpn -} -else -{ - $strLyncIdentity = $strAlias -} - -$lyncAccount = $null -try { - $lyncAccount = Get-CsMeetingRoom -Identity $strLyncIdentity -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -} catch { - try { - $lyncAccount = Get-CsUser -Identity $strLyncIdentity -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - } catch { } -} -Validate -Test "There is a Lync or Skype for Business account for $strLyncIdentity" -Condition ($lyncAccount -ne $null -and $lyncAccount.Enabled) -FailureMsg "SfB Enabled - there is no Skype for Business account - meetings will not support Skype for Business" -if ($lyncAccount) -{ - Validate -Test "The meeting room has a SIP address" -Condition (![System.String]::IsNullOrEmpty($lyncAccount.SipAddress)) -FailureMsg "SfB Enabled - there is no SIP Address - the device account cannot be used to sign into Skype for Business." -} -## End SFB ## - - -if ($fHasOnline) -{ - #License validation and password expiry - $accountOnline = Get-MsolUser -UserPrincipalName $strUpn -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - Validate -Test "There is an online user account for $strUpn" -Condition ($accountOnline -ne $null) -FailureMsg "Could not find a Microsoft Online account for this user even though some services are online" - if ($accountOnline) - { - Validate -Test "The password for $strUpn will not expire" -Condition ($accountOnline.PasswordNeverExpires -eq $True) -FailureMsg "PasswordNeverExpires - the admin will need to update the device account's password on the Surface Hub when it expires." - if ($fIsSfbOnline -and !$fIsExOnline) - { - $strLicenseFailureMsg = "Has O365 license - The devices will not be able to use Skype for Business services." - } - elseif ($fIsExOnline -and !$fIsSfbOnline) - { - $strLicenseFailureMsg = "Has O365 license - The devices will not be able to use Exchange Online services." - } - else - { - $strLicenseFailureMsg = "Has O365 license - The devices will not be able to use Skype for Business or Exchange Online services." - } - Validate -Test "$strUpn is licensed" -Condition ($accountOnline.IsLicensed -eq $True) -FailureMsg $strLicenseFailureMsg - - Validate -Test "$strUpn is allowed to sign in" -Condition ($accountOnline.BlockCredential -ne $True) -FailureMsg "BlockCredential - This user is not allowed to sign in." - } -} - -#If there is an on-prem component, we can get the authoritative AD user from mailbox -if ($fHasOnPrem) -{ - $accountOnPrem = $null - if ($strLinkedAccount) - { - $accountOnPrem = Get-AdUser $strLinkedUser -server $strLinkedServer -credential $credLinkedDomain -properties PasswordNeverExpires -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - } - else - { - #AD User enabled validation - $accountOnPrem = Get-AdUser $mailbox.UserPrincipalName -properties PasswordNeverExpires -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - } - $strOnPremUpn = $accountOnPrem.UserPrincipalName - Validate -Test "There is a user account for $strOnPremUpn" -Condition ($accountOnprem -ne $null) -FailureMsg "Could not find an Active Directory account for this user" - if ($accountOnPrem) - { - Validate -WarningOnly -Test "The password for $strOnPremUpn will not expire" -Condition ($accountOnprem.PasswordNeverExpires -eq $True) -FailureMsg "PasswordNeverExpires - the admin will need to update the device account's password on the Surface Hub when it expires." - Validate -Test "$strOnPremUpn is enabled" -Condition $accountOnPrem.Enabled -FailureMsg "AccountEnabled - this device account will not sign in" - } -} - - -$global:iTotalTests = ($global:iTotalFailures + $global:iTotalPasses + $global:iTotalWarnings) - -Write-Host -NoNewline $global:iTotalTests "tests executed: " -Write-Host -NoNewline -ForegroundColor Red $Global:iTotalFailures "failures " -Write-Host -NoNewline -ForegroundColor Yellow $Global:iTotalWarnings "warnings " -Write-Host -ForegroundColor Green $Global:iTotalPasses "passes " - -Cleanup -``` - -## Enable Skype for Business - - -This script will enable Skype for Business on a device account. Use it only if Skype for Business wasn't previously enabled during account creation. - -```PowerShell -## This script performs only the Enable for Skype for Business step on an account. It should only be run if this step failed in SHAccountCreate and the other steps have been completed ## -# EnableSfb.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessCS) - { - Remove-PSSession $sessCS - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor "red" -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor "green" -} - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - -## Check dependencies ## - -$input = Read-Host "Is the account you wish to enable part of an online environment (enter O) or on-premises environment (enter P)" -if ($input -eq "P") -{ - $online = $false -} -elseif ($input -eq "O") -{ - $online = $true -} -else -{ - CleanupAndFail "Invalid selection" -} -if ($online) -{ - try { - Import-Module LyncOnlineConnector - } - catch - { - PrintError "Some dependencies are missing" - PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366" - PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" - CleanupAndFail - } -} -else -{ - $strRegPool = Read-Host "Enter the FQDN of your Skype for Business Registrar Pool" -} - - -## Collect account data ## -Write-Host "----------- Enter info for the account to enable -----------." -foregroundcolor "magenta" -$strRoomUri=Read-Host 'Please enter the UPN of the account you are enabling (e.g. confroom@surfacehub.microsoft.com)' - -if ([System.String]::IsNullOrEmpty($strRoomUri)) -{ - CleanupAndFail "Please enter all of the requested data to continue." - exit 1 -} -Write-Host "--------------------------------------------------------------." -foregroundcolor "magenta" - - - -## Sign in to remote powershell for exchange and lync online ## -Write-Host "`n------------------ Establishing connection -----------------." -foregroundcolor "magenta" -$credAdmin=Get-Credential -Message "Enter credentials of a Skype for Business admin" -if (!$credadmin) -{ - CleanupAndFail("Valid admin credentials are required to create and prepare the account."); -} -Write-Host "Connecting to remote sessions. This can occasionally take a while - please do not enter input..." - -try -{ - if ($online) - { - $sessCS = New-CsOnlineSession -Credential $credAdmin - } - else - { - $sessCS = New-PSSession -Credential $credAdmin -ConnectionURI "https://$strRegPool/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue - } -} -catch -{ - CleanupAndFail("Failed to connect to Skype for Business server. Please check your credentials and try again. Error message: $_") -} - -Import-PSSession $sessCS -AllowClobber - - -Write-Host "--------------------------------------------------------------." -foregroundcolor "magenta" - -# Getting registrar pool -if ($online) -{ - try { - $strRegPool = $null; - $strRegPool = (Get-CsTenant).RegistrarPool - } catch {} - if ($Error) - { - $Error.Clear(); - $strRegPool = ""; - Write-Host "We failed to lookup your Skype for Business Registrar Pool, but you can still enter it manually" - } - else - { - $strRegPool = $strRegPool[0].Substring($strRegPool[0].IndexOf(':') + 1) - } -} - - -$Error.Clear() -try { - Enable-CsMeetingRoom -Identity $strRoomUri -RegistrarPool $strRegPool -SipAddressType EmailAddress -} -catch {} - -ExitIfError("Failed to setup Skype for Business meeting room") - -PrintSuccess "Successfully enabled $strRoomUri as a Skype for Business meeting room" - -Cleanup -``` - -## Useful cmdlets - - -### Creating a Surface Hub-compatible ActiveSync policy - -For Surface Hub to use Exchange services, a device account configured with a compatible ActiveSync policy must be provisioned on the device. This policy has the following requirements: - -``` syntax -PasswordEnabled == 0 -``` - -In the following cmdlets, `$strPolicy` is the name of the ActiveSync policy, and `$strRoomUpn` is the UPN of the device account you want to apply the policy to. - -Note that in order to run the cmdlets, you need to set up a remote PowerShell session and: - -- Your admin account must be remote-PowerShell-enabled. This allows the admin to use the PowerShell cmdlets that are needed by the script. (This permission can be set using `set-user $admin -RemotePowerShellEnabled $true`) -- Your admin account must have the "Reset Password" role if you plan to run the creation scripts. This allows the admin to change the password of the account, which is needed for the script. The Reset Password Role can be enabled using the Exchange Admin Center. - -Create the policy. - -```PowerShell -# Create new policy with PasswordEnabled == false -New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false –AllowNonProvisionableDevices $true -``` - -To apply the policy, the mailbox cannot be a room type, so it has to be converted into a user first. - -```PowerShell -# Convert user to regular type -Set-Mailbox $strRoomUpn -Type Regular -# Set policy for account -Set-CASMailbox $strRoomUpn -ActiveSyncMailboxPolicy $strPolicy -``` - -Now the device account just needs to be converted back into a room type. - -```PowerShell -# Convert back to room mailbox -Set-Mailbox $strRoomUpn -Type Room -``` - -### Allowing device IDs for ActiveSync - -To allow an account `$strRoomUpn`, run the following command: - -```PowerShell -Set-CASMailbox –Identity $strRoomUpn –ActiveSyncAllowedDeviceIDs “” -``` - -To find a device's ID, run: - -```PowerShell -Get-ActiveSyncDevice -Mailbox $strRoomUpn -``` - -This retrieves device information for every device that the account has been provisioned on, Including the `DeviceId` property. - -### Auto-accepting and declining meeting requests - -For a device account to automatically accept or decline meeting requests based on its availability, the **AutomateProcessing** attribute must be set to **AutoAccept**. This is recommended as to prevent overlapping meetings. - -```PowerShell -Set-CalendarProcessing $strRoomUpn -AutomateProcessing AutoAccept -``` - -### Accepting external meeting requests - -For a device account to accept external meeting requests (a meeting request from an account not in the same tenant/domain), the device account must be set to allow processing of external meeting requests. Once set, the device account will automatically accept or decline meeting requests from external accounts as well as local accounts. - ->**Note**  If the **AutomateProcessing** attribute is not set to **AutoAccept**, then setting this will have no effect. - -  - -```PowerShell -Set-CalendarProcessing $strRoomUpn -ProcessExternalMeetingMessages $true -``` - -  - -  - - - - - diff --git a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md deleted file mode 100644 index 7ea2bc584c..0000000000 --- a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Applying ActiveSync policies to device accounts (Surface Hub) -description: The Microsoft Surface Hub's device account uses ActiveSync to sync mail and calendar. This allows people to join and start scheduled meetings from the Surface Hub, and allows them to email any whiteboards they have made during their meeting. -ms.assetid: FAABBA74-3088-4275-B58E-EC1070F4D110 -ms.reviewer: -manager: dansimp -keywords: Surface Hub, ActiveSync policies -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: medium ---- - -# Applying ActiveSync policies to device accounts (Surface Hub) - - -The Microsoft Surface Hub's device account uses ActiveSync to sync mail and calendar. This allows people to join and start scheduled meetings from the Surface Hub, and allows them to email any whiteboards they have made during their meeting. - -For these features to work, the ActiveSync policies for your organization must be configured as follows: - -- There can't be any global policies that block synchronization of the resource mailbox that's being used by the Surface Hub’s device account. If there is such a blocking policy, you need to whitelist the Surface Hub as an allowed device. -- You must set a mobile device mailbox policy where the **PasswordEnabled** setting is set to False. Other mobile device mailbox policy settings are not compatible with the Surface Hub. - -## Whitelisting the DeviceID - - -Your organization may have a global policy that prevents syncing of device accounts provisioned on Surface Hubs. To configure this property, see [Allowing device IDs for ActiveSync](appendix-a-powershell-scripts-for-surface-hub.md#whitelisting-device-ids-cmdlet). - -## Setting PasswordEnabled - - -The device account must have an ActiveSync policy where the **PasswordEnabled** attribute is set to False or 0. To configure this property, see [Creating a Surface Hub-compatible Microsoft Exchange ActiveSync policy](appendix-a-powershell-scripts-for-surface-hub.md#create-compatible-as-policy). - -  - -  - - - - - diff --git a/devices/surface-hub/breadcrumb/toc.yml b/devices/surface-hub/breadcrumb/toc.yml deleted file mode 100644 index d846a15189..0000000000 --- a/devices/surface-hub/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Surface Hub - tocHref: /surface-hub - topicHref: /surface-hub/index \ No newline at end of file diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md deleted file mode 100644 index 2d55222b1b..0000000000 --- a/devices/surface-hub/change-history-surface-hub.md +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Change history for Surface Hub -ms.reviewer: -manager: dansimp -description: This topic lists new and updated topics for Surface Hub. -keywords: change history -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Change history for Surface Hub - -This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). - -## April 2019 - -New or changed topic | Description ---- | --- -[Surface Hub Site Readiness Guide](surface-hub-site-readiness-guide.md) | New; previously available for download only -[Technical information for 55” Microsoft Surface Hub](surface-hub-technical-55.md) | New; previously available for download and on [Surface Hub Tech Spec](https://support.microsoft.com/help/4483539/surface-hub-tech-spec) -[Technical information for 84” Microsoft Surface Hub](surface-hub-technical-84.md) | New; previously available for download and on [Surface Hub Tech Spec](https://support.microsoft.com/help/4483539/surface-hub-tech-spec) -[Surface Hub SSD replacement](surface-hub-ssd-replacement.md) | New; previously available for download only -[Implement Quality of Service on Surface Hub](surface-hub-qos.md) | New - -## July 2018 - -New or changed topic | Description ---- | --- -[Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Added information and links for new Microsoft Whiteboard app release. - -## June 2018 - -New or changed topic | Description ---- | --- -[On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md) and [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | Added (prerelease) instructions for disabling anonymous email and IM. - -## May 2018 - -New or changed topic | Description ---- | --- -[Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) | New - -## April 2018 - -New or changed topic | Description ---- | --- -[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions for Skype for Business Hybrid. - - -## March 2018 - -New or changed topic | Description ---- | --- -[Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Added section for account verification and testing, with link to new Surface Hub Hardware Diagnostic app. - -## February 2018 - -New or changed topic | Description ---- | --- -[Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Updated instructions for custom settings using Microsoft Intune. -[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions and scripts. -| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated instructions and scripts. - -## January 2018 - -New or changed topic | Description ---- | --- -[Configure Surface Hub Start menu](surface-hub-start-menu.md) | New -[PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) | Added prerequisites for running the scripts - -## November 2017 - -New or changed topic | Description ---- | --- -[Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | New -[Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Added settings for 802.1x wired authentication. - -## October 2017 - -New or changed topic | Description | ---- | --- -[Install apps on your Microsoft Surface Hub](install-apps-on-surface-hub.md) | Updated instructions to use Windows Team device family -[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated the instructions for Exchange on-premises -[Create a device account using UI](create-a-device-account-using-office-365.md) | Updated the instructions -[Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | Clarified user sign-in on Surface Hub -[Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Removed **How to control and manage Whiteboard to Whiteboard collaboration** due to issues with the EnterpriseModernAppmanagement CSP losing state during End Session. -| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Removed settings for managing Whiteboard collaboration. | -[Top support solutions for Surface Hub](support-solutions-surface-hub.md) | Added link to Surface Hub warranty information - - -## September 2017 - -New or changed topic | Description ---- | --- -[Top support solutions for Surface Hub](support-solutions-surface-hub.md) | New -[PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) | Updated account creation scripts - -## August 2017 - - -| New or changed topic | Description | -| --- | --- | -[Accessibility](accessibility-surface-hub.md) | Added information about Narrator -[Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) | New - - - - - -## July 2017 - -| New or changed topic | Description | -| --- | --- | -| [Windows updates](manage-windows-updates-for-surface-hub.md) | Changed deferral recommendations for Windows Updates | -| [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Added Whiteboard URLs to prerequisites | -| [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md#skype-for-business-online) | Updated the Skype for Business Online requirements | -| [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Added that Surface Hub supports 802.1X using PEAP-MSCHAPv2 | - -## June 2017 - -| New or changed topic | Description | -| --- | --- | -| [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | New | -| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Added settings for managing Whiteboard collaboration | - -## RELEASE: Windows 10, version 1703 - -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added: - -- [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) - ->[Looking for the Surface Hub admin guide for Windows 10, version 1607?](https://download.microsoft.com/download/7/2/5/7252051B-7E97-4781-B5DF-58D4B1A4BB88/surface-hub-admin-guide-1607.pdf) - - -## May 2017 - -| New or changed topic | Description | -| --- | --- | -| [Online or hybrid deployment using Skype Hybrid Voice environment](skype-hybrid-voice.md) | New | - - -## February 2017 - -| New or changed topic | Description | -| --- | --- | -| [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) | New | - -## January 2017 - -| New or changed topic | Description | -| --- | --- | -| [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) | New | -| [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | New | -| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added graphics cards verified to work with 84" Surface Hubs and added information about the lengths of cables. | -| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated procedures for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. | - -## December 2016 - -| New or changed topic | Description| -| --- | --- | -| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added information about Bluetooth accessories. | -| [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) | Updated example procedures to include screenshots. | - -## November 2016 - -| New or changed topic | Description | -| --- | --- | -| [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | New | -| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added information for Video Out and a table to help select a display method. | -| [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Added instructions for creating accounts for Surface Hub in a Skype for Business hybrid environment. | - - - -## RELEASE: Windows Anniversary Update for Surface Hub (Windows 10, version 1607) -The topics in this library have been updated for Windows 10, version 1607 (also known as Windows Anniversary Update for Surface Hub). These topics had significant updates for this release: -- [Windows Updates (Surface Hub)](manage-windows-updates-for-surface-hub.md) -- [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) -- [Monitor your Microsoft Surface Hub](monitor-surface-hub.md) -- [Create provisioning packages (Surface Hub)](provisioning-packages-for-certificates-surface-hub.md) -- [Install apps on your Microsoft Surface Hub](install-apps-on-surface-hub.md) -- [Device reset (Surface Hub)](device-reset-surface-hub.md) - -## October 2016 -| New or changed topic | Description | -| --- | --- | -| [Admin group management (Surface Hub)](admin-group-management-for-surface-hub.md) |Add note about automatic enrollment, and update table. | -| [Password management (Surface Hub)](password-management-for-surface-hub-device-accounts.md) | Updates to content. | -| [Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Reorganize and streamline guidance on creating a device account. | -| [Introduction to Surface Hub](intro-to-surface-hub.md) | Move Surface Hub dependencies table to [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md). | -| [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Add dependency table and reorganize topic. | -| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | New topic. | diff --git a/devices/surface-hub/change-surface-hub-device-account.md b/devices/surface-hub/change-surface-hub-device-account.md deleted file mode 100644 index 142af6e80e..0000000000 --- a/devices/surface-hub/change-surface-hub-device-account.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Change the Microsoft Surface Hub device account -description: You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned. -ms.assetid: AFC43043-3319-44BC-9310-29B1F375E672 -ms.reviewer: -manager: dansimp -keywords: change device account, change properties, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Change the Microsoft Surface Hub device account - - -You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned. - -## Details - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ValueDescription

          User Principal Name

          The user principal name (UPN) of the device account.

          Password

          The corresponding password of the device account.

          Domain

          The domain that the device account belongs to. This field does not need to be provided for Office 365 accounts.

          User name

          The user name of the device account. This field does not need to be provided for Office 365 accounts.

          Session Initiation Protocol (SIP) address

          The SIP address of the device account.

          Microsoft Exchange server

          This is the Exchange server of the device account. The device account’s username and password must be able to authenticate to the specified Exchange server.

          Enable Exchange services

          When checked, all Exchange services will be enabled (for example, calendar on the welcome screen, emailing whiteboards). When not checked, all Exchange services will be disabled, and the Exchange server does not need to be provided.

          - -  - -## What happens? - - -The UPN and password are used to validate the account in AD or Azure AD. If the validation fails, you may need to provide the domain and user name. - -Using the credentials provided, we will try to discover the SIP address. If a SIP address can't be found, then Skype for Business will use the UPN as the SIP address. If this is not the SIP address for the account, you will need to provide the SIP address. - -The Exchange server address will need to be provided if the device can't find a server associated with the login credentials. Microsoft Surface Hub will use the Exchange server to talk to ActiveSync, which enables several key features on the device. - -## Related topics - - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md deleted file mode 100644 index 5fd13d7b95..0000000000 --- a/devices/surface-hub/connect-and-display-with-surface-hub.md +++ /dev/null @@ -1,494 +0,0 @@ ---- -title: Connect other devices and display with Surface Hub -description: You can connect other device to your Surface Hub to display content. -ms.assetid: 8BB80FA3-D364-4A90-B72B-65F0F0FC1F0D -ms.reviewer: -manager: dansimp -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Connect other devices and display with Surface Hub - - -You can connect other devices to your Microsoft Surface Hub to display content. This topic describes the Guest Mode, Replacement PC Mode, and Video Out functionality available through wired connections, and also lists accessories that you can connect to Surface Hub using [Bluetooth](#bluetooth-accessories). - ->[!NOTE] ->Surface Hub will use the video input that you select until a new connection is made, the existing connection is disrupted, or the Connect App is closed. - -## Which method should I choose? - -When connecting external devices and displays to a Surface Hub, there are several available options. The method you use will depend upon your scenario and needs. - -| When you want to: | Use this method: | -| --- | --- | -| Mirror the Surface Hub's display on another device. | [Video Out](#video-out) | -| Present another device's display on the Surface Hub screen and interact with both the device's content and the built-in Surface Hub experience. | [Guest Mode](#guest-mode) | -| Power the Surface Hub from an external Windows 10 PC, turning off the embedded computer of the Surface Hub. Cameras, microphones, speakers, and other peripherals, are sent to the external PC, in addition to pen and touch. | [Replacement PC Mode](#replacement-pc-mode) | - - -## Guest Mode - - -Guest Mode uses a wired connection, so people can display content from their devices to the Surface Hub. If the source device is Windows-based, that device can also provide Touchback and Inkback. Surface Hub's internal PC takes video and audio from the connected device and presents them on the Surface Hub. If Surface Hub encounters a High-Bandwidth Digital Content Protection (HDCP) signal, the source will be displayed as a black image. To display your content without violating HDCP requirements, use the keypad on the right side of the Surface Hub to directly choose the external source. - ->[!NOTE] ->When an HDCP source is connected, use the side keypad to change source inputs. - -### Ports - -Use these ports on the Surface Hub for Guest Mode. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          InterfaceTypeDescriptionCapabilities

          Display Port 1.1a

          Video input

          Guest input #1

            -
          • Support simultaneous guest input display with guest input #2 and guest input #3 (one full resolution, two thumbnail).

          • -
          • HDCP compliant in bypass mode

          • -
          • Touchback enabled

          • -

          HDMI 1.4

          Video input

          Guest input #2

            -
          • Support simultaneous guest input display with guest input #1 and guest input #3 (one full resolution, two thumbnail).

          • -
          • HDCP compliant in bypass mode

          • -
          • Touchback enabled

          • -

          VGA

          Video input

          Guest input #3

            -
          • Support simultaneous guest input display with guest input #1 and guest input #2 (one full resolution, two thumbnail).

          • -
          • HDCP compliant in bypass mode

          • -
          • Touchback enabled

          • -

          3.5 mm jack

          Audio input

          Analog audio input

            -
          • Ingest into Surface Hub PC, usually with the VGA video input.

          • -

          USB 2.0, type B

          USB out

          Touchback

            -
          • Provides access to the HID input devices mouse, touch, keyboard, and stylus back to the guest PC.

          • -
          - - - -### Port locations - -These are the port connections used for Guest Mode on the 55" and 84" Surface Hubs. - -![image showing guest ports on 55" surface hub.](images/sh-55-guest-ports.png) - -Wired port connections on 55" Surface Hub - -![image showing guest ports on 84" surface hub.](images/sh-84-guest-ports.png) - -Wired port connections on 84" Surface Hub - -### Port enumeration - -When a Surface hub is connected to a guest computer with the wired connect USB port, a number of USB devices are discovered and configured. These peripheral devices are created for Touchback and Inkback. The peripheral devices can be viewed in Device Manager. Device Manager will show duplicate names for some devices. - -**Human interface devices** - -- HID-compliant consumer control device - -- HID-compliant pen - -- HID-compliant pen (duplicate item) - -- HID-compliant pen (duplicate item) - -- HID-compliant touch screen - -- USB Input Device - -- USB Input Device (duplicate item) - -**Keyboards** - -- Standard PS/2 keyboard - -**Mice and other pointing devices** - -- HID-compliant mouse - -**Universal serial bus controllers** - -- Generic USB hub - -- USB composite device - -### Guest Mode connectivity - -Your choice of video cable will be determined by what is available from your source input. The Surface Hub has three choices of video input: DisplayPort, HDMI, and VGA. See the following chart for available resolutions. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Signal TypeResolutionFrame rateHDMI - RGBDisplayPortVGA

          PC

          640 x 480

          59.94/60

          X

          X

          X

          PC

          720 x 480

          59.94/60

          X

          X

          PC

          1024 x 768

          60

          X

          X

          X

          HDTV

          720p

          59.94/60

          X

          X

          X

          HDTV

          1080p

          59.94/60

          X

          X

          X

          - - - -Source audio is provided by DisplayPort and HDMI cables. If you must use VGA, Surface Hub has an audio input port that uses a 3.5 mm plug. Surface Hub also uses a USB cable that provides Touchback and Inkback from the Surface Hub to compatible Windows 10 devices. The USB cable can be used with any video input that is already connected with a cable. - -Someone using Guest Mode to connect a PC would use one of these options: - -**DisplayPort** -- DisplayPort cable and USB 2.0 cable - -**HDMI** -- HDMI cable and USB 2.0 cable - -**VGA** -- VGA cable, 3.5 mm audio cable, and USB 2.0 cable - -If the computer you are using for Guest Mode is not compatible with Touchback and Inkback, then you won't need the USB cable. - -## Replacement PC Mode - - -In Replacement PC Mode, the embedded computer of the Surface Hub is turned off and an external PC is connected to the Surface Hub. Connections to replacement PC ports give access to key peripherals on the Surface Hub, including the screen, pen, and touch features. This does mean that your Surface Hub won’t have the benefit of the Windows Team experience, but you will have the flexibility offered by providing and managing your own Windows computer. - -### Software requirements - -You can run Surface Hub in Replacement PC Mode with 64-bit versions of Windows 10 Home, Windows 10 Pro, and Windows 10 Enterprise. You can download the [Surface Hub Replacement PC driver package](https://www.microsoft.com/download/details.aspx?id=52210) from the Microsoft Download Center. We recommend that you install these drivers on any computer you plan to use as a replacement PC. - -### Hardware requirements - -Surface Hub is compatible with a range of hardware. Choose the processor and memory confirmation for your replacement PC so that it supports the programs you'll be using. Your replacement PC hardware needs to support 64-bit versions of Windows 10. - -### Graphics adapter - -In Replacement PC Mode, Surface Hub supports any graphics adapter that can produce a DisplayPort signal. You'll improve your experience with a graphics adapter that can match Surface Hub's resolution and refresh rate. For example, the best and recommended replacement PC experience on the Surface Hub is with a 120Hz video signal. - -**55" Surface Hubs** - For best experience, use a graphics card capable of 1080p resolution at 120Hz. - -**84" Surface Hubs** - For best experience, use a graphics card capable of outputting four DisplayPort 1.2 streams to produce 2160p at 120Hz (3840 x 2160 at 120Hz vertical refresh). We've verified that this works with the NVIDIA Quadro K2200, NVIDIA Quadro K4200, NVIDIA Quadro M6000, AMD FirePro W5100, AMD FirePro W7100, and AMD FirePro W9100. These are not the only graphics cards - others are available from other vendors. - -Check directly with graphics card vendors for the latest drivers. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Graphics vendorDriver download page

          NVIDIA

          http://nvidia.com/Download/index.aspx

          AMD

          http://support.amd.com/en-us/download

          Intel

          https://downloadcenter.intel.com/

          - - - -### Ports - -Replacement PC ports on 55" Surface Hub - -![image showing replacement pc ports on 55" surface hub.](images/sh-55-rpc-ports.png) - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          DescriptionTypeInterfaceDetails

          PC video

          Video input

          DP 1.2

            -
          • Full screen display of 1080p at 120 Hz, plus audio

          • -
          • HDCP compliant

          • -

          Internal peripherals

          USB output

          USB 2.0 type B

            -
          • Touch

          • -
          • Pen

          • -
          • Speakers

          • -
          • Microphone

          • -
          • Cameras

          • -
          • NFC sensor

          • -
          • Ambient light sensor

          • -
          • Passive infrared sensor

          • -

          USB hub

          USB output

          USB 2.0 type B

            -
          • Underneath USB ports

          • -
          - - - -Replacement PC ports on 84" Surface Hub - -![image showing replacement pc ports on 84" surface hub.](images/sh-84-rpc-ports.png) - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          DescriptionTypeInterfaceDetails

          PC video

          Video input

          DP 1.2 (2x)

            -
          • Full screen display of 2160p at 120 Hz, plus audio

          • -
          • HDCP compliant

          • -

          Internal peripherals

          USB output

          USB 2.0 type B

            -
          • Touch

          • -
          • Pen

          • -
          • Speakers

          • -
          • Microphone

          • -
          • Cameras

          • -
          • NFC sensor

          • -
          • Ambient light sensor

          • -
          • Passive infrared sensor

          • -

          USB hub

          USB output

          USB 2.0 type B

            -
          • Underneath USB ports

          • -
          - - - -### Replacement PC setup instructions - -**To use Replacement PC Mode** - -1. Download and install the [Surface Hub Replacement PC driver package](https://www.microsoft.com/download/details.aspx?id=52210) on the replacement PC. - - >[!NOTE] - >We recommend that you set sleep or hibernation on the replacement PC so the Surface Hub will turn off the display when it isn't being used. - -2. Turn off the Surface Hub using the power switch next to the power cable. - -3. Connect the cables from the Surface Hub's replacement PC ports to the replacement PC. These ports are usually covered by a removable plastic cover. - - 55" Surface Hub -- connect one DisplayPort cable, and two USB cables. - - 84" Surface Hub -- connect two DisplayPort cables, and two USB cables. - -4. Toggle the Mode switch to **Replacement PC**. The Mode switch is next to the Replacement PC ports. - -5. Turn on the Surface Hub using the power switch next to the power cable. - -6. Press the power button on the right side of the Surface Hub. - -You can switch the Surface Hub to use the internal PC. - -**To switch back to internal PC** - -1. Turn off the Surface Hub using the power switch next to the power cable. - -2. Toggle the Mode switch to Internal PC. The Mode switch is next to the Replacement PC ports. - -3. Turn on the Surface Hub using the power switch next to the power cable. - - -## Video Out - -The Surface Hub includes a Video Out port for mirroring visual content from the Surface Hub to another display. - -### Ports - -Video Out port on the 55" Surface Hub - -![Illustration of video output port](images/video-out-55.png) - -Video Out port on the 84" Surface Hub - -![Illustration of video output port](images/video-out-84.png) - - - - - - - - - - - - - - - - - - -
          DescriptionTypeInterfaceCapabilities

          Video Output Mirror

          Video Output

          Video Output

            -
          • Supports connection to a standard DisplayPort monitor (only supports an x4 Link displaying 1080p60 resolution at 24bpp)

          • -
          • Supports use with HDMI monitors (supporting 1080p60) by using a DisplayPort-to-HDMI adaptor

          • -
          - -## Cables - -Both the 55” and 84” Surface Hub devices have been tested to work with Certified DisplayPort and HDMI cables. While vendors do sell longer cables that may work with the Surface Hub, only those cables that have been certified by testing labs are certain to work with the Hub. For example, DisplayPort cables are certified only up to 3 meters, however many vendors sell cables that are 3 times that length. If a long cable is necessary, we strongly suggest using HDMI. HDMI has many cost-effective solutions for long-haul cables, including the use of repeaters. Nearly every DisplayPort source will automatically switch to HDMI signaling if a HDMI sink is detected. - - -## Bluetooth accessories - -You can connect the following accessories to Surface Hub using Bluetooth: - -- Mice -- Keyboards -- Headsets -- Speakers - ->[!NOTE] ->After you connect a Bluetooth headset or speaker, you might need to change the [default microphone and speaker settings](local-management-surface-hub-settings.md). diff --git a/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md b/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md deleted file mode 100644 index 9e70a8755c..0000000000 --- a/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: What to do if the Connect app in Surface Hub exits unexpectedly -description: Describes how to resolve an issue where the Connect app in Surface Hub exits to the Welcome screen after cycling through inputs. -ms.assetid: 9576f4e4-d936-4235-8a03-d8a6fe9e8fec -ms.reviewer: -manager: -keywords: surface, hub, connect, input, displayport -ms.prod: surface-hub -ms.sitesec: library -author: todmccoy -ms.author: v-todmc -ms.topic: article -ms.localizationpriority: medium ---- - -# What to do if the Connect app in Surface Hub exits unexpectedly - -At times, a wired Connect session that is started from the Welcome screen by connecting a DisplayPort input will exit back to the Welcome screen after using the side keypad or the source button to cycle through all source inputs. - -This is an issue in the Connect app and its default full-screen state. By changing the size of the app, or by selecting a DisplayPort input thumbnail in the Connect app, you can prevent input cycling from affecting the app. - -The way to resolve this issue is to first launch the Connect app from the Welcome screen, and THEN connect a DisplayPort input. If the input is already connected, manually select the thumbnail. \ No newline at end of file diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md deleted file mode 100644 index 20f13c7d1b..0000000000 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ /dev/null @@ -1,387 +0,0 @@ ---- -title: Create a device account using UI (Surface Hub) -description: If you prefer to use a graphical user interface, you can create a device account for your Microsoft Surface Hub with either the Office 365 UI or the Exchange Admin Center. -ms.assetid: D11BCDC4-DABA-4B9A-9ECB-58E02CC8218C -ms.reviewer: -manager: dansimp -keywords: create device account, Office 365 UI, Exchange Admin center, Microsoft 365 admin center, Skype for Business, mobile device mailbox policy -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 05/04/2018 -ms.localizationpriority: medium ---- - -# Create a device account using UI (Surface Hub) - - -If you prefer to use a graphical user interface, you can create a device account for your Microsoft Surface Hub with either the [Office 365 UI](#create-device-acct-o365) or the [Exchange Admin Center](#create-device-acct-eac). - -## Create a device account using Office 365 - - -1. [Create the account in the Microsoft 365 Admin Center](#create-device-acct-o365-admin-ctr). -2. [Create a mobile device mailbox (ActiveSync) policy from the Microsoft Exchange Admin Center](#create-device-acct-o365-mbx-policy). -3. [Use PowerShell to complete device account creation](#create-device-acct-o365-complete-acct). -4. [Use PowerShell to configure Exchange properties of the account](#create-device-acct-o365-configure-exch-prop). -5. [Enable the account with Skype for Business](#create-device-acct-o365-skype-for-business). - -### Create the account in the admin center - -1. Sign in to Office 365 by visiting http://portal.office.com -2. Provide the admin credentials for your Office 365 tenant. This will take you to your Microsoft 365 Admin Center. - - ![Microsoft 365 admin center.](images/setupdeviceaccto365-02.png) - -3. In the admin center, navigate to **Resources** in the left panel, and then click **Rooms & equipment**. - - ![Rooms & equipment option in admin center](images/room-equipment.png) - -4. Click **Add** to create a new Room account. Enter a display name and email address for the account, and then click **Add**. - - ![Create new room account window](images/room-add.png) - -5. Select the Room account you just created in the Active Users list. In the right panel, you can see the account properties and several optional actions. Click **Reset password** to change the password, and unselect **Make this user change their password when they first sign in**, because it is not possible to change the password from the Surface Hub sign-in flow. - -6. In the **Assigned license** section, click **Edit**, and then click the dropdown arrow next to the appropriate license to expand the details. Select a user location, and in the list of licenses, toggle on **Skype for Business Online (Plan 2)**, and then click **Save**. The license may vary depending on your organization (for example, you might have Plan 2 or Plan 3). - -### Create a mobile device mailbox (ActiveSync) policy from the Exchange Admin Center - -1. In the admin center’s left panel, click **ADMIN**, and then click **Exchange**. - - ![admin center, showing exchange active users.](images/setupdeviceaccto365-08.png) - -2. This will open another tab on your browser to take you to the Exchange Admin Center, where you can create and set the Mailbox Setting for Surface Hub. - - ![Exchange admin center.](images/setupdeviceaccto365-09.png) - -3. To create a Mobile Device Mailbox Policy, click **Mobile** from the left panel and then click **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts. - - ![Exchange admin center - creating a mobile device mailbox policy.](images/setupdeviceaccto365-10.png) - -4. To create a New Surface Hub mobile device mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name, provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). Make sure the policy does not require a password for the devices assigned to, so make sure **Require a Password** remains unchecked, then click **Save**. - - ![Image showing new mobile device policy.](images/setupdeviceaccto365-11.png) - -5. After you have created the new mobile device mailbox policy, go back to the **Exchange Admin Center** and you will see the new policy listed. - - ![Image with new mobile device mailbox policy in Exchange admin center.](images/setupdeviceaccto365-12.png) - - - -### Use PowerShell to complete device account creation - -From here on, you'll need to finish the account creation process using PowerShell to set up some configuration. - -In order to run cmdlets used by these PowerShell scripts, the following must be installed for the admin PowerShell console: - -- [Microsoft Online Services Sign-In Assistant for IT Professionals RTW](https://www.microsoft.com/en-us/download/details.aspx?id=41950) -- [Windows Azure Active Directory Module for Windows PowerShell](https://www.microsoft.com/web/handlers/webpi.ashx/getinstaller/WindowsAzurePowershellGet.3f.3f.3fnew.appids) -- [Skype for Business Online, Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366) - -Install the following module in Powershell -``` syntax - install-module AzureAD - Install-module MsOnline -``` - -### Connecting to online services - -1. Run Windows PowerShell as Administrator. - - ![Image showing how to start Windows PowerShell and run as administrator.](images/setupdeviceaccto365-17.png) - -2. Create a Credentials object, then create a new session that connects to Skype for Business Online, and provide the global tenant administrator account, then click **OK**. - - ![Image for Windows PowerShell credential request.](images/setupdeviceaccto365-18.png) - -3. To connect to Microsoft Online Services, run: - - ``` syntax - Connect-MsolService -Credential $Cred - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-19.png) - -4. Now to connect to Skype for Business Online Services, run: - - ``` syntax - $sfbsession = New-CsOnlineSession -Credential $cred - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-20.png) - -5. Finally, to connect to Exchange Online Services, run: - - ``` syntax - $exchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -Credential $cred -Authentication "Basic" –AllowRedirection - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-21.png) - -6. Now you have to import the Skype for Business Online Session and the Exchange Online session you have just created, which will import the Exchange and Skype Commands so you can use them locally. - - ``` syntax - Import-PSSession $exchangesession -AllowClobber -WarningAction SilentlyContinue - Import-PSSession $sfbsession -AllowClobber -WarningAction SilentlyContinue - ``` - - Note that this could take a while to complete. - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-22.png) - -7. Once you’re connected to the online services you need to run a few more cmdlets to configure this account as a Surface Hub device account. - -### Use PowerShell to configure Exchange properties of the account - -Now that you're connected to the online services, you can finish setting up the device account. You'll use the device account email address to: - -- Change the mailbox type from regular to room. -- Set the password and enable the room mailbox account -- Change various Exchange properties -- Set the user account password to never expire. - -1. You’ll need to enter the account’s mail address and create a variable with that value: - - ```powershell - $mailbox = (Get-Mailbox ) - ``` - - To store the value get it from the mailbox: - - ```powershell - $strEmail = $mailbox.WindowsEmailAddress - ``` - - Print the value: - - ```powershell - $strEmail - ``` - - You will see the correct email address. - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-23.png) - -2. Run the following cmdlet: - - ```powershell - Set-CASMailbox $strEmail -ActiveSyncMailboxPolicy "SurfaceHubDeviceMobilePolicy" - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ``` syntax - Set-CalendarProcessing -Identity $strEmail -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $strEmail -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-26.png) - -5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ``` syntax - Set-MsolUser -UserPrincipalName $strEmail -PasswordNeverExpires $True - ``` - -### Enable the account with Skype for Business - -Enable the device account with Skype for Business. - -In order to enable Skype for Business, your environment will need to meet the following prerequisites: - -- You'll need to have Skype for Business Online Standalone Plan 2 or higher in your O365 plan. The plan needs to support conferencing capability. -- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Skype for Business Online Standalone Plan 3. -- Your tenant users must have Exchange mailboxes. -- Your Surface Hub account does require a Skype for Business Online Standalone Plan 2 or Skype for Business Online Standalone Plan 3 license, but it does not require an Exchange Online license. - -1. Start by creating a remote PowerShell session from a PC. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - -2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress - ``` - - If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - - ```PowerShell - Get-CsOnlineUser -Identity ‘alice@contoso.microsoft.com’| fl *registrarpool* - ``` - -## Create a device account using the Exchange Admin Center - ->[!NOTE] ->This method will only work if you are syncing from an on-premises Active Directory. - -You can use the Exchange Admin Center to create a device account: - -1. [Create an account and mailbox with the Exchange Admin Center](#create-device-acct-exch-admin-ctr). -2. [Create a mobile device mailbox policy from the Exchange Admin Center](#create-device-acct-exch-mbx-policy). -3. [Use PowerShell to configure the account](#create-device-acct-exch-powershell-conf). -4. [Enable the account with Skype for Business](#create-device-acct-exch-skype-for-business). - -### Create an account and mailbox with the Exchange Admin Center - -1. Sign in to your Exchange Admin Center using Exchange admin credentials. -2. Once you are at the Exchange Admin Center (EAC), navigate to **Recipients** in the left panel. - - ![Image showing mailboxes in Exchange admin center.](images/setupdeviceacctexch-01.png) - -3. On the controls above the list of mailboxess, choose **+** to create a new one, and provide a **Display name**, **Name**, and **User logon name**, and then click **Save**. - - ![Image showing creating a new mailbox.](images/setupdeviceacctexch-02.png) - -### Create a mobile device mailbox policy from the Exchange Admin Center - ->[!NOTE] ->If you want to create and assign a policy to the account you created, and are using Exchange 2010, look up the corresponding information regarding policy creation and policy assignment when using the EMC (Exchange management console). - - - -1. Go to the Exchange Admin Center. - - ![Image showing Exchange admin center.](images/setupdeviceacctexch-03.png) - -2. To create a mobile device mailbox policy, click **Mobile** from the left panel, then **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts. - - ![Image showing using Exchange admin center to create a mobile device mailbox policy.](images/setupdeviceacctexch-05.png) - -3. To create a new mobile device account mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). The policy must not be password-protected, so make sure **Require a Password** remains unchecked, then click **Save**. - - ![Image showing new mobile device mailbox policy.](images/setupdeviceacctexch-06.png) - -4. After you have created the new mobile device mailbox policy, go back to the Exchange Admin Center and you will see the new policy listed. - - ![Image showing new mobile device mailbox policy in Exchange admin center.](images/setupdeviceacctexch-07.png) - -5. To apply the ActiveSync policy without using PowerShell, you can do the following: - - - In the EAC, click **Recipients** > **Mailboxes** and select a mailbox. - - ![image showing exchange admin center.](images/setupdeviceacctexch-08.png) - - - In the **Details** pane, scroll to **Phone and Voice Features** and click **View details** to display the **Mobile Device Details** screen. - - ![image showing mailbox details.](images/setupdeviceacctexch-09.png) - - - The mobile device mailbox policy that’s currently assigned is displayed. To change the mobile device mailbox policy, click **Browse**. - - ![image showing the currently assigned mobile device mailbox policy.](images/setupdeviceacctexch-10.png) - - - Choose the appropriate mobile device mailbox policy from the list, click **OK** and then click **Save**. - - ![image showing list of mobile device mailbox policies.](images/setupdeviceacctexch-11.png) - -### Use PowerShell to configure the account - -Now that you're connected to the online services, you can finish setting up the device account. You'll use the device account email address to: - -- Change the mailbox type from regular to room. -- Change various Exchange properties -- Set the user account password to never expire. - -1. You’ll need to enter the account’s mail address and create a variable with that value: - - ``` syntax - $mailbox = (Get-Mailbox ) - ``` - - To store the value got it from the mailbox: - - ``` syntax - $strEmail = $mailbox.WindowsEmailAddress - ``` - - Print the value by running: - - ``` syntax - $strEmail - ``` - - You will see the correct email address. - -2. You need to convert the account into a room mailbox, so run: - - ``` syntax - Set-Mailbox $strEmail -Type Room - ``` - -3. In order for the device account to be authenticated on a Surface Hub, you need to enable the room mailbox account and set a password, so the account can be used by the device to get meeting information using ActiveSync and log in to Skype for Business. - - ``` syntax - Set-Mailbox $strEmail -RoomMailboxPassword (ConvertTo-SecureString -String "" -AsPlainText -Force) -EnableRoomMailboxAccount $true - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ``` syntax - Set-CalendarProcessing -Identity $strEmail -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $strEmail -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. Now we have to set some properties in AD. To do that, you need the alias of the account (this is the part of the UPN that becomes before the “@”). - - ``` syntax - $strAlias = “” - ``` - -6. The user needs to be enabled in AD before it can authenticate with a Surface Hub. Run: - - ``` syntax - Set-ADUser $strAlias -Enabled $True - ``` - -7. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ``` syntax - Set-ADUser $strAlias -PasswordNeverExpires $True - ``` - -### Enable the account with Skype for Business - -Enable the device account with Skype for Business. - -In order to enable Skype for Business, your environment will need to meet the following prerequisites: - -- You'll need to have Skype for Business Online Standalone Plan 2 or higher in your O365 plan. The plan needs to support conferencing capability. -- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Skype for Business Online Standalone Plan 3. -- Your tenant users must have Exchange mailboxes. -- Your Surface Hub account does require a Skype for Business Online Standalone Plan 2 or Skype for Business Online Standalone Plan 3 license, but it does not require an Exchange Online license. - -1. Start by creating a remote PowerShell session from a PC. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - -2. Retrieve your Surface Hub account Registrar Pool - -If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - - ```PowerShell - Get-CsOnlineUser -Identity ‘alice@contoso.microsoft.com’| fl *registrarpool* - ``` - -3. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress - ``` - - - - - - - diff --git a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md deleted file mode 100644 index 104a1125cc..0000000000 --- a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Create and test a device account (Surface Hub) -description: This topic introduces how to create and test the device account that Microsoft Surface Hub uses to communicate with Microsoft Exchange and Skype. -ms.assetid: C8605B5F-2178-4C3A-B4E0-CE32C70ECF67 -ms.reviewer: -manager: dansimp -keywords: create and test device account, device account, Surface Hub and Microsoft Exchange, Surface Hub and Skype -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/06/2018 -ms.localizationpriority: medium ---- - -# Create and test a device account (Surface Hub) - - -This topic introduces how to create and test the device account that Microsoft Surface Hub uses to communicate with Microsoft Exchange and Skype. - -A **device account** is an Exchange resource account that Surface Hub uses to: - -- Display its meeting calendar -- Join Skype for Business calls -- Send email (for example, email whiteboard content from a meeting) - -Once the device account is provisioned to a Surface Hub, people can add this account to a meeting invitation the same way that they would invite a meeting room. - -## Configuration overview - -This table explains the main steps and configuration decisions when you create a device account. - -| Step | Description | Purpose | -|------|---------------------------------|--------------------------------------| -| 1 | Created a logon-enabled Exchange resource mailbox (Exchange 2013 or later, or Exchange Online) | This resource mailbox allows the device to maintain a meeting calendar, receive meeting requests, and send mail. It must be logon-enabled to be provisioned to a Surface Hub. | -| 2 | Configure mailbox properties | The mailbox must be configured with the correct properties to enable the best meeting experience on Surface Hub. For more information on mailbox properties, see [Mailbox properties](exchange-properties-for-surface-hub-device-accounts.md). | -| 3 | Apply a compatible mobile device mailbox policy to the mailbox | Surface Hub is managed using mobile device management (MDM) rather than through mobile device mailbox policies. For compatibility, the device account must have a mobile device mailbox policy where the **PasswordEnabled** setting is set to False. Otherwise, Surface Hub can't sync mail and calendar info. | -| 4 | Enable mailbox with Skype for Business (Lync Server 2013 or later, or Skype for Business Online) | Skype for Business must be enabled to use conferencing features like video calls, IM, and screen sharing. | -| 5 | (Optional) Whitelist ActiveSync Device ID | Your organization may have a global policy that prevents device accounts from syncing mail and calendar info. If so, you need to whitelist the ActiveSync Device ID of your Surface Hub. | -| 6 | (Optional) Disable password expiration | To simplify management, you can turn off password expiration for the device account and allow Surface Hub to automatically rotate the device account password. For more information about password management, see [Password management](password-management-for-surface-hub-device-accounts.md). | - -## Detailed configuration steps - -We recommend setting up your device accounts using remote PowerShell. There are PowerShell scripts available to help create and validate device accounts For more information on PowerShell scripts and instructions, see [Appendix A: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md). - -For detailed steps using PowerShell to provision a device account, choose an option from the table, based on your organization deployment. - -| Organization deployment | Description | -|---------------------------------|--------------------------------------| -| [Online deployment (Office 365)](online-deployment-surface-hub-device-accounts.md) | Your organization's environment is deployed entirely on Office 365. | -| [On-premises deployment (single-forest)](on-premises-deployment-surface-hub-device-accounts.md) | Your organization has servers that it controls and uses to host Active Directory, Exchange, and Skype for Business (or Lync) in a single-forest environment. | -| [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | Your organization has servers that it controls and uses to host Active Directory, Exchange, and Skype for Business (or Lync) in a multi-forest environment. | -| [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Your organization has a mix of services, with some hosted on-premises and some hosted online through Office 365. | -| [Online or hybrid deployment using Skype Hybrid Voice environment](skype-hybrid-voice.md) | Your organization has Skype for Business home pools and Exchange servers in the cloud, and uses an on-premises pool of Skype for Business 2015 or Cloud Connector edition connected via Public Switched Telephone Network (PSTN). | - - -If you prefer to use a graphical user interface (UI), some steps can be done using UI instead of PowerShell. -For more information, see [Creating a device account using UI](create-a-device-account-using-office-365.md). - -## Account verification and testing - -There are two methods available that you can use to validate and test a Surface Hub device account: [account verifications scripts](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts) and the [Surface Hub Hardware Diagnostic app](https://www.microsoft.com/store/apps/9nblggh51f2g). The account verification script will validate a previously-created device account using PowerShell from your desktop. The Surface Hub Hardware Diagnostic app is installed on your Surface Hub and provides detailed feedback about signin and communication failures. Both are valuable tools to test newly created device accounts and should be used to ensure optimal account availability. - -  - -  - -  - - - - - diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md deleted file mode 100644 index 6d7d33415f..0000000000 --- a/devices/surface-hub/device-reset-surface-hub.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Reset or recover a Surface Hub -description: Describes the reset and recovery processes for the Surface Hub, and provides instructions. -ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF -ms.reviewer: -manager: dansimp -keywords: reset Surface Hub, recover -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/31/2019 -ms.localizationpriority: medium ---- - -# Reset or recover a Surface Hub - -This article describes how to reset or recover a Microsoft Surface Hub. - -[Resetting the Surface Hub](#reset-a-surface-hub) returns its operating system to the last cumulative Windows update, and removes all local user files and configuration information. The information that is removed includes the following: - -- The device account -- Account information for the device's local administrators -- Domain-join or Azure AD-join information -- Mobile Device Management (MDM) enrollment information -- Configuration information that was set by using MDM or the Settings app - -[Recovering a Surface Hub from the cloud](#recover-a-surface-hub-from-the-cloud) also removes this information. In addition, the Surface Hub downloads a new operating system image and installs it. You can specify whether the recovery process preserves other information that is stored on the Surface Hub. - -## Reset a Surface Hub - -You may have to reset your Surface Hub for reasons such as the following: - -- You are re-purposing the device for a new meeting space and want to reconfigure it. -- You want to change how you locally manage the device. -- The user name or password for the device account or the Administrator account has been lost. -- After you install an update, the performance of the device decreases. - -During the reset process, if you see a blank screen for long periods of time, please wait and do not take any action. - -> [!WARNING] -> The device reset process may take up to six hours. Do not turn off or unplug the Surface Hub until the process has finished. If you interrupt the process, the device becomes inoperable. The device requires warranty service in order to become functional again. - -1. On your Surface Hub, open **Settings**. - - ![Image that shows Settings app for Surface Hub.](images/sh-settings.png) - -1. Select **Update & Security**. - - ![Image that shows Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png) - -1. Select **Recovery**, and then, under **Reset device**, select **Get started**. - - ![Image that shows the Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) - - After the reset process finishes, the Surface Hub starts the [first run program](first-run-program-surface-hub.md) again. If the reset process encounters a problem, it rolls the Surface Hub back to the previously-existing operating system image and then displays the Welcome screen. - - - -## Recover a Surface Hub from the cloud - -If for some reason the Surface Hub becomes unusable, you can still recover it from the cloud without assistance from Microsoft Support. The Surface Hub can download a fresh operating system image from the cloud, and use that image to reinstall its operating system. - -You may have to use this type of recovery process under the following circumstances: - -- [The Surface Hub or its related accounts have entered an unstable state](#recover-a-surface-hub-in-a-bad-state) -- [The Surface Hub is locked](#recover-a-locked-surface-hub) - ->[!IMPORTANT] ->The **Recover from the cloud** process requires an open internet connection (no proxy or other authentications). An ethernet connection is recommended. - -### Recover a Surface Hub in a bad state - -If the device account gets into an unstable state or if the administrator account encounters problems, you can use the Settings app to start the cloud recovery process. You should only use the cloud recovery process when the [device reset](#reset-a-surface-hub) process doesn't fix the problem. - -1. On your Surface Hub, select **Settings** > **Update & security** > **Recovery**. - -1. Under **Recover from the cloud**, select **Restart now**. - - ![recover from the cloud](images/recover-from-the-cloud.png) - -### Recover a locked Surface Hub - -On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device automatically restarts and tries the operation again. But if this operation fails repeatedly, the device automatically locks to protect user data. To unlock it, you must [reset the device](#reset-a-surface-hub) or, if that doesn't work, recover it from the cloud. - -1. Locate the power switch on the bottom of Surface Hub. The power switch is next to the power cord connection. For more information about the power switch, see the [Surface Hub Site Readiness Guide (PDF)](surface-hub-site-readiness-guide.md). - -1. While the Surface Hub displays the Welcome screen, use the power switch to turn off the Surface Hub. - -1. Use the power switch to turn the Surface Hub back on. The device starts and displays the Surface Hub Logo screen. When you see spinning dots under the Surface Hub Logo, use the power switch to turn the Surface Hub off again. - -1. Repeat step 3 three times, or until the Surface Hub displays the “Preparing Automatic Repair” message. After it displays this message, the Surface Hub displays the Windows RE screen. - -1. Select **Advanced Options**. - -1. Select **Recover from the cloud**. (Optionally, you can select **Reset**. However, **Recover from the cloud** is the recommended approach.) - - ![Recover from the cloud](images/recover-from-cloud.png) -1. If you are prompted to enter the Bitlocker key, do one of the following: - - - To preserve the information that Bitlocker protects on the Surface Hub, enter the Bitlocker key. - - To discard the protected information, select **Skip this drive** - -1. When you are prompted, select **Reinstall**. - - ![Reinstall](images/reinstall.png) - -1. To repartition the disk, select **Yes**. - - ![Repartition](images/repartition.png) - - First, the recovery process downloads the operating system image from the cloud. - - ![downloading 97&](images/recover-progress.png) - - When the download finishes, the recovery process restores the Surface Hub according to the options that you selected. - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md deleted file mode 100644 index 73a50f66c9..0000000000 --- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: Operating system essentials (Surface Hub) -description: This topic explains unique aspects of the Windows 10 Team operating system and how it differs from Windows 10 Enterprise. -keywords: change history -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Operating system essentials (Surface Hub) - -The Surface Hub operating system, Windows 10 Team, is based on Windows 10 Enterprise, providing rich support for enterprise management, security, and other features. However, there are important differences between them. While the Enterprise edition is designed for PCs, Windows 10 Team is designed from the ground up for large screens and meeting rooms. When you evaluate security and management requirements for Surface Hub, it's best to consider it as a new operating system. This article is designed to help highlight the key differences between Windows 10 Team on Surface Hub and Windows 10 Enterprise, and what the differences mean for your organization. - -## User interface - -### Shell (OS user interface) - -The Surface Hub's shell is designed from the ground up to be large screen and touch optimized. It doesn't use the same shell as Windows 10 Enterprise. - -*Organization policies that this may affect:*
          Settings related to controls in the Windows 10 Enterprise shell don't apply for Surface Hub. - -### Lock screen and screensaver - -Surface Hub doesn't have a lock screen or a screen saver, but it has a similar feature called the welcome screen. The welcome screen shows scheduled meetings from the device account's calendar, and easy entry points to the Surface Hub's top apps - Skype for Business, Whiteboard, and Connect. - -*Organization policies that this may affect:*
          Settings for lock screen, screen timeout, and screen saver don't apply for Surface Hub. - -### User sign-in - -Surface Hub is designed to be used in communal spaces, such as meeting rooms. Unlike Windows PCs, anyone can walk up and use a Surface Hub without requiring a user to sign in. To enable this communal functionality, Surface Hub does not support Windows sign-in the same way that Windows 10 Enterprise does (e.g., signing in a user to the OS and using those credentials throughout the OS). Instead, there is always a local, auto signed-in, low-privilege user signed in to the Surface Hub. It doesn't support signing in any additional users, including admin users (e.g., when an admin signs in, they are not signed in to the OS). - -Users can sign in to a Surface Hub, but they will not be signed in to the OS. For example, when a user signs in to Apps or My Meetings and Files, the users is signed in only to the apps or services, not to the OS. As a result, the signed-in user is able to retrieve their cloud files and personal meetings stored in the cloud, and these credentials are discarded when **End session** is activated. - - -*Organization policies that this may affect:*
          Generally, Surface Hub uses lockdown features rather than user access control to enforce security. Policies related to password requirements, interactive logon, user accounts, and access control don't apply for Surface Hub. - -### Saving and browsing files - -Users have access to a limited set of directories on the Surface Hub: -- Music -- Videos -- Documents -- Pictures -- Downloads - -Files saved locally in these directories are deleted when users press **End session**. To save content created during a meeting, users should save files to a USB drive or to OneDrive. - -*Organization policies that this may affect:*
          Policies related to access permissions and ownership of files and folders don't apply for Surface Hub. Users can't browse and save files to system directories and network folders. - -## Applications - -### Default applications - -With few exceptions, the default Universal Windows Platform (UWP) apps on Surface Hub are also available on Windows 10 PCs. - -UWP apps pre-installed on Surface Hub: -- Alarms & Clock -- Calculator -- Connect -- Excel Mobile -- Feedback Hub -- File Explorer* -- Get Started -- Maps -- Microsoft Edge -- Microsoft Power BI -- OneDrive -- Photos -- PowerPoint Mobile -- Settings* -- Skype for Business* -- Store -- Whiteboard* -- Word Mobile - -*Apps with an asterisk (*) are unique to Surface Hub* - -*Organization policies that this may affect:*
          Use guidelines for Windows 10 Enterprise to determine the features and network requirements for default apps on the Surface Hub. - -### Installing apps, drivers, and services - -To help preserve the appliance-like nature of the device, Surface Hub only supports installing Universal Windows Platform (UWP) apps, and does not support installing classic Win32 apps, services and drivers. Furthermore, only admins have access to install UWP apps. - -*Organization policies that this may affect:*
          Employees can only use the apps that have been installed by admins, helping mitigate against unintended use. Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools. - -## Security and lockdown - -For Surface Hub to be used in communal spaces, such as meeting rooms, its custom OS implements many of the security and lockdown features available in Windows 10. - -Surface Hub implements these Windows 10 security features: -- [UEFI Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) -- [User Mode Code Integrity (UMCI) with Device Guard](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) -- [Application restriction policies using AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) -- [BitLocker Drive Encryption](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) -- [Trusted Platform Module (TPM)](https://technet.microsoft.com/itpro/windows/keep-secure/trusted-platform-module-overview) -- [Windows Defender](https://technet.microsoft.com/itpro/windows/keep-secure/windows-defender-in-windows-10) -- [User Account Control (UAC)](https://technet.microsoft.com/itpro/windows/keep-secure/user-account-control-overview) for access to the Settings app - -These Surface Hub features provide additional security: -- Custom UEFI firmware -- Custom shell and Start menu limits device to meeting functions -- Custom File Explorer only grants access to files and folders under My Documents -- Custom Settings app only allows admins to modify device settings -- Downloading advanced Plug and Play drivers is disabled - -*Organization policies that this may affect:*
          Consider these features when performing your security assessment for Surface Hub. - -## Management - -### Device settings - -Device settings can be configured through the Settings app. The Settings app is customized for Surface Hub, but also contains many familiar settings from Windows 10 Desktop. A User Accounts Control (UAC) prompt appears when opening up the Settings app to verify the admin's credentials, but this does not sign in the admin. - -*Organization policies that this may affect:*
          Employees can use the Surface Hub for meetings, but cannot modify any device settings. In addition to lockdown features, this ensures that employees only use the device for meeting functions. - -### Administrative features - -The administrative features in Windows 10 Enterprise, such as the Microsoft Management Console, Run, Command Prompt, PowerShell, registry editor, event viewer, and task manager are not supported on Surface Hub. The Settings app contains all of the administrative features locally available on Surface Hub. - -*Organization policies that this may affect:*
          Surface Hubs are not managed like traditional PCs. Use MDM to configure settings and OMS to monitor your Surface Hub. - -### Remote management and monitoring - -Surface Hub supports remote management through mobile device management (MDM) solutions such as [Microsoft Intune](https://docs.microsoft.com/intune/) and monitoring through [Azure Monitor](https://azure.microsoft.com/services/monitor/). - -*Organization policies that this may affect:*
          Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools, such as System Center Operations Manager. - -### Group Policy - -Surface Hub does not support Windows Group Policy, including auditing. Instead, use MDM to apply policies to your Surface Hub. For more information about MDM, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md). - -*Organization policies that this may affect:*
          Use MDM to manage Surface Hub rather than group policy. - -### Remote assistance - -Surface Hub does not support remote assistance. - -*Organization policies that this may affect:*
          Policies related to remote assistance don't apply for Surface Hub. - -## Network - -### Domain join and Azure Active Directory (Azure AD) join - -Surface Hub uses domain join and Azure AD join primarily to provide a directory-backed admin group. Users can't sign in with a domain account. For more information, see [Admin group management](admin-group-management-for-surface-hub.md). - -*Organization policies that this may affect:*
          Group policies are not applied when a Surface Hub is joined to your domain. Policies related to domain membership don't apply for Surface Hub. - -### Accessing domain resources - -Users can sign in to Microsoft Edge to access intranet sites and online resources (such as Office 365). If your Surface Hub is configured with a device account, the system uses it to access Exchange and Skype for Business. However, Surface Hub doesn't support accessing domain resources such as file shares and printers. - -*Organization policies that this may affect:*
          Policies related to accessing domain objects don't apply for Surface Hub. - - - -### Diagnostic data - -The Surface Hub OS uses the Windows 10 Connected User Experience and Telemetry component to gather and transmit diagnostic data. For more information, see [Configure Windows diagnostic data in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization). - -*Organization policies that this may affect:*
          Configure diagnostic data levels for Surface Hub in the same way as you do for Windows 10 Enterprise. diff --git a/devices/surface-hub/docfx.json b/devices/surface-hub/docfx.json index 2ab787b803..8eba3c49b1 100644 --- a/devices/surface-hub/docfx.json +++ b/devices/surface-hub/docfx.json @@ -41,7 +41,18 @@ "depot_name": "Win.surface-hub", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ], + "titleSuffix": "Surface Hub" }, "externalReference": [], "template": "op.html", diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx deleted file mode 100644 index b06a6e8b44..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx deleted file mode 100644 index 4fa5e3abd9..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx deleted file mode 100644 index 210102de52..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx deleted file mode 100644 index 6d39d374a7..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf deleted file mode 100644 index 6c5b52d377..0000000000 Binary files a/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf deleted file mode 100644 index ae296c8c08..0000000000 Binary files a/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf deleted file mode 100644 index 9f64a7c4f2..0000000000 Binary files a/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCConnectYourPC.pdf b/devices/surface-hub/downloads/QRCConnectYourPC.pdf deleted file mode 100644 index fbdb9d9164..0000000000 Binary files a/devices/surface-hub/downloads/QRCConnectYourPC.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf deleted file mode 100644 index 62b86d2a00..0000000000 Binary files a/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf deleted file mode 100644 index a6af26dcf9..0000000000 Binary files a/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCNavigationBasics.pdf b/devices/surface-hub/downloads/QRCNavigationBasics.pdf deleted file mode 100644 index 6d8eb75ad5..0000000000 Binary files a/devices/surface-hub/downloads/QRCNavigationBasics.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf deleted file mode 100644 index a33cf1b1e1..0000000000 Binary files a/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCShareSendFile.pdf b/devices/surface-hub/downloads/QRCShareSendFile.pdf deleted file mode 100644 index 56d5c9f8c2..0000000000 Binary files a/devices/surface-hub/downloads/QRCShareSendFile.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf b/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf deleted file mode 100644 index 61caa64f94..0000000000 Binary files a/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf deleted file mode 100644 index d7a7c89268..0000000000 Binary files a/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf b/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf deleted file mode 100644 index aed2f55671..0000000000 Binary files a/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCWhiteboardTools.pdf b/devices/surface-hub/downloads/QRCWhiteboardTools.pdf deleted file mode 100644 index c6dfcc3523..0000000000 Binary files a/devices/surface-hub/downloads/QRCWhiteboardTools.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf b/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf deleted file mode 100644 index 79675aaaaa..0000000000 Binary files a/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf deleted file mode 100644 index b8b6d804a9..0000000000 Binary files a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf deleted file mode 100644 index 9e3ac0aa01..0000000000 Binary files a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf deleted file mode 100644 index a40bdf33d6..0000000000 Binary files a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf and /dev/null differ diff --git a/devices/surface-hub/enable-8021x-wired-authentication.md b/devices/surface-hub/enable-8021x-wired-authentication.md deleted file mode 100644 index bf91e2e42c..0000000000 --- a/devices/surface-hub/enable-8021x-wired-authentication.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Enable 802.1x wired authentication -description: 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 11/15/2017 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Enable 802.1x wired authentication - -The [November 14, 2017 update to Windows 10](https://support.microsoft.com/help/4048954/windows-10-update-kb4048954) (build 15063.726) enables 802.1x wired authentication MDM policies on Surface Hub devices. The feature allows organizations to enforce standardized wired network authentication using the [IEEE 802.1x authentication protocol](http://www.ieee802.org/1/pages/802.1x-2010.html). This is already available for wireless authentication using WLAN profiles via MDM. This topic explains how to configure a Surface Hub for use with wired authentication. - -Enforcement and enablement of 802.1x wired authentication on Surface Hub can be done through MDM [OMA-URI definition](https://docs.microsoft.com/intune-classic/deploy-use/windows-10-policy-settings-in-microsoft-intune#oma-uri-settings). - -The primary configuration to set is the **LanProfile** policy. Depending on the authentication method selected, other policies may be required, either the **EapUserData** policy or through MDM policies for adding user or machine certificates (such as [ClientCertificateInstall](https://docs.microsoft.com/windows/client-management/mdm/clientcertificateinstall-csp) for user/device certificates or [RootCATrustedCertificates](https://docs.microsoft.com/windows/client-management/mdm/rootcacertificates-csp) for device certificates). - -## LanProfile policy element - -To configure Surface Hub to use one of the supported 802.1x authentication methods, utilize the following OMA-URI. - -``` -./Vendor/MSFT/SurfaceHub/Dot3/LanProfile -``` - -This OMA-URI node takes a text string of XML as a parameter. The XML provided as a parameter should conform to the [Wired LAN Profile Schema](https://msdn.microsoft.com/library/cc233002.aspx) including elements from the [802.1X schema](https://msdn.microsoft.com/library/cc233003.aspx). - -In most instances, an administrator or user can export the LanProfile XML from an existing PC that is already configured on the network for 802.1X using this following NETSH command. - -``` -netsh lan export profile folder=. -``` - -Running this command will give the following output and place a file titled **Ethernet.xml** in the current directory. - -``` -Interface: Ethernet -Profile File Name: .\Ethernet.xml -1 profile(s) were exported successfully. -``` - -## EapUserData policy element - -If your selected authentication method requires a username and password as opposed to a certificate, you can use the **EapUserData** element to specify credentials for the device to use to authenticate to the network. - -``` -./Vendor/MSFT/SurfaceHub/Dot3/EapUserData -``` - -This OMA-URI node takes a text string of XML as a parameter. The XML provided as a parameter should conform to the [PEAP MS-CHAPv2 User Properties example](https://msdn.microsoft.com/library/windows/desktop/bb891979). In the example, you will need to replace all instances of *test* and *ias-domain* with your information. - - - -## Adding certificates - -If your selected authentication method is certificate-based, you will need to [create a provisioning package](provisioning-packages-for-surface-hub.md), [utilize MDM](https://docs.microsoft.com/windows/client-management/mdm/clientcertificateinstall-csp), or import a certificate from settings (**Settings** > **Update and Security** > **Certificates**) to deploy those certificates to your Surface Hub device in the appropriate Certificate Store. When adding certificates, each PFX must contain only one certificate (a PFX cannot have multiple certificates). - diff --git a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md deleted file mode 100644 index b6fca3a49e..0000000000 --- a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Microsoft Exchange properties (Surface Hub) -description: Some Microsoft Exchange properties of the device account must be set to particular values to have the best meeting experience on Microsoft Surface Hub. -ms.assetid: 3E84393B-C425-45BF-95A6-D6502BA1BF29 -ms.reviewer: -manager: dansimp -keywords: Microsoft Exchange properties, device account, Surface Hub, Windows PowerShell cmdlet -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: medium ---- - -# Microsoft Exchange properties (Surface Hub) - - -Some Microsoft Exchange properties of the device account must be set to particular values to have the best meeting experience on Microsoft Surface Hub. The following table lists various Exchange properties based on PowerShell cmdlet parameters, their purpose, and the values they should be set to. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescriptionValueImpact

          AutomateProcessing

          The AutomateProcessing parameter enables or disables calendar processing on the mailbox.

          AutoAccept

          The Surface Hub will be able to automatically accept or decline meeting requests based on its availability.

          AddOrganizerToSubject

          The AddOrganizerToSubject parameter specifies whether the meeting organizer's name is used as the subject of the meeting request.

          $False

          The welcome screen will not show the meeting organizer twice (instead of showing it as both the organizer and in the meeting subject).

          AllowConflicts

          The AllowConflicts parameter specifies whether to allow conflicting meeting requests.

          $False

          The Surface Hub will decline meeting requests that conflict with another meeting’s time.

          DeleteComments

          The DeleteComments parameter specifies whether to remove or keep any text in the message body of incoming meeting requests.

          $False

          The message body of meetings can be retained and retrieved from a Surface Hub if you need it during a meeting.

          DeleteSubject

          The DeleteSubject parameter specifies whether to remove or keep the subject of incoming meeting requests.

          $False

          Meeting request subjects can be shown on the Surface Hub.

          RemovePrivateProperty

          The RemovePrivateProperty parameter specifies whether to clear the private flag for incoming meeting requests.

          $False

          Private meeting subjects will show as Private on the welcome screen.

          AddAdditionalResponse

          The AddAdditionalResponse parameter specifies whether additional information will be sent from the resource mailbox when responding to meeting requests.

          $True

          When a response is sent to a meeting request, custom text will be provided in the response.

          AdditionalResponse

          The AdditionalResponse parameter specifies the additional information to be included in responses to meeting requests.

          -
          -Note  This text will not be sent unless AddAdditionalResponse is set to $True. -
          -
          -  -

          Your choice—the additional response can be used to inform people how to use a Surface Hub or point them towards resources.

          Adding an additional response message can provide people an introduction to how they can use a Surface Hub in their meeting.

          - -  - -  - -  - - - - - diff --git a/devices/surface-hub/finishing-your-surface-hub-meeting.md b/devices/surface-hub/finishing-your-surface-hub-meeting.md deleted file mode 100644 index 8776870779..0000000000 --- a/devices/surface-hub/finishing-your-surface-hub-meeting.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: End session - ending a Surface Hub meeting -description: To end a Surface Hub meeting, tap End session. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. -keywords: I am Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# End a Surface Hub meeting with End session -Surface Hub is a collaboration device designed to be used in meeting spaces by different groups of people. At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting. Surface Hub will clean up, or reset, the following states: -- Applications -- Operating system -- User interface - -This topic explains what **End session** resets for each of these states. - -## Applications -When you start apps on Surface Hub, they are stored in memory and data is stored at the application level. Data is available to all users during that session (or meeting) until date is removed or overwritten. When **End session** is selected, Surface Hub application state is cleared out by closing applications, deleting browser history, resetting applications, and removing Skype logs. - -### Close applications -Surface Hub closes all visible windows, including Win32 and Universal Windows Platform (UWP) applications. The application close stage uses the multitasking view to query the visible windows. Win32 windows that do not close within a certain timeframe are closed using **TerminateProcess**. - -### Delete browser history -Surface Hub uses Delete Browser History (DBH) in Edge to clear Edge history and cached data. This is similar to how a user can clear out their browser history manually, but **End session** also ensures that application states are cleared and data is removed before the next session, or meeting, starts. - -### Reset applications -**End session** resets the state of each application that is installed on the Surface Hub. Resetting an application clears all background tasks, application data, notifications, and user consent dialogs. Applications are returned to their first-run state for the next people that use Surface Hub. - -### Remove Skype logs -Skype does not store personally-identifiable information on Surface Hub. Information is stored in the Skype service to meet existing Skype for Business guidance. Local Skype logging information is the only data removed when **End session** is selected. This includes Unified Communications Client Platform (UCCP) logs and media logs. - -## Operating System -The operating system hosts a variety of information about the state of the sessions that needs to be cleared after each Surface Hub meeting. - -### File System -Meeting attendees have access to a limited set of directories on the Surface Hub. When **End session** is selected, Surface Hub clears these directories:
          -- Music -- Videos -- Documents -- Pictures -- Downloads - -Surface Hub also clears these directories, since many applications often write to them: -- Desktop -- Favorites -- Recent -- Public Documents -- Public Music -- Public Videos -- Public Downloads - -### Credentials -User credentials that are stored in **TokenBroker**, **PasswordVault**, or **Credential Manager** are cleared when you tap **End session**. - -## User interface -User interface (UI) settings are returned to their default values when **End session** is selected. - -### UI items -- Reset Quick Actions to default state -- Clear Toast notifications -- Reset volume levels -- Reset sidebar width -- Reset tablet mode layout -- Sign user out of Office 365 meetings and files - -### Accessibility -Accessibility features and apps are returned to default settings when **End session** is selected. -- Filter keys -- High contrast -- Sticky keys -- Toggle keys -- Mouse keys -- Magnifier -- Narrator - -### Clipboard -The clipboard is cleared to remove data that was copied to the clipboard during the session. - -## Frequently asked questions -**What happens if I forget to tap End session at the end of a meeting, and someone else uses the Surface Hub later?**
          -Surface Hub only cleans up meeting content when users tap **End session**. If you leave the meeting without tapping **End session**, the device will return to the welcome screen after some time. From the welcome screen, users have the option to resume the previous session or start a new one. You can also disable the ability to resume a session if **End session** is not pressed. - -**Are documents recoverable?**
          -Removing files from the hard drive when **End session** is selected is just like any other file deletion from a hard disk drive. Third-party software might be able to recover data from the hard disk drive, but file recovery is not a supported feature on Surface Hub. To prevent data loss, always save the data you need before leaving a meeting. - -**Do the clean-up actions from End session comply with the US Department of Defense clearing and sanitizing standard: DoD 5220.22-M?**
          -No. Currently, the clean-up actions from **End session** do not comply with this standard. - diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md deleted file mode 100644 index 22cddbc67d..0000000000 --- a/devices/surface-hub/first-run-program-surface-hub.md +++ /dev/null @@ -1,461 +0,0 @@ ---- -title: First-run program (Surface Hub) -description: The term \ 0034;first run \ 0034; refers to the series of steps you'll go through the first time you power up your Microsoft Surface Hub, and means the same thing as \ 0034;out-of-box experience \ 0034; (OOBE). This section will walk you through the process. -ms.assetid: 07C9E84C-1245-4511-B3B3-75939AD57C49 -ms.reviewer: -manager: dansimp -keywords: first run, Surface Hub, out-of-box experience, OOBE -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# First-run program (Surface Hub) - - -The term "first run" refers to the series of steps you'll go through the first time you power up your Microsoft Surface Hub, and means the same thing as "out-of-box experience" (OOBE). This section will walk you through the process. - -By now, you should have gone through all of the previous steps: - -- [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) -- [Physically install your Surface Hub device](physically-install-your-surface-hub-device.md), and -- [Setup worksheet](setup-worksheet-surface-hub.md) - -Assuming that's the case, first run should be both simple and quick. -The normal procedure goes through six steps: - -1. [Hi there page](#first-page) -2. [Set up for you page](#set-up-for-you) -3. [Device account page](#device-account) -4. [Name this device page](#name-this-device) -5. [Set up admins for this device page](#setup-admins) -6. [Update the Surface Hub](#update-surface-hub) - -Each of these sections also contains information about paths you might take when something is different. For example, most Surface Hubs will use a wired network connection, but some of them will be set up with wireless instead. Details are described where appropriate. - ->[!NOTE] ->You should have the separate keyboard that came with your Surface Hub set up and ready before beginning. See the Surface Hub Setup Guide for details. - - - -## Hi there page - - -This is the first screen you'll see when you power up the Surface Hub for the first time. It's where you input localization information for your device. - ->[!NOTE] ->This is also where you begin the optional process of deploying a provisioning package. See [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) if that's what you're doing. - - Select a language and the initial setup options are displayed. - -![Image showing ICD options checklist.](images/setuplocale.png) - -### Details - -If the default values shown are correct, then you can click **Next** to go on. Otherwise, you'll need to enter data in the appropriate boxes. - -- **Country/region:** Select the country or region where the Surface Hub will be used. -- **App language:** Apps and features will display in this language and language format. -- **Keyboard layout:** Select the keyboard layout for the on-screen and physical keyboards that will be used with your device. -- **Time zone:** Select the time zone where the Surface Hub will be used. - -### What happens? - ->[!NOTE] -> Once the settings on this page are entered, you can't come back to this screen unless you reset the device (see [Device reset](device-reset-surface-hub.md)). Make sure that the settings are properly configured before proceeding. - - - -When the settings are accepted, the device will check for a wired network connection. If the connection is fine, it will display the [Set up for you page](#set-up-for-you). If there is a problem with the wired connection, the device will display the [Network setup page](#network-setup). - -If no wired connection can be found, then the device will attempt to set up a wireless connection, and will display the [Network setup page](#network-setup). - -## Network setup page - - -If your device does not detect a wired connection that it can use to connect to a network or the Internet, you will see this page. Here you can either connect to a wireless network, or skip making the network connection. - -![Image shoring Network setup page.](images/setupnetworksetup-1.png) - -### Details - -This screen is shown only if the device fails to detect a wired network. If you see this screen, you have three choices: - -- You can select one of the wireless networks shown. If the network is secured, you'll be taken to a login page. See [Wireless network setup](#wireless) for details. -- Click **Skip this step** to skip connecting to a network. You'll be taken to the [Set up for you page](#set-up-for-you). - >[!NOTE] - >If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including system updates and email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)). - - - -- You can plug in a network cable while this screen is visible. The device will detect it, and will add **Next** to the screen. Click **Next** to continue with making the wired connection. - -### What happens? - -If the device has a wired connection when it starts, and can establish a network or Internet connection, then this page will not be displayed. If you want to connect the device to a wireless connection, make sure no Ethernet cable is plugged in at first run, which will bring you to this screen. No matter what you choose to set up now, you can [use Settings](wireless-network-management-for-surface-hub.md) to set up different connections later. - -If you want to connect to a secured wireless network from this page, click on the network of your choice, and then provide the necessary information (password or account credentials) to connect. See [Wireless network setup](#wireless). - -## Wireless network setup - - -This page will be shown when you've selected a secured wireless network. - -![Image showing wireless network setup page.](images/setupnetworksetup-3.png) - -### Details - -- **User name:** Enter the user name for the selected wireless network. -- **Password:** This is the password for the network. - -### What happens? - -The device will attempt to connect to the specified network. If it's successful, you'll be taken to the [Set up for you page](#set-up-for-you). - -## Network proxy setup - - -This page will be shown when the device detects a wired connection with limited connectivity. You have three options: - -- You can select a wireless network to use instead of the limited wired connection. -- You can skip connecting to a network by selecting **Skip this step**. You'll be taken to the [Set up for you page](#set-up-for-you). - **Note**  If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)). - - - -- You can select **Enter proxy settings** which will allow you to specify how to use the network proxy. You'll be taken to the next screen. - -![Image showing network proxy page.](images/setupnetworksetup-2.png) - -This is the screen you'll see if you clicked **Enter proxy settings** on the previous screen. - -![Image showing proxy server setting details.](images/setupnetworksetup-4.png) - -### Details - -In order to make a network connection, you'll need to fill in either a script name, or the proxy server and port info. - -- **Proxy script:** Provide the address of a proxy script. -- **Proxy server and port:** You can provide the proxy server address and port. - -### What happens? - -When you click **Next**, the device will attempt to connect to the proxy server. If successful, you'll be taken to the [Set up for you page](#set-up-for-you). - -You can skip connecting to a network by selecting **Skip this step**. You'll be taken to the [Set up for you page](#set-up-for-you). - ->[!NOTE] ->If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)). - - - -## Set up for you page - - -This screen is purely informational, and shows which recommended settings have been enabled by default. - -![Image showing set up for you page.](images/setupsetupforyou.png) - -### Details - -You should read this screen and note which services have been enabled by default. All of them can be changed using the Settings app if need be, but you should be careful about the effects of doing so. See [Intro to Surface Hub](intro-to-surface-hub.md) for details. - -Once you're done reviewing the settings, click **Next** to go on. - -### What happens? - -The settings shown on the page have already been made, and can't be changed until after first run is completed. - -## Device account page - - -On this page, the Surface Hub will ask for credentials for the device account that you previously configured. (See [Create and test a device account](create-and-test-a-device-account-surface-hub.md).) The Surface Hub will attempt to discover various properties of the account, and may ask for more information on another page if it does not succeed. - ->[!NOTE] ->This section does not cover specific errors that can happen during first run. See [Troubleshoot Surface Hub](troubleshoot-surface-hub.md) for more information on errors. - - -![Image showing Enter device account info page.](images/setupdeviceacct.png) - -### Details - -Use either a **user principal name (UPN)** or a **domain\\user name** as the account identifier in the first entry field. Use the format that matches your environment, and enter the password. - - -| Environment | Required format for device account | -|-------------------------------------------------------|------------------------------------| -| Device account is hosted only online. | username@domain.com | -| Device account is hosted only on-prem. | DOMAIN\username | -| Device account is hosted online and on-prem (hybrid). | DOMAIN\username | - -Click **Skip setting up a device account** to skip setting up a device account. However, if you don't set up a device account, the device will not be fully integrated into your infrastructure. For example, people won't be able to: - -- See a meeting calendar on the Welcome screen -- Start a meeting from the Welcome screen -- Email whiteboards from OneNote -- Use Skype for Business for meetings - -If you skip setting it up now, you can add a device account later by using the Settings app. - -If you click **Skip setting up a device account**, the device will display a dialog box showing what will happen if the device doesn't have a device account. If you choose **Yes, skip this**, you will be sent to the [Name this device page](#name-this-device). - -![Image showing message the is displayed to confirm you want to skip creating a device account.](images/setupskipdeviceacct.png) - -### What happens? - -The device will use the UPN or DOMAIN\\User name and password for the device account to do the following: - -- Check if the account exists in Active Directory (AD) or Azure Active Directory (Azure AD): - - - If a UPN was entered: the device will look for the account in Azure AD. - - If a DOMAIN\\User name was entered: the device will look for the account in AD. -- Look up the Microsoft Exchange server for the account’s mailbox. -- Look up the Session Initiation Protocol (SIP) address for the account. -- Pull the account’s display name and alias attributes. - -## Exchange server page - - -This page will only be shown if there's a problem. Typically, it means that the device account that you provided was found in Active Directory (AD) or Azure Active Directory (Azure AD), but the Exchange server for the account was not discovered. - -![Image showing Exchange server page.](images/setupexchangeserver-01.png) - -### Details - -Enter the name of the Exchange server where the device account's mailbox is hosted. - -Click **Skip setting up Exchange services** to skip this step. If you do, people will not be able to: - -- See a meeting calendar on the welcome screen. -- Start a meeting from the welcome screen. -- Email whiteboards from OneNote. - -See [Intro to Surface Hub](intro-to-surface-hub.md) for details on setup dependencies. - -You can enable Exchange services for a device account later by using the Settings app. - -If you click **Skip setting up Exchange services**, the device will display a dialog showing what will happen. If you choose **Yes, skip this**, then Exchange services will not be set up. - -![Image showing confirmation message that is displayed when you skip setting up Exchange services.](images/setupexchangeserver-02.png) - -### What happens? - -The Surface Hub will attempt to validate the device account on the Exchange server that you enter here. If the Exchange server can be reached and validates, then first run will proceed. - -If you choose to skip setting up Exchange services, the Surface Hub will stop looking for the Exchange server, and no Exchange services (mail and calendar) will be enabled. - -## Exchange policies page - - -This page will be shown when: - -- The device account is using an Exchange Active Sync (EAS) policy where the PasswordEnabled policy is set to 1. -- There’s no connection to Exchange. -- Exchange returns a status code indicating an error. (For example: The account has been provisioned to too many devices.) -- Exchange supported protocols are not supported by the Surface Hub. -- Exchange returns incorrect XML. - -![Image showing Exchange policis page.](images/setupexchangepolicies.png) - -### Details - -This page is purely informational, so no input is required. However, you have two options for proceeding: either skipping ahead or retrying the validation that caused the error. Before deciding which option is best, please read the following **What happens?** section. You may be able to fix the problem elsewhere before you click on one of the options. - -- **Click here to continue using unsupported policies**: click on this to continue first run. The Surface Hub will not be able to use Exchange services, or sync. -- **Retry**: check the policy on the Exchange server again. - -### What happens? - -The Surface Hub checks whether the device account’s EAS policy has the PasswordEnabled policy set to 0 (False). If this is not the case, mail and calendar can't be synced and the Surface Hub can't use any Exchange services. You can use your Exchange management tools from a PC to check that the device account has the PasswordEnabled policy set to 0. If that's not the case, you can reconfigure the account and click **Retry** here. - -If the policy has already been configured properly, check that your device is properly connected to the network or Internet, and can reach your Exchange server, because this page will also be shown if the Surface Hub can't reach the Exchange server. - -Another possible reason for not being able to reach Exchange is because of certificate-based authentication. You may wind up on this page because of certificate issues. Note that if the device displays error codes 0x80072F0D or 0X800C0019, then a certificate is required. Because provisioning is done on the first page of the first run process, you must disable Exchange services by clicking **Click here to continue using unsupported policies**, and then install the correct certificates through the Settings app. - -If you choose to skip this check, the Surface Hub will stop looking for the Exchange server and validating EAS policies, and no Exchange services will be enabled. See [Intro to Surface Hub](intro-to-surface-hub.md) for details on setup dependencies. - -## Name this device page - - -This page asks you to provide two names that will be used for identifying the Surface Hub. - -![Image showing Name this device page.](images/setupnamedevice.png) - -### Details - -If the default values shown are correct, then you can click **Next** to go on. Otherwise, enter data in one or both of the text boxes. - -- **Friendly name:** This is the name that people will see when they want to wirelessly connect to the Surface Hub. -- **Device name:** Can be set to any unique name as described on the screen. - -As long as both names are within the length requirements and do not use restricted characters, clicking **Next** will take you to the next page, [Set up admins for this device](#setup-admins). - -### What happens? - -The Surface Hub requires two names for the device, which will default to: - -- **Friendly name:** Defaults to the Display Name of the device account -- **Device name:** Defaults to the alias of the device account - -While either of the names can be changed later, keep in mind that: - -- The friendly name should be recognizable and different so that people can distinguish one Surface Hub from another when trying to wirelessly connect. -- If you decide to domain join the device, the device name must not be the same as any other device on the account’s Active Directory domain. The device can't join the domain if it is using the same name as another domain-joined device. - ->[!NOTE] ->If you want to enable [Miracast over Infrastructure](miracast-over-infrastructure.md), the device name needs to be discoverable via DNS. You can achieve this by either allowing your Surface Hub to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the Surface Hub's device name. - -## Set up admins for this device page - - -On this page, you will choose from several options for how you want to set up admin accounts to locally manage your device. - -Because every Surface Hub can be used by any number of authenticated employees, settings are locked down so that they can't change from session to session. Only admins can configure the settings on the device, and on this page, you’ll choose which type of admins have that privilege. - ->[!NOTE] ->The purpose of this page is primarily to determine who can configure the device from the device’s UI; that is, who can actually visit a device, log in, open up the Settings app, and make changes to the Settings. - - - -![Image showing Set up admins for this device page.](images/setupsetupadmins.png) - -### Details - -Choose one of the three available options: - -- **Use Microsoft Azure Active Directory** -- **Use Active Directory Domain Services** -- **Use a local admin** - -### What happens? - -This is what happens when you choose an option. - -- **Use Microsoft Azure Active Directory** - - Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. Members of the Azure Global Admins security group from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization. - - >[!IMPORTANT] - >Administrators added to the Azure Global Admins group after you join the device to Azure AD will be unable to use the Settings app. - > - >If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually. - -- **Use Active Directory Domain Services** - - Click this option to join the device to AD. Once you click **Next**, you’ll be taken to the [Use Active Directory Domain Services](#use-active-directory) page and asked to enter credentials that allow you to join the specified domain. After joining, you can pick a security group from the joined domain, and people from that security group will be able to use the Settings app. - -- **Use a local admin** - - Choosing this option will allow you to create a single local admin. This admin won’t be backed by any directory service, so we recommend you only choose this case if the device does not have access to Azure AD or AD. Once you create an admin’s user name and password on the [Use a local admin](#use-a-local-admin) page, you will need to re-enter those same credentials whenever you open the Settings app. - - Note that a local admin must have physical access to the Surface Hub to log in. - ->[!NOTE] ->After you finish this process, you won't be able to change the device's admin option unless you reset the device. - - - -### Use Microsoft Azure Active Directory - -If you've decided to join your Surface Hub to Azure Active Directory (Azure AD), you'll see this **What happens next** page. Read it and click **Next** to go to the **Let's get you signed in page**. - -Joining Azure AD has two primary benefits: - -1. Some employees from your organization will be able to access the device as admins, and will be able to start the Settings app and configure the device. People that have admin permissions will be defined in your Azure AD subscription. -2. If your Azure AD is connected to a mobile device management (MDM) solution, the device will enroll with that MDM solution so you can apply policies and configuration. - -![Image showing message when you join your Surface Hub to Azure Active Directory.](images/setupjoiningazuread-1.png) - -### Details - -The following input is required: - -- **User's UPN:** The user principal name (UPN) of an account that can join Azure AD. -- **Password:** The password of the account you’re using to join Azure AD. - -![Image showing account log in info.](images/setupjoiningazuread-2.png) - -If you get to this point and don't have valid credentials for an Azure AD account, the device will allow you to continue by creating a local admin account. Click **Set up Windows with a local account instead**. - -![Image showing Set up an admin account page.](images/setupjoiningazuread-3.png) - -### What happens? - -Once you enter valid Azure AD account credentials, the device will try to join the associated Azure AD organization. If this succeeds, then the device will provision employees in that organization to be local admins on the device. If your Azure AD tenant was configured for it, the device will also enroll into MDM. - -### Use Active Directory Domain Services - -This page will ask for credentials to join a domain so that the Surface Hub can provision a security group as administrators of the device. - -Once the device has been domain joined, you must specify a security group from the domain you joined. This security group will be provisioned as administrators on the Surface Hub, and anyone from the security group can enter their domain credentials to access Settings. - -![Image showing Set up admins using domain join page.](images/setupdomainjoin.png) - -### Details - -The following input is required: - -- **Domain:** This is the fully qualified domain name (FQDN) of the domain that you want to join. A security group from this domain can be used to manage the device. -- **User name:** The user name of an account that has sufficient permission to join the specified domain. -- **Password:** The password for the account. - -After the credentials are verified, you will be asked to type a security group name. This input is required. - -![Image showing Enter a security group page.](images/setupsecuritygroup-1.png) - -### What happens? - -Using the provided domain, account credentials from the [Use Active Directory Domain Services page](#use-active-directory) and the device name from the [Name this device](#name-this-device) page, the Surface Hub will attempt to join the domain. If the join is successful, first run will continue, and will ask for a security group. If the join is not successful, first run will halt and ask you to change the information provided. - -If the join is successful, you'll see the **Enter a security group** page. When you click the **Select** button on this page, the device will search for the specified security group on your domain. If found, the group will be verified. Click **Finish** to complete the first run process. - ->[!NOTE] ->If you domain join the Surface Hub, you can't unjoin the device without resetting it. - - - -### Use a local admin - -If you decide not to use Azure Active Directory (Azure AD) or Active Directory (AD) to manage the Surface Hub, you'll need to create a local admin account. - -![Image showing Set up an admin account for local admin.](images/setuplocaladmin.png) - -### Details - -The following input is required: - -- **User name:** This is the user name of the local admin account that will be created for this Surface Hub. -- **Password:** This is the password of the device account. -- **Re-enter password:** Verifying the password as in the previous box. - -### What happens? - -This page will attempt to create a new admin account using the credentials that you enter here. If it's successful, then first run will end. If not, you'll be asked for different credentials. - -## Update the Surface Hub - - ->[!IMPORTANT] ->Before you do the updates, make sure you read [Save your BitLocker key](save-bitlocker-key-surface-hub.md) in order to make sure you have a backup of the key. - - - -In order to get the latest features and fixes, you should update your Surface Hub as soon as you finish all of the preceding first-run steps. - -1. Make sure the device has access to the Windows Update servers or to Windows Server Update Services (WSUS). To configure WSUS, see [Using WSUS](manage-windows-updates-for-surface-hub.md#use-windows-server-update-services). -2. Open Settings, click **Update & security**, then **Windows Update**, and then click **Check for updates**. -3. If updates are available, they will be downloaded. Once downloading is complete, click the **Update now** button to install the updates. -4. Follow the onscreen prompts after the updates are installed. You may need to restart the device. - - - - - - - - - diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md deleted file mode 100644 index 1b001aa627..0000000000 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ /dev/null @@ -1,414 +0,0 @@ ---- -title: Hybrid deployment (Surface Hub) -description: A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. -ms.assetid: 7BFBB7BE-F587-422E-9CE4-C9DDF829E4F1 -ms.reviewer: -manager: dansimp -keywords: hybrid deployment, device account for Surface Hub, Exchange hosted on-prem, Exchange hosted online -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 08/30/2018 -ms.localizationpriority: medium ---- - -# Hybrid deployment (Surface Hub) -A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).) - ->[!NOTE] ->In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-prem). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet. - - -## Exchange on-premises -Use this procedure if you use Exchange on-premises. - -1. For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. This account will be synced to Office 365. - - - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. - - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.

          - - ![New object box for creating a new user in active directory.](images/hybriddeployment-01a.png) - - - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected. - - >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account. - - ![Image showing password dialog box.](images/hybriddeployment-02a.png) - - - Click **Finish** to create the account. - - ![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png) - - - -2. Enable the remote mailbox. - - Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet. - - ```PowerShell - Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room - ``` - >[!NOTE] - >If you don't have an on-premises Exchange environment to run this cmdlet, you can make the same changes directly to the Active Directory object for the account. - > - >msExchRemoteRecipientType = 33 - > - >msExchRecipientDisplayType = -2147481850 - > - >msExchRecipientTypeDetails = 8589934592 - -3. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Microsoft 365 admin center and verify that the account created in the previous steps has merged to online. - -4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365. - - Start a remote PowerShell session on a PC and connect to Microsoft Exchange. Be sure you have the right permissions set to run the associated cmdlets. - - The next steps will be run on your Office 365 tenant. - - ```PowerShell - Set-ExecutionPolicy RemoteSigned - $cred=Get-Credential -Message "Please use your Office 365 admin credentials" - $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection - Import-PSSession $sess - ``` - -5. Create a new Exchange ActiveSync policy, or use a compatible existing policy. - - After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet—-this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. - - ```PowerShell - Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id - ``` - -6. Set Exchange properties. - - Setting Exchange properties on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse 'This is a Surface Hub room!' - ``` - -7. Connect to Azure AD. - - You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command : - ```PowerShell - Install-Module -Name AzureAD - ``` - - You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. - - ```PowerShell - Import-Module AzureAD - Connect-AzureAD -Credential $cred - ``` -8. Assign an Office 365 license. - - The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account. - - You can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - - Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - - ```PowerShell - Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" - - Get-AzureADSubscribedSku | Select Sku*,*Units - $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense - $License.SkuId = SkuId You selected - - $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses - $AssignedLicenses.AddLicenses = $License - $AssignedLicenses.RemoveLicenses = @() - - Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses - ``` - -Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid). - - -### Skype for Business Online - -To enable Skype for Business online, your tenant users must have Exchange mailboxes (at least one Exchange mailbox in the tenant is required). The following table explains which plans or additional services you need. - -| Skype room system scenario | If you have Office 365 Premium, Office 365 ProPlus, or Skype for Business Standalone Plan 2, you need: | If you have an Enterprise-based plan, you need: | If you have Skype for Business Server 2015 (on-premises or hybrid), you need: | -| --- | --- | --- | --- | -| Join a scheduled meeting | Skype for Business Standalone Plan 1 | E1, 3, 4, or 5 | Skype for Business Server Standard CAL | -| Initiate an ad-hoc meeting | Skype for Business Standalone Plan 2 | E 1, 3, 4, or 5 | Skype for Business Server Standard CAL or Enterprise CAL | -| Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with Audio Conferencing

          **Note** PSTN consumption billing is optional | E1 or E3 with Audio Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL | -| Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Phone System and a PSTN Voice Calling plan | E1 or E3 with Phone System and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL | - -The following table lists the Office 365 plans and Skype for Business options. - -| O365 Plan | Skype for Business | Phone System | Audio Conferencing | Calling Plans | -| --- | --- | --- | --- | --- | -| O365 Business Essentials | Included | | | | -| O365 Business Premium | Included | | | | -| E1 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) | -| E3 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) | -| E5 | Included | Included | Included | Add-on | - -1. Start by creating a remote PowerShell session from a PC to the Skype for Business online environment. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - -2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName - ``` - - If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - - ```PowerShell - Get-CsOnlineUser -Identity ‘HUB01@contoso.com’| fl *registrarpool* - ``` - -3. Assign Skype for Business license to your Surface Hub account. - - Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device. - - - Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app. - - - Click on **Users and Groups** and then **Add users, reset passwords, and more**. - - - Click the Surface Hub account, and then click the pen icon to edit the account information. - - - Click **Licenses**. - - - In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub. - - - Click **Save**. - - >[!NOTE] - >You can also use the Windows Azure Active Directory Module for Windows Powershell to run the cmdlets needed to assign one of these licenses, but that's not covered here. - -For validation, you should be able to use any Skype for Business client (PC, Android, etc.) to sign in to this account. - -### Skype for Business on-premises - -To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run: - -``` -Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName -``` - -### Skype for Business hybrid - -If your organization has set up [hybrid connectivity between Skype for Business Server and Skype for Business Online](https://technet.microsoft.com/library/jj205403.aspx), the guidance for creating accounts differs from a standard Surface Hub deployment. - -The Surface Hub requires a Skype account of the type `meetingroom`, while a normal user would use a user type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. - -In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet. - ->[!NOTE] ->To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p). - - -## Exchange online -Use this procedure if you use Exchange online. - -1. Create an email account in Office 365. - - Start a remote PowerShell session on a PC and connect to Exchange. Be sure you have the right permissions set to run the associated cmdlets. - - ```PowerShell - Set-ExecutionPolicy RemoteSigned - $cred=Get-Credential -Message "Please use your Office 365 admin credentials" - $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection - Import-PSSession $sess - ``` - -2. Set up mailbox. - - After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub. - - If you're changing an existing resource mailbox: - - ```PowerShell - Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - - If you’re creating a new resource mailbox: - - ```PowerShell - New-Mailbox -MicrosoftOnlineServicesID 'HUB01@contoso.com' -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - -3. Create Exchange ActiveSync policy. - - After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too. - - ```PowerShell - Set-Mailbox 'HUB01@contoso.com' -Type Regular - Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id - Set-Mailbox 'HUB01@contoso.com' -Type Room - $credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password" - Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - ``` - -4. Set Exchange properties. - - Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. Add email address for your on-premises domain account. - - For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. - - - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. - - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**. - - ![New object box for creating a new user in Active Directory.](images/hybriddeployment-01a.png) - - - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected. - - >[!IMPORTANT] - >Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account. - - ![Image showing password dialog box.](images/hybriddeployment-02a.png) - - - Click **Finish** to create the account. - - ![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png) - -6. Run directory synchronization. - - After you've created the account, run a directory synchronization. When it's complete, go to the users page and verify that the two accounts created in the previous steps have merged. - -7. Connect to Azure AD. - - You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command : - - ```PowerShell - Install-Module -Name AzureAD - ``` - You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. - - ```PowerShell - Import-Module AzureAD - Connect-AzureAD -Credential $cred - ``` - -8. Assign an Office 365 license. - - The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account. - - Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - - Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - - ```PowerShell - Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" - - Get-AzureADSubscribedSku | Select Sku*,*Units - $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense - $License.SkuId = SkuId You selected - - $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses - $AssignedLicenses.AddLicenses = $License - $AssignedLicenses.RemoveLicenses = @() - - Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses - ``` - -Next, you enable the device account with [Skype for Business Online](#sfb-online), [Skype for Business on-premises](#sfb-onprem), or [Skype for Business hybrid](#sfb-hybrid). - - -### Skype for Business Online - -In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](#sfb-online). - -1. Start by creating a remote PowerShell session to the Skype for Business online environment from a PC. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - -2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool - 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName - ``` - - If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - - ```PowerShell - Get-CsOnlineUser -Identity 'HUB01@contoso.com'| fl *registrarpool* - ``` - -10. Assign Skype for Business license to your Surface Hub account - - Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device. - - - Sign in as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app. - - - Click on **Users and Groups** and then **Add users, reset passwords, and more**. - - - Click the Surface Hub account, and then click the pen icon to edit the account information. - - - Click **Licenses**. - - - In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub. - - - Click **Save**. - - >[!NOTE] - > You can also use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here. - -For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account. - - -### Skype for Business on-premises - -To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run: - -```PowerShell -Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName -``` - - -### Skype for Business hybrid - -If your organization has set up [hybrid connectivity between Skype for Business Server and Skype for Business Online](https://technet.microsoft.com/library/jj205403.aspx), the guidance for creating accounts differs from a standard Surface Hub deployment. - -The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. - -In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet. - ->[!NOTE] ->To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p). - diff --git a/devices/surface-hub/images/01-diagnostic.png b/devices/surface-hub/images/01-diagnostic.png deleted file mode 100644 index fde5951776..0000000000 Binary files a/devices/surface-hub/images/01-diagnostic.png and /dev/null differ diff --git a/devices/surface-hub/images/01-escape.png b/devices/surface-hub/images/01-escape.png deleted file mode 100644 index badfc5883d..0000000000 Binary files a/devices/surface-hub/images/01-escape.png and /dev/null differ diff --git a/devices/surface-hub/images/02-all-apps.png b/devices/surface-hub/images/02-all-apps.png deleted file mode 100644 index a29e9d8428..0000000000 Binary files a/devices/surface-hub/images/02-all-apps.png and /dev/null differ diff --git a/devices/surface-hub/images/02-skip-this-drive.png b/devices/surface-hub/images/02-skip-this-drive.png deleted file mode 100644 index 930f0b26d3..0000000000 Binary files a/devices/surface-hub/images/02-skip-this-drive.png and /dev/null differ diff --git a/devices/surface-hub/images/03-recover-from-cloud.png b/devices/surface-hub/images/03-recover-from-cloud.png deleted file mode 100644 index be422cecc8..0000000000 Binary files a/devices/surface-hub/images/03-recover-from-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/03-welcome.png b/devices/surface-hub/images/03-welcome.png deleted file mode 100644 index b71ebe0752..0000000000 Binary files a/devices/surface-hub/images/03-welcome.png and /dev/null differ diff --git a/devices/surface-hub/images/04-test-results-1.png b/devices/surface-hub/images/04-test-results-1.png deleted file mode 100644 index e0b53f2dc3..0000000000 Binary files a/devices/surface-hub/images/04-test-results-1.png and /dev/null differ diff --git a/devices/surface-hub/images/04-yes.png b/devices/surface-hub/images/04-yes.png deleted file mode 100644 index 9c26b795ce..0000000000 Binary files a/devices/surface-hub/images/04-yes.png and /dev/null differ diff --git a/devices/surface-hub/images/05-test-results-2.png b/devices/surface-hub/images/05-test-results-2.png deleted file mode 100644 index 55b7c7abed..0000000000 Binary files a/devices/surface-hub/images/05-test-results-2.png and /dev/null differ diff --git a/devices/surface-hub/images/05a-reinstall.png b/devices/surface-hub/images/05a-reinstall.png deleted file mode 100644 index 60d90928ba..0000000000 Binary files a/devices/surface-hub/images/05a-reinstall.png and /dev/null differ diff --git a/devices/surface-hub/images/05b-downloading.png b/devices/surface-hub/images/05b-downloading.png deleted file mode 100644 index 59393e7162..0000000000 Binary files a/devices/surface-hub/images/05b-downloading.png and /dev/null differ diff --git a/devices/surface-hub/images/06-account-settings.png b/devices/surface-hub/images/06-account-settings.png deleted file mode 100644 index 35a92f2ff8..0000000000 Binary files a/devices/surface-hub/images/06-account-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/06-out-of-box.png b/devices/surface-hub/images/06-out-of-box.png deleted file mode 100644 index a513b46c5b..0000000000 Binary files a/devices/surface-hub/images/06-out-of-box.png and /dev/null differ diff --git a/devices/surface-hub/images/07-account-settings-details.png b/devices/surface-hub/images/07-account-settings-details.png deleted file mode 100644 index 421f372b03..0000000000 Binary files a/devices/surface-hub/images/07-account-settings-details.png and /dev/null differ diff --git a/devices/surface-hub/images/07-cancel.png b/devices/surface-hub/images/07-cancel.png deleted file mode 100644 index a788960011..0000000000 Binary files a/devices/surface-hub/images/07-cancel.png and /dev/null differ diff --git a/devices/surface-hub/images/08-test-account.png b/devices/surface-hub/images/08-test-account.png deleted file mode 100644 index d7cbf9620d..0000000000 Binary files a/devices/surface-hub/images/08-test-account.png and /dev/null differ diff --git a/devices/surface-hub/images/08-troubleshoot.png b/devices/surface-hub/images/08-troubleshoot.png deleted file mode 100644 index d2af1969bd..0000000000 Binary files a/devices/surface-hub/images/08-troubleshoot.png and /dev/null differ diff --git a/devices/surface-hub/images/09-network.png b/devices/surface-hub/images/09-network.png deleted file mode 100644 index d69f2d67ec..0000000000 Binary files a/devices/surface-hub/images/09-network.png and /dev/null differ diff --git a/devices/surface-hub/images/09-recover-from-cloud2.png b/devices/surface-hub/images/09-recover-from-cloud2.png deleted file mode 100644 index 64650a91bb..0000000000 Binary files a/devices/surface-hub/images/09-recover-from-cloud2.png and /dev/null differ diff --git a/devices/surface-hub/images/10-cancel.png b/devices/surface-hub/images/10-cancel.png deleted file mode 100644 index ffef745522..0000000000 Binary files a/devices/surface-hub/images/10-cancel.png and /dev/null differ diff --git a/devices/surface-hub/images/10-environment.png b/devices/surface-hub/images/10-environment.png deleted file mode 100644 index 376e077249..0000000000 Binary files a/devices/surface-hub/images/10-environment.png and /dev/null differ diff --git a/devices/surface-hub/images/11-certificates.png b/devices/surface-hub/images/11-certificates.png deleted file mode 100644 index 13b45396b3..0000000000 Binary files a/devices/surface-hub/images/11-certificates.png and /dev/null differ diff --git a/devices/surface-hub/images/12-trust-model.png b/devices/surface-hub/images/12-trust-model.png deleted file mode 100644 index 996bb4fdd4..0000000000 Binary files a/devices/surface-hub/images/12-trust-model.png and /dev/null differ diff --git a/devices/surface-hub/images/2s-mount-pattern.png b/devices/surface-hub/images/2s-mount-pattern.png deleted file mode 100644 index 92262fb428..0000000000 Binary files a/devices/surface-hub/images/2s-mount-pattern.png and /dev/null differ diff --git a/devices/surface-hub/images/35mm.png b/devices/surface-hub/images/35mm.png deleted file mode 100644 index 7a414337b6..0000000000 Binary files a/devices/surface-hub/images/35mm.png and /dev/null differ diff --git a/devices/surface-hub/images/ICDstart-option.PNG b/devices/surface-hub/images/ICDstart-option.PNG deleted file mode 100644 index 1ba49bb261..0000000000 Binary files a/devices/surface-hub/images/ICDstart-option.PNG and /dev/null differ diff --git a/devices/surface-hub/images/OOBE-2.jpg b/devices/surface-hub/images/OOBE-2.jpg deleted file mode 100644 index 0c615a2ec4..0000000000 Binary files a/devices/surface-hub/images/OOBE-2.jpg and /dev/null differ diff --git a/devices/surface-hub/images/account-management-details.PNG b/devices/surface-hub/images/account-management-details.PNG deleted file mode 100644 index 66712394ec..0000000000 Binary files a/devices/surface-hub/images/account-management-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/account-management.PNG b/devices/surface-hub/images/account-management.PNG deleted file mode 100644 index 34165dfcd6..0000000000 Binary files a/devices/surface-hub/images/account-management.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-applications-details.PNG b/devices/surface-hub/images/add-applications-details.PNG deleted file mode 100644 index 2efd3483ae..0000000000 Binary files a/devices/surface-hub/images/add-applications-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-applications.PNG b/devices/surface-hub/images/add-applications.PNG deleted file mode 100644 index 2316deb2fd..0000000000 Binary files a/devices/surface-hub/images/add-applications.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-certificates-details.PNG b/devices/surface-hub/images/add-certificates-details.PNG deleted file mode 100644 index 78cd783282..0000000000 Binary files a/devices/surface-hub/images/add-certificates-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-certificates.PNG b/devices/surface-hub/images/add-certificates.PNG deleted file mode 100644 index 24cb605d1c..0000000000 Binary files a/devices/surface-hub/images/add-certificates.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-config-file-details.PNG b/devices/surface-hub/images/add-config-file-details.PNG deleted file mode 100644 index c7b4db97e6..0000000000 Binary files a/devices/surface-hub/images/add-config-file-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-config-file.PNG b/devices/surface-hub/images/add-config-file.PNG deleted file mode 100644 index 5b779509d9..0000000000 Binary files a/devices/surface-hub/images/add-config-file.PNG and /dev/null differ diff --git a/devices/surface-hub/images/adjust-room-audio.png b/devices/surface-hub/images/adjust-room-audio.png deleted file mode 100644 index 3d0eef5ed7..0000000000 Binary files a/devices/surface-hub/images/adjust-room-audio.png and /dev/null differ diff --git a/devices/surface-hub/images/analog.png b/devices/surface-hub/images/analog.png deleted file mode 100644 index 1f1666903b..0000000000 Binary files a/devices/surface-hub/images/analog.png and /dev/null differ diff --git a/devices/surface-hub/images/approve-signin.png b/devices/surface-hub/images/approve-signin.png deleted file mode 100644 index 7736b95431..0000000000 Binary files a/devices/surface-hub/images/approve-signin.png and /dev/null differ diff --git a/devices/surface-hub/images/approve-signin2.png b/devices/surface-hub/images/approve-signin2.png deleted file mode 100644 index 2ccfc40ecc..0000000000 Binary files a/devices/surface-hub/images/approve-signin2.png and /dev/null differ diff --git a/devices/surface-hub/images/apps.png b/devices/surface-hub/images/apps.png deleted file mode 100644 index 5cb3b7ec8f..0000000000 Binary files a/devices/surface-hub/images/apps.png and /dev/null differ diff --git a/devices/surface-hub/images/attendees.png b/devices/surface-hub/images/attendees.png deleted file mode 100644 index fd468aa971..0000000000 Binary files a/devices/surface-hub/images/attendees.png and /dev/null differ diff --git a/devices/surface-hub/images/caution.PNG b/devices/surface-hub/images/caution.PNG deleted file mode 100644 index 0f87b07c0f..0000000000 Binary files a/devices/surface-hub/images/caution.PNG and /dev/null differ diff --git a/devices/surface-hub/images/choose-package.png b/devices/surface-hub/images/choose-package.png deleted file mode 100644 index 2bf7a18648..0000000000 Binary files a/devices/surface-hub/images/choose-package.png and /dev/null differ diff --git a/devices/surface-hub/images/connect-aad.png b/devices/surface-hub/images/connect-aad.png deleted file mode 100644 index 8583866165..0000000000 Binary files a/devices/surface-hub/images/connect-aad.png and /dev/null differ diff --git a/devices/surface-hub/images/deploy1.png b/devices/surface-hub/images/deploy1.png deleted file mode 100644 index 1c5c119303..0000000000 Binary files a/devices/surface-hub/images/deploy1.png and /dev/null differ diff --git a/devices/surface-hub/images/deploy2.png b/devices/surface-hub/images/deploy2.png deleted file mode 100644 index 2b035e979f..0000000000 Binary files a/devices/surface-hub/images/deploy2.png and /dev/null differ diff --git a/devices/surface-hub/images/deploy3.png b/devices/surface-hub/images/deploy3.png deleted file mode 100644 index 56621a24dc..0000000000 Binary files a/devices/surface-hub/images/deploy3.png and /dev/null differ diff --git a/devices/surface-hub/images/deploymentoptions-01.png b/devices/surface-hub/images/deploymentoptions-01.png deleted file mode 100644 index 05a5eb45c6..0000000000 Binary files a/devices/surface-hub/images/deploymentoptions-01.png and /dev/null differ diff --git a/devices/surface-hub/images/developer-setup.PNG b/devices/surface-hub/images/developer-setup.PNG deleted file mode 100644 index 8c93d5ed91..0000000000 Binary files a/devices/surface-hub/images/developer-setup.PNG and /dev/null differ diff --git a/devices/surface-hub/images/device-family.png b/devices/surface-hub/images/device-family.png deleted file mode 100644 index 1efe12fc57..0000000000 Binary files a/devices/surface-hub/images/device-family.png and /dev/null differ diff --git a/devices/surface-hub/images/dport.png b/devices/surface-hub/images/dport.png deleted file mode 100644 index 2842f96ad4..0000000000 Binary files a/devices/surface-hub/images/dport.png and /dev/null differ diff --git a/devices/surface-hub/images/dportio.png b/devices/surface-hub/images/dportio.png deleted file mode 100644 index 02bf145d60..0000000000 Binary files a/devices/surface-hub/images/dportio.png and /dev/null differ diff --git a/devices/surface-hub/images/dportout.png b/devices/surface-hub/images/dportout.png deleted file mode 100644 index 4b6bb87663..0000000000 Binary files a/devices/surface-hub/images/dportout.png and /dev/null differ diff --git a/devices/surface-hub/images/ease-of-access.png b/devices/surface-hub/images/ease-of-access.png deleted file mode 100644 index 2cb79254f8..0000000000 Binary files a/devices/surface-hub/images/ease-of-access.png and /dev/null differ diff --git a/devices/surface-hub/images/end-session.png b/devices/surface-hub/images/end-session.png deleted file mode 100644 index 4b28583af4..0000000000 Binary files a/devices/surface-hub/images/end-session.png and /dev/null differ diff --git a/devices/surface-hub/images/enroll-mdm-details.PNG b/devices/surface-hub/images/enroll-mdm-details.PNG deleted file mode 100644 index f3a7fea8da..0000000000 Binary files a/devices/surface-hub/images/enroll-mdm-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/enroll-mdm.PNG b/devices/surface-hub/images/enroll-mdm.PNG deleted file mode 100644 index b7cfdbc767..0000000000 Binary files a/devices/surface-hub/images/enroll-mdm.PNG and /dev/null differ diff --git a/devices/surface-hub/images/express-settings.png b/devices/surface-hub/images/express-settings.png deleted file mode 100644 index 99e9c4825a..0000000000 Binary files a/devices/surface-hub/images/express-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/finish-details.png b/devices/surface-hub/images/finish-details.png deleted file mode 100644 index 727efac696..0000000000 Binary files a/devices/surface-hub/images/finish-details.png and /dev/null differ diff --git a/devices/surface-hub/images/finish.PNG b/devices/surface-hub/images/finish.PNG deleted file mode 100644 index 7c65da1799..0000000000 Binary files a/devices/surface-hub/images/finish.PNG and /dev/null differ diff --git a/devices/surface-hub/images/five.png b/devices/surface-hub/images/five.png deleted file mode 100644 index 961f0e15b7..0000000000 Binary files a/devices/surface-hub/images/five.png and /dev/null differ diff --git a/devices/surface-hub/images/four.png b/devices/surface-hub/images/four.png deleted file mode 100644 index 0fef213b37..0000000000 Binary files a/devices/surface-hub/images/four.png and /dev/null differ diff --git a/devices/surface-hub/images/getstarted.png b/devices/surface-hub/images/getstarted.png deleted file mode 100644 index e5b85dd8ae..0000000000 Binary files a/devices/surface-hub/images/getstarted.png and /dev/null differ diff --git a/devices/surface-hub/images/h2gen-platemount.png b/devices/surface-hub/images/h2gen-platemount.png deleted file mode 100644 index 4a8ca76fd4..0000000000 Binary files a/devices/surface-hub/images/h2gen-platemount.png and /dev/null differ diff --git a/devices/surface-hub/images/h2gen-railmount.png b/devices/surface-hub/images/h2gen-railmount.png deleted file mode 100644 index 0c8bf8ffb6..0000000000 Binary files a/devices/surface-hub/images/h2gen-railmount.png and /dev/null differ diff --git a/devices/surface-hub/images/hdmi.png b/devices/surface-hub/images/hdmi.png deleted file mode 100644 index a2c69ace45..0000000000 Binary files a/devices/surface-hub/images/hdmi.png and /dev/null differ diff --git a/devices/surface-hub/images/hub2s-rear.png b/devices/surface-hub/images/hub2s-rear.png deleted file mode 100644 index f30a81159c..0000000000 Binary files a/devices/surface-hub/images/hub2s-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/hub2s-schematic.png b/devices/surface-hub/images/hub2s-schematic.png deleted file mode 100644 index 28c328a005..0000000000 Binary files a/devices/surface-hub/images/hub2s-schematic.png and /dev/null differ diff --git a/devices/surface-hub/images/hybriddeployment-01a.png b/devices/surface-hub/images/hybriddeployment-01a.png deleted file mode 100644 index 9eb84f777f..0000000000 Binary files a/devices/surface-hub/images/hybriddeployment-01a.png and /dev/null differ diff --git a/devices/surface-hub/images/hybriddeployment-02a.png b/devices/surface-hub/images/hybriddeployment-02a.png deleted file mode 100644 index 85229d2d0d..0000000000 Binary files a/devices/surface-hub/images/hybriddeployment-02a.png and /dev/null differ diff --git a/devices/surface-hub/images/hybriddeployment-03a.png b/devices/surface-hub/images/hybriddeployment-03a.png deleted file mode 100644 index 42cd08d900..0000000000 Binary files a/devices/surface-hub/images/hybriddeployment-03a.png and /dev/null differ diff --git a/devices/surface-hub/images/icd-common-settings.png b/devices/surface-hub/images/icd-common-settings.png deleted file mode 100644 index c2a8eb807f..0000000000 Binary files a/devices/surface-hub/images/icd-common-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/icd-new-project.png b/devices/surface-hub/images/icd-new-project.png deleted file mode 100644 index 8a5c64fa4e..0000000000 Binary files a/devices/surface-hub/images/icd-new-project.png and /dev/null differ diff --git a/devices/surface-hub/images/icd-simple-edit.png b/devices/surface-hub/images/icd-simple-edit.png deleted file mode 100644 index aea2e24c8a..0000000000 Binary files a/devices/surface-hub/images/icd-simple-edit.png and /dev/null differ diff --git a/devices/surface-hub/images/idcfeatureschecklist.png b/devices/surface-hub/images/idcfeatureschecklist.png deleted file mode 100644 index a58d20fcb2..0000000000 Binary files a/devices/surface-hub/images/idcfeatureschecklist.png and /dev/null differ diff --git a/devices/surface-hub/images/iec.png b/devices/surface-hub/images/iec.png deleted file mode 100644 index 7ca6e9237b..0000000000 Binary files a/devices/surface-hub/images/iec.png and /dev/null differ diff --git a/devices/surface-hub/images/intune-save-policy.png b/devices/surface-hub/images/intune-save-policy.png deleted file mode 100644 index f53cc85602..0000000000 Binary files a/devices/surface-hub/images/intune-save-policy.png and /dev/null differ diff --git a/devices/surface-hub/images/intune-template.png b/devices/surface-hub/images/intune-template.png deleted file mode 100644 index 047aed6502..0000000000 Binary files a/devices/surface-hub/images/intune-template.png and /dev/null differ diff --git a/devices/surface-hub/images/key-55.png b/devices/surface-hub/images/key-55.png deleted file mode 100644 index d0ee9a5d13..0000000000 Binary files a/devices/surface-hub/images/key-55.png and /dev/null differ diff --git a/devices/surface-hub/images/license-terms.png b/devices/surface-hub/images/license-terms.png deleted file mode 100644 index 8dd34b0a18..0000000000 Binary files a/devices/surface-hub/images/license-terms.png and /dev/null differ diff --git a/devices/surface-hub/images/manage1.png b/devices/surface-hub/images/manage1.png deleted file mode 100644 index 4caf53b809..0000000000 Binary files a/devices/surface-hub/images/manage1.png and /dev/null differ diff --git a/devices/surface-hub/images/manage2.png b/devices/surface-hub/images/manage2.png deleted file mode 100644 index cb232cffa6..0000000000 Binary files a/devices/surface-hub/images/manage2.png and /dev/null differ diff --git a/devices/surface-hub/images/manage3.png b/devices/surface-hub/images/manage3.png deleted file mode 100644 index 9da88b808e..0000000000 Binary files a/devices/surface-hub/images/manage3.png and /dev/null differ diff --git a/devices/surface-hub/images/manage4.png b/devices/surface-hub/images/manage4.png deleted file mode 100644 index 5c9553718e..0000000000 Binary files a/devices/surface-hub/images/manage4.png and /dev/null differ diff --git a/devices/surface-hub/images/managesettingsmdm-enroll.png b/devices/surface-hub/images/managesettingsmdm-enroll.png deleted file mode 100644 index fe33277b4e..0000000000 Binary files a/devices/surface-hub/images/managesettingsmdm-enroll.png and /dev/null differ diff --git a/devices/surface-hub/images/mfa-options.png b/devices/surface-hub/images/mfa-options.png deleted file mode 100644 index 5bd3defd01..0000000000 Binary files a/devices/surface-hub/images/mfa-options.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwired-01.png b/devices/surface-hub/images/networkmgtwired-01.png deleted file mode 100644 index d2c1748b0b..0000000000 Binary files a/devices/surface-hub/images/networkmgtwired-01.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwired-02.png b/devices/surface-hub/images/networkmgtwired-02.png deleted file mode 100644 index 7312b644d0..0000000000 Binary files a/devices/surface-hub/images/networkmgtwired-02.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-01.png b/devices/surface-hub/images/networkmgtwireless-01.png deleted file mode 100644 index 0ccdc9f5c7..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-01.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-02.png b/devices/surface-hub/images/networkmgtwireless-02.png deleted file mode 100644 index 5e9ccb9d99..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-02.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-03.png b/devices/surface-hub/images/networkmgtwireless-03.png deleted file mode 100644 index 33954daf1a..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-03.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-04.png b/devices/surface-hub/images/networkmgtwireless-04.png deleted file mode 100644 index c1d0e6ec6d..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-04.png and /dev/null differ diff --git a/devices/surface-hub/images/new-user-hybrid-voice.png b/devices/surface-hub/images/new-user-hybrid-voice.png deleted file mode 100644 index e291f9ebca..0000000000 Binary files a/devices/surface-hub/images/new-user-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/new-user-password-hybrid-voice.png b/devices/surface-hub/images/new-user-password-hybrid-voice.png deleted file mode 100644 index 1ae4d5560b..0000000000 Binary files a/devices/surface-hub/images/new-user-password-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/oma-uri.png b/devices/surface-hub/images/oma-uri.png deleted file mode 100644 index b6d4a325d0..0000000000 Binary files a/devices/surface-hub/images/oma-uri.png and /dev/null differ diff --git a/devices/surface-hub/images/one.png b/devices/surface-hub/images/one.png deleted file mode 100644 index 42b4742c49..0000000000 Binary files a/devices/surface-hub/images/one.png and /dev/null differ diff --git a/devices/surface-hub/images/oobe.jpg b/devices/surface-hub/images/oobe.jpg deleted file mode 100644 index 53a5dab6bf..0000000000 Binary files a/devices/surface-hub/images/oobe.jpg and /dev/null differ diff --git a/devices/surface-hub/images/plan1.png b/devices/surface-hub/images/plan1.png deleted file mode 100644 index 891e1e43a6..0000000000 Binary files a/devices/surface-hub/images/plan1.png and /dev/null differ diff --git a/devices/surface-hub/images/plan2.png b/devices/surface-hub/images/plan2.png deleted file mode 100644 index 3ad1f2b9fc..0000000000 Binary files a/devices/surface-hub/images/plan2.png and /dev/null differ diff --git a/devices/surface-hub/images/plan3.png b/devices/surface-hub/images/plan3.png deleted file mode 100644 index 1891d1d2b5..0000000000 Binary files a/devices/surface-hub/images/plan3.png and /dev/null differ diff --git a/devices/surface-hub/images/ppkg-config.png b/devices/surface-hub/images/ppkg-config.png deleted file mode 100644 index 10a2b7de58..0000000000 Binary files a/devices/surface-hub/images/ppkg-config.png and /dev/null differ diff --git a/devices/surface-hub/images/ppkg-csv.png b/devices/surface-hub/images/ppkg-csv.png deleted file mode 100644 index 0648f555e1..0000000000 Binary files a/devices/surface-hub/images/ppkg-csv.png and /dev/null differ diff --git a/devices/surface-hub/images/product-license-hybrid-voice.png b/devices/surface-hub/images/product-license-hybrid-voice.png deleted file mode 100644 index 3d16aeb467..0000000000 Binary files a/devices/surface-hub/images/product-license-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/prov.jpg b/devices/surface-hub/images/prov.jpg deleted file mode 100644 index 1593ccb36b..0000000000 Binary files a/devices/surface-hub/images/prov.jpg and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-01.png b/devices/surface-hub/images/provisioningpackageoobe-01.png deleted file mode 100644 index 72774987c7..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-01.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-02.png b/devices/surface-hub/images/provisioningpackageoobe-02.png deleted file mode 100644 index 43d283a316..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-02.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-03.png b/devices/surface-hub/images/provisioningpackageoobe-03.png deleted file mode 100644 index 84b037292f..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-03.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-04.png b/devices/surface-hub/images/provisioningpackageoobe-04.png deleted file mode 100644 index 9c854e8084..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-04.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackagesettings-01.png b/devices/surface-hub/images/provisioningpackagesettings-01.png deleted file mode 100644 index b42614c566..0000000000 Binary files a/devices/surface-hub/images/provisioningpackagesettings-01.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackagesettings-02.png b/devices/surface-hub/images/provisioningpackagesettings-02.png deleted file mode 100644 index f6cae68e8b..0000000000 Binary files a/devices/surface-hub/images/provisioningpackagesettings-02.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackagesettings-03.png b/devices/surface-hub/images/provisioningpackagesettings-03.png deleted file mode 100644 index e4538d7368..0000000000 Binary files a/devices/surface-hub/images/provisioningpackagesettings-03.png and /dev/null differ diff --git a/devices/surface-hub/images/proxy-details.PNG b/devices/surface-hub/images/proxy-details.PNG deleted file mode 100644 index fcc7b06a41..0000000000 Binary files a/devices/surface-hub/images/proxy-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/proxy.PNG b/devices/surface-hub/images/proxy.PNG deleted file mode 100644 index cdfc02c454..0000000000 Binary files a/devices/surface-hub/images/proxy.PNG and /dev/null differ diff --git a/devices/surface-hub/images/qos-create.png b/devices/surface-hub/images/qos-create.png deleted file mode 100644 index 7cd4726ddb..0000000000 Binary files a/devices/surface-hub/images/qos-create.png and /dev/null differ diff --git a/devices/surface-hub/images/qos-setting.png b/devices/surface-hub/images/qos-setting.png deleted file mode 100644 index d775d9a46f..0000000000 Binary files a/devices/surface-hub/images/qos-setting.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-from-cloud.png b/devices/surface-hub/images/recover-from-cloud.png deleted file mode 100644 index 7d409edc5f..0000000000 Binary files a/devices/surface-hub/images/recover-from-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-from-the-cloud.png b/devices/surface-hub/images/recover-from-the-cloud.png deleted file mode 100644 index 07c1e22851..0000000000 Binary files a/devices/surface-hub/images/recover-from-the-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-progress.png b/devices/surface-hub/images/recover-progress.png deleted file mode 100644 index 316d830a57..0000000000 Binary files a/devices/surface-hub/images/recover-progress.png and /dev/null differ diff --git a/devices/surface-hub/images/reinstall.png b/devices/surface-hub/images/reinstall.png deleted file mode 100644 index 2f307841aa..0000000000 Binary files a/devices/surface-hub/images/reinstall.png and /dev/null differ diff --git a/devices/surface-hub/images/repartition.png b/devices/surface-hub/images/repartition.png deleted file mode 100644 index 26725a8c54..0000000000 Binary files a/devices/surface-hub/images/repartition.png and /dev/null differ diff --git a/devices/surface-hub/images/replacement-port-55.PNG b/devices/surface-hub/images/replacement-port-55.PNG deleted file mode 100644 index 5bf0b51b02..0000000000 Binary files a/devices/surface-hub/images/replacement-port-55.PNG and /dev/null differ diff --git a/devices/surface-hub/images/replacement-port-84.PNG b/devices/surface-hub/images/replacement-port-84.PNG deleted file mode 100644 index 45284b4ab9..0000000000 Binary files a/devices/surface-hub/images/replacement-port-84.PNG and /dev/null differ diff --git a/devices/surface-hub/images/rj11.png b/devices/surface-hub/images/rj11.png deleted file mode 100644 index f044354caa..0000000000 Binary files a/devices/surface-hub/images/rj11.png and /dev/null differ diff --git a/devices/surface-hub/images/rj45.png b/devices/surface-hub/images/rj45.png deleted file mode 100644 index ca88423217..0000000000 Binary files a/devices/surface-hub/images/rj45.png and /dev/null differ diff --git a/devices/surface-hub/images/room-add.png b/devices/surface-hub/images/room-add.png deleted file mode 100644 index 6b0597c41a..0000000000 Binary files a/devices/surface-hub/images/room-add.png and /dev/null differ diff --git a/devices/surface-hub/images/room-control-wiring-diagram.png b/devices/surface-hub/images/room-control-wiring-diagram.png deleted file mode 100644 index 5a2ecf613e..0000000000 Binary files a/devices/surface-hub/images/room-control-wiring-diagram.png and /dev/null differ diff --git a/devices/surface-hub/images/room-equipment.png b/devices/surface-hub/images/room-equipment.png deleted file mode 100644 index 131f8b8c75..0000000000 Binary files a/devices/surface-hub/images/room-equipment.png and /dev/null differ diff --git a/devices/surface-hub/images/roomcontrolwiring.png b/devices/surface-hub/images/roomcontrolwiring.png deleted file mode 100644 index 78da10ce77..0000000000 Binary files a/devices/surface-hub/images/roomcontrolwiring.png and /dev/null differ diff --git a/devices/surface-hub/images/sccm-additional.png b/devices/surface-hub/images/sccm-additional.png deleted file mode 100644 index 7c8fbf8e2f..0000000000 Binary files a/devices/surface-hub/images/sccm-additional.png and /dev/null differ diff --git a/devices/surface-hub/images/sccm-create.png b/devices/surface-hub/images/sccm-create.png deleted file mode 100644 index 1db436d3ad..0000000000 Binary files a/devices/surface-hub/images/sccm-create.png and /dev/null differ diff --git a/devices/surface-hub/images/sccm-oma-uri.png b/devices/surface-hub/images/sccm-oma-uri.png deleted file mode 100644 index 699bc054a1..0000000000 Binary files a/devices/surface-hub/images/sccm-oma-uri.png and /dev/null differ diff --git a/devices/surface-hub/images/sccm-platform.png b/devices/surface-hub/images/sccm-platform.png deleted file mode 100644 index e857c50cc3..0000000000 Binary files a/devices/surface-hub/images/sccm-platform.png and /dev/null differ diff --git a/devices/surface-hub/images/sccm-team.png b/devices/surface-hub/images/sccm-team.png deleted file mode 100644 index f99acd5738..0000000000 Binary files a/devices/surface-hub/images/sccm-team.png and /dev/null differ diff --git a/devices/surface-hub/images/select-room-hybrid-voice.png b/devices/surface-hub/images/select-room-hybrid-voice.png deleted file mode 100644 index 961f8355e8..0000000000 Binary files a/devices/surface-hub/images/select-room-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-admins-details.PNG b/devices/surface-hub/images/set-up-device-admins-details.PNG deleted file mode 100644 index 42c04b4b3b..0000000000 Binary files a/devices/surface-hub/images/set-up-device-admins-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-admins.PNG b/devices/surface-hub/images/set-up-device-admins.PNG deleted file mode 100644 index e0e037903c..0000000000 Binary files a/devices/surface-hub/images/set-up-device-admins.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-details.PNG b/devices/surface-hub/images/set-up-device-details.PNG deleted file mode 100644 index be565ac8d9..0000000000 Binary files a/devices/surface-hub/images/set-up-device-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device.PNG b/devices/surface-hub/images/set-up-device.PNG deleted file mode 100644 index 0c9eb0e3ff..0000000000 Binary files a/devices/surface-hub/images/set-up-device.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-network-details.PNG b/devices/surface-hub/images/set-up-network-details.PNG deleted file mode 100644 index 7e1391326c..0000000000 Binary files a/devices/surface-hub/images/set-up-network-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-network.PNG b/devices/surface-hub/images/set-up-network.PNG deleted file mode 100644 index a0e856c103..0000000000 Binary files a/devices/surface-hub/images/set-up-network.PNG and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacct.png b/devices/surface-hub/images/setupdeviceacct.png deleted file mode 100644 index 23c2f22171..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacct.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-01.png b/devices/surface-hub/images/setupdeviceacctexch-01.png deleted file mode 100644 index 10710fa4ca..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-01.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-02.png b/devices/surface-hub/images/setupdeviceacctexch-02.png deleted file mode 100644 index b55cb6b87e..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-02.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-03.png b/devices/surface-hub/images/setupdeviceacctexch-03.png deleted file mode 100644 index 4f15b6e025..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-03.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-05.png b/devices/surface-hub/images/setupdeviceacctexch-05.png deleted file mode 100644 index 40dced3c01..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-05.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-06.png b/devices/surface-hub/images/setupdeviceacctexch-06.png deleted file mode 100644 index f4f1686037..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-06.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-07.png b/devices/surface-hub/images/setupdeviceacctexch-07.png deleted file mode 100644 index aebb0ae29e..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-07.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-08.png b/devices/surface-hub/images/setupdeviceacctexch-08.png deleted file mode 100644 index 85c013f98d..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-08.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-09.png b/devices/surface-hub/images/setupdeviceacctexch-09.png deleted file mode 100644 index f36fb9817c..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-09.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-10.png b/devices/surface-hub/images/setupdeviceacctexch-10.png deleted file mode 100644 index 4a5d1aaee4..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-10.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-11.png b/devices/surface-hub/images/setupdeviceacctexch-11.png deleted file mode 100644 index 03d320cd55..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-11.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-02.png b/devices/surface-hub/images/setupdeviceaccto365-02.png deleted file mode 100644 index e0694bac42..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-02.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-03.png b/devices/surface-hub/images/setupdeviceaccto365-03.png deleted file mode 100644 index f93f0f1594..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-03.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-04.png b/devices/surface-hub/images/setupdeviceaccto365-04.png deleted file mode 100644 index 8484394faa..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-04.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-05.png b/devices/surface-hub/images/setupdeviceaccto365-05.png deleted file mode 100644 index 51150e3bcb..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-05.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-06.png b/devices/surface-hub/images/setupdeviceaccto365-06.png deleted file mode 100644 index 3f6567feca..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-06.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-07.png b/devices/surface-hub/images/setupdeviceaccto365-07.png deleted file mode 100644 index ce0eb99af2..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-07.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-08.png b/devices/surface-hub/images/setupdeviceaccto365-08.png deleted file mode 100644 index e174c7d54c..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-08.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-09.png b/devices/surface-hub/images/setupdeviceaccto365-09.png deleted file mode 100644 index 4820c18f0f..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-09.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-10.png b/devices/surface-hub/images/setupdeviceaccto365-10.png deleted file mode 100644 index bb461ddf8d..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-10.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-11.png b/devices/surface-hub/images/setupdeviceaccto365-11.png deleted file mode 100644 index f88d1246aa..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-11.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-12.png b/devices/surface-hub/images/setupdeviceaccto365-12.png deleted file mode 100644 index 29a2fa31d3..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-12.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-13.png b/devices/surface-hub/images/setupdeviceaccto365-13.png deleted file mode 100644 index 3e079c3092..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-13.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-14.png b/devices/surface-hub/images/setupdeviceaccto365-14.png deleted file mode 100644 index da2175f3d1..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-14.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-15.png b/devices/surface-hub/images/setupdeviceaccto365-15.png deleted file mode 100644 index 00e066f97e..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-15.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-16.png b/devices/surface-hub/images/setupdeviceaccto365-16.png deleted file mode 100644 index b6e467c72f..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-16.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-17.png b/devices/surface-hub/images/setupdeviceaccto365-17.png deleted file mode 100644 index e1501c92a1..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-17.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-18.png b/devices/surface-hub/images/setupdeviceaccto365-18.png deleted file mode 100644 index 8f1f3aba04..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-18.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-19.png b/devices/surface-hub/images/setupdeviceaccto365-19.png deleted file mode 100644 index 3e9b2a86fc..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-19.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-20.png b/devices/surface-hub/images/setupdeviceaccto365-20.png deleted file mode 100644 index 210cfb54c8..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-20.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-21.png b/devices/surface-hub/images/setupdeviceaccto365-21.png deleted file mode 100644 index 6ea80e548d..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-21.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-22.png b/devices/surface-hub/images/setupdeviceaccto365-22.png deleted file mode 100644 index cacd3294ad..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-22.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-23.png b/devices/surface-hub/images/setupdeviceaccto365-23.png deleted file mode 100644 index f15727c542..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-23.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-24.png b/devices/surface-hub/images/setupdeviceaccto365-24.png deleted file mode 100644 index a335591f17..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-24.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-25.png b/devices/surface-hub/images/setupdeviceaccto365-25.png deleted file mode 100644 index b49e3e9066..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-25.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-26.png b/devices/surface-hub/images/setupdeviceaccto365-26.png deleted file mode 100644 index 5a2841ec32..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-26.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdomainjoin.png b/devices/surface-hub/images/setupdomainjoin.png deleted file mode 100644 index c42a637981..0000000000 Binary files a/devices/surface-hub/images/setupdomainjoin.png and /dev/null differ diff --git a/devices/surface-hub/images/setupexchangepolicies.png b/devices/surface-hub/images/setupexchangepolicies.png deleted file mode 100644 index 63a4396364..0000000000 Binary files a/devices/surface-hub/images/setupexchangepolicies.png and /dev/null differ diff --git a/devices/surface-hub/images/setupexchangeserver-01.png b/devices/surface-hub/images/setupexchangeserver-01.png deleted file mode 100644 index f3b9dc9e18..0000000000 Binary files a/devices/surface-hub/images/setupexchangeserver-01.png and /dev/null differ diff --git a/devices/surface-hub/images/setupexchangeserver-02.png b/devices/surface-hub/images/setupexchangeserver-02.png deleted file mode 100644 index 58462ec244..0000000000 Binary files a/devices/surface-hub/images/setupexchangeserver-02.png and /dev/null differ diff --git a/devices/surface-hub/images/setupjoiningazuread-1.png b/devices/surface-hub/images/setupjoiningazuread-1.png deleted file mode 100644 index cd24be2c90..0000000000 Binary files a/devices/surface-hub/images/setupjoiningazuread-1.png and /dev/null differ diff --git a/devices/surface-hub/images/setupjoiningazuread-2.png b/devices/surface-hub/images/setupjoiningazuread-2.png deleted file mode 100644 index 9ec163f679..0000000000 Binary files a/devices/surface-hub/images/setupjoiningazuread-2.png and /dev/null differ diff --git a/devices/surface-hub/images/setupjoiningazuread-3.png b/devices/surface-hub/images/setupjoiningazuread-3.png deleted file mode 100644 index abe6691d92..0000000000 Binary files a/devices/surface-hub/images/setupjoiningazuread-3.png and /dev/null differ diff --git a/devices/surface-hub/images/setuplocaladmin.png b/devices/surface-hub/images/setuplocaladmin.png deleted file mode 100644 index 30ac056c5a..0000000000 Binary files a/devices/surface-hub/images/setuplocaladmin.png and /dev/null differ diff --git a/devices/surface-hub/images/setuplocale.png b/devices/surface-hub/images/setuplocale.png deleted file mode 100644 index e9aa468697..0000000000 Binary files a/devices/surface-hub/images/setuplocale.png and /dev/null differ diff --git a/devices/surface-hub/images/setupmsg.jpg b/devices/surface-hub/images/setupmsg.jpg deleted file mode 100644 index 12935483c5..0000000000 Binary files a/devices/surface-hub/images/setupmsg.jpg and /dev/null differ diff --git a/devices/surface-hub/images/setupnamedevice.png b/devices/surface-hub/images/setupnamedevice.png deleted file mode 100644 index 5baa35c487..0000000000 Binary files a/devices/surface-hub/images/setupnamedevice.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-1.png b/devices/surface-hub/images/setupnetworksetup-1.png deleted file mode 100644 index 49dfbde566..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-1.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-2.png b/devices/surface-hub/images/setupnetworksetup-2.png deleted file mode 100644 index 4d96e95782..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-2.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-3.png b/devices/surface-hub/images/setupnetworksetup-3.png deleted file mode 100644 index 62d6e0a772..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-3.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-4.png b/devices/surface-hub/images/setupnetworksetup-4.png deleted file mode 100644 index 836bb208fb..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-4.png and /dev/null differ diff --git a/devices/surface-hub/images/setupsecuritygroup-1.png b/devices/surface-hub/images/setupsecuritygroup-1.png deleted file mode 100644 index bab6e2f197..0000000000 Binary files a/devices/surface-hub/images/setupsecuritygroup-1.png and /dev/null differ diff --git a/devices/surface-hub/images/setupsetupadmins.png b/devices/surface-hub/images/setupsetupadmins.png deleted file mode 100644 index 109cb1ea92..0000000000 Binary files a/devices/surface-hub/images/setupsetupadmins.png and /dev/null differ diff --git a/devices/surface-hub/images/setupsetupforyou.png b/devices/surface-hub/images/setupsetupforyou.png deleted file mode 100644 index c0ea230caf..0000000000 Binary files a/devices/surface-hub/images/setupsetupforyou.png and /dev/null differ diff --git a/devices/surface-hub/images/setupskipdeviceacct.png b/devices/surface-hub/images/setupskipdeviceacct.png deleted file mode 100644 index 7a71c7f982..0000000000 Binary files a/devices/surface-hub/images/setupskipdeviceacct.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-bottom.png b/devices/surface-hub/images/sh-55-bottom.png deleted file mode 100644 index 3d718d1226..0000000000 Binary files a/devices/surface-hub/images/sh-55-bottom.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-clearance.png b/devices/surface-hub/images/sh-55-clearance.png deleted file mode 100644 index 12fc35ec49..0000000000 Binary files a/devices/surface-hub/images/sh-55-clearance.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-front.png b/devices/surface-hub/images/sh-55-front.png deleted file mode 100644 index e1268ee328..0000000000 Binary files a/devices/surface-hub/images/sh-55-front.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-guest-ports.png b/devices/surface-hub/images/sh-55-guest-ports.png deleted file mode 100644 index af42c738f8..0000000000 Binary files a/devices/surface-hub/images/sh-55-guest-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-hand-rear.png b/devices/surface-hub/images/sh-55-hand-rear.png deleted file mode 100644 index b1ff007ec2..0000000000 Binary files a/devices/surface-hub/images/sh-55-hand-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-hand.png b/devices/surface-hub/images/sh-55-hand.png deleted file mode 100644 index 6f8d96ba8e..0000000000 Binary files a/devices/surface-hub/images/sh-55-hand.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-rear.png b/devices/surface-hub/images/sh-55-rear.png deleted file mode 100644 index 840b941e03..0000000000 Binary files a/devices/surface-hub/images/sh-55-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-rpc-ports.png b/devices/surface-hub/images/sh-55-rpc-ports.png deleted file mode 100644 index 7df98f2277..0000000000 Binary files a/devices/surface-hub/images/sh-55-rpc-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-top.png b/devices/surface-hub/images/sh-55-top.png deleted file mode 100644 index f8c93f5d1b..0000000000 Binary files a/devices/surface-hub/images/sh-55-top.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-bottom.png b/devices/surface-hub/images/sh-84-bottom.png deleted file mode 100644 index d7252537e4..0000000000 Binary files a/devices/surface-hub/images/sh-84-bottom.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-clearance.png b/devices/surface-hub/images/sh-84-clearance.png deleted file mode 100644 index 8fd0cd2c32..0000000000 Binary files a/devices/surface-hub/images/sh-84-clearance.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-front.png b/devices/surface-hub/images/sh-84-front.png deleted file mode 100644 index 8afa0de18b..0000000000 Binary files a/devices/surface-hub/images/sh-84-front.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-guest-ports.png b/devices/surface-hub/images/sh-84-guest-ports.png deleted file mode 100644 index 6c7060154b..0000000000 Binary files a/devices/surface-hub/images/sh-84-guest-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-hand-top.png b/devices/surface-hub/images/sh-84-hand-top.png deleted file mode 100644 index 1e52446eb0..0000000000 Binary files a/devices/surface-hub/images/sh-84-hand-top.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-hand.png b/devices/surface-hub/images/sh-84-hand.png deleted file mode 100644 index 3e84a8a434..0000000000 Binary files a/devices/surface-hub/images/sh-84-hand.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-rear.png b/devices/surface-hub/images/sh-84-rear.png deleted file mode 100644 index 5837d4e185..0000000000 Binary files a/devices/surface-hub/images/sh-84-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-rpc-ports.png b/devices/surface-hub/images/sh-84-rpc-ports.png deleted file mode 100644 index f3a0a52327..0000000000 Binary files a/devices/surface-hub/images/sh-84-rpc-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-side.png b/devices/surface-hub/images/sh-84-side.png deleted file mode 100644 index 6b1ad8385b..0000000000 Binary files a/devices/surface-hub/images/sh-84-side.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-top.png b/devices/surface-hub/images/sh-84-top.png deleted file mode 100644 index badc94af0b..0000000000 Binary files a/devices/surface-hub/images/sh-84-top.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-wall.png b/devices/surface-hub/images/sh-84-wall.png deleted file mode 100644 index 15d2e5a848..0000000000 Binary files a/devices/surface-hub/images/sh-84-wall.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-device-family-availability.png b/devices/surface-hub/images/sh-device-family-availability.png deleted file mode 100644 index 30b8a954af..0000000000 Binary files a/devices/surface-hub/images/sh-device-family-availability.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-org-licensing.png b/devices/surface-hub/images/sh-org-licensing.png deleted file mode 100644 index 48c7033715..0000000000 Binary files a/devices/surface-hub/images/sh-org-licensing.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-quick-action.png b/devices/surface-hub/images/sh-quick-action.png deleted file mode 100644 index 3003e464b3..0000000000 Binary files a/devices/surface-hub/images/sh-quick-action.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-select-template.png b/devices/surface-hub/images/sh-select-template.png deleted file mode 100644 index 58ab21481e..0000000000 Binary files a/devices/surface-hub/images/sh-select-template.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-settings-reset-device.png b/devices/surface-hub/images/sh-settings-reset-device.png deleted file mode 100644 index f3a9a6dc5c..0000000000 Binary files a/devices/surface-hub/images/sh-settings-reset-device.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-settings-update-security.png b/devices/surface-hub/images/sh-settings-update-security.png deleted file mode 100644 index 59212d1805..0000000000 Binary files a/devices/surface-hub/images/sh-settings-update-security.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-settings.png b/devices/surface-hub/images/sh-settings.png deleted file mode 100644 index 0134fda740..0000000000 Binary files a/devices/surface-hub/images/sh-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account2.png b/devices/surface-hub/images/sh2-account2.png deleted file mode 100644 index 2a2267ab7c..0000000000 Binary files a/devices/surface-hub/images/sh2-account2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account3.png b/devices/surface-hub/images/sh2-account3.png deleted file mode 100644 index b67ff0da37..0000000000 Binary files a/devices/surface-hub/images/sh2-account3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account4.png b/devices/surface-hub/images/sh2-account4.png deleted file mode 100644 index 7495f28607..0000000000 Binary files a/devices/surface-hub/images/sh2-account4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account5.png b/devices/surface-hub/images/sh2-account5.png deleted file mode 100644 index 3dc9061733..0000000000 Binary files a/devices/surface-hub/images/sh2-account5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-add-group.png b/devices/surface-hub/images/sh2-add-group.png deleted file mode 100644 index eb44ad8cf9..0000000000 Binary files a/devices/surface-hub/images/sh2-add-group.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-add-room.png b/devices/surface-hub/images/sh2-add-room.png deleted file mode 100644 index c53ee340bc..0000000000 Binary files a/devices/surface-hub/images/sh2-add-room.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-apps-assign.png b/devices/surface-hub/images/sh2-apps-assign.png deleted file mode 100644 index f6a91864c8..0000000000 Binary files a/devices/surface-hub/images/sh2-apps-assign.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-assign-group.png b/devices/surface-hub/images/sh2-assign-group.png deleted file mode 100644 index a2d79bcd34..0000000000 Binary files a/devices/surface-hub/images/sh2-assign-group.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-cartridge.png b/devices/surface-hub/images/sh2-cartridge.png deleted file mode 100644 index 3c7a2e83be..0000000000 Binary files a/devices/surface-hub/images/sh2-cartridge.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-config-file.png b/devices/surface-hub/images/sh2-config-file.png deleted file mode 100644 index d8293c8ff6..0000000000 Binary files a/devices/surface-hub/images/sh2-config-file.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-deploy-apps-sync.png b/devices/surface-hub/images/sh2-deploy-apps-sync.png deleted file mode 100644 index 060c29c17f..0000000000 Binary files a/devices/surface-hub/images/sh2-deploy-apps-sync.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-keepout-zones.png b/devices/surface-hub/images/sh2-keepout-zones.png deleted file mode 100644 index bf318963df..0000000000 Binary files a/devices/surface-hub/images/sh2-keepout-zones.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-keypad.png b/devices/surface-hub/images/sh2-keypad.png deleted file mode 100644 index 595bb19341..0000000000 Binary files a/devices/surface-hub/images/sh2-keypad.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-mobile-stand.png b/devices/surface-hub/images/sh2-mobile-stand.png deleted file mode 100644 index 75c64f06f3..0000000000 Binary files a/devices/surface-hub/images/sh2-mobile-stand.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-mount-config.png b/devices/surface-hub/images/sh2-mount-config.png deleted file mode 100644 index 5cde6108a1..0000000000 Binary files a/devices/surface-hub/images/sh2-mount-config.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-onscreen-display.png b/devices/surface-hub/images/sh2-onscreen-display.png deleted file mode 100644 index 4605f50734..0000000000 Binary files a/devices/surface-hub/images/sh2-onscreen-display.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-pen-pressure.png b/devices/surface-hub/images/sh2-pen-pressure.png deleted file mode 100644 index 67054ca972..0000000000 Binary files a/devices/surface-hub/images/sh2-pen-pressure.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-pen.png b/devices/surface-hub/images/sh2-pen.png deleted file mode 100644 index 1a95b9581e..0000000000 Binary files a/devices/surface-hub/images/sh2-pen.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-ports.png b/devices/surface-hub/images/sh2-ports.png deleted file mode 100644 index 2d30422911..0000000000 Binary files a/devices/surface-hub/images/sh2-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-proxy.png b/devices/surface-hub/images/sh2-proxy.png deleted file mode 100644 index 81946a9906..0000000000 Binary files a/devices/surface-hub/images/sh2-proxy.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-reset.png b/devices/surface-hub/images/sh2-reset.png deleted file mode 100644 index 06b306ec5d..0000000000 Binary files a/devices/surface-hub/images/sh2-reset.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run1.png b/devices/surface-hub/images/sh2-run1.png deleted file mode 100644 index 15aa540166..0000000000 Binary files a/devices/surface-hub/images/sh2-run1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run10.png b/devices/surface-hub/images/sh2-run10.png deleted file mode 100644 index 5e980fa334..0000000000 Binary files a/devices/surface-hub/images/sh2-run10.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run11.png b/devices/surface-hub/images/sh2-run11.png deleted file mode 100644 index 02362bc5da..0000000000 Binary files a/devices/surface-hub/images/sh2-run11.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run12.png b/devices/surface-hub/images/sh2-run12.png deleted file mode 100644 index f619ac4c42..0000000000 Binary files a/devices/surface-hub/images/sh2-run12.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run13.png b/devices/surface-hub/images/sh2-run13.png deleted file mode 100644 index 77b9e3e2a6..0000000000 Binary files a/devices/surface-hub/images/sh2-run13.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run14.png b/devices/surface-hub/images/sh2-run14.png deleted file mode 100644 index d88ca872ca..0000000000 Binary files a/devices/surface-hub/images/sh2-run14.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run2.png b/devices/surface-hub/images/sh2-run2.png deleted file mode 100644 index fd379b2b05..0000000000 Binary files a/devices/surface-hub/images/sh2-run2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run3.png b/devices/surface-hub/images/sh2-run3.png deleted file mode 100644 index 8171beecbf..0000000000 Binary files a/devices/surface-hub/images/sh2-run3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run4.png b/devices/surface-hub/images/sh2-run4.png deleted file mode 100644 index 1a132dfebb..0000000000 Binary files a/devices/surface-hub/images/sh2-run4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run5.png b/devices/surface-hub/images/sh2-run5.png deleted file mode 100644 index ebfe53f3cb..0000000000 Binary files a/devices/surface-hub/images/sh2-run5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run6.png b/devices/surface-hub/images/sh2-run6.png deleted file mode 100644 index 896531f4ec..0000000000 Binary files a/devices/surface-hub/images/sh2-run6.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run7.png b/devices/surface-hub/images/sh2-run7.png deleted file mode 100644 index 59e60d84de..0000000000 Binary files a/devices/surface-hub/images/sh2-run7.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run8.png b/devices/surface-hub/images/sh2-run8.png deleted file mode 100644 index ec2daf8e4f..0000000000 Binary files a/devices/surface-hub/images/sh2-run8.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run9.png b/devices/surface-hub/images/sh2-run9.png deleted file mode 100644 index 5bd3abea88..0000000000 Binary files a/devices/surface-hub/images/sh2-run9.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune1.png b/devices/surface-hub/images/sh2-set-intune1.png deleted file mode 100644 index 9993225210..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune3.png b/devices/surface-hub/images/sh2-set-intune3.png deleted file mode 100644 index f931d828fc..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune5.png b/devices/surface-hub/images/sh2-set-intune5.png deleted file mode 100644 index 9afb1c1445..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune6.png b/devices/surface-hub/images/sh2-set-intune6.png deleted file mode 100644 index 155cbb9930..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune6.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune8.png b/devices/surface-hub/images/sh2-set-intune8.png deleted file mode 100644 index a8d9bfe874..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune8.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-1.png b/devices/surface-hub/images/sh2-setup-1.png deleted file mode 100644 index 1204020f9f..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-2.png b/devices/surface-hub/images/sh2-setup-2.png deleted file mode 100644 index 0d6501782b..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-3.png b/devices/surface-hub/images/sh2-setup-3.png deleted file mode 100644 index 2b827f4405..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-4.png b/devices/surface-hub/images/sh2-setup-4.png deleted file mode 100644 index 0825dadce4..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-thermal-audio.png b/devices/surface-hub/images/sh2-thermal-audio.png deleted file mode 100644 index 5d9640df9b..0000000000 Binary files a/devices/surface-hub/images/sh2-thermal-audio.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-token.png b/devices/surface-hub/images/sh2-token.png deleted file mode 100644 index 115153a767..0000000000 Binary files a/devices/surface-hub/images/sh2-token.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-token2.png b/devices/surface-hub/images/sh2-token2.png deleted file mode 100644 index 324bc27f63..0000000000 Binary files a/devices/surface-hub/images/sh2-token2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-token3.png b/devices/surface-hub/images/sh2-token3.png deleted file mode 100644 index 04e173d391..0000000000 Binary files a/devices/surface-hub/images/sh2-token3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi1.png b/devices/surface-hub/images/sh2-uefi1.png deleted file mode 100644 index ecb5aad455..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi10.png b/devices/surface-hub/images/sh2-uefi10.png deleted file mode 100644 index eafc0617a2..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi10.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi2.png b/devices/surface-hub/images/sh2-uefi2.png deleted file mode 100644 index 8dbcb3df84..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi3.png b/devices/surface-hub/images/sh2-uefi3.png deleted file mode 100644 index f9b0fdb754..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi4.png b/devices/surface-hub/images/sh2-uefi4.png deleted file mode 100644 index ae6f427772..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi5.png b/devices/surface-hub/images/sh2-uefi5.png deleted file mode 100644 index 18a780074f..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi6.png b/devices/surface-hub/images/sh2-uefi6.png deleted file mode 100644 index 7b4390574a..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi6.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi7.png b/devices/surface-hub/images/sh2-uefi7.png deleted file mode 100644 index 0302b41a43..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi7.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi8.png b/devices/surface-hub/images/sh2-uefi8.png deleted file mode 100644 index c5ccc27628..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi8.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi9.png b/devices/surface-hub/images/sh2-uefi9.png deleted file mode 100644 index 4747c398c8..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi9.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-wall-front.png b/devices/surface-hub/images/sh2-wall-front.png deleted file mode 100644 index 349e124bb0..0000000000 Binary files a/devices/surface-hub/images/sh2-wall-front.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-wall-side.png b/devices/surface-hub/images/sh2-wall-side.png deleted file mode 100644 index f09cbda81e..0000000000 Binary files a/devices/surface-hub/images/sh2-wall-side.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-wcd.png b/devices/surface-hub/images/sh2-wcd.png deleted file mode 100644 index 8a945dfca4..0000000000 Binary files a/devices/surface-hub/images/sh2-wcd.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-complete.png b/devices/surface-hub/images/shrt-complete.png deleted file mode 100644 index 64525f76a3..0000000000 Binary files a/devices/surface-hub/images/shrt-complete.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-done.png b/devices/surface-hub/images/shrt-done.png deleted file mode 100644 index ea05c13051..0000000000 Binary files a/devices/surface-hub/images/shrt-done.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-download.png b/devices/surface-hub/images/shrt-download.png deleted file mode 100644 index 8eee758a54..0000000000 Binary files a/devices/surface-hub/images/shrt-download.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-drive-start.png b/devices/surface-hub/images/shrt-drive-start.png deleted file mode 100644 index 490998f214..0000000000 Binary files a/devices/surface-hub/images/shrt-drive-start.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-drive.png b/devices/surface-hub/images/shrt-drive.png deleted file mode 100644 index 9afeb4b7f3..0000000000 Binary files a/devices/surface-hub/images/shrt-drive.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-guidance.png b/devices/surface-hub/images/shrt-guidance.png deleted file mode 100644 index c878761704..0000000000 Binary files a/devices/surface-hub/images/shrt-guidance.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-shortcut.png b/devices/surface-hub/images/shrt-shortcut.png deleted file mode 100644 index d71d3e163c..0000000000 Binary files a/devices/surface-hub/images/shrt-shortcut.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-start.png b/devices/surface-hub/images/shrt-start.png deleted file mode 100644 index 93356c889b..0000000000 Binary files a/devices/surface-hub/images/shrt-start.png and /dev/null differ diff --git a/devices/surface-hub/images/sign-in-prov.png b/devices/surface-hub/images/sign-in-prov.png deleted file mode 100644 index 55c9276203..0000000000 Binary files a/devices/surface-hub/images/sign-in-prov.png and /dev/null differ diff --git a/devices/surface-hub/images/sign-in.png b/devices/surface-hub/images/sign-in.png deleted file mode 100644 index bd34f642a7..0000000000 Binary files a/devices/surface-hub/images/sign-in.png and /dev/null differ diff --git a/devices/surface-hub/images/six.png b/devices/surface-hub/images/six.png deleted file mode 100644 index 2816328ec3..0000000000 Binary files a/devices/surface-hub/images/six.png and /dev/null differ diff --git a/devices/surface-hub/images/ssd-click.PNG b/devices/surface-hub/images/ssd-click.PNG deleted file mode 100644 index 5dfcc57c42..0000000000 Binary files a/devices/surface-hub/images/ssd-click.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-lift-door.PNG b/devices/surface-hub/images/ssd-lift-door.PNG deleted file mode 100644 index d395ce91aa..0000000000 Binary files a/devices/surface-hub/images/ssd-lift-door.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-location.PNG b/devices/surface-hub/images/ssd-location.PNG deleted file mode 100644 index 9b774456b1..0000000000 Binary files a/devices/surface-hub/images/ssd-location.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-lock-tab.PNG b/devices/surface-hub/images/ssd-lock-tab.PNG deleted file mode 100644 index 17c11dc7a2..0000000000 Binary files a/devices/surface-hub/images/ssd-lock-tab.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-pull-tab.PNG b/devices/surface-hub/images/ssd-pull-tab.PNG deleted file mode 100644 index a306f08a13..0000000000 Binary files a/devices/surface-hub/images/ssd-pull-tab.PNG and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-1.png b/devices/surface-hub/images/surface-hub-2s-repack-1.png deleted file mode 100644 index cab6f33cb7..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-1.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-10.png b/devices/surface-hub/images/surface-hub-2s-repack-10.png deleted file mode 100644 index 7f3c6ab51c..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-10.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-11.png b/devices/surface-hub/images/surface-hub-2s-repack-11.png deleted file mode 100644 index 0e0485056a..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-11.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-12.png b/devices/surface-hub/images/surface-hub-2s-repack-12.png deleted file mode 100644 index 7032cbc1b7..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-12.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-13.png b/devices/surface-hub/images/surface-hub-2s-repack-13.png deleted file mode 100644 index 465ce22bee..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-13.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-2.png b/devices/surface-hub/images/surface-hub-2s-repack-2.png deleted file mode 100644 index f8fbc235b6..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-2.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-3.png b/devices/surface-hub/images/surface-hub-2s-repack-3.png deleted file mode 100644 index e270326ab9..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-3.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-4.png b/devices/surface-hub/images/surface-hub-2s-repack-4.png deleted file mode 100644 index 42bc3a0389..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-4.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-5.png b/devices/surface-hub/images/surface-hub-2s-repack-5.png deleted file mode 100644 index d6457cd161..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-5.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-6.png b/devices/surface-hub/images/surface-hub-2s-repack-6.png deleted file mode 100644 index 73b8a14630..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-6.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-7.png b/devices/surface-hub/images/surface-hub-2s-repack-7.png deleted file mode 100644 index 54a20e2257..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-7.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-8.png b/devices/surface-hub/images/surface-hub-2s-repack-8.png deleted file mode 100644 index f2dcac60ed..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-8.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-9.png b/devices/surface-hub/images/surface-hub-2s-repack-9.png deleted file mode 100644 index c067cbf1d8..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-9.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png b/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png deleted file mode 100644 index 10530cba1e..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png b/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png deleted file mode 100644 index 119dc21a5a..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png deleted file mode 100644 index ceebc3d5fd..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png deleted file mode 100644 index 77ab33c1d5..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png deleted file mode 100644 index 3cf6d0ec62..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png deleted file mode 100644 index d44ad9d37c..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png deleted file mode 100644 index ffbec86f57..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png deleted file mode 100644 index 90ddf71366..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png deleted file mode 100644 index 5020d16853..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png deleted file mode 100644 index 9ea535dff4..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png deleted file mode 100644 index 1a64ae0ebb..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png deleted file mode 100644 index 9d9bc52c66..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png and /dev/null differ diff --git a/devices/surface-hub/images/surfaceblog.png b/devices/surface-hub/images/surfaceblog.png deleted file mode 100644 index ae996a918c..0000000000 Binary files a/devices/surface-hub/images/surfaceblog.png and /dev/null differ diff --git a/devices/surface-hub/images/surfacehub.png b/devices/surface-hub/images/surfacehub.png deleted file mode 100644 index 1b9b484ab8..0000000000 Binary files a/devices/surface-hub/images/surfacehub.png and /dev/null differ diff --git a/devices/surface-hub/images/surfacemechanics.png b/devices/surface-hub/images/surfacemechanics.png deleted file mode 100644 index ad674466fa..0000000000 Binary files a/devices/surface-hub/images/surfacemechanics.png and /dev/null differ diff --git a/devices/surface-hub/images/switch.png b/devices/surface-hub/images/switch.png deleted file mode 100644 index 5ea0d21909..0000000000 Binary files a/devices/surface-hub/images/switch.png and /dev/null differ diff --git a/devices/surface-hub/images/system-settings-add-fqdn.png b/devices/surface-hub/images/system-settings-add-fqdn.png deleted file mode 100644 index ef00872a16..0000000000 Binary files a/devices/surface-hub/images/system-settings-add-fqdn.png and /dev/null differ diff --git a/devices/surface-hub/images/three.png b/devices/surface-hub/images/three.png deleted file mode 100644 index 887fa270d7..0000000000 Binary files a/devices/surface-hub/images/three.png and /dev/null differ diff --git a/devices/surface-hub/images/trust-package.png b/devices/surface-hub/images/trust-package.png deleted file mode 100644 index 8a293ea4da..0000000000 Binary files a/devices/surface-hub/images/trust-package.png and /dev/null differ diff --git a/devices/surface-hub/images/twitter.png b/devices/surface-hub/images/twitter.png deleted file mode 100644 index 25143adcf6..0000000000 Binary files a/devices/surface-hub/images/twitter.png and /dev/null differ diff --git a/devices/surface-hub/images/two.png b/devices/surface-hub/images/two.png deleted file mode 100644 index b8c2d52eaf..0000000000 Binary files a/devices/surface-hub/images/two.png and /dev/null differ diff --git a/devices/surface-hub/images/usb.png b/devices/surface-hub/images/usb.png deleted file mode 100644 index a743c6b634..0000000000 Binary files a/devices/surface-hub/images/usb.png and /dev/null differ diff --git a/devices/surface-hub/images/vga.png b/devices/surface-hub/images/vga.png deleted file mode 100644 index 016b42d1f4..0000000000 Binary files a/devices/surface-hub/images/vga.png and /dev/null differ diff --git a/devices/surface-hub/images/video-out-55.png b/devices/surface-hub/images/video-out-55.png deleted file mode 100644 index e386b7f3d9..0000000000 Binary files a/devices/surface-hub/images/video-out-55.png and /dev/null differ diff --git a/devices/surface-hub/images/video-out-84.png b/devices/surface-hub/images/video-out-84.png deleted file mode 100644 index 672ae78556..0000000000 Binary files a/devices/surface-hub/images/video-out-84.png and /dev/null differ diff --git a/devices/surface-hub/images/wb-collab-example.png b/devices/surface-hub/images/wb-collab-example.png deleted file mode 100644 index 0ed67c03ea..0000000000 Binary files a/devices/surface-hub/images/wb-collab-example.png and /dev/null differ diff --git a/devices/surface-hub/images/wb-collab-link.png b/devices/surface-hub/images/wb-collab-link.png deleted file mode 100644 index 9b0531d0c0..0000000000 Binary files a/devices/surface-hub/images/wb-collab-link.png and /dev/null differ diff --git a/devices/surface-hub/images/wcd-wizard.PNG b/devices/surface-hub/images/wcd-wizard.PNG deleted file mode 100644 index 706771f756..0000000000 Binary files a/devices/surface-hub/images/wcd-wizard.PNG and /dev/null differ diff --git a/devices/surface-hub/images/whats-new-video-thumbnail.PNG b/devices/surface-hub/images/whats-new-video-thumbnail.PNG deleted file mode 100644 index 44cbffcbb3..0000000000 Binary files a/devices/surface-hub/images/whats-new-video-thumbnail.PNG and /dev/null differ diff --git a/devices/surface-hub/images/who-owns-pc.png b/devices/surface-hub/images/who-owns-pc.png deleted file mode 100644 index d3ce1def8d..0000000000 Binary files a/devices/surface-hub/images/who-owns-pc.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-02a.png b/devices/surface-hub/images/wicd-screen-apps-02a.png deleted file mode 100644 index caf88b011e..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-02a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-03a.png b/devices/surface-hub/images/wicd-screen-apps-03a.png deleted file mode 100644 index 20d4218c6b..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-03a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-04a.png b/devices/surface-hub/images/wicd-screen-apps-04a.png deleted file mode 100644 index 494a661420..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-04a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-06a.png b/devices/surface-hub/images/wicd-screen-apps-06a.png deleted file mode 100644 index 44e6e2cee7..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-06a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-08a.png b/devices/surface-hub/images/wicd-screen-apps-08a.png deleted file mode 100644 index 19ce342449..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-08a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-10a.png b/devices/surface-hub/images/wicd-screen-apps-10a.png deleted file mode 100644 index 820fd3efff..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-10a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-11a.png b/devices/surface-hub/images/wicd-screen-apps-11a.png deleted file mode 100644 index 2bf0a692ef..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-11a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-12a.png b/devices/surface-hub/images/wicd-screen-apps-12a.png deleted file mode 100644 index 8ab9d524f4..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-12a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen01a.png b/devices/surface-hub/images/wicd-screen01a.png deleted file mode 100644 index 34b528951e..0000000000 Binary files a/devices/surface-hub/images/wicd-screen01a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen02a.png b/devices/surface-hub/images/wicd-screen02a.png deleted file mode 100644 index f76eec1efb..0000000000 Binary files a/devices/surface-hub/images/wicd-screen02a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen02b.png b/devices/surface-hub/images/wicd-screen02b.png deleted file mode 100644 index 6686186f8b..0000000000 Binary files a/devices/surface-hub/images/wicd-screen02b.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen02c.png b/devices/surface-hub/images/wicd-screen02c.png deleted file mode 100644 index eb8fd6b307..0000000000 Binary files a/devices/surface-hub/images/wicd-screen02c.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen03a.png b/devices/surface-hub/images/wicd-screen03a.png deleted file mode 100644 index afec8ef352..0000000000 Binary files a/devices/surface-hub/images/wicd-screen03a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen04a.png b/devices/surface-hub/images/wicd-screen04a.png deleted file mode 100644 index 62ea7e595c..0000000000 Binary files a/devices/surface-hub/images/wicd-screen04a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen06a.png b/devices/surface-hub/images/wicd-screen06a.png deleted file mode 100644 index 53c223746b..0000000000 Binary files a/devices/surface-hub/images/wicd-screen06a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen07a.png b/devices/surface-hub/images/wicd-screen07a.png deleted file mode 100644 index e44f5cf0b7..0000000000 Binary files a/devices/surface-hub/images/wicd-screen07a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen08a.png b/devices/surface-hub/images/wicd-screen08a.png deleted file mode 100644 index 7a2b5bbefb..0000000000 Binary files a/devices/surface-hub/images/wicd-screen08a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen09a.png b/devices/surface-hub/images/wicd-screen09a.png deleted file mode 100644 index 29e14902bd..0000000000 Binary files a/devices/surface-hub/images/wicd-screen09a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen10a.png b/devices/surface-hub/images/wicd-screen10a.png deleted file mode 100644 index 556c9fbdb5..0000000000 Binary files a/devices/surface-hub/images/wicd-screen10a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen11a.png b/devices/surface-hub/images/wicd-screen11a.png deleted file mode 100644 index 9f7bf2ba64..0000000000 Binary files a/devices/surface-hub/images/wicd-screen11a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen12a.png b/devices/surface-hub/images/wicd-screen12a.png deleted file mode 100644 index 7c55111ae4..0000000000 Binary files a/devices/surface-hub/images/wicd-screen12a.png and /dev/null differ diff --git a/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx b/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx deleted file mode 100644 index 1d44312447..0000000000 Binary files a/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx and /dev/null differ diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md deleted file mode 100644 index d9a7bc204f..0000000000 --- a/devices/surface-hub/index.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -title: Surface Hub -author: robmazz -ms.author: robmazz -manager: laurawi -layout: LandingPage -ms.prod: surface-hub -ms.tgt_pltfrm: na -ms.devlang: na -ms.topic: landing-page -description: "Get started with Microsoft Surface Hub." -localization_priority: High ---- -# Get started with Surface Hub - -Surface Hub 2S is an all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. Use the links below to learn how to plan, deploy, manage, and support your Surface Hub devices. - -

          - - - ---- - - \ No newline at end of file diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md deleted file mode 100644 index 20c6c45925..0000000000 --- a/devices/surface-hub/install-apps-on-surface-hub.md +++ /dev/null @@ -1,189 +0,0 @@ ---- -title: Install apps on your Microsoft Surface Hub -description: Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business. -ms.assetid: 3885CB45-D496-4424-8533-C9E3D0EDFD94 -ms.reviewer: -manager: dansimp -keywords: install apps, Microsoft Store, Microsoft Store for Business -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 10/23/2018 -ms.localizationpriority: medium -audience: ITPro ---- - -# Install apps on your Microsoft Surface Hub - -You can install additional apps on your Surface Hub to fit your team or organization's needs. There are different methods for installing apps depending on whether you are developing and testing an app, or deploying a released app. This topic describes methods for installing apps for either scenario. - -A few things to know about apps on Surface Hub: -- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub. -- Apps must be targeted for the [Universal device family](https://msdn.microsoft.com/library/windows/apps/dn894631) or Windows Team device family. -- Surface Hub only supports [offline-licensed apps](https://docs.microsoft.com/microsoft-store/distribute-offline-apps) from [Microsoft Store for Business](https://businessstore.microsoft.com/store). -- By default, apps must be Store-signed to be installed. During testing and development, you can also choose to run developer-signed UWP apps by placing the device in developer mode. -- When submitting an app to the Microsoft Store, developers need to set Device family availability and Organizational licensing options to make sure an app will be available to run on Surface Hub. -- You need admin credentials to install apps on your Surface Hub. Since the device is designed to be used in communal spaces like meeting rooms, people can't access the Microsoft Store to download and install apps. - - -## Develop and test apps -While you're developing your own app, there are a few options for testing apps on Surface Hub. - -### Developer Mode -By default, Surface Hub only runs UWP apps that have been published to and signed by the Microsoft Store. Apps submitted to the Microsoft Store go through security and compliance tests as part of the [app certification process](https://msdn.microsoft.com/windows/uwp/publish/the-app-certification-process), so this helps safeguard your Surface Hub against malicious apps. - -By enabling developer mode, you can also install developer-signed UWP apps. - -> [!IMPORTANT] -> After developer mode has been enabled, you will need to reset the Surface Hub to disable it. Resetting the device removes all local user files and configurations and then reinstalls Windows. - -**To turn on developer mode** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **Update & security** > **For developers**. -4. Select **Developer mode** and accept the warning prompt. - -### Visual Studio -During development, the easiest way to test your app on a Surface Hub is using Visual Studio. Visual Studio's remote debugging feature helps you discover issues in your app before deploying it broadly. For more information, see [Test Surface Hub apps using Visual Studio](https://msdn.microsoft.com/windows/uwp/debug-test-perf/test-surface-hub-apps-using-visual-studio). - -### Provisioning package -Use Visual Studio to [create an app package](https://msdn.microsoft.com/library/windows/apps/hh454036.aspx) for your UWP app, signed using a test certificate. Then use Windows Imaging and Configuration Designer (ICD) to create a provisioning package containing the app package. For more information, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md). - - -## Submit apps to the Microsoft Store -Once an app is ready for release, developers need to submit and publish it to the Microsoft Store. For more information, see [Publish Windows apps](https://developer.microsoft.com/store/publish-apps). - -During app submission, developers need to set **Device family availability** and **Organizational licensing** options to make sure the app will be available to run on Surface Hub. - -**To set device family availability** -1. On the [Windows Dev Center](https://developer.microsoft.com), navigate to your app submission page. -2. Select **Packages**. -3. Under **Device family availability**, select these options: - - - **Windows 10 Team** - - **Let Microsoft decide whether to make the app available to any future device families** - -![Image showing Device family availability page - part of Microsoft Store app submission process.](images/device-family.png) - -For more information, see [Device family availability](https://msdn.microsoft.com/windows/uwp/publish/upload-app-packages#device-family-availability). - -**To set organizational licensing** -1. On the [Windows Dev Center](https://developer.microsoft.com), navigate to your app submission page. -2. Select **Pricing and availability**. -3. Under Organizational licensing, select **Allow disconnected (offline) licensing for organizations**. - -![Image showing Organizational licensing page - part of Microsoft Store app submission process.](images/sh-org-licensing.png) - -> [!NOTE] -> **Make my app available to organizations with Store-managed (online) licensing and distribution** is selected by default. - -> [!NOTE] -> Developers can also publish line-of-business apps directly to enterprises without making them broadly available in the Store. For more information, see [Distribute LOB apps to enterprises](https://msdn.microsoft.com/windows/uwp/publish/distribute-lob-apps-to-enterprises). - -For more information, see [Organizational licensing options](https://msdn.microsoft.com/windows/uwp/publish/organizational-licensing). - - -## Deploy released apps - -There are several options for installing apps that have been released to the Microsoft Store, depending on whether you want to evaluate them on a few devices, or deploy them broadly to your organization. - -To install released apps: -- Download the app using the Microsoft Store app, or -- Download the app package from the Microsoft Store for Business, and distribute it using a provisioning package or a supported MDM provider. - -### Microsoft Store app -To evaluate apps released on the Microsoft Store, use the Microsoft Store app on the Surface Hub to browse and download apps. - -> [!NOTE] -> Using the Microsoft Store app is not the recommended method of deploying apps at scale to your organization: -> - To download apps, you must sign in to the Microsoft Store app with a Microsoft account or organizational account. However, you can only connect an account to a maximum of 10 devices at once. If you have more than 10 Surface Hubs, you will need to create multiple accounts or remove devices from your account between app installations. -> - To install apps, you will need to manually sign in to the Microsoft Store app on each Surface Hub you own. - -**To browse the Microsoft Store on Surface Hub** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **This device** > **Apps & features**. -4. Select **Open Store**. - -### Download app packages from Microsoft Store for Business -To download the app package you need to install apps on your Surface Hub, visit the [Microsoft Store for Business](https://www.microsoft.com/business-store). The Store for Business is where you can find, acquire, and manage apps for the Windows 10 devices in your organization, including Surface Hub. - -> [!NOTE] -> Currently, Surface Hub only supports offline-licensed apps available through the Store for Business. App developers set offline-license availability when they submit apps. - -Find and acquire the app you want, then download: -- The offline-licensed app package (either an .appx or an .appxbundle) -- The *unencoded* license file (if you're using provisioning packages to install the app) -- The *encoded* license file (if you're using MDM to distribute the app) -- Any necessary dependency files - -For more information, see [Download an offline-licensed app](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app). - -### Provisioning package -You can manually install the offline-licensed apps that you downloaded from the Store for Business on a few Surface Hubs using provisioning packages. Use Windows Imaging and Configuration Designer (ICD) to create a provisioning package containing the app package and *unencoded* license file that you downloaded from the Store for Business. For more information, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md). - -### Supported MDM provider -To deploy apps to a large number of Surface Hubs in your organization, use a supported MDM provider. The table below shows which MDM providers support deploying offline-licensed app packages. - -| MDM provider | Supports offline-licensed app packages | -|-----------------------------|----------------------------------------| -| On-premises MDM with System Center Configuration Manager (beginning in version 1602) | Yes | -| Hybrid MDM with System Center Configuration Manager and Microsoft Intune | Yes | -| [Microsoft Intune standalone](https://docs.microsoft.com/intune/windows-store-for-business) | Yes | -| Third-party MDM provider | Check to make sure your MDM provider supports deploying offline-licensed app packages. | - -**To deploy apps remotely using System Center Configuration Manager (either on-prem MDM or hybrid MDM)** - -> [!NOTE] -> These instructions are based on the current branch of System Center Configuration Manager. - -1. Enroll your Surface Hubs to System Center Configuration Manager. For more information, see [Enroll a Surface Hub into MDM](manage-settings-with-mdm-for-surface-hub.md#enroll-into-mdm). -2. Download the offline-licensed app package, the *encoded* license file, and any necessary dependency files from the Store for Business. For more information, see [Download an offline-licensed app](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app). Place the downloaded files in the same folder on a network share. -3. In the **Software Library** workspace of the Configuration Manager console, click **Overview** > **Application Management** > **Applications**. -4. On the **Home** tab, in the **Create** group, click **Create Application**. -5. On the **General** page of the **Create Application Wizard**, select the **Automatically detect information about this application from installation files** check box. -6. In the **Type** drop-down list, select **Windows app package (\*.appx, \*.appxbundle)**. -7. In the **Location** field, specify the UNC path in the form \\server\share\\filename for the offline-licensed app package that you downloaded from the Store for Business. Alternatively, click **Browse** to browse to the app package. -8. On the **Import Information** page, review the information that was imported, and then click **Next**. If necessary, you can click **Previous** to go back and correct any errors. -9. On the **General Information** page, complete additional details about the app. Some of this information might already be populated if it was automatically obtained from the app package. -10. Click **Next**, review the application information on the Summary page, and then complete the Create Application Wizard. -11. Create a deployment type for the application. For more information, see [Create deployment types for the application](https://docs.microsoft.com/sccm/apps/deploy-use/create-applications#create-deployment-types-for-the-application). -12. Deploy the application to your Surface Hubs. For more information, see [Deploy applications with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications). -13. As needed, update the app by downloading a new package from the Store for Business, and publishing an application revision in Configuration Manager. For more information, see [Update and retire applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt595704.aspx). - -> [!NOTE] -> If you are using System Center Configuration Manager (current branch), you can bypass the above steps by connecting the Store for Business to System Center Configuration Manager. By doing so, you can synchronize the list of apps you've purchased with System Center Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. For more information, see [Manage apps from the Microsoft Store for Business with System Center Configuration Manager](https://technet.microsoft.com/library/mt740630.aspx). - - -## Summary - -There are a few different ways to install apps on your Surface Hub depending on whether you are developing apps, evaluating apps on a small number of devices, or deploying apps broadly to your organization. This table summarizes the supported methods: - -| Install method | Developing apps | Evaluating apps on
          a few devices | Deploying apps broadly
          to your organization | -| -------------------------- | --------------- | ------------------------------------- | ---------------------- | -| Visual Studio | X | | | -| Provisioning package | X | X | | -| Microsoft Store app | | X | | -| Supported MDM provider | | | X | - -## More information - -- [Blog post: Deploy Windows Store apps to Surface Hub using Intune](https://blogs.technet.microsoft.com/y0av/2018/01/18/7-2/) - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/juneworkspace.code-workspace b/devices/surface-hub/juneworkspace.code-workspace deleted file mode 100644 index f23e17c3ca..0000000000 --- a/devices/surface-hub/juneworkspace.code-workspace +++ /dev/null @@ -1,11 +0,0 @@ -{ - "folders": [ - { - "path": "C:\\github\\windows-docs-pr" - }, - { - "path": "." - } - ], - "settings": {} -} \ No newline at end of file diff --git a/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md b/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md deleted file mode 100644 index 93c56d4e28..0000000000 --- a/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: Known issues and additional information about Microsoft Surface Hub -description: Outlines known issues with Microsoft Surface Hub. -ms.assetid: aee90a0c-fb05-466e-a2b1-92de89d0f2b7 -ms.reviewer: -manager: -keywords: surface, hub, issues -ms.prod: surface-hub -ms.sitesec: library -author: todmccoy -ms.author: v-todmc -ms.topic: article -ms.localizationpriority: medium ---- - -# Known issues and additional information about Microsoft Surface Hub - -We're listening. Quality is a top priority, and we want to keep you informed about issues impacting customers. The following are some known issues of Microsoft Surface Hub: - -- **Skype for Business isn't using proxy for media traffic with RS2** -
          For some Surface Hub users who are behind a proxy, Skype for Business won't use the proxy server for media. However, the Surface Hub will be able to sign in to the account. We received your feedback and are aware of the media traffic issue when you are using proxy. We're actively investigating this issue and will release fixes as soon as a solution is identified and tested. - -- **For AAD joined devices, when a user tries to sign in to "My meetings & files", Surface Hub reports that there is no Internet connection** -
          We’re aware of a set of issues that affect sign-in and document access on Surface Hub. We're actively investigating these issues. As a workaround until a resolution is released, customers can reset their devices and set up their Hub to use a local admin account. After reconfiguring to use the local admin account, "My meetings and files" will work as expected. -- **Single sign-in when Azure AD joined** -
          Surface Hub was designed for communal spaces, which impacts the way user credentials are stored. Because of this, there are currently limitations in how single sign-in works when devices are Azure AD joined. Microsoft is aware of this limitation and is actively investigating options for a resolution. -- **Miracast over Infrastructure projection to Surface Hub fails if the Surface Hub has a dot character (.) in the friendly name** -
          Surface Hub users may experience issues projecting to their device if the Friendly Name includes a period or dot in the name (.) -- for example, "Conf.Room42". To work around the issue, change the Friendly Name of the Hub in **Settings** > **Surface Hub** > **About**, and then restart the device. Microsoft is working on a solution to this issue. \ No newline at end of file diff --git a/devices/surface-hub/local-management-surface-hub-settings.md b/devices/surface-hub/local-management-surface-hub-settings.md deleted file mode 100644 index 810691dfe8..0000000000 --- a/devices/surface-hub/local-management-surface-hub-settings.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Local management Surface Hub settings -description: How to manage Surface Hub settings with Settings. -keywords: manage Surface Hub, Surface Hub settings -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/08/2019 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Local management for Surface Hub settings - -After initial setup of Microsoft Surface Hub, the device’s settings can be locally managed through **Settings**. - -## Surface Hub settings - -Surface Hubs have many settings that are common to other Windows devices, but also have settings which are only configurable on Surface Hubs. This table lists settings only configurable on Surface Hubs. - -| Setting | Location | Description | -| ------- | -------- | ----------- | -| Device account | Surface Hub > Accounts | Set or change the Surface Hub's device account. | -| Device account sync status | Surface Hub > Accounts | Check the sync status of the device account’s mail and calendar on the Surface Hub. | -| Password rotation | Surface Hub > Accounts | Choose whether to let the Surface Hub automatically rotate the device account's password.| -| Change admin account password | Surface Hub > Accounts | Change the password for the local admin account. This is only available if you configured the device to use a local admin during first run. | -| Device Management | Surface Hub > Device management | Manage policies and business applications using mobile device management (MDM). | -| Provisioning packages | Surface Hub > Device management | Set or change provisioning packages installed on the Surface Hub. | -| Open the Microsoft Store app | Surface Hub > Apps & features | The Microsoft Store app is only available to admins through the Settings app. | -| Skype for Business domain name | Surface Hub > Calling & Audio | Configure a domain name for your Skype for Business server. | -| Default Speaker volume | Surface Hub > Calling & Audio | Configure the default speaker volume for the Surface Hub when it starts a session. | -| Default microphone and speaker settings | Surface Hub > Calling & Audio | Configure a default microphone and speaker for calls, and a default speaker for media playback. | -| Enable Dolby Audio X2 | Surface Hub > Calling & Audio | Configure the Dolby Audio X2 speaker enhancements. | -| Open Connect App automatically | Surface Hub > Projection | Choose whether projection will automatically open the Connect app or wait for user input before opening. | -| Turn off wireless projection using Miracast | Surface Hub > Projection | Choose whether presenters can wirelessly project to the Surface Hub using Miracast. | -| Require a PIN for wireless projection | Surface Hub > Projection | Choose whether people are required to enter a PIN before they use wireless projection. | -| Wireless projection (Miracast) channel | Surface Hub > Projection | Set the channel for Miracast projection. | -| Meeting info shown on the welcome screen | Surface Hub > Welcome screen | Choose whether meeting organizer, time, and subject show up on the welcome screen. | -| Welcome screen background | Surface Hub > Welcome screen | Choose a background image for the welcome screen. | -| Idle timeout to Welcome screen | Surface Hub > Session & Power | Choose how long until the Surface Hub returns to the welcome screen after no motion is detected. | -| Resume session | Surface Hub > Session & Power | Choose to allow users to resume a session after no motion is detected or to automatically clean up a session. | -| Access to Office 365 meetings and files | Surface Hub > Session & Power | Choose whether a user can sign in to Office 365 to get access to their meetings and files. | -| Turn on screen with motion sensors | Surface Hub > Session & clean up | Choose whether the screen turns on when motion is detected. | -| Session time out | Surface Hub > Session & clean up | Choose how long the device needs to be inactive before returning to the welcome screen. | -| Sleep time out | Surface Hub > Session & clean up | Choose how long the device needs to be inactive before going to sleep mode. | -| Friendly name | Surface Hub > About | Set the Surface Hub name that people will see when connecting wirelessly. | -| Maintenance hours | Update & security > Windows Update > Advanced options | Configure when updates can be installed. | -| Configure Windows Server Update Services (WSUS) server | Update & security > Windows Update > Advanced options | Change whether Surface Hub receives updates from a WSUS server instead of Windows Update. | -| Recover from the cloud | Update & security > Recovery | Reinstall the operating system on Surface Hub to a manufacturer build from the cloud. | -| Save BitLocker key | Update & security > Recovery | Backup your Surface Hub's BitLocker key to a USB drive. | -| Collect logs | Update & security > Recovery | Save logs to a USB drive to send to Microsoft later. | - -## Related topics - -[Manage Surface Hub settings](manage-surface-hub-settings.md) - -[Remote Surface Hub management](remote-surface-hub-management.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md deleted file mode 100644 index 96577828d5..0000000000 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ /dev/null @@ -1,281 +0,0 @@ ---- -title: Manage settings with an MDM provider (Surface Hub) -description: Microsoft Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution. -ms.assetid: 18EB8464-6E22-479D-B0C3-21C4ADD168FE -ms.reviewer: -manager: dansimp -keywords: mobile device management, MDM, manage policies -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/07/2018 -ms.localizationpriority: medium ---- - -# Manage settings with an MDM provider (Surface Hub) - -Surface Hub and other Windows 10 devices allow IT administrators to manage settings and policies using a mobile device management (MDM) provider. A built-in management component communicates with the management server, so there is no need to install additional clients on the device. For more information, see [Windows 10 mobile device management](https://msdn.microsoft.com/library/windows/hardware/dn914769.aspx). - -Surface Hub has been validated with Microsoft’s first-party MDM providers: -- On-premises MDM with System Center Configuration Manager (beginning in version 1602) -- Hybrid MDM with System Center Configuration Manager and Microsoft Intune -- Microsoft Intune standalone - -You can also manage Surface Hubs using any third-party MDM provider that can communicate with Windows 10 using the MDM protocol. - -##
          Enroll a Surface Hub into MDM -You can enroll your Surface Hubs using bulk, manual, or automatic enrollment. - -### Bulk enrollment -**To configure bulk enrollment** -- Surface Hub supports the [Provisioning CSP](https://msdn.microsoft.com/library/windows/hardware/mt203665.aspx) for bulk enrollment into MDM. For more information, see [Windows 10 bulk enrollment](https://msdn.microsoft.com/library/windows/hardware/mt613115.aspx).
          ---OR-- -- If you have an on-premises System Center Configuration Manager infrastructure, see [How to bulk enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://technet.microsoft.com/library/mt627898.aspx). - -### Manual enrollment -**To configure manual enrollment** -1. On your Surface Hub, open **Settings**. -2. Type the device admin credentials when prompted. -3. Select **This device**, and navigate to **Device management**. -4. Under **Device management**, select **+ Device management**. -5. Follow the instructions in the dialog to connect to your MDM provider. - -### Automatic enrollment via Azure Active Directory join - -Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory. - -For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment). - -## Manage Surface Hub settings with MDM - -You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings), and some [Windows 10 settings](#supported-windows-10-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and System Center Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML. - -### Supported Surface Hub CSP settings - -You can configure the Surface Hub settings in the following table using MDM. The table identifies if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML. - -For more information, see [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323). - - -| Setting | Node in the SurfaceHub CSP | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Maintenance hours | MaintenanceHoursSimple/Hours/StartTime
          MaintenanceHoursSimple/Hours/Duration | Yes | Yes | Yes | -| Automatically turn on the screen using motion sensors | InBoxApps/Welcome/AutoWakeScreen | Yes | Yes | Yes | -| Require a pin for wireless projection | InBoxApps/WirelessProjection/PINRequired | Yes | Yes | Yes | -| Enable wireless projection | InBoxApps/WirelessProjection/Enabled | Yes | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Miracast channel to use for wireless projection | InBoxApps/WirelessProjection/Channel | Yes | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Connect to your Operations Management Suite workspace | MOMAgent/WorkspaceID
          MOMAgent/WorkspaceKey | Yes | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Welcome screen background image | InBoxApps/Welcome/CurrentBackgroundPath | Yes | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Meeting information displayed on the welcome screen | InBoxApps/Welcome/MeetingInfoOption | Yes | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Friendly name for wireless projection | Properties/FriendlyName | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Device account, including password rotation | DeviceAccount/*``*
          See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes | -| Specify Skype domain | InBoxApps/SkypeForBusiness/DomainName | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Auto launch Connect App when projection is initiated | InBoxApps/Connect/AutoLaunch | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Set default volume | Properties/DefaultVolume | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Set screen timeout | Properties/ScreenTimeout | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Set session timeout | Properties/SessionTimeout | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Set sleep timeout | Properties/SleepTimeout | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow session to resume after screen is idle | Properties/AllowSessionResume | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow device account to be used for proxy authentication | Properties/AllowAutoProxyAuth | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -### Supported Windows 10 settings - -In addition to Surface Hub-specific settings, there are numerous settings common to all Windows 10 devices. These settings are defined in the [Configuration service provider reference](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference). - -The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table identifies if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML. - -#### Security settings - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|--------------------|------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes.
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``*
          See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
          . | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
          | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Browser settings - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|-----------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow developer tools | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Allow SmartScreen | Keep this enabled to turn on SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Prevent ignoring SmartScreen Filter warnings for websites | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Prevent ignoring SmartScreen Filter warnings for files | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Windows Update settings - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Defer feature updates | See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Configure device to use WSUS | Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``*
          See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Windows Defender settings - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|-------------------|----------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``*
          See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Defender status | Use to initiate a Defender scan, force a Security intelligence update, query any threats detected. | [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx) | Yes | Yes | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Remote reboot - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow
          See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes | No | Yes | -| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
          See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | -| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
          See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Install certificates - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|---------------------------------|--------------------------------------------------------------|----------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------| -| Install trusted CA certificates | Use to deploy trusted root and intermediate CA certificates. | [RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx) | Yes.
          See [Configure Intune certificate profiles](https://docs.microsoft.com/intune/deploy-use/configure-intune-certificate-profiles). | Yes.
          See [How to create certificate profiles in System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/create-certificate-profiles). | Yes | - - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Collect logs - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|------------------|----------------------------------------------------|----------------------------------------------------------------------------------------|---------------------------|------------------------------------------|-----------------------------| -| Collect ETW logs | Use to remotely collect ETW logs from Surface Hub. | [DiagnosticLog CSP](https://msdn.microsoft.com/library/windows/hardware/mt219118.aspx) | No | No | Yes | - - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Set network quality of service (QoS) policy - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|------------------------|--------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Set Network QoS Policy | Use to set a QoS policy to perform a set of actions on network traffic. This is useful for prioritizing Skype network packets. | [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Set network proxy - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|-------------------|---------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Configure Start menu - -| Setting | Details | CSP reference | Supported with
          Intune? | Supported with
          Configuration Manager? | Supported with
          SyncML\*? | -|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Configure Start menu | Use to configure which apps are displayed on the Start menu. For more information, see [Configure Surface Hub Start menu](surface-hub-start-menu.md) | [Policy CSP: Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Yes
          [Use a custom policy.](#example-intune) | Yes.
          [Use a custom setting.](#example-sccm) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -### Generate OMA URIs for settings -You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager. - -**To generate the OMA URI for any setting in the CSP documentation** -1. In the CSP documentation, identify the root node of the CSP. Generally, this looks like `./Vendor/MSFT/`
          -*For example, the root node of the [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) is `./Vendor/MSFT/SurfaceHub`.* -2. Identify the node path for the setting you want to use.
          -*For example, the node path for the setting to enable wireless projection is `InBoxApps/WirelessProjection/Enabled`.* -3. Append the node path to the root node to generate the OMA URI.
          -*For example, the OMA URI for the setting to enable wireless projection is `./Vendor/MSFT/SurfaceHub/InBoxApps/WirelessProjection/Enabled`.* - -The data type is also stated in the CSP documentation. The most common data types are: -- char (String) -- int (Integer) -- bool (Boolean) - - - -## Example: Manage Surface Hub settings with Microsoft Intune - -You can use Microsoft Intune to manage Surface Hub settings. For custom settings, follow the instructions in [How to configure custom device settings in Microsoft Intune](https://docs.microsoft.com/intune/custom-settings-configure). For **Platform**, select **Windows 10 and later**, and in **Profile type**, select **Device restrictions (Windows 10 Team)**. - - - - -## Example: Manage Surface Hub settings with System Center Configuration Manager -System Center Configuration Manager supports managing modern devices that do not require the Configuration Manager client to manage them, including Surface Hub. If you already use System Center Configuration Manager to manage other devices in your organization, you can continue to use the Configuration Manager console as your single location for managing Surface Hubs. - -> [!NOTE] -> These instructions are based on the current branch of System Center Configuration Manager. - -**To create a configuration item for Surface Hub settings** - -1. On the **Assets and Compliance** workspace of the Configuration Manager console, click **Overview** > **Compliance Settings** > **Configuration Items**. -2. On the **Home** tab, in the **Create** group, click **Create Configuration Item**. -3. On the **General** page of the Create Configuration Item Wizard, specify a name and optional description for the configuration item. -4. Under **Settings for devices managed without the Configuration Manager client**, select **Windows 8.1 and Windows 10**, and then click **Next**. - - ![example of UI](images/sccm-create.png) -5. On the **Supported Platforms** page, expand **Windows 10** and select **All Windows 10 Team and higher**. Unselect the other Windows platforms, and then click **Next**. - - ![select platform](images/sccm-platform.png) -7. On the **Device Settings** page, under **Device settings groups**, select **Windows 10 Team**. - - -8. On the **Windows 10 Team** page, configure the settings you require. - - ![Windows 10 Team](images/sccm-team.png) -9. You'll need to create custom settings to manage settings that are not available in the Windows 10 Team page. On the **Device Settings** page, select the check box **Configure additional settings that are not in the default setting groups**. - - ![additional settings](images/sccm-additional.png) -10. On the **Additional Settings** page, click **Add**. -11. In the **Browse Settings** dialog, click **Create Setting**. -12. In the **Create Setting** dialog, under the **General** tab, specify a name and optional description for the custom setting. -13. Under **Setting type**, select **OMA URI**. -14. Complete the form to create a new setting, and then click **OK**. - - ![OMA URI setting](images/sccm-oma-uri.png) -15. On the **Browse Settings** dialog, under **Available settings**, select the new setting you created, and then click **Select**. -16. On the **Create Rule** dialog, complete the form to specify a rule for the setting, and then click **OK**. -17. Repeat steps 9 to 15 for each custom setting you want to add to the configuration item. -18. When you're done, on the **Browse Settings** dialog, click **Close**. -19. Complete the wizard.
          You can view the new configuration item in the **Configuration Items** node of the **Assets and Compliance** workspace. - -For more information, see [Create configuration items for Windows 8.1 and Windows 10 devices managed without the System Center Configuration Manager client](https://docs.microsoft.com/sccm/compliance/deploy-use/create-configuration-items-for-windows-8.1-and-windows-10-devices-managed-without-the-client). - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - - - - - - - - - - - diff --git a/devices/surface-hub/manage-surface-hub-settings.md b/devices/surface-hub/manage-surface-hub-settings.md deleted file mode 100644 index a5d76ff156..0000000000 --- a/devices/surface-hub/manage-surface-hub-settings.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Manage Surface Hub settings -description: This section lists topics for managing Surface Hub settings. -keywords: Surface Hub accessibility settings, device account, device reset, windows updates, wireless network management -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Manage Surface Hub settings - -## In this section - -|Topic | Description| -| ------ | --------------- | -| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | Learn about Surface Hub settings. | -| [Accessibility](accessibility-surface-hub.md) | Accessibility settings for the Surface Hub can be changed by using the Settings app. You'll find them under Ease of Access. Your Surface Hub has the same accessibility options as Windows 10.| -| [Change the Surface Hub device account](change-surface-hub-device-account.md) | You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned.| -| [Device reset](device-reset-surface-hub.md) | You may need to reset your Surface Hub.| -| [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md) | Options to configure domain name with Surface Hub. | -| [Wireless network management](wireless-network-management-for-surface-hub.md) | Surface Hub offers two options for network connectivity to your corporate network and Internet: wireless, and wired. While both provide network access, we recommend you use a wired connection. | diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md deleted file mode 100644 index fcd75f6dfd..0000000000 --- a/devices/surface-hub/manage-surface-hub.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Manage Microsoft Surface Hub -description: How to manage your Surface Hub after finishing the first-run program. -ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1 -ms.reviewer: -manager: dansimp -keywords: manage Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/17/2018 -ms.localizationpriority: medium ---- - -# Manage Microsoft Surface Hub - -After initial setup of Microsoft Surface Hub, the device’s settings and configuration can be modified or changed in a couple ways: - -- **Local management** - Every Surface Hub can be configured locally using the **Settings** app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app. For more information, see [Local management for Surface Hub settings](local-management-surface-hub-settings.md). -- **Remote management** - Surface Hub allow IT admins to manage settings and policies using a mobile device management (MDM) provider, such as Microsoft Intune, System Center Configuration Manager, and other third-party providers. Additionally, admins can monitor Surface Hubs using Microsoft Operations Management Suite (OMS). For more information, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md), and [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). - -> [!NOTE] -> These management methods are not mutually exclusive. Devices can be both locally and remotely managed if you choose. However, MDM policies and settings will overwrite any local changes when the Surface Hub syncs with the management server. - -## In this section - -Learn about managing and updating Surface Hub. - -| Topic | Description | -| ----- | ----------- | -| [Remote Surface Hub management](remote-surface-hub-management.md) |Topics related to managing your Surface Hub remotely. Include install apps, managing settings with MDM and monitoring with Operations Management Suite. | -| [Manage Surface Hub settings](manage-surface-hub-settings.md) |Topics related to managing Surface Hub settings: accessibility, device account, device reset, fully qualified domain name, Windows Update settings, and wireless network | -| [Install apps on your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/install-apps-on-surface-hub) | Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business.| -[Configure Surface Hub Start menu](surface-hub-start-menu.md) | Use MDM to customize the Start menu for Surface Hub. -| [Set up and use Microsoft Whiteboard](whiteboard-collaboration.md) | Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. | -| [End a meeting with End session](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting.| -| [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) | You can sign in to a Surface Hub without a password using the Microsoft Authenticator app, available on Android and iOS. | -| [Save your BitLocker key](https://technet.microsoft.com/itpro/surface-hub/save-bitlocker-key-surface-hub) | Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.| -| [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.| -| [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) | You can use Miracast on your wireless network or LAN to connect to Surface Hub. | - [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices. -| [Using a room control system](https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.| -[Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) | Use the Surface Hub Recovery Tool to re-image the Surface Hub SSD. -[Surface Hub SSD replacement](surface-hub-ssd-replacement.md) | Learn how to remove and replace the solid state drive in your Surface Hub. - -## Related topics - -- [View Power BI presentation mode on Surface Hub & Windows 10](https://powerbi.microsoft.com/documentation/powerbi-mobile-win10-app-presentation-mode/) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md deleted file mode 100644 index 01c378c14a..0000000000 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: Windows updates (Surface Hub) -description: You can manage Windows updates on your Microsoft Surface Hub by setting the maintenance window, deferring updates, or using Windows Server Update Services (WSUS). -ms.assetid: A737BD50-2D36-4DE5-A604-55053D549045 -ms.reviewer: -manager: dansimp -keywords: manage Windows updates, Surface Hub, Windows Server Update Services, WSUS -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: medium ---- - -# Windows updates (Surface Hub) - -New releases of the Surface Hub operating system are published through Windows Update, just like releases of Windows 10. There are a couple of ways you can manage which updates are installed on your Surface Hubs, and the timing for when updates are applied. -- **Windows Update for Business** - New in Windows 10, Windows Update for Business is a set of features designed to provide enterprises additional control over how and when Windows Update installs releases, while reducing device management costs. Using this method, Surface Hubs are directly connected to Microsoft’s Windows Update service. -- **Windows Server Update Services (WSUS)** - Set of services that enable IT administrators to obtain the updates that Windows Update determines are applicable to the devices in their enterprise, perform additional testing and evaluation on the updates, and select the updates they want to install. Using this method, Surface Hubs will receive updates from WSUS rather than Windows Update. - -You can also configure Surface Hub to receive updates from both Windows Update for Business and WSUS. See [Integrate Windows Update for Business with Windows Server Update Services](https://technet.microsoft.com/itpro/windows/manage/waas-integrate-wufb#integrate-windows-update-for-business-with-windows-server-update-services) for details. - -| Capabilities | Windows Update for Business | Windows Server Update Services (WSUS) | -| ------------ | --------------------------- | ------------------------------------- | -| Receive updates directly from Microsoft's Windows Update service, with no additional infrastructure required. | Yes | No | -| Defer updates to provide additional time for testing and evaluation. | Yes | Yes | -| Deploy updates to select groups of devices. | Yes | Yes | -| Define maintenance windows for installing updates. | Yes | Yes | - -> [!TIP] -> Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Optimize update delivery for Windows 10 updates](https://technet.microsoft.com/itpro/windows/manage/waas-optimize-windows-10-updates) for details. - -> [!NOTE] -> Surface Hub does not currently support rolling back updates. - - -## Surface Hub servicing model - -Surface Hub uses the Windows 10 servicing model, referred to as [Windows as a Service (WaaS)](https://docs.microsoft.com/windows/deployment/update/waas-overview). Traditionally, new features were added only in new versions of Windows that were released every few years. Each new version required lengthy and expensive processes to deploy in an organization. As a result, end users and organizations don't frequently enjoy the benefits of new innovation. The goal of Windows as a Service is to continually provide new capabilities while maintaining a high level of quality. - -Microsoft publishes two types of Surface Hub releases broadly on an ongoing basis: -- **Feature updates** - Updates that install the latest new features, experiences, and capabilities. Microsoft expects to publish two new feature updates per year. -- **Quality updates** - Updates that focus on the installation of security fixes, drivers, and other servicing updates. Microsoft expects to publish one cumulative quality update per month. - -In order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10, including Surface Hub, will be cumulative. This means new feature updates and quality updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 quality update. For example, if a quality update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes. - -The Surface Hub operating system receives updates on the [Semi-Annual Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes). Like other editions of Windows 10, the servicing lifetime is finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. - -For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). - - -## Use Windows Update for Business -Surface Hubs, like all Windows 10 devices, include **Windows Update for Business (WUfB)** to enable you to control how your devices are being updated. Windows Update for Business helps reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. For more information, see [Manage updates using Windows Update for Business](https://technet.microsoft.com/itpro/windows/manage/waas-manage-updates-wufb). - -**To set up Windows Update for Business:** -1. [Group Surface Hub into deployment rings](#group-surface-hub-into-deployment-rings) -2. [Configure when Surface Hub receives updates](#configure-when-surface-hub-receives-updates). - -> [!NOTE] -> You can use Microsoft Intune, System Center Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune) - - -### Group Surface Hub into deployment rings -Use deployment rings to control when updates roll out to your Surface Hubs, giving you time to validate them. For example, you can update a small pool of devices first to verify quality before a broader roll-out to your organization. Depending on who manages Surface Hub in your organization, consider incorporating Surface Hub into the deployment rings that you've built for your other Windows 10 devices. For more information about deployment rings, see [Build deployment rings for Windows 10 updates](https://technet.microsoft.com/itpro/windows/manage/waas-deployment-rings-windows-10-updates). - -This table gives examples of deployment rings. - -| Deployment ring | Ring size | Servicing branch | Deferral for feature updates | Deferral for quality updates (security fixes, drivers, and other updates) | Validation step | -| --------- | --------- | --------- | --------- | --------- | --------- | -| Preview (e.g. non-critical or test devices) | Small | Semi-annual channel (Targeted) | None. | None. | Manually test and evaluate new functionality. Pause updates if there are issues. | -| Release (e.g. devices used by select teams) | Medium | Semi-annual channel | None. | None. | Monitor device usage and user feedback. Pause updates if there are issues. | -| Broad deployment (e.g. most of the devices in your organization) | Large | Semi-annual channel | 120 days after release. | 7-14 days after release. | Monitor device usage and user feedback. Pause updates if there are issues. | -| Mission critical (e.g. devices in executive boardrooms) | Small | Semi-annual channel | 180 days after release (maximum deferral for feature updates). | 30 days after release (maximum deferral for quality updates). | Monitor device usage and user feedback. | - - - - - -### Configure when Surface Hub receives updates -Once you've determined deployment rings for your Surface Hubs, configure update deferral policies for each ring: -- To defer feature updates, set an appropriate [Update/DeferFeatureUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays) policy for each ring. -- To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferqualityupdatesperiodindays) policy for each ring. - -> [!NOTE] -> If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdates) and [Update/PauseQualityUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-pausequalityupdates). - - -## Use Windows Server Update Services - -You can connect Surface Hub to your Windows Server Update Services (WSUS) server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them. - -**To manually connect a Surface Hub to a WSUS server:** -1. Open **Settings** on your Surface Hub. -2. Enter the device admin credentials when prompted. -3. Navigate to **Update & security** > **Windows Update** > **Advanced options** > **Configure Windows Server Update Services (WSUS) server**. -4. Click **Use WSUS Server to download updates** and type the URL of your WSUS server. - -To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) policy. - -**If you use a proxy server or other method to block URLs** - -If you use a method other than WSUS to block specific URLs and prevent updates, you will need to add the following Windows update trusted site URLs to the “allow list”: -- `http(s)://*.update.microsoft.com` -- `http://download.windowsupdate.com` -- `http://windowsupdate.microsoft.com` - -Once the Windows 10 Team Anniversary Update is installed, you can remove these addresses to return your Surface Hub to its previous state. - -## Maintenance window - -To ensure the device is always available for use during business hours, Surface Hub performs its administrative functions during a specified maintenance window. During the maintenance window, the Surface Hub automatically installs updates through Windows Update or WSUS, and reboots the device if needed. - -Surface Hub follows these guidelines to apply updates: -- Install the update during the next maintenance window. If a meeting is scheduled to start during a maintenance window, or the Surface Hub sensors detect that the device is being used, the pending update will be postponed to the following maintenance window. -- If the next maintenance window is past the update’s prescribed grace period, the device will calculate the next available slot during business hours using the estimated install time from the update’s metadata. It will continue to postpone the update if a meeting is scheduled, or the Surface Hub sensors detect that the device is being used. -- If the next maintenance window is **not** past the update's grace period, the Surface Hub will continue to postpone the update. -- If a reboot is needed, the Surface Hub will automatically reboot during the next maintenance window. - -> [!NOTE] -> Allow time for updates when you first setup your Surface Hub. For example, a backlog of virus definitions may be available, which should be immediately installed. - -A default maintenance window is set for all new Surface Hubs: -- **Start time:** 3:00 AM -- **Duration:** 1 hour - -**To manually change the maintenance window:** -1. Open **Settings** on your Surface Hub. -2. Navigate to **Update & security** > **Windows Update** > **Advanced options**. -3. Under **Maintenance hours**, select **Change**. - -To change the maintenance window using MDM, set the **MOMAgent** node in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for more details. - - -## More information - -- [Blog post: Servicing, Flighting, and Managing updates for Surface Hub (With Intune, of course!)](https://blogs.technet.microsoft.com/y0av/2018/05/31/7-3/) - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md deleted file mode 100644 index 1b09f33999..0000000000 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Miracast on existing wireless network or LAN -description: Windows 10 enables you to send a Miracast stream over a local network. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Miracast on existing wireless network or LAN - -In the Windows 10, version 1703, Microsoft has extended the ability to send a Miracast stream over a local network rather than over a direct wireless link. This functionality is based on the [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx). - -Miracast over Infrastructure offers a number of benefits: - -- Windows automatically detects when sending the video stream over this path is applicable. -- Windows will only choose this route if the connection is over Ethernet or a secure Wi-Fi network. -- Users do not have to change how they connect to a Miracast receiver. They use the same UX as for standard Miracast connections. -- No changes to current wireless drivers or PC hardware are required. -- It works well with older wireless hardware that is not optimized for Miracast over Wi-Fi Direct. -- It leverages an existing connection which both reduces the time to connect and provides a very stable stream. - - -## How it works - -Users attempt to connect to a Miracast receiver as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. - - -## Enabling Miracast over Infrastructure - -If you have a Surface Hub or other Windows 10 device that has been updated to Windows 10, version 1703, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: - -- The Surface Hub or device (Windows PC or phone) needs to be running Windows 10, version 1703. -- A Surface Hub or Windows PC can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. - - As a Miracast receiver, the Surface Hub or device must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Surface Hub or device is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - - As a Miracast source, the Windows PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. -- The DNS Hostname (device name) of the Surface Hub or device needs to be resolvable via your DNS servers. You can achieve this by either allowing your Surface Hub to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the Surface Hub's hostname. -- Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. -- On Windows 10 PCs, the **Projecting to this PC** feature must be enabled within System Settings, and the device must have a Wi-Fi interface enabled in order to respond to discovery requests. - - -It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method. - -The **InBoxApps/WirelessProjection/PinRequired** setting in the [SurfaceHub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) is not required for Miracast over Infrastructure. This is because Miracast over Infrastructure only works when both devices are connected to the same enterprise network. This removes the security restriction that was previously missing from Miracast. We recommend that you continue using this setting (if you used it previously) as Miracast will fall back to regular Miracast if the infrastructure connection does not work. diff --git a/devices/surface-hub/miracast-troubleshooting.md b/devices/surface-hub/miracast-troubleshooting.md deleted file mode 100644 index 9517857676..0000000000 --- a/devices/surface-hub/miracast-troubleshooting.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Troubleshoot Miracast on Surface Hub -description: Learn how to resolve issues with Miracast on Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Troubleshoot Miracast on Surface Hub - -Surface Hub supports wireless projection through the Miracast protocol. Most wireless monitors and adapters available today use the original implementation of Miracast. Surface Hub uses a slightly different version of Miracast known as **Miracast Autonomous Group Owner (AGO)**. A common troubleshooting step when projecting wirelessly to Surface Hub fails is to test projecting to another wireless monitor or adapter. However, in most cases, these devices are not using Miracast AGO and do not handle wireless projection the same way that Surface Hub does. - -In traditional Miracast, the projecting device will connect the access point set up by the Miracast-enabled monitor, and then the monitor will send traffic back to the projecting device using the network channel of the projecting device. Miracast AGO is a two-step connection process: - -- The first step is an initial connection using 2.4GHz. -- After that initial handshake, the projecting device sends traffic to the monitor using the wireless channel settings on the monitor. If Surface Hub is connected to a Wi-Fi network, the access point, it will use the same channel as the connected network, otherwise it will use the Miracast channel from Settings. - -There are generally two types of issues with Miracast to Surface Hub: [connection](#connect-issues) and [performance](#performance-issues). In either case, it is a good idea to get a general picture of wireless network activity in the Surface Hub’s location. Running a network scanning tool will show you the available networks and channel usage in the environment. - -## Connect issues - -Ensure both Wi-Fi and Miracast are both enabled in Settings on Surface Hub. - -If you ran a network scan, you should see Surface Hub Miracast listed as an access point. If Surface Hub’s Miracast network shows up on the scan, but you cannot not see it as an available device, you can try to adjust the Miracast channel used by Surface Hub. - -When Surface Hub is connected to a Wi-Fi network it will use the same channel settings as the Wi-Fi access point for its Miracast access point. For troubleshooting purposes, disconnect Surface Hub from any Wi-Fi networks (but keep Wi-Fi enabled), so you can control the channel used for Miracast. You can manually select the Miracast channel in Settings. You will need to restart Surface Hub after each change. Generally speaking, you will want to use channels that do not show heavy utilization from the network scan. - -It is also possible that the connect issue can be the result of a problem on the connecting device. If the projecting device is running Windows, it should be Windows 8.1 or newer for full Miracast support. Again, for troubleshooting, disconnect the projecting device from any Wi-Fi networks. This will eliminate any channel switching between the access point channel and the Miracast channel set on Surface Hub. Also, some Group Policy and firewall settings may be tied to a Wi-Fi network. - -### Check drivers - -It is also a good idea to ensure the latest drivers and updates are installed on the projecting device. In Device Manager, open the Wi-Fi adapter and video adapter and check for an updated driver version. [Hotfix 3120232](https://support.microsoft.com/help/3120232/poor-wireless-performance-on-5-ghz-connections-on-surface-pro-3-and-surface-3) is highly recommended for Surface Pro 3 and Surface Pro 4 if they are on an older Wi-Fi driver. - -### Check for Miracast support - -Next, ensure Miracast is supported on the device. - -1. Press Windows Key + R and type `dxdiag`. -2. Click “Save all information”. -3. Open the saved dxdiag.txt and find **Miracast**. It should say **Available, with HDCP**. - -### Check firewall - -The Windows firewall can block Miracast traffic. The simplest test is to disable the firewall and test projection. If Miracast works with the firewall disabled, add an exception for - - C:\Windows\System32\WUDFHost.exe - Allow In/Out connections for TCP and UDP, Ports: All. - -### Check Group Policy settings - -On domain-joined devices, Group Policy can also block Miracast. - -1. Use the Windows Key + R and type `rsop.msc` to execute the **Resultant Set of Policy** snap-in. This will show the current policies applied to the PC. -2. Review **Computer Configuration** > **Windows Settings** > **Security Settings** > **Wireless Network (IEEE 802.11) Policies**. There should be a setting for wireless policies. -3. Double click the setting for wireless policies and a dialog box will appear. -4. Open the **Network Permissions** tab and select **Allow everyone to create all user profiles**. - -### Check event logs - -The last place to check is in the Event logs. Miracast events will be logged to **Wlanautoconfig**. This is true on both Surface Hub and the projecting device. If you export Surface Hub logs, you can view Surface Hub’s Wlanautoconfig in the **WindowsEventLog** folder. Errors in the event log can provide some additional details on where the connection fails. - -## Performance issues - -After wireless projection is connected, it is possible to see performance issues causing latency. This is generally a result of overall channel saturation or a situation that causes channel switching. - -For channel saturation, refer to the network scan and try to use channels with less traffic. - -Channel switching is caused when the Wi-Fi adapter needs to send traffic to multiple channels. Certain channels support Dynamic Frequency Selection (DFS). DFS is used on channels 49 through 148. Some Wi-Fi drivers will show poor performance when connected to a DFS channel. If you are seeing poor Miracast performance while connected to a DFS channel, try the projection on a non-DFS channel. Both Surface Hub and projecting device should use non-DFS channels. - -If Surface Hub and the projecting device are both connected to Wi-Fi but using different access points with different channels, this will force Surface Hub and the projecting device to channel switch while Miracast is connected. This will result in both poor wireless project and poor network performance over Wi-Fi. The channel switching will affect the performance of all wireless traffic, not just wireless projection. - -Channel switching will also occur if the projecting device is connected to an Wi-Fi network using a different channel than the channel that Surface Hub uses for Miracast. So, a best practice is to set Surface Hub’s Miracast channel to the same channel as the most commonly used access point. - -If there are multiple Wi-Fi networks or access points in the environment, some channel switching is unavoidable. This is best addressed by ensuring all Wi-Fi drivers are up to date. - diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md deleted file mode 100644 index e90e7d8f95..0000000000 --- a/devices/surface-hub/monitor-surface-hub.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Monitor your Microsoft Surface Hub -description: Monitoring for Microsoft Surface Hub devices is enabled through Microsoft Operations Management Suite (OMS). -ms.assetid: 1D2ED317-DFD9-423D-B525-B16C2B9D6942 -ms.reviewer: -manager: dansimp -keywords: monitor Surface Hub, Microsoft Operations Management Suite, OMS -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Monitor your Microsoft Surface Hub - -Monitoring for Microsoft Surface Hub devices is enabled through Microsoft Operations Management Suite (OMS). The [Operations Management Suite](https://go.microsoft.com/fwlink/?LinkId=718138) is Microsoft's IT management solution that helps you manage and protect your entire IT infrastructure, including your Surface Hubs. - - -Surface Hub is offered as a Log Analytics solution in OMS, allowing you to collect and view usage and reliability data across all your Surface Hubs. Use the Surface Hub solution to: -- Inventory your Surface Hubs. -- View a snapshot of usage and reliability data for Skype meetings, wired and wireless projection, and apps on your Surface Hubs. -- Create custom alerts to respond quickly if your Surface Hubs report software or hardware issues. - -## Add Surface Hub to Operations Management Suite - -1. **Sign in to Operations Management Suite (OMS)**. You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. -2. **Create a new OMS workspace**. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. -3. **Link Azure subscription to your workspace**. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. - - > [!NOTE] - > If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. Your workspace opens. - -4. **Add Surface Hub solution**. In the Solutions Gallery, select the **Surface Hub** tile in the gallery and then select **Add** on the solution’s details page. The solution is now visible on your workspace. - -## Use the Surface Hub dashboard -From the **Overview** page in your OMS workspace, click the Surface Hub tile to see the Surface Hub dashboard. Use the dashboard to get a snapshot of usage and reliability data across your Surface Hubs. Click into each view on the dashboard to see detailed data, modify the query as desired, and create alerts. - -> [!NOTE] -> Most of these views show data for the past 30 days, but this is subject to your subscription's data retention policy. - -**Active Surface Hubs** - -Use this view to get an inventory of all your Surface Hubs. Once connected to OMS, each Surface Hub periodically sends a "heartbeat" event to the server. This view shows Surface Hubs that have reported a heartbeat in the past 24 hours. - - - -**Wireless projection** - -Use this view to get usage and reliability data for wireless projection over the past 30 days. The graph shows the total number of wireless connections across all your Surface Hubs, which provides an indication whether people in your organization are using this feature. If it's a low number, it may suggest a need to provide training to help people in your organization learn how to wirelessly connect to a Surface Hub. - -Also, the graph shows a breakdown of successful and unsuccessful connections. If you see a high number of unsuccessful connections, devices may not properly support wireless projection using Miracast. For best performance, Microsoft suggests that devices run a WDI Wi-Fi driver and a WDDM 2.0 graphics driver. Use the details view to learn if wireless projection problems are common with particular devices. - -When a connection fails, users can also do the following if they are using a Windows laptop or phone: -- Remove the paired device from **Settings** > **Devices** > **Connected devices**, then try to connect again. -- Reboot the device. - -**Wired projection** - -Use this view to get usage and reliability data for wired projection over the past 30 days. If the graph shows a high number of unsuccessful connections, it may indicate a connectivity issue in your audio-visual pipeline. For example, if you use a HDMI repeater or a center-of-room control panel, they may need to be restarted. - -**Application usage** - -Use this view to get usage data for apps on your Surface Hubs over the past 30 days. The data comes from app launches on your Surface Hubs, not including Skype for Business. This view helps you understand which Surface Hub apps are the most valuable in your organization. If you are deploying new line-of-business apps in your environment, this can also help you understand how often they are being used. - -**Application Crashes** - -Use this view to get reliability data for apps on your Surface Hubs over the past 30 days. The data comes from app crashes on your Surface Hubs. This view helps you detect and notify app developers of poorly behaving in-box and line-of-business apps. - -**Sample Queries** - -Use this to create custom alerts based on a recommended set of queries. Alerts help you respond quickly if your Surface Hubs report software or hardware issues. For more inforamtion, see [Set up alerts using sample queries](#set-up-alerts-with-sample-queries). - -## Set up alerts with sample queries - -Use alerts to respond quickly if your Surface Hubs report software or hardware issues. Alert rules automatically run log searches according to a schedule, and runs one or more actions if the results match specific criteria. For more information, see [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/). - -The Surface Hub Log Analytics solution comes with a set of sample queries to help you set up the appropriate alerts and understand how to resolve issues you may encounter. Use them as a starting point to plan your monitoring and support strategy. - -This table describes the sample queries in the Surface Hub solution: - -| Alert type | Impact | Recommended remediation | Details | -| ---------- | ------ | ----------------------- | ------- | -| Software | Error | **Reboot the device**.
          Reboot manually, or using the [Reboot configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt720802(v=vs.85).aspx).
          Suggest doing this between meetings to minimize impact to your people in your organization. | Trigger conditions:
          - A critical process in the Surface Hub operating system, such as the shell, projection, or Skype, crashes or becomes non-responsive.
          - The device hasn't reported a heartbeat in the past 24 hours. This may be due to network connectivity issue or network-related hardware failure, or an error with the diagnostic data reporting system. | -| Software | Error | **Check your Exchange service**.
          Verify:
          - The service is available.
          - The device account password is up to date – see [Password management](password-management-for-surface-hub-device-accounts.md) for details.| Triggers when there's an error syncing the device calendar with Exchange. | -| Software | Error | **Check your Skype for Business service**.
          Verify:
          - The service is available.
          - The device account password is up to date – see [Password management](password-management-for-surface-hub-device-accounts.md) for details.
          - The domain name for Skype for Business is properly configured - see [Configure a domain name](use-fully-qualified-domain-name-surface-hub.md). | Triggers when Skype fails to sign in. | -| Software | Error | **Reset the device**.
          This takes some time, so you should take the device offline.
          For more information, see [Device reset](device-reset-surface-hub.md).| Triggers when there is an error cleaning up user and app data at the end of a session. When this operation repeatedly fails, the device is locked to protect user data. You must reset the device to continue. | -| Hardware | Warning | **None**. Indicates negligible impact to functionality.| Triggers when there is an error with any of the following hardware components:
          - Virtual pen slots
          - NFC driver
          - USB hub driver
          - Bluetooth driver
          - Proximity sensor
          - Graphical performance (video card driver)
          - Mismatched hard drive
          - No keyboard/mouse detected | -| Hardware | Error | **Contact Microsoft support**.
          Indicates impact to core functionality (such as Skype, projection, touch, and internet connectivity).
          **Note** Some events, including heartbeat, include the device’s serial number that you can use when contacting support.| Triggers when there is an error with any of the following hardware components.
          **Components that affect Skype**:
          - Speaker driver
          - Microphone driver
          - Camera driver
          **Components that affect wired and wireless projection**:
          - Wired touchback driver
          - Wired ingest driver
          - Wireless adapter driver
          - Wi-Fi Direct error
          **Other components**:
          - Touch digitizer driver
          - Network adapter error (not reported to OMS)| - -**To set up an alert** -1. From the Surface Hub solution, select one of the sample queries. -2. Modify the query as desired. See Log Analytics search reference to learn more. -3. Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert. -4. Click **Save** to complete the alert rule. It will start running immediately. - -## Enroll your Surface Hub - -For Surface Hub to connect to and register with the OMS service, it must have access to the port number of your domains and the URLs. This table list the ports that OMS needs. For more information, see [Configure proxy and firewall settings in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-proxy-firewall/). - ->[!NOTE] ->Surface Hub does not currently support the use of a proxy server to communicate with the OMS service. - -| Agent resource | Ports | Bypass HTTPS inspection? | -| --------------------------- | ----- | ------------------------ | -| *.ods.opinsights.azure.com | 443 | Yes | -| *.oms.opinsights.azure.com | 443 | Yes | -| *.blob.core.windows.net | 443 | Yes | -| ods.systemcenteradvisor.com | 443 | No | - -The Microsoft Monitoring Agent, used to connect devices to OMS, is integrated with the Surface Hub operating system, so there is no need to install additional clients to connect Surface Hub to OMS. - -Once your OMS workspace is set up, there are several ways to enroll your Surface Hub devices: -- [Settings app](#enroll-using-the-settings-app) -- [Provisioning package](#enroll-using-a-provisioning-package) -- [MDM provider](#enroll-using-a-mdm-provider), such as Microsoft Intune and Configuration Manager - -You'll need the workspace ID and primary key of your OMS workspace. You can get these from the OMS portal. - -### Enroll using the Settings app - -**To Enroll using the settings app** - -1. From your Surface Hub, start **Settings**. -2. Enter the device admin credentials when prompted. -3. Select **This device**, and navigate to **Device management**. -4. Under **Monitoring**, select **Configure OMS settings**. -5. In the OMS settings dialog, select **Enable monitoring**. -6. Type the workspace ID and primary key of your OMS workspace. You can get these from the OMS portal. -7. Click **OK** to complete the configuration. - -A confirmation dialog will appear telling you whether or not the OMS configuration was successfully applied to the device. If it was, the device will start sending data to OMS. - -### Enroll using a provisioning package -You can use a provisioning package to enroll your Surface Hub. For more information, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md). - -### Enroll using a MDM provider -You can enroll Surface Hub into OMS using the SurfaceHub CSP. Intune and Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. For more information, see [Manage Surface Hub settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md). - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md deleted file mode 100644 index 5bea64a216..0000000000 --- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: On-premises deployment single forest (Surface Hub) -description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment. -ms.assetid: 80E12195-A65B-42D1-8B84-ECC3FCBAAFC6 -ms.reviewer: -manager: dansimp -keywords: single forest deployment, on prem deployment, device account, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.date: 08/28/2018 -ms.localizationpriority: medium ---- - -# On-premises deployment for Surface Hub in a single-forest environment - - -This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment. - -If you have a single-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premises-ps-scripts) to create device accounts. If you’re using a multi-forest deployment, see [On-premises deployment for Surface Hub in a multi-forest environment](on-premises-deployment-surface-hub-multi-forest.md). - -1. Start a remote PowerShell session from a PC and connect to Exchange. - - Be sure you have the right permissions set to run the associated cmdlets. - - Note here that `$strExchangeServer` is the fully qualified domain name (FQDN) of your Exchange server, and `$strLyncFQDN` is the FQDN of your Skype for Business server. - - ```PowerShell - Set-ExecutionPolicy Unrestricted - $org='contoso.microsoft.com' - $cred=Get-Credential $admin@$org - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $cred -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue - $sessLync = New-PSSession -Credential $cred -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue - Import-PSSession $sessExchange - Import-PSSession $sessLync - ``` - -2. After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub. - - If you're changing an existing resource mailbox: - - ```PowerShell - Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - - If you’re creating a new resource mailbox: - - ```PowerShell - New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - -3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too. - - ```PowerShell - Set-Mailbox $acctUpn -Type Regular - Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy - Set-Mailbox $acctUpn -Type Room - Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ```PowerShell - Set-AdUser $acctUpn -PasswordNeverExpires $true - ``` - -6. Enable the account in Active Directory so it will authenticate to the Surface Hub. - - ```PowerShell - Set-AdUser $acctUpn -Enabled $true - ``` - -7. Enable the device account with Skype for Business by enabling your Surface Hub AD account on a Skype for Business Server pool: - - ```PowerShell - Enable-CsMeetingRoom -SipAddress "sip:HUB01@contoso.com" - -DomainController DC-ND-001.contoso.com -RegistrarPool LYNCPool15.contoso.com - -Identity HUB01 - ``` - - You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity. - -8. OPTIONAL: You can also allow your Surface Hub to make and receive public switched telephone network (PSTN) phone calls by enabling Enterprise Voice for your account. Enterprise Voice isn't a requirement for Surface Hub, but if you want PSTN dialing functionality for the Surface Hub client, here's how to enable it: - - ```PowerShell - Set-CsMeetingRoom -Identity HUB01 -DomainController DC-ND-001.contoso.com -LineURI "tel:+14255550555;ext=50555" -EnterpriseVoiceEnabled $true - ``` - - Again, you need to replace the provided domain controller and phone number examples with your own information. The parameter value `$true` stays the same. - - - ## Disable anonymous email and IM - - - - -Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account. - -Assume you have a per-user client policy assigned to each meeting room device with an identity of **SurfaceHubPolicy**. To disable anonymous email and messaging, you add a clientPolicyEntry to this client policy by using the following commands. - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $false -$clientPolicy = Get-CsClientPolicy -Identity SurfaceHubPolicy -$clientPolicy.PolicyEntry.Add($policyEntry) -Set-CsClientPolicy -Instance $clientPolicy -``` - -To verify that the policy has been set: - -``` -Select-Object -InputObject $clientPolicy -Property PolicyEntry -``` - -The output should be: - -``` -PolicyEntry ------------ -{Name=AllowResourceAccountSendMessage;Value=False} -``` - - -To change the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Replace = $policyEntry} -``` - -To remove the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Remove = $policyEntry} -``` - - - - - - - diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md deleted file mode 100644 index e3754d3e15..0000000000 --- a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md +++ /dev/null @@ -1,148 +0,0 @@ ---- -title: On-premises deployment multi-forest (Surface Hub) -description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a multi-forest, on-premises deployment. -keywords: multi forest deployment, on prem deployment, device account, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.date: 08/28/2018 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# On-premises deployment for Surface Hub in a multi-forest environment - - -This topic explains how you add a device account for your Microsoft Surface Hub when you have a multi-forest, on-premises deployment. - -If you have a multi-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premises-ps-scripts) to create device accounts. If you’re using a single-forest deployment, see [On-premises deployment for Surface Hub in a single-forest environment](on-premises-deployment-surface-hub-device-accounts.md). - -1. Start a remote PowerShell session from a PC and connect to Exchange. - - Be sure you have the right permissions set to run the associated cmdlets. - - Note here that `$strExchangeServer` is the fully qualified domain name (FQDN) of your Exchange server, and `$strLyncFQDN` is the FQDN of your Skype for Business server. - - ```PowerShell - Set-ExecutionPolicy Unrestricted - $org='contoso.microsoft.com' - $cred=Get-Credential $admin@$org - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $cred -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue - $sessLync = New-PSSession -Credential $cred -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue - Import-PSSession $sessExchange - Import-PSSession $sessLync - ``` - -2. After establishing a session, create a new mailbox in the Resource Forest. This will allow the account to authenticate into the Surface Hub. - - If you're changing an existing resource mailbox: - - ```PowerShell - New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01" - ``` - -3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to **False**. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet-—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. - - ```PowerShell - Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy -ActiveSyncEnabled $true - Set-Mailbox $acctUpn -Type Room - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. This should be set in the User Forest. - - ```PowerShell - Set-AdUser $acctUpn -PasswordNeverExpires $true - ``` - -6. Enable the account in Active Directory so it will authenticate to the Surface Hub. This should be set in the User Forest. - - ```PowerShell - Set-AdUser $acctUpn -Enabled $true - ``` - -6. You now need to change the room mailbox to a linked mailbox: - - ```PowerShell - $cred=Get-Credential AuthForest\ADAdmin - Set-mailbox -Alias LinkedRoomTest1 -LinkedMasterAccount AuthForest\LinkedRoomTest1 -LinkedDomainController AuthForest-4939.AuthForest.extest.contoso.com -Name LinkedRoomTest1 -LinkedCredential $cred -Identity LinkedRoomTest1 - ``` - -7. Enable the device account with Skype for Business by enabling your Surface Hub AD account on a Skype for Business Server pool: - - ```PowerShell - Enable-CsMeetingRoom -SipAddress "sip:HUB01@contoso.com" - -DomainController DC-ND-001.contoso.com -RegistrarPool LYNCPool15.contoso.com - -Identity HUB01 - ``` - - You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity. - - -## Disable anonymous email and IM - - - -Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account. - -Assume you have a per-user client policy assigned to each meeting room device with an identity of **SurfaceHubPolicy**. To disable anonymous email and messaging, you add a clientPolicyEntry to this client policy by using the following commands. - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $false -$clientPolicy = Get-CsClientPolicy -Identity SurfaceHubPolicy -$clientPolicy.PolicyEntry.Add($policyEntry) -Set-CsClientPolicy -Instance $clientPolicy -``` - -To verify that the policy has been set: - -``` -Select-Object -InputObject $clientPolicy -Property PolicyEntry -``` - -The output should be: - -``` -PolicyEntry ------------ -{Name=AllowResourceAccountSendMessage;Value=False} -``` - - -To change the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Replace = $policyEntry} -``` - -To remove the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Remove = $policyEntry} -``` -  - - - - - diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md deleted file mode 100644 index df1bf821b4..0000000000 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Online deployment with Office 365 (Surface Hub) -description: This topic has instructions for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. -ms.assetid: D325CA68-A03F-43DF-8520-EACF7C3EDEC1 -ms.reviewer: -manager: dansimp -keywords: device account for Surface Hub, online deployment -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 02/21/2018 -ms.localizationpriority: medium ---- - -# Online deployment with Office 365 (Surface Hub) - - -This topic has instructions for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. - -If you have a pure, online (O365) deployment, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-os356-ps-scripts) to create device accounts. - -1. Start a remote PowerShell session on a PC and connect to Exchange. - - Be sure you have the right permissions set to run the associated cmdlets. - - ```PowerShell - Set-ExecutionPolicy RemoteSigned - $org='contoso.microsoft.com' - $cred=Get-Credential admin@$org - $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection - Import-PSSession $sess - ``` - -2. After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub. - - If you're changing an existing resource mailbox: - - ```PowerShell - Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - - If you’re creating a new resource mailbox: - - ```PowerShell - New-Mailbox -MicrosoftOnlineServicesID HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - -3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false -AllowNonProvisionableDevices $True - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. - - ```PowerShell - Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id - ``` - -4. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. Connect to Azure AD. - - You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command : - - ```PowerShell - Install-Module -Name AzureAD - ``` - You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. - - ```PowerShell - Import-Module AzureAD - Connect-AzureAD -Credential $cred - ``` - -6. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ```PowerShell - Set-AzureADUser -ObjectId "HUB01@contoso.com" -PasswordPolicies "DisablePasswordExpiration" - ``` - -7. Surface Hub requires a license for Skype for Business functionality. In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](hybrid-deployment-surface-hub-device-accounts.md#sfb-online). - - Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - - Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - - ```PowerShell - Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" - - Get-AzureADSubscribedSku | Select Sku*,*Units - $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense - $License.SkuId = SkuId You selected - - $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses - $AssignedLicenses.AddLicenses = $License - $AssignedLicenses.RemoveLicenses = @() - - Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses - ``` - -8. Enable the device account with Skype for Business. - If the Skype for Business PowerShell module is not installed, [download the Skype for Business Online Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366). - - - Start by creating a remote PowerShell session from a PC. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - - - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, alice@contoso.com): - - ```PowerShell - (Get-CsTenant).TenantPoolExtension - ``` - OR by setting a variable - - ```PowerShell - $strRegistrarPool = (Get-CsTenant).TenantPoolExtension - $strRegistrarPool = $strRegistrarPool[0].Substring($strRegistrarPool[0].IndexOf(':') + 1) - ``` - - - Enable the Surface Hub account with the following cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress - ``` - - OR using the $strRegistarPool variable from above - - ```PowerShell - Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress - ``` - -For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account. - - - - - diff --git a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md deleted file mode 100644 index 283520ee40..0000000000 --- a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Password management (Surface Hub) -description: Every Microsoft Surface Hub device account requires a password to authenticate and enable features on the device. -ms.assetid: 0FBFB546-05F0-430E-905E-87111046E4B8 -ms.reviewer: -manager: dansimp -keywords: password, password management, password rotation, device account -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Password management (Surface Hub) - -Every Microsoft Surface Hub device account requires a password to authenticate and enable features on the device. For security reasons, you may want to change (or "rotate") this password regularly. However, if the device account’s password changes, the password that was previously stored on the Surface Hub will be invalid, and all features that depend on the device account will be disabled. You will need to update the device account’s password on the Surface Hub from the Settings app to re-enable these features. - -To simplify password management for your Surface Hub device accounts, there are two options: - -1. Turn off password expiration for the device account. -2. Allow the Surface Hub to automatically rotate the device account’s password. - - -## Turn off password rotation for the device account - -Set the device account’s **PasswordNeverExpires** property to True. You should verify whether this meets your organization’s security requirements. - - -## Allow the Surface Hub to automatically rotate the device account’s password - -The Surface Hub can manage a device account’s password by changing it frequently without requiring you to manually update the device account’s information. You can enable this feature in **Settings**. Once enabled, the device account's password will change weekly during maintenance hours. - -Note that when the device account’s password is changed, you will not be shown the new password. If you need to sign in to the account, or to provide the password again (for example, if you want to change the device account settings on the Surface Hub), then you'll need use Active Directory or the Office 365 admin portal to reset the password. - -> [!IMPORTANT] -> If your organization uses a hybrid topology (some services are hosted on-premises and some are hosted online through Office 365), you must setup the device account in **domain\username** format. Otherwise, password rotation will not work. diff --git a/devices/surface-hub/physically-install-your-surface-hub-device.md b/devices/surface-hub/physically-install-your-surface-hub-device.md deleted file mode 100644 index 32a8f0f5ff..0000000000 --- a/devices/surface-hub/physically-install-your-surface-hub-device.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Physically install Microsoft Surface Hub -description: The Microsoft Surface Hub Readiness Guide will help make sure that your site is ready for the installation. -ms.assetid: C764DBFB-429B-4B29-B4E8-D7F0073BC554 -ms.reviewer: -manager: dansimp -keywords: Surface Hub, readiness guide, installation location, mounting options -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Physically install Microsoft Surface Hub - - -The [Microsoft Surface Hub Readiness Guide](surface-hub-site-readiness-guide.md) will help make sure that your site is ready for the installation. It includes planning information for both the 55" and 84" devices, as well as info on moving the Surface Hub from receiving to the installation location, mounting options, and a list of what's in the box. - -You may also want to check out the Unpacking Guide. It will show you how to unpack the devices efficiently and safely. There are two guides, one for the 55" and one for the 84". A printed version of the Unpacking Guide is attached to the outside front of each unit's shipping crate. - -- Download the 55" Unpacking Guide from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718145). -- Download the 84" version from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718146). - -  - -  - - - - - diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md deleted file mode 100644 index d5c4c22cea..0000000000 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Prepare your environment for Microsoft Surface Hub -description: This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Microsoft Surface Hub. -ms.assetid: 336A206C-5893-413E-A270-61BFF3DF7DA9 -ms.reviewer: -manager: dansimp -keywords: prepare environment, features of Surface Hub, create and test device account, check network availability -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 12/04/2017 -ms.localizationpriority: medium ---- - -# Prepare your environment for Microsoft Surface Hub - - -This section contains an overview of setup dependencies and the setup process. Review the info in this section to help you prepare your environment and gather information needed to set up your Surface Hub. - - -## Review infrastructure dependencies -Review these dependencies to make sure Surface Hub features will work in your IT infrastructure. - -| Dependency | Purpose | -|-------------|------------------| -| Active Directory or Azure Active Directory (Azure AD) |

          The Surface Hub's uses an Active Directory or Azure AD account (called a **device account**) to access Exchange and Skype for Business services. The Surface Hub must be able to connect to your Active Directory domain controller or to your Azure AD tenant in order to validate the device account’s credentials, as well as to access information like the device account’s display name, alias, Exchange server, and Session Initiation Protocol (SIP) address.

          You can also domain join or Azure AD join your Surface Hub to allow a group of authorized users to configure settings on the Surface Hub. | -| Exchange (Exchange 2013 or later, or Exchange Online) and Exchange ActiveSync |

          Exchange is used for enabling mail and calendar features, and also lets people who use the device send meeting requests to the Surface Hub, enabling one-touch meeting join.

          ActiveSync is used to sync the device account’s calendar and mail to the Surface Hub. If the device cannot use ActiveSync, it will not show meetings on the welcome screen, and joining meetings and emailing whiteboards will not be enabled. | -| Skype for Business (Lync Server 2013 or later, or Skype for Business Online) | Skype for Business is used for various conferencing features, like video calls, instant messaging, and screen sharing.| -| Mobile device management (MDM) solution (Microsoft Intune, System Center Configuration Manager, or supported third-party MDM provider) | If you want to apply settings and install apps remotely, and to multiple devices at a time, you must set up a MDM solution and enroll the device to that solution. See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for details. | -| Microsoft Operations Management Suite (OMS) | OMS is used to monitor the health of Surface Hub devices. See [Monitor your Surface Hub](monitor-surface-hub.md) for details. | -| Network and Internet access | In order to function properly, the Surface Hub should have access to a wired or wireless network. Overall, a wired connection is preferred. 802.1X Authentication is supported for both wired and wireless connections.


          **802.1X authentication:** In Windows 10, version 1703, 802.1X authentication for wired and wireless connections is enabled by default in Surface Hub. If your organization doesn't use 802.1X authentication, there is no configuration required and Surface Hub will continue to function as normal. If you use 802.1X authentication, you must ensure that the authentication certification is installed on Surface Hub. You can deliver the certificate to Surface Hub using the [ClientCertificateInstall CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/clientcertificateinstall-csp) in MDM, or you can [create a provisioning package](provisioning-packages-for-surface-hub.md) and install it during first run or through the Settings app. After the certificate is applied to Surface Hub, 802.1X authentication will start working automatically.
          **Note:** For more information on enabling 802.1X wired authentication on Surface Hub, see [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md).

          **Dynamic IP:** The Surface Hub cannot be configured to use a static IP. It must use DHCP to assign an IP address.

          **Proxy servers:** If your topology requires a connection to a proxy server to reach Internet services, then you can configure it during first run, or in Settings. Proxy credentials are stored across Surface Hub sessions and only need to be set once. | - -Additionally, note that Surface Hub requires the following open ports: -- HTTPS: 443 -- HTTP: 80 -- NTP: 123 - -If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below: -- If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). -- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols). -- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json). - -Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list: -- Diagnostic data client endpoint: `https://vortex.data.microsoft.com/` -- Diagnostic data settings endpoint: `https://settings.data.microsoft.com/` - -### Proxy configuration - -If your organization restricts computers on your network from connecting to the Internet, there is a set of URLs that need to be available for devices to use Microsoft Store for Business. Some of the Store for Business features use Microsoft Store app and Microsoft Store services. Devices using Store for Business – either to acquire, install, or update apps – will need access to these URLs. If you use a proxy server to block traffic, your configuration needs to allow these URLs: - -- login.live.com -- login.windows.net -- account.live.com -- clientconfig.passport.net -- windowsphone.com -- *.wns.windows.com -- *.microsoft.com -- www.msftncsi.com (prior to Windows 10, version 1607) -- www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com starting with Windows 10, version 1607) - - -## Work with other admins - -Surface Hub interacts with a few different products and services. Depending on the size of your organization, there could be multiple people supporting different products in your environment. You'll want to include people who manage Exchange, Active Directory (or Azure Active Directory), mobile device management (MDM), and network resources in your planning and prep for Surface Hub deployments. - - -## Create and verify device account - -A device account is an Exchange resource account that Surface Hub uses to display its meeting calendar, join Skype for Business calls, send email, and (optionally) to authenticate to Exchange. See [Create and test a device account](create-and-test-a-device-account-surface-hub.md) for details. - -After you've created your device account, to verify that it's setup correctly, run Surface Hub device account validation PowerShell scripts. For more information, see [PowerShell scripts for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) later in this guide. - - - -## Prepare for first-run program -There are a few more item to consider before you start the [first-run program](first-run-program-surface-hub.md). - -### Create provisioning packages (optional) -You can use provisioning packages to add certificates, customize settings and install apps. See [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) for details. You can [install provisioning packages at first-run](first-run-program-surface-hub.md#first-page). - -### Set up admin groups -Every Surface Hub can be configured locally using the Settings app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app. See [Admin group management](admin-group-management-for-surface-hub.md) for details on how admin groups are set up and managed. You will [set up admins for the device at first run](first-run-program-surface-hub.md#setup-admins). - -### Review and complete Surface Hub setup worksheet (optional) -When you go through the first-run program for your Surface Hub, there's some information that you'll need to supply. The setup worksheet summarizes that info, and provides lists of environment-specific info that you'll need when you go through the first-run program. For more information, see [Setup worksheet](setup-worksheet-surface-hub.md). - - -## In this section - - ---- - - - - - - - - - - - - - - - - - - - - -
          TopicDescription

          Create and test a device account

          This topic introduces how to create and test the device account that Surface Hub uses to communicate with and Skype.

          Create provisioning packages

          For Windows 10, settings that use the registry or a content services platform (CSP) can be configured using provisioning packages. You can also add certificates during first run using provisioning.

          Admin group management

          Every Surface Hub can be configured individually by opening the Settings app on the device. However, to prevent people who are not administrators from changing the settings, the Settings app requires administrator credentials to open the app and change settings.

          -

          The Settings app requires local administrator credentials to open the app.

          - -## More information - -- [Blog post: Surface Hub and the Skype for Business Trusted Domain List](https://blogs.technet.microsoft.com/y0av/2017/10/25/95/) -- [Blog post: Surface Hub in a Multi-Domain Environment](https://blogs.technet.microsoft.com/y0av/2017/11/08/11/) -- [Blog post: Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) - - - - - - - - - diff --git a/devices/surface-hub/provisioning-packages-for-surface-hub.md b/devices/surface-hub/provisioning-packages-for-surface-hub.md deleted file mode 100644 index 2f47ffd5f8..0000000000 --- a/devices/surface-hub/provisioning-packages-for-surface-hub.md +++ /dev/null @@ -1,322 +0,0 @@ ---- -title: Create provisioning packages (Surface Hub) -description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages. -ms.assetid: 8AA25BD4-8A8F-4B95-9268-504A49BA5345 -ms.reviewer: -manager: dansimp -keywords: add certificate, provisioning package -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 03/16/2019 -ms.localizationpriority: medium ---- - -# Create provisioning packages (Surface Hub) - -This topic explains how to create a provisioning package using the Windows Configuration Designer, and apply it to Surface Hub devices. For Surface Hub, you can use provisioning packages to add certificates, install Universal Windows Platform (UWP) apps, and customize policies and settings. - -You can apply a provisioning package using a USB stick during first-run setup, or through the **Settings** app. - - -## Advantages -- Quickly configure devices without using a mobile device management (MDM) provider. - -- No network connectivity required. - -- Simple to apply. - -[Learn more about the benefits and uses of provisioning packages.](https://technet.microsoft.com/itpro/windows/configure/provisioning-packages) - - -## Requirements - -To create and apply a provisioning package to a Surface Hub, you'll need the following: - -- Windows Configuration Designer, which can be installed from Microsoft Store or from the Windows 10 Assessment and Deployment Kit (ADK). [Learn how to install Windows Configuration Designer.](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd) -- A USB stick. -- If you apply the package using the **Settings** app, you'll need device admin credentials. - -You create the provisioning package on a PC running Windows 10, save the package to a USB drive, and then deploy it to your Surface Hub. - - -## Supported items for Surface Hub provisioning packages - -Using the **Provision Surface Hub devices** wizard, you can: - -- Enroll in Active Directory, Azure Active Directory, or MDM -- Create an device administrator account -- Add applications and certificates -- Configure proxy settings -- Add a Surface Hub configuration file - ->[!WARNING] ->You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using the wizard. - -Using the advanced provisioning editor, you can add these items to provisioning packages for Surface Hub: - -- **Policies** - Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#surfacehubpolicies). -- **Settings** - You can configure any setting in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). - ->[!TIP] -> Use the wizard to create a package with the common settings, then switch to the advanced editor to add other settings. -> ->![open advanced editor](images/icd-simple-edit.png) - -## Use the Surface Hub provisioning wizard - -After you [install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd), you can create a provisioning package. - -### Create the provisioning package - -1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, - - or - - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. - -2. Click **Provision Surface Hub devices**. - -3. Name your project and click **Next**. - -### Configure settings - - - - - - - - - -
          step one add certificates

          To provision the device with a certificate, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.
          add a certificate
          step two configure proxy settings

          Toggle Yes or No for proxy settings. The default configuration for Surface Hub is to automatically detect proxy settings, so you can select No if that is the setting that you want. However, if your infrastructure previously required using a proxy server and has changed to not require a proxy server, you can use a provisioning package to revert your Surface Hub devices to the default settings by selecting Yes and Automatically detect settings.

          If you toggle Yes, you can select to automatically detect proxy settings, or you can manually configure the settings by entering a URL to a setup script, or a static proxy server address. You can also identify whether to use the proxy server for local addresses, and enter exceptions (addresses that Surface Hub should connect to directly without using the proxy server).
          configure proxy settings
          step three device admins

          You can enroll the device in Active Directory and specify a security group to use the Settings app, enroll in Azure Active Directory to allow global admins to use the Settings app, or create a local administrator account on the device.

          To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain, and specify the security group to have admin credentials on Surface Hub. If a provisioning package that enrolls a device in Active Directory is going to be applied to a Surface Hub that was reset, the same domain account can only be used if the account listed is a domain administrator or is the same account that set up the Surface Hub initially. Otherwise, a different domain account must be used in the provisioning package.

          Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions.

          To create a local administrator account, select that option and enter a user name and password.

          Important: If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.
          join Active Directory, Azure AD, or create a local admin account
          step four enroll in device management

          Toggle Yes or No for enrollment in MDM.

          If you toggle Yes, you must provide a service account and password or certificate thumbprint that is authorized to enroll the device, and also specify the authentication type. If required by your MDM provider, also enter the URLs for the discovery service, enrollment service, and policy service. Learn more about managing Surface Hub with MDM.
          enroll in mobile device management
          step five add applications

          You can install multiple Universal Windows Platform (UWP) apps in a provisioning package. For help with the settings, see Provision PCs with apps.

          Important: Although the wizard interface allows you to select a Classic Win32 app, only include UWP apps in a provisioning package that will be applied to Surface Hub. If you include a Classic Win32 app, provisioning will fail.
          add an application
          step six Add configuration file

          You don't configure any settings in this step. It provides instructions for including a configuration file that contains a list of device accounts. The configuration file must not contain column headers. When you apply the provisioning package to Surface Hub, if a Surface Hub configuration file is included on the USB drive, you can select the account and friendly name for the device from the file. See Sample configuration file for an example.

          Important: The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703.
          Add a Surface Hub configuration file
          finish

          You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.
          Protect your package
          - -After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. - -## Sample configuration file - -A Surface Hub configuration file contains a list of device accounts that your device can use to connect to Exchange and Skype for Business. When you apply a provisioning package to Surface Hub, you can include a configuration file in the root directory of the USB flash drive, and then select the desired account to apply to that device. The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703. - -Use Microsoft Excel or other CSV editor to create a CSV file named `SurfaceHubConfiguration.csv`. In the file, enter a list of device accounts and friendly names in this format: - -``` -,, -``` ->[!IMPORTANT] ->Because the configuration file stores the device account passwords in plaintext, we recommend that you update the passwords after you've applied the provisioning package to your devices. You can use the [DeviceAccount node](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp#deviceaccount) in the [Surface Hub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) to update the passwords via MDM. - - -The following is an example of `SurfaceHubConfiguration.csv`. - -``` -Rainier@contoso.com,password,Rainier Surface Hub -Adams@contoso.com,password,Adams Surface Hub -Baker@contoso.com,password,Baker Surface Hub -Glacier@constoso.com,password,Glacier Surface Hub -Stuart@contoso.com,password,Stuart Surface Hub -Fernow@contoso.com,password,Fernow Surface Hub -Goode@contoso.com,password,Goode Surface Hub -Shuksan@contoso.com,password,Shuksan Surface Hub -Buckner@contoso.com,password,Buckner Surface Hub -Logan@contoso.com,password,Logan Surface Hub -Maude@consoto.com,password,Maude Surface hub -Spickard@contoso.com,password,Spickard Surface Hub -Redoubt@contoso.com,password,Redoubt Surface Hub -Dome@contoso.com,password,Dome Surface Hub -Eldorado@contoso.com,password,Eldorado Surface Hub -Dragontail@contoso.com,password,Dragontail Surface Hub -Forbidden@contoso.com,password,Forbidden Surface Hub -Oval@contoso.com,password,Oval Surface Hub -StHelens@contoso.com,password,St Helens Surface Hub -Rushmore@contoso.com,password,Rushmore Surface Hub -``` - -## Use advanced provisioning - -After you [install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd), you can create a provisioning package. - -### Create the provisioning package (advanced) - -1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, - - or - - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. - -2. Click **Advanced provisioning**. - -3. Name your project and click **Next**. - -4. Select **Common to Windows 10 Team edition**, click **Next**, and then click **Finish**. - - ![ICD new project](images/icd-new-project.png) - -5. In the project, under **Available customizations**, select **Common Team edition settings**. - - ![ICD common settings](images/icd-common-settings.png) - - -### Add a certificate to your package -You can use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange. - -> [!NOTE] -> Provisioning packages can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details. - -1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. - -2. Enter a **CertificateName** and then click **Add**. - -2. Enter the **CertificatePassword**. - -3. For **CertificatePath**, browse and select the certificate. - -4. Set **ExportCertificate** to **False**. - -5. For **KeyLocation**, select **Software only**. - - -### Add a Universal Windows Platform (UWP) app to your package -Before adding a UWP app to a provisioning package, you need the app package (either an .appx, or .appxbundle) and any dependency files. If you acquired the app from the Microsoft Store for Business, you will also need the *unencoded* app license. See [Distribute offline apps](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app) to learn how to download these items from the Microsoft Store for Business. - -1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextApp**. - -2. Enter a **PackageFamilyName** for the app and then click **Add**. For consistency, use the app's package family name. If you acquired the app from the Microsoft Store for Business, you can find the package family name in the app license. Open the license file using a text editor, and use the value between the \...\ tags. - -3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). - -4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. For Surface Hub, you will only need the x64 versions of these dependencies. - -If you acquired the app from the Microsoft Store for Business, you will also need to add the app license to your provisioning package. - -1. Make a copy of the app license, and rename it to use a **.ms-windows-store-license** extension. For example, "example.xml" becomes "example.ms-windows-store-license". - -2. In ICD, in the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextAppLicense**. - -3. Enter a **LicenseProductId** and then click **Add**. For consistency, use the app's license ID from the app license. Open the license file using a text editor. Then, in the \ tag, use the value in the **LicenseID** attribute. - -4. Select the new **LicenseProductId** node. For **LicenseInstall**, click **Browse** to find and select the license file that you renamed in Step 1. - - -### Add a policy to your package -Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD. - -1. In the **Available customizations** pane, go to **Runtime settings** > **Policies**. - -2. Select one of the available policy areas. - -3. Select and set the policy you want to add to your provisioning package. - - -### Add Surface Hub settings to your package - -You can add settings from the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) to your provisioning package. - -1. In the **Available customizations** pane, go to **Runtime settings** > **WindowsTeamSettings**. - -2. Select one of the available setting areas. - -3. Select and set the setting you want to add to your provisioning package. - - -## Build your package - -1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. - -2. Read the warning that project files may contain sensitive information, and click **OK**. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -3. On the **Export** menu, click **Provisioning package**. - -4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources. - -5. Set a value for **Package Version**, and then select **Next.** - - > [!TIP] - > You can make changes to existing packages and change the version number to update previously applied packages. - -6. Optional: You can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse...** and choosing the certificate you want to use to sign the package. - - > [!IMPORTANT] - > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.  - -7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

          -Optionally, you can click **Browse** to change the default output location. - -8. Click **Next**. - -9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

          -If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

          -If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - - - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. - -11. Select the **output location** link to go to the location of the package. Copy the .ppkg to an empty USB flash drive. - - -## Apply a provisioning package to Surface Hub - -There are two options for deploying provisioning packages to a Surface Hub. [During the first run wizard](#apply-a-provisioning-package-during-first-run), you can apply a provisioning package that installs certificates, or after the first-run program is complete, you can apply a provisioning package that configures settings, apps, and certificates by using [Settings](#apply-a-package-using-settings). - - -### Apply a provisioning package during first run - -> [!IMPORTANT] -> During the first-run program, you can only use provisioning packages to install certificates. Use the **Settings** app to install apps and apply other settings. - -1. When you turn on the Surface Hub for the first time, the first-run program will display the [**Hi there page**](first-run-program-surface-hub.md#first-page). Make sure that the settings are properly configured before proceeding. - -2. Insert the USB flash drive containing the .ppkg file into the Surface Hub. If the package is in the root directory of the drive, the first-run program will recognize it and ask if you want to set up the device. Select **Set up**. - - ![Set up device?](images/provisioningpackageoobe-01.png) - -3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - - ![Provision this device](images/provisioningpackageoobe-02.png) - -4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. Note that you can only install one package during first run. - - ![Choose a package](images/provisioningpackageoobe-03.png) - -5. The first-run program will show you a summary of the changes that the provisioning package will apply. Select **Yes, add it**. - - ![Do you trust this package?](images/provisioningpackageoobe-04.png) - -6. If a configuration file is included in the root directory of the USB flash drive, you will see **Select a configuration**. The first device account in the configuration file will be shown with a summary of the account information that will be applied to the Surface Hub. - - ![select a configuration](images/ppkg-config.png) - -7. In **Select a configuration**, select the device name to apply, and then click **Next**. - - ![select a friendly device name](images/ppkg-csv.png) - -The settings from the provisioning package will be applied to the device and OOBE will be complete. After the device restarts, you can remove the USB flash drive. - -### Apply a package using Settings - -1. Insert the USB flash drive containing the .ppkg file into the Surface Hub. - -2. From the Surface Hub, start **Settings** and enter the admin credentials when prompted. - -3. Navigate to **Surface Hub** > **Device management**. Under **Provisioning packages**, select **Add or remove a provisioning package**. - -4. Select **Add a package**. - -5. Choose your provisioning package and select **Add**. You may have to re-enter the admin credentials if prompted. - -6. You'll see a summary of the changes that the provisioning package will apply. Select **Yes, add it**. - - diff --git a/devices/surface-hub/remote-surface-hub-management.md b/devices/surface-hub/remote-surface-hub-management.md deleted file mode 100644 index 9d435f4650..0000000000 --- a/devices/surface-hub/remote-surface-hub-management.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Remote Surface Hub management -description: This section lists topics for managing Surface Hub. -keywords: remote management, MDM, install apps, monitor Surface Hub, Operations Management Suite, OMS -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Remote Surface Hub management - -## In this section - -|Topic | Description| -| ------ | --------------- | -| [Manage settings with an MDM provider]( https://technet.microsoft.com/itpro/surface-hub/manage-settings-with-mdm-for-surface-hub) | Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution.| -| [Monitor your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/monitor-surface-hub) | Monitoring for Surface Hub devices is enabled through Microsoft Operations Management Suite.| -| [Windows updates](https://technet.microsoft.com/itpro/surface-hub/manage-windows-updates-for-surface-hub) | You can manage Windows updates on your Surface Hub by setting the maintenance window, deferring updates, or using WSUS.| diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md deleted file mode 100644 index acd4207515..0000000000 --- a/devices/surface-hub/save-bitlocker-key-surface-hub.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Save your BitLocker key (Surface Hub) -description: Every Microsoft Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys. -ms.assetid: E11E4AB6-B13E-4ACA-BCE1-4EDC9987E4F2 -ms.reviewer: -manager: dansimp -keywords: Surface Hub, BitLocker, Bitlocker recovery keys -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/08/2019 -ms.localizationpriority: medium ---- - -# Save your BitLocker key (Surface Hub) - - -Every Microsoft Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys. - -There are several ways to manage your BitLocker key on the Surface Hub. - -1. If you’ve joined the Surface Hub to a domain, the device will back up the key on the domain and store it under the computer object. - - If you can’t find the BitLocker key after joining the device to a domain, it’s likely that your Active Directory schema doesn’t support BitLocker key backup. If you don’t want to change the schema, you can save the BitLocker key by going to Settings and following the procedure for using a local admin account, which is detailed later in this list. - -2. If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device. - -3. If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive. - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md deleted file mode 100644 index d329156bb0..0000000000 --- a/devices/surface-hub/set-up-your-surface-hub.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Set up Microsoft Surface Hub -description: Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. -ms.assetid: 4D1722BC-704D-4471-BBBE-D0500B006221 -ms.reviewer: -manager: dansimp -keywords: set up instructions, Surface Hub, setup worksheet, first-run program -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Set up Microsoft Surface Hub - - -Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. - -Before you turn on your Microsoft Surface Hub for the first time, make sure you've completed the checklist at the end of the [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) section, and that you have the information listed in the [Setup worksheet](setup-worksheet-surface-hub.md). When you do power it on, the device will walk you through a series of setup screens. If you haven't properly set up your environment, or don't have the required information, you'll have to do extra work afterward making sure the settings are correct. - -## In this section - - - ---- - - - - - - - - - - - - - - - - -
          TopicDescription

          Setup worksheet

          When you've finished pre-setup and are ready to start first-time setup for your Surface Hub, make sure you have all the information listed in this section.

          First-run program

          The term "first run" refers to the series of steps you'll go through the first time you power up your Surface Hub, and means the same thing as "out-of-box experience" (OOBE). This section will walk you through the process.

          - - - - - - - - - - - diff --git a/devices/surface-hub/setup-worksheet-surface-hub.md b/devices/surface-hub/setup-worksheet-surface-hub.md deleted file mode 100644 index 46479063ed..0000000000 --- a/devices/surface-hub/setup-worksheet-surface-hub.md +++ /dev/null @@ -1,252 +0,0 @@ ---- -title: Setup worksheet (Surface Hub) -description: When you've finished pre-setup and are ready to start first-time setup for your Microsoft Surface Hub, make sure you have all the information listed in this section. -ms.assetid: AC6F925B-BADE-48F5-8D53-8B6FFF6EE3EB -ms.reviewer: -manager: dansimp -keywords: Setup worksheet, pre-setup, first-time setup -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: medium ---- - -# Setup worksheet (Surface Hub) - - -When you've finished pre-setup and are ready to start first-time setup for your Microsoft Surface Hub, make sure you have all the information listed in this section. - -You should fill out one list for each Surface Hub you need to configure, although some information can be used on all Surface Hubs, like the proxy information or domain credentials. Some of this information may not be needed, depending on how you've decided to configure your device, or depending on how the environment is configured for your organization's infrastructure. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyWhat this is used forExampleActual value
          -

          Proxy information

          -
          -

          If your network uses a proxy for network and/or Internet access, you must provide a script or server/port information.

          -
          -

          Proxy script: http://contoso/proxy.pa
          -- OR -
          -Server and port info: 10.10.10.100, port 80 -

          -
          -

          -
          -

          Wireless network credentials (username and password)

          -
          -

          If you decide to connect your device to Wi-Fi, and your wireless network requires user credentials.

          -
          -

          admin1@contoso.com, #MyPassw0rd

          -
          -

          -
          -

          Device account UPN or Domain\username and device account password

          -
          -

          This is the User Principal Name (UPN) or the domain\username, and the password of the device account. Mail, calendar, and Skype for Business depend on a compatible device account.

          -
          -

          UPN: ConfRoom15@contoso.com, #Passw0rd1
          -- OR -
          -Domain and username: CONTOSO\ConfRoom15, #Passw0rd1

          -
          -

          -
          -

          Device account Microsoft Exchange server

          -
          -

          This is the device account's Exchange server. -Mail, calendar, and Skype for Business depend on a compatible device account. -For mail and calendar to work, the device account must have a valid Exchange server. The device will try to find this automatically.

          -
          -

          outlook.office365.com

          -
          -

          -
          -

          Device account Session Initiation Protocol (SIP) address

          -
          -

          This is the device account's Skype for Business SIP address. -Mail, calendar, and Skype for Business depend on a compatible device account. -For Skype for Business to work, the device account must have a valid SIP address. The device will try to find this automatically.

          -
          -

          sip: ConfRoom15@contoso.com

          -
          -

          -
          -

          Friendly name

          -
          -

          The friendly name of the device is the broadcast name that people will see when they try to wirelessly connect to the Surface Hub. This name will be displayed prominently on the Surface Hub's screen. -We suggest that the friendly name you choose is recognizable and unique so that people can distinguish one Surface Hub from another when trying to connect.

          -
          -

          Conference Room 15

          -
          -

          -
          -

          Device name

          -
          -

          The device name is the name that will be used for domain join, and is the identity you will see in your MDM provider if the device is enrolled into MDM. -The device name you choose must not be the same name as any other device on the user’s Active Directory domain (if you decide to domain join the device). The device cannot join the domain if its name is not unique. -

          -
          -

          confroom15

          -
          -

          -
          -

          IF YOU'RE JOINING AZURE AD

          -
          -

          Azure AD tenant user credentials (username and password)

          -
          -

          If you decide to have people in your Azure Active Directory (Azure AD) organization become admins on the device, then you'll need to join Azure AD. -To join Azure AD, you will need valid user credentials.

          -
          -

          admin1@contoso.com, #MyPassw0rd

          -
          -

          -
          -

          IF YOU'RE JOINING A DOMAIN

          -
          -

          Domain to join

          -
          -

          This is the domain you will need to join so that a security group of your choice can be admins for the device. -You may need the fully qualified domain name (FQDN).

          -
          -

          contoso (short name) OR contoso.corp.com (FQDN)

          -
          -

          -
          -

          Domain account credentials (username and password)

          -
          -

          A domain can't be joined unless you provide sufficient account credentials to join the domain. Once you provide a domain to join and credentials to join the domain, then a security group of your choice can change settings on the device.

          -
          -

          admin1, #MyPassw0rd

          -
          -

          -
          -

          Admin security group alias

          -
          -

          This is a security group in your Active Directory (AD); any members of this security group can change settings on the device.

          -
          -

          SurfaceHubAdmins

          -
          -

          -
          -

          IF YOU'RE USING A LOCAL ADMIN

          -
          -

          Local admin account credentials (username and password)

          -
          -

          If you decide not to join an AD domain or Azure AD, you can create a local admin account on the device.

          -
          -

          admin1, #MyPassw0rd

          -
          -

          -
          -

          IF YOU NEED TO INSTALL CERTIFICATES OR APPS

          -
          -

          USB drive

          -
          -

          If you know before first run that you want to install certificates or universal apps, follow the steps in Create provisioning packages. Your provisioning packages will be created on a USB drive.

          -
          -

          -
          -

          -
            - - - - - diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md deleted file mode 100644 index c60e7826dc..0000000000 --- a/devices/surface-hub/skype-hybrid-voice.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: Online or hybrid deployment using Skype Hybrid Voice environment (Surface Hub) -description: This topic explains how to enable Skype for Business Cloud PBX with on premises PSTN connectivity via Cloud Connector Edition or Skype for Business 2015 pool. -keywords: hybrid deployment, Skype Hybrid Voice -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Online or hybrid deployment using Skype Hybrid Voice environment (Surface Hub) - -This topic explains how to enable Skype for Business Cloud PBX with on-premises Public Switched Telephone Network (PSTN) connectivity via Cloud Connector Edition or Skype for Business 2015 pool. In this option. your Skype for Business home pools and Exchange servers are in the cloud, and are connected by PSTN via an on-premises pool running Skype for Business 2015 or Cloud Connector edition. [Learn more about different Cloud PBX options](https://technet.microsoft.com/library/mt612869.aspx). - -If you deployed Skype for Business Cloud PBX with one of the hybrid voice options, follow the steps below to enable the room account for Surface Hub. It is important to create a regular user account first, assign all hybrid voice options and phone numbers, and then convert the account to a room account. If you do not follow this order, you will not be able to assign a hybrid phone number. - ->[!WARNING] ->If you create an account before configuration of Hybrid voice (you run Enable-CSMeetingRoom command), you will not be able to configure required hybrid voice parameters. In order to configure hybrid voice parameters for a previously configured account or to reconfigure a phone number, delete the E5 or E3 + Cloud PBX add-on license, and then follow the steps below, starting at step 3. - -1. Create a new user account for Surface Hub. This example uses surfacehub2@adatum.com. The account can be created in local Active Directory and synchronized to the cloud, or created directly in the cloud. - - ![new object user](images/new-user-hybrid-voice.png) - -2. Select **Password Never Expires**. This is important for a Surface Hub device. - - ![Password never expires](images/new-user-password-hybrid-voice.png) - -3. In Office 365, add **E5** license or **E3 and Cloud PBX** add-on to the user account created for the room. This is required for Hybrid Voice to work. - - ![Add product license](images/product-license-hybrid-voice.png) - -4. Wait approximately 15 minutes until the user account for the room appears in Skype for Business Online. - -5. After the user account for room is created in Skype for Business Online, enable it for Hybrid Voice in Skype for Business Remote PowerShell by running the following cmdlet: - - ``` - Set-csuser surfacehub2@adatum.com EnterpriseVoiceEnabled $true -HostedVoiceMail $true -onpremlineuri tel:+15005000102 - ``` - -6. Validate Hybrid Voice call flow by placing test calls from the Surface Hub. - -7. Start a remote PowerShell session on a PC and connect to Exchange by running the following cmdlets. - - ``` - Set-ExecutionPolicy Unrestricted - $cred=Get-Credential -Message "Please use your Office 365 admin credentials" - $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/ps1-liveid/ -Credential $cred -Authentication Basic -AllowRedirection - Import-PSSession $sess - ``` - -8. After establishing a session, modify the user account for the room to enable it as a **RoomMailboxAccount** by running the following cmdlets. This allows the account to authenticate with Surface Hub. - - ``` - Set-Mailbox surfacehub2@adatum.com -Type Room - Set-Mailbox surfacehub2@adatum.com -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - -9. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to **False**. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet (this one creates a policy called "Surface Hubs"). After it’s created, you can apply the same policy to other device accounts. - - ``` - $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false - ``` - - After you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. Run the following cmdlets to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox (you may need to re-enable the account and set the password again). - - ``` - Set-Mailbox surfacehub2@adatum.com -Type Regular - Set-CASMailbox surfacehub2@adatum.com -ActiveSyncMailboxPolicy $easPolicy.id - Set-Mailbox surfacehub2@adatum.com -Type Room - $credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password" - Set-Mailbox surfacehub2@adatum.com -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - ``` - -10. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties. - - ``` - Set-CalendarProcessing surfacehub2@adatum.com -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing surfacehub2@adatum.com -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -11. Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the account as a meeting device. - - ``` - Get-CsTenant | select registrarpool - Enable-CsMeetingRoom surfacehub2@adatum.com -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName - ``` - - As a result of running this cmdlet, users will be asked if they are in a meeting room, as shown in the following image. **Yes** will mute the microphone and speaker. - - ![](images/adjust-room-audio.png) - - - -At this moment the room account is fully configured, including Hybrid Voice. If you use Skype on-premises, you can configure additional attributes, like description, location, etc., on-premises. If you create a room in Skype Online, these parameters can be set online. - -In the following image, you can see how the device appears to users. - - -![](images/select-room-hybrid-voice.png) diff --git a/devices/surface-hub/support-solutions-surface-hub.md b/devices/surface-hub/support-solutions-surface-hub.md deleted file mode 100644 index 81eba249eb..0000000000 --- a/devices/surface-hub/support-solutions-surface-hub.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Top support solutions for Microsoft Surface Hub -description: Find top solutions for common issues using Surface Hub. -ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A -ms.reviewer: -manager: dansimp -keywords: Troubleshoot common problems, setup issues -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 10/24/2017 -ms.localizationpriority: medium ---- - -# Top support solutions for Microsoft Surface Hub - -Microsoft regularly releases both updates and solutions for Surface Hub. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface Hub devices updated. For a complete listing of the update history, see [Surface Hub update history](https://www.microsoft.com/surface/support/surface-hub/surface-hub-update-history) and [Known issues and additional information about Microsoft Surface Hub](https://support.microsoft.com/help/4025643). - ->[!TIP] ->Looking for [Surface Hub warranty information](https://support.microsoft.com/help/4040687/surface-surface-documents)? - -These are the top Microsoft Support solutions for common issues experienced when using Surface Hub. - -## Setup and install issues - -- [Setup troubleshooting](troubleshoot-surface-hub.md#setup-troubleshooting) -- [Exchange ActiveSync errors](troubleshoot-surface-hub.md#exchange-activesync-errors) - -## Miracast issues - -- [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) - -## Download updates issues - -- [Surface Hub can't download updates from Windows Update](https://support.microsoft.com/help/3191418/surface-hub-can-t-download-updates-from-windows-update) - -## Connect app issues - -- [The Connect app in Surface Hub exits unexpectedly](https://support.microsoft.com/help/3157417/the-connect-app-in-surface-hub-exits-unexpectedly) - - -  - - -  - - - - - diff --git a/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md b/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md deleted file mode 100644 index 1ec6740c76..0000000000 --- a/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Surface Hub may install updates and restart outside maintenance hours -description: troubleshooting information for Surface Hub regarding automatic updates -ms.assetid: 6C09A9F8-F9CF-4491-BBFB-67A1A1DED0AA -ms.reviewer: -manager: -keywords: surface hub, maintenance window, update -ms.prod: surface-hub -ms.sitesec: library -author: Teresa-MOTIV -ms.author: v-tea -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub may install updates and restart outside maintenance hours - -Under specific circumstances, Surface Hub installs updates during business hours instead of during the regular maintenance window. The device then restarts if it is necessary. You cannot use the device until the process is completed. - -> [!NOTE] -> This isn't expected behavior for missing a maintenance window. It occurs only if the device is out-of-date for a long time. - -## Cause -To ensure that Surface Hub remains available for use during business hours, the Hub is configured to perform administrative functions during a maintenance window that is defined in Settings (see "References," below). During this maintenance period, the Hub automatically installs any available updates through Windows Update or Windows Server Update Service (WSUS). Once updates are complete, the Hub may restart. - -Updates can be installed during the maintenance window only if the Surface Hub is turned on but not in use or reserved. For example, if the Surface Hub is scheduled for a meeting that lasts 24 hours, any updates that are scheduled to be installed will be deferred until the Hub is available during the next maintenance window. If the Hub continues to be busy and misses multiple maintenance windows, the Hub will eventually begin to install and download updates. This can occur during or outside the maintenance window. Once the download and installation has begun, the device may restart. - -## To avoid this issue - -It's important that you set aside maintenance time for Surface Hub to perform administrative functions. Reserving the Surface Hub for 24 hour intervals or using the device during the maintenance window delays installing updates. We recommend that you not use or reserve the Hub during scheduled maintenance period. A two-hour window should be reserved for updating. - -One option that you can use to control the availability of updates is Windows Server Update Service (WSUS). WSUS provides control over what updates are installed and when. - -## References - -[Update the Surface Hub](first-run-program-surface-hub.md#update-the-surface-hub) - -[Maintenance window](manage-windows-updates-for-surface-hub.md#maintenance-window) - -[Deploy Windows 10 updates using Windows Server Update Services (WSUS)](/windows/deployment/update/waas-manage-updates-wsus) - - diff --git a/devices/surface-hub/surface-hub-2s-account.md b/devices/surface-hub/surface-hub-2s-account.md deleted file mode 100644 index 025b2b8320..0000000000 --- a/devices/surface-hub/surface-hub-2s-account.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: "Create Surface Hub 2S device account" -description: "This page describes the procedure for creating the Surface Hub 2S device account." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Create Surface Hub 2S device account - -Creating a Surface Hub device account (also known as a Room mailbox) allows Surface Hub 2S to receive, approve, or decline meeting requests and join meetings using Microsoft Teams or Skype for Business. Configure the device account during OOBE setup. If needed you can change it later (without going through OOBE setup). - -Unlike standard Room mailboxes that remain disabled by default, you need to enable the Surface Hub 2S device account to sign on to Microsoft Teams and Skype for Business. Surface Hub 2S relies on Exchange ActiveSync, which requires an ActiveSync mailbox policy on the device account. Apply the default ActiveSync mailbox policy that comes with Exchange Online. - -Create the account using the Microsoft 365 admin center or by using PowerShell. You can use Exchange Online PowerShell to configure specific features including: - -- Calendar processing for every Surface Hub device account. -- Custom auto replies to scheduling requests. -- If the default ActiveSync mailbox policy has already been modified by someone else or another process, you will likely have to create and assign a new ActiveSync mailbox policy - -## Create account using Microsoft 365 admin center - -1. In the Microsoft 365 admin center, go to **Resources** and choose **Rooms & Equipment** and then select **+ Room**. - -2. Provide a name and email address for the device account. Leave remaining settings unchanged in the default state. - -![Provide a name and email address](images/sh2-account2.png) - -![Leave remaining settings unchanged in the default state](images/sh2-account3.png) - -3. Set the password for the device account. Ensure that you **do not** select the option **Make this user change their password when they first sign in.** - -![Set the password for the device account](images/sh2-account4.png) - -4. Assign the room with an Office 365 license. It’s recommended to assign the Office 365 **Meeting Room** license, a new option that automatically enables the account for Skype for Business Online and Microsoft Teams. - -![Assign Office 365 license](images/sh2-account5.png) - -### Finalize setup via PowerShell - -- **Skype for Business:** For Skype for Business only (on-premises or online), you can enable the Skype for Business object by running **Enable-CsMeetingRoom** to enable features such as Meeting room prompt for audio and Lobby hold. - -- **Calendar:** Set **Calendar Auto processing** for this account. - -## Create account using PowerShell -Instead of using the Microsoft Admin Center portal, you can create the account using PowerShell. - -### Connect to Exchange Online PowerShell - -``` -$365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication Basic –AllowRedirection $ImportResults = Import-PSSession $365Session -``` - -### Create a new Room Mailbox - -``` -New-Mailbox -MicrosoftOnlineServicesID account@YourDomain.com -Alias SurfaceHub2S -Name SurfaceHub2S -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String "" -AsPlainText -Force) -``` - -### Set Calendar Auto processing - -``` -Set-CalendarProcessing -Identity "account@YourDomain.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub" -``` - -### Assign a license - -``` -Connect-MsolService -Set-Msoluser -UserPrincipalName account@YourDomain.com -UsageLocation IE -Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "contoso:MEETING_ROOM" -``` - -## Connect to Skype for Business Online using PowerShell - -### Install prerequisites - -- [Visual C++ 2017 Redistributable](https://aka.ms/vs/15/release/vc_redist.x64.exe) -- [Skype for Business Online PowerShell Module](https://www.microsoft.com/en-us/download/confirmation.aspx?id=39366) - -``` -Import-Module LyncOnlineConnector -$SfBSession = New-CsOnlineSession -Credential (Get-Credential) -Import-PSSession $SfBSession -AllowClobber -Enable the Skype for Business meeting room -Enable-CsMeetingRoom -Identity account@YourDomain.com -RegistrarPoo(Get-CsTenant).Registrarpool -SipAddressType EmailAddress -``` diff --git a/devices/surface-hub/surface-hub-2s-adoption-kit.md b/devices/surface-hub/surface-hub-2s-adoption-kit.md deleted file mode 100644 index 119b93ff02..0000000000 --- a/devices/surface-hub/surface-hub-2s-adoption-kit.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Surface Hub 2S adoption toolkit" -description: "Microsoft has developed downloadable materials that you can make available for your users to aid in adoption of Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 07/18/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S adoption toolkit - -Microsoft has developed downloadable materials that you can make available for your users to aid in adoption of Surface Hub 2S. - -## Training guides - -- [Surface Hub adoption toolkit](downloads/SurfaceHubAdoptionToolKit.pdf) -- [Training guide – end user](downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf) -- [Training guide – power user](downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf) -- [Training guide – help desk](downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf) -- [Training guide – Microsoft Teams desktop](downloads/Guide-SurfaceHub2S-Teams.pptx) - -[Download all training guides](http://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) - -[Download all training guides](http://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) - -## End user guides - -- [Guide to Navigation on Surface Hub](downloads/Guide-SurfaceHub2S-Navigation.pptx) -- [Guide to Office 365 on Surface Hub](downloads/Guide-SurfaceHub2S-Office365.pptx) -- [Guide to Microsoft Whiteboard on Surface Hub](downloads/Guide-SurfaceHub2S-Whiteboard.pptx) -- [Guide to Microsoft Teams on Surface Hub](downloads/Guide-SurfaceHub2S-Teams.pptx) - -## Quick reference cards - -- [Connect your PC](downloads/QRCConnectYourPC.pdf) -- [Join a Teams Meeting](downloads/QRCJoinTeamsMeeting.pdf) -- [Manage a Teams meeting](downloads/QRCManageTeamsMeeting.pdf) -- [Navigation basics](downloads/QRCNavigationBasics.pdf) -- [Schedule a Teams meeting](downloads/QRCScheduleTeamsMeeting.pdf) -- [Start a new Teams meeting](downloads/QRCStartNewTeamsMeeting.pdf) -- [Share or send a file](downloads/QRCShareSendFile.pdf) -- [Sign in to view meetings and files](downloads/QRCSignInToViewMeetingsFiles.pdf) -- [Whiteboard advanced](downloads/QRCWhiteboardAdvanced.pdf) -- [Whiteboard tools](downloads/QRCWhiteboardTools.pdf) - -[Download all user guides and quick reference cards](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) diff --git a/devices/surface-hub/surface-hub-2s-change-history.md b/devices/surface-hub/surface-hub-2s-change-history.md deleted file mode 100644 index a24c8c12e4..0000000000 --- a/devices/surface-hub/surface-hub-2s-change-history.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: "Change history for Surface Hub 2S" -description: "This page shows change history for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -audience: Admin -ms.manager: laurawi -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Change history for Surface Hub 2S - -This topic summarizes new and updated content in the Surface Hub 2S documentation library. - -## August 2019 - -Changes | Description -|:--- |:--- -|Connect devices to Surface Hub 2S| Updated with guidance for connecting to a second display. - -## July 2019 - -Changes | Description -|:--- |:--- | -| Reset and recovery for Surface Hub 2S | Added link to Surface recovery website that enables customers to download a recovery image for Surface Hub 2S | -| Surface Hub 2S tech specs | Updated power consumption data | -| Surface Hub 2S Adoption Kit | New | - -## June 2019 - -Changes | Description -|:--- |:--- | -| Published new guidance for Surface Hub 2S | New | diff --git a/devices/surface-hub/surface-hub-2s-connect.md b/devices/surface-hub/surface-hub-2s-connect.md deleted file mode 100644 index d3a17d2848..0000000000 --- a/devices/surface-hub/surface-hub-2s-connect.md +++ /dev/null @@ -1,134 +0,0 @@ ---- -title: "Connect devices to Surface Hub 2S" -description: "This page explains how to connect external devices to Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Connect devices to Surface Hub 2S -Surface Hub 2S lets you connect external devices, mirror the display on Surface Hub 2S to another device, and connect a wide variety of third-party peripherals including video conference cameras, conference phones, and room system devices. - -You can display content from your devices to Surface Hub 2S. If the source device is Windows-based, that device can also provide TouchBack and InkBack, which takes video and audio from the connected device and presents them on Surface Hub 2S. If Surface Hub 2S encounters a High-Bandwidth Digital Content Protection (HDCP) signal, such as a Blu-ray DVD player, the source is displayed as a black image. - -> [!NOTE] -> Surface Hub 2S uses the video input selected until a new connection is made, the existing connection is disrupted, or the Connect app is closed. - -## Recommended wired configurations - -In general, it’s recommended to use native cable connections whenever possible such as USB-C to USB-C or HDMI to HDMI. Other combinations such as MiniDP to HDMI or MiniDP to USB-C will also work. - -| **Connection** | **Functionality** | **Description**| -| --- | --- | ---| -| USB-C
          (via compute module) | Video-in
          Video-out
          Audio-in
          Audio-out

          TouchBack and InkBack | Provides video, audio, and TouchBack/InkBack on a single cable.

          **NOTE:** Some configuration is required to optimize the video-out experience. Refer to the section below: [Mirroring Surface Hub 2S display on another device](#). | -| HDMI + USB-C | HDMI-in for audio and video

          USB-C for TouchBack and InkBack | USB-C supports TouchBack and InkBack with the HDMI A/V connection.

          Use USB-C to USB-A to connect to legacy computers.

          **NOTE:** For best results, connect HDMI before connecting a USB-C cable. If the computer you're using for HDMI is not compatible with TouchBack and InkBack, you won't need a USB-C cable. | -| USB-C
          (via compute module) | Video-in
          Audio-in | Single cable needed for A/V

          TouchBack and InkBack not supported

          HDCP enabled | -| HDMI (in port) | Video, Audio into Surface Hub 2S | Single cable needed for A/V

          TouchBack and InkBack not supported

          HDCP enabled | -| MiniDP 1.2 output | Video-out such as mirroring to a larger projector. | Single cable needed for A/V | - -When you connect a guest computer to Surface Hub 2S via the USB-C port, several USB devices are discovered and configured. These peripheral devices are created for TouchBack and InkBack. As shown in the following table, the peripheral devices can be viewed in Device Manager, which will show duplicate names for some devices, as shown in the following table. - - -|**Peripheral**| **Listing in Device Manager** | -| ---------------------------- |------------- | ------------------------------| -| Human interface devices | HID-compliant consumer control device
          HID-compliant pen
          HID-compliant pen (duplicate item)
          HID-compliant pen (duplicate item)
          HID-compliant touch screen
          USB Input Device
          USB Input Device (duplicate item) | -| Keyboards | Standard PS/2 keyboard | -| Mice and other pointing devices | HID-compliant mouse | -| USB controllers | Generic USB hub
          USB composite device | - -## Connecting video-in to Surface Hub 2S - -You can input video to Surface Hub 2S using USB-C or HDMI, as indicated in the following table. - -### Surface Hub 2S video-in settings - -| **Signal Type** | **Resolution** | **Frame rate** | **HDMI** | **USB-C** | -| --------------- | -------------- | -------------- | -------- | --------- | -| PC | 640 x 480 | 60 | X | X | -| PC | 720 x 480 | 60 | X | X | -| PC | 1024 x 768 | 60 | X | X | -| PC | 1920 x 1080 | 60 | X | X | -| PC | 3840x2560 | 30 | X | X | -| HDTV | 720p | 60 | X | X | -| HDTV | 1080p | 60 | X | X | -| 4K UHD | 3840x2560 | 30 | X | X | - -> [!NOTE] -> The 4K UHD resolution (3840×2560) is only supported when connecting to ports on the compute module. It is not supported on the “guest” USB ports located on the left, top, and right sides of the device. - -> [!NOTE] -> Video from a connected external PC may appear smaller when displayed on Surface Hub 2S. - -## Mirroring Surface Hub 2S display on another device - -You can output video to another display using either USB-C or MiniDP, as indicated in the following table. - -### Surface Hub 2S video-out settings - -| **Signal Type** | **Resolution** | **Frame rate** | **USB-C** | **MiniDP** | -| --------------- | -------------- | -------------- | --------- | ---------- | -| PC | 640 x 480 | 60 | X | X | -| PC | 720 x 480 | 60 | X | X | -| PC | 1024 x 768 | 60 | X | X | -| PC | 1920 x 1080 | 60 | X | X | -| PC | 3840x2560 | 60 | X | X | -| HDTV | 720p | 60 | X | X | -| HDTV | 1080p | 60 | X | X | -| 4K UHD | 3840x2560 | 60 | X | X | - - -Surface Hub 2S includes a MiniDP video-out port for projecting visual content from Surface Hub 2S to another display. If you plan to use Surface Hub 2S to project to another display, note the following recommendations: - -- **Keyboard required.** Before you begin, you’ll need to connect either a wired or Bluetooth-enabled external keyboard to Surface Hub 2S. Note that unlike the original Surface Hub, a keyboard for Surface Hub 2S is sold separately and is not included in the shipping package.

          -- **Set duplicate mode.** Surface Hub 2S supports video-out in duplicate mode only. However, you will still need to manually configure the display mode when you connect for the first time: - 1. Enter the **Windows logo key** + **P**, which opens the Project pane on the right side of Surface Hub 2S, and then select **Duplicate** mode. - 2. When you’re finished with your Surface Hub 2S session, select **End Session**. This ensures that the duplicate setting is saved for the next session.

          -- **Plan for different aspect ratios.** Like other Surface devices, Surface Hub 2S uses a 3:2 display aspect ratio (the relationship between the width and the height of the display). Projecting Surface Hub 2S onto displays with different aspect ratios is supported. Note however that because Surface Hub 2S duplicates the display, the MiniDP output will also only display in a 3:2 aspect ratio, which may result in letterboxing or curtaining depending on the aspect ratio of the receiving display. - -> [!NOTE] -> if your second monitor uses a 16:9 aspect ratio (the predominant ratio for most TV monitors), black bars may appear on the left and right sides of the mirrored display. If this occurs, you may wish to inform your users that there is no need to adjust the second display. - -## Selecting cables - -Note the following recommendations: - -- **USB.** USB 3.1 Gen 2 cables. -- **MiniDP.** DisplayPort cables certified for up to 3 meters in length. -- **HDMI.** If a long cable is necessary, HDMI is recommended due to the wide availability of cost-effective, long-haul cables with the ability to install repeaters if needed. - -> [!NOTE] -> Most DisplayPort sources will automatically switch to HDMI signaling if HDMI is detected. - -## Wirelessly connect to Surface Hub 2S - -Windows 10 natively supports Miracast, which lets you wireless connect to Surface Hub 2S.

          - -### To connect using Miracast: - -1. On your Windows 10 device, enter **Windows logo key** + **K**. -2. In the Connect window, look for the name of your Surface Hub 2S in the list of nearby devices. You can find the name of your Surface Hub 2S in the bottom left corner of the display. -3. Enter a PIN if your system administrator has enabled the PIN setting for Miracast connections. This requires you to enter a PIN number when you connect to Surface Hub 2S for the first time. - -> [!NOTE] ->If you do not see the name of the Surface Hub 2S device as expected, it’s possible the previous session was prematurely closed. If so, sign into Surface Hub 2S directly to end the previous session and then connect from your external device. - -## Connecting peripherals to Surface Hub 2S - -### Bluetooth accessories - -You can connect the following accessories to Surface Hub-2S using Bluetooth: - -- Mice -- Keyboards -- Headsets -- Speakers - -> [!NOTE] -> After you connect a Bluetooth headset or speaker, you might need to change the default microphone and speaker settings. For more information, see [**Local management for Surface Hub settings**](https://docs.microsoft.com/en-us/surface-hub/local-management-surface-hub-settings). diff --git a/devices/surface-hub/surface-hub-2s-custom-install.md b/devices/surface-hub/surface-hub-2s-custom-install.md deleted file mode 100644 index 020256c627..0000000000 --- a/devices/surface-hub/surface-hub-2s-custom-install.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: "Customize wall mount of Surface Hub 2S" -description: "Learn how to perform a custom install of Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Customize wall mount of Surface Hub 2S - -If you’re not using certified mounting solutions, you can mount Surface Hub 2S using readily available retail hardware. - -## Set wall mount measurements - -Surface Hub 2S recommended mounting measurements: - -|**Item**|**Description**|**Notes**| -|:------ |:------------- |:------- | -|**Height from bottom of Surface Hub 2S**| 1026.5 mm (40.41”) | Recommended | -|**Height from top of Surface Hub 2S**| 1767.2 mm (69.57”) | Recommended | -|**Height from center of mount**| 1397 mm (55”) | Recommended | - -1. Measure 1026.5 mm (40.41”) from the floor level to set the recommended minimum height. -2. Measure 1767.2 mm (69.57”) from the floor level to set the recommended top height. - -![*Surface Hub 2S wall mount front view*](images/sh2-wall-front.png)
          - -3. Measure 1397 mm (55”) mm from the floor level to set the recommended center height. - -![*Surface Hub 2S wall mount side view*](images/sh2-wall-side.png)
          - -## Obstruction free mounting - -In addition to the visible ports on the sides of the device, certain integrated components must remain free of obstruction in order to function correctly. These include the Bluetooth, Wi-Fi, occupancy, and mic sensors as well thermal cooling vents. - Keep out zones - -|**Item**|**Description**|**Notes**| -|:---- |:----------- |:----- | -|**Access**| Ensure unimpeded access to input/output ports, the compute cartridge, Bluetooth radio, Bluetooth sensor, Wi-Fi radio, Wi-Fi sensor, occupancy sensor. | See Figure 1. | -|**Air flow**| Avoid blocking inlet and outlet air vent zones. | See Figure 2 | -|**Audio**| Avoid blocking audio exit zone on rear of Surface Hub 2S. | See Figure 2. | - -![*Figure 1. Keep out zones for Surface Hub 2S components*](images/sh2-keepout-zones.png)
          -***Figure 1. Keep out zones for Surface Hub 2S components*** - -![*Figure 2. Avoid blocking thermal inlet/outlet and audio exit zones*](images/sh2-thermal-audio.png)
          -***Figure 2. Avoid blocking thermal inlet/outlet and audio exit zones.
          *** - -The removable compute cartridge containing the I/O ports must remain free of any obstructions or impediments of any kind. - -![*Figure 3.View of compute cartridge on the underside of Surface Hub 2s.*](images/sh2-ports.png)
          -***Figure 3.View of compute cartridge on the underside of Surface Hub 2s.*** - -![*Figure 4. Unimpeded removal of compute cartridge *](images/sh2-cartridge.png)
          -***Figure 4. Unimpeded removal of compute cartridge*** - -## Selecting a mounting system - -Surface Hub 2S uses a 350 mm x 350 mm mounting framework that meets most — but not all — of the criteria listed in the VESA Flat Display Mounting Interface Standard. You can install Surface Hub 2S using any of various off-the-shelf display brackets designed to accommodate displays that diverge from exact VESA specifications, as shown below. - -On the back of Surface Hub 2S, you’ll find a square pattern of four M6 x 1.0 threaded holes centered on the circular bump (565 mm in diameter). Attach your mount using four M6 x 1.0–12 mm-long metric bolts. Or, depending on preference, you can use longer bolts up to a maximum of 20 mm. -Important considerations for mounting systems - -|**Item**|**Description**|**Notes**| -|:------ |:------------- |:------- | -|**Strength**| Only choose mounts that can safely support devices of at least 28 kg (62 lbs.). | Required | -|**Stiffness**| Avoid flexible display mounts that can diminish the interactive pen and touch use experience. Most TV mounts are not designed to support touch displays. | Recommended | -|**Depth**| Keep the device mounted tightly to the wall especially in corridors and along circulation paths within rooms.| Recommended | -|**Versatility**| Ensure your mounting solution remains hidden from view in both the existing landscape mode and any potential portrait mode (subject to future availability). | Recommended | - -![*Figure 5. Surface Hub 2S mounting configuration*](images/sh2-mount-config.png)
          -***Figure 5. Surface Hub 2S mounting configuration*** - -## Mounting methods compatible with Surface Hub 2S - -Surface Hub 2S is compatible with mounts that allow you to place it at angles of 10-70 degrees from the vertical plane. Rail mounts typically have multiple holes and a set of slots, enabling compatibility across a wide range of displays. A rail attached to the wall and two mounts attached to the display enable you to securely install Surface Hub 2S to a wall. When evaluating rail mounts for compatibility, ensure they meet versatility requirements listed earlier. - -![*Figure 6. Rail mounts*](images/h2gen-railmount.png)
          -***Figure 6. Surface Hub 2S rail mounts*** diff --git a/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md b/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md deleted file mode 100644 index b52bdc6532..0000000000 --- a/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: "Deploy apps to Surface Hub 2S using Intune" -description: "Learn how you can deploy apps to Surface Hub 2S using Intune." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Deploy apps to Surface Hub 2S using Intune - -You can install additional apps to fit your team or organization's needs. - -## Developer guidelines - -- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub. -- Apps must be targeted for the [Universal device family](https://msdn.microsoft.com/library/windows/apps/dn894631) or Windows Team device family. -- Surface Hub only supports [offline-licensed apps](https://docs.microsoft.com/microsoft-store/distribute-offline-apps) from [Microsoft Store for Business](https://businessstore.microsoft.com/store). -- By default, apps must be Store-signed to be installed. During testing and development, you can also choose to run developer-signed UWP apps by placing the device in developer mode. -- When developing and submitting apps to the Microsoft Store, set Device family availability and Organizational licensing options to ensure that apps are available to run on Surface Hub. -- You need admin credentials to install apps on Surface Hub. Designed for use in meeting rooms and other shared spaces, Surface Hub prevents regular users from accessing the Microsoft Store to download and install apps. - -## Deployment guidelines - -You can deploy Universal Windows Platform (UWP) apps to Surface Hub 2S using Intune, easing app deployment to devices. - -1. To deploy apps, enable MDM for your organization. In the Intune portal, select **Intune** as your MDM Authority (recommended).
          - - ![Choose MDM authority](images/sh2-set-intune5.png) - -2. Enable the Microsoft Store for Business in Intune. Open Intune, select **Client apps** > **Microsoft Store for Business.**
          - - ![Enable Store for Business](images/sh2-deploy-apps-sync.png) - -3. In Intune open **Microsoft Store for Business** and select **Settings** > **Distribute** > **Management tools**. Choose **Microsoft Intune** as your management tool.
          - - ![Add Intune as your management tool](images/sh2-set-intune8.png) - -4. In Microsoft Store for Business, select **Settings** > **Shop** > **Shopping Experience**, and then select **Show offline apps**. Offline apps refer to apps that can be synced to Intune and centrally deployed to a device. -5. After enabling Offline shopping, you can acquire offline licenses for apps that you can sync to Intune and deploy as Device licensing. -6. In **Intune** > **Client apps** > **Microsoft Store for Business**, select **Sync**. -7. In the Client apps page, search for the app in the apps list. Assign the apps to the desired device group or groups. Select **Assignments** > **Add group**.
          - -![*Assigning apps to groups *](images/sh2-assign-group.png)
          - -8. Under assignment type, choose **Required**.
          - -![*Assigning apps to groups *](images/sh2-add-group.png)
          - -9. For the selected groups, choose **Device licensing** and then select **OK** and save the assignment.
          - -![*Assigning apps to groups *](images/sh2-apps-assign.png) diff --git a/devices/surface-hub/surface-hub-2s-deploy-checklist.md b/devices/surface-hub/surface-hub-2s-deploy-checklist.md deleted file mode 100644 index 10fe718f75..0000000000 --- a/devices/surface-hub/surface-hub-2s-deploy-checklist.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: "Surface Hub 2S deployment checklists" -description: "Verify your deployment of Surface Hub 2S using pre- and post-deployment checklists." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S deployment checklists - -## Surface Hub 2S pre-deployment checklist - -|**Item**|**Response**| -|:------ |:------ | -|**Device account name**| | -|**Device account UPN**| | -|**ActiveSync Policy**| | -|**Calendar processing configuration completed**| ☐ Yes
          ☐ No | -|**Device-friendly name**| | -|**Device host name**| | -|**Affiliation**| ☐ None
          ☐ Active Directory affiliation
          ☐ Azure Active Directory | -|**Microsoft Teams Mode**| ☐ Mode 0
          ☐ Mode 1
          ☐ Mode 2 | -|**Device Management**| ☐ Yes, Microsoft Intune
          ☐ Yes, other mobile device manager [MDM]
          ☐ None | -|**Proxy**| ☐ Automatic configuration
          ☐ Proxy server
          ☐ Proxy auto-config (PAC) file | -|**Proxy authentication**| ☐ Device account credentials
          ☐ Prompt for credentials | -|**Password rotation**| ☐ On
          ☐ Off | -|**Skype for Business additional domain names (on-premises only)**| | -|**Session timeout time**| | -|**Session timeout action**| ☐ End session
          ☐ Allow resume | -|**My meetings and files**| ☐ Enabled
          ☐ Disabled | -|**Lock screen timeout**| | -|**Sleep idle timeout**| | -|**Bluetooth**| ☐ On
          ☐ Off | -|**Use only BitLocker USB drives**| ☐ On
          ☐ Off | -|**Install additional certificates (on-premises only)**| | -|**Windows update**| ☐ Windows Update for Business
          ☐ Windows Server Update Services [WSUS] | -|**Surface app speaker setting**| ☐ Rolling stand
          ☐ Wall-mounted | -|**IP Address**| ☐ Wired — DHCP
          ☐ Wired — DHCP reservation
          ☐ Wireless — DHCP
          ☐ Wireless — DHCP reservation | - -## Surface Hub 2S post-deployment checklist - -|**Check**|**Response**| -|:------|:---------| -|**Device account syncing**| ☐ Yes
          ☐ No | -|**Bitlocker key**| ☐ Saved to file (no affiliation)
          ☐ Saved in Active Directory (AD affiliation)
          ☐ Saved in Azure AD (Azure AD affiliation) | -|**Device OS updates**| ☐ Completed | -|**Windows Store updates**| ☐ Automatic
          ☐ Manual | -|**Microsoft Teams scheduled meeting**| ☐ Confirmation email received
          ☐ Meeting appears on start screen
          ☐ One-touch join functions
          ☐ Able to join audio
          ☐ Able to join video
          ☐ Able to share screen || -|**Skype for Business scheduled meeting**| ☐ Confirmation email received
          ☐ Meeting appears on start screen
          ☐ One-touch join functions correctly
          ☐ Able to join audio
          ☐ Able to join video
          ☐ Able to share screen
          ☐ Able to send/receive IM | -|**Scheduled meeting when already invited**| ☐ Meeting declined | -|**Microsoft Teams ad-hoc meeting**| ☐ Invite other users work
          ☐ Able to join audio
          ☐ Able to join video
          ☐ Able to share screen | -|**Skype for Business scheduled meeting**| ☐ Invite other users work
          ☐ Able to join audio
          ☐ Able to join video
          ☐ Able to share screen
          ☐ Able to send/receive IM | -|**Microsoft Whiteboard**| ☐ Launch from Welcome / Start screen
          ☐ Launch from Microsoft Teams | -|**Incoming Skype/Teams call**| ☐ Able to join audio
          ☐ Able to join video
          ☐ Able to share screen
          ☐ Able to send/receive IM (Skype for Business only) | -|**Incoming live video streams**| ☐ Maximum 2 (Skype for Business)
          ☐ Maximum 4 (Microsoft Teams) | -|**Microsoft Teams Mode 0 behavior**| ☐ Skype for Business tile on Welcome/Start screen
          ☐ Can join scheduled Skype for Business meetings (Skype UI)
          ☐ Can join scheduled Teams meetings (Teams UI) | -|**Microsoft Teams Mode 1 behavior**| ☐ Teams tile on Welcome/Start screen
          ☐ Can join scheduled Skype for Business meetings (Skype UI)
          ☐ Can join scheduled Teams meetings (Teams UI) | -|**Microsoft Teams Mode 2 behavior**| ☐ Teams tile on Welcome / Start screen
          ☐ Can join scheduled Teams meetings
          ☐ Fail to join Skype for Business meetings | diff --git a/devices/surface-hub/surface-hub-2s-deploy.md b/devices/surface-hub/surface-hub-2s-deploy.md deleted file mode 100644 index cd99172ad3..0000000000 --- a/devices/surface-hub/surface-hub-2s-deploy.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: "Create provisioning packages for Surface Hub 2S" -description: "This page describes how to deploy Surface Hub 2S using provisioning packages and other tools." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Create provisioning packages for Surface Hub 2S - -You can use Windows Configuration Designer (WCD) to create provisioning packages to automate the deployment process of Surface Hub 2S. Use provisioning packages to add certificates, configure proxies, set up device administrators and device accounts. You can also use provisioning packages along with a configuration file to deploy multiple Surface Hubs with a single USB thumb drive. - -### Install Windows Configuration Designer - -Install Windows Configuration Designer from the Windows Assessment and Deployment Kit (ADK) for Windows 10. Download and install the [ADK for Windows 10, version 1703](https://go.microsoft.com/fwlink/p/?LinkId=845542). For more information, see [Download and install the Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install). - -### Add certificates - -You can import Certificate Authority certificates to Surface Hub 2S. -To add certificates to Surface Hub 2S, you need a copy of each certificate as X.509 in .cer format. You cannot import .crt, .pfx or other container formats. Certificates must be imported into Windows Configuration Designer and arranged by hierarchy: - - ![Add certificates](images/sh2-wcd.png) - -### Configure proxy during OOBE - -In Windows Configuration Designer, go to the Configure proxy settings tab and enter the appropriate settings as shown below. - - ![Configure proxy settings](images/sh2-proxy.png) - -> [!NOTE] -> When configuring proxy settings, turn off **Automatically detect settings** if you intend to use a setup script or a proxy server. You can use a setup script *or* a proxy server, not both. - -### Affiliate Surface Hub 2S with Azure Active Directory - -You can affiliate Surface Hub 2S with Azure Active Directory using a provisioning package: -As an Azure Active Directory Global Administrator, you can join large numbers of new Windows devices to Azure Active Directory and Intune using a bulk token. - -To create a bulk token, give it a friendly name, configure the expiration date (maximum of 30 days) and use your Admin credentials to acquire the token as shown below: - - ![Set up device admins](images/sh2-token.png)

          - ![Set up device admins](images/sh2-token2.png)

          - ![Set up device admins](images/sh2-token3.png)

          - -### Provisioning multiple devices (.csv file) - -In addition to the provisioning package, you can use a Surface Hub configuration file to make it even easier to set up your devices. A Surface Hub configuration file contains a list of device accounts and friendly names for wireless projection. During first run, you get an option to choose a device account and friendly name from a configuration file. - -### To create a Surface Hub configuration file - -1. Using Microsoft Excel or another CSV editor, create a CSV file named: **SurfaceHubConfiguration.csv** -2. Enter a list of device accounts and friendly names in this format: - -``` -,, -``` - -3. Save the file to the root of the USB thumb drive where you copied the PPKG file. - - ![Configuration file example](images/sh2-config-file.png) diff --git a/devices/surface-hub/surface-hub-2s-install-mount.md b/devices/surface-hub/surface-hub-2s-install-mount.md deleted file mode 100644 index 7b4e3e3e00..0000000000 --- a/devices/surface-hub/surface-hub-2s-install-mount.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Install and mount Surface Hub 2S" -description: "Learn how to install and mount Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Install and mount Surface Hub 2S - -Surface Hub 2S is designed for ease of mobility with a form factor that enables you to quickly install and begin using the device. Microsoft has partnered with Steelcase on the following certified mounting solutions: Roam Mobile Stand and Roam Wall Mount. Both fully integrate with the design of Surface Hub 2S, enabling unimpeded access to the compute cartridge, power, USB-A, USB-C, and other ports. - -You can mount Surface Hub 2S with the certified wall mount or the certified mobile stand, both developed in partnership with Steelcase. Both fully integrate with the design of Surface Hub 2S, enabling unimpeded access to the compute cartridge along with all I/O ports and power. - -For more information, see [Officially licensed third-party accessories](http://licensedhardware.azurewebsites.net/surface) and view installation demos from the Surface product team at [Steelcase mobile stand and APC battery set up](https://youtu.be/VTzdu4Skpkg). - - ![Surface Hub 2S on Roam Mobile Stand](images/sh2-mobile-stand.png)
          - -If you’re not using licensed accessories, see [Customize wall mount of Surface Hub 2S](surface-hub-2s-custom-install.md). - -| 1. **Set up your mount first** | | -|:------ |:-------- | -| Leave your Surface Hub in the box until the mount is set up and mounting hardware is applied. Mount is not included. Your mount is sold separately. | ![* Set up your mount first *](images/sh2-setup-1.png)
          | -| 2. **Attach hardware to the Surface Hub** | | -| Mounting hardware and specific instructions are found in the box for your mount. | ![* Attach hardware to the Surface Hub *](images/sh2-setup-2.png)
          | -| 3. **Remove the instructional label before mounting.** | | -| Get someone to help you lift and mount your Surface Hub. Make sure to hold and lift the Surface Hub from the bottom. | ![* Remove the instructional label before mounting *](images/sh2-setup-3.png)
          | -| 4. **Attach accessories and power on** | | -| Install accessories and attach power cable as shown. See guides on the screen cling. Remove cling wrap from the screen. Press the power button to power on. | ![* Attach accessories and power on *](images/sh2-setup-4.png)
          | diff --git a/devices/surface-hub/surface-hub-2s-manage-intune.md b/devices/surface-hub/surface-hub-2s-manage-intune.md deleted file mode 100644 index 1749e6cafd..0000000000 --- a/devices/surface-hub/surface-hub-2s-manage-intune.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: "Manage Surface Hub 2S with Intune" -description: "Learn how to update and manage Surface Hub 2S using Intune." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Manage Surface Hub 2S with Intune - -## Register Surface Hub 2S with Intune - -Surface Hub 2S allows IT administrators to manage settings and policies using a mobile device management (MDM) provider. Surface Hub 2S has a built-in management component to communicate with the management server, so there is no need to install additional clients on the device. - -### Manual registration - -1. Sign in as a local administrator on Surface Hub 2S and open the **Settings** app. Select **Surface Hub** > **Device management** and then select **+** to add. -2. After authenticating, the device will automatically register with Intune. - - ![Register Surface Hub 2S with Intune](images/sh2-set-intune1.png)
          - -### Auto registration — Azure Active Directory Affiliated - -When affiliating Surface Hub 2S with a tenant that has Intune auto enrollment enabled, the device will automatically enroll with Intune. - -## Windows 10 Team Edition settings - -Select Windows 10 Team for preset device restriction settings for Surface Hub and Surface Hub 2S. - - ![Set device restrictions for Surface Hub 2S.](images/sh2-set-intune3.png)
          - -These settings include user experience and app behavior, Azure Log Analytics registration, Maintenance windows configuration, Session settings, and Miracast settings. For a complete list of available Windows 10 Team settings, see [SurfaceHub CSP](https://docs.microsoft.com/windows/client-management/mdm/surfacehub-csp). - -## Additional supported configuration service providers (CSPs) - -For additional supported CSPs, see [Surface Hub CSPs in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#surfacehubcspsupport). - -## Quality of Service (QoS) settings - -To ensure optimal video and audio quality on Surface Hub 2S, add the following QoS settings to the device. The settings are identical for Skype for Business and Teams. - -|**Name**|**Description**|**OMA-URI**|**Type**|**Value**| -|:------ |:------------- |:--------- |:------ |:------- | -|**Audio Ports**| Audio Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition | String | 50000-50019 | -|**Audio DSCP**| Audio ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/DSCPAction | Integer | 46 | -|**Video Ports**| Video Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubVideo/SourcePortMatchCondition | String | 50020-50039 | -|**Video DSCP**| Video ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubVideo/DSCPAction | Integer | 34 | - -> [!NOTE] -> These are the default port ranges. Administrators may change the port ranges in the Skype for Business and Teams control panel. - -## Microsoft Teams Mode settings - -You can set the Microsoft Teams app mode using Intune. Surface Hub 2S comes installed with Microsoft Teams in mode 0, which supports both Microsoft Teams and Skype for Business. You can adjust the modes as shown below. - -### Modes: - -- Mode 0 — Skype for Business with Microsoft Teams functionality for scheduled meetings. -- Mode 1 — Microsoft Teams with Skype for Business functionality for scheduled meetings. -- Mode 2 — Microsoft Teams only. - -To set modes, add the following settings to a custom Device Configuration Profile. - -|**Name**|**Description**|**OMA-URI**|**Type**|**Value**| -|:------ |:------------- |:--------- |:------ |:------- | -|**Teams App ID**| App name | ./Vendor/MSFT/SurfaceHub/Properties/VtcAppPackageId | String | Microsoft.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe!Teams­­ | -|**Teams App Mode**| Teams mode | ./Vendor/MSFT/SurfaceHub/Properties/SurfaceHubMeetingMode | Integer | 0 or 1 or 2 | diff --git a/devices/surface-hub/surface-hub-2s-manage-passwords.md b/devices/surface-hub/surface-hub-2s-manage-passwords.md deleted file mode 100644 index 3de1d293aa..0000000000 --- a/devices/surface-hub/surface-hub-2s-manage-passwords.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Manage device account password rotation" -description: "Learn how to configure Surface Hub 2S on-premises accounts with PowerShell" -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- -# Manage device account password rotation - -You can configure Surface Hub 2S to automatically change a device account password without requiring you to manually update the device account information. - -If you turn on Password Rotation, Surface Hub 2S changes the password every 7 days. The automatically generated passwords contain 15-32 characters including a combination of uppercase and lowercase letters, numbers, and special characters. - -Passwords do not change during a meeting. If Surface Hub 2S is turned off, it attempts to change the password immediately when turned on or every 10 minutes until successful. diff --git a/devices/surface-hub/surface-hub-2s-onprem-powershell.md b/devices/surface-hub/surface-hub-2s-onprem-powershell.md deleted file mode 100644 index 0d51997eda..0000000000 --- a/devices/surface-hub/surface-hub-2s-onprem-powershell.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: "Configure Surface Hub 2S on-premises accounts with PowerShell" -description: "Learn how to configure Surface Hub 2S on-premises accounts with PowerShell" -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Configure Surface Hub 2S on-premises accounts with PowerShell - -## Connect to Exchange Server PowerShell - -> [!IMPORTANT] -> You'll need the Fully Qualified Domain Name (FQDN) for the Client Access service of the on-premises Exchange server for some of these cmdlets. - -```PowerShell -$ExchServer = Read-Host "Please Enter the FQDN of your Exchange Server" -$ExchSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://$ExchServer/PowerShell/ -Authentication Kerberos -Credential (Get-Credential) -Import-PSSession $ExchSession -``` - -```PowerShell -$ExchServer = Read-Host "Please Enter the FQDN of your Exchange Server" -$ExchSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://$ExchServer/PowerShell/ -Authentication Kerberos -Credential (Get-Credential) -Import-PSSession $ExchSession -``` - -## Create the device account - -```PowerShell -New-Mailbox -UserPrincipalName Hub01@contoso.com -Alias Hub01 -Name "Hub 01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) -``` - -## Set automatic calendar processing - -```PowerShell -Set-CalendarProcessing -Identity "HUB01@contoso.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub" -``` - -## Enable the Skype for Business object - -> [!NOTE] -> It is important that you know the FQDN of the Skype for Business Registrar Pool. - -```PowerShell -Enable-CsMeetingRoom -Identity Contoso\HUB01 -SipAddressType emailaddress -RegistrarPool SfbIEFE01.contoso.local -``` - -## Mobile Device Mailbox Policy - -You may need to create a Mobile Device Mailbox Policy (also known as ActiveSync Policy) to allow your Surface Hub to connect to your online or on-premises environment. - -## Create a Surface Hub mobile device mailbox policy - -```PowerShell -New-MobileDeviceMailboxPolicy -Name “Surface Hubs” -PasswordEnabled $false -``` - -## Additional settings - -It is recommended to add a MailTip to Surface Hub rooms so users remember to make the meeting a Skype for Business or Teams meeting: - -```PowerShell -Set-Mailbox "Surface Hub 2S" -MailTip "This is a Surface Hub room. Please make sure this is a Microsoft Teams meeting." -``` diff --git a/devices/surface-hub/surface-hub-2s-onscreen-display.md b/devices/surface-hub/surface-hub-2s-onscreen-display.md deleted file mode 100644 index 0f5679cd37..0000000000 --- a/devices/surface-hub/surface-hub-2s-onscreen-display.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: "Adjust Surface Hub 2S brightness, volume, and input" -description: "Learn how to use the onscreen display to adjust brightness and other settings in Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 07/09/2019 -ms.localizationpriority: Medium ---- -# Adjust Surface Hub 2S brightness, volume, and input - -Surface Hub 2S provides an on-screen display for volume, brightness, and input control. The Source button functions as a toggle key to switch between the volume, brightness, and input control menus. - -## To show the on-screen display - -- Press and hold the **Source** button for 4 seconds. - - ![Surface Hub 2S on-screen display](images/sh2-onscreen-display.png)
          - - When the on-screen display is visible, use one or more buttons to reach desired settings. - -## To adjust volume - -- Use the **Volume up/down** button to increase or decrease volume. - -## To adjust brightness - -1. Press the **Source** button again to switch to the brightness menu. -2. Use the **Volume up/down** button to increase or decrease brightness. - -## To adjust input - -1. Press the **Source** button twice to switch to the Source menu. -2. Use the **Volume up/down** button to switch between PC, HDMI, and USB-C inputs. diff --git a/devices/surface-hub/surface-hub-2s-pack-components.md b/devices/surface-hub/surface-hub-2s-pack-components.md deleted file mode 100644 index 692f4ee02d..0000000000 --- a/devices/surface-hub/surface-hub-2s-pack-components.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: "How to pack and ship your Surface Hub 2S for service" -description: "Instructions for packing Surface Hub 2S components, replacing the Compute cartridge, and replacing the camera" -keywords: pack, replace components, camera, compute cartridge -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 07/1/2019 -ms.localizationpriority: Medium ---- - -# How to pack and ship your Surface Hub 2S for service - -If you replace your Surface Hub 2S, one of its components, or a related accessory, use the instructions in this article when you pack the device for shipment. - ->[!IMPORTANT] ->When packing your device for shipment, make sure that you use the packaging in which your replacement device arrived. - -## How to pack your Surface Hub 2S 50” - -Use the following steps to pack your Surface Hub 2S 50" for shipment. - -![The Surface Hub unit and mobile stand.](images/surface-hub-2s-repack-1.png) - -![Remove the pen and the camera. Do not pack them with the unit.](images/surface-hub-2s-repack-2.png) - -![Remove the drive and the power cable. Do not pack them with the unit.](images/surface-hub-2s-repack-3.png) - -![Do not pack the Setup guide with the unit.](images/surface-hub-2s-repack-4.png) - -![Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge.](images/surface-hub-2s-repack-5.png) - -![Slide the Compute Cartridge out of the unit.](images/surface-hub-2s-repack-6.png) - -![You will need the Compute Cartridge and a screwdriver.](images/surface-hub-2s-repack-7.png) - -![Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD).](images/surface-hub-2s-repack-8.png) - -![Replace the cover and slide the Compute Cartridge back into the unit.](images/surface-hub-2s-repack-9.png) - -![Re-fasten the locking screw and slide the cover into place.](images/surface-hub-2s-repack-10.png) - -![Remove any base or mounting hardware. Using two people, place the unit in the base of the shipping container.](images/surface-hub-2s-repack-11.png) - -![Replace the cover of the shipping container, and insert the four clips.](images/surface-hub-2s-repack-12.png) - -![Close the four clips.](images/surface-hub-2s-repack-13.png) - -## How to replace and pack your Surface Hub 2S Compute Cartridge - -Use the following steps to remove the Surface Hub 2S Compute Cartridge, pack it for shipment, and install the new Compute Cartridge. - -![Image of the compute cartridge.](images/surface-hub-2s-replace-cartridge-1.png) - -![Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge.](images/surface-hub-2s-replace-cartridge-2.png) - -![Slide the Compute Cartridge out of the unit.](images/surface-hub-2s-replace-cartridge-3.png) - -![You will need the Compute Cartridge and a screwdriver.](images/surface-hub-2s-replace-cartridge-4.png) - -![Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD). When finished, replace the cover.](images/surface-hub-2s-repack-8.png) - -![You will need the packaging fixtures that were used to package your replacement Compute Cartridge.](images/surface-hub-2s-replace-cartridge-6.png) - -![Place the old Compute Cartridge in the packaging fixtures.](images/surface-hub-2s-replace-cartridge-7.png) - -![Place the old Compute Cartridge and its packaging into the box that was used for the replacement Compute Cartridge. Reseal the box.](images/surface-hub-2s-replace-cartridge-8.png) - -![Image of the replacement Compute Cartridge.](images/surface-hub-2s-replace-cartridge-1.png) - -![Slide the replacement Compute Cartridge into the unit.](images/surface-hub-2s-replace-cartridge-9.png) - -![Fasten the locking screw and slide the cover into place.](images/surface-hub-2s-replace-cartridge-10.png) - -## How to replace your Surface Hub 2S Camera - -Use the following steps to remove the Surface Hub 2S camera and install the new camera. - -![You will need the new camera and the two-millimeter allen wrench](images/surface-hub-2s-replace-camera-1.png) - -![Unplug the old camera from the unit. If needed, use the allen wrench to adjust the new camera. Plug the new camera into the unit.](images/surface-hub-2s-replace-camera-2.png) diff --git a/devices/surface-hub/surface-hub-2s-phone-authenticate.md b/devices/surface-hub/surface-hub-2s-phone-authenticate.md deleted file mode 100644 index ae82ccdf36..0000000000 --- a/devices/surface-hub/surface-hub-2s-phone-authenticate.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Configure password-less phone sign-in for Surface Hub 2S" -description: "Learn how to simplify signing in to Surface Hub 2S using password-less phone sign-in on your mobile device." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Configure password-less phone sign-in for Surface Hub 2S - -Password-less phone sign-in simplifies signing-in to your meetings and files on Surface Hub 2S. - -> [!NOTE] -> Password-less phone sign-in requires that your primary email address must match your UPN. - -## To set up password-less phone sign-in - -1. Download the [Microsoft Authenticator](https://www.microsoft.com/en-us/account/authenticator) app for iPhone or Android to your phone. -2. From your PC, go to [https://aka.ms/MFASetup](https://aka.ms/MFASetup) , sign in with your account, and select **Next.** -3. In the Additional security verification screen, select Mobile App and Use verification code, and then select **Setup**. - -## To configure mobile app - -1. In the Microsoft authenticator app on your phone, add an account, choose **Work or School Account**, and then scan the QR code displayed on your PC -2. Send a notification to your phone and then approve the sign-in request. -3. In the Authenticator app on your phone, use the drop-down menu next to your account and select **Enable phone sign-in**. -4. If required, register your device with your organization and follow the on-screen instructions. - -## To sign in to Surface Hub - -1. On Surface Hub, sign into **My meetings and files** and select **Send notification** when prompted. -2. Match the number displayed on your phone with the number displayed on Surface Hub to approve your sign-in request. -3. If prompted, enter the PIN or biometric ID on your phone to complete sign-in. - -## Learn more -For more information, see [Password-less phone sign-in with the Microsoft Authenticator app](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-phone-sign-in). diff --git a/devices/surface-hub/surface-hub-2s-port-keypad-overview.md b/devices/surface-hub/surface-hub-2s-port-keypad-overview.md deleted file mode 100644 index 05c3c4b37a..0000000000 --- a/devices/surface-hub/surface-hub-2s-port-keypad-overview.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Surface Hub 2S ports and keypad overview" -description: "This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S ports and keypad overview - -This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S whether via wired, Wi-Fi, or Bluetooth methods. It also includes best practice recommendations for key connectivity scenarios. - -> [!NOTE] -> You can find the serial number on the outside of the packaging, on the display by the power cord, or by using the Surface app. - -The figure below shows the location of ports and physical buttons on a keypad attached to the underside of the device. The table includes detailed descriptions of each element. - - ![Front facing and underside view of I/O connections and physical buttons](images/hub2s-schematic.png) - -## Port and keypad component reference - -|**Key**|**Component**|**Description**|**Key parameters**| -|:--- |:--------- |:----------- |:-------------- | -| 1 | **USB C** | **USB 3.1 Gen 1**
          Use as a walk-up port for plugging in peripherals such as thumb-drives. Guest ports are on each side of the device (4).

          *NOTE: This is the recommended port for connecting an external camera. Additional camera mount features are incorporated into the design to help support retention of attached cameras.*

          NOTE: TouchBack and video ingest are not supported on these ports. | Type C

          15 W Port (5V/3A) | -| 2 | **AC power** | **100-240 V input**
          Connect to standard AC power and Surface Hub 2S will auto switch to the local power standard such as110 volts in the US and Canada or 220 volts in the UK. | IEC 60320 C14 | -| 3 | **DC power** | **24V DC input port**
          Use for connecting to mobile battery. | Xbox1 Dual barrel to Anderson connector | -| 4 | **Ethernet** | **1000/100/10 Base-T**
          Use for providing a continuous connection in a corporate environment and related scenarios requiring maximum stability or capacity. | RJ45 | -| 5 | **USB-A** | **USB 3.1 Gen 1**
          Use as a walk-up port for plugging in peripherals such as thumb-drives. | Type A
          7.5 W Port (5V/1.5A) | -| 6 | **USB-C** | **USB 3.1 Gen 1**
          Use as a walk-up port for connecting external PCs and related devices or plugging in peripherals such as thumb-drives.

          *NOTE: This is the recommended input port for video, TouchBack, and InkBack.* | Type C
          18 W Port (5V/3A, 9V/2A) | -| 7 | **HDMI-in** | **HDMI 2.0, HDCP 2.2 /1.4**
          Use for multiple scenarios including HDMI-to-HDMI guest input. | Standard HDMI | -| 8 | **Mini DP-out** | **Mini DP 1.2 output**
          Use for video-out scenarios such as mirroring the Surface Hub 2S display to a larger projector.

          *NOTE: This supports a maximum resolution of 3840 x 2160 (4K UHD) @60Hz.* | Mini DP | -| 9 | **Source** | Use to toggle among connected ingest sources — external PC, HDMI, and Mini DP modes. | n/a | -| 10 | **Volume** | Use +/- to adjust audio locally on the device.

          *NOTE: When navigating to the brightness control, use +/- on the volume slider to control display brightness.* | n/a | -| 11 | **Power** | Power device on/off.
          Use also to navigate display menus and select items. | n/a | - - ![Rear facing view of wireless, audio, & related components](images/hub2s-rear.png) diff --git a/devices/surface-hub/surface-hub-2s-prepare-environment.md b/devices/surface-hub/surface-hub-2s-prepare-environment.md deleted file mode 100644 index 2b28cab313..0000000000 --- a/devices/surface-hub/surface-hub-2s-prepare-environment.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: "Prepare your environment for Surface Hub 2S" -description: "Learn what you need to do to prepare your environment for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Prepare your environment for Surface Hub 2S - -## Office 365 readiness - -You may use Exchange and Skype for Business on-premises with Surface Hub 2S. However, if you use Exchange Online, Skype for Business Online, Microsoft Teams or Microsoft Whiteboard, and intend to manage Surface Hub 2S with Intune, first review the [Office 365 requirements for endpoints](https://docs.microsoft.com/office365/enterprise/office-365-endpoints). - -Office 365 endpoints help optimize your network by sending all trusted Office 365 network requests directly through your firewall, bypassing all additional packet level inspection or processing. This feature reduces latency and your perimeter capacity requirements. - -Microsoft regularly updates the Office 365 service with new features and functionality, which may alter required ports, URLs, and IP addresses. To evaluate, configure, and stay up-to-date with changes, subscribe to the [Office 365 IP Address and URL Web service](https://docs.microsoft.com/office365/enterprise/office-365-ip-web-service). - -## Device affiliation - -Use Device affiliation to manage user access to the Settings app on Surface Hub 2S. -With the Windows 10 Team Edition operating system — that runs on Surface Hub 2S — only authorized users can adjust settings via the Settings app. Since choosing the affiliation can impact feature availability, plan appropriately to ensure that users can access features as intended. - -> [!NOTE] -> You can only set Device affiliation during the initial out-of-box experience (OOBE) setup. If you need to reset Device affiliation, you’ll have to repeat OOBE setup. - -## No affiliation - -No affiliation is like having Surface Hub 2S in a workgroup with a different local Administrator account on each Surface Hub 2S. If you choose No affiliation, you must locally save the [Bitlocker Key to a USB thumb drive](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-key-management-faq). You can still enroll the device with Intune, however only the local admin can access the Settings app using the account credentials configured during OOBE. You can change the Administrator account password from the Settings app. - -## Active Directory Domain Services - -If you affiliate Surface Hub 2S with on-premises Active Directory Domain Services, you need to manage access to the Settings app via a security group on your domain, ensuring that all security group members have permissions to change settings on Surface Hub 2S. Note also the following: - -- When Surface Hub 2S affiliates with your on-premises Active Directory Domain Services, the Bitlocker key can be saved in the AD Schema. For more information, see [Prepare your organization for BitLocker: Planning and policies](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies). -- Your organization’s Trusted Root CAs are pushed to the same container in Surface Hub 2S, which means you don’t need to import them using a provisioning package. -- You can still enroll the device with Intune to centrally manage settings on your Surface Hub 2S. - -## Azure Active Directory - -When choosing to affiliate your Surface Hub 2S with Azure AD, any user in the Global Admins Security Group can sign in to the Settings app on Surface Hub 2S. Alternatively, you can configure the Device Administrator role to sign in to the Settings app. For more information, see [Administrator role permissions in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles#device-administrators). Currently, no other group can be delegated to sign in to the Settings app on Surface Hub 2S. - -If you enabled Intune Automatic Enrollment for your organization, Surface Hub 2S will automatically enroll itself with Intune. The device’s Bitlocker key is automatically saved in Azure AD. When affiliating Surface Hub 2S with Azure AD, single sign-on and Easy Authentication will not work. diff --git a/devices/surface-hub/surface-hub-2s-quick-start.md b/devices/surface-hub/surface-hub-2s-quick-start.md deleted file mode 100644 index d1d20bc7c8..0000000000 --- a/devices/surface-hub/surface-hub-2s-quick-start.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: "Surface Hub 2S quick start" -description: "View the quick start steps to begin using Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S quick start - -## Unpack Surface Hub 2S - -1. Use the handles on each side of the box to move it to the space where you'll set it up. -2. Before opening, remove the clips (4) on the front and back, and then lift the top off the box using the handles. -3. In the base of the Surface Hub 2S, open the accessories box containing the setup guide, Surface Hub 2 pen, Surface Hub 2 camera, and the power cable. -4. On the back of the Surface Hub, there's an instructional label showing you where to attach the mounting hardware. Install them in place and remove the label. - -See this video for more information about [unboxing and set up](https://youtu.be/fCrxdNXvru4). - -## Install and adjust pen - -1. Attach Surface Hub 2 pen magnetically to your preferred side of the device. - -![*Surface Hub 2 pen comes ready to use. To replace AAA battery, pull off the top button and insert battery as shown. The indicator light will turn red when the battery is low.*](images/sh2-pen.png)
          - -2. To adjust pen pressure, open the Surface app on Surface Hub 2S, select Pen, and adjust the slider. - -![*Adjust the slider to change pen pressure *](images/sh2-pen-pressure.png)
          - -## Install camera - -Remove the lens cling from the camera and attach it to the USB-C port on the top of the Surface Hub 2S. - -## Start Surface Hub 2S - -1. Insert the power cable into the back of the device and plug it into a power outlet. Run the cable through any cable guides on your mounting solution and remove the screen clang. -2. To begin, press the power button on the bottom right. - -![* Keypad showing source, volume and power buttons*](images/sh2-keypad.png)
          diff --git a/devices/surface-hub/surface-hub-2s-recover-reset.md b/devices/surface-hub/surface-hub-2s-recover-reset.md deleted file mode 100644 index d055e724cd..0000000000 --- a/devices/surface-hub/surface-hub-2s-recover-reset.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: "Reset and recovery for Surface Hub 2S" -description: "Learn how to recover and reset Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Reset and recovery for Surface Hub 2S - -If you encounter problems with Surface Hub 2S, you can reset the device to factory settings or recover using a USB drive. - -To begin, sign into Surface Hub 2S with admin credentials, open the **Settings** app, select **Update & security**, and then select **Recovery**. - -## Reset device - -1. To reset, select **Get Started**. -2. When the **Ready to reset this device** window appears, select **Reset**. Surface Hub 2S reinstalls the operating system from the recovery partition and may take up to one hour to complete. -3. Run **the first time Setup program** to reconfigure the device. -4. If you manage the device using Intune or other mobile device manager (MDM) solution, retire and delete the previous record and re-enroll the new device. For more information, see [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe). - -![*Reset and recovery for Surface Hub 2S*](images/sh2-reset.png)
          -*Figure 1. Reset and recovery for Surface Hub 2S.* - -## Recover Surface Hub 2S using USB recovery drive - -New in Surface Hub 2S, you can now reinstall the device using a recovery image. - -### Recover from USB drive - -Surface Hub 2S lets you reinstall the device using a recovery image, which allows you to reinstall the device to factory settings if you lost the Bitlocker key or no longer have admin credentials to the Settings app. - -1. Begin with a USB 3.0 drive with 8 GB or 16 GB of storage, formatted as FAT32. -2. Download recovery image from the [Surface Recovery website](https://support.microsoft.com/en-us/surfacerecoveryimage?devicetype=surfacehub2s) onto the USB drive and connect it to any USB-C or USB A port on Surface Hub 2S. -3. Turn off the device. While holding down the Volume down button, press the Power button. Keep holding both buttons until you see the Windows logo. Release the Power button but continue to hold the Volume until the Install UI begins. - -![*Use Volume down and power buttons to initiate recovery*](images/sh2-keypad.png)
          - -4. In the language selection screen, select the display language for your Surface Hub 2S. -5. Choose **Recover from a drive** and **Fully clean the drive** and then select **Recover**. If prompted for a BitLocker key, select **Skip this drive**. Surface Hub 2S reboots several times and takes approximately 30 minutes to complete the recovery process. -Remove the USB drive when the first time setup screen appears. - -## Recover a locked Surface Hub - -On rare occasions, Surface Hub 2S may encounter an error during cleanup of user and app data at the end of a session. If this occurs, the device will automatically reboot and resume data cleanup. But if this operation fails repeatedly, the device will be automatically locked to protect user data. - -**To unlock Surface Hub 2S:**
          -Reset or recover the device from Windows Recovery Environment (Windows RE). For more information, see [What is Windows RE?](https://technet.microsoft.com/library/cc765966.aspx) - -> [!NOTE] -> To enter recovery mode, you need to physically unplug and replug the power cord three times. diff --git a/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md b/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md deleted file mode 100644 index cf7b561dca..0000000000 --- a/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: "Secure and manage Surface Hub 2S with SEMM" -description: "Learn more about securing Surface Hub 2S with SEMM." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Secure and manage Surface Hub 2S with SEMM and UEFI - -New in Surface Hub 2S, you can use SEMM to manage the UEFI setting of the device. -Use the Microsoft Surface UEFI Configurator to control the following components: - -- Wired LAN -- Cameras -- Bluetooth -- Wi-Fi -- Occupancy sensor - -Use the Microsoft Surface UEFI Configurator to turn on or off the following UEFI settings: - -- Boot - - - IPv6 for PXE Boot - - Alternate Boot - - Boot Order Lock - - USB Boot -- UEFI Front Page - - - Devices - - Boot - - Date/Time - -## Create UEFI configuration image - -Unlike other Surface devices, you cannot use an MSI file or a Win PE image to apply these settings on Surface Hub 2S. Instead, you need to create a USB image to load into the device. To create a Surface Hub 2S UEFI configuration image, download and install the latest version of the Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. For more information about using UEFI and SEMM, see [Microsoft Surface Enterprise Management Mode](https://docs.microsoft.com/surface/surface-enterprise-management-mode). - -## To configure UEFI on Surface Hub 2S - -1. Start the UEFI Configurator and on the first screen, choose **Configuration Package**.

          -![* Start the UEFI Configurator and choose Configuration Package*](images/sh2-uefi1.png)

          -2. To add the certificate to your package, you must have a valid certificate with the private key in a .pfx file format to sign and protect the package. Select **+ Certificate Protection.**
          -![* Select + Certificate Protection *](images/sh2-uefi2.png)

          -3. Enter the certificate’s private key’s password.
          -![* Enter the certificate’s private key’s password *](images/sh2-uefi3.png)

          -4. After importing the private key, continue creating the package.
          -![* Continue creating the package *](images/sh2-uefi4.png)

          -5. Choose **Hub** and **Surface Hub 2S** as the target for the UEFI configuration package.
          -![* Choose Hub and Surface Hub 2S as the target for the UEFI configuration package *](images/sh2-uefi5.png)

          -6. Choose the components and settings you want to activate or deactivate on Surface Hub 2S.
          -![* Choose the components and settings you want to activate or deactivate *](images/sh2-uefi6.png)

          -7. Use the USB option to export the file.
          -![* Use the USB option to export the file *](images/sh2-uefi8.png)

          -8. Insert and choose the USB drive you’d like to use for this package. The USB drive will be formatted and you lose any information you have on it.
          -![* Insert and choose the USB drive for your package *](images/sh2-uefi9.png)

          -9. Upon successful creation of the package, the Configurator will display the last two characters of your certificate’s thumbprint. You need these characters when you import to the configuration to Surface Hub 2S.
          -![* Successful configuration of package *](images/sh2-uefi10.png)
          - -## To boot into UEFI - -Turn off Surface Hub 2S. Press and hold the **Volume Up** button and press the **Power** Button. Keep holding the Volume Up button until the UEFI menu appears. diff --git a/devices/surface-hub/surface-hub-2s-setup.md b/devices/surface-hub/surface-hub-2s-setup.md deleted file mode 100644 index 76e5ac1055..0000000000 --- a/devices/surface-hub/surface-hub-2s-setup.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: "First time Setup for Surface Hub 2S" -description: "Learn how to complete first time Setup for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 07/03/2019 -ms.localizationpriority: Medium ---- - -# First time Setup for Surface Hub 2S - -When you first start Surface Hub 2S, the device automatically enters first time Setup mode to guide you through account configuration and related settings. - -## Configuring Surface Hub 2S account - -1. **Configure your locale.** Enter region, language, keyboard layout and time zone information. Select **Next**. - - ![* Configure your locale *](images/sh2-run1.png)
          -1. **Connect to a wireless network.** Choose your preferred wireless network and select **Next.** - -- This option is not shown if connected using an Ethernet cable. -- You cannot connect to a wireless network in hotspots (captive portals) that redirect sign-in requests to a provider’s website. - -3. **Enter device account info.** Use **domain\user** for on-premises and hybrid environments and **user@example.com** for online environments. Select **Next.** - - ![* Enter device account info *](images/sh2-run2.png)
          -1. **Enter additional info.** If requested, provide your Exchange server address and then select **Next.** - - ![* Enter more info; for example, Exchange server name*](images/sh2-run3.png)
          - -1. **Name this device.** Enter a name for your device or use the suggested one based on your account’s display name and user principle name [UPN]. **Select Next**. - -- The **Friendly name** is visible on the bottom left corner of Surface Hub 2S and is shown when projecting to the device. - -- The **Device name** identifies the device when affiliated with Active Directory or Azure Active Directory, and when enrolling the device with Intune. - - ![* Name this device*](images/sh2-run4.png)
          - -## Configuring device admin accounts - -You can only set up device admins during first time Setup. For more information, refer to [Surface Hub 2S device affiliation](https://docs.microsoft.com/surface-hub/surface-hub-2s-prepare-environment#device-affiliation). - - In the **Setup admins for this device** window, select one of the following options: Active Directory Domain Services, Azure Active Directory, or Local admin. - - ![* Setup admins for this device *](images/sh2-run5.png)
          - -### Active Directory Domain Services - -1. Enter the credentials of a user who has permissions to join the device to Active Directory. - - ![* Setup admins using domain join *](images/sh2-run6.png)
          - -2. Select the Active Directory Security Group containing members allowed to log on to the Settings app on Surface Hub 2S. - - ![* Enter a security group *](images/sh2-run7.png)
          -1. Select **Finish**. The device will restart. - -### Azure Active Directory - -When choosing to affiliate your device with Azure Active Directory, the device will immediately restart and display the following page. Select **Next**. - -![* If your organization uses Office 365 or other business services from Microsoft, we’ll enrolll this device with your organization*](images/sh2-run8.png)
          - -1. Enter the email address or UPN of an account **with Intune Plan 1** or greater and then select **Next.** - - ![* Enter work or school account*](images/sh2-run9.png)
          - -2. If redirected, authenticate using your organization’s sign-in page and provide additional logon information if requested. The device will restart. - -## Local Administrator account - -- Enter a username and password for your local admin. The device will restart. - - ![* Set up an admin account*](images/sh2-run10.png)
          - -## Using provisioning packages - -If you insert a USB thumb drive with a provisioning package into one of the USB ports when you start Surface Hub 2S, the device displays the following page. - -1. Enter the requested settings and select **Set up**. - - ![* Enter regional settings for provisioning package*](images/sh2-run11.png)
          - - ![* Provision this device from removable media*](images/sh2-run12.png)
          -2. Choose the provisioning package you’d like to use. - - ![* Choose provisioning package to use*](images/sh2-run13.png)
          - -3. If you created a multiple devices CSV file, you will be able to choose a device configuration. For more information, refer to [Create provisioning packages for Surface Hub 2S](https://docs.microsoft.com/surface-hub/surface-hub-2s-deploy#provisioning-multiple-devices-csv-file). - - - ![* Select a device account and friendly name from your configuration file*](images/sh2-run14.png)
          - -4. Follow the instructions to complete first time Setup. diff --git a/devices/surface-hub/surface-hub-2s-site-planning.md b/devices/surface-hub/surface-hub-2s-site-planning.md deleted file mode 100644 index 683d732f9a..0000000000 --- a/devices/surface-hub/surface-hub-2s-site-planning.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Surface Hub 2S site planning" -description: "Learn more about rooms for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S site planning - -## Introduction - -Designed for team collaboration, Surface Hub 2S can transform the way you work — not only in the conference rooms but any place you want to work. One of the biggest advantages of Surface Hub 2S is the ability to move it from one space to another when used with the Steelcase Roam mobile stand and mobile battery. Providing unplugged, uninterrupted teamwork capabilities, Surface Hub 2S can be integrated into almost any workspace. - -## Room considerations - -Designed for interactive use in smaller conference rooms and huddle spaces, Surface Hub 2S provides a 4K camera, microphone array, crystal clear speakers, and a brilliant 4K+ resolution display. Optimizing the user experience in larger spaces with more people further away from the display may require peripherals such as an extra camera, microphone, or room systems solution such as Microsoft Teams Rooms. - -As a general guideline, install Surface Hub 2S in a space that meets the following criteria: - -- People can reach all four edges of the touchscreen. -- The screen is not in direct sunlight, which could affect viewing or damage the screen. -- Ventilation openings are not blocked. -- Microphones are not affected by noise sources, such as fans or vents. -- Space is well lit with no reflective sources. - -Whether mounted to a wall or installed on the mobile stand, the areas where you use the device should maintain: - -- Room temperatures no cooler than 10°C (50° F) and no hotter than 35°C (95° F). -- Relative humidity no lower than 20 percent and no higher than 80 percent. - -For detailed room planning guidance and more information about Microsoft Teams Rooms see [Plan Microsoft Teams Rooms.](https://docs.microsoft.com/MicrosoftTeams/room-systems/skype-room-systems-v2-0) - -## Managing Surface Hub 2S location - -If you plan to use Surface Hub 2S on a mobile stand, you may wish to explore third-party solutions that enable location services. For example, active RFID systems can provide real-time tracking throughout complex office or industrial spaces. For more information, see your A/V provider or other third-party expertise for guidance. diff --git a/devices/surface-hub/surface-hub-2s-site-readiness-guide.md b/devices/surface-hub/surface-hub-2s-site-readiness-guide.md deleted file mode 100644 index e765207b4c..0000000000 --- a/devices/surface-hub/surface-hub-2s-site-readiness-guide.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: "Surface Hub 2S site readiness guide" -description: "Get familiar with site readiness requirements and recommendations for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S site readiness guide - -|**Topic**|**Description**| -|:-------|:-------| -| [Site planning for Surface Hub 2S](surface-hub-2s-site-planning.md) | Review room considerations and planning for peripherals. | -| [Surface Hub 2S quick start](surface-hub-2s-quick-start.md) | Get an overview of required steps to unpack and start Surface Hub 2S. | -| [Install and mount Surface Hub 2S](surface-hub-2s-install-mount.md) | Learn about licensed accessories to install and mount Surface Hub 2S. | -| [Customizing installation of Surface Hub 2S](surface-hub-2s-custom-install.md) | Learn how to custom install without licensed mounting accessories.| -| [Surface Hub 2S ports and keypad overview](surface-hub-2s-port-keypad-overview.md) | Get details for I/O ports and keypad power and selection controls. | -| [Connect to Surface Hub 2S](surface-hub-2s-connect.md) | Learn about wired and wireless methods to connect to Surface Hub.| diff --git a/devices/surface-hub/surface-hub-2s-techspecs.md b/devices/surface-hub/surface-hub-2s-techspecs.md deleted file mode 100644 index 12955c3afb..0000000000 --- a/devices/surface-hub/surface-hub-2s-techspecs.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: "Surface Hub 2S tech specs" -description: "View tech specs for Surface Hub 2S including pen, camera, and optional mobile battery specifications." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -manager: laurawi -ms.author: robmazz -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S tech specs - -|**Item**|**Details**| -|:------ |:--------- | -|**Dimensions**| 29.2" x 43.2" x 3.0” (741 mm x 1097 mm x 76 mm) | -|**Shipping dimensions**| 47.64" x 36.89" x 9.92" (1,210 mm x 937 mm x 252 mm)| -|**Weight**| 61.6 lbs. (28 kg) | -|**Shipping Weight**| 81.08 lbs. (36.77 kg) | -|**Resolution**| 3840 x 2560 | -|**Display**| PixelSense Display, 3:2 aspect ratio, 10-bit color, 15.5 mm border, anti-glare, IPS LCD | -|**Processor**| Quad-core 8th Generation Intel Core i5 processor, 8 GB RAM, 128 GB SSD 1 | -|**Graphics**| Intel UHD Graphics 620 | -|**Wireless**| Wi-Fi 5 (IEEE 802.11 a/b/g/n/ac compatible) Bluetooth Wireless 4.1 technology
          Miracast display | -|**Connections**| USB-A
          Mini-DisplayPort 1.2 video output
          RJ45 gigabit Ethernet (1000/100/10 BaseT)
          HDMI video input (HDMI 2.0, HDCP 2.2 /1.4)
          USB-C with DisplayPort input
          Four USB-C (on display) | -|**Sensors**| Doppler occupancy sensor
          Accelerometer
          Gyroscope | -|**Audio/Video**| Full-range, front facing 3-way stereo speakers
          Full band 8-element MEMS microphone array
          Microsoft Surface Hub 2 Camera, 4K, USB-C connection, 90-degree HFOV | -|**Pen**| Microsoft Surface Hub 2 Pen (active) | -|**Software**| Windows 10
          Microsoft Teams for Surface Hub 2
          Skype for Business
          Microsoft Whiteboard
          Microsoft Office (Mobile)
          Microsoft Power BI 2 | -|**Exterior**| Casing: Precision machined aluminum with mineral-composite resin
          Color: Platinum
          Physical Buttons: Power, Volume, Source | -|**What’s in the box**| One Surface Hub 2S
          One Surface Hub 2 Pen
          One Surface Hub 2 Camera
          2.5 m AC Power Cable
          Quick Start Guide | -|**Warranty**| 1-year limited hardware warranty | -|**BTU**| 1518 BTU/hr | -|**Input Voltage**| 50/60Hz 110/230v nominal, 90-265v max | -|**Input power, operating**| 445 W (495 W Surge Load) | -|**Input Current**| 5.46 A | -|**Input Power, standby**| 5 W max | - -> [!NOTE] -> 1 System software uses significant storage space. Available storage is subject to change based on system software updates and apps usage. 1 GB= 1 billion bytes. See Surface.com/Storage for more details.
          2 Software license required for some features. Sold separately.
          diff --git a/devices/surface-hub/surface-hub-2s-unpack.md b/devices/surface-hub/surface-hub-2s-unpack.md deleted file mode 100644 index 474bec14da..0000000000 --- a/devices/surface-hub/surface-hub-2s-unpack.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Unpack Surface Hub 2S" -description: "This page includes information about safely unpacking Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Unpack Surface Hub 2S - -## Unpacking the Surface Hub 2S - -Before you remove Surface Hub 2S from the box, make sure that you have your mounting solution assembled and someone available to help you. - -1. Use the handles on each side of the box to move it to the space where you'll set it up. -2. Before opening, remove the clips (4) on the front and back, and then lift the top off the box using the handles. -3. In the base of the Surface Hub 2S, open the accessories box containing the setup guide, Surface Hub 2 pen, Surface Hub 2 camera, and the power cable. -4. On the back of the surface hub, there's an instructional label that shows you where to attach the mounting hardware. Install them in place and remove the label. -5. If you're using a mobile stand remember to lock the wheels to keep the stand in place -6. Be sure to lift the Surface Hub 2S with both hands and support the bottom of the device. -7. Align the installed hardware with the slots on the mount so it rests firmly in place. -8. Follow any further instructions that came with your mounting solution. - -## Install pen and camera - -1. Unwrap your Surface Hub 2 pen and attach it magnetically to your preferred side of the device. -2. Remove the lens cling from the camera and attach it to the USB-C port on the top of the Surface Hub 2S. -3. Insert the power cable into the back of the device and plug it into a power outlet. Run the cable through any cable guides on your mounting solution and remove the screen clang. -4. To begin, press the power button on the bottom right. diff --git a/devices/surface-hub/surface-hub-2s-whats-new.md b/devices/surface-hub/surface-hub-2s-whats-new.md deleted file mode 100644 index 2f0dad2a22..0000000000 --- a/devices/surface-hub/surface-hub-2s-whats-new.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: "What's new in Surface Hub 2S for IT admins" -description: "Learn more about new features in Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# What's new in Surface Hub 2S for IT admins - -Surface Hub 2S is an all-in-one collaboration canvas that’s built for teamwork delivering a digital whiteboard, meetings platform, and a Windows 10 computing experience in one device. - -|**Capability**|**Summary**|**Learn more**| -|:-------|:------|:----| -|**Mobile Device Management and UEFI manageability**| Manage settings and policies using a mobile device management (MDM) provider.

          Full integration with Surface Enterprise Management Mode (SEMM) lets you manage hardware components and firmware. | [Managing Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md)

          [Surface Enterprise Management Mode](https://docs.microsoft.com/surface/surface-enterprise-management-mode) | -|**Cloud and on-premises coexistence**| Supports on-premises, hybrid, or online. | [Prepare your environment for Microsoft Surface Hub 2S](surface-hub-2s-prepare-environment.md) | -|**Reset and recovery**| Restore from the cloud or USB drive. | [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md) | -|**Microsoft Whiteboard**| Ofice 365 integration, intelligent ink, and Bing search bring powerful new capabilities, enabling a persistent digital canvas shareable across most browsers, Windows and iOS devices. | [Announcing a new whiteboard for your Surface Hub](https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-a-new-Whiteboard-for-your-Surface-Hub/ba-p/637050) | -|**Microsoft Teams Meeting Room License**| Extends Office 365 licensing options across Skype for Business, Microsoft Teams, and Intune. | [Teams Meeting Room Licensing Update](https://docs.microsoft.com/MicrosoftTeams/room-systems/skype-room-systems-v2-0) | -|**On-screen display**| Adjust volume, brightness, and input control directly on the display. | | -|**Sensor-activated Connected Standby**| Doppler sensor activates Connected Standby after 1 minute of inactivity.

          Manage this setting remotely using Intune or directly on the device from the Settings app. | [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) | -|**Surface Hub pen**| Ergonomically redesigned and easily attachable on the sides of the device. | | -|**Surface app for Surface Hub 2S**| Change audio settings and view your device's information from the Surface app | | -|**Ready for tomorrow**| Removable cartridge facilitates upgrading to new features. | | - -For more information about what’s new in Surface Hub 2S, see: - -- [Surface Hub 2S product site](https://www.microsoft.com/p/surface-hub-2S/8P62MW6BN9G4?activetab=pivot:overviewtab) -- [Behind the Design Surface Hub 2S](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Behind-the-design-Surface-Hub-2S/ba-p/464099) - -## Surface Hub 2S compared with Surface Hub - -The following table details the differences between Surface Hub and Surface Hub 2S: - -|**Component**| **Surface Hub 55”**|**Surface Hub 84”**| **Surface Hub 2S**| -|:----- |:---- |:---- |:----- | -|**Form Factor**| 55” | 84” | 50” | -|**Dimension**| 31.75” x 59.62” x 3.38”
          (806.4 mm x 1514.3 mm x 85.8 mm) | 46.12” x 86.7” x 4.15”
          (1171.5 mm x 2202.9 mm x 105.4 mm) | 29.2" x 43.2" x 3.0"
          (741 mm x 1097 mm x 76 mm) | -|**Weight**| 105 lbs. (48 kg) | 280 lbs. (127 kg) | 61.6 lbs. (28 kg) | -|**Display**| Resolution:
          1920 x 1080 @ 120 Hz
          Contrast ratio:
          1300:1
          Touch:
          100-point multi-touch
          Projective Capacitance optically bonded sensor | Resolution:
          3840 x 2160 @ 120 Hz
          Contrast Ratio:
          1400:1
          Touch:
          100-point multi-touch
          Projective Capacitance optically bonded sensor | Resolution:
          3840 x 2560 @ 60 Hz | -|**Aspect Ratio**| 16:9 | 16:9 | 3:2 | -|**Storage**| SSD 128 GB | SSD 128 GB | SSD 128 GB | -|**RAM**| 8 GB RAM | 8 GB RAM | 8 GB RAM | -|**Processor**| 4th Generation Intel® Core i5 | 4th Generation Intel Core i7 | Quad-core 8th Generation Intel Core i5 processor | -|**Graphics**| Intel HD 4600 | NVIDIA Quadro K2200 | Intel UHD Graphics 620 | -|**Network**| Wi-Fi (802.11 a/b/g/n/ac)
          Ethernet 1 Gbps
          Bluetooth 4.0 low energy
          Miracast enabled | Wi-Fi (802.11 a/b/g/n/ac)
          Ethernet 1 Gbps
          Bluetooth 4.0 low energy
          Miracast enabled | Wi-Fi 5 (IEEE 802.11 a/b/g/n/ac)
          Ethernet 1 Gbps
          Bluetooth Wireless 4.1 technology
          Miracast Display | -|**Ports**| (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
          (2) USB 2.0
          DisplayPort Video Output
          3.5 mm Stereo Out
          RJ11 Connector for system-level control

          DisplayPort Video Input
          HDMI Video Input
          VGA Video Input
          3.5 mm Stereo Input
          (1) USB 2.0 type B Touchback Output | (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
          (4) USB 2.0
          DisplayPort Video Output
          3.5 mm Stereo Out
          RJ11 Connector for system-level control

          DisplayPort Video Input
          HDMI Video Input
          VGA Video Input
          3.5 mm Stereo Input
          (1) USB 2.0 type B Touchback Output | (1) USB-A
          Mini-DisplayPort Video Output
          HDMI Video Input
          USB-C with DisplayPort Input
          (4) USB-C (on display)
          RJ45 Gigabit Ethernet | -|**Sensors**| (2) Passive Infrared Presence Sensors, Ambient Light Sensors | (2) Passive Infrared Presence Sensors, Ambient Light Sensors | Doppler occupancy sensor,
          Accelerometer,
          Gyroscope | -|**NFC**| NFC reader | NFC reader | N/A | -|**Speakers**| (2) Front-facing stereo speakers | (2) Front-facing stereo speakers | Full range front facing 3-way stereo speakers | -|**Microphone**| High-Performance, 4-Element Array | High-Performance, 4-Element Array | Full band 8-element MEMS microphone array | -|**Camera**| (2) Wide angle HD cameras 1080p @ 30 fps | (2) Wide angle HD cameras 1080p @ 30 fps | (1) Microsoft Surface Hub 2 Camera, 4K, USB-C connection, 90-degree horizontal field of view | -|**Pen**| (2) Powered, active, subpixel accuracy | (2) Powered, active, subpixel accuracy | (1) Microsoft Surface Hub 2 Pen (active) | -|**Physical buttons**| Power, Input Select, Volume, Brightness | Power, Input Select, Volume, Brightness | Power, Volume, Source | -|**Software**| Windows 10 + Office (Word, PowerPoint, Excel) | Windows 10 + Office (Word, PowerPoint, Excel) | Windows 10 + Office (Word, PowerPoint, Excel) | - -> [!NOTE] -> The NFC reader available in the original Surface Hub is discontinued in Surface Hub 2S and is no longer available. diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md deleted file mode 100644 index 2ffa84dd12..0000000000 --- a/devices/surface-hub/surface-hub-authenticator-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Sign in to Surface Hub with Microsoft Authenticator -description: Use Microsoft Authenticator on your mobile device to sign in to Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 08/28/2017 -ms.reviewer: -manager: dansimp -localizationpriority: medium ---- - -# Sign in to Surface Hub with Microsoft Authenticator - -People in your organization can sign in to a Surface Hub without a password using the Microsoft Authenticator app, available on Android and iOS. - -## Organization prerequisites - -To let people in your organization sign in to Surface Hub with their phones and other devices instead of a password, you’ll need to make sure that your organization meets these prerequisites: - -- Your organization must be a hybrid or cloud-only organization, backed by Azure Active Directory (Azure AD). For more information, see [What is Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/active-directory-whatis) - -- Make sure you have at minimum an Office 365 E3 subscription. - -- [Configure Multi-Factor Authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-mfasettings). Make sure **Notification through mobile app** is selected. - - ![multi-factor authentication options](images/mfa-options.png) - -- Enable content hosting on Azure AD services such as Office, SharePoint, etc. - -- Surface Hub must be running Windows 10, version 1703 or later. - -- Surface Hub is set up with either a local or domain-joined account. - -Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs that are joined to Azure AD. - -## Individual prerequisites - -- An Android phone running 6.0 or later, or an iPhone or iPad running iOS9 or later - -- The most recent version of the Microsoft Authenticator app from the appropriate app store - - >[!NOTE] - >On iOS, the app version must be 5.4.0 or higher. - > - >The Microsoft Authenticator app on phones running a Windows operating system can't be used to sign in to Surface Hub. - -- Passcode or screen lock on your device is enabled - -- A standard SMTP email address (example: joe@contoso.com). Non-standard or vanity SMTP email addresses (example: firstname.lastname@contoso.com) currently don’t work. - -## How to set up the Microsoft Authenticator app - ->[!NOTE] ->If Company Portal is installed on your Android device, uninstall it before you set up Microsoft Authenticator. After you set up the app, you can reinstall Company Portal. -> ->If you have already set up Microsoft Authenticator on your phone and registered your device, go to the sign-in instructions. - -1. Add your work or school account to Microsoft Authenticator for Multi-Factor Authentication. You will need a QR code provided by your IT department. For help, see [Get started with the Microsoft Authenticator app](https://docs.microsoft.com/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to). -2. Go to **Settings** and register your device. -3. Return to the accounts page and choose **Enable phone sign-in** from the account dropdown menu. - -## How to sign in to Surface Hub during a meeting - -1. After you’ve set up a meeting, go to the Surface Hub and select **Sign in to see your meetings and files**. - - >[!NOTE] - >If you’re not sure how to schedule a meeting on a Surface Hub, see [Schedule a meeting on Surface Hub](https://support.microsoft.com/help/17325/surfacehub-schedulemeeting). - - ![screenshot of Sign in option on Surface Hub](images/sign-in.png) - -2. You’ll see a list of the people invited to the meeting. Select yourself (or the person who wants to sign in – make sure this person has gone through the steps to set up their device before your meeting), and then select **Continue**. - - ![screenshot of list of attendees in a meeting](images/attendees.png) - - You'll see a code on the Surface Hub. - - ![screenshot of code for Approve Sign in](images/approve-signin.png) - -3. To approve the sign-in, open the Authenticator app, enter the four-digit code that’s displayed on the Surface Hub, and select **Approve**. You will then be asked to enter the PIN or use your fingerprint to complete the sign in. - - ![screenshot of the Approve sign-in screen in Microsoft Authenticator](images/approve-signin2.png) - -You can now access all files through the OneDrive app. \ No newline at end of file diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md deleted file mode 100644 index 8f92a6b3a0..0000000000 --- a/devices/surface-hub/surface-hub-downloads.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Useful downloads for Microsoft Surface Hub -description: Downloads related to the Microsoft Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 08/22/2017 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Useful downloads for Microsoft Surface Hub - -This topic provides links to useful Surface Hub documents, such as product datasheets and user's guide. - -| Link | Description | -| --- | --- | -| [Surface Hub Setup Guide (English, French, Spanish) (PDF)](https://download.microsoft.com/download/0/1/6/016363A4-8602-4F01-8281-9BE5C814DC78/Setup-Guide_EN-FR-SP.pdf) | Get a quick overview of how to set up the environment for your new Surface Hub. | -| [Surface Hub Quick Reference Guide (PDF)](https://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface%20Hub%20Quick%20Reference%20Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. | -| [Surface Hub User Guide (PDF)](https://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. | -| [Surface Hub Replacement PC Drivers](https://www.microsoft.com/download/details.aspx?id=52210) | The Surface Hub Replacement PC driver set is available for those customers who have chosen to disable the Surface Hub’s internal PC and use an external computer with their 84” or 55” Surface Hub. This download is meant to be used with the Surface Hub Admin Guide , which contains further details on configuring a Surface Hub Replacement PC. | -| [Microsoft Surface Hub Rollout and Adoption Success Kit (ZIP)](https://download.microsoft.com/download/F/A/3/FA3ADEA4-4966-456B-8BDE-0A594FD52C6C/Surface_Hub_Adoption_Kit_Final_0519.pdf) | Best practices for generating awareness and implementing change management to maximize adoption, usage, and benefits of Microsoft Surface Hub. The Rollout and Adoption Success Kit zip file includes the Rollout and Adoption Success Kit detailed document, Surface Hub presentation, demo guidance, awareness graphics, and more. | -| [Unpacking Guide for 84-inch Surface Hub (PDF)](https://download.microsoft.com/download/5/2/B/52B4007E-D8C8-4EED-ACA9-FEEF93F6055C/84_Unpacking_Guide_English_French-Spanish.pdf) | Learn how to unpack your 84-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/75/2b/752b73dc-6e9d-4692-8ba1-0f9fc03bff6b.mov?n=04.07.16_installation_video_03_unpacking_84.mov) | -| [Unpacking Guide for 55-inch Surface Hub (PDF)](https://download.microsoft.com/download/2/E/7/2E7616A2-F936-4512-8052-1E2D92DFD070/55_Unpacking_Guide_English-French-Spanish.PDF) | Learn how to unpack your 55-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/a9/d6/a9d6b4d7-d33f-4e8b-be92-28f7fc2c06d7.mov?n=04.07.16_installation_video_02_unpacking_55.mov) | -| [Wall Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Wall_Mounts_EN-FR-ES-NL-DE-IT-PT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the wall brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/bf/4d/bf4d6f06-370c-45ee-88e6-c409873914e8.mov?n=04.07.16_installation_video_05_wall_mount.mov) | -| [Floor-Supported Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Floor_Support_Mount_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the floor-supported brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/ed/de/edde468a-e1d4-4ce8-8b61-c4527dd25c81.mov?n=04.07.16_installation_video_06_floor_support_mount.mov) | -| [Rolling Stand Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Rolling_Stands_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the rolling stand, and how to mount your Surface Hub onto it. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/1f/94/1f949613-3e4a-41e3-ad60-fe8aa7134115.mov?n=04.07.16_installation_video_04_rolling_stand_mount.mov) | -| [Mounts and Stands Datasheet (PDF)](https://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf) | Specifications and prices for all Surface Hub add-on stands and mounts that turn your workspace into a Surface Hub workspace. | -| [Surface Hub Stand and Wall Mount Specifications (PDF)](https://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf) | Illustrated specifications for the 55” and 84” Surface Hub rolling stands, wall mounts, and floor-supported wall mounts. | - - - - diff --git a/devices/surface-hub/surface-hub-qos.md b/devices/surface-hub/surface-hub-qos.md deleted file mode 100644 index 589cfcfcdf..0000000000 --- a/devices/surface-hub/surface-hub-qos.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Implement Quality of Service on Surface Hub -ms.reviewer: -manager: dansimp -description: Learn how to configure QoS on Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.localizationpriority: medium ---- - -# Implement Quality of Service (QoS) on Surface Hub - -Quality of Service (QoS) is a combination of network technologies that allows the administrators to optimize the experience of real time audio/video and application sharing communications. - -Configuring [QoS for Skype for Business](https://docs.microsoft.com/windows/client-management/mdm/networkqospolicy-csp) on the Surface Hub can be done using your [mobile device management (MDM) provider](manage-settings-with-mdm-for-surface-hub.md) or through a [provisioning package](provisioning-packages-for-surface-hub.md). - - -This procedure explains how to configure QoS for Surface Hub using Microsoft Intune. - -1. In Intune, [create a custom policy](https://docs.microsoft.com/intune/custom-settings-configure). - - ![Screenshot of custom policy creation dialog in Intune](images/qos-create.png) - -2. In **Custom OMA-URI Settings**, select **Add**. For each setting that you add, you will enter a name, description (optional), data type, OMA-URI, and value. - - ![Screenshot of a blank OMA-URI setting dialog box](images/qos-setting.png) - -3. Add the following custom OMA-URI settings: - - Name | Data type | OMA-URI
          ./Device/Vendor/MSFT/NetworkQoSPolicy | Value - --- | --- | --- | --- - Audio Source Port | String | /HubAudio/SourcePortMatchCondition | Get the values from your Skype administrator - Audio DSCP | Integer | /HubAudio/DSCPAction | 46 - Video Source Port | String | /HubVideo/SourcePortMatchCondition | Get the values from your Skype administrator - Video DSCP | Integer | /HubVideo/DSCPAction | 34 - Audio Process Name | String | /HubAudio/AppPathNameMatchCondition | Microsoft.PPISkype.Windows.exe - Video Process Name | String | /HubVideo/AppPathNameMatchCondition | Microsoft.PPISkype.Windows.exe - - >[!IMPORTANT] - >Each **OMA-URI** path begins with `./Device/Vendor/MSFT/NetworkQoSPolicy`. The full path for the audio source port setting, for example, will be `./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition`. - - - - -4. When the policy has been created, [deploy it to the Surface Hub.](manage-settings-with-mdm-for-surface-hub.md#manage-surface-hub-settings-with-mdm) - - ->[!WARNING] ->Currently, you cannot configure the setting **IPProtocolMatchCondition** in the [NetworkQoSPolicy CSP](https://docs.microsoft.com/windows/client-management/mdm/networkqospolicy-csp). If this setting is configured, the policy will fail to apply. - diff --git a/devices/surface-hub/surface-hub-recovery-tool.md b/devices/surface-hub/surface-hub-recovery-tool.md deleted file mode 100644 index f1f6a52a05..0000000000 --- a/devices/surface-hub/surface-hub-recovery-tool.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Using the Surface Hub Recovery Tool -description: How to use the Surface Hub Recovery Tool to re-image the SSD. -ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1 -ms.reviewer: -manager: dansimp -keywords: manage Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 05/22/2018 -ms.localizationpriority: medium ---- - -# Using the Surface Hub Recovery Tool - -The [Microsoft Surface Hub Recovery Tool](https://www.microsoft.com/download/details.aspx?id=52210) helps you re-image your Surface Hub Solid State Drive (SSD) using a Windows 10 desktop device, without calling support or replacing the SSD. With this tool, you can reimage an SSD that has an unknown Administrator password, boot errors, was unable to complete a cloud recovery, or for a device that has an older version of the operating system. The tool will not fix physically damaged SSDs. - -To re-image the Surface Hub SSD using the Recovery Tool, you'll need to remove the SSD from the Surface Hub, connect the drive to the USB-to-SATA cable, and then connect the cable to the desktop PC on which the Recovery Tool is installed. For more information on how to remove the existing drive from your Surface Hub, see [Surface Hub SSD replacement](surface-hub-ssd-replacement.md). - ->[!IMPORTANT] ->Do not let the device go to sleep or interrupt the download of the image file. - -If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support). - -## Prerequisites - -### Mandatory - -- Host PC running 64-bit version of Windows 10, version 1607 or higher. -- Internet access -- Open USB 2.0 or greater port -- USB-to-SATA cable -- 10 GB of free disk space on the host computer -- SSDs shipped with Surface Hub or a SSD provided by Support as a replacement. SSDs not supplied by Microsoft are not supported. - -### Recommended - -- High-speed Internet connection -- Open USB 3.0 port -- USB 3.0 or higher USB-to-SATA cable -- The imaging tool was tested with the following make and model of cables: - - Startech USB312SAT3CB - - Rosewill RCUC16001 - - Ugreen 20231 - -## Download Surface Hub Recovery Tool - -Surface Hub Recovery Tool is available for download from [Surface Hub Tools for IT](https://www.microsoft.com/download/details.aspx?id=52210) under the file name **SurfaceHub_Recovery_v1.14.137.0.msi**. - -To start the download, click **Download**, choose **SurfaceHub_Recovery_v1.14.137.0.msi** from the list, and click **Next**. From the pop-up, choose one of the following: - -- Click **Run** to start the installation immediately. -- Click **Save** to copy the download to your computer for later installation. - -Install Surface Hub Recovery Tool on the host PC. - -## Run Surface Hub Recovery Tool - -1. On the host PC, select the **Start** button, scroll through the alphabetical list on the left, and select the recovery tool shortcut. - - ![Microsoft Surface Hub Recovery Tool shortcut](images/shrt-shortcut.png) - -2. Click **Start**. - - ![Recovery Tool Start button](images/shrt-start.png) - -3. In the **Guidance** window, click **Next**. - - ![Do not let your machine go to sleep guidance](images/shrt-guidance.png) - -4. click **Yes** to download the image. Time to download the recovery image is dependent on internet connection speeds. On an average corporate connection, it can take up to an hour to download the 8GB image file. - - ![Download the image?](images/shrt-download.png) - -5. When the download is complete, the tool instructs you to connect an SSD drive. If the tool is unable to locate the attached drive, there is a good chance that the cable being used is not reporting the name of the SSD to Windows. The imaging tool must find the name of the drive as "LITEON L CH-128V2S USB Device" before it can continue. For more information on how to remove the existing drive from your Surface Hub, see [Surface Hub SSD replacement](surface-hub-ssd-replacement.md). - - -~~~ -![Connect SSD](images/shrt-drive.png) -~~~ - -6. When the drive is recognized, click **Start** to begin the re-imaging process. On the warning that all data on the drive will be erased, click **OK**. - - ![Start re-imaging the SSD](images/shrt-drive-start.png) - - Prior to applying the system image to the drive, the SSD is repartitioned and formatted. Copying the system binaries will take approximately 30 minutes, but can take longer depending on the speed of your USB bus, the cable being used, or antivirus software installed on your system. - - ![Copying done](images/shrt-done.png) - - ![Reimaging complete](images/shrt-complete.png) - -## Troubleshooting and common problems - -Issue | Notes ---- | --- -The tool fails to image the SSD | Make sure you are using a factory-supplied SSD and one of the tested cables. -The reimaging process appears halted/frozen | It is safe to close and restart the Surface Hub Recovery Tool with no ill effect to the SSD. -The drive isn’t recognized by the tool | Verify that the Surface Hub SSD is enumerated as a Lite-On drive, "LITEON L CH-128V2S USB Device". If the drive is recognized as another named device, your current cable isn’t compatible. Try another cable or one of the tested cable listed above. -Error: -2147024809 | Open Disk Manager and remove the partitions on the Surface Hub drive. Disconnect and reconnect the drive to the host machine. Restart the imaging tool again. - -If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support). diff --git a/devices/surface-hub/surface-hub-site-readiness-guide.md b/devices/surface-hub/surface-hub-site-readiness-guide.md deleted file mode 100644 index 44e8717278..0000000000 --- a/devices/surface-hub/surface-hub-site-readiness-guide.md +++ /dev/null @@ -1,141 +0,0 @@ ---- -title: Surface Hub Site Readiness Guide -ms.reviewer: -manager: dansimp -description: Use this Site Readiness Guide to help plan your Surface Hub installation. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub Site Readiness Guide - -Use this Site Readiness Guide to help plan your Surface Hub installation. In this guide, you’ll find: -- Site readiness topics -- Detailed hardware specifications on power, ports, and cables -- Recommendations for moving and storage -- Links to guidance on unpacking and mounting - -## Site readiness planning - -The room needs to be large enough to provide good viewing angles, but small enough for the microphones to pick up clear signals from the people in the room. Most rooms that are about 22 feet (seven meters) long will provide a good meeting experience. In the conference area, mount Surface Hub where: - -- Everyone in the room can see it. -- People can reach all four edges of the touchscreen. -- The screen is not in direct sunlight, which could affect viewing or damage the screen. -- Ventilation openings are not blocked. -- Microphones are not affected by noise sources, such as fans or vents. -You can find more details in the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections. For cleaning, care, and safety information, see the mounting guides and user guide at http://www.microsoft.com/surface/support/surface-hub. - -### Hardware considerations - -Surface Hub arrives with: -- Two Microsoft Surface Hub pens -- A Microsoft wireless keyboard, customized for Surface Hub -- A 9-foot NEMA 5-15P (US Standard) to C13 power cable - -You’ll need to provide: -- Cat-5e or Cat-6 network cables -- Display cables (optional) -- Audio cable (optional) -- Type A to B USB cable (optional) - -For details about cable ports, see the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections. For details about cables, see [Wired Connect](#wired). - -Microsoft Surface Hub has an internal PC and does not require an external computer system. - -For power recommendations, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md). For power cable safety warnings, see the mounting guides at http://www.microsoft.com/surface/support/surface-hub. - -### Data and other connections - -To use Surface Hub, you need an active Ethernet port and a standard power outlet. In addition, you may want to: - -- Equip the conference table for Wired Connect. -- Expand the wall outlet configuration to include: - - Additional AC outlets - - Ethernetports - - Audio ports - - Video ports (DisplayPort, HDMI, VGA, etc.) - - -## When Surface Hub arrives - -Surface Hub is large and heavy, so let Receiving know when it will arrive and what they should do to handle it safely. For details on the packing weights and other specifications, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md). - -Consider the following: -- Wait to unpack Surface Hub from the shipping container until you’ve moved it to the conference area where you plan to install it. -- Make sure your loading dock can accept a shipment on a pallet and hold it securely until it can be installed. -- Check for local labor union rules that would require you to use union labor to unload or move Surface Hub. -- Do not leave Surface Hub in a hot or humid environment. As with any computer-based or display equipment, heat and humidity can damage Surface Hub. The recommended storage temperatures are 32°F to 95°F with a relative humidity of less than 70 percent. - -### Moving Surface Hub - -Before you move Surface Hub, make sure that all the doorways, thresholds, hallways, and elevators are big enough to accommodate it. For information on the dimensions and weight of your Surface Hub in its shipping container, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md). - -### Unpacking Surface Hub - -For unpacking information, refer to the unpacking guide included in the shipping container. You can open the unpacking instructions before you open the shipping container. These instructions can also be found here: http://www.microsoft.com/surface/support/surface-hub - ->[!IMPORTANT] ->Retain and store all Surface Hub shipping materials—including the pallet, container, and screws—in case you need to ship Surface Hub to a new location or send it -for repairs. For the 84” Surface Hub, retain the lifting handles. - -### Lifting Surface Hub - -The 55” Surface Hub requires two people to safely lift and mount. The 84” Surface Hub requires four people to safely lift and mount. Those assisting must be able to lift 70 pounds to waist height. Review the unpacking and mounting guide for details on lifting Surface Hub. You can find it at http://www.microsoft.com/surface/support/surface-hub. - -## Mounting and setup - -See your mounting guide at http://www.microsoft.com/surface/support/surface-hub for detailed instructions. - -There are three ways to mount your Surface Hub: - -- **Wall mount**: Lets you permanently hang Surface Hub on a conference space wall. -- **Floor support mount**: Supports Surface Hub on the floor while it is permanently anchored to a conference space wall. -- **Rolling stand**: Supports Surface Hub and lets you move it to other conference locations. For links to guides that provide details about each mounting method, including building requirements, see http://www.microsoft.com/surface/support/surface-hub. - -For specifications on available mounts for the original Surface Hub, see the following: - -- [Surface Hub Mounts and Stands Datasheet](http://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf) -- [Surface Hub Stand and Wall Mount Specifications](http://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf) - -## The Connect experience - -Connect lets people project their laptop, tablet, or phone to the Surface Hub screen. Connect allows wireless or wired connection types. - -#### Wireless connect - -Since wireless connect is based on Miracast, you don’t need cables or additional setup planning to use it. Your users can load Miracast on most Miracast-enabled Windows 8.1 and Windows 10 devices. Then they can project their display from their computer or phone to the Surface Hub screen. - - -#### Wired connect - -With wired connect, a cable transmits information from computers, tablets, or phones to Surface Hub. There are three video cable options, and they all use the same USB 2.0 cable. The cable bundle can include one or all of these connection options. - -- DisplayPort (DisplayPort cable + USB 2.0 cable) -- HDMI (HDMI cable + USB 2.0 cable) -- VGA (VGA cable + 3.5mm audio cable + USB 2.0 cable) - -For example, to provide audio, video, and touchback capability to all three video options, your Wired Connect cable bundle must include: - -- A DisplayPort cable -- An HDMI cable -- A VGA cable -- A USB 2.0 cable -- A 3.5mm cable - -When you create your wired connect cable bundles, check the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections for specific technical and physical details and port locations for each type of Surface Hub. Make the cables long enough to reach from Surface Hub to where the presenter will sit or stand. - -For details on Touchback and Inkback, see the user guide at http://www.microsoft.com/surface/support/surface-hub. - - - -## See also - -[Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov) - - - diff --git a/devices/surface-hub/surface-hub-ssd-replacement.md b/devices/surface-hub/surface-hub-ssd-replacement.md deleted file mode 100644 index 363f1e6e81..0000000000 --- a/devices/surface-hub/surface-hub-ssd-replacement.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Surface Hub SSD replacement -ms.reviewer: -manager: dansimp -description: Learn how to replace the solid state drive in a Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub SSD replacement - -You might need to remove the solid state drive (SSD) from your Surface Hub so that you can reimage it using the [Surface Hub Recovery Tool](surface-hub-recovery-tool.md) or because you've been sent a replacement drive. You would reimage your SSD when the operating system is no longer bootable, such as from a Windows update failure, BitLocker issues, reset failure, or hardware failure. - - ->[!WARNING] ->Make sure the Surface Hub is turned off at the AC switch. - -1. Locate the SSD compartment door on the rear, upper portion of the Surface Hub in the locations illustrated below. The door is identifiable as it doesn't have open ventilation slots. - - ![SSD compartment door](images/ssd-location.png) - - *Surface Hub hard drive locations* - -2. Locate the locking tab on the hard drive compartment door. On the Surface Hub 55, the locking tab will be located on the left-hand side of the door. On the Surface Hub 84, it will be on the right-hand side as shown in the illustration. - - ![SSD compartment locking tab](images/ssd-lock-tab.png) - - *Locking tab on hard drive compartment door* - -3. Lift open the compartment door to access the hard drive. - - ![Lift](images/ssd-lift-door.png) - - *Lift compartment door* - -4. Locate the pull tab, which may be partially hidden under the rear cover. Pull on the tab to eject the hard drive from the compartment. - - ![Pull](images/ssd-pull-tab.png) - - *Pull tab* - -5. Slide the replacement drive into place until you hear it click. - - ![Slide in drive](images/ssd-click.png) - - *Slide replacement drive into place* - -6. Close the compartment door. - -7. Apply power to the Surface Hub. diff --git a/devices/surface-hub/surface-hub-start-menu.md b/devices/surface-hub/surface-hub-start-menu.md deleted file mode 100644 index 9ddfa628e6..0000000000 --- a/devices/surface-hub/surface-hub-start-menu.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: Configure Surface Hub Start menu -description: Use MDM to customize the Start menu on Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 01/17/2018 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Configure Surface Hub Start menu - -The [January 17, 2018 update to Windows 10](https://support.microsoft.com/help/4057144) (build 15063.877) enables customized Start menus on Surface Hub devices. You apply the customized Start menu layout using mobile device management (MDM). - -When you apply a customized Start menu layout to Surface Hub, users cannot pin, unpin, or uninstall apps from Start. - -## How to apply a customized Start menu to Surface Hub - -The customized Start menu is defined in a Start layout XML file. You have two options for creating your Start layout XML file: - -- Edit the [default Surface Hub Start XML](#default) - - -or- - -- Configure the desired Start menu on a desktop (pinning only apps that are available on Surface Hub), and then [export the layout](https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout#export-the-start-layout). - ->[!TIP] ->To add a tile with a web link to your desktop start menu, go to the link in Microsoft Edge, select `...` in the top right corner, and select **Pin this page to Start**. See [a Start layout that includes a Microsoft Edge link](#edge) for an example of how links will appear in the XML. - -To edit the default XML or the exported layout, familiarize yourself with the [Start layout XML](https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop). There are a few [differences between Start layout on a deskop and a Surface Hub.](#differences) - -When you have your Start menu defined in a Start layout XML, [create an MDM policy to apply the layout.](https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management#a-href-idbkmk-domaingpodeploymentacreate-a-policy-for-your-customized-start-layout) - - -## Differences between Surface Hub and desktop Start menu - -There are a few key differences between Start menu customization for Surface Hub and a Windows 10 desktop: - -- You cannot use **DesktopApplicationTile** (https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop#startdesktopapplicationtile) in your Start layout XML because Windows desktop applications (Win32) are not supported on Surface Hub. -- You cannot use the Start layout XML to configure the taskbar or the Welcome screen for Surface Hub. -- Surface Hub supports a maximum of 6 columns (6 1x1 tiles), however, you **must** define `GroupCellWidth=8` even though Surface Hub will only display tiles in columns 0-5, not columns 6 and 7. -- Surface Hub supports a maximum 6 rows (6 1x1 tiles) -- `SecondaryTile`, which is used for links, will open the link in Microsoft Edge. - - - -## Example: Default Surface Hub Start layout - -```xml - - - - - - - - - - - - - - - - - - - -``` - - -## Example: Start layout that includes a Microsoft Edge link - -This example shows a link to a website and a link to a .pdf file. - -```xml - - - - - - - - - - - - - - - - - - - -``` - ->[!NOTE] ->Microsoft Edge tile logos won't appear on secondary tiles because they aren't stored in Surface Hub. -> ->The default value for `ForegroundText` is light; you don't need to include `ForegroundText` in your XML unless you're changing the value to dark. - -## More information - -- [Blog post: Changing Surface Hub’s Start Menu](https://blogs.technet.microsoft.com/y0av/2018/02/13/47/) diff --git a/devices/surface-hub/surface-hub-technical-55.md b/devices/surface-hub/surface-hub-technical-55.md deleted file mode 100644 index 353347476f..0000000000 --- a/devices/surface-hub/surface-hub-technical-55.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Technical information for 55" Surface Hub -ms.reviewer: -manager: dansimp -description: Specifications for the 55" Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.localizationpriority: medium ---- - -# Technical information for 55" Surface Hub - -## Measurements - -| ---- | --- -Pricing | Starting at $8,999 -Size | 31.75” x 59.62” x 3.38” (806.4mm x 1514.3mm x 85.8mm) -Storage/RAM | SSD 128GB with 8GB RAM -Processor | 4th Generation Intel® Core™ i5 -Graphics | Intel® HD 4600 -Ports | **Internal PC**
          • (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
          • (2) USB 2.0
          • Ethernet 1000 Base-T
          • DisplayPort
          • Video Output
          • 3.5mm Stereo Out
          • RJ11 Connector for system-level control
          **Alternate PC**
          • (2) USB 2.0 type B output
          • Connection for Camera, Sensors, Microphone, Speakers
          • (1) DisplayPort Video Input
          **Guest PC**
          • DisplayPort Video Input
          • HDMI Video Input
          • VGA Video Input
          • 3.5mm Stereo Input
          • (1) USB 2.0 type B Touchback™ Output -Sensors | (2) Passive Infrared Presence Sensors, Ambient Light Sensors -Speakers | (2) Front-facing stereo speakers -Microphone | High-Performance, 4-Element Array -Camera | (2) Wide angle HD cameras 1080p @ 30fps -Pen | (2) Powered, active, subpixel accuracy -Physical side buttons | Power, Input Select, Volume, Brightness -Software | Windows 10 + Office (Word, PowerPoint, Excel) -What’s in the box | • Surface Hub 55”
          • (2) Surface Hub Pens
          • Power Cable
          • Setup Guide
          • Start Guide
          • Safety and Warranty documents
          • Wireless All-in-One Keyboard -Mounting features | 4X VESA standard, 400mm x 400mm plus 1150mm x 400mm pattern, 8X M6 X 1.0 threaded mounting locations -Display height from floor | Recommended height of 55 inches (139.7 cm) to center of screen -Product weight | Approx. 105 lb. (47.6 kg) without accessories -Product shipping weight | Approx. 150 lb. (68 kg) -Product dimensions HxWxD | 31.63 x 59.62 x 3.2 inches (80.34 x 151.44 x 8.14 cm) -Product shipping dimensions HxWxD | 43 x 65 x 20 inches (109 x 165 x 51 cm) -Product thickness | Touch surface to mounting surface: ≤ 2.4 inches (6 cm) -Orientation | Landscape only. Display cannot be used in a portrait orientation. -BTU | 1706 BTU/h -Image resolution | 1920 x 1080 -Frame rate | 120Hz -EDID preferred timing, replacement PC | 1920 x 1080, 120Hz vertical refresh -EDID preferred timing, wired connect | 1920 x 1080, 60Hz vertical refresh -Input voltage | (50/60Hz) 110/230v nominal, 90-265v max -Input power, operating | 500W max -Input power, standby | 5W nominal - - -## Replacement PC connections - -Connector and location | Label | Description ---- | --- | --- -Switch, bottom I/O | ![](images/switch.png) | Switches the function between using internal PC or external PC. -Display port, bottom I/O | ![](images/dport.png) | Provides input for replacement PC. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for replacement PC to internal peripherals. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for integrated hub. - - -## Wired connect connections - -Connector and location | Label | Description ---- | --- | --- -Display port, bottom I/O | ![](images/dportio.png) | Provides input for wired connect PC. -HDMI, bottom I/O | ![](images/hdmi.png) | Provides HDMI input for wired connect PC. -VGA, bottom I/O | ![](images/vga.png) | Provides VGA input for wired connect PC. -3.5mm, bottom I/O | ![](images/35mm.png) | Provides analog audio input. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for video ingest touchback. - -## Additional connections - -Connector and location | Label | Description ---- | --- | --- -USB type A, side I/O | ![](images/usb.png) | Provides 1 USB 3.0 connection for USB devices. Wake-on USB capable. -USB type A, bottom I/O with blue insulator | ![](images/usb.png) | Provides USB 3.0 connection. -3.5mm, bottom I/O | ![](images/analog.png) | Provides analog audio out. -Display port, bottom I/O | ![](images/dportout.png) | Provides mirrored video out function to another display. -IEC/EN60320-C13 receptacle with hard switch | ![](images/iec.png) | Provides AC input and compliance with EU power requirements. -RJ45, bottom I/O | ![](images/rj45.png) | Connects to Ethernet. -RJ11, bottom I/O | ![](images/rj11.png) | Connects to room control systems. - - - - - - - -## Diagrams of ports and clearances - -***Top view of 55" Surface Hub*** - -![](images/sh-55-top.png) - ---- - - -***Front view of 55" Surface Hub*** - -![](images/sh-55-front.png) - - ---- - -***Bottom view of 55" Surface Hub*** - -![](images/sh-55-bottom.png) - - ---- - -***Replacement PC ports on 55" Surface Hub*** - -![](images/sh-55-rpc-ports.png) - - ---- - -***Keypad on right side of 55" Surface Hub*** - -![](images/key-55.png) - - ---- - -***Rear view of 55" Surface Hub*** - -![](images/sh-55-rear.png) - - ---- - -***Clearances for 55" Surface Hub*** - -![](images/sh-55-clearance.png) - ---- - - -***Front and bottom handholds and clearances for 55" Surface Hub*** - -![](images/sh-55-hand.png) - - ---- - - -***Rear handholds and clearances for 55" Surface Hub*** - -![](images/sh-55-hand-rear.png) - - diff --git a/devices/surface-hub/surface-hub-technical-84.md b/devices/surface-hub/surface-hub-technical-84.md deleted file mode 100644 index fb52cf8797..0000000000 --- a/devices/surface-hub/surface-hub-technical-84.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Technical information for 84" Surface Hub -ms.reviewer: -manager: dansimp -description: Specifications for the 84" Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.localizationpriority: medium ---- - -# Technical information for 84" Surface Hub - -## Measurements - -| ---- | --- -Pricing | Starting at $21,999 -Size | 46.12” x 86.7” x 4.15” (1171.5mm x 2202.9mm x 105.4mm) -Storage/RAM | SSD 128GB with 8GB RAM -Processor | 4th Generation Intel® Core™ i7 -Graphics | NVIDIA Quadro K2200 -Ports | **Internal PC**
          • (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
          • (4) USB 2.0
          • Ethernet 1000 Base-T
          • DisplayPort Video Output
          • 3.5mm Stereo Out
          • RJ11 Connector for system-level control
          **Alternate PC**
          • (2) USB 2.0 type B output
          • connection for Camera, Sensors, Microphone, Speakers
          • (2) DisplayPort Video Input
          **Guest PC**
          • DisplayPort Video Input
          • HDMI Video Input
          • VGA Video Input
          • 3.5mm Stereo Input
          • (1) USB 2.0 type B Touchback™ Output -Sensors | (2) Passive Infrared Presence Sensors, Ambient Light Sensors -Speakers | (2) Front-facing stereo speakers -Microphone | High-Performance, 4-Element Array -Camera | (2) Wide angle HD cameras 1080p @ 30fps -Pen | (2) Powered, active, subpixel accuracy -Physical side buttons | Power, Input Select, Volume, Brightness -Software | Windows 10 + Office (Word, PowerPoint, Excel) -What’s in the box | • Surface Hub 84”
          • (2) Surface Hub Pens
          • Power Cable
          • Setup Guide
          • Safety and Warranty documents
          • Wireless All-in-One Keyboard -Mounting features | 4X VESA standard, 1200mm x 600mm pattern, 8X M8 X 1.25 threaded mounting locations -Display height from floor | Recommended height of 54 inches (139.7 cm) to center of screen -Product weight | Approx. 280 lb. (127 kg.) -Product shipping weight | Approx. 580 lb. (263 kg.) -Product dimensions HxWxD | 46 x 86.9 x 4.1 inches (116.8 x 220.6 x 10.4 cm) -Product shipping dimensions HxWxD | 66.14 x 88.19 x 24.4 inches (168 x 224 x 62 cm) -Product thickness | Touch surface to mounting surface: ≤ 3.1 inches (7.8 cm) -Orientation | Landscape only. Display cannot be used in a portrait orientation. -BTU | 3070.8 BTU/h -Image resolution | 3840 x 2160 -Frame rate | 120Hz -Contrast Ratio | 1400:1 -EDID preferred timing, replacement PC | 3840 x 2140, 120Hz vertical refresh -EDID preferred timing, wired connect | 1920 x 1080, 60Hz vertical refresh -Input voltage | 110/230v nominal, 90-265v max -Input power, operating | 900W max -Input power, standby | 5W nominal, 1-10W max - - -## Replacement PC connections - -Connector and location | Label | Description ---- | --- | --- -Switch, bottom I/O | ![](images/switch.png) | Switches the function between using internal PC or external PC. -Display port, bottom I/O | ![](images/dport.png) | Provides input for replacement PC. -Display port, bottom I/O | ![](images/dport.png) | Provides second input for replacement PC. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for replacement PC to internal peripherals. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for integrated hub. - - -## Wired connect connections - -Connector and location | Label | Description ---- | --- | --- -Display port, bottom I/O | ![](images/dportio.png) | Provides input for wired connect PC. -HDMI, bottom I/O | ![](images/hdmi.png) | Provides HDMI input for wired connect PC. -VGA, bottom I/O | ![](images/vga.png) | Provides VGA input for wired connect PC. -3.5mm, bottom I/O | ![](images/35mm.png) | Provides analog audio input. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for video ingest touchback. - -## Additional connections - -Connector and location | Label | Description ---- | --- | --- -USB type A, side I/O | ![](images/usb.png) | Provides 1 USB 3.0 connection for USB devices. Wake-on USB capable. -USB type A, bottom I/O with blue insulator | ![](images/usb.png) | Provides USB 3.0 connection. -3.5mm, bottom I/O | ![](images/analog.png) | Provides analog audio out. -Display port, bottom I/O | ![](images/dportout.png) | Provides mirrored video out function to another display. -IEC/EN60320-C13 receptacle with hard switch | ![](images/iec.png) | Provides AC input and compliance with EU power requirements. -RJ45, bottom I/O | ![](images/rj45.png) | Connects to Ethernet. -RJ11, bottom I/O | ![](images/rj11.png) | Connects to room control systems. - - - - - - - -## Diagrams of ports and clearances - -***Top view of 84" Surface Hub*** - -![](images/sh-84-top.png) - ---- - - -***Front view of 84" Surface Hub*** - -![](images/sh-84-front.png) - - ---- - -***Bottom view of 84" Surface Hub*** - -![](images/sh-84-bottom.png) - - ---- - -***Replacement PC ports on 84" Surface Hub*** - -![](images/sh-84-rpc-ports.png) - - - ---- - -***Rear view of 84" Surface Hub*** - -![](images/sh-84-rear.png) - - ---- - -***Clearances for 84" Surface Hub*** - -![](images/sh-84-clearance.png) - ---- - - -***Removable lifting handles on 84” Surface Hub *** - -![](images/sh-84-hand.png) - - ---- - - -***Wall mount threads on back of 84” Surface Hub *** - -![](images/sh-84-wall.png) - ---- -***Lifting handles in top view of 84” Surface Hub*** - -![](images/sh-84-hand-top.png) - ---- -***Side view of 84” Surface Hub*** - -![](images/sh-84-side.png) - - diff --git a/devices/surface-hub/surface-hub-update-history.md b/devices/surface-hub/surface-hub-update-history.md deleted file mode 100644 index 568e515039..0000000000 --- a/devices/surface-hub/surface-hub-update-history.md +++ /dev/null @@ -1,499 +0,0 @@ ---- -title: Surface Hub update history -description: Surface Hub update history -ms.assetid: d66a9392-2b14-4cb2-95c3-92db0ae2de34 -ms.reviewer: -manager: -keywords: -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub update history - -Windows 10 was designed to be a service, which means it automatically gets better through periodic software updates. The great news is that you usually don’t have to do anything to get the latest Windows 10 updates—they'll download and install whenever they’re available. - -Most Windows updates focus on performance and security improvements to keep you going 24/7. - -One thing we’re hearing from you is that you want to know more about what's in our Windows 10 updates, so we're providing more details on this page. In the list below, the most recent Windows update is listed first. Installing the most recent update ensures that you also get any previous updates you might have missed, including security updates. Microsoft Store apps are updated through the Microsoft Store (managed by the Surface Hub's system administrator). Details about app updates are provided on a per-app basis. -We'll be refreshing this page as new updates are released, so stay tuned for the latest info. And thank you for helping us learn and get better with each update! - -Please refer to the “[Surface Hub Important Information](https://support.microsoft.com/products/surface-devices/surface-hub)” page for related topics on current and past releases that may require your attention. - -## Windows 10 Team Creators Update 1703 - -

          -June 18, 2019—update for Team edition based on KB4503289* (OS Build 15063.1897) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Addresses an issue with log collection for Microsoft Surface Hub 2S. -* Addresses an issue preventing a user from signing in to a Microsoft Surface Hub device with an Azure Active Directory account. This issue occurs because a previous session did not end successfully. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4503289](https://support.microsoft.com/help/4503289) -
          - -
          -May 28, 2019—update for Team edition based on KB4499162* (OS Build 15063.1835) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Ensures that Surface Hub users aren't prompted to enter proxy credentials after the "Use device account credentials" feature has been enabled. -* Resolves an issue where Skype connections fail periodically because audio/video isn't using the correct proxy. -* Adds support for TLS 1.2 in Skype for Business. -* Resolves a SIP connection failure in the Skype client when the Skype server has TLS 1.0 or TLS 1.1 disabled. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4499162](https://support.microsoft.com/help/4499162) -
          - -
          -April 25, 2019—update for Team edition based on KB4493436* (OS Build 15063.1784) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves video and audio sync issue with some USB devices that are connected to the Surface Hub. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4493436](https://support.microsoft.com/help/4493436) -
          - -
          -November 27, 2018—update for Team edition based on KB4467699* (OS Build 15063.1478) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Addresses an issue that prevents some users from Signing-In to “My Meetings and Files.” - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KBKB4467699](https://support.microsoft.com/help/KB4467699) -
          - -
          -October 18, 2018 —update for Team edition based on KB4462939* (OS Build 15063.1418) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business fixes: - * Resolves Skype for Business connection issue when resuming from sleep - * Resolves Skype for Business network connection issue, when device is connected to Internet - * Resolves Skype for Business crash when searching for users from directory -* Resolves issue where the Hub mistakenly reports “No Internet connection” in enterprise proxy environments. -* Implemented a feature allowing customers to op-in to a new Whiteboard experience. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4462939](https://support.microsoft.com/help/4462939) -
          - -
          -August 31, 2018 —update for Team edition based on KB4343889* (OS Build 15063.1292) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Adds support for Microsoft Teams -* Resolves task management issue with Intune registration -* Enables Administrators to disable Instant Messaging and Email services for the Hub -* Additional bug fixes and reliability improvements for the Surface Hub Skype for Business App - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4343889](https://support.microsoft.com/help/4343889) -
          - -
          -June 21, 2018 —update for Team edition based on KB4284830* (OS Build 15063.1182) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Telemetry change in support of GDPR requirements in EMEA - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4284830](https://support.microsoft.com/help/KB4284830) -
          - -
          -April 17, 2018 —update for Team edition based on KB4093117* (OS Build 15063.1058) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves a wired projection issue -* Enables bulk update for certain MDM (Mobile Device Management) policies -* Resolves phone dialer issue with international calls -* Addresses image resolution issue when 2 Surface Hubs join the same meeting -* Resolves OMS (Operations Management Suite) certificate handling error -* Addresses a security issue when cleaning up at the end of a session -* Addresses Miracast issue, when Surface Hub is specified to channels 149 through 165 - * Channels 149 through 165 will continue to be unusable in Europe, Japan or Israel due to regional governmental regulations - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4093117](https://support.microsoft.com/help/4093117) -
          - -
          -February 23, 2018 —update for Team edition based on KB4077528* (OS Build 15063.907) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolved an issue where MDM settings were not being correctly applied -* Improved Cleanup process - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4077528](https://support.microsoft.com/help/4077528) -
          - -
          -January 16, 2018 —update for Team edition based on KB4057144* (OS Build 15063.877) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Adds ability to manage Start Menu tile layout via MDM -* MDM bug fix on password rotation configuration - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4057144](https://support.microsoft.com/help/4057144) -
          - -
          -December 12, 2017 —update for Team edition based on KB4053580* (OS Build 15063.786) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves camera video flashes (tearing or flickers) during Skype for Business calls -* Resolves Notification Center SSD ID issue - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4053580](https://support.microsoft.com/help/4053580) -
          - -
          -November 14, 2017 —update for Team edition based on KB4048954* (OS Build 15063.726) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Feature update that allows customers to enable 802.1x wired network authentication using MDM policy. -* A feature update that enables users to dynamically select an application of their choice when opening a file. -* Fix that ensures that End Session cleanup fully removes all connections between the user’s account and the device. -* Performance fix that improves cleanup time as well as Miracast connection time. -* Introduces Easy Authentication utilization during ad-hock meetings. -* Fix that ensures service components to use the same proxy that is configured across the device. -* Reduces and more thoroughly secures the telemetry transmitted by the device, reducing bandwidth utilization. -* Enables a feature allowing users to provide feedback to Microsoft after a meeting concludes. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4048954](https://support.microsoft.com/help/4048954) -
          - -
          -October 10, 2017 —update for Team edition based on KB4041676* (OS Build 15063.674) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business - * Resolves issue that required a device reboot when resuming from sleep. - * Fixes issue where external contacts did not resolve through Skype Online Hub account. -* PowerPoint - * Fixes problem where some PowerPoint presentations would not project on Hub. -* General - * Fix to resolve issue where USB port could not be disabled by System Administrator. - -*[KB4041676](https://support.microsoft.com/help/4041676) -
          - -
          -September 12, 2017 —update for Team edition based on KB4038788* (OS Build 15063.605) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Security - * Resolves issue with Bitlocker when device wakes from sleep. -* General - * Reduces frequency/amount of device health telemetry, improving system performance. - * Fixes issue that prevented device from collecting system logs. - -*[KB4038788](https://support.microsoft.com/help/4038788) -
          - -
          -August 1, 2017 — update for Team edition based on KB4032188* (OS Build 15063.498) - -* Skype for Business - * Resolves Skype for Business Sign-In issue, which required retry or system reboot. - * Resolves Skype for Business meeting time being incorrectly displayed. - * Fixes to improve Surface Hub Skype for Business reliability. - -*[KB4032188](https://support.microsoft.com/help/4032188) -
          - -
          -June 27, 2017 — update for Team edition based on KB4022716* (OS Build 15063.442) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Address NVIDIA driver crashes that may necessitate sleeping 84” Surface Hub to power down, requiring a manual restart. -* Resolved an issue where some apps fail to launch on an 84” Surface Hub. - -*[KB4022716](https://support.microsoft.com/help/4022716) -
          - -
          -June 13, 2017 — update for Team edition based on KB4022725* (OS Build 15063.413) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Resolved Pen ink dropping issues with pens - * Resolved issue causing extended time to “cleanup” meeting - -*[KB4022725](https://support.microsoft.com/help/4022725) -
          - -
          -May 24, 2017 — update for Team edition based on KB4021573* (OS Build 15063.328) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Resolved issue with proxy setting retention during update issue - -*[KB4021573](https://support.microsoft.com/help/4021573) -
          - -
          -May 9, 2017 — update for Team edition based on KB4016871* (OS Build 15063.296) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Addressed sleep/wake cycle issue - * Resolved several Reset and Recovery issues - * Addressed Update History tab issue - * Resolved Miracast service launch issue -* Apps - * Fixed App package update error - -*[KB4016871](https://support.microsoft.com/help/4016871) -
          - -
          -Windows 10 Team Creators Update 1703 for Surface Hub — General Release notes (OS Build 15063.0) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Evolving the large screen experience - * Improved the meeting carousel in Welcome and Start - * Join meetings and end the session directly from the Start menu - * Apps can utilize more of the screen during a session - * Simplified Skype controls - * Improved mechanisms for providing feedback -* Access My Personal Content* - * Personal single sign-on from Welcome or Start - * Join meetings and end the session directly from the Start menu - * Access personal files through OneDrive for Business directly from Start - * Pre-populated attendee sign-in - * Streamlined authentication flows with “Authenticator” app** -* Deployment & Manageability - * Simplified OOBE experience through bulk provisioning - * Cloud-based device recovery service - * Enterprise client certificate support - * Improved proxy credential support - * Added and /improved Skype Quality of Service (QoS) configuration support - * Added ability to set default device volume in Settings - * Improved MDM support for Surface Hub [settings](https://docs.microsoft.com/surface-hub/remote-surface-hub-management) -* Improved Security - * Added ability to restrict USB drives to BitLocker only - * Added ability to disable USB ports via MDM - * Added ability to disable “Resume session” functionality on timeout - * Addition of wired 802.1x support -* Audio and Projection - * Dolby Audio “Human Speaker” enhancements - * Reduced “pen tap” sounds when using Pen during Skype for Business calls - * Added support for Miracast infrastructure connections -* Reliability and Performance fixes - * Resolved several Reset and Recovery issues - * Resolved Surface Hub Exchange authentication issue when utilizing client certificates - * Improved Wi-Fi network connection and credentials stability - * Fixed Miracast audio popping and sync issues during video playback - * Included setting to disable auto connect behavior - -*Single sign-in feature requires use of Office365 and OneDrive for Business -**Refer to Admin Guide for service requirements - -
          - -## Windows 10 Team Anniversary Update 1607 - -
          -March 14th, 2017 — update for Team edition based on KB4013429* (OS Build 14393.953) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Security fix for File Explorer to prevent navigation to restricted file locations -* Skype for Business - * Fix to address latency during Remote Desktop based screen sharing - -*[KB4013429](https://support.microsoft.com/help/4013429) -
          - -
          -January 10th, 2017 — update for Team edition based on KB4000825* (OS Build 14393.693) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Enabled selection of 106/109 Keyboard Layouts for use with physical Japanese keyboards - -*[KB4000825](https://support.microsoft.com/help/4000825) -
          - -
          -December 13, 2016 — update for Team edition based on KB3206632* (OS Build 14393.576) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves wired connection audio distortion issue - -*[KB3206632](https://support.microsoft.com/help/3206632) -
          - -
          -November 4, 2016 — update for Windows 10 Team Anniversary edition based on KB3200970* (OS Build 14393.447) - -This update to the Windows 10 Team Anniversary Update (version 1607) for Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business bug fixes to improve reliability - -*[KB3200970](https://support.microsoft.com/help/3200970) -
          - -
          -October 25, 2016 — update for Team edition based on KB3197954* (OS Build 14393.351) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Enabling new Sleep feature in OS and Bios to reduce the Surface Hub’s power consumption and improve its long-term reliability -* General - * Resolves scenarios where the on-screen keyboard would sometimes not appear - * Resolves Whiteboard application shift that occasionally occurs when opening scheduled meeting - * Resolves issue that prevented Admins from changing the local administrator password, after device has been Reset - * BIOS change resolving issue with status bar tracking during device Reset - * UEFI update to resolve powering down issues - -*[KB3197954](https://support.microsoft.com/help/3197954) -
          - -
          -October 11, 2016 — update for Team edition based on KB3194496* (OS Build 14393.222) - -This update brings the Windows 10 Team Anniversary Update to Surface Hub and includes quality improvements and security fixes. (Your device will be running Windows 10 Version 1607 after it's installed.) Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business - * Performance improvements when joining meetings, including issues when joining a meeting using federated accounts - * Video Based Screen Sharing (VBSS) support now available on Skype for Business for Surface Hub - * Resolved disconnection after 5 minutes of idle time issue - * Resolved Skype Hub-to-Hub screen sharing failure - * Improvements to Skype video, including: - * Loss of video during meeting with multiple video presenters - * Video cropping during calls - * Outgoing call video not displaying for other participants - * Addressed issue with UPN sign in error - * Addressed issue with dial pad during use of Session Initiation Protocol (SIP) calls -* Whiteboard - * User can now save and recall Whiteboard sessions using OneDrive online service (via Share functionality) - * Improved launching Whiteboard when removing pen from dock -* Apps - * Pre-installed OneDrive app, for access to your personal and work files - * Pre-installed Photos app, to view photos and video - * Pre-installed PowerBI app, to view dashboards - * The Office apps – Word, Excel, PowerPoint – are all ink-enabled - * Edge on Surface Hub now supports Flash-based websites -* General - * Enabled Audio Device Selection (for Surface Hubs attached using external audio devices) - * Enabled support for HDCP on DisplayPort output connector - * System UI changes to settings for usability optimization (refer to [User and Admin Guides](http://www.microsoft.com/surface/support/surface-hub) for additional details) - * Bug fixes and performance optimizations to speed up the Azure Active Directory sign-in flow - * Significantly improved time needed to reset and restore Surface Hub - * Windows Defender UI has been added within settings - * Improved UX touch to start - * Enabled support for greater than 1080p wireless projection via Miracast, on supported devices - * Resolved “There’s no internet connection” and “Appointments may be out of date” false notification states from launch - * Improved reliability of on-screen keyboard - * Additional support for creating Surface Hub provisioning packages using Windows Imaging & Configuration Designer (ICD) and improved Surface Hub monitoring solution on Operations Management Suite (OMS) - -*[KB3194496](https://support.microsoft.com/help/3194496) -
          - -## Updates for Windows 10 Version 1511 - -
          -November 4, 2016 — update for Windows 10 Team (version 1511) on KB3198586* (OS Build 10586.679) - -This update to the Windows 10 Team edition (version 1511) to Surface Hub includes quality improvements and security fixes that are outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history). There are no Surface Hub specific items in this update. - -*[KB3198586](https://support.microsoft.com/help/3198586) -
          - -
          -July 12, 2016 — KB3172985* (OS Build 10586.494) - -This update includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key changes specific to the Surface Hub (those not already included in the [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history)), include: - -* Fixed issue that caused Windows system crashes -* Fixed issue that caused repeated Edge crashes -* Fixed issue causing pre-shutdown service crashes -* Fixed issue where some app data wasn’t properly removed after a session -* Updated Broadcom NFC driver to improve NFC performance -* Updated Marvell Wi-Fi driver to improve Miracast performance -* Updated Nvidia driver to fix a display bug in which 84" Surface Hub devices show dim or fuzzy content -* Numerous Skype for Business issues fixed, including: - * Issue that caused Skype for Business to disconnect during meetings - * Issue in which users were unable to join meetings when the meeting organizer was on a federated configuration - * Enabling Skype for Business application sharing - * Issue that caused Skype application crashes -* Added a prompt in “Settings” to inform users that the OS can become corrupted if device reset is interrupted before completion - -*[KB3172985](https://support.microsoft.com/help/3172985) -
          - -
          -June 14, 2016 — KB3163018* (OS Build 10586.420) - -This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Constrained release. Refer to July 12, 2016 — [KB3172985](https://support.microsoft.com/en-us/help/3172985) (OS Build 10586.494) for Surface Hub specific package details - -*[KB3163018](https://support.microsoft.com/help/3163018) -
          - -
          -May 10, 2016 — KB3156421* (OS Build 10586.318) - -This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Fixed issue that prevented certain Store apps (OneDrive) from installing -* Fixed issue that caused touch input to stop responding in applications - -*[KB3156421](https://support.microsoft.com/help/3156421) -
          - -
          -April 12, 2016 — KB3147458* (OS Build 10586.218) - -This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Fixed issue where volume level wasn’t properly reset between sessions - -*[KB3147458](https://support.microsoft.com/help/3147458) -
          - -## Related topics - -* [Windows 10 feature road map](http://go.microsoft.com/fwlink/p/?LinkId=785967) -* [Windows 10 release information](http://go.microsoft.com/fwlink/p/?LinkId=724328) -* [Windows 10 November update: FAQ](http://windows.microsoft.com/windows-10/windows-update-faq) -* [Microsoft Surface update history](http://go.microsoft.com/fwlink/p/?LinkId=724327) -* [Microsoft Lumia update history](http://go.microsoft.com/fwlink/p/?LinkId=785968) -* [Get Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=616447) diff --git a/devices/surface-hub/surface-hub-wifi-direct.md b/devices/surface-hub/surface-hub-wifi-direct.md deleted file mode 100644 index 5d8fad351d..0000000000 --- a/devices/surface-hub/surface-hub-wifi-direct.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -title: How Surface Hub addresses Wi-Fi Direct security issues -description: This topic provides guidance on Wi-Fi Direct security risks. -keywords: change history -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 06/20/2019 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# How Surface Hub addresses Wi-Fi Direct security issues - -Microsoft Surface Hub is an all-in-one productivity device that enables teams to better brainstorm, collaborate, and share ideas. Surface Hub relies on Miracast for wireless projection by using Wi-Fi Direct. - -This topic provides guidance on Wi-Fi Direct security vulnerabilities, how Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security. This hardening information will help customers with high security requirements understand how best to protect their Surface Hub connected networks and data in transit. - -The intended audiences for this topic include IT and network administrators interested in deploying Microsoft Surface Hub in their corporate environment with optimal security settings. - -## Overview - -Microsoft Surface Hub's security depends extensively on Wi-Fi Direct / Miracast and the associated 802.11, Wi-Fi Protected Access (WPA2), and Wireless Protected Setup (WPS) standards. Since the device only supports WPS (as opposed to WPA2 Pre-Shared Key (PSK) or WPA2 Enterprise), issues traditionally associated with 802.11 encryption are simplified by design. - -It is important to note Surface Hub operates on par with the field of Miracast receivers, meaning that it is protected from, and vulnerable to, a similar set of exploits as all WPS-based wireless network devices. But Surface Hub’s implementation of WPS has extra precautions built in, and its internal architecture helps prevent an attacker – even after compromising the Wi-Fi Direct / Miracast layer – to move past the network interface onto other attack surfaces and connected enterprise networks see [Wi-Fi Direct vulnerabilities and how Surface Hub addresses them](#vulnerabilities). - -## Wi-Fi Direct background - -Miracast is part of the Wi-Fi Display standard, which itself is supported by the Wi-Fi Direct protocol. These standards are supported in modern mobile devices for screen sharing and collaboration. - -Wi-Fi Direct or Wi-Fi "Peer to Peer" (P2P) is a standard released by the Wi-Fi Alliance for "Ad-Hoc" networks. This allows supported devices to communicate directly and create groups of networks without requiring a traditional Wi-Fi Access Point or an Internet connection. - -Security for Wi-Fi Direct is provided by WPA2 using the WPS standard. Authentication mechanism for devices can be a numerical pin (WPS-PIN), a physical or virtual Push Button (WPS-PBC), or an out-of-band message such as Near Field Communication (WPS-OOO). The Microsoft Surface Hub supports both Push Button (which is the default) and PIN methods. - -In Wi-Fi Direct, groups are created as either "persistent," allowing for automatic reconnection using stored key material, or "temporary," where devices cannot re-authenticate without user intervention or action. Wi-Fi Direct groups will typically determine a Group Owner (GO) through a negotiation protocol, which mimics the "station" or "Access Point" functionality for the established Wi-Fi Direct Group. This Wi-Fi Direct GO provides authentication (via an “Internal Registrar”), and facilitate upstream network connections. For Surface Hub, this GO negotiation does not take place, as the network only operates in "autonomous" mode, where Surface Hub is always the Group Owner. Finally, Surface Hub does not and will not join other Wi-Fi Direct networks itself as a client. - - -## Wi-Fi Direct vulnerabilities and how Surface Hub addresses them - -**Vulnerabilities and attacks in the Wi-Fi Direct invitation, broadcast, and discovery process**: Wi-Fi Direct / Miracast attacks may target weaknesses in the group establishment, peer discovery, device broadcast, or invitation processes. - -|Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| The discovery process may remain active for an extended period of time, which could allow Invitations and connections to be established without the intent of the device owner. | Surface Hub only operates as the Group Owner (GO), which does not perform the client Discovery or GO negotiation process. Broadcast can be turned off by fully disabling wireless projection. | -| Invitation and discovery using PBC allows an unauthenticated attacker to perform repeated connection attempts or unauthenticated connections are automatically accepted. | By requiring WPS PIN security, Administrators can reduce the potential for such unauthorized connections or "Invitation bombs" (where invitations are repeatedly sent until a user mistakenly accepts one). | - -**Wi-Fi Protected Setup (WPS) Push Button Connect (PBC) vs PIN Entry**: Public weaknesses have been demonstrated in WPS-PIN method design and implementation, other vulnerabilities exist within WPS-PBC involving active attacks against a protocol designed for one time use. - -| Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| WPS-PBC is vulnerable to active attackers. As stated within the WPS specification: "The PBC method has zero bits of entropy and only protects against passive eavesdropping attacks. PBC protects against eavesdropping attacks and takes measures to prevent a device from joining a network that was not selected by the device owner. The absence of authentication, however, means that PBC does not protect against active attack". Attackers can use selective wireless jamming or other potential denial-of-service vulnerabilities in order to trigger an unintended Wi-Fi Direct GO or connection. Additionally, an active attacker, with only physical proximity, can repeatedly teardown any Wi-Fi Direct group and attempt the described attack until it is successful. |Enable WPS-PIN security within Surface Hub’s configuration. As discussed within the Wi-Fi WPS specification: "The PBC method should only be used if no PIN-capable Registrar is available and the WLAN user is willing to accept the risks associated with PBC". | -| WPS-PIN implementations can be brute-forced using a Vulnerability within the WPS standard. Due to the design of split PIN verification, a number of implementation vulnerabilities occurred in the past several years across a wide range of Wi-Fi hardware manufacturers. In 2011 two researchers (Stefan Viehböck and Craig Heffner) released information on this vulnerability and tools such as "Reaver" as a proof of concept. | The Microsoft implementation of WPS within Surface Hub changes the pin every 30 seconds. In order to crack the pin, an attacker must work through the entire exploit in less than 30 seconds. Given the current state of tools and research in this area, a brute-force pin-cracking attack through WPS is unlikely. | -| WPS-PIN can be cracked using an offline attack due to weak initial key (E-S1,E S2) entropy. In 2014, Dominique Bongard discussed a "Pixie Dust" attack where poor initial randomness for the pseudo random number generator (PRNG) within the wireless device lead to the ability to perform an offline brute-force attack. | The Microsoft implementation of WPS within Surface Hub is not susceptible to this offline PIN brute-force attack. The WPS-PIN is randomized for each connection. | - -**Unintended exposure of network services**: Network daemons intended for Ethernet or WLAN services may be accidentally exposed due to misconfiguration (such as binding to “all”/0.0.0.0 interfaces), a poorly configured device firewall, or missing firewall rules altogether. - -| Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| Misconfiguration binds a vulnerable or unauthenticated network service to "all" interfaces, which includes the Wi-Fi Direct interface. This potentially exposes services not intended to be accessible to Wi-Fi Direct clients, which may be weakly or automatically authenticated. | Within Surface Hub, the default firewall rules only permit the required TCP and UDP network ports and by default deny all inbound connections. Strong authentication can be configured by enabling the WPS-PIN mode. | - -**Bridging Wi-Fi Direct and other wired or wireless networks**: While network bridging between WLAN or Ethernet networks is a violation of the Wi-Fi Direct specification, such a bridge or misconfiguration may effectively lower or remove wireless access controls for the internal corporate network. - -| Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| Wi-Fi Direct devices could allow unauthenticated or poorly authenticated access to bridged network connections. This may allow Wi-Fi Direct networks to route traffic to internal Ethernet LAN or other infrastructure or enterprise WLAN networks in violation of existing IT security protocols. | Surface Hub cannot be configured to bridge Wireless interfaces or allow routing between disparate networks. The default firewall rules add defense in depth to any such routing or bridge connections. | - -**The use of Wi-Fi Direct “legacy” mode**: Exposure to unintended networks or devices when operating in “legacy” mode may present a risk. Device spoofing or unintended connections could occur if WPS-PIN is not enabled. - - -| Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| By supporting both Wi-Fi Direct and 802.11 infrastructure clients, the system is operating in a "legacy" support mode. This may expose the connection setup phase indefinitely, allowing for groups to be joined or devices invited to connect well after their intended setup phase terminates. | Surface Hub does not support Wi-Fi Direct legacy clients. Only Wi-Fi Direct connections can be made to Surface Hub even when WPS-PIN mode is enabled. | - -**Wi-Fi Direct GO negotiation during connection setup**: The Group Owner within Wi-Fi Direct is analogous to the “Access Point” in a traditional 802.11 wireless network. The negotiation can be gamed by a malicious device. - -|Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| If groups are dynamically established or if the Wi-Fi Direct device can be made to join new groups, the Group Owner (GO) negotiation can be won by a malicious device that always specifies the max Group Owner "intent" value of 15. (Unless such device is configured to always be a Group Owner, in which case the connection fails.) | Surface Hub takes advantage of Wi-Fi Direct "Autonomous mode", which skips the GO negotiation phase of the connection setup. Surface Hub is always the Group Owner. | - -**Unintended or malicious Wi-Fi deauthentication**: Wi-Fi deauthentication is an age-old attack that can be used by a physically local attacker to expedite information leaks against the connection setup process, trigger new four-way handshakes, target Wi-Fi Direct WPS-PBC for active attack, or create denial-of-service attacks. - -| Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| Deauthentication packets can be sent by an unauthenticated attacker to cause the station to re-authenticate and sniff the resulting handshake. Cryptographic or brute-force attacks can be attempted on the resulting handshake. Mitigations for these attack include: enforcing length and complexity policies for pre-shared keys; configuring the Access Point (if applicable) to detect malicious levels of deauthentication packets; and using WPS to automatically generate strong keys. In PBC mode the user is interacting with a physical or virtual button to allow arbitrary device association. This process should happen only at setup within a small window, once the button is automatically "pushed", the device will accept any station associating via a canonical PIN value (all zeros). Deauthentication can force a repeated setup process. | The current Surface Hub design uses WPS in PIN or PBC mode. No PSK configuration is permitted, helping enforce the generation of strong keys. It is recommended to enable WPS-PIN. | -| Beyond denial-of-service attacks, deauthentication packets can also be used to trigger a reconnect which re-opens the window of opportunity for active attacks against WPS-PBC. | Enable WPS-PIN security within Surface Hub’s configuration. | - -**Basic wireless information disclosure**: Wireless networks, 802.11 or otherwise, are inherently sources of information disclosure. Although the information is largely connection or device metadata, it remains an accepted risk for any 802.11 administrator. Wi-Fi Direct with device authentication via WPS-PIN effectively reveals the same information as a PSK or Enterprise 802.11 network. - -| Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| During broadcast, connection setup, or even with already encrypted connections, basic information about the devices and packet sizes is wirelessly transmitted. At a basic level, a local attacker within wireless range can determine the names of wireless devices, the MAC addresses of communicating equipment, and possibly other details such as the version of the wireless stack, packet sizes, or the configured Access Point or Group Owner options by examining the relevant 802.11 Information Elements. | The Wi-Fi Direct network employed by Surface Hub cannot be further protected from metadata leaks, in the same way 802.11 Enterprise or PSK wireless networks also leak such metadata. Physical security and removing potential threats from the wireless proximity can be used to reduce any potential information leaks. | - -**Wireless evil twin or spoofing attacks**: Spoofing the wireless name is a trivial and known exploit for a physically local attacker in order to lure unsuspecting or mistaken users to connect. - -| Wi-Fi Direct Vulnerability | Surface Hub Mitigation | -| --- | --- | -| By spoofing or cloning the wireless name or "SSID" of the target network, an attacker may trick the user into connecting to fake malicious network. By supporting unauthenticated, auto-join Miracast an attacker could capture the intended display materials or attempt to perform network attacks on the connecting device. | While no specific protections against joining a spoofed Surface Hub are in place, this attack is partially mitigated in two ways. First, any potential attack must be physically within Wi-Fi range. Second, this attack is only possible during the very first connection. Subsequent connections use a persistent Wi-Fi Direct group and Windows will remember and prioritize this prior connection during future Hub use. (Note: Spoofing the MAC address, Wi-Fi channel and SSID simultaneously was not considered for this report and may result in inconsistent Wi-Fi behavior.) Overall this weakness is a fundamental problem for any 802.11 wireless network not using Enterprise WPA2 protocols such as EAP-TLS or EAP-PWD, which are not supported in Wi-Fi Direct. | - -## Surface Hub hardening guidelines - -Surface Hub is designed to facilitate collaboration and allow users to start or join meetings quickly and efficiently. As such, the default Wi-Fi Direct settings for Surface Hub are optimized for this scenario. - -For users who require additional security around the wireless interface, we recommend Surface Hub users enable the WPS-PIN security setting. This disables WPS-PBC mode and offers client authentication, and provides the strongest level of protection by preventing any unauthorized connections to Surface Hub. - -If concerns remain around authentication and authorization of a Surface Hub, we recommend users connect the device to a separate network, either Wi-Fi (such as a "guest" Wi-Fi network) or using separate Ethernet network (preferably an entirely different physical network, but a VLAN can also provide some added security). Of course, this approach may preclude connections to internal network resources or services, and may require additional network configurations to regain access. - -Also recommended: -- [Install regular system updates.](manage-windows-updates-for-surface-hub.md) -- Update the Miracast settings to disable auto-present mode. - -## Learn more - -- [Wi-Fi Direct specifications](http://www.wi-fi.org/discover-wi-fi/wi-fi-direct) -- [Wireless Protected Setup (WPS) specification](http://www.wi-fi.org/discover-wi-fi/wi-fi-protected-setup) - - - - - - - diff --git a/devices/surface-hub/surface-hub.yml b/devices/surface-hub/surface-hub.yml deleted file mode 100644 index dac70e8f37..0000000000 --- a/devices/surface-hub/surface-hub.yml +++ /dev/null @@ -1,62 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Surface Hub -metadata: - document_id: - title: Surface Hub - description: Find tools and resources to help you install, set up, and manage a Surface Hub in your organization. - keywords: Surface Hub, Windows 10 - ms.localizationpriority: medium - author: lizap - ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find tools and resources to help you install, set up, and manage a Surface Hub in your organization. - " -- title: Explore -- items: - - type: markdown - text: " - Discover how this all-in-one productivity device enables teams to better brainstorm, collaborate, and share ideas.
          -
          - -
          Explore the key features and product specifications of Surface Hub.
          Get real-world examples of how you can increase productivity and improve collaboration.
          Differences between Surface Hub and Windows 10 Enterprise
          Surface Hub FAQ'
          - " -- title: Plan -- items: - - type: markdown - text: " - Prepare to deploy Surface Hub in your organization. Explore site readiness, assembly, configuration, and Exchange and ActiveSync policies.
          - -

          **Get ready for Surface Hub**
          Explore the steps you'll need to take to set up Surface Hub.
          Surface Hub Site Readiness Guide (PDF, 1.48 MB)
          Unpacking guides

          **Assembly for Surface Hub**
          Learn how to assemble your Surface Hub.
          Surface Hub Setup Guide (PDF, 1.43 MB)
          Mounting and assembling guides

          **Prepare your environment**
          Learn about setup dependencies and account requirements.
          Prepare your environment
          Create and test a device account
          - " -- title: Deploy -- items: - - type: markdown - text: " - Get information for setup, app management and installation, and network management of your Surface Hub.
          - -

          **Set up your Surface Hub**
          Review info needed to prepare for using the out-of-box experience to set up your Surface Hub.
          Setup worksheet
          First-run program
          PowerShell scripts

          **Install apps**
          Options for installing and managing apps on your Surface Hub.
          Install apps
          Whiteboard to Whiteboard collaboration
          Create provisioning packages

          **Network your Surface Hub**
          Network scenarios for your Surface Hub.
          Wireless network management
          Using a room control system
          Connect other devices with Surface Hub.
          - " -- title: Manage -- items: - - type: markdown - text: " - Learn how to manage Surface Hub updates and maintain the security and integrity of corporate devices.
          - -

          **Manage the device**
          Monitoring for Surface Hub is performed through Microsoft Operations Management Suite (OMS).
          Monitor your Surface Hub
          Accessibility and Surface Hub

          **Manage account**
          Learn about options for managing accounts used with Surface Hub.
          Change the Surface Hub device account
          Admin account management

          **Stay secure and up to date**
          Learn how Surface Hub stays current.
          Manage Windows updates
          Surface Hub update history
          Save your BitLocker key

          **Training for your employees**
          Find resources to help employees be productive with Surface Hub.
          Surface Hub User Guide (PDF, 1.69 MB)
          How-to videos
          - " -- title: Stay informed -- items: - - type: markdown - text: " - -

          **Surface IT Pro Blog**
          Get insight into new Surface products plus tips and tricks for IT professionals.
          Learn more

          **Surface on Microsoft Mechanics**
          View technical demos and walkthroughs of Surface devices, features, and functionality.
          Get started

          **Follow us on Twitter**
          Keep up with the latest news and see the latest product demonstrations.
          Visit Twitter
          - " diff --git a/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md b/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md deleted file mode 100644 index 12678d2a9c..0000000000 --- a/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel -description: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel -ms.assetid: 8af3a832-0537-403b-823b-12eaa7a1af1f -ms.reviewer: -manager: -keywords: -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Summary - -In compliance with regional governmental regulations, all 5-GHz wireless devices in Europe, Japan, and Israel do not support the U-NII-3 band. In Surface Hub, the channels that are associated with U-NII-3 are 149 through 165. This includes Miracast connection on these channels. Therefore, Surface Hubs that are used in Europe, Japan, and Israel can't use channels 149 through 165 for Miracast connection. - -## More Information - -For more information see the [U-NII](https://en.wikipedia.org/wiki/U-NII) topic on Wikipedia. - -> [!NOTE] -> Microsoft provides third-party contact information to help you find additional information about this topic. This information may change without notice. Microsoft does not guarantee the accuracy of third-party information. \ No newline at end of file diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md deleted file mode 100644 index 1f9447ff87..0000000000 --- a/devices/surface-hub/surfacehub-whats-new-1703.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: What's new in Windows 10, version 1703 for Surface Hub -description: Windows 10, version 1703 (Creators Update) brings new features to Microsoft Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 01/18/2018 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# What's new in Windows 10, version 1703 for Microsoft Surface Hub? - -Watch Surface Hub engineer Jordan Marchese present updates to Microsoft Surface Hub with Windows 10, version 1703 (Creators Update). - - Link to Surface Hub video on Youtube - -Windows 10, version 1703 (also called the Creators Update), introduces the following changes for Microsoft Surface Hub. - -## New settings - -Settings have been added to mobile device management (MDM) and configuration service providers (CSPs) to expand the Surface Hub management capabilities. [New settings include](manage-settings-with-mdm-for-surface-hub.md): - -- InBoxApps/SkypeForBusiness/DomainName -- InBoxApps/Connect/AutoLaunch -- Properties/DefaultVolume -- Properties/ScreenTimeout -- Properties/SessionTimeout -- Properties/SleepTimeout -- Properties/AllowSessionResume -- Properties/AllowAutoProxyAuth -- Properties/DisableSigninSuggestions -- Properties/DoNotShowMyMeetingsAndFiles -- System/AllowStorageCard - -Plus settings based on the new [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) and [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp). -
          - -## Provisioning wizard - -An easy-to-use wizard helps you quickly create provisioning packages that you can apply to multiple Surface Hub devices, and includes bulk join to Azure Active Directory. [Learn how to create a provisioning package for Surface Hub.](provisioning-packages-for-certificates-surface-hub.md) - -![steps in the provision Surface Hub devices wizard](images/wcd-wizard.png) - -## Miracast on your existing wireless network or LAN - -Microsoft has extended the ability to [send a Miracast stream over a local network](miracast-over-infrastructure.md) rather than over a direct wireless link. - -## Cloud recovery - -When you reset a Surface Hub device, you now have the ability to download and install a factory build of the operating system from the cloud. [Learn more about cloud recovery.](device-reset-surface-hub.md#cloud-recovery) - ->[!NOTE] ->Cloud recovery doesn't work if you use proxy servers. - -![Reinstall](images/reinstall.png) - -## End session - -**I'm done** is now **End session**. [Learn how to use End session.](i-am-done-finishing-your-surface-hub-meeting.md) - -![end session](images/end-session.png) - - - - - - diff --git a/devices/surface-hub/troubleshoot-surface-hub.md b/devices/surface-hub/troubleshoot-surface-hub.md deleted file mode 100644 index c67203853d..0000000000 --- a/devices/surface-hub/troubleshoot-surface-hub.md +++ /dev/null @@ -1,616 +0,0 @@ ---- -title: Troubleshoot Microsoft Surface Hub -description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. -ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A -ms.reviewer: -manager: dansimp -keywords: Troubleshoot common problems, setup issues, Exchange ActiveSync errors -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 03/16/2018 -ms.localizationpriority: medium ---- - -# Troubleshoot Microsoft Surface Hub - - -Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. - -The [Surface Hub Hardware Diagnostic tool](https://www.microsoft.com/store/p/surface-hub-hardware-diagnostic/9nblggh51f2g?rtc=1&activetab=pivot%3aoverviewtab) contains interactive tests which allow you to confirm essential functionality of your Hub is working as expected. In addition to testing hardware, the diagnostic can test the resource account to verify that it is configured properly for your environment. If problems are encountered, results can be saved and shared with the Surface Hub Support Team. For usage information, see [Using the Surface Hub Hardware Diagnostic Tool to test a device account](https://support.microsoft.com/help/4077574/using-the-surface-hub-hardware-diagnostic-tool-to-test-a-device-accoun). - -Common issues are listed in the following table, along with causes and possible fixes. The [Setup troubleshooting](#setup-troubleshooting) section contains a listing of on-device problems, along with several types of issues that may be encountered during the first-run experience. The [Exchange ActiveSync errors](#exchange-activesync-errors) section lists common errors the device may encounter when trying to synchronize with an Microsoft Exchange ActiveSync server. - - - - -## Setup troubleshooting - - -This section lists causes, and possible fixes to help troubleshoot issues you might find when you set up your Microsoft Surface Hub. - -### On-device - -Possible fixes for issues on the Surface Hub after you've completed the first-run program. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          IssueCausesPossible fixes
          -

          Not receiving automatic accept/decline messages.

          -
          -

          The device account isn't configured to automatically accept/decline messages.

          -
          -

          Use PowerShell cmdlet Set-CalendarProcessing $upn -AutomateProcessing AutoAccept.

          -
          -

          The device account isn't configured to process external meeting requests.

          -
          -

          Use PowerShell cmdlet Set-CalendarProcessing $upn -ProcessExternalMeetingMessages $true.

          -
          -

          Calendar is not showing on the Welcome screen, or message "Appointments of date (no account provisioned)" is being displayed.

          -
          -

          No device account is set up on this Surface Hub.

          -
          -

          Provision a device account through Settings.

          -
          -

          Calendar is not showing on the Welcome screen or message "Appointments of date (overprovisioned)" is being displayed.

          -
          -

          The device account is provisioned on too many devices.

          -
          -

          Remove the device account from other devices that it's provisioned to. This can be done using the Exchange admin portal.

          -
          -

          Calendar is not showing on the Welcome screen or message "Appointments of date (invalid credentials)" is being displayed.

          -
          -

          The device account's password has expired and is no longer valid.

          -
          -

          Update the account's password in Settings. Also see Password management.

          -
          -

          Calendar is not showing on the Welcome screen or message "Appointments of date (account policy)" is being displayed.

          -
          -

          The device account is using an invalid ActiveSync policy.

          -
          -

          Make sure the device account has an ActiveSync policy where PasswordEnabled == False.

          -
          -

          Calendar is not showing on the Welcome screen or message "Appointments may be out of date" is being displayed.

          -
          -

          Exchange is not enabled.

          -
          Enable the device account for Exchange services through Settings. You need to make sure you have the right set of ActiveSync policies and have also installed any necessary certificates for Exchange services to work.
          -

          Can't log in to Skype for Business.

          -
          -

          The device account does not have a Session Initiation Protocol (SIP) address property.

          -
          -

          The account does not have a SIP address property and its User Principal Name (UPN) does not match the actual SIP address. The account must have its SIP address set, or the SIP address should be added using the Settings app.

          -
          -

          Can't log in to Skype for Business.

          -
          -

          The device account requires a certificate to authenticate into Skype for Business.

          -
          -

          Install the appropriate certificate using provisioning packages.

          -
          -  - -### First run - -Possible fixes for issues with Surface Hub first-run program. - - ----- - - - - - - - - - - - - - - -
          IssueCausesPossible fixes

          Cannot find account when asked for domain and user name.

          Domain needs to be the fully qualified domain name (FQDN).

          The FQDN should be provided in the domain field.

          - -  - -### Device account page, issues for new account settings - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          IssueCausesPossible fixes

          Unable to find the provided account in Azure AD.

          The provided account's User Principal Name (UPN) has a tenant that can't be reached in Azure AD.

          Make sure that you have a working Internet connection, and that the device can reach Microsoft Online Services. Make sure the account credentials are entered correctly.

          Unable to reach the specified directory.

          The provided account domain specifies a domain that can't be reached.

          Make sure that you have a working network connection, and that the device can reach the domain controller. Make sure the account credentials are entered correctly. You can also try using the FQDN instead.

          Can't auto-discover Exchange server.

          The Exchange server isn't configured for auto-discovery.

          Enable auto-discovery of the Exchange server for the device account, or enter the account's Exchange server address manually.

          Could not discover the SIP address after entering the account credentials.

          There was no SIP address entry in Active Directory or Azure AD.

          Make sure the account is enabled with Skype for Business and has a SIP address. If not, you can enter the SIP address manually into the text box.

          - -  - -### Device account page, issues for existing account settings - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          IssueCausesError codesPossible fixes
          -

          Account could not authenticate with the specified credentials.

          -
          -

          The account is not enabled as a user in Active Directory (AD), needs a password to authenticate, or the password is incorrect.

          -
          -

          None

          -
          -

          Make sure the credentials are entered correctly. Enable the account as a user in AD and add a password, or set the RoomMailboxPassword

          .
          -

          Error 0x800C0019 is displayed when providing an Exchange server.

          -
          -

          The device account requires a certificate to authenticate.

          -
          -

          0x800C0019

          -
          -

          Install the appropriate certificate using provisioning packages.

          -
          -

          Device account credentials are not valid for the provided Exchange server.

          -
          -

          The provided Exchange server is not where the device account's mailbox is hosted.

          -
          -

          None

          -
          -

          Make sure you are providing the correct Exchange mail server for the device account.

          -
          -

          HTTP timeout while trying to reach Exchange server.

          -
          -

          0x80072EE2

          -
          -

          Couldn't find the provided Exchange server.

          -
          -

          The Exchange server provided could not be found.

          -
          -

          None

          -
          -

          Ensure that you have a working network or Internet connection, and that the Exchange server you provided is correct.

          -
          -

          http not supported.

          -
          -

          An Exchange server with http:// instead of https:// was provided.

          -
          -

          None

          -
          -

          Use an Exchange server that uses https.

          -
          -

          People land on the page titled "There's a problem with this account" regarding ActiveSync.

          -
          -
           
          -
          -

          The ActiveSync policy PasswordEnabled is set to True (or 1).

          -
          -

          None

          -
          -

          Create a new ActiveSync policy where PasswordEnabled is set to False (or 0), and then apply that policy to the account.

          -
          -

          The Surface Hub doesn't have a connection to Exchange.

          -
          -

          None

          -
          -

          Make sure that you have a working network or Internet connection.

          -
          -

          Exchange returns a status code indicating an error.

          -
          -

          None

          -
          -

          Make sure that you have a working network or Internet connection.

          -
          -  - -### First run, Domain join page issues - - ----- - - - - - - - - - - - - - - - - - - - -
          IssueCausesPossible fixes

          When trying to join a domain, an error shows that the account couldn't authenticate using the specified credentials.

          The credentials provided are not capable of joining the specified domain.

          Enter correct credentials for an account that exists in the specified domain.

          When specifying a group from a domain, an error shows that the group couldn't be found on the domain.

          The group may have been removed or no longer exists.

          Verify that the group exists within the domain.

          - -  - -### First run, Exchange server page - - ----- - - - - - - - - - - - - - - -
          IssueCausesPossible fixes

          People land on this page and are asked for the Exchange server address.

          The Exchange server isn't configured for auto-discovery.

          Enable auto-discovery of the Exchange server for the device account, or enter the account's Exchange server address manually.

          - -  - -### First run, On-device issues - - ------ - - - - - - - - - - - - - - - - -
          IssueCausesError codesPossible fixes

          Can't sync mail/calendar.

          The account has not allowed the Surface Hub as an allowed device.

          0x86000C1C

          Add the Surface Hub device ID to the whitelist by setting the ActiveSyncAllowedDeviceIds property for the mailbox.

          - -  - - - -  - -## Exchange ActiveSync errors - - -This section lists status codes, mapping, user messages, and actions an admin can take to solve Exchange ActiveSync errors. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Hex CodeMappingUser-Friendly MessageAction admin should take

          0x85010002

          E_HTTP_DENIED

          The password must be updated.

          Update the password.

          0x80072EFD

          WININET_E_CANNOT_CONNECT

          Can’t connect to the server right now. Wait a while and try again, or check the account settings.

          Verify that the server name is correct and reachable. Verify that the device is connected to the network.

          0x86000C29

          E_NEXUS_STATUS_DEVICE_NOTPROVISIONED (policies don’t match)

          The account is configured with policies not compatible with Surface Hub.

          Disable the PasswordEnabled policy for this account.

          -

          We have a bug were we may surface policy errors if the account doesn’t receive any server notifications within the policy refresh interval.

          0x86000C4C

          E_NEXUS_STATUS_MAXIMUMDEVICESREACHED

          The account has too many device partnerships.

          Delete one or more partnerships on the server.

          0x86000C0A

          E_NEXUS_STATUS_SERVERERROR_RETRYLATER

          Can’t connect to the server right now.

          Wait until the server comes back online. If the issue persists, re-provision the account.

          0x85050003

          E_CREDENTIALS_EXPIRED (Credentials have expired and need to be updated)

          The password must be updated.

          Update the password.

          0x8505000D

          E_AIRSYNC_RESET_RETRY

          Can’t connect to the server right now. Wait a while or check the account’s settings.

          This is normally a transient error but if the issue persists check the number of devices associated with the account and delete some of them if the number is large.

          0x86000C16

          E_NEXUS_STATUS_USER_HASNOMAILBOX

          The mailbox was migrated to a different server.

          You should never see this error. If the issue persists, re-provision the account.

          0x85010004

          E_HTTP_FORBIDDEN

          Can’t connect to the server right now. Wait a while and try again, or check the account’s settings.

          Verify the server name to make sure it is correct. If the account is using cert based authentication make sure the certificate is still valid and update it if not.

          0x85030028

          E_ACTIVESYNC_PASSWORD_OR_GETCERT

          The account’s password or client certificate are missing or invalid.

          Update the password and/or deploy the client certificate.

          0x86000C2A

          E_NEXUS_STATUS_DEVICE_POLICYREFRESH

          The account is configured with policies not compatible with Surface Hub.

          Disable the PasswordEnabled policy for this account.

          0x85050002

          E_CREDENTIALS_UNAVAILABLE

          The password must be updated.

          Update the password.

          0x80072EE2

          WININET_E_TIMEOUT

          The network doesn’t support the minimum idle timeout required to receive server notification, or the server is offline.

          Verify that the server is running. Verify the NAT settings.

          0x85002004

          E_FAIL_ABORT

          This error is used to interrupt the hanging sync, and will not be exposed to users. It will be shown in the diagnostic data if you force an interactive sync, delete the account, or update its settings.

          Nothing.

          0x85010017

          E_HTTP_SERVICE_UNAVAIL

          Can’t connect to the server right now. Wait a while or check the account’s settings.

          Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.

          0x86000C0D

          E_NEXUS_STATUS_MAILBOX_SERVEROFFLINE

          Can’t connect to the server right now. Wait a while or check the account’s settings.

          Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.

          0x85030027

          E_ACTIVESYNC_GETCERT

          The Exchange server requires a certificate.

          Import the appropriate EAS certificate on the Surface Hub.

          0x86000C2B

          E_NEXUS_STATUS_INVALID_POLICYKEY

          The account is configured with policies not compatible with Surface Hub.

          Disable the PasswordEnabled policy for this account.

          -

          We have a bug were we may surface policy errors if the account doesn’t receive any server notifications within the policy refresh interval.

          0x85010005

          E_HTTP_NOT_FOUND

          The server name is invalid.

          Verify the server name to make sure it is correct. If the issue persists, re-provision the account.

          0x85010014

          E_HTTP_SERVER_ERROR

          Can’t connect to the server.

          Verify the server name to make sure it is correct. Trigger a sync and, if the issue persists, re-provision the account.

          0x80072EE7

          WININET_E_NAME_NOT_RESOLVED

          The server name or address could not be resolved.

          Make sure the server name is entered correctly.

          0x8007052F

          ERROR_ACCOUNT_RESTRICTION

          While auto-discovering the Exchange server, a policy is applied that prevents the logged-in user from logging in to the server.

          This is a timing issue. Re-verify the account's credentials. Try to re-provision when they're correct.

          0x800C0019

          INET_E_INVALID_CERTIFICATE

          Security certificate required to access this resource is invalid.

          Install the correct ActiveSync certificate needed for the provided device account.

          0x80072F0D

          WININET_E_INVALID_CA

          The certificate authority is invalid or is incorrect. Could not auto-discover the Exchange server because a certificate is missing.

          Install the correct ActiveSync certificate needed for the provided device account.

          0x80004005

          E_FAIL

          The domain provided couldn't be found. The Exchange server could not be auto-discovered and was not provided in the settings.

          Make sure that the domain entered is the FQDN, and that there is an Exchange server entered in the Exchange server text box.

          - -  - -  -## Related content - -- [Troubleshooting Miracast connection to the Surface Hub](https://docs.microsoft.com/surface-hub/miracast-troubleshooting) -  - - - - - diff --git a/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md b/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md deleted file mode 100644 index 2cb3ab2414..0000000000 --- a/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to use cloud recovery for BitLocker on a Surface Hub -description: How to use cloud recovery for BitLocker on a Surface Hub -ms.assetid: c0bde23a-49de-40f3-a675-701e3576d44d -ms.reviewer: -manager: -keywords: Accessibility settings, Settings app, Ease of Access -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Summary - -This article describes how to use the cloud recovery function if you are unexpectedly prompted by BitLocker on a Surface Hub device. - -> [!NOTE] -> You should follow these steps only if a BitLocker recovery key isn't available. - -> [!WARNING] -> * This recovery process deletes the contents of the internal drive. If the process fails, the internal drive will become completely unusable. If this occurs, you will have to log a service request with Microsoft for a resolution. -> * After the recovery process is complete, the device will be reset to the factory settings and returned to its Out of Box Experience state. -> * After the recovery, the Surface Hub must be completely reconfigured. - -> [!IMPORTANT] -> This process requires an open Internet connection that does not use a proxy or other authentication method. - -## Cloud recovery process - -To perform a cloud recovery, follow these steps: - -1. Select **Press Esc for more recovery options**. - - ![Screenshot of Escape](images/01-escape.png) - -1. Select **Skip this drive**. - - ![Screenshot of Skip this drive](images/02-skip-this-drive.png) - -1. Select **Recover from the cloud**. - - ![Screenshot of Recover from the cloud](images/03-recover-from-cloud.png) - -1. Select **Yes**. - - ![Screenshot of Yes](images/04-yes.png) - -1. Select **Reinstall**. - - ![Screenshot of Reinstall](images/05a-reinstall.png) - - ![Screenshot of Downloading](images/05b-downloading.png) - -1. After the cloud recovery process is complete, start the reconfiguration by using the **Out of Box Experience**. - - ![Screenshot of Out of the Box](images/06-out-of-box.png) - -## "Something went Wrong" error message - -This error is usually caused by network issues that occur during the recovery download. When this issue occurs, don't turn off the Hub because you won't be able to restart it. If you receive this error message, return to the "Recover from the cloud" step, and then restart the recovery process. - -1. Select **Cancel**. - - ![Screenshot of Cancel](images/07-cancel.png) - -1. Select **Troubleshoot**. - - ![Screenshot of Troubleshoot](images/08-troubleshoot.png) - -1. Select **Recover from the cloud**. - - ![Screenshot of Recover from the cloud](images/09-recover-from-cloud2.png) - -1. If the **Wired network isn't found** error occurs, select **Cancel**, and then let the Surface Hub rediscover the wired network. - - ![Screenshot of Wired network isn't found](images/10-cancel.png) \ No newline at end of file diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md deleted file mode 100644 index 57f4f3faa0..0000000000 --- a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Use fully qualified domain name with Surface Hub -description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. -keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"] -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium -ms.prod: surface-hub -ms.sitesec: library ---- - -# Configure domain name for Skype for Business - -There are a few scenarios where you need to specify the domain name of your Skype for Business server: -- **Multiple DNS suffixes** - When your Skype for Business infrastructure has disjointed namespaces such that one or more servers have a DNS suffix that doesn't match the suffix of the sign-in address (SIP) for Skype for Business. -- **Skype for Business and Exchange suffixes are different** - When the suffix of the sign-in address for Skype for Business differs from the suffix of the Exchange address used for the device account. -- **Working with certificates** - Large organizations with on-premises Skype for Business servers commonly use certificates with their own root certificate authority (CA). It is common for the CA domain to be different than the domain of the Skype for Business server which causes the certificate to not be trusted, and sign-in fails. Skype needs to know the domain name of the certificate in order to set up a trust relationship. Enterprises typically use Group Policy to push this out to Skype desktop, but Group Policy is not supported on Surface Hub. - -**To configure the domain name for your Skype for Business server**
          -1. On Surface Hub, open **Settings**. -2. Click **Surface Hub**, and then click **Calling & Audio**. -3. Under **Skype for Business configuration**, click **Configure domain name**. -4. Type the domain name for your Skype for Business server, and then click **Ok**. - > [!TIP] - > You can type multiple domain names, separated by commas.
          For example: lync.com, outlook.com, lync.glbdns.microsoft.com - - ![Add Skype for Business FQDN to Settings](images/system-settings-add-fqdn.png) diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md deleted file mode 100644 index e18ca0fcd5..0000000000 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: Using a room control system (Surface Hub) -description: Room control systems can be used with your Microsoft Surface Hub. -ms.assetid: DC365002-6B35-45C5-A2B8-3E1EB0CB8B50 -ms.reviewer: -manager: dansimp -keywords: room control system, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Using a room control system (Surface Hub) - - -Room control systems can be used with your Microsoft Surface Hub. - -Using a room control system with your Surface Hub involves connecting room control hardware to the Surface Hub, usually through the RJ11 serial port on the bottom of the Surface Hub. - -## Terminal settings - -To connect to a room control system control panel, you don't need to configure any terminal settings on the Surface Hub. If you want to connect a PC or laptop to your Surface Hub and send serial commands from the Surface Hub, you can use a terminal emulator program like Tera Term or PuTTY. - -| Setting | Value | -| --- | --- | -| Baud rate | 115200 | -| Data bits | 8 | -| Stop bits | 1 | -| Parity | none | -| Flow control | none | -| Line feed | every carriage return | - - -## Wiring diagram - -You can use a standard RJ-11 (6P6C) connector to connect the Surface Hub serial port to a room control system. This is the recommended method. You can also use an RJ-11 4-conductor cable, but we do not recommend this method. - -This diagram shows the correct pinout used for an RJ-11 (6P6C) to DB9 cable. - -![Image showing the wiring diagram.](images/room-control-wiring-diagram.png) - -## Command sets - -Room control systems use common meeting-room scenarios for commands. Commands originate from the room control system, and are communicated over a serial connection to a Surface Hub. Commands are ASCII based, and the Surface Hub will acknowledge when state changes occur. - -The following command modifiers are available. Commands terminate with a new line character (\n). Responses can come at any time in response to state changes not triggered directly by a management port command. - -| Modifier | Result | -| --- | --- | -| + | Increment a value | -| - | Decrease a value | -| = | Set a discrete value | -| ? | Queries for a current value | - - -## Power - -Surface Hub can be in one of these power states. - -| State | Energy Star state| Description | -| --- | --- | --- | -| 0 | S5 | Off | -| 1 | - | Power up (indeterminate) | -| 2 | S3 | Sleep | -| 5 | S0 | Ready | - - -In Replacement PC mode, the power states are only Ready and Off and only change the display. The management port can't be used to power on the replacement PC. - -| State | Energy Star state| Description | -| --- | --- | --- | -| 0 | S5 | Off | -| 5 | S0 | Ready | - -For a control device, anything other than 5 / Ready should be considered off. Each PowerOn command results in two state changes and responses. - -| Command | State change| Response | -| --- | --- | --- | -| PowerOn | Device turns on (display + PC).

          PC service notifies SMC that the PC is ready. | Power=0

          Power=5 | -| PowerOff | Device transitions to ambient state (PC on, display dim). | Power=0 | -| Power? | SMC reports the last-known power state. | Power=<#> | - - - -## Brightness - -The current brightness level is a range from 0 to 100. - -Changes to brightness levels can be sent by a room control system, or other system. - -| Command | State change |Response | -| --- | --- | --- | -| Brightness+ | System management controller (SMC) sends the brightness up command.

          PC service on the room control system notifies SMC of new brightness level. | Brightness = 51 | -| Brightness- | SMC sends the brightness down command.

          PC service notifies SMC of new brightness level. | Brightness = 50 | - -## Volume - -The current volume level is a range from 0 to 100. - -Changes to volume levels can be sent by a room control system, or other system. - ->[!NOTE] ->The Volume command will only control the volume for embedded or Replacement PC mode, not from [Guest sources](connect-and-display-with-surface-hub.md). - -| Command | State change | Response
          (On in [Replacement PC mode](connect-and-display-with-surface-hub.md#replacement-pc-mode)) | -| --- | --- | --- | -| Volume+ | SMC sends the volume up command.

          PC service notifies SMC of new volume level. | Volume = 51 | -| Volume- | SMC sends the volume down command.

          PC service notifies SMC of new volume level. | Volume = 50 | - - - - -## Mute for audio - -Audio can be muted. - -| Command | State change | Response | -| --- | --- | --- | -| AudioMute+ | SMC sends the audio mute command.

          PC service notifies SMC that audio is muted. | none | - - - - -## Video source - -Several display sources can be used. - -| State | Description | -| --- | --- | -| 0 | Onboard PC | -| 1 | DisplayPort | -| 2 | HDMI | -| 3 | VGA | - - - - -Changes to display source can be sent by a room control system, or other system. - -| Command | State change | Response | -| --- | --- | --- | -| Source=# | SMC changes to the desired source.

          PC service notifies SMC that the display source has switched. | Source=<#> | -| Source+ | SMC cycles to the next active input source.

          PC service notifies SMC of the current input source. | Source=<#> | -| Source- | SMC cycles to the previous active input source.

          PC service notifies SMC of the current input source. | Source=<#> | -| Source? | SMC queries PC service for the active input source.

          PC service notifies SMC of the current in;put source. | Source=<#> | - -## Errors - -Errors are returned following the format in this table. - -| Error | Notes | -| --- | --- | -| Error: Unknown command '<input>'. | The instruction contains an unknown initial command. For example, "VOL+" would be invalid and return " Error: Unknown command 'VOL'". | -| Error: Unknown operator '<input>'. | The instruction contains an unknown operator. For example, "Volume!" would be invalid and return " Error: Unknown operator '!'". | -| Error: Unknown parameter '<input>'. | The instruction contains an unknown parameter. For example, "Volume=abc" would be invalid and return " Error: Unknown parameter 'abc'". | -| Error: Command not available when off '<input>'. | When the Surface Hub is off, commands other than Power return this error. For example, "Volume+" would be invalid and return " Error: Command not available when off 'Volume'". | - - - - -## Related topics - - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - - - - - - - - - diff --git a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md deleted file mode 100644 index eedbfe9ae5..0000000000 --- a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Using the Surface Hub Hardware Diagnostic Tool to test a device account -description: Using the Surface Hub Hardware Diagnostic Tool to test a device account -ms.assetid: a87b7d41-d0a7-4acc-bfa6-b9070f99bc9c -ms.reviewer: -manager: -keywords: Accessibility settings, Settings app, Ease of Access -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Using the Surface Hub Hardware Diagnostic Tool to test a device account - -## Introduction - -> [!NOTE] -> The "Account Settings" section of the Surface Hub Hardware Diagnostic tool doesn’t collect any information. The email and password that are entered as input are used only directly on your environment and not collected or transferred to anyone. The login information persists only until the application is closed or you end the current session on the Surface Hub. - -> [!IMPORTANT] -> * Administrator privileges are not required to run this application. -> * The results of the diagnostic should be discussed with your local administrator before you open a service call with Microsoft. - -### Surface Hub Hardware Diagnostic - -By default, the [Surface Hub Hardware Diagnostic](https://www.microsoft.com/store/apps/9nblggh51f2g) application isn’t installed in earlier versions of the Surface Hub system. The application is available for free from the Microsoft Store. Administrator privileges are required to install the application. - - ![Screenshot of Hardware Diagnostic](images/01-diagnostic.png) - -## About the Surface Hub Hardware Diagnostic Tool - -The Surface Hub Hardware Diagnostic tool is an easy-to-navigate tool that lets the user test many of the hardware components within the Surface Hub device. This tool can also test and verify a Surface Hub device account. This article describes how to use the Account Settings test within the Surface Hub Hardware Diagnostic tool. - -> [!NOTE] -> The device account for the Surface Hub should be created before any testing is done. The Surface Hub Administrator Guide provides instructions and PowerShell scripts to help you create on-premises, online (Office365), or hybrid device accounts. For more information, go to the [Create and test a device account (Surface Hub)](https://docs.microsoft.com/surface-hub/create-and-test-a-device-account-surface-hub) topic in the guide. - -### Device account testing process - -1. Navigate to **All Apps**, and then locate the Surface Hub Hardware Diagnostic application. - - ![Screenshot of All Apps](images/02-all-apps.png) - -1. When the application starts, the **Welcome** page provides a text window to document the reason why you are testing the Hub. This note can be saved to USB together with the diagnostic results at the conclusion of testing. After you finish entering a note, select the **Continue** button. - - ![Screenshot of Welcome](images/03-welcome.png) - -1. The next screen provides you the option to test all or some of the Surface Hub components. To begin testing the device account, select the **Test Results** icon. - - ![Screenshot of Test Results](images/04-test-results-1.png) - - ![Screenshot of Test Results](images/05-test-results-2.png) - -1. Select **Account Settings**. - - ![Screenshot of Account Settings](images/06-account-settings.png) - - The Account Settings screen is used to test your device account. - - ![Screenshot of Account Settings Details](images/07-account-settings-details.png) - -1. Enter the email address of your device account. The password is optional but is recommended. Select the **Test Account** button when you are ready to continue. - - ![Screenshot of Test Account](images/08-test-account.png) - -1. After testing is finished, review the results for the four areas of testing. Each section can be expanded or collapsed by selecting the Plus or Minus sign next to each topic. - - **Network** - - ![Screenshot of Network](images/09-network.png) - - **Environment** - - ![Screenshot of Environment](images/10-environment.png) - - **Certificates** - - ![Screenshot of Certificates](images/11-certificates.png) - - **Trust Model** - - ![Screenshot of Trust Model](images/12-trust-model.png) - -## Appendix - -### Field messages and resolution - -#### Network - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -Internet Connectivity |Device does have Internet connectivity |Device does not have Internet connectivity |Verifies internet connectivity, including proxy connection |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) -HTTP Version |1.1 |1.0 |If HTTP 1.0 found, it will cause issue with WU and Store | -Direct Internet Connectivity |Device has a Proxy configured Device has no Proxy configured |N/A |Informational. Is your device behind a proxy? | -Proxy Address | | |If configured, returns proxy address. | -Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated thru the proxy. |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) -Proxy Auth Types | | |If proxy authentication is used, return the Authentication methods advertised by the proxy. | - -#### Environment - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -SIP Domain | | |Informational. | -Skype Environment |Skype for Business Online, Skype for Business OnPrem, Skype for Business Hybrid |Informational. |What type of environment was detected. Note: Hybrid can only be detected if the password is entered. -LyncDiscover FQDN | | |Informational. Displays the LyncDiscover DNS result | -LyncDiscover URI | | |Informational. Displays the URL used to perform a LyncDiscover on your environment.| -LyncDiscover |Connection Successful |Connection Failed |Response from LyncDiscover web service. | -SIP Pool Hostname | | |Informational. Display the SIP pool name discovered from LyncDiscover | - -#### Certificates (in-premises hybrid only) - -LyncDiscover Certificate - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -LyncDiscover Cert CN | | |Informational. Displays the LD cert Common name | -LyncDiscover Cert CA | | |Informational. Displays the LD Cert CA | -LyncDiscover Cert Root CA | | |Informational. Displays the LD Cert Root CA, if available. | -LD Trust Status |Certificate is Trusted. |Certificate is not trusted, please add the Root CA. |Verify the certificate against the local cert store. Returns positive if the machine trusts the certificate.|[Download and deploy Skype for Business certificates using PowerShell](https://blogs.msdn.microsoft.com/surfacehub/2016/06/07/download-and-deploy-skype-for-business-certificates-using-powershell/)/[Supported items for Surface Hub provisioning packages](https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub#supported-items-for-surface-hub-provisioning-packages) - -SIP Pool Certification - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -SIP Pool Cert CN | | |(CONTENTS) | -SIP Pool Cert CA | | |(CONTENTS) | -SIP Pool Trust Status |Certificate is Trusted. |Certificate is not trusted, please add the Root CA. |Verify the certificate against the local cert store and return a positive if the devices trusts the certificate. | -SIP Pool Cert Root CA | | |Information. Display the SIP Pool Cert Root CA, if available. | - -#### Trust Model (on-premises hybrid only) - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -Trust Model Status |No Trust Model Issue Detected. |SIP Domain and server domain are different please add the following domains. |Check the LD FQDN/ LD Server Name/ Pool Server name for Trust model issue. |[Surface Hub and the Skype for Business Trusted Domain List](https://blogs.technet.microsoft.com/y0av/2017/10/25/95/) -Domain Name(s) | | |Return the list of domains that should be added for SFB to connect. | diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md deleted file mode 100644 index e921c71e09..0000000000 --- a/devices/surface-hub/whiteboard-collaboration.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Set up and use Microsoft Whiteboard -description: Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 03/18/2019 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium ---- - -# Set up and use Microsoft Whiteboard - - - ->[!IMPORTANT] ->A new Microsoft Whiteboard app was released on July 12, 2018. The existing Whiteboard app that comes installed on Surface Hub and is pinned to the Welcome screen has been renamed **Microsoft Whiteboard 2016**. Microsoft Whiteboard 2016 will be automatically upgraded by May 21, 2019, and the collaboration service for the legacy app will stop functioning after June 7, 2019. For more details, see [Enable Microsoft Whiteboard on Surface Hub](https://support.office.com/article/enable-microsoft-whiteboard-on-surface-hub-b5df4539-f735-42ff-b22a-0f5e21be7627?ui=en-US&rs=en-US&ad=US). - -The Microsoft Whiteboard app includes the capability for two Surface Hubs to collaborate in real time on the same board. - -By ensuring that your organization meets the prerequisites, users can then ink, collaborate, and ideate together. - -![example of a whiteboard with collaborative inking](images/wb-collab-example.png) - -## Prerequisites for Whiteboard to Whiteboard collaboration (Microsoft Whiteboard 2016) - -To get Whiteboard to Whiteboard collaboration up and running, you’ll need to make sure your organization meets the following requirements: - -- Office 365 with cloud-based Azure Active Directory (Azure AD) for all users -- OneDrive for Business deployed for all users who intend to collaborate -- Currently not utilizing Office 365 Germany or Office 365 operated by 21Vianet -- Surface Hub needs to be updated to Windows 10, version 1607 or newer -- Port 443 needs to be open since Whiteboard makes standard https requests -- Whiteboard.ms, whiteboard.microsoft.com, wbd.ms, \*.onenote.com, and your company's SharePoint tenant domain URLs need to be whitelisted for proxies - - ->[!NOTE] ->Collaborative sessions can only take place between users within the same tenant, so users outside of your organization won’t be able to join even if they have a Surface Hub. - -## Using Whiteboard to Whiteboard collaboration (Microsoft Whiteboard 2016) - -To start a collaboration session: - -1. In the Whiteboard app, tap the **Sign in** button. -2. Sign in with your organization ID. -3. Tap the **Invite** button next to your name at the top of the app. -4. Tap **Start session**. Whiteboard will generate a link that you can share. - - ![screenshot of the link dialog box on whiteboard](images/wb-collab-link.png) - -5. Copy and paste this link into a Skype chat with another Surface Hub - -When the other Surface Hub receives the link, the recipient can tap on the link, sign in to Whiteboard, and then begin collaborating. You can copy and paste other content, use smart ink features like Ink to Shape, and co-author together. - -After you’re done, you can export a copy of the Whiteboard collaboration for yourself through the Share charm and leave the board for others to continue working. - ->[!TIP] ->When you start a collaboration session, Whiteboard creates a folder named **Whiteboard App Data** in your OneDrive for Business to store your shared whiteboards. After some collaboration sessions, this folder may continue to sync or process changes indefinitely. You can fix this by choosing to not sync the **Whiteboard App Data** folder to your device. Disabling sync for this folder won't limit your ability to use Whiteboard for collaboration sessions. - - - - - - -## Related topics - -- [Windows 10 Creators Update for Surface Hub](https://www.microsoft.com/surface/support/surface-hub/windows-10-creators-update-surface-hub) - -- [Support documentation for Microsoft Whiteboard](https://support.office.com/article/Whiteboard-Help-0c0f2aa0-b1bb-491c-b814-fd22de4d7c01) diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md deleted file mode 100644 index 5e17e464a9..0000000000 --- a/devices/surface-hub/wireless-network-management-for-surface-hub.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Wireless network management (Surface Hub) -description: Microsoft Surface Hub offers two options for network connectivity to your corporate network and Internet wireless, and wired. While both provide network access, we recommend you use a wired connection. -ms.assetid: D2CFB90B-FBAA-4532-B658-9AA33CAEA31D -ms.reviewer: -manager: dansimp -keywords: network connectivity, wired connection -ms.prod: surface-hub -ms.sitesec: library -author: levinec -ms.author: ellevin -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Wireless network management (Surface Hub) - - -Microsoft Surface Hub offers two options for network connectivity to your corporate network and Internet: wireless, and wired. While both provide network access, we recommend you use a wired connection. - -## Modifying, adding, or reviewing a network connection - - -If a wired network connection is not available, the Surface Hub can use a wireless network for internet access. A properly connected and configured Wi-Fi access point must be available and within range of the Surface Hub. - -### Choose a wireless access point - -1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **Network & Internet**. Under **Wi-Fi**, choose an access point. If you want Surface Hub to automatically connect to this access point, click **Connect automatically**. Click **Connect**. - - ![Image showing Wi-Fi settings, Network & Internet page.](images/networkmgtwireless-01.png) - -3. If the network is secured, you'll be asked to enter the security key. Click **Next** to connect. - - ![Image showing security key and password prompts for connecting to secured Wi-Fi.](images/networkmgtwireless-02.png) - -### Review wireless settings - -1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**. -3. Surface Hub shows you the properties for the wireless network connection. - - ![Image showing properties for connected Wi-Fi.](images/networkmgtwireless-04.png) - -### Review wired settings - -1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **System**, click **Network & Internet**, then click on the network under Ethernet. - - ![Image showing Network & Internet, Ethernet settings page.](images/networkmgtwired-01.png) - -3. The system will show you the properties for the wired network connection. - - ![Image showing properties for ethernet connection.](images/networkmgtwired-02.png) - -## Related topics - - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md deleted file mode 100644 index e74076b642..0000000000 --- a/devices/surface/TOC.md +++ /dev/null @@ -1,57 +0,0 @@ -# [Surface](index.md) - -## [Get started](get-started.md) - -## Overview -### [Surface Pro Tech specs](https://www.microsoft.com/surface/devices/surface-pro/tech-specs) -### [Surface Book Tech specs](https://www.microsoft.com/surface/devices/surface-book/tech-specs) -### [Surface Studio Tech specs](https://www.microsoft.com/surface/devices/surface-studio/tech-specs) -### [Surface Go Tech specs](https://www.microsoft.com/surface/devices/surface-go/tech-specs) -### [Surface Laptop 2 Tech specs](https://www.microsoft.com/surface/devices/surface-laptop/tech-specs) - -## Plan -### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) -### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md) -### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md) -### [Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) -### [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) -### [Deploy Surface app with Microsoft Store for Business](deploy-surface-app-with-windows-store-for-business.md) -### [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md) -### [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md) - -## Deploy -### [Deploy Surface devices](deploy.md) -### [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md) -### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md) -### [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) -### [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md) -### [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md) -### [Using the Surface Deployment Accelerator deployment share](using-the-sda-deployment-share.md) -### [Surface System SKU reference](surface-system-sku-reference.md) - -## Manage -### [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) -### [Battery Limit setting](battery-limit.md) -### [Surface Brightness Control](microsoft-surface-brightness-control.md) -### [Surface Asset Tag](assettag.md) -### [Surface firmware and driver updates](update.md) -### [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) -### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md) -### [Surface Dock Updater](surface-dock-updater.md) -### [Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) - -## Secure -### [Manage Surface UEFI settings](manage-surface-uefi-settings.md) -### [Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md) -### [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) -### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md) -### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) - -## Support -### [Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md) -### [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) -### [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) -### [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) -### [Surface Data Eraser](microsoft-surface-data-eraser.md) -### [Top support solutions for Surface devices](support-solutions-surface.md) -### [Change history for Surface documentation](change-history-for-surface.md) diff --git a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md deleted file mode 100644 index c677b56488..0000000000 --- a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: Advanced UEFI security features for Surface Pro 3 (Surface) -description: This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices. -ms.assetid: 90F790C0-E5FC-4482-AD71-60589E3C9C93 -ms.reviewer: -manager: dansimp -keywords: security, features, configure, hardware, device, custom, script, update -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 ---- - -# Advanced UEFI security features for Surface Pro 3 - - -This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices. - -To address more granular control over the security of Surface devices, the v3.11.760.0 UEFI update provides additional security options that allow you to disable specific hardware devices or to prevent starting from those devices. After the UEFI update is installed on a device, you can configure it manually or automatically by running a script. - -## Manually install the UEFI update - - -Before you can configure the advanced security features of your Surface device, you must first install the v3.11.760.0 UEFI update. This update is installed automatically if you receive your updates from Windows Update. For more information about how to configure Windows to update automatically by using Windows Update, see [How to configure and use Automatic Updates in Windows](https://support.microsoft.com/kb/306525). - -To update the UEFI on Surface Pro 3, you can download and install the Surface UEFI updates as part of the Surface Pro 3 Firmware and Driver Pack. These firmware and driver packs are available from the [Surface Pro 3 page](https://www.microsoft.com/download/details.aspx?id=38826) on the Microsoft Download Center. You can find out more about the firmware and driver packs at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). The firmware and driver packs are available as both self-contained Windows Installer (.msi) and archive (.zip) formats. You can find out more about these two formats and how you can use them to update your drivers at [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). - -## Manually configure additional security settings - - ->[!NOTE] ->To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. - -After the v3.11.760.0 UEFI update is installed on a Surface device, an additional UEFI menu named **Advanced Device Security** becomes available. If you click this menu, the following options are displayed: - -| Option | Description | Available settings (default listed in bold) | -|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------| -| Network Boot | Enables or disables the ability of your Surface device to boot from the network (also known as PXE boot). | **Enabled**, Not Bootable | -| Side USB | Enables or disables the USB port on the side of the Surface device. Additionally, the USB port can be enabled, but not allow booting. | **Enabled**, Not Bootable, Disabled | -| Docking Port | Enables or disables the ports on the Surface docking station. Additionally, the docking port can be enabled, but block booting from any USB or Ethernet port in the docking station. | **Enabled**, Not Bootable, Disabled | -| Front Camera | Enables or disables the camera on the front of the Surface device. | **Enabled**, Disabled | -| Rear Camera | Enables or disables the camera on the rear of the Surface device. | **Enabled**, Disabled | -| On Board Audio | Enables or disables audio on the Surface device. | **Enabled**, Disabled | -| microSD | Enables or disables the microSD slot on the Surface device. | **Enabled**, Disabled | -| WiFi | Enables or disables the built-in Wi-Fi transceiver in the Surface device. This also disables Bluetooth. | **Enabled**, Disabled | -| Bluetooth | Enables or disables the built-in Bluetooth transceiver in the Surface device. | **Enabled**, Disabled | - -  - -## Automate additional security settings - - -As an IT professional with administrative privileges, you can automate the configuration of UEFI settings by leveraging [Surface Pro 3 Firmware Tools (476 KB)](https://go.microsoft.com/fwlink/p/?LinkID=618038) available from the Microsoft Download Center. These tools install a .NET assembly that can be called from any custom application or script. - -**Prerequisites** - -- The sample scripts below leverage the previously mentioned extension and therefore assume that the tool has been installed on the device being managed. -- The scripts must be run with administrative privilege. -- The Windows PowerShell command [**Set-ExecutionPolicy Unrestricted**](https://technet.microsoft.com/library/ee176961.aspx) must be called prior to running sample scripts if they are not digitally signed. - -**Sample scripts** - ->**Note**:  The UEFI password used in the sample scripts below is presented in clear text. We strongly recommend saving the scripts in a protected location and running them in a controlled environment. - - -Show all configurable options: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Get the collection of all configurable settings -$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() - -foreach ($uefiOption in $uefiOptions) -{ - Write-Host "Name:" $uefiOption.Name - Write-Host " Description =" $uefiOption.Description - Write-Host " Current Value =" $uefiOption.CurrentValue - Write-Host " Default Value =" $uefiOption.DefaultValue - Write-Host " Proposed Value =" $uefiOption.ProposedValue - - # This gives usage and validation information - Write-Host " Allowed Values =" $uefiOption.FriendlyRegEx - Write-Host " Regular Expression =" $uefiOption.RegEx - - Write-Host -} -``` - -Set or change UEFI password: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Must supply UEFI administrator Password if set -# If it is not currently set this is ignored -[Microsoft.Surface.FirmwareOption]::Unlock("1234") - -$Password = [Microsoft.Surface.FirmwareOption]::Find("Password") - -# Set New value to 12345 -$Password.ProposedValue = "12345" -``` - -Check status of proposed changes: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Check update status -$updateStatus = [Microsoft.Surface.FirmwareOption]::UpdateStatus -$updateIteration = [Microsoft.Surface.FirmwareOption]::UpdateIteration -Write-Host "Last Update Status =" $updateStatus -Write-Host "Last Update Iteration =" $updateIteration - -# Get the individual results for the last proposed update -# If the device has never had an update attempt this will be an empty list -$details = [Microsoft.Surface.FirmwareOption]::UpdateStatusDetails -Write-Host $details.Count "Settings were proposed" -if ($details.Count -gt 0) -{ - Write-Host "Result Details" - foreach ($detail in $details.GetEnumerator()) - { - Write-Host " " $detail.Key "=" $detail.Value - } -} -``` - -Revert UEFI to default values: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Must supply UEFI administrator Password if set -# If it is not currently set this is ignored -[Microsoft.Surface.FirmwareOption]::Unlock("1234") - -# Get the collection of all configurable settings -$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() - -# Reset all options to the factory default -foreach ($uefiOption in $uefiOptions) -{ - $uefiOption.ProposedValue = $uefiOption.DefaultValue -} -``` - -Status code interpretation - -- 00 - The proposed update was a success -- 02 - One of the proposed values had an invalid value -- 03 - There was a proposed value set that was not recognized -- 0F - The unlock password did not match currently set password - -  - -  - - - - - diff --git a/devices/surface/assettag.md b/devices/surface/assettag.md deleted file mode 100644 index e0df401dea..0000000000 --- a/devices/surface/assettag.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Surface Asset Tag Tool -description: This topic explains how to use the Surface Asset Tag Tool. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 02/01/2019 -ms.reviewer: -manager: dansimp ---- - -# Surface Asset Tag Tool - -Surface Asset Tag is a command line interface (CLI) utility -that allows you to view, assign, and modify an assigned asset tag value -for Surface devices. It works on Surface Pro 3 and all newer Surface devices. - -## System requirements - -- Surface Pro 3 or later - -- UEFI firmware version 3.9.150.0 or later - -## Using Surface Asset Tag - -To run Surface Asset Tag: - -1. On the Surface device, download **Surface Asset Tag.zip** from the [Microsoft Download - Center](https://www.microsoft.com/en-us/download/details.aspx?id=46703), - extract the zip file, and save AssetTag.exe in desired folder (in - this example, C:\\assets). - -2. Open a command console as an Administrator and run AssetTag.exe, - entering the full path to the tool. - -3. Restart Surface. - -### Asset Tag tool commands -In the following examples, AssetTag.exe is saved in a directory on a local machine (C:\assets). - -To get the proposed asset tag, run AssetTag -g. - -**Example** - - ``` - C:\assets\AssetTag.exe -g - ``` - - To clear the proposed asset tag, run AssetTag -s. - - **Example** - - ``` -C:\assets\AssetTag.exe -s - ``` -To set the proposed asset tag, run AssetTag -s testassettag12. - -**Example** - -``` -C:\assets\AssetTag.exe -s testassettag12 -``` - ->[!NOTE] ->The asset tag value must contain between 1 and 36 characters. Valid characters include A-Z, a-z, 0-9, period (.) and hyphen (-). - - -## Managing asset tags - -You can view the existing asset tag in the UEFI settings under Device -Information (**Control Panel > Recovery > Advanced Startup > Restart -now**.) - -The figure below shows the results of running the Asset Tag Tool on -Surface Go. - -![Results of running Surface Asset Tag tool on Surface Go. -](images/assettag-fig1.png) - -> **Figure 1.** Results of running Surface Asset Tag tool on Surface Go - -Alternately, you can use WMI to query the existing asset tag on a device: - -(Get-WmiObject -query “Select * from Win32_SystemEnclosure”) - -**Example** - - ``` -C:\Windows\System32> (Get-WmiObject -query “Select * from Win32_SystemEnclosure”) - ``` - -### Using PowerShell - -You can use the script below as a way of getting the proposed value and -interpreting any errors. - - ``` -AssetTag -g \> $asset\_tag 2\> $error\_message -$asset\_tag\_return\_code = $LASTEXITCODE -$asset\_tag = $asset\_tag.Trim(“\`r\`n”) - -if ($asset\_tag\_return\_code -eq 0) { -Write-Output (“Good Tag = ” + $asset\_tag) -} else { -Write-Output ( -“Failure: Code = ” + $asset\_tag\_return\_code + -“Tag = ” + $asset\_tag + -“Message = ” + $error\_message) - -} - ``` diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md deleted file mode 100644 index 48b26edcc5..0000000000 --- a/devices/surface/battery-limit.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Battery Limit setting (Surface) -description: Battery Limit is a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article ---- - -# Battery Limit setting - -Battery Limit option is a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. This setting is recommended in cases in which the device is continuously connected to power, for example when devices are integrated into kiosk solutions. - -## Battery Limit information - -Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity. - -Adding the Battery Limit option to Surface UEFI requires a [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. Currently, Battery Limit is supported on a subset of Surface devices and will be available in the future on other Surface device models. - -## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later) - -The Surface UEFI Battery Limit setting can be configured by booting into Surface UEFI (**Power + Vol Up** when turning on the device). Choose **boot configuration**, and then, under **Advanced Options**, toggle **Enable Battery Limit Mode** to **On**. - -![Screenshot of Advanced options](images/enable-bl.png) - -## Enabling Battery Limit in Surface UEFI (Surface Pro 3) - -The Surface UEFI Battery Limit setting can be configured by booting into Surface UEFI (**Power + Vol Up** when turning on the device). Choose **Kiosk Mode**, select **Battery Limit**, and then choose **Enabled**. - -![Screenshot of Advanced options](images/enable-bl-sp3.png) - -![Screenshot of Advanced options](images/enable-bl-sp3-2.png) - -## Enabling Battery Limit using Surface Enterprise Management Mode (SEMM) or Surface Pro 3 firmware PowerShell scripts - -The Surface UEFI battery limit is also available for configuration via the following methods: - -- Surface Pro 4 and later - - [Microsoft Surface UEFI Configurator](https://docs.microsoft.com/surface/surface-enterprise-management-mode) - - Surface UEFI Manager Powershell scripts (SEMM_Powershell.zip) in the [Surface Tools for IT downloads](https://www.microsoft.com/download/details.aspx?id=46703) -- Surface Pro 3 - - [SP3_Firmware_Powershell_Scripts.zip](https://www.microsoft.com/download/details.aspx?id=46703) - -### Using Microsoft Surface UEFI Configurator - -To configure Battery Limit mode, set the **Kiosk Overrides** setting on the **Advanced Settings** configuration page in SEMM (Surface Pro 4 and later). - -![Screenshot of advanced settings](images/semm-bl.png) - -### Using Surface UEFI Manager PowerShell scripts - -The battery limit feature is controlled via the following setting: - -`407 = Battery Profile` - -**Description**: Active management scheme for battery usage pattern - -**Default**: `0` - -Set this to `1` to enable Battery Limit. - -### Using Surface Pro 3 firmware tools - -The battery limit feature is controlled via the following setting: - -**Name**: BatteryLimitEnable - -**Description**: BatteryLimit - -**Current Value**: `0` - -**Default Value**: `0` - -**Proposed Value**: `0` - -Set this to `1` to enable Battery Limit. - ->[!NOTE] ->To configure this setting, you must use [SP3_Firmware_Powershell_Scripts.zip](https://www.microsoft.com/download/details.aspx?id=46703). - diff --git a/devices/surface/breadcrumb/toc.yml b/devices/surface/breadcrumb/toc.yml deleted file mode 100644 index 1ab1f047c2..0000000000 --- a/devices/surface/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Surface - tocHref: /surface - topicHref: /surface/index \ No newline at end of file diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md deleted file mode 100644 index 14eea5c91d..0000000000 --- a/devices/surface/change-history-for-surface.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: Change history for Surface documentation (Windows 10) -ms.reviewer: -manager: dansimp -description: This topic lists new and updated topics in the Surface documentation library. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article ---- - -# Change history for Surface documentation - -This topic lists new and updated topics in the Surface documentation library. - -## July 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) | Renamed to reflect focus on deployment guidance for IT professionals. Covers minor changes in Version 2.41.139.0. | - - - -## June 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -|[Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md) | New introductory page for the Surface Diagnostic Toolkit for Business. | -| [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) |Updated with summary of recommendations for managing power settings and optimizing battery life. | - - -## March 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Surface System SKU reference](surface-system-sku-reference.md) | New | - - -## February 2019 - -New or changed topic | Description ---- | --- -[Surface Asset Tag](assettag.md) | New - - -## January 2019 - -New or changed topic | Description ---- | --- -[Surface Brightness Control](microsoft-surface-brightness-control.md) | New -[Maintain optimal power settings on Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) | New -|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface Studio 2 | - - -## November 2018 - -New or changed topic | Description ---- | --- -|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface Pro 6 | -[Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) | New -[Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) | New -[Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) | New - -## October 2018 - -New or changed topic | Description ---- | --- -[Battery Limit setting](battery-limit.md) | New -|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface GO | - -## May 2018 - -|New or changed topic | Description | -| --- | --- | -|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.58.0 information | -|[Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)](surface-device-compatibility-with-windows-10-ltsc.md) | Removed note box around content | - -## February 2018 - -|New or changed topic | Description | -| --- | --- | -|[Surface Dock Updater](surface-dock-updater.md) | Added version 2.12.136.0 information | -|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.46.0 information | - -## January 2018 - -|New or changed topic | Description | -| --- | --- | -|[Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | New article | -|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.45.0 information | -|[Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)](surface-device-compatibility-with-windows-10-ltsc.md) | Updated Current Branch (CB) or Current Branch for Business (CBB) servicing options with Semi-Annual Channel (SAC) information | -|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, Surface Pro with LTE Advanced, and Surface Pro information | - -## December 2017 - -|New or changed topic | Description | -| --- | --- | -|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, and Surface Pro with LTE Advanced information | - -## November 2017 - -|New or changed topic | Description | -| --- | --- | -|[Surface Dock Updater](surface-dock-updater.md) | Added version 2.7.136.0 information | - -## October 2017 - -New or changed topics | Description ---- | --- -Microsoft Surface Diagnostic Toolkit | Topic removed. The Microsoft Surface Diagnostic Toolkit is no longer available for download. - -## September 2017 - -New or changed topic | Description ---- | --- -[Top support solutions for Surface devices](support-solutions-surface.md) | New - -## June 2017 - -|New or changed topic | Description | -| --- | --- | -|[Surface Data Eraser](microsoft-surface-data-eraser.md) | Update compatible devices, added version 3.2.36 information | -|[Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md) | Added version 2.0.8.0 information | -|[Surface Dock Updater](surface-dock-updater.md) | Added version 2.1.15.0 information | - - -## April 2017 - -|New or changed topic | Description | -| --- | --- | -|[Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md) | New (supersedes [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md))| - - -## January 2017 - -|New or changed topic | Description | -| --- | --- | -|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | New | - -## December 2016 - -|New or changed topic | Description | -| --- | --- | -|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added driver info for Surface Studio; updated info for Surface Book and Surface Pro 4 (Windows 10 .zip cumulative update), Surface Pro 3 (Windows8.1-KB2969817-x64.msu), and Surface 3 (UEFI Asset Tag management tool)| - -## November 2016 - -|New or changed topic | Description | -| --- | --- | -|[Surface Enterprise Management Mode](surface-enterprise-management-mode.md) | Added procedure for viewing certificate thumbprint. | -|[Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) | New | - - - -## October 2016 - -| New or changed topic | Description | -| --- | --- | -| [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) | New | -| [Long-term servicing branch for Surface devices](ltsb-for-surface.md) | New | - - - - -  diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md deleted file mode 100644 index ec997db3be..0000000000 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Considerations for Surface and System Center Configuration Manager (Surface) -description: The management and deployment of Surface devices with Configuration Manager is fundamentally the same as any other PC; this article describes scenarios that may require additional considerations. -keywords: manage, deployment, updates, driver, firmware -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 10/16/2017 -ms.reviewer: -manager: dansimp ---- - -# Considerations for Surface and System Center Configuration Manager - -Fundamentally, management and deployment of Surface devices with System Center Configuration Manager is the same as the management and deployment of any other PC. Like any other PC, a deployment to Surface devices includes importing drivers, importing a Windows image, preparing a deployment task sequence, and then deploying the task sequence to a collection. After deployment, Surface devices are like any other Windows client – to publish apps, settings, and policies, you use the same process that you would use for any other device. - -You can find more information about how to use Configuration Manager to deploy and manage devices in the [Documentation for System Center Configuration Manager](https://docs.microsoft.com/sccm/index). - -Although the deployment and management of Surface devices is fundamentally the same as any other PC, there are some scenarios that may require additional considerations or steps. This article provides descriptions and guidance for these scenarios; the solutions documented in this article may apply to other devices and manufacturers as well. - ->[!NOTE] ->For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager. - -## Updating Surface device drivers and firmware - -For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -As .msi files, deployment of driver and firmware updates is performed in the same manner as deployment of an application. Instead of installing an application as would normally happen when an .msi file is run, the Surface driver and firmware .msi will apply the driver and firmware updates to the device. The single .msi file contains the driver and firmware updates required by each component of the Surface device. The updates for firmware are applied the next time the device reboots. You can read more about the .msi installation method for Surface drivers and firmware in [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). For more information about how to deploy applications with Configuration Manager, see [Packages and programs in System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs). - ->[!NOTE] ->Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2 – for more information see [Can't import drivers into System Center Configuration Manager (KB3025419)](https://support.microsoft.com/kb/3025419). - -## Surface Ethernet adapters and Configuration Manager deployment - -The default mechanism that Configuration Manager uses to identify devices during deployment is the Media Access Control (MAC) address. Because the MAC address is associated with the Ethernet controller, an Ethernet adapter shared among multiple devices will cause Configuration Manager to identify each of the devices as only a single device. This can cause a Configuration Manager deployment of Windows to not be applied to intended devices. - -To ensure that Surface devices using the same Ethernet adapter are identified as unique devices during deployment, you can instruct Configuration Manager to identify devices using another method. This other method could be the MAC address of the wireless network adapter or the System Universal Unique Identifier (System UUID). You can specify that Configuration Manager use other identification methods with the following options: - -* Add an exclusion for the MAC addresses of Surface Ethernet adapters, which forces Configuration Manager to overlook the MAC address in preference of the System UUID, as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. - -* Prestage devices by System UUID as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. - -* Use a script to identify a newly deployed Surface device by the MAC address of its wireless adapter, as documented in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post. - -Another consideration for the Surface Ethernet adapter during deployments with Configuration Manager is the driver for the Ethernet controller. Beginning in Windows 10, version 1511, the driver for the Surface Ethernet adapter is included by default in Windows. For organizations that want to deploy the latest version of Windows 10 and use the latest version of WinPE, use of the Surface Ethernet adapter requires no additional actions. - -For versions of Windows prior to Windows 10, version 1511 (including Windows 10 RTM and Windows 8.1), you may still need to install the Surface Ethernet adapter driver and include the driver in your WinPE boot media. With its inclusion in Windows 10, the driver is no longer available for download from the Microsoft Download Center. To download the Surface Ethernet adapter driver, download it from the Microsoft Update Catalog as documented in the [Surface Ethernet Drivers](https://blogs.technet.microsoft.com/askcore/2016/08/18/surface-ethernet-drivers/) blog post from the Ask The Core Team blog. - -## Deploy Surface app with Configuration Manager - -With the release of Microsoft Store for Business, Surface app is no longer available as a driver and firmware download. Organizations that want to deploy Surface app to managed Surface devices or during deployment with the use of Configuration Manager, must acquire Surface app through Microsoft Store for Business and then deploy Surface app with PowerShell. You can find the PowerShell commands for deployment of Surface app, instructions to download Surface app, and prerequisite frameworks from Microsoft Store for Business in the [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business) article in the TechNet Library. - -## Use prestaged media with Surface clients - -If your organization uses prestaged media to pre-load deployment resources on to machines prior to deployment with Configuration Manager, the nature of Surface devices as UEFI devices may require you to take additional steps. Specifically, a native UEFI environment requires that you create multiple partitions on the boot disk of the system. If you are following along with the [documentation for prestaged media](https://technet.microsoft.com/library/79465d90-4831-4872-96c2-2062d80f5583?f=255&MSPPError=-2147217396#BKMK_CreatePrestagedMedia), the instructions provide for only single partition boot disks and therefore will fail when applied to Surface devices. - -Instructions for applying prestaged media to UEFI devices, such as Surface devices, can be found in the [How to apply Task Sequence Prestaged Media on multi-partitioned disks for BIOS or UEFI PCs in System Center Configuration Manager](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2014/04/02/how-to-apply-task-sequence-prestaged-media-on-multi-partitioned-disks-for-bios-or-uefi-pcs-in-system-center-configuration-manager/) blog post. - -## Licensing conflicts with OEM Activation 3.0 - -Surface devices come preinstalled with a licensed copy of Windows. For example, Surface Pro 4 is preinstalled with Windows 10 Professional. The license key for this preinstalled copy of Windows is embedded in the firmware of the device with OEM Activation 3.0 (OA 3.0). When you run Windows installation media on a device with an OA 3.0 key, Windows setup automatically reads the license key and uses it to install and activate Windows. In most situations, this simplifies the reinstallation of Windows, because the user does not have to find or enter a license key. - -When you reimage a device by using Windows Enterprise, this embedded license key does not cause a conflict. This is because the installation media for Windows Enterprise is configured to install only an Enterprise edition of Windows and therefore is incompatible with the license key embedded in the system firmware. If a product key is not specified (such as when you intend to activate with Key Management Services (KMS) or Active Directory Based Activation), a Generic Volume License Key (GVLK) is used until Windows is activated by one of those technologies. - -However, issues may arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file (see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/library/hh824952.aspx)) to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center. - -## Apply an asset tag during deployment - -Surface Studio, Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post. - -To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.microsoft.com/download/details.aspx?id=44076) during a Configuration Manager deployment task sequence, use the script and instructions found in the [Set Surface Asset Tag During a Configuration Manager Task Sequence](https://blogs.technet.microsoft.com/jchalfant/set-surface-pro-3-asset-tag-during-a-configuration-manager-task-sequence/) blog post. - -## Configure push-button reset - -When you deploy Windows to a Surface device, the push-button reset functionality of Windows is configured by default to revert the system back to a state where the environment is not yet configured. When the reset function is used, the system discards any installed applications and settings. Although in some situations it can be beneficial to restore the system to a state without applications and settings, in a professional environment this effectively renders the system unusable to the end user. - -Push-button reset can be configured, however, to restore the system configuration to a state where it is ready for use by the end user. Follow the process outlined in [Deploy push-button reset features](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/deploy-push-button-reset-features) to customize the push-button reset experience for your devices. diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md deleted file mode 100644 index f160c5977b..0000000000 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Customize the OOBE for Surface deployments (Surface) -description: This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization. -ms.assetid: F6910315-9FA9-4297-8FA8-2C284A4B1D87 -ms.reviewer: -manager: dansimp -keywords: deploy, customize, automate, network, Pen, pair, boot -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 ---- - -# Customize the OOBE for Surface deployments - - -This article walks you through the process of customizing the Surface out-of-box experience for end users in your organization. - -It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE. - ->[!NOTE] ->OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](https://msdn.microsoft.com/library/windows/hardware/dn898581.aspx). - -In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome. - -This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image). - ->[!NOTE] ->Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
          ->- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) ->- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager) - -  - -## Scenario 1: Wireless networking in OOBE with MDT 2013 - - -When a wireless network adapter is present during OOBE, the **Join a wireless network** page is displayed, which prompts a user to connect to a wireless network. This page is not automatically hidden by deployment technologies, including MDT 2013, and therefore will be displayed even when a deployment is configured for complete automation. - -To ensure that an automated deployment is not stopped by this page, the page must be hidden by configuring an additional setting in the answer file, **HideWirelessSetupInOOBE**. You can find additional information about the **HideWirelessSetupInOOBE** setting in [Unattended Windows Setup Reference](https://technet.microsoft.com/library/ff716213.aspx). - -## Scenario 2: Surface Pen pairing in OOBE - - -When you first take a Surface Pro 3, Surface Pro 4, Surface Book, or Surface Studio out of the package and start it up, the first-run experience of the factory image includes a prompt that asks you to pair the included Surface Pen to the device. This prompt is only provided by the factory image that ships with the device and is not included in other images used for deployment, such as the Windows Enterprise installation media downloaded from the Volume Licensing Service Center. Because pairing the Bluetooth Surface Pen outside of this experience requires that you enter the Control Panel or PC Settings and manually pair a Bluetooth device, you may want to have users or a technician use this prompt to perform the pairing operation. - -To provide the factory Surface Pen pairing experience in OOBE, you must copy four files from the factory Surface image into the reference image. You can copy these files into the reference environment before you capture the reference image, or you can add them later by using Deployment Image Servicing and Management (DISM) to mount the image. The four required files are: - -- %windir%\\system32\\oobe\\info\\default\\1033\\oobe.xml -- %windir%\\system32\\oobe\\info\\default\\1033\\PenPairing\_en-US.png -- %windir%\\system32\\oobe\\info\\default\\1033\\PenError\_en-US.png -- %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png - ->[!NOTE] ->You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4. - -  - -The step-by-step process for adding these required files to an image is described in [Deploying Surface Pro 3 Pen and OneNote Tips](https://blogs.technet.microsoft.com/askcore/2014/07/15/deploying-surface-pro-3-pen-and-onenote-tips/). This blog post also includes tips to ensure that the necessary updates for the Surface Pen Quick Note-Taking Experience are installed, which allows users to send notes to OneNote with a single click. - -  - -  - - - - - diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md deleted file mode 100644 index 5c4cc7c4a3..0000000000 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ /dev/null @@ -1,168 +0,0 @@ ---- -title: Deploy Surface app with Microsoft Store for Business or Microsoft Store for Education (Surface) -description: Find out how to add and download Surface app with Microsoft Store for Business or Microsoft Store for Education, as well as install Surface app with PowerShell and MDT. -keywords: surface app, app, deployment, customize -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, store -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 09/21/2017 -ms.reviewer: -manager: dansimp ---- - -# Deploy Surface app with Microsoft Store for Business and Education - -**Applies to** -* Surface Pro 4 -* Surface Book -* Surface 3 - ->[!NOTE] ->The Surface app ships in Surface Studio. - -The Surface app is a lightweight Microsoft Store app that provides control of many Surface-specific settings and options, including: - -* Enable or disable the Windows button on the Surface device - -* Adjust the sensitivity of a Surface Pen - -* Customize Surface Pen button actions - -* Enable or disable Surface audio enhancements - -* Quick access to support documentation and information for your device - -If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Microsoft Store or your Microsoft Store for Business. - -## Surface app overview - -The Surface app is available as a free download from the [Microsoft Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Microsoft Store, but if your organization uses Microsoft Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Microsoft Store for Business, see [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/) in the Windows TechCenter. - -## Add Surface app to a Microsoft Store for Business account - -Before users can install or deploy an app from a company’s Microsoft Store for Business account, the desired app(s) must first be made available and licensed to the users of a business. - -1. If you have not already done so, create a [Microsoft Store for Business account](https://www.microsoft.com/business-store). - -2. Log on to the portal. - -3. Enable offline licensing: click **Manage->Store settings**, and then select the **Show offline licensed apps to people shopping in the store** checkbox, as shown in Figure 1. For more information about Microsoft Store for Business app licensing models, see [Apps in Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/).

          - ![Show offline licenses apps checkbox](images/deploysurfapp-figure1-enablingapps.png "Show offline licenses apps checkbox")
          - *Figure 1. Enable apps for offline use* - -4. Add Surface app to your Microsoft Store for Business account by following this procedure: - * Click the **Shop** menu. - * In the search box, type **Surface app**, and then click the search icon. - * After the Surface app is presented in the search results, click the app’s icon. - * You are presented with a choice (select **Online** or **Offline**), as shown in Figure 2.

          - - ![Select the Offline licensing mode and add the app to your inventory](images/deploysurfapp-fig2-selectingofflinelicense.png "Select the Offline licensing mode and add the app to your inventory") - - *Figure 2. Select the Offline licensing mode and add the app to your inventory* - - * Click **Offline** to select the Offline licensing mode. - * Click **Get the app** to add the app to your Microsoft Store for Business inventory. As shown in Figure 3, you’ll see a dialog box that prompts you to acknowledge that offline apps can be deployed using a management tool or downloaded from the company’s inventory page in their private store. - - ![Offline-licensed app acknowledgement window](images/deploysurfapp-fig3-acknowledge.png "Offline-licensed app acknowledgement window") - - *Figure 3. Offline-licensed app acknowledgement* - * Click **OK**. - -## Download Surface app from a Microsoft Store for Business account -After you add an app to the Microsoft Store for Business account in Offline mode, you can download and add the app as an AppxBundle to a deployment share. -1. Log on to the Microsoft Store for Business account at https://businessstore.microsoft.com. -2. Click **Manage->Apps & software**. A list of all of your company’s apps is displayed, including the Surface app you added in the [Add Surface app to a Microsoft Store for Business account](#add-surface-app-to-a-microsoft-store-for-business-account) section of this article. -3. Under **Actions**, click the ellipsis (**…**), and then click **Download for offline use** for the Surface app. -4. Select the desired **Platform** and **Architecture** options from the available selections for the selected app, as shown in Figure 4. - - ![Example of the AppxBundle package](images/deploysurfapp-fig4-downloadappxbundle.png "Example of the AppxBundle package") - - *Figure 4. Download the AppxBundle package for an app* -5. Click **Download**. The AppxBundle package will be downloaded. Make sure you note the path of the downloaded file because you’ll need that later in this article. -6. Click either the **Encoded license** or **Unencoded license** option. Use the Encoded license option with management tools like System Center Configuration Manager or when you use Windows Configuration Designer to create a provisioning package. Select the Unencoded license option when you use Deployment Image Servicing and Management (DISM) or deployment solutions based on imaging, including the Microsoft Deployment Toolkit (MDT). -7. Click **Generate** to generate and download the license for the app. Make sure you note the path of the license file because you’ll need that later in this article. - ->[!NOTE] ->When you download an app for offline use, such as the Surface app, you may notice a section at the bottom of the page labeled **Required frameworks**. Your target computers must have the frameworks installed for the app to run, so you may need to repeat the download process for each of the required frameworks for your architecture (either x86 or x64) and also include them as part of your Windows deployment discussed later in this article. - -Figure 5 shows the required frameworks for the Surface app. - -![Required frameworks for the Surface app](images/deploysurfapp-fig5-requiredframework.png "Required frameworks for the Surface app") - -*Figure 5. Required frameworks for the Surface app* - ->[!NOTE] ->The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Microsoft Store for Business. Always use the Surface app and recommended framework versions as provided by Microsoft Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes. - -To download the required frameworks for the Surface app, follow these steps: -1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. -2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. - ->[!NOTE] ->Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. - -## Install Surface app on your computer with PowerShell -The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards. -1. Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. -2. Begin an elevated PowerShell session. - - >[!NOTE] - >If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app. - -3. In the elevated PowerShell session, copy and paste the following command: - ``` - Add-AppxProvisionedPackage –Online –PackagePath \ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath \ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml - ``` - - Where `` is the folder where you downloaded the AppxBundle and license file from the Microsoft Store for Business account. - - For example, if you downloaded the files to c:\Temp, the command you run is: - ```` - Add-AppxProvisionedPackage –Online –PackagePath c:\Temp\ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath c:\Temp\ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml - ``` - -4. The Surface app will now be available on your current Windows computer. - -Before the Surface app is functional on the computer where it has been provisioned, you must also provision the frameworks described earlier in this article. To provision these frameworks, use the following procedure in the elevated PowerShell session you used to provision the Surface app. - -5. In the elevated PowerShell session, copy and paste the following command: - ``` - Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx - ``` -6. In the elevated PowerShell session, copy and paste the following command: - ``` - Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx - ``` - -## Install Surface app with MDT -The following procedure uses MDT to automate installation of the Surface app at the time of deployment. The application is provisioned automatically by MDT during deployment and thus you can use this process with existing images. This is the recommended process to deploy the Surface app as part of a Windows deployment to Surface devices because it does not reduce the cross platform compatibility of the Windows image. -1. Using the procedure described [earlier in this article](#download-surface-app-from-a-microsoft-store-for-business-account), download the Surface app AppxBundle and license file. -2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. -3. On the **Command Details** page of the New Application Wizard, specify the default **Working Directory** and for the **Command** specify the file name of the AppxBundle, as follows: - - * Command: - ``` - Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle - ``` - * Working Directory: %DEPLOYROOT%\Applications\SurfaceApp - -For the Surface app to function on the target computer, it will also require the frameworks described earlier in this article. Use the following procedure to import the frameworks required for the Surface app into MDT and to configure them as dependencies. -1. Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder. -2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. -3. On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory. - -To configure the frameworks as dependencies of the Surface app, use this process: -1. Open the properties of the Surface app in the MDT Deployment Workbench. -2. Click the **Dependencies** tab, and then click **Add**. -3. Select the check box for each framework using the name you provided in the New Application Wizard. - -After import, the Surface app will be available for selection in the **Applications** step of the Windows Deployment Wizard. You can also install the application automatically by specifying the application in the deployment task sequence by following this process: -1. Open your deployment task sequence in the MDT Deployment Workbench. -2. Add a new **Install Application** task in the **State Restore** section of deployment. -3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**. - -For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit). diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md deleted file mode 100644 index 78eb4bd170..0000000000 --- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Deploy the latest firmware and drivers for Surface devices (Surface) -description: This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device. -ms.assetid: 7662BF68-8BF7-43F7-81F5-3580A770294A -ms.reviewer: -manager: dansimp -keywords: update Surface, newest, latest, download, firmware, driver, tablet, hardware, device -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.date: 08/13/2018 -ms.author: dansimp -ms.topic: article ---- - -# Deploy the latest firmware and drivers for Surface devices -Although Surface devices are typically automatically updated with the latest device drivers and firmware via Windows Update, sometimes it's necessary to download and install updates manually, such as during a Windows deployment. - -## Download MSI files -To download MSI files, refer to the following Microsoft Support page: - -- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface)
          -Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices. - -## Deploying MSI files -Driver and firmware updates for Surface devices consisting of all required cumulative updates are packaged in separate MSI files for specific versions of Windows 10. - -The MSI file names contain useful information including the minimum supported Windows build number required to install the drivers and firmware. For example, to install the drivers contained in SurfaceBook_Win10_17763_19.080.2031.0.msi requires Windows 10 Fall Creators Update version 1709 or later installed on your Surface Book. - -To view build numbers for each version, refer to [Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information). - -### Surface MSI naming convention -Beginning in August 2019, MSI files use the following naming formula: - -- Product > Windows release > Windows build number > Version number > Revision of version number (typically zero). - -**Example:** -SurfacePro6_Win10_18362_19.073.44195_0.msi : - -| Product | Windows release | Build | Version | Revision of version | -| --- | --- | --- | --- | --- | -| SurfacePro6 | Win10 | 18362 | 19.073.44195 | 0 | -| | | | Indicates key date and sequence information. | Indicates release history of the update. | -| | | | **19:** Signifies the year (2019).
          **073**: Signifies the month (July) and week of the release (3).
          **44195**: Signifies the minute of the month that the MSI file was created. |**0:** Signifies it's the first release of version 1907344195 and has not been re-released for any reason. | - -### Legacy Surface MSI naming convention -Legacy MSI files prior to August 2019 followed the same overall naming formula but used a different method to derive the version number. - -**Example:** -SurfacePro6_Win10_16299_1900307_0.msi : - -| Product | Windows release | Build | Version | Revision of version | -| --- | --- | --- | --- | --- | -| SurfacePro6 | Win10 | 16299 | 1900307 | 0 | -| | | | Indicates key date and sequence information. | Indicates release history of the MSI file. | -| | | | **19:** Signifies the year (2019)
          **003**: Signifies that it’s the third release of 2019.
          **07**: Signifies the product version number. (Surface Pro 6 is officially the seventh version of Surface Pro.) | **0:** Signifies it's the first release of version 1900307 and has not been re-released for any reason. | - -Look to the **version** number to determine the latest files that contain the most recent security updates. For example, you might need to install the newest file from the following list: - - -- SurfacePro6_Win10_16299_1900307_0.msi -- SurfacePro6_Win10_17134_1808507_3.msi -- SurfacePro6_Win10_17763_1808707_3.msi - -The first file — SurfacePro6_Win10_16299_1900307_0.msi — is the newest because its VERSION field has the newest build in 2019; the other files are from 2018. - -## Supported devices -Downloadable MSI files are available for Surface devices from Surface Pro 2 and later. - - -[!NOTE] -There are no downloadable firmware or driver updates available for Surface devices with Windows RT, including Surface RT and Surface 2. Updates can only be applied using Windows Update. - -For more information about deploying Surface drivers and firmware, refer to: - -- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates) - -- [Microsoft Surface support for business](https://www.microsoft.com/surface/support/business) - - -  - - - - - diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md deleted file mode 100644 index ea5592fb85..0000000000 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ /dev/null @@ -1,799 +0,0 @@ ---- -title: Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit (Surface) -description: Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit. -keywords: windows 10 surface, automate, customize, mdt -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 10/16/2017 -ms.reviewer: -manager: dansimp ---- - -# Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit - -**Applies to** -- Surface Studio -- Surface Pro 4 -- Surface Book -- Surface 3 -- Windows 10 - -This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app. When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies. - -By following the procedures in this article, you can create an up-to-date reference image and deploy this image to your Surface devices, a process known as *reimaging*. Reimaging will erase and overwrite the existing environment on your Surface devices. This process allows you to rapidly configure your Surface devices with identical environments that can be configured to precisely fit your organization’s requirements. - -An alternative to the reimaging process is an upgrade process. The upgrade process is non-destructive and instead of erasing the existing environment on your Surface device, it allows you to install Windows 10 while retaining your user data, applications, and settings. You can read about how to manage and automate the upgrade process of Surface devices to Windows 10 at [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md). - -The goal of the deployment process presented in this article is automation. By leveraging the many technologies and tools available from Microsoft, you can create a process that requires only a single touch on the devices being deployed. The automation can load the deployment environment; format the device; prepare an updated Windows image with the drivers required for the device; apply that image to the device; configure the Windows environment with licensing, membership in a domain, and user accounts; install applications; apply any Windows updates that were not included in the reference image; and log out. - -By automating each aspect of the deployment process, you not only greatly decrease the effort involved, but you create a process that can be easily repeated and where human error becomes less of a factor. Take for example a scenario where you create a reference image for the device manually, but you accidentally install conflicting applications and cause the image to become unstable. In this scenario you have no choice but to begin again the manual process of creating your image. If in this same scenario you had automated the reference image creation process, you could repair the conflict by simply editing a step in the task sequence and then re-running the task sequence. - -## Deployment tools - -The deployment process described in this article leverages a number of Microsoft deployment tools and technologies. Some of these tools and technologies are included in Windows client and Windows Server, such as Hyper-V and Windows Deployment Services (WDS), while others are available as free downloads from the [Microsoft Download Center](https://www.microsoft.com/download/windows.aspx). - -#### Microsoft Deployment Toolkit - -The Microsoft Deployment Toolkit (MDT) is the primary component of a Windows deployment. It serves as a unified interface for most of the Microsoft deployment tools and technologies, such as the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), User State Migration Tool (USMT), and many other tools and technologies. Each of these is discussed throughout this article. The unified interface, called the *Deployment Workbench*, facilitates automation of the deployment process through a series of stored deployment procedures, known as a *task sequence*. Along with these task sequences and the many scripts and tools that MDT provides, the resources for a Windows deployment (driver files, application installation files, and image files) are stored in a network share known as the *deployment share*. - -You can download and find out more about MDT at [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). - -#### Windows Assessment and Deployment Kit - -Although MDT is the tool you will interact with most during the deployment process, the deployment tools found in the Windows ADK perform most of the deployment tasks during the deployment process. The resources for deployment are held within the MDT deployment share, but it is the collection of tools included in Windows ADK that access the image files, stage drivers and Windows updates, run the deployment experience, provide instructions to Windows Setup, and back up and restore user data. - -You can download and find out more about the Windows ADK at [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk). - -#### Windows 10 installation media - -Before you can perform a deployment with MDT, you must first supply a set of operating system installation files and an operating system image. These files and image can be found on the physical installation media (DVD) for Windows 10. You can also find these files in the disk image (ISO file) for Windows 10, which you can download from the [Volume Licensing Service Center (VLSC)](https://www.microsoft.com/Licensing/servicecenter/default.aspx). - - ->[!NOTE] ->The installation media generated from the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. - - -#### Windows Server - -Although MDT can be installed on a Windows client, to take full advantage of Windows Deployment Services’ ability to network boot, a full Windows Server environment is recommended. To provide network boot for UEFI devices like Surface with WDS, you will need Windows Server 2008 R2 or later. - - ->[!NOTE] ->To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter). - - -#### Windows Deployment Services - -Windows Deployment Services (WDS) is leveraged to facilitate network boot capabilities provided by the Preboot Execution Environment (PXE) server. The boot media generated by MDT is loaded onto the Surface device simply by pressing Enter at the prompt when the device attempts to boot from the attached network adapter or Surface Dock. - -#### Hyper-V virtualization platform - -The process of creating a reference image should always be performed in a virtual environment. When you use a virtual machine as the platform to build your reference image, you eliminate the need for installation of additional drivers. The drivers for a Hyper-V virtual machine are included by default in the factory Windows 10 image. When you avoid the installation of additional drivers – especially complex drivers that include application components like control panel applications – you ensure that the image created by your reference image process will be as universally compatible as possible. - ->[!NOTE] ->A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment. - -Because customizations are performed by MDT at the time of deployment, the goal of reference image creation is not to perform customization but to increase performance during deployment by reducing the number of actions that need to occur on each deployed device. The biggest action that can slow down an MDT deployment is the installation of Windows updates. When MDT performs this step during the deployment process, it downloads the updates on each deployed device and installs them. By installing Windows updates in your reference image, the updates are already installed when the image is deployed to the device and the MDT update process only needs to install updates that are new since the image was created or are applicable to products other than Windows (for example, Microsoft Office updates). - - ->[!NOTE] ->Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. - - -#### Surface firmware and drivers - -For your deployed Windows environment to function correctly on your Surface devices, you will need to install the drivers used by Windows to communicate with the components of your device. These drivers are available for download in the Microsoft Download Center for each Surface device. You can find the correct Microsoft Download Center page for your device at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -When you browse to the specific Microsoft Download Center page for your device, you will notice that there are two files available for download. One file is a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. The other file is an archive (.zip) file. This file contains the individual driver files that are used during deployment, or for manual installation with Device Manager. The file that you will need to download is the .zip archive file. You can read more about the difference between the firmware and driver pack file types at [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). - - -In addition to the driver files that help Windows communicate with the hardware components of the Surface device, the .zip file you download will also contain firmware updates. These firmware updates will update the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. The firmware of an out-of-date Surface device is thus updated when the device reboots during and after the Windows deployment process. - ->[!NOTE] ->Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices. - -#### Application installation files - -In addition to the drivers that are used by Windows to communicate with the Surface device’s hardware and components, you will also need to provide the installation files for any applications that you want to install on your deployed Surface devices. To automate the deployment of an application, you will also need to determine the command-line instructions for that application to perform a silent installation. In this article, the Surface app and Microsoft Office 365 will be installed as examples of application installation. The application installation process can be used with any application with installation files that can be launched from command line. - ->[!NOTE] ->If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article. - -#### Microsoft Surface Deployment Accelerator - -If you want to deploy only to Surface devices or you want an accelerated method to perform deployment to Surface devices, you can use the Microsoft Surface Deployment Accelerator to generate an MDT deployment share complete with Surface device drivers, Surface apps, and pre-configured task sequences to create a reference image and perform deployment to Surface devices. Microsoft Surface Deployment Accelerator can automatically import boot images into WDS and prepare WDS for network boot (PXE). You can download the Microsoft Surface Deployment Accelerator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. - -### Install the deployment tools - -Before you can configure the deployment environment with Windows images, drivers, and applications, you must first install the deployment tools that will be used throughout the deployment process. The three main tools to be installed are WDS, Windows ADK, and MDT. WDS provides the capacity for network boot, Windows ADK provides several deployment tools that perform specific deployment tasks, and MDT provides automation and a central interface from which to manage and control the deployment process. - -To boot from the network with either your reference virtual machines or your Surface devices, your deployment environment must include a Windows Server environment. The Windows Server environment is required to install WDS and the WDS PXE server. Without PXE support, you will be required to create physical boot media, such as a USB stick to perform your deployment – MDT and Windows ADK will still be required, but Windows Server is not required. Both MDT and Windows ADK can be installed on a Windows client and perform a Windows deployment. - ->[!NOTE] ->To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**. - -#### Install Windows Deployment Services - -Windows Deployment Services (WDS) is a Windows Server role. To add the WDS role to a Windows Server 2012 R2 environment, use the Add Roles and Features Wizard, as shown in Figure 1. Start the Add Roles and Features Wizard from the **Manage** button of **Server Manager**. Install both the Deployment Server and Transport Server role services. - -![Install the Windows Deployment Services role](images/surface-deploymdt-fig1.png "Install the Windows Deployment Services role") - -*Figure 1. Install the Windows Deployment Services server role* - -After the WDS role is installed, you need to configure WDS. You can begin the configuration process from the WDS node of Server Manager by right-clicking your server’s name and then clicking **Windows Deployment Services Management Console**. In the **Windows Deployment Services** window, expand the **Servers** node to find your server, right-click your server, and then click **Configure** in the menu to start the Windows Deployment Services Configuration Wizard, as shown in Figure 2. - -![Configure PXE response for Windows Deployment Services](images/surface-deploymdt-fig2.png "Configure PXE response for Windows Deployment Services") - -*Figure 2. Configure PXE response for Windows Deployment Services* - ->[!NOTE] ->Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration. - -Using the Windows Deployment Services Configuration Wizard, configure WDS to fit the needs of your organization. You can find detailed instructions for the installation and configuration of WDS at [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426). On the **PXE Server Initial Settings** page, be sure to configure WDS so that it will respond to your Surface devices when they attempt to boot from the network. If you have already installed WDS or need to change your PXE server response settings, you can do so on the **PXE Response** tab of the **Properties** of your server in the Windows Deployment Services Management Console. - ->[!NOTE] ->You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role. - -#### Install Windows Assessment and Deployment Kit - -To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows. - ->[!NOTE] ->You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices. - -When you get to the **Select the features you want to install** page, you only need to select the **Deployment Tools** and **Windows Preinstallation Environment (Windows PE)** check boxes to deploy Windows 10 using MDT, as shown in Figure 3. - -![Required options for deployment with MDT](images/surface-deploymdt-fig3.png "Required options for deployment with MDT") - -*Figure 3. Only Deployment Tools and Windows PE options are required for deployment with MDT* - -#### Install Microsoft Deployment Toolkit - -After the Windows ADK installation completes successfully, you can install MDT. When you download MDT, ensure that you download the version that matches the architecture of your deployment server environment. For Windows Server the architecture is 64-bit. Download the MDT installation file that ends in **x64**. When MDT is installed you can use the default options during the installation wizard, as shown in Figure 4. - -![MDT installation with default options](images/surface-deploymdt-fig4.png "MDT installation with default options") - -*Figure 4. Install the Microsoft Deployment Toolkit with default options* - -Before you can open the MDT Deployment Workbench, you must enable execution of scripts in PowerShell. If you do not do this, the following error message may be displayed: *"Initialization Error PowerShell is required to use the Deployment Workbench. Please install PowerShell then relaunch Deployment Workbench."* - -To enable the execution of scripts, run the following cmdlet in PowerShell as an Administrator: - - `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser` - -## Create a reference image - -Now that you have installed the required tools, you can begin the first step of customizing your deployment environment to your needs – create a reference image. Because the reference image should be created in a virtual machine where there is no need for drivers to be installed, and because the reference image will not include applications, you can use the MDT deployment environment almost entirely with default settings. - -### Create a deployment share - -Now that you have the tools installed, the next step is to configure MDT for the creation of a reference image. Before you can perform the process of creating a reference image, MDT needs to be set up with a repository for scripts, images, and other deployment resources. This repository is known as the *deployment share*. After the deployment share is created, you must supply MDT with a complete set of Windows 10 installation files, the last set of tools required before MDT can perform reference image creation. - -To create the deployment share, follow these steps: - -1. Open the Deployment Workbench from your Start menu or Start screen, as shown in Figure 5. - - ![The MDT Deployment Workbench](images/surface-deploymdt-fig5.png "The MDT Deployment Workbench") - - *Figure 5. The MDT Deployment Workbench* - -2. Right-click the **Deployment Shares** folder, and then click **New Deployment Share** to start the New Deployment Share Wizard, as shown in Figure 6. - - ![Summary page of the New Deployment Share Wizard](images/surface-deploymdt-fig6.png "Summary page of the New Deployment Share Wizard") - - *Figure 6. The Summary page of the New Deployment Share Wizard* - -3. Create a new deployment share with New Deployment Share Wizard with the following steps: - - * **Path** – Specify a local folder where the deployment share will reside, and then click **Next**. - - >[!NOTE] - >Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume. - - * **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**. - - >[!NOTE] - >The share name cannot contain spaces. - - >[!NOTE] - >You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer. - - * **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench. - * **Options** – You can accept the default options on this page. Click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the deployment share. - * **Progress** – While the deployment share is being created, a progress bar is displayed on this page to indicate the status of the deployment share creation process. - * **Confirmation** – When the deployment share creation process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Deployment Share Wizard. - -4. When the New Deployment Share Wizard is complete, you can expand the Deployment Shares folder to find your newly created deployment share. -5. You can expand your deployment share, where you will find several folders for the resources, scripts, and components of your MDT deployment environment are stored. - -To secure the deployment share and prevent unauthorized access to the deployment resources, you can create a local user on the deployment share host and configure permissions for that user to have read-only access to the deployment share only. It is especially important to secure access to the deployment share if you intend to automate the logon to the deployment share during the deployment boot process. By automating the logon to the deployment share during the boot of deployment media, the credentials for that logon are stored in plaintext in the bootstrap.ini file on the boot media. - ->[!NOTE] ->If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share. - -You now have an empty deployment share that is ready for you to add the resources that will be required for reference image creation and deployment to Surface devices. - -### Import Windows installation files - -The first resources that are required to perform a deployment of Windows are the installation files from Windows 10 installation media. Even if you have an already prepared reference image, you still need to supply the unaltered installation files from your installation media. The source of these files can be a physical disk, or it can be an ISO file like the download from the Volume Licensing Service Center (VLSC). - ->[!NOTE] ->A 64-bit operating system is required for compatibility with Surface Studio, Surface Pro 4, Surface Book, Surface Pro 3, and Surface 3. - -To import Windows 10 installation files, follow these steps: - -1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench, and then click **New Folder** to open the **New Folder** page, as shown in Figure 7. - - ![Create a new folder on the New Folder page](images/surface-deploymdt-fig7.png "Create a new folder on the New Folder page") - - *Figure 7. Create a new folder on the New Folder page* - -2. On the **New Folder** page a series of steps is displayed, as follows: - * **General Settings** – Enter a name for the folder in the **Folder Name** field (for example, Windows 10 Enterprise), add any comments you want in the **Comments** field, and then click **Next**. - * **Summary** – Review the specified configuration of the new folder on this page, and then click **Next**. - * **Progress** – A progress bar will be displayed on this page while the folder is created. This page will likely pass very quickly. - * **Confirmation** – When the new folder has been created, a **Confirmation** page displays the success of the operation. Click **Finish** to close the **New Folder** page. -3. Expand the Operating Systems folder to see the newly created folder. -4. Right-click the newly created folder, and then click **Import Operating System** to launch the Import Operating System Wizard, as shown in Figure 8. - - ![Import source files with the Import Operating System Wizard](images/surface-deploymdt-fig8.png "Import source files with the Import Operating System Wizard") - - *Figure 8. Import source files with the Import Operating System Wizard* - -5. The Import Operating System Wizard walks you through the import of your operating system files, as follows: - * **OS Type** – Click **Full Set of Source Files** to specify that you are importing the Windows source files from installation media, and then click **Next**. - * **Source** – Click **Browse**, move to and select the folder or drive where your installation files are found, and then click **Next**. - * **Destination** – Enter a name for the new folder that will be created to hold the installation files, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the installation files are imported, a progress bar is displayed on this page. - * **Confirmation** – When the operating system import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Operating System Wizard. -6. Expand the folder you created in Step 1 to see the entry for your newly imported installation files for Windows 10. - -Now that you’ve imported the installation files from the installation media, you have the files that MDT needs to create the reference image and you are ready to instruct MDT how to create the reference image to your specifications. - -### Create reference image task sequence - -As described in the [Deployment tools](#deployment-tools) section of this article, the goal of creating a reference image is to keep the Windows environment as simple as possible while performing tasks that would be common to all devices being deployed. You should now have a basic MDT deployment share configured with default options and a set of unaltered, factory installation files for Windows 10. This simple configuration is perfect for reference image creation because the deployment share contains no applications or drivers to interfere with the process. - ->[!NOTE] ->For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications. - -To create the reference image task sequence, follow these steps: - -1. Right-click the **Task Sequences** folder under your deployment share in the Deployment Workbench, and then click **New Task Sequence** to start the New Task Sequence Wizard, as shown in Figure 9. - - ![Create new task sequence to deploy and update a Windows 10 reference environment](images/surface-deploymdt-fig9.png "Create new task sequence to deploy and update a Windows 10 reference environment") - - *Figure 9. Create a new task sequence to deploy and update a Windows 10 reference environment* - -2. The New Task Sequence Wizard presents a series of steps, as follows: - * **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - * **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. - * **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**. - * **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**. - * **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**. - >[!NOTE] - >During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - * **Progress** – While the task sequence is created, a progress bar is displayed on this page. - * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard. -3. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -4. Select the **Task Sequence** tab to view the steps that are included in the Standard Client Task Sequence template, as shown in Figure 10. - - ![Enable Windows Update in the reference image task sequence](images/surface-deploymdt-fig10.png "Enable Windows Update in the reference image task sequence") - - *Figure 10. Enable Windows Update in the reference image task sequence* - -5. Select the **Windows Update (Pre-Application Installation)** option, located under the **State Restore** folder. -6. Click the **Options** tab, and then clear the **Disable This Step** check box. -7. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option. -8. Click **OK** to apply changes to the task sequence, and then close the task sequence properties window. - -### Generate and import MDT boot media - -To boot the reference virtual machine from the network, the MDT deployment share first must be updated to generate boot media with the resources that have been added in the previous sections. - -To update the MDT boot media, follow these steps: - -1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard, as shown in Figure 11. - - ![Generate boot images with the Update Deployment Share Wizard](images/surface-deploymdt-fig11.png "Generate boot images with the Update Deployment Share Wizard") - - *Figure 11. Generate boot images with the Update Deployment Share Wizard* - -2. Use the Update Deployment Share Wizard to create boot images with the following process: - * **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**. - >[!NOTE] - >Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page. - * **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images. - * **Progress** – While the boot images are being generated, a progress bar is displayed on this page. - * **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard. -3. Confirm that boot images have been generated by navigating to the deployment share in File Explorer and opening the Boot folder. The following files should be displayed, as shown in Figure 12: - * **LiteTouchPE_x86.iso** - * **LiteTouchPE_x86.wim** - * **LiteTouchPE_x64.iso** - * **LiteTouchPE_x64.wim** - - - ![Boot images in the Boot folder after Update Deployment Share Wizard completes](images/surface-deploymdt-fig12.png "Boot images in the Boot folder after Update Deployment Share Wizard completes") - - *Figure 12. Boot images displayed in the Boot folder after completion of the Update Deployment Share Wizard* - -To import the MDT boot media into WDS for PXE boot, follow these steps: - -1. Open Windows Deployment Services from the Start menu or Start screen. -2. Expand **Servers** and your deployment server. -3. Click the **Boot Images** folder, as shown in Figure 13. - - ![Start the Add Image Wizard from the Boot Images folder](images/surface-deploymdt-fig13.png "Start the Add Image Wizard from the Boot Images folder") - - *Figure 13. Start the Add Image Wizard from the Boot Images folder* - -4. Right-click the **Boot Images** folder, and then click **Add Boot Image** to open the Add Image Wizard, as shown in Figure 14. - - ![Import the LiteTouchPE_x86.wim MDT boot image](images/surface-deploymdt-fig14.png "Import the LiteTouchPE_x86.wim MDT boot image") - - *Figure 14. Import the LiteTouchPE_x86.wim MDT boot image* - -5. The Add Image Wizard displays a series of steps, as follows: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, click **Open**, and then click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. - ->[!NOTE] ->Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine. - -If your WDS configuration is properly set up to respond to PXE clients, you should now be able to boot from the network with any device with a network adapter properly configured for network boot (PXE). - ->[!NOTE] ->If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351). - -### Deploy and capture a reference image - -Your deployment environment is now set up to create a reference image for Windows 10 complete with Windows Updates. - ->[!NOTE] ->You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.

          -By using a fully automated task sequence in an MDT deployment share dedicated to reference image creation, you can greatly reduce the time and effort required to create new reference images and it is the best way to ensure that your organization is ready for feature updates and new versions of Windows 10. - -You can now boot from the network with a virtual machine to run the prepared task sequence and generate a reference image. When you prepare your virtual machine in Hyper-V for reference image creation, consider the following: - -* Use a Generation 1 virtual machine for the simplicity of drivers and to ensure maximum compatibility with both BIOS and UEFI devices. -* Ensure your virtual machine has at least 1 GB of system memory at boot. You can ensure that the virtual machine has at least 1 GB of memory at boot but allow the memory to adjust after boot by using Dynamic Memory. You can read more about Dynamic Memory in the [Hyper-V Dynamic Memory Overview](https://technet.microsoft.com/library/hh831766). -* Ensure your virtual machine uses a legacy network adapter to support network boot (PXE); that network adapter should be connected to the same network as your deployment server, and that network adapter should receive an IP address automatically via DHCP. -* Configure your boot order such that PXE Boot is the first option. - -When your virtual machine (VM) is properly configured and ready, start or boot the VM and be prepared to press the F12 key when prompted to boot via PXE from the WDS server. - -Perform the reference image deployment and capture using the following steps: - -1. Start your virtual machine and press the F12 key when prompted to boot to the WDS server via PXE, as shown in Figure 15. - - ![Start network boot by pressing the F12 key](images/surface-deploymdt-fig15.png "Start network boot by pressing the F12 key") - - *Figure 15. Start network boot by pressing the F12 key* - -2. Click **Run the Deployment Wizard to Install a New Operating System** to begin the MDT deployment process. -3. Enter your MDT username and password, a user with rights to access the MDT deployment share over the network and with rights to write to the Captures folder in the deployment share. -4. After your credentials are validated, the Windows Deployment Wizard will start and process the boot and deployment share rules. -5. The Windows Deployment Wizard displays a series of steps, as follows: - * **Task Sequence** – Select the task sequence you created for reference image creation (it should be the only task sequence available), and then click **Next**. - * **Computer Details** – Leave the default computer name, workgroup name, and the **Join a Workgroup** option selected, and then click **Next**. The computer name and workgroup will be reset when the image is prepared by Sysprep and captured. - * **Move Data and Settings** – Leave the default option of **Do Not Move User Data and Settings** selected, and then click **Next**. - * **User Data (Restore)** – Leave the default option of **Do Not Restore User Data and Settings** selected, and then click **Next**. - * **Locale and Time** – Leave the default options for language and time settings selected. The locale and time settings will be specified during deployment of the image to other devices. Click **Next**. - * **Capture Image** – Click the **Capture an Image of this Reference Computer** option, as shown in Figure 16. In the **Location** field, keep the default location of the Captures folder. You can keep or change the name of the image file in the **File Name** field. When you are finished, click **Next**. - - ![Capture an image of the reference machine](images/surface-deploymdt-fig16.png "Capture an image of the reference machine") - - *Figure 16. Use the Capture Image page to capture an image of the reference machine after deployment* - - * **Ready** – You can review your selections by expanding **Details** on the **Ready** page. Click **Begin** when you are ready to perform the deployment and capture of your reference image. - -6. Your reference task sequence will run with the specified options. - -As the task sequence processes the deployment, it will automatically perform the following tasks: -* Install the Windows 10 image from the installation files you supplied -* Reboot into Windows 10 -* Run Windows updates until all Windows updates have been installed and the Windows environment is fully up to date -* Run Sysprep and prepare the Windows 10 environment for deployment -* Reboot into WinPE -* Capture an image of the Windows 10 environment and store it in the Captures folder in the MDT deployment share - ->[!NOTE] ->The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment. - -When the task sequence completes, your virtual machine will be off and a new reference image complete with updates will be ready in your MDT deployment share for you to import it and prepare your deployment environment for deployment to Surface devices. - -## Deploy Windows 10 to Surface devices - -With a freshly prepared reference image, you are now ready to configure the deployment process for deployment to the Surface devices. Use the steps detailed in this section to produce a deployment process that requires minimal effort on each Surface device to produce a complete and ready-to-use Windows 10 environment. - -### Import reference image - -After the reference image has been created and stored in the Captures folder, you need to add it to your MDT deployment share as an image for deployment. You perform this task by using the same process that you used to import the installation files for Windows 10. - -To import the reference image for deployment, use the following steps: - -1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench or the folder you created in when you imported Windows 10 installation files, and then click **Import Operating System** to start the Import Operating System Wizard. -2. Import the custom image with the Import Operating System Wizard by using the following steps: - * **OS Type** – Select Custom Image File to specify that you are importing the Windows source files from installation media, and then click **Next**. - * **Image** – Click **Browse**, and then navigate to and select the image file in the **Captures** folder in your deployment share. Select the **Move the Files to the Deployment Share Instead of Copying Them** checkbox if desired. Click **Next**. - * **Setup** – Click **Setup Files are not Neededf**, and then click **Next**. - * **Destination** – Enter a name for the new folder that will be created to hold the image file, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the image is imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard. -3. Expand the folder in which you imported the image to verify that the import completed successfully. - ->[!NOTE] ->You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media. - -Now that your updated reference image is imported, it is time to prepare your deployment environment for deployment to Surface devices complete with drivers, applications, and automation. - -### Import Surface drivers - -Before you can deploy your updated reference image to Surface devices, or any physical environment, you need to supply MDT with the drivers that Windows will use to communicate with that physical environment. For Surface devices you can download all of the drivers required by Windows in a single archive (.zip) file in a format that is ready for deployment. In addition to the drivers that are used by Windows to communicate with the hardware and components, Surface firmware and driver packs also include updates for the firmware of those components. By installing the Surface firmware and driver pack, you will also bring your device’s firmware up to date. If you have not done so already, download the drivers for your Surface device listed at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -Many devices require that you import drivers specifically for WinPE in order for the MDT boot media to communicate with the deployment share and to boot properly on that device. Even Surface Pro 3 required that network drivers be imported specifically for WinPE for deployment of Windows 8.1. Fortunately, for Windows 10 deployments to Surface devices, all of the required drivers for operation of WinPE are contained within the out-of-box drivers that are built into Windows 10. It is still a good idea to prepare your environment with folder structure and selection profiles that allow you to specify drivers for use in WinPE. You can read more about that folder structure in **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec05). - -To import the Surface drivers (in this example, Surface Pro 4) into MDT, follow these steps: - -1. Extract the downloaded archive (.zip) file to a folder that you can easily locate. Keep the driver files separate from other drivers or files. -2. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. -3. If you have not already created a folder structure by operating system version, you should do so now and create under the Windows 10 x64 folder a new folder for Surface Pro 4 drivers named Surface Pro 4. Your Out-of-Box Drivers folder should resemble the following structure, as shown in Figure 17: - * WinPE x86 - * WinPE x64 - * Windows 10 x64 - * Microsoft Corporation - * Surface Pro 4 - - ![Recommended folder structure for drivers](images/surface-deploymdt-fig17.png "Recommended folder structure for drivers") - - *Figure 17. The recommended folder structure for drivers* - -4. Right-click the **Surface Pro 4** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 18. - - ![Progress page during drivers import](images/surface-deploymdt-fig18.png "Progress page during drivers import") - - *Figure 18. The Progress page during drivers import* - -5. The Import Driver Wizard displays a series of steps, as follows: - * **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 4 firmware and drivers in Step 1. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the drivers are imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard. -6. Click the **Surface Pro 4** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 19. - - ![Drivers for Surface Pro 4 imported and organized in the MDT deployment share](images/surface-deploymdt-fig19.png "Drivers for Surface Pro 4 imported and organized in the MDT deployment share") - - *Figure 19. Drivers for Surface Pro 4 imported and organized in the MDT deployment share* - -### Import applications - -You can import any number of applications into MDT for installation on your devices during the deployment process. You can configure your applications and task sequences to prompt you during deployment to pick and choose which applications are installed, or you can use your task sequence to explicitly define which applications are installed. For more information, see **Step 4: Add an application** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec04). - -#### Import Microsoft Office 365 Installer - -The Office Deployment Tool is a free download available in the Microsoft Download Center that allows IT professionals and system administrators to download and prepare Office installation packages for Office Click-to-Run. You can find the Office Deployment Tool and instructions to download Click-to-Run for Office 365 installation source files at [Download Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/library/jj219424). - -Download and install the version of Office Deployment Tool (ODT), for Office 2013 or Office 2016, that fits your organization’s needs and use the steps provided by that page to download the Office installation files for use with MDT. - -After you have downloaded the source files for your version of Office Click-to-Run, you need to edit the Configuration.xml file with instructions to install Office Click-to-Run silently. To configure the Office Deployment Tool for silent installation, follow these steps: - -1. Right-click the existing **Configuration.xml** file, and then click **Edit**. -2. This action opens the file in Notepad. Replace the existing text with the following: - ``` - - - - - - - - ``` - -3. Save the file. - -The default behavior of Setup.exe is to look for the source files in the path that contains **Setup.exe**. If the installation files are not found in this folder, the Office Deployment Tool will default to online source files from an Internet connection. - -For MDT to perform an automated installation of office, it is important to configure the **Display Level** option to a value of **None**. This setting is used to suppress the installation dialog box for silent installation. It is required that the **AcceptEULA** option is set to **True** to accept the license agreement when the **Display Level** option is set to **None**. With both of these options configured, the installation of Office will occur without the display of dialog boxes which could potentially cause the installation to pause until a user can address an open dialog box. - -Now that the installation and configuration files are prepared, the application can be imported into the deployment share by following these steps: - -1. Open the Deployment Workbench. -2. Expand the deployment share, right-click the **Applications** folder, and then click **New Application** to start the New Application Wizard, as shown in Figure 20. - - ![Enter the command and directory for Office 2016 Click-to-Run](images/surface-deploymdt-fig20.png "Enter the command and directory for Office 2016 Click-to-Run") - - *Figure 20. Enter the command and directory for Office 2016 Click-to-Run* - -3. The New Application Wizard walks you through importing the Office 2016 Click-to-Run files, as follows: - * **Application Type** – Click **Application with Source Files**, and then click **Next**. - * **Details** – Enter a name for the application (for example, Office 2016 Click-to-Run) in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**. - * **Source** – Click **Browse** to navigate to and select the folder where you downloaded the Office installation files with the Office Deployment Tool, and then click **Next**. - * **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name. - * **Command Details** – Enter the Office Deployment Tool installation command line: - - `Setup.exe /configure configuration.xml` - - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the installation files are imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard. - -4. You should now see the **Office 2016 Click-to-Run** item under the **Applications** folder in the Deployment Workbench. - -#### Import Surface app installer - -The Surface app is a Microsoft Store app that provides the user with greater control over specific Surface device functions and capabilities (for example, control over the sensitivity of the Surface Pen). It is a highly recommended app for Surface devices to provide end users with the best experience and greatest control over their device. Find out more about the Surface app at [Install and use the Surface app](https://www.microsoft.com/surface/support/apps-and-windows-store/surface-app?os=windows-10). - -To perform a deployment of the Surface app, you will need to download the app files through Microsoft Store for Business. You can find detailed instructions on how to download the Surface app through Microsoft Store for Business at [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business). - -After you have downloaded the installation files for Surface app, including the AppxBundle and license files, you can import these files into the deployment share through the same process as a desktop application like Microsoft Office. Both the AppxBundle and license files must be together in the same folder for the import process to complete successfully. Use the following command on the **Command Details** page to install the Surface app: - ``` -DISM.exe /Online /Add-ProvisionedAppxPackage /PackagePath: Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle /LicensePath: Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml - ``` - -### Create deployment task sequence - -The next step in the process is to create the deployment task sequence. This task sequence will be configured to completely automate the deployment process and will work along with customized deployment share rules to reduce the need for user interaction down to a single touch. Before you can make customizations to include all of this automation, the new task sequence has to be created from a template. - -To create the deployment task sequence, follow these steps: -1. In the Deployment Workbench, under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. -2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: - * **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - * **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. - * **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**. - * **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. - * **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - * **Progress** – While the task sequence is being created, a progress bar is displayed on this page. - * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard. - -After the task sequence is created it can be modified for increased automation, such as the installation of applications without user interaction, the selection of drivers, and the installation of Windows updates. - -1. Click the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -2. Click the **Task Sequence** tab to view the steps that are included in the new task sequence. -3. Click the **Windows Update (Pre-Application Installation)** step, located under the **State Restore** folder. -4. Click the **Options** tab, and then clear the **Disable This Step** check box. -5. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option. -6. Between the two **Windows Update** steps is the **Install Applications** step. Click the **Install Applications** step, and then click **Add**. -7. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 21. - - ![A new Install Application step in the deployment task sequence](images/surface-deploymdt-fig21.png "A new Install Application step in the deployment task sequence") - - *Figure 21. A new Install Application step in the deployment task sequence* - -8. On the **Properties** tab of the new **Install Application** step, enter **Install Microsoft Office 2016 Click-to-Run** in the **Name** field. -9. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**. -11. Repeat Steps 6 through 10 for the Surface app. -12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step. -13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. -14. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 22), configure the following options: - * **Name** – Set DriverGroup001 - * **Task Sequence Variable** – DriverGroup001 - * **Value** – Windows 10 x64\%Make%\%Model% - - ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-deploymdt-fig22.png "Configure a new Set Task Sequence Variable step in the deployment task sequence") - - *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence* - -15. Select the **Inject Drivers** step, the next step in the task sequence. -16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: - * In the **Choose a selection profile** drop-down menu, select **Nothing**. - * Click the **Install all drivers from the selection profile** button. - - ![Configure deployment task sequence not to choose the drivers to inject into Windows](images/surface-deploymdt-fig23.png "Configure deployment task sequence not to choose the drivers to inject into Windows") - - *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows* - -17. Click **OK** to apply changes to the task sequence and close the task sequence properties window. - -### Configure deployment share rules - -The experience of users during a Windows deployment is largely governed by a set of rules that control how the MDT and Windows Deployment Wizard experience should proceed. These rules are stored in two configuration files. Boot media rules are stored in the Bootstrap.ini file that is processed when the MDT boot media is first run. Deployment share rules are stored in the Customsettings.ini file and tell the Windows Deployment Wizard how to operate (for example, what screens to show and what questions to ask). By using these the rules stored in these two files, you can completely automate the process of deployment to where you will not be asked to supply the answer to any questions during deployment and the deployment will perform all tasks completely on its own. - -#### Configure Bootstrap.ini - -Bootstrap.ini is the simpler of the two rule files. The purpose it serves is to provide instructions from when the MDT boot media starts on a device until the Windows Deployment Wizard is started. The primary use of this file is to provide the credentials that will be used to log on to the deployment share and start the Windows Deployment Wizard. - -To automate the boot media rules, follow these steps: - -1. Right-click your deployment share in the Deployment Workbench, and then click **Properties**. -2. Click the **Rules** tab, and then click **Edit Bootstrap.ini** to open Bootstrap.ini in Notepad. -3. Replace the text of the Bootstrap.ini file with the following text: - - ``` - [Settings] - Priority=Model,Default - - [Surface Pro 4] - DeployRoot=\\STNDeployServer\DeploymentShare$ - UserDomain=STNDeployServer - UserID=MDTUser - UserPassword=P@ssw0rd - SkipBDDWelcome=YES - - [Surface Pro 4] - DeployRoot=\\STNDeployServer\DeploymentShare$ - ``` - -4. Press Ctrl+S to save Bootstrap.ini, and then close Notepad. - -You can use a number of variables in both boot media and deployment share rules to apply rules only when certain conditions are met. For example, you can use MAC addresses to identify specific machines where MDT will run fully automated, but will run with required user interaction on all other devices. You can also use the model of the device to instruct the MDT boot media to perform different actions based on computer model, much as the way **[Surface Pro 4]** is listed in Step 3. You can use the following cmdlet in a PowerShell session to see what the Model variable would be on a device: - -```wmic csproduct get name``` - -Rules used in the text shown in Step 3 include: - -* **DeployRoot** – Used to specify the deployment share that the MDT boot media will connect to. -* **UserDomain** – Used to specify the domain or computer where the MDT user account is located. -* **UserID** – Used to specify the MDT user account for automatic logon to the deployment share. -* **UserPassword** – Used to specify the MDT user password for automatic logon to the deployment share. -* **SkipBDDWelcome** – Used to skip the Welcome page and to start the Windows Deployment Wizard immediately using the specified credentials and deployment share. - -#### Configure CustomSettings.ini - -The bulk of the rules used to automate the MDT deployment process are stored in the deployment share rules, or the Customsettings.ini file. In this file you can answer and hide all of the prompts from the Windows Deployment Wizard, which yields a deployment experience that mostly consists of a progress bar that displays the automated actions occurring on the device. The deployment share rules are shown directly in the **Rules** tab of the deployment share properties, as shown in Figure 24. - -![Deployment share rules configured for automation of the Windows Deployment Wizard](images/surface-deploymdt-fig24.png "Deployment share rules configured for automation of the Windows Deployment Wizard") - -*Figure 24. Deployment share rules configured for automation of the Windows Deployment Wizard* - -To configure automation for the production deployment, copy and paste the following text into the text box on the **Rules** tab of your deployment share properties: - - ``` -[Settings] -Priority=Model,Default -Properties=MyCustomProperty - -[Surface Pro 4] -SkipTaskSequence=YES -TaskSequenceID=Win10SP4 - -[Default] -OSInstall=Y -SkipCapture=YES -SkipAdminPassword=YES -SkipProductKey=YES -SkipComputerBackup=YES -SkipBitLocker=YES -SkipBDDWelcome=YES -SkipUserData=YES -UserDataLocation=AUTO -SkipApplications=YES -SkipPackageDisplay=YES -SkipComputerName=YES -SkipDomainMembership=YES -JoinDomain=contoso.com -DomainAdmin=MDT -DomainAdminDomain=contoso -DomainAdminPassword=P@ssw0rd -SkipLocaleSelection=YES -KeyboardLocale=en-US -UserLocale=en-US -UILanguage=en-US -SkipTimeZone=YES -TimeZoneName=Pacific Standard Time -UserID=MDTUser -UserDomain=STNDeployServer -UserPassword=P@ssw0rd -SkipSummary=YES -SkipFinalSummary=YES -FinishAction=LOGOFF - ``` -Rules used in this example include: - -* **SkipTaskSequence** – This rule is used to skip the **Task Sequence** page where the user would have to select between available task sequences. -* **TaskSequenceID** – This rule is used to instruct the Windows Deployment Wizard to run a specific task sequence. In this scenario the task sequence ID should match the deployment task sequence you created in the previous section. -* **OSInstall** – This rule indicates that the Windows Deployment Wizard will be performing an operating system deployment. -* **SkipCapture** – This rule prevents the **Capture Image** page from being displayed, prompting the user to create an image of this device after deployment. -* **SkipAdminPassword** – This rule prevents the **Admin Password** page from being displayed. The Administrator password specified in the task sequence will still be applied. -* **SkipProductKey** – This rule prevents the **Specify Product Key** page from being displayed. The product key specified in the task sequence will still be applied. -* **SkipComputerBackup** – This rule prevents the **Move Data and Settings** page from being displayed, where the user is asked if they would like to make a backup of the computer before performing deployment. -* **SkipBitLocker** – This rule prevents the **BitLocker** page from being displayed, where the user is asked if BitLocker Drive Encryption should be used to encrypt the device. -* **SkipBDDWelcome** – This rule prevents the **Welcome** page from being displayed, where the user is prompted to begin Windows deployment. -* **SkipUserData** – This rule prevents the **User Data (Restore)** page from being displayed, where the user is asked to restore previously backed up user data in the new environment. -* **UserDataLocation** – This rule prevents the user from being prompted to supply a location on the User Data (Restore) page. -* **SkipApplications** – This rule prevents the **Applications** page from being displayed, where the user is prompted to select from available applications to be installed in the new environment. -* **SkipPackageDisplay** – This rule prevents the **Packages** page from being displayed, where the user is prompted to select from available packages to be installed in the new environment. -* **SkipComputerName** – This rule, when combined with the **SkipDomainMembership** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup. -* **SkipDomainMembership** – This rule, when combined with the **SkipComputerName** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup. -* **JoinDomain** – This rule instructs the Windows Deployment Wizard to have the computer join the specified domain using the specified credentials. -* **DomainAdmin** – This rule specifies the username for the domain join operation. -* **DomainAdminDomain** – This rule specifies the domain for the username for the domain join operation. -* **DomainAdminPassword** – This rule specifies the password for the username for the domain join operation. -* **SkipLocaleSelection** – This rule, along with the **SkipTimeZone** rule, prevents the **Locale and Time** page from being displayed. -* **KeyboardLocale** – This rule is used to specify the keyboard layout for the deployed Windows environment. -* **UserLocale** – This rule is used to specify the geographical locale for the deployed Windows environment. -* **UILanguage** – This rule is used to specify the language to be used in the deployed Windows environment. -* **SkipTimeZone** – This rule, along with the **SkipLocaleSelection** rule, prevents the **Locale and Time** page from being displayed. -* **TimeZoneName** – This rule is used to specify the time zone for the deployed Windows environment. -* **UserID** – This rule is used to supply the username under which the MDT actions and task sequence steps are performed. -* **UserDomain** – This rule is used to supply the domain for the username under which the MDT actions and task sequence steps are performed. -* **UserPassword** – This rule is used to supply the password for the username under which the MDT actions and task sequence steps are performed. -* **SkipSummary** – This rule prevents the **Summary** page from being displayed before the task sequence is run, where the user is prompted to confirm the selections before beginning the task sequence. -* **SkipFinalSummary** – This rule prevents the **Summary** page from being displayed when the task sequence has completed. -* **FinishAction** – This rule specifies whether to log out, reboot, or shut down the device after the task sequence has completed. - -You can read about all of the possible deployment share and boot media rules in the [Microsoft Deployment Toolkit Reference](https://technet.microsoft.com/library/dn781091). - -### Update and import updated MDT boot media - -The process to update MDT boot media with these new rules and changes to the deployment share is very similar to the process to generate boot media from scratch. - -To update the MDT boot media, follow these steps: - -1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard. -2. The Update Deployment Share Wizard displays a series of steps, as follows: - * **Options** – Choose between the **Completely Regenerate the Boot Images** or **Optimize the Boot Image Updating Process** options. Completely regenerating the boot images will take more time, but produces boot media that is not fragmented and does not contain out of date components. Optimizing the boot image updating process will proceed more quickly, but may result in longer load times when booting via PXE. Click **Next**. - * **Summary** – Review the specified options on this page before you click **Next** to begin the update of boot images. - * **Progress** – While the boot images are being updated a progress bar is displayed on this page. - * **Confirmation** – When the boot images have been updated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard. - -To import the updated MDT boot media into WDS for PXE boot, follow these steps: - -1. Open Windows Deployment Services from the Start menu or Start screen. -2. Expand **Servers** and your deployment server. -3. Click the **Boot Images** folder. -4. Right-click the existing MDT boot image, and then click **Replace Image** to open the Replace Boot Image Wizard. -5. Replace the previously imported MDT boot image with the updated version by using these steps in the Replace Boot Image Wizard: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, and then click **Open**. Click **Next**. - * **Available Images** – Only one image should be listed and selected **LiteTouch Windows PE (x86)**, click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections for importing a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Replace Boot Image Wizard. -6. Right-click the **Boot Images** folder, and then click **Add Image** to open the Add Image Wizard. -7. Add the new 64-bit boot image for 64-bit UEFI device compatibility with the Add Image Wizard , as follows: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, select **LiteTouchPE_x64.wim**, and then click **Open**. Click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. - ->[!NOTE] ->Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices. - -### Deploy Windows to Surface - -With all of the automation provided by the deployment share rules and task sequence, performing the deployment on each Surface device becomes as easy as a single touch. - ->[!NOTE] ->For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25. - -![Set boot priority for PXE boot](images/surface-deploymdt-fig25.png "Set boot priority for PXE boot") - -*Figure 25. Setting boot priority for PXE boot* - -On a properly configured Surface device, simply turn on the device and press Enter when you are prompted to boot from the network. The fully automated MDT deployment process will then take over and perform the following tasks: - -* The MDT boot media will be loaded to your Surface device via the network -* The MDT boot media will use the provided credentials and rules to connect to the MDT deployment share -* The task sequence and drivers will be automatically selected for your device via make and model information -* The task sequence will deploy your updated Windows 10 image to the device complete with the selected drivers -* The task sequence will join your device to the domain -* The task sequence will install the applications you specified, Microsoft Office and Surface app -* Windows Update will run, installing any new Windows Updates or updates for installed applications, like Microsoft Office -* The task sequence will complete silently and log out of the device - ->[!NOTE] ->For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device. - -The resulting configuration is a Surface device that is logged out and ready for an end user to enter their credentials, log on, and get right to work. The applications and drivers they need are already installed and up to date. - - - - diff --git a/devices/surface/deploy.md b/devices/surface/deploy.md deleted file mode 100644 index c0b2ec4e85..0000000000 --- a/devices/surface/deploy.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Deploy Surface devices (Surface) -description: Get deployment guidance for your Surface devices including information about MDT, OOBE customization, Ethernet adaptors, and Surface Deployment Accelerator. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article ---- - -# Deploy Surface devices - -Get deployment guidance for your Surface devices including information about Microsoft Deployment Toolkit (MDT), out-of-box-experience (OOBE) customization, Ethernet adaptors, Surface Deployment Accelerator, and the Battery Limit setting. - -## In this section - -| Topic | Description | -| --- | --- | -| [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | Find out how to remotely deploy and configure devices with Windows Autopilot. | -| [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md) | Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSC edition. | -| [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) | Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit.| -| [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)| Find out how to perform a Windows 10 upgrade deployment to your Surface devices. | -| [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)| Walk through the process of customizing the Surface out-of-box experience for end users in your organization.| -| [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)| Get guidance and answers to help you perform a network deployment to Surface devices.| -| [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)| See how Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices. | -[Battery Limit setting](battery-limit.md) | Learn how to use Battery Limit, a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. - - - -  - -## Related topics - - -[Surface TechCenter](https://technet.microsoft.com/windows/surface) - -[Surface for IT pros blog](http://blogs.technet.com/b/surface/) - -  - -  - - - - - diff --git a/devices/surface/docfx.json b/devices/surface/docfx.json index 026be430c1..42faacbcac 100644 --- a/devices/surface/docfx.json +++ b/devices/surface/docfx.json @@ -37,11 +37,22 @@ "depot_name": "Win.surface", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ], + "titleSuffix": "Surface" }, "externalReference": [], "template": "op.html", "dest": "devices/surface", "markdownEngineName": "markdig" - } +} } diff --git a/devices/surface/documentation/surface-system-sku-reference.md b/devices/surface/documentation/surface-system-sku-reference.md deleted file mode 100644 index c0aa8460a0..0000000000 --- a/devices/surface/documentation/surface-system-sku-reference.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Surface System SKU reference -description: This topic provides a reference of System SKU names that you can use to quickly determine the machine state of a specific device. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 03/12/2019 ---- -# Surface System SKU Reference -This document provides a reference of System SKU names that you can use to quickly determine the machine state of a specific device using PowerShell, WMI, and related tools. - -System SKU is a variable (along with System Model and others) stored in System Management BIOS (SMBIOS) tables in the UEFI layer of Surface devices. Use the System SKU name whenever you need to differentiate between devices with the same System Model name, such as Surface Pro and Surface Pro with LTE Advanced. - -| **Device**| **System Model** | **System SKU**| -| --- | ---| --- | -| Surface 3 WiFI | Surface 3 | Surface_3 | -| Surface 3 LTE AT&T | Surface 3 | Surface_3_US1 | -| Surface 3 LTE Verizon | Surface 3 | Surface_3_US2 | -| Surface 3 LTE North America | Surface 3 | Surface_3_NAG | -| Surface 3 LTE Outside of North America and T-Mobile In Japan | Surface 3 | Surface_3_ROW | -| Surface Pro | Surface Pro | Surface_Pro_1796 | -| Surface Pro with LTE Advanced | Surface Pro | Surface_Pro_1807 | -| Surface Book 2 13inch | Surface Book 2 | Surface_Book_1832 | -| Surface Book 2 15inch | Surface Book 2 | Surface_Book_1793 | -| Surface Go Consumer | Surface Go | Surface_Go_1824_Consumer | -| Surface Go Commercial | Surface Go | Surface_Go_1824_Commercial | -| Surface Pro 6 Consumer | Surface Pro 6 | Surface_Pro_6_1796_Consumer | -| Surface Pro 6 Commercial | Surface Pro 6 | Surface_Pro_6_1796_Commercial | -| Surface Laptop 2 Consumer | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer | -| Surface Laptop 2 Commercial | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial | - -## Using System SKU variables - -### PowerShell - - gwmi -namespace root\wmi -class MS_SystemInformation | select SystemSKU - -### System Information -You can also find the System SKU and System Model for a device in System Information. -- Click **Start** > **MSInfo32**. - -### WMI -You can use System SKU variables in a Task Sequence WMI Condition in the Microsoft Deployment Toolkit (MDT) or System Center Configuration Manager. For example: - - - WMI Namespace – Root\WMI - - WQL Query – SELECT * FROM MS_SystemInformation WHERE SystemSKU = "Surface_Pro_1796" - - - - - - diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md deleted file mode 100644 index 580498d41a..0000000000 --- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices (Surface) -description: Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. -ms.assetid: A281EFA3-1552-467D-8A21-EB151E58856D -ms.reviewer: -manager: dansimp -keywords: network, wireless, device, deploy, authentication, protocol -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 ---- - -# Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices - - -Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. - -If you use PEAP, EAP-FAST, or Cisco LEAP in your enterprise network, you probably already know that these three wireless authentication protocols are not supported by Surface devices out of the box. Some users may discover this when they attempt to connect to your wireless network; others may discover it when they are unable to gain access to resources inside the network, like file shares and internal sites. For more information, see [Extensible Authentication Protocol](https://technet.microsoft.com/network/bb643147). - -You can add support for each protocol by executing a small MSI package from a USB stick or from a file share. For organizations that want to enable EAP support on their Surface devices, the MSI package format supports deployment with many management and deployment tools, like the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. - -## Download PEAP, EAP-FAST, or Cisco LEAP installation files - - -You can download the MSI installation files for PEAP, EAP-FAST, or Cisco LEAP in a single zip archive file from the Microsoft Download Center. To download this file, go to the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center, click **Download**, and then select the **Cisco EAP-Supplicant Installer.zip** file. - -## Deploy PEAP, EAP-FAST, or Cisco LEAP with MDT - - -If you are already performing a Windows deployment to Surface devices in your organization, it is quick and easy to add the installation files for each protocol to your deployment share and configure automatic installation during deployment. You can even configure a task sequence that updates previously deployed Surface devices to provide support for these protocols using the same process. - -To enable support for PEAP, EAP-FAST, or Cisco LEAP on newly deployed Surface devices, follow these steps: - -1. Download and extract the installation files for each protocol to separate folders in an easily accessible location. - -2. Open the MDT Deployment Workbench and expand your deployment share to the **Applications** folder. - -3. Select **New Application** from the **Action** pane. - -4. Choose **Application with source files** to copy the MSI files into the Deployment Share. - -5. Select the folder you created in step 1 for the desired protocol. - -6. Name the folder in the deployment share where the installation files will be stored. - -7. Specify the command line to deploy the application: - - - For PEAP use **EAP-PEAP.msi /qn /norestart**. - - - For LEAP use **EAP-LEAP.msi /qn /norestart**. - - - For EAP-FAST use **EAP-FAST.msi /qn /norestart**. - -8. Use the default options to complete the New Application Wizard. - -9. Repeat steps 3 through 8 for each desired protocol. - -After you’ve performed these steps to import the three MSI packages as applications into MDT, they will be available for selection in the Applications page of the Windows Deployment Wizard. Although in some simple deployment scenarios it might be sufficient to have technicians select each package at the time of deployment, it is not recommended. This practice introduces the possibility that a technician could attempt to apply these packages to computers other than Surface devices, or that a Surface device could be deployed without EAP support due to human error. - -To hide these applications from the Install Applications page, select the **Hide this application in the Deployment Wizard** checkbox in the properties of each application. After the applications are hidden, they will not be displayed as optional applications during deployment. To deploy them in your Surface deployment task sequence, they must be explicitly defined for installation through a separate step in the task sequence. - -To specify the protocol(s) explicitly, follow these steps: - -1. Open your Surface deployment task sequence properties from the MDT Deployment Workbench. - -2. On the **Task Sequence** tab, select the **Install Applications** step under **State Restore**. This is typically found between the pre-application and post-application Windows Update steps. - -3. Use the **Add** button to create a new **Install Application** step from the **General** category. - -4. Select **Install a single application** in the step **Properties** tab. - -5. Select the desired EAP protocol from the list. - -6. Repeat steps 2 through 5 for each desired protocol. - -## Deploy PEAP, EAP-FAST, or Cisco LEAP with Configuration Manager - - -For organizations that manage Surface devices with Configuration Manager, it is even easier to deploy PEAP, EAP-FAST, or Cisco LEAP support to Surface devices. Simply import each MSI file as an application from the Software Library and configure a deployment to your Surface device collection. - -For more information on how to deploy applications with Configuration Manager see [How to Create Applications in Configuration Manager](https://technet.microsoft.com/library/gg682159.aspx) and [How to Deploy Applications in Configuration Manager](https://technet.microsoft.com/library/gg682082.aspx). - -  - -  - - - - - diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md deleted file mode 100644 index 7eb53c4ec9..0000000000 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: Enroll and configure Surface devices with SEMM (Surface) -description: Learn how to create a Surface UEFI configuration package to control the settings of Surface UEFI, as well as enroll a Surface device in SEMM. -keywords: surface enterprise management -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/06/2017 -ms.reviewer: -manager: dansimp ---- - -# Enroll and configure Surface devices with SEMM - -With Microsoft Surface Enterprise Management Mode (SEMM), you can securely configure the settings of Surface UEFI on a Surface device and manage those settings on Surface devices in your organization. When a Surface device is managed by SEMM, that device is considered to be *enrolled* (sometimes referred to as activated). This article shows you how to create a Surface UEFI configuration package that will not only control the settings of Surface UEFI, but will also enroll a Surface device in SEMM. - -For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). - -#### Download and install Microsoft Surface UEFI Configurator -The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. -Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu. - ->[!NOTE] ->Microsoft Surface UEFI Configurator is supported only on Windows 10. - -## Create a Surface UEFI configuration package - -The Surface UEFI configuration package performs both the role of applying a new configuration of Surface UEFI settings to a Surface device managed with SEMM and the role of enrolling Surface devices in SEMM. The creation of a configuration package requires you to have a signing certificate to be used with SEMM to secure the configuration of UEFI settings on each Surface device. For more information about the requirements for the SEMM certificate, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). - -To create a Surface UEFI configuration package, follow these steps: - -1. Open Microsoft Surface UEFI Configurator from the Start menu. -2. Click **Start**. -3. Click **Configuration Package**, as shown in Figure 1. - - ![Create a package for SEMM enrollment](images/surface-ent-mgmt-fig1-uefi-configurator.png "Create a package for SEMM enrollment") - - *Figure 1. Select Configuration Package to create a package for SEMM enrollment and configuration* - -4. Click **Certificate Protection** to add your exported certificate file with private key (.pfx), as shown in Figure 2. Browse to the location of your certificate file, select the file, and then click **OK**. - - ![Add the SEM certificate and Surface UEFI password to configuration package](images/surface-ent-mgmt-fig2-securepackage.png "Add the SEM certificate and Surface UEFI password to configuration package") - - *Figure 2. Add the SEMM certificate and Surface UEFI password to a Surface UEFI configuration package* - -5. When you are prompted to confirm the certificate password, enter and confirm the password for your certificate file, and then click **OK**. -6. Click **Password Protection** to add a password to Surface UEFI. This password will be required whenever you boot to UEFI. If this password is not entered, only the **PC information**, **About**, **Enterprise management**, and **Exit** pages will be displayed. This step is optional. -7. When you are prompted, enter and confirm your chosen password for Surface UEFI, and then click **OK**. If you want to clear an existing Surface UEFI password, leave the password field blank. -8. If you do not want the Surface UEFI package to apply to a particular device, on the **Choose which Surface type you want to target** page, click the slider beneath the corresponding Surface Book or Surface Pro 4 image so that it is in the **Off** position. (As shown in Figure 3.) - - ![Choose devices for package compatibility](images/surface-semm-enroll-fig3.png "Choose devices for package compatibility") - - *Figure 3. Choose the devices for package compatibility* - -9. Click **Next**. -10. If you want to deactivate a component on managed Surface devices, on the **Choose which components you want to activate or deactivate** page, click the slider next to any device or group of devices you want to deactivate so that the slider is in the **Off** position. (Shown in Figure 4.) The default configuration for each device is **On**. Click the **Reset** button if you want to return all sliders to the default position. - - ![Disable or enable Surface components](images/surface-ent-mgmt-fig3-enabledisable.png "Disable or enable Surface components") - - *Figure 4. Disable or enable individual Surface components* - -11. Click **Next**. -12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. - - ![Control advanced Surface UEFI settings and Surface UEFI pages](images/surface-ent-mgmt-fig4-advancedsettings.png "Control advanced Surface UEFI settings and Surface UEFI pages") - - *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM* - -13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. -14. When the package is created and saved, the **Successful** page is displayed. - ->[!NOTE] ->Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. - -![Display of certificate thumbprint characters](images/surface-ent-mgmt-fig5-success.png "Display of certificate thumbprint characters") - -*Figure 6. The last two characters of the certificate thumbprint are displayed on the Successful page* - -Now that you have created your Surface UEFI configuration package, you can enroll or configure Surface devices. - ->[!NOTE] ->When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options. - -## Enroll a Surface device in SEMM -When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7. - -![SEMM process for configuration of Surface UEFI or enrollment](images/surface-semm-enroll-fig7.png "SEMM process for configuration of Surface UEFI or enrollment") - -*Figure 7. The SEMM process for configuration of Surface UEFI or enrollment of a Surface device* - -Before you begin the process to enroll a Surface device in SEMM, ensure that you have the last two characters of the certificate thumbprint on hand. You will need these characters to confirm the device’s enrollment (see Figure 6). - -To enroll a Surface device in SEMM with a Surface UEFI configuration package, follow these steps: - -1. Run the Surface UEFI configuration package .msi file on the Surface device you want to enroll in SEMM. This will provision the Surface UEFI configuration file in the device’s firmware. -2. Select the **I accept the terms in the License Agreement** check box to accept the End User License Agreement (EULA), and then click **Install** to begin the installation process. -3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so. -4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows: - * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate. - * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8. - - ![SEMM enrollment requires last two characters of certificate thumbprint](images/surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint") - - *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint* - - * Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file. - -5. The Surface device is now enrolled in SEMM and will boot to Windows. - -You can verify that a Surface device has been successfully enrolled in SEMM by looking for **Microsoft Surface Configuration Package** in **Programs and Features** (as shown in Figure 9), or in the events stored in the **Microsoft Surface UEFI Configurator** log, found under **Applications and Services Logs** in Event Viewer (as shown in Figure 10). - -![Verify enrollment of Surface device in SEMM in Programs and Features](images/surface-semm-enroll-fig9.png "Verify enrollment of Surface device in SEMM in Programs and Features") - -*Figure 9. Verify the enrollment of a Surface device in SEMM in Programs and Features* - -![Verify enrollment of Surface device in SEMM in Event Viewer](images/surface-semm-enroll-fig10.png "Verify enrollment of Surface device in SEMM in Event Viewer") - -*Figure 10. Verify the enrollment of a Surface device in SEMM in Event Viewer* - -You can also verify that the device is enrolled in SEMM in Surface UEFI – while the device is enrolled, Surface UEFI will contain the **Enterprise management** page (as shown in Figure 11). - -![Surface UEFI Enterprise management page](images/surface-semm-enroll-fig11.png "Surface UEFI Enterprise management page") - -*Figure 11. The Surface UEFI Enterprise management page* - - -## Configure Surface UEFI settings with SEMM - -After a device is enrolled in SEMM, you can run Surface UEFI configuration packages signed with the same SEMM certificate to apply new Surface UEFI settings. These settings are applied automatically the next time the device boots, without any interaction from the user. You can use application deployment solutions like System Center Configuration Manager to deploy Surface UEFI configuration packages to Surface devices to change or manage the settings in Surface UEFI. - -For more information about how to deploy Windows Installer (.msi) files with Configuration Manager, see [Deploy and manage applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt627959). - -If you have secured Surface UEFI with a password, users without the password who attempt to boot to Surface UEFI will only have the **PC information**, **About**, **Enterprise management**, and **Exit** pages displayed to them. - -If you have not secured Surface UEFI with a password or a user enters the password correctly, settings that are configured with SEMM will be dimmed (unavailable) and the text Some settings are managed by your organization will be displayed at the top of the page, as shown in Figure 12. - -![Settings managed by SEMM disabled in Surface UEFI](images/surface-semm-enroll-fig12.png "Settings managed by SEMM disabled in Surface UEFI") - -*Figure 12. Settings managed by SEMM will be disabled in Surface UEFI* diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md deleted file mode 100644 index 00aa0c1f1a..0000000000 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Ethernet adapters and Surface deployment (Surface) -description: This article provides guidance and answers to help you perform a network deployment to Surface devices. -ms.assetid: 5273C59E-6039-4E50-96B3-426BB38A64C0 -ms.reviewer: -manager: dansimp -keywords: ethernet, deploy, removable, network, connectivity, boot, firmware, device, adapter, PXE boot, USB -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 ---- - -# Ethernet adapters and Surface deployment - - -This article provides guidance and answers to help you perform a network deployment to Surface devices. - -Network deployment to Surface devices can pose some unique challenges for system administrators. Due to the lack of a native wired Ethernet adapter, administrators must provide connectivity through a removable Ethernet adapter. - -## Select an Ethernet adapter for Surface devices - - -Before you can address the concerns of how you will boot to your deployment environment or how devices will be recognized by your deployment solution, you have to use a wired network adapter. - -The primary concern when selecting an Ethernet adapter is how that adapter will boot your Surface device from the network. If you are pre-staging clients with Windows Deployment Services (WDS) or if you are using System Center Configuration Manager, you may also want to consider whether the removable Ethernet adapters will be dedicated to a specific Surface device or shared among multiple devices. See the [Manage MAC addresses with removable Ethernet adapters](#manage-mac-addresses) section of this article for more information on potential conflicts with shared adapters. - -Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](https://www.microsoft.com/surface/accessories/surface-dock) use a chipset that is compatible with the Surface firmware. - -The following Ethernet devices are supported for network boot with Surface devices: - -- Surface USB-C to Ethernet and USB 3.0 Adapter - -- Surface USB 3.0 to Gigabit Ethernet Adapter - -- Surface Dock - -- Surface 3 Docking Station - -- Surface Pro 3 Docking Station - -- Docking Station for Surface Pro and Surface Pro 2 - -Third-party Ethernet adapters are also supported for network deployment, although they do not support PXE boot. To use a third-party Ethernet adapter, you must load the drivers into the deployment boot image and you must launch that boot image from a separate storage device, such as a USB stick. - -## Boot Surface devices from the network - - -To boot from the network or a connected USB stick, you must instruct the Surface device to boot from an alternate boot device. You can alter the boot order in the system firmware to prioritize USB boot devices, or you can instruct it to boot from an alternate boot device during the boot up process. - -To boot a Surface device from an alternative boot device, follow these steps: - -1. Ensure the Surface device is powered off. -2. Press and hold the **Volume Down** button. -3. Press and release the **Power** button. -4. After the system begins to boot from the USB stick or Ethernet adapter, release the **Volume Down** button. - ->[!NOTE] ->In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard. - -  -For Windows 10, version 1511 and later – including the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10, version 1511 – the drivers for Microsoft Surface Ethernet Adapters are present by default. If you are using a deployment solution that uses Windows Preinstallation Environment (WinPE), like the Microsoft Deployment Toolkit, and booting from the network with PXE, ensure that your deployment solution is using the latest version of the Windows ADK. - -## Manage MAC addresses with removable Ethernet adapters - - -Another consideration for administrators performing Windows deployment over the network is how you will identify computers when you use the same Ethernet adapter to deploy to more than one computer. A common identifier used by deployment technologies is the Media Access Control (MAC) address that is associated with each Ethernet adapter. However, when you use the same Ethernet adapter to deploy to multiple computers, you cannot use a deployment technology that inspects MAC addresses because there is no way to differentiate the MAC address of the removable adapter when used on the different computers. - -The simplest solution to avoid MAC address conflicts is to provide a dedicated removable Ethernet adapter for each Surface device. This can make sense in many scenarios where the Ethernet adapter or the additional functionality of the docking station will be used regularly. However, not all scenarios call for the additional connectivity of a docking station or support for wired networks. - -Another potential solution to avoid conflict when adapters are shared is to use the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741) to perform deployment to Surface devices. MDT does not use the MAC address to identify individual computers and thus is not subject to this limitation. However, MDT does use Windows Deployment Services to provide PXE boot functionality, and is subject to the limitations regarding pre-staged clients which is covered later in this section. - -When you use a shared adapter for deployment, the solution for affected deployment technologies is to use another means to identify unique systems. For Configuration Manager and WDS, both of which can be affected by this issue, the solution is to use the System Universal Unique Identifier (System UUID) that is embedded in the computer firmware by the computer manufacturer. For Surface devices, you can see this entry in the computer firmware under **Device Information**. - -To access the firmware of a Surface device, follow these steps: - -1. Ensure the Surface device is powered off. -2. Press and hold the **Volume Up** button. -3. Press and release the **Power** button. -4. After the device begins to boot, release the **Volume Up** button. - -When deploying with WDS, the MAC address is only used to identify a computer when the deployment server is configured to respond only to known, pre-staged clients. When pre-staging a client, an administrator creates a computer account in Active Directory and defines that computer by the MAC address or the System UUID. To avoid the identity conflicts caused by shared Ethernet adapters, you should use [System UUID to define pre-staged clients](https://technet.microsoft.com/library/cc742034). Alternatively, you can configure WDS to respond to unknown clients that do not require definition by either MAC address or System UUID by selecting the **Respond to all client computers (known and unknown)** option on the [**PXE Response** tab](https://technet.microsoft.com/library/cc732360) in **Windows Deployment Server Properties**. - -The potential for conflicts with shared Ethernet adapters is much higher with Configuration Manager. Where WDS only uses MAC addresses to define individual systems when configured to do so, Configuration Manager uses the MAC address to define individual systems whenever performing a deployment to new or unknown computers. This can result in improperly configured devices or even the inability to deploy more than one system with a shared Ethernet adapter. There are several potential solutions for this situation that are described in detail in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post on the Ask Premier Field Engineering (PFE) Platforms TechNet blog. - -  - -  - - - - - diff --git a/devices/surface/get-started.md b/devices/surface/get-started.md deleted file mode 100644 index 07342f0005..0000000000 --- a/devices/surface/get-started.md +++ /dev/null @@ -1,165 +0,0 @@ ---- -title: Get started with Surface devices -author: robmazz -ms.author: robmazz -manager: laurawi -layout: LandingPage -ms.assetid: -ms.tgt_pltfrm: na -ms.devlang: na -ms.topic: landing-page -description: "Get started with Microsoft Surface devices" -localization_priority: High ---- -# Get started with Surface devices - -Harness the power of Surface, Windows, and Office connected together through the cloud. Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. - - - - - ---- - - \ No newline at end of file diff --git a/devices/surface/images/Surface-Devices-400x140.svg b/devices/surface/images/Surface-Devices-400x140.svg deleted file mode 100644 index 4414de0f16..0000000000 --- a/devices/surface/images/Surface-Devices-400x140.svg +++ /dev/null @@ -1,25 +0,0 @@ - - - - -Surface-Devices-400x140 - - - - - - - - - - - diff --git a/devices/surface/images/Surface-Hub-400x140.svg b/devices/surface/images/Surface-Hub-400x140.svg deleted file mode 100644 index f5a5c12a56..0000000000 --- a/devices/surface/images/Surface-Hub-400x140.svg +++ /dev/null @@ -1,51 +0,0 @@ - - - - -win_it-pro-6 - - - - - - - - - - - - - DevicesLaptopTablet-blue - - - - - - - - - - - - - - - - diff --git a/devices/surface/images/Surface-Workplace-400x140.svg b/devices/surface/images/Surface-Workplace-400x140.svg deleted file mode 100644 index 9bb3779192..0000000000 --- a/devices/surface/images/Surface-Workplace-400x140.svg +++ /dev/null @@ -1,33 +0,0 @@ - - - - -SharePoint_Doc_3_400x140 - - users_group - - - - - - - - - - - - - - diff --git a/devices/surface/images/assettag-fig1.png b/devices/surface/images/assettag-fig1.png deleted file mode 100644 index 5ccb36c85f..0000000000 Binary files a/devices/surface/images/assettag-fig1.png and /dev/null differ diff --git a/devices/surface/images/config-mgr-semm-fig1.png b/devices/surface/images/config-mgr-semm-fig1.png deleted file mode 100644 index 7ff888c2e2..0000000000 Binary files a/devices/surface/images/config-mgr-semm-fig1.png and /dev/null differ diff --git a/devices/surface/images/config-mgr-semm-fig2.png b/devices/surface/images/config-mgr-semm-fig2.png deleted file mode 100644 index 33836c09eb..0000000000 Binary files a/devices/surface/images/config-mgr-semm-fig2.png and /dev/null differ diff --git a/devices/surface/images/config-mgr-semm-fig3.png b/devices/surface/images/config-mgr-semm-fig3.png deleted file mode 100644 index c844b60531..0000000000 Binary files a/devices/surface/images/config-mgr-semm-fig3.png and /dev/null differ diff --git a/devices/surface/images/data-eraser-3.png b/devices/surface/images/data-eraser-3.png deleted file mode 100644 index eed3836aa7..0000000000 Binary files a/devices/surface/images/data-eraser-3.png and /dev/null differ diff --git a/devices/surface/images/dataeraser-complete-process.png b/devices/surface/images/dataeraser-complete-process.png deleted file mode 100644 index c7d0ee1d09..0000000000 Binary files a/devices/surface/images/dataeraser-complete-process.png and /dev/null differ diff --git a/devices/surface/images/dataeraser-start-tool.png b/devices/surface/images/dataeraser-start-tool.png deleted file mode 100644 index a727d8a870..0000000000 Binary files a/devices/surface/images/dataeraser-start-tool.png and /dev/null differ diff --git a/devices/surface/images/dataeraser-usb-selection.png b/devices/surface/images/dataeraser-usb-selection.png deleted file mode 100644 index 6c5382c7b0..0000000000 Binary files a/devices/surface/images/dataeraser-usb-selection.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig2-selectingofflinelicense.png b/devices/surface/images/deploysurfapp-fig2-selectingofflinelicense.png deleted file mode 100644 index eb7a2ef787..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig2-selectingofflinelicense.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig3-acknowledge.png b/devices/surface/images/deploysurfapp-fig3-acknowledge.png deleted file mode 100644 index dd59593baf..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig3-acknowledge.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig4-downloadappxbundle.png b/devices/surface/images/deploysurfapp-fig4-downloadappxbundle.png deleted file mode 100644 index 59b96e327b..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig4-downloadappxbundle.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig5-requiredframework.png b/devices/surface/images/deploysurfapp-fig5-requiredframework.png deleted file mode 100644 index 24d6e7edd8..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig5-requiredframework.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-figure1-enablingapps.png b/devices/surface/images/deploysurfapp-figure1-enablingapps.png deleted file mode 100644 index 78bfef9e8b..0000000000 Binary files a/devices/surface/images/deploysurfapp-figure1-enablingapps.png and /dev/null differ diff --git a/devices/surface/images/discovertools.png b/devices/surface/images/discovertools.png deleted file mode 100644 index 2568398824..0000000000 Binary files a/devices/surface/images/discovertools.png and /dev/null differ diff --git a/devices/surface/images/enable-bl-sp3-2.png b/devices/surface/images/enable-bl-sp3-2.png deleted file mode 100644 index f1940c403f..0000000000 Binary files a/devices/surface/images/enable-bl-sp3-2.png and /dev/null differ diff --git a/devices/surface/images/enable-bl-sp3.png b/devices/surface/images/enable-bl-sp3.png deleted file mode 100644 index 7fa99786f1..0000000000 Binary files a/devices/surface/images/enable-bl-sp3.png and /dev/null differ diff --git a/devices/surface/images/enable-bl.png b/devices/surface/images/enable-bl.png deleted file mode 100644 index a99cb994fb..0000000000 Binary files a/devices/surface/images/enable-bl.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-dock-fig1-updateprocess.png b/devices/surface/images/manage-surface-dock-fig1-updateprocess.png deleted file mode 100644 index e779fa33ef..0000000000 Binary files a/devices/surface/images/manage-surface-dock-fig1-updateprocess.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig10.png b/devices/surface/images/manage-surface-uefi-fig10.png deleted file mode 100644 index 7d36f66808..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig10.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig11.png b/devices/surface/images/manage-surface-uefi-fig11.png deleted file mode 100644 index daccc0efbb..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig11.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig12.png b/devices/surface/images/manage-surface-uefi-fig12.png deleted file mode 100644 index 34d2dc5342..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig12.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig13.png b/devices/surface/images/manage-surface-uefi-fig13.png deleted file mode 100644 index b7a58d16c2..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig13.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig14.png b/devices/surface/images/manage-surface-uefi-fig14.png deleted file mode 100644 index 8845608fbd..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig14.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig2.png b/devices/surface/images/manage-surface-uefi-fig2.png deleted file mode 100644 index 6d8e4b41c8..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig2.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig3.png b/devices/surface/images/manage-surface-uefi-fig3.png deleted file mode 100644 index 4ae63c2a49..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig3.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig4.png b/devices/surface/images/manage-surface-uefi-fig4.png deleted file mode 100644 index 67866fcbf0..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig4.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig5.png b/devices/surface/images/manage-surface-uefi-fig5.png deleted file mode 100644 index eae3212f76..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig5.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig6.png b/devices/surface/images/manage-surface-uefi-fig6.png deleted file mode 100644 index a06c845a9c..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig6.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig7.png b/devices/surface/images/manage-surface-uefi-fig7.png deleted file mode 100644 index 9af6d1beed..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig7.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig8.png b/devices/surface/images/manage-surface-uefi-fig8.png deleted file mode 100644 index d8c078cf59..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig8.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig9.png b/devices/surface/images/manage-surface-uefi-fig9.png deleted file mode 100644 index 2269fe6c17..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig9.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-figure-1.png b/devices/surface/images/manage-surface-uefi-figure-1.png deleted file mode 100644 index b87279bdd5..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-figure-1.png and /dev/null differ diff --git a/devices/surface/images/managefirmware.png b/devices/surface/images/managefirmware.png deleted file mode 100644 index 392bcc601c..0000000000 Binary files a/devices/surface/images/managefirmware.png and /dev/null differ diff --git a/devices/surface/images/managesettings.png b/devices/surface/images/managesettings.png deleted file mode 100644 index 0f0567f97c..0000000000 Binary files a/devices/surface/images/managesettings.png and /dev/null differ diff --git a/devices/surface/images/mdt.png b/devices/surface/images/mdt.png deleted file mode 100644 index e185c8c501..0000000000 Binary files a/devices/surface/images/mdt.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig1.png b/devices/surface/images/powerintrofig1.png deleted file mode 100644 index d33b9922fd..0000000000 Binary files a/devices/surface/images/powerintrofig1.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig1a.png b/devices/surface/images/powerintrofig1a.png deleted file mode 100644 index e704b940c9..0000000000 Binary files a/devices/surface/images/powerintrofig1a.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig2.png b/devices/surface/images/powerintrofig2.png deleted file mode 100644 index eea52a8f3d..0000000000 Binary files a/devices/surface/images/powerintrofig2.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig2a.png b/devices/surface/images/powerintrofig2a.png deleted file mode 100644 index e00fe81105..0000000000 Binary files a/devices/surface/images/powerintrofig2a.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig3.png b/devices/surface/images/powerintrofig3.png deleted file mode 100644 index 08e9cd36a3..0000000000 Binary files a/devices/surface/images/powerintrofig3.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig4.png b/devices/surface/images/powerintrofig4.png deleted file mode 100644 index f983673f35..0000000000 Binary files a/devices/surface/images/powerintrofig4.png and /dev/null differ diff --git a/devices/surface/images/preparewindowsdeployment.png b/devices/surface/images/preparewindowsdeployment.png deleted file mode 100644 index d7c04abc9e..0000000000 Binary files a/devices/surface/images/preparewindowsdeployment.png and /dev/null differ diff --git a/devices/surface/images/sccm.png b/devices/surface/images/sccm.png deleted file mode 100644 index 754f2ef89f..0000000000 Binary files a/devices/surface/images/sccm.png and /dev/null differ diff --git a/devices/surface/images/sda-fig1-select-steps.png b/devices/surface/images/sda-fig1-select-steps.png deleted file mode 100644 index cb5c24c2e0..0000000000 Binary files a/devices/surface/images/sda-fig1-select-steps.png and /dev/null differ diff --git a/devices/surface/images/sda-fig2-specify-local.png b/devices/surface/images/sda-fig2-specify-local.png deleted file mode 100644 index a7eb4d5b33..0000000000 Binary files a/devices/surface/images/sda-fig2-specify-local.png and /dev/null differ diff --git a/devices/surface/images/sda-fig5-erase.png b/devices/surface/images/sda-fig5-erase.png deleted file mode 100644 index 8ac3e174a7..0000000000 Binary files a/devices/surface/images/sda-fig5-erase.png and /dev/null differ diff --git a/devices/surface/images/sda.png b/devices/surface/images/sda.png deleted file mode 100644 index b9433dcd4a..0000000000 Binary files a/devices/surface/images/sda.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig1.png b/devices/surface/images/sdasteps-fig1.png deleted file mode 100644 index 2f83597305..0000000000 Binary files a/devices/surface/images/sdasteps-fig1.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig10-rules.png b/devices/surface/images/sdasteps-fig10-rules.png deleted file mode 100644 index 581c6f1492..0000000000 Binary files a/devices/surface/images/sdasteps-fig10-rules.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig11-bootstrap.ini.png b/devices/surface/images/sdasteps-fig11-bootstrap.ini.png deleted file mode 100644 index 64a4bd9aad..0000000000 Binary files a/devices/surface/images/sdasteps-fig11-bootstrap.ini.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig12-updatemedia.png b/devices/surface/images/sdasteps-fig12-updatemedia.png deleted file mode 100644 index 01a677ba02..0000000000 Binary files a/devices/surface/images/sdasteps-fig12-updatemedia.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig13-taskseq.png b/devices/surface/images/sdasteps-fig13-taskseq.png deleted file mode 100644 index 1fe51f0b60..0000000000 Binary files a/devices/surface/images/sdasteps-fig13-taskseq.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig14-credentials.png b/devices/surface/images/sdasteps-fig14-credentials.png deleted file mode 100644 index d2944325f4..0000000000 Binary files a/devices/surface/images/sdasteps-fig14-credentials.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig15-deploy.png b/devices/surface/images/sdasteps-fig15-deploy.png deleted file mode 100644 index 14cc461225..0000000000 Binary files a/devices/surface/images/sdasteps-fig15-deploy.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig16-computername.png b/devices/surface/images/sdasteps-fig16-computername.png deleted file mode 100644 index 1960c5b138..0000000000 Binary files a/devices/surface/images/sdasteps-fig16-computername.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig17-installprogresswindow.png b/devices/surface/images/sdasteps-fig17-installprogresswindow.png deleted file mode 100644 index ab2c456857..0000000000 Binary files a/devices/surface/images/sdasteps-fig17-installprogresswindow.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig2.png b/devices/surface/images/sdasteps-fig2.png deleted file mode 100644 index 4edeb35ca3..0000000000 Binary files a/devices/surface/images/sdasteps-fig2.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig3.png b/devices/surface/images/sdasteps-fig3.png deleted file mode 100644 index 728ddab514..0000000000 Binary files a/devices/surface/images/sdasteps-fig3.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig4-select.png b/devices/surface/images/sdasteps-fig4-select.png deleted file mode 100644 index 15d4df2af7..0000000000 Binary files a/devices/surface/images/sdasteps-fig4-select.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig5-installwindow.png b/devices/surface/images/sdasteps-fig5-installwindow.png deleted file mode 100644 index 66f1814146..0000000000 Binary files a/devices/surface/images/sdasteps-fig5-installwindow.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig6-specify-driver-app-files.png b/devices/surface/images/sdasteps-fig6-specify-driver-app-files.png deleted file mode 100644 index cb82d3fec7..0000000000 Binary files a/devices/surface/images/sdasteps-fig6-specify-driver-app-files.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig7-diskpart.png b/devices/surface/images/sdasteps-fig7-diskpart.png deleted file mode 100644 index 70b517f3f1..0000000000 Binary files a/devices/surface/images/sdasteps-fig7-diskpart.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig8-mediafolder.png b/devices/surface/images/sdasteps-fig8-mediafolder.png deleted file mode 100644 index f6a862e60f..0000000000 Binary files a/devices/surface/images/sdasteps-fig8-mediafolder.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig9-location.png b/devices/surface/images/sdasteps-fig9-location.png deleted file mode 100644 index c8247de908..0000000000 Binary files a/devices/surface/images/sdasteps-fig9-location.png and /dev/null differ diff --git a/devices/surface/images/sdt-1.png b/devices/surface/images/sdt-1.png deleted file mode 100644 index fb10753608..0000000000 Binary files a/devices/surface/images/sdt-1.png and /dev/null differ diff --git a/devices/surface/images/sdt-2.png b/devices/surface/images/sdt-2.png deleted file mode 100644 index be951967f0..0000000000 Binary files a/devices/surface/images/sdt-2.png and /dev/null differ diff --git a/devices/surface/images/sdt-3.png b/devices/surface/images/sdt-3.png deleted file mode 100644 index 0d3077cc1b..0000000000 Binary files a/devices/surface/images/sdt-3.png and /dev/null differ diff --git a/devices/surface/images/sdt-4.png b/devices/surface/images/sdt-4.png deleted file mode 100644 index babddbb240..0000000000 Binary files a/devices/surface/images/sdt-4.png and /dev/null differ diff --git a/devices/surface/images/sdt-5.png b/devices/surface/images/sdt-5.png deleted file mode 100644 index 5c5346d93a..0000000000 Binary files a/devices/surface/images/sdt-5.png and /dev/null differ diff --git a/devices/surface/images/sdt-6.png b/devices/surface/images/sdt-6.png deleted file mode 100644 index acf8e684b3..0000000000 Binary files a/devices/surface/images/sdt-6.png and /dev/null differ diff --git a/devices/surface/images/sdt-7.png b/devices/surface/images/sdt-7.png deleted file mode 100644 index 5e16961c6b..0000000000 Binary files a/devices/surface/images/sdt-7.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-1.png b/devices/surface/images/sdt-desk-1.png deleted file mode 100644 index f1ecc03b30..0000000000 Binary files a/devices/surface/images/sdt-desk-1.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-2.png b/devices/surface/images/sdt-desk-2.png deleted file mode 100644 index 3d066cb3e5..0000000000 Binary files a/devices/surface/images/sdt-desk-2.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-3.png b/devices/surface/images/sdt-desk-3.png deleted file mode 100644 index bbd9709300..0000000000 Binary files a/devices/surface/images/sdt-desk-3.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-4.png b/devices/surface/images/sdt-desk-4.png deleted file mode 100644 index f533646605..0000000000 Binary files a/devices/surface/images/sdt-desk-4.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-5.png b/devices/surface/images/sdt-desk-5.png deleted file mode 100644 index 664828762e..0000000000 Binary files a/devices/surface/images/sdt-desk-5.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-6.png b/devices/surface/images/sdt-desk-6.png deleted file mode 100644 index 1b9ce9f7e2..0000000000 Binary files a/devices/surface/images/sdt-desk-6.png and /dev/null differ diff --git a/devices/surface/images/sdt-install.png b/devices/surface/images/sdt-install.png deleted file mode 100644 index ce0fe297d7..0000000000 Binary files a/devices/surface/images/sdt-install.png and /dev/null differ diff --git a/devices/surface/images/semm-bl.png b/devices/surface/images/semm-bl.png deleted file mode 100644 index 3f8a375057..0000000000 Binary files a/devices/surface/images/semm-bl.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig1.png b/devices/surface/images/surface-deploymdt-fig1.png deleted file mode 100644 index d2fe0995a7..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig10.png b/devices/surface/images/surface-deploymdt-fig10.png deleted file mode 100644 index 96cb86b56f..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig10.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig11.png b/devices/surface/images/surface-deploymdt-fig11.png deleted file mode 100644 index a78c147322..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig11.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig12.png b/devices/surface/images/surface-deploymdt-fig12.png deleted file mode 100644 index 6200a677ec..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig12.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig13.png b/devices/surface/images/surface-deploymdt-fig13.png deleted file mode 100644 index c04c8f6d19..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig13.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig14.png b/devices/surface/images/surface-deploymdt-fig14.png deleted file mode 100644 index f02bc1fdb9..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig14.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig15.png b/devices/surface/images/surface-deploymdt-fig15.png deleted file mode 100644 index 4eb72e98cc..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig15.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig16.png b/devices/surface/images/surface-deploymdt-fig16.png deleted file mode 100644 index 0c5abc40a3..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig16.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig17.png b/devices/surface/images/surface-deploymdt-fig17.png deleted file mode 100644 index 3ccd548a70..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig17.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig18.png b/devices/surface/images/surface-deploymdt-fig18.png deleted file mode 100644 index f510c5b884..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig18.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig19.png b/devices/surface/images/surface-deploymdt-fig19.png deleted file mode 100644 index 535a139991..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig19.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig2.png b/devices/surface/images/surface-deploymdt-fig2.png deleted file mode 100644 index ad18f2ad58..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig20.png b/devices/surface/images/surface-deploymdt-fig20.png deleted file mode 100644 index 045801b6ac..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig20.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig21.png b/devices/surface/images/surface-deploymdt-fig21.png deleted file mode 100644 index 7660a618c8..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig21.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig22.png b/devices/surface/images/surface-deploymdt-fig22.png deleted file mode 100644 index 1852197dc7..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig22.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig23.png b/devices/surface/images/surface-deploymdt-fig23.png deleted file mode 100644 index 306a662236..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig23.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig24.png b/devices/surface/images/surface-deploymdt-fig24.png deleted file mode 100644 index 546a310733..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig24.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig25.png b/devices/surface/images/surface-deploymdt-fig25.png deleted file mode 100644 index a58b7fba71..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig25.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig3.png b/devices/surface/images/surface-deploymdt-fig3.png deleted file mode 100644 index 7d87a1c986..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig4.png b/devices/surface/images/surface-deploymdt-fig4.png deleted file mode 100644 index 944fd37f41..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig5.png b/devices/surface/images/surface-deploymdt-fig5.png deleted file mode 100644 index 8fa0679886..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig5.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig6.png b/devices/surface/images/surface-deploymdt-fig6.png deleted file mode 100644 index 53c923be28..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig6.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig7.png b/devices/surface/images/surface-deploymdt-fig7.png deleted file mode 100644 index 48892a9ef0..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig7.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig8.png b/devices/surface/images/surface-deploymdt-fig8.png deleted file mode 100644 index 59028f2a82..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig8.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig9.png b/devices/surface/images/surface-deploymdt-fig9.png deleted file mode 100644 index 6044405883..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig9.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig1-options.png b/devices/surface/images/surface-diagnostic-kit-fig1-options.png deleted file mode 100644 index 8e10b877f9..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig1-options.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png b/devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png deleted file mode 100644 index 061c7748b3..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig3-results.png b/devices/surface/images/surface-diagnostic-kit-fig3-results.png deleted file mode 100644 index e02087d6d9..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig3-results.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig4-notes.png b/devices/surface/images/surface-diagnostic-kit-fig4-notes.png deleted file mode 100644 index 02726648db..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig4-notes.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-gear-icon.png b/devices/surface/images/surface-diagnostic-kit-gear-icon.png deleted file mode 100644 index fe6be488b1..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-gear-icon.png and /dev/null differ diff --git a/devices/surface/images/surface-enroll-semm-fig1.png b/devices/surface/images/surface-enroll-semm-fig1.png deleted file mode 100644 index 0db814ae84..0000000000 Binary files a/devices/surface/images/surface-enroll-semm-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig1-uefi-configurator.png b/devices/surface/images/surface-ent-mgmt-fig1-uefi-configurator.png deleted file mode 100644 index e8fb93a1a7..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig1-uefi-configurator.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig2-securepackage.png b/devices/surface/images/surface-ent-mgmt-fig2-securepackage.png deleted file mode 100644 index fa47419ca0..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig2-securepackage.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png b/devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png deleted file mode 100644 index 0a34907def..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig4-advancedsettings.png b/devices/surface/images/surface-ent-mgmt-fig4-advancedsettings.png deleted file mode 100644 index f425466056..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig4-advancedsettings.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig5-success.png b/devices/surface/images/surface-ent-mgmt-fig5-success.png deleted file mode 100644 index e671570fee..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig5-success.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png b/devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png deleted file mode 100644 index a1421da21c..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png b/devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png deleted file mode 100644 index 91c03fef5e..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig1.png b/devices/surface/images/surface-semm-enroll-fig1.png deleted file mode 100644 index 0db814ae84..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig10.png b/devices/surface/images/surface-semm-enroll-fig10.png deleted file mode 100644 index e61cf3d70a..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig10.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig11.png b/devices/surface/images/surface-semm-enroll-fig11.png deleted file mode 100644 index 91c03fef5e..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig11.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig12.png b/devices/surface/images/surface-semm-enroll-fig12.png deleted file mode 100644 index d6c0505c16..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig12.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig3.png b/devices/surface/images/surface-semm-enroll-fig3.png deleted file mode 100644 index 2d66b485f9..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig4.png b/devices/surface/images/surface-semm-enroll-fig4.png deleted file mode 100644 index 39b0c797e7..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig5.png b/devices/surface/images/surface-semm-enroll-fig5.png deleted file mode 100644 index b3d3db34c7..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig5.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig6.png b/devices/surface/images/surface-semm-enroll-fig6.png deleted file mode 100644 index 95b1c1b24b..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig6.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig7.png b/devices/surface/images/surface-semm-enroll-fig7.png deleted file mode 100644 index 26a640ac0c..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig7.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig8.png b/devices/surface/images/surface-semm-enroll-fig8.png deleted file mode 100644 index a1421da21c..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig8.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig9.png b/devices/surface/images/surface-semm-enroll-fig9.png deleted file mode 100644 index 9229ee255d..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig9.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enrollment-fig2.png b/devices/surface/images/surface-semm-enrollment-fig2.png deleted file mode 100644 index 1a5649b01e..0000000000 Binary files a/devices/surface/images/surface-semm-enrollment-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig1.png b/devices/surface/images/surface-semm-unenroll-fig1.png deleted file mode 100644 index b0247d3871..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig10.png b/devices/surface/images/surface-semm-unenroll-fig10.png deleted file mode 100644 index 968bf44d8c..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig10.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig11.png b/devices/surface/images/surface-semm-unenroll-fig11.png deleted file mode 100644 index c5e86d2b65..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig11.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig12.png b/devices/surface/images/surface-semm-unenroll-fig12.png deleted file mode 100644 index d9a3e0617b..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig12.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig13.png b/devices/surface/images/surface-semm-unenroll-fig13.png deleted file mode 100644 index cfe16c3a99..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig13.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig14.png b/devices/surface/images/surface-semm-unenroll-fig14.png deleted file mode 100644 index 5c95097c8d..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig14.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig2.png b/devices/surface/images/surface-semm-unenroll-fig2.png deleted file mode 100644 index 5affd8cef6..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig3.png b/devices/surface/images/surface-semm-unenroll-fig3.png deleted file mode 100644 index 45c1ae38ed..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig4.png b/devices/surface/images/surface-semm-unenroll-fig4.png deleted file mode 100644 index c4ecf92b1b..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig5.png b/devices/surface/images/surface-semm-unenroll-fig5.png deleted file mode 100644 index 9229ee255d..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig5.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig6.png b/devices/surface/images/surface-semm-unenroll-fig6.png deleted file mode 100644 index 91c03fef5e..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig6.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig7.png b/devices/surface/images/surface-semm-unenroll-fig7.png deleted file mode 100644 index 0dcbace491..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig7.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig8.png b/devices/surface/images/surface-semm-unenroll-fig8.png deleted file mode 100644 index 77e7e05407..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig8.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig9.png b/devices/surface/images/surface-semm-unenroll-fig9.png deleted file mode 100644 index b40ccb2449..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig9.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig1.png b/devices/surface/images/surface-upgrademdt-fig1.png deleted file mode 100644 index 094f5d700b..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig2.png b/devices/surface/images/surface-upgrademdt-fig2.png deleted file mode 100644 index 88ec207691..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig3.png b/devices/surface/images/surface-upgrademdt-fig3.png deleted file mode 100644 index 7660a618c8..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig4.png b/devices/surface/images/surface-upgrademdt-fig4.png deleted file mode 100644 index 1852197dc7..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig5.png b/devices/surface/images/surface-upgrademdt-fig5.png deleted file mode 100644 index 306a662236..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig5.png and /dev/null differ diff --git a/devices/surface/images/surfaceblog.png b/devices/surface/images/surfaceblog.png deleted file mode 100644 index d5bef3dc3d..0000000000 Binary files a/devices/surface/images/surfaceblog.png and /dev/null differ diff --git a/devices/surface/images/surfacebook.png b/devices/surface/images/surfacebook.png deleted file mode 100644 index d27cf05820..0000000000 Binary files a/devices/surface/images/surfacebook.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig1-uptodate-568pix.png b/devices/surface/images/surfacedockupdater-fig1-uptodate-568pix.png deleted file mode 100644 index 900ffd9269..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig1-uptodate-568pix.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig2a-needsupdating.png b/devices/surface/images/surfacedockupdater-fig2a-needsupdating.png deleted file mode 100644 index 4c690e0a7f..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig2a-needsupdating.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig3-progress.png b/devices/surface/images/surfacedockupdater-fig3-progress.png deleted file mode 100644 index aa56e090e9..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig3-progress.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig4-disconnect.png b/devices/surface/images/surfacedockupdater-fig4-disconnect.png deleted file mode 100644 index 4892dce1ba..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig4-disconnect.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig5-success.png b/devices/surface/images/surfacedockupdater-fig5-success.png deleted file mode 100644 index 790ff235e9..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig5-success.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig6-countdown.png b/devices/surface/images/surfacedockupdater-fig6-countdown.png deleted file mode 100644 index fa208e0e4a..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig6-countdown.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig7-error.png b/devices/surface/images/surfacedockupdater-fig7-error.png deleted file mode 100644 index c18ef16b4c..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig7-error.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig8-737test.png b/devices/surface/images/surfacedockupdater-fig8-737test.png deleted file mode 100644 index c101313b96..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig8-737test.png and /dev/null differ diff --git a/devices/surface/images/surfacemechanics.png b/devices/surface/images/surfacemechanics.png deleted file mode 100644 index 3d42daaed2..0000000000 Binary files a/devices/surface/images/surfacemechanics.png and /dev/null differ diff --git a/devices/surface/images/surfacepro.png b/devices/surface/images/surfacepro.png deleted file mode 100644 index c036b2ad3a..0000000000 Binary files a/devices/surface/images/surfacepro.png and /dev/null differ diff --git a/devices/surface/images/surfacestudio.png b/devices/surface/images/surfacestudio.png deleted file mode 100644 index c41bbbf0f7..0000000000 Binary files a/devices/surface/images/surfacestudio.png and /dev/null differ diff --git a/devices/surface/images/twitter.png b/devices/surface/images/twitter.png deleted file mode 100644 index c61827284e..0000000000 Binary files a/devices/surface/images/twitter.png and /dev/null differ diff --git a/devices/surface/images/using-sda-driverfiles-fig1.png b/devices/surface/images/using-sda-driverfiles-fig1.png deleted file mode 100644 index 51244bfe16..0000000000 Binary files a/devices/surface/images/using-sda-driverfiles-fig1.png and /dev/null differ diff --git a/devices/surface/images/using-sda-installcommand-fig2.png b/devices/surface/images/using-sda-installcommand-fig2.png deleted file mode 100644 index 61a4fbd1f2..0000000000 Binary files a/devices/surface/images/using-sda-installcommand-fig2.png and /dev/null differ diff --git a/devices/surface/images/using-sda-newinstall-fig3.png b/devices/surface/images/using-sda-newinstall-fig3.png deleted file mode 100644 index ff18b67e3e..0000000000 Binary files a/devices/surface/images/using-sda-newinstall-fig3.png and /dev/null differ diff --git a/devices/surface/images/windows10.png b/devices/surface/images/windows10.png deleted file mode 100644 index e48690853c..0000000000 Binary files a/devices/surface/images/windows10.png and /dev/null differ diff --git a/devices/surface/images/windows10upgradepath.png b/devices/surface/images/windows10upgradepath.png deleted file mode 100644 index c008e446ea..0000000000 Binary files a/devices/surface/images/windows10upgradepath.png and /dev/null differ diff --git a/devices/surface/index.md b/devices/surface/index.md deleted file mode 100644 index 33fbe6bf0c..0000000000 --- a/devices/surface/index.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Microsoft Surface documentation and resources -layout: HubPage -hide_bc: true -description: Surface and Surface Hub documentation for admins & IT professionals -author: robmazz -ms.author: robmazz -manager: laurawi -ms.topic: hub-page -keywords: Microsoft Surface, Microsoft Surface Hub, Surface documentation -localization_priority: High -audience: ITPro -ms.prod: Surface -description: Learn about Microsoft Surface and Surface Hub devices. ---- - diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md deleted file mode 100644 index d7e5bdc7d7..0000000000 --- a/devices/surface/ltsb-for-surface.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Long-Term Servicing Branch for Surface devices (Surface) -description: LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 04/25/2017 -ms.reviewer: -manager: dansimp ---- - -# Long-Term Servicing Branch (LTSB) for Surface devices - ->[!WARNING] ->For updated information on this topic, see [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md). For additional information on this update, see the [Documentation Updates for Surface and Windows 10 LTSB Compatibility](https://blogs.technet.microsoft.com/surface/2017/04/11/documentation-updates-for-surface-and-windows-10-ltsb-compatibility) post on the Surface Blog for IT Pros. - -General-purpose Surface devices running Long-Term Servicing Branch (LTSB) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSB and should instead run Current Branch (CB) or Current Branch for Business (CBB). - ->[!NOTE] ->For more information about the servicing branches, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). - -LTSB prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSB configuration will be instructed to upgrade to CB or CBB. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSB is not supported as a suitable servicing solution for general-purpose Surface devices. - -General-purpose Surface devices are intended to run CB or CBB to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. With CB, feature updates are available as soon as Microsoft releases them. Customers in the CBB servicing model receive the same build of Windows 10 as those in CB, at a later date. - -Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–may consider the use of LTSB. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. - - - - - -## Related topics - -- [Surface TechCenter](https://technet.microsoft.com/windows/surface) - -- [Surface for IT pros blog](http://blogs.technet.com/b/surface/) - - - -  - -  - - - - - diff --git a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md deleted file mode 100644 index 4a3c4f93b3..0000000000 --- a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Best practice power settings for Surface devices -description: This topic provides best practice recommendations for maintaining optimal power settings and explains how Surface streamlines the power management experience. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.reviewer: -manager: dansimp ---- - -# Best practice power settings for Surface devices - -Surface devices are designed to take advantage of the latest advances in -mobile device energy consumption to deliver a streamlined experience -optimized across workloads. Depending on what you’re doing, Surface -dynamically fine tunes how power flows to individual hardware -components, momentarily waking up system components to handle background -tasks -- such as an incoming email or network traffic -- before returning to a -low power idle state (S0ix). - -## Summary of recommendations for IT administrators - -To ensure Surface devices across your organization fully benefit from Surface power optimization features: - -- Exclude Surface devices from any existing power management policy settings and let the Surface default policy control the power policy and behavior of the device. -- If you must manage the power profile of devices across your network (such as in highly managed organizations), use the powercfg command tool to export the power profile from the factory image of the Surface device and then import it into the provisioning package for your Surface devices. For more information, refer to [Configure power settings](https://docs.microsoft.com/windows-hardware/customize/power-settings/configure-power-settings). -- Always use the newest available version of the drivers and firmware for your devices and for the version of Windows 10 they're running. For more information, refer to [Deploying the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) -- Avoid creating custom power profiles or adjusting advanced power settings not visible in the default UI (**System** > **Power & sleep**). For more information, refer to User best practices for extended battery life in this document. - -## Background - -The way Surface implements power management differs significantly from -the earlier OS standard that gradually reduces and turns off power via a -series of sleep states; for example, cycling through S1, S2, S3, and so on. - -Instead, Surface is imaged with a custom power profile that replaces -legacy sleep and energy consumption functionality with modern standby -features and dynamic fine tuning. This custom power profile is -implemented via the Surface Serial Hub Driver and the system aggregator -module (SAM). The SAM chip functions as the Surface device power-policy -owner, using algorithms to calculate optimal power requirements. It -works in conjunction with Windows power manager to allocate or throttle -only the exact amount of power required for hardware components to -function. - -## Utilizing the custom power profile in Surface - -If you go into the power options on a surface device, you'll see that there's a single power plan available. This is the custom power profile. And if you go to the advanced power settings, you’ll see a much smaller subset of power options compared to a generic PC running Windows 10. Unlike generic devices, Surface has firmware and custom components to manage these power options. - - -## Modern Standby - -The algorithmically embedded custom power profile enables modern standby -connectivity for Surface by maintaining a low power state for -instant on/instant off functionality typical of smartphones. S0ix, also -known as Deepest Runtime Idle Platform State (DRIPS), is the default -power mode for Surface devices. Modern standby has two modes: - -- **Connected standby.** The default mode for up-to-the minute - delivery of emails, messaging, and cloud-synced data, connected - standby keeps Wi-Fi on and maintains network connectivity. - -- **Disconnected standby.** An optional mode for extended battery - life, disconnected standby delivers the same instant-on experience - and saves power by turning off Wi-Fi, Bluetooth, and related network - connectivity. - -To learn more about modern standby, refer to the [Microsoft Hardware Dev -Center](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-wake-sources). - -## How Surface streamlines the power management experience - -Surface integrates the following features designed to help users -optimize the power management experience: - -- [Singular power plan](#singular-power-plan) - -- [Simplified power settings user - interface](#simplified-power-settings-user-interface) - -- [Windows performance power - slider](#windows-performance-power-slider) - -### Singular power plan - -Surface is designed for a streamlined power management experience that -eliminates the need to create custom power plans or manually configure -power settings. Microsoft streamlines the user -experience by delivering a single power plan (balanced) that replaces -the multiple power plans from standard Windows builds. - -### Simplified power settings user interface - -Surface provides a simplified UI in accord with best practice power -setting recommendations. In general, it's recommended to only adjust settings visible in the default user interface and avoid configuring advanced power settings or Group Policy settings. Using the default screen and sleep timeouts while avoiding maximum -brightness levels are the most effective ways for users to maintain -extended battery life. - -![Figure 1. Simplified power & sleep settings](images/powerintrofig1.png) - -Figure 1. Simplified power and sleep settings - -### Windows performance power slider - -Surface devices running Windows 10 build 1709 and later include a power -slider allowing you to prioritize battery life when needed or favor performance if desired. You -can access the power slider from the taskbar by clicking on the battery -icon. Slide left for longer battery life (battery saver mode) or slide -right for faster performance. - -![Figure 2. Power slider](images/powerintrofig2a.png) - -Figure 2. Power slider - -Power slider enables four states as described in the following table: - -| Slider mode| Description | -|---|---| -| Battery saver| Helps conserve power and prolong battery life when the system is disconnected from a power source. When battery saver is on, some Windows features are disabled, throttled, or behave differently. Screen brightness is also reduced. Battery saver is only available when using battery power (DC). To learn more, see [Battery Saver](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver).| -| Recommended | Delivers longer battery life than the default settings in earlier versions of Windows. | -| Better Performance | Slightly favors performance over battery life, functioning as the default slider mode. | -| Best Performance | Favors performance over power for workloads requiring maximum performance and responsiveness, regardless of battery power consumption.| - -Power slider modes directly control specific hardware components shown -in the following table. - -| Component | Slider functionality | -|---|---| -| Intel Speed Shift (CPU energy registers) and Energy Performance Preference hint. | Selects the best operating frequency and voltage for optimal performance and power. The Energy Performance Preference (PERFEPP) is a global power efficiency hint to the CPU. | -| Fan speed (RPM)| Where applicable, adjusts for changing conditions such as keeping fan silent in battery saver slider mode.| -| Processor package power limits (PL1/PL2).| Requires the CPU to manage its frequency choices to accommodate a running average power limit for both steady state (PL1) and turbo (PL2) workloads.| -| Processor turbo frequency limits (IA turbo limitations). | Adjusts processor and graphics performance allowing processor cores to run faster or slower than the rated operating frequency. | - ->[!NOTE] ->The power slider is entirely independent of operating system power settings whether configured from Control Panel/ Power Options, Group Policy, or related methods. - -To learn more, see: - -- [Customize the Windows performance power - slider](https://docs.microsoft.com/windows-hardware/customize/desktop/customize-power-slider) - -- [Battery - saver.](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver) - -## Best practices for extended battery life - - -| Best practice | Go to | Next steps | -|---|---|---| -| Ensure your Surface device is up to date| Windows Update | In the taskbar search box, type **Windows Update** and select **Check for updates**. | -| Choose the best power setting for what you’re doing | Power slider | In the taskbar, select the battery icon, then choose **Best performance**, **Best battery life**, or somewhere in between.| -| Conserve battery when it’s low | Battery saver | In the taskbar, select the battery icon and click **Battery settings**. Select **Turn battery saver on automatically if my battery falls below** and then move the slider further to the right for longer battery life. | -| Configure optimal screen brightness | Battery saver | In the taskbar, select the battery icon and click **Battery settings**, select **Lower screen brightness while in battery saver**. | -| Conserve power whenever you’re not plugged in | Battery saver| Select **Turn on battery saver status until next charge**.| -| Investigate problems with your power settings. | Power troubleshooter | In the Taskbar search for troubleshoot, select **Troubleshoot**, and then select **Power** and follow the instructions.| -| Check app usage | Your apps | Close apps.| -| Check your power cord for any damage.| Your power cord | Replace power cord if worn or damaged.| - -# Learn more - -- [Modern - standby](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-wake-sources) - - - -- [Customize the Windows performance power - slider](https://docs.microsoft.com/windows-hardware/customize/desktop/customize-power-slider) - -- [Battery - saver](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver) -- [Deploying the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md deleted file mode 100644 index 0913c4266d..0000000000 --- a/devices/surface/manage-surface-pro-3-firmware-updates.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Manage Surface driver and firmware updates (Surface) -description: This article describes the available options to manage firmware and driver updates for Surface devices. -ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73 -ms.reviewer: -manager: dansimp -keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 ---- - -# Manage Surface driver and firmware updates - - -This article describes the available options to manage firmware and driver updates for Surface devices. - -For a list of the available downloads for Surface devices and links to download the drivers and firmware for your device, see [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md). - -On Surface devices, the firmware is exposed to the operating system as a driver and is visible in Device Manager. This allows a Surface device firmware to be automatically updated along with all drivers through Windows Update. This mechanism provides a seamless, automatic experience to receive the latest firmware and driver updates. Although automatic updating is easy for end users, updating firmware and drivers automatically may not always apply to organizations and businesses. Automatic updates with Windows Update may not be applicable where updates are carefully managed, or when you deploy a new operating system to a Surface device. - -## Methods for firmware deployment - - -Although firmware is provided automatically by Windows Update for computers that receive updates directly from Microsoft, in environments where updates are carefully managed by using Windows Server Update Services (WSUS), updating the firmware through Windows Update is not supported. For managed environments, there are a number of options you can use to deploy firmware updates. - -**Windows Update** - -The simplest solution to ensure that firmware on Surface devices in your organization is kept up to date is to allow Surface devices to receive updates directly from Microsoft. You can implement this solution easily by excluding Surface devices from Group Policy that directs computers to receive updates from WSUS. - -Although this solution ensures that firmware will be updated as new releases are made available to Windows Update, it does present potential drawbacks. Each Surface device that receives Windows Updates directly will separately download each update rather than accessing a central location, which increases demand on Internet connectivity and bandwidth. Updates are also provided automatically to devices, without being subjected to testing or review by administrators. - -For details about Group Policy for client configuration of WSUS or Windows Update, see [Step 5: Configure Group Policy Settings for Automatic Updates](https://technet.microsoft.com/library/dn595129). - -**Windows Installer Package** - -The firmware and driver downloads for Surface devices now include Windows Installer files for firmware and driver updates. These Windows Installer packages can be deployed with utilities that support application deployment, including the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. This solution allows for centralized deployment and for administrators to test and review firmware updates before they are deployed. For more information about the Windows Installer package delivery method for firmware and driver updates, including details on what drivers are updated by the package and why certain drivers and firmware are not updated by the Windows Installer package, see the [Surface Pro 3 MSI Now Available](https://blogs.technet.microsoft.com/surface/2015/03/04/surface-pro-3-msi-now-available/) blog post. - -For instructions on how to deploy with System Center Configuration Manager, refer to [How to Deploy Applications in Configuration Manager](https://technet.microsoft.com/library/gg682082). For deployment of applications with MDT, see [Step 4: Add an application in the Deploy a Windows 8.1 Image Using MDT 2013](https://technet.microsoft.com/library/dn744279#sec04). Note that you can deploy applications separately from an operating system deployment through MDT by using a Post OS Installation task sequence. - -**Provisioning packages** - -New in Windows 10, provisioning packages (PPKG files) provide a simple method to apply a configuration to a destination device. You can find out more about provisioning packages, including instructions for how to create your own, in [Provisioning packages](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages). For easy application of a complete set of drivers and firmware to devices running Windows 10, a provisioning package is supplied for Surface Pro 3 devices. This file contains all of the instructions and required assets to update a Surface Pro 3 device with Windows 10 to the latest drivers and firmware. - -**Windows PowerShell** - -Another method you can use to update the firmware when Windows Updates are managed in the organization is to install the firmware from the firmware and driver pack by using PowerShell. This method allows for a similar deployment experience to the Windows Installer package and can similarly be deployed as a package by using System Center Configuration Manager. You can find the PowerShell script and details on how to perform the firmware deployment in the [Deploying Drivers and Firmware to Surface Pro](https://blogs.technet.microsoft.com/deploymentguys/2013/05/16/deploying-drivers-and-firmware-to-surface-pro/) blog post. - -## Operating system deployment considerations - - -The deployment of firmware updates during an operating system deployment is a straightforward process. The firmware and driver pack can be imported into either System Center Configuration Manager or MDT, and are used to deploy a fully updated environment, complete with firmware, to a target Surface device. For a complete step-by-step guide for deployment to Surface Pro 3 using either Configuration Manager or MDT, download the [Deployment and Administration Guide for Surface Pro 3](https://www.microsoft.com/download/details.aspx?id=45292) from the Microsoft Download Center. - -The individual driver files are also made available in the Microsoft Download Center if you are using deployment tools. The driver files are available in the ZIP archive file in the list of available downloads for your device. - -**Windows PE and Surface firmware and drivers** - -A best practice for deployment with any solution that uses the Windows Preinstallation Environment (WinPE), such as System Center Configuration Manager or MDT, is to configure WinPE with only the drivers that are required during the WinPE stage of deployment. These usually include drivers for network adapters and storage controllers. This best practice helps to prevent errors with more complex drivers that rely on components that are not present in WinPE. For Surface Pro 3 devices, this is especially true of the Touch Firmware. The Touch Firmware should never be loaded in a WinPE environment on Surface Pro 3. - -**Update Surface Pro 3 firmware offline through USB** - -In some early versions of Surface Pro 3 firmware, PXE boot performance can be quite slow. This has been resolved with updated firmware, but for organizations where firmware will be updated through operating system deployment, this issue is encountered before the updates can be deployed to the device. In this scenario, you can deploy updated firmware through a USB drive to ensure that when the operating system deployment is initiated, the network boot is quick, and deployment can complete in a timely fashion. To create a USB drive to update Surface Pro 3 firmware, see [How to Update the Surface Pro 3 Firmware Offline using a USB Drive](https://blogs.technet.microsoft.com/askpfeplat/2014/10/19/how-to-update-the-surface-pro-3-firmware-offline-using-a-usb-drive/) on the Ask Premier Field Engineering (PFE) Platforms TechNet Blog. - -  - -  - - - - - diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md deleted file mode 100644 index d25c33688f..0000000000 --- a/devices/surface/manage-surface-uefi-settings.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: Manage Surface UEFI settings (Surface) -description: Use Surface UEFI settings to enable or disable devices or components, configure security settings, and adjust Surface device boot settings. -keywords: firmware, security, features, configure, hardware -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: devices, surface -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp ---- - -# Manage Surface UEFI settings - -Current and future generations of Surface devices, including Surface Pro 4, Surface Book, and Surface Studio, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. - ->[!NOTE] ->Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. - -You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot. - -## PC information - -On the **PC information** page, detailed information about your Surface device is provided: - -- **Model** – Your Surface device’s model will be displayed here, such as Surface Book or Surface Pro 4. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). -- **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. - -- **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. -- **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://www.microsoft.com/download/details.aspx?id=44076). - -You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC information** page (as shown in Figure 1): - -- System UEFI - -- SAM Controller - -- Intel Management Engine - -- System Embedded Controller - -- Touch Firmware - -![System information and firmware version information](images/manage-surface-uefi-figure-1.png "System information and firmware version information") - -*Figure 1. System information and firmware version information* - -You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) for your device. - -## Security - -On the **Security** page of Surface UEFI settings, you can set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 2): - -- Uppercase letters: A-Z - -- Lowercase letters: a-z - -- Numbers: 1-0 - -- Special characters: !@#$%^&*()?<>{}[]-_=+|.,;:’`” - -The password must be at least 6 characters and is case sensitive. - -![Add a password to protect Surface UEFI settings](images/manage-surface-uefi-fig2.png "Add a password to protect Surface UEFI settings") - -*Figure 2. Add a password to protect Surface UEFI settings* - -On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library. - -![Configure Secure Boot](images/manage-surface-uefi-fig3.png "Configure Secure Boot") - -*Figure 3. Configure Secure Boot* - -You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. - -![Configure Surface UEFI security settings](images/manage-surface-uefi-fig4.png "Configure Surface UEFI security settings") - -*Figure 4. Configure Surface UEFI security settings* - -## Devices - -On the **Devices** page you can enable or disable specific devices and components of your Surface device. Devices that you can enable or disable on this page include: - -- Docking and USB Ports - -- MicroSD or SD Card Slot - -- Rear Camera - -- Front Camera - -- Infrared (IR) Camera - -- Wi-Fi and Bluetooth - -- Onboard Audio (Speakers and Microphone) - -Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. - -![Enable and disable specific devices](images/manage-surface-uefi-fig5.png "Enable and disable specific devices") - -*Figure 5. Enable and disable specific devices* - -## Boot configuration - -On the **Boot Configuration** page, you can change the order of your boot devices and/or enable or disable boot of the following devices: - -- Windows Boot Manager - -- USB Storage - -- PXE Network - -- Internal Storage - -You can boot from a specific device immediately, or you can swipe left on that device’s entry in the list using the touchscreen. You can also boot immediately to a USB device or USB Ethernet adapter when the Surface device is powered off by pressing the **Volume Down** button and the **Power** button simultaneously. - -For the specified boot order to take effect, you must set the **Enable Alternate Boot Sequence** option to **On**, as shown in Figure 6. - -![Configure the boot order for your Surface device](images/manage-surface-uefi-fig6.png "Configure the boot order for your Surface device") - -*Figure 6. Configure the boot order for your Surface device* - -You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only. - -## About - -The **About** page displays regulatory information, such as compliance with FCC rules, as shown in Figure 7. - -![Regulatory information displayed on the About page](images/manage-surface-uefi-fig7.png "Regulatory information displayed on the About page") - -*Figure 7. Regulatory information displayed on the About page* - -## Exit - -Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. - -![Exit Surface UEFI and restart the device](images/manage-surface-uefi-fig8.png "Exit Surface UEFI and restart the device") - -*Figure 8. Click Restart Now to exit Surface UEFI and restart the device* - -## Surface UEFI boot screens - -When you update Surface device firmware, by using either Windows Update or manual installation, the updates are not applied immediately to the device, but instead during the next reboot cycle. You can find out more about the Surface firmware update process in [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates). The progress of the firmware update is displayed on a screen with progress bars of differing colors to indicate the firmware for each component. Each component’s progress bar is shown in Figures 9 through 13. - -![Surface UEFI firmware update with blue progress bar](images/manage-surface-uefi-fig9.png "Surface UEFI firmware update with blue progress bar") - -*Figure 9. The Surface UEFI firmware update displays a blue progress bar* - -![System Embedded Controller firmware with green progress bar](images/manage-surface-uefi-fig10.png "System Embedded Controller firmware with green progress bar") - -*Figure 10. The System Embedded Controller firmware update displays a green progress bar* - -![SAM Controller firmware update with orange progress bar](images/manage-surface-uefi-fig11.png "SAM Controller firmware update with orange progress bar") - -*Figure 11. The SAM Controller firmware update displays an orange progress bar* - -![Intel Management Engine firmware with red progress bar](images/manage-surface-uefi-fig12.png "Intel Management Engine firmware with red progress bar") - -*Figure 12. The Intel Management Engine firmware update displays a red progress bar* - -![Surface touch firmware with gray progress bar](images/manage-surface-uefi-fig13.png "Surface touch firmware with gray progress bar") - -*Figure 13. The Surface touch firmware update displays a gray progress bar* ->[!NOTE] ->An additional warning message that indicates Secure Boot is disabled is displayed, as shown in Figure 14. - -![Surface boot screen that indicates Secure Boot has been disabled](images/manage-surface-uefi-fig14.png "Surface boot screen that indicates Secure Boot has been disabled") - -*Figure 14. Surface boot screen that indicates Secure Boot has been disabled in Surface UEFI settings* - -## Related topics - -[Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md) diff --git a/devices/surface/microsoft-surface-brightness-control.md b/devices/surface/microsoft-surface-brightness-control.md deleted file mode 100644 index 41b2e3d994..0000000000 --- a/devices/surface/microsoft-surface-brightness-control.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Surface Brightness Control -description: This topic describes how you can use the Surface Brightness Control app to manage display brightness in point-of-sale and kiosk scenarios. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 1/15/2019 -ms.reviewer: -manager: dansimp ---- - -# Surface Brightness Control - -When deploying Surface devices in point of sale or other “always-on” -kiosk scenarios, you can optimize power management using the new Surface -Brightness Control app. - -Available for download with [Surface Tools for -IT](https://www.microsoft.com/download/details.aspx?id=46703), Surface Brightness Control is -designed to help reduce thermal load and lower the overall carbon -footprint for deployed Surface devices. The tool automatically dims the screen when not in use and -includes the following configuration options: - -- Period of inactivity before dimming the display. - -- Brightness level when dimmed. - -- Maximum brightness level when in use. - -**To run Surface Brightness Control:** - -- Install surfacebrightnesscontrol.msi on the target device and Surface Brightness Control - will begin working immediately. - -## Configuring Surface Brightness Control - -You can adjust the default values via the Windows Registry. For more -information about using the Windows Registry, refer to the [Registry -documentation](https://docs.microsoft.com/windows/desktop/sysinfo/registry). - -1. Run regedit from a command prompt to open the Windows Registry - Editor. - - - Computer\HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Surface\Surface - Brightness Control\ - - -| Registry Setting | Data| Description -|-----------|------------|--------------- -| Brightness Control Enabled | Default: 01
          Option: 01, 00
          Type: REG_BINARY | This setting allows you to turn Surface Brightness Control on or off. To disable Surface Brightness Control, set the value to 00. If you do not configure this setting, Surface Brightness Control is on. | -| Brightness Control On Power Enabled| Default: 01
          Options: 01, 00
          Type: REG_BINARY | This setting allows you to turn off Surface Brightness Control when the device is directly connected to power. To disable Surface Brightness Control when power is plugged in, set the value to 00. If you do not configure this setting, Surface Brightness Control is on. | -| Dimmed Brightness | Default: 20
          Option: Range of 0-100 percent of screen brightness
          Data Type: Positive integer
          Type: REG_DWORD | This setting allows you to manage brightness range during periods of inactivity. If you do not configure this setting, the brightness level will drop to 20 percent of full brightness after 30 seconds of inactivity. | -Full Brightness | Default: 100
          Option: Range of 0-100 percent of screen brightness
          Data Type: Positive integer
          Type: REG_DWORD | This setting allows you to manage the maximum brightness range for the device. If you do not configure this setting, the maximum brightness range is 100 percent.| -| Inactivity Timeout| Default: 30 seconds
          Option: Any numeric value
          Data Type: Integer
          Type: REG_DWORD | This setting allows you to manage the period of inactivity before dimming the device. If you do not configure this setting, the inactivity timeout is 30 seconds.| -| Telemetry Enabled | Default: 01
          Option: 01, 00
          Type: REG_BINARY | This setting allows you to manage the sharing of app usage information to improve software and provide better user experience. To disable telemetry, set the value to 00. If you do not configure this setting, telemetry information is shared with Microsoft in accordance with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). | - -## Changes and updates - -### Version 1.12.239.0 -*Release Date: 26 April 2019*
          -This version of Surface Brightness Control adds support for the following: -- Touch delay fixes. - - -## Related topics - -- [Battery limit setting](battery-limit.md) diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md deleted file mode 100644 index 3688553be3..0000000000 --- a/devices/surface/microsoft-surface-data-eraser.md +++ /dev/null @@ -1,221 +0,0 @@ ---- -title: Microsoft Surface Data Eraser (Surface) -description: Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. -ms.assetid: 8DD3F9FE-5458-4467-BE26-E9200341CF10 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium -keywords: tool, USB, data, erase -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 05/15/2018 ---- - -# Microsoft Surface Data Eraser - - -Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. - -[Microsoft Surface Data Eraser](https://www.microsoft.com/download/details.aspx?id=46703) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB stick is easy to create by using the provided wizard, the Microsoft Surface Data Eraser wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://www.microsoft.com/surface/support/security-sign-in-and-accounts/data-wiping-policy). - ->[!IMPORTANT] ->Microsoft Surface Data Eraser uses the NVM Express (NVMe) format command to erase data as authorized in [NIST Special Publication 800-88 Revision 1](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf). - -Compatible Surface devices include: - -* Surface Pro 6 -* Surface Laptop 2 -* Surface Go -* Surface Book 2 -* Surface Pro with LTE Advanced (Model 1807) -* Surface Pro (Model 1796) -* Surface Laptop -* Surface Studio -* Surface Book -* Surface Pro 4 -* Surface 3 LTE -* Surface 3 -* Surface Pro 3 -* Surface Pro 2 - -Some scenarios where Microsoft Surface Data Eraser can be helpful include: - -- Prepare a Surface device to be sent for repair - -- Decommission a Surface device to be removed from corporate or organizational use - -- Repurpose a Surface device for use in a new department or for use by a new user - -- Standard practice when performing reimaging for devices used with sensitive data - ->[!NOTE] ->Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. - ->[!NOTE] ->Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. - ->[!NOTE] ->Surface Data Eraser on Surface Studio and Surface Studio 2 can take up to 6 minutes to boot into WinPE before disk erasure can occur. - - -## How to create a Microsoft Surface Data Eraser USB stick - - -To create a Microsoft Surface Data Eraser USB stick, first install the Microsoft Surface Data Eraser setup tool from the Microsoft Download Center using the link provided at the beginning of this article. You do not need a Surface device to *create* the USB stick. After you have downloaded the installation file to your computer, follow these steps to install the Microsoft Surface Data Eraser creation tool: - -1. Run the DataEraserSetup.msi installation file that you downloaded from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=46703). - -2. Select the check box to accept the terms of the license agreement, and then click **Install**. - -3. Click **Finish** to close the Microsoft Surface Data Eraser setup window. - -After the creation tool is installed, follow these steps to create a Microsoft Surface Data Eraser USB stick. Before you begin these steps, ensure that you have a USB 3.0 stick that is 4 GB or larger connected to the computer. - -1. Start Microsoft Surface Data Eraser from the Start menu or Start screen. - -2. Click **Build** to begin the Microsoft Surface Data Eraser USB creation process. - -3. Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1. - - ![Start the Microsoft Surface Data Eraser tool](images/dataeraser-start-tool.png "Start the Microsoft Surface Data Eraser tool") - - *Figure 1. Start the Microsoft Surface Data Eraser tool* - -4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost. - - >[!NOTE] - >If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB. - - ![USB thumb drive selection](images/dataeraser-usb-selection.png "USB thumb drive selection") - - *Figure 2. USB thumb drive selection* - -5. After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**. - -6. When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 3. - - ![Surface Data Eraser USB creation process](images/dataeraser-complete-process.png "Surface Data Eraser USB creation process") - - *Figure 3. Complete the Microsoft Surface Data Eraser USB creation process* - -7. Click **X** to close Microsoft Surface Data Eraser. - -## How to use a Microsoft Surface Data Eraser USB stick - - -After you create a Microsoft Surface Data Eraser USB stick, you can boot a supported Surface device from the USB stick by following this procedure: - -1. Insert the bootable Microsoft Surface Data Eraser USB stick into the supported Surface device. - -2. Boot your Surface device from the Microsoft Surface Data Eraser USB stick. To boot your device from the USB stick follow these steps: - - a. Turn off your Surface device. - - b. Press and hold the **Volume Down** button. - - c. Press and release the **Power** button. - - d. Release the **Volume Down** button. - - >[!NOTE] - >If your device does not boot to USB using these steps, you may need to turn on the **Enable Alternate Boot Sequence** option in Surface UEFI. You can read more about Surface UEFI boot configuration in [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). - -3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed, as shown in Figure 4. - - ![Booting the Microsoft Surface Data Eraser USB stick](images/data-eraser-3.png "Booting the Microsoft Surface Data Eraser USB stick") - - *Figure 4. Booting the Microsoft Surface Data Eraser USB stick* - -4. Read the software license terms, and then close the Notepad file. - -5. Accept or decline the software license terms by typing **Accept** or **Decline**. You must accept the license terms to continue. - -6. The Microsoft Surface Data Eraser script detects the storage devices that are present in your Surface device and displays the details of the native storage device. To continue, press **Y** (this action runs Microsoft Surface Data Eraser and removes all data from the storage device) or press **N** (this action shuts down the device without removing data). - - >[!NOTE] - >The Microsoft Surface Data Eraser tool will delete all data, including Windows operating system files required to boot the device, in a secure and unrecoverable way. To boot a Surface device that has been wiped with Microsoft Surface Data Eraser, you will first need to reinstall the Windows operating system. To remove data from a Surface device without removing the Windows operating system, you can use the **Reset your PC** function. However, this does not prevent your data from being recovered with forensic or data recovery capabilities. See [Recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options) for more information. - - ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed") - - *Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser* - -7. If you pressed **Y** in step 6, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice. - -8. Click the **Yes** button to continue erasing data on the Surface device. - ->[!NOTE] ->When you run Surface Data Eraser on the Surface Data Eraser USB drive, a log file is generated in the **SurfaceDataEraserLogs** folder. - -## Changes and updates - -Microsoft Surface Data Eraser is periodically updated by Microsoft. For information about the changes provided in each new version, see the following: - -### Version 3.2.78.0 -*Release Date: 4 Dec 2018* - -This version of Surface Data Eraser: - -- Includes bug fixes - - -### Version 3.2.75.0 -*Release Date: 12 November 2018* - -This version of Surface Data Eraser: - -- Adds support to Surface Studio 2 -- Fixes issues with SD card - -### Version 3.2.69.0 -*Release Date: 12 October 2018* - -This version of Surface Data Eraser adds support for the following: - -- Surface Pro 6 -- Surface Laptop 2 - -### Version 3.2.68.0 -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Go - - -### Version 3.2.58.0 -This version of Microsoft Surface Data Eraser adds support for the following: - -- Additional storage devices (drives) for Surface Pro and Surface Laptop devices - - -### Version 3.2.46.0 -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Pro with LTE Advanced - - -### Version 3.2.45.0 - -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Book 2 - -- Surface Pro 1TB - ->[!NOTE] ->Surface Data Eraser v3.2.45.0 and above can be used to restore Surface Pro or Surface Laptop devices with the 1TB storage option in the scenario that the device shows two separate 512GB volumes or encounters errors when attempting to deploy or install Windows 10. See [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/help/4046105/surface-pro-model-1796-and-surface-laptop-1tb-display-two-drives) for more information. - - -### Version 3.2.36.0 - -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Pro - -- Surface Laptop - ->[!NOTE] ->The Microsoft Surface Data Eraser USB drive creation tool is unable to run on Windows 10 S. To wipe a Surface Laptop running Windows 10 S, you must first create the Microsoft Surface Data Eraser USB drive on another computer with Windows 10 Pro or Windows 10 Enterprise. diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md deleted file mode 100644 index b6921a138f..0000000000 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: Microsoft Surface Deployment Accelerator (Surface) -description: Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices. -ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4 -ms.reviewer: -manager: dansimp -ms.date: 07/27/2017 -ms.localizationpriority: medium -keywords: deploy, install, tool -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article ---- - -# Microsoft Surface Deployment Accelerator - - -Microsoft Surface Deployment Accelerator (SDA) provides a quick and simple deployment mechanism for organizations to reimage Surface devices. - -SDA includes a wizard that automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. The resulting deployment solution is complete with everything you need to immediately begin the deployment of Windows to a Surface device. You can also use SDA to create and capture a Windows reference image and then deploy it with the latest Windows updates. - -SDA is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution. - -You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](https://technet.microsoft.com/windows/dn913725). - -**Download Microsoft Surface Deployment Accelerator** - -You can download the installation files for SDA from the Microsoft Download Center. To download the installation files: - -1. Go to the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center. - -2. Click the **Download** button, select the **Surface\_Deployment\_Accelerator\_xxxx.msi** file, and then click **Next**. - -## Microsoft Surface Deployment Accelerator prerequisites - - -Before you install SDA, your environment must meet the following prerequisites: - -- SDA must be installed on Windows Server 2012 R2 or later - -- PowerShell Script Execution Policy must be set to **Unrestricted** - -- DHCP and DNS must be enabled on the network where the Windows Server 2012 R2 environment is connected - -- To download Surface drivers and apps automatically the Windows Server 2012 R2 environment must have Internet access and Internet Explorer Enhanced Security Configuration must be disabled - -- To support network boot, the Windows Server 2012 R2 environment must have Windows Deployment Services installed and configured to respond to PXE requests - -- Access to Windows source files or installation media is required when you prepare a deployment with SDA - -- At least 6 GB of free space for each version of Windows you intend to deploy - -## How Microsoft Surface Deployment Accelerator works - - -As you progress through the SDA wizard, you will be asked some basic questions about how your deployment solution should be configured. As you select the desired Surface models to be supported and apps to be installed (see Figure 1), the wizard will prepare scripts that download, install, and configure everything needed to perform a complete deployment and capture of a reference image. By using the network boot (PXE) capabilities of Windows Deployment Services (WDS), the resulting solution enables you to boot a Surface device from the network and perform a clean deployment of Windows. - -![Software and driver selection window](images/sda-fig1-select-steps.png "Software and driver selection window") - -*Figure 1. Select desired apps and drivers* - -When the SDA completes, you can use the deployment share to deploy over the network immediately. Simply boot your Surface device from the network using a Surface Ethernet Adapter and select the Surface deployment share you created with the SDA wizard. Select the **1- Deploy Microsoft Surface** task sequence and the wizard will walk you through an automated deployment of Windows to your Surface device. - -You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt#sec04), or to [pause the automated installation routine](https://blogs.technet.microsoft.com/mniehaus/2009/06/26/mdt-2010-new-feature-3-suspend-and-resume-a-lite-touch-task-sequence/). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before. - ->[!NOTE] ->With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment. - -  - -## Use Microsoft Surface Deployment Accelerator without an Internet connection - - -For environments where the SDA server will not be able to connect to the Internet, the required Surface files can be downloaded separately. To specify a local source for Surface driver and app files, select the **Copy from a local directory** option and specify the location of your downloaded files (see Figure 2). All of the driver and app files for your selected choices must be placed in the specified folder. - -![Specify a local source for Surface driver and app files](images/sda-fig2-specify-local.png "Specify a local source for Surface driver and app files") - -*Figure 2. Specify a local source for Surface driver and app files* - -You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) - ->[!NOTE] ->Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder. - ->[!NOTE] ->Using files from a local directory is not supported when including Office 365 in your deployment share. To include Office 365 in your deployment share, select the **Download from the Internet** check box. - -## Changes and updates - -SDA is periodically updated by Microsoft. For instructions on how these features are used, see [Step-by-Step: Microsoft Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator). - ->[!NOTE] ->To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share. - -### Version 2.8.136.0 -This version of SDA supports deployment of the following: -* Surface Book 2 -* Surface Laptop -* Surface Pro LTE - -### Version 2.0.8.0 -This version of SDA supports deployment of the following: -* Surface Pro - ->[!NOTE] ->SDA version 2.0.8.0 includes support only for Surface Pro, and does not support other Surface devices such as Surface Pro 4 or Surface Book. To deploy these devices, please continue to use SDA version 1.96.0405. -  -### Version 1.96.0405 -This version of SDA adds support for the following: -* Microsoft Deployment Toolkit (MDT) 2013 Update 2 -* Office 365 Click-to-Run -* Surface 3 and Surface 3 LTE -* Reduced Windows Assessment and Deployment Kit (Windows ADK) footprint, only the following Windows ADK components are installed: - * Deployment tools - * Windows Preinstallation Environment (WinPE) - * User State Migration Tool (USMT) - -### Version 1.90.0258 -This version of SDA adds support for the following: -* Surface Book -* Surface Pro 4 -* Windows 10 - -### Version 1.90.0000 -This version of SDA adds support for the following: -* Local driver and app files can be used to create a deployment share without access to the Internet - -### Version 1.70.0000 -This version is the original release of SDA. This version of SDA includes support for: -* MDT 2013 Update 1 -* Windows ADK -* Surface Pro 3 -* Windows 8.1 - - -## Related topics - -[Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md) - -[Using the Surface Deployment Accelerator deployment share](using-the-sda-deployment-share.md) - - diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md deleted file mode 100644 index 956924345f..0000000000 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ /dev/null @@ -1,407 +0,0 @@ ---- -title: Step by step Surface Deployment Accelerator (Surface) -description: This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. -ms.assetid: A944FB9C-4D81-4868-AFF6-B9D1F5CF1032 -ms.reviewer: -manager: dansimp -ms.localizationpriority: medium -keywords: deploy, configure -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 ---- - -# Step by step: Surface Deployment Accelerator - -This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. This article also contains instructions on how to perform these tasks without an Internet connection or without support for Windows Deployment Services network boot (PXE). - -## How to install Surface Deployment Accelerator - -For information about prerequisites and instructions for how to download and install SDA, see [Microsoft Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md). - -1. Download SDA, which is included in [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) on the Microsoft Download Center. - -2. Run the SDA installation file, named **Surface\_Deployment\_Accelerator\_*xxxx*.msi**, where *xxxx* is the current version number. - -3. Accept the End User License Agreement (EULA) by selecting the check box, and then click **Install**, as shown in Figure 1. - - ![Surface Deployment Accelerator setup](images/sdasteps-fig1.png "Surface Deployment Accelerator setup") - - *Figure 1. SDA setup* - -4. Click **Finish** to complete the installation of SDA. - -The tool installs in the SDA program group, as shown in Figure 2. - -![SDA program group and icon](images/sdasteps-fig2.png "SDA program group and icon") - -*Figure 2. The SDA program group and icon* - ->[!NOTE] ->At this point, the tool has not yet prepared any deployment environment or downloaded any materials from the Internet. - -## Create a deployment share - -The following steps show you how to create a deployment share for Windows 10 that supports Surface 3, Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, the Surface Asset Tag Tool, and Office 365. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps. - ->[!NOTE] ->SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice. - -1. Open the SDA wizard by double-clicking the icon in the **Surface Deployment Accelerator** program group on the Start screen. - -2. On the **Welcome** page, click **Next** to continue. - -3. On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 2. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue. - - >[!NOTE] - >As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows: - > * Deployment tools - > * User State Migration Tool (USMT) - > * Windows Preinstallation Environment (WinPE) - - > [!NOTE] - > As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1. - -4. On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue. - -5. On the **Windows 10** page, to create a Windows 10 deployment share, select the **Would you like to support Windows 10** check box. Supply the following information before you click **Next** to continue: - - - **Configure Deployment Share for Windows 10** - - - **Local Path** – Specify or browse to a location on the local storage device where you would like to store the deployment share files for the Windows 10 SDA deployment share. For example, **E:\\SDAWin10\\** is the location specified in Figure 3. - - - **Share Name** – Specify a name for the file share that will be used to access the deployment share on this server from the network. For example, **SDAWin10** is the deployment share name shown in Figure 3. The local path folder is automatically shared by the SDA scripts under this name to the group **Everyone** with a permission level of **Full Control**. - - - **Windows 10 Deployment Services** - - - Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx) for more information about how to configure Windows Deployment Services for PXE boot. - - - **Windows 10 Source Files** - - - **Local Path** – Specify or browse to the root directory of Windows 10 installation files. If you have an ISO file, mount it and browse to the root of the mounted drive. You must have a full set of source files, not just **Install.wim**. - - ![Specify Windows 10 deployment share options](images/sdasteps-fig3.png "Specify Windows 10 deployment share options") - - *Figure 3. Specify Windows 10 deployment share options* - -6. On the **Configure** page, select the check box next to each device or app that you want to include in your deployment share. Note that Surface Pro 4 and Surface Book only support Windows 10 and are not available for the deployment of Windows 8.1. The Surface Firmware Tool is only applicable to Surface 3 and Surface Pro 3 and cannot be selected unless Surface 3 or Surface Pro 3 drivers are selected, as shown in Figure 4. Click **Next** to continue. - - ![Firmware tool selection](images/sdasteps-fig4-select.png "Firmware tool selection") - - *Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers* - - >[!NOTE] - >You cannot select both Surface 3 and Surface 3 LTE models at the same time. - -7. On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes: - - - Download of Windows ADK - - - Installation of Windows ADK - - - Download of MDT - - - Installation of MDT - - - Download of Surface apps and drivers - - - Creation of the deployment share - - - Import of Windows installation files into the deployment share - - - Import of the apps and drivers into the deployment share - - - Creation of rules and task sequences for Windows deployment - - ![The installation progress window](images/sdasteps-fig5-installwindow.png "The installation progress window") - - *Figure 5. The Installation Progress window* - - ### Optional: Workaround for Webclient exception - - You may see this error message while installing the latest version of ADK or MDT: _An exception occurred during a WebClient request._ This is due to incompatibility between the Surface Deployment Accelerator (SDA) and Background Intelligent Transfer Service (BITS). To work around this issue, do the following. - - In the two PowerShell scripts: - - ```PowerShell - %ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\Install-MDT.ps1 - %ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\INSTALL-WindowsADK.ps1 - ``` - - Edit the $BITSTransfer variable in the input parameters to $False as shown below: - - ```PowerShell - Param( - [Parameter( - Position=0, - Mandatory=$False, - HelpMessage="Download via BITS bool true/false" - )] - [string]$BITSTransfer = $False - ) - ``` - -8. When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices. - - ### Optional: Create a deployment share without an Internet connection - - If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver and app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6. - - >[!NOTE] - >All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step. - - >[!NOTE] - >The driver and app files do not need to be extracted from the downloaded .zip files. - - >[!NOTE] - >Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files. - - ![Specify Surface driver and app files](images/sdasteps-fig6-specify-driver-app-files.png "Specify Surface driver and app files") - - *Figure 6. Specify the Surface driver and app files from a local path* - - >[!NOTE] - >The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later. - - ### Optional: Prepare offline USB media - - You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection. - - >[!NOTE] - >The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended. - - Before you can create bootable media files within the MDT Deployment Workbench or copy those files to a USB drive, you must first configure that USB drive to be bootable. Using [DiskPart](https://go.microsoft.com/fwlink/p/?LinkId=761073), create a partition, format the partition as FAT32, and set the partition to be active. To run DiskPart, open an administrative PowerShell or Command Prompt window, and then run the following sequence of commands, as shown in Figure 7: - - 1. **diskpart** – Opens DiskPart to manage disks and partitions. - - 2. **list disk** – Displays a list of the disks available in your system; use this list to identify the disk number that corresponds with your USB drive. - - 3. **sel disk 2** – Selects your USB drive; use the number that corresponds with the disk in your system. - - 4. **clean** – Removes all configuration from your USB drive. - - >[!WARNING] - >This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command. - - 5. **create part pri** – Creates a primary partition on the USB drive. - - 6. **format fs=fat32 quick** – Formats the partition with the FAT32 file system, performing a quick format. FAT32 is required to boot the device from UEFI systems like Surface devices. - - 7. **assign** – Assigns the next available drive letter to the newly created FAT32 volume. - - 8. **active** – Sets the partition to be active, which is required to boot the volume. - - 9. **exit** – Exits DiskPart, after which you can close the PowerShell or Command Prompt window. - - ![Use DiskPart to prepare a USB drive for boot](images/sdasteps-fig7-diskpart.png "Use DiskPart to prepare a USB drive for boot") - - *Figure 7. Use DiskPart to prepare a USB drive for boot* - - >[!NOTE] - >You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly. - - After you have prepared the USB drive for boot, the next step is to generate offline media from the SDA deployment share. To create this media, follow these steps: - - 1. Open the **Deployment Workbench** from the **Microsoft Deployment Toolkit** group on your Start screen. - - 2. Expand the **Deployment Shares** node and the **Microsoft Surface Deployment Accelerator** deployment share. - - 3. Expand the folder **Advanced Configuration** and select the **Media** folder. - -4. Right-click the **Media** folder and click **New Media** as shown in Figure 8 to start the New Media Wizard. - - ![The Media folder of the SDA deployment share](images/sdasteps-fig8-mediafolder.png "The Media folder of the SDA deployment share") - - *Figure 8. The Media folder of the SDA deployment share* - - 5. On the **General Settings** page in the **Media path** field, enter or browse to a folder where you will create the files for the new offline media. See the example **E:\\SDAMedia** in Figure 9. Leave the default profile **Everything** selected in the **Selection profile** drop-down menu, and then click **Next**. - - ![Specify a location and selection profile for your offline media](images/sdasteps-fig9-location.png "Specify a location and selection profile for your offline media") - - *Figure 9. Specify a location and selection profile for your offline media* - - 6. On the **Summary** page verify your selections, and then click **Next** to begin creation of the media. - - 7. A **Progress** page is displayed while the media is created. - - 8. On the **Confirmation** page, click **Finish** to complete creation of the media. - - 9. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab as shown in Figure 10. - - ![Rules of the SDA deployment share](images/sdasteps-fig10-rules.png "Rules of the SDA deployment share") - - *Figure 10. Rules of the SDA deployment share* - - 10. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+C** to copy the text. - - 11. Click **OK** to close the **Microsoft Surface Deployment Accelerator** deployment share properties. - - 12. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab. - - 13. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+V** to paste the text you copied from the **Microsoft Surface Deployment Accelerator** deployment share rules. - - 14. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad. - - 15. Press **Ctrl+A** to select all of the text in the window, and then press **Ctrl+C** to copy the text. - - 16. Close Bootstrap.ini and click **OK** in **Microsoft Surface Deployment Accelerator** deployment share properties to close the window. - - 17. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad. - - 18. Press **Ctrl+A** to select all of the text in the window, then press **Ctrl+V** to paste the text from the SDA deployment share Bootstrap.ini file. - - 19. Delete the following lines from the Bootstrap.ini as shown in Figure 11, and then save the file: - - ```PowerShell - UserID= - UserDomain= - UserPassword= - DeployRoot=\\SDASERVER\SDAWin10 - UserID= - UserDomain= - UserPassword= - ``` - - ![The Bootstrap.ini file](images/sdasteps-fig11-bootstrap.ini.png "The Bootstrap.ini file") - - *Figure 11. The Bootstrap.ini file of MEDIA001* - - 20. Close Bootstrap.ini and click **OK** in **MEDIA001** deployment share properties to close the window. - - 21. In the **Deployment Workbench** under the **Media** folder, right-click the newly created **MEDIA001** and click **Update Media Content**, as shown in Figure 12. This will update the media files with the content of the **Microsoft Surface Deployment Accelerator** deployment share. - - ![Select the Update Media Content option](images/sdasteps-fig12-updatemedia.png "Select the Update Media Content option") - - *Figure 12. Select the Update Media Content option* - - 22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.** - - The final step is to copy the offline media files to your USB drive. - - 1. In File Explorer, open the path you specified in Step 5, for example **E:\\SDAMedia**. - - 2. Copy all of the files from the Content folder to the root of the USB drive. - - Your USB drive is now configured as bootable offline media that contains all of the resources required to perform a deployment to a Surface device. - -## SDA task sequences - -The SDA deployment share is configured with all of the resources required to perform a Windows deployment to a Surface device. These resources include Windows source files, image, Surface drivers, and Surface apps. The deployment share also contains two pre-configured task sequences, as shown in Figure 13. These task sequences contain the steps required to perform a deployment to a Surface device using the default Windows image from the installation media or to create a reference image complete with Windows updates and applications. To learn more about task sequences, see [MDT 2013 Update 2 Lite Touch components](https://technet.microsoft.com/itpro/windows/deploy/mdt-2013-lite-touch-components). - -![Task sequences in the Deployment Workbench](images/sdasteps-fig13-taskseq.png "Task sequences in the Deployment Workbench") - -*Figure 13. Task sequences in the Deployment Workbench* - -### Deploy Microsoft Surface - -The **1 – Deploy Microsoft Surface** task sequence is used to perform a complete deployment of Windows to a Surface device. This task sequence is pre-configured by the SDA wizard and is ready to perform a deployment as soon as the wizard completes. Running this task sequence on a Surface device deploys the unaltered Windows image copied directly from the Windows installation media you specified in the SDA wizard, along with the Surface drivers for your device. The drivers for your Surface device will be automatically selected through the pre-configured deployment share rules. - -When you run the task sequence, you will be prompted to provide the following information: - -- A computer name - -- Your domain information and the credentials required to join the domain - -- A product key, if one is required - - >[!NOTE] - >If you are deploying the same version of Windows as the version that came on your device, no product key is required. - -- A time zone - -- An Administrator password - -The Surface apps you specified on the **Configure** page of the SDA wizard are automatically installed when you run this task sequence on a Surface device. - -### Create Windows reference image - -The **2 – Create Windows Reference Image** task sequence is used to perform a deployment to a virtual machine for the purpose of capturing an image complete with Windows Updates for use in a deployment to Surface devices. By installing Windows Updates in your reference image, you eliminate the need to download and install those updates on each deployed Surface device. The deployment process with an up-to-date image is significantly faster and more efficient than performing a deployment first and then installing Windows Updates on each device. - -Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations. - ->[!NOTE] ->Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt). - -In addition to the information required by the **1 – Deploy Microsoft Surface** task sequence, you will also be prompted to capture an image when you run this task sequence on your reference virtual machine. The **Location** and **File name** fields are automatically populated with the proper information for your deployment share. All that you need to do is select the **Capture an image of this reference computer** option when you are prompted on the **Capture Image** page of the Windows Deployment Wizard. - -## Deployment to Surface devices - - -To perform a deployment from the SDA deployment share, follow this process on the Surface device: - -1. Boot the Surface device to MDT boot media for the SDA deployment share. You can do this over the network by using PXE boot, or from a USB drive as described in the [Optional: Prepare offline USB media](#optional) section of this article. - -2. Select the deployment share for the version of Windows you intend to deploy and enter your credentials when you are prompted. - -3. Select the task sequence you want to run, usually the **1 – Deploy Microsoft Surface** task sequence. - -4. Address the task sequence prompts to pick applications, supply a password, and so on. - -5. The task sequence performs the automated deployment using the options specified. - -### Boot the Surface device from the network - -To boot the Surface device from the network, the Microsoft Surface Deployment Accelerator wizard must have been run on a Windows Server 2012 R2 or later environment that was configured with the Windows Deployment Services (WDS). WDS must have been configured to respond to network boot (PXE boot) requests and the boot files must have been imported into WDS. The SDA wizard will import these file automatically if the **Import boot media into the local Windows Deployment Service** check box was selected on the page for the version of Windows you intend to deploy. - -To boot the Surface device from the network, you must also use a Microsoft Surface Ethernet Adapter or the Ethernet port on a Microsoft Surface Dock. Third-party Ethernet adapters are not supported for network boot (PXE boot). A keyboard is also required. Both the Microsoft Surface Type Cover and keyboards connected via USB to the device or dock are supported. - -To instruct your Surface device to boot from the network, start with the device powered off and follow these steps: - -1. Press and hold the **Volume Down** button, press and release the **Power** button. Continue holding the **Volume Down** button until the device has begun to boot from the network. - -2. Press **Enter** when prompted by the dialog on the screen. This prompt indicates that your device has found the WDS PXE server over the network. - -3. If you have configured more than one deployment share on this device, you will be prompted to select between the boot images for each deployment share. For example, if you created both a Windows 10 and a Windows 8.1 deployment share, you will be prompted to choose between these two options. - -4. Enter the domain credentials that you use to log on to the server where SDA is installed when you are prompted, as shown in Figure 14. - - ![Prompt for credentials to the deployment share](images/sdasteps-fig14-credentials.png "Prompt for credentials to the deployment share") - - *Figure 14. The prompt for credentials to the deployment share* - -5. The Windows Deployment Wizard will start from the deployment share to walk you through the deployment process. - -### Alternatively boot the devices from the USB stick - -To boot a device from the USB stick: - -1. Press and hold the **Volume Down** button, press and release the **Power** button. Continue holding the **Volume Down** button until the device has begun to boot from the USB drive. - -2. The Windows Deployment Wizard will start from the deployment share to walk you through the deployment process. - -### Run the Deploy Microsoft Surface task sequence - -To run the Deploy Microsoft Surface task sequence: - -1. On the **Task Sequence** page, select the **1 – Deploy Microsoft Surface** task sequence as shown in Figure 15, and then click **Next.** - - ![Select the task sequence](images/sdasteps-fig15-deploy.png "Select the task sequence") - - *Figure 15. Select the 1 – Deploy Microsoft Surface task sequence* - -2. On the **Computer Details** page, type a name for the Surface device in the **Computer Name** box. In the **Join a domain** section, type your domain name and credentials as shown in Figure 16, and then click **Next**. - - ![Computer name and domain credentials](images/sdasteps-fig16-computername.png "Computer name and domain credentials") - - *Figure 16. Enter the computer name and domain information* - -3. On the **Product Key** page, keep the **No product key is required** check box selected if you are deploying the same version and edition of Windows to your Surface devices as they came with from the factory. If you are deploying a different version or edition of Windows to the device, such as Windows Enterprise, select the licensing option that is applicable to your scenario. - -4. On the **Locale and Time** page, select your desired **Language Settings** and **Time Zone**, and then click **Next.** - -5. On the **Administrator Password** page, type a password for the local Administrator account on the Surface device, and then click **Next.** - -6. On the **BitLocker** page, select the **Enable BitLocker** option along with your desired configuration of BitLocker protectors if you want to encrypt the device. Otherwise, keep the **Do not enable BitLocker for this computer** check box selected, and then click **Next.** - -7. On the **Ready** page, verify your selections and then click **Begin** to start the automated deployment to this device. The deployment will not require user interaction again. The Windows Deployment Wizard will close and an **Installation Progress** window is displayed to show progress of the task sequence as the image is applied and applications are installed (Figure 17). - - ![Installation progress window](images/sdasteps-fig17-installprogresswindow.png "Installation progress window") - - *Figure 17. The Installation Progress window* - -8. When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device. diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md deleted file mode 100644 index a6099038b0..0000000000 --- a/devices/surface/support-solutions-surface.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Top support solutions for Surface devices -description: Find top solutions for common issues using Surface devices in the enterprise. -ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A -ms.reviewer: -manager: dansimp -keywords: Troubleshoot common problems, setup issues -ms.prod: w10 -ms.mktglfcycl: support -ms.sitesec: library -ms.pagetype: surfacehub -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 09/08/2017 -ms.localizationpriority: medium ---- - -# Top support solutions for Surface devices - -Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated. For a complete listing of the update history, see [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) and [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined). - - -These are the top Microsoft Support solutions for common issues experienced when using Surface devices in an enterprise. - -## Screen cracked or scratched issues - -- [Cracked screen and physical damage](https://www.microsoft.com/surface/support/warranty-service-and-recovery/surface-is-damaged) - - -## Device cover or keyboard issues - -- [Troubleshoot your Surface Type Cover or keyboard](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-surface-keyboards) -- [Troubleshoot problems with Surface Keyboard, Surface Ergonomic Keyboard, and Microsoft Modern Keyboard with Fingerprint ID](https://www.microsoft.com/surface/support/touch-mouse-and-search/surface-keyboard-troubleshooting) -- [Set up Microsoft Modern Keyboard with Fingerprint ID](https://www.microsoft.com/surface/support/touch-mouse-and-search/microsoft-modern-keyboard-fingerprintid-set-up) -- [Enabling Surface Laptop keyboard during MDT deployment](https://blogs.technet.microsoft.com/askcore/2017/08/18/enabling-surface-laptop-keyboard-during-mdt-deployment/) - - -## Device won't wake from sleep or hibernation issues - -- [Surface won’t turn on or wake from sleep](https://www.microsoft.com/surface/support/warranty-service-and-recovery/surface-wont-turn-on-or-wake-from-sleep?os=windows-10&=undefined) -- [Surface Pro 4 or Surface Book doesn't hibernate in Windows 10](https://support.microsoft.com/help/3122682) -- [Surface Pro 3 doesn't hibernate after four hours in connected standby](https://support.microsoft.com/help/2998588/surface-pro-3-doesn-t-hibernate-after-four-hours-in-connected-standby) -- [Surface Pro 3 Hibernation Doesn’t Occur on Enterprise Install](https://blogs.technet.microsoft.com/askcore/2014/11/05/surface-pro-3-hibernation-doesnt-occur-on-enterprise-install/) - - -## Other common issues - -- [Trouble installing Surface updates](https://www.microsoft.com/surface/support/performance-and-maintenance/troubleshoot-updates?os=windows-10&=undefined) -- [Troubleshooting common Surface Pro 3 issues post-deployment](http://blogs.technet.com/b/askcore/archive/2015/03/19/troubleshooting-common-surface-pro-3-issues-post-deployment.aspx) -- [Surface Pro 3 hibernation doesn't occur on enterprise install](https://blogs.technet.microsoft.com/askcore/2014/11/05/surface-pro-3-hibernation-doesnt-occur-on-enterprise-install/) -- [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manger OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd) -- [Troubleshoot docking stations for Surface Pro and Surface 3](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-docking-station?os=windows-8.1-update-1&=undefined) -- [What to do if Surface is running slower](https://www.microsoft.com/surface/support/performance-and-maintenance/what-to-do-if-surface-is-running-slower?os=windows-10&=undefined) - - - - - - - - - - - - - diff --git a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md deleted file mode 100644 index f095bc3269..0000000000 --- a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Surface device compatibility with Windows 10 Long-Term Servicing Channel (Surface) -description: Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSB edition. -keywords: ltsb, update, surface servicing options -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/03/2018 -ms.reviewer: -manager: dansimp ---- - -# Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC) - -Surface devices are designed to provide best-in-class experiences in productivity and general-purpose scenarios. Regular updates enable Surface devices to bring to life new innovations and to evolve with the new capabilities delivered by Windows 10 Feature Updates. Feature Updates are available only in Windows 10 Pro or Windows 10 Enterprise editions that receive continuous updates through the Semi-Annual Channel (SAC). - -In contrast to the SAC servicing option, formerly known as the Current Branch (CB) or Current Branch for Business (CBB) servicing options, you cannot select the Long-Term Servicing Channel (LTSC) option in Windows 10 settings. To use the LTSC servicing option, you must install a separate edition of Windows 10 Enterprise, known as Windows 10 Enterprise LTSC, formerly known as Windows 10 Enterprise LTSB (Long-Term Servicing Branch. In addition to providing an extended servicing model, the Windows 10 Enterprise LTSC edition also provides an environment with several Windows components removed. The core Surface experiences that are impacted by LTSC include: - -* Windows Feature Updates, including enhancements such as: - - * Improvements to Direct Ink and palm rejection provided in Windows 10, version 1607 (also referred to as the Anniversary Update) - * Improved support for high DPI applications provided in Windows 10, version 1703 (also referred to as the Creators Update) - -* Pressure sensitivity settings provided by the Surface app - -* The Windows Ink Workspace - -* Key touch-optimized in-box applications including Microsoft Edge, OneNote, Calendar, and Camera - -The use of the Windows 10 Enterprise LTSC environment on Surface devices results in sub-optimal end-user experiences and you should avoid using it in environments where users want and expect a premium, up-to-date user experience. - -The LTSC servicing option is designed for device types and scenarios where the key attribute is for features or functionality to never change. Examples include systems that power manufacturing or medical equipment, or embedded systems in kiosks, such as ATMs or airport ticketing systems. - ->[!NOTE] ->For general information about Windows servicing branches, including LTSC, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/update/waas-overview#long-term-servicing-branch). - -As a general guideline, devices that fulfill the following criteria are considered general-purpose devices and should be paired with Windows 10 Pro or Windows 10 Enterprise using the Semi-Annual Channel servicing option: - -* Devices that run productivity software such as Microsoft Office - -* Devices that use Microsoft Store applications - -* Devices that are used for general Internet browsing (for example, research or access to social media) - -Before you choose to use Windows 10 Enterprise LTSC edition on Surface devices, consider the following limitations: - -* Driver and firmware updates are not explicitly tested against releases of Windows 10 Enterprise LTSC. - -* If you encounter problems, Microsoft Support will provide troubleshooting assistance. However, due to the servicing nature of the Windows LTSC, issue resolution may require that devices be upgraded to a more recent version of Windows 10 Enterprise LTSC, or to Windows 10 Pro or Enterprise with the SAC servicing option. - -* Surface device replacements (for example, devices replaced under warranty) may contain subtle variations in hardware components that require updated device drivers and firmware. Compatibility with these updates may require the installation of a more recent version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise with the SAC servicing option. - ->[!NOTE] ->Organizations that standardize on a specific version of Windows 10 Enterprise LTSC may be unable to adopt new generations of Surface hardware without also updating to a later version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4). - -Surface devices running Windows 10 Enterprise LTSC edition will not receive new features. In many cases these features are requested by customers to improve the usability and capabilities of Surface hardware. For example, new improvements for High DPI applications in Windows 10, version 1703. Customers that use Surface devices in the LTSC configuration will not see the improvements until they either update to a new Windows 10 Enterprise LTSC release or upgrade to a version of Windows 10 with support for the SAC servicing option. - -Devices can be changed from Windows 10 Enterprise LTSC to a more recent version of Windows 10 Enterprise, with support for the SAC servicing option, without the loss of user data by performing an upgrade installation. You can also perform an upgrade installation on multiple devices by leveraging the Upgrade Task Sequence Templates available in the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. For more information, see [Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/upgrade-surface-devices-to-windows-10-with-mdt). diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md deleted file mode 100644 index cd0812b2d9..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-business.md +++ /dev/null @@ -1,183 +0,0 @@ ---- -title: Deploy Surface Diagnostic Toolkit for Business -description: This topic explains how to use the Surface Diagnostic Toolkit for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 11/15/2018 -ms.reviewer: -manager: dansimp ---- - -# Deploy Surface Diagnostic Toolkit for Business - -The Microsoft Surface Diagnostic Toolkit for Business (SDT) enables IT administrators to quickly investigate, troubleshoot, and resolve hardware, software, and firmware issues with Surface devices. You can run a range of diagnostic tests and software repairs in addition to obtaining device health insights and guidance for resolving issues. - -Specifically, SDT for Business enables you to: - -- [Customize the package.](#create-custom-sdt) -- [Run the app using commands.](surface-diagnostic-toolkit-command-line.md) -- [Run multiple hardware tests to troubleshoot issues.](surface-diagnostic-toolkit-desktop-mode.md#multiple) -- [Generate logs for analyzing issues.](surface-diagnostic-toolkit-desktop-mode.md#logs) -- [Obtain detailed report comparing device vs optimal configuration.](surface-diagnostic-toolkit-desktop-mode.md#detailed-report) - - -## Primary scenarios and download resources - -To run SDT for Business, download the components listed in the following table. - - -Mode | Primary scenarios | Download | Learn more ---- | --- | --- | --- -Desktop mode | Assist users in running SDT on their Surface devices to troubleshoot issues.
          Create a custom package to deploy on one or more Surface devices allowing users to select specific logs to collect and analyze. | SDT distributable MSI package:
          Microsoft Surface Diagnostic Toolkit for Business Installer
          [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) | [Use Surface Diagnostic Toolkit in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) -Command line | Directly troubleshoot Surface devices remotely without user interaction, using standard tools such as Configuration Manager. It includes the following commands:
          `-DataCollector` collects all log files
          `-bpa` runs health diagnostics using Best Practice Analyzer.
          `-windowsupdate` checks Windows Update for missing firmware or driver updates.
          `-warranty` checks warranty information.

          | SDT console app:
          Microsoft Surface Diagnostics App Console
          [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) | [Run Surface Diagnostic Toolkit using commands](surface-diagnostic-toolkit-command-line.md) - -## Supported devices - -SDT for Business is supported on Surface 3 and later devices, including: - -- Surface Pro 6 -- Surface Laptop 2 -- Surface Go -- Surface Go with LTE -- Surface Book 2 -- Surface Pro with LTE Advanced (Model 1807) -- Surface Pro (Model 1796) -- Surface Laptop -- Surface Studio -- Surface Studio 2 -- Surface Book -- Surface Pro 4 -- Surface 3 LTE -- Surface 3 -- Surface Pro 3 - -## Installing Surface Diagnostic Toolkit for Business - -To create an SDT package that you can distribute to users in your organization: - -1. Sign in to your Surface device using the Administrator account. -2. Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop. -3. The SDT setup wizard appears, as shown in figure 1. Click **Next**. - - >[!NOTE] - >If the setup wizard does not appear, ensure that you are signed into the Administrator account on your computer. - - ![welcome to the Surface Diagnostic Toolkit setup wizard](images/sdt-1.png) - - *Figure 1. Surface Diagnostic Toolkit setup wizard* - -4. When the SDT setup wizard appears, click **Next**, accept the End User License Agreement (EULA) - -5. On the Install Options screen, change the default install location if desired. -6. Under Setup Type, select **Advanced**. - - >[!NOTE] - >The standard option allows users to run the diagnostic tool directly on their Surface device provided they are signed into their device using an Administrator account. - - ![Install Options: Advanced](images/sdt-install.png) - -7. Click **Next** and then click **Install**. - -## Installing using the command line -If desired, you can install SDT at a command prompt and set a custom flag to install the tool in admin mode. SDT contains the following install option flags: - -- `SENDTELEMETRY` sends telemetry data to Microsoft. The flag accepts `0` for disabled or `1` for enabled. The default value is `1` to send telemetry. -- `ADMINMODE` configures the tool to be installed in admin mode. The flag accepts `0` for client mode or `1` for IT Administrator mode. The default value is `0`. - -### To install SDT from the command line: - -1. Open a command prompt and enter: - - ``` - msiexec.exe /i ADMINMODE=1. - ``` - **Example:** - - ``` - C:\Users\Administrator> msiexec.exe/I"C:\Users\Administrator\Desktop\Microsoft_Surface_Diagnostic_Toolkit_for_Business_Installer.msi" ADMINMODE=1 - ``` - -## Locating SDT on your Surface device - -Both SDT and the SDT app console are installed at `C:\Program Files\Microsoft\Surface\Microsoft Surface Diagnostic Toolkit for Business`. - -In addition to the .exe file, SDT installs a JSON file and an admin.dll file (modules\admin.dll), as shown in figure 2. - -![list of SDT installed files in File Explorer](images/sdt-2.png) - -*Figure 2. Files installed by SDT* - - -## Preparing the SDT package for distribution - -Creating a custom package allows you to target the tool to specific known issues. - -1. Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. -2. When the tool opens, click **Create Custom Package**, as shown in figure 3. - - ![Create custom package option](images/sdt-3.png) - - *Figure 3. Create custom package* - -### Language and telemetry settings - - When creating a package, you can select language settings or opt out of sending telemetry information to Microsoft. By default, SDT sends telemetry to Microsoft that is used to improve the application in accordance with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). If you wish to decline, clear the check box when creating a custom package, as shown below. Or clear the **Send telemetry to Microsoft** check box on the **Install Options** page during SDT Setup. - ->[!NOTE] ->This setting does not affect the minimal telemetry automatically stored on Microsoft servers when running tests and repairs that require an Internet connection, such as Windows Update and Software repair, or providing feedback using the Smile or Frown buttons in the app toolbar. - - -![Select language and telemetry settings](images/sdt-4.png) - -*Figure 4. Select language and telemetry settings* - - -### Windows Update page - -Select the option appropriate for your organization. Most organizations with multiple users will typically select to receive updates via Windows Server Update Services (WSUS), as shown in figure 5. If using local Windows Update packages or WSUS, enter the path as appropriate. - -![Select Windows Update option](images/sdt-5.png) - -*Figure 5. Windows Update option* - -### Software repair page - -This allows you to select or remove the option to run software repair updates. - -![Select software repair option](images/sdt-6.png) - -*Figure 6. Software repair option* - -### Collecting logs and saving package page - -You can select to run a wide range of logs across applications, drivers, hardware, and the operating system. Click the appropriate area and select from the menu of available logs. You can then save the package to a software distribution point or equivalent location that users can access. - -![Select log options](images/sdt-7.png) - -*Figure 7. Log option and save package* - -## Next steps - -- [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) -- [Use Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) - - -## Changes and updates -### Version 2.41.139.0 -*Release date: June 24, 2019*
          -This version of Surface Diagnostic Toolkit for Business adds support for the following: -- Driver version information included in logs and report. -- Ability to provide feedback about the app.
          - - -### Version 2.36.139.0 -*Release date: April 26, 2019*
          -This version of Surface Diagnostic Toolkit for Business adds support for the following: -- Advanced Setup option to unlock admin capabilities through the installer UI, without requiring command line configuration. -- Accessibility improvements. -- Surface brightness control settings included in logs. -- External monitor compatibility support link in report generator. diff --git a/devices/surface/surface-diagnostic-toolkit-command-line.md b/devices/surface/surface-diagnostic-toolkit-command-line.md deleted file mode 100644 index 39dc1bddd1..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-command-line.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Run Surface Diagnostic Toolkit for Business using commands -description: How to run Surface Diagnostic Toolkit in a command console -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 11/15/2018 -ms.reviewer: -manager: dansimp ---- - -# Run Surface Diagnostic Toolkit for Business using commands - -Running the Surface Diagnostic Toolkit (SDT) at a command prompt requires downloading the STD app console. After it's installed, you can run SDT at a command prompt via the Windows command console (cmd.exe) or using Windows PowerShell, including PowerShell Integrated Scripting Environment (ISE), which provides support for autocompletion of commands, copy/paste, and other features. - ->[!NOTE] ->To run SDT using commands, you must be signed in to the Administrator account or signed in to an account that is a member of the Administrator group on your Surface device. - -## Running SDT app console - -Download and install SDT app console from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703). You can use the Windows command prompt (cmd.exe) or Windows PowerShell to: - -- Collect all log files. -- Run health diagnostics using Best Practice Analyzer. -- Check update for missing firmware or driver updates. - ->[!NOTE] ->In this release, the SDT app console supports single commands only. Running multiple command line options requires running the console exe separately for each command. - -By default, output files are saved in the same location as the console app. Refer to the following table for a complete list of commands. - -Command | Notes ---- | --- --DataCollector "output file" | Collects system details into a zip file. "output file" is the file path to create system details zip file.

          **Example**:
          `Microsoft.Surface.Diagnostics.App.Console.exe -DataCollector SDT_DataCollection.zip` --bpa "output file" | Checks several settings and health indicators in the device. “output file" is the file path to create the HTML report.

          **Example**:
          `Microsoft.Surface.Diagnostics.App.Console.exe -bpa BPA.html` --windowsupdate | Checks Windows Update online servers for missing firmware and/or driver updates.

          **Example**:
          Microsoft.Surface.Diagnostics.App.Console.exe -windowsupdate --warranty "output file" | Checks warranty information on the device (valid or invalid). The optional “output file” is the file path to create the xml file.

          **Example**:
          Microsoft.Surface.Diagnostics.App.Console.exe –warranty “warranty.xml” - - ->[!NOTE] ->To run the SDT app console remotely on target devices, you can use a configuration management tool such as System Center Configuration Manager. Alternatively, you can create a .zip file containing the console app and appropriate console commands and deploy per your organization’s software distribution processes. - -## Running Best Practice Analyzer - -You can run BPA tests across key components such as BitLocker, Secure Boot, and Trusted Platform Module (TPM) and then output the results to a shareable file. The tool generates a series of tables with color-coded headings and condition descriptors along with guidance about how to approach resolving the issue. - -- Green indicates the component is running in an optimal condition (optimal). -- Orange indicates the component is not running in an optimal condition (not optimal). -- Red indicates the component is in an abnormal state. - -### Sample BPA results output - - - - - - - -
          BitLocker
          Description:Checks if BitLocker is enabled on the system drive.
          Value:Protection On
          Condition:Optimal
          Guidance:It is highly recommended to enable BitLocker to protect your data.
          - - - - - - - -
          Secure Boot
          Description:Checks if Secure Boot is enabled.
          Value:True
          Condition:Optimal
          Guidance:It is highly recommended to enable Secure Boot to protect your PC.
          - - - - - - - -
          Trusted Platform Module
          Description:Ensures that the TPM is functional.
          Value:True
          Condition:Optimal
          Guidance:Without a functional TPM, security-based functions such as BitLocker may not work properly.
          - - - - - - - -
          Connected Standby
          Description:Checks if Connected Standby is enabled.
          Value:True
          Condition:Optimal
          Guidance:Connected Standby allows a Surface device to receive updates and notifications while not being used. For best experience, Connected Standby should be enabled.
          - - - - - - - -
          Bluetooth
          Description:Checks if Bluetooth is enabled.
          Value:Enabled
          Condition:Optimal
          Guidance:
          - - - - - - - -
          Debug Mode
          Description:Checks if the operating system is in Debug mode.
          Value:Normal
          Condition:Optimal
          Guidance:The debug boot option enables or disables kernel debugging of the Windows operating system. Enabling this option can cause system instability and can prevent DRM (digital rights managemend) protected media from playing.
          - - - - - - - -
          Test Signing
          Description:Checks if Test Signing is enabled.
          Value:Normal
          Condition:Optimal
          Guidance:Test Signing is a Windows startup setting that should only be used to test pre-release drivers.
          - - - - - - - -
          Active Power Plan
          Description:Checks that the correct power plan is active.
          Value:Balanced
          Condition:Optimal
          Guidance:It is highly recommended to use the "Balanced" power plan to maximize productivity and battery life.
          - - - - - - - -
          Windows Update
          Description:Checks if the device is up to date with Windows updates.
          Value:Microsoft Silverlight (KB4023307), Definition Update for Windows Defender Antivirus - KB2267602 (Definition 1.279.1433.0)
          Condition:Not Optimal
          Guidance:Updating to the latest windows makes sure you are on the latest firmware and drivers. It is recommended to always keep your device up to date
          - - - - - - - -
          Free Hard Drive Space
          Description:Checks for low free hard drive space.
          Value:66%
          Condition:Optimal
          Guidance:For best performance, your hard drive should have at least 10% of its capacity as free space.
          - - - - - - - -
          Non-Functioning Devices
          Description:List of non-functioning devices in Device Manager.
          Value:
          Condition:Optimal
          Guidance:Non-functioning devices in Device Manager may cause unpredictable problems with Surface devices such as, but not limited to, no power savings for the respective hardware component.
          - - - - - - - -
          External Monitor
          Description:Checks for an external monitor that may have compatibility issues.
          Value:
          Condition:Optimal
          Guidance:Check with the original equipment manufacturer for compatibility with your Surface device.
          diff --git a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md deleted file mode 100644 index 9022fb4770..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Use Surface Diagnostic Toolkit for Business in desktop mode -description: How to use SDT to help users in your organization run the tool to identify and diagnose issues with the Surface device. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 11/15/2018 -ms.reviewer: -manager: dansimp ---- - -# Use Surface Diagnostic Toolkit for Business in desktop mode - -This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error. - -1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. - -2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. - - ![Start SDT in desktop mode](images/sdt-desk-1.png) - - *Figure 1. SDT in desktop mode* - -3. When SDT indicates the device has the latest updates, click **Continue** to advance to the catalog of available tests, as shown in figure 2. - - ![Select from SDT options](images/sdt-desk-2.png) - - *Figure 2. Select from SDT options* - -4. You can choose to run all the diagnostic tests. Or, if you already suspect a particular issue such as a faulty display or a power supply problem, click **Select** to choose from the available tests and click **Run Selected**, as shown in figure 3. See the following table for details of each test. - - ![Select hardware tests](images/sdt-desk-3.png) - - *Figure 3. Select hardware tests* - - Hardware test | Description - --- | --- - Power Supply and Battery | Checks Power supply is functioning optimally - Display and Sound | Checks brightness, stuck or dead pixels, speaker and microphone functioning - Ports and Accessories | Checks accessories, screen attach and USB functioning - Connectivity | Checks Bluetooth, wireless and LTE connectivity - Security | Checks security related issues - Touch | Checks touch related issues - Keyboard and touch | Checks integrated keyboard connection and type cover - Sensors | Checks functioning of different sensors in the device - Hardware | Checks issues with different hardware components such as graphics card and camera - - - - - - -## Running multiple hardware tests to troubleshoot issues - -SDT is designed as an interactive tool that runs a series of tests. For each test, SDT provides instructions summarizing the nature of the test and what users should expect or look for in order for the test to be successful. For example, to diagnose if the display brightness is working properly, SDT starts at zero and increases the brightness to 100 percent, asking users to confirm – by answering **Yes** or **No** -- that brightness is functioning as expected, as shown in figure 4. - -For each test, if functionality does not work as expected and the user clicks **No**, SDT generates a report of the possible causes and ways to troubleshoot it. - -![Running hardware diagnostics](images/sdt-desk-4.png) - -*Figure 4. Running hardware diagnostics* - -1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. -2. If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. -3. Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution. - - -### Repairing applications - -SDT enables you to diagnose and repair applications that may be causing issues, as shown in figure 5. - -![Running repairs](images/sdt-desk-5.png) - -*Figure 5. Running repairs* - - - - - -### Generating logs for analyzing issues - -SDT provides extensive log-enabled diagnosis support across applications, drivers, hardware, and operating system issues, as shown in figure 6. - -![Generating logs](images/sdt-desk-6.png) - -*Figure 6. Generating logs* - - - - -### Generating detailed report comparing device vs. optimal configuration - -Based on the logs, SDT generates a report for software- and firmware-based issues that you can save to a preferred location. - -## Related topics - -- [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) - diff --git a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md deleted file mode 100644 index 83613f4a36..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Fix common Surface problems using the Surface Diagnostic Toolkit for Business -description: This page provides an introduction to the Surface Diagnostic Toolkit for Business for use in commercial environments. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/11/2019 -ms.reviewer: cottmca -manager: dansimp ---- - -# Fix common Surface problems using the Surface Diagnostic Toolkit for Business - -If your Surface isn’t working properly, the Microsoft Surface Diagnostic Toolkit for Business can help you or your administrator find and solve problems. - -> [!NOTE] -> Surface Diagnostic Toolkit for Business is built for commercial devices. If your device is a personal device and not managed by your work or school run the [Surface Diagnostic Toolkit](https://support.microsoft.com/en-us/help/4037239/surface-fix-common-surface-problems-using-surface-diagnostic-toolkit) instead. - -## Run the Surface Diagnostic Toolkit for Business - -Before you run the diagnostic tool, make sure you have the latest Windows updates. Go to [Install Surface and Windows 10 updates](https://support.microsoft.com/en-us/help/4023505/surface-install-surface-and-windows-updates) for more information. If that doesn't solve the problem, you'll need to run the diagnostic tool. - -> [!NOTE] -> The Surface Diagnostic Toolkit for Business only works on Surface devices running Windows 10. It does not work on Surface Pro, Surface Pro 2, or Surface devices configured in S mode. - -**To run the Surface Diagnostic Toolkit for Business:** - -1. Download the [Surface Diagnostic Toolkit for Business](https://aka.ms/SDT4B). -2. Select Run and follow the on-screen instructions. - -The diagnosis and repair time averages 15 minutes but could take an hour or longer, depending on internet connection speed and the number of updates or repairs required. For more detailed information on Surface Diagnostic Toolkit for Business, refer to [Deploy Surface Diagnostic Toolkit for Business](https://docs.microsoft.com/surface/surface-diagnostic-toolkit-business). - -# If you still need help - -If the Surface Diagnostic Toolkit for Business didn’t fix the problem, you can also: - -- Make an in-store appointment: We might be able to fix the problem or provide a replacement Surface at your local Microsoft Store. [Locate a Microsoft Store near you](https://www.microsoft.com/en-us/store/locations/find-a-store?WT.mc_id=MSC_Solutions_en_us_scheduleappt). -- Contact customer support: If you want to talk to someone about how to fix your problem, [contact us](https://support.microsoft.com/en-us/help/4037645/contact-surface-warranty-and-software-support-for-business). -- Get your Surface serviced: If your Surface product needs service, [request it online](https://mybusinessservice.surface.com/). diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md deleted file mode 100644 index 89e26f6db0..0000000000 --- a/devices/surface/surface-dock-updater.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: Microsoft Surface Dock Updater (Surface) -description: This article provides a detailed walkthrough of Microsoft Surface Dock Updater. -ms.assetid: 1FEFF277-F7D1-4CB4-8898-FDFE8CBE1D5C -ms.reviewer: -manager: dansimp -keywords: install, update, firmware -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.date: 02/23/2018 -ms.author: dansimp -ms.topic: article ---- - -# Microsoft Surface Dock Updater - - -This article provides a detailed walkthrough of Microsoft Surface Dock Updater. - -The [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details.aspx?id=46703) tool allows you to check the firmware status of a Surface Dock and to manually update the firmware of Surface Dock devices. It is most often used to update Surface Docks prior to deployment of those Surface Docks to end users or as a troubleshooting tool. Microsoft Surface Dock Updater walks you through the process of updating the firmware on one or more Surface Docks, including the required connect and disconnect steps to perform the complete firmware installation. - -When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA). - ->[!NOTE] ->Updating Surface Dock firmware requires connectivity to the Surface Dock via the Surface Connect™ port. Installation of the Microsoft Surface Dock Updater is only supported on devices that feature the Surface Connect™ port. - ->[!NOTE] ->The Surface Dock Updater tool is unable to run on Windows 10 S. To manually update a Surface Dock for use with Surface Laptop and Windows 10 S, connect the Surface Dock to another Surface device with a Windows 10 Pro or Windows 10 Enterprise environment. - -## Update a Surface Dock with Microsoft Surface Dock Updater - - -After you install the [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details.aspx?id=46703) tool, you can find Microsoft Surface Dock Updater under **All Apps** in your Start menu. Click **Microsoft Surface Dock Updater** to start the application. - -To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps: - -1. Click Start to begin the firmware update process. If you do not have a Surface Dock connected, you will be prompted to connect a Surface Dock. - -2. Microsoft Surface Dock Updater checks the status of your Surface Dock firmware. - - - If the tool determines that the firmware of your Surface Dock is up to date, a **You have the latest firmware for this Surface Dock** message is displayed, as shown in Figure 1. - - ![Screen that shows your Surface Dock firmware is up to date](images/surfacedockupdater-fig1-uptodate-568pix.png "Screen that shows your Surface Dock firmware is up to date") - - *Figure 1. Your Surface Dock firmware is up to date* - - - If Microsoft Surface Dock Updater determines that the firmware of your Surface Dock is not up to date, a **This Surface Dock is not running the latest firmware** message is displayed, as shown in Figure 2. - - ![Screen that shows your Surface Dock firmware needs to be updated](images/surfacedockupdater-fig2a-needsupdating.png "Screen that shows your Surface Dock firmware needs to be updated") - - *Figure 2. Your Surface Dock firmware needs to be updated* - -3. To begin the firmware update process, click **Update** on the **Surface Dock Firmware** page. - -4. Before the firmware update process begins, you will be prompted for confirmation. Click **OK** to proceed or **Cancel** to return to the **Surface Dock Firmware** page displaying the status of your Surface Dock firmware. - -5. As the firmware update is uploaded to the Surface Dock, a **Progress** page is displayed, as shown in Figure 3. Do not disconnect the Surface Dock while firmware is being uploaded. - - ![Progress of firmware update upload](images/surfacedockupdater-fig3-progress.png "Progress of firmware update upload") - - *Figure 3. Progress of firmware update upload to Surface Dock* - -6. After the firmware update has successfully uploaded to the Surface Dock, you are prompted to disconnect and then reconnect the Surface Dock from the Surface device, as shown in Figure 4. The main chipset firmware update will be applied while the Surface Dock is disconnected. - - ![Disconnect and reconnect Surface Dock when prompted](images/surfacedockupdater-fig4-disconnect.png "Disconnect and reconnect Surface Dock when prompted") - - *Figure 4. Disconnect and reconnect Surface Dock when prompted* - -7. When the main chipset firmware update is verified, the DisplayPort chipset firmware update will be uploaded to the Surface Dock. Upon completion, a **Success** page is displayed and you will again be prompted to disconnect the Surface Dock, as shown in Figure 5. - - ![Screen showing successful upload](images/surfacedockupdater-fig5-success.png "Screen showing successful upload") - - *Figure 5. Successful upload of Surface Dock firmware* - -8. After you disconnect the Surface Dock the DisplayPort firmware update will be installed. This process occurs on the Surface Dock hardware while it is disconnected. The Surface Dock must remain powered for up to 3 minutes after it has been disconnected for the firmware update to successfully install. An **Update in Progress** page is displayed (as shown in Figure 6), with a countdown timer to show the estimated time remaining to complete the firmware update installation. - - ![Countdown timer to complete firmware installation](images/surfacedockupdater-fig6-countdown.png "Countdown timer to complete firmware installation") - - *Figure 6. Countdown timer to complete firmware installation on Surface Dock* - -9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock. - - >[!NOTE] - >The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power. - -   - -## Troubleshooting Microsoft Surface Dock Updater - - -If the Surface Dock firmware update process encounters an installation error with either firmware update, the **Encountered an unexpected error** page may be displayed, as shown in Figure 7. - -![Firmware update installation error](images/surfacedockupdater-fig7-error.png "Firmware update installation error") - -*Figure 7. Firmware update installation has encountered an error* - -Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in Figure 8. If you need to troubleshoot an update through this tool, you will find Surface Dock events recorded with the following event IDs: - -| Event ID | Event type | -|----------|----------------------------------------------------------| -| 12100 | Up-to-date confirmation | -| 12101 | Event in the main chipset firmware update process | -| 12102 | Event in the DisplayPort chipset firmware update process | -| 12105 | Error | - - -![Surface Dock Updater events in Event Viewer](images/surfacedockupdater-fig8-737test.png "Surface Dock Updater events in Event Viewer") - -*Figure 8. Surface Dock Updater events in Event Viewer* - -## Changes and updates - -Microsoft periodically updates Surface Dock Updater. - ->[!Note] ->Each update to Surface Dock firmware is included in a new version of Surface Dock Updater. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Updater. - -### Version 2.23.139.0 -*Release Date: 10 October 2018* - -This version of Surface Dock Updater adds support for the following: - -- Add support for Surface Pro 6 -- Add support for Surface Laptop 2 - - -### Version 2.22.139.0 -*Release Date: 26 July 2018* - -This version of Surface Dock Updater adds support for the following: - -- Increase update reliability -- Add support for Surface Go - -### Version 2.12.136.0 -*Release Date: 29 January 2018* - -This version of Surface Dock Updater adds support for the following: -* Update for Surface Dock Main Chipset Firmware -* Update for Surface Dock DisplayPort Firmware -* Improved display stability for external displays when used with Surface Book or Surface Book 2 - -Additionally, installation of this version of Surface Dock Updater on Surface Book devices includes the following: -* Update for Surface Book Base Firmware -* Added support for Surface Dock firmware updates with improvements targeted to Surface Book devices - ->[!Note] ->Before the Surface Dock firmware update applied by Surface Dock Updater v2.12.136.0 will take effect on a Surface Book device, a firmware update for the Surface Book Base is required. If you install Surface Dock Updater v2.12.136.0 on a Surface Book and update an attached Surface Dock from that same device, the firmware of the Surface Book Base will automatically be updated when installing the Surface Dock Updater. However, if you update a Surface Dock using Surface Dock Updater v2.12.136.0 on different device, and then connect that Surface Dock to a Surface Book where Surface Dock Updater v2.12.136.0 has not been installed, the benefits of the updated Surface Dock will not be enabled. To enable the benefits of the updated Surface Dock on a Surface Book device, Surface Book Base firmware must also be updated by installing Surface Dock Updater v2.12.136.0 on the Surface Book device. Surface Book Base firmware update is not required on a Surface Book 2 device. - - -### Version 2.9.136.0 -*Release date: November 3, 2017* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock DisplayPort Firmware -* Resolves an issue with audio over passive display port adapters - -### Version 2.1.15.0 -*Release date: June 19, 2017* - -This version of Surface Dock Updater adds support for the following: - -* Surface Laptop -* Surface Pro - -### Version 2.1.6.0 -*Release date: April 7, 2017* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock DisplayPort firmware -* Requires Windows 10 - -### Version 2.0.22.0 -*Release date: October 21, 2016* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock USB firmware -* Improved reliability of Ethernet, audio, and USB ports - -### Version 1.0.8.0 -*Release date: April 26, 2016* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock Main Chipset firmware -* Update for Surface Dock DisplayPort firmware - - - - - - diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md deleted file mode 100644 index df65b6c73d..0000000000 --- a/devices/surface/surface-enterprise-management-mode.md +++ /dev/null @@ -1,261 +0,0 @@ ---- -title: Surface Enterprise Management Mode (Surface) -description: See how this feature of Surface devices with Surface UEFI helps you secure and manage firmware settings within your organization. -keywords: uefi, configure, firmware, secure, semm -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/06/2017 -ms.reviewer: -manager: dansimp ---- - -# Microsoft Surface Enterprise Management Mode - -Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal. - ->[!NOTE] ->SEMM is only available on devices with Surface UEFI firmware such as Surface Pro 4 and later, Surface Go, Surface Laptop, Surface Book, and Surface Studio. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). - -When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM. - -There are two administrative options you can use to manage SEMM and enrolled Surface devices – a standalone tool or integration with System Center Configuration Manager. The SEMM standalone tool, called the Microsoft Surface UEFI Configurator, is described in this article. For more information about how to manage SEMM with System Center Configuration Manager, see [Use System Center Configuration Manager to manage devices with SEMM](https://technet.microsoft.com/itpro/surface/use-system-center-configuration-manager-to-manage-devices-with-semm). - -## Microsoft Surface UEFI Configurator - -The primary workspace of SEMM is Microsoft Surface UEFI Configurator, as shown in Figure 1. Microsoft Surface UEFI Configurator is a tool that is used to create Windows Installer (.msi) packages or WinPE images that are used to enroll, configure, and unenroll SEMM on a Surface device. These packages contain a configuration file where the settings for UEFI are specified. SEMM packages also contain a certificate that is installed and stored in firmware and used to verify the signature of configuration files before UEFI settings are applied. - -![Microsoft Surface UEFI Configurator](images/surface-ent-mgmt-fig1-uefi-configurator.png "Microsoft Surface UEFI Configurator") - -*Figure 1. Microsoft Surface UEFI Configurator* - ->[!NOTE] ->Windows 10 is required to run Microsoft Surface UEFI Configurator - -You can use the Microsoft Surface UEFI Configurator tool in three modes: - -* [Surface UEFI Configuration Package](#configuration-package). Use this mode to create a Surface UEFI configuration package to enroll a Surface device in SEMM and to configure UEFI settings on enrolled devices. -* [Surface UEFI Reset Package](#reset-package). Use this mode to unenroll a Surface device from SEMM. -* [Surface UEFI Recovery Request](#recovery-request). Use this mode to respond to a recovery request to unenroll a Surface device from SEMM where a Reset Package operation is not successful. - - -#### Download Microsoft Surface UEFI Configurator - -You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. - -### Configuration package - -Surface UEFI configuration packages are the primary mechanism to implement and manage SEMM on Surface devices. These packages contain a configuration file of UEFI settings specified during creation of the package in Microsoft Surface UEFI Configurator and a certificate file, as shown in Figure 2. When a configuration package is run for the first time on a Surface device that is not already enrolled in SEMM, it provisions the certificate file in the device’s firmware and enrolls the device in SEMM. When enrolling a device in SEMM, you will be prompted to confirm the operation by providing the last two digits of the SEMM certificate thumbprint before the certificate file is stored and the enrollment can complete. This confirmation requires that a user be present at the device at the time of enrollment to perform the confirmation. - -![Secure a SEMM configuration package with a certificate](images/surface-ent-mgmt-fig2-securepackage.png "Secure a SEMM configuration package with a certificate") - -*Figure 2. Secure a SEMM configuration package with a certificate* - -See the [Surface Enterprise Management Mode certificate requirements](#surface-enterprise-management-mode-certificate-requirements) section of this article for more information about the requirements for the SEMM certificate. - ->[!NOTE] ->You can also specify a UEFI password with SEMM that is required to view the **Security**, **Devices**, **Boot Configuration**, or **Enterprise Management** pages of Surface UEFI. - -After a device is enrolled in SEMM, the configuration file is read and the settings specified in the file are applied to UEFI. When you run a configuration package on a device that is already enrolled in SEMM, the signature of the configuration file is checked against the certificate that is stored in the device firmware. If the signature does not match, no changes are applied to the device. - -You can use Surface UEFI settings to enable or disable the operation of individual components, such as cameras, wireless communication, or docking USB port (as shown in Figure 3), and configure advanced settings (as shown in Figure 4). - -![Enable or disable devices in Surface UEFI with SEMM](images/surface-ent-mgmt-fig3-enabledisable.png "Enable or disable devices in Surface UEFI with SEMM") - -*Figure 3. Enable or disable devices in Surface UEFI with SEMM* - -![Configure advanced settings in SEMM](images/surface-ent-mgmt-fig4-advancedsettings.png "Configure advanced settings in SEMM") - -*Figure 4. Configure advanced settings with SEMM* - -You can enable or disable the following devices with SEMM: - -* Docking USB Port -* On-board Audio -* DGPU -* Type Cover -* Micro SD Card -* Front Camera -* Rear Camera -* Infrared Camera, for Windows Hello -* Bluetooth Only -* Wi-Fi and Bluetooth -* LTE - -You can configure the following advanced settings with SEMM: - -* IPv6 support for PXE boot -* Alternate boot order, where the Volume Down button and Power button can be pressed together during boot, to boot directly to a USB or Ethernet device -* Lock the boot order to prevent changes -* Support for booting to USB devices -* Enable Network Stack boot settings -* Enable Auto Power On boot settings -* Display of the Surface UEFI **Security** page -* Display of the Surface UEFI **Devices** page -* Display of the Surface UEFI **Boot** page -* Display of the Surface UEFI **DateTime** page - ->[!NOTE] ->When you create a SEMM configuration package, two characters are shown on the **Successful** page, as shown in Figure 5. - -![Certificate thumbprint display](images/surface-ent-mgmt-fig5-success.png "Certificate thumbprint display") - -*Figure 5. Display of the last two characters of the certificate thumbprint on the Successful page* - -These characters are the last two characters of the certificate thumbprint and should be written down or recorded. The characters are required to confirm enrollment in SEMM on a Surface device, as shown in Figure 6. - -![Enrollment confirmation in SEMM](images/surface-ent-mgmt-fig6-enrollconfirm.png "Enrollment confirmation in SEMM") - -*Figure 6. Enrollment confirmation in SEMM with the SEMM certificate thumbprint* - ->[!NOTE] ->Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process: ->1. Right-click the .pfx file, and then click **Open**. ->2. Expand the folder in the navigation pane. ->3. Click **Certificates**. ->4. Right-click your certificate in the main pane, and then click **Open**. ->5. Click the **Details** tab. ->6. **All** or **Properties Only** must be selected in the **Show** drop-down menu. ->7. Select the field **Thumbprint**. - -To enroll a Surface device in SEMM or to apply the UEFI configuration from a configuration package, all you need to do is run the .msi file with administrative privileges on the intended Surface device. You can use application deployment or operating system deployment technologies such as [System Center Configuration Manager](https://technet.microsoft.com/library/mt346023) or the [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). When you enroll a device in SEMM you must be present to confirm the enrollment on the device. User interaction is not required when you apply a configuration to devices that are already enrolled in SEMM. - -For a step-by-step walkthrough of how to enroll a Surface device in SEMM or apply a Surface UEFI configuration with SEMM, see [Enroll and configure Surface devices with SEMM](https://technet.microsoft.com/itpro/surface/enroll-and-configure-surface-devices-with-semm). - -### Reset package - -A Surface UEFI reset package is used to perform only one task — to unenroll a Surface device from SEMM. The reset package contains signed instructions to remove the SEMM certificate from the device’s firmware and to reset UEFI settings to factory default. Like a Surface UEFI configuration package, a reset package must be signed with the same SEMM certificate that is provisioned on the Surface device. When you create a SEMM reset package, you are required to supply the serial number of the Surface device you intend to reset. SEMM reset packages are not universal and are specific to one device. - -### Recovery request - -In some scenarios, it may be impossible to use a Surface UEFI reset package. (For example, if Windows becomes unusable on the Surface device.) In these scenarios you can unenroll the Surface device from SEMM through the **Enterprise Management** page of Surface UEFI (shown in Figure 7) with a Recovery Request operation. - -![Initiate a SEMM recovery request](images/surface-ent-mgmt-fig7-semmrecovery.png "Initiate a SEMM recovery request") - -*Figure 7. Initiate a SEMM recovery request on the Enterprise Management page* - -When you use the process on the **Enterprise Management** page to reset SEMM on a Surface device, you are provided with a Reset Request. This Reset Request can be saved as a file to a USB drive, copied as text, or read as a QR Code with a mobile device to be easily emailed or messaged. Use the Microsoft Surface UEFI Configurator Reset Request option to load a Reset Request file or enter the Reset Request text or QR Code. Microsoft Surface UEFI Configurator will generate a verification code that can be entered on the Surface device. If you enter the code on the Surface device and click **Restart**, the device will be unenrolled from SEMM. - ->[!NOTE] ->A Reset Request expires two hours after it is created. - -For a step-by-step walkthrough of how to unenroll Surface devices from SEMM, see [Unenroll Surface devices from SEMM](https://technet.microsoft.com/itpro/surface/unenroll-surface-devices-from-semm). - -## Surface Enterprise Management Mode certificate requirements - ->[!NOTE] ->The SEMM certificate is required to perform any modification to SEMM or Surface UEFI settings on enrolled Surface devices. If the SEMM certificate is corrupted or lost, SEMM cannot be removed or reset. Manage your SEMM certificate accordingly with an appropriate solution for backup and recovery. - -Packages created with the Microsoft Surface UEFI Configurator tool are signed with a certificate. This certificate ensures that after a device is enrolled in SEMM, only packages created with the approved certificate can be used to modify the settings of UEFI. The following settings are recommended for the SEMM certificate: - -* **Key Algorithm** – RSA -* **Key Length** – 2048 -* **Hash Algorithm** – SHA-256 -* **Type** – SSL Server Authentication -* **Key Usage** – Digital signature, Key Encipherment -* **Provider** – Microsoft Enhanced RSA and AES Cryptographic Provider -* **Expiration Date** – 15 Months from certificate creation -* **Key Export Policy** – Exportable - -It is also recommended that the SEMM certificate be authenticated in a two-tier public key infrastructure (PKI) architecture where the intermediate certification authority (CA) is dedicated to SEMM, enabling certificate revocation. For more information about a two-tier PKI configuration, see [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](https://technet.microsoft.com/library/hh831348). - ->[!NOTE] ->You can use the following PowerShell script to create a self-signed certificate for use in proof-of-concept scenarios. - > To use this script, copy the following text into Notepad and save the file as a PowerShell script (.ps1). This script creates a certificate with a password of `12345678`.

          The certificate generated by this script is not recommended for production environments. - - ``` -if (-not (Test-Path "Demo Certificate")) { New-Item -ItemType Directory -Force -Path "Demo Certificate" } -if (Test-Path "Demo Certificate\TempOwner.pfx") { Remove-Item "Demo Certificate\TempOwner.pfx" } - -# Generate the Ownership private signing key with password 12345678 -$pw = ConvertTo-SecureString "12345678" -AsPlainText -Force - -$TestUefiV2 = New-SelfSignedCertificate ` - -Subject "CN=Surface Demo Kit, O=Contoso Corporation, C=US" ` - -Type SSLServerAuthentication ` - -HashAlgorithm sha256 ` - -KeyAlgorithm RSA ` - -KeyLength 2048 ` - -KeyUsage KeyEncipherment ` - -KeyUsageProperty All ` - -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" ` - -NotAfter (Get-Date).AddYears(25) ` - -TextExtension @("2.5.29.37={text}1.2.840.113549.1.1.1") ` - -KeyExportPolicy Exportable - -$TestUefiV2 | Export-PfxCertificate -Password $pw -FilePath "Demo Certificate\TempOwner.pfx" - ``` - -For use with SEMM and Microsoft Surface UEFI Configurator, the certificate must be exported with the private key and with password protection. Microsoft Surface UEFI Configurator will prompt you to select the SEMM certificate file (.pfx) and certificate password when it is required. - ->[!NOTE] ->For organizations that use an offline root in their PKI infrastructure, Microsoft Surface UEFI Configurator must be run in an environment connected to the root CA to authenticate the SEMM certificate. The packages generated by Microsoft Surface UEFI Configurator can be transferred as files and therefore can be transferred outside the offline network environment with removable storage, such as a USB stick. - -### Managing certificates FAQ - -The recommended *minimum* length is 15 months. You can use a -certificate that expires in less than 15 months or use a certificate -that expires in longer than 15 months. - ->[!NOTE] ->When a certificate expires, it does not automatically renew. - -**Will existing machines continue to apply the bios settings after 15 -months?** - -Yes, but only if the package itself was signed when the certificate was -valid. - -**Will** **the SEMM package and certificate need to be updated on all -machines that have it?** - -If you want SEMM reset or recovery to work, the certificate needs to be -valid and not expired. - -**Can bulk reset packages be created for each surface that we order? Can -one be built that resets all machines in our environment?** - -The PowerShell samples that create a config package for a specific -device type can also be used to create a reset package that is -serial-number independent. If the certificate is still valid, you can -create a reset package using PowerShell to reset SEMM. - -## Version History - - - -### Version 2.43.136.0 -* Support to enable/disable simulatenous multithreating -* Separate options for WiFi and Bluetooth for some devices -* Battery Limit removed for Surface Studio - -### Version 2.26.136.0 -* Add support to Surface Studio 2 -* Battery Limit feature - -### Version 2.21.136.0 -* Add support to Surface Pro 6 -* Add support to Surface Laptop 2 - -### Version 2.14.136.0 -* Add support to Surface Go - -### Version 2.9.136.0 -* Add support to Surface Book 2 -* Add support to Surface Pro LTE -* Accessibility improvements - -### Version 1.0.74.0 -* Add support to Surface Laptop -* Add support to Surface Pro -* Bug fixes and general improvement - -## Related topics - -[Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md) - -[Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) diff --git a/devices/surface/surface-system-sku-reference.md b/devices/surface/surface-system-sku-reference.md deleted file mode 100644 index 6b6e75f7d4..0000000000 --- a/devices/surface/surface-system-sku-reference.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: System SKU reference (Surface) -description: See a reference of System Model and System SKU names. -keywords: uefi, configure, firmware, secure, semm -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/20/2019 -ms.reviewer: -manager: dansimp ---- - -# System SKU reference - -This document provides a reference of System Model and System SKU names that you can use to quickly determine the machine state of a specific device by using PowerShell or WMI. - -System Model and System SKU are variables that are stored in the System Management BIOS (SMBIOS) tables in the UEFI layer of Surface devices. The System SKU name is required to differentiate between devices that have the same System Model name, such as Surface Pro and Surface Pro with LTE Advanced. - -| Device | System Model | System SKU | -| ---------- | ----------- | -------------- | -| Surface 3 WiFI | Surface 3 | Surface_3 | -| Surface 3 LTE AT&T | Surface 3 | Surface_3_US1 | -| Surface 3 LTE Verizon | Surface 3 | Surface_3_US2 | -| Surface 3 LTE North America | Surface 3 | Surface_3_NAG | -| Surface 3 LTE Outside of North America and Y!mobile In Japan | Surface 3 | Surface_3_ROW | -| Surface Pro | Surface Pro | Surface_Pro_1796 | -| Surface Pro with LTE Advanced | Surface Pro | Surface_Pro_1807 | -| Surface Book 2 13inch | Surface Book 2 | Surface_Book_1832 | -| Surface Book 2 15inch | Surface Book 2 | Surface_Book_1793 | -| Surface Go LTE Consumer | Surface Go | Surface_Go_1825_Consumer | -| Surface Go LTE Commercial | System Go | Surface_Go_1825_Commercial | -| Surface Go Consumer | Surface Go | Surface_Go_1824_Consumer | -| Surface Go Commercial | Surface Go | Surface_Go_1824_Commercial | -| Surface Pro 6 Consumer | Surface Pro 6 | Surface_Pro_6_1796_Consumer | -| Surface Pro 6 Commercial | Surface Pro 6 | Surface_Pro_6_1796_Commercial | -| Surface Laptop 2 Consumer | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer | -| Surface Laptop 2 Commercial | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial | - -## Examples - -**Retrieving the SKU by using PowerShell** -Use the following PowerShell command to pull the System SKU information: - - ``` powershell -gwmi -namespace root\wmi -class MS_SystemInformation | select SystemSKU -``` - -**Retrieving the SKU by using System Information** -You can also find the System SKU and System Model for a device in **System Information**. To do this, follow these steps: - -1. Select **Start**, and then type **MSInfo32** in the search box. -1. Select **System Information**. - -**Using the SKU in a task sequence WMI condition** -You can use the System SKU information in the Microsoft Deployment Toolkit (MDT) or System Center Configuration Manager as part of a task sequence WMI condition. - - ``` powershell - - WMI Namespace – Root\WMI - - WQL Query – SELECT * FROM MS_SystemInformation WHERE SystemSKU = "Surface_Pro_1796" - ``` diff --git a/devices/surface/surface.yml b/devices/surface/surface.yml deleted file mode 100644 index 8287763c1e..0000000000 --- a/devices/surface/surface.yml +++ /dev/null @@ -1,61 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Surface devices -metadata: - document_id: - title: Surface devices - description: Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: medium - author: lizap - ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. - " -- title: Explore -- items: - - type: markdown - text: " - Evaluate the Surface device portfolio, review the tools and technologies for management of your Surface devices, and learn about Surface technologies and devices with engineering walkthroughs.
          - -

          **Surface Pro**
          Light enough to take anywhere. Powerful enough to use as a full desktop workstation.
          See spec

          **Surface Book**
          Built for extreme performance. Lightning fast access to apps. Up to 16 hours of battery life.
          See spec

          **Surface Studio**
          Professional-grade power and performance. Use it upright or draw on it like a drafting table.
          See spec
          - " -- title: Plan -- items: - - type: markdown - text: " - Explore essential concepts for the deployment of Windows 10 to Surface devices.
          - -

          **Try Windows 10 Enterprise free for 90 days**
          Try the latest features. Test your apps, hardware, and deployment strategies.
          Get started

          **Windows 10 upgrade paths**
          Upgrade to Windows 10 from a previous version, or from one edition to another.
          Explore paths

          **Prepare for Windows 10 deployment**
          Get familiar with current deployment options and best practices.
          Review options
          - " -- title: Deploy -- items: - - type: markdown - text: " - Download deployment tools and get step-by-step guidance on how to upgrade a Surface device or deploy a new image.
          - -

          **Microsoft Deployment Toolkit (MDT)**
          Automate Windows 10 deployment, and more easily manage security and configurations.
          Download the toolkit

          **System Center Configuration Manager**
          Use in tandem with MDT to deploy Windows 10 and manage PCs and devices moving forward.
          Download an eval

          **Surface Deployment Accelerator**
          Automate the creation and configuration of Windows images for Surface devices.
          Download the accelerator
          - " -- title: Manage -- items: - - type: markdown - text: " - Learn how to more easily manage and secure Surface devices in your organization.
          - -

          **Manage Surface firmware and driver updates**
          Download the latest firmware and drivers for Surface devices.
          Manage Surface Dock Updater.
          Surface update history

          **Discover Surface tools for IT**
          Surface Diagnostic Toolkit
          Surface Data Eraser
          Surface Enterprise Management Mode
          Surface Pro 3 Asset Tag CLI Utility

          **Manage settings and devices**
          Manage Windows corporate devices
          Manage Surface UEFI Settings
          Bitlocker PIN on Surface Pro 3 and other tablets
          Enroll and configure Surface devices with SEMM
          - " -- title: Stay informed -- items: - - type: markdown - text: " - -

          **Surface IT Pro Blog**
          Get insight into new Surface products plus tips and tricks for IT professionals.
          Learn more

          **Surface on Microsoft Mechanics**
          View technical demos and walkthroughs of Surface devices, features, and functionality.
          Get started

          **Follow us on Twitter**
          Keep up with the latest news and see the latest product demonstrations.
          Visit Twitter
          - " diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md deleted file mode 100644 index edcfcdf120..0000000000 --- a/devices/surface/unenroll-surface-devices-from-semm.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: Unenroll Surface devices from SEMM (Surface) -description: Learn how to unenroll a device from SEMM by using a Surface UEFI reset package or the Recovery Request option. -keywords: surface enterprise management -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/06/2017 -ms.reviewer: -manager: dansimp ---- - -# Unenroll Surface devices from SEMM - -When a Surface device is enrolled in Surface Enterprise Management Mode (SEMM), a certificate is stored in the firmware of that device. The presence of that certificate and the enrollment in SEMM prevent any unauthorized changes to Surface UEFI settings or options while the device is enrolled in SEMM. To restore control of Surface UEFI settings to the user, the Surface device must be unenrolled from SEMM, a process sometimes described as reset or recovery. There are two methods you can use to unenroll a device from SEMM—a Surface UEFI reset package and a Recovery Request. - ->[!WARNING] ->To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly. - -For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). - -## Unenroll a Surface device from SEMM with a Surface UEFI reset package - -The Surface UEFI reset package is the primary method you use to unenroll a Surface device from SEMM. Like a Surface UEFI configuration package, the reset package is a Windows Installer (.msi) file that configures SEMM on the device. Unlike the configuration package, the reset package will reset the Surface UEFI configuration on a Surface device to its default settings, remove the SEMM certificate, and unenroll the device from SEMM. - -Reset packages are created specifically for an individual Surface device. To begin the process of creating a reset package, you will need the serial number of the device you want to unenroll, as well as the SEMM certificate used to enroll the device. You can find the serial number of your Surface device on the **PC information** page of Surface UEFI, as shown in Figure 1. This page is displayed even if Surface UEFI is password protected and the incorrect password is entered. - -![Serial number of Surface device is displayed](images/surface-semm-unenroll-fig1.png "Serial number of Surface device is displayed") - -*Figure 1. The serial number of the Surface device is displayed on the Surface UEFI PC information page* - ->[!NOTE] ->To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot. - -To create a Surface UEFI reset package, follow these steps: - -1. Open Microsoft Surface UEFI Configurator from the Start menu. -2. Click **Start**. -3. Click **Reset Package**, as shown in Figure 2. - - ![Select Reset Package to create a package to unenroll Surface device from SEMM](images/surface-semm-unenroll-fig2.png "Select Reset Package to create a package to unenroll Surface device from SEMM") - - *Figure 2. Click Reset Package to create a package to unenroll a Surface device from SEMM* - -4. Click **Certificate Protection** to add your SEMM certificate file with private key (.pfx), as shown in Figure 3. Browse to the location of your certificate file, select the file, and then click **OK**. - - ![Add the SEMM certificate to Surface UEFI reset package](images/surface-semm-unenroll-fig3.png "Add the SEMM certificate to Surface UEFI reset package") - - *Figure 3. Add the SEMM certificate to a Surface UEFI reset package* - -5. Click **Next**. -6. Type the serial number of the device you want to unenroll from SEMM (as shown in Figure 4), and then click **Build** to generate the Surface UEFI reset package. - - ![Create a Surface UEFI reset package with serial number of Surface device](images/surface-semm-unenroll-fig4.png "Create a Surface UEFI reset package with serial number of Surface device") - - *Figure 4. Use the serial number of your Surface device to create a Surface UEFI reset package* - -7. In the **Save As** dialog box, specify a name for the Surface UEFI reset package, browse to the location where you would like to save the file, and then click **Save**. -8. When the package generation has completed, the **Successful** page is displayed. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. - -Run the Surface UEFI reset package Windows Installer (.msi) file on the Surface device to unenroll the device from SEMM. The reset package will require a reboot to perform the unenroll operation. After the device has been unenrolled, you can verify the successful removal by ensuring that the **Microsoft Surface Configuration Package** item in **Programs and Features** (shown in Figure 5) is no longer present. - -![Screen that shows device is enrolled in SEMM](images/surface-semm-unenroll-fig5.png "Screen that shows device is enrolled in SEMM") - -*Figure 5. The presence of the Microsoft Surface Configuration Package item in Programs and Features indicates that the device is enrolled in SEMM* - -## Unenroll a Surface device from SEMM with a Recovery Request - -In some scenarios, a Surface UEFI reset package may not be a viable option to unenroll a Surface device from SEMM (for example, where Windows has become unusable). In these scenarios you can unenroll the device by using a Recovery Request generated from within Surface UEFI. The Recovery Request process can be initiated even on devices where you do not have the Surface UEFI password. - -The Recovery Request process is initiated from Surface UEFI on the Surface device, approved with Microsoft Surface UEFI Configurator on another computer, and then completed in Surface UEFI. Like the reset package, approving a Recovery Request with Microsoft Surface UEFI Configurator requires access to the SEMM certificate that was used to enroll the Surface device. - -To initiate a Recovery Request, follow these steps: - -1. Boot the Surface device that is to be unenrolled from SEMM to Surface UEFI. -2. Type the Surface UEFI password if you are prompted to do so. -3. Click the **Enterprise management** page, as shown in Figure 6. - - ![Enterprise Management page](images/surface-semm-unenroll-fig6.png "Enterprise Management page") - - *Figure 6. The Enterprise management page is displayed in Surface UEFI on devices enrolled in SEMM* - -4. Click or press **Get Started**. -5. Click or press **Next** to begin the Recovery Request process. - >[!NOTE] - >A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process. -6. Select **SEMM Certificate** from the list of certificates displayed on the **Choose a SEMM reset key** page (shown in Figure 7), and then click or press **Next**. - - ![Select SEMM certificate for your Recovery Request](images/surface-semm-unenroll-fig7.png "Select SEMM certificate for your Recovery Request") - - *Figure 7. Choose SEMM Certificate for your Recovery Request (Reset Request)* - -7. On the **Enter SEMM reset verification code** page you can click the **QR Code** or **Text** buttons to display your Recovery Request (Reset Request) as shown in Figure 8, or the **USB** button to save your Recovery Request (Reset Request) as a file to a USB drive, as shown in Figure 9. - - ![Recovery Request displayed as a QR Code](images/surface-semm-unenroll-fig8.png "Recovery Request displayed as a QR Code") - - *Figure 8. A Recovery Request (Reset Request) displayed as a QR Code* - - ![Save a recovery request to a USB drive](images/surface-semm-unenroll-fig9.png "Save a recovery request to a USB drive") - - *Figure 9. Save a Recovery Request (Reset Request) to a USB drive* - - * To use a QR Code Recovery Request (Reset Request), use a QR reader app on a mobile device to read the code. The QR reader app will translate the QR code into an alphanumeric string. You can then email or message that string to the administrator that will produce the reset verification code with Microsoft Surface UEFI Configurator. - * To use a Recovery Request (Reset Request) saved to a USB drive as a file, use the USB drive to transfer the file to the computer where Microsoft Surface UEFI Configurator will be used to produce the Reset Verification Code. The file can also be copied from the USB drive on another device to be emailed or transferred over the network. - * To use the Recovery Request (Reset Request) as text, simply type the text directly into Microsoft Surface UEFI Configurator. - -8. Open Microsoft Surface UEFI Configurator from the Start menu on another computer. - >[!NOTE] - >Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate. -9. Click **Start**. -10. Click **Recovery Request**, as shown in Figure 10. - - ![Start process to approve a Recovery Request](images/surface-semm-unenroll-fig10.png "Start process to approve a Recovery Request") - - *Figure 10. Click Recovery Request to begin the process to approve a Recovery Request* - -11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate. -12. Browse to and select your SEMM certificate file, and then click **OK**. -13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**. - - ![Type password for SEMM certificate](images/surface-semm-unenroll-fig11.png "Type password for SEMM certificate") - - *Figure 11. Type the password for the SEMM certificate* - -14. Click **Next**. -15. Enter the Recovery Request (Reset Request), and then click **Generate** to create a reset verification code (as shown in Figure 12). - - ![Enter the recovery request](images/surface-semm-unenroll-fig12.png "Enter the recovery request") - - *Figure 12. Enter the Recovery Request (Reset Request)* - - * If you displayed the Recovery Request (Reset Request) as text on the Surface device being reset, use the keyboard to type the Recovery Request (Reset Request) in the provided field. - * If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field. - * If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**. - -16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13. - - ![Display of the reset verification code](images/surface-semm-unenroll-fig13.png "Display of the reset verification code") - - *Figure 13. The reset verification code displayed in Microsoft Surface UEFI Configurator* - - * Click the **Share** button to send the reset verification code by email. - -17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM. -18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14. - - ![Example display of successful unenrollment from SEMM](images/surface-semm-unenroll-fig14.png "Example display of successful unenrollment from SEMM") - - *Figure 14. Successful unenrollment from SEMM* - -19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator. - - diff --git a/devices/surface/update.md b/devices/surface/update.md deleted file mode 100644 index 0a3a4b4a5d..0000000000 --- a/devices/surface/update.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Surface firmware and driver updates (Surface) -description: Find out how to download and manage the latest firmware and driver updates for your Surface device. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 11/13/2018 -ms.reviewer: -manager: dansimp ---- - -# Surface firmware and driver updates - -Find out how to download and manage the latest firmware and driver updates for your Surface device. - -## In this section - -| Topic | Description | -| --- | --- | -|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically. | -| [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)| Get a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.| -| [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)| Explore the available options to manage firmware and driver updates for Surface devices.| -| [Surface Dock Updater](surface-dock-updater.md)| Get a detailed walkthrough of Microsoft Surface Dock Updater.| - - -## Related topics - -[Surface TechCenter](https://technet.microsoft.com/windows/surface) - -[Surface for IT pros blog](http://blogs.technet.com/b/surface/) - - - - - - - - - diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md deleted file mode 100644 index fc7cf4147e..0000000000 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ /dev/null @@ -1,235 +0,0 @@ ---- -title: Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit (Surface) -description: Find out how to perform a Windows 10 upgrade deployment to your Surface devices. -keywords: windows 10 surface, upgrade, customize, mdt -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 10/16/2017 -ms.reviewer: -manager: dansimp ---- - -# Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit - -#### Applies to -* Surface Pro 3 -* Surface 3 -* Surface Pro 2 -* Surface Pro -* Windows 10 - -In addition to the traditional deployment method of reimaging devices, administrators that want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. The process described in this article shows how to perform a Windows 10 upgrade deployment to Surface devices. - -If you are not already familiar with the deployment of Windows or the Microsoft deployment tools and technologies, you should read [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) and familiarize yourself with the traditional deployment method before you proceed. - -#### The upgrade concept - -When you use the factory installation media to install Windows on a device, you are presented with two options or *installation paths* to install Windows on that device. The first of these installation paths – *clean installation* – allows you to apply a factory image of Windows to that device, including all default settings. The second of these installation paths – *upgrade* – allows you to apply Windows to the device but retains the device’s users, apps, and settings. - -When you perform a Windows deployment using traditional deployment methods, you follow an installation path that is very similar to a clean installation. The primary difference between the clean installation and the traditional deployment method of *reimaging* is that with reimaging, you can apply an image that includes customizations. Microsoft deployment technologies, such as the Microsoft Deployment Toolkit (MDT), expand the capabilities of the reimaging process by modifying the image during deployment. For example, MDT is able to inject drivers for a specific hardware configuration during deployment, and with pre and post imaging scripts to perform a number of tasks, such as the installation of applications. - -For versions of Windows prior to Windows 10, if you wanted to install a new version of Windows on your devices and preserve the configuration of those systems, you had to perform additional steps during your deployment. For example, if you wanted to keep the data of users on the device, you had to back up user data with the User State Migration Tool (USMT) prior to the deployment and restore that data after the deployment had completed. - -Introduced with Windows 10 and MDT 2013 Update 1, you can use the upgrade installation path directly with Microsoft deployment technologies such as the Microsoft Deployment Toolkit (MDT). With an upgrade deployment you can use the same deployment technologies and process, but you can preserve users settings, and applications of the existing environment on the device. - -## Deployment tools and resources - -Performing an upgrade deployment of Windows 10 requires the same tools and resources that are required for a traditional reimaging deployment. You can read about the tools required, including detailed explanations and installation instructions, in [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md). To proceed with the upgrade deployment described in this article, you will need the following tools installed and configured: - -* [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741) -* [Windows Assessment and Deployment Kit (Windows ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk), which includes: - * Deployment Image Servicing and Management (DISM) - * Windows Preinstallation Environment (Windows PE) - * Windows System Image Manager (Windows SIM) - -You will also need to have available the following resources: - -* Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx) - - >[!NOTE] - >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. -* [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 - -* Application installation files for any applications you want to install, such as the Surface app - -## Prepare the upgrade deployment - -Before you begin the process described in this section, you need to have installed and configured the deployment tools outlined in the previous [Deployment tools and resources](#deployment-tools-and-resources) section. For instructions on how to install and configure the deployment tools, see the **Install the deployment tools** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#install-the-deployment-tools) article. You will also have needed to create a deployment share with MDT, described in the section Create a Deployment Share in the aforementioned article. - -### Import Windows 10 installation files - -Windows 10 installation files only need to be imported if you have not already done so in the deployment share. To import Windows 10 installation files, follow the steps described in the **Import Windows installation files** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#import-windows-installation-files) article. - -### Import Surface drivers -In the import process example shown in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, drivers for Surface Pro 4 were imported for Windows 10. To perform an upgrade deployment of Windows 10 to Surface Pro 3, drivers for Surface Pro 3 must also be imported. To import the Surface drivers for Surface Pro 3, follow these steps: - -1. Download the Surface Pro 3 firmware and driver pack for Windows 10 archive file (.zip), SurfacePro3_Win10_xxxxxx.zip, from the [Surface Pro 3 download page](https://www.microsoft.com/download/details.aspx?id=38826) in the Microsoft Download Center. -2. Extract the contents of the Surface Pro 3 firmware and driver pack archive file to a temporary folder. Keep the driver files separate from other drivers or files. -3. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. -4. If you have not already created a folder structure by operating system version, you should do so next. Under the **Windows 10 x64** folder, create a new folder for Surface Pro 3 drivers named **Surface Pro 3**. Your Out-of-Box Drivers folder should resemble the following structure: - * WinPE x86 - * WinPE x64 - * Windows 10 x64 - * Microsoft Corporation - * Surface Pro 4 - * Surface Pro 3 -5. Right-click the **Surface Pro 3** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1. - - ![Import Surface Pro 3 drivers for Windows 10](images/surface-upgrademdt-fig1.png "Import Surface Pro 3 drivers for Windows 10") - - *Figure 1. Import Surface Pro 3 drivers for Windows 10* - -6. The Import Driver Wizard displays a series of steps, as follows: - - **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 3 firmware and drivers in Step 1. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - - **Progress** – While the drivers are imported, a progress bar is displayed on this page. - - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Drivers Wizard. -7. Select the **Surface Pro 3** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 2. - - ![Drivers for Surface Pro 3 imported and organized in the MDT deployment share](images/surface-upgrademdt-fig2.png "Drivers for Surface Pro 3 imported and organized in the MDT deployment share") - - *Figure 2. Drivers for Surface Pro 3 imported and organized in the MDT deployment share* - -### Import applications - -Installation of applications in an upgrade deployment is not always necessary because the applications from the previous environment will remain on the device. (For example, in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, the deployment includes Office 365 which is not required in an upgrade deployment where the user is already using Office 365 on the device.) - -There are still some circumstances where you will want to deploy an application, even during an upgrade deployment. For example, you may have Surface Pro 3 devices on which you would like to add the Surface app. To deploy the Surface app in an upgrade scenario use the same process as you would for a traditional deployment. See the [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business) article for instructions on how to add the Surface app to an MDT task sequence. - -### Create the upgrade task sequence - -After you have all of the resources in place to perform the deployment (including the installation files, Surface drivers, and application files), the next step is to create the upgrade task sequence. This task sequence is a series of steps that will be performed on the device being upgraded that applies the new Windows environment, compatible drivers, and any applications you have specified. - -Create the upgrade task sequence with the following process: - -1. In the Deployment Workbench under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. -2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: - - **General Settings** – Enter an identifier for the deployment task sequence in the Task Sequence ID field, a name for the deployment task sequence in the Task Sequence Name field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, and then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - - **Select Template** – Select **Standard Client Upgrade Task Sequence** from the drop-down menu, and then click **Next**. - - **Select OS** – Navigate to and select the Windows image that you imported, and then click **Next**. - - **Specify Product Key** – Select the product key entry that fits your organization’s licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. - - **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - - **Admin Password** – Select **Use the Specified Local Administrator Password** and enter a password in the provided fields, and then click **Next**. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - - **Progress** – While the task sequence is being created, a progress bar is displayed on this page. - - **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete New Task Sequence Wizard. - -After the task sequence is created, you can modify some additional settings to provide additional automation of the task sequence and require less interaction during deployment. Follow these steps to modify the task sequence: - -1. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -2. Select the **Task Sequence** tab to view the steps that are included in the new task sequence. -3. Select the **Windows Update (Pre-Application Installation)** step, located under the **State Restore** folder. -4. Click the **Options** tab, and then clear the **Disable This Step** check box. -5. Repeat Step 3 and Step 4 for the **Windows Update (Post-Application Installation)** step. -6. Between the two Windows Update steps is an **Install Applications** step. Select that step and then click **Add**. -7. Hover the mouse over **General** under the **Add** menu, and then choose **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. - - ![A new Install Application step in the deployment task sequence](images/surface-upgrademdt-fig3.png "A new Install Application step in the deployment task sequence") - - *Figure 3. A new Install Application step in the deployment task sequence* - -8. On the **Properties** tab of the new **Install Application** step, enter **Install Surface App** in the **Name** field. -9. Select **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select **Surface App** from the list of applications, and then click **OK**. -11. Expand the **Preinstall** folder and select the **Enable BitLocker (Offline)** step. -12. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. -13. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 4) configure the following options: - - - **Name** – Set DriverGroup001 - - **Task Sequence Variable** – DriverGroup001 - - **Value** – Windows 10 x64\%Make%\%Model% - - ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-upgrademdt-fig4.png "Configure a new Set Task Sequence Variable step in the deployment task sequence") - - *Figure 4. Configure a new Set Task Sequence Variable step in the deployment task sequence* - -14. Select the **Inject Drivers** step, the next step in the task sequence. -15. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 5) configure the following options: - * In the **Choose a selection profile** drop-down menu, select **Nothing**. - * Click the **Install all drivers from the selection profile** button. - - ![Configure the deployment task sequence to not install drivers](images/surface-upgrademdt-fig5.png "Configure the deployment task sequence to not install drivers") - - *Figure 5. Configure the deployment task sequence to not install drivers* - -16. Click **OK** to apply changes to the task sequence and close the task sequence properties window. - -Steps 11 through 15 are very important to the deployment of Surface devices. These steps instruct the task sequence to install only drivers that are organized into the correct folder using the organization for drivers from the [Import Surface drivers](#import-surface-drivers) section. - -### Deployment share rules - -To automate the upgrade process, the rules of the MDT deployment share need to be modified to suppress prompts for information from the user. Unlike a traditional deployment, Bootstrap.ini does not need to be modified because the deployment process is not started from boot media. Similarly, boot media does not need to be imported into WDS because it will not be booted over the network with PXE. - -To modify the deployment share rules and suppress the Windows Deployment Wizard prompts for information, copy and paste the following text into the text box on the **Rules** tab of your deployment share properties: - -``` -[Settings] -Priority=Model,Default -Properties=MyCustomProperty - -[Surface Pro 4] -SkipTaskSequence=YES -TaskSequenceID=Win10SP4 - -[Surface Pro 3] -SkipTaskSequence=YES -TaskSequenceID=Win10SP3Up - -[Default] -OSInstall=Y -SkipCapture=YES -SkipAdminPassword=YES -SkipProductKey=YES -SkipComputerBackup=YES -SkipBitLocker=YES -SkipBDDWelcome=YES -SkipUserData=YES -UserDataLocation=AUTO -SkipApplications=YES -SkipPackageDisplay=YES -SkipComputerName=YES -SkipDomainMembership=YES -JoinDomain=contoso.com -DomainAdmin=MDT -DomainAdminDomain=contoso -DomainAdminPassword=P@ssw0rd -SkipLocaleSelection=YES -KeyboardLocale=en-US -UserLocale=en-US -UILanguage=en-US -SkipTimeZone=YES -TimeZoneName=Pacific Standard Time -UserID=MDTUser -UserDomain=STNDeployServer -UserPassword=P@ssw0rd -SkipSummary=YES -SkipFinalSummary=YES -FinishAction=LOGOFF -``` - - - -For more information about the rules configured by this text, see the **Configure deployment share rules** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#configure-deployment-share-rules) article. - -### Update deployment share - -To update the deployment share, right-click the deployment share in the Deployment Workbench and click **Update Deployment Share**, then proceed through the Update Deployment Share Wizard. See the **Update and import updated MDT boot media** section of the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#update-and-import-updated-mdt-boot-media) article for detailed steps. - -### Run the upgrade deployment - -Unlike a traditional deployment, the upgrade task sequence must be launched from within the Windows environment that will be upgraded. This requires that a user on the device to be upgraded navigate to the deployment share over the network and launch a script, LiteTouch.vbs. This script is the same script that displays the Windows Deployment Wizard in Windows PE in a traditional deployment. In this scenario, Litetouch.vbs will run within Windows. To perform the upgrade task sequence and deploy the upgrade to Windows 10 follow these steps: - -1. Browse to the network location of your deployment share in File Explorer. -2. Navigate to the **Scripts** folder, locate **LiteTouch.vbs**, and then double-click **LiteTouch.vbs** to start the Windows Deployment Wizard. -3. Enter your credentials when prompted. -4. The upgrade task sequence for Surface Pro 3 devices will automatically start when the model of the device is detected and determined to match the deployment share rules. -5. The upgrade process will occur automatically and without user interaction. - -The task sequence will automatically install the drivers for Surface Pro 3 and the Surface app, and will perform any outstanding Windows Updates. When it completes, it will log out and be ready for the user to log on with the credentials they have always used for this device. diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md deleted file mode 100644 index dff968bbf3..0000000000 --- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md +++ /dev/null @@ -1,536 +0,0 @@ ---- -title: Use System Center Configuration Manager to manage devices with SEMM (Surface) -description: Find out how to use Microsoft Surface UEFI Manager to perform SEMM management with System Center Configuration Manager. -keywords: enroll, update, scripts, settings -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 02/01/2017 -ms.reviewer: -manager: dansimp ---- - -# Use System Center Configuration Manager to manage devices with SEMM - -The Surface Enterprise Management Mode (SEMM) feature of Surface UEFI devices allows administrators to both manage and secure the configuration of Surface UEFI settings. For most organizations, this process is accomplished by creating Windows Installer (.msi) packages with the Microsoft Surface UEFI Configurator tool. These packages are then run or deployed to the client Surface devices to enroll the devices in SEMM and to update the Surface UEFI settings configuration. - -For organizations with System Center Configuration Manager, there is an alternative to using the Microsoft Surface UEFI Configurator .msi process to deploy and administer SEMM. Microsoft Surface UEFI Manager is a lightweight installer that makes required assemblies for SEMM management available on a device. By installing these assemblies with Microsoft Surface UEFI Manager on a managed client, SEMM can be administered by Configuration Manager with PowerShell scripts, deployed as applications. With this process, SEMM management is performed within Configuration Manager, which eliminates the need for the external Microsoft Surface UEFI Configurator tool. - ->[!Note] ->Although the process described in this article may work with earlier versions of System Center Configuration Manager or with other third-party management solutions, management of SEMM with Microsoft Surface UEFI Manager and PowerShell is supported only with the Current Branch of System Center Configuration Manager. - -#### Prerequisites - -Before you begin the process outlined in this article, it is expected that you are familiar with the following technologies and tools: - -* [Surface UEFI](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings) -* [Surface Enterprise Management Mode (SEMM)](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode) -* [PowerShell scripting](https://technet.microsoft.com/scriptcenter/dd742419) -* [System Center Configuration Manager application deployment](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications) -* Certificate management - -> [!Note] -> You will also need access to the certificate that you intend to use to secure SEMM. For details about the requirements for this certificate, see [Surface Enterprise Management Mode certificate requirements](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode#surface-enterprise-management-mode-certificate-requirements). -> -> It is very important that this certificate be kept in a safe location and properly backed up. If this certificate becomes lost or unusable, it is not possible to reset Surface UEFI, change managed Surface UEFI settings, or remove SEMM from an enrolled Surface device. - -#### Download Microsoft Surface UEFI Manager - -Management of SEMM with Configuration Manager requires the installation of Microsoft Surface UEFI Manager on each client Surface device. You can download Microsoft Surface UEFI Manager (SurfaceUEFIManager.msi) from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center. - -#### Download SEMM scripts for Configuration Manager - -After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://www.microsoft.com/en-us/download/details.aspx?id=46703) from the Download Center. - -## Deploy Microsoft Surface UEFI Manager - -Deployment of Microsoft Surface UEFI Manager is a typical application deployment. The Microsoft Surface UEFI Manager installer file is a standard Windows Installer file that you can install with the [standard quiet option](https://msdn.microsoft.com/library/windows/desktop/aa367988). - -The command to install Microsoft Surface UEFI Manager is: - -`msiexec /i "SurfaceUEFIManagerSetup.msi" /q` - -The command to uninstall Microsoft Surface UEFI Manager is: - -`msiexec /x {541DA890-1AEB-446D-B3FD-D5B3BB18F9AF} /q` - -To create a new application and deploy it to a collection that contains your Surface devices, perform the following steps: - -1. Open Configuration Manager Console from the Start screen or Start menu. -2. Click **Software Library** in the bottom left corner of the window. -3. Expand the Application Management node of the Software Library, and then click **Applications**. -4. Click the **Create Application** button under the **Home** tab at the top of the window. This starts the Create Application Wizard. -5. The Create Application Wizard presents a series of steps: - - * **General** – The **Automatically detect information about this application from installation files** option is selected by default. In the **Type** field, **Windows Installer (*.msi file)** is also selected by default. Click **Browse** to navigate to and select **SurfaceUEFIManagerSetup.msi**, and then click **Next**. - - >[!Note] - >The location of SurfaceUEFIManagerSetup.msi must be on a network share and located in a folder that contains no other files. A local file location cannot be used. - - * **Import Information** – The Create Application Wizard will parse the .msi file and read the **Application Name** and **Product Code**. SurfaceUEFIManagerSetup.msi should be listed as the only file under the line **Content Files**, as shown in Figure 1. Click **Next** to proceed. - - - ![Information from Surface UEFI Manager setup is automatically parsed](images/config-mgr-semm-fig1.png "Information from Surface UEFI Manager setup is automatically parsed") - - *Figure 1. Information from Microsoft Surface UEFI Manager setup is automatically parsed* - - * **General Information** – You can modify the name of the application and information about the publisher and version, or add comments on this page. The installation command for Microsoft Surface UEFI Manager is displayed in the Installation Program field. The default installation behavior of Install for system will allow Microsoft Surface UEFI Manager to install the required assemblies for SEMM even if a user is not logged on to the Surface device. Click Next to proceed. - * **Summary** – The information that was parsed in the **Import Information** step and your selections from the **General Information** step is displayed on this page. Click **Next** to confirm your selections and create the application. - * **Progress** – Displays a progress bar and status as the application is imported and added to the Software Library. - * **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Click **Close** to finish the Create Application Wizard. - -After the application is created in Configuration Manager, you can distribute it to your distribution points and deploy it to the collections including your Surface devices. This application will not install or enable SEMM on the Surface device – it only provides the assemblies required for SEMM to be enabled via PowerShell script. - -If you do not want to install the Microsoft Surface UEFI Manager assemblies on devices that will not be managed with SEMM, you can configure Microsoft Surface UEFI Manager as a dependency of the SEMM Configuration Manager scripts. This scenario is covered in the [Deploy SEMM Configuration Manager Scripts](#deploy-semm-configuration-manager-scripts) section later in this article. - -## Create or modify the SEMM Configuration Manager scripts - -After the required assemblies have been installed on the devices, the process of enrolling the devices in SEMM and configuring Surface UEFI is done with PowerShell scripts and deployed as a script application with Configuration Manager. These scripts can be modified to fit the needs of your organization and environment. For example, you can create multiple configurations for managed Surface devices in different departments or roles. You can download samples of the scripts for SEMM and Configuration Manager at the link in the [Prerequisites](#prerequisites) section at the beginning of this article. - -There are two primary scripts you will need to perform a SEMM deployment with Configuration Manager: - -* **ConfigureSEMM.ps1** – Use this script to create configuration packages for your Surface devices with your desired Surface UEFI settings, to apply the specified settings to a Surface device, to enroll the device in SEMM, and to set a registry key used to identify the enrollment of the device in SEMM. -* **ResetSEMM.ps1** – Use this script to reset SEMM on a Surface device, which unenrolls it from SEMM and removes the control over Surface UEFI settings. - -The sample scripts include examples of how to set Surface UEFI settings and how to control permissions to those settings. These settings can be modified to secure Surface UEFI and set Surface UEFI settings according to the needs of your environment. The following sections of this article explain the ConfigureSEMM.ps1 script and explore the modifications you need to make to the script to fit your requirements. - ->[!NOTE] ->The SEMM Configuration Manager scripts and the exported SEMM certificate file (.pfx) should be placed in the same folder with no other files before they are added to Configuration Manager. - -### Specify certificate and package names - -The first region of the script that you need to modify is the portion that specifies and loads the SEMM certificate, and also indicates SurfaceUEFIManager version, the names for the SEMM configuration package and SEMM reset package. The certificate name and SurfaceUEFIManager version are specified on lines 56 through 73 in the ConfigureSEMM.ps1 script: - - ``` - 56 $WorkingDirPath = split-path -parent $MyInvocation.MyCommand.Definition - 57 $packageRoot = "$WorkingDirPath\Config" - 58 $certName = "FabrikamSEMMSample.pfx" - 59 $DllVersion = "2.26.136.0" - 60 - 61 $certNameOnly = [System.IO.Path]::GetFileNameWithoutExtension($certName) - 62 $ProvisioningPackage = $certNameOnly + "ProvisioningPackage.pkg" - 63 $ResetPackage = $certNameOnly + "ResetPackage.pkg" - 64 - 65 if (-not (Test-Path $packageRoot)) { New-Item -ItemType Directory -Force -Path $packageRoot } - 66 Copy-Item "$WorkingDirPath\$certName" $packageRoot - 67 - 68 $privateOwnerKey = Join-Path -Path $packageRoot -ChildPath $certName - 69 $ownerPackageName = Join-Path -Path $packageRoot -ChildPath $ProvisioningPackage - 70 $resetPackageName = Join-Path -Path $packageRoot -ChildPath $ResetPackage - 71 - 72 # If your PFX file requires a password then it can be set here, otherwise use a blank string. - 73 $password = "1234" - ``` - -Replace the **FabrikamSEMMSample.pfx** value for the **$certName** variable with the name of your SEMM Certificate file on line 58. The script will create a working directory (named Config) in the folder where your scripts are located, and will then copy the certificate file to this working directory. - -Owner package and reset package will also be created in the Config directory and hold the configuration for Surface UEFI settings and permissions generated by the script. - -On line 73, replace the value of the **$password** variable, from 1234, to the password for your certificate file. If a password is not required, delete the **1234** text. - ->[!Note] ->The last two characters of the certificate thumbprint are required to enroll a device in SEMM. This script will display these digits to the user, which allows the user or technician to record these digits before the system reboots to enroll the device in SEMM. The script uses the following code, found on lines 150-155, to accomplish this: - -``` -150 # Device owners will need the last two characters of the thumbprint to accept SEMM ownership. -151 # For convenience we get the thumbprint here and present to the user. -152 $pw = ConvertTo-SecureString $password -AsPlainText -Force -153 $certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -154 $certPrint.Import($privateOwnerKey, $pw, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet) -155 Write-Host "Thumbprint =" $certPrint.Thumbprint -``` - -Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process: - -1. Right-click the .pfx file, and then click **Open**. -2. Expand the folder in the navigation pane. -3. Click **Certificates**. -4. Right-click your certificate in the main pane, and then click **Open**. -5. Click the **Details** tab. -6. **All** or **Properties Only** must be selected in the **Show** drop-down menu. -7. Select the field **Thumbprint**. - ->[!NOTE] ->The SEMM certificate name and password must also be entered in this section of the ResetSEMM.ps1 script to enable Configuration Manager to remove SEMM from the device with the uninstall action. - -### Configure permissions - -The first region of the script where you will specify the configuration for Surface UEFI is the **Configure Permissions** region. This region begins at line 210 in the sample script with the comment **# Configure Permissions** and continues to line 247. The following code fragment first sets permissions to all Surface UEFI settings so that they may be modified by SEMM only, then adds explicit permissions to allow the local user to modify the Surface UEFI password, TPM, and front and rear cameras: - -``` -210 # Configure Permissions -211 foreach ($uefiV2 IN $surfaceDevices.Values) { -212 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) { -213 Write-Host "Configuring permissions" -214 Write-Host $Device.Model -215 Write-Host "=======================" -216 -217 # Here we define which "identities" will be allowed to modify which settings -218 # PermissionSignerOwner = The primary SEMM enterprise owner identity -219 # PermissionLocal = The user when booting to the UEFI pre-boot GUI -220 # PermissionSignerUser, PermissionSignerUser1, PermissionSignerUser2 = -221 # Additional user identities created so that the signer owner -222 # can delegate permission control for some settings. -223 $ownerOnly = [Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -224 $ownerAndLocalUser = ([Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -bor [Microsoft.Surface.IUefiSetting]::PermissionLocal) -225 -226 # Make all permissions owner only by default -227 foreach ($setting IN $uefiV2.Settings.Values) { -228 $setting.ConfiguredPermissionFlags = $ownerOnly -229 } -230 -231 # Allow the local user to change their own password -232 $uefiV2.SettingsById[501].ConfiguredPermissionFlags = $ownerAndLocalUser -233 -234 Write-Host "" -235 -236 # Create a unique package name based on family and LSV. -237 # We will choose a name that can be parsed by later scripts. -238 $packageName = $uefiV2.SurfaceUefiFamily + "^Permissions^" + $lsv + ".pkg" -239 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName -240 -241 # Build and sign the Permission package then save it to a file. -242 $permissionPackageStream = $uefiV2.BuildAndSignPermissionPackage($privateOwnerKey, $password, "", $null, $lsv) -243 $permissionPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) -244 $permissionPackageStream.CopyTo($permissionPackage) -245 $permissionPackage.Close() -246 } -247 } -``` - -Each **$uefiV2** variable identifies a Surface UEFI setting by setting name or ID, and then configures the permissions to one of the following values: - -* **$ownerOnly** – Permission to modify this setting is granted only to SEMM. -* **$ownerAndLocalUser** – Permission to modify this setting is granted to a local user booting to Surface UEFI, as well as to SEMM. - -You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section of this article. - -### Configure settings - -The second region of the script where you will specify the configuration for Surface UEFI is the **Configure Settings** region of the ConfigureSEMM.ps1 script, which configures whether each setting is enabled or disabled. The sample script includes instructions to set all settings to their default values. The script then provides explicit instructions to disable IPv6 for PXE Boot and to leave the Surface UEFI Administrator password unchanged. You can find this region beginning with the **# Configure Settings** comment at line 291 through line 335 in the sample script. The region appears as follows: - -``` -291 # Configure Settings -292 foreach ($uefiV2 IN $surfaceDevices.Values) { -293 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) { -294 Write-Host "Configuring settings" -295 Write-Host $Device.Model -296 Write-Host "====================" -297 -298 # In this demo, we will start by setting every setting to the default factory setting. -299 # You may want to start by doing this in your scripts -300 # so that every setting gets set to a known state. -301 foreach ($setting IN $uefiV2.Settings.Values) { -302 $setting.ConfiguredValue = $setting.DefaultValue -303 } -304 -305 $EnabledValue = "Enabled" -306 $DisabledValue = "Disabled" -307 -308 # If you want to set something to a different value from the default, -309 # here are examples of how to accomplish this. -310 # This disables IPv6 PXE boot by name: -311 $uefiV2.Settings["IPv6 for PXE Boot"].ConfiguredValue = $DisabledValue -312 -313 # This disables IPv6 PXE Boot by ID: -314 $uefiV2.SettingsById[400].ConfiguredValue = $DisabledValue -315 -316 Write-Host "" -317 -318 # If you want to leave the setting unmodified, set it to $null -319 # PowerShell has issues setting things to $null so ClearConfiguredValue() -320 # is supplied to do this explicitly. -321 # Here is an example of leaving the UEFI administrator password as-is, -322 # even after we initially set it to factory default above. -323 $uefiV2.SettingsById[501].ClearConfiguredValue() -324 -325 # Create a unique package name based on family and LSV. -326 # We will choose a name that can be parsed by later scripts. -327 $packageName = $uefiV2.SurfaceUefiFamily + "^Settings^" + $lsv + ".pkg" -328 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName -329 -330 # Build and sign the Settings package then save it to a file. -331 $settingsPackageStream = $uefiV2.BuildAndSignSecuredSettingsPackage($privateOwnerKey, $password, "", $null, $lsv) -332 $settingsPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) -333 $settingsPackageStream.CopyTo($settingsPackage) -334 $settingsPackage.Close() -335 } -``` - -Like the permissions set in the **Configure Permissions** section of the script, the configuration of each Surface UEFI setting is performed by defining the **$uefiV2** variable. For each line defining the **$uefiV2** variable, a Surface UEFI setting is identified by setting name or ID and the configured value is set to **Enabled** or **Disabled**. - -If you do not want to alter the configuration of a Surface UEFI setting, for example to ensure that the Surface UEFI administrator password is not cleared by the action of resetting all Surface UEFI settings to their default, you can use **ClearConfiguredValue()** to enforce that this setting will not be altered. In the sample script, this is used on line 323 to prevent the clearing of the Surface UEFI Administrator password, identified in the sample script by its setting ID, **501**. - -You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section later in this article. - -### Settings registry key - -To identify enrolled systems for Configuration Manager, the ConfigureSEMM.ps1 script writes registry keys that can be used to identify enrolled systems as having been installed with the SEMM configuration script. These keys can be found at the following location: - -`HKLM\SOFTWARE\Microsoft\Surface\SEMM` - -The following code fragment, found on lines 380-477, is used to write these registry keys: - -``` -380 # For SCCM or other management solutions that wish to know what version is applied, tattoo the LSV and current DateTime (in UTC) to the registry: -381 $UTCDate = (Get-Date).ToUniversalTime().ToString() -382 $certIssuer = $certPrint.Issuer -383 $certSubject = $certPrint.Subject -384 -385 $SurfaceRegKey = "HKLM:\SOFTWARE\Microsoft\Surface\SEMM" -386 New-RegKey $SurfaceRegKey -387 $LSVRegValue = Get-ItemProperty $SurfaceRegKey LSV -ErrorAction SilentlyContinue -388 $DateTimeRegValue = Get-ItemProperty $SurfaceRegKey LastConfiguredUTC -ErrorAction SilentlyContinue -389 $OwnershipSessionIdRegValue = Get-ItemProperty $SurfaceRegKey OwnershipSessionId -ErrorAction SilentlyContinue -390 $PermissionSessionIdRegValue = Get-ItemProperty $SurfaceRegKey PermissionSessionId -ErrorAction SilentlyContinue -391 $SettingsSessionIdRegValue = Get-ItemProperty $SurfaceRegKey SettingsSessionId -ErrorAction SilentlyContinue -392 $IsResetRegValue = Get-ItemProperty $SurfaceRegKey IsReset -ErrorAction SilentlyContinue -393 $certUsedRegValue = Get-ItemProperty $SurfaceRegKey CertName -ErrorAction SilentlyContinue -394 $certIssuerRegValue = Get-ItemProperty $SurfaceRegKey CertIssuer -ErrorAction SilentlyContinue -395 $certSubjectRegValue = Get-ItemProperty $SurfaceRegKey CertSubject -ErrorAction SilentlyContinue -396 -397 -398 If ($LSVRegValue -eq $null) -399 { -400 New-ItemProperty -Path $SurfaceRegKey -Name LSV -PropertyType DWORD -Value $lsv | Out-Null -401 } -402 Else -403 { -404 Set-ItemProperty -Path $SurfaceRegKey -Name LSV -Value $lsv -405 } -406 -407 If ($DateTimeRegValue -eq $null) -408 { -409 New-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -PropertyType String -Value $UTCDate | Out-Null -410 } -411 Else -412 { -413 Set-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -Value $UTCDate -414 } -415 -416 If ($OwnershipSessionIdRegValue -eq $null) -417 { -418 New-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -PropertyType String -Value $ownerSessionIdValue | Out-Null -419 } -420 Else -421 { -422 Set-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -Value $ownerSessionIdValue -423 } -424 -425 If ($PermissionSessionIdRegValue -eq $null) -426 { -427 New-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -PropertyType String -Value $permissionSessionIdValue | Out-Null -428 } -429 Else -430 { -431 Set-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -Value $permissionSessionIdValue -432 } -433 -434 If ($SettingsSessionIdRegValue -eq $null) -435 { -436 New-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -PropertyType String -Value $settingsSessionIdValue | Out-Null -437 } -438 Else -439 { -440 Set-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -Value $settingsSessionIdValue -441 } -442 -443 If ($IsResetRegValue -eq $null) -444 { -445 New-ItemProperty -Path $SurfaceRegKey -Name IsReset -PropertyType DWORD -Value 0 | Out-Null -446 } -447 Else -448 { -449 Set-ItemProperty -Path $SurfaceRegKey -Name IsReset -Value 0 -450 } -451 -452 If ($certUsedRegValue -eq $null) -453 { -454 New-ItemProperty -Path $SurfaceRegKey -Name CertName -PropertyType String -Value $certName | Out-Null -455 } -456 Else -457 { -458 Set-ItemProperty -Path $SurfaceRegKey -Name CertName -Value $certName -459 } -460 -461 If ($certIssuerRegValue -eq $null) -462 { -463 New-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -PropertyType String -Value $certIssuer | Out-Null -464 } -465 Else -466 { -467 Set-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -Value $certIssuer -468 } -469 -470 If ($certSubjectRegValue -eq $null) -471 { -472 New-ItemProperty -Path $SurfaceRegKey -Name CertSubject -PropertyType String -Value $certSubject | Out-Null -473 } -474 Else -475 { -476 Set-ItemProperty -Path $SurfaceRegKey -Name CertSubject -Value $certSubject -477 } -``` - -### Settings names and IDs - -To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from SEMM_Powershell.zip in [Surface Tools for IT Downloads](https://www.microsoft.com/en-us/download/details.aspx?id=46703) - -The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device. - -The following tables show the available settings for Surface Pro 4 and Surface Book: - -*Table 1. Surface UEFI settings for Surface Pro 4* - -| Setting ID | Setting Name | Description | Default Setting | -| --- | --- | --- | --- | -|501| Password | UEFI System Password | | -|200| Secure Boot Keys | Secure Boot signing keys to enable for EFI applications | MsPlus3rdParty | -|300| Trusted Platform Module (TPM) | TPM device enabled or disabled | Enabled | -|301| Docking USB Port | Docking USB Port enabled or disabled | Enabled | -|302| Front Camera | Front Camera enabled or disabled | Enabled | -|303| Bluetooth | Bluetooth radio enabled or disabled | Enabled | -|304| Rear Camera | Rear Camera enabled or disabled | Enabled | -|305| IR Camera | InfraRed Camera enabled or disabled | Enabled | -|308| Wi-Fi and Bluetooth | Wi-Fi and Bluetooth enabled or disabled | Enabled | -|310| Type Cover | Surface Type Cover connector | Enabled | -|320| On-board Audio | On-board audio enabled or disabled | Enabled | -|330| Micro SD Card | Micro SD Card enabled or disabled | Enabled | -|370| USB Port 1 | Side USB Port (1) | UsbPortEnabled | -|400| IPv6 for PXE Boot | Enable IPv6 PXE boot before IPv4 PXE boot |Disabled | -|401| Alternate Boot | Alternate Boot allows users to override the boot order by holding the volume down button when powering up the device | Enabled | -|402| Boot Order Lock | Boot Order variable lock enabled or disabled | Disabled | -|403| USB Boot | Enable booting from USB devices | Enabled | -|500| TPM clear EFI protocol | Enable EFI protocol for invoking TPM clear | Disabled | -|600| Security | UEFI Security Page Display enabled or disabled | Enabled | -|601| Devices | UEFI Devices Page Display enabled or disabled | Enabled | -|602| Boot | UEFI Boot Manager Page Display enabled or disabled | Enabled | - -*Table 2. Surface UEFI settings for Surface Book* - -| Setting ID | Setting Name | Description | Default Setting | -| --- | --- | --- | --- | -| 501 | Password | UEFI System Password | | -| 200 | Secure Boot Keys | Secure Boot signing keys to enable for EFI applications | MsPlus3rdParty | -| 300 | Trusted Platform Module (TPM) | TPM device enabled or disabled | Enabled | -| 301 | Docking USB Port | Docking USB Port enabled or disabled | Enabled | -| 302 | Front Camera | Front Camera enabled or disabled | Enabled | -| 303 | Bluetooth | Bluetooth radio enabled or disabled | Enabled | -| 304 | Rear Camera | Rear Camera enabled or disabled | Enabled | -| 305 | IR Camera | InfraRed Camera enabled or disabled | Enabled | -| 308 | Wi-Fi and Bluetooth | Wi-Fi and Bluetooth enabled or disabled | Enabled | -| 320 | On-board Audio | On-board audio enabled or disabled | Enabled | -| 400 | IPv6 for PXE Boot Enable | IPv6 PXE boot before IPv4 PXE boot | Disabled | -| 401 | Alternate Boot | Alternate Boot allows users to override the boot order by holding the volume down button when powering up the device | Enabled | -| 402 | Boot Order Lock | Boot Order variable lock enabled or disabled | Disabled | -| 403 | USB Boot | Enable booting from USB devices | Enabled | -| 500 | TPM clear EFI protocol | Enable EFI protocol for invoking TPM clear | Disabled | -| 600 | Security | UEFI Security Page Display enabled or disabled | Enabled | -| 601 | Devices | UEFI Devices Page Display enabled or disabled | Enabled | -| 602 | Boot | UEFI Boot Manager Page Display enabled or disabled | Enabled | - -## Deploy SEMM Configuration Manager scripts - -After your scripts are prepared to configure and enable SEMM on the client device, the next step is to add these scripts as an application in Configuration Manager. Before you open Configuration Manager, ensure that the following files are in a shared folder that does not include other files: - -* ConfigureSEMM.ps1 -* ResetSEMM.ps1 -* Your SEMM certificate (for example SEMMCertificate.pfx) - -The SEMM Configuration Manager scripts will be added to Configuration Manager as a script application. The command to install SEMM with ConfigureSEMM.ps1 is: - -`Powershell.exe -file ".\ConfigureSEMM.ps1"` - -The command to uninstall SEMM with ResetSEMM.ps1 is: - -`Powershell.exe -file ".\ResetSEMM.ps1"` - -To add the SEMM Configuration Manager scripts to Configuration Manager as an application, use the following process: - -1. Start the Create Application Wizard using Step 1 through Step 5 from the [Deploy Microsoft Surface UEFI Manager](#deploy-microsoft-surface-uefi-manager) section earlier in this article. - -2. Proceed through The Create Application Wizard as follows: - - - **General** – Select **Manually specify the application information**, and then click **Next**. - - - **General Information** – Enter a name for the application (for example SEMM) and any other information you want such as publisher, version, or comments on this page. Click **Next** to proceed. - - - **Application Catalog** – The fields on this page can be left with their default values. Click **Next**. - - - **Deployment Types** – Click **Add** to start the Create Deployment Type Wizard. - - - Proceed through the steps of the Create Deployment Type Wizard, as follows: - - * **General** – Click **Script Installer** from the **Type** drop-down menu. The **Manually specify the deployment type information** option will automatically be selected. Click **Next** to proceed. - * **General Information** – Enter a name for the deployment type (for example SEMM Configuration Scripts), and then click **Next** to continue. - * **Content** – Click **Browse** next to the **Content Location** field, and then click the folder where your SEMM Configuration Manager scripts are located. In the **Installation Program** field, type the [installation command](#deploy-semm-configuration-manager-scripts) found earlier in this article. In the **Uninstall Program** field, enter the [uninstallation command](#deploy-semm-configuration-manager-scripts) found earlier in this article (shown in Figure 2). Click **Next** to move to the next page. - - ![Set the SEMM Configuration Manager scripts as the install and uninstall commands](images/config-mgr-semm-fig2.png "Set the SEMM Configuration Manager scripts as the install and uninstall commands") - - *Figure 2. Set the SEMM Configuration Manager scripts as the install and uninstall commands* - - * **Detection Method** – Click **Add Clause** to add the SEMM Configuration Manager script registry key detection rule. The **Detection Rule** window is displayed, as shown in Figure 3. Use the following settings: - - - Click **Registry** from the **Setting Type** drop-down menu. - - Click **HKEY_LOCAL_MACHINE** from the **Hive** drop-down menu. - - Enter **SOFTWARE\Microsoft\Surface\SEMM** in the **Key** field. - - Enter **Enabled_Version1000** in the **Value** field. - - Click **String** from the **Data Type** drop-down menu. - - Click the **This registry setting must satisfy the following rule to indicate the presence of this application** button. - - Enter **1** in the **Value** field. - - Click **OK** to close the **Detection Rule** window. - - ![Use a registry key to identify devices enrolled in SEMM](images/config-mgr-semm-fig3.png "Use a registry key to identify devices enrolled in SEMM") - - *Figure 3. Use a registry key to identify devices enrolled in SEMM* - - * Click **Next** to proceed to the next page. - - * **User Experience** – Click **Install for system** from the **Installation Behavior** drop-down menu. If you want your users to record and enter the certificate thumbprint themselves, leave the logon requirement set to **Only when a user is logged on**. If you want your administrators to enter the thumbprint for users and the users do not need to see the thumbprint, click **Whether or not a user is logged on** from the **Logon Requirement** drop-down menu. - - * **Requirements** – The ConfigureSEMM.ps1 script automatically verifies that the device is a Surface device before attempting to enable SEMM. However, if you intend to deploy this script application to a collection with devices other than those to be managed with SEMM, you could add requirements here to ensure this application would run only on Surface devices or devices you intend to manage with SEMM. Click **Next** to continue. - - * **Dependencies** – Click **Add** to open the **Add Dependency** window. - - * Click **Add** to open the **Specify Required Application** window. - - - Enter a name for the SEMM dependencies in the **Dependency Group Name** field (for example, *SEMM Assemblies*). - - - Click **Microsoft Surface UEFI Manager** from the list of **Available Applications** and the MSI deployment type, and then click **OK** to close the **Specify Required Application** window. - - * Keep the **Auto Install** check box selected if you want Microsoft Surface UEFI Manager installed automatically on devices when you attempt to enable SEMM with the Configuration Manager scripts. Click **OK** to close the **Add Dependency** window. - - * Click **Next** to proceed. - - * **Summary** – The information you have entered throughout the Create Deployment Type wizard is displayed on this page. Click **Next** to confirm your selections. - - * **Progress** – A progress bar and status as the deployment type is added for the SEMM script application is displayed on this page. - - * **Completion** – Confirmation of the deployment type creation is displayed when the process is complete. Click **Close** to finish the Create Deployment Type Wizard. - - - **Summary** – The information that you entered throughout the Create Application Wizard is displayed. Click **Next** to create the application. - - - **Progress** – A progress bar and status as the application is added to the Software Library is displayed on this page. - - - **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Click **Close** to finish the Create Application Wizard. - -After the script application is available in the Software Library of Configuration Manager, you can distribute and deploy SEMM using the scripts you prepared to devices or collections. If you have configured the Microsoft Surface UEFI Manager assemblies as a dependency that will be automatically installed, you can deploy SEMM in a single step. If you have not configured the assemblies as a dependency, they must be installed on the devices you intend to manage before you enable SEMM. - -When you deploy SEMM using this script application and with a configuration that is visible to the end user, the PowerShell script will start and the thumbprint for the certificate will be displayed by the PowerShell window. You can have your users record this thumbprint and enter it when prompted by Surface UEFI after the device reboots. - -Alternatively, you can configure the application installation to reboot automatically and to install invisibly to the user – in this scenario, a technician will be required to enter the thumbprint on each device as it reboots. Any technician with access to the certificate file can read the thumbprint by viewing the certificate with CertMgr. Instructions for viewing the thumbprint with CertMgr are in the [Create or modify the SEMM Configuration Manager scripts](#create-or-modify-the-semm-configuration-manager-scripts) section of this article. - -Removal of SEMM from a device deployed with Configuration Manager using these scripts is as easy as uninstalling the application with Configuration Manager. This action starts the ResetSEMM.ps1 script and properly unenrolls the device with the same certificate file that was used during the deployment of SEMM. - -> [!NOTE] -> Microsoft Surface recommends that you create reset packages only when you need to unenroll a device. These reset packages are typically valid for only one device, identified by its serial number. You can, however, create a universal reset package that would work for any device enrolled in SEMM with this certificate. -> -> We strongly recommend that you protect your universal reset package as carefully as the certificate you used to enroll devices in SEMM. Please remember that – just like the certificate itself – this universal reset package can be used to unenroll any of your organization’s Surface devices from SEMM. -> -> When you install a reset package, the Lowest Supported Value (LSV) is reset to a value of 1. You can reenroll a device by using an existing configuration package – the device will prompt for the certificate thumbprint before ownership is taken. -> -> For this reason, the reenrollment of a device in SEMM would require a new package to be created and installed on that device. Because this action is a new enrollment and not a change in configuration on a device already enrolled in SEMM, the device will prompt for the certificate thumbprint before ownership is taken. diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md deleted file mode 100644 index 52e96859b3..0000000000 --- a/devices/surface/using-the-sda-deployment-share.md +++ /dev/null @@ -1,168 +0,0 @@ ---- -title: Using the Microsoft Surface Deployment Accelerator deployment share (Surface) -description: Explore the scenarios where you can use SDA to meet the deployment needs of your organization including Proof of Concept, pilot deployment, as well as import additional drivers and applications. -keywords: deploy, install, automate, deployment solution -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 10/16/2017 -ms.reviewer: -manager: dansimp ---- - -# Using the Microsoft Surface Deployment Accelerator deployment share - -With Microsoft Surface Deployment Accelerator (SDA), you can quickly and easily set up a deployment solution that is ready to deploy Windows to Surface devices. The prepared environment is built on powerful deployment technologies available from Microsoft, such as the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741), and is capable of immediately performing a deployment after configuration. See [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) for a comprehensive walkthrough of using the SDA wizard to set up a deployment share and perform a deployment. - -For more information about SDA and information on how to download SDA, see [Microsoft Surface Deployment Accelerator (SDA)](https://technet.microsoft.com/itpro/surface/microsoft-surface-deployment-accelerator). - -Using SDA provides these primary benefits: - -* With SDA, you can create a ready-to-deploy environment that can deploy to target devices as fast as your download speeds allow. The wizard experience enables you to check a few boxes and then the automated process builds your deployment environment for you. - -* With SDA, you prepare a deployment environment built on the industry leading deployment solution of MDT. With MDT you can scale from a relatively basic deployment of a few Surface devices to a solution capable of deploying to thousands of devices including all of the different makes and models in your organization and all of the applications required by each device and user. - -This article explores four scenarios where you can use SDA to meet the needs of your organization. See [Deploy Windows 10](https://technet.microsoft.com/itpro/windows/deploy/index) to explore the capabilities of MDT and the Windows deployment technologies available from Microsoft in greater detail. - -## Perform a Proof of Concept deployment - -One of the primary scenarios for use of SDA is as a Proof of Concept. A *Proof of Concept* (PoC) enables you to test or evaluate the capabilities of a solution or technology. A PoC is often used to illustrate the benefits of the solution or technology to decision makers. For example, if you want to recommend Surface devices as a replacement of older point of sale (POS) systems, you could perform a PoC to demonstrate how Surface devices provide superior computing power, flexibility, and connectivity when compared to alternate options. - -Using SDA to prepare a PoC of Surface devices enables you to very quickly prepare a demonstration of Surface device or devices, which gives you more time for customization or preparation. The flexibility of SDA even lets you import resources, like applications and drivers, from existing MDT deployment infrastructure. See the [Work with existing deployment shares](#work-with-existing-deployment-shares) section later in this article for more information. - -SDA is also an excellent PoC of the capabilities of MDT. SDA demonstrates just how quickly an MDT deployment environment can be prepared and made ready for deployment to devices. It also shows just how flexible and customizable the MDT solution can be, with support for Windows 10 and Windows 8.1, for Microsoft Store and desktop applications, and several models of Surface devices. - -Some recommendations for a successful PoC with SDA are: - -* Keep your SDA deployment environment separate from your production network. This ensures optimal performance and reduces potential for conflicts during your PoC deployment. - -* Use a fresh and updated instance of Windows Server to house your SDA deployment share to maintain the simplicity and performance of the demonstration environment. - -* Test the deployment process before you demonstrate your PoC. This reduces the potential for unexpected situations and keeps the demonstration focused on the deployment process and Surface devices. - -* Use offline files with SDA to further reduce installation times. - -* For help with your PoC, contact [Surface Support](https://www.microsoft.com/surface/support/contact-us-business). - -## Perform a pilot deployment - -A pilot deployment differs from a PoC. Where a PoC is usually a closed demonstration that is performed prior to the deployment process in order to get approval for the use of certain technologies or solutions, a *pilot deployment* is performed during the deployment process as a limited scope deployment for testing and validation. The focus of a pilot deployment can be as narrow as only a handful of devices, or wide enough to include a significant portion of your organization. - ->[!NOTE] ->A pilot deployment should not replace the testing process that should be performed regularly in the lab as the deployment environment is built and developed. A deployment solution should be tested in virtual and physical environments as new applications and drivers are added and when task sequences are modified and before a pilot deployment is performed. - -For example, you are tasked with deploying Surface devices to mobile workers and you want to test the organization’s MDT deployment process by providing a small number of devices to executives. You can use SDA to create an isolated Surface deployment environment and then copy the task sequence, applications, and drivers needed from the production deployment share. This not only enables you to quickly create a Surface deployment, but it also minimizes the risk to the production deployment process used for other types of devices. - -For small organizations, the pilot deployment environment of SDA may suffice as a complete deployment solution. Even if you do not have an existing deployment environment, you can import drivers and applications (covered later in this article) to provide a complete deployment solution based on MDT. Even without previous knowledge of MDT or Windows deployment, you can follow the [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) article to get started with a deployment to Surface devices. - -## Import additional drivers - -The SDA deployment share includes all of the drivers needed for Surface devices. This includes the drivers for the components inside the Surface device, such as the wireless network adapter and the main chipset, as well as drivers for Surface accessories, such as the Surface Dock or Surface USB Ethernet adapters. The SDA deployment share does not, however, include drivers for third-party devices or peripherals. - -For example, you may intend to use your Surface device with a thermal printer, credit card reader, and barcode scanner as a POS terminal. In this scenario, the thermal printer, credit card reader, and barcode scanner will very likely require installation of drivers to operate properly. You could potentially download and install these drivers from Windows Update when each peripheral is connected, or you could install the driver package from the manufacturer manually on each Surface device, but the ideal solution is to have these drivers already present in Windows so that when the peripheral is connected, it will just work. - -Because SDA is built on MDT, adding the drivers to the SDA deployment share is easy and simple. - ->[!NOTE] ->The drivers must be in the Setup Information File (.inf) format. If the drivers for your device come as an executable file (.exe), they may need to be extracted or installed to procure the .inf file. Some device drivers come packaged with applications, for example an all-in-one printer bundled with scan software. These applications will need to be installed separately from the drivers. - -To import drivers for a peripheral device: - -1. Download the drivers for your device from the manufacturer web site. - -2. Open the MDT Deployment Workbench. - -3. Expand the **Deployment Shares** node and expand the SDA deployment share. - -4. Expand the **Out-of-Box Drivers** folder. - -5. Select the folder of the Surface model for which you would like to include this driver. - -6. Click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1. - - ![Provide the location of your driver files](images/using-sda-driverfiles-fig1.png "Provide the location of your driver files") - - *Figure 1. Provide the location of your driver files* - -7. The Import Drivers Wizard presents a series of steps: - - - **Specify Directory** – Click **Browse** and navigate to the folder where you stored the drivers in Step 1. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - - **Progress** – While the drivers are imported, a progress bar is displayed on this page. - - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard. - -8. Repeat Steps 5-7 for each Surface model on which you would like to include this driver. - -9. Close the Deployment Workbench. - -After the drivers are imported for the Surface model, the deployment task sequence will automatically select the drivers during the deployment process and include them in the Windows environment. When you connect your device, such as the barcode scanner in the example, Windows should automatically detect the device and you should be able to use it immediately. - ->[!NOTE] ->You can even import drivers for other computer makes and models to support other devices. See **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt) for more information about how to import drivers for other makes and models. - -## Import additional applications - -As with drivers, the SDA deployment share can be pre-configured with apps like the Surface App and Microsoft Office 365. You can also add applications to the SDA deployment share and configure them to be installed on your Surface devices during deployment of Windows. In the ideal scenario, your Surface devices deployed with the SDA deployment share will include all of the applications needed to be ready for your end users. - -In the previous example for including drivers for a POS system, you would also need to include POS software for processing transactions and recording the input from the barcode scanner and credit card reader. To import an application and prepare it for installation on your Surface devices during Windows deployment: - -1. Download the application installation files or locate the installation media for your application. - -2. Determine the command line instruction for silent installation, usually provided by the developer of the application. For Windows Installer files (.msi), see [Standard Installer Command-Line Options](https://msdn.microsoft.com/library/windows/desktop/aa372024) in the Windows Dev Center. - -3. Open the MDT Deployment Workbench. - -4. Expand the **Deployment Shares** node and expand the SDA deployment share. - -5. Expand the **Applications** folder. - -6. Click **New Application** to start the New Application Wizard, as shown in Figure 2. - - ![Provide the command to install your application](images/using-sda-installcommand-fig2.png "Provide the command to install your application") - - *Figure 2: Provide the command to install your application* - -7. Follow the steps of the New Application Wizard: - - - **Application Type** – Click **Application with Source Files**, and then click **Next**. - - **Details** – Enter a name for the application in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**. - - **Source** – Click **Browse** to navigate to and select the folder with the application installation files procured in Step 1, and then click **Next**. - - **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name. - - **Command Details** – Enter the silent command-line instruction, for example `setup.msi /quiet /norestart` - - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - - **Progress** – While the installation files are imported, a progress bar is displayed on this page. - - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard. - -8. Click the **Task Sequences** folder, right-click **1 - Deploy Microsoft Surface**, and then click **Properties**. - -9. Click the **Task Sequence** tab to view the steps that are included in the new task sequence. - -10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**. - -11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. - - ![A new Install Application step for Sample POS App](images/using-sda-newinstall-fig3.png "A new Install Application step for Sample POS App") - - *Figure 3. A new Install Application step for Sample POS App* - -12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app. - -13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. - -14. Select your app from the list of applications, and then click **OK**. - -15. Click **OK** to close the task sequence properties. - -16. Close the Deployment Workbench. - -## Work with existing deployment shares - -One of the many benefits of an MDT deployment share is the simplicity of how deployment resources are stored. The MDT deployment share is, at its core, just a standard network file share. All deployment resources, such as Windows images, application installation files, and drivers, are stored in a share that can be browsed with File Explorer, copied and pasted, and moved just like any other file share, provided that you have the necessary permissions. This makes working with deployment resources extremely easy. MDT even allows you to make it easier by allowing you to open multiple deployment shares from the Deployment Workbench and to transfer or copy resources between them. - -This ability gives SDA some extra capabilities when used in an environment with an existing MDT infrastructure. For example, if you install SDA on an isolated server to prepare a PoC and then log on to your production MDT deployment share from the Deployment Workbench on your SDA server, you can copy applications, drivers, task sequences, and other components into the SDA deployment share that is prepared with Surface apps and drivers. With this process, in a very short amount time, you can have a deployment environment ready to deploy your organization’s precise requirements to Surface devices. - -You can also use this capability in reverse. For example, you can copy the Surface drivers, deployment task sequences, and apps directly into a lab or testing environment following a successful PoC. Using these resources, you can immediately begin to integrate Surface deployment into your existing deployment infrastructure. diff --git a/devices/surface/wake-on-lan-for-surface-devices.md b/devices/surface/wake-on-lan-for-surface-devices.md deleted file mode 100644 index ddc39aa7c2..0000000000 --- a/devices/surface/wake-on-lan-for-surface-devices.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Wake On LAN for Surface devices (Surface) -description: See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically – even if the devices are powered down. -keywords: update, deploy, driver, wol, wake-on-lan -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/03/2018 -ms.reviewer: -manager: dansimp ---- - -# Wake On LAN for Surface devices - -Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anniversary Update) or later and use a Surface Ethernet adapter to connect to a wired network, are capable of Wake On LAN (WOL) from Connected Standby. With WOL, you can remotely wake up devices to perform management or maintenance tasks or enable management solutions (such as System Center Configuration Manager) automatically. For example, you can deploy applications to Surface devices left docked with a Surface Dock or Surface Pro 3 Docking Station by using System Center Configuration Manager during a window in the middle of the night, when the office is empty. - ->[!NOTE] ->Surface devices must be connected to AC power and in Connected Standby (Sleep) to support WOL. WOL is not possible from devices that are in hibernation or powered off. - -## Supported devices - -The following devices are supported for WOL: - -* Surface Ethernet adapter -* Surface USB-C to Ethernet and USB Adapter -* Surface Dock -* Surface Docking Station for Surface Pro 3 -* Surface 3 -* Surface Pro 3 -* Surface Pro 4 -* Surface Pro (5th Gen) -* Surface Pro (5th Gen) with LTE Advanced -* Surface Book -* Surface Laptop (1st Gen) -* Surface Pro 6 -* Surface Book 2 -* Surface Laptop 2 -* Surface Go -* Surface Go with LTE Advanced - -## WOL driver - -To enable WOL support on Surface devices, a specific driver for the Surface Ethernet adapter is required. This driver is not included in the standard driver and firmware pack for Surface devices – you must download and install it separately. You can download the Surface WOL driver (SurfaceWOL.msi) from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. - -You can run this Microsoft Windows Installer (.msi) file on a Surface device to install the Surface WOL driver, or you can distribute it to Surface devices with an application deployment solution, such as System Center Configuration Manager. To include the Surface WOL driver during deployment, you can install the .msi file as an application during the deployment process. You can also extract the Surface WOL driver files to include them in the deployment process. For example, you can include them in your Microsoft Deployment Toolkit (MDT) deployment share. You can read more about Surface deployment with MDT in [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/deploy-windows-10-to-surface-devices-with-mdt). - -> [!NOTE] -> During the installation of SurfaceWOL.msi, the following registry key is set to a value of 1, which allows easy identification of systems where the WOL driver has been installed. If you chose to extract and install these drivers separately during deployment, this registry key will not be configured and must be configured manually or with a script. -> -> **HKLM\SYSTEM\CurrentControlSet\Control\Power AllowSystemRequiredPowerRequests** - -To extract the contents of SurfaceWOL.msi, use the MSIExec administrative installation option (**/a**), as shown in the following example, to extract the contents to the C:\WOL\ folder: - - `msiexec /a surfacewol.msi targetdir=C:\WOL /qn` - -## Using Surface WOL - -The Surface WOL driver conforms to the WOL standard, whereby the device is woken by a special network communication known as a magic packet. The magic packet consists of 6 bytes of 255 (or FF in hexadecimal) followed by 16 repetitions of the target computer’s MAC address. You can read more about the magic packet and the WOL standard on [Wikipedia](https://wikipedia.org/wiki/Wake-on-LAN#Magic_packet). - ->[!NOTE] ->To send a magic packet and wake up a device by using WOL, you must know the MAC address of the target device and Ethernet adapter. Because the magic packet does not use the IP network protocol, it is not possible to use the IP address or DNS name of the device. - -Many management solutions, such as System Center Configuration Manager, provide built-in support for WOL. There are also many solutions, including Microsoft Store apps, PowerShell modules, third-party applications, and third-party management solutions that allow you to send a magic packet to wake up a device. For example, you can use the [Wake On LAN PowerShell module](https://gallery.technet.microsoft.com/scriptcenter/Wake-On-Lan-815424c4) from the TechNet Script Center. - ->[!NOTE] ->After a device has been woken up with a magic packet, the device will return to sleep if an application is not actively preventing sleep on the system or if the AllowSystemRequiredPowerRequests registry key is not configured to 1, which allows applications to prevent sleep. See the [WOL driver](#wol-driver) section of this article for more information about this registry key. diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md deleted file mode 100644 index 8134359845..0000000000 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Windows Autopilot and Surface Devices (Surface) -ms.reviewer: -manager: dansimp -description: Find out about Windows Autopilot deployment options for Surface devices. -keywords: autopilot, windows 10, surface, deployment -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article ---- - -# Windows Autopilot and Surface devices - -Windows Autopilot is a cloud-based deployment technology available in Windows 10. Using Windows Autopilot, you can remotely deploy and configure devices in a truly zero-touch process right out of the box. Windows Autopilot registered devices are identified over the internet at first boot using a unique device signature, known as the hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM). - -With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution. - -In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library. - -## Prerequisites -Enrollment of Surface devices in Windows Autopilot with a Surface partner enabled for Windows Autopilot has the following licensing requirements for each enrolled Surface device: -* **Azure Active Directory Premium** – Required to enroll your devices in your organization and to automatically enroll devices in your organization’s mobile management solution. -* **Mobile Device Management (such as Microsoft Intune)** – Required to remotely deploy applications, configure, and manage your enrolled devices. -* **Office 365 ProPlus** – Required to deploy Microsoft Office to your enrolled devices. - -These requirements are also met by the following solutions: -* Microsoft 365 E3 or E5 (includes Azure Active Directory Premium, Microsoft Intune, and Office 365 ProPlus) - -Or -* Enterprise Mobility + Security E3 or E5 (includes Azure Active Directory Premium and Microsoft Intune) -* Office 365 ProPlus, E3, or E5 (includes Office 365 ProPlus) - ->[!NOTE] ->Deployment of devices using Windows Autopilot to complete the Out-of-Box Experience (OOBE) is supported without these prerequisites, however will yield deployed devices without applications, configuration, or enrollment in a management solution and is highly discouraged. - -### Windows version considerations -Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update). Windows 10 Version 1709 uses a secure 4096-bit (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale. - -### Surface device support -Surface devices with support for out-of-box deployment with Windows Autopilot, enrolled during the purchase process with a Surface partner, include the following devices, where the devices ship from the factory with Windows 10 Version 1709: - -* Surface Pro (5th gen) -* Surface Laptop(1st gen) -* Surface Studio (1st gen) -* Surface Pro 6 -* Surface Book 2 -* Surface Laptop 2 -* Surface Studio 2 -* Surface Go -* Surface Go with LTE Advanced - -## Surface partners enabled for Windows Autopilot -Enrolling Surface devices in Windows Autopilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows Autopilot, Azure Active Directory, and Mobile Device Management. - -When you purchase Surface devices from a Surface partner enabled for Windows Autopilot, your new devices can be enrolled in your Windows Autopilot deployment for you by the partner. Surface partners enabled for Windows Autopilot include: - -- [Atea](https://www.atea.com/) -- [Connection](https://www.connection.com/brand/microsoft/microsoft-surface) -- [Insight](https://www.insight.com/en_US/buy/partner/microsoft/surface/windows-autopilot.html) -- [SHI](https://www.shi.com/Surface) - - diff --git a/education/developers.yml b/education/developers.yml new file mode 100644 index 0000000000..6533d8c51c --- /dev/null +++ b/education/developers.yml @@ -0,0 +1,33 @@ +### YamlMime:Hub + +title: Microsoft 365 Education Documentation for developers +summary: Are you an app developer looking for information about developing solutions on Microsoft Education products? Start here. + +metadata: + title: Microsoft 365 Education Documentation for developers + description: Are you an app developer looking for information about developing solutions on Microsoft Education products? Start here. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +additionalContent: + sections: + - items: + # Card + - title: UWP apps for education + summary: Learn how to write universal apps for education. + url: https://docs.microsoft.com/windows/uwp/apps-for-education/ + # Card + - title: Take a test API + summary: Learn how web applications can use the API to provide a locked down experience for taking tests. + url: https://docs.microsoft.com/windows/uwp/apps-for-education/take-a-test-api + # Card + - title: Office Education Dev center + summary: Integrate with Office 365 across devices and services to extend Microsoft enterprise-scale compliance and security to students, teachers, and staff in your education app + url: https://developer.microsoft.com/office/edu + # Card + - title: Data Streamer + summary: Bring new STEM experiences into the classroom with real-time data in Excel using Data Streamer. Data Streamer can send data to Excel from a sensor or application. + url: https://docs.microsoft.com/microsoft-365/education/data-streamer diff --git a/education/docfx.json b/education/docfx.json index 2f691e4f77..8ba1394c6d 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -7,7 +7,8 @@ "**/**.yml" ], "exclude": [ - "**/obj/**" + "**/obj/**", + "**/includes/**" ] } ], @@ -19,7 +20,8 @@ "**/*.svg" ], "exclude": [ - "**/obj/**" + "**/obj/**", + "**/includes/**" ] } ], @@ -28,22 +30,32 @@ "audience": "windows-education", "ms.topic": "article", "ms.technology": "windows", + "manager": "laurawi", "audience": "ITPro", "breadcrumb_path": "/education/breadcrumb/toc.json", "ms.date": "05/09/2017", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.education", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ] }, "externalReference": [], "template": "op.html", "dest": "education", "markdownEngineName": "markdig" - } +} } diff --git a/education/get-started/TOC.md b/education/get-started/TOC.md deleted file mode 100644 index 20de4cd93d..0000000000 --- a/education/get-started/TOC.md +++ /dev/null @@ -1,10 +0,0 @@ -# [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) -## [Set up an Office 365 education tenant](set-up-office365-edu-tenant.md) -## [Use School Data Sync to import student data](use-school-data-sync.md) -## [Configure Microsoft Store for Education](configure-microsoft-store-for-education.md) -## [Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md) -## [Set up Windows 10 education devices](set-up-windows-10-education-devices.md) -### [Set up Windows 10 devices using Windows OOBE](set-up-windows-education-devices.md) -## [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md) -# [Change history for Microsoft Education Get Started](change-history-ms-edu-get-started.md) - diff --git a/education/get-started/change-history-ms-edu-get-started.md b/education/get-started/change-history-ms-edu-get-started.md deleted file mode 100644 index 5273dbe9ce..0000000000 --- a/education/get-started/change-history-ms-edu-get-started.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Change history for Microsoft Education Get Started -description: New and changed topics in the Microsoft Education get started guide. -keywords: Microsoft Education get started guide, IT admin, IT pro, school, education, change history -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 07/07/2017 -ms.reviewer: -manager: dansimp ---- - -# Change history for Microsoft Education Get Started - -This topic lists the changes in the Microsoft Education IT admin get started. - -## July 2017 - -| New or changed topic | Description | -| --- | ---- | -| [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) | Broke up the get started guide to highlight each phase in the Microsoft Education deployment and management process. | -| [Set up an Office 365 Education tenant](set-up-office365-edu-tenant.md) | New. Shows the video and step-by-step guide on how to set up an Office 365 for Education tenant. | -| [Use School Data Sync to import student data](use-school-data-sync.md) | New. Shows the video and step-by-step guide on School Data Sync and sample CSV files to import student data in a trial environment. | -| [Enable Microsoft Teams for your school](enable-microsoft-teams.md) | New. Shows how IT admins can enable and deploy Microsoft Teams in schools. | -| [Configure Microsoft Store for Education](configure-microsoft-store-for-education.md) | New. Shows the video and step-by-step guide on how to accept the services agreement and ensure your Microsoft Store account is associated with Intune for Education. | -| [Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md) | New. Shows the video and step-by-step guide on how to set up Intune for Education, buy apps from the Microsoft Store for Education, and install the apps for all users in your tenant. | -| [Set up Windows 10 education devices](set-up-windows-10-education-devices.md) | New. Shows options available to you when you need to set up new Windows 10 devices and enroll them to your education tenant. Each option contains a video and step-by-step guide. | -| [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md) | New. Shows the video and step-by-step guide on how to finish preparing your Windows 10 devices for use in the classroom. | - - -## June 2017 - -| New or changed topic | Description | -| --- | ---- | -| [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) | Includes the following updates:

          - New configuration guidance for IT administrators to deploy Microsoft Teams.
          - Updated steps for School Data Sync to show the latest workflow and user experience.
          - Updated steps for Option 2: Try out Microsoft Education in a trial environment. You no longer need the SDS promo code to try SDS in a trial environment. | - -## May 2017 - -| New or changed topic | Description | -| --- | ---- | -| [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) | New. Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. | diff --git a/education/get-started/configure-microsoft-store-for-education.md b/education/get-started/configure-microsoft-store-for-education.md deleted file mode 100644 index 3047fe8d8d..0000000000 --- a/education/get-started/configure-microsoft-store-for-education.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Configure Microsoft Store for Education -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 08/29/2017 -ms.reviewer: -manager: dansimp ---- - -# Configure Microsoft Store for Education - -> [!div class="step-by-step"] -> [<< Use School Data Sync to import student data](use-school-data-sync.md) -> [Use Intune for Education to manage groups, apps, and settings >>](use-intune-for-education.md) - -You'll need to configure Microsoft Store for Education to accept the services agreement and make sure your Microsoft Store account is associated with Intune for Education. - -You can watch the video to see how this is done, or follow the step-by-step guide.
          - -> [!VIDEO https://www.youtube.com/embed/Jnbssq0gC_g] - -You can watch the descriptive audio version here: [Microsoft Education: Configure Microsoft Store for Education (DA)](https://www.youtube.com/watch?v=bStgEpHbEXw) - -## Associate your Microsoft Store account with Intune for Education - -1. Sign in to Microsoft Store for Education. -2. Accept the Microsoft Store for Business and Education Services Agreement. - - This will take you to the Microsoft Store for Education portal. - - **Figure 1** - Microsoft Store for Education portal - - ![Microsoft Store for Education portal](images/msfe_store_portal.png) - -3. In the Microsoft Store portal, click **Manage** to go to the Microsoft Store **Overview** page. -4. Find the **Overview** page, find the **Store settings** tile and click **Management tools**. - - **Figure 2** - Select management tools from the list of Store settings options - - ![Select management tools from list of Store settings options](images/msfe_storesettings_select_managementtools.png) - -5. In the **Management tools** page, find **Microsoft Intune** on the list and click **Activate** to get Intune for Education ready for use with Microsoft Store for Education. - - **Figure 3** - Activate Intune for Education as the management tool - - ![Activate Intune for Education as the management tool](images/msfe_managementtools_activateintune.png) - -Your Microsoft Store for Education account is now linked to Intune for Education so let's set that up next. - -> [!div class="step-by-step"] -> [<< Use School Data Sync to import student data](use-school-data-sync.md) -> [Use Intune for Education to manage groups, apps, and settings >>](use-intune-for-education.md) - - -## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) diff --git a/education/get-started/enable-microsoft-teams.md b/education/get-started/enable-microsoft-teams.md deleted file mode 100644 index 986a6c4af0..0000000000 --- a/education/get-started/enable-microsoft-teams.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Enable Microsoft Teams for your school -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 07/28/2017 -ms.reviewer: -manager: dansimp ---- - -# Enable Microsoft Teams for your school - -Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. Because it's built on Office 365, schools benefit from integration with their familiar Office apps and services. Your institution can use Microsoft Teams to create collaborative classrooms, connect in professional learning communities, and communicate with school staff all from a single experience in Office 365 for Education. - -To get started, IT administrators need to use the Microsoft 365 Admin Center to enable Microsoft Teams for your school. - -## Enable Microsoft Teams for your school - -1. Sign in to Office 365 with your work or school account. -2. Click **Admin** to go to the admin center. -3. Go to **Settings > Services & add-ins**. -4. On the **Services & add-ins** page, select **Microsoft Teams**. - - **Figure 1** - Select Microsoft Teams from the list of services & add-ins - - ![Enable Microsoft Teams for your school](images/o365_settings_services_msteams.png) - -5. On the Microsoft Teams settings screen, select the license that you want to configure, **Student** or **Faculty and Staff**. Select **Faculty and Staff**. - - **Figure 2** - Select the license that you want to configure - - ![Select the Microsoft Teams license that you want to configure](images/o365_msteams_settings.png) - -6. After you select the license type, set the toggle to turn on Microsoft Teams for your organization. - - **Figure 3** - Turn on Microsoft Teams for your organization - - ![Turn on Microsoft Teams for your organization](images/o365_msteams_turnon.png) - -7. Click **Save**. - -You can find more info about how to control which users in your school can use Microsoft Teams, turn off group creation, configure tenant-level settings, and more by reading the *Guide for IT admins* getting started guide in the Meet Microsoft Teams page. - - -> [!div class="step-by-step"] -> [<< Use School Data Sync to import student data](use-school-data-sync.md) -> [Configure Microsoft Store for Education >>](configure-microsoft-store-for-education.md) - - -## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) diff --git a/education/get-started/finish-setup-and-other-tasks.md b/education/get-started/finish-setup-and-other-tasks.md deleted file mode 100644 index 8633a400ed..0000000000 --- a/education/get-started/finish-setup-and-other-tasks.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: Finish Windows 10 device setup and other tasks -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 10/09/2017 -ms.reviewer: -manager: dansimp ---- - -# Finish Windows 10 device setup and other tasks - -> [!div class="step-by-step"] -> [<< Set up Windows 10 education devices](set-up-windows-10-education-devices.md) - -Once you've set up your Windows 10 education device, it's worth checking to verify the following: - -> [!div class="checklist"] -> * Correct device setup -> * Device is Azure AD joined - -You can watch the video to see how this is done, or follow the step-by-step guide.
          - -> [!VIDEO https://www.youtube.com/embed/nhQ_4okWFmk] - -You can watch the descriptive audio version here: [Microsoft Education: Verify Windows 10 education devices are Azure AD joined and managed (DA)](https://www.youtube.com/watch?v=_hVIxaEsu2Y) - -## Verify correct device setup -Verify that the device is set up correctly and boots without any issues. - -**Verify that the device was set up correctly** -1. Confirm that the Start menu contains a simple configuration. -2. Confirm that the Store and built-in apps are installed and working. The apps pushed down from Intune for Education will appear under **Recently added**. - - > [!NOTE] - > It may take some time before some apps are pushed down to your device from Intune for Education. Check again later if you don't see some of the apps you provisioned for the user. - - **Figure 1** - Sample list of apps for a user - - ![Apps list contains the apps provisioned for the user](images/win10_start_checkapps.png) - -## Verify the device is Azure AD joined -Let's now verify that the device is joined to your organization's Azure AD and shows up as being managed in Microsoft Intune for Education. - -**Verify if the device is joined to Azure AD** -1. Log in to the Intune for Education console. -2. Select **Groups** and select **All Devices**. -3. In the **All Devices** page, see the list of devices and verify that the device you're signed into appears on the list. - - **Figure 2** - List of all managed devices - - ![Verify that the device is managed in Intune for Education](images/i4e_groups_alldevices_listofaadjdevices.png) - -4. On the Windows 10 education device, click **Start** and go to **Settings**. -5. Select **Accounts > Access work or school**. -6. In the **Access work or school** page, confirm that the device is connected to the organization's Azure AD. - - **Figure 3** - Confirm that the Windows 10 device is joined to Azure AD - - ![Confirm that the Windows 10 device is joined to Azure AD](images/win10_confirmaadj.png) - -**That's it! You're done!** You've completed basic cloud setup, deployment, and management using Microsoft Education. - -You can follow the rest of the walkthrough to finish setup and complete other tasks, such as: - -> [!div class="checklist"] -> * Update group settings in Intune for Education -> * Configure Azure settings -> * Complete Office 365 for Education setup -> * Enable Microsoft teams for your school -> * Add more users -> * Connect other devices, like BYOD devices, to your cloud infrastructure - -You can watch the following video to see how to update group settings in Intune for Education and configure Azure settings. Or, you can follow the step-by-step guide for these tasks and the other tasks listed above. - -> [!VIDEO https://www.youtube.com/embed/M6-k73dZOfw] - -You can watch the descriptive audio version here: [Microsoft Education: Update settings, apps, and Azure AD settings for your education tenant (DA)](https://www.youtube.com/watch?v=-Rz3VcDXbzs) - -## Update group settings in Intune for Education -If you need to make changes or updates to any of the apps or settings for the group(s), follow these steps. - -1. Log in to the Intune for Education console. -2. Click **Groups** and then choose **Settings** in the taskbar at the top of the page. -3. You will see the same settings groups that you saw in express setup for Intune for Education as well as other settings categories such as **Windows Defender settings**, **Device sharing**, **Edition upgrade**, and so on. - - **Figure 4** - See the list of available settings in Intune for Education - - ![See the list of available settings in Intune for Education](images/i4e_groups_settingslist_full.png) - -4. Keep the default settings or configure the settings according to your school's policies. - - For example, you can configure the diagnostic data sent to Microsoft in **Basic device settings > Send diagnostic data**. - -5. Click **Save** or **Discard changes**. - -## Configure Azure settings -After completing the basic setup for your cloud infrastructure and confirming that it is up and running, it's time to prepare for additional devices to be added and enable capabilities for the user to use. - -### Enable many devices to be added by a single person -When a device is owned by the school, you may need to have a single person adding many devices to your cloud infrastructure. - -Follow the steps in this section to enable a single person to add many devices to your cloud infrastructure. - -1. Sign in to the admin center. -2. Configure the device settings for the school's Active Directory. To do this, go to the new Azure portal, https://portal.azure.com. -3. Select **Azure Active Directory > Users and groups > Device settings**. - - **Figure 5** - Device settings in the new Azure portal - - ![Configure device settings in the new Azure portal](images/azure_newportal_usersandgroups_devicesettings.png) - -4. Find the setting **Maximum number of devices per user** and change the value to **Unlimited**. -5. Click **Save** to update device settings. - -### Enable roaming settings for users -When students move from using one device to another, they may need to have their settings roam with them and be made available on other devices. - -Follow the steps in this section to ensure that settings for the each user follow them when they move from one device to another. - -1. Sign in to the admin center. -2. Go to the new Azure portal, https://portal.azure.com. -3. Select **Azure Active Directory > Users and groups > Device settings**. -4. Find the setting **Users may sync settings and enterprise app data** and change the value to **All**. - - **Figure 6** - Enable settings to roam with users - - ![Enable settings to roam with users](images/azure_usersandgroups_devicesettings_ers.png) - -5. Click **Save** to update device settings. - -## Complete Office 365 for Education setup -Now that your basic cloud infrastructure is up and running, it's time to complete the rest of the Office 365 for Education setup. You can find detailed information about completing Office 365 setup, services and applications, troubleshooting, and more by reading the Office 365 admin documentation. - -## Enable Microsoft Teams for your school -Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. Because it's built on Office 365, schools benefit from integration with their familiar Office apps and services. Your institution can use Microsoft Teams to create collaborative classrooms, connect in professional learning communities, and communicate with school staff all from a single experience in Office 365 for Education. - -To get started, IT administrators need to use the Microsoft 365 Admin Center to enable Microsoft Teams for your school. - -**To enable Microsoft Teams for your school** - -1. Sign in to Office 365 with your work or school account. -2. Click **Admin** to go to the admin center. -3. Go to **Settings > Services & add-ins**. -4. On the **Services & add-ins** page, select **Microsoft Teams**. - - **Figure 1** - Select Microsoft Teams from the list of services & add-ins - - ![Enable Microsoft Teams for your school](images/o365_settings_services_msteams.png) - -5. On the Microsoft Teams settings screen, select the license that you want to configure, **Student** or **Faculty and Staff**. Select **Faculty and Staff**. - - **Figure 2** - Select the license that you want to configure - - ![Select the Microsoft Teams license that you want to configure](images/o365_msteams_settings.png) - -6. After you select the license type, set the toggle to turn on Microsoft Teams for your organization. - - **Figure 3** - Turn on Microsoft Teams for your organization - - ![Turn on Microsoft Teams for your organization](images/o365_msteams_turnon.png) - -7. Click **Save**. - -You can find more info about how to control which users in your school can use Microsoft Teams, turn off group creation, configure tenant-level settings, and more by reading the *Guide for IT admins* getting started guide in the Meet Microsoft Teams page. - -## Add more users -After your cloud infrastructure is set up and you have a device management strategy in place, you may need to add more users and you want the same policies to apply to these users. You can add new users to your tenant simply by adding them to the Office 365 groups. Adding new users to Office 365 groups automatically adds them to the corresponding groups in Intune for Education. - -See Add users to Office 365 to learn more. Once you're done adding new users, go to the Intune for Education console and verify that the same users were added to the Intune for Education groups as well. - -## Connect other devices to your cloud infrastructure -Adding a new device to your cloud-based tenant is easy. For new devices, you can follow the steps in [Set up Windows 10 education devices](set-up-windows-10-education-devices.md). For other devices, such as those personally-owned by teachers who need to connect to the school network to access work or school resources (BYOD), you can follow the steps in this section to get these devices connected. - - > [!NOTE] - > These steps enable users to get access to the organization's resources, but it also gives the organization some control over the device. - -**To connect a personal device to your work or school** - -1. On your Windows device, go to **Settings > Accounts**. -2. Select **Access work or school** and then click **Connect** in the **Connect to work or school** page. -3. In the **Set up a work or school account** window, enter the user's account info. - - For example, if a teacher connects their personal device to the school network, they'll see the following screen after typing in their account information. - - **Figure 7** - Device is now managed by Intune for Education - - ![Device is managed by Intune for Education](images/byob_aad_enrollment_intune.png) - -4. Enter the account password and then click **Sign in** to authenticate the user. - - Depending on the organization's policy, the user may be asked to update the password. - -5. After the user's credentials are validated, the window will refresh and will now include an entry that shows the device is now connected to the organization's MDM. This means the device is now enrolled in Intune for Education MDM and the account should have access to the organization's resources. - - **Figure 8** - Device is connected to organization's MDM - - ![Device is connected to organization's MDM](images/win10_connectedtoorgmdm.png) - -6. You can confirm that the new device and user are showing up as Intune for Education-managed by going to the Intune for Education management portal and following the steps in [Verify the device is Azure AD joined](#verify-the-device-is-azure-ad-joined). - - It may take several minutes before the new device shows up so check again later. - - -> [!div class="step-by-step"] -> [<< Set up Windows 10 education devices](set-up-windows-10-education-devices.md) - - -## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) diff --git a/education/get-started/get-started-with-microsoft-education.md b/education/get-started/get-started-with-microsoft-education.md deleted file mode 100644 index a36cdb45da..0000000000 --- a/education/get-started/get-started-with-microsoft-education.md +++ /dev/null @@ -1,169 +0,0 @@ ---- -title: Deploy and manage a full cloud IT solution with Microsoft Education -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: hero-article -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 10/09/2017 -ms.reviewer: -manager: dansimp ---- - -# Get started: Deploy and manage a full cloud IT solution with Microsoft Education - -![Learn how to deploy and manage a cloud solution with MSES!](images/mses_getstarted_banner.png) - -**Applies to:** - -- Office 365 for Education, School Data Sync, Microsoft Intune for Education, Microsoft Store for Education, Windows 10 Creators Update, Set up School PCs - -Hello, IT administrators! In this walkthrough, we'll show you how you can quickly and easily use the new Microsoft Education system, consisting of new and existing cloud services and tools, to implement a full IT cloud solution for your school. - -## What is Microsoft Education? -**Microsoft Education** consists of these new and existing services and tools from Microsoft: -- **Microsoft Intune for Education** for simple set up, control, and management of the resources for your school including apps, devices, and settings -- **Office 365 for Education** provides online apps for work from anywhere and desktop apps for advanced functionality, built for working together and available across devices, and it's free for schools, teachers, and students - - **School Data Sync** to help automate the process for importing and integrating School Information System (SIS) data that you can use with Office 365 - - **OneNote Class Notebook** to organize course content, create and deliver interactive lessons to some or all students, collaborate and provide private feedback to individual students, and connect with major LMS and SIS partners for assignment workflow -- **Microsoft Teams** to bring conversations, content, and apps together in one place and create collaborate classrooms, connect in professional learning communities, and communicate with school staff -- **Learning Tools** are moving beyond the OneNote desktop app and is now available in Office Lens, OneNote, and Word -- **Whiteboard** to create interactive lessons on the big screen, share and collaborate real-time by connecting to Class Notebook and Classroom -- **Windows 10, version 1703 or later** which brings 3D for everyone and other new and updated Windows features -- **Minecraft: Education Edition** which provides an open and immersive environment to promote creativity, collaboration, and problem-solving - -With Microsoft Education, schools can: -- **Use affordable devices and simple setup** - Boost creativity and get started instantly with Windows 10 devices that support Windows Ink. Set up devices in minutes and stay in control with the new Intune for Education. -- **Collaborate in a modern classroom** - Help students become career-ready with Office apps like Word, Excel, PowerPoint, and OneNote. Increase comprehension and outcomes with the most advanced teaching apps like integrated Learning Tools. -- **Go beyond the browser with inspiring apps for classroom learning** - Inspire with Minecraft: Education Edition and innovative apps from the Microsoft Store for Education. - -Go to the Microsoft Education site to learn more. See How to buy to learn about pricing and purchasing options for schools, students, and teachers as well as academic pricing and offers for qualified K-12 and higher education institutions. - -## What we're doing -The end-to-end process for deploying and managing a full cloud IT solution with Microsoft Education is outlined here. Depending on your [setup scenario](#setup-options), you may not need to implement all these steps. - -Click the link to watch the video or follow the step-by-step guidance for each. - -1. [Set up an Office 365 education tenant](set-up-office365-edu-tenant.md) -2. [Use School Data Sync to import student data](use-school-data-sync.md) -3. [Configure Microsoft Store for Education](configure-microsoft-store-for-education.md) -4. [Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md) -5. [Set up Windows 10 education devices](set-up-windows-10-education-devices.md) -6. [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md) - -**Figure 1** - Microsoft Education IT administrator workflow - -![Deploy and manage a full cloud IT solution using Microsoft Education](images/MSES_Get_Started_IT_082917.png) - -## Prerequisites -Complete these tasks before you start the walkthrough: -- Make sure all the devices that you want to configure, such as student PCs, have Windows 10 (version 1703 or later) image installed. - - We recommend Windows 10, version 1703 or later, to take advantage of all the new features and functionality that Windows supports. This version of Windows is also compatible with the latest version of the Set up School PCs app and the versions must match in order for Set up School PCs to provision the devices. - - If you don't have Windows 10, version 1703 or later, installed on your devices, we recommend upgrading. This process takes a while so start this task before proceeding with this walkthrough. - -- Have an education-verified tenant to qualify for an Office 365 for Education subscription. You also need to be education-verified to use School Data Sync and Intune for Education. - - If you don't have an education-verified domain, don't worry. We'll show you the steps on how to do this. - - > [!NOTE] - > If you need to get education-verified, it may take up to two weeks for the verification process to be completed. - -## Setup options - To make sure you have a successful experience with deploying and managing a full cloud IT solution with Microsoft Education, select the scenario that best describes your school or how you'd like to get started. - - -| [Get started with Microsoft Education in production environment](#noo365prodenv) | [Try out Microsoft Education in trial environment](#noo365trialenv) | [School uses Office 365, try out Intune for Education now](#schooluseso365tryi4e) | -| ----------------------------------------- | ------------------------------------------------ | ---------------------------------------------- | -| * My school doesn't use Office 365 for Education | * My school doesn't use Office 365 for Education | * My school uses Office 365 for Education | -| * My school is not an education-verified tenant | * My school is not an education-verified tenant | * My school is an education-verified tenant | -| * I would like to get started with Microsoft Education in a production environment | * I would like to try out Microsoft Education in a trial environment | * I would like to apply the Intune for Education trial code to my school's production environment | -| * Longest, need to start from scratch | * Simplest, but may take longer to start | * Fastest, Office 365 and SDS already set up | - - -### Option 1: Get started with Microsoft Education in a production environment -Trying out Microsoft Education in a production environment means you'll be using real school data as you evaluate the features and tools. This requires more time to get fully set up and going. - -To get started with Microsoft Education in a production environment: - -* Go to https://aka.ms/sdssignup and fill out the form to sign up for School Data Sync and receive a free, one-on-one support from Microsoft. - - A team from Microsoft will contact you to help get started with Microsoft Education. - -If you want a quicker way to evaluate Microsoft Education, you can [use a trial environment instead](#noo365trialenv). - -### Option 2: Try out Microsoft Education in a trial environment -Once you get an Office 365 education-verified tenant, trying out Microsoft Education in a trial environment is an easy way to evaluate all the features and tools. Here, you'll use promo codes and sample files as you follow the walkthrough. - -To get started with Microsoft Education in a trial environment, follow these steps. - -1. [Set up a new Office 365 for Education tenant](set-up-office365-edu-tenant.md). - - Wait for your tenant to be education-verified before proceeding with the next step. Verification can take up to a few days. - -2. Once you have an education-verified tenant, click https://aka.ms/intuneforedupreviewtrial to apply the Intune for Education trial promo code. - 1. In the Intune for Education Trial page, on the upper right, click **Sign in** next to **Want to add this to an existing subscription?**. - 2. Sign in with your global admin credentials. - -3. Sign in to Office 365 admin portal and: - 1. Select **Admin > Users** and then search for your admin account. - 2. In the user page, select **Product licenses** and expand the **Office 365 Education** license you assigned to yourself. - 3. Confirm that School Data Sync is turned on. - -4. Skip ahead and follow the rest of the instructions in this walkthrough beginning with [Use School Data Sync to import student data](use-school-data-sync.md). - -### Option 3: Try out Intune for Education -Already have an Office 365 for Education verified tenant? Just sign in with your global admin credentials to apply the Intune for Education preview trial code to your tenant and follow the rest of the walkthrough. - -1. Click https://aka.ms/intuneforedupreviewtrial to get started. -2. In the **Intune for Education Trial** page, on the upper right, click **Sign in** next to **Want to add this to an existing subscription?**. - - **Figure 2** - Intune for Education trial sign in page - - ![Intune for Education trial sign in page](images/i4e_trialsigninpage.png) - -3. Enter your Office 365 global admin credentials to apply the Intune for Education trial to your tenant. -4. If you don't already have Microsoft Teams deployed to your tenant, you can start with [Enable Microsoft Teams for your school](enable-microsoft-teams.md) and then follow the rest of the instructions in this walkthrough. - -## Get more info - -### Microsoft Education documentation and resources hub -See the Microsoft Education documentation and resources hub for links to more content for IT admins, teachers, students, and education app developers. - -### Info related to this walkthrough - -**For IT admins** - -To learn more about the services and tools mentioned in this walkthrough, and learn what other tasks you can do, follow these links: -- Working with Microsoft Store for Education -- *Resources for anyone who uses Office 365* and *Resources for admins* in Get started with Office 365 for Education -- School Data Sync deployment options - - Deployment using CSV files: How to deploy School Data Sync by using CSV files and CSV files for School Data Sync - - Deployment using PowerSchool Sync: How to deploy School Data Sync by using PowerSchool Sync and School Data Sync required attributes for PowerSchool Sync - - Deployment using Clever Sync: How to deploy School Data Sync by using Clever Sync and School Data Sync required attributes for Clever sync - - Deployment using OneRoster CSV files: How to deploy School Data Sync by using OneRoster CSV files -- Azure Active Directory features used by Intune for Education, including: - - Single Sign-On (SSO) - Allow your Azure AD users to access SSO-enabled apps, so they don’t need to type in their credentials to access these apps. - - MDM auto-enrollment - Devices are automatically enrolled with Intune upon being joined with Azure AD join. -- Enterprise state roaming - Keep school data and personal data separate on your devices. - - Dynamic groups - You can use dynamic groups to create rules that populate your groups (for example, a group with all 9th graders) instead of having to manually add or remove members of the groups. The group stays updated by continually staying populated with members that fit the rules you pick. - - Password write-back - Allows you to configure Azure AD to write passwords back to your on-premises Active Directory. It removes the need to set up and manage a complicated on-premises self-service password reset solution, and it provides a convenient cloud-based way for your users to reset their on-premises passwords wherever they are. - - Administrative units - - Additional local administrators - - Self-service BitLocker recovery - A self-service portal that allows your employees to retrieve their BitLocker recovery key and avoid support calls. - -**For teachers** - -Whether it's in the classroom, getting the most out of your devices, or learning some of the cool things you can do, we've got teachers covered. Follow these links for more info: -- *Resources for anyone who uses Office 365* in Get started with Office 365 for Education -- Windows 10 online resources for teachers - - - - diff --git a/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png b/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png deleted file mode 100644 index 82aeef7c40..0000000000 Binary files a/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png and /dev/null differ diff --git a/education/get-started/images/ICDstart-option.PNG b/education/get-started/images/ICDstart-option.PNG deleted file mode 100644 index 1ba49bb261..0000000000 Binary files a/education/get-started/images/ICDstart-option.PNG and /dev/null differ diff --git a/education/get-started/images/MSES_Get_Started_IT_082917.png b/education/get-started/images/MSES_Get_Started_IT_082917.png deleted file mode 100644 index 5153524b43..0000000000 Binary files a/education/get-started/images/MSES_Get_Started_IT_082917.png and /dev/null differ diff --git a/education/get-started/images/PCicon.png b/education/get-started/images/PCicon.png deleted file mode 100644 index c97c137b83..0000000000 Binary files a/education/get-started/images/PCicon.png and /dev/null differ diff --git a/education/get-started/images/TakeATestURL.png b/education/get-started/images/TakeATestURL.png deleted file mode 100644 index b057763e8b..0000000000 Binary files a/education/get-started/images/TakeATestURL.png and /dev/null differ diff --git a/education/get-started/images/allowcortana_gp.PNG b/education/get-started/images/allowcortana_gp.PNG deleted file mode 100644 index 7adf1b7594..0000000000 Binary files a/education/get-started/images/allowcortana_gp.PNG and /dev/null differ diff --git a/education/get-started/images/allowcortana_omauri.PNG b/education/get-started/images/allowcortana_omauri.PNG deleted file mode 100644 index 303c89ed5f..0000000000 Binary files a/education/get-started/images/allowcortana_omauri.PNG and /dev/null differ diff --git a/education/get-started/images/allowcortana_wcd.PNG b/education/get-started/images/allowcortana_wcd.PNG deleted file mode 100644 index 5e62e0bb01..0000000000 Binary files a/education/get-started/images/allowcortana_wcd.PNG and /dev/null differ diff --git a/education/get-started/images/app-distribution-options.PNG b/education/get-started/images/app-distribution-options.PNG deleted file mode 100644 index 75b3374720..0000000000 Binary files a/education/get-started/images/app-distribution-options.PNG and /dev/null differ diff --git a/education/get-started/images/app-privacy-group-policy.png b/education/get-started/images/app-privacy-group-policy.png deleted file mode 100644 index 96a5f0380a..0000000000 Binary files a/education/get-started/images/app-privacy-group-policy.png and /dev/null differ diff --git a/education/get-started/images/app1.jpg b/education/get-started/images/app1.jpg deleted file mode 100644 index aef6c5c22e..0000000000 Binary files a/education/get-started/images/app1.jpg and /dev/null differ diff --git a/education/get-started/images/assign_intune_classroom_licenses_to_users.png b/education/get-started/images/assign_intune_classroom_licenses_to_users.png deleted file mode 100644 index 39885c5778..0000000000 Binary files a/education/get-started/images/assign_intune_classroom_licenses_to_users.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_apps_intune.png b/education/get-started/images/azure_ad_apps_intune.png deleted file mode 100644 index ff703bd920..0000000000 Binary files a/education/get-started/images/azure_ad_apps_intune.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_configure_intune.png b/education/get-started/images/azure_ad_configure_intune.png deleted file mode 100644 index 253ec99443..0000000000 Binary files a/education/get-started/images/azure_ad_configure_intune.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_first_signin.png b/education/get-started/images/azure_ad_first_signin.png deleted file mode 100644 index 01e71111a2..0000000000 Binary files a/education/get-started/images/azure_ad_first_signin.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_intune_configuration_save.png b/education/get-started/images/azure_ad_intune_configuration_save.png deleted file mode 100644 index a7feb3b75b..0000000000 Binary files a/education/get-started/images/azure_ad_intune_configuration_save.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_oops_subscription_message.png b/education/get-started/images/azure_ad_oops_subscription_message.png deleted file mode 100644 index 2c6f751179..0000000000 Binary files a/education/get-started/images/azure_ad_oops_subscription_message.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal.png b/education/get-started/images/azure_ad_portal.png deleted file mode 100644 index b06600f922..0000000000 Binary files a/education/get-started/images/azure_ad_portal.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old.png b/education/get-started/images/azure_ad_portal_old.png deleted file mode 100644 index 4f48fdeaa2..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_add_group_members.png b/education/get-started/images/azure_ad_portal_old_add_group_members.png deleted file mode 100644 index 465b2d2c01..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_add_group_members.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_intune_configuration.png b/education/get-started/images/azure_ad_portal_old_intune_configuration.png deleted file mode 100644 index 6d48984601..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_intune_configuration.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_intune_properties.png b/education/get-started/images/azure_ad_portal_old_intune_properties.png deleted file mode 100644 index 3ce578a2e5..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_intune_properties.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_intune_select_all_students.png b/education/get-started/images/azure_ad_portal_old_intune_select_all_students.png deleted file mode 100644 index 0165d7b6b5..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_intune_select_all_students.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_intune_select_groups.png b/education/get-started/images/azure_ad_portal_old_intune_select_groups.png deleted file mode 100644 index 0165d7b6b5..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_intune_select_groups.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_new_group.png b/education/get-started/images/azure_ad_portal_old_new_group.png deleted file mode 100644 index 2c27738d26..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_new_group.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_select_apps.png b/education/get-started/images/azure_ad_portal_old_select_apps.png deleted file mode 100644 index 3c8d188d0c..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_select_apps.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_select_directory.png b/education/get-started/images/azure_ad_portal_old_select_directory.png deleted file mode 100644 index ba8d43dca8..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_select_directory.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_old_select_domain.png b/education/get-started/images/azure_ad_portal_old_select_domain.png deleted file mode 100644 index 4fcaeabbd6..0000000000 Binary files a/education/get-started/images/azure_ad_portal_old_select_domain.png and /dev/null differ diff --git a/education/get-started/images/azure_ad_portal_overview.png b/education/get-started/images/azure_ad_portal_overview.png deleted file mode 100644 index 99a8b3899f..0000000000 Binary files a/education/get-started/images/azure_ad_portal_overview.png and /dev/null differ diff --git a/education/get-started/images/azure_classicportal_configure_devicesettings.PNG b/education/get-started/images/azure_classicportal_configure_devicesettings.PNG deleted file mode 100644 index d9681e69d2..0000000000 Binary files a/education/get-started/images/azure_classicportal_configure_devicesettings.PNG and /dev/null differ diff --git a/education/get-started/images/azure_newportal_usersandgroups_devicesettings.PNG b/education/get-started/images/azure_newportal_usersandgroups_devicesettings.PNG deleted file mode 100644 index c73cf7a68b..0000000000 Binary files a/education/get-started/images/azure_newportal_usersandgroups_devicesettings.PNG and /dev/null differ diff --git a/education/get-started/images/azure_usersandgroups_devicesettings_ers.PNG b/education/get-started/images/azure_usersandgroups_devicesettings_ers.PNG deleted file mode 100644 index 2fa9c8dc74..0000000000 Binary files a/education/get-started/images/azure_usersandgroups_devicesettings_ers.PNG and /dev/null differ diff --git a/education/get-started/images/azuread_usersandgroups_allusers_automaticaccounts.png b/education/get-started/images/azuread_usersandgroups_allusers_automaticaccounts.png deleted file mode 100644 index f0549797a0..0000000000 Binary files a/education/get-started/images/azuread_usersandgroups_allusers_automaticaccounts.png and /dev/null differ diff --git a/education/get-started/images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png b/education/get-started/images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png deleted file mode 100644 index 37ea63cda2..0000000000 Binary files a/education/get-started/images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png and /dev/null differ diff --git a/education/get-started/images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png b/education/get-started/images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png deleted file mode 100644 index 1b8389b1f5..0000000000 Binary files a/education/get-started/images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png and /dev/null differ diff --git a/education/get-started/images/azuread_usersandgroups_devicesettings_usersmayjoin.png b/education/get-started/images/azuread_usersandgroups_devicesettings_usersmayjoin.png deleted file mode 100644 index 40a603cf64..0000000000 Binary files a/education/get-started/images/azuread_usersandgroups_devicesettings_usersmayjoin.png and /dev/null differ diff --git a/education/get-started/images/azuread_video_thumbnail.PNG b/education/get-started/images/azuread_video_thumbnail.PNG deleted file mode 100644 index e0723147f4..0000000000 Binary files a/education/get-started/images/azuread_video_thumbnail.PNG and /dev/null differ diff --git a/education/get-started/images/byob_aad_enrollment_intune.png b/education/get-started/images/byob_aad_enrollment_intune.png deleted file mode 100644 index fb6aaa4cd8..0000000000 Binary files a/education/get-started/images/byob_aad_enrollment_intune.png and /dev/null differ diff --git a/education/get-started/images/checkmark.png b/education/get-started/images/checkmark.png deleted file mode 100644 index f9f04cd6bd..0000000000 Binary files a/education/get-started/images/checkmark.png and /dev/null differ diff --git a/education/get-started/images/choose-package-icd.png b/education/get-started/images/choose-package-icd.png deleted file mode 100644 index 2bf7a18648..0000000000 Binary files a/education/get-started/images/choose-package-icd.png and /dev/null differ diff --git a/education/get-started/images/choose-package.png b/education/get-started/images/choose-package.png deleted file mode 100644 index 868407df56..0000000000 Binary files a/education/get-started/images/choose-package.png and /dev/null differ diff --git a/education/get-started/images/chromebook-fig1-googleadmin.png b/education/get-started/images/chromebook-fig1-googleadmin.png deleted file mode 100644 index b3d42e5ff2..0000000000 Binary files a/education/get-started/images/chromebook-fig1-googleadmin.png and /dev/null differ diff --git a/education/get-started/images/clipboard.png b/education/get-started/images/clipboard.png deleted file mode 100644 index bbfa2c9e8d..0000000000 Binary files a/education/get-started/images/clipboard.png and /dev/null differ diff --git a/education/get-started/images/cloud-mode-graphic.png b/education/get-started/images/cloud-mode-graphic.png deleted file mode 100644 index 53046c440f..0000000000 Binary files a/education/get-started/images/cloud-mode-graphic.png and /dev/null differ diff --git a/education/get-started/images/cloud-mode-intro-banner.png b/education/get-started/images/cloud-mode-intro-banner.png deleted file mode 100644 index 6ef1059262..0000000000 Binary files a/education/get-started/images/cloud-mode-intro-banner.png and /dev/null differ diff --git a/education/get-started/images/cloud-mode-topic-banner.png b/education/get-started/images/cloud-mode-topic-banner.png deleted file mode 100644 index 53046c440f..0000000000 Binary files a/education/get-started/images/cloud-mode-topic-banner.png and /dev/null differ diff --git a/education/get-started/images/configure_store_for_business_app_sync.png b/education/get-started/images/configure_store_for_business_app_sync.png deleted file mode 100644 index e56dc038f9..0000000000 Binary files a/education/get-started/images/configure_store_for_business_app_sync.png and /dev/null differ diff --git a/education/get-started/images/connect-aad.png b/education/get-started/images/connect-aad.png deleted file mode 100644 index 8583866165..0000000000 Binary files a/education/get-started/images/connect-aad.png and /dev/null differ diff --git a/education/get-started/images/connect-ad.png b/education/get-started/images/connect-ad.png deleted file mode 100644 index 4da67e8cdd..0000000000 Binary files a/education/get-started/images/connect-ad.png and /dev/null differ diff --git a/education/get-started/images/connect_download_entry.jpg b/education/get-started/images/connect_download_entry.jpg deleted file mode 100644 index 204b3ad6fa..0000000000 Binary files a/education/get-started/images/connect_download_entry.jpg and /dev/null differ diff --git a/education/get-started/images/create_group_for_intune_management.png b/education/get-started/images/create_group_for_intune_management.png deleted file mode 100644 index b886d12456..0000000000 Binary files a/education/get-started/images/create_group_for_intune_management.png and /dev/null differ diff --git a/education/get-started/images/crossmark.png b/education/get-started/images/crossmark.png deleted file mode 100644 index 69432ff71c..0000000000 Binary files a/education/get-started/images/crossmark.png and /dev/null differ diff --git a/education/get-started/images/deploy-win-10-school-figure1.png b/education/get-started/images/deploy-win-10-school-figure1.png deleted file mode 100644 index 66113dcce1..0000000000 Binary files a/education/get-started/images/deploy-win-10-school-figure1.png and /dev/null differ diff --git a/education/get-started/images/deploy-win-10-school-figure2.png b/education/get-started/images/deploy-win-10-school-figure2.png deleted file mode 100644 index 0227f8dbaa..0000000000 Binary files a/education/get-started/images/deploy-win-10-school-figure2.png and /dev/null differ diff --git a/education/get-started/images/deploy-win-10-school-figure3.png b/education/get-started/images/deploy-win-10-school-figure3.png deleted file mode 100644 index 1b39b5cc14..0000000000 Binary files a/education/get-started/images/deploy-win-10-school-figure3.png and /dev/null differ diff --git a/education/get-started/images/deploy-win-10-school-figure4.png b/education/get-started/images/deploy-win-10-school-figure4.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/get-started/images/deploy-win-10-school-figure4.png and /dev/null differ diff --git a/education/get-started/images/deploy-win-10-school-figure5.png b/education/get-started/images/deploy-win-10-school-figure5.png deleted file mode 100644 index 550386f1ce..0000000000 Binary files a/education/get-started/images/deploy-win-10-school-figure5.png and /dev/null differ diff --git a/education/get-started/images/deploy-win-10-school-figure6.png b/education/get-started/images/deploy-win-10-school-figure6.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/get-started/images/deploy-win-10-school-figure6.png and /dev/null differ diff --git a/education/get-started/images/deploy-win-10-school-figure7.png b/education/get-started/images/deploy-win-10-school-figure7.png deleted file mode 100644 index 8e7581007a..0000000000 Binary files a/education/get-started/images/deploy-win-10-school-figure7.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig1.png b/education/get-started/images/edu-districtdeploy-fig1.png deleted file mode 100644 index a9ed962f95..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig1.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig2.png b/education/get-started/images/edu-districtdeploy-fig2.png deleted file mode 100644 index 3838c18153..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig2.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig3.png b/education/get-started/images/edu-districtdeploy-fig3.png deleted file mode 100644 index 0227f8dbaa..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig3.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig4.png b/education/get-started/images/edu-districtdeploy-fig4.png deleted file mode 100644 index c55ee20d47..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig4.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig5.png b/education/get-started/images/edu-districtdeploy-fig5.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig5.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig6.png b/education/get-started/images/edu-districtdeploy-fig6.png deleted file mode 100644 index 550386f1ce..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig6.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig7.png b/education/get-started/images/edu-districtdeploy-fig7.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig7.png and /dev/null differ diff --git a/education/get-started/images/edu-districtdeploy-fig8.png b/education/get-started/images/edu-districtdeploy-fig8.png deleted file mode 100644 index 8e7581007a..0000000000 Binary files a/education/get-started/images/edu-districtdeploy-fig8.png and /dev/null differ diff --git a/education/get-started/images/education.png b/education/get-started/images/education.png deleted file mode 100644 index cc4f7fabb2..0000000000 Binary files a/education/get-started/images/education.png and /dev/null differ diff --git a/education/get-started/images/enter-email.PNG b/education/get-started/images/enter-email.PNG deleted file mode 100644 index 644d893f06..0000000000 Binary files a/education/get-started/images/enter-email.PNG and /dev/null differ diff --git a/education/get-started/images/express-settings.png b/education/get-started/images/express-settings.png deleted file mode 100644 index 99e9c4825a..0000000000 Binary files a/education/get-started/images/express-settings.png and /dev/null differ diff --git a/education/get-started/images/fig2-locallyconfig.png b/education/get-started/images/fig2-locallyconfig.png deleted file mode 100644 index d2fe9820da..0000000000 Binary files a/education/get-started/images/fig2-locallyconfig.png and /dev/null differ diff --git a/education/get-started/images/get-app-store.png b/education/get-started/images/get-app-store.png deleted file mode 100644 index 14ae888425..0000000000 Binary files a/education/get-started/images/get-app-store.png and /dev/null differ diff --git a/education/get-started/images/get-the-app.PNG b/education/get-started/images/get-the-app.PNG deleted file mode 100644 index 0692ae6f7f..0000000000 Binary files a/education/get-started/images/get-the-app.PNG and /dev/null differ diff --git a/education/get-started/images/gp_letwinappsaccesscontacts.PNG b/education/get-started/images/gp_letwinappsaccesscontacts.PNG deleted file mode 100644 index 0228c9474b..0000000000 Binary files a/education/get-started/images/gp_letwinappsaccesscontacts.PNG and /dev/null differ diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG deleted file mode 100644 index 1dcae48622..0000000000 Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG and /dev/null differ diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG deleted file mode 100644 index b366d25c4e..0000000000 Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG and /dev/null differ diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG deleted file mode 100644 index 60f4857c8e..0000000000 Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG and /dev/null differ diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG deleted file mode 100644 index 56cd93787e..0000000000 Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_admin_portal.png b/education/get-started/images/i4e_admin_portal.png deleted file mode 100644 index c6f2b25d18..0000000000 Binary files a/education/get-started/images/i4e_admin_portal.png and /dev/null differ diff --git a/education/get-started/images/i4e_apps_newstoreapp.PNG b/education/get-started/images/i4e_apps_newstoreapp.PNG deleted file mode 100644 index 99af139e1d..0000000000 Binary files a/education/get-started/images/i4e_apps_newstoreapp.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_apps_newstoreapp_selected.png b/education/get-started/images/i4e_apps_newstoreapp_selected.png deleted file mode 100644 index d4716d7574..0000000000 Binary files a/education/get-started/images/i4e_apps_newstoreapp_selected.png and /dev/null differ diff --git a/education/get-started/images/i4e_apps_purchased_apps_list.PNG b/education/get-started/images/i4e_apps_purchased_apps_list.PNG deleted file mode 100644 index 4440487d68..0000000000 Binary files a/education/get-started/images/i4e_apps_purchased_apps_list.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_apps_storeaboughtapps_nowsyncing.PNG b/education/get-started/images/i4e_apps_storeaboughtapps_nowsyncing.PNG deleted file mode 100644 index 423e557d87..0000000000 Binary files a/education/get-started/images/i4e_apps_storeaboughtapps_nowsyncing.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_apps_storeapps_newappbutton.PNG b/education/get-started/images/i4e_apps_storeapps_newappbutton.PNG deleted file mode 100644 index 4cb91536ac..0000000000 Binary files a/education/get-started/images/i4e_apps_storeapps_newappbutton.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard.PNG b/education/get-started/images/i4e_dashboard.PNG deleted file mode 100644 index faced8b1f7..0000000000 Binary files a/education/get-started/images/i4e_dashboard.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard_afterconfiguration.PNG b/education/get-started/images/i4e_dashboard_afterconfiguration.PNG deleted file mode 100644 index 7c736072af..0000000000 Binary files a/education/get-started/images/i4e_dashboard_afterconfiguration.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard_apps.PNG b/education/get-started/images/i4e_dashboard_apps.PNG deleted file mode 100644 index 01bb4168f2..0000000000 Binary files a/education/get-started/images/i4e_dashboard_apps.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard_clickapps.PNG b/education/get-started/images/i4e_dashboard_clickapps.PNG deleted file mode 100644 index e847279c38..0000000000 Binary files a/education/get-started/images/i4e_dashboard_clickapps.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard_clickapps_latest.PNG b/education/get-started/images/i4e_dashboard_clickapps_latest.PNG deleted file mode 100644 index cec81cebc7..0000000000 Binary files a/education/get-started/images/i4e_dashboard_clickapps_latest.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard_latest.PNG b/education/get-started/images/i4e_dashboard_latest.PNG deleted file mode 100644 index 131d285d86..0000000000 Binary files a/education/get-started/images/i4e_dashboard_latest.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard_newtenant.PNG b/education/get-started/images/i4e_dashboard_newtenant.PNG deleted file mode 100644 index 3494a366b2..0000000000 Binary files a/education/get-started/images/i4e_dashboard_newtenant.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_dashboard_selectgroups.png b/education/get-started/images/i4e_dashboard_selectgroups.png deleted file mode 100644 index 5d00c46121..0000000000 Binary files a/education/get-started/images/i4e_dashboard_selectgroups.png and /dev/null differ diff --git a/education/get-started/images/i4e_expres_setup_option.PNG b/education/get-started/images/i4e_expres_setup_option.PNG deleted file mode 100644 index e08f7ef18c..0000000000 Binary files a/education/get-started/images/i4e_expres_setup_option.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_express_configuration_welcometoi4e.PNG b/education/get-started/images/i4e_express_configuration_welcometoi4e.PNG deleted file mode 100644 index 00626c574b..0000000000 Binary files a/education/get-started/images/i4e_express_configuration_welcometoi4e.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_express_setup_option.png b/education/get-started/images/i4e_express_setup_option.png deleted file mode 100644 index e08f7ef18c..0000000000 Binary files a/education/get-started/images/i4e_express_setup_option.png and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_alldone.PNG b/education/get-started/images/i4e_expressconfiguration_alldone.PNG deleted file mode 100644 index dfb6b51cf0..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_alldone.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_chooseapps.PNG b/education/get-started/images/i4e_expressconfiguration_chooseapps.PNG deleted file mode 100644 index 2663b45d24..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_chooseapps.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected.PNG b/education/get-started/images/i4e_expressconfiguration_chooseapps_selected.PNG deleted file mode 100644 index 70576b0d45..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected_cropped.png b/education/get-started/images/i4e_expressconfiguration_chooseapps_selected_cropped.png deleted file mode 100644 index 013468cc32..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected_cropped.png and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosebuttontogoback.PNG b/education/get-started/images/i4e_expressconfiguration_choosebuttontogoback.PNG deleted file mode 100644 index 535a0cf01c..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosebuttontogoback.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings.PNG deleted file mode 100644 index 5883a00ced..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings.PNG deleted file mode 100644 index fb3a0d3d71..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.PNG deleted file mode 100644 index 96e1e0452b..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured.PNG deleted file mode 100644 index 011e91658d..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured_cropped.png b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured_cropped.png deleted file mode 100644 index b9cc6885fc..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured_cropped.png and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse.PNG deleted file mode 100644 index 8a998070fa..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped.png b/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped.png deleted file mode 100644 index 0d39ae2780..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped.png and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.PNG deleted file mode 100644 index e223b5a94c..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_review.PNG b/education/get-started/images/i4e_expressconfiguration_review.PNG deleted file mode 100644 index bbc70f3a3f..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_review.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_sdsconfigured.PNG b/education/get-started/images/i4e_expressconfiguration_sdsconfigured.PNG deleted file mode 100644 index 5a7b4ed672..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_sdsconfigured.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expressconfiguration_welcome.PNG b/education/get-started/images/i4e_expressconfiguration_welcome.PNG deleted file mode 100644 index 019609fb3e..0000000000 Binary files a/education/get-started/images/i4e_expressconfiguration_welcome.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_alldone.PNG b/education/get-started/images/i4e_expresssetup_alldone.PNG deleted file mode 100644 index e53e4e1d3c..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_alldone.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_chooseapps.PNG b/education/get-started/images/i4e_expresssetup_chooseapps.PNG deleted file mode 100644 index e7eeb0c59a..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_chooseapps.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_chooseapps_apps_chosen.PNG b/education/get-started/images/i4e_expresssetup_chooseapps_apps_chosen.PNG deleted file mode 100644 index 1e5d6e53d1..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_chooseapps_apps_chosen.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_chooseapps_appschosen.PNG b/education/get-started/images/i4e_expresssetup_chooseapps_appschosen.PNG deleted file mode 100644 index e08d5bd572..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_chooseapps_appschosen.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_chooseapps_new.PNG b/education/get-started/images/i4e_expresssetup_chooseapps_new.PNG deleted file mode 100644 index 254f18813b..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_chooseapps_new.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_choosebuttontogoback.PNG b/education/get-started/images/i4e_expresssetup_choosebuttontogoback.PNG deleted file mode 100644 index 1580c4382e..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_choosebuttontogoback.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_choosesettings.PNG b/education/get-started/images/i4e_expresssetup_choosesettings.PNG deleted file mode 100644 index 16b2a086e7..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_choosesettings.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_choosesettings_additionalsettings.PNG b/education/get-started/images/i4e_expresssetup_choosesettings_additionalsettings.PNG deleted file mode 100644 index 749823c21e..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_choosesettings_additionalsettings.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_endofsetup.PNG b/education/get-started/images/i4e_expresssetup_endofsetup.PNG deleted file mode 100644 index e9f2fa4b24..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_endofsetup.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_getschoolinfo.PNG b/education/get-started/images/i4e_expresssetup_getschoolinfo.PNG deleted file mode 100644 index e230f260c9..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_getschoolinfo.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_getstarted.PNG b/education/get-started/images/i4e_expresssetup_getstarted.PNG deleted file mode 100644 index 6ce576aaa9..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_getstarted.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_expresssetup_sdsconfigured.PNG b/education/get-started/images/i4e_expresssetup_sdsconfigured.PNG deleted file mode 100644 index c9ef184d9d..0000000000 Binary files a/education/get-started/images/i4e_expresssetup_sdsconfigured.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups.PNG b/education/get-started/images/i4e_groups.PNG deleted file mode 100644 index ed429844ae..0000000000 Binary files a/education/get-started/images/i4e_groups.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_alldevices_aadjoined_list.PNG b/education/get-started/images/i4e_groups_alldevices_aadjoined_list.PNG deleted file mode 100644 index 6e87a4fa5a..0000000000 Binary files a/education/get-started/images/i4e_groups_alldevices_aadjoined_list.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_alldevices_list.PNG b/education/get-started/images/i4e_groups_alldevices_list.PNG deleted file mode 100644 index 8fbf5ddd7b..0000000000 Binary files a/education/get-started/images/i4e_groups_alldevices_list.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_alldevices_listofaadjdevices.png b/education/get-started/images/i4e_groups_alldevices_listofaadjdevices.png deleted file mode 100644 index d59b8a7b70..0000000000 Binary files a/education/get-started/images/i4e_groups_alldevices_listofaadjdevices.png and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_apps.PNG b/education/get-started/images/i4e_groups_allusers_apps.PNG deleted file mode 100644 index 7047f51bc1..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_apps.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_apps_appstodeploy.PNG b/education/get-started/images/i4e_groups_allusers_apps_appstodeploy.PNG deleted file mode 100644 index 3a0ae4645d..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_apps_appstodeploy.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_apps_edit.PNG b/education/get-started/images/i4e_groups_allusers_apps_edit.PNG deleted file mode 100644 index cace903c13..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_apps_edit.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_apps_updatedlist.PNG b/education/get-started/images/i4e_groups_allusers_apps_updatedlist.PNG deleted file mode 100644 index a25a1fb432..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_apps_updatedlist.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_appspage.PNG b/education/get-started/images/i4e_groups_allusers_appspage.PNG deleted file mode 100644 index 5c81a54283..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_appspage.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_appspage_editapps.png b/education/get-started/images/i4e_groups_allusers_appspage_editapps.png deleted file mode 100644 index 3935807ff8..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_appspage_editapps.png and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_list.PNG b/education/get-started/images/i4e_groups_allusers_list.PNG deleted file mode 100644 index b28969d4e8..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_list.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_selectappstodeploy.PNG b/education/get-started/images/i4e_groups_allusers_selectappstodeploy.PNG deleted file mode 100644 index 65c1dba1e2..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_selectappstodeploy.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_updatedappslist.PNG b/education/get-started/images/i4e_groups_allusers_updatedappslist.PNG deleted file mode 100644 index 0c7bb32fa7..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_updatedappslist.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_users.PNG b/education/get-started/images/i4e_groups_allusers_users.PNG deleted file mode 100644 index 8a94818fbc..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_users.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_allusers_users_steps.png b/education/get-started/images/i4e_groups_allusers_users_steps.png deleted file mode 100644 index 2ce85659e0..0000000000 Binary files a/education/get-started/images/i4e_groups_allusers_users_steps.png and /dev/null differ diff --git a/education/get-started/images/i4e_groups_groups_blade.PNG b/education/get-started/images/i4e_groups_groups_blade.PNG deleted file mode 100644 index d821aaad2c..0000000000 Binary files a/education/get-started/images/i4e_groups_groups_blade.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_settings_changes.PNG b/education/get-started/images/i4e_groups_settings_changes.PNG deleted file mode 100644 index fe3c4dd610..0000000000 Binary files a/education/get-started/images/i4e_groups_settings_changes.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groups_settingslist_full.PNG b/education/get-started/images/i4e_groups_settingslist_full.PNG deleted file mode 100644 index f3efbd9a04..0000000000 Binary files a/education/get-started/images/i4e_groups_settingslist_full.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_groupspage.PNG b/education/get-started/images/i4e_groupspage.PNG deleted file mode 100644 index 7ee8affebc..0000000000 Binary files a/education/get-started/images/i4e_groupspage.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_new_store_app.PNG b/education/get-started/images/i4e_new_store_app.PNG deleted file mode 100644 index 1e20501da2..0000000000 Binary files a/education/get-started/images/i4e_new_store_app.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_portal.PNG b/education/get-started/images/i4e_portal.PNG deleted file mode 100644 index f234e60fff..0000000000 Binary files a/education/get-started/images/i4e_portal.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_takeatestprofile_accountsummary.PNG b/education/get-started/images/i4e_takeatestprofile_accountsummary.PNG deleted file mode 100644 index e8feb9b5d7..0000000000 Binary files a/education/get-started/images/i4e_takeatestprofile_accountsummary.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_takeatestprofile_addnewprofile.PNG b/education/get-started/images/i4e_takeatestprofile_addnewprofile.PNG deleted file mode 100644 index 401bccef4a..0000000000 Binary files a/education/get-started/images/i4e_takeatestprofile_addnewprofile.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_takeatestprofile_changegroup_selectgroup.PNG b/education/get-started/images/i4e_takeatestprofile_changegroup_selectgroup.PNG deleted file mode 100644 index 4c8f0705ce..0000000000 Binary files a/education/get-started/images/i4e_takeatestprofile_changegroup_selectgroup.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_takeatestprofile_groupassignment_selected.PNG b/education/get-started/images/i4e_takeatestprofile_groupassignment_selected.PNG deleted file mode 100644 index 8431e1d0cf..0000000000 Binary files a/education/get-started/images/i4e_takeatestprofile_groupassignment_selected.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_takeatestprofile_groups_changegroupassignments.PNG b/education/get-started/images/i4e_takeatestprofile_groups_changegroupassignments.PNG deleted file mode 100644 index 914f0b4edd..0000000000 Binary files a/education/get-started/images/i4e_takeatestprofile_groups_changegroupassignments.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_takeatestprofile_newtestaccount.PNG b/education/get-started/images/i4e_takeatestprofile_newtestaccount.PNG deleted file mode 100644 index 1ec2f0a2e2..0000000000 Binary files a/education/get-started/images/i4e_takeatestprofile_newtestaccount.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_tenant_settings_force_sync.PNG b/education/get-started/images/i4e_tenant_settings_force_sync.PNG deleted file mode 100644 index 285c8b236b..0000000000 Binary files a/education/get-started/images/i4e_tenant_settings_force_sync.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_tenantsettings.PNG b/education/get-started/images/i4e_tenantsettings.PNG deleted file mode 100644 index 90c1a0afde..0000000000 Binary files a/education/get-started/images/i4e_tenantsettings.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_tenantsettings_edit_syncwithstore_on.PNG b/education/get-started/images/i4e_tenantsettings_edit_syncwithstore_on.PNG deleted file mode 100644 index d06bbde3ef..0000000000 Binary files a/education/get-started/images/i4e_tenantsettings_edit_syncwithstore_on.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_trialsigninpage.png b/education/get-started/images/i4e_trialsigninpage.png deleted file mode 100644 index 5945ce3170..0000000000 Binary files a/education/get-started/images/i4e_trialsigninpage.png and /dev/null differ diff --git a/education/get-started/images/i4e_video_thumbnail.PNG b/education/get-started/images/i4e_video_thumbnail.PNG deleted file mode 100644 index fdec163bca..0000000000 Binary files a/education/get-started/images/i4e_video_thumbnail.PNG and /dev/null differ diff --git a/education/get-started/images/i4e_video_thumbnail_app.PNG b/education/get-started/images/i4e_video_thumbnail_app.PNG deleted file mode 100644 index f30ea26067..0000000000 Binary files a/education/get-started/images/i4e_video_thumbnail_app.PNG and /dev/null differ diff --git a/education/get-started/images/icd-adv-shared-pc.PNG b/education/get-started/images/icd-adv-shared-pc.PNG deleted file mode 100644 index a8da5fa78a..0000000000 Binary files a/education/get-started/images/icd-adv-shared-pc.PNG and /dev/null differ diff --git a/education/get-started/images/icd-school-adv-edit.png b/education/get-started/images/icd-school-adv-edit.png deleted file mode 100644 index 16843cc010..0000000000 Binary files a/education/get-started/images/icd-school-adv-edit.png and /dev/null differ diff --git a/education/get-started/images/icd-school.PNG b/education/get-started/images/icd-school.PNG deleted file mode 100644 index e6a944a193..0000000000 Binary files a/education/get-started/images/icd-school.PNG and /dev/null differ diff --git a/education/get-started/images/icd-simple.PNG b/education/get-started/images/icd-simple.PNG deleted file mode 100644 index 7ae8a1728b..0000000000 Binary files a/education/get-started/images/icd-simple.PNG and /dev/null differ diff --git a/education/get-started/images/icdbrowse.png b/education/get-started/images/icdbrowse.png deleted file mode 100644 index 53c91074c7..0000000000 Binary files a/education/get-started/images/icdbrowse.png and /dev/null differ diff --git a/education/get-started/images/intune_admin_mdm_storeforbiz.png b/education/get-started/images/intune_admin_mdm_storeforbiz.png deleted file mode 100644 index d67e95defb..0000000000 Binary files a/education/get-started/images/intune_admin_mdm_storeforbiz.png and /dev/null differ diff --git a/education/get-started/images/intune_admin_workspace_configure_sync.PNG b/education/get-started/images/intune_admin_workspace_configure_sync.PNG deleted file mode 100644 index a67c9a096c..0000000000 Binary files a/education/get-started/images/intune_admin_workspace_configure_sync.PNG and /dev/null differ diff --git a/education/get-started/images/intune_app_deployment_action.png b/education/get-started/images/intune_app_deployment_action.png deleted file mode 100644 index 7535cf2979..0000000000 Binary files a/education/get-started/images/intune_app_deployment_action.png and /dev/null differ diff --git a/education/get-started/images/intune_create_general_win10_policy.png b/education/get-started/images/intune_create_general_win10_policy.png deleted file mode 100644 index fed06848b5..0000000000 Binary files a/education/get-started/images/intune_create_general_win10_policy.png and /dev/null differ diff --git a/education/get-started/images/intune_create_new_policy.png b/education/get-started/images/intune_create_new_policy.png deleted file mode 100644 index 544ab5ef22..0000000000 Binary files a/education/get-started/images/intune_create_new_policy.png and /dev/null differ diff --git a/education/get-started/images/intune_dashboard.png b/education/get-started/images/intune_dashboard.png deleted file mode 100644 index b5c309259a..0000000000 Binary files a/education/get-started/images/intune_dashboard.png and /dev/null differ diff --git a/education/get-started/images/intune_device_management_apply_groups.png b/education/get-started/images/intune_device_management_apply_groups.png deleted file mode 100644 index 0178a26695..0000000000 Binary files a/education/get-started/images/intune_device_management_apply_groups.png and /dev/null differ diff --git a/education/get-started/images/intune_force_sync.png b/education/get-started/images/intune_force_sync.png deleted file mode 100644 index 9943be5b5b..0000000000 Binary files a/education/get-started/images/intune_force_sync.png and /dev/null differ diff --git a/education/get-started/images/intune_management_console_apps_apps.png b/education/get-started/images/intune_management_console_apps_apps.png deleted file mode 100644 index 5ee6354a01..0000000000 Binary files a/education/get-started/images/intune_management_console_apps_apps.png and /dev/null differ diff --git a/education/get-started/images/intune_missing_ems_license_error_message.png b/education/get-started/images/intune_missing_ems_license_error_message.png deleted file mode 100644 index ae441d47ba..0000000000 Binary files a/education/get-started/images/intune_missing_ems_license_error_message.png and /dev/null differ diff --git a/education/get-started/images/intune_missing_ems_license_errormessage.png b/education/get-started/images/intune_missing_ems_license_errormessage.png deleted file mode 100644 index e63ceb7b84..0000000000 Binary files a/education/get-started/images/intune_missing_ems_license_errormessage.png and /dev/null differ diff --git a/education/get-started/images/intune_portal_apps_volume_purchased.png b/education/get-started/images/intune_portal_apps_volume_purchased.png deleted file mode 100644 index 311fa6e4dd..0000000000 Binary files a/education/get-started/images/intune_portal_apps_volume_purchased.png and /dev/null differ diff --git a/education/get-started/images/intune_portal_apps_volume_purchased_wsfb_apps.png b/education/get-started/images/intune_portal_apps_volume_purchased_wsfb_apps.png deleted file mode 100644 index 9c5a2ffae4..0000000000 Binary files a/education/get-started/images/intune_portal_apps_volume_purchased_wsfb_apps.png and /dev/null differ diff --git a/education/get-started/images/intune_portal_configure_wsfb_app_sync.png b/education/get-started/images/intune_portal_configure_wsfb_app_sync.png deleted file mode 100644 index aa9b1e2f07..0000000000 Binary files a/education/get-started/images/intune_portal_configure_wsfb_app_sync.png and /dev/null differ diff --git a/education/get-started/images/intune_portal_direct_managed_devices_list.png b/education/get-started/images/intune_portal_direct_managed_devices_list.png deleted file mode 100644 index 41b1eddad2..0000000000 Binary files a/education/get-started/images/intune_portal_direct_managed_devices_list.png and /dev/null differ diff --git a/education/get-started/images/intune_students_group_2.png b/education/get-started/images/intune_students_group_2.png deleted file mode 100644 index 0d898047d5..0000000000 Binary files a/education/get-started/images/intune_students_group_2.png and /dev/null differ diff --git a/education/get-started/images/it-get-app.PNG b/education/get-started/images/it-get-app.PNG deleted file mode 100644 index 9740081ef4..0000000000 Binary files a/education/get-started/images/it-get-app.PNG and /dev/null differ diff --git a/education/get-started/images/license-terms.png b/education/get-started/images/license-terms.png deleted file mode 100644 index 8dd34b0a18..0000000000 Binary files a/education/get-started/images/license-terms.png and /dev/null differ diff --git a/education/get-started/images/lightbulb.png b/education/get-started/images/lightbulb.png deleted file mode 100644 index 95bea10957..0000000000 Binary files a/education/get-started/images/lightbulb.png and /dev/null differ diff --git a/education/get-started/images/list.png b/education/get-started/images/list.png deleted file mode 100644 index 089827c373..0000000000 Binary files a/education/get-started/images/list.png and /dev/null differ diff --git a/education/get-started/images/mc-assign-to-others-admin.png b/education/get-started/images/mc-assign-to-others-admin.png deleted file mode 100644 index 907f21d514..0000000000 Binary files a/education/get-started/images/mc-assign-to-others-admin.png and /dev/null differ diff --git a/education/get-started/images/mc-assign-to-others-teacher.png b/education/get-started/images/mc-assign-to-others-teacher.png deleted file mode 100644 index 2656e9c784..0000000000 Binary files a/education/get-started/images/mc-assign-to-others-teacher.png and /dev/null differ diff --git a/education/get-started/images/mc-check-for-updates.png b/education/get-started/images/mc-check-for-updates.png deleted file mode 100644 index a9a0fbae5f..0000000000 Binary files a/education/get-started/images/mc-check-for-updates.png and /dev/null differ diff --git a/education/get-started/images/mc-dnld-others-admin.png b/education/get-started/images/mc-dnld-others-admin.png deleted file mode 100644 index 5e253c20d1..0000000000 Binary files a/education/get-started/images/mc-dnld-others-admin.png and /dev/null differ diff --git a/education/get-started/images/mc-dnld-others-teacher.png b/education/get-started/images/mc-dnld-others-teacher.png deleted file mode 100644 index aa5df16595..0000000000 Binary files a/education/get-started/images/mc-dnld-others-teacher.png and /dev/null differ diff --git a/education/get-started/images/mc-install-for-me-admin.png b/education/get-started/images/mc-install-for-me-admin.png deleted file mode 100644 index f9194a6188..0000000000 Binary files a/education/get-started/images/mc-install-for-me-admin.png and /dev/null differ diff --git a/education/get-started/images/mc-install-for-me-teacher.png b/education/get-started/images/mc-install-for-me-teacher.png deleted file mode 100644 index e303e63660..0000000000 Binary files a/education/get-started/images/mc-install-for-me-teacher.png and /dev/null differ diff --git a/education/get-started/images/mcee-add-payment-method.png b/education/get-started/images/mcee-add-payment-method.png deleted file mode 100644 index e583b4eccc..0000000000 Binary files a/education/get-started/images/mcee-add-payment-method.png and /dev/null differ diff --git a/education/get-started/images/mcee-auto-assign-bd.png b/education/get-started/images/mcee-auto-assign-bd.png deleted file mode 100644 index b14990583f..0000000000 Binary files a/education/get-started/images/mcee-auto-assign-bd.png and /dev/null differ diff --git a/education/get-started/images/mcee-auto-assign-legacy.png b/education/get-started/images/mcee-auto-assign-legacy.png deleted file mode 100644 index 866b37395e..0000000000 Binary files a/education/get-started/images/mcee-auto-assign-legacy.png and /dev/null differ diff --git a/education/get-started/images/mcee-invoice-bills.PNG b/education/get-started/images/mcee-invoice-bills.PNG deleted file mode 100644 index 1a07ac3f01..0000000000 Binary files a/education/get-started/images/mcee-invoice-bills.PNG and /dev/null differ diff --git a/education/get-started/images/mcee-invoice-info.png b/education/get-started/images/mcee-invoice-info.png deleted file mode 100644 index f4bf29f8b2..0000000000 Binary files a/education/get-started/images/mcee-invoice-info.png and /dev/null differ diff --git a/education/get-started/images/mcee-view-bills.png b/education/get-started/images/mcee-view-bills.png deleted file mode 100644 index 5aeff48109..0000000000 Binary files a/education/get-started/images/mcee-view-bills.png and /dev/null differ diff --git a/education/get-started/images/mes_banner.png b/education/get-started/images/mes_banner.png deleted file mode 100644 index cc08f278e2..0000000000 Binary files a/education/get-started/images/mes_banner.png and /dev/null differ diff --git a/education/get-started/images/microsoft-education-get-started-workflow.png b/education/get-started/images/microsoft-education-get-started-workflow.png deleted file mode 100644 index 46051500a0..0000000000 Binary files a/education/get-started/images/microsoft-education-get-started-workflow.png and /dev/null differ diff --git a/education/get-started/images/microsoft-education-workflow.png b/education/get-started/images/microsoft-education-workflow.png deleted file mode 100644 index f15aa3f783..0000000000 Binary files a/education/get-started/images/microsoft-education-workflow.png and /dev/null differ diff --git a/education/get-started/images/microsoft_education_get_started_workflow.png b/education/get-started/images/microsoft_education_get_started_workflow.png deleted file mode 100644 index faa0579b44..0000000000 Binary files a/education/get-started/images/microsoft_education_get_started_workflow.png and /dev/null differ diff --git a/education/get-started/images/microsoft_education_it_getstarted_workflow.png b/education/get-started/images/microsoft_education_it_getstarted_workflow.png deleted file mode 100644 index ebcaa2add9..0000000000 Binary files a/education/get-started/images/microsoft_education_it_getstarted_workflow.png and /dev/null differ diff --git a/education/get-started/images/minecraft-admin-permissions.png b/education/get-started/images/minecraft-admin-permissions.png deleted file mode 100644 index 3051c3dd84..0000000000 Binary files a/education/get-started/images/minecraft-admin-permissions.png and /dev/null differ diff --git a/education/get-started/images/minecraft-assign-roles-2.png b/education/get-started/images/minecraft-assign-roles-2.png deleted file mode 100644 index 3ab1d6e072..0000000000 Binary files a/education/get-started/images/minecraft-assign-roles-2.png and /dev/null differ diff --git a/education/get-started/images/minecraft-assign-roles.png b/education/get-started/images/minecraft-assign-roles.png deleted file mode 100644 index 5dc396155c..0000000000 Binary files a/education/get-started/images/minecraft-assign-roles.png and /dev/null differ diff --git a/education/get-started/images/minecraft-assign-to-others.png b/education/get-started/images/minecraft-assign-to-others.png deleted file mode 100644 index 4e8fba6126..0000000000 Binary files a/education/get-started/images/minecraft-assign-to-others.png and /dev/null differ diff --git a/education/get-started/images/minecraft-assign-to-people-name.png b/education/get-started/images/minecraft-assign-to-people-name.png deleted file mode 100644 index 38994cc58f..0000000000 Binary files a/education/get-started/images/minecraft-assign-to-people-name.png and /dev/null differ diff --git a/education/get-started/images/minecraft-assign-to-people.png b/education/get-started/images/minecraft-assign-to-people.png deleted file mode 100644 index 0f0e3dcdff..0000000000 Binary files a/education/get-started/images/minecraft-assign-to-people.png and /dev/null differ diff --git a/education/get-started/images/minecraft-get-the-app.png b/education/get-started/images/minecraft-get-the-app.png deleted file mode 100644 index 47024aab6c..0000000000 Binary files a/education/get-started/images/minecraft-get-the-app.png and /dev/null differ diff --git a/education/get-started/images/minecraft-in-windows-store-app.png b/education/get-started/images/minecraft-in-windows-store-app.png deleted file mode 100644 index e25f2b4df3..0000000000 Binary files a/education/get-started/images/minecraft-in-windows-store-app.png and /dev/null differ diff --git a/education/get-started/images/minecraft-my-library.png b/education/get-started/images/minecraft-my-library.png deleted file mode 100644 index 1be1660adb..0000000000 Binary files a/education/get-started/images/minecraft-my-library.png and /dev/null differ diff --git a/education/get-started/images/minecraft-perms.PNG b/education/get-started/images/minecraft-perms.PNG deleted file mode 100644 index 1788d6b593..0000000000 Binary files a/education/get-started/images/minecraft-perms.PNG and /dev/null differ diff --git a/education/get-started/images/minecraft-private-store.png b/education/get-started/images/minecraft-private-store.png deleted file mode 100644 index 0194d4b955..0000000000 Binary files a/education/get-started/images/minecraft-private-store.png and /dev/null differ diff --git a/education/get-started/images/minecraft.PNG b/education/get-started/images/minecraft.PNG deleted file mode 100644 index c758c28ad5..0000000000 Binary files a/education/get-started/images/minecraft.PNG and /dev/null differ diff --git a/education/get-started/images/mses_get_started_banner.png b/education/get-started/images/mses_get_started_banner.png deleted file mode 100644 index ca188d738e..0000000000 Binary files a/education/get-started/images/mses_get_started_banner.png and /dev/null differ diff --git a/education/get-started/images/mses_getstarted_banner.png b/education/get-started/images/mses_getstarted_banner.png deleted file mode 100644 index 48dde0456c..0000000000 Binary files a/education/get-started/images/mses_getstarted_banner.png and /dev/null differ diff --git a/education/get-started/images/mses_getstarted_workflow_e2e.png b/education/get-started/images/mses_getstarted_workflow_e2e.png deleted file mode 100644 index afb328d27d..0000000000 Binary files a/education/get-started/images/mses_getstarted_workflow_e2e.png and /dev/null differ diff --git a/education/get-started/images/msfe_manage_page.PNG b/education/get-started/images/msfe_manage_page.PNG deleted file mode 100644 index 04bbc172c4..0000000000 Binary files a/education/get-started/images/msfe_manage_page.PNG and /dev/null differ diff --git a/education/get-started/images/msfe_manageapps_inventory.PNG b/education/get-started/images/msfe_manageapps_inventory.PNG deleted file mode 100644 index 20c8e6f750..0000000000 Binary files a/education/get-started/images/msfe_manageapps_inventory.PNG and /dev/null differ diff --git a/education/get-started/images/msfe_manageapps_inventory_grouped.png b/education/get-started/images/msfe_manageapps_inventory_grouped.png deleted file mode 100644 index e2376d90b2..0000000000 Binary files a/education/get-started/images/msfe_manageapps_inventory_grouped.png and /dev/null differ diff --git a/education/get-started/images/msfe_manageapps_inventory_newappsselected.png b/education/get-started/images/msfe_manageapps_inventory_newappsselected.png deleted file mode 100644 index 1ef47ea1b9..0000000000 Binary files a/education/get-started/images/msfe_manageapps_inventory_newappsselected.png and /dev/null differ diff --git a/education/get-started/images/msfe_managementtools_activateintune.PNG b/education/get-started/images/msfe_managementtools_activateintune.PNG deleted file mode 100644 index efae378abd..0000000000 Binary files a/education/get-started/images/msfe_managementtools_activateintune.PNG and /dev/null differ diff --git a/education/get-started/images/msfe_managepage_storesettings_managementtools.png b/education/get-started/images/msfe_managepage_storesettings_managementtools.png deleted file mode 100644 index ac88d8e30f..0000000000 Binary files a/education/get-started/images/msfe_managepage_storesettings_managementtools.png and /dev/null differ diff --git a/education/get-started/images/msfe_managepage_storesettings_managementtoolspng.png b/education/get-started/images/msfe_managepage_storesettings_managementtoolspng.png deleted file mode 100644 index 77512f45bd..0000000000 Binary files a/education/get-started/images/msfe_managepage_storesettings_managementtoolspng.png and /dev/null differ diff --git a/education/get-started/images/msfe_services_agreement.PNG b/education/get-started/images/msfe_services_agreement.PNG deleted file mode 100644 index 1c25eaea3b..0000000000 Binary files a/education/get-started/images/msfe_services_agreement.PNG and /dev/null differ diff --git a/education/get-started/images/msfe_store_portal.PNG b/education/get-started/images/msfe_store_portal.PNG deleted file mode 100644 index 51850223e5..0000000000 Binary files a/education/get-started/images/msfe_store_portal.PNG and /dev/null differ diff --git a/education/get-started/images/msfe_storesettings_select_managementtools.png b/education/get-started/images/msfe_storesettings_select_managementtools.png deleted file mode 100644 index 06fe6aa274..0000000000 Binary files a/education/get-started/images/msfe_storesettings_select_managementtools.png and /dev/null differ diff --git a/education/get-started/images/o365_admincenter_gotosetup.PNG b/education/get-started/images/o365_admincenter_gotosetup.PNG deleted file mode 100644 index aea6f7fdb2..0000000000 Binary files a/education/get-started/images/o365_admincenter_gotosetup.PNG and /dev/null differ diff --git a/education/get-started/images/o365_admincenter_welcome.PNG b/education/get-started/images/o365_admincenter_welcome.PNG deleted file mode 100644 index 3f0721263f..0000000000 Binary files a/education/get-started/images/o365_admincenter_welcome.PNG and /dev/null differ diff --git a/education/get-started/images/o365_assignlicense.PNG b/education/get-started/images/o365_assignlicense.PNG deleted file mode 100644 index fd33cd2211..0000000000 Binary files a/education/get-started/images/o365_assignlicense.PNG and /dev/null differ diff --git a/education/get-started/images/o365_assignsdslicense.png b/education/get-started/images/o365_assignsdslicense.png deleted file mode 100644 index 08b0c0749c..0000000000 Binary files a/education/get-started/images/o365_assignsdslicense.png and /dev/null differ diff --git a/education/get-started/images/o365_createaccount.PNG b/education/get-started/images/o365_createaccount.PNG deleted file mode 100644 index 5aa71c9cf9..0000000000 Binary files a/education/get-started/images/o365_createaccount.PNG and /dev/null differ diff --git a/education/get-started/images/o365_msteams_settings.PNG b/education/get-started/images/o365_msteams_settings.PNG deleted file mode 100644 index 0e3dab4886..0000000000 Binary files a/education/get-started/images/o365_msteams_settings.PNG and /dev/null differ diff --git a/education/get-started/images/o365_msteams_turnon.PNG b/education/get-started/images/o365_msteams_turnon.PNG deleted file mode 100644 index 95588d5031..0000000000 Binary files a/education/get-started/images/o365_msteams_turnon.PNG and /dev/null differ diff --git a/education/get-started/images/o365_settings_services_msteams.PNG b/education/get-started/images/o365_settings_services_msteams.PNG deleted file mode 100644 index ca4dee07ac..0000000000 Binary files a/education/get-started/images/o365_settings_services_msteams.PNG and /dev/null differ diff --git a/education/get-started/images/o365_subscriptions_verifyclassroomsubscription.PNG b/education/get-started/images/o365_subscriptions_verifyclassroomsubscription.PNG deleted file mode 100644 index 1331ff75ed..0000000000 Binary files a/education/get-started/images/o365_subscriptions_verifyclassroomsubscription.PNG and /dev/null differ diff --git a/education/get-started/images/office365_admin_center.PNG b/education/get-started/images/office365_admin_center.PNG deleted file mode 100644 index 099bc314f4..0000000000 Binary files a/education/get-started/images/office365_admin_center.PNG and /dev/null differ diff --git a/education/get-started/images/office365_admin_center_assign_licenses.png b/education/get-started/images/office365_admin_center_assign_licenses.png deleted file mode 100644 index 6d20208748..0000000000 Binary files a/education/get-started/images/office365_admin_center_assign_licenses.png and /dev/null differ diff --git a/education/get-started/images/office365_admin_center_home.png b/education/get-started/images/office365_admin_center_home.png deleted file mode 100644 index bd2ab02a2c..0000000000 Binary files a/education/get-started/images/office365_admin_center_home.png and /dev/null differ diff --git a/education/get-started/images/office365_admin_center_product_licenses.png b/education/get-started/images/office365_admin_center_product_licenses.png deleted file mode 100644 index 11ffabe3ee..0000000000 Binary files a/education/get-started/images/office365_admin_center_product_licenses.png and /dev/null differ diff --git a/education/get-started/images/office365_admin_portal_add_new_user.png b/education/get-started/images/office365_admin_portal_add_new_user.png deleted file mode 100644 index b10fbf7660..0000000000 Binary files a/education/get-started/images/office365_admin_portal_add_new_user.png and /dev/null differ diff --git a/education/get-started/images/office365_create_new_class.png b/education/get-started/images/office365_create_new_class.png deleted file mode 100644 index 5befb87b99..0000000000 Binary files a/education/get-started/images/office365_create_new_class.png and /dev/null differ diff --git a/education/get-started/images/office365_start_page_classroom.png b/education/get-started/images/office365_start_page_classroom.png deleted file mode 100644 index ab229cead1..0000000000 Binary files a/education/get-started/images/office365_start_page_classroom.png and /dev/null differ diff --git a/education/get-started/images/office365_students_group_2.png b/education/get-started/images/office365_students_group_2.png deleted file mode 100644 index 6526fd3c8f..0000000000 Binary files a/education/get-started/images/office365_students_group_2.png and /dev/null differ diff --git a/education/get-started/images/oobe.jpg b/education/get-started/images/oobe.jpg deleted file mode 100644 index 53a5dab6bf..0000000000 Binary files a/education/get-started/images/oobe.jpg and /dev/null differ diff --git a/education/get-started/images/package.png b/education/get-started/images/package.png deleted file mode 100644 index f5e975e3e9..0000000000 Binary files a/education/get-started/images/package.png and /dev/null differ diff --git a/education/get-started/images/personalize_class_settings.png b/education/get-started/images/personalize_class_settings.png deleted file mode 100644 index cbe88c9c73..0000000000 Binary files a/education/get-started/images/personalize_class_settings.png and /dev/null differ diff --git a/education/get-started/images/privacy-contacts-marked.png b/education/get-started/images/privacy-contacts-marked.png deleted file mode 100644 index 54a3116408..0000000000 Binary files a/education/get-started/images/privacy-contacts-marked.png and /dev/null differ diff --git a/education/get-started/images/prov.jpg b/education/get-started/images/prov.jpg deleted file mode 100644 index 1593ccb36b..0000000000 Binary files a/education/get-started/images/prov.jpg and /dev/null differ diff --git a/education/get-started/images/reconfigure_intune_app_deployment_settings.png b/education/get-started/images/reconfigure_intune_app_deployment_settings.png deleted file mode 100644 index 90491aacd1..0000000000 Binary files a/education/get-started/images/reconfigure_intune_app_deployment_settings.png and /dev/null differ diff --git a/education/get-started/images/school.PNG b/education/get-started/images/school.PNG deleted file mode 100644 index f8be255a05..0000000000 Binary files a/education/get-started/images/school.PNG and /dev/null differ diff --git a/education/get-started/images/sds_add_new_profile.png b/education/get-started/images/sds_add_new_profile.png deleted file mode 100644 index 3728b2c8a8..0000000000 Binary files a/education/get-started/images/sds_add_new_profile.png and /dev/null differ diff --git a/education/get-started/images/sds_add_new_profile_062017.PNG b/education/get-started/images/sds_add_new_profile_062017.PNG deleted file mode 100644 index 84340eebb8..0000000000 Binary files a/education/get-started/images/sds_add_new_profile_062017.PNG and /dev/null differ diff --git a/education/get-started/images/sds_add_new_profile_062317.PNG b/education/get-started/images/sds_add_new_profile_062317.PNG deleted file mode 100644 index 5732ad597d..0000000000 Binary files a/education/get-started/images/sds_add_new_profile_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_add_newprofile.PNG b/education/get-started/images/sds_add_newprofile.PNG deleted file mode 100644 index 377e82a29b..0000000000 Binary files a/education/get-started/images/sds_add_newprofile.PNG and /dev/null differ diff --git a/education/get-started/images/sds_addnewprofile_studentoptions.PNG b/education/get-started/images/sds_addnewprofile_studentoptions.PNG deleted file mode 100644 index bacaed1642..0000000000 Binary files a/education/get-started/images/sds_addnewprofile_studentoptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_addnewprofile_syncoptions.PNG b/education/get-started/images/sds_addnewprofile_syncoptions.PNG deleted file mode 100644 index 4d99545389..0000000000 Binary files a/education/get-started/images/sds_addnewprofile_syncoptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_addnewprofile_teacheroptions.PNG b/education/get-started/images/sds_addnewprofile_teacheroptions.PNG deleted file mode 100644 index 0a4896048e..0000000000 Binary files a/education/get-started/images/sds_addnewprofile_teacheroptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_github_downloadsample.PNG b/education/get-started/images/sds_github_downloadsample.PNG deleted file mode 100644 index f3f1d33065..0000000000 Binary files a/education/get-started/images/sds_github_downloadsample.PNG and /dev/null differ diff --git a/education/get-started/images/sds_github_downloadsampledata.PNG b/education/get-started/images/sds_github_downloadsampledata.PNG deleted file mode 100644 index a83093879b..0000000000 Binary files a/education/get-started/images/sds_github_downloadsampledata.PNG and /dev/null differ diff --git a/education/get-started/images/sds_more_menu_items.PNG b/education/get-started/images/sds_more_menu_items.PNG deleted file mode 100644 index 1cb1a083ee..0000000000 Binary files a/education/get-started/images/sds_more_menu_items.PNG and /dev/null differ diff --git a/education/get-started/images/sds_portal.PNG b/education/get-started/images/sds_portal.PNG deleted file mode 100644 index c7a47f2d7d..0000000000 Binary files a/education/get-started/images/sds_portal.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_directoryoptions.PNG b/education/get-started/images/sds_profile_directoryoptions.PNG deleted file mode 100644 index dc1925ecc5..0000000000 Binary files a/education/get-started/images/sds_profile_directoryoptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_profilepage.PNG b/education/get-started/images/sds_profile_profilepage.PNG deleted file mode 100644 index 04e2193189..0000000000 Binary files a/education/get-started/images/sds_profile_profilepage.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_profilepage_062017.PNG b/education/get-started/images/sds_profile_profilepage_062017.PNG deleted file mode 100644 index 8621592542..0000000000 Binary files a/education/get-started/images/sds_profile_profilepage_062017.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_profilepage_settingup_062317.PNG b/education/get-started/images/sds_profile_profilepage_settingup_062317.PNG deleted file mode 100644 index 90fe34dbee..0000000000 Binary files a/education/get-started/images/sds_profile_profilepage_settingup_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_ready_for_sync.png b/education/get-started/images/sds_profile_ready_for_sync.png deleted file mode 100644 index f0d39b25c3..0000000000 Binary files a/education/get-started/images/sds_profile_ready_for_sync.png and /dev/null differ diff --git a/education/get-started/images/sds_profile_readytosync.PNG b/education/get-started/images/sds_profile_readytosync.PNG deleted file mode 100644 index 4e0c127208..0000000000 Binary files a/education/get-started/images/sds_profile_readytosync.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_reviewpage_062317.PNG b/education/get-started/images/sds_profile_reviewpage_062317.PNG deleted file mode 100644 index 676bed0efc..0000000000 Binary files a/education/get-started/images/sds_profile_reviewpage_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_settingup.PNG b/education/get-started/images/sds_profile_settingup.PNG deleted file mode 100644 index 19f3666b96..0000000000 Binary files a/education/get-started/images/sds_profile_settingup.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_status_everythingok_062317.png b/education/get-started/images/sds_profile_status_everythingok_062317.png deleted file mode 100644 index cdb487aced..0000000000 Binary files a/education/get-started/images/sds_profile_status_everythingok_062317.png and /dev/null differ diff --git a/education/get-started/images/sds_profile_status_syncerrors_062317.PNG b/education/get-started/images/sds_profile_status_syncerrors_062317.PNG deleted file mode 100644 index 6ae7ec5a31..0000000000 Binary files a/education/get-started/images/sds_profile_status_syncerrors_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_status_syncerrors_highlighted_062317.png b/education/get-started/images/sds_profile_status_syncerrors_highlighted_062317.png deleted file mode 100644 index 2cd58a3b21..0000000000 Binary files a/education/get-started/images/sds_profile_status_syncerrors_highlighted_062317.png and /dev/null differ diff --git a/education/get-started/images/sds_profile_status_syncinprogress_062317.PNG b/education/get-started/images/sds_profile_status_syncinprogress_062317.PNG deleted file mode 100644 index 2fd6208eca..0000000000 Binary files a/education/get-started/images/sds_profile_status_syncinprogress_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_status_syncinprogress_highlighted_062317.png b/education/get-started/images/sds_profile_status_syncinprogress_highlighted_062317.png deleted file mode 100644 index 407744d066..0000000000 Binary files a/education/get-started/images/sds_profile_status_syncinprogress_highlighted_062317.png and /dev/null differ diff --git a/education/get-started/images/sds_profile_student_options_062017.PNG b/education/get-started/images/sds_profile_student_options_062017.PNG deleted file mode 100644 index 4affc4dbfd..0000000000 Binary files a/education/get-started/images/sds_profile_student_options_062017.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_student_options_062317.PNG b/education/get-started/images/sds_profile_student_options_062317.PNG deleted file mode 100644 index 0d2102be7d..0000000000 Binary files a/education/get-started/images/sds_profile_student_options_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_studentoptions.PNG b/education/get-started/images/sds_profile_studentoptions.PNG deleted file mode 100644 index 87558a3881..0000000000 Binary files a/education/get-started/images/sds_profile_studentoptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_sync_options_062017.PNG b/education/get-started/images/sds_profile_sync_options_062017.PNG deleted file mode 100644 index 71df6f3d24..0000000000 Binary files a/education/get-started/images/sds_profile_sync_options_062017.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_sync_options_062317.PNG b/education/get-started/images/sds_profile_sync_options_062317.PNG deleted file mode 100644 index 1d02a0659a..0000000000 Binary files a/education/get-started/images/sds_profile_sync_options_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_syncenabled.PNG b/education/get-started/images/sds_profile_syncenabled.PNG deleted file mode 100644 index 197d2f0851..0000000000 Binary files a/education/get-started/images/sds_profile_syncenabled.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_syncoptions.PNG b/education/get-started/images/sds_profile_syncoptions.PNG deleted file mode 100644 index f7cd01262f..0000000000 Binary files a/education/get-started/images/sds_profile_syncoptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_teacher_options_062017.PNG b/education/get-started/images/sds_profile_teacher_options_062017.PNG deleted file mode 100644 index 7c8bdfae25..0000000000 Binary files a/education/get-started/images/sds_profile_teacher_options_062017.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_teacher_options_062317.PNG b/education/get-started/images/sds_profile_teacher_options_062317.PNG deleted file mode 100644 index ab9f2706b1..0000000000 Binary files a/education/get-started/images/sds_profile_teacher_options_062317.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_teacheroptions.PNG b/education/get-started/images/sds_profile_teacheroptions.PNG deleted file mode 100644 index 0a01ed2f96..0000000000 Binary files a/education/get-started/images/sds_profile_teacheroptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profile_wizard_start.PNG b/education/get-started/images/sds_profile_wizard_start.PNG deleted file mode 100644 index 7b2a797e5d..0000000000 Binary files a/education/get-started/images/sds_profile_wizard_start.PNG and /dev/null differ diff --git a/education/get-started/images/sds_profilepage.PNG b/education/get-started/images/sds_profilepage.PNG deleted file mode 100644 index 6e0047a2b1..0000000000 Binary files a/education/get-started/images/sds_profilepage.PNG and /dev/null differ diff --git a/education/get-started/images/sds_sample_csv_files.PNG b/education/get-started/images/sds_sample_csv_files.PNG deleted file mode 100644 index fbb37cec96..0000000000 Binary files a/education/get-started/images/sds_sample_csv_files.PNG and /dev/null differ diff --git a/education/get-started/images/sds_sample_csv_files_us_uk.PNG b/education/get-started/images/sds_sample_csv_files_us_uk.PNG deleted file mode 100644 index 349ee1366d..0000000000 Binary files a/education/get-started/images/sds_sample_csv_files_us_uk.PNG and /dev/null differ diff --git a/education/get-started/images/sds_sample_csvfiles.PNG b/education/get-started/images/sds_sample_csvfiles.PNG deleted file mode 100644 index e4932d9303..0000000000 Binary files a/education/get-started/images/sds_sample_csvfiles.PNG and /dev/null differ diff --git a/education/get-started/images/sds_sds_and_classroom_off.PNG b/education/get-started/images/sds_sds_and_classroom_off.PNG deleted file mode 100644 index 0b5409752d..0000000000 Binary files a/education/get-started/images/sds_sds_and_classroom_off.PNG and /dev/null differ diff --git a/education/get-started/images/sds_sds_on_newmenu_items.PNG b/education/get-started/images/sds_sds_on_newmenu_items.PNG deleted file mode 100644 index d6f2f9a79e..0000000000 Binary files a/education/get-started/images/sds_sds_on_newmenu_items.PNG and /dev/null differ diff --git a/education/get-started/images/sds_sds_on_newmenuitemsappear.PNG b/education/get-started/images/sds_sds_on_newmenuitemsappear.PNG deleted file mode 100644 index bec27dc781..0000000000 Binary files a/education/get-started/images/sds_sds_on_newmenuitemsappear.PNG and /dev/null differ diff --git a/education/get-started/images/sds_settings_first_signin.png b/education/get-started/images/sds_settings_first_signin.png deleted file mode 100644 index c60628fcd1..0000000000 Binary files a/education/get-started/images/sds_settings_first_signin.png and /dev/null differ diff --git a/education/get-started/images/sds_settings_manage_sds_firstsignin.PNG b/education/get-started/images/sds_settings_manage_sds_firstsignin.PNG deleted file mode 100644 index 6298721880..0000000000 Binary files a/education/get-started/images/sds_settings_manage_sds_firstsignin.PNG and /dev/null differ diff --git a/education/get-started/images/sds_settings_turnon_sds.png b/education/get-started/images/sds_settings_turnon_sds.png deleted file mode 100644 index 53c0c144a2..0000000000 Binary files a/education/get-started/images/sds_settings_turnon_sds.png and /dev/null differ diff --git a/education/get-started/images/sds_signin_settings.PNG b/education/get-started/images/sds_signin_settings.PNG deleted file mode 100644 index 54ff453249..0000000000 Binary files a/education/get-started/images/sds_signin_settings.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_addnewprofile.PNG b/education/get-started/images/sds_updated_addnewprofile.PNG deleted file mode 100644 index a3e2f5cea2..0000000000 Binary files a/education/get-started/images/sds_updated_addnewprofile.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_dashboard.PNG b/education/get-started/images/sds_updated_dashboard.PNG deleted file mode 100644 index 8c5c21afb1..0000000000 Binary files a/education/get-started/images/sds_updated_dashboard.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_menu.png b/education/get-started/images/sds_updated_menu.png deleted file mode 100644 index d4e066300f..0000000000 Binary files a/education/get-started/images/sds_updated_menu.png and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_name_syncmethod.PNG b/education/get-started/images/sds_updated_newprofile_name_syncmethod.PNG deleted file mode 100644 index 47c9906eb2..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_name_syncmethod.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_readytosync.png b/education/get-started/images/sds_updated_newprofile_readytosync.png deleted file mode 100644 index e10d725544..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_readytosync.png and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_review_1.PNG b/education/get-started/images/sds_updated_newprofile_review_1.PNG deleted file mode 100644 index f05ace66db..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_review_1.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_status_readytosync.png b/education/get-started/images/sds_updated_newprofile_status_readytosync.png deleted file mode 100644 index e6424e3aa9..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_status_readytosync.png and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_studentmapping.PNG b/education/get-started/images/sds_updated_newprofile_studentmapping.PNG deleted file mode 100644 index 97742bc9f1..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_studentmapping.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_studentmapping_1.PNG b/education/get-started/images/sds_updated_newprofile_studentmapping_1.PNG deleted file mode 100644 index 21efeb8bd7..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_studentmapping_1.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_studentmapping_updated.png b/education/get-started/images/sds_updated_newprofile_studentmapping_updated.png deleted file mode 100644 index 0a9a3682a0..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_studentmapping_updated.png and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_summary.PNG b/education/get-started/images/sds_updated_newprofile_summary.PNG deleted file mode 100644 index 3aeb90d58d..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_summary.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_syncoptions.PNG b/education/get-started/images/sds_updated_newprofile_syncoptions.PNG deleted file mode 100644 index 4deea4b14e..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_syncoptions.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_syncoptions_1.PNG b/education/get-started/images/sds_updated_newprofile_syncoptions_1.PNG deleted file mode 100644 index 507eab115f..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_syncoptions_1.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_syncoptions_updated.png b/education/get-started/images/sds_updated_newprofile_syncoptions_updated.png deleted file mode 100644 index ef36b45626..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_syncoptions_updated.png and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_teachermapping.PNG b/education/get-started/images/sds_updated_newprofile_teachermapping.PNG deleted file mode 100644 index f99947e982..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_teachermapping.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_teachermapping_1.PNG b/education/get-started/images/sds_updated_newprofile_teachermapping_1.PNG deleted file mode 100644 index 6f100a8afe..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_teachermapping_1.PNG and /dev/null differ diff --git a/education/get-started/images/sds_updated_newprofile_teachermapping_updated.png b/education/get-started/images/sds_updated_newprofile_teachermapping_updated.png deleted file mode 100644 index 6d625cc1a9..0000000000 Binary files a/education/get-started/images/sds_updated_newprofile_teachermapping_updated.png and /dev/null differ diff --git a/education/get-started/images/set_up_school_pcs_app.png b/education/get-started/images/set_up_school_pcs_app.png deleted file mode 100644 index b0a2a42112..0000000000 Binary files a/education/get-started/images/set_up_school_pcs_app.png and /dev/null differ diff --git a/education/get-started/images/setedupolicies_omauri.PNG b/education/get-started/images/setedupolicies_omauri.PNG deleted file mode 100644 index eb3d9e216c..0000000000 Binary files a/education/get-started/images/setedupolicies_omauri.PNG and /dev/null differ diff --git a/education/get-started/images/setedupolicies_wcd.PNG b/education/get-started/images/setedupolicies_wcd.PNG deleted file mode 100644 index e240063f68..0000000000 Binary files a/education/get-started/images/setedupolicies_wcd.PNG and /dev/null differ diff --git a/education/get-started/images/settings-contacts-app-marked.png b/education/get-started/images/settings-contacts-app-marked.png deleted file mode 100644 index 94523f1b36..0000000000 Binary files a/education/get-started/images/settings-contacts-app-marked.png and /dev/null differ diff --git a/education/get-started/images/settings-privacy-marked.png b/education/get-started/images/settings-privacy-marked.png deleted file mode 100644 index 513e9b1afc..0000000000 Binary files a/education/get-started/images/settings-privacy-marked.png and /dev/null differ diff --git a/education/get-started/images/setup-app-1-access.png b/education/get-started/images/setup-app-1-access.png deleted file mode 100644 index 1de1081d1d..0000000000 Binary files a/education/get-started/images/setup-app-1-access.png and /dev/null differ diff --git a/education/get-started/images/setup-app-1-usb.png b/education/get-started/images/setup-app-1-usb.png deleted file mode 100644 index b2d170244f..0000000000 Binary files a/education/get-started/images/setup-app-1-usb.png and /dev/null differ diff --git a/education/get-started/images/setup-app-1-wifi-manual.png b/education/get-started/images/setup-app-1-wifi-manual.png deleted file mode 100644 index 92de4f784c..0000000000 Binary files a/education/get-started/images/setup-app-1-wifi-manual.png and /dev/null differ diff --git a/education/get-started/images/setup-app-1-wifi.png b/education/get-started/images/setup-app-1-wifi.png deleted file mode 100644 index 9f305e081c..0000000000 Binary files a/education/get-started/images/setup-app-1-wifi.png and /dev/null differ diff --git a/education/get-started/images/setup-app-1.PNG b/education/get-started/images/setup-app-1.PNG deleted file mode 100644 index 1b88c5ac31..0000000000 Binary files a/education/get-started/images/setup-app-1.PNG and /dev/null differ diff --git a/education/get-started/images/setup-app-2-directions.png b/education/get-started/images/setup-app-2-directions.png deleted file mode 100644 index f245aafb2b..0000000000 Binary files a/education/get-started/images/setup-app-2-directions.png and /dev/null differ diff --git a/education/get-started/images/setup-app-3-directions.png b/education/get-started/images/setup-app-3-directions.png deleted file mode 100644 index f593ea7371..0000000000 Binary files a/education/get-started/images/setup-app-3-directions.png and /dev/null differ diff --git a/education/get-started/images/setup-app-all-done.png b/education/get-started/images/setup-app-all-done.png deleted file mode 100644 index af7343f0e5..0000000000 Binary files a/education/get-started/images/setup-app-all-done.png and /dev/null differ diff --git a/education/get-started/images/setup-options.png b/education/get-started/images/setup-options.png deleted file mode 100644 index 07d29576a0..0000000000 Binary files a/education/get-started/images/setup-options.png and /dev/null differ diff --git a/education/get-started/images/setup_class_notebook.png b/education/get-started/images/setup_class_notebook.png deleted file mode 100644 index 2ede37e177..0000000000 Binary files a/education/get-started/images/setup_class_notebook.png and /dev/null differ diff --git a/education/get-started/images/setupmsg.jpg b/education/get-started/images/setupmsg.jpg deleted file mode 100644 index 12935483c5..0000000000 Binary files a/education/get-started/images/setupmsg.jpg and /dev/null differ diff --git a/education/get-started/images/sign-in-prov.png b/education/get-started/images/sign-in-prov.png deleted file mode 100644 index 55c9276203..0000000000 Binary files a/education/get-started/images/sign-in-prov.png and /dev/null differ diff --git a/education/get-started/images/signin.jpg b/education/get-started/images/signin.jpg deleted file mode 100644 index ad31bb31c4..0000000000 Binary files a/education/get-started/images/signin.jpg and /dev/null differ diff --git a/education/get-started/images/skype-manage-profile-pic.png b/education/get-started/images/skype-manage-profile-pic.png deleted file mode 100644 index 4133ac9c60..0000000000 Binary files a/education/get-started/images/skype-manage-profile-pic.png and /dev/null differ diff --git a/education/get-started/images/skype-profile-icon.png b/education/get-started/images/skype-profile-icon.png deleted file mode 100644 index 7ccaaea693..0000000000 Binary files a/education/get-started/images/skype-profile-icon.png and /dev/null differ diff --git a/education/get-started/images/skype_uwp_manageprofilepic.PNG b/education/get-started/images/skype_uwp_manageprofilepic.PNG deleted file mode 100644 index bdcf23dbc2..0000000000 Binary files a/education/get-started/images/skype_uwp_manageprofilepic.PNG and /dev/null differ diff --git a/education/get-started/images/skype_uwp_userprofile_icon.PNG b/education/get-started/images/skype_uwp_userprofile_icon.PNG deleted file mode 100644 index ad36c7f886..0000000000 Binary files a/education/get-started/images/skype_uwp_userprofile_icon.PNG and /dev/null differ diff --git a/education/get-started/images/store_for_business_management_tool_activation.png b/education/get-started/images/store_for_business_management_tool_activation.png deleted file mode 100644 index 9c68d4efe6..0000000000 Binary files a/education/get-started/images/store_for_business_management_tool_activation.png and /dev/null differ diff --git a/education/get-started/images/suspc_account_signin.PNG b/education/get-started/images/suspc_account_signin.PNG deleted file mode 100644 index d045cff914..0000000000 Binary files a/education/get-started/images/suspc_account_signin.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_and_wcd_comparison.png b/education/get-started/images/suspc_and_wcd_comparison.png deleted file mode 100644 index cff874ceb8..0000000000 Binary files a/education/get-started/images/suspc_and_wcd_comparison.png and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_apps.PNG b/education/get-started/images/suspc_choosesettings_apps.PNG deleted file mode 100644 index babb55a445..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_apps.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_settings.PNG b/education/get-started/images/suspc_choosesettings_settings.PNG deleted file mode 100644 index bd556c0892..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_settings.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_settings_updated.PNG b/education/get-started/images/suspc_choosesettings_settings_updated.PNG deleted file mode 100644 index c62b4fa86f..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_settings_updated.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_setuptakeatest.PNG b/education/get-started/images/suspc_choosesettings_setuptakeatest.PNG deleted file mode 100644 index 8ffc3fe3e6..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_setuptakeatest.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_signin.PNG b/education/get-started/images/suspc_choosesettings_signin.PNG deleted file mode 100644 index a45a12fbf5..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_signin.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_signin_final.PNG b/education/get-started/images/suspc_choosesettings_signin_final.PNG deleted file mode 100644 index 3ec997cb73..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_signin_final.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_summary.PNG b/education/get-started/images/suspc_choosesettings_summary.PNG deleted file mode 100644 index c659a579e4..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_summary.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_takeatest.PNG b/education/get-started/images/suspc_choosesettings_takeatest.PNG deleted file mode 100644 index 9f9f028852..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_takeatest.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_choosesettings_takeatest_updated.png b/education/get-started/images/suspc_choosesettings_takeatest_updated.png deleted file mode 100644 index e44dd21207..0000000000 Binary files a/education/get-started/images/suspc_choosesettings_takeatest_updated.png and /dev/null differ diff --git a/education/get-started/images/suspc_getpcsready.PNG b/education/get-started/images/suspc_getpcsready.PNG deleted file mode 100644 index 1e2bfae0ff..0000000000 Binary files a/education/get-started/images/suspc_getpcsready.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_getpcsready_getpcsready.PNG b/education/get-started/images/suspc_getpcsready_getpcsready.PNG deleted file mode 100644 index 6bb9ec078b..0000000000 Binary files a/education/get-started/images/suspc_getpcsready_getpcsready.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_getpcsready_installpackage.PNG b/education/get-started/images/suspc_getpcsready_installpackage.PNG deleted file mode 100644 index c12bbe4de9..0000000000 Binary files a/education/get-started/images/suspc_getpcsready_installpackage.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_getstarted.PNG b/education/get-started/images/suspc_getstarted.PNG deleted file mode 100644 index cbb3d4977c..0000000000 Binary files a/education/get-started/images/suspc_getstarted.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_getstarted_050817.PNG b/education/get-started/images/suspc_getstarted_050817.PNG deleted file mode 100644 index 124905676a..0000000000 Binary files a/education/get-started/images/suspc_getstarted_050817.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_getstarted_final.PNG b/education/get-started/images/suspc_getstarted_final.PNG deleted file mode 100644 index d533536ad1..0000000000 Binary files a/education/get-started/images/suspc_getstarted_final.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_getstarted_resized.png b/education/get-started/images/suspc_getstarted_resized.png deleted file mode 100644 index c9c99d8555..0000000000 Binary files a/education/get-started/images/suspc_getstarted_resized.png and /dev/null differ diff --git a/education/get-started/images/suspc_installsetupfile.PNG b/education/get-started/images/suspc_installsetupfile.PNG deleted file mode 100644 index 61d0d9a3ad..0000000000 Binary files a/education/get-started/images/suspc_installsetupfile.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_ppkg_isready.PNG b/education/get-started/images/suspc_ppkg_isready.PNG deleted file mode 100644 index e601a05a0f..0000000000 Binary files a/education/get-started/images/suspc_ppkg_isready.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_ppkgready.PNG b/education/get-started/images/suspc_ppkgready.PNG deleted file mode 100644 index e285acdaee..0000000000 Binary files a/education/get-started/images/suspc_ppkgready.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_reviewsettings.PNG b/education/get-started/images/suspc_reviewsettings.PNG deleted file mode 100644 index 0948dbccb1..0000000000 Binary files a/education/get-started/images/suspc_reviewsettings.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_reviewsettings_bluelinks.png b/education/get-started/images/suspc_reviewsettings_bluelinks.png deleted file mode 100644 index 46c07c7a1a..0000000000 Binary files a/education/get-started/images/suspc_reviewsettings_bluelinks.png and /dev/null differ diff --git a/education/get-started/images/suspc_savepackage_insertusb.PNG b/education/get-started/images/suspc_savepackage_insertusb.PNG deleted file mode 100644 index e5f9968d7e..0000000000 Binary files a/education/get-started/images/suspc_savepackage_insertusb.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_savesettings.PNG b/education/get-started/images/suspc_savesettings.PNG deleted file mode 100644 index f8338d3dec..0000000000 Binary files a/education/get-started/images/suspc_savesettings.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_setup_removemediamessage.png b/education/get-started/images/suspc_setup_removemediamessage.png deleted file mode 100644 index 94e9ddb900..0000000000 Binary files a/education/get-started/images/suspc_setup_removemediamessage.png and /dev/null differ diff --git a/education/get-started/images/suspc_setupfile_reviewsettings.PNG b/education/get-started/images/suspc_setupfile_reviewsettings.PNG deleted file mode 100644 index c5f3425ff5..0000000000 Binary files a/education/get-started/images/suspc_setupfile_reviewsettings.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_setupfile_savesettings.PNG b/education/get-started/images/suspc_setupfile_savesettings.PNG deleted file mode 100644 index 97ba234b8e..0000000000 Binary files a/education/get-started/images/suspc_setupfile_savesettings.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_setupfileready.PNG b/education/get-started/images/suspc_setupfileready.PNG deleted file mode 100644 index 349acbaf9d..0000000000 Binary files a/education/get-started/images/suspc_setupfileready.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_signin_account.PNG b/education/get-started/images/suspc_signin_account.PNG deleted file mode 100644 index 3f8b040f45..0000000000 Binary files a/education/get-started/images/suspc_signin_account.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_signin_addapps.PNG b/education/get-started/images/suspc_signin_addapps.PNG deleted file mode 100644 index 93e572a043..0000000000 Binary files a/education/get-started/images/suspc_signin_addapps.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_signin_allowguests.PNG b/education/get-started/images/suspc_signin_allowguests.PNG deleted file mode 100644 index 0bd0f69680..0000000000 Binary files a/education/get-started/images/suspc_signin_allowguests.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_signin_setuptakeatest.PNG b/education/get-started/images/suspc_signin_setuptakeatest.PNG deleted file mode 100644 index 6c8ba1799b..0000000000 Binary files a/education/get-started/images/suspc_signin_setuptakeatest.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_start.PNG b/education/get-started/images/suspc_start.PNG deleted file mode 100644 index ab34f99a6b..0000000000 Binary files a/education/get-started/images/suspc_start.PNG and /dev/null differ diff --git a/education/get-started/images/suspc_studentpcsetup_installingsetupfile.png b/education/get-started/images/suspc_studentpcsetup_installingsetupfile.png deleted file mode 100644 index bbd10c89c4..0000000000 Binary files a/education/get-started/images/suspc_studentpcsetup_installingsetupfile.png and /dev/null differ diff --git a/education/get-started/images/suspc_wcd_featureslist.png b/education/get-started/images/suspc_wcd_featureslist.png deleted file mode 100644 index 32b9211799..0000000000 Binary files a/education/get-started/images/suspc_wcd_featureslist.png and /dev/null differ diff --git a/education/get-started/images/suspc_wcd_sidebyside.png b/education/get-started/images/suspc_wcd_sidebyside.png deleted file mode 100644 index 7fc108133e..0000000000 Binary files a/education/get-started/images/suspc_wcd_sidebyside.png and /dev/null differ diff --git a/education/get-started/images/suspc_win10v1703_getstarted.PNG b/education/get-started/images/suspc_win10v1703_getstarted.PNG deleted file mode 100644 index 2777edfef9..0000000000 Binary files a/education/get-started/images/suspc_win10v1703_getstarted.PNG and /dev/null differ diff --git a/education/get-started/images/take-a-test-flow.png b/education/get-started/images/take-a-test-flow.png deleted file mode 100644 index a5135c1822..0000000000 Binary files a/education/get-started/images/take-a-test-flow.png and /dev/null differ diff --git a/education/get-started/images/take_a_test_flow.png b/education/get-started/images/take_a_test_flow.png deleted file mode 100644 index 261813c7f8..0000000000 Binary files a/education/get-started/images/take_a_test_flow.png and /dev/null differ diff --git a/education/get-started/images/take_a_test_flow_dark.png b/education/get-started/images/take_a_test_flow_dark.png deleted file mode 100644 index 98255e8694..0000000000 Binary files a/education/get-started/images/take_a_test_flow_dark.png and /dev/null differ diff --git a/education/get-started/images/take_a_test_workflow.png b/education/get-started/images/take_a_test_workflow.png deleted file mode 100644 index a4c7a84686..0000000000 Binary files a/education/get-started/images/take_a_test_workflow.png and /dev/null differ diff --git a/education/get-started/images/tat_settingsapp_setupaccount_addtestaccount.PNG b/education/get-started/images/tat_settingsapp_setupaccount_addtestaccount.PNG deleted file mode 100644 index 66c28eccc7..0000000000 Binary files a/education/get-started/images/tat_settingsapp_setupaccount_addtestaccount.PNG and /dev/null differ diff --git a/education/get-started/images/tat_settingsapp_setuptesttakingaccount.PNG b/education/get-started/images/tat_settingsapp_setuptesttakingaccount.PNG deleted file mode 100644 index 70a917d836..0000000000 Binary files a/education/get-started/images/tat_settingsapp_setuptesttakingaccount.PNG and /dev/null differ diff --git a/education/get-started/images/tat_settingsapp_setuptesttakingaccount_1703.PNG b/education/get-started/images/tat_settingsapp_setuptesttakingaccount_1703.PNG deleted file mode 100644 index deb04f2e74..0000000000 Binary files a/education/get-started/images/tat_settingsapp_setuptesttakingaccount_1703.PNG and /dev/null differ diff --git a/education/get-started/images/tat_settingsapp_workorschoolaccess_setuptestaccount.PNG b/education/get-started/images/tat_settingsapp_workorschoolaccess_setuptestaccount.PNG deleted file mode 100644 index c9221ed95a..0000000000 Binary files a/education/get-started/images/tat_settingsapp_workorschoolaccess_setuptestaccount.PNG and /dev/null differ diff --git a/education/get-started/images/teacher-get-app.PNG b/education/get-started/images/teacher-get-app.PNG deleted file mode 100644 index 329607edb9..0000000000 Binary files a/education/get-started/images/teacher-get-app.PNG and /dev/null differ diff --git a/education/get-started/images/teacher.PNG b/education/get-started/images/teacher.PNG deleted file mode 100644 index 286d515624..0000000000 Binary files a/education/get-started/images/teacher.PNG and /dev/null differ diff --git a/education/get-started/images/test-account-icd.PNG b/education/get-started/images/test-account-icd.PNG deleted file mode 100644 index 4fd9bf3f28..0000000000 Binary files a/education/get-started/images/test-account-icd.PNG and /dev/null differ diff --git a/education/get-started/images/trust-package.png b/education/get-started/images/trust-package.png deleted file mode 100644 index 8a293ea4da..0000000000 Binary files a/education/get-started/images/trust-package.png and /dev/null differ diff --git a/education/get-started/images/uwp-dependencies.PNG b/education/get-started/images/uwp-dependencies.PNG deleted file mode 100644 index 4e2563169f..0000000000 Binary files a/education/get-started/images/uwp-dependencies.PNG and /dev/null differ diff --git a/education/get-started/images/uwp-family.PNG b/education/get-started/images/uwp-family.PNG deleted file mode 100644 index bec731eec4..0000000000 Binary files a/education/get-started/images/uwp-family.PNG and /dev/null differ diff --git a/education/get-started/images/uwp-license.PNG b/education/get-started/images/uwp-license.PNG deleted file mode 100644 index ccb5cf7cf4..0000000000 Binary files a/education/get-started/images/uwp-license.PNG and /dev/null differ diff --git a/education/get-started/images/verify_pc_aad_joined_and_intune_managed.png b/education/get-started/images/verify_pc_aad_joined_and_intune_managed.png deleted file mode 100644 index 5ee6354a01..0000000000 Binary files a/education/get-started/images/verify_pc_aad_joined_and_intune_managed.png and /dev/null differ diff --git a/education/get-started/images/wcd_accountmanagement.PNG b/education/get-started/images/wcd_accountmanagement.PNG deleted file mode 100644 index 071522f906..0000000000 Binary files a/education/get-started/images/wcd_accountmanagement.PNG and /dev/null differ diff --git a/education/get-started/images/wcd_exportpackage.PNG b/education/get-started/images/wcd_exportpackage.PNG deleted file mode 100644 index 19a1c89703..0000000000 Binary files a/education/get-started/images/wcd_exportpackage.PNG and /dev/null differ diff --git a/education/get-started/images/wcd_settings_assignedaccess.PNG b/education/get-started/images/wcd_settings_assignedaccess.PNG deleted file mode 100644 index 443a5d0688..0000000000 Binary files a/education/get-started/images/wcd_settings_assignedaccess.PNG and /dev/null differ diff --git a/education/get-started/images/wcd_setupdevice.PNG b/education/get-started/images/wcd_setupdevice.PNG deleted file mode 100644 index 01422870d4..0000000000 Binary files a/education/get-started/images/wcd_setupdevice.PNG and /dev/null differ diff --git a/education/get-started/images/wcd_setupnetwork.PNG b/education/get-started/images/wcd_setupnetwork.PNG deleted file mode 100644 index f0be6908f5..0000000000 Binary files a/education/get-started/images/wcd_setupnetwork.PNG and /dev/null differ diff --git a/education/get-started/images/wcd_win10v1703_start_newdesktopproject.PNG b/education/get-started/images/wcd_win10v1703_start_newdesktopproject.PNG deleted file mode 100644 index f0ce8f6b93..0000000000 Binary files a/education/get-started/images/wcd_win10v1703_start_newdesktopproject.PNG and /dev/null differ diff --git a/education/get-started/images/who-owns-pc.png b/education/get-started/images/who-owns-pc.png deleted file mode 100644 index d3ce1def8d..0000000000 Binary files a/education/get-started/images/who-owns-pc.png and /dev/null differ diff --git a/education/get-started/images/win-10-activated-enterprise-subscription-active.png b/education/get-started/images/win-10-activated-enterprise-subscription-active.png deleted file mode 100644 index eb888b23b5..0000000000 Binary files a/education/get-started/images/win-10-activated-enterprise-subscription-active.png and /dev/null differ diff --git a/education/get-started/images/win-10-activated-enterprise-subscription-not-active.png b/education/get-started/images/win-10-activated-enterprise-subscription-not-active.png deleted file mode 100644 index e4ac7398be..0000000000 Binary files a/education/get-started/images/win-10-activated-enterprise-subscription-not-active.png and /dev/null differ diff --git a/education/get-started/images/win-10-not-activated-enterprise-subscription-active.png b/education/get-started/images/win-10-not-activated-enterprise-subscription-active.png deleted file mode 100644 index 5fedfe5d06..0000000000 Binary files a/education/get-started/images/win-10-not-activated-enterprise-subscription-active.png and /dev/null differ diff --git a/education/get-started/images/win-10-not-activated-enterprise-subscription-not-active.png b/education/get-started/images/win-10-not-activated-enterprise-subscription-not-active.png deleted file mode 100644 index 84e39071db..0000000000 Binary files a/education/get-started/images/win-10-not-activated-enterprise-subscription-not-active.png and /dev/null differ diff --git a/education/get-started/images/win-10-pro-edu-activated-subscription-active.png b/education/get-started/images/win-10-pro-edu-activated-subscription-active.png deleted file mode 100644 index d29fa0e0e5..0000000000 Binary files a/education/get-started/images/win-10-pro-edu-activated-subscription-active.png and /dev/null differ diff --git a/education/get-started/images/win-10-pro-edu-not-activated-subscription-active.PNG b/education/get-started/images/win-10-pro-edu-not-activated-subscription-active.PNG deleted file mode 100644 index 8e9242c0ba..0000000000 Binary files a/education/get-started/images/win-10-pro-edu-not-activated-subscription-active.PNG and /dev/null differ diff --git a/education/get-started/images/win10-connect-to-work-or-school.png b/education/get-started/images/win10-connect-to-work-or-school.png deleted file mode 100644 index 08afb5b092..0000000000 Binary files a/education/get-started/images/win10-connect-to-work-or-school.png and /dev/null differ diff --git a/education/get-started/images/win10-lets-get-2.png b/education/get-started/images/win10-lets-get-2.png deleted file mode 100644 index c2d3c3ba61..0000000000 Binary files a/education/get-started/images/win10-lets-get-2.png and /dev/null differ diff --git a/education/get-started/images/win10-set-up-work-or-school.png b/education/get-started/images/win10-set-up-work-or-school.png deleted file mode 100644 index 0ca83fb0e1..0000000000 Binary files a/education/get-started/images/win10-set-up-work-or-school.png and /dev/null differ diff --git a/education/get-started/images/win10_1703_oobe_firstscreen.png b/education/get-started/images/win10_1703_oobe_firstscreen.png deleted file mode 100644 index 0d5343d0b4..0000000000 Binary files a/education/get-started/images/win10_1703_oobe_firstscreen.png and /dev/null differ diff --git a/education/get-started/images/win10_confirmaadj.png b/education/get-started/images/win10_confirmaadj.png deleted file mode 100644 index 410d7a9c81..0000000000 Binary files a/education/get-started/images/win10_confirmaadj.png and /dev/null differ diff --git a/education/get-started/images/win10_connectedtoorgmdm.png b/education/get-started/images/win10_connectedtoorgmdm.png deleted file mode 100644 index ea1d0c0c26..0000000000 Binary files a/education/get-started/images/win10_connectedtoorgmdm.png and /dev/null differ diff --git a/education/get-started/images/win10_letsgetyousignedin.png b/education/get-started/images/win10_letsgetyousignedin.png deleted file mode 100644 index 8da483d1d3..0000000000 Binary files a/education/get-started/images/win10_letsgetyousignedin.png and /dev/null differ diff --git a/education/get-started/images/win10_letsstartwithregion.png b/education/get-started/images/win10_letsstartwithregion.png deleted file mode 100644 index 03b6cc3bbe..0000000000 Binary files a/education/get-started/images/win10_letsstartwithregion.png and /dev/null differ diff --git a/education/get-started/images/win10_oobe_complete.png b/education/get-started/images/win10_oobe_complete.png deleted file mode 100644 index 54677a6fc2..0000000000 Binary files a/education/get-started/images/win10_oobe_complete.png and /dev/null differ diff --git a/education/get-started/images/win10_oobe_letsgetyousignedin.png b/education/get-started/images/win10_oobe_letsgetyousignedin.png deleted file mode 100644 index fa7407a271..0000000000 Binary files a/education/get-started/images/win10_oobe_letsgetyousignedin.png and /dev/null differ diff --git a/education/get-started/images/win10_recentlyaddedappslist.png b/education/get-started/images/win10_recentlyaddedappslist.png deleted file mode 100644 index 2f56f8f500..0000000000 Binary files a/education/get-started/images/win10_recentlyaddedappslist.png and /dev/null differ diff --git a/education/get-started/images/win10_settings_accounts_aadjoined_confirmation.png b/education/get-started/images/win10_settings_accounts_aadjoined_confirmation.png deleted file mode 100644 index 0a188d75ed..0000000000 Binary files a/education/get-started/images/win10_settings_accounts_aadjoined_confirmation.png and /dev/null differ diff --git a/education/get-started/images/win10_settings_privacy.PNG b/education/get-started/images/win10_settings_privacy.PNG deleted file mode 100644 index 5285ce94f2..0000000000 Binary files a/education/get-started/images/win10_settings_privacy.PNG and /dev/null differ diff --git a/education/get-started/images/win10_settings_privacy_contacts.PNG b/education/get-started/images/win10_settings_privacy_contacts.PNG deleted file mode 100644 index f17ef60de0..0000000000 Binary files a/education/get-started/images/win10_settings_privacy_contacts.PNG and /dev/null differ diff --git a/education/get-started/images/win10_settings_privacy_contacts_apps.png b/education/get-started/images/win10_settings_privacy_contacts_apps.png deleted file mode 100644 index 774f18fad9..0000000000 Binary files a/education/get-started/images/win10_settings_privacy_contacts_apps.png and /dev/null differ diff --git a/education/get-started/images/win10_setupforanorg.png b/education/get-started/images/win10_setupforanorg.png deleted file mode 100644 index 517bf138fb..0000000000 Binary files a/education/get-started/images/win10_setupforanorg.png and /dev/null differ diff --git a/education/get-started/images/win10_start_checkapps.png b/education/get-started/images/win10_start_checkapps.png deleted file mode 100644 index 7fd7bd2219..0000000000 Binary files a/education/get-started/images/win10_start_checkapps.png and /dev/null differ diff --git a/education/get-started/images/windows-10-for-education-banner.png b/education/get-started/images/windows-10-for-education-banner.png deleted file mode 100644 index cf33adc9b6..0000000000 Binary files a/education/get-started/images/windows-10-for-education-banner.png and /dev/null differ diff --git a/education/get-started/images/windows-ad-connect.png b/education/get-started/images/windows-ad-connect.png deleted file mode 100644 index 97a69d1a6c..0000000000 Binary files a/education/get-started/images/windows-ad-connect.png and /dev/null differ diff --git a/education/get-started/images/windows-choose-how.png b/education/get-started/images/windows-choose-how.png deleted file mode 100644 index 8e84535bfd..0000000000 Binary files a/education/get-started/images/windows-choose-how.png and /dev/null differ diff --git a/education/get-started/images/windows-connect-to-work-or-school.png b/education/get-started/images/windows-connect-to-work-or-school.png deleted file mode 100644 index 90e1b1131f..0000000000 Binary files a/education/get-started/images/windows-connect-to-work-or-school.png and /dev/null differ diff --git a/education/get-started/images/windows-lets-get-2.png b/education/get-started/images/windows-lets-get-2.png deleted file mode 100644 index ef523d4af8..0000000000 Binary files a/education/get-started/images/windows-lets-get-2.png and /dev/null differ diff --git a/education/get-started/images/windows-lets-get.png b/education/get-started/images/windows-lets-get.png deleted file mode 100644 index 582da1ab2d..0000000000 Binary files a/education/get-started/images/windows-lets-get.png and /dev/null differ diff --git a/education/get-started/images/windows-set-up-work-or-school.png b/education/get-started/images/windows-set-up-work-or-school.png deleted file mode 100644 index cebd87cff8..0000000000 Binary files a/education/get-started/images/windows-set-up-work-or-school.png and /dev/null differ diff --git a/education/get-started/images/windows-sign-in.png b/education/get-started/images/windows-sign-in.png deleted file mode 100644 index 3029d3ef2b..0000000000 Binary files a/education/get-started/images/windows-sign-in.png and /dev/null differ diff --git a/education/get-started/images/windows-who-owns.png b/education/get-started/images/windows-who-owns.png deleted file mode 100644 index c3008869d2..0000000000 Binary files a/education/get-started/images/windows-who-owns.png and /dev/null differ diff --git a/education/get-started/images/windows.png b/education/get-started/images/windows.png deleted file mode 100644 index 9b312d7844..0000000000 Binary files a/education/get-started/images/windows.png and /dev/null differ diff --git a/education/get-started/images/wsfb-minecraft-vl.png b/education/get-started/images/wsfb-minecraft-vl.png deleted file mode 100644 index e3fe6de6d7..0000000000 Binary files a/education/get-started/images/wsfb-minecraft-vl.png and /dev/null differ diff --git a/education/get-started/images/wsfb_manage_inventory.PNG b/education/get-started/images/wsfb_manage_inventory.PNG deleted file mode 100644 index 66bc03d301..0000000000 Binary files a/education/get-started/images/wsfb_manage_inventory.PNG and /dev/null differ diff --git a/education/get-started/images/wsfb_manage_inventory_annotated.png b/education/get-started/images/wsfb_manage_inventory_annotated.png deleted file mode 100644 index aa37e0a43f..0000000000 Binary files a/education/get-started/images/wsfb_manage_inventory_annotated.png and /dev/null differ diff --git a/education/get-started/images/wsfb_newportal.PNG b/education/get-started/images/wsfb_newportal.PNG deleted file mode 100644 index 3ec546e8bc..0000000000 Binary files a/education/get-started/images/wsfb_newportal.PNG and /dev/null differ diff --git a/education/get-started/images/wsfb_newportal_manage.PNG b/education/get-started/images/wsfb_newportal_manage.PNG deleted file mode 100644 index 7aa94bccc9..0000000000 Binary files a/education/get-started/images/wsfb_newportal_manage.PNG and /dev/null differ diff --git a/education/get-started/images/wsfb_newportal_manage_managementtools_activate.PNG b/education/get-started/images/wsfb_newportal_manage_managementtools_activate.PNG deleted file mode 100644 index 74b7aec1ff..0000000000 Binary files a/education/get-started/images/wsfb_newportal_manage_managementtools_activate.PNG and /dev/null differ diff --git a/education/get-started/images/wsfb_newportal_manage_storesettings.PNG b/education/get-started/images/wsfb_newportal_manage_storesettings.PNG deleted file mode 100644 index 5278b9907e..0000000000 Binary files a/education/get-started/images/wsfb_newportal_manage_storesettings.PNG and /dev/null differ diff --git a/education/get-started/images/wsfb_portal.png b/education/get-started/images/wsfb_portal.png deleted file mode 100644 index 2d47885e97..0000000000 Binary files a/education/get-started/images/wsfb_portal.png and /dev/null differ diff --git a/education/get-started/images/wsfb_portal_activate_intune.PNG b/education/get-started/images/wsfb_portal_activate_intune.PNG deleted file mode 100644 index 5c05362ebf..0000000000 Binary files a/education/get-started/images/wsfb_portal_activate_intune.PNG and /dev/null differ diff --git a/education/get-started/images/wsfb_settings_management_tools.png b/education/get-started/images/wsfb_settings_management_tools.png deleted file mode 100644 index afdb61150b..0000000000 Binary files a/education/get-started/images/wsfb_settings_management_tools.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_education_enabled_for_org.png b/education/get-started/images/wsfb_win10_pro_education_enabled_for_org.png deleted file mode 100644 index ea3d582d79..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_education_enabled_for_org.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_education_launch.png b/education/get-started/images/wsfb_win10_pro_education_launch.png deleted file mode 100644 index 4e7b741227..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_education_launch.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_education_order_confirmation.png b/education/get-started/images/wsfb_win10_pro_education_order_confirmation.png deleted file mode 100644 index e35bbf64d5..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_education_order_confirmation.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_education_order_options.png b/education/get-started/images/wsfb_win10_pro_education_order_options.png deleted file mode 100644 index eaf93ece33..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_education_order_options.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_education_refund_confirmation.png b/education/get-started/images/wsfb_win10_pro_education_refund_confirmation.png deleted file mode 100644 index 4749dafc44..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_education_refund_confirmation.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_education_refund_order.png b/education/get-started/images/wsfb_win10_pro_education_refund_order.png deleted file mode 100644 index 813cfce309..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_education_refund_order.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_disable.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_disable.png deleted file mode 100644 index 92aeb8ed19..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_disable.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_eligibility_page.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_eligibility_page.png deleted file mode 100644 index 177c6e36df..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_eligibility_page.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_email_global_admins.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_email_global_admins.png deleted file mode 100644 index 8044a4cc91..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_email_global_admins.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_enable.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_enable.png deleted file mode 100644 index 420b44513f..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_enable.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_summary.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_summary.png deleted file mode 100644 index a507f56694..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_summary.png and /dev/null differ diff --git a/education/get-started/images/wsfb_win10_pro_to_proedu_email_upgrade_link.png b/education/get-started/images/wsfb_win10_pro_to_proedu_email_upgrade_link.png deleted file mode 100644 index a30869b8ea..0000000000 Binary files a/education/get-started/images/wsfb_win10_pro_to_proedu_email_upgrade_link.png and /dev/null differ diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md deleted file mode 100644 index d8c3f7273d..0000000000 --- a/education/get-started/inclusive-classroom-it-admin.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Inclusive Classroom IT Admin Guide -description: Learning which Inclusive Classroom features are available in which apps and in which versions of Microsoft Office. -keywords: Inclusive Classroom, Admin, Administrator, Microsoft Intune, Intune, Ease of Access, Office 365, account -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: article -ms.localizationpriority: medium -ms.pagetype: edu -ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin -ms.date: 06/12/2018 -ms.reviewer: -manager: dansimp ---- - -# Inclusive Classroom IT Admin Guide -The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Microsoft Office. -You will also learn how to deploy apps using Microsoft Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription. - -1. [Inclusive Classroom features](#features) -2. [Deploying apps with Microsoft Intune](#intune) -3. [How to show/hide the Ease of Access settings for text in Windows 10](#ease) -4. [How to change your Office 365 account from monthly, semi-annual, or yearly](#account) - -## Inclusive Classroom features - -| Reading features | Available in which apps | Office 2016 MSI | Office 2019 | Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | -|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------| -| Read aloud with simultaneous highlighting |
          • OneNote 2016 (add-in), OneNote in a browser, OneNote for Windows 10, OneNote for iPad, OneNote Mac
          • Word 2016, Word in a browser, Word Mac, Word for iOS
          • Outlook 2016, Outlook Web Access
          • Office Lens on iOS, Android
          |

          X

          (N/A for Word for iOS, Word in a browser, Outlook Web Access, or Office Lens)

          |

          X

          (N/A for Word for iOS, Word in a browser, Outlook Web Access, or Office Lens)

          |

          X

          |

          X

          (N/A for Outlook PC)

          |

          X

          (N/A for any OneNote apps or Outlook PC)

          | -| Adjustable text spacing and font size |
          • OneNote 2016 (add-in), OneNote in a browser, OneNote for Windows 10, OneNote for iPad, OneNote Mac
          • Word 2016, Word in a browser, Word Mac, Word for iPad
          • Outlook Web Access
          • Office Lens on iOS, Android
          |

          X

          (N/A for Word for iOS, Word in a browser, Outlook Web Access, or Office Lens)

          |

          X

          (N/A for Word for iOS, Word in a browser, Outlook Web Access, or Office Lens)

          |

          X

          |

          X

          |

          X

          (N/A for any OneNote apps)

          | -| Syllabification |
          • OneNote 2016 (add-in), OneNote in a browser, OneNote for Windows 10, OneNote for iPad, OneNote Mac
          • Word in a browser
          • Outlook Web Access
          | |

          X

          (N/A for Word for iOS, Word in a browser, Outlook Web Access)

          |

          X

          (N/A for Word iOS)

          |

          X

          (N/A for Word iOS)

          |

          X

          (N/A for any OneNote apps or Word iOS)

          | -| Parts of speech identification |
          • OneNote 2016 (add-in), OneNote in a browser, OneNote for Windows 10, OneNote for iPad, OneNote Mac
          • Word 2016, Word in a browser, Word Mac, Word for iOS
          • Outlook 2016, Outlook Web Access
          • Office Lens on iOS, Android
          |

          X

          (N/A for Word in a browser, Outlook Web Access)

          |

          X

          (N/A for Word in a browser, Outlook Web Access)

          |

          X

          (N/A for any OneNote apps)

          |

          X

          (N/A for any OneNote apps)

          |

          X

          (N/A for any OneNote apps)

          | -| Line focus mode |
          • Word 2016, Word in a browser, Word Mac, Word for iOS
          • Outlook 2016, Outlook Web Access
          • Office Lens on iOS, Android
          | |

          X

          (N/A for Word in a browser, Outlook Web Access)

          |

          X

          (N/A for any OneNote apps)

          |

          X

          (N/A for any OneNote apps)

          |

          X

          (N/A for any OneNote apps)

          | -| Picture Dictionary |
          • Word 2016, Word in a browser, Word Mac, Word for iOS
          • Outlook 2016, Outlook Web Access
          • Office Lens on iOS, Android
          | |

          X

          (N/A for Word in a browser, Outlook Web Access)

          |

          X

          (N/A for any OneNote apps)

          |

          X

          (N/A for any OneNote apps)

          |

          X

          (N/A for any OneNote apps)

          | - -
          - - -| Writing and proofing features | Available in which apps | Office 2016 MSI | Office 2019 | Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | -|----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|--------------------------------------|--------------------------------------|--------------------------------------|--------------------------------------|---------------------------------| -| Dictation |
          • OneNote 2016, OneNote for Windows 10
          • Word 2016
          • Outlook 2016
          • PowerPoint 2016
          | |

          X

          |

          X

          | | | -| Spelling suggestions for phonetic misspellings |
          • Word 2016, Word in a browser, Word for Mac
          • Outlook 2016
          | |

          X

          |

          X

          |

          X

          | | -| Synonyms alongside spelling suggestions that can be read aloud |
          • Word 2016
          • Outlook 2016
          | |

          X

          |

          X

          |

          X

          | | -| Grammar checks |
          • Word 2016, Word in a browser, Word for Mac
          • Outlook 2016
          | |

          X

          |

          X

          | | | -| Customizable writing critiques |
          • Word 2016, Word for Mac
          • Outlook 2016
          |

          X

          |

          X

          |

          X

          | | | -| Tell me what you want to do |
          • Office 2016
          • Office in a browser
          • Office on iOS, Android, Windows 10
          |

          X

          |

          X

          |

          X

          |

          X

          | | -| Editor |
          • Word 2016
          | |

          X

          |

          X

          | | | - -
          - - -| Creating accessible content features | Available in which apps | Office 2016 MSI | Office 2019 | Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | -|---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------|--------------------------------------|--------------------------------------|--------------------------------------|---------------------------------| -| Accessibility Checker |
          • All Office 365 authoring applications on PC, Mac, Web
          | |

          X

          |

          X

          | | | -| Accessible Templates |
          • Word for PCs, Mac
          • Excel for PCs, Mac
          • PowerPoint for PCs, Mac
          • Sway on iOS, Web, Windows 10
          | |

          X

          |

          X

          | | | -| Ability to add alt-text for images |
          • Word for PCs (includes automatic suggestions for image descriptions)
          • SharePoint Online (includes automatic suggestions for image descriptions)
          • PowerPoint for PCs (includes automatic suggestions for image descriptions)
          • OneNote (includes automatic extraction of text in images)
          • All Office 365 authoring applications (include ability to add alt-text manually)
          |

          X

          |

          X

          |

          X

          | | | -| Ability to add captions to videos |
          • PowerPoint for PCs
          • Sway on iOS, Web, Windows 10
          • Microsoft Stream (includes ability to have captions auto-generated for videos in English and Spanish)
          | |

          X

          | | | | -| Export as tagged PDF |
          • Word for PCs, Mac
          • Sway on iOS, Web, Windows 10
          | |

          X

          |

          X

          | | | -| Ability to request accessible content |
          • Outlook Web Access
          | | | | | | - -
          - - -| Communication features | Available in which apps | Office 2016 MSI | Office 2019 | Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | -|------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------|--------------------------------------|--------------------------------------|--------------------------------------|--------------------------------------| -| Microsoft Translator |
          • Word 2016
          • Excel 2016
          • "Translator for Outlook" Add-in
          • PowerPoint 2016 (and PowerPoint Garage Add-in)
          |

          X

          |

          X

          |

          X

          |

          X

          |

          X

          | - -
          - -## Deploying apps with Microsoft Intune -Microsoft Intune can be used to deploy apps such as Immersive Reader and Microsoft Translator to all the devices connected in the same groups. -1. Go to the Intune for Education portal and log in with your account. -2. Select the **Apps** page. -3. Find the app you're looking for in the included list (if it's not there, you can select **Add app** and download it from the Microsoft Store). -4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to. - -## How to show/hide the Ease of access settings for text in Windows 10 -The Ease of access settings in Windows 10 are very useful accessibility tools, but having those options could be a bit much for everyone in a group to have in their device. With the following instructions you can chose to hide or show the Ease of access settings on users' devices. -1. Go to the Intune for Education portal and login with your account. -2. Select the **Groups** page and then select your desired group. -3. Select **Settings** and under the **User access and device settings** section you will find the toggle to set **Ease of access** to **Blocked** or **Not blocked**. -4. Select **Save** after making your selection. - -## How to change your Office 365 account from monthly, semi-annual, or yearly -Depending on how you plan to do billing, you can have Office 365 accounts that are set to renew monthly, semi-annually, or yearly. -1. Sign-in to your services and subscriptions with your Microsoft account. -2. Find the subscription in the list, then select **Change how you pay**. - >**Note:** If you don't see **Change how you pay**, it could be because auto-renew is not turned on. You won't be able to change how you pay if auto-renew is off because the subscription has already been paid and will end when its duration expires. -3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. diff --git a/education/get-started/set-up-office365-edu-tenant.md b/education/get-started/set-up-office365-edu-tenant.md deleted file mode 100644 index f0887073f7..0000000000 --- a/education/get-started/set-up-office365-edu-tenant.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Set up an Office 365 Education tenant -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 10/09/2017 -ms.reviewer: -manager: dansimp ---- - -# Set up an Office 365 Education tenant - -> [!div class="step-by-step"] -> [<< Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) -> [Use School Data Sync to import student data >>](use-school-data-sync.md) - -Schools can use Office 365 to save time and be more productive. Built with powerful tools and accessible from any device, setting it up is the first step in getting your school to the cloud. - -Don't have an Office 365 for Education verified tenant or just starting out? Follow these steps to set up an Office 365 for Education tenant. [Learn more about Office 365 for Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans).
          - -> [!VIDEO https://www.youtube.com/embed/X7bscA-knaY] - -You can watch the descriptive audio version here: [Microsoft Education: Set up an Office 365 Education tenant (DA)](https://www.youtube.com/watch?v=d5tQ8KoB3ic) - -## To set up a new Office 365 Education tenant - -1. Go to the
          Office 365 for Education sign up page to sign up for a free subscription for your school. -2. Create an account and a user ID and password to use to sign into your account. - - **Figure 1** - Office 365 account creation - - ![Create an Office 365 account](images/o365_createaccount.png) - -3. Save your sign-in info so you can use it to sign in to https://portal.office.com (the sign-in page). Click **You're ready to go...** -4. In the **Verify eligibility for Microsoft Office 365 for Education** screen: - 1. Add your domain name and follow the steps to confirm ownership of the domain. - 2. Choose your DNS hosting provider to see step-by-step instructions on how to confirm that you own the domain. - - In some cases, you may need to wait several hours for the DNS verification to complete. You can click **I'll verify later** and come back later and log into the Office 365 portal and then go to the **Admin** center and select **Domains** to check the status entry for your domain. - - You may need to fill in other information to provide that you qualify for an education tenant. Provide and submit the info to Microsoft to continue verification for your tenant. - -As part of setting up a basic cloud infrastructure, you don't need to complete the rest of the Office 365 for Education setup so we will skip the rest of setup for now and start importing school data. You can pick up where you left off with Office 365 for Education setup once you've completed the rest of the steps in the walkthrough. See *Complete Office 365 for Education setup* in [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md) for info. - -> [!div class="step-by-step"] -> [<< Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) -> [Use School Data Sync to import student data >>](use-school-data-sync.md) - - -## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) diff --git a/education/get-started/set-up-windows-10-education-devices.md b/education/get-started/set-up-windows-10-education-devices.md deleted file mode 100644 index 67b39af36c..0000000000 --- a/education/get-started/set-up-windows-10-education-devices.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Set up Windows 10 education devices -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 10/09/2017 -ms.reviewer: -manager: dansimp ---- - -# Set up Windows 10 education devices - -> [!div class="step-by-step"] -> [<< Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md) -> [Finish setup and other tasks >>](finish-setup-and-other-tasks.md) - -We recommend using the latest build of Windows 10, version 1703 on your education devices. - -To set up new Windows 10 devices and enroll them to your education tenant, choose from one of these options and follow the link to watch the video or follow the step-by-step guide: -- **Option 1: [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app)** - You can use the app to create a setup file that you can use to quickly set up one or more Windows 10 devices. -- **Option 2: [Go through Windows OOBE and join the device to Azure AD](set-up-windows-education-devices.md)** - You can go through a typical Windows 10 device setup or first-run experience to configure your device. - -> [!div class="step-by-step"] -> [<< Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md) -> [Finish setup and other tasks >>](finish-setup-and-other-tasks.md) - - - -## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) diff --git a/education/get-started/set-up-windows-education-devices.md b/education/get-started/set-up-windows-education-devices.md deleted file mode 100644 index cb83590354..0000000000 --- a/education/get-started/set-up-windows-education-devices.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Set up Windows 10 devices using Windows OOBE -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 07/28/2017 -ms.reviewer: -manager: dansimp ---- - -# Set up Windows 10 devices using Windows OOBE - -If you are setting up a Windows 10 device individually, and network bandwidth is not an issue, you can go through the Windows 10 first-run setup experience, also known as OOBE (out-of-box-experience) to set up the device, and join it to your school's Office 365 and Azure Active Directory. - -You can watch the video to see how this is done, or follow the step-by-step guide.
          - -> [!VIDEO https://www.youtube.com/embed/nADWqBYvqXk] - -You can watch the descriptive audio version here: [Microsoft Education: Set up a new Windows 10 education devices using the Windows setup experience (DA)](https://www.youtube.com/watch?v=_UtS1Cz2Pno) - -## To set up Windows 10 devices using OOBE - -1. If you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired or Ethernet connection. -2. Go through the Windows device setup experience. On a new or reset device, this starts with the **Let's start with region. Is this right?** screen. - - **Figure 1** - Let's start with region - - ![Let's start with region](images/win10_letsstartwithregion.png) - -3. Continue with setup. In the **How would you like to set up?** screen, select **Set up for an organization**. - - **Figure 2** - Select setup for an organization - - ![Select setup for an organization](images/win10_setupforanorg.png) - -4. Sign in using the user's account and password. Depending on the user password setting, you may be prompted to update the password. -5. Choose privacy settings for the device. Location, speech recognition, diagnostics, and other settings are all on by default. Configure the settings based on the school's policies. -6. Click **Accept** to go through the rest of device setup. - - -## Related topic -[Set up Windows 10 education devices](set-up-windows-10-education-devices.md) diff --git a/education/get-started/use-intune-for-education.md b/education/get-started/use-intune-for-education.md deleted file mode 100644 index 1a4fdb71e5..0000000000 --- a/education/get-started/use-intune-for-education.md +++ /dev/null @@ -1,224 +0,0 @@ ---- -title: Use Intune for Education to manage groups, apps, and settings -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 08/29/2017 -ms.reviewer: -manager: dansimp ---- - -# Use Intune for Education to manage groups, apps, and settings - -> [!div class="step-by-step"] -> [<< Configure Microsoft Store for Education](configure-microsoft-store-for-education.md) -> [Set up Windows 10 education devices >>](set-up-windows-10-education-devices.md) - -Intune for Education is a streamlined device management solution for educational institutions that can be used to quickly set up and manage Windows 10 devices for your school. It provides a new streamlined UI with the enterprise readiness and resiliency of the Intune service. You can learn more about Intune for Education by reading the Intune for Education documentation. - -## Example - Set up Intune for Education, buy apps from the Store, and install the apps -In this walkthrough, we'll go through a sample scenario and walk you through the steps to: -- [Use express configuration to quickly set up Intune for Education](#set-up-intune-for-education) -- [Use Intune for Education to buy apps from the Microsoft Store for Education](#add-apps-bought-from-microsoft-store-for-education) -- [Use Intune for Education to install the apps for all users in your tenant](#install-apps-for-all-users) - -Note that for verified education tenants, Microsoft automatically provisions your app catalog with these apps so you will see them appear on your Intune for Education catalog even before you've bought any apps: -- Excel -- Fresh Paint -- Minecraft: Education Edition -- OneNote -- PowerPoint -- Sway -- Word - - > [!NOTE] - > Apps that you own in the Microsoft Store for Education are automatically available in Intune for Education. Any changes you make to your purchases get reflected in Intune for Education. - -You can watch the video to see how this is done, or follow the step-by-step guide.
          - -> [!VIDEO https://www.youtube.com/embed/c3BLoZZw3TQ] - -You can watch the descriptive audio version here: [Microsoft Education: Use Intune for Education to manage groups, apps, and settings (DA)](https://youtu.be/Tejxfc4V7cQ) - -## Set up Intune for Education -Intune for Education provides an **Express configuration** option so you can get going right away. We'll use that option here. - -1. Log into the Intune for Education console. You will see the Intune for Education dashboard once you're logged in. - - **Figure 1** - Intune for Education dashboard - - ![Intune for Education dashboard](images/i4e_portal.png) - -2. On the dashboard, click **Launch Express Configuration**, or select the **Express configuration** option on the menu on the left. -3. In the **Welcome to Intune for Education** screen, click **Get started**. - - **Figure 2** - Click Get started to set up Intune for Education - - ![Click Get Started to configure groups, apps, and settings](images/i4e_expressconfiguration_welcome.png) - -4. In the **Get school information (optional)** screen, it should indicate that SDS is already configured. Click **Next**. - - **Figure 3** - SDS is configured - - ![SDS is already configured](images/i4e_expressconfiguration_sdsconfigured.png) - -5. In the **Choose group** screen, select **All Users**. All apps and settings that we select during express setup will apply to this group. - - You can choose another group during this step, but note that your experience may vary from what we show in the walkthrough. - -6. The **Next** button will appear at the bottom of the screen after you select **All Users**. Click **Next**. - - > [!TIP] - > At the top of the screen, did you notice the **Choose group** button change to a green check mark? This means we are done with that step. If you change your mind or need to make changes, simply click on the button to go back to that step. Try it! - > - > **Figure 4** - Click on the buttons to go back to that step - > - > ![Click on the buttons to back to that step](images/i4e_expressconfiguration_choosebuttontogoback.png) - -7. In the **Choose apps** screen, you will see a selection of Web apps, Microsoft Store apps, and desktop (Win32) apps. You will also see a list of popular apps from each category. - - - Add or remove apps by clicking on them. A blue checkmark means the app is added and will be installed for all members of the group selected in the **Choose group** step. - - In this walkthrough, it's up to you to select the apps you choose to install. Just remember what they are so that later in the walkthrough you can verify that the apps were installed correctly on the device. - - > [!TIP] - > Web apps are pushed as links in the Windows Start menu under **All apps**. If you want apps to appear in Microsoft Edge browser tabs, use the **Homepages** setting for Microsoft Edge through **Express configuration** or **Manage Users and Devices**. - - **Figure 5** - Choose the apps that you want to install for the group - - ![Choose apps to install for the group](images/i4e_expressconfiguration_chooseapps_selected_cropped.png) - -8. When you're done choosing apps, click **Next** at the bottom of the screen. - - If you select Microsoft Store apps, you will see a notification that Intune for Education is getting these apps. - -9. In the **Choose settings** screen, we will set the settings to apply to the group. Click the reverse caret (downward-facing arrow) to expand the settings group and get more information about each setting in that settings group. - - **Figure 6** - Expand the settings group to get more details - - ![Expand the settings group to get more info](images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.png) - -10. For this walkthrough, set the following settings: - - In the **Microsoft Edge settings** group, change the **Do-Not-Track headers** setting to **Require**. - - In the **App settings** group, change the **Microsoft Store for Business apps** setting to **Block**, and then set the **Require Microsoft Store for Business apps to be installed from private store** to **Require**. - - **Figure 28** - Set some additional settings - - ![Set some additional settings](images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.png) - -11. Click **Next**. In the **Review** screen, you will see a summary of the apps and settings you selected to apply. - - **Figure 7** - Review the group, apps, and settings you configured - - ![Review the group, apps, and settings you configured](images/i4e_expressconfiguration_review.png) - -12. Click **Save** to end express configuration. -13. You will see the **You're done!** screen which lets you choose one of two options. - - **Figure 8** - All done with Intune for Education express configuration - - ![Done with Intune for Education express configuration](images/i4e_expressconfiguration_alldone.png) - -14. Click **All done** or click the **X** on the upper-right corner of the screen to dismiss this screen and go back to the dashboard. - -## Add apps bought from Microsoft Store for Education - -- **Example 1 - Minecraft: Education Edition** - - If you would like to purchase Minecraft: Education Edition or want to learn how to get, distribute, and manage permissions for Minecraft: Education Edition, see For IT administrators - get Minecraft: Education Edition. - -- **Example 2 - Free educational/reference apps** - - 1. In the Intune for Education console, click **Apps** from the menu on the left. - - **Figure 9** - Click on **Apps** to see the list of apps for your tenant - - ![Click Apps to see the list of apps for your tenant](images/i4e_dashboard_clickapps.png) - - 2. In the **Store apps** section, click **+ New app**. This will take you to the Microsoft Store for Education portal and you will already be signed in. - - **Figure 10** - Select the option to add a new Store app - - ![Select the option to add a new Store app](images/i4e_apps_newstoreapp_selected.png) - - 3. In the Microsoft Store page, check some of the categories for suggested apps or search the Store for a free educational or reference app. Find ones that you haven't already installed during express setup for Intune for Education. - - For example, these apps are free: - - Duolingo - Learn Languages for Free - - Flashcards Pro - - Khan Academy - - My Study Life - - 4. Find or select the app you want to install and click **Get the app**. - 5. In the app's Store page, click the **...** button and select **Add to private store**. - 6. Repeat steps 3-5 to install another app or move to the next step. - 7. In the Microsoft Store for Education portal, select **Manage > Apps & software > Manage apps** to verify that the apps you purchased appear in your inventory. - - For example, if you bought Duolingo and Khan Academy, they will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant. - - **Figure 11** - Apps inventory in Microsoft Store for Education - - ![Apps inventory in Store for Business](images/msfe_manageapps_inventory_grouped.png) - - In the **Private store** column of the **Apps & software** page, the status for some apps will indicate that it's "In private store" while others will say "Not in private store". We won't go over this in the walkthrough, but you can learn more about this in Distribute apps using your private store. - - > [!NOTE] - > You'll see in the above screenshot that some apps say that **Add is in progress**. Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune for Education to sync all your purchased apps. - -## Install apps for all users - -Now that you've bought the apps, use Intune for Education to specify the group to install the apps for. Here, we'll show you how to install the apps you bought for all devices used by all users in your tenant. - -1. In the Intune for Education console, click the **Groups** option from the menu on the left. - - **Figure 12** - Groups page in Intune for Education - - ![Groups page in Intune for Education](images/i4e_groupspage.png) - -2. In the **Groups** page, select **All Users** from the list of groups on the left, and then click **Users** in the taskbar at the top of the **All Users** page. - - **Figure 13** - List of all users in the tenant - - ![List of all users in the tenant](images/i4e_groups_allusers_users_steps.png) - -3. In the taskbar at the top, select **Apps** and then click **Edit apps** to see a list of available apps. - - **Figure 14** - Edit apps to assign them to users - - ![Edit apps to assign them to users](images/i4e_groups_allusers_appspage_editapps.png) - -4. Select the apps to deploy to the group. A blue checkmark will appear next to the apps you select. - - **Figure 15** - Select the apps to deploy to the group - - ![Select the apps to deploy to the group](images/i4e_groups_allusers_selectappstodeploy.png) - -5. Once you're done, click **Save** at the bottom of the page to deploy the selected apps to the group. -6. You'll be notified that app assignments are being updated. The updated **All Users** groups page now include the apps you selected. - - **Figure 16** - Updated list of assigned apps - - ![Updated list of assigned apps](images/i4e_groups_allusers_updatedappslist.png) - -You're now done assigning apps to all users in your tenant. It's time to set up your Windows 10 device(s) and check that your cloud infrastructure is correctly set up and your apps are being pushed to your devices from the cloud. - - - -> [!div class="step-by-step"] -> [<< Configure Microsoft Store for Education](configure-microsoft-store-for-education.md) -> [Set up Windows 10 education devices >>](set-up-windows-10-education-devices.md) - - - -## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) diff --git a/education/get-started/use-school-data-sync.md b/education/get-started/use-school-data-sync.md deleted file mode 100644 index 14a34bcda5..0000000000 --- a/education/get-started/use-school-data-sync.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Use School Data Sync to import student data -description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.topic: quickstart -ms.localizationpriority: medium -ms.pagetype: edu -author: levinec -ms.author: ellevin -ms.date: 07/10/2017 -ms.reviewer: -manager: dansimp ---- - -# Use School Data Sync to import student data - -> [!div class="step-by-step"] -> [<< Set up an Office 365 education tenant](set-up-office365-edu-tenant.md) -> [Configure Microsoft Store for Education >>](configure-microsoft-store-for-education.md) - -School Data Sync (SDS) helps you import Student Information System (SIS) data into Office 365. It helps automate the process for importing and integrating SIS data that you can use with Office 365 and apps like OneNote Class Notebooks. - -Follow all the steps in this section to use SDS and sample CSV files in a trial environment. To use SDS in a production environment, see step 2 in [Try out Microsoft Education in a production environment](https://docs.microsoft.com/education/get-started/get-started-with-microsoft-education#setup-options) instead. - -You can watch the video to see how this is done, or follow the step-by-step guide.
          - -> [!VIDEO https://www.youtube.com/embed/ehSU8jr8T24] - -You can watch the descriptive audio version here: [Microsoft Education: Use School Data Sync to import student data (DA)](https://www.youtube.com/watch?v=l4b086IMtvc) - -## Download sample school data - -1. Go to the O365-EDU-Tools GitHub site. -2. Click the green **Clone or download** button to download the SDS sample files. - - **Figure 1** - Download the SDS sample files from GitHub - - ![Download the SDS sample files from GitHub](images/sds_github_downloadsample.png) - -3. In the **Clone with HTTPS** pop-up window, choose **Download ZIP** and note the location where you're saving the folder. -4. Go to the folder where you saved the .zip and unzip the files. -5. Open the **O365-EDU-Tools-master** folder and then open the **CSV Samples** subfolder. Confirm that you can see the following sample CSV files. - - **Figure 2** - Sample CSV files - - ![Use the sample CSV files](images/sds_sample_csv_files_us_uk.png) - - > [!NOTE] - > - The sample CSV files uses sample accounts and passwords. If you are using the sample files for testing, remember the accounts and their corresponding passwords. You may be asked to change the password during your first sign in. - > - If you are modifying the sample CSV files to use in your organization, change the accounts and passwords to match the user accounts and passwords in your organization. - > - If you are using CSV files from your existing production environment, see the detailed instructions in step 5 in the next section. - -To learn more about the CSV files that are required and the info you need to include in each file, see CSV files for School Data Sync. If you run into any issues, see School Data Sync errors and troubleshooting. - -## Use SDS to import student data - -1. If you haven't done so already, go to the SDS portal, https://sds.microsoft.com. -2. Click Sign in. Then enter your O365 Global Admin account credentials. -3. After logging in, click **+ Add Profile** in the left hand navigation pane to create a Sync Profile.. This opens up the new profile setup wizard within the main page. - - **Figure 3** - New SDS profile setup wizard - - ![Screenshot that shows creating a new profile](images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png) - -4. For the new profile, in the **How do you want to connect to your school?** screen: - - 1. Enter a name for your profile, such as *Contoso_Elementary_Profile*. - 2. Select a sync method for your profile. For this walkthrough, select **Upload CSV Files**. - 3. Select the type of CSV files that you're using. For this walkthrough, select **CSV files: SDS Format**. - 4. Click **Start**. - -5. In the **Sync options** screen: - - 1. In the **Select new or existing users** section, you can select either **Existing users** or **New users** based on the scenario that applies to you. For this walkthrough, select **New users**. - 2. In the **Import data** section, click **Upload Files** to bring up the **Select data files to be uploaded** window. - 3. In the **Select data files to be uploaded** window, click **+ Add Files** and navigate to the directory where you saved the six CSV files required for data import. - 4. In the File Explorer window, you will see a folder for the sample CSV files for the UK and six sample CSV files for the US. Select the CSV files that match your region/locale, and then click **Open**. - 5. In the **Select data files to be uploaded** window, confirm that all six CSV files (School.csv, Section.csv, Student.csv, StudentEnrollment.csv, Teacher.csv, and TeacherRoster.csv) are listed and then click **Upload**. - - > [!NOTE] - > After you click **Upload**, the status in the **Select data files to be uploaded** window will indicate that files are being uploaded and verified. - - 6. After all the files are successfully uploaded, click **OK**. - 7. In the **Select school and section properties** section, ensure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties, or deselect any properties, make sure you have the properties and values contained within the CSV files. For the walkthrough, you don't have to change the default. - 8. In the Replace Unsupported Special Characters section, checking this box will allow SDS to automatically replace unsupported special characters while the sync is running. Special characters will be replaced with an "_", and no longer result in an error during the sync process for that object. - 9. In the **Sync option for Section Group Display Name**, check the box if you want to allow teachers to overwrite the section names. Otherwise, SDS will always reset the display name value for sections to the value contained within the CSV files. - 10. In the **Student enrollment option** section: - * If you want to sync your student roster data immediately, leave the box unchecked. - * If you prefer to sync student enrollment/rostering data at a later date, check this box and then pick a date by clicking the empty box and selecting the appropriate date in the calendar when you would like to begin syncing your student roster data. Some schools prefer to delay syncing student roster data so they don't expose rosters before the start of the new term, semester, or school year. - 11. In the Default Term Dates section, You can set default start and end dates for Section terms. These dates will only be used if you do not provide these dates in your CSV files. If you upload files with Section start and end dates, you will be asked to select the format of the dates provided. If the format that you enter does not match the format of start and end dates in your files, you will receive an error message and need to edit the date format so that it matches the format in your files. - 12. In the **License Options** section, check the box for **Intune for Education** to allow students and teachers to receive the Intune for Education license. This will also create the SDS dynamic groups and security groups, which will be used within Intune for Education. - 13. Click **Next**. - - **Figure 4** - Sync options for the new profile - - ![Specify sync options for the new SDS profile](images/how-to-deploy-SDS-using-CSV-files-2a.PNG) - -6. In the **Teacher options** screen: - - 1. Select the domain for the teachers. SDS appends the selected domain suffix to the teacher's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The teacher will log in to Office 365 with the UserPrincipalName once the account is created. - * Primary Key (Source Directory) - This is the Teacher attribute in the CSV file used for SDS Identity Matching. Watch the Identity Matching video for additional information on how to select the appropriate source directory attribute, and properly configure the identity matching settings for teacher. - * Primary Key (Target Directory) - This is the User attribute in Azure AD used for SDS Identity Matching. Watch the Identity Matching video for additional information on how to select the appropriate target directory attribute, and properly configure the identity matching settings for the teacher. - * Domain (optional) - This is an optional domain value that you can add to the selected Source Directory attribute to complete your Teacher Identity Matching. If you need to match to a UserPrincipalName or Mail attribute, you must have a domain included in the string. Your source attribute must either include the domain already or you can append the appropriate domain to the source attribute using this dropdown menu. - - 2. In the **Select teacher properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default. - - 3. In the **License assignment** section, choose the SKU to assign licenses for teachers. - - 4. Click **Next**. - - **Figure 5** - Specify options for teacher mapping - - ![Specify options for teacher mapping](images/how-to-deploy-SDS-using-CSV-files-3.PNG) - -7. In the **Student options** screen: - - 1. Select the domain for the students. SDS appends the selected domain suffix to the student's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The student will log in to Office 365 with the UserPrincipalName once the account is created. - 2. In the **Select student properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default. - 3. In the **License assignment** section, choose the SKU to assign licenses for students. - 4. Click **Next**. - - **Figure 6** - Specify options for student mapping - - ![Specify options for student mapping](images/how-to-deploy-SDS-using-CSV-files-4.PNG) - -8. In the profile **Review** page, review the summary and confirm that the options selected are correct. -9. Click **Create profile**. You will see a notification that your profile is being submitted and then you will see a page for your profile. - - **Figure 7** - SDS profile page - - ![SDS profile page](images/how-to-deploy-SDS-using-CSV-files-5.png) - -10. After the profile is created and the status indicates as **Setting up**, refresh the page until you see the status change to **Sync in progress**. Beneath the **Sync in progress** status, you will see which of the 5 sync stages SDS is working on: - * Stage 1 - Validating data - * Stage 2 - Processing schools and sections - * Stage 3 - Processing students and teachers - * Stage 4 - Adding students and teachers into sections - * Stage 5 - Setting up security groups - - If you don't see a **Sync in progress** status on the sync profile, and receive an error message instead, this indicates that SDS has encountered data issues during the pre-sync validation check and has not started syncing your data. This gives you the opportunity to fix the errors identified by the pre-sync validation checks before continuing. Once you've fixed any errors or if you prefer to continue with the errors and begin syncing your data anyway, click the **Resume sync** button to start the sync process. - - Once you've completed all five sync stages, your profile status will update one final time. - * If you haven't encountered any errors, you will see a green check mark which states **Everything is ok**, and the profile status will change to **Sync complete. Ready for more data.** - * If SDS encountered sync errors, you will see a red status icon that indicates an error, and a profile status of **Sync complete. Profile contains multiple errors**. Download the available error report to identify and fix your sync errors. Once complete, upload new files as needed and re-sync your data until errors are resolved. - - Here are some examples of what the sync status can look like: - - **Figure 8** - New profile: Sync in progress - - ![Sync in progress for the new profile](images/sds_profile_status_syncinprogress_062317.png) - - **Figure 9** - New profile: Sync complete - no errors - - ![New profile sync complete with no errors](images/sds_profile_status_everythingok_062317.png) - - **Figure 10** - New profile: Sync complete - with errors - - ![New profile sync complete with errors](images/sds_profile_status_syncerrors_062317.png) - - Sync times, like file download times, can vary widely depending on when you start the sync, how much data you are syncing, the complexity of your data (such as the number of users, schools, and class enrollments), overall system/network load, and other factors. Two people who start a sync at the same time may not have their syncs complete at the same time. - - You can refresh the page to confirm that your profile synced successfully. - -That's it for importing sample school data using SDS. - -> [!div class="step-by-step"] -> [<< Set up an Office 365 education tenant](set-up-office365-edu-tenant.md) -> [Configure Microsoft Store for Education >>](configure-microsoft-store-for-education.md) - -## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) diff --git a/education/images/EDU-Apps-Mgmt.svg b/education/images/EDU-Apps-Mgmt.svg new file mode 100644 index 0000000000..862f0e12ff --- /dev/null +++ b/education/images/EDU-Apps-Mgmt.svg @@ -0,0 +1 @@ +EDU-Apps-Mgmt-50px \ No newline at end of file diff --git a/education/images/EDU-Deploy.svg b/education/images/EDU-Deploy.svg new file mode 100644 index 0000000000..1a0d67fd67 --- /dev/null +++ b/education/images/EDU-Deploy.svg @@ -0,0 +1 @@ +EDU-Deploy-50px \ No newline at end of file diff --git a/education/images/EDU-Device-Mgmt.svg b/education/images/EDU-Device-Mgmt.svg new file mode 100644 index 0000000000..92fb95141f --- /dev/null +++ b/education/images/EDU-Device-Mgmt.svg @@ -0,0 +1 @@ +EDU-Device-Mgmt-50px \ No newline at end of file diff --git a/education/images/EDU-Education.svg b/education/images/EDU-Education.svg new file mode 100644 index 0000000000..146dd00257 --- /dev/null +++ b/education/images/EDU-Education.svg @@ -0,0 +1 @@ +EDU-Education-50px \ No newline at end of file diff --git a/education/images/EDU-FindHelp.svg b/education/images/EDU-FindHelp.svg new file mode 100644 index 0000000000..fea3109134 --- /dev/null +++ b/education/images/EDU-FindHelp.svg @@ -0,0 +1,32 @@ + + + + +EDUAdmins-50px + + + + toolbox + + + + + + + + + + + diff --git a/education/images/EDU-ITJourney.svg b/education/images/EDU-ITJourney.svg new file mode 100644 index 0000000000..e42fe12104 --- /dev/null +++ b/education/images/EDU-ITJourney.svg @@ -0,0 +1,31 @@ + + + + +EDUAdmins-50px + + + + MapPin-blue + + + + + + + diff --git a/education/images/EDU-Lockbox.svg b/education/images/EDU-Lockbox.svg new file mode 100644 index 0000000000..8133127433 --- /dev/null +++ b/education/images/EDU-Lockbox.svg @@ -0,0 +1 @@ +EDU-Lockbox-50px \ No newline at end of file diff --git a/education/images/EDU-Tasks.svg b/education/images/EDU-Tasks.svg new file mode 100644 index 0000000000..f1339ea705 --- /dev/null +++ b/education/images/EDU-Tasks.svg @@ -0,0 +1 @@ +EDU-Tasks-50px \ No newline at end of file diff --git a/education/images/EDU-Teachers.svg b/education/images/EDU-Teachers.svg new file mode 100644 index 0000000000..4cdb2b3e7d --- /dev/null +++ b/education/images/EDU-Teachers.svg @@ -0,0 +1,27 @@ + + + + +EDUAdmins-50px + + + + PresenterPresentationChart-blue + + + + + diff --git a/education/images/EDUAdmins.svg b/education/images/EDUAdmins.svg new file mode 100644 index 0000000000..d512fb942f --- /dev/null +++ b/education/images/EDUAdmins.svg @@ -0,0 +1 @@ +EDUAdmins-50px \ No newline at end of file diff --git a/education/images/EDUDevelopers.svg b/education/images/EDUDevelopers.svg new file mode 100644 index 0000000000..900159699a --- /dev/null +++ b/education/images/EDUDevelopers.svg @@ -0,0 +1 @@ +EDUDevelopers-50px \ No newline at end of file diff --git a/education/images/EDUPartners.svg b/education/images/EDUPartners.svg new file mode 100644 index 0000000000..01b80c9a42 --- /dev/null +++ b/education/images/EDUPartners.svg @@ -0,0 +1 @@ +EDUPartners-50px \ No newline at end of file diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md new file mode 100644 index 0000000000..36578af4bf --- /dev/null +++ b/education/includes/education-content-updates.md @@ -0,0 +1,10 @@ + + + + +## Week of November 30, 2020 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 12/4/2020 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified | diff --git a/education/index.md b/education/index.md deleted file mode 100644 index f07f216119..0000000000 --- a/education/index.md +++ /dev/null @@ -1,253 +0,0 @@ ---- -layout: HubPage -hide_bc: true -title: Microsoft 365 Education documentation and resources | Microsoft Docs -description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. -author: CelesteDG -ms.topic: hub-page -ms.author: celested -ms.collection: ITAdminEDU -ms.date: 10/30/2017 -ms.prod: w10 ---- -
          -
          -

          Microsoft Education documentation and resources

          -
          -
          diff --git a/education/index.yml b/education/index.yml new file mode 100644 index 0000000000..80796a921a --- /dev/null +++ b/education/index.yml @@ -0,0 +1,35 @@ +### YamlMime:Hub + +title: Microsoft 365 Education Documentation +summary: Microsoft 365 Education empowers educators to unlock creativity, promote teamwork, and provide a simple and safe experience in a single, affordable solution built for education. + +metadata: + title: Microsoft 365 Education Documentation + description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +productDirectory: + items: + # Card + - title: IT Admins + # imageSrc should be square in ratio with no whitespace + imageSrc: ./images/EDUAdmins.svg + links: + - url: itadmins.yml + text: Get started with deploying and managing a full cloud IT solution for your school. + # Card + - title: Developers + imageSrc: ./images/EDUDevelopers.svg + links: + - url: developers.yml + text: Looking for information about developing solutions on Microsoft Education products? Start here. + # Card + - title: Partners + imageSrc: ./images/EDUPartners.svg + links: + - url: partners.yml + text: Looking for resources available to Microsoft Education partners? Start here. \ No newline at end of file diff --git a/education/itadmins.yml b/education/itadmins.yml new file mode 100644 index 0000000000..4aa321c59c --- /dev/null +++ b/education/itadmins.yml @@ -0,0 +1,120 @@ +### YamlMime:Hub + +title: Microsoft 365 Education Documentation for IT admins +summary: Microsoft 365 Education consists of Office 365 Education, Windows 10 Education, and security and management tools such as Intune for Education and School Data Sync. + +metadata: + title: Microsoft 365 Education Documentation for IT admins + description: M365 Education consists of Office 365 Education, Windows 10 Education, and security and management tools such as Intune for Education and School Data Sync. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +productDirectory: + summary: This guide is designed for IT admins looking for the simplest way to move their platform to the cloud. It does not capture all the necessary steps for large scale or complex deployments. + items: + # Card + - title: Phase 1 - Cloud deployment + imageSrc: ./images/EDU-Deploy.svg + links: + - url: https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant + text: 1. Create your Office 365 tenant + - url: https://docs.microsoft.com/microsoft-365/education/deploy/secure-and-configure-your-network + text: 2. Secure and configure your network + - url: https://docs.microsoft.com/microsoft-365/education/deploy/aad-connect-and-adfs + text: 3. Sync your active directory + - url: https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync + text: 4. Sync you SIS using School Data Sync + - url: https://docs.microsoft.com/microsoft-365/education/deploy/license-users + text: 5. License users + # Card + - title: Phase 2 - Device management + imageSrc: ./images/EDU-Device-Mgmt.svg + links: + - url: https://docs.microsoft.com/en-us/education/windows/ + text: 1. Get started with Windows 10 for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices + text: 2. Set up Windows 10 devices + - url: https://docs.microsoft.com/microsoft-365/education/deploy/intune-for-education + text: 3. Get started with Intune for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education + text: 4. Use Intune to manage groups, apps, and settings + - url: https://docs.microsoft.com/en-us/intune/enrollment/enrollment-autopilot + text: 5. Enroll devices using Windows Autopilot + # Card + - title: Phase 3 - Apps management + imageSrc: ./images/EDU-Apps-Mgmt.svg + links: + - url: https://docs.microsoft.com/microsoft-365/education/deploy/configure-admin-settings + text: 1. Configure admin settings + - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education + text: 2. Set up Teams for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-office-365 + text: 3. Set up Office 365 + - url: https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education + text: 4. Install apps from Microsoft Store for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/minecraft-for-education + text: 5. Install Minecraft - Education Edition + # Card + - title: Complete your deployment + # imageSrc should be square in ratio with no whitespace + imageSrc: ./images/EDU-Tasks.svg + links: + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-online + text: Deploy Exchange Online + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-online-and-onedrive + text: Deploy SharePoint Online and OneDrive + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-server-hybrid + text: Deploy Exchange Server hybrid + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-server-hybrid + text: Deploy SharePoint Server Hybrid + # Card + - title: Security & compliance + imageSrc: ./images/EDU-Lockbox.svg + links: + - url: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-deployment-checklist-p2 + text: AAD feature deployment guide + - url: https://techcommunity.microsoft.com/t5/Azure-Information-Protection/Azure-Information-Protection-Deployment-Acceleration-Guide/ba-p/334423 + text: Azure information protection deployment acceleration guide + - url: https://docs.microsoft.com/en-us/cloud-app-security/getting-started-with-cloud-app-security + text: Microsoft Cloud app security + - url: https://docs.microsoft.com/microsoft-365/compliance/create-test-tune-dlp-policy + text: Office 365 data loss prevention + - url: https://docs.microsoft.com/microsoft-365/compliance/ + text: Office 365 advanced compliance + - url: https://social.technet.microsoft.com/wiki/contents/articles/35748.office-365-what-is-customer-lockbox-and-how-to-enable-it.aspx + text: Deploying Lockbox + # Card + - title: Analytics & insights + imageSrc: ./images/EDU-Education.svg + links: + - url: https://docs.microsoft.com/en-us/power-bi/service-admin-administering-power-bi-in-your-organization + text: Power BI for IT admins + - url: https://docs.microsoft.com/en-us/dynamics365/#pivot=get-started + text: Dynamics 365 + # Card + - title: Find deployment help + imageSrc: ./images/EDU-FindHelp.svg + links: + - url: https://docs.microsoft.com/microsoft-365/education/deploy/find-deployment-help + text: IT admin help + - url: https://social.technet.microsoft.com/forums/en-us/home + text: TechNet + # Card + - title: Check out our education journey + imageSrc: ./images/EDU-ITJourney.svg + links: + - url: https://edujourney.microsoft.com/k-12/ + text: K-12 + - url: https://edujourney.microsoft.com/hed/ + text: Higher education + # Card + - title: Additional support resources + imageSrc: ./images/EDU-Teachers.svg + links: + - url: https://support.office.com/en-us/education + text: Education help center + - url: https://support.office.com/en-us/article/teacher-training-packs-7a9ee74a-8fe5-43d3-bc23-a55185896921 + text: Teacher training packs \ No newline at end of file diff --git a/education/partners.yml b/education/partners.yml new file mode 100644 index 0000000000..42925925f4 --- /dev/null +++ b/education/partners.yml @@ -0,0 +1,33 @@ +### YamlMime:Hub + +title: Microsoft 365 Education Documentation for partners +summary: Looking for resources available to Microsoft Education partners? Start here. + +metadata: + title: Microsoft 365 Education Documentation for partners + description: Looking for resources available to Microsoft Education partners? Start here. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +additionalContent: + sections: + - items: + # Card + - title: Microsoft Partner Network + summary: Discover the latest news and resources for Microsoft Education products, solutions, licensing and readiness. + url: https://partner.microsoft.com/solutions/education + # Card + - title: Authorized Education Partner (AEP) program + summary: Become authorized to purchase and resell academic priced offers and products to Qualified Educational Users (QEUs). + url: https://www.mepn.com/ + # Card + - title: Authorized Education Partner Directory + summary: Search through the list of Authorized Education Partners worldwide who can deliver on customer licensing requirements, and provide solutions and services to current and future school needs. + url: https://www.mepn.com/MEPN/AEPSearch.aspx + # Card + - title: Education Partner community Yammer group + summary: Sign in with your Microsoft Partner account and join the Education Partner community private group on Yammer. + url: https://www.yammer.com/mepn/ \ No newline at end of file diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index f1d88dc8c8..aff8c085b5 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp @@ -339,7 +339,7 @@ For more information about checking for updates, and how to optionally turn on a ## Get more info * Learn more at microsoft.com/education * Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox -* Buy Windows 10 devices +* Buy Windows 10 devices

          diff --git a/education/trial-in-a-box/images/Thumbs.db b/education/trial-in-a-box/images/Thumbs.db deleted file mode 100644 index d36fc0c985..0000000000 Binary files a/education/trial-in-a-box/images/Thumbs.db and /dev/null differ diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md index c91f1c0264..f21a0ddcf4 100644 --- a/education/trial-in-a-box/index.md +++ b/education/trial-in-a-box/index.md @@ -1,6 +1,6 @@ --- title: Microsoft Education Trial in a Box -description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program. +description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program. keywords: education, Microsoft 365 Education, trial, full cloud IT solution, school, deploy, setup, IT admin, educator, student, explore, Trial in a Box ms.prod: w10 ms.mktglfcycl: deploy @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: CelesteDG -ms.author: celested +author: dansimp +ms.author: dansimp ms.date: 12/11/2017 --- diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index b4cdaad1f4..1965c6abf7 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -9,8 +9,8 @@ ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp @@ -278,4 +278,4 @@ For more information about checking for updates, and how to optionally turn on a ## Get more info * Learn more at microsoft.com/education * Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox -* Buy Windows 10 devices +* Buy Windows 10 devices diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md index b377719a91..9cb32351de 100644 --- a/education/trial-in-a-box/support-options.md +++ b/education/trial-in-a-box/support-options.md @@ -1,6 +1,6 @@ --- title: Microsoft Education Trial in a Box Support -description: Need help or have a question about using Microsoft Education Trial in a Box? Start here. +description: Need help or have a question about using Microsoft Education Trial in a Box? Start here. keywords: support, troubleshooting, education, Microsoft 365 Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Set up School PCs ms.prod: w10 ms.mktglfcycl: deploy @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 2c11c122c4..8ba6fec5bb 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 06/27/2018 ms.reviewer: manager: dansimp @@ -36,8 +36,7 @@ You can set the policy using one of these methods: - MDM provider - - Autopilot Reset in Intune for Education is coming soon. In a future update of Intune for Education, new tenants will automatically have the Autopilot Reset setting enabled by default on the **All devices** group as part of initial tenant configuration. You will also be able to manage this setting to target different groups in the admin console. - - If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. + -Check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. For example, in Intune, create a new configuration policy and add an OMA-URI. - OMA-URI: ./Vendor/MSFT/Policy/Config/CredentialProviders/DisableAutomaticReDeploymentCredentials @@ -65,7 +64,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo **To trigger Autopilot Reset** -1. From the Windows device lock screen, enter the keystroke: **CTRL + ![Windows key](images/windows_glyph.png) + R**. +1. From the Windows device lock screen, enter the keystroke: **CTRL + Windows key + R**. ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png) @@ -93,6 +92,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo Once provisioning is complete, the device is again ready for use. + ## Troubleshoot Autopilot Reset Autopilot Reset will fail when the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is not enabled on the device. You will see `Error code: ERROR_NOT_SUPPORTED (0x80070032)`. diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index b3dd38357b..9302c8fdb4 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md index da30be64ef..e40ce61ea7 100644 --- a/education/windows/change-to-pro-education.md +++ b/education/windows/change-to-pro-education.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp @@ -37,7 +37,7 @@ Before you change to Windows 10 Pro Education, make sure you meet these requirem - The user making the changes must be a member of the Azure AD global administrator group. ## Compare Windows 10 Pro and Pro Education editions -You can [compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10. +You can [compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10. For more info about Windows 10 default settings and recommendations for education customers, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). @@ -314,6 +314,6 @@ For more information about integrating on-premises AD DS domains with Azure AD, [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md) -[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) [Windows 10 subscription activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation) diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index 9769d7a3bf..cbbdb3502b 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -10,8 +10,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu, devices ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 --- @@ -457,7 +457,7 @@ Table 5. Select on-premises AD DS, Azure AD, or hybrid X -Use System Center 2012 R2 Configuration Manager for management +Use Microsoft Endpoint Configuration Manager for management X X @@ -493,7 +493,7 @@ You may ask the question, “Why plan for device, user, and app management befor Also, planning management before deployment is essential to being ready to support the devices as you deploy them. You want to have your management processes and technology in place when the first teachers, facility, or students start using their new Windows device. -Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, System Center Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan. +Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, Microsoft Endpoint Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan. Table 6. Device, user, and app management products and technologies diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 1cb747217a..71f603bec9 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -7,9 +7,9 @@ ms.sitesec: library ms.prod: w10 ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin -ms.date: 08/31/2017 +author: dansimp +ms.author: dansimp +ms.date: ms.reviewer: manager: dansimp --- @@ -32,7 +32,7 @@ In Windows 10, version 1703 (Creators Update), it is straightforward to configur | **Microsoft consumer experiences** | **SetEduPolicies** | Disables suggested content from Windows such as app recommendations | This is already set | This is already set | The policy must be set | | **Cortana** | **AllowCortana** | Disables Cortana

          * Cortana is enabled by default on all editions in Windows 10, version 1703 | If using Windows 10 Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

          See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | If using Windows 10 Pro Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

          See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | | **Safe search** | **SetEduPolicies** | Locks Bing safe search to Strict in Microsoft Edge | This is already set | This is already set | The policy must be set | -| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | +| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge. See [Ad-free search with Bing](#ad-free-search-with-bing | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | | **Apps** | **SetEduPolicies** | Preinstalled apps like Microsoft Edge, Movies & TV, Groove, and Skype become education ready

          * Any app can detect Windows is running in an education ready configuration through [IsEducationEnvironment](https://docs.microsoft.com/uwp/api/windows.system.profile.educationsettings) | This is already set | This is already set | The policy must be set | @@ -150,34 +150,10 @@ For example: ![Set SetEduPolicies to True in Windows Configuration Designer](images/setedupolicies_wcd.png) ## Ad-free search with Bing -Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. Additional information is available at https://www.bing.com/classroom/about-us. - -> [!NOTE] -> If you enable the guest account in shared PC mode, students using the guest account will not have an ad-free experience searching with Bing in Microsoft Edge unless the PC is connected to your school network and your school network has been configured as described in [IP registration for entire school network using Microsoft Edge](#ip-registration-for-entire-school-network-using-microsoft-edge). +Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. ### Configurations -#### IP registration for entire school network using Microsoft Edge -Ad-free searching with Bing in Microsoft Edge can be configured at the network level. To configure this, email bingintheclassroom@microsoft.com with the subject "New Windows 10, version 1703 (Creators Update) Registration: [School District Name]" and the include the following information in the body of the email. - -**District information** -- **District or School Name:** -- **Outbound IP Addresses (IP Range + CIDR):** -- **Address:** -- **City:** -- **State Abbreviation:** -- **Zip Code:** - -**Registrant information** -- **First Name:** -- **Last Name:** -- **Job Title:** -- **Email Address:** -- **Opt-In for Email Announcements?:** -- **Phone Number:** - -This will suppress ads when searching with Bing on Microsoft Edge when the PC is connected to the school network. - #### Azure AD and Office 365 Education tenant To suppress ads when searching with Bing on Microsoft Edge on any network, follow these steps: @@ -185,6 +161,8 @@ To suppress ads when searching with Bing on Microsoft Edge on any network, follo 2. Domain join the Windows 10 PCs to your Azure AD tenant (this is the same as your Office 365 tenant). 3. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. 4. Have students sign in with their Azure AD identity, which is the same as your Office 365 identity, to use the PC. +> [!NOTE] +> If you are verifying your Office 365 domain to prove education status (step 1 above), you may need to wait up to 7 days for the ad-free experience to take effect. Microsoft recommends not to roll out the browser to your students until that time. #### Office 365 sign-in to Bing To suppress ads only when the student signs into Bing with their Office 365 account in Microsoft Edge, follow these steps: @@ -192,8 +170,6 @@ To suppress ads only when the student signs into Bing with their Office 365 acco 1. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. 2. Have students sign into Bing with their Office 365 account. -### More information -For more information on all the possible Bing configuration methods, see https://aka.ms/e4ahor. ## Related topics [Deployment recommendations for school IT administrators](edu-deployment-recommendations.md) diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index bb621c32d8..2d08a4c82d 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -1,14 +1,14 @@ --- title: Deploy Windows 10 in a school district (Windows 10) -description: Learn how to deploy Windows 10 in a school district. Integrate the school environment with Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD), use System Center Configuration Manager, Intune, and Group Policy to manage devices. +description: Learn how to deploy Windows 10 in a school district. Integrate the school environment with Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD), use Microsoft Endpoint Configuration Manager, Intune, and Group Policy to manage devices. keywords: configure, tools, device, school district, deploy Windows 10 ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.reviewer: manager: dansimp --- @@ -20,75 +20,112 @@ manager: dansimp - Windows 10 -This guide shows you how to deploy the Windows 10 operating system in a school district. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft System Center Configuration Manager, Microsoft Intune, and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you will perform after initial deployment as well as the automated tools and built-in features of the operating system. +This guide shows you how to deploy the Windows 10 operating system in a school district. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft Endpoint Configuration Manager, Microsoft Intune, and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you will perform after initial deployment as well as the automated tools and built-in features of the operating system. ## Prepare for district deployment Proper preparation is essential for a successful district deployment. To avoid common mistakes, your first step is to plan a typical district configuration. Just as with building a house, you need a blueprint for what your district and individual schools should look like when it’s finished. The second step in preparation is to learn how you will manage the users, apps, and devices in your district. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your district. ->**Note**  This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management). +> [!NOTE] +> This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management). ### Plan a typical district configuration As part of preparing for your district deployment, you need to plan your district configuration — the focus of this guide. Figure 1 illustrates a typical finished district configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. -![Typical district configuration for this guide](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") +> [!div class="mx-imgBorder"] +> ![Typical district configuration for this guide](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") *Figure 1. Typical district configuration for this guide* A *district* consists of multiple schools, typically at different physical locations. Figure 2 illustrates a typical school configuration within the district that this guide uses. -![Typical school configuration for this guide](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") +> [!div class="mx-imgBorder"] +> ![Typical school configuration for this guide](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") *Figure 2. Typical school configuration for this guide* Finally, each school consists of multiple classrooms. Figure 3 shows the classroom configuration this guide uses. -![Typical classroom configuration in a school](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") +> [!div class="mx-imgBorder"] +> ![Typical classroom configuration in a school](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") *Figure 3. Typical classroom configuration in a school* This district configuration has the following characteristics: * It contains one or more admin devices. + * It contains two or more schools. + * Each school contains two or more classrooms. + * Each classroom contains one teacher device. + * The classrooms connect to each other through multiple subnets. + * All devices in each classroom connect to a single subnet. + * All devices have high-speed, persistent connections to each other and to the Internet. + * All teachers and students have access to Microsoft Store or Microsoft Store for Business. + * You install a 64-bit version of Windows 10 on the admin device. + * You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. + * You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. - >**Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. + + > [!NOTE] + > In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. + * The devices use Azure AD in Office 365 Education for identity management. + * If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](https://azure.microsoft.com/documentation/articles/active-directory-aadconnect/). + * Use [Intune](https://docs.microsoft.com/intune/), [Mobile Device Management for Office 365](https://support.office.com/en-us/article/Set-up-Mobile-Device-Management-MDM-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy in AD DS](https://technet.microsoft.com/library/cc725828.aspx) to manage devices. + * Each device supports a one-student-per-device or multiple-students-per-device scenario. + * The devices can be a mixture of different make, model, and processor architecture (32-bit or 64-bit) or be identical. + * To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment (PXE) boot. + * The devices can be a mixture of different Windows 10 editions, such as Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education. Use these characteristics at a minimum as you deploy your schools. If your district deployment is less complex, you may want to review the guidance in [Deploy Windows 10 in a school](https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school). ->**Note**  This guide focuses on Intune as the mobile device management (MDM) solution. If you want to use an MDM solution other than Intune, ignore the Intune-specific content in this guide. For each section, contact your MDM provider to determine the features and management capabilities for your institution. +> [!NOTE] +> This guide focuses on Intune as the mobile device management (MDM) solution. If you want to use an MDM solution other than Intune, ignore the Intune-specific content in this guide. For each section, contact your MDM provider to determine the features and management capabilities for your institution. Office 365 Education allows: * Students and faculty to use Microsoft Office to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser. + * Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students. + * Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, the administration, and faculty. + * Teachers to employ Sway to create interactive educational digital storytelling. + * Students and faculty to use email and calendars, with mailboxes up to 50 GB per user. + * Faculty to use advanced email features like email archiving and legal hold capabilities. + * Faculty to help prevent unauthorized users from accessing documents and email by using Microsoft Azure Rights Management. + * Faculty to use advanced compliance tools on the unified eDiscovery pages in the Office 365 Compliance Center. + * Faculty to host online classes, parent–teacher conferences, and other collaboration in Skype for Business. + * Students and faculty to access up to 1 TB of personal cloud storage that users inside and outside the educational institution can share through OneDrive for Business. + * Teachers to provide collaboration in the classroom through Microsoft SharePoint Online team sites. + * Students and faculty to use Office 365 Video to manage videos. + * Students and faculty to use Yammer to collaborate through private social networking. + * Students and faculty to access classroom resources from anywhere on any device (including Windows 10 Mobile, iOS, and Android devices). For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://products.office.com/en-us/academic). @@ -99,24 +136,28 @@ Now that you have the plan (blueprint) for your district and individual schools The primary tool you will use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI). -You can use MDT as a stand-alone tool or integrate it with System Center Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with System Center Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as System Center Configuration Manager) but result in fully automated deployments. +You can use MDT as a stand-alone tool or integrate it with Microsoft Endpoint Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as Configuration Manager) but result in fully automated deployments. -This guide focuses on LTI deployments to deploy the reference device. You can use ZTI deployments with System Center Configuration Manager or LTI deployments to deploy the reference images to your faculty and student devices. If you want to only use MDT, see [Deploy Windows 10 in a school](https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school). +This guide focuses on LTI deployments to deploy the reference device. You can use ZTI deployments with Configuration Manager or LTI deployments to deploy the reference images to your faculty and student devices. If you want to only use MDT, see [Deploy Windows 10 in a school](https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school). MDT includes the Deployment Workbench, a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps, and migration of user settings on existing devices. -LTI performs deployment from a *deployment share* — a network-shared folder on the device on which you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in the [Prepare the admin device](#prepare-the-admin-device) section. +LTI performs deployment from a *deployment share* — a network-shared folder on the device on which you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in [Prepare the admin device](#prepare-the-admin-device), earlier in this article. The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with Intune, the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements. -ZTI performs fully automated deployments using System Center Configuration Manager and MDT. Although you could use System Center Configuration Manager by itself, using System Center Configuration Manager with MDT provides an easier process for deploying operating systems. MDT works with the operating system deployment feature in System Center Configuration Manager. +ZTI performs fully automated deployments using Configuration Manager and MDT. Although you could use Configuration Manager by itself, using Configuration Manager with MDT provides an easier process for deploying operating systems. MDT works with the operating system deployment feature in Configuration Manager. The configuration process requires the following devices: -* **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the System Center Configuration Manager Console on this device. +* **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the Configuration Manager Console on this device. + * **Reference devices.** These are the devices that you will use as a template for the faculty and student devices. You install Windows 10 and Windows desktop apps on these devices, and then capture an image (.wim file) of the devices. - You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/en-us/windows/view-all). + + You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/windows/view-all). + * **Faculty and staff devices.** These are the devices that the teachers, faculty, and staff use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices. + * **Student devices.** The students will use these devices. You will use the admin device deploy (or upgrade) Windows 10 and apps to them. The high-level process for deploying and configuring devices within individual classrooms, individual schools, and the district as a whole is as follows and illustrated in Figure 4: @@ -133,13 +174,14 @@ The high-level process for deploying and configuring devices within individual c 6. On the reference devices, deploy Windows 10 and the Windows desktop apps on the device, and then capture the reference image from the devices. -7. Import the captured reference images into MDT or System Center Configuration Manager. +7. Import the captured reference images into MDT or Microsoft Endpoint Configuration Manager. 8. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. 9. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS–Azure AD integration. -![How district configuration works](images/edu-districtdeploy-fig4.png "How district configuration works") +> [!div class="mx-imgBorder"] +> ![How district configuration works](images/edu-districtdeploy-fig4.png "How district configuration works") *Figure 4. How district configuration works* @@ -160,9 +202,9 @@ Before you select the deployment and management methods, you need to review the |Scenario feature |Cloud-centric|On-premises and cloud| |---|---|---| |Identity management | Azure AD (stand-alone or integrated with on-premises AD DS) | AD DS integrated with Azure AD | -|Windows 10 deployment | MDT only | System Center Configuration Manager with MDT | +|Windows 10 deployment | MDT only | Microsoft Endpoint Configuration Manager with MDT | |Configuration setting management | Intune | Group Policy

          Intune| -|App and update management | Intune |System Center Configuration Manager

          Intune| +|App and update management | Intune |Microsoft Endpoint Configuration Manager

          Intune| *Table 1. Deployment and management scenarios* @@ -174,14 +216,14 @@ These scenarios assume the need to support: Some constraints exist in these scenarios. As you select the deployment and management methods for your device, keep the following constraints in mind: * You can use Group Policy or Intune to manage configuration settings on a device but not both. -* You can use System Center Configuration Manager or Intune to manage apps and updates on a device but not both. +* You can use Microsoft Endpoint Configuration Manager or Intune to manage apps and updates on a device but not both. * You cannot manage multiple users on a device with Intune if the device is AD DS domain joined. Use the cloud-centric scenario and on-premises and cloud scenario as a guide for your district. You may need to customize these scenarios, however, based on your district. As you go through the [Select the deployment methods](#select-the-deployment-methods), [Select the configuration setting management methods](#select-the-configuration-setting-management-methods), and the [Select the app and update management products](#select-the-app-and-update-management-products) sections, remember these scenarios and use them as the basis for your district. ### Select the deployment methods -To deploy Windows 10 and your apps, you can use MDT by itself or System Center Configuration Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution. +To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Configuration Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution. @@ -230,8 +272,8 @@ Select this method when you:

          - - + - - + - - + @@ -1728,7 +1809,7 @@ For more information about completing this task, see the following resources: For more information, see: @@ -1739,10 +1820,10 @@ For more information, see: diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index f1696a220d..5631f3e6ab 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.reviewer: manager: dansimp --- @@ -88,7 +88,7 @@ Now that you have the plan (blueprint) for your classroom, you’re ready to lea The primary tool you will use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI). -You can use MDT as a stand-alone tool or integrate it with Microsoft System Center Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with System Center Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as System Center Configuration Manager) but result in fully automated deployments. +You can use MDT as a stand-alone tool or integrate it with Microsoft Endpoint Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as Configuration Manager) but result in fully automated deployments. MDT includes the Deployment Workbench—a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps and migration of user settings on existing devices. @@ -164,7 +164,7 @@ In this section, you installed the Windows ADK and MDT on the admin device. You Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. Teachers and students use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. -As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx). +As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office-365-deployment-resources/default.aspx). ### Select the appropriate Office 365 Education license plan @@ -173,9 +173,9 @@ Complete the following steps to select the appropriate Office 365 Education lice
          1. Determine the number of faculty members and students who will use the classroom.
            Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan.
          2. -
          3. Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
          4. +
          5. Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Microsoft 365 Apps for enterprise plans). Table 1 lists the advantages and disadvantages of standard and Microsoft 365 Apps for enterprise plans.

          6. -Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans +Table 1. Comparison of standard and Microsoft Microsoft 365 Apps for enterprise plans
          System Center Configuration Manager

          System Center Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle. You can use System Center Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection.

          +

          Microsoft Endpoint Configuration Manager

          Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle. You can use Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection.

          Select this method when you:

          • Want to deploy Windows 10 to institution-owned devices that are domain joined (personal devices are typically not domain joined).
          • @@ -249,7 +291,7 @@ Select this method when you:

          The disadvantages of this method are that it:

            -
          • Carries an additional cost for System Center Configuration Manager server licenses (if the institution does not have System Center Configuration Manager already).
          • +
          • Carries an additional cost for Microsoft Endpoint Configuration Manager server licenses (if the institution does not have Configuration Manager already).
          • Can deploy Windows 10 only to domain-joined (institution-owned devices).
          • Requires an AD DS infrastructure (if the institution does not have AD DS already).
          @@ -265,7 +307,7 @@ Record the deployment methods you selected in Table 3. |Selection | Deployment method| |--------- | -----------------| | |MDT by itself | -| |System Center Configuration Manager and MDT| +| |Microsoft Endpoint Configuration Manager and MDT| *Table 3. Deployment methods selected* @@ -320,7 +362,7 @@ Select this method when you:

          Intune

          Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.

          -Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with System Center Configuration Manager is unavailable.

          +Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with Configuration Manager is unavailable.

          Select this method when you:

            @@ -364,7 +406,7 @@ Record the configuration setting management methods you selected in Table 5. Alt #### Select the app and update management products -For a district, there are many ways to manage apps and software updates. Table 6 lists the products that this guide describes and recommends. Although you could manage updates by using [Windows Updates or Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx), you still need to use System Center Configuration Manager or Intune to manage apps. Therefore, it only makes sense to use one or both of these tools for update management. +For a district, there are many ways to manage apps and software updates. Table 6 lists the products that this guide describes and recommends. Although you could manage updates by using [Windows Updates or Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx), you still need to Configuration Manager or Intune to manage apps. Therefore, it only makes sense to use one or both of these tools for update management. Use the information in Table 6 to determine which combination of app and update management products is right for your district. @@ -382,10 +424,10 @@ Use the information in Table 6 to determine which combination of app and update
          System Center Configuration Manager

          System Center Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.

          System Center Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using System Center Configuration Manager. You can also manage Windows desktop and Microsoft Store applications.

          Select this method when you:

          +
          Microsoft Endpoint Configuration Manager

          Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.

          Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager. You can also manage Windows desktop and Microsoft Store applications.

          Select this method when you:

            -
          • Selected System Center Configuration Manager to deploy Windows 10.
          • +
          • Selected Configuration Manager to deploy Windows 10.
          • Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
          • Want to manage AD DS domain-joined devices.
          • Have an existing AD DS infrastructure.
          • @@ -404,7 +446,7 @@ Use the information in Table 6 to determine which combination of app and update

          The disadvantages of this method are that it:

            -
          • Carries an additional cost for System Center Configuration Manager server licenses (if the institution does not have System Center Configuration Manager already).
          • +
          • Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
          • Carries an additional cost for Windows Server licenses and the corresponding server hardware.
          • Can only manage domain-joined (institution-owned devices).
          • Requires an AD DS infrastructure (if the institution does not have AD DS already).
          • @@ -441,12 +483,12 @@ Select this method when you:

          System Center Configuration Manager and Intune (hybrid)

          System Center Configuration Manager and Intune together extend System Center Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both System Center Configuration Manager and Intune.

          -System Center Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using System Center Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.

          +

          Microsoft Endpoint Configuration Manager and Intune (hybrid)

          Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.

          +Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.

          Select this method when you:

            -
          • Selected System Center Configuration Manager to deploy Windows 10.
          • +
          • Selected Microsoft Endpoint Configuration Manager to deploy Windows 10.
          • Want to manage institution-owned and personal devices (does not require that the device be domain joined).
          • Want to manage domain-joined devices.
          • Want to manage Azure AD domain-joined devices.
          • @@ -466,7 +508,7 @@ Select this method when you:

          The disadvantages of this method are that it:

            -
          • Carries an additional cost for System Center Configuration Manager server licenses (if the institution does not have System Center Configuration Manager already).
          • +
          • Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
          • Carries an additional cost for Windows Server licenses and the corresponding server hardware.
          • Carries an additional cost for Intune subscription licenses.
          • Requires an AD DS infrastructure (if the institution does not have AD DS already).
          • @@ -483,9 +525,9 @@ Record the app and update management methods that you selected in Table 7. |Selection | Management method| |----------|------------------| -| |System Center Configuration Manager by itself| +| |Microsoft Endpoint Configuration Manager by itself| | |Intune by itself| -| |System Center Configuration Manager and Intune (hybrid mode)| +| |Microsoft Endpoint Configuration Manager and Intune (hybrid mode)| *Table 7. App and update management methods selected* @@ -512,7 +554,8 @@ For more information about installing the Windows ADK, see [Step 2-2: Install Wi Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windows 10 and app deployment. It is a free tool available directly from Microsoft. You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. ->**Note**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system. +> [!NOTE] +> If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system. For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/library/dn759415.aspx#InstallingaNewInstanceofMDT). @@ -526,31 +569,33 @@ For more information about how to create a deployment share, see [Step 3-1: Crea ### Install the Configuration Manager console ->**Note**  If you selected System Center Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next. +> [!NOTE] +> If you selected Microsoft Endpoint Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next. -You can use System Center Configuration Manager to manage Windows 10 deployments, Windows desktop apps, Microsoft Store apps, and software updates. To manage System Center Configuration Manager, you use the Configuration Manager console. You must install the Configuration Manager console on every device you use to manage System Center Configuration Manager (specifically, the admin device). The Configuration Manager console is automatically installed when you install System Center Configuration Manager primary site servers. +You can use Configuration Manager to manage Windows 10 deployments, Windows desktop apps, Microsoft Store apps, and software updates. To manage Configuration Manager, you use the Configuration Manager console. You must install the Configuration Manager console on every device you use to manage Configuration Manager (specifically, the admin device). The Configuration Manager console is automatically installed when you install Configuration Manager primary site servers. -For more information about how to install the Configuration Manager console, see [Install System Center Configuration Manager consoles](https://technet.microsoft.com/library/mt590197.aspx#bkmk_InstallConsole). +For more information about how to install the Configuration Manager console, see [Install Microsoft Endpoint Configuration Manager consoles](https://technet.microsoft.com/library/mt590197.aspx#bkmk_InstallConsole). ### Configure MDT integration with the Configuration Manager console ->**Note**  If you selected MDT only to deploy Windows 10 and your apps (and not System Center Configuration Manager) in the [Select the deployment methods](#select-the-deployment-methods) section, then skip this section and continue to the next. +> [!NOTE] +> If you selected MDT only to deploy Windows 10 and your apps (and not Microsoft Endpoint Configuration Manager) in [Select the deployment methods](#select-the-deployment-methods), earlier in this article, then skip this section and continue to the next. -You can use MDT with System Center Configuration Manager to make ZTI operating system deployment easier. To configure MDT integration with System Center Configuration Manager, run the Configure ConfigMgr Integration Wizard. This wizard is installed when you install MDT. +You can use MDT with Configuration Manager to make ZTI operating system deployment easier. To configure MDT integration with Configuration Manager, run the Configure ConfigMgr Integration Wizard. This wizard is installed when you install MDT. -In addition to the admin device, run the Configure ConfigMgr Integration Wizard on each device that runs the Configuration Manager console to ensure that all Configuration Manager console installation can use the power of MDT–System Center Configuration Manager integration. +In addition to the admin device, run the Configure ConfigMgr Integration Wizard on each device that runs the Configuration Manager console to ensure that all Configuration Manager console installation can use the power of MDT–Configuration Manager integration. For more information, see [Enable Configuration Manager Console Integration for Configuration Manager](https://technet.microsoft.com/library/dn759415.aspx#EnableConfigurationManagerConsoleIntegrationforConfigurationManager). #### Summary -In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later to capture a reference image. You can also use the MDT deployment share to deploy Windows 10 and your apps to faculty and students (if that’s the method you selected in the [Select the deployment methods](#select-the-deployment-methods) section). Finally, you installed the Configuration Manager console and configured MDT integration with the Configuration Manager console. +In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later to capture a reference image. You can also use the MDT deployment share to deploy Windows 10 and your apps to faculty and students (if that’s the method you selected in [Select the deployment methods](#select-the-deployment-methods), earlier in this article). Finally, you installed the Configuration Manager console and configured MDT integration with the Configuration Manager console. ## Create and configure Office 365 Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. They also use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. -As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx). +As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office-365-deployment-resources/default.aspx). ### Select the appropriate Office 365 Education license plan @@ -558,16 +603,16 @@ Complete the following steps to select the appropriate Office 365 Education lice 1. Determine the number of faculty members and students who will use the classroom. Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan. -2. Determine the faculty members and students who need to install Microsoft Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 8 lists the advantages and disadvantages of standard and Office 365 ProPlus plans. +2. Determine the faculty members and students who need to install Microsoft Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Microsoft 365 Apps for enterprise plans). Table 8 lists the advantages and disadvantages of standard and Microsoft 365 Apps for enterprise plans. |Plan |Advantages |Disadvantages | |----- |----------- |------------- | - |Office 365 Education |
            • Less expensive than Office 365 ProPlus
            • Can be run from any device
            • No installation necessary
            |
            • Must have an Internet connection to use it
            • Does not support all the features found in Office 365 ProPlus
            | - |Office 365 ProPlus |
            • Only requires an Internet connection every 30 days (for activation)
            • Supports the full set of Office features
            • Can be installed on five devices per user (there is no limit to the number of devices on which you can run Office apps online)
            |
            • Requires installation
            • More expensive than Office 365 Education
            | + |Office 365 Education |
            • Less expensive than Microsoft 365 Apps for enterprise
            • Can be run from any device
            • No installation necessary
            |
            • Must have an Internet connection to use it
            • Does not support all the features found in Microsoft 365 Apps for enterprise
            | + |Microsoft 365 Apps for enterprise |
            • Only requires an Internet connection every 30 days (for activation)
            • Supports the full set of Office features
            • Can be installed on five devices per user (there is no limit to the number of devices on which you can run Office apps online)
            |
            • Requires installation
            • More expensive than Office 365 Education
            | - *Table 8. Comparison of standard and Office 365 ProPlus plans* + *Table 8. Comparison of standard and Microsoft 365 Apps for enterprise plans* - The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. + The best user experience is to run Microsoft 365 Apps for enterprise or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. 3. Determine whether students or faculty need Azure Rights Management. @@ -590,13 +635,19 @@ You will use the Office 365 Education license plan information you record in Tab To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. ->**Note**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Create user accounts in Office 365](#create-user-accounts-in-office-365). +> [!NOTE] +> If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Create user accounts in Office 365](#create-user-accounts-in-office-365). #### To create a new Office 365 subscription 1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. - > **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods: - >
            • In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap More actions), and then click or tap New InPrivate window.
            • In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap Settings), click or tap Safety, and then click or tap InPrivate Browsing.
            + + > [!NOTE] + > If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods: + > + > - In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap More actions), and then click or tap New InPrivate window. + > + > - In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap Settings), click or tap Safety, and then click or tap InPrivate Browsing. 2. On the **Get started** page, in **Enter your school email address**, type your school email address, and then click **Sign up**. @@ -631,7 +682,8 @@ Now that you have created your new Office 365 Education subscription, add the do To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. ->**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush). +> [!NOTE] +> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush). Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: @@ -640,7 +692,8 @@ Office 365 uses the domain portion of the user’s email address to know which O You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before you allow other faculty and students to join Office 365. ->**Note**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. +> [!NOTE] +> You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -651,13 +704,15 @@ By default, all new Office 365 Education subscriptions have automatic tenant joi *Table 10. Windows PowerShell commands to enable or disable automatic tenant join* ->**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. +> [!NOTE] +> If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. ### Disable automatic licensing To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that do not require administrative approval. ->**Note**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. +> [!NOTE] +> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -678,7 +733,7 @@ The following Azure AD Premium features are not in Azure AD Basic: * Allow designated users to manage group membership * Dynamic group membership based on user metadata -* Azure multifactor authentication (MFA; see [What is Azure Multi-Factor Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/)) +* Azure AD Multi-Factor Authentication authentication (MFA; see [What is Azure AD Multi-Factor Authentication Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/)) * Identify cloud apps that your users run * Self-service recovery of BitLocker * Add local administrator accounts to Windows 10 devices @@ -709,9 +764,11 @@ Now that you have an Office 365 subscription, you must determine how you’ll cr In this method, you have an on-premises AD DS domain. As shown in Figure 5, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD. ->**Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/library/dn510997.aspx). +> [!NOTE] +> Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/library/dn510997.aspx). -![Automatic synchronization between AD DS and Azure AD](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") +> [!div class="mx-imgBorder"] +> ![Automatic synchronization between AD DS and Azure AD](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") *Figure 5. Automatic synchronization between AD DS and Azure AD* @@ -721,7 +778,8 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 6, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. -![Bulk import into Azure AD from other sources](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") +> [!div class="mx-imgBorder"] +> ![Bulk import into Azure AD from other sources](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") *Figure 6. Bulk import into Azure AD from other sources* @@ -742,7 +800,8 @@ In this section, you selected the method for creating user accounts in your Offi You can integrate your on-premises AD DS domain with Azure AD to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Azure AD with the Azure AD Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. ->**Note**  If your institution does not have an on-premises AD DS domain, you can skip this section. +> [!NOTE] +> If your institution does not have an on-premises AD DS domain, you can skip this section. ### Select a synchronization model @@ -752,13 +811,15 @@ You can deploy the Azure AD Connect tool: - **On premises.** As shown in Figure 7, Azure AD Connect runs on premises, which has the advantage of not requiring a VPN connection to Azure. It does, however, require a virtual machine (VM) or physical server. - ![Azure AD Connect on premises](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") + > [!div class="mx-imgBorder"] + > ![Azure AD Connect on premises](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") *Figure 7. Azure AD Connect on premises* - **In Azure.** As shown in Figure 8, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. - ![Azure AD Connect in Azure](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") + > [!div class="mx-imgBorder"] + > ![Azure AD Connect in Azure](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") *Figure 8. Azure AD Connect in Azure* @@ -815,7 +876,8 @@ In this section, you selected your synchronization model, deployed Azure AD Conn You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. ->**Note**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. +> [!NOTE] +> If your institution doesn’t have an on-premises AD DS domain, you can skip this section. ### Select the bulk import method @@ -823,7 +885,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T |Method |Description and reason to select this method | |-------|---------------------------------------------| -|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren't comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| |VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).| |Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| @@ -845,7 +907,8 @@ After you have selected your user and group account bulk import method, you’re With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. ->**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. +> [!NOTE] +> Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. For more information about how to import user accounts into AD DS by using: @@ -865,7 +928,8 @@ You can bulk-import user and group accounts directly into Office 365, reducing t Now that you have created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom. ->**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +> [!NOTE] +> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. You can use the Microsoft 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users). @@ -873,7 +937,8 @@ The bulk-add process assigns the same Office 365 Education license plan to all u For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365 - Admin help](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US). ->**Note**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. +> [!NOTE] +> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. The email accounts are assigned temporary passwords on creation. You must communicate these temporary passwords to your users before they can sign in to Office 365. @@ -881,13 +946,15 @@ The email accounts are assigned temporary passwords on creation. You must commun Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. ->**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +> [!NOTE] +> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. For information about creating security groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US). You can add and remove users from security groups at any time. ->**Note**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may have to sign out, and then sign in again for the change to take effect. +> [!NOTE] +> Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may have to sign out, and then sign in again for the change to take effect. ### Create email distribution groups @@ -895,7 +962,8 @@ Microsoft Exchange Online uses an email distribution group as a single email rec You can create email distribution groups based on job role (such as teacher, administration, or student) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. ->**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps. +> [!NOTE] +> Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps. For information about creating email distribution groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US). @@ -957,7 +1025,8 @@ After you create the Microsoft Store for Business portal, configure it by using Now that you have created your Microsoft Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this from the **Inventory** page in Microsoft Store for Business. ->**Note**  Your educational institution can now use a credit card or purchase order to pay for apps in Microsoft Store for Business. +> [!NOTE] +> Your educational institution can now use a credit card or purchase order to pay for apps in Microsoft Store for Business. You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users to install the apps. @@ -989,13 +1058,15 @@ Depending on your school’s requirements, you may need any combination of the f * Upgrade institution-owned devices to Windows 10 Education. * Deploy new instances of Windows 10 Education so that new devices have a known configuration. ->**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades). +> [!NOTE] +> Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades). -For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32-bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. ->**Note**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. +> [!NOTE] +> On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you cannot standardize personal devices on a specific operating system version or processor architecture. @@ -1077,7 +1148,7 @@ At the end of this section, you should know the Windows 10 editions and processo ## Prepare for deployment -Before you can deploy Windows 10 and your apps to devices, you need to prepare your MDT environment, Windows Deployment Services, and System Center Configuration Manager (if you selected it to do operating system deployment in the [Select the deployment methods](#select-the-deployment-methods) section). In this section, you ensure that the deployment methods you selected in the [Select the deployment methods](#select-the-deployment-methods) section have the necessary Windows 10 editions and versions, Windows desktop apps, Microsoft Store apps, and device drivers. +Before you can deploy Windows 10 and your apps to devices, you need to prepare your MDT environment, Windows Deployment Services, and Microsoft Endpoint Configuration Manager (if you selected it to do operating system deployment in the [Select the deployment methods](#select-the-deployment-methods) section). In this section, you ensure that the deployment methods you selected in the [Select the deployment methods](#select-the-deployment-methods) section have the necessary Windows 10 editions and versions, Windows desktop apps, Microsoft Store apps, and device drivers. ### Configure the MDT deployment share @@ -1120,7 +1191,7 @@ Import device drivers for each device in your institution. For more information
          • For apps that are not offline licensed, obtain the .appx files from the app software vendor directly.

          If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.

          -If you have Intune or System Center Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune and Deploy and manage apps by using System Center Configuration Manager sections. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.

          +If you have Intune or Microsoft Endpoint Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune and Deploy and manage apps by using Microsoft Endpoint Configuration Manager sections. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.

          In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:

          x
          Install new or update existing Microsoft Store apps used in the curriculum.

          Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.

          -You can also deploy Microsoft Store apps directly to devices by using Intune, System Center Configuration Manager, or both in a hybrid configuration. For more information, see: +You can also deploy Microsoft Store apps directly to devices by using Intune, Microsoft Endpoint Configuration Manager, or both in a hybrid configuration. For more information, see:
          @@ -191,13 +191,13 @@ Complete the following steps to select the appropriate Office 365 Education lice - +
          Standard
          • Less expensive than Office 365 ProPlus
          • Can be run from any device
          • No installation necessary
          • Must have an Internet connection to use it
          • Does not support all the features found in Office 365 ProPlus
          Standard
          • Less expensive than Microsoft 365 Apps for enterprise
          • Can be run from any device
          • No installation necessary
          • Must have an Internet connection to use it
          • Does not support all the features found in Microsoft 365 Apps for enterprise
          Office ProPlus
          • Only requires an Internet connection every 30 days (for activation)
          • Supports full set of Office features
          • Requires installation
          • Can be installed on only five devices per user (there is no limit to the number of devices on which you can run Office apps online)

          -The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. +The best user experience is to run Microsoft 365 Apps for enterprise or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device.
        • Determine whether students or faculty need Azure Rights Management.
          You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see Azure Rights Management.
        • Record the Office 365 Education license plans needed for the classroom in Table 2.

          @@ -506,7 +506,7 @@ Assign SharePoint Online resource permissions to Office 365 security groups, not **Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. -For information about creating security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). +For information about creating security groups, see [Create and manage Microsoft 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). You can add and remove users from security groups at any time. @@ -520,7 +520,7 @@ You can create email distribution groups based on job role (such as teachers, ad **Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. -For information about how to create security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). +For information about how to create security groups, see [Create and manage Microsoft 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). ### Summary @@ -1096,7 +1096,7 @@ As a final quality control step, verify the device configuration to ensure that - The device can connect to the Internet and view the appropriate web content in Microsoft Edge. - Windows Update is active and current with software updates. - Windows Defender is active and current with malware Security intelligence. -- The SmartScreen Filter is active. +- Windows Defender SmartScreen is active. - All Microsoft Store apps are properly installed and updated. - All Windows desktop apps are properly installed and updated. - Printers are properly configured. diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index cb30050aa8..1f3bcffff3 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -5,8 +5,8 @@ keywords: Windows 10 deployment, recommendations, privacy settings, school ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index 5598256e19..de941be3c6 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -searchScope: +searchScope: - Store -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/30/2018 ms.reviewer: manager: dansimp @@ -83,7 +83,7 @@ Applies to: IT admins Self-service sign up makes it easier for teachers and students in your organization to get started with **Minecraft: Education Edition**. If you have self-service sign up enabled in your tenant, teachers can assign **Minecraft: Education Edition** to students before they have a work or school account. Students receive an email that steps them through the process of signing up for a work or school account. For more information on self-service sign up, see [Using self-service sign up in your organization](https://support.office.com/article/Using-self-service-sign-up-in-your-organization-4f8712ff-9346-4c6c-bb63-a21ad7a62cbd?ui=en-US&rs=en-US&ad=US). ### Domain verification -For education organizations, domain verification ensures you are on the academic verification list. As an admin, you might need to verify your domain using the Office 365 portal. For more information, see [Verify your Office 365 domain to prove ownership, nonprofit or education status](https://support.office.com/article/Verify-your-Office-365-domain-to-prove-ownership-nonprofit-or-education-status-or-to-activate-Yammer-87d1844e-aa47-4dc0-a61b-1b773fd4e590?ui=en-US&rs=en-US&ad=US). +For education organizations, domain verification ensures you are on the academic verification list. As an admin, you might need to verify your domain using the Microsoft 365 admin center. For more information, see [Verify your Office 365 domain to prove ownership, nonprofit or education status](https://support.office.com/article/Verify-your-Office-365-domain-to-prove-ownership-nonprofit-or-education-status-or-to-activate-Yammer-87d1844e-aa47-4dc0-a61b-1b773fd4e590?ui=en-US&rs=en-US&ad=US). ## Acquire apps Applies to: IT admins and teachers diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md index 0862548ea6..0b7fc8c617 100644 --- a/education/windows/enable-s-mode-on-surface-go-devices.md +++ b/education/windows/enable-s-mode-on-surface-go-devices.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/30/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/get-minecraft-device-promotion.md b/education/windows/get-minecraft-device-promotion.md index 4864b6d4a0..bafc4ed6ae 100644 --- a/education/windows/get-minecraft-device-promotion.md +++ b/education/windows/get-minecraft-device-promotion.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 06/05/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 0908c78b04..7037b5ce14 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 01/29/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/images/edu-districtdeploy-fig1.png b/education/windows/images/edu-districtdeploy-fig1.png index a9ed962f95..9e9cd6c238 100644 Binary files a/education/windows/images/edu-districtdeploy-fig1.png and b/education/windows/images/edu-districtdeploy-fig1.png differ diff --git a/education/windows/images/edu-districtdeploy-fig2.png b/education/windows/images/edu-districtdeploy-fig2.png index 3838c18153..dfa00a0132 100644 Binary files a/education/windows/images/edu-districtdeploy-fig2.png and b/education/windows/images/edu-districtdeploy-fig2.png differ diff --git a/education/windows/images/edu-districtdeploy-fig4.png b/education/windows/images/edu-districtdeploy-fig4.png index c55ee20d47..ca07e5a968 100644 Binary files a/education/windows/images/edu-districtdeploy-fig4.png and b/education/windows/images/edu-districtdeploy-fig4.png differ diff --git a/education/windows/index.md b/education/windows/index.md index 0f1dedb139..b40b009575 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: CelesteDG -ms.author: celested +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 --- @@ -19,8 +19,8 @@ ms.date: 10/13/2017 ## ![Learn more about Windows](images/education.png) Learn

          Windows 10 editions for education customers
          Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.

          -

          Compare each Windows edition
          Find out more about the features and functionality we support in each edition of Windows.

          -

          Get Windows 10 Education or Windows 10 Pro Education
          When you've made your decision, find out how to buy Windows for your school.

          +

          Compare each Windows edition
          Find out more about the features and functionality we support in each edition of Windows.

          +

          Get Windows 10 Education or Windows 10 Pro Education
          When you've made your decision, find out how to buy Windows for your school.

          ## ![Plan for Windows 10 in your school](images/clipboard.png) Plan diff --git a/education/windows/s-mode-switch-to-edu.md b/education/windows/s-mode-switch-to-edu.md index 7c0eaafd0a..4860249e19 100644 --- a/education/windows/s-mode-switch-to-edu.md +++ b/education/windows/s-mode-switch-to-edu.md @@ -1,6 +1,6 @@ --- title: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode -description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. +description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. keywords: Windows 10 S switch, S mode Switch, switch in S mode, Switch S mode, Windows 10 Pro Education in S mode, S mode, system requirements, Overview, Windows 10 Pro in S mode, Education, EDU ms.mktglfcycl: deploy ms.localizationpriority: medium @@ -10,8 +10,8 @@ ms.pagetype: edu ms.date: 12/03/2018 ms.reviewer: manager: dansimp -ms.author: macapara -author: mjcaparas +ms.author: dansimp +author: dansimp --- # Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode @@ -71,4 +71,4 @@ Tenant-wide Windows 10 Pro > Pro Education [FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
          [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
          [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
          -[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index 00a5baee8a..515bfff44f 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 01/30/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md index 7b8f55bb14..6d62b6bb55 100644 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ b/education/windows/set-up-school-pcs-azure-ad-join.md @@ -1,14 +1,14 @@ ---- -title: Azure AD Join with Set up School PCs app -description: Describes how Azure AD Join is configured in the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: levinec -ms.author: ellevin +--- +title: Azure AD Join with Set up School PCs app +description: Describes how Azure AD Join is configured in the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp ms.date: 01/11/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-provisioning-package.md b/education/windows/set-up-school-pcs-provisioning-package.md index 48a2aa9549..12bbf4fc89 100644 --- a/education/windows/set-up-school-pcs-provisioning-package.md +++ b/education/windows/set-up-school-pcs-provisioning-package.md @@ -1,15 +1,15 @@ ---- -title: What's in Set up School PCs provisioning package -description: Lists the provisioning package settings that are configured in the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 10/17/2018 +--- +title: What's in Set up School PCs provisioning package +description: Lists the provisioning package settings that are configured in the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 10/17/2018 ms.reviewer: manager: dansimp --- diff --git a/education/windows/set-up-school-pcs-shared-pc-mode.md b/education/windows/set-up-school-pcs-shared-pc-mode.md index 50b01da4f3..2ac3eb11d0 100644 --- a/education/windows/set-up-school-pcs-shared-pc-mode.md +++ b/education/windows/set-up-school-pcs-shared-pc-mode.md @@ -1,15 +1,15 @@ ---- -title: Shared PC mode for school devices -description: Describes how shared PC mode is set for devices set up with the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 07/13/2018 +--- +title: Shared PC mode for school devices +description: Describes how shared PC mode is set for devices set up with the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 07/13/2018 ms.reviewer: manager: dansimp --- diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index ab45a9f0a7..67c378fb9f 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/11/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md index 27ca52dfd3..72bea22625 100644 --- a/education/windows/set-up-school-pcs-whats-new.md +++ b/education/windows/set-up-school-pcs-whats-new.md @@ -1,21 +1,41 @@ ---- -title: What's new in the Windows Set up School PCs app -description: Find out about app updates and new features in Set up School PCs. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 06/03/2019 +--- +title: What's new in the Windows Set up School PCs app +description: Find out about app updates and new features in Set up School PCs. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 08/31/2020 ms.reviewer: manager: dansimp --- # What's new in Set up School PCs -Learn what’s new with the Set up School PCs app each week. Find out about new app features and functionality, and see updated screenshots. You'll also find information about past releases. +Learn what’s new with the Set up School PCs app each week. Find out about new app features and functionality, see updated screenshots, and find information about past releases. + + +## Week of August 24, 2020 + +### Longer device names supported in app +You can now give devices running Windows 10, version 2004 and later a name that's up to 53 characters long. + +## Week of September 23, 2019 + +### Easier way to deploy Office 365 to your classroom devices + Microsoft Office now appears as an option on the **Apps** screen. Select the app to add it to your provisioning package. Devices install Microsoft 365 Apps for enterprise. This version includes the cloud-connected and most current versions of apps such as Word, PowerPoint, Excel, and Teams. + + +## Week of June 24, 2019 + +### Resumed support for Windows 10, version 1903 and later +The previously mentioned provisioning problem was resolved, so the Set up School PCs app once again supports Windows 10, version 1903 and later. The Windows 10 settings that were removed are now back in the app. + +### Device rename made optional for Azure AD joined devices +When you set up your Azure AD join devices in the app, you no longer need to rename your devices. You can keep existing device names. ## Week of May 23, 2019 @@ -23,29 +43,29 @@ Learn what’s new with the Set up School PCs app each week. Find out about new Due to a provisioning problem, Set up School PCs has temporarily stopped support for Windows 10, version 1903 and later. All settings in the app that were for Windows 10, version 1903 and later have been removed. When the problem is resolved, support will resume again. ### Mandatory device rename for Azure AD joined devices -If you configure Azure AD Join, you are now required to rename your devices during setup. Set up School PCs will not let you keep existing device names. +If you configure Azure AD Join, you're now required to rename your devices during setup. You can't keep existing device names. ## Week of April 15, 2019 ### Support for Minecraft Education Edition upgrade - Set up School PCs will only add apps to the provisioning package that meet the minimum supported version for Windows 10. For example, Minecraft was the most recent store app to upgrade, and when selected, can only be installed on devices running Windows 10, version 1709 and later. If you select an earlier Windows version, Minecraft won't be added to the provisioning package. + Set up School PCs only adds apps to the provisioning package that meet the minimum supported version for Windows 10. For example, Minecraft is the most recent store app to upgrade; it's only installed on devices running Windows 10, version 1709 and later. If you select an earlier version of Windows, Minecraft won't be included in the provisioning package. ## Week of April 8, 2019 ### Apps configured as non-removeable -All apps that are deployed by Set up School PCs are configured on the device as non-removable apps. This feature ensures that students don't unpin or uninstall the apps they need. +Apps that you deploy with Set up School PCs are configured as non-removable apps. This feature prevents students from unpinning or uninstalling the apps they need. ### Domain name automatically added during sign-in -Specify your preferred Azure Active Directory tenant domain name to automatically append it to the username on the sign-in screen. With this setting, students don't need to type out long school domain names. They can sign in by typing only their unique usernames. +Specify your preferred Azure Active Directory tenant domain name to automatically append it to the username on the sign-in screen. With this setting, students don't need to type out long school domain names. To sign in, they type only their unique usernames. ### Set up devices with hidden Wi-Fi network -Set up devices so that they connect to a hidden Wi-Fi network. To configure a hidden network, open Set up School PCs. When you get to **Wireless network**, choose **Add a Wi-Fi network**. Enter in your Wi-Fi information and select **Hidden network**. +Set up devices so that they connect to a hidden Wi-Fi network. To configure a hidden network, open the app. When you get to **Wireless network**, choose **Add a Wi-Fi network**. Enter in your Wi-Fi information and select **Hidden network**. ## Week of December 31, 2018 ### Add Microsoft Whiteboard to provisioning package -Microsoft Whiteboard has been added to the list of Microsoft-recommended apps for schools. Whiteboard is a freeform digital canvas where ideas, content, and people come together so students can create and collaborate in real time in the classroom. You can add Whiteboard to your provisioning package in Set up School PCs, on the **Add apps** page. For more information see [Use Set up School PCs app](use-set-up-school-pcs-app.md#create-the-provisioning-package). +Microsoft Whiteboard is now a Microsoft-recommended app for schools. Whiteboard is a freeform digital canvas where ideas, content, and people come together; students can create and collaborate in real time in the classroom. Add the app to your provisioning package on the **Add apps** page. For more information, see [Use Set up School PCs app](use-set-up-school-pcs-app.md#create-the-provisioning-package). ## Week of November 5, 2018 @@ -60,7 +80,7 @@ The Set up School PCs app was updated with the following changes: ### Three new setup screens added to the app The following screens and functionality were added to the setup workflow. Select a screen name to view the relevant steps and screenshots in the Set Up School PCs docs. -* [**Package name**](use-set-up-school-pcs-app.md#package-name): Customize a package name to make it easy to recognize it from your school's other packages. The name is generated by Azure Active Directory and appears as the filename and as the token name in Azure AD in the Azure portal. +* [**Package name**](use-set-up-school-pcs-app.md#package-name): Customize a package name to make it easy to recognize it from your school's other packages. Azure Active Directory generates the name. It appears as the filename, and as the token name in Azure AD in the Azure portal. * [**Product key**](use-set-up-school-pcs-app.md#product-key): Enter a product key to upgrade your current edition of Windows 10, or change the existing product key. @@ -70,17 +90,17 @@ The following screens and functionality were added to the setup workflow. Select Packages now expire 180 days from the date you create them. ### Updated apps with more helpful, descriptive text -We've updated the app's **Skip** buttons to clarify the intent of each action. You'll also see an **Exit** button on the last page of the app. +The **Skip** buttons in the app now communicate the intent of each action. An **Exit** button also appears on the last page of the app. ### Option to keep existing device names The [**Name these devices** screen](use-set-up-school-pcs-app.md#device-names) now gives you the option to keep the original or existing names of your student devices. ### Skype and Messaging apps to be removed from student PCs by default -We've added the Skype and Messaging app to a selection of apps that are, by default, removed from student devices. +The Skype and Messaging apps are part of a selection of apps that are, by default, removed from student devices. ## Next steps -Learn more about setting up devices with the Set up School PCs app. +Learn how to create provisioning packages and set up devices in the app. * [What's in my provisioning package?](set-up-school-pcs-provisioning-package.md) * [Shared PC mode for schools](set-up-school-pcs-shared-pc-mode.md) * [Set up School PCs technical reference](set-up-school-pcs-technical.md) diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 3842e9d435..0ebe308f14 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/27/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index 8f09eb0561..c711403393 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -7,8 +7,8 @@ ms.pagetype: edu ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md index 1f8eb4eb0f..b401df97ef 100644 --- a/education/windows/set-up-windows-10.md +++ b/education/windows/set-up-windows-10.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/27/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 7106de6cfd..9f006e7a88 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/28/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index ac67906e9b..1bfa750d6f 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/08/2017 ms.reviewer: manager: dansimp @@ -20,7 +20,7 @@ manager: dansimp - Windows 10 -Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. +Many schools use online testing for formative and summation assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. Follow the guidance in this topic to set up Take a Test on multiple PCs. @@ -28,7 +28,7 @@ Follow the guidance in this topic to set up Take a Test on multiple PCs. To configure a dedicated test account on multiple PCs, select any of the following methods: - [Provisioning package created through the Set up School PCs app](#set-up-a-test-account-in-the-set-up-school-pcs-app) - [Configuration in Intune for Education](#set-up-a-test-account-in-intune-for-education) -- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-a-test-account-in-mdm-or-configuration-manager) +- [Mobile device management (MDM) or Microsoft Endpoint Configuration Manager](#set-up-a-test-account-in-mdm-or-configuration-manager) - [Provisioning package created through Windows Configuration Designer](#set-up-a-test-account-through-windows-configuration-designer) - [Group Policy to deploy a scheduled task that runs a Powershell script](https://docs.microsoft.com/education/windows/take-a-test-multiple-pcs#create-a-scheduled-task-in-group-policy) @@ -130,7 +130,7 @@ To set up a test account through Windows Configuration Designer, follow these st 1. [Install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd). 2. Create a provisioning package by following the steps in [Provision PCs with common settings for initial deployment (desktop wizard)](https://technet.microsoft.com/itpro/windows/configure/provision-pcs-for-initial-deployment). However, make a note of these other settings to customize the test account. - 1. After you're done with the wizard, do not click **Create**. Instead, click the **Switch to advanced editor** to switch the project to the advanced editor to see all the available **Runtine settings**. + 1. After you're done with the wizard, do not click **Create**. Instead, click the **Switch to advanced editor** to switch the project to the advanced editor to see all the available **Runtime settings**. 2. Under **Runtime settings**, go to **AssignedAccess > AssignedAccessSettings**. 3. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up. @@ -145,8 +145,8 @@ To set up a test account through Windows Configuration Designer, follow these st - username@tenant.com 4. Under **Runtime settings**, go to **TakeATest** and configure the following settings: - 1. In **LaunchURI**, enter the assessment URL. - 2. In **TesterAccount**, enter the test account you entered in step 3. + - In **LaunchURI**, enter the assessment URL. + - In **TesterAccount**, enter the test account you entered in step 3. 3. Follow the steps to [build a package](https://technet.microsoft.com/itpro/windows/configure/provisioning-create-package#build-package). @@ -166,9 +166,9 @@ This sample PowerShell script configures the tester account and the assessment U - Use your tester account for **-UserName** >[!NOTE] ->The account that you specify for the tester account must already exist on the device. +>The account that you specify for the tester account must already exist on the device. For steps to create the tester account, see [Set up a dedicated test account](https://docs.microsoft.com/education/windows/take-a-test-single-pc#set-up-a-dedicated-test-account). -``` +```powershell $obj = get-wmiobject -namespace root/cimv2/mdm/dmmap -class MDM_SecureAssessment -filter "InstanceID='SecureAssessment' AND ParentID='./Vendor/MSFT'"; $obj.LaunchURI='https://www.foo.com'; $obj.TesterAccount='TestAccount'; @@ -211,7 +211,7 @@ Anything hosted on the web can be presented in a locked down manner, not just as For this option, you can just copy the assessment URL, select the options you want to allow during the test, and click a button to create the link. We recommend this for option for teachers. - To get started, go here: [Create a link using a web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link). + To get started, go here: [Create a link using a web UI](https://aka.ms/create-a-take-a-test-link). - Create a link using schema activation @@ -232,7 +232,7 @@ One of the ways you can present content in a locked down manner is by embedding 1. Embed a link or create a desktop shortcut with: - ``` + ```http ms-edu-secureassessment:#enforceLockdown ``` @@ -255,7 +255,7 @@ One of the ways you can present content in a locked down manner is by embedding See [Permissive mode](take-a-test-app-technical.md#permissive-mode) and [Secure Browser API Specification](https://github.com/SmarterApp/SB_BIRT/blob/master/irp/doc/req/SecureBrowserAPIspecification.md) for more info. ### Create a shortcut for the test link -You can also distribute the test link by creating a shortcut. To do this, create the link to the test by either using the [web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link) or using [schema activation](#create-a-link-using-schema-activation). After you have the link, follow these steps: +You can also distribute the test link by creating a shortcut. To do this, create the link to the test by either using the [web UI](https://aka.ms/create-a-take-a-test-link) or using [schema activation](#create-a-link-using-schema-activation). After you have the link, follow these steps: 1. On a device running Windows, right-click on the desktop and then select **New > Shortcut**. 2. In the **Create Shortcut** window, paste the assessment URL in the field under **Type the location of the item**. diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index bb20a3760e..1286a5aec8 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/08/2017 ms.reviewer: manager: dansimp @@ -66,7 +66,7 @@ Anything hosted on the web can be presented in a locked down manner, not just as For this option, you can just copy the assessment URL, select the options you want to allow during the test, and click a button to create the link. We recommend this for option for teachers. - To get started, go here: [Create a link using a web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link). + To get started, go here: [Create a link using a web UI](https://aka.ms/create-a-take-a-test-link). - Create a link using schema activation @@ -117,7 +117,7 @@ One of the ways you can present content in a locked down manner is by embedding ### Create a shortcut for the test link -You can also distribute the test link by creating a shortcut. To do this, create the link to the test by either using the [web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link) or using [schema activation](#create-a-link-using-schema-activation). After you have the link, follow these steps: +You can also distribute the test link by creating a shortcut. To do this, create the link to the test by either using the [web UI](https://aka.ms/create-a-take-a-test-link) or using [schema activation](#create-a-link-using-schema-activation). After you have the link, follow these steps: 1. On a device running Windows, right-click on the desktop and then select **New > Shortcut**. 2. In the **Create Shortcut** window, paste the assessment URL in the field under **Type the location of the item**. diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index cad3303266..7e016c22c0 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/16/2017 ms.reviewer: manager: dansimp @@ -34,8 +34,12 @@ Many schools use online testing for formative and summative assessments. It's cr ![Set up and user flow for the Take a Test app](images/take_a_test_flow_dark.png) -There are several ways to configure devices for assessments. You can: -- **Configure an assessment URL and a dedicated testing account** +There are several ways to configure devices for assessments, depending on your use case: + +- For higher stakes testing such as mid-term exams, you can set up a device with a dedicated testing account and URL. +- For lower stakes assessments such as a quick quiz in a class, you can quickly create and distribute the assessment URL through any method of your choosing. + +1. **Configure an assessment URL and a dedicated testing account** In this configuration, a user signs into in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. @@ -48,7 +52,7 @@ There are several ways to configure devices for assessments. You can: - **For multiple PCs** You can use any of these methods: - - Mobile device management (MDM) or Microsoft System Center Configuration Manager + - Mobile device management (MDM) or Microsoft Endpoint Configuration Manager - A provisioning package created in Windows Configuration Designer - Group Policy to deploy a scheduled task that runs a Powershell script @@ -58,9 +62,9 @@ There are several ways to configure devices for assessments. You can: For more info about these methods, see [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md). -- **Distribute the assessment URL through the web, email, OneNote, or any other method of your choosing. You can also create shortcuts to distribute the link** +2. **Create and distribute the assessment URL through the web, email, OneNote, or any other method** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. + This allows teachers and test administrators an easier way to deploy assessments quickly and simply. We recommend this method for lower stakes assessments. You can also create shortcuts to distribute the link. You can enable this using a schema activation. diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 838aa85226..136499ee4c 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -searchScope: +author: dansimp +searchScope: - Store -ms.author: macapara +ms.author: dansimp ms.date: 01/05/2018 ms.reviewer: manager: dansimp @@ -93,7 +93,7 @@ Enter email addresses for your students, and each student will get an email with ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) You can assign the app to students with work or school accounts.
          - If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Office 365 portal where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. + If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Microsoft 365 admin center where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. **To finish Minecraft install (for students)** diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md index 8f8f6c6aa2..2b64a32bd1 100644 --- a/education/windows/test-windows10s-for-edu.md +++ b/education/windows/test-windows10s-for-edu.md @@ -7,8 +7,8 @@ ms.prod: w10 ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/30/2019 ms.reviewer: manager: dansimp @@ -51,7 +51,7 @@ Due to these reasons, we recommend that you use the installation tool and avoid Before you install Windows 10 in S mode on your existing Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise device: * Make sure that you updated your existing device to Windows 10, version 1703 (Creators Update). - See [Download Windows 10](https://www.microsoft.com/en-us/software-download/windows10) and follow the instructions to update your device to Windows 10, version 1703. You can verify your current version in **Settings > System > About**. + See [Download Windows 10](https://www.microsoft.com/software-download/windows10) and follow the instructions to update your device to Windows 10, version 1703. You can verify your current version in **Settings > System > About**. * Install the latest Windows Update. @@ -184,7 +184,7 @@ If you see this message, follow these steps to stop receiving the message: To use an installation media to reinstall Windows 10, follow these steps. -1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/en-us/software-download/windows10). +1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/software-download/windows10). 2. Download the Media Creation Tool and then run it. 3. Select **Create installation media for another PC**. 4. Choose a language, edition, and architecture (64-bit or 32-bit). diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 1af547f463..3f31119391 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/23/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index 52a4aa6bb6..4197cf6869 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp @@ -30,10 +30,10 @@ Windows 10, version 1607 introduces two editions designed for the unique needs o Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools. Windows 10 Pro Education is effectively a variant of Windows 10 Pro that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). -For Cortana[1](#footnote1), +For Cortana[1](#footnote1): - If you're using version 1607, Cortana is removed. -- If you're using new devices with version 1703, Cortana is turned on by default. -- If you're upgrading from version 1607 to version 1703, Cortana will be enabled. +- If you're using new devices with version 1703 or later, Cortana is turned on by default. +- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). @@ -49,10 +49,10 @@ Customers who deploy Windows 10 Pro are able to configure the product to have si Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise-grade manageability and security desired by many schools. Windows 10 Education is effectively a variant of Windows 10 Enterprise that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). -For Cortana1, +For Cortana1: - If you're using version 1607, Cortana1 is removed. -- If you're using new devices with version 1703, Cortana is turned on by default. -- If you're upgrading from version 1607 to version 1703, Cortana will be enabled. +- If you're using new devices with version 1703 or later, Cortana is turned on by default. +- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). diff --git a/images/sc-image402.png b/images/sc-image402.png new file mode 100644 index 0000000000..8bfe73fd87 Binary files /dev/null and b/images/sc-image402.png differ diff --git a/mdop/TOC.md b/mdop/TOC.md deleted file mode 100644 index 91a625282c..0000000000 --- a/mdop/TOC.md +++ /dev/null @@ -1,21 +0,0 @@ -# [Microsoft Desktop Optimization Pack](index.md) -## [Advanced Group Policy Management](agpm/index.md) -## Application Virtualization -### [Application Virtualization 5](appv-v5/index.md) -### [Application Virtualization 4](appv-v4/index.md) -### [SoftGrid Application Virtualization](softgrid-application-virtualization.md) -## Diagnostics and Recovery Toolset -### [Diagnostics and Recovery Toolset 10](dart-v10/index.md) -### [Diagnostics and Recovery Toolset 8](dart-v8/index.md) -### [Diagnostics and Recovery Toolset 7](dart-v7/index.md) -### [Diagnostics and Recovery Toolset 6.5](dart-v65.md) -## Microsoft Bitlocker Administration and Monitoring -### [Microsoft Bitlocker Administration and Monitoring 2.5](mbam-v25/index.md) -### [Microsoft Bitlocker Administration and Monitoring 2](mbam-v2/index.md) -### [Microsoft Bitlocker Administration and Monitoring 1](mbam-v1/index.md) -## Microsoft Enterprise Desktop Virtualization -### [Microsoft Enterprise Desktop Virtualization 2](medv-v2/index.md) -## User Experience Virtualization -### [User Experience Virtualization 2](uev-v2/index.md) -### [User Experience Virtualization 1](uev-v1/index.md) -## [MDOP Solutions and Scenarios](solutions/index.md) \ No newline at end of file diff --git a/mdop/agpm/TOC.md b/mdop/agpm/TOC.md deleted file mode 100644 index 319eeaf746..0000000000 --- a/mdop/agpm/TOC.md +++ /dev/null @@ -1,245 +0,0 @@ -# [Advanced Group Policy Management](index.md) -## [Technical Overview of AGPM](technical-overview-of-agpm.md) -## [Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md) -## [AGPM 4.0 SP3](agpm-40-sp3-navengl.md) -### [What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) -#### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) -## [AGPM 4.0 SP2](agpm-40-sp2-navengl.md) -### [What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) -#### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) -## [AGPM 4.0 SP1](agpm-40-sp1-navengl.md) -### [What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) -### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) -## [AGPM 4](agpm-4-navengl.md) -### [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) -### [What's New in AGPM 4.0](whats-new-in-agpm-40.md) -### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md) -### [Operations Guide for Microsoft Advanced Group Policy Management 4.0](operations-guide-for-microsoft-advanced-group-policy-management-40.md) -#### [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm40.md) -#### [Best Practices for Version Control](best-practices-for-version-control-agpm40.md) -#### [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive-agpm40.md) -#### [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md) -#### [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md) -#### [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) -##### [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) -###### [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md) -###### [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md) -###### [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm40.md) -###### [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm40.md) -###### [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md) -##### [Managing the Archive](managing-the-archive-agpm40.md) -###### [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md) -###### [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md) -###### [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm40.md) -###### [Import a GPO from a File](import-a-gpo-from-a-file-agpmadmin.md) -###### [Back Up the Archive](back-up-the-archive-agpm40.md) -###### [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) -##### [Managing the AGPM Service](managing-the-agpm-service-agpm40.md) -###### [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md) -###### [Modify the AGPM Service](modify-the-agpm-service-agpm40.md) -##### [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) -#### [Performing Editor Tasks](performing-editor-tasks-agpm40.md) -##### [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) -###### [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm40.md) -###### [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) -###### [Import a GPO from Production](import-a-gpo-from-production-agpm40-ed.md) -##### [Editing a GPO](editing-a-gpo-agpm40.md) -###### [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md) -###### [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm40.md) -###### [Rename a GPO or Template](rename-a-gpo-or-template-agpm40.md) -##### [Using a Test Environment](using-a-test-environment.md) -###### [Export a GPO to a File](export-a-gpo-to-a-file.md) -###### [Import a GPO from a File](import-a-gpo-from-a-file-ed.md) -###### [Test a GPO in a Separate Organizational Unit](test-a-gpo-in-a-separate-organizational-unit-agpm40.md) -##### [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md) -##### [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) -###### [Create a Template](create-a-template-agpm40.md) -###### [Set a Default Template](set-a-default-template-agpm40.md) -##### [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) -###### [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm40.md) -###### [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm40.md) -#### [Performing Approver Tasks](performing-approver-tasks-agpm40.md) -##### [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md) -##### [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) -###### [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm40.md) -###### [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md) -###### [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm40.md) -###### [Import a GPO from Production](import-a-gpo-from-production-agpm40-app.md) -##### [Check In a GPO](check-in-a-gpo-agpm40.md) -##### [Deploy a GPO](deploy-a-gpo-agpm40.md) -##### [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md) -##### [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) -###### [Delete a Controlled GPO](delete-a-controlled-gpo-agpm40.md) -###### [Restore a Deleted GPO](restore-a-deleted-gpo-agpm40.md) -###### [Destroy a GPO](destroy-a-gpo-agpm40.md) -#### [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) -##### [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md) -##### [Review GPO Settings](review-gpo-settings-agpm40.md) -##### [Review GPO Links](review-gpo-links-agpm40.md) -##### [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md) -#### [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) -#### [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) -##### [Contents Tab](contents-tab-agpm40.md) -###### [Contents Tab Features](contents-tab-features-agpm40.md) -###### [History Window](history-window-agpm40.md) -###### [Controlled GPO Commands](controlled-gpo-commands-agpm40.md) -###### [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm40.md) -###### [Pending GPO Commands](pending-gpo-commands-agpm40.md) -###### [Template Commands](template-commands-agpm40.md) -###### [Recycle Bin Commands](recycle-bin-commands-agpm40.md) -##### [Domain Delegation Tab](domain-delegation-tab-agpm40.md) -##### [AGPM Server Tab](agpm-server-tab-agpm40.md) -##### [Production Delegation Tab](production-delegation-tab-agpm40.md) -##### [Administrative Templates Folder](administrative-templates-folder-agpm40.md) -###### [Logging and Tracing Settings](logging-and-tracing-settings-agpm40.md) -###### [AGPM Server Connection Settings](agpm-server-connection-settings-agpm40.md) -###### [Feature Visibility Settings](feature-visibility-settings-agpm40.md) -### [Release Notes for Microsoft Advanced Group Policy Management 4.0](release-notes-for-microsoft-advanced-group-policy-management-40.md) -## [AGPM 3](agpm-3-navengl.md) -### [What's New in AGPM 3.0](whats-new-in-agpm-30.md) -### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md) -### [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) -#### [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm30ops.md) -#### [Best Practices for Version Control](best-practices-for-version-control.md) -#### [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive.md) -#### [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm30ops.md) -#### [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) -##### [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) -###### [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md) -###### [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md) -###### [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm30ops.md) -###### [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm30ops.md) -###### [Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md) -##### [Managing the Archive](managing-the-archive.md) -###### [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md) -###### [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md) -###### [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm30ops.md) -###### [Back Up the Archive](back-up-the-archive.md) -###### [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) -##### [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md) -###### [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md) -###### [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md) -##### [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) -#### [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) -###### [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm30ops.md) -###### [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) -###### [Import a GPO from Production](import-a-gpo-from-production-agpm30ops.md) -##### [Editing a GPO](editing-a-gpo-agpm30ops.md) -###### [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md) -###### [Use a Test Environment](use-a-test-environment-agpm30ops.md) -###### [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md) -###### [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm30ops.md) -###### [Rename a GPO or Template](rename-a-gpo-or-template-agpm30ops.md) -##### [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) -###### [Create a Template](create-a-template-agpm30ops.md) -###### [Set a Default Template](set-a-default-template-agpm30ops.md) -##### [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm30ops.md) -###### [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm30ops.md) -###### [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm30ops.md) -#### [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) -##### [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) -###### [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm30ops.md) -###### [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm30ops.md) -###### [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm30ops.md) -###### [Import a GPO from Production](import-a-gpo-from-production-editor-agpm30ops.md) -##### [Check In a GPO](check-in-a-gpo-agpm30ops.md) -##### [Deploy a GPO](deploy-a-gpo-agpm30ops.md) -##### [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md) -##### [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) -###### [Delete a Controlled GPO](delete-a-controlled-gpo-agpm30ops.md) -###### [Restore a Deleted GPO](restore-a-deleted-gpo-agpm30ops.md) -###### [Destroy a GPO](destroy-a-gpo-agpm30ops.md) -#### [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) -##### [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md) -##### [Review GPO Settings](review-gpo-settings-agpm30ops.md) -##### [Review GPO Links](review-gpo-links-agpm30ops.md) -##### [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md) -#### [Troubleshooting AGPM](troubleshooting-advanced-group-policy-management-agpm30ops.md) -#### [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) -##### [Contents Tab](contents-tab-agpm30ops.md) -###### [Contents Tab Features](contents-tab-features-agpm30ops.md) -###### [History Window](history-window-agpm30ops.md) -###### [Controlled GPO Commands](controlled-gpo-commands-agpm30ops.md) -###### [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm30ops.md) -###### [Pending GPO Commands](pending-gpo-commands-agpm30ops.md) -###### [Template Commands](template-commands-agpm30ops.md) -###### [Recycle Bin Commands](recycle-bin-commands-agpm30ops.md) -##### [Domain Delegation Tab](domain-delegation-tab-agpm30ops.md) -##### [AGPM Server Tab](agpm-server-tab-agpm30ops.md) -##### [Production Delegation Tab](production-delegation-tab-agpm30ops.md) -##### [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) -###### [Logging and Tracing Settings](logging-and-tracing-settings-agpm30ops.md) -###### [AGPM Server Connection Settings](agpm-server-connection-settings-agpm30ops.md) -###### [Feature Visibility Settings](feature-visibility-settings-agpm30ops.md) -## [AGPM 2.5](agpm-25-navengl.md) -### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5](step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md) -### [Operations Guide for Microsoft Advanced Group Policy Management 2.5](operations-guide-for-microsoft-advanced-group-policy-management-25.md) -#### [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management.md) -#### [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md) -#### [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) -##### [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md) -##### [Configure E-Mail Notification](configure-e-mail-notification.md) -##### [Delegate Domain-Level Access](delegate-domain-level-access.md) -##### [Delegate Access to an Individual GPO](delegate-access-to-an-individual-gpo.md) -##### [Configure Logging and Tracing](configure-logging-and-tracing.md) -##### [Managing the AGPM Service](managing-the-agpm-service.md) -###### [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md) -###### [Modify the Archive Path](modify-the-archive-path.md) -###### [Modify the AGPM Service Account](modify-the-agpm-service-account.md) -###### [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md) -#### [Performing Editor Tasks](performing-editor-tasks.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) -###### [Request Control of a Previously Uncontrolled GPO](request-control-of-a-previously-uncontrolled-gpo.md) -###### [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) -###### [Import a GPO from Production](import-a-gpo-from-production-editor.md) -##### [Editing a GPO](editing-a-gpo.md) -###### [Edit a GPO Offline](edit-a-gpo-offline.md) -###### [Use a Test Environment](use-a-test-environment.md) -###### [Request Deployment of a GPO](request-deployment-of-a-gpo.md) -###### [Label the Current Version of a GPO](label-the-current-version-of-a-gpo.md) -###### [Rename a GPO or Template](rename-a-gpo-or-template.md) -##### [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) -###### [Create a Template](create-a-template.md) -###### [Set a Default Template](set-a-default-template.md) -##### [Delete a GPO](delete-a-gpo-editor.md) -#### [Performing Approver Tasks](performing-approver-tasks.md) -##### [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) -###### [Control a Previously Uncontrolled GPO](control-a-previously-uncontrolled-gpo.md) -###### [Create a New Controlled GPO](create-a-new-controlled-gpo.md) -###### [Delegate Access to a GPO](delegate-access-to-a-gpo.md) -###### [Import a GPO from Production](import-a-gpo-from-production-approver.md) -##### [Check In a GPO](check-in-a-gpo-approver.md) -##### [Deploy a GPO](deploy-a-gpo.md) -##### [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo.md) -##### [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) -###### [Delete a GPO](delete-a-gpo-approver.md) -###### [Restore a Deleted GPO](restore-a-deleted-gpo.md) -###### [Destroy a GPO](destroy-a-gpo.md) -#### [Performing Reviewer Tasks](performing-reviewer-tasks.md) -##### [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md) -##### [Review GPO Settings](review-gpo-settings.md) -##### [Review GPO Links](review-gpo-links.md) -##### [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates.md) -#### [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management.md) -#### [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) -##### [Contents Tab](contents-tab.md) -###### [Controlled Tab](controlled-tab.md) -###### [Uncontrolled Tab](uncontrolled-tab.md) -###### [Pending Tab](pending-tab.md) -###### [Templates Tab](templates-tab.md) -###### [Recycle Bin Tab](recycle-bin-tab.md) -###### [Common Secondary Tab Features](common-secondary-tab-features.md) -###### [History Window](history-window.md) -##### [Domain Delegation Tab](domain-delegation-tab.md) -##### [AGPM Server Tab](agpm-server-tab.md) -##### [Administrative Template Settings](administrative-template-settings.md) -###### [Logging and Tracing Settings](logging-and-tracing-settings.md) -###### [AGPM Server Connection Settings](agpm-server-connection-settings.md) -###### [Feature Visibility Settings](feature-visibility-settings.md) -##### [Other Enhancements to the GPMC](other-enhancements-to-the-gpmc.md) -## [Troubleshooting AGPM Upgrades](troubleshooting-agpm40-upgrades.md) -## [Resources for AGPM](resources-for-agpm.md) - diff --git a/mdop/agpm/administrative-template-settings.md b/mdop/agpm/administrative-template-settings.md deleted file mode 100644 index 80b6ac71d2..0000000000 --- a/mdop/agpm/administrative-template-settings.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Administrative Template Settings -description: Administrative Template Settings -author: mjcaparas -ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrative Template Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM clients and servers to which a Group Policy object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** node and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. - -- [Logging and Tracing Settings](logging-and-tracing-settings.md) - -- [AGPM Server Connection Settings](agpm-server-connection-settings.md) - -- [Feature Visibility Settings](feature-visibility-settings.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/administrative-templates-folder-agpm30ops.md b/mdop/agpm/administrative-templates-folder-agpm30ops.md deleted file mode 100644 index 5e0fc9628c..0000000000 --- a/mdop/agpm/administrative-templates-folder-agpm30ops.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Administrative Templates Folder -description: Administrative Templates Folder -author: mjcaparas -ms.assetid: 0cc5b570-b6d3-4841-9646-02521c13519c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrative Templates Folder - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Clients and AGPM Servers to which a Group Policy Object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. - -- [Logging and Tracing Settings](logging-and-tracing-settings-agpm30ops.md) - -- [AGPM Server Connection Settings](agpm-server-connection-settings-agpm30ops.md) - -- [Feature Visibility Settings](feature-visibility-settings-agpm30ops.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/administrative-templates-folder-agpm40.md b/mdop/agpm/administrative-templates-folder-agpm40.md deleted file mode 100644 index f40c1aca18..0000000000 --- a/mdop/agpm/administrative-templates-folder-agpm40.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Administrative Templates Folder -description: Administrative Templates Folder -author: mjcaparas -ms.assetid: abc41968-4505-4b09-94f2-67ee0e6c9aaf -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrative Templates Folder - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Clients and AGPM Servers to which a Group Policy Object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. - -- [Logging and Tracing Settings](logging-and-tracing-settings-agpm40.md) - -- [AGPM Server Connection Settings](agpm-server-connection-settings-agpm40.md) - -- [Feature Visibility Settings](feature-visibility-settings-agpm40.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/advanced-group-policy-management-40.md b/mdop/agpm/advanced-group-policy-management-40.md deleted file mode 100644 index 0ea0886272..0000000000 --- a/mdop/agpm/advanced-group-policy-management-40.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Advanced Group Policy Management 4.0 -description: Advanced Group Policy Management 4.0 -author: mjcaparas -ms.assetid: 9873a1f7-97fc-4546-9538-b4c0308529c0 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Advanced Group Policy Management 4.0 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC). AGPM provides comprehensive change control and improved management of Group Policy Objects (GPOs). - -Using AGPM, you can do these tasks: - -- Perform offline editing of GPOs so that you can create and test them before you deploy them to a production environment. - -- Maintain multiple versions of a GPO in a central archive so that you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people by using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting one another's work by using the check-in and check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO by using difference reporting. - -- Simplify creating new GPOs by using GPO templates, storing common policy settings and preference settings to use as starting points for new GPOs. - -- Delegate access to the production environment. - -- Search for GPOs with specific attributes and filter the list of GPOs displayed. - -- Export a GPO to a file so that you can copy it from a domain in a test forest to a domain in a production forest. - -AGPM adds a **Change Control** folder under each domain displayed in the GPMC, in addition to a **History** tab for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm40.md) - -- [Best Practices for Version Control](best-practices-for-version-control-agpm40.md) - -- [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive-agpm40.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md) - -- [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -- [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-25-navengl.md b/mdop/agpm/agpm-25-navengl.md deleted file mode 100644 index 6b407bf5e4..0000000000 --- a/mdop/agpm/agpm-25-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 2.5 -description: AGPM 2.5 -author: mjcaparas -ms.assetid: 6db42f2e-88b2-4305-ab6b-d3cd0c5d686c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 2.5 - - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5](step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md) - -- [Operations Guide for Microsoft Advanced Group Policy Management 2.5](operations-guide-for-microsoft-advanced-group-policy-management-25.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-3-navengl.md b/mdop/agpm/agpm-3-navengl.md deleted file mode 100644 index fd7734162e..0000000000 --- a/mdop/agpm/agpm-3-navengl.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: AGPM 3 -description: AGPM 3 -author: mjcaparas -ms.assetid: b0d0051d-2900-4a0f-8307-552ad26b0e3b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 3 - - -- [What's New in AGPM 3.0](whats-new-in-agpm-30.md) - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md) - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-4-navengl.md b/mdop/agpm/agpm-4-navengl.md deleted file mode 100644 index dbf263cc72..0000000000 --- a/mdop/agpm/agpm-4-navengl.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: AGPM 4 -description: AGPM 4 -author: mjcaparas -ms.assetid: 81693f30-1b8e-4e63-b1ac-e6de1bc30cc0 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4 - - -- [What's New in AGPM 4.0](whats-new-in-agpm-40.md) - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md) - -- [Operations Guide for Microsoft Advanced Group Policy Management 4.0](operations-guide-for-microsoft-advanced-group-policy-management-40.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0](release-notes-for-microsoft-advanced-group-policy-management-40.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-40-sp1-navengl.md b/mdop/agpm/agpm-40-sp1-navengl.md deleted file mode 100644 index 03a4a2a65d..0000000000 --- a/mdop/agpm/agpm-40-sp1-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 4.0 SP1 -description: AGPM 4.0 SP1 -author: mjcaparas -ms.assetid: 4e55d9e6-635c-4ba6-acbb-ed1d1b580a5b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4.0 SP1 - - -- [What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-40-sp2-navengl.md b/mdop/agpm/agpm-40-sp2-navengl.md deleted file mode 100644 index 49ac51fa2d..0000000000 --- a/mdop/agpm/agpm-40-sp2-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 4.0 SP2 -description: AGPM 4.0 SP2 -author: mjcaparas -ms.assetid: 915c9791-ac07-43db-bd53-957b641c700f -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4.0 SP2 - - -- [What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-40-sp3-navengl.md b/mdop/agpm/agpm-40-sp3-navengl.md deleted file mode 100644 index 336886046c..0000000000 --- a/mdop/agpm/agpm-40-sp3-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 4.0 SP3 -description: AGPM 4.0 SP3 -author: mjcaparas -ms.assetid: cd80eea9-601f-4e45-b89e-c3904addee37 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4.0 SP3 - - -- [What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md deleted file mode 100644 index 60c6b4b4ab..0000000000 --- a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: AGPM Server Connection Settings -description: AGPM Server Connection Settings -author: mjcaparas -ms.assetid: 5f03e397-b868-4c49-9cbf-a5f5d0ddcc39 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Connection Settings - - -You can use Administrative template settings for Advanced Group Policy Management (AGPM) to centrally configure AGPM Server connections for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - - ---- - - - - - - - - - - - - - - - - -
          SettingEffect

          AGPM: Specify default AGPM Server (all domains)

          This policy setting allows you to specify a default AGPM Server for all domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to another archive. You can override this default for individual domains using the AGPM: Specify AGPM Servers setting.

          AGPM: Specify AGPM Servers

          This policy setting allows you to specify the AGPM Servers for individual domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to a different archive for the specified domain. To specify a default AGPM Server, use the AGPM: Specify default AGPM Server (all domains) setting and use this policy setting to override the default on a per domain basis.

          - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-connection-settings-agpm40.md b/mdop/agpm/agpm-server-connection-settings-agpm40.md deleted file mode 100644 index cd4a015986..0000000000 --- a/mdop/agpm/agpm-server-connection-settings-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: AGPM Server Connection Settings -description: AGPM Server Connection Settings -author: mjcaparas -ms.assetid: cc67f122-6309-4820-92c2-f6a27d897123 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Connection Settings - - -You can use Administrative template settings for Advanced Group Policy Management (AGPM) to centrally configure AGPM Server connections for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - - ---- - - - - - - - - - - - - - - - - -
          SettingEffect

          AGPM: Specify default AGPM Server (all domains)

          This policy setting allows you to specify a default AGPM Server for all domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to another archive. You can override this default for individual domains using the AGPM: Specify AGPM Servers setting.

          AGPM: Specify AGPM Servers

          This policy setting allows you to specify the AGPM Servers for individual domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to a different archive for the specified domain. To specify a default AGPM Server, use the AGPM: Specify default AGPM Server (all domains) setting and use this policy setting to override the default on a per domain basis.

          - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-connection-settings.md b/mdop/agpm/agpm-server-connection-settings.md deleted file mode 100644 index a303704f78..0000000000 --- a/mdop/agpm/agpm-server-connection-settings.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: AGPM Server Connection Settings -description: AGPM Server Connection Settings -author: mjcaparas -ms.assetid: faf78e5b-2b0d-4069-9b8c-910add892200 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Connection Settings - - -You can use Administrative template settings for Advanced Group Policy Management (AGPM) to centrally configure AGPM Server connections for Group Policy administrators to whom a Group Policy object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. If this path is not visible, right-click **Administrative Templates**, and add the agpm.admx or agpm.adm template. - - ---- - - - - - - - - - - - - - - - - -
          SettingEffect

          AGPM Server (all domains)

          If enabled, this setting centrally configures one AGPM Server connection for use by all domains and disables the settings on the AGPM Server tab for Group Policy administrators. For multiple AGPM Servers, configure this setting with a default server and then configure the AGPM Server setting in the Administrative template to override this server for other domains.

          -

          If disabled or not configured, each Group Policy administrator must select the AGPM Server to display for each domain on the AGPM Server tab in AGPM.

          AGPM Server

          If enabled, this setting centrally configures multiple domain-specific AGPM Servers, overriding the AGPM Server (all domains) setting in the Administrative template. If your environment requires only a single AGPM Server, use only the AGPM Server (all domains) setting in the Administrative template.

          -

          If disabled or not configured, the AGPM Server (all domains) setting in the Administrative template configures the AGPM Server connection.

          - -  - -### Additional references - -- [Administrative Template Settings](administrative-template-settings.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-tab-agpm30ops.md b/mdop/agpm/agpm-server-tab-agpm30ops.md deleted file mode 100644 index 184530ce23..0000000000 --- a/mdop/agpm/agpm-server-tab-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: AGPM Server Tab -description: AGPM Server Tab -author: mjcaparas -ms.assetid: fb3b0265-53ed-4bf6-88a4-c409f5f1bed4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Tab - - -The **AGPM Server** tab on the **Change Control** pane enables you to select an AGPM Server by entering a fully-qualified computer name and port, and to delete older versions of Group Policy Objects (GPOs) from the archive to conserve disk space on the AGPM Server. - -## Specifying the AGPM Server - - -The AGPM Server selected determines which archive is displayed for you on the **Contents** tab and to which location the **Domain Delegation** settings are applied. The default port for Advanced Group Policy Management (AGPM) is port 4600. - -If the AGPM Server connection is centrally configured using Administrative template settings, the options on this tab for configuring the connection are unavailable. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - -## Deleting old GPO versions - - -By default, all versions of every controlled GPO are retained in the archive. However, you can configure the AGPM Service to limit the number of versions retained for each GPO and automatically delete the oldest version when that limit is exceeded. Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - -**Note**   -The maximum number of unique versions to store for each GPO does not include the current version, so entering 0 retains only the current version. The limit must be no greater than 999 versions. - -When a GPO version is deleted, a record of that version remains in the history of the GPO, but the GPO version itself is deleted from the archive. You can prevent a GPO version from being deleted by marking it in the history as not deletable. - - - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/agpm-server-tab-agpm40.md b/mdop/agpm/agpm-server-tab-agpm40.md deleted file mode 100644 index 6e0807ad30..0000000000 --- a/mdop/agpm/agpm-server-tab-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: AGPM Server Tab -description: AGPM Server Tab -author: mjcaparas -ms.assetid: a6689437-233e-4f33-a0d6-f7d432c96c00 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Tab - - -The **AGPM Server** tab on the **Change Control** pane enables you to select an AGPM Server by entering a fully-qualified computer name and port, and to delete older versions of Group Policy Objects (GPOs) from the archive to conserve disk space on the AGPM Server. - -## Specifying the AGPM Server - - -The AGPM Server selected determines which archive is displayed for you on the **Contents** tab and to which location the **Domain Delegation** settings are applied. The default port for Advanced Group Policy Management (AGPM) is port 4600. - -If the AGPM Server connection is centrally configured using Administrative template settings, the options on this tab for configuring the connection are unavailable. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - -## Deleting old GPO versions - - -By default, all versions of every controlled GPO are retained in the archive. However, you can configure the AGPM Service to limit the number of versions retained for each GPO and automatically delete the oldest version when that limit is exceeded. Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - -**Note**   -The maximum number of unique versions to store for each GPO does not include the current version, so entering 0 retains only the current version. The limit must be no greater than 999 versions. - -When a GPO version is deleted, a record of that version remains in the history of the GPO, but the GPO version itself is deleted from the archive. You can prevent a GPO version from being deleted by marking it in the history as not deletable. - - - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/agpm-server-tab.md b/mdop/agpm/agpm-server-tab.md deleted file mode 100644 index f009fdd1b3..0000000000 --- a/mdop/agpm/agpm-server-tab.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: AGPM Server Tab -description: AGPM Server Tab -author: mjcaparas -ms.assetid: ce4490b7-b564-49af-8962-858ee39e0016 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Tab - - -The **AGPM Server** tab on the **Change Control** pane enables you to select an AGPM Server by entering a fully-qualified computer name and port. The default port for Advanced Group Policy Management (AGPM) is port 4600. - -The AGPM Server selected determines which archive is displayed for you on the **Contents** tab and to which location the **Domain Delegation** settings are applied. - -If the AGPM Server connection is centrally configured using Administrative template settings, the options on this tab are unavailable. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md deleted file mode 100644 index 90d438d2f0..0000000000 --- a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Approve or Reject a Pending Action -description: Approve or Reject a Pending Action -author: mjcaparas -ms.assetid: 6d78989a-b600-4876-9dd9-bc6207ff2ce7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Approve or Reject a Pending Action - - -The core responsibility of an Approver is to evaluate and then approve or reject requests for Group Policy Object (GPO) creation, deployment, and deletion from Editors or Reviewers who do not have permission to complete those actions. Reports can assist an Approver with evaluating a new version of a GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To approve or reject a pending request** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -3. Right-click a pending GPO, and then click either **Approve** or **Reject**. - -4. If approving deployment, click **Advanced** in the **Approve Pending Operation** dialog box to review links to the GPO. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes** or **OK** to confirm approval or rejection of the pending action. If you have approved the request, the GPO is moved to the appropriate tab for the action performed. - - **Note**   - If an Approver's e-mail address is included in the **To e-mail address** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have the permissions required to perform the request that you are approving. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md deleted file mode 100644 index cba1a90592..0000000000 --- a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Approve or Reject a Pending Action -description: Approve or Reject a Pending Action -author: mjcaparas -ms.assetid: 078ea8b5-9ac5-45fc-9ac1-a1aa629c10b4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Approve or Reject a Pending Action - - -The core responsibility of an Approver is to evaluate and then approve or reject requests for Group Policy Object (GPO) creation, deployment, and deletion from Editors or Reviewers who do not have permission to complete those actions. Reports can assist an Approver with evaluating a new version of a GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To approve or reject a pending request** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -3. Right-click a pending GPO, and then click either **Approve** or **Reject**. - -4. If approving deployment, click **Advanced** in the **Approve Pending Operation** dialog box to review links to the GPO. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes** or **OK** to confirm approval or rejection of the pending action. If you have approved the request, the GPO is moved to the appropriate tab for the action performed. - - **Note**   - If an Approver's e-mail address is included in the **To e-mail address** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have the permissions required to perform the request that you are approving. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/approve-or-reject-a-pending-action.md b/mdop/agpm/approve-or-reject-a-pending-action.md deleted file mode 100644 index 08603a71fc..0000000000 --- a/mdop/agpm/approve-or-reject-a-pending-action.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Approve or Reject a Pending Action -description: Approve or Reject a Pending Action -author: mjcaparas -ms.assetid: 22921a51-50fb-4a47-bec1-4f563f523675 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Approve or Reject a Pending Action - - -The core responsibility of an Approver is to evaluate and then approve or reject requests for Group Policy object (GPO) creation, deployment, and deletion from Editors or Reviewers who do not have permission to complete those actions. The report capabilities of Advanced Group Policy Management (AGPM) can assist an Approver with evaluating a new version of a GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To approve or reject a pending request** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -3. Right-click a pending GPO, and then click either **Approve** or **Reject**. - -4. If approving deployment, click **Advanced** in the **Approve Pending Operation** dialog box to review links to the GPO. Pause the mouse pointer on a node in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes** or **OK** to confirm approval or rejection of the pending action. If you have approved the request, the GPO is moved to the appropriate tab for the action performed. - - **Note**   - If an Approver's e-mail address is included in the **To** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have the permissions required to perform the request that you are approving. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/back-up-the-archive-agpm40.md b/mdop/agpm/back-up-the-archive-agpm40.md deleted file mode 100644 index e07a0de456..0000000000 --- a/mdop/agpm/back-up-the-archive-agpm40.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Back Up the Archive -description: Back Up the Archive -author: mjcaparas -ms.assetid: 538d85eb-3596-4c1d-bbd7-26bc28857c28 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Back Up the Archive - - -To help in the recovery of the archive for Advanced Group Policy Management (AGPM) if there is a disaster, an AGPM Administrator (Full Control) should back up the archive frequently. By default, the archive is created in %ProgramData%\\Microsoft\\AGPM. However, you can specify a different path during the setup of Microsoft Advanced Group Policy Management - Server. - -A user account that has access to both the AGPM Server—the computer on which the AGPM Service is installed—and to the folder that contains the archive is required to complete this procedure. - -**To back up the archive** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -2. Back up the archive folder by using Windows Explorer, Xcopy, Windows Server® Backup, or another backup tool. Make sure that you back up hidden, system, and read-only files. - -3. Store the archive backup in a secure location. - -4. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -**Note**   -If an AGPM Administrator backs up the archive infrequently, the Group Policy Objects (GPOs) in the archive backup will not be current. To better ensure that the archive backup is current, back up the archive as part of your organization’s daily backup strategy. - - - -### Additional references - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/back-up-the-archive.md b/mdop/agpm/back-up-the-archive.md deleted file mode 100644 index a85193dcac..0000000000 --- a/mdop/agpm/back-up-the-archive.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Back Up the Archive -description: Back Up the Archive -author: mjcaparas -ms.assetid: 400176da-3518-4475-ad19-c96cda6ca7ba -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Back Up the Archive - - -To help in the recovery of the archive for Advanced Group Policy Management (AGPM) if there is a disaster, an AGPM Administrator (Full Control) should back up the archive frequently. By default, the archive is created in %ProgramData%\\Microsoft\\AGPM. However, you can specify a different path during the setup of Microsoft Advanced Group Policy Management - Server. - -A user account that has access to both the AGPM Server—the computer on which the AGPM Service is installed—and to the folder that contains the archive is required to complete this procedure. - -**To back up the archive** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -2. Back up the archive folder by using Windows Explorer, Xcopy, Windows Server® Backup, or another backup tool. Make sure that you back up hidden, system, and read-only files. - -3. Store the archive backup in a secure location. - -4. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -**Note**   -If an AGPM Administrator backs up the archive infrequently, the Group Policy Objects (GPOs) in the archive backup will not be current. To better ensure that the archive backup is current, back up the archive as part of your organization’s daily backup strategy. - - - -### Additional references - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/best-practices-for-version-control-agpm40.md b/mdop/agpm/best-practices-for-version-control-agpm40.md deleted file mode 100644 index 92a272c0d4..0000000000 --- a/mdop/agpm/best-practices-for-version-control-agpm40.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Best Practices for Version Control -description: Best Practices for Version Control -author: mjcaparas -ms.assetid: 4a2a1ac7-67f3-4ba3-ab07-860d33da0efe -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Best Practices for Version Control - - -Microsoft Advanced Group Policy Management (AGPM) provides version control for Group Policy Objects (GPOs) much like Microsoft Visual SourceSafe® provides version control for source code. Developers can use Visual SourceSafe to manage multiple versions of each source file. Group Policy administrators can use AGPM to do the same for GPOs. When you use AGPM, Group Policy administrators should be aware of best practices that apply to any version control system: - -- **Date and time:** AGPM stamps each version of a GPO with the date and time. To ensure that history is accurate, especially when you edit GPOs on more than one computer, make sure that each computer synchronizes its clock with one authoritative time source. - -- **Check in GPOs when you are finished editing them:** It is common for Editors to check out GPOs and forget to check them back into the archive. However, this can prevent other Group Policy administrators from changing the GPO. Always check GPOs back in to AGPM immediately when you are finished editing. - -- **Save changes frequently:** When you edit a GPO, save changes frequently. Most Editors check out a GPO, make many changes, and then check the GPO into the archive. Instead, check the GPO into the archive regularly, and then check it out again. The detail can be as small as checking in the GPO after you change every setting (not recommended) or checking in the GPO after you make groups of related changes. The result is a better-documented history for each GPO that can help when troubleshooting issues. - -- **Deploy GPOs frequently:** Do not let new and edited GPOs that have not yet been deployed accumulate in large numbers in the archive. Instead, deploy new and edited GPOs as soon as possible so that they have a minimum effect on the production environment. Deploying many new and edited GPOs at one time can jeopardize the production environment. - -- **Document the purpose of changes when you check in GPOs:** Any Reviewer can compare versions of a GPO to see specific changes between the two. Documenting those specific changes adds no value. Instead, document the intent and purpose of a change instead of documenting what Reviewers can see by viewing difference reports. Version comments should add value to the comparison report and help a Reviewer understand why the Editor changed the GPO. - -- **Test GPOs in a test environment:** Deploying GPOs to the production environment without testing them is risky. Instead, test your GPOs in a domain in a test forest, and then export the GPOs to files and import them to a domain in a production forest. Also, you can link GPOs to an organizational unit that contains test computers and users. Verify that each GPO functions correctly in the test environment and then deploy the GPOs to the production environment. - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - -  - -  - - - - - diff --git a/mdop/agpm/best-practices-for-version-control.md b/mdop/agpm/best-practices-for-version-control.md deleted file mode 100644 index 0ec09f3051..0000000000 --- a/mdop/agpm/best-practices-for-version-control.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Best Practices for Version Control -description: Best Practices for Version Control -author: mjcaparas -ms.assetid: 89067f6a-f7ea-4dad-999d-118284cf6c5a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Best Practices for Version Control - - -Microsoft Advanced Group Policy Management (AGPM) provides version control for Group Policy Objects (GPOs) much like Microsoft Visual SourceSafe® provides version control for source code. Developers can use Visual SourceSafe to manage multiple versions of each source file. Group Policy administrators can use AGPM to do the same for GPOs. When you use AGPM, Group Policy administrators should be aware of best practices that apply to any version control system: - -- **Date and time:** AGPM stamps each version of a GPO with the date and time. To ensure that history is accurate, especially when you edit GPOs on more than one computer, make sure that each computer synchronizes its clock with one authoritative time source. - -- **Check in GPOs when you are finished editing them:** It is common for Editors to check out GPOs and forget to check them back into the archive. However, this can prevent other Group Policy administrators from changing the GPO. Always check GPOs back in to AGPM immediately when you are finished editing. - -- **Save changes frequently:** When you edit a GPO, save changes frequently. Most Editors check out a GPO, make many changes, and then check the GPO into the archive. Instead, check the GPO into the archive regularly, and then check it out again. The detail can be as small as checking in the GPO after you change every setting (not recommended) or checking in the GPO after you make groups of related changes. The result is a better-documented history for each GPO that can help when troubleshooting issues. - -- **Deploy GPOs frequently:** Do not let new and edited GPOs that have not yet been deployed accumulate in large numbers in the archive. Instead, deploy new and edited GPOs as soon as possible so that they have a minimum effect on the production environment. Deploying many new and edited GPOs at one time can jeopardize the production environment. - -- **Document the purpose of changes when you check in GPOs:** Any Reviewer can compare versions of a GPO to see specific changes between the two. Documenting those specific changes adds no value. Instead, document the intent and purpose of a change instead of documenting what Reviewers can see by viewing difference reports. Version comments should add value to the comparison report and help a Reviewer understand why the Editor changed the GPO. - -- **Test GPOs in a lab before you deploy:** Deploying GPOs to the production environment without first testing them is risky. Instead, test GPOs in a lab environment by linking them to an organizational unit that contains test computers and users, and then verifying that they function correctly. After verifying each GPO in the lab, deploy the GPO to the production environment. - -### Additional references - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/check-in-a-gpo-agpm30ops.md b/mdop/agpm/check-in-a-gpo-agpm30ops.md deleted file mode 100644 index 399b6e1604..0000000000 --- a/mdop/agpm/check-in-a-gpo-agpm30ops.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Check In a GPO -description: Check In a GPO -author: mjcaparas -ms.assetid: 437397db-c94b-4940-b1a4-05442619ebee -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Check In a GPO - - -Ordinarily, Editors should check in Group Policy Objects (GPOs) that they have edited when their modifications are complete. (For details, see [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md).) However, if the Editor is unavailable, an Approver can also check in a GPO. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To check in a GPO that has been checked out by an Editor** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - - - To discard any changes made by the Editor, right-click the GPO, click **Undo Check Out**, and then click **Yes** to confirm. - - - To retain changes made by the Editor, right-click the GPO and then click **Check In**. - -3. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/check-in-a-gpo-agpm40.md b/mdop/agpm/check-in-a-gpo-agpm40.md deleted file mode 100644 index 1353c657f0..0000000000 --- a/mdop/agpm/check-in-a-gpo-agpm40.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Check In a GPO -description: Check In a GPO -author: mjcaparas -ms.assetid: b838c8a2-eb9e-4e5b-8740-d7701a4294ac -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Check In a GPO - - -Ordinarily, Editors should check in Group Policy Objects (GPOs) that they have edited when their modifications are complete. (For details, see [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md).) However, if the Editor is unavailable, an Approver can also check in a GPO. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To check in a GPO that has been checked out by an Editor** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - - - To discard any changes made by the Editor, right-click the GPO, click **Undo Check Out**, and then click **Yes** to confirm. - - - To retain changes made by the Editor, right-click the GPO and then click **Check In**. - -3. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/check-in-a-gpo-approver.md b/mdop/agpm/check-in-a-gpo-approver.md deleted file mode 100644 index 1b264c6d74..0000000000 --- a/mdop/agpm/check-in-a-gpo-approver.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Check In a GPO -description: Check In a GPO -author: mjcaparas -ms.assetid: e428cfff-651f-4903-bf01-d742714d2fa9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Check In a GPO - - -Ordinarily, Editors should check in Group Policy objects (GPOs) that they have edited when their modifications are complete. (For details, see [Edit a GPO Offline](edit-a-gpo-offline.md).) However, if the Editor is unavailable, an Approver can also check in a GPO. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To check in a GPO that has been checked out by an Editor** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - - - To discard any changes made by the Editor, right-click the GPO, click **Undo Check Out**, and then click **Yes** to confirm. - - - To retain changes made by the Editor, right-click the GPO and then click **Check In**. - -3. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Edit a GPO Offline](edit-a-gpo-offline.md) - -  - -  - - - - - diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md deleted file mode 100644 index 4b298d6115..0000000000 --- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Checklist Administer the AGPM Server and Archive -description: Checklist Administer the AGPM Server and Archive -author: mjcaparas -ms.assetid: d9c60203-90c2-48a7-9318-197e0ec5038b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Administer the AGPM Server and Archive - - -In Advanced Group Policy Management (AGPM), both the AGPM Service and the archive are managed by AGPM Administrators (Full Control). The following are typical tasks for an AGPM Administrator. - - ---- - - - - - - - - - - - - - - - - -
          Frequent TaskReference

          Delegate access to Group Policy Objects (GPOs) in the archive.

          Delegate Domain-Level Access to the Archive

          -

          Delegate Access to an Individual GPO in the Archive

          Back up the archive to enable disaster recovery.

          Back Up the Archive

          - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Infrequent TaskReference

          Restore the archive from a backup to recover from a disaster.

          Restore the Archive from a Backup

          Move the AGPM Service, the archive, or both to a different server.

          Move the AGPM Server and the Archive

          Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens.

          Modify the AGPM Service

          Troubleshoot common problems with the AGPM Server.

          Troubleshooting AGPM

          -

          Configure Logging and Tracing

          - - - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md deleted file mode 100644 index 51a6f1f128..0000000000 --- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Checklist Administer the AGPM Server and Archive -description: Checklist Administer the AGPM Server and Archive -author: mjcaparas -ms.assetid: 0b2eb536-c3cc-462f-a42f-27a53f57bc55 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Administer the AGPM Server and Archive - - -In Advanced Group Policy Management (AGPM), both the AGPM Service and the archive are managed by AGPM Administrators (Full Control). The following are typical tasks for an AGPM Administrator. - - ---- - - - - - - - - - - - - - - - - -
          Frequent TaskReference

          Delegate access to Group Policy Objects (GPOs) in the archive.

          Delegate Domain-Level Access to the Archive

          -

          Delegate Access to an Individual GPO in the Archive

          Back up the archive to enable disaster recovery.

          Back Up the Archive

          - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Infrequent TaskReference

          Restore the archive from a backup to recover from a disaster.

          Restore the Archive from a Backup

          Move the AGPM Service, the archive, or both to a different server.

          Move the AGPM Server and the Archive

          Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens.

          Modify the AGPM Service

          Troubleshoot common problems with the AGPM Server.

          Troubleshooting Advanced Group Policy Management

          -

          Configure Logging and Tracing

          - - - -### Additional references - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md deleted file mode 100644 index 25fa7701f1..0000000000 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Checklist Create, Edit, and Deploy a GPO -description: Checklist Create, Edit, and Deploy a GPO -author: mjcaparas -ms.assetid: a7a17706-304a-4455-9ada-52508ec620f1 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Create, Edit, and Deploy a GPO - - -In an environment where multiple people make changes to Group Policy Objects (GPOs) using Advanced Group Policy Management (AGPM), an AGPM Administrator (Full Control) delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. The following is a typical GPO development process for an Editor and an Approver. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReference

          Editor requests the creation of a new GPO or an Approver creates a new GPO.

          Request the Creation of a New Controlled GPO

          -

          Create a New Controlled GPO

          Approver approves the creation of the GPO if it was requested by an Editor.

          Approve or Reject a Pending Action

          Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.

          Edit a GPO Offline

          Editor requests deployment of the GPO to the production environment.

          Request Deployment of a GPO

          Reviewers, such as Approvers or Editors, analyze the GPO.

          Performing Reviewer Tasks

          Approver approves and deploys the GPO to the production environment or rejects the GPO.

          Approve or Reject a Pending Action

          - - - -### Additional references - -[Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md deleted file mode 100644 index a95a9654f7..0000000000 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Checklist Create, Edit, and Deploy a GPO -description: Checklist Create, Edit, and Deploy a GPO -author: mjcaparas -ms.assetid: 44631bed-16d2-4b5a-af70-17a73fb5f6af -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Create, Edit, and Deploy a GPO - - -In an environment where multiple people change Group Policy Objects (GPOs) by using Advanced Group Policy Management (AGPM), an AGPM Administrator (Full Control) delegates permission to Editors, Approvers, and Reviewers either as groups or as individuals. The following is a typical GPO development process for an Editor and an Approver. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReference

          Editor requests that a new GPO be created or an Approver creates a new GPO.

          Request the Creation of a New Controlled GPO

          -

          Create a New Controlled GPO

          Approver approves the creation of the GPO if it was requested by an Editor.

          Approve or Reject a Pending Action

          Editor checks out a copy of the GPO from the archive so that no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.

          Edit a GPO Offline

          If developing in a test forest, Editor exports the GPO to a file, transfers the file to the production forest, and imports the file. Additionally, an Editor can link the GPO to an organizational unit that contains test computers and users.

          Using a Test Environment

          Editor requests deployment of the GPO to the production environment of the domain.

          Request Deployment of a GPO

          Reviewers, such as Approvers or Editors, analyze the GPO.

          Performing Reviewer Tasks

          Approver approves and deploys the GPO to the production environment of the domain or rejects the GPO.

          Approve or Reject a Pending Action

          - - - -### Additional references - -[Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md deleted file mode 100644 index fcb032c722..0000000000 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Checklist Create, Edit, and Deploy a GPO -description: Checklist Create, Edit, and Deploy a GPO -author: mjcaparas -ms.assetid: 614e2d9a-c18b-4f62-99fd-e17a2ac8559d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Create, Edit, and Deploy a GPO - - -In an environment where multiple people make changes to Group Policy objects (GPOs), an AGPM Administrator (Full Control) delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. The following is a typical GPO development process for an Editor and an Approver. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReference

          Editor requests the creation of a new GPO or an Approver creates a new GPO.

          Request the Creation of a New Controlled GPO

          -

          Create a New Controlled GPO

          Approver approves the creation of the GPO if it was requested by an Editor.

          Approve or Reject a Pending Action

          Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.

          Edit a GPO Offline

          Editor requests deployment of the GPO to the production environment.

          Request Deployment of a GPO

          Reviewers, such as Approvers or Editors, analyze the GPO.

          Performing Reviewer Tasks

          Approver approves and deploys the GPO to the production environment or rejects the GPO.

          Approve or Reject a Pending Action

          - - - - - - - - - - - diff --git a/mdop/agpm/choosing-which-version-of-agpm-to-install.md b/mdop/agpm/choosing-which-version-of-agpm-to-install.md deleted file mode 100644 index c5b9d72127..0000000000 --- a/mdop/agpm/choosing-which-version-of-agpm-to-install.md +++ /dev/null @@ -1,309 +0,0 @@ ---- -title: Choosing Which Version of AGPM to Install -description: Choosing Which Version of AGPM to Install -author: mjcaparas -ms.assetid: 31357d2a-bc23-4e15-93f4-0beda8ab7a7b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/05/2017 ---- - - -# Choosing Which Version of AGPM to Install - - -Each release of Microsoft Advanced Group Policy Management (AGPM) supports specific versions of the Windows operating system. We strongly recommend that you run the AGPM Client and AGPM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -We recommend that you install the AGPM Server on the most recent version of the operating system in the domain. AGPM uses the Group Policy Management Console (GPMC) to back up and restore Group Policy Objects (GPOs). Because newer versions of the GPMC provide additional policy settings that are not available in earlier versions, you can manage more policy settings by using the most recent version of the operating system. - -All versions of AGPM can manage only the policy settings that were introduced in the same version or an earlier version of the operating system on which AGPM is running. For example, if you install AGPM 4.0 SP2 on Windows Server 2012, you can manage policy settings that were introduced in Windows Server 2012 or earlier, but you cannot manage policy settings that were introduced later, in Windows 8.1 or Windows Server 2012 R2. - -If the version of the GPMC on your AGPM Server is older than the version on the computers that administrators use to manage Group Policy, the AGPM Server will be unable to store any policy settings that are not available in the older version of the GPMC. For a spreadsheet of Group Policy settings included in Windows, see [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=613627). - -## AGPM 4.0 SP3 - - -If you are using computers that are running Windows 10 to manage GPOs, you must use AGPM 4.0 SP3. You cannot install earlier versions of AGPM on computers that are running the Windows 10 operating system. - -Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and the policy settings that you can manage by using AGPM 4.0 SP3. - -**Table 1: AGPM  4.0 SP3 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

          Windows Server 2016 or Windows 10

          Windows Server 2016 or Windows 10

          Supported

          Windows Server 2012 R2

          Windows 10

          Supported with the caveats outlined in KB 4015786 -

          Windows Server 2012 R2 or Windows 8.1

          Windows Server 2012 R2 or Windows 8.1

          Supported

          Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

          Windows Server 2012 or Windows 8.1

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2012, Windows Server 2008 R2, or Windows 7

          Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

          Not supported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

          - - - -## AGPM 4.0 SP2 - - -If you are using computers that are running Windows Server 2012 R2 or Windows 8.1 to manage GPOs, you must use AGPM 4.0 SP2. You cannot install earlier versions of AGPM on computers that are running those operating systems. - -Table 1 lists the operating systems on which you can install AGPM 4.0 SP2, and the policy settings that you can manage by using AGPM 4.0 SP2. - -**Table 2: AGPM 4.0 SP2 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

          Windows Server 2012 R2 or Windows 8.1

          Windows Server 2012 R2 or Windows 8.1

          Supported

          Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

          Windows Server 2012 or Windows 8.1

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2012, Windows Server 2008 R2, or Windows 7

          Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2012, Windows Server 2008 R2, or Windows 7

          Not supported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

          - - - -## AGPM 4.0 SP1 - - -Table 2 lists the operating systems on which you can install AGPM 4.0 SP1, and the policy settings that you can manage by using AGPM 4.0 SP1. - -**Table 3: AGPM 4.0 SP1 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

          Windows Server 2012

          Windows Server 2012

          Supported

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2012, Windows Server 2008 R2, or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2, or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2012, Windows Server 2008 R2, or Windows 7

          Supported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2, or Windows 7

          - - - -## AGPM 4.0 - - -Table 3 lists the operating systems on which you can install AGPM 4.0, and the policy settings that you can manage by using AGPM 4.0. - -**Table 4: AGPM 4.0 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported operating systems for the AGPM ServerSupported operating systems for the AGPM ClientAGPM Support

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 R2 or Windows 7

          Not supported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

          - - - -## Versions of AGPM that precede AGPM 4.0 - - -Table 4 lists the operating systems on which you can install the versions of AGPM that precede AGPM 4.0. If an operating system is not listed, you cannot install AGPM on that operating system. - -**Table 5: Supported operating systems for versions of AGPM that precede AGPM 4.0** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemVersion of AGPM that can be installed

          Windows Server 2008

          3.0

          Windows Vista with SP1

          3.0

          Windows Vista with no service pack installed (32-bit)

          2.5

          Windows Server 2003 (32-bit)

          2.5

          - - - -## How to Get MDOP Technologies - - -AGPM 4.0 SP2 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Advanced Group Policy Management](index.md) - - - - - - - - - diff --git a/mdop/agpm/common-secondary-tab-features.md b/mdop/agpm/common-secondary-tab-features.md deleted file mode 100644 index 7383568174..0000000000 --- a/mdop/agpm/common-secondary-tab-features.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Common Secondary Tab Features -description: Common Secondary Tab Features -author: mjcaparas -ms.assetid: 44a15c28-944c-49c1-8534-115ce1c362ed -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Common Secondary Tab Features - - -Each secondary tab has two sections—**Group Policy objects** and **Groups and Users**. - -## Group Policy objects section - - -The **Group Policy objects** section displays a filtered list of Group Policy objects (GPOs) and identifies the following characteristics for each GPO: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          GPO CharacteristicDescription

          Name

          Name of the Group Policy object.

          Computer (Comp.)

          Automatically generated version of the Computer Configuration portion of the GPO.

          User

          Automatically generated version of the User Configuration portion of the GPO.

          State

          The state of the selected GPO:

          -

          Deployed GPO icon Uncontrolled: Not managed by AGPM.

          -

          Checked in GPO icon Checked In: Available for authorized Editors to check out for editing or for a Group Policy administrator to deploy.

          -

          Checked out GPO icon Checked Out: Currently being edited. Unavailable for other Editors to check out until the Editor who checked it out or an AGPM Administrator checks it in.

          -

          Pending GPO icon Pending: Awaiting approval from a Group Policy administrator before being created, controlled, deployed, or deleted.

          -

          Checked in GPO icon Deleted: Deleted from the archive, but still able to be restored.

          -

          Template icon Template: A static version of a GPO for use as a starting point when creating new GPOs.

          -

          Default template icon Template (default): By default, this template is the starting point used when creating a new GPO.

          GPO Status

          The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled.

          WMI Filter

          Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters node for the domain in the console tree of the GPMC.

          Modified

          For a controlled GPO, the most recent date when it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified.

          Owner

          The Editor who checked in or the Approver who deployed the selected GPO.

          - -  - -## Groups and Users section - - -When a GPO is selected, the **Groups and Users** section displays a list of the groups and users with access to that GPO. The allowed permissions and inheritance are displayed for each group or user. An AGPM Administrator can configure permissions using either standard AGPM roles (Editor, Approver, and Reviewer) or a customized combination of permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor. Any user or group in Active Directory can be added.

          Remove

          Remove the selected entry from the Access Control List.

          Properties

          Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers.

          Advanced

          Open the Access Control List Editor.

          - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md), [Performing Editor Tasks](performing-editor-tasks.md), [Performing Approver Tasks](performing-approver-tasks.md), and [Performing Reviewer Tasks](performing-reviewer-tasks.md). - -### Additional references - -- [Contents Tab](contents-tab.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md b/mdop/agpm/configure-agpm-server-connections-agpm30ops.md deleted file mode 100644 index 14cb1c8009..0000000000 --- a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configure AGPM Server Connections -description: Configure AGPM Server Connections -author: mjcaparas -ms.assetid: 6062b77b-2fd7-442c-ad1b-6f14419ebd5f -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure AGPM Server Connections - - -All versions of each controlled Group Policy Object (GPO) are stored in a central archive so that Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete these procedures for centrally configuring archive locations for all Group Policy administrators. Review the details in "Additional considerations" in this topic. - -## Configuring AGPM Server connections - - -As an AGPM Administrator, you can ensure that all Group Policy administrators connect to the same AGPM Server by centrally configuring the associated setting. If your environment requires separate AGPM Servers for some or all domains, configure those additional AGPM Servers as exceptions to the default. If you do not centrally configure AGPM Server connections, each Group Policy administrator must manually configure the AGPM Server to be displayed for each domain. - -- [Configure an AGPM Server connection for all Group Policy administrators](#bkmk-defaultarchiveloc) - -- [Configure additional AGPM Server connections for all Group Policy administrators](#bkmk-additionalarchiveloc) - -- [Manually configure an AGPM Server connection for your account](#bkmk-manuallyconfigurearchiveloc) - -### - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -2. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -4. In the **Properties** window, select the **Enabled** check box, and type the fully-qualified computer name and port (for example, server.contoso.com:4600). - -5. Click **OK**. Unless you want to configure additional AGPM Server connections, close the **Group Policy Management Editor** window and deploy the GPO. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).) When Group Policy is updated, the AGPM Server connection is configured for all Group Policy administrators. - -### - -**To configure additional AGPM Server connections for all Group Policy administrators** - -1. If no AGPM Server connection has been configured, follow the preceding procedure to configure a default AGPM Server for all domains. - -2. To configure separate AGPM Servers for some or all domains (overriding the default AGPM Server), in the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -3. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and then **AGPM**. - -4. In the details pane, double-click **AGPM: Specify AGPM Servers**. - -5. In the **Properties** window, select the **Enabled** check box, and click **Show**. - -6. In the **Show Contents** window: - - 1. Click **Add**. - - 2. For **Value Name**, type the domain name (for example, server1.contoso.com). - - 3. For **Value**, type the AGPM Server name and port to use for this domain (for example, server2.contoso.com:4600), and then click **OK**. (By default, the AGPM Service listens on port 4600. To use a different port, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md).) - - 4. Repeat for each domain not using the default AGPM Server. - -7. Click **OK** to close the **Show Contents** and **Properties** windows. - -8. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).) When Group Policy is updated, the new AGPM Server connections are configured for all Group Policy administrators. - -### - -If you have centrally configured the AGPM Server connection, the option to manually configure it is unavailable for all Group Policy administrators. - -**To manually configure which AGPM Server to display for your account** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Enter the fully-qualified computer name for the AGPM Server that manages the archive used for this domain (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). - -4. Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- You must be able to edit and deploy a GPO to perform the procedures for centrally configuring AGPM Server connections for all Group Policy administrators. See [Editing a GPO](editing-a-gpo-agpm30ops.md) and [Deploy a GPO](deploy-a-gpo-agpm30ops.md) for additional detail. - -- The selected AGPM Server determines which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-agpm-server-connections-agpm40.md b/mdop/agpm/configure-agpm-server-connections-agpm40.md deleted file mode 100644 index f830c94dae..0000000000 --- a/mdop/agpm/configure-agpm-server-connections-agpm40.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configure AGPM Server Connections -description: Configure AGPM Server Connections -author: mjcaparas -ms.assetid: bbbb15e8-35e7-403c-b695-7a6ebeb87839 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure AGPM Server Connections - - -All versions of each controlled Group Policy Object (GPO) are stored in a central archive so that Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete these procedures for centrally configuring archive locations for all Group Policy administrators. Review the details in "Additional considerations" in this topic. - -## Configuring AGPM Server connections - - -As an AGPM Administrator, you can ensure that all Group Policy administrators connect to the same AGPM Server by centrally configuring the associated setting. If your environment requires separate AGPM Servers for some or all domains, configure those additional AGPM Servers as exceptions to the default. If you do not centrally configure AGPM Server connections, each Group Policy administrator must manually configure the AGPM Server to be displayed for each domain. - -- [Configure an AGPM Server connection for all Group Policy administrators](#bkmk-defaultarchiveloc) - -- [Configure additional AGPM Server connections for all Group Policy administrators](#bkmk-additionalarchiveloc) - -- [Manually configure an AGPM Server connection for your account](#bkmk-manuallyconfigurearchiveloc) - -### - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -2. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -4. In the **Properties** window, select the **Enabled** check box, and type the fully-qualified computer name and port (for example, server.contoso.com:4600). - -5. Click **OK**. Unless you want to configure additional AGPM Server connections, close the **Group Policy Management Editor** window and deploy the GPO. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md).) When Group Policy is updated, the AGPM Server connection is configured for all Group Policy administrators. - -### - -**To configure additional AGPM Server connections for all Group Policy administrators** - -1. If no AGPM Server connection has been configured, follow the preceding procedure to configure a default AGPM Server for all domains. - -2. To configure separate AGPM Servers for some or all domains (overriding the default AGPM Server), in the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -3. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and then **AGPM**. - -4. In the details pane, double-click **AGPM: Specify AGPM Servers**. - -5. In the **Properties** window, select the **Enabled** check box, and click **Show**. - -6. In the **Show Contents** window: - - 1. Click **Add**. - - 2. For **Value Name**, type the domain name (for example, server1.contoso.com). - - 3. For **Value**, type the AGPM Server name and port to use for this domain (for example, server2.contoso.com:4600), and then click **OK**. (By default, the AGPM Service listens on port 4600. To use a different port, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md).) - - 4. Repeat for each domain not using the default AGPM Server. - -7. Click **OK** to close the **Show Contents** and **Properties** windows. - -8. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md).) When Group Policy is updated, the new AGPM Server connections are configured for all Group Policy administrators. - -### - -If you have centrally configured the AGPM Server connection, the option to manually configure it is unavailable for all Group Policy administrators. - -**To manually configure which AGPM Server to display for your account** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Enter the fully-qualified computer name for the AGPM Server that manages the archive used for this domain (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). - -4. Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- You must be able to edit and deploy a GPO to perform the procedures for centrally configuring AGPM Server connections for all Group Policy administrators. See [Editing a GPO](editing-a-gpo-agpm40.md) and [Deploy a GPO](deploy-a-gpo-agpm40.md) for additional detail. - -- The selected AGPM Server determines which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md b/mdop/agpm/configure-an-agpm-server-connection-agpm40.md deleted file mode 100644 index 1d27c35dd9..0000000000 --- a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Configure an AGPM Server Connection -description: Configure an AGPM Server Connection -author: mjcaparas -ms.assetid: 409cbbcf-3b0e-459d-9bd2-75cb7b9430b0 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure an AGPM Server Connection - - -To ensure that you are connected to the correct central archive, review the configuration of the AGPM Server connection. If an AGPM Administrator (Full Control) has not configured an AGPM Server connection for you, then you must manually configure it. - -**To select an AGPM Server** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab: - - - If the options on the **AGPM Server** tab are unavailable, they have been centrally configured by an AGPM Administrator. - - - If the options on the **AGPM Server** tab are available, type the fully-qualified computer name for the AGPM Server (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- The AGPM Servers selected determine which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md b/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md deleted file mode 100644 index 4941464778..0000000000 --- a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configure an AGPM Server Connection -description: Configure an AGPM Server Connection -author: mjcaparas -ms.assetid: ae78dc74-111d-4509-b0a6-e8b8b451c22a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure an AGPM Server Connection - - -To ensure that you are connected to the correct central archive, review the configuration of the AGPM Server connection. If an AGPM Administrator (Full Control) has not configured an AGPM Server connection for you, then you must manually configure it. - -**To select an AGPM Server** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab: - - - If the options on the **AGPM Server** tab are unavailable, they have been centrally configured by an AGPM Administrator. - - - If the options on the **AGPM Server** tab are available, type the fully-qualified computer name for the AGPM Server (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- The AGPM Servers selected determine which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-notification-agpm30ops.md b/mdop/agpm/configure-e-mail-notification-agpm30ops.md deleted file mode 100644 index c1e769ec3e..0000000000 --- a/mdop/agpm/configure-e-mail-notification-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure E-Mail Notification -description: Configure E-Mail Notification -author: mjcaparas -ms.assetid: b32ce395-d1b9-4c5b-b765-97cdbf455f9e -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Notification - - -When an Editor or a Reviewer attempts to create, deploy, or delete a Group Policy Object (GPO), a request for this action is sent to a designated e-mail address or addresses so that an Approver can evaluate the request and implement or deny it. You determine the e-mail address or addresses to which notifications are sent, as well as the alias from which notifications are sent. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To e-mail address** field, type a comma-delimited list of e-mail addresses of Approvers who should receive requests for approval. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- E-mail notification for AGPM is a domain-level setting. You can provide different Approver e-mail addresses or AGPM e-mail aliases on each domain's **Domain Delegation** tab, or use the same e-mail addresses throughout your environment. - -- By default, e-mail messages sent as a result of actions in Advanced Group Policy Management (AGPM) are not encrypted. However, you can configure e-mail security for AGPM using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. For more information, see [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm30ops.md) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-notification-agpm40.md b/mdop/agpm/configure-e-mail-notification-agpm40.md deleted file mode 100644 index 10119ff76f..0000000000 --- a/mdop/agpm/configure-e-mail-notification-agpm40.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure E-Mail Notification -description: Configure E-Mail Notification -author: mjcaparas -ms.assetid: 06f19556-f296-4a80-86a4-4f446c992204 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Notification - - -When an Editor or a Reviewer attempts to create, deploy, or delete a Group Policy Object (GPO), a request for this action is sent to a designated e-mail address or addresses so that an Approver can evaluate the request and implement or deny it. You determine the e-mail address or addresses to which notifications are sent, as well as the alias from which notifications are sent. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To e-mail address** field, type a comma-delimited list of e-mail addresses of Approvers who should receive requests for approval. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- E-mail notification for AGPM is a domain-level setting. You can provide different Approver e-mail addresses or AGPM e-mail aliases on each domain's **Domain Delegation** tab, or use the same e-mail addresses throughout your environment. - -- By default, e-mail messages sent as a result of actions in Advanced Group Policy Management (AGPM) are not encrypted. However, you can configure e-mail security for AGPM using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. For more information, see [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm40.md). - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-notification.md b/mdop/agpm/configure-e-mail-notification.md deleted file mode 100644 index 865b510ca2..0000000000 --- a/mdop/agpm/configure-e-mail-notification.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Configure E-Mail Notification -description: Configure E-Mail Notification -author: mjcaparas -ms.assetid: 6e152de0-4376-4963-8d1a-3e7f5866d30f -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Notification - - -When an Editor or a Reviewer attempts to create, deploy, or delete a Group Policy object (GPO), a request for this action is sent to a designated e-mail address or addresses so that an Approver can evaluate the request and implement or deny it. You determine the e-mail address or addresses to which notifications are sent, as well as the alias from which notifications are sent. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To** field, type a comma-delimited list of e-mail addresses of Approvers who should receive requests for approval. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- E-mail notification for AGPM is a domain-level setting. You can provide different Approver e-mail addresses or AGPM e-mail aliases on each domain's **Domain Delegation** tab, or use the same e-mail addresses throughout your environment. - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md deleted file mode 100644 index 4e4802cb36..0000000000 --- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Configure E-Mail Security for AGPM -description: Configure E-Mail Security for AGPM -author: mjcaparas -ms.assetid: 4850ed8e-a1c6-43f0-95c5-853aa66a94ae -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Security for AGPM - - -By default, e-mail notifications sent because of actions in Advanced Group Policy Management (AGPM) are not encrypted and are sent through SMTP port 25. However, you can configure e-mail security for AGPM by using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. - -By encrypting AGPM e-mail notifications, you can better protect those that could reveal sensitive information about your organization’s security. Encrypting e-mail notifications is recommended when they are being relayed through remote mail servers, and may be required by some compliance regulations. - -**Caution**   -Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. - - - -A user account that has the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account that has the necessary permissions in AGPM is required to complete these procedures. Review the details in "Additional considerations" in this topic. - -**To configure e-mail security for AGPM by using Group Policy preferences** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all AGPM Servers for which you want to configure e-mail security. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -2. In the **Group Policy Management Editor** window, expand the **Computer Configuration**, **Preferences**, **Windows Settings**, and **Registry** folders. - -3. In the console tree, right-click **Registry**, point to **New**, click **Collection Item**, and type **AGPM e-mail security**. - -4. Create a Registry preference item to turn on encryption: - - 1. In the console tree, right-click **AGPM e-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path**, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **EncryptSmtp**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type **1** to use SSL encryption, or **0** to let e-mail to be sent without encryption. By default, e-mail is sent without encryption. - - 8. Click **OK**. - -5. Create a Registry preference item to specify the SMTP port: - - 1. In the console tree, right-click **AGPM E-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path** dialog box, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **SmtpPort**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type a port number for the SMTP port. By default, the SMTP port is port 25 if encryption is not enabled or port 587 if SSL encryption is enabled. - - 8. Click **OK**. - -6. Close the **Group Policy Management Editor** window, and then check in and deploy the GPO. For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md). - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure registry settings by using Group Policy Preferences. See [Editing a GPO](editing-a-gpo-agpm30ops.md) and [Deploy a GPO](deploy-a-gpo-agpm30ops.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - - - - - - - - - diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md deleted file mode 100644 index e4c204dcf0..0000000000 --- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Configure E-Mail Security for AGPM -description: Configure E-Mail Security for AGPM -author: mjcaparas -ms.assetid: b9c48894-0a10-4d03-8027-50ed3b02485a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Security for AGPM - - -By default, e-mail notifications sent because of actions in Advanced Group Policy Management (AGPM) are not encrypted and are sent through SMTP port 25. However, you can configure e-mail security for AGPM by using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. - -By encrypting AGPM e-mail notifications, you can better protect those that could reveal sensitive information about your organization’s security. Encrypting e-mail notifications is recommended when they are being relayed through remote mail servers, and may be required by some compliance regulations. - -**Caution**   -Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. - - - -A user account that has the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account that has the necessary permissions in AGPM is required to complete these procedures. Review the details in "Additional considerations" in this topic. - -**To configure e-mail security for AGPM by using Group Policy preferences** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all AGPM Servers for which you want to configure e-mail security. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -2. In the **Group Policy Management Editor** window, expand the **Computer Configuration**, **Preferences**, **Windows Settings**, and **Registry** folders. - -3. In the console tree, right-click **Registry**, point to **New**, click **Collection Item**, and type **AGPM e-mail security**. - -4. Create a Registry preference item to turn on encryption: - - 1. In the console tree, right-click **AGPM e-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path**, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **EncryptSmtp**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type **1** to use SSL encryption, or **0** to let e-mail to be sent without encryption. By default, e-mail is sent without encryption. Click **OK**. - -5. Create a Registry preference item to specify the SMTP port: - - 1. In the console tree, right-click **AGPM E-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path** dialog box, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **SmtpPort**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type a port number for the SMTP port. By default, the SMTP port is port 25 if encryption is not enabled or port 587 if SSL encryption is enabled. Click **OK**. - -6. Close the **Group Policy Management Editor** window, and then check in and deploy the GPO. For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md). - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure registry settings by using Group Policy Preferences. See [Editing a GPO](editing-a-gpo-agpm40.md) and [Deploy a GPO](deploy-a-gpo-agpm40.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md b/mdop/agpm/configure-logging-and-tracing-agpm30ops.md deleted file mode 100644 index 2fd5e988c9..0000000000 --- a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure Logging and Tracing -description: Configure Logging and Tracing -author: mjcaparas -ms.assetid: 4f89552f-e949-48b0-9325-23746034eaa4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Logging and Tracing - - -You can centrally configure optional logging and tracing using Administrative templates. This may be helpful when diagnosing any problems related to Advanced Group Policy Management (AGPM). - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account with the necessary permissions in AGPM is required to complete these procedures. Additionally, a user account with access to the AGPM Server is required to initiate logging on the AGPM Server. Review the details in "Additional considerations" in this topic. - -**To configure logging and tracing for AGPM** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators for which you want to turn on logging and tracing. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -2. In the **Group Policy Management Editor** window, click **Computer Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Configure logging**. - -4. In the **Properties** window, click **Enabled**, and configure the level of detail to record in the logs. - -5. Click **OK**. - -6. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).) After Group Policy is updated, you must restart the AGPM Service to start, modify, or stop logging on the AGPM Server. Group Policy administrators must close and restart the GPMC to start, modify, or stop logging on their computers. - - **Trace file locations**: - - - Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - - - Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure AGPM logging and tracing. See [Editing a GPO](editing-a-gpo-agpm30ops.md) and [Deploy a GPO](deploy-a-gpo-agpm30ops.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-logging-and-tracing-agpm40.md b/mdop/agpm/configure-logging-and-tracing-agpm40.md deleted file mode 100644 index 69c630de77..0000000000 --- a/mdop/agpm/configure-logging-and-tracing-agpm40.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure Logging and Tracing -description: Configure Logging and Tracing -author: mjcaparas -ms.assetid: 2418cb6a-7189-4080-8fe2-9c8d47dec62c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Logging and Tracing - - -You can centrally configure optional logging and tracing using Administrative templates. This may be helpful when diagnosing any problems related to Advanced Group Policy Management (AGPM). - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account with the necessary permissions in AGPM is required to complete these procedures. Additionally, a user account with access to the AGPM Server is required to initiate logging on the AGPM Server. Review the details in "Additional considerations" in this topic. - -**To configure logging and tracing for AGPM** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators for which you want to turn on logging and tracing. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -2. In the **Group Policy Management Editor** window, click **Computer Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Configure logging**. - -4. In the **Properties** window, click **Enabled**, and configure the level of detail to record in the logs. - -5. Click **OK**. - -6. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md).) After Group Policy is updated, you must restart the AGPM Service to start, modify, or stop logging on the AGPM Server. Group Policy administrators must close and restart the GPMC to start, modify, or stop logging on their computers. - - **Trace file locations**: - - - Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - - - Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure AGPM logging and tracing. See [Editing a GPO](editing-a-gpo-agpm40.md) and [Deploy a GPO](deploy-a-gpo-agpm40.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-logging-and-tracing.md b/mdop/agpm/configure-logging-and-tracing.md deleted file mode 100644 index 5146b45a14..0000000000 --- a/mdop/agpm/configure-logging-and-tracing.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Configure Logging and Tracing -description: Configure Logging and Tracing -author: mjcaparas -ms.assetid: 419231f9-e9db-4f91-a7cf-a0a73db25256 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Logging and Tracing - - -You can centrally configure optional logging and tracing for Advanced Group Policy Management (AGPM) using Administrative templates. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete these procedures. Additionally, a user account with access to the AGPM Server is required to initiate logging on the AGPM Server. Review the details in "Additional considerations" in this topic. - -**To configure logging and tracing for AGPM** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators for which you want to turn on logging and tracing. (For more information, see [Editing a GPO](editing-a-gpo.md).) - -2. In the **Group Policy Object Editor**, click **Computer Configuration**, **Administrative Templates**, and **Windows Components**. - -3. If **AGPM** is not listed under **Windows Components**: - - 1. Right-click **Administrative Templates** and click **Add/Remove Templates**. - - 2. Click **Add**, select **agpm.admx** or **agpm.adm**, click **Open**, and then click **Close**. - -4. Under **Windows Components**, double-click **AGPM**. - -5. In the details pane, double-click **AGPM Logging**. - -6. In the **AGPM Logging Properties** window, click **Enabled**, and configure the level of detail to record in the logs. - -7. Click **OK**. - -8. Close the **Group Policy Object Editor**. (For more information, see [Deploy a GPO](deploy-a-gpo.md).) After Group Policy is updated, you must restart the AGPM Service to begin logging on the AGPM Server. Group Policy administrators must close and restart the GPMC to begin logging on their computers. - - **Trace file locations**: - - - Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - - - Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure AGPM logging and tracing. See [Editing a GPO](editing-a-gpo.md) and [Deploy a GPO](deploy-a-gpo.md) for additional detail. - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md b/mdop/agpm/configure-the-agpm-server-connection-reviewer.md deleted file mode 100644 index e4c102ba9e..0000000000 --- a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configure the AGPM Server Connection -description: Configure the AGPM Server Connection -author: mjcaparas -ms.assetid: 74e8f348-a8ed-4d69-a8e0-9c974aaeca2d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure the AGPM Server Connection - - -To ensure that you are connected to the correct central archive, review the configuration of the AGPM Server connection. If an AGPM Administrator (Full Control) has not configured the AGPM Server connection for you, then you must manually configure it. - -**To select an AGPM Server** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab: - - - If the options on the **AGPM Server** tab are unavailable, they have been centrally configured by an AGPM Administrator. - - - If the options on the **AGPM Server** tab are available, type the fully-qualified computer name for the AGPM Server (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- The AGPM Servers selected determine which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-the-agpm-server-connection.md b/mdop/agpm/configure-the-agpm-server-connection.md deleted file mode 100644 index 80bef3aea5..0000000000 --- a/mdop/agpm/configure-the-agpm-server-connection.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Configure the AGPM Server Connection -description: Configure the AGPM Server Connection -author: mjcaparas -ms.assetid: 9a42b5bc-41be-44ef-a6e2-6f56e2cf1996 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure the AGPM Server Connection - - -Advanced Group Policy Management (AGPM) stores all versions of each controlled Group Policy object (GPO) in a central archive, so Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete these procedures for centrally configuring archive locations for all Group Policy administrators. Review the details in "Additional considerations" in this topic. - -## Configuring the AGPM Server connection - - -As an AGPM Administrator (Full Control), you can ensure that all Group Policy administrators connect to the same AGPM Server by centrally configuring the setting. If your environment requires separate AGPM Servers for some or all domains, configure those additional AGPM Servers as exceptions to the default. If you do not centrally configure AGPM Server connections, each Group Policy administrator must manually configure the AGPM Server to be displayed for each domain. - -- [Configure an AGPM Server for all Group Policy administrators](#bkmk-defaultarchiveloc) - -- [Configure additional AGPM Servers for all Group Policy administrators](#bkmk-additionalarchiveloc) - -- [Manually configure an AGPM Server for your account](#bkmk-manuallyconfigurearchiveloc) - -### - -**To configure an AGPM Server for all Group Policy administrators** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo.md).) - -2. In the **Group Policy Object Editor**, click **User Configuration**, **Administrative Templates**, and **Windows Components**. - -3. If **AGPM** is not listed under **Windows Components**: - - 1. Right-click **Administrative Templates** and click **Add/Remove Templates**. - - 2. Click **Add**, select **agpm.admx** or **agpm.adm**, click **Open**, and then click **Close**. - -4. Under **Windows Components**, double-click **AGPM**. - -5. In the details pane, double-click **AGPM Server (all domains)**. - -6. In the **AGPM Server (all domains) Properties** window, select the **Enabled** check box, and type the fully-qualified computer name and port (for example, server.contoso.com:4600). - -7. Click **OK**. Unless you want to configure additional AGPM Server connections, close the **Group Policy Object Editor** and deploy the GPO. (For more information, see [Deploy a GPO](deploy-a-gpo.md).) When Group Policy is updated, the AGPM Server connection is configured for all Group Policy administrators. - -### - -**To configure additional AGPM Servers for all Group Policy administrators** - -1. If no AGPM Server connection has been configured, follow the preceding procedure to configure a default AGPM Server for all domains. - -2. To configure separate AGPM Servers for some or all domains (overriding the default AGPM Server), in the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo.md).) - -3. Under **User Configuration** in the **Group Policy Object Editor**, double-click **Administrative Templates**, **Windows Components**, and then **AGPM**. - -4. In the details pane, double-click **AGPM Server**. - -5. In the **AGPM Server Properties** window, select the **Enabled** check box, and click **Show**. - -6. In the **Show Contents** window: - - 1. Click **Add**. - - 2. For **Value Name**, type the domain name (for example, server1.contoso.com). - - 3. For **Value**, type the AGPM Server name and port to use for this domain (for example, server2.contoso.com:4600), and then click **OK**. (By default, the AGPM Service listens on port 4600. To use a different port, see [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md).) - - 4. Repeat for each domain not using the default AGPM Server. - -7. Click **OK** to close the **Show Contents** and **AGPM Server Properties** windows. - -8. Close the **Group Policy Object Editor**. (For more information, see [Deploy a GPO](deploy-a-gpo.md).) When Group Policy is updated, the new AGPM Server connections are configured for all Group Policy administrators. - -### - -If you have centrally configured the AGPM Server connection, the option to manually it is unavailable for all Group Policy administrators. - -**To manually configure the AGPM Server to display for your account** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Enter the fully-qualified computer name for the AGPM Server that manages the archive used for this domain (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). - -4. Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- You must be able to edit and deploy a GPO to perform the procedures for centrally configuring AGPM Server connections for all Group Policy administrators. See [Editing a GPO](editing-a-gpo.md) and [Deploy a GPO](deploy-a-gpo.md) for additional detail. - -- The AGPM Server selected determines which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative Template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -- Membership in the Group Policy Creator Owners group should be restricted so that it is not used to circumvent the management of access to GPOs by AGPM. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md b/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md deleted file mode 100644 index fa059fc59e..0000000000 --- a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Configuring Advanced Group Policy Management -description: Configuring Advanced Group Policy Management -author: mjcaparas -ms.assetid: 8c978ddf-2789-44e4-9c08-de7b4cd1afa0 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Advanced Group Policy Management - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you can centrally configure AGPM Server connections for Group Policy administrators, configure e-mail notification for AGPM, configure optional e-mail security for AGPM, delegate access to Group Policy Objects (GPOs) in the production environment of the domain, and configure logging and tracing for troubleshooting. - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md) - -- [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md) - -- [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm40.md) - -- [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm40.md) - -- [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md) - -### Additional references - -- For information about delegating access to GPOs in the archive, see [Managing the Archive](managing-the-archive-agpm40.md). - -- For information about how to restrict the number of versions of each GPO stored in the archive, see [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm40.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configuring-advanced-group-policy-management.md b/mdop/agpm/configuring-advanced-group-policy-management.md deleted file mode 100644 index a8b8d92728..0000000000 --- a/mdop/agpm/configuring-advanced-group-policy-management.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Configuring Advanced Group Policy Management -description: Configuring Advanced Group Policy Management -author: mjcaparas -ms.assetid: 836f4a49-2c77-4f6b-8727-9df7ef443141 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Advanced Group Policy Management - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you can centrally configure AGPM Server connections for Group Policy administrators, configure e-mail notification for AGPM, configure optional e-mail security for AGPM, delegate access to Group Policy Objects (GPOs) in the production environment, and configure logging and tracing for troubleshooting. - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md) - -- [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md) - -- [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm30ops.md) - -- [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm30ops.md) - -- [Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md) - -### Additional references - -- For information about delegating access to GPOs in the archive, see [Managing the Archive](managing-the-archive.md). - -- For information about how to restrict the number of versions of each GPO stored in the archive, see [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm30ops.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-agpm30ops.md b/mdop/agpm/contents-tab-agpm30ops.md deleted file mode 100644 index 8ab5fc8894..0000000000 --- a/mdop/agpm/contents-tab-agpm30ops.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Contents Tab -description: Contents Tab -author: mjcaparas -ms.assetid: 6ada6430-cd93-47aa-af6e-d7f5b5620132 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab - - -The **Contents** tab on the **Change Control** pane provides access to Group Policy Objects (GPOs) and a shortcut menu for managing GPOs. The options displayed when right-clicking items are dependent on your role, your permissions, and your ownership stake in the GPO being managed. Additionally, these shortcut menus differ with the state of the GPO being managed. - -The following secondary tabs filter the list of GPOs displayed: - -- **Controlled**: GPOs managed by Advanced Group Policy Management (AGPM) - -- **Uncontrolled**: GPOs not managed by AGPM - -- **Pending**: GPO changes awaiting approval by an Approver - -- **Templates**: GPO templates for creating new GPOs and comparing to existing GPOs - -- **Recycle Bin**: Deleted GPOs - -The **Contents** tab and its secondary tabs provide details about each GPO and access to the history of each GPO: - -- [Contents Tab Features](contents-tab-features-agpm30ops.md) - -- [History Window](history-window-agpm30ops.md) - -When you right-click GPOs on any secondary tab, a shortcut menu unique to that tab is displayed, providing commands for managing the GPOs: - -- [Controlled GPO Commands](controlled-gpo-commands-agpm30ops.md) - -- [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm30ops.md) - -- [Pending GPO Commands](pending-gpo-commands-agpm30ops.md) - -- [Template Commands](template-commands-agpm30ops.md) - -- [Recycle Bin Commands](recycle-bin-commands-agpm30ops.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-agpm40.md b/mdop/agpm/contents-tab-agpm40.md deleted file mode 100644 index 6f2c059b3e..0000000000 --- a/mdop/agpm/contents-tab-agpm40.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Contents Tab -description: Contents Tab -author: mjcaparas -ms.assetid: cf9d1f17-3c3d-422f-bd6b-3db87be45554 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab - - -The **Contents** tab on the **Change Control** pane provides access to Group Policy Objects (GPOs) and a shortcut menu for managing GPOs. The options displayed when right-clicking items are dependent on your role, your permissions, and your ownership stake in the GPO being managed. Additionally, these shortcut menus differ with the state of the GPO being managed. - -The following secondary tabs filter the list of GPOs displayed: - -- **Controlled**: GPOs managed by Advanced Group Policy Management (AGPM) - -- **Uncontrolled**: GPOs not managed by AGPM - -- **Pending**: GPO changes awaiting approval by an Approver - -- **Templates**: GPO templates for creating new GPOs and comparing to existing GPOs - -- **Recycle Bin**: Deleted GPOs - -The **Contents** tab and its secondary tabs provide details about each GPO and access to the history of each GPO: - -- [Contents Tab Features](contents-tab-features-agpm40.md) - -- [History Window](history-window-agpm40.md) - -When you right-click GPOs on any secondary tab, a shortcut menu unique to that tab is displayed, providing commands for managing the GPOs: - -- [Controlled GPO Commands](controlled-gpo-commands-agpm40.md) - -- [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm40.md) - -- [Pending GPO Commands](pending-gpo-commands-agpm40.md) - -- [Template Commands](template-commands-agpm40.md) - -- [Recycle Bin Commands](recycle-bin-commands-agpm40.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-features-agpm30ops.md b/mdop/agpm/contents-tab-features-agpm30ops.md deleted file mode 100644 index 217b586426..0000000000 --- a/mdop/agpm/contents-tab-features-agpm30ops.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Contents Tab Features -description: Contents Tab Features -author: mjcaparas -ms.assetid: 725f025a-c30a-4d07-add1-4e0ed9a1a5fd -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab Features - - -Each secondary tab within the **Contents** tab has two sections—**Group Policy objects** and **Groups and Users**. - -## Group Policy objects section - - -The **Group Policy objects** section displays a filtered list of Group Policy Objects (GPOs) and identifies the following attributes for each GPO: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          GPO attributeDescription

          Name

          Name of the GPO.

          State

          The state of the selected GPO

          Changed By

          The Editor who checked in or the Approver who deployed the selected GPO.

          Change Date

          For a controlled GPO, the most recent date it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified.

          Comment

          A comment entered by the person who checked in or deployed a GPO at the time that it was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version.

          Computer Version

          Automatically generated version of the Computer Configuration portion of the GPO.

          User Version

          Automatically generated version of the User Configuration portion of the GPO.

          GPO Status

          The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled.

          WMI Filter

          Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC.

          - -  - -## Groups and Users section - - -When a GPO is selected, the **Groups and Users** section displays a list of the groups and users with access to that GPO. The allowed permissions and inheritance are displayed for each group or user. An AGPM Administrator can configure permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor. Any user or group in Active Directory can be added.

          Remove

          Remove the selected entry from the Access Control List.

          Properties

          Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers.

          Advanced

          Open the Access Control List Editor.

          - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md), [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md), [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md). - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-features-agpm40.md b/mdop/agpm/contents-tab-features-agpm40.md deleted file mode 100644 index c714922193..0000000000 --- a/mdop/agpm/contents-tab-features-agpm40.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Contents Tab Features -description: Contents Tab Features -author: mjcaparas -ms.assetid: f1f4849d-bf94-47d5-ad81-0eee33abcaca -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab Features - - -Each secondary tab within the **Contents** tab has two sections—**Group Policy objects** and **Groups and Users**. - -## Group Policy objects section - - -The **Group Policy objects** section displays a filtered list of Group Policy Objects (GPOs) and identifies the following attributes for each GPO. You can use the **Search** box to search for GPOs with specific attributes. For more information, see [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          GPO attributeDescription

          Name

          Name of the GPO.

          State

          The state of the selected GPO

          Changed By

          The Editor who checked in or the Approver who deployed the selected GPO.

          Change Date

          For a controlled GPO, the most recent date it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified.

          Comment

          A comment entered by the person who checked in or deployed a GPO at the time that it was modified. Useful for identifying the specifics of the version in case of the need to roll back to an earlier version.

          Computer Version

          Automatically generated version of the Computer Configuration part of the GPO.

          User Version

          Automatically generated version of the User Configuration part of the GPO.

          GPO Status

          The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled.

          WMI Filter

          Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC.

          - -  - -## Groups and Users section - - -When a GPO is selected, the **Groups and Users** section displays a list of the groups and users with access to that GPO. The allowed permissions and inheritance are displayed for each group or user. An AGPM Administrator can configure permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor. Any user or group in Active Directory can be added.

          Remove

          Remove the selected entry from the Access Control List.

          Properties

          Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers.

          Advanced

          Open the Access Control List Editor.

          - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md), [Performing Editor Tasks](performing-editor-tasks-agpm40.md), [Performing Approver Tasks](performing-approver-tasks-agpm40.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md). - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab.md b/mdop/agpm/contents-tab.md deleted file mode 100644 index 0039020f48..0000000000 --- a/mdop/agpm/contents-tab.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Contents Tab -description: Contents Tab -author: mjcaparas -ms.assetid: 8a756bc1-3900-4d83-93c4-7ebc4705d956 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab - - -The **Contents** tab on the **Change Control** pane provides access to Group Policy objects (GPOs) and a shortcut menu for managing GPOs. The options displayed when right-clicking items are dependent on your role, your permissions, and your ownership stake in the GPO being managed. Additionally, these shortcut menus differ with the state of the GPO being managed. - -The secondary tabs filter the list of GPOs displayed. - -- [Controlled Tab](controlled-tab.md): GPOs managed by AGPM - -- [Uncontrolled Tab](uncontrolled-tab.md): GPOs not managed by AGPM - -- [Pending Tab](pending-tab.md): GPO changes awaiting approval by an Approver - -- [Templates Tab](templates-tab.md): GPO templates for creating new GPOs and comparing to existing GPOs - -- [Recycle Bin Tab](recycle-bin-tab.md): Deleted GPOs - -Additionally, the secondary tabs provide access to the History of each GPO and to other features: - -- [Common Secondary Tab Features](common-secondary-tab-features.md) - -- [History Window](history-window.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/control-a-previously-uncontrolled-gpo.md b/mdop/agpm/control-a-previously-uncontrolled-gpo.md deleted file mode 100644 index 535a5958f2..0000000000 --- a/mdop/agpm/control-a-previously-uncontrolled-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Control a Previously Uncontrolled GPO -description: Control a Previously Uncontrolled GPO -author: mjcaparas -ms.assetid: 452689a9-4e32-4e3b-8208-56353a82bf36 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Control a Previously Uncontrolled GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy object (GPO), you must first control the GPO with AGPM. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control a previously uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md deleted file mode 100644 index 6b69bcd500..0000000000 --- a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Control an Uncontrolled GPO -description: Control an Uncontrolled GPO -author: mjcaparas -ms.assetid: 603f00f9-1e65-4b2f-902a-e53dafedbd8d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Control an Uncontrolled GPO - - -To provide change control for a Group Policy Object (GPO), you must first control the GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md deleted file mode 100644 index fa7fb95245..0000000000 --- a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Control an Uncontrolled GPO -description: Control an Uncontrolled GPO -author: mjcaparas -ms.assetid: dc81545c-8da5-4b6f-b266-f01a82e27c6b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Control an Uncontrolled GPO - - -To provide change control for a Group Policy Object (GPO), you must first control the GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/controlled-gpo-commands-agpm30ops.md b/mdop/agpm/controlled-gpo-commands-agpm30ops.md deleted file mode 100644 index a964df04b5..0000000000 --- a/mdop/agpm/controlled-gpo-commands-agpm30ops.md +++ /dev/null @@ -1,211 +0,0 @@ ---- -title: Controlled GPO Commands -description: Controlled GPO Commands -author: mjcaparas -ms.assetid: 82db4772-154a-4a8d-99cd-2c69e1738698 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Controlled GPO Commands - - -The **Controlled** tab: - -- Displays a list of Group Policy Objects (GPOs) managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for managing GPOs and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          New Controlled GPO

          Create a new GPO with change control managed through AGPM and deploy it to the production environment. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Editing - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Edit

          Open the Group Policy Management Editor window to make changes to the selected GPO.

          Check Out

          Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing it until it is checked back into the archive. (Check Out can be overridden by an AGPM Administrator (Full Control).)

          Check In

          Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy it to the production environment.

          Undo Check Out

          Return a checked out GPO to the archive without any changes.

          - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Import from Production

          For the selected GPO, copy the version in the production environment to the archive.

          Delete

          Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete it as well as the version in the archive. If you do not have permission to delete a GPO, you will be prompted to submit a request.

          Deploy

          Move the selected GPO that is checked into the archive to the production environment. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request.

          Label

          Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window, enabling you to easily identify previous versions of a GPO identified with a particular label, so you can roll back if a problem occurs.

          Rename

          Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment when the GPO is redeployed.

          Save as Template

          Create a new template based on the settings of the selected GPO.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/controlled-gpo-commands-agpm40.md b/mdop/agpm/controlled-gpo-commands-agpm40.md deleted file mode 100644 index 7f1617be1c..0000000000 --- a/mdop/agpm/controlled-gpo-commands-agpm40.md +++ /dev/null @@ -1,219 +0,0 @@ ---- -title: Controlled GPO Commands -description: Controlled GPO Commands -author: mjcaparas -ms.assetid: 370d3db9-4efc-4799-983d-e29ba5f32b07 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Controlled GPO Commands - - -The **Controlled** tab: - -- Displays a list of Group Policy Objects (GPOs) managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for managing GPOs and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu. This menu includes whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          New Controlled GPO

          Create a new GPO with change control managed through AGPM and deploy it to the production environment of the domain. If you do not have permission to create a GPO, you are prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Editing - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Edit

          Open the Group Policy Management Editor window to change the selected GPO.

          Check Out

          Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing the GPO until it is checked back into the archive. Check Out can be overridden by an AGPM Administrator (Full Control).

          Check In

          Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy the GPO to the production environment of the domain.

          Undo Check Out

          Return a checked out GPO to the archive without any changes.

          - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Import from Production

          For the selected GPO, copy the version in the production environment of the domain to the archive.

          Import from File

          Replace the policy settings of the selected, checked-out GPO with those from a GPO backup file.

          Delete

          Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete the deployed version in addition to the version in the archive. If you do not have permission to delete a GPO, you are prompted to submit a request.

          Deploy

          Move the selected GPO that is checked into the archive to the production environment of the domain. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request.

          Export to

          Save the selected GPO to a backup file so that you can copy it to another domain.

          Label

          Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window. They help you identify earlier versions of a GPO so that you can roll back if a problem occurs.

          Rename

          Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment of the domain when the GPO is redeployed.

          Save as Template

          Create a new template based on the settings of the selected GPO.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/controlled-tab.md b/mdop/agpm/controlled-tab.md deleted file mode 100644 index c17aab7903..0000000000 --- a/mdop/agpm/controlled-tab.md +++ /dev/null @@ -1,211 +0,0 @@ ---- -title: Controlled Tab -description: Controlled Tab -author: mjcaparas -ms.assetid: 8995a9e1-ace4-40b7-a47b-e1e9924541ba -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Controlled Tab - - -The **Controlled** tab: - -- Displays a list of Group Policy objects (GPOs) managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for managing GPOs and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          New Controlled GPO

          Create a new GPO with change control managed through AGPM and deploy it to the production environment. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Editing - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Edit

          Open the Group Policy Object Editor to make changes to the selected GPO.

          Check Out

          Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing it until it is checked back into the archive. (Check Out can be overridden by an AGPM Administrator (Full Control).)

          Check In

          Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy it to the production environment.

          Undo Check Out

          Return a checked out GPO to the archive without any changes.

          - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Import from Production

          For the selected GPO, copy the version in the production environment to the archive.

          Delete

          Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete it as well as the version in the archive. If you do not have permission to delete a GPO, you will be prompted to submit a request.

          Deploy

          Move the selected GPO that is checked into the archive to the production environment. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request.

          Label

          Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window, enabling you to easily identify previous versions of a GPO identified with a particular label, so you can roll back if a problem occurs.

          Rename

          Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment when the GPO is redeployed.

          Save as Template

          Create a new template based on the settings of the selected GPO.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md deleted file mode 100644 index ed19062453..0000000000 --- a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Create a New Controlled GPO -description: Create a New Controlled GPO -author: mjcaparas -ms.assetid: f89eaae8-7858-4222-ba3f-a93a9d7ea5a3 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a New Controlled GPO - - -New Group Policy Objects (GPOs) created through the **Change Control** folder will automatically be controlled, enabling you to manage them. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. Type a name for the new GPO. - - 2. Optional: Type a comment for the new GPO to be displayed in the **History** for the GPO. - - 3. To immediately deploy the new GPO to the production environment, click **Create live**. To create the new GPO offline without immediately deploying it, click **Create offline**. - - 4. Select the GPO template to use as a starting point for the new GPO. - - 5. Click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md b/mdop/agpm/create-a-new-controlled-gpo-agpm40.md deleted file mode 100644 index 89efc3c447..0000000000 --- a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Create a New Controlled GPO -description: Create a New Controlled GPO -author: mjcaparas -ms.assetid: 5ce760f6-9f05-42b4-b787-7835ab8e324e -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a New Controlled GPO - - -New Group Policy Objects (GPOs) created through the **Change Control** folder will automatically be controlled, enabling you to manage them. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. Type a name for the new GPO. - - 2. Optional: Type a comment for the new GPO to be displayed in the **History** for the GPO. - - 3. To immediately deploy the new GPO to the production environment of the domain, click **Create live**. To create the new GPO offline without immediately deploying it, click **Create offline**. - - 4. Select the GPO template to use as a starting point for the new GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-new-controlled-gpo.md b/mdop/agpm/create-a-new-controlled-gpo.md deleted file mode 100644 index 614627225b..0000000000 --- a/mdop/agpm/create-a-new-controlled-gpo.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Create a New Controlled GPO -description: Create a New Controlled GPO -author: mjcaparas -ms.assetid: b43ce0f4-4519-4278-83c4-c7d5163ddd11 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a New Controlled GPO - - -New Group Policy objects (GPOs) created through the **Change Control** node will automatically be controlled, enabling you to manage them with Advanced Group Policy Management (AGPM). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. Type a name for the new GPO. - - 2. Optional: Type a comment for the new GPO to be displayed in the **History** for the GPO. - - 3. To immediately deploy the new GPO to the production environment, click **Create live**. To create the new GPO offline without immediately deploying it, click **Create offline**. - - 4. Select the GPO template to use as a starting point for the new GPO. - - 5. Click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-template-agpm30ops.md b/mdop/agpm/create-a-template-agpm30ops.md deleted file mode 100644 index 406acb5276..0000000000 --- a/mdop/agpm/create-a-template-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Create a Template -description: Create a Template -author: mjcaparas -ms.assetid: 8208f14a-5c18-43a7-8564-118230398cca -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a template based on an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Uncontrolled** tab to display available GPOs. - -3. Right-click the GPO from which you want to create a template, and then click **Save as Template**. - -4. Type a name for the template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/create-a-template-agpm40.md b/mdop/agpm/create-a-template-agpm40.md deleted file mode 100644 index c8a1e97a01..0000000000 --- a/mdop/agpm/create-a-template-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Create a Template -description: Create a Template -author: mjcaparas -ms.assetid: b38423af-7d24-437a-98bc-01f1ae891127 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a template based on an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Uncontrolled** tab to display available GPOs. - -3. Right-click the GPO from which you want to create a template, and then click **Save as Template**. - -4. Type a name for the template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/create-a-template.md b/mdop/agpm/create-a-template.md deleted file mode 100644 index d0db0eb513..0000000000 --- a/mdop/agpm/create-a-template.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Create a Template -description: Create a Template -author: mjcaparas -ms.assetid: 6992bd55-4a4f-401f-9815-c468bac598ef -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy object (GPO) to use as a starting point for creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a template based on an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Uncontrolled** tab to display available GPOs. - -3. Right-click the GPO from which you want to create a template, then click **Save as Template**. - -4. Type a name for the template and a comment, then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) - - - - - - - - - diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md deleted file mode 100644 index d35b5810d4..0000000000 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Creating a Template and Setting a Default Template -description: Creating a Template and Setting a Default Template -author: mjcaparas -ms.assetid: acce0e0f-7e67-479c-9daa-e678fccd7ced -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a Template and Setting a Default Template - - -Creating a template enables you to save all the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. As an Editor, you can also specify which of the available templates will be the default template for all Group Policy administrators creating new GPOs. - -Some potential uses for a template include the following: - -- Create a security baseline that your organization can reuse across domains. - -- Create a template to manage folder redirection and offline files that your organization can customize for each department. - -- Create a wireless networking template that your organization can use to configure wireless network connections for different geographical areas. - -- Create regulatory compliance templates for local network administrators. - -- Create a read-only snapshot of an existing GPO. - -**Note**   -A template is a static version of a GPO that cannot be edited, yet can be used as a starting point for creating new, editable GPOs. Renaming or deleting a template does not affect GPOs created from that template. - - - -- [Create a Template](create-a-template-agpm30ops.md) - -- [Set a Default Template](set-a-default-template-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md deleted file mode 100644 index a3981ca8a0..0000000000 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Creating a Template and Setting a Default Template -description: Creating a Template and Setting a Default Template -author: mjcaparas -ms.assetid: ffa72c2a-64eb-4492-8072-c3a66179b546 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a Template and Setting a Default Template - - -Creating a template enables you to save all the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. As an Editor, you can also specify which of the available templates will be the default template for all Group Policy administrators creating new GPOs. - -Some potential uses for a template include the following: - -- Create a security baseline that your organization can reuse across domains. - -- Create a template to manage folder redirection and offline files that your organization can customize for each department. - -- Create a wireless networking template that your organization can use to configure wireless network connections for different geographical areas. - -- Create regulatory compliance templates for local network administrators. - -- Create a read-only snapshot of an existing GPO. - -**Note**   -A template is a static version of a GPO that cannot be edited, yet can be used as a starting point for creating new, editable GPOs. Renaming or deleting a template does not affect GPOs created from that template. - - - -- [Create a Template](create-a-template-agpm40.md) - -- [Set a Default Template](set-a-default-template-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template.md b/mdop/agpm/creating-a-template-and-setting-a-default-template.md deleted file mode 100644 index 79e1c3682d..0000000000 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Creating a Template and Setting a Default Template -description: Creating a Template and Setting a Default Template -author: mjcaparas -ms.assetid: 8771b4b5-4dea-4be1-a675-f60cfd3ec5dc -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a Template and Setting a Default Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy object (GPO) to use as a starting point for creating new GPOs. As an Editor, you can also specify which of the available templates will be the default template for all Group Policy administrators creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. Renaming or deleting a template does not impact GPOs created from that template. - - - -- [Create a Template](create-a-template.md) - -- [Set a Default Template](set-a-default-template.md) - - - - - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md deleted file mode 100644 index 8e9e92e5ac..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: mjcaparas -ms.assetid: ce8b232e-7758-4a6a-9e2f-18967da6cdad -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), the GPO must first be controlled by AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. As an Editor, you may not have permission to complete the control, creation, or deletion of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm30ops.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) - -- [Import a GPO from Production](import-a-gpo-from-production-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md deleted file mode 100644 index ba433a553b..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: mjcaparas -ms.assetid: f2c8bef5-b654-4864-99d4-9207cfb0a137 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy object (GPO), you must first control the GPO with AGPM. New GPOs created through the **Change Control** node will automatically be controlled. - -- [Control a Previously Uncontrolled GPO](control-a-previously-uncontrolled-gpo.md) - -- [Create a New Controlled GPO](create-a-new-controlled-gpo.md) - -- [Delegate Access to a GPO](delegate-access-to-a-gpo.md) - -- [Import a GPO from Production](import-a-gpo-from-production-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md deleted file mode 100644 index 0aee5a400a..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: mjcaparas -ms.assetid: 0cc1b6ee-3335-4d84-9e1c-d1aefabfef51 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), you must first control the GPO with AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. - -- [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm30ops.md) - -- [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm30ops.md) - -- [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm30ops.md) - -- [Import a GPO from Production](import-a-gpo-from-production-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md deleted file mode 100644 index 7a228249c6..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: mjcaparas -ms.assetid: 5259ce25-f570-4346-9f50-6b051724a998 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy object (GPO), the GPO must first be controlled by AGPM. New GPOs created through the **Change Control** node will automatically be controlled. As an Editor, you may not have permission to complete the control, creation, or deletion of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Control of a Previously Uncontrolled GPO](request-control-of-a-previously-uncontrolled-gpo.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) - -- [Import a GPO from Production](import-a-gpo-from-production-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md deleted file mode 100644 index fc60c82ade..0000000000 --- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Creating or Controlling a GPO -description: Creating or Controlling a GPO -author: mjcaparas -ms.assetid: ca2fa40e-c6e9-4c57-9da1-e5375df4a2fd -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating or Controlling a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), you must first control the GPO with AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. - -- [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm40.md) - -- [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md) - -- [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm40.md) - -- [Import a GPO from Production](import-a-gpo-from-production-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md deleted file mode 100644 index 119b8134b3..0000000000 --- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Creating or Controlling a GPO -description: Creating or Controlling a GPO -author: mjcaparas -ms.assetid: 807f3b3f-ad3d-4851-9772-7f54a065632a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating or Controlling a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), the GPO must first be controlled by AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. As an Editor, you may not have permission to complete the control, creation, or deletion of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm40.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) - -- [Import a GPO from Production](import-a-gpo-from-production-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-a-gpo.md b/mdop/agpm/delegate-access-to-a-gpo.md deleted file mode 100644 index d303c1e2f1..0000000000 --- a/mdop/agpm/delegate-access-to-a-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Delegate Access to a GPO -description: Delegate Access to a GPO -author: mjcaparas -ms.assetid: f1d6bb6c-d5bf-4080-a6cb-32774689f804 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to a GPO - - -An Approver can delegate the management of a controlled Group Policy object (GPO) that was **created by that Approver**. Like an AGPM Administrator (Full Control), the Approver can delegate access to such a GPO, so selected Editors can edit it, Reviewers can review it, and other Approvers can approve it. By default, an Approver cannot delegate access to GPOs created by another Group Policy administrator. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate. - -3. Click the **Add** button, select the users or groups to be permitted access, and then click **OK**. - -4. To customize the permissions for each, click the **Advanced** button on the **Contents** tab and check role permissions to allow or deny. (For more detailed control, click **Advanced** in the **Permissions** dialog box.) - -5. Click **Apply**, and then click **OK** in the **Permissions** dialog box. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md deleted file mode 100644 index 3c102e5273..0000000000 --- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Delegate Access to an Individual GPO in the Archive -description: Delegate Access to an Individual GPO in the Archive -author: mjcaparas -ms.assetid: 7b37b188-2b6b-4e52-be97-8ef899e9893b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to an Individual GPO in the Archive - - -As an AGPM Administrator (Full Control), you can delegate the management of a controlled Group Policy Object (GPO) in the archive so that selected groups and Editors can edit it, Reviewers can review it, and Approvers can approve it. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md deleted file mode 100644 index f5124591cc..0000000000 --- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Delegate Access to an Individual GPO in the Archive -description: Delegate Access to an Individual GPO in the Archive -author: mjcaparas -ms.assetid: 284d2aa2-7c10-4ffa-8978-bbe30867c1c1 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to an Individual GPO in the Archive - - -As an AGPM Administrator (Full Control), you can delegate the management of a controlled Group Policy Object (GPO) in the archive so that selected groups and Editors can edit it, Reviewers can review it, and Approvers can approve it. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo.md b/mdop/agpm/delegate-access-to-an-individual-gpo.md deleted file mode 100644 index 48a3a17674..0000000000 --- a/mdop/agpm/delegate-access-to-an-individual-gpo.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Delegate Access to an Individual GPO -description: Delegate Access to an Individual GPO -author: mjcaparas -ms.assetid: b2a7d550-14bf-4b41-b6e4-2cc091eedd2d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to an Individual GPO - - -As an AGPM Administrator (Full Control), you can delegate the management of a controlled Group Policy object (GPO), so selected groups and Editors can edit it, Reviewers can review it, and Approvers can approve it. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate. - -3. Click the **Add** button, select the users or groups to be permitted access, and then click **OK**. - -4. To customize the permissions for each user or group, click the **Advanced** button on the **Contents** tab and check role permissions to allow or deny. (For more detailed control, click **Advanced** in the **Permissions** dialog box.) - -5. Click **Apply**, and then click **OK** in the **Permissions** dialog box. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Set the permission to apply to **This object and nested objects**. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted so that it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md deleted file mode 100644 index 5465a92076..0000000000 --- a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Delegate Access to the Production Environment -description: Delegate Access to the Production Environment -author: mjcaparas -ms.assetid: c1ebae2e-909b-4e64-b368-b7d3cc67b1eb -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to the Production Environment - - -You can change access to Group Policy Objects (GPOs) in the production environment, replacing any existing permissions on those GPOs. You can configure permissions at the domain level to either allow or prevent users from editing, deleting, or modifying the security of GPOs in the production environment when they are not using the **Change Control** folder in the Group Policy Management Console (GPMC). - -**Note**   -- Delegating access to the production environment does not affect users’ ability to link GPOs. - -- When GPOs are controlled or deployed, access for any other accounts except those with **Read** and **Apply** permissions is removed. - -  - -A user account that has either the necessary permissions in Advanced Group Policy Management (AGPM) or the role of AGPM Administrator (Full Control) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To change access to GPOs in the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Production Delegation** tab. - -3. To add permissions for a user or group that does not have access to the production environment, or to replace the permissions for a user or group that does have access: - - 1. Click **Add**, select a user or group, and then click **OK**. - - 2. Select permissions to delegate to that user or group for the production environment, and then click **OK**. - -4. To remove all permissions to the production environment for a user or group, select the user or group, click **Remove**, and then click **OK**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- Permissions for the AGPM Service Account cannot be changed on the **Production Delegation** tab. - -- By default, the following accounts have permissions for GPOs in the production environment: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          AccountDefault Permissions for GPOs

          <AGPM Service Account>

          Edit Settings, Delete, Modify Security

          Authenticated Users

          Read, Apply

          Domain Admins

          Edit Settings, Delete, Modify Security

          Enterprise Admins

          Edit Settings, Delete, Modify Security

          Enterprise Domain Controllers

          Read

          System

          Edit Settings, Delete, Modify Security

          - -   - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md deleted file mode 100644 index 499f2dda22..0000000000 --- a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Delegate Access to the Production Environment -description: Delegate Access to the Production Environment -author: mjcaparas -ms.assetid: 4c670581-8c47-41ea-80eb-02846ff1ec1f -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to the Production Environment - - -In Advanced Group Policy Management (AGPM), you can change access to Group Policy Objects (GPOs) in the production environment of the domain, replacing any existing permissions on those GPOs. You can configure permissions at the domain level to either allow or prevent users from editing, deleting, or modifying the security of GPOs in the production environment when they are not using the **Change Control** folder in the Group Policy Management Console (GPMC). - -**Note**   -- Changing how access to the production environment is delegated does not affect users' ability to link GPOs. - -- When GPOs are controlled or deployed, access for any other accounts except those with **Read** and **Apply** permissions is removed. - -  - -A user account that has either the role of AGPM Administrator (Full Control) or the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To change access to GPOs in the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Production Delegation** tab. - -3. To add permissions for a user or group that does not have access to the production environment, or to replace the permissions for a user or group that does have access: - - 1. Click **Add**, select a user or group, and then click **OK**. - - 2. Select permissions to delegate to that user or group for the production environment, and then click **OK**. - -4. To remove all permissions to the production environment for a user or group, select the user or group, click **Remove**, and then click **OK**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- Permissions for the AGPM Service Account cannot be changed on the **Production Delegation** tab. - -- By default, the following accounts have permissions for GPOs in the production environment: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          AccountDefault Permissions for GPOs

          <AGPM Service Account>

          Edit Settings, Delete, Modify Security

          Authenticated Users

          Read, Apply

          Domain Admins

          Edit Settings, Delete, Modify Security

          Enterprise Admins

          Edit Settings, Delete, Modify Security

          Enterprise Domain Controllers

          Read

          System

          Edit Settings, Delete, Modify Security

          - -   - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md deleted file mode 100644 index 3d5ef495b1..0000000000 --- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Delegate Domain-Level Access to the Archive -description: Delegate Domain-Level Access to the Archive -author: mjcaparas -ms.assetid: d232069e-71d5-4b4d-b22e-bef11de1cfd4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Domain-Level Access to the Archive - - -Set up delegation for your environment so that Group Policy administrators have the appropriate access to and control over Group Policy Objects (GPOs) in the archive. There are baseline permissions you can apply to make operation more efficient. You can grant permissions in any manner that meets the needs of your organization. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate access so that users and groups have appropriate permissions to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Domain Delegation** tab, and configure access to all GPOs in the domain: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - 3. To modify the roles and permissions delegated to a user or group, select click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must be granted **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md deleted file mode 100644 index f1aa01ad7e..0000000000 --- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Delegate Domain-Level Access to the Archive -description: Delegate Domain-Level Access to the Archive -author: mjcaparas -ms.assetid: 11ca1d40-4b5c-496e-8922-d01412717858 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Domain-Level Access to the Archive - - -Set up delegation for your environment so that Group Policy administrators have the appropriate access to and control over Group Policy Objects (GPOs) in the archive. There are baseline permissions you can apply to make operation more efficient. You can grant permissions in any manner that meets the needs of your organization. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate access so that users and groups have appropriate permissions to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Domain Delegation** tab, and configure access to all GPOs in the domain: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - 3. To modify the roles and permissions delegated to a user or group, select click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must be granted **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-domain-level-access.md b/mdop/agpm/delegate-domain-level-access.md deleted file mode 100644 index da327eae2f..0000000000 --- a/mdop/agpm/delegate-domain-level-access.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Delegate Domain-Level Access -description: Delegate Domain-Level Access -author: mjcaparas -ms.assetid: 64c8e773-38cc-4991-9ed2-5a801094d06e -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Domain-Level Access - - -Set up delegation for your environment so Group Policy administrators have the appropriate access to and control over Group Policy objects (GPOs). There are baseline permissions you can apply to make the operation of Advanced Group Policy Management (AGPM) more efficient. You can grant permissions in any manner that meets the needs of your organization. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate access so users and groups have appropriate permissions to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Domain Delegation** tab, then click the **Advanced** button. - -3. In the **Permissions** dialog box, click the check box for each role to be assigned to an individual, and then click the **Advanced** button. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -4. In the **Advanced Security Settings** dialog box, select a Group Policy administrator, and then click **Edit**. - -5. For **Apply onto**, select **This object and nested objects**, configure any special permissions beyond the standard AGPM roles, then click **OK** in the **Permission** **Entry** dialog box. - -6. In the **Advanced Security Settings** dialog box, click **OK**. - -7. In the **Permissions** dialog box, click **OK**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Set the permission to apply to **This object and nested objects**. Other permissions must be explicitly delegated. - -- Editors must be granted **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted so that it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md deleted file mode 100644 index 2a17a1e42b..0000000000 --- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Delegate Management of a Controlled GPO -description: Delegate Management of a Controlled GPO -author: mjcaparas -ms.assetid: 509b02e7-ce0b-4919-b58a-c3a33051152e -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Management of a Controlled GPO - - -An Approver can delegate the management of a controlled Group Policy Object (GPO) that was created by that Approver. Like an AGPM Administrator (Full Control), the Approver can delegate access to such a GPO so that selected Editors can edit it, Reviewers can review it, and other Approvers can approve it. By default, an Approver cannot delegate access to GPOs created by another Group Policy administrator. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and then click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md deleted file mode 100644 index 19b09da4c5..0000000000 --- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Delegate Management of a Controlled GPO -description: Delegate Management of a Controlled GPO -author: mjcaparas -ms.assetid: 96b4bfb3-5657-4267-8326-85d7a0db87ce -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Management of a Controlled GPO - - -An Approver can delegate the management of a controlled Group Policy Object (GPO) that was created by that Approver. Like an AGPM Administrator (Full Control), the Approver can delegate access to such a GPO so that selected Editors can edit it, Reviewers can review it, and other Approvers can approve it. By default, an Approver cannot delegate access to GPOs created by another Group Policy administrator. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and then click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - - - - - - - - - diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md deleted file mode 100644 index 82004ed62c..0000000000 --- a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Delete a Controlled GPO -description: Delete a Controlled GPO -author: mjcaparas -ms.assetid: f51c1737-c116-4faf-a6f6-c72303f60a3b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a Controlled GPO - - -Approvers can delete a controlled Group Policy Object (GPO), moving it to the Recycle Bin. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delete a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - -4. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. If the GPO was deleted only from the archive, it is also displayed on the **Uncontrolled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm40.md b/mdop/agpm/delete-a-controlled-gpo-agpm40.md deleted file mode 100644 index 4b1f19997b..0000000000 --- a/mdop/agpm/delete-a-controlled-gpo-agpm40.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Delete a Controlled GPO -description: Delete a Controlled GPO -author: mjcaparas -ms.assetid: 2a461018-aa0b-4ae3-b079-efc554ca4a3d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a Controlled GPO - - -Approvers can delete a controlled Group Policy Object (GPO), moving it to the Recycle Bin. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delete a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment of the domain, click **Delete GPO from archive and production**. - -4. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. If the GPO was deleted only from the archive, it is also displayed on the **Uncontrolled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/delete-a-gpo-approver.md b/mdop/agpm/delete-a-gpo-approver.md deleted file mode 100644 index fee036a028..0000000000 --- a/mdop/agpm/delete-a-gpo-approver.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Delete a GPO -description: Delete a GPO -author: mjcaparas -ms.assetid: 85fca371-5707-49c1-aa51-813fc3a58dfc -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a GPO - - -Advanced Group Policy Management (AGPM) enables Approvers to delete a controlled Group Policy object (GPO), moving it to the Recycle Bin. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delete a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only (uncontrol)**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - -4. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. If the GPO was deleted only from the archive, it is also displayed on the **Uncontrolled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to delete a deployed GPO. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to delete a GPO from the archive. Specifically, you must have **List Contents** and either **Edit Settings** or **Delete GPO** permissions for the GPO. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/delete-a-gpo-editor.md b/mdop/agpm/delete-a-gpo-editor.md deleted file mode 100644 index 5bc745374a..0000000000 --- a/mdop/agpm/delete-a-gpo-editor.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Delete a GPO -description: Delete a GPO -author: mjcaparas -ms.assetid: 66be3dde-653e-4c25-8cb7-00e7090c8d31 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a GPO - - -As an Editor, you may not have permission to complete the deletion of a Group Policy object (GPO), but you do have the permission necessary to begin the process and submit your request to an Approver. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deletion of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only (uncontrol)**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - - Unless you have special permission to delete GPOs, you must submit a request for deletion of the deployed GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Recycle Bin** tab, where it can be restored or destroyed. - -### Additional considerations - -- By default, you must be an Editor to request the deletion of a deployed GPO. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to delete a GPO from the archive. Specifically, you must have **List Contents** and either **Edit Settings** or **Delete GPO** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md deleted file mode 100644 index d4ebed245e..0000000000 --- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Deleting or Restoring a GPO -description: Deleting or Restoring a GPO -author: mjcaparas -ms.assetid: ee4a467a-187a-48e3-8f0d-548de0606a56 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting or Restoring a GPO - - -To use Advanced Group Policy Management (AGPM) to delete a Group Policy Object (GPO) from the archive or restore a deleted GPO from the Recycle Bin, the GPO must be controlled by AGPM. As an Editor, you may not have permission to complete the deletion or restoration of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm30ops.md) - -- [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md deleted file mode 100644 index e0bc537cc9..0000000000 --- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Deleting or Restoring a GPO -description: Deleting or Restoring a GPO -author: mjcaparas -ms.assetid: d4f92f4d-eba7-4e6e-b166-13670864d298 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting or Restoring a GPO - - -To use Advanced Group Policy Management (AGPM) to delete a Group Policy Object (GPO) from the archive or restore a deleted GPO from the Recycle Bin, the GPO must be controlled by AGPM. As an Editor, you may not have permission to complete the deletion or restoration of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm40.md) - -- [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md deleted file mode 100644 index a27d832f3f..0000000000 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Deleting, Restoring, or Destroying a GPO -description: Deleting, Restoring, or Destroying a GPO -author: mjcaparas -ms.assetid: 3e1b862e-007a-4b60-900f-0489069f5c75 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting, Restoring, or Destroying a GPO - - -As an Approver, you can delete a Group Policy Object (GPO) (moving it to the Recycle Bin), restore a GPO from the Recycle Bin (returning it to the archive), or destroy a GPO (permanently deleting it so that it can no longer be restored). - -- [Delete a Controlled GPO](delete-a-controlled-gpo-agpm30ops.md) - -- [Restore a Deleted GPO](restore-a-deleted-gpo-agpm30ops.md) - -- [Destroy a GPO](destroy-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md deleted file mode 100644 index e9a7b13f30..0000000000 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Deleting, Restoring, or Destroying a GPO -description: Deleting, Restoring, or Destroying a GPO -author: mjcaparas -ms.assetid: 3af6c396-61c8-4b32-9fd8-28e9f15e575c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting, Restoring, or Destroying a GPO - - -As an Approver, you can delete a Group Policy Object (GPO) (moving it to the Recycle Bin), restore a GPO from the Recycle Bin (returning it to the archive), or destroy a GPO (permanently deleting it so that it can no longer be restored). - -- [Delete a Controlled GPO](delete-a-controlled-gpo-agpm40.md) - -- [Restore a Deleted GPO](restore-a-deleted-gpo-agpm40.md) - -- [Destroy a GPO](destroy-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md deleted file mode 100644 index 96207fe50f..0000000000 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Deleting, Restoring, or Destroying a GPO -description: Deleting, Restoring, or Destroying a GPO -author: mjcaparas -ms.assetid: 089c68e7-c1a5-418a-8776-cf23960f10c4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting, Restoring, or Destroying a GPO - - -As an Approver, you can delete a Group Policy object (GPO) (moving it to the Recycle Bin), restore a GPO from the Recycle Bin (returning it to the archive), or destroy a GPO (permanently deleting it so that it can no longer be restored). - -- [Delete a GPO](delete-a-gpo-approver.md) - -- [Restore a Deleted GPO](restore-a-deleted-gpo.md) - -- [Destroy a GPO](destroy-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/deploy-a-gpo-agpm30ops.md b/mdop/agpm/deploy-a-gpo-agpm30ops.md deleted file mode 100644 index 15b54d327d..0000000000 --- a/mdop/agpm/deploy-a-gpo-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploy a GPO -description: Deploy a GPO -author: mjcaparas -ms.assetid: 3767b722-db43-40f1-a714-bb8e38bcaa10 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy a GPO - - -An Approver can deploy a new or edited Group Policy Object (GPO) to the production environment. For information about redeploying a previous version of a GPO, see [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed and then click **Deploy**. - -4. To review links to the GPO, click **Advanced**. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes**. When the **Progress** window indicates that overall progress is complete, click **Close**. - -**Note**   -To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/deploy-a-gpo-agpm40.md b/mdop/agpm/deploy-a-gpo-agpm40.md deleted file mode 100644 index d24c1562ea..0000000000 --- a/mdop/agpm/deploy-a-gpo-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploy a GPO -description: Deploy a GPO -author: mjcaparas -ms.assetid: a6febeaa-144b-4c02-99af-d972f0f2b544 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy a GPO - - -An Approver can deploy a new or edited Group Policy Object (GPO) to the production environment. For information about redeploying an earlier version of a GPO, see [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed and then click **Deploy**. - -4. To review links to the GPO, click **Advanced**. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes**. When the **Progress** window indicates that overall progress is complete, click **Close**. - -**Note**   -To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/deploy-a-gpo.md b/mdop/agpm/deploy-a-gpo.md deleted file mode 100644 index 6cccb83b8a..0000000000 --- a/mdop/agpm/deploy-a-gpo.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploy a GPO -description: Deploy a GPO -author: mjcaparas -ms.assetid: a0a3f292-e3ab-46ae-a0fd-d7b2b4ad8883 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy a GPO - - -Advanced Group Policy Management (AGPM) enables an Approver to deploy a new or edited Group Policy object (GPO) to the production environment. For information about redeploying a previous version of a GPO, see [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo.md). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed and then click **Deploy**. - -4. To review links to the GPO, click **Advanced**. Pause the mouse pointer on a node in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes**. When the **Progress** window indicates that overall progress is complete, click **Close**. - -**Note**   -To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/destroy-a-gpo-agpm30ops.md b/mdop/agpm/destroy-a-gpo-agpm30ops.md deleted file mode 100644 index dd853317de..0000000000 --- a/mdop/agpm/destroy-a-gpo-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Destroy a GPO -description: Destroy a GPO -author: mjcaparas -ms.assetid: bfabd71a-47f3-462e-b86f-5f15762b9e28 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Destroy a GPO - - -Approvers can destroy a Group Policy Object (GPO), removing it from the Recycle Bin and permanently deleting it so that it can no longer be restored. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To permanently delete a GPO so it can no longer be restored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to destroy, and then click **Destroy**. - -4. Click **Yes** to confirm that you want to permanently delete the selected GPO and all backups from the archive. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is permanently deleted. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/destroy-a-gpo-agpm40.md b/mdop/agpm/destroy-a-gpo-agpm40.md deleted file mode 100644 index 28f76ae7c9..0000000000 --- a/mdop/agpm/destroy-a-gpo-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Destroy a GPO -description: Destroy a GPO -author: mjcaparas -ms.assetid: 09bce8c4-f75b-4633-b80b-d894bbec95c9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Destroy a GPO - - -Approvers can destroy a Group Policy Object (GPO), removing it from the Recycle Bin and permanently deleting it so that it can no longer be restored. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To permanently delete a GPO so it can no longer be restored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to destroy, and then click **Destroy**. - -4. Click **Yes** to confirm that you want to permanently delete the selected GPO and all backups from the archive. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is permanently deleted. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/destroy-a-gpo.md b/mdop/agpm/destroy-a-gpo.md deleted file mode 100644 index 4c21c398e6..0000000000 --- a/mdop/agpm/destroy-a-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Destroy a GPO -description: Destroy a GPO -author: mjcaparas -ms.assetid: d74941a3-beef-46cd-a4ca-80a324dcfadf -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Destroy a GPO - - -Advanced Group Policy Management (AGPM) enables Approvers to destroy a Group Policy object (GPO), removing it from the Recycle Bin and permanently deleting it so that it can no longer be restored. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To permanently delete a GPO so it can no longer be restored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to destroy, and then click **Destroy**. - -4. Click **Yes** to confirm that you want to permanently delete the selected GPO and all backups from the archive. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is permanently deleted. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/domain-delegation-tab-agpm30ops.md b/mdop/agpm/domain-delegation-tab-agpm30ops.md deleted file mode 100644 index aa5f709f13..0000000000 --- a/mdop/agpm/domain-delegation-tab-agpm30ops.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Domain Delegation Tab -description: Domain Delegation Tab -author: mjcaparas -ms.assetid: 523cdf39-f4b8-4d20-a917-3485756658ce -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain Delegation Tab - - -The **Domain Delegation** tab on the **Change Control** pane provides a list of Group Policy administrators who have domain-level access to the archive and indicates the roles of each. Additionally, this tab enables AGPM Administrators (Full Control) to configure domain-level permissions for Editors, Approvers, Reviewers, and other AGPM Administrators. There are two sections on the **Domain Delegation** tab—configuration of e-mail notification and role-based delegation for Advanced Group Policy Management (AGPM) at the domain level. - -## Configuration of e-mail notification - - -The e-mail notification section of this tab identifies the Approvers that will receive notification when operations are pending in AGPM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SettingDescription

          From e-mail address

          The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain.

          To e-mail address

          A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent

          SMTP server

          The name of the e-mail server, such as mail.contoso.com

          User name

          A user with access to the SMTP server

          Password

          User's password for authentication to the SMTP server

          Confirm password

          Confirm user's password

          - -  - -## Domain-level role-based delegation - - -The role-based delegation section of this tab displays and enables an AGPM Administrator to delegate allowed, denied, and inherited permissions for each group and user on the domain with access to the archive. An AGPM Administrator can configure domain-wide permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions for each Group Policy administrator. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators.

          Remove

          Remove the selected Group Policy administrators from the Access Control List.

          Properties

          Display the properties for the selected Group Policy administrators.

          Advanced

          Open the Access Control List Editor.

          - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md), [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md), [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/domain-delegation-tab-agpm40.md b/mdop/agpm/domain-delegation-tab-agpm40.md deleted file mode 100644 index 5d2f696910..0000000000 --- a/mdop/agpm/domain-delegation-tab-agpm40.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Domain Delegation Tab -description: Domain Delegation Tab -author: mjcaparas -ms.assetid: 5be5841e-92fb-4af6-aa68-0ae50f8d5141 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain Delegation Tab - - -The **Domain Delegation** tab on the **Change Control** pane provides a list of Group Policy administrators who have domain-level access to the archive and indicates the roles of each. Additionally, this tab enables AGPM Administrators (Full Control) to configure domain-level permissions for Editors, Approvers, Reviewers, and other AGPM Administrators. There are two sections on the **Domain Delegation** tab—configuration of e-mail notification and role-based delegation for Advanced Group Policy Management (AGPM) at the domain level. - -## Configuration of e-mail notification - - -The e-mail notification section of this tab identifies the Approvers that will receive notification when operations are pending in AGPM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SettingDescription

          From e-mail address

          The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain.

          To e-mail address

          A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent

          SMTP server

          The name of the e-mail server, such as mail.contoso.com

          User name

          A user with access to the SMTP server

          Password

          User's password for authentication to the SMTP server

          Confirm password

          Confirm user's password

          - -  - -## Domain-level role-based delegation - - -The role-based delegation section of this tab displays and enables an AGPM Administrator to delegate allowed, denied, and inherited permissions for each group and user on the domain with access to the archive. An AGPM Administrator can configure domain-wide permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions for each Group Policy administrator. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators.

          Remove

          Remove the selected Group Policy administrators from the Access Control List.

          Properties

          Display the properties for the selected Group Policy administrators.

          Advanced

          Open the Access Control List Editor.

          - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md), [Performing Editor Tasks](performing-editor-tasks-agpm40.md), [Performing Approver Tasks](performing-approver-tasks-agpm40.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/domain-delegation-tab.md b/mdop/agpm/domain-delegation-tab.md deleted file mode 100644 index 476c26e436..0000000000 --- a/mdop/agpm/domain-delegation-tab.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Domain Delegation Tab -description: Domain Delegation Tab -author: mjcaparas -ms.assetid: 15a9bfff-e25b-4b62-9ebc-521a5f4eae96 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain Delegation Tab - - -The **Domain Delegation** tab on the **Change Control** pane provides a list of Group Policy administrators who have domain-level access to the archive and indicates the roles of each. Additionally, this tab enables AGPM Administrators (Full Control) to configure domain-level permissions for Editors, Approvers, Reviewers, and other AGPM Administrators. There are two sections on the **Domain Delegation** tab—configuration of e-mail notification and role-based delegation for Advanced Group Policy Management (AGPM) at the domain level. - -## Configuration of e-mail notification - - -The e-mail notification section of this tab identifies the Approvers that will receive notification when operations are pending in AGPM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SettingDescription

          From

          The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain.

          To

          A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent

          SMTP server

          The name of the e-mail server, such as mail.contoso.com

          User name

          A user with access to the SMTP server

          Password

          User's password for authentication to the SMTP server

          Confirm password

          Confirm user's password

          - -  - -## Domain-level role-based delegation - - -The role-based delegation section of this tab displays and enables an AGPM Administrator to delegate allowed, denied, and inherited permissions for each group and user on the domain with access to the archive. An AGPM Administrator can configure domain-wide permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions for each Group Policy administrator. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators.

          Remove

          Remove the selected Group Policy administrators from the Access Control List.

          Properties

          Display the properties for the selected Group Policy administrators. The properties page is the same one displayed for an object in Active Directory User and Computers.

          Advanced

          Open the Access Control List Editor.

          - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md), [Performing Editor Tasks](performing-editor-tasks.md), [Performing Approver Tasks](performing-approver-tasks.md), and [Performing Reviewer Tasks](performing-reviewer-tasks.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md b/mdop/agpm/edit-a-gpo-offline-agpm30ops.md deleted file mode 100644 index 5518d46244..0000000000 --- a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Edit a GPO Offline -description: Edit a GPO Offline -author: mjcaparas -ms.assetid: 51677d8a-6209-41b5-82ed-4f3be817abc0 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit a GPO Offline - - -To make changes to a controlled Group Policy Object (GPO), you must first check out a copy of the GPO from the archive. No one else will be able to modify the GPO until it is checked in again, preventing the introduction of conflicting changes by multiple Group Policy administrators. When you have finished modifying the GPO, you check it into the archive so that it can be reviewed and deployed to the production environment. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Editing a GPO offline - - -To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and then check the GPO into the archive so that it can be reviewed and deployed (or modified by other Editors). - -- [Check out a GPO from the archive for editing](#bkmk-checkout) - -- [Edit a GPO offline](#bkmk-edit) - -- [Check a GPO into the archive](#bkmk-checkin) - -### - -**To check out a GPO from the archive for editing** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be edited, and then click **Check Out**. - -4. Type a comment to be displayed in the History of the GPO while it is checked out, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is now identified as **Checked Out**. - -### - -**To edit a GPO offline** - -1. On the **Controlled** tab, right-click the GPO to be edited, and then click **Edit**. - -2. In the **Group Policy Management Editor** window, make changes to an offline copy of the GPO. - - **Note**   - To disable all Computer Configuration settings or all User Configuration settings, right-click the GPO in the **Group Policy Management Editor** window and click **Properties**. Select **Disable Computer Configuration settings** or **Disable User Configuration settings** as appropriate. - - - -3. When you have finished modifying the GPO, close the **Group Policy Management Editor** window. - -### - -**To check a GPO into the archive** - -1. On the **Controlled** tab: - - - If you have made no changes to the GPO, right-click the GPO and click **Undo Check Out**, and then click **Yes** to confirm. - - - If you have made changes to the GPO, right-click the GPO and click **Check In**. - -2. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -3. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- To check out and edit a GPO, by default you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. Additionally, to edit the GPO you must be the individual who has checked out the GPO. - -- To check in a GPO, by default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -- When editing a GPO, any Group Policy Software Installation upgrade of a package in another GPO should reference the deployed GPO, and not the checked-out copy. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -- Reviewing a GPO - - - [Review GPO Settings](review-gpo-settings-agpm30ops.md) - - - [Review GPO Links](review-gpo-links-agpm30ops.md) - - - [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md) - -- Deploying a GPO - - - [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md) - - - [Deploy a GPO](deploy-a-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/edit-a-gpo-offline-agpm40.md b/mdop/agpm/edit-a-gpo-offline-agpm40.md deleted file mode 100644 index 4f311a1cc3..0000000000 --- a/mdop/agpm/edit-a-gpo-offline-agpm40.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Edit a GPO Offline -description: Edit a GPO Offline -author: mjcaparas -ms.assetid: 9c75eb3c-d4d5-41e0-b65e-8b4464a42cd9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit a GPO Offline - - -To make changes to a controlled Group Policy Object (GPO), you must first check out a copy of the GPO from the archive. No one else will be able to modify the GPO until it is checked in again, preventing the introduction of conflicting changes by multiple Group Policy administrators. When you have finished modifying the GPO, you check it into the archive so that it can be reviewed and deployed to the production environment. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Editing a GPO offline - - -To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and then check the GPO into the archive so that it can be reviewed and deployed (or modified by other Editors). - -- [Check out a GPO from the archive for editing](#bkmk-checkout) - -- [Edit a GPO offline](#bkmk-edit) - -- [Check a GPO into the archive](#bkmk-checkin) - -### - -**To check out a GPO from the archive for editing** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be edited, and then click **Check Out**. - -4. Type a comment to be displayed in the History of the GPO while it is checked out, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is now identified as **Checked Out**. - -### - -**To edit a GPO offline** - -1. On the **Controlled** tab, right-click the GPO to be edited, and then click **Edit**. - -2. In the **Group Policy Management Editor** window, make changes to an offline copy of the GPO. - - **Note**   - To disable all Computer Configuration settings or all User Configuration settings, right-click the GPO in the **Group Policy Management Editor** window and click **Properties**. Select **Disable Computer Configuration settings** or **Disable User Configuration settings** as appropriate. - - - -3. When you have finished modifying the GPO, close the **Group Policy Management Editor** window. - -### - -**To check a GPO into the archive** - -1. On the **Controlled** tab: - - - If you have made no changes to the GPO, right-click the GPO and click **Undo Check Out**, and then click **Yes** to confirm. - - - If you have made changes to the GPO, right-click the GPO and click **Check In**. - -2. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -3. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- To check out and edit a GPO, by default you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. Additionally, to edit the GPO you must be the individual who has checked out the GPO. - -- To check in a GPO, by default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -- When editing a GPO, any Group Policy Software Installation upgrade of a package in another GPO should reference the deployed GPO, and not the checked-out copy. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -- Reviewing a GPO - - - [Review GPO Settings](review-gpo-settings-agpm40.md) - - - [Review GPO Links](review-gpo-links-agpm40.md) - - - [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md) - -- Deploying a GPO - - - [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md) - - - [Deploy a GPO](deploy-a-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/edit-a-gpo-offline.md b/mdop/agpm/edit-a-gpo-offline.md deleted file mode 100644 index 6ea16ebc61..0000000000 --- a/mdop/agpm/edit-a-gpo-offline.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Edit a GPO Offline -description: Edit a GPO Offline -author: mjcaparas -ms.assetid: 4a148952-9fe9-4ec4-8df1-b25e37c97a54 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit a GPO Offline - - -To make changes to a controlled Group Policy object (GPO), you must first check out a copy of the GPO from the archive. No one else will be able to modify the GPO until it is checked in again, preventing the introduction of conflicting changes by multiple Group Policy administrators. When you have finished modifying the GPO, you check it into the archive, so it can be reviewed and deployed to the production environment. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Editing a GPO offline - - -To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and then check the GPO into the archive, so it can be reviewed and deployed (or modified by other Editors). - -- [Check out a GPO](#bkmk-checkout) - -- [Edit a GPO](#bkmk-edit) - -- [Check in a GPO](#bkmk-checkin) - -### - -**To check out a GPO from the archive for editing** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be edited, and then click **Check Out**. - -4. Type a comment to be displayed in the History of the GPO while it is checked out, then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is now identified as **Checked Out**. - -### - -**To edit a GPO offline** - -1. On the **Controlled** tab, right-click the GPO to be edited, and then click **Edit**. - -2. In the **Group Policy Object Editor**, make changes to an offline copy of the GPO. - -3. When you have finished modifying the GPO, close the **Group Policy Object Editor**. - -### - -**To check a GPO into the archive** - -1. On the **Controlled** tab: - - - If you have made no changes to the GPO, right-click the GPO and click **Undo Check Out**, then click **Yes** to confirm. - - - If you have made changes to the GPO, right-click the GPO and click **Check In**. - -2. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -3. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- To check out and edit a GPO, by default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. Additionally, to edit the GPO you must be the individual who has checked out the GPO. - -- To check in a GPO, by default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -- When editing a GPO, any Group Policy Software Installation upgrade of a package in another GPO should reference the deployed GPO, not the checked-out copy. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -- Reviewing a GPO - - - [Review GPO Settings](review-gpo-settings.md) - - - [Review GPO Links](review-gpo-links.md) - - - [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates.md) - -- Deploying a GPO - - - [Request Deployment of a GPO](request-deployment-of-a-gpo.md) - - - [Deploy a GPO](deploy-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/editing-a-gpo-agpm30ops.md b/mdop/agpm/editing-a-gpo-agpm30ops.md deleted file mode 100644 index 36bd0a1166..0000000000 --- a/mdop/agpm/editing-a-gpo-agpm30ops.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Editing a GPO -description: Editing a GPO -author: mjcaparas -ms.assetid: 3024051a-ff33-46d0-9c3e-68ebae7f6b60 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing a GPO - - -A Group Policy Object (GPO) must be controlled by Advanced Group Policy Management (AGPM) before you can edit it. See [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) for more information about controlling a GPO. - -To make changes to a GPO offline without immediately impacting the deployed copy of the GPO in the production environment, check out a copy of the GPO from the archive. When changes are complete, check the GPO back into the archive and request deployment of the GPO to the production environment. - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md) - -- [Use a Test Environment](use-a-test-environment-agpm30ops.md) - -- [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md) - -- [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm30ops.md) - -- [Rename a GPO or Template](rename-a-gpo-or-template-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/editing-a-gpo-agpm40.md b/mdop/agpm/editing-a-gpo-agpm40.md deleted file mode 100644 index 77dcc4e9cc..0000000000 --- a/mdop/agpm/editing-a-gpo-agpm40.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Editing a GPO -description: Editing a GPO -author: mjcaparas -ms.assetid: ef42eefe-7705-46b2-954d-18966335cbbf -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing a GPO - - -A Group Policy Object (GPO) must be controlled by Advanced Group Policy Management (AGPM) before you can edit it. See [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) for more information about controlling a GPO. - -To make changes to a GPO offline without immediately impacting the deployed copy of the GPO in the production environment, check out a copy of the GPO from the archive. When changes are complete, check the GPO back into the archive, test it, and request deployment of the GPO to the production environment. - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md) - -- [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm40.md) - -- [Rename a GPO or Template](rename-a-gpo-or-template-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/editing-a-gpo.md b/mdop/agpm/editing-a-gpo.md deleted file mode 100644 index c4bcdd473c..0000000000 --- a/mdop/agpm/editing-a-gpo.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Editing a GPO -description: Editing a GPO -author: mjcaparas -ms.assetid: ec77d3bb-8a64-4d8e-9c28-87763de02ec0 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing a GPO - - -A Group Policy object (GPO) must be controlled by Advanced Group Policy Management (AGPM) before you can edit it. See [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) for more information about controlling a GPO. - -To make changes to a GPO offline without immediately impacting the deployed copy of the GPO in the production environment, check out a copy of the GPO from the archive. When changes are complete, check the GPO back into the archive and request deployment of the GPO to the production environment. - -- [Edit a GPO Offline](edit-a-gpo-offline.md) - -- [Use a Test Environment](use-a-test-environment.md) - -- [Request Deployment of a GPO](request-deployment-of-a-gpo.md) - -- [Label the Current Version of a GPO](label-the-current-version-of-a-gpo.md) - -- [Rename a GPO or Template](rename-a-gpo-or-template.md) - -  - -  - - - - - diff --git a/mdop/agpm/export-a-gpo-to-a-file.md b/mdop/agpm/export-a-gpo-to-a-file.md deleted file mode 100644 index d75d40eada..0000000000 --- a/mdop/agpm/export-a-gpo-to-a-file.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Export a GPO to a File -description: Export a GPO to a File -author: mjcaparas -ms.assetid: 0d01b1f7-a6a4-4d0d-9aa7-2d6f1ae93d9d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Export a GPO to a File - - -You can export a controlled Group Policy Object (GPO) to a CAB file so that you can copy it to a domain in another forest and import the GPO into Advanced Group Policy Management (AGPM) in that domain. For information about how to import GPO settings into a new or existing GPO, see [Import a GPO from a File](import-a-gpo-from-a-file-ed.md). - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To export a GPO to a file** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Export to**. - -4. Enter a file name for the file to which you want to export the GPO, and then click **Export**. If the file does not exist, it is created. If it already exists, it is replaced. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents**, **Read Settings**, and **Export GPO** permissions for the GPO. - -### Additional references - -- [Using a Test Environment](using-a-test-environment.md) - -  - -  - - - - - diff --git a/mdop/agpm/feature-visibility-settings-agpm30ops.md b/mdop/agpm/feature-visibility-settings-agpm30ops.md deleted file mode 100644 index d3049f4b3f..0000000000 --- a/mdop/agpm/feature-visibility-settings-agpm30ops.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Feature Visibility Settings -description: Feature Visibility Settings -author: mjcaparas -ms.assetid: 6a844478-a6b0-490d-923f-5a6f82467831 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Feature Visibility Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Management Console\\Restricted/Permitted Snap-ins\\Extension Snap-ins when editing a GPO. - - ---- - - - - - - - - - - - - - - - - - - - - -
          SettingEffect

          AGPM: Show Change Control tab

          This policy setting allows you to control the visibility of the Change Control folder in the Group Policy Management Console (GPMC).

          AGPM: Show History tab for linked GPOs

          This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a linked GPO in the GPMC.

          AGPM: Show History tab for GPOs

          This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a GPO in the GPMC.

          - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/feature-visibility-settings-agpm40.md b/mdop/agpm/feature-visibility-settings-agpm40.md deleted file mode 100644 index e30c603bc7..0000000000 --- a/mdop/agpm/feature-visibility-settings-agpm40.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Feature Visibility Settings -description: Feature Visibility Settings -author: mjcaparas -ms.assetid: d3c0b02a-b943-4001-8b9c-dfac8fe58789 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Feature Visibility Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Management Console\\Restricted/Permitted Snap-ins\\Extension Snap-ins when editing a GPO. - - ---- - - - - - - - - - - - - - - - - - - - - -
          SettingEffect

          AGPM: Show Change Control tab

          This policy setting allows you to control the visibility of the Change Control folder in the Group Policy Management Console (GPMC).

          AGPM: Show History tab for linked GPOs

          This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a linked GPO in the GPMC.

          AGPM: Show History tab for GPOs

          This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a GPO in the GPMC.

          - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/feature-visibility-settings.md b/mdop/agpm/feature-visibility-settings.md deleted file mode 100644 index 1cb1b3fc24..0000000000 --- a/mdop/agpm/feature-visibility-settings.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Feature Visibility Settings -description: Feature Visibility Settings -author: mjcaparas -ms.assetid: 9db2ba03-fb75-4f95-9138-ec89b9fc8d01 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Feature Visibility Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure the visibility of the **Change Control** node and **History** tab for Group Policy administrators to whom a Group Policy object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Administrative Templates\\Windows Components\\Microsoft Management Console\\Restricted/Permitted Snap-ins\\Extension Snap-ins in the **Group Policy Object Editor** when editing a GPO in the Group Policy Management Console (GPMC). If this path is not visible, right-click **Administrative Templates**, and add the agpm.admx or agpm.adm template. - - ---- - - - - - - - - - - - - - - - - - - - - -
          SettingEffect

          AGPM Change Control

          If enabled or not configured, the Change Control node is visible in the GPMC.

          -

          If disabled, the Change Control node is not visible in the GPMC.

          AGPM Link Extension

          If enabled or not configured, a History tab appears in the GPMC for each linked GPO.

          -

          If disabled, the History tab is not visible for linked GPOs.

          AGPM GPO Extension

          If enabled or not configured, a History tab appears in the GPMC for each GPO.

          -

          If disabled, the History tab is not visible for GPOs.

          - -  - -### Additional references - -- [Administrative Template Settings](administrative-template-settings.md) - -  - -  - - - - - diff --git a/mdop/agpm/history-window-agpm30ops.md b/mdop/agpm/history-window-agpm30ops.md deleted file mode 100644 index c3295c3095..0000000000 --- a/mdop/agpm/history-window-agpm30ops.md +++ /dev/null @@ -1,204 +0,0 @@ ---- -title: History Window -description: History Window -author: mjcaparas -ms.assetid: 114f50a4-508d-4589-b006-6cd05cffe6b7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# History Window - - -The history of a Group Policy Object (GPO) can be displayed by double-clicking a GPO or by right-clicking a GPO and then clicking **History**. It is also displayed in the **Group Policy Management Console** (GPMC) as a tab for each GPO. - -The history provides a record of events in the lifetime of the selected GPO. From the **History** window, you can obtain a report of the settings within a version of the GPO, compare multiple versions of a GPO, or roll back to a previous version of a GPO. - -## Filtering events in the History window - - -The tabs within the **History** window filter the states in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - -
          TabsFiltering

          All States

          Display all states in the history of the GPO.

          Unique Versions

          Display only unique versions of the GPO checked into the archive. The version deployed to the production environment, shortcuts to unique versions, and informational states are omitted from this list.

          - - - -## Event information - - -Information is provided for each state in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          GPO attributeDescription

          Change Date

          Time stamp of when the action in the State column was performed.

          State

          A state in the history of the GPO.

          Changed By

          The person who checked in or deployed the GPO.

          Comment

          A comment entered by the person who checked in or deployed a GPO at the time that this version was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version.

          Deletable

          Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited.

          -
          -Note

          You can modify whether a version of a GPO is deletable by right-clicking it and then clicking Do Not Allow Deletion or Allow Deletion.

          -
          -
          - -

          Computer Version

          Automatically generated version of the Computer Configuration portion of the GPO.

          User Version

          Automatically generated version of the User Configuration portion of the GPO.

          GPO Status

          The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled.

          WMI Filter

          Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC.

          - - - -## Reports - - -The **Settings** and **Differences** buttons display reports about GPO settings for the GPO version or versions selected. Right-clicking GPO versions provides the option to display XML-based reports as well. - - ---- - - - - - - - - - - - - - - - - -
          ButtonEffect

          Settings

          Generate an HTML-based report displaying the settings within the selected version of the GPO.

          Differences

          Generate an HTML-based report comparing the settings within multiple selected versions of the GPO.

          - - - -### Key to difference reports - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SymbolMeaningColor

          None

          Item exists with identical settings in both GPOs

          Varies with level

          [#]

          Item exists in both GPOs, but with changed settings

          Blue

          [-]

          Item exists only in the first GPO

          Red

          [+]

          Item exists only in the second GPO

          Green

          - - - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second), rather than as one item that has changed. - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/history-window-agpm40.md b/mdop/agpm/history-window-agpm40.md deleted file mode 100644 index 7603d75dd5..0000000000 --- a/mdop/agpm/history-window-agpm40.md +++ /dev/null @@ -1,204 +0,0 @@ ---- -title: History Window -description: History Window -author: mjcaparas -ms.assetid: 5bea62e7-d267-40b2-a66d-fb1be7373a1c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# History Window - - -The history of a Group Policy Object (GPO) can be displayed by double-clicking a GPO or by right-clicking a GPO and then clicking **History**. It is also displayed in the Group Policy Management Console (GPMC) as a tab for each GPO. - -The history provides a record of events in the lifetime of the selected GPO. From the **History** window, you can obtain a report of the settings in a version of the GPO, compare multiple versions of a GPO, or roll back to an earlier version of a GPO. - -## Filtering events in the History window - - -The tabs within the **History** window filter the states in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - -
          TabsFiltering

          All States

          Display all states in the history of the GPO.

          Unique Versions

          Display only unique versions of the GPO checked into the archive. The version deployed to the production environment, shortcuts to unique versions, and informational states are omitted from this list.

          - - - -## Event information - - -Information is provided for each state in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          GPO attributeDescription

          Change Date

          Time stamp of when the action in the State column was performed.

          State

          A state in the history of the GPO.

          Changed By

          The person who checked in or deployed the GPO.

          Comment

          A comment entered by the person who checked in or deployed a GPO at the time that this version was changed, useful for identifying the specifics of the version in case of the need to roll back to an earlier version.

          Deletable

          Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited.

          -
          -Note

          You can change whether a version of a GPO can be deleted by right-clicking the GPO and then clicking Do Not Allow Deletion or Allow Deletion.

          -
          -
          - -

          Computer Version

          Automatically generated version of the Computer Configuration part of the GPO.

          User Version

          Automatically generated version of the User Configuration part of the GPO.

          GPO Status

          The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled.

          Source GPO Information

          For a GPO that has been imported from another forest, the original GPO name, domain, and user and date associated with the last change.

          - - - -## Reports - - -The **Settings** and **Differences** buttons display reports about GPO settings for the GPO version or versions selected. Also, right-clicking a GPO version or versions provides the option to display XML-based reports. - - ---- - - - - - - - - - - - - - - - - -
          ButtonEffect

          Settings

          Generate an HTML-based report displaying the settings within the selected version of the GPO.

          Differences

          Generate an HTML-based report comparing the settings within multiple selected versions of the GPO.

          - - - -### Key to difference reports - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SymbolMeaningColor

          None

          Item exists with identical settings in both GPOs

          Varies with level

          [#]

          Item exists in both GPOs, but with changed settings

          Blue

          [-]

          Item exists only in the first GPO

          Red

          [+]

          Item exists only in the second GPO

          Green

          - - - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two items (one present only in the first GPO, one present only in the second), instead of one item that has changed. - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/history-window.md b/mdop/agpm/history-window.md deleted file mode 100644 index 0e5e9a6687..0000000000 --- a/mdop/agpm/history-window.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: History Window -description: History Window -author: mjcaparas -ms.assetid: f11f9ad9-bffe-4c56-8c46-fe9c0a8e55c1 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# History Window - - -The history of a Group Policy object (GPO) can be displayed by double-clicking a GPO or by right-clicking a GPO and then clicking **History**. It is also displayed in the **Group Policy Management Console** (GPMC) as a tab for each GPO. - -The history provides a list of all versions of the selected GPO saved within the archive. From the **History** window, you can obtain a report of the settings within a GPO, compare multiple versions of a GPO, or roll back to a previous version of a GPO. - -## Filtering events in the History window - - -The tabs within the **History** window filter the events displayed. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TabsFiltering

          Show All

          Display all versions of the GPO.

          Checked In

          Display only checked-in versions of the GPO. The deployed version is omitted from this list.

          Labels Only

          Display only GPOs that have labels associated with them.

          - -  - -## Event information - - -Information is provided for each event in the history of the selected GPO. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          GPO CharacteristicDescription

          Computer

          Automatically generated version of the Computer Configuration portion of the GPO.

          User

          Automatically generated version of the User Configuration portion of the GPO.

          Time

          Timestamp of the version of the GPO when the action in the status field was performed.

          State

          The state of the selected version of the GPO:

          -

          Deployed GPO icon Deployed: This version of the GPO is currently live in the production environment.

          -

          Checked in GPO icon Checked In: This version of the GPO is available for authorized Editors to check out for editing or for a Group Policy administrator to deploy.

          -

          Checked out GPO icon Checked Out: This version of the GPO is currently checked out by an Editor and is unavailable for other Editors. (The checked out state is not recorded in the History except to indicate if a GPO is currently checked out.)

          -

          Created GPO icon Created: Identifies the date and time of the initial creation of the GPO.

          -

          Labeled GPO icon Labeled: Identifies a labeled version of the GPO.

          GPO Status

          The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled.

          Owner

          The person who checked in or deployed the GPO.

          Comment

          A comment entered by the owner of a GPO at the time that this version was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version.

          - -  - -## Reports - - -Depending on whether a single GPO version or multiple GPO versions are selected, the **Settings** and **Differences** buttons display reports on GPO settings. Right-clicking GPO versions provides the option to display XML-based reports as well. - - ---- - - - - - - - - - - - - - - - - -
          ButtonEffect

          Settings

          Generate an HTML-based report displaying the settings within the selected version of the GPO.

          Differences

          Generate an HTML-based report comparing the settings within multiple selected versions of the GPO.

          - -  - -### Key to difference reports - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SymbolMeaningColor

          None

          Item exists with identical settings in both GPOs

          Varies with level

          [#]

          Item exists in both GPOs, but with changed settings

          Blue

          [-]

          Item exists only in the first GPO

          Red

          [+]

          Item exists only in the second GPO

          Green

          - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second), rather than as one item that has changed. - -### Additional references - -- [Contents Tab](contents-tab.md) - -  - -  - - - - - diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md deleted file mode 100644 index 370ce5130b..0000000000 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: Identify Differences Between GPOs, GPO Versions, or Templates -description: Identify Differences Between GPOs, GPO Versions, or Templates -author: mjcaparas -ms.assetid: e391fa91-3956-4150-9d43-900cfc88d543 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify Differences Between GPOs, GPO Versions, or Templates - - -You can generate HTML-based or XML-based difference reports to analyze the differences between Group Policy Objects (GPOs), templates, or different versions of a GPO. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Identifying differences between GPOs, GPO versions, or templates - - -- [Between two GPOs or templates](#bkmk-two-gpos) - -- [Between a GPO and a template](#bkmk-gpo-and-template) - -- [Between two versions of one GPO](#bkmk-two-versions) - -- [Between a GPO version and a template](#bkmk-gpo-version-and-template) - -## - - -**To identify differences between two GPOs or templates** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Select the two GPOs or templates. - -4. Right-click one of the GPOs or templates, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs or templates. - -### - -**To identify differences between a GPO and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Right-click the GPO, click **Differences**, and then click **Template**. - -4. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO and template. - -### - -**To identify differences between two versions of one GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history, and then highlight the versions to be compared. - -4. Right-click one of the versions, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs. - -### - -**To identify differences between a GPO version and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version of interest, click **Differences**, and then click **Template**. - -5. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO version and template. - -## Key to difference reports - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SymbolMeaningColor

          None

          Item exists with identical settings in both GPOs

          Varies with level

          [#]

          Item exists in both GPOs, but with changed settings

          Blue

          [-]

          Item exists only in the first GPO

          Red

          [+]

          Item exists only in the second GPO

          Green

          - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second) rather than as one item that has changed. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md deleted file mode 100644 index 57a7719f21..0000000000 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: Identify Differences Between GPOs, GPO Versions, or Templates -description: Identify Differences Between GPOs, GPO Versions, or Templates -author: mjcaparas -ms.assetid: 3f03c368-162b-450f-be6c-2807c3e8d741 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify Differences Between GPOs, GPO Versions, or Templates - - -You can generate HTML-based or XML-based difference reports to analyze the differences between Group Policy Objects (GPOs), templates, or different versions of a GPO. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Identifying differences between GPOs, GPO versions, or templates - - -- [Between two GPOs or templates](#bkmk-two-gpos) - -- [Between a GPO and a template](#bkmk-gpo-and-template) - -- [Between two versions of one GPO](#bkmk-two-versions) - -- [Between a GPO version and a template](#bkmk-gpo-version-and-template) - -## - - -**To identify differences between two GPOs or templates** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Select the two GPOs or templates. - -4. Right-click one of the GPOs or templates, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs or templates. - -### - -**To identify differences between a GPO and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Right-click the GPO, click **Differences**, and then click **Template**. - -4. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO and template. - -### - -**To identify differences between two versions of one GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history, and then highlight the versions to be compared. - -4. Right-click one of the versions, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs. - -### - -**To identify differences between a GPO version and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version of interest, click **Differences**, and then click **Template**. - -5. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO version and template. - -## Key to difference reports - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SymbolMeaningColor

          None

          Item exists with identical settings in both GPOs

          Varies with level

          [#]

          Item exists in both GPOs, but with changed settings

          Blue

          [-]

          Item exists only in the first GPO

          Red

          [+]

          Item exists only in the second GPO

          Green

          - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second) rather than as one item that has changed. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md deleted file mode 100644 index 31a0ed88ed..0000000000 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: Identify Differences Between GPOs, GPO Versions, or Templates -description: Identify Differences Between GPOs, GPO Versions, or Templates -author: mjcaparas -ms.assetid: 6320afc4-af81-47e8-9f4c-463ff99d5a53 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify Differences Between GPOs, GPO Versions, or Templates - - -You can generate HTML-based or XML-based difference reports to analyze the differences between Group Policy objects (GPOs), templates, or different versions of a GPO. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Identifying differences between GPOs, GPO versions, or templates - - -- [Between two GPOs or templates](#bkmk-two-gpos) - -- [Between a GPO and a template](#bkmk-gpo-and-template) - -- [Between two versions of one GPO](#bkmk-two-versions) - -- [Between a GPO version and a template](#bkmk-gpo-version-and-template) - -## - - -**To identify differences between two GPOs or templates** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Select the two GPOs or templates. - -4. Right-click one of the GPOs or templates, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs or templates. - -### - -**To identify differences between a GPO and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Right-click the GPO, click **Differences**, and then click **Template**. - -4. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO and template. - -### - -**To identify differences between two versions of one GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history, and then highlight the versions to be compared. - -4. Right-click one of the versions, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs. - -### - -**To identify differences between a GPO version and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version of interest, click **Differences**, and then click **Template**. - -5. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO version and template. - -## Key to difference reports - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SymbolMeaningColor

          None

          Item exists with identical settings in both GPOs

          Varies with level

          [#]

          Item exists in both GPOs, but with changed settings

          Blue

          [-]

          Item exists only in the first GPO

          Red

          [+]

          Item exists only in the second GPO

          Green

          - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second) rather than as one item that has changed. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/images/0840a6a3-54a6-4528-98a9-7b122243c1a5.gif b/mdop/agpm/images/0840a6a3-54a6-4528-98a9-7b122243c1a5.gif deleted file mode 100644 index 92fb2d9983..0000000000 Binary files a/mdop/agpm/images/0840a6a3-54a6-4528-98a9-7b122243c1a5.gif and /dev/null differ diff --git a/mdop/agpm/images/327623bd-0842-4372-be1f-bdc4b8c3481c.gif b/mdop/agpm/images/327623bd-0842-4372-be1f-bdc4b8c3481c.gif deleted file mode 100644 index c44fbda129..0000000000 Binary files a/mdop/agpm/images/327623bd-0842-4372-be1f-bdc4b8c3481c.gif and /dev/null differ diff --git a/mdop/agpm/images/36f6b687-f5cc-40d1-805f-b191d1fb1ace.gif b/mdop/agpm/images/36f6b687-f5cc-40d1-805f-b191d1fb1ace.gif deleted file mode 100644 index 08cd486435..0000000000 Binary files a/mdop/agpm/images/36f6b687-f5cc-40d1-805f-b191d1fb1ace.gif and /dev/null differ diff --git a/mdop/agpm/images/57b610a5-1c71-4d26-9173-d04abd495fcc.gif b/mdop/agpm/images/57b610a5-1c71-4d26-9173-d04abd495fcc.gif deleted file mode 100644 index 7cde9d24a1..0000000000 Binary files a/mdop/agpm/images/57b610a5-1c71-4d26-9173-d04abd495fcc.gif and /dev/null differ diff --git a/mdop/agpm/images/8356fcdc-1279-425b-ab14-a23bcfe391da.gif b/mdop/agpm/images/8356fcdc-1279-425b-ab14-a23bcfe391da.gif deleted file mode 100644 index a911ef77d0..0000000000 Binary files a/mdop/agpm/images/8356fcdc-1279-425b-ab14-a23bcfe391da.gif and /dev/null differ diff --git a/mdop/agpm/images/8e7a7c4e-809a-435a-8b29-30d797936210.gif b/mdop/agpm/images/8e7a7c4e-809a-435a-8b29-30d797936210.gif deleted file mode 100644 index 9514d106f5..0000000000 Binary files a/mdop/agpm/images/8e7a7c4e-809a-435a-8b29-30d797936210.gif and /dev/null differ diff --git a/mdop/agpm/images/9b65829d-253c-4f30-9295-c816a6521ed2.gif b/mdop/agpm/images/9b65829d-253c-4f30-9295-c816a6521ed2.gif deleted file mode 100644 index 7fa479c173..0000000000 Binary files a/mdop/agpm/images/9b65829d-253c-4f30-9295-c816a6521ed2.gif and /dev/null differ diff --git a/mdop/agpm/images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif b/mdop/agpm/images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif deleted file mode 100644 index e5c857fb6a..0000000000 Binary files a/mdop/agpm/images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif and /dev/null differ diff --git a/mdop/agpm/images/cd349b8d-c4d8-45ff-b17f-7db882502c58.gif b/mdop/agpm/images/cd349b8d-c4d8-45ff-b17f-7db882502c58.gif deleted file mode 100644 index 0a689c5b02..0000000000 Binary files a/mdop/agpm/images/cd349b8d-c4d8-45ff-b17f-7db882502c58.gif and /dev/null differ diff --git a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md b/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md deleted file mode 100644 index 259967c12d..0000000000 --- a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Import a GPO from a File -description: Import a GPO from a File -author: mjcaparas -ms.assetid: 2cbcda72-4de3-47ad-aaf8-4fc7341d5a00 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from a File - - -In Advanced Group Policy Management (AGPM), if you are an AGPM Administrator (Full Control) and you have exported a Group Policy Object (GPO) to a CAB file, you can import the policy settings from that GPO into a new GPO or an existing GPO in a domain in another forest. For information about exporting GPO settings to a CAB file, see [Export a GPO to a File](export-a-gpo-to-a-file.md). - -A user account with the AGPM Administrator role or the necessary permissions in AGPM is required to import policy settings into a new controlled GPO. A user account with the Editor or AGPM Administrator role or necessary permissions in AGPM is required to import policy settings into an existing GPO. Review the details in "Additional considerations" in this topic. - -## Importing policy settings from a file - - -When you import policy settings from a file, you can import them into a new GPO or an existing GPO. However, if you import policy settings into an existing GPO, all policy settings within it are replaced. - -- [Import policy settings into a new controlled GPO](#bkmk-new) - -- [Import policy settings into an existing GPO](#bkmk-existing) - -### - -**To import policy settings into a new controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the domain to which you want to import policy settings. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Create a new controlled GPO. In the **New Controlled GPO** dialog box, click **Import** and then click **Launch Wizard**. For more information about how to create a GPO, see [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md). - -4. Follow the instructions in the **Import Settings Wizard** to select a GPO backup, import policy settings from it for the new GPO, and enter a comment for the audit trail of the new GPO. - -### - -**To import policy settings into an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the domain to which you want to import policy settings. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Check out the destination GPO to which you want to import policy settings. - -4. Right-click the destination GPO, point to **Import from**, and then click **File**. - -5. Follow the instructions in the **Import Settings Wizard** to select a GPO backup, import its policy settings to replace those in the destination GPO, and enter a comment for the audit trail of the destination GPO. By default, the destination GPO is checked in when the wizard is finished. - -### Additional considerations - -- To import policy settings to a new controlled GPO, you must have **List Contents**, **Import GPO**, and **Create GPO** permissions for the domain. By default, you must be an AGPM Administrator to perform this procedure. - -- To import policy settings to an existing GPO, you must have **List Contents**, **Edit Settings**, and **Import GPO** permissions for the domain, and the GPO must be checked out by you. By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-a-file-ed.md b/mdop/agpm/import-a-gpo-from-a-file-ed.md deleted file mode 100644 index 3019b67029..0000000000 --- a/mdop/agpm/import-a-gpo-from-a-file-ed.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Import a GPO from a File -description: Import a GPO from a File -author: mjcaparas -ms.assetid: 6e901a52-1101-4fed-9f90-3819b573b378 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from a File - - -In Advanced Group Policy Management (AGPM), if you have exported a Group Policy Object (GPO) to a CAB file, you can import the policy settings from that GPO into an existing GPO in a domain in another forest. Importing policy settings into an existing GPO replaces all policy settings within that GPO. For information about exporting GPO settings to a CAB file, see [Export a GPO to a File](export-a-gpo-to-a-file.md). - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## - - -**To import policy settings into an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the domain to which you want to import policy settings. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Check out the destination GPO to which you want to import policy settings. - -4. Right-click the destination GPO, point to **Import from**, and then click **File**. - -5. Follow the instructions in the **Import Settings Wizard** to select a GPO backup, import its policy settings to replace those in the destination GPO, and enter a comment for the audit trail of the destination GPO. By default, the destination GPO is checked in when the wizard is finished. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents**, **Edit Settings**, and **Import GPO** permissions for the domain, and the GPO must be checked out by you. - -- Although an Editor cannot import policy settings into a new GPO during its creation, an Editor can request the creation of a new GPO and then import policy settings into it after it is created. - -### Additional references - -- [Using a Test Environment](using-a-test-environment.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-agpm30ops.md deleted file mode 100644 index 06214d174c..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: mjcaparas -ms.assetid: 35c2a682-ece8-4577-a083-7e3e9facfd13 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm30ops.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md b/mdop/agpm/import-a-gpo-from-production-agpm40-app.md deleted file mode 100644 index af00e3582a..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: mjcaparas -ms.assetid: c5b2f40d-1dc7-4dbf-b8b3-4d97ad73e1e5 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment of the domain and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm40.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md b/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md deleted file mode 100644 index a10d461d9e..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: mjcaparas -ms.assetid: ad14203a-2e6a-41d4-a05e-4508c80045fd -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment of the domain and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm40.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-approver.md b/mdop/agpm/import-a-gpo-from-production-approver.md deleted file mode 100644 index 6895bd2248..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-approver.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: mjcaparas -ms.assetid: 071270fa-1890-40ce-ab89-ce070a54aa59 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Control a Previously Uncontrolled GPO](control-a-previously-uncontrolled-gpo.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md deleted file mode 100644 index cc32d29e0f..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: mjcaparas -ms.assetid: ad90f13e-e73c-400f-b86f-c12f2e75d19d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm30ops.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-editor.md b/mdop/agpm/import-a-gpo-from-production-editor.md deleted file mode 100644 index 3ee29adf06..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-editor.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: mjcaparas -ms.assetid: ffa02b2a-2a43-4fc0-a06e-7d4b59022cc3 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Request Control of a Previously Uncontrolled GPO](request-control-of-a-previously-uncontrolled-gpo.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/index.md b/mdop/agpm/index.md deleted file mode 100644 index 3832e088c4..0000000000 --- a/mdop/agpm/index.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Advanced Group Policy Management -description: Advanced Group Policy Management -author: dansimp -ms.assetid: 493ca3c3-c3d6-4bb1-9430-dc1e43c86bb0 -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/23/2017 ---- - - -# Advanced Group Policy Management - - -Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of the Group Policy Management Console (GPMC) to provide comprehensive change control and improved management for Group Policy Objects (GPOs). AGPM is available as part of the Microsoft Desktop Optimization Pack (MDOP) for Software Assurance. - -## AGPM Version Information - - -[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 4.0 SP2](agpm-40-sp2-navengl.md) supports Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 4.0 SP1](agpm-40-sp1-navengl.md) supports Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 4](agpm-4-navengl.md) supports Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 3](agpm-3-navengl.md) supports Windows Server 2008 and Windows Vista with SP1. - -[AGPM 2.5](agpm-25-navengl.md) supports Windows Vista (32-bit) with no service pack and Windows Server 2003 (32-bit). - -## Supplemental MDOP Product Guidance - - -In addition to the product documentation available online, supplemental product guidance such as informational videos and virtual labs are available for most MDOP products. - - ---- - - - - - - - - - - -

          MDOP Virtual Labs

          For a list of available MDOP virtual labs, go to Microsoft Desktop Optimization Pack (MDOP) Virtual Labs (https://go.microsoft.com/fwlink/?LinkId=234276).

          MDOP TechCenter

          For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to MDOP TechCenter (https://go.microsoft.com/fwlink/?LinkId=225286)

          -

          - - - -## How to Get MDOP - - -MDOP is a suite of products that can help streamline desktop deployment, management, and support across the enterprise. MDOP is available as an additional subscription for Software Assurance customers. - -**Evaluate MDOP** -MDOP is also available for test and evaluation to [MSDN](https://msdn.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) and [TechNet](https://technet.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) subscribers in accordance with MSDN and TechNet agreements. - -**Download MDOP** -MDOP subscribers can download the software at the [Microsoft Volume Licensing website (MVLS)](https://go.microsoft.com/fwlink/?LinkId=166331). - -**Purchase MDOP** -Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/windows/enterprise/how-to-buy.aspx) website to find out how to purchase MDOP for your business. - - - - - - - - - diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md deleted file mode 100644 index 1aa5500034..0000000000 --- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Label the Current Version of a GPO -description: Label the Current Version of a GPO -author: mjcaparas -ms.assetid: 3845211a-0bc9-4875-9906-cb758c443825 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Label the Current Version of a GPO - - -You can label the current version of a Group Policy Object (GPO) for easy identification in its history. You can use a label to identify a known good version to which you could roll back if a problem occurs. Also, by labeling multiple GPOs with the same label at one time, you can mark related GPOs that should be rolled back to the same point if rollback should later be necessary. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To label the current version of GPOs in their histories** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Click a GPO for which to label the current version. To select multiple GPOs, press SHIFT and click the last GPO in a contiguous group of GPOs, or press CTRL and click individual GPOs. Right-click a selected GPO, and then click **Label**. - -4. Type a label and a comment to be displayed in the history of each GPO selected, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md deleted file mode 100644 index 4a8c652822..0000000000 --- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Label the Current Version of a GPO -description: Label the Current Version of a GPO -author: mjcaparas -ms.assetid: cadc8769-21da-44b0-8122-6cafdb448913 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Label the Current Version of a GPO - - -You can label the current version of a Group Policy Object (GPO) for easy identification in its history. You can use a label to identify a known good version to which you could roll back if a problem occurs. Also, by labeling multiple GPOs with the same label at one time, you can mark related GPOs that should be rolled back to the same point if rollback should later be necessary. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To label the current version of GPOs in their histories** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Click a GPO for which to label the current version. To select multiple GPOs, press SHIFT and click the last GPO in a contiguous group of GPOs, or press CTRL and click individual GPOs. Right-click a selected GPO, and then click **Label**. - -4. Type a label and a comment to be displayed in the history of each GPO selected, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/label-the-current-version-of-a-gpo.md b/mdop/agpm/label-the-current-version-of-a-gpo.md deleted file mode 100644 index 23520638fb..0000000000 --- a/mdop/agpm/label-the-current-version-of-a-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Label the Current Version of a GPO -description: Label the Current Version of a GPO -author: mjcaparas -ms.assetid: 5e4e50f8-e4a8-4bda-aac4-1569d5fbd6a7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Label the Current Version of a GPO - - -You can label the current version of a Group Policy object (GPO) for easy identification in its history. You can use a label to identify a known good version to which you could roll back if a problem occurs. Also, by labeling multiple GPOs with the same label at one time, you can mark related GPOs that should be rolled back to the same point if rollback should later be necessary. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To label the current version of GPOs in their histories** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Click a GPO for which to label the current version. To select multiple GPOs, press SHIFT and click the last GPO in a contiguous group of GPOs, or press CTRL and click individual GPOs. Right-click a selected GPO, and then click **Label**. - -4. Type a label and a comment to be displayed in the history of each GPO selected, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md deleted file mode 100644 index d119a83fa7..0000000000 --- a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Limit the GPO Versions Stored -description: Limit the GPO Versions Stored -author: mjcaparas -ms.assetid: da14edc5-0c36-4c54-b122-861c86b99eb1 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Limit the GPO Versions Stored - - -By default, all versions of every controlled Group Policy Object (GPO) are retained in the archive on the AGPM Server. However, you can limit the number of versions retained for each GPO and delete older versions when that limit is exceeded. When GPO versions are deleted, a record of the version remains in the history of the GPO, but the GPO version itself is deleted from the archive. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To limit the number of GPO versions stored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Select the **Delete old versions of each GPO from the archive** check box, and type the maximum number of GPO versions to store for each GPO, not including the current version. To retain only the current version, enter 0. The maximum must be no greater than 999. - - **Important**   - Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - - - -4. Click the **Apply** button. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- You can prevent a GPO version from being deleted by marking it in the history as ineligible for deletion. To do so, right-click the version in the history of the GPO and click **Do Not Delete**. - -### Additional references - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md deleted file mode 100644 index 2570da4136..0000000000 --- a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Limit the GPO Versions Stored -description: Limit the GPO Versions Stored -author: mjcaparas -ms.assetid: d802c7b6-f303-4b23-aefd-f19f1300b0ff -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Limit the GPO Versions Stored - - -By default, all versions of every controlled Group Policy Object (GPO) are retained in the archive on the AGPM Server. However, you can limit the number of versions retained for each GPO and delete older versions when that limit is exceeded. When GPO versions are deleted, a record of the version remains in the history of the GPO, but the GPO version itself is deleted from the archive. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To limit the number of GPO versions stored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Select the **Delete old versions of each GPO from the archive** check box, and type the maximum number of GPO versions to store for each GPO, not including the current version. To retain only the current version, enter 0. The maximum must be no greater than 999. - - **Important**   - Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - - - -4. Click the **Apply** button. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- You can prevent a GPO version from being deleted by marking it in the history as ineligible for deletion. To do so, right-click the version in the history of the GPO and click **Do Not Delete**. - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md b/mdop/agpm/logging-and-tracing-settings-agpm30ops.md deleted file mode 100644 index 327edf7784..0000000000 --- a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Logging and Tracing Settings -description: Logging and Tracing Settings -author: mjcaparas -ms.assetid: 858b6fbf-65b4-42fa-95a9-69b04e5734d7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Logging and Tracing Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Servers and clients to which a Group Policy Object (GPO) with these settings is applied. - -The following setting is available under Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - -**Trace file locations**: - -- Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - -- Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - - ---- - - - - - - - - - - - - -
          SettingEffect

          AGPM: Configure logging

          This policy setting allows you to turn on and configure logging for AGPM. This setting affects both client and server components of AGPM.

          - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/logging-and-tracing-settings-agpm40.md b/mdop/agpm/logging-and-tracing-settings-agpm40.md deleted file mode 100644 index 3e42a4a154..0000000000 --- a/mdop/agpm/logging-and-tracing-settings-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Logging and Tracing Settings -description: Logging and Tracing Settings -author: mjcaparas -ms.assetid: 66d03306-80d8-4132-bf71-2827157b1fc9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Logging and Tracing Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Servers and clients to which a Group Policy Object (GPO) with these settings is applied. - -The following setting is available under Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - -**Trace file locations**: - -- Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - -- Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - - ---- - - - - - - - - - - - - -
          SettingEffect

          AGPM: Configure logging

          This policy setting allows you to turn on and configure logging for AGPM. This setting affects both client and server components of AGPM.

          - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/logging-and-tracing-settings.md b/mdop/agpm/logging-and-tracing-settings.md deleted file mode 100644 index ec78ccc511..0000000000 --- a/mdop/agpm/logging-and-tracing-settings.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Logging and Tracing Settings -description: Logging and Tracing Settings -author: mjcaparas -ms.assetid: db6b43c7-fdde-4d11-b5ab-a81346e56940 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Logging and Tracing Settings - - -The Administrative Template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Servers and clients to which a Group Policy object (GPO) with these settings is applied. - -The following setting is available under Computer Configuration\\Administrative Templates\\Windows Components\\AGPM in the **Group Policy Object Editor** when editing a GPO in the Group Policy Management Console (GPMC). If this path is not visible, right-click **Administrative Templates**, and add the agpm.admx or agpm.adm template. - -**Trace file locations**: - -- Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - -- Server: %CommonAppData%\\Microsoft\\AGPM\\agpmserv.log - - ---- - - - - - - - - - - - - -
          SettingEffect

          AGPM Logging

          If enabled, this setting configures whether tracing is turned on and the level of detail. This setting affects both client and server components of AGPM.

          -

          If disabled or not configured, this setting has no effect.

          - -  - -### Additional references - -- [Administrative Template Settings](administrative-template-settings.md) - -  - -  - - - - - diff --git a/mdop/agpm/managing-the-agpm-service-agpm30ops.md b/mdop/agpm/managing-the-agpm-service-agpm30ops.md deleted file mode 100644 index 9896b4a887..0000000000 --- a/mdop/agpm/managing-the-agpm-service-agpm30ops.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Managing the AGPM Service -description: Managing the AGPM Service -author: mjcaparas -ms.assetid: a522b1f1-c57b-43aa-9d75-acc6f9bedbf9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. It enforces Advanced Group Policy Management (AGPM) delegation and provides an enhanced level of security. The AGPM Service is hosted on the server on which the Microsoft Advanced Group Policy Management - Server is installed. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -- [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md) - -### Additional references - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/managing-the-agpm-service-agpm40.md b/mdop/agpm/managing-the-agpm-service-agpm40.md deleted file mode 100644 index 96280adf4b..0000000000 --- a/mdop/agpm/managing-the-agpm-service-agpm40.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Managing the AGPM Service -description: Managing the AGPM Service -author: mjcaparas -ms.assetid: 48ca02aa-6acf-403b-afd4-66ae8a953246 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment of the domain. It enforces Advanced Group Policy Management (AGPM) delegation and provides an enhanced level of security. The AGPM Service is hosted on the server on which the Microsoft Advanced Group Policy Management - Server is installed. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -- [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm40.md) - -### Additional references - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/managing-the-agpm-service.md b/mdop/agpm/managing-the-agpm-service.md deleted file mode 100644 index 174c061105..0000000000 --- a/mdop/agpm/managing-the-agpm-service.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Managing the AGPM Service -description: Managing the AGPM Service -author: mjcaparas -ms.assetid: 331f64d2-1236-4711-81b4-1b92f019bfa5 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. It enforces Advanced Group Policy Management (AGPM) delegation and provides an enhanced level of security. The AGPM Service is hosted on the server on which the Microsoft Advanced Group Policy Management - Server is installed. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -- [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md) - -- [Modify the Archive Path](modify-the-archive-path.md) - -- [Modify the AGPM Service Account](modify-the-agpm-service-account.md) - -- [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md) - - - - - - - - - diff --git a/mdop/agpm/managing-the-archive-agpm40.md b/mdop/agpm/managing-the-archive-agpm40.md deleted file mode 100644 index e22bed1a2d..0000000000 --- a/mdop/agpm/managing-the-archive-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Managing the Archive -description: Managing the Archive -author: mjcaparas -ms.assetid: b11a3d71-74ea-4dd7-b243-6f2880b7af2d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the Archive - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you manage access to the archive and have the option to limit the number of versions of each Group Policy Object (GPO) stored in the archive. You can delegate access to GPOs in the archive at the domain level or GPO level. Additionally, you can back up the archive so that you may be able to recover it if a disaster occurs. - -As an AGPM Administrator, you can export a GPO to a file, copy the file to another forest, and then import the GPO into a domain in that forest. Unlike an Editor, you can import policy settings from a GPO backup directly into a new controlled GPO when you create it. For information about how to export a GPO, see [Export a GPO to a File](export-a-gpo-to-a-file.md). - -- [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md) - -- [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md) - -- [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm40.md) - -- [Import a GPO from a File](import-a-gpo-from-a-file-agpmadmin.md) - -- [Back Up the Archive](back-up-the-archive-agpm40.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) - -### Additional references - -- For information about how to delegate access to GPOs in the production environment, see [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm40.md). - -- For information about how to move the archive, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/managing-the-archive.md b/mdop/agpm/managing-the-archive.md deleted file mode 100644 index ba25337775..0000000000 --- a/mdop/agpm/managing-the-archive.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Managing the Archive -description: Managing the Archive -author: mjcaparas -ms.assetid: 7c7654e9-ab0e-4531-8ef7-ae77ef391620 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the Archive - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you manage access to the archive and have the option to limit the number of versions of each Group Policy Object (GPO) stored in the archive. You can delegate access to GPOs in the archive at the domain level or GPO level. - -- [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md) - -- [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md) - -- [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm30ops.md) - -- [Back Up the Archive](back-up-the-archive.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) - -### Additional references - -- For information about how to delegate access to GPOs in the production environment, see [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm30ops.md). - -- For information about how to move the archive, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/modify-the-agpm-service-account.md b/mdop/agpm/modify-the-agpm-service-account.md deleted file mode 100644 index 21bd9e501c..0000000000 --- a/mdop/agpm/modify-the-agpm-service-account.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Modify the AGPM Service Account -description: Modify the AGPM Service Account -author: mjcaparas -ms.assetid: 0d8d8c7b-f299-4fee-8414-406492156942 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the AGPM Service Account - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. If this service is stopped or disabled, AGPM clients cannot perform operations through the server. - -The archive path and AGPM Service Account are configured during the installation of AGPM Server and can be changed afterward through **Add or Remove Programs** on the AGPM Server. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. - -**Important**   -The AGPM Service Account must have full access to the GPOs that it will manage and will be granted **Log On As A Service** permission. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - -If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - -**To modify the AGPM Service Account** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed, click **Start**, click **Control Panel**, click **Add or Remove Programs**. - -2. Click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions on screen to configure settings for the AGPM Service: - - 1. For the archive path, confirm or change the location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - 2. Enter new credentials for the AGPM Service Account. - - 3. For the archive owner, enter the credentials of an AGPM Administrator (Full Control). - -5. Click **Change**, and when the installation is complete click **Finish**. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-agpm-service-agpm30ops.md b/mdop/agpm/modify-the-agpm-service-agpm30ops.md deleted file mode 100644 index ce08a4d000..0000000000 --- a/mdop/agpm/modify-the-agpm-service-agpm30ops.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Modify the AGPM Service -description: Modify the AGPM Service -author: mjcaparas -ms.assetid: 3485f85f-59d1-48dc-8748-36826214dcb1 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. If this service is stopped or disabled, AGPM Clients cannot perform operations through the server. You can modify the archive path, the AGPM Service Account, and the port on which the AGPM Service listens. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to complete this procedure. - -**To modify the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed: - - - For Windows Server 2008, click **Start**, **Control Panel**, and **Programs and Features**. - - - For Windows Vista, click **Start**, **Control Panel**, **Programs**, and **Programs and Features**. - -2. Right-click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions to configure the AGPM Service: - - 1. In the **Archive Path** dialog box, enter a new location for the archive relative to the AGPM Server, or confirm the current archive path, and then click **Next**. - - **Important**   - The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - - - 2. In the **AGPM Service Account** dialog box, enter credentials for a service account under which the AGPM Service will run, and click **Next**. - - **Important**   - Modifying the installation clears the credentials for the AGPM Service Account. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - The AGPM Service Account must have full access to the GPOs that it will manage and will be granted **Log On As A Service** permission. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - - If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - - 3. In the **Archive Owner** dialog box, enter the user name of an AGPM Administrator (Full Control) or group of AGPM Administrators, and click **Next**. - - **Note**   - Modifying the installation clears the credentials for the Archive Owner. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - - - 4. In the **Port Configuration** dialog box, type a new port on which the AGPM Service should listen or confirm the port currently selected, and click **Next**. - - **Note**   - By default, the AGPM Service listens on port 4600. - - If you manually configure port exceptions or have rules configuring port exceptions, you can clear the **Add port exception to firewall** check box. - - - -5. Click **Change**, and when the installation is complete click **Finish**. - -6. If you have changed the port on which the AGPM Service listens, modify the port in the AGPM Server connection for each Group Policy administrator. (For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md).) - -7. Repeat for each AGPM Server to which the configuration changes should be applied. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-agpm-service-agpm40.md b/mdop/agpm/modify-the-agpm-service-agpm40.md deleted file mode 100644 index 20ec5c3a65..0000000000 --- a/mdop/agpm/modify-the-agpm-service-agpm40.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Modify the AGPM Service -description: Modify the AGPM Service -author: mjcaparas -ms.assetid: 3239d088-bb86-4ec4-bc56-dbe8f1c710f5 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment of the domain. If this service is stopped or disabled, AGPM Clients cannot perform operations through the server. You can modify the archive path, the AGPM Service Account, and the port on which the AGPM Service listens. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to complete this procedure. - -**To modify the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed, click **Start**, **Control Panel**, **Programs**, and **Programs and Features**. - -2. Right-click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions to configure the AGPM Service: - - 1. In the **Archive Path** dialog box, enter a new location for the archive relative to the AGPM Server, or confirm the current archive path, and then click **Next**. - - **Important**   - The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - - - 2. In the **AGPM Service Account** dialog box, enter credentials for a service account under which the AGPM Service will run, and click **Next**. - - **Important**   - Modifying the installation clears the credentials for the AGPM Service Account. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - The AGPM Service Account must have full access to the GPOs that it will manage and will be granted **Log On As A Service** permission. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - - If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - - 3. In the **Archive Owner** dialog box, enter the user name of an AGPM Administrator (Full Control) or group of AGPM Administrators, and click **Next**. - - **Note**   - Modifying the installation clears the credentials for the Archive Owner. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - - - 4. In the **Port Configuration** dialog box, type a new port on which the AGPM Service should listen or confirm the port currently selected, and click **Next**. - - **Note**   - By default, the AGPM Service listens on port 4600. - - If you manually configure port exceptions or have rules configuring port exceptions, you can clear the **Add port exception to firewall** check box. - - - -5. Click **Change**, and when the installation is complete click **Finish**. - -6. If you have changed the port on which the AGPM Service listens, modify the port in the AGPM Server connection for each Group Policy administrator. (For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md).) - -7. Repeat for each AGPM Server to which the configuration changes should be applied. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-archive-path.md b/mdop/agpm/modify-the-archive-path.md deleted file mode 100644 index 0e52f280d7..0000000000 --- a/mdop/agpm/modify-the-archive-path.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Modify the Archive Path -description: Modify the Archive Path -author: mjcaparas -ms.assetid: 6d90daf9-58db-4166-b5b3-e84bb261164a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the Archive Path - - -The archive path is the location of the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or on another server in the same forest. - -The archive path and AGPM Service Account are configured during the installation of AGPM Server and can be changed afterward through **Add or Remove Programs** on the AGPM Server. - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. - -**To modify the archive path** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed, click **Start**, click **Control Panel**, click **Add or Remove Programs**. - -2. Click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions on screen to configure settings for the AGPM Service: - - 1. For the archive path, enter a new location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - 2. Enter credentials for the AGPM Service Account. - - **Important**   - Modifying the installation clears the credentials for the AGPM Service Account. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - The AGPM Service Account must have full access to the GPOs that it will manage. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - - If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - - 3. For the archive owner, enter the credentials of an AGPM Administrator (Full Control). - -5. Click **Change**, and when the installation is complete click **Finish**. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md b/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md deleted file mode 100644 index 6ad27ab0b6..0000000000 --- a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Modify the Port on Which the AGPM Service Listens -description: Modify the Port on Which the AGPM Service Listens -author: mjcaparas -ms.assetid: a82c6873-e916-4a04-b263-aa612cd6956b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the Port on Which the AGPM Service Listens - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. By default, the AGPM Service listens on port 4600. You can change this port by modifying the Advanced Group Policy Management (AGPM) archive index file for each archive. - -**Note**   -Before modifying the port on which the AGPM Service listens, it is recommended that you back up the AGPM archive index file (gpostate.xml). This file is located in the folder entered as the archive path during the installation of Advanced Group Policy Management - Server. By default, this location of this file is %CommonAppData%\\Microsoft\\AGPM\\gpostate.xml on the AGPM Server. If you do not know which computer hosts the archive, you can follow the procedure for modifying the archive path to display the current archive path. For more information, see [Modify the Archive Path](modify-the-archive-path.md). - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) and the archive index file is required to complete this procedure. - -**To modify the port on which the AGPM Service listens** - -1. On the computer hosting the archive, open the archive index file (gpostate.xml) in a text editor. - -2. In the file, search for **agpm:port="4600"**. - -3. Replace **4600** with the port on which the AGPM Service should listen; then, save and close the file. - -4. On the AGPM Server, restart the AGPM Service. (For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md).) - -5. Modify the port in the AGPM Server connection for each Group Policy administrator. (For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md).) - -6. Repeat for each archive and AGPM Server. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md b/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md deleted file mode 100644 index 027abbaaa7..0000000000 --- a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Move the AGPM Server and the Archive -description: Move the AGPM Server and the Archive -author: mjcaparas -ms.assetid: 9ec48d3a-c293-45f0-8939-32ccdc062303 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Move the AGPM Server and the Archive - - -If you are replacing the AGPM Server and the server on which the archive is hosted, you must move the AGPM Service and the archive. If you prefer, you can move the AGPM Service and the archive separately. - -**Note**   -- The AGPM Server is the computer that hosts the AGPM Service and the computer on which Microsoft Advanced Group Policy Management – Server is installed. - -- By default, the archive is hosted on the AGPM Server, but you can specify an archive path to host it on another server instead. - - - -A user account that is a member of the Domain Admins group and has access to the previous and new AGPM Servers is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to be used by the new AGPM Server to complete this procedure. - -**To move the AGPM Service and the archive to a different server or servers** - -1. Back up the archive. For more information, see [Back Up the Archive](back-up-the-archive-agpm40.md). - -2. Move the AGPM Service: - - 1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - - 2. Install Microsoft Advanced Group Policy Management - Server on the new server that will host the AGPM Service. During this process, you specify the new archive path, the location for the archive in relation to the AGPM Server. For more information, see [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkId=153505) (https://go.microsoft.com/fwlink/?LinkId=153505) and [Planning Guide for Microsoft Advanced Group Policy Management](https://go.microsoft.com/fwlink/?LinkId=156883) (https://go.microsoft.com/fwlink/?LinkId=156883). - - 3. Either an AGPM Administrator (Full Control) must configure the AGPM Server connection for all Group Policy administrators who will use the new AGPM Server and remove the connection for the old AGPM Server, or else each Group Policy administrator must manually configure the new AGPM Server connection and remove the old AGPM Server connection for the AGPM snap-in on their computer. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - **Note**   - As a best practice, you should uninstall Microsoft Advanced Group Policy Management – Server from the previous AGPM Server. This will ensure that the AGPM Service cannot be unintentionally restarted on that server and potentially cause confusion if any AGPM Server connections to it remain. - - - -3. Copy the archive from the backup to the new server that will host the archive. For more information, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md). - - **Important**   - If you moved the archive without moving the AGPM Service at the same time: - - 1. You must change the archive path to point to the new location for the archive in relation to the AGPM Server. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - - 2. You must re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md). - - - -### Additional references - -- [Back Up the Archive](back-up-the-archive-agpm40.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm40.md) - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkId=153505) (https://go.microsoft.com/fwlink/?LinkId=153505) - -- [Planning Guide for Microsoft Advanced Group Policy Management](https://go.microsoft.com/fwlink/?LinkId=156883) (https://go.microsoft.com/fwlink/?LinkId=156883) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive.md b/mdop/agpm/move-the-agpm-server-and-the-archive.md deleted file mode 100644 index 93f0d42c02..0000000000 --- a/mdop/agpm/move-the-agpm-server-and-the-archive.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Move the AGPM Server and the Archive -description: Move the AGPM Server and the Archive -author: mjcaparas -ms.assetid: 13cb83c4-bb42-4e81-8660-5b7540f473d8 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Move the AGPM Server and the Archive - - -If you are replacing the AGPM Server and the server on which the archive is hosted, you must move the AGPM Service and the archive. If you prefer, you can move the AGPM Service and the archive separately. - -**Note**   -- The AGPM Server is the computer that hosts the AGPM Service and the computer on which Microsoft Advanced Group Policy Management – Server is installed. - -- By default, the archive is hosted on the AGPM Server, but you can specify an archive path to host it on another server instead. - - - -A user account that is a member of the Domain Admins group and has access to the previous and new AGPM Servers is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to be used by the new AGPM Server to complete this procedure. - -**To move the AGPM Service and the archive to a different server or servers** - -1. Back up the archive. For more information, see [Back Up the Archive](back-up-the-archive.md). - -2. Move the AGPM Service: - - 1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - - 2. Install Microsoft Advanced Group Policy Management - Server on the new server that will host the AGPM Service. During this process, you specify the new archive path, the location for the archive in relation to the AGPM Server. For more information, see Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 () and Planning Guide for Microsoft Advanced Group Policy Management (). - - 3. Either an AGPM Administrator (Full Control) must configure the AGPM Server connection for all Group Policy administrators who will use the new AGPM Server and remove the connection for the old AGPM Server, or else each Group Policy administrator must manually configure the new AGPM Server connection and remove the old AGPM Server connection for the AGPM snap-in on their computer. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - **Note**   - As a best practice, you should uninstall Microsoft Advanced Group Policy Management – Server from the previous AGPM Server. This will ensure that the AGPM Service cannot be unintentionally restarted on that server and potentially cause confusion if any AGPM Server connections to it remain. - - - -3. Copy the archive from the backup to the new server that will host the archive. For more information, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md). - - **Important**   - If you moved the archive without moving the AGPM Service at the same time: - - 1. You must change the archive path to point to the new location for the archive in relation to the AGPM Server. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - - 2. You must re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md). - - - -### Additional references - -- [Back Up the Archive](back-up-the-archive.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md) - -- Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 () - -- Planning Guide for Microsoft Advanced Group Policy Management () - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md deleted file mode 100644 index 464ddc37b5..0000000000 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations Guide for Microsoft Advanced Group Policy Management 2.5 -description: Operations Guide for Microsoft Advanced Group Policy Management 2.5 -author: mjcaparas -ms.assetid: 005f0bb5-789f-42a9-bcaf-7e8c31a8df66 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations Guide for Microsoft Advanced Group Policy Management 2.5 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC), providing comprehensive change control and enhanced management for Group Policy objects (GPOs). - -With AGPM you can: - -- Perform offline editing of GPOs, so you can create and test them before deploying to a production environment. - -- Retain multiple versions of a GPO in a central archive, so you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting each other's work by using a check-in/check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO using difference reporting. - -- Simplify the creation of new GPOs by using GPO templates, storing standard settings to use as starting points for new GPOs. - -AGPM adds a **Change Control** node under each domain displayed in the GPMC, as well as **History** and **Extensions** tabs for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -- [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md deleted file mode 100644 index eaa5a661af..0000000000 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Operations Guide for Microsoft Advanced Group Policy Management 3.0 -description: Operations Guide for Microsoft Advanced Group Policy Management 3.0 -author: mjcaparas -ms.assetid: aaefe6d1-a9e5-43eb-b4d8-85880798cb8b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations Guide for Microsoft Advanced Group Policy Management 3.0 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC), providing comprehensive change control and enhanced management for Group Policy Objects (GPOs). - -With AGPM you can: - -- Perform offline editing of GPOs, so you can create and test them before deploying to a production environment. - -- Retain multiple versions of a GPO in a central archive, so you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting each other's work by using a check-in/check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO using difference reporting. - -- Simplify the creation of new GPOs by using GPO templates, storing standard settings to use as starting points for new GPOs. - -AGPM adds a **Change Control** folder under each domain displayed in the GPMC, as well as a **History** tab for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm30ops.md) - -- [Best Practices for Version Control](best-practices-for-version-control.md) - -- [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -- [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management-agpm30ops.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md deleted file mode 100644 index 7243627a33..0000000000 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Operations Guide for Microsoft Advanced Group Policy Management 4.0 -description: Operations Guide for Microsoft Advanced Group Policy Management 4.0 -author: mjcaparas -ms.assetid: 0bafeba3-20a9-4360-be5d-03f786df11ee -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations Guide for Microsoft Advanced Group Policy Management 4.0 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC). AGPM provides comprehensive change control and improved management of Group Policy Objects (GPOs). - -Using AGPM, you can do these tasks: - -- Perform offline editing of GPOs so that you can create and test them before you deploy them to a production environment. - -- Maintain multiple versions of a GPO in a central archive so that you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people by using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting one another's work by using the check-in and check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO by using difference reporting. - -- Simplify creating new GPOs by using GPO templates, storing common policy settings and preference settings to use as starting points for new GPOs. - -- Delegate access to the production environment. - -- Search for GPOs with specific attributes and filter the list of GPOs displayed. - -- Export a GPO to a file so that you can copy it from a domain in a test forest to a domain in a production forest. - -AGPM adds a **Change Control** folder under each domain displayed in the GPMC, in addition to a **History** tab for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm40.md) - -- [Best Practices for Version Control](best-practices-for-version-control-agpm40.md) - -- [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive-agpm40.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md) - -- [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -- [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/other-enhancements-to-the-gpmc.md b/mdop/agpm/other-enhancements-to-the-gpmc.md deleted file mode 100644 index d68a942bcd..0000000000 --- a/mdop/agpm/other-enhancements-to-the-gpmc.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Other Enhancements to the GPMC -description: Other Enhancements to the GPMC -author: mjcaparas -ms.assetid: ef344101-17e1-4e06-9dc8-2f20ca796774 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Other Enhancements to the GPMC - - -Advanced Group Policy Management (AGPM) adds a **History** tab and an **Extensions** tab to extend the functionality of the **Group Policy Management Console** (GPMC). - -## History tab - - -AGPM adds a **History** tab to all Group Policy objects (GPOs) and Group Policy links displayed in the GPMC. The features of the **History** tab in the details pane of a GPO are the same as those of the **History** window displayed through the **Change Control** tab. For information about these features, see [History Window](history-window.md). - -## Extensions tab - - -In the Microsoft Windows Server® 2003 operating system, AGPM adds an **Extensions** tab to all GPOs and Group Policy links displayed in the GPMC. This tab lists all extensions that have settings in the GPO (or all registered extensions if **Show all registered extensions** is checked) and identifies them as part of the user or computer context. - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md deleted file mode 100644 index e14a1f4b10..0000000000 --- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Overview of Advanced Group Policy Management -description: Overview of Advanced Group Policy Management -author: mjcaparas -ms.assetid: 3a8d1e58-12b9-42bd-898f-6d57514dfbb9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Advanced Group Policy Management - - -You can use Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC) to provide comprehensive change control and improved management for Group Policy Objects (GPOs). - -## Group Policy object development with change control - - -With AGPM, you can store a copy of each GPO in a central archive so that Group Policy administrators can view and change it offline without immediately affecting the deployed version of the GPO. Additionally, AGPM stores a copy of each version of each controlled GPO in the archive so that you can roll back to an earlier version if necessary. - -The terms "check in" and "check out" are used just as in a library (or in applications that provide change control, version control, or source control for programming development). To use a book that is in a library, you check it out from the library. No one else can use it while you have it checked out. When you are finished with the book, you check it back into the library, so others can use it. - -When you develop GPOs by using AGPM: - -1. Create a new controlled GPO or control a previously uncontrolled GPO. - -2. Check out the GPO, so that you and only you can change it. - -3. Edit the GPO. - -4. Check in the edited GPO, so that others can change it, or so that it can be deployed. - -5. Review the changes. - -6. Deploy the GPO to the production environment. - -## Role-based delegation - - -AGPM provides comprehensive, easy-to-use role-based delegation for managing access to GPOs in the archive. Domain-level permissions enable AGPM Administrators to provide access to individual domains without providing access to other domains. GPO-based delegation enables AGPM Administrators to provide access to specific GPOs without providing domain-wide access. - -Within AGPM, there are specifically defined roles: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. The AGPM Administrator role includes the permissions for all other roles. By default, only Approvers have the power to deploy GPOs to the production environment, protecting the environment from mistakes by less experienced Editors. Also by default, all roles include the Reviewer role and therefore the ability to view GPO settings in reports. However, AGPM provides an AGPM Administrator with the flexibility to customize GPO access to fit the needs of your organization. - -## Delegation in a multiple Group Policy administrator environment - - -In an environment where multiple people change GPOs, an AGPM Administrator delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. For a typical GPO development process for an Editor and an Approver, see [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm30ops.md). - -### Additional references - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md deleted file mode 100644 index 4d4f47e6ad..0000000000 --- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Overview of Advanced Group Policy Management -description: Overview of Advanced Group Policy Management -author: mjcaparas -ms.assetid: 2c12f3b4-8472-4c5b-b7f8-1c98a80d6b47 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Advanced Group Policy Management - - -You can use Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC) to provide comprehensive change control and improved management for Group Policy Objects (GPOs). - -## Group Policy object development with change control - - -With AGPM, you can store a copy of each GPO in a central archive so that Group Policy administrators can view and change it offline without immediately affecting the deployed version of the GPO. Additionally, AGPM stores a copy of each version of each controlled GPO in the archive so that you can roll back to an earlier version if necessary. - -The terms "check in" and "check out" are used just as in a library (or in applications that provide change control, version control, or source control for programming development). To use a book that is in a library, you check it out from the library. No one else can use it while you have it checked out. When you are finished with the book, you check it back into the library, so others can use it. - -To use these GPO control features, you will click a Change Control node in the Group Policy Management editor. The Change Control node appears only if you have installed the AGPM Client. - -When you develop GPOs by using AGPM: - -1. Create a new controlled GPO or control a previously uncontrolled GPO. - -2. Check out the GPO, so that you and only you can change it. - -3. Edit the GPO. - -4. Check in the edited GPO, so that others can change it, or so that it can be deployed. - -5. Review the changes. - -6. Deploy the GPO to the production environment. - -## Role-based delegation - - -AGPM provides comprehensive, easy-to-use role-based delegation for managing access to GPOs in the archive. Domain-level permissions enable AGPM Administrators to provide access to individual domains without providing access to other domains. GPO-based delegation enables AGPM Administrators to provide access to specific GPOs without providing domain-wide access. - -Within AGPM, there are specifically defined roles: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. The AGPM Administrator role includes the permissions for all other roles. By default, only Approvers have the power to deploy GPOs to the production environment of a domain, protecting the environment from mistakes by less experienced Editors. Also by default, all roles include the Reviewer role and therefore the ability to view GPO settings in reports. However, AGPM provides an AGPM Administrator with the flexibility to customize GPO access to fit the needs of your organization. - -## Delegation in a multiple Group Policy administrator environment - - -In an environment where multiple people change GPOs, an AGPM Administrator delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. For a typical GPO development process for an Editor and an Approver, see [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md). - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - -  - -  - - - - - diff --git a/mdop/agpm/overview-of-advanced-group-policy-management.md b/mdop/agpm/overview-of-advanced-group-policy-management.md deleted file mode 100644 index 6bbb659ca4..0000000000 --- a/mdop/agpm/overview-of-advanced-group-policy-management.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Overview of Advanced Group Policy Management -description: Overview of Advanced Group Policy Management -author: mjcaparas -ms.assetid: 028de9dd-848b-42bc-a982-65ba5c433772 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Advanced Group Policy Management - - -You can use Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC), providing comprehensive change control and enhanced management for Group Policy objects (GPOs). - -## Group Policy object development with change control - - -With AGPM, you can store a copy of each GPO in a central archive, so Group Policy administrators can view and modify it offline without immediately impacting the deployed version of the GPO. Additionally, AGPM stores a copy of each version of each controlled GPO in the archive so that you can roll back to an earlier version if needed. - -The terms "check in" and "check out" are used in much the same way as in a library (or in applications that provide change control, version control, or source code control for programming development). To use a book that is in a library, you check it out from the library. No one else can use it while you have it checked out. When you are finished with the book, you check it back into the library, so others can use it. - -When developing GPOs using AGPM: - -1. Create a new controlled GPO or control a previously uncontrolled GPO. - -2. Check out the GPO, so you and only you can modify it. - -3. Edit the GPO. - -4. Check in the edited GPO, so others can modify it, or so it can be deployed. - -5. Review the changes. - -6. Deploy the GPO to the production environment. - -## Role-based delegation - - -AGPM provides comprehensive, easy-to-use role-based delegation. Domain-level permissions allow AGPM Administrators to provide access to individual domains without providing access to other domains. GPO-based delegation enables AGPM Administrators to allow access only to specific GPOs. - -Within AGPM, there are specifically defined roles: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. The AGPM Administrator role includes the permissions for all other roles. By default, only Approvers have the power to deploy GPOs to the production environment, protecting the environment from inadvertent mistakes by less experienced Editors. Also by default, all roles include the Reviewer role and therefore the ability to view GPO settings in reports. However, AGPM provides an AGPM Administrator with the flexibility to customize GPO access to fit the needs of your organization. - -## Delegation in a multiple Group Policy administrator environment - - -In an environment where multiple people make changes to GPOs, an AGPM Administrator delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. For a typical GPO development process for an Editor and an Approver, see [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md). - -### Additional references - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -- [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/pending-gpo-commands-agpm30ops.md b/mdop/agpm/pending-gpo-commands-agpm30ops.md deleted file mode 100644 index c155fbc2cf..0000000000 --- a/mdop/agpm/pending-gpo-commands-agpm30ops.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Pending GPO Commands -description: Pending GPO Commands -author: mjcaparas -ms.assetid: 3868dda0-8a41-4bba-9b0c-9f656f9a3cd5 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Pending GPO Commands - - -The **Pending** tab: - -- Displays a list of Group Policy Objects (GPOs) with pending requests for GPO management actions (such as creation, control, deployment, or deletion). - -- Provides a shortcut menu with commands for responding to pending requests and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

          Withdraw

          Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved.

          Approve

          Complete a pending request from an Editor to create, control, or delete the selected GPO.

          Reject

          Deny a pending request from an Editor to create, control, or delete the selected GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/pending-gpo-commands-agpm40.md b/mdop/agpm/pending-gpo-commands-agpm40.md deleted file mode 100644 index 1e6862db89..0000000000 --- a/mdop/agpm/pending-gpo-commands-agpm40.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Pending GPO Commands -description: Pending GPO Commands -author: mjcaparas -ms.assetid: b62f49e1-43ab-4c93-8102-96cd97a4adad -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Pending GPO Commands - - -The **Pending** tab: - -- Displays a list of Group Policy Objects (GPOs) with pending requests for GPO management actions (such as creation, control, deployment, or deletion). - -- Provides a shortcut menu with commands for responding to pending requests and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO.

          Withdraw

          Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved.

          Approve

          Complete a pending request from an Editor to create, control, or delete the selected GPO.

          Reject

          Deny a pending request from an Editor to create, control, or delete the selected GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/pending-tab.md b/mdop/agpm/pending-tab.md deleted file mode 100644 index 4ee185771f..0000000000 --- a/mdop/agpm/pending-tab.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Pending Tab -description: Pending Tab -author: mjcaparas -ms.assetid: 54a9a977-c0bc-4553-922b-b2e10e162df9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Pending Tab - - -The **Pending** tab: - -- Displays a list of Group Policy objects (GPOs) with pending requests for GPO management actions (such as creation, control, deployment, or deletion). - -- Provides a shortcut menu with commands for responding to pending requests and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

          Withdraw

          Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved.

          Approve

          Complete a pending request from an Editor to create, control, or delete the selected GPO.

          Reject

          Deny a pending request from an Editor to create, control, or delete the selected GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md deleted file mode 100644 index b23cff06c7..0000000000 --- a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Performing AGPM Administrator Tasks -description: Performing AGPM Administrator Tasks -author: mjcaparas -ms.assetid: 9678b0f4-70a5-411e-a896-afa4dc9ea6c4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing AGPM Administrator Tasks - - -In Advanced Group Policy Management (AGPM), an AGPM Administrator (Full Control) configures domain-wide options and delegates permissions to Approvers, Editors, Reviewers, and other AGPM Administrators. By default, an AGPM Administrator is an individual with Full Control—all AGPM permissions—and who therefore can perform tasks associated with any role. - -In an environment in which multiple people develop Group Policy Objects (GPOs), you can choose whether all AGPM users perform the same tasks and have the same level of access or whether AGPM Administrators delegate permissions to Editors who make changes to GPOs and to Approvers who deploy GPOs to the production environment. AGPM Administrators can configure permissions to meet the needs of your organization. - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md): Configure the AGPM Server Connection and e-mail notification, delegate access to GPOs in the production environment, and configure logging and tracing for troubleshooting. - -- [Managing the Archive](managing-the-archive.md): Delegate access to GPOs in the archive and limit the number of versions of each GPO stored. - -- [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md): Stop and start the AGPM Service or change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens. - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md): Move the AGPM Service, the archive, or both to a different server. - -Also, because the AGPM Administrator role includes the permissions for all other roles, an AGPM Administrator can perform the tasks normally associated with any other role. - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md), such as creating, deploying, or deleting GPOs - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md), such as editing, renaming, labeling, or importing GPOs, creating templates, or setting a default template - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md), such as reviewing settings and comparing GPOs - -### Additional considerations - -By default, the AGPM Administrator role has Full Control—all AGPM permissions: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -- Modify Options - -- Modify Security - -- Create Template - -The **Modify Options** and **Modify Security** permissions are unique to the role of AGPM Administrator. - -  - -  - - - - - diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md deleted file mode 100644 index aa73d0ac46..0000000000 --- a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Performing AGPM Administrator Tasks -description: Performing AGPM Administrator Tasks -author: mjcaparas -ms.assetid: bc746f39-bdc9-4e2a-bc48-c3c7905de098 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing AGPM Administrator Tasks - - -Advanced Group Policy Management (AGPM) lets an AGPM Administrator (Full Control) configure domain-wide options and delegate permissions to Approvers, Editors, Reviewers, and AGPM Administrators. By default, an AGPM Administrator is someone who has Full Control— all AGPM permissions—and who therefore can perform tasks associated with any role. - -In an environment in which multiple people develop Group Policy Objects (GPOs), you can choose to let all Group Policy administrators perform the same tasks and have the same level of access. Or, you can choose to let AGPM Administrators delegate permissions to Editors who can change GPOs and to Approvers who deploy GPOs to the production environment. AGPM Administrators can configure permissions to meet the needs of your organization. - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md): Configure the AGPM Server Connection and e-mail notification, delegate access to GPOs in the production environment, and configure logging and tracing for troubleshooting. - -- [Managing the Archive](managing-the-archive-agpm40.md): Delegate access to GPOs in the archive, limit the number of versions of each GPO stored, import a GPO from another domain, and back up and restore the archive. - -- [Managing the AGPM Service](managing-the-agpm-service-agpm40.md): Stop and start the AGPM Service or change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens. - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md): Move the AGPM Service, the archive, or both to a different server. - -**Note**   -Because the AGPM Administrator role includes the permissions for all other roles, an AGPM Administrator can perform the tasks usually associated with any other role. - -[Performing Approver Tasks](performing-approver-tasks-agpm40.md), such as creating, deploying, or deleting GPOs - -[Performing Editor Tasks](performing-editor-tasks-agpm40.md), such as editing, renaming, labeling, or importing GPOs, creating templates, or setting a default template - -[Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md), such as reviewing settings and comparing GPOs - - - -### Additional considerations - -By default, the AGPM Administrator role has Full Control—all AGPM permissions: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -- Export GPO - -- Import GPO - -- Create Template - -- Modify Options - -- Modify Security - -The **Modify Options** and **Modify Security** permissions are unique to the role of AGPM Administrator. - - - - - - - - - diff --git a/mdop/agpm/performing-agpm-administrator-tasks.md b/mdop/agpm/performing-agpm-administrator-tasks.md deleted file mode 100644 index ebc6992639..0000000000 --- a/mdop/agpm/performing-agpm-administrator-tasks.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Performing AGPM Administrator Tasks -description: Performing AGPM Administrator Tasks -author: mjcaparas -ms.assetid: 32e694a7-be64-4943-bce2-2a3a15e5341f -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing AGPM Administrator Tasks - - -An AGPM Administrator (Full Control) configures domain-wide options and delegates permissions to Approvers, Editors, Reviewers, and other AGPM Administrators. By default, an AGPM Administrator is an individual with Full Control (all Advanced Group Policy Management \[AGPM\] permissions) and therefore can also perform tasks associated with any role. - -In an environment in which multiple people develop Group Policy objects (GPOs), you can choose whether all Advanced Group Policy Management (AGPM) users perform the same tasks and have the same level of access or whether AGPM Administrators delegate permissions to Editors who make changes to GPOs and to Approvers who deploy GPOs to the production environment. AGPM Administrators can configure permissions to meet the needs of your organization. - -- [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md) - -- [Configure E-Mail Notification](configure-e-mail-notification.md) - -- [Delegate Domain-Level Access](delegate-domain-level-access.md) - -- [Delegate Access to an Individual GPO](delegate-access-to-an-individual-gpo.md) - -- [Configure Logging and Tracing](configure-logging-and-tracing.md) - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md) - - - [Modify the Archive Path](modify-the-archive-path.md) - - - [Modify the AGPM Service Account](modify-the-agpm-service-account.md) - - - [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md) - -Also, because the AGPM Administrator role includes the permissions for all other roles, an AGPM Administrator can perform the tasks normally associated with any other role. - -- [Performing Approver Tasks](performing-approver-tasks.md), such as creating, deploying, or deleting GPOs - -- [Performing Editor Tasks](performing-editor-tasks.md), such as editing, renaming, labeling, or importing GPOs, creating templates, or setting a default template - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md), such as reviewing settings and comparing GPOs - -### Additional considerations - -By default, the AGPM Administrator role has Full Control—all AGPM permissions: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -- Modify Options - -- Modify Security - -- Create Template - -The **Modify Options** and **Modify Security** permissions are unique to the role of AGPM Administrator. - -  - -  - - - - - diff --git a/mdop/agpm/performing-approver-tasks-agpm30ops.md b/mdop/agpm/performing-approver-tasks-agpm30ops.md deleted file mode 100644 index 457707ad10..0000000000 --- a/mdop/agpm/performing-approver-tasks-agpm30ops.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Approver Tasks -description: Performing Approver Tasks -author: mjcaparas -ms.assetid: 9f711824-191b-4b4b-a1c6-a3b2116006a4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Approver Tasks - - -An Approver is a person authorized by an AGPM Administrator (Full Control) to create, deploy, and delete Group Policy Objects (GPOs) and to approve or reject requests (typically from Editors) to create, deploy, or delete GPOs. - -**Important**   -Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - - - -- [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md) - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -- [Check In a GPO](check-in-a-gpo-agpm30ops.md) - -- [Deploy a GPO](deploy-a-gpo-agpm30ops.md) - -- [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md) - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - -**Note**   -Before approving a GPO, an Approver should review the policy settings that it contains. The Approver role includes the permissions for the Reviewer role, so that an Approver can review policy settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Approver role: - -- List Contents - -- Read Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -Also, an Approver has full control over GPOs that he created or controlled. - - - - - - - - - diff --git a/mdop/agpm/performing-approver-tasks-agpm40.md b/mdop/agpm/performing-approver-tasks-agpm40.md deleted file mode 100644 index 8a19c9ecda..0000000000 --- a/mdop/agpm/performing-approver-tasks-agpm40.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Approver Tasks -description: Performing Approver Tasks -author: mjcaparas -ms.assetid: e0a4b7fe-ce69-4755-9104-c7f523ea6b62 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Approver Tasks - - -An Approver is a person authorized by an AGPM Administrator (Full Control) to create, deploy, and delete Group Policy Objects (GPOs) and to approve or reject requests (typically from Editors) to create, deploy, or delete GPOs. - -**Important**   -Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - - - -- [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md) - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -- [Check In a GPO](check-in-a-gpo-agpm40.md) - -- [Deploy a GPO](deploy-a-gpo-agpm40.md) - -- [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md) - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - -**Note**   -Before approving a GPO, an Approver should review the policy settings that it contains. The Approver role includes the permissions for the Reviewer role, so that an Approver can review policy settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Approver role: - -- List Contents - -- Read Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -Also, an Approver has full control over GPOs that he created or controlled. - - - - - - - - - diff --git a/mdop/agpm/performing-approver-tasks.md b/mdop/agpm/performing-approver-tasks.md deleted file mode 100644 index ce05f48885..0000000000 --- a/mdop/agpm/performing-approver-tasks.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Approver Tasks -description: Performing Approver Tasks -author: mjcaparas -ms.assetid: 6f6310b3-19c1-47c9-8615-964ddd10ce14 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Approver Tasks - - -An Approver is a person authorized by an AGPM Administrator (Full Control) to create, deploy, and delete Group Policy objects (GPOs) and to approve or reject requests (typically from Editors) to create, deploy, or delete GPOs. - -**Important**   -Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - - - -- [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md) - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -- [Check In a GPO](check-in-a-gpo-approver.md) - -- [Deploy a GPO](deploy-a-gpo.md) - -- [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo.md) - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - -**Note**   -Because the Approver role includes the permissions for the Reviewer role, an Approver can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Approver role: - -- List Contents - -- Read Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -Also, an Approver has full control over GPOs that he created or controlled. - - - - - - - - - diff --git a/mdop/agpm/performing-editor-tasks-agpm30ops.md b/mdop/agpm/performing-editor-tasks-agpm30ops.md deleted file mode 100644 index abc69827c2..0000000000 --- a/mdop/agpm/performing-editor-tasks-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Performing Editor Tasks -description: Performing Editor Tasks -author: mjcaparas -ms.assetid: d4ac3277-2557-41cf-ac90-5adb6c30687c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Editor Tasks - - -An Editor is a person authorized by an AGPM Administrator (Full Control) to make changes to Group Policy Objects (GPOs) and create GPO templates. Additionally, an Editor can initiate the process of creating, deleting, or restoring a GPO, but by default must request approval from an Approver. - -**Important**   -Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - - - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm30ops.md) - -**Note**   -Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Editor role: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create Template - - - - - - - - - diff --git a/mdop/agpm/performing-editor-tasks-agpm40.md b/mdop/agpm/performing-editor-tasks-agpm40.md deleted file mode 100644 index b776479dfc..0000000000 --- a/mdop/agpm/performing-editor-tasks-agpm40.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Editor Tasks -description: Performing Editor Tasks -author: mjcaparas -ms.assetid: 81976a01-2a95-4256-b703-9fb3c884ef34 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Editor Tasks - - -In Advanced Group Policy Management (AGPM), an Editor is a person authorized by an AGPM Administrator (Full Control) to change Group Policy Objects (GPOs) and create GPO templates. Additionally, an Editor can request that a GPO be created, deleted, or restored. An Approver must approve the request for it to be implemented. An Editor can export a GPO to a file so that it can be copied to a domain in another forest, and import a GPO that was copied from another domain. - -**Important**   -Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - - - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -- [Using a Test Environment](using-a-test-environment.md) - -- [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md) - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) - -**Note**   -Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Editor role: - -- List Contents - -- Read Settings - -- Edit Settings - -- Export GPO - -- Import GPO - -- Create Template - - - - - - - - - diff --git a/mdop/agpm/performing-editor-tasks.md b/mdop/agpm/performing-editor-tasks.md deleted file mode 100644 index eeea2a652c..0000000000 --- a/mdop/agpm/performing-editor-tasks.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Performing Editor Tasks -description: Performing Editor Tasks -author: mjcaparas -ms.assetid: b1e62615-2e02-460e-81d1-4a3fbe59f62d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Editor Tasks - - -An Editor is a person authorized by an AGPM Administrator (Full Control) to make changes to Group Policy objects (GPOs) and create GPO templates. Additionally, an Editor can initiate the process of creating or deleting a GPO, but by default must request approval from an Approver. - -**Important**   -Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - - - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -- [Editing a GPO](editing-a-gpo.md) - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) - -- [Delete a GPO](delete-a-gpo-editor.md) - -**Note**   -Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Editor role: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create Template - - - - - - - - - diff --git a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md b/mdop/agpm/performing-reviewer-tasks-agpm30ops.md deleted file mode 100644 index 94d4b73d01..0000000000 --- a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Performing Reviewer Tasks -description: Performing Reviewer Tasks -author: mjcaparas -ms.assetid: 1faf396d-be0d-49ac-b063-0722fda2e43d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Reviewer Tasks - - -A Reviewer is a person authorized by an AGPM Administrator (Full Control) to review or audit Group Policy Objects (GPOs). An individual with only the Reviewer role cannot modify GPOs; however, all other roles include the Reviewer role. - -- [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md) - -- [Review GPO Settings](review-gpo-settings-agpm30ops.md) - -- [Review GPO Links](review-gpo-links-agpm30ops.md) - -- [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md) - -### Additional considerations - -By default, the following permissions are provided for the Reviewer role: - -- List Contents - -- Read Settings - -  - -  - - - - - diff --git a/mdop/agpm/performing-reviewer-tasks-agpm40.md b/mdop/agpm/performing-reviewer-tasks-agpm40.md deleted file mode 100644 index 5bf87e09a7..0000000000 --- a/mdop/agpm/performing-reviewer-tasks-agpm40.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Performing Reviewer Tasks -description: Performing Reviewer Tasks -author: mjcaparas -ms.assetid: b5f0805c-da55-45a5-a94c-2473af92b54a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Reviewer Tasks - - -A Reviewer is a person authorized by an AGPM Administrator (Full Control) to review or audit Group Policy Objects (GPOs). An individual with only the Reviewer role cannot modify GPOs; however, all other roles include the Reviewer role. - -- [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md) - -- [Review GPO Settings](review-gpo-settings-agpm40.md) - -- [Review GPO Links](review-gpo-links-agpm40.md) - -- [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md) - -### Additional considerations - -By default, the following permissions are provided for the Reviewer role: - -- List Contents - -- Read Settings - -  - -  - - - - - diff --git a/mdop/agpm/performing-reviewer-tasks.md b/mdop/agpm/performing-reviewer-tasks.md deleted file mode 100644 index aa542e0ac9..0000000000 --- a/mdop/agpm/performing-reviewer-tasks.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Performing Reviewer Tasks -description: Performing Reviewer Tasks -author: mjcaparas -ms.assetid: 4bdd43fa-5c73-4900-8947-b45906f47f60 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Reviewer Tasks - - -A Reviewer is a person authorized by an AGPM Administrator (Full Control) to review or audit Group Policy objects (GPOs). An individual with only the Reviewer role cannot modify GPOs; however, all other roles include the Reviewer role. - -- [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md) - -- [Review GPO Settings](review-gpo-settings.md) - -- [Review GPO Links](review-gpo-links.md) - -- [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates.md) - -### Additional considerations - -By default, the following permissions are provided for the Reviewer role: - -- List Contents - -- Read Settings - -  - -  - - - - - diff --git a/mdop/agpm/production-delegation-tab-agpm30ops.md b/mdop/agpm/production-delegation-tab-agpm30ops.md deleted file mode 100644 index efa8ccb039..0000000000 --- a/mdop/agpm/production-delegation-tab-agpm30ops.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Production Delegation Tab -description: Production Delegation Tab -author: mjcaparas -ms.assetid: 9851637d-d5c1-4d29-8582-e8779500a14e -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Production Delegation Tab - - -The **Production Delegation** tab on the **Change Control** pane provides a list of users and groups who have domain-level access to controlled Group Policy Objects (GPOs) in the production environment and indicates the allowed permissions of each user or group. - -This tab allows an AGPM Administrator (Full Control) to modify the default delegation of access to GPOs in the production environment, adding or removing users and groups, and modifying the allowed permissions for each user and group. - - ---- - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor.

          Remove

          Remove the selected users or groups from the Access Control List.

          Properties

          Display the properties for the selected user or group. The properties page is the same one displayed for an object in Active Directory User and Computers.

          - -  - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/production-delegation-tab-agpm40.md b/mdop/agpm/production-delegation-tab-agpm40.md deleted file mode 100644 index 29e323127c..0000000000 --- a/mdop/agpm/production-delegation-tab-agpm40.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Production Delegation Tab -description: Production Delegation Tab -author: mjcaparas -ms.assetid: 046bb9bc-769a-4306-bc49-c159a9533552 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Production Delegation Tab - - -The **Production Delegation** tab on the **Change Control** pane provides a list of users and groups who have domain-level access to controlled Group Policy Objects (GPOs) in the production environment and indicates the allowed permissions of each user or group. - -This tab allows an AGPM Administrator (Full Control) to modify the default delegation of access to GPOs in the production environment of the domain, adding or removing users and groups, and modifying the allowed permissions for each user and group. - - ---- - - - - - - - - - - - - - - - - - - - - -
          ButtonEffect

          Add

          Add a new entry to the security descriptor.

          Remove

          Remove the selected users or groups from the Access Control List.

          Properties

          Display the properties for the selected user or group. The properties page is the same one displayed for an object in Active Directory User and Computers.

          - -  - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/recycle-bin-commands-agpm30ops.md b/mdop/agpm/recycle-bin-commands-agpm30ops.md deleted file mode 100644 index baf41c217c..0000000000 --- a/mdop/agpm/recycle-bin-commands-agpm30ops.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Recycle Bin Commands -description: Recycle Bin Commands -author: mjcaparas -ms.assetid: ffe8f020-7aa9-40ad-8019-cc99901a7840 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recycle Bin Commands - - -The **Recycle Bin** tab: - -- Displays a list of Group Policy Objects (GPOs) that have been deleted from the archive. - -- Provides a shortcut menu with commands for managing GPOs and for displaying reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable: - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Destroy

          Remove the selected GPO from the Recycle Bin, so it can no longer be restored.

          Restore

          Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for Advanced Group Policy Management (AGPM).

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/recycle-bin-commands-agpm40.md b/mdop/agpm/recycle-bin-commands-agpm40.md deleted file mode 100644 index ddd12cfd22..0000000000 --- a/mdop/agpm/recycle-bin-commands-agpm40.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Recycle Bin Commands -description: Recycle Bin Commands -author: mjcaparas -ms.assetid: 347a101f-0ba0-4afc-bd59-752cc06bb904 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recycle Bin Commands - - -The **Recycle Bin** tab: - -- Displays a list of Group Policy Objects (GPOs) that have been deleted from the archive. - -- Provides a shortcut menu with commands for managing GPOs and for displaying reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable: - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Destroy

          Remove the selected GPO from the Recycle Bin, so it can no longer be restored.

          Restore

          Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for Advanced Group Policy Management (AGPM).

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/recycle-bin-tab.md b/mdop/agpm/recycle-bin-tab.md deleted file mode 100644 index 95d40a6e1d..0000000000 --- a/mdop/agpm/recycle-bin-tab.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Recycle Bin Tab -description: Recycle Bin Tab -author: mjcaparas -ms.assetid: 9ce62e98-c03e-4a75-90e0-51be83c6d2db -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recycle Bin Tab - - -The **Recycle Bin** tab: - -- Displays a list of Group Policy objects (GPOs) that have been deleted from the archive. - -- Provides a shortcut menu with commands for managing GPOs and for displaying reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable: - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Destroy

          Remove the selected GPO from the Recycle Bin, so it can no longer be restored.

          Restore

          Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md deleted file mode 100644 index f72ca9d61d..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 -author: mjcaparas -ms.assetid: 91835bf8-e53c-4202-986e-8d37050d1267 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft Advanced Group Policy Management (AGPM) 4.0 SP1. These release notes contain information that is required to successfully install AGPM 4.0 SP1 and contain information that is not available in the product documentation. If there is a difference between these release notes and other AGPM documentation, the latest change should be considered authoritative. These release notes supersede the content included with this product. - -## AGPM 4.0 SP1 known issues - - -This section contains release notes for AGPM 4.0 SP1. - -### Control Panel’s “Uninstall” tool may not work when you try to change AGPM Server settings - -The tool in Control Panel that lets you uninstall or change a program may not work when you try to change AGPM server settings. - -WORKAROUND: Before you try to change AGPM server settings by using Control Panel, make a copy of the AGPM Archive folder. You can then use Setup.exe to reinstall the AGPM server and choose the configuration parameters that you want. - -### Reports do not display the links that were added to a Group Policy Object - -The AGPM settings and difference reports do not display the links that were added to a Group Policy Object (GPO). - -WORKAROUND: To view the links in the reports, select the GPO in the Group Policy Management Console (GPMC), and click the **Settings** tab in the right pane. - -### Reports do not display all “Choice Options Properties” settings - -The AGPM settings and difference reports do not display all of the settings that were selected on the Choice Options Properties window in the Group Policy Object Editor. - -WORKAROUND: Use the GPMC to view the selected Choice Options Properties settings in the reports. - -### Reports do not display the Show and Hide tabs in certain browsers - -The Show and Hide tabs, shown on the right side of the AGPM settings and difference reports, are not displayed when you view the reports in Google Chrome or Mozilla Firefox. - -WORKAROUND: View the reports by using Internet Explorer. - -### AGPM settings and difference reports may show different content from GPMC reports - -The AGPM settings and difference reports may not show the same content as reports in the Group Policy Management Console (GPMC). - -WORKAROUND: Use the GPMC to view the AGPM reports. - -### AGPM Service does not start if the domain controller is not online - -When the AGPM Service is installed on a domain controller on Windows 8, the Service does not start if the domain controller is not online. - -WORKAROUND: Manually start the AGPM Service after the domain controller is online. - -### Upgrade of AGPM Server to AGPM 4.0 SP1 is blocked when you upgrade from the AGPM 4.0 release plus the hotfix - -If you try to upgrade the AGPM server to AGPM 4.0. SP1 after installing AGPM 4.0 and then installing the AGPM hotfix (see Knowledge Base article [2643502](https://go.microsoft.com/fwlink/?LinkId=254474)), the upgrade fails and cannot be completed. - -WORKAROUND: Uninstall the AGPM 4.0 Server and then install AGPM 4.0 SP1. - -### Reports do not display organizational unit links - -If you link an uncontrolled GPO to an organizational unit and then control that GPO using AGPM, the AGPM settings and difference reports do not display the organizational unit links. - -WORKAROUND: From the **Controlled** tab of the **Change Settings** node, right-click the GPO and click **Settings** and then click **GPO Links** to view the organizational links. Alternatively, you can use the GPMC to view the links to a GPO from the **Scope** tab. - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md deleted file mode 100644 index e5a7a19136..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 -author: mjcaparas -ms.assetid: 0593cd11-3308-4942-bf19-8a7bb9447f01 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 2 (SP2). These release notes contain information that is required to successfully install AGPM 4.0 SP2 and contain information that is not available in the product documentation. If there is a difference between these release notes and other AGPM documentation, consider the latest change authoritative. These release notes supersede the content included with this product. - -## AGPM 4.0 SP2 known issues - - -This section describes the known issues for AGPM 4.0 SP2. - -### Control Panel’s “Uninstall” tool may not work when you try to change AGPM Server settings - -The tool in Control Panel that you use to uninstall or change a program may not work when you try to change AGPM Server settings. - -**Workaround:** Before you try to change AGPM Server settings by using Control Panel, make a copy of the AGPM Archive folder. You can then use Setup.exe to reinstall the AGPM Server and choose the configuration parameters that you want. - -### Reports do not display the links that were added to a Group Policy Object - -The AGPM settings and difference reports do not display the links that were added to a Group Policy Object (GPO). - -**Workaround:** To view the links in the reports, select the GPO in the Group Policy Management Console (GPMC), and then click the **Settings** tab in the right pane. - -### Reports do not display all Choice Options Properties settings - -The AGPM settings and difference reports do not display all of the settings that were selected in the **Choice Options Properties** window in the Group Policy Object Editor. - -**Workaround:** Use the GPMC to view the selected **Choice Options Properties** settings in the reports. - -### Reports may not display the Show and Hide tabs in certain browsers - -The **Show** and **Hide** tabs, on the right side of the AGPM settings and difference reports, may not appear when you view the reports in Google Chrome or Mozilla Firefox. - -**Workaround:** View the reports by using the Internet Explorer browser. - -### AGPM settings and difference reports may show different content from GPMC reports - -The AGPM settings and difference reports may not show the same content as reports in the GPMC. - -**Workaround:** Use the GPMC to view the AGPM reports. - -### AGPM Service does not start if the domain controller is offline - -When the AGPM Service is installed on a domain controller on the Windows® 8 operating systems or later operating systems, the service does not start if the domain controller is offline. - -**Workaround:** Manually start the AGPM Service after the domain controller is online. - -### Upgrade of AGPM Server to AGPM 4.0 SP2 is blocked when you upgrade from the AGPM 4.0 release plus hotfix 1 - -If you try to upgrade the AGPM server to AGPM 4.0. SP2 after installing AGPM 4.0 Server and then installing the AGPM hotfix named AGPM 4.0 reports incorrect differences in the HTML report (see Knowledge Base article [2643502](https://go.microsoft.com/fwlink/?LinkId=254474)), the upgrade fails and cannot be completed. - -**Workaround:** Uninstall the AGPM 4.0 Server and then install AGPM 4.0 SP2. - -### Reports do not display organizational unit links - -If you link an uncontrolled GPO to an organizational unit and then control that GPO by using AGPM, the AGPM settings and difference reports do not display the organizational unit links. - -**Workaround:** On the **Controlled** tab of the **Change Settings** node, right-click the GPO, click **Settings**, and then click **GPO Links** to view the organizational links. Alternatively, you can use the GPMC to view the links to a GPO from the **Scope** tab. - -### AGPM displays an error if you click the Back button from the Change, Repair, or Remove AGPM Client dialog box - -If you browse to **Programs and Features** in Control Panel and then select **Microsoft Advanced Group Policy Management – Client**, AGPM displays an error if you click **Modify** and then click the **Back** button in the **Change, Repair, or Remove AGPM Client** dialog box. - -**Workaround:** Click **Cancel** to clear the error, and then start the process again. Do not click the **Back** button after you click **Modify** . - -### Comment fails to appear in the History window when the Approver deploys a GPO and enters a comment - -If a user who has the Editor role submits a request to deploy a GPO, and the user who has the Approver role then deploys the GPO and enters a comment, the comment fails to appear in the **History** window. - -**Workaround:** None. - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md deleted file mode 100644 index 2c9d766a6d..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md +++ /dev/null @@ -1,113 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 -author: mjcaparas -ms.assetid: 955d7674-a8d9-4fc5-b18a-5a1639e38014 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/27/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 3 (SP3). These release notes contain information that is required to successfully install AGPM 4.0 SP3 and contain information that is not available in the product documentation. If there is a difference between these release notes and other AGPM documentation, consider the latest change authoritative. These release notes supersede the content included with this product. - -## AGPM 4.0 SP3 known issues - - -This section describes the known issues for AGPM 4.0 SP3. - -### AGPM installation fails in Windows 10 - -AGPM internally enables the Windows Communication Foundation (WCF)-NonHTTP-Activation feature during installation. In Windows 10, WCF now includes a requirement to restart Windows after enabling the WCF NonHTTP-Activation feature. However, the current AGPM installer code does not handle this restart requirement and stops responding while it waits for the service to be activated. - -**Workaround:** Before you run the AGPM installer, enable the WCF Non-HTTP Activation feature and then restart Windows. - -### Control Panel’s “Uninstall” tool may not work when you try to change AGPM Server settings - -The tool in Control Panel that you use to uninstall or change a program may not work when you try to change AGPM Server settings. - -**Workaround:** Before you try to change AGPM Server settings by using Control Panel, make a copy of the AGPM Archive folder. You can then use Setup.exe to reinstall the AGPM Server and choose the configuration parameters that you want. - -### Reports do not display the links that were added to a Group Policy Object - -The AGPM settings and difference reports do not display the links that were added to a Group Policy Object (GPO). - -**Workaround:** To view the links in the reports, select the GPO in the Group Policy Management Console (GPMC), and then click the **Settings** tab in the right pane. - -### Reports do not display all Choice Options Properties settings - -The AGPM settings and difference reports do not display all of the settings that were selected in the **Choice Options Properties** window in the Group Policy Object Editor. - -**Workaround:** Use the GPMC to view the selected **Choice Options Properties** settings in the reports. - -### Reports may not display the Show and Hide tabs in certain browsers - -The **Show** and **Hide** tabs, on the right side of the AGPM settings and difference reports, may not appear when you view the reports in Google Chrome or Mozilla Firefox. - -**Workaround:** View the reports by using the Internet Explorer browser. - -### AGPM settings and difference reports may show different content from GPMC reports - -The AGPM settings and difference reports may not show the same content as reports in the GPMC. - -**Workaround:** Use the GPMC to view the AGPM reports. - -### AGPM Service does not start if the domain controller is offline - -When the AGPM Service is installed on a domain controller on the Windows® 8 operating systems or later operating systems, the service does not start if the domain controller is offline. - -**Workaround:** Manually start the AGPM Service after the domain controller is online. - -### Upgrade of AGPM Server to AGPM 4.0 SP2 is blocked when you upgrade from the AGPM 4.0 release plus hotfix 1 - -If you try to upgrade the AGPM server to AGPM 4.0. SP2 after installing AGPM 4.0 Server and then installing the AGPM hotfix named AGPM 4.0 reports incorrect differences in the HTML report (see Knowledge Base article [2643502](https://go.microsoft.com/fwlink/?LinkId=254474)), the upgrade fails and cannot be completed. - -**Workaround:** Uninstall the AGPM 4.0 Server and then install AGPM 4.0 SP2. - -### Reports do not display organizational unit links - -If you link an uncontrolled GPO to an organizational unit and then control that GPO by using AGPM, the AGPM settings and difference reports do not display the organizational unit links. - -**Workaround:** On the **Controlled** tab of the **Change Settings** node, right-click the GPO, click **Settings**, and then click **GPO Links** to view the organizational links. Alternatively, you can use the GPMC to view the links to a GPO from the **Scope** tab. - -### AGPM displays an error if you click the Back button from the Change, Repair, or Remove AGPM Client dialog box - -If you browse to **Programs and Features** in Control Panel and then select **Microsoft Advanced Group Policy Management – Client**, AGPM displays an error if you click **Modify** and then click the **Back** button in the **Change, Repair, or Remove AGPM Client** dialog box. - -**Workaround:** Click **Cancel** to clear the error, and then start the process again. Do not click the **Back** button after you click **Modify** . - -### Comment fails to appear in the History window when the Approver deploys a GPO and enters a comment - -If a user who has the Editor role submits a request to deploy a GPO, and the user who has the Approver role then deploys the GPO and enters a comment, the comment fails to appear in the **History** window. - -**Workaround:** None. - -### Added mechanism to override AGPM default behavior of removing GPO permission changes - -As of HF02, AGPM has added a registry key to enable overriding the default AGPM GPO permission behavior. For more information, please see [Changes to Group Policy object permissions through AGPM are ignored](https://support.microsoft.com/kb/3174540) - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md deleted file mode 100644 index caa920e145..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 -author: mjcaparas -ms.assetid: 44c19e61-c8e8-48aa-a2c2-20396d14d5bb -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 - - -October 2009 - -## About Microsoft Advanced Group Policy Management 4.0 - - -Microsoft Advanced Group Policy Management (AGPM) 4.0 extends the capabilities of the Group Policy Management Console (GPMC). AGPM provides comprehensive change control and improved management of Group Policy Objects (GPOs). - -The following documents can help you get started with AGPM 4.0. - -- For an overview of the capabilities of AGPM, see [Overview of Microsoft Advanced Group Policy Management](https://go.microsoft.com/fwlink/?LinkID=162671) (https://go.microsoft.com/fwlink/?LinkID=162671). - -- For information about how AGPM 4.0 differs from AGPM 3.0, see [What's New in AGPM 4.0](https://go.microsoft.com/fwlink/?LinkId=160058) (https://go.microsoft.com/fwlink/?LinkId=160058). - -- For guidance about how to determine whether AGPM 4.0, AGPM 3.0, or AGPM 2.5 is appropriate for your environment, see [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=145981) (https://go.microsoft.com/fwlink/?LinkId=145981). - -- For basic guidance about how to install AGPM and a sample scenario for using AGPM, see [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkID=153505) (https://go.microsoft.com/fwlink/?LinkID=153505). This guide is primarily designed to help evaluators and first-time users. - -- For information about how to upgrade from an earlier version of AGPM or detailed guidance about how to plan the deployment of AGPM in your organization, see the [Planning Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkID=156883) (https://go.microsoft.com/fwlink/?LinkID=156883). - -- For information about how to use AGPM to perform specific tasks, see the Advanced Group Policy Management 4.0 Help, which is also available on TechNet as the [Operations Guide for AGPM 4.0](https://go.microsoft.com/fwlink/?LinkId=159872) (https://go.microsoft.com/fwlink/?LinkId=159872). - -## More information - - -For more information about AGPM, see the following: - -- [Advanced Group Policy Management TechNet Library](https://go.microsoft.com/fwlink/?LinkID=146846) (https://go.microsoft.com/fwlink/?LinkID=146846) - -- [Microsoft Desktop Optimization Pack TechCenter](https://go.microsoft.com/fwlink/?LinkId=159870) (http://www.microsoft.com/technet/mdop) - -- [Group Policy TechCenter](https://go.microsoft.com/fwlink/?LinkId=145531) (http://www.microsoft.com/gp) - -## Providing feedback - - -You can post feedback or questions about AGPM to the [Group Policy Forum](https://go.microsoft.com/fwlink/?LinkId=145532) (https://go.microsoft.com/fwlink/?LinkId=145532). - -## Known issues with AGPM 4.0 - - -### Import from Production command does not import settings into a GPO that is checked out - -If you edit a GPO in the production environment, you must import the GPO from production to update the GPO in the offline archive. The **Import from Production** command is intended to let you perform a final production backup before you finish editing so that you can roll back to the production backup if it is necessary. - -If the GPO is checked out when you run the **Import from Production** command, then the production changes are not incorporated into the checked out version of the GPO. However, the imported version of the GPO is added to the history of the GPO even though that version is not available to be edited. When the GPO is checked in, that version will supersede the imported version in the archive, but both are available in the history of the GPO. - -**Workaround:** Make sure that the GPO is checked in before you import it from production. If the GPO was not checked in before you imported it, you can use the **Undo Check Out** command to discard your changes and roll back to the version of the GPO that you imported from production. - -### Checked out GPOs cannot be edited for several minutes in an environment that uses a multiple site Active Directory topology - -AGPM uses a client/server model. The AGPM Server and the AGPM Client each determine their own closest domain controller for Group Policy operations. When you check out a GPO by using an AGPM Client, it is actually the AGPM Server that checks the GPO out from the offline archive to a temporary folder in the SYSVOL folder. - -If the AGPM Server and the AGPM Client are in different sites, then the temporary checked out GPO may not be present on the local site's domain controller for several minutes or up to 30 minutes due to SYSVOL replication latency. In this situation, you cannot edit the checked out GPO using the GPMC on an AGPM Client until SYSVOL replication of the checked out GPO has occurred. - -**Workaround:** As a best practice, you should position AGPM Clients in the same site as the AGPM Server to which they connect so that you do not have to wait for SYSVOL replication to occur before you can edit a checked out GPO. - -### AGPM cannot read the backup limit if your account does not have permissions for the archive - -On an AGPM Client, if you log on by using an account that has not been delegated permissions to the AGPM archive, start the Group Policy Management Console (GPMC), and then click **Change Control**, you receive the following error. - -``` syntax -Failed to read backup purge limit for this domain. - -The following error occurred: -You do not have sufficient permissions to perform this operation. -Microsoft.Agpm.AccessDeniedException (80070005) -``` - -**Workaround:** Contact an AGPM Administrator (Full Control) and request that they delegate access to AGPM for your account. If you are an AGPM Administrator, log on by using an account to which the AGPM Administrator role is assigned so that you can delegate access for the additional account. For more information, see "Delegate Domain-Level Access to the Archive" in the AGPM Help. - -## Release notes copyright information - - -Information in this document, including URL and other Internet Web site references, is subject to change without notice, and is provided for informational purposes only. The entire risk of the use or results of the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, MS-DOS, Windows, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. - -The names of actual companies and products mentioned herein may be the trademarks of their respective owners. - -  - -  - - - - - diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md b/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md deleted file mode 100644 index 3aa827f71f..0000000000 --- a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Rename a GPO or Template -description: Rename a GPO or Template -author: mjcaparas -ms.assetid: 19d17ddf-8b58-4677-929e-9550fa388b93 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Rename a GPO or Template - - -You can rename a controlled Group Policy Object (GPO) or a template. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To rename a GPO or template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** or **Templates** tab to display the item to rename. - -3. Right-click the GPO or template to rename and click **Rename**. - -4. Type the new name for the GPO or template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO or template appears under the new name on the **Contents** tab. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- When you rename a GPO that has been deployed, the name is immediately changed in the archive. The name is changed in the production environment only when the GPO is redeployed. Until the GPO is redeployed (or the production copy is deleted), the old name is still in use in the production environment and therefore cannot be used for another GPO. Likewise, the GPO in the archive cannot be renamed back to its original name until the GPO has been deployed (changing the name of the production copy) or the production copy has been deleted. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm40.md b/mdop/agpm/rename-a-gpo-or-template-agpm40.md deleted file mode 100644 index 7befd4f578..0000000000 --- a/mdop/agpm/rename-a-gpo-or-template-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Rename a GPO or Template -description: Rename a GPO or Template -author: mjcaparas -ms.assetid: 84293f7a-4ff7-497e-bdbc-cabb70189a03 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Rename a GPO or Template - - -You can rename a controlled Group Policy Object (GPO) or a template. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To rename a GPO or template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** or **Templates** tab to display the item to rename. - -3. Right-click the GPO or template to rename and click **Rename**. - -4. Type the new name for the GPO or template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO or template appears under the new name on the **Contents** tab. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- When you rename a GPO that has been deployed, the name is immediately changed in the archive. The name is changed in the production environment only when the GPO is redeployed. Until the GPO is redeployed (or the production copy is deleted), the old name is still in use in the production environment and therefore cannot be used for another GPO. Likewise, the GPO in the archive cannot be renamed back to its original name until the GPO has been deployed (changing the name of the production copy) or the production copy has been deleted. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/rename-a-gpo-or-template.md b/mdop/agpm/rename-a-gpo-or-template.md deleted file mode 100644 index 3a2a71a243..0000000000 --- a/mdop/agpm/rename-a-gpo-or-template.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Rename a GPO or Template -description: Rename a GPO or Template -author: mjcaparas -ms.assetid: 64a1aaf4-f672-48b5-94c6-473bf1076cf3 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Rename a GPO or Template - - -You can rename a controlled Group Policy object (GPO) or a template. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To rename a GPO or template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** or **Templates** tab to display the item to rename. - -3. Right-click the GPO or template to rename and click **Rename**. - -4. Type the new name for the GPO or template and a comment, then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO or template appears under the new name on the **Contents** tab. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- When you rename a GPO that has been deployed, the name is immediately changed in the archive. The name is changed in the production environment only when the GPO is redeployed. - - Until the GPO is redeployed (or the production copy is deleted), the old name is still in use in the production environment and therefore cannot be used for another GPO. Likewise, the GPO in the archive cannot be renamed back to its original name until the GPO has been deployed (changing the name of the production copy) or the production copy has been deleted. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md b/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md deleted file mode 100644 index e58c025f14..0000000000 --- a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Control of a Previously Uncontrolled GPO -description: Request Control of a Previously Uncontrolled GPO -author: mjcaparas -ms.assetid: 00e8725d-5d7f-4eed-a5e6-c3631632cfbd -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Control of a Previously Uncontrolled GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for an existing Group Policy object (GPO), the GPO must be controlled with AGPM. Unless you are an Approver or an AGPM Administrator (Full Control), you must request that the GPO be controlled. - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control a previously uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Unless you have special permission to control GPOs, you must submit a request for control. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Uncontrolled** tab. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md deleted file mode 100644 index 3d14dbd600..0000000000 --- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Control of an Uncontrolled GPO -description: Request Control of an Uncontrolled GPO -author: mjcaparas -ms.assetid: b668a67a-5a2c-4f6a-8b1c-efa3ca0794d4 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Control of an Uncontrolled GPO - - -To provide change control for an existing Group Policy Object (GPO), the GPO must be controlled. Unless you are an Approver or an AGPM Administrator (Full Control), you must request that the GPO be controlled. - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Unless you have special permission to control GPOs, you must submit a request for control. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Uncontrolled** tab. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md deleted file mode 100644 index 86d8e3030f..0000000000 --- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Control of an Uncontrolled GPO -description: Request Control of an Uncontrolled GPO -author: mjcaparas -ms.assetid: a34e0aeb-33a1-4c9f-b187-1d08493a785c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Control of an Uncontrolled GPO - - -To provide change control for an existing Group Policy Object (GPO), the GPO must be controlled. Unless you are an Approver or an AGPM Administrator (Full Control), you must request that the GPO be controlled. - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Unless you have special permission to control GPOs, you must submit a request for control. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Uncontrolled** tab. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md deleted file mode 100644 index 7f2ecf3393..0000000000 --- a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Request Deletion of a GPO -description: Request Deletion of a GPO -author: mjcaparas -ms.assetid: 576ece5c-dc6d-4b5e-8628-01c15ae2c9a8 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deletion of a GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the deletion of a Group Policy Object (GPO). - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deletion of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - -4. Unless you have special permission to delete GPOs, you must submit a request for deletion of the deployed GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Recycle Bin** tab, where it can be restored or destroyed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md b/mdop/agpm/request-deletion-of-a-gpo-agpm40.md deleted file mode 100644 index 844b1cad3c..0000000000 --- a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Request Deletion of a GPO -description: Request Deletion of a GPO -author: mjcaparas -ms.assetid: 2410f7a1-ccca-44cf-ab26-76ad474409e7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deletion of a GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the deletion of a Group Policy Object (GPO). - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deletion of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment of the domain, click **Delete GPO from archive and production**. - -4. Unless you have special permission to delete GPOs, you must submit a request for deletion of the deployed GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Recycle Bin** tab, where it can be restored or destroyed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md deleted file mode 100644 index a1fb49a16f..0000000000 --- a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Deployment of a GPO -description: Request Deployment of a GPO -author: mjcaparas -ms.assetid: f44ae0fb-bcf7-477b-b99e-9dd6a55ee597 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deployment of a GPO - - -After you have modified and checked in a Group Policy Object (GPO), deploy the GPO, so it will take effect in the production environment. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deployment of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed, and then click **Deploy**. - -4. Unless you are an Approver or AGPM Administrator or have special permission to deploy GPOs, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Controlled** tab and be deployed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md b/mdop/agpm/request-deployment-of-a-gpo-agpm40.md deleted file mode 100644 index 334d30d658..0000000000 --- a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Deployment of a GPO -description: Request Deployment of a GPO -author: mjcaparas -ms.assetid: 5783cfd0-bd93-46b4-8fa0-684bd39aa8fc -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deployment of a GPO - - -After you have modified and checked in a Group Policy Object (GPO), deploy the GPO, so it will take effect in the production environment. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deployment of a GPO to the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed, and then click **Deploy**. - -4. Unless you are an Approver or AGPM Administrator or have special permission to deploy GPOs, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Controlled** tab and be deployed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deployment-of-a-gpo.md b/mdop/agpm/request-deployment-of-a-gpo.md deleted file mode 100644 index fd81f52490..0000000000 --- a/mdop/agpm/request-deployment-of-a-gpo.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Deployment of a GPO -description: Request Deployment of a GPO -author: mjcaparas -ms.assetid: 9aa9af29-4754-4f72-b624-bb3e1087cbe1 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deployment of a GPO - - -After you have modified and checked in a Group Policy object (GPO), deploy the GPO, so it will take effect in the production environment. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deployment of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed, and then click **Deploy**. - -4. Unless you are an Approver or AGPM Administrator or have special permission to deploy GPOs, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Controlled** tab and be deployed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md deleted file mode 100644 index 5eea73eb07..0000000000 --- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Request Restoration of a Deleted GPO -description: Request Restoration of a Deleted GPO -author: mjcaparas -ms.assetid: dcc3baea-8af7-4886-a301-98b6ac5819cd -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Restoration of a Deleted GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the restoration of a deleted Group Policy Object (GPO) from the Recycle Bin to return it to the archive. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the restoration of a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO you want to restore, and then click **Restore**. - -4. Unless you have special permission to restore GPOs, you must submit a request for restoration of the deleted GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md). - - - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Recycle Bin** tab. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md deleted file mode 100644 index 9a569cc216..0000000000 --- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Request Restoration of a Deleted GPO -description: Request Restoration of a Deleted GPO -author: mjcaparas -ms.assetid: bac5ca3b-be47-49b5-bf1b-96280625fda8 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Restoration of a Deleted GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the restoration of a deleted Group Policy Object (GPO) from the Recycle Bin to return it to the archive. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the restoration of a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO you want to restore, and then click **Restore**. - -4. Unless you have special permission to restore GPOs, you must submit a request for restoration of the deleted GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md). - - - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Recycle Bin** tab. - -### Additional references - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md deleted file mode 100644 index 9c7adfcc7c..0000000000 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Request the Creation of a New Controlled GPO -description: Request the Creation of a New Controlled GPO -author: mjcaparas -ms.assetid: 4194c2f3-8116-4a35-be1a-81c84072daec -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request the Creation of a New Controlled GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the creation of a new Group Policy Object (GPO). - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. Unless you have special permission to create GPOs, you must submit a request for creation. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, enter your e-mail address in the **Cc** field. - - 2. Type a name for the new GPO. - - 3. Optional: Type a comment for the new GPO. - - 4. To deploy the new GPO to the production environment immediately upon approval, click **Create live**. To create the new GPO offline without immediately deploying it upon approval, click **Create offline**. - - 5. Select the GPO template to use as a starting point for the new GPO. - - 6. Click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, then click **Withdraw**. The GPO will be destroyed. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md deleted file mode 100644 index 155d54a519..0000000000 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Request the Creation of a New Controlled GPO -description: Request the Creation of a New Controlled GPO -author: mjcaparas -ms.assetid: cb265238-386f-4780-a59a-0c9a4a87d736 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request the Creation of a New Controlled GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the creation of a new Group Policy Object (GPO). - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. Unless you have special permission to create GPOs, you must submit a request for creation. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, enter your e-mail address in the **Cc** field. - - 2. Type a name for the new GPO. - - 3. Optional: Type a comment for the new GPO. - - 4. To deploy the new GPO to the production environment of the domain immediately upon approval, click **Create live**. To create the new GPO offline without immediately deploying it upon approval, click **Create offline**. - - 5. Select the GPO template to use as a starting point for the new GPO. - - 6. Click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, then click **Withdraw**. The GPO will be destroyed. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md deleted file mode 100644 index be1818d321..0000000000 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Request the Creation of a New Controlled GPO -description: Request the Creation of a New Controlled GPO -author: mjcaparas -ms.assetid: e1875d81-8553-42ee-8f3a-023d6ced86ca -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request the Creation of a New Controlled GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the creation of a new Group Policy object (GPO) if it is to be managed using Advanced Group Policy Management (AGPM). - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. Unless you have special permission to create GPOs, you must submit a request for creation. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, enter your e-mail address in the **Cc** field. - - 2. Type a name for the new GPO. - - 3. Optional: Type a comment for the new GPO. - - 4. To deploy the new GPO to the production environment immediately upon approval, click **Create live**. To create the new GPO offline without immediately deploying it upon approval, click **Create offline**. - - 5. Select the GPO template to use as a starting point for the new GPO. - - 6. Click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, then click **Withdraw**. The GPO will be destroyed. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/resources-for-agpm.md b/mdop/agpm/resources-for-agpm.md deleted file mode 100644 index 310dda78df..0000000000 --- a/mdop/agpm/resources-for-agpm.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Resources for AGPM -description: Resources for AGPM -author: mjcaparas -ms.assetid: b44b58c0-2810-40d6-9677-f2f64e1add75 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Resources for AGPM - - -### Documents for download - -- [Advanced Group Policy Management 4.0 documents](https://go.microsoft.com/fwlink/?LinkID=158931) - -### Microsoft Desktop Optimization Pack resources - -- [Microsoft Desktop Optimization Pack (MDOP) for Software Assurance TechCenter](https://go.microsoft.com/fwlink/?LinkID=159870) (http://www.microsoft.com/technet/mdop): Links to MDOP videos and resources. - -- [Enterprise products: MDOP](https://go.microsoft.com/fwlink/?LinkID=160297): Overviews and information about the benefits of applications in MDOP. - -### Group Policy resources - -- [Group Policy TechCenter](https://go.microsoft.com/fwlink/?LinkID=145531) (http://www.microsoft.com/grouppolicy): Links to Group Policy documentation, tools, and downloads. - -- [Group Policy Team Blog](https://go.microsoft.com/fwlink/?LinkID=75192) (http://blogs.technet.com/GroupPolicy): Stay current on the latest news about Group Policy with articles by the Group Policy Team and other experts. - -- [Group Policy Forum](https://go.microsoft.com/fwlink/?LinkID=145532): Do you have questions about Group Policy or AGPM? You can post your questions to the forum, and receive answers from the experts. - -  - -  - - - - - diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md b/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md deleted file mode 100644 index 5f46d1b370..0000000000 --- a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Restore a Deleted GPO -description: Restore a Deleted GPO -author: mjcaparas -ms.assetid: 853feb0a-d2d9-4be9-a07e-e113a56a9968 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore a Deleted GPO - - -Approvers can restore a deleted Group Policy Object (GPO) from the Recycle Bin, returning it to the archive. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To restore a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to restore, and then click **Restore**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md). - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Deploy GPO** or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm40.md b/mdop/agpm/restore-a-deleted-gpo-agpm40.md deleted file mode 100644 index d68d3dc138..0000000000 --- a/mdop/agpm/restore-a-deleted-gpo-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Restore a Deleted GPO -description: Restore a Deleted GPO -author: mjcaparas -ms.assetid: 0a131d26-a741-4a51-b612-c0bc7dbba06b -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore a Deleted GPO - - -Approvers can restore a deleted Group Policy Object (GPO) from the Recycle Bin, returning it to the archive. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To restore a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to restore, and then click **Restore**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm40.md). - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Deploy GPO** or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/restore-a-deleted-gpo.md b/mdop/agpm/restore-a-deleted-gpo.md deleted file mode 100644 index 27a79b4d0e..0000000000 --- a/mdop/agpm/restore-a-deleted-gpo.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Restore a Deleted GPO -description: Restore a Deleted GPO -author: mjcaparas -ms.assetid: e6953296-7b7d-4d1e-ad82-d4a23044cdd7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore a Deleted GPO - - -Advanced Group Policy Management (AGPM) enables Approvers to restore a deleted Group Policy object (GPO) from the Recycle Bin, returning it to the archive. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To restore a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to restore, and then click **Restore**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo.md). - - - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - - - - - - - - - diff --git a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md b/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md deleted file mode 100644 index 35d0247a88..0000000000 --- a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Restore the Archive from a Backup -description: Restore the Archive from a Backup -author: mjcaparas -ms.assetid: b83f6173-a236-4da2-b16e-8df20920d4cc -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore the Archive from a Backup - - -If a disaster occurs and the archive for Advanced Group Policy Management (AGPM) is damaged or destroyed, an AGPM Administrator (Full Control) can restore the archive from a backup copy prepared in advance and then import from the production environment of the domain any Group Policy Objects (GPOs) that are not in the archive or for which the version in production is more current than that in the archive. For information about how to restore an archive backup to a different server, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md). - -A user account that has access to the AGPM Server (the computer on which the AGPM Service is installed) and to the folder that contains the archive is required to complete this procedure. - -**To restore the archive from a backup** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -2. Remove the existing archive. By default, the archive folder is %ProgramData%\\Microsoft\\AGPM, however the AGPM Administrator who installed Microsoft Advanced Group Policy Management - Server may have entered a different location during setup. - -3. Re-create the archive folder by configuring the archive path, AGPM Service Account, Archive Owner, and listening port. Using the same values as used during the original installation is not necessary. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - -4. Copy the contents of the archive backup to the archive folder, copying the subfolders and files to make sure that each subfolder and file inherits the permissions of the archive folder. Be careful not to overwrite the archive folder. - -5. If you not sure about whether a GPO in the archive backup is more current than the copy of that GPO in production, generate a difference report and compare their settings. For more information, see [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md). - -6. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -### Additional references - -- [Back Up the Archive](back-up-the-archive-agpm40.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) - -- [Managing the Archive](managing-the-archive-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/restore-the-archive-from-a-backup.md b/mdop/agpm/restore-the-archive-from-a-backup.md deleted file mode 100644 index 597857d21f..0000000000 --- a/mdop/agpm/restore-the-archive-from-a-backup.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Restore the Archive from a Backup -description: Restore the Archive from a Backup -author: mjcaparas -ms.assetid: 49666337-d72c-4e44-99e4-9eb59b2355a9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore the Archive from a Backup - - -If a disaster occurs and the archive for Advanced Group Policy Management (AGPM) is damaged or destroyed, an AGPM Administrator (Full Control) can restore the archive from a backup copy prepared in advance and then import from the production environment any Group Policy Objects (GPOs) that are not in the archive or for which the version in production is more current than that in the archive. For information about how to restore an archive backup to a different server, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md). - -A user account that has access to the AGPM Server (the computer on which the AGPM Service is installed) and to the folder that contains the archive is required to complete this procedure. - -**To restore the archive from a backup** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -2. Remove the existing archive. By default, the archive folder is %ProgramData%\\Microsoft\\AGPM, however the AGPM Administrator who installed Microsoft Advanced Group Policy Management - Server may have entered a different location during setup. - -3. Re-create the archive folder by configuring the archive path, AGPM Service Account, Archive Owner, and listening port. Using the same values as used during the original installation is not necessary. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - -4. Copy the contents of the archive backup to the archive folder, copying the subfolders and files to make sure that each subfolder and file inherits the permissions of the archive folder. Be careful not to overwrite the archive folder. - -5. If you not sure about whether a GPO in the archive backup is more current than the copy of that GPO in production, generate a difference report and compare their settings. For more information, see [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md). - -6. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -### Additional references - -- [Back Up the Archive](back-up-the-archive.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) - -- [Managing the Archive](managing-the-archive.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-links-agpm30ops.md b/mdop/agpm/review-gpo-links-agpm30ops.md deleted file mode 100644 index f76ec518b9..0000000000 --- a/mdop/agpm/review-gpo-links-agpm30ops.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Review GPO Links -description: Review GPO Links -author: mjcaparas -ms.assetid: 5ae95afc-2b89-45cf-916c-efe2d43b2211 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Links - - -You can display a diagram showing where a Group Policy Object (GPO) or GPOs that you select are linked to organizational units. GPO link diagrams are updated each time the GPO is controlled, imported, or checked in. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Reviewing GPO links - - -- [For one or more GPOs](#bkmk-gpos) - -- [For one or more versions of a GPO](#bkmk-gpo-versions) - -### - -**To display GPO links for one or more GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled**, **Pending**, or **Recycle Bin** tab to display GPOs. - -3. Select one or more GPOs for which to display links, right-click a selected GPO, click **Settings**, and then click **GPO Links** to display a diagram of domains and organizational units with links to the selected GPO(s). - -### - -**To display GPO links for one or more versions of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Recycle Bin** tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-links-agpm40.md b/mdop/agpm/review-gpo-links-agpm40.md deleted file mode 100644 index 46af2603fc..0000000000 --- a/mdop/agpm/review-gpo-links-agpm40.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Review GPO Links -description: Review GPO Links -author: mjcaparas -ms.assetid: 3aaba9da-f0aa-466f-bd1c-49f11d00ea54 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Links - - -You can display a diagram showing where a Group Policy Object (GPO) or GPOs that you select are linked to organizational units. GPO link diagrams are updated each time the GPO is controlled, imported, or checked in. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Reviewing GPO links - - -- [For one or more GPOs](#bkmk-gpos) - -- [For one or more versions of a GPO](#bkmk-gpo-versions) - -### - -**To display GPO links for one or more GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled**, **Pending**, or **Recycle Bin** tab to display GPOs. - -3. Select one or more GPOs for which to display links, right-click a selected GPO, click **Settings**, and then click **GPO Links** to display a diagram of domains and organizational units with links to the selected GPO(s). - -### - -**To display GPO links for one or more versions of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Recycle Bin** tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-links.md b/mdop/agpm/review-gpo-links.md deleted file mode 100644 index e0569fce2c..0000000000 --- a/mdop/agpm/review-gpo-links.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Review GPO Links -description: Review GPO Links -author: mjcaparas -ms.assetid: 3c472448-f16a-493c-a229-5ca60a470965 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Links - - -You can display a diagram showing where a Group Policy object (GPO) or GPOs that you select are linked to organizational units. GPO link diagrams are updated each time the GPO is controlled, imported, or checked in. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Reviewing GPO links - - -- [For one or more GPOs](#bkmk-gpos) - -- [For one or more versions of a GPO](#bkmk-gpo-versions) - -### - -**To display GPO links for one or more GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled**, **Pending**, or **Recycle Bin** tab to display GPOs. - -3. Select one or more GPOs for which to display links, right-click a selected GPO, click **Settings**, and then click **GPO Links** to display a diagram of domains and organizational units with links to the selected GPO(s). - -### - -**To display GPO links for one or more versions of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Recycle Bin** tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-settings-agpm30ops.md b/mdop/agpm/review-gpo-settings-agpm30ops.md deleted file mode 100644 index 5568f18e0f..0000000000 --- a/mdop/agpm/review-gpo-settings-agpm30ops.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Review GPO Settings -description: Review GPO Settings -author: mjcaparas -ms.assetid: bed956d0-082e-4fa9-bf1e-572d0d3d02ec -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Settings - - -You can generate HTML-based and XML-based reports for reviewing settings within any version of a Group Policy Object (GPO). - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To review settings in any version of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-settings-agpm40.md b/mdop/agpm/review-gpo-settings-agpm40.md deleted file mode 100644 index 2b24c18e22..0000000000 --- a/mdop/agpm/review-gpo-settings-agpm40.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Review GPO Settings -description: Review GPO Settings -author: mjcaparas -ms.assetid: c346bcde-dd6a-4775-aeab-721ca3a361b2 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Settings - - -You can generate HTML-based and XML-based reports for reviewing settings within any version of a Group Policy Object (GPO). - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To review settings in any version of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-settings.md b/mdop/agpm/review-gpo-settings.md deleted file mode 100644 index 406ad65b0c..0000000000 --- a/mdop/agpm/review-gpo-settings.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Review GPO Settings -description: Review GPO Settings -author: mjcaparas -ms.assetid: e82570b2-d8ce-4bf0-8ad7-8910409f3041 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Settings - - -You can generate HTML-based and XML-based reports for reviewing settings within any version of a Group Policy object (GPO). - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To review settings in any version of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md deleted file mode 100644 index 14901c7456..0000000000 --- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Roll Back to a Previous Version of a GPO -description: Roll Back to a Previous Version of a GPO -author: mjcaparas -ms.assetid: 2a98ad8f-32cb-41eb-ab99-0318f2a55d81 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Roll Back to a Previous Version of a GPO - - -An Approver can roll back changes to a Group Policy Object (GPO) by redeploying an earlier version of the GPO from its history. Deploying an earlier version of a GPO overwrites the version of the GPO currently in production. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a previous version of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Double-click the GPO to be deployed to display its **History**. - -4. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - -**Note**   -To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md deleted file mode 100644 index 2363f2055b..0000000000 --- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Roll Back to a Previous Version of a GPO -description: Roll Back to a Previous Version of a GPO -author: mjcaparas -ms.assetid: 028631c0-4cb9-4642-90ad-04cd813051b7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Roll Back to a Previous Version of a GPO - - -Advanced Group Policy Management (AGPM) enables an Approver to roll back changes to a Group Policy object (GPO) by redeploying an earlier version of the GPO from its history. Deploying an earlier version of a GPO overwrites the version of the GPO currently in production. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a previous version of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Double-click the GPO to be deployed to display its **History**. - -4. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - -**Note**   -To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md b/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md deleted file mode 100644 index 5a9b000943..0000000000 --- a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Roll Back to an Earlier Version of a GPO -description: Roll Back to an Earlier Version of a GPO -author: mjcaparas -ms.assetid: 06ce9251-95e0-46d0-99c2-b9a0690e5891 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Roll Back to an Earlier Version of a GPO - - -An Approver can roll back changes to a Group Policy Object (GPO) by redeploying an earlier version of the GPO from its history. Deploying an earlier version of a GPO overwrites the version of the GPO currently in production. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy an earlier version of a GPO to the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Double-click the GPO to be deployed to display its **History**. - -4. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - -**Note**   -To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/search-and-filter-the-list-of-gpos.md b/mdop/agpm/search-and-filter-the-list-of-gpos.md deleted file mode 100644 index 51af8002eb..0000000000 --- a/mdop/agpm/search-and-filter-the-list-of-gpos.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Search and Filter the List of GPOs -description: Search and Filter the List of GPOs -author: mjcaparas -ms.assetid: 1bc58a38-033c-4aed-9eb4-c239827f5501 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Search and Filter the List of GPOs - - -In Advanced Group Policy Management (AGPM), you can search the list of Group Policy Objects (GPOs) and their attributes to filter the list of GPOs displayed. For example, you can search for GPOs with a particular name, state, or comment. You can also search for GPOs that were last changed by a particular Group Policy administrator or on a particular date. - -## Performing a complex search - - -You can perform a complex search by using the format *GPO attribute 1: search string 1 GPO attribute 2: search string 2…all-column search strings*. The search is not case-sensitive. - -- **GPO attribute:** Any column heading in the list of GPOs in AGPM other than **Computer Version** or **User Version**. GPO attributes include the GPO name, state, user who most recently changed the GPO, date and time when the GPO was most recently changed, comment, GPO status, and WMI filter applied to the GPO. - -- **Search string:** Text for which to search in the specified column. If a string includes spaces, you must enclose the string with quotation marks. - -- **All-column search strings:** Text for which to search in all columns in the list of GPOs in AGPM other than **Computer Version** and **User Version**. You can include multiple strings separated by spaces. If a string includes spaces, you must enclose the string with quotation marks. - -Each GPO attribute and search string pair and each all-column search string are combined by using a logical AND operation. The result is a list of all GPOs for which each specified attribute includes the specified search string and for which any all-column search strings appear in at least one column. The search returns any partial matches for strings so that you can enter part of a GPO name or user name and view a list of all GPOs that include that text in their name. - -The following are examples of searches: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Description of search resultSearch query

          All GPOs with names that include the text security and North America.

          name: security name: "North America"

          All checked out GPOs.

          state: "checked out"

          All GPOs most recently changed by the user named Administrator and most recently changed within the previous month.

          changed by: Administrator change date: lastmonth

          All GPOs in which the word firewall is included in the most recent comment and in which the word security appears in any column.

          comment: firewall security

          All GPOs that have a status of All Settings Disabled.

          gpo status: all

          All GPOs that have a WMI filter named My WMI Filter applied and that have a status of User Configuration Settings Disabled.

          wmi filter: "My WMI Filtergpo status: user

          - -  - -## Specifying dates - - -You can search for GPOs changed on a specific date, at a specific time, or during a span of time by using the same special terms available when you search in Windows. If entering a specific date or time, you must use the format that is used in the **Change Date** column. The following are examples of searches of the **Change Date** column: - -- **change date:** **10/10/2009** - -- **change date:** **10/10/2009 9:00:00 AM** - -- **change date:** **thisweek** - -You can use the following special terms, which are not case-sensitive, when you search the **Change Date** column: - -- **Today** - -- **Yesterday** - -- **ThisWeek** - -- **LastWeek** - -- **ThisMonth** - -- **LastMonth** - -- **TwoMonths** - -- **ThreeMonths** - -- **ThisYear** - -- **LastYear** - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- For more information about GPO attributes, see [Contents Tab Features](contents-tab-features-agpm40.md). - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - -  - -  - - - - - diff --git a/mdop/agpm/set-a-default-template-agpm30ops.md b/mdop/agpm/set-a-default-template-agpm30ops.md deleted file mode 100644 index aab61140e4..0000000000 --- a/mdop/agpm/set-a-default-template-agpm30ops.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Set a Default Template -description: Set a Default Template -author: mjcaparas -ms.assetid: 84edbd69-451b-4c10-a898-781d4b75d09c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Set a Default Template - - -As an Editor, you can specify which of the available templates will be the default template suggested for all Group Policy administrators creating new Group Policy Objects (GPOs). - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To set the default template for use when creating new GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Templates** tab to display available templates. - -3. Right-click the template that you want to set as the default, and then click **Set as Default**. - -4. Click **Yes** to confirm. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The default template has a blue icon and the state is identified as **Template (default)** on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- After you set a template as the default, that template will be the one initially selected in the **New Controlled GPO** dialog box when Group Policy administrators create new GPOs. However, they will have the option to select any other GPO template, including **<Empty GPO>**, which does not include any settings. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/set-a-default-template-agpm40.md b/mdop/agpm/set-a-default-template-agpm40.md deleted file mode 100644 index 68c165be29..0000000000 --- a/mdop/agpm/set-a-default-template-agpm40.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Set a Default Template -description: Set a Default Template -author: mjcaparas -ms.assetid: 07208b6b-cb3a-4f6c-9c84-36d4dc1486d8 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Set a Default Template - - -As an Editor, you can specify which of the available templates will be the default template suggested for all Group Policy administrators creating new Group Policy Objects (GPOs). - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To set the default template for use when creating new GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Templates** tab to display available templates. - -3. Right-click the template that you want to set as the default, and then click **Set as Default**. - -4. Click **Yes** to confirm. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The default template has a blue icon and the state is identified as **Template (default)** on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- After you set a template as the default, that template will be the one initially selected in the **New Controlled GPO** dialog box when Group Policy administrators create new GPOs. However, they will have the option to select any other GPO template, including **<Empty GPO>**, which does not include any settings. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/set-a-default-template.md b/mdop/agpm/set-a-default-template.md deleted file mode 100644 index 354b961123..0000000000 --- a/mdop/agpm/set-a-default-template.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Set a Default Template -description: Set a Default Template -author: mjcaparas -ms.assetid: e0acf980-437f-4357-b237-298aaebe490d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Set a Default Template - - -As an Editor, you can specify which of the available templates will be the default template suggested for all Group Policy administrators creating new Group Policy objects (GPOs). - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To set the default template for use when creating new GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Templates** tab to display available templates. - -3. Right-click the template that you want to set as the default, and then click **Set as Default**. - -4. Click **Yes** to confirm. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The default template has a blue icon and the state is identified as **Template (default)** on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- After you set a template as the default, that template will be the one initially selected in the **New Controlled GPO** dialog box when Group Policy administrators create new GPOs. However, they will have the option to select any other GPO template, including **<Empty GPO>**, which does not include any settings. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) - - - - - - - - - diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md deleted file mode 100644 index bd04d77d92..0000000000 --- a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Start and Stop the AGPM Service -description: Start and Stop the AGPM Service -author: mjcaparas -ms.assetid: b9d26920-c439-4992-9a78-73e4fba8309d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Start and Stop the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. - -**Important**   -Stopping or disabling the AGPM Service will prevent AGPM Clients from performing any operations (such as listing or editing GPOs) through the server. - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure. - -**To start or stop the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server (and therefore the AGPM Service) is installed, click **Start**, click **Control Panel**, click **Administrative Tools**, and then click **Services**. - -2. In the list of services, right-click **AGPM Service** and select **Start**, **Restart**, or **Stop**. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md deleted file mode 100644 index 7d19498e83..0000000000 --- a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Start and Stop the AGPM Service -description: Start and Stop the AGPM Service -author: mjcaparas -ms.assetid: dcc9566c-c515-4fbe-b7f5-8ac030141307 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Start and Stop the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. - -**Important**   -Stopping or disabling the AGPM Service will prevent AGPM Clients from performing any operations (such as listing or editing GPOs) through the server. - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure. - -**To start or stop the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server (and therefore the AGPM Service) is installed, click **Start**, click **Control Panel**, click **Administrative Tools**, and then click **Services**. - -2. In the list of services, right-click **AGPM Service** and select **Start**, **Restart**, or **Stop**. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/start-and-stop-the-agpm-service.md b/mdop/agpm/start-and-stop-the-agpm-service.md deleted file mode 100644 index 05cb3f8cc5..0000000000 --- a/mdop/agpm/start-and-stop-the-agpm-service.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Start and Stop the AGPM Service -description: Start and Stop the AGPM Service -author: mjcaparas -ms.assetid: 769aa0ce-224a-446f-9958-9518af4ad159 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Start and Stop the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. - -**Important**   -Stopping or disabling the AGPM Service will prevent AGPM clients from performing any operations (such as listing or editing GPOs) through the server. - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure. - -**To start or stop the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server (and therefore the AGPM Service) is installed, click **Start**, click **Control Panel**, click **Administrative Tools**, and then click **Services**. - -2. In the list of services, right-click **AGPM Service** and select **Start**, **Restart**, or **Stop**. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. To modify settings for the service, see [Managing the AGPM Service](managing-the-agpm-service.md). - - - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md deleted file mode 100644 index b41ee4e572..0000000000 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md +++ /dev/null @@ -1,541 +0,0 @@ ---- -title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 -description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 -author: mjcaparas -ms.assetid: 454298c9-0fab-497a-9808-c0246a4c8db5 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 - - -This step-by-step guide demonstrates advanced techniques for Group Policy management using the Group Policy Management Console (GPMC) and Microsoft Advanced Group Policy Management (AGPM). AGPM increases the capabilities of the GPMC, providing: - -- Standard roles for delegating permissions to manage Group Policy objects (GPOs) to multiple Group Policy administrators. - -- An archive to enable Group Policy administrators to create and modify GPOs offline before deploying them to a production environment. - -- The ability to roll back to any previous version of a GPO. - -- Check-in/check-out capability for GPOs to ensure that Group Policy administrators do not inadvertently overwrite each other's work. - -## AGPM scenario overview - - -For this scenario, you will use a separate user account for each role in AGPM to demonstrate how Group Policy can be managed in an environment with multiple Group Policy administrators who have different levels of permissions. Specifically, you will perform the following tasks: - -- Using an account that is a member of the Domain Admins group, install AGPM Server and assign the AGPM Administrator role to an account or group. - -- Using accounts to which you will assign AGPM roles, install AGPM Client. - -- Using an account with the AGPM Administrator role, configure AGPM and delegate access to GPOs by assigning roles to other accounts. - -- Using an account with the Editor role, request the creation of a GPO, which you then approve using an account with the Approver role. With the Editor account, check the GPO out of the archive, edit the GPO, check the GPO into the archive, and request deployment. - -- Using an account with the Approver role, review the GPO and deploy it to your production environment. - -- Using an account with the Editor role, create a GPO template and use it as a starting point to create a new GPO. - -- Using an account with the Approver role, delete and restore a GPO. - -![group policy object development process](images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif) - -## Requirements - - -Computers on which you want to install AGPM must meet the following requirements, and you must create accounts for use in this scenario. - -### AGPM Server requirements - -AGPM Server 2.5 requires Windows Vista® (32-bit version) with no service packs installed or Windows Server® 2003 (32-bit version), as well as the GPMC. Additionally, you must be a member of the Domain Admins group to install AGPM Server. - -You should install AGPM Server on a member server or domain controller with the most recent version of the GPMC that is available to you and supported by AGPM. AGPM uses the GPMC to back up and restore GPOs, and newer versions of the GPMC provide additional policy settings not available in preceding versions. If the version of the GPMC on your AGPM Server is older than the version on the computers that administrators use to manage Group Policy, the AGPM Server will be unable to store those policy settings not available in the older version of the GPMC. - -Specifically, if your AGPM Server is running Windows Server 2003 and the version of the GPMC that accompanied it, and your Group Policy administrators’ computers are running Windows Vista and the version of the GPMC that accompanied it, you can still manage most policy settings. However, policy settings from the GPMC in Windows Vista that are not available in the GPMC in Windows Server 2003—such as those related to folder redirection, wireless networking (IEEE 802.11), and deployed printers—cannot be stored by the AGPM Server, even though administrators can configure them using AGPM on their computers. - -If you must install AGPM Server on a computer with an older version of GPMC than your Group Policy administrators are running, see the Group Policy Settings Reference for details about which policy settings are available with which operating systems. To download the Group Policy Settings Reference, see . - -**Note**   -Archives cannot be migrated from an AGPM Server or a GPOVault Server running Windows Server 2003 to an AGPM Server running Windows Vista. - -For Windows Server 2003, if GPOVault Server is installed on the computer on which you want to install AGPM Server, it is recommended that you do not uninstall GPOVault Server before beginning the installation. The installation of AGPM Server will uninstall GPOVault Server and automatically transfer your existing GPOVault archive data to an AGPM archive. - - - -### AGPM Client requirements - -AGPM Client 2.5 requires Windows Vista (32-bit version) with no service packs installed or Windows Server 2003 (32-bit version), as well as the GPMC. AGPM Client can be installed on a computer running AGPM Server. - -### Scenario requirements - -Before you begin this scenario, create four user accounts. During the scenario, you will assign one of the following AGPM roles to each of these accounts: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. These accounts must be able to send and receive e-mail messages. Assign **Link GPOs** permission to the accounts with the AGPM Administrator, Approver, and (optionally) Editor roles. - -**Note**   -**Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts with the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which to assign the permission. - - - -For this scenario, you perform actions with different accounts. You can either log on with each account as indicated, or you can use the **Run as** command to start the GPMC with the indicated account. - -**Note**   -To use the **Run as** command with GPMC on Windows Server 2003, click **Start**, point to **Administrative Tools**, right-click **Group Policy Management**, and click **Run as**. Click **The following user** and enter credentials for an account. - -To use the **Run as** command with GPMC on Windows Vista, click the **Start** button, point to **Run**, and type **runas /user:**DomainName\\UserName**"mmc %windir%\\system32\\gpmc.msc"**, and click **OK**. Type the password for the account when prompted. - - - -## Steps for installing and configuring AGPM - - -You must complete the following steps to install and configure AGPM. - -[Step 1: Install AGPM Server](#bkmk-config1) - -[Step 2: Install AGPM Client](#bkmk-config2) - -[Step 3: Configure an AGPM Server connection](#bkmk-config3) - -[Step 4: Configure e-mail notification](#bkmk-config4) - -[Step 5: Delegate access](#bkmk-config5) - -### Step 1: Install AGPM Server - -In this step, you install AGPM Server on the member server or domain controller that will run the AGPM Service, and you configure the archive. All AGPM operations are managed through this Windows service and are executed with the service's credentials. The archive managed by an AGPM Server can be hosted on that server or on another server in the same forest. - -**To install AGPM Server on the computer that will host the AGPM Service** - -1. Log on with an account that is a member of the Domain Admins group. - -2. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Server**. - -3. In the **Welcome** dialog box, click **Next**. - -4. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -5. In the **Application Path** dialog box, select a location in which to install AGPM Server. The computer on which AGPM Server is installed will host the AGPM Service and manage the archive. Click **Next**. - -6. In the **Archive Path** dialog box, select a location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but you should select a location with sufficient space to store all GPOs and history data managed by this AGPM Server. Click **Next**. - -7. In the **AGPM Service Account** dialog box, select a service account under which the AGPM Service will run and then click **Next**. - -8. In the **Archive Owner** dialog box, select an account or group to which to initially assign the AGPM Administrator (Full Control) role. This AGPM Administrator can assign AGPM roles and permissions to other Group Policy administrators (including the role of AGPM Administrator). For this scenario, select the account to serve in the AGPM Administrator role. Click **Next**. - -9. Click **Install**, and then click **Finish** to exit the Setup Wizard. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. For information on how to modify settings for the service, see Help for Advanced Group Policy Management. - - - -### Step 2: Install AGPM Client - -Each Group Policy administrator—anyone who creates, edits, deploys, reviews, or deletes GPOs—must have AGPM Client installed on computers that they use to manage GPOs. For this scenario, you install AGPM Client on at least one computer. You do not need to install AGPM Client on the computers of end users who do not perform Group Policy administration. - -**To install AGPM Client on the computer of a Group Policy administrator** - -1. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Client**. - -2. In the **Welcome** dialog box, click **Next**. - -3. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -4. In the **Application Path** dialog box, select a location in which to install AGPM Client. Click **Next**. - -5. In the **AGPM Server** dialog box, type the fully-qualified computer name and the port for the AGPM Server to which to connect. The default port for the AGPM Service is 4600. Click **Next**. - -6. Click **Install**, and then click **Finish** to exit the Setup Wizard. - -### Step 3: Configure an AGPM Server connection - -AGPM stores all versions of each controlled Group Policy object (GPO)—a GPO for which AGPM provides change control—in a central archive, so Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -In this step, you configure an AGPM Server connection and ensure that all Group Policy administrators connect to the same AGPM Server. (For information about configuring multiple AGPM Servers, see Help for Advanced Group Policy Management.) - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. On a computer on which you have installed AGPM Client, log on with the user account that you selected as the Archive Owner. This user has the role of AGPM Administrator (Full Control). - -2. Click **Start**, point to **Administrative Tools**, and click **Group Policy Management** to open the **Group Policy Management Console (GPMC)**. - -3. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. - -4. In the **Group Policy Object Editor** window, click **User Configuration**, **Administrative Templates**, and **Windows Components**. - -5. If **AGPM** is not listed under **Windows Components**: - - 1. Right-click **Administrative Templates** and select **Add/Remove Templates**. - - 2. Click **Add**, select **agpm.admx** or **agpm.adm**, click **Open**, and then click **Close**. - -6. Under **Windows Components**, double-click **AGPM**. - -7. In the details pane, double-click **AGPM Server (all domains)**. - -8. In the **AGPM Server (all domains) Properties** window, select **Enabled** and type the fully-qualified computer name and port (for example, server.contoso.com:4600) for the server hosting the archive. The port used by the AGPM Service is port 4600. - -9. Click **OK**, and then close the **Group Policy Object Editor** window. When Group Policy is updated, the AGPM Server connection is configured for each Group Policy administrator. - -### Step 4: Configure e-mail notification - -As an AGPM Administrator (Full Control), you designate the e-mail addresses of Approvers and AGPM Administrators to whom an e-mail message containing a request is sent when an Editor attempts to create, deploy, or delete a GPO. You also determine the alias from which these messages are sent. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To** field, type the e-mail address for the user account to which you intend to assign the Approver role. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Step 5: Delegate access - -As an AGPM Administrator (Full Control), you delegate domain-level access to GPOs, assigning roles to the account of each Group Policy administrator. - -**Note**   -You can also delegate access at the GPO level rather than the domain level. For details, see Help for Advanced Group Policy Management. - - - -**Important**   -You should restrict membership in the Group Policy Creator Owners group, so it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - - - -**To delegate access to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Domain Delegation** tab, click the **Advanced** button. - -3. In the **Permissions** dialog box: - - 1. Click the user account of a Group Policy administrator, and then select the **Approver** check box to assign that role to the account. Clear the **Editor** check box. (This role includes the Reviewer role.) - - 2. Click the user account of another Group Policy administrator, and then select the **Editor** check box to assign that role to the account. (This role includes the Reviewer role.) - - 3. Click a third account and then select the **Reviewer** check box to assign only the Reviewer role to the account of that Group Policy administrator. Clear the **Editor** check box. - - 4. Click the **Advanced** button. - -4. In the **Advanced Security Settings** dialog box: - - 1. Select a Group Policy administrator, and then click **Edit**. - - 2. For **Apply onto**, select **This object and nested objects**, and then click **OK** in the **Permission** **Entry** dialog box. - - 3. Repeat for each Group Policy administrator. - -5. In the **Advanced Security Settings** dialog box, click **OK**. - -6. In the **Permissions** dialog box, click **OK**. - -## Steps for managing GPOs - - -You must complete the following steps to create, edit, review, and deploy GPOs using AGPM. Additionally, you will create a template, delete a GPO, and restore a deleted GPO. - -[Step 1: Create a GPO](#bkmk-manage1) - -[Step 2: Edit a GPO](#bkmk-manage2) - -[Step 3: Review and deploy a GPO](#bkmk-manage3) - -[Step 4: Use a template to create a GPO](#bkmk-manage4) - -[Step 5: Delete and restore a GPO](#bkmk-manage5) - -### Step 1: Create a GPO - -In an environment with multiple Group Policy administrators, those with the Editor role have the ability to request the creation of new GPOs, but such a request must be approved by someone with the Approver role because the creation of a new GPO impacts the production environment. - -In this step, you use an account with the Editor role to request the creation of a new GPO. Using an account with the Approver role, you approve this request and complete the creation of a GPO. - -**To request the creation of a new GPO managed through AGPM** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the Editor role in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -4. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so the new GPO will be deployed to the production environment immediately upon approval. - - 5. Click **Submit**. - -5. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -**To approve the pending request to create a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. - -2. Open the e-mail inbox for the account, and note that you have received an e-mail message from the AGPM alias with the Editor's request to create a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -5. Right-click **MyGPO**, and then click **Approve**. - -6. Click **Yes** to confirm approval of the creation of the GPO. The GPO is moved to the **Controlled** tab. - -### Step 2: Edit a GPO - -You can use GPOs to configure computer or user settings and deploy them to many computers or users. In this step, you use an account with the Editor role to check out a GPO from the archive, edit the GPO offline, check the edited GPO into the archive, and request deployment of the GPO to the production environment. For this scenario, you configure a setting in the GPO to require that the password be at least eight characters in length. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Check Out**. - -5. Type a comment to be displayed in the **History** of the GPO while it is checked out, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the minimum password length** - -1. On the **Controlled** tab, right-click **MyGPO**, and then click **Edit** to open the **Group Policy Object Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Windows Settings**, double-click **Security Settings**, double-click **Account Policies**, and double-click **Password Policy**. - - 2. In the details pane, double-click **Minimum password length**. - - 3. In the properties window, select the **Define this policy setting** check box, set the number of characters to **8**, and then click **OK**. - -2. Close the **Group Policy Object Editor** window. - -**To check the GPO into the archive** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Check In**. - -2. Type a comment, and then click **OK**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -**To request the deployment of the GPO to the production environment** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Deploy**. - -2. Because this account is not an Approver or AGPM Administrator, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. **MyGPO** is displayed on the list of GPOs on the **Pending** tab. - -### Step 3: Review and deploy a GPO - -In this step, you act as an Approver, creating reports and analyzing the settings and changes to settings in the GPO to determine whether you should approve them. After evaluating the GPO, you deploy it to the production environment and link it to a domain or an organizational unit (OU) so that it takes effect when Group Policy is refreshed for computers in that domain or OU. - -**To review settings in the GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. (Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.) - -2. Open the e-mail inbox for the account and note that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab in the details pane, click the **Pending** tab. - -5. Double-click **MyGPO** to display its history. - -6. Review the settings in the most recent version of MyGPO: - - 1. In the **History** window, right-click the GPO version with the most recent timestamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings. - - 2. In the Web browser, click **show all** to display all of the settings in the GPO. - - 3. Close the browser. - -7. Compare the most recent version of MyGPO to the first version checked in to the archive: - - 1. In the **History** window, click the GPO version with the most recent timestamp. Press **CTRL** and click the oldest GPO version that has a state of **Checked In**. - - 2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**, indicating that this setting is configured only in the latter version of the GPO. - - 3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO. - - 4. Close the Web browser. - -**To deploy the GPO to the production environment** - -1. On the **Pending** tab, right-click **MyGPO** and then click **Approve**. - -2. Type a comment to include in the history of the GPO. - -3. Click **Yes**. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is deployed to the production environment. - -**To link the GPO to a domain or organizational unit** - -1. In the GPMC, right-click the domain or an OU to which to apply the GPO that you configured, and then click **Link an Existing GPO**. - -2. In the **Select GPO** dialog box, click **MyGPO**, and then click **OK**. - -### Step 4: Use a template to create a GPO - -In this step, you use an account with the Editor role to create a template—an uneditable, static version of a GPO for use as a starting point for creating new GPOs—and then create a new GPO based upon that template. Templates are useful for quickly creating multiple GPOs that include many of the same settings. - -**To create a template based on an existing GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab. - -4. Right-click **MyGPO**, and then click **Save as Template** to create a template incorporating all settings currently in MyGPO. - -5. Type **MyTemplate** as the name for the template and a comment, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -**To request the creation of a new GPO managed through AGPM** - -1. Click the **Controlled** tab. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyOtherGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live**, so the new GPO will be deployed to the production environment immediately upon approval. - - 5. For **From GPO template**, select **MyTemplate**. - - 6. Click **Submit**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -Use an account that has been assigned the role of Approver to approve the pending request to create the GPO as you did in [Step 1: Create a GPO](#bkmk-manage1). MyTemplate incorporates all of the settings that you configured in MyGPO. Because MyOtherGPO was created using MyTemplate, it initially contains all of the settings that MyGPO contained at the time that MyTemplate was created. You can confirm this by generating a difference report to compare MyOtherGPO to MyTemplate. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. Right-click **MyOtherGPO**, and then click **Check Out**. - -3. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the account lockout duration** - -1. On the **Controlled** tab, right-click **MyOtherGPO**, and then click **Edit** to open the **Group Policy Object Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Windows Settings**, double-click **Security Settings**, double-click **Account Policies**, and double-click **Account Lockout Policy**. - - 2. In the details pane, double-click **Account lockout duration**. - - 3. In the properties window, check **Define this policy setting**, set the duration to **30** minutes, and then click **OK**. - -2. Close the **Group Policy Object Editor** window. - -Check MyOtherGPO into the archive and request deployment as you did for MyGPO in [Step 2: Edit a GPO](#bkmk-manage2). You can compare MyOtherGPO to MyGPO or to MyTemplate using difference reports. Any account that includes the Reviewer role (AGPM Administrator \[Full Control\], Approver, Editor, or Reviewer) can generate reports. - -**To compare a GPO to another GPO and to a template** - -1. To compare MyGPO and MyOtherGPO: - - 1. On the **Controlled** tab, click **MyGPO**. Press **CTRL** and then click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **HTML Report**. - -2. To compare MyOtherGPO and MyTemplate: - - 1. On the **Controlled** tab, click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **Template**. - - 3. Select **MyTemplate** and **HTML Report**, and then click **OK**. - -### Step 5: Delete and restore a GPO - -In this step, you act as an Approver to delete a GPO. - -**To delete a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Delete**. Click **Delete GPO from archive and production** to delete both the version in the archive as well as the deployed version of the GPO in the production environment. - -5. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. - -Occasionally you may discover after deleting a GPO that it is still needed. In this step, you act as an Approver to restore a GPO that has been deleted. - -**To restore a deleted GPO** - -1. On the **Contents** tab, click the **Recycle Bin** tab to display deleted GPOs. - -2. Right-click **MyGPO**, and then click **Restore**. - -3. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - - **Note**   - Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3). - - - -After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to a previous version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made. - -**To roll back to a previous version of a GPO** - -1. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -2. Double-click **MyGPO** to display its history. - -3. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - - **Note**   - To verify that the version that has been redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**. - - - - - - - - - - - diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md deleted file mode 100644 index d593fc9011..0000000000 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md +++ /dev/null @@ -1,530 +0,0 @@ ---- -title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 -description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 -author: mjcaparas -ms.assetid: d067f465-d7c8-4f6d-b311-66b9b06874f7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 - - -This step-by-step guide demonstrates advanced techniques for Group Policy management using the Group Policy Management Console (GPMC) and Microsoft Advanced Group Policy Management (AGPM). AGPM increases the capabilities of the GPMC, providing: - -- Standard roles for delegating permissions to manage Group Policy objects (GPOs) to multiple Group Policy administrators, as well as the ability to delegate access to GPOs in the production environment. - -- An archive to enable Group Policy administrators to create and modify GPOs offline before deploying them to a production environment. - -- The ability to roll back to any previous version of a GPO in the archive and to limit the number of versions stored in the archive. - -- Check-in/check-out capability for GPOs to ensure that Group Policy administrators do not inadvertently overwrite each other's work. - -## AGPM scenario overview - - -For this scenario, you will use a separate user account for each role in AGPM to demonstrate how Group Policy can be managed in an environment with multiple Group Policy administrators who have different levels of permissions. Specifically, you will perform the following tasks: - -- Using an account that is a member of the Domain Admins group, install AGPM Server and assign the AGPM Administrator role to an account or group. - -- Using accounts to which you will assign AGPM roles, install AGPM Client. - -- Using an account with the AGPM Administrator role, configure AGPM and delegate access to GPOs by assigning roles to other accounts. - -- Using an account with the Editor role, request the creation of a GPO, which you then approve using an account with the Approver role. With the Editor account, check the GPO out of the archive, edit the GPO, check the GPO into the archive, and request deployment. - -- Using an account with the Approver role, review the GPO and deploy it to your production environment. - -- Using an account with the Editor role, create a GPO template and use it as a starting point to create a new GPO. - -- Using an account with the Approver role, delete and restore a GPO. - -![group policy object development process](images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif) - -## Requirements - - -Computers on which you want to install AGPM must meet the following requirements, and you must create accounts for use in this scenario. - -**Note**   -If you have AGPM 2.5 installed and are upgrading from Windows Server® 2003 to Windows Server 2008 or Windows Vista® with no service packs installed to Windows Vista with Service Pack 1, you must upgrade the operating system before you can upgrade to AGPM 3.0. - - - -### AGPM Server requirements - -AGPM Server 3.0 requires Windows Server 2008 or Windows Vista with Service Pack 1 and the GPMC from Remote Server Administration Tools (RSAT) installed. Both 32-bit and 64-bit versions are supported. - -Before you install AGPM Server, you must be a member of the Domain Admins group and the following Windows features must be present unless otherwise noted: - -- GPMC - - - Windows Server 2008: The GPMC is automatically installed by AGPM if not present. - - - Windows Vista: You must install the GPMC from RSAT before you install AGPM. For more information, see . - -- .NET Framework 3.5 - -The following Windows features are required by AGPM Server and will be automatically installed if not present: - -- WCF Activation; Non-HTTP Activation - -- Windows Process Activation Service - - - Process Model - - - .NET Environment - - - Configuration APIs - -### AGPM Client requirements - -AGPM Client 3.0 requires Windows Server 2008 or Windows Vista with Service Pack 1 and the GPMC from Remote Server Administration Tools (RSAT) installed. Both 32-bit and 64-bit versions are supported. AGPM Client can be installed on a computer running AGPM Server. - -The following Windows features are required by AGPM Client and will be automatically installed if not present unless otherwise noted: - -- GPMC - - - Windows Server 2008: The GPMC is automatically installed by AGPM if not present. - - - Windows Vista: You must install the GPMC from RSAT before you install AGPM. For more information, see . - -- .NET Framework 3.0 - -### Scenario requirements - -Before you begin this scenario, create four user accounts. During the scenario, you will assign one of the following AGPM roles to each of these accounts: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. These accounts must be able to send and receive e-mail messages. Assign **Link GPOs** permission to the accounts with the AGPM Administrator, Approver, and (optionally) Editor roles. - -**Note**   -**Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts with the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which to assign the permission. - - - -## Steps for installing and configuring AGPM - - -You must complete the following steps to install and configure AGPM. - -[Step 1: Install AGPM Server](#bkmk-config1) - -[Step 2: Install AGPM Client](#bkmk-config2) - -[Step 3: Configure an AGPM Server connection](#bkmk-config3) - -[Step 4: Configure e-mail notification](#bkmk-config4) - -[Step 5: Delegate access](#bkmk-config5) - -### Step 1: Install AGPM Server - -In this step, you install AGPM Server on the member server or domain controller that will run the AGPM Service, and you configure the archive. All AGPM operations are managed through this Windows service and are executed with the service's credentials. The archive managed by an AGPM Server can be hosted on that server or on another server in the same forest. - -**To install AGPM Server on the computer that will host the AGPM Service** - -1. Log on with an account that is a member of the Domain Admins group. - -2. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Server**. - -3. In the **Welcome** dialog box, click **Next**. - -4. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -5. In the **Application Path** dialog box, select a location in which to install AGPM Server. The computer on which AGPM Server is installed will host the AGPM Service and manage the archive. Click **Next**. - -6. In the **Archive Path** dialog box, select a location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but you should select a location with sufficient space to store all GPOs and history data managed by this AGPM Server. Click **Next**. - -7. In the **AGPM Service Account** dialog box, select a service account under which the AGPM Service will run and then click **Next**. - -8. In the **Archive Owner** dialog box, select an account or group to which to initially assign the AGPM Administrator (Full Control) role. This AGPM Administrator can assign AGPM roles and permissions to other Group Policy administrators (including the role of AGPM Administrator). For this scenario, select the account to serve in the AGPM Administrator role. Click **Next**. - -9. In the **Port Configuration** dialog box, type a port on which the AGPM Service should listen. Do not clear the **Add port exception to firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -10. In the **Languages** dialog box, select one or more display languages to install for AGPM Server. - -11. Click **Install**, and then click **Finish** to exit the Setup Wizard. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. For information on how to modify settings for the service, see Help for Advanced Group Policy Management. - - - -### Step 2: Install AGPM Client - -Each Group Policy administrator—anyone who creates, edits, deploys, reviews, or deletes GPOs—must have AGPM Client installed on computers that they use to manage GPOs. For this scenario, you install AGPM Client on at least one computer. You do not need to install AGPM Client on the computers of end users who do not perform Group Policy administration. - -**To install AGPM Client on the computer of a Group Policy administrator** - -1. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Client**. - -2. In the **Welcome** dialog box, click **Next**. - -3. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -4. In the **Application Path** dialog box, select a location in which to install AGPM Client. Click **Next**. - -5. In the **AGPM Server** dialog box, type the fully-qualified computer name for the AGPM Server and the port to which to connect. The default port for the AGPM Service is 4600. Do not clear the **Allow Microsoft Management Console through the firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -6. In the **Languages** dialog box, select one or more display languages to install for AGPM Client. - -7. Click **Install**, and then click **Finish** to exit the Setup Wizard. - -### Step 3: Configure an AGPM Server connection - -AGPM stores all versions of each controlled Group Policy object (GPO)—a GPO for which AGPM provides change control—in a central archive, so Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -In this step, you configure an AGPM Server connection and ensure that all Group Policy administrators connect to the same AGPM Server. (For information about configuring multiple AGPM Servers, see Help for Advanced Group Policy Management.) - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. On a computer on which you have installed AGPM Client, log on with the user account that you selected as the Archive Owner. This user has the role of AGPM Administrator (Full Control). - -2. Click **Start**, point to **Administrative Tools**, and click **Group Policy Management** to open the GPMC. - -3. Edit a GPO that is applied to all Group Policy administrators. - -4. In the **Group Policy Management Editor** window, double-click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -5. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -6. In the **Properties** window, select **Enabled** and type the fully-qualified computer name and port (for example, **server.contoso.com:4600**) for the server hosting the archive. By default, the AGPM Service uses port 4600. - -7. Click **OK**, and then close the **Group Policy Management Editor** window. When Group Policy is updated, the AGPM Server connection is configured for each Group Policy administrator. - -### Step 4: Configure e-mail notification - -As an AGPM Administrator (Full Control), you designate the e-mail addresses of Approvers and AGPM Administrators to whom an e-mail message containing a request is sent when an Editor attempts to create, deploy, or delete a GPO. You also determine the alias from which these messages are sent. - -**To configure e-mail notification for AGPM** - -1. In the details pane, click the **Domain Delegation** tab. - -2. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -3. In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role. - -4. In the **SMTP server** field, type a valid SMTP mail server. - -5. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. Click **Apply**. - -### Step 5: Delegate access - -As an AGPM Administrator (Full Control), you delegate domain-level access to GPOs, assigning roles to the account of each Group Policy administrator. - -**Note**   -You can also delegate access at the GPO level rather than the domain level. For details, see Help for Advanced Group Policy Management. - - - -**Important**   -You should restrict membership in the Group Policy Creator Owners group, so it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - - - -**To delegate access to all GPOs throughout a domain** - -1. On the **Domain Delegation** tab, click the **Add** button, select the user account of the Group Policy administrator to serve as Approver, and then click **OK**. - -2. In the **Add Group or User** dialog box, select the **Approver** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -3. Click the **Add** button, select the user account of the Group Policy administrator to serve as Editor, and then click **OK**. - -4. In the **Add Group or User** dialog box, select the **Editor** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -5. Click the **Add** button, select the user account of the Group Policy administrator to serve as Reviewer, and then click **OK**. - -6. In the **Add Group or User** dialog box, select the **Reviewer** role to assign only that role to the account. - -## Steps for managing GPOs - - -You must complete the following steps to create, edit, review, and deploy GPOs using AGPM. Additionally, you will create a template, delete a GPO, and restore a deleted GPO. - -[Step 1: Create a GPO](#bkmk-manage1) - -[Step 2: Edit a GPO](#bkmk-manage2) - -[Step 3: Review and deploy a GPO](#bkmk-manage3) - -[Step 4: Use a template to create a GPO](#bkmk-manage4) - -[Step 5: Delete and restore a GPO](#bkmk-manage5) - -### Step 1: Create a GPO - -In an environment with multiple Group Policy administrators, those with the Editor role have the ability to request the creation of new GPOs, but such a request must be approved by someone with the Approver role because the creation of a new GPO impacts the production environment. - -In this step, you use an account with the Editor role to request the creation of a new GPO. Using an account with the Approver role, you approve this request and complete the creation of a GPO. - -**To request the creation of a new GPO managed through AGPM** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the Editor role in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -4. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so the new GPO will be deployed to the production environment immediately upon approval. Click **Submit**. - -5. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -**To approve the pending request to create a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. - -2. Open the e-mail inbox for the account, and note that you have received an e-mail message from the AGPM alias with the Editor's request to create a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -5. Right-click **MyGPO**, and then click **Approve**. - -6. Click **Yes** to confirm approval of the creation of the GPO. The GPO is moved to the **Controlled** tab. - -### Step 2: Edit a GPO - -You can use GPOs to configure computer or user settings and deploy them to many computers or users. In this step, you use an account with the Editor role to check out a GPO from the archive, edit the GPO offline, check the edited GPO into the archive, and request deployment of the GPO to the production environment. For this scenario, you configure a setting in the GPO to require that the password be at least eight characters in length. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Check Out**. - -5. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the minimum password length** - -1. On the **Controlled** tab, right-click **MyGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Password Policy**. - - 2. In the details pane, double-click **Minimum password length**. - - 3. In the properties window, select the **Define this policy setting** check box, set the number of characters to **8**, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -**To check the GPO into the archive** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Check In**. - -2. Type a comment, and then click **OK**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -**To request the deployment of the GPO to the production environment** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Deploy**. - -2. Because this account is not an Approver or AGPM Administrator, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the history of the GPO, and then click **Submit**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. **MyGPO** is displayed on the list of GPOs on the **Pending** tab. - -### Step 3: Review and deploy a GPO - -In this step, you act as an Approver, creating reports and analyzing the settings and changes to settings in the GPO to determine whether you should approve them. After evaluating the GPO, you deploy it to the production environment and link it to a domain or an organizational unit (OU) so that it takes effect when Group Policy is refreshed for computers in that domain or OU. - -**To review settings in the GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. (Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.) - -2. Open the e-mail inbox for the account and note that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab in the details pane, click the **Pending** tab. - -5. Double-click **MyGPO** to display its history. - -6. Review the settings in the most recent version of MyGPO: - - 1. In the **History** window, right-click the GPO version with the most recent timestamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings. - - 2. In the Web browser, click **show all** to display all of the settings in the GPO. Close the browser. - -7. Compare the most recent version of MyGPO to the first version checked in to the archive: - - 1. In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and click the oldest GPO version for which the **Computer Version** is not **\\***. - - 2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**, indicating that this setting is configured only in the latter version of the GPO. - - 3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO. - - 4. Close the Web browser. - -**To deploy the GPO to the production environment** - -1. On the **Pending** tab, right-click **MyGPO** and then click **Approve**. - -2. Type a comment to include in the history of the GPO. - -3. Click **Yes**. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is deployed to the production environment. - -**To link the GPO to a domain or organizational unit** - -1. In the GPMC, right-click the domain or an OU to which to apply the GPO that you configured, and then click **Link an Existing GPO**. - -2. In the **Select GPO** dialog box, click **MyGPO**, and then click **OK**. - -### Step 4: Use a template to create a GPO - -In this step, you use an account with the Editor role to create a template—an uneditable, static version of a GPO for use as a starting point for creating new GPOs—and then create a new GPO based upon that template. Templates are useful for quickly creating multiple GPOs that include many of the same settings. - -**To create a template based on an existing GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab. - -4. Right-click **MyGPO**, and then click **Save as Template** to create a template incorporating all settings currently in MyGPO. - -5. Type **MyTemplate** as the name for the template and a comment, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -**To request the creation of a new GPO managed through AGPM** - -1. Click the **Controlled** tab. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyOtherGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live**, so the new GPO will be deployed to the production environment immediately upon approval. - - 5. For **From GPO template**, select **MyTemplate**. Click **Submit**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -Use an account that has been assigned the role of Approver to approve the pending request to create the GPO as you did in [Step 1: Create a GPO](#bkmk-manage1). MyTemplate incorporates all of the settings that you configured in MyGPO. Because MyOtherGPO was created using MyTemplate, it initially contains all of the settings that MyGPO contained at the time that MyTemplate was created. You can confirm this by generating a difference report to compare MyOtherGPO to MyTemplate. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. Right-click **MyOtherGPO**, and then click **Check Out**. - -3. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the account lockout duration** - -1. On the **Controlled** tab, right-click **MyOtherGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Account Lockout Policy**. - - 2. In the details pane, double-click **Account lockout duration**. - - 3. In the properties window, check **Define this policy setting**, set the duration to **30** minutes, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -Check MyOtherGPO into the archive and request deployment as you did for MyGPO in [Step 2: Edit a GPO](#bkmk-manage2). You can compare MyOtherGPO to MyGPO or to MyTemplate using difference reports. Any account that includes the Reviewer role (AGPM Administrator \[Full Control\], Approver, Editor, or Reviewer) can generate reports. - -**To compare a GPO to another GPO and to a template** - -1. To compare MyGPO and MyOtherGPO: - - 1. On the **Controlled** tab, click **MyGPO**. Press CTRL and then click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **HTML Report**. - -2. To compare MyOtherGPO and MyTemplate: - - 1. On the **Controlled** tab, click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **Template**. - - 3. Select **MyTemplate** and **HTML Report**, and then click **OK**. - -### Step 5: Delete and restore a GPO - -In this step, you act as an Approver to delete a GPO. - -**To delete a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Delete**. Click **Delete GPO from archive and production** to delete both the version in the archive as well as the deployed version of the GPO in the production environment. - -5. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. - -Occasionally you may discover after deleting a GPO that it is still needed. In this step, you act as an Approver to restore a GPO that has been deleted. - -**To restore a deleted GPO** - -1. On the **Contents** tab, click the **Recycle Bin** tab to display deleted GPOs. - -2. Right-click **MyGPO**, and then click **Restore**. - -3. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - - **Note**   - Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3). - - - -After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to a previous version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made. - -**To roll back to a previous version of a GPO** - -1. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -2. Double-click **MyGPO** to display its history. - -3. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - - **Note**   - To verify that the version that has been redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**. - - - - - - - - - - - diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md deleted file mode 100644 index 090949bb7e..0000000000 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md +++ /dev/null @@ -1,601 +0,0 @@ ---- -title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 -description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 -author: mjcaparas -ms.assetid: dc6f9b16-b1d4-48f3-88bb-f29301f0131c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 - - -This step-by-step guide demonstrates advanced techniques for Group Policy management that use the Group Policy Management Console (GPMC) and Microsoft Advanced Group Policy Management (AGPM). AGPM increases the capabilities of the GPMC, providing: - -- Standard roles for delegating permissions to manage Group Policy Objects (GPOs) to multiple Group Policy administrators, in addition to the ability to delegate access to GPOs in the production environment. - -- An archive to enable Group Policy administrators to create and modify GPOs offline before the GPOs are deployed into a production environment. - -- The ability to roll back to any earlier version of a GPO in the archive and to limit the number of versions stored in the archive. - -- Check-in and check-out capability for GPOs to make sure that Group Policy administrators do not unintentionally overwrite each other's work. - -- The ability to search for GPOs with specific attributes and to filter the list of GPOs displayed. - -## AGPM scenario overview - - -For this scenario, you will use a separate user account for each role in AGPM to demonstrate how Group Policy can be managed in an environment that has multiple Group Policy administrators who have different levels of permissions. Specifically, you will perform the following tasks: - -- Using an account that is a member of the Domain Admins group, install AGPM Server and assign the AGPM Administrator role to an account or group. - -- Using accounts to which you will assign AGPM roles, install AGPM Client. - -- Using an account that has the AGPM Administrator role, configure AGPM and delegate access to GPOs by assigning roles to other accounts. - -- From an account that has the Editor role, request that a new GPO be created that you then approve by using an account that has the Approver role. Use the Editor account to check the GPO out of the archive, edit the GPO, check the GPO into the archive, and then request deployment. - -- Using an account that has the Approver role, review the GPO and deploy it to your production environment. - -- Using an account that has the Editor role, create a GPO template and use it as a starting point to create a new GPO. - -- Using an account that has the Approver role, delete and restore a GPO. - -![group policy object development process](images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif) - -## Requirements - - -Computers on which you want to install AGPM must meet the following requirements, and you must create accounts for use in this scenario. - -**Note**   -If you have AGPM 2.5 installed and are upgrading from Windows Server® 2003 to Windows Server 2008 R2 or Windows Server 2008, or are upgrading from Windows Vista with no service packs installed to Windows 7 or Windows Vista® with Service Pack 1 (SP1), you must upgrade the operating system before you can upgrade to AGPM 4.0. - -If you have AGPM 3.0 installed, you do not have to upgrade the operating system before you upgrade to AGPM 4.0 - - - -In a mixed environment that includes both newer and older operating systems, there are some limitations to functionality, as indicated in the following table. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating system on which AGPM Server 4.0 runsOperating system on which AGPM Client 4.0 runsStatus of AGPM 4.0 support

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 R2 or Windows 7

          Unsupported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

          - - - -### AGPM Server requirements - -AGPM Server 4.0 requires Windows Server 2008 R2, Windows Server 2008, Windows 7 and the GPMC from Remote Server Administration Tools (RSAT), or Windows Vista with SP1 and the GPMC from RSAT installed. Both 32-bit and 64-bit versions are supported. - -Before you install AGPM Server, you must be a member of the Domain Admins group and the following Windows features must be present unless otherwise noted: - -- GPMC - - - Windows Server 2008 R2 or Windows Server 2008: If the GPMC is not present, it is automatically installed by AGPM. - - - Windows 7: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows 7](https://go.microsoft.com/fwlink/?LinkID=131280) (https://go.microsoft.com/fwlink/?LinkID=131280). - - - Windows Vista with SP1: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows Vista with Service Pack 1](https://go.microsoft.com/fwlink/?LinkID=116179) (https://go.microsoft.com/fwlink/?LinkID=116179). - -- The .NET Framework 3.5 or later versions - - - Windows Server 2008 R2 or Windows 7: If the .NET Framework 3.5 or later version is not present, the .NET Framework 3.5 is automatically installed by AGPM. - - - Windows Server 2008 or Windows Vista with SP1: You must install the .NET Framework 3.5 or a later version before you install AGPM. - -The following Windows features are required by AGPM Server and will be automatically installed if they are not present: - -- WCF Activation; Non-HTTP Activation - -- Windows Process Activation Service - - - Process Model - - - The .NET Environment - - - Configuration APIs - -### AGPM Client requirements - -AGPM Client 4.0 requires Windows Server 2008 R2, Windows Server 2008, Windows 7 and the GPMC from RSAT, or Windows Vista with SP1 and the GPMC from RSAT installed. Both 32-bit and 64-bit versions are supported. AGPM Client can be installed on a computer that is running AGPM Server. - -The following Windows features are required by AGPM Client and unless otherwise noted are automatically installed if they are not present: - -- GPMC - - - Windows Server 2008 R2 or Windows Server 2008: If the GPMC is not present, it is automatically installed by AGPM. - - - Windows 7: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows 7](https://go.microsoft.com/fwlink/?LinkID=131280) (https://go.microsoft.com/fwlink/?LinkID=131280). - - - Windows Vista with SP1: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows Vista with Service Pack 1](https://go.microsoft.com/fwlink/?LinkID=116179) (https://go.microsoft.com/fwlink/?LinkID=116179). - -- The .NET Framework 3.0 or later version - - - Windows Server 2008 R2 or Windows 7: If the .NET Framework 3.0 or later version is not present, the .NET Framework 3.5 is automatically installed by AGPM. - - - Windows Server 2008 or Windows Vista with SP1: If the .NET Framework 3.0 or later version is not present, the .NET Framework 3.0 is automatically installed by AGPM. - -### Scenario requirements - -Before you begin this scenario, create four user accounts. During the scenario, you will assign one of the following AGPM roles to each of these accounts: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. These accounts must be able to send and receive e-mail messages. Assign **Link GPOs** permission to the accounts that have the AGPM Administrator, Approver, and (optionally) Editor roles. - -**Note**   -**Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts that have the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which you want to assign the permission. - - - -## Steps for installing and configuring AGPM - - -You must complete the following steps to install and configure AGPM. - -[Step 1: Install AGPM Server](#bkmk-config1) - -[Step 2: Install AGPM Client](#bkmk-config2) - -[Step 3: Configure an AGPM Server connection](#bkmk-config3) - -[Step 4: Configure e-mail notification](#bkmk-config4) - -[Step 5: Delegate access](#bkmk-config5) - -### Step 1: Install AGPM Server - -In this step, you install AGPM Server on the member server or domain controller that will run the AGPM Service, and you configure the archive. All AGPM operations are managed through this Windows service and are executed with the service's credentials. The archive managed by an AGPM Server can be hosted on that server or on another server in the same forest. - -**To install AGPM Server on the computer that will host the AGPM Service** - -1. Log on with an account that is a member of the Domain Admins group. - -2. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Server**. - -3. In the **Welcome** dialog box, click **Next**. - -4. In the **Microsoft Software License Terms** dialog box, accept the terms and then click **Next**. - -5. In the **Application Path** dialog box, select a location in which to install AGPM Server. The computer on which AGPM Server is installed will host the AGPM Service and manage the archive. Click **Next**. - -6. In the **Archive Path** dialog box, select a location for the archive in relation to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere. However, you should select a location with sufficient space to store all GPOs and history data managed by this AGPM Server. Click **Next**. - -7. In the **AGPM Service Account** dialog box, select a service account under which the AGPM Service will run and then click **Next**. - - This account must be a member of the either the Domain Admins group or, for a least-privilege configuration, the following groups in each domain managed by the AGPM Server: - - - Group Policy Creator Owners - - - Backup Operators - - Additionally, this account requires Full Control permission for the following folders: - - - The AGPM archive folder, for which this permission is automatically granted during the installation of AGPM Server if it is installed on a local drive. - - - The local system temp folder, typically %windir%\\temp. - -8. In the **Archive Owner** dialog box, select an account or group to which you assign the AGPM Administrator (Full Control) role. AGPM Administrators can assign AGPM roles and permissions to other Group Policy administrators, so that later you can assign the role of AGPM Administrator to additional Group Policy administrators. For this scenario, select the account to serve in the AGPM Administrator role. Click **Next**. - -9. In the **Port Configuration** dialog box, type a port on which the AGPM Service should listen. Do not clear the **Add port exception to firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -10. In the **Languages** dialog box, select one or more display languages to install for AGPM Server. - -11. Click **Install**, and then click **Finish** to exit the Setup Wizard. - - **Caution**   - Do not change settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing this can prevent the AGPM Service from starting. For information about how to change settings for the service, see Help for Advanced Group Policy Management. - - - -### Step 2: Install AGPM Client - -Each Group Policy administrator—anyone who creates, edits, deploys, reviews, or deletes GPOs—must have AGPM Client installed on computers that they use to manage GPOs. The Change Control node, which you use to perform many of the GPO management tasks, appears in the Group Policy Management Console only if you install the AGPM Client. For this scenario, you install AGPM Client on at least one computer. You do not need to install AGPM Client on the computers of end users who do not perform Group Policy administration. - -**To install AGPM Client on the computer of a Group Policy administrator** - -1. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Client**. - -2. In the **Welcome** dialog box, click **Next**. - -3. In the **Microsoft Software License Terms** dialog box, accept the terms and then click **Next**. - -4. In the **Application Path** dialog box, select a location in which to install AGPM Client. Click **Next**. - -5. In the **AGPM Server** dialog box, type the DNS name or IP address for the AGPM Server and the port to which you want to connect. The default port for the AGPM Service is 4600. Do not clear the **Allow Microsoft Management Console through the firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -6. In the **Languages** dialog box, select one or more display languages to install for AGPM Client. - -7. Click **Install**, and then click **Finish** to exit the Setup Wizard. - -### Step 3: Configure an AGPM Server connection - -AGPM stores all versions of each controlled Group Policy Object (GPO), that is, each GPO for which AGPM provides change control, in a central archive. This lets Group Policy administrators view and change GPOs offline without immediately affecting the deployed version of each GPO. - -In this step, you configure an AGPM Server connection and ensure that all Group Policy administrators connect to the same AGPM Server. (For information about how to configure multiple AGPM Servers, see Help for Advanced Group Policy Management.) - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. On a computer on which you have installed AGPM Client, log on with the user account that you selected as the Archive Owner. This user has the role of AGPM Administrator (Full Control). - -2. Click **Start**, point to **Administrative Tools**, and then click **Group Policy Management** to open the GPMC. - -3. Edit a GPO that is applied to all Group Policy administrators. - -4. In the **Group Policy Management Editor** window, double-click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -5. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -6. In the **Properties** window, select **Enabled** and type the DNS name or IP address and port (for example, **server.contoso.com:4600**) for the server hosting the archive. By default, the AGPM Service uses port 4600. - -7. Click **OK**, and then close the **Group Policy Management Editor** window. When Group Policy is updated, the AGPM Server connection is configured for each Group Policy administrator. - -### Step 4: Configure e-mail notification - -As an AGPM Administrator (Full Control), you designate the e-mail addresses of Approvers and AGPM Administrators to whom an e-mail message that contains a request is sent when an Editor tries to create, deploy, or delete a GPO. You also determine the alias from which these messages are sent. - -**To configure e-mail notification for AGPM** - -1. In **Group Policy Management Editor** , navigate to the **Change Control** folder - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user who has access to the SMTP service. Click **Apply**. - -### Step 5: Delegate access - -As an AGPM Administrator (Full Control), you delegate domain-level access to GPOs, assigning roles to the account of each Group Policy administrator. - -**Note**   -You can also delegate access at the GPO level instead of the domain level. For more information, see Help for Advanced Group Policy Management. - - - -**Important**   -You should restrict membership in the Group Policy Creator Owners group so that it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - - - -**To delegate access to all GPOs throughout a domain** - -1. On the **Domain Delegation** tab, click the **Add** button, select the user account of the Group Policy administrator to serve as Approver, and then click **OK**. - -2. In the **Add Group or User** dialog box, select the **Approver** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -3. Click the **Add** button, select the user account of the Group Policy administrator to serve as Editor, and then click **OK**. - -4. In the **Add Group or User** dialog box, select the **Editor** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -5. Click the **Add** button, select the user account of the Group Policy administrator to serve as Reviewer, and then click **OK**. - -6. In the **Add Group or User** dialog box, select the **Reviewer** role to assign only that role to the account. - -## Steps for managing GPOs - - -You must complete the following steps to create, edit, review, and deploy GPOs by using AGPM. Additionally, you will create a template, delete a GPO, and restore a deleted GPO. - -[Step 1: Create a GPO](#bkmk-manage1) - -[Step 2: Edit a GPO](#bkmk-manage2) - -[Step 3: Review and deploy a GPO](#bkmk-manage3) - -[Step 4: Use a template to create a GPO](#bkmk-manage4) - -[Step 5: Delete and restore a GPO](#bkmk-manage5) - -### Step 1: Create a GPO - -In an environment that has multiple Group Policy administrators, those with the Editor role can request that new GPOs be created. However, that request must be approved by someone with the Approver role. - -In this step, you use an account that has the Editor role to request that a new GPO be created. Using an account that has the Approver role, you approve this request to create the GPO. - -**To request that a new GPO be created and managed through AGPM** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the Editor role in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -4. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so that the new GPO will be deployed to the production environment immediately upon approval. Click **Submit**. - -5. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -**To approve the pending request to create a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has the role of Approver in AGPM. - -2. Open the e-mail inbox for the account, and notice that you have received an e-mail message from the AGPM alias with the Editor's request to create a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -5. Right-click **MyGPO**, and then click **Approve**. - -6. Click **Yes** to confirm approval and move the GPO to the **Controlled** tab. - -### Step 2: Edit a GPO - -You can use GPOs to configure computer or user settings and deploy them to many computers or users. In this step, you use an account that has the Editor role to check out a GPO from the archive, edit the GPO offline, check the edited GPO into the archive, and request deployment of the GPO to the production environment. For this scenario, you configure a setting in the GPO to require that the password be at least eight characters long. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Check Out**. - -5. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the minimum password length** - -1. On the **Controlled** tab, right-click **MyGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and change an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Password Policy**. - - 2. In the details pane, double-click **Minimum password length**. - - 3. In the properties window, select the **Define this policy setting** check box, set the number of characters to **8**, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -**To check the GPO into the archive** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Check In**. - -2. Type a comment, and then click **OK**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -**To request the deployment of the GPO to the production environment** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Deploy**. - -2. Because this account is not an Approver or AGPM Administrator, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the history of the GPO, and then click **Submit**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. **MyGPO** is displayed on the list of GPOs on the **Pending** tab. - -### Step 3: Review and deploy a GPO - -In this step, you act as an Approver, creating reports and analyzing the settings and changes to settings in the GPO to determine whether you should approve them. After you evaluate the GPO, you deploy it to the production environment and link the GPO to a domain or an organizational unit (OU). The GPO takes effect when Group Policy is refreshed for computers in that domain or OU. - -**To review settings in the GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver in AGPM. Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO. - -2. Open the e-mail inbox for the account and notice that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab in the details pane, click the **Pending** tab. - -5. Double-click **MyGPO** to display its history. - -6. Review the settings in the most recent version of MyGPO: - - 1. In the **History** window, right-click the GPO version with the most recent time stamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings. - - 2. In the Web browser, click **show all** to display all the settings in the GPO. Close the browser. - -7. Compare the most recent version of MyGPO to the first version checked in to the archive: - - 1. In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and then click the oldest GPO version for which the **Computer Version** is not **\\***. - - 2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**. This indicates that the setting is configured only in the latter version of the GPO. - - 3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO. - - 4. Close the Web browser. - -**To deploy the GPO to the production environment** - -1. On the **Pending** tab, right-click **MyGPO** and then click **Approve**. - -2. Type a comment to include in the history of the GPO. - -3. Click **Yes**. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is deployed to the production environment. - -**To link the GPO to a domain or organizational unit** - -1. In the GPMC, right-click either the domain or an organizational unit (OU) to which you want to apply the GPO that you configured, and then click **Link an Existing GPO**. - -2. In the **Select GPO** dialog box, click **MyGPO**, and then click **OK**. - -### Step 4: Use a template to create a GPO - -In this step, you use an account that has the Editor role to create and use a template. That template is a static version of a GPO for use as a starting point for creating new GPOs. Although you cannot edit a template, you can create a new GPO based on a template. Templates are useful for quickly creating multiple GPOs that include many of the same policy settings. - -**To create a template based on an existing GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab. - -4. Right-click **MyGPO**, and then click **Save as Template** to create a template incorporating all settings currently in MyGPO. - -5. Type **MyTemplate** as the name for the template and a comment, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -**To request that a new GPO be created and managed through AGPM** - -1. Click the **Controlled** tab. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyOtherGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so that the new GPO will be deployed to the production environment immediately upon approval. - - 5. For **From GPO template**, select **MyTemplate**. Click **Submit**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -Use an account that is assigned the role of Approver to approve the pending request to create the GPO as you did in [Step 1: Create a GPO](#bkmk-manage1). MyTemplate incorporates all the settings that you configured in MyGPO. Because MyOtherGPO was created using MyTemplate, it at first contains all the settings that MyGPO contained at the time that MyTemplate was created. You can confirm this by generating a difference report to compare MyOtherGPO to MyTemplate. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Editor in AGPM. - -2. Right-click **MyOtherGPO**, and then click **Check Out**. - -3. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the account lockout duration** - -1. On the **Controlled** tab, right-click **MyOtherGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and change an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Account Lockout Policy**. - - 2. In the details pane, double-click **Account lockout duration**. - - 3. In the properties window, check **Define this policy setting**, set the duration to **30** minutes, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -Check MyOtherGPO into the archive and request deployment as you did for MyGPO in [Step 2: Edit a GPO](#bkmk-manage2). You can compare MyOtherGPO to MyGPO or to MyTemplate by using difference reports. Any account that includes the Reviewer role (AGPM Administrator \[Full Control\], Approver, Editor, or Reviewer) can generate reports. - -**To compare a GPO to another GPO and to a template** - -1. To compare MyGPO and MyOtherGPO: - - 1. On the **Controlled** tab, click **MyGPO**. Press CTRL and then click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and then click **HTML Report**. - -2. To compare MyOtherGPO and MyTemplate: - - 1. On the **Controlled** tab, click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and then click **Template**. - - 3. Select **MyTemplate** and **HTML Report**, and then click **OK**. - -### Step 5: Delete and restore a GPO - -In this step, you act as an Approver to delete a GPO. - -**To delete a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Delete**. Click **Delete GPO from archive and production** to delete both the version in the archive and the deployed version of the GPO in the production environment. - -5. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. - -Occasionally you may discover after you delete a GPO that it is still needed. In this step, you act as an Approver to restore a GPO that was deleted. - -**To restore a deleted GPO** - -1. On the **Contents** tab, click the **Recycle Bin** tab to display deleted GPOs. - -2. Right-click **MyGPO**, and then click **Restore**. - -3. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - - **Note**   - Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3). - - - -After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to an earlier version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made. - -**To roll back to an earlier version of a GPO** - -1. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -2. Double-click **MyGPO** to display its history. - -3. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - - **Note**   - To verify that the version that was redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**. - - - - - - - - - - - diff --git a/mdop/agpm/technical-overview-of-agpm.md b/mdop/agpm/technical-overview-of-agpm.md deleted file mode 100644 index 9f7a7d14d8..0000000000 --- a/mdop/agpm/technical-overview-of-agpm.md +++ /dev/null @@ -1,284 +0,0 @@ ---- -title: Technical Overview of AGPM -description: Technical Overview of AGPM -author: mjcaparas -ms.assetid: 36bc0ab5-f752-474c-8559-721ea95169c2 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Technical Overview of AGPM - - -Microsoft Advanced Group Policy Management (AGPM) is a client/server application. The AGPM Server stores Group Policy Objects (GPOs) offline in the archive that AGPM creates on the server's file system. Group Policy administrators use the AGPM snap-in for the Group Policy Management Console (GPMC) to work with GPOs on the server that hosts the archive. Understanding the parts of AGPM and related items, how they store GPOs in the file system, and how permissions control the actions available to each user role can improve Group Policy administrators' effectiveness with AGPM. - -## Terminology - - -The following explains the basic AGPM terms. - -- **AGPM Client:** A computer that runs the AGPM snap-in for the Group Policy Management Console (GPMC) and from which Group Policy administrators manage GPOs. - -- **AGPM snap-in:** The software component of AGPM installed on AGPM Clients so that they can manage GPOs. - -- **AGPM Server:** A server that runs the AGPM Service and manages an archive. Each AGPM Server can manage only one archive, but one AGPM Server can manage archive data for multiple domains in one archive. An archive can be hosted on a computer other than an AGPM Server. - -- **AGPM Service:** The software component of AGPM that runs on an AGPM Server as a service. The service manages GPOs in the archive and in the production environment in that forest. - -- **Archive:** In AGPM, a central store that contains the controlled GPOs that the associated AGPM Server manages, in addition to the history for each of those GPOs. This includes all previous controlled versions of each GPO. An archive consists of an archive index file and associated archive data that may include data for GPOs in multiple domains. An archive can be hosted on a computer other than an AGPM Server. - -- **Controlled GPO:** A GPO that is being managed by AGPM. AGPM manages the history and permissions of controlled GPOs, which it stores in the archive. - -- **Uncontrolled GPO:** A GPO in the production environment for a domain and not managed by AGPM. - -## What AGPM installs, creates, and affects - - -On an AGPM Server, the AGPM Setup program installs the AGPM Service. AGPM does not alter the Active Directory® directory service or the schema. By default, the AGPM Server program files are installed in %ProgramFiles%\\Microsoft\\AGPM\\Server. You can install the AGPM Service on a domain controller if you have to; however, we recommend that you install the AGPM Service on a member server. - -On an AGPM Client, the AGPM Setup program installs the AGPM snap-in, adding a **Change Control** folder to each domain that appears in the GPMC. By default, the AGPM Client program files are installed in %ProgramFiles%\\Microsoft\\AGPM\\Client. - -Table 1 describes both the items that AGPM installs or creates and the parts of the operating system that affect AGPM operation. - -**Table 1: Items installed, created, or affected by AGPM** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ItemDescription

          AGPM Service

          The AGPM Service runs on the AGPM Server. The service manages the archive, which contains offline GPOs, and controlled GPOs in the production environment. The default configuration of the AGPM Service is as follows:

          -
            -
          • Service name: AGPM Service

          • -
          • Display name: AGPM Service

          • -
          • Path to executable: %ProgramFiles%\Microsoft\AGPM\Server\Agpm.exe

          • -
          • Startup: Automatic

          • -
          • Log on as: AGPM Service Account specified during installation of AGPM Server, which can be changed using Programs and Features in the Control Panel.

          • -

          AGPM archive

          By default, AGPM creates the archive in %ProgramData%\Microsoft\AGPM on the AGPM Server. The archive provides storage for offline GPOs, and it can store multiple versions of each GPO. Changes that AGPM makes to GPOs in the archive do not affect the production environment until an AGPM Administrator or Approver deploys the GPO to the production environment and links the GPO to an organizational unit (OU).

          Windows Firewall

          During installation, AGPM enables an inbound Windows Firewall rule that allows the AGPM Client to communicate with the AGPM Server. The default Windows Firewall rule is the following:

          -
            -
          • Name: AGPM Service

          • -
          • Action: Allow the connection

          • -
          • Programs: All programs that meet the specified conditions

          • -
          • Protocol type: TCP

          • -
          • Local port: 4600

          • -
          • Remote port: All ports

          • -
          • Local IP address: Any

          • -
          • Remote IP address: Any

          • -

          E-mail server

          AGPM uses Simple Mail Transfer Protocol (SMTP) to send e-mail requests to the addresses configured on the Domain Delegation tab. For example, when an Editor requests that a new GPO be created, AGPM notifies each e-mail address specified on the Domain Delegation tab.

          AGPM snap-in

          The AGPM snap-in for the GPMC runs on AGPM Clients and is used by Group Policy administrators to manage GPOs. The snap-in appears in the GPMC as a Change Control folder in each domain.

          - - - -### Additional references - -For more information about the files installed by AGPM, see the [Planning Guide for AGPM](https://go.microsoft.com/fwlink/?LinkId=160060). - -## Archive - - -By default, the AGPM Server installation process creates the archive on the local hard disk of the AGPM Server at %ProgramData%\\Microsoft\\AGPM. However, you can change the path during installation and even create the archive on a server other than the AGPM Server. - -The archive contains a subfolder for each version of each GPO the archive contains. The name of each subfolder is a GUID that identifies a version of the GPO. - -The gpostate.xml file records the state of each GPO in the archive. The file is a manifest that describes the contents of the archive. For example, a GPO can have many versions, and each version is in its own subfolder in the archive. The gpostate.xml file indicates which subfolders contain different versions of a single GPO. Additionally, GPO templates have subfolders in the archive, but gpostate.xml indicates that these are templates and not controlled GPOs. Similarly, when Group Policy administrators delete GPOs, AGPM changes their states in gpostate.xml to indicate that they are in the **Recycle Bin** but does not actually remove the GPOs' subfolders from the archive. - -**Caution**   -Do not manually edit gpostate.xml or the GPOs the archive contains. This information is provided only to enhance understanding of the AGPM archive. Instead, use the AGPM snap-in to change GPOs. - - - -When AGPM creates the archive, it gives Full Control to SYSTEM, Administrators, and the AGPM Service Account (specified in the setup of AGPM Server). Changing permissions by using the AGPM user interface on the AGPM snap-in does not alter permissions on the archive, because the AGPM Service Account performs all operations on behalf of the logged-on user. - -### Additional references - -For information about how to back up the archive, restore the archive from a backup, or move both the AGPM Server and the archive, see the "Performing AGPM Administrator Tasks" section in the [Operations Guide for AGPM](https://go.microsoft.com/fwlink/?LinkId=160061). - -## Roles and permissions - - -Roles simplify delegation. Instead of assigning detailed permissions to Group Policy administrators, AGPM Administrators can assign one of four roles to Group Policy administrators to let them perform work related to that role: - -- **AGPM Administrator:** Group Policy administrators assigned the AGPM Administrator (Full Control) role can perform any task in AGPM. AGPM Administrators can configure domain-wide options and delegate permissions to other Group Policy administrators. - -- **Approver:** Group Policy administrators assigned the Approver role can deploy GPOs to the production environment for a domain. Approvers can also create and delete GPOs and approve or reject requests from Editors. Approvers can view the list of GPOs in a domain, view the policy settings in GPOs, and create and view reports of the policy settings in a GPO. They cannot edit the policy settings in GPOs unless they are also assigned the Editor role. - -- **Editor:** Group Policy administrators assigned the Editor role can view the list of GPOs in a domain, view the policy settings in GPOs, edit the policy settings in GPOs, and create and view reports of the policy settings in a GPO. Unless they are also assigned the Approver role, Editors cannot create, deploy, or delete GPOs. However, they can request that GPOs be created, deployed, or deleted. - -- **Reviewer:** Group Policy administrators assigned the Reviewer role can view the list of GPOs in a domain and create and view reports of the policy settings in a GPO. Unless they are also assigned the Editor role, they cannot edit policy settings in a GPO. - -AGPM gives AGPM Administrators the flexibility to configure permissions at a more detailed level than roles by using the AGPM snap-in. Table 2 describes these permissions and indicates the permissions granted to each role by default. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PermissionDescriptionAGPM AdministratorApproverEditorReviewer

          Full Control

          Have all permissions.

          Yes

          Create GPO

          Create GPOs in a domain.

          Yes

          Yes

          List Contents

          List the GPOs in a domain.

          Yes

          Yes

          Yes

          Yes

          Read Settings

          Read the policy settings within a GPO.

          Yes

          Yes

          Yes

          Yes

          Edit Settings

          Change the policy settings in a GPO.

          Yes

          Yes

          Delete GPO

          Delete a GPO.

          Yes

          Yes

          Modify Security

          Delegate domain-level access, delegate access to a single GPO, and delegate access to the production environment.

          Yes

          Deploy GPO

          Deploy a GPO from the archive to the production environment.

          Yes

          Yes

          Create Template

          Create a GPO template in AGPM.

          Yes

          Yes

          Modify Options

          Configure AGPM e-mail notification and limit the GPO versions stored in the archive.

          Yes

          Export GPO

          Export a GPO to a file.

          Yes

          Yes

          Import GPO

          Import a GPO from a file.

          Yes

          Yes

          - - - -**Note**   -**Export GPO** and **Import GPO** permissions are not available in AGPM 3.0 or 2.5. - -The ability to delegate access to GPOs in the production environment for a domain and the ability to limit the number of GPO versions stored are not available in AGPM 2.5. - - - -### Additional references - -For information about what tasks can be performed by Group Policy administrators assigned a particular role or about which permissions are required to perform a specific task, see the [Operations Guide for AGPM](https://go.microsoft.com/fwlink/?LinkId=160061). - - - - - - - - - diff --git a/mdop/agpm/template-commands-agpm30ops.md b/mdop/agpm/template-commands-agpm30ops.md deleted file mode 100644 index d0d078ee41..0000000000 --- a/mdop/agpm/template-commands-agpm30ops.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Template Commands -description: Template Commands -author: mjcaparas -ms.assetid: 2ec11b3f-0c5c-4788-97bd-bd4bf64ba51a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Template Commands - - -The **Templates** tab: - -- Displays a list of available templates that you can use to create new Group Policy Objects (GPOs). - -- Provides a shortcut menu with commands for creating a GPO based on a selected template, managing templates, and displaying reports for templates. - -- Displays a list of the groups and users who have permission to access a selected template. - -Because a template cannot be altered, templates have no history. However, like any GPO version, the settings of a template can be displayed with a settings report or compared to another GPO with a difference report. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control - - - ---- - - - - - - - - - - - - -
          CommandEffect

          New Controlled GPO

          Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

          - - - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates.

          - - - -## Template management - - - ---- - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Set as Default

          Set the selected template as the default to be used automatically when creating a new GPO.

          Delete

          Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request.

          Rename

          Change the name of the selected template.

          - - - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for Advanced Group Policy Management (AGPM).

          - - - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/template-commands-agpm40.md b/mdop/agpm/template-commands-agpm40.md deleted file mode 100644 index ab77542a14..0000000000 --- a/mdop/agpm/template-commands-agpm40.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Template Commands -description: Template Commands -author: mjcaparas -ms.assetid: 243a9b18-bf3f-44fa-94d7-5c793f7322da -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Template Commands - - -The **Templates** tab: - -- Displays a list of available templates that you can use to create new Group Policy Objects (GPOs). - -- Provides a shortcut menu with commands for creating a GPO based on a selected template, managing templates, and displaying reports for templates. - -- Displays a list of the groups and users who have permission to access a selected template. - -Because a template cannot be altered, templates have no history. However, like any GPO version, the settings of a template can be displayed with a settings report or compared to another GPO with a difference report. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control - - - ---- - - - - - - - - - - - - -
          CommandEffect

          New Controlled GPO

          Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment of the domain is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

          - - - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates.

          - - - -## Template management - - - ---- - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Set as Default

          Set the selected template as the default to be used automatically when creating a new GPO.

          Delete

          Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request.

          Rename

          Change the name of the selected template.

          - - - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for Advanced Group Policy Management (AGPM).

          - - - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/templates-tab.md b/mdop/agpm/templates-tab.md deleted file mode 100644 index 6c6a7e617d..0000000000 --- a/mdop/agpm/templates-tab.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Templates Tab -description: Templates Tab -author: mjcaparas -ms.assetid: 5676e9f9-eb52-49e1-a55d-15c1059af368 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Templates Tab - - -The **Templates** tab: - -- Displays a list of available templates that you can use to create new Group Policy objects (GPOs). - -- Provides a shortcut menu with commands for creating a GPO based on a selected template, managing templates, and displaying reports for templates. - -- Displays a list of the groups and users who have permission to access a selected template. - -Because a template cannot be altered, templates have no history. However, like any GPO version, the settings of a template can be displayed with a settings report or compared to another GPO with a difference report. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control - - - ---- - - - - - - - - - - - - -
          CommandEffect

          New Controlled GPO

          Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

          - - - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates.

          - - - -## Template management - - - ---- - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          Set as Default

          Set the selected template as the default to be used automatically when creating a new GPO.

          Delete

          Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request.

          Rename

          Change the name of the selected template.

          - - - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for Advanced Group Policy Management (AGPM).

          - - - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md b/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md deleted file mode 100644 index 7eebcfe46c..0000000000 --- a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Test a GPO in a Separate Organizational Unit -description: Test a GPO in a Separate Organizational Unit -author: mjcaparas -ms.assetid: 9a9e6d22-74e6-41d8-ac2f-12a1b76ad5a0 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Test a GPO in a Separate Organizational Unit - - -If you use a testing organizational unit (OU) to test Group Policy Objects (GPOs) within the same domain before deployment to the production environment, you must have the necessary permissions to access the test OU. Using a test OU is optional. - -**To use a test OU** - -1. Although you have the GPO checked out for editing, in the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you are managing GPOs. - -2. Click the checked out copy of the GPO to be tested. The name will be preceded by **\[AGPM\]**. (If it is not listed, click **Action**, then **Refresh**. Sort the names alphabetically, and **\[AGPM\]** GPOs will typically appear at the top of the list.) - -3. Drag the GPO to the test OU. - -4. Click **OK** in the dialog box that asks whether to create a link to the GPO in the test OU. - -### Additional considerations - -- When testing is complete, checking in the GPO automatically deletes the link to the checked-out copy of the GPO. - -### Additional references - -- [Using a Test Environment](using-a-test-environment.md) - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md deleted file mode 100644 index 9cfdbb49f9..0000000000 --- a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: Troubleshooting Advanced Group Policy Management -description: Troubleshooting Advanced Group Policy Management -author: mjcaparas -ms.assetid: f7ece97c-e9f8-4b18-8c7a-a615c98d5c60 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Advanced Group Policy Management - - -This section lists common issues that you may encounter when you use Advanced Group Policy Management (AGPM) to manage Group Policy Objects (GPOs). To diagnose issues not listed here, it may be helpful for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md). - -**Note**   -- For information about rolling back to an earlier version of a GPO if there are problems, see [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md). - -- For information about how to recover from a disaster by restoring the complete archive from a backup, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md). - -  - -## What problems are you having? - - -- [I am unable to access an archive](#bkmk-access-an-archive) - -- [The GPO state varies for different Group Policy administrators](#bkmk-state-varies) - -- [I am unable to modify the AGPM Server connection](#bkmk-modify-archive-location) - -- [I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs](#bkmk-perform-task) - -- [I am unable to use a particular GPO name](#bkmk-use-particular-name) - -- [I am not receiving AGPM e-mail notifications](#bkmk-email) - -- [I cannot use port 4600 for the AGPM Service](#bkmk-port) - -- [The AGPM Service will not start](#bkmk-not-start) - -- [Group Policy Software Installation fails to install software](#bkmk-software-installation) - -- [An error occurred when I restored the archive to a new AGPM Server](#bkmk-error-on-restore) - -### I am unable to access an archive - -- **Cause**: You have not selected the correct server and port for the archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - -- **Cause**: The AGPM Service is not running. - -- **Solution**: - - - If you are an AGPM Administrator: Start the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - - - If you are not an AGPM Administrator: Contact an AGPM Administrator for assistance. - -### The GPO state varies for different Group Policy administrators - -- **Cause**: Different Group Policy administrators have selected different AGPM Servers for the same archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - -### I am unable to modify the AGPM Server connection - -- **Cause**: If the settings on the **AGPM Server** tab are unavailable, the AGPM Server has been centrally configured using an Administrative template. - -- **Solution**: - - - If you are an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - - If you are not an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, you do not need to modify the AGPM Server. - -### I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs - -- **Cause**: You have not been assigned a role with the permissions required to perform the task or tasks. - -- **Solution**: - - - If you are an AGPM Administrator: See [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md) and [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md). AGPM permissions will cascade from the domain to all GPOs currently in the archive. For details about which roles can perform a task and which permissions are necessary to perform a task, refer to the help for that task. - - - If you are not an AGPM Administrator and you require additional roles or permissions: Contact an AGPM Administrator for assistance. Be aware that if you are an Editor, you can begin the process of creating a GPO, deploying a GPO, or deleting a GPO from the production environment, but an Approver or AGPM Administrator must approve your request. - -### I am unable to use a particular GPO name - -- **Cause**: Either the GPO name is already in use or you lack permission to list the GPO. - -- **Solution**: - - - If the GPO name appears on the **Controlled**, **Uncontrolled**, or **Pending** tab, choose another name. If a GPO that was deployed is renamed but not yet redeployed, it will be displayed under its old name in the production environment. Therefore, the old name is still being used. Redeploy the GPO to update its name in the production environment and release that name for use by another GPO. - - - If the GPO name does not appear on the **Controlled**, **Uncontrolled**, or **Pending** tab, you may lack permission to list the GPO. To request permission, contact an AGPM Administrator. - -### I am not receiving AGPM e-mail notifications - -- **Cause**: A valid SMTP e-mail server and e-mail address has not been provided, or no action has been taken that generates an e-mail notification. - -- **Solution**: - - - If you are an AGPM Administrator: For e-mail notifications about pending actions to be sent by AGPM, an AGPM Administrator must provide a valid SMTP e-mail server and e-mail addresses for Approvers on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md). - - - E-mail notifications are generated only when an Editor, Reviewer, or other Group Policy administrator who lacks the permission necessary to create, deploy, or delete a GPO submits a request for one of those actions to occur. There is no automatic notification of approval or rejection of a request. - -### I cannot use port 4600 for the AGPM Service - -- **Cause**: By default, the port on which the AGPM Service listens is port 4600. - -- **Solution**: If port 4600 is not available for the AGPM Service, modify the port configuration on the AGPM Server to use another port and then update the port in the AGPM Server connection for AGPM Clients. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - -### The AGPM Service will not start - -- **Cause**: You have modified settings for the AGPM Service in the operating system under **Administrative Tools** and **Services**. - -- **Solution**: Modify the settings for **Microsoft Advanced Group Policy Management - Server** under **Programs and Features** in Control Panel. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - -### Group Policy Software Installation fails to install software - -- **Cause**: AGPM preserves the integrity of Group Policy Software Installation packages. Although GPOs are edited offline, links between packages in addition to cached client information are preserved. This is by design. - -- **Solution**: When you edit a GPO offline with AGPM, configure any Group Policy Software Installation upgrade of a package in another GPO to reference the deployed GPO, not the checked-out copy. The Editor must have **Read** permission for the deployed GPO. - -### An error occurred when I restored the archive to a new AGPM Server - -- **Cause**: For security reasons, the encryption protecting the password entered on the **Domain Delegation** tab causes the password to fail if the archive is moved to another computer. - -- **Solution**: Re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md). - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management.md b/mdop/agpm/troubleshooting-advanced-group-policy-management.md deleted file mode 100644 index 17e6a15981..0000000000 --- a/mdop/agpm/troubleshooting-advanced-group-policy-management.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Troubleshooting Advanced Group Policy Management -description: Troubleshooting Advanced Group Policy Management -author: mjcaparas -ms.assetid: f58849cf-6c5b-44d8-b356-0ed7a5b24cee -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Advanced Group Policy Management - - -This section lists a few common issues you may encounter when using Advanced Group Policy Management (AGPM) to manage Group Policy objects (GPOs). - -## What problems are you having? - - -- [I am unable to access an archive](#bkmk-access-an-archive) - -- [The GPO state varies for different Group Policy administrators](#bkmk-state-varies) - -- [I am unable to modify the AGPM Server connection](#bkmk-modify-archive-location) - -- [I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs](#bkmk-perform-task) - -- [I am unable to use a particular GPO name](#bkmk-use-particular-name) - -- [I am not receiving AGPM e-mail notifications](#bkmk-email) - -- [I cannot use port 4600 for the AGPM Service](#bkmk-port) - -- [The AGPM Service will not start](#bkmk-not-start) - -- [Group Policy Software Installation fails to install software](#bkmk-software-installation) - -### I am unable to access an archive - -- **Cause**: You have not selected the correct server and port for the archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - -- **Cause**: The Advanced Group Policy Management Service is not running. - -- **Solution**: - - - If you are an AGPM Administrator: Start the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md). - - - If you are not an AGPM Administrator: Contact an AGPM Administrator for assistance. - -### The GPO state varies for different Group Policy administrators - -- **Cause**: Different Group Policy administrators have selected different AGPM Servers for the same archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - -### I am unable to modify the AGPM Server connection - -- **Cause**: If the settings on the **AGPM Server** tab are unavailable, the AGPM Server has been centrally configured using an Administrative template. - -- **Solution**: - - - If you are an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - - - If you are not an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, you do not need to modify the AGPM Server. - -### I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs - -- **Cause**: You have not been assigned a role with the permissions required to perform the task or tasks. - -- **Solution**: - - - If you are an AGPM Administrator: See [Delegate Domain-Level Access](delegate-domain-level-access.md) and [Delegate Access to an Individual GPO](delegate-access-to-an-individual-gpo.md). AGPM permissions will cascade from the domain to all GPOs currently in the archive. As new Group Policy administrators are added at the domain level, their permissions must be set to apply to **This object and nested objects**. For details about which roles can perform a task and what permissions are necessary to perform a task, refer to the help for that task. - - - If you are not an AGPM Administrator and you require additional roles or permissions: Contact an AGPM Administrator for assistance. Note that if you are an Editor, you can begin the process of creating a GPO, deploying a GPO, or deleting a GPO from the production environment, but an Approver or AGPM Administrator must approve your request. - -### I am unable to use a particular GPO name - -- **Cause**: Either the GPO name is already in use or you lack permission to list the GPO. - -- **Solution**: - - - If the GPO name appears on the **Controlled**, **Uncontrolled**, or **Pending** tab, choose another name. If a GPO that has been deployed is renamed but not yet redeployed, it will be displayed under its old name in the production environment—therefore, the old name is still in use. Redeploy the GPO to update its name in the production environment and release that name for use by another GPO. - - - If the GPO name does not appear on the **Controlled**, **Uncontrolled**, or **Pending** tab, you may lack permission to list the GPO. To request permission, contact an AGPM Administrator. - -### I am not receiving AGPM e-mail notifications - -- **Cause**: A valid SMTP e-mail server and e-mail address has not been provided, or no action has been taken that generates an e-mail notification. - -- **Solution**: - - - If you are an AGPM Administrator: For e-mail notifications about pending actions to be sent by AGPM, an AGPM Administrator must provide a valid SMTP e-mail server and e-mail addresses for Approvers on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification.md). - - - E-mail notifications are generated only when an Editor, Reviewer, or other Group Policy administrator who lacks the permission necessary to create, deploy, or delete a GPO submits a request for one of those actions to occur. There is no automatic notification of approval or rejection of a request. - -### I cannot use port 4600 for the AGPM Service - -- **Cause**: By default, the port on which the AGPM Service listens is port 4600. - -- **Solution**: If port 4600 is not available for the AGPM Service, modify each archive index file to use another port and then update the AGPM Server for all Group Policy administrators. For more information, see [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md). - -### The AGPM Service will not start - -- **Cause**: You have modified settings for the AGPM Service in the operating system under **Administrative Tools** and **Services**. - -- **Solution**: Modify the settings for **Microsoft Advanced Group Policy Management - Server** under **Add or Remove Programs**. For more information, see [Modify the AGPM Service Account](modify-the-agpm-service-account.md). - -### Group Policy Software Installation fails to install software - -- **Cause**: AGPM preserves the integrity of Group Policy Software Installation packages. Although GPOs are edited offline, links between packages as well as cached client information are preserved. This is by design. - -- **Solution**: When editing a GPO offline with AGPM, configure any Group Policy Software Installation upgrade of a package in another GPO to reference the deployed GPO, not the checked-out copy. The Editor must have **Read** permission for the deployed GPO. - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-agpm-agpm40.md b/mdop/agpm/troubleshooting-agpm-agpm40.md deleted file mode 100644 index a714041c6c..0000000000 --- a/mdop/agpm/troubleshooting-agpm-agpm40.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: Troubleshooting AGPM -description: Troubleshooting AGPM -author: mjcaparas -ms.assetid: bedcd817-beb2-47bf-aebd-e3923c4fd06f -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting AGPM - - -This section lists common issues that you may encounter when you use Advanced Group Policy Management (AGPM) to manage Group Policy Objects (GPOs). To diagnose issues not listed here, it may be helpful for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md). - -**Note**   -- For information about rolling back to an earlier version of a GPO if there are problems, see [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md). - -- For information about how to recover from a disaster by restoring the complete archive from a backup, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md). - -  - -## What problems are you having? - - -- [I am unable to access an archive](#bkmk-access-an-archive) - -- [The GPO state varies for different Group Policy administrators](#bkmk-state-varies) - -- [I am unable to modify the AGPM Server connection](#bkmk-modify-archive-location) - -- [I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs](#bkmk-perform-task) - -- [I am unable to use a particular GPO name](#bkmk-use-particular-name) - -- [I am not receiving AGPM e-mail notifications](#bkmk-email) - -- [I cannot use port 4600 for the AGPM Service](#bkmk-port) - -- [The AGPM Service will not start](#bkmk-not-start) - -- [Group Policy Software Installation fails to install software](#bkmk-software-installation) - -- [An error occurred when I restored the archive to a new AGPM Server](#bkmk-error-on-restore) - -### I am unable to access an archive - -- **Cause**: You have not selected the correct server and port for the archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - -- **Cause**: The AGPM Service is not running. - -- **Solution**: - - - If you are an AGPM Administrator: Start the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - - - If you are not an AGPM Administrator: Contact an AGPM Administrator for assistance. - -### The GPO state varies for different Group Policy administrators - -- **Cause**: Different Group Policy administrators have selected different AGPM Servers for the same archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - -### I am unable to modify the AGPM Server connection - -- **Cause**: If the settings on the **AGPM Server** tab are unavailable, the AGPM Server has been centrally configured using an Administrative template. - -- **Solution**: - - - If you are an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - - If you are not an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, you do not need to modify the AGPM Server. - -### I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs - -- **Cause**: You have not been assigned a role with the permissions required to perform the task or tasks. - -- **Solution**: - - - If you are an AGPM Administrator: See [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md) and [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md). AGPM permissions will cascade from the domain to all GPOs currently in the archive. For details about which roles can perform a task and which permissions are necessary to perform a task, refer to the help for that task. - - - If you are not an AGPM Administrator and you require additional roles or permissions: Contact an AGPM Administrator for assistance. Be aware that if you are an Editor, you can begin the process of creating a GPO, deploying a GPO, or deleting a GPO from the production environment of the domain, but an Approver or AGPM Administrator must approve your request. - -### I am unable to use a particular GPO name - -- **Cause**: Either the GPO name is already in use or you lack permission to list the GPO. - -- **Solution**: - - - If the GPO name appears on the **Controlled**, **Uncontrolled**, or **Pending** tab, choose another name. If a GPO that was deployed is renamed but not yet redeployed, it will be displayed under its old name in the production environment of the domain. Therefore, the old name is still being used. Redeploy the GPO to update its name in the production environment and release that name for use by another GPO. - - - If the GPO name does not appear on the **Controlled**, **Uncontrolled**, or **Pending** tab, you may lack permission to list the GPO. To request permission, contact an AGPM Administrator. - -### I am not receiving AGPM e-mail notifications - -- **Cause**: A valid SMTP e-mail server and e-mail address has not been provided, or no action has been taken that generates an e-mail notification. - -- **Solution**: - - - If you are an AGPM Administrator: For e-mail notifications about pending actions to be sent by AGPM, an AGPM Administrator must provide a valid SMTP e-mail server and e-mail addresses for Approvers on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md). - - - E-mail notifications are generated only when an Editor, Reviewer, or other Group Policy administrator who lacks the permission necessary to create, deploy, or delete a GPO submits a request for one of those actions to occur. There is no automatic notification of approval or rejection of a request. - -### I cannot use port 4600 for the AGPM Service - -- **Cause**: By default, the port on which the AGPM Service listens is port 4600. - -- **Solution**: If port 4600 is not available for the AGPM Service, modify the port configuration on the AGPM Server to use another port and then update the port in the AGPM Server connection for AGPM Clients. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - -### The AGPM Service will not start - -- **Cause**: You have modified settings for the AGPM Service in the operating system under **Administrative Tools** and **Services**. - -- **Solution**: Modify the settings for **Microsoft Advanced Group Policy Management - Server** under **Programs and Features** in Control Panel. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - -### Group Policy Software Installation fails to install software - -- **Cause**: AGPM preserves the integrity of Group Policy Software Installation packages. Although GPOs are edited offline, links between packages in addition to cached client information are preserved. This is by design. - -- **Solution**: When you edit a GPO offline with AGPM, configure any Group Policy Software Installation upgrade of a package in another GPO to reference the deployed GPO, not the checked-out copy. The Editor must have **Read** permission for the deployed GPO. - -### An error occurred when I restored the archive to a new AGPM Server - -- **Cause**: For security reasons, the encryption protecting the password entered on the **Domain Delegation** tab causes the password to fail if the archive is moved to another computer. - -- **Solution**: Re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md). - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-agpm40-upgrades.md b/mdop/agpm/troubleshooting-agpm40-upgrades.md deleted file mode 100644 index a1b6663214..0000000000 --- a/mdop/agpm/troubleshooting-agpm40-upgrades.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Troubleshooting AGPM Upgrades -description: Troubleshooting AGPM Upgrades -author: jedodson -ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d -ms.reviewer: -manager: dansimp -ms.author: jedodson -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting AGPM Upgrades - -This section lists common issues that you may encounter when you upgrade your Advanced Group Policy Management (AGPM) server to a newer version (e.g. AGPM 4.0 to AGPM 4.3). To diagnose issues not listed here, it may be helpful to view the [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) or for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md). - -## What problems are you having? - -- [Failed to generate a HTML GPO difference report (Error code 80004003)](#bkmk-error-80004003) - -### Failed to generate a HTML GPO difference report (Error code 80004003) - -- **Cause**: You have installed the AGPM upgrade package with an incorrect account. - -- **Solution**: You will need to be an AGPM administrator in order to fix this issue. - - - Ensure you know the username & password of your **AGPM service account**. - - - Log onto your AGPM server interactively as your AGPM service account. - - - This is critically important, as the install will fail if you use a different account. - - - Shutdown the AGPM service. - - - Install the required hotfix. - - - Connect to AGPM using an AGPM client to test that your difference reports are now functioning. diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md b/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md deleted file mode 100644 index 63d79386b6..0000000000 --- a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Uncontrolled GPO Commands -description: Uncontrolled GPO Commands -author: mjcaparas -ms.assetid: 94c07b09-cb96-4ff2-b963-b25f103e73e9 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Uncontrolled GPO Commands - - -The **Uncontrolled** tab: - -- Displays a list of Group Policy Objects (GPOs) not managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for bringing uncontrolled GPOs under the management of AGPM and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

          Control

          Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request.

          Save as Template

          Create a new template based on the settings of the selected GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md b/mdop/agpm/uncontrolled-gpo-commands-agpm40.md deleted file mode 100644 index 81b96fa77a..0000000000 --- a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Uncontrolled GPO Commands -description: Uncontrolled GPO Commands -author: mjcaparas -ms.assetid: 05a8050f-adc3-465b-8524-bbe95745165c -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Uncontrolled GPO Commands - - -The **Uncontrolled** tab: - -- Displays a list of Group Policy Objects (GPOs) not managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for bringing uncontrolled GPOs under the management of AGPM and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO.

          Control

          Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request.

          Save as Template

          Create a new template based on the settings of the selected GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/uncontrolled-tab.md b/mdop/agpm/uncontrolled-tab.md deleted file mode 100644 index 92f967b4c2..0000000000 --- a/mdop/agpm/uncontrolled-tab.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Uncontrolled Tab -description: Uncontrolled Tab -author: mjcaparas -ms.assetid: d7e658bf-a72b-4813-bdc8-2fdb7251e742 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Uncontrolled Tab - - -The **Uncontrolled** tab: - -- Displays a list of Group Policy objects (GPOs) not managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for bringing uncontrolled GPOs under the management of AGPM and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - -
          CommandEffect

          History

          Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

          Control

          Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request.

          Save as Template

          Create a new template based on the settings of the selected GPO.

          - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Settings

          Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

          Differences

          Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

          - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
          CommandEffect

          Refresh

          Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

          Help

          Display help for AGPM.

          - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/use-a-test-environment-agpm30ops.md b/mdop/agpm/use-a-test-environment-agpm30ops.md deleted file mode 100644 index 02be96d42b..0000000000 --- a/mdop/agpm/use-a-test-environment-agpm30ops.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Use a Test Environment -description: Use a Test Environment -author: mjcaparas -ms.assetid: 86295084-b39e-4040-bb3f-15c3c1e99b1a -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Use a Test Environment - - -If you use a testing organizational unit (OU) to test Group Policy Objects (GPOs) before deployment to the production environment, you must have the necessary permissions to access the test OU. The use of a test OU is optional. - -**To use a test OU** - -1. While you have the GPO checked out for editing, in the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you are managing GPOs. - -2. Click the checked out copy of the GPO to be tested. The name will be preceded with **\[Checked Out\]**. (If it is not listed, click **Action**, then **Refresh**. Sort the names alphabetically, and **\[Checked Out\]** GPOs will typically appear at the top of the list.) - -3. Drag and drop the GPO to the test OU. - -4. Click **OK** in the dialog box asking whether to create a link to the GPO in the test OU. - -### Additional considerations - -- When testing is complete, checking in the GPO automatically deletes the link to the checked-out copy of the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/use-a-test-environment.md b/mdop/agpm/use-a-test-environment.md deleted file mode 100644 index 42f74a29ce..0000000000 --- a/mdop/agpm/use-a-test-environment.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Use a Test Environment -description: Use a Test Environment -author: mjcaparas -ms.assetid: b8d7b3ee-030a-4b5b-8223-4a3276fd47a7 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Use a Test Environment - - -If you use a testing organizational unit (OU) to test Group Policy objects (GPOs) before deployment to the production environment, you must have the necessary permissions to access the test OU. The use of a test OU is optional. - -**To use a test OU** - -1. While you have the GPO checked out for editing, in the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you are managing GPOs. - -2. Click the checked out copy of the GPO to be tested. The name will be preceded with **\[AGPM\]**. (If it is not listed, click **Action**, then **Refresh**. Sort the names alphabetically, and **\[AGPM\]** GPOs will typically appear at the top of the list.) - -3. Drag and drop the GPO to the test OU. - -4. Click **OK** in the dialog box asking whether to create a link to the GPO in the test OU. - -### Additional considerations - -- When testing is complete, checking in the GPO automatically deletes the link to the checked-out copy of the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md deleted file mode 100644 index 1fc220154a..0000000000 --- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: User Interface Advanced Group Policy Management -description: User Interface Advanced Group Policy Management -author: mjcaparas -ms.assetid: 19aab694-8283-4d97-9425-1845404b461f -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Interface: Advanced Group Policy Management - - -Advanced Group Policy Management (AGPM) adds a **Change Control** folder to each domain displayed in the **Group Policy Management Console** (GPMC). In an environment where multiple domains are managed with the GPMC, each domain is listed under the **Domains** folder in the console tree. Each domain has a **Change Control** folder under it, and there is one archive of Group Policy Objects (GPOs) per domain. - -Within the details pane there are four primary tabs, providing access to both GPO-level settings and domain-level settings and commands for AGPM. Additionally, there are Administrative template settings specific to AGPM. - -- [Contents Tab](contents-tab-agpm30ops.md): GPO settings and commands and GPO-level delegation - -- [Domain Delegation Tab](domain-delegation-tab-agpm30ops.md): AGPM e-mail notification settings and domain-level delegation - -- [AGPM Server Tab](agpm-server-tab-agpm30ops.md): Domain-level archive connection settings - -- [Production Delegation Tab](production-delegation-tab-agpm30ops.md): Production environment delegation - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md): Central configuration of logging and tracking, archive locations, and the visibility of features - -  - -  - - - - - diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md deleted file mode 100644 index db917b9080..0000000000 --- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: User Interface Advanced Group Policy Management -description: User Interface Advanced Group Policy Management -author: mjcaparas -ms.assetid: 1bf67f6a-4f24-4020-a8c1-fe440de9caa3 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Interface: Advanced Group Policy Management - - -Advanced Group Policy Management (AGPM) adds a **Change Control** folder to each domain displayed in the **Group Policy Management Console** (GPMC). In an environment where multiple domains are managed with the GPMC, each domain is listed under the **Domains** folder in the console tree. Each domain has a **Change Control** folder under it, and there is one archive of Group Policy Objects (GPOs) per domain. - -Within the details pane there are four primary tabs, providing access to both GPO-level settings and domain-level settings and commands for AGPM. Additionally, there are Administrative template settings specific to AGPM. - -- [Contents Tab](contents-tab-agpm40.md): GPO settings and commands and GPO-level delegation - -- [Domain Delegation Tab](domain-delegation-tab-agpm40.md): AGPM e-mail notification settings and domain-level delegation - -- [AGPM Server Tab](agpm-server-tab-agpm40.md): Domain-level archive connection settings - -- [Production Delegation Tab](production-delegation-tab-agpm40.md): Production environment delegation - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md): Central configuration of logging and tracking, archive locations, and the visibility of features - -  - -  - - - - - diff --git a/mdop/agpm/user-interface-advanced-group-policy-management.md b/mdop/agpm/user-interface-advanced-group-policy-management.md deleted file mode 100644 index 2ab508b6ad..0000000000 --- a/mdop/agpm/user-interface-advanced-group-policy-management.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: User Interface Advanced Group Policy Management -description: User Interface Advanced Group Policy Management -author: mjcaparas -ms.assetid: 73324c99-adca-46dc-b516-ef78b7235f59 -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Interface: Advanced Group Policy Management - - -Advanced Group Policy Management (AGPM) adds a **Change Control** node to each domain displayed in the **Group Policy Management Console** (GPMC). In an environment where multiple domains are managed with the GPMC, each domain is listed under the **Domains** node in the console tree. Each domain has a **Change Control** node under it, and there is one archive of Group Policy objects (GPOs) per domain. - -Within the details pane there are three primary tabs, providing access to both GPO-level settings and domain-level settings and commands for AGPM. - -- [Contents Tab](contents-tab.md): GPO settings and commands and GPO-level delegation - -- [Domain Delegation Tab](domain-delegation-tab.md): AGPM e-mail notification settings and domain-level delegation - -- [AGPM Server Tab](agpm-server-tab.md): Domain-level archive connection settings - -Other enhancements and settings: - -- [Administrative Template Settings](administrative-template-settings.md): Central configuration of logging and tracing, archive locations, and the visibility of features - -- [Other Enhancements to the GPMC](other-enhancements-to-the-gpmc.md): AGPM adds a **History** tab and an **Extensions** tab for each GPO and Group Policy link - -  - -  - - - - - diff --git a/mdop/agpm/using-a-test-environment.md b/mdop/agpm/using-a-test-environment.md deleted file mode 100644 index 0b9b47d7e4..0000000000 --- a/mdop/agpm/using-a-test-environment.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Using a Test Environment -description: Using a Test Environment -author: mjcaparas -ms.assetid: fc5fcc7c-1ac8-483a-a6bd-2279ae2ee3fb -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using a Test Environment - - -Before you request that a Group Policy Object (GPO) be deployed to the production environment, you should test the GPO in a lab environment. If you develop the GPO in a domain in a test forest, you can export the GPO to a file and import the file to a domain in the production forest. You can then test the GPO by linking it to an organizational unit (OU) that contains test computers and users. - -- [Export a GPO to a File](export-a-gpo-to-a-file.md) - -- [Import a GPO from a File](import-a-gpo-from-a-file-ed.md) - -- [Test a GPO in a Separate Organizational Unit](test-a-gpo-in-a-separate-organizational-unit-agpm40.md) - -**Note**   -You can also import a GPO from the production environment of the domain. For more information, see [Import a GPO from Production](import-a-gpo-from-production-agpm40-ed.md). - - - - - - - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-30.md b/mdop/agpm/whats-new-in-agpm-30.md deleted file mode 100644 index 5d83cee0ba..0000000000 --- a/mdop/agpm/whats-new-in-agpm-30.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: What's New in AGPM 3.0 -description: What's New in AGPM 3.0 -author: mjcaparas -ms.assetid: 0d082b86-63c5-45ce-9529-6e5f37254f9d -ms.reviewer: -manager: dansimp -ms.author: macapara -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in AGPM 3.0 - - -Microsoft Advanced Group Policy Management (AGPM) 3.0 includes the following new or changed features: - -- Support for Windows Server 2008 and Windows Vista with Service Pack 1 that includes 32-bit and 64-bit versions - -- Improved installation process - -- Simplified procedure for modifying the port on which the AGPM Server listens - -- More detailed information in the History of each GPO - -- Ability to delegate access to the production environment from AGPM - -- Ability to limit the number of GPO versions stored in the archive - -- Ability to configure e-mail security for AGPM - -- Friendlier names for AGPM policy settings - -- The Editor role now requires permission to delete GPOs from the archive - -Additionally, AGPM 3.0 is localized for the following languages: - -- Chinese (Simplified) - -- Chinese (Taiwan) - -- English (U.S.) - -- French - -- German - -- Italian - -- Japanese - -- Korean - -- Portuguese (Brazil) - -- Russian - -- Spanish - -### Additional considerations - -AGPM 3.0 supports Windows Server 2008 and Windows Vista with SP1. It does not support Windows Server 2003 or Windows Vista with no service packs installed. AGPM 2.5 supports those environments. For more information, see [Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md). - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40-sp1.md b/mdop/agpm/whats-new-in-agpm-40-sp1.md deleted file mode 100644 index 6151532df1..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40-sp1.md +++ /dev/null @@ -1,213 +0,0 @@ ---- -title: What's New in AGPM 4.0 SP1 -description: What's New in AGPM 4.0 SP1 -author: dansimp -ms.assetid: c6a3d94a-13c3-44e6-a466-c3011879999e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in AGPM 4.0 SP1 - - -This “What’s New” content describes enhancements and supported configurations for Microsoft Advanced Group Policy Management (AGPM) 4.0 SP1. If there is a difference between this content and other AGPM documentation, this content should be considered authoritative and should supersede the content included with this product. - -## What’s new - - -AGPM 4.0 SP1 supports the following enhancements: - -### New and changed client-side extensions - -Group Policy client-side extensions (CSEs) have been added or changed for AGPM to support new Group Policies in Windows 8 and Windows Server 2012. These group policies enable Group Policy administrators to manage and track Windows 8-specific Group Policy settings that change between two Group Policy Objects (GPOs) or templates. You can also create custom GPOs, with Windows 8-specific settings, and configure and save the GPOs as a template. To view your CSEs, use the settings and difference reports that are available in the AGPM 4.0 SP1 client. - -The new and changed Group Policy client-side extensions are: - -- **Central Access Policy:** Enables Group Policy administrators to specify Central Access Policies on Group Policy servers, for example, file servers. Central Access Policy is an authorization policy that is specified by a GPO item and applied to policy targets to facilitate centralized access and control of resources. These Central Access Policies must be configured on a Group Policy client computer from within Active Directory. A Group Policy distributes the knowledge of an applicable Central Access Policy to the computers that have to enforce it. - -- **Name Resolution Policy changes:** Enables Group Policy administrators to configure settings for DNS security and DirectAccess on DNS client computers. New tabs for configuring Generic DNS Server settings and Encoding settings have been added. - -- **Group Policy Preference changes:** Adds support for the configuration and management of Internet Explorer 10 settings that were added for Windows 8. - -- **Remote Application and Desktop Connections:** Lets Group Policy administrators specify the default connection URL that is used for Remote Application and Desktop Connections. - -- **Windows To Go Startup Options:** Lets Group Policy administrators configure whether the computer will boot to Windows To Go if a USB device that contains a Windows To Go workspace is connected. - -- **Windows To Go Hibernate Options:** Lets Group Policy administrators configure whether a computer can use the hibernation sleep state (S4) when the computer is started from a Windows To Go workspace. - -### Customer feedback and hotfix rollup - -AGPM 4.0 SP1 includes a rollup of fixes to address issues found since the AGPM 4.0 release. AGPM 4.0 SP1 contains the latest fixes up to and including Microsoft Advanced Group Policy Management 4.0 Hotfix 1. - -### Settings and difference reports show new Group Policy extensions - -The new Group Policy extensions have been added to the settings and difference reports. - -### Installer changes and support - -The changes and support for the AGPM 4.0 SP1 installer are: - -- If you install AGPM 4.0 SP1 on Windows 8 or Windows Server 2012, the AGPM installer verifies that the required prerequisite software (Group Policy Management Console and the .NET 3.5 Framework) is installed. If these prerequisites are not installed, the AGPM 4.0 SP1 installation is blocked. - -- When you install AGPM 4.0 SP1, WCF Activation, Non-HTTP Activation, and Windows Process Activation Service are automatically enabled. - -- On Windows Vista, Windows 7, and Windows 8 client operating systems, download the appropriate version of the Remote System Administration Toolkit for your operating system before you install AGPM 4.0 SP1. - -- Backward compatibility with older supported operating systems is supported. - -### Ability to upgrade or update to AGPM 4.0 SP1 without re-entering configuration parameters - -You can upgrade the AGPM client or server to AGPM 4.0 SP1 only from AGPM 4.0 without being prompted to re-enter configuration parameters (called “Smart Upgrade”), as shown in the following table. If you are upgrading to AGPM 4.0 SP1 from other versions of AGPM, as shown in the table, you must use the “Classic Upgrade,” which requires you to re-enter the configuration parameters. Since each version of AGPM is associated with a particular operating system, refer to [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=254350), and be sure to upgrade your operating system as appropriate before performing an upgrade. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          AGPM Version From Which You Can Upgrade

          2.5

          3.0

          4.0

          4.0 SP1

          2.5

          Not Applicable

          Classic Upgrade

          Classic Upgrade

          Installation is blocked

          3.0

          Not Applicable

          Not Applicable

          Classic Upgrade

          Installation is blocked

          4.0

          Not Applicable

          Not Applicable

          Not Applicable

          Smart Upgrade

          - -  - -## Supported configurations - - -AGPM supports the configurations in the following table. Although AGPM supports mixed configurations, it is strongly recommended that you run the AGPM client and server on the same operating system family, for example, Windows 8 with Windows Server 2012, Windows 7 with Windows Server 2008 R2, and so on. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Supported Configurations for AGPM 4.0 SP1 Server

          Supported Configurations for AGPM 4.0 SP1 Client

          AGPM 4.0 SP1 Support

          Windows 8 or Windows Server 2012

          Windows 8 or Windows Server 2012

          Supported

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8

          Windows Server 2008 R2 or Windows 7 or Windows 8 or Windows Server 2012

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 or Windows 8.

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 R2 or Windows 7 or Windows 8 or Windows Server 2012

          Supported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 or Windows 8

          - -  - -## Prerequisites for installing AGPM 4.0 SP1 - - -The following table describes the behavior on Windows 8 of AGPM 4.0 SP1 client and server installers when .NET 3.5 or the Group Policy Management Console in the Remote Server Administration Tools (RSAT) is missing. - -**AGPM Client 4.0 SP1** - -**AGPM Server 4.0 SP1** - -**Operating System** - -**.NET** - -**RSAT** - -**.NET** - -**RSAT** - -**Windows 8** - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled or installed on the system, the installer blocks the installation. - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled or installed on the system, the installer blocks the installation. - -**Windows Server 2012** - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled, the installer enables it during the installation. - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled, the installer enables it during the installation. - -  - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40-sp2.md b/mdop/agpm/whats-new-in-agpm-40-sp2.md deleted file mode 100644 index 407487d485..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40-sp2.md +++ /dev/null @@ -1,242 +0,0 @@ ---- -title: What's New in AGPM 4.0 SP2 -description: What's New in AGPM 4.0 SP2 -author: dansimp -ms.assetid: 5c0dcab4-f27d-4153-8b8e-b280b080be51 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in AGPM 4.0 SP2 - - -This content describes enhancements and supported configurations for Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 2 (SP2). If there is a difference between this content and other AGPM documentation, consider this content authoritative and assume that it supersedes the other documentation. - -## What’s new - - -AGPM 4.0 SP2 supports the following features and functionality. - -### Support for Windows 8.1 and Windows Server 2012 R2 - -AGPM 4.0 SP2 adds support for the Windows 8.1 and Windows Server 2012 R2 operating systems. - -### New and changed client-side extensions - -Group Policy client-side extensions have been added or changed for AGPM to support new policy settings in Windows 8.1. These policy settings enable Group Policy administrators to manage and track Windows 8.1–specific policy settings that change between two Group Policy Objects (GPOs) or templates. To view your client-side extensions, use the settings and difference reports that are available in the AGPM Client. - -The new and changed Group Policy client-side extensions are: - -- **Specify Work Folders settings**. If you enable this policy setting, IT administrators can configure Work Folders to be created automatically. The Work Folders feature enables end users to synchronize files from their Windows desktop devices to their other devices. Use this policy setting to create the synchronization relationship on an end user’s devices and to configure how to identify the file server that stores the user’s Work Folders. If you select the **Auto provision synchronization** check box, the synchronization partnership will be created without user input, and data will automatically start synchronizing to the user’s device. If you do not select the **Auto provision synchronization** check box, users must provide input to start the synchronization. - -- **Force automatic setup for all users**. If you enable this policy setting, IT administrators can determine whether to create the Work Folders partnership automatically on end-user devices without input from end users. If you enable this policy setting, the synchronization will be set up according to how you configure the **Specify Work Folders settings** policy setting. If you set the **Force automatic setup for all users** policy setting to **Disabled** or **Not configured**, the Work Folders partnership will be configured according to how you set the **Automatic Provisioning** option in the **Specify Work Folders settings** policy setting. - -For more information about the Work Folders feature, see [Work Folders Overview](https://go.microsoft.com/fwlink/?LinkId=330444). - -### Customer feedback and hotfix rollup - -AGPM 4.0 SP2 includes a rollup of hotfixes to address issues found since the AGPM 4.0 Service Pack 1 (SP1) release. AGPM 4.0 SP2 contains the latest fixes up to and including Microsoft Advanced Group Policy Management 4.0 SP1 Hotfix 1. For more information, see Knowledge Base article [2873472](https://go.microsoft.com/fwlink/?LinkId=325400)). - -### New Group Policy extensions in settings and difference reports - -The new Group Policy extensions have been added to the settings and difference reports. - -### Installer changes and support - -The changes and support for the AGPM 4.0 SP2 installer are: - -- If you install AGPM 4.0 SP2 on the Windows 8 or Windows Server 2012 operating system or later operating systems, the AGPM installer verifies that the required prerequisite software (the Group Policy Management Console (GPMC) and the Microsoft .NET Framework 3.5) is installed. If this prerequisite software is not installed, the AGPM 4.0 SP2 installation is blocked. - -- When you install the AGPM Server, WCF Activation, Non-HTTP Activation, and Windows Process Activation Service are automatically enabled. - -- On the Windows Vista client operating system and later operating systems, download the appropriate version of the Remote System Administration Tools for your operating system before you install AGPM 4.0 SP2. - -- AGPM 4.0 SP2 supports backward compatibility with older supported operating systems. - -### Ability to upgrade to AGPM 4.0 SP2 without reentering configuration parameters - -You can upgrade the AGPM Client or AGPM Server to AGPM 4.0 SP2 without being prompted to reenter configuration parameters (called the Smart Upgrade) only from AGPM 4.0 onward, as shown in the following table. If you are upgrading to AGPM 4.0 SP2 from other versions of AGPM, as shown in the table, you must use the Classic Upgrade, which requires you to reenter the configuration parameters. Because each version of AGPM is associated with a particular operating system, see [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=254350) and make sure that you upgrade your operating system as appropriate before you upgrade AGPM. - -**AGPM 4.0 SP2 supported upgrades** - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          AGPM version from which you can upgrade

          2.5

          3.0

          4.0

          4.0 SP1

          4.0 SP2

          2.5

          Not applicable

          Classic Upgrade

          Classic Upgrade

          Installation is blocked

          Installation is blocked

          3.0

          Not applicable

          Not applicable

          Classic Upgrade

          Installation is blocked

          Installation is blocked

          4.0

          Not applicable

          Not applicable

          Not applicable

          Smart Upgrade

          Smart Upgrade

          4.0 SP1

          Not applicable

          Not applicable

          Not applicable

          Not applicable

          Smart Upgrade

          - -  - -## Supported configurations - - -AGPM 4.0 SP2 supports the configurations in the following table. Although AGPM supports mixed configurations, we strongly recommend that you run the AGPM Client and AGPM Server on the same operating system line—for example, Windows 8.1 with Windows Server 2012 R2, Windows 8 with Windows Server 2012, and so on. - -**AGPM 4.0 SP2 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

          Windows Server 2012 R2 or Windows 8.1

          Windows Server 2012 R2 or Windows 8.1

          Supported

          Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8

          Windows Server 2012 or Windows 8

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8

          Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

          Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

          Not supported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

          - -  - -## Prerequisites for installing AGPM 4.0 SP2 - - -The following table describes the behavior of AGPM 4.0 SP2 Client and Server installers on Windows 8.1 when the .NET Framework 3.5 or the GPMC in the Remote Server Administration Tools is missing. - -**AGPM Client** - -**AGPM Server** - -**Operating system** - -**.NET Framework** - -**Remote Server Administration Tools** - -**.NET Framework** - -**Remote Server Administration Tools** - -**Windows 8.1** - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled or installed, the installer blocks the installation. - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled or installed, the installer blocks the installation. - -**Windows Server 2012 R2** - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled, the installer enables it during the installation. - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled, the installer enables it during the installation. - -  - -## How to Get MDOP Technologies - - -AGPM 4.0 SP2 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) - -[Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md) - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40-sp3.md b/mdop/agpm/whats-new-in-agpm-40-sp3.md deleted file mode 100644 index 4e65034c54..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40-sp3.md +++ /dev/null @@ -1,210 +0,0 @@ ---- -title: What's New in AGPM 4.0 SP3 -description: What's New in AGPM 4.0 SP3 -author: dansimp -ms.assetid: df495d55-9fbf-4f7e-a7af-3905f4f8790e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/27/2016 ---- - - -# What's New in AGPM 4.0 SP3 - - -This content describes enhancements and supported configurations for Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 3 (SP3). If there is a difference between this content and other AGPM documentation, consider this content authoritative and assume that it supersedes the other documentation. - -## What’s new - - -AGPM 4.0 SP3 supports the following features and functionality. - -### Support for Windows 10 - -AGPM 4.0 SP3 adds support for the Windows 10 and Windows Server 2016 operating systems. - -### Support for PowerShell - -AGPM 4.0 SP3 adds support for PowerShell cmdlets. For a list of the cmdlets available in AGPM 4.0 SP3, including descriptions and syntax, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx). - -### Customer feedback and hotfix rollup - -AGPM 4.0 SP3 includes a rollup of all fixes up to and including Microsoft Advanced Group Policy Management 4.0 SP2 and any fixes for issues found since AGPM 4.0 SP2. - -### Ability to upgrade to AGPM 4.0 SP3 without re-entering configuration parameters - -You can upgrade the AGPM Client or AGPM Server to AGPM 4.0 SP3 without being prompted to re-enter configuration parameters (called the Smart Upgrade) only from AGPM 4.0 and later, as shown in the following table. If you are upgrading to AGPM 4.0 SP3 from other versions of AGPM, as shown in the table, you must use the Classic Upgrade, which requires you to re-enter the configuration parameters. Because each version of AGPM is associated with a particular operating system, see [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=254350) and make sure that you upgrade your operating system as appropriate before you upgrade AGPM. - -**AGPM 4.0 SP3 supported upgrades** - - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          AGPM version from which you can upgrade

          2.5

          3.0

          4.0

          4.0 SP1

          4.0 SP2

          4.0 SP3

          2.5

          Not applicable

          Classic Upgrade

          Classic Upgrade

          Installation is blocked

          Installation is blocked

          Installation is blocked

          3.0

          Not applicable

          Not applicable

          Classic Upgrade

          Installation is blocked

          Installation is blocked

          Installation is blocked

          4.0

          Not applicable

          Not applicable

          Not applicable

          Smart Upgrade

          Smart Upgrade

          Smart Upgrade

          4.0 SP1

          Not applicable

          Not applicable

          Not applicable

          Not applicable

          Smart Upgrade

          Smart Upgrade

          4.0 SP2

          Not applicable

          Not applicable

          Not applicable

          Not applicable

          Not applicable

          Smart Upgrade

          - -  - -## Supported configurations - - -AGPM 4.0 SP3 supports the configurations in the following table. Although AGPM supports mixed configurations, we strongly recommend that you run the AGPM Client and AGPM Server on the same operating system line—for example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -**AGPM 4.0 SP3 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

          Windows Server 2016 or Windows 10

          Windows 10

          Supported

          Windows Server 2012 R2 or Windows 8.1

          Windows Server 2012 R2 or Windows 8.1

          Supported

          Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

          Windows Server 2012

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

          Windows Server 2012, Windows Server 2008 R2, or Windows 7

          Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2012, Windows Server 2008 R2, or Windows 7

          Not supported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

          - -  - -## Prerequisites for installing AGPM 4.0 SP3 - -The following table describes the behavior of AGPM 4.0 SP3 Client and Server installers when the .NET Framework 4.5.1, PowerShell 3.0, or the GPMC in the Remote Server Administration Tools is missing. - -| AGPM Client | | | AGPM Server | | | -|------------------------|-------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|---------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------| -| Operating system | .NET Framework | PowerShell | Remote Server Administration Tools | .NET Framework | Remote Server Administration Tools | -| Windows 10 | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If Powershell 3.0 is not installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | -| Windows 8.1 | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If Powershell 3.0 is not installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | -| Windows Server 2012 R2 | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If Powershell 3.0 is not installed, the installer blocks the installation. | If the GPMC is not enabled, the installer enables it during the installation. | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If the GPMC is not enabled, the installer enables it during the installation. | - -  - -## How to Get MDOP Technologies - - -AGPM 4.0 SP3 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) - -[Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md) - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40.md b/mdop/agpm/whats-new-in-agpm-40.md deleted file mode 100644 index 280c395196..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: What's New in AGPM 4.0 -description: What's New in AGPM 4.0 -author: dansimp -ms.assetid: 31775f7f-a59c-4e64-a875-0adc9f5bc835 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in AGPM 4.0 - - -Microsoft Advanced Group Policy Management (AGPM) 4.0 includes new features that let you search for Group Policy Objects (GPOs), filter the list of GPOs displayed, export and import a GPO to a different forest, and install AGPM on computers running Windows 7 and Windows Server 2008 R2. - -## Search and filter GPOs - - -In AGPM 4.0, you can search the list of GPOs for specific attributes to filter the list of GPOs displayed. For example, you can search for GPOs with a particular name, state, or comment. You can also search for GPOs that were last changed by a particular Group Policy administrator or on a particular date. - -You can create a complex search string by using the format *GPO attribute 1: search text 1 GPO attribute 2: search text 2…*, where a GPO attribute is any column heading in the list of GPOs in AGPM. For example, to search for all GPOs with names including the text "MyGPO" that are checked in and were last changed by the user Editor03, you would type the following in the Search box: **name: MyGPO state:** **checked in** **changed by: Editor03**. The search returns partial matches so that you can enter part of a GPO name or user name and view a list of all GPOs that include that text in their name. - -Additionally, you can use the same special terms available when you search in Windows to search for GPOs changed on a specific date or range of dates. For example, **change date:** **lastmonth** or **change date:** **thisweek**. - -## Export and import GPOs to different forests - - -Using AGPM 4.0, you can copy a controlled GPO from a domain in one forest to a domain in a second forest. For example, you can export a GPO from a domain in one forest to a CAB file by using AGPM, copy that CAB file to a USB drive, plug the USB drive into a computer in a domain in a second forest, and import the GPO into AGPM in a domain in the second forest. You can either import the GPO as a new controlled GPO, or import it to replace the settings of an existing GPO that is checked out. - -## Support for Windows Server 2008 R2 and Windows 7 - - -AGPM 4.0 supports Windows Server 2008 R2 and Windows 7, yet still supports Windows Server 2008 and Windows Vista® with Service Pack 1 (SP1). However, there are limitations in a mixed environment that includes both the newer and older operating systems, as indicated in the following table. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating system on which AGPM Server 4.0 runsOperating system on which AGPM Client 4.0 runsStatus of AGPM 4.0 support

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 R2 or Windows 7

          Supported

          Windows Server 2008 R2 or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 R2 or Windows 7

          Unsupported

          Windows Server 2008 or Windows Vista with SP1

          Windows Server 2008 or Windows Vista with SP1

          Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

          - -  - -  - -  - - - - - diff --git a/mdop/appv-v4/TOC.md b/mdop/appv-v4/TOC.md deleted file mode 100644 index 743199d765..0000000000 --- a/mdop/appv-v4/TOC.md +++ /dev/null @@ -1,649 +0,0 @@ -# [Application Virtualization 4](index.md) -## [Getting Started Guide](microsoft-application-virtualization-getting-started-guide.md) -### [Overview of Application Virtualization](overview-of-application-virtualization.md) -### [Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -#### [Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -#### [Planning the Application Virtualization Sequencer Implementation](planning-the-application-virtualization-sequencer-implementation.md) -#### [Using Electronic Software Distribution as a Package Management Solution](using-electronic-software-distribution-as-a-package-management-solution.md) -##### [Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) -##### [Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) -#### [Using Application Virtualization Servers as a Package Management Solution](using-application-virtualization-servers-as-a-package-management-solution.md) -##### [Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) -##### [Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) -##### [Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) -#### [Planning for Application Virtualization Client Deployment](planning-for-application-virtualization-client-deployment.md) -#### [Planning for Migration from Previous Versions](planning-for-migration-from-previous-versions.md) -#### [Planning for Security and Protection](planning-for-security-and-protection.md) -##### [Security and Protection Overview](security-and-protection-overview.md) -##### [Planning for Server Security](planning-for-server-security.md) -##### [Planning for Client Security](planning-for-client-security.md) -##### [Planning for Sequencer Security](planning-for-sequencer-security.md) -### [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations-copy.md) -#### [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -##### [Application Virtualization System Requirements](application-virtualization-system-requirements.md) -##### [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -##### [Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) -#### [Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) -##### [App-V Pre-Installation Checklist](app-v-pre-installation-checklist.md) -##### [App-V Installation Checklist](app-v-installation-checklist.md) -##### [App-V Postinstallation Checklist](app-v-postinstallation-checklist.md) -##### [App-V Upgrade Checklist](app-v-upgrade-checklist.md) -#### [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -##### [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) -##### [How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md) -##### [How to Install the Management Web Service](how-to-install-the-management-web-service.md) -##### [How to Install the Management Console](how-to-install-the-management-console.md) -##### [How to Install a Database](how-to-install-a-database.md) -##### [How to Remove the Application Virtualization System Components](how-to-remove-the-application-virtualization-system-components.md) -#### [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -#### [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -#### [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -#### [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -#### [How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -### [About Microsoft Application Virtualization 4.5](about-microsoft-application-virtualization-45.md) -#### [App-V 4.5 Release Notes](microsoft-application-virtualization-management-system-release-notes.md) -### [About Microsoft Application Virtualization 4.5 SP1](about-microsoft-application-virtualization-45-sp1.md) -#### [App-V 4.5 SP1 Release Notes](microsoft-application-virtualization-management-system-release-notes-45-sp1.md) -### [About Microsoft Application Virtualization 4.5 SP2](about-microsoft-application-virtualization-45-sp2.md) -#### [App-V 4.5 SP2 Release Notes](app-v-45-sp2-release-notes.md) -### [About Microsoft Application Virtualization 4.6](about-microsoft-application-virtualization-46.md) -#### [App-V 4.6 Release Notes](app-v-46-release-notes.md) -### [About Microsoft Application Virtualization 4.6 SP1](about-microsoft-application-virtualization-46-sp1.md) -#### [App-V 4.6 SP1 Release Notes](app-v-46-sp1-release-notes.md) -### [About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md) -#### [App-V 4.6 SP2 Release Notes](app-v-46-sp2-release-notes.md) -### [About Microsoft Application Virtualization 4.6 SP3](about-microsoft-application-virtualization-46-sp3.md) -#### [App-V 4.6 SP3 Release Notes](app-v-46-sp3-release-notes.md) -## [Planning and Deployment](planning-and-deployment-guide-for-the-application-virtualization-system.md) -### [Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -#### [Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -#### [Planning the Application Virtualization Sequencer Implementation](planning-the-application-virtualization-sequencer-implementation.md) -#### [Using Electronic Software Distribution as a Package Management Solution](using-electronic-software-distribution-as-a-package-management-solution.md) -##### [Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) -##### [Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) -#### [Using Application Virtualization Servers as a Package Management Solution](using-application-virtualization-servers-as-a-package-management-solution.md) -##### [Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) -##### [Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) -##### [Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) -#### [Planning for Application Virtualization Client Deployment](planning-for-application-virtualization-client-deployment.md) -#### [Planning for Migration from Previous Versions](planning-for-migration-from-previous-versions.md) -#### [Planning for Security and Protection](planning-for-security-and-protection.md) -##### [Security and Protection Overview](security-and-protection-overview.md) -##### [Planning for Server Security](planning-for-server-security.md) -##### [Planning for Client Security](planning-for-client-security.md) -##### [Planning for Sequencer Security](planning-for-sequencer-security.md) -### [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) -#### [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -##### [Application Virtualization System Requirements](application-virtualization-system-requirements.md) -##### [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -##### [Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) -##### [Configuring Prerequisite Groups in Active Directory for App-V](configuring-prerequisite-groups-in-active-directory-for-app-v.md) -##### [How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md) -#### [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -#### [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -#### [How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -#### [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -### [Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) -#### [Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) -##### [Determine Your Publishing Method](determine-your-publishing-method.md) -##### [Determine Your Streaming Method](determine-your-streaming-method.md) -#### [How to Configure Servers for ESD-Based Deployment](how-to-configure-servers-for-esd-based-deployment.md) -##### [How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -##### [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -##### [How to Configure the File Server](how-to-configure-the-file-server.md) -#### [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) -##### [How to Install the App-V Client by Using Setup.exe](how-to-install-the-app-v-client-by-using-setupexe-new.md) -##### [How to Install the App-V Client by Using Setup.msi](how-to-install-the-app-v-client-by-using-setupmsi-new.md) -#### [How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) -#### [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -### [Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) -#### [Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) -#### [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -##### [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) -##### [How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md) -##### [How to Install the Management Web Service](how-to-install-the-management-web-service.md) -##### [How to Install the Management Console](how-to-install-the-management-console.md) -##### [How to Install a Database](how-to-install-a-database.md) -##### [How to Remove the Application Virtualization System Components](how-to-remove-the-application-virtualization-system-components.md) -#### [How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) -##### [How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) -##### [How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -##### [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -##### [How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md) -##### [Configuring the Firewall for the App-V Servers](configuring-the-firewall-for-the-app-v-servers.md) -##### [How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md) -#### [How to Configure a Read-only Cache on the App-V Client (VDI)](how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md) -#### [How to Configure a Read-only Cache on the App-V Client (RDS)](how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md) -#### [How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -### [Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) -#### [Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md) -#### [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -#### [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -### [Application Virtualization Reference](application-virtualization-reference.md) -#### [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) -#### [SFTMIME Command Reference](sftmime--command-reference.md) -##### [ADD APP](add-app.md) -##### [ADD PACKAGE](add-package.md) -##### [ADD SERVER](add-server.md) -##### [ADD TYPE](add-type.md) -##### [CLEAR APP](clear-app.md) -##### [CLEAR OBJ](clear-obj.md) -##### [CONFIGURE APP](configure-app.md) -##### [CONFIGURE PACKAGE](configure-package.md) -##### [CONFIGURE SERVER](configure-server.md) -##### [CONFIGURE TYPE](configure-type.md) -##### [DELETE APP](delete-app.md) -##### [DELETE OBJ](delete-obj.md) -##### [DELETE PACKAGE](delete-package.md) -##### [DELETE SERVER](delete-server.md) -##### [DELETE TYPE](delete-type.md) -##### [HELP](help.md) -##### [LOAD APP](load-app.md) -##### [LOAD PACKAGE](load-package.md) -##### [LOCK APP](lock-app.md) -##### [PUBLISH APP](publish-app.md) -##### [PUBLISH PACKAGE](publish-package.md) -##### [QUERY OBJ](query-obj.md) -##### [REFRESH SERVER](refresh-server.md) -##### [REPAIR APP](repair-app.md) -##### [UNLOAD APP](unload-app.md) -##### [UNLOAD PACKAGE](unload-package.md) -##### [UNLOCK APP](unlock-app.md) -##### [UNPUBLISH PACKAGE](unpublish-package.md) -## [Operations](operations-guide-for-the-application-virtualization-system.md) -### [Application Virtualization Client](application-virtualization-client.md) -#### [How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -##### [How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Cancel Loading of Virtual Applications from the Desktop Notification Area](how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) -##### [How to Exit the App-V Client from the Notification Area](how-to-exit-the-app-v-client-from-the-notification-area.md) -#### [How to Manage Virtual Applications Manually](how-to-manage-virtual-applications-manually.md) -##### [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) -##### [How to Clear an Application](how-to-clear-an-application.md) -##### [How to Repair an Application](how-to-repair-an-application.md) -##### [How to Import an Application](how-to-import-an-application.md) -##### [How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) -##### [How to Delete an Application](how-to-delete-an-application.md) -##### [How to Change an Application Icon](how-to-change-an-application-icon.md) -##### [How to Add an Application](how-to-add-an-application.md) -##### [How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) -##### [How to Add a File Type Association](how-to-add-a-file-type-association.md) -##### [How to Delete a File Type Association](how-to-delete-a-file-type-association.md) -#### [How to Configure the Application Virtualization Client Settings Manually](how-to-configure-the-application-virtualization-client-settings-manually.md) -##### [How to Perform General Administrative Tasks in the App-V Client Management Console](how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md) -###### [How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -###### [How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -###### [How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -###### [User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -###### [Disconnected Operation Mode](disconnected-operation-mode.md) -##### [How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -###### [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) -###### [How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) -###### [How to Change User Access Permissions](how-to-change-user-access-permissions.md) -###### [How to Change Import Search Paths](how-to-change-import-search-paths.md) -###### [How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) -###### [How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) -#### [How to Manage Virtual Applications by Using the Command Line](how-to-manage-virtual-applications-by-using-the-command-line.md) -##### [How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) -##### [How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) -##### [How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) -##### [How to Manage the App-V Client Cache Using Performance Counters](how-to-manage-the-app-v-client-cache-using-performance-counters.md) -#### [How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) -##### [How to Reset the FileSystem Cache](how-to-reset-the-filesystem-cache.md) -##### [How to Change the Size of the FileSystem Cache](how-to-change-the-size-of-the-filesystem-cache.md) -##### [How to Use the Cache Space Management Feature](how-to-use-the-cache-space-management-feature.md) -##### [How to Configure the Client Log File](how-to-configure-the-client-log-file.md) -##### [How to Configure User Permissions](how-to-configure-user-permissions.md) -##### [How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md) -##### [How to Configure the Client for Disconnected Operation Mode](how-to-configure-the-client-for-disconnected-operation-mode.md) -##### [How to Configure Shortcut and File Type Association Behavior](how-to-configure-shortcut-and-file-type-association-behavior-46-only.md) -##### [How to Configure the Client for MIT Kerberos Realm Support](how-to-configure-the-client-for-mit-kerberos-realm-support.md) -#### [Troubleshooting Information for the Application Virtualization Client](troubleshooting-information-for-the-application-virtualization-client.md) -#### [Application Virtualization Client Reference](application-virtualization-client-reference.md) -##### [SFTMIME Command Reference](sftmime--command-reference.md) -###### [ADD APP](add-app.md) -###### [ADD PACKAGE](add-package.md) -###### [ADD SERVER](add-server.md) -###### [ADD TYPE](add-type.md) -###### [CLEAR APP](clear-app.md) -###### [CLEAR OBJ](clear-obj.md) -###### [CONFIGURE APP](configure-app.md) -###### [CONFIGURE PACKAGE](configure-package.md) -###### [CONFIGURE SERVER](configure-server.md) -###### [CONFIGURE TYPE](configure-type.md) -###### [DELETE APP](delete-app.md) -###### [DELETE OBJ](delete-obj.md) -###### [DELETE PACKAGE](delete-package.md) -###### [DELETE SERVER](delete-server.md) -###### [DELETE TYPE](delete-type.md) -###### [HELP](help.md) -###### [LOAD APP](load-app.md) -###### [LOAD PACKAGE](load-package.md) -###### [LOCK APP](lock-app.md) -###### [PUBLISH APP](publish-app.md) -###### [PUBLISH PACKAGE](publish-package.md) -###### [QUERY OBJ](query-obj.md) -###### [REFRESH SERVER](refresh-server.md) -###### [REPAIR APP](repair-app.md) -###### [UNLOAD APP](unload-app.md) -###### [UNLOAD PACKAGE](unload-package.md) -###### [UNLOCK APP](unlock-app.md) -###### [UNPUBLISH PACKAGE](unpublish-package.md) -##### [SFTTRAY Command Reference](sfttray-command-reference.md) -##### [Application Virtualization Client WMI Provider](application-virtualization-client-wmi-provider.md) -###### [App-V Application WMI Class](app-v-application-wmi-class.md) -###### [App-V Package WMI Class](app-v-package-wmi-class.md) -##### [Log File for the Application Virtualization Client](log-file-for-the-application-virtualization-client.md) -##### [App-V Client Registry Values](app-v-client-registry-values-sp1.md) -##### [App-V Interoperability with Windows AppLocker](app-v-interoperability-with-windows-applocker.md) -##### [Support for Client Reporting over HTTP](support-for-client-reporting-over-http.md) -### [Application Virtualization Server](application-virtualization-server.md) -#### [Monitoring Application Virtualization Servers](monitoring-application-virtualization-servers.md) -#### [How to Load Files and Packages](how-to-load-files-and-packages.md) -#### [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -##### [How to Connect to an Application Virtualization System](how-to-connect-to-an-application-virtualization-system.md) -##### [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) -###### [How to Import an Application](how-to-import-an-applicationserver.md) -###### [How to Rename an Application](how-to-rename-an-application.md) -###### [How to Delete an Application](how-to-delete-an-application-server.md) -###### [How to Manually Add an Application](how-to-manually-add-an-application.md) -###### [How to Move an Application](how-to-move-an-application.md) -###### [How to Grant Access to an Application](how-to-grant-access-to-an-application.md) -###### [How to Deny Access to an Application](how-to-deny-access-to-an-application.md) -###### [How to Change an Application Icon](how-to-change-an-application-iconserver.md) -##### [How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) -###### [How to Create an Application Group](how-to-create-an-application-group.md) -###### [How to Move an Application Group](how-to-move-an-application-group.md) -###### [How to Rename an Application Group](how-to-rename-an-application-group.md) -###### [How to Remove an Application Group](how-to-remove-an-application-group.md) -##### [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) -###### [How to Add a Package](how-to-add-a-package.md) -###### [How to Add a Package Version](how-to-add-a-package-version.md) -###### [How to Delete a Package](how-to-delete-a-packageserver.md) -###### [How to Delete a Package Version](how-to-delete-a-package-version.md) -###### [How to Upgrade a Package](how-to-upgrade-a-package.md) -##### [How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) -###### [Application Virtualization Report Types](application-virtualization-report-types.md) -####### [System Utilization Report](system-utilization-reportserver.md) -####### [Software Audit Report](software-audit-reportserver.md) -####### [Application Utilization Report](application-utilization-reportserver.md) -####### [System Error Report](system-error-reportserver.md) -###### [How to Create a Report](how-to-create-a-reportserver.md) -###### [How to Run a Report](how-to-run-a-reportserver.md) -###### [How to Print a Report](how-to-print-a-reportserver.md) -###### [How to Export a Report](how-to-export-a-reportserver.md) -###### [How to Delete a Report](how-to-delete-a-reportserver.md) -##### [How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) -###### [How to Create a Server Group](how-to-create-a-server-group.md) -###### [How to Remove a Server Group](how-to-remove-a-server-group.md) -###### [How to Add a Server](how-to-add-a-server.md) -###### [How to Remove a Server](how-to-remove-a-server.md) -###### [How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) -###### [How to Change the Server Port](how-to-change-the-server-port.md) -##### [How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) -###### [How to Create an Application License Group](how-to-create-an-application-license-group.md) -###### [How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) -###### [How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) -###### [How to Remove an Application License Group](how-to-remove-an-application-license-group.md) -###### [How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) -###### [How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) -###### [How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) -##### [How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) -###### [How to Set Up and Enable or Disable Authentication](how-to-set-up-and-enable-or-disable-authentication.md) -###### [How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) -###### [How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) -###### [How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) -###### [How to Add an Administrator Group](how-to-add-an-administrator-group.md) -###### [How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) -##### [How to Change the Server Logging Level and the Database Parameters](how-to-change-the-server-logging-level-and-the-database-parameters.md) -#### [How to Configure the App-V System for Package Upgrade](how-to-configure-the-app-v-system-for-package-upgrade.md) -#### [Troubleshooting Information for the Application Virtualization Server](troubleshooting-information-for-the-application-virtualization-server.md) -#### [How to Migrate the App-V SQL Database to a Different SQL Server](how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md) -### [Application Virtualization Sequencer](application-virtualization-sequencer.md) -#### [Application Virtualization Sequencer Console Overview](application-virtualization-sequencer-console-overview.md) -#### [About Sequencing Phases](about-sequencing-phases.md) -#### [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md) -#### [How to Determine Whether to Edit or Upgrade a Virtual Application Package](how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md) -#### [How to Configure the App-V Sequencer](how-to-configure-the-app-v-sequencer.md) -##### [How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) -##### [How to Create the Sequencer Package Root Directory](how-to-create-the-sequencer-package-root-directory.md) -##### [How to Modify the Scratch Directory Location](how-to-modify-the-scratch-directory-location.md) -#### [Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) -##### [How to Install the Sequencer (App-V 4.6 SP1)](how-to-install-the-sequencer---app-v-46-sp1-.md) -##### [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md) -#### [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) -##### [How to Sequence an Application](how-to-sequence-an-application.md) -##### [How to Sequence a New Application (App-V 4.6)](how-to-sequence-a-new-application--app-v-46-.md) -##### [How to Edit an Existing Virtual Application](how-to-edit-an-existing-virtual-application.md) -##### [How to Modify a Virtual Application Package (App-V 4.6)](how-to-modify-a-virtual-application-package--app-v-46-.md) -##### [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) -##### [How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) -##### [How to Modify the Operating Systems Associated With an Existing Windows Installer File](how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md) -##### [How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md) -##### [How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md) -##### [How To Use Dynamic Suite Composition](how-to-use-dynamic-suite-composition.md) -##### [How to Use the Differential SFT File](how-to-use-the-differential-sft-file.md) -#### [Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) -##### [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) -##### [How to Sequence a New Standard Application (App-V 4.6 SP1)](how-to-sequence-a-new-standard-application--app-v-46-sp1-.md) -##### [How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)](how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md) -##### [How to Sequence a New Middleware Application (App-V 4.6 SP1)](how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md) -##### [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) -##### [How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) -##### [How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md) -##### [How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) -#### [Troubleshooting Application Virtualization Sequencer Issues](troubleshooting-application-virtualization-sequencer-issues.md) -#### [Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) -##### [Log Files for the Application Virtualization Sequencer](log-files-for-the-application-virtualization-sequencer.md) -##### [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) -##### [Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) -##### [Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) -###### [Incompatible Installer Dialog Box (App-V 4.6 SP1)](incompatible-installer-dialog-box--app-v-46-sp1-.md) -###### [Failed Launch Dialog Box (App-V 4.6 SP1)](failed-launch-dialog-box--app-v-46-sp1-.md) -###### [Oversized Package Dialog Box (App-V 4.6 SP1)](oversized-package-dialog-box--app-v-46-sp1-.md) -###### [Restart Task Failure Dialog Box (App-V 4.6 SP1)](restart-task-failure-dialog-box--app-v-46-sp1-.md) -###### [Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1)](side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md) -###### [SXS Conflict Detected Dialog Box (App-V 4.6 SP1)](sxs-conflict-detected-dialog-box--app-v-46-sp1-.md) -###### [Files Excluded Page Dialog Box (App-V 4.6 SP1)](files-excluded-page-dialog-box--app-v-46-sp1-.md) -###### [Defender Running Dialog Box (App-V 4.6 SP1)](defender-running-dialog-box--app-v-46-sp1-.md) -###### [Defrag Running Dialog Box (App-V 4.6 SP1)](defrag-running-dialog-box--app-v-46-sp1-.md) -###### [Antivirus Running Dialog Box (App-V 4.6 SP1)](antivirus-running-dialog-box--app-v-46-sp1-.md) -##### [Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) -###### [Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) -####### [About Sharing Package Accelerators Page](about-sharing-package-accelerators-page.md) -####### [Select Package (Learn More) Page](select-package--learn-more--page.md) -####### [Installation Files Page](installation-files-page.md) -####### [Gathering Information Page (Learn More)](gathering-information-page--learn-more-.md) -####### [Select Files Page](select-files-page.md) -####### [Verify Applications Page (Package Accelerators)](verify-applications-page--package-accelerators-.md) -####### [Select Guidance Page (Package Accelerators)](select-guidance-page--package-accelerators-.md) -####### [Create Package Accelerator Page](create-package-accelerator-page.md) -####### [Create Package Accelerator (Review Errors) Page](create-package-accelerator--review-errors--page.md) -####### [Completion Page](completion-page.md) -###### [Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) -####### [Packaging Method Page (Learn More)](packaging-method-page--learn-more-.md) -####### [Prepare Computer Page (Learn More)](prepare-computer-page--learn-more-.md) -####### [Type of Application Page (Learn More)](type-of-application-page--learn-more-.md) -####### [Select Installer Page (Learn More)](select-installer-page--learn-more-.md) -####### [Package Name Page (Learn More)](package-name-page---learn-more-.md) -####### [Installation Page (Learn More)](installation-page--learn-more-.md) -####### [Configure Software Page (Learn More)](configure-software-page--learn-more-.md) -####### [Installation Report Page (Learn More)](installation-report-page--learn-more-.md) -####### [Customize Page (Learn More)](customize-page--learn-more-.md) -######## [Edit Shortcuts](edit-shortcuts-learn-more.md) -######## [Streaming Page](streaming-page-learn-more.md) -######## [Target OS Page](target-os-page-learn-more.md) -####### [Select Primary Page (Learn More)](select-primary-page--learn-more-.md) -###### [Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) -####### [Select Task Page (Learn More)](select-task-page--learn-more-.md) -####### [Packaging Method (Learn More)](packaging-method--learn-more-.md) -###### [Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) -####### [Select Package Accelerator Page](select-package-accelerator-page.md) -####### [Select Package Accelerator (Learn More) Page](select-package-accelerator--learn-more--page.md) -####### [Guidance Page [App-V 4.6 SP1]](guidance-page-app-v-46-sp1.md) -####### [Select Installation Files Page [App-V 4.6 SP1]](select-installation-files-page-app-v-46-sp1.md) -####### [Package Name Page [App-V 4.6 SP1]](package-name-page--app-v-46-sp1.md) -####### [Create Package Page [App-V 4.6 SP1]](create-package-page--app-v-46-sp1.md) -####### [Configure Software Page [App-V 4.6 SP1]](configure-software-page-app-v-46-sp1.md) -####### [Run Each Program Page [App-V 4.6 SP1]](run-each-program-page-app-v-46-sp1.md) -####### [Completion Page [Package Accelerator]](completion-page-package-accelerator.md) -## [Online Help for Application Virtualization](online-help-for-application-virtualization.md) -### [Application Virtualization Client Help](microsoft-application-virtualization-client-management-help.md) -#### [Application Virtualization Client Management Console Roadmap](application-virtualization-client-management-console-roadmap.md) -#### [About Virtual Environments](about-virtual-environments.md) -#### [How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -##### [How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Cancel Loading of Virtual Applications from the Desktop Notification Area](how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) -##### [How to Exit the App-V Client from the Notification Area](how-to-exit-the-app-v-client-from-the-notification-area.md) -#### [Application Virtualization Client Management Console](application-virtualization-client-management-console.md) -##### [Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) -###### [About Application Virtualization Servers](about-application-virtualization-servers.md) -###### [User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -###### [Disconnected Operation Mode](disconnected-operation-mode.md) -##### [How to Perform General Administrative Tasks in the Client Management Console](how-to-perform-general-administrative-tasks-in-the-client-management-console.md) -###### [How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -###### [How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -###### [How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -##### [How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) -###### [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) -###### [How to Clear an Application](how-to-clear-an-application.md) -###### [How to Repair an Application](how-to-repair-an-application.md) -###### [How to Import an Application](how-to-import-an-application.md) -###### [How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) -###### [How to Delete an Application](how-to-delete-an-application.md) -###### [How to Change an Application Icon](how-to-change-an-application-icon.md) -##### [How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -###### [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) -###### [How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) -###### [How to Change User Access Permissions](how-to-change-user-access-permissions.md) -###### [How to Change Import Search Paths](how-to-change-import-search-paths.md) -###### [How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) -###### [How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) -##### [How to Manually Manage Applications in the Client Management Console](how-to-manually-manage-applications-in-the-client-management-console.md) -###### [How to Add an Application](how-to-add-an-application.md) -###### [How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) -###### [How to Add a File Type Association](how-to-add-a-file-type-association.md) -###### [How to Delete a File Type Association](how-to-delete-a-file-type-association.md) -#### [Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) -##### [Client Management Console: Application Virtualization Node](client-management-console-application-virtualization-node.md) -##### [Client Management Console: About Dialog Boxes](client-management-console-about-dialog-boxes.md) -##### [Client Management Console: Applications Node](client-management-console-applications-node.md) -###### [Applications Node](applications-node.md) -###### [Applications Results Pane](applications-results-pane.md) -###### [Applications Results Pane Columns](applications-results-pane-columns.md) -##### [Client Management Console: File Type Associations Node](client-management-console-file-type-associations-node.md) -###### [File Type Associations Node](file-type-associations-node-client.md) -###### [File Type Association Results Pane](file-type-association-results-pane.md) -###### [File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) -##### [Client Management Console: Publishing Servers Node](client-management-console-publishing-servers-node.md) -###### [Publishing Servers Node](publishing-servers-node.md) -###### [Publishing Servers Results Pane](publishing-servers-results-pane.md) -###### [Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) -##### [Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) -###### [Application Virtualization Properties: General Tab](application-virtualization-properties-general-tab.md) -###### [Application Virtualization Properties: Interface Tab](application-virtualization-properties-interface-tab.md) -###### [Application Virtualization Properties: File System Tab](application-virtualization-properties-file-system-tab.md) -###### [Application Virtualization Properties: Import Search Path Tab](application-virtualization-properties-import-search-path-tab.md) -###### [Application Virtualization Properties: Connectivity Tab](application-virtualization-properties-connectivity-tab.md) -###### [Application Virtualization Properties: Permissions Tab](application-virtualization-properties-permissions-tab.md) -### [Application Virtualization Server Help](application-virtualization-server-management-help.md) -#### [About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) -##### [About Application Virtualization Applications](about-application-virtualization-applications.md) -##### [About Application Virtualization Packages](about-application-virtualization-packages.md) -##### [About Publishing](about-publishing.md) -##### [About Application Licensing](about-application-licensing.md) -#### [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -##### [How to Connect to an Application Virtualization System](how-to-connect-to-an-application-virtualization-system.md) -##### [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) -###### [How to Import an Application](how-to-import-an-applicationserver.md) -###### [How to Rename an Application](how-to-rename-an-application.md) -###### [How to Delete an Application](how-to-delete-an-application-server.md) -###### [How to Manually Add an Application](how-to-manually-add-an-application.md) -###### [How to Move an Application](how-to-move-an-application.md) -###### [How to Grant Access to an Application](how-to-grant-access-to-an-application.md) -###### [How to Deny Access to an Application](how-to-deny-access-to-an-application.md) -###### [How to Change an Application Icon](how-to-change-an-application-iconserver.md) -##### [How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) -###### [How to Create an Application Group](how-to-create-an-application-group.md) -###### [How to Move an Application Group](how-to-move-an-application-group.md) -###### [How to Rename an Application Group](how-to-rename-an-application-group.md) -###### [How to Remove an Application Group](how-to-remove-an-application-group.md) -##### [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) -###### [How to Add a Package](how-to-add-a-package.md) -###### [How to Add a Package Version](how-to-add-a-package-version.md) -###### [How to Delete a Package](how-to-delete-a-packageserver.md) -###### [How to Delete a Package Version](how-to-delete-a-package-version.md) -###### [How to Upgrade a Package](how-to-upgrade-a-package.md) -##### [How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) -###### [Application Virtualization Report Types](application-virtualization-report-types.md) -####### [System Utilization Report](system-utilization-reportserver.md) -####### [Software Audit Report](software-audit-reportserver.md) -####### [Application Utilization Report](application-utilization-reportserver.md) -####### [System Error Report](system-error-reportserver.md) -###### [How to Create a Report](how-to-create-a-reportserver.md) -###### [How to Run a Report](how-to-run-a-reportserver.md) -###### [How to Print a Report](how-to-print-a-reportserver.md) -###### [How to Export a Report](how-to-export-a-reportserver.md) -###### [How to Delete a Report](how-to-delete-a-reportserver.md) -##### [How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) -###### [How to Create a Server Group](how-to-create-a-server-group.md) -###### [How to Remove a Server Group](how-to-remove-a-server-group.md) -###### [How to Add a Server](how-to-add-a-server.md) -###### [How to Remove a Server](how-to-remove-a-server.md) -###### [How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) -###### [How to Change the Server Port](how-to-change-the-server-port.md) -##### [How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) -###### [How to Create an Application License Group](how-to-create-an-application-license-group.md) -###### [How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) -###### [How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) -###### [How to Remove an Application License Group](how-to-remove-an-application-license-group.md) -###### [How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) -###### [How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) -###### [How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) -##### [How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) -###### [How to Set Up and Enable or Disable Authentication](how-to-set-up-and-enable-or-disable-authentication.md) -###### [How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) -###### [How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) -###### [How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) -###### [How to Add an Administrator Group](how-to-add-an-administrator-group.md) -###### [How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) -##### [How to Change the Server Logging Level and the Database Parameters](how-to-change-the-server-logging-level-and-the-database-parameters.md) -##### [How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -#### [Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) -##### [Server Management Console: Application Virtualization System Node](server-management-console-application-virtualization-system-node.md) -##### [Server Management Console: About Dialog Boxes](server-management-console-about-dialog-boxes.md) -##### [Server Management Console: Applications Node](server-management-console-applications-node.md) -###### [Applications Node](applications-node-in-server-management-console.md) -###### [Applications Results Pane](applications-results-pane-in-server-management-console.md) -###### [Applications Results Pane Columns](applications-results-pane-columns-in-server-management-console.md) -##### [Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) -###### [File Type Associations Node](file-type-associations-node.md) -###### [File Type Associations Results Pane](file-type-associations-results-pane.md) -###### [File Type Associations Results Pane Columns](file-type-associations-results-pane-columns.md) -##### [Server Management Console: Packages Node](server-management-console-packages-node.md) -###### [Packages Node](packages-node.md) -###### [Package Results Pane](package-results-pane.md) -###### [Package Results Pane Columns](package-results-pane-columns.md) -##### [Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) -###### [Applications Licenses Node](applications-licenses-node.md) -###### [Applications Licenses Results Pane](applications-licenses-results-pane.md) -###### [Applications Licenses Results Pane Columns](applications-licenses-results-pane-columns.md) -##### [Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) -###### [Server Groups Node](server-groups-node.md) -###### [Server Groups Results Pane](server-groups-results-pane.md) -###### [Server Groups Results Pane Columns](server-groups-results-pane-columns.md) -##### [Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) -###### [Provider Policies Node](provider-policies-node.md) -###### [Provider Policies Results Pane](provider-policies-results-pane.md) -###### [Provider Policies Results Pane Columns](provider-policies-results-pane-columns.md) -##### [Server Management Console: Administrators Node](server-management-console-administrators-node.md) -###### [Administrators Node](administrators-node.md) -###### [Administrators Results Pane](administrators-results-pane.md) -###### [Administrators Results Pane Columns](administrators-results-pane-columns.md) -##### [Server Management Console: Reports Node](server-management-console-reports-node.md) -###### [Reports Node](reports-node.md) -###### [Reports Results Pane](reports-results-pane.md) -###### [Reports Results Pane Columns](reports-results-pane-columns.md) -### [Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) -#### [Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) -##### [About the Application Virtualization Sequencer](about-the-application-virtualization-sequencer.md) -##### [About the Sequencer Console](about-the-sequencer-console.md) -##### [About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) -##### [Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -#### [Sequencer Hardware and Software Requirements](sequencer-hardware-and-software-requirements.md) -#### [Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) -##### [How to Install the Sequencer](how-to-install-the-sequencer.md) -##### [How to Create the Package Root Directory](how-to-create-the-package-root-directory.md) -##### [How to Modify the Location of the Log Directory](how-to-modify-the-location-of-the-log-directory.md) -##### [How to Modify the Location of the Scratch Directory](how-to-modify-the-location-of-the-scratch-directory.md) -#### [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) -##### [How to Sequence a New Application](how-to-sequence-a-new-application.md) -##### [How to Create a Virtual Environment for a Web-Based Application](how-to-create-a-virtual-environment-for-a-web-based-application.md) -##### [How to Upgrade a Sequenced Virtual Application Package](how-to-upgrade-a-sequenced-virtual-application-package.md) -##### [How to Branch a Package](how-to-branch-a-package.md) -##### [How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) -##### [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) -###### [How to Open a Sequenced Application Using the Command Line](how-to-open-a-sequenced-application-using-the-command-line.md) -###### [How to Sequence a New Application Package Using the Command Line](how-to-sequence-a-new-application-package-using-the-command-line.md) -###### [How to Upgrade a Sequenced Application Package Using the Command Line](how-to-upgrade-a-sequenced-application-package-using-the-command-line.md) -#### [Troubleshooting the Application Virtualization Sequencer](troubleshooting-the-application-virtualization-sequencer.md) -#### [Application Virtualization Sequencer Technical Reference](application-virtualization-sequencer-technical-reference-keep.md) -##### [Sequencer Dialog Boxes](sequencer-dialog-boxes.md) -###### [Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) -####### [General Tab](general-tab-keep.md) -####### [Parse Items Tab](parse-items-tab-keep.md) -####### [Exclusion Items Tab](exclusion-items-tab-keep.md) -####### [Exclusion Item Dialog Box](exclusion-item-dialog-box.md) -###### [Application Virtualization Sequencing Wizard-Add Application Dialog Box](application-virtualization-sequencing-wizard-add-application-dialog-box.md) -###### [Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box](application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md) -###### [Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box](application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md) -##### [Sequencing Wizard](sequencing-wizard.md) -###### [Package Information Page](application-virtualization-sequencing-wizard-package-information-page-keep.md) -###### [Advanced Options Page](application-virtualization-sequencing-wizard-advanced-options-page.md) -###### [Monitor Installation Page](application-virtualization-sequencing-wizard-monitor-installation-page.md) -###### [Add Files to Virtual File System Page](application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md) -###### [Virtual Application Package Additional Components](virtual-application-package-additional-components.md) -###### [Configure Application Page](application-virtualization-sequencing-wizard-configure-application-page-keep.md) -###### [Launch Applications Page](application-virtualization-sequencing-wizard-launch-applications-page.md) -###### [Sequence Package Page](application-virtualization-sequencing-wizard-sequence-package-page.md) -##### [Sequencer Console](sequencer-console.md) -###### [Properties Tab](properties-tab-keep.md) -####### [About the Properties Tab](about-the-properties-tab.md) -####### [How to Change Package Properties](how-to-change-package-properties.md) -###### [Deployment Tab](deployment-tab.md) -####### [About the Deployment Tab](about-the-deployment-tab.md) -####### [How to Change Deployment Properties](how-to-change-deployment-properties.md) -###### [Change History Tab](change-history-tab-keep.md) -###### [Files Tab](files-tab-keep.md) -####### [About the Files Tab](about-the-files-tab.md) -####### [How to Modify the Files Included in a Package](how-to-modify-the-files-included-in-a-package.md) -###### [Virtual Registry Tab](virtual-registry-tab-keep.md) -####### [About the Virtual Registry Tab](about-the-virtual-registry-tab.md) -####### [How to Modify Virtual Registry Key Information](how-to-modify-virtual-registry-key-information.md) -###### [Virtual File System Tab](virtual-file-system-tab-keep.md) -####### [About the Virtual File System Tab](about-the-virtual-file-system-tab.md) -####### [How to Modify File-Mapping Information](how-to-modify-file-mapping-information.md) -###### [Virtual Services Tab](virtual-services-tab-keep.md) -####### [About the Virtual Services Tab](about-the-virtual-services-tab.md) -####### [How to Modify Attributes of Embedded Services](how-to-modify-attributes-of-embedded-services.md) -###### [OSD Tab](osd-tab-keep.md) -####### [About the OSD Tab](about-the-osd-tab.md) -######## [OSD File Elements](osd-file-elements.md) -####### [How to Edit an OSD File](how-to-edit-an-osd-file.md) -####### [How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) -##### [Application Virtualization Sequencer Command Line](application-virtualization-sequencer-command-line.md) -###### [Command-Line Parameters](command-line-parameters.md) -###### [Command-Line Errors](command-line-errors.md) -## [Glossary](application-virtualization-glossary.md) -## [Application Virtualization Technical Publications](application-virtualization-technical-publications-white-papers.md) -### [Microsoft Application Virtualization Security Guide](microsoft-application-virtualization-security-guide.md) -#### [Introduction](introduction-to-the-application-virtualization-security-guide.md) -#### [Installing App-V Management Server or Streaming Server Securely](installing-app-v-management-server-or-streaming-server-securely.md) -##### [Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) -##### [How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) -##### [Configuring Certificates to Support App-V Management Server or Streaming Server](configuring-certificates-to-support-app-v-management-server-or-streaming-server.md) -#### [Configuring Management or Streaming Server for Secure Communications Post-Installation](configuring-management-or-streaming-server-for-secure-communications-post-installation.md) -##### [How to Configure Management Server Security Post-Installation](how-to-configure-management-server-security-post-installation.md) -##### [How to Configure Streaming Server Security Post-Installation](how-to-configure-streaming-server-security-post-installation.md) -##### [Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) -#### [Configuring Windows Firewall for App-V](configuring-windows-firewall-for-app-v.md) -##### [How to Configure Windows Server 2003 Firewall for App-V](how-to-configure-windows-server-2003-firewall-for-app-v.md) -##### [How to Configure Windows Server 2008 Firewall for App-V](how-to-configure-windows-server-2008-firewall-for-app-v.md) -#### [Configuring App-V for Secure Administration](configuring-app-v-for-secure-administration.md) -##### [Configuring Certificates to Support the App-V Web Management Service](configuring-certificates-to-support-the-app-v-web-management-service.md) -##### [How to Install and Configure the App-V Management Console for a More Secure Environment](how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md) -#### [Configuring App-V Administration for a Distributed Environment](configuring-app-v-administration-for-a-distributed-environment.md) -#### [Configuring IIS for Secure Streaming](configuring-iis-for-secure-streaming.md) -#### [App-V Desktop Client Security](app-v-desktop-client-security.md) -#### [Improving Security During App-V Sequencing](improving-security-during-app-v-sequencing.md) -#### [Internet-Facing Server Scenarios for Perimeter Networks](internet-facing-server-scenarios-for-perimeter-networks.md) -#### [Internet-Facing Considerations for App-V Clients](internet-facing-considerations-for-app-v-clients.md) -##### [Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) -##### [How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) -##### [How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) -## [Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement](microsoft-application-virtualization-46-service-pack-1-privacy-statement.md) -## [Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement](microsoft-application-virtualization-46-service-pack-2-privacy-statement.md) - diff --git a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md deleted file mode 100644 index 5d1c399e81..0000000000 --- a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: About App-V Package Accelerators (App-V 4.6 SP1) -description: About App-V Package Accelerators (App-V 4.6 SP1) -author: manikadhiman -ms.assetid: fc2d2375-8f17-4a6d-b374-771cb947cb8c -ms.reviewer: -manager: dansimp -ms.author: manikadhiman -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V Package Accelerators (App-V 4.6 SP1) - - -You can use App-V Package Accelerators to automatically sequence large, complex applications. Additionally, when you apply an App-V Package Accelerator, you are not always required to manually install an application to create the virtual application package. - -**Note**   -In some cases, you are prompted to install an application locally to the computer running the App-V Sequencer before you can use the Package Accelerator. If you have to install an application, you must install the application to the application’s default location. This installation is not monitored by App-V Sequencer. When the App-V Package Accelerator is created, the author of the Package Accelerator determines whether to install an application locally is required. - - - -App-V Sequencer extracts the required files from the App-V Package Accelerator and associated installation media to create a virtual package without having to monitor the installation of the application. - -**Important**   -Disclaimer: The Microsoft Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer. - - - -App-V Package Accelerators and project templates differ from each other. Package Accelerators are application-specific. Project templates enable users to save commonly used settings specific to an organization and apply them to multiple applications. You can also create project templates at the command prompt, while in contrast, you must use the App-V Sequencer console to create Package Accelerators. Additionally, creating a package by using a Package Accelerator and applying a project template is not supported. - -## Sharing App-V Package Accelerators - - -This section provides best practice information about how to share Package Accelerators. If you plan to share Package Accelerators, information such as computer names, user account information, and information about the associated applications might be included in the Package Accelerators.The following list describes methods you should consider when creating Package Accelerators: - -- **User name**. When you log on to the computer running App-V Sequencer, you should use a generic user account, such as the built-in **administrator** account for administering the computer / domain. You should not use an account that is based on an existing user name. - -- **Computer Name**. Specify a general, non-identifying name for the computer running the Sequencer. - -- **Server URL**. In the Sequencer console, on the **Deployment** tab, use the default settings for the server URL configuration information. - -- **Applications**. If you do not want to share the list of applications that were installed on the computer running the Sequencer when you created the Package Accelerator, you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -You should also review any settings or configuration files associated with the virtual application package to ensure the applications do not contain any personal information. - -## Securing App-V Package Accelerators - - -Always save App-V Package Accelerators and any associated installation media in a secure location on the network to protect the App-V Package Accelerators and the installation files from being tampered with or becoming corrupted. Because Package Accelerators can also contain password and user-specific information, you must save App-V Package Accelerators in a secure location, and you must digitally sign the Package Accelerator after you create it so that the publisher can be verified when the Package Accelerator is applied. For more information about digital signatures, see [Application Guidelines on Digital Signature Practices for Common Criteria Security](https://go.microsoft.com/fwlink/?LinkId=204705) (https://go.microsoft.com/fwlink/?LinkId=204705). - -## Related topics - - -[How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) - -[How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-application-licensing.md b/mdop/appv-v4/about-application-licensing.md deleted file mode 100644 index 039444d39d..0000000000 --- a/mdop/appv-v4/about-application-licensing.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: About Application Licensing -description: About Application Licensing -author: dansimp -ms.assetid: 6b487641-1627-4e91-b829-04f001008176 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Licensing - - -You can manage application licenses directly from the Application Virtualization Server Management Console. - -## License Types - - -The System Center Application Virtualization System currently supports the following license types: - -- **Unlimited License**—Allows access to the application by any number of simultaneous users. This method of licensing is appropriate when you want to associate an enterprise-wide license with an application. - -- **Concurrent License**—Enables you to define the maximum number of concurrent users who are allowed to use the application. - -- **Named License**—Enables you to assign a license to an individual user. A named license can be used to ensure that a particular user will always be able to run the application. - -You can combine concurrent and named licenses for the same application. - -Licensing is disabled by default, but you can enable it from the **Provider Pipeline** tab of the **Provider Properties** dialog. For details about enabling and disabling licensing, see [How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md). - -## Provider Policies - - -Provider policies were developed for the Application Service Provider (ASP) model. In this model, a single ASP can host a single Application Virtualization System for multiple clients, where each client needs to remain isolated. Clients might have dramatically different requirements—for example, one client might require authentication while another does not. You can use provider policies to associate permissions with clients so that only the approved users can access each virtual application or virtual application package. - -For the enterprise customer, you can use this feature when you have strict licensing requirements for one or more applications. Under this situation, the licensing component is disabled on the **Provider Pipeline** tab of the **Provider Properties** dialog. - -The **Provider Pipeline** tab also has check boxes to enable authentication, authorization (**Enforce Access Permission Settings**), and metering (**Log Usage Information**). If your configuration has special requirements, you can write your own pipeline components and add them to the system by clicking the **Advanced** button. - -## Account Authorities - - -The account authority is the domain in which the Application Virtualization Server is installed. As you proceed through the server installation, you are prompted to supply a domain name; the domain in which the computer is installed is detected and used by default. When users attempt to log in to the system, they are prompted for their credentials before they can access that domain. - -The Application Virtualization System supports multiple domains. You can grant application access to user groups in other domains if a trust relationship is established between domains. Users must supply credentials that are recognized by each domain. - -In the Application Virtualization Server Management Console, you can change the primary domain (account authority) and the credentials that are used to access it. - -## Authentication - - -Authentication is the mechanism used to confirm a user's identity. Any user with a recognized user name and password has access. - -In the Application Virtualization System, you can enable or disable authentication through a check box on the **Provider Pipeline** tab. By default, Windows Authentication is enabled. - -## Authorization - - -Authorization is the process used to confirm a user’s identity. After confirming the user's identity, the system determines whether the user was granted access to the system and to which applications the user was granted access. The Application Virtualization Server Management Console has an **Enforce Access Permission Settings** check box on the **Provider Pipeline** tab to enable or disable authorization. - -In the Application Virtualization System, access is granted to a user group only, not to individual users. - -## Related topics - - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-application-virtualization-applications.md b/mdop/appv-v4/about-application-virtualization-applications.md deleted file mode 100644 index 81f4351171..0000000000 --- a/mdop/appv-v4/about-application-virtualization-applications.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: About Application Virtualization Applications -description: About Application Virtualization Applications -author: dansimp -ms.assetid: 3bf833b7-d172-4eef-a9e8-4b4f0c7eb15b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Virtualization Applications - - -In Application Virtualization, an *application* is an executable program, such as Microsoft Visio, that is streamed to the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) from an Application Virtualization Management Server. Before an application can be streamed to a client, the application must be prepared for streaming by processing it with the Application Virtualization Sequencer. - -## Managing Applications - - -You must add applications to the system before you can make the applications available to users. The most common method for adding applications to the system is to import them. To access this feature, right-click the **Applications** node in the Application Virtualization Server Management Console and choose **Import Applications**. - -You can import more than one Open Software Descriptor (OSD) file at the same time, or you can import a Sequencer Project file (SPRJ) that can contain multiple OSD files. This functionality enables you to configure related applications similarly. - -You can also use the following features to help you manage your applications: - -- **Application Groups**—Enables you to create logical groups of applications for simplified management. When changes are made to a group (for example, access permissions), the changes are applied to all applications in the group. Applications in a group can come from different packages. - -- **Multi Select**—Enables you to select multiple applications at once by holding the CTRL key when you click an application to modify the application properties. However, if you want to maintain a relationship between the applications, you should create an application group to hold the applications. - -- **Cross System Copy**—Enables you to copy applications from one environment to another environment that is running the same version of App-V in one step. For example, you might have a user acceptance test environment where you initially deploy and configure applications. After you finish your testing phase, you might want to replicate the same set of applications (including permissions) to the production environment. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-application-virtualization-packages.md b/mdop/appv-v4/about-application-virtualization-packages.md deleted file mode 100644 index 63e1915d67..0000000000 --- a/mdop/appv-v4/about-application-virtualization-packages.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: About Application Virtualization Packages -description: About Application Virtualization Packages -author: dansimp -ms.assetid: 69bd35c1-7af3-43db-931b-3074780aa926 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Virtualization Packages - - -In Application Virtualization, a *package* is the output of the sequencing process. You use packages when you first deploy applications on your servers and when you upgrade applications with a new version. Packages enable you to control virtual application versions on your Application Virtualization Management Servers. A single package can contain one or more applications. Each application package contains a set of files as a self-contained unit. - -## Managing Packages - - -After the Sequencer creates a package of one or more applications as part of its process, you can copy the Sequencer-generated files to a Application Virtualization Management Server and make them available for streaming. - -Available packages appear under the **Packages** container in the left pane of the Application Virtualization Management Console. When you import an application with a Sequencer Project (SPRJ) file or an Open Software Descriptor (OSD) file, a related entry appears in the **Packages** container. From the Application Virtualization Server Management Console, you can then deploy, upgrade, or delete packages and versions of them. - -Each virtual application has an associated package. This package includes the following files: - -- SFT—The file that streams the application to clients. - -- OSD—The Open Software Descriptor file contains the information needed to find and launch the application. - -- ICO—The icon file that visually represents the application in user interfaces and shortcuts. - -- SPRJ—The Sequencer Project file. - -When you import the SPRJ file, all sequenced applications are available for deployment, by default, but the applications are not enabled for streaming. You can choose to stream all or some of the applications in the package. For example, if you sequenced and imported Microsoft Office, you can choose not to deploy some applications, such as the Save My Settings Wizard. In this case, right-click each application you want to deploy, choose **Properties**, and make sure that the **Enabled** box is cleared (blank). Only the applications with the **Enabled** box selected will stream to client computers. - -After you resequence a package and produce a new SFT file for streaming, you can upgrade the old package quickly and easily through the Application Virtualization Server Management Console. - -The only operational scenario that requires you to use the **Packages** node is when you introduce a new version (SFT file) for the package. Whenever you import applications, assign access and licenses to applications, and so on, the Application Virtualization System tracks this information at the package level. This means that when you authorize a user to use an application, you are giving the user permission to run any application in the same package. - -### Package Version - -A package version is represented by a specific SFT file. When you upgrade a package (apply an update to an application or add an application to a package), you generate a new SFT file. Each time you create a new SFT file, you are creating a new package version. - -When you import applications through the Application Virtualization Server Management Console, the software automatically creates a package and a package version if they do not already exist. - -## Related topics - - -[About Application Virtualization Applications](about-application-virtualization-applications.md) - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-application-virtualization-servers.md b/mdop/appv-v4/about-application-virtualization-servers.md deleted file mode 100644 index 6078a1f5cb..0000000000 --- a/mdop/appv-v4/about-application-virtualization-servers.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: About Application Virtualization Servers -description: About Application Virtualization Servers -author: dansimp -ms.assetid: 60a45509-2112-44ca-8e28-c73b0c2ff85e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Virtualization Servers - - -Application Virtualization Management Servers, also called *application publishing servers*, control access to the applications that are processed to run in a virtual environment. Virtual applications are stored on the Application Virtualization Management Servers. When a virtual application is called for by the client, the application package is streamed to the client from the Application Virtualization Management Servers. - -**Note**   -You can also stream applications to clients from Application Virtualization Streaming Servers. Streaming Servers do not offer some of the services that are available from the Management Servers, such as publishing, management, and reporting. - -You can stream applications to the client directly from a file or disk. Some application virtualization deployment scenarios, which are characterized by low or unreliable connectivity or where bandwidth is limited, are ideally suited for streaming from file or disk. - - - -One or more Application Virtualization Management Servers that share a single data store make up an *Application Virtualization system*. - -## Related topics - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) - -[How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) - -[How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md deleted file mode 100644 index 2379da3dff..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.5 SP1 -description: About Microsoft Application Virtualization 4.5 SP1 -author: dansimp -ms.assetid: f5dcff12-5956-41ef-bc36-b59200f90807 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.5 SP1 - - -This service pack contains the following changes: - -- Support for Windows 7 and Windows Server 2008 R2: App-V 4.5 SP1 provides support for Windows 7 and Windows Server 2008 R2, including support for Windows 7 features such as the taskbar, AppLocker, BranchCache, and BitLocker To Go.  Windows Server 2008 R2 support applies only to Application Virtualization Server. For more information about AppLocker support in Windows 7, see [Windows AppLocker](https://go.microsoft.com/fwlink/?LinkID=156732) (https://go.microsoft.com/fwlink/?LinkID=156732). - -- Support for third-party Kerberos realms: App-V 4.5 SP1 provides support for environments that have a trust relationship and mapped user accounts between a Windows domain and an MIT Kerberos realm, which is a scenario commonly used at many universities. For information about how to enable this support, see [How to Configure the Client for MIT Kerberos Realm Support](https://go.microsoft.com/fwlink/?LinkId=166004) (https://go.microsoft.com/fwlink/?LinkId=166004). - -- Improved support for application publishing and streaming through HTTP/HTTPS: App-V 4.5 SP1 provides support for application publishing and streaming through the HTTP/HTTPS protocols for Windows XP Home Edition, Windows Vista Home Basic, and Windows 7 Home Basic. - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP1 also includes a rollup of fixes to address issues found after the Microsoft Application Virtualization (App-V) 4.5 CU1 release. The updates result from a combination of known issues and customer feedback from our internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see [article 976338](https://go.microsoft.com/fwlink/?LinkId=167121) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=167121). - -## In This Section - - -[Microsoft Application Virtualization Management System Release Notes 4.5 SP1](microsoft-application-virtualization-management-system-release-notes-45-sp1.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.5 SP1. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md deleted file mode 100644 index 80134f7a39..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.5 SP2 -description: About Microsoft Application Virtualization 4.5 SP2 -author: dansimp -ms.assetid: c498adbe-e331-42c8-99fe-29623fae2345 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.5 SP2 - - -This service pack contains the following changes: - -- Support for Office 2010: Microsoft Application Virtualization (App-V) 4.5 SP2 now supports the virtualization of Microsoft Office 2010. For prescriptive guidance for sequencing Office 2010 with App-V 4.5 SP2, see [Prescriptive guidance for sequencing Office 2010 in Microsoft App-V 4.6](https://go.microsoft.com/fwlink/?LinkId=191539) (https://go.microsoft.com/fwlink/?LinkId=191539). - -- Support for Database Mirroring: App-V 4.5 SP2 now supports Microsoft SQL Server Database Mirroring. For more information about configuring database mirroring in your App-V environment, see [How to Configure Microsoft SQL Server Mirroring Support for App-V](https://go.microsoft.com/fwlink/?LinkId=190880) (https://go.microsoft.com/fwlink/?LinkId=190880). - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP2 also includes a rollup of fixes to address issues found after the App-V  4.5 SP1 release. The updates address a combination of known issues and customer feedback from Microsoft internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see article 980847 in the Microsoft Knowledge Base (KB) at [Description of Microsoft Application Virtualization 4.5 Service Pack 2](https://go.microsoft.com/fwlink/?LinkId=191540) (https://go.microsoft.com/fwlink/?LinkId=191540). - -## In This Section - - -[App-V 4.5 SP2 Release Notes](app-v-45-sp2-release-notes.md) -Provides the most up-to-date information about known issues with App-V 4.5 SP2. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45.md b/mdop/appv-v4/about-microsoft-application-virtualization-45.md deleted file mode 100644 index 827934974f..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.5 -description: About Microsoft Application Virtualization 4.5 -author: dansimp -ms.assetid: 39f45a6f-ac55-4fd7-8a83-865e1a7034f8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Microsoft Application Virtualization 4.5 - - -Formerly known as SoftGrid Application Virtualization, Microsoft Application Virtualization (App-V) 4.5 is the first Microsoft-branded release of the product. It includes new capabilities that make it easy for enterprise IT organizations to support large-scale, global application virtualization implementations. - -- Dynamic Virtualization: App-V 4.5 provides the flexibility to control virtual application interaction. Administrators who want to consolidate virtual environments and enable faster, easier administration, can use the product’s Dynamic Suite Composition, which sequences and manages packages for middleware applications separately from the main application. It shrinks potential package size by eliminating redundant packaging of middleware. This lets multiple Web applications communicate with the same single instance of a virtualized application of, for example, Microsoft .NET Framework or Sun Java Runtime Environment (JRE). Updates for the common virtual middleware are simplified and one virtual application is updated instead of several. This “many-to-one” capability greatly reduces the cost of updates. It also makes it easier to deploy and manage applications that use multiple plug-ins and add-ins, and improves management of plug-in distribution to different user groups. - -- Extended Scalability: Choose among three flexible deployment modes: - - 1. Application Virtualization Management Server, which ships as part of the Microsoft Desktop Optimization Pack and Microsoft Application Virtualization for Remote Desktop Services packages, enables dynamic streaming including package and active upgrades, and requires Microsoft Active Directory Domain Services and Microsoft SQL Server. - - 2. Application Virtualization Streaming Server, a lightweight version which also ships as part of the Microsoft Desktop Optimization Pack and Microsoft Application Virtualization for Remote Desktop Services packages, offers application streaming including package and active upgrades without the Active Directory Domain Services and database overheads, and enables administrators to deploy to existing servers or add streaming to Electronic Software Delivery (ESD) systems. - - 3. Standalone mode enables virtual applications to run without streaming and is interoperable with Microsoft Systems Management Server and System Center Configuration Manager 2007 and third-party ESD systems. - -- Globalization: The product is localized across 11 languages, includes support for foreign language applications that use special characters, and supports foreign language Active Directory and servers and runtime locale detection. - -- Microsoft Security Standards: Microsoft Application Virtualization (App-V) 4.5 complies with Microsoft security standards including Trustworthy Computing, Secure Windows Initiative and Security Development Lifecycle. It includes support for Internet-facing scenarios and provides Secure by Default configuration out of the box. - -## In This Section - - -[Microsoft Application Virtualization Management System Release Notes](microsoft-application-virtualization-management-system-release-notes.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.5. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md deleted file mode 100644 index f2d49596f4..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 SP1 -description: About Microsoft Application Virtualization 4.6 SP1 -author: dansimp -ms.assetid: 20917eb6-c998-43f8-aefa-307eb322dc8d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Microsoft Application Virtualization 4.6 SP1 - - -Microsoft Application Virtualization (App-V) 4.6 SP1 provides the following enhancements and new features: - -- Improved App-V sequencer – the App-V 4.6 SP1 sequencer has been updated to help improve the sequencing process. The enhancements include a more predictable packaging experience, and help at each step of the sequencing process. Click any of the following links for more information about the new version of the App-V sequencer. - - - App-V Package Accelerators can be used to automatically sequence large, complex applications. Additionally, when you apply an App-V Package Accelerator, you are not always required to manually install an application to create the virtual application package. For more information about App-V package accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - - - Enhanced support for sequencing different types of applications. For more information about the different types of applications, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - - - Enhanced support for using App-V project templates. For more information about App-V project templates, see [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md). - - - Step-by-step help during sequencing. For an example of the new step-by-step see [Type of Application Page (Learn More)](type-of-application-page--learn-more-.md). - - - Enhanced reporting to help identify sequencing issues. For an example of the new reporting, see [Files Excluded Page Dialog Box (App-V 4.6 SP1)](files-excluded-page-dialog-box--app-v-46-sp1-.md). - -- Support for using a read-only cache on RDS - App-V 4.6 SP1 now supports using a shared, read-only cache in both VDI and RDS environments. For more information about sharing a read-only cache on RDS, see [How to Configure a Read-only Cache on the App-V Client (RDS)](how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md). - -- Support for sequencing the Microsoft .NET Framework 4 - App-V 4.6 SP1 now supports sequencing the Microsoft .NET Framework 4. - -- Customer Feedback and Hotfix Rollup – App-V 4.6 SP1 also includes a rollup up of fixes to address issues found since the App-V 4.6 release. - -## In This Section - - -[App-V 4.6 SP1 Release Notes](app-v-46-sp1-release-notes.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.6 SP1. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md deleted file mode 100644 index ece900187a..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 SP2 -description: About Microsoft Application Virtualization 4.6 SP2 -author: dansimp -ms.assetid: 1429e314-9c38-472b-8687-3bed6cf0015c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.6 SP2 - - -Microsoft Application Virtualization (App-V) 4.6 SP2 provides several enhancements and new features, which are described in this topic. - -**Caution**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -**Support for Windows 8 and Windows Server 2012** - -App-V 4.6 SP2 adds support for Windows 8 and Windows Server 2012 Remote Desktop Services. - -**Support for coexistence with App-V 5.0 client** - -App-V 4.6 SP2 provides support for coexistence with the Microsoft Application Virtualization 5.0 client. Review the App-V 5.0 documentation for instructions on how to configure the App-V 5.0 client for coexistence with the App-V 4.6 SP2 client. For more information about App-V 5.0, see [Application Virtualization 5](https://go.microsoft.com/fwlink/?LinkId=267599) on TechNet. - -**Ability to virtualize Adobe Reader X with Protected Mode** - -You can virtualize Adobe Reader X with its Protected Mode feature turned on by using the following procedures. Previously you had to disable Protected Mode in order to virtualize Adobe Reader X. - -Before launching the App-V Sequencer, create the following registry value under HKEY\_LOCAL\_MACHINE\\SOFTWARE \\Microsoft\\SoftGrid\\4.5\\SystemGuard\\Overrides: - - ------ - - - - - - - - - - - - - - -

          Name

          Type

          Data

          Description

          EnableVFSPassthrough

          DWORD

          1

          Set this value to 1 in order to start Adobe Reader X in Protected Mode during the launch phase.

          - - - -**Note**   -On a computer running a 64-bit operating system, create the registry value under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\Overrides. - - - -For each OSD-file in your Adobe Reader X package, add the following items under the <POLICIES> element: - -`TRUE` - -`TRUE` - -`TRUE` - -**New Sequencer command-line parameter** - -When you create a Package Accelerator (PA) through the Sequencer GUI, you can select an RTF or TXT file that provides packaging and deployment guidance to the administrators who will apply the Package Accelerator. This functionality is now available using the Sequencer CLI. - -`/ACCELERATORDESCRIPTIONFILE:PathToDescriptionFile` - -Specify a path to an RTF or TXT file that provides packaging and deployment guidance when creating a Package Accelerator. - -**Microsoft Application Error Reporting no longer needs to be installed** - -When you are installing the App-V 4.6 SP2 client by using setup.msi, you no longer need to install Microsoft Application Error Reporting (dw20shared.msi). App-V 4.6 SP2 now uses Microsoft Error Reporting. For more information, see [How to Install the App-V Client by Using Setup.msi](https://go.microsoft.com/fwlink/?LinkId=267237). - -**Customer feedback and hotfix rollup** - -App-V 4.6 SP2 includes a rollup of fixes to address issues found since the App-V 4.6 SP1 release. App-V 4.6 SP2 contains the latest fixes up to and including Microsoft Application Virtualization 4.6 SP1 Hotfix 6. - -## In This Section - - -[App-V 4.6 SP2 Release Notes](https://go.microsoft.com/fwlink/?LinkId=267600) -Provides the most up-to-date information about known issues with App-V 4.6 SP2. - - - - - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md deleted file mode 100644 index ef4f01c277..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 SP3 -description: About Microsoft Application Virtualization 4.6 SP3 -author: dansimp -ms.assetid: a6374fb0-1dfa-41f7-9a6a-3d2688492a8b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.6 SP3 - - -Microsoft Application Virtualization (App-V) 4.6 SP3 provides the following enhancements and new features, which are described in this topic. - -## Support for Windows Server 2012 R2 and Windows 8.1 - - -App-V 4.6 SP3 includes support for Windows Server 2012 R2 and Windows 8.1 - -## How to Get MDOP Technologies - - -App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[App-V 4.6 SP3 Release Notes](app-v-46-sp3-release-notes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46.md b/mdop/appv-v4/about-microsoft-application-virtualization-46.md deleted file mode 100644 index 4e2161b45f..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 -description: About Microsoft Application Virtualization 4.6 -author: dansimp -ms.assetid: 34150f34-ee74-45a6-957e-9ea6c5a497de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Microsoft Application Virtualization 4.6 - - -Microsoft Application Virtualization (App-V) 4.6 provides the following enhancements and new features for the App-V Desktop Client, Client for Remote Desktop Services and App-V Sequencer: - -- Support for 64-bit applications—provides the ability to sequence and run 32-bit and 64-bit applications on 64-bit versions of Windows 7, Windows Vista, Windows XP, Windows Server 2008, Windows Server 2008 R2, Windows Server 2003 and Windows Server 2003 R2. For more information about supported operating systems, see [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md). - -- Support for Windows 7 and Windows Server 2008 R2—provides support for Windows 7 and Windows Server 2008 R2, including support for Windows 7 features such as the taskbar, Jump Lists, AppLocker, BranchCache, and BitLocker To Go. - -- Expands globalization and localization—provides support for 12 additional languages. - -- Support for Virtual Desktop Infrastructure (VDI) systems—provides the capability for the read-only shared cache to help optimize server disk storage in VDI scenarios. - -- Improved sequencing experience—provides improvements to the sequencing wizard and support for sequencing 32-bit and 64-bit applications. - -**Note**   -The App-V Management Server and Streaming Server have not been updated to version 4.6. Until they are updated, use App-V Management Server and Streaming Server 4.5 with the most recent service pack. - - - -## In This Section - - -[App-V 4.6 Release Notes](app-v-46-release-notes.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.6. - - - - - - - - - diff --git a/mdop/appv-v4/about-publishing.md b/mdop/appv-v4/about-publishing.md deleted file mode 100644 index 0aab27b334..0000000000 --- a/mdop/appv-v4/about-publishing.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: About Publishing -description: About Publishing -author: dansimp -ms.assetid: 295074d7-123f-4740-b938-e4a371ee72fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Publishing - - -You can centrally manage publishing applications to the Application Virtualization Client from the Application Virtualization Server Management Console. For example, you can assign access to applications and define when and how often the Application Virtualization Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) need to refresh that information. You can set the clients to refresh this information on a set schedule or every time the user logs in to the client. Also, you can use the console's application publishing functionality to enable users to see which applications are published (or available) to the client. - -**Note**   -Before the client can refresh the publishing information, the client must know about the Application Virtualization Management Server. You configure the client with the necessary information about the server when you install the client. - - - -When a client contacts the server for application publishing information, the server provides the client with the list of applications that the user has permission to access and the location of the corresponding Open Software Descriptor (OSD) files. The server also provides the relevant information about icons, file type associations, and shortcuts. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[About Application Virtualization Applications](about-application-virtualization-applications.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-sequencing-phases.md b/mdop/appv-v4/about-sequencing-phases.md deleted file mode 100644 index e9f821e89a..0000000000 --- a/mdop/appv-v4/about-sequencing-phases.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: About Sequencing Phases -description: About Sequencing Phases -author: dansimp -ms.assetid: c1cb7b6c-204c-48f2-848c-4bd5a3d5ecb6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Sequencing Phases - - -Sequencing is the process by which you create a sequenced application package by using the Microsoft Application Virtualization (App-V) Sequencer. During sequencing, the Sequencer monitors and records all installation and setup processes for an application and creates the following files: ICO, OSD, SFT, and SPRJ. These files contain all the necessary information about an application, and they allow that application to run in a virtual environment. - -The four phases to sequencing an application and creating a virtual application package are installation, launch, customization, and save. The following list provides information about each of the phases: - -1. **Installation phase**—During the installation phase, you specify the package name and an optional associated comment that will be associated with the package. You can also configure advanced monitoring options during this phase. Advanced monitoring options include specifying the block size and whether you will install automatic updates during monitoring. The sequencer records all necessary information and configurations required to create a virtual application package and the associated file and registry settings. - - **Important**   - To view the advanced options select **Show Advanced Monitoring Options** on the **Package Information** page. - - - -2. **Launch phase**—During the launch phase, you can specify any required file associations and security descriptors that should be configured with the package. You should open the application as many times as necessary to ensure application functionality and stability. - -3. **Customization phase**—During the customization phase, you can configure your package by using the associated .osd files. You can specify whether any associated scripts should run inside or outside of the virtual environment, specify additional actions that should be performed, specify how associated scripts run (synchronously or asynchronously), and specify any additional scripts that should be run under the user context. - -4. **Save phase**—During the save phase, all required files for the virtual application package are created. The files created are .sprj, .sft, .osd, .ico, .xml manifest, and the Windows installer (.msi) file. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-sharing-package-accelerators-page.md b/mdop/appv-v4/about-sharing-package-accelerators-page.md deleted file mode 100644 index 880688dd13..0000000000 --- a/mdop/appv-v4/about-sharing-package-accelerators-page.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: About Sharing Package Accelerators Page -description: About Sharing Package Accelerators Page -author: dansimp -ms.assetid: 9630cde0-e2c3-476f-8fa1-58b3c9f7d3f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Sharing Package Accelerators Page - - -This following information provides best practice information about how to share Package Accelerators. If you plan to share Package Accelerators files, information such as computer names, user account information, and information about applications included in the transforms might be included in the Package Accelerators file. You should review any settings or configuration files associated with the virtual application package to ensure the applications do not contain any personal information.This page contains the following elements. - -- **Username**. When you log on to the computer running the Microsoft App-V Sequencer, you should use a generic user account, such as the built-in **administrator** account. You should not use an account that is based on an existing user name. - -- **Computer Name**. Specify a general, non-identifying name of the computer running the Sequencer. - -- **Server URL**. In the App-V Sequencer console, on the **Deployment** tab, use the default settings for the server URL configuration information. - -- **Applications**. If you do not want to share the list of applications that were installed on the computer running the Sequencer when you created the Package Accelerator, you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -[About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-application-virtualization-sequencer.md b/mdop/appv-v4/about-the-application-virtualization-sequencer.md deleted file mode 100644 index c51d335407..0000000000 --- a/mdop/appv-v4/about-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: About the Application Virtualization Sequencer -description: About the Application Virtualization Sequencer -author: dansimp -ms.assetid: bee193ca-58bd-40c9-b41a-310435633895 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Application Virtualization Sequencer - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records all installation and setup processes for an application and creates the following files: **ICO**, **OSD**, **SFT**, and **SPRJ**. These files contain all the necessary information about an application so the application can run in a virtual environment on target computers. You can use the Microsoft Application Virtualization (App-V) Sequencer to create virtual applications. After you sequence an application, it can be streamed to target computers, or target computers can run the virtual application by downloading the contents of the virtual application package and running the application locally. - -**Important**   -To run a virtual application package the target computer must be running the appropriate version of the App-V client. - - - -Virtual application packages run on target computers without interacting with the underlying operating system on the target computer because each application runs in a virtual environment and is isolated from other applications that are installed or running on the target computer. This isolation can reduce application conflicts and can help decrease the required amount of application pre-deployment testing. - -## Sequencer Terminology - - -Application Virtualization drive -The application virtualization drive is the default drive (Q:\) on the target computer from which sequenced applications are run. - -ICO file -The icon file on the client desktop which is used to launch a sequenced application. - -Installation directory -The directory used by the sequencer to place installation files during setup. - -Open Software Descriptor (OSD) file -An XML-based file that instructs the App-V client how to retrieve the sequenced application from the App-V streaming server and how to run the sequenced application in the virtual environment. - -Package root directory -The directory on the sequencing computer on which files for the sequenced application package are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed. - -Sequenced application -An application that has been monitored by the sequencer, broken up into primary and secondary feature blocks, streamed to a target computer running the App-V client t, and runs a virtual environment. - -Sequenced application package -The files that comprise a virtual application and allow a virtual application to run. These files are created after sequencing and specifically include **.osd**, **.sft**, **.sprj**, and **.ico** files. - -Sequencing -The process of creating an application package using the App-V Sequencer. In this process, an application is monitored, its shortcuts are configured, and a sequenced application package is created. - -Sequencing computer -The computer used to sequence an application. - -Virtual application -An application packaged by the Sequencer to run in a self-contained, virtual environment. The virtual environment contains the information necessary to run the application on the client without installing the application locally. - -Primary feature block -The minimum content in a virtual application package that is necessary for an application to run on a target computer. The content in the primary feature block is identified during the application phase of sequencing and typically consists of the content for the most used application features. - -## Sequencing Applications - - -There are two methods to create and modify virtual application packages in your environment. The first method is by using the **Sequencing** wizard. The **Sequencing** wizard allows you to create new, or modify existing virtual application packages. For more information about using the **Sequencing** wizard see, [How to Sequence a New Application](how-to-sequence-a-new-application.md). The second method is by using the command-line. The command-line allows you to create new, or modify existing virtual application packages using the command prompt. For more information about using the command line see, [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md). - -The **Sequencing** wizard provides the following functions for creating virtual application packages: - -1. **Package Configuration**: The **Sequencing** Wizard prompts for package configuration information necessary to complete the Open Software Descriptor (OSD) file, which is a required file for starting a sequenced application package. - -2. **Application Installation**: The **Sequencing** Wizard gathers information about an application’s installation and startup configurations. It monitors and records the installation and startup information associated with the application to create the files necessary for a virtual application package. - -3. **Application Startup**: The **Sequencing** Wizard gathers information for compiling and ordering the blocks of code necessary to perform the initial startup of the sequenced application package on the target computer. The compilation of the code block is referred to as the primary feature block. - -## Application Virtualization Sequencer Security Considerations - - -The App-V Sequencer runs all services detected at sequencing time using the Local System account and does not enforce security descriptors on service control requests. If the service was installed using a different user account or if the security descriptors are intended to grant different user groups specific service permissions, consider carefully whether the service should be virtualized. In some cases, you should install the service locally to ensure that the intended service security is preserved. - -**Important**   -You should always save virtual application packages in a secure location. - - - -## Related topics - - -[Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md b/mdop/appv-v4/about-the-application-virtualization-server-management-console.md deleted file mode 100644 index e3654b07e0..0000000000 --- a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: About the Application Virtualization Server Management Console -description: About the Application Virtualization Server Management Console -author: dansimp -ms.assetid: 108d0e4b-08fa-47b4-a737-d2c36c2641de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Application Virtualization Server Management Console - - -This section of the Application Virtualization Server Management Help describes some of the concepts you should understand while working with the Application Virtualization Server Management Console. - -## In This Section - - -[About Application Virtualization Applications](about-application-virtualization-applications.md) -Provides an overview of managing applications from the Application Virtualization Server Management Console. - -[About Application Virtualization Packages](about-application-virtualization-packages.md) -Provides an overview of managing packages from the Application Virtualization Server Management Console. - -[About Publishing](about-publishing.md) -Provides an overview of how you can publish applications from the Application Virtualization Server Management Console. - -[About Application Licensing](about-application-licensing.md) -Provides an overview of how you can manage application licensing from the Application Virtualization Server Management Console and the types of licenses available. - -## Reference - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -## Related Sections - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-deployment-tab.md b/mdop/appv-v4/about-the-deployment-tab.md deleted file mode 100644 index 7a0a6c25b4..0000000000 --- a/mdop/appv-v4/about-the-deployment-tab.md +++ /dev/null @@ -1,154 +0,0 @@ ---- -title: About the Deployment Tab -description: About the Deployment Tab -author: dansimp -ms.assetid: 12891798-baa4-45a5-b845-b9505ab95633 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About the Deployment Tab - - -Use the **Deployment** tab in the Application Virtualization Sequencer Console to change the information for an application you are about to sequence. This tab contains the following elements. - -## Server URL - - -Use the **Server URL** controls to specify the virtual application server configuration settings. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ControlDescription

          Protocol

          Enables you to select the protocol that will stream the sequenced application package from a virtual application server to an Application Virtualization Desktop Client. The following protocols are available:

          -
            -
          • RTSP—The default, it specifies that the Real-Time Streaming Protocol controls the exchange of virtualization-enabled applications.

          • -
          • RTSPS—Specifies that the Real-Time Streaming Protocol with Transport Layer Security controls the exchange of a sequenced application package.

          • -
          • File—Specifies that the sequenced application will be streamed from a file share.

          • -
          • HTTPS—Specifies that Secure Hypertext Transport Protocol controls the exchange of a package.

          • -

          Hostname

          Enables you to select the virtual application server or the load balancer in front of a group of virtual application servers that will stream the software package to an Application Virtualization Desktop Client. You must complete this item to create a sequenced application package, but you can change from the default %SFT_SOFTGRIDSERVER% environment variable to the actual hostname or IP address of a virtual application server.

          -
          -Note

          If you choose not to specify a static hostname or IP address, on each Application Virtualization Desktop Client you must set up an environment variable called SFT_SOFTGRIDSERVER. Its value must be the hostname or IP address of the virtual application server or load balancer that is this client's source of applications. You should make this environment variable a system variable rather than a user variable. Any Application Virtualization Desktop Client session that is running on this computer during your assignment of this variable must be closed and then opened so that the resumed session will be aware of its new application source.

          -
          -
          - -

          Port

          Enables you to specify the port on which the virtual application server or the load balancer will listen for an Application Virtualization Desktop Client's request for the package. This information is required to create a package, but you can change it. The default port is 554.

          Path

          Enables you to specify the relative path on the virtual application server where the software package is stored and from which it will be streamed. This information is required to create a package if the SFT file will be stored in a subdirectory of CONTENT; otherwise, this information is not required.

          - - - -## Operating Systems - - -Use the **Operating Systems** controls to specify the application's operating system requirements. If an Application Virtualization Desktop Client cannot support any of the selected operating systems, the application will not start. - - ---- - - - - - - - - - - - - - - - - -
          ControlsDescription

          Available Operating Systems

          Displays a list of operating systems that can support the applications in the package.

          Selected Operating Systems

          Displays a list of selected operating systems that support the applications in the package.

          - - - -## Output Options - - -Use the **Output Options** controls to specify the output options for the application to be installed. - - ---- - - - - - - - - - - - - - - - - - - - - -
          ControlDescription

          Compression Algorithm

          Use to select the method for compressing the SFT file for streaming across a network. Select one of the following compression methods:

          -
            -
          • Compressed—Specifies that the SFT file be compressed in the ZLIB format.

          • -
          • Not Compressed—The default; specifies that the SFT file not be compressed.

          • -

          Enforce Security Descriptors

          Select to enforce security descriptors of the applications in the package after it is deployed to the client.

          Generate Microsoft Windows Installer (MSI) Package

          Select to install or deploy a sequenced application package with the Windows Installer. If you have made any changes using the sequencer the changes will not be included with the Windows Installer file. The Windows Installer file will always be created using the .sft file saved on the hard disk.

          - - - -## Related topics - - -[How to Change Deployment Properties](how-to-change-deployment-properties.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-files-tab.md b/mdop/appv-v4/about-the-files-tab.md deleted file mode 100644 index 2281e4a415..0000000000 --- a/mdop/appv-v4/about-the-files-tab.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: About the Files Tab -description: About the Files Tab -author: dansimp -ms.assetid: 3c20e720-4b0f-465b-b7c4-3013dae1c815 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Files Tab - - -The **Files** tab displays the complete list of files that are included in a sequenced application package. The left pane displays, in a standard file browse format, the complete list of files in the package that was created during the application sequencing. These files include the package root directory (the directory you specified during the application installation phase), the Virtual File System (VFS) folder, and the virtual environment files. The right pane displays the file name, file attributes, and the Sequencer attributes. - -## File Name and Short Name - - -**File Name** -The name of the file is in the left pane. The files displayed in the left pane are created during sequencing. - -**Short Name** -This is the name of a file selected in the left pane, written in the 8.3 format naming convention. - -## File Attributes - - -**File Size** -The size of the file in bytes. - -**File Version** -The version of the selected file. - -**Date Created** -The date and time the selected file was created. - -**Date Modified** -The date and time the selected file was last modified. - -**File ID** -The file GUID. - -## Sequencer Attributes - - -**User Data** -Select this attribute to specify that an application must retain the information of an individual user. - -**Application Data** -Select this attribute to specify that an application must retain the general information of a group of users. - -**Override** -When selected, the Application Virtualization Desktop Client overwrites the corresponding file when the sequenced application package is upgraded and streamed to the client. If this check box is not selected, the client determines whether or not to overwrite the selected file. - -## Related topics - - -[How to Modify the Files Included in a Package](how-to-modify-the-files-included-in-a-package.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-osd-tab.md b/mdop/appv-v4/about-the-osd-tab.md deleted file mode 100644 index cd15ddc088..0000000000 --- a/mdop/appv-v4/about-the-osd-tab.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: About the OSD Tab -description: About the OSD Tab -author: dansimp -ms.assetid: 7c78cd3a-91f2-4377-8c62-e52912906197 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the OSD Tab - - -An OSD (Open Software Descriptor) file is produced after sequencing. It provides instructions for how a client is to retrieve and run a sequenced application package. Use the **OSD** tab to display and modify the OSD files in the sequenced application package. - -## Drop-Down List - - -**Drop down** -Displays a list of sequenced applications. Select a sequenced application package to modify the elements of an OSD file. - -## Navigation Pane - - -**Navigation Pane** -Displays a list of elements in the OSD file. - -## Results Pane - - -**Attribute** -Displays one or more attributes of an element. - -**Value** -Displays the value that corresponds to an attribute. - -**Element Text** -Displays an editable comment that corresponds to an element. - -## Related topics - - -[How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) - -[How to Edit an OSD File](how-to-edit-an-osd-file.md) - -[OSD File Elements](osd-file-elements.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-properties-tab.md b/mdop/appv-v4/about-the-properties-tab.md deleted file mode 100644 index 49f24affb3..0000000000 --- a/mdop/appv-v4/about-the-properties-tab.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: About the Properties Tab -description: About the Properties Tab -author: dansimp -ms.assetid: a6cf6f51-3778-4c8d-9632-3af4005775d2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Properties Tab - - -Use the **Properties** tab to view basic statistical information about a sequenced application package. The information is automatically generated unless otherwise noted. This tab contains the following elements. - -## Package Information - - -**Package Name** -The single name used for a sequenced application package that might contain one or more applications—for example, Microsoft Office could be used to label a sequenced application package that contains Microsoft Word and Microsoft Excel applications that run in the same virtual environment. - -**Comments** -Displays a short description of the software package that will appear in the Open Software Descriptor (OSD) file ABSTRACT element. This item is optional. - -**Package Version** -The sequenced application package version. - -**Package GUID** -The globally unique identifier (GUID) automatically assigned to the sequenced application package to distinguish it from other sequenced application packages that might be running on the computer to which a sequenced application package is streamed. - -**Package Version GUID** -The sequenced application package version GUID. - -**Root Directory** -The directory on the sequencing computer in which files for the sequenced application package are installed. This directory is also created on the computer to which a sequenced application package will be streamed. It is recommended for backwards compatibility that this be an 8.3 format directory name at the root of the Q drive, such as Q:\\MyApp.1\\. - -**Created** -The date and time the sequenced application package was created. - -**Modified** -The date and time the sequenced application package was last modified. - -**Package Size** -The size of the package in megabytes. - -**Launch Size** -The size in megabytes of the portion of the SFT file that is required to start the application. - -## Sequencing Parameters - - -**Block Size** -Specifies the size of the primary and secondary feature blocks into which the SFT file is divided for streaming across a network. All blocks equal the specified size; however, the last block might be smaller than specified. You will see one of the following values: - -- 4 KB - -- 16 KB - -- 32 KB - -- 64 KB - -**Note**   -After the initial package has been created, the block size value is not changeable. - - - -## Related topics - - -[How to Change Package Properties](how-to-change-package-properties.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-sequencer-console.md b/mdop/appv-v4/about-the-sequencer-console.md deleted file mode 100644 index c9ade6aad8..0000000000 --- a/mdop/appv-v4/about-the-sequencer-console.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: About the Sequencer Console -description: About the Sequencer Console -author: dansimp -ms.assetid: 36ecba89-a0f5-4d4d-981c-7f581aa43695 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Sequencer Console - - -Before you start using the Microsoft Application Virtualization (App-V) sequencer, you should be familiar with the following information about the App-V sequencer console. The following sections describe the tools available in the Sequencer console. - -## Application Virtualization Sequencer Console Menu Options - - -The following menu items are available in the App-V Sequencer Console: - -- **File** - Contains various commands to help create, open, modify, and save sequenced applications. - -- **Edit** - Contains various commands for editing existing virtual applications. - -- **View** - Contains various commands for viewing properties of a virtual application. - -- **Tools** - Contains various tools and diagnostics for configuring virtual applications. - -## Application Virtualization Sequencer Console Toolbar Options - - -The following toolbar buttons are available in the App-V Sequencer Console: - -- **New Package** - Click to create a new sequenced application. - -- **Open** - Click to open a sequenced application package in the App-V Sequencer Console. - -- **Open for Upgrade** - Click to open a sequenced application to upgrade or apply an update. - -- **Save** - Click to save a sequenced virtual application. - -- **Sequencing Wizard** - Click to open the Sequencing Wizard. You should use this button to start the Sequencing Wizard if you make any changes on the **General** tab under **Tools** / **Options**. - -## Virtual Application Tabs - - -The following tabs are displayed when you view a virtual application in the App-V Sequencer Console: - -- **Properties** - Displays information about the selected virtual application. You can update the Package Name and Comments associated with the virtual application. - -- **Deployment** - Displays information about how the virtual application will be accessed by target computers. You can configure the virtual application delivery method, and you can configure which operating systems must be running on the target computer. You can also configure the associated output options. If you plan to have clients access a virtual application from a file, use the following format when specifying the path: **File://server/share/path/.sft**. Select **Enforce Security Descriptors** to preserve security associated with the package during an upgrade, or the permissions will be reset during the upgrade. - -- **Change History** - Displays information about updates that have been made to the virtual application. - -- **Files** - Displays the files associated with the selected virtual application. You can make minor revisions to the associated file properties by using the appropriate fields. - -- **Virtual Registry** - Displays the virtual registry associated with the selected virtual application. You can add or delete registry keys by right-clicking the appropriate entry. - -- **Virtual File System** - Displays the virtual file systems associated with the selected virtual application. You can add, delete, or edit file system entries on this tab by right-clicking the appropriate entry and selecting the option. - -- **Virtual Services** - Displays the services associated with the selected virtual application. - -- **OSD** - Displays information about the Open Software Descriptor (OSD) associated with the virtual application. You can update the files associated with the OSD file by right-clicking the appropriate entry and selecting the action that you want. - -## Related topics - - -[Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-virtual-file-system-tab.md b/mdop/appv-v4/about-the-virtual-file-system-tab.md deleted file mode 100644 index c63df76467..0000000000 --- a/mdop/appv-v4/about-the-virtual-file-system-tab.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: About the Virtual File System Tab -description: About the Virtual File System Tab -author: dansimp -ms.assetid: 4d2e344d-3f3b-49fd-bbbd-fa5177e7af50 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About the Virtual File System Tab - - -The virtual file system is created during sequencing. It maps directories and files that are added or modified outside the package root directory. The **Virtual File System** tab displays the entire virtual file system for a sequenced application package. It also allows you to add, edit, and delete file associations. - -For information about the virtual file system and its use, see the section “VFS Installs” of [Advanced Sequencing Topics](https://go.microsoft.com/fwlink/?LinkId=114543), at https://go.microsoft.com/fwlink/?LinkId=114543. - -## Columns - - -**From** -Displays the application's component files in the SFT file as they will be distributed on an Application Virtualization Desktop Client. - -**To** -Displays the application's component files as they have been distributed by the application installer on the Application Virtualization Sequencer. - -## Related topics - - -[How to Modify File-Mapping Information](how-to-modify-file-mapping-information.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-virtual-registry-tab.md b/mdop/appv-v4/about-the-virtual-registry-tab.md deleted file mode 100644 index 580a4456c0..0000000000 --- a/mdop/appv-v4/about-the-virtual-registry-tab.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: About the Virtual Registry Tab -description: About the Virtual Registry Tab -author: dansimp -ms.assetid: ca8d837f-8218-4f86-95fd-13a44dccd022 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Virtual Registry Tab - - -A virtual registry is created during sequencing. The **Virtual Registry** tab displays all the registry keys and values that are required for a sequenced application package to run. Use this tab to add, edit, and delete registry keys and registry values. - -You can also choose to ignore the hosting system’s keys by selecting **Override Local Key**, or you can create a merged view of the key from within the virtual environment by selecting **Merge with Local Key**. - -The changes to the virtual registry **Settings** tab affect applications that are part of the specific sequenced application package, but they do not affect the operation of other applications that are streamed to or locally installed on the Application Virtualization Desktop Client. - -**Note**   - Exercise caution when changing virtual registry keys and values. Changing these keys and values might render your sequenced application package inoperable. - - - -The left pane of the **Virtual Registry** tab displays the full list of virtual registries created during the sequencing of an application. - -## Columns - - -**Name** -The name for the entry in the virtual registry. - -**Type** -How the entry stores its data. - -**Data** -The value stored by the entry. - -**Attributes** -Displays the file attributes. - -## Related topics - - -[How to Modify Virtual Registry Key Information](how-to-modify-virtual-registry-key-information.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-virtual-services-tab.md b/mdop/appv-v4/about-the-virtual-services-tab.md deleted file mode 100644 index 9da1a5c4f1..0000000000 --- a/mdop/appv-v4/about-the-virtual-services-tab.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: About the Virtual Services Tab -description: About the Virtual Services Tab -author: dansimp -ms.assetid: d31eea1b-9a37-42f1-8d7c-95881716e753 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Virtual Services Tab - - -During sequencing, a list of embedded services are identified and sequenced. Embedded services help an operating system run. The **Virtual Services** tab displays a list of embedded services. It also allows you to edit the properties of the individual services. - -## Columns - - -**Name** -The name of the service. - -**Description** -A description of the service. - -**Startup Type** -Indicates whether virtual services on the client are set to manual or automatic start-up. - -**Logon As** -Indicates the client log-on identity—for example, LocalSystem. - -**Services Type** -Indicates the type of service running on the Client. - -## Related topics - - -[How to Modify Attributes of Embedded Services](how-to-modify-attributes-of-embedded-services.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-using-the-sequencer-command-line.md b/mdop/appv-v4/about-using-the-sequencer-command-line.md deleted file mode 100644 index b54eeb6152..0000000000 --- a/mdop/appv-v4/about-using-the-sequencer-command-line.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: About Using the Sequencer Command Line -description: About Using the Sequencer Command Line -author: dansimp -ms.assetid: 0fd5f81b-17f9-4065-bce2-8785e8aac7c7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Using the Sequencer Command Line - - -You can use the command line to create sequenced application packages. Using the command line to create virtual applications is useful in the following scenarios: - -- You need to create a large number of sequenced application packages. - -- You need to create a sequenced application package on a recurring basis. - -**Important**   -Sequencing at the command prompt allows for default sequencing only. If you need to change default sequencing parameters, you must either manually modify a sequenced application package or re-sequence the application. - - - -All subsequent modifications to existing sequenced application packages must be made using the sequencing wizard. - -## Prerequisites - - -To sequence an application by using the command prompt, the following conditions must be met: - -- The application that is about to be sequenced must not require changes or workarounds made to it outside the installer or Windows Installer package. - -- Before sequencing, you must prepare a list of batch files for creating the sequenced application packages. - -- Review For more information about the command line parameters, see [Command-Line Parameters](command-line-parameters.md). - -- Review the errors that might be displayed when creating a sequenced application package by using the command line. For more information, see these errors, see [Command-Line Errors](command-line-errors.md). - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-virtual-environments.md b/mdop/appv-v4/about-virtual-environments.md deleted file mode 100644 index 263e550a58..0000000000 --- a/mdop/appv-v4/about-virtual-environments.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: About Virtual Environments -description: About Virtual Environments -author: dansimp -ms.assetid: e03a8c72-56c1-4ae9-aa45-0283c50a154c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Virtual Environments - - -Virtual applications run in virtual environments. Virtual environments enable each application to run on a desktop, laptop, or Remote Desktop Session Host (RD Session Host) server without installation and alteration of the host operating system. Each application carries its own configuration information in the virtual environment. As a result, many applications run side by side with other applications on the same computer without any conflicts. - -Virtual applications run locally, so they run with the full performance, functionality, and access to local services that you would expect from any application installed locally. - -Because each application runs in a virtual environment, the following problems are reduced: - -- Application conflicts—In environments that do not use Application Virtualization, you must thoroughly test every application to ensure that it does not interfere with other installed applications. - -- Regression testing—Because the application does not change the underlying operating system, lengthy regression testing is eliminated. - -- Version incompatibilities—Different versions of the same application can run simultaneously on the same computer. - -- Multiuser access—Applications that do not run in multiuser mode, and therefore cannot run within an RD Session Host, can now do so and function correctly for multiple users on a single RD Session Host. - -- Multitenancy issues—Two instances of the same application that use different configurations can run on the same computer at the same time. - -- Server siloing—The need for many separate server farms is eliminated. - -Virtual environments include a virtual registry for each application. Registry settings created by one application cannot be seen by other applications or utilities such as Regedit. Rather than copying the entire registry, the virtual registry uses an *overlay* method. Items in the client registry can be read by the application as long as a virtual copy of that registry item is not included in the virtual registry. All application writes to the registry are contained in the virtual registry. - -Virtual environments also include a virtual file system and other virtual components, including virtual services and virtual COM. - -## Related topics - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/add-app.md b/mdop/appv-v4/add-app.md deleted file mode 100644 index be8e8866ee..0000000000 --- a/mdop/appv-v4/add-app.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: ADD APP -description: ADD APP -author: dansimp -ms.assetid: 329fd0c8-a795-49be-b0fd-1367c5b4a34b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD APP - - -Adds an application record. - -`SFTMIME ADD APP:application /OSD osd-pathname [/ICON icon-pathname] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application.

          /OSD <osd-pathname>

          The path or URL for the OSD file.

          /ICON <icon-pathname>

          The path or URL for the icon file.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -**Note**   -The resulting name of the application will be taken from the OSD file and not from the name provided in APP:<application>. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/add-package.md b/mdop/appv-v4/add-package.md deleted file mode 100644 index 80ed132da5..0000000000 --- a/mdop/appv-v4/add-package.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: ADD PACKAGE -description: ADD PACKAGE -author: dansimp -ms.assetid: aa83928d-a234-4395-831e-2a7ef786ff53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD PACKAGE - - -Adds a package record. If the package already exists, this command will update the configuration of the existing package. - -`SFTMIME ADD PACKAGE:package-name /MANIFEST manifest-path [/OVERRIDEURL url [/AUTOLOADONREFRESH] [/AUTOLOADONLOGIN] [/AUTOLOADONLAUNCH] [/AUTOLOADTARGET {NONE|ALL|PREVUSED}] [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          PACKAGE:<package-name>

          User-visible and user-friendly name for the package.

          /MANIFEST <manifest-path>

          The path of the manifest file that lists the applications included in the package and all of their publishing information.

          /OVERRIDEURL <URL>

          The location of the package's SFT file.

          /AUTOLOADONREFRESH

          Background loading is performed after a publishing refresh.

          /AUTOLOADONLOGIN

          Background loading is performed when a user logs in.

          /AUTOLOADONLAUNCH

          Background loading is performed after a user starts an application from the package.

          /AUTOLOADTARGET target

          Indicates which applications from the package will be autoloaded.

          NONE

          No autoloading will be performed, despite the presence of any /AUTOLOADONxxx flags.

          ALL

          If an autoload trigger is enabled, all applications in the package will be loaded into cache whether or not they have been previously started.

          PREVUSED

          If an autoload trigger is enabled, the package will load if any applications in this package have previously been started by a user.

          /GLOBAL

          If present, the package will be available for all users on this computer.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/add-server.md b/mdop/appv-v4/add-server.md deleted file mode 100644 index 546c6c2e3a..0000000000 --- a/mdop/appv-v4/add-server.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: ADD SERVER -description: ADD SERVER -author: dansimp -ms.assetid: 4be2ac2e-a410-4711-9f84-f305393c8fa7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD SERVER - - -Adds a publishing server. - -`SFTMIME ADD SERVER:server-name /HOST hostname /TYPE {HTTP|RTSP} /PATH path [/PORT port] [/REFRESH {ON|OFF}] [/SECURE] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          SERVER:<server-name>

          The display name for the publishing server.

          /HOST <hostname>

          The host name or IP address for the publishing server.

          /TYPE {HTTP|RTSP}

          Indicates whether the publishing server is a Web server ("HTTP") or an Application Virtualization Server ("RTSP").

          /PORT <port>

          The port on which the publishing server listens. Defaults to 80 for normal HTTP servers, 443 for HTTP servers using enhanced security, 554 for normal Application Virtualization Servers, and 322 for servers using enhanced security.

          /PATH <path>

          The path portion of the URL used in a publishing request. If the TYPE parameter is set to RTSP, the path is optional and defaults to "/".

          /REFRESH

          If set to ON, publishing information will be refreshed when the user logs in. Defaults to ON.

          /SECURE

          If present, indicates that a connection with enhanced security should be established to the publishing server.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/add-type.md b/mdop/appv-v4/add-type.md deleted file mode 100644 index cfcbb9e6fb..0000000000 --- a/mdop/appv-v4/add-type.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: ADD TYPE -description: ADD TYPE -author: dansimp -ms.assetid: 8f1d3978-9977-4851-9f46-fee6aefa3535 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD TYPE - - -Adds the specified file type association. - -`SFTMIME ADD TYPE:file-extension /APP application [/ICON icon-pathname] [/DESCRIPTION type-desc] [/CONTENT-TYPE content-type] [/GLOBAL] [/PERCEIVED-TYPE perceived-type] [/PROGID progid] [/CONFIRMOPEN {YES|NO}] [/SHOWEXT {YES|NO}] [/NEWMENU {YES|NO}] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          TYPE:<file-extension>

          The file name extension that will be associated with the application specified.

          /APP <application>

          The name and version (optional) of the application.

          /ICON <icon-pathname>

          The path or URL for the icon file.

          /DESCRIPTION <type-desc>

          The user-friendly name for the file type. Defaults to "EXTENSION File."

          /CONTENT-TYPE <content-type>

          The content type of the file. Defaults to "application/softricity-extension."

          /GLOBAL

          If present, the package will be available for all users on this computer.

          /PERCEIVED-TYPE <perceived-type>

          The perceived type of the file. Defaults to nothing.

          /PROGID <progid>

          The programmatic identifier for the file type. Defaults to App Virt.extension.File.

          /CONFIRMOPEN

          Indicates whether users downloading a file of this type should be asked whether to open or save the file. Defaults to YES.

          /SHOWEXT

          Indicates whether the file's extension should always be shown, even if the user has requested that all extensions be hidden. Defaults to NO.

          /NEWMENU

          Indicates whether an entry should be added to the shell's New menu. Defaults to NO.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/administrators-node.md b/mdop/appv-v4/administrators-node.md deleted file mode 100644 index 633c1da358..0000000000 --- a/mdop/appv-v4/administrators-node.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Administrators Node -description: Administrators Node -author: dansimp -ms.assetid: 5f462a0d-af53-4464-9891-7b712193c7e8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrators Node - - -The **Administrators** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of administrator groups. Right-click the **Administrators** node to display a pop-up menu that contains the following elements. - -**Add Administrator Group** -Displays the **Select Groups** dialog to find and add the desired administrator group. Click **Finish** to add the group. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/administrators-results-pane-columns.md b/mdop/appv-v4/administrators-results-pane-columns.md deleted file mode 100644 index 57de6d3cde..0000000000 --- a/mdop/appv-v4/administrators-results-pane-columns.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Administrators Results Pane Columns -description: Administrators Results Pane Columns -author: dansimp -ms.assetid: 2ac86625-15a8-471a-846b-a42eae37ed72 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrators Results Pane Columns - - -The **Administrators Results** pane in the Application Virtualization Server Management Console displays two columns that are described in the following table. - - ---- - - - - - - - - - - - - - - - - -
          ColumnContents

          Domain

          Displays the name of the domain.

          Group

          Displays the name of the administrators group.

          - -  - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/administrators-results-pane.md b/mdop/appv-v4/administrators-results-pane.md deleted file mode 100644 index 88516a4348..0000000000 --- a/mdop/appv-v4/administrators-results-pane.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Administrators Results Pane -description: Administrators Results Pane -author: dansimp -ms.assetid: 92f4f924-c73b-45d6-8905-26f0f30aa189 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrators Results Pane - - -The **Administrators Results** pane in the Application Virtualization Server Management Console displays a list of the available administrator groups. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 4eec31af83..0000000000 --- a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Antivirus Running Dialog Box (App-V 4.6 SP1) -description: Antivirus Running Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: b720e308-8597-4470-a03e-fc36ffef84aa -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Antivirus Running Dialog Box (App-V 4.6 SP1) - - -Antivirus software is running on the computer running the App-V Sequencer. Running antivirus software during the creation of a virtual application package can interfere with the process by accessing required files that must to be added to the virtual application package or by adding extraneous data to the virtual application package. - -Use the following procedure to stop the antivirus software from running during sequencing: - -- On the computer running the App-V Sequencer, you must scan the computer and then stop the antivirus software from running. - - **Important**   - Remember to restart the antivirus software when you have finished sequencing the application. - - - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-45-sp2-release-notes.md b/mdop/appv-v4/app-v-45-sp2-release-notes.md deleted file mode 100644 index ab0e856ca4..0000000000 --- a/mdop/appv-v4/app-v-45-sp2-release-notes.md +++ /dev/null @@ -1,222 +0,0 @@ ---- -title: App-V 4.5 SP2 Release Notes -description: App-V 4.5 SP2 Release Notes -author: dansimp -ms.assetid: 1b3a8a83-4523-4634-9f75-29bc22ca5815 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.5 SP2 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. These Release Notes contain information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative. - - - -For updated information about known issues, please visit the Microsoft TechNet Library at [App-V 4.5 SP2 Release Notes](https://go.microsoft.com/fwlink/?LinkId=184640) (https://go.microsoft.com/fwlink/?LinkId=184640). - -## About Microsoft Application Virtualization 4.5 Service Pack 2 - - -These Release Notes have been updated to reflect the changes introduced with Microsoft Application Virtualization (App-V) 4.5 Service Pack 2 (SP2). This service pack contains the following changes: - -- Support for Office 2010: App-V 4.5 SP2 now supports the virtualization of Microsoft Office 2010. For prescriptive guidance for sequencing Microsoft Office 2010 with App-V 4.5 SP2, see [Prescriptive guidance for sequencing Office 2010 in Microsoft App-V 4.6](https://go.microsoft.com/fwlink/?LinkId=191539) (https://go.microsoft.com/fwlink/?LinkId=191539). - -- Support for Database Mirroring: App-V 4.5 SP2 now supports Microsoft SQL Server Database Mirroring. For more information about configuring database mirroring in your App-V environment, see [How to Configure Microsoft SQL Server Mirroring Support for App-V](https://go.microsoft.com/fwlink/?LinkId=190880) (https://go.microsoft.com/fwlink/?LinkId=190880). - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP2 also includes a rollup of fixes to address issues found after the App-V  4.5 SP1 release. The updates address a combination of known issues and customer feedback from Microsoft internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see article 980847 in the Microsoft Knowledge Base (KB) at [Description of Microsoft Application Virtualization 4.5 Service Pack 2](https://go.microsoft.com/fwlink/?LinkId=191540) (https://go.microsoft.com/fwlink/?LinkId=191540). - -## About the Product Documentation - - -Comprehensive documentation for Application Virtualization (App-V) is available on Microsoft TechNet in the [Application Virtualization TechCenter Library](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939). The TechNet documentation includes the online Help for the Application Virtualization Sequencer, the Application Virtualization Clients, and the Application Virtualization Server. It also includes the Application Virtualization Planning and Deployment Guide and the Application Virtualization Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see [Microsoft Security](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Provide Feedback - - -You can provide feedback, make a suggestion, or report an issue with the Microsoft Application Virtualization (App-V) Management System through the community forum on the Application Virtualization TechCenter [App-V Documentation Forum](https://go.microsoft.com/fwlink/?LinkId=122917) (https://go.microsoft.com/fwlink/?LinkId=122917). - -You can also send your documentation feedback directly to the App-V documentation team at . - -## Known Issues with Application Virtualization 4.5 SP2 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.5 SP2. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases of the software. - -### Guidance for installing Server Management Console - -If you have to install management software on systems other than the primary Application Virtualization publishing and streaming server, the server installation supports installing the Application Virtualization Management Console and Application Virtualization Management Web service on separate servers from the primary App-V Management Server. To distribute the management components across multiple servers, Kerberos delegation must be enabled on the server where the Application Virtualization Web service is installed. For information about how to enable this support, see [How to Configure the Server to be Trusted for Delegation](https://go.microsoft.com/fwlink/?LinkId=166682) (https://go.microsoft.com/fwlink/?LinkId=166682). - -### Guidance for installing or upgrading clients to App-V 4.5 SP2 by using Setup.msi - -When installing or upgrading your App-V Clients to App-V 4.5 SP2 by using Setup.msi, the prerequisites are not installed automatically. - -WORKAROUND   You must manually install the prerequisites before installing or upgrading the App-V Clients to App-V 4.5 SP2. For detailed procedures about how to install the prerequisites and the App-V Client, see [How to Install the Client by Using the Command Line](https://go.microsoft.com/fwlink/?LinkId=144106) (https://go.microsoft.com/fwlink/?LinkId=144106). - -When this has been completed, install the App-V 4.5 SP2 Clients by using Setup.msi with administrative credentials. This file is available on the App-V 4.5 SP2 release media in the Installers\\Client folder. - -When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 SP2 Desktop Client: - -**msiexec /i dw20shared.msi APPGUID={C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** - -Alternatively, if you are installing or upgrading to the App-V 4.5 SP2 Client for Remote Desktop Services (formerly Terminal Services), use the following command: - -**msiexec /i dw20shared.msi APPGUID={ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** - -**Note**   -- The APPGUID parameter references the product code of the App-V Clients that you install or upgrade. The product code is unique for each Setup.msi. You can use the Orca Database Editor or a similar tool to examine Windows Installer files and determine the product code. This step is required for all installations or upgrades to App-V 4.5 SP2. - -- This step is not required if you are upgrading and have previously installed Dw20shared.msi. - - - -### Improving performance when sequencing the .NET Framework - -When sequencing the Microsoft .NET Framework, you might experience reduced system performance because the .NET Framework NGEN service attempts to precompile assemblies as a background task. - -WORKAROUND   When sequencing the .NET Framework, disable the .NET Framework NGEN service (Mscorsvw.exe) after completing the monitoring phase. You must use the **Virtual Services** tab in the App-V Sequencer and change the startup type to **Disabled**. - -### When you uninstall the Microsoft Application Virtualization Client, user settings associated with the user performing the uninstallation are deleted - -When you uninstall the App-V Client, the Windows Installer removes Application Virtualization settings from the current user's profile. If your computer uses roaming profiles, do not use your personal network account to uninstall the client because it will remove settings for your virtual applications on all of your computers. - -WORKAROUND   You must uninstall the App-V Client with an administrative account that is not used for running virtual applications. - -### Edits made on the virtual file system and virtual registry tabs must be saved while running the Sequencing wizard - -If you open a package to perform an upgrade, or if you have already run the Sequencing wizard with a new package and make changes to the package in the virtual file system or virtual registry tabs, those changes are not automatically saved. - -WORKAROUND   Save the changes before re-running the wizard, to ensure that they are reflected inside the wizard’s virtual environment. - -### Command-line Sequencer must be run from an elevated command prompt - -When you use the command-line Sequencer, it does not prompt for elevation. - -WORKAROUND   Run the command-line Sequencer by using an elevated command prompt. - -### Short path variable names in OSD files can cause errors - -If you receive error 450478-1F702339-0000010B "The directory name is invalid" when starting a virtual application on the client, it is possible that the variable in the OSD is set incorrectly. This can happen if the application’s installer sets a short path name during sequencing. - -WORKAROUND   Remove the trailing tilde from any CSIDL variable that exists in the OSD file. - -### Correct syntax for DECODEPATH parameter for command-line Sequencer - -In the command-line Sequencer, when opening a package for upgrade and decoding it to the root of drive Q, the syntax for the *DECODEPATH* parameter should not include a trailing slash. - -WORKAROUND   You can use **Q:** rather than **Q:\\** (omitting the trailing "\\" character). - -### When upgrading APP-V 4.2 packages, you encounter problems caused by Windows Installer files in the Virtual File System - -When upgrading a package from APP-V 4.2, you might experience issues relating to a mismatch of Windows Installer system files that were included by default in APP-V 4.2 and the Windows Installer libraries locally installed on your Sequencing workstation. The following files are located in CSIDL\_SYSTEM\\: - -Cabinet.dll - -Msi.dll - -Msiexec.exe - -Msihnd.dll - -Msimsg.dlll - -WORKAROUND   Delete all of the preceding files from the package. Delete the mappings on the **VFS** tab and the actual files in the CSIDL\_SYSTEM folder in your decode path. - -### On Windows XP, by default, client installation logging is not enabled - -When installing the client, to ensure that any install errors are captured for troubleshooting, you must enable logging by using the command line. - -WORKAROUND   Add the parameter */l\*vx! log.txt* to the command line, as shown in the following example: - -**setup.exe /s /v”/qn /l\*vx! log.txt”** - -**msiexec.exe /i setup.msi /qn /l\*vx! log.txt** - -Alternatively, you can set the registry key to the following value: - -**\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\] "Logging"="voicewarmupx!"** - -### For Kerberos authentication to work, Service Principal Names (SPNs) must be registered for IIS - -When using Internet Information Services (IIS) 6.0 or IIS 7.0 for icon or OSD file retrieval and streaming of packages, to enable Kerberos authentication, the SPNs must be registered as follows: - -- On the IIS server, run the following commands by using the SETSPN.EXE Resource Kit tool. The server fully qualified domain name (FQDN) must be used. - - **Setspn -r SOFTGRID/<Server FQDN>** - - **Setspn -r HTTP/<Server FQDN>** - -For more information, see [Integrated Windows Authentication (IIS 6.0)](https://go.microsoft.com/fwlink/?LinkId=131407) (https://go.microsoft.com/fwlink/?LinkId=131407). - -### .NET compatibility changes - -Microsoft Application Virtualization (App-V) Cumulative Update 1 or later supports sequencing the .NET Framework on Windows XP SP2 or later. Sequencing routines for .NET applications that were written for SoftGrid 4.2 might have to be updated when used with the App-V 4.5 Sequencer. For details and workarounds, see the Application Virtualization TechCenter article at [Support for .NET in Microsoft Application Virtualization 4.5](https://go.microsoft.com/fwlink/?LinkId=123412) (https://go.microsoft.com/fwlink/?LinkId=123412). - -### After client upgrade from App-V 4.2, some applications are not shown - -Check for the following error in the log: "The Application Virtualization Client could not parse the OSD file". The App-V 4.5 Client filters out applications that have an OSD file that contains an empty OS tag (<OS></OS>). - -WORKAROUND   Delete the empty OS tag from the OSD file. - -### The App-V server requires exemptions in its firewall for certain processes - -For the server to stream applications correctly, the server's core processes, including the dispatcher, require access through the firewall. - -WORKAROUND   Set exemptions in the server's firewall for the following processes: Sghwsvr.exe and Sghwdsptr.exe. This applies to the App-V Management Server and App-V Streaming Server. - -### When the server installer is run in silent mode, it does not correctly check for MSXML6 - -The App-V Management Server depends on MSXML6. However, if you run the installer in silent mode—for example, by using the command **msiexec -i setup.msi /qn** on a system where MSXML6 is not already installed—the installer does not detect the missing dependency and installs anyway. Therefore, when clients attempt to refresh publishing information from the App-V Management Server, they will get errors. - -WORKAROUND   Verify that MSXML6 is installed on the system before attempting a silent installation of the App-V Management Server. - -### Error code 000C800 when attempting to connect to the Application Virtualization Management Console - -An Application Virtualization administrator who is not a local administrator on the App-V Management Web Service server receives an error (Error code: 000C800) when attempting to connect to the App-V Management Console, and the Sftmmc.log entry indicates that access to SftMgmt.udl is denied. To successfully connect to the App-V Management Console, an administrator who does not have local administrator rights on the App-V Management Web Service server must have at least Read and Execute permissions to the SftMgmt.udl file. - -Application Virtualization administrators must have Read and Execute permissions to the SftMgmt.UDL file in folder %systemdrive%\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service. - -### Client installer command-line parameters are ignored when used in conjunction with KEEPCURRENTSETTINGS=1 - -When used in conjunction with KEEPCURRENTSETTINGS=1, the following client installer command-line parameters are ignored: SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, SWIUSERDATA, and REQUIRESECURECONNECTION. - -WORKAROUND   If you have settings you want to retain, use KEEPCURRENTSETTINGS=1, and then set the other parameters after deployment. The App-V ADM Template can be used to set the following client settings: APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, AUTOLOADTARGET, AUTOLOADTRIGGERS, DOTIMEOUTMINUTES, and ALLOWINDEPENDENTFILESTREAMING. You can download the ADM Template from the Microsoft DownLoad Center at [Microsoft Application Virtualization Administrative Template (ADM Template)](https://go.microsoft.com/fwlink/?LinkId=121835) (https://go.microsoft.com/fwlink/?LinkId=121835). - -### Release Notes Copyright Information - -This document is provided "as-is". Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious.  No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-release-notes.md b/mdop/appv-v4/app-v-46-release-notes.md deleted file mode 100644 index 08a8ca5d64..0000000000 --- a/mdop/appv-v4/app-v-46-release-notes.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: App-V 4.6 Release Notes -description: App-V 4.6 Release Notes -author: dansimp -ms.assetid: a3eba129-edac-48bf-a933-3bf43a9873e5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that you need to successfully install Application Virtualization (App-V) 4.6. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other App-V documentation, the latest change should be considered authoritative. - - - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the [Microsoft Security Web site](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with Application Virtualization 4.6 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.6. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases. - -### Load/install error running a Windows Installer file generated by the App-V 4.5 Sequencer - -Running a Windows Installer file generated by the App-V 4.5 Sequencer produces a load/install error when trying to run it on an App-V 4.6 client. You will see the following message: "This package requires Microsoft Application Virtualization Client 4.5 or later". Please use the following workaround. - -WORKAROUND   Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi file for the package. - -**Note**   -Alternatively, at the command prompt, the App-V Sequencer can generate the new .msi file by using the */OPEN* and */MSI* parameters, for example, `SFTSequencer /Open:”package.sprj” /MSI`. For more information, see [How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md). - - - -### Release Notes Copyright Information - -This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious.  No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - - - -Microsoft, Active Directory, ActiveSync, ActiveX, Excel, SQL Server, Windows, Windows PowerShell, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-sp1-release-notes.md b/mdop/appv-v4/app-v-46-sp1-release-notes.md deleted file mode 100644 index dd7fa73a1b..0000000000 --- a/mdop/appv-v4/app-v-46-sp1-release-notes.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: App-V 4.6 SP1 Release Notes -description: App-V 4.6 SP1 Release Notes -author: dansimp -ms.assetid: aeb6784a-864a-4f4e-976b-40c34dcfd8d6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 SP1 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that helps you successfully install Application Virtualization (App-V) 4.6 SP1. This document contains information that is not available in the product documentation. If there is a difference between these Release Notes and other App-V documentation, the latest change should be considered authoritative. - - - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the [Microsoft Security website](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with Application Virtualization 4.6 SP1 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.6 SP1. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. When it is possible, these issues will be addressed in later releases. - -### Path from SPRT is lost if it does not end in forward slash ( / ) - -When the path in an HREF in a project template does not end with a forward slash (**/**), the generated HREF does not include the path. This occurs when the user manually manipulates the **.sprt** file. If you use the sequencer it always adds the forward slash (**/**) after the path. - -WORKAROUND Make sure that the HREF has a trailing forward slash (**/**). - -### User folder name do not correspond to the package name - -Folders that contain user and global .pkg files no longer include the package name. Previously, the App-V client used to use the package root folder 8.3 short name as part of the folder name. This lets you easily identify it. When you use the App-V 4.6 SP1 sequencer, the package root folder 8.3 short names are now random strings. This makes it difficult to identify the folders that contain the package’s **.pkg** files on the computer that is running the App-V client. - -WORKAROUND Use one of the following methods to more easily identify these package folders: - -1. When you create the package by using the Sequencer, specify a folder name that follows the 8.3 naming convention for the primary application folder. This name will then be used as part of the user folder name as was the case in App-V 4.6. - -2. The .sprj file now contains a tag that displays the string that is used as the beginning of the user folder name. You can use the **SHORTNAME** element of the **PACKAGEROOTFOLDER** element to determine the name. - -### Running App-V 4.6 SP1 on computers that have more than 64 processors - -When you run App-V 4.6 SP1 on computers that have more than 64 processors installed, the App-V client fails. - -WORKAROUND None. This configuration is not supported. You must run App-V 4.6 SP1on computers that have fewer than 64 processors. - -### Application Virtualization 4.6 SP1 update is not offered on all locales that use Microsoft Update - -When you use Microsoft Update, the update for App-V 4.6 SP1 is not available for the following language locales: - -- Kazakh - -- Hindi - -- Serbian-Cyrillic - -WORKAROUND If you are using Microsoft Windows Server Update Services (WSUS) use the English version of the update or download the update from the Microsoft Update Catalog. - -### After expanding the parent package, you cannot sequence a plug-in with side by side components - -When you expand a parent package by using **Tools** / **Expand Package to Local System** in the App-V Sequencer console and you sequence a plug-in with side by side components, an installation error is returned. For example: - -- **HRESULT 0x80073712** - -This is caused when the sequencer writes the side-by-side component to the registry but does not clear the value for the following registry key: - -HKEY\_LOCAL\_MACHINE\\COMPONENTS\\StoreDirty - -WORKAROUND After expanding the parent package on the computer that is running the sequencer, you have to delete the value for the following registry key: - -HKEY\_LOCAL\_MACHINE\\COMPONENTS\\StoreDirty - -After you have deleted the value, sequence the plug-in. - -### Release Notes Copyright Information - -This document is provided “as-is”. Information and views expressed in this document, such as URL and other Internet website references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - - - -Microsoft, Active Directory, ActiveSync, ActiveX, Excel, SQL Server, Windows, Windows PowerShell, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-sp2-release-notes.md b/mdop/appv-v4/app-v-46-sp2-release-notes.md deleted file mode 100644 index 227967a34a..0000000000 --- a/mdop/appv-v4/app-v-46-sp2-release-notes.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: App-V 4.6 SP2 Release Notes -description: App-V 4.6 SP2 Release Notes -author: dansimp -ms.assetid: abb536f0-e187-4c5b-952a-f837abd10ad2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 SP2 Release Notes - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Application Virtualization (App-V) 4.6 SP2. - -These release notes contain information that is required to successfully install Application Virtualization 4.6 SP2. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other App-V 4.6 SP2 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For more information about documentation for App-V, see the [Application Virtualization](https://go.microsoft.com/fwlink/?LinkID=232982) page on Microsoft TechNet. - -## Providing feedback - - -We are interested in your feedback on App-V 4.6 SP2. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan future changes for our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with App-V 4.6 SP2 - - -### Short file name support is disabled for non-system physical drives when you sequence - -When you sequence on Windows 8 or Windows Server 2012, support for short file names (8.3) is disabled by default for non-system physical drives. - -The underlying physical drive associated with the primary virtual application directory (for example, “Q:\\appname”) on the sequencing station must provide short file name (8.3) support in order for the App-V 4.6 SP2 Sequencer to generate short file names when creating virtual application packages. Short file name (8.3) support is disabled by default for non-system physical drives on Windows 8 or Windows Server 2012. - -**Workaround:** Enable short file name (8.3) support on non-system physical drives. You can use the following command to enable short file name support on Windows 8 or Windows Server 2012. - -``` syntax -fsutil 8dot3name set : -``` - -For example, use the following command if the drive letter is “Q:”: - -``` syntax -fsutil 8dot3name set Q: 0 -``` - -**Note**   -You do not need to change this setting on the App-V client because the App-V file system properly handles short paths on Windows 8 or Windows Server 2012. - - - -### App-V does not override the default handler for file type or protocol associations on Windows 8 - -If you select a default application by using **Default Programs** in **Control Panel** on Windows 8, App-V will not override the associated file type associations for that application. - -**Workaround:** None. - -### Virtualized Outlook 2010 is not offered as an option for mailto clickable links on Windows 8 - -The mailto shell extension does not offer virtualized Outlook 2010 on Windows 8. For example, if you click a mailto: link from virtualized Outlook 2010 that is running on Windows 8, a new email window is not created. This option works correctly on Windows 7 and earlier versions of the Windows operating system. - -**Workaround:** None. - -### Application Virtualization 4.6 SP2 update is not offered on all locales that use Microsoft Update - -When you use Microsoft Update, the update for App-V 4.6 SP2 is not available for the following language locales: - -- Kazakh - -- Hindi - -- Serbian-Cyrillic - -**Workaround:** If you are using Microsoft Windows Server Update Services (WSUS), use the English version of the update or download the update from the Microsoft Update Catalog. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-sp3-release-notes.md b/mdop/appv-v4/app-v-46-sp3-release-notes.md deleted file mode 100644 index d62afda16b..0000000000 --- a/mdop/appv-v4/app-v-46-sp3-release-notes.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: App-V 4.6 SP3 Release Notes -description: App-V 4.6 SP3 Release Notes -author: dansimp -ms.assetid: 206fadeb-59cc-47b4-836f-191ab1c27ff8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 SP3 Release Notes - - -To search these Release Notes, press CTRL+F. - -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that helps you successfully install Application Virtualization (App-V) 4.6 SP3. This document contains information that is not available in the product documentation. If there is a difference between these Release Notes and other App-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the [Microsoft Security website](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with Application Virtualization 4.6 SP3 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.6 SP3. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. When it is possible, these issues will be addressed in later releases. - -### Unable to open hyperlinks using Internet Explorer 11 on Microsoft Windows 8.1 within the Virtual Environment - -Attempting to open hyperlinks from within a virtual environment will fail on Windows 8.1 using Internet Explorer 11. This is because Internet Explorer 11 now ships with the Enhanced Protection Mode (EPM) enabled by default and this causes App-V to be unable to access required registry keys, files and communication port objects. - -WORKAROUND: Disable EPM in Internet Explorer 11 before opening an App-V package. This will allow you to open Internet Explorer from within the virtual environment. - -## Related topics - - -[About Microsoft Application Virtualization 4.6 SP3](about-microsoft-application-virtualization-46-sp3.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/app-v-application-wmi-class.md b/mdop/appv-v4/app-v-application-wmi-class.md deleted file mode 100644 index 3567a8da0e..0000000000 --- a/mdop/appv-v4/app-v-application-wmi-class.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: App-V Application WMI Class -description: App-V Application WMI Class -author: dansimp -ms.assetid: b79b0d5a-ba57-442f-8bb4-d7154fc056f9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Application WMI Class - - -In the Application Virtualization (App-V) Client, the **Application** class is a Windows Management Instrumentation (WMI) class that represents all the virtual applications on the client. - -The following syntax is simplified from Managed Object Format (MOF) code. The code includes all the inherited properties. - -## Syntax - - -``` syntax -class Application -{ - string Name; - string Version; - string PackageGUID; - datetime LastLaunchOnSystem; - uint32 GlobalRunningCount; - boolean Loading; - string OriginalOsdPath; - string CachedOsdPath; -}; -``` - -## Requirements - - -## Properties - - -**Name** -Data type: **String** - -Access type: Read-only - -Qualifiers: Key - -The display name of the virtual application. - -**Version** -Data type: **String** - -Access type: Read-only - -Qualifiers: Key - -The version of the virtual application. - -**PackageGUID** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The GUID of the package that the virtual application is associated with. - -**LastLaunchOnSystem** -Data type: **DateTime** - -Access type: Read-only - -Qualifiers: None - -The last date and time that the virtual application was launched. - -**GlobalRunningCount** -Data type: **UInt32** - -Access type: Read-only - -Qualifiers: None - -A count of the running instances of the virtual application that were started directly. - -**Loading** -Data type: **Boolean** - -Access type: Read-only - -Qualifiers: None - -**true** if the virtual application is being started; otherwise **false**. - -**OriginalOsdPath** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The original file path of the OSD file that was registered with the App-V Client. - -**CachedOsdPath** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The file path of the OSD file if the App-V Client has cached the OSD file locally. - -  - -  - - - - - diff --git a/mdop/appv-v4/app-v-client-registry-values-sp1.md b/mdop/appv-v4/app-v-client-registry-values-sp1.md deleted file mode 100644 index 5edc5870e2..0000000000 --- a/mdop/appv-v4/app-v-client-registry-values-sp1.md +++ /dev/null @@ -1,826 +0,0 @@ ---- -title: App-V Client Registry Values -description: App-V Client Registry Values -author: dansimp -ms.assetid: 46af5209-9762-47b9-afdb-9a2947e013f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Client Registry Values - - -The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists all the Application Virtualization (App-V) client registry keys and explains their uses. - -**Important** -On a computer running a 64-bit operating system, the keys and values described in the following sections will be under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client. - - - -## Configuration Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameTypeData (Examples)Description

          ProductName

          String

          Microsoft Application Virtualization Desktop Client

          Do not modify.

          Version

          String

          4.5.0.xxx

          Do not modify.

          Drivers

          String

          Sftfs.sys

          If this key value is present, it contains the name of the driver that caused a stop error the last time the core was starting. After you have fixed the stop error, you must delete this key value so that sftlist can start.

          InstallPath

          String

          Default=C:\Program Files\Microsoft Application Virtualization Client

          The location where the client is installed. Do not modify.

          LogFileName

          String

          Default=CSIDL_COMMON_APPDATA\Microsoft\Application Virtualization Client\sftlog.txt

          The path and name for the client log file.

          -
          -Note

          If you are running an earlier version than App-V 4.6, SP1 and you modify the log file name or location, you must restart the sftlist service for the change to take effect.

          -
          -
          - -
          -

          LogMinSeverity

          DWORD

          Default=4, Informational

          Controls which messages are written to the log. The value indicates a threshold of what is logged—everything less than or equal to that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged.

          -

          Value Range: 0x0 = None, 0x1 = Critical, 0x2 = Error, 0x3 = Warning, 0x4 = Information (Default), 0x5 = Verbose.

          -

          The log level is configurable from the Application Virtualization (App-V) client console and from the command prompt. At a command prompt, the command sftlist.exe /verboselog will increase the log level to verbose. For more information on command-line details see

          -

          https://go.microsoft.com/fwlink/?LinkId=141467https://go.microsoft.com/fwlink/?LinkId=141467

          -

          .

          LogRolloverCount

          DWORD

          Default=4

          Defines the number of backup copies of the log file that are kept when it is reset. The valid range is 0–9999. The default is 4. A value of 0 means no copies will be kept.

          LogMaxSize

          DWORD

          Default=256

          Defines the maximum size in megabytes (MB) that the log file can grow before being reset. The default size is 256 MB. When this size is reached, a log reset will be forced on the next write attempt.

          SystemEventLogLevel

          DWORD

          Default=0x4 (App-V 4.5)

          -

          Default=0x3 (App-V 4.6)

          Indicates the logging level at which log messages are written to the NT event log. The value indicates a threshold of what is logged—that is, everything equal to or less than that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged.

          -

          Value Range

          -

          0x0 = None

          -

          0x1 = Critical

          -

          0x2 = Error

          -

          0x3 = Warning

          -

          0x4 = Information (Default)

          -

          0x5 = Verbose

          AllowIndependentFileStreaming

          DWORD

          Default=0

          Indicates whether streaming from file will be enabled regardless of how the client has been configured with the APPLICATIONSOURCEROOT parameter. If set to FALSE, the transport will not enable streaming from files even if the OSD HREF or the APPLICATIONSOURCEROOT parameter contains a file path.

          -

          0x0=False (default)

          -

          0x1=True

          ApplicationSourceRoot

          String

          rtsps://mainserver:322/prodapps

          -

          https://mainserver:443/prodapps

          -

          file://\uncserver\share\prodapps

          -

          file://\uncserver\share

          Enables an administrator or electronic software distribution (ESD) system to ensure application loading is performed according to the topology management scheme. Use this key value to override the OSD CODEBASE for the HREF element (for example, the source location) for an application. Application Source Root supports URLs and Universal Naming Convention (UNC) path formats.

          -

          The correct format for the URL path is protocol://servername:[port][/path][/], where port and path are optional. If a port is not specified, the default port for the protocol is used. Only the protocol://server:port portion of the OSD URL is replaced.

          -

          The correct format for the UNC path is \computername\sharefolder[folder][], where folder is optional. The computer name can be a fully qualified domain name (FQDN) or an IP address, and sharefolder can be a drive letter. Only the \computername\sharefolder or drive letter portion of the OSD path is replaced.

          OSDSourceRoot

          String

          \computername\sharefolder\resource

          -

          \computername\content

          -

          C:\foldername

          -

          http://computername/productivity/

          -

          https://computername/productivity/

          Enables an administrator to specify a source location for OSD file retrieval for a sequenced application package during publication. Acceptable formats for the OSDSourceRoot include UNC paths and URLs (http or https).

          IconSourceRoot

          String

          \computername\sharefolder\resource

          -

          \computername\content

          -

          C:\foldername

          -

          http://computername/productivity/

          -

          https://computername/productivity/

          Enables an administrator to specify a source location for icon file retrieval for a sequenced application package during publication. Acceptable formats for the IconSourceRoot include UNC paths and URLs (http or https).

          AutoLoadTriggers

          DWORD

          Default=5

          AutoLoad is a client runtime policy configuration parameter that enables the secondary feature block of a virtualized application to be streamed to the client automatically in the background. The AutoLoad triggers are flags to indicate events that initiate auto-loading of applications. AutoLoad implicitly uses background streaming to enable the application to be fully loaded into cache. The primary feature block will be loaded first, and the remaining feature blocks will be loaded in the background to enable foreground operations, such as user interaction with applications, to take place and provide optimal perceived performance.

          -

          Bit mask values:

          -

          (0) Never: No bits are set (value is 0), no auto loading will be performed, because there are no triggers set.

          -

          (1) OnLaunch: Loading starts when a user starts an application.

          -

          (2) OnRefresh: Loading starts when the application is published. This occurs whenever the package record is added or updated—for example, when a publishing refresh occurs.

          -

          (4) OnLogin: Loading starts when a user logs in.

          -

          (5) OnLaunch and OnLogin: Default.

          AutoLoadTarget

          DWORD

          Default=1

          Indicates what will be auto-loaded when any given AutoLoad triggers occur. Bit mask values:

          -

          (0) None: No auto-loading, regardless of what triggers may be set.

          -

          (1) PreviouslyUsed (default): If any AutoLoad trigger is enabled, load only the packages where at least one application in the package has been previously used—that is, started or precached.

          -

          (2) All: If any AutoLoad trigger is enabled, all applications in the package (per package) or all packages (set for client) will be automatically loaded, whether or not they have ever been started.

          RequireAuthorizationIfCached

          DWORD

          Default=1

          Indicates that authorization is always required, whether or not an application is already in cache. Possible values:

          -

          0=False: Always try to connect to the server. If a connection to the server cannot be established, the client still allows the user to launch an application that has previously been loaded into cache.

          -

          1=True (default): Application always must be authorized at startup. For RTSP streamed applications, the user authorization token is sent to the server for authorization. For file-based applications, file ACLs control whether a user may access the application.

          -

          Restart the sftlist service for the change to take effect.

          UserDataDirectory

          String

          %APPDATA%

          Location where the icon cache and user settings are stored.

          GlobalDataDirectory

          String

          C:\Users\Public\Documents

          Directory to use for global App-V data, including caches for OSD files, icon files, shortcut information, and SystemGuard resources such as .ini files.

          AllowCrashes

          DWORD

          0 or 1

          Default=0: A value of 0 means that the client tries to catch internal program exceptions so that other user applications can recover and continue when a crash happens. A value of 1 means that the client allows the internal program exceptions to occur so that they can be captured in a debugger.

          CoreInternalTimeout

          DWORD

          60

          Time-out in seconds for internal IPC requests between core and front-end. Do not modify.

          DefaultSuiteCombineTime

          DWORD

          10

          This value is used to indicate how soon after being started that a program can shut down and not generate any error messages when another application in the same suite is running.

          SerializedSuiteLaunchTimeout

          DWORD

          Default=60000

          Defines how long in milliseconds the client will wait as it tries to serialize program starts in the same suite. If the client times out, the program start will continue but it will not be serialized.

          ScriptTimeout

          DWORD

          300

          Default time-out in seconds for scripts in OSD file if WAIT=TRUE. You can specify per-script time-outs with TIMEOUT instead of WAIT. A value of 0 means no wait, and 0xFFFFFFFF means wait forever.

          LaunchRecordLogPath

          String

          If, under either HKLM or HKCU, this value contains a valid path to a log file, SFTTray will write to this log when programs start, shut down, fail to launch, and enter or exit disconnected mode.

          LaunchRecordMask

          DWORD

          0x1A (26) log launch errors and disconnected mode entry and exit activity.

          -

          0x1F (31) logs everything.

          -

          0x0 (0) logs nothing.

          Specifies which of the five events are logged (bitmask values):

          -

          1 for program starts

          -

          2 for launch failure errors

          -

          4 for shutdowns

          -

          8 for entering disconnected mode

          -

          16 for exiting disconnected mode to reconnect to a server

          -

          Add any combination of those numbers to turn on the respective messages. Defaults to 0x1F if not in registry.

          LaunchRecordWriteTimeout

          DWORD

          Default=3000

          Specifies in milliseconds how long the tray will wait when trying to write to the launch record log if another process is using it.

          ImportSearchPath

          String

          d:\files;C:\documents and settings\user1\SFTs

          A semicolon delimited list of up to five directories to search for portable SFT files before prompting the user to select a directory. Trailing backslash in paths is optional. This value is not present by default and must be set manually.

          UserImportPath

          String

          D:\SFTs\

          Valid only under HKCU. The last location the user browsed to while finding a SFT file for package import. Set automatically if the SFT is found successfully. This is used on successive imports when trying to automatically locate SFT files.

          - - - -## Shared Key - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Shared key controls values that are shared across App-V components. The following table provides information about the registry values associated with the Shared key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Name Type Data (Examples) Description

          DumpPath

          String

          Default=C:\

          Default path to create dump files when generating a minidump on an exception. This defaults to C:\ if not specified. The Client installer sets this key to the <App Virtualization global data directory>\Dumps. The Sequencer installer sets this key to the installation directory.

          DumpPathSizeLimit

          DWORD

          1000

          Specifies the maximum total amount of disk space in megabytes that can be used to store minidumps. Default = 1000 MB.

          - - - -## Network Key - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network key controls a variety of network-related parameters. This key is primarily used by the network transport agent. The following table provides information about the registry values associated with the Network key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Name Type Data (Examples) Description

          Online

          DWORD

          Default=1

          Enables or disables offline mode. If set to 0, the client will not communicate with App-V Management Servers or publishing servers. In disconnected operations, the client can start a loaded application even when it is not connected to an App-V Management Server. In offline mode, the client does not attempt to connect to an App-V Management Server or publishing server. You must allow disconnected operations to be able to work offline. Default value is 1 enabled (online), and 0 is disabled (offline).

          AllowDisconnectedOperation

          DWORD

          Default=1

          Enables or disables disconnected operation. Default value is 1 enabled, and 0 is disabled. When disconnected operations are enabled, the App-V client can start a loaded application even when it is not connected to an App-V Management Server.

          FastConnectTimeout

          DWORD

          Default=1000

          This value specifies the TCP connect time-out in milliseconds to determine when to go into disconnected operations mode. This value can be used to override the default ConnectTimeout of 20 seconds (App-V connect time-out for network transactions) or the system’s TCP time-out of approximately 25 seconds. This brings the client into disconnected operations mode quickly. Applied on the next connect.

          LimitDisconnectedOperation

          DWORD

          Default=1

          Applicable only if AllowDisconnectedOperation is 1, enabled. This value determines whether there will be a time limit for how long the client will be allowed to operate in disconnected operations. 1=limited. 0=unlimited.

          DOTimeoutMinutes

          DWORD

          Default=129,600

          Indicates how many minutes an application may be used in disconnected operation mode.

          The valid values are 1–999,999 in days expressed in minutes (1–1,439,998,560 minutes). The default value is 90 days or 129,600 minutes.

          Protocol

          DWORD

          Default=8

          Default protocol to use (TCP vs SSL). Configure in Options Dialog.

          ReadTimeout

          DWORD

          20

          Read time-out for network transactions, in seconds. Do not modify.

          WriteTimeout

          DWORD

          20

          Write time-out for network transactions, in seconds. Do not modify.

          ConnectTimeout

          DWORD

          20

          Connect time-out for network transactions, in seconds. Do not modify.

          ReestablishmentRetries

          DWORD

          3

          The number of times to try to reestablish a dropped session.

          ReestablishmentInterval

          DWORD

          15

          The number of seconds to wait between tries to reestablish a dropped session.

          - - - -## Http Key - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\Http key controls the parameters that are related to Http streaming. This key is used primarily by the network transport agent. The following table provides information about the registry values that are associated with the Http key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Name Type Data (Examples) Description

          LaunchIfNotFound

          DWORD

          Default=0

          Controls the behavior of HTTP streaming when a connection to the HTTP server can be established and the package file no longer exists on the HTTP server. If the value does not exist or if it is not set to 1, the App-V client does not let you launch an application that has previously been loaded into cache.

          1

          If this value is set to 1, the App-V client lets you launch an application that has previously been loaded into cache.

          - - - -## File System Key - - -The values that are contained under the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS key control the file system parameters for App-V. The following table provides information about the registry values associated with the AppFS key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Name Type Data (Examples) Description

          FileSize

          DWORD

          4096

          Maximum size in megabytes of file system cache file. If you change this value in the registry, you must set State to 0 and reboot.

          FileName

          String

          C:\Users\Public\Documents\SoftGrid Client\sftfs.fsd

          Location of file system cache file. If you change this value in the registry, you must either leave FileSize the same and reboot or set State to 0 and reboot.

          DriveLetter

          String

          Q:

          Drive where App-V file system will be mounted, if it is available. This value is set either by the listener or the installer, and it is read by the file system.

          State

          DWORD

          0x100

          State of file system. Set to 0 and reboot to completely clear the file system cache.

          FileSystemStorage

          String

          C:\Profiles\Joe\SG

          Path for symlinks, set under HKCU. Do not modify (use data directory under Configuration to change).

          GlobalFileSystemStorage

          String

          C:\Users\Public\Documents\SoftGrid Client\AppFS Storage

          Path for global file system data. Do not modify.

          MaxPercentToLockInCache

          DWORD

          Default=90

          Specifies the maximum percentage of the file system cache file that can be locked. Do not modify.

          UnloadLeastRecentlyUsed

          DWORD

          Default=1

          The file system cache space management feature uses a Least Recently Used (LRU) algorithm and is enabled by default. If the space that is required for a new package would exceed the available free space in the cache, the App-V Client uses this feature to determine which, if any, existing packages it can delete from the cache to make room for the new package. The client deletes the package with the oldest last-accessed date if it is older than the value specified in the MinPkgAge registry value. Values are 0 (disabled) and 1 (default, enabled).

          MinPackageAge

          DWORD

          1

          To determine when the package can be selected for discard, set this registry value to equal the minimum number of days you want to elapse since the package was last accessed. Packages that have been used more recently are not discarded.

          - - - -## Permissions Key - - -To help to prevent users from making mistakes, administrators can use the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions key to control access to some actions for non-administrative users—for example, to prevent users from accidentally unloading programs. Users with administrative rights can give themselves any of these permissions. On shared systems, such as a Remote Desktop Session Host (RD Session Host) server (formerly Terminal Server) system, be careful when granting additional permissions to users because some of these permissions would enable users to control the applications used by all users on the system. Possible values for these settings are 1 (allow) and 0 (disallow). - -The Permissions key settings control all interfaces that enable the named actions. This includes the Options Dialog, SFTTray, and SFTMime. These settings do not affect administrators. The following table provides information about the registry values associated with the Permissions key. - -Name -Type -Data (Examples) -Description -ChangeFSDrive - -DWORD - -Default=0 - -A value of 1 allows users to pick a different drive letter to be used as the file system drive. - -ChangeCacheSize - -DWORD - -Default=0 - -A value of 1 allows users to change the cache size. - -ChangeLogSettings - -DWORD - -Default=0 - -A value of 1 allows users to modify the log level, change its location, and reset it through the user interface. - -AddApp - -DWORD - -Default=0 - -A value of 1 allows users to add applications explicitly. This does not affect applications that are added through publishing refresh nor does it prevent users from starting (and thereby implicitly adding) applications that have not already been added. Values are 0 or 1. - -LoadApp - -DWORD - -0 - -Does not allow a user to load an application. This is the default for RD Session Hosts. If you are a mobile user, you might want to fully load your applications in the cache to use them during disconnected operation or offline mode. To stream applications from the App-V Management Server or the App-V Streaming Server, you must be connected to a server to load applications. - -1 - -Allows a user to load an application. This is the default for Windows desktops. - -UnloadApp - -DWORD - -0 - -Does not allow a user to unload an application. When you load or unload a package, all the applications in the package are loaded into or removed from cache. - -1 - -Allows a user to unload an application. - -LockApp - -DWORD - -0 - -Does not allow a user to lock and unlock an application. This is the default for RD Session Hosts. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the App-V Desktop or Client for Remote Desktop Services (formerly Terminal Services) cache, you must unlock it. - -1 - -Allows a user to lock and unlock an application. This is the default for Windows Desktops. - -ManageTypes - -DWORD - -0 - -Does not allow a user to add, edit, or remove file type associations for that User alone. This is the default for RD Session Hosts. - -1 - -Allows a user to add, edit, and remove file type associations for that user only and not globally. This is the default for Windows Desktops. - -RefreshServer - -DWORD - -0 - -Does not allow a user to trigger a refresh of MIME settings. This is the default for RD Session Hosts. - -1 - -Enables a user to trigger a refresh of MIME settings. This is the default for Windows Desktops. - -UpdateOSDFile - -DWORD - -Default= 0 - -A value of 1 enables a user to use a modified OSD file. - -ImportApp - -DWORD - -0 - -Does not allow a user to import applications into cache. The difference between Load and Import is that when a Load is triggered, the client gets the package from the currently configured location contained in the OSD, ASR, or Override URL. When using Import, a location to get the package from must be specified. - -1 - -Allows a user to import applications into cache. - -ChangeRefreshSettings - -DWORD - -Default=0 - -A value of 1 allows users to modify the refresh settings for servers (refresh on login and periodic refresh). This does not imply that the user can modify other server settings (path, host, and so on). - -ManageServers - -DWORD - -Default=0 - -A value of 1 allows the user to add, edit, and remove servers, except for editing the refresh settings, which is controlled by the ChangeRefreshSettings permission. - -PublishShortcut - -DWORD - -Default=0 - -A value of 1 allows users to publish shortcuts through the user interface. This does not affect shortcuts that are published during a publishing refresh. - -ViewAllApplications - -DWORD - -Default=0 - -A value of 1 displays all applications through the user interface; otherwise, only the user’s applications are displayed. - -RepairApp - -DWORD - -Default=1 - -A value of 1 allows the user to use the Repair action on applications in SFTMime or the Client Management Console. When you repair an application, you remove any custom user settings and restore the default settings. This action does not change or delete shortcuts or file type associations, and it does not remove the application from cache. - -ClearApp - -DWORD - -Default=1 - -A value of 1 allows the user to use the Clear action on applications in SFTMime or the Client Management Console. When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. - -DeleteApp - -DWORD - -Default=0 - -A value of 1 allows the user to use the Delete action on applications in SFTMime or the Client Management Console. When you delete an application, the selected application will no longer be available to any users on that client. Shortcuts and file type associations are deleted and the application is deleted from cache. However, if another application refers to data in the file system cache or settings data for the selected application, these items will not be deleted. - -After a publishing refresh, the deleted applications will again become available to you. - -ToggleOfflineMode - -DWORD - -A value of 1 allows the users to select to run the client in Offline Mode. In Offline Mode, the Application Virtualization client can start a loaded application even when it is not connected to an Application Virtualization Server. - - - -## Custom Settings - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\CustomSettings key contains values specific to front-end components. All custom settings are stored as strings. The following table provides information about the registry values associated with the CustomSettings key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Name Type Data (Examples) Description

          TrayErrorDelay

          DWORD

          Default=30

          Time in seconds that the Application Virtualization notification area will display error messages like "Launch failed". Minimum value of 1.

          TraySuccessDelay

          DWORD

          Default=10

          Time in seconds that the appvmed notification area will display success messages like "Word launched" or "Excel shut down". If 0, those messages will be suppressed.

          TrayVisibility

          DWORD

          Default=0

          0=Show Tray when virtualized applications are in use.

          -

          1=Show Tray always.

          -

          2=Never show Tray.

          TrayShowRefresh

          DWORD

          When present and set to a value of 1, allows menu item Refresh Applications to be displayed on the Tray menu and is accessible by the user.

          TrayShowLoad

          DWORD

          When present and set to a value of 1, allows menu item Load Applications to be displayed on the Tray menu and is accessible by the user.

          - - - -## Reporting Settings - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Reporting key contains values specific to reporting to an App-V Management Server. The following table provides information about the registry values associated with the Reporting key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Name Type Data (Examples) Description

          DataCacheLimit

          DWORD

          Default=20

          This value specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. When a new record is added (bottom of the list), one or more of the oldest records (top of the list) will be deleted to make room. A warning will be logged to the Client log and the event log the first time this occurs, and it will not be logged again until after the cache has been successfully cleared on transmission and the log has filled up again.

          DataBlockSize

          DWORD

          Default=65536

          This value specifies the maximum size in bytes to transmit to the server at once on publishing refresh, to avoid permanent transmission failures when the log has reached a significant size. The default value is 65536. When transmitting report data to the server, one block of application records—less than or equal to the block size in bytes of XML data—will be removed from the cache and sent to the server. Each block will have the general Client data and global package list data prepended, and these will not factor into the block size calculations; the potential exists for an extremely large package list to result in transmission failures over low bandwidth or unreliable connections.

          - - - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-desktop-client-security.md b/mdop/appv-v4/app-v-desktop-client-security.md deleted file mode 100644 index 2bf8723032..0000000000 --- a/mdop/appv-v4/app-v-desktop-client-security.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: App-V Desktop Client Security -description: App-V Desktop Client Security -author: dansimp -ms.assetid: 216b9c16-7bb4-4f94-b9d8-810501285008 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Desktop Client Security - - -The App-V Desktop Client provides many security enhancements that were not available in previous versions of the product. These changes provide higher levels of security by default and through configuration of the client settings. - -**Note**   -When you install the App-V Desktop Client on a computer, the software defaults to the most secure settings. However, when upgrading, the previous settings of the client persist. - - - -By default, the App-V Desktop Client is configured only with the permissions required to allow a non-administrative user to perform a publishing refresh and stream applications. Additional security enhancements provided in the App-V Desktop Client include the following: - -- By default, an OSD cache update is allowed only by the publishing refresh process. - -- The log file (`sftlog.txt`) is accessible only by accounts with local administrative access to the client. - -- The log file now has a maximum size. - -- The log files are managed through archive settings. - -- System Event logging is now performed. - -## Permissions - - -After you install the Desktop Client, you can configure other security settings through the MMC, or on an individual client by using the registry or the ADM Template provided by Microsoft. The App-V Desktop Client has permissions that you can set to restrict non-administrative users from accessing all the features of the Desktop Client. For a full list of permissions, please see the App-V Client Help file or App-V Operations Guide. - -**Important**   -Carefully consider the consequences of changing access rights, especially on systems that are shared by multiple users, such as Terminal Servers. - - - -**Note**   -If users in the environment have local administrator privileges for their computers, the permissions are ignored. - - - -### ADM Template - -Microsoft Application Virtualization (App-V) introduces an ADM Template that you can use to configure the most common client settings through Group Policies. This template enables administrators to implement and change many of the client settings through a centralized administration model. Some of the settings available in the ADM Template are security settings. - -**Important**   -When using the ADM Template, remember that the settings are Group Policy preference settings and not fully managed Group Policies. - - - -For a full description of the ADM Template, the specific settings, and guidance to successfully deploy clients in your environment, see the App-V ADM Template white paper at [https://go.microsoft.com/fwlink/LinkId=122063](https://go.microsoft.com/fwlink/?LinkId=122063). - -## Removing OSD File Type Associations - - -If your organization does not require users to open applications directly from an OSD file, you can enhance security by removing the file type associations on the client. Remove the `HKEY_CURRENT_USERS` keys for OSD and `Softgird.osd.file` by using the registry editor. You can put this process into a logon script or into a post-installation script to automate these changes. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-installation-checklist.md b/mdop/appv-v4/app-v-installation-checklist.md deleted file mode 100644 index 68208f051d..0000000000 --- a/mdop/appv-v4/app-v-installation-checklist.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: App-V Installation Checklist -description: App-V Installation Checklist -author: dansimp -ms.assetid: b17efaab-cd6d-4c30-beb7-c6e7c9c87657 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Installation Checklist - - -The following checklist is intended to provide a high-level list of items to consider and outlines the steps you should take to install the Microsoft Application Virtualization (App-V) servers. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Install the App-V Management Server. If you are installing the Management Web Service, Management Console, or the Data Store on different servers, you can use the custom installation option.

          How to Install Application Virtualization Management Server

          Install the App-V Management Web Service. (Optional ¹)

          How to Install the Management Web Service

          Install the App-V Management Console. (Optional ¹)

          How to Install the Management Console

          Install the App-V Data Store. (Optional ¹)

          How to Install a Database

          Install the App-V client.

          How to Manually Install the Application Virtualization Client

          Install the App-V Sequencer.

          How to Install the Application Virtualization Sequencer

          Install the App-V Streaming Server. (This is optional and required only if you are installing the Streaming Server).

          How to Install the Application Virtualization Streaming Server

          Create Content directories on the servers that will be used for streaming applications to users’ computers.

          How to Configure the Application Virtualization Management Servers

          -

          How to Configure the Application Virtualization Streaming Servers

          -

          How to Configure the Server for IIS

          -

          How to Configure the File Server

          - - - -¹ This is required only if you are installing the App-V Management Web Service, Management Console, or the Data Store on a different computer. - -## Related topics - - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - -[App-V Postinstallation Checklist](app-v-postinstallation-checklist.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md b/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md deleted file mode 100644 index b4fc7f6ba0..0000000000 --- a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: App-V Interoperability with Windows AppLocker -description: App-V Interoperability with Windows AppLocker -author: dansimp -ms.assetid: 9a488034-607d-411c-b495-ff184c726f49 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Interoperability with Windows AppLocker - - -Version 4.5 SP1 of the Microsoft Application Virtualization (App-V) client supports the AppLocker feature of Windows 7. The AppLocker feature enables IT administrators to specify which applications are restricted from running on computers. This document describes how to configure the AppLocker rules to work with the App-V virtual environment and virtualized applications. - -**Note**   -Windows AppLocker must first be enabled before configuring Windows AppLocker rules for virtual applications. For more information about enabling Windows AppLocker, [Windows AppLocker](https://go.microsoft.com/fwlink/?LinkId=156732) (https://go.microsoft.com/fwlink/?LinkId=156732). - - - -## Configuring Windows AppLocker Rules for Virtual Applications - - -Local administrators can create Windows AppLocker rules that restrict the running of program executables (.exe files), Windows Installer files (.msi and .msp files), and scripts (.ps, .bat, .cmd, .vbs and .js files). The administrator does this by using a reference computer that has the App-V client installed and that has all the relevant virtual applications streamed to the client cache. The administrator then uses the Windows AppLocker section of the Local Security Policy Microsoft Management Console (MMC) snap-in on the reference computer to create the rules. - -When you browse to find a directory path or specific file for which you want to create a rule, you can access the App-V drive by using the path to the hidden share. For example, you can browse to \\\\localhost\\Q$, where the App-V drive is drive Q. However, to create the rule, you must edit the path to remove the reference to \\\\localhost\\Q$ and use Q:\\ instead. You must start each application on the reference computer to access the application’s files, and administrative rights are required to browse to \\\\localhost\\Q$. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-package-wmi-class.md b/mdop/appv-v4/app-v-package-wmi-class.md deleted file mode 100644 index f9efeee4ce..0000000000 --- a/mdop/appv-v4/app-v-package-wmi-class.md +++ /dev/null @@ -1,161 +0,0 @@ ---- -title: App-V Package WMI Class -description: App-V Package WMI Class -author: dansimp -ms.assetid: 0fc26c3b-9706-4804-be2d-645771dc33ae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Package WMI Class - - -In the Application Virtualization (App-V) Client, the **Package** class is a Windows Management Instrumentation (WMI) class that represents all the virtual packages on the client. The virtual packages can contain many virtual applications. - -## Syntax - - -``` syntax -class Package -{ - string Name; - string Version; - string PackageGUID; - string SftPath; - uint64 TotalSize; - uint64 CachedSize; - uint64 LaunchSize; - uint64 CachedLaunchSize; - boolean InUse; - boolean Locked; - uint16 CachedPercentage; - string VersionGUID; - }; -``` - -## Properties - - -**Name** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The user-friendly name of the virtual package. - -**Version** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The version of the virtual package. - -**PackageGUID** -Data type: **String** - -Access type: Read-only - -Qualifiers: Key - -The GUID identifier of the package configuration and source files. - -**SftPath** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The file path of the SFT file. - -**TotalSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -The total size of the virtual package, in kilobytes. - -**CachedSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -The total size of the cache for the virtual package, in kilobytes. - -**LaunchSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -The total size of the virtual package’s primary feature block, in kilobytes. - -**CachedLaunchSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -Total size of the virtual package’s primary feature block that has been cached, in kilobytes. - -**InUse** -Data type: **Boolean** - -Access type: Read-only - -Qualifiers: None - -**true** if any virtual application in the virtual package is running; otherwise **false**. - -**Locked** -Data type: **Boolean** - -Access type: Read-only - -Qualifiers: None - -**true** if the virtual package is locked; otherwise **false**. - -**CachedPercentage** -Data type: **UInt16** - -Access type: Read-only - -Qualifiers: None - -The percentage of the cache files. Based on the following formula: CachedSize / TotalSize × 100. - -**VersionGUID** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The GUID identifier of the package version. - -  - -  - - - - - diff --git a/mdop/appv-v4/app-v-postinstallation-checklist.md b/mdop/appv-v4/app-v-postinstallation-checklist.md deleted file mode 100644 index 814811b75f..0000000000 --- a/mdop/appv-v4/app-v-postinstallation-checklist.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: App-V Postinstallation Checklist -description: App-V Postinstallation Checklist -author: dansimp -ms.assetid: 74db297e-a744-4287-bcc6-0e096ca8b57a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Postinstallation Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps you should take after you have completed the installation of the Microsoft Application Virtualization (App-V) Management Server, App-V Streaming Server, and the App-V Desktop Client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Create firewall exceptions for the App-V Management Server or Streaming Server services.

          Configuring the Firewall for the App-V Servers

          Verify that the App-V system is functioning correctly by publishing, streaming, and testing the default application.

          How to Install and Configure the Default Application

          Configure the App-V Client to use the App-V Streaming Server or other server for streaming by means of the ApplicationSourceRoot, IconSourceRoot, and OSDSourceRoot settings.

          How to Configure the Client for Application Package Retrieval

          Understand how to use the .msi file version of sequenced application packages for offline deployment.

          How to Publish a Virtual Application on the Client

          (Optional) Configure SQL Server database mirroring for the App-V database.

          How to Configure Microsoft SQL Server Mirroring Support for App-V

          - - - -## Related topics - - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-pre-installation-checklist.md b/mdop/appv-v4/app-v-pre-installation-checklist.md deleted file mode 100644 index 4de02e6032..0000000000 --- a/mdop/appv-v4/app-v-pre-installation-checklist.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: App-V Pre-Installation Checklist -description: App-V Pre-Installation Checklist -author: dansimp -ms.assetid: 3af609b1-2c09-4edb-b083-b913b6d5e8c4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Pre-Installation Checklist - - -The following checklist is intended to provide a high-level list of items to consider and outlines the steps you should take before you install the Microsoft Application Virtualization (App-V) servers. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Ensure your computing environment meets the supported configurations required for App-V.

          Application Virtualization Deployment Requirements

          Configure the necessary Active Directory groups and accounts.

          Configuring Prerequisite Groups in Active Directory for App-V

          Configure the Internet Information Services (IIS) settings on the server that is running IIS.

          How to Configure Windows Server 2008 for App-V Management Servers

          Configure the server that is running IIS to be trusted for delegation.

          -
          -Note

          This is required only if you are installing the App-V Management Server by using a distributed system architecture, that is, if you install the App-V Management Console, the Management Web Service, and the database on different computers.

          -
          -
          - -

          How to Configure the Server to be Trusted for Delegation

          Install Microsoft SQL Server 2008.

          Install SQL Server 2008 (https://go.microsoft.com/fwlink/?LinkId=181924).

          - - - -## Related topics - - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - -[App-V Installation Checklist](app-v-installation-checklist.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-upgrade-checklist.md b/mdop/appv-v4/app-v-upgrade-checklist.md deleted file mode 100644 index 942fa32de6..0000000000 --- a/mdop/appv-v4/app-v-upgrade-checklist.md +++ /dev/null @@ -1,213 +0,0 @@ ---- -title: App-V Upgrade Checklist -description: App-V Upgrade Checklist -author: dansimp -ms.assetid: 64e317d2-d260-4b67-8a49-ba9ac513087a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Upgrade Checklist - - -Before trying to upgrade to Microsoft Application Virtualization (App-V) 4.5 or later versions, any version earlier than App-V 4.1 must be upgraded to App-V 4.1. You should plan to upgrade clients first, and then upgrade the server components. App-V clients that have been upgraded to App-V 4.5 continue to work with App-V servers that have not yet been upgraded. Earlier versions of the client are not supported on servers that have been upgraded to App-V 4.5. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Upgrade the App-V clients.

          How to Upgrade the Application Virtualization Client

          Upgrade the App-V servers and database.

          -
          -Important

          If you have more than one server sharing access to the App-V database, all those servers must be taken offline while the database is being upgraded. You should follow your regular business practices for the database upgrade, but we recommend that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the App-V software on the other servers.

          -
          -
          - -

          How to Upgrade the Servers and System Components

          Upgrade the App-V Management Web Service.

          -

          This step applies only if the Management Web Service is on a separate server, which would require that you run the server installer program on that separate server to upgrade the Management Web service. Otherwise, the previous server upgrade step will automatically upgrade the Management Web Service.

          How to Upgrade the Servers and System Components

          Upgrade the App-V Management Console.

          -

          This step applies only if the Management Console is on a separate computer, which would require that you run the server installer program on that separate computer to upgrade the console. Otherwise, the previous server upgrade step will upgrade the Management Console.

          How to Upgrade the Servers and System Components

          Upgrade the App-V Sequencer.

          How to Upgrade the Application Virtualization Sequencer

          - - - -## Additional Upgrade Considerations - - -- Any virtual application packages sequenced in version 4.2 will not have to be sequenced again for use with version 4.5. However, you should consider upgrading the virtual packages to the Microsoft Application Virtualization 4.5 format if you want to apply default access control lists (ACLs) or generate a Windows Installer file. This is a simple process and requires only that the existing virtual application package be opened and saved with the App-V 4.5 Sequencer. This can be automated by using the App-VSequencer command-line interface. For more information, see [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -- One of the features of the 4.5 Sequencer is the ability to create Windows Installer (.msi) files as control points for virtual application package interoperability with electronic software distribution (ESD) systems, such as Microsoft System Center Configuration Manager 2007. Previous Windows Installer files created with the MSI tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 client that is subsequently upgraded to App-V 4.5 will continue to work, although they cannot be installed on the App-V 4.5 client. However, they cannot be removed or upgraded unless they are upgraded in the App-V 4.5 Sequencer. The original App-V package earlier than 4.5 has to be opened in the App-V 4.5 Sequencer and then saved as a Windows Installer File. - - **Note** - If the App-V 4.2 Client has already been upgraded to App-V 4.5, it is possible to script a workaround to preserve the version 4.2 packages on version 4.5 clients and allow them to be managed. This script must copy two files, msvcp71.dll and msvcr71.dll, to the App-V installation folder and set the following registry key values under the registry key:\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\]: - - "ClientVersion"="4.2.1.20" - - "GlobalDataDirectory"="C:\\\\Documents and Settings\\\\All Users\\\\Documents\\\\" (a globally writeable location) - - - -- Windows Installer files generated by the App-V 4.5 Sequencer display the error message "This package requires Microsoft Application Virtualization Client 4.5 or later" when trying to run them on an App-V 4.6 Client. Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi file for the package. - -- Any version 4.2 reports that were created and saved will be overwritten when the server is upgraded to version 4.5. If you have to keep these reports, you must save a backup copy of the SftMMC.msc file located in the SoftGrid Management Console folder on the server and use that copy to replace the new SftMMC.msc that is installed during the upgrade. - -- For additional information about upgrading from previous versions, see [Upgrading to Microsoft Application Virtualization 4.5 FAQ](https://go.microsoft.com/fwlink/?LinkId=120358) (https://go.microsoft.com/fwlink/?LinkId=120358). - -## App-V 4.6 Client Package Support - - -You can deploy packages created in previous versions of App-V to App-V 4.6 clients. However, you must modify the associated .osd file so that it includes the appropriate operating system and chip architecture information. The following values can be used: - - --- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          OS Value

          <OS VALUE=”Win2003TS”/>

          <OS VALUE=”Win2003TS64”/>

          <OS VALUE=”Win2008TS”/>

          <OS VALUE=”Win2008TS64”/>

          <OS VALUE=”Win2008R2TS64”/>

          <OS VALUE=”Win7”/>

          <OS VALUE=”Win764”/>

          <OS VALUE=”WinVista”/>

          <OS VALUE=”WinVista64”/>

          <OS VALUE=”WinXP”/>

          <OS VALUE=”WinXP64”/>

          - - - -To run a newly created 32-bit package, you must sequence the application on a computer running a 32-bit operating system with the App-V 4.6 Sequencer installed. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab and then specify the appropriate operating system and chip architecture as required. - -**Important** -Applications sequenced on a computer running a 64-bit operating system must be deployed to computers running a 64-bit operating system. New 32-bit packages created by using the App-V 4.6 Sequencer do not run on computers running the App-V 4.5 client. - - - -To run new 64-bit packages on the App-V 4.6 Client, you must sequence the application on a computer running the App-V 4.6 Sequencer and that is running a 64-bit operating system. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab, and then specify the appropriate operating system and chip architecture as required. - -The following table lists which client versions will run packages created by using the various versions of the sequencer. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Sequenced by using the App-V 4.2 SequencerSequenced by using the App-V 4.5 SequencerSequenced by using the 32-bit App-V 4.6 SequencerSequenced by using the 64-bit App-V 4.6 Sequencer

          4.2 Client

          Yes

          No

          No

          No

          4.5 Client ¹

          Yes

          Yes

          No

          No

          4.6 Client (32-bit)

          Yes

          Yes

          Yes

          No

          4.6 Client (64-bit)

          Yes

          Yes

          Yes

          Yes

          - - - -¹Applies to all versions of the App-V 4.5 client, including App-V 4.5, App-V 4.5 CU1, and App-V 4.5 SP1. - - - - - - - - - diff --git a/mdop/appv-v4/application-utilization-reportserver.md b/mdop/appv-v4/application-utilization-reportserver.md deleted file mode 100644 index 78ed55aaad..0000000000 --- a/mdop/appv-v4/application-utilization-reportserver.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Application Utilization Report -description: Application Utilization Report -author: dansimp -ms.assetid: cb961969-c9a3-4d46-8303-121d737d76d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Utilization Report - - -Use the Application Utilization Report to track usage information for a specified application defined in the database. You can use this report to determine how heavily a specific application is used. - -This report generates a graph that displays the total daily usage over time during the reporting period. - -This report also lists the following information: - -- Number of sessions—Number of times an application was used - -The Application Utilization Report also includes a summary of the total usage. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run a report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md deleted file mode 100644 index e7bf14bd06..0000000000 --- a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md +++ /dev/null @@ -1,274 +0,0 @@ ---- -title: Application Virtualization Client Hardware and Software Requirements -description: Application Virtualization Client Hardware and Software Requirements -author: dansimp -ms.assetid: 8b877a2c-5721-4b22-a47f-e2838d58ab12 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Virtualization Client Hardware and Software Requirements - - -This topic describes the recommended minimum hardware and software configuration for the installation of the Application Virtualization Desktop Client and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -## Application Virtualization Desktop Client - - -The following list includes the recommended minimum hardware and software requirements for the Application Virtualization Desktop Client. The requirements are listed first for Microsoft Application Virtualization (App-V) 4.6 SP2, followed by the requirements for versions that preceded App-V 4.6 SP2. - -**Note**   -The Application Virtualization (App-V) Desktop Client requires no additional processor or RAM resources beyond the requirements of the host operating system. - - - -### Hardware Requirements - -The hardware requirements are applicable to all versions. - -- Processor—See recommended system requirements for the operating system you are using. - -- RAM—See recommended system requirements for the operating system you are using. - -- Disk—30 MB for installation and 6 GB for the cache. - -### Software Requirements for App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackArchitectural SKU

          Windows XP

          Professional Edition

          SP3

          x86

          Windows Vista

          Business, Enterprise, or Ultimate Edition

          SP2

          x86

          Windows 7

          Professional, Enterprise, or Ultimate Edition

          No service pack or SP1

          x86 and x64

          Windows 8

          Pro or Enterprise Edition

          x86 and x64

          - -The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first. -- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360). - - **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266). - -For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed. - -- **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700). - -### Software Requirements for Versions that Precede App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackArchitectural SKU

          Windows XP

          Professional Edition

          SP2 or SP3

          x86 and x64

          Windows Vista

          Business, Enterprise, or Ultimate Edition

          No service pack, SP1, or SP2

          x86 and x64

          Windows 7¹

          Professional, Enterprise, or Ultimate Edition

          No service pack or SP1

          x86 and x64

          -¹Supported for App-V 4.5 SP1 and SP2, App-V 4.6 and 4.6 SP1 only - -The Application Virtualization (App-V) 4.6 Desktop Client supports x86 and x64 SKUs of these operating systems. - -The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first. - -- Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist_x86.exe from Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update (https://go.microsoft.com/fwlink/?LinkId=169360). - -- Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) (https://go.microsoft.com/fwlink/?LinkId=63266). - -- Microsoft Application Error Reporting—The installation program for this software is included in the Support\Watson folder in the self-extracting archive file. - -For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed. - -- Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) (https://go.microsoft.com/fwlink/?LinkId=150700). - -## Application Virtualization Client for Remote Desktop Services - -Following are the recommended hardware and software requirements for the Application Virtualization Client for Remote Desktop Services. The requirements are listed first for appv461_3, followed by the requirements for versions that preceded App-V 4.6 SP2. - -The Application Virtualization (App-V) Client for Remote Desktop Services requires no additional processor or RAM resources beyond the requirements of the host operating system. - -### Hardware Requirements - -The hardware requirements are applicable to all versions. - -- Processor—See recommended system requirements for the operating system you are using. - -- RAM—See recommended system requirements for the operating system you are using. These requirements also depend on the number of users and applications. - -- Disk—30 MB for installation and 6 GB for the cache. - -### Software Requirements for App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackArchitectural SKU

          Windows Server 2003 R2

          Standard Edition, Enterprise Edition, or Datacenter Edition

          SP2

          x86 and x64

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP2

          x86 and x64

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter Edition

          No service pack or SP1

          x64

          Windows Server 2012

          Standard, Enterprise, or Datacenter Edition

          x64

          - -The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first. - -- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360). - -- **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266). - -- **Microsoft Application Error Reporting**—The installation program for this software is included in the **Support\\Watson** folder in the self-extracting archive file. - -For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed. - -- **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700). - -### Software Requirements for Versions that Precede App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackArchitectural SKU

          Windows Server 2003

          Standard Edition, Enterprise Edition, or Datacenter Edition

          SP1 or SP2

          x86 and x64

          Windows Server 2003 R2

          Standard Edition, Enterprise Edition, or Datacenter Edition

          No service pack or SP2

          x86 and x64

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP1 or SP2

          x86 and x64

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter Edition

          No service pack or SP1

          x64

          - -The Application Virtualization (App-V) 4.6 Client for Remote Desktop Services supports x86 and x64 SKUs of these operating systems. - -## Related topics -- [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -- [Application Virtualization System Requirements](application-virtualization-system-requirements.md) -- [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) -- [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -- [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) diff --git a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md b/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md deleted file mode 100644 index 2f13cd29a0..0000000000 --- a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md +++ /dev/null @@ -1,311 +0,0 @@ ---- -title: Application Virtualization Client Installer Command-Line Parameters -description: Application Virtualization Client Installer Command-Line Parameters -author: dansimp -ms.assetid: 508fa404-52a5-4919-8788-2a3dfb00639b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Virtualization Client Installer Command-Line Parameters - - -The following table lists all available Microsoft Application Virtualization Client installer command-line parameters, their values, and a brief description of each parameter. Parameters are case-sensitive and must be entered as all-uppercase letters. All parameter values must be enclosed in double quotes. - -**Note** -- For App-V version 4.6, command-line parameters cannot be used during a client upgrade. - -- The *SWICACHESIZE* and *MINFREESPACEMB* parameters cannot be combined on the command line. If both are used, the *SWICACHESIZE* parameter will be ignored. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterValuesDescription

          ALLOWINDEPENDENTFILESTREAMING

          TRUE

          -

          FALSE

          Indicates whether streaming from file will be enabled regardless of how the client has been configured with the APPLICATIONSOURCEROOT parameter. If set to FALSE, the transport will not enable streaming from files even if the OSD HREF or the APPLICATIONSOURCEROOT parameter contains a file path.

          -

          Possible values:

          -
            -
          • TRUE—Manually deployed application may be loaded from disk.

          • -
          • FALSE—All applications must come from source streaming server.

          • -

          APPLICATIONSOURCEROOT

          RTSP:// URL (for dynamic package delivery)

          -

          File:// URL or UNC (for load from file package delivery)

          To enable an administrator or an electronic software distribution system to ensure that application loading is performed in compliance with the topology management scheme, allows an override of the OSD CODEBASE for the application HREF element (the source location). If the value is “”, which is the default value, the existing OSD file settings are used.

          -

          A URL has several parts:

          -

          <protocol>://<server>:<port>/<path>/<?query><#fragment>

          -

          A UNC path has three parts:

          -

          &lt;computername>&lt;share folder>&lt;resource>

          -

          If the APPLICATIONSOURCEROOT parameter is specified on a client, the client will break the URL or UNC path from an OSD file into its constituent parts and replace the OSD sections with the corresponding APPLICATIONSOURCEROOT sections.

          -
          -Important

          Be sure to use the correct format when using file:// with a UNC path. The correct format is file://&lt;server>&lt;share>.

          -
          -
          - -

          ICONSOURCEROOT

          UNC

          -

          HTTP://URL or HTTPS://URL

          Enables an administrator to specify a source location for icon retrieval for a sequenced application package during publication. Icon source roots support UNC paths and URLs (HTTP or HTTPS). If the value is “”, which is the default value, the existing OSD file settings are used.

          -

          A URL has several parts:

          -

          <protocol>://<server>:<port>/<path>/<?query><#fragment>

          -

          A UNC path has three parts:

          -

          &lt;computername>&lt;share folder>&lt;resource>

          -
          -Important

          Be sure to use the correct format when using a UNC path. Acceptable formats are &lt;server>&lt;share> or <drive letter>:&lt;folder>.

          -
          -
          - -

          OSDSOURCEROOT

          UNC

          -

          HTTP://URL or HTTPS://URL

          Enables an administrator to specify a source location for OSD file retrieval for an application package during publication. OSD source roots support UNC paths and URLs (HTTP or HTTPS). If the value is “”, which is the default value, the existing OSD file settings are used.

          -

          A URL has several parts:

          -

          <protocol>://<server>:<port>/<path>/<?query><#fragment>

          -

          A UNC path has three parts:

          -

          &lt;computername>&lt;share folder>&lt;resource>

          -
          -Important

          Be sure to use the correct format when using a UNC path. Acceptable formats are &lt;server>&lt;share> or <drive letter>:&lt;folder>.

          -
          -
          - -

          AUTOLOADONLOGIN

          -

          AUTOLOADONLAUNCH

          -

          AUTOLOADONREFRESH

          [0|1]

          The AutoLoad triggers that define the events that initiate auto-loading of applications. AutoLoad implicitly uses background streaming to enable the application to be fully loaded into cache.

          -

          The primary feature block will be loaded as quickly as possible. Remaining feature blocks will be loaded in the background to enable foreground operations, such as user interaction with applications, to take priority and provide optimal performance.

          -
          -Note

          The AUTOLOADTARGET parameter determines which applications are auto-loaded. By default, packages that have been used are auto-loaded unless AUTOLOADTARGET is set.

          -
          -
          - -
          -

          Each parameter affects loading behavior as follows:

          -
            -
          • AUTOLOADONLOGIN—Loading starts when the user logs in.

          • -
          • AUTOLOADONLAUNCH—Loading starts when the user starts an application.

          • -
          • AUTOLOADONREFRESH—Loading starts when a publishing refresh occurs.

          • -
          -

          The three values can be combined. In the following example, AutoLoad triggers are enabled both at user login and when publishing refresh occurs:

          -

          AUTOLOADONLOGIN AUTOLOADONREFRESH

          -
          -Note

          If the client is configured with these values at first install, Autoload will not be triggered until the next time the user logs off and logs back on.

          -
          -
          - -

          AUTOLOADTARGET

          NONE

          -

          ALL

          -

          PREVUSED

          Indicates what will be auto-loaded when any given AutoLoad triggers occur.

          -

          Possible values:

          -
            -
          • NONE—No auto-loading, regardless of what triggers might be set.

          • -
          • ALL—If any AutoLoad trigger is enabled, all packages are automatically loaded, whether or not they have ever been launched.

            -
            -Note

            This setting is configured for individual packages by using the SFTMIME ADD PACKAGE and CONFIGURE PACKAGE commands. For more information about these commands, see SFTMIME Command Reference.

            -
            -
            - -
          • -
          • PREVUSED—If any AutoLoad trigger is enabled, load only the packages where at least one application in the package has been previously used (that is, launched or precached).

          • -
          -
          -Note

          When you install the App-V client to use a read-only cache, (for example, as a VDI server implementation), you must set the AUTOLOADTARGET parameter to NONE to prevent the client from trying to update applications in the read-only cache.

          -
          -
          - -

          DOTIMEOUTMINUTES

          29600 (default)

          -

          1–1439998560 minutes (range)

          Indicates how many minutes an application may be used in disconnected operation.

          INSTALLDIR

          <pathname>

          Specifies the installation directory of the App-V Client.

          -

          Example: INSTALLDIR="C:\Program Files\Microsoft Application Virtualization Client"

          OPTIN

          “TRUE”

          -

          “”

          Microsoft Application Virtualization Client components will be upgradable through Microsoft Update when updates are made available to the general public. The Microsoft Update Agent installed on Windows operating systems requires a user to explicitly opt-in to use the service. This opt-in is required only one time for all applications on the device. If you have already opted into Microsoft Update, the Microsoft Application Virtualization components on the device will automatically take advantage of the service.

          -

          For command-line installation, use of Microsoft Update is by default opt-out (unless a previous application already enabled the device to be opted in) due to the requirement for manually opting into Microsoft Update. Therefore, opting in must be explicit for command-line installations. Setting the command-line parameter OPTIN to TRUE forces the Microsoft Update opt-in to be set.

          REQUIREAUTHORIZATIONIFCACHED

          TRUE

          -

          FALSE

          Indicates whether authorization is always required, whether or not an application is already in cache.

          -

          Possible values:

          -
            -
          • TRUE—Application always must be authorized at startup. For RTSP streamed applications, the user authorization token is sent to the server for authorization. For file-based applications, file ACLs dictate whether a user may access the application.

          • -
          • FALSE—Always try to connect to the server. If a connection to the server cannot be established, the client still allows the user to launch an application that has previously been loaded into cache.

          • -

          SWICACHESIZE

          Cache size in MB

          Specifies the size in megabytes of the client cache. The default size is 4096 MB, and the maximum size is 1,048,576 MB (1 TB). The system checks for the available space at installation time, but the space is not reserved.

          -

          Example: SWICACHESIZE="1024"

          SWIPUBSVRDISPLAY

          Display name

          Specifies the displayed name of the publishing server; required when SWIPUBSVRHOST is used.

          -

          Example: SWIPUBSVRDISPLAY="PRODUCTION ENVIRONMENT"

          SWIPUBSVRTYPE

          [HTTP|RTSP]

          Specifies the publishing server type. The default server type is Application Virtualization Server. The /secure switch is not case sensitive.

          -
            -
          • HTTP—Standard HTTP Server

          • -
          • HTTP /secure—Enhanced Security HTTP Server

          • -
          • RTSP—Application Virtualization Server

          • -
          • RTSP /secure—Enhanced Security Application Virtualization Server

          • -
          -

          Example: SWIPUBSVRTYPE="HTTP /secure"

          SWIPUBSVRHOST

          IP address|host name

          Specifies either the IP address of the Application Virtualization Server or a host name of the server that resolves into the server's IP address; required when SWIPUBSVRDISPLAY is used.

          -

          Example: SWIPUBSVRHOST="SERVER01"

          SWIPUBSVRPORT

          Port number

          Specifies the logical port that is used by this Application Virtualization Server to listen for requests from the client (default = 554).

          -
            -
          • Standard HTTP server—Default = 80.

          • -
          • Enhanced Security HTTP Server—Default = 443.

          • -
          • Application Virtualization Server—Default = 554.

          • -
          • Enhanced Security Application Virtualization Server—Default = 322.

          • -
          -

          Example: SWIPUBSVRPORT="443"

          SWIPUBSVRPATH

          Path name

          Specifies the location on the publishing server of the file that defines file type associations (default = /); required when the SWIPUBSVRTYPE parameter value is HTTP.

          -

          Example: SWIPUBSVRPATH="/AppVirt/appsntypes.xml"

          SWIPUBSVRREFRESH

          [ON|OFF]

          Specifies whether the client automatically queries the publishing server for file type associations and applications when a user logs in to the client (default = ON).

          -

          Example: SWIPUBSVRREFRESH="off"

          SWIGLOBALDATA

          Global data directory

          Specifies the directory where data will be stored that is not specific to particular users (default = C:\Documents and Settings\All Users\Documents).

          -

          Example: SWIGLOBALDATA="D:\Microsoft Application Virtualization Client\Global"

          SWIUSERDATA

          User data directory

          Specifies the directory where data will be stored that is specific to particular users (default = %APPDATA%).

          -

          Example: SWIUSERDATA="H:\Windows\Microsoft Application Virtualization Client"

          SWIFSDRIVE

          Preferred drive letter

          Corresponds to the drive letter that you selected for the virtual drive.

          -

          Example: SWIFSDRIVE="S"

          SYSTEMEVENTLOGLEVEL

          0–4

          Indicates the logging level at which log messages are written to the NT event Log. The value indicates a threshold of what is logged—that is, everything equal to or less than that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged.

          -

          Possible values:

          -
            -
          • 0 == None

          • -
          • 1 == Critical

          • -
          • 2 == Error

          • -
          • 3 == Warning

          • -
          • 4 == Information

          • -

          MINFREESPACEMB

          In MB

          Specifies the amount of free space (in megabytes) that must be available on the host before the cache size can increase. The following example would configure the client to ensure at least 5 GB of free space on the disk before allowing the size of the cache to increase. The default is 5000 MB of free space available on disk at installation time.

          -

          Example: MINFREESPACEMB ="5000" (5 GB)

          KEEPCURRENTSETTINGS

          [0|1]

          Used when you have applied registry settings prior to deploying a client—for example, by using Group Policy. When a client is deployed, set this parameter to a value of 1 so that it will not overwrite the registry settings.

          -
          -Important

          If set to a value of 1, the following client installer command-line parameters are ignored:

          -

          SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, and SWIUSERDATA.

          -

          For further information about setting these values after installation, see “How to Configure the App-V Client Registry Settings by Using the Command Line” in the Application Virtualization (App-V) Operations Guide (https://go.microsoft.com/fwlink/?LinkId=122939).

          -
          -
          - -
          - - - -## Related topics - - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console-overview.md b/mdop/appv-v4/application-virtualization-client-management-console-overview.md deleted file mode 100644 index 1f514c7ba3..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console-overview.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Client Management Console Overview -description: Application Virtualization Client Management Console Overview -author: dansimp -ms.assetid: 21d648cc-eca5-475c-be42-228879b7a45a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console Overview - - -The Microsoft Application Virtualization Client Management Console is a snap-in to the Microsoft Management Console. Administrators and users can use the Application Virtualization Management Console to configure the Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) and manage applications. - -## In This Section - - -[About Application Virtualization Servers](about-application-virtualization-servers.md) -Provides a brief description of the Application Virtualization Management Servers. - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -Provides the list of user access permissions. - -[Disconnected Operation Mode](disconnected-operation-mode.md) -Describes the disconnected operation mode and circumstances that affect it. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console-reference.md b/mdop/appv-v4/application-virtualization-client-management-console-reference.md deleted file mode 100644 index e13ceabe61..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console-reference.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Client Management Console Reference -description: Application Virtualization Client Management Console Reference -author: dansimp -ms.assetid: aa27537d-e053-45b5-b0ee-cf6606849e0c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console Reference - - -The topics in this section provide detailed information about each of the functional areas of the Application Virtualization Client Management Console. - -## In This Section - - -[Client Management Console: Application Virtualization Node](client-management-console-application-virtualization-node.md) -Describes the screens in the **Application Virtualization** node. - -[Client Management Console: About Dialog Boxes](client-management-console-about-dialog-boxes.md) -Describes the screens in the **About Dialog** node. - -[Client Management Console: Applications Node](client-management-console-applications-node.md) -Describes the screens in the **Applications** node. - -[Client Management Console: File Type Associations Node](client-management-console-file-type-associations-node.md) -Describes the screens in the **File Type Association** node. - -[Client Management Console: Publishing Servers Node](client-management-console-publishing-servers-node.md) -Describes the screens in the **Publishing Servers** node. - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) -Describes the screens for **Application Virtualization Properties**. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md b/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md deleted file mode 100644 index a65de90286..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Application Virtualization Client Management Console Roadmap -description: Application Virtualization Client Management Console Roadmap -author: dansimp -ms.assetid: 3aca02c4-728c-4c34-b90f-4e6f188937b0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console Roadmap - - -The Application Virtualization Client Management Console is a snap-in to the Microsoft Management Console. Administrators and users can use the Application Virtualization Client Management Console to configure the Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) and manage desktops and applications. The following lists represent some of the available procedures in the Client Management Console. - -The following topics detail some general administrative tasks you can perform: - -- [How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) - -- [How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) - -The following topics detail what you can do when configuring the Application Virtualization client: - -- [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) - -- [How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) - -- [How to Change User Access Permissions](how-to-change-user-access-permissions.md) - -- [How to Change Import Search Paths](how-to-change-import-search-paths.md) - -- [How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) - -- [How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) - -The following topics detail what you can do when managing applications: - -- [How to Delete an Application](how-to-delete-an-application.md) - -- [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) - -- [How to Clear an Application](how-to-clear-an-application.md) - -- [How to Import an Application](how-to-import-an-application.md) - -- [How to Change an Application Icon](how-to-change-an-application-icon.md) - -- [How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) - -## Related topics - - -[About Virtual Environments](about-virtual-environments.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console.md b/mdop/appv-v4/application-virtualization-client-management-console.md deleted file mode 100644 index e8e5980d13..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Application Virtualization Client Management Console -description: Application Virtualization Client Management Console -author: dansimp -ms.assetid: 18635688-8cbe-40d1-894e-acb2749b4e69 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console - - -The Microsoft Application Virtualization Client Management Console is a snap-in to the Microsoft Management Console. Administrators and users can use the Application Virtualization Management Console to configure the Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) and manage applications. - -## In This Section - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) -Provides general information about the tasks you can perform by using the Virtualization Client Management Console. - -[How to Perform General Administrative Tasks in the Client Management Console](how-to-perform-general-administrative-tasks-in-the-client-management-console.md) -Provides procedures that you can use to set up the Publishing Server and to refresh applications. - -[How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) -Provides procedures that you can use to manage applications. - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -Provides procedures that you can use to configure Desktop Client and Client for Remote Desktop Services. - -[How to Manually Manage Applications in the Client Management Console](how-to-manually-manage-applications-in-the-client-management-console.md) -Provides procedures that you can use to manually manage applications. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-reference.md b/mdop/appv-v4/application-virtualization-client-reference.md deleted file mode 100644 index bc3dbef0d8..0000000000 --- a/mdop/appv-v4/application-virtualization-client-reference.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Application Virtualization Client Reference -description: Application Virtualization Client Reference -author: dansimp -ms.assetid: 5107f567-9ac8-43e1-89c8-5e0762e3ddd8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Reference - - -This section provides reference information that is related to installing and managing the Application Virtualization (App-V) Client and the virtual application packages that are created by the Application Virtualization (App-V) Sequencer. - -## In This Section - - -[SFTMIME Command Reference](sftmime--command-reference.md) -Provides a detailed list of all SFTMIME parameters. - -[SFTTRAY Command Reference](sfttray-command-reference.md) -Lists and describes all SFTTRAY commands and command-line switches. - -[Application Virtualization Client WMI Provider](application-virtualization-client-wmi-provider.md) -Describes the Windows Management Instrumentation (WMI) classes that are available in the App-V Client WMI Provider. - -[Log File for the Application Virtualization Client](log-file-for-the-application-virtualization-client.md) -Provides information about the log file for the App-V Client. - -[App-V Client Registry Values](app-v-client-registry-values-sp1.md) -Provides a detailed list and descriptions of registry key values. - -[App-V Interoperability with Windows AppLocker](app-v-interoperability-with-windows-applocker.md) -Provides information on how to configure AppLocker rules for virtual applications. - -[Support for Client Reporting over HTTP](support-for-client-reporting-over-http.md) -Provides an overview of the Client Reporting process for HTTP publishing. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-wmi-provider.md b/mdop/appv-v4/application-virtualization-client-wmi-provider.md deleted file mode 100644 index dd3b3f8eae..0000000000 --- a/mdop/appv-v4/application-virtualization-client-wmi-provider.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Client WMI Provider -description: Application Virtualization Client WMI Provider -author: dansimp -ms.assetid: 384e33e0-6689-4e28-af84-53acee8a5c24 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client WMI Provider - - -This section contains detailed information about the Application Virtualization (App-V) Client Windows Management Instrumentation (WMI) Provider. All the classes that are described are in the WMI root\\microsoft\\appvirt\\client namespace. - -You can use a query tool such as wbemtest.exe or a scripting language such as Windows PowerShell or VBScript to retrieve key information about packages and applications from the clients for reporting purposes. The information available includes details on package status, cache size, and usage data. - -## In This Section - - -[App-V Application WMI Class](app-v-application-wmi-class.md) -Represents an individual application object in a package. - -[App-V Package WMI Class](app-v-package-wmi-class.md) -Represents an individual virtual package that can contain multiple applications. - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client.md b/mdop/appv-v4/application-virtualization-client.md deleted file mode 100644 index 819dd8bed1..0000000000 --- a/mdop/appv-v4/application-virtualization-client.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Application Virtualization Client -description: Application Virtualization Client -author: dansimp -ms.assetid: d9e1939b-eb9c-49a0-855d-f4c323b84c2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client - - -You can use the procedures in this section to configure and manage the Microsoft Application Virtualization (App-V) Client. Procedures are provided for manual interaction with the App-V Client by using the App-V Client Management Console and also by using the command line. - -## In This Section - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -Includes information about using the features and commands that are available from the Windows desktop notification area. - -[How to Manage Virtual Applications Manually](how-to-manage-virtual-applications-manually.md) -Provides information about how to manage the virtual applications by using the App-V Client Management Console. - -[How to Configure the Application Virtualization Client Settings Manually](how-to-configure-the-application-virtualization-client-settings-manually.md) -Provides a set of procedures that you can use to configure App-V Client settings by using the App-V Client Management Console. - -[How to Manage Virtual Applications by Using the Command Line](how-to-manage-virtual-applications-by-using-the-command-line.md) -Provides important procedures you can use to manage virtual applications and packages by using the SFTMIME command-line language. - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) -Provides a set of procedures you can use to change the configuration of the App-V Client. - -[Troubleshooting Information for the Application Virtualization Client](troubleshooting-information-for-the-application-virtualization-client.md) -Provides information about troubleshooting the App-V Client. - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) -Contains detailed technical reference material related to installing and managing system components. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md deleted file mode 100644 index 4bd4d4fe49..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Virtualization Deployment and Upgrade Checklists -description: Application Virtualization Deployment and Upgrade Checklists -author: dansimp -ms.assetid: 462e5119-cb83-4548-98f2-df668aa0958b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment and Upgrade Checklists - - -The topics in this section provide checklists that you can use when installing the Microsoft Application Virtualization (App-V) system. - -## In This Section - - -[App-V Pre-Installation Checklist](app-v-pre-installation-checklist.md) -Describes the tasks that must be completed before starting the installation of the App-V system. - -[App-V Installation Checklist](app-v-installation-checklist.md) -Describes the tasks that must be completed while installing the App-V system. - -[App-V Postinstallation Checklist](app-v-postinstallation-checklist.md) -Describes the tasks that must be completed after the installation of the App-V system. - -[App-V Upgrade Checklist](app-v-upgrade-checklist.md) -Describes the tasks to be completed when upgrading the App-V system and the correct sequence for those tasks. - -## Related topics - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md deleted file mode 100644 index d71379b47f..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Application Virtualization Deployment and Upgrade Considerations -description: Application Virtualization Deployment and Upgrade Considerations -author: dansimp -ms.assetid: c3c38930-0da3-43e6-b240-945edfd00a01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment and Upgrade Considerations - - -Before you begin the deployment of Microsoft Application Virtualization (App-V), you might have to review your environment requirements that includes the hardware and software requirements for installing the various Application Virtualization components. Also, if you are upgrading from an earlier version, the topics in this section provide information about how to upgrade your current Sequencer, Server, and Client versions. - -## In This Section - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -Provides general information about system requirements and upgrade considerations for your Application Virtualization deployment. - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) -Provides detailed lists of installation and upgrade tasks with links to the specific procedures. - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -Describes how to install the Application Virtualization (App-V) platform components required for your server-based deployment. - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -Describes how to install the Application Virtualization Client software. - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -Describes how to install the Application Virtualization Sequencer. - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -Describes how to upgrade the Application Virtualization Desktop Client or the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -Describes how to upgrade the software components installed on all Application Virtualization Management System computers. - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -Describes how to upgrade the Sequencer on computers that are running Windows Vista or Windows XP. - -## Related topics - - -[Application Virtualization Reference](application-virtualization-reference.md) - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md deleted file mode 100644 index c09ced741d..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Application Virtualization Deployment and Upgrade Considerations -description: Application Virtualization Deployment and Upgrade Considerations -author: dansimp -ms.assetid: adc562ee-7276-4b14-b10a-da17f05e1682 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment and Upgrade Considerations - - -Before you begin the deployment of Microsoft Application Virtualization, you might need to review your environment requirements, including the hardware and software requirements for installing the various Application Virtualization components. Also, if you are upgrading from a previous version, the topics in this section provide information about upgrading your current Sequencer, server, and client versions. - -## In This Section - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -Provides general information about system requirements and upgrade considerations for your Application Virtualization deployment. - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -Provides step-by-step procedures for upgrading the Application Virtualization Desktop Client or the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -Provides a step-by-step procedure you can use to upgrade the software components installed on all Application Virtualization System computers. - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -Provides step-by-step procedures for upgrading the Sequencer on computers running Windows Vista or Windows XP. - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -Provides a step-by-step procedure for installing the Sequencer. - -## Related topics - - -[Application Virtualization Reference](application-virtualization-reference.md) - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-requirements.md b/mdop/appv-v4/application-virtualization-deployment-requirements.md deleted file mode 100644 index 9baee67d59..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-requirements.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Deployment Requirements -description: Application Virtualization Deployment Requirements -author: dansimp -ms.assetid: 9564e974-a853-45ae-b605-0a2e3e5cf212 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment Requirements - - -Before you deploy Microsoft Application Virtualization (App-V) in your environment, you should verify that you can meet the hardware and software requirements for the components you plan to deploy, according to your chosen deployment scenario. - -## In This Section - - -[Application Virtualization System Requirements](application-virtualization-system-requirements.md) -Describes the recommended hardware and software requirements for each of the Application Virtualization System components. - -[Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -Describes the minimum recommended hardware and software configuration for your Microsoft Application Virtualization Sequencer workstation. - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) -Describes the recommended minimum hardware and software configuration for your installation of the Application Virtualization Desktop Client and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -[Configuring Prerequisite Groups in Active Directory for App-V](configuring-prerequisite-groups-in-active-directory-for-app-v.md) -Describes the objects that you must install in Active Directory groups before you install the App-V system. - -[How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md) -Describes how to configure the server running Windows Server 2008 by installing Internet Information Services (IIS) as a role so that you can install the App-V Management Web Service. - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) -Provides checklists of tasks to guide you through the correct sequence when installing or upgrading the App-V system. - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-glossary.md b/mdop/appv-v4/application-virtualization-glossary.md deleted file mode 100644 index 3669509527..0000000000 --- a/mdop/appv-v4/application-virtualization-glossary.md +++ /dev/null @@ -1,208 +0,0 @@ ---- -title: Application Virtualization Glossary -description: Application Virtualization Glossary -author: dansimp -ms.assetid: 9eb71774-e288-4f94-8f94-5b98e0d012a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Glossary - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TermDefinition

          active upgrade

          An upgrade that enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application.

          Application Source Root

          Reference to a registry key that allows an override of the OSD CODEBASE for the HREF element (for example, the source location). This registry value enables an administrator or ESD system to ensure application loading is performed according to a planned topology management scheme.

          Application Virtualization drive

          The default virtual application client drive (Q:) from which sequenced applications are run.

          Application Virtualization reporting

          Virtual application information gathered for data analysis. Data is collected for assembly of custom views and interpretation.

          AutoLoad configuration parameter

          A client runtime policy configuration parameter that enables the secondary feature block of a virtualized application to be streamed to the client automatically in the background.

          branch a package

          To upgrade an existing sequenced application package and run it side-by-side with the original sequenced application package.

          Dynamic Suite Composition

          An Application Virtualization feature that enables a virtual application package to allow dependent plug-ins or middleware packages to use the virtual environment. This feature enables plug-ins and middleware packages to use the primary package's registry settings, and the packages behave and interact with one another in the same way as if they were installed locally on a comuter.

          ICO file

          The file for the icon on the client's desktop used to launch a sequenced application.

          Icon Source Root

          Reference to a registry key that allows specification of a source location for icon retrieval for a sequenced application package during publication. Icon Source Roots support UNC formats only (not URLs).

          Installation directory

          The directory where the installer for the application virtualization sequencer places its files.

          Microsoft Application Virtualization Desktop Client

          An application that resides on a Windows-based computer desktop and which communicates and authenticates with the Microsoft System Center Virtual Application Server to receive the application code and allow a sequenced application to be run locally.

          Microsoft Application Virtualization for Terminal Services

          The Application Virtualization feature, including both client and server components, running in a Terminal Services environment.

          Microsoft Application Virtualization Management Console

          Centralized snap-in to the Microsoft Management Console, which you use to administer the Application Virtualization Management System.

          Microsoft Application Virtualization Management System

          A specific deployment of the Application Virtualization platform that includes all of the components that are managed by a single data store.

          Microsoft Application Virtualization Management Web Service

          A service that acts as an intermediary between the Application Virtualization Management Console and the data store. First it authenticates its users, and then it allows authorized administrators to manipulate data in the data store.

          Microsoft Application Virtualization platform

          Name for the Microsoft products that are used to create, store, distribute, and run virtualized applications.

          Microsoft Application Virtualization Sequencer

          Application that monitors and records the installation and setup process for applications so that an application can be sequenced and run in the virtual environment.

          Microsoft Application Virtualization Terminal Services Client

          An application that resides on a Terminal Server and which communicates and authenticates with the Microsoft Virtual Application Server to receive the application code and allow a sequenced application to be run locally.

          Microsoft System Center Application Virtualization Management Server

          One of two Application Virtualization server types from which a sequenced application package can be streamed. In addition to streaming virtual application packages, the Application Virtualization Management Server offers other services such as publishing, management, reporting, and so on.

          Microsoft System Center Application Virtualization Streaming Server

          One of two Application Virtualization server types from which a sequenced application package can be streamed. The Streaming Server streams applications to the client computers only and does not offer other services such as publishing, management, reporting, and so on.

          Open Software Descriptor (OSD) file

          An XML-based file that instructs the client on how to retrieve the sequenced application from the Application Virtualization Management/Streaming Server and how to run the sequenced application in its virtual environment.

          OSD Source Root

          Reference to a registry key that allows specification of a source location for OSD file retrieval for an application package during publication. OSD Source Roots support UNC formats only (not URLs).

          package root directory

          The directory on the sequencing computer on which files for the sequenced application package are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed.

          primary feature block

          The minimum content in an application package that is necessary for an application to run. The content in the primary feature block is identified during the application phase of sequencing and typically consists of the content for the most used application features.

          secondary feature block

          The remainder of the application package that is not contained in the primary feature block. This content is streamed to the client on demand as application features are used.

          sequenced application

          An application that has been monitored by the Sequencer, broken up into primary and secondary feature blocks, streamed to a computer running the Microsoft Application Virtualization Terminal Services Client or the Microsoft Application Virtualization Desktop Client, and can run inside of its own virtual environment.

          sequenced application package

          The files that comprise a virtual application and allow a virtual application to run. These files are created after sequencing and specifically include .osd, .sft, .sprj, and .ico files.

          sequencing

          The process of creating an application package by using the Application Virtualization Sequencer. In this process, an application is monitored, its shortcuts are configured, and a sequenced application package is created containing the .osd, .sft, .sprj, and .ico files.

          sequencing computer

          The computer used to perform sequencing and create a sequenced application package.

          Sequencing Wizard

          Step-by-step wizard that walks the user through sequencing an application, including package configuration, installing the application or applications to be sequenced, and sequencing the application package for streaming.

          SFT

          A file that contains one or more sequenced applications that the Sequencer has packaged into streaming blocks, as well as the associated delivery information. The SFT file is stored on each server that must stream the packaged applications to a client.

          SFTMIME

          A command-line interface for setting up and managing applications, file type associations, and desktop configuration servers managed by Application Virtualization Desktop and Terminal Services Clients.

          SPRJ file

          An XML-based Sequencer Project file, in which the Sequencer stores its Exclusion Items and Parse Items information. The SPRJ file is used heavily in the creation of application records as well as during an upgrade to a package.

          virtual application

          An application packaged by the Sequencer to run in a self-contained, virtual environment. The virtual environment contains the information necessary to run the application on the client without installing the application locally.

          Virtual COM

          The subsystem that manages COM objects created by application processes running in a virtual environment and prevents conflict with the same objects created outside the virtual environment.

          virtual directory

          An opaque directory where only files and subdirectories defined in the application package or created through interaction with an application in a virtual environment are visible. Any files in an identically named local directory are not visible to the application.

          virtual environment

          A runtime container that defines the resources available to application processes launched from a sequenced application package.

          virtual file

          A file name within the virtual environment that is mapped to an alternate target location. A virtual file appears alongside other files in the containing directory, regardless of whether that directory is virtual or local.

          virtual file system

          The subsystem that intercepts and redirects file system requests from application processes running in a virtual environment. These requests are processed based on the virtual files and directories defined in the application package and created or modified through interaction with a virtual application.

          virtual registry

          The subsystem that intercepts and redirects registry requests for keys and values from application processes running in a virtual environment. The redirection is based on the registry information defined in the application package and created or modified through interaction with a virtual application.

          virtual services

          The subsystem that acts as the Service Control Manager (SCM) for services running in a virtual environment.

          - -  - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md b/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md deleted file mode 100644 index 9b480ae5f3..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Properties Connectivity Tab -description: Application Virtualization Properties Connectivity Tab -author: dansimp -ms.assetid: e07c1352-a2be-4d99-9968-daba515bcde2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Connectivity Tab - - -Use the **Connectivity** tab of the **Application Virtualization Properties** dialog box to specify the connectivity settings. - -This tab contains the following elements. - -**Allow disconnected operation** -Use this check box to enable or disable disconnected operation. - -**Limit disconnected operation to \_\_\_\_ days** -Use this check box and field to set an expiration time-out for disconnected operation. The expiration length in days can be any number from 1–999999. - -**Work offline** -Use this check box to enable and disable offline operation. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md b/mdop/appv-v4/application-virtualization-properties-file-system-tab.md deleted file mode 100644 index fe4acb134a..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Application Virtualization Properties File System Tab -description: Application Virtualization Properties File System Tab -author: dansimp -ms.assetid: c7d56d36-8c50-4dfc-afee-83dea06376d4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: File System Tab - - -Use the **File System** tab of the **Application Virtualization Properties** dialog box to view and monitor file system settings. - -This tab contains the following elements. - -**Client Cache Configuration Settings** -This section enables you to configure the client cache settings. Click one of the following radio buttons to choose how to manage the cache space: - -- **Use maximum cache size** - - Enter a numeric value from 100 to 1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size in MB of the cache. The value shown in **Reserved Cache Size** indicates the amount of cache in use. - -- **Use free disk space threshold** - - Enter a numeric value to specify the amount of free disk space, in MB, that the cache must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is unused. - -**Drive Letter** -This field displays the current drive being used. To change the drive, select any drive letter from the drop-down list of available drives. This setting becomes effective when the computer is rebooted. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-general-tab.md b/mdop/appv-v4/application-virtualization-properties-general-tab.md deleted file mode 100644 index 375209e344..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-general-tab.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Application Virtualization Properties General Tab -description: Application Virtualization Properties General Tab -author: dansimp -ms.assetid: be7449d9-171a-4a11-9382-83b7008ccbdd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: General Tab - - -Use the **General** tab of the **Application Virtualization Properties** dialog box to modify log settings and data locations. - -This tab contains the following elements. - -**Log Level** -Select the level from the drop-down list. The default level is **Information**. - -**Reset Log** -Click this button to back up the current log file and immediately start a new log file. - -**Location** -Enter or browse to the location where you want to save the log file sftlog.txt. The default locations are as follows: - -- For Windows XP, Windows Server 2003—*C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Application Virtualization Client* - -- For Windows Vista, Windows 7, Windows Server 2008—*C:\\ProgramData\\Microsoft\\Application Virtualization Client* - -**System Log Level** -Select the level from the drop-down list. The default level is **Warning**. - -**Note**   -The **System Log Level** setting controls the level of messages sent to the system event log. The logged messages are identical to the messages that get logged to the client event log, but they are stored in a different location that does not have the space limitations of the client event log. Because the system event log does not have space limitations, it is ideally suited for situations where verbose logging is necessary. - - - -**Global Data Directory** -Enter or browse to the location of the directory of the log file. The default locations are as follows: - -- For Windows XP, Windows Server 2003—*C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Application Virtualization Client* - -- For Windows Vista, Windows 7, Windows Server 2008—*C:\\ProgramData\\Microsoft\\Application Virtualization Client* - -**User Data Directory** -Enter or browse to the location of the directory where user-specific data is stored. The default is %APPDATA%. This path must be a valid environment variable on the client computer. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md b/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md deleted file mode 100644 index ada91ffa6f..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Properties Import Search Path Tab -description: Application Virtualization Properties Import Search Path Tab -author: dansimp -ms.assetid: 7f94d472-1d0a-49d8-b307-330936071e13 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Import Search Path Tab - - -Use the **Import Search Path** tab of the **Application Virtualization Properties** dialog to view and manage the search paths for importing SFT files. - -This tab contains the following elements. - -**Path Window** -This window displays the SFT paths. - -**Add** and **Remove** -Use these buttons to add or remove SFT search paths. - -**Move up** and **Move Down** -Use these buttons to organize the SFT search paths. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-interface-tab.md b/mdop/appv-v4/application-virtualization-properties-interface-tab.md deleted file mode 100644 index fedbe93af5..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-interface-tab.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Properties Interface Tab -description: Application Virtualization Properties Interface Tab -author: dansimp -ms.assetid: bb9cb54e-315a-48bf-a396-b33e2cbd030a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Interface Tab - - -Use the **Interface** tab of the **Application Virtualization Properties** dialog box to control default settings for user-interface components. - -This tab contains the following elements. - -**Run Settings** radio buttons -Select **Always**, **Only**, or **Do not show** to determine when the Application Virtualization Client is visible in the Windows desktop notification area. - -**Error message display time** -Enter a duration (in seconds) to determine how long error messages are visible in the desktop notification area. The minimum allowable value is 10. - -**Information message display time** -Enter a duration (in seconds) to determine how long information messages are visible in the desktop notification area. If you set this value to zero, all messages except error messages are suppressed. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md b/mdop/appv-v4/application-virtualization-properties-permissions-tab.md deleted file mode 100644 index b830275c12..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Application Virtualization Properties Permissions Tab -description: Application Virtualization Properties Permissions Tab -author: dansimp -ms.assetid: 5219bc7c-7c7a-4e2f-8fba-7039933d1124 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Permissions Tab - - -Use the **Permissions** tab of the **Application Virtualization Properties** dialog box to specify which activities are available for non-administrators on the local computer. Select the check boxes that correspond to the items you want to make available to all users. Users who do not have administrative rights can view this page and see which items are selected, but they cannot modify the list. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-reference.md b/mdop/appv-v4/application-virtualization-reference.md deleted file mode 100644 index 11b374d4e3..0000000000 --- a/mdop/appv-v4/application-virtualization-reference.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Application Virtualization Reference -description: Application Virtualization Reference -author: dansimp -ms.assetid: 5f994be7-41fa-416b-8a4c-6ed52fcd9b72 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Reference - - -This section provides reference information related to installing and managing the Microsoft Application Virtualization Client and the virtual application packages created by the Application Virtualization Sequencer. - -## In This Section - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) -Provides details of all the command-line parameters that are available for use when installing the client. - -[SFTMIME Command Reference](sftmime--command-reference.md) -Provides a detailed list of all SFTMIME parameters. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-report-types.md b/mdop/appv-v4/application-virtualization-report-types.md deleted file mode 100644 index 3e81bdd8f6..0000000000 --- a/mdop/appv-v4/application-virtualization-report-types.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Virtualization Report Types -description: Application Virtualization Report Types -author: dansimp -ms.assetid: 232ef25e-11a0-49fb-b4b3-54ac83577383 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Report Types - - -From the Application Virtualization Server Management Console, you can generate a variety of reports that provide information about the system. This information includes usage information for applications and system error tracking. - -## In This Section - - -[System Utilization Report](system-utilization-reportserver.md) -Graphs the total daily usage, to help you determine the load on your Application Virtualization System. - -[Software Audit Report](software-audit-reportserver.md) -Lists the usage information during the reporting period for all applications defined in the database, to help you determine which applications are the most heavily used. - -[Application Utilization Report](application-utilization-reportserver.md) -Tracks usage information for a specified application, to help you determine how heavily a specific application is used. - -[System Error Report](system-error-reportserver.md) -Tracks the number of errors and warnings logged over time during the specified reporting period for the specified server or for the specified server group. - -## Related topics - - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-command-line.md b/mdop/appv-v4/application-virtualization-sequencer-command-line.md deleted file mode 100644 index abbc660844..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-command-line.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Application Virtualization Sequencer Command Line -description: Application Virtualization Sequencer Command Line -author: dansimp -ms.assetid: a6d5ec9f-cc66-4869-9250-5c65d7e1e58e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Command Line - - -You can use the Microsoft Application Virtualization (App-V) Sequencer to create virtual application packages using the command line. This method of sequencing is faster than sequencing using the **Sequencing** Wizard and is ideal if you are sequencing a large number of applications. - -## In This Section - - -[Command-Line Parameters](command-line-parameters.md) -Provides information about the Sequencer command line parameters. - -[Command-Line Errors](command-line-errors.md) -Provides information about common command line errors. - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md b/mdop/appv-v4/application-virtualization-sequencer-console-overview.md deleted file mode 100644 index 1669e0fe12..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Application Virtualization Sequencer Console Overview -description: Application Virtualization Sequencer Console Overview -author: dansimp -ms.assetid: 681bb40d-2937-4645-82aa-4a44775232d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Console Overview - - -The Application Virtualization (App-V) Sequencer creates applications so that they can be run in a virtual environment, as virtual applications. After an application has been sequenced, it can run from an App-V Server to target computers that are running the App-V Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services) by using a process called streaming. The App-V Sequencer monitors the installation and setup process for applications, and it records all the information necessary for the application to run in the virtual environment. This process also determines which files and configurations are applicable to all users and which configurations users can customize. Virtual applications run on target computers and have no effect on the operating system running on the target computer or on any applications that are installed on the target computer. - -## Application Virtualization Sequencer Security Considerations - - -The App-V Sequencer runs all services detected at sequencing time using the Local System account and does not enforce security descriptors on service control requests. If the service was installed using a different user account or if the security descriptors are intended to grant different user groups specific service permissions, consider carefully whether the service should be virtualized. In some cases, you should install the service locally to ensure that the intended service security is preserved. - -## Application Virtualization Sequencer Console Menu Options - - -The following menu items are available in the App-V Sequencer Console: - -- **File**—Contains various commands to help create, open, modify, and save sequenced applications. - -- **Edit**—Contains various commands for editing existing virtual applications. - -- **View**—Contains various commands for viewing properties of a virtual application. - -- **Tools**—Contains various tools and diagnostics for configuring virtual applications. - -## Application Virtualization Sequencer Console Toolbar Options - - -The following toolbar buttons are available in the App-V Sequencer Console: - -- **New Package**—Click to create a new sequenced application. - -- **Open**—Click to open a sequenced application package in the App-V Sequencer Console. - -- **Open for Upgrade**—Click to open a sequenced application to upgrade or apply an update. - -- **Save**—Click to save a sequenced virtual application. - -- **Sequencing Wizard**—Click to open the Sequencing Wizard. You should use this button to start the Sequencing Wizard if you make any changes on the **General** tab under **Tools** / **Options**. - -## Virtual Application Tabs - - -The following tabs are displayed when you view a virtual application in the App-V Sequencer Console: - -- **Properties**—Displays information about the selected virtual application. You can update the **Package Name** and **Comments** associated with the virtual application. - -- **Deployment**—Displays information about how the virtual application will be accessed by target computers. You can configure the virtual application delivery method, and you can configure which operating systems must be running on the target computer. You can also configure the associated output options. If you plan to have clients access a virtual application from a file, use the following format when specifying the path: **File://server/share/path/.sft**. Select **Enforce Security Descriptors** to preserve security associated with the package during an upgrade, or the permissions will be reset during the upgrade. - -- **Change History**—Displays information about updates that have been made to the virtual application. - -- **Files**—Displays the files associated with the selected virtual application. You can make minor revisions to the associated file properties by using the appropriate fields. - -- **Virtual Registry**—Displays the virtual registry associated with the selected virtual application. You can add or delete registry keys by right-clicking the appropriate entry. - -- **Virtual File System**—Displays the virtual file systems associated with the selected virtual application. You can add, delete, or edit file system entries on this tab by right-clicking the appropriate entry and selecting the option. - -- **Virtual Services**—Displays the services associated with the selected virtual application. - -- **OSD**—Displays information about the Open Software Descriptor (OSD) associated with the virtual application. You can update the files associated with the OSD file by right-clicking the appropriate entry and selecting the action that you want. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md deleted file mode 100644 index cc7fa3c205..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md +++ /dev/null @@ -1,282 +0,0 @@ ---- -title: Application Virtualization Sequencer Hardware and Software Requirements -description: Application Virtualization Sequencer Hardware and Software Requirements -author: dansimp -ms.assetid: c88a1b5b-23e1-4460-afa9-a5f37e32eb05 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Hardware and Software Requirements - - -This topic describes the minimum recommended hardware and software requirements for the computer running the Microsoft Application Virtualization (App-V) Sequencer. - -**Important**   -You must run the App-V sequencer (**SFTSequencer.exe**) using an account that has administrator privileges because of the changes the sequencer makes to the local system. These changes can include writing files to the **C:\\Program Files** directory, making registry changes, starting and stopping services, updating security descriptors for files, and changing permissions. - - - -Before you install the Sequencer and after you sequence each application, you must restore a clean operating system image to the sequencing computer. You can use one of the following methods to restore the computer running the Sequencer: - -- Reformat the hard drive and reinstall the operating system. - -- Restore the hard drive on the computer running the Sequencer image by using another disk-imaging software. - -- Revert a virtual operating system image such as a Microsoft Virtual PC image. Using a virtual machine allows for clean sequencing environments to be easily reused with minimal administration. - -The following list outlines the recommended hardware requirements for running the App-V Sequencer. - -The requirements are listed first for Microsoft Application Virtualization (App-V) 4.6 SP2, followed by the requirements for versions that preceded App-V 4.6 SP2. - -### Hardware Requirements - -- Processor—Intel Pentium III, 1 GHz (32-bit or 64-bit). The sequencing process is a single-threaded process and does not take advantage of dual processors. - -- Memory—1 GB or above, 2 GB recommended. - -- Hard disk—40 gigabyte (GB) hard disk space with a minimum of 15 GB available hard disk space. We recommend that you have at least three times the hard disk space that the application you are sequencing requires. - - **Note**   - Sequencing requires heavy disk usage. A fast disk speed can decrease the sequencing time. - - - -### Software Requirements for App-V 4.6 SP2 - -The following list outlines the supported operating systems for running the App-V 4.6 SP2 Sequencer. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows XP

          Professional

          SP3

          x86

          Windows Vista

          Business, Enterprise, or Ultimate

          SP2

          x86

          Windows 7

          Professional, Enterprise, or Ultimate

          No service pack or SP1

          x86 and x64

          Windows 8

          Pro or Enterprise Edition

          x86 and x64

          - - - -**Note**   -The Application Virtualization (App-V) 4.6 SP2 Sequencer supports 32-bit and 64-bit versions of these operating systems. - - - -You should configure computers running the Sequencer with the same applications that are installed on targeted computers. - -### Software Requirements for Versions that Precede App-V 4.6 SP2 - -The following list outlines the supported operating systems for running the Sequencer for versions that precede App-V 4.6 SP2. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows XP

          Professional

          SP2 or SP3

          x86

          Windows Vista

          Business, Enterprise, or Ultimate

          No service pack, SP1, or SP2

          x86

          Windows 7¹

          Professional, Enterprise, or Ultimate

          x86

          - - - -¹Supported for App-V 4.5 with SP1 or SP2, and App-V 4.6 only - -**Note**   -The Application Virtualization (App-V) 4.6 Sequencer supports 32-bit and 64-bit versions of these operating systems. - - - -You should configure computers running the Sequencer with the same applications that are installed on targeted computers. - -### Software Requirements for Remote Desktop Services for App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2003 R2

          Standard Edition, Enterprise Edition, or Datacenter Edition

          SP2

          x86

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP2

          x86

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter Edition

          No service pack or SP1

          x64

          Windows Server 2012

          Standard, Enterprise, or Datacenter Edition

          x86 or x64

          - - - -**Note**   -Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems. - - - -### Software Requirements for Remote Desktop Services for Versions that Precede App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2003

          Standard Edition, Enterprise Edition, or Datacenter Edition

          SP1 or SP2

          x86

          Windows Server 2003 R2

          Standard Edition, Enterprise Edition, or Datacenter Edition

          No service pack or SP2

          x86

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP1 or SP2

          x86

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter Edition

          No service pack or SP1

          x64

          - - - -**Note**   -Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems. - - - -## Related topics - - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) - -[Application Virtualization System Requirements](application-virtualization-system-requirements.md) - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-online-help.md b/mdop/appv-v4/application-virtualization-sequencer-online-help.md deleted file mode 100644 index 3164dedaf1..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-online-help.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Application Virtualization Sequencer Online Help -description: Application Virtualization Sequencer Online Help -author: dansimp -ms.assetid: 0ddeae59-314f-4c61-b85f-6b137b959fa6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Online Help - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records the installation and setup processes for software applications. Use the Sequencer to create a sequenced application that runs inside a virtual environment. The Sequencer packages the sequenced application and creates a virtual application that can be distributed to target computers and that runs in a self-contained, virtual environment. The virtual environment contains the information necessary to run the virtual application on the target computer without interacting with the operating system installed on the target computer. - -For more information about the App-V Sequencer, see the following topics: - -- [Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - -- [Sequencer Hardware and Software Requirements](sequencer-hardware-and-software-requirements.md) - -- [Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -- [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - -- [Troubleshooting the Application Virtualization Sequencer](troubleshooting-the-application-virtualization-sequencer.md) - -- [Application Virtualization Sequencer Technical Reference](application-virtualization-sequencer-technical-reference-keep.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md deleted file mode 100644 index 894504a132..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Sequencer Options Dialog Box -description: Application Virtualization Sequencer Options Dialog Box -author: dansimp -ms.assetid: f71eda8d-8270-439f-a093-867b3a43ebff -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Options Dialog Box - - -Use the **Options** dialog box to configure and view the Microsoft Application Virtualization (App-V) settings. - -## In This Section - - -- [General Tab](general-tab-keep.md) - -- [Parse Items Tab](parse-items-tab-keep.md) - -- [Exclusion Items Tab](exclusion-items-tab-keep.md) - -- [Exclusion Item Dialog Box](exclusion-item-dialog-box.md) - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-overview.md b/mdop/appv-v4/application-virtualization-sequencer-overview.md deleted file mode 100644 index efe77f6f0e..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-overview.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Sequencer Overview -description: Application Virtualization Sequencer Overview -author: dansimp -ms.assetid: e6422a28-633e-4dff-8abb-7cf6a5468112 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Overview - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records all installation and setup processes for an application and creates the following files: **ICO**, **OSD**, **SFT**, and **SPRJ**. These files contain all the necessary information about an application so the application can run in a virtual environment. - -Click the associated link for more information about the App-V Sequencer: - -## In This Section - - -[About the Application Virtualization Sequencer](about-the-application-virtualization-sequencer.md) -Provides general information about the sequencer. - -[About the Sequencer Console](about-the-sequencer-console.md) -Provides information about the App-V sequencer console. - -[About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) -Provides information about using the command line to sequence applications. - -[Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -Provides important security-related planning information about setting up the Application Virtualization Sequencer to sequence application packages. - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-reference.md b/mdop/appv-v4/application-virtualization-sequencer-reference.md deleted file mode 100644 index 69240cc62a..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-reference.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Sequencer Reference -description: Application Virtualization Sequencer Reference -author: dansimp -ms.assetid: a2aef256-98c0-4f81-83a2-af4b64208088 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Reference - - -This section provides reference information related to managing the Application Virtualization (App-V) Sequencer. - -## In This Section - - -[Log Files for the Application Virtualization Sequencer](log-files-for-the-application-virtualization-sequencer.md) -Provides detailed information about the App-V Sequencer log files. - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) -Provides information about parameters you can use to sequence an application and to upgrade an existing virtual application. - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) -Provides a list of errors that are related to sequencing applications. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md b/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md deleted file mode 100644 index 36c372bd1c..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Sequencer Technical Reference -description: Application Virtualization Sequencer Technical Reference -author: dansimp -ms.assetid: 4aa515ce-64f0-4998-8100-f87dc77aed70 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Technical Reference - - -The Microsoft Application Virtualization (App-V) Sequencer Reference section contains technical information that you might find helpful as you work with the App-V Sequencer. - -## In This Section - - -- [Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -- [Sequencing Wizard](sequencing-wizard.md) - -- [Sequencer Console](sequencer-console.md) - -- [Application Virtualization Sequencer Command Line](application-virtualization-sequencer-command-line.md) - -## Related topics - - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer.md b/mdop/appv-v4/application-virtualization-sequencer.md deleted file mode 100644 index 3f31f87b42..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Application Virtualization Sequencer -description: Application Virtualization Sequencer -author: dansimp -ms.assetid: f078f3c9-7b5c-4ff1-b319-4c076b88bc39 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer - - -Sequencing is the process by which you create an application package using the Microsoft Application Virtualization (App-V) Sequencer. The App-V Sequencer monitors and records all installation and setup processes for an application and creates the following files: ICO, OSD, SFT, and SPRJ. These files contain all the necessary information about an application, and they allow that application to run in a virtual environment. - -## In This Section - - -[Application Virtualization Sequencer Console Overview](application-virtualization-sequencer-console-overview.md) -Provides information about the menu, toolbar, and tabs on the Application Virtualization Sequencer Console. - -[About Sequencing Phases](about-sequencing-phases.md) -Provides information about sequencing an application. - -[How to Configure the App-V Sequencer](how-to-configure-the-app-v-sequencer.md) -Provides a set of procedures you can use to configure the Application Virtualization Sequencer. - -[Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) -Provides a set of procedures you can use to configure the Application Virtualization Sequencer. - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) -Provides step-by-step procedures for sequencing or upgrading virtual application, using either the user interface or the command line. - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) -Provides step-by-step procedures for sequencing or upgrading virtual application. - -[Troubleshooting Application Virtualization Sequencer Issues](troubleshooting-application-virtualization-sequencer-issues.md) -Provides troubleshooting tips for a variety of issues that you might encounter when working with the App-V Sequencer. - -[Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) -Provides detailed technical reference material related to working with the Application Virtualization Sequencer. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md deleted file mode 100644 index e3b9b48948..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard-Add Application Dialog Box -description: Application Virtualization Sequencing Wizard-Add Application Dialog Box -author: dansimp -ms.assetid: 247eac0e-830d-4d72-be48-af7d1525eefd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard-Add Application Dialog Box - - -Use the **Add Application** dialog box to add an application to a sequenced application package for sequencing. This dialog box contains the following elements. - -**Application Path** -Specifies the path of the application. - -**Name** -Specifies the name of the application as listed in the OSD file. - -**Version** -Specifies the version of the application as listed in the OSD file. - -**OSD File Name** -Specifies the name of the OSD file that causes the application shortcut to open the application. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md deleted file mode 100644 index 7d58727b72..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box -description: Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box -author: dansimp -ms.assetid: f7656053-3d92-448e-8759-b6b09cef6025 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box - - -Use the **Add File Type Association** dialog box to add a file type association for the application. To access this dialog box, click **File Type** associations on the **Configure Application** page and click **Add**. This dialog box contains the following elements. - -**Extension** -Use to specify the file name extension for the file type associated with the application. - -**File Type Description** -Use to specify a brief description of the file type. - -**Content Type** -Use to specify a brief description of the MIME type. - -**Perceived Type** -Use to select a file type. - -**Confirm open after download** -Select to confirm that the file is opened after a download. - -**Always show extension** -Select to display the extension with the file name. - -**Add to New menu** -Select to add the file type to the **New** menu. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md deleted file mode 100644 index 1a7aceec55..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Add Files to Virtual File System Page -description: Application Virtualization Sequencing Wizard Add Files to Virtual File System Page -author: dansimp -ms.assetid: 6b01333b-08bd-4b96-a123-a07a7aafddd1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Add Files to Virtual File System Page - - -Use the **Add Files to Virtual File System** page of the Application Virtualization Sequencing Wizard to select files to add to the virtual file system. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Add the following files to the VFS

          Select to add the listed files to the virtual file system.

          Remove

          Click to remove a selected file from the list so that it will not be added to the virtual file system.

          Add

          Click to add a file so that you can add a file to the virtual file system.

          Reset

          Click to restore the default list of files under Add the following files to the VFS.

          Back

          Accesses the Sequencing Wizard's previous page.

          Next

          Accesses the Sequencing Wizard's next page.

          Cancel

          Terminates operation of the Sequencing Wizard.

          - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md deleted file mode 100644 index c195624f90..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md +++ /dev/null @@ -1,130 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Advanced Options Page -description: Application Virtualization Sequencing Wizard Advanced Options Page -author: dansimp -ms.assetid: 2c4c5d95-d55e-463d-a851-8486f6a724f2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Advanced Options Page - - -Use the **Advanced Options** page of the Application Virtualization (App-V) Sequencing Wizard to specify advanced options for the application to be installed. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Block Size

          Use to specify the size of blocks that the SFT file will be divided into when streamed across a network. All blocks equal the specified size; however, the last block might be smaller than specified. Select one of the following values:

          -
            -
          • 4 KB

          • -
          • 16 KB

          • -
          • 32 KB

          • -
          • 64 KB

          • -
          -
          -Note

          When you select a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network.

          -
          -
          - -

          Enable Microsoft Update During Monitoring

          Enables installation of Microsoft Updates during the Sequencing Wizard's monitoring phase.

          Rebase DLLs

          Enables remapping of supported dynamic-link libraries to a contiguous space in RAM, saving memory and improving performance.

          Back

          Accesses the Sequencing Wizard's previous page.

          Next

          Accesses the Sequencing Wizard's next page.

          Cancel

          Terminates operation of the Sequencing Wizard.

          - - - -\[Template Token Value\] - -Use the **Advanced Options** page of the App-V Sequencing Wizard to specify advanced options for the application you are sequencing. This page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Allow Microsoft Update to run during monitoring

          Specifies whether software updates will be applied to the application during the monitoring phase of application sequencing. This option is helpful if updates are required to successfully complete the application installation. This option is not selected by default.

          Rebase Dlls

          Enables remapping of supported dynamic-link libraries to a contiguous space in RAM. Selecting this option can help manage memory and improve application performance. This option is not selected by default.

          Back

          Goes to the previous page of the wizard.

          Next

          Goes to the next page of the wizard.

          Cancel

          Discards the settings and exits the wizard.

          - - - -\[Template Token Value\] - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md deleted file mode 100644 index 0fa1b9ca03..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Configure Application Page -description: Application Virtualization Sequencing Wizard Configure Application Page -author: dansimp -ms.assetid: 2927debd-de4b-41d2-9e1c-e8927231f4cc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Configure Application Page - - -Use the **Configure Applications** page of the App-V Sequencing Wizard to add applications to a sequenced application package and to add or delete shortcuts and file type associations. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Application

          Displays a list of applications, which can be expanded to add or edit file type associations.

          Name

          Displays the name of the application you are sequencing.

          Version

          Displays the version number for the application you are sequencing.

          Command Line

          Displays any command-line directive of the application you are sequencing.

          Add

          Adds a selected application to a package.

          Remove

          Deletes a selected application from a package.

          Edit

          Enables editing of the application path and OSD file properties of the selected application.

          Back

          Goes to the previous page of the wizard.

          Next

          Goes to the next page of the wizard

          Cancel

          Discards the settings and closes the wizard.

          - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md deleted file mode 100644 index 995ae0facc..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Launch Applications Page -description: Application Virtualization Sequencing Wizard Launch Applications Page -author: dansimp -ms.assetid: 69b1d6e1-00ff-49e3-a245-a4aca225d681 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Launch Applications Page - - -Use the **Launch Applications** page of the App-V sequencing wizard to run applications so that the Sequencer can optimize the package for streaming and you can configure how the application should be initially started on target computers. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Name

          Displays the name of application you are sequencing.

          Command Line

          Displays any command-line directive for the application you are sequencing.

          Launch All

          Starts each application displayed, exercises each application sufficiently to cover the actions that users typically take immediately after they open the application, and then exits each application.

          Launch

          Starts a selected application and exercises the application sufficiently to cover the actions that users typically take immediately after they open the application.

          Back

          Goes to the previous page of the wizard.

          Next

          Goes to the next page of the wizard.

          Cancel

          Discards the settings and closes the wizard.

          - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md deleted file mode 100644 index 8f834f6d26..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Monitor Installation Page -description: Application Virtualization Sequencing Wizard Monitor Installation Page -author: dansimp -ms.assetid: b54b8145-a57e-4d0d-b776-b5319aadb78e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Monitor Installation Page - - -Use the **Monitor Installation** page of the Application Virtualization Sequencing Wizard to start the sequencing process so that the Sequencer can monitor the application installation activities. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Begin Monitoring

          Starts the monitoring of the sequencing process.

          -
          -Note

          The Sequencer will minimize so that you can run your application's installer, except on Vista.

          -
          -
          - -

          Stop Monitoring

          Stops the monitoring of the sequencing process.

          -
          -Note

          The Stop Monitoring button is displayed only after the monitoring process starts.

          -
          -
          - -

          Back

          Accesses the Sequencing Wizard's previous page.

          Next

          Accesses the Sequencing Wizard's next page.

          Cancel

          Terminates operation of the Sequencing Wizard.

          - - - -\[Template Token Value\] - -Use the **Monitor Installation** page of the App-V sequencing wizard to monitor the installation of an application. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Begin Monitoring

          Starts the monitoring of the application installation by the sequencer. This option enables the sequencer to record the installation process. After you click Start Monitoring, you must wait while sequencer prepares the computer for sequencing. All new and changed application components will be added to the virtual application package.

          Stop Monitoring

          Stops the sequencer from recording the installation process. This button is not available until you click Begin Monitoring.

          Back

          Goes to the previous page of the wizard.

          Next

          Goes to the next page of the wizard.

          Cancel

          Discards the settings and closes the wizard.

          - - - -\[Template Token Value\] - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md deleted file mode 100644 index 996fff81b1..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Package Information Page -description: Application Virtualization Sequencing Wizard Package Information Page -author: dansimp -ms.assetid: e52efd08-1b05-4bd6-a6e7-5f6bdbde7df7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Package Information Page - - -Use the **Package Information** page of the Application Virtualization (App-V) wizard to specify information that will be associated with the application you sequence. This page contains the following elements. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Package Name

          Specifies the name that will be associated with the virtual application package. This is a required field.

          Comments

          Specifies identifying information that will be associated with the package. The information will be added to OSD file ABSTRACT element. This field is optional.

          Show Advanced Monitoring Options

          Displays the Advanced Options page of the Sequencing Wizard.

          Next

          Goes to the next page of the wizard.

          Cancel

          Discards the settings and exits the wizard.

          - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md deleted file mode 100644 index 6a9437812a..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Sequence Package Page -description: Application Virtualization Sequencing Wizard Sequence Package Page -author: dansimp -ms.assetid: 4c603d6a-9139-4867-a085-c6d6b517917e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Sequence Package Page - - -Use the **Sequence Package** page of the Application Virtualization Sequencing Wizard to create the sequenced package. After you click **Finish**, save the application by clicking **File / Save** in the Sequencer console. This page contains the elements described in the following table. - - ---- - - - - - - - - - - - - -
          NameDescription

          Finish

          Closes the Sequencing Wizard and displays the virtual application package in the Sequence console.

          - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md deleted file mode 100644 index 87689f417f..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box -description: Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box -author: dansimp -ms.assetid: d79d7085-228e-4be2-abe6-2760b9b983d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box - - -Use the **Shortcut Locations** dialog box to specify where to publish application shortcuts on the Application Virtualization Desktop Client. This dialog box is found on the **Configure Applications** page of the Sequencing Wizard and contains the following elements. - -**Desktop** -Select to publish the application shortcut to the Application Virtualization Desktop Client. - -**Send To Menu** -Select to publish the application shortcut to the **Send To** menu. - -**Quick Launch Toolbar** -Select to publish the application shortcut to the Quick Launch toolbar. - -**Start Menu** -Select to publish the application shortcuts to a designated subfolder of the **Start** menu. - -**Advanced** -Click to publish application shortcuts to additional locations. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md b/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md deleted file mode 100644 index 8a53cc64f2..0000000000 --- a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md +++ /dev/null @@ -1,178 +0,0 @@ ---- -title: Application Virtualization Server-Based Scenario Overview -description: Application Virtualization Server-Based Scenario Overview -author: dansimp -ms.assetid: 2d91392b-5085-4a5d-94f2-15eed1ed2928 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server-Based Scenario Overview - - -If you plan to use a server-based deployment scenario for your Microsoft Application Virtualization environment, it is important to understand the differences between the *Application Virtualization Management Server* and the *Application Virtualization Streaming Server*. This topic describes those differences and also provides information about package delivery methods, transmission protocols, and external components that you will need to consider as you proceed with your deployment. - -## Application Virtualization Management Server - - -The Application Virtualization Management Server performs both the publishing function and the streaming function. The server publishes application icons, shortcuts, and file type associations to the App-V clients for authorized users. When user requests for applications are received the server streams that data on-demand to authorized users using RTSP or RTSPS protocols. In most configurations using this server, one or more Management Servers share a common data store for configuration and package information. - -The Application Virtualization Management Servers use Active Directory groups to manage user authorization. In addition to Active Directory Domain Services, these servers have SQL Server installed to manage the database and data store. The Management Server is controlled through the Application Virtualization Management Console, a snap-in to the Microsoft Management Console. - -Because the Application Virtualization Management Servers stream applications to end-users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. - -## Application Virtualization Streaming Server - - -The Application Virtualization Streaming Server delivers the same streaming and package upgrade capabilities provided by the Management Server, but without its Active Directory or SQL Server requirements. However, the Streaming Server does not have a publishing service, nor does it have licensing or metering capabilities. The publishing service of a separate App-V Management Server is used in conjunction with the App-V Streaming Server. The App-V Streaming Server addresses the needs of businesses that want to use Application Virtualization in multiple locations with the streaming capabilities of the classic server configuration but might not have the infrastructure to support App-V Management Servers in every location. - -The Application Virtualization Streaming Server can also be used in environments with an existing electronic software distribution system (ESD). You use the ESD to manage streaming applications. Unlike the Application Virtualization Management Server, the Streaming Server does not use SQL or a management console. These servers use access control lists (ACLs) to grant user authorization. - -## Package Delivery Methods - - -If you plan to use an Application Virtualization Server as the publishing delivery method, you need to determine which of the following package delivery methods your scenario employs: - -- *Dynamic package delivery* - -- *Load from file package delivery* - -### Dynamic Package Delivery - -During dynamic package delivery, the server (Application Virtualization Management Server, Application Virtualization Streaming Server, or IIS server) delivers the virtualized applications to the end users through on-demand deployment. The server delivers the virtualized applications and packages to a client computer only when a user first attempts to launch an application (on demand). The server streams only the blocks needed to start the application (primary feature block). After the primary feature block is delivered to the client, the application runs; the client does not receive the complete application (incremental deployment) unless the client needs access to a part of the application that is not included in the primary feature block. When this occurs, the client performs an out-of-sequence request and the secondary feature block is streamed to the client. Dynamic package delivery allows for rapid application launch. - -### Load from File Package Delivery - -For load from file package delivery, the server delivers the entire virtualized application package to a client computer before the user launches the application. In this scenario, virtualized applications are delivered as a full package, rather than through the dynamic, incremental method used by the dynamic delivery model. - -**Note**   -For each delivery method, the initial virtual application delivery process and the virtual application update process are the same; the updated virtual application package replaces the original application package. - - - -The following table compares the advantages and disadvantages of each package delivery method. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          MethodAdvantagesDisadvantagesComments

          Dynamic package delivery

          Applications are delivered and updated on demand.

          -

          Applications are delivered and updated incrementally to optimize launch time.

          -

          Updates are delivered automatically to the client desktop.

          Larger footprint in enterprise topology because of server requirements.

          -

          Application streaming should be over a LAN; deployment scenarios over a WAN or that use an unreliable or intermittent connection between the server and client might be unusable.

          Requires a streaming infrastructure.

          -

          Windows Installer used to deploy Application Virtualization Desktop Client software to end-user computers.

          -

          Large enterprises should use Application Virtualization Streaming Servers as distribution points.

          Load from file package delivery

          Consistent with typical enterprise management practices.

          -

          Supports stand-alone configuration scenario.

          -

          Provides solution to micro–branch office problem.

          Application delivery and update is not possible on-demand.

          -

          Application delivery and update is not incremental; it increases resource consumption relative to dynamic delivery.

          The IT organization is often responsible for managing application licenses, user authorization, and authentication.

          - - - -## Server-Related Protocols and External Components - - -The following table lists the server types that can be used in an Application Virtualization Server-based scenarios, along with their corresponding transmission protocols and the external components needed to support the specific server configuration. The table also includes the reporting mechanism and the active upgrade mechanism for each server type. Because these scenarios all use the Application Virtualization Management Server, you can use the internal reporting functionality that is built into the system. If you use an Application Virtualization Management or an Application Virtualization Streaming Server to deliver packages to the client, packages on the server are automatically upgraded when a user logs into the client; if you use IIS servers or a file to deliver the packages to the client, the packages on the client must be upgraded manually. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Server TypeProtocolsExternal Components NeededReportingActive Upgrade

          Application Virtualization Management Server

          RTSP

          -

          RTSPS

          When using HTTPS, use an IIS server to download ICO and OSD files and a firewall to protect the server from exposure to the Internet.

          Internal

          Supported

          Application Virtualization Streaming Server

          RTSP

          -

          RTSPS

          Use a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTPS, use an IIS server to download ICO and OSD files and use a firewall to protect the server from exposure to the Internet.

          Internal

          Supported

          IIS server

          HTTP

          -

          HTTPS

          Use a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server to download ICO and OSD files and a firewall to protect the server from exposure to the Internet.

          Internal

          Not Supported

          File

          SMB

          You need a way to synchronize the content between the Management Server and the Streaming Server. You need a client computer with file sharing or streaming capability.

          Internal

          Not Supported

          - - - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario.md b/mdop/appv-v4/application-virtualization-server-based-scenario.md deleted file mode 100644 index 84336dad16..0000000000 --- a/mdop/appv-v4/application-virtualization-server-based-scenario.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Application Virtualization Server-Based Scenario -description: Application Virtualization Server-Based Scenario -author: dansimp -ms.assetid: 10ed0b18-087d-470f-951b-5083f4cb076f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server-Based Scenario - - -If you plan to use a server-based deployment scenario for your Microsoft Application Virtualization (App-V) environment, you should understand the differences between the Application Virtualization Management Server and the Application Virtualization Streaming Server. The topics in this section describe those differences and also provide information about package delivery methods, transmission protocols, and external components that you have to consider as you continue with your deployment. This section also provides step-by-step procedures for installing and configuring the App-V Management Server and the Application Virtualization Streaming Servers. - -## In This Section - - -[Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) -Provides important deployment information about the Application Virtualization Management Server, the Application Virtualization Streaming Server, and the package delivery methods, protocols, and external components relevant to your server-based deployment plan. - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -Describes how to install the Microsoft Application Virtualization platform components required for your server-based deployment. - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) -Describes how to configure the Application Virtualization Management Server, the Application Virtualization Streaming Server, the Internet Information Integration (IIS) server, and the file server. - -[How to Configure a Read-only Cache on the App-V Client (VDI)](how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md) -Describes how to configure the App-V client to use read-only cache. - -[How to Configure a Read-only Cache on the App-V Client (RDS)](how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md) -Describes how to configure the App-V client to use read-only cache. - -[How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -Describes how to configure database mirroring by using Microsoft SQL Server for your App-V system. - -## Reference - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -## Related Sections - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-management-console-reference.md b/mdop/appv-v4/application-virtualization-server-management-console-reference.md deleted file mode 100644 index c36cd7f3fd..0000000000 --- a/mdop/appv-v4/application-virtualization-server-management-console-reference.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Application Virtualization Server Management Console Reference -description: Application Virtualization Server Management Console Reference -author: dansimp -ms.assetid: 7c9890f4-7230-44dd-bbe8-95a4b65dc796 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server Management Console Reference - - -This section of the Application Virtualization Server Management Console Help provides detailed information about each of the functional areas of the interface. - -## In This Section - - -[Server Management Console: About Dialog Boxes](server-management-console-about-dialog-boxes.md) -Describes the available **About** dialog boxes and how to view them. - -[Server Management Console: Application Virtualization System Node](server-management-console-application-virtualization-system-node.md) -Describes the screens in the Application Virtualization System node. - -[Server Management Console: Applications Node](server-management-console-applications-node.md) -Describes the screens in the **Applications** node. - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) -Describes the screens in the **File Type Association** node. - -[Server Management Console: Packages Node](server-management-console-packages-node.md) -Describes the screens in the **Packages** node. - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) -Describes the screens in the **Application Licenses** node. - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) -Describes the screens in the **Server Groups** node. - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) -Describes the screens in the **Provider Policies** node. - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) -Describes the screens in the **Administrators** node. - -[Server Management Console: Reports Node](server-management-console-reports-node.md) -Describes the screens in the **Reports** node. - -## Related topics - - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-management-help.md b/mdop/appv-v4/application-virtualization-server-management-help.md deleted file mode 100644 index 7ae7b3aab4..0000000000 --- a/mdop/appv-v4/application-virtualization-server-management-help.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Application Virtualization Server Management Help -description: Application Virtualization Server Management Help -author: dansimp -ms.assetid: 4f67265c-58f5-4d77-bfff-95474d8f1bb6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server Management Help - - -This help file supports the Application Virtualization Management Server. - -## In This Section - - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) -Includes overview information about the Application Virtualization Management Server. - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -Includes an overview as well as step-by-step procedures for using the features and commands that are available in the Application Virtualization Server. - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) -Includes reference information about the windows and dialogs that are available in the Application Virtualization Server Management Console. - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server.md b/mdop/appv-v4/application-virtualization-server.md deleted file mode 100644 index db3ac34238..0000000000 --- a/mdop/appv-v4/application-virtualization-server.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Application Virtualization Server -description: Application Virtualization Server -author: dansimp -ms.assetid: feea99b2-5e3d-42b1-ad41-157429e5fceb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server - - -This section provides important information and procedures that you can use to configure and manage the Microsoft Application Virtualization (App-V) Servers. - -## In This Section - - -[Monitoring Application Virtualization Servers](monitoring-application-virtualization-servers.md) -Provides information about monitoring the App-V Servers. - -[How to Load Files and Packages](how-to-load-files-and-packages.md) -Provides information about loading files and packages. - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -Provides detailed procedures for managing the App-V Servers by using the Server Management Console. - -[How to Configure the App-V System for Package Upgrade](how-to-configure-the-app-v-system-for-package-upgrade.md) -Provides detailed information about upgrading packages in different scenarios. - -[Troubleshooting Information for the Application Virtualization Server](troubleshooting-information-for-the-application-virtualization-server.md) -Provides information that you can use to troubleshoot various issues on the Application Virtualization (App-V) Server. - -[How to Migrate the App-V SQL Database to a Different SQL Server](how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md) -Provides detailed procedures for migrating the App-V SQL Database to a different SQL Server. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-system-requirements.md b/mdop/appv-v4/application-virtualization-system-requirements.md deleted file mode 100644 index d912bfff73..0000000000 --- a/mdop/appv-v4/application-virtualization-system-requirements.md +++ /dev/null @@ -1,363 +0,0 @@ ---- -title: Application Virtualization System Requirements -description: Application Virtualization System Requirements -author: dansimp -ms.assetid: a2798dd9-168e-45eb-8103-e12e128fae7c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization System Requirements - - -This topic describes the minimum hardware and software requirements for the Microsoft Application Virtualization (App-V) Management Server and Streaming Server. - -## Application Virtualization Management and Streaming Servers - - -The following list includes the minimum recommended hardware and software requirements for the App-V Management Server and App-V Streaming Server. - -### Hardware Requirements - -- Processor—Intel Pentium III, 1 GHz - -- RAM—512 MB - -- Disk space—200 MB available hard disk space, not including the Content directory - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2003

          Standard Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2003

          Enterprise Edition or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2003 R2

          Standard Edition

          No service pack or SP2

          x86 or x64

          Windows Server 2003 R2

          Enterprise Edition or Datacenter Edition

          No service pack or SP2

          x86 or x64

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2008 R2¹

          Standard, Enterprise, or Datacenter Edition

          x64

          - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -## Data Store - - -The following list includes the minimum recommended hardware and software requirements for the computer that is used when you install the data store on a separate server. The data store is required only for the Application Virtualization Management Server. - -### Hardware Requirements - -- Processor—Intel Pentium III, 850 MHz - -- RAM—512 MB - -- Disk space—200 MB available hard disk space - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2003

          Standard Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2003

          Enterprise Edition or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2003 R2

          Standard Edition

          No service pack or SP2

          x86 or x64

          Windows Server 2003 R2

          Enterprise Edition or Datacenter Edition

          No service pack or SP2

          x86 or x64

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2008 R2¹

          Standard, Enterprise, or Datacenter Edition

          x64

          - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -- Database—Microsoft SQL Server 2000 SP3a or SP4, SQL Server 2005 SP1, SP2, or SP3, or SQL Server 2008, no service pack or SP1 or SQL Server 2008 R2 (32-bit or 64-bit) - -- Microsoft Data Access Components—MDAC 2.7 - -- Domain controller—Active Directory Domain Services or Windows NT 4.0-based primary domain controller (PDC) as the central authentication authority - -## Management Web Service - - -The following list includes the minimum recommended hardware and software requirements for the Application Virtualization Management Web Service when it is installed on a separate computer. - -### Hardware Requirements - -- Processor—Intel Pentium III, 800 MHz - -- RAM—256 MB - -- Disk space—50 MB available hard disk space - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2003

          Standard Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2003

          Enterprise Edition or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2003 R2

          Standard Edition

          No service pack or SP2

          x86 or x64

          Windows Server 2003 R2

          Enterprise Edition or Datacenter Edition

          No service pack or SP2

          x86 or x64

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2008 R2¹

          Standard, Enterprise, or Datacenter Edition

          x64

          - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -- Internet Information Services—Internet Information Services (IIS) 6.0 configured with Microsoft ASP.NET, IIS 7 - -- Microsoft .NET Framework 2.0 - -## Management Console - - -The following list includes the minimum recommended hardware and software requirements for the Application Virtualization Management Console when it is installed on a separate computer. - -### Hardware Requirements - -- Processor—Intel Pentium III, 450 MHz - -- RAM—256 MB - -- Disk space—200 MB available hard disk space - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows XP

          Professional Edition

          SP2 or SP3

          x86 or x64

          Windows Vista

          Business, Enterprise, or Ultimate Edition

          No service pack, SP1, or SP2

          x86 or x64

          Windows 7

          Professional, Enterprise, or Ultimate Edition

          x86 or x64

          Windows Server 2003

          Standard Edition, Enterprise Edition, or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2003 R2

          Standard Edition, Enterprise Edition, or Datacenter Edition

          No service pack or SP2

          x86 or x64

          Windows Server 2008

          Standard, Enterprise, or Datacenter Edition

          SP1 or SP2

          x86 or x64

          Windows Server 2008 R2¹

          Standard, Enterprise, or Datacenter Edition

          x64

          - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -- Microsoft Management Console—MMC 3.0 or later - -- Microsoft .NET Framework 2.0 SP2 (minimum) - - **Important**   - The minimum requirement is .NET Framework 2.0 SP2 if you must install App-V hotfix KB980850 or subsequent App-V hotfixes on the computer that is running the App-V Management Console. - - - -## Related topics - - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) - -[Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md b/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md deleted file mode 100644 index 3420240770..0000000000 --- a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Application Virtualization Technical Publications -description: Application Virtualization Technical Publications -author: dansimp -ms.assetid: 86606647-3b9b-4459-9638-64626051ac94 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Technical Publications - - -In this section, you can find additional technical support information for Microsoft Application Virtualization. - -## Technical Publications - - -The following technical publications support Microsoft Application Virtualization. - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-licenses-node.md b/mdop/appv-v4/applications-licenses-node.md deleted file mode 100644 index 3bc727a6b1..0000000000 --- a/mdop/appv-v4/applications-licenses-node.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Applications Licenses Node -description: Applications Licenses Node -author: dansimp -ms.assetid: 2b8752ff-aa56-483e-b844-966941af2d94 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Licenses Node - - -The **Applications Licenses** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of licenses and license groups. The following license types are available: - -- **Unlimited License**—Provides access for any number of simultaneous users. This method of licensing is appropriate when you want to associate an enterprise-wide license with an application. - -- **Concurrent License**—Enables you to define the maximum number of concurrent users who are allowed to use the application. - -- **Named License**—Enables you to assign a license to an individual user. A named license can be used to ensure that a particular user will always be able to run the application. - -**Note**   -You can combine concurrent and named licenses for the same application. - - - -Right-click the **Applications Licenses** node to display a pop-up menu that contains the following elements. - -**New Unlimited License** -Displays the New Unlimited License Wizard. This wizard consists of the following pages: - -1. Enter the name of the license group in the **Applications License Group Name** field, and enter a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0 through 100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and select the **Enabled** check box to enable the license. - - Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new license. - -**New Concurrent License** -Displays the New Concurrent License Wizard. This wizard consists of the following three pages and is almost identical to the New Unlimited License Wizard: - -1. Enter the name of the license group in the **Applications License Group Name** field, and enter a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0 through 100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and enter a value in the **Concurrent License Quantity** field. - - You can also use the up and down arrows to specify the number of concurrent licenses. Select the **Enabled** check box to enable the license. - - Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new licenses. - -**New Named License** -Displays the New Named License Wizard. This wizard consists of the following four pages: - -1. Enter the name of the license group in the **Applications License Group Name** field, and enter a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0 through 100). You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and select the **Enabled** check box to enable the license. - - Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Add**, **Edit**, or **Remove** named users. - -4. Click **Finish** to add the new license. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -If you click a license group or license that appears under the **Application Licenses** node in the **Scope** pane, the following elements are available. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Properties** -Displays the **Properties** dialog box for the selected license group. The **General** tab of the **Properties** dialog box displays information about the license group and lets you change the time value in the **License Expiration Warning** field. The **Applications** tab displays the list of applications associated with the license group. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) - - - - - - - - - diff --git a/mdop/appv-v4/applications-licenses-results-pane-columns.md b/mdop/appv-v4/applications-licenses-results-pane-columns.md deleted file mode 100644 index 9fe5dbaaf8..0000000000 --- a/mdop/appv-v4/applications-licenses-results-pane-columns.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Applications Licenses Results Pane Columns -description: Applications Licenses Results Pane Columns -author: dansimp -ms.assetid: bd56b36a-655e-4fc4-9f83-d2ed68882402 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Licenses Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays a variety of columns. These columns are visible when licenses are visible and when the **Results** pane displays licenses. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, expand the **Application Licenses** node, right-click a license and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ColumnContents

          Description

          Describes the license.

          Type

          Lists the type of license. The available types are Unlimited (any number or users), Concurrent (a specified number of concurrent users), and Named (licenses reserved for specific users).

          Expiration Date

          Displays the date the license is set to expire.

          Enabled

          Displays the enabled status of the license as true or false.

          - -  - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-licenses-results-pane.md b/mdop/appv-v4/applications-licenses-results-pane.md deleted file mode 100644 index 3339644301..0000000000 --- a/mdop/appv-v4/applications-licenses-results-pane.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Applications Licenses Results Pane -description: Applications Licenses Results Pane -author: dansimp -ms.assetid: 8b519715-b2fe-451e-ad9b-e9b73f454961 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Licenses Results Pane - - -The **Applications Licenses Results** pane in the Application Virtualization Server Management Console displays a list of the available application license groups and application licenses. - -Right-click any application license group to display a pop-up menu that contains the following elements. - -**New Unlimited License** -Displays the New Unlimited License Wizard. This option is available only when the license group has no licenses. This wizard consists of three pages: - -1. Enter a group name in the **Applications License Group Name** field and a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0–100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and select the **Enabled** check box. Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the default check box or use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new license. - -**New Concurrent License** -Displays the New Concurrent License Wizard. This option is available only when the license group has no unlimited licenses. This wizard consists of the following pages and is almost identical to the New Unlimited License Wizard: - -1. Enter a group name in the **Applications License Group Name** field and a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0–100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and enter a value in the **Concurrent License Quantity** field. You can also use the up and down arrows to specify the number of concurrent licenses. Select the **Enabled** check box to enable the license. Optionally, you can use the **Expiration Date** field to select an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new licenses. - -**New Named License** -Displays the New Named License Wizard. This option is available only when the license group has no unlimited licenses. This wizard consists of the following pages: - -1. Enter a group name in the **Applications License Group Name** field and a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0–100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description**, and select the **Enabled** check box. Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or use the calendar utility to browse to the desired expiration date. - -3. Click **Add**, **Edit**, or **Remove** named users. - -4. Click **Finish** to add the new license. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes the license group from the list. - -**Rename** -Changes the name of the applications license group. - -**Properties** -Displays the **Properties** dialog box for the selected application license groups. This dialog box has the following tabs: - -- **General** tab—Displays general information about the license group. From this tab, you can change the time value (in minutes) in the **License Expiration Warning** field. You can enter any value from 0–100. - -- **Applications** tab—Displays the list of applications associated with the license group. - -**Help** -Displays the Application Virtualization Server Management Console help system. - -When the **Results** pane displays application license groups, right-click anywhere in the **Results** pane, except on a license group, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays licenses, right-click any application license to display a pop-up menu that contains the following elements. - -**Delete** -Deletes the license from the list. - -**Rename** -Changes the name of the license. - -**Properties** -Displays the **Properties** dialog box for the selected application license. - -The **General** tab of the **Properties** dialog box displays information about the license and lets you change the enabled status, license expiration date, and license key information. - -**Help** -Displays the server management console help system. - -When the **Results** pane displays licenses, right-click anywhere in the **Results** pane, except on a license, to display a pop-up menu that contains the following elements. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the selected license. - -The **General** tab of the **Properties** dialog box displays information about the license and lets you change the enabled status, license expiration date, and license key information. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-node-in-server-management-console.md b/mdop/appv-v4/applications-node-in-server-management-console.md deleted file mode 100644 index 0dd4066e35..0000000000 --- a/mdop/appv-v4/applications-node-in-server-management-console.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Applications Node in Server Management Console -description: Applications Node in Server Management Console -author: dansimp -ms.assetid: 27edbd83-0fc2-4a40-9834-d5db5be06681 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Node in Server Management Console - - -The **Applications** node is one level below the Application Virtualization System node in the **Scope** pane. When you select this node, the **Results** pane displays a list of applications. Right-click the **Applications** node to display a pop-up menu that contains the following elements: - -**New Application Group** -Displays the New Application Group Wizard. - -**New Application** -Displays the New Application Wizard. - -**Import Applications** -Imports Open Software Descriptor (OSD) files or Sequencer Project (SPRJ) files. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -When you right-click any application group that appears under the **Applications** node in the **Scope** pane, the following additional elements are available. - -**View** -Changes the appearance and content of the **Results** pane. - -**Move** -Moves the application to another application group. - -**Copy** -Copies an application to a new Application Virtualization System. - -**Delete** -Deletes an application. - -**Rename** -Renames an application. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -## Related topics - - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - -[Server Management Console: Applications Node](server-management-console-applications-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-node.md b/mdop/appv-v4/applications-node.md deleted file mode 100644 index 760ebc733a..0000000000 --- a/mdop/appv-v4/applications-node.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Applications Node -description: Applications Node -author: dansimp -ms.assetid: ded79569-8a3f-47ab-b135-0836bbb039f3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Node - - -The **Applications** node is one level below the **Application Virtualization** node in the **Scope** pane of the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of applications. Right-click the **Applications** node to display a pop-up menu that contains the following elements. - -**New Application** -This menu item displays the New Application Wizard. This wizard consists of one page where you can select an icon for the application and browse to or enter a URL or a path to the Open Software Descriptor (OSD) file. - -- **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - -- **OSD File Path or URL**—Enter a local absolute path, a full Universal Naming Convention (UNC) path, or an HTTP URL. - -- **... (OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -**New Window from Here** -Select this menu item to open a new management console with the selected node as the root node. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items enables you to change the appearance and content of the **Results** pane. - -**Refresh** -Select this item to refresh the management console. - -**Help** -This item displays the help system for the management console. - -## Related topics - - -[Applications Results Pane](applications-results-pane.md) - -[Applications Results Pane Columns](applications-results-pane-columns.md) - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md deleted file mode 100644 index 55a7172da2..0000000000 --- a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Applications Results Pane Columns in Server Management Console -description: Applications Results Pane Columns in Server Management Console -author: dansimp -ms.assetid: 8757e3bc-450b-4550-81d2-624906523147 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane Columns in Server Management Console - - -The **Applications Results** pane in the Application Virtualization Management Console displays a variety of columns. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ColumnContents

          Name

          Displays the application name.

          Version

          Displays the application version.

          Package

          Displays the name of the package.

          OSD Path

          Displays the full original path or URL to the Open Software Descriptor (OSD) file.

          Icon File

          Displays the complete path to the icon file.

          Enabled

          Displays the enabled status of the file; the status is either true or false.

          Application License

          Displays the name of the application license.

          Type

          Displays the application or application group type.

          Description

          Displays a brief description of the application.

          - -  - -## Related topics - - -[Server Management Console: Applications Node](server-management-console-applications-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-results-pane-columns.md b/mdop/appv-v4/applications-results-pane-columns.md deleted file mode 100644 index c7c7c41ec3..0000000000 --- a/mdop/appv-v4/applications-results-pane-columns.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Applications Results Pane Columns -description: Applications Results Pane Columns -author: dansimp -ms.assetid: abae5ce2-40df-4f47-8062-f5eb6295c88c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane Columns - - -The **Results** pane of the **Applications** node in the Application Virtualization Client Management Console can display a variety of columns. **Application**, **Running**, **Locked**, and **Package Status** are shown by default. - -**Note**   -You can add or remove columns by right-clicking in the **Results** pane, selecting **View**, and then selecting **Add/Remove Columns**. - - - -The list can be sorted by any column. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text, dates and times are considered to come before any other text. - -The following columns are available. - -**Application** -The application name and version, separated by a space. - -**Application In Use** -Displays **Yes** or **No** depending on whether any user is using the application (that is, running it or loading it). - -**App Virt Server** -The Application Virtualization server from which the package was streamed. - -**Cached Icon File** -The name of the icon files in cache (a GUID in the current implementation). - -**Cached Icon Path** -The full path to the icon files in cache. - -**Cached Launch Percent** -The percentage of the application’s launch data currently in cache. - -**Cached Launch Size (MB)** -The amount of the application’s launch data currently in cache. - -**Cached OSD File** -The name of the OSD file in the cache (which is a GUID in the current implementation). - -**Cached OSD Path** -The full path to the OSD file in the cache. - -**Cached Package Percent** -The percentage of the package currently in cache. - -**Cached Package Size (MB)** -The size of the portion of the package currently in cache. - -**Icon File** -The original name of the icon file. - -**Icon Path** -The original path or URL for the icon file. - -**Last System Launch** -The last time the application was launched by the system. - -**Last User Launch** -The last time the application was launched by the user. - -**Launch Size (MB)** -The uncompressed size of the package data needed to launch the application. - -**Locked** -Displays **Yes** or **No** depending on whether the application’s package is locked in the cache. - -**Name** -The application name. - -**OSD File** -The original name of the Open Software Descriptor (OSD) file. - -**OSD Path** -The full original path or URL to the OSD file. - -**Package Name** -The name of the package. - -**Package GUID** -The GUID for the package. - -**Package Size (MB)** -The total size of the uncompressed data in the package. - -**Package Status** -The current operational status of the package. - -**Package URL** -The URL for the package. - -**Package Version** -The version for the package. - -**Package Version GUID** -The GUID for the package version. - -**Running** -Displays **Yes** or **No** depending on whether the current user is running the application. - -**Source** -Where the application came from—either the name of an application publishing server or "Local" for applications added from OSD files directly. - -**Version** -The application version. - -## Related topics - - -[Applications Node](applications-node.md) - -[Applications Results Pane](applications-results-pane.md) - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/applications-results-pane-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-in-server-management-console.md deleted file mode 100644 index ea36979d73..0000000000 --- a/mdop/appv-v4/applications-results-pane-in-server-management-console.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: Applications Results Pane in Server Management Console -description: Applications Results Pane in Server Management Console -author: dansimp -ms.assetid: 686218bc-6156-40e2-92aa-90981c3d112a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane in Server Management Console - - -The **Applications Results** pane displays a list of the available applications. - -Right-click anywhere in the **Results** pane, except on an application or application group, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the list of applications. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. For more information about the **Export List** feature, refer to the documentation for the Microsoft Management Console. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line up Icons** -Organizes the icons in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -Right-click any application in the **Results** pane to display a pop-up menu that contains the following elements. - -**Move** -Moves the applications into and out of application groups. - -**Copy** -Copies the application to another Application Virtualization System. - -**Duplicate** -Duplicates the application in the **Results** pane. - -**Delete** -Removes the application from the Application Virtualization System. - -**Rename** -Enables you to change the name of the application. - -**Properties** -Displays the **Properties** dialog box for the selected application. This dialog box has the following tabs: - -- **General** tab—Displays the application icon, application name, and package name. This tab also displays the following specific information about the application that you can change: - - - **Version**—Enables you to enter the appropriate version number. Select the **Enable** check box to enable version numbering. - - - **Description**—Enables you to enter a brief description of the application. - - - **OSD Path**—Enables you to enter or browse to the location of the appropriated Open Software Descriptor (OSD) file. - - - **Icon Path**—Enables you to enter or browse to the location of the icon file that you want to associate with the application. - - - **Application License Group**—Enables you to select the license group from the drop-down list of license groups. - - - **Server Group**—Enables you to select the server group from the drop-down list of server groups. - -- **Shortcuts** tab—Displays the check boxes that correspond to the locations where the shortcuts are published. You can select or clear check boxes from this tab. - -- **File Type Associations** tab—Displays a list of the file types associated with the selected application. From this tab, you can add, edit, or delete the file type association. - -- **Access Permissions** tab—Displays the list of groups that have access permission to the selected application. From this tab, you can add, edit, or delete groups. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -Right-click any application group to display a pop-up menu that contains the following elements. - -**New Application Group** -Displays the New Application Group Wizard. Add the name of the new application group in the appropriate field, and then click **Finish**. - -**New Application** -Displays the New Application Wizard. Navigate through the wizard to add applications. - -**Import Applications** -Displays a browse dialog box that you can use to import existing applications into the Application Virtualization Management Console. You can import an OSD file or a Sequencer Project (SPRJ) file. - -**Move** -Moves the application group into and out of application groups. - -**Copy** -Copies the application group to a new server. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Removes the application group from the server. - -**Rename** -Changes the name of the application group. - -**Refresh** -Refreshes the application group. If the **Results** pane is displaying the entire application node, the pane will switch to display the contents of the application group. - -**Properties** -Displays the **Properties** dialog box for the selected application group. This dialog box has the following tabs: - -- **General** tab—Displays the application group icon and application group name. This tab also displays the following, limited information about the application group that you can change. - - - **Version**—Enables you to enter a version number for the application group. - - - **Description**—Enables you to enter a brief description of the application group. - - - **OSD Path**—Enables you to enter or browse to the location where the OSD file is located. - - - **Icon Path**—Enables you to enter or browse to the location where the icon file is located. - - - **Application License Group**—Enables you to select the license group from the drop-down list of license groups. - - - **Server Group**—Enables you to select the server group from the drop-down list of server groups. - -- **Shortcuts** tab—Displays the check boxes that correspond to the locations where the shortcuts are published. You can select or clear check boxes from this tab. - -- **File Associations** tab—Displays the list of file type associations. You can add, edit, or delete file type associations from this tab. - -- **Access Permissions** tab—Displays the list of groups that have access permission to the selected application group. From this tab, you can add, edit, or delete groups. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -## Related topics - - -[Server Management Console: Applications Node](server-management-console-applications-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-results-pane.md b/mdop/appv-v4/applications-results-pane.md deleted file mode 100644 index ad52fe65d1..0000000000 --- a/mdop/appv-v4/applications-results-pane.md +++ /dev/null @@ -1,142 +0,0 @@ ---- -title: Applications Results Pane -description: Applications Results Pane -author: dansimp -ms.assetid: 977a4d35-5344-41fa-af66-14957b38ed47 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane - - -The **Applications Results** pane in the Application Virtualization Client Management Console displays a list of the available applications. Users can see a list of applications for which they have been granted access privileges. - -For more information about the procedures you can perform from this pane, see [How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md). - -Right-click any application to display a pop-up menu that contains the following elements. - -**New Shortcut** -This menu item displays the New Shortcut Wizard. This wizard consists of three pages: - -1. Select an icon, and specify a name for the shortcut: - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **Shortcut Title**—Enter the name you want to give the shortcut. This field defaults to the existing name and version of the application. - -2. Determine the location of the published shortcut. - - 1. **Location of shortcut**—Select a location by selecting one of the check boxes. The available locations are **Desktop**, **Quick Launch Toolbar**, **Send to Menu**, **Start Menu**, and **Another location**. - - 2. **Programs in the Start Menu**—When you select the **Start Menu** check box, this field becomes active. Leave this field blank to publish the shortcut directly to the root of the Programs folder, or enter a folder name or hierarchy—for example, "My\_Computer\\Office Applications." Shortcuts created this way are available only for the current user. - - 3. **Another location** and browse button—When you select the **Another location** check box, this field becomes active. Enter any valid location on the computer or any available Universal Naming Convention (UNC) path(shared file or directory on a network). The browse button displays a standard Windows **File Open** dialog box. - -3. Enter the desired command-line parameters, and then click **Finish** to exit the wizard. - -**New Association** -This menu item displays the New Association Wizard. This wizard consists of two pages: - -1. Enter a file name extension, and associate the extension with a file type. - - 1. **Extension**—Enter a file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is not selected. - - 4. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Choose a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -2. Select the application that will open files with the specified extension: - - 1. **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - 2. **Open file with the association described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -**Repair** -Resets the application default settings and eliminates all user-defined settings for the selected application. - -**Load** or **Unload** -Loads or unloads the selected application into the cache. This command is not available if 100 percent of the application is in the cache. - -**Clear** -Removes the user's settings, shortcuts, and file type associations for the selected application. This item is not available if a user is running any application from a suite of applications. Displays a confirmation prompt. - -**Lock** or **Unlock** -Locks or unlocks an application in the cache. When an application is locked, it cannot be deleted or overwritten. - -**Import** -Imports an application into the cache directly from this command in the **Applications** node. - -**Delete** -Deletes an application from the **Results** pane and from the computer, and clears the application from cache. - -**Refresh** -Refreshes the contents of the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the selected application. This dialog box has two tabs: - -1. The **General** tab displays the application icon and name, the location from where the application was streamed, and the path to the local OSD file. From this tab, you can change the icon for the application or you can clear the settings (which removes the shortcuts and the file type associations). - -2. The **Package** tab displays information about the application package, and you can **Lock**, **Unlock**, **Load**, **Unload**, and **Import** applications. - -**Help** -Displays the Client Management Console help system. - -## Displaying General Options for the Results pane - - -Right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**New Application** -This menu item displays the New Application Wizard. This wizard consists of one page where you can select an icon for the application and browse to or enter a URL or a path to the OSD file: - -1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - -2. **OSD File Path or URL**—Enter a local absolute path, a full UNC path, or an HTTP URL. - -3. **... (OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items lets you change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the management console. - -## Related topics - - -[Applications Node](applications-node.md) - -[Applications Results Pane Columns](applications-results-pane-columns.md) - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -[How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md b/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md deleted file mode 100644 index 8ac9a89ec9..0000000000 --- a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Best Practices for the Application Virtualization Sequencer -description: Best Practices for the Application Virtualization Sequencer -author: dansimp -ms.assetid: 95e5e216-864f-41a1-90d4-b8d7e1eb42a0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Best Practices for the Application Virtualization Sequencer - - -This topic provides best practices for running the Microsoft Application Virtualization (App-V) Sequencer. Review and consider the following recommendations when planning and using the Sequencer in your environment. - -## Sequencing Computer Configuration Best Practices - - -The following best practices should be considered when configuring the computer running the App-V Sequencer: - -- **Sequence on a computer that has a similar configuration and that is running an earlier version of the operating system than the target computers.** - - Ensure that the computer that is running the Sequencer is running an earlier version of the operating system than the target computers. This includes the service pack and update versions. For example, if the target computers are running Windows Vista and Windows XP, you should sequence applications on a computer that is running Windows XP. The ability to sequence on one operating system and run the virtualized application on a different operating system is not guaranteed, and depends on the particular application and operating system. If you encounter issues, you may be required to sequence on the same operating system environment as the one on which the App-V client is running. - -- **Configure the computer running the Sequencer with multiple partitions.** - - You should configure the computer running the Sequencer with at least two primary partitions. The first partition (**C:**) should contain the operating system, and it should be formatted using the NTFS file system. The second partition (**Q:**) is used as the destination path for the virtual application installation and should also be formatted using the NTFS file system. - -- **Configure the temp directory with enough free disk space.** - - The Sequencer uses the **%TMP%** or **%TEMP%** directory and the **Scratch** directory to store temporary files during sequencing. You should configure these directories on the computer running the Sequencer with free disk space equivalent to the estimated application installation requirements. You can verify the location of the **Scratch** directory by opening the Sequencer console and selecting **Tools**, **Options**, and then selecting the **Paths** tab. Configuring the temp directories and the **Scratch** directory on different hard drive partitions can improve performance during sequencing. - -- **Sequence applications by using Microsoft Virtual PC.** - - You will sequence most applications more than once. To help facilitate this, you should consider sequencing on a computer running in a virtual environment. This will allow you to sequence an application and revert to a clean state, with minimal reconfiguration, on the computer that is running the Sequencer. - - If you are running Microsoft Hyper-V in your environment the App-V sequencer will run when the Hyper-V virtual computer it is running on is: - - - paused and resumed. - - - has its state saved and restored. - - - saved as a snapshot and is restored. - - - migrated to different hardware as part of a live migration. - -- **Before you sequence a new application, shut down other running programs.** - - Processes and scheduled tasks that normally run on the sequencing computer can slow down the sequencing process and cause irrelevant data to be gathered during sequencing. All unnecessary applications and programs should be shut down before you begin sequencing. - -- **Sequence on a computer that is running Terminal Services** - - You should not configure the install mode on a computer that is running Terminal Services before you install the sequencer. - -## Sequencing Best Practices - - -The following best practices should be considered when sequencing a new application: - -- - - **Note**   - If you are running App-V 4.6 SP1 you do not need to sequence to a directory that follows the 8.3 naming convention. - - - -- **Sequence to a unique directory that follows the 8.3 naming convention.** - - You should sequence all applications to a directory that follows the 8.3 naming convention. The specified directory name cannot contain more than eight characters, followed by a three-character file name extension—for example, **Q:\\MYAPP.ABC**. - -- **Sequence to a destination folder on the root of the drive, not to a subdirectory.** - - If the application suite has multiple parts, install each application to a subdirectory of the main directory. For example, if a package contains an application along with a client, use **Q:\\AppSuite** as the main directory and sequence the main application to **Q:\\AppSuite\\Main**, and sequence the client to **Q:\\AppSuite\\Client**. - -- **Configure and test the application during the installation phase.** - - Completing the installation of an application often requires performing several manual steps that are not part of the application installation process. These steps can involve configuring a connection to a database or copying updated files. You should perform these configurations during the installation phase and then run the application to make sure it works. - -- **Run the application, multiple times if necessary, until the program is stable.** - - You should run the application multiple times during the installation to ensure all associated registration and dialog box configurations have been completed. Opening the application multiple times during installation will ensure that only the relevant application features are loaded into the **primary feature block**. - -- **Disable all automatic update features associated with the application.** - - Some applications have the ability to check for the latest updates automatically during installation. To assist with versioning of virtual application packages, you should disable this feature during sequencing. If there are required updates, you should sequence a new virtual application package with the associated updates installed. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/change-history-tab-keep.md b/mdop/appv-v4/change-history-tab-keep.md deleted file mode 100644 index 7de068d479..0000000000 --- a/mdop/appv-v4/change-history-tab-keep.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: Change History Tab -description: Change History Tab -author: dansimp -ms.assetid: 652ef2f0-3a3e-4844-a472-9fa99ec5ee32 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Change History Tab - - -After you sequence an application and before you save it, you can use the **Change History** tab to view the historical information about a sequenced application package. This tab is read only and cannot be modified. It contains the following elements. - -## Modification Date - - -**Modification Date** -The date a sequenced application package was modified. - -## Package Information - - -**Package Version GUID** -The GUID for the version of the sequenced application package that is loaded, which can be used during deployment to specify a particular version of the package. - -## Sequencer Information - - -This section of the **Change History** tab displays specific information about the Application Virtualization Sequencer (the Sequencer) that was used to create the sequenced application package. It contains the following elements. - -**Sequencer Version** -The version of the Sequencer used to create the package. - -**Sequenced By** -The name of the sequencing engineer. - -**Sequencing Station** -The sequencing computer used to create the sequenced application package. - -**Package Upgrade** -Indicates whether the sequenced application package was upgraded and saved. - -**Save Mode** -Indicates the method used to save the application package. - -## Windows Information - - -**Windows Version** -The version of Windows used to create a sequenced application package. - -**System Folder** -The path on the Sequencing computer of its System folder. - -**Windows Folder** -The location on the sequencing computer of its Windows folder. - -**User Folder** -The location on the sequencing computer of its User folder. - -**System Type** -The type of operating system on the sequencing computer. - -## System Information - - -**Processor** -The processor of the sequencing computer system. - -**Last Boot Normal** -Indicates whether or not the sequencing computer's most recent boot-up was normal. - -**Terminal Services** -Indicates whether Terminal Services are operant on the sequencing computer system. - -**Remote Desktop** -Indicates whether Remote Desktop is operant on the sequencing computer. - -**.NET Framework Version** -Indicates the availability of any version of the .NET Framework on the sequencing computer. - -**Internet Explorer Version** -Indicates the availability of any version of Internet Explorer on the sequencing computer. - -**Windows Media Player Version** -Indicates the availability of any version of Windows Media Player on the sequencing computer. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/clear-app.md b/mdop/appv-v4/clear-app.md deleted file mode 100644 index ce8c9d4c5f..0000000000 --- a/mdop/appv-v4/clear-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: CLEAR APP -description: CLEAR APP -author: dansimp -ms.assetid: c2e63031-5941-45e4-9863-127231cfa25b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CLEAR APP - - -Clears the current user's settings and publishing configurations for an application. - -`SFTMIME CLEAR APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/clear-obj.md b/mdop/appv-v4/clear-obj.md deleted file mode 100644 index 33dfd04705..0000000000 --- a/mdop/appv-v4/clear-obj.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: CLEAR OBJ -description: CLEAR OBJ -author: dansimp -ms.assetid: 1e50b33f-6324-4eae-8573-75c153f786cd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CLEAR OBJ - - -Clears the settings and publishing configurations for all of your applications. - -`SFTMIME CLEAR OBJ:APP [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-about-dialog-boxes.md b/mdop/appv-v4/client-management-console-about-dialog-boxes.md deleted file mode 100644 index 67b7ff9eaa..0000000000 --- a/mdop/appv-v4/client-management-console-about-dialog-boxes.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Client Management Console About Dialog Boxes -description: Client Management Console About Dialog Boxes -author: dansimp -ms.assetid: eaf4a05e-513d-4eac-a549-76e63a70893d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: About Dialog Boxes - - -The **About** dialog boxes display information about the specific version of the Microsoft Management Console or the specific version of the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) Management Console. - -To display these dialog boxes, click **Help** and select **About Microsoft Management Console** or **About Application Virtualization Client Management Console**. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-application-virtualization-node.md b/mdop/appv-v4/client-management-console-application-virtualization-node.md deleted file mode 100644 index 9ea64120a9..0000000000 --- a/mdop/appv-v4/client-management-console-application-virtualization-node.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Client Management Console Application Virtualization Node -description: Client Management Console Application Virtualization Node -author: dansimp -ms.assetid: cf74e112-ddff-4e30-a3cc-7f4c643366c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Application Virtualization Node - - -The **Application Virtualization** node is the top-level node in the **Scope** pane of the Application Virtualization Client Management Console. This node displays the name of the computer the console is currently controlling, or it displays "Local" if the console is connected to the local computer. - -By right-clicking the **Application Virtualization** node, you can display the **Properties** dialog box to configure the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services). - -The **Properties** dialog box contains the following elements: - -[Application Virtualization Properties: General Tab](application-virtualization-properties-general-tab.md) - -[Application Virtualization Properties: Interface Tab](application-virtualization-properties-interface-tab.md) - -[Application Virtualization Properties: File System Tab](application-virtualization-properties-file-system-tab.md) - -[Application Virtualization Properties: Permissions Tab](application-virtualization-properties-permissions-tab.md) - -[Application Virtualization Properties: Connectivity Tab](application-virtualization-properties-connectivity-tab.md) - -[Application Virtualization Properties: Import Search Path Tab](application-virtualization-properties-import-search-path-tab.md) - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-application-virtualization-properties.md b/mdop/appv-v4/client-management-console-application-virtualization-properties.md deleted file mode 100644 index 85513a0959..0000000000 --- a/mdop/appv-v4/client-management-console-application-virtualization-properties.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Client Management Console Application Virtualization Properties -description: Client Management Console Application Virtualization Properties -author: dansimp -ms.assetid: 70319e4c-5032-4cb3-bbb8-4292809dcea2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Application Virtualization Properties - - -You can display the **Properties** dialog simply by right-clicking the **Application Virtualization** node in the Application Virtualization Client Management Console and selecting **Properties** from the pop-up menu. - -## In This Section - - -[Application Virtualization Properties: General Tab](application-virtualization-properties-general-tab.md) -Use the **General** tab of the **Properties** dialog box to modify log settings and data locations. - -[Application Virtualization Properties: Interface Tab](application-virtualization-properties-interface-tab.md) -Use the **Interface** tab of the **Properties** dialog box to control default settings for user-interface components. - -[Application Virtualization Properties: File System Tab](application-virtualization-properties-file-system-tab.md) -Use the **File System** tab of the **Properties** dialog box to view and monitor file system settings. - -[Application Virtualization Properties: Import Search Path Tab](application-virtualization-properties-import-search-path-tab.md) -Use the **Import Search Path** tab of the **Properties** dialog box to add, view, or change import search paths. - -[Application Virtualization Properties: Connectivity Tab](application-virtualization-properties-connectivity-tab.md) -Use the **Connectivity** tab of the **Properties** dialog box to specify the connectivity settings. - -[Application Virtualization Properties: Permissions Tab](application-virtualization-properties-permissions-tab.md) -Use the **Permissions** tab of the **Properties** dialog box to specify which activities are available for non-administrators on the local computer. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-applications-node.md b/mdop/appv-v4/client-management-console-applications-node.md deleted file mode 100644 index 6661141ad2..0000000000 --- a/mdop/appv-v4/client-management-console-applications-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Client Management Console Applications Node -description: Client Management Console Applications Node -author: dansimp -ms.assetid: 20cf533c-e0b0-4b81-af4b-b5b519594d1e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Applications Node - - -The topics in this section provide information about the screen reference for the **Applications** node in the Application Virtualization Client Management Console. - -## In This Section - - -[Applications Node](applications-node.md) -Describes the features and commands available from the **Applications** node. - -[Applications Results Pane](applications-results-pane.md) -Describes the features and commands available from the **Applications** node **Results** pane. - -[Applications Results Pane Columns](applications-results-pane-columns.md) -Describes the columns available in the **Applications** node **Results** pane. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-file-type-associations-node.md b/mdop/appv-v4/client-management-console-file-type-associations-node.md deleted file mode 100644 index f0c5570f3c..0000000000 --- a/mdop/appv-v4/client-management-console-file-type-associations-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Client Management Console File Type Associations Node -description: Client Management Console File Type Associations Node -author: dansimp -ms.assetid: f0bc05ce-2cb2-4b06-961b-6c42d0274d28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: File Type Associations Node - - -The topics in this section provide information about the screen reference for the **File Associations** node in the Application Virtualization Client Management Console. - -## In This Section - - -[File Type Associations Node](file-type-associations-node-client.md) -Describes the features and commands available from the **File Associations** node. - -[File Type Association Results Pane](file-type-association-results-pane.md) -Describes the features and commands available from the **File Associations** node **Results** pane. - -[File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) -Describes the columns available in the **File Associations** node **Results** pane. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-publishing-servers-node.md b/mdop/appv-v4/client-management-console-publishing-servers-node.md deleted file mode 100644 index f863e5d717..0000000000 --- a/mdop/appv-v4/client-management-console-publishing-servers-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Client Management Console Publishing Servers Node -description: Client Management Console Publishing Servers Node -author: dansimp -ms.assetid: 03f2038f-b5f7-4e5b-a8f0-98f5e9d5f644 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Publishing Servers Node - - -The topics in this section provide information about the screen reference for the **Publishing Servers** node in the Application Virtualization Client Management Console. - -## In This Section - - -[Publishing Servers Node](publishing-servers-node.md) -Describes the features and commands available from the **Publishing Servers** node. - -[Publishing Servers Results Pane](publishing-servers-results-pane.md) -Describes the features and commands available from the **Publishing Servers** node **Results** pane. - -[Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) -Describes the columns available in the **Publishing Servers** node **Results** pane. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/command-line-errors.md b/mdop/appv-v4/command-line-errors.md deleted file mode 100644 index 3da8e0d9f9..0000000000 --- a/mdop/appv-v4/command-line-errors.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Command-Line Errors -description: Command-Line Errors -author: dansimp -ms.assetid: eea62568-4e90-4877-9cc7-e27ef5c05068 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Command-Line Errors - - -Use the following list of errors to identify the reasons why command-line sequencing is not working properly. You can also see these errors by viewing the sequencer log file. - -**Note**   -More than one error might be displayed when sequencing. Furthermore, the error code displayed might be the sum of two error codes. For example, if the */InstallPath* and */OutputFile* parameters are missing, the Microsoft System Center Application Virtualization Sequencer will return 96—the sum of the two error codes. - - - -01 -There is an unspecified error. - -02 -The specified installation directory (/INSTALLPACKAGE) specified is not valid. - -04 -The specified package root directory (/INSTALLPATH) is not valid. - -08 -The */OutputFile* parameter that was specified is not valid. - -16 -The installation directory (/INSTALLPACKAGE) was not specified. - -32 -The package root directory (/INSTALLPATH) was not specified. - -64 -The */OutputFile* parameter was not specified. - -128 -The specified application virtualization drive is not valid. - -256 -The installer failed. - -512 -Sequencing the application failed. - -1024 -Evaluating installed shortcuts failed. - -2048 -The sequenced application package cannot be saved. - -4096 -The specified package name (/PACKAGENAME) is not valid. - -8192 -The specified block size (/BLOCKSIZE) is not valid. - -16384 -The specified compression type (/COMPRESSION) is not valid. - -32768 -The specified project path is not valid. - -65536 -The specified upgrade parameter is not valid. - -131072 -The specified upgrade project parameter is not valid. - -262144 -The specified decode path parameter is not valid. - -525288 -The package name was not specified. - -## Related topics - - -[About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) - -[Command-Line Parameters](command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/command-line-parameters.md b/mdop/appv-v4/command-line-parameters.md deleted file mode 100644 index 2c67aced2f..0000000000 --- a/mdop/appv-v4/command-line-parameters.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Command-Line Parameters -description: Command-Line Parameters -author: dansimp -ms.assetid: d90a0591-f1ce-4cb8-b244-85cc70461922 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Command-Line Parameters - - -Use the following Application Virtualization Sequencer parameters to sequence an application and to upgrade a sequenced application package at the command prompt. In the Microsoft Application Virtualization Sequencer directory, you would enter **SFTSequencer**, followed by the appropriate parameter. - -*/HELP* or */?* -Use to display the list of parameters available for command-line sequencing. - -*/INSTALLPACKAGE* or */I* -Use to specify the installer or a batch file for the application to be sequenced. - -*/INSTALLPATH* or */P* -Use to specify the package root directory. - -*/OUTPUTFILE* or */O* -Use to specify the path and file name of the SPRJ file that will be generated. - -**Important**   -The */OUTPUTFILE* parameter is not available when opening a package that you do not intend to upgrade. - - - -*/FULLLOAD* or */F* -Use to specify whether to put everything in the primary feature block. - -*/PACKAGENAME* or */K* -Use to specify the package name of the sequenced application. - -*/BLOCKSIZE* -Specifies the SFT file block size that will be used to stream the package to client computers. You can select one of the following values: - -- 4 KB - -- 16 KB - -- 32 KB - -- 64 KB - -You should consider the size of the SFT file when you specify the block size. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes use more network bandwidth. - -*/COMPRESSION* -Use to specify the method for compressing the SFT file as it is streamed to the client. - -*/MSI* or */M* -Use to specify generating a Microsoft Windows Installer package for the sequenced application. - -*/DEFAULT* -Specifies the default SPRJ file that will be used when creating a virtual application package. This file is used as the .sprj template when the application is sequenced for the first time. - -*/UPGRADE* -Specifies the path and file name of the SPRJ file that will be upgraded. - -*/DECODEPATH* -Specifies the directory on the sequencing computer where the files associated with the sequenced application package are installed. Use one of the following formats when specifying the directory: - -- /decodepath:Q: - -- /decodepath:Q:. - -- /decodepath:”Q:.” - -- /decodepath:”Q:” - -## Related topics - - -[About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) - -[How to Open a Sequenced Application Using the Command Line](how-to-open-a-sequenced-application-using-the-command-line.md) - -[How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) - - - - - - - - - diff --git a/mdop/appv-v4/completion-page-package-accelerator.md b/mdop/appv-v4/completion-page-package-accelerator.md deleted file mode 100644 index 7542c71906..0000000000 --- a/mdop/appv-v4/completion-page-package-accelerator.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Completion Page -description: Completion Page -author: dansimp -ms.assetid: b2c7776c-2c35-4d25-92b4-6cd8c2bdff42 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Completion Page - - -Use the **Completion** page to review the package completion report. Any issues experienced during sequencing are displayed in the **Successful Virtual Application Package Report** pane. This information is also available in the directory where the package is saved in a file named Report.xml. - -This page contains the following elements: - -**Close** -Closes the **Create New Package Wizard**. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/completion-page.md b/mdop/appv-v4/completion-page.md deleted file mode 100644 index c733a56d5d..0000000000 --- a/mdop/appv-v4/completion-page.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Completion Page -description: Completion Page -author: dansimp -ms.assetid: b284d362-b9e1-4d04-88cd-fe9980652188 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Completion Page - - -Always save App-V Package Accelerators and any associated installation media in a secure location on the network to protect App-V Package Accelerators and the installation files from being tampered with or becoming corrupted. Transforms can also contain password and user-specific information so that you must save App-V Package Accelerators in a secure location. You must also digitally sign the Package Accelerator after you create it so the publisher can be verified when the Package Accelerator is applied. A digital signature is an electronic security mark that can help indicate the publisher of the software and whether the package has been tampered with, after the transform was originally signed. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-app.md b/mdop/appv-v4/configure-app.md deleted file mode 100644 index 407824e6a0..0000000000 --- a/mdop/appv-v4/configure-app.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: CONFIGURE APP -description: CONFIGURE APP -author: dansimp -ms.assetid: fcfb4f86-8b7c-4208-bca3-955fd067079f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE APP - - -Enables the user to change the icon associated with an application but does not update the icon on existing shortcuts or file type associations. - -`SFTMIME CONFIGURE APP:application /ICON icon-pathname [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application.

          /ICON <icon-pathname>

          The path or URL for the icon file.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-package.md b/mdop/appv-v4/configure-package.md deleted file mode 100644 index 2bccdbf61d..0000000000 --- a/mdop/appv-v4/configure-package.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: CONFIGURE PACKAGE -description: CONFIGURE PACKAGE -author: dansimp -ms.assetid: acc7eaa8-6ada-47b9-a655-2ca2537605b9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE PACKAGE - - -Enables the user to change a package manifest file, package source, load trigger types, or load target for a package. - -`SFTMIME CONFIGURE PACKAGE:package-name [/MANIFEST manifest-path] [/OVERRIDEURL url] [/AUTOLOADNEVER] [/AUTOLOADONREFRESH] [/AUTOLOADONLOGIN] [/AUTOLOADONLAUNCH] [/AUTOLOADTARGET {NONE|ALL|PREVUSED}] [/LOG log-pathname | /CONSOLE | /GUI] [/NO-UPDATE-FTA-SHORTCUT {TRUE|FALSE} {/GLOBAL}]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          PACKAGE:<package-name>

          User-visible and user-friendly name for the package.

          /MANIFEST <manifest-path>

          The path or URL of the manifest file that lists the applications included in the package and all of their publishing information.

          /OVERRIDEURL <URL>

          The location of the package's SFT file.

          /AUTOLOADNEVER

          Background loading is turned off for the package.

          /AUTOLOADONREFRESH

          Background loading is performed after a publishing refresh.

          /AUTOLOADONLOGIN

          Background loading is performed when a user logs in.

          /AUTOLOADONLAUNCH

          Background loading is performed after a user starts an application from the package.

          /AUTOLOADTARGET <target>

          Indicates which applications from the package will be autoloaded.

          NONE

          No autoloading will be performed despite the presence of any /AUTOLOADONxxx flags.

          ALL

          If an autoload trigger is enabled, all applications in the package will be loaded into cache regardless of whether they have ever been launched.

          PREVUSED

          If an autoload trigger is enabled, the package will load if any applications in this package have previously been started by a user.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -For version 4.6 SP2, the following option has been added. - - ---- - - - - - - - - - - -

          [/NO-UPDATE-FTA-SHORTCUT {TRUE|FALSE} {/GLOBAL}]

          If set to TRUE, a registry value is created for the package, either per user, or globally if the /GLOBAL flag is specified.

          -

          If set to FALSE, the registry value is removed and the file type associations (FTA) for the package are reinstalled.

          -

          If not specified, normal FTA and shortcut publishing behavior occurs. If you perform any subsequent publishing refresh operations on the App-V 4.6 SP2 client, the shortcuts and FTAs for packages that have this registry value set will not be changed, and the shortcuts and FTAs will not be registered at system startup or user login unless you reset the flag.

          /GLOBAL

          Works in conjunction with the /NO-UPDATE-FTA-SHORTCUT flag. If the /GLOBAL flag is present, it indicates that a registry value will be created for that package for all users. By default, the registry value is created only for this user.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-server.md b/mdop/appv-v4/configure-server.md deleted file mode 100644 index ed7f5ca4d8..0000000000 --- a/mdop/appv-v4/configure-server.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: CONFIGURE SERVER -description: CONFIGURE SERVER -author: dansimp -ms.assetid: c916eddd-74f2-46e4-953d-120b23284e37 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE SERVER - - -Enables a user to change the setup of a server; any settings not specified will not be modified. - -`SFTMIME CONFIGURE SERVER:server-name [/NAME display-name] [/HOST hostname] [/PORT port] [/PATH path] [/TYPE {HTTP|RTSP}] [/REFRESH {ON|OFF}] [/SECURE] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          SERVER:<server-name>

          The display name for the publishing server.

          /NAME <display-name>

          New display name for the server.

          /HOST <hostname>

          The host name or IP address for the publishing server.

          /PORT <port>

          The port on which the publishing server listens. Defaults to 80 for normal HTTP servers, 443 for HTTP servers using enhanced security, 554 for normal Application Virtualization Servers, and 322 for servers using enhanced security.

          /PATH <path>

          The path portion of the URL used in a publishing request. If the TYPE parameter is set to RTSP, the path is optional and defaults to "/".

          /TYPE

          Indicates whether the publishing server is a Web server ("HTTP") or an Application Virtualization Server ("RTSP").

          /REFRESH

          If set to ON, publishing information will be refreshed when the user logs in. Defaults to ON.

          /SECURE

          If present, indicates that a connection with enhanced security should be established to the publishing server.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-software-page--learn-more-.md b/mdop/appv-v4/configure-software-page--learn-more-.md deleted file mode 100644 index 87abcb67dd..0000000000 --- a/mdop/appv-v4/configure-software-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configure Software Page (Learn More) -description: Configure Software Page (Learn More) -author: dansimp -ms.assetid: 9a0cd4a5-88da-4897-a13a-5d21fc04afda -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Software Page (Learn More) - - -Use the **Configure Software** page to run each program to complete any configuration tasks after the installation. For example, this step helps configure any associated application license agreements. - -This page contains the following elements: - -**Run Selected** -Opens only the selected programs associated with the application. - -**Run All** -Opens all programs associated with the application. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md b/mdop/appv-v4/configure-software-page-app-v-46-sp1.md deleted file mode 100644 index 7d201afb8d..0000000000 --- a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configure Software Page -description: Configure Software Page -author: dansimp -ms.assetid: 50596eba-ce20-4d36-8e57-bd4b6c6cf92e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Software Page - - -Use the **Configure Software** page to manage the application first-use tasks. - -This page contains the following elements: - -**Configure Software** -Click **Configure Software** to manually configure application first-use tasks. Selecting this option can increase the overall sequencing time depending on the size of the package you are creating. - -**Skip this step** -Click **Skip this step** to skip configuring the application. If you choose to skip this step, end users have to perform any required first-use tasks such as accepting any license agreements and first-use questions. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-type.md b/mdop/appv-v4/configure-type.md deleted file mode 100644 index 42307e58cb..0000000000 --- a/mdop/appv-v4/configure-type.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: CONFIGURE TYPE -description: CONFIGURE TYPE -author: dansimp -ms.assetid: 2caf9433-5449-486f-ab94-83ee8e44d7f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE TYPE - - -Enables the user to change settings for a file type association. - -`SFTMIME CONFIGURE TYPE:file-extension [/GLOBAL] [/APP application] [/ICON icon-pathname] [/DESCRIPTION type-desc] [/CONTENT-TYPE content-type] [/PERCEIVED-TYPE perceived-type] [/PROGID progid] [/CONFIRMOPEN {YES|NO}] [/SHOWEXT {YES|NO}] [/NEWMENU {YES|NO}] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          TYPE:<file-extension>

          The file name extension to be configured.

          /APP <application>

          The name and version (optional) of the application to associate this file type with. Cannot be specified with PROGID.

          /ICON <icon-pathname>

          The path or URL for the icon file.

          /DESCRIPTION <type-desc>

          The user-friendly name for the file type.

          /CONTENT-TYPE <content-type>

          The content type of the file.

          /GLOBAL

          If present, indicates that the association that applies to all users should be edited, not the user-specific one.

          /PERCEIVED-TYPE <perceived-type>

          The perceived type of the file.

          /PROGID <progid>

          Indicates that the extension should be associated with a different file type. The previous file type is not deleted. Cannot be specified with APP, ICON, DESCRIPTION, CONFIRMOPEN, or SHOWEXT.

          /CONFIRMOPEN

          Indicates whether users downloading a file of this type should be asked whether to open or save the file.

          /SHOWEXT

          Indicates whether the file's extension should always be shown, even if the user has requested that all extensions be hidden.

          /NEWMENU

          Indicates whether an entry should be added to the shell's New menu.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md b/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md deleted file mode 100644 index 1fe3f100c5..0000000000 --- a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Configuring App-V Administration for a Distributed Environment -description: Configuring App-V Administration for a Distributed Environment -author: dansimp -ms.assetid: 53971fa9-8319-435c-be74-c37feb9af1da -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring App-V Administration for a Distributed Environment - - -When designing the infrastructure for your specific organization, you can install the App-V Management Web Service on a computer other than the computer where you install the App-V Management Server. Common reasons for separating these App-V components include the following: - -- Performance - -- Reliability - -- Availability - -- Scalability - -Separating the Management Server and Management Web Service requires additional configuration for the infrastructure to operate correctly. When you separate these two features but do not complete the procedures described in this topic, the Management Console will connect to the Management Web Service but will not be able to properly authenticate with the data store. The Management Console will not load properly, and the administrator will not be able to complete any administrative tasks. - -This behavior occurs because the Management Web Service cannot use the credentials, passed to it from the Management Console, to access the data store. The solution is to configure the Management Web Service server to be “Trusted for delegation.” - -## Configuring Active Directory Domain Services - - -It is also necessary to configure Active Directory Domain Services properly to work in a distributed environment. This section includes the information you need configure Active Directory Domain Services. - -### When SQL Service Uses Local System account - -To set up the environment where the SQL Service uses the local system account, change the properties of the machine account of the Management Web Service to be trusted for delegation. For detailed procedures about how to do this, see [How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md) - -### When SQL Service Uses Domain-Based Account - -To set up the environment where SQL Servers use domain-based service accounts, you need to consider whether or not a variety of factors apply, including the following: - -- Clustering of SQL Server - -- Replication - -- Automated tasks - -- Linked servers - -For information about configuring Active Directory Domain Services when the SQL service uses a domain-based account, see . - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-app-v-for-secure-administration.md b/mdop/appv-v4/configuring-app-v-for-secure-administration.md deleted file mode 100644 index a71fffa3c7..0000000000 --- a/mdop/appv-v4/configuring-app-v-for-secure-administration.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configuring App-V for Secure Administration -description: Configuring App-V for Secure Administration -author: dansimp -ms.assetid: 4543fa81-c8cc-4b10-83b7-060778eb1349 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring App-V for Secure Administration - - -In an environment where securing administrative operations is important, App-V allows for secure communication between the App-V Web Management Service and the App-V Management Console. Because the Management Service is a Web-based application, it requires securing the App-V Management Server application on the Web server that hosts the Management Service. As shown in the following illustration, this process includes using HTTPS for communication and configuring the IIS server to allow only Windows Integrated Authentication. - -![app-v web service network configuration](images/appvmgmtwebservice.gif) - -The App-V Web Management Service is installed as a Web-based application on IIS. For the Web Management Service to support secure (SSL) connections between the App-V Management Console and the Web Management Service, you will need to configure the IIS server where the Web Management Service is installed and configure the App-V Management Console. - -## In This Section - - -[Configuring Certificates to Support the App-V Web Management Service](configuring-certificates-to-support-the-app-v-web-management-service.md) -Provides helpful information about configuring certificates to support SSL-based connections, to help secure communication for the App-V Web Management Service. - -[How to Install and Configure the App-V Management Console for a More Secure Environment](how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md) -Provides a step-by-step procedure for connecting to an App-V Web Management Service by using a secure connection. - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md b/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md deleted file mode 100644 index fe8ec7d8bc..0000000000 --- a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Configuring Certificates to Support App-V Management Server or Streaming Server -description: Configuring Certificates to Support App-V Management Server or Streaming Server -author: dansimp -ms.assetid: 2f24e550-585e-4b7e-b486-22a3f181f543 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring Certificates to Support App-V Management Server or Streaming Server - - -After you complete the certificate provisioning process and change the private key permissions to support the App-V installation, you can launch the setup of the Management Server or the Streaming Server. During setup, if a certificate is provisioned before running the setup program, the wizard displays the certificate in the **Connection Security Mode** screen and, by default, the **Use enhanced security** check box is selected. - -**Note**   -Select the certificate that was configured for App-V if there is more than one certificate provisioned for this server. - - - -**Important**   -When upgrading from version  4.2 to version  4.5, the setup has an option for **Use enhanced security**; however, selecting this option will not disable streaming over RTSP. You must use the Management Console to disable RTSP after installation. - - - -Select the TCP port that the service will use for client communications. The default port is TCP 322; however, you can change the port to a custom port for your environment. - -The remaining steps of the wizard are the same as if you were deploying an App-V Management or Streaming Server without using the **Enhanced security** feature. - -## Configuring Certificates for NLB Environments - - -To support large enterprises, often the Management Server is placed into a Network Load Balancing (NLB) cluster to support the large number of connections. This requires at least two Management Servers that appear to be a single Management Server. When your environment uses an NLB cluster with several Management Servers, you need an advanced configuration of the certificate used for the NLB cluster. - -The App-V certificate is submitted to a certification authority (CA) that is configured on a computer running Windows Server 2003. The SAN lets you connect to a specific Management Server NLB cluster host name by using a Domain Name System (DNS) name that might differ from the actual computer names, because there can be up to 32 servers that comprise the NLB cluster. - -This configuration is necessary only when using an NLB cluster. When the client connects to the server, it will connect using the fully qualified domain name (FQDN) of the NLB cluster and not the FQDN of an individual server. If you do not add the SAN property with the FQDN of the server nodes in the cluster, all client connections are refused because the common name of the certificate won’t match the server name. - -For more detailed information about configuring certificates with the SAN attribute, see . - -## Related topics - - -[Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) - -[How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md b/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md deleted file mode 100644 index 86f2485e5c..0000000000 --- a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Configuring Certificates to Support Secure Streaming -description: Configuring Certificates to Support Secure Streaming -author: dansimp -ms.assetid: 88dc76d8-7745-4729-92a1-af089c921244 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring Certificates to Support Secure Streaming - - -By default, the App-V service runs under the Network Service account. However, you can create a service account in Active Directory Domain Services and replace the Network Service account with the Active Directory Domain account. - -The security context under which the service runs is important for configuring enhanced secure communications. This security context must have read permissions for the certificate private key. When a PKCS\#10 *Certificate Signing Request* (CSR) is generated for the App-V server, the Windows *Cryptographic Service Provider* is called and a private key is generated. The private key is secured with permissions given to the System and Administrator accounts only. - -You must modify the access control lists (ACLs) on the private key to let the App-V Management or Streaming Server access the private key required for successful TLS secured communication. - -## Obtaining and Installing a Certificate - - -The scenarios for obtaining and installing a certificate for App-V are as follows: - -- Internal public key infrastructure (PKI). - -- Third-party certificate issuing certification authority (CA). - - **Note**   - If you need to obtain a certificate from a third-party CA, follow the documentation available on that CA’s Web site. - - - -If a PKI infrastructure has been deployed, consult with the PKI administrators to acquire a certificate that complies with the requirements described in this topic. If a PKI infrastructure is not available, use a third-party CA to obtain a valid certificate. - -For step-by-step guidance for obtaining and installing a certificate, see . - -## Related topics - - -Configuring Certificates to Support Secure Streaming -[How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md b/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md deleted file mode 100644 index 7999d55e32..0000000000 --- a/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configuring Certificates to Support the App-V Web Management Service -description: Configuring Certificates to Support the App-V Web Management Service -author: dansimp -ms.assetid: b7960161-2c19-4cbf-a98a-d4b06f547dce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring Certificates to Support the App-V Web Management Service - - -The App-V Web Management Service must be configured to support SSL-based connections to help secure the communication. This process requires that the Web server or computer on which the Management Service is installed has a certificate issued to the service or computer. - -The following scenarios illustrate how to obtain a certificate for this purpose: - -1. The company infrastructure already has a public key infrastructure (PKI) in place that automatically issues certificates to computers. - -2. The company infrastructure already has a PKI in place, although it does not automatically issue certificates to computers. - -3. The company infrastructure has no PKI in place. - -In each of the preceding scenarios, the method for obtaining a certificate is different, but the end result is the same. The administrator must assign a certificate to the IIS Default Web Site and configure the App-V Web Management Service to require secure communications. - -**Important**   -The name of the certificate must match the name of the server. It is a best practice to use fully qualified domain names (FQDNs) for the common name of the certificate. - - - -App-V can use IIS servers to support different infrastructure configurations. For more information about configuring IIS servers to support HTTPS, see . - -## Related topics - - -[How to Install and Configure the App-V Management Console for a More Secure Environment](how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-iis-for-secure-streaming.md b/mdop/appv-v4/configuring-iis-for-secure-streaming.md deleted file mode 100644 index 1e5c0be5b8..0000000000 --- a/mdop/appv-v4/configuring-iis-for-secure-streaming.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Configuring IIS for Secure Streaming -description: Configuring IIS for Secure Streaming -author: dansimp -ms.assetid: 9a80a703-4642-4bec-b7af-dc7cb6b76925 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring IIS for Secure Streaming - - -With the release of Microsoft Application Virtualization (App-V) version 4.5, you can use HTTP and HTTPS as protocols for streaming application packages to the App-V clients. This option enables organizations to leverage the additional scalability that IIS typically offers. When you use IIS as a streaming server, you can help secure the communications between the client and server by using HTTPS instead of HTTP. - -**Note**   -If you want to stream applications from a file server, you should enhance the security of the communications to the application packages. This can be achieved using IPsec. For more information see the following topics in the TechNet Library: - -- For Windows Server 2003, - -- For Windows Server 2008, - - - -## MIME Types - - -When you use IIS to stream virtual applications with HTTP or HTTPS, to support App-V, the following MIME types must be added to the IIS server: - -- .OSD=TXT - -- .SFT=Binary - -Use the following KB articles as guidance for adding MIME types: - -IIS 6.0: - -IIS 7.0: - -## Kerberos Authentication - - -When you use HTTP or HTTPS and Kerberos authentication to stream ICO, OSD, or SFT files, you are enhancing the security of your environment. However, for IIS to support Kerberos authentication, you must configure a proper Service Principal Name (SPN). The `setspn.exe` tool is available for Windows Server 2003 from the Support Tools on the installation CD and is built-in to Windows Server 2008. - -To create an SPN, run `setspn.exe` from a command prompt while logged in as a member of Domain Administrators—for example, `setspn.exe –A HTTP/FQDN of Server ServerName`. - -## Related topics - - -[Configuring Management or Streaming Server for Secure Communications Post-Installation](configuring-management-or-streaming-server-for-secure-communications-post-installation.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md b/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md deleted file mode 100644 index 022b096208..0000000000 --- a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Configuring Management or Streaming Server for Secure Communications Post-Installation -description: Configuring Management or Streaming Server for Secure Communications Post-Installation -author: dansimp -ms.assetid: 1062a213-470b-4ae2-b12f-b3e28a6ab745 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Management or Streaming Server for Secure Communications Post-Installation - - -If the proper certificate was not provisioned before the installation of the App-V Management Server or the App-V Streaming Server, App-V can be configured for enhanced security after the initial installation. You can configure the App-V Management Server through the App-V Management Console. However, the App-V Streaming Server is managed through the registry. In either case, the certificate must include the proper *extended key usage* (EKU) for Server authentication and the Network Service must have read access to the private key. - -## In This Section - - -[How to Configure Management Server Security Post-Installation](how-to-configure-management-server-security-post-installation.md) -Provides a procedure that can be performed post-installation, using the App-V Management Console, to add the certificate and configure the App-V Management Server for enhanced security. - -[How to Configure Streaming Server Security Post-Installation](how-to-configure-streaming-server-security-post-installation.md) -Provides a procedure that can be performed post-installation, to add the certificate and configure the App-V Streaming Server for enhanced security. - -[Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) -Provides troubleshooting guidance for when the private key has not been configured with the proper ACL for the Network Service. - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md b/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md deleted file mode 100644 index 92700f1f2a..0000000000 --- a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Configuring Prerequisite Groups in Active Directory for App-V -description: Configuring Prerequisite Groups in Active Directory for App-V -author: dansimp -ms.assetid: 0010d534-46c0-44a3-b5c1-621b4d5e2c31 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Prerequisite Groups in Active Directory for App-V - - -Before you install the Microsoft Application Virtualization (App-V) Management Server, you must create the following objects in Active Directory. App-V uses Active Directory groups to control access to applications and administrative functions. You will use these groups during the server installation process and when publishing applications. - -## Configuring Prerequisite Groups in Active Directory for Application Virtualization - - -This table lists the Active Directory groups that are required for installing App-V. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ObjectDescription

          Organizational Unit (OU)

          Create an OU in Active Directory for the specific groups required for App-V.

          App-V Administrative Group

          During installation of the App-V Management Server, you must select an Active Directory group to use as the App-V Administrators group to control administrative access to the Management Console. Create a security group for App-V administrators, and add to this group every user who needs to use the Management Console. You cannot create this group directly from the App-V Management Server installer.

          App-V Users Group

          App-V requires that every User account that accesses App-V functions be a member of a provider policy associated with a single group for general platform access. Use an existing group; for example, Domain Users, if all users are to have access to App-V, or create a new group.

          Application Groups

          App-V associates the right to use an individual application with an Active Directory group. Create an Active Directory group for each application, and assign users to these groups as needed to control user access to the applications.

          - -  - -## Related topics - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - -[How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md deleted file mode 100644 index f8ec256bdd..0000000000 --- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) -description: Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) -author: dansimp -ms.assetid: af775165-5b99-4c74-807f-f504377c7be4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) - - -Use any of the following links for more information about configuring the App-V Sequencer. - -## In This Section - - -[How to Install the Sequencer (App-V 4.6 SP1)](how-to-install-the-sequencer---app-v-46-sp1-.md) -Describes how to install the App-V Sequencer. - -[How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md) -Describes how to create a project template. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md deleted file mode 100644 index 571b263abc..0000000000 --- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configuring the Application Virtualization Sequencer -description: Configuring the Application Virtualization Sequencer -author: dansimp -ms.assetid: cae1c368-9fcd-454e-8fc9-0893345d55bf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the Application Virtualization Sequencer - - -To configure your environment for the Microsoft Application Virtualization (App-V) Sequencer, you need to perform certain tasks. - -Click any link in the following section for information about configuring your environment for running the Sequencer. - -## In This Section - - -[How to Install the Sequencer](how-to-install-the-sequencer.md) -Contains the steps for installing the App-V Sequencer. - -[How to Create the Package Root Directory](how-to-create-the-package-root-directory.md) -Contains the steps necessary to configure the directory where sequenced applications will be installed. - -[How to Modify the Location of the Log Directory](how-to-modify-the-location-of-the-log-directory.md) -Contains the steps necessary to configure where the Sequencer logs will be saved. - -[How to Modify the Location of the Scratch Directory](how-to-modify-the-location-of-the-scratch-directory.md) -Contains the steps necessary to configure the location where the Sequencer temporarily stores files during sequencing. - -## Related topics - - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md b/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md deleted file mode 100644 index 688c137ae2..0000000000 --- a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Configuring the Firewall for the App-V Servers -description: Configuring the Firewall for the App-V Servers -author: dansimp -ms.assetid: f779c450-6c6f-46a8-ac66-5e82e0689d55 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the Firewall for the App-V Servers - - -After you install the Microsoft Application Virtualization (App-V) Management Server or Streaming Server and configure it to use the RTSP or RTSPS protocol, you must create firewall exceptions for the App-V programs. - -## Configuring Firewall Exceptions for Application Virtualization Management Server - - -Create a firewall exception for **sghwdsptr.exe** and **sghwsvr.exe**. These programs are found in the folder C:\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Server\\bin on a 32-bit operating system. If you are using a 64-bit operating system version, the folder is located under C:\\Program Files (x86)\\Microsoft System Center App Virt Management Server\\App Virt Management Server\\bin. - -## Configuring Firewall Exceptions for Application Virtualization Streaming Server - - -Create a firewall exception for **sglwdsptr.exe** and **sglwsvr.exe**. These programs are found in the folder C:\\Program Files\\Microsoft System Center App Virt Streaming Server\\App Virt Streaming Server\\bin on a 32-bit operating system. If you are using a 64-bit operating system version, the folder is located under C:\\Program Files (x86)\\Microsoft System Center App Virt Streaming Server\\App Virt Streaming Server\\bin. - -## Related topics - - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md b/mdop/appv-v4/configuring-windows-firewall-for-app-v.md deleted file mode 100644 index f97d412295..0000000000 --- a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Configuring Windows Firewall for App-V -description: Configuring Windows Firewall for App-V -author: dansimp -ms.assetid: 6b5e253c-473f-4afc-a48b-631eda11d9ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Windows Firewall for App-V - - -Securing the communication between components in an App-V infrastructure is only one element in securing the environment. Using a firewall program on the server can help reduce the attack surface area. The topics in this section provide procedures for configuring Windows built-in firewall capabilities that support App-V. These procedures assume that you installed a Management Server and that it has been configured for RTSPS communication. Notes are included in the procedures for Streaming Servers and environments where RTSP is being used for communication. - -## In This Section - - -[How to Configure Windows Server 2003 Firewall for App-V](how-to-configure-windows-server-2003-firewall-for-app-v.md) -Provides a procedure you can use to configure the Windows Server 2003 firewall for App-V. - -[How to Configure Windows Server 2008 Firewall for App-V](how-to-configure-windows-server-2008-firewall-for-app-v.md) -Provides a procedure you can use to configure the Windows Server 2008 firewall for App-V. - -  - -  - - - - - diff --git a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md deleted file mode 100644 index 11cb5f957c..0000000000 --- a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Create New Package Wizard (AppV 4.6 SP1) -description: Create New Package Wizard (AppV 4.6 SP1) -author: dansimp -ms.assetid: 1f73d044-b364-4c95-8ae1-daedd316d87e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create New Package Wizard (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Create New Package wizard. - -## In This Section - - -[Packaging Method Page (Learn More)](packaging-method-page--learn-more-.md) - -[Prepare Computer Page (Learn More)](prepare-computer-page--learn-more-.md) - -[Type of Application Page (Learn More)](type-of-application-page--learn-more-.md) - -[Select Installer Page (Learn More)](select-installer-page--learn-more-.md) - -[Package Name Page (Learn More)](package-name-page---learn-more-.md) - -[Installation Page (Learn More)](installation-page--learn-more-.md) - -[Configure Software Page (Learn More)](configure-software-page--learn-more-.md) - -[Installation Files Page](installation-files-page.md) - -[Installation Report Page (Learn More)](installation-report-page--learn-more-.md) - -[Customize Page (Learn More)](customize-page--learn-more-.md) - -[Select Primary Page (Learn More)](select-primary-page--learn-more-.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-accelerator--review-errors--page.md b/mdop/appv-v4/create-package-accelerator--review-errors--page.md deleted file mode 100644 index 63cdf9f7e1..0000000000 --- a/mdop/appv-v4/create-package-accelerator--review-errors--page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Create Package Accelerator (Review Errors) Page -description: Create Package Accelerator (Review Errors) Page -author: dansimp -ms.assetid: ea3f531d-1887-4b42-a30f-b875d0ccb916 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Accelerator (Review Errors) Page - - -Use the **Completion** page to review the Package Accelerator completion report. Any issues experienced during sequencing are displayed. - -This page contains the following elements: - -**Close** -Closes the **Create Package Accelerator** wizard. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-accelerator-page.md b/mdop/appv-v4/create-package-accelerator-page.md deleted file mode 100644 index 2d86172bf5..0000000000 --- a/mdop/appv-v4/create-package-accelerator-page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Create Package Accelerator Page -description: Create Package Accelerator Page -author: dansimp -ms.assetid: 51cdc262-beda-4a4f-bb3e-66458062a7bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Accelerator Page - - -Use the **Create Package Accelerator** page to specify the location where to save the Package Accelerator. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the location where to save the Package Accelerator. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md b/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md deleted file mode 100644 index 65aba0176a..0000000000 --- a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Create Package Accelerator Wizard (AppV 4.6 SP1) -description: Create Package Accelerator Wizard (AppV 4.6 SP1) -author: dansimp -ms.assetid: 976d84e1-86d7-4a9b-a747-2b6eef790c1f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Accelerator Wizard (AppV 4.6 SP1) - - -Use any of the following links for more information about the use of page elements in the App-V Create Package Accelerator wizard. - -## In This Section - - -[About Sharing Package Accelerators Page](about-sharing-package-accelerators-page.md) - -[Select Package (Learn More) Page](select-package--learn-more--page.md) - -[Installation Files Page](installation-files-page.md) - -[Gathering Information Page (Learn More)](gathering-information-page--learn-more-.md) - -[Select Files Page](select-files-page.md) - -[Verify Applications Page (Package Accelerators)](verify-applications-page--package-accelerators-.md) - -[Select Guidance Page (Package Accelerators)](select-guidance-page--package-accelerators-.md) - -[Create Package Accelerator Page](create-package-accelerator-page.md) - -[Completion Page](completion-page.md) - -[Create Package Accelerator (Review Errors) Page](create-package-accelerator--review-errors--page.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-page--app-v-46-sp1.md b/mdop/appv-v4/create-package-page--app-v-46-sp1.md deleted file mode 100644 index cfd5f7b2fc..0000000000 --- a/mdop/appv-v4/create-package-page--app-v-46-sp1.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Create Package Page -description: Create Package Page -author: dansimp -ms.assetid: dd7a8709-74cc-459a-88ac-b63d8dcf2ddf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Page - - -Use the **Create Package** page to add optional comments and to specify where the package will be saved. You can also specify whether the package should be compressed. After you have configured the options on this page, click **Create** to create the new virtual application package. - -This page contains the following elements: - -**Comments** -Add optional comments that will be associated with the new virtual application package. The comments that you add help identify the purpose or version of the virtual application package. - -**Save Location** -Click **Browse** and specify to which location you want to save the package (.**sprj** file). - -**Compress Package** -Select the **Compress Package** check box to compress the package, which can help enhance package streaming to target computers. We recommend that you select this option for packages that are larger than 4 GB. The current uncompressed package size is also displayed. - -**Note**   -If the original package size is more than 4 GB and compressed, by default, the checkbox is checked and cannot be changed. If the original package is compressed and less than 4 GB, the check box is checked, but can be cleared. - - - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/customize-page--learn-more-.md b/mdop/appv-v4/customize-page--learn-more-.md deleted file mode 100644 index 0bed35f090..0000000000 --- a/mdop/appv-v4/customize-page--learn-more-.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Customize Page (Learn More) -description: Customize Page (Learn More) -author: dansimp -ms.assetid: 893df614-7058-4fcf-ba34-d0f16c856374 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Customize Page (Learn More) - - -Use the **Customize** page to finish creating the virtual application package or to configure the virtual application package further. - -This page contains the following elements: - -**Stop Now** -Creates a basic virtual application package. If you select this option, the package creation will finish, and the package will be available in the Sequencer console. - -**Customize** -Enables you to configure the virtual application package further. You can perform the following configuration items: - -- **Edit Shortcuts**. Add, remove, or change the shortcuts, and configure the file type associations associated with the virtual application package that will be created on target computers. - -- **Prepare virtual application package for streaming to improve the initial end user experience**. Optimize the virtual application package for streaming across the network. - -- **Restrict operating systems that can run this package**. Specify the operating systems that can run the virtual application package. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index a4d6ce5126..0000000000 --- a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Defender Running Dialog Box (App-V 4.6 SP1) -description: Defender Running Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 716ec7f9-ddad-45dd-a3c7-4a9d81cfcfd0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Defender Running Dialog Box (App-V 4.6 SP1) - - -Microsoft Windows Defender is running. You should stop Windows Defender before continuing with the installation. Windows Defender can interfere with creation of a package by accessing files that must be added to the virtual application package or by adding extraneous data to the virtual application package. - -Use the following procedure to stop Microsoft Windows Defender from running during sequencing. - -1. On the computer running the App-V Sequencer, click **Start**, right-click **Computer**, and then click **Manage**. - -2. In the **Computer Management** console, double click **Services and Applications**, and then double-click **Services** to expand **Services**. - -3. Locate it in the list. Right-click Windows Defender, click **Stop** to stop Microsoft Windows Defender, and then click **Ok**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 0fc1fd41be..0000000000 --- a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Defrag Running Dialog Box (App-V 4.6 SP1) -description: Defrag Running Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 0ceb0897-377e-4754-a7ab-3bc2b5af1452 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Defrag Running Dialog Box (App-V 4.6 SP1) - - -The Disk Defragmenter service is running. The Disk Defragmenter service uses system resources and can cause degradation in performance or increase the time it takes to create virtual application package. - -Use the following procedure to stop the Disk Defragmenter service from running during sequencing. - -1. On the computer running the App-V Sequencer, click **Start**, right-click **Computer**, and then click **Manage**. - -2. In the **Computer Management** console, double-click **Services and Applications**, and then double-click **Services** to expand **Services**,. - -3. Locate it in the list. Right-click **Disk Defragmenter**, click **More Actions**, click **Stop** to stop Disk Defragmenter, and then click **OK**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/delete-app.md b/mdop/appv-v4/delete-app.md deleted file mode 100644 index a5a5189fe4..0000000000 --- a/mdop/appv-v4/delete-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: DELETE APP -description: DELETE APP -author: dansimp -ms.assetid: 2f89c0c0-373b-4389-a26d-67b3f9712957 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE APP - - -Removes an application record from the file system cache to make it no longer visible. Users’ shortcuts and file type associations are hidden but not deleted. No user settings are removed. - -`SFTMIME DELETE APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application to be removed.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/delete-obj.md b/mdop/appv-v4/delete-obj.md deleted file mode 100644 index e0e1085ae9..0000000000 --- a/mdop/appv-v4/delete-obj.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: DELETE OBJ -description: DELETE OBJ -author: dansimp -ms.assetid: fb17a261-f378-4ce6-a538-ab2f0ada0f2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE OBJ - - -Removes all of your application records. - -`SFTMIME DELETE OBJ:APP [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          /GLOBAL

          If specified, all applications are removed. By default, only applications the current user has access to are removed.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/delete-package.md b/mdop/appv-v4/delete-package.md deleted file mode 100644 index f89b69d461..0000000000 --- a/mdop/appv-v4/delete-package.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: DELETE PACKAGE -description: DELETE PACKAGE -author: dansimp -ms.assetid: 8f7a4598-610d-490e-a224-426acce01a9f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE PACKAGE - - -Removes a package record and the applications associated with it. - -`SFTMIME DELETE PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          PACKAGE:<package-name>

          The name of the package to be removed.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -**Important**   -The DELETE PACKAGE command always performs a global delete of the package and deletes only global file types and shortcuts. - -If the package is global, this command must be run as local Administrator; otherwise, only **DeleteApp** permission is needed. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/delete-server.md b/mdop/appv-v4/delete-server.md deleted file mode 100644 index 7425b0751b..0000000000 --- a/mdop/appv-v4/delete-server.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: DELETE SERVER -description: DELETE SERVER -author: dansimp -ms.assetid: 4c929639-1c1d-47c3-9225-cc4d7a8736f0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE SERVER - - -Removes a publishing server. - -**Note**   -This command does not remove any applications or packages published to the client by the server. For each application, use the SFTMIME **CLEAR APP** command followed by the **DELETE PACKAGE** command to completely remove those applications and packages from the client. - - - -`SFTMIME DELETE SERVER:server-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          SERVER:<server-name>

          The display name of the publishing server.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/delete-type.md b/mdop/appv-v4/delete-type.md deleted file mode 100644 index 62cbd9b1c7..0000000000 --- a/mdop/appv-v4/delete-type.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: DELETE TYPE -description: DELETE TYPE -author: dansimp -ms.assetid: f2852723-c894-49f3-a3c5-56f9648bb9ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE TYPE - - -Removes the specified file type association. - -`SFTMIME DELETE TYPE:file-extension [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          TYPE:<file-extension>

          The file name extension to be removed.

          /GLOBAL

          If specified, indicates that the global association for the file name extension should be removed.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/deployment-tab.md b/mdop/appv-v4/deployment-tab.md deleted file mode 100644 index 0b872aa0ce..0000000000 --- a/mdop/appv-v4/deployment-tab.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Deployment Tab -description: Deployment Tab -author: dansimp -ms.assetid: 4510188b-eade-445d-a90f-b9127dd479a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deployment Tab - - -The **Deployment** tab in the Application Virtualization Sequencer Console enables you to specify parameters for the deployment of a sequenced application package. - -## In This Section - - -[About the Deployment Tab](about-the-deployment-tab.md) -Provides general information about the **Deployment** tab. - -[How to Change Deployment Properties](how-to-change-deployment-properties.md) -Provides procedures for changing package properties by using the **Deployment** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/determine-your-publishing-method.md b/mdop/appv-v4/determine-your-publishing-method.md deleted file mode 100644 index 683549aa16..0000000000 --- a/mdop/appv-v4/determine-your-publishing-method.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Determine Your Publishing Method -description: Determine Your Publishing Method -author: dansimp -ms.assetid: 1f2d0d39-5d65-457a-b826-4f45b00c8c85 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Determine Your Publishing Method - - -After you sequence an application by using the Application Virtualization Sequencer, you need to *publish* that application to your users. Publishing the application consists of delivering the icons, package definition information, and content source location to each computer where the Application Virtualization Client has been installed. The following table describes publishing methods that are supported when you deploy Application Virtualization by using an electronic software distribution (ESD) system. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          MethodAdvantagesDisadvantages

          Generate a Windows Installer file during sequencing, as a stand-alone solution.

            -
          • Very simple to use.

          • -
          • Package loaded into cache locally on each computer.

          • -
          • Icons displayed to user.

          • -
          • Similar to traditional software deployment.

          • -
          • No need for streaming servers.

          • -
            -
          • No flexibility in location of package contents on computers—same location on all computers.

          • -
          • Must use only Add/Remove Programs or msiexec to remove applications.

          • -
          • Removal and replacement with new version required for package updating.

          • -

          Generate a Windows Installer file during sequencing, used with MODE, LOAD, and OVERRIDEURL command-line properties and the package manifest.

            -
          • Simple to use but with added flexibility.

          • -
          • Icons displayed to user.

          • -
          • SFT file containing the applications can be placed on a streaming source location, with clients configured to use that location.

          • -
            -
          • Limited flexibility—only the location of the package content can be controlled at run time.

          • -
          • Must use only Add/Remove Programs or msiexec to remove the application.

          • -
          • Removal and replacement with new version required for package updating, unless using streaming server.

          • -

          Run SFTMIME commands.

            -
          • Complete flexibility—full control of all package management functions.

          • -
            -
          • Commands must be scripted for use with the ESD system.

          • -
          • Commands must be run on each computer in correct sequence.

          • -
          • Detailed understanding of command language and careful planning required.

          • -
          - -  - -For more information about using these publishing methods, see [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md). - -## Related topics - - -[Determine Your Streaming Method](determine-your-streaming-method.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/determine-your-streaming-method.md b/mdop/appv-v4/determine-your-streaming-method.md deleted file mode 100644 index eac83fa0c2..0000000000 --- a/mdop/appv-v4/determine-your-streaming-method.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: Determine Your Streaming Method -description: Determine Your Streaming Method -author: dansimp -ms.assetid: 50d5e0ec-7f48-4cea-8711-5882bd89153b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Determine Your Streaming Method - - -The first time that a user double-clicks the icon that has been placed on a computer through the publishing process, the Application Virtualization client will obtain the virtual application package content from a streaming source location. - -**Note**   -*Streaming* is the term used to describe the process of obtaining content from a sequenced application package, starting with the primary feature block and then obtaining additional blocks as needed. - - - -The streaming source location is usually a server that is accessible by the user’s computer; however, some electronic distribution systems, such as Microsoft System Center Configuration Manager, can distribute the SFT file to the user’s computer and then stream the virtual application package locally from that computer’s cache. - -**Note**   -A streaming source location for virtual packages can be set up on a computer that is not a server. This is especially useful in a small branch office that has no server. - - - -The streaming sources that can be used to store sequenced applications are described in the following table. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Server TypeProtocolAdvantagesDisadvantagesLinks

          File server

          File

            -
          • Simple low-cost solution to configure existing file server with \CONTENT share

          • -
            -
          • No active upgrade

          • -

          How to Configure the File Server

          IIS server

          HTTP/ HTTPS

            -
          • Supports enhanced security using HTTPS protocol.

          • -
          • Supports streaming to remote computers across the Internet

          • -
          • Only one port in firewall to open

          • -
          • Highly scalable

          • -
          • Familiar protocol

          • -
            -
          • Need to manage IIS

          • -
          • No active upgrade

          • -

          How to Configure the Server for IIS

          Application Virtualization Streaming Server

          RTSP/ RTSPS

            -
          • Active upgrade

          • -
          • Supports enhanced security using RTSPS protocol

          • -
          • Only one port in firewall to open (RTSPS only)

          • -
            -
          • Dual infrastructure

          • -
          • Server administration requirement

          • -

          How to Configure the Application Virtualization Management Servers

          - - - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) - -[Determine Your Publishing Method](determine-your-publishing-method.md) - - - - - - - - - diff --git a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md b/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md deleted file mode 100644 index a61b7c716f..0000000000 --- a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Dialog Boxes (AppV 4.6 SP1) -description: Dialog Boxes (AppV 4.6 SP1) -author: dansimp -ms.assetid: f76b95df-cba4-4a69-8cd8-a888edf437be -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Dialog Boxes (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Sequencer dialog boxes. - -## In This Section - - -[Incompatible Installer Dialog Box (App-V 4.6 SP1)](incompatible-installer-dialog-box--app-v-46-sp1-.md) - -[Failed Launch Dialog Box (App-V 4.6 SP1)](failed-launch-dialog-box--app-v-46-sp1-.md) - -[Oversized Package Dialog Box (App-V 4.6 SP1)](oversized-package-dialog-box--app-v-46-sp1-.md) - -[Restart Task Failure Dialog Box (App-V 4.6 SP1)](restart-task-failure-dialog-box--app-v-46-sp1-.md) - -[Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1)](side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md) - -[SXS Conflict Detected Dialog Box (App-V 4.6 SP1)](sxs-conflict-detected-dialog-box--app-v-46-sp1-.md) - -[Files Excluded Page Dialog Box (App-V 4.6 SP1)](files-excluded-page-dialog-box--app-v-46-sp1-.md) - -[Defender Running Dialog Box (App-V 4.6 SP1)](defender-running-dialog-box--app-v-46-sp1-.md) - -[Defrag Running Dialog Box (App-V 4.6 SP1)](defrag-running-dialog-box--app-v-46-sp1-.md) - -[Antivirus Running Dialog Box (App-V 4.6 SP1)](antivirus-running-dialog-box--app-v-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/disconnected-operation-mode.md b/mdop/appv-v4/disconnected-operation-mode.md deleted file mode 100644 index b123b249f9..0000000000 --- a/mdop/appv-v4/disconnected-operation-mode.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Disconnected Operation Mode -description: Disconnected Operation Mode -author: dansimp -ms.assetid: 3f9849ea-ba53-4c68-85d3-87a4218f59c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Disconnected Operation Mode - - -The disconnected operation mode settings—accessible by right-clicking the **Application Virtualization** node, selecting **Properties**, and clicking the **Connectivity** tab—enables the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) to run applications that are stored in the file system cache of the client when the client is unable to connect to the Application Virtualization Management Server. - -Reasons for failure to connect to the server include server failure, network outage, or disconnection from the network. If any failure occurs, the client will automatically switch to disconnected operation. After it is disconnected, if the client needs additional data from the server to continue to run an application or if the disconnected operation time-out expires, the client will attempt to reconnect to the server. If this connection attempt fails, the application will be shut down. - -By default, disconnected operation is enabled and the time-out is set to 90 days. The time-out value is specified as the number of days you want to limit disconnected operation mode, and you can enter a value from 1–999. - -## Related topics - - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md b/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md deleted file mode 100644 index 7abf4bd3a7..0000000000 --- a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Domain-Joined and Non-Domain-Joined Clients -description: Domain-Joined and Non-Domain-Joined Clients -author: dansimp -ms.assetid: a935dc98-de60-45f3-ab74-2444ce082e88 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain-Joined and Non-Domain-Joined Clients - - -The App-V Desktop Client can be configured to allow connection to a network regardless of whether the client is domain joined or non-domain joined. - -## Domain-Joined Clients - - -Clients that are domain joined, but outside the internal network, can communicate with the App-V infrastructure by using a VPN connection. When you want to provide users the ability to leave the internal network but still communicate in an App-V infrastructure, your environment requires very little setup. Because the users are already part of the domain, you simply need to ensure that Cached Credentials are supported on the client. This is the default configuration, and any changes to this setting can be accomplished from Group Policies. - -As mentioned in the App-V Security Best Practices Guide, the user will attempt to send their user ticket to the App-V infrastructure for authentication. If the ticket is expired, it will revert to using NTLM and the cached credentials on the computer. To allow roaming, administrators must ensure that the publishing server being accessed internally is available at the same name externally for the names to resolve properly. - -## Non-Domain-Joined Clients - - -Clients that are non-domain joined but need to communicate in the App-V infrastructure must be configured to ensure that authentication to the App-V infrastructure is successful. The App-V Desktop Client does not permit prompting for the publishing refresh process, so the client must be configured to present the proper credentials to the App-V Management Server. - -The publishing server, which is configured for publishing refresh from the non-domain joined client, requires that the external name that clients access is configured as the common name or a subject alternate name (SAN) on the publishing server’s certificate. - -## Related topics - - -[How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) - -[How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/edit-shortcuts-learn-more.md b/mdop/appv-v4/edit-shortcuts-learn-more.md deleted file mode 100644 index 830abacbd3..0000000000 --- a/mdop/appv-v4/edit-shortcuts-learn-more.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Edit Shortcuts -description: Edit Shortcuts -author: dansimp -ms.assetid: a0ca75aa-1059-4d0c-894c-2e3474e9f519 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit Shortcuts - - -Use the **Edit Shortcuts** page to configure the shortcuts and file type associations (FTA) that are installed when you deploy the virtual application package to target computers. - -This page contains the following elements: - -**Add** -Adds an icon or specifies an FTA for the package. Click **Browse** to specify the file or program to add. - -**Remove** -Removes an icon or FTA from the package. - -**Edit** -Enables you to configure the properties associated with an icon or FTA in the package. You can update the associated **Application Path**, **Name**, **Version**, and **OSD File Name**. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md b/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md deleted file mode 100644 index 6173dbdd7a..0000000000 --- a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: Electronic Software Distribution-Based Scenario Overview -description: Electronic Software Distribution-Based Scenario Overview -author: dansimp -ms.assetid: e9e94b8a-6cba-4de8-9b57-73897796b6a0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Electronic Software Distribution-Based Scenario Overview - - -If you plan to use an electronic software distribution (ESD) solution to deploy virtual applications, it is important to understand the factors that go into and are affected by that decision. This topic describes the benefits of using an ESD-based scenario and provides information about the publishing and package streaming methods that you will need to consider as you proceed with your deployment. - -**Important**   -Whichever ESD solution you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or later, see the System Center Configuration Manager documentation at . - - - -Using an existing ESD system provides you with the following benefits: - -- Eliminates dual management infrastructures - -- Reduces the cost of additional hardware - -- Reduces the cost of additional operating system and database licenses - -## Publishing Methods - - -When using an ESD-based scenario, you have the following choices for publishing the application to the clients: - -- **Stand-alone Windows Installer.** The Windows Installer file contains the manifest and the OSD and ICO files the clients use to configure a package. The Windows Installer file also copies the SFT file to the client because this scenario does not use a server. - -- **Windows Installer with the package manifest.** The Windows Installer file contains the manifest and the OSD and ICO files the clients use to configure a package. The SFT file is stored on a server. A command-line parameter directs the client to the location of the SFT file. - -- **SFTMIME commands.** SFTMIME commands are used with the manifest, OSD, ICO, and SFT files to add packages to the client. The manifest file must be on the client computer, or it must be accessible through a UNC path. Depending on the client configuration and the command-line options, the OSD, ICO, and SFT files can be on the client computer or on a server. - -For more detailed information about the preceding publishing methods, see [Determine Your Publishing Method](determine-your-publishing-method.md). - -## Package Streaming Methods - - -You will need to determine the method your Application Virtualization System will use to stream the virtual application packages, or SFT files, from the server to the clients. The following streaming options are available: - -- **Application Virtualization Streaming Server.** If you use an Application Virtualization Streaming Server in your configuration, the SFT files are streamed to the clients from that server using RTSP or RTSPS protocols. You must install the server software on a computer and you must configure it through the registry, but this configuration does not depend on services such as SQL or Active Directory Domain Services. The SFT files are stored on the server at a location accessible by the clients. Publishing information can be distributed to the clients through any distribution mechanism. However, when configured, the client receives package upgrades automatically and active upgrade is supported. - -- **Application Virtualization Management Server.** If you use an Application Virtualization Management Server in your configuration, the SFT files are streamed to the clients from that server using RTSP or RTSPS protocols. You manage this server through the Application Virtualization Management Console. This configuration uses a SQL database and Active Directory services. The server can distribute publishing information to the clients, so additional publishing mechanisms are not needed. - -- **File server.** If you use a file server in your configuration, the SFT files are streamed to the other client computers by using SMB protocols. File servers used in this configuration are managed by creating access control lists (ACLs) on the file shares and SFT files. Care must be taken to direct the clients to the correct files on the file server. - -- **IIS server.** If you use an IIS server in your configuration, the SFT files are streamed to the clients from that server using HTTP or HTTPS protocols. The IIS server is easy to configure and manage. Care must be taken to direct the clients to the correct files on the IIS server. - -For more detailed information about the preceding streaming methods, see [Determine Your Streaming Method](determine-your-streaming-method.md). - -## Related topics - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Determine Your Publishing Method](determine-your-publishing-method.md) - -[Determine Your Streaming Method](determine-your-streaming-method.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario.md b/mdop/appv-v4/electronic-software-distribution-based-scenario.md deleted file mode 100644 index d99c4ce90f..0000000000 --- a/mdop/appv-v4/electronic-software-distribution-based-scenario.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Electronic Software Distribution-Based Scenario -description: Electronic Software Distribution-Based Scenario -author: dansimp -ms.assetid: 18be0f8d-60ee-449b-aa83-93c86d1a908e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Electronic Software Distribution-Based Scenario - - -If you plan to use an electronic software distribution (ESD) deployment scenario for your Microsoft Application Virtualization environment, it is important to understand the factors that go into and are affected by that decision. The topics in this section describe the ESD scenario and provide information about package delivery methods, transmission protocols, and external components that you will need to consider in your deployment strategy. You can also use the procedures in this section to complete your deployment, from the server configuration phase through the deployment verification phase. - -## In This Section - - -[Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) -Provides important information about the publishing and streaming methods you can use for an ESD-based deployment. - -[How to Configure Servers for ESD-Based Deployment](how-to-configure-servers-for-esd-based-deployment.md) -This section provides procedures you can use to configure the Application Virtualization Streaming Servers, the IIS server, and the file server for your electronic software distribution–based deployment strategy. - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) -Provides command-line procedures for installing the Application Virtualization Client, using either the setup.exe or the setup.msi file. - -[How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) -Provides a step-by-step procedure you can use to confirm that the Application Virtualization Client has been installed and is functioning correctly. - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -Provides command-line procedures for publishing an application package, using either Windows Installer or SFTMIME. - -## Reference - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -## Related Sections - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/exclusion-item-dialog-box.md b/mdop/appv-v4/exclusion-item-dialog-box.md deleted file mode 100644 index 250a430862..0000000000 --- a/mdop/appv-v4/exclusion-item-dialog-box.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Exclusion Item Dialog Box -description: Exclusion Item Dialog Box -author: dansimp -ms.assetid: 5523c6d4-95f2-47af-8c06-3ab18004a207 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Exclusion Item Dialog Box - - -Use the **Exclusion Item** dialog box to assign or change a mapping rule and to assign or change an expression for exclusion. This dialog box contains the following elements. - -**Important**   -Adding files from an excluded directory to the virtual files system is not supported. - - - -**Exclude Path** -Use to specify variable name that the Application Virtualization Sequencer will exclude if encountered while parsing virtual file system items or virtual registry items. - -**Mapping Type** -Use to select the mapping rules the Application Virtualization Sequencer will apply to parse items in the virtual file system or virtual registry. One of the following values can occur: - -- VRG—Specifies that this mapping rule applies when parsing an item in the virtual registry. - -- VFS—Specifies that this mapping rule applies when parsing an item in the virtual file system. - -- VRG & VFS—Specifies that this mapping rule applies when parsing an item in either the virtual file system or the virtual registry. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - - - - - - - - - diff --git a/mdop/appv-v4/exclusion-items-tab-keep.md b/mdop/appv-v4/exclusion-items-tab-keep.md deleted file mode 100644 index e4dcff97c2..0000000000 --- a/mdop/appv-v4/exclusion-items-tab-keep.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Exclusion Items Tab -description: Exclusion Items Tab -author: dansimp -ms.assetid: 864e46dd-3d6e-4a1b-acf4-9dc00548117e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Exclusion Items Tab - - -The **Exclusion Items** tab displays the expressions that the Application Virtualization Sequencer excludes from the virtual file system or virtual registry. These expressions are excluded to ensure that the sequenced application package can run on Application Virtualization Desktop Clients. You can also exclude non-standard installation directories that might be unwanted in the sequencing. - -This tab contains the following elements. - -**Exclude Path** -Displays variable names that the Sequencer excludes if encountered while parsing virtual file system items or virtual registry items. - -**Resolves To** -Displays the actual paths that correspond to the Sequencer variables. - -**Map Type** -Displays mapping rules that the Sequencer applies to parse items in the virtual file system or virtual registry. One of the following values can occur: - -**New** -Click to enter a new exclusion item. - -**Edit** -Click to edit a selected exclusion. - -**Delete** -Click to remove a selected exclusion. - -**Save As Default** -Click to save the current exclusion items as your default. - -**Restore Defaults** -Click to restore default-assigned exclusion items and remove any items you added. - -**OK** -Click to accept the displayed exceptions. - -**Cancel** -Click to cancel any changes you have made. - -## Related topics - - -[Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -[Exclusion Item Dialog Box](exclusion-item-dialog-box.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index a08aea1e5d..0000000000 --- a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Failed Launch Dialog Box (App-V 4.6 SP1) -description: Failed Launch Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 55669552-51b4-48aa-8bd0-6d78c2c930d9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Failed Launch Dialog Box (App-V 4.6 SP1) - - -The application did not start successfully. - -Use the following list to help identify why the application did not run successfully. - -1. Verify that all required prerequisites have been installed on the computer running the App-V Sequencer. - -2. Verify that any resources required by the application are available and not in use by another process. - -3. Verify that the application you are installing is supported by the operating system running on the computer that is running the App-V Sequencer. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-association-results-pane-columns.md b/mdop/appv-v4/file-type-association-results-pane-columns.md deleted file mode 100644 index 1cdc78f1cc..0000000000 --- a/mdop/appv-v4/file-type-association-results-pane-columns.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: File Type Association Results Pane Columns -description: File Type Association Results Pane Columns -author: dansimp -ms.assetid: eab48e20-9c92-459d-a06b-8e20202d73f6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Association Results Pane Columns - - -In the Application Virtualization Client Management Console, the **Results** pane of the **File Associations** node can display a variety of columns. **Extension**, **Description**, and **Application** are shown by default. - -**Note**   -You can add or remove a column simply by right-clicking in the **Results** pane, selecting **View**, then selecting **Add/Remove Columns**. - - - -The list can be sorted by any of the columns. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text, dates and times are considered to come before any other text. - -The available column names contain the following elements. - -**Extension** -The extension, such as DOC or HTML. This is the field by which the list is organized, so each extension is displayed once on the list. - -**Description** -The description or user-friendly name. - -**Application** -The name and version of the application associated with the default action of this file type. - -**Parameters** -The parameters for the default action. - -**Default Action** -The name of the default action. - -**DDE** -Displays **Enabled** or **Disabled** depending on whether Dynamic Data Exchange (DDE) is enabled for the default action. - -**Linked Extensions** -A comma-separated list of other extensions that are associated with the same type. - -**Confirm Open** -Displays **Yes** or **No** depending on whether **Confirm open after download** is selected. - -**Always Show** -Displays **Yes** or **No** depending on whether **Always show extension** is selected. - -**Shell New** -Displays **Yes** or **No** depending on whether the extension is added to the shell’s **New** menu. - -**Applies To** -Displays **User** or **Computer** depending on whether this is a user-specific or computer-wide association. - -**Icon File** -The original name of the icon file. - -**Icon Path** -The original path or URL for the icon file. - -**Cached Icon File** -The name of the icon files in cache (which is a GUID in the current implementation). - -**Cached Icon Path** -The full path to the icon files in cache. - -**Content Type** -The content type. - -**Perceived Type** -The perceived type or blank. - -## Related topics - - -[File Type Associations Node](file-type-associations-node-client.md) - -[File Type Association Results Pane](file-type-association-results-pane.md) - - - - - - - - - diff --git a/mdop/appv-v4/file-type-association-results-pane.md b/mdop/appv-v4/file-type-association-results-pane.md deleted file mode 100644 index 3b6a32eb71..0000000000 --- a/mdop/appv-v4/file-type-association-results-pane.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: File Type Association Results Pane -description: File Type Association Results Pane -author: dansimp -ms.assetid: bc5ceb48-1b9f-45d9-a770-1bac90629c76 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Association Results Pane - - -The **File Association** **Results** pane is one level below the **System** pane in the Application Virtualization Client Management Console, and it displays a list of the available file type associations. Users can see a list of file type extensions and the applications to which they correspond. - -To display specific options for file types, right-click any application extension to display a pop-up menu that contains the following elements. - -**Delete** -Deletes the file name extension from the list and removes the association to the file type. - -**Properties** -Displays the **Properties** dialog box for the selected application extension. This dialog box has two tabs: - -- The **General** tab displays general information about the file type association, including the application icon and name: - - - **Icon**—Displays the selected icon for the associated file type. - - - **Association Name**—Displays the name of the file type. - - - **Change Icon**—Click this button to change the icon for the file type association. - - - **Extension**—Displays the extension or extensions associated with a particular file type. - - - **Unlink**—This button is enabled when more than one extension is associated with an application. Click **Unlink** to manage the file type extension separately from the extension it is currently linked with. - - - **Specified application**—Select this radio button, and choose an application from the drop-down list of available applications. You are changing the application that is used by the default action. You can also browse to find an application if it isn't available on the drop-down list. - - - **OSD file**—Select this radio button, and specify a path to an Open Software Descriptor (OSD) file. You can also browse to an OSD file. - -- The **Advanced** tab displays detailed information about the file type association: - - - **Action**—Displays a list of the available actions for the associated file type. - - - **Content Type**—Displays a description of the contents of the file type. If this field is left blank, the client will fill it. - - - **Perceived Type**—Displays the file type. You can select one of the options from the drop-down list or add your own. - - - **Confirm open after download**—Select this check box to display a confirmation message after a file is loaded. If this box is selected, when you attempt to open a file of this type by downloading it into a Web browser, the browser prompts you to see whether you want to save the file rather than open it directly into the browser without confirmation. - - - **Always show extension**—Select this check box to specify that extensions should be shown even when the user requests that the system should hide extensions for known file types. - - - **Add to new menu**—Select this check box to specify that the extension or extensions should be listed in the shell's **New** context menu. - - - **Apply to all users**—Select this check box to specify that extensions should be available to all users. - -**Help** -Displays the Client Management Console help system. - -To display general options for the **Results** pane, right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**New Association** -This menu item displays the New Association Wizard. This wizard consists of two pages: - -1. Enter a new or existing file name extension, and associate the extension with a file type: - - - **Extension**—Enter a new file name extension. This field is blank by default. - - - **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - - **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is not selected. - - - **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -2. Select the application that will open files with the specified extension: - - - **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - - **Open file with the association described in this OSD file**—Select this radio button to specify an OSD file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -**Refresh** -This item refreshes the **Results** pane. - -**Export List** -With this menu item, you can create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu item lets you change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -This item displays the help system for the management console. - -## Related topics - - -[How to Change an Application Icon](how-to-change-an-application-icon.md) - -[File Type Associations Node](file-type-associations-node-client.md) - -[File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-node-client.md b/mdop/appv-v4/file-type-associations-node-client.md deleted file mode 100644 index 4182a0dbbf..0000000000 --- a/mdop/appv-v4/file-type-associations-node-client.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: File Type Associations Node -description: File Type Associations Node -author: dansimp -ms.assetid: 48e4d9eb-00bd-4231-a68a-f8597ab683ff -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Node - - -The **File Type Associations** node is one level below the **Application Virtualization** node in the **Scope** pane of the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of file type associations. - -Right-click the **File Type Associations** node to display a pop-up menu that contains the following elements. - -**New Association** -This menu item displays the New Association Wizard. This wizard consists of two pages: - -1. Enter a new or existing file name extension, and associate the extension with a file type: - - - **Extension**—Enter a new or existing file name extension. This field is blank by default. - - - **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - - **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is not selected. - - - **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Choose a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -2. Select the application that will open files with the specified extension: - - - **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - - **Open files with the application described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Browse to select an existing location, or enter a path or HTTP-formatted URL in this field. - -**New Window from Here** -Select this menu item to open a new management console with the selected node as the root node. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items enables you to change the appearance and content of the **Results** pane. - -**Refresh** -Select this item to refresh the management console. - -**Help** -With this menu item, you can display the help system for the management console. - -## Related topics - - -[File Type Association Results Pane](file-type-association-results-pane.md) - -[File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-node.md b/mdop/appv-v4/file-type-associations-node.md deleted file mode 100644 index f739cf0208..0000000000 --- a/mdop/appv-v4/file-type-associations-node.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: File Type Associations Node -description: File Type Associations Node -author: dansimp -ms.assetid: a3f35562-32d0-4a43-8604-3a54189ade92 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Node - - -The **File Type Associations** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of file type associations. Right-click the **File Type Association** node to display a pop-up menu that contains the following elements. - -**New File Type Association** -Displays the New File Type Association Wizard. This wizard consists of the following two pages: - -1. Enter a new or existing file name extension, and associate the extension with a file type. - - 1. **Extension**—Enables you to enter a new or existing file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. - -2. Select the application that will open files with the specified extension. - - 1. **Open files with the selected application**—Enables you to choose an application from the drop-down list of available applications. - - 2. **Icon Path**—Enables you to enter the complete path to the ICO file or to browse for the ICO file. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system. - -## Related topics - - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-results-pane-columns.md b/mdop/appv-v4/file-type-associations-results-pane-columns.md deleted file mode 100644 index 1458316d50..0000000000 --- a/mdop/appv-v4/file-type-associations-results-pane-columns.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: File Type Associations Results Pane Columns -description: File Type Associations Results Pane Columns -author: dansimp -ms.assetid: 8cbb63e4-f93b-4066-ba06-30103e6d0c3e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays two columns. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - -
          ColumnDescription

          Extension

          Displays the extension, such as DOC or HTML. This is the field by which the list is organized, so each extension is displayed once on the list.

          File Type

          Displays the file type.

          - -  - -## Related topics - - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-results-pane.md b/mdop/appv-v4/file-type-associations-results-pane.md deleted file mode 100644 index b1f2badd96..0000000000 --- a/mdop/appv-v4/file-type-associations-results-pane.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: File Type Associations Results Pane -description: File Type Associations Results Pane -author: dansimp -ms.assetid: 881d7fa7-ecde-4a05-b6ee-132fe2c09900 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Results Pane - - -The **File Type Associations Results** pane in the Application Virtualization Server Management Console displays a list of the available file type associations. Users can see a list of file type extensions and the applications to which they correspond. - -Right-click any application extension to display a pop-up menu that contains the following elements. - -**Delete** -Deletes the file name extension from the list. - -**Properties** -Displays the **Properties** dialog box for the selected application extension. This dialog box has the following tabs: - -- **General** tab—Displays general information about the file type association, including the application icon and name. - - - **Icon**—Displays the selected icon for the associated file type. - - - **Extension**—Displays the extension for the file type. - - - **File Type Description**—Displays a brief description of the file type. You can edit this field. - - - **Open files with this application**—Enables you to choose an application from the drop-down list of available applications. - - - **Icon Path**—Enables you to enter the complete path to the icon file (ICO) or to browse for the ICO file. - -- **Advanced** tab—Displays detailed information about the file type. - - - **Action**—Displays a list of the available actions for the associated file type. You can add new actions, edit existing actions, set an action as a default, or delete actions. - - - **Content Type**—Displays a description of the contents of the file type. If this field is left blank, the client will fill it. - - - **Perceived Type**—Displays the kind of file type. You can select one of the options from the drop-down list or add your own. - - - **Confirm open after download**—Select this check box to display a confirmation message after an application is loaded. - - - **Always show extension**—Select this check box to specify that extensions should be shown even when the user requests that the system hide the extensions for known file types. - - - **Add to new menu**—Select this check box to specify that the extension or extensions should be listed in the shell's **New Extensions** list. - -**Help** -Displays the Application Virtualization Server Management Console help system. - -Right-click anywhere in the **Results** pane that is not on an extension to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line up Icons** -Organizes the icons in the **Results** pane. - -**Help** -Displays the help system. - -## Related topics - - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index c994c8d5e0..0000000000 --- a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Files Excluded Page Dialog Box (App-V 4.6 SP1) -description: Files Excluded Page Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 9718c7bf-7ed2-44d8-bdac-df013cd0d6c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Files Excluded Page Dialog Box (App-V 4.6 SP1) - - -All required files were not added to the package because they are located in excluded paths. Use the following steps to remove the files from the exclusion list. - -1. Open the package in the App-V Sequencer console. - -2. Click **Tools** / **Options**, and then click the **Exclusion Items** tab. - -3. Select the **Exclude Path** entry, and then click **Delete**. - -4. Click **Ok**. - -You must then add the file to the package. You can use the following steps to add files: - -1. In the App-V Sequencer console, click the **Virtual File System** tab. - -2. To add a new virtual file system mapping, right-click, and then click **Add**. - -3. In the **New Virtual File System Mapping** dialog box, to specify the file, click **Browse** and select the file. Click **OK**. To save the package, click **File** / **Save**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/files-tab-keep.md b/mdop/appv-v4/files-tab-keep.md deleted file mode 100644 index aaeebd7805..0000000000 --- a/mdop/appv-v4/files-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Files Tab -description: Files Tab -author: dansimp -ms.assetid: 14191e51-11a2-40ab-8855-3408a4bc5a9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Files Tab - - -Use the **Files** tab to specify whether a file in a sequenced application package will be available to a specific user or to all users in the community. - -## In This Section - - -[About the Files Tab](about-the-files-tab.md) -Provides general information about the **Files** tab. - -[How to Modify the Files Included in a Package](how-to-modify-the-files-included-in-a-package.md) -Provides the procedure to modify the files included in a package. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/g b/mdop/appv-v4/g deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/mdop/appv-v4/gathering-information-page--learn-more-.md b/mdop/appv-v4/gathering-information-page--learn-more-.md deleted file mode 100644 index 2fb6c6cc6f..0000000000 --- a/mdop/appv-v4/gathering-information-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Gathering Information Page (Learn More) -description: Gathering Information Page (Learn More) -author: dansimp -ms.assetid: f8d5ec6b-a3d3-4e80-b1c2-3f8441b04aaa -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Gathering Information Page (Learn More) - - -Use the **Gathering Information** page to review the installation files that could not be located in the directory specified on the **Installation Files** page of this wizard. You must either locate the missing files and then click **Previous** to recreate the Package Accelerator, or select the **Remove these files** check box before you advance to the next page of this wizard. - -This page contains the following elements: - -**Review Missing Files** -Displays a list of the installation files that were not found in the specified directory. - -**Remove these files** -Specifies whether the missing installation files should be removed from the package. Only select this option if the files displayed in the **Review Missing Files** pane are not required to successfully run the application. All files that are removed will not be part of the Package Accelerator and also will not be part of any virtual application packages created by using the Package Accelerator. Ensure that removing these files will not cause the package to fail when running on target computers. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/general-tab-keep.md b/mdop/appv-v4/general-tab-keep.md deleted file mode 100644 index 58ae9340d1..0000000000 --- a/mdop/appv-v4/general-tab-keep.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: General Tab -description: General Tab -author: dansimp -ms.assetid: aeefae39-60cd-4ad4-9575-c07d7e2b1e59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# General Tab - - -Use the **General** tab to configure options for Microsoft Application Virtualization (App-V) Sequencer. - -**Scratch Directory** -Specifies the path to the location where the Sequencer will temporarily save files generated during sequencing. The default path is C:\\Program Files\\Microsoft Application Virtualization Sequencer\\Scratch. To specify a new path, click **Browse**. - -**Log Directory** -Specifies the path to the directory where the Sequencer will save log files. The default path is C:\\Program Files\\Microsoft Application Virtualization Sequencer\\Logs. To specify a new path, click **Browse** - -**Allow Use of MSI Installer** -Select this option to allow interaction between the Sequencer and the application installer. This option is selected by default. - -**Allow Virtualization of Events** -Select this option to allow low-level operating system activities of the application to be virtualized when a sequenced application package is run on App-V Desktop Clients. This option is selected by default. - -**Allow Virtualization of Services** -Select this option to allow services required by the application to be virtualized when the application is run on App-V Desktop Clients. This option is selected by default. - -**Append Package Version to Filename** -Select this option to automatically append the sequenced application package version number to the file name. This option is selected by default. - -**OK** -Saves changes and closes the dialog box. - -**Cancel** -Exits the dialog box without saving any changes. - -**Apply** -Saves the changes and remains in the dialog box. - -## Related topics - - -[Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/guidance-page-app-v-46-sp1.md b/mdop/appv-v4/guidance-page-app-v-46-sp1.md deleted file mode 100644 index 6af524a1e1..0000000000 --- a/mdop/appv-v4/guidance-page-app-v-46-sp1.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Guidance Page -description: Guidance Page -author: dansimp -ms.assetid: 2d461f7e-bde0-4f20-bfc1-46d52feb701e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Guidance Page - - -Use the **Guidance** page to review the publishing guidance associated with the Package Accelerator. This information was created with the Package Accelerator and includes information about creating and publishing a new virtual application package based on the specified Package Accelerator. - -This page contains the following elements: - -**Export** -Click **Export** to export the guidance information to a Rich Text Format (.rtf) or text (.txt) file. Exporting the information is helpful if you have to review the guidance information later in the sequencing process. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/help.md b/mdop/appv-v4/help.md deleted file mode 100644 index 1b14a81bf2..0000000000 --- a/mdop/appv-v4/help.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: HELP -description: HELP -author: dansimp -ms.assetid: 0ddb5f18-0c0a-45ea-b7c7-2d4749e3d35d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# HELP - - -Displays information about the various SFTMIME commands that can be used in Application Virtualization (App-V). - -## HELP - - -`SFTMIME [/? | /HELP [VERB:]]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          /?, /HELP

          Displays usage information.

          verb

          The command to run, such as ADD, REFRESH, HELP or REMOVE.

          object

          What the command applies to, such as APP:"Default Application."

          parameters

          Optional parameters for the specified verb and object.

          /LOG

          Log output to the specified path name.

          /CONSOLE

          Displays output in the active console window (default).

          /GUI

          Displays errors in a dialog box (not valid for queries).

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -The verbs described in the following table are supported. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          ADD

          Adds a new application, package, file type association, or publishing server to the App-V Client.

          CONFIGURE

          Changes the configuration of an application, a package, a file type association, or a publishing server.

          DELETE

          Removes applications, packages, file type associations, or servers.

          LOAD

          Loads a package into the file system cache.

          REPAIR

          Resets your personal settings for an application.

          REFRESH

          Triggers a publishing server refresh.

          PUBLISH

          Publishes an application shortcut to the user's Start menu, desktop, or other specified location, or can be used to publish the contents of an entire package.

          UNPUBLISH

          Removes the shortcuts and file types for an entire package.

          QUERY

          Gets a current list of applications, packages, file type associations, or publishing servers.

          CLEAR

          Removes your personal settings and desktop configurations for one or more applications.

          UNLOAD

          Unloads a package from the file system cache.

          LOCK

          Locks the application specified in the file system cache.

          UNLOCK

          Unlocks the application specified in the file system cache.

          - -  - -For more information about the preceding actions, use the following command: - -`SFTMIME /HELP VERB:verb` - -For example, the following command will display information for the ADD verb: - -`SFTMIME /HELP VERB:ADD` - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-add-a-file-type-association.md b/mdop/appv-v4/how-to-add-a-file-type-association.md deleted file mode 100644 index bd5e1a7cb5..0000000000 --- a/mdop/appv-v4/how-to-add-a-file-type-association.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Add a File Type Association -description: How to Add a File Type Association -author: dansimp -ms.assetid: cccfbd00-51ba-4a60-a598-ee97f5ea1215 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a File Type Association - - -You can use the following procedure to add a file type association, using the **File Type Associations** node in the Application Virtualization Client Management Console. - -**To add a file type association** - -1. Right-click the **File Type Associations** node, and select **New Association** from the pop-up menu. - -2. Complete the first step of the dialog box by completing the following information, and then click **Next**: - - 1. **Extension**—Enter a new file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is cleared. - - 4. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -3. Complete the second step of the dialog box by completing the following information, and then click **Finish** to return to the Client Management Console: - - 1. **Change Icon**—Click this button to change the application icon. Select one of the available icons, or browse to a new location and select an icon. - - 2. **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - 3. **Open file with the association described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -## Related topics - - -[How to Add an Application](how-to-add-an-application.md) - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md deleted file mode 100644 index 6b9c002b72..0000000000 --- a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Add a Package by Using the Command Line -description: How to Add a Package by Using the Command Line -author: dansimp -ms.assetid: e75af49e-811a-407a-a7f0-6de8562b9188 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Package by Using the Command Line - - -The following procedures list the steps that are necessary to add a virtual application package to the Application Virtualization (App-V) Client on a specific computer. - -**To add a virtual application package for a specific user** - -- Run the following command under the user account of the person who is to get the package. The command adds and publishes the package for that user. - - `SFTMIME ADD PACKAGE:”name” /MANIFEST ` - -**To add a virtual application package for all users** - -- Run the following command under an account that has administrator rights. The package is added and published for all users on the computer. - - `SFTMIME ADD PACKAGE:”name” /MANIFEST /GLOBAL` - -**To add a package using an electronic software distribution system** - -1. If you are using an electronic software distribution system that runs the commands under the computer’s **SYSTEM** account, the package is published for that account only, unless you use the /GLOBAL switch. Run the following command to add and publish the package for all users on the computer: - - `SFTMIME ADD PACKAGE:”name” /MANIFEST /GLOBAL` - -2. - - If you want to add the package for specific users only, run the **ADD PACKAGE** command, and then explicitly publish the package for each user by running the following **PUBLISH PACKAGE** command under each person’s user account: - - `SFTMIME ADD PACKAGE:”name” /MANIFEST ` - - `SFTMIME PUBLISH PACKAGE:”name” /MANIFEST ` - - Publishing the package without the GLOBAL parameter grants the user access to the applications in the package and publishes the file types and shortcuts that are listed in the manifest to the user’s profile. Permissions required are “Manage file type associations” (**ManageTypes**) and “Publish shortcuts” (**PublishShortcut**). - -## Related topics - - -[How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) - -[How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-add-a-package-version.md b/mdop/appv-v4/how-to-add-a-package-version.md deleted file mode 100644 index 6a4b7c4372..0000000000 --- a/mdop/appv-v4/how-to-add-a-package-version.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Add a Package Version -description: How to Add a Package Version -author: dansimp -ms.assetid: dbb829c1-e5cb-4a2f-bc17-9a9bb50c671c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Package Version - - -In the Application Virtualization Server Management Console, when you resequence a package, you can use the following procedure to add the new version to your servers for streaming. - -**Note**   -When you upgrade a package with a new version, you can leave the existing version in place or delete it and leave only the newest one. You might want to leave the old version in place for compatibility with legacy documents or so that you can test the new version before making it available to all users. - - - -**To add a package version** - -1. Copy the new SFT file to the application server's content folder. If resequencing did not add changes to the Open Software Descriptor (OSD), icon (ICO), or Sequencer Project (SPRJ) files, you do not need to copy those. You can include those files if you want all the files to display the same date. - -2. In left pane of the Application Virtualization Server Management Console, expand the **Packages** node. - -3. Right-click the package you want to upgrade, and choose **Add Version**. - -4. In the **Add Package Version** dialog box, browse for or type the path name for the new application file in the **Full path for package file** field. This must be an SFT file. - -5. Click **Next**. - -6. The **Summary** dialog box shows the file location and prompts you to copy the file there if you have not already done so. Click **Finish** after you have verified the information. - - The new version is now complete and ready to stream. - -## Related topics - - -[How to Delete a Package](how-to-delete-a-packageserver.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-a-package.md b/mdop/appv-v4/how-to-add-a-package.md deleted file mode 100644 index b9f409c2cb..0000000000 --- a/mdop/appv-v4/how-to-add-a-package.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Add a Package -description: How to Add a Package -author: dansimp -ms.assetid: 5407fdbe-e658-44f6-a9b8-a566b81dedce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Package - - -You can add a package from the Application Virtualization Server Management Console in the following ways: - -- Import an application, which creates the package automatically in the process. - -- Add a package manually. - -It is recommended that you import applications instead of adding them manually. For more information about importing applications, see [How to Import an Application](how-to-import-an-applicationserver.md). - -**To add a package manually** - -1. In the Application Virtualization Server Management Console, right-click the **Packages** node in the left pane and choose **New Package**. - -2. In the **New Package** dialog box, type a name in the **Package Name** field. - -3. Browse for or type a path name in the **Full path for package file** field. This must be an SFT file. - - **Note**   - If you browse to the SFT file, replace the local path (such as C:\\Program Files\\User\_Apps\\Virtual\_App\_Server\\content) with the server's static host name or IP address. Using the variable *%SFT\_SOFTGRIDSERVER%* requires per-client computer configuration. - - In dialog boxes that refer to Virtual Application Servers, you must use a network location, such as the server's static host name or IP address, that your users can access. The application's Open Software Descriptor (OSD) file can replace the placeholder variable *%SFT\_SOFTGRIDSERER%* with the server's static host name or IP address. If you leave the placeholder variable, you must set this variable on each client computer that will access that server. Set a User or System variable on each computer for SFT\_SOFTGRIDSERVER. The variable value must be the server's static host name or IP address. If you set a variable, exit the Client session, log out of and back into Microsoft Windows, and then restart the session on each computer that had a session running and had the variable set. - - - -4. Click **Next**. - -5. The **Summary** dialog box shows the file location and prompts you to copy the file to the location if you have not already done so. Click **Finish** after you have verified the information. - - **Note**   - If you are managing applications on a remote server, in the next dialog box, type only the path of the file relative to the server's content root. - - - -## Related topics - - -[How to Import an Application](how-to-import-an-applicationserver.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-a-server.md b/mdop/appv-v4/how-to-add-a-server.md deleted file mode 100644 index 0fb467e68f..0000000000 --- a/mdop/appv-v4/how-to-add-a-server.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Add a Server -description: How to Add a Server -author: dansimp -ms.assetid: 1f31678a-8edf-4d35-a812-e4a2abfd979b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Server - - -To help you manage your Application Virtualization Management Servers more efficiently, organize them into server groups. After you create a server group in the Application Virtualization Server Management Console, you can use the following procedure to add a server to the group. - -**Note**   -All servers in a server group must be connected to the same data store. - - - -**To add a server to a group** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. Right-click the desired server group, and select **New Application Virtualization Management Server**. - -3. In the **New Server Group Wizard**, enter the **Display Name** and the **DNS Host Name**. - -4. Leave the default values in the **Maximum Memory Allocation** field for the server cache and the **Warn Memory Allocation** field to specify the threshold warning level. - -5. Click **Next**. - -6. In the **Connection Security Mode** dialog, check the **Use enhanced security** box to select enhanced security mode, if desired. If necessary, complete the **Certificate Wizard** or view existing certificates. - -7. Click **Next**. - -8. In the **App Virt Port Setting** dialog, select the **Use Default Port** or the **User Custom Port** radio button and enter the custom port number. - -9. Click **Finish**. - -## Related topics - - -[How to Create a Server Group](how-to-create-a-server-group.md) - -[How to Remove a Server](how-to-remove-a-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-an-administrator-group.md b/mdop/appv-v4/how-to-add-an-administrator-group.md deleted file mode 100644 index 27067fbc52..0000000000 --- a/mdop/appv-v4/how-to-add-an-administrator-group.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Add an Administrator Group -description: How to Add an Administrator Group -author: dansimp -ms.assetid: 2611f33e-6082-4269-b0ba-394174701492 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add an Administrator Group - - -From the **Administrators** node of the Application Virtualization Server Management Console, you can use the following procedure to add an administrator group. - -**To add an administrator group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Administrators** node and select **Add Administrator Group**. - -2. Complete the **Select Groups** dialog box to add groups. - - **Important**   - When completing the **Select Groups** dialog box, you might see the **Multiple Names Found** dialog box, which can display multiple group names. To add more than one group at a time, press **Ctrl** and click the name of each group you want to add. Click **OK** to exit the **Multiple Names Found** dialog box. - - - -3. Click **OK**. - - **Note**   - To add administrator groups to the Application Virtualization Management Server, you must have system administrator or security administrator privileges on the associated data store. If you attempt to create a group without sufficient privileges, the system generates an error message. - - - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -[How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-an-application.md b/mdop/appv-v4/how-to-add-an-application.md deleted file mode 100644 index 760c7f8540..0000000000 --- a/mdop/appv-v4/how-to-add-an-application.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Add an Application -description: How to Add an Application -author: dansimp -ms.assetid: 0147233d-f369-4796-8e34-fb1d894af732 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add an Application - - -You can use the following procedure to add an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To add an application** - -1. In the **Results** pane, right-click and select **New Application** from the pop-up menu. - -2. On the wizard page, you can perform the following tasks: - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **OSD File Path or URL**—Enter a local absolute path, a full UNC path (shared file or directory on a network), or an HTTP URL. - - 3. **(OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -3. Click **Finish** to add the application to the **Results** pane. - -## Related topics - - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md deleted file mode 100644 index 2616fee08d..0000000000 --- a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1) -description: How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1) -author: dansimp -ms.assetid: ca0bd514-2bbf-4130-8c77-98d991cbe016 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1) - - -You can use App-V Package Accelerators to automatically generate a new virtual application package. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -**Important** -Disclaimer: The Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer. - - - -**Note** -Before starting this procedure, copy the required Package Accelerator locally to the computer running the App-V Sequencer. You should also copy all required installation files for the package to a local directory on the computer running the Sequencer. This is the directory that you have to specify in step 5 of this procedure. - - - -Use the following procedure to create a virtual application package by using a Package Accelerator. - -**To create a virtual application package by using an App-V Package Accelerator** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. - -3. On the **Select Package Accelerator** page, to specify the Package Accelerator that will be used to create the new virtual application package, click **Browse** to locate the Package Accelerator that you want to use. Click **Next**. - - **Important** - If the publisher of the Package Accelerator cannot be verified and does not contain a valid digital signature, in the **Security Warning** dialog box, you must confirm that you trust the source of the Package Accelerator before you click **Run**. - - - -4. On the **Guidance** page, review the publishing guidance information displayed in the information pane. The information displayed was added when the Package Accelerator was created and contains information about creating and publishing the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. - -5. On the **Select Installation Files** page, to create a local folder that contains all required installation files for the package, click **Make New Folder** and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer running the Sequencer, click **Browse** to select the folder. - - Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. - - **Note** - You can specify the following types of supported installation files: - - - Windows Installer files(**.msi** - - - .cab files - - - Compressed files with a .zip file name extension - - - The actual application files - - The following file types are not supported: **.msp** and.exe files. If you specify an **.exe** file you must extract the installation files manually. - - - -~~~ -If the Package Accelerator requires an application be installed prior to applying the Package Accelerator and you have installed the application, on the **Local Installation** page, select the check box **I have installed all applications**, and then click **Next**. -~~~ - -6. On the **Package Name** page, specify a name that will be associated with the package. The name specified identifies the package in the App-V Management Console. Click **Next**. - -7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package you are creating. To confirm the location where the package is created, review the information displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - To create the package, click **Create**. After the package has been created, click **Next**. - -8. On the **Configure Software** page, to enable the Sequencer to configure the applications contained in the package, select **Configure Software**. This step is useful for configuring any associated tasks that must be completed to run the application on target computers, such as configuring any associated license agreements. - - If you select **Configure Software**, the following items are configured by the Sequencer as part of this step: - - - **Load Package**. The Sequencer loads the files associated with the package. It can take several seconds to up to an hour to decode the package. - - - **Run Each Program**. Optionally run the programs contained in the package. This step is helpful for completing any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**. - - - **Save Package**. The Sequencer saves the package. - - - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. - - If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**. - -9. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md). - -## Related topics - - -[Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md deleted file mode 100644 index ca8c706037..0000000000 --- a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Apply an App-V Project Template (App-V 4.6 SP1) -description: How to Apply an App-V Project Template (App-V 4.6 SP1) -author: dansimp -ms.assetid: 8ef120ab-8cfb-438c-8136-671167b7bd9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply an App-V Project Template (App-V 4.6 SP1) - - -You can use an App-V project template to apply common settings associated with an existing virtual application package to a new virtual application package. Using App-V project templates can help streamline the process of creating virtual application packages by configuring common settings before you begin sequencing an application. - -**Note**   -You can only apply an App-V project template when you are creating a new virtual application package. Applying project templates to existing virtual application packages is not supported. Additionally, you cannot use a project template in conjunction with a Package Accelerator. - - - -For more information about creating App-V project templates, see [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md). - -**To apply an App-V project template** - -1. To start the Microsoft Application Virtualization Sequencer, on the computer on which App-V Sequencer is installed, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To create a new virtual application package by using an App-V project template, click **File** / **New From Template**. - -3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**. - -4. Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. For more information about creating a new virtual application package, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md), and select the appropriate procedure. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md deleted file mode 100644 index f24d17b75f..0000000000 --- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Assign the Proper Credentials for Windows Vista -description: How to Assign the Proper Credentials for Windows Vista -author: dansimp -ms.assetid: cc11d2af-a350-4d16-ba7b-f9c1d89e14b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Assign the Proper Credentials for Windows Vista - - -Use the following procedure to configure the App-V Desktop Client for proper Windows Vista credentials. - -**Note**   -This procedure must be completed on each non-domain joined computer. Depending on the number of non-domain joined computers in your environment, this could be a very tedious operation. You can use scripts and the command-line interface for Credential Manager to help administrators automate this process. - - - -**To assign the proper credentials for App-V clients running Windows Vista** - -1. With administrator privileges on the App-V Desktop Client running Windows Vista, open the **User Accounts** control panel (Classic Control Panel). - -2. Select **Manage your network passwords** from **User Accounts** in the left tasks pane. - -3. Select **Add** on the **Stored User Names and Passwords** screen. - -4. On the **Stored Credential Properties** screen, provide the information for the App-V infrastructure: - - 1. **Log on to:** External name of the publishing server. - - 2. **User name:** User name for the external user in the form Domain\\Username. - - 3. **Password:** Password for the user account entered in the **User name** field. - - 4. Leave **Credential Type** selected, and click **OK**. - -5. Click **Close**. The credentials are stored in the credential store for proper authentication to the App-V infrastructure. - -## Related topics - - -[Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) - -[How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md deleted file mode 100644 index 9e1d52e3fc..0000000000 --- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Assign the Proper Credentials for Windows XP -description: How to Assign the Proper Credentials for Windows XP -author: dansimp -ms.assetid: cddbd556-d8f9-4981-a947-6e8e3f552b70 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Assign the Proper Credentials for Windows XP - - -Use the following procedure to configure the App-V Desktop Client for proper Windows XP credentials. - -**Note**   -After finishing this procedure, the non-domain joined client can perform a publishing refresh without being joined to a domain. - - - -**To assign the proper credentials for App-V clients running Windows XP** - -1. With administrator privileges on the App-V Client running Windows XP, open the **User Accounts** control panel (Classic Control Panel). - -2. Click the **Advanced Tab**, and select **Manage Passwords**. - -3. On the **Stored User Names and Passwords** screen, click **Add**. - -4. On the **Logon Information Properties** screen, fill out the following fields with information from the App-V infrastructure: - - 1. **Server:** Name of publishing server external name. - - 2. **User name:** User name for external user in the form Domain\\username. - - 3. **Password:** Password for the user account entered in the **User name** field. - -5. Click **OK**. The credentials will be stored on the client. - -## Related topics - - -[Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) - -[How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md b/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md deleted file mode 100644 index 84d62ca579..0000000000 --- a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Associate an Application with a License Group -description: How to Associate an Application with a License Group -author: dansimp -ms.assetid: 85639db3-5751-497e-a9e7-ce4770c0b55f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Associate an Application with a License Group - - -You can enforce licensing restrictions on an application by associating the application with a license group in the Application Virtualization Server Management Console. Depending on the type of license group, you control who has access to the application and how many users can access an application at a time. You can also access license compliance reports for the application. - -**Important**   -One or more application license groups must exist for you to associate an application with a license group. - - - -**To associate an application with a license group** - -1. In the left pane of the management console, expand the **Applications** node. - -2. Right-click the application you want to add to a license group, and choose **Properties**. - -3. On the **General** tab, use the **Application License Group** pull-down menu to choose the group. - -4. Click **OK**. - - **Note**   - You can alter the **Properties** tab of one application at a time. - - - -## Related topics - - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-branch-a-package.md b/mdop/appv-v4/how-to-branch-a-package.md deleted file mode 100644 index 9b2ab8c069..0000000000 --- a/mdop/appv-v4/how-to-branch-a-package.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Branch a Package -description: How to Branch a Package -author: dansimp -ms.assetid: bfe46a8a-f0ee-4a71-9e9c-64ac08aac9c1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Branch a Package - - -Use this procedure to modify an existing sequenced application package so you can run it side-by-side with the original sequenced application package. This process is called branching. When you branch a virtual application package you are able to run two versions of the same package. For example, you can apply a service pack to an existing package, and run it side-by-side with the original sequenced virtual application package. - -Use the following procedure to branch a sequenced virtual application package. - -**To branch a sequenced virtual application package** - -1. Open the Microsoft Application Virtualization (App-V) Sequencer. To specify the destination directory that contains the package (.sprj) you want to branch select **File**, **Open**. - -2. Navigate to the directory that contains the sequenced application you plan to branch and click **Open**. - -3. To save a copy of the package, in the App-V Sequencer, select **File**, **Save As**. Specify a new, unique name, and specify a new unique package root directory for the copy of the package. Click **Save**. - - **Important** - You must specify a new package name or you will overwrite the existing version of the package. - - - -~~~ -The sequencer will automatically generate new GUID files for the new package. The version number associated with the package will also be automatically appended to the OSD file name. -~~~ - -4. After you save the new version you can apply the required configuration changes and save the associated ICO, OSD, SFT, and SPRJ files to correct location on the Application Virtualization (App-V) server. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md deleted file mode 100644 index 32dfc28858..0000000000 --- a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Cancel Loading of Virtual Applications from the Desktop Notification Area -description: How to Cancel Loading of Virtual Applications from the Desktop Notification Area -author: dansimp -ms.assetid: 4420a091-a344-48e9-a354-93bc0e2470eb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Cancel Loading of Virtual Applications from the Desktop Notification Area - - -From the desktop notification area, you can cancel the loading of applications into the cache. Applications are loaded one application at a time; the progress bar shows you the application name, the percentage of application loaded, and the number of applications already processed compared to the total number of the applications queued. You can cancel any application load in progress before it is 100% loaded. You can skip the loading of all remaining applications as well. - -**To cancel loading applications** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Cancel** and **Load All** from the pop-up menu. - -3. Click one of the following buttons in the **Microsoft App Virt - Confirm Cancel** dialog to achieve the desired results: - - 1. **Skip**—To skip the currently loading application. - - 2. **Skip All**—To skip all remaining applications. - - 3. **Continue**—To cancel the dialog box and continue loading applications. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-an-application-icon.md b/mdop/appv-v4/how-to-change-an-application-icon.md deleted file mode 100644 index 9e9dbf95b0..0000000000 --- a/mdop/appv-v4/how-to-change-an-application-icon.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: How to Change an Application Icon -description: How to Change an Application Icon -author: dansimp -ms.assetid: bd6cfb22-086b-43fd-b6f9-1907b5f16e83 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change an Application Icon - - -You can use the following procedure to change an icon associated with the selected application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To change an application icon** - -1. Move the cursor to the **Results** pane, and right-click the desired application. - -2. Select **Properties**. - -3. On the **General** tab, click **Change Icon**. - -4. Select the desired icon, or browse to another location to select the icon. After you've selected the icon, click **OK**. The new icon appears in the **Results** pane. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-an-application-iconserver.md b/mdop/appv-v4/how-to-change-an-application-iconserver.md deleted file mode 100644 index 19445774d2..0000000000 --- a/mdop/appv-v4/how-to-change-an-application-iconserver.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Change an Application Icon -description: How to Change an Application Icon -author: dansimp -ms.assetid: 52c870eb-4a54-410b-8abf-79395a53f846 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change an Application Icon - - -You can use the following procedure to change an icon associated with the selected application directly from the **Results** pane of the **Application** node in the Application Virtualization Server Management Console. - -**To change an application icon** - -1. Right-click the application, and select **Properties** from the pop-up menu. - -2. On the **General** tab, click the **Browse** button next to **Icon Path**. - -3. Select the desired icon, or browse to another location to select the icon. After you've selected the icon, click **Open**. Click **OK** to apply. - - The new icon appears in the **Results** pane. The new icon is also displayed in the menus and in the client desktop notification area. - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-deployment-properties.md b/mdop/appv-v4/how-to-change-deployment-properties.md deleted file mode 100644 index f9eb0b5d3f..0000000000 --- a/mdop/appv-v4/how-to-change-deployment-properties.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Change Deployment Properties -description: How to Change Deployment Properties -author: dansimp -ms.assetid: 0a214a7a-cc83-4d04-89f9-5727153be918 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change Deployment Properties - - -You can use the following procedures to change the **Deployment** tab information for an application you are sequencing, including the Application Virtualization server URL, the operating systems required by the virtualized applications, and the output options for the virtual application to be installed. - -**To change the server URL** - -1. Select the streaming protocol from the drop-down list box. - -2. Enter the host name of the virtual application server or the server group's load balancer. You can use the actual host name or IP address. - -3. Specify the port number on which the virtual application server or load balancer will listen for an Application Virtualization Desktop Client request for the streamed application. - -4. Specify the relative path on the virtual application server where the software package is stored. - -**To change the application operating systems requirements** - -1. To add the required operating system(s), select it in the **Available** list and click the arrow button pointing to the **Selected** operating systems list control. - -2. To remove an operating system, select it in the **Selected** list control, and click the arrow button pointing to the **Available** operating systems list control. - -**To change the application output options** - -1. From the **Compression Algorithm** drop-down list, select the compression method to use when streaming the application. - -2. Select the **Enforce Security Descriptors** check box to ensure security descriptors of the packaged applications are enforced when deployed. - -3. Select **Generate Difference File** to generate a difference file for the application from the previous sequenced version. - -4. Select **Generate Microsoft Windows Installer (MSI) Package** to create an installer package. - -## Related topics - - -[About the Deployment Tab](about-the-deployment-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-import-search-paths.md b/mdop/appv-v4/how-to-change-import-search-paths.md deleted file mode 100644 index fef1c273d9..0000000000 --- a/mdop/appv-v4/how-to-change-import-search-paths.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Change Import Search Paths -description: How to Change Import Search Paths -author: dansimp -ms.assetid: 0125f2bf-4958-4854-a5a4-a63afe5bb986 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change Import Search Paths - - -You can use the following procedure to change the import search path directly from the **Application Virtualization** node in the Application Virtualization Client Management Console. The import search path is used by the client to find the SFT file when you use the console to import an SFT file. If it can find the file in this search path, it will not need to prompt you for a path. - -**To change the import search path** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **Import Search Path** tab in the **Properties** dialog box, click **Add** to display a standard **Browse** dialog box and browse to the desired location. - -3. Highlight a path, and click **Remove** to delete this path. - -4. Use the **Move Up** and **Move Down** buttons to control the order in which the paths will be searched. - -5. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[How to Import an Application](how-to-import-an-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-package-properties.md b/mdop/appv-v4/how-to-change-package-properties.md deleted file mode 100644 index 565e4c27e9..0000000000 --- a/mdop/appv-v4/how-to-change-package-properties.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Change Package Properties -description: How to Change Package Properties -author: dansimp -ms.assetid: 6050916a-d4fe-4dac-8f2a-47308dbbf481 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change Package Properties - - -You can use the following procedures to modify an Application Virtualization package name and its associated comments. - -If this is the first time the package has been created, you can also change the sequencing parameter block size, which determines how a sequenced application package is streamed from an Application Virtualization Server to an Application Virtualization Desktop Client. - -**Note**   -When selecting a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network, but it is less bandwidth intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network. - - - -The remainder of the package properties on the **Properties** tab is automatically generated and cannot be modified on this tab. - -**To change the package name or comments** - -1. Click the **Properties** tab. - -2. In the **Package Name** text box, enter or edit the single name used for the package, which can contain multiple applications. - -3. In the **Comments** text box, optionally enter or edit any comments. The suggested best practice is to provide detail information about the package and sequencing. - -4. From the **File** menu, select **Save**. - -**To change the block size** - -1. Click the **Properties** tab. - -2. On the **Block Size** drop-down list, select **4 KB**, **16 KB**, **32 KB**, or **64 KB**. - -3. From the **File** menu, select **Save**. - -## Related topics - - -[About the Properties Tab](about-the-properties-tab.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md b/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md deleted file mode 100644 index 0aed8a88e3..0000000000 --- a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Change the Cache Size and the Drive Letter Designation -description: How to Change the Cache Size and the Drive Letter Designation -author: dansimp -ms.assetid: e7d7b635-079e-41aa-a5e6-655f33b4e317 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Cache Size and the Drive Letter Designation - - -You can change the cache size and drive letter designation directly from the **Application Virtualization** node in the Application Virtualization Client Management Console. - -**Note** -After the cache size has been set, it cannot be made smaller. - - - -**To change the cache size** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. Select the **File System** tab on the **Properties** dialog box. In the **Client Cache Configuration Settings** section, click one of the following radio buttons to choose how to manage the cache space: - - **Important** - If you select the **Use free disk space threshold** setting, the value you enter will set the cache size to the total disk size minus the free disk space threshold number you entered. If you then want revert to using the **Use maximum cache size** setting, you must specify a larger number than the existing cache size. Otherwise, the error “New size must be larger than the existing cache size” will appear. - - - -~~~ -- **Use maximum cache size** - - Enter a numeric value from 100 to 1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. The value shown in **Reserved Cache Size** indicates the amount of cache in use. - -- **Use free disk space threshold** - - Enter a numeric value to specify the amount of free disk space, in MB, that the cache must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is unused. -~~~ - -3. Click **OK** or **Apply** to change the setting. - -**To change the drive letter designation** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **File System** tab in the **Properties** dialog box, in the **Drive to use** field, select the desired drive letter from the drop-down list of available drive letters. This setting becomes effective when the computer is rebooted. - -3. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md b/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md deleted file mode 100644 index 4c3247ee57..0000000000 --- a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Change the Log Reporting Levels and Reset the Log Files -description: How to Change the Log Reporting Levels and Reset the Log Files -author: dansimp -ms.assetid: 9561d6fb-b35c-491b-a355-000064583194 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Log Reporting Levels and Reset the Log Files - - -You can use the following procedure to change the log reporting level from the **Application Virtualization** node in the Application Virtualization Management Console. When the log file reaches the maximum size (default is 256 MB), a reset is forced when the next write to the log occurs. A reset causes a new log file to be created, and the old file is renamed as a backup. - -**To change the log reporting level** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **General** tab in the **Properties** dialog box, from the **Log Level** drop-down list, select the desired log level. - - **Note**   - If you choose **Verbose** as the logging level, the log files will grow large very quickly. This might inhibit client performance, so best practice is to use this log level only for diagnosing specific problems. - - - -3. On the **General** tab in the **Properties** dialog box, from the **System Log Level** drop-down list, select the desired log level. - - **Note**   - The **System Log Level** setting controls the level of messages sent to the system event log. The logged messages are identical to the messages that get logged to the client event log, but they are stored in a different location. - - - -4. Click **OK** or **Apply** to change the setting. - -**To reset the log file** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **General** tab in the **Properties** dialog box, click **Reset Log** to back up the current log file and immediately start a new log file. The backup log files are stored in the same folder. - -3. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-server-cache-size.md b/mdop/appv-v4/how-to-change-the-server-cache-size.md deleted file mode 100644 index 5b61e12a03..0000000000 --- a/mdop/appv-v4/how-to-change-the-server-cache-size.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Change the Server Cache Size -description: How to Change the Server Cache Size -author: dansimp -ms.assetid: 24e63744-21c3-458e-b137-9592f4fe785c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Server Cache Size - - -You can use the following procedure to change the cache size for any server directly from the Application Virtualization Server Management Console. - -**Note**   -Although you can change the cache size, unless your configuration specifically requires you to change the size, it is recommended that you leave the cache size set to the default values. - - - -**To change the server cache size** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. In the **Results** pane, double-click the desired server group to display the list of servers in the group. - -3. In the **Results** pane, right-click the desired server and select **Properties**. - -4. Select the **Advanced** tab. - -5. Enter a value in the **Maximum Memory Allocation** field for the server cache, and enter a value for the threshold warning level in the **Warn Memory Allocation** field. - -6. Enter a value in the **Maximum Block Size** field. This number must be greater than or equal to the maximum block size of the largest package that will be streamed from the server. - -7. Click **OK**. - -## Related topics - - -[How to Change the Server Port](how-to-change-the-server-port.md) - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md b/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md deleted file mode 100644 index baeeef43e1..0000000000 --- a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md +++ /dev/null @@ -1,142 +0,0 @@ ---- -title: How to Change the Server Logging Level and the Database Parameters -description: How to Change the Server Logging Level and the Database Parameters -author: dansimp -ms.assetid: e3ebaee5-6c4c-4aa8-9766-c5aeb00f477a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Server Logging Level and the Database Parameters - - -You can use the following procedures to change the logging level and the database log parameters from the Application Virtualization Server Management Console. - -The following logging levels are available: - -- Transaction Only - -- Fatal Errors - -- Errors - -- Warnings/Errors - -- Info/Warnings/Errors - -- Verbose - -**Note**   -Because of the size of the log file produced when you use **Verbose** mode, the recommendation is that you do not run production servers with this level of logging set. - - - -The database logging parameters determine the database driver type, access credentials, and location of the logging database. - -**To change the logging level for Management Servers** - -1. Click the **Server Groups** node to display the server groups. - -2. Right-click the server group, and select **Properties**. - -3. In the **Properties** dialog box, select the **Logging** tab. - -4. In the **Server Group Properties** dialog box, select the server and then click **Edit**. - -5. In the **Add/Edit Log Module** dialog box, select the logging level from the **Event Type** drop-down list. - -6. Click **OK**. - -7. In the **Server Group Properties** dialog box, click **OK** or **Apply**. - -**To change the logging level for Streaming Servers** - -1. Edit the following registry key value to change the logging level: - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\DistributionServer\\LogLevel - -2. Select one of the following values to set the logging level. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ValueLogging Level

          0

          Transactions Only

          1

          Fatal Errors

          2

          Errors

          3

          Warnings/Errors

          4

          Information/ Warnings/Errors

          5

          Verbose

          - - - -**To change database log parameters** - -1. Click the **Server Groups** node to display the server groups. - -2. Right-click the server group, and select **Properties**. - -3. In the **Properties** dialog box, select the **Logging** tab. - -4. In the **Server Group Properties** dialog box, select the server and then click **Edit**. - -5. In the **Add/Edit Log Module** dialog box, select a database driver from the **Database Driver** drop-down list. - -6. Enter a **DNS Host Name**. - -7. Click the **Dynamically Determine Port** check box, or enter a port number in the **Port** field. - -8. Enter a **Service Name** in the corresponding field. - -9. Click **OK**. - -10. On the **Server Group Properties** dialog box, click **OK** or **Apply**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-server-port.md b/mdop/appv-v4/how-to-change-the-server-port.md deleted file mode 100644 index 14d1933fb9..0000000000 --- a/mdop/appv-v4/how-to-change-the-server-port.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Change the Server Port -description: How to Change the Server Port -author: dansimp -ms.assetid: 0b4a262c-4816-48d0-b7c6-e496bb0d7370 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Server Port - - -From the Application Virtualization Server Management Console, you can use the following procedure to change the server communication port for any server. - -**To change the server port** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. In the **Results** pane, double-click the desired server group to display the list of servers in the group. - -3. In the **Results** pane, right-click the desired server and select **Properties.** - -4. Select the **Ports** tab. - -5. Enter the **Port** number. - - **Note**   - The port number can be any value between 1 and 65,535. The default values are 554 for RTSP and 322 for RTSPS. - - - -6. Click **OK** to change the port number. - -7. Click **OK** to exit the dialog box. - -8. Click **OK** at the prompt. - -## Related topics - - -[How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md b/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md deleted file mode 100644 index db72c07843..0000000000 --- a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Change the Size of the FileSystem Cache -description: How to Change the Size of the FileSystem Cache -author: dansimp -ms.assetid: 6ed17ba3-293b-4482-b3fa-31e5f606dad6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Size of the FileSystem Cache - - -You can change the size of the FileSystem cache by using the command line. This action requires a complete reset of the cache, and it requires administrative rights. - -**To change the size of the FileSystem cache** - -1. Set the following registry value to 0 (zero): - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\State - -2. Set the following registry value to the maximum cache size, in MB, that is necessary to hold the packages—for example, 8192 MB: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\FileSize - -3. Restart the computer. - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-user-access-permissions.md b/mdop/appv-v4/how-to-change-user-access-permissions.md deleted file mode 100644 index e935af3cad..0000000000 --- a/mdop/appv-v4/how-to-change-user-access-permissions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Change User Access Permissions -description: How to Change User Access Permissions -author: dansimp -ms.assetid: 21b60cc7-5395-401e-a374-6ef0d58872b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change User Access Permissions - - -Use the following procedure to change user access permissions in the Application Virtualization Client Management Console. - -**Note**   -Before changing users access permissions, ensure that any permissions changes are consistent with the organization's guidelines for granting user access. - - - -**To change user access permissions** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **Permissions** tab on the **Properties** dialog box, scroll through the list of permissions and select the check boxes that correspond to the permissions you want to grant to users of this computer. Administrators have access to all the permissions regardless of the settings on this tab. - -3. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-clear-an-application.md b/mdop/appv-v4/how-to-clear-an-application.md deleted file mode 100644 index 2fba3e47a3..0000000000 --- a/mdop/appv-v4/how-to-clear-an-application.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to Clear an Application -description: How to Clear an Application -author: dansimp -ms.assetid: 247b8f40-531c-413e-a2e5-fc990ed0a51a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Clear an Application - - -You can clear an application from the console directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you clear an application, the system removes the settings, shortcuts, and file type associations that correspond to the application and also removes the application from the user’s list of applications. - -**Note**   -When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. If there are multiple applications in a package, the user's settings are not removed until all of the applications are cleared. - - - -**To clear an application from the console** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Clear** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md deleted file mode 100644 index 0a694a6795..0000000000 --- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: How to Configure a Read-only Cache on the App-V Client (RDS) -description: How to Configure a Read-only Cache on the App-V Client (RDS) -author: dansimp -ms.assetid: b6607fe2-6f92-4567-99f1-d8e3c8a591e0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure a Read-only Cache on the App-V Client (RDS) - - -**Important**   -You must be running App-V 4.6, SP1 to use this procedure. - - - -You can deploy the App-V client by using a shared cache that is populated with all the applications required for all users. Then you configure the App-V Remote Desktop Services (RDS) Clients to use the same cache file. Users are granted access to specific applications by using the App-V publishing process. Because the cache is already preloaded with all applications, no streaming occurs when a user starts an application. However, the packages used to prepopulate the cache must be put on an App-V server that supports Real Time Streaming Protocol (RTSP) streaming and that grants access permissions to the App-V Clients. If you publish the applications by using an App-V Management Server, you can use it to provide this streaming function. - -**Note**   -The details outlined in these procedures are intended as examples only. You might use different methods to complete the overall process. - - - -## Deploying the App-V Client in an RDS Scenario - - -The deployment process consists of four primary tasks: - -- Creating and populating the master shared cache file - -- Copying the shared cache file to the server storage - -- Configuring the App-V client software - -- Managing the update deployment cycle for the shared cache file after the initial deployment - -These tasks require careful planning. We recommend that you prepare and document a methodical, reproducible process for your organization to follow. This is especially important for the preparation and deployment of the master shared cache file, and for the ongoing management of application updates, each of which require an update to the master shared cache. Use the following procedures to complete these primary tasks. - -**Note**   -Although you can publish the applications by using several different methods, the following procedures are based on your using an App-V Management Server for publishing. - - - -**To configure the read-only cache for initial deployment** - -1. Set up and configure an App-V Management Server to provide user authentication and publishing support. - -2. Populate the Content folder of this Management Server with all the application packages required for all users. - -3. Set up a staging computer that has the App-V Client installed. Log on to the staging computer by using an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded. - - **Important** - The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run. - - - -4. Restart the staging computer in safe mode to make sure that the drivers are not started, because this would lock the cache file. - - **Note** - Or, you can stop and disable the Application Virtualization service, and then restart the computer. After the file is copied, remember to enable and start the service again. - - - -5. Copy the Sftfs.fsd cache file to a SAN where all the RDS servers can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName. - - **Important** - You must put the FSD file in a location that has the responsiveness and reliability equal to locally attached storage performance, for example, a SAN. - - - -6. Install the App-V RDS Client on each RDS server, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 32-bit computers and at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 64-bit computers. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KeyTypeValuePurpose

          FileName

          String

          path of FSD

          Specifies the path of the shared cache file, for example, \RDSServername\Sharefolder\SFTFS.FSD (Required).

          ReadOnlyFSD

          DWORD

          1

          Configures the client to operate in Read-Only mode. This ensures that the client will not try to stream updates to the package cache. (Required)

          ErrorLogLocation

          String

          path of error log (.etl) file

          Entry used to specify the path of the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).

          - - - -7. Configure each RDS server in the farm to use the publishing server and to use publishing update when users log on. As users log on to the RDS servers, a publishing update cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache. - -**To configure the RDS client for package upgrade** - -1. Complete the upgrade and testing of the application package. - -2. Upgrade the package on the App-V server. Then, publish and stream the new version of the applications to the client on the staging computer so that they are fully loaded into cache. - -3. Restart the staging computer in safe mode to ensure the drivers are not started. - - **Note**   - Or, you can first stop and then disable the Application Virtualization service in the Services.msc, and restart the computer. After the file has been copied, remember to enable and start the service again. - - - -4. Copy the Sftfs.fsd cache file to a SAN where all the RDS servers can access it, such as in a shared folder. You can use a different file name, for example, SFTFS\_V2.FSD, to distinguish the new version. - -5. To configure the App-V RDS Client on each RDS server in the farm to use the updated shared cache file, change the AppFS registry key FILENAME value to point to the location of the updated file, for example, \\\\RDSServername\\Sharefolder\\SFTFS\_V2.FSD. This guarantees that each RDS server receives the updated copy of the cache when the App-Vclient drivers restart. - - **Important**   - You must restart the RDS servers in order to use the updated shared cache file. - - - -## How to Use Symbolic Links when Upgrading the Cache - - -Instead of changing the AppFS key FILENAME value every time that a new cache file is deployed that contains new or upgraded packages, you can use a symbolic link in the following operating systems: Windows Vista, Windows 7, and Windows Server 2008. For more information about symbolic links, see [Symbolic Links](https://go.microsoft.com/fwlink/?LinkId=157626) (https://go.microsoft.com/fwlink/?LinkId=157626). In contrast, Windows XP does not support the use of symbolic links, and you must use junction points instead. For more information about junctions, see [article 205524](https://go.microsoft.com/fwlink/?LinkId=182553) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=182553), and also the tool [Junction v1.05](https://go.microsoft.com/fwlink/?LinkId=182554) (https://go.microsoft.com/fwlink/?LinkId=182554). - -**To configure a symbolic link to reference the cache** - -1. During the initial deployment stage, open a Command Prompt window as a local administrator on the RDS server host operating system. - -2. Create a symbolic link by using the MKLINK command, and then configure it to point to the Sftfs.fsd file. - - **     mklink symlinkname \\\\rdshostserver\\sharefolder\\sftfs.fsd** - -3. On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled. - - **fsutil behavior set SymlinkEvaluation R2R:1** - - **Note**   - On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**. - - - -4. When you configure the App-V RDS Client, set the AppFS key FILENAME value equal to the UNC path of the FSD file that is using the symbolic link. For example, set the file name to \\\\VDIHostserver\\Symlinkname. When the App-V client first accesses the cache, the symbolic link passes to the client a handle to the cache file. The client continues to use that handle as long as the client is running. The value of the symbolic link can safely be updated even if existing clients have the old shared cache open. - -5. When you must upgrade a package or to add a new package to the cache, follow steps 1 through 4 of the upgrade procedure. Then, delete the symbolic link and re-create it to point to the new version of the shared cache file. This guarantees that each RDS server receives the updated copy of the cache when the App-V client drivers restart. When the RDS server is restarted, the App-V client receives a handle to the updated copy of the cache because the client uses the path that contains the updated symbolic link. Then, the users have access to the new and updated applications. - -## Related topics - - -[How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md deleted file mode 100644 index 8fd997eafd..0000000000 --- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md +++ /dev/null @@ -1,197 +0,0 @@ ---- -title: How to Configure a Read-only Cache on the App-V Client (VDI) -description: How to Configure a Read-only Cache on the App-V Client (VDI) -author: dansimp -ms.assetid: 7a41e017-9e23-4a6a-a659-04d23f008b83 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure a Read-only Cache on the App-V Client (VDI) - - -In Microsoft Application Virtualization (App-V) 4.6 the Client supports using a shared read-only cache. The shared read-only cache enables the Client to use disk space efficiently in a Virtual Desktop Infrastructure (VDI) system, where users run applications on Virtual Machines (VM) that are hosted in a data center server environment and share network storage on a Storage Area Network (SAN). The following procedures provide an overview of the process that is required to implement the App-V Client in either of the primary VDI architectures, known as “Pooled VM” or “Static VM”. It is assumed that you are familiar with the planning, deployment, and operation of the App-V system and its components, and also the operation and management of the VDI server. For more information about App-V, see [Application Virtualization](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939) - -**Note**   -The details outlined in these procedures are intended as examples only. You might use different methods to complete the overall process. - - - -## Deploying the App-V Client in a VDI Scenario - - -You can deploy the App-V Client in a VDI scenario by using a shared read-only cache that has been populated with all the applications required for all users. You then configure the VDI Master VM Image so that all the App-V Clients use the same cache file. Users are granted access to specific applications by using the App-V publishing process. Since the cache is already preloaded with all applications, no streaming occurs when a user starts an application. However, the packages used to prepopulate the cache must be put on an App-V server that supports Real Time Streaming Protocol (RTSP) streaming and that grants access permissions to the App-V Clients. If you publish the applications by using an App-V Management Server, you can use it to provide this streaming function. - -The deployment process consists of four primary tasks: - -- Creating and populating the master shared cache file - -- Copying the shared cache file to the VDI server storage - -- Configuring the App-V client software on the VDI Master Image - -- Managing the update deployment cycle for the shared cache file after the initial deployment - -These tasks require careful planning. We recommend that you prepare and document a methodical, reproducible process for your organization to follow. This is especially important for the initial preparation and deployment of the master shared cache file, and for the on-going management of application updates, each of which require an update to the master shared cache. Use the following procedures to complete these primary tasks. - -**Note**   -Although you can publish the applications by using several different methods, the following procedures are based on the use of an App-V Management Server for publishing. - - - -**To configure the read-only cache for initial deployment in a Pooled VM VDI or Static VM VDI scenario** - -1. Set up and configure an App-V Management Server in a VM on the VDI server to provide user authentication and publishing support. - -2. Populate the Content folder of this Management Server with all the application packages required for all users. - -3. Set up a staging computer that has the App-V Client installed. Log on to the staging computer with an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded. - - **Important** - The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run. - - - -4. Restart the staging computer in Safe Mode to ensure the drivers are not started, which would lock the cache file. - - **Note** - Alternatively, you can stop and disable the Application Virtualization service, and then restart the computer. After the file has been copied, remember to enable and start the service again. - - - -5. Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName. - - **Important** - You must put the FSD file in a location that has the responsiveness and reliability equivalent to locally attached storage performance, for example, a SAN. - - - -6. Install the App-V Desktop Client on the VDI Master VM Image, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\[Wow6432Node\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KeyTypeValuePurpose

          FileName

          String

          path to FSD

          Specifies the path to the shared cache file, for example, \VDIServername\Sharefolder\SFTFS.FSD (Required).

          ReadOnlyFSD

          DWORD

          1

          Configures the client to operate in Read-Only mode. This ensures that the client will not attempt to stream updates to the package cache. (Required)

          ErrorLogLocation

          String

          path to error log (.etl) file

          Entry used to specify the path to the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).

          - - - -7. Configure the Master VM Image client to use the publishing server and to use publishing refresh at logon. As users log on to the VDI system and their VM is built from the Master VM Image, a publishing refresh cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache. - -**To configure the client for package upgrade in a Pooled VM scenario** - -1. Complete the upgrade and testing of the application package. - -2. Upgrade the package on the App-V server. Then, publish and stream the new version of the applications to the client on the staging computer so that they are fully loaded into cache. - -3. Restart the staging computer in Safe Mode to ensure the drivers are not started. - - **Note**   - Alternatively, you can stop and disable the Application Virtualization service in the Services.msc, and then restart the computer. After the file has been copied, remember to enable and start the service again. - - - -4. Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. You can use a different filename, for example, SFTFS\_V2.FSD, to distinguish the new version. - -5. To configure the App-V Desktop Client on the VDI Master VM Image to use the updated shared cache file, change the AppFS registry key FILENAME value to point to the location of the updated file, for example, \\\\VDIServername\\Sharefolder\\SFTFS\_V2.FSD. When users log off and then log on again, a new VM is created for them by using the updated Master Image. All their user settings will be retained and applied to the new VM. Then they have access to the updated applications. - -**To configure the client for package upgrade in a Static VM scenario** - -1. Complete the upgrade and testing of the application package. - -2. Upgrade the package on the App-V server. Then, publish and stream the new version of the applications to the client on the staging computer so that the applications are fully loaded into cache. - -3. Restart the staging computer in Safe Mode to ensure that the drivers are not started. - - **Note**   - Alternatively, you can stop and disable the Application Virtualization service in the Services.msc, and then restart the computer. After the file has been copied, remember to enable and start the service again. - - - -4. Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. You can use a different filename, for example, SFTFS\_V2.FSD, to distinguish the new version. - -5. To configure the App-V Desktop Client on the VDI Master VM Image to use the updated shared cache file, change the AppFS registry key FILENAME value to point to the location of the updated file, for example, \\\\VDIServername\\Sharefolder\\SFTFS\_V2.FSD. This ensures that new users get the new version. - -6. Create a script that edits the AppFS key FILENAME value to set it to the location of the updated cache, for example, \\\\VDIServername\\Sharefolder\\SFTFS\_V2.FSD. Configure this script to run when the user logs off or logs on so that it runs before the App-V client drivers start, for example, by using Group Policy settings. When users log off and log on again, their existing VM is updated, and they will use the updated copy of the cache. Then, they have access to the updated applications. - -## How to Use Symbolic Links when Upgrading the Cache - - -Instead of modifying the AppFS key FILENAME value every time that a new cache file is deployed that contains new or upgraded packages, you can use a symbolic link in the following operating systems: Windows Vista, Windows 7, and Windows Server 2008. For more information about symbolic links, see [Symbolic Links](https://go.microsoft.com/fwlink/?LinkId=157626) (https://go.microsoft.com/fwlink/?LinkId=157626). In contrast, Windows XP does not support the use of symbolic links, and you must use junction points instead. For more information about junctions, see [article 205524](https://go.microsoft.com/fwlink/?LinkId=182553) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=182553), and also the tool [Junction v1.05](https://go.microsoft.com/fwlink/?LinkId=182554) (https://go.microsoft.com/fwlink/?LinkId=182554). - -**To configure a symbolic link to reference the cache** - -1. During the initial deployment stage, open a Command Prompt window as a local administrator on the VDI server host operating system. - -2. Create a symbolic link by using the MKLINK command, and then configure it to point to the Sftfs.fsd file. - - **     mklink symlinkname \\\\vdihostserver\\sharefolder\\sftfs.fsd** - -3. On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled. - - **fsutil behavior set SymlinkEvaluation R2R:1** - - **Note**   - On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**. - - - -4. When you configure the App-V Desktop Client on the VDI Master VM Image, set the AppFS key FILENAME value equal to the UNC path of the FSD file that is using the symbolic link; for example, set it to \\\\VDIHostserver\\Symlinkname. When the App-V client first accesses the cache, the symbolic link passes to the client a handle to the cache file. The client continues to use that handle as long as the client is running. The value of the symbolic link can safely be updated even if existing clients have the old shared cache open. - -5. When you must upgrade a package or to add a new package to the cache, follow steps 1 through 5 of the upgrade procedure for either the Static VM or Pooled VM scenario. Then, delete the symbolic link and re-create it to point to the new version of the shared cache file. When the VM is restarted, the client receives a handle to the updated copy of the cache because the VM uses the path that contains the updated symbolic link. Then, the users have access to the new and updated applications. - -## Related topics - - -[How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md deleted file mode 100644 index c14a8c48a6..0000000000 --- a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Configure Management Server Security Post-Installation -description: How to Configure Management Server Security Post-Installation -author: dansimp -ms.assetid: 71979fa6-3d0b-4a8b-994e-cb728d013090 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Management Server Security Post-Installation - - -Use the App-V Management Console to add the certificate and configure the App-V Management Server for enhanced security. You can use the following procedure to configure security post-installation. - -**To configure Management Server security post-installation** - -1. Open the App-V Management Console, and connect to the **Management Service** with App-V administrator privileges. - -2. Expand the server, expand **Server Groups**, and then select the appropriate server group with which the Management Server was registered. - -3. Right-click the Management Server object, and select **Properties**. - -4. On the **Ports** tab, click **Server Certificate** and complete the wizard to select the properly provisioned certificate. - - **Note**   - If no certificates are displayed in the wizard, a certificate has not been provisioned or the certificate does meet the requirements of App-V. - - - -5. Click **Next** to continue on to the **Welcome To Certificate Wizard** page. - -6. Select the correct certificate in the **Available Certificates** screen. - -7. Click **Finish**. - -8. After completing the wizard, clear **RTSP** as an available listening port. This prevents connections from being made over a non-secure communication channel. - -9. Click **Apply**, and restart the **Microsoft Virtual Application Server** service. Use the service’s MMC snap-in to accomplish this task. - -## Related topics - - -[How to Configure Streaming Server Security Post-Installation](how-to-configure-streaming-server-security-post-installation.md) - -[Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md b/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md deleted file mode 100644 index 2b4a53819a..0000000000 --- a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: How to Configure Microsoft SQL Server Mirroring Support for App-V -description: How to Configure Microsoft SQL Server Mirroring Support for App-V -author: dansimp -ms.assetid: 6d069eb5-109f-460a-836a-de49473b7035 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure Microsoft SQL Server Mirroring Support for App-V - - -You can use the following procedure to configure your Microsoft Application Virtualization (App-V) environment to use Microsoft SQL Server database mirroring. Configuring database mirroring can help with disaster recovery and failover scenarios. App-V 4.5 SP2 supports all modes of database mirroring currently available for Microsoft SQL Server 2005 and SQL Server 2008. - -**Note** -This procedure is written for administrators who are familiar with setting up and configuring SQL Server databases and database mirroring with Microsoft SQL Server, and therefore covers only the specific configuration settings that are unique to App-V. - - - -**To configure your App-V environment to use Microsoft SQL Server database mirroring** - -1. Set up SQL Server database mirroring of the App-V database following your standard business practices for database mirroring. Use the following links for general information about implementing Microsoft SQL Server database mirroring: - - - **Microsoft SQL 2005**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187478) (https://go.microsoft.com/fwlink/?LinkId=187478) - - - **Microsoft SQL 2008**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187477) (https://go.microsoft.com/fwlink/?LinkId=187477) - - In addition, you can find Best Practices information in [Database Mirroring Best Practices and Performance Considerations](https://go.microsoft.com/fwlink/?LinkId=190270) (https://go.microsoft.com/fwlink/?LinkId=190270). - -2. After mirroring has been set up, verify that the App-V database shows a status of **(Principal, Synchronized)**, and the mirrored database shows a status of **(Mirror, Synchronized / Restoring)**. Resolve any mirroring issues before proceeding to the next step. For additional information about monitoring the status, see [Monitoring Mirroring Status](https://go.microsoft.com/fwlink/?LinkId=190279) (https://go.microsoft.com/fwlink/?LinkId=190279). - -3. On the SQL Server computer that hosts the mirror of the App-V database, create the SQL Server Login for the network service account of the App-V Management Server by using the account name **<domain>\\<ManagementServerHostName>$**. - -4. Install the Microsoft SQL Server Native Client on the App-V Management Server, and on the computer running the App-V Management Web Service if installed on a different computer. If you plan to have additional App-V Management Servers connect to the mirrored SQL database for load balancing, you must install the Microsoft SQL Server Native Client on those computers as well. You can download the Microsoft SQL Server Native Client from the [Microsoft SQL Server 2008 Feature Pack](https://go.microsoft.com/fwlink/?LinkId=187479) page in the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=187479). - -5. Check the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLServerName** and make sure that it contains only the host name of the SQL Server. If it includes an instance name, for example *serverhostname\\instancename*, the instance name must be removed. - - **Important** - The App-V Management Server uses the TCP/IP networking library to communicate with the SQL Server when database mirroring is enabled, and therefore instance names cannot be used. The port numbers must be specified in the registry keys instead. - - - -6. Check the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLServerPort** and make sure that it contains the port number that is used for SQL on the SQL Server computer. If you are using a named instance this key value must be set to the port that is used for the named instance. - -7. Create the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLFailoverServerName** as REG\_SZ and then set the value to the host name of the SQL Server that hosts the mirror. - -8. Create the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLFailoverServerPort** as DWORD and then set the value to the port number that is used for SQL on the computer that is running SQL Server to host the mirror. If you are using a named instance for the mirror this key value must be set to the port number that is used for the named instance. - -9. On the computer that is running the App-V Management Web Service, configure the Universal Data Link (UDL) text file. In the directory where App-V is installed, double-click **SftMgmt.udl** and specify the following values: - - - On the **Provider** tab, select the OLE DB provider **SQL Server Native Client 10.0**. - - - Click **Next** to select the **Connection** tab. In the **Server Name** box, enter the server name of the SQL Server. Next, select **Use Windows NT Integrated Security**. Finally, click the list **Select the database**, and then select the App-V database name. - - - Click the **All** tab, and then select the entry **Failover Partner**. Click **Edit Value**, and then enter the server name of the failover SQL Server. Click **OK**. - - **Important** - The App-V system uses Kerberos authentication. Therefore, when you configure SQL mirroring where Kerberos Authentication is enabled on the SQL Server and the SQL Server service runs under a domain user account, you must manually configure an SPN. For more information, see “When SQL Service Uses Domain-Based Account” in the article [Configuring App-V Administration for a Distributed Environment](https://go.microsoft.com/fwlink/?LinkId=203186) (https://go.microsoft.com/fwlink/?LinkId=203186). - - - -10. To verify that database mirroring is running correctly, test the failover and confirm that the App-V Management Server continues to function correctly. - - **Important** - Proceed with care, and follow your standard business practices to ensure that system operations are not disrupted in the event of a failure. - - - -~~~ -After the failover has occurred successfully, as verified by using the SQL Server status monitoring information, right-click the **Applications** node in the App-V Management Console, and then select **Refresh**. The list of applications should display normally if the system is working correctly. -~~~ - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md deleted file mode 100644 index 1c79254fd6..0000000000 --- a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Configure Servers for ESD-Based Deployment -description: How to Configure Servers for ESD-Based Deployment -author: dansimp -ms.assetid: 96208522-3a0c-4606-a10b-fc0ec0a12021 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Servers for ESD-Based Deployment - - -This section provides procedures you can use to configure the Application Virtualization Streaming Servers, the IIS server, and the file server for your electronic software distribution–based deployment strategy. - -## In This Section - - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -Provides a step-by-step procedure for configuring the Application Virtualization Streaming Servers. - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -Provides a step-by-step procedure for configuring the IIS server for your electronic software distribution deployment. - -[How to Configure the File Server](how-to-configure-the-file-server.md) -Provides a step-by-step procedure for configuring a local computer that is used as a file share and that streams applications to the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services), for a deployment strategy where your site does not have server-class hardware installed. - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md deleted file mode 100644 index 5a4d8e1932..0000000000 --- a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Configure Servers for Server-Based Deployment -description: How to Configure Servers for Server-Based Deployment -author: dansimp -ms.assetid: 6371c37a-46eb-44e8-ad6b-4430c866c8b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Servers for Server-Based Deployment - - -This section provides procedures you can use to configure the Microsoft System Center Application Virtualization (App-V) Management Servers and Microsoft System Center Application Virtualization Streaming Servers, and the Internet Information Services (IIS) and file servers, as appropriate for your Application Virtualization Server-based deployment strategy. - -## In This Section - - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) -Provides a step-by-step procedure for configuring the Application Virtualization Management Servers. - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -Provides a step-by-step procedure for configuring the Application Virtualization Streaming Servers. - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -Provides a step-by-step procedure for configuring the IIS server for your server-based deployment. - -[How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md) -Provides detailed instructions about how to configure the server to be trusted for delegation. - -[Configuring the Firewall for the App-V Servers](configuring-the-firewall-for-the-app-v-servers.md) -Describes the firewall settings required for the App-V servers. - -[How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md) -Describes how to install and configure the default application for testing the App-V system. - -## Related topics - - -[Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md b/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md deleted file mode 100644 index c668b902eb..0000000000 --- a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: How to Configure Shortcut and File Type Association Behavior -description: How to Configure Shortcut and File Type Association Behavior -author: dansimp -ms.assetid: d6fd1728-4de6-4066-b36b-d4837d593d40 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Shortcut and File Type Association Behavior - - -Shortcut and File Type Association (FTA) publishing policy is defined and controlled by the publishing XML file, which is sent to clients by a publishing server during a publishing refresh operation. When the client receives this information, it adds any newly published data about applications such as the icons and FTAs. Then, it removes any outdated publishing data. - -In App-V version 4.6, two registry key values have been defined to enable administrators to control this behavior. By default, shortcuts that are created locally by using the client console are now retained. - -## How to Change Shortcut and FTA Behavior - - -Two new DWORD registry values have been defined for the client Configuration registry key, “FileTypePolicy” and “ShortcutPolicy”. These DWORD registry values are not present by default, but they can be added manually. The Configuration registry key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\[Wow6432Node\\\]Microsoft\\SoftGrid\\4.5\\Client\\Configuration. - -There are four policy values defined in the following table and these apply to both registry key values. The following list shows the numeric values for the registry settings, and the behavior applied to file types or shortcuts on a publishing refresh operation. - - ------ - - - - - - - - - - - - - - - - - - - - -

          Name

          Type

          Data (Examples)

          Description

          FileTypePolicy

          DWORD

          Default=0x2 (App-V 4.6)

          (0x0) – “ClientOnly”- remove any existing items from the same publishing information source, and keep only items that are added locally

          -

          (0x1) – “ServerOnly” - remove any outdated items from the same publishing information source and any items that are added locally, and add the new items

          -

          (0x2) – “ClientAndServer”- remove any outdated items from the same publishing information source, keep items added locally, and add the new items (default if not present for App-V 4.6)

          -

          (0x3) – “NoChange” - make no changes to file types or shortcuts

          ShortcutPolicy

          DWORD

          Default=0x2

          (0x0) – “ClientOnly”- remove any existing items from the same publishing information source, and keep only items added locally

          -

          (0x1) – “ServerOnly” - remove any outdated items from the same publishing information source and any items added locally, and add the new items

          -

          (0x2) – “ClientAndServer”- remove any outdated items from the same publishing information source, keep items added locally, and add the new items (default if not present)

          -

          (0x3) – “NoChange” - make no changes to file types or shortcuts

          - - - -**Note**   -The text values refer to the values for the XML attributes in the publishing XML file.  You can set these values manually if you have implemented a custom HTTP publishing solution. - - - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md deleted file mode 100644 index afe7d0a2da..0000000000 --- a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Configure Streaming Server Security Post-Installation -description: How to Configure Streaming Server Security Post-Installation -author: dansimp -ms.assetid: 9bde3677-d1aa-4dcc-904e-bb49a268d748 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Streaming Server Security Post-Installation - - -Configure the App-V Streaming Server for enhanced security through the registry. As with the App-V Management Server, a certificate must be correctly provisioned with the correct EKU identifier for Server Authentication before you complete the following post-installation procedure. - -**To configure Streaming Server security post-installation** - -1. Create an MMC, add the **Certificates** snap-in, and select **Local Machine certificate store**. - -2. Open the **Personal** certificates for the computer, and open the certificate provisioned for App-V. - -3. On the **Details** tab, scroll down to the thumbprint and copy the hash in the details pane. - -4. Open the registry editor, and navigate to `HKLM\Software\Microsoft\SoftGrid\4.5\Distribution server`. - -5. Edit the `X509CertHash` value, paste the thumbprint hash in the value field, and remove all spaces. Click **OK** to accept the edit. - -6. In the registry editor, navigate to `HKLM\Software\Microsoft\SoftGrid\4.5\Distribution server\RtspsPorts`. - -7. Create a new **DWORD** value named "322," and then enter the decimal value as 322 or the hexadecimal value as 142. - -8. Restart the streaming service. - -## Related topics - - -[How to Configure Management Server Security Post-Installation](how-to-configure-management-server-security-post-installation.md) - -[Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md b/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md deleted file mode 100644 index 03e3ac7409..0000000000 --- a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Configure the App-V Client Registry Settings by Using the Command Line -description: How to Configure the App-V Client Registry Settings by Using the Command Line -author: dansimp -ms.assetid: 3e3d873f-13d2-402f-97b4-f62d0c399171 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure the App-V Client Registry Settings by Using the Command Line - - -After the Application Virtualization (App-V) Client has been deployed and configured during the installation by using the command line, it might be necessary to change one or more client configuration settings. This is accomplished by editing the appropriate registry keys, using one of the following methods: - -- Using the Registry Editor directly - -- Using a .reg file - -- Using a scripting language such as VBScript or Windows PowerShell - -There is also an ADM template that you can use. For more information about the ADM template, see . - -**Caution**   -Use care when you edit the registry because errors can leave the computer in an unusable state. Be sure to follow your standard business practices that relate to registry edits. Thoroughly test all proposed changes in a test environment before you deploy them to production computers. - - - -## In This Section - - -**Important**   -On a 64-bit computer, the keys and values described in the following sections will be under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client. - - - -[How to Reset the FileSystem Cache](how-to-reset-the-filesystem-cache.md) -Provides the information that is required to reset the FileSystem cache. - -[How to Change the Size of the FileSystem Cache](how-to-change-the-size-of-the-filesystem-cache.md) -Explains how you can change the size of the cache. - -[How to Use the Cache Space Management Feature](how-to-use-the-cache-space-management-feature.md) -Describes how you can configure the cache space management feature. - -[How to Configure the Client Log File](how-to-configure-the-client-log-file.md) -Describes the various registry key values that control the client log file and how you can change them. - -[How to Configure User Permissions](how-to-configure-user-permissions.md) -Identifies the registry key that controls the user permissions and gives examples of how you can change some permissions. - -[How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md) -Explains how to configure the client to retrieve package content, icons, and file type associations from different sources, and provides several examples of the correct path format. - -[How to Configure the Client for Disconnected Operation Mode](how-to-configure-the-client-for-disconnected-operation-mode.md) -Provides information about how to configure the various settings associated with disconnected operations mode. - -[How to Configure Shortcut and File Type Association Behavior](how-to-configure-shortcut-and-file-type-association-behavior-46-only.md) -Describes the registry key values that control shortcuts and file type associations in the App-V client, and provides details on how to configure them. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md b/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md deleted file mode 100644 index 615d3a60b6..0000000000 --- a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Configure the App-V Sequencer -description: How to Configure the App-V Sequencer -author: dansimp -ms.assetid: 0f43f618-80b0-4715-af17-90f5c673d838 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the App-V Sequencer - - -The topics in this section provide detailed information about the associated Application Virtualization (App-V) Sequencer configuration tasks. - -## In This Section - - -[How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) -Provides a step-by-step procedure you can use to modify the location of the log directory. - -[How to Create the Sequencer Package Root Directory](how-to-create-the-sequencer-package-root-directory.md) -Provides a step-by-step procedure you can use to create the package root directory. - -[How to Modify the Scratch Directory Location](how-to-modify-the-scratch-directory-location.md) -Provides a step-by-step procedure you can use to modify the location of scratch directory. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md b/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md deleted file mode 100644 index 85ccb5fd59..0000000000 --- a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: How to Configure the App-V System for Package Upgrade -description: How to Configure the App-V System for Package Upgrade -author: dansimp -ms.assetid: de133898-f887-46c1-9bc9-fbb03feac66a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the App-V System for Package Upgrade - - -When you deploy a new version of an existing application package that has been upgraded in the App-V Sequencer, you can deploy it so that the App-V clients automatically stream the new version to the local cache. Depending on the streaming solution you use, there are different procedures for configuring the package upgrade. The following sections describe the most typical scenarios for publishing and streaming, and include the procedures necessary for configuring the package upgrade for each scenario. - -## Using a Management Server for both publishing and streaming - - -In this scenario, a single App-V Management Server is used for both publishing and streaming of packages and applications, and the RTSP(S) protocol is required. When the original package is imported to the App-V Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator also edits the HREF entry in the OSD file to point to the SFT file in the package folder, and then imports the package to the server. - -When a user is authenticated by the Management Server, the server publishes the user’s applications by sending the applist.xml file to the client. The client then retrieves the OSD files and icons for the applications from the Management Server. When the user double-clicks an application icon, the application content is streamed to the client cache from the path that is specified in the OSD file, and the application is started. - -### To upgrade the package - -To add a new version of an application that has been upgraded in the App-V Sequencer, the administrator must copy the new SFT file and any other modified files to the same folder as the original version of the application. The administrator will then use **Add Version** in the server management console to add the new version of the package. - -When the user next starts the application, the server streams the new version to the client automatically. This specific method of upgrading a package was formerly known as an active upgrade. - -## Using a Management Server for publishing and a Streaming Server for streaming - - -In this scenario, the App-V Management Server is used for publishing the packages, and the Streaming Server is used for streaming packages and applications. The RTSP(S) protocol is required. When the original package is imported to the Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator edits the HREF entry in the OSD file to point to the SFT file on the Streaming Server, and then imports the package to the Management Server. - -To set up the Streaming Server, the administrator copies the package folder from the Management Server to the CONTENT folder on the Streaming Server. This folder must have the same name and relative path under the Streaming Server’s CONTENT folder as on the Management Server, for example, \\\\streamingserver\\CONTENT\\packagename. - -If the client’s Application Source Root (ASR) setting is configured to point to the Streaming Server, the client uses this setting instead of the server name in the HREF entry in the OSD file. The ISR and OSR fields on the client can optionally be configured to point to either the Management Server or the Streaming Server, depending on the specific system architecture that is used. - -When a user is authenticated by the Management Server, the server publishes the user’s applications by sending the applist.xml file to the client. The client retrieves the OSD files and icons for the applications from either the Streaming Server or the Management Server, depending on the settings in the OSR and ISR fields. - -When the user double-clicks an application icon, the client uses the path to the package content file (SFT) that is contained in the OSD file HREF element. If the ASR is used the client replaces the server name (and port and protocol, if used) in the HREF element with the path to the Streaming Server that is specified in the ASR. The application is then streamed from the Streaming Server to the client cache and is started. - -### To upgrade the package - -To add a new version of an application that has been upgraded in the App-V Sequencer, the administrator must copy the new version of the SFT file and any other modified files to the same folder as the original version of the application on the Streaming Server. - -For consistency, we recommend that you copy new files to the folder on the Management Server as well. In particular, if you use the client’s OSR or ISR fields, copy the updated OSD file and icons to the server that is specified in the OSR and ISR fields. - -After the Streaming Server detects the new version, the next time the user starts the application, the server streams the new version to the client automatically. - -## Using a Management Server for publishing and an IIS Server for streaming - - -In this scenario, the App-V Management Server is used for publishing the packages, and the IIS server is used for streaming packages and applications. When the original package is imported to the Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator edits the HREF entry in the OSD file so it points to the SFT file on the IIS server, and then imports the package to the Management Server. - -To set up the IIS server for streaming, the administrator copies the package folder from the Management Server to the CONTENT folder on the IIS Server. This folder must have the same name and relative path under the IIS server’s Web Content folder as on the Management Server; for example, the URL on the IIS Server can be accessed by using http://IISserver/CONTENT/packagename or https://IISserver/CONTENT/packagename. - -If the client’s Application Source Root (ASR) setting is configured to point to the IIS Server, the client uses the ASR instead of the server name in the HREF entry in the OSD file. You can optionally configure the ISR and OSR fields on the client to point to either the Management Server or the IIS Server, depending on the specific system architecture that you use. - -When the Management Server authenticates the user, the server publishes the user’s applications by sending the applist.xml file to the client. The client retrieves the OSD files and icons for the applications from either the IIS Server or the Management Server, depending on the settings in the ISR and OSR fields. - -When the user double-clicks an application icon, the client uses the path to the package content file (SFT) that is contained in the OSD file HREF element. If the ASR is used the client replaces the server name (and port and protocol, if used) in the HREF element with the path to the IIS Server that is specified in the ASR. The application is then streamed from the IIS server to the client cache by using the HTTP(S) protocol and is started. - -### To upgrade the package - -The procedure to upgrade the package is as follows: - -- Copy the new version of the OSD file to the original version’s folder under the Management Server’s CONTENT folder, for example \\\\server\\CONTENT\\packagename, and replace the existing OSD file. For consistency, copy any other modified files, too. If the client’s OSR or ISR fields are used, then also copy the updated OSD file and icons to the server that is specified in the OSR and ISR fields. - -- Copy the new version of the SFT file to the package folder under the Web Content folder on the IIS server; for example, the URL on the IIS Server can be accessed by using http://IISserver/CONTENT/packagename or https://IISserver/CONTENT/packagename. - -At the next publishing refresh, the client is updated with the new version of the OSD file. This file now points to the new version of the SFT file; therefore, when the user next double-clicks an application icon, the new version is started. - -## Using a Management Server for publishing and a File Share for Streaming - - -In this scenario, the App-V Management Server is used for publishing the packages, and the file server is used for streaming packages and applications. When the original package is imported to the Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator edits the HREF entry in the OSD file so that it points to the SFT file on the file server, and imports the package to the Management Server. - -To set up the file server for streaming, the administrator copies the package folder from the Management Server to the CONTENT folder on the file server. This folder must have the same name and relative path under the file server’s CONTENT folder as on the Management Server, for example \\\\fileserver\\CONTENT\\packagename. - -If the client’s Application Source Root (ASR) setting is configured to point to the file server by using a UNC path, for example \\\\fileserver\\content, the client uses this setting instead of the server name in the HREF entry in the OSD file. The administrator can optionally configure the ISR and OSR fields on the client to point to either the Management Server or the file server, depending on the specific system architecture being used. - -When the Management Server authenticates the user, the server publishes the user’s applications by sending the applist.xml file to the client. The client retrieves the OSD files and icons for the applications from either the file server or the Management Server, depending on the settings in the ISR and OSR fields. - -When the user double-clicks an application icon, the client uses the path to the package content file (SFT) that is contained in the OSD file HREF element. If the ASR is used, the client replaces the server name (and port and protocol, if used) in the HREF element with the path to the file server that is specified in the ASR. The application is then streamed from the file server to the client cache and is started. - -### To upgrade the package - -The procedure to upgrade the package is as follows: - -- Copy the new version of the OSD file to the original version’s folder under the Management Server’s CONTENT folder, for example \\\\server\\CONTENT\\packagename, replacing the existing OSD file. Any other modified files should be copied as well for consistency. If the client’s OSR or ISR fields are used, then also copy the updated OSD file and icons to the server that is specified in the OSR and ISR fields. - -- Copy the new version of the SFT file to the package folder under the CONTENT folder on the file server, for example \\\\fileserver\\CONTENT\\packagename. Copy the V2 SFT file to the folder under the CONTENT share on the file server, for example \\\\fileserver\\CONTENT\\packagename\\V1. - -At the next publishing refresh the client is updated with the new version of the OSD file. This file now points to new version of the SFT file, so when the user next double-clicks an application icon, the new version is started. - -## Upgrading the package by using MSI Streaming mode - - -When you generate a Windows Installer (MSI) file during sequencing a package, the sequencer creates a .MSI file that contains all the necessary publishing information. The administrator must copy the .MSI file to the client and the .SFT file containing the package content to a network share accessible by the client computer. - -To publish the application to the client, run the following command on the client computer: - -   **Msiexec.exe /i \\\\PathToMsi\\packagename.msi MODE=STREAMING OVERRIDEURL=\\\\\\\\server\\share\\package.sft** - -The .MSI file publishes the applications to the client and then streams the .SFT file to the client cache. - -### To upgrade the package - -To add a new version, an administrator must deploy a new .MSI file to the client and a new .SFT file to the network share. The administrator must then run the same command used to deploy the package, but use the new .MSI file and the new .SFT file, for example: - -   **Msiexec.exe /i \\\\PathToMsi\\packagename\_2.msi MODE=STREAMING OVERRIDEURL=\\\\\\\\server\\share\\package\_2.sft** - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md deleted file mode 100644 index 5dab5d7b35..0000000000 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: How to Configure the Application Virtualization Client Settings Manually -description: How to Configure the Application Virtualization Client Settings Manually -author: dansimp -ms.assetid: 53bd21d8-49eb-4c77-9692-c093ffe4c17c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Application Virtualization Client Settings Manually - - -This section contains procedures that administrators can use to configure the Application Virtualization (App-V) Desktop Client and the Application Virtualization (App-V) Client for Remote Desktop Services (formerly Terminal Services) and to manage applications by using the App-V Client Management Console. - -## In This Section - - -[How to Perform General Administrative Tasks in the App-V Client Management Console](how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md) -Provides procedures that you can use to set up the Publishing Server and to refresh applications. - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -Provides procedures that you can use to configure App-V Desktop Client and the App-V Client for Remote Desktop Services. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md deleted file mode 100644 index 8225fe37da..0000000000 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Configure the Application Virtualization Management Servers -description: How to Configure the Application Virtualization Management Servers -author: dansimp -ms.assetid: a9f96148-bf2d-486f-98c2-23409bfb0935 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Application Virtualization Management Servers - - -Before virtualized applications can be streamed to the Application Virtualization Desktop Client or the Client for Remote Desktop Services (formerly Terminal Services), the Application Virtualization Management Server must be configured. When you configure the server, you are setting up the *content directory* where the SFT files are loaded and stored. The SFT files contain the virtualized application (or applications). - -**Important**   -Application Virtualization Servers stream SFT files to the Desktop Client and the Client for Remote Desktop Services using only RTSP or RTSPS protocols. The ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different file or HTTP server. - - - -**To configure the Application Virtualization Management Server** - -1. Complete the following procedure: - - [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - - **Note**   - During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen. - - - -2. Navigate to the location that you specified for the \\Content directory, and if necessary, create the directory. - -3. When the content directory is created, configure this directory as a standard file share. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Application Virtualization System Requirements](application-virtualization-system-requirements.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md deleted file mode 100644 index 8671c8e401..0000000000 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Configure the Application Virtualization Streaming Servers -description: How to Configure the Application Virtualization Streaming Servers -author: dansimp -ms.assetid: 3e2dde35-9d72-40ba-9fdf-d0338bd4d561 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Application Virtualization Streaming Servers - - -Before virtual applications can be streamed to the Application Virtualization Desktop Client or the Client for Remote Desktop Services (formerly Terminal Services), the Application Virtualization Streaming Servers must be configured. When you configure the servers, you are setting up the *content directory* where the SFT files are loaded and stored. The SFT files contain the virtual application (or applications). - -**Important**   -Application Virtualization Servers stream SFT files to the Desktop Client and the Client for Remote Desktop Services using only RTSP or RTSPS protocols. The ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different file or HTTP server. - - - -**To configure the Application Virtualization Streaming Servers** - -1. Complete the installation procedure for the Application Virtualization Streaming Server. During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen. - -2. Navigate to the location that you specified for the \\Content directory, and if you have to, create the directory. - -3. When the Content directory is created, configure this directory as a standard file share. - -4. Configure the NTFS file system permissions to the Content directory and the package folders under the Content directory. You should use Security Groups in Active Directory Domain Services that define which users can access each application. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) - -[How to Configure the File Server](how-to-configure-the-file-server.md) - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md b/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md deleted file mode 100644 index 04f4c05542..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md +++ /dev/null @@ -1,169 +0,0 @@ ---- -title: How to Configure the Client for Application Package Retrieval -description: How to Configure the Client for Application Package Retrieval -author: dansimp -ms.assetid: 891f2739-da7a-46da-b452-b8c0af075525 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client for Application Package Retrieval - - -When the client is configured with an Application Virtualization (App-V) Management Server as its publishing server, by default at the next publishing refresh cycle, the client retrieves from the server the Open Software Descriptor (OSD) and package manifest files for each package that the user is authorized to use. The client uses the package source information that is defined in these files to determine where to find the package content, icons, and file type associations. - -If you want the client to obtain the package content (SFT file) from a local App-V Streaming Server or other alternate source such as a Web server or file server, instead of from the App-V Management Server, you can configure the ApplicationSourceRoot registry key value on the computer to point to the local content share on the other server. The OSD file still defines the original source path for the package content. However the client uses the value of the ApplicationSourceRoot setting in place of the server and share that are specified in the content path in the OSD file. This redirects the client to retrieve the content from the other server. - -You can also configure the OSDSourceRoot and IconSourceRoot registry key values if you want to override those settings in the package manifest file or in the paths sent by a publishing server. The OSDSourceRoot specifies a source location for OSD file retrieval for an application package during publication. The IconSourceRoot specifies a source location for icon retrieval for an application package during publication. - -**Note** -- The IconSourceRoot and OSDSourceRoot settings override the values in the package manifest file, so if you try to deploy a package by using the Windows Installer (.msi) file method, it will also override the values in the package manifest file that is contained within that .msi file. - -- During both the publishing and HTTP(S) streaming operations,App-V 4.5 SP1 clients use the proxy server settings that are configured in Internet Explorer on the user’s computer. - - - -**To configure the ApplicationSourceRoot registry key value** - -- Configure the ApplicationSourceRoot in the following registry key value with either a UNC path or a URL: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\ApplicationSourceRoot - - The correct format for the Universal Naming Convention (UNC) path is **\\\\computername\\sharefolder\\\[folder\]\[\\\]**, where **folder** is optional. The **computername** can be a Fully Qualified Domain Name (FQDN) or an IP address, and **sharefolder** can be a drive letter. Only the **\\\\computername\\sharedfolder** or drive letter portion of the OSD path is replaced. - - The correct format for the URL path is **protocol://servername:\[port\]\[/path\]\[/\]**, where **port** and **path** are optional. If **port** is not specified, the default port for the protocol is used. Only the **protocol://server:port** portion of the OSD URL is replaced. - - **Important** - Environment variables are not supported in the ApplicationSourceRoot definition. - - - -~~~ -The following table lists examples of acceptable URL and UNC path formats. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ApplicationSourceRootOSD File HREF PathResultComments

          rtsps://mainserver:322

          rtsp://appserver/productivity/office2k3.sft?customer=seq

          rtsps://mainserver:322/productivity/office2k3.sft?customer=seq

          rtsps://mainserver:322/prodapps

          rtsp://appserver/productivity/office2k3.sft?customer=seq

          rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq

          https://mainserver:443/prodapps

          rtsp://appserver/productivity/office2k3.sft?customer=seq

          https://mainserver:443/prodapps/productivity/office2k3.sft?customer=seq

          rtsps://mainserver:322/prodapps

          rtsp://%SFT_APPVSERVER%:554/productivity/office2k3.sft?customer=seq

          rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq

          rtsps://mainserver:322

          \\uncserver\share\productivity\office2k3.sft

          rtsps://mainserver:322/productivity/office2k3.sft

          ‘\’ converted to ‘/’

          rtsps://mainserver:322

          file://\\uncserver\share\productivity\office2k3.sft

          rtsps://mainserver:322/productivity/office2k3.sft

          ‘\’ converted to ‘/’

          \\uncserver\share

          rtsp://appserver/productivity/office2k3.sft?customer=seq

          \\uncserver\share\productivity\office2k3.sft

          ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path

          \\uncserver\share\prodapps

          rtsp://appserver/productivity/office2k3.sft?customer=seq

          \\uncserver\share\prodapps\productivity\office2k3.sft

          ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path

          M:

          \\uncserver\share\productivity\office2k3.sft

          M:\productivity\office2k3.sft

          M:\prodapps

          \\uncserver\share\productivity\office2k3.sft

          M:\prodapps\productivity\office2k3.sft

          -~~~ - - - -**To configure the OSDSourceRoot value** - -- Configure the OSDSourceRoot in the following registry key value with either a UNC path or a URL: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\OSDSourceRoot - - Acceptable formats for the OSDSourceRoot include UNC paths and URLs, as in the following example: - - **\\\\computername\\sharefolder\\resource** or **\\\\computername\\content** or **<drive>:\\foldername** - - **http://computername/productivity/** or **https://computername/productivity/** - -**To configure the IconSourceRoot value** - -- Configure the IconSourceRoot in the following registry key value with either a UNC path or a URL: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\IconSourceRoot - - Acceptable formats for the IconSourceRoot include UNC paths and URLs, as in the following example: - - **\\\\computername\\sharefolder\\resource** or **\\\\computername\\content** or **<drive>:\\foldername** - - **http://computername/productivity/** or **https://computername/productivity/** - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md b/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md deleted file mode 100644 index fe5c5331d3..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Configure the Client for Disconnected Operation Mode -description: How to Configure the Client for Disconnected Operation Mode -author: dansimp -ms.assetid: 3b48464a-b8b4-494b-93e3-9a6d9bd74652 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client for Disconnected Operation Mode - - -The disconnected operation mode enables the Application Virtualization (App-V) Desktop Client or the Application Virtualization (App-V) Client for Remote Desktop Services (formerly Terminal Services) to run applications that are stored in the file system cache of the client when the client cannot connect to the App-V Management Server. - -**Important**   -In a large organization where multiple Remote Desktop Session Host (RD°Session Host) servers (formerly Terminal Servers) are linked in a farm to support many users, using a single App-V Management Server to support the farm represents a single point of failure. To provide high availability to support the RD Session Host farm, consider linking two or more App-V Management Servers to use the same database. - - - -**To enable disconnected operation mode** - -- Set the following registry key value equal to 1 to enable disconnected operation mode: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\AllowDisconnectedOperation - -**To set a time limit on disconnected operation mode use** - -1. Set the following registry key value to 1: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\LimitDisconnectedOperation - -2. Set the following registry key value to the number of minutes you want to limit disconnected operation mode. The valid range of values is 1–999999. The default value is 90 days or 129,600 minutes. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\DOTimeoutMinutes - -**To configure the Client for Remote Desktop Services for disconnected operation mode** - -1. Set the following registry key value to 1 to enable disconnected operation mode: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\AllowDisconnectedOperation - -2. Set the following registry key value to 0 (zero) to allow unlimited use of disconnected operation mode: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\LimitDisconnectedOperation - -3. Ensure that all packages are preloaded into the cache to improve performance. - -## Related topics - - -[Disconnected Operation Mode](disconnected-operation-mode.md) - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md b/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md deleted file mode 100644 index ee1c92f759..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: How to Configure the Client for MIT Kerberos Realm Support -description: How to Configure the Client for MIT Kerberos Realm Support -author: dansimp -ms.assetid: 46102f4c-270c-4115-8eb4-7ff5ae3be32d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client for MIT Kerberos Realm Support - - -In Application Virtualization (App-V) 4.5 SP1, support was added for MIT Kerberos realms. This topic provides detailed information on how to enable that support. - -**To enable support for MIT Kerberos Realms** - -- Create a new registry key named **UseMitKerberos** of type DWORD, as follows, and then set it to a value of 1. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\UseMitKerberos - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md b/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md deleted file mode 100644 index 951cbbb2d7..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Configure the Client in the Application Virtualization Client Management Console -description: How to Configure the Client in the Application Virtualization Client Management Console -author: dansimp -ms.assetid: d0868c9f-8fe9-442f-a9ad-ef30efb0f6b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client in the Application Virtualization Client Management Console - - -You can use the Application Virtualization Client Management Console to configure the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services). - -## In This Section - - -[How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) -Provides procedures you can use to change the cache size and the drive designation letter that represents the virtual drive. - -[How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) -Provides procedures you can use to change the log reporting levels and to reset the log files. - -[How to Change User Access Permissions](how-to-change-user-access-permissions.md) -Provides a procedure you can use to change the user access permissions. - -[How to Change Import Search Paths](how-to-change-import-search-paths.md) -Provides a procedure you can use to set up client import search paths. - -[How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) -Provides a procedure you can use to establish a schedule for Application Virtualization Server refresh. - -[How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) -Provides a procedure you can use to force Application Virtualization Server refresh on system login. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-log-file.md b/mdop/appv-v4/how-to-configure-the-client-log-file.md deleted file mode 100644 index e4a46cd129..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-log-file.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: How to Configure the Client Log File -description: How to Configure the Client Log File -author: dansimp -ms.assetid: dd79f8ce-61e2-4dc8-af03-2a353554a1b2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client Log File - - -You can use the following procedures to configure the Application Virtualization (App-V) Client log file. - -**To change the log file location** - -- Edit the following registry key value to specify the new path for the log file. You must restart the **sftlist** service after changing this value. This location can also be changed interactively after installation. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogFileName - -**To change the log reporting level** - -- By default, the type of messages that are written to the log include all events of severity level 4 (Informational) or higher. The severity level is stored in the following key value. Set this key value to 5 to enable verbose logging. Use verbose logging only for short periods during troubleshooting because it will generate a very large volume of messages and cause the log to fill up quickly. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogMinSeverity - -**To change the log size** - -- In Application Virtualization (App-V) 4.5, the log size is controlled by the following registry key value. This value defaults to 256 MB and defines the maximum size, in MB, that the log can grow to before being reset. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogMaxSize - - **Caution**   - This registry key value must be set to a value greater than zero to ensure the log file does get reset. - - - -**To change the number of backup copies** - -- When the log file reaches the maximum size, a reset is forced when the next write to the log occurs. A reset causes a new log file to be created, and the old file is renamed as a backup. The following registry setting controls the number of backup copies of the log file that are kept when the file is reset. The default value is 4. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogRolloverCount - - The format of the backup log file names is: **sftlog\_YYYYMMDD\_hhmmss-uuu.txt** and is based on the reset time, in Universal Coordinated Time (UTC). The following table lists the symbols used in creating the file names and their descriptions. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SymbolDescription

          YYYY

          4-digit year

          MM

          2-digit month (01–12)

          DD

          2-digit day of the month (01–31)

          hh

          hour (00–23)

          mm

          minutes (00–59)

          ss

          seconds (00–59)

          uuu

          milliseconds (000–999)

          - - - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-file-server.md b/mdop/appv-v4/how-to-configure-the-file-server.md deleted file mode 100644 index c9d01b4dba..0000000000 --- a/mdop/appv-v4/how-to-configure-the-file-server.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Configure the File Server -description: How to Configure the File Server -author: dansimp -ms.assetid: 0977554c-1741-411b-85e7-7e1cd017542f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the File Server - - -You can use the following procedure to configure a local computer that is used as a file share and streams applications to the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services). This scenario is used when you do not want to add an additional server infrastructure to your existing hardware environment. - -If you are using an Application Virtualization Management Server as a distribution point to the file share installed in local offices, you must configure this server before virtual applications can be streamed to the computers that are used as file shares. When you configure the servers and the file shares, you are setting up the content directory where the SFT files are loaded and stored. The SFT files contain the virtual application (or applications). - -**Important**   -For applications to stream properly to the Application Virtualization Desktop Client and the Client for Remote Desktop Services, the SFT file streams from the content directory on the server where you store the virtual application; the ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different server. - - - -**To configure the Application Virtualization file server** - -1. Complete the following installation procedure to configure the server that is used as the distribution point: - - [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - - **Note**   - During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen. - - - -2. Create a \\Content directory, which corresponds to the directory you specified when you installed the server, on each computer that you are using as a file share. - - **Important**   - Configure the Application Virtualization Desktop Clients to stream applications from the computer you are using as a file share rather than from an Application Virtualization Server or IIS server. - - - -3. When the \\Content directory is created, configure this directory as a standard file share. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-server-for-iis.md b/mdop/appv-v4/how-to-configure-the-server-for-iis.md deleted file mode 100644 index 4290cc9bf5..0000000000 --- a/mdop/appv-v4/how-to-configure-the-server-for-iis.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Configure the Server for IIS -description: How to Configure the Server for IIS -author: dansimp -ms.assetid: 1fcfc583-322f-4a38-90d0-e64bfa9ee3d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Server for IIS - - -Before virtual applications can be streamed to the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services), the IIS servers must be configured. When you configure the servers, you are setting up the content directory where the SFT files are loaded and stored. The SFT files contain the virtual application (or applications). - -**To configure the content directory on the IIS server** - -1. On the server that is running IIS, locate the directory that you want to use as the content directory, or create the directory if it does not exist. Configure this directory as a standard file share. - -2. On the server that is running IIS, open **IIS Manager**, and under the default website, create a virtual directory that corresponds to the content directory that you created on the server. Make sure that **Read** is checked. - -3. Give the newly created virtual directory the alias **Content**. - -4. Accept all other default settings for this virtual directory. - -5. Configure the NTFS file system permissions to the content directory and the package folders under the content directory by using the Security Groups in Active Directory Domain Services that you defined earlier. - -**Note**   -If you are using IIS to publish the ICO and OSD files, you must configure a MIME type for OSD=TXT; otherwise, IIS will not serve the ICO and OSD files to clients. If you are using IIS to publish packages (SFT files), you must configure a MIME type for SFT=Binary; otherwise, IIS will not serve the SFT files to clients. - - - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) - -[How to Configure the File Server](how-to-configure-the-file-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md b/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md deleted file mode 100644 index fec2c858fe..0000000000 --- a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: How to Configure the Server to be Trusted for Delegation -description: How to Configure the Server to be Trusted for Delegation -author: dansimp -ms.assetid: d8d11588-17c0-4bcb-a7e6-86b5e4ba7e1c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Server to be Trusted for Delegation - - -When you install the Microsoft Application Virtualization (App-V) Management Server software, you can choose to install it by using a distributed system architecture. If you install the console, the Management Web Service, and the database on different computers, you must configure the Internet Information Services (IIS) server to be trusted for delegation. This is necessary because the Management Web Service will attempt to connect to the App-V data store by using the credentials of the App-V administrator who is using the console. The database server on which the data store is installed will not accept the administrator’s credentials from the IIS server unless the IIS server is configured to be trusted for delegation, and so the Management Web Service will not be able to connect to the App-V data store. - -**Note**   -If you install the App-V Management Server software on a single server and place the data store on a separate server, there is one situation in which you must still configure the server to be trusted for delegation even though the Management Web Service and Management Console are on the same server. This situation occurs if you need to connect to the Management Web Service in the console by using the **Use Alternate Credentials** option. - - - -The type of delegation that you can use depends on the Domain Functional Level that you have configured in your Active Directory Domain Services (AD DS) infrastructure. The following table lists the types of delegation that can be configured for each Domain Functional Level for App-V. Detailed instructions follow the table. - - ---- - - - - - - - - - - - - - - - - -
          Domain Functional LevelDelegation Levels Available

          Windows 2000 native

            -
          • No delegation (default)

          • -
          • Unconstrained delegation

          • -

          Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2

            -
          • No delegation (default)

          • -
          • Unconstrained delegation¹

          • -
          • Constrained delegation (Use Kerberos Only Protocols)

          • -
          • Constrained delegation (Use any authentication protocol) ¹

          • -
          - - - -¹ Not recommended. - -## To configure unconstrained delegation when the Domain Functional Level is Windows 2000 native - - -On the domain controller for your Web server’s domain, complete the following steps. - -**** - -1. Click **Start**, **Administrative Tools**, and then click **Active Directory Users and Computers**. - -2. Expand domain, and then expand the Computers folder. - -3. In the right pane, right-click the computer name for the Web server, and then click **Properties**. - -4. On the **General** tab, ensure that the **Trust computer for delegation** check box is selected. - -5. Click **OK**. - -## To configure unconstrained delegation when the Domain Functional Level is Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 - - -On the domain controller for your Web server’s domain, complete the following steps. - -**** - -1. Click **Start**, click **Administrative Tools**, and then click **Active Directory Users and Computers**. - -2. Expand domain, and expand the Computers folder. - -3. In the right pane, right-click the computer name for the Web server, select **Properties**, and then click the **Delegation** tab. - -4. Click to select **Trust this computer for delegation to any service (Kerberos only)**. - -5. Click **OK**. - -## To configure constrained delegation when the Domain Functional Level is Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 - - -On the domain controller for your Web server’s domain, complete the following steps. - -**** - -1. Click **Start**, click **Administrative Tools**, and then click **Active Directory Users and Computers**. - -2. Expand domain, and then expand the Computers folder. - -3. In the right pane, right-click the computer name for the Web server, select **Properties**, and then click the **Delegation** tab. - -4. Click to select **Trust this computer for delegation to specified services only**. - -5. Ensure that **Use Kerberos only** is selected, and then click **OK**. - -6. Click the **Add** button. In the **Add Services** dialog box, click **Users or Computers**, and then browse to or type the name of the Microsoft SQL server that has the App-V data store and is to receive the users credentials from IIS. Click **OK**. - -7. In the **Available Services** list, select the MSSQLSvc service that lists port number on which the Microsoft SQL Server is accepting connections for the App-V database (the default port is 1433). Click **OK**. - -### Additional steps to configure IIS 7 for constrained delegation - -If you are running the Management Web Service on an IIS 7 server, you must complete the following steps to set the IIS 7 *useAppPoolCredentials* variable to True. - -1. Open an elevated Command Prompt window. To open an elevated Command Prompt window, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. - -2. Navigate to %windir%\\system32\\inetsrv. - -3. Type **appcmd.exe set config -section:system.webServer/security/authentication/windowsAuthentication -useAppPoolCredentials:true**, and then press ENTER. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-user-permissions.md b/mdop/appv-v4/how-to-configure-user-permissions.md deleted file mode 100644 index 88e1049577..0000000000 --- a/mdop/appv-v4/how-to-configure-user-permissions.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Configure User Permissions -description: How to Configure User Permissions -author: dansimp -ms.assetid: 54e69f46-b028-4ad1-9b80-f06ef5c8f559 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure User Permissions - - -You can enable and disable some actions for users who do not have administrative rights by editing the key values under the **Permissions** registry key (HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions). This key is primarily designed to help prevent users from making mistakes rather than to provide any special security, because users with administrative rights can edit any of these key values. The following procedures are examples of how to change the key values. For more information about the Application Virtualization (App-V) Client registry keys and values, see . - -**To change user permissions** - -1. To enable the users to choose to run the client in offline mode, set the following key value to 1: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions\\ToggleOfflineMode - -2. To enable the users to view all applications through the user interface, set the following key value to 1. Setting the value to 0 (zero) allows the users to see only the applications that are available to them. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions\\ViewAllApplications - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md deleted file mode 100644 index 3ec2889648..0000000000 --- a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Configure Windows Server 2003 Firewall for App-V -description: How to Configure Windows Server 2003 Firewall for App-V -author: dansimp -ms.assetid: 2c0e80f8-41e9-4164-ac83-b23b132b489a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Windows Server 2003 Firewall for App-V - - -Use the following procedure to configure the Windows Server 2003 firewall for App-V. - -**To configure Windows Server 2003 firewall for App-V** - -1. In **Control Panel**, open the **Windows Firewall**. - - **Note**   - If the server has not been configured to run the firewall service before this step, you will be prompted to start the firewall service. - - - -2. If ICO and OSD files are published through SMB, ensure that **File and Printer Sharing** is enabled on the **Exceptions** tab. - - **Note**   - If ICO and OSD files are published through HTTP/HTTPS on the Management Server, you might need to add an exception for HTTP or HTTPS. If the IIS server hosting the ICO and OSD files is hosted on a computer separate from the Management Server, you need to add the exception to that computer. To maximize performance, it is recommended that you host the ICO and OSD files on a separate server from the Management Server. - - - -3. Add a program exception for `sghwdsptr.exe`, which is the Management Server service executable. The default path to this executable is `%ProgramFiles%\Microsoft System Center App Virt Management Server\App Virt Management Server\bin`. - - **Note**   - If the Management Server uses RTSP for communication, you must also add a program exception for `sghwsvr.exe`. - - The App-V Streaming Server requires a program exception `sglwdsptr.exe` for RTSPS communication. The App-V Streaming Server that uses RTSP for communication also requires a program exception for `sglwsvr.exe`. - - - -4. Ensure that the proper scope is configured for each exception. To reduce risk, remove any computer and strictly limit the IP addresses to which the server will respond. - -## Related topics - - -[How to Configure Windows Server 2008 Firewall for App-V](how-to-configure-windows-server-2008-firewall-for-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md deleted file mode 100644 index 7e516a89fd..0000000000 --- a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Configure Windows Server 2008 Firewall for App-V -description: How to Configure Windows Server 2008 Firewall for App-V -author: dansimp -ms.assetid: 57f4ed17-0651-4a3c-be1e-29d9520c6aeb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure Windows Server 2008 Firewall for App-V - - -With the introduction of Windows Server 2008, the firewall and IPsec components were merged into one service, and the capabilities of this service were enhanced. The new firewall service supports incoming and outgoing stateful inspection. Also, you can configure specific firewall rules and IPsec policies through group policies. For additional information about the Windows firewall in Windows Server 2008, see . - -The following procedure does not include adding an exception for ICO and OSD publishing through SMB or HTTP/HTTPS. Those exceptions are automatically added based on the network profile and roles installed on the Windows Server 2008 firewall. - -**Note**   -If the Management Server is configured to use RTSP, repeat this procedure to add the `sghwsvr.exe` program as an exception. - -The App-V Streaming Server requires the program exception `sglwdsptr.exe` for RTSPS communication. An App-V Streaming Server that uses RTSP for communication also requires a program exception for `sglwsvr.exe`. - - - -**To configure Windows Server 2008 firewall for App-V** - -1. Open the **Windows Firewall with Advanced Security** management console through the Control Panel or by typing `wf.msc` on the Run line. - -2. Create a new inbound rule, and select **Program**. - -3. Select the program path, and browse to `sghwdsptr.exe`, which is located by default at `%ProgramFiles%\Microsoft System Center App Virt Management Server\App Virt Management Server\bin`. - -4. Click **Next**. - -5. On the **Action** page, select **Allow the connection**, and then click **Next**. - -6. Select the appropriate **Profiles** to apply to the inbound rule. - -7. Provide a name and description for the rule, and click **Finish**. - -## Related topics - - -[How to Configure Windows Server 2003 Firewall for App-V](how-to-configure-windows-server-2003-firewall-for-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md b/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md deleted file mode 100644 index 8368dd56f8..0000000000 --- a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Configure Windows Server 2008 for App-V Management Servers -description: How to Configure Windows Server 2008 for App-V Management Servers -author: dansimp -ms.assetid: 38b4016f-de82-4209-9159-387d20ddee25 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Windows Server 2008 for App-V Management Servers - - -The Windows Server 2008 server on which you install the Microsoft Application Virtualization (App-V) Management Web Service requires Internet Information Services (IIS) to be installed as a role on the server. Use the following procedure to configure Windows Server 2008 to support App-V server installation. - -**To install IIS on a Windows Server 2008 computer** - -1. On the Windows Server 2008 computer, click **Start**, click **All Programs**, click **Administrative Tools**, and then click **Server Manager** to start Server Manager. In Server Manager, right-click the **Roles** node, and click **Add Roles** to start the **Add Roles Wizard**. - -2. In the **Add Roles Wizard**, on the **Select Server Roles** page, select **Web Server (IIS)**. When prompted, click **Add Required Features** to add the dependent features. - -3. On the **Select Server Roles** page, Click **Next**, and then click **Next** again. - -4. In the **Add Roles Wizard**, on the **Select Role Services** page: - - 1. Under **Application Development**, select **ASP.NET** and, when prompted, click **Add Required Role Services** to add the dependent roles services and features. - - 2. Under **Security**, select **Windows Authentication**. - - 3. In the **Management Tools** node, select **IIS Management Scripts and Tools**. Under **IIS 6 Management Compatibility**, ensure that both **IIS 6 Metabase Compatibility** and **IIS 6 WMI Compatibility** are selected, and then click **Next**. - -5. On the **Confirm Installation Selections** page, click **Install**, and then complete the rest of the wizard. - -6. Click **Close** to exit the **Add Roles Wizard**, and then close Server Manager. - -## Related topics - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md b/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md deleted file mode 100644 index 169761167e..0000000000 --- a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Connect to an Application Virtualization System -description: How to Connect to an Application Virtualization System -author: dansimp -ms.assetid: ac38216c-5464-4c0b-a4d3-3949ba6358ac -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Connect to an Application Virtualization System - - -You must connect the Application Virtualization Server Management Console to an Application Virtualization System before you can use the management console to manage applications, file type associations, packages, application licenses, server groups, provider policies and administrators. The following procedure outlines the steps you must follow to connect the console to an Application Virtualization System. - -**To connect to an Application Virtualization System** - -1. Right-click the Application Virtualization System node in the **Scope** pane, and select **Connect to Application Virtualization System** from the pop-up menu. - - **Note** - There are three components to Application Virtualization server management: the Application Virtualization Management Console, the Management Web Service, and the SQL Datastore. If these components are distributed across different physical machines, you must configure security properly for the components to communicate across the system. For more information, see the following manuals and articles: - - [How to Configure the Server to be Trusted for Delegation](https://go.microsoft.com/fwlink/?LinkID=166682) (https://go.microsoft.com/fwlink/?LinkID=166682) - - [Planning and Deployment Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=122063) (https://go.microsoft.com/fwlink/?LinkID=122063) - - [Operations Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=133129) (https://go.microsoft.com/fwlink/?LinkID=133129) - - [Article 930472](https://go.microsoft.com/fwlink/?LinkId=114647) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114647) - - [Article 930565](https://go.microsoft.com/fwlink/?LinkId=114648) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114648) - - - -2. Complete the fields in the **Connect to Application Virtualization System** dialog box: - - 1. **Web Service Host Name**—Enter the name of the Application Virtualization System to which you want to connect, or enter **localhost** to connect to the local server. - - 2. **Use Secure Connection**—Select this check box if you want to connect to the server with a secure connection. - - 3. **Port**—Enter the port number you want to use for the connection. **80** is the default regular port number, and **443** is the secure-port number. - - 4. **Use Current Windows Account**—Select this radio button to use the current Windows account credentials. - - 5. **Specify Windows Account**—Select this radio button when you want to connect to the server as a different user. - - 6. **Name**—Enter the name of the new user by using either the *DOMAIN\\username* or the username@domain format. - - 7. **Password**—Enter the password that corresponds to the new user. - -3. Click **OK**. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-a-reportserver.md b/mdop/appv-v4/how-to-create-a-reportserver.md deleted file mode 100644 index abdfd7298e..0000000000 --- a/mdop/appv-v4/how-to-create-a-reportserver.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Create a Report -description: How to Create a Report -author: dansimp -ms.assetid: 70938167-d3b9-45ce-b459-a953c93769b0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Report - - -The process for creating a report from the Application Virtualization Server Management Console is the same regardless of the report type. When you select a report type, the window displays a brief description of the selected report. - -**Note**   - When you create a report, you specify the parameters that are used for collecting the data when the report is run. Until you run a report, no data is collected. - - - -**To create a report** - -1. Run the New Report Wizard by right-clicking the **Reports** node and selecting **New Report** from the pop-up menu. - -2. On the first page of the New Report Wizard, enter a name in the **Report Name** field and select the **Report Type** from the drop-down list of reports. Depending on which report you select, the remaining pages in the wizard change according the requirements of that report type. Scan the following list of pages to find the pages that refer to your report: - - 1. **Report Period**—Select a radio button to specify the frequency for running the report. - - 2. **Server**—Select the **Server**, **Server Group**, or **Enterprise** radio button, and then select the server group and server from the corresponding drop-down list and field as enabled. - - 3. **Application**—Select an application from the drop-down list of available applications. - -3. Click **Finish**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-a-server-group.md b/mdop/appv-v4/how-to-create-a-server-group.md deleted file mode 100644 index bc12c0bd0a..0000000000 --- a/mdop/appv-v4/how-to-create-a-server-group.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create a Server Group -description: How to Create a Server Group -author: dansimp -ms.assetid: 29ada98b-1024-483d-a3ee-67d4bb263df7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Server Group - - -To help you manage your Application Virtualization Management Servers more efficiently, you can use the Application Virtualization Server Management Console to organize them into server groups. - -**To create a server group** - -1. Click the **Server Groups** node in the left pane, and choose **New Server Group**. - -2. In the **New Server Group Wizard**, enter a name in the **Server Group Name** field, and select the default provider policy from the drop-down list of provider policies. - -3. Be sure the **Enabled** check box is selected to enable the server group. - -4. Click **Finish**. - -## Related topics - - -[How to Add a Server](how-to-add-a-server.md) - -[How to Remove a Server Group](how-to-remove-a-server-group.md) - -[How to Remove a Server](how-to-remove-a-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md b/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md deleted file mode 100644 index 23e2b3570b..0000000000 --- a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create a Virtual Environment for a Web-Based Application -description: How to Create a Virtual Environment for a Web-Based Application -author: dansimp -ms.assetid: d2b16e9d-369c-4bd6-b2a0-16dd24c0e32c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Virtual Environment for a Web-Based Application - - -You can create separate virtual environments for web applications you want to isolate. Creating separate web environments is useful if the web-based applications require plug-ins of have configurations that conflict with each other. - -**To create a virtual environment for a Web-based application** - -1. Open the sequencing wizard. For more information about sequencing an application see [How to Sequence a New Application](how-to-sequence-a-new-application.md). - -2. On the **Monitor Installation** page, to start monitoring the installation of the application, click **Begin Monitoring**. Open a web browser and navigate to the installer file associated with the application. Install the application, and perform any required post installation configuration tasks. - -3. To ensure the applications starts, open the application three times. - -4. Install and configure any additional applications that need to reside in the same virtual environment. - -5. Complete the remainder of the Sequencing Wizard. - -6. To save the application, select **File**, and click **Save**. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md deleted file mode 100644 index 26aae4b1ea..0000000000 --- a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Create an App-V Project Template (App-V 4.6 SP1) -description: How to Create an App-V Project Template (App-V 4.6 SP1) -author: dansimp -ms.assetid: 7e87fba2-b72a-4bc9-92b8-220e25aae99a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create an App-V Project Template (App-V 4.6 SP1) - - -You can use an App-V project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment which can help streamline the process of creating virtual application packages. - -**Note**   -You can only apply an App-V project template when you are creating a new virtual application package. Applying project templates to existing virtual application packages is not supported. - - - -For more information about applying an App-V project template, see [How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md). - -App-V project templates differ from App-V Application Accelerators because App-V Application Accelerators are application-specific, and App-V project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. - -The following general settings are saved with an App-V project template: - -- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring, Rebase **.dll’s**. - -- **Package Deployment Settings**. Contains **Protocol**, **Host Name**, **Port**, **Path**, **Operating Systems**, **Enforce Security Descriptors**, **Create MSI**, **Compress Package**. - -- **General Options**. Allows you to **Generate Microsoft Windows Installer (MSI)** package, **Allow Virtualization of Events**, **Allow Virtualization of Services**, **Append Package Version to Filename**. - -- **Exclusion Items**. Contains the Exclusion pattern list. - -**To create a project template** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. If the virtual application package is currently open in the App-V Sequencer, skip to step 3 of this procedure. To open the existing virtual application package that contains the settings you want to save with the App-V project template, click **File** / **Open** and click **Edit** **Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. - -3. In the App-V Sequencer console, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V project template. Click **Save**. - - The new App-V project template is saved in the directory specified in step 3 of this procedure. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-an-application-group.md b/mdop/appv-v4/how-to-create-an-application-group.md deleted file mode 100644 index ac2fba82be..0000000000 --- a/mdop/appv-v4/how-to-create-an-application-group.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Create an Application Group -description: How to Create an Application Group -author: dansimp -ms.assetid: 32751511-3d1e-40e5-b21f-d88ea39c76a3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create an Application Group - - -In the Application Virtualization Server Management Console, you can use the following procedure to create application groups to organize your applications. - -**To create an application group** - -1. In the Application Virtualization Server Management Console, click the **Applications** node in the left pane or expand it and highlight an existing application group. - -2. Right-click the **Applications** node or the existing application group where you want to put the new group, and choose **New Application Group**. - -3. In the **New Application Group Wizard**, type the name for the group and click **OK**. - - Now you can populate the new group by importing applications. You can also move applications between groups. For more information about moving applications, see [How to Move an Application](how-to-move-an-application.md). - -## Related topics - - -[How to Grant Access to an Application](how-to-grant-access-to-an-application.md) - -[How to Import an Application](how-to-import-an-applicationserver.md) - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - -[How to Move an Application](how-to-move-an-application.md) - -[How to Move an Application Group](how-to-move-an-application-group.md) - -[How to Remove an Application Group](how-to-remove-an-application-group.md) - -[How to Rename an Application Group](how-to-rename-an-application-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-an-application-license-group.md b/mdop/appv-v4/how-to-create-an-application-license-group.md deleted file mode 100644 index 76da2668b9..0000000000 --- a/mdop/appv-v4/how-to-create-an-application-license-group.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Create an Application License Group -description: How to Create an Application License Group -author: dansimp -ms.assetid: b385324a-8a11-41ee-86e8-8f809235454c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create an Application License Group - - -The Application Virtualization Server Management Console enables you to organize and manage application licenses. Depending on the type of license group, you can control who has access to the application and how many users can access an application at a time. You can use the following procedure to create an application license group. - -**To create an application license group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select one of the following menu items that corresponds to the type of license group you want to create, and complete the pages in the associated **New License Wizard**: - - 1. **New Unlimited License** - - 2. **New Concurrent License** - - 3. **New Named License** - -3. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Remove an Application License Group](how-to-remove-an-application-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md deleted file mode 100644 index bf6769fb47..0000000000 --- a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: How to Create App-V Package Accelerators (App-V 4.6 SP1) -description: How to Create App-V Package Accelerators (App-V 4.6 SP1) -author: dansimp -ms.assetid: 585e692e-cebb-48ac-93ab-b2e7eb7ae7ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create App-V Package Accelerators (App-V 4.6 SP1) - - -You can use App-V Package Accelerators to automatically generate a new virtual application package. After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). Creating App-V Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied. - -In some situations, to create the Package Accelerator, you might have to install the application locally on the computer running the Sequencer. First try to create the Package Accelerator by using the installation media, and if there are a number of missing files that are required, install the application locally to the computer running the Sequencer, and then create the Package Accelerator. - -**Important** -Before you begin the following procedure, you should do the following: - -- Copy the virtual application package that you must use to create the Package Accelerator locally to the computer running the Sequencer. - -- Copy all required installation files associated with the virtual application package to the computer running the Sequencer. - - - -**Important** -Disclaimer: The Microsoft Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer. - - - -**To create an App-V Package Accelerator** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the App-V **Create Package Accelerator** wizard, in the App-V Sequencer, click **Tools** / **Create Package Accelerator**. - -3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.sprj file). - - **Tip** - Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - - - -~~~ -Click **Next**. -~~~ - -4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. - - **Tip** - Copy the folder that contains the required installation files to the computer running the Sequencer. - - - -~~~ -If the application is already installed on the computer running the Sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. -~~~ - -5. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. - - **Note** - You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. - - - -6. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the Package Accelerator. Select only files that are required for the application to run successfully, and then click **Next**. - -7. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. - - If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**. - -8. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**. - -9. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory. - -10. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. - - **Important** - To help ensure that the Package Accelerator is as secure as possible, and so that the publisher can be verified when the Package Accelerator is applied, you should always digitally sign the Package Accelerator. - - - -## Related topics - - -Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) -[How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md b/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md deleted file mode 100644 index c4db220dcf..0000000000 --- a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Create or Upgrade Virtual Applications Using the App-V Sequencer -description: How to Create or Upgrade Virtual Applications Using the App-V Sequencer -author: dansimp -ms.assetid: 661d4f8c-2527-4654-9d92-15ecc652c0db -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create or Upgrade Virtual Applications Using the App-V Sequencer - - -The following topics provide detailed information about the associated Application Virtualization (App-V) Sequencer task. - -## In This Section - - -[How to Sequence an Application](how-to-sequence-an-application.md) -Provides a step-by-step procedure you can use to sequence an application. - -[How to Sequence a New Application (App-V 4.6)](how-to-sequence-a-new-application--app-v-46-.md) -Provides a step-by-step procedure you can use to sequence an application. - -[How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) -Provides a step-by-step procedure you can use to upgrade an existing virtual application to a new version. - -[How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) -Provides a step-by-step procedure you can use to upgrade an existing virtual application to a new version. - -[How to Modify a Virtual Application Package (App-V 4.6)](how-to-modify-a-virtual-application-package--app-v-46-.md) -Provides a step-by-step procedure you can use to modify an existing virtual application package. - -[How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md) -Provides a step-by-step procedure you can use to sequence a new application by using a command line. - -[How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md) -Provides a step-by-step procedure you can use to upgrade a virtual application by using a command line. - -[How To Use Dynamic Suite Composition](how-to-use-dynamic-suite-composition.md) -Provides information about how to define an application as being dependent on another application such as middleware or a plug-in. - -[How to Use the Differential SFT File](how-to-use-the-differential-sft-file.md) -Provides a step-by-step procedure you can use to create and deploy the Differential SFT file. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-the-package-root-directory.md b/mdop/appv-v4/how-to-create-the-package-root-directory.md deleted file mode 100644 index 8e00793ee2..0000000000 --- a/mdop/appv-v4/how-to-create-the-package-root-directory.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Create the Package Root Directory -description: How to Create the Package Root Directory -author: dansimp -ms.assetid: bcfe3bd4-6c60-409a-8ffa-cc22f27194b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create the Package Root Directory - - -The package root directory is the directory on the computer running the App-V Sequencer where files for the sequenced application are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed. You should create the package root directory before you monitor the installation of a new application. - -After you have created the package root directory, you can begin sequencing applications. For more information about sequencing a new application, see [How to Install the Sequencer](how-to-install-the-sequencer.md). - -**To create the package root directory** - -1. To create the package root directory, on the computer running the App-V Sequencer, map the Q:\\ drive to the specified network location. The location you specify should have sufficient space to save the application you are sequencing. - -2. To create a directory that you can use for a new virtual application, create a folder on the Q:\\ drive and assign it a name. - - **Important**   - The name you assign to virtual application files that will be saved in the package root directory should use the 8.3 naming format. The file names should be no longer than 8 characters with a three-character file name extension. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md b/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md deleted file mode 100644 index b745ddf86a..0000000000 --- a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Create the Sequencer Package Root Directory -description: How to Create the Sequencer Package Root Directory -author: dansimp -ms.assetid: 23fe28f1-c284-43ee-b8b7-1dfbed94eea5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create the Sequencer Package Root Directory - - -The package root directory is the directory on the computer running the App-V Sequencer where files for the sequenced application are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed. You should create the package root directory before you monitor the installation of a new application. - -After you have created the package root directory, you can begin sequencing applications. For more information about sequencing a new application, see [How to Sequence an Application](how-to-sequence-an-application.md). - -**To create the package root directory** - -1. To create the package root directory, on the computer running the App-V Sequencer, map the Q:\\ drive to the specified network location. The location you specify should have sufficient space to save the application you are sequencing. - -2. To create a directory that you can use for a new virtual application, create a folder on the Q:\\ drive and assign it a name. - - **Important**   - The name you assign to virtual application files that will be saved in the package root directory should use the 8.3 naming format. The file names should be no longer than 8 characters with a three-character file name extension. - - - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) - -[How to Modify the Scratch Directory Location](how-to-modify-the-scratch-directory-location.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md b/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md deleted file mode 100644 index f1e04f6d1e..0000000000 --- a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Customize an Application Virtualization System in the Server Management Console -description: How to Customize an Application Virtualization System in the Server Management Console -author: dansimp -ms.assetid: e3a51d1d-451d-46a5-8ae5-f5792d49495b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Customize an Application Virtualization System in the Server Management Console - - -You can choose a variety of options to customize an Application Virtualization System. These options are available through the user interface of the Application Virtualization Server Management Console. - -## In This Section - - -[How to Set Up and Enable or Disable Authentication](how-to-set-up-and-enable-or-disable-authentication.md) -Provides procedures you can use to establish the levels of authentication for defining who has access to the system. - -[How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) -Provides procedures for setting up or disabling usage reporting. - -[How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) -Provides procedures for setting up the database size limits and determining when the server will clean up the database. - -[How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) -Provides procedures for setting up or disabling application licensing. - -[How to Add an Administrator Group](how-to-add-an-administrator-group.md) -Provides a procedure for adding an administrator group. - -[How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) -Provides a procedure for deleting an administrator group. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-file-type-association.md b/mdop/appv-v4/how-to-delete-a-file-type-association.md deleted file mode 100644 index 16c96b8513..0000000000 --- a/mdop/appv-v4/how-to-delete-a-file-type-association.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Delete a File Type Association -description: How to Delete a File Type Association -author: dansimp -ms.assetid: bb2dd1cf-9a5d-45a9-aca1-3c53144b73ec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a File Type Association - - -You can use the following procedure to delete a file type association. The **File Type Associations** node is one level below the **Application Virtualization** node in the **Scope** pane. When you select this node, the **Results** pane displays a list of file type associations. - -**To remove a file type association** - -1. In the **Results** pane, right-click the extension of the file type association you want to delete. - -2. Select **Delete** from the pop-up menu. - -3. Click **Yes** to delete the association, or click **No** to return to the **Results** pane. - -## Related topics - - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) - -[How to Add an Application](how-to-add-an-application.md) - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-package-version.md b/mdop/appv-v4/how-to-delete-a-package-version.md deleted file mode 100644 index c1d92e1264..0000000000 --- a/mdop/appv-v4/how-to-delete-a-package-version.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Delete a Package Version -description: How to Delete a Package Version -author: dansimp -ms.assetid: a55adb9d-ffa6-4df3-a2d1-5e0c73c35e1b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package Version - - -From the Application Virtualization Server Management Console, for a package that has multiple versions, you can use the following procedure to delete one or more versions and still stream the remaining versions of the package. You might do this to more effectively manage files on the server or to remove an obsolete version. - -**Note**   -When you choose to delete a version, a confirmation box reminds you that client computers might still be using it. You should advise users to exit and unload any applications before you remove a version that is in use. - - - -**To delete a package version** - -1. In the left panel of the Application Virtualization Server Management Console, expand **Packages**. - -2. Click the package that contains the version you want to delete. - -3. In the center pane, right-click the version of the package you want to delete and choose **Delete**. - -4. Read the confirmation window, and click **Yes** to complete the action. - - **Note**   - If you have users in disconnected operation, their applications will be replaced with the new versions the next time they connect to the servers. After you are sure all users have updated applications, you can delete old versions. - - - -## Related topics - - -[How to Delete a Package](how-to-delete-a-packageserver.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-packageserver.md b/mdop/appv-v4/how-to-delete-a-packageserver.md deleted file mode 100644 index 7f2bd13bae..0000000000 --- a/mdop/appv-v4/how-to-delete-a-packageserver.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Delete a Package -description: How to Delete a Package -author: dansimp -ms.assetid: 23f9c0e9-8910-47df-9fc0-7bbb5bbf2dc9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package - - -You can use the following procedure to delete a package, including all versions of the package, from the Application Virtualization Server Management Console. You might do this for easier management of files on the server or to remove a package and replace it with a more stable one. - -**Important**   -When you choose to delete a package, a confirmation box reminds you that this action deletes all its versions. The server will no longer be able to stream the application. - - - -**To delete a package** - -1. In the left pane of the Application Virtualization Server Management Console, expand **Packages**. - -2. In the menu tree pane, right-click the package you want to delete and choose **Delete**. - -3. Read the confirmation window, and click **Yes** to complete the action. - -## Related topics - - -[How to Delete a Package Version](how-to-delete-a-package-version.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-reportserver.md b/mdop/appv-v4/how-to-delete-a-reportserver.md deleted file mode 100644 index 14ac327bbf..0000000000 --- a/mdop/appv-v4/how-to-delete-a-reportserver.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Delete a Report -description: How to Delete a Report -author: dansimp -ms.assetid: 53350b71-1fb5-4f7e-a684-9ea1116c5c3f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Report - - -From the Application Virtualization Server Management Console, the process for deleting a report is the same regardless of the report type. - -**To delete a report** - -1. Click the **Reports** node to expand the list of reports. - -2. Right-click the desired report (either in the **Reports** node or the **Results** pane), and select **Delete**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md deleted file mode 100644 index 1fdb2c31c6..0000000000 --- a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Delete All Virtual Applications by Using the Command Line -description: How to Delete All Virtual Applications by Using the Command Line -author: dansimp -ms.assetid: bfe13b5c-825a-4eb1-a979-6c4b8d8b2a9c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete All Virtual Applications by Using the Command Line - - -You can use the following procedure to delete all virtual applications from a specific computer. - -**Note**   -When all applications are deleted from a package, the Application Virtualization (App-V) Client also deletes the package. - - - -**To delete all applications** - -- Run the following command to delete all applications for the user account under which the command is run. If you run the command with the optional /GLOBAL switch, using an account with administrative rights, all applications are deleted for all users. - - `SFTMIME DELETE OBJ:APP [/GLOBAL]` - - **Note**   - When all applications are deleted from a package, the Application Virtualization (App-V) Client also deletes the package. - - - -## Related topics - - -[How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) - -[How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-an-administrator-group.md b/mdop/appv-v4/how-to-delete-an-administrator-group.md deleted file mode 100644 index d538220e01..0000000000 --- a/mdop/appv-v4/how-to-delete-an-administrator-group.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Delete an Administrator Group -description: How to Delete an Administrator Group -author: dansimp -ms.assetid: 398a8028-e128-4020-bbe2-59ba63b5cd48 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete an Administrator Group - - -From the **Administrators** node of the Application Virtualization Server Management Console, you can use the following procedure to delete an administrator group. - -**To delete an administrator group** - -1. Click the **Administrators** node to display the list of administrator groups in the **Results** pane. - -2. In the **Actions** pane (far right pane), click **Delete**. - -3. Click **Yes**. - -## Related topics - - -[How to Add an Administrator Group](how-to-add-an-administrator-group.md) - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-an-application-server.md b/mdop/appv-v4/how-to-delete-an-application-server.md deleted file mode 100644 index 55f77b412f..0000000000 --- a/mdop/appv-v4/how-to-delete-an-application-server.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Delete an Application -description: How to Delete an Application -author: dansimp -ms.assetid: 421e7df0-fea3-4cb2-a884-3d04f2223da7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete an Application - - -You can delete an application through the Application Virtualization Server Management Console. This does not delete its Open Software Descriptor (.osd) file for other files from the Application Virtualization Server. After it is deleted, however, the application no longer streams to end users. - -**Note**   -If this is the only application in a package, deleting it also removes related package data and file associations. - - - -**To delete an application** - -1. In the left pane of the management console, click the **Applications** node. - -2. In the right pane, highlight one or more applications you want to delete. You can use CTRL or Shift key combinations to highlight multiple applications. - -3. Right-click the application or applications, and choose **Delete**. - -4. In the **Remove Application** confirmation prompt, click **Yes** to complete the action. - -## Related topics - - -[How to Import an Application](how-to-import-an-applicationserver.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-an-application.md b/mdop/appv-v4/how-to-delete-an-application.md deleted file mode 100644 index c1e441347c..0000000000 --- a/mdop/appv-v4/how-to-delete-an-application.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Delete an Application -description: How to Delete an Application -author: dansimp -ms.assetid: 03b0912d-b14a-4522-916d-71f8b77a8a82 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete an Application - - -When you select the **Application** node in the Application Virtualization Client Management Console, the **Results** pane displays a list of applications. You can use the following procedure to delete an application from the **Results** pane, which also removes the application from the cache. - -**Note**   -When you delete an application, the selected application will no longer be available to any users on that client. Shortcuts and file type associations are hidden, and the application is deleted from cache. However, if another application refers to data in the file system cache data for the selected application, these items will not be deleted. - -After a publishing refresh, the deleted applications will again become available to you. - - - -**To delete an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Delete** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-deny-access-to-an-application.md b/mdop/appv-v4/how-to-deny-access-to-an-application.md deleted file mode 100644 index 1dd6b7fdf5..0000000000 --- a/mdop/appv-v4/how-to-deny-access-to-an-application.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Deny Access to an Application -description: How to Deny Access to an Application -author: dansimp -ms.assetid: 14f5e201-7265-462c-b738-57938dc3fc30 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deny Access to an Application - - -Users must be in an application's **Access Permissions** list to load and use the application. Although the Application Virtualization Server Management Console does not support explicitly denying a user group access to an application, you can remove the user groups from an application’s properties to achieve this. - -**To deny access to an application** - -1. For an existing application, click the **Applications** node in the left pane. - -2. Right-click an application in the right pane, and choose **Properties**. Then select the **Access Permissions** tab. - -3. To remove access for a user group, highlight the user group and click **Remove**. - -4. Click **OK**. - - **Note**   - To control access to applications, you can also limit the application licenses. Setting up the proper user groups in Active Directory Domain Services provides the easiest way to grant and deny access to specific sets of users. - - - -## Related topics - - -[How to Grant Access to an Application](how-to-grant-access-to-an-application.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md b/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md deleted file mode 100644 index 6fda63581a..0000000000 --- a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: How to Determine Whether to Edit or Upgrade a Virtual Application Package -description: How to Determine Whether to Edit or Upgrade a Virtual Application Package -author: dansimp -ms.assetid: 33dd5332-6802-46e0-9748-43fcc8f80aa3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine Whether to Edit or Upgrade a Virtual Application Package - - -Use the following table to help determine whether a virtual application package can be opened for edit, whether you need to create a new version of the package, or whether either option is available, using the App-V Sequencer. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ActionOpen for editOpen for upgrade

          View package properties.

          Yes

          Yes

          View package change history.

          Yes

          Yes

          View associated package files.

          Yes

          Yes

          Edit registry settings.

          Yes

          Yes

          Review additional package settings (except operating system file properties).

          Yes

          Yes

          Create associated Windows Installer (MSI).

          Yes

          Yes

          Modify OSD file.

          Yes

          Yes

          Compress and uncompress package.

          Yes

          Yes

          Add file type associations.

          Yes

          Yes

          Rename shortcuts.

          Yes

          Yes

          Set virtualized registry key state (override / merge).

          Yes

          Yes

          Set virtualized folder state.

          Yes

          Yes

          Edit virtual file system mappings.

          Yes

          Yes

          Review all associated operating system file properties for a package.

          No

          Yes

          Add additional services.

          No

          Yes

          Add additional files.

          No

          Yes

          Collect and configure associated security descriptors.

          No

          Yes

          Apply security updates or upgrade to a new version.

          No

          Yes

          Add an additional application.

          No

          Yes

          Apply updates that require the application to open.

          No

          Yes

          Apply updates that require the computer to restart.

          No

          Yes

          - -  - -## Related topics - - -[How to Edit an Existing Virtual Application](how-to-edit-an-existing-virtual-application.md) - -[How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md b/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md deleted file mode 100644 index 5394ec7bb3..0000000000 --- a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: How to Determine Which Type of Application to Sequence (App-V 4.6 SP1) -description: How to Determine Which Type of Application to Sequence (App-V 4.6 SP1) -author: dansimp -ms.assetid: 936abee2-98f1-45fb-9f0d-786e1d7464b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Determine Which Type of Application to Sequence (App-V 4.6 SP1) - - -You can sequence three basic types of applications by using Microsoft Application Virtualization (App-V) Sequencer. - -## To determine which type of application to sequence - - -Use the following table to determine which type of application you should sequence and to obtain more information about how to sequence the application. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Application TypeDescriptionMore Information

          Standard

          Select this option to create a package that contains an application or a suite of applications. You should select this option for most applications that you plan to sequence.

          How to Sequence a New Standard Application (App-V 4.6 SP1)

          Add-on or Plug-in

          Select this option to create a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or another package that is linked by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see How To Use Dynamic Suite Composition (https://go.microsoft.com/fwlink/?LinkId=203804).

          How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)

          Middleware

          Select this option to create a package that is required by a standard application, for example, the Microsoft .NET Framework. Middleware packages are used for linking to other packages by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see How To Use Dynamic Suite Composition (https://go.microsoft.com/fwlink/?LinkId=203804).

          How to Sequence a New Middleware Application (App-V 4.6 SP1)

          - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md b/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md deleted file mode 100644 index fc1d34c067..0000000000 --- a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Disable or Modify Disconnected Operation Mode Settings -description: How to Disable or Modify Disconnected Operation Mode Settings -author: dansimp -ms.assetid: 39f166d7-2d25-4899-8405-b45f051facb8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Disable or Modify Disconnected Operation Mode Settings - - -Use the following procedures in Application Virtualization Client to disable or modify disconnected operation mode settings. - -**To disable disconnected operation** - -1. Right-click the **Application Virtualization** node in the console, and select **Properties** from the pop-up menu. - -2. Click the **Connectivity** tab, and then clear **Allow disconnected operation** check box. - -3. Click **OK** to accept the change. - -**To change the time-out** - -1. Right-click the **Application Virtualization** node in the console, and select **Properties** from the pop-up menu. - -2. Click the **Connectivity** tab, and then select the **Limit disconnected operation to** check box. - -3. In the field, enter a value from 1–999999 (representing days). The default value is 90 days. - -4. Click **OK** to accept the change. - -**To work offline** - -1. Right-click the **Application Virtualization** node in the console, and select **Properties** from the pop-up menu. - -2. Click the **Connectivity** tab, and then select the **Work offline** check box. - -3. Click **OK** to accept the change. - -## Related topics - - -[Disconnected Operation Mode](disconnected-operation-mode.md) - -[How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md b/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md deleted file mode 100644 index 822fe72dd9..0000000000 --- a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Edit an Existing Virtual Application -description: How to Edit an Existing Virtual Application -author: dansimp -ms.assetid: 358b9a69-5695-4c6f-92e1-7ed2b69a2def -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit an Existing Virtual Application - - -You can use the following procedure to edit the properties associated with an existing virtual application package by using the Application Virtualization (App-V) Sequencer. You must open the existing virtual application, make the necessary updates, and then save the updated virtual application package. - -**To modify an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start**/**Programs**/**Microsoft Application Virtualization**/**Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application, in the App-V Console, select **File**/**Open**. Use the **Open** dialog box to locate the associated SPRJ file you want to modify. - -3. Modify the virtual application package. For more information about what properties can be modified, see [How to Determine Whether to Edit or Upgrade a Virtual Application Package](how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md). - -4. To save the modifications, select **File** / **Save**. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -[How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md b/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md deleted file mode 100644 index 41b7631eb1..0000000000 --- a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Edit an OSD File Using a Text Editor -description: How to Edit an OSD File Using a Text Editor -author: dansimp -ms.assetid: f4263a1b-824f-49b9-8060-b8229c9d9960 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit an OSD File Using a Text Editor - - -Use the following procedure to edit an Open Software Descriptor (OSD) file by using a text editor. - -**To edit an OSD file by using a text editor** - -1. Open the OSD file using any XML or ASCII text editor—for example, Microsoft Notepad. - - **Note**   - Before modifying the OSD file, read the schema prescribed by the XSD file in the install directory. Failing to follow this schema might introduce errors that prevent a sequenced application from starting successfully. - - - -2. Edit the OSD file using your XML or ASCII text editor of choice, adhering to the prescribed schema and the following guidelines: - - 1. Ensure that named elements are nested within the <SOFTPKG> root element. - - 2. Ensure that element names are in all uppercase letters. - - 3. Be aware that attribute values are case sensitive. - - 4. Type carefully, and observe the XML specifications. - -## Related topics - - -[About the OSD Tab](about-the-osd-tab.md) - -[How to Edit an OSD File](how-to-edit-an-osd-file.md) - -[OSD File Elements](osd-file-elements.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-edit-an-osd-file.md b/mdop/appv-v4/how-to-edit-an-osd-file.md deleted file mode 100644 index 6f19e9a7b7..0000000000 --- a/mdop/appv-v4/how-to-edit-an-osd-file.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: How to Edit an OSD File -description: How to Edit an OSD File -author: dansimp -ms.assetid: 0d126ba7-72fb-42ce-982e-90ed01a852c8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit an OSD File - - -Use the following procedures to modify a sequenced application package's Open Software Descriptor (OSD) file by adding or deleting an element or an attribute. - -**Note**   - Some elements do not have an attribute, so it is not possible to add an attribute to every element. - - - -**Important**   -If you use the OSD editor to change the .sft file name, the HREF attribute of the CODEBASE element in the OSD file, you must use the **Save As** command to save the change to the project files. - - - -**To add an element** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the navigation pane, right-click the element that you want to modify. On the menu, select **Element** and select **Add**. - -4. From the menu, select the element you want to add—for example, **Codebase**. - -5. From the **File** menu, select **Save**. - -**To delete an element** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the navigation pane, right-click the element that you want to delete. On the menu, select **Element** and select **Delete**. - -4. From the **File** menu, select **Save**. - -**To add an attribute** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the left pane, right-click the element to which you want to add an attribute. On the menu, select **Attribute** and select **Add**, choosing from the listed available attributes. - -4. From the **File** menu, select **Save**. - -**To delete an attribute** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the navigation pane, right-click the element from which you want to delete an attribute. On the menu, select **Attribute** and then select **Delete**, choosing the attribute you wish to delete. - -4. From the **File** menu, select **Save**. - -## Related topics - - -[About the OSD Tab](about-the-osd-tab.md) - -[How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) - -[OSD File Elements](osd-file-elements.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md b/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md deleted file mode 100644 index 480c2d8d34..0000000000 --- a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to Exit the App-V Client from the Notification Area -description: How to Exit the App-V Client from the Notification Area -author: dansimp -ms.assetid: 71ebf88b-ef51-41a5-ae34-4e197d9d6ee6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Exit the App-V Client from the Notification Area - - -You can use the following procedure to exit the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -**To exit the client** - -- Right-click the Application Virtualization System icon in the notification area, and select **Exit** from the pop-up menu. - - If you choose to exit from the client while virtual applications are open, the system displays a prompt telling you that you will lose unsaved data. Select **OK** or **Cancel** to acknowledge and close the prompt. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-export-a-reportserver.md b/mdop/appv-v4/how-to-export-a-reportserver.md deleted file mode 100644 index f7eb70e1aa..0000000000 --- a/mdop/appv-v4/how-to-export-a-reportserver.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Export a Report -description: How to Export a Report -author: dansimp -ms.assetid: 2f917130-db02-4c72-a45a-7928e51e689e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Export a Report - - -The process for exporting a report, using the Application Virtualization Console, is the same regardless of the report type. - -**To export a report** - -1. Right-click the report displayed in the **Results** pane, and select **Export** from the drop down menu. - -2. Select the report type from the list of types. - -3. In the **Save As** dialog box, navigate to the location where you want to save the output. - -4. Enter a name for the report in the **File Name** field, or select a file from the drop-down list of files. - -5. Select an output type from the **Save as Type** drop-down list of types. - -6. Click the **Save** button to save the file. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-grant-access-to-an-application.md b/mdop/appv-v4/how-to-grant-access-to-an-application.md deleted file mode 100644 index 89a6cf8277..0000000000 --- a/mdop/appv-v4/how-to-grant-access-to-an-application.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Grant Access to an Application -description: How to Grant Access to an Application -author: dansimp -ms.assetid: e54d9e84-21f5-488f-b040-25f374d9289f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Grant Access to an Application - - -As the administrator, you can use the Application Virtualization Server Management Console to determine which users can access which applications. You can do this when you import the Sequencer Project (SPRJ) or Open Software Descriptor (OSD) file or at anytime using the application's **Properties** dialog box. With both methods, use the **Access Permissions** options to add users. - -**To grant access to an application** - -1. For an existing application, click the **Applications** node in the left pane. Right-click an application in the right pane, and choose **Properties**. - -2. Select the **Access Permissions** tab. - -3. To add user groups, click **Add**. - -4. In the **Add/Edit User Group** dialog box, navigate to the user group. You can also enter the domain and group by typing the information in the respective fields. - -5. Click **OK**. You can add other groups with the same pages. - -6. When the wizard reappears, click **OK**. - - **Note**   - You must set up your groups in Active Directory Domain Services before you attempt to grant access to applications. - - - -## Related topics - - -[How to Deny Access to an Application](how-to-deny-access-to-an-application.md) - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-import-an-application.md b/mdop/appv-v4/how-to-import-an-application.md deleted file mode 100644 index 2fc950a033..0000000000 --- a/mdop/appv-v4/how-to-import-an-application.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to Import an Application -description: How to Import an Application -author: dansimp -ms.assetid: 85aaf5d8-489c-4929-996f-f15d2dab1ad8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Import an Application - - -You can use the following procedure to import an application into the cache directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To import an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Import** from the pop-up menu. - -2. From the **Browse** window, navigate to the location of the package file for the desired application, and then click **OK**. - - **Note**   - If you have already configured an import search path or if the SFT file is in the same path as the last successful import, step 2 is not required. - - - - - - - - - - - diff --git a/mdop/appv-v4/how-to-import-an-applicationserver.md b/mdop/appv-v4/how-to-import-an-applicationserver.md deleted file mode 100644 index 66852c68c1..0000000000 --- a/mdop/appv-v4/how-to-import-an-applicationserver.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: How to Import an Application -description: How to Import an Application -author: dansimp -ms.assetid: ab40acad-1025-478d-8e13-0e1ff1bd37e4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Import an Application - - -Typically, you import applications to make them available to stream from an Application Virtualization Management Server. You can also add an application manually, but you must provide precise, detailed information about the application to do so. For more information, see [How to Manually Add an Application](how-to-manually-add-an-application.md). - -**Note**   -To import an application, you must have its sequenced Open Software Descriptor (OSD) file or its Sequencer Project (SPRJ) file available on the server. - - - -When importing an application, you should make sure the server is configured with a value in the **Default Content Path** field on the **General** tab of the **System Options** dialog (accessible by right-clicking the **Application Virtualization System** node in the App-V Server Console). The default content path value defines where the applications will be imported, and during the import process, this value is used to modify the paths defined in the OSD file for the SFT file and for the icon shortcuts. In the OSD file, the path for the SFT file is specified in the CODEBASE HREF entry and the path for the icons is specified in the SHORTCUTS entry. - -During the import process, the protocol, server, and, if present, port specified in these two paths in the OSD file will be replaced with the value from the default content path. The following table provides an example of how the import path will be affected. - - ----- - - - - - - - - - - - - - - -
          Default Content PathOSD File CODEBASE HREFResulting Value

          \server\content</p>

          http://WebServer/myFolder/package.sft

          \server\content\myFolder\package.sft

          - - - -**To import an application** - -1. Right-click the **Applications** node in the left pane, and choose **Import Applications**. - -2. In the **Open** dialog box, navigate to the application's SPRJ or OSD file. Highlight the file and click **Open**. - -3. In the **New Application Wizard**, be sure the **Enabled** box is selected for applications you want to stream. There you can also enter a description and verify the server and file paths. Also, if you have set up license and server groups, you can select those. - -4. Click **Next**. - -5. On the **Published Shortcuts** screen, select the boxes for the locations where you would like the application shortcuts to appear on the client computers. - -6. Click **Next**. - -7. In the **File Associations** screen, you can add new file associations to this application. To do so, click **Add**, enter the extension (without a preceding dot), enter a description, and click **OK**. - - **Note**   - Applications sequenced with Sequencer 4.0 populate the **File Associations** dialog box when you import or create them through the management console. Applications with previous Sequencer version packages do not. - - - -8. Click **Next**. - -9. In the **Access Permissions** screen, click **Add**. - -10. Complete the **Select Groups** dialog box. When you finish, click **OK**. - -11. Click **Next**. - -12. On the **Summary** screen, you can review the import settings. Click **Finish**, or click **Back** to change the import or click **Cancel** to cancel the import. - -## Related topics - - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-a-database.md b/mdop/appv-v4/how-to-install-a-database.md deleted file mode 100644 index da440a18ff..0000000000 --- a/mdop/appv-v4/how-to-install-a-database.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Install a Database -description: How to Install a Database -author: dansimp -ms.assetid: 52e3a19d-b7cf-4f2c-8268-0f8361cc9766 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install a Database - - -You can use the following procedure to install a database for your server-based deployment of Application Virtualization if a database is not already available. Typically, in a production environment, you will connect to an existing database. - -**Important**   -To install the database, you must use a network account with the appropriate permissions. If your organization requires that only database administrators are allowed to create and conduct database upgrades, scripts are available that allow this task to be performed. - - - -**To install a database** - -1. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -2. On the **Welcome Page**, click **Next**. - -3. On the **License Agreement** page, to accept the license agreement, select **I accept the license terms and conditions**, and click **Next**. - -4. On the **Registering Information** page, specify the **User Name** and **Organization** information, and then click **Next**. - -5. On the **Setup Type** page, select **Custom** and then click **Next**. - -6. On the **Custom Setup** page, deselect all Application Virtualization System components except **Application Virtualization Server**, and then click **Next**. - - **Note**   - If a component is already installed on the computer, by deselecting it on the **Custom Setup** screen it will automatically be uninstalled. - - - -7. On the **Database Server** page, type the passwords, assign an installation path, save the information, and click **Next**. - -8. Select a name for the database, and then click **Next**. - - **Note**   - If error 25109 is displayed when you try to complete this step, you have incorrectly set up the permissions necessary to install the database. For details on setting up the necessary SQL permissions, please see . - - - -9. On the **Directory Server** screen, enter a domain name and credentials that Application Virtualization Servers and the Management Web Service will use to access your domain controller, save this information, and then click **Next**. - - **Note**   - The installation will default to the domain of the current computer. - - - -10. On the **Administrator Group** page, enter the name of a group that will have Administrator privileges, save this information, and then click **Next**. - - **Note**   - You can also enter the first few characters of the name of a group that will have Administration privileges, click **Next**, and on the **Select Administrator Group** screen, select the group from the resulting list. Then save this information and click **Next**. - - - -11. On the **Default Provider Group** page, enter the complete name of a group that will control access to applications, save this information, and then click **Next**. - - **Note**   - You can also enter the first few characters of the name of a group that will control access to applications, click **Next**, and on the **Select Default Provider Group** screen, select the group in the list. Then save this information and click **Next**. - - - -12. On the **Installation Wizard Completed** page, to close the wizard, click **Finish**. - - **Important**   - The installation can take a few minutes to finish. A status message will flash above the Windows desktop notification area, indicating whether the installation succeeded. - - - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md b/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md deleted file mode 100644 index ba2ed5bf33..0000000000 --- a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Install and Configure the App-V Management Console for a More Secure Environment -description: How to Install and Configure the App-V Management Console for a More Secure Environment -author: dansimp -ms.assetid: 9d89ef09-cdbf-48fc-99da-b24fc987ef8f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure the App-V Management Console for a More Secure Environment - - -The default installation of the App-V Management Console includes support for secure communications. Each Management Console is configured on a per-connection basis when the console is started for the first time or when connecting to an additional App-V Web Management Service. The default configuration uses SSL over TCP port 443. You can change the port number if the port number was modified on the server. You can use the following procedure to connect to an App-V Web Management Service by using a secure connection. - -**How to Connect to an App-V Management Service by Using an SSL Connection** - -1. Start the Application Virtualization Management Console. - -2. Click **Configure Connection** in the actions pane of the console. - -3. Type the **Web Service Host Name**, and ensure that **Use Secure Connection** is selected. - - **Important**   - The name provided in the Web Service Host Name must match the common name on the certificate, or the connection will fail. - - - -4. Select the appropriate login credentials, and click **OK**. - -## Related topics - - -[Configuring Certificates to Support the App-V Web Management Service](configuring-certificates-to-support-the-app-v-web-management-service.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md b/mdop/appv-v4/how-to-install-and-configure-the-default-application.md deleted file mode 100644 index 529a24aadc..0000000000 --- a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: How to Install and Configure the Default Application -description: How to Install and Configure the Default Application -author: dansimp -ms.assetid: 5c5d5ad1-af40-4f83-8234-39e972f2c29a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure the Default Application - - -The default application is provided as part of the installation and is automatically copied to the Microsoft Application Virtualization (App-V) Management Server during installation. It is used to verify that the Management Server was installed and configured correctly, but it has to be published to the Microsoft Application Virtualization (App-V) Client so that the user can access it. - -Use the following procedures to publish the default application and to stream it. - -**To publish the default application** - -1. Log on to the App-V Management Server by using an account that is a member of the App-V Administrators group specified during installation. - -2. On the App-V Management Server, click **Start**, click **Administrative Tools**, and then click **Application Virtualization Management Console**. - -3. In the App-V Management Console, click **Actions**, and then click **Connect to Application Virtualization System**. - -4. On the **Configure Connection** page, clear the **Use Secure Connection** check box. - -5. In the **Web Service Host Name** box, type the fully qualified domain name (FQDN) of the App-V Management Server, and then click **OK**. - - **Note**   - You can also use **localhost** for the Web Service Host name if it is installed on the Management Server. - - - -6. In the App-V Management Console, right-click the **Server** node, and click **System Options**. - -7. On the **General** tab, in the **Default Content Path** box, enter the Universal Naming Convention (UNC) path to the Content folder you created on the server during installation; for example, \\\\<Server Name>\\Content, and then click **OK**. - - **Important**   - Use the FQDN for the server name so that the client can resolve the name correctly. - - - -8. In the App-V Management Console, in the navigation pane, expand the **Server** node, and then click **Applications**. - -9. In the topic pane, click **Default Application**, and then, in the **Actions** pane, click **Properties**. - -10. In the **Properties** dialog box, next to the **OSD Path** box, click **Browse**. - -11. In the **Open** dialog box, enter the UNC path to the Content folder you created on the server during installation; for example, \\\\<Server Name>\\Content, and press ENTER. You must use the actual server name and cannot use the **localhost** here. - - **Important**   - Ensure that the values in both the **OSD Path** and **Icon Path** boxes are in UNC format (for example, \\\\<Server Name>\\Content\\DefaultApp.ico), and point to the Content folder you created when installing the server. Do not use **localhost** or a file path containing a drive letter such as C:\\Program Files\\..\\..\\Content. - - - -12. Select the DefaultApp.osd file, and click **Open**. - -13. Repeat the previous steps to configure the icon path. - -14. Click the **Access Permissions** tab, and confirm that the App-V Users group has access permissions to the application. - -15. Click the **Shortcuts** tab, and then click **Publish to User’s Desktop**. Click **OK**. - -16. Open Windows Explorer, and locate the Content directory. - -17. Double-click the DefaultApp.osd file, and open it with Notepad. - -18. Locate the line that contains the **HREF** tag, and change it to the following code: - - `CODEBASEHREF=”RTSP://:554/DefaultApp.sft”` - - Or, if you are using RTSPS: - - `CODEBASEHREF=”RTSPS://:322/DefaultApp.sft”` - -19. Close the DefaultApp.osd file, and save the changes. - -**To stream the default application** - -1. On the computer that has the App-V Client installed, log on as a user who is a member of the Application Virtualization Users group specified during server installation. - -2. On the desktop, the **Default Application Virtualization Application** shortcut appears. Double-click the shortcut to start the application. - -3. A status bar, displayed above the Windows notification area, reports that the application is starting. If the application startup is successful, the title screen for the default application is displayed. Click **OK** to close the dialog box. You have now confirmed that the App-V system is running correctly. - -## Related topics - - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md b/mdop/appv-v4/how-to-install-application-virtualization-management-server.md deleted file mode 100644 index 9fff92bc25..0000000000 --- a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: How to Install Application Virtualization Management Server -description: How to Install Application Virtualization Management Server -author: dansimp -ms.assetid: 8184be79-8c27-4328-a3c1-183791b5556c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install Application Virtualization Management Server - - -The Application Virtualization Management Server publishes its applications to clients. In a load-balanced environment, which is typical of large deployments, all servers in a server group should stream the same applications. If Application Virtualization Management Servers are to publish different applications, assign the servers to different server groups. In this case, you also might need to increase a server group's capacity. - -If you have designated a target computer on the network, with a login account having local Administrator privileges, you can use the following procedure to install the Application Virtualization Management Server and assign it to the appropriate server group. - -**Note** -The Installation Wizard can create a server group record, if one does not exist, as well as a record of the Application Virtualization Management Server's membership in this group. - - - -After you complete the installation process, reboot the server. - -**To install an Application Virtualization Management Server** - -1. Verify and, if necessary, uninstall previous versions of the Application Virtualization Management Server that are installed on the target computer. - -2. To open the **Microsoft Application Virtualization Management Server installation** wizard, navigate to the location of the Application Virtualization System **setup.exe** program on the network, either run this program from the network or copy its directory to the target computer, and then double-click the **Setup.exe** file. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, read the license agreement and, to accept the license agreement, select **I accept the license terms and conditions**. Click **Next**. - -5. On the **Registering Information** page, you must enter the user name and the **Organization**. Click **Next**. - -6. On the **Setup Type** page, select **Custom**. Click **Next**. On the **Custom Setup** page, deselect all Application Virtualization System components except **Application Virtualization Server**, and then click **Next**. - - **Caution** - If a component is already installed on the computer, when you deselect it in the **Custom Setup** window, the component is automatically uninstalled. - - - -7. On the **Configuration Database** page, select a database server from the list of available servers or add a server by selecting **Use the following host name** and specifying the **Server Name** and **Port Number** data. Click **Next**. - - **Note** - The Application Virtualization Management Server does not support case sensitive SQL. - - - -~~~ -If a database is available, click the radio button, select the database from the list, and then click **Next**. Setup will upgrade it to this newer version. If the name does not appear in the list, enter the name in the space provided. - -**Note** -When naming a server, do not use the backslash character (/) in the server name. - -If you need to install a database, see [How to Install a Database](how-to-install-a-database.md). If you would like to create a new database for this version, select **Create a new database** and specify the name that will be assigned to the new database. You can also specify a new location for the database by selecting the check box and entering the path. -~~~ - - - -8. On the **Connection Security Mode** page, select the desired certificate from the drop-down list. Click **Next**. - - **Note** - The **Secure Connection Mode** setting requires the server to have a server certificate provisioned to it from a public key infrastructure. If a server certificate is not installed on the server, this option is unavailable and cannot be selected. You must grant the Network Service account read access to the certificate being used. - - - -9. On the **TCP Port Configuration** page, to use the default port (554), select **Use default port (554)**. To specify a custom port, select **Use custom port** and specify the port number that will be used. Click **Next**. - - **Note** - When you install the server in a nonsecure environment, you can use the default port (554) or you can define a custom port. - - - -10. On the **Administrator Group** page, specify the name of the security group authorized to manage this server in **Group Name**. Click **Next**. Confirm the group specified and click **Next**. - -11. On the **Default Provider Group** page, specify the name of the default provider group, and then click **Next**. - -12. On the **Content Path** page, specify the location on the target computer where SFT files will be saved, and then click **Next**. - - **Note** - If the HTTP or RTSP port for the Management Server is already allocated, you will be prompted to choose a new port. Select the desired port, and then click **Next**. - - - -13. On the **Ready to Install the Program** page, to install the Application Virtualization Management Server, click **Install**. - - **Note** - If error 25120 is displayed when you try to complete this step, you need to enable IIS **Management Scripts and Tools**. To enable this Windows feature, open the **Programs and Features** control panel, select **Turn Windows features on or off**, and navigate to **Internet Information Services.** - - Under **Web Management Tools**, enable **IIS Management Scripts and Tools**. - - - -14. On the **Installation Wizard Completed** screen, to close the wizard, click **Finish**. - - **Important** - The installation can take a few minutes to finish. A status message will flash above the Windows desktop notification area, indicating that the installation succeeded. - - It is not necessary to reboot the computer when prompted. However, to optimize system performance, a reboot is recommended. - - - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md deleted file mode 100644 index 37596836cd..0000000000 --- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Install the App-V Client by Using Setup.exe -description: How to Install the App-V Client by Using Setup.exe -author: dansimp -ms.assetid: 106a5d97-b5f6-4a16-bf52-a84f4d558c74 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the App-V Client by Using Setup.exe - - -This topic describes how to install the App-V client by using the setup.exe program. When you install the App-V client using the setup.exe program, the installer determines which prerequisite software is needed and installs it automatically before it installs the client. - -**To install the Application Virtualization Client by Using Setup.exe** - -1. Make sure you are logged on with an account that has administrator rights on the computer. - -2. Open a Command Prompt window, and then change the directory to the folder that contains the setup files. When installing version 4.6 or a later version of the App-V client, you must use the correct installer for the computer’s operating system, 32-bit or 64-bit. The installation will fail and an error message will be displayed if you use the wrong installer. - -3. Enter the install command string at the command prompt. Alternatively, you can create a command file and run it from the command prompt. You can also use a scripting language such as VBScript or Windows PowerShell to run the command. - -4. The following command-line example shows how setup.exe can be used with a number of optional parameters. For more information about these parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). - - **"setup.exe" /s /v"/qn SWICACHESIZE=\\"10240\\" SWIPUBSVRDISPLAY=\\"Production System\\" SWIPUBSVRTYPE=\\"HTTP /secure\\" SWIPUBSVRHOST=\\"PRODSYS\\" SWIPUBSVRPORT=\\"443\\" SWIPUBSVRPATH=\\"/AppVirt/appsntype.xml\\" SWIPUBSVRREFRESH=\\"on\\" SWIGLOBALDATA=\\"D:\\AppVirt\\Global\\" SWIUSERDATA=\\"^% LOCALAPPDATA ^%\\Windows\\Application Virtualization Client\\" SWIFSDRIVE=\\"Q\\""** - - **Important**   - - The quotation marks that appear in the "**/v**" section must be treated as special characters and entered with a preceding "**\\**". The quotation marks are required only when the value contains a space; however, for consistency, all the instances in the preceding example are shown as having quotation marks. - - - The "**%**" characters in "**%HomeDrive%**" must be preceded by the "**^**" escape character. Otherwise, the Windows command shell sets the value to that of the user who is performing the installation. - - - The **InstallShield** switches **/s** and **/qn** are needed to make this a silent install. The **/qn** switch must follow the **/v** switch, separated by only a quote character with no intervening spaces. - - - The folder specified in the **SWIGLOBALDATA** value must already exist. - -   - -5. When the installation is complete, we recommend that you run a Microsoft Update scan to ensure the latest updates are installed. - -## Related topics - - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md deleted file mode 100644 index 5485cfe6f6..0000000000 --- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -title: How to Install the App-V Client by Using Setup.msi -description: How to Install the App-V Client by Using Setup.msi -author: dansimp -ms.assetid: 7221f384-36d6-409a-94a2-86f54fd75322 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the App-V Client by Using Setup.msi - - -This topic describes how to install the App-V client by using the setup.msi program. Before you install the App-V client using the setup.msi program, you must first determine if any prerequisite software must be installed, and then you must install it. To install the prerequisite software, see the [Installing Prerequisite Software](#prereq-sw) section of this topic. To install the client software, see the [Installing the App-V Client Using the Setup.msi Program](#msi-setup) section of this topic. - -## Installing Prerequisite Software - - -You can use the following procedures to install the prerequisite software. You can create a command file and run the commands from the command prompt, or you can use a scripting language such as VBScript or Windows PowerShell to run the commands. - -**Note**   -The x86 versions of the following software are required for both x86 and x64 versions of the App-V client. - - - -**To install Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)** - -1. Download the [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) software package from the Microsoft Download Center (). \[Template Token Value\] For version 4.5 SP2 and later of the App-V client, download vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).\[Template Token Value\] - -2. To install silently, use the command-line option “/Q” with vcredist\_x86.exe—for example, **vcredist\_x86.exe /Q**. - -3. To install the software by using the vcredist\_x86.msi file, use the command-line option “/C /T:<fullpathtofolder>” to extract the files vcredist.msi and vcredis1.cab from vcredist\_x86.exe to a temporary folder. To install silently, use the command-line option /quiet—for example, **msiexec /i vcredist.msi** /quiet. - -### To install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) - -**Important**   -For version 4.6 and later of the App-V client, you must also install the Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update. - - - -**** - -1. Download the [Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=150700) software package from the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=150700). - -2. To install silently, use the command-line option “/Q” with vcredist\_x86.exe—for example, **vcredist\_x86.exe /Q**. - -### To install Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) - -**** - -1. Download the [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) software package from the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=63266). - -2. To install silently, use the command-line option /quiet—for example, **msiexec /i msxml6\_x86.msi /quiet**. - -### To install Microsoft Application Error Reporting - -When installing Microsoft Application Error Reporting, you must use the *APPGUID* parameter to specify the App-V product code. The product code is unique for each App-V client type and version. Select the correct product code from the following table. - -**Important**   -For App-V 4.6 SP2 and later, you no longer need to install Microsoft Application Error Reporting (dw20shared.msi). App-V now uses Microsoft Error Reporting. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          VersionProduct Code for Desktop ClientProduct Code for Client for Remote Desktop Services

          App-V 4.5 CU1

          FE495DBC-6D42-4698-B61F-86E655E0796D

          8A97C241-D92A-47DC-B360-E716C1AAA929

          App-V 4.5 SP1

          93468B43-C19D-44F9-8BCC-114076DB0443

          0042AD3C-99A4-4E58-B5F0-744D5AD96E1C

          App-V 4.5 SP2

          C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D

          ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5

          App-V 4.6 x86

          9E9D30B2-2065-4FDE-B756-8F1A6EABAFC3

          439FAC21-B423-41D4-8126-54F9FCB70039

          App-V 4.6 x64

          E569E45F-7BA6-4C7F-B6BA-3FFCBE92FC22

          D2977C18-D88A-47CB-AFD8-652DD36F4D0D

          App-V 4.6 x86 ¹

          40C3258B-F9D1-46DF-AE97-72C1F86F2427

          9915D911-CC73-4122-AF4F-564F89454655

          App-V 4.6 x64 ¹

          1650E31F-23B8-40B5-A60A-C5934F557E3B

          7580D918-C621-49E7-9877-3CC59F9BD1DA

          App-V 4.6 x86 SP1

          DB9F70CD-29BC-480B-8BA2-C9C2232C4553

          1354855A-2298-4C73-9022-EF0686C65991

          App-V 4.6 x64 SP1

          342C9BB8-65A0-46DE-AB7A-8031E151AF69

          B2C6C8D5-FE76-4056-A326-EE5D633EA175

          - - - -¹ App-V “Languages” release. - -**Note**   -If you need to find the product code, you can use the Orca.exe database editor or a similar tool to examine Windows Installer files to find the value of the *ProductCode* property. For more information about using Orca.exe, see [Windows Installer Development Tools](https://go.microsoft.com/fwlink/?LinkId=150008) (https://go.microsoft.com/fwlink/?LinkId=150008). - - - -**** - -1. Locate the Microsoft Application Error Reporting install program, dw20shared.msi, which can be found in the **Support\\Watson** folder on the release media. - -2. To install the software, run the following command: - - **msiexec /i dw20shared.msi APPGUID={valuefromtable} REBOOT=Suppress REINSTALL=ALL REINSTALLMODE=vomus** - -## Installing the App-V Client by Using the Setup.msi Program - - -Use the following procedure to install the App-V client. Ensure that any necessary prerequisite software has been installed. \[Template Token Value\] For version 4.6 and later of the App-V client, the setup.msi program checks the system and if prerequisite software is not installed, it generates an error message indicating that installation cannot continue. \[Template Token Value\] - -**To install the Application Virtualization Client by Using Setup.msi** - -1. Make sure you are logged on with an account that has administrator rights on the computer. - -2. Open a Command Prompt window by using elevated rights, and then change the directory to the folder that contains the setup files. When installing version 4.6 or a later version of the App-V client, you must use the correct installer for the computer’s operating system, 32-bit or 64-bit. The installation will fail and an error message will be displayed if you use the wrong installer. - -3. Enter the install command string at the command prompt. Alternatively, you can create a command file and run it from the command prompt. You can also use a scripting language such as VBScript or Windows PowerShell to run the command. - -4. The following command-line example shows how setup.msi can be used with a number of optional parameters. For more information about these parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). - - **msiexec.exe /i "setup.msi" SWICACHESIZE="10240" SWIPUBSVRDISPLAY="Production System" SWIPUBSVRTYPE="HTTP /secure" SWIPUBSVRHOST="PRODSYS" SWIPUBSVRPORT="443" SWIPUBSVRPATH="/AppVirt/appsntype.xml" SWIPUBSVRREFRESH="on" SWIGLOBALDATA="D:\\AppVirt\\Global" SWIUSERDATA="^% LOCALAPPDATA^%\\Windows\\Application Virtualization Client" SWIFSDRIVE="S" /q** - - **Important**   - - The Windows Installer switch "**/q**" is used to make this a silent installation. - - - The "**%**" characters in "**%HomeDrive%**" must be preceded by the "**^**" escape character. Otherwise, the Windows command shell sets the value to that of the user who is performing the installation. - - - To turn on installation logging, use the msiexec switch **/l\*v filename.log**. - - - -## Related topics - - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md deleted file mode 100644 index 5cf9e908d7..0000000000 --- a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Install the Application Virtualization Sequencer -description: How to Install the Application Virtualization Sequencer -author: dansimp -ms.assetid: 89cdf60d-18b0-4204-aa9f-b402610f8f0e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Application Virtualization Sequencer - - -The Microsoft Application Virtualization Sequencer monitors and records the installation and setup process for applications so that the application can be run as a virtual application. You should install the Sequencer on a computer that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running a virtual environment—for example, Microsoft Virtual PC. This method is useful because it is easier to maintain a clean sequencing environment that can be reused with minimal additional configuration. - -You must have administrative rights on the computer you are using to sequence the application and the computer must not be running any version of the Application Virtualization (App-V) client. Creating a virtual application by using the Sequencer is very resource intensive, so it is important that you install the Sequencer on a computer that meets or exceeds the recommended requirements. Running the App-V sequencer in Safe Mode is not supported. For more information about the system requirements, see [Application Virtualization System Requirements](application-virtualization-system-requirements.md). - -**Important**   -After you have sequenced an application, before you can properly sequence a new application you must reinstall the operating system and the Sequencer on the computer you are using to sequence applications. - - - -**To install the Microsoft Application Virtualization Sequencer** - -1. Copy the Microsoft Application Virtualization Sequencer installation files to the computer that you want to install it on. - -2. To start the Microsoft Application Virtualization Sequencer installation wizard, select **setup.exe**. If the **Microsoft Visual C++ SP1 Redistributable Package (x86)** is not detected prior to installation, **setup.exe** will install it. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the terms of the license agreement, select **I accept the terms in the license agreement**. Click **Next**. - -5. On the **Destination Folder** page, to accept the default installation folder, click **Next**. To specify a different destination folder, click **Change** and specify the installation folder that will be used for the installation. Click **Next**. - -6. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -7. On the **InstallShield Wizard Completed** page, to close the installation wizard and open the Sequencer, click **Finish**. To close the installation wizard without opening the Sequencer, deselect **Launch the program** and click **Finish**. - -## Related topics - - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md b/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md deleted file mode 100644 index b6facad249..0000000000 --- a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: How to Install the Application Virtualization Streaming Server -description: How to Install the Application Virtualization Streaming Server -author: dansimp -ms.assetid: a3065257-fb5a-4d92-98f8-7ef996c61db9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Application Virtualization Streaming Server - - -The Application Virtualization Streaming Server publishes its applications to clients. In a load-balanced environment, which is typical of large deployments, all servers in a server group should stream the same applications. If Application Virtualization Streaming Servers are to stream different applications, assign the servers to different server groups. In this case, you might also have to increase a server group's capacity. - -If you have designated a target computer on the network, with a logon account having local administrative privileges, you can use the following procedure to install the Application Virtualization Streaming Server and assign it to the appropriate server group. - -**Note**   -The Installation Wizard can create a server group record, if one does not exist, and a record of the Application Virtualization Streaming Server membership in this group. - - - -After you complete the installation process, restart the server. - -**To install an Application Virtualization Streaming Server** - -1. Verify that no earlier versions of the Application Virtualization Streaming Server are installed on your target computer. - - **Important**   - Make sure that the App-V Management Server is not installed on this computer. The two products cannot be installed on the same computer. - - - -2. Navigate to the location of the Application Virtualization System Setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click the **Setup.exe** file. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the license terms, select **I accept the licensing terms and conditions**, and then click **Next**. - -5. On the **Customer Information** page, specify the **User name** and the organization, and then click **Next**. - -6. On the **Installation Path** page, click **Browse**, specify the location where you want to install the Streaming Server, and then click **Next**. - -7. On the **Connection Security Mode** page, select the desired certificate from the drop-down list, and then click **Next**. - - **Note**   - The **Secure Connection Mode** setting requires the server to have a server certificate provisioned to it from a public key infrastructure. If a server certificate is not installed on the server, this option is unavailable and cannot be selected. You must grant the Network Service account read access to the certificate being used. - - - -8. On the **TCP Port Configuration** page, to use the standard port (554), select **Use default port (554)**. To specify a custom port, select **Use custom port**, specify the port number in the field provided, and then click **Next**. - - **Note**   - When you install the server in a nonsecure scenario, you can use the default port (554), or you can define a custom port. - - - -9. On the **Content Root** page, specify the location on the target computer where SFT files will be saved, and then click **Next**. - - **Note**   - If the HTTP or RTSP port for the Virtual Application Streaming Server is already allocated, you will be prompted to select a new port. Specify the desired port, and then click **Next**. - - - -10. On the **Advanced Setting** screen, enter the following information: - - 1. **Max client connections** - - 2. **Connection timeout (sec)** - - 3. **RTSP thread pool size** - - 4. **RTSP timeout (sec)** - - 5. **Number of core processes** - - 6. **Core timeout (sec)** - - 7. **Enable User authentication** - - 8. **Enable User authorization** - - 9. **Cache block size (KB)** - - 10. **Maximum cache size (MB)** - - **Note**   - The App-V Streaming Server uses NTFS file system permissions to control access to the applications under the Content share. Use **Enable User authentication** and **Enable User authorization** to control whether the server checks and enforces those access control lists (ACLs) or not. - - - -11. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -12. On the **Installation Wizard Completed** screen, to close the wizard, click **Finish**. - - **Important**   - The installation can take several minutes to finish. A status message will flash above the Windows desktop notification area, indicating that the installation succeeded. - - It is not required to restart the computer when you are prompted. However, to optimize system performance, we recommend a restart. - - - -13. Repeat Steps 1–12 for each Virtual Application Server that you have to install. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md b/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md deleted file mode 100644 index 69e3331059..0000000000 --- a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Install the Client by Using the Command Line -description: How to Install the Client by Using the Command Line -author: dansimp -ms.assetid: ed372403-64ff-48ff-a3cd-a46cad04a4d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the Client by Using the Command Line - - -The topics in this section include procedures to install either the Application Virtualization (App-V) Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services) by using either setup.exe or setup.msi. Administrative rights are required to run either setup program. - -You can use optional command-line parameters to apply specific configuration settings to the App-V client during the installation. For more information about using parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). If you have applied registry settings to a computer before deploying a client—for example, by using Group Policy—these settings are retained and any additional command line parameters are applied. Command line parameter values will replace any existing value for the same setting. - -**Note**   -When you install the App-V client to use with a read-only cache, for example with a VDI server implementation, you must set the *AUTOLOADTARGET* parameter to NONE to prevent the client from trying to update applications when the cache is read-only. - - - -For more information about setting these parameter values after installation, see [How to Configure the App-V Client Registry Settings by Using the Command Line](https://go.microsoft.com/fwlink/?LinkId=169355) (https://go.microsoft.com/fwlink/?LinkId=169355) in the Application Virtualization (App-V) Operations Guide. - -**Note**   -If a configuration setting on the user’s computer depends on the client installation path, note that the Application Virtualization (App-V) 4.5 client copies its installation files to a different folder than previous versions did. By default, a new installation of the App-V 4.5 client will copy its installation files to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, running the App-V 4.5 client installer will perform an upgrade of the existing client using the existing installation folder. - - - -\[Template Token Value\] - -**Note**   -For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is copied to the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is copied to the Windows\\SysWOW64 directory. - - - -\[Template Token Value\] - -## In This Section - - -The following topics describe how to install either the Application Virtualization (App-V) Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services) by using either setup.exe or setup.msi. - -[How to Install the App-V Client by Using Setup.exe](how-to-install-the-app-v-client-by-using-setupexe-new.md) -Provides a step-by-step procedure for installing the App-V client by using the setup.exe program. - -[How to Install the App-V Client by Using Setup.msi](how-to-install-the-app-v-client-by-using-setupmsi-new.md) -Provides step-by-step procedures for installing any prerequisite software and also the App-V client by using the setup.msi program. - -## Related topics - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-management-console.md b/mdop/appv-v4/how-to-install-the-management-console.md deleted file mode 100644 index df74e0f969..0000000000 --- a/mdop/appv-v4/how-to-install-the-management-console.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Install the Management Console -description: How to Install the Management Console -author: dansimp -ms.assetid: 586d99c8-bca6-42e2-a39c-a696053142f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management Console - - -You can use the following procedure to install the Application Virtualization Management Console on a target computer on the network. You must use a network account that has administrator privileges on the target computer. You can use the console to configure and manage the Application Virtualization System Platform. - -Before you can complete this procedure, you must install the Application Virtualization Management Web Service on this or a different computer. The Management Web Service allows you to access the data store and the domain controller. For more information about installing the Web service, see [How to Install the Management Web Service](how-to-install-the-management-web-service.md). - -**To install the Management Console** - -1. Verify that no previous versions of the Management Console are installed on the target computer. - -2. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -3. On the **Welcome Page**, click **Next**. - -4. On the **License Agreement** page, to accept the license agreement, select **I accept the license terms and conditions**, and then click **Next**. - -5. On the **Registration Information** page, specify the **User Name** and **Organization** information, and then click **Next**. - -6. On the **Setup Type** page, click **Custom** and then click **Next**. - -7. On the **Custom Setup** page, deselect all Application Virtualization System components except **Management Console**, and then click **Next**. - - **Note**   - If a component is already installed on the computer, by deselecting it on the Custom Setup screen, it will automatically be uninstalled. - - - -8. On the **Ready to Modify the Program** screen, click **Install**. - - **Note**   - If this is the first component you install, the **Ready to Install the Program** page is displayed. To start the installation, click **Install**. - - - -9. On the **Installation Wizard Completed** screen, click **Finish**. Click **Okay** to restart the computer and complete the installation. - -10. In the Windows Control Panel, double-click **Administrative Tools** and then click **Application Virtualization Management Console** to display the Management Console. - -11. Click the **Connect** icon, or right-click the **Application Virtualization Systems** container, and then click **Connect to Application Virtualization System**. - -12. On the **Connect to Application Virtualization System** screen, enter the host name and port of the Management Web Service computer, change the security information and login credentials if necessary, and then click **OK**. - -13. After connecting to the Management Web Service computer, click **File** on the **Console** menu, and then click **Exit**. Click **Yes** to save console settings. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-management-web-service.md b/mdop/appv-v4/how-to-install-the-management-web-service.md deleted file mode 100644 index 72f0d59456..0000000000 --- a/mdop/appv-v4/how-to-install-the-management-web-service.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: How to Install the Management Web Service -description: How to Install the Management Web Service -author: dansimp -ms.assetid: cac296f5-8ca0-4ce7-afdb-859ae207d2f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management Web Service - - -Use the following procedure to install the Application Virtualization Management Web Service on a target computer on the network, with a logon account having local administrative privileges. Although it is not required, we recommended that you install this component on your Web server. - -**To install the Management Web Service** - -1. Verify that no previous versions of the Application Virtualization Web Service are installed on your target computer. - -2. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -3. After the Installation Wizard opens, on the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the license agreement, select **I accept the license terms and conditions**, and then click **Next**. - -5. On the **Registration Information** page, specify the **User Name** and organization information, and then click **Next**. - -6. On the **Setup Type** page, click **Custom**, and then click **Next**. - - **Note**   - If this is not the first component you installed on this computer, the **Program Maintenance** page is displayed. On the **Program Maintenance** page, click **Modify**. - - - -7. On the **Custom Setup** page, clear all Application Virtualization System components except **App Virt Management Service**, and then click **Next**. - - **Note**   - If a component is already installed on the computer, by clearing it on the **Custom Setup** page, you will automatically uninstall it. - - - -8. On the **Database Server** page, click **Connect to available database**, and then click **Next**. - - **Note**   - In a production environment, Microsoft assumes that you will connect to an existing database. If you want to install a database, see [How to Install a Database](how-to-install-a-database.md). After installing the database, continue with step 13. - - - -9. On the **Database Server Type** page, select a database type from the list, and then click **Next**. - -10. On the **Database Server Location** page, select a database server from the list of available servers or add a server by selecting the **Use the following host name** check box and entering information in the **Server Name** and **Port Number** boxes, and then click **Next**. - -11. On the **Select Database** page, select the database you want, and then click **Next**. - -12. On the **Database User Configuration** page, enter the credentials that the Management Web Service will use to access the data store, and then click **Next**. - -13. On the **Ready to Modify the Program** page, click **Install**. - - **Note**   - If this is the first component you install, the **Ready to Install the Program** page is displayed. On the page, click **Install**. - - - -14. On the **Installation Wizard Completed** page, click **Finish**. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md b/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md deleted file mode 100644 index ea900036a2..0000000000 --- a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: How to Install the Sequencer (App-V 4.6 SP1) -description: How to Install the Sequencer (App-V 4.6 SP1) -author: dansimp -ms.assetid: fe8eb876-28fb-46ae-b592-da055107e639 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer (App-V 4.6 SP1) - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records the installation and setup process for applications so that the application can be run as a virtual application. You should install the App-V Sequencer on a computer that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running in a virtual environment, for example, a virtual computer. This method is useful because it is easier to maintain a clean sequencing environment that you can reuse with minimal additional configuration. - -You must have administrative credentials on the computer you are using to sequence the application, and the computer must not be running any version of App-V client. Creating a virtual application by using the App-V Sequencer requires multiple operations, so it is important that you install the Sequencer on a computer that meets or exceeds the [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md). - -**Note** -Running the App-V sequencer in Safe Mode is not supported. - - - -**To install the Microsoft Application Virtualization Sequencer** - -1. Copy the Microsoft Application Virtualization Sequencer installation files to the computer on which you want to install it. - -2. To start the Microsoft Application Virtualization Sequencer installation wizard, double-click **Setup.exe**. If the **Microsoft Visual C++ SP1 Redistributable Package (x86)** is not detected prior to installation, click **Install** to install the required prerequisite. - -3. To continue the installation, on the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the terms of the license agreement, click **I accept the terms in the license agreement**, and then click **Next**. - -5. On the **Destination Folder** page, to accept the default installation folder, click **Next**. To specify a different destination folder, click **Change** and specify the installation folder that will be used for the installation. Click **Next**. - -6. On the **Virtual Drive** page, to configure the Application Virtualization default drive **Q:\\** (default) as the drive that all sequenced applications will run from, click **Next**. If you want to specify a different drive letter, use the list and select the drive letter that you want to use by selecting the appropriate drive letter, and then click **Next**. - - **Important** - The Application Virtualization drive letter specified with this step is the drive letter that virtual applications will be run from on target computers. The drive letter specified must be available, and not currently in use on the computers running the App-V client. If the specified drive is already in use, the virtual application fails on the target computer. - - - -7. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -8. On the **InstallShield Wizard Completed** page, to close the installation wizard and open the App-V Sequencer, click **Finish**. To close the installation wizard without opening the Sequencer, clear **Launch the program**, and then click **Finish**. - - **Note** - If you installed the App-V Sequencer on a computer running a virtual environment, for example a virtual machine, you must now take a snapshot. After you sequence an application, you can revert to this image, so you can sequence the next application. - - - -~~~ -When you uninstall the Sequencer, the following registry keys are not removed from the computer that the Sequencer was installed on. Additionally, you must restart the computer after you have uninstalled the Sequencer so that all associated drivers can be stopped and the operation can be completed. - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\SecKey** -~~~ - -## Related topics - - -[Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-sequencer.md b/mdop/appv-v4/how-to-install-the-sequencer.md deleted file mode 100644 index decce9699a..0000000000 --- a/mdop/appv-v4/how-to-install-the-sequencer.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Install the Sequencer -description: How to Install the Sequencer -author: dansimp -ms.assetid: 2cd16427-a0ba-4870-82d1-3e3c79e1959b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records the installation and setup process for applications so that the application can be run as a virtual application. You should install the Sequencer on a computer that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running a virtual environment—for example, Microsoft Virtual PC. This method is useful because it is easier to maintain a clean sequencing environment that can be reused with minimal additional configuration. - -You must have administrative rights on the computer you are using to sequence the application and the computer must be connected to the network. The computer must not be running any version of the Application Virtualization (App-V) client. Creating a virtual application using the Sequencer is very resource intensive, so it is important that you install the Sequencer on a computer that meets or exceeds the recommended requirements. For more information about the system requirements, see [Sequencer Hardware and Software Requirements](sequencer-hardware-and-software-requirements.md).. - -**To install the Microsoft Application Virtualization Sequencer** - -1. Copy the Microsoft Application Virtualization Sequencer installation files to the computer that you want to install it on. - -2. To start the Microsoft Application Virtualization Sequencer installation wizard, select **setup.exe**. If the **Microsoft Visual C++ SP1 Redistributable Package (x86)** is not detected prior to installation, **setup.exe** will install it. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the terms of the license agreement, select **I accept the terms in the license agreement**. Click **Next**. - -5. On the **Destination Folder** page, to accept the default installation folder, click **Next**. To specify a different destination folder, click **Change** and specify the installation folder that will be used for the installation. Click **Next**. - -6. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -7. On the **InstallShield Wizard Completed** page, to close the installation wizard and open the Sequencer, click **Finish**. To close the installation wizard without opening the Sequencer, deselect **Launch the program** and click **Finish**. - -## Related topics - - -[Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md b/mdop/appv-v4/how-to-install-the-servers-and-system-components.md deleted file mode 100644 index d8d537d0e8..0000000000 --- a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Install the Servers and System Components -description: How to Install the Servers and System Components -author: dansimp -ms.assetid: c6f5fef0-522a-4ef1-8585-05b292d0289b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Servers and System Components - - -Before you can deliver applications to users, you must install the Microsoft Application Virtualization Platform components. The topics in this section provide the information required to install the Application Virtualization Servers and the other Application Virtualization System components. - -**Note**   -The procedures in this section take you through a customized installation, where you pick and choose components to install on separate computers, as recommended in a production environment. However, your operating procedures might dictate a different approach, and during the installation process you might want to group components together. Regardless of where you install the components, you can install them in any order. - - - -## In This Section - - -[How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) -Provides a step-by-step procedure for installing the Application Virtualization Management Server and assigning it to the appropriate server group. - -[How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md) -Provides a step-by-step procedure for installing the Application Virtualization Streaming Server and assigning it to the appropriate server group. - -[How to Install the Management Web Service](how-to-install-the-management-web-service.md) -Provides a step-by-step procedure for installing the Application Virtualization Management Web Service on a target computer on your network. - -[How to Install the Management Console](how-to-install-the-management-console.md) -Provides a step-by-step procedure for installing the Application Virtualization Management Console on a target computer on your network. - -[How to Install a Database](how-to-install-a-database.md) -Provides a step-by-step procedure for installing a database for your server-based deployment of Application Virtualization, if a database is not already available. - -[How to Remove the Application Virtualization System Components](how-to-remove-the-application-virtualization-system-components.md) -Provides step-by-step procedures to remove all or selected Application Virtualization software components from a target computer. - -## Related topics - - -[Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-load-files-and-packages.md b/mdop/appv-v4/how-to-load-files-and-packages.md deleted file mode 100644 index f70cbf6dc3..0000000000 --- a/mdop/appv-v4/how-to-load-files-and-packages.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Load Files and Packages -description: How to Load Files and Packages -author: dansimp -ms.assetid: f86f5bf1-99a4-44d7-ae2f-e6049c482f68 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Load Files and Packages - - -You can use the following procedure to load files and packages on Application Virtualization Servers. - -**Note**   -During the installation process, you specified the location of the \\Content directory on the **Content Path** page. This directory should be created and configured as a standard file share before you point to its location. - - - -**To load files and packages** - -1. On the computer from which you will stream applications, navigate to the location that you specified for the \\Content directory. If necessary, create the directory and configure it as a standard file share. - -2. Move the SFT files for the virtual applications and packages to the \\Content directory. To keep the SFT files organized and to avoid confusion, put applications and packages in dedicated subfolders. - -3. Load the applications and packages according to the requirements of your scenario and configuration, considering the following conditions: - - - If your applications and packages are stored on an Application Virtualization (App-V) Management Server, load them through the Management Console. For more information, see [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) or [How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md). - - - If your applications are stored on an App-V Streaming Server, a Web server, or a computer configured as a file server, the applications can be automatically loaded. - - **Note**   - The App-V Streaming Server automatically polls the \\Content directory for applications and packages and puts this information in RAM to service application requests. - - The App-V Clients must be properly configured to retrieve applications and packages from Web servers and file servers. For more information, see [How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md). - - - -## Related topics - - -[Application Virtualization Server](application-virtualization-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-load-or-unload-an-application.md b/mdop/appv-v4/how-to-load-or-unload-an-application.md deleted file mode 100644 index 5dd97091a1..0000000000 --- a/mdop/appv-v4/how-to-load-or-unload-an-application.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Load or Unload an Application -description: How to Load or Unload an Application -author: dansimp -ms.assetid: 8c149761-c591-433f-972b-91793a69c654 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Load or Unload an Application - - -You can use the following procedures to load or unload an application from the cache, directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of applications. - -**Note**   -When you load or unload a package, all the applications in the package are loaded into or removed from cache. When loading a package, if you do not have adequate space in cache to load the applications, increase your cache size. For more information about cache size, see [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md). - - - -**To load an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Load** from the pop-up menu. - -2. The application is automatically loaded. The progress is tracked in the column labeled **Package Status**. You must refresh the view to see that the load is complete or to see the progress. - -**To unload an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Unload** from the pop-up menu. - -2. The application is automatically unloaded, and the **Package Status** column is updated to reflect the change. - -## Related topics - - -[How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md deleted file mode 100644 index c089ce97ab..0000000000 --- a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Load Virtual Applications from the Desktop Notification Area -description: How to Load Virtual Applications from the Desktop Notification Area -author: dansimp -ms.assetid: f52758eb-8b81-4b3c-9bc3-adcf7c00c238 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Load Virtual Applications from the Desktop Notification Area - - -If you are a mobile user, you might want to fully load your applications in the cache to use them during disconnected operation or offline mode. To stream applications from the Application Virtualization (App-V) Server or the Application Virtualization (App-V) Streaming Server, you must be connected to a server to load applications. If you are not connected to the server when you attempt to load applications, your system will generate an appropriate error message. You can also stream applications to the client from a file or disk. - -The applications are loaded one application at a time. The progress bar shows you the application name, the percentage of application loaded, and the number of applications already processed compared to the total number of the applications queued. You can skip any application in progress before it is 100% loaded. You can skip the loading of all remaining applications as well. - -**Note**   -If your system encounters an error while loading an application, it reports the error to you. You must dismiss the error dialog before it will load the next application. - - - -**To load all applications** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Load Applications** from the pop-up menu. - -**To skip applications** - -1. Click the progress bar to display the dialog box. - -2. Select one of the following buttons to achieve the desired results: - - 1. **Skip**—To skip the currently loading application. - - 2. **Skip All**—To skip all remaining applications. - - 3. **Continue**—To cancel the dialog box and continue loading applications. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md b/mdop/appv-v4/how-to-lock-or-unlock-an-application.md deleted file mode 100644 index 1b2b033d69..0000000000 --- a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Lock or Unlock an Application -description: How to Lock or Unlock an Application -author: dansimp -ms.assetid: 8c65d4fd-f336-447f-8c0a-6d65aec9fd00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Lock or Unlock an Application - - -You can use the following procedures to lock or unlock any application in the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services (formerly Terminal Services) cache. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services cache, you must first unlock it. - -**To lock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Lock** from the pop-up menu. The selected application is locked in the cache. - -**To unlock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Unlock** from the pop-up menu. The selected application is unlocked in the cache and can be removed. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md deleted file mode 100644 index a48df6078f..0000000000 --- a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Manage Application Groups in the Server Management Console -description: How to Manage Application Groups in the Server Management Console -author: dansimp -ms.assetid: 46997971-bdc8-4565-aefd-f47e90d6d7a6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Application Groups in the Server Management Console - - -You can display and manage one or more applications in application groups in the Application Virtualization Server Management Console. This can be useful when you want to do the following: - -- Organize many applications into more manageable subgroups. - -- Create groups of applications specific to a department or other company division. - -- Group similar types of applications, such as financial software. - -- Simplify access permissions or license management by group. - -- Change the properties of applications and application groups within a group simultaneously. - -You can create a group, place it where you would like in the console's **Applications** tree, and import applications to the group. Then you can configure and manage the group's properties to affect all of its applications. You can also move applications among groups. - -**Note**   -Moving applications into groups does not affect the locations of their files (SFT, OSD, or SPRJ) on the server's file system. - - - -## In This Section - - -[How to Create an Application Group](how-to-create-an-application-group.md) -Provides step-by-step instructions for creating an application group. - -[How to Move an Application Group](how-to-move-an-application-group.md) -Provides step-by-step instructions for moving an application group. - -[How to Rename an Application Group](how-to-rename-an-application-group.md) -Provides step-by-step instructions for renaming an application group. - -[How to Remove an Application Group](how-to-remove-an-application-group.md) -Provides step-by-step instructions for removing or deleting an application group. - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md deleted file mode 100644 index 89c0f06825..0000000000 --- a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Manage Application Licenses in the Server Management Console -description: How to Manage Application Licenses in the Server Management Console -author: dansimp -ms.assetid: 48503b04-0de7-48de-98ee-4623a712a341 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Application Licenses in the Server Management Console - - -The Application Virtualization Server Management Console is the interface you use to manage the Application Virtualization platform. From it, you can add, remove, configure, and control application license groups. - -**Important**   -If the App-V client Application Source Root (ASR) setting is configured to use any type of streaming source other than the Management Server, for example a Streaming Server, an IIS server, or a File server, then the Management Server is unable to enforce its licensing policy. - - - -## In This Section - - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) -Provides a procedure for creating a new application in a license group. - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) -Provides a procedure for adding an application to a license group. - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) -Provides a procedure for removing an application from a license group. - -[How to Remove an Application License Group](how-to-remove-an-application-license-group.md) -This section includes the steps necessary to delete an application license group. - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) -Provides a procedure for creating a new unlimited license group, allowing an unlimited number of users to access the applications in the group. - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) -Provides a procedure for creating a new concurrent license group, allowing a specific number of concurrent users to access the applications in the group. - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) -Provides a procedure for creating a new unlimited license group, allowing specific users to access the applications in the group. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md deleted file mode 100644 index caa426f56a..0000000000 --- a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Manage Applications in the Client Management Console -description: How to Manage Applications in the Client Management Console -author: dansimp -ms.assetid: 15cb5133-539b-499d-adca-ed02da20194a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Applications in the Client Management Console - - -You can use the Application Virtualization Client Management Console to manage virtual applications in the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) cache. In the context of application virtualization, the cache is the area on the client computer reserved to store virtual applications. - -## In This Section - - -[How to Load or Unload an Application](how-to-load-or-unload-an-application.md) -Provides procedures for loading or unloading an application into or from the client cache. - -[How to Clear an Application](how-to-clear-an-application.md) -Provides a procedure you can use to clear the settings, file type associations, and shortcuts from the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -[How to Repair an Application](how-to-repair-an-application.md) -Provides a procedure for repairing an application from the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -[How to Import an Application](how-to-import-an-application.md) -Provides a procedure you can use to add a new application to the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -[How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) -Provides procedures for locking or unlocking an application in the cache. - -[How to Delete an Application](how-to-delete-an-application.md) -Provides a procedure you can use to remove an application from the file system cache. - -[How to Change an Application Icon](how-to-change-an-application-icon.md) -Provides a procedure you can use to change the icon associated with the selected application. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md deleted file mode 100644 index bfae14c37b..0000000000 --- a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Manage Applications in the Server Management Console -description: How to Manage Applications in the Server Management Console -author: dansimp -ms.assetid: 21139a77-9f0f-4787-8173-a7766966ff7f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Applications in the Server Management Console - - -From the Application Virtualization Server Management Console, you can add, remove, configure, and control all applications, for one or multiple Application Virtualization Servers. - -## In This Section - - -[How to Import an Application](how-to-import-an-applicationserver.md) -Provides step-by-step instructions for importing an application by importing the Open Software Descriptor (OSD) or Sequencer Project (SPRJ) file. - -[How to Rename an Application](how-to-rename-an-application.md) -Provides step-by-step instructions for renaming an existing application. - -[How to Delete an Application](how-to-delete-an-application-server.md) -Provides step-by-step instructions for removing or deleting an application. - -[How to Manually Add an Application](how-to-manually-add-an-application.md) -Provides step-by-step instructions for manually adding an application to the servers. - -[How to Move an Application](how-to-move-an-application.md) -Provides step-by-step instructions for moving an application from one application group to another application group. - -[How to Grant Access to an Application](how-to-grant-access-to-an-application.md) -Provides step-by-step instructions for giving users access permission to applications. - -[How to Deny Access to an Application](how-to-deny-access-to-an-application.md) -Provides step-by-step instructions for denying users access permission to applications. - -[How to Change an Application Icon](how-to-change-an-application-iconserver.md) -Provides step-by-step instructions for changing the application icon. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md deleted file mode 100644 index 920445161f..0000000000 --- a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Manage Packages in the Server Management Console -description: How to Manage Packages in the Server Management Console -author: dansimp -ms.assetid: d13d3896-8575-4d2a-8bb4-1fe15d79c390 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Packages in the Server Management Console - - -Application Virtualization packages, accessible via the **Packages** node in the Application Virtualization Server Management Console, enable you to control virtual application versions on your Application Virtualization Management Servers. - -## In This Section - - -[How to Add a Package](how-to-add-a-package.md) -Provides a step-by-step procedure for adding a package to the Application Virtualization Server Management Console. - -[How to Add a Package Version](how-to-add-a-package-version.md) -Provides a step-by-step procedure for adding a new version of the package to the Application Virtualization Server Management Console. - -[How to Delete a Package](how-to-delete-a-packageserver.md) -Provides a step-by-step procedure for deleting a package from the Application Virtualization Server Management Console. - -[How to Delete a Package Version](how-to-delete-a-package-version.md) -Provides a step-by-step procedure for deleting a specific version of a package from the Application Virtualization Server Management Console. - -[How to Upgrade a Package](how-to-upgrade-a-package.md) -Provides a step-by-step procedure for upgrading a package version on the Application Virtualization Server Management Console. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md deleted file mode 100644 index cfd2debb42..0000000000 --- a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Manage Reports in the Server Management Console -description: How to Manage Reports in the Server Management Console -author: dansimp -ms.assetid: 28d99620-6339-43f6-9288-4aa958607c59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage Reports in the Server Management Console - - -To effectively manage the Application Virtualization System, you can use the Application Virtualization Server Management Console to generate a variety of reports that provide information about the system. This information includes daily usage information for a specific application or all applications, and system error tracking. - -**Note**   -- During installation, the installation script installs only the English language version of report viewer. For the report viewer to display the correct information in other languages, it is necessary to install a language pack from the following location: . - -- When you add or edit an application in the Server Management Console, you must make sure that the application names and versions exactly match those in the OSD files. The reporting feature uses the application names and versions data fields when it identifies application usage data on which to report. If the data fields do not match, the usage records will be skipped. - -  - -## In This Section - - -[Application Virtualization Report Types](application-virtualization-report-types.md) -Contains information about the available report types. - -[How to Create a Report](how-to-create-a-reportserver.md) -Provides a step-by-step process for creating a report. - -[How to Run a Report](how-to-run-a-reportserver.md) -Provides a step-by-step process for running a report. - -[How to Print a Report](how-to-print-a-reportserver.md) -Provides a step-by-step process for printing a report. - -[How to Export a Report](how-to-export-a-reportserver.md) -Provides a step-by-step process for exporting a report. - -[How to Delete a Report](how-to-delete-a-reportserver.md) -Provides a step-by-step process for deleting a report. - -## Related topics - - -[Application Utilization Report](application-utilization-reportserver.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Software Audit Report](software-audit-reportserver.md) - -[System Error Report](system-error-reportserver.md) - -[System Utilization Report](system-utilization-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md deleted file mode 100644 index 9287af4caa..0000000000 --- a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Manage Servers in the Server Management Console -description: How to Manage Servers in the Server Management Console -author: dansimp -ms.assetid: 6e851c74-ea86-4fef-bb0c-e690e8e7e7eb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Servers in the Server Management Console - - -The Application Virtualization Server Management Console is your interface to manage the servers in the Application Virtualization Platform. From it, you can add, configure, and control all the Application Virtualization Management Servers. - -## In This Section - - -[How to Create a Server Group](how-to-create-a-server-group.md) -Provides a procedure for creating server groups, to help you more effectively manage your servers. - -[How to Remove a Server Group](how-to-remove-a-server-group.md) -Provides a procedure for removing server groups from the Application Virtualization System. - -[How to Add a Server](how-to-add-a-server.md) -Provides a procedure for adding servers to a server group. - -[How to Remove a Server](how-to-remove-a-server.md) -Provides a procedure for removing servers from a server group. - -[How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) -Provides a procedure for changing the cache size of a server. - -[How to Change the Server Port](how-to-change-the-server-port.md) -Provides a procedure for changing the server ports. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md b/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md deleted file mode 100644 index b3050789b3..0000000000 --- a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Manage the App-V Client Cache Using Performance Counters -description: How to Manage the App-V Client Cache Using Performance Counters -author: dansimp -ms.assetid: 49d6c3f2-68b8-4c69-befa-7598a8737d05 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage the App-V Client Cache Using Performance Counters - - -You can use the following procedure to determine how much free space is available in the Application Virtualization (App-V) client cache by using Performance Monitor to display the information graphically. This information is captured on the client computer by a performance counter called “App Virt Client Cache,” and it includes the following counters: “Cache size (MB),” “Cache free space (MB),” and “% free space.” - -**To determine client cache space usage** - -1. Open a command prompt as administrator, or click **Start**, **Run**, type **perfmon.exe**, and click **OK**. - -2. Depending on the Windows operating system being used, click the Performance Monitor or System Monitor tool after the MMC window opens. - -3. To add counters, right-click the graph area and select **Add Counters**. - -4. Click the drop-down to display the list of available counters, scroll to find **App Virt Client Cache**, and then add the three counters. - - **Important**   - The App-V performance counters are implemented in a 32-bit DLL, so to see them, you must use the following command to start the 32-bit version of Performance Monitor: **mmc /32 perfmon.msc**. This command must be run directly on the computer being monitored and cannot be used to monitor a remote computer running a 64-bit operating system. - - - -## Related topics - - -[How to Manage Virtual Applications by Using the Command Line](how-to-manage-virtual-applications-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md deleted file mode 100644 index c88c2c0a2e..0000000000 --- a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Manage Virtual Applications by Using the Command Line -description: How to Manage Virtual Applications by Using the Command Line -author: dansimp -ms.assetid: 88c61c20-5243-4862-83eb-5b30825f8bbf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Virtual Applications by Using the Command Line - - -This section provides information about using the SFTMIME command-line language to manage applications and packages on computers. - -## In This Section - - -[How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) -Describes how to add a package to a specific computer by using SFTMIME. - -[How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) -Describes how to remove a package from a specific computer by using SFTMIME. - -[How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) -Describes how to remove all applications from a specific computer by using SFTMIME. - -[How to Manage the App-V Client Cache Using Performance Counters](how-to-manage-the-app-v-client-cache-using-performance-counters.md) -Describes how to determine free space in the client cache using the performance counters. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md b/mdop/appv-v4/how-to-manage-virtual-applications-manually.md deleted file mode 100644 index 1e5aa136e6..0000000000 --- a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md +++ /dev/null @@ -1,241 +0,0 @@ ---- -title: How to Manage Virtual Applications Manually -description: How to Manage Virtual Applications Manually -author: dansimp -ms.assetid: 583c5255-d3f4-4197-85cd-2a59868d85de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Virtual Applications Manually - - -You can use the Application Virtualization (App-V) Client Management Console to manage virtual applications in the App-V Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services). App-V administrators can use perform the following tasks: - -## How to Load or Unload an App-V Application - - -You can use the following procedures to load or unload an application from the cache, directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of applications. - -**Note**   -When you load or unload a package, all the applications in the package are loaded into or removed from cache. When loading a package, if you do not have adequate space in cache to load the applications, increase your cache size. For more information about cache size, see [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md). - - - -**To load an App-V application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Load** from the pop-up menu. - -2. The application is automatically loaded. The progress is tracked in the column labeled **Package Status**. You must refresh the view to see that the load is complete or to see the progress. - -**To unload an App-V application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Unload** from the pop-up menu. - -2. The application is automatically unloaded, and the **Package Status** column is updated to reflect the change. - -## How to clear an App-V application - - -You can clear an application from the console directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you clear an application, the system removes the settings, shortcuts, and file type associations that correspond to the application and also removes the application from the user’s list of applications. - -**Note**   -When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. If there are multiple applications in a package, the user's settings are not removed until all of the applications are cleared. - - - -**To clear an application from the console** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Clear** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - -## How to Repair an App-V application - - -To repair a selected application, you can perform the following procedure directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you repair an application, you remove any custom user settings and restore the default settings. This action does not change or delete shortcuts or file type associations, and it does not remove the application from cache. - -**To repair an App-V application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Repair** from the pop-up menu. - -3. At the confirmation prompt, click **Yes** to repair the application or **No** to cancel. - -## How to import an App-V application - - -You can use the following procedure to import an application into the cache directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To import an App-V application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Import** from the pop-up menu. - -2. From the **Browse** window, navigate to the location of the package file for the desired application, and then click **OK**. - - **Note**   - If you have already configured an import search path or if the SFT file is in the same path as the last successful import, step 2 is not required. - - - -## How to lock or unlock an App-V application - - -You can use the following procedures to lock or unlock any application in the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services (formerly Terminal Services) cache. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services cache, you must first unlock it. - -**To lock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Lock** from the pop-up menu. The selected application is locked in the cache. - -**To unlock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Unlock** from the pop-up menu. The selected application is unlocked in the cache and can be removed. - -## How to delete an App-V application - - -When you select the **Application** node in the Application Virtualization Client Management Console, the **Results** pane displays a list of applications. You can use the following procedure to delete an application from the **Results** pane, which also removes the application from the cache. - -**Note**   -When you delete an application, the selected application will no longer be available to any users on that client. Shortcuts and file type associations are hidden, and the application is deleted from cache. However, if another application refers to data in the file system cache data for the selected application, these items will not be deleted. - -After a publishing refresh, the deleted applications will again become available to you. - - - -**To delete an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Delete** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - -## How to change an App-V application icon - - -You can use the following procedure to change an icon associated with the selected application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To change an application icon** - -1. Move the cursor to the **Results** pane, and right-click the desired application. - -2. Select **Properties**. - -3. On the **General** tab, click **Change Icon**. - -4. Select the desired icon, or browse to another location to select the icon. After you've selected the icon, click **OK**. The new icon appears in the **Results** pane. - -## How to add an App-V application - - -You can use the following procedure to add an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To add an application** - -1. In the **Results** pane, right-click and select **New Application** from the pop-up menu. - -2. On the wizard page, you can perform the following tasks: - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **OSD File Path or URL**—Enter a local absolute path, a full UNC path (shared file or directory on a network), or an HTTP URL. - - 3. **(OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -3. Click **Finish** to add the application to the **Results** pane. - -## How to publish an App-V application shortcut - - -You can use the following procedure to publish shortcuts to an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To publish application shortcuts** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **New Shortcut** from the pop-up menu to display the New Shortcut Wizard. - -2. On the first page of the New Shortcut Wizard, select an icon and specify a name for the shortcut. - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **Shortcut Title**—Enter the name you want to give the shortcut. This field defaults to the existing name and version of the application. - -3. On the second page of the wizard, determine the location of the published shortcut. - - 1. **The Desktop**—Select this check box to publish the shortcut to the desktop. - - 2. **The Quick Launch Toolbar**—Select this check box to publish the shortcut to the Quick Launch toolbar. - - 3. **The Send To Menu**—Select this check box to publish the shortcut to the **Send To** menu. - - 4. **Programs in the Start Menu**—When you select the **Start Menu** check box, this field becomes active. Leave this field blank to publish the shortcut directly to the root of the Programs folder, or enter a folder name or hierarchy—for example, "My\_Computer\\Office Applications." Shortcuts created this way are available only for the current user. - - 5. **Another location** and **Browse** button—When you select the **Another location** check box, this field becomes active. Enter any valid location on the computer or any available UNC path (shared file or directory on a network). The **Browse** button displays a standard Windows **File Open** dialog box. - -4. On the third page of the wizard, enter desired command-line parameters. - -5. Click **Finish** to publish the shortcuts and exit to the **Results** pane. - -## How to add a file type association for an App-V application - - -You can use the following procedure to add a file type association, using the **File Type Associations** node in the Application Virtualization Client Management Console. - -**To add a file type association** - -1. Right-click the **File Type Associations** node, and select **New Association** from the pop-up menu. - -2. Complete the first step of the dialog box by completing the following information, and then click **Next**: - - 1. **Extension**—Enter a new file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is cleared. - - 4. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -3. Complete the second step of the dialog box by completing the following information, and then click **Finish** to return to the Client Management Console: - - 1. **Change Icon**—Click this button to change the application icon. Select one of the available icons, or browse to a new location and select an icon. - - 2. **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - 3. **Open file with the association described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -## How to delete a file type association for an App-V application - - -You can use the following procedure to delete a file type association. The **File Type Associations** node is one level below the **Application Virtualization** node in the **Scope** pane. When you select this node, the **Results** pane displays a list of file type associations. - -**To remove a file type association** - -1. In the **Results** pane, right-click the extension of the file type association you want to delete. - -2. Select **Delete** from the pop-up menu. - -3. Click **Yes** to delete the association, or click **No** to return to the **Results** pane. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md deleted file mode 100644 index 49b1512034..0000000000 --- a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Manage Virtual Applications Using the Command Line -description: How to Manage Virtual Applications Using the Command Line -author: dansimp -ms.assetid: 9394f34d-2b1e-4ea7-bf6f-1f56101ab4de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Virtual Applications Using the Command Line - - -Click any of the following links for more information about managing virtual applications using the command line. - -## In This Section - - -[How to Open a Sequenced Application Using the Command Line](how-to-open-a-sequenced-application-using-the-command-line.md) -Specifies how to open a virtual application using the command line. - -[How to Upgrade a Sequenced Application Package Using the Command Line](how-to-upgrade-a-sequenced-application-package-using-the-command-line.md) -Specifies how to sequence a virtual application using the command line. - -[How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) -Specifies how to upgrade a virtual application package using the command line. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manually-add-an-application.md b/mdop/appv-v4/how-to-manually-add-an-application.md deleted file mode 100644 index b503780e0d..0000000000 --- a/mdop/appv-v4/how-to-manually-add-an-application.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Manually Add an Application -description: How to Manually Add an Application -author: dansimp -ms.assetid: c635b07a-5c7f-4ab2-ba18-366457146cb9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manually Add an Application - - -When adding an application to the Application Virtualization Management Server, it is recommended that you import it. You can add an application manually, but you must provide the precise, detailed information about the application called for in this section. - -**To manually add a new application** - -1. In the left pane, right-click the **Applications** node and choose **New Application**. - -2. In the **New Application Wizard**, complete the **General Information** dialog box: - - 1. **Application Name**—Type the name you want the users to see. - - 2. **Version**—Type the application version. - - 3. **Enabled**—This box must be selected to stream the application after you create it. - - 4. **Description**—Type an optional description for administrative use. - - 5. **OSD Path**—Browse the network to the application's Open Software Descriptor (OSD) file. This file must be in a shared network folder. - - 6. **Icon Path**—Browse to the application's ICO file. - - 7. **Application License Group**—If you have set up license groups, you can assign the application to one by selecting it in the pull-down list. - - 8. **Server Group**—If you have multiple Application Virtualization Servers, you can assign the application to one by selecting it in the pull-down list. - -3. Click **Next**. - -4. In the **Select Package** dialog box, select the related package and click **Next**. - -5. On the **Published Shortcuts** screen, select the boxes for the locations where you would like the application shortcuts to appear on the client computers and click **Next**. - -6. In the **File Associations** screen, you can add new type file associations to this application. To do so, click **Add**, enter the extension (without a preceding dot), enter a description, and click **OK**. - -7. Click **Next**. - -8. In the **Access Permissions** dialog box, click **Add**. - -9. In the **Add/Edit User Group** dialog box, navigate to the user group. You can also enter the domain and group by typing the information in the respective fields. When you finish, click **OK**. You can add other groups with the same pages. - -10. Click **Next**. - -11. On the **Summary** screen, you can review the import settings. Click **Finish** to add the application, click **Back** to change the information, or click **Cancel**. - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md b/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md deleted file mode 100644 index 3df7f2a0ee..0000000000 --- a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: How to Manually Install the Application Virtualization Client -description: How to Manually Install the Application Virtualization Client -author: dansimp -ms.assetid: bb67f70b-d525-4317-b254-e4f084c717ab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - -# How to Manually Install the Application Virtualization Client - -There are two types of Application Virtualization Client components: the Application Virtualization Desktop Client, which is designed for installation on desktop computers, and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services), which you can install on Remote Desktop Session Host (RD Session Host) servers . Although the two client installer programs are different, you can use the following procedure to manually install either the Application Virtualization Desktop Client on a single desktop computer or the Application Virtualization Client for Remote Desktop Services on a single RD Session Host server. In a production environment, you most likely will install the Application Virtualization Desktop Client on multiple desktop computers with an automated scripted installation process. For information about how to install multiple clients by using a scripted installation process, see [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md). - -**Note** -1. If you are installing the Application Virtualization Client for Remote Desktop Services software on a RD Session Host server, advise users who have an open RDP or ICA client session with the RD Session Host server that they must save their work and close their sessions. In a Remote Desktop session, you can install the client the client manually. For more information about upgrading the client, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md). - -2. If you have any configuration on the user’s computer that depends on the client install path, note that the Application Virtualization (App-V) 4.5 client uses a different install folder than previous versions. By default, a new install of the Application Virtualization (App-V) 4.5 client will install to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, installing the App-V client will perform an upgrade into the existing installation folder. - -**Note** -For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is installed in the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is installed in the Windows\\SysWOW64 directory. - -**To manually install Application Virtualization Desktop Client** - -1. After you have obtained the correct installer archive file and saved it to your computer, make sure you are logged on with an account having administrator rights on the computer and double-click the file to expand the archive. - -2. Choose the folder in which to save the files, and then open the folder after the files have been copied to it. - -3. Review the Release Notes if appropriate. - -4. Browse to find the setup.exe file, and double-click setup.exe to start the installation. - -5. The wizard checks the system to ensure that all prerequisite software is installed, and if any of the following are missing, the wizard will automatically prompt you to install them: - - - Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) - - - Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) - - - Microsoft Application Error Reporting - - **Note** - For App-V version 4.6 and later, the wizard will also install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86). - - For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [https://go.microsoft.com/fwlink/?LinkId=150700](https://go.microsoft.com/fwlink/?LinkId=150700). - - If prompted, click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully. - -6. When the **Microsoft Application Virtualization Desktop Client – InstallShield Wizard** is displayed, click **Next**. - -7. The **License Agreement** screen is displayed. Read the license agreement, and if you agree, click **I accept the terms in the license agreement** and then click **Next**. - - Optionally, you can click the button to read the Privacy Statement. You must be connected to the Internet to access the Privacy Statement. - -8. On the **Setup Type** screen, select the setup type. Click **Typical** to use the default program values, or click **Custom** if you want to configure the program settings during installation. - -9. If you choose **Typical**, the next screen displays **Ready to Install the Program**. Click **Install** to begin the installation. - -10. If you choose **Custom**, the **Destination Folder** screen appears. - -11. On the **Destination Folder** screen, click **Next** to accept the default folder or click **Change** to display the **Change Current Destination Folder** screen. Browse to or, in the **Folder Name** field, enter the destination folder, click **OK**, and then click **Next**. - -12. On the **Application Virtualization Data Location** screen, click **Next** to accept the default data locations or complete the following actions to change where the data is stored: - - 1. Click **Change**, and then browse to or, in the **Global Data Location** field, enter the destination folder for the global data location, and click **OK**. The Global Data Directory is where the Application Virtualization Desktop Client caches data shared by all users on the computer, like OSD files and SFT file data. - - 2. If you want to change the drive letter to be used, select the preferred drive letter from the drop-down list. - - 3. Enter a new path to store the user-specific data in the **User-specific Data Location** field if you want to change the data location. The User Data Directory is where the Application Virtualization Desktop Client stores user-specific information, like personal settings for virtualized applications. - - **Note** - This path must be different for every user, so it should include a user-specific environment variable or a mapped drive or something else that will resolve to a unique path for each user. - - 4. When you have finished making the changes, click **Next**. - -13. On the **Cache Size Settings** screen, you can accept or change the default cache size. Click one of the following radio buttons to choose how to manage the cache space: - - 1. **Use maximum cache size**. Enter a numeric value from 100–1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. - - 2. **Use free disk space threshold**. Enter a numeric value to specify the amount of free disk space, in MB, that the Application Virtualization Client must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is currently unused. - - **Important** - To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. For more information about the cache space management feature, in the Microsoft Application Virtualization (App-V) Operations Guide, see **How to Use the Cache Space Management Feature**. - - Click **Next** to continue. - -14. In the following sections of the **Runtime Package Policy Configuration** screen, you can change the parameters that affect how the Application Virtualization client behaves during runtime: - - 1. **Application Source Root**. Specifies the location of SFT files. If used, overrides the protocol, server, and port portions of the CODEBASE HREF URL in the OSD file. - - 2. **Application Authorization**. When **Require User authorization even when cached** is checked, users are required to connect to a server and validate their credentials at least once before they are allowed to start each virtual application. - - 3. **Allow streaming from file**. Indicates whether streaming from file will be enabled, regardless of how the **Application Source Root** field is used. If not checked, streaming from files is disabled. This must be checked if **Application Source Root** contains a UNC path in the form \\\\server\\share. - - 4. **Automatically Load Application**. Controls when and how automatic background loading of applications occurs. - - **Note** - When you install the App-V client to use with a read-only cache, for example, with a VDI server implementation, set **What applications to Auto Load** to **Do not automatically load applications** to prevent the client from trying to update applications in the read-only cache. - - Click **Next** to continue. - -15. On the **Publishing Server** screen, select the **Set up a Publishing Server now** check box if you want to define a publishing server, or click **Next** if you want to complete this later. To define a publishing server, specify the following information: - - 1. **Display Name**—Enter the name you want to display for the server. - - 2. **Type**—Select the server type from the drop-down list of server types. - - 3. **Host Name** and **Port**—Enter the host name and the port in the corresponding fields. When you select a server type in the drop-down list, the port field will automatically fill with the standard port numbers. To change a port number, click the server type in the list and change the port number according to your needs. - - 4. **Path**—If you have selected either **Standard HTTP Server** or **Enhanced Security HTTP Server**, you must enter the complete path to the XML file containing publishing data in this field. If you select either **Application Virtualization Server** or **Enhanced Security Application Virtualization Server**, this field is not active. - - 5. **Automatically contact this server to update settings when a user logs in**—Select this check box if you want this server to be queried automatically when users log in to their account on the Application Virtualization Client. - - 6. When finished with the configuration steps, click **Next**. - -16. On the **Ready to Install the Program** screen, click **Install**. A screen is displayed that shows the progress of the installation. - -17. On the **Install Wizard Completed** screen, click **Finish**. - - **Note** - If the installation fails for any reason, you might need to restart the computer before trying the install again. - -## Related topics - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -[Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md) diff --git a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md deleted file mode 100644 index 4302487ce2..0000000000 --- a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Manually Manage Applications in the Client Management Console -description: How to Manually Manage Applications in the Client Management Console -author: dansimp -ms.assetid: e29caa22-325d-457b-a177-a11f8a8ad57c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manually Manage Applications in the Client Management Console - - -This section provides procedures for using the Application Virtualization Client Management Console to manually manage your virtual applications. - -## In This Section - - -[How to Add an Application](how-to-add-an-application.md) -Provides a procedure you can use to add an application to the cache directly from the Application Virtualization Client Management Console. - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) -Provides a procedure you can use to publish application shortcuts to the desktop, menus, and tool bar directly from the Application Virtualization Client Management Console. - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) -Provides a procedure you can use to add a file type association to an application. - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) -Provides a procedure you can use to delete a file type association. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md b/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md deleted file mode 100644 index f4e1e2a14e..0000000000 --- a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: How to Migrate the App-V SQL Database to a Different SQL Server -description: How to Migrate the App-V SQL Database to a Different SQL Server -author: dansimp -ms.assetid: 353892a1-9327-4489-a19c-4ec7bd1b736f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Migrate the App-V SQL Database to a Different SQL Server - - -The following procedures describe in detail how to migrate the SQL database of the Microsoft Application Virtualization (App-V) Management Server to a different SQL Server. - -**Important**   -This procedure requires that the App-V server service is stopped and this will prevent end-users from using their applications. - - - -**To back up the App-V SQL database** - -1. Open the Services.msc program and stop the App-V Management Server service on all Management Servers that use the database to be migrated. - -2. On the computer where the App-V database is located, open SQL Server Management Studio. - -3. Expand the **Databases** node and locate the App-V database (default name is APPVIRT). - -4. Right-click the database and select **Tasks** and then select **Back Up**. - -5. Verify that **Recovery model** is set to **SIMPLE** and the **Backup type** is set to **Full**. Change the **Backup set** and **Destination** settings if it is necessary. - -6. Click **OK** to back up the database. After the backup has completed successfully, click **OK**. - -7. Open Windows Explorer and browse to the folder that contains the database backup file, for example APPVIRT.BAK. Copy the database backup file to the destination computer that is running SQL Server. - -**To restore the App-V SQL database to the destination computer** - -1. On the destination computer, open SQL Server Management Studio, right-click the **Databases** node and select **Restore Database**. - -2. Under **Source for Restore**, choose **From device** and then click the “**…**” button. - -3. In the **Specify Backup** dialog box, make sure that the **Backup Media** is set to **File** and then click **Add**. - -4. Select the backup file that you copied from the original computer that is running SQL Server, and then click **OK**. - -5. Click **OK** and then click to select the backup set to restore. - -6. Under **Destination for restore**, click the drop-down for **To database** and select the App-V database name, for example APPVIRT. - -7. Click **OK** to start the restore. After the restore has completed successfully, click **OK**. - -8. Expand the **Security** node, right-click **Logins** and select **New Login**. - -9. In the **Login Name** field, enter the Network Service account details for the App-V Management Server in the format of DOMAIN\\SERVERNAME$. - -10. On the **General** page under **Default database** select the App-V database name, for example, APPVIRT, and then click **OK**. - -11. Under **Select a page**, click to select the **User Mapping** page. Under **Users mapped to this login**, click the check box in the **Map** column to select the App-V database. - -12. Under **Database role membership for: <appvdatabasename>**, click to select **SFTEveryone** and then click **OK**. - -13. Make sure that the Windows Firewall on the new computer that is running SQL Server is configured to allow the App-V Management Server to access the system. Under **Administrative Tools**, use the **Windows Firewall with Advanced Security** program to create an **Inbound Rule** for the port that is used by SQL Server (default is port 1433). - -**To migrate the App-V SQL Server Agent jobs** - -1. On the original computer that is running SQL Server, in SQL Server Management Studio, expand the **SQL Server Agent** node, and then expand the **Jobs** node. - -2. Right-click the following four App-V jobs and select **Script Job as | CREATE to | File**, and save each script to a folder and give each script a descriptive name. - - - **Softgrid Database (appvdbname) Check Usage History** - - - **Softgrid Database (appvdbname) Close Orphaned Sessions** - - - **Softgrid Database (appvdbname) Enforce Size Limit** - - - **Softgrid Database (appvdbname) Monitor Alert/Job Status** - -3. Copy the four script files (.sql) to the destination computer that is running SQL Server and open SQL Server Management Studio. - -4. In Windows Explorer, right-click each .sql file and then click **Run**. Each script will open in a query window in SQL Server Management Studio. Click **Execute** for each script and verify that each is completed successfully. - -5. Refresh the **Jobs** node under the **SQL Server Agent** node and confirm that the four jobs are created successfully. - -**To update the configuration of the App-V Management Server** - -1. On the App-V Management Server, modify the following registry keys: - - - **SQLServerName** = <newservername> - - - **SQLServerPort** = <newserverport> - - Then restart the App-V server service. - -2. Browse to find the file SftMgmt.udl under the App-V Management Server installation directory (default is C:\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service). Right-click the file and select **Open**. - -3. On the **Connection** tab, enter the name of the destination computer that is running SQL Server, and then click **Test Connection**. When the test is successful, click **OK** and then click **OK** again. - -4. For App-V Management Server versions before 4.5 SP2, you must update the SQL Logging settings. Under **Server Groups**, right-click the server group the server is a member of and select **Properties**. - -5. On the **Logging** tab click to select the **SQL Database** entry and then click **Edit**. - -6. Change the **DNS Host Name** to the host name of the new computer that is running SQL Server and then click **OK**. Click **OK** two times more, and then restart the App-V server service. - -7. Open the App-V Management Console, right-click the **Applications** node and select **Refresh**. The list of applications should be displayed as before. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md deleted file mode 100644 index b3286dd1fd..0000000000 --- a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Modify a Virtual Application Package (App-V 4.6) -description: How to Modify a Virtual Application Package (App-V 4.6) -author: eavena -ms.assetid: 346ec470-3822-48a7-95e7-61f46eb38dc2 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify a Virtual Application Package (App-V 4.6) - - -The following procedure uses the Application Virtualization (App-V) Sequencer to edit the properties associated with an existing virtual application package. - -**To modify a virtual application package** - -1. To start the App-V Sequencer Console, on the computer running the Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the Sequencer console select **Edit a Package**. In the **Open** dialog box, locate and select the package you want to modify. - -3. Modify the application package. For more information about what properties can be modified, see [How to Determine Whether to Edit or Upgrade a Virtual Application Package](how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md). - -4. To save the modifications to the package, select **File** / **Save**. - -## Related topics - - -[How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md b/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md deleted file mode 100644 index 9ef7b06355..0000000000 --- a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package (App-V 4.6 SP1) -description: How to Modify an Existing Virtual Application Package (App-V 4.6 SP1) -author: dansimp -ms.assetid: f43a9927-4325-4b2d-829f-3068e4e84349 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify an Existing Virtual Application Package (App-V 4.6 SP1) - - -Use the following procedures to modify an existing virtual application package. You can use these procedures to: - -- Update an application that is part of an existing virtual application package. To perform this task, use the procedure **"To update an application in an existing application package"** in this document. - -- Modify the properties associated with an existing virtual application package. To perform this task, use the procedure **"To modify the properties associated with an existing virtual application package"** in this document. - -- Add a new application to an existing virtual application package. To perform this task, use the procedure **"To add a new application to an existing virtual application package"** in this document. - -You must have the App-V Sequencer installed to modify a virtual application package. For more information about installing the App-V Sequencer, see [How to Install the Sequencer (App-V 4.6 SP1)](how-to-install-the-sequencer---app-v-46-sp1-.md). - -**To update an application in an existing virtual application package** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package**, and then click **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package**, and then click **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application that you want to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail, or for the application update to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information that is displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important**   - If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files are added to the package. - - - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - - **Note**   - The sequencer monitors all changes and installations to the computer running the sequencer, including the changes and installations that are performed outside of the sequencing wizard. - - - -8. On the **Installation Report** page, you can review information about the virtual application you just updated. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop**, and then click one of the following options, **Stop all applications** or **Stop this application only**, depending on what you want. - - - -10. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. When you select this option, the package in the Sequencer console opens so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**, and then click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - -**To modify the properties associated with an existing virtual application package** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package**, and then click **Next**. - -3. On the **Select Task** page, click **Edit Package**, and then click **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties that you want to modify, and then click **Edit**. - -5. In the Sequencer console, you can perform any of the following tasks: - - - View package properties. - - - View package change history. - - - View associated package files. - - - Edit registry settings. - - - Review additional package settings (except operating system file properties). - - - Create an associated Windows Installer (MSI). - - - Modify OSD file. - - - Compress and uncompress package. - - - Add file type associations. - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Edit virtual file system mappings. - -6. When you have finished modifying the package properties, click **File** / **Save** to save the package,. - -**To add a new application to an existing virtual application package** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package**, and then click **Next**. - -3. On the **Select Task** page, click **Add New Application**, and then click **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that you want to add the application to, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail, or for the update to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information that is displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important**   - If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files can be added to the package. - - - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. This should be a new location so that you do not overwrite the existing version of the virtual application package. - - **Note**   - All changes and installations to the computer running the sequencer are monitored by the sequencer, including the changes and installations that are performed outside of the sequencing wizard. - - - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step helps complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application you just updated. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. If you want to customize any of the items in the following list, click **Customize**. - - - Edit the file type associations associated with an application. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - Click **Next**. - -11. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) that will be associated with the various applications in the package. To create a new FTA, select and expand the application that you want to customize in the left pane, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. To review the shortcut information associated with an application, under the application, select the **Shortcuts** check box, and in the **Location** pane, you can review the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop** and select either the **Stop all applications** or the **Stop this application only** check box, depending on what you want. - - - -13. On the **Create Package** page, select the **Continue to modify package without saving using the package editor** check box, to modify the package without saving it. When you select this option, the package in the sequencer console opens so that you can modify the package before it is saved. Click **Next**. - - Select the default **Save the package now**, to save the package immediately. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -14. On the **Completion** page, click **Close**. The package is now available in the sequencer. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md b/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md deleted file mode 100644 index 98cb2e695d..0000000000 --- a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Modify Attributes of Embedded Services -description: How to Modify Attributes of Embedded Services -author: dansimp -ms.assetid: b4057d3f-2e8f-4b1f-9ed5-b65f3da8631a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Attributes of Embedded Services - - -After you sequence an application but before you save it, you can use the following procedure to manually modify the sequenced application package. - -**To remove an embedded service** - -1. Click the **Virtual Services** tab. - -2. Right-click the service you want to remove, and select **Remove**. - -3. In the **Sequencer** dialog box, click **Yes**. - -**To modify the properties of an embedded service** - -1. Click the **Virtual Services** tab. - -2. Right-click the service whose properties you want to modify, and select **Properties**. - -3. In the **Office Source Engine Properties** dialog box, complete the following tasks: - - 1. In the **Display Name** text box, type the name of the service. - - 2. In the **Description** text box, type a description of the service. - - 3. In the **Path to Executable** text box, enter the path to the executable file. - - 4. From the **Startup Type** drop down list, select how the service is to start up—manually, automatically, or not. - - 5. Click **OK**. - -## Related topics - - -[About the Virtual Services Tab](about-the-virtual-services-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-file-mapping-information.md b/mdop/appv-v4/how-to-modify-file-mapping-information.md deleted file mode 100644 index bd04938de3..0000000000 --- a/mdop/appv-v4/how-to-modify-file-mapping-information.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Modify File-Mapping Information -description: How to Modify File-Mapping Information -author: eavena -ms.assetid: d3a9d10a-6cc8-4399-9479-b20f729c4dd9 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify File-Mapping Information - - -After you sequence an application but before you save it, you can manually modify the virtual file system. Use the following procedures to add, delete, or edit a file in the virtual file system. - -**To add a file in the file system** - -1. Click the **Virtual File System** tab. - -2. Right-click a file under the virtual file system root in the left pane. On the menu, select **Add**. - -3. Complete the following tasks in the **New Virtual File System Mapping** dialog box: - - 1. To specify the new file association type the full network path to the new file. - - 2. Click **OK**. - -4. To override the local directory, right-click the file you just added and, on the menu, select **Override Local Directory**; or to merge with the local directory, select **Merge with Local Directory**. - -5. On the **File** menu, select **Save** to save this change. - -**To delete a file in the file system** - -1. Click the **Virtual File System** tab. - -2. Right-click a file in the virtual file system, and select **Delete**. - -3. Accept the confirmation message by clicking **OK**. - -4. On the **File** menu, select **Save** to save this change. - -**To edit a file in the file system** - -1. Click the **Virtual File System** tab. - -2. Right-click a file in the virtual file system. On the menu, select **Edit**. - -3. Complete the following tasks in the **Edit Virtual File System Mapping** dialog box: - - 1. To edit the file association, specify the full network path to the new file. - - 2. Click **OK**. - -4. To override the local directory, right-click the file you just edited and, on the menu, select **Override Local Directory**. - -5. On the **File** menu, select **Save** to save this change. - -## Related topics - - -[About the Virtual File System Tab](about-the-virtual-file-system-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md b/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md deleted file mode 100644 index c6af207c9b..0000000000 --- a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Modify Private Key Permissions to Support Management Server or Streaming Server -description: How to Modify Private Key Permissions to Support Management Server or Streaming Server -author: eavena -ms.assetid: 1ebe86fa-0fbc-4512-aebc-0a5da991cd43 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Modify Private Key Permissions to Support Management Server or Streaming Server - - -To support a more secure App-V installation, you can use the following procedures to modify private keys in either Windows Server 2003 or Windows Server 2008. To modify the permissions of the private key, you can use the Windows Server 2003 Resource Kit tool `WinHttpCertCfg.exe`. - -For Windows Server 2003, the procedure requires that a certificate that meets the prerequisites listed in this document is installed on the computer or computers on which you will install the App-V Management or Streaming Server. Additional information about using the `WinHttpCertCfg.exe` tool is available at . - -In Windows Server 2008, the process of changing the ACLs on the private key is much simpler. The certificate’s user interface can be used to manage private key permissions. - -**Note**   -The default security context is Network Service; however, a domain account can be used instead. - - - -**To manage private keys in Windows Server 2003** - -1. On the computer that will become the App-V Management or Streaming Server, type the following command in a command prompt to list the current permissions assigned to a specific certificate: - - `winhttpcertcfg -l -c LOCAL_MACHINE\My -s Name_of_cert` - -2. If necessary, modify the permissions of the certificate to provide read access to the security context that will be used for Management or Streaming Service: - - `winhttpcertcfg -g -c LOCAL_MACHINE\My -s Name_of_cert -a NetworkService` - -3. Verify that the security context was properly added by listing the permissions on the certificate: - - `winhttpcertcfg –l –c LOCAL_MACHINE\My –s Name_of_cert` - -**To manage private keys in Windows Server 2008** - -1. Create a Microsoft Management Console (MMC) with the *Certificates* snap-in that targets the *Local Machine* certificate store. - -2. Expand the MMC and select **Manage Private Keys**. - -3. On the **Security** tab, add the **Network Service** account with **Read** access. - -## Related topics - - -[Configuring Certificates to Support App-V Management Server or Streaming Server](configuring-certificates-to-support-app-v-management-server-or-streaming-server.md) - -[Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md b/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md deleted file mode 100644 index dabbe47a97..0000000000 --- a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Modify the Files Included in a Package -description: How to Modify the Files Included in a Package -author: eavena -ms.assetid: e331ac85-1c9c-49be-9d96-5444de38fd56 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Files Included in a Package - - -After you sequence an application but before you save it, you can manually modify a sequenced application package to specify how it will retain its settings. Use the Sequencer attributes section to specify whether a file in a sequenced application package will be available to a specific user or to all users in the community. - -**To modify Sequencer attributes** - -1. Click the **Files** tab. - -2. Select **User Data** or **Application Data**, depending on how you want an application to retain its settings, and select **Override** to enable the client to overwrite the cached application. - -3. Click **Apply**. - -## Related topics - - -[About the Files Tab](about-the-files-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md deleted file mode 100644 index c3428e4556..0000000000 --- a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Modify the Location of the Log Directory -description: How to Modify the Location of the Log Directory -author: eavena -ms.assetid: 8e222d29-6f58-43bb-9ea7-da9a2ebfa48c -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Location of the Log Directory - - -The log directory location is where the Application Virtualization (App-V) Sequencer writes information about the sequencing of an application. - -Use the following procedure to change the location of the directory where the App-V Sequencer will save associated logs. - -**To modify the log directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new directory location where you want the App-V Sequencer log file information to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md deleted file mode 100644 index 09e46293f9..0000000000 --- a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Modify the Location of the Scratch Directory -description: How to Modify the Location of the Scratch Directory -author: eavena -ms.assetid: 25ebc2fa-d532-4800-9825-9d08306fc2e0 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Location of the Scratch Directory - - -The scratch directory is used by the App-V Sequencer to save temporary files during the sequencing of an application. - -**To modify the scratch directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new scratch directory location where you want the App-V Sequencer temporary files to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-log-directory-location.md b/mdop/appv-v4/how-to-modify-the-log-directory-location.md deleted file mode 100644 index f02e8c4638..0000000000 --- a/mdop/appv-v4/how-to-modify-the-log-directory-location.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Modify the Log Directory Location -description: How to Modify the Log Directory Location -author: eavena -ms.assetid: 203c674f-8d46-4d42-9af0-245a2681fc0f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Log Directory Location - - -The log directory location is where the Application Virtualization (App-V) Sequencer writes information about the sequencing of an application. - -**Important**   -The log location directory must be located on the computer running the App-V Sequencer. - - - -Use the following procedure to change the location of the directory where the App-V Sequencer will save associated logs. - -**To modify the log directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new directory location where you want the App-V Sequencer log file information to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Configure the App-V Sequencer](how-to-configure-the-app-v-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md b/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md deleted file mode 100644 index e331c63e11..0000000000 --- a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Modify the Operating Systems Associated With an Existing Windows Installer File -description: How to Modify the Operating Systems Associated With an Existing Windows Installer File -author: eavena -ms.assetid: 0633f7e2-aebf-4e00-be02-35bc59dec420 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Operating Systems Associated With an Existing Windows Installer File - - -Use the following procedure to modify the operating system versions associated with an existing Windows Installer (**MSI**) file that was created by using the App-V Sequencer. - -**To modify the operating systems of an existing Windows Installer file** - -1. Install the App-V Sequencer on a computer in your environment that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running a virtual environment—for example, Microsoft Virtual PC. This method is useful because it is easier to maintain a clean sequencing environment that you can reuse with minimal additional configuration. For more information about installing the App-V Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer.md). - -2. Copy the entire virtual application package that contains the Windows Installer file you want to modify to the computer running the Sequencer. - -3. To modify the Windows Installer file, open the Sequencer console, select **Package** / **Open**, and then browse to the location where the virtual application package associated with the Windows Installer file is saved. - -4. To add or remove operating systems, select the **Deployment** tab in the Sequencer console. To specify additional operating systems that will be associated with the Windows Installer file, select the desired operating system, and then click the arrow that points to the **Selected** operating system list control. - - To remove an operating system association, select the operating system you want to remove, and then click the arrow that points to the **Available** operating system list control. - -5. To create a new Windows Installer that will be associated with the virtual application package, select **Generate Microsoft Windows Installer (MSI) Package**. Alternatively, you can select **Tools** / **Create MSI**. - - **Note**   - If you select **Tools** / **Create MSI** to create a new Windows Installer file, you can skip **Step 6** of this procedure. - - - -6. To save the virtual application package, select **Package** / **Save**. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md b/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md deleted file mode 100644 index 325ec1b929..0000000000 --- a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Modify the Scratch Directory Location -description: How to Modify the Scratch Directory Location -author: eavena -ms.assetid: 61ecb379-85be-4316-8023-a2c1811504e5 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Scratch Directory Location - - -The scratch directory is used by the App-V Sequencer to save temporary files during the sequencing of an application. - -**Important**   -The specified scratch directory location should be located on the computer running the App-V Sequencer. - - - -Use the following procedure to modify the scratch directory location. - -**To modify the scratch directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new scratch directory location where you want the App-V Sequencer temporary files to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Create the Sequencer Package Root Directory](how-to-create-the-sequencer-package-root-directory.md) - -[How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md b/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md deleted file mode 100644 index 4d0979f07c..0000000000 --- a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Modify Virtual Registry Key Information -description: How to Modify Virtual Registry Key Information -author: eavena -ms.assetid: cf2559f2-a8cc-4fc7-916e-8368843c7ebc -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Virtual Registry Key Information - - -After you sequence an application but before you save it, you can modify its registry settings. Use the following procedures to modify a sequenced application package's registry values and registry keys. - -**To modify a registry key** - -1. Click the **Virtual Registry Key** tab. - -2. Double-click the **Registry** folder to expand its contents. - -3. In the left pane, right-click the folder you want to modify and select **Key**. - -4. To create a new registry key, on the menu, select **New**. A new registry key will appear in the folder you selected. - -5. To rename a registry key, on the menu, select **Rename**. Type a new value name in the text box. - -6. To delete a registry key, on the menu, select **Delete**. - -7. To override the local key, on the menu, select **Override Local Key**, or to merge with the local key, select **Merge with Local Key**. - -**To modify a registry value** - -1. Click the **Virtual Registry Value** tab. - -2. Double-click the **Registry** folder to expand its contents. - -3. In the left pane, right-click the folder you want to modify and select **Value**. - -4. To add a string, on the menu, select **Add String**. - -5. To add a binary, on the menu, select **Add Binary**. - -6. To add a DWORD, on the menu, select **Add DWORD**. - -7. To delete a registry value, right-click a value and select **Delete**. - -8. To rename a registry value, right-click a registry value and select **Rename**. - -## Related topics - - -[About the Virtual Registry Tab](about-the-virtual-registry-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-move-an-application-group.md b/mdop/appv-v4/how-to-move-an-application-group.md deleted file mode 100644 index dc8b8b117a..0000000000 --- a/mdop/appv-v4/how-to-move-an-application-group.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Move an Application Group -description: How to Move an Application Group -author: eavena -ms.assetid: 7f9f9f2e-f394-4ad3-8615-4237a7dcfb95 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move an Application Group - - -In the Application Virtualization Server Management Console, you can use the following procedure to move an application group, which enables you to arrange your applications to suit your operations. You also can group them so that you can change the properties of nested groups simultaneously. - -**To move an application group** - -1. In the left pane of the Application Virtualization Server Management Console, expand **Applications** so that you can see the **Application** group you want to move. - -2. Right-click the group and choose **Move**. - -3. In the **Select Target** window, navigate to the application group under which you want to place this group. - -4. Click **OK**. - - The group, all its subgroups, and its existing applications now appear under the target group. This move does not change the properties of the group or its applications. - - **Note**   - You can select and move multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group. - - - -## Related topics - - -[How to Create an Application Group](how-to-create-an-application-group.md) - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-move-an-application.md b/mdop/appv-v4/how-to-move-an-application.md deleted file mode 100644 index 1ddecfd3b0..0000000000 --- a/mdop/appv-v4/how-to-move-an-application.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Move an Application -description: How to Move an Application -author: eavena -ms.assetid: 3ebbf30c-b435-4a69-a0ba-2313aaf0017c -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move an Application - - -If you have application groups under the **Applications** node in the Application Virtualization Server Management Console, you can move an application between groups or from the main node to a group. You can move the applications to suit your operations. You also can group them so that you can change the properties of nested groups simultaneously. - -**Important**   -You must have one or more application groups under the **Applications** node to move applications. - - - -**To move an application** - -1. In the left pane of the Application Virtualization Server Management Console, expand **Applications**. - -2. Highlight the application you want to move. - -3. Right-click the application and choose **Move**. - -4. In the **Select Target** window, navigate to the group in which you want to place this group. - -5. Click **OK**. - - The applications now appear under the target group. This move does not change the properties of the group or its applications, and it does not move any of the application's files on the server. - - **Note**   - You can select and move multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group. - - - -## Related topics - - -[How to Create an Application Group](how-to-create-an-application-group.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md b/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md deleted file mode 100644 index 69ea2fdaa3..0000000000 --- a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Open a Sequenced Application Using the Command Line -description: How to Open a Sequenced Application Using the Command Line -author: eavena -ms.assetid: dc23ee65-8aea-470e-bb3f-a2f2b06cb241 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Open a Sequenced Application Using the Command Line - - -You can open virtual application packages using the command line. You must run the **cmd** prompt as an administrator. - -Use the following procedure to open sequenced application packages using the command line - -**To open a sequenced application using the command line** - -1. To open the command prompt, click **Start**, and select **Run**, type **cmd**, and click **OK**. - -2. At a command prompt, type **cd\\** and specify the path to the directory where the Sequencer is installed and then press **Enter.** - -3. At the command prompt, type the following command, replacing the italicized text with your values: - - SFTSequencer /OPEN:*”specifies the .sprj file to open"* - - Press **Enter**. - -4. You can also specify the following optional parameters. At the command prompt, type the following commands, replacing the italicized text with your values: - - /PACKAGENAME:"*specifies the package name"* - - /MSI - specifies generating an associated Microsoft Windows Installer. - - /COMPRESS – specifies if the package will be compressed. By default, packages are not compressed. - - Press **Enter**. - - **Note**   - If the installer or Windows Installer package has a graphical user interface, it will be displayed after you specify the command-line parameters. - - - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md b/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md deleted file mode 100644 index 7b74cd7b09..0000000000 --- a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Perform Administrative Tasks in the Application Virtualization Server Management Console -description: How to Perform Administrative Tasks in the Application Virtualization Server Management Console -author: eavena -ms.assetid: b80e39eb-4b2a-4f66-8c85-dd5712efed33 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform Administrative Tasks in the Application Virtualization Server Management Console - - -You have a wide range of configuration and control operations for one or more Application Virtualization Management Servers. The Application Virtualization Server Management Console provides local or remote access to your servers. - -## In This Section - - -[How to Connect to an Application Virtualization System](how-to-connect-to-an-application-virtualization-system.md) -Provides steps for connecting to an Application Virtualization System in the Application Virtualization Management Server Management Console. - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) -Provides procedures for managing applications in the Application Virtualization Server Management Console. - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) -Provides procedures for managing application groups in the Application Virtualization Server Management Console. - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) -Provides procedures for managing packages in the Application Virtualization Server Management Console. - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) -Provides procedures for managing reports in the Application Virtualization Server Management Console. - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) -Provides procedures for managing Application Virtualization Management Servers in the Application Virtualization Server Management Console. - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) -Provides procedures for managing licenses in the Application Virtualization Server Management Console. - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) -Provides procedures for customizing an Application Virtualization System in the Application Virtualization Server Management Console. - -[How to Change the Server Logging Level and the Database Parameters](how-to-change-the-server-logging-level-and-the-database-parameters.md) -Provides procedures for changing the logging level and the database log parameters in the Application Virtualization Server Management Console. - -[How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -Describes how to configure database mirroring by using Microsoft SQL Server for your App-V system. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md deleted file mode 100644 index 78618cb92e..0000000000 --- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Perform General Administrative Tasks in the App-V Client Management Console -description: How to Perform General Administrative Tasks in the App-V Client Management Console -author: eavena -ms.assetid: 22abdb1e-ab35-440d-bf74-d358dd1a6558 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform General Administrative Tasks in the App-V Client Management Console - - -The App-V Client Management Console enables users who are local administrators to manage their applications. - -## In This Section - - -[How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -Provides procedures for setting up App-V Servers and for adding more App-V Servers to both the App-V Desktop Client and the App-V Client for Remote Desktop Services (formerly Terminal Services). - -[How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -Provides a procedure for refreshing the App-V Servers from the App-V Client Management Console. - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -Provides procedures for disabling or modifying disconnected operation mode settings. - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -Provides the list of user access permissions. - -[Disconnected Operation Mode](disconnected-operation-mode.md) -Describes the disconnected operation mode and circumstances that affect it. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md deleted file mode 100644 index 129c4c2058..0000000000 --- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Perform General Administrative Tasks in the Client Management Console -description: How to Perform General Administrative Tasks in the Client Management Console -author: eavena -ms.assetid: 90bb7101-1075-4654-8a5e-ad08374e381f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform General Administrative Tasks in the Client Management Console - - -The Application Virtualization Client Management Console enables users who are local administrators to manage their applications. - -## In This Section - - -[How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -Provides procedures for adding more Application Virtualization Servers to the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) and for setting up those servers. - -[How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -Provides a procedure for refreshing the Application Virtualization Servers from the Client Management Console. - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -Provides procedures you can use to disable or modify disconnected operation mode settings. - -## Related topics - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) - -[How to Manually Manage Applications in the Client Management Console](how-to-manually-manage-applications-in-the-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-print-a-reportserver.md b/mdop/appv-v4/how-to-print-a-reportserver.md deleted file mode 100644 index c3407cc14a..0000000000 --- a/mdop/appv-v4/how-to-print-a-reportserver.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Print a Report -description: How to Print a Report -author: eavena -ms.assetid: 9cb3a2f1-69bf-47b2-b2cf-8afdcd77138f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Print a Report - - -The process for printing a report for the Application Virtualization Server Management Console is the same regardless of the report type. - -**To print a report** - -1. After the report output is displayed in the **Results** pane, click the **Printer** button (at the top of the **Results** pane) or right-click the desired report under the **Reports** node and select **Print** from the pop-up menu. - -2. Follow the printing prompts, and click **OK**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md b/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md deleted file mode 100644 index 9a3d19e2a1..0000000000 --- a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Publish a Virtual Application on the Client -description: How to Publish a Virtual Application on the Client -author: eavena -ms.assetid: 90af843e-b5b3-4a71-a3a1-fa5f4c087f28 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Virtual Application on the Client - - -When you deploy Application Virtualization by using an electronic software distribution system, you can use one of the following procedures to publish an application package to your users. - -**To publish a package using a stand-alone Windows Installer file** - -1. The client should be installed with the *REQUIREAUTHORIZATIONIFCACHED* parameter set to 0 (zero). For more information about setting this parameter, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -2. Copy the Windows Installer file and the SFT file to same folder on the target computer. - -3. Run the following command on the computer: - - `Msiexec.exe /I "packagename.msi" /q` - -**To publish a package using Windows Installer and the package manifest** - -1. Copy the Windows Installer file to the target computer and the SFT file to the CONTENT share on the streaming server. - -2. Run the following command on each user’s computer: - - `Msiexec.exe /I "\\pathtomsi\packagename.msi" MODE=STREAMING OVERRIDEURL="\\\\server\\share\\package.sft" LOAD=TRUE /q` - - **Important**   - For OVERRIDEURL all backslash characters must be escaped using a preceding backslash, or the OVERRIDEURL path will not be parsed correctly. Also, properties and values must be entered as uppercase except where the value is a path to a file. - - - -**To publish a package using SFTMIME** - -- For an example of how to publish an application for all users on a computer, run the following command on the user’s computer: - - `SFTMIME ADD PACKAGE:package-name /MANIFEST manifest-path [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - For additional details about these and other SFTMIME commands, see [SFTMIME Command Reference](sftmime--command-reference.md). - -## Related topics - - -[Determine Your Publishing Method](determine-your-publishing-method.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-publish-application-shortcuts.md b/mdop/appv-v4/how-to-publish-application-shortcuts.md deleted file mode 100644 index 25b4335a06..0000000000 --- a/mdop/appv-v4/how-to-publish-application-shortcuts.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Publish Application Shortcuts -description: How to Publish Application Shortcuts -author: eavena -ms.assetid: fc5efe86-1bbe-438b-b7d8-4f9b815cc58e -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish Application Shortcuts - - -You can use the following procedure to publish shortcuts to an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To publish application shortcuts** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **New Shortcut** from the pop-up menu to display the New Shortcut Wizard. - -2. On the first page of the New Shortcut Wizard, select an icon and specify a name for the shortcut. - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **Shortcut Title**—Enter the name you want to give the shortcut. This field defaults to the existing name and version of the application. - -3. On the second page of the wizard, determine the location of the published shortcut. - - 1. **The Desktop**—Select this check box to publish the shortcut to the desktop. - - 2. **The Quick Launch Toolbar**—Select this check box to publish the shortcut to the Quick Launch toolbar. - - 3. **The Send To Menu**—Select this check box to publish the shortcut to the **Send To** menu. - - 4. **Programs in the Start Menu**—When you select the **Start Menu** check box, this field becomes active. Leave this field blank to publish the shortcut directly to the root of the Programs folder, or enter a folder name or hierarchy—for example, "My\_Computer\\Office Applications." Shortcuts created this way are available only for the current user. - - 5. **Another location** and **Browse** button—When you select the **Another location** check box, this field becomes active. Enter any valid location on the computer or any available UNC path (shared file or directory on a network). The **Browse** button displays a standard Windows **File Open** dialog box. - -4. On the third page of the wizard, enter desired command-line parameters. - -5. Click **Finish** to publish the shortcuts and exit to the **Results** pane. - -## Related topics - - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) - -[How to Add an Application](how-to-add-an-application.md) - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md b/mdop/appv-v4/how-to-refresh-the-publishing-servers.md deleted file mode 100644 index c1f6550d87..0000000000 --- a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Refresh the Publishing Servers -description: How to Refresh the Publishing Servers -author: eavena -ms.assetid: 92e1d7b0-10ee-4531-9049-1056b44934e2 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Refresh the Publishing Servers - - -After you request access to additional applications and permission is granted by the system administrator, you must refresh the publishing information from the Application Virtualization Servers before the applications appear on your desktop. You can accomplish this directly from the Windows desktop notification area. - -**Note**   -By default, publishing information is refreshed on user log in. - - - -**To refresh the publishing information** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Refresh Applications** from the pop-up-menu. The new shortcuts appear where designated by the system administrator—for example, on your desktop, **Start** menu, or **Quick Launch** menu, depending on the configuration of the Application Virtualization Server and your desktop. - - **Note**   - Following are additional ways you can refresh the publishing information from the servers: - - - Right-click the server in the **Results** pane, and select **Refresh Server** from the pop-up menu. - - - Right-click the server in the **Results** pane, and then select **Properties** from the pop-up menu. Select the **Refresh** tab, and then click the **Refresh** button. - - - -## Related topics - - -[How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) - -[How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md deleted file mode 100644 index 9d197bf99f..0000000000 --- a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Refresh Virtual Applications from the Desktop Notification Area -description: How to Refresh Virtual Applications from the Desktop Notification Area -author: eavena -ms.assetid: 801610d9-e89c-48bb-972c-20e37b945a02 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Refresh Virtual Applications from the Desktop Notification Area - - -To refresh the list of available applications and the associated shortcuts and file type associations, you must refresh the publishing information from the Application Virtualization (App-V) Management Server or the Application Virtualization (App-V) Streaming Server before the applications appear on your desktop. You can accomplish this directly from the notification area on your desktop. - -**To refresh the virtual applications from the client desktop** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Refresh Applications** from the pop-up-menu. - - Your desktop is updated, and the client reflects any changes in applications, shortcuts, and file type associations. This applies only when a publishing server has been defined. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md deleted file mode 100644 index 09098690cf..0000000000 --- a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Remove a Package by Using the Command Line -description: How to Remove a Package by Using the Command Line -author: eavena -ms.assetid: 47697ec7-20e5-4258-8865-a0a710d41d5a -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove a Package by Using the Command Line - - -You can use the following command-line procedures to delete a virtual application package from the Application Virtualization (App-V) Client on a specific computer. - -**To delete a virtual application package for all users** - -- If the package was previously added for all users by using the /GLOBAL switch, use the following command to delete the package and the global file types and shortcuts. Administrator rights are required. The /GLOBAL switch is not needed in this case because the command always performs a global deletion of the package. - - `SFTMIME DELETE PACKAGE:”name”` - -**To delete a package previously added for individual users** - -1. If the package was previously added for individual users, you have several options. - - Run the following command once under the user account of each person the package was published to. This denies the user access to the applications if they roam to another computer. It deletes the specific user’s settings, shortcuts, and file types from the profile, and it stops background loads under the user’s context. - - `SFTMIME UNPUBLISH PACKAGE:”name”` - -2. Alternatively, run the following command under the user account of each person the package was published to. - - `SFTMIME UNPUBLISH PACKAGE:”name”` - - Then run this command for the package. - - `SFTMIME DELETE PACKAGE:”name”` - - This completely removes the package, and it deletes all user settings, shortcuts, and file types from their profiles. If the package is subsequently re-added, the users will have to specify their settings again. Only “Delete applications” (**DeleteApp**) permission is needed to run this command. - -3. As a third alternative, you can simply run the **DELETE PACKAGE** command without using the **UNPUBLISH PACKAGE** command. In this case, file types and shortcuts for each user are hidden rather than deleted, and the user settings are retained. This means that if the package is subsequently re-added for the user, the file types and shortcuts are restored, and the user settings are reapplied. - -## Related topics - - -[How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) - -[How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-a-server-group.md b/mdop/appv-v4/how-to-remove-a-server-group.md deleted file mode 100644 index f29d802d3f..0000000000 --- a/mdop/appv-v4/how-to-remove-a-server-group.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Remove a Server Group -description: How to Remove a Server Group -author: eavena -ms.assetid: 3017f4f4-614b-4db4-834c-b6fd9b45f10c -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove a Server Group - - -You can use the following procedure in the Application Virtualization Server Management Console to remove server groups, including all the servers in the group, from your Application Virtualization System. - -**To remove a server group** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. Right-click the desired server group, and select **Delete**. - -3. At the prompt, click **Yes**. - -## Related topics - - -[How to Add a Server](how-to-add-a-server.md) - -[How to Create a Server Group](how-to-create-a-server-group.md) - -[How to Remove a Server](how-to-remove-a-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-a-server.md b/mdop/appv-v4/how-to-remove-a-server.md deleted file mode 100644 index 6bf7d4bcf3..0000000000 --- a/mdop/appv-v4/how-to-remove-a-server.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Remove a Server -description: How to Remove a Server -author: eavena -ms.assetid: afb2a889-733c-4058-9a50-caa2ca10bd58 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove a Server - - -To help you manage your servers more efficiently, organize them into server groups. After you create a server group in the Application Virtualization Server Management Console, you can remove servers from the group. - -**To remove a server from a group** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. In the right pane, right-click the desired server and select **Delete**. - -3. At the prompt, click **Yes**. - -## Related topics - - -[How to Add a Server](how-to-add-a-server.md) - -[How to Create a Server Group](how-to-create-a-server-group.md) - -[How to Remove a Server Group](how-to-remove-a-server-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md b/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md deleted file mode 100644 index b6cf52235b..0000000000 --- a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Remove an Application from a License Group -description: How to Remove an Application from a License Group -author: eavena -ms.assetid: 973dfb11-b4d1-4b79-8f6a-aaea3e52b04f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove an Application from a License Group - - -You can use the following procedure to remove an application from its assigned license group in the Application Virtualization Server Management Console. After you do this, you cannot apply license controls or use reports to track the license usage for this application. - -**To remove an application from a license group** - -1. In the left pane of the management console, click and expand the **Applications** node. - -2. Right-click the desired application, and choose **Properties**. - -3. On the **General** tab, use the **Application License Group** pull-down menu to choose **<none>**. - -4. Click **OK**. - - **Note**   - You can alter the **Properties** tab of one application at a time. - - - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-remove-an-application-group.md b/mdop/appv-v4/how-to-remove-an-application-group.md deleted file mode 100644 index f6be0294c8..0000000000 --- a/mdop/appv-v4/how-to-remove-an-application-group.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Remove an Application Group -description: How to Remove an Application Group -author: eavena -ms.assetid: 3016b373-f5a0-4c82-96e8-e5e7960f0cc4 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove an Application Group - - -You can use the following procedures to remove an application group in the Application Virtualization Server Management Console in one of two ways: - -**Caution**   -Deleting a group with its applications deletes those applications from the Application Virtualization Management Server. When you try to do this, you must confirm the deletion in a pop-up window. - - - -**To empty and then delete an application group** - -1. In the Application Virtualization Server Management Console, expand **Applications** in the left pane and select the **Application** group you want to remove. - -2. In the right pane, select the applications and application groups you want to keep. You can use the **CTRL** and **Shift** keys to select multiple applications and application groups. - -3. Right-click the selected applications, and choose **Move**. - -4. In the **Select Target** window, navigate to the new location and click **OK**. Repeat this step if you want to move different applications to more than one group. - -5. When you finish moving the applications you want to keep, right-click the application group and choose **Delete**. - -6. Click **Yes** to confirm. - -**To delete the group, with all its child groups and its applications** - -1. In the Application Virtualization Server Management Console, expand **Applications** in the left pane. - -2. Right-click the application group you want to remove, and choose **Delete**. - -3. Click **Yes** to confirm. - - **Note**   - You can select and remove multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group. - - - -## Related topics - - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-remove-an-application-license-group.md b/mdop/appv-v4/how-to-remove-an-application-license-group.md deleted file mode 100644 index 2ddff90f47..0000000000 --- a/mdop/appv-v4/how-to-remove-an-application-license-group.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Remove an Application License Group -description: How to Remove an Application License Group -author: eavena -ms.assetid: 35830916-7015-44cd-829b-23599a5029a7 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove an Application License Group - - -In the Application Virtualization Server Management Console, you can use the following procedure to remove an application license group. After you do this, you will be unable to apply license controls or use reports to track the licenses. - -**Important**   -Before you can remove a license group, you must remove any licenses associated with the group. - - - -**To remove a license group** - -1. In the left pane of the Application Virtualization Server Management Console, click and expand the **Applications Licenses** node. - -2. Click the desired **License Group**. - -3. In the right pane, right-click the license and select **Delete**. - -4. Click **Yes** at the prompt. - -5. In the left pane, right-click the desired license group and select **Delete**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md b/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md deleted file mode 100644 index a24a7b50b4..0000000000 --- a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Remove the Application Virtualization System Components -description: How to Remove the Application Virtualization System Components -author: eavena -ms.assetid: 45bb1e43-8708-48b7-9169-e3659f32686f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove the Application Virtualization System Components - - -You can use the following procedures to remove all or selected Application Virtualization software components from a target computer. - -**To remove all components from a single computer** - -1. From the Windows desktop, click **Start > Settings > Control Panel**. - -2. In the Control Panel window, double-click **Add or Remove Programs**. - -3. On the **Add or Remove Programs** page, select **Microsoft System Center Application Virtual Management Server** or **Microsoft System Center Application Streaming Server**, click **Remove**, and then click **Yes** at the prompt to remove all Application Virtualization software components from the computer. - -**To remove one or more components from a computer** - -1. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -2. On the **Welcome** page, click **Next**. - -3. On the **Program Maintenance** page, select **Modify** and then click **Next**. - -4. On the **Custom Setup** page, deselect the Application Virtualization component or components you want to remove, and then click **Next**. - -5. On the **Ready to Modify the Program** page, to remove the selected components, click **Install**. - -6. On the **Installation Wizard Completed** page, to close the wizard click **Finish**. Click **Yes** to restart the computer. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-rename-an-application-group.md b/mdop/appv-v4/how-to-rename-an-application-group.md deleted file mode 100644 index 572521fe16..0000000000 --- a/mdop/appv-v4/how-to-rename-an-application-group.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Rename an Application Group -description: How to Rename an Application Group -author: eavena -ms.assetid: 4dfd3336-ea9a-4a56-91e1-7e9d742c7b9a -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Rename an Application Group - - -From the Application Virtualization Server Management Console, you can use the following procedure to rename an application group without affecting any of its properties or those of the applications in it. - -**To rename an application group** - -1. In the management console, expand **Applications** in the left pane. - -2. Right-click the **Applications** group, and choose **Rename**. - -3. Type the new name for the group, and press **Enter**. - - Alternately, you can highlight the group and press **F2**. Then type the new name, and press **Enter** - -## Related topics - - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-rename-an-application.md b/mdop/appv-v4/how-to-rename-an-application.md deleted file mode 100644 index 4f52a1b300..0000000000 --- a/mdop/appv-v4/how-to-rename-an-application.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Rename an Application -description: How to Rename an Application -author: eavena -ms.assetid: 983136b7-66bf-49f6-8dea-8933b622072d -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Rename an Application - - -You can rename an application through the Application Virtualization Server Management Console. - -**To rename an application** - -1. In the left pane of the management console, click **Applications**. - -2. Right-click the application and choose **Rename**. - -3. Enter the new name and press **Enter**, or click outside of the box to cancel. - - **Note**   - You can also highlight the application in the right pane and press **F2**. - - - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-repair-an-application.md b/mdop/appv-v4/how-to-repair-an-application.md deleted file mode 100644 index ac189548e4..0000000000 --- a/mdop/appv-v4/how-to-repair-an-application.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: How to Repair an Application -description: How to Repair an Application -author: eavena -ms.assetid: 80b08416-ad86-4ed6-966a-b943e3efb951 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Repair an Application - - -To repair a selected application, you can perform the following procedure directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you repair an application, you remove any custom user settings and restore the default settings. This action does not change or delete shortcuts or file type associations, and it does not remove the application from cache. - -**To repair an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Repair** from the pop-up menu. - -3. At the confirmation prompt, click **Yes** to repair the application or **No** to cancel. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md b/mdop/appv-v4/how-to-reset-the-filesystem-cache.md deleted file mode 100644 index c5e745460d..0000000000 --- a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Reset the FileSystem Cache -description: How to Reset the FileSystem Cache -author: eavena -ms.assetid: 7777259d-8c21-4c06-9384-9599b69f9828 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset the FileSystem Cache - - -Resetting the FileSystem cache is not something that should usually be necessary. However if you need to completely reset the FileSystem cache, perhaps for troubleshooting purposes, you can use the following procedure. Administrative rights are required to perform this action. - -**To reset the FileSystem cache** - -1. Set the following registry value to 0 (zero): - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\State - -2. Restart the computer. - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-run-a-reportserver.md b/mdop/appv-v4/how-to-run-a-reportserver.md deleted file mode 100644 index 80562c889f..0000000000 --- a/mdop/appv-v4/how-to-run-a-reportserver.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Run a Report -description: How to Run a Report -author: eavena -ms.assetid: 72a5419b-aa65-4e60-b23e-3751186b7aed -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run a Report - - -The process for running a report is the same regardless of the report type. When you select a report type in the Application Virtualization Server Management Console, the window displays a brief description of the selected report. - -**Note**   -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run a report is determined by the amount of data collected in the data store. - - - -**To run a report** - -1. Click the **Reports** node in the navigation pane. - -2. Right-click the desired report, and select **Run Report** from the pop-up menu. - -3. The pages you must complete to run a report vary depending on the type of report. To run a report, complete the appropriate pages from the following list: - - 1. Select a **Report Period** radio button to specify the frequency for running the report. - - 2. Specify the start date and end date in the respective fields to determine the range of dates included in the report. You can enter these dates manually or use the calendar function and select the dates. - - 3. Select the **Server**, **Server Group**, or **Enterprise** radio button, and then select the server group and server from the corresponding drop-down list and field as enabled. - - 4. Select the desired application from the drop-down list of applications. - -4. Click **Finish**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md deleted file mode 100644 index acfe510e08..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) -description: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) -author: eavena -ms.assetid: 2c018215-66e5-4301-8481-159891a6b35b -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) - - -Use the following procedure to create a new add-on or plug-in virtual application package by using the Application Virtualization (App-V) Sequencer. An add-on or plug-in application is an application that extends the functionality of an application, for example, a plug-in for Microsoft Excel. For more information about the types of applications you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -**Important** -Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. - - - -You can also use an existing virtual application package as the parent application. To use an existing virtual application package, use the following procedure before sequencing the new add-on or plug-in. - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To expand an existing package to the computer running the sequencer, click **Tools** / **Expand Package to Local System**. - -3. Browse to and select the package (**.sprj** file) that you want to expand, and then click **Open**. Continue with the following procedure. - -**To sequence a new add-on or plug-in application** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select **Create Package (default)**, and click then **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**. - - For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Select Primary** page, click **Browse** and specify the parent application. - - **Important** - If the parent application that the add-on or plug-in you are installing is going to support has not been installed locally, stop here and install the application on the computer running the sequencer. For example, the **Excel.exe** program file must be installed locally for a Microsoft Excel plug-in. - - - -~~~ -Click **Next**. -~~~ - -7. On the **Package Name** page, specify a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will also be displayed in the App-V management console. The **Installation Location** displays the Application Virtualization path where the application will be installed. To edit this location, select **Edit (Advanced)**. - - **Important** - Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path. - - - -~~~ -Click **Next**. -~~~ - -8. On the **Installation** page, when the sequencer and application installer are ready, install the plug-in or add-in application so the sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. If you want to customize any of the items in the following list, select **Customize**. - - - Edit the file type associations associated with an application. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -11. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) that will be associated with the various applications in the package. To create a new FTA, in the left pane, select and expand the application that you want to customize, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. Under the application, select **Shortcuts** to review the shortcut information associated with an application. In the **Location** pane, you can review the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note** - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop** and select one of the check boxes, **Stop all applications** or **Stop this application only**. - - - -13. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**. - -14. On the **Create Package** page, to modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Optionally, select **Comments** to add comments that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -15. On the **Completion** page, after you have reviewed the information that is displayed in the **Successful Virtual Application Package Report** pane, click **Close**. The information displayed in the **Successful Virtual Application Package Report** pane is also available in the directory specified in step 14 of this procedure, in a file named **Reports.xml**. - - The package is now available in the sequencer. Click **Edit \[Package Name\]** to edit the package properties. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md). - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md b/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md deleted file mode 100644 index 8ebca67179..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Sequence a New Application (App-V 4.6) -description: How to Sequence a New Application (App-V 4.6) -author: eavena -ms.assetid: f2c398c6-9200-4be3-b502-e00386fcd150 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application (App-V 4.6) - - -Use the following procedure to create a new virtual application by using the Application Virtualization (App-V) Sequencer. You can also use the App-V Sequencer to configure which files and configurations are applicable to all users and which files and configurations users can customize. After you successfully sequence the application, it is available in the App-V Sequencer. - -**Important** -During sequencing, if the computer running the sequencer is running Windows Vista or Windows 7, and a restart is initiated outside of the virtual environment, for example, by clicking **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation will fail, and the computer will restart. When you click **Cancel**, the sequencer successfully records the restart while the application is being sequenced. - - - -**To sequence a new application** - -1. To create the App-V drive, configure drive Q as the location that can be used to save files while you are sequencing an application. You must then create individual directories for each application that you plan to sequence on drive Q. You can create the virtual application targeted folders before you sequence an application, or you can create them in step 5 of this procedure. - - **Note** - The App-V drive you specify must be accessible on targeted computers. If drive Q is not accessible, you can choose a different drive letter. - - - -2. To start the App-V Sequencer Console, on the computer that is running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. To start the Sequencing Wizard, click **Create a Package**. - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**, and then click **Next**; otherwise, proceed to step 5. - -4. On the **Advanced Options** page, to allow Microsoft Update to update the application as it is being sequenced, select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates can be installed during the monitoring phase, and you have to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Terminal Server scenarios. Click **Next**. - -5. On the **Monitor Installation** page, when you are ready to install the application, click **Begin Monitoring**, and in the **Browse for Folder** dialog box, specify the directory on drive Q where the application will be installed. If you did not configure drive Q and used a different drive letter for the application virtualization drive, select the drive letter you specified in step 1 of this procedure. To install the application to a folder that has not been created on the application virtualization drive, click **Make New Folder**. After you specify the folder, wait while the Sequencer configures the computer for sequencing. - - **Important** - You must install each application that you sequence into a separate directory on the virtual application drive, and the associated folder name must not be longer than eight characters. - - - -~~~ -After the computer has been configured for sequencing, install the application so that the App-V Sequencer can monitor the installation; when you are finished, click **Stop Monitoring**, and then click **Next**. -~~~ - -6. On the **Configure Applications** page, if necessary, configure the shortcuts and file type associations that will be associated with the virtual application. To add a new file type association or shortcut, click **Add**, and in the **Add Application** dialog box, specify the new element. To remove an existing shortcut or file type association, click **Remove**. To edit an existing element, select the element you want to modify, and then click **Edit**. Specify the configurations in the **Edit Application** dialog box. Click **Save**, and then click **Next**. - -7. On the **Launch Applications** page, to start the application to ensure that the package has been installed correctly and is optimized for streaming, select the package, and then click **Launch**. This step is useful for configuring how the application initially runs on targeted computers and for accepting any associated license agreements before the package becomes available to App-V clients. If multiple applications are associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -8. After you have successfully created the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the virtual drive location where the package will be saved. - - You can optionally create an associated Windows Installer file (**.msi**) to install the virtual application package on targeted computers. To create a Windows Installer file, open the package in the Sequencer and select **Tools** / **Create MSI**. The Windows Installer file will be created and saved in the directory where the virtual application package is saved. - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer running the sequencer. - - - -## Related topics - - -[How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md deleted file mode 100644 index 590210b069..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Sequence a New Application by Using the Command Line -description: How to Sequence a New Application by Using the Command Line -author: eavena -ms.assetid: c3b5c842-6a91-4d0a-9a22-c7b8d1aeb09a -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application by Using the Command Line - - -You can use a command line to sequence a new application. Using a command line is useful when you have to create a large number of virtual applications or when you need to create sequenced applications on a recurring basis. - -**Important** -Command-line sequencing allows for default sequencing only. If you need to change default installation settings for the application you are sequencing, you must either manually modify the virtual application or update the virtual application by using the Application Virtualization (App-V) Sequencer. For more information about updating a virtual application by using the App-V Sequencer, see [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md). - - - -Use the following procedure to create a virtual application by using the command line. - -**To sequence an application by using the command line** - -1. On the computer that is running the App-V Sequencer, open the command prompt by selecting **Start**, **Run**, and then type **cmd**. Click **OK**. - -2. Use the command prompt to specify the location of where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /INSTALLPACKAGE:"pathtoMSI" /INSTALLPATH:"pathtopackageroot" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are sequencing. For a complete list of parameters that are available for use with the App-V Sequencer, see [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - -
          ValueDescription

          pathtoMSI

          Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.

          pathtopackageroot

          Specify the package root directory.

          pathtodestinationSPRJ

          Specifies the path and file name of the SPRJ file that will be created.

          -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md deleted file mode 100644 index 2f8c87b2f6..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Sequence a New Application Package Using the Command Line -description: How to Sequence a New Application Package Using the Command Line -author: eavena -ms.assetid: de72912b-d9e7-45b5-a601-12528f1a4cac -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application Package Using the Command Line - - -You can use a command line to sequence a new application. Using a command line is useful when you have to create a large number of virtual applications or when you need to create sequenced applications on a recurring basis. - -**Important** -Command-line sequencing allows for default sequencing only. If you need to change default installation settings for the application you are sequencing, you must either manually modify the virtual application or update the virtual application by using the Application Virtualization (App-V) Sequencer. For more information about updating a virtual application by using the App-V Sequencer, see [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md). - - - -Use the following procedure to create a virtual application by using the command line. - -**To sequence an application by using the command line** - -1. On the computer that is running the App-V Sequencer, open the command prompt by selecting **Start**, **Run**, and then type **cmd**. Click **OK**. - -2. Use the command prompt to specify the location of where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /INSTALLPACKAGE:"pathtoMSI" /INSTALLPATH:"pathtopackageroot" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are sequencing. For a complete list of parameters that are available for use with the App-V Sequencer, see [Application Virtualization Sequencer Command Line](application-virtualization-sequencer-command-line.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - -
          ValueDescription

          pathtoMSI

          Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.

          pathtopackageroot

          Specifies the package root directory.

          pathtodestinationSPRJ

          Specifies the path and file name of the SPRJ file that will be created.

          -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application.md b/mdop/appv-v4/how-to-sequence-a-new-application.md deleted file mode 100644 index 93f3d84506..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Sequence a New Application -description: How to Sequence a New Application -author: eavena -ms.assetid: e01e98cd-2378-478f-9739-f72c465bf79a -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application - - -The Application Virtualization (App-V) Sequencer creates applications that can be run in a virtual environment. The App-V Sequencer monitors the installation and setup process for an application, and it records the information necessary for the application to run in a virtual environment. You can also use the App-V Sequencer to configure which files and configurations are applicable to all users and which files and configurations users can customize. When you sequence an application, you should save the package to a drive that is local to the computer you are sequencing on. - -A sequenced application does not interact with the operating system because each application runs in a virtual environment and is isolated from other applications that might be installed or running on the target computer. This isolation dramatically reduces application conflicts and decreases the required amount of application pre-deployment testing. - -After you successfully sequence the application, it is available in the App-V Sequencer Console. Running the App-V sequencer in Safe Mode is not supported. - -**To sequence a new application** - -1. You must create the Application Virtualization drive to sequence a new virtual application. To create the Application Virtualization drive, map the Q:\\ drive to a location that can be used to save files while you are sequencing an application. You must then create individual directories for each application you plan to sequence on the Q:\\ drive. You can create the virtual application target folders before you sequence an application, or you can create it in step 5 of this procedure. - -2. To start the App-V Sequencer Console, on the computer that is running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. To start the **Sequencing Wizard**, select **File** / **New Package**. - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**. Click **Next**. - - **Note** - To display the **Advanced Options** page, you must select **Show Advanced Monitoring Options**. If you do not require the **Advanced Options** page, skip to step 4. - - - -4. On the **Advanced Options** page, to specify the **Block Size** for the virtual application, select the size you want. The block size determines how the **.sft** file will be divided for streaming the package across the network to target computers. To allow Microsoft Update to update the application as it is being sequenced; select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Terminal Server scenarios. Click **Next**. - -5. On the **Monitor Installation** page, to monitor the installation of an application, click **Begin Monitoring**. After you click **Begin Monitoring**, specify the directory on the Q:\\ drive where the application will be installed. To install the application to a folder that has not been created, click **Make New Folder**. You must install each application that you sequence into a separate directory. - - **Important** - The folder name you specify must not be longer than 8 characters. - - - -~~~ -Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring** and then click **Next**. -~~~ - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset** and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box. Click **OK** and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -9. On the **Sequence Package** page, to close the wizard, click **Finish**. - -10. After you have successfully created the package, to save the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the location where the package will be saved. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md deleted file mode 100644 index 3ca27b78c7..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Sequence a New Middleware Application (App-V 4.6 SP1) -description: How to Sequence a New Middleware Application (App-V 4.6 SP1) -author: eavena -ms.assetid: 304045c2-5e5e-4c91-b59e-a91fdf2500fb -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Sequence a New Middleware Application (App-V 4.6 SP1) - - -Use the following procedure to create a new middleware virtual application package using the Application Virtualization (App-V) Sequencer. A middleware application is software that connects software modules or applications. For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -Use this type of package by using Dynamic Suite Composition in App-V. Dynamic Suite Composition enables you to define a virtual application package as being dependent on another virtual application package. The dependency enables the application to interact with the middleware or plug-in in the virtual environment, where typically this interaction is prevented. This is useful because a secondary application package can be used with several other primary applications, which enables each primary application to reference the same secondary package. For more information about how to use Dynamic Suite Composition, see [How To Use Dynamic Suite Composition](https://go.microsoft.com/fwlink/?LinkID=203804&clcid=0x409) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkID=203804&clcid=0x409). - -**Important** -During sequencing, if the computer running the App-V Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, App-V Sequencer successfully records the restart while the application is being sequenced. - - - -**To sequence a new middleware application** - -1. To start App-V Sequencer, on the computer that is running App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you must scan the computer running the App-VSequencer to ensure that no unwanted or malicious files can be added to the package. - - - -4. On the **Type of Application** page, select **Middleware**, and then click **Next**. - - For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Package Name** page, specify a name that will be associated with the package. The name helps identify the purpose and version of the application that will be added to the package. The package name is also displayed in the App-V Management Console. The **Installation Location** displays the application virtualization path where the application will be installed. To edit this location, select **Edit (Advanced)**. - - **Important** - Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path. - - - -~~~ -Click **Next**. -~~~ - -7. On the **Installation** page, when the Sequencer and middleware application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**. - -8. On the **Installation** page, wait while the Sequencer configures the virtual application package. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**. - -11. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default, the **Save the package now** check box. Add optional comments in the **Comments** box that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse**, and then specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -12. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. The information displayed in the **Virtual Application Package Report** pane is also available in the directory specified in step 11 of this procedure, in a file named **Report.xml**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the Sequencer. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md deleted file mode 100644 index baf39c7e2c..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: How to Sequence a New Standard Application (App-V 4.6 SP1) -description: How to Sequence a New Standard Application (App-V 4.6 SP1) -author: eavena -ms.assetid: c4a2eb33-def8-4535-b93a-3d2de21ce29f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Standard Application (App-V 4.6 SP1) - - -Use the following procedure to create a new standard virtual application package by using the Application Virtualization (App-V) Sequencer. This procedure applies to most applications that you sequence. For more information about the types of applications you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). You must run the sequencer (**SFTSequencer.exe**) using an account that has administrator privileges because of the changes the sequencer makes to the local system. These changes can include writing files to the **C:\\Program Files** directory, making registry changes, starting and stopping services, updating security descriptors for files, and changing permissions. - -**Important** -During sequencing, if the computer running the Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows Vista or Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, the Sequencer successfully records the restart while the application is being sequenced. - - - -**Note** -Running the App-V sequencer in Safe Mode is not supported. - - - -**To sequence a new standard application** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information that is displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, scan the computer running the Sequencer to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, click **Standard Application (default)** check box, and then click **Next**. - - For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**. - -6. On the **Package Name** page, specify a name that will be associated with the package. The name helps identify the purpose and version of the application that are added to the package. The package name is also displayed in the App-V management console. The **Primary Virtual Application Directory** displays the Application Virtualization path where the application will be installed on target computers. To edit this location, select **Edit (Advanced)**. - - **Important** - Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, the default path is recommended. - - - -~~~ -Click **Next**. -~~~ - -7. On the **Installation** page, when the Sequencer and application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - -8. On the **Installation** page, wait while the Sequencer configures the virtual application package. - -9. On the **Configure Software** page, optionally run the programs contained in the package. This step helps complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -10. On the **Installation Report** page, you can review information about the virtual application package you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -11. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 15 of this procedure. If you want to customize any of the items in the following list, select **Customize**. - - - Edit the file type associations and the icons associated with an application. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -12. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) and shortcut locations that will be associated with the various applications in the package. To create a new FTA, in the left pane, select and expand the application you want to customize, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. To review the shortcut information associated with an application, under the application, select **Shortcuts**, and in the **Location** pane, you can edit the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. - -13. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note** - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop**, and select one of the check boxes, **Stop all applications** or **Stop this application only**, depending on what you want. - - - -14. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and specify the operating systems that can run this package. Click **Next**. - - **Important** - The operating systems specified during this step reflect the operating systems on target computers that are enabled to run the package. You must ensure that the operating systems specified are supported by the application you are sequencing. - - - -15. On the **Create Package** page, to modify the package without saving it, select **Continue to modify package without saving using the package editor**. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -16. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. The information displayed in the **Virtual Application Package Report** pane is also available in the directory specified in step 15 of this procedure, in a file named **Report.xml**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the Sequencer. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-an-application.md b/mdop/appv-v4/how-to-sequence-an-application.md deleted file mode 100644 index 119261cce7..0000000000 --- a/mdop/appv-v4/how-to-sequence-an-application.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: How to Sequence an Application -description: How to Sequence an Application -author: eavena -ms.assetid: bd643dd6-dbf6-4469-bc70-c43ad9c69da9 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence an Application - - -The Application Virtualization (App-V) Sequencer creates applications that can be run in a virtual environment. The App-V Sequencer monitors the installation and setup process for an application, and it records the information necessary for the application to run in a virtual environment. You can also use the App-V Sequencer to configure which files and configurations are applicable to all users and which files and configurations users can customize. When you sequence an application, you should save the package to a drive that is local to the computer you are sequencing on. - -A sequenced application does not interact with the operating system because each application runs in a virtual environment and is isolated from other applications that might be installed or running on the target computer. This isolation dramatically reduces application conflicts and decreases the required amount of application pre-deployment testing. - -After you successfully sequence the application, it is available in the App-V Sequencer Console. - -**To sequence a new application** - -1. You must create the Application Virtualization drive to sequence a new virtual application. To create the Application Virtualization drive, map the Q:\\ drive to a location that can be used to save files while you are sequencing an application. You must then create individual directories for each application you plan to sequence on the Q:\\ drive. You can create the virtual application target folders before you sequence an application, or you can create it in step 5 of this procedure. - -2. To start the App-V Sequencer Console, on the computer that is running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. To start the **Sequencing Wizard**, select **File** / **New Package**. - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**. Click **Next**. - - **Note** - To display the **Advanced Options** page, you must select **Show Advanced Monitoring Options**. If you do not require the **Advanced Options** page, skip to step 4. - - - -4. On the **Advanced Options** page, to specify the **Block Size** for the virtual application, select the size you want. The block size determines how the **.sft** file will be divided for streaming the package across the network to target computers. To allow Microsoft Update to update the application as it is being sequenced; select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Remote Desktop Session Host (RD Session Host) Server scenarios. Click **Next**. - -5. On the **Monitor Installation** page, to monitor the installation of an application, click **Begin Monitoring**. After you click **Begin Monitoring**, specify the directory on the Q:\\ drive where the application will be installed. To install the application to a folder that has not been created, click **Make New Folder**. You must install each application that you sequence into a separate directory. - - **Important** - The folder name you specify must not be longer than 8 characters. - - - -~~~ -Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring**, and then click **Next**. -~~~ - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element that you want to update, and then click **Edit Locations**. Specify the configurations in the Shortcut Locations dialog box. Click **OK**, and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -9. On the **Sequence Package** page, to close the wizard, click **Finish**. - -10. After you have successfully created the package, to save the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the location where the package will be saved. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md b/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md deleted file mode 100644 index ad438383ba..0000000000 --- a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Set Up a Concurrent License Group -description: How to Set Up a Concurrent License Group -author: eavena -ms.assetid: 031abcf6-d8ed-49be-bddb-91b2c695d411 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up a Concurrent License Group - - -You can use the following procedure in the Application Virtualization Server Management Console to set up a concurrent license group. When you set up a concurrent license group, you can limit access to applications to a specific number of concurrent users. - -**To set up a concurrent license group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select **New Concurrent License**. - -3. Enter a name in the **Application License Group Name** field. - -4. Enter a value (in minutes) in the **License Expiration Warning** field. - -5. Click **Next**. - -6. Enter descriptive text in the **License Description** field. - -7. Enter a value in the **Concurrent License Quantity** field. - -8. Select the **Enabled** check box to enable the license. - -9. Select the **Expiration Date** check box (if you want to set an expiration date), and enter the expiration date or use the calendar utility to select a date. - -10. If you need to associate a key with the license, enter the license key information in the **License Key** field. - -11. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-a-named-license-group.md b/mdop/appv-v4/how-to-set-up-a-named-license-group.md deleted file mode 100644 index 5779656049..0000000000 --- a/mdop/appv-v4/how-to-set-up-a-named-license-group.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Set Up a Named License Group -description: How to Set Up a Named License Group -author: eavena -ms.assetid: 8ef6716c-0cb7-4706-ad3b-ac6f27b2e7ad -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up a Named License Group - - -You can use the following procedure in the Application Virtualization Server Management Console to set up a named license group. When you set up a named license group, you are giving specific users access to the selected application. - -**To set up a Named License Group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select **New Named License**. - -3. Enter a name in the **Application License Group Name** field. - -4. Enter a value (in minutes) in the **License Expiration Warning** field. - -5. Click **Next**. - -6. Enter descriptive text in the **License Description** field. - -7. Select the **Enabled** check box to enable the license. - -8. Select the **Expiration Date** check box (if you want to set an expiration date), and enter the expiration date or use the calendar utility to select a date. - -9. Click **Next**. - -10. Use the **Named License User Wizard** to add, edit, or remove specific users from the license group. - -11. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Remove an Application License Group](how-to-remove-an-application-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md b/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md deleted file mode 100644 index a793a50ed2..0000000000 --- a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Set Up an Unlimited License Group -description: How to Set Up an Unlimited License Group -author: eavena -ms.assetid: 0c37c7b7-aba9-4c03-9e0e-94c966f874cf -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up an Unlimited License Group - - -You can use the following procedure in the Application Virtualization Server Management Console to set up an unlimited license group. When you set up an unlimited license group, you let an unlimited number of users access an application simultaneously. - -**To set up an unlimited license group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select **New Unlimited License**. - -3. Enter the name of the new group in the **Application License Group Name** field. - -4. Enter a value (in minutes) in the **License Expiration Warning** field. - -5. Click **Next**. - -6. Enter descriptive text in the **License Description** field. - -7. Select the **Enabled** check box to enable the license. - -8. Select the **Expiration Date** check box (if you want to set an expiration date), and enter the expiration date or use the calendar utility to select a date. - -9. If you need to associate a key with the license, enter the license key information in the **License Key** field. - -10. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md b/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md deleted file mode 100644 index 45059429b0..0000000000 --- a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Set Up and Enable or Disable Authentication -description: How to Set Up and Enable or Disable Authentication -author: eavena -ms.assetid: 1e43d0c5-a467-4a8b-b656-93f75d7deb82 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up and Enable or Disable Authentication - - -The Application Virtualization Server Management Console lets you enable or disable Windows authentication, which lets you to define who has access to the system. You can use the following procedures to set up and disable authentication from the **Provider Policies Results** pane of the console. - -**Note**   - Normally, you set up authentication when you add a provider policy through the New Provider Policy Wizard. - - - -**To set up authentication** - -1. Click the **Provider Policies** node to display the list of provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Make sure the **Authentication** check box is selected. - -5. Select the authentication level from the drop-down list. - -6. Click **Apply** or **OK**. - -**To enable or disable authentication** - -1. Click the **Provider Policies** node to display the list of provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Select the **Authentication** check box to enable authentication. Clear the box to disable it. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md b/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md deleted file mode 100644 index 2171c365e1..0000000000 --- a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Set Up or Disable Application Licensing -description: How to Set Up or Disable Application Licensing -author: eavena -ms.assetid: 7c00b531-ec41-4970-b0fc-d84225ce3bb2 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up or Disable Application Licensing - - -You can use the following procedures to set up or disable application licensing in the Application Virtualization Server Management Console. - -**To set up application licensing** - -1. Click the **Provider Policies** node to display the provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Select the **Licensing** check box, and select a licensing option from the drop-down menu. - -5. Click **Apply** or **OK**. - -**To disable application licensing** - -1. Click the **Provider Policies** node to display the provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Clear the **Licensing** check box. - -5. Click **Apply** or **OK**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md b/mdop/appv-v4/how-to-set-up-or-disable-database-size.md deleted file mode 100644 index 055ff8198c..0000000000 --- a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Set Up or Disable Database Size -description: How to Set Up or Disable Database Size -author: eavena -ms.assetid: 4abaf349-132d-4186-8873-a0e515593b93 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up or Disable Database Size - - -You can use the following procedures in the Application Virtualization Server Management Console to specify the size (in MB) of Application Virtualization System usage that you want to store in the database. - -When the size of the stored data reaches 95% (the high watermark) of the specified limit, the system will delete 10% of the usage data, leaving 85% of the data. Package and application usage data will be deleted. When the database grows large enough and approaches the high watermark, a warning message is sent to the SQL Server log to inform you that this limit has been reached. This warning is necessary because the cleanup action can affect the output of the reports. It will also help you decide whether you need to increase the maximum database size, reduce the number of months of usage data to be kept, or turn down the logging level. - -**Note**   -The **No Size Limit** and **Keep All Usage** options are provided so that you can disable usage reporting and database cleanup. Selecting these items will clean up the database transaction log as well. (All committed Microsoft SQL Server transactions will be removed from the database log.) - - - -**To set up database size** - -1. Right-click the Application Virtualization System node in the left pane, and select **System Options**. - -2. Select the **Database** tab. - -3. Select the **Maximum Database Size (MB)** or **No Size Limit** radio button. - -4. If you choose to specify a database size, best practices recommend that you enter a number between 512 and 4096 MB. The default size is 1024 MB and if you need to increase the database size, the maximum value you can enter is 2,147,483,647. If you select **No Size Limit**, the database will grow until it reaches the disk size limit. - -5. Click **Apply** or **OK**. - -**To disable database size limits** - -1. Right-click the Application Virtualization System node in the **Scope** pane, and select **System Options**. - -2. Select the **Database** tab. - -3. Select the **No Size Limit** and **Keep All Usage** radio buttons. - -4. Click **Apply** or **OK**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -[How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md b/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md deleted file mode 100644 index 404bc76bd0..0000000000 --- a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Set Up or Disable Usage Reporting -description: How to Set Up or Disable Usage Reporting -author: eavena -ms.assetid: 8587003a-128d-4b5d-ac70-5b9eddddd3dc -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up or Disable Usage Reporting - - -You can use the following procedures in the Application Virtualization Server Management Console to specify the duration (in months) of Application Virtualization System usage information you want to store in the database. - -**Note**   - To store usage information, you must select the **Log Usage Information** check box on the **Provider Pipeline** tab. To display this tab, right-click the provider policy in the **Provider Policies Results** pane and select **Properties**. - - - -**To set up usage reporting** - -1. Right-click the Application Virtualization System node in the left pane, and select **System Options**. - -2. Select the **Database** tab. - -3. Select the **Keep Usage For (Months)** or **Keep All Usage** radio button. - -4. If you choose to specify usage duration in months, enter a number from 1 to 120 (default value is 6 months). If you select **Keep All Usage**, the database will grow until it reaches the specified size limit. - -5. Click **Apply** or **OK**. - -**To disable usage reporting** - -1. Click the **Provider Policies** node. - -2. Right-click **Provider Policy** and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Clear the **Log Usage Information** check box. - -5. Click **Apply** or **OK**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -[How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md b/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md deleted file mode 100644 index f069cfa3b6..0000000000 --- a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Set Up Periodic Publishing Refresh -description: How to Set Up Periodic Publishing Refresh -author: eavena -ms.assetid: c358c765-cb88-4881-b4e7-0a2e87304870 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Periodic Publishing Refresh - - -You can use the following procedure to configure the client to periodically refresh the publishing information from the App-V servers. After the client is configured, the refresh operation is automatic. These settings configure the default settings for the client so that all users on this computer will see the same settings. - -**Note**   -After you have performed this procedure, the publishing information will be refreshed according to the new settings after the first refresh at login. When this first refresh occurs, the server might override the computer settings with different settings, depending on how it is configured. The **Refresh** tab in the **Properties** dialog box shows the locally configured client computer settings and any settings that might have been configured for the user by the publishing server. - - - -**To periodically refresh the publishing information from the Application Virtualization Servers** - -1. Click **Publishing Servers** in the **Scope** pane. - -2. In the **Results** pane, right-click the desired server and select **Properties** from the pop-up-menu. - -3. In the **Properties** dialog box, on the **Refresh** tab, select the **Refresh configuration every** check box and enter a number that represents the frequency in the field. Then select **Minutes**, **Hours**, **Days** from the drop-down menu. - - **Note**   - This setting will cause the client to refresh publishing information every time the configured period elapses. If the user is not logged in when it's time to do a refresh, the refresh will take place when the user next logs in. The timer is then started again for the next period. - - - -4. Click **Apply** to change the configuration. - -5. When you finish configuring the server, click **OK** to exit the dialog box and return to the Application Virtualization Client Management Console. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md b/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md deleted file mode 100644 index a416763534..0000000000 --- a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Set Up Publishing Refresh on Login -description: How to Set Up Publishing Refresh on Login -author: eavena -ms.assetid: 196448db-7645-4fd5-a854-ef6405b15db4 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Publishing Refresh on Login - - -You can use the following procedure to configure the Application Virtualization (App-V) Client to refresh the publishing information from the server each time you log in to the computer. After the client is configured, the refresh operation is automatic. - -**To refresh the publishing information on login** - -1. Click **Publishing Servers** in the **Scope** pane. - -2. In the **Results** pane, right-click the desired server and select **Properties** from the pop-up-menu. - -3. In the **Properties** dialog box, on the **Refresh** tab, select the **Refresh configuration server on user login** check box. - -4. Click **Apply** to change the configuration. - -5. When you finish configuring the settings, click **OK** to exit the dialog box and return to the Application Virtualization Management Console. - - The publishing information will now be refreshed each time you log in to the system. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-publishing-servers.md b/mdop/appv-v4/how-to-set-up-publishing-servers.md deleted file mode 100644 index ad41ea0184..0000000000 --- a/mdop/appv-v4/how-to-set-up-publishing-servers.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Set Up Publishing Servers -description: How to Set Up Publishing Servers -author: eavena -ms.assetid: 2111f079-c202-4c49-b2a6-f4237068b2dc -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Publishing Servers - - -You can use the following procedures to add and configure Application Virtualization Servers directly from the Client Management Console. - -**To add an application publishing server** - -1. In the **Results** pane, right-click and select **New Server** from the pop-up-menu to start the New Application Virtualization Server Wizard, or alternatively, right-click the **Publishing Server** node and select **New Server** from the pop-up-menu. - -2. On page one of the wizard, enter the name of the server in the **Display Name** field and select the server type from the **Type** drop-down list. You can choose **Application Virtualization Server**, **Enhanced Security Application Virtualization Server**, **Standard HTTP Server**, or **Enhanced Security HTTP Server** from the drop-down list of server types. - -3. Click **Next**. - -4. On page two of the wizard, type the appropriate information into the **Host Name** and **Port** fields. The **Path** field is not editable for Application Virtualization Servers. You must enter a path for Standard HTTP Server or Enhanced Security HTTP Server. - -5. Click **Finish** to add the server. - -**To set up an application publishing server** - -1. In the **Results** pane, right-click the desired server and select **Properties** from the pop-up menu. - -2. Click the **General** tab, where you can change the server name, select a type from the drop-down list of server types, and specify the host name and port. When the server type is Standard HTTP Server or Enhanced Security HTTP Server, the **Path** field is also editable. - -3. Click the **Refresh** tab, where the **Refresh publishing on user login** check box is selected by default. To change the refresh rate, select the **Refresh publishing every** check box and enter a number that represents the frequency in the field. Then select **Minutes**, **Hours**, **Days** from the drop-down menu. (The minimum amount of time you can enter is 30 minutes.) - -4. Click **Apply** to change the configuration. - -5. When you are finished publishing, click **OK** to exit the dialog box and return to the Client Management Console. - -## Related topics - - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md b/mdop/appv-v4/how-to-uninstall-the-app-v-client.md deleted file mode 100644 index aa38719ec5..0000000000 --- a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Uninstall the App-V Client -description: How to Uninstall the App-V Client -author: eavena -ms.assetid: 07591270-9651-4bb5-a5b3-e0fc009bd9e2 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the App-V Client - - -Use the following procedure to uninstall the Application Virtualization Client from the computer. - -**To uninstall the Application Virtualization Desktop Client** - -1. In Control Panel, double-click **Add or Remove Programs** (or in Windows Vista, **Programs and Features**), and then double-click **Microsoft Application Virtualization Desktop Client**. - -2. In the dialog box that appears, click **Yes** to continue with the uninstall process. - - **Important**   - The uninstall process cannot be canceled or interrupted. - - - -3. When a message stating that the Microsoft Application Virtualization Client Tray application must be closed before continuing appears, right-click the App-V icon in the notification area and select **Exit** to close the application. Then click **Retry** to continue with the uninstall process. - - **Important**   - You might see a message stating that one or more virtual applications are in use. Close any open applications and save your data before you continue. Then click **OK** to continue with the uninstall process. - - - -4. A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process. - - **Note**   - The following registry keys remain after the uninstall process is complete: - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5 - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard "Client"=dword:00000000 - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\SecKey - - - -## Related topics - - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md b/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md deleted file mode 100644 index 2285f43d07..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Upgrade a Package Using the Open Package Command -description: How to Upgrade a Package Using the Open Package Command -author: eavena -ms.assetid: 67c10440-de8a-4547-a34b-f83206d0cc3b -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Package Using the Open Package Command - - -Use the Open Package command to upgrade or apply an update to a sequenced application package. When you upgrade an existing virtual application package using the command line, the original version of the .sft file is deleted. You should backup the associated .sft file before upgrading the package using the command line. - -**To upgrade a package using the Open Package command** - -1. To open the package that will be upgraded, in the Application Virtualization (App-V) console select **File**, **Open Package for Upgrade**. In the **Open** dialog box, select the package that will be upgraded. - -2. To start the **Sequencing** wizard, select **Tools**, **Sequencing Wizard**. Complete the wizard applying the configuration changes, to save the new sequenced application, select **File**, **Save**. - -3. To append the version number to the package name, in the Sequencer console, select **Tools**, **Options**. Select **Append Package Version to Filename**. Click **OK**. - - **Important**   - Updating the file name with the package version is essential to successfully completing the upgrade. - - - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-package.md b/mdop/appv-v4/how-to-upgrade-a-package.md deleted file mode 100644 index a2e8150145..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-package.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Upgrade a Package -description: How to Upgrade a Package -author: eavena -ms.assetid: 831c7556-6f6c-4b3a-aefb-26889094dc1a -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Package - - -The process for an automatic upgrade is the same as for adding a package version in the Application Virtualization Server Management Console. An automatic upgrade is performed when you resequence the application in an existing package. Then you can add this new version to your servers for streaming. - -When you upgrade a package with a new version, you can leave the existing version in place or delete it and leave only the newest one. You might want to leave the old version in place for compatibility with legacy documents or so that you can test the new version before making it available to all users. - -**To upgrade a package automatically** - -1. Copy the new SFT file to the Application Virtualization Server's content folder. - - **Note**   - If resequencing did not add features that changed the Open Software Descriptor (OSD), icon (ICO), or Sequencer Project (SPRJ) files, you do not need to copy those. You can include these files if you want all these files to display the same date. - - - -2. In left pane of the Application Virtualization Server Management Console, expand **Packages**. - -3. Right-click the package you want to upgrade, and select **Add Version**. - -4. In the **Add Package Version** dialog box, browse for or type the full path name for the new application version in the **Full Path for the file** field. This must be an SFT file. - -5. Click **Next**. - -6. The **Summary** dialog box shows the file location and prompts you to copy the file there if you have not already done so. Click **Finish** after you have verified the information. - - The new version is now complete and ready to stream. - -## Related topics - - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md deleted file mode 100644 index 85293d4b7e..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: How to Upgrade a Sequenced Application Package Using the Command Line -description: How to Upgrade a Sequenced Application Package Using the Command Line -author: eavena -ms.assetid: 682fac46-c71d-4731-831b-81bfd5032764 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Sequenced Application Package Using the Command Line - - -Use the following procedure to upgrade a virtual application by using a command line. When you upgrade an existing virtual application package by using the command line, the original version of the .sft file is deleted. You should back up the associated .sft file before upgrading the package by using the command line. - -**To upgrade a virtual application** - -1. On the computer that is running the Application Virtualization (App-V) Sequencer, to open the command prompt, select **Start**, **Run**, and type **cmd**. Click **OK**. - -2. At the command prompt, specify the location where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /UPGRADE:"pathtosourceSPRJ" /INSTALLPACKAGE:"pathtoUpgradeInstaller" /DECODEPATH:"pathtodecodefolder" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are upgrading. For a complete list of parameters that are available for use with the App-V Sequencer, see [Command-Line Parameters](command-line-parameters.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ValueDescription

          pathtosourceSPRJ

          Specifies the directory location of the virtual application to be upgraded.

          pathtoUpgradeInstaller

          Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.

          pathtodecodefolder

          Specify the directory in which to unpack the SFT file.

          pathtodestinationSPRJ

          Specifies the path and file name of the SPRJ file that will be created.

          -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md deleted file mode 100644 index 10086eb8f7..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Upgrade a Sequenced Virtual Application Package -description: How to Upgrade a Sequenced Virtual Application Package -author: eavena -ms.assetid: ffa989f3-6621-4c59-9599-e3c3b3332f67 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Sequenced Virtual Application Package - - -You can upgrade an existing virtual application to a new version by using the Application Virtualization (App-V) Sequencer. The upgrade process is similar to creating a new virtual application. You must open the existing virtual application for an upgrade, make the necessary updates, and then save the updated virtual application to a new location in the package root directory. You can also use the App-V Sequencer Console to make changes to an existing virtual application without performing an upgrade. However, you cannot make modifications to the virtual application’s file system by using this method because the App-V Sequencer does not actually decode the associated .sft file. For example; you can open an existing virtual application in the App-V Sequencer Console by selecting **Open** on the **File** menu. You can update the **Package Name** and the associated **Comments**, and you can make changes to the virtual file system and virtual registry. You can also create a Windows Installer file. - -**Caution**   -You should not reference a previous version of the Windows Installer (.msi) file when you upgrade an existing virtual application package because the previous version of the .sft file will be modified during the upgrade. - - - -Use the following procedure to upgrade an existing virtual application. - -**To upgrade an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start**/**Programs**/**Microsoft Application Virtualization**/**Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application, in the App-V Console, select **File**/**Open for Package Upgrade**. Use the **Open For Package Upgrade** dialog box to locate the associated SPRJ file you want to open for upgrade. - -3. To specify the location of where the updated package will be decoded, browse to the location by using the **Browse For Folder** dialog box. This is the location where the package root directory will be created as specified in the associated SFT file. The directory that you specify must be a different location from where the original version of the virtual application is saved. You can click **Make New Folder** if the new target folder has not been created yet. You should select the root of the Application Virtualization drive to create the folder. When you create the updated version of the package, it will be denoted with a sequential addition to the directory name—for example, “**.1**” will be added to the directory name located on the Q:\\ drive. - - **Important**   - The directory that you specify must be located in the package root directory on the Q:\\ drive. You can create a new folder, or you can create a subfolder under the directory where the original virtual application is saved. The name assigned to the new folder must not be longer than 8 eight characters. - - - -4. To open the Sequencing Wizard, select **Tools**/**Sequencing Wizard**. On the **Package Information** page, optionally specify the new **Package Name** and add optional comments that will be associated with the updated virtual application. Click **Next**. - -5. On the **Monitor Installation** page, to begin monitoring the new installation, click **Begin Monitoring**. After the virtual environment has finished loading, install the updated version of the application, or apply updates to the existing application. After you have finished updating the virtual application, click **Stop Monitoring**, and then click **Next**. - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the updated virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box, and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the new version of the virtual application, click **Next**. - -9. To finish and to close the Sequencing Wizard, on the **Sequence Package** page, click **Finish**. - -10. After you have successfully updated the virtual application, to save the package, in the App-V Sequencer Console, on the **File** menu, select **Save**. The virtual application can be accessed in the directory specified in step 3. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md deleted file mode 100644 index fcea04d661..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: How to Upgrade a Virtual Application by Using the Command Line -description: How to Upgrade a Virtual Application by Using the Command Line -author: eavena -ms.assetid: 83c97767-6ea1-42aa-b411-ccc9fa61cf81 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Virtual Application by Using the Command Line - - -Use the following procedure to upgrade a virtual application by using a command line. - -**To upgrade a virtual application** - -1. On the computer that is running the Application Virtualization (App-V) Sequencer, to open the command prompt, select **Start**, **Run**, and type **cmd**. Click **OK**. - -2. At the command prompt, specify the location where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /UPGRADE:"pathtosourceSPRJ" /INSTALLPACKAGE:"pathtoUpgradeInstaller" /DECODEPATH:"pathtodecodefolder" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are upgrading. For a complete list of parameters that are available for use with the App-V Sequencer, see [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ValueDescription

          pathtosourceSPRJ

          Specifies the directory location of the virtual application to be upgraded.

          pathtoUpgradeInstaller

          Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.

          pathtodecodefolder

          Specify the directory in which to unpack the SFT file.

          pathtodestinationSPRJ

          Specifies the path and file name of the SPRJ file that will be created.

          -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md deleted file mode 100644 index 82e5f8e584..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Upgrade a Virtual Application Package (App-V 4.6) -description: How to Upgrade a Virtual Application Package (App-V 4.6) -author: eavena -ms.assetid: 3566227e-f3dc-4c32-af1f-e0211588118c -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Virtual Application Package (App-V 4.6) - - -Use the following procedure to upgrade an existing virtual application by using the Application Virtualization (App-V) Sequencer. You can also use the App-V Sequencer Console to make changes to an existing virtual application without performing an upgrade, but you cannot make modifications to the virtual application’s file system by using this method because the App-V Sequencer does not actually decode the associated .sft file. For more information about editing an existing package, see [How to Modify a Virtual Application Package (App-V 4.6)](how-to-modify-a-virtual-application-package--app-v-46-.md). - -**To upgrade an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application package and start the **Sequencing Wizard**, select **Upgrade a Package**. Locate the package you want to upgrade, and click **Open**. In the **Browse For Folder** dialog box, specify the location where the upgraded version of the package will be placed. This location specified must be located on the drive specified as the application virtualization drive, which is typically the Q:\\ drive. To create a new folder, select **Make New Folder**. - - **Warning**   - You must specify the root folder of the existing virtual application. Do not manually create a subfolder or the upgrade will fail. - - - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the updated package. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application—for example, a version number. To display the **Advanced Options** page, select **Show Advanced Monitoring Options** and click **Next**; otherwise, proceed to step 5. - -4. On the **Advanced Options** page, to allow Microsoft Update to update the application as it is being sequenced, select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic-link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Click **Next**. - -5. On the **Monitor Installation** page, when you are ready to update the application, click **Begin Monitoring**. - - When the updates to the application have been applied, click **Stop Monitoring**. Click **Next**. - -6. On the **Configure Applications** page, if necessary, configure the shortcuts and file type associations that will be associated with the virtual application. To add a new file type association or shortcut, click **Add**, and in the **Add Application** dialog box, specify the new element. To remove an existing shortcut or file type association, click **Remove**. To edit an existing element, select the element you want to modify, and then click **Edit**. Specify the configurations in the **Edit Application** dialog box. Click **Save**. Click **Next**. - -7. On the **Launch Applications** page, to start the application to ensure that the package has been installed correctly and is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to App-V clients. If multiple applications are associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -8. To close the Sequencing Wizard, click **Finish**. To save the updated package, in the Sequencer Console, select **File** / **Save**. - - If you plan to deploy the updated package by using a Windows Installer file (.msi), you must create new one as follows: in the Sequencer Console, select **Tools** / **Create MSI**. The new Windows Installer file will be created and saved in the directory where the updated virtual application package is saved. - -## Related topics - - -[How to Sequence a New Application (App-V 4.6)](how-to-sequence-a-new-application--app-v-46-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md b/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md deleted file mode 100644 index 25e939097f..0000000000 --- a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Upgrade an Existing Virtual Application -description: How to Upgrade an Existing Virtual Application -author: eavena -ms.assetid: ec531576-2423-4c2c-9b9f-da74174a6858 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade an Existing Virtual Application - - -You can upgrade an existing virtual application to a new version by using the Application Virtualization (App-V) Sequencer. The upgrade process is similar to creating a new virtual application. You must open the existing virtual application for an upgrade, make the necessary updates, and then save the updated virtual application to a new location in the package root directory. - -You can also use the App-V Sequencer Console to make changes to an existing virtual application without performing an upgrade. However, you cannot make modifications to the virtual application’s file system by using this method because the App-V Sequencer does not actually decode the associated .sft file. For example; you can open an existing virtual application in the App-V Sequencer Console by selecting **Open** on the **File** menu. You can update the **Package Name** and the associated **Comments**, and you can make changes to the virtual file system and virtual registry. You can also create a Windows Installer file. - -Use the following procedure to upgrade an existing virtual application. - -**To upgrade an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start**/**Programs**/**Microsoft Application Virtualization**/**Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application, in the App-V Console, select **File**/**Open for Package Upgrade**. Use the **Open For Package Upgrade** dialog box to locate the associated SPRJ file you want to open for upgrade. - -3. To specify the location of where the package will be decoded, click **Browse For Folder** and specify the Q:\\. This is the location where the package root directory will be created as specified in the associated SFT file. When you create the updated version of the package, it will be denoted with a sequential addition to the directory name—for example, “**.1**” will be added to the directory name located on the Q:\\ drive. - -4. To open the Sequencing Wizard, select **Tools**/**Sequencing Wizard**. On the **Package Information** page, optionally specify the new **Package Name** and add optional comments that will be associated with the updated virtual application. Click **Next**. - -5. On the **Monitor Installation** page, to begin monitoring the new installation, click **Begin Monitoring**. After the virtual environment has finished loading, install the updated version of the application, or apply updates to the existing application. After you have finished updating the virtual application, click **Stop Monitoring**, and then click **Next**. - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the updated virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box, and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the new version of the virtual application, click **Next**. - -9. To finish and to close the Sequencing Wizard, on the **Sequence Package** page, click **Finish**. - -10. After you have successfully updated the virtual application, to save the package, in the App-V Sequencer Console, on the **File** menu, select **Save**. The virtual application can be accessed in the directory specified in step 3. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md deleted file mode 100644 index 841dd29209..0000000000 --- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: How to Upgrade the Application Virtualization Client -description: How to Upgrade the Application Virtualization Client -author: eavena -ms.assetid: 2a75d8b5-da88-456c-85bb-f5bd3d470f7f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade the Application Virtualization Client - - -You can use the following procedures to upgrade the Application Virtualization (App-V) Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services). You upgrade the client by installing a new version over the previously installed older version. When you upgrade the clients, the installer software automatically preserves and migrates the user’s settings for virtual applications. Administrative rights are required to run the setup program. - -**Note**   -During the upgrade to Application Virtualization (App-V) 4.5 or later versions, the permissions to the HKCU registry key are changed. Because of this, users will lose user configurations that were set previously, such as user-configured Disconnected Mode settings. If the user is not actively restricted from configuring client user interface behavior through a permission lockdown, the user can reset these preferences after a publishing refresh. - - - -**Important**   -When upgrading to version 4.6 or a later version of the App-V Client, you must use the correct installer for the computer’s operating system, 32-bit or 64-bit. The installation will fail and an error message will be displayed if you use the wrong installer. - - - -**To upgrade the Application Virtualization Desktop Client** - -1. Shut down all virtual applications, right-click the App-V Desktop Client icon displayed in the Windows desktop notification area, and select **Exit** to shut down the existing client. - -2. After you have obtained the correct installer archive file and saved it to your computer, double-click it to expand the archive. - -3. Browse to find the setup.exe file, and double-click setup.exe to start the installation. - -4. The wizard checks the system to ensure that all prerequisite software is installed and will prompt you to install any of the following, if missing: - - - Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) - - - Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) - - - Microsoft Application Error Reporting - - **Note**   - For version 4.6 and higher, the wizard will also install the following software prerequisite: - - - Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) - - - -5. Click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully. - -6. When the **Application Virtualization Desktop Client** dialog appears and displays a message stating that an older version of the client has been found on the computer, click **Next** to upgrade to the new version. - -7. When the **License Agreement** screen is displayed, read the license agreement, and if you agree, click **I accept the terms in the license agreement**, and then click **Next**. - -8. When the InstallShield Wizard displays the **Ready to Upgrade the Program** dialog screen, click **Upgrade** to begin the upgrade. The next screen indicates that the client is being installed. - - **Warning**   - If you did not shut down the client program in step 1, you might see a **Files In Use** warning displayed. If this happens, right-click the App-V Client icon displayed in the desktop notification area and select **Exit** to shut down the existing client. Then click **Retry** to continue. - - - -9. When the installation completes successfully, you will be prompted to restart the computer. You need to restart the computer to complete the installation. - - **Caution**   - If the upgrade fails for any reason, you will need to restart the computer before attempting the upgrade again. - - - -**To upgrade the Application Virtualization Client by Using the Command Line** - -1. If upgrading the App-V client using the setup.msi program, ensure that any necessary prerequisite software has been installed. - - **Important**   - - For version 4.6 and later of the App-V client, the setup.msi program checks the system and will fail with an error message indicating that installation cannot continue if prerequisite software is not installed. - - - For App-V version 4.6, command-line parameters cannot be used during an upgrade and will be ignored. - - - -2. The following command-line example uses the setup.msi file to upgrade the App-V Client. You will need to use the correct client installer program depending on whether you are upgrading the App-V Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services). - - **msiexec.exe /i "setup.msi"** - - **Important**   - The quotation marks are required only when the value contains a space. For consistency, all instances in the preceding example are shown as having quotation marks. - - - -**To upgrade the Application Virtualization Client for Remote Desktop Services** - -1. Follow your organization’s standard policies for installing or upgrading applications on the Remote Desktop Session Host (RD Session Host) server. If the system is part of a farm, remove the RD Session Host from the server farm. - -2. To upgrade the App-V Client for Remote Desktop Services (formerly Terminal Services), you must use the command line because you cannot upgrade the client manually on the RD Session Host. - - **Note**   - In App-V version 4.6 and later, in addition to using the command line to upgrade the client, you can also use a Remote Desktop session. No special parameters are required to start the Remote Desktop session. - - - -3. After the Client for Remote Desktop Services upgrade is complete, restart and log in to the RD Session Host. - -4. After the system is restarted, add the server to the server farm. - - **Caution**   - If the upgrade fails for any reason, you will need to restart the computer before attempting the upgrade again. - - - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md deleted file mode 100644 index 8505528785..0000000000 --- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Upgrade the Application Virtualization Sequencer -description: How to Upgrade the Application Virtualization Sequencer -author: eavena -ms.assetid: 7f85f140-5034-4227-85ef-81f205e722ef -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade the Application Virtualization Sequencer - - -Upgrading from previous versions of the Sequencer is not supported. You must uninstall any previous versions of the Sequencer and then install Microsoft Application Virtualization Sequencer 4.5. However, Virtual applications created using an earlier version of the Sequencer can be opened and edited using Sequencer 4.5. - -**To upgrade the Sequencer on computers running Windows Vista** - -1. To uninstall previous installations of the Sequencer, open Control Panel and select **Programs and Features**. Select the older version from the list, and then click **Uninstall**. To confirm the uninstall, click **Yes** in the **Programs and Features** dialog box. - -2. After you have completed uninstalling the previous Sequencer version, install Application Virtualization Sequencer 4.5. For more information about installing Sequencer 4.5, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - -**To upgrade the Sequencer on computers running Windows XP** - -1. To uninstall previous installations of the Sequencer, open Control Panel and select **Add or Remove Programs**. Select the older version from the list, and then click **Remove**. To confirm the uninstall, click **Yes** in the **Add or Remove Programs** dialog box. - -2. After you have completed uninstalling the previous Sequencer version, install Application Virtualization Sequencer 4.5. For more information about installing Sequencer 4.5, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md b/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md deleted file mode 100644 index 07994fd06a..0000000000 --- a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: How to Upgrade the Servers and System Components -description: How to Upgrade the Servers and System Components -author: eavena -ms.assetid: 7d8374fe-5897-452e-923e-556a854b2024 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade the Servers and System Components - - -Use the following procedure to upgrade software components installed on all Application Virtualization System computers. Application Virtualization System services will be restarted automatically on each computer after it has been upgraded. - -**Note**   -- The upgrade process stops all Application Virtualization System services, thereby taking the system out of service. User sessions should be shut down before you begin the upgrade process, and you should stop all Application Virtualization Server services in your environment. - -- If you have more than one server that is sharing access to the Application Virtualization database, all those servers must be taken offline while the database is being upgraded. You should follow your normal business practices for the database upgrade, but it is highly advisable that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the other servers. - -- You can upgrade to Microsoft Application Virtualization (App-V) 4.5 only from Microsoft Application Virtualization (App-V) 4.1 or 4.1 SP1. App-V 4.0 and earlier must be uninstalled or upgraded to 4.1 or 4.1 SP1 before upgrading to App-V 4.5. - - - -**To upgrade software components on Application Virtualization System computers** - -1. Navigate to the location of the Setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click the Setup.exe file. - -2. On the **Welcome** page of the Installation Wizard, click **Next**. - -3. On the **License Agreement** page, read the license agreement, check **I accept the terms in the license agreement**, and click **Next**. - -4. When the **Installed Software** page opens and displays a list of the installed Application Virtualization System components and the version of each component, click **Next**. - -5. On the **Session Loss Warning** page, read the displayed message and click **Next**. - -6. On the **Connect to Configuration Database** page, review the content on the page and click **Next**. - -7. If the **Database Upgrade Required** page is displayed, a database upgrade is required. Enter the database administrative credentials, and then click **Next**. If this page is not displayed, skip to Step 9. - -8. On the **Backup Configuration Database** page, check the appropriate boxes to perform the backup and export it to an existing location, and then click **Next**. - - **Important**   - If you want to be able to roll back to the previous version in the event of an upgrade failure, make sure you check the **Perform a backup of the configuration database** box, or you will lose the configuration data. - - When you want to restore a database with VSS, you must first stop the App-V Server Service on the Management Server. This should be done on every Management server if there is more than one server connected to the same database. - - - -9. On the first **Package Validation** page, read the content and then click **Next**. - -10. On the second **Package Validation** page, you have the option of displaying the details of the package validation in a Notepad window. To see the details, click **Details**; otherwise, click **Next**. - -11. On the **Ready to Upgrade the Program** page, click **Next**. - -12. On the **Installation Wizard Completed** page, click **Finish**. - -13. Repeat steps 1–12 on all other computers where you installed the Application Virtualization Management Console or the Application Virtualization Server software component. - - After upgrading the data store, you can resume normal operation. (The data store is upgraded when you upgrade any server or the App-V Management Web Service.) - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md b/mdop/appv-v4/how-to-use-dynamic-suite-composition.md deleted file mode 100644 index e2c025e1fc..0000000000 --- a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -title: How To Use Dynamic Suite Composition -description: How To Use Dynamic Suite Composition -author: eavena -ms.assetid: 24147feb-a0a8-4791-a8e5-cbe5fe13c762 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How To Use Dynamic Suite Composition - - -Dynamic Suite Composition in Application Virtualization enables you to define an application as being dependent on another application, such as middleware or a plug-in. This enables the application to interact with the middleware or plug-in in the virtual environment, where typically this is prevented. This is useful because a secondary application package can be used with several other applications, referred to as the *primary applications*, which enables each primary application to reference the same secondary package. - -You can use Dynamic Suite Composition when you sequence applications that depend on plug-ins such as ActiveX controls or for applications that depend on middleware such as OLE DB or the Java Runtime Environment (JRE). If each application that used these dependent components required sequencing, including the components, updates to those components would require re-sequencing all the primary applications. If you sequence the primary applications without the components and then sequence the middleware or plug-in as a secondary package, then only the secondary package must be updated. - -One advantage of this approach is that it reduces the size of the primary packages. Another advantage is that it provides you with better control of access permissions on the secondary applications. Note that the secondary application can be streamed in the regular way and does not have to be fully cached to run. - -A primary package can have more than one secondary package. However, only one level of dependency is supported, so you cannot define a secondary package as dependent on another secondary package. Also the secondary application can only be middleware or a plug-in and cannot be another full software product. - -If you plan to make several primary applications dependent on a single middleware product, make sure that you test this configuration to determine the potential effect on system performance before you deploy it. - -**Important**   -Package dependencies can be specified as mandatory for a primary application. If a secondary package is flagged as mandatory and it cannot be accessed for some reason during loading, the load of the secondary package will fail. Also, the primary application will fail when the user tries to start it. - - - -You can use the following procedures to create a secondary package, for either a plug-in or a middleware component, and then you can use the final procedure to define the dependency in the OSD file of the secondary package. - -**To create a secondary package for a plug-in by using Dynamic Suite Composition** - -1. On a sequencing computer that is set up with a clean image, install Application Virtualization Sequencer and save the computer state. - -2. Sequence the primary application, and save the package to the Content folder on the server. - -3. Restore the sequencing computer to its saved state from step 1. - -4. Install and configure the primary application locally on the sequencing computer. - - **Important**   - You must specify a new package root for the secondary package. - - - -5. Start the sequencer monitoring phase. - -6. Install the plug-in on the sequencing computer and configure it as needed. - -7. Open the primary application, and confirm that the plug-in is working correctly. - -8. In the sequencer console, create a dummy application to represent the secondary package that will contain the plug-in and select an icon. - -9. Save the package to the Content folder on the server. - - **Note**   - To assist with management of secondary packages, it is recommended that the package name include the term “Secondary package” to emphasize that this is a package that will not function as a stand-alone application—for example, **\[Plug In Name\] Secondary package**. - - - -**To create a secondary package for middleware by using Dynamic Suite Composition** - -1. On a sequencing computer that is set up with a clean image, install Application Virtualization Sequencer and save the computer state. - -2. Install the middleware locally on the sequencing computer, and configure it. - -3. Sequence the primary application, and save the package to the Content folder on the server. - -4. Restore the sequencing computer to its saved state from step 1. - -5. Start the sequencer to create a new package. - -6. Start the sequencer monitoring phase. - -7. Install the middleware application on the sequencing computer, and configure it as in a typical installation. - -8. Complete the sequencing process. - -9. Save the package to the Content folder on the server. - - **Note**   - To assist with management of secondary packages, it is recommended that the package name include the term “Secondary package” to emphasize that this is a package that will not function as a stand-alone application—for example, **\[Middleware Name\] Secondary package**. - - - -**To define the dependency in the primary package** - -1. On the server, open the OSD file of the secondary package for editing. (It is a good idea to use an XML editor to make changes to the OSD file; however, you can use Notepad as an alternative.) - -2. Copy the **CODEBASE HREF** line from that file. - -3. Open the OSD file of the primary package for editing. - -4. Insert the <DEPENDENCIES>tag after the close of **</ENVLIST>** tag at the end of the **<VIRTUALENV>** section just before the **</VIRTUALENV>** tag. - -5. Paste the **CODEBASE HREF** line from the secondary package after the **<DEPENDENCIES>** tag you just created. - -6. If the secondary package is a mandatory package, which means that it must be started before the primary package is started, add the **MANDATORY=”TRUE”** property inside the **CODEBASE** tag. If it is not mandatory, the property can be omitted. - -7. Close the **<DEPENDENCIES>** tag by inserting the following: - - **</DEPENDENCIES>** - -8. Review the changes that you made to the OSD file, and then save and close the file. The following example shows how the added section should appear. The tag values shown here are for example only. - - **<VIRTUALENV>** - - **<ENVLIST>** - - **…** - - **</ENVLIST>** - - **<DEPENDENCIES>** - - **<CODEBASE HREF="rtsp://virt\_apps/package.1/package.1.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.1\\osguard.cp"/>** - - **<CODEBASE HREF="rtsp://sample\_apps/package.2/sample.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.2\\osguard.cp" MANDATORY="TRUE" />** - - **</DEPENDENCIES>** - - **</VIRTUALENV>** - -9. If the secondary package has any entries in the **<ENVLIST>** section of the OSD file, you must copy those entries to the same section in the primary package. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md b/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md deleted file mode 100644 index c449a2a051..0000000000 --- a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Use the Cache Space Management Feature -description: How to Use the Cache Space Management Feature -author: eavena -ms.assetid: 60965660-c015-46a8-88ac-54cbc050fe33 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Cache Space Management Feature - - -The FileSystem cache space management feature uses a Least Recently Used (LRU) algorithm and is enabled by default. If the space that is required for a new package would exceed the available free space in the cache, the Application Virtualization (App-V) Client uses this feature to determine which, if any, existing packages it can delete from the cache to make room for the new package. The client deletes the package with the oldest last-accessed date if it is older than the value specified in the MinPkgAge registry value. Use of the FileSystem cache space management feature can also help to avoid low cache space problems. - -More than one package is deleted if necessary. Packages that are locked are not deleted. - -**Note**   -To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. - - - -The cache space management feature is controlled by the UnloadLeastRecentlyUsed registry value. A value of 1 enables the feature, and a value of 0 (zero) disables it. - -**To enable or disable the cache space management feature** - -- Set the following registry value to 1 to enable the LRU algorithm. Set it to 0 (zero) to disable the feature. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\UnloadLeastRecentlyUsed - -**To control which packages can be discarded** - -- To determine when the package can be selected for discard, set the following registry value to equal the minimum number of days you want to elapse since the package was last accessed. Packages that have been used more recently are not discarded. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\MinPkgAge - - **Caution**   - The maximum value for this registry key is 0x00011111. Larger values will prevent the correct operation of the cache space management feature. - - - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md b/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md deleted file mode 100644 index ec96967913..0000000000 --- a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Use the Desktop Notification Area for Application Virtualization Client Management -description: How to Use the Desktop Notification Area for Application Virtualization Client Management -author: eavena -ms.assetid: 75b2e636-7669-4e1e-8368-8b9fca567a84 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Desktop Notification Area for Application Virtualization Client Management - - -The notification area is a standard Windows feature that, by default, appears in the lower-right corner of the desktop. You can exercise some Application Virtualization Client functionality from the notification area without starting the Application Virtualization Client Management Console. - -## In This Section - - -[How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) -Provides a simple procedure you can use to refresh the list of virtualized applications authorized for the client. - -[How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md) -Provides procedures for loading virtualized applications into the cache. - -[How to Cancel Loading of Virtual Applications from the Desktop Notification Area](how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md) -Provides procedures for cancelling the loading of virtual applications. - -[How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) -Provides procedures you can use to toggle between offline and online operation. - -[How to Exit the App-V Client from the Notification Area](how-to-exit-the-app-v-client-from-the-notification-area.md) -Provides a simple procedure you can use to exit the application from the desktop notification area. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-use-the-differential-sft-file.md b/mdop/appv-v4/how-to-use-the-differential-sft-file.md deleted file mode 100644 index 76fe2dc754..0000000000 --- a/mdop/appv-v4/how-to-use-the-differential-sft-file.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Use the Differential SFT File -description: How to Use the Differential SFT File -author: eavena -ms.assetid: 607e30fd-2f0e-4e2f-b669-0b3f010aebb0 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Use the Differential SFT File - - -When sequencing an application, the Microsoft Application Virtualization (App-V) Sequencer creates SFT files (.sft) to store all of the virtual application’s files content and configuration information. In version 4.5 of App-V, the Differential SFT (.dsft) file has been introduced. After using the Sequencer to create an upgrade for an existing package, you can choose to generate this file to store only the differences between the original sequenced application package and the new version. It is therefore much smaller than the full SFT file would be for the new version of the application and reduces the impact of sending package updates over low-bandwidth network connections. However, its use is supported only in certain restricted situations. This feature was intended to be used specifically where you are using an electronic software distribution (ESD) system to manage a group of users with a local file server over a low-bandwidth connection and you are not using App-V streaming servers. - -You do not need to use the Differential SFT file if you are using Configuration Manager 2007 to manage the users, because Configuration Manager has support for low-bandwidth deployments already built in. It is also not required if you are using Application Virtualization (App-V) Management or Streaming Servers with Active Upgrade because the client will retrieve only the differences between the old and new package versions. - -The following procedure shows how to use the mkdiffpkg.exe that is included in the Sequencer installation to create the Differential SFT file, after completing the upgrade of the virtual application package, and to deploy the Differential SFT file. Completing this procedure helps ensure that if the package is somehow unloaded from the client computer, the next time the user tries to run the application, the client will fall back to the override URL, which is set to stream the full package V2.sft from the local file share. This will avoid any failure for the user when starting the application. If the entire client becomes corrupted or is uninstalled, it is recommended that the ESD system be configured to deploy the full version of the upgraded package, V2.sft, to the client. - -For more information about upgrading a package, see “How to Upgrade an Existing Virtual Application” in the App-V 4.5 Operations Guide at - -**Note**   -As a prerequisite, all user computers being targeted by the ESD must have the V1.sft file fully loaded into their local cache, and file streaming must be enabled on all computers. - - - -**To use the Differential SFT file** - -1. Log on to the Sequencer computer by using an account with administrator rights. Open the original package (V1) for upgrade in the Sequencer, and then upgrade the package to the new version (V2) and save it as a new V2.sft. - -2. Open a command window in the App-V 4.5 Sequencer installation folder, and run the following command: - - `“mkdiffpkg.exe V2.sft V2.dsft”` - -3. Using the ESD system or other file copy process, copy the full V2 package content file, V2.sft, to a local file share that is accessible to the user computers on a well-connected network connection. - -4. Using the ESD system, place a copy of the Differential SFT file, V2.dsft, on each user computer. - -5. To import the V2.dsft file, run the following SFTMIME command on each user computer: - - `“SFTMIME load package: /SFTPATH ”` - -6. Run the following SFTMIME command on each user computer to set the override URL to point to the V2.sft file: - - `“SFTMIME configure package: /OverrideURL FILE://”` - -**Note**   -- Differential SFT files must be applied to clients in the correct order. For example, V2.dsft must be applied to a V1 application before V3.dsft is applied. - -- The **Generate Microsoft Windows Installer (MSI) Package** capability in the Sequencer cannot be used with the Differential SFT file. - - - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md b/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md deleted file mode 100644 index 99672dfe57..0000000000 --- a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Work Offline or Online with Application Virtualization -description: How to Work Offline or Online with Application Virtualization -author: eavena -ms.assetid: aa532b37-8a00-4db4-9b51-e1e8354b2495 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Work Offline or Online with Application Virtualization - - -If you plan to be disconnected from the network for an extended period of time, you can work in offline mode to eliminate possible delays when the Application Virtualization client attempts to communicate with the server. In offline mode, the Application Virtualization client will not attempt to communicate with the publishing server, so applications must be fully cached before enabling offline mode. Applications will not be retrieved from the content share even if they are on the local disk on the computer. You can use the following Application Virtualization Client procedure to toggle between working offline and online. - -**Note**   -By default, **Work Offline** is disabled for the Client for Remote Desktop Services (formerly Terminal Services). Your system administrator must change your user permissions to allow you to use this setting on a Client for Remote Desktop Services. - - - -**To work offline** - -- Right-click the Application Virtualization System icon in the notification area, and select **Work Offline** from the pop-up menu. - -**To work online** - -- Right-click the Application Virtualization System icon in the notification area, and select **Work Online** from the pop-up menu. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - - - - - - - - - diff --git a/mdop/appv-v4/i b/mdop/appv-v4/i deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/mdop/appv-v4/images/appvbranchoffices.gif b/mdop/appv-v4/images/appvbranchoffices.gif deleted file mode 100644 index 57ece467d2..0000000000 Binary files a/mdop/appv-v4/images/appvbranchoffices.gif and /dev/null differ diff --git a/mdop/appv-v4/images/appvfirewalls.gif b/mdop/appv-v4/images/appvfirewalls.gif deleted file mode 100644 index e72ffc5c0f..0000000000 Binary files a/mdop/appv-v4/images/appvfirewalls.gif and /dev/null differ diff --git a/mdop/appv-v4/images/appvmgmtwebservice.gif b/mdop/appv-v4/images/appvmgmtwebservice.gif deleted file mode 100644 index 303643d098..0000000000 Binary files a/mdop/appv-v4/images/appvmgmtwebservice.gif and /dev/null differ diff --git a/mdop/appv-v4/images/appvperimeternetworkfirewall.gif b/mdop/appv-v4/images/appvperimeternetworkfirewall.gif deleted file mode 100644 index b4f5a8d453..0000000000 Binary files a/mdop/appv-v4/images/appvperimeternetworkfirewall.gif and /dev/null differ diff --git a/mdop/appv-v4/improving-security-during-app-v-sequencing.md b/mdop/appv-v4/improving-security-during-app-v-sequencing.md deleted file mode 100644 index 36abc689dd..0000000000 --- a/mdop/appv-v4/improving-security-during-app-v-sequencing.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Improving Security During App-V Sequencing -description: Improving Security During App-V Sequencing -author: eavena -ms.assetid: f30206dd-5749-4a27-bbaf-61fc21b9c663 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Improving Security During App-V Sequencing - - -Packaging applications for sequencing is the largest ongoing task in an App-V infrastructure. Because this task is ongoing, you should carefully consider creating policies and procedures to follow when sequencing applications. In App-V 4.5, during sequencing, you can capture Access Control Lists (ACLs) on the file assets of the virtualized application. - -## Virus Scanning on the Sequencer - - -It is a best practice to install the scanning software on the sequencing computer and then scan the computer for viruses and malware. After the sequencing computer is scanned and free of any viruses or malware, disable the scanning software, including all antivirus and malware detection software, on the sequencing computer before sequencing any applications. This speeds the sequencing process and prevents the scanning software components from being detected during sequencing and included in the virtual application package. - -## Capturing ACLs on Files (NTFS) - - -The Sequencer captures NTFS permissions (the ACLs) for the files that are monitored during the sequencing installation phase. (Before the release of App-V 4.5, ACLs were not captured as part of the sequencing process.) This new feature enables certain applications to run for users with a low level of permission that would normally require Administrative privileges. - -This feature also enables the sequencing engineer to capture the security settings identified by the vendor. Failing to apply the settings recommended by the vendor could leave the application open to attack or misuse by users. For information about whether or not you should deploy an application with open ACLs, refer to your application support group or the software vendor. - -**Important**   -Although the sequencer captures the NTFS ACLs while monitoring the installation phase of sequencing, it does not capture the ACLs for the registry. Users have full access to all registry keys for virtual applications except for services. However, if a user modifies the registry of a virtual application, that change is stored in a specific location (`uservol_sftfs_v1.pkg`) and won’t affect other users. - - - -During the installation phase, a sequencing engineer can modify the default permissions of the files if necessary. After the sequencing process is complete, but before saving the package, the sequencing engineer can then choose to enforce security descriptors that were captured during the installation phase. It is a best practice to enforce security descriptors if no other solution allows the application to run properly once virtualized. - - - - - - - - - diff --git a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index b621af0ea0..0000000000 --- a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Incompatible Installer Dialog Box (App-V 4.6 SP1) -description: Incompatible Installer Dialog Box (App-V 4.6 SP1) -author: eavena -ms.assetid: 45d465b1-ee49-4274-8234-71dd031a07b6 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Incompatible Installer Dialog Box (App-V 4.6 SP1) - - -The application did not install correctly. - -Use the following procedure to verify that the application you are trying to sequence is compatible with the computer running the sequencer. - -1. Close the App-V Sequencer. - -2. Install the application on the computer running the Sequencer without monitoring the installation. - -3. Verify that the application is compatible and can be installed successfully. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/index.md b/mdop/appv-v4/index.md deleted file mode 100644 index 02747f94e3..0000000000 --- a/mdop/appv-v4/index.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Application Virtualization 4 -description: Application Virtualization 4 -author: dansimp -ms.assetid: 9da557bc-f433-47d3-8af7-68ec4ff9bd3f -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization 4 - - -Microsoft Application Virtualization provides the administrative capability to make applications available to end user computers without having to install the applications directly on those computers. - -## Technical Documentation - - -The technical documentation for Application Virtualization in the TechNet Library contains the following sections: - -- [Microsoft Application Virtualization Getting Started Guide](microsoft-application-virtualization-getting-started-guide.md) - -- [Planning and Deployment Guide for the Application Virtualization System](planning-and-deployment-guide-for-the-application-virtualization-system.md) - -- [Operations Guide for the Application Virtualization System](operations-guide-for-the-application-virtualization-system.md) - -- [Online Help for Application Virtualization](online-help-for-application-virtualization.md) - -- [Application Virtualization Glossary](application-virtualization-glossary.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/installation-files-page.md b/mdop/appv-v4/installation-files-page.md deleted file mode 100644 index e27b8a8203..0000000000 --- a/mdop/appv-v4/installation-files-page.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Installation Files Page -description: Installation Files Page -author: eavena -ms.assetid: b0aad26f-b143-4f09-87a1-9f016a23cb62 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation Files Page - - -Use the **Installation Files** page to specify the installation files that were used to create the virtual application package specified on the **Select Package** page of this wizard. If you created a virtual application package that contains multiple applications, you should copy all required installation files to a single folder on the computer running the Microsoft Application Virtualization Sequencer. - -This page contains the following elements: - -**Original Installation Files** -Click **Browse** to specify the installation files that were originally used to create the virtual application package. The parent directory you specify should be saved locally to the computer running the Sequencer and must contain all required installation files or subfolders that contain the installation files. The installation files can be contained in the parent folder or in any of the subfolders of the specified parent folder. - -**Files installed on local system** -Click **Browse** to specify the installation files that have been installed locally on the computer running the Sequencer. You can only select this option if the application installation files have been installed to the application’s default location. - -**Note**   -The default installation location you provide depends on the following conditions: - - - -- The package root specified when the package was originally created. - -- The installation location specified in the Windows Installer when the package was originally created. - -- The default application installation path. - -For example, if the package root specified is **Q:\\Office12** and during installation, the default installation location is changed from **C:\\Program Files\\Office12** to **Q:\\Office12**, then the path specified during dehydration must be **C:\\Program Files\\Office 12**. - -If the package root specified is **Q:\\Microsoft** and during installation, the default installation location is changed from **C:\\Program Files\\Office12** to **Q:\\Microsoft\\Office12**, then the path specified during dehydration must be **C:\\Program Files**. - -When you create a package using a package accelerator, each file in the package, for example **Q:\\Office12\\file.txt** is found on the local computer by replacing the package root **Q:\\Office12** with the default location specified when the Package Accelerator was created, for example, **C:\\Program Files\\Office12**. In the previous example, the file should be located in **C:\\Program Files\\Office12\\file.txt**. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/installation-page--learn-more-.md b/mdop/appv-v4/installation-page--learn-more-.md deleted file mode 100644 index decc1b459b..0000000000 --- a/mdop/appv-v4/installation-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Installation Page (Learn More) -description: Installation Page (Learn More) -author: eavena -ms.assetid: a53b8330-dfc3-4540-b147-7c10529f403a -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation Page (Learn More) - - -Use the **Installation** page to run additional installation files that are required to complete the application installation. - -This page contains the following elements: - -**Run** -Opens the **Select installation file** dialog box. Specify the location of the additional installation files, Windows Installer and executable program files, and then click **Open**. - -**I am finished installing** -Enables the **Next** button. Select this option if no additional installation files are associated with this application. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/installation-report-page--learn-more-.md b/mdop/appv-v4/installation-report-page--learn-more-.md deleted file mode 100644 index 4dc8d9afc6..0000000000 --- a/mdop/appv-v4/installation-report-page--learn-more-.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Installation Report Page (Learn More) -description: Installation Report Page (Learn More) -author: eavena -ms.assetid: 499cf4db-a39c-4dcf-b1cf-85fd7da11701 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation Report Page (Learn More) - - -Use the **Installation Report** page to review the results of the sequencing process. These reports can help diagnose common problems that can occur during sequencing. - -This page contains the following elements: - -**Information Pane** -Displays problems and additional information about the overall sequencing process. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md b/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md deleted file mode 100644 index 9770276fd5..0000000000 --- a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Installing App-V Management Server or Streaming Server Securely -description: Installing App-V Management Server or Streaming Server Securely -author: eavena -ms.assetid: d2a51a81-a80f-427c-a727-611e1eb74f02 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Installing App-V Management Server or Streaming Server Securely - - -The topics in this section provide information for installing an enhanced security version of the App-V Management Server or the App-V Streaming Server. - -**Note**   -Installing or configuring an App-V Management or Streaming Server to use enhanced security (for example, Transport Layer Security, or TLS) requires that an X.509 V3 certificate has been provisioned to the App-V server. - - - -When you prepare to install or configure a secure Management or Streaming Server, consider the following technical requirements: - -- The certificate must be valid. If the certificate is not valid, the client ends the connection. - -- The certificate must contain the correct *Enhanced Key Usage* (EKU)—Server Authentication (OID 1.3.6.1.5.5.7.3.1). If the certificate does not contain this EKU, the client ends the connection. - -- The certificate fully qualified domain name (FQDN) must match the server on which it is installed. For example, if the client is calling `RTSPS://Myserver.mycompany.com/content/MyApp.sft` and the certificate **Issued To** field is set to `Server1.mycompany.com`, the client will not connect to the server and the session ends. The failure is reported to the user. - - **Note**   - If you are using App-V in a Network Load Balancing cluster, you must configure the certificate with Subject Alternate Names (SANs) to support RTSPS. For information about configuring the certification authority (CA) and creating certificates with SANs, see . - - - -- The client and the server need to trust the root CA—The CA issuing the certificate to the App-V server must by trusted by the client connecting to the server. If not, the client ends the connection. - -- The certificate’s private key must have permissions changed to allow the App-V Service account to access the certificate. By default, App-V uses the Network Service account, and by default, the Network Service account does not have permission to access the private key, which will prevent secure connections. - -## In This Section - - -[Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) -Provides information about obtaining, configuring, and installing certificates to support secure streaming. - -[How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) -Provides procedures you can use to modify keys in Windows Server 2003 and Windows Server 2008. - -[Configuring Certificates to Support App-V Management Server or Streaming Server](configuring-certificates-to-support-app-v-management-server-or-streaming-server.md) -Provides information about configuring certificates for the App-V Management or Streaming Servers, including information about configuring certificates for Network Load Balancing environments. - - - - - - - - - diff --git a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md b/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md deleted file mode 100644 index f1e423b957..0000000000 --- a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Internet-Facing Considerations for App-V Clients -description: Internet-Facing Considerations for App-V Clients -author: eavena -ms.assetid: 261acde3-7112-492e-8b11-934ae45adc5f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Internet-Facing Considerations for App-V Clients - - -The topics in this section includes information about Internet-facing configurations for domain-joined and non-domain joined clients, as well as procedures you can use to assign the proper credentials to your App-V Desktop Clients. - -## In This Section - - -[Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) -Provides general information about configuring domain-joined or non-domain-joined clients for successful network access. - -[How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) -Provides a step-by-step procedure for assigning credentials on an App-V Desktop Client running Windows XP. - -[How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) -Provides a step-by-step procedure for assigning credentials on an App-V Desktop Client running Windows Vista. - -  - -  - - - - - diff --git a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md b/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md deleted file mode 100644 index 7ed378d7f0..0000000000 --- a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Internet-Facing Server Scenarios for Perimeter Networks -description: Internet-Facing Server Scenarios for Perimeter Networks -author: eavena -ms.assetid: 8a4da6e6-82c7-49e5-b9b1-1666cba02f65 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Internet-Facing Server Scenarios for Perimeter Networks - - -App-V 4.5 supports Internet-facing server scenarios, in which users who are not connected to the corporate network or who disconnect from the network can still use App-V. As shown in the following illustration, only the use of secure protocols on the Internet (RTSPS and HTTPS) is supported. - -![app-v firewall positioning diagram](images/appvfirewalls.gif) - -You can set up an Internet-facing solution, using an ISA Server, where the App-V infrastructure is on the internal network in the following ways: - -- Create a Web Publishing rule for the IIS server that is hosting the ICO and OSD files—and optionally, the packages for streaming—located on the internal network. Detailed steps are provided at . - -- Create a Server Publishing rule for the App-V Web Management Server (RTSPS). Detailed steps are provided at [https://go.microsoft.com/fwlink/?LinkId=151983&](https://go.microsoft.com/fwlink/?LinkId=151983). - -As shown in the following illustration, if the infrastructure has implemented other firewalls between the client and the ISA Server or between the ISA Server and the internal network, both RTSPS (TCP 322) and HTTPS (TCP 443) firewall rules must be created to support the flow of traffic. Also, if firewalls have been implemented between the ISA Server and the internal network, the default traffic required for domain members must be permitted to tunnel through the firewall (DNS, LDAP, Kerberos, SMB/CIFS). - -![app-v perimeter network firewall diagram](images/appvperimeternetworkfirewall.gif) - -Because the firewall solutions vary from environment to environment, the guidance provided in this topic describes the traffic that would be required to configure an Internet-facing App-V environment in the perimeter network. This information also includes the recommended internal network servers. - -Place the following servers in the perimeter network: - -- App-V Management Server - -- IIS server for publishing and streaming - -**Note**   -It is a best practice to place the Management Server and IIS server on separate computers. - - - -Place the following servers in the internal network: - -- Content server - -- Data store (SQL Server) - -- Active Directory Domain Controller - -## Traffic Requirements - - -The following tables list the traffic requirements for communication from the Internet and the perimeter network and from the perimeter network to the internal network. - - ---- - - - - - - - - - - - - - - - - -
          Traffic Requirements from Internet to Perimeter NetworkDetails

          RTSPS (publishing refresh and streaming packages)

          TCP 322 by default; this can be changed in App-V Management Server.

          HTTPS (publishing ICO and OSD files and streaming packages)

          TCP 443 by default; this can be changed in the IIS configuration.

          - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Traffic Requirements from Perimeter Network to Internal NetworkDetails

          SQL Server

          TCP 1433 is the default but can be configured in SQL Server.

          SMB/CIFS

          If the content directory is located remotely from the Management Server(s) or IIS server (recommended).

          Kerberos

          TCP and UDP 88

          LDAP

          TCP and UDP 389

          DNS

          For name resolution of internal resources (can be eliminated with the use of host’s file on perimeter network servers)

          - - - - - - - - - - - diff --git a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md b/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md deleted file mode 100644 index 5e5e2a17d9..0000000000 --- a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: Introduction to the Application Virtualization Security Guide -description: Introduction to the Application Virtualization Security Guide -author: eavena -ms.assetid: 50e1d220-7a95-45b8-933b-3dadddebe26f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Introduction to the Application Virtualization Security Guide - - -This Microsoft Application Virtualization (App-V) security guide provides instructions for administrators who are responsible for configuring the security features that were selected for the App-V deployment. - -**Note**   -This documentation does not provide guidance for choosing the specific security options. That information is provided in the App-V Security Best Practices white paper available at . - - - -As an App-V administrator using this guide, you should be familiar with the following security-related technologies: - -- Active Directory Domain Services - -- Public key infrastructure (PKI) - -- Internet Protocol Security (IPsec) - -- Group Policies - -- Internet Information Services (IIS) - -## APP-V Infrastructure Components - - -When planning an enhanced security App-V environment, you can consider several different infrastructure models. - -**Note**   -For more information about App-V infrastructure models, see the following documentation: - -- [App-V Planning and Deployment Guide](https://go.microsoft.com/fwlink/?LinkId=122063) - -- [Infrastructure Planning and Design Guide Series](https://go.microsoft.com/fwlink/?LinkId=151986) - - - -These models utilize some but possibly not all of the App-V components depicted in the following illustration. - -![app-v branch office diagram](images/appvbranchoffices.gif) - -Application Virtualization (App-V) Management Server -The App-V Management Server streams the package content and publishes the shortcuts and file-type associations to the App-V Client. The App-V Management Server also supports active upgrade, license management, and a database that can be used for reporting. - -Application Virtualization (App-V) Streaming Server -The App-V Streaming Server hosts the packages for streaming to App-V Clients in environments such as branch offices, where the bandwidth of the connection to the App-V Management Server is insufficient for streaming package content to clients. The Streaming Server contains only streaming functionality and does not provide you with the App-V Management Console or the App-V Management Web Service. - -Application Virtualization (App-V) Data Store -The App-V data store, in the SQL database, retains information related to the App-V infrastructure. The information in the App-V data store includes all application records, application assignments, and which groups manage the Application Virtualization environment. - -Application Virtualization (App-V) Management Service -The App-V Management Service communicates read/write requests to the Application Virtualization data store. This component can be installed on the same computer as the App-V Management Server or on a separate computer with IIS installed. - -Application Virtualization (App-V) Management Console -The App-V Management Console is a snap-in management utility for App-V Server administration. This component can be installed on the same computer as the App-V Server or on a separate workstation that has MMC 3.0 and .NET 2.0 installed. - -Application Virtualization (App-V) Sequencer -The App-V Sequencer monitors and captures the installation of applications and creates virtual application packages. The output of the Sequencer consists of the application icon, the OSD file containing application definition information, a package manifest file, and an SFT file containing the application’s content files. Optionally, a Windows Installer file can be created for installing the package without using the App-V infrastructure. - -Application Virtualization (App-V) Client -The App-V Client is installed on the App-V Desktop Client computer or on the App-V Terminal Services Client computer. It provides the virtual environment for the virtual application packages. The App-V Client manages the package streaming to the cache, virtual application publishing refresh, and interaction with the Application Virtualization Servers. - - - - - - - - - diff --git a/mdop/appv-v4/load-app.md b/mdop/appv-v4/load-app.md deleted file mode 100644 index ec44358bc7..0000000000 --- a/mdop/appv-v4/load-app.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: LOAD APP -description: LOAD APP -author: eavena -ms.assetid: 7b727d0c-5423-419d-92ef-7ebbc6343e79 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# LOAD APP - - -Loads the specified application and all other applications in the package into the file system cache. - -**Note**   -The **LOAD APP** command starts the load process and a progress bar is displayed in the Desktop Notification Area. The command exits immediately after starting this process, so any load errors are displayed in the same location. Use the **LOAD PACKAGE** command if you want to start the load process from the command line without using the Desktop Notification Area. - - - -`SFTMIME LOAD APP:application [/LOG log-pathname | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application to load.

          /LOG

          If specified, output is logged to the specified path name.

          /GUI

          If specified, output is presented in a Windows dialog box.

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/load-package.md b/mdop/appv-v4/load-package.md deleted file mode 100644 index 2de2fe1aa4..0000000000 --- a/mdop/appv-v4/load-package.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: LOAD PACKAGE -description: LOAD PACKAGE -author: eavena -ms.assetid: eb19116d-e5d0-445c-b2f0-3116a09384d7 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# LOAD PACKAGE - - -Loads the specified package into the file system cache. - -`SFTMIME LOAD PACKAGE:package-name [/SFTPATH sft-pathname] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          PACKAGE:<package-name>

          The name of the package to load.

          /SFTPATH <sft-pathname>

          If specified, the path to an SFT file to load from.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -**Note**   -If no SFTPATH is specified, the client will load the package by using the path it has been configured to use, based on the OSD file, the ApplicationSourceRoot registry key value, or the OverrideURL setting. - -The **LOAD PACKAGE** command performs a synchronous load and will not be complete until the package is fully loaded or until it encounters an error condition. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/lock-app.md b/mdop/appv-v4/lock-app.md deleted file mode 100644 index c6e0e0a6eb..0000000000 --- a/mdop/appv-v4/lock-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: LOCK APP -description: LOCK APP -author: eavena -ms.assetid: 30673433-4364-499f-8116-cb135fe2716f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# LOCK APP - - -Locks the application specified in the file system cache. - -`SFTMIME LOCK APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application to lock.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md b/mdop/appv-v4/log-file-for-the-application-virtualization-client.md deleted file mode 100644 index ca3662f546..0000000000 --- a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Log File for the Application Virtualization Client -description: Log File for the Application Virtualization Client -author: eavena -ms.assetid: ac4b3e4a-a220-4c06-bd60-af7dc318b3a9 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Log File for the Application Virtualization Client - - -The log file for the Application Virtualization (App-V) Client captures detailed information about operations and error conditions. You can use it when you are verifying functionality and when you are troubleshooting issues. - -When the App-V Client is first installed, the log file is created by default in the location shown in the following table. The location of the log file is new for Application Virtualization (App-V) 4.5, although the location will not be changed if the client is upgraded from an earlier version. - - ---- - - - - - - - - - - - - -
          Log File NameDescription

          sftlog.txt

          Provides general information about App-V Client operations and errors. Use this log as a starting point for troubleshooting App-V Client errors.

          -

          Log file location for either the Desktop Client or the Client for Remote Desktop Services (formerly Terminal Services):

          -
            -
          • C:\Documents and Settings\All Users\Application Data\Microsoft\Application Virtualization Client: Windows XP, Windows Server 2003

          • -
          • C:\ProgramData\Microsoft\Application Virtualization Client: Windows Vista, Windows Server 2008

          • -
          - -  - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md deleted file mode 100644 index ba4748b2d7..0000000000 --- a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Log Files for the Application Virtualization Sequencer -description: Log Files for the Application Virtualization Sequencer -author: eavena -ms.assetid: 1a296544-eab4-46f9-82ce-3136f8b578af -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Log Files for the Application Virtualization Sequencer - - -The log files for the Application Virtualization (App-V) Sequencer provide detailed information about sequencing applications, and they can be helpful when you are verifying functionality or when you are troubleshooting issues. - -The following table provides information about the log files and their default locations, which are created when using the Sequencer. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Log File NameDescription

          sft-seq-log.txt

          Provides general information about sequencing an application. Use this log as a starting point for troubleshooting Sequencer errors.

          -

          Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs

          -

          [Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value]

          sftbt.txt

          Provides information about computer restart tasks that occur during the Sequencer’s simulated restart.

          -

          Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs

          -

          [Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value]

          SftCallBack.txt

          Provides general information about processes used during sequencing.

          -

          Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs

          -

          [Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value]

          - -  - -## Related topics - - -[Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md deleted file mode 100644 index b631d97a83..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement -description: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement -author: eavena -ms.assetid: e82c57ea-885d-4761-96db-4d80b1c3e1ae -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Application Virtualization, 4.6 Service Pack 1 (“App-V”).  Specifically, the privacy statement describes the features in Service Pack 1 that send information to others, including Microsoft. It does not apply to other online or offline Microsoft sites, products, or services. - -App-V transforms applications into virtualized, network-available services resulting in dynamic delivery of software that is never installed, does not conflict, and minimizes costly application compatibility testing. Users and their application environments are no longer machine-specific, and the machines themselves are no longer user-specific, enabling IT to be flexible and responsive to business needs, and significantly reducing the cost of PC management, including application and operating system (OS) migrations. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized.  It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements.  Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft App-V may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well.  - -The privacy details for each App-V feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us at: - -Microsoft Privacy - -Microsoft Corporation - -One Microsoft Way - -Redmond, Washington 98052 USA - -## Specific features - - -The remainder of this document will address the following specific features: - -## Customer Experience Improvement Program - - -### What This Feature Does: - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services.  We will not collect your name, address, or other contact information. - -### Information Collected, Processed, or Transmitted: - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -### Use of Information: - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -### Choice/Control: - -You are offered the opportunity to participate in CEIP during setup. If you choose to participate and later change your mind, you can turn off CEIP at any time by: - -1. Select “Help” on the main toolbar. - -2. Select “Customer Feedback Options”. - -## Microsoft Error Reporting - - -### What This Feature Does: - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with App-V to Microsoft and to receive information that may help you avoid or solve such problems. - -### Information Collected, Processed, or Transmitted: - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . - -### Use of Information: - -We use the error reporting data to solve customer problems and improve our software and services. - -### Important Information: - -App-V does not change your Microsoft Error Reporting settings. If you previously turned on error reporting, it will send the information described above. Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at [https://go.microsoft.com/fwlink/?LinkId=35776](https://go.microsoft.com/fwlink/?LinkID=35776). - -## Application Package Accelerators - - -### What This Feature Does: - -Customers can use Application Package Accelerators to automatically package complex applications without installing the application. The App-V sequencer allows you to create package accelerators for each virtual package. You can then use these package accelerators to automatically re-create the same virtual package in the future. You may also use package accelerators released by Microsoft or other third parties to simplify and automate packaging of complex applications. - -### Information Collected, Processed, or Transmitted: - -Application Package Accelerators may contain information such as computer names, user account information, and information about applications included in the Package Accelerator file. - -If you plan to share Application Package Accelerators with anyone outside your organization you should review all the settings and ensure the Package Accelerators do not contain any personal or company information. You can view the contents by opening the Package Accelerator files using any XML viewer. The following are ways you can view and remove any computer or user information from the Package Accelerator files before sharing with anyone outside your company: - -- **Username** - When you log on to the computer running the App-V sequencer you should use a generic user account, such as **administrator**. You should not use an account that is based on an existing username. - -- **Computer Name**– Specify a general, non-identifying name for the computer that is running the App-V Sequencer. - -- **Server URL**– Use the default settings for the server URL configuration information on the **Deployment** tab in the App-V Sequencer console. - -- **Applications** – If you do not want to share the list of applications that were installed on the computer running the sequencer when you created the Package Accelerator you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -No information is sent to Microsoft through customers’ use of the Application Package Accelerator feature. - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md deleted file mode 100644 index feb3688ed5..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md +++ /dev/null @@ -1,227 +0,0 @@ ---- -title: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement -description: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement -author: eavena -ms.assetid: 4ee569b2-7711-475a-9f17-70247f00b1b7 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Application Virtualization (App-V). Specifically, the privacy statement describes the features that send information to others, including Microsoft. It does not apply to other online or offline Microsoft sites, products, or services. - -App-V transforms applications into virtualized, network-available services resulting in dynamic delivery of software that is never installed, does not conflict, and minimizes costly application compatibility testing. Users and their application environments are no longer machine-specific, and the machines themselves are no longer user-specific, enabling IT to be flexible and responsive to business needs, and significantly reducing the cost of PC management, including application and operating system (OS) migrations. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by App-V may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -Because this is a pre-release version of the software, some of these Internet-enabled features are turned on by default so that we can collect enough information about how the software is working in order to improve the commercially released software. The default settings in this pre-release software do not necessarily reflect how these features will be configured in the commercially released software. - -The privacy details for each App-V feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us at . - -## Specific features - - -The remainder of this document will address the following specific features: - -**Note**   -This section is divided into two parts: (1) features in all versions of App-V and (2) features in App-V 4.6 SP1 and later. - - - -### Microsoft Error Reporting - -**What This Feature Does:** - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with App-V to Microsoft and to receive information that may help you avoid or solve such problems. - -**Information Collected, Processed, or Transmitted:** - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . - -**Use of Information:** - -We use the error reporting data to solve customer problems and improve our software and services. - -**Choice/Control:** - -App-V does not change your Microsoft Error Reporting settings. If you previously turned on error reporting, it will send Microsoft the information about the errors you encountered. When Microsoft needs additional data to analyze the problem, you will be prompted to review the data and choose whether or not to send it.  App-V will always respect your Microsoft Error Reporting settings. - -**Important Information:** - -Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at . - -### Microsoft Update - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software, including App-V.  For details about what information is collected, how it is used and how to change your settings, see the Update Services Privacy Statement at . - -**Choice/Control:** - -If Microsoft Update is not enabled, you can opt-in during setup and subsequent checks for updates will follow the machine-wide schedule. You can update this option from the Microsoft Update Control Panel item. - -### Collection/Transmission of Configuration Data - -**What This Feature Does:** - -The product will collect various configuration items, including UserID, MachineID and SecurityGroup details, to be able to enforce settings on managed nodes. The data is stored in the App-V SQL database and transmitted across the App-V server and client components to enforce the configuration on the managed node. - -**Information Collected, Processed, or Transmitted:** - -User and machine information and configuration content - -**Use of Information:** - -The information is used to enforce the application access configuration on the managed nodes within the enterprise. The information does not leave the enterprise. - -**Choice/Control:** - -By default, the product does not have any data. All data is entered and enabled by the admin and can be viewed in the Management console. The feature cannot be disabled as this is the product functionality. To disable this, App-V will need to be uninstalled. - -**Important Information:** - -None of this information is sent out of the enterprise. - -### Package History Information - -**What This Feature Does:** - -It captures package history and asset information as part of the package. - -**Information Collected, Processed, or Transmitted:** - -Information about the package and the sequencing environment is collected and stored in the package manifest during sequencing. - -**Use of Information:** - -The information will be used by the admin to track the updates done to a package during its lifecycle. It will also be used by software deployment systems to track the package deployments within the organization. - -**Choice/Control:** - -This feature is always enabled and cannot be turned off. - -**Important Information:** - -This administrator information will be stored in the package and can be viewed by the end users if they access the XML associated with the application. - -### Collection and Transmission of Reporting Data - -**What This Feature Does:** - -The product will collect a variety of reporting data points, including the username, to allow reporting on the usage of the product. - -**Information Collected, Processed, or Transmitted:** - -Information about the machine, package and application usage are collected from every machine that reporting is enabled on. - -**Use of Information:** - -The information is used to report on application usage within the enterprise. The information does not leave the enterprise. - -**Choice/Control:** - -By default, the product does not have any data. Data is only collected once the reporting feature is enabled on the App-V Client. To disable the collection of reporting data, the reporting feature must be disabled on all clients. - -**Important Information:** - -None of this information is sent out of the enterprise. - -### Features in App-V 4.6 SP1 and later - -This section addresses specific features available in App-V 4.6 SP1 and later. - -### Customer Experience Improvement Program - -**What This Feature Does:** - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We will not collect your name, address, or other contact information. - -**Information Collected, Processed, or Transmitted:** - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -**Use of Information:** - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -**Choice/Control:** - -CEIP is optional and the opt-in status can be updated during install or post install from the GUI.   - -### Application Package Accelerators - -**What This Feature Does:** - -Customers can use Application Package Accelerators to automatically package complex applications without installing the application. The App-V sequencer allows you to create package accelerators for each virtual package. You can then use these package accelerators to automatically re-create the same virtual package in the future. You may also use package accelerators released by Microsoft or other third parties to simplify and automate packaging of complex applications. - -**Information Collected, Processed, or Transmitted:** - -Application Package Accelerators may contain information such as computer names, user account information, and information about applications included in the Package Accelerator file. - -If you plan to share Application Package Accelerators with anyone outside your organization you should review all the settings and ensure the Package Accelerators do not contain any personal or company information. You can view the contents by opening the Package Accelerator files using any XML viewer. The following are ways you can view and remove any computer or user information from the Package Accelerator files before sharing with anyone outside your company: - -- **Username** - When you log on to the computer running the App-V sequencer you should use a generic user account, such as **administrator**. You should not use an account that is based on an existing username. - -- **Computer Name**– Specify a general, non-identifying name for the computer that is running the App-V Sequencer. - -- **Server URL**– Use the default settings for the server URL configuration information on the **Deployment** tab in the App-V Sequencer console. - -- **Applications** – If you do not want to share the list of applications that were installed on the computer running the sequencer when you created the Package Accelerator you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -No information is sent to Microsoft through customers’ use of the Application Package Accelerator feature. - -## Related topics - - -[About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md b/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md deleted file mode 100644 index 4c68c94bf5..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Microsoft Application Virtualization Client Management Help -description: Microsoft Application Virtualization Client Management Help -author: eavena -ms.assetid: 449eebda-70eb-48b7-855a-db965a680923 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization Client Management Help - - -The Microsoft Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services) provide the interface you can use to manage virtual applications on your computer. Through the user interface, you can manage applications and file type associations, and you can refresh applications from the Application Virtualization Management Servers (also referred to as application publishing servers). - -This help documentation supports the Application Virtualization Desktop Client and Client for Remote Desktop Services. It includes conceptual information, step-by-step procedures, and a user interface reference. - -For the latest updates to this help documentation, please visit the Microsoft TechNet Library at . - -## In This Section - - -[Application Virtualization Client Management Console Roadmap](application-virtualization-client-management-console-roadmap.md) -Includes overview information about the Client Management Console. - -[About Virtual Environments](about-virtual-environments.md) -Describes virtual environments and the way virtual applications affect the environment. - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -Includes information about using the features and commands that are available from the Windows desktop notification area. - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) -Includes an overview as well as step-by-step procedures for using the features and commands that are available in the Application Virtualization Client. - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) -Includes reference information about the screen elements and dialog boxes that are available in the Application Virtualization Desktop Client and the Client for Remote Desktop Services. - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md b/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md deleted file mode 100644 index 8d3ac35075..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Microsoft Application Virtualization Getting Started Guide -description: Microsoft Application Virtualization Getting Started Guide -author: eavena -ms.assetid: 6cd9a212-e270-4d7c-bd0a-bd6af9a5c3ba -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Microsoft Application Virtualization Getting Started Guide - - -This Getting Started Guide provides essential information that will help you design your Microsoft Application Virtualization (App-V) system and assist in your deployment and upgrade planning. - -## In This Section - - -[Overview of Application Virtualization](overview-of-application-virtualization.md) -Provides a summary of the App-V system features. - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -Provides the guidance necessary to plan the implementation and deployment of your Application Virtualization system, and to migrate from previous versions. - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations-copy.md) -Provides information about hardware and software requirements for installing the various Application Virtualization components and upgrade information. - -[About Microsoft Application Virtualization 4.5](about-microsoft-application-virtualization-45.md) -Describes the features introduced in App-V 4.5 and also includes the App-V 4.5 release notes documentation. - -[About Microsoft Application Virtualization 4.5 SP1](about-microsoft-application-virtualization-45-sp1.md) -Describes the changes introduced in App-V 4.5 with SP1 and also includes the App-V 4.5 SP1 release notes documentation. - -[About Microsoft Application Virtualization 4.5 SP2](about-microsoft-application-virtualization-45-sp2.md) -Describes what’s new in App-V 4.5 with SP2 and also includes the App-V 4.5 SP2 release notes documentation. - -[About Microsoft Application Virtualization 4.6](about-microsoft-application-virtualization-46.md) -Describes what’s new in App-V 4.6 and also includes the App-V 4.6 release notes documentation. - -[About Microsoft Application Virtualization 4.6 SP1](about-microsoft-application-virtualization-46-sp1.md) -Describes what’s new in App-V 4.6 SP1 and also includes the App-V 4.6 release notes documentation. - -[About Microsoft Application Virtualization 4.6 SP3](about-microsoft-application-virtualization-46-sp3.md) -Describes what’s new in App-V 4.6 SP3 and also includes the App-V 4.6 release notes documentation. - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md deleted file mode 100644 index e0573f689e..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md +++ /dev/null @@ -1,221 +0,0 @@ ---- -title: Microsoft Application Virtualization Management System Release Notes 4.5 SP1 -description: Microsoft Application Virtualization Management System Release Notes 4.5 SP1 -author: eavena -ms.assetid: 5d6b11ea-7b87-4084-9a7c-0d831f247aa3 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization Management System Release Notes 4.5 SP1 - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. These Release Notes contain information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative. - - - -For updated information about known issues, please visit the Microsoft TechNet Library at . - -## About Microsoft Application Virtualization 4.5 Service Pack 1 - - -These Release Notes have been updated to reflect the changes introduced with Microsoft Application Virtualization (App-V) 4.5 Service Pack 1 (SP1). This service pack contains the following changes: - -- Support for Windows 7 and Windows Server 2008 R2: App-V 4.5 SP1 provides support for Windows 7 and Windows Server 2008 R2, including support for Windows 7 features such as the taskbar, AppLocker, BranchCache, and BitLocker To Go.  Windows Server 2008 R2 support is for the Application Virtualization Server only. For more information on AppLocker support in Windows 7, see . - -- Support for 3rd Party Kerberos Realms: App-V 4.5 SP1 provides support for environments that have a trust relationship and mapped user accounts between a Windows domain and an MIT Kerberos realm, which is a scenario that is common at many universities. For information on how to enable this support, please visit the Microsoft TechNet Library at . - -- Improved support for application publishing and streaming via HTTP/HTTPS: App-V 4.5 SP1 provides support for application publishing and streaming via the HTTP/HTTPS protocols for Windows XP Home Edition, Windows Vista Home Basic, and Windows 7 Home Basic. - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP1 also includes a rollup up of fixes to address issues found since the Microsoft Application Virtualization (App-V) 4.5 CU1 release. The updates are a result of a combination of known issues and customer feedback from our internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see the KB article at . - -## About the Product Documentation - - -Comprehensive documentation for Application Virtualization (App-V) is available on Microsoft TechNet in the Application Virtualization (App-V) TechCenter at . The TechNet documentation includes the online Help for the Application Virtualization Sequencer, the Application Virtualization Client, and the Application Virtualization Server. It also includes the Application Virtualization Planning and Deployment Guide and the Application Virtualization Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see the Microsoft Security Web site at . - -## Providing Feedback - - -You can provide feedback, make a suggestion, or report an issue with the Microsoft Application Virtualization (App-V) Management System via a community forum on the Microsoft Application Virtualization TechCenter (). - -You can also provide your feedback on the documentation directly to the App-V documentation team. Send your documentation feedback to appvdocs@microsoft.com. - -## Known Issues with Application Virtualization 4.5 SP1 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.5 SP1. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases of the software. - -### Guidance for installing Server Management Console - -If you need to install management software onto systems other than the primary Application Virtualization publishing and streaming server, the server install supports installing the Management Console and Management Web service on separate servers from the primary App-V Management Server. To distribute the management components across multiple servers, Kerberos delegation must be enabled on the server where the Web service is installed. For information on how to enable this support, please visit the Microsoft TechNet Library at - -### Guidance for installing or upgrading clients to App-V 4.5 SP1 using setup.msi - -When installing or upgrading your App-V clients to App-V 4.5 SP1 by using setup.msi, the prerequisites are not installed automatically. - -WORKAROUND   You must manually install the prerequisites before installing or upgrading the App-V client to App-V 4.5 SP1. For detailed procedures for installing the prerequisites and the App-V client, see . - -When this has been completed, install the App-V 4.5 SP1 client by using setup.msi with elevated privileges. This file is available on the App-V 4.5 SP1 release media in the Installers\\Client folder. - -When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 SP1 Desktop client: - - msiexec /i dw20shared.msi APPGUID={93468B43-C19D-44F9-8BCC-114076DB0443}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -Alternatively, if you are installing or upgrading to the App-V 4.5 SP1 Client for Remote Desktop Services (formerly Terminal Services), use the following command: - - msiexec /i dw20shared.msi APPGUID={0042AD3C-99A4-4E58-B5F0-744D5AD96E1C} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -**Note**   -The APPGUID parameter references the product code of the App-V client that you install or upgrade. The product code is unique for each setup.msi. You can use the Orca database editor or a similar tool to examine Windows Installer files and determine the product code. This step is required for all installations or upgrades to App-V 4.5 SP1. - - - -### Improving performance when sequencing the .NET Framework - -When sequencing the .NET Framework, you might experience reduced system performance because the Microsoft .NET Framework NGEN service attempts to precompile assemblies as a background task. - -WORKAROUND   When sequencing the .NET Framework, disable the Microsoft .NET Framework NGEN service (mscorsvw.exe) after completing the monitoring phase. You must use the **Virtual Services** tab in the Sequencer and change the startup type to disabled. - -### When you uninstall the Microsoft Application Virtualization Client, user settings associated with the user performing the uninstall will be deleted - -When you uninstall the App-V Client, the Windows Installer will remove Application Virtualization settings from the current user's profile. If your computer uses roaming profiles, do not use your personal network account to uninstall the client because it will remove settings for your virtual applications on all of your computers. - -WORKAROUND   You should perform the App-V Client uninstall with an administrative account that is not used for running virtual applications. - -### Edits made on the virtual file system and virtual registry tabs must be saved while running the Sequencing wizard - -If you open a package to perform an upgrade, or if you have already run the Sequencing wizard with a new package and make changes to the package in the virtual file system or virtual registry tabs, those changes are not automatically saved. - -WORKAROUND   Save the changes before re-running the wizard, to ensure that they are reflected inside the wizard’s virtual environment. - -### Command-line Sequencer must be run from an elevated command prompt - -When you use the command-line Sequencer, it does not prompt for elevation. - -WORKAROUND   Run the command-line Sequencer using an elevated command prompt. - -### Short path variable names in OSD files can cause errors - -If you receive error 450478-1F702339-0000010B “The directory name is invalid” when starting a virtual application on the client, it is possible that the variable in the OSD is set incorrectly. This can happen if the application’s installer sets a short path name during sequencing. - -WORKAROUND   Remove the trailing tilde from any CSIDL variable that exists in the OSD file. - -### Correct syntax for DECODEPATH parameter for command-line Sequencer - -In the command-line Sequencer, when opening a package for upgrade and decoding it to the root of the Q drive, the syntax for the *DECODEPATH* parameter should not include a trailing slash. - -WORKAROUND   You can use **Q:** rather than **Q:\\** (omitting the trailing “\\” character). - -### When upgrading 4.2 packages, you encounter problems caused by Windows Installer files in the Virtual File System - -When upgrading a package from 4.2, you might experience issues relating to a mismatch of Windows Installer system files that were included by default in 4.2 and the Windows Installer libraries locally installed on your Sequencing workstation. The following files are located in CSIDL\_SYSTEM\\: - -cabinet.dll - -msi.dll - -msiexec.exe - -msihnd.dll - -msimsg.dlll - -WORKAROUND   Delete all of the preceding files from the package. Delete the mappings on the **VFS** tab as well as the actual files in the CSIDL\_SYSTEM folder in your decode path. - -### On Windows XP, client install logging is not enabled by default - -When installing the client, to ensure that any install errors are captured for troubleshooting purposes, you should enable logging by using the command line. - -WORKAROUND   Add the parameter */l\*vx! log.txt* to the command line, as shown in the following example: - -setup.exe /s /v”/qn /l\*vx! log.txt” - -msiexec.exe /i setup.msi /qn /l\*vx! log.txt - -Alternatively, you can set the registry key to the following value: - -\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\] "Logging"="voicewarmupx!" - -### For Kerberos authentication to work, Service Principal Names (SPNs) must be registered for IIS - -When using IIS 6.0 or 7.0 for icon or OSD file retrieval and streaming of packages, for Kerberos authentication to be enabled, the SPNs must be registered as follows: - -- On the IIS server, run the following commands by using the SETSPN.EXE Resource Kit tool. The server fully qualified domain name (FQDN) must be used. - - Setspn -r SOFTGRID/<Server FQDN> - - Setspn -r HTTP/<Server FQDN> - -For more information, see . - -### .NET compatibility changes - -Microsoft Application Virtualization (App-V) Cumulative Update 1 or later supports sequencing the .NET Framework on Windows XP (SP2 or later). Sequencing routines for .NET applications that were written for SoftGrid 4.2 might need to be updated when used with the App-V 4.5 Sequencer. For details and workarounds, please refer to the Knowledge Base article at . - -### After client upgrade from App-V 4.2, some applications are not shown - -Check for the following error in the log: ”The Application Virtualization Client could not parse the OSD file”. The App-V 4.5 client filters out applications that have an OSD file containing an empty OS tag (<OS></OS>). - -WORKAROUND   Delete the empty OS tag from the OSD file. - -### The App-V server requires exemptions in its firewall for certain processes - -For the server to stream applications correctly, the server's core processes, including the dispatcher, need access through the firewall. - -WORKAROUND   Set exemptions in the server's firewall for the following processes: sghwsvr.exe and sghwdsptr.exe. This applies to the App-V Management Server and App-V Streaming Server. - -### When the server installer is run in silent mode, it does not correctly check for MSXML6 - -The App-V Management Server depends on MSXML6. However, if you run the installer in silent mode—for example, by using the command “msiexec -i setup.msi /qn” on a system where MSXML6 is not already installed—the installer does not detect the missing dependency and installs anyway. Therefore, when clients attempt to refresh publishing information from the App-V Management Server, they will see failures. - -WORKAROUND   Verify that MSXML6 is installed on the system before attempting a silent install of the App-V Management Server. - -### Error code 000C800 when attempting to connect to the Application Virtualization Management Console - -An Application Virtualization administrator who is not a local administrator on the App-V Management Web Service server will receive an error (Error code: 000C800) when attempting to connect to the App-V Management Console, and the sftmmc.log entry will indicate that access to SftMgmt.udl is denied. To successfully connect to the App-V Management Console, an administrator who does not have local administrator rights on the App-V Management Web Service server must have at least read and execute permissions to the SftMgmt.udl file. - -The Application Virtualization administrators must be given read and execute permissions to the SftMgmt.UDL file under %systemdrive%\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service. - -### Client installer command-line parameters are ignored when used in conjunction with KEEPCURRENTSETTINGS=1 - -When used in conjunction with KEEPCURRENTSETTINGS=1, the following client installer command-line parameters are ignored: SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, SWIUSERDATA, and REQUIRESECURECONNECTION. - -WORKAROUND   If you have settings you want to retain, use KEEPCURRENTSETTINGS=1 and then set the other parameters after deployment. The App-V ADM Template can be used to set the following client settings: APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, AUTOLOADTARGET, AUTOLOADTRIGGERS, DOTIMEOUTMINUTES, and ALLOWINDEPENDENTFILESTREAMING. The ADM Template can be found at . - -## Release Notes Copyright Information - - -Information in this document, including URL and other Internet Web site references, is subject to change without notice and is provided for informational purposes only. The entire risk of the use or results from the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md deleted file mode 100644 index faa8e6fb37..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md +++ /dev/null @@ -1,287 +0,0 @@ ---- -title: Microsoft Application Virtualization Management System Release Notes -description: Microsoft Application Virtualization Management System Release Notes -author: eavena -ms.assetid: e1a4d5ee-53c7-4b48-814c-a34ce0e698dc -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization Management System Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative. These Release Notes supersede the content included with this product. - - - -For updated information about known issues, please visit the Microsoft TechNet Library at . - -## About Microsoft Application Virtualization 4.5 Cumulative Update 1 - - -These Release Notes have been updated to reflect the changes introduced with Microsoft Application Virtualization 4.5 Cumulative Update 1 (App-V 4.5 CU1), which provides the latest updates to Application Virtualization (App-V) 4.5. This cumulative update contains the following changes: - -- Support for Windows 7 Beta and Windows Server 2008 R2 Beta: App-V 4.5 CU1 addresses compatibility issues with Windows 7 Beta and Windows Server 2008 R2 Beta. Support will be provided for blocking issues that prevent App-V 4.5 CU1 running in a test environment on pre-RTM versions of Windows 7. This will help ensure that your virtual applications can run successfully in a test environment where compatibility between App-V 4.5 Client and Windows 7 Beta is required. - - **Important**   - Running App-V 4.5 CU1 on any version of Windows 7 or Windows Server 2008 R2 in a live operating environment is not supported. - - - -- Improved support for sequencing the .NET Framework: App-V 4.5 CU1 addresses previous issues with sequencing the .NET Framework 3.5 and earlier on Windows XP (SP2 or later). For more information about the new capabilities, see the TechNet article at . - -- Customer Feedback and Hotfix Rollup: App-V 4.5 CU1 also includes a rollup up of fixes to address issues found since the App-V 4.5 RTM release. This includes a combination of known issues and customer feedback from our internal teams, partners, and customers who are using App-V 4.5. For a full list of the included updates, see the KB article at . - -## About the Product Documentation - - -Comprehensive documentation for Application Virtualization (App-V) is available on Microsoft TechNet in the Application Virtualization (App-V) TechCenter at . The TechNet documentation includes the online Help for the Application Virtualization Sequencer, the Application Virtualization Client, and the Application Virtualization Server. It also includes the Application Virtualization Planning and Deployment Guide and the Application Virtualization Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the Microsoft Security Web site at . - -## Providing Feedback - - -You can provide feedback, make a suggestion, or report an issue with the Microsoft Application Virtualization (App-V) Management System via a community forum on the Microsoft Application Virtualization TechCenter (). - -You can also provide your feedback on the documentation directly to the App-V documentation team. Send your documentation feedback to appvdocs@microsoft.com. - -## Known Issues with Application Virtualization 4.5 CU1 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.5 CU1. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases. - -### Guidance for installing or upgrading clients to App-V 4.5 CU1 using setup.msi - -When installing or upgrading your App-V clients to App-V 4.5 CU1 by using setup.msi, the prerequisites are not installed automatically. - -WORKAROUND   You must manually install the prerequisites before installing or upgrading the App-V client to 4.5 CU1. For detailed procedures for installing the prerequisites and the App-V client, see . - -When this has been completed, install the App-V 4.5 CU1 client by using setup.msi with elevated privileges. This file is available on the App-V 4.5 CU1 release media in the Installers\\Client folder. - -When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 CU1 Desktop client: - - msiexec /i dw20shared.msi APPGUID={FE495DBC-6D42-4698-B61F-86E655E0796D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -Alternatively, if you are installing or upgrading to the App-V 4.5 CU1 Terminal Services client, use the following command: - - msiexec /i dw20shared.msi APPGUID={8A97C241-D92A-47DC-B360-E716C1AAA929} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -**Note**   -The APPGUID parameter references the product code of the App-V client that you install or upgrade to. The product code is unique for each setup.msi. You can use the Orca database editor or similar tool to examine Windows Installer files and determine the product code. This step is required for all installs or upgrades to App-V 4.5 CU1. - - - -### Some applications might fail to install during the monitoring phase when sequencing on Windows 7 Beta - -When sequencing on Windows 7 Beta or on a computer with Windows Installer 5.0, some applications might fail to install during the monitoring phase. - -WORKAROUND   You must manually grant the Everyone group Full Control permissions to the following registry key: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\SystemGuard - -**Important**   -You must use the **Advanced** button to set the “Include inheritable permissions from this object’s parent” option. - - - -### Unable to save packages when sequencing on Windows 7 Beta - -When sequencing on Windows 7 Beta, you might be unable to save your sequenced package because of a sharing violation. - -WORKAROUND   As specified in the best practices section of the Microsoft Application Virtualization 4.5 Sequencing Guide (see ), you must shutdown and disable the following software programs before you begin sequencing: - -- Windows Defender - -- Antivirus software - -- Disk defragmentation software - -- Windows Search - -- Any open Windows Explorer session - -In addition, if you have Microsoft Update running on the sequencing station to capture updates during the package update process, you will need to add “C:\\Windows\\SoftwareDistribution” as a VFS exclusion before you start sequencing. - -### Improving performance when sequencing the .NET Framework - -When sequencing the .NET Framework, you might experience reduced system performance because the Microsoft .NET Framework NGEN service attempts to precompile assemblies as a background task. - -WORKAROUND   When sequencing the .NET Framework, disable the Microsoft .NET Framework NGEN service (mscorsvw.exe) after completing the monitoring phase. You must use the **Virtual Services** tab in the Sequencer and change the startup type to disabled. - -### Interoperability issues with the Windows 7 Taskbar - -When you run the Application Virtualization Client on Windows 7, the Windows 7 taskbar does not collapse multiple instances of a virtual application into a single taskbar button. In addition, jump Lists do not appear when you right-click a taskbar button of a virtual application, unless the application has been pinned to the Windows 7 taskbar. - -### When you uninstall the Microsoft Application Virtualization Client, user settings associated with the user performing the uninstall will be deleted - -When you uninstall the Microsoft Application Virtualization Client, the Windows Installer will remove Application Virtualization settings from the current user's profile. If your computer uses roaming profiles, do not use your personal network account to uninstall the client because it will remove settings for your virtual applications on all of your computers. - -WORKAROUND   You should perform the App-V Client uninstall with an administrative account that is not used for running virtual applications. - -### Edits made on the virtual file system and virtual registry tabs must be saved while running the Sequencing wizard - -If you open a package to perform an upgrade or have already run the Sequencing wizard with a new package and you make changes to the package in the virtual file system or virtual registry tabs, those changes are not automatically saved. - -WORKAROUND   Save the changes before re-running the wizard, to ensure that they are reflected inside the wizard’s virtual environment. - -### Command-line Sequencer must be run from an elevated command prompt - -When you use the command-line Sequencer, it does not prompt for elevation. - -WORKAROUND   Run the command-line Sequencer using an elevated command prompt. - -### Server Management Console configuration in distributed environments - -If you need to install management components onto systems other than the primary Application Virtualization publishing and streaming server, the server install supports installing our management console and Web service on separate servers from the primary Application Virtualization Server when properly configured. - -To distribute the management components across multiple servers, Kerberos delegation must be enabled on the server where the Web service is installed. - -### Short path variable names in OSD files can cause errors - -If you receive error 450478-1F702339-0000010B “The directory name is invalid” when starting a virtual application on the client, it is possible that the variable in the OSD is set incorrectly. This can happen if the application’s installer sets a short path name during sequencing. - -WORKAROUND   Remove the trailing tilde from any CSIDL variable that exists in the OSD file. - -### Correct syntax for DECODEPATH parameter for command-line Sequencer - -In the command-line Sequencer, when opening a package for upgrade and decoding it to the root of the Q drive, the syntax for the *DECODEPATH* parameter should not include a trailing slash. - -WORKAROUND   You can use **Q:** rather than **Q:\\** (omitting the trailing “\\” character). - -### When upgrading 4.2 packages, you encounter problems caused by Windows Installer files in the Virtual File System - -When upgrading a package from 4.2, you might experience issues relating to a mismatch of Windows Installer system files that were included by default in 4.2 and the Windows Installer libraries locally installed on your Sequencing workstation. The following files are located in CSIDL\_SYSTEM\\: - -cabinet.dll - -msi.dll - -msiexec.exe - -msihnd.dll - -msimsg.dlll - -WORKAROUND   Delete all of the preceding files from the package. Delete the mappings on the **VFS** tab as well as the actual files in the CSIDL\_SYSTEM folder in your decode path. - -### On Windows XP, client install logging is not enabled by default - -When installing the client, to ensure that any install errors are captured for troubleshooting purposes, you should enable logging by using the command line. - -WORKAROUND   Add the parameter */l\*vx! log.txt* to the command line, as shown in the following example: - -setup.exe /s /v”/qn /l\*vx! log.txt” - -msiexec.exe /i setup.msi /qn /l\*vx! log.txt - -Alternatively, you can set the registry key to the following value: - -\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\] "Logging"="voicewarmupx!" - -### For Kerberos authentication to work, Service Principal Names (SPNs) must be registered for IIS - -When using IIS 6.0 or 7.0 for icon or OSD file retrieval and streaming of packages, for Kerberos authentication to be enabled, the SPNs must be registered as follows: - -- On the IIS server, run the following commands by using the SETSPN.EXE Resource Kit tool. The server fully qualified domain name (FQDN) must be used. - - Setspn -r SOFTGRID/<Server FQDN> - - Setspn -r HTTP/<Server FQDN> - -For more information, see . - -### On upgrade from RC, the default permissions on client logs do not allow for non-admin users to access the logs for troubleshooting and support - -The default permissions on client logs for the Application Virtualization RC client did not allow for non-admin access to log files, and manual changes to these log permissions were reverted when clients were restarted. This has been corrected in the RTM release for new client installs, but on upgrade from RC, the custom permissions on existing log files are not reset. However, when any new logs are created or after a log reset, the files will have the new default permissions. - -WORKAROUND   After the upgrade, reset existing client logs or manually change their permissions. - -### .NET compatibility changes - -Microsoft Application Virtualization Cumulative Update 1 supports sequencing the .NET Framework on Windows XP (SP2 or later). Sequencing routines for .NET applications that were written for SoftGrid 4.2 might need to be updated when used with the App-V 4.5 Sequencer. For details and workarounds, please refer to the Knowledge Base article at . - -### After client upgrade from App-V 4.2, some applications are not shown - -Check for the following error in the log: ”The Application Virtualization Client could not parse the OSD file”. The Microsoft Application Virtualization 4.5 client filters out applications that have an OSD file containing an empty OS tag (<OS></OS>). - -WORKAROUND   Delete the empty OS tag from the OSD file. - -### The App-V server requires exemptions in its firewall for certain processes - -For the server to stream applications correctly, the server's core processes, including the dispatcher, need access through the firewall. - -WORKAROUND   Set exemptions in the server's firewall for the following processes: sghwsvr.exe and sghwdsptr.exe. This applies to the App-V Management Server and App-V Streaming Server. - -### Sequencing packages that require new Visual Basic runtimes might fail - -If you sequence a package that uses a newer version of a Visual Basic (VB) runtime on a system where an older version of the VB runtime is installed, you might see a crash or other unexpected behavior when you try to use your package. For example, if you try to sequence Microsoft Money 2007, which uses version 6.00.9782 of the VB runtime, on a Windows XP system with version 6.00.9690 of the VB runtime, you might see a crash in the Invoice Designer when you try to run it on another Windows XP system with that older VB runtime. - -WORKAROUND   After installing the application on the sequencing computer, while still monitoring, copy the correct (newer) VB runtime to the directory in the package from where the executable is started. This allows the sequenced application to find the expected version of the VB runtime when it is started. - -**Important**   -This issue has been fixed in Microsoft Application Virtualization 4.5 Cumulative Update 1. - - - -### When the server installer is run in silent mode, it does not correctly check for MSXML6 - -The App-V Management Server depends on MSXML6. However, if you run the installer in silent mode—for example, by using the command “msiexec -i setup.msi /qn” on a system where MSXML6 is not already installed—the installer does not notice the missing dependency and installs anyway. The most common result is that when clients attempt to refresh publishing information from the App-V Management Server, they will see failures. - -WORKAROUND   Verify that MSXML6 is installed on the system before attempting a silent install of the App-V Management Server. - -### Error code 000C800 when attempting to connect to the Application Virtualization Management Console - -An Application Virtualization administrator who is not a local admin on the Application Virtualization Management Service server will receive an error (Error code: 000C800) when attempting to connect to the Application Virtualization Management Console, and the sftmmc.log entry will indicate that access to SftMgmt.udl is denied. To successfully connect to the Application Virtualization Management Console, an Application Virtualization administrator who is not a local admin on the Application Virtualization Management Service server must have at least read and execute access to the SftMgmt.udl file. - -The Application Virtualization administrators must be given read and execute permissions to the SftMgmt.UDL file under %systemdrive%\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service. - -### Client installer command-line parameters are ignored when used in conjunction with KEEPCURRENTSETTINGS=1 - -When used in conjunction with KEEPCURRENTSETTINGS=1, the following client installer command-line parameters are ignored: SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, SWIUSERDATA, and REQUIRESECURECONNECTION. - -WORKAROUND   If you have settings you want to retain, use KEEPCURRENTSETTINGS=1 and then set the other parameters after deployment. The App-V ADM Template can be used to set the following client settings: APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, AUTOLOADTARGET, AUTOLOADTRIGGERS, DOTIMEOUTMINUTES, and ALLOWINDEPENDENTFILESTREAMING. The ADM Template can be found at . - -### Error initializing virtual applications with Symantec Endpoint Protection - -When using Symantec Endpoint Protection with the Application and Device Control feature enabled, virtual applications might fail to start, with the error “The application failed to initialize properly (0xc000007b)”. For details and workarounds, please refer to the Knowledge Base article at . - -**Important**   -This issue has been fixed in Microsoft Application Virtualization 4.5 Cumulative Update 1. - - - -## Release Notes Copyright Information - - -Information in this document, including URL and other Internet Web site references, is subject to change without notice, and is provided for informational purposes only. The entire risk of the use or results of the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, MS-DOS, Windows, Windows Server, Windows Vista, Active Directory, and ActiveSync are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. - -The names of actual companies and products mentioned herein may be the trademarks of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md b/mdop/appv-v4/microsoft-application-virtualization-security-guide.md deleted file mode 100644 index 610d1317df..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: Microsoft Application Virtualization Security Guide -description: Microsoft Application Virtualization Security Guide -author: eavena -ms.assetid: 5e794316-cc4f-459e-90ef-79fc9841ba4e -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Microsoft Application Virtualization Security Guide - - -This documentation introduces you to important information about deployment decisions that can affect the security of your system. It also provides you with the necessary steps to configure the Microsoft Application Virtualization (App-V) security settings to enhance the security of your environment based on the recommendations presented in the Security Best Practices Whitepaper. If the security settings are specific to Windows but not to App-V, the documentation includes the appropriate links to that information. - -  - -  - - - - - diff --git a/mdop/appv-v4/monitoring-application-virtualization-servers.md b/mdop/appv-v4/monitoring-application-virtualization-servers.md deleted file mode 100644 index e2b08724bc..0000000000 --- a/mdop/appv-v4/monitoring-application-virtualization-servers.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Monitoring Application Virtualization Servers -description: Monitoring Application Virtualization Servers -author: eavena -ms.assetid: d84355ae-4fe4-41d9-ac3a-3eaa32d9a61f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring Application Virtualization Servers - - -To simplify Application Virtualization (App-V) Server management, you can use the System Center Operations Manager 2007 Management Pack. This Management Pack supports only Application Virtualization (App-V) 4.5 servers; it does not support previous server versions. The Management Pack maximizes App-V Server availability for handling App-V Client requests. - -## Status Indicators - - -The App-V Server health status indicators are color-coded. The colors represent the following status values: - -- No color indicates that the server is running without non-recoverable errors. - -- Yellow indicates that one of the components is not functioning correctly. The overall functionality of the server is degraded, but the server is still available. - -- Red indicates that the server is not available and that it cannot provide key services or communicate with external service dependencies. - -## Monitoring Criteria - - -The Management Pack monitors the following aspects of server health: - -- Server Status—monitors server events to validate that the server is providing its expected services. - -- Data Store Access—tracks the ability of one or more of the App-V Management Servers to access and communicate with the App-V data store. - -- Content Data Access—monitors access to the \\Content directory, which might be a local directory or a network share, and the ability to read the requested files. - -- Security—reports errors with the App-V Server’s certificate and secure communications. - -- Client Request Handling—monitors the ability of one or more of the App-V Servers to handle and correctly respond to client requests. These requests include publishing such items as configuration requests, package load requests, and out of sequence requests. - -- Server Configuration—checks the configuration settings of the App-V Server. These configuration settings include the settings in the registry and in the App-V data store. - -## Server Differences - - -The main differences between the App-V Management Server and the App-V Streaming Server are as follows: - -- App-V Management Servers can provide publishing, streaming, management, and reporting services. Therefore, the Management Pack can manage more aspects of the App-V Management Server than it can manage on the App-V Streaming Server, which provides only package streaming. - -- The App-V Streaming Server does not have an App-V data store, so data store access is not monitored. The configuration information for the App-V Streaming Server is managed in the registry. - -- The App-V Streaming Server does not use the App-V Server Management Console interface; use other tools to manage the configuration. - -## Related topics - - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/online-help-for-application-virtualization.md b/mdop/appv-v4/online-help-for-application-virtualization.md deleted file mode 100644 index 7b0fb5aa06..0000000000 --- a/mdop/appv-v4/online-help-for-application-virtualization.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Online Help for Application Virtualization -description: Online Help for Application Virtualization -author: eavena -ms.assetid: 261ede48-976f-473c-84bc-452577efdcdf -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Online Help for Application Virtualization - - -The Microsoft Application Virtualization (App-V) system provides the capability to make applications available to end user computers without having to install the applications directly on those computers. The following online help documentation provides step-by-step procedures for interacting with and using the key system components. - -## In This Section - - -[Microsoft Application Virtualization Client Management Help](microsoft-application-virtualization-client-management-help.md) -Includes conceptual information, step-by-step procedures, and a user interface reference for the Application Virtualization (App-V) Desktop Client and Terminal Services Client. - -[Application Virtualization Server Management Help](application-virtualization-server-management-help.md) -Provides overview information about the Application Virtualization (App-V) Servers, as well as step-by-step procedures for using the available features and commands. A reference section includes information about the windows and dialogs that are available in the Server Management Console. - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) -Includes information about the user interface and the Sequencing Wizard and provides detailed step-by-step procedures for sequencing applications. - -  - -  - - - - - diff --git a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md deleted file mode 100644 index 1b5f04ae2a..0000000000 --- a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Open Package Wizard (AppV 4.6 SP1) -description: Open Package Wizard (AppV 4.6 SP1) -author: eavena -ms.assetid: 26bdef59-2ea3-4e30-9095-0ee0d0085b2d -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Open Package Wizard (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Open Package wizard. - -## In This Section - - -[Select Task Page (Learn More)](select-task-page--learn-more-.md) -Describes the options on the **Select Task** page to modify an existing virtual application package. - -[Packaging Method (Learn More)](packaging-method--learn-more-.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md deleted file mode 100644 index 0ecbf6bd98..0000000000 --- a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Operations Guide for the Application Virtualization System -description: Operations Guide for the Application Virtualization System -author: eavena -ms.assetid: 686f2b75-7fba-4410-89b2-a539984b6ef2 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Operations Guide for the Application Virtualization System - - -The Microsoft Application Virtualization Operations Guide provides information and step-by-step procedures to help you administer the Microsoft Application Virtualization (App-V) system and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. - -## In This Section - - -[Application Virtualization Client](application-virtualization-client.md) -Provides information about operational tasks for administering the Application Virtualization (App-V) Client. - -[Application Virtualization Server](application-virtualization-server.md) -Provides information about operational tasks for administering the Application Virtualization (App-V) Servers. - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) -Provides information about operational tasks for using the Application Virtualization (App-V) Sequencer. - -## Reference - - -For more information about general App-V sequencing best practices, see the following Microsoft Web sites: - -MCS Sequencing Guidelines at - -Best Practices for Sequencing at - -  - -  - - - - - diff --git a/mdop/appv-v4/osd-file-elements.md b/mdop/appv-v4/osd-file-elements.md deleted file mode 100644 index 157d258180..0000000000 --- a/mdop/appv-v4/osd-file-elements.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: OSD File Elements -description: OSD File Elements -author: eavena -ms.assetid: 8211b562-7549-4331-8321-144f52574e99 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# OSD File Elements - - -The Sequencer installation directory contains an XML schema file, **Softricity.xsd**, which defines the valid structure of an Open Software Descriptor (OSD) file. Following are some of the more frequently used OSD elements. - -SOFTPKG -The root element of the OSD file containing all elements defining the software package. - -CODEBASE -Information about the .sft file for this package, including the HREF, FILENAME, and GUID attributes. You can edit the HREF attribute if you change the distribution point of this particular package. - -OS -Defines on what operating systems this application can run based on values that are initially set in the Sequencing Wizard. This value can contain only the values defined in **Softricity.xsd**. - -LOCAL\_INTERACTION\_ALLOWED -Set to TRUE, this enables creation of named objects (events, mutexes, semaphores, file mappings, and mailslots) and COM objects in the global namespace rather than isolated inside a particular virtual environment, which allows virtual applications to interact with the host operating system's applications. - -Example:<SOFTPKG><IMPLEMENTATION> - -<VIRTUALENV><POLICIES> - -<LOCAL\_INTERACTION\_ALLOWED>TRUE - -</LOCAL\_INTERACTION\_ALLOWED> - -</POLICIES></VIRTUALENV> - -</IMPLEMENTATION></SOFTPKG> - -DEPENDENCIES -Defines Dynamic Suite Composition (dependencies on other packages) by using a CODEBASE tag from another package. - -Example:<DEPENDENCIES><CODEBASE HREF="rtsps://server/package.sft" GUID="7579F4DF-2461-4219-BD43-494E1FDC69E3" SYSGUARDFILE="pkg.1\\osguard.cp" SIZE="6572748" MANDATORY="FALSE"/></DEPENDENCIES> - -PACKAGE NAME -A common name for the package entered into the Sequencing Wizard **Package Information** page, which enables you to specify a single name used for a sequenced application containing multiple applications. - -TITLE -Optional descriptive name of the application you are sequencing. - -ABSTRACT -Short description of the software package entered in the **Comments** field in the Sequencing Wizard **Package Information** page. A best practice is to specify information such as the operating system and service-pack level of the Sequencer workstation, Sequencer version, and the sequencing engineer’s name. - -SCRIPT -Defines specific scripted events to occur during startup, shutdown, or streaming. - -MGMT\_SHORTCUTLIST -List of all shortcuts defined in the wizard. - -MGMT\_FILEASSOCIATIONS -List of the file types specified in the wizard. - -## Related topics - - -[About the OSD Tab](about-the-osd-tab.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/osd-tab-keep.md b/mdop/appv-v4/osd-tab-keep.md deleted file mode 100644 index 6ee10b4d02..0000000000 --- a/mdop/appv-v4/osd-tab-keep.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: OSD Tab -description: OSD Tab -author: eavena -ms.assetid: e66f1384-1753-4216-b9ee-77e99af93c74 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# OSD Tab - - -Use the **OSD** tab to edit and customize the Open Software Descriptor (OSD) file. - -## In This Section - - -[About the OSD Tab](about-the-osd-tab.md) -Provides general information about the **OSD** tab. - -[How to Edit an OSD File](how-to-edit-an-osd-file.md) -Provides the procedure to edit the OSD file by using the **Virtual Services** tab. - -[How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) -Provides the procedure to customize an OSD file by using a text editor. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 1ad9f93518..0000000000 --- a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Oversized Package Dialog Box (App-V 4.6 SP1) -description: Oversized Package Dialog Box (App-V 4.6 SP1) -author: eavena -ms.assetid: 8973a493-6509-4d52-afb6-a9f47d1c5c26 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Oversized Package Dialog Box (App-V 4.6 SP1) - - -The uncompressed package size exceeds the recommended 4 GB package size limit. To reduce the size of the package, package compression has been enabled. - -In the **Oversized Package** dialog box, use the following procedure to configure package compression. - -1. In the App-V Sequencer console, click the **Deployment** tab. - -2. To enable package compression, select the **Compress Package** check box. To disable package compression, clear the **Compress Package** check box. - -3. To save the package, click **File** / **Save**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/overview-of-application-virtualization.md b/mdop/appv-v4/overview-of-application-virtualization.md deleted file mode 100644 index 2381ed0605..0000000000 --- a/mdop/appv-v4/overview-of-application-virtualization.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Overview of Application Virtualization -description: Overview of Application Virtualization -author: eavena -ms.assetid: 80545ef4-cf4c-420c-88d6-48e9f226051f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Application Virtualization - - -Microsoft Application Virtualization (App-V) can make applications available to end user computers without having to install the applications directly on those computers. This is made possible through a process known as *sequencing the application*, which enables each application to run in its own self-contained virtual environment on the client computer. The sequenced applications are isolated from each other. This eliminates application conflicts, but the applications can still interact with the client computer. - -The App-V client is the feature that lets the end user interact with the applications after they have been published to the computer. The client manages the virtual environment in which the virtualized applications run on each computer. After the client has been installed on a computer, the applications must be made available to the computer through a process known as *publishing*, which enables the end user to run the virtual applications. The publishing process copies the virtual application icons and shortcuts to the computer—typically on the Windows desktop or on the **Start** menu—and also copies the package definition and file type association information to the computer. Publishing also makes the application package content available to the end user’s computer. - -The virtual application package content can be copied onto one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be copied directly to the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft System Center Configuration Manager 2007. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications available to end users located all over the world. Managing the packages to ensure that the appropriate applications are available to all users where and when they need access to them is therefore an important requirement. - -## Microsoft Application Virtualization System Features - - -The following table describes the primary features of the Microsoft Application Virtualization Management System. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FeatureFunctionAdditional Information

          Microsoft Application Virtualization Management Server

          Responsible for streaming the package content and publishing the shortcuts and file type associations to the Application Virtualization client.

          The Application Virtualization Management Server supports active upgrade, License Management, and a database that can be used for reporting.

          Content folder

          Indicates the location of the Application Virtualization packages for streaming.

          This folder can be located on a share on or off the Application Virtualization Management Server.

          Microsoft Application Virtualization Management Console

          This console is an MMC 3.0 snap-in management tool used for Microsoft Application Virtualization Server administration.

          This tool can be installed on the Microsoft Application Virtualization server or located on a separate workstation that has Microsoft Management Console (MMC) 3.0 and Microsoft .NET Framework 2.0 installed.

          Microsoft Application Virtualization Management Web Service

          Responsible for communicating any read and write requests to the Application Virtualization data store.

          The Management Web Service can be installed on the Microsoft Application Virtualization Management server or on a separate computer that has Microsoft Internet Information Services (IIS) installed.

          Microsoft Application Virtualization Data Store

          The App-V SQL Server database responsible for storing all information related to the Application Virtualization infrastructure.

          This information includes all application records, application assignments, and which groups have responsibility for managing the Application Virtualization environment.

          Microsoft Application Virtualization Streaming Server

          Responsible for hosting the Application Virtualization packages for streaming to clients in a branch office, where the link back to the Application Virtualization Management Server is considered a wide area networks (WAN) connection.

          This server contains streaming functionality only and provides neither the Application Virtualization Management Console nor the Application Virtualization Management Web Service.

          Microsoft Application Virtualization Sequencer

          The sequencer is used to monitor and capture the installation of applications to create virtual application packages.

          The output consists of the application’s icons, an .osd file that contains package definition information, a package manifest file, and the .sft file that contains the application program’s content files.

          Microsoft Application Virtualization Client

          The Application Virtualization Desktop Client and the Application Virtualization Client for Remote Desktop Services provide and manage the virtual environment for the virtualized applications.

          The Microsoft Application Virtualization client manages the package streaming into cache, publishing refresh, transport, and all interaction with the Application Virtualization servers.

          - -  - -  - -  - - - - - diff --git a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md b/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md deleted file mode 100644 index 672e8b0158..0000000000 --- a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Overview of the Application Virtualization System Components -description: Overview of the Application Virtualization System Components -author: eavena -ms.assetid: 75d88ef7-44d8-4fa7-b7f5-9153f37e570d -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of the Application Virtualization System Components - - -The following table describes the primary components of the Microsoft Application Virtualization Management System. For more information about deploying these system components, see [Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ComponentFunctionAdditional Information

          Microsoft Application Virtualization Management Server

          The component responsible for streaming the package content and publishing the shortcuts and file type associations to the Application Virtualization Client.

          The Application Virtualization Management Server supports active upgrade, License Management, and a database that can be used for reporting.

          Content folder

          The location of the Application Virtualization packages for streaming.

          This folder can be located on a share on or off the Application Virtualization Management Server. The folder can also be located on a Storage Area Network (SAN).

          Microsoft Application Virtualization Management Console

          An MMC 3.0 snap-in management utility for Microsoft Application Virtualization Server administration.

          This component can be installed on the Microsoft Application Virtualization server or located on a separate workstation that has MMC 3.0 and .NET 2.0 installed.

          Microsoft Application Virtualization Management Web Service

          The component responsible for communicating any read/write requests to the Application Virtualization data store.

          This component can installed on the Microsoft Application Virtualization Server or on a separate computer with IIS installed.

          Microsoft Application Virtualization Data Store

          The component stored in the SQL database and responsible for storing all information related to the Application Virtualization infrastructure.

          This information includes all application records, application assignments, and which groups have responsibility for managing the Application Virtualization environment.

          Microsoft Application Virtualization Streaming Server

          The component responsible for hosting the Application Virtualization packages for streaming to clients in a branch office, where the link back to the Application Virtualization Management Server is considered a WAN.

          This server contains streaming functionality only and provides neither the Application Virtualization Management Console nor the Application Virtualization Management Web Service.

          Microsoft Application Virtualization Sequencer

          The component used to monitor and capture the installation of applications to create virtual application packages.

          Output consists of the application’s icons, an OSD file containing package definition information, a package manifest file, and the SFT file containing the application program’s content files.

          Microsoft Application Virtualization Client

          The component installed on the Application Virtualization Desktop Client or on the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services) and that provides the virtual environment for the virtualized applications.

          The Microsoft Application Virtualization Client manages the package streaming into cache, publishing refresh, transport, and all interaction with the Application Virtualization Servers.

          - -  - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) - -[Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/package-name-page---learn-more-.md b/mdop/appv-v4/package-name-page---learn-more-.md deleted file mode 100644 index 47e9be6e5f..0000000000 --- a/mdop/appv-v4/package-name-page---learn-more-.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Package Name Page (Learn More) -description: Package Name Page (Learn More) -author: eavena -ms.assetid: ee75b8f0-bd9d-4460-a256-016ff97c2386 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Name Page (Learn More) - - -Use the **Package Name** page to specify a name for the virtual application package. You can also configure where the package will reside on the target computers. - -**Note**   -Editing the primary virtual application directory is an advanced task. - - - -This page contains the following elements: - -**Virtual Application Package Name** -Specifies the name that will be associated with virtual application package. The name specified should help identify the purpose and version of the application. The package name is also displayed in the App-V management console. - -**Edit (Advanced)** -Select this option to change the location of where the virtual application will be installed on target computers. Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path. Only select this option, if you prefer to generate your own file name. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/package-name-page--app-v-46-sp1.md b/mdop/appv-v4/package-name-page--app-v-46-sp1.md deleted file mode 100644 index b595db124d..0000000000 --- a/mdop/appv-v4/package-name-page--app-v-46-sp1.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Package Name Page -description: Package Name Page -author: eavena -ms.assetid: 1cea36b7-737d-4c5e-9294-5feba02a3e7d -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Name Page - - -Use the **Package Name** page to specify a name to associate with the new virtual application package. - -This page contains the following elements: - -**Virtual Application Package Name** -Specify a name that describes the new virtual application package. The name also identifies the virtual application package in the App-V Management Console. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/package-results-pane-columns.md b/mdop/appv-v4/package-results-pane-columns.md deleted file mode 100644 index cfca796126..0000000000 --- a/mdop/appv-v4/package-results-pane-columns.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Package Results Pane Columns -description: Package Results Pane Columns -author: eavena -ms.assetid: 4ed3a06a-656d-497a-b62d-21684396e2b0 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Results Pane Columns - - -The **Packages Results** pane in the Application Virtualization Server Management Console displays a variety of columns. - -You can use the standard Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click a package in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ColumnContents

          Number

          Displays the package icon and the version number.

          Package File

          Displays the name of the application file (SFT).

          Date Added

          Displays the date and time the package was added to the server.

          Version GUID

          Displays the version GUID.

          - -  - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -[Server Management Console: Packages Node](server-management-console-packages-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/package-results-pane.md b/mdop/appv-v4/package-results-pane.md deleted file mode 100644 index 65808ecea6..0000000000 --- a/mdop/appv-v4/package-results-pane.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Package Results Pane -description: Package Results Pane -author: eavena -ms.assetid: 07b7f737-f26f-4feb-88aa-3d8009c5622d -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Results Pane - - -The **Packages Results** pane in the Application Virtualization Server Management Console displays a list of the available packages. - -Right-click any package in the **Results** pane to display a pop-up menu that contains the following elements. - -**Add Version** -Starts the Add Package Version wizard. On the **Add Package Version** page, in **Full path for package file**, you can enter or browse to the correct path. On the **Enter Relative path for package file** page, you can enter the relative path in the **Relative path for package file** field. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Refresh** -Refreshes the view of the server. - -**Properties** -Displays the **Properties** dialog box for the selected package. The **Properties** dialog box displays the GUID information, the package name, and a list of applications (including version number and enabled status) associated with the package. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange Icons** -Changes how the icons are displayed in the **Results** pane. - -**Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -[Server Management Console: Packages Node](server-management-console-packages-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/packages-node.md b/mdop/appv-v4/packages-node.md deleted file mode 100644 index 6bdf422c6e..0000000000 --- a/mdop/appv-v4/packages-node.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Packages Node -description: Packages Node -author: eavena -ms.assetid: 3465168c-012f-4e9f-905d-611418d2975a -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Packages Node - - -The **Packages** node is one level below the Application Virtualization System node in the **Scope** pane of the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of packages. Right-click the **Packages** node to display a pop-up menu that contains the following elements. - -**New Package** -Displays the New Package Wizard. This wizard consists of the following three pages: - -1. Enter the package name and path to the corresponding package file (SFT). - -2. Enter the relative path to the SFT file. This path must be relative to the Server Content root. - -3. View the summary screen, and click **Finish** to add the new package. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -If you right-click any package that appears under the **Packages** node in the **Scope** pane, the following elements are available. - -**Add Version** -Displays the Add Package Version Wizard. Use this wizard to enter the full path to a new SFT file, or browse to the location of a new SFT file. This wizard also has a summary screen. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Properties** -Displays the **Properties** dialog box for the selected package. The **Properties** dialog box displays the GUID information, the package name, and a list of applications (including version number and enabled status) associated with the package. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -[Server Management Console: Packages Node](server-management-console-packages-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/packaging-method--learn-more-.md b/mdop/appv-v4/packaging-method--learn-more-.md deleted file mode 100644 index f0fd04c1c6..0000000000 --- a/mdop/appv-v4/packaging-method--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Packaging Method (Learn More) -description: Packaging Method (Learn More) -author: eavena -ms.assetid: 3975a640-1ffd-4b4c-95fd-608469f4c205 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Packaging Method (Learn More) - - -Use the **Packaging Method** page to specify the method you want to use to create a new virtual application package. - -This page contains the following elements: - -**Create Package (default)** -Select this option to create a virtual application package by installing an application to the computer running the App-V Sequencer while the App-V Sequencer monitors the installation. You should also copy all the required installation files to a local directory on the computer running the Sequencer. - -**Create Package using a Package Accelerator** -Select this option to create a package by using a Package Accelerator. The App-V Sequencer uses a Package Accelerator to create a virtual application package without having to manually install the application. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -## Related topics - - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/packaging-method-page--learn-more-.md b/mdop/appv-v4/packaging-method-page--learn-more-.md deleted file mode 100644 index 7d367a7c65..0000000000 --- a/mdop/appv-v4/packaging-method-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Packaging Method Page (Learn More) -description: Packaging Method Page (Learn More) -author: eavena -ms.assetid: f405a293-bcd4-48a1-b4d9-b5e4cf73c5f4 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Packaging Method Page (Learn More) - - -Use the **Packaging Method** page to specify the method you want to use to create a new virtual application package. - -This page contains the following elements. - -**Create Package (default)** -Select this option to create a virtual application package by installing an application on the computer running the App-V Sequencer while the App-V Sequencer monitors the installation. You should also copy all the required installation files to a local directory on the computer running the Sequencer. - -**Create Package using a Package Accelerator** -Select this option to create a package by using a Package Accelerator. The App-V Sequencer uses a Package Accelerator to create a virtual application package. A Package Accelerator enables you to create a virtual application package without performing all of the required manual steps during installation. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -## Related topics - - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/parse-items-tab-keep.md b/mdop/appv-v4/parse-items-tab-keep.md deleted file mode 100644 index 5f70497e42..0000000000 --- a/mdop/appv-v4/parse-items-tab-keep.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Parse Items Tab -description: Parse Items Tab -author: eavena -ms.assetid: bdf3fe0d-404a-4745-af52-f415fa321564 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Parse Items Tab - - -The **Parse Items** tab displays the mapping rules that the Sequencer uses to accommodate differences that exist between configurations on the sequencing computer and the App-V Desktop Client. This tab contains the following elements. - -## UI Elements List - - -**Parse From** -Displays read-only variable names evaluated by the Application Virtualization Sequencer to determine important operating system locations on the sequencing computer. - -**Parse To** -Displays read-only variable names that the Application Virtualization Sequencer substitutes when encountering variable names in the associated **Parse From** column, while parsing items in the virtual file system or virtual registry. - -**Map Type** -Displays read-only mapping rules that the Application Virtualization Sequencer applies to parse items in the virtual file system or virtual registry. One of the following values can occur: - -**OK** -Saves the changes and exits the dialog box. - -**Cancel** -Exits the dialog box without saving any changes. - -**Apply** -Saves the changes and remains in the dialog box. - -## Related topics - - -[Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md deleted file mode 100644 index 890bce54a6..0000000000 --- a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Planning and Deployment Guide for the Application Virtualization System -description: Planning and Deployment Guide for the Application Virtualization System -author: eavena -ms.assetid: 6c012e33-9ac6-4cd8-84ff-54f40973833f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning and Deployment Guide for the Application Virtualization System - - -Microsoft Application Virtualization Management provides the capability to make applications available to end user computers without having to install the applications directly on those computers. This is made possible through a process known as *sequencing the application*, which enables each application to run in its own self-contained virtual environment on the client computer. The sequenced applications are isolated from one another, eliminating application conflicts, yet can still interact with the client computer. - -The Application Virtualization Client is the Application Virtualization system component that enables the end user to interact with the applications after they have been published to the computer. The client manages the virtual environment in which the virtualized applications run on each computer. After the client has been installed on a computer, the applications must be made available to the computer through a process known as *publishing*, which enables the end user to run the virtual applications. The publishing process places the virtual application icons and shortcuts on the computer—typically on the Windows desktop or on the **Start** menu—and also places the package definition and file type association information on the computer. Publishing also makes the application package content available to the end user’s computer. - -The virtual application package content can be placed on one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be placed directly on the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft System Center Configuration Manager 2007. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications accessible to end users located all over the world. Managing the packages to ensure that the right applications are available to all users where and when they need access to them is therefore an essential requirement. - -The Application Virtualization Planning and Deployment Guide provides information to help you better understand and deploy the Microsoft Application Virtualization application and its components. It also provides step-by-step procedures for implementing the key deployment scenarios. - -## In This Section - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -Provides the guidance necessary to plan the implementation and deployment of your Application Virtualization system. - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) -Provides information about hardware and software requirements for installing the various Application Virtualization components, as well as upgrade information. - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) -Provides information about deploying Application Virtualization using an electronic software distribution (ESD) system. - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) -Provides information about deploying Application Virtualization using the Application Virtualization Management Server. - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) -Describes how to deploy Application Virtualization in a stand-alone mode, without the use of ESD or server-based resources. - -[Application Virtualization Reference](application-virtualization-reference.md) -Contains detailed technical reference material related to installing and managing system components. - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md deleted file mode 100644 index c7c2e67bf3..0000000000 --- a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Planning for Application Virtualization Client Deployment -description: Planning for Application Virtualization Client Deployment -author: eavena -ms.assetid: a352f80f-f0f9-4fbf-ac10-24c510b2d6be -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Application Virtualization Client Deployment - - -After you have decided how you will publish and deploy virtual application packages to your end user computers, you should plan the deployment of the Application Virtualization Client software. - -The Application Virtualization Client is the component that actually runs the virtual applications. The Application Virtualization Client enables users to interact with icons and to double-click file types to start a virtual application. It also handles streaming of the application content from a streaming server and caches it before starting the application. The application content is structured such that all the content needed to start the application and handle initial user interaction is streamed to the end user computer first. There are two different types of Application Virtualization Client software: the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services), which is used on Remote Desktop Session Host (RD Session Host) server systems, and the Application Virtualization Desktop Client, which is used for all other computers. - -The Application Virtualization Client should be configured at installation time, either in the Application Virtualization Management Console or via the installer command line, with a number of important settings, including the following: - -- Locations of the icons for all the applications. - -- The location of the OSD file that contains the package definition information. - -- The application content source. - -- The communications protocol to be used when retrieving the preceding items. - -- The cache size and cache size management method to be used. - -To expedite the deployment of the Application Virtualization Client software when using an electronic software distribution (ESD) solution, the preceding settings must be defined carefully in advance. This is especially important when you have computers in different offices, where their clients would need to be configured to use different source locations. - -**Note**   -- The icon location and OSD file values are an important factor to consider when choosing your publishing method, whether using Windows Installer or SFTMIME. The setting for the application content source is defined by your choice of streaming method. - -- To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. For more information about the cache space management feature, see **How to Use the Cache Space Management Feature** in the Microsoft Application Virtualization (App-V) Operations Guide. - -- During both the publishing and HTTP(S) streaming operations,App-V 4.5 SP1 clients use the proxy server settings that are configured in Internet Explorer on the user’s computer. - -For more information about configuring the client installation parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). - -  - -Finally, you need to determine how to deploy the Application Virtualization Desktop Client software for the desktop clients. Although it is possible to deploy the Application Virtualization Desktop Client manually on each computer, most organizations would need to do this through some automated process. A medium or large organization might have an ESD system in operation, and that would be an ideal way to deploy the client. If no ESD system exists, you can use your standard method of installing software in your organization. Choices include Group Policy or various scripting techniques. Depending on the number and size of the offices you have, this deployment process can be complex, and it is essential that you take a structured approach to ensure all computers get a client installed with the correct configuration. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) - -[How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md deleted file mode 100644 index b54977c4b8..0000000000 --- a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Planning for Application Virtualization System Deployment -description: Planning for Application Virtualization System Deployment -author: eavena -ms.assetid: 8215269f-c083-468a-bf0b-886b0d2dd69e -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Application Virtualization System Deployment - - -This section provides important information to help you plan your deployment of Microsoft Application Virtualization. - -## In This Section - - -[Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -Provides important security-related planning information about setting up the Application Virtualization Sequencer to sequence application packages. - -[Planning the Application Virtualization Sequencer Implementation](planning-the-application-virtualization-sequencer-implementation.md) -Provides planning guidance for implementing the App-V sequencer. - -[Using Electronic Software Distribution as a Package Management Solution](using-electronic-software-distribution-as-a-package-management-solution.md) -Provides planning guidance for using an electronic software distribution system to manage application package content, including setting up publishing and streaming. - -[Using Application Virtualization Servers as a Package Management Solution](using-application-virtualization-servers-as-a-package-management-solution.md) -Provides the planning information necessary for managing application package content in an Application Virtualization Server-based deployment. - -[Planning for Application Virtualization Client Deployment](planning-for-application-virtualization-client-deployment.md) -Provides important planning considerations for deploying the Application Virtualization Client. - -[Planning for Migration from Previous Versions](planning-for-migration-from-previous-versions.md) -Identifies the steps for upgrading from a previous version and lists several important factors to consider. - -[Planning for Security and Protection](planning-for-security-and-protection.md) -Provides information about enhanced security features in Application Virtualization 4.5. - -## Reference - - -[Application Virtualization Reference](application-virtualization-reference.md) - -## Related Sections - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-client-security.md b/mdop/appv-v4/planning-for-client-security.md deleted file mode 100644 index 2e70095470..0000000000 --- a/mdop/appv-v4/planning-for-client-security.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: Planning for Client Security -description: Planning for Client Security -author: eavena -ms.assetid: 4840a60f-4c91-489c-ad0b-6671882abf9b -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Client Security - - -The App-V Client provides several security enhancements that were not present in previous versions of the product. These changes provide improved security after installation and through later configuration of the client settings. This topic describes some of those enhancements and identifies several important security-related configuration settings that you should consider during your planning process. It is important to remember that virtual applications are still executables, so you must ensure that these assets cannot be tampered with by unauthorized people. For this reason, the Open Software Descriptor (OSD) file cache is protected as described later in this topic, and we strongly recommend that you use RTSPS, HTTPS, and IPsec to protect publishing and streaming. - -## App-V Client Security - - -By default, at installation the App-V client is configured with the minimum permissions required to allow a user to perform a publishing refresh and to start applications. Other security enhancements provided in the App-V client include the following: - -- By default, the OSD file cache can be updated only by administrators and by using the publishing refresh process. - -- The log file (sftlog.txt) is accessible only by accounts with local administrative access to the client. - -- The log file now has a maximum size. - -### File Type Associations - -By default, the installation of the client registers file type associations (FTAs) for OSD files, which enables users to start applications directly from OSD files instead of the published shortcuts. If a user with local administrator rights receives an OSD file containing malicious code, either in e-mail or downloaded from a Web site, the user can open the OSD file and start the application even if the client has been set to restrict the **Add Application** permission. You can unregister the FTAs for the OSD to reduce this risk. Also, consider blocking this extension in the e-mail system and at the firewall. For more information about configuring Outlook to block extensions, see . - -**Security Note:** - -Starting with App-V version 4.6, the file type association is no longer created for OSD files during a new installation of the client, although the existing settings will be maintained during an upgrade from version 4.2 or 4.5 of the App-V client. If for any reason it is essential to create the file type association, you can create the following registry keys and set their values as shown: - - Create HKEY\_CLASSES\_ROOT\\.osd with a default value of SoftGrid.osd.File - - Under HKEY\_LOCAL\_MACHINE\\software\\classes\\Softgrid.osd.file, create a string value named AppUserModelID with a data value of Microsoft.AppV.Client.Tray - -### Authorization - -During installation, you can use the **RequireAuthorizationIfCached** parameter to configure the client to require authorization from the server when the user tries to start an application. You should consider carefully how to set this parameter. If the App-V server is unavailable for any reason, the application will use the most recent stored state of this parameter to control user access to the application. If the user has not launched the application successfully before the App-V server becomes unavailable, they will not be able to launch the application until they can communicate with the server and receive authorization. However, if you set the parameter so that the client does not require authorization and if the server is unavailable, all previously cached applications can be started whether authorized or not. Also, if the user has permission to change the client to Work Offline mode through permissions or if the user is a local administrator, the user would be able to open all cached packages as if the App-V infrastructure was unavailable. - -### Antivirus Scanning - -Antivirus software running on an App-V Client computer can detect and report an infected file in the virtual environment. However, it cannot disinfect the file. If a virus is detected in the virtual environment, the antivirus software would perform the configured quarantine or repair operation in the cache, not in the actual package. Configure the antivirus software with an exception for the sftfs.fsd file. This file is the cache file that stores packages on the App-V Client. - -**Security Note:** - -If a virus is detected in an application or package deployed in the production environment, replace the application or package with a virus-free version. - -## Communication Between Client and Server - - -Publishing refreshes and package streaming are also areas where security considerations relating to client-server communication are important. - -### Publishing Refresh - -When the client communicates with the server to perform a publishing refresh, it uses the credentials of the logged on user to request information about the application packages. You should secure the communication that occurs between the App-V client and App-V Management Server to ensure that none of the publishing information can be tampered with in transit. This is done by using the Enhanced Security option, which will use RTSPS/HTTPS. Communication between the Client and the location where the ICO and OSD files are stored should use IPsec for SMB/CIFS shares and HTTPS for an IIS server. - -**Note**   -If you are using IIS to publish the ICO and OSD files, configure a MIME type for OSD=TXT; otherwise, IIS will refuse to serve the ICO and OSD files to clients. - - - -### Package Streaming - -When a user launches an application for the first time, or if auto-loading parameters have been set on the client, the application package is streamed from a server to the client cache. This process supports the RTSP/RTSPS, HTTP/HTTPS, and SMB/CIFS protocols. The OSD files control which protocols are used, unless the **ApplicationSourceRoot** or **OverrideURL** setting has been configured on the clients. You should configure communication to occur over RTSPS, HTTPS, or IPsec for SMB/CIFS to achieve higher levels of security. For more information about choosing which communication method to use, see the App-V Planning and Deployment Guide at . - -**Note**   -If you are using IIS to publish packages (SFT files), configure a MIME type for SFT=Binary; otherwise, IIS will refuse to serve the SFT files to clients. - - - -### Roaming Profiles and Folder Redirection - -The App-V system stores user-specific changes to packages in the usrvol\_sftfs\_v1.pkg file. This file is located in the Application Data folder of a user’s profile. Because the profile or a redirected Application Data folder is transferred between the client and the server, use IPsec to secure the communication. - -## Considerations for Internet-Facing Clients - - -For Internet-facing clients, it is important to consider whether the client is domain joined or non-domain joined. - -### Domain Joined Client - -By default, App-V Clients use Kerberos tickets that were issued by Active Directory Domain Services for authentication and authorization on the intranet. These Kerberos tickets are valid for 10 hours by default. The client will use this ticket to access the App-V server for as long as the ticket is valid, even if the computer is unable to connect to the domain controller to refresh the ticket. If the Kerberos ticket expires, the App-V client will revert to NTLM authentication and use the user’s cached credentials. - -### Non-Domain Joined Client - -If a user is home-based and the computer is not joined to the company domain, App-V can still support delivering applications. To authenticate and authorize a user to perform a publishing refresh and to start applications, configure the user account on the client computer to store the user name and password that has access to the App-V environment and to provide appropriate permissions to the applications. - -## Related topics - - -[Planning for Security and Protection](planning-for-security-and-protection.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-for-migration-from-previous-versions.md b/mdop/appv-v4/planning-for-migration-from-previous-versions.md deleted file mode 100644 index 31b155f1d0..0000000000 --- a/mdop/appv-v4/planning-for-migration-from-previous-versions.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Planning for Migration from Previous Versions -description: Planning for Migration from Previous Versions -author: eavena -ms.assetid: 62967bf1-542f-41b0-838f-c62f3430ac73 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Migration from Previous Versions - - -Before attempting to upgrade to Microsoft Application Virtualization 4.5 or later versions, any version prior to 4.1 must be upgraded to version 4.1. You should plan to upgrade your clients first, and then upgrade the server components. Clients that have been upgraded to 4.5 will continue to work with Application Virtualization servers that have not yet been upgraded. Earlier versions of the client are not supported on servers that have been upgraded to 4.5. For more information about upgrading the system components, see [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md). - -To help ensure a successful migration, the Application Virtualization system components should be upgraded in the following order: - -1. **Microsoft Application Virtualization Clients.** For step-by-step upgrade instructions, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md). - -2. **Microsoft Application Virtualization Servers and Database.** For step-by-step upgrade instructions, see [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md). - - **Note**   - If you have more than one server sharing access to the Application Virtualization database, all those servers must be taken offline while the database is being upgraded. You should follow your normal business practices for the database upgrade, but it is highly advisable that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the other servers. - - - -3. **Microsoft Application Virtualization Management Web Service.** This step applies only if the Management Web Service is on a separate server, which would require that you run the server installer program on that separate server to upgrade the Web service. Otherwise, the previous server upgrade step will automatically upgrade the Management Web Service. - -4. **Microsoft Application Virtualization Management Console.** This step applies only if the Management Console is on a separate computer, which would require that you run the server installer program on that separate computer to upgrade the console. Otherwise, the previous server upgrade step will upgrade the Management Console. - -5. **Microsoft Application Virtualization Sequencer.** For step-by-step instructions, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). Any virtual application packages sequenced in version 4.2 will not have to be re-sequenced for use with version 4.5. However, you should consider upgrading the virtual packages to the Microsoft Application Virtualization 4.5 format if you would like to apply default access control lists (ACLs) or generate a Windows Installer file. This is a simple process and requires only that the existing virtual application package be opened and saved with the 4.5 Sequencer. This can be automated by using the Application Virtualization Sequencer command-line interface. - -## App-V 4.6 Client Package Support - - -You can deploy packages created in previous versions of App-V to App-V 4.6 Clients. However, you must modify the associated **.osd** file so that it includes the appropriate operating system and chip architecture information. Use the following values. - - --- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          OS Value

          <OS VALUE=”Win2003TS”/>

          <OS VALUE=”Win2003TS64”/>

          <OS VALUE=”Win2008TS”/>

          <OS VALUE=”Win2008TS64”/>

          <OS VALUE=”Win2008R2TS64”/>

          <OS VALUE=”Win7”/>

          <OS VALUE=”Win764”/>

          <OS VALUE=”WinVista”/>

          <OS VALUE=”WinVista64”/>

          <OS VALUE=”WinXP”/>

          <OS VALUE=”WinXP64”/>

          - - - -To run a newly created 32-bit package, you must sequence the application on a computer running a 32-bit operating system with the App-V 4.6 Sequencer installed. After you have sequenced the application, in the Sequencer console, select the **Deployment** tab and then specify the appropriate operating system and chip architecture as required. - -**Important**   -Applications sequenced on a computer running a 64-bit operating system must be deployed to computers running a 64-bit operating system. New 32-bit packages created by using the App-V 4.6 Sequencer will not run on computers running the App-V 4.5 Client. - - - -To run new 64-bit packages on the App-V 4.6 Client, you must sequence the application on a computer running the App-V 4.6 Sequencer and that is running a 64-bit operating system. After you have sequenced the application, in the Sequencer console, select the **Deployment** tab and then specify the appropriate operating system and chip architecture as required. - -The following table lists which client versions will run packages created by using the various versions of the Sequencer. - - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Sequenced by using the App-V 4.2 SequencerSequenced by using the App-V 4.5 SequencerSequenced by using the 32-bit App-V 4.6 SequencerSequenced by using the 64-bit App-V 4.6 SequencerSequenced by using the 32-bit App-V 4.6 SP1 SequencerSequenced by using the 64-bit App-V 4.6 SP1 Sequencer

          4.2 Client

          Yes

          No

          No

          No

          No

          No

          4.5 Client ¹

          Yes

          Yes

          No

          No

          No

          No

          4.6 Client (32-bit)

          Yes

          Yes

          Yes

          No

          Yes

          No

          4.6 Client (64-bit)

          Yes

          Yes

          Yes

          Yes

          Yes

          Yes

          4.6 SP1 Client

          Yes

          Yes

          Yes

          No

          Yes

          No

          4.6 SP1 Client (64-bit)

          Yes

          Yes

          Yes

          Yes

          Yes

          Yes

          - - - -¹Applies to all versions of the App-V 4.5 Client, including App-V 4.5, App-V 4.5 CU1 and App-V 4.5 SP1. - -## Additional Migration Considerations - - -One of the features of the App-V 4.5 Sequencer is the ability to create Windows Installer files (.msi) as control points for virtual application package interoperability with electronic software distribution (ESD) systems such as Microsoft System Center Configuration Manager. Previous Windows Installer files created with the .msi tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 Client that is subsequently upgraded to 4.5 continue to work, although they cannot be installed on the 4.5 Client. However, they cannot be removed or upgraded unless they are upgraded in the 4.5 Sequencer. The original pre-4.5 virtual application package would need to be opened in the 4.5 Sequencer and then saved as a Windows Installer File. - -**Note**   -If the App-V 4.2 Client has already been upgraded to 4.5, it is possible to use script as a workaround to preserve the 4.2 packages on 4.5 clients and allow them to be managed. This script must copy two files, msvcp71.dll and msvcr71.dll, to the App-V installation folder and set the following registry key values under the registry key \[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\]: - -"ClientVersion"="4.2.1.20" - -"GlobalDataDirectory"="C:\\\\Documents and Settings\\\\All Users\\\\Documents\\\\" (a globally writeable location) - - - -Windows Installer files generated by the App-V 4.5 Sequencer display the error message "This package requires Microsoft Application Virtualization Client 4.5 or later" when you try to run them on an App-V 4.6 Client. Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi for the package. - -Any 4.2 reports that were created and saved will be overwritten when the server is upgraded to 4.5. If you need to keep these reports, you must save a backup copy of the SftMMC.msc file located in the SoftGrid Management Console folder on the server and use that copy to replace the new SftMMC.msc that is installed during the upgrade. - -For additional information about upgrading from previous versions, see [Upgrading to Microsoft Application Virtualization 4.5 FAQ](https://go.microsoft.com/fwlink/?LinkId=120358) (https://go.microsoft.com/fwlink/?LinkId=120358). - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-for-security-and-protection.md b/mdop/appv-v4/planning-for-security-and-protection.md deleted file mode 100644 index a229a68305..0000000000 --- a/mdop/appv-v4/planning-for-security-and-protection.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Planning for Security and Protection -description: Planning for Security and Protection -author: eavena -ms.assetid: d0e2ef81-c197-4020-ad85-8d66fe5c178f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Security and Protection - - -As an infrastructure administrator, you must provide a secure, productive, and supportable, environment. Security for the Microsoft Application Virtualization (App-V) system relies on proper setup of the software and the environment in which it operates. This section of the Planning and Deployment Guide provides guidance for configuring the various App-V components to enhance the security of your environment. You should carefully consider the exposure and attack surface of your App-V environment before deciding to deploy a system without applying the security recommendations outlined in this section. - -## In This Section - - -[Security and Protection Overview](security-and-protection-overview.md) -Provides overview information about the security and protection of your App-V system. - -[Planning for Server Security](planning-for-server-security.md) -Provides information you can use to configure the Application Virtualization Management Server and Application Virtualization Streaming Server. - -[Planning for Client Security](planning-for-client-security.md) -Provides information you can use to configure the Application Virtualization Management Desktop Client. - -[Planning for Sequencer Security](planning-for-sequencer-security.md) -Provides information you can use to configure the Application Virtualization Sequencer. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-sequencer-security.md b/mdop/appv-v4/planning-for-sequencer-security.md deleted file mode 100644 index fc925dca50..0000000000 --- a/mdop/appv-v4/planning-for-sequencer-security.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Planning for Sequencer Security -description: Planning for Sequencer Security -author: eavena -ms.assetid: 8043cb02-476d-4c28-a850-903a8ac5b2d3 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Sequencer Security - - -Incorporate recommended implementation practices as early as possible when configuring Application Virtualization (App-V) so that your Sequencer implementation is functional and more secure. If you have already configured the Sequencer, use the following best-practice guidelines to revisit your design decisions and analyze them from a security perspective. - -**Important** -The App-V Sequencer collects and deploys all application information recorded on the computer running the sequencer. You should ensure that all users accessing the computer running the Sequencer have administrative credentials. Users with user account credentials should not have access to control package contents and package files. If you are sequencing on a computer running Remote Desktop Services (formerly Terminal Services), make sure it is a computer that is dedicated to sequencing and that users with user account credentials are not connected to it during sequencing. - - - -## Sequencer Security Best Practices - - -Consider the following scenarios and the associated best practices when implementing and using the Application Virtualization (App-V) Sequencer: - -- **Virus scanning on the computer running the Sequencer**—It is recommended that you scan the computer running the Sequencer for viruses and then disable all antivirus and malware detection software on the computer running the Sequencer during the sequencing process. This will speed the sequencing process and prevent the antivirus and anti-malware software components from interfering with the sequencing process. Next install the sequenced package on a computer not running the Sequencer, and after successful installation, scan that computer for viruses. If viruses are found, the manufacturer of the software should be contacted to inform them of the infected source files and request an updated installation source without viruses. Optionally, the Sequencer could be scanned after the installation phase and if a virus is found, the software manufacturer should be contacted as mentioned above. - - **Note** - If a virus is detected in an application, the application should not be deployed to target computers. - - - -- **Capturing access control lists (ACLs) on NTFS files**—The App-V Sequencer captures NTFS file system permissions for the files that are monitored during the installation of the product. This capability allows you to more accurately replicate the intended behavior of the application, as if it were installed locally and not virtualized. In some scenarios, an application might store information that users were not intended to access within the application files. For example, an application could store credentials information in a file inside of the application. If ACLs are not enforced on the package, a user could potentially view and then use this information outside of the application. - - **Note** - You should not sequence applications that store unencrypted security-specific information, such as passwords, and so on. - - - -~~~ -During the installation phase, you can modify the default permissions of the files if necessary. After completion of the sequencing process, but before saving the package, you can choose whether to enforce security descriptors that were captured during the installation of the application. By default, App-V will enforce the security descriptors specified during the installation of the application. If you turn off security descriptor enforcement, you should test the application to ensure the removal of associated Access Control Lists (ACL) will not cause the application to perform unexpectedly. -~~~ - -- **Sequencer doesn’t capture registry ACLs**—Although the Sequencer captures the NTFS file system ACLs during the installation phase of sequencing, it does not capture the ACLs for the registry. Users will have full access to all registry keys for virtual applications except for services. However, if a user modifies the registry of a virtual application, the change will be stored in a specific store (**uservol\_sftfs\_v1.pkg**) and will not affect other users. - -- **Application services**—App-V provides support for application services that are part of a virtualized application. However, in the virtual environment, the security context that they will run as is limited. The only security contexts supported in a virtual environment are Local System, Local Service, and Network Service. During sequencing, if a security context is specified for an application service other than the three supported, the Local System security context will be applied in the virtual environment. If the application service is configured to use either Local Service or Network Service, it will be honored in the virtual environment. Configuring the service account can be done during the sequencing process using these three security contexts. - -- **Persisted security information**—When sequencing applications, you can install the application as a user would or you can develop an automated method for installing the application while being monitored. Everything that is not being excluded from the package will be captured as part of that package so that the application will have the necessary assets to run in a virtualized environment. Some applications store sensitive security information (such as passwords) during the installation; if persisted unprotected, this security information could be accessed by other users with access to the package. During installation, if an application installation asks for a password or other security-sensitive information, check with the documentation to ensure that it is either not persisted (removed after installation) or, if persisted, that it is protected (encrypted). - -- **Securing virtual application packages**—Always save virtual application packages in a secure location on the network to protect the package from being tampered with or corrupted. - -## Related topics - - -[Planning for Security and Protection](planning-for-security-and-protection.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-for-server-security.md b/mdop/appv-v4/planning-for-server-security.md deleted file mode 100644 index 2cc2c0459b..0000000000 --- a/mdop/appv-v4/planning-for-server-security.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Planning for Server Security -description: Planning for Server Security -author: eavena -ms.assetid: c7cd8227-b359-41e7-a8ae-d0d5718a76a2 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Server Security - - -To enhance the security of an environment, you must look at the exposure to any potential threats in the environment. Providing security for an App-V infrastructure requires you to use the specific App-V security features as well as the security practices and features for the underlying infrastructure. Securing the underlying infrastructure for services such as Internet Information Services (IIS), Active Directory Domain Services, and SQL Server will improve the overall security for your App-V system. - -The default settings for the server installation provide the highest levels of security. However, some of the components rely on underlying infrastructure that is not configured as part of the installation. Following up with post-installation steps will enhance the security of the App-V infrastructure. - -The content directory contains all of the packages that are to be streamed to clients. These resources need to be as secure as possible to eliminate many possible security threats. The following list offers some additional guidance: - -- UNC-based publishing and/or streaming—The permissions for this item should be the most restrictive in the environment. Use NTFS permissions to implement the most restrictive access control lists (ACLs) for the content directory (Users=Read, Administrators=Read and Write). - -- IIS used for publishing and/or streaming—Configure IIS to support only Windows Integrated authentication. Remove anonymous access to the IIS server, and restrict access to the directory with NTFS permissions. - -- RTSP/RTSPS to stream application packages—Configure the App-V Provider Policy to require authentication, enforce access permissions, and enable only required groups to have access to the provider policy. Configure applications with the appropriate permissions in the database. - -Keep the number of users with administrative privileges to a minimum to reduce possible threats to the data in the data store and to avoid publishing malicious applications into the infrastructure. - -## Application Virtualization Security - - -App-V uses several methods of communication between the various components of the infrastructure. When you plan your App-V infrastructure, securing the communications between servers can reduce the security risks that might already be present on the existing network. - -### Data Store - -The Application Virtualization Management Server and Application Virtualization Management Service communicate with the data store by using an SQL connection over TCP port 1433. The Management Server uses the data store to retrieve application and configuration data, and it writes usage information to the database. The Management Service communicates with the data store on behalf of an administrator who is configuring the App-V infrastructure. Because the data store contains critical information, it is important to minimize threats to this data. - -It is recommended that communications between App-V Management Server, Management Service and the data store be secured with Internet Protocol Security (IPsec). Specifically, create policies that secure the communication channel between the data store (SQL) and the Management Server and the data store and the Management Service. You can also deploy server and domain isolation with IPsec, ensuring all App-V infrastructure components communicate only with secure channels. For information about implementing IPsec, refer to the following documentation: - -- For Windows Server 2003, see (https://go.microsoft.com/fwlink/?LinkId=133226). - -- For Windows Server 2008, see (https://go.microsoft.com/fwlink/?LinkId=133227). - -### Content Directory - -The App-V Management Server installation configures a location for the content directory. This directory is the storage location for virtualized application packages. This location can be local to the server, or it can be placed on a remote network share. Therefore, implement IPsec to help secure the communication with a remote location for the content directory. - -You can also use a virtual directory on an IIS server to stream packages to the clients. If the virtual directory that is created for content is located on a remote source, use IPsec to help secure the communication between the IIS server and the remote storage location. - -The content directory contains all of the packages that are streamed to clients. These resources need to be as secure as possible to eliminate many possible security threats. - -### Security Protocols - -You can use RTSPS or HTTPS for enhanced secure communications. RTSPS is the protocol used by App-V servers, and HTTPS is the protocol used by IIS servers. These protocols are used when publishing applications from the server to the Application Virtualization Desktop Client. After you determine the desired protocol, add a publishing server that uses that protocol. - -### Configuring App-V Servers for RTSPS - -Installing or configuring an App-V Management Server or Streaming Server to use Enhanced Security (for example, TLS) requires that an X.509 V3 certificate be provisioned to the App-V server. When you prepare to install or configure security for a server, you must fulfill some specific requirements. Technical requirements for deploying and configuring certificates for a more secure App-V Management Server or Streaming Server include the following: - -- Certificate must be valid. Otherwise, the client terminates the connection. - -- Certificate must contain the correct Enhanced Key Usage (EKU) - Server Authentication (OID 1.3.6.1.5.5.7.3.1). Otherwise, the client terminates the connection. - -- Certificate fully qualified domain name (FQDN) must match the server on which it is installed. For example, if the client is calling `RTSPS://Myserver.mycompany.com/content/MyApp.sft`, but the certificate **Issued To** field contains `Myserver1.mycompany.com`, the client will not connect to the server and the session is terminated, even if `Myserver.mycompany.com` and `Myserver1.mycompany.com` resolve to the same IP address. - - **Note**   - If you use App-V in a network load balanced cluster, the certificate must be configured with *Subject Alternate Names* (SANs) to support RTSPS. For information about configuring the certification authority (CA) and creating certificates with SANs, see (https://go.microsoft.com/fwlink/?LinkId=133228). - - - -- The CA issuing the certificate to the App-V server must be trusted by the client connecting to the server. Otherwise, the client terminates the connection. - -- You must change the permissions for the *Certificate Private Key* to enable access by the Server App-V Service. By default, the App-V Management Server and Streaming Server services run under the Network Service account. When a PKCS\#10 is generated on the server, a private key is created. Only the Local System and Administrators groups have access to this key. These default ACLs prevent the App-V server from accepting secure connections. - - **Note**   - For information about configuring a public key infrastructure (PKI), see (https://go.microsoft.com/fwlink/?LinkId=133229). - - - -### Configuring IIS Servers with HTTPS - -App-V might use IIS servers in certain infrastructure configurations. For more information about configuring IIS servers, see (https://go.microsoft.com/fwlink/?LinkId=133230). - -**Note**   -If you are using IIS to publish the ICO and OSD files, configure a MIME type for OSD=TXT; otherwise, IIS will refuse to serve the ICO and OSD files to clients. - - - -### Application-Level Security - -You can configure the servers to stream specific applications to a user’s desktop. However, access permission actually is granted at the package level, not at the application level. Although a specific application might not be published to the user’s desktop, if the user has permission to add applications or is an administrator on the client computer, the user can create and use a shortcut on the client to run all the applications in a package. - -## Configuring App-V Administration for a Distributed Environment - - -When designing the infrastructure for your specific organization, you can install the App-V Management Web Service on a computer other than the computer where you install the App-V Management Server. Common reasons for separating these App-V components include the following: - -- Performance - -- Reliability - -- Availability - -- Scalability - -For the infrastructure to operate correctly, separating the App-V Management Console, Management Server and Management Web Service requires additional configuration. For detailed information about how to configure the server, see [How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md). - -## Related topics - - -[Planning for Security and Protection](planning-for-security-and-protection.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md b/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md deleted file mode 100644 index 90f6f01821..0000000000 --- a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Planning the Application Virtualization Sequencer Implementation -description: Planning the Application Virtualization Sequencer Implementation -author: eavena -ms.assetid: 052f32fe-ad13-4921-a8ce-4a657eb2b2bf -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning the Application Virtualization Sequencer Implementation - - -Sequencing, the process used by Application Virtualization to create virtual applications and application packages, requires the use of a computer with the Application Virtualization Sequencer software installed. - -During the sequencing process, the Sequencer is placed in monitor mode, and the application to be sequenced is installed on the sequencing computer. Next, the sequenced application is started, and its most important and commonly used functions are exercised so that the monitoring process can configure the primary feature block, which contains the minimum content in an application package that is necessary for an application to run. When these steps are complete, monitoring mode is stopped and the sequenced application is saved and tested to verify correct operation. - -When deciding which applications to choose for sequencing, remember that certain applications cannot be sequenced. These include certain parts of the Windows operating system, such as Internet Explorer, device drivers, and applications that start services at boot time. - -For step-by-step information about installing the Sequencer, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - -**Important**   -The entire sequencing process plan should be reviewed and approved by your corporate security team. Sequencer operations would usually be kept separate from the production environment in a lab. This can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers will need connectivity to the corporate network to copy finished packages over to the production servers. However, because they are typically operated without antivirus protection, they must not be on the corporate network unprotected—for example, you might be able to operate behind a firewall or on an isolated network segment. Using Virtual Machines configured to share an isolated virtual network might also be an acceptable approach. Follow your corporate security policies to safely address this situation. - - - -Key steps for planning the sequencing process include the following: - -- Consider the number of applications you expect to process each month, the size of those applications, and add an allowance for sequencing future updates. Packages can be up to 4 GB in size, compressed or uncompressed. - -- Prepare and document a methodical, repeatable process for your organization to follow when sequencing each application. This should include the use of a checklist for each run, as well as a version control process. The use of a tracking log for each sequenced application is also very helpful when investigating possible technical issues with a package. - -- For sequencing applications, use high-performing computers that are optimized for processing throughput, with at least 4 GB of RAM and a fast CPU (3 GHz or faster). Fast hard disks and the use of separate disk volumes can also improve performance. Virtual Machines are ideal for sequencing because they can easily be reset, or you can use a physical computer with a clean image on a local partition to enable rapid re-imaging after each package sequencing operation has been completed. - - **Important**   - Running the App-V sequencer in Safe Mode is not supported. - - - -- Verify that you understand the sequenced application’s operating environment, including integration elements such as Microsoft Office or the Java Runtime Environment, because this will often determine whether anything has to be installed on the sequencing computer prior to sequencing the application. - -- Ensure that each new sequencing operation always starts with a clean base image. Make sure that the sequencing computer has been reset, either by restoring the saved image to a physical computer or by restarting a virtual machine after discarding all changes. The base image should have the latest updates applied from Windows Update before saving. - -- Turn off anything on the sequencing computer that can interfere with the install monitoring process, such antivirus scanners and Windows Update, because having a stable platform during the sequencing process is essential. Because this step incurs significant security risks, ensure that the correct precautions are taken to protect the computer and network as well as the sequenced application package. We recommend that you do an antivirus scan of application packages before sequencing them. - -- Include a detailed process for testing each application after sequencing. Testing the sequenced application will determine whether it functions correctly and is an essential part of the process prior to deploying the virtualized application to end users. As the final step in testing prior to wide-scale deployment to end users, you should also plan for a pilot deployment to a test group. - -- When testing sequenced applications, choose computer equipment of the same type and running the same operating systems that are in use in the company production environment. As long as they are configured properly, either virtual machines or physical machines can be used. - -## Related topics - - -[Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) - -[Security and Protection Overview](security-and-protection-overview.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md deleted file mode 100644 index f81b40c0e2..0000000000 --- a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation -description: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation -author: eavena -ms.assetid: 3a57306e-5c54-4fde-8593-fe3b788f18d3 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation - - -If you want to use Application Virtualization Streaming Servers in conjunction with your Application Virtualization Management Server-based implementation, you can choose from several alternatives, taking advantage of whatever infrastructure is already in place. For example, if you already have servers in your field branch offices, you can place the Application Virtualization \\CONTENT share on those servers and then configure the clients to use that content share as their application content source. If you choose to use only Application Virtualization Management Servers—for example, because you have only a single office—the clients can stream content from that server. - -The supported options include using a file server, an IIS server, or an Application Virtualization Streaming Server. You could also install the Application Virtualization Streaming Server on an existing file server or IIS server. The characteristics of these different options are summarized in the following table. - -**Note**   -The active upgrade feature enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application. The App-V clients will automatically receive the latest version of the application from the App-V Management Server or Streaming Server the next time the user starts the application. Use of the RTSP(S) protocol is required for this feature. - - - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Server TypeProtocolAdvantagesDisadvantagesLinks

          File server

          SMB

            -
          • Simple low-cost solution to configure existing file server with \CONTENT share

          • -
            -
          • No active upgrade

          • -

          How to Configure the File Server

          IIS server

          HTTP/ HTTPS

            -
          • Supports enhanced security using HTTPS protocol

          • -
          • Supports streaming to remote computers across the Internet

          • -
          • Only one port in firewall to open

          • -
          • Scalable

          • -
          • Familiar protocol

          • -
            -
          • Need to manage IIS

          • -
          • No active upgrade

          • -

          How to Configure the Server for IIS

          Application Virtualization Streaming Server

          RTSP/ RTSPS

            -
          • Active upgrade

          • -
          • Supports enhanced security using RTSPS protocol

          • -
          • Only one port in firewall to open

          • -
            -
          • Dual infrastructure

          • -
          • Server administration requirement

          • -

          How to Configure the Application Virtualization Streaming Servers

          Application Virtualization Management Server

          RTSP/ RTSPS

            -
          • Active upgrade

          • -
          • Supports enhanced security using RTSPS protocol

          • -
          • Only one port in firewall to open

          • -
            -
          • Dual infrastructure

          • -
          • Server administration requirement

          • -

          How to Configure the Application Virtualization Management Servers

          - - - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) - -[Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md deleted file mode 100644 index 0ec37daf28..0000000000 --- a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Planning Your Streaming Solution in an Electronic Software Distribution Implementation -description: Planning Your Streaming Solution in an Electronic Software Distribution Implementation -author: eavena -ms.assetid: bc18772a-f169-486f-adb1-7af1a31845aa -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning Your Streaming Solution in an Electronic Software Distribution Implementation - - -If you decide to use streaming servers in conjunction with your ESD system to make application content available to your end user computers, you can choose from several alternatives, taking advantage of whatever infrastructure is already in place. For example, if your ESD system has software distribution shares on servers in your field branch offices, you can place the Application Virtualization \\CONTENT share on those servers and then configure the clients to use that content share as their application content source. The supported options include using a file server or an IIS server. You could also install the Application Virtualization Streaming Server on an existing file server or IIS server. - -The Application Virtualization Streaming Server provides support for the active upgrade feature in Application Virtualization. The active upgrade feature enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application. The App-V clients will automatically receive the latest version of the application from the App-V Management Server or Streaming Server the next time the user starts the application. Use of the RTSP(S) protocol is required for this feature. If you choose not to use the Application Virtualization Streaming Server, you will need to explicitly manage application package upgrades by using the ESD system. - -**Note**   -Access to the applications is controlled by means of Security Groups in Active Directory Domain Services, so you will need to plan a process for setting up a security group for each virtual application and for managing which users are added to each group. The Application Virtualization system administrator configures each streaming server to use these Active Directory groups by applying ACLs to the application directories under the CONTENT share, which controls access to the packages based on Active Directory group membership. - - - -The characteristics of the available streaming options are summarized in the following table. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Server TypeProtocolAdvantagesDisadvantagesLinks

          File server

          SMB

            -
          • Simple low-cost solution to configure existing file server with \CONTENT share

          • -
            -
          • No active upgrade

          • -

          How to Configure the File Server

          IIS server

          HTTP/ HTTPS

            -
          • Supports enhanced security using HTTPS protocol

          • -
          • Supports streaming to remote computers across the Internet

          • -
          • Only one port in firewall to open

          • -
          • Scalable

          • -
          • Familiar protocol

          • -
            -
          • Need to manage IIS

          • -
          • No active upgrade

          • -

          How to Configure the Server for IIS

          Application Virtualization Streaming Server

          RTSP/ RTSPS

            -
          • Active upgrade

          • -
          • Supports enhanced security using RTSPS protocol

          • -
          • Only one port in firewall to open

          • -
            -
          • Dual infrastructure

          • -
          • Server administration requirement

          • -

          How to Configure the Application Virtualization Management Servers

          - - - -## Related topics - - -[How to Configure Servers for ESD-Based Deployment](how-to-configure-servers-for-esd-based-deployment.md) - -[Security and Protection Overview](security-and-protection-overview.md) - -[Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) - - - - - - - - - diff --git a/mdop/appv-v4/prepare-computer-page--learn-more-.md b/mdop/appv-v4/prepare-computer-page--learn-more-.md deleted file mode 100644 index 4920b634e8..0000000000 --- a/mdop/appv-v4/prepare-computer-page--learn-more-.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Prepare Computer Page (Learn More) -description: Prepare Computer Page (Learn More) -author: eavena -ms.assetid: a401ce3d-b8f7-4b3f-9be9-ecf6d8b544fd -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Prepare Computer Page (Learn More) - - -Use the **Prepare Computer** to review the issues that might cause the virtual application package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, you can proceed to the next step. - -This page contains the following elements. - -**Description** -Displays the potential conflicting applications or programs that are currently running on the computer running the App-V Sequencer. - -**Resolution** -Displays the recommended action to ensure that the computer running the Sequencer has been optimized to create the virtual application package. - -**Refresh** -Refreshes the information displayed in the **Description** pane. After you performed the suggested steps, click **Refresh**. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/properties-tab-keep.md b/mdop/appv-v4/properties-tab-keep.md deleted file mode 100644 index af45012be4..0000000000 --- a/mdop/appv-v4/properties-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Properties Tab -description: Properties Tab -author: eavena -ms.assetid: 6ff20678-6766-4f0d-8bbb-f19b224682a1 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Properties Tab - - -The **Properties** tab provides basic statistical information about a sequenced application package. - -## In This Section - - -[About the Properties Tab](about-the-properties-tab.md) -Provides general information about the **Properties** tab. - -[How to Change Package Properties](how-to-change-package-properties.md) -Provides the procedure to change package properties using the **Properties** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/provider-policies-node.md b/mdop/appv-v4/provider-policies-node.md deleted file mode 100644 index 23667457d8..0000000000 --- a/mdop/appv-v4/provider-policies-node.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Provider Policies Node -description: Provider Policies Node -author: eavena -ms.assetid: 89b47076-7732-4128-93cc-8e6d5b671c8e -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Provider Policies Node - - -The **Provider Policies** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of provider policies. Right-click the **Provider Policies** node to display a pop-up menu that contains the following elements. - -**New Provider Policy** -Displays the New Provider Policy Wizard. This wizard consists of the following pages: - -1. Enter a name in the **Provider Policy Name** field. Select the **Manage client desktop using the Management Console** check box if you want that capability. Select one or both of the following check boxes if you want the associated functionality: - - - **Refresh publishing configuration when a user logs in** - - - **Refresh configuration every**. After selecting this option, enter a number and select the unit from the drop-down menu. Valid entries range from a minimum of **30 minutes** to a maximum of **999 days**. - -2. Click **Add** or **Remove** to add or remove a group assignment. Use the standard **Windows Browse** dialog box to find a user group. - -3. Select one of the following check boxes on the **Provider Pipeline Configuration** dialog box to enable the associated feature: - - - **Authentication**—Select the type of authentication from the drop-down list. - - - **Enforce Access Permission Settings** - - - **Log Usage Information** - - - **Licensing**—Select an enforcement scheme from the drop-down list. - -4. Click **Finish** to add the new provider policy. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/provider-policies-results-pane-columns.md b/mdop/appv-v4/provider-policies-results-pane-columns.md deleted file mode 100644 index edc54d5af9..0000000000 --- a/mdop/appv-v4/provider-policies-results-pane-columns.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Provider Policies Results Pane Columns -description: Provider Policies Results Pane Columns -author: eavena -ms.assetid: f9456f17-3106-4e5a-9a8c-df3af66986e1 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Provider Policies Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays one column for the provider policies. If there are additional columns available, you can add and remove them. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - -
          ColumnContents

          Name

          This column displays the name of the provider policy.

          - -  - -## Related topics - - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/provider-policies-results-pane.md b/mdop/appv-v4/provider-policies-results-pane.md deleted file mode 100644 index 2f0f38d356..0000000000 --- a/mdop/appv-v4/provider-policies-results-pane.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Provider Policies Results Pane -description: Provider Policies Results Pane -author: eavena -ms.assetid: 17ea0836-bfb5-4966-8778-155444d81e64 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Provider Policies Results Pane - - -The **Provider Policies Results** pane in the Application Virtualization Server Management Console displays a list of the available provider policies. - -Right-click any provider policy to display the following elements. - -**Delete** -This menu item enables you to delete a provider policy from the **Results** pane. - -**Rename** -This menu item enables you to change the name of a provider policy in the **Results** pane. - -**Properties** -This menu item displays the **Properties** dialog box for the selected provider policy. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the **Manage client desktop using the** **Management Console** check box if you want to centrally manage shortcuts on the client desktops from the Application Virtualization Server Management Console. If you choose to manage shortcuts from the console, you can select check boxes to refresh the desktop every time a user logs in and at intervals you specify. - -- **Group Assignment**—Enables you to add and remove user groups assigned to the provider policy. - -- **Provider Pipeline**—Enables you to specify the authentication required. - - - Select the desired check boxes for **Enforce Access Permission Settings**, **Log Usage Information**, and **Licensing**. If you select the **Licensing** check box, select **Audit License Usage Only** or **Enforce License Policies** from the drop-down list. The first option monitors license usage, while the second option strictly enforces your licensing policy. Click **Finish**, and then read the prompt and click **OK** to continue. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click anywhere in the **Results** pane, except on a provider policy, to display a pop-up menu that contains the following elements. - -**Refresh** -Select this menu item to refresh the view of the provider policies. - -**Export List** -With this menu item, you can create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This menu item lets you change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system of the Application Virtualization Server Management Console. - -## Related topics - - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publish-app.md b/mdop/appv-v4/publish-app.md deleted file mode 100644 index 13b9f2635e..0000000000 --- a/mdop/appv-v4/publish-app.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: PUBLISH APP -description: PUBLISH APP -author: eavena -ms.assetid: f25f06a8-ca23-435b-a0c2-16a5f39b6b97 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# PUBLISH APP - - -Publishes an application shortcut to the user's Start menu, desktop, or other specified location. - -`SFTMIME PUBLISH APP:application {/DESKTOP | /START | /TARGET target-path} [/ICON icon-pathname] [/DISPLAY display-name] [/ARGS command-args...] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APPLICATION:<application>

          The name and version (optional) of the application.

          /DESKTOP

          Publishes a shortcut to the user's desktop.

          /START

          Publishes a shortcut to the Application Virtualization Applications folder in the Programs folder of the Start menu.

          /TARGET <target-path>

          The absolute path where the shortcut should be published.

          /ICON <icon-pathname>

          The path or URL for the icon file.

          /DISPLAY <display-name>

          The display name for the shortcut.

          /ARGS <command-args>

          Parameters to be passed to the application.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publish-package.md b/mdop/appv-v4/publish-package.md deleted file mode 100644 index 04b4e5c319..0000000000 --- a/mdop/appv-v4/publish-package.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: PUBLISH PACKAGE -description: PUBLISH PACKAGE -author: eavena -ms.assetid: a33e72dd-194f-4283-8e99-4584ab13de53 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# PUBLISH PACKAGE - - -Publishes the contents of an entire package. - -`SFTMIME PUBLISH PACKAGE:package-name /MANIFEST manifest-path [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          PACKAGE:<package-name>

          User-visible and user-friendly name for the package.

          /MANIFEST <manifest-path>

          The path or URL of the manifest file that lists the applications included in the package and all of their publishing information.

          /GLOBAL

          If present, the package will be available for all users on this computer.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -**Important**   -The package must already have been added to the Application Virtualization Client, and the manifest file is required. - -To use the **GLOBAL** parameter, the PUBLISH PACKAGE command must be run as local Administrator; otherwise, only **ManageTypes** and **PublishShortcut** permissions are needed. - -Publishing without the **GLOBAL** parameter grants the user access to the applications in the package and publishes the file types and shortcuts listed in the manifest to the user’s profile. - -Publishing with the **GLOBAL** parameter adds the file types and shortcuts listed in the manifest to the “All Users” profile. - -If the package is not global before the call and the **GLOBAL** parameter is used, the package is made global and available to all users. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/publishing-servers-node.md b/mdop/appv-v4/publishing-servers-node.md deleted file mode 100644 index 76d964d714..0000000000 --- a/mdop/appv-v4/publishing-servers-node.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Publishing Servers Node -description: Publishing Servers Node -author: eavena -ms.assetid: b5823c6c-15bc-4e8d-aeeb-acc366ffedd1 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Servers Node - - -The **Publishing Servers** node is one level below the **Application Virtualization** node in the **Scope** pane of the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of publishing servers. - -Right-click the **Publishing Servers** node to display a pop-up menu that contains the following elements. - -**New Server** -This menu item displays the New Server Wizard. This wizard consists of two pages: - -1. Enter a server display name and server type: - - - **Display Name**—Enter a name that you want displayed for the server. This field is blank by default. - - - **Type**—Choose the server type from the drop-down list of server types. - -2. Specify the connection settings for the server: - - - **Host Name**—Enter the name or IP address for the server. - - - **Port**—Enter a numeric value that corresponds to the port number. The default value is 554 if the server type is "Application Virtualization Server" and 80 if the server type is "Standard HTTP Server." - - - **Path**—This field defaults to "/" and is read-only when the server type is "Application Virtualization Server" or “Enhanced Security Application Virtualization Server”. When the server type is “Standard HTTP Server” or “Enhanced Security HTTP Server”, the **Path** field is also editable. - -**New Window from Here** -Select this menu item to open a new management console with the selected node as the root node. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items enables you to change the appearance and content of the **Results** pane. - -**Refresh** -Select this item to refresh the management console. - -**Help** -This item displays the help system for the management console. - -## Related topics - - -[Publishing Servers Results Pane](publishing-servers-results-pane.md) - -[Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publishing-servers-results-pane-columns.md b/mdop/appv-v4/publishing-servers-results-pane-columns.md deleted file mode 100644 index 4d18f6216d..0000000000 --- a/mdop/appv-v4/publishing-servers-results-pane-columns.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Publishing Servers Results Pane Columns -description: Publishing Servers Results Pane Columns -author: eavena -ms.assetid: ad875715-50b3-4881-a6b3-586238d12527 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Servers Results Pane Columns - - -The **Publishing Servers Results** pane can display a variety of columns. **Name**, **URL**, and **Next Refresh** are shown by default. - -**Note**   -You can add or remove a column simply by right-clicking in the **Results** pane, selecting **View**, then selecting **Add/Remove Columns**. - - - -The list can be sorted by any of the columns. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text (for example, **Next Refresh**), dates and times are considered to come before any other text. - -The available column names contain the following elements. - -**Name** -The display name for the server. - -**URL** -The protocol, server name, server port, and path combined into a URL. - -**Next User Refresh** -The next time a refresh is scheduled for the current user. Displays the time if periodic refreshes are set up. Displays **On Login** if the server is set to refresh only on login. Displays **Manual** if automatic refresh is not enabled. - -**Default Refresh Policy** -Displays **Manual**, **On Login**, or **Periodic** to describe how the server is configured. - -**Host** -The name or IP address for the server. - -**Type** -Displays **HTTP** or **Virtual Application** to indicate the server type. - -**Port** -The port on the server to be used. - -**Path** -The path on the server (generally just "/" for Application Virtualization Servers). - -**Last User Refresh** -The time the last refresh occurred for the current user. - -**Last System Refresh** -The last time a refresh happened from this server for any user. - -## Related topics - - -[Publishing Servers Node](publishing-servers-node.md) - -[Publishing Servers Results Pane](publishing-servers-results-pane.md) - - - - - - - - - diff --git a/mdop/appv-v4/publishing-servers-results-pane.md b/mdop/appv-v4/publishing-servers-results-pane.md deleted file mode 100644 index 09a6240706..0000000000 --- a/mdop/appv-v4/publishing-servers-results-pane.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Publishing Servers Results Pane -description: Publishing Servers Results Pane -author: eavena -ms.assetid: ee0662e8-9623-4a7c-b6dc-657fa3f56161 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Servers Results Pane - - -The **Publishing Servers** **Results** pane is one level below the **System** pane in the Application Virtualization Client Management Console, and it displays a list of the available application publishing servers. - -To display specific options for the application publishing servers, right-click any server to display a pop-up menu that contains the following elements. - -**Refresh Server** -Refreshes the application and file type associations from the selected application publishing server. - -**Delete** -Deletes the server from the list. - -**Refresh** -Refreshes the contents of the **Results** pane. - -**Properties** -- Click the **General** tab, where you can change the server name, select a type from the drop-down list of server types, and specify the host name and port. When the server type is Standard HTTP Server or Enhanced Security HTTP Server, the **Path** field is also editable. - -- Click the **Refresh** tab, where the **Refresh publishing on user login** check box is selected by default. To change the refresh rate, select the **Refresh publishing every** check box and enter a number that represents the frequency in the field. Then select **Minutes**, **Hours**, **Days** from the drop-down menu. (The minimum amount of time you can enter is 30 minutes.) - -**Help** -Displays the help system for the management console. - -To display general options for the **Result** pane, right-click anywhere in the **Result** pane to display a pop-up menu that contains the following elements. - -**New Server** -- On page one of the wizard, enter the name of the server in the **Display Name** field and select the server type from the **Type** drop-down list. You can choose **Application Virtualization Server**, **Enhanced Security Application Virtualization Server**, **Standard HTTP Server**, or **Enhanced Security HTTP Server** from the drop-down list of server types. - -- On page two of the wizard, type the appropriate information into the **Host Name** and **Port** fields. The **Path** field is not editable for Application Virtualization Servers. You must enter a path for Standard HTTP Server or Enhanced Security HTTP Server. - -**Refresh** -Refreshes the contents of the **Results** pane. - -**Export List** -Can be used to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Enables you to change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the management console. - -## Related topics - - -[Publishing Servers Node](publishing-servers-node.md) - -[Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md b/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md deleted file mode 100644 index 3e8cc15328..0000000000 --- a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Publishing Virtual Applications Using Application Virtualization Management Servers -description: Publishing Virtual Applications Using Application Virtualization Management Servers -author: eavena -ms.assetid: f3d79284-3f82-4ca3-b741-1a80b61490da -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Virtual Applications Using Application Virtualization Management Servers - - -In an Application Virtualization Server-based deployment, virtual application packages that have been sequenced, tested, and found deployable are copied to the main CONTENT share to be used by the Application Virtualization Management Server. After the packages are imported on the Application Virtualization Management Server, they can be published to the end users. - -**Note**   -The CONTENT share should be located on the server’s attached disk storage. Using a network storage device such as a SAN or a DFS share should be considered carefully because of the network impact. - - - -Applications are provisioned to Active Directory groups. Typically, the Application Virtualization administrator will create Active Directory groups for each virtual application to be published and then add the appropriate users to those groups. When the users log on to their workstations, the Application Virtualization Client, by default, performs a publishing refresh using the credentials of the logged on user. The user can then start applications from wherever the shortcuts have been placed. The Application Virtualization administrator determines where and how many shortcuts are located on the client system during the sequencing of the application. - -**Note**   -A *publishing refresh* is a call to the Application Virtualization Server that is defined on the Application Virtualization Client, to determine which virtual application shortcuts are sent to the client for use by the end user. - - - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) - -[Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) - - - - - - - - - diff --git a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md b/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md deleted file mode 100644 index 9201d18ee2..0000000000 --- a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Publishing Virtual Applications Using Electronic Software Distribution -description: Publishing Virtual Applications Using Electronic Software Distribution -author: eavena -ms.assetid: 295fbc1d-ed1c-43b4-aeee-0df384d4e630 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Virtual Applications Using Electronic Software Distribution - - -An electronic software distribution (ESD) system is designed to efficiently move software to many different computers over slow or fast network connections. With Application Virtualization, using an ESD system, you can use one of the following methods to distribute your virtual application packages: - -- Configure your ESD system to distribute the packages directly to each client computer by using the Windows Installer version of the package generated by the Application Virtualization Sequencer. The Windows Installer file contains the icons, package definition information, and the content, and when you use Windows Installer, it publishes the icons to the Windows desktop and Start menu and loads the package content into the Application Virtualization Client cache. The user can immediately start using the applications without any further setup requirements. Upgrading a package to a newer version is accomplished by using Windows Installer to uninstall the package.msi file and then to install the new version. - -- Place the package content on a software distribution point or Application Virtualization Streaming Server that is readily accessible to the client computers over a network connection with good bandwidth, such as a LAN. For example, you might use the existing ESD system distribution point computers in each branch office. Using command-line parameters to define the streaming source from which clients will stream the virtual application package, the ESD system would deploy the Windows Installer version of the package to each client. The ESD system could also be used to copy the SFT file that contains the package content to the file share on all streaming servers. Upgrading a package to a newer version is accomplished by using Windows Installer to uninstall the package.msi file and then install the new version. - -- As an alternative to using the self-contained Windows Installer file in either of the preceding modes to deploy the packages, you can control the deployment in a much more detailed way by using the Application Virtualization command-line language SFTMIME. This provides many commands to control all aspects of managing the packages. While SFTMIME is powerful, it is also complex, so administrators should plan to create all commands as scripts and thoroughly test them in a test environment prior to production use. For more information about available SFTMIME commands, see [SFTMIME Command Reference](sftmime--command-reference.md). - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -[Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/query-obj.md b/mdop/appv-v4/query-obj.md deleted file mode 100644 index ffe63b39cb..0000000000 --- a/mdop/appv-v4/query-obj.md +++ /dev/null @@ -1,142 +0,0 @@ ---- -title: QUERY OBJ -description: QUERY OBJ -author: eavena -ms.assetid: 55abf0d1-c779-4172-8357-552ab010933b -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# QUERY OBJ - - -Returns a tab-delimited list of current applications, packages, file type associations, or publishing servers. - -`SFTMIME QUERY OBJ:{APP|PACKAGE|TYPE|SERVER} [/SHORT] [/GLOBAL] [/LOG log-pathname | /CONSOLE ]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP

          Returns a list of applications.

          PACKAGE

          Returns a list of packages.

          TYPE

          Returns a list of file type associations.

          SERVER

          Returns a list of publishing servers.

          /SHORT

          Without displaying the full properties of each, returns a list of application names, packages, associations, or server names.

          /GLOBAL

          For applications, returns all known applications instead of only the ones the current user has access to. For packages, returns all known packages instead of only the ones the current user has access to. For associations, returns only associations that apply to all users, not user-specific ones. Not valid for servers.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -**Note**   -In version 4.6, a new column has been added to the output of SFTMIME QUERY OBJ:APP \[/GLOBAL\]. The last column of the output is a numeric value that indicates whether an application is published or not. - -PUBLISHED=1 means the application was published by a Publishing Server refresh, by installing the application by using a Windows Installer file (.MSI), or by running an SFTMIME ADD PACKAGE, CONFIGURE PACKAGE or PUBLISH PACKAGE command by using a package manifest. - -PUBLISHED=0 means the application has not been published or it is no longer published as a result of performing a Clear operation or running an SFTMIME UNPUBLISH command. - -If you use the /GLOBAL parameter, the PUBLISHED state will be 1 for applications that were published globally and 0 for those applications that were published under user contexts. Without the /GLOBAL parameter, a PUBLISHED state of 1 is returned for applications published in the context of the user running the command, and a state of 0 is returned for those applications that are published globally. - - - -The SFTMIME QUERY OBJ command can be used to query for information on all of the objects shown above—applications, packages, file type associations, and servers. To show how you might use the SFTMIME QUERY OBJ command in your normal operations tasks, the following example demonstrates the process you would follow if you wanted to set the OVERRIDEURL parameter value for a specific package to specify a new path to the package content.  - -1. To find the package that you want to configure, run the following command: - - `SFTMIME QUERY OBJ:PACKAGE` - - This command returns each discovered package name as a GUID in the first column of output—for example, {AF78ABE1-57D4-4297-89DE-C308684AEDD6}. - -2. To set the OVERRIDEURL parameter value, you use the SFTMIME [CONFIGURE PACKAGE](configure-package.md) command. For example, to set the OVERRIDEURL value for this package to a value of *\\\\server\\share\\mypackage.sft*, use the SFTMIME CONFIGURE PACKAGE command and give it the selected package GUID from the output of the SFTMIME QUERY OBJ command in step 1, followed by the OVERRIDEURL parameter and its new value, as follows: - - `SFTMIME CONFIGURE PACKAGE:"{AF78ABE1-57D4-4297-89DE-C308684AEDD6}" /OVERRIDEURL "\\\\server\\share\\mypackage.sft "` - -For version 4.6 SP2, the following option has been added. - - ---- - - - - - - -

          /NO-UPDATE-FTA-SHORTCUT

          Indicates the current state of the /NO-UPDATE-FTA-SHORTCUT flag.

          - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/refresh-server.md b/mdop/appv-v4/refresh-server.md deleted file mode 100644 index ce416e2f57..0000000000 --- a/mdop/appv-v4/refresh-server.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: REFRESH SERVER -description: REFRESH SERVER -author: eavena -ms.assetid: 232df842-a160-46cd-b60b-f464cd9a0086 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# REFRESH SERVER - - -This command updates publishing information from a server. - -`SFTMIME REFRESH SERVER:server-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          SERVER:<server-name>

          The display name of the server.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/repair-app.md b/mdop/appv-v4/repair-app.md deleted file mode 100644 index 8028a99b00..0000000000 --- a/mdop/appv-v4/repair-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: REPAIR APP -description: REPAIR APP -author: eavena -ms.assetid: 892b556b-612d-4531-890e-4cfc2ac88d9f -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# REPAIR APP - - -This command resets your personal settings for an application. - -`SFTMIME REPAIR APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/reports-node.md b/mdop/appv-v4/reports-node.md deleted file mode 100644 index 3a134a0bf2..0000000000 --- a/mdop/appv-v4/reports-node.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Reports Node -description: Reports Node -author: eavena -ms.assetid: b7fdc52d-f112-4a65-af25-134398810e9b -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Reports Node - - -The **Reports** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of reports. Right-click the node to display a pop-up menu that contains the following elements. - -**New Report** -Displays the New Report Wizard. The wizard has several pages. Depending on which report you select, the remaining pages in the wizard change for the requirements of that report type. Scan the following list of pages to find the pages that refer to your report: - -- **Report Name**—Enables you to select a report type from the **Report Type** drop-down list. For more information, see [Application Virtualization Report Types](application-virtualization-report-types.md). - -- **Report Period**—Enables you to select a radio button to specify the frequency for running the report. - -- **Server**—Enables you to select the **Server**, **Server Group**, or **Enterprise** radio button, and to select the server from the **Server** field and the server group from the **Server Group** drop-down list. - -- **Application**—Enables you to select an application from the drop-down list of available applications. - -- When prompted, click **Finish** to add the report. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click any report displayed under the **Reports** node to display a pop-up menu that contains the following elements. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes the report from the **Reports** node. - -**Rename** -Highlights the report name so that it becomes editable text. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -[Server Management Console: Reports Node](server-management-console-reports-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/reports-results-pane-columns.md b/mdop/appv-v4/reports-results-pane-columns.md deleted file mode 100644 index 30d4a7cd79..0000000000 --- a/mdop/appv-v4/reports-results-pane-columns.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Reports Results Pane Columns -description: Reports Results Pane Columns -author: eavena -ms.assetid: 907360ca-6a55-4e42-88d2-db1a24cd2a28 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Reports Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays three columns for reports. If there are additional columns available, you can add and remove them. - -You can use the standard Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - -
          ColumnContents

          Report Name

          This column displays the report name.

          Report Type

          This column displays the report type.

          Period Type

          This column displays the frequency with which Application Virtualization generates the report.

          - -  - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -[Server Management Console: Reports Node](server-management-console-reports-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/reports-results-pane.md b/mdop/appv-v4/reports-results-pane.md deleted file mode 100644 index 1bf053f4df..0000000000 --- a/mdop/appv-v4/reports-results-pane.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Reports Results Pane -description: Reports Results Pane -author: eavena -ms.assetid: 66beac62-fa55-4ab9-ac19-b9e1772e2d20 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Reports Results Pane - - -The **Reports Results** pane in the Application Virtualization Server Management Console displays a list of the available reports. - -To display specific options for reports, right-click any report to view the following elements. - -**Run Report** -Runs the selected report regardless of the specified value in the **Report Period** field. - -**New Window From Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes the selected report from the **Results** pane. - -**Rename** -Changes the name of the selected report. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -[Server Management Console: Reports Node](server-management-console-reports-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index f8023fed89..0000000000 --- a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Restart Task Failure Dialog Box (App-V 4.6 SP1) -description: Restart Task Failure Dialog Box (App-V 4.6 SP1) -author: eavena -ms.assetid: 1933fe71-8aa0-4e43-b6f7-060050001edd -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restart Task Failure Dialog Box (App-V 4.6 SP1) - - -A restart task associated with the application that you are trying sequence failed. - -Complete the installation and then manually restart the computer running Microsoft Application Virtualization (App-V) Sequencer. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md b/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md deleted file mode 100644 index fca8e43e79..0000000000 --- a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Run Each Program Page -description: Run Each Program Page -author: eavena -ms.assetid: 4f09a64e-9545-47aa-bc43-fda0089f7adb -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Run Each Program Page - - -Use the **Run Each Program** page to run each program to complete any configuration tasks after installation. For example, this step helps configure any associated application license agreements. Select the application in the **Application Pane** and select one of the following options. - -This page contains the following elements: - -**Run Selected** -Runs only the selected applications. - -**Run All** -Runs all applications contained in the package. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/security-and-protection-overview.md b/mdop/appv-v4/security-and-protection-overview.md deleted file mode 100644 index 2f668ca5d7..0000000000 --- a/mdop/appv-v4/security-and-protection-overview.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Security and Protection Overview -description: Security and Protection Overview -author: eavena -ms.assetid: a43e1c53-7936-4d48-a110-0be26c8e9d97 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Protection Overview - - -Microsoft Application Virtualization 4.5 provides the following enhanced security features to help you plan and implement a more secure deployment strategy: - -- Application Virtualization now supports Transport Layer Security (TLS) using X.509 V3 certificates. Provided that a server certificate has been provisioned to the planned Application Virtualization Management or Streaming Server, the installation will default to secure, using the RTSPS protocol over port 322. Using RTSPS ensures that communication between the Application Virtualization Servers and the Application Virtualization Clients is signed and encrypted. If no certificate is assigned to the server during the Application Virtualization Server installation, the communication will be set to RTSP over port 554. - - **Security Note:** - - To help provide a secure setup of the server, you must make sure that RTSP ports are disabled even if you have all packages configured to use RTSPS. - - If you add security certificates to the server after installing the server, the server might not detect the certificates. To help ensure security certificate detection, restart the server after adding the certificates. - -- The client must be configured to use the same protocol and port as the server, or it will not be able to communicate with the server. The client must also trust the issuer of the certificate and ships with several of the primary providers in its Trusted Root Store. You can use self-signed certificates, but you will need to update the clients. - -- When configuring IIS servers to use the HTTPS protocol for streaming, you will need to set up Secure Sockets Layer (SSL) on the IIS server and provision the certificate for the server. The clients will also need to be configured to trust the root certification authority that issued the server certificate. - -- Kerberos authentication has been added to Microsoft Application Virtualization as the default authentication mechanism. Earlier versions relied upon NTLM V2 for authentication. Using Kerberos Authentication strengthens the security of the communication between the client and the Application Virtualization server. When a connection has been initiated from the client, the Application Virtualization Server verifies the session ticket with the Key Distribution Center (KDC). - -- Because of the support for using server certificates and using the RTSPS or HTTPS protocols, you can now support clients outside of the corporate network. This can help eliminate the need for mobile users to set up a secure connection to the corporate network (VPN, RAS, and so on) prior to launching Application Virtualization provisioned applications. - -Other important security considerations to consider include the following: - -- Always keep servers fully updated and protected. - -- To add a certificate to enable more secure communications to the Application Virtualization Management Server, the following criteria must be met: - - - The user who will be adding the certificate must be an administrator on the server where the certificate store is located. - - - The server service must be started. - - - Port 139 on the Management Server must be open to the Web Service server’s IP. - -- Use access control lists (ACLs) to ensure that the application packages and all package files are protected and cannot be tampered. ACLs restrict access to the location or folder where you store the packages, allowing access only to certain accounts. - -- Make sure that the channel between the Application Virtualization Management Server and the database is secured—for example, by using IPsec. - -- If packages are stored on a SAN or NAS, ensure the connection between the central storage device and the Application Virtualization Servers is protected. - -- All communication channels to the client should be protected—including connections to the publishing server, the Application Virtualization Server, and the path to the OSD and ICO files—by using a protocol such as HTTPS or IPsec.  - -- Client permissions should be configured to help ensure that packages cannot be tampered with by users. It is especially important that you do not grant users permission to add or update packages on systems, such as Remote Desktop Session Host (RD Session Host) servers, that are shared with multiple users. - -- Kerberos authentication must be permitted across domain or forest environments for the Server Management Console to work correctly. - -- This release of the software does not support hosting a Kerberos-based RTSP server and a Microsoft NTLM-only-based IIS server on the same computer. To host an RTSP server and an IIS server on the same computer, remove the SPN from the IIS server and use NTLM authentication. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-files-page.md b/mdop/appv-v4/select-files-page.md deleted file mode 100644 index 3e3ce46931..0000000000 --- a/mdop/appv-v4/select-files-page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Select Files Page -description: Select Files Page -author: eavena -ms.assetid: 6d1524ca-6306-4a28-b65f-3ded9d487e75 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Files Page - - -Use the **Select Files** page to review the files that will be saved with the Package Accelerator. Some of these files are displayed because they were not located on the specified media or on the local computer. In some scenarios the displayed files should be saved with the Package Accelerator so that the virtual application package can be fully recreated when the Package Accelerator is applied. - -This page contains the following elements: - -**Select Files Pane** -Displays a list of the files that were discovered in the Package Accelerator. Carefully review the files, and clear any file that should be removed from the Package Accelerator. Select only files that are required by the application to run successfully. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-guidance-page--package-accelerators-.md b/mdop/appv-v4/select-guidance-page--package-accelerators-.md deleted file mode 100644 index f2a9ba20b3..0000000000 --- a/mdop/appv-v4/select-guidance-page--package-accelerators-.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Select Guidance Page (Package Accelerators) -description: Select Guidance Page (Package Accelerators) -author: eavena -ms.assetid: 608b8823-6eac-40c0-a6dc-2f0bfc0d42a1 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Guidance Page (Package Accelerators) - - -Use the **Select Guidance** page to specify a file that contains prescriptive guidance about how to use the Package Accelerator to create a new virtual application package. The file you select must be in rich text (.rtf) (recommended) or text (.txt) format. You should provide detailed information about all the necessary instructions for the Package Accelerator to create a virtual application package. For example, if you are performing a media installation, you can include information about how to extract files from any self-extracting executable programs. You should also provide information about all the dependent packages or any applications that must be installed for the package to run on target computers. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the file that contains information about how to apply the Package Accelerator. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md b/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md deleted file mode 100644 index 0fb499ff9d..0000000000 --- a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Select Installation Files Page -description: Select Installation Files Page -author: eavena -ms.assetid: 4c8cd49e-ba39-4918-9863-5b3c315d14a5 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Installation Files Page - - -Use the **Select Installation Files** page to select installation files that the selected Package Accelerator requires. The installation files you specify should be located on the computer running the App-V Sequencer. The required installation files are also displayed on this page. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the directory that contains required installation files for the selected Package Accelerator to create the virtual application package. The directory should be located on the computer running the Sequencer. You can specify installation files of the following types of media and format: - -- Compressed files - -- Windows Installer files - -- .cab files - -- Local files and directories - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-installer-page--learn-more-.md b/mdop/appv-v4/select-installer-page--learn-more-.md deleted file mode 100644 index c0c95a1828..0000000000 --- a/mdop/appv-v4/select-installer-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Select Installer Page (Learn More) -description: Select Installer Page (Learn More) -author: eavena -ms.assetid: da05e756-d23e-4557-8ff6-313d695a78a1 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Installer Page (Learn More) - - -Use the **Select Installer** page to specify the installation (**.msi**, **.exe**) files or programs for the application that you are sequencing. The files specified on this page must be the actual files that will be used to install the application you are sequencing. - -This page contains the following elements: - -**Select the installer for the application.** -Specifies the installation file or files that the sequencer runs and records while creating the virtual application package. You must specify a valid Windows Installer or an executable (**.exe**) program. - -**Select this option to perform a custom installation.** -If the application you are installing does not have an associated Windows Installer or executable program, select this option to manually install the application by using a custom set of installation files. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-package--learn-more--page.md b/mdop/appv-v4/select-package--learn-more--page.md deleted file mode 100644 index 078dbfbad4..0000000000 --- a/mdop/appv-v4/select-package--learn-more--page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Select Package (Learn More) Page -description: Select Package (Learn More) Page -author: eavena -ms.assetid: 0b3d4ca4-ff65-4aa5-87a9-61cbe2ffc8be -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Package (Learn More) Page - - -Use the **Select Package** page to select the source virtual application package you want to use to create the Package Accelerator. Copy the package you specify on this page to the computer running the sequencer. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the existing virtual application package that you will use to create the Package Accelerator. Save the package you specify locally on the computer running the sequencer. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-package-accelerator--learn-more--page.md b/mdop/appv-v4/select-package-accelerator--learn-more--page.md deleted file mode 100644 index 28c3dd746a..0000000000 --- a/mdop/appv-v4/select-package-accelerator--learn-more--page.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Select Package Accelerator (Learn More) Page -description: Select Package Accelerator (Learn More) Page -author: eavena -ms.assetid: 2db51514-8695-4b5e-b3e5-1e96e3ee4cc7 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Package Accelerator (Learn More) Page - - -Only run Package Accelerators from publishers that you trust. Package Accelerators usually include a digital signature. A digital signature is an electronic security mark that can help indicate the publisher of the software, and that the package has not been tampered with after the transform was originally signed. If you use a transform that has been digitally signed by a publisher and the publisher has verified its identity with a certification authority, you can be more confident that the transform comes from that specific publisher and has not been altered. - -The sequencer notifies you if any of the following conditions are true: - -- The selected transform has not been digitally signed. - -- The selected transform is signed by a publisher that has not verified its identity with a certification authority. - -- The selected transform has been altered after it was digitally signed and released. - -If any of these messages are displayed when using a Package Accelerator, visit the Package Accelerators publisher’s website to get a digitally signed version of the transform. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-package-accelerator-page.md b/mdop/appv-v4/select-package-accelerator-page.md deleted file mode 100644 index d06ddc61ba..0000000000 --- a/mdop/appv-v4/select-package-accelerator-page.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Select Package Accelerator Page -description: Select Package Accelerator Page -author: eavena -ms.assetid: 865c2702-4dfd-41ae-8cfc-3514d5f41f76 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Package Accelerator Page - - -Use the **Select Package Accelerator** page to select the Package Accelerator that will be used to create the new virtual application package. You must copy the Package Accelerator to a folder on the computer running the App-V Sequencer. For more information, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -Only run Package Accelerators from publishers that you trust. Package Accelerators usually include a digital signature. A digital signature is an electronic security mark that can help indicate the publisher of the software, and whether the package has been tampered with after the transform was originally signed. If you use a transform that has been digitally signed by a publisher and the publisher has verified its identity with a certification authority, you can be more confident that the transform comes from that specific publisher and has not been altered. - -The App-V Sequencer notifies you if any of the following conditions are true: - -- The selected transform has not been digitally signed. - -- The selected transform is signed by a publisher that has not verified its identity with a certification authority. - -- The selected transform has been altered after it was digitally signed and released. - -If any of these messages are displayed when using a Package Accelerators, visit the Package Accelerators publisher’s website to get a digitally signed version of the transform. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the Package Accelerator that you will use to create the virtual application package. Save the Package Accelerator you specified locally on the computer that is running the Sequencer. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-primary-page--learn-more-.md b/mdop/appv-v4/select-primary-page--learn-more-.md deleted file mode 100644 index a35e3c17bc..0000000000 --- a/mdop/appv-v4/select-primary-page--learn-more-.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Select Primary Page (Learn More) -description: Select Primary Page (Learn More) -author: eavena -ms.assetid: 17c779da-f683-4967-b136-94fe65373c1b -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Primary Page (Learn More) - - -Use the **Select Primary** page to specify the installation file of the program that the add-on or plug-in will be associated with. If the parent application is not already installed on the computer running the App-V Sequencer, you must stop this procedure and install it now. - -For example, if you are installing a plug-in that is designed to operate with Microsoft Excel, you must specify **Excel.exe**. - -You can also use an existing virtual application package as the parent application. To use an existing virtual application package, use the following procedure before sequencing the new add-on or plug-in. - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To expand an existing package to the computer running the Sequencer, click **Tools** / **Expand Package to Local System**. - -3. Browse to, and select the package (**.sprj** file) that you want to expand, and then click **Open**. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the program that the add-in or plug-in you are sequencing will be associated with. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-task-page--learn-more-.md b/mdop/appv-v4/select-task-page--learn-more-.md deleted file mode 100644 index fd9a980960..0000000000 --- a/mdop/appv-v4/select-task-page--learn-more-.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Select Task Page (Learn More) -description: Select Task Page (Learn More) -author: eavena -ms.assetid: 09534c40-bf6c-4b3f-be9a-8624965c9c18 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Task Page (Learn More) - - -Use the **Select Task** page to modify an existing virtual application package. For more information about modifying an existing virtual application package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md). - -This page contains the following elements: - -**Update Application in Existing Package** -Select this option to apply an update to an application or program that is part of an existing virtual application package. If you select this option, you should have the associated installation files saved locally to the computer running the App-V Sequencer. You must also have access to the location where the package that contains the application or program that you want to modify is saved. - -**Edit Package** -Select this option to modify the properties associated with an existing virtual application package. To edit a package, you must have access to the location where the virtual application package is saved. The following list displays the package properties that can be updated if you select **Edit Package**: - -- View package properties. - -- View package change history. - -- View associated package files. - -- Edit registry settings. - -- Review additional package settings (except operating system file properties). - -- Create associated Windows Installer. - -- Modify OSD file. - -- Compress and uncompress package. - -- Add file type associations. - -- Rename shortcuts. - -- Set virtualized registry key state (override / merge). - -- Set virtualized folder state. - -- Edit virtual file system mappings. - -**Add New Application** -Select this option to add a new application or program to an existing virtual application package. For example, you can add Microsoft Excel to an existing Microsoft Office virtual application package. To add a new application, you must have access to the location where the virtual application package is saved. You can also edit file type associations associated with an existing package. - -## Related topics - - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-command-line-error-codes.md b/mdop/appv-v4/sequencer-command-line-error-codes.md deleted file mode 100644 index dd6de8148b..0000000000 --- a/mdop/appv-v4/sequencer-command-line-error-codes.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Sequencer Command-Line Error Codes -description: Sequencer Command-Line Error Codes -author: eavena -ms.assetid: 3d491314-4923-45fd-9839-c541c5e620bd -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Command-Line Error Codes - - -Use the following list to help identify errors that are related to sequencing applications by using the command line. You can also see this information by viewing the associated App-V Sequencer log file. - -**Note**   -Multiple errors can occur during sequencing, and if this happens, the error code that is displayed might be the sum of two error codes. For example, if the */InstallPath* and */OutputFile* parameters are missing, the App-V Sequencer will return **96**—the sum of the two error codes. - - - -01 -There is an unspecified error. - -02 -The specified installation directory (/INSTALLPACKAGE) is not valid. - -04 -The specified package root directory (/INSTALLPATH) is not valid. - -08 -The specified */OutputFile* parameter is not valid. - -16 -The installation directory (/INSTALLPACKAGE) is not specified. - -32 -The package root directory (/INSTALLPATH) is not specified. - -64 -The */OutputFile* parameter is not specified. - -128 -The specified application virtualization drive is not valid. - -256 -The installer failed. - -512 -Sequencing the application failed. - -1024 -Evaluating installed shortcuts failed. - -2048 -The sequenced application package cannot be saved. - -4096 -The specified package name (/PACKAGENAME) is not valid. - -8192 -The specified block size (/BLOCKSIZE) is not valid. - -16384 -The specified compression type (/COMPRESSION) is not valid. - -32768 -The specified project path is not valid. - -65536 -The specified upgrade parameter is not valid. - -131072 -The specified upgrade project parameter is not valid. - -262144 -The specified decode path parameter is not valid. - -525288 -The package name is not specified. - -## Related topics - - -[Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/sequencer-command-line-parameters.md b/mdop/appv-v4/sequencer-command-line-parameters.md deleted file mode 100644 index 45f23f75de..0000000000 --- a/mdop/appv-v4/sequencer-command-line-parameters.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Sequencer Command-Line Parameters -description: Sequencer Command-Line Parameters -author: eavena -ms.assetid: 28fb875a-c302-4d95-b2e0-8dc0c5dbb0f8 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Command-Line Parameters - - -You can use the following Application Virtualization (App-V) Sequencer parameters to sequence an application and to upgrade an existing virtual application by using a command line. For more information about sequencing an application by using a command line, see [How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md). - -## Sequencer Command-Line Parameters - - -**/HELP or /?** -Displays information about parameters that are available for using a command line to sequence applications. - -**/INSTALLPACKAGE or /I** -Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced. - -**/INSTALLPATH or /P** -Specifies the package root directory for an application. - -**/OUTPUTFILE or /O** -Specifies the path and file name of the SPRJ file that will be generated. - -**/FULLLOAD or /F** -Specifies whether all files will be contained in the primary feature block. If the **/FULLLOAD** parameter is specified on the command line, all of the associated application data is added to primary feature block. If the **/FULLLOAD** parameter is not specified on the command line, then none of the associated application data is added to the primary feature block. - -**/PACKAGENAME or /K** -Specifies the package name that will be assigned to the sequenced application. - -**/BLOCKSIZE** -Specifies the SFT file block size that will be used to stream the package to client computers. You can select one of the following values: - -- 4 KB - -- 16 KB - -- 32 KB - -- 64 KB - -You should consider the size of the SFT file when you specify the block size. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes use more network bandwidth. - -**/COMPRESSION** -Specifies the method for compressing the SFT file that will be streamed to the client. - -**/MSI or /M** -Specifies whether a Windows Installer for the sequenced application should be created. - -**/DEFAULT** -Specifies the default SPRJ file that will be used when creating a virtual application package. This file is used as the .sprj template when the application is sequenced for the first time. - -**/UPGRADE** -Specifies the path and file name of the SPRJ file that will be upgraded. - -**/DECODEPATH** -Specifies the directory on the sequencing computer where the files associated with the sequenced application package are installed. Use one of the following formats when specifying the directory: - -- /decodepath:Q: - -- /decodepath:Q:. - -- /decodepath:”Q:.” - -- /decodepath:”Q:” - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-console.md b/mdop/appv-v4/sequencer-console.md deleted file mode 100644 index 7400f6a83a..0000000000 --- a/mdop/appv-v4/sequencer-console.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Sequencer Console -description: Sequencer Console -author: eavena -ms.assetid: 69e0202d-be2c-41cc-99cb-2a08a034e804 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Console - - -The Application Virtualization Sequencer Console enables you to perform a variety of tasks, including sequencing an application, modifying a sequenced application package, configuring the Application Virtualization Sequencer, and more. - -## In This Section - - -[Properties Tab](properties-tab-keep.md) -Provides general information about the **Properties** tab, along with related procedures you can perform. - -[Deployment Tab](deployment-tab.md) -Provides general information about the **Deployment** tab, along with related procedures you can perform. - -[Change History Tab](change-history-tab-keep.md) -Provides general information about the **Change History** tab. - -[Files Tab](files-tab-keep.md) -Provides general information about the **Files** tab, along with related procedures you can perform. - -[Virtual Registry Tab](virtual-registry-tab-keep.md) -Provides general information about the **Virtual Registry** tab, along with related procedures you can perform. - -[Virtual File System Tab](virtual-file-system-tab-keep.md) -Provides general information about the **Virtual File System** tab, along with related procedures you can perform. - -[Virtual Services Tab](virtual-services-tab-keep.md) -Provides general information about the **Virtual Services** tab, along with related procedures you can perform. - -[OSD Tab](osd-tab-keep.md) -Provides general information about the **OSD** tab, along with related procedures you can perform. - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-dialog-boxes.md b/mdop/appv-v4/sequencer-dialog-boxes.md deleted file mode 100644 index 41e0e7f3a7..0000000000 --- a/mdop/appv-v4/sequencer-dialog-boxes.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Sequencer Dialog Boxes -description: Sequencer Dialog Boxes -author: eavena -ms.assetid: f660d56b-0244-4167-b077-96ad482e6b36 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Dialog Boxes - - -## In This Section - - -- [Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -- [Application Virtualization Sequencing Wizard-Add Application Dialog Box](application-virtualization-sequencing-wizard-add-application-dialog-box.md) - -- [Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box](application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md) - -- [Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box](application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md) - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/sequencer-hardware-and-software-requirements.md deleted file mode 100644 index 1a194914ee..0000000000 --- a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Sequencer Hardware and Software Requirements -description: Sequencer Hardware and Software Requirements -author: eavena -ms.assetid: 36084e12-831d-452f-a4a4-45f07f9ce471 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Hardware and Software Requirements - - -This topic describes the minimum recommended hardware and software requirements for the computer running the Microsoft Application Virtualization (App-V) Sequencer. - -Before you install the Sequencer and after you sequence each application, you must restore a clean operating system image to the sequencing computer. You can use one of the following methods to restore the computer running the Sequencer: - -- Reformat the hard drive and reinstall the operating system. - -- Restore the hard drive on the computer running the Sequencer image by using another disk-imaging software. - -The following list outlines the recommended hardware requirements for running the App-V Sequencer. - -### Hardware Requirements - -- Processor—Intel Pentium III, 1 GHz (32-bit or 64-bit). The sequencing process is a single-threaded process and does not take advantage of dual processors. - -- Memory—1 GB or above, 2 GB recommended. - -- Hard Disk—40 gigabyte (GB) hard disk space with a minimum of 15 GB available hard disk space. We recommend that you have at least three times the hard disk space that the application you are sequencing requires. - - **Note**   - Sequencing requires heavy disk usage. A fast disk speed can decrease the sequencing time. - - - -### Software Requirements - -The following list outlines the supported operating systems for running the Sequencer. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows XP

          Professional

          SP2 or SP3

          x86

          Windows Vista

          Business, Enterprise, or Ultimate

          No service pack, SP1, or SP2

          x86

          Windows 7¹

          Professional, Enterprise, or Ultimate

          x86

          - - - -¹Supported for App-V 4.5 with SP1 or SP2, and App-V 4.6 only - -**Note**   -The Application Virtualization (App-V) 4.6 Sequencer supports 32-bit and 64-bit versions of these operating systems. - - - -You should configure computers running the Sequencer with the same applications that are installed on target computers. - -### Software Requirements for Remote Desktop Services - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2003

          Standard Edition, Enterprise Edition, or Datacenter Edition

          SP1 or SP2

          x86

          Windows Server 2003 R2

          Standard Edition, Enterprise Edition, or Datacenter Edition

          x86

          Windows Server 2008

          Standard, Enterprise, or Datacenter

          SP1 or SP2

          x86

          - - - -**Note**   -Application Virtualization (App-V) 4.6 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems. - - - -## Related topics - - -[Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - - - - - - - - - diff --git a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md b/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md deleted file mode 100644 index 684ee01f73..0000000000 --- a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) -description: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) -author: eavena -ms.assetid: 1f75f5ba-0707-48fb-b0b8-ba94a5159e36 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Package Accelerator wizard. - -## In This Section - - -[Select Package Accelerator Page](select-package-accelerator-page.md) - -[Select Package Accelerator (Learn More) Page](select-package-accelerator--learn-more--page.md) - -[Guidance Page](guidance-page-app-v-46-sp1.md) - -[Select Installation Files Page](select-installation-files-page-app-v-46-sp1.md) - -[Package Name Page](package-name-page--app-v-46-sp1.md) - -[Create Package Page](create-package-page--app-v-46-sp1.md) - -[Configure Software Page](configure-software-page-app-v-46-sp1.md) - -[Run Each Program Page](run-each-program-page-app-v-46-sp1.md) - -[Completion Page](completion-page-package-accelerator.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencing-wizard.md b/mdop/appv-v4/sequencing-wizard.md deleted file mode 100644 index d4f7d09fec..0000000000 --- a/mdop/appv-v4/sequencing-wizard.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Sequencing Wizard -description: Sequencing Wizard -author: eavena -ms.assetid: 81e2f4fa-b06e-4cbe-aeb8-6ceb8f0543a5 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencing Wizard - - -Use the Sequencing Wizard to create applications that can run in a virtual environment. The topics in this section provide detailed information about each wizard page in the Sequencing Wizard. - -## In This Section - - -- [Application Virtualization Sequencing Wizard Package Information Page](application-virtualization-sequencing-wizard-package-information-page-keep.md) - -- [Application Virtualization Sequencing Wizard Advanced Options Page](application-virtualization-sequencing-wizard-advanced-options-page.md) - -- [Application Virtualization Sequencing Wizard Monitor Installation Page](application-virtualization-sequencing-wizard-monitor-installation-page.md) - -- [Application Virtualization Sequencing Wizard Add Files to Virtual File System Page](application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md) - -- [Application Virtualization Sequencing Wizard Configure Application Page](application-virtualization-sequencing-wizard-configure-application-page-keep.md) - -- [Application Virtualization Sequencing Wizard Launch Applications Page](application-virtualization-sequencing-wizard-launch-applications-page.md) - -- [Application Virtualization Sequencing Wizard Sequence Package Page](application-virtualization-sequencing-wizard-sequence-package-page.md) - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-groups-node.md b/mdop/appv-v4/server-groups-node.md deleted file mode 100644 index ce1414674d..0000000000 --- a/mdop/appv-v4/server-groups-node.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Server Groups Node -description: Server Groups Node -author: eavena -ms.assetid: 6b2ed086-9100-47d0-be7f-0c5fb4fa55c6 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Groups Node - - -The **Server Groups** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of server groups. Right-click the node to display a pop-up menu that contains the following elements. - -**New Server Group** -Displays the New Server Group Wizard. This wizard consists of a single page, where you can specify a name for the server group in the **Server Group Name** field and then select the default provider policy from the drop-down menu of available provider policies. Select the **Enable** check box to enable the server group. Click **Finish** to add the new server group. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -If you click any server group that appears under the **Server Groups** node in the **Scope** pane, the following elements are available. - -**New Virtual Application Server** -Displays the New Virtual Application Server Wizard. Use this wizard to add a new Application Virtualization Management Server. This wizard has one page, in which you specify the server name in the **Display Name** field and enter a name in the **DNS Host Name** field. From this wizard, you can also specify a value for the server cache in the **Maximum Memory Allocation (MB)** field and a value for the threshold warning level in the **Warn Memory Allocation (MB)** field. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Refresh** -Refreshes the view of the server. - -**Properties** -Displays the **Properties** dialog box for the selected server group. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the provider policy from the drop-down list of Provider Policies. You can also enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging**—Enables you to add, edit, and remove logging modules. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-groups-results-pane-columns.md b/mdop/appv-v4/server-groups-results-pane-columns.md deleted file mode 100644 index f3e42b607f..0000000000 --- a/mdop/appv-v4/server-groups-results-pane-columns.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Server Groups Results Pane Columns -description: Server Groups Results Pane Columns -author: eavena -ms.assetid: e91b1b9b-e58c-4274-ad18-8b157936b9be -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Groups Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays a variety of columns. If there are additional columns available, you can add and remove them. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -When the **Results** pane displays server groups, the column name and contents that appear are described in the following table. - - ---- - - - - - - - - - - - - -
          ColumnContents

          Name

          Displays the name of the server group.

          - -  - -When the **Results** pane displays virtual application servers, the column name and contents that appear are described in the following table. - - ---- - - - - - - - - - - - - - - - - -
          ColumnContents

          Name

          Displays the name of the virtual application server.

          Host Name

          Displays the DNS host name for the virtual application server.

          - -  - -## Related topics - - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-groups-results-pane.md b/mdop/appv-v4/server-groups-results-pane.md deleted file mode 100644 index 129e193e76..0000000000 --- a/mdop/appv-v4/server-groups-results-pane.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Server Groups Results Pane -description: Server Groups Results Pane -author: eavena -ms.assetid: ac7b0525-5946-4728-9cf1-c65007852ebe -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Groups Results Pane - - -The **Server Groups Results** pane in the Application Virtualization Server Management Console displays a list of the available server groups and Application Virtualization Management Servers. - -When you right-click any server group, the following elements are displayed. - -**New Application Virtualization Management Server** -Displays the New Server Wizard. Use this wizard to add a new Application Virtualization Management Server. This wizard has one page, in which you specify a name for the server in the **Display Name** field, and enter a name in the **DNS Host Name** field. From this wizard, you can also specify a maximum memory allocation for the server cache and a memory threshold warning level. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a server group. - -**Rename** -Changes the name of a server group. - -**Refresh** -Refreshes the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the selected server group. The **Properties** dialog box has the following tabs: - -- **General Tab**—Enables you to select the provider policy from the drop-down list of provider policies and to enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging Tab**—Displays the list of logging modules. You can add, edit, and remove logging modules from this tab. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications Tab**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays **Server Groups**, right-click anywhere in the **Results** pane, except on a server group, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays **Application Virtualization Management** **Servers**, right-click a server to display a pop-up menu that contains the following elements. - -**Duplicate** -Duplicates an Application Virtualization Management Server. - -**Delete** -Deletes an Application Virtualization Management Server. - -**Rename** -Changes the name of an Application Virtualization Management Server. - -**Properties** -Displays the **Properties** dialog box for the selected server. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the provider policy from the **Provider Policies** drop-down list and to enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging**—Displays the **Logging Modules** list. You can add, edit, and remove logging modules from this tab. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays **Application Virtualization Management** **Servers**, right-click anywhere, except on a server, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the most recently selected server. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the provider policy from the **Provider Policies** drop-down list and to enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging**—Displays the **Logging Modules** list. You can add, edit, and remove logging modules from this tab. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-about-dialog-boxes.md b/mdop/appv-v4/server-management-console-about-dialog-boxes.md deleted file mode 100644 index 3efe389863..0000000000 --- a/mdop/appv-v4/server-management-console-about-dialog-boxes.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Server Management Console About Dialog Boxes -description: Server Management Console About Dialog Boxes -author: eavena -ms.assetid: b5fdee0b-4269-4a48-98a0-ed3f06cff041 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: About Dialog Boxes - - -The **About** dialog boxes display information about the specific version of the Microsoft Management Console or the specific version of the Application Virtualization Server Management Console. - -To display these dialog boxes, click **Help** and select **About Microsoft Management Console** or **About Application Virtualization Server Management Console**. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-administrators-node.md b/mdop/appv-v4/server-management-console-administrators-node.md deleted file mode 100644 index 015c4f342b..0000000000 --- a/mdop/appv-v4/server-management-console-administrators-node.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Server Management Console Administrators Node -description: Server Management Console Administrators Node -author: eavena -ms.assetid: ab421454-69d1-4c10-8f58-2a35ae89c8b1 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Administrators Node - - -The topics in this section provide information about the screen reference for the **Administrators** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Administrators Node](administrators-node.md) -Describes the features and commands available from the **Administrators** node. - -[Administrators Results Pane](administrators-results-pane.md) -Describes the features and commands available in the **Administrators** node **Results** pane. - -[Administrators Results Pane Columns](administrators-results-pane-columns.md) -Describes the columns available in the **Administrators** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-application-licenses-node.md b/mdop/appv-v4/server-management-console-application-licenses-node.md deleted file mode 100644 index 3f238741ce..0000000000 --- a/mdop/appv-v4/server-management-console-application-licenses-node.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Server Management Console Application Licenses Node -description: Server Management Console Application Licenses Node -author: eavena -ms.assetid: ad3fa486-2b3c-4efd-91f5-507e9c5057d5 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Application Licenses Node - - -The topics in this section provide information about the screen reference for the **Application Licenses** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Applications Licenses Node](applications-licenses-node.md) -Describes the features and commands available from the **Application Licenses** node. - -[Applications Licenses Results Pane](applications-licenses-results-pane.md) -Describes the features and commands available in the **Application Licenses** node **Results** pane. - -[Applications Licenses Results Pane Columns](applications-licenses-results-pane-columns.md) -Describes the columns available in the **Application Licenses** node **Results** pane. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md b/mdop/appv-v4/server-management-console-application-virtualization-system-node.md deleted file mode 100644 index 8b80ae666f..0000000000 --- a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Server Management Console Application Virtualization System Node -description: Server Management Console Application Virtualization System Node -author: eavena -ms.assetid: 9450832e-335c-41e7-af24-fddb8ffc327c -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Application Virtualization System Node - - -The Application Virtualization System node is the top-level node in the **Scope** pane. This node displays the name of the server the console is currently controlling, or it displays the name of the local computer (if you are connected by the name) or "local" when the console is connected to the local computer. From the Application Virtualization System node, you can connect to another computer or you can connect to the current computer with a different set of credentials. - -You can right-click the Application Virtualization System node to display the following elements. - -**Configure Connection** -In this dialog box, you can modify the following settings: - -- **Web Service Host Name**—Enables you to enter the name of the Application Virtualization System to which you want to connect, or you can enter **localhost** to connect to the local computer. - -- **Use Secure Connection**—Select if you want to connect to the server with a secure connection. - -- **Port**—Enables you to enter the port number you want to use for the connection. 80 is the default regular port number, and 443 is default secure port number. - -- **Use Current Windows Account**—Select to use the current Windows account credentials. - -- **Specify Windows Account**—Select when you want to connect to the server as a different user. - -- **Name**—Enables you to enter the name of the new user by using either the *DOMAIN\\username* or the username@domain format. - -- **Password**—Enables you to enter the password that corresponds to the new user. - -**System Options** -On the following tabs on this dialog box, you can modify the associated settings: - -- **General Tab**—Enables you to specify the **Default Content Path** where the OSD and icon files are stored. - -- **Database Tab**—Enables you to specify the maximum **Database Size** and the **Usage History**. - -**View** -Changes the appearance of the Application Virtualization Server Management Console. For more information about changing the appearance of the console, refer to the help files for the Microsoft Management Console. - -**New Window from Here** -Opens a new management console window. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Starts the management console help file. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/server-management-console-applications-node.md b/mdop/appv-v4/server-management-console-applications-node.md deleted file mode 100644 index a60b48ffce..0000000000 --- a/mdop/appv-v4/server-management-console-applications-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Server Management Console Applications Node -description: Server Management Console Applications Node -author: eavena -ms.assetid: e465f816-032d-4824-9924-f2dcf30f2a2c -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Applications Node - - -The topics in this section provide information about the screen reference for the **Applications** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Applications Node in Server Management Console](applications-node-in-server-management-console.md) -Describes the features and commands available from the **Applications** node. - -[Applications Results Pane in Server Management Console](applications-results-pane-in-server-management-console.md) -Describes the features and commands available in the **Applications** node **Results** pane. - -[Applications Results Pane Columns in Server Management Console](applications-results-pane-columns-in-server-management-console.md) -Describes the columns available in the **Applications** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-file-type-associations-node.md b/mdop/appv-v4/server-management-console-file-type-associations-node.md deleted file mode 100644 index fceda812e7..0000000000 --- a/mdop/appv-v4/server-management-console-file-type-associations-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Server Management Console File Type Associations Node -description: Server Management Console File Type Associations Node -author: eavena -ms.assetid: c22168be-6601-4154-b36b-9ca0fa87e5e0 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: File Type Associations Node - - -The topics in this section provide information about the screen reference for the **File Type Associations** node in the Application Virtualization Server Management Console. - -## In This Section - - -[File Type Associations Node](file-type-associations-node.md) -Describes the features and commands available from the **File Type Associations** node. - -[File Type Associations Results Pane](file-type-associations-results-pane.md) -Describes the features and commands available in the **File Type Associations** node **Results** pane. - -[File Type Associations Results Pane Columns](file-type-associations-results-pane-columns.md) -Describes the columns available in the **File Type Associations** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-packages-node.md b/mdop/appv-v4/server-management-console-packages-node.md deleted file mode 100644 index 1dfe0fa72c..0000000000 --- a/mdop/appv-v4/server-management-console-packages-node.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Server Management Console Packages Node -description: Server Management Console Packages Node -author: eavena -ms.assetid: 458424f6-d586-4fa8-bf61-44c5028a4490 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Packages Node - - -The topics in this section provide information about the screen reference for the **Packages** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Packages Node](packages-node.md) -Describes the features and commands available from the **Packages** node. - -[Package Results Pane](package-results-pane.md) -Describes the features and commands available in the **Packages** node **Results** pane. - -[Package Results Pane Columns](package-results-pane-columns.md) -Describes the columns available in the **Packages** node **Results** pane. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-provider-policies-node.md b/mdop/appv-v4/server-management-console-provider-policies-node.md deleted file mode 100644 index ce731f565e..0000000000 --- a/mdop/appv-v4/server-management-console-provider-policies-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Server Management Console Provider Policies Node -description: Server Management Console Provider Policies Node -author: eavena -ms.assetid: a5b99158-9af8-45bb-b3b8-61e220529e14 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Provider Policies Node - - -The topics in this section provide information about the screen reference for the **Provider Policies** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Provider Policies Node](provider-policies-node.md) -Describes the features and commands available from the **Provider Policies** node. - -[Provider Policies Results Pane](provider-policies-results-pane.md) -Describes the features and commands available in the **Provider Policies** node **Results** pane. - -[Provider Policies Results Pane Columns](provider-policies-results-pane-columns.md) -Describes the columns available in the **Provider Policies** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-reports-node.md b/mdop/appv-v4/server-management-console-reports-node.md deleted file mode 100644 index 414250a6ed..0000000000 --- a/mdop/appv-v4/server-management-console-reports-node.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Server Management Console Reports Node -description: Server Management Console Reports Node -author: eavena -ms.assetid: 9dde6332-5882-40dd-8a8f-857216df80ed -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Reports Node - - -The topics in this section provide information about the screen reference for the **Reports** node in the Application Virtualization Server Management Console. - -## In This Section - - -Reports Node -Describes the features and commands available from the **Reports** node. - -[Reports Results Pane](reports-results-pane.md) -Describes the features and commands available in the **Reports** node **Results** pane. - -[Reports Results Pane Columns](reports-results-pane-columns.md) -Describes the columns available in the **Reports** node **Results** pane. - -## Related topics - - -[Application Utilization Report](application-utilization-reportserver.md) - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[Software Audit Report](software-audit-reportserver.md) - -[System Error Report](system-error-reportserver.md) - -[System Utilization Report](system-utilization-reportserver.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-server-groups-node.md b/mdop/appv-v4/server-management-console-server-groups-node.md deleted file mode 100644 index fa0a289798..0000000000 --- a/mdop/appv-v4/server-management-console-server-groups-node.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Server Management Console Server Groups Node -description: Server Management Console Server Groups Node -author: eavena -ms.assetid: 83b86fc5-3f77-4470-985a-cf0bb8686067 -ms.reviewer: -manager: dansimp -ms.author: eravena -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Server Groups Node - - -The topics in this section provide information about the screen reference for the **Server Groups** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Server Groups Node](server-groups-node.md) -Describes the features and commands available from the **Server Groups** node. - -[Server Groups Results Pane](server-groups-results-pane.md) -Describes the features and commands available in the **Server Groups** node **Results** pane. - -[Server Groups Results Pane Columns](server-groups-results-pane-columns.md) -Describes the columns available in the **Server Groups** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sftmime--command-reference.md b/mdop/appv-v4/sftmime--command-reference.md deleted file mode 100644 index 55ee1492e0..0000000000 --- a/mdop/appv-v4/sftmime--command-reference.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: SFTMIME Command Reference -description: SFTMIME Command Reference -author: manikadhiman -ms.assetid: a4a69228-9dd3-4623-b773-899d03c0cf10 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# SFTMIME Command Reference - - -SFTMIME is a command-line interface used by Application Virtualization (App-V) that enables you to manage many client configuration details. This section contains all the commands and their parameters, with a brief description of each. - -**Important**   -- All backslash characters must be escaped using a preceding backslash, or the path will not be parsed correctly. - -- If you are using a calling program to invoke SFTMIME with **CreateProcess**, you must ensure that the first parameter is the path to sftmime.exe. - -- The output of the SFTMIME **QUERY OBJ** command cannot be piped to the **findstr** command to search for a string. - -- Use of the **GLOBAL** switch requires local administrator rights. - -- Use of short paths and relative paths can lead to unexpected results and should be avoided. Always use full paths. - -  - -## In This Section - - -[ADD APP](add-app.md) - -[ADD PACKAGE](add-package.md) - -[ADD SERVER](add-server.md) - -[ADD TYPE](add-type.md) - -[CLEAR APP](clear-app.md) - -[CLEAR OBJ](clear-obj.md) - -[CONFIGURE APP](configure-app.md) - -[CONFIGURE PACKAGE](configure-package.md) - -[CONFIGURE SERVER](configure-server.md) - -[CONFIGURE TYPE](configure-type.md) - -[DELETE APP](delete-app.md) - -[DELETE OBJ](delete-obj.md) - -[DELETE PACKAGE](delete-package.md) - -[DELETE SERVER](delete-server.md) - -[DELETE TYPE](delete-type.md) - -[HELP](help.md) - -[LOAD APP](load-app.md) - -[LOAD PACKAGE](load-package.md) - -[LOCK APP](lock-app.md) - -[PUBLISH APP](publish-app.md) - -[PUBLISH PACKAGE](publish-package.md) - -[QUERY OBJ](query-obj.md) - -[REFRESH SERVER](refresh-server.md) - -[REPAIR APP](repair-app.md) - -[UNLOAD APP](unload-app.md) - -[UNLOAD PACKAGE](unload-package.md) - -[UNLOCK APP](unlock-app.md) - -[UNPUBLISH PACKAGE](unpublish-package.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sfttray-command-reference.md b/mdop/appv-v4/sfttray-command-reference.md deleted file mode 100644 index bf89666ba8..0000000000 --- a/mdop/appv-v4/sfttray-command-reference.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: SFTTRAY Command Reference -description: SFTTRAY Command Reference -author: manikadhiman -ms.assetid: 6fa3a939-b047-4d6c-bd1d-dfb93e065eb2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# SFTTRAY Command Reference - - -The Microsoft Application Virtualization (App-V) Client Tray application, sfttray.exe, is the main user interface element of the App-V Client that users will interact with during normal use. This program controls the streaming and starting of all virtual applications and is accessed by right-clicking the icon displayed in the notification area to display the menu of client functions. The menu enables the user to load applications, start a publishing refresh, cancel a request, or change the client to offline mode. The user can also close the Application Virtualization Client Tray application and all active applications by clicking **Exit**. - -By default, the icon is displayed whenever a virtual application is started, although you can control this behavior by using SFTTRAY commands. The Application Virtualization Client Tray application also displays a progress bar for each application that is started, as well as status messages about active applications. Clicking the progress bar displays a message that allows you to cancel the loading or starting of an application. - -## SFTTRAY Commands - - -The list of commands and command-line switches can be displayed by running the following command from a command window. - -**Note** -There is only one Application Virtualization Client Tray instance for each user context, so if you start a new SFTTRAY command, it will be passed to the program that is already running. - - - -`Sfttray.exe /?` - -### Command Usage - -`Sfttray.exe [/HIDE | /SHOW]` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT /LAUNCH app [args]` - -`Sfttray.exe /EXIT` - -### Command-Line Switches - -The SFTTRAY command-line switches are described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SwitchDescription

          /HIDE

          Hides the SFTTRAY icon in the Windows notification area.

          /SHOW

          Displays the SFTTRAY icon in the Windows notification area.

          /QUIET

          Supports unattended usage by preventing errors from displaying message boxes that require user acknowledgement.

          /EXE <alternate-exe>

          Used with /LAUNCH to specify that an executable program is to be started in the virtual environment when a virtual application is started in place of the target file specified in the OSD.

          -
          -Note

          For example, use “SFTTRAY.EXE /EXE REGEDIT.EXE /LAUNCH <app>” to enable you to examine the registry of the virtual environment in which the application is running.

          -
          -
          - -

          /LAUNCH <app> [<args>]

          Starts a virtual application. Specify the name and version of an application or the path to an OSD file. Optionally, command-line arguments can be passed to the virtual application.

          -
          -Note

          Use the command “SFTMIME.EXE /QUERY OBJ:APP /SHORT” to obtain a list of the names and versions of available virtual applications.

          -
          -
          - -

          /LOAD

          Loads or imports a virtual application.

          /LOADALL

          Loads all applications into cache.

          /REFRESHALL

          Starts a publishing refresh for all applications.

          /LAUNCHRESULT <UNIQUE ID>

          Returns the launch result code to the process that launches sfttray.exe by using a global event and a memory mapped file that are based on the specified root name for the UNIQUE ID.¹

          /SFTFILE <sft>

          Optional switch used with /LOAD to specify the path to the application’s SFT file. If specified, the application is imported rather than loaded.

          /EXIT

          Closes the SFTTRAY program and all active virtual applications and removes the icon from the Windows notification area.

          - - - -**Note** -¹ The */LAUNCHRESULT* command line parameter provides a means for the process that launches sfttray.exe to specify the root name for a global event and a memory mapped file that are used to return the launch result code to the process. The unique identifier name should start with “SFT-” to prevent the event name from getting virtualized when the launching process is invoked within a virtual environment. The memory mapped region will be 64 bits in size. - -To use this parameter, the launching process creates an event with the name “<UNIQUE ID>-result\_event”, a memory mapped file with the name “<UNIQUE ID>-result\_value”, and optionally an event with the name “<UNIQUE ID>-shutdown\_event”, and then the launching process launches sfttray.exe and waits on the event to be signaled. After the event “<UNIQUE ID>-result\_event” is signaled, the launching process retrieves the 64-bit return code from the memory mapped region. - -If the optional event “<UNIQUE ID>-shutdown\_event” exists when the virtual application exits, sfttray.exe opens and signals the event. The launching process waits on this shutdown event if it needs to determine when the virtual application exits. - - - - - - - - - - - diff --git a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index ce583088cc..0000000000 --- a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) -description: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) -author: manikadhiman -ms.assetid: bcdb9b82-b53d-4a36-9f5d-71c021d4be28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) - - -The Side-by-side assembly privatization failed. You can find more information about the side-by-side assemblies in the Sequencer log file which is located in the following directory: - -<App-V Sequencer installation drive> \\**Program Files** \\ **Microsoft Application Virtualization Sequencer** \\ **Logs** - -Install public versions of the required assemblies on the computer running the App-V Sequencer before you sequence the application. The same assemblies must also be installed on all computers running the App-V client before you deploy the package. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/software-audit-reportserver.md b/mdop/appv-v4/software-audit-reportserver.md deleted file mode 100644 index d360b339b8..0000000000 --- a/mdop/appv-v4/software-audit-reportserver.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Software Audit Report -description: Software Audit Report -author: manikadhiman -ms.assetid: 55a49ed2-f331-40d3-add6-8e5fcd6816fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Software Audit Report - - -Use the Software Audit Report to list the usage information during the reporting period for all applications defined in the database. You can use this report to determine which applications are the most heavily used. - -For each application, the Software Audit Report lists the following information: - -- Number of sessions—Number of times an application was used - -The Software Audit Report also includes a summary of the total usage per application. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run this report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md b/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md deleted file mode 100644 index 057f6f881c..0000000000 --- a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Stand-Alone Delivery Scenario for Application Virtualization Clients -description: Stand-Alone Delivery Scenario for Application Virtualization Clients -author: manikadhiman -ms.assetid: 7545b468-f58a-4504-a6d5-3c2d303731c4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Stand-Alone Delivery Scenario for Application Virtualization Clients - - -The Stand-Alone Delivery Scenario enables you to realize the benefits of Microsoft Application Virtualization in situations where no servers are available to support other methods of deploying your virtual applications. - -**Note**   -It is assumed that you have already installed the Application Virtualization Sequencer in preparation for the stand-alone scenario. For more information, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - - - -## In This Section - - -[Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md) -Provides a general overview of the benefits of a stand-alone Application Virtualization deployment scenario. - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -Provides a step-by-step procedure for installing the Application Virtualization Client software. - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -Provides command-line procedures for publishing an application package, using either Windows Installer or SFTMIME. - -## Reference - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md)[SFTMIME Command Reference](sftmime--command-reference.md) - -## Related topics - - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md b/mdop/appv-v4/stand-alone-delivery-scenario-overview.md deleted file mode 100644 index 07365c016e..0000000000 --- a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Stand-Alone Delivery Scenario Overview -description: Stand-Alone Delivery Scenario Overview -author: manikadhiman -ms.assetid: b109f309-f3c1-43af-996f-2a9b138dd171 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Stand-Alone Delivery Scenario Overview - - -The stand-alone delivery scenario is an ideal application virtualization solution for environments where either low bandwidth connectivity or no connectivity limits the ability of the Application Virtualization Desktop Client to stream applications from centralized servers. In these environments, users often work remotely and device owners install applications by using Windows Installer files. - -You can use the Application Virtualization Sequencer to create sequenced applications that include Windows Installer files. These packages include the virtualized applications, publication information, and the necessary installer routines for installing the packages on the client systems. The installer adds the virtual application package to the Microsoft Application Virtualization Desktop Client. The publication information is configured to load applications from a local location rather than stream them across a WAN. Users can temporarily connect to a network to retrieve the Windows Installer files or can run them from a DVD. - -The stand-alone delivery scenario provides users the following benefits: - -- Simple deployment operation. - -- Network and servers not needed at runtime. - -- Applications pre-cached and available to all users. - -The stand-alone delivery scenario has the following limitations: - -- Built-in, automated reporting is unavailable; reports must be generated with external reporting tools. - -- Applications must be delivered to the client manually like the original Windows Installer files. - -## Related topics - - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/streaming-page-learn-more.md b/mdop/appv-v4/streaming-page-learn-more.md deleted file mode 100644 index da5ad4a4f7..0000000000 --- a/mdop/appv-v4/streaming-page-learn-more.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Streaming Page -description: Streaming Page -author: manikadhiman -ms.assetid: a69a57a0-1bbe-4604-840d-bfa87ec463e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Streaming Page - - -Use the **Streaming** page to optimize the virtual application package. During this step, the App-V Sequencer evaluates and configures the virtual application package so that it runs more efficiently when the package is deployed to target computers. - -**Note**   -You only have to perform the following tasks if you plan to stream the package across the network. - - - -This page contains the following elements: - -**Run Selected** -Runs and optimizes only the specified programs saved in the virtual application package. - -**Run All** -Runs all the programs saved in the virtual application package. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/support-for-client-reporting-over-http.md b/mdop/appv-v4/support-for-client-reporting-over-http.md deleted file mode 100644 index affd21c498..0000000000 --- a/mdop/appv-v4/support-for-client-reporting-over-http.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: Support for Client Reporting over HTTP -description: Support for Client Reporting over HTTP -author: manikadhiman -ms.assetid: 4a26ac80-1fb5-4c05-83de-4d06793f7bf2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Support for Client Reporting over HTTP - - -Version 4.6 of the App-V client now supports the use of HTTP communication when sending client reporting data to the publishing server. This feature supports scenarios where a customer has implemented a custom HTTP(S) publishing server that is configured to collect and process client data. - -For more information on HTTP publishing servers, see - -## Client Reporting over HTTP - - -The client starts collecting data when it receives a “REPORTING=”TRUE””attribute in the publishing refresh response XML from the publishing server. When this attribute is received, the client sends any accumulated data to the publishing server that sent the publishing refresh. The details of this process are as follows: - -- The client sends an HTTP GET request to the publishing server for a publishing refresh. The header of this message contains an “AppV-Op:Refresh” custom header that the custom HTTP(S) publishing server uses to identify the message type. - -- The publishing server then sends the publishing refresh response XML that contains a “REPORTING=”TRUE”” value. - -- The client then sends an HTTP POST request to the publishing server along with the reporting data that has been gathered since the previous refresh. The header of this message contains an “AppV-Op:Report” custom header that the custom HTTP(S) publishing server uses to identify the message type. - -The following schema gives specific details of the package and the application data that is sent to the server. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -  - -  - - - - - diff --git a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 836a996cb8..0000000000 --- a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: SXS Conflict Detected Dialog Box (App-V 4.6 SP1) -description: SXS Conflict Detected Dialog Box (App-V 4.6 SP1) -author: manikadhiman -ms.assetid: 7cbb67ba-cc11-4f10-b903-4a6af233eacb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# SXS Conflict Detected Dialog Box (App-V 4.6 SP1) - - -The application you are installing requires 64-bit assemblies. You can find more information about the side-by-side assemblies in the Sequencer log file which is located in the following directory: - -<App-V Sequencer installation drive> \\**Program Files** \\ **Microsoft Application Virtualization Sequencer** \\ **Logs** - -Install public versions of the required 64-bit assemblies on the computer running the App-V Sequencer before sequencing this application. You must also install the assemblies on the computer running the App-V client before you deploy this package. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/system-error-reportserver.md b/mdop/appv-v4/system-error-reportserver.md deleted file mode 100644 index a05fd63491..0000000000 --- a/mdop/appv-v4/system-error-reportserver.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Error Report -description: System Error Report -author: manikadhiman -ms.assetid: 4081db2f-92a6-4928-a26b-757048159094 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# System Error Report - - -Generate the System Error Report to track the number of errors and warnings logged over time during the specified reporting period for the specified server, for the specified server group. - -This report generates a bar graph that displays the fatal errors, errors, and log warnings in ascending order based on the time the messages were logged. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run this report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/system-utilization-reportserver.md b/mdop/appv-v4/system-utilization-reportserver.md deleted file mode 100644 index d8d31cf853..0000000000 --- a/mdop/appv-v4/system-utilization-reportserver.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: System Utilization Report -description: System Utilization Report -author: manikadhiman -ms.assetid: 4d490d15-2d1f-4f2c-99bb-0685447c0672 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# System Utilization Report - - -Use the System Utilization Report to graph the total daily system usage. You can use this report to determine the load on your Application Virtualization System. - -This report tracks the usage over time during the reporting period for the specified server or for the server group. - -The System Utilization Report also graphs the following system usage: - -- Usage by day of the week - -- Usage by hour of the day - -The System Utilization Report also includes a summary of the total system usage for specific users and total session counts. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run this report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -**Note**   -The App-V server name reported from the clients must be part of the Default Server Group in order for the System Utilization report to show data. For example, if you are using multiple servers with a Network Load Balancer (NLB), you must add the NLB cluster name to the Default Server Group. - - - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - - - - - - - - - diff --git a/mdop/appv-v4/target-os-page-learn-more.md b/mdop/appv-v4/target-os-page-learn-more.md deleted file mode 100644 index 8b841dc45f..0000000000 --- a/mdop/appv-v4/target-os-page-learn-more.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Target OS Page -description: Target OS Page -author: manikadhiman -ms.assetid: 003fd992-0a7e-494e-9e75-4dd5e0927e15 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Target OS Page - - -Use the **Target OS** page to specify which operating systems in your environment can run this virtual application package. - -**Note**   -The operating systems specified on this page can only run this virtual application package if the application you are sequencing supports the operating systems specified. Review the supported operating systems for the application you are sequencing to ensure compatibility. - - - -This page contains the following elements: - -**Allow this package to run on any operating system** -Enables the virtual application package to be installed and run on all supported operating systems. - -**Allow this package to only run on the following operating systems** -Enables the virtual application package to be installed and run only on the selected supported operating systems. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md deleted file mode 100644 index c7fd7547bb..0000000000 --- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) -description: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) -author: manikadhiman -ms.assetid: 58597af9-6a62-4588-ab41-dbf6b7026267 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) - - -Use any of the following links for more information about using the App-V Sequencer. - -## In This Section - - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) -Describes how to determine the type of application you want to sequence. - -[How to Sequence a New Standard Application (App-V 4.6 SP1)](how-to-sequence-a-new-standard-application--app-v-46-sp1-.md) -Describes how to sequence a new standard application. - -[How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)](how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md) -Describes how to sequence a new add-on or plug-in application. - -[How to Sequence a New Middleware Application (App-V 4.6 SP1)](how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md) -Describes how to sequence a new middleware application. - -[How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) -Describes how to modify an existing virtual application package. - -[How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) -Describes how to use a Package Accelerator to create a new virtual application package. - -[How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md) -Describes how to use a project template to apply standard package settings to a new virtual application package. - -[How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) -Describes how create a new Package Accelerator. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md deleted file mode 100644 index 5241b96cce..0000000000 --- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Tasks for the Application Virtualization Sequencer -description: Tasks for the Application Virtualization Sequencer -author: manikadhiman -ms.assetid: 398018f4-297a-440d-b614-23f0ab03e7bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Tasks for the Application Virtualization Sequencer - - -The links in this section provide the necessary information to complete each associated Microsoft Application Virtualization (App-V) task. - -## In This Section - - -[How to Sequence a New Application](how-to-sequence-a-new-application.md) -Specifies the tasks associated with sequencing a new application. - -[How to Create a Virtual Environment for a Web-Based Application](how-to-create-a-virtual-environment-for-a-web-based-application.md) -Specifies how to create separate web environments for virtual applications. - -[How to Upgrade a Sequenced Virtual Application Package](how-to-upgrade-a-sequenced-virtual-application-package.md) -Specifies how to upgrade an existing virtual application package. - -[How to Branch a Package](how-to-branch-a-package.md) -Specifies how to branch an existing virtual application package so you can run multiple versions of the same package. - -[How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) -Specifies how to upgrade an existing virtual application package using the command line. - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) -Specifies how to manage virtual applications using the command line. - -## Related topics - - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md b/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md deleted file mode 100644 index 0c9d93141c..0000000000 --- a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Troubleshooting Application Virtualization Sequencer Issues -description: Troubleshooting Application Virtualization Sequencer Issues -author: manikadhiman -ms.assetid: 2712094b-a0bc-4643-aced-5415535f3fec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Application Virtualization Sequencer Issues - - -This topic includes information that you can use to help troubleshoot general issues on the Application Virtualization (App-V) Sequencer. - -## Creating an SFTD File by Using the App-V Sequencer Increases the Version Number Unexpectedly - - -Use the command line to generate a new .sft file. To create the .sft file by using the command line, enter the following at a command prompt: - -**mkdiffpkg.exe <base SFT file name> <diff SFT file name>** - -## File Name in OSD File Is Not Correct After Package Upgrade - - -When you open a package for upgrade, you should specify the root Q:\\ drive as the output location for the package. Do not specify an associated file name with the output location. - -## Microsoft Word 2003 Default Install Results in an Error When Streamed to a Client - - -When you stream Microsoft Word 2003 to a client, an error is returned, but Microsoft Word continues to run. - -**Solution** - -Resequence the virtual application package and select **Full Install**. - -## Active Upgrade Does Not Work When You Create a Dependent Package - - -When you create a dependent package by using active upgrade and add new registry entries, it appears to function correctly, but the updated registry entries are not available. - -**Solution** - -Registry settings are always stored with the original version of the package, so updates to the package will not appear to be available unless you repair the original package. - -## Detailed information is not visible for Microsoft Office 2007 documents by using the properties page - - -When you try to view detailed information associated with a Microsoft Office 2007 document by using the properties page, the detailed information is not visible. - -**Solution** - -App-V does not support the required shell extensions for these property pages. - -## Some registry keys are not captured when you sequence 16-bit applications - - -In App-V 4.5, registry hooking has been moved from kernel mode to user mode. If you want to sequence a 16-bit application or an application that uses a 16-bit installer, you must first configure the sequencer computer so that the process runs in its own copy of the Windows NT Virtual DOS Machine (NTVDM). - -**Solution** - -Before you sequence the application, set the following global REGSZ registry key value to "yes" on the sequencing computer: - -HKLM\\SYSTEM\\CurrentControlSet\\Control\\WOW\\DefaultSeparateVDM - -You must restart the computer before this takes effect. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md b/mdop/appv-v4/troubleshooting-certificate-permission-issues.md deleted file mode 100644 index 6987ec6314..0000000000 --- a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Troubleshooting Certificate Permission Issues -description: Troubleshooting Certificate Permission Issues -author: manikadhiman -ms.assetid: 06b8cbbc-93fd-44aa-af39-2d780792d3c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Certificate Permission Issues - - -After the installation of App-V 4.5, if the private key has not been configured with the proper ACL for the Network Service, an event is logged in the NT Event Log and an entry is placed in the `Sft-server.log` file. - -## Error Messages - - -### Windows Server 2003 - -Event ID 36870—A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x80090016. - -### Windows Server 2008 - -Event ID 36870—A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. - -## Sft-server.log - - -The following error is placed in the `sft-server.log` file located in the `%ProgramFiles%\Microsoft System Center App Virt Management Server\App Virt Management Server\logs` directory: - -Certificate could not be loaded. Error code \[-2146893043\]. Make sure that the Network Service account has proper access to the certificate and its corresponding private key file. - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md deleted file mode 100644 index 1a8a9821d5..0000000000 --- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Troubleshooting Information for the Application Virtualization Client -description: Troubleshooting Information for the Application Virtualization Client -author: manikadhiman -ms.assetid: 260a8dad-847f-4ec0-b7dd-6e6bc52017ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Information for the Application Virtualization Client - - -This topic includes information that you can use to troubleshoot various issues on the Application Virtualization (App-V) Client. - -## Publishing Refresh Is Very Slow - - -If publishing refresh on a specific computer takes much longer than expected and if the client is configured to use the **IconSourceRoot** setting, determine whether **IconSourceRoot** contains a nonvalid URL. A nonvalid URL will cause very long delays during publishing refresh. - -## Users Cannot Connect to the Server and Go into Disconnected Operations Mode - - -When you are using an App-V Management Server configured with the RTSPS protocol, if the users are unable to connect and they go into disconnected operations mode, determine whether the certificate that is being used on the server is valid. A nonvalid certificate will prevent users from connecting and will cause them to go into disconnected operations mode. - -## Users Experience Slow Performance When Applications Are Not Fully Cached - - -When applications are not fully cached, users might occasionally experience temporary slow or intermittent performance when they start or use the application. There are several possible reasons this can occur—for example, when the App-V Client is in the process of auto-loading an application or when an Out Of Sequence request is being processed. When the applications are fully cached, these problems will no longer occur. - -## Error Displayed After an Update Is Removed - - -You must use the correct Windows Installer 3.1 command format to remove an update from the App-V Client, as follows: - -`Msiexec /I {F82584A0-D706-4D2D-9BC1-7E6D8BE3BB0F} MSIPATCHREMOVE={BE3DD018-9A1F-40FD-9538-C0A995CBD254} /qb /l*v "Uninstall.log"` - -Using the older command format `msiexec /package /uninstall ` will cause error 6003 "Application Virtualization client could not be started". - -## Error Code 0A-0000E01E Occurs When You Try to Start an Application - - -Error code 0A-0000E01E indicates that the sequenced application package might be corrupt. The solution is to resequence the package. - -## Users Cannot Access Files They Have Created on the Q: Drive - - -If users save files to the **Q:** drive, they cannot retrieve them because they do not have read rights to the drive. Users should not save files to the **Q:** drive. - -## User Is Prompted with a 1D1 Error - - -When the file streaming URL is incorrectly set in the Open Software Descriptor (OSD) file, the App-V Client returns a 1d1 error instead of a “file not found” error. This error indicates that the application start failed and the user has been forced into disconnected operations mode. Correct the file streaming URL. - -## Incorrect Icons Associated with Some Applications - - -When an icon is to be used in a publishing operation, the App-V Client first determines whether it already has a cached copy of the icon, by looking in the icon cache for an item whose original source path matches the path of the icon given to the publishing operation. If the App-V Client finds a match, it will use the already-cached icon; otherwise, it will download the new icon into the cache. If the path to the icon is a scratch directory or if it gets reused for new icons or packages, the lookup in the cache might pick the wrong icon from a previous operation. - -## Users Are Prompted for Credentials When Starting an Application - - -If a user attempts to start a virtual application to which the system administrator has restricted access, the user might be prompted to enter credentials. The user should type the user name and password for an account that has permission to launch the application and then press ENTER. - -## Publishing Refresh Fails After Upgrading the App-V Client to Version 4.5 - - -If the user data directory was previously placed in a non-standard location (%*AllUsersProfile*%\\Documents\\SoftGrid Client\\Users\\%*username*%), users who do not have administrator privileges on the computer will find that publishing refresh fails after the App-V Client is upgraded. During the upgrade, the App-V Client global data directory and all its subdirectories are configured with restricted access rights for administrators only. You can avoid this problem by changing the user data directory before upgrading so that it is not a subdirectory of the global data directory. - -## Reboot Required After Install Failure - - -If the client install fails for any reason and if subsequent attempts to install the client also fail, check the Windows Installer log to see whether it shows an error “sftplay failed, error=1072”. If so, restart the computer before trying to install the client again. - -## Repairing a Corrupted Virtual Application - - -If for any reason a virtual application package installed using a Windows Installer Package (MSI) file becomes corrupted, reinstall the package. The Repair function available in the Windows Installer will not update the user volumes. - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md deleted file mode 100644 index 021372f847..0000000000 --- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Troubleshooting Information for the Application Virtualization Server -description: Troubleshooting Information for the Application Virtualization Server -author: manikadhiman -ms.assetid: e9d43d9b-84f2-4d1b-bb90-a13740151e0c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Information for the Application Virtualization Server - - -This topic includes information that you can use to troubleshoot various issues on the Application Virtualization (App-V) Servers. - -## Warning Message 25017 in Setup Log After Installing the Server - - -You might find the following message in the server setup log after installation. - -*Warning 25017. The installation Program could not create the Active Directory marker object for the server. The account used to install did not have the sufficient rights to write to Active Directory or Active Directory was unavailable.* - -The App-V Management or Streaming Server installer creates a Service Connection Point entry under the Computer object in Active Directory Domain Services (AD DS) that corresponds to the computer on which the server is installed if the account used to run the installer has the appropriate rights. Failure to create this entry will not cause the install to fail and this should not otherwise affect the functioning of the product. The likely cause of any failure is that the user account used to run the install did not have sufficient rights to write to AD DS. Although registering the App-V server in AD DS is optional, one benefit of doing so enables centralized management tools to locate the App-V server for inventory and management purposes. - -## Related topics - - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md b/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md deleted file mode 100644 index 0ee0ebe678..0000000000 --- a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Troubleshooting the Application Virtualization Sequencer -description: Troubleshooting the Application Virtualization Sequencer -author: manikadhiman -ms.assetid: 12ea8367-0b84-44e1-a885-e0539486556b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting the Application Virtualization Sequencer - - -This topic includes information that you can use to help troubleshoot general issues on the Application Virtualization (App-V) Sequencer. - -## Creating an SFTD File by Using the App-V Sequencer Increases the Version Number Unexpectedly - - -The version number associated with an SFTD file increases unexpectedly. - -**Solution** - -Use the command line to generate a new .sft file. To create the .sft file by using the command line, enter the following at a command prompt: - -**mkdiffpkg.exe <base SFT file name> <diff SFT file name>** - -## File Name in OSD File Is Not Correct After Package Upgrade - - -After you upgrade an existing package, the file name is not correct. - -**Solution** - -When you open a package for upgrade, you should specify the root Q:\\ drive as the output location for the package. Do not specify an associated file name with the output location. - -## Microsoft Word 2003 Default Install Results in an Error When Streamed to a Client - - -When you stream Microsoft Word 2003 to a client, an error is returned but Microsoft Word continues to run. - -**Solution** - -Resequence the virtual application package, and select **Full Install**. - -## Package Upgrade Does Not Work When You Create a Dependent Package - - -When you create a dependent package by using package upgrade and add new registry entries, it appears to function correctly but the updated registry entries are not available. - -**Solution** - -Registry settings are always stored with the original version of the package, so updates to the package will not appear to be available unless you repair the original package. - -## Error When Trying to Sequence .NET 2.0 - - -When you sequence a package that requires .NET 2.0, you get an error. - -**Solution** - -Sequencing packages that require .NET 2.0 is not supported. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/type-of-application-page--learn-more-.md b/mdop/appv-v4/type-of-application-page--learn-more-.md deleted file mode 100644 index 793ec8b0c1..0000000000 --- a/mdop/appv-v4/type-of-application-page--learn-more-.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Type of Application Page (Learn More) -description: Type of Application Page (Learn More) -author: manikadhiman -ms.assetid: d1262d16-7b14-441e-8500-7974bf68d196 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Type of Application Page (Learn More) - - -Use the **Type of Application** page to specify the type of application you are sequencing. It is important to understand and select the correct type of application you are sequencing so you can ensure you take the correct steps toward successful package creation. - -This page contains the following elements: - -**Standard Application (default)** -Select this option to create a package that contains an application or a suite of applications. You should select this option for most applications you plan to sequence. - -**Add-on or Plug-in** -Select this option to create a package that extends the functionality of a standard application; for example, a plug-in for Microsoft Excel. - -**Middleware** -Select this option to create a package that is required by a standard application, for example, the Microsoft .NET Framework. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unload-app.md b/mdop/appv-v4/unload-app.md deleted file mode 100644 index 692d0b2a1b..0000000000 --- a/mdop/appv-v4/unload-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: UNLOAD APP -description: UNLOAD APP -author: manikadhiman -ms.assetid: f0d729ae-8772-498b-be11-1a4b35499c53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNLOAD APP - - -Unloads the application and all other applications in the package from the file system cache. - -`SFTMIME UNLOAD APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application to unload.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unload-package.md b/mdop/appv-v4/unload-package.md deleted file mode 100644 index d0ad6ce857..0000000000 --- a/mdop/appv-v4/unload-package.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: UNLOAD PACKAGE -description: UNLOAD PACKAGE -author: manikadhiman -ms.assetid: a076eb5a-ce3d-49e4-ac7a-4d4df10e3477 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNLOAD PACKAGE - - -Unloads the package from the file system cache. - -`SFTMIME UNLOAD PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          PACKAGE:<package-name>

          The name of the package to unload.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unlock-app.md b/mdop/appv-v4/unlock-app.md deleted file mode 100644 index f003f66e5a..0000000000 --- a/mdop/appv-v4/unlock-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: UNLOCK APP -description: UNLOCK APP -author: manikadhiman -ms.assetid: 91fc8ceb-b4f5-4a06-8193-05189f830943 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNLOCK APP - - -Unlocks the application specified in the file system cache. - -`SFTMIME UNLOCK APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          APP:<application>

          The name and version (optional) of the application to unlock.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unpublish-package.md b/mdop/appv-v4/unpublish-package.md deleted file mode 100644 index 28df41e62d..0000000000 --- a/mdop/appv-v4/unpublish-package.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: UNPUBLISH PACKAGE -description: UNPUBLISH PACKAGE -author: manikadhiman -ms.assetid: 1651427c-72a5-4701-bb57-71e14a7a3803 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNPUBLISH PACKAGE - - -Enables you to remove the shortcuts and file types for an entire package. - -`SFTMIME UNPUBLISH PACKAGE:package-name [/CLEAR] [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          PACKAGE:<package-name>

          The name of the package.

          /CLEAR

          If present, user settings will also be removed. (For more information, see the Important note later in this topic.)

          /GLOBAL

          If present, the package will be unpublished for all users on this computer.

          /LOG

          If specified, output is logged to the specified path name.

          /CONSOLE

          If specified, output is presented in the active console window (default).

          /GUI

          If specified, output is presented in a Windows dialog box.

          - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

          /LOGU

          If specified, output is logged to the specified path name in UNICODE format.

          - - - -**Important**   -Before you can run the **UNPUBLISH PACKAGE** command, the package must already have been added to the Application Virtualization Client. - -To use **GLOBAL**, **UNPUBLISH PACKAGE** must be run as local Administrator; otherwise, only **ClearApp** permission is needed. - -Using **UNPUBLISH PACKAGE** with **GLOBAL** removes any global file types and shortcuts for the package. **CLEAR** is not applicable. - -Using **UNPUBLISH PACKAGE** without **GLOBAL** removes the user shortcuts and file types for the package and, if **CLEAR** is set, also removes user settings and stops background loads under the user’s context. - -**UNPUBLISH PACKAGE** works on applications from the same package name or GUID that was used as the source ID for **ADD**, **EDIT**, and **PUBLISH PACKAGE**. - -**UNPUBLISH PACKAGE** always clears all the user settings, shortcuts, and file types regardless of the use of the /CLEAR switch. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md b/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md deleted file mode 100644 index 1517ada613..0000000000 --- a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md +++ /dev/null @@ -1,134 +0,0 @@ ---- -title: User Access Permissions in Application Virtualization Client -description: User Access Permissions in Application Virtualization Client -author: manikadhiman -ms.assetid: 7459374c-810c-45e3-b205-fdd1f8514f80 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Access Permissions in Application Virtualization Client - - -On the **Permissions** tab on the **Properties** dialog box, accessible by right-clicking the **Application Virtualization** node in the Application Virtualization Client Management Console, administrators can grant users permissions to use the various client functions. - -**Note**   -Before changing users permissions, ensure that any permissions changes are consistent with the organization's guidelines for granting user permissions. - - - -The following table lists and describes the permissions that can be granted to users. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Permission NameDescription

          Add applications

          Register new applications by passing a new OSD file to the client by using sfttray.exe, sftmime.exe or the MMC.

          Change file system cache size

          Increase the size of the file system cache.

          Change file system drive

          Select a different preferred drive letter for the file system.

          Change log settings

          Change the log level or the log path for the client log file.

          Change OSD files

          Modify OSD files for registered applications and pass them into the client. This does not affect publishing refresh.

          Clear application settings

          Delete file types, shortcuts and any configurations for the current user.

          Delete applications

          Remove all references to an application from the file system and OSD cache for all users on the computer.

          Import applications into the cache

          Load application data directly from a specified SFT file into the file system cache. This affects all users.

          Load applications into the cache

          Start a load of the SFT file for an application from the configured source, such as an App-V Streaming Server. This loads the application for all users on the computer.

          Lock and unlock applications in the cache

          Prevent or allow applications from being unloaded from the file system cache. This affects all users on the computer.

          Manage file type associations

          Add, modify, or delete file type associations for the current user only.

          Manage publishing refresh settings

          Change settings that control the timing of publishing refreshes for all users on the computer.

          Manage publishing servers

          Add, modify, or delete publishing servers for all users on the computer. This permission implicitly includes permission to manage publishing refresh settings.

          Publish shortcuts

          Create new shortcuts to registered applications. The user must also have permission to create files in the local file system.

          Repair applications

          Remove application specific configurations for the current user without removing shortcuts or file type associations.

          Start a publishing refresh

          Start an unscheduled publishing refresh for the current user.

          Toggle offline mode

          Change the entire client from online to offline mode for all users.

          Unload applications from the cache

          Clear application data from the file system cache for all users without removing user-specific settings, shortcuts, or file type associations.

          View all applications

          Allow the user to see the virtual applications for all users registered on the computer.

          - - - -## Related topics - - -[How to Change User Access Permissions](how-to-change-user-access-permissions.md) - - - - - - - - - diff --git a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md b/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md deleted file mode 100644 index 0537d830a9..0000000000 --- a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Using Application Virtualization Servers as a Package Management Solution -description: Using Application Virtualization Servers as a Package Management Solution -author: manikadhiman -ms.assetid: 41597355-e7bb-45e2-b300-7b1724419975 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using Application Virtualization Servers as a Package Management Solution - - -If you do not have an existing ESD system to deploy your Application Virtualization solution or do not wish to use one, you will need to install one or more Application Virtualization Management Servers as the core of your system architecture. The Application Virtualization Management Server requires a dedicated server computer and needs a Microsoft SQL Server database. The database can be on the same server, or it can be configured on a corporate database server that is accessible to the Application Virtualization Management Server over a high-speed LAN connection. In addition, you will need to install the Microsoft Application Virtualization Management Console, on either the Application Virtualization Management Server or on a designated management workstation, and you will need to install the Microsoft Application Virtualization Management Web Service, which can also be installed on the Application Virtualization Management Server or on a separate IIS server. The Application Virtualization Management Console is used to connect to the Application Virtualization Management Web Service, enabling the system administrator to interact with the Application Virtualization Management Server. - -**Note**   -Access to the applications is controlled by means of Security Groups in Active Directory Domain Services, so you will need to plan a process to set up a security group for each virtualized application and for managing which users are added to each group. The Application Virtualization Management Server administrator configures the server to use these Active Directory groups, and the server then automatically controls access to the packages based on Active Directory group membership. - - - -## In This Section - - -[Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) -Lists and describes the primary components of the Microsoft Application Virtualization Management System. - -[Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) -Provides a brief overview of how virtual applications are published in an Application Virtualization Server-based deployment scenario. - -[Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) -Describes available options for using Application Virtualization Streaming Servers in conjunction with your Application Virtualization Management Server-based implementation. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md b/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md deleted file mode 100644 index 4788d4f85f..0000000000 --- a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Using Electronic Software Distribution as a Package Management Solution -description: Using Electronic Software Distribution as a Package Management Solution -author: manikadhiman -ms.assetid: 7d96ea70-3e7e-49fa-89cc-586804a10657 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using Electronic Software Distribution as a Package Management Solution - - -In Application Virtualization, after you have sequenced and tested a package, you need to deploy the virtual application package to the target computers. To accomplish this, you will need to determine where to put the package content and how to deliver it to the end user computers. An efficient, effective electronic software distribution–based deployment plan will help you avoid the situation where large numbers of end users computers need to retrieve the package content over slow network connections. - -If you currently have an electronic software distribution (ESD) system in daily operation, you can use it to handle all necessary management tasks in Application Virtualization. This means that you can effectively use your existing infrastructure to the best advantage, without the need to add new servers and application software or incur the additional administrative overhead that these would require. Ideally, if you have System Center Configuration Manager 2007 R2 deployed and operational, you will find that Configuration Manager has built-in capability for performing the Application Virtualization management tasks. - -For in-depth information about performing an ESD-based deployment, [Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md). - -## In This Section - - -[Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) -Describes the available ESD-based methods for distributing your sequenced applications to clients. - -[Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) -Describes available options for using a streaming server to deploy your sequenced applications to clients. - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/verify-applications-page--package-accelerators-.md b/mdop/appv-v4/verify-applications-page--package-accelerators-.md deleted file mode 100644 index dc6a8604e7..0000000000 --- a/mdop/appv-v4/verify-applications-page--package-accelerators-.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Verify Applications Page (Package Accelerators) -description: Verify Applications Page (Package Accelerators) -author: manikadhiman -ms.assetid: e58a37db-d042-453f-aa0d-2f324600a35b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Verify Applications Page (Package Accelerators) - - -Use the **Verify Applications** page to review the installer file dependencies that are saved with the package. These files are required when the Package Accelerator is used to create a new virtual application package. - -You can add or edit the following types of information. Only the application **Name** is required; however, you should provide as much information as possible to help ensure that a new virtual application package is created successfully when you use a package accelerator: - -- **Name**. You must specify a name. - -- **Publisher**. Optionally specify information about the application publisher. - -- **Version**. Optionally specify application version information. - -- **Language**. Optionally specify language information. - -This page contains the following elements: - -**Add** -Adds a new installation file dependency that will be required when the Package Accelerator is applied. - -**Delete** -Deletes a selected dependency file that is currently part of the Package Accelerator. - -**Edit** -Enables you to edit the properties associated with the selected installer file’s dependency. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-application-package-additional-components.md b/mdop/appv-v4/virtual-application-package-additional-components.md deleted file mode 100644 index 42d28df0f0..0000000000 --- a/mdop/appv-v4/virtual-application-package-additional-components.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Virtual Application Package Additional Components -description: Virtual Application Package Additional Components -author: manikadhiman -ms.assetid: 476b0f40-ebd6-4296-92fa-61fa9495c03c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Virtual Application Package Additional Components - - -The App-V Sequencer has detected a directory that contains 64-bit and 32-bit executables and/or dynamic-link library (.dll) files that depend on the same side-by-side assembly. Typically, the Sequencer creates private side-by-side assemblies for all public assemblies that are used by the package; however, it is not possible to create 32-bit and 64-bit versions of the private assemblies in the same directory. - -If the Sequencer detects a single conflict, it will perform the following actions: - -- Remove all of the existing 64-bit private assemblies in the entire package, whether or not the directory has a conflict. - -- Create only 32-bit versions of the private side-by-side assemblies. - -You should natively install public versions of all the required 64-bit assemblies on the computer running the Sequencer and on all App-V client computers. - -To locate the required existing public assemblies, open the directory where the package is saved and look in the **VFS** folder. For example, if the package root is **Q:\\MyApp**, when you sequence the application, look in **Q:\\MyApp\\VFS\\CSIDL\_Windows\\WinSxS\\Manifests** and locate all of the existing public assemblies. The 64-bit versions of these files will always start with the following text at the beginning of the manifest name: **amd64…**. The exact name and version of the assembly can be found in the associated manifest file. - -Use any of the following links to download and install the correct version of the required prerequisites: - -- [Microsoft Visual C++ 2005 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152697) - -- [Microsoft Visual C++ 2005 SP1 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152698) - -- [Microsoft Visual C++ 2008 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152699) - -- [Microsoft Visual C++ 2008 SP1 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152700) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-file-system-tab-keep.md b/mdop/appv-v4/virtual-file-system-tab-keep.md deleted file mode 100644 index 188445d4e4..0000000000 --- a/mdop/appv-v4/virtual-file-system-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Virtual File System Tab -description: Virtual File System Tab -author: manikadhiman -ms.assetid: 9d084e2a-720d-4a25-9cd5-d0d70868b413 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtual File System Tab - - -The **Virtual File System** tab allows you to view and modify the file-mapping information. - -## In This Section - - -[About the Virtual File System Tab](about-the-virtual-file-system-tab.md) -Provides general information about the **Virtual File System** tab. - -[How to Modify File-Mapping Information](how-to-modify-file-mapping-information.md) -Provides the procedure to modify the file-mapping information by using the **Virtual File System** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-registry-tab-keep.md b/mdop/appv-v4/virtual-registry-tab-keep.md deleted file mode 100644 index 832f3dc40b..0000000000 --- a/mdop/appv-v4/virtual-registry-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Virtual Registry Tab -description: Virtual Registry Tab -author: manikadhiman -ms.assetid: 25833383-24c4-40a1-b34c-73b2bd3f11e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtual Registry Tab - - -Use the **Virtual Registry** tab to view and modify the virtual registry key information. - -## In This Section - - -[About the Virtual Registry Tab](about-the-virtual-registry-tab.md) -Provides general information about the **Virtual Registry** tab. - -[How to Modify Virtual Registry Key Information](how-to-modify-virtual-registry-key-information.md) -Provides the procedure to modify the virtual registry key information by using the **Virtual Registry** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-services-tab-keep.md b/mdop/appv-v4/virtual-services-tab-keep.md deleted file mode 100644 index e78e0eee33..0000000000 --- a/mdop/appv-v4/virtual-services-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Virtual Services Tab -description: Virtual Services Tab -author: manikadhiman -ms.assetid: 9fc4679d-ccb5-4df7-99de-dd7d3a367ecc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtual Services Tab - - -Use the **Virtual Services** tab to view and edit the attributes of embedded services. - -## In This Section - - -[About the Virtual Services Tab](about-the-virtual-services-tab.md) -Provides general information about the **Virtual Services** tab. - -[How to Modify Attributes of Embedded Services](how-to-modify-attributes-of-embedded-services.md) -Provides the procedure to modify the attributes of embedded services by using the **Virtual Services** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md b/mdop/appv-v4/wizard-pages--appv-46-sp1-.md deleted file mode 100644 index 8d47e49527..0000000000 --- a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Wizard Pages (AppV 4.6 SP1) -description: Wizard Pages (AppV 4.6 SP1) -author: manikadhiman -ms.assetid: dadab8cf-fe6d-4cff-8f6c-e9676f244872 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Wizard Pages (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V wizards. - -## In This Section - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/TOC.md b/mdop/appv-v5/TOC.md deleted file mode 100644 index db147e8a98..0000000000 --- a/mdop/appv-v5/TOC.md +++ /dev/null @@ -1,223 +0,0 @@ -# [Application Virtualization 5](index.md) -## [Application Virtualization 5.1](microsoft-application-virtualization-51-administrators-guide.md) -### [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) -#### [About App-V 5.1](about-app-v-51.md) -##### [Release Notes for App-V 5.1](release-notes-for-app-v-51.md) -#### [Evaluating App-V 5.1](evaluating-app-v-51.md) -#### [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md) -#### [Accessibility for App-V 5.1](accessibility-for-app-v-51.md) -### [Planning for App-V 5.1](planning-for-app-v-51.md) -#### [Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) -##### [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) -##### [App-V 5.1 Security Considerations](app-v-51-security-considerations.md) -#### [Planning to Deploy App-V 5.1](planning-to-deploy-app-v51.md) -##### [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) -##### [App-V 5.1 Capacity Planning](app-v-51-capacity-planning.md) -##### [Planning for High Availability with App-V 5.1](planning-for-high-availability-with-app-v-51.md) -##### [Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md) -##### [Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md) -##### [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md) -##### [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md) -##### [Planning for Using App-V with Office 5.1](planning-for-using-app-v-with-office51.md) -##### [Planning to Use Folder Redirection with App-V 5.1](planning-to-use-folder-redirection-with-app-v51.md) -#### [App-V 5.1 Planning Checklist](app-v-51-planning-checklist.md) -### [Deploying App-V 5.1](deploying-app-v-51.md) -#### [Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) -##### [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) -##### [About Client Configuration Settings 5.1](about-client-configuration-settings51.md) -##### [How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) -##### [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md) -##### [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) -##### [How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md) -##### [How to Uninstall the App-V 5.1 Client](how-to-uninstall-the-app-v-51-client.md) -#### [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) -##### [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) -##### [How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) -##### [How to Deploy the App-V Databases by Using SQL Scripts 5.1](how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md) -##### [How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer51.md) -##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services 5.1](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md) -##### [How to install the Management Server on a Standalone Computer and Connect it to the Database 5.1](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) -##### [About App-V 5.1 Reporting](about-app-v-51-reporting.md) -##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database 5.1](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) -#### [App-V 5.1 Deployment Checklist](app-v-51-deployment-checklist.md) -#### [Deploying Microsoft Office 2016 by Using App-V 5.1](deploying-microsoft-office-2016-by-using-app-v51.md) -#### [Deploying Microsoft Office 2013 by Using App-V 5.1](deploying-microsoft-office-2013-by-using-app-v51.md) -#### [Deploying Microsoft Office 2010 by Using App-V 5.1](deploying-microsoft-office-2010-by-using-app-v51.md) -### [Operations for App-V 5.1](operations-for-app-v-51.md) -#### [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) -##### [How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md) -##### [How to Modify an Existing Virtual Application Package 5.1](how-to-modify-an-existing-virtual-application-package-51.md) -##### [How to Create and Use a Project Template 5.1](how-to-create-and-use-a-project-template51.md) -##### [How to Create a Package Accelerator 5.1](how-to-create-a-package-accelerator51.md) -##### [How to Create a Virtual Application Package Using an App-V Package Accelerator 5.1](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md) -#### [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) -##### [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) -##### [How to Connect to the Management Console 5.1](how-to-connect-to-the-management-console-51.md) -##### [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) -##### [How to Configure Access to Packages by Using the Management Console 5.1](how-to-configure-access-to-packages-by-using-the-management-console-51.md) -##### [How to Publish a Package by Using the Management Console 5.1](how-to-publish-a-package-by-using-the-management-console-51.md) -##### [How to Delete a Package in the Management Console 5.1](how-to-delete-a-package-in-the-management-console-51.md) -##### [How to Add or Remove an Administrator by Using the Management Console 5.1](how-to-add-or-remove-an-administrator-by-using-the-management-console51.md) -##### [How to Register and Unregister a Publishing Server by Using the Management Console 5.1](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md) -##### [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md) -##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console 5.1](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md) -##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console 5.1](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md) -##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console 5.1](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md) -#### [Managing Connection Groups 5.1](managing-connection-groups51.md) -##### [About the Connection Group Virtual Environment 5.1](about-the-connection-group-virtual-environment51.md) -##### [About the Connection Group File 5.1](about-the-connection-group-file51.md) -##### [How to Create a Connection Group 5.1](how-to-create-a-connection-group51.md) -##### [How to Create a Connection Group with User-Published and Globally Published Packages 5.1](how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md) -##### [How to Delete a Connection Group 5.1](how-to-delete-a-connection-group51.md) -##### [How to Publish a Connection Group 5.1](how-to-publish-a-connection-group51.md) -##### [How to Use Optional Packages in Connection Groups 5.1](how-to-use-optional-packages-in-connection-groups51.md) -##### [How to Make a Connection Group Ignore the Package Version 5.1](how-to-make-a-connection-group-ignore-the-package-version51.md) -##### [How to Allow Only Administrators to Enable Connection Groups 5.1](how-to-allow-only-administrators-to-enable-connection-groups51.md) -#### [Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) -##### [How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md) -##### [How to Enable Only Administrators to Publish Packages by Using an ESD 5.1](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md) -#### [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md) -##### [How to Access the Client Management Console 5.1](how-to-access-the-client-management-console51.md) -##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server 5.1](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md) -#### [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) -##### [Check Registry Keys before installing App-V 5.x Server](check-reg-key-svr.md) -##### [How to Convert a Package Created in a Previous Version of App-V 5.1](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md) -##### [How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) -##### [How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md) -#### [Maintaining App-V 5.1](maintaining-app-v-51.md) -##### [How to Move the App-V Server to Another Computer 5.1](how-to-move-the-app-v-server-to-another-computer51.md) -#### [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) -##### [How to Load the PowerShell Cmdlets and Get Cmdlet Help 5.1](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md) -##### [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md) -##### [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell 5.1](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md) -##### [How to Modify Client Configuration by Using PowerShell 5.1](how-to-modify-client-configuration-by-using-powershell51.md) -##### [How to Apply the User Configuration File by Using PowerShell 5.1](how-to-apply-the-user-configuration-file-by-using-powershell51.md) -##### [How to Apply the Deployment Configuration File by Using PowerShell 5.1](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md) -##### [How to Sequence a Package by Using PowerShell 5.1](how-to-sequence-a-package--by-using-powershell-51.md) -##### [How to Create a Package Accelerator by Using PowerShell 5.1](how-to-create-a-package-accelerator-by-using-powershell51.md) -##### [How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md) -##### [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell 5.1](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md) -### [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) -### [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) -#### [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) -#### [Application Publishing and Client Interaction 5.1](application-publishing-and-client-interaction51.md) -#### [Viewing App-V Server Publishing Metadata 5.1](viewing-app-v-server-publishing-metadata51.md) -#### [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications 5.1](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md) -## [Application Virtualization 5.0](microsoft-application-virtualization-50-administrators-guide.md) -### [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) -#### [About App-V 5.0](about-app-v-50.md) -##### [What's New in App-V 5.0](whats-new-in-app-v-50.md) -##### [Release Notes for App-V 5.0](release-notes-for-app-v-50.md) -#### [About App-V 5.0 SP1](about-app-v-50-sp1.md) -##### [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) -##### [Release Notes for App-V 5.0 SP1](release-notes-for-app-v-50-sp1.md) -#### [About App-V 5.0 SP2](about-app-v-50-sp2.md) -##### [Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md) -#### [About App-V 5.0 SP3](about-app-v-50-sp3.md) -##### [Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md) -#### [Evaluating App-V 5.0](evaluating-app-v-50.md) -#### [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md) -#### [Accessibility for App-V 5.0](accessibility-for-app-v-50.md) -### [Planning for App-V 5.0](planning-for-app-v-50-rc.md) -#### [Preparing Your Environment for App-V 5.0](preparing-your-environment-for-app-v-50.md) -##### [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) -##### [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) -##### [App-V 5.0 Security Considerations](app-v-50-security-considerations.md) -#### [Planning to Deploy App-V](planning-to-deploy-app-v.md) -##### [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) -##### [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md) -##### [App-V 5.0 Capacity Planning](app-v-50-capacity-planning.md) -##### [Planning for High Availability with App-V 5.0](planning-for-high-availability-with-app-v-50.md) -##### [Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md) -##### [Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md) -##### [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) -##### [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md) -##### [Planning for Using App-V with Office](planning-for-using-app-v-with-office.md) -##### [Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v.md) -#### [App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md) -### [Deploying App-V 5.0](deploying-app-v-50.md) -#### [Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) -##### [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) -##### [About Client Configuration Settings](about-client-configuration-settings.md) -##### [How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) -##### [How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md) -##### [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) -##### [How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md) -##### [How to Uninstall the App-V 5.0 Client](how-to-uninstall-the-app-v-50-client.md) -#### [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) -##### [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) -##### [How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) -##### [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md) -##### [How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer.md) -##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md) -##### [How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md) -##### [About App-V 5.0 Reporting](about-app-v-50-reporting.md) -##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md) -#### [App-V 5.0 Deployment Checklist](app-v-50-deployment-checklist.md) -#### [Deploying Microsoft Office 2016 by Using App-V](deploying-microsoft-office-2016-by-using-app-v.md) -#### [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) -#### [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) -### [Operations for App-V 5.0](operations-for-app-v-50.md) -#### [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) -##### [How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md) -##### [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md) -##### [How to Create and Use a Project Template](how-to-create-and-use-a-project-template.md) -##### [How to Create a Package Accelerator](how-to-create-a-package-accelerator.md) -##### [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md) -#### [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) -##### [About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md) -##### [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md) -##### [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) -##### [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md) -##### [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) -##### [How to Delete a Package in the Management Console](how-to-delete-a-package-in-the-management-console-beta.md) -##### [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console.md) -##### [How to Register and Unregister a Publishing Server by Using the Management Console](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md) -##### [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md) -##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md) -##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md) -##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md) -#### [Managing Connection Groups](managing-connection-groups.md) -##### [About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment.md) -##### [About the Connection Group File](about-the-connection-group-file.md) -##### [How to Create a Connection Group](how-to-create-a-connection-group.md) -##### [How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md) -##### [How to Delete a Connection Group](how-to-delete-a-connection-group.md) -##### [How to Publish a Connection Group](how-to-publish-a-connection-group.md) -##### [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md) -##### [How to Make a Connection Group Ignore the Package Version](how-to-make-a-connection-group-ignore-the-package-version.md) -##### [How to Allow Only Administrators to Enable Connection Groups](how-to-allow-only-administrators-to-enable-connection-groups.md) -#### [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) -##### [How to deploy App-V 5.0 Packages Using Electronic Software Distribution](how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md) -##### [How to Enable Only Administrators to Publish Packages by Using an ESD](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md) -#### [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md) -##### [How to Access the Client Management Console](how-to-access-the-client-management-console.md) -##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md) -#### [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) -##### [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md) -##### [How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) -##### [How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md) -#### [Maintaining App-V 5.0](maintaining-app-v-50.md) -##### [How to Move the App-V Server to Another Computer](how-to-move-the-app-v-server-to-another-computer.md) -#### [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) -##### [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md) -##### [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md) -##### [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md) -##### [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell.md) -##### [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md) -##### [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md) -##### [How to Sequence a Package by Using PowerShell](how-to-sequence-a-package--by-using-powershell-50.md) -##### [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell.md) -##### [How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) -##### [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md) -### [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) -### [Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) -#### [Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) -#### [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md) -#### [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata.md) -#### [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md) - diff --git a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md b/mdop/appv-v5/about-app-v-50-dynamic-configuration.md deleted file mode 100644 index 103b44d92c..0000000000 --- a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md +++ /dev/null @@ -1,889 +0,0 @@ ---- -title: About App-V 5.0 Dynamic Configuration -description: About App-V 5.0 Dynamic Configuration -author: manikadhiman -ms.assetid: 88afaca1-68c5-45c4-a074-9371c56b5804 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About App-V 5.0 Dynamic Configuration - - -You can use the dynamic configuration to customize an App-V 5.0 package for a user. Use the following information to create or edit an existing dynamic configuration file. - -When you edit the dynamic configuration file it customizes how an App-V 5.0 package will run for a user or group. This helps to provide a more convenient method for package customization by removing the need to re-sequence packages using the desired settings, and provides a way to keep package content and custom settings independent. - -## Advanced: Dynamic Configuration - - -Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no additional customization). If you want to adjust these defaults for a particular user or group, you can create and edit the following files: - -- User Configuration file - -- Deployment configuration file - -The previous .xml files specify package settings and allow for packages to be customized without directly affecting the packages. When a package is created, the sequencer automatically generates default deployment and user configuration .xml files using the package manifest data. Therefore, these automatically generated configuration files simply reflect the default settings that the package innately as from how things were configured during sequencing. If you apply these configuration files to a package in the form generated by the sequencer, the packages will have the same default settings that came from their manifest. This provides you with a package-specific template to get started if any of the defaults must be changed. - -**Note**   -The following information can only be used to modify sequencer generated configuration files to customize packages to meet specific user or group requirements. - - - -### Dynamic Configuration file contents - -All of the additions, deletions, and updates in the configuration files need to be made in relation to the default values specified by the package's manifest information. Review the following table: - - --- - - - - - - - - - - - -

          User Configuration .xml file

          Deployment Configuration .xml file

          Package Manifest

          - - - -The previous table represents how the files will be read. The first entry represents what will be read last, therefore, its content takes precedence. Therefore, all packages inherently contain and provide default settings from the package manifest. If a deployment configuration .xml file with customized settings is applied, it will override the package manifest defaults. If a user configuration .xml file with customized settings is applied prior to that, it will override both the deployment configuration and the package manifest defaults. - -The following list displays more information about the two file types: - -- **User Configuration File (UserConfig)** – Allows you to specify or modify custom settings for a package. These settings will be applied for a specific user when the package is deployed to a computer running the App-V 5.0 client. - -- **Deployment Configuration File (DeploymentConfig)** – Allows you to specify or modify the default settings for a package. These settings will be applied for all users when a package is deployed to a computer running the App-V 5.0 client. - -To customize the settings for a package for a specific set of users on a computer or to make changes that will be applied to local user locations such as HKCU, the UserConfig file should be used. To modify the default settings of a package for all users on a machine or to make changes that will be applied to global locations such as HKEY\_LOCAL\_MACHINE and the all users folder, the DeploymentConfig file should be used. - -The UserConfig file provides configuration settings that can be applied to a single user without affecting any other users on a client: - -- Extensions that will be integrated into the native system per user:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM - -- Virtual Subsystems:- Application Objects, Environment variables, Registry modifications, Services and Fonts - -- Scripts (User context only) - -- Managing Authority (for controlling co-existence of package with App-V 4.6) - -The DeploymentConfig file provides configuration settings in two sections, one relative to the machine context and one relative to the user context providing the same capabilities listed in the UserConfig list above: - -- All UserConfig settings above - -- Extensions that can only be applied globally for all users - -- Virtual Subsystems that can be configured for global machine locations e.g. registry - -- Product Source URL - -- Scripts (Machine context only) - -- Controls to Terminate Child Processes - -### File structure - -The structure of the App-V 5.0 Dynamic Configuration file is explained in the following section. - -### Dynamic User Configuration file - -**Header** - the header of a dynamic user configuration file is as follows: - -<?xml version="1.0" encoding="utf-8"?><UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - -The **PackageId** is the same value as exists in the Manifest file. - -**Body** - the body of the Dynamic User Configuration file can include all the app extension points that are defined in the Manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body: - -1. **Applications** - All app-extensions that are contained in the Manifest file within a package are assigned with an Application ID, which is also defined in the manifest file. This allows you to enable or disable all the extensions for a given application within a package. The **Application ID** must exist in the Manifest file or it will be ignored. - - <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - - <Applications> - - <!-- No new application can be defined in policy. AppV Client will ignore any application ID that is not also in the Manifest file --> - - <Application Id="{a56fa627-c35f-4a01-9e79-7d36aed8225a}" Enabled="false"> - - </Application> - - </Applications> - - … - - </UserConfiguration> - -2. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under the <Subsystems>: - - <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - - <Subsystems> - - .. - - </Subsystems> - - .. - - </UserConfiguration> - - Each subsystem can be enabled/disabled using the “**Enabled**” attribute. Below are the various subsystems and usage samples. - - **Extensions:** - - Some subsystems (Extension Subsystems) control Extensions. Those subsystems are:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM - - Extension Subsystems can be enabled and disabled independently of the content. Thus if Shortcuts are enabled, The client will use the shortcuts contained within the manifest by default. Each Extension Subsystem can contain an <Extensions> node. If this child element is present, the client will ignore the content in the Manifest file for that subsystem and only use the content in the configuration file. - - Example using the shortcuts subsystem: - - 1. If the user defined this in either the dynamic or deployment config file: - - **<Shortcuts Enabled="true">** - - **<Extensions>** - - ... - - **</Extensions>** - - **</Shortcuts>** - - Content in the manifest will be ignored. - - 2. If the user defined only the following: - - **<Shortcuts Enabled="true"/>** - - Then the content in the Manifest will be integrated during publishing. - - 3. If the user defines the following - - **<Shortcuts Enabled="true">** - - **<Extensions/>** - - **</Shortcuts>** - - Then all the shortcuts within the manifest will still be ignored. There will be no shortcuts integrated. - - The supported Extension Subsystems are: - - **Shortcuts:** This controls shortcuts that will be integrated into the local system. Below is a sample with 2 shortcuts: - - <Subsystems> - - <Shortcuts Enabled="true"> - - <Extensions> - - <Extension Category="AppV.Shortcut"> - - <Shortcut> - - <File>\[{Common Programs}\]\\Microsoft Contoso\\Microsoft ContosoApp Filler 2010.lnk</File> - - <Target>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</Target> - - <Icon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\inficon.exe</Icon> - - <Arguments /> - - <WorkingDirectory /> - - <AppUserModelId>ContosoApp.Filler.3</AppUserModelId> - - <Description>Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp.</Description> - - <Hotkey>0</Hotkey> - - <ShowCommand>1</ShowCommand> - - <ApplicationId>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</ApplicationId> - - </Shortcut> - - </Extension> - - <Extension Category="AppV.Shortcut"> - - <Shortcut> - - <File>\[{AppData}\]\\Microsoft\\Contoso\\Recent\\Templates.LNK</File> - - <Target>\[{AppData}\]\\Microsoft\\Templates</Target> - - <Icon /> - - <Arguments /> - - <WorkingDirectory /> - - <AppUserModelId /> - - <Description /> - - <Hotkey>0</Hotkey> - - <ShowCommand>1</ShowCommand> - - <!-- Note the ApplicationId is optional --> - - </Shortcut> - - </Extension> - - </Extensions> - - </Shortcuts> - - **File-Type Associations:** Associates File-types with programs to open by default as well as setup the context menu. (MIME types can also be setup using this susbsystem). Sample File-type Association is below: - - <FileTypeAssociations Enabled="true"> - - <Extensions> - - <Extension Category="AppV.FileTypeAssociation"> - - <FileTypeAssociation> - - <FileExtension MimeAssociation="true"> - - <Name>.docm</Name> - - <ProgId>contosowordpad.DocumentMacroEnabled.12</ProgId> - - <PerceivedType>document</PerceivedType> - - <ContentType>application/vnd.ms-contosowordpad.document.macroEnabled.12</ContentType> - - <OpenWithList> - - <ApplicationName>wincontosowordpad.exe</ApplicationName> - - </OpenWithList> - - <OpenWithProgIds> - - <ProgId>contosowordpad.8</ProgId> - - </OpenWithProgIds> - - <ShellNew> - - <Command /> - - <DataBinary /> - - <DataText /> - - <FileName /> - - <NullFile>true</NullFile> - - <ItemName /> - - <IconPath /> - - <MenuText /> - - <Handler /> - - </ShellNew> - - </FileExtension> - - <ProgId> - - <Name>contosowordpad.DocumentMacroEnabled.12</Name> - - <DefaultIcon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\contosowordpadicon.exe,15</DefaultIcon> - - <Description>Blah Blah Blah</Description> - - <FriendlyTypeName>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,9182</FriendlyTypeName> - - <InfoTip>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,1424</InfoTip> - - <EditFlags>0</EditFlags> - - <ShellCommands> - - <DefaultCommand>Open</DefaultCommand> - - <ShellCommand> - - <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId> - - <Name>Edit</Name> - - <FriendlyName>&Edit</FriendlyName> - - <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /vu "%1"</CommandLine> - - </ShellCommand> - - </ShellCommand> - - <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId> - - <Name>Open</Name> - - <FriendlyName>&Open</FriendlyName> - - <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /n "%1"</CommandLine> - - <DropTargetClassId /> - - <DdeExec> - - <Application>mscontosowordpad</Application> - - <Topic>ShellSystem</Topic> - - <IfExec>\[SHELLNOOP\]</IfExec> - - <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand> - - </DdeExec> - - </ShellCommand> - - </ShellCommands> - - </ProgId> - - </FileTypeAssociation> - - </Extension> - - </Extensions> - - </FileTypeAssociations> - - **URL Protocols**: This controls the URL Protocols that are integrated into the local registry of the client machine e.g. “mailto:”. - - <URLProtocols Enabled="true"> - - <Extensions> - - <Extension Category="AppV.URLProtocol"> - - <URLProtocol> - - <Name>mailto</Name> - - <ApplicationURLProtocol> - - <DefaultIcon>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE,-9403</DefaultIcon> - - <EditFlags>2</EditFlags> - - <Description /> - - <AppUserModelId /> - - <FriendlyTypeName /> - - <InfoTip /> - - <SourceFilter /> - - <ShellFolder /> - - <WebNavigableCLSID /> - - <ExplorerFlags>2</ExplorerFlags> - - <CLSID /> - - <ShellCommands> - - <DefaultCommand>open</DefaultCommand> - - <ShellCommand> - - <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId> - - <Name>open</Name> - - <CommandLine>\[{ProgramFilesX86}\\Microsoft Contoso\\Contoso\\contosomail.EXE" -c OEP.Note /m "%1"</CommandLine> - - <DropTargetClassId /> - - <FriendlyName /> - - <Extended>0</Extended> - - <LegacyDisable>0</LegacyDisable> - - <SuppressionPolicy>2</SuppressionPolicy> - - <DdeExec> - - <NoActivateHandler /> - - <Application>contosomail</Application> - - <Topic>ShellSystem</Topic> - - <IfExec>\[SHELLNOOP\]</IfExec> - - <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand> - - </DdeExec> - - </ShellCommand> - - </ShellCommands> - - </ApplicationURLProtocol> - - </URLProtocol> - - </Extension> - - </Extension> - - </URLProtocols> - - **Software Clients**: Allows the app to register as an Email client, news reader, media player and makes the app visible in the Set Program Access and Computer Defaults UI. In most cases you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client. - - <SoftwareClients Enabled="true"> - - <ClientConfiguration EmailEnabled="false" /> - - </SoftwareClients> - - AppPaths:- If an application for example contoso.exe is registered with an apppath name of “myapp”, it allows you type “myapp” under the run menu and it will open contoso.exe. - - <AppPaths Enabled="true"> - - <Extensions> - - <Extension Category="AppV.AppPath"> - - <AppPath> - - <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId> - - <Name>contosomail.exe</Name> - - <ApplicationPath>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationPath> - - <PATHEnvironmentVariablePrefix /> - - <CanAcceptUrl>false</CanAcceptUrl> - - <SaveUrl /> - - </AppPath> - - </Extension> - - </Extensions> - - </AppPaths> - - **COM**: Allows an Application register Local COM servers. Mode can be Integration, Isolated or Off. When Isol. - - <COM Mode="Isolated"/> - - **Other Settings**: - - In addition to Extensions, other subsystems can be enabled/disabled and edited: - - **Virtual Kernel Objects**: - - <Objects Enabled="false" /> - - **Virtual Registry**: Used if you want to set a registry in the Virtual Registry within HKCU - - <Registry Enabled="true"> - - <Include> - - <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\ABC"> - - <Value Type="REG\_SZ" Name="Bar" Data="NewValue" /> - - </Key> - - <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\EmptyKey" /> - - </Include> - - <Delete> - - </Registry> - - **Virtual File System** - - <FileSystem Enabled="true" /> - - **Virtual Fonts** - - <Fonts Enabled="false" /> - - **Virtual Environment Variables** - - <EnvironmentVariables Enabled="true"> - - <Include> - - <Variable Name="UserPath" Value="%path%;%UserProfile%" /> - - <Variable Name="UserLib" Value="%UserProfile%\\ABC" /> - - </Include> - - <Delete> - - <Variable Name="lib" /> - - </Delete> - - </EnvironmentVariables> - - **Virtual services** - - <Services Enabled="false" /> - -3. **UserScripts** – Scripts can be used to setup or alter the virtual environment as well as execute scripts at time of deployment or removal, before an application executes, or they can be used to “clean up” the environment after the application terminates. Please reference a sample User configuration file that is output by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used. - -4. **ManagingAuthority** – Can be used when 2 versions of your package are co-existing on the same machine, one deployed to App-V 4.6 and the other deployed on App-V 5.0. To Allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6: - - <ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName="032630c0-b8e2-417c-acef-76fc5297fe81" /> - -### Dynamic Deployment Configuration file - -**Header** - The header of a Deployment Configuration file is as follows: - -<?xml version="1.0" encoding="utf-8"?><DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - -The **PackageId** is the same value as exists in the manifest file. - -**Body** - The body of the deployment configuration file includes two sections: - -- User Configuration section –allows the same content as the User Configuration file described in the previous section. When the package is published to a user, any appextensions configuration settings in this section will override corresponding settings in the Manifest within the package unless a user configuration file is also provided. If a UserConfig file is also provided, it will be used instead of the User settings in the deployment configuration file. If the package is published globally, then only the contents of the deployment configuration file will be used in combination with the manifest. - -- Machine Configuration section–contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY\_LOCAL\_MACHINE registry keys in the VFS. - -<DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - -<UserConfiguration> - - .. - -</UserConfiguration> - -<MachineConfiguration> - -.. - -</MachineConfiguration> - -.. - -</MachineConfiguration> - -</DeploymentConfiguration> - -**User Configuration** - use the previous **Dynamic User Configuration file** section for information on settings that are provided in the user configuration section of the Deployment Configuration file. - -Machine Configuration - the Machine configuration section of the Deployment Configuration File is used to configure information that can be set only for an entire machine, not for a specific user on the computer. For example, HKEY\_LOCAL\_MACHINE registry keys in the Virtual Registry. There are four subsections allowed in under this element - -1. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under <Subsystems>: - - <MachineConfiguration> - - <Subsystems> - - .. - - </Subsystems> - - .. - - </MachineConfiguration> - - The following section displays the various subsystems and usage samples. - - **Extensions**: - - Some subsystems (Extension Subsystems) control Extensions which can only apply to all users. The subsystem is application capabilities. Because this can only apply to all users, the package must be published globally in order for this type of extension to be integrated into the local system. The same rules for controls and settings that apply to the Extensions in the User Configuration also apply to those in the MachineConfiguration section. - - **Application Capabilities**: Used by default programs in windows operating system Interface. Allows an application to register itself as capable of opening certain file extensions, as a contender for the start menu internet browser slot, as capable of opening certain windows MIME types.  This extension also makes the virtual application visible in the Set Default Programs UI.: - - <ApplicationCapabilities Enabled="true"> - - <Extensions> - - <Extension Category="AppV.ApplicationCapabilities"> - - <ApplicationCapabilities> - - <ApplicationId>\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe</ApplicationId> - - <Reference> - - <Name>LitView Browser</Name> - - <Path>SOFTWARE\\LitView\\Browser\\Capabilities</Path> - - </Reference> - - <CapabilityGroup> - - <Capabilities> - - <Name>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12345</Name> - - <Description>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12346</Description> - - <Hidden>0</Hidden> - - <EMailSoftwareClient>Lit View E-Mail Client</EMailSoftwareClient> - - <FileAssociationList> - - <FileAssociation Extension=".htm" ProgID="LitViewHTML" /> - - <FileAssociation Extension=".html" ProgID="LitViewHTML" /> - - <FileAssociation Extension=".shtml" ProgID="LitViewHTML" /> - - </FileAssociationList> - - <MIMEAssociationList> - - <MIMEAssociation Type="audio/mp3" ProgID="LitViewHTML" /> - - <MIMEAssociation Type="audio/mpeg" ProgID="LitViewHTML" /> - - </MIMEAssociationList> - - <URLAssociationList> - - <URLAssociation Scheme="http" ProgID="LitViewHTML.URL.http" /> - - </URLAssociationList> - - </Capabilities> - - </CapabilityGroup> - - </ApplicationCapabilities> - - </Extension> - - </Extensions> - - </ApplicationCapabilities> - - **Other Settings**: - - In addition to Extensions, other subsystems can be edited: - - **Machine Wide Virtual Registry**: Used when you want to set a registry key in the virtual registry within HKEY\_Local\_Machine - - <Registry> - - <Include> - - <Key Path="\\REGISTRY\\Machine\\Software\\ABC"> - - <Value Type="REG\_SZ" Name="Bar" Data="Baz" /> - - </Key> - - <Key Path="\\REGISTRY\\Machine\\Software\\EmptyKey" /> - - </Include> - - <Delete> - - </Registry> - - **Machine Wide Virtual Kernel Objects** - - <Objects> - - <NotIsolate> - - <Object Name="testObject" /> - - </NotIsolate> - - </Objects> - -2. **ProductSourceURLOptOut**: Indicates whether the URL for the package can be modified globally through PackageSourceRoot (to support branch office scenarios). Default is false and the setting change takes effect on the next launch.   - - <MachineConfiguration> - - ..  - - <ProductSourceURLOptOut Enabled="true" /> - - .. - - </MachineConfiguration> - -3. **MachineScripts** – Package can be configured to execute scripts at time of deployment, publishing or removal. Please reference a sample deployment configuration file that is generated by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used - -4. **TerminateChildProcess**:- An application executable can be specified, whose child processes will be terminated when the application exe process is terminated. - - <MachineConfiguration> - - ..    - - <TerminateChildProcesses> - - <Application Path="\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE" /> - - <Application Path="\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe" /> - - <Application Path="\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE" /> - - </TerminateChildProcesses> - - .. - - </MachineConfiguration> - -### Scripts - -The following table describes the various script events and the context under which they can be run. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Script Execution TimeCan be specified in Deployment ConfigurationCan be specified in User ConfigurationCan run in the Virtual Environment of the packageCan be run in the context of a specific applicationRuns in system/user context: (Deployment Configuration, User Configuration)

          AddPackage

          X

          (SYSTEM, N/A)

          PublishPackage

          X

          X

          (SYSTEM, User)

          UnpublishPackage

          X

          X

          (SYSTEM, User)

          RemovePackage

          X

          (SYSTEM, N/A)

          StartProcess

          X

          X

          X

          X

          (User, User)

          ExitProcess

          X

          X

          X

          (User, User)

          StartVirtualEnvironment

          X

          X

          X

          (User, User)

          TerminateVirtualEnvironment

          X

          X

          (User, User)

          - - - -### Create a Dynamic Configuration file using an App-V 5.0 Manifest file - -You can create the Dynamic Configuration file using one of three methods: either manually, using the App-V 5.0 Management Console or sequencing a package, which will be generated with 2 sample files. - -For more information about how to create the file using the App-V 5.0 Management Console see, [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md). - -To create the file manually, the information above in previous sections can be combined into a single file. We recommend you use files generated by the sequencer. - - - - - - -## Related topics - - -[How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md) - -[How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md) - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-reporting.md b/mdop/appv-v5/about-app-v-50-reporting.md deleted file mode 100644 index a050c4a164..0000000000 --- a/mdop/appv-v5/about-app-v-50-reporting.md +++ /dev/null @@ -1,327 +0,0 @@ ---- -title: About App-V 5.0 Reporting -description: About App-V 5.0 Reporting -author: manikadhiman -ms.assetid: 27c33dda-f017-41e3-8a78-1b681543ec4f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 Reporting - - -Microsoft Application Virtualization (App-V) 5.0 includes a built-in reporting feature that helps you collect information about computers running the App-V 5.0 client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. - -## App-V 5.0 Reporting Overview - - -The following list displays the end–to-end high-level workflow for reporting in App-V 5.0. - -1. The Microsoft Application Virtualization (App-V) 5.0 Reporting server has the following prerequisites: - - - Internet Information Service (IIS) web server role - - - Windows Authentication role (under **IIS / Security**) - - - SQL Server installed and running with SQL Server Reporting Services (SSRS) - - To confirm SQL Server Reporting Services is running, view `http://localhost/Reports` in a web browser as administrator on the server that will host App-V 5.0 Reporting. The SQL Server Reporting Services Home page should display. - -2. Install the App-V 5.0 reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md). Configure the time when the computer running the App-V 5.0 client should send data to the reporting server. - -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at . - - **Note**   - If you are using the Configuration Manager integration with App-V 5.0, most reports are generated from Configuration Manager rather than from App-V 5.0. - - - -4. After importing the App-V 5.0 PowerShell module using `Import-Module AppvClient` as administrator, enable the App-V 5.0 client. This sample PowerShell cmdlet enables App-V 5.0 reporting: - - ``` syntax - Set-AppvClientConfiguration –reportingserverurl : -reportingenabled 1 – ReportingStartTime <0-23> - ReportingRandomDelay <#min> - ``` - - To immediately send App-V 5.0 report data, run `Send-AppvClientReport` on the App-V 5.0 client. - - For more information about installing the App-V 5.0 client with reporting enabled see [About Client Configuration Settings](about-client-configuration-settings.md). To administer App-V 5.0 Reporting with Windows PowerShell, see [How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md). - -5. After the reporting server receives the data from the App-V 5.0 client it sends the data to the reporting database. When the database receives and processes the client data, a successful reply is sent to the reporting server and then a notification is sent to the App-V 5.0 client. - -6. When the App-V 5.0 client receives the success notification, it empties the data cache to conserve space. - - **Note**   - By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. - - - -~~~ -If the App-V 5.0 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. -~~~ - -### App-V 5.0 reporting server frequently asked questions - -The following table displays answers to common questions about App-V 5.0 reporting - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          QuestionMore Information

          What is the frequency that reporting information is sent to the reporting database?

          The frequency depends on how the reporting task is configured on the computer running the App-V 5.0 client. You must configure the frequency / interval for sending the reporting data. App-V 5.0 Reporting is not enabled by default.

          What information is stored in the reporting server database?

          The following list displays what is stored in the reporting database:

          -
            -
          • The operating system running on the computer running the App-V 5.0 client: host name, version, service pack, type - client/server, processor architecture.

          • -
          • App-V 5.0 Client information: version.

          • -
          • Published package list: GUID, version GUID, name.

          • -
          • Application usage information: name, version, streaming server, user (domain\alias), package version GUID, launch status and time, shutdown time.

          • -

          What is the average volume of information that is sent to the reporting server?

          It depends. The following list displays the three sets of the data sent to the reporting server:

          -
            -
          1. Operating system, and App-V 5.0 client information. ~150 Bytes, every time this data is sent.

          2. -
          3. Published package list. ~7 KB for 30 packages. This is sent only when the package list is updated with a publishing refresh, which is done infrequently; if there is no change, this information is not sent.

          4. -
          5. Virtual application usage information – about 0.25KB per event. Opening and closing count as one event if both occur before sending the information. When sending using a scheduled task, only the data since the last successful upload is sent to the server. If sending manually through the PowerShell cmdlet, there is an optional argument that controls if the data needs to be re-sent next time around – that argument is DeleteOnSuccess.

            -

            -

            So for example, if twenty applications are opened and closed and reporting information is scheduled to be sent daily, the typical daily traffic should be about 0.15KB + 20 x 0.25KB, or about 5KB/user

          6. -

          Can reporting be scheduled?

          Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting:

          -
            -
          1. Using PowerShell cmdlets - Set-AppvClientConfiguration. For example:

            -

            Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting

            -

            -

            For a complete list of client configuration settings see About Client Configuration Settings and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.

            -

          2. -
          3. By using Group Policy. If distributed using the domain controller, the settings are the same as previously listed.

            -
            -Note

            Group Policy settings override local settings configured using PowerShell.

            -
            -
            - -
          4. -
          - - - -## App-V 5.0 Client Reporting - - -To use App-V 5.0 reporting you must install and configure the App-V 5.0 client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](about-client-configuration-settings.md). The following section provides examples of App-V 5.0 client reporting configuration using PowerShell. - -### Configuring App-V Client reporting using PowerShell - -The following examples show how PowerShell parameters can configure the reporting features of the App-V 5.0 client. - -**Note** -The following configuration task can also be configured using Group Policy settings in the App-V 5.0 ADMX template. For more information about using the ADMX template, see [How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md). - - - -**To enable reporting and to initiate data collection on the computer running the App-V 5.0 client**: - -`Set-AppVClientConfiguration –ReportingEnabled 1` - -**To configure the client to automatically send data to a specific reporting server**: - -``` syntax -Set-AppVClientConfiguration –ReportingServerURL http://MyReportingServer:MyPort/ -ReportingStartTime 20 -ReportingInterval 1 -ReportingRandomDelay 30 -``` - -`-ReportingInterval 1 -ReportingRandomDelay 30` - -This example configures the client to automatically send the reporting data to the reporting server URL http://MyReportingServer:MyPort/. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session. - -**To limit the size of the data cache on the client**: - -`Set-AppvClientConfiguration –ReportingDataCacheLimit 100` - -Configures the maximum size of the reporting cache on the computer running the App-V 5.0 client to 100 MB. If the cache limit is reached before the data is sent to the server, then the log rolls over and data will be overwritten as necessary. - -**To configure the data block size transmitted across the network between the client and the server**: - -`Set-AppvClientConfiguration –ReportingDataBlockSize 10240` - -Specifies the maximum data block that the client sends to 10240 MB. - -### Types of data collected - -The following table displays the types of information you can collect by using App-V 5.0 reporting. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Client InformationPackage InformationApplication Usage

          Host Name

          Package Name

          Start and End Times

          App-V 5.0 Client Version

          Package Version

          Run Status

          Processor Architecture

          Package Source

          Shutdown State

          Operating System Version

          Percent Cached

          Application Name

          Service Pack Level

          Application Version

          Operating System Type

          Username

          Connection Group

          - - - -The client collects and saves this data in an **.xml** format. The data cache is hidden by default and requires administrator rights to open the XML file. - -### Sending data to the server - -You can configure the computer that is running the App-V 5.0 client to automatically send data to the specified reporting server. To specify the server use the **Set-AppvClientConfiguration** cmdlet with the following settings: - -- ReportingEnabled - -- ReportingServerURL - -- ReportingStartTime - -- ReportingInterval - -- ReportingRandomDelay - -After you configure the previous settings, you must create a scheduled task. The scheduled task will contact the server specified by the **ReportingServerURL** setting and will initiate the transfer. If you want to manually send data outside of the scheduled times, use the following PowerShell cmdlet: - -`Send-AppVClientReport –URL http://MyReportingServer:MyPort/ -DeleteOnSuccess` - -If the reporting server has been previously configured, then the **–URL** parameter can be omitted. Alternatively, if the data should be sent to an alternate location, specify a different URL to override the configured **ReportingServerURL** for this data collection. - -The **-DeleteOnSuccess** parameter indicates that if the transfer is successful, then the data cache is cleared. If this is not specified, then the cache will not be cleared. - -### Manual Data Collection - -You can also use the **Send-AppVClientReport** cmdlet to manually collect data. This solution is helpful with or without an existing reporting server. The following list displays information about collecting data with or without a reporting server. - - ---- - - - - - - - - - - - - -
          With a Reporting ServerWithout a Reporting Server

          If you have an existing App-V 5.0 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency.

          If you do not have an existing App-V 5.0 reporting Server, use the –URL parameter to send the data to a specified share. For example:

          -

          Send-AppVClientReport –URL \Myshare\MyData\ -DeleteOnSuccess

          -

          The previous example will send the reporting data to \MyShare\MyData</strong> location indicated by the -URL parameter. After the data has been sent, the cache is cleared.

          -
          -Note

          If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.

          -
          -
          - -
          - - - -### Creating Reports - -To retrieve report information and create reports using App-V 5.0 you must use one of the following methods: - -- **Microsoft SQL Server Reporting Services (SSRS)** - Microsoft SQL Server Reporting Services is available with Microsoft SQL Server. SSRS is not installed when you install the App-V 5.0 reporting server. It must be deployed separately to generate the associated reports. - - Use the following link for more information about using [Microsoft SQL Server Reporting Services](https://go.microsoft.com/fwlink/?LinkId=285596). - -- **Scripting** – You can generate reports by scripting directly against the App-V 5.0 reporting database. For example: - - **Stored Procedure:** - - **spProcessClientReport** is scheduled to run at midnight or 12:00 AM. - - To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. You should ensure that the Microsoft SQL Server Agent is set to **AutoStart**. For more information see [Autostart SQL Server Agent (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=287045). - - The stored procedure is also created when using the App-V 5.0 database scripts. - -You should also ensure that the reporting server web service’s **Maximum Concurrent Connections** is set to a value that the server will be able to manage without impacting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. - - - - - - -## Related topics - - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - -[How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-sp1.md b/mdop/appv-v5/about-app-v-50-sp1.md deleted file mode 100644 index d77515d490..0000000000 --- a/mdop/appv-v5/about-app-v-50-sp1.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: About App-V 5.0 SP1 -description: About App-V 5.0 SP1 -author: manikadhiman -ms.assetid: 2848a51b-452e-4c70-b465-f6717cfa667f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 SP1 - - -This service pack contains the following changes: - -- The App-V 5.0 sequencer and App-V 5.0 client now support twenty-four languages. You can download the additional language packs using the **Volume Licensing Service Center**. - -- The App-V 5.0 server now supports eleven languages. You can download the additional language packs using the **Volume Licensing Service Center**. - -- Support has been added for the App-V 5.0 Volume Shadow Copy Service (VSS) Writer feature. - - **Important**   - To use VSS and App-V 5.0 you must modify the values for the following server registry keys with the updated database names: - - - Management - **HKEY\_LOCAL\_MACHINE** \\ **SOFTWARE** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ManagementService** \\ **MANAGEMENT\_DB\_NAME** - - - Reporting - **HKEY\_LOCAL\_MACHINE** \\ **SOFTWARE** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ReportingService** \\ **REPORTING\_DB\_NAME** - - - -## How to Get MDOP Technologies - - -App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) - -[Release Notes for App-V 5.0 SP1](release-notes-for-app-v-50-sp1.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-sp2.md b/mdop/appv-v5/about-app-v-50-sp2.md deleted file mode 100644 index 9da2057ae1..0000000000 --- a/mdop/appv-v5/about-app-v-50-sp2.md +++ /dev/null @@ -1,183 +0,0 @@ ---- -title: About App-V 5.0 SP2 -description: About App-V 5.0 SP2 -author: manikadhiman -ms.assetid: 16ca8452-cef2-464e-b4b5-c10d4630fa6a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 SP2 - - -App-V 5.0 SP2 provides an improved integrated platform, more flexible virtualization, and powerful management for virtualized applications. For more information see, [App-V 5.0 Overview](https://go.microsoft.com/fwlink/p/?LinkId=325265) (https://go.microsoft.com/fwlink/?LinkId=325265). - -## Changes in Standard App-V 5.0 SP2 Functionality - - -The following sections contain information about the changes in standard functionality for App-V 5.0 SP2. - -### Support for Windows Server 2012 R2 and Windows 8.1 - -App-V 5.0 includes support for Windows Server 2012 R2 and Windows 8.1 - -### App-V 5.0 SP2 now supports folder redirection for the user’s roaming AppData directory - -App-V 5.0 SP2 supports roaming AppData (%AppData%) folder redirection. For more information, see the [Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v.md). - -### Package upgrade improvements and pending tasks - -In App-V 5.0 SP2, you are no longer prompted to close a running virtual application when a newer version of the package or connection group is published. If a package or connection group is in use when you try to perform a related task, a message displays to indicate that the object is in use, and that the operation will be attempted at a later time. - -Tasks that have been placed in a pending state will be performed according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
          Task typeApplicable rule

          User-based task, e.g., publishing a package to a user

          The pending task will be performed after the user logs off and then logs back on.

          Globally based task, e.g., enabling a connection group globally

          The pending task will be performed when the computer is shut down and then restarted.

          - - - -When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: - - ---- - - - - - - - - - - - - - - - - -
          User-based or globally based taskWhere the registry key is generated

          User-based tasks

          KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks

          Globally based tasks

          HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks

          - - - -### Virtualizing Microsoft Office 2013 and Microsoft Office 2010 using App-V 5.0 - -Use the following link for more information about App-V 5.0 supported Microsoft Office scenarios. - -[Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md) - -**Note**   -This document focuses on creating a Microsoft Office 2013 App-V 5.0 Package. However, it also provides information about scenarios for Microsoft Office 2010 with App-V 5.0. - - - -### App-V 5.0 Client Management User Interface Application - -In previous versions of App-V 5.0 the Client Management User Interface (UI) was provided with the App-V 5.0 Client installation. With App-V 5.0 SP2 this is no longer the case. Administrators now have the option to deploy the App-V 5.0 Client UI as a Virtual Application (using all supported App-V deployment configurations) or as an installed application. - -For more information see [Microsoft Application Virtualization 5.0 Client UI Application](https://go.microsoft.com/fwlink/p/?LinkId=386345) (https://go.microsoft.com/fwlink/?LinkId=386345). - -### Side-by-Side (SxS) Assembly Automatic Packaging and Deployment - -App-V 5.0 SP2 now automatically detects side-by-side (SxS) assemblies, and deployment on the computer running the App-V 5.0 SP2 client. A SxS assembly primarily consists of VC++ run-time dependencies or MSXML. In previous versions of App-V, virtual applications that had dependencies on VC run-times required these dependencies to be locally on the computer running the App-V 5.0 SP2 client. - -The following functionality is now supported: - -- The App-V 5.0 sequencer automatically captures the SxS assembly in the package regardless of whether the VC run-time has already been installed on the computer running the sequencer. - -- The App-V 5.0 client automatically installs the required SxS assembly to the computer running the client as required at publishing time. - -- The App-V 5.0 sequencer reports the VC run-time dependency using the sequencer reporting mechanism. - -- The App-V 5.0 sequencer now allows you to exclude the VC run-time dependency in the event that the dependency is already available on the computer running the sequencer. - -### Publishing Refresh Improvements - -App-V 5.0 supports several features were added to improve the overall experience of refreshing a set of applications for a specific user. - -The following list displays the publishing refresh enhancements: - -The following list contains more information about how to enable the new publishing refresh improvements. - -- **EnablePublishingRefreshUI** - Enables the publishing refresh progress bar for the computer running the App-V 5.0 Client. - -- **HideUI** - Hides the publishing refresh progress bar during a manual sync. - -### New Client Configuration Setting - -The following new client configuration setting is available with App-V 5.0 SP2: - -**EnableDynamicVirtualization** - Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. - -For more information, see [About Client Configuration Settings](about-client-configuration-settings.md). - -### App-V 5.0 Shell extensions - -App-V 5.0 SP2 now supports shell extensions. - -For more information see the **App-V 5.0 SP2 shell extension support** section of [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md). - -## App-V 5.0 documentation updates - - -App-V 5.0 SP2 provides updated documentation for the following scenarios: - -- [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - -- [About App-V 5.0](about-app-v-50.md) - -- [About App-V 5.0 Reporting](about-app-v-50-reporting.md) (frequently asked questions section) - -## How to Get MDOP Technologies - - -App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-sp3.md b/mdop/appv-v5/about-app-v-50-sp3.md deleted file mode 100644 index 404ea88933..0000000000 --- a/mdop/appv-v5/about-app-v-50-sp3.md +++ /dev/null @@ -1,839 +0,0 @@ ---- -title: About App-V 5.0 SP3 -description: About App-V 5.0 SP3 -author: manikadhiman -ms.assetid: 67b5268b-edc1-4027-98b0-b3937dd70a6b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# About App-V 5.0 SP3 - - -Use the following sections to review information about significant changes that apply to Microsoft Application Virtualization (App-V) 5.0 SP3: - -- [App-V 5.0 SP3 software prerequisites and supported configurations](#bkmk-sp3-prereq-configs) - -- [Migrating to App-V 5.0 SP3](#bkmk-migrate-to-50sp3) - -- [Manually created connection group xml file requires update to schema](#bkmk-update-schema-cg) - -- [Improvements to connection groups](#bkmk-cg-improvements) - -- [Administrators can publish and unpublish packages for a specific user](#bkmk-usersid-pub-pkgs-specf-user) - -- [Enable only administrators to publish and unpublish packages](#bkmk-admins-only-pub-unpub-pkgs) - -- [RunVirtual registry key supports packages that are published to the user](#bkmk-runvirtual-reg-key) - -- [New PowerShell cmdlets and updateable cmdlet help](#bkmk-posh-cmdlets-help) - -- [Primary virtual application directory (PVAD) is hidden but can be turned on](#bkmk-pvad-hidden) - -- [ClientVersion is required to view App-V publishing metadata](#bkmk-pub-metadata-clientversion) - -- [App-V event logs have been consolidated](#bkmk-event-logs-moved) - -## App-V 5.0 SP3 software prerequisites and supported configurations - - -See the following links for the App-V 5.0 SP3 software prerequisites and supported configurations. - - ---- - - - - - - - - - - - - - - - - -
          Links to prerequisites and supported configurationsDescription

          App-V 5.0 SP3 Prerequisites

          Prerequisite software that you must install before starting the App-V 5.0 SP3 installation

          App-V 5.0 SP3 Supported Configurations

          Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components

          - - - -## Migrating to App-V 5.0 SP3 - - -Use the following information to upgrade to App-V 5.0 SP3 from earlier versions. - -### Before you start the upgrade - -Review the following information before you start the upgrade: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Items to review before upgradingDescription

          Components to upgrade

            -
          1. App-V Server

          2. -
          3. Sequencer

          4. -
          5. App-V client or App-V Remote Desktop Services (RDS) client

          6. -
          7. Connection groups

          8. -
          -
          -Note

          To use the App-V client user interface, download the existing version from Microsoft Application Virtualization 5.0 Client UI Application.

          -
          -
          - -

          Upgrading from App-V 4.x

          You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.0 SP3.

          -

          For more information, see:

          - -

          Upgrading from App-V 5.0 or later

          You can upgrade to App-V 5.0 SP3 directly from any of the following versions:

          -
            -
          • App-V 5.0

          • -
          • App-V 5.0 SP1

          • -
          • App-V 5.0 SP2

          • -
          -

          To upgrade to App-V 5.0 SP3, follow the steps in the remaining sections of this article.

          Required changes to packages and connection groups after upgrade

          None. Packages and connection groups will continue to work as they currently do.

          - - - -### Steps to upgrade the App-V infrastructure - -Complete the following steps to upgrade each component of the App-V infrastructure to App-V 5.0 SP3. - - ---- - - - - - - - - - - - - - - - - - - - - -
          StepFor more information

          Step 1: Upgrade the App-V Server.

          -

          If you are not using the App-V Server, skip this step and go to the next step.

          -
          -Note

          The App-V 5.0 SP3 client is compatible with the App-V 5.0 SP1 Server.

          -
          -
          - -

          Follow these steps:

          -
            -
          1. Review the Release Notes for App-V 5.0 SP3 for issues that may affect the App-V Server installation.

          2. -
          3. Do one of the following, depending on the method you are using to upgrade the Management database and/or Reporting database:

            - ---- - - - - - - - - - - - - - - - - -
            Database upgrade methodStep

            Windows Installer

            Skip this step and go to step 3, “If you are upgrading the App-V Server...”

            SQL scripts

            ---- - - - - - - - - - - -

            Management database

            To install or upgrade, see SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail.

            Reporting database

            Follow the steps in How to Deploy the App-V Databases by Using SQL Scripts.

            -

            -

          4. -
          5. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section Check registry keys after installing the App-V 5.0 SP3 Server.

          6. -
          7. Follow the steps in How to Deploy the App-V 5.0 Server.

          8. -

          Step 2: Upgrade the App-V Sequencer.

          See How to Install the Sequencer.

          Step 3: Upgrade the App-V client or App-V RDS client.

          See How to Deploy the App-V Client.

          - - - -### Check registry keys before installing the App-V 5.0 SP3 Server - -This is step 3 from the previous table. - - ---- - - - - - - - - - - - - - - - - - - -

          When this step is required

          You are upgrading from App-V SP1 with any subsequent Hotfix Packages that you installed by using an .msp file.

          Which components require that you do this step

          Only the App-V Server components that you are upgrading.

          When you need to do this step

          Before you upgrade the App-V Server to App-V 5.0 SP3

          What you need to do

          Using the information in the following tables, update each registry key value under HKLM\Software\Microsoft\AppV\Server with the value that you provided in your original server installation. Completing this step restores registry values that may have been removed when App-V SP1 Hotfix Packages were installed.

          - - - -**ManagementDatabase key** - -If you are installing the Management database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Key nameDescription

          IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

          Describes whether a public access account is required to access non-local management databases. Value is set to “1” if it is required.

          MANAGEMENT_DB_NAME

          Name of the Management database.

          MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT

          Account used for read (public) access to the Management database.

          -

          Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_SID

          Secure identifier (SID) of the account used for read (public) access to the Management database.

          -

          Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          MANAGEMENT_DB_SQL_INSTANCE

          SQL Server instance for the Management database.

          -

          If the value is blank, the default database instance is used.

          MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT

          Account used for write (administrator) access to the Management database.

          MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT_SID

          Secure identifier (SID) of the account used for write (administrator) access to the Management database.

          MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          Management server remote computer account (domain\account).

          MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          Installation administrator login for the Management server (domain\account).

          MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          Valid values are:

          -
            -
          • 1 – the Management service is on the local computer, that is, MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

          • -
          • 0 - the Management service is on a different computer from the local computer.

          • -
          - - - -**ManagementService key** - -If you are installing the Management server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementService`. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Key nameDescription

          MANAGEMENT_ADMINACCOUNT

          Active Directory Domain Services (AD DS) group or account that is authorized to manage App-V (domain\account).

          MANAGEMENT_DB_SQL_INSTANCE

          SQL server instance that contains the Management database.

          -

          If the value is blank, the default database instance is used.

          MANAGEMENT_DB_SQL_SERVER_NAME

          Name of the remote SQL server with the Management database.

          -

          If the value is blank, the local computer is used.

          - - - -**ReportingDatabase key** - -If you are installing the Reporting database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Key nameDescription

          IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

          Describes whether a public access account is required to access non-local reporting databases. Value is set to “1” if it is required.

          REPORTING_DB_NAME

          Name of the Reporting database.

          REPORTING_DB_PUBLIC_ACCESS_ACCOUNT

          Account used for read (public) access to the Reporting database.

          -

          Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_SID

          Secure identifier (SID) of the account used for read (public) access to the Reporting database.

          -

          Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          REPORTING_DB_SQL_INSTANCE

          SQL Server instance for the Reporting database.

          -

          If the value is blank, the default database instance is used.

          REPORTING_DB_WRITE_ACCESS_ACCOUNT

          REPORTING_DB_WRITE_ACCESS_ACCOUNT_SID

          REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          Reporting server remote computer account (domain\account).

          REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          Installation administrator login for the Reporting server (domain\account).

          REPORTING_SERVER_MACHINE_USE_LOCAL

          Valid values are:

          -
            -
          • 1 – the Reporting service is on the local computer, that is, REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

          • -
          • 0 - the Reporting service is on a different computer from the local computer.

          • -
          - - - -**ReportingService key** - -If you are installing the Reporting server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingService`. - - ---- - - - - - - - - - - - - - - - - -
          Key nameDescription

          REPORTING_DB_SQL_INSTANCE

          SQL Server instance for the Reporting database.

          -

          If the value is blank, the default database instance is used.

          REPORTING_DB_SQL_SERVER_NAME

          Name of the remote SQL server with the Reporting database.

          -

          If the value is blank, the local computer is used.

          - - - -## Manually created connection group xml file requires update to schema - - -If you are manually creating the connection group XML file, and want to use the new “optional packages” and “use any version” features that are described in [Improvements to connection groups](#bkmk-cg-improvements), you must specify the following schema in the XML file: - -`xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"` - -For examples and more information, see [About the Connection Group File](about-the-connection-group-file.md). - -## Improvements to connection groups - - -You can manage connection groups more easily by using optional packages and other improvements that have been added in App-V 5.0 SP3. The following table summarizes the tasks that you can perform by using the new connection group features, and links to more detailed information about each task. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Task/featureDescriptionLinks to more information

          Enable a connection group to include optional packages

          Including optional packages in a connection group enables you to dynamically determine which applications will be included in the connection group’s virtual environment, based on the applications that users are entitled to.

          -

          You don’t need to manage as many connection groups because you can mix optional and non-optional packages in the same connection group. Mixing packages allows different groups of users to use the same connection group, even though users might have only one package in common.

          -

          Example: You can enable a package with Microsoft Office for all users, but enable different optional packages, which contain different Office plug-ins, to different subsets of users.

          How to Use Optional Packages in Connection Groups

          Unpublish or delete an optional package without changing the connection group

          Unpublish or delete, or unpublish and republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V client.

          How to Use Optional Packages in Connection Groups

          Publish connection groups that contain user-published and globally published packages

          Create a user-published connection group that contains user-published and globally published packages.

          How to Create a Connection Group with User-Published and Globally Published Packages

          Make a connection group ignore the package version

          Configure a connection group to accept any version of a package, which enables you to upgrade a package without having to disable the connection group. In addition, if there is an optional package with an incorrect version in the connection group, the package is ignored and won’t block the connection group’s virtual environment from being created.

          How to Make a Connection Group Ignore the Package Version

          Limit end users’ publishing capabilities

          Enable only administrators (not end users) to publish packages and to enable connection groups.

          For information about connection groups, see How to Allow Only Administrators to Enable Connection Groups

          -

          For information about packages, see the following articles:

          - ---- - - - - - - - - - - - - - - - - - - - - -
          MethodLink to more information

          Management console

          How to Publish a Package by Using the Management Console

          PowerShell

          How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

          Third-party electronic software delivery system

          How to Enable Only Administrators to Publish Packages by Using an ESD

          -

          Enable or disable a connection group for a specific user

          Administrators can enable or disable a connection group for a specific user by using the optional –UserSID parameter with the following cmdlets:

          -
            -
          • Enable-AppVClientConnectionGroup

          • -
          • Disable-AppVClientConnectionGroup

          • -

          How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

          Merging identical package paths into one virtual directory in connection groups

          If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment.

          -

          This merging of paths allows an application in one package to access files that are in a different package.

          About the Connection Group Virtual Environment

          - - - -## Administrators can publish and unpublish packages for a specific user - - -Administrators can use the following cmdlets to publish or unpublish packages for a specific user. To use the cmdlets, enter the **–UserSID** parameter, followed by the user’s security identifier (SID). For more information, see: - -- [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-pub-pkg-a-user-standalone-posh) - -- [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-unpub-pkg-specfc-use) - - ---- - - - - - - - - - - - - - - - - -
          CmdletExamples

          Publish-AppvClientPackage

          Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

          Unpublish-AppvClientPackage

          Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

          - - - -## Enable only administrators to publish and unpublish packages - - -You can enable only administrators (not end users) to publish and unpublish packages by using one of the following methods: - - ---- - - - - - - - - - - - - - - - - -
          MethodMore information

          Group Policy setting

          Navigate to the following Group Policy Object node:

          -

          Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing.

          -

          Enable the Require publish as administrator Group Policy setting.

          PowerShell

          How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell

          - - - -## RunVirtual registry key supports packages that are published to the user - - -App-V 5.0 SP3 adds support for using the **RunVirtual** registry key with virtualized applications that are in user-published packages. The **RunVirtual** registry key lets you run a locally installed application in a virtual environment, along with applications that have been virtualized by using App-V. - -Previously, the virtualized applications in App-V packages had to be published globally. For more about **RunVirtual** and about other methods of running locally installed applications in a virtual environment with virtualized applications, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md). - -## New PowerShell cmdlets and updateable cmdlet help - - -New PowerShell cmdlets and updateable cmdlet help are included in App-V 5.0 SP3. To download the cmdlet modules, see [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md#bkmk-load-cmdlets). - -### New App-V 5.0 SP3 Server PowerShell cmdlets - -New Windows PowerShell cmdlets for the App-V Server have been added to help you manage connection groups. - - ---- - - - - - - - - - - - - - - - - - - - - -
          CmdletDescription

          Add-AppvServerConnectionGroupPackage

          Appends a package to the end of a connection group's package list and enables you to configure the package as optional and/or with no version within the connection group.

          Set-AppvServerConnectionGroupPackage

          Enables you to edit details about the connection group package, such as whether it is optional.

          Remove-AppvServerConnectionGroupPackage

          Removes a package from a connection group.

          - - - -### Getting help for the PowerShell cmdlets - -Cmdlet help is available in the following formats: - - ---- - - - - - - - - - - - - - - - - -
          FormatDescription

          As a downloadable module

          To get the latest help after downloading the cmdlet module:

          -
            -
          1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

          2. -
          3. Type one of the following commands to load the cmdlets for the module you want:

          4. -
          - ---- - - - - - - - - - - - - - - - - - - - - -
          App-V componentCommand to type

          App-V Server

          Update-Help-Module AppvServer

          App-V Sequencer

          Update-Help-Module AppvSequencer

          App-V client

          Update-Help-Module AppvClient

          -

          On TechNet as web pages

          See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.

          - - - -For more information, see [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md). - -## Primary virtual application directory (PVAD) is hidden but can be turned on - - -The primary virtual application directory (PVAD) is hidden in App-V 5.0 SP3, but you can turn it back on and make it visible by using one of the following methods: - - ---- - - - - - - - - - - - - - - - - -
          MethodSteps

          Use a command line parameter

          Pass the –EnablePVADControl parameter to the Sequencer.exe.

          Create a registry subkey

            -
          1. In the Registry Editor, navigate to: HKLM\SOFTWARE\Microsoft\AppV\Sequencer\Compatibility

            -
            -Note

            If the Compatibility subkey doesn’t exist, you must create it.

            -
            -
            - -
          2. -
          3. Create a DWORD Value named EnablePVADControl, and set the value to 1.

            -

            A value of 0 means that PVAD is hidden.

          4. -
          - - - -**More about PVAD:** When you use the Sequencer to create a package, you can enter any installation path for the package. In past versions of App-V, you were required to specify the primary virtual application directory (PVAD) of the application as the path. PVAD is the directory to which you would typically install an application on your local computer if you weren’t using App-V. For example, if you were installing Office on a computer, the PVAD typically would be C:\\Program Files\\Microsoft Office\\. - -## ClientVersion is required to view App-V publishing metadata - - -In App-V 5.0 SP3, you must provide the following values in the address when you query the App-V Publishing server for metadata: - - ---- - - - - - - - - - - - - - - - - -
          ValueAdditional details

          ClientVersion

          If you omit the ClientVersion parameter from the query, the metadata excludes the new App-V 5.0 SP3 features.

          ClientOS

          You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query.

          -

          If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata.

          - - - -For syntax and examples of this query, see [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata.md). - -## App-V event logs have been consolidated - - -The following event logs, previously located at **Applications and Services Logs/Microsoft/AppV/<App-V component>**, have been moved to **Applications and Services Logs/Microsoft/AppV/ServiceLog**. - -To view the logs, select **View** > **Show Analytic and Debug Logs** in the Event Viewer application. - -Client-Catalog Client-Integration Client-Orchestration Client-PackageConfig Client-Scripting Client-Service Client-Vemgr Client-VFSC FilesystemMetadataLibrary ManifestLibrary PolicyLibrary Subsystems-ActiveX Subsystems-AppPath Subsystems-Com Subsystems-fta - -## How to Get MDOP Technologies - - -App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50.md b/mdop/appv-v5/about-app-v-50.md deleted file mode 100644 index 76b86ac82d..0000000000 --- a/mdop/appv-v5/about-app-v-50.md +++ /dev/null @@ -1,113 +0,0 @@ ---- -title: About App-V 5.0 -description: About App-V 5.0 -author: manikadhiman -ms.assetid: 5799141b-44bc-4033-afcc-212235e15f00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 - - -App-V 5.0 provides an improved integrated platform, more flexible virtualization, and powerful management for virtualized applications. For more information see the [App-V 5.0 Overview](https://go.microsoft.com/fwlink/?LinkId=325265) (https://go.microsoft.com/fwlink/?LinkId=325265). - -## What’s new? - - -The following list displays what is new with App-V 5.0: - -- **IT Diagnostics and Monitoring** - App-V 5.0 enhances the ability to generate reporting information about computers running the App-V 5.0 client and virtualized packages. - -- **End-to-End Programmability** - Leveraging PowerShell 3.0, App-V 5.0 offers a complete programmability solution for packaging, client and server operations. - -- **Simple and Effective Client Console** - App-V 5.0 offers a modern client console designed to simplify the top end user and Tier 1 support engineer scenarios. - -- **Virtual Application Extensions** - App-V 5.0 virtual application extensions enable virtual packages to run as if they are installed locally. - -- **Local Drive Creation** - App-V 5.0 no longer requires a dedicated local drive letter for virtual application deployment. - -- **Shared Content Store** – The App-V 5.0 shared content store offers similar functionality to the streaming server available in previous versions of App-V. It also requires less disk space and updates to virtual applications are available as soon as the new version is ready. - -- **Connection Groups** - App-V 5.0 connection groups allow you to connect and run virtual applications interactively. - -## Differences between App-V 4.6 and App-V 5.0 - - -The following table displays some of the differences between App-V 4.6 and App-V 5.0: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          App-V 4.6App-V 5.0

          Must Use a dedicated drive letter (Q:</strong>).

          No dedicated drive letter required.

          4 GB package size limit requirement.

          No 4 GB package size limit requirement.

          Virtual applications are isolated from locally installed applications.

          Virtual applications can be extended to support local application interaction.

          Dynamic Suite Composition enabled interaction with middleware applications.

          Peer applications are shared using connection groups. For more information about connection groups see, Managing Connection Groups.

          VDI/RDS environments required a read-only shared cache.

          You can update the shared content store using the standard workflow.

          Limited command-line scripting.

          Supports robust PowerShell scripting for the sequencer, client, and server components.

          Provides web-based management capabilities.

          - - - -## How to Get MDOP Technologies - - -App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md deleted file mode 100644 index b66bfce583..0000000000 --- a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md +++ /dev/null @@ -1,953 +0,0 @@ ---- -title: About App-V 5.1 dynamic configuration -description: You can use the dynamic configuration to customize an App-V 5.1 package for a user. Use the following information to create or edit an existing dynamic configuration file. -author: manikadhiman -ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74 -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/28/2018 -ms.author: dansimp ---- - -# About App-V 5.1 dynamic configuration -With dynamic configuration, you can edit the dynamic configuration file to customize how an App-V 5.1 package runs for a user or group. Package customization removes the need to resequence packages using the desired settings. It also provides a way to keep package content and custom settings independent. - -Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no additional customization). - -When a package gets created, the sequencer generates default deployment and user configuration .xml files automatically using the package manifest data. Therefore, these generated files reflect the default settings configured during sequencing. If you apply these files to a package in the form generated by the sequencer, the packages have the same default settings that came from their manifest. - -Use these generated files to make changes, if necessary, which doesn’t directly affect the package. If you want to add, delete or update the configuration files, make your changes about the default values in the manifest information. - ->[!TIP] ->The order in which the files read are:
          • UserConfig.xml
          • DeploymentConfig.xml
          • Manifest

          The first entry represents what gets read last. Therefore, its content takes precedence, and all packages inherently contain and provide default settings from the package manifest.

          1. If customizing the DeploymentConfig.xml file and apply the customized settings, the default settings in the package manifest get overridden.
          2. If customizing the UserConfig.xml and apply the customized settings, the default settings for both the deployment configuration and the package manifest get overridden.
          - -## User configuration file contents (UserConfig.xml) -The UserConfig file provides configuration settings that get applied for a specific user when deploying the package to a computer running the App-V 5.1 client. These settings don’t affect any other users on the client. - -Use the UserConfig file to specify or modify custom settings for a package: - -- Extensions integrated into the native system per user: shortcuts, file-type associations, URL protocols, AppPaths, software clients and COM -- Virtual subsystems: application objects, environment variables, registry modifications, services and fonts -- Scripts (user context only) -- Managing authority (for controlling co-existence of package with App-V 4.6) - -### Header - -The header of a dynamic user configuration file looks like: - -```xml - -``` - -The **PackageId** is the same value as exists in the manifest file. - - -### Body - -The body of the dynamic user configuration file can include all the app extension points defined in the manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body: - -1. **[Applications](#applications)** -2. **[Subsystems](#subsystems)** -3. **[UserScripts](#userscripts)** -4. **[ManagingAuthority](#managingauthority)** - -#### Applications - -All app-extensions contained in the manifest file within a package have an Application ID assigned, which you find in the manifest file. The Application ID lets you enable or disable all extensions for a given application within a package. The Application ID must exist in the manifest file, or it gets ignored. - -```XML - - - - - - - - - - - - -.. - - -``` - -#### Subsystems - -AppExtensions and other subsystems arranged as subnodes. - -```XML - - - - -.. - - - -.. - - -``` - -You can enable or disable each subsystem using the **Enabled** attribute. - -**Extensions** - -Some subsystems (extension subsystems) control extensions. Those subsystems are Shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients, and COM. - -Extension subsystems can be enabled and disabled independently of the content. For example, if you enable Shortcuts, the client uses the Shortcuts contained within the manifest by default. Each extension subsystem can contain an \ node. If this child element is present, the client ignores the content in the manifest file for that subsystem and only use the content in the configuration file. - -_**Examples:**_ - -- If you define this in either the user or deployment config file, the content in the manifest gets ignored. - - ```XML - - - - - - ... - - - - - ``` -- If you define only the following, the content in the manifest gets integrated during publishing. - - ```XML - - - ``` - -- If you define the following, all Shortcuts within the manifest still get ignored. In other words, no Shortcuts get integrated. - - ```XML - - - - - - - ``` - -_**Supported extension subsystems:**_ - -**Shortcuts** extension subsystem controls what shortcuts get integrated into the local system. - -```XML - - - - - - - - - - - - [{Common Programs}]\Microsoft Contoso\Microsoft ContosoApp Filler 2010.lnk - - [{PackageRoot}]\Contoso\ContosoApp.EXE - - - [{Windows}]\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe - - - - - - ContosoApp.Filler.3 - - Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp. - - 0 - - 1 - - [{PackageRoot}]\Contoso\ContosoApp.EXE - - - - - - - - - - [{AppData}]\Microsoft\Contoso\Recent\Templates.LNK - - [{AppData}]\Microsoft\Templates - - - - - - - - - - - - 0 - - 1 - - - - - - - - - - -``` - -**File-Type Associates** extension subsystem associates file types with programs to open by default as well as set up the context menu. - ->[!TIP] ->You can set up the subsystem with MIME types. - -```XML - - - - - - - - - - - - .docm - - contosowordpad.DocumentMacroEnabled.12 - - document - - application/vnd.ms-contosowordpad.document.macroEnabled.12 - - - - wincontosowordpad.exe - - - - - - contosowordpad.8 - - - - - - - - - - - - - - true - - - - - - - - - - - - - - - - contosowordpad.DocumentMacroEnabled.12 - - [{Windows}]\Installer\{90140000-0011-0000-0000-000000FF1CE}\contosowordpadicon.exe,15 - - Blah Blah Blah - - [{FOLDERID_ProgramFilesX86}]\Microsoft Contoso 14\res.dll,9182 - - [{FOLDERID_ProgramFilesX86}]\Microsoft Contoso 14\res.dll,1424 - - 0 - - - - Open - - - - {e56fa627-c35f-4a01-9e79-7d36aed8225a} - - Edit - - &Edit - - "[{PackageRoot}]\Contoso\WINcontosowordpad.EXE" /vu "%1" - - - - - - {e56fa627-c35f-4a01-9e79-7d36aed8225a} - - Open - - &Open - - "[{PackageRoot}]\Contoso\WINcontosowordpad.EXE" /n "%1" - - - - - - mscontosowordpad - - ShellSystem - - [SHELLNOOP] - - [SetForeground][ShellNewDatabase"%1"] - - - - - - - - - - - - - - - - -``` - -**URL Protocols** extension subsystem controls the URL protocols integrated into the local registry of the client machine, for example, _mailto:_. - -```XML - - - - - - - - - - mailto - - - - [{ProgramFilesX86}]\MicrosoftContoso\Contoso\contosomail.EXE,-9403 - - 2 - - - - - - - - - - - - - - - - 2 - - - - - - open - - - - [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE - - open - - [{ProgramFilesX86}\Microsoft Contoso\Contoso\contosomail.EXE" -c OEP.Note /m "%1" - - - - - - 0 - - 0 - - 2 - - - - - - contosomail - - ShellSystem - - [SHELLNOOP] - - [SetForeground][ShellNewDatabase "%1"] - - - - - - - - - - - - - - - - -``` - -**Software Clients** extension subsystem allows the app to register as an email client, news reader, media player and makes the app visible in the Set program access and Computer defaults UI. In most cases, you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client. - -```XML - - - - - - -``` - -**AppPaths** extension subsystem opens apps registered with an application path. For example, if contoso.exe has an apppath name of _myapp_, users can type _myapp_ from the run menu, opening contoso.exe. - -```XML - - - - - - - - - - [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE - - contosomail.exe - - [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE - - - - false - - - - - - - - - - -``` - -**COM** extensions subsystem allows an application registered to local COM servers. The mode can be: - -- Integration -- Isolated -- Off - -```XML - - -``` - -**Virtual Kernel Objects** - -```XML - - -``` - -**Virtual Registry** sets a registry in the virtual registry within HKCU. - -```XML - - - - - - - - - - - - - - - - - - -``` - -**Virtual File System** - -```XML - - -``` - -**Virtual Fonts** - -```XML - - -``` - -**Virtual Environment Variables** - -```XML - - - - - - - - - - - - - - - - - - -``` - -**Virtual services** - -```XML - - -``` - -#### UserScripts - -Use UserScripts to set up or alter the virtual environment. You can also execute scripts at the time of deployment or to clean up the environment after the application terminates. To see a sample script, refer to the user configuration file generated by the sequencer. -The Scripts section below provides more information on the various triggers that can be used. - -#### ManagingAuthority - -Use ManagingAuthority when two versions of your package co-exist on the same machine, one deployed to App-V 4.6 and another deployed on App-V 5.0. To allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6: - -```XML - - -``` - -## Deployment configuration file (DeploymentConfig.xml) - -The DeploymentConfig file provides configuration settings for machine context and user context, providing the same capabilities listed in the UserConfig file. The setting get applied when deploying the package to a computer running the App-V 5.1 client. - -Use the DeploymentConfig file to specify or modify custom settings for a package: - -- All UserConfig settings -- Extensions that can only be applied globally for all users -- Virtual subsystems for global machine locations, for example, registry -- Product source URL -- Scripts (machine context only) -- Controls to terminate child processes - -### Header - -The header of a dynamic deployment configuration file looks like: - -```XML - -``` - -The **PackageId** is the same value as exists in the manifest file. - -### Body - -The body of the dynamic deployment configuration file includes two sections: - -- **UserConfiguration:** allows the same content as the user configuration file described in the previous section. When publishing the package to a user, any appextensions configuration settings in this section override corresponding settings in the manifest within the package, unless you provide a user configuration file. If also providing a UserConfig file, it gets used instead of the User settings in the deployment configuration file. If publishing the package globally, then only the contents of the deployment configuration file get used in combination with the manifest. For more details, see [User configuration file contents (UserConfig.xml)](#user-configuration-file-contents-userconfigxml). - -- **MachineConfiguration:** contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY_LOCAL_MACHINE registry keys in the VFS. - -```XML - - - - - -... - - - - - -... - - - -... - - - - -``` - -### UserConfiguration - -Refer to [User configuration file contents (UserConfig.xml)](#user-configuration-file-contents-userconfigxml) for information on the settings provided for this section. - -### MachineConfiguration - -Use the MachineConfiguration section to configure information for an entire machine; not for a specific user on the computer. For example, HKEY_LOCAL_MACHINE registry keys in the virtual registry. There are four subsections allowed in under this element: - -1. **[Subsystems](#subsystems-1)** -2. **[ProductSourceURLOptOut](#productsourceurloptout)** -3. **[MachineScripts](#machinescripts)** -4. **[TerminateChildProcess](#terminatechildprocess)** - -#### Subsystems - -AppExtensions and other subsystems arranged as subnodes. - -```XML - - - - - - … - - - -… - - -``` - -You can enable or disable each subsystem using the **Enabled** attribute. - -**Extensions** - -Some subsystems (extension subsystems) control extensions. The subsystem is Application Capabilities that default programs use. For this type of extension, the package must be published globally for integration into the local system. The same rules for controls and settings that apply to the Extensions in the User Configuration also, apply to those in the MachineConfiguration section. - -**Application Capabilities**: Used by default programs that allow an application to register itself as: - -- Capable of opening specific file extensions -- A contender for the start menu internet browser slot -- Capable of opening specific windows MIME types - -This extension also makes the virtual application visible in the Set default programs UI. - -```XML - - - - - - - - - - - [{PackageRoot}]\LitView\LitViewBrowser.exe - - - - LitView Browser - - SOFTWARE\LitView\Browser\Capabilities - - - - - - - - - @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12345 - - - @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12346 - - 0 - - Lit View E-Mail Client - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -_**Supported extension subsystems:**_ - -**Machine Wide Virtual Registry** extension subsystem sets a registry key in the virtual registry within HKEY_Local_Machine. - -```XML - - - - - - - - - - - - - - - - - - -``` - -**Machine Wide Virtual Kernel Objects** - -```XML - - - - - - - - - - -``` - -#### ProductSourceURLOptOut - -Use ProductSourceURLOptOut to indicate that the URL for the package can be modified globally through _PackageSourceRoot_ (to support branch office scenarios). Changes take effect on the next launch. - -```XML - - - - ... - - - - ... - - -``` - -#### MachineScripts - -The package can be configured to execute scripts at time of deployment, publishing or removal. To see a sample script, refer to the deployment configuration file generated by the sequencer. - -The Scripts section below provides more information on the various triggers that can be used. - -#### TerminateChildProcess - -An application executable can be specified, whose child processes get terminated when the application exe process terminates. - -```XML - - - - ... - - - - - - - - - - - - ... - - -``` - - - -## Scripts - -The following table describes the various script events and the context under which they can be run. - -| Script Execution Time | Can be specified in Deployment Configuration | Can be specified in User Configuration | Can run in the Virtual Environment of the package | Can be run in the context of a specific application | Runs in system/user context: (Deployment Configuration, User Configuration) | -|-----------------------------|----------------------------------------------|----------------------------------------|---------------------------------------------------|-----------------------------------------------------|-----------------------------------------------------------------------------| -| AddPackage | X | | | | (SYSTEM, N/A) | -| PublishPackage | X | X | | | (SYSTEM, User) | -| UnpublishPackage | X | X | | | (SYSTEM, User) | -| RemovePackage | X | | | | (SYSTEM, N/A) | -| StartProcess | X | X | X | X | (User, User) | -| ExitProcess | X | X | | X | (User, User) | -| StartVirtualEnvironment | X | X | X | | (User, User) | -| TerminateVirtualEnvironment | X | X | | | (User, User) | - -### Using multiple scripts on a single event trigger - -App-V 5.1 supports the use of multiple scripts on a single event trigger for -App-V packages, including packages that you convert from App-V 4.6 to App-V 5.0 -or later. To enable the use of multiple scripts, App-V 5.1 uses a script -launcher application, named ScriptRunner.exe, which is installed as part of the -App-V client installation. - -### How to use multiple scripts on a single event trigger - -For each script that you want to run, pass that script as an argument to the -ScriptRunner.exe application. The application then runs each script separately, -along with the arguments that you specify for each script. Use only one script -(ScriptRunner.exe) per trigger. - -> [!NOTE] -> -> We recommended that you run the multi-script line from a command prompt -> first to make sure that all arguments are built correctly before adding them to -> the deployment configuration file. - -### Example script and parameter descriptions - -Using the following example file and table, modify the deployment or user -configuration file to add the scripts that you want to run. - -```XML - - - ScriptRunner.exe - - -appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10 - -appvscript script2.vbs arg1 arg2 - -appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 –rollbackonerror - - - - -``` - - -**Parameters in the example file include:** - -#### \ - -Name of the event trigger for which you are running a script, such as adding a package or publishing a package. - -#### \ScriptRunner.exe\ - -The script launcher application that is installed as part of the App-V client installation. - -> [!NOTE] -> -> Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:FilesApplication Virtualizationfolder. - -#### \ - -`-appvscript` - Token that represents the actual script that you want to run. - -`script1.exe` – Name of the script that you want to run. - -`arg1 arg2` – Arguments for the script that you want to run. - -`-appvscriptrunnerparameters` – Token that represents the execution options for script1.exe. - -`-wait` – Token that informs ScriptRunner to wait for execution of script1.exe to complete before proceeding to the next script. - -`-timeout=x` – Token that informs ScriptRunner to stop running the current script after x number of seconds. All other specified scripts still runs. - -`-rollbackonerror` – Token that informs ScriptRunner to stop running all scripts that haven't yet run and to roll back an error to the App-V client. - -#### \ - -Waits for overall completion of ScriptRunner.exe. - -Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts. - -If any individual script reported an error and rollbackonerror was set to true, then ScriptRunner would report the error to App-V client. - -ScriptRunner runs any script whose file type is associated with an application installed on the computer. If the associated application is missing, or the script’s file type is not associated with any application on the computer, the script does not run. - -### Create a dynamic configuration file using an App-V 5.1 manifest file - -You can create the dynamic configuration file using one of three methods: either manually, using the App-V 5.1 Management Console or sequencing a package, which generates two sample files. For more information about how to create the file using the App-V 5.1 Management Console see, [How to create a custom configuration File by using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md). - -To create the file manually, the information above in previous sections can be combined into a single file. We recommend you use files generated by the sequencer. - - - -- Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -- For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -- [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md) - -- [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - ---- diff --git a/mdop/appv-v5/about-app-v-51-reporting.md b/mdop/appv-v5/about-app-v-51-reporting.md deleted file mode 100644 index 05c85668ea..0000000000 --- a/mdop/appv-v5/about-app-v-51-reporting.md +++ /dev/null @@ -1,327 +0,0 @@ ---- -title: About App-V 5.1 Reporting -description: About App-V 5.1 Reporting -author: manikadhiman -ms.assetid: 385dca00-7178-4e35-8d86-c58867ebd65c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.1 Reporting - - -Microsoft Application Virtualization (App-V) 5.1 includes a built-in reporting feature that helps you collect information about computers running the App-V 5.1 client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. - -## App-V 5.1 Reporting Overview - - -The following list displays the end–to-end high-level workflow for reporting in App-V 5.1. - -1. The App-V 5.1 Reporting server has the following prerequisites: - - - Internet Information Service (IIS) web server role - - - Windows Authentication role (under **IIS / Security**) - - - SQL Server installed and running with SQL Server Reporting Services (SSRS) - - To confirm SQL Server Reporting Services is running, view `http://localhost/Reports` in a web browser as administrator on the server that will host App-V 5.1 Reporting. The SQL Server Reporting Services Home page should display. - -2. Install the App-V 5.1 reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md). Configure the time when the computer running the App-V 5.1 client should send data to the reporting server. - -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at . - - **Note**   - If you are using the Configuration Manager integration with App-V 5.1, most reports are generated from Configuration Manager rather than from App-V 5.1. - - - -4. After importing the App-V 5.1 PowerShell module using `Import-Module AppvClient` as administrator, enable the App-V 5.1 client. This sample PowerShell cmdlet enables App-V 5.1 reporting: - - ``` syntax - Set-AppvClientConfiguration –reportingserverurl : -reportingenabled 1 – ReportingStartTime <0-23> - ReportingRandomDelay <#min> - ``` - - To immediately send App-V 5.1 report data, run `Send-AppvClientReport` on the App-V 5.1 client. - - For more information about installing the App-V 5.1 client with reporting enabled see [About Client Configuration Settings](about-client-configuration-settings51.md). To administer App-V 5.1 Reporting with Windows PowerShell, see [How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md). - -5. After the reporting server receives the data from the App-V 5.1 client it sends the data to the reporting database. When the database receives and processes the client data, a successful reply is sent to the reporting server and then a notification is sent to the App-V 5.1 client. - -6. When the App-V 5.1 client receives the success notification, it empties the data cache to conserve space. - - **Note**   - By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. - - - -~~~ -If the App-V 5.1 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. -~~~ - -### App-V 5.1 reporting server frequently asked questions - -The following table displays answers to common questions about App-V 5.1 reporting - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          QuestionMore Information

          What is the frequency that reporting information is sent to the reporting database?

          The frequency depends on how the reporting task is configured on the computer running the App-V 5.1 client. You must configure the frequency / interval for sending the reporting data. App-V 5.1 Reporting is not enabled by default.

          What information is stored in the reporting server database?

          The following list displays what is stored in the reporting database:

          -
            -
          • The operating system running on the computer running the App-V 5.1 client: host name, version, service pack, type - client/server, processor architecture.

          • -
          • App-V 5.1 Client information: version.

          • -
          • Published package list: GUID, version GUID, name.

          • -
          • Application usage information: name, version, streaming server, user (domain\alias), package version GUID, launch status and time, shutdown time.

          • -

          What is the average volume of information that is sent to the reporting server?

          It depends. The following list displays the three sets of the data sent to the reporting server:

          -
            -
          1. Operating system, and App-V 5.1 client information. ~150 Bytes, every time this data is sent.

          2. -
          3. Published package list. ~7 KB for 30 packages. This is sent only when the package list is updated with a publishing refresh, which is done infrequently; if there is no change, this information is not sent.

          4. -
          5. Virtual application usage information – about 0.25KB per event. Opening and closing count as one event if both occur before sending the information. When sending using a scheduled task, only the data since the last successful upload is sent to the server. If sending manually through the PowerShell cmdlet, there is an optional argument that controls if the data needs to be re-sent next time around – that argument is DeleteOnSuccess.

            -

            -

            So for example, if twenty applications are opened and closed and reporting information is scheduled to be sent daily, the typical daily traffic should be about 0.15KB + 20 x 0.25KB, or about 5KB/user

          6. -

          Can reporting be scheduled?

          Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting:

          -
            -
          1. Using PowerShell cmdlets - Set-AppvClientConfiguration. For example:

            -

            Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting

            -

            -

            For a complete list of client configuration settings see About Client Configuration Settings and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.

            -

          2. -
          3. By using Group Policy. If distributed using the domain controller, the settings are the same as previously listed.

            -
            -Note

            Group Policy settings override local settings configured using PowerShell.

            -
            -
            - -
          4. -
          - - - -## App-V 5.1 Client Reporting - - -To use App-V 5.1 reporting you must install and configure the App-V 5.1 client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](about-client-configuration-settings51.md). The following section provides examples of App-V 5.1 client reporting configuration using PowerShell. - -### Configuring App-V Client reporting using PowerShell - -The following examples show how PowerShell parameters can configure the reporting features of the App-V 5.1 client. - -**Note** -The following configuration task can also be configured using Group Policy settings in the App-V 5.1 ADMX template. For more information about using the ADMX template, see [How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md). - - - -**To enable reporting and to initiate data collection on the computer running the App-V 5.1 client**: - -`Set-AppVClientConfiguration –ReportingEnabled 1` - -**To configure the client to automatically send data to a specific reporting server**: - -``` syntax -Set-AppVClientConfiguration –ReportingServerURL http://MyReportingServer:MyPort/ -ReportingStartTime 20 -ReportingInterval 1 -ReportingRandomDelay 30 -``` - -`-ReportingInterval 1 -ReportingRandomDelay 30` - -This example configures the client to automatically send the reporting data to the reporting server URL http://MyReportingServer:MyPort/. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session. - -**To limit the size of the data cache on the client**: - -`Set-AppvClientConfiguration –ReportingDataCacheLimit 100` - -Configures the maximum size of the reporting cache on the computer running the App-V 5.1 client to 100 MB. If the cache limit is reached before the data is sent to the server, then the log rolls over and data will be overwritten as necessary. - -**To configure the data block size transmitted across the network between the client and the server**: - -`Set-AppvClientConfiguration –ReportingDataBlockSize 10240` - -Specifies the maximum data block that the client sends to 10240 MB. - -### Types of data collected - -The following table displays the types of information you can collect by using App-V 5.1 reporting. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Client InformationPackage InformationApplication Usage

          Host Name

          Package Name

          Start and End Times

          App-V 5.1 Client Version

          Package Version

          Run Status

          Processor Architecture

          Package Source

          Shutdown State

          Operating System Version

          Percent Cached

          Application Name

          Service Pack Level

          Application Version

          Operating System Type

          Username

          Connection Group

          - - - -The client collects and saves this data in an **.xml** format. The data cache is hidden by default and requires administrator rights to open the XML file. - -### Sending data to the server - -You can configure the computer that is running the App-V 5.1 client to automatically send data to the specified reporting server. To specify the server use the **Set-AppvClientConfiguration** cmdlet with the following settings: - -- ReportingEnabled - -- ReportingServerURL - -- ReportingStartTime - -- ReportingInterval - -- ReportingRandomDelay - -After you configure the previous settings, you must create a scheduled task. The scheduled task will contact the server specified by the **ReportingServerURL** setting and will initiate the transfer. If you want to manually send data outside of the scheduled times, use the following PowerShell cmdlet: - -`Send-AppVClientReport –URL http://MyReportingServer:MyPort/ -DeleteOnSuccess` - -If the reporting server has been previously configured, then the **–URL** parameter can be omitted. Alternatively, if the data should be sent to an alternate location, specify a different URL to override the configured **ReportingServerURL** for this data collection. - -The **-DeleteOnSuccess** parameter indicates that if the transfer is successful, then the data cache is cleared. If this is not specified, then the cache will not be cleared. - -### Manual Data Collection - -You can also use the **Send-AppVClientReport** cmdlet to manually collect data. This solution is helpful with or without an existing reporting server. The following list displays information about collecting data with or without a reporting server. - - ---- - - - - - - - - - - - - -
          With a Reporting ServerWithout a Reporting Server

          If you have an existing App-V 5.1 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency.

          If you do not have an existing App-V 5.1 reporting Server, use the –URL parameter to send the data to a specified share. For example:

          -

          Send-AppVClientReport –URL \Myshare\MyData\ -DeleteOnSuccess

          -

          The previous example will send the reporting data to \MyShare\MyData</strong> location indicated by the -URL parameter. After the data has been sent, the cache is cleared.

          -
          -Note

          If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.

          -
          -
          - -
          - - - -### Creating Reports - -To retrieve report information and create reports using App-V 5.1 you must use one of the following methods: - -- **Microsoft SQL Server Reporting Services (SSRS)** - Microsoft SQL Server Reporting Services is available with Microsoft SQL Server. SSRS is not installed when you install the App-V 5.1 reporting server. It must be deployed separately to generate the associated reports. - - Use the following link for more information about using [Microsoft SQL Server Reporting Services](https://go.microsoft.com/fwlink/?LinkId=285596). - -- **Scripting** – You can generate reports by scripting directly against the App-V 5.1 reporting database. For example: - - **Stored Procedure:** - - **spProcessClientReport** is scheduled to run at midnight or 12:00 AM. - - To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. You should ensure that the Microsoft SQL Server Agent is set to **AutoStart**. For more information see [Autostart SQL Server Agent (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=287045). - - The stored procedure is also created when using the App-V 5.1 database scripts. - -You should also ensure that the reporting server web service’s **Maximum Concurrent Connections** is set to a value that the server will be able to manage without impacting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. - - - - - - -## Related topics - - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - -[How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-51.md b/mdop/appv-v5/about-app-v-51.md deleted file mode 100644 index 199fc19259..0000000000 --- a/mdop/appv-v5/about-app-v-51.md +++ /dev/null @@ -1,527 +0,0 @@ ---- -title: About App-V 5.1 -description: About App-V 5.1 -author: manikadhiman -ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.1 - - -Use the following sections to review information about significant changes that apply to Application Virtualization (App-V) 5.1: - -[App-V 5.1 software prerequisites and supported configurations](#bkmk-51-prereq-configs) - -[Migrating to App-V 5.1](#bkmk-migrate-to-51) - -[What’s New in App-V 5.1](#bkmk-whatsnew) - -[App-V support for Windows 10](#bkmk-win10support) - -[App-V Management Console Changes](#bkmk-mgmtconsole) - -[Sequencer Improvements](#bkmk-seqimprove) - -[Improvements to Package Converter](#bkmk-pkgconvimprove) - -[Support for multiple scripts on a single event trigger](#bkmk-supmultscripts) - -[Hardcoded path to installation folder is redirected to virtual file system root](#bkmk-hardcodepath) - -## App-V 5.1 software prerequisites and supported configurations - - -See the following links for the App-V 5.1 software prerequisites and supported configurations. - - ---- - - - - - - - - - - - - - - - - -
          Links to prerequisites and supported configurationsDescription

          App-V 5.1 Prerequisites

          Prerequisite software that you must install before starting the App-V 5.1 installation

          App-V 5.1 Supported Configurations

          Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components

          - - - -**Support for using Configuration Manager with App-V:** App-V 5.1 supports System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager and Configuration Manager. - -## Migrating to App-V 5.1 - - -Use the following information to upgrade to App-V 5.1 from earlier versions. See [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) for more information. - -### Before you start the upgrade - -Review the following information before you start the upgrade: - - ---- - - - - - - - - - - - - - - - - - - - - -
          Items to review before upgradingDescription

          Components to upgrade, in any order

            -
          1. App-V Server

          2. -
          3. Sequencer

          4. -
          5. App-V Client or App-V Remote Desktop Services (RDS) Client

          6. -
          -
          -Note

          Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from Application Virtualization 5.0 Client UI Application.

          -
          -
          - -

          Upgrading from App-V 4.x

          You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.1. For more information, see:

          - -

          Upgrading from App-V 5.0 or later

          You can upgrade to App-V 5.1 directly from any of the following versions:

          -
            -
          • App-V 5.0

          • -
          • App-V 5.0 SP1

          • -
          • App-V 5.0 SP2

          • -
          • App-V 5.0 SP3

          • -
          -

          To upgrade to App-V 5.1, follow the steps in the remaining sections of this topic.

          -

          Packages and connection groups will continue to work with App-V 5.1 as they currently do.

          - - - -### Steps to upgrade the App-V infrastructure - -Complete the following steps to upgrade each component of the App-V infrastructure to App-V 5.1. The following order is only a suggestion; you may upgrade components in any order. - - ---- - - - - - - - - - - - - - - - - - - - - -
          StepFor more information

          Step 1: Upgrade the App-V Server.

          -
          -Note

          If you are not using the App-V Server, skip this step and go to the next step.

          -
          -
          - -

          Follow these steps:

          -
            -
          1. Do one of the following, depending on the method you are using to upgrade the Management database and/or Reporting database:

            - ---- - - - - - - - - - - - - - - - - -
            Database upgrade methodStep

            Windows Installer

            Skip this step and go to step 2, “If you are upgrading the App-V Server...”

            SQL scripts

            Follow the steps in How to Deploy the App-V Databases by Using SQL Scripts.

            -
          2. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section Check registry keys after installing the App-V 5.0 SP3 Server.

          3. -
          4. Follow the steps in How to Deploy the App-V 5.1 Server

          5. -

            -

          Step 2: Upgrade the App-V Sequencer.

          See How to Install the Sequencer.

          Step 3: Upgrade the App-V Client or App-V RDS Client.

          See How to Deploy the App-V Client.

          - - - -### Converting packages created using a prior version of App-V - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - -**Note** -App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and so there is no need to convert App-V 5.0 packages to App-V 5.1 packages. - - - -## What’s New in App-V 5.1 - - -These sections are for users who are already familiar with App-V and want to know what has changed in App-V 5.1. If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.1](planning-for-app-v-51.md). - -### App-V support for Windows 10 - -The following table lists the Windows 10 support for App-V. Windows 10 is not supported in versions of App-V prior to App-V 5.1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          ComponentApp-V 5.1App-V 5.0

          App-V Client

          Yes

          No

          App-V RDS Client

          Yes

          No

          App-V Sequencer

          Yes

          No

          - - - -### App-V Management Console Changes - -This section compares the App-V Management Console’s current and previous functionality. - -### Silverlight is no longer required - -The Management Console UI no longer requires Silverlight. The 5.1 Management Console is built on HTML5 and Javascript. - -### Notifications and messages are displayed individually in a dialog box - - ---- - - - - - - - - - - - - - - - - - - - - -
          New in App-V 5.1Prior to App-V 5.1

          Number of messages indicator:

          -

          On the title bar of the App-V Management Console, a number is now displayed next to a flag icon to indicate the number of messages that are waiting to be read.

          You could see only one message or error at a time, and you were unable to determine how many messages there were.

          Message appearance:

          -
            -
          • Messages that require user input appear in a separate dialog box that displays on top of the current page that you were viewing, and require a response before you can dismiss them.

          • -
          • Messages and errors appear in a list, with one beneath the other.

          • -

          You could see only one message or error at a time.

          Dismissing messages:

          -

          Use the Dismiss All link to dismiss all messages and errors at one time, or dismiss them one at a time.

          You could dismiss messages and errors only one at a time.

          - - - -### Console pages are now separate URLs - - ---- - - - - - - - - - - - - -
          New in App-V 5.1Prior to App-V 5.1

          Each page in the console has a different URL, which enables you to bookmark specific pages for quick access in the future.

          -

          The number that appears in some URLs indicates the specific package. These numbers are unique.

          All console pages are accessed through the same URL.

          - - - -### New, separate CONNECTION GROUPS page and menu option - - ---- - - - - - - - - - - - - -
          New in App-V 5.1Prior to App-V 5.1

          The CONNECTION GROUPS page is now part of the main menu, at the same level as the PACKAGES page.

          To open the CONNECTION GROUPS page, you navigate through the PACKAGES page.

          - - - -### Menu options for packages have changed - - ---- - - - - - - - - - - - - - - - - -
          New in App-V 5.1Prior to App-V 5.1

          The following options are now buttons that appear at the bottom of the PACKAGES page:

          -
            -
          • Add or Upgrade

          • -
          • Publish

          • -
          • Unpublish

          • -
          • Delete

          • -
          -

          The following options will still appear when you right-click a package to open the drop-down context menu:

          -
            -
          • Publish

          • -
          • Unpublish

          • -
          • Edit AD Access

          • -
          • Edit Deployment Config

          • -
          • Transfer deployment configuration from…

          • -
          • Transfer access and configuration from…

          • -
          • Delete

          • -
          -

          When you click Delete to remove a package, a dialog box opens and asks you to confirm that you want to delete the package.

          The Add or Upgrade option was a button at the top right of the PACKAGES page.

          -

          The Publish, Unpublish, and Delete options were available only if you right-clicked a package name in the packages list.

          The following package operations are now buttons on the package details page for each package:

          -
            -
          • Transfer (drop-down menu with the following options):

            -
              -
            • Transfer deployment configuration from…

            • -
            • Transfer access and configuration from…

            • -
          • -
          • Edit (connection groups and AD Access)

          • -
          • Unpublish

          • -
          • Delete

          • -
          • Edit Default Configuration

          • -

          These package options were available only if you right-clicked a package name in the packages list.

          - - - -### Icons in left pane have new colors and text - -The colors of the icons in the left pane have been changed, and text added, to make the icons consistent with other Microsoft products. - -### Overview page has been removed - -In the left pane of the Management Console, the OVERVIEW menu option and its associated OVERVIEW page have been removed. - -### Sequencer Improvements - -The following improvements have been made to the package editor in the App-V 5.1 Sequencer. - -### Import and export the manifest file - -You can import and export the AppxManifest.xml file. To export the manifest file, select the **Advanced** tab and in the Manifest File box, click **Export...**. You can make changes to the manifest file, such as removing shell extensions or editing file type associations. - -After you make your changes, click **Import...** and select the file you edited. After you successfully import it back in, the manifest file is immediately updated within the package editor. - -**Caution** -When you import the file, your changes are validated against the XML schema. If the file is not valid, you will receive an error. Be aware that it is possible to import a file that is validated against the XML schema, but that might still fail to run for other reasons. - - - -### Addition of Windows 10 to operating systems list - -In the Deployment tab, Windows 10 32-bit and Windows 10-64 bit have been added to the list of operating systems for which you can sequence a package. If you select **Any Operating System**, Windows 10 is automatically included among the operating systems that the sequenced package will support. - -### Current path displays at bottom of virtual registry editor - -In the Virtual Registry tab, the path now displays at the bottom of the virtual registry editor, which enables you to determine the currently selected key. Previously, you had to scroll through the registry tree to find the currently selected key. - -### Combined “find and replace” dialog box and shortcut keys added in virtual registry editor - -In the virtual registry editor, shortcut keys have been added for the Find option (Ctrl+F), and a dialog box that combines the “find” and “replace” tasks has been added to enable you to find and replace values and data. To access this combined dialog box, select a key and do one of the following: - -- Press **Ctrl+H** - -- Right-click a key and select **Replace**. - -- Select **View** > **Virtual Registry** > **Replace**. - -Previously, the “Replace” dialog box did not exist, and you had to make changes manually. - -### Rename registry keys and package files successfully - -You can rename virtual registry keys and files without experiencing Sequencer issues. Previously, the Sequencer stopped working if you tried to rename a key. - -### Import and export virtual registry keys - -You can import and export virtual registry keys. To import a key, right-click the node under which to import the key, navigate to the key you want to import, and then click **Import**. To export a key, right-click the key and select **Export**. - -### Import a directory into the virtual file system - -You can import a directory into the VFS. To import a directory, click the **Package Files** tab, and then click **View** > **Virtual File System** > **Import Directory**. If you try to import a directory that contains files that are already in the VFS, the import fails, and an explanatory message is displayed. Prior to App-V 5.1, you could not import directories. - -### Import or export a VFS file without having to delete and then add it back to the package - -You can import files to or export files from the VFS without having to delete the file and then add it back to the package. For example, you might use this feature to export a change log to a local drive, edit the file using an external editor, and then re-import the file into the VFS. - -To export a file, select the **Package Files** tab, right-click the file in the VFS, click **Export**, and choose an export location from which you can make your edits. - -To import a file, select the **Package Files** tab and right-click the file that you had exported. Browse to the file that you edited, and then click **Import**. The imported file will overwrite the existing file. - -After you import a file, you must save the package by clicking **File** > **Save**. - -### Menu for adding a package file has moved - -The menu option for adding a package file has been moved. To find the Add option, select the **Package Files** tab, then click **View** > **Virtual File System** > **Add File**. Previously, you right-clicked a folder under the VFS node, and chose **Add File**. - -### Virtual registry node expands MACHINE and USER hives by default - -When you open the virtual registry, the MACHINE and USER hives are shown below the top-level REGISTRY node. Previously, you had to expand the REGISTRY node to show the hives beneath. - -### Enable or disable Browser Helper Objects - -You can enable or disable Browser Helper Objects by selecting a new check box, Enable Browser Helper Objects, on the Advanced tab of the Sequencer user interface. If Browser Helper Objects: - -- Exist in the package and are enabled, the check box is selected by default. - -- Exist in the package and are disabled, the check box is clear by default. - -- Exist in the package, with one or more enabled and one or more disabled, the check box is set to indeterminate by default. - -- Do not exist in the package, the check box is disabled. - -### Improvements to Package Converter - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -For more information including examples, see [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md). - -### Support for multiple scripts on a single event trigger - -App-V 5.1 supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you are converting from App-V 4.6 to App-V 5.0 or later. To enable the use of multiple scripts, App-V 5.1 uses a script launcher application, named ScriptRunner.exe, which is installed as part of the App-V client installation. - -For more information, including a list of event triggers and the context under which scripts can be run, see the Scripts section in [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md). - -### Hardcoded path to installation folder is redirected to virtual file system root - -When you convert packages from App-V 4.6 to 5.1, the App-V 5.1 package can access the hardcoded drive that you were required to use when you created 4.6 packages. The drive letter will be the drive you selected as the installation drive on the 4.6 sequencing machine. (The default drive letter is Q:\\.) - -Previously, the 4.6 root folder was not recognized and could not be accessed by App-V 5.0 packages. App-V 5.1 packages can access hardcoded files by their full path or can programmatically enumerate files under the App-V 4.6 installation root. - -**Technical Details:** The App-V 5.1 package converter will save the App-V 4.6 installation root folder and short folder names in the FilesystemMetadata.xml file in the Filesystem element. When the App-V 5.1 client creates the virtual process, it will map requests from the App-V 4.6 installation root to the virtual file system root. - -## How to Get MDOP Technologies - - -App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Release Notes for App-V 5.1](release-notes-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-client-configuration-settings.md b/mdop/appv-v5/about-client-configuration-settings.md deleted file mode 100644 index 8671a0c754..0000000000 --- a/mdop/appv-v5/about-client-configuration-settings.md +++ /dev/null @@ -1,473 +0,0 @@ ---- -title: About Client Configuration Settings -description: About Client Configuration Settings -author: manikadhiman -ms.assetid: cc7ae28c-b2ac-4f68-b992-5ccdbd5316a4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Client Configuration Settings - - -The Microsoft Application Virtualization (App-V) 5.0 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V 5.0 Client configuration settings and explains their uses. You can use PowerShell to modify the client configuration settings. For more information about using PowerShell and App-V 5.0 see [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md). - -## App-V 5.0 Client Configuration Settings - - -The following table displays information about the App-V 5.0 client configuration settings: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Setting NameSetup FlagDescriptionSetting OptionsRegistry Key ValueDisabled Policy State Keys and Values

          PackageInstallationRoot

          PACKAGEINSTALLATIONROOT

          Specifies directory where all new applications and updates will be installed.

          String

          Streaming\PackageInstallationRoot

          Policy value not written (same as Not Configured)

          PackageSourceRoot

          PACKAGESOURCEROOT

          Overrides source location for downloading package content.

          String

          Streaming\PackageSourceRoot

          Policy value not written (same as Not Configured)

          AllowHighCostLaunch

          Not available.

          This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (For example, 4G).

          True (enabled); False (Disabled state)

          Streaming\AllowHighCostLaunch

          0

          ReestablishmentRetries

          Not available.

          Specifies the number of times to retry a dropped session.

          Integer (0-99)

          Streaming\ReestablishmentRetries

          Policy value not written (same as Not Configured)

          ReestablishmentInterval

          Not available.

          Specifies the number of seconds between attempts to reestablish a dropped session.

          Integer (0-3600)

          Streaming\ReestablishmentInterval

          Policy value not written (same as Not Configured)

          AutoLoad

          AUTOLOAD

          Specifies how new packages should be loaded automatically by App-V on a specific computer.

          (0x0) None; (0x1) Previously used; (0x2) All

          Streaming\AutoLoad

          Policy value not written (same as Not Configured)

          LocationProvider

          Not available.

          Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface.

          String

          Streaming\LocationProvider

          Policy value not written (same as Not Configured)

          CertFilterForClientSsl

          Not available.

          Specifies the path to a valid certificate in the certificate store.

          String

          Streaming\CertFilterForClientSsl

          Policy value not written (same as Not Configured)

          VerifyCertificateRevocationList

          Not available.

          Verifies Server certificate revocation status before steaming using HTTPS.

          True(enabled); False(Disabled state)

          Streaming\VerifyCertificateRevocationList

          0

          SharedContentStoreMode

          SHAREDCONTENTSTOREMODE

          Specifies that streamed package contents will be not be saved to the local hard disk.

          True(enabled); False(Disabled state)

          Streaming\SharedContentStoreMode

          0

          Name

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          PUBLISHINGSERVERNAME

          Displays the name of publishing server.

          String

          Publishing\Servers{serverId}\FriendlyName

          Policy value not written (same as Not Configured)

          URL

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          PUBLISHINGSERVERURL

          Displays the URL of publishing server.

          String

          Publishing\Servers{serverId}\URL

          Policy value not written (same as Not Configured)

          GlobalRefreshEnabled

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          GLOBALREFRESHENABLED

          Enables global publishing refresh (Boolean)

          True(enabled); False(Disabled state)

          Publishing\Servers{serverId}\GlobalEnabled

          False

          GlobalRefreshOnLogon

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          GLOBALREFRESHONLOGON

          Triggers a global publishing refresh on logon. ( Boolean)

          True(enabled); False(Disabled state)

          Publishing\Servers{serverId}\GlobalLogonRefresh

          False

          GlobalRefreshInterval

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          GLOBALREFRESHINTERVAL

          Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.

          Integer (0-744

          Publishing\Servers{serverId}\GlobalPeriodicRefreshInterval

          0

          GlobalRefreshIntervalUnit

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          GLOBALREFRESHINTERVALUNI

          Specifies the interval unit (Hour 0-23, Day 0-31).

          0 for hour, 1 for day

          Publishing\Servers{serverId}\GlobalPeriodicRefreshIntervalUnit

          1

          UserRefreshEnabled

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          USERREFRESHENABLED

          Enables user publishing refresh (Boolean)

          True(enabled); False(Disabled state)

          Publishing\Servers{serverId}\UserEnabled

          False

          UserRefreshOnLogon

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          USERREFRESHONLOGON

          Triggers a user publishing refresh onlogon. ( Boolean)

          -

          Word count (with spaces): 60

          True(enabled); False(Disabled state)

          Publishing\Servers{serverId}\UserLogonRefresh

          False

          UserRefreshInterval

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          USERREFRESHINTERVAL

          Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.

          -

          Word count (with spaces): 85

          Integer (0-744 Hours)

          Publishing\Servers{serverId}\UserPeriodicRefreshInterval

          0

          UserRefreshIntervalUnit

          -
          -Note

          This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

          -
          -
          - -

          USERREFRESHINTERVALUNIT

          Specifies the interval unit (Hour 0-23, Day 0-31).

          0 for hour, 1 for day

          Publishing\Servers{serverId}\UserPeriodicRefreshIntervalUnit

          1

          MigrationMode

          MIGRATIONMODE

          Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V.

          True(enabled state); False (disabled state)

          Coexistence\MigrationMode

          CEIPOPTIN

          CEIPOPTIN

          Allows the computer running the App-V 5.0 Client to collect and return certain usage information to help allow us to further improve the application.

          0 for disabled; 1 for enabled

          SOFTWARE/Microsoft/AppV/CEIP/CEIPEnable

          0

          EnablePackageScripts

          ENABLEPACKAGESCRIPTS

          Enables scripts defined in the package manifest of configuration files that should run.

          True(enabled); False(Disabled state)

          \Scripting\EnablePackageScripts

          RoamingFileExclusions

          ROAMINGFILEEXCLUSIONS

          Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures'

          RoamingRegistryExclusions

          ROAMINGREGISTRYEXCLUSIONS

          Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients

          String

          Integration\RoamingRegistryExclusions

          Policy value not written (same as Not Configured)

          IntegrationRootUser

          Not available.

          Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\Microsoft\AppV\Client\Integration.

          String

          Integration\IntegrationRootUser

          Policy value not written (same as Not Configured)

          IntegrationRootGlobal

          Not available.

          Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\Microsoft\AppV\Client\Integration

          String

          Integration\IntegrationRootGlobal

          Policy value not written (same as Not Configured)

          VirtualizableExtensions

          Not available.

          A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment.

          -

          When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the RunVirtual command line parameter will be added, and the application will run virtually.

          -

          For more information about the RunVirtual parameter, see Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications.

          String

          Integration\VirtualizableExtensions

          Policy value not written

          ReportingEnabled

          Not available.

          Enables the client to return information to a reporting server.

          True (enabled); False (Disabled state)

          Reporting\EnableReporting

          False

          ReportingServerURL

          Not available.

          Specifies the location on the reporting server where client information is saved.

          String

          Reporting\ReportingServer

          Policy value not written (same as Not Configured)

          ReportingDataCacheLimit

          Not available.

          Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024.

          Integer [0-1024]

          Reporting\DataCacheLimit

          Policy value not written (same as Not Configured)

          ReportingDataBlockSize

          Not available.

          Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited.

          Integer [1024 - Unlimited]

          Reporting\DataBlockSize

          Policy value not written (same as Not Configured)

          ReportingStartTime

          Not available.

          Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the ReportingStartTime will start on the current day at 10 P.M.or 22.

          -
          -Note

          You should configure this setting to a time when computers running the App-V 5.0 client are least likely to be offline.

          -
          -
          - -

          Integer (0 – 23)

          Reporting\ StartTime

          Policy value not written (same as Not Configured)

          ReportingInterval

          Not available.

          Specifies the retry interval that the client will use to resend data to the reporting server.

          Integer

          Reporting\RetryInterval

          Policy value not written (same as Not Configured)

          ReportingRandomDelay

          Not available.

          Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data. This can help to prevent collisions on the server.

          Integer [0 - ReportingRandomDelay]

          Reporting\RandomDelay

          Policy value not written (same as Not Configured)

          EnableDynamicVirtualization

          -
          -Important

          This setting is available only with App-V 5.0 SP2 or later.

          -
          -
          - -

          Not available.

          Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications.

          1 (Enabled), 0 (Disabled)

          HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Virtualization

          EnablePublishingRefreshUI

          -
          -Important

          This setting is available only with App-V 5.0 SP2.

          -
          -
          - -

          Not available.

          Enables the publishing refresh progress bar for the computer running the App-V 5.0 Client.

          1 (Enabled), 0 (Disabled)

          HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing

          HideUI

          -
          -Important

          This setting is available only with App-V 5.0 SP2.

          -
          -
          - -

          Not available.

          Hides the publishing refresh progress bar.

          1 (Enabled), 0 (Disabled)

          ProcessesUsingVirtualComponents

          Not available.

          Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization.

          String

          Virtualization\ProcessesUsingVirtualComponents

          Empty string.

          - - - - - - - - -## Related topics - - -[Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - -[How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md) - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-client-configuration-settings51.md b/mdop/appv-v5/about-client-configuration-settings51.md deleted file mode 100644 index b0af200279..0000000000 --- a/mdop/appv-v5/about-client-configuration-settings51.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: About Client Configuration Settings -description: About Client Configuration Settings -author: manikadhiman -ms.assetid: 18bb307a-7eda-4dd6-a83e-6afaefd99470 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Client Configuration Settings - - -The Microsoft Application Virtualization (App-V) 5.1 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V 5.1 Client configuration settings and explains their uses. You can use PowerShell to modify the client configuration settings. For more information about using PowerShell and App-V 5.1 see [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md). - -## App-V 5.1 Client Configuration Settings - - -The following table displays information about the App-V 5.1 client configuration settings: - -|Setting name | Setup Flag | Description | Setting Options | Registry Key Value | Disabled Policy State Keys and Values | -|-------------|------------|-------------|-----------------|--------------------|--------------------------------------| -| PackageInstallationRoot | PACKAGEINSTALLATIONROOT | Specifies directory where all new applications and updates will be installed. | String | Streaming\PackageInstallationRoot | Policy value not written (same as Not Configured) | -| PackageSourceRoot | PACKAGESOURCEROOT | Overrides source location for downloading package content. | String | Streaming\PackageSourceRoot | Policy value not written (same as Not Configured) | -| AllowHighCostLaunch | Not available. |This setting controls whether virtualized applications are launched on Windows 10 machines connected via a metered network connection (For example, 4G). | True (enabled); False (Disabled state) | Streaming\AllowHighCostLaunch | 0 | -| ReestablishmentRetries | Not available. | Specifies the number of times to retry a dropped session. | Integer (0-99) | Streaming\ReestablishmentRetries | Policy value not written (same as Not Configured) | -| ReestablishmentInterval | Not available. | Specifies the number of seconds between attempts to reestablish a dropped session. | Integer (0-3600) | Streaming\ReestablishmentInterval | Policy value not written (same as Not Configured) | -| LocationProvider | Not available. | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | String | Streaming\LocationProvider | Policy value not written (same as Not Configured) | -| CertFilterForClientSsl | Not available. | Specifies the path to a valid certificate in the certificate store. | String | Streaming\CertFilterForClientSsl | Policy value not written (same as Not Configured) | -| VerifyCertificateRevocationList | Not available. | Verifies Server certificate revocation status before steaming using HTTPS. | True(enabled); False(Disabled state) | Streaming\VerifyCertificateRevocationList | 0 | -| SharedContentStoreMode | SHAREDCONTENTSTOREMODE | Specifies that streamed package contents will be not be saved to the local hard disk. | True(enabled); False(Disabled state) | Streaming\SharedContentStoreMode | 0 | -| Name
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | PUBLISHINGSERVERNAME | Displays the name of publishing server. | String | Publishing\Servers\{serverId}\FriendlyName | Policy value not written (same as Not Configured) | -| URL
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | PUBLISHINGSERVERURL | Displays the URL of publishing server. | String | Publishing\Servers\{serverId}\URL | Policy value not written (same as Not Configured) | -| GlobalRefreshEnabled
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHENABLED | Enables global publishing refresh (Boolean) | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\GlobalEnabled | False | -| GlobalRefreshOnLogon
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHONLOGON | Triggers a global publishing refresh on logon. ( Boolean) | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\GlobalLogonRefresh | False | -| GlobalRefreshInterval
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHINTERVAL | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. | Integer (0-744) | Publishing\Servers\{serverId}\GlobalPeriodicRefreshInterval | 0 | -| GlobalRefreshIntervalUnit
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHINTERVALUNI | Specifies the interval unit (Hour 0-23, Day 0-31). | 0 for hour, 1 for day | Publishing\Servers\{serverId}\GlobalPeriodicRefreshIntervalUnit | 1 | -| UserRefreshEnabled
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHENABLED | Enables user publishing refresh (Boolean) | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\UserEnabled | False | -| UserRefreshOnLogon
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHONLOGON | Triggers a user publishing refresh onlogon. ( Boolean)
          Word count (with spaces): 60 | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\UserLogonRefresh | False | -| UserRefreshInterval
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHINTERVAL | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | Word count (with spaces): 85
          Integer (0-744 Hours) | Publishing\Servers\{serverId}\UserPeriodicRefreshInterval | 0 | -| UserRefreshIntervalUnit
          **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHINTERVALUNIT | Specifies the interval unit (Hour 0-23, Day 0-31). | 0 for hour, 1 for day | Publishing\Servers\{serverId}\UserPeriodicRefreshIntervalUnit | 1 | -| MigrationMode | MIGRATIONMODE | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. | True(enabled state); False (disabled state) | Coexistence\MigrationMode | | -| CEIPOPTIN | CEIPOPTIN | Allows the computer running the App-V 5.1 Client to collect and return certain usage information to help allow us to further improve the application. | 0 for disabled; 1 for enabled | SOFTWARE/Microsoft/AppV/CEIP/CEIPEnable | 0 | -| EnablePackageScripts | ENABLEPACKAGESCRIPTS | Enables scripts defined in the package manifest of configuration files that should run. | True(enabled); False(Disabled state) | \Scripting\EnablePackageScripts | | -| RoamingFileExclusions | ROAMINGFILEEXCLUSIONS | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage:  /ROAMINGFILEEXCLUSIONS='desktop;my pictures' | | | | -| RoamingRegistryExclusions | ROAMINGREGISTRYEXCLUSIONS | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | String | Integration\RoamingRegistryExclusions | Policy value not written (same as Not Configured) | -| IntegrationRootUser | Not available. | Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\Microsoft\AppV\Client\Integration.| String | Integration\IntegrationRootUser | Policy value not written (same as Not Configured) | -|IntegrationRootGlobal | Not available.| Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\Microsoft\AppV\Client\Integration | String | Integration\IntegrationRootGlobal | Policy value not written (same as Not Configured) | -| VirtualizableExtensions | Not available. | A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment.
          When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command line parameter will be added, and the application will run virtually.
          For more information about the **RunVirtual** parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md). | String | Integration\VirtualizableExtensions | Policy value not written | -| ReportingEnabled | Not available. | Enables the client to return information to a reporting server. | True (enabled); False (Disabled state) | Reporting\EnableReporting | False | -| ReportingServerURL | Not available. | Specifies the location on the reporting server where client information is saved. | String | Reporting\ReportingServer | Policy value not written (same as Not Configured) | -| ReportingDataCacheLimit | Not available. | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Integer [0-1024] | Reporting\DataCacheLimit | Policy value not written (same as Not Configured) | -| ReportingDataBlockSize| Not available. | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Integer [1024 - Unlimited] | Reporting\DataBlockSize | Policy value not written (same as Not Configured) | -| ReportingStartTime | Not available. | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
          **Note** You should configure this setting to a time when computers running the App-V 5.1 client are least likely to be offline. | Integer (0 – 23) | Reporting\ StartTime | Policy value not written (same as Not Configured) | -| ReportingInterval | Not available. | Specifies the retry interval that the client will use to resend data to the reporting server. | Integer | Reporting\RetryInterval | Policy value not written (same as Not Configured) | -| ReportingRandomDelay | Not available. | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server. | Integer [0 - ReportingRandomDelay] | Reporting\RandomDelay | Policy value not written (same as Not Configured) | -| EnableDynamicVirtualization
          **Important** This setting is available only with App-V 5.0 SP2 or later. | Not available. | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | 1 (Enabled), 0 (Disabled) | HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Virtualization | | -| EnablePublishingRefreshUI
          **Important** This setting is available only with App-V 5.0 SP2. | Not available. | Enables the publishing refresh progress bar for the computer running the App-V 5.1 Client. | 1 (Enabled), 0 (Disabled) | HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing | | -| HideUI
          **Important**  This setting is available only with App-V 5.0 SP2.| Not available. | Hides the publishing refresh progress bar. | 1 (Enabled), 0 (Disabled) | | | -| ProcessesUsingVirtualComponents | Not available. | Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | String | Virtualization\ProcessesUsingVirtualComponents | Empty string. | - - - - - - -## Related topics - - -[Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - -[How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md) - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-file.md b/mdop/appv-v5/about-the-connection-group-file.md deleted file mode 100644 index a46bdbf5ea..0000000000 --- a/mdop/appv-v5/about-the-connection-group-file.md +++ /dev/null @@ -1,338 +0,0 @@ ---- -title: About the Connection Group File -description: About the Connection Group File -author: manikadhiman -ms.assetid: bfeb6013-a7ca-4e36-9fe3-229702e83f0d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group File - - -**In this topic:** - -- [Connection group file purpose and location](#bkmk-cg-purpose-loc) - -- [Structure of the connection group XML file](#bkmk-define-cg-5-0sp3) - -- [Configuring the priority of packages in a connection group](#bkmk-config-pkg-priority-incg) - -- [Supported virtual application connection configurations](#bkmk-va-conn-configs) - -## Connection group file purpose and location - - - ---- - - - - - - - - - - - - - - -

          Connection group purpose

          A connection group is an App-V feature that enables you to group packages together to create a virtual environment in which the applications in those packages can interact with each other.

          -

          Example: You want to use plug-ins with Microsoft Office. You can create a package that contains the plug-ins, and create another package that contains Office, and then add both packages to a connection group to enable Office to use those plug-ins.

          How the connection group file works

          When you apply an Application Virtualization 5.0 connection group file, the packages that are enumerated in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) 5.0 connection group file to configure existing Application Virtualization 5.0 connection groups.

          Example file path

          %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups{6CCC7575-162E-4152-9407-ED411DA138F4}{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.

          - - - -## Structure of the connection group XML file - - -**In this section:** - -- [Parameters that define the connection group](#bkmk-params-define-cg) - -- [Parameters that define the packages in the connection group](#bkmk-params-define-pkgs-incg) - -- [App-V 5.0 SP3 example connection group XML file](#bkmk-50sp3-exp-cg-xml) - -- [App-V 5.0 through App-V 5.0 SP2 example connection group XML file](#bkmk-50thru50sp2-exp-cg-xm) - -### Parameters that define the connection group - -The following table describes the parameters in the XML file that define the connection group itself, not the packages. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          Schema name

          Name of the schema.

          -

          Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:

          -

          xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";

          AppConnectionGroupId

          Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group.

          -

          You can create a new GUID by typing: [Guid]::NewGuid().

          VersionId

          Version GUID identifier for this version of the connection group.

          -

          When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version.

          DisplayName

          Display name of the connection group.

          Priority

          Optional priority field for the connection group.

          -

          “0” - indicates the highest priority.

          -

          If a priority is required, but has not been configured, the package will fail because the correct connection group to use cannot be determined.

          - - - -### Parameters that define the packages in the connection group - -In the <Packages> section of the connection group XML file, you list the member packages in the connection group by specifying each package’s unique package identifier and version identifier, as described in the following table. The first package in the list has the highest precedence. - - ---- - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          PackageId

          Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published.

          VersionId

          Unique GUID identifier for the version of the package.

          -

          Applicable starting in App-V 5.0 SP3: If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted.

          IsOptional

          Applicable starting in App-V 5.0 SP3: Parameter that enables you to make a package optional within the connection group. Valid entries are:

          -
            -
          • “true” – package is optional in the connection group

          • -
          • “false” – package is required in the connection group

          • -
          -

          See How to Use Optional Packages in Connection Groups.

          - - - -### App-V 5.0 SP3 example connection group XML file - -The following example connection group XML file shows examples of the fields in the previous tables and highlights the items that are new for App-V 5.0 SP3. - -```XML - - - - - - - -``` - -### App-V 5.0 through App-V 5.0 SP2 example connection group XML file - -The following example connection group XML file applies to App-V 5.0 through App-V 5.0 SP2. It shows examples of the fields in the previous table, but it excludes the changes described above for App-V 5.0 SP3. - -```XML - - - - - - -Configuring the priority of packages in a connection group - - -Package precedence is configured using the package list order. The first package in the document has the highest precedence. Subsequent packages in the list have descending priority. - -Package precedence is the resolution for otherwise inevitable resource collisions during virtual environment initialization. For example, if two packages that are opening in the same virtual environment define the same registry DWORD value, the package with the highest precedence determines the value that is set. - -You can use the connection group file to configure each connection group by using the following methods: - -- Specify runtime priorities for connection groups. - - **Note**   - Priority is required only if the package is associated with more than one connection group. - - - -- Specify package precedence within the connection group. - -The priority field is required when a running virtual application initiates from a native application request, for example, Microsoft Windows Explorer. The App-V client uses the priority to determine which connection group virtual environment the application should run in. This situation occurs if a virtual application is part of multiple connection groups. - -If a virtual application is opened using another virtual application the virtual environment of the original virtual application will be used. The priority field is not used in this case. - -**Example:** - -The virtual application Microsoft Outlook is running in virtual environment **XYZ**. When you open an attached Microsoft Word document, a virtualized version Microsoft Word opens in the virtual environment **XYZ**, regardless of the virtualized Microsoft Word’s associated connection groups or runtime priorities. - -## Supported virtual application connection configurations - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ConfigurationExample scenario

          An. exe file and plug-in (.dll)

            -
          • You want to distribute Microsoft Office to all users, but distribute a Microsoft Excel plug-in to only a subset of users.

          • -
          • Enable the connection group for the appropriate users.

          • -
          • Update each package individually as required.

          • -

          An. exe file and a middleware application

            -
          • You have an application requires a middleware application, or several applications that all depend on the same middleware runtime version.

          • -
          • All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime.

          • -
          • You can optionally combine multiple middleware applications into a single connection group.

            - ---- - - - - - - - - - - - - - - - - -
            ExampleExample description

            Virtual application connection group for the financial division

              -
            • Middleware application 1

            • -
            • Middleware application 2

            • -
            • Middleware application 3

            • -
            • Middleware application runtime

            • -

            Virtual application connection group for HR division

              -
            • Middleware application 5

            • -
            • Middleware application 6

            • -
            • Middleware application runtime

            • -
            -

             

          • -

          An. exe file and an .exe file

          You have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines.

          -

          Example:

          -

          If you are deploying Microsoft Lync 2010, you can use three packages:

          -
            -
          • Microsoft Office 2010

          • -
          • Microsoft Communicator 2007

          • -
          • Microsoft Lync 2010

          • -
          -

          You can manage the deployment using the following connection groups:

          -
            -
          • Microsoft Office 2010 and Microsoft Communicator 2007

          • -
          • Microsoft Office 2010 and Microsoft Lync 2010

          • -
          -

          When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group.

          - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-file51.md b/mdop/appv-v5/about-the-connection-group-file51.md deleted file mode 100644 index f8949ce649..0000000000 --- a/mdop/appv-v5/about-the-connection-group-file51.md +++ /dev/null @@ -1,338 +0,0 @@ ---- -title: About the Connection Group File -description: About the Connection Group File -author: manikadhiman -ms.assetid: 1f4df515-f5f6-4b58-91a8-c71598cb3ea4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group File - - -**In this topic:** - -- [Connection group file purpose and location](#bkmk-cg-purpose-loc) - -- [Structure of the connection group XML file](#bkmk-define-cg-5-0sp3) - -- [Configuring the priority of packages in a connection group](#bkmk-config-pkg-priority-incg) - -- [Supported virtual application connection configurations](#bkmk-va-conn-configs) - -## Connection group file purpose and location - - - ---- - - - - - - - - - - - - - - -

          Connection group purpose

          A connection group is an App-V feature that enables you to group packages together to create a virtual environment in which the applications in those packages can interact with each other.

          -

          Example: You want to use plug-ins with Microsoft Office. You can create a package that contains the plug-ins, and create another package that contains Office, and then add both packages to a connection group to enable Office to use those plug-ins.

          How the connection group file works

          When you apply an App-V 5.1 connection group file, the packages that are enumerated in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) 5.1 connection group file to configure existing App-V 5.1 connection groups.

          Example file path

          %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups{6CCC7575-162E-4152-9407-ED411DA138F4}{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.

          - - - -## Structure of the connection group XML file - - -**In this section:** - -- [Parameters that define the connection group](#bkmk-params-define-cg) - -- [Parameters that define the packages in the connection group](#bkmk-params-define-pkgs-incg) - -- [App-V example connection group XML file](#bkmk-50sp3-exp-cg-xml) - -- [App-V 5.0 through App-V 5.0 SP2 example connection group XML file](#bkmk-50thru50sp2-exp-cg-xm) - -### Parameters that define the connection group - -The following table describes the parameters in the XML file that define the connection group itself, not the packages. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          Schema name

          Name of the schema.

          -

          Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:

          -

          xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";

          AppConnectionGroupId

          Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group.

          -

          You can create a new GUID by typing: [Guid]::NewGuid().

          VersionId

          Version GUID identifier for this version of the connection group.

          -

          When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version.

          DisplayName

          Display name of the connection group.

          Priority

          Optional priority field for the connection group.

          -

          “0” - indicates the highest priority.

          -

          If a priority is required, but has not been configured, the package will fail because the correct connection group to use cannot be determined.

          - - - -### Parameters that define the packages in the connection group - -In the <Packages> section of the connection group XML file, you list the member packages in the connection group by specifying each package’s unique package identifier and version identifier, as described in the following table. The first package in the list has the highest precedence. - - ---- - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          PackageId

          Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published.

          VersionId

          Unique GUID identifier for the version of the package.

          -

          Applicable starting in App-V 5.0 SP3: If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted.

          IsOptional

          Applicable starting in App-V 5.0 SP3: Parameter that enables you to make a package optional within the connection group. Valid entries are:

          -
            -
          • “true” – package is optional in the connection group

          • -
          • “false” – package is required in the connection group

          • -
          -

          See How to Use Optional Packages in Connection Groups.

          - - - -### App-V example connection group XML file - -The following example connection group XML file shows examples of the fields in the previous tables and highlights the items that are new starting in App-V 5.0 SP3. - -```XML - - - - - - - -``` - -### App-V 5.0 through App-V 5.0 SP2 example connection group XML file - -The following example connection group XML file applies to App-V 5.0 through App-V 5.0 SP2. It shows examples of the fields in the previous table, but it excludes the changes described above for App-V 5.0 SP3. - -```XML - - - - - - - -``` - -## Configuring the priority of packages in a connection group - - -Package precedence is configured using the package list order. The first package in the document has the highest precedence. Subsequent packages in the list have descending priority. - -Package precedence is the resolution for otherwise inevitable resource collisions during virtual environment initialization. For example, if two packages that are opening in the same virtual environment define the same registry DWORD value, the package with the highest precedence determines the value that is set. - -You can use the connection group file to configure each connection group by using the following methods: - -- Specify runtime priorities for connection groups. To edit priority by using the App-V Management Console, click the connection group and then click **Edit**. - - **Note**   - Priority is required only if the package is associated with more than one connection group. - - - -- Specify package precedence within the connection group. - -The priority field is required when a running virtual application initiates from a native application request, for example, Microsoft Windows Explorer. The App-V client uses the priority to determine which connection group virtual environment the application should run in. This situation occurs if a virtual application is part of multiple connection groups. - -If a virtual application is opened using another virtual application the virtual environment of the original virtual application will be used. The priority field is not used in this case. - -**Example:** - -The virtual application Microsoft Outlook is running in virtual environment **XYZ**. When you open an attached Microsoft Word document, a virtualized version Microsoft Word opens in the virtual environment **XYZ**, regardless of the virtualized Microsoft Word’s associated connection groups or runtime priorities. - -## Supported virtual application connection configurations - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ConfigurationExample scenario

          An. exe file and plug-in (.dll)

            -
          • You want to distribute Microsoft Office to all users, but distribute a Microsoft Excel plug-in to only a subset of users.

          • -
          • Enable the connection group for the appropriate users.

          • -
          • Update each package individually as required.

          • -

          An. exe file and a middleware application

            -
          • You have an application requires a middleware application, or several applications that all depend on the same middleware runtime version.

          • -
          • All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime.

          • -
          • You can optionally combine multiple middleware applications into a single connection group.

            - ---- - - - - - - - - - - - - - - - - -
            ExampleExample description

            Virtual application connection group for the financial division

              -
            • Middleware application 1

            • -
            • Middleware application 2

            • -
            • Middleware application 3

            • -
            • Middleware application runtime

            • -

            Virtual application connection group for HR division

              -
            • Middleware application 5

            • -
            • Middleware application 6

            • -
            • Middleware application runtime

            • -
            -

             

          • -

          An. exe file and an .exe file

          You have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines.

          -

          Example:

          -

          If you are deploying Microsoft Lync 2010, you can use three packages:

          -
            -
          • Microsoft Office 2010

          • -
          • Microsoft Communicator 2007

          • -
          • Microsoft Lync 2010

          • -
          -

          You can manage the deployment using the following connection groups:

          -
            -
          • Microsoft Office 2010 and Microsoft Communicator 2007

          • -
          • Microsoft Office 2010 and Microsoft Lync 2010

          • -
          -

          When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group.

          - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment.md b/mdop/appv-v5/about-the-connection-group-virtual-environment.md deleted file mode 100644 index d8d9974471..0000000000 --- a/mdop/appv-v5/about-the-connection-group-virtual-environment.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: About the Connection Group Virtual Environment -description: About the Connection Group Virtual Environment -author: manikadhiman -ms.assetid: 535fa640-cbd9-425e-8437-94650a70c264 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group Virtual Environment - - -**In this topic:** - -- [How package priority is determined](#bkmk-pkg-priority-deter) - -- [Merging identical package paths into one virtual directory in connection groups](#bkmk-merged-root-ve-exp) - -## How package priority is determined - - -The virtual environment and its current state are associated with the connection group, not with the individual packages. If an App-V package is removed from the connection group, the state that existed as part of the connection group will not migrate with the package. - -If the same package is a part of two different connection groups, you have to indicate which connection group App-V should use. For example, you might have two packages in a connection group that each define the same registry DWORD value. - -The connection group that is used is based on the order in which a package appears inside the **AppConnectionGroup** XML document: - -- The first package has the highest precedence. - -- The second package has the second highest precedence. - -Consider the following example section: - -```xml - -``` - -Assume that same DWORD value ABC (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region) is defined in the first and third package, such as: - -- Package 1 (A8731008-4523-4713-83A4-CD1363907160): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5 - -- Package 3 (04220DCA-EE77-42BE-A9F5-96FD8E8593F2): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=10 - -Since Package 1 appears first, the AppConnectionGroup's virtual environment will have the single DWORD value of 5 (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5). This means that the virtual applications in Package 1, Package 2, and Package 3 will all see the value 5 when they query for HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region. - -Other virtual environment resources are resolved similarly, but the usual case is that the collisions occur in the registry. - -## Merging identical package paths into one virtual directory in connection groups - - -If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment. This merging of paths allows an application in one package to access files that are in a different package. - -When you remove a package from a connection group, the applications in that removed package are no longer able to access files in the remaining packages in the connection group. - -The order in which App-V looks up a file’s name in the connection group is specified by the order in which the App-V packages are listed in the connection group manifest file. - -The following example shows the order and relationship of a file name lookup in a connection group for **Package A** and **Package B**. - - ---- - - - - - - - - - - - - - - - - -
          Package APackage B

          C:\Windows\System32

          C:\Windows\System32

          C:\AppTest

          C:\AppTest

          - -  - -In the example above, when a virtualized application tries to find a specific file, Package A is searched first for a matching file path. If a matching path is not found, Package B is searched, using the following mapping rules: - -- If a file named **test.txt** exists in the same virtual folder hierarchy in both application packages, the first matching file is used. - -- If a file named **bar.txt** exists in the virtual folder hierarchy of one application package, but not in the other, the first matching file is used. - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md b/mdop/appv-v5/about-the-connection-group-virtual-environment51.md deleted file mode 100644 index 3489f151b7..0000000000 --- a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: About the Connection Group Virtual Environment -description: About the Connection Group Virtual Environment -author: manikadhiman -ms.assetid: b7bb0e3d-8cd5-45a9-b84e-c9ab4196a18c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group Virtual Environment - - -**In this topic:** - -- [How package priority is determined](#bkmk-pkg-priority-deter) - -- [Merging identical package paths into one virtual directory in connection groups](#bkmk-merged-root-ve-exp) - -## How package priority is determined - - -The virtual environment and its current state are associated with the connection group, not with the individual packages. If an App-V package is removed from the connection group, the state that existed as part of the connection group will not migrate with the package. - -If the same package is a part of two different connection groups, you have to indicate which connection group App-V should use. For example, you might have two packages in a connection group that each define the same registry DWORD value. - -The connection group that is used is based on the order in which a package appears inside the **AppConnectionGroup** XML document: - -- The first package has the highest precedence. - -- The second package has the second highest precedence. - -Consider the following example section: - -```xml - -``` - -Assume that same DWORD value ABC (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region) is defined in the first and third package, such as: - -- Package 1 (A8731008-4523-4713-83A4-CD1363907160): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5 - -- Package 3 (04220DCA-EE77-42BE-A9F5-96FD8E8593F2): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=10 - -Since Package 1 appears first, the AppConnectionGroup's virtual environment will have the single DWORD value of 5 (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5). This means that the virtual applications in Package 1, Package 2, and Package 3 will all see the value 5 when they query for HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region. - -Other virtual environment resources are resolved similarly, but the usual case is that the collisions occur in the registry. - -## Merging identical package paths into one virtual directory in connection groups - - -If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment. This merging of paths allows an application in one package to access files that are in a different package. - -When you remove a package from a connection group, the applications in that removed package are no longer able to access files in the remaining packages in the connection group. - -The order in which App-V looks up a file’s name in the connection group is specified by the order in which the App-V packages are listed in the connection group manifest file. - -The following example shows the order and relationship of a file name lookup in a connection group for **Package A** and **Package B**. - - ---- - - - - - - - - - - - - - - - - -
          Package APackage B

          C:\Windows\System32

          C:\Windows\System32

          C:\AppTest

          C:\AppTest

          - -  - -In the example above, when a virtualized application tries to find a specific file, Package A is searched first for a matching file path. If a matching path is not found, Package B is searched, using the following mapping rules: - -- If a file named **test.txt** exists in the same virtual folder hierarchy in both application packages, the first matching file is used. - -- If a file named **bar.txt** exists in the virtual folder hierarchy of one application package, but not in the other, the first matching file is used. - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/accessibility-for-app-v-50.md b/mdop/appv-v5/accessibility-for-app-v-50.md deleted file mode 100644 index 1f11859823..0000000000 --- a/mdop/appv-v5/accessibility-for-app-v-50.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Accessibility for App-V 5.0 -description: Accessibility for App-V 5.0 -author: manikadhiman -ms.assetid: 56696523-6332-4bbe-8ddf-32b1dfe38131 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for App-V 5.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -**Important**   -The information in this section only applies to the App-V 5.0 sequencer. For specific information about the App-V 5.0 server, see the Keyboard Shortcuts for the App-V 5.0 Management Server section of this document. - - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Keyboard Shortcuts for the App-V 5.0 Management Server - - -Keyboard Shortcuts for the App-V 5.0 Management Server: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          To do thisPress

          Rename App-V 5.0 connection groups or the App-V 5.0 publishing server description.

          F2

          Transfer access and configuration information from an existing App-V 5.0 package.

          CTRL + Shift + A

          Transfer default configurations from an existing App-V 5.0 package.

          CTRL + Shift + C

          Refresh the current page of the App-V 5.0 client console.

          F5

          On the Connections Groups page of the client management console, copies as a new version.

          CTRL + Shift + C

          - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - - - - - - - - diff --git a/mdop/appv-v5/accessibility-for-app-v-51.md b/mdop/appv-v5/accessibility-for-app-v-51.md deleted file mode 100644 index bae1242c01..0000000000 --- a/mdop/appv-v5/accessibility-for-app-v-51.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Accessibility for App-V 5.1 -description: Accessibility for App-V 5.1 -author: manikadhiman -ms.assetid: ef3f7742-f2e9-4748-ad60-74e0961b1bd9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for App-V 5.1 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Keyboard Shortcuts for the App-V 5.1 Management Server - - -Following are the keyboard Shortcuts for the App-V 5.1 Management Server: - - ---- - - - - - - - - - - - - - - - - - - - - -
          To do thisPress

          Close a dialog box.

          Esc

          Perform the default action of a dialog box.

          Enter

          Refresh the current page of the App-V 5.1 client console.

          F5

          - - - -## Keyboard Shortcuts for the App-V 5.1 Sequencer - - -Following are the keyboard shortcuts for the Virtual Registry tab in the package editor in the App-V 5.1 Sequencer: - - ---- - - - - - - - - - - - - - - - - -
          To do thisPress

          Open the Find dialog box.

          CTRL + F

          Open the Replace dialog box.

          CTRL + H

          - - - -### Access Any Command with a Few Keystrokes - -**Important**   -The information in this section only applies to the App-V 5.1 sequencer. For specific information about the App-V 5.1 server, see the Keyboard Shortcuts for the App-V 5.1 Management Server section of this document. - - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - An underline appears beneath the keyboard shortcut for each feature that is available in the current view. - -2. Press the letter underlined in the keyboard shortcut for the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md deleted file mode 100644 index cb135d1d39..0000000000 --- a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: Administering App-V 5.0 Virtual Applications by Using the Management Console -description: Administering App-V 5.0 Virtual Applications by Using the Management Console -author: manikadhiman -ms.assetid: e9280dbd-782b-493a-b495-daab25247795 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering App-V 5.0 Virtual Applications by Using the Management Console - - -Use the Microsoft Application Virtualization (App-V) 5.0 management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V 5.0 client. One or more management servers typically share a common data store for configuration and package information. - -The management server uses Active Directory Domain Services (AD DS) groups to manage user authorization and has SQL Server installed to manage the database and data store. - -Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: - -- Management Server – Use the management server to manage packages and connection groups. - -- Publishing Server – Use the publishing server to deploy packages to computers that run the App-V 5.0 client. - -- Management Database - Use the management database to manage the package access and to publish the server’s synchronization with the management server. - -## Management Console tasks - - -The most common tasks that you can perform with the App-V 5.0 Management console are: - -- [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md) - -- [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) - -- [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md) - -- [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) - -- [How to Delete a Package in the Management Console](how-to-delete-a-package-in-the-management-console-beta.md) - -- [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console.md) - -- [How to Register and Unregister a Publishing Server by Using the Management Console](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md) - -- [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md) - -- [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md) - -- [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md) - -- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md) - -The main elements of the App-V 5.0 Management Console are: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Management Console tabDescription

          Overview

          -
            -
          • App-V Sequencer - Select this option to review general information about using the App-V 5.0 sequencer.

          • -
          • Application Packages Library – Select this option to open the PACKAGES page of the Management Console. Use this page to review packages that have been added to the server. You can also manage the connection groups, as well as add or upgrade packages.

          • -
          • SERVERS – Select this option to open the SERVERS page of the Management Console. Use this page to review the list of servers that have been registered with your App-V 5.0 infrastructure.

          • -
          • CLIENTS – Select this option to review general information about App-V 5.0 clients.

          • -

          Packages tab

          Use the PACKAGES tab to add or upgrade packages. You can also manage connection groups by clicking CONNECTION GROUPS.

          Servers tab

          Use the SERVERS tab to register a new server.

          Administrators tab

          Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V 5.0 environment.

          - -  - - - - - - -## Other resources for this App-V 5.0 deployment - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md b/mdop/appv-v5/administering-app-v-51-by-using-powershell.md deleted file mode 100644 index 877702cf37..0000000000 --- a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: Administering App-V 5.1 by Using PowerShell -description: Administering App-V 5.1 by Using PowerShell -author: manikadhiman -ms.assetid: 9e10ff07-2cd9-4dc1-9e99-582f90c36081 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering App-V 5.1 by Using PowerShell - - -Microsoft Application Virtualization (App-V) 5.1 provides Windows PowerShell cmdlets, which can help administrators perform various App-V 5.1 tasks. The following sections provide more information about using PowerShell with App-V 5.1. - -## How to administer App-V 5.1 by using PowerShell - - -Use the following PowerShell procedures to perform various App-V 5.1 tasks. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          How to Load the PowerShell Cmdlets and Get Cmdlet Help

          Describes how to install the PowerShell cmdlets and find cmdlet help and examples.

          How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell

          Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell.

          How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

          Describes how to manage connection groups using PowerShell.

          How to Modify Client Configuration by Using PowerShell

          Describes how to modify the client using PowerShell.

          How to Apply the User Configuration File by Using PowerShell

          Describes how to apply a user configuration file using PowerShell.

          How to Apply the Deployment Configuration File by Using PowerShell

          Describes how to apply a deployment configuration file using PowerShell.

          How to Sequence a Package by Using PowerShell

          Describes how to create a new package using PowerShell.

          How to Create a Package Accelerator by Using PowerShell

          Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications.

          How to Enable Reporting on the App-V 5.1 Client by Using PowerShell

          Describes how to enable the computer running the App-V 5.1 to send reporting information.

          How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell

          Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.

          - - - -**Important**   -Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for PowerShell. - - - -## PowerShell Error Handling - - -Use the following table for information about App-V 5.1 PowerShell error handling. - - ---- - - - - - - - - - - - - - - - - -
          EventAction

          Using the RollbackOnError attribute with embedded scripts

          When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events:

          -
            -
          • Removing a package

          • -
          • Unpublishing a package

          • -
          • Terminating a virtual environment

          • -
          • Terminating a process

          • -

          Package name contains $

          If a package name contains the character ( $ ), you must use a single-quote ( ), for example,

          -

          Add-AppvClientPackage ‘Contoso$App.appv’

          - - - - - - - - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md deleted file mode 100644 index 72a7e81f82..0000000000 --- a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Administering App-V 5.1 Virtual Applications by Using the Management Console -description: Administering App-V 5.1 Virtual Applications by Using the Management Console -author: manikadhiman -ms.assetid: a4d078aa-ec54-4fa4-9463-bfb3b971d724 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering App-V 5.1 Virtual Applications by Using the Management Console - - -Use the Microsoft Application Virtualization (App-V) 5.1 management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V 5.1 client. One or more management servers typically share a common data store for configuration and package information. - -The management server uses Active Directory Domain Services (AD DS) groups to manage user authorization and has SQL Server installed to manage the database and data store. - -Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: - -- Management Server – Use the management server to manage packages and connection groups. - -- Publishing Server – Use the publishing server to deploy packages to computers that run the App-V 5.1 client. - -- Management Database - Use the management database to manage the package access and to publish the server’s synchronization with the management server. - -## Management Console tasks - - -The most common tasks that you can perform with the App-V 5.1 Management console are: - -- [How to Connect to the Management Console](how-to-connect-to-the-management-console-51.md) - -- [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) - -- [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md) - -- [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md) - -- [How to Delete a Package in the Management Console](how-to-delete-a-package-in-the-management-console-51.md) - -- [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console51.md) - -- [How to Register and Unregister a Publishing Server by Using the Management Console](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md) - -- [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md) - -- [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md) - -- [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md) - -- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md) - -The main elements of the App-V 5.1 Management Console are: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Management Console tabDescription

          Packages tab

          Use the PACKAGES tab to add or upgrade packages.

          Connection Groups tab

          Use the CONNECTION GROUPS tab to manage connection groups.

          Servers tab

          Use the SERVERS tab to register a new server.

          Administrators tab

          Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V 5.1 environment.

          - - - -**Important**   -JavaScript must be enabled on the browser that opens the Web Management Console. - - - - - - - - -## Other resources for this App-V 5.1 deployment - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/administering-app-v-by-using-powershell.md b/mdop/appv-v5/administering-app-v-by-using-powershell.md deleted file mode 100644 index 42d3dcaa27..0000000000 --- a/mdop/appv-v5/administering-app-v-by-using-powershell.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Administering App-V by Using PowerShell -description: Administering App-V by Using PowerShell -author: manikadhiman -ms.assetid: 1ff4686a-1e19-4eff-b648-ada091281094 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering App-V by Using PowerShell - - -Microsoft Application Virtualization (App-V) 5.0 provides Windows PowerShell cmdlets, which can help administrators perform various App-V 5.0 tasks. The following sections provide more information about using PowerShell with App-V 5.0. - -## How to administer App-V 5.0 by using PowerShell - - -Use the following PowerShell procedures to perform various App-V 5.0 tasks. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          How to Load the PowerShell Cmdlets and Get Cmdlet Help

          Describes how to install the PowerShell cmdlets and find cmdlet help and examples.

          How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell

          Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell.

          How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

          Describes how to manage connection groups using PowerShell.

          How to Modify Client Configuration by Using PowerShell

          Describes how to modify the client using PowerShell.

          How to Apply the User Configuration File by Using PowerShell

          Describes how to apply a user configuration file using PowerShell.

          How to Apply the Deployment Configuration File by Using PowerShell

          Describes how to apply a deployment configuration file using PowerShell.

          How to Sequence a Package by Using PowerShell

          Describes how to create a new package using PowerShell.

          How to Create a Package Accelerator by Using PowerShell

          Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications.

          How to Enable Reporting on the App-V 5.0 Client by Using PowerShell

          Describes how to enable the computer running the App-V 5.0 to send reporting information.

          How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell

          Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.

          - - - -## PowerShell Error Handling - - -Use the following table for information about App-V 5.0 PowerShell error handling. - - ---- - - - - - - - - - - - - - - - - -
          EventAction

          Using the RollbackOnError attribute with embedded scripts

          When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events:

          -
            -
          • Removing a package

          • -
          • Unpublishing a package

          • -
          • Terminating a virtual environment

          • -
          • Terminating a process

          • -

          Package name contains $

          If a package name contains the character ( $ ), you must use a single-quote ( ), for example,

          -

          Add-AppvClientPackage ‘Contoso$App.appv’

          - - - - - - - - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-capacity-planning.md b/mdop/appv-v5/app-v-50-capacity-planning.md deleted file mode 100644 index 457f754602..0000000000 --- a/mdop/appv-v5/app-v-50-capacity-planning.md +++ /dev/null @@ -1,963 +0,0 @@ ---- -title: App-V 5.0 Capacity Planning -description: App-V 5.0 Capacity Planning -author: manikadhiman -ms.assetid: 56f48b00-cd91-4280-9481-5372a0e2e792 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 Capacity Planning - - -The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V 5.0 infrastructure. - -**Important**   -Use the information in this section only as a general guide for planning your App-V 5.0 deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary. - - - -## Determine the Project Scope - - -Before you design the App-V 5.0 infrastructure, you must determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V 5.0 infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. - - ---- - - - - - - - - - - - - - - - - -
          TaskMore Information

          Determine Application Scope

          Depending on the applications to be virtualized, the App-V 5.0 infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize.

          Determine Location Scope

          Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed.

          - - - -## Determine Which App-V 5.0 Infrastructure is Required - - -**Important**   -Both of the following models require the App-V 5.0 client to be installed on the computer where you plan to run virtual applications. - -You can also manage your App-V 5.0 environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md). - - - -- **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V 5.0 in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios: - - - With disconnected remote users who cannot connect to the App-V 5.0 infrastructure. - - - When you are running a software management system, such as Configuration Manager 2012. - - - When network bandwidth limitations inhibit electronic software distribution. - -- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V 5.0 Full Infrastructure Model consists of one or more App-V 5.0 management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - - **Important**   - The App-V 5.0 full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - - - - When you want to use the Management Server to publish the application to target computers. - - - For rapid provisioning of applications to target computers. - - - When you want to use App-V 5.0 reporting. - -## End-to-end Server Sizing Guidance - - -The following section provides information about end-to-end App-V 5.0 sizing and planning. For more specific information, refer to the subsequent sections. - -**Note**   -Round trip response time on the client is the time taken by the computer running the App-V 5.0 client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server. - - - -- 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds) - -- A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time. (<5 seconds) - -## App-V 5.0 Management Server Capacity Planning Recommendations - - -The App-V 5.0 publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V 5.0 management server supported configurations see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -**Note**   -The default refresh time on the App-V 5.0 publishing server is ten minutes. - - - -When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server: - -1. Number of publishing servers making simultaneous requests. - -2. Number of connection groups configured on the management server. - -3. Number of access groups configured on the management server. - -The following table displays more information about each factor that impacts round trip time. - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.0 publishing server to receive a successful package metadata update from the management server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          Factors impacting round trip response timeMore Information

          The number of publishing servers simultaneously requesting package metadata refreshes.

          -
            -
          • A single management server can respond to up to 320 publishing servers requesting publishing metadata simultaneously.

          • -
          • Round trip response time for 320 pub servers is ~40 seconds.

          • -
          • For <50 publishing servers requesting metadata simultaneously, the round trip response time is <5 seconds.

          • -
          • From 50 to 320 publishing servers, the response time increases linearly (approximately 2x).

          • -

          The number of connection groups configured on the management server.

          -

          -
            -
          • For up to 100 connection groups, there is no significant change in the round trip response time on the publishing server.

          • -
          • For 100 - 400 connection groups, there is a minor linear increase in the round trip response time.

          • -

          The number of access groups configured on the management server.

          -

          -
            -
          • For up to 40 access groups, there is a linear (approximately 3x) increase in the round trip response time on the publishing server.

          • -
          - - - -The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V 5.0management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

          Publishing servers simultaneously contacting management server for publishing metadata.

          Number of publishing servers

          -
            -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -

          -
            -
          • 50

          • -
          • 100

          • -
          • 200

          • -
          • 300

          • -
          • 315

          • -
          • 320

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 5

          • -
          • 10

          • -
          • 19

          • -
          • 32

          • -
          • 30

          • -
          • 37

          • -

          -
            -
          • 17

          • -
          • 17

          • -
          • 17

          • -
          • 15

          • -
          • 17

          • -
          • 15

          • -

          Publishing metadata contains connection groups

          Number of connection groups

          -
            -
          • 10

          • -
          • 50

          • -
          • 100

          • -
          • 150

          • -
          • 300

          • -
          • 400

          • -

          -
            -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -

          -
            -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 10

          • -
          • 11

          • -
          • 11

          • -
          • 16

          • -
          • 22

          • -
          • 25

          • -

          -
            -
          • 17

          • -
          • 19

          • -
          • 22

          • -
          • 19

          • -
          • 20

          • -
          • 20

          • -

          Publishing metadata contains access groups

          Number of access groups

          -
            -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 10

          • -
          • 20

          • -
          • 40

          • -

          -
            -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 10

          • -
          • 43

          • -
          • 153

          • -
          • 535

          • -

          -
            -
          • 17

          • -
          • 26

          • -
          • 24

          • -
          • 24

          • -
          - - - -The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6. - -Using a geographically distributed deployment, where the management server & publishing servers utilize a slow link network between them, the round trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

          Network connection between the publishing server and management server

          1.5 Mbps Slow link Network

          -
            -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 1

          • -

          -
            -
          • 50

          • -
          • 100

          • -

          -
            -
          • 1.5Mbps Cable DSL

          • -
          • 1.5Mbps Cable DSL

          • -

          -
            -
          • 4

          • -
          • 5

          • -

          -
            -
          • 1

          • -
          • 2

          • -

          Network connection between the publishing server and management server

          LAN / WIFI Network

          -
            -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 1

          • -

          -
            -
          • 100

          • -
          • 200

          • -

          -
            -
          • Wifi

          • -
          • Wifi

          • -

          -
            -
          • 11

          • -
          • 20

          • -

          -
            -
          • 15

          • -
          • 17

          • -
          - - - -Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes. - -## App-V 5.0 Reporting Server Capacity Planning Recommendations - - -App-V 5.0 clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V 5.0 client. For more information about App-V 5.0 Reporting Server supported configurations see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.0 client to send the reporting information to the reporting server and receive a successful notification from the reporting server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ScenarioSummary

          Multiple App-V 5.0 clients send reporting information to the reporting server simultaneously.

          -
            -
          • Round trip response time from the reporting server is 2.6 seconds for 500 clients.

          • -
          • Round trip response time from the reporting server is 5.65 seconds for 1000 clients.

          • -
          • Round trip response time increases linearly depending on number of clients.

          • -

          Requests per second processed by the reporting server.

          -

          -
            -
          • A single reporting server and a single database, can process a maximum of 139 requests per second. The average is 121 requests/second.

          • -
          • Using two reporting servers reporting to the same Microsoft SQL Server database, the average requests/second is similar to a single reporting server = ~127, with a max of 278 requests/second.

          • -
          • A single reporting server can process 500 concurrent/active connections.

          • -
          • A single reporting server can process a maximum 1500 concurrent connections.

          • -

          Reporting Database.

          -

          -
            -
          • Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second.

          • -
          • Throughput and response time are independent of database size.

          • -
          - - - -**Calculating random delay**: - -The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data. - -Random delay = 4 \* number of clients / average requests per second. - -Example: For 500 clients, with 120 requests per second, the Random delay is, 4 \* 500 / 120 = ~17 minutes. - -## App-V 5.0 Publishing Server Capacity Planning Recommendations - - -Computers running the App-V 5.0 client connect to the App-V 5.0 publishing server to send a publishing refresh request and to receive a response. Round trip response time is measured on the computer running the App-V 5.0 client. Processor time is measured on the publishing server. For more information about App-V 5.0 Publishing Server supported configurations see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -**Important**   -The following list displays the main factors to consider when setting up the App-V 5.0 publishing server: - -- The number of clients connecting simultaneously to a single publishing server. - -- The number of packages in each refresh. - -- The available network bandwidth in your environment between the client and the App-V 5.0 publishing server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ScenarioSummary

          Multiple App-V 5.0 clients connect to a single publishing server simultaneously.

          -
            -
          • A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously.

          • -
          • For 5000-10000 clients, the publishing server requires a minimum quad core.

          • -
          • For 10000-20000 clients, the publishing server should have dual quad cores for more efficient response times.

          • -
          • A publishing server with a quad core can refresh up to 10000 packages within 3 seconds. (Supporting 10000 simultaneous clients)

          • -

          Number of packages in each refresh.

          -

          -
            -
          • Increasing number of packages will increase response time by ~40% (up to 1000 packages).

          • -

          Network between the App-V 5.0 client and the publishing server.

          -

          -
            -
          • Across a slow network (1.5 Mbps bandwidth), there is a 97% increase in response time compared to LAN (up to 1000 users).

          • -
          - - - -**Note**   -The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second. - - - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of App-V 5.0 clientsNumber of packagesProcessor configuration on the publishing serverNetwork connection type publishing server / App-V 5.0 clientRound trip time on the App-V 5.0 client (in seconds)CPU utilization on publishing server (in %)

          App-V 5.0 client sends publishing refresh request & receives response, each request containing 120 packages

          Number of clients

          -
            -
          • 100

          • -
          • 1000

          • -
          • 5000

          • -
          • 10000

          • -

          -
            -
          • 120

          • -
          • 120

          • -
          • 120

          • -
          • 120

          • -

          -
            -
          • Dual Core

          • -
          • Dual Core

          • -
          • Quad Core

          • -
          • Quad Core

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 1

          • -
          • 2

          • -
          • 2

          • -
          • 3

          • -

          -
            -
          • 100

          • -
          • 99

          • -
          • 89

          • -
          • 77

          • -

          Multiple packages in each refresh

          Number of packages

          -
            -
          • 1000

          • -
          • 1000

          • -

          -
            -
          • 500

          • -
          • 1000

          • -

          -
            -
          • Quad Core

          • -
          • Quad Core

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 2

          • -
          • 3

          • -

          -
            -
          • 92

          • -
          • 91

          • -

          Network between client and publishing server

          1.5 Mbps Slow link network

          -
            -
          • 100

          • -
          • 500

          • -
          • 1000

          • -

          -
            -
          • 120

          • -
          • 120

          • -
          • 120

          • -

          -
            -
          • Quad Core

          • -
          • Quad Core

          • -
          • Quad Core

          • -

          -
            -
          • 1.5 Mbps Intra-Continental Network

          • -

          -
            -
          • 3

          • -
          • 10 (with 0.2% failure rate)

          • -
          • 17 (with 1% failure rate)

          • -

          - - - -## App-V 5.0 Streaming Capacity Planning Recommendations - - -Computers running the App-V 5.0 client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V 5.0 client, and is the time taken to stream the entire package. - -**Important**   -The following list identifies the main factors to consider when setting up the App-V 5.0 streaming server: - -- The number of clients streaming application packages simultaneously from a single streaming server. - -- The size of the package being streamed. - -- The available network bandwidth in your environment between the client and the streaming server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ScenarioSummary

          Multiple App-V 5.0 clients stream applications from a single streaming server simultaneously.

          -
            -
          • If the number of clients simultaneously streaming from the same server increases, there is a linear relationship with the package download/streaming time.

          • -

          Size of the package being streamed.

          -

          -
            -
          • The package size has a significant impact on the streaming/download time only for larger packages with a size ~ 1GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.

          • -

          Network between the App-V 5.0 client and the streaming server.

          -

          -
            -
          • Across a slow network (1.5 Mbps bandwidth), there is a 70-80% increase in response time compared to LAN (up to 100 users).

          • -
          - - - -The following table displays sample values for each of the factors in the previous list: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of App-V 5.0 clientsSize of each packageNetwork connection type streaming server / App-V 5.0 clientRound trip time on the App-V 5.0 client (in seconds)

          Multiple App-V 5.0 clients streaming virtual application packages from a streaming server.

          Number of clients.

          -
            -
          • 100

          • -
          • 200

          • -
          • 1000

          • -
          • -
          • 100

          • -
          • 200

          • -
          • 1000

          • -

          -
            -
          • 3.5 MB

          • -
          • 3.5 MB

          • -
          • 3.5 MB

          • -
          • -
          • 5 MB

          • -
          • 5 MB

          • -
          • 5 MB

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 29

          • -
          • 39

          • -
          • 391

          • -
          • -
          • 35

          • -
          • 68

          • -
          • 461

          • -

          Size of each package being streamed.

          Size of each package.

          -
            -
          • 100

          • -
          • 200

          • -
          • -
          • 100

          • -
          • 200

          • -

          -
            -
          • 21 MB

          • -
          • 21 MB

          • -
          • -
          • 109

          • -
          • 109

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • -
          • LAN

          • -
          • LAN

          • -

          -

          33

          -

          83

          -

          -

          100

          -

          160

          Network connection between client and App-V 5.0 streaming server.

          1.5 Mbps Slow link network.

          -
            -
          • 100

          • -
          • -
          • 100

          • -

          -
            -
          • 3.5 MB

          • -
          • -
          • 5 MB

          • -

          -
            -
          • 1.5 Mbps Intra-Continental Network

          • -

          -

          102

          -

          -

          121

          - - - -Each App-V 5.0 streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications. - -**Note**   -The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions. - - - -For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers. - -The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. - -## Combining App-V 5.0 Server Roles - - -Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another. - -Ignoring scaling requirements, the minimum number of servers necessary to provide a fault-tolerant implementation is four. The management server, and Microsoft SQL Server roles support being placed in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure. - -Although there are a number of fault-tolerance strategies and technologies available, not all are applicable to a given service. Additionally, if App-V 5.0 roles are combined, certain fault-tolerance options may no longer apply due to incompatibilities. - - - - - - -## Related topics - - -[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) - -[Planning for High Availability with App-V 5.0](planning-for-high-availability-with-app-v-50.md) - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-deployment-checklist.md b/mdop/appv-v5/app-v-50-deployment-checklist.md deleted file mode 100644 index 811e99527d..0000000000 --- a/mdop/appv-v5/app-v-50-deployment-checklist.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: App-V 5.0 Deployment Checklist -description: App-V 5.0 Deployment Checklist -author: manikadhiman -ms.assetid: d6d93152-82b4-4b02-8b11-ed21d3331f00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft Application Virtualization (App-V) 5.0 deployment. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V 5.0 features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Complete the planning phase to prepare the computing environment for App-V 5.0 deployment.

          App-V 5.0 Planning Checklist

          Checklist box

          Review the App-V 5.0 supported configurations information to make sure selected client and server computers are supported for App-V 5.0 feature installation.

          App-V 5.0 Supported Configurations

          Checklist box

          Run App-V 5.0 Setup to deploy the required App-V 5.0 features for your environment.

          -
          -Note

          Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.

          -
          -
          - -

          -

          - - - - - - - - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-planning-checklist.md b/mdop/appv-v5/app-v-50-planning-checklist.md deleted file mode 100644 index 4dbf695034..0000000000 --- a/mdop/appv-v5/app-v-50-planning-checklist.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: App-V 5.0 Planning Checklist -description: App-V 5.0 Planning Checklist -author: manikadhiman -ms.assetid: 81d3fa62-3c9e-4de7-a9da-cd13112b0862 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Application Virtualization (App-V) 5.0 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for an App-V 5.0 deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the getting started information about App-V 5.0 to gain a basic understanding of the product before beginning deployment planning.

          Getting Started with App-V 5.0

          Checklist box

          Plan for App-V 5.0 1.0 Deployment Prerequisites and prepare your computing environment.

          App-V 5.0 Prerequisites

          Checklist box

          If you plan to use the App-V 5.0 management server, plan for the required roles.

          Planning for the App-V 5.0 Server Deployment

          Checklist box

          Plan for the App-V 5.0 sequencer and client so you to create and run virtualized applications.

          Planning for the App-V 5.0 Sequencer and Client Deployment

          Checklist box

          If applicable, review the options and steps for migrating from a previous version of App-V.

          Planning for Migrating from a Previous Version of App-V

          Checklist box

          Plan for running App-V 5.0 clients using in shared content store mode.

          How to Install the App-V 5.0 Client for Shared Content Store Mode

          - - - - - - - - -## Related topics - - -[Planning for App-V 5.0](planning-for-app-v-50-rc.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md deleted file mode 100644 index 2ecd8abb24..0000000000 --- a/mdop/appv-v5/app-v-50-prerequisites.md +++ /dev/null @@ -1,436 +0,0 @@ ---- -title: App-V 5.0 Prerequisites -description: App-V 5.0 Prerequisites -author: manikadhiman -ms.assetid: 9756b571-c785-4ce6-a95c-d4e134e89429 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 Prerequisites - - -Before you begin the Microsoft Application Virtualization (App-V) 5.0 Setup, you should make sure that you have met the prerequisites to install the product. This topic contains information to help you successfully plan for preparing your computing environment before you deploy the App-V 5.0 features. - -**Important** -**The prerequisites in this article apply only to App-V 5.0**. For additional prerequisites that apply to App-V 5.0 Service Packs, see the following web pages: - -- [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) - -- [About App-V 5.0 SP2](about-app-v-50-sp2.md) - -- [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) - - - -The following table lists prerequisite information that pertains to specific operating systems. - - ---- - - - - - - - - - - - - - - - - -
          Operating systemsPrerequisite description

          Computers that are running:

          -
            -
          • Windows 8

          • -
          • Windows Server 2012

          • -

          The following prerequisites are already installed:

          -
            -
          • Microsoft .NET Framework 4.5 – you do not need Microsoft .NET Framework 4

          • -
          • Windows PowerShell 3.0

          • -

          Computers that are running:

          -
            -
          • Windows 7

          • -
          • Windows Server 2008

          • -

          You may want to download the following KB:

          -

          Microsoft Security Advisory: Insecure library loading could allow remote code execution

          -

          Be sure to check for subsequent KBs that have superseded this one, and note that some KBs may require that you uninstall previous updates.

          - - - -## Installation prerequisites for App-V 5.0 - - -**Note** -The following prerequisites are already installed for computers that run Windows 8. - - - -Each of the App-V 5.0 features have specific prerequisites that must be met before the App-V 5.0 features can be successfully installed. - -### Prerequisites for the App-V 5.0 client - -The following table lists the installation prerequisites for the App-V 5.0 client: - - ---- - - - - - - - - - - - - -
          PrerequisiteDetails

          Software requirements

          - - - -### Prerequisites for the App-V 5.0 Remote Desktop Services client - -**Note** -The following prerequisites are already installed for computers that run Windows Server 2012. - - - -The following table lists the installation prerequisites for the App-V 5.0 Remote Desktop Services client: - - ---- - - - - - - - - - - - - -
          PrerequisiteDetails

          Software requirements

          - - - -### Prerequisites for the App-V 5.0 Sequencer - -**Note** -The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012. - - - -The following table lists the installation prerequisites for the App-V 5.0 Sequencer. If possible, the computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. - -**Note** -If the system requirements of a locally installed application exceed the requirements of the Sequencer, you must meet the requirements of that application. Additionally, because the sequencing process is system resource-intensive, we recommend that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - - - ---- - - - - - - - - - - - - -
          PrerequisiteDetails

          Software requirements

          - - - -### Prerequisites for the App-V 5.0 server - -**Note** -The following prerequisites are already installed for computers that run Windows Server 2012: - -- Microsoft .NET Framework 4.5. This eliminates the Microsoft .NET Framework 4 requirement. - -- Windows PowerShell 3.0 - -- Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623) - - **Important** - You can still download install the previous KB. However, it may have been replaced with a more recent version. - - - - - -The following table lists the installation prerequisites for the App-V 5.0 server. The account that you use to install the server components must have administrative rights on the computer that you are installing on. This account must also have the ability to query Active Directory Directory Services. Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to the specified ports. - -**Note** -Web Distributed Authoring and Versioning (WebDAV) is automatically disabled for the Management Service. - - - -The App-V 5.0 server is supported for a standalone deployment, where all the components are deployed on the same server, and a distributed deployment. Depending on the topology that you use to deploy the App-V 5.0 server, the data that you will need for each component will slightly change. - -**Important** -The installation of the App-V 5.0 server on a computer that runs any previous version or component of App-V is not supported. Additionally, the installation of the server components on a computer that runs Server Core or a Domain Controller is also not supported. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Management Server

          -

          The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server.

          -
            -
          • Installation location - by default this component will be installed to: %PROGRAMFILES%\Microsoft Application Virtualization Server.

          • -
          • Location of the App-V 5.0 management database - SQL Server Name, SQL Instance Name, Database Name.

          • -
          • Access rights for the App-V 5.0 management console - This is the user or the group that should be granted access to the management console at the end of the deployment. After the deployment, only these users will have access to the management console until additional administrators are added through the management console.

            -
            -Note

            Security groups and single users are not supported. You must specify an AD DS group.

            -
            -
            - -
          • -
          • App-V 5.0 management service website name – specify a name for the website or use the default name.

          • -
          • App-V 5.0 management service port binding - this should be a unique port number that is not used by another website on the computer.

          • -
          • Support for Microsoft Silverlight– Microsoft Silverlight must be installed before the management console is available. While this is not a requirement for the deployment, the server must be able to support Microsoft Silverlight.

          • -

          Management Database

          -
          -Note

          The database is required only when using the App-V 5.0 management server.

          -
          -
          - -
          - -

          The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.

          -
            -
          • Installation location - by default this component will be installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

          • -
          • Custom SQL Server instance name (if applicable) – the format should be INSTANCENAME, because the installation assumes that it is on the local machine. If you specify the name with the following format, SVR\INSTANCE will fail.

          • -
          • Custom App-V 5.0 database name (if applicable) – you must specify a unique database name. The default value for the management database is AppVManagement.

          • -
          • App-V 5.0 management server location – specifies the machine account on which the management server is deployed. This should be specified in the following format Domain\MachineAccount.

          • -
          • App-V 5.0 management server installation administrator - specifies the account that will be used to install the App-V 5.0 management server. You should use the following format: Domain\AdministratorLoginName.

          • -
          • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see Configure SQL Server Agent to Restart Services Automatically (https://go.microsoft.com/fwlink/?LinkId=273725).

          • -

          Reporting Server

            -
          • Microsoft .NET Framework 4 (Full Package) (http://www.microsoft.com/download/details.aspx?id=17718)

          • -
          • Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)(https://go.microsoft.com/fwlink/?LinkId=267110)

          • -
          • -Note

            To help reduce the risk of unwanted or malicious data being sent to the reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.

            -
            -
            - -
            -

            Windows Web Server with the IIS role with the following features: Common HTTP Features (static content and default document), Application Development (ASP.NET, .NET Extensibility, ISAPI Extensions and ISAPI Filters), Security (Windows Authentication, Request Filtering), Security (Windows Authentication, Request Filtering), Management Tools (IIS Management Console)

          • -
          • 64-bit ASP.NET registration

          • -
          • Installation location - by default this component is installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

          • -
          • App-V 5.0 reporting service website name – specifies the name of the website or the default name that will be used.

          • -
          • App-V 5.0 reporting service port binding - This should be a unique port number that is not already used by another website that runs on the computer.

          • -

          Reporting Database

          -
          -Note

          The database is required only when using the App-V 5.0 reporting server.

          -
          -
          - -
          - -

          The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 reporting database.

          -
            -
          • Installation location - by default this component will be installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

          • -
          • Custom SQL Server instance name (if applicable) – the format should be INSTANCENAME, because the installation assumes that it is on the local machine. If you specify the name with the following format, SVR\INSTANCE will fail.

          • -
          • Custom App-V 5.0 database name (if applicable) – you must specify a unique database name. The default value for the reporting database is AppVReporting.

          • -
          • App-V 5.0 reporting server location – specifies the machine account on which the reporting server is deployed. This should be specified in the following format Domain\MachineAccount.

          • -
          • App-V 5.0 reporting server installation administrator - specifies the account that will be used to install the App-V 5.0 reporting server. You should use the following format: Domain\AdministratorLoginName.

          • -
          • Microsoft SQL Server Service and the Microsoft SQL Server Agent Service – these services must be associated with user accounts that have access to query AD.

          • -

          Publishing Server

          -

          The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 publishing server.

          -
            -
          • Installation location - by default this component is installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

          • -
          • App-V 5.0 management service URL – specifies the URL of the App-V 5.0 management service. This is the port that the publishing server communicates with, and it should be specified using the following format: http://localhost:12345.

          • -
          • App-V 5.0 publishing service website name – specifies the name of the website or the default name that will be used.

          • -
          • App-V 5.0 publishing service port binding - This should be a unique port number that is not already used by another website that runs on the computer.

          • -
          - - - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-security-considerations.md b/mdop/appv-v5/app-v-50-security-considerations.md deleted file mode 100644 index f7291b163e..0000000000 --- a/mdop/appv-v5/app-v-50-security-considerations.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: App-V 5.0 Security Considerations -description: App-V 5.0 Security Considerations -author: manikadhiman -ms.assetid: 1e7292a0-7972-4b4f-85a9-eaf33f6c563a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 Security Considerations - - -This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for App-V 5.0. - -**Important** -App-V 5.0 is not a security product and does not provide any guarantees for a secure environment. - - - -## PackageStoreAccessControl (PSAC) feature has been deprecated - - -Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that was introduced in Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2) has been deprecated in both single-user and multi-user environments. - -## General security considerations - - -**Understand the security risks.** The most serious risk to App-V 5.0 is that its functionality could be hijacked by an unauthorized user who could then reconfigure key data on App-V 5.0 clients. The loss of App-V 5.0 functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. - -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V 5.0 server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V 5.0 servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V 5.0, subscribe to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V 5.0 and App-V 5.0 administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and groups in App-V 5.0 - - -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V 5.0 local groups on the App-V 5.0 servers. - -**Note** -App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. - - - -### App-V 5.0 server security - -No groups are created automatically during App-V 5.0 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.0 server operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Group nameDetails

          App-V Management Admin group

          Used to manage the App-V 5.0 management server. This group is created during the App-V 5.0 Management Server installation.

          -
          -Important

          There is no method to create the group using the management console after you have completed the installation.

          -
          -
          - -

          Database read/write for Management Service account

          Provides read/write access to the management database. This account should be created during the App-V 5.0 management database installation.

          App-V Management Service install admin account

          -
          -Note

          This is only required if management database is being installed separately from the service.

          -
          -
          - -

          Provides public access to schema-version table in management database. This account should be created during the App-V 5.0 management database installation.

          App-V Reporting Service install admin account

          -
          -Note

          This is only required if reporting database is being installed separately from the service.

          -
          -
          - -

          Public access to schema-version table in reporting database. This account should be created during the App-V 5.0 reporting database installation.

          - - - -Consider the following additional information: - -- Access to the package shares - If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share. - - **Note** - In previous versions of App-V, package share was referred to as content share. - - - -- Registering publishing servers with Management Server - A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API. - -### App-V 5.0 package security - -The following will help you plan how to ensure that virtualized packages are secure. - -- If an application installer applies an access control list (ACL) to a file or directory, then that ACL is not persisted in the package. When the package is deployed, if the file or directory is modified by a user it will either inherit the ACL in the **%userprofile%** or inherit the ACL of the target computer’s directory. The former case occurs if the file or directory does not exist in a virtual file system location; the latter case occurs if the file or directory exists in a virtual file system location, for example **%windir%**. - -## App-V 5.0 log files - - -During App-V 5.0 Setup, setup log files are created in the **%temp%** folder of the installing user. diff --git a/mdop/appv-v5/app-v-50-sp3-prerequisites.md b/mdop/appv-v5/app-v-50-sp3-prerequisites.md deleted file mode 100644 index fb281d9f9f..0000000000 --- a/mdop/appv-v5/app-v-50-sp3-prerequisites.md +++ /dev/null @@ -1,659 +0,0 @@ ---- -title: App-V 5.0 SP3 Prerequisites -description: App-V 5.0 SP3 Prerequisites -author: manikadhiman -ms.assetid: fa8d5578-3a53-4e8a-95c7-e7a5f6e4a31c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 SP3 Prerequisites - - -Before installing Microsoft Application Virtualization (App-V) 5.0 SP3, ensure that you have installed all of the following required prerequisite software. - -For a list of supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client, see [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md). - -## Summary of software preinstalled on each operating system - - -The following table indicates the software that is already installed for different operating systems. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Operating systemPrerequisite description

          Windows 8.1

          All of the prerequisite software is already installed.

          Windows 8

          -

          Windows Server 2012

          The following prerequisite software is already installed:

          -
            -
          • Microsoft .NET Framework 4.5

          • -
          • Windows PowerShell 3.0

            -
            -Note

            Installing PowerShell 3.0 requires a restart.

            -
            -
            - -
          • -

          Windows 7

          The prerequisite software is not already installed. You must install it before you can install App-V.

          - - - -## App-V Server prerequisite software - - -Install the required prerequisite software for the App-V 5.0 SP3 Server components. - -### What to know before you start - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Account for installing the App-V Server

          The account that you use to install the App-V Server components must have:

          -
            -
          • Administrative rights on the computer on which you are installing the components.

          • -
          • The ability to query Active Directory Domain Services.

          • -

          Port and firewall

            -
          • Specify a port where each component will be hosted.

          • -
          • Add the associated firewall rules to allow incoming requests to the specified ports.

          • -
          -

          Web Distributed Authoring and Versioning (WebDAV)

          WebDAV is automatically disabled for the Management Service.

          Supported deployment scenarios

            -
          • A stand-alone deployment, where all components are deployed on the same server.

          • -
          • A distributed deployment.

          • -

          Unsupported deployment scenarios

            -
          • Installing the App-V Server on a computer that runs any previous version or component of App-V.

          • -
          • Installing the App-V server components on a computer that runs server core or domain controller.

          • -
          - - - -### Management server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Supported version of SQL Server

          For supported versions, see App-V 5.0 SP3 Supported Configurations.

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          Installing PowerShell 3.0 requires a restart.

          Download and install KB2533623

          Applies to Windows 7 only.

          Visual C++ Redistributable Packages for Visual Studio 2013

          64-bit ASP.NET registration

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Management server.

          Web Server (IIS) Management Tools

          Click IIS Management Scripts and Tools.

          Web Server Role Services

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -
          -

          Management Tools:

          -
            -
          • IIS Management Console

          • -

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Location of the Management database

          SQL Server database name, SQL Server database instance name, and database name.

          Management console and Management database permissions

          A user or group that can access the Management console and database after the deployment is complete. Only these users or groups will have access to the Management console and database unless additional administrators are added by using the Management console.

          Management service website name

          Name for the Management console website.

          Management service port binding

          Unique port number for the Management service. This port cannot be used by another process on the computer.

          Microsoft Silverlight 5

          The Management console is available only if Silverlight is installed.

          - - - -### Management server database prerequisite software - -The Management database is required only if you are using the App-V 5.0 SP3 Management server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Custom SQL Server instance name (if applicable)

          Format to use: INSTANCENAME

          -

          This format is based on the assumption that the installation is on the local computer.

          -

          If you specify the name with the format SVR\INSTANCE, the installation will fail.

          Custom database name (if applicable)

          Unique database name.

          -

          Default: AppVManagement

          Management server location

          Machine account on which the Management server is deployed.

          -

          Format to use: Domain\MachineAccount

          Management server installation administrator

          Account used to install the Management server.

          -

          Format to use: Domain\AdministratorLoginName

          Microsoft SQL Server Service Agent

          Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see Configure SQL Server Agent to Restart Services Automatically.

          - - - -### Publishing server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          64-bit ASP.NET registration

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Management server.

          Web Server (IIS) Management Tools

          Click IIS Management Scripts and Tools.

          Web Server Role Services

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -
          -

          Management Tools:

          -
            -
          • IIS Management Console

          • -

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Management service URL

          URL of the App-V Management service. This is the port with which the Publishing server communicates.

          - ---- - - - - - - - - - - - - - - - - -
          Installation architectureFormat to use for the URL

          Management server and Publishing server are installed on the same server

          http://localhost:12345

          Management server and Publishing server are installed on different servers

          http://MyAppvServer.MyDomain.com

          -

          -

          Publishing service website name

          Name for the Publishing website.

          Publishing service port binding

          Unique port number for the Publishing service. This port cannot be used by another process on the computer.

          - - - -### Reporting server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Supported version of SQL Server

          For supported versions, see App-V 5.0 SP3 Supported Configurations.

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          64-bit ASP.NET registration

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Management server.

          Web Server (IIS) Management Tools

          Click IIS Management Scripts and Tools.

          Web Server Role Services

          To reduce the risk of unwanted or malicious data being sent to the Reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.

          -

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -
          -

          Management Tools:

          -
            -
          • IIS Management Console

          • -

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Reporting service website name

          Name for the Reporting website.

          Reporting service port binding

          Unique port number for the Reporting service. This port cannot be used by another process on the computer.

          - - - -### Reporting database prerequisite software - -The Reporting database is required only if you are using the App-V 5.0 SP3 Reporting server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Custom SQL Server instance name (if applicable)

          Format to use: INSTANCENAME

          -

          This format is based on the assumption that the installation is on the local computer.

          -

          If you specify the name with the format SVR\INSTANCE, the installation will fail.

          Custom database name (if applicable)

          Unique database name.

          -

          Default: AppVReporting

          Reporting server location

          Machine account on which the Reporting server is deployed.

          -

          Format to use: Domain\MachineAccount

          Reporting server installation administrator

          Account used to install the Reporting server.

          -

          Format to use: Domain\AdministratorLoginName

          Microsoft SQL Server Service and Microsoft SQL Server Service Agent

          Configure these services to be associated with user accounts that have access to query AD DS.

          - - - -## App-V client prerequisite software - - -Install the following prerequisite software for the App-V client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          -

          Installing PowerShell 3.0 requires a restart.

          KB2533623

          Applies to Windows 7 only: Download and install the KB.

          Visual C++ Redistributable Packages for Visual Studio 2013

          - - - -## Remote Desktop Services client prerequisite software - - -Install the following prerequisite software for the App-V Remote Desktop Services client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          -

          Installing PowerShell 3.0 requires a restart.

          KB2533623

          Applies to Windows 7 only: Download and install the KB.

          Visual C++ Redistributable Packages for Visual Studio 2013

          - - - -## Sequencer prerequisite software - - -**What to know before installing the prerequisites:** - -- Best practice: The computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. - -- The sequencing process is resource intensive, so make sure that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. The system requirements of locally installed applications cannot exceed those of the Sequencer. For more information, see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          -

          Installing PowerShell 3.0 requires a restart.

          KB2533623

          Applies to Windows 7 only: Download and install the KB.

          Visual C++ Redistributable Packages for Visual Studio 2013

          - - - - - - - - -## Related topics - - -[Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -[App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md deleted file mode 100644 index ce1e2700d6..0000000000 --- a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md +++ /dev/null @@ -1,467 +0,0 @@ ---- -title: App-V 5.0 SP3 Supported Configurations -description: App-V 5.0 SP3 Supported Configurations -author: manikadhiman -ms.assetid: 08ced79a-0ed3-43c3-82e7-de01c1f33e81 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 SP3 Supported Configurations - - -This topic specifies the requirements to install and run Microsoft Application Virtualization (App-V) 5.0 SP3 in your environment. - -## App-V Server system requirements - - -This section lists the operating system and hardware requirements for all of the App-V Server components. - -### Unsupported App-V 5.0 SP3 Server scenarios - -The App-V 5.0 SP3 Server does not support the following scenarios: - -- Deployment to a computer that runs Microsoft Windows Server Core. - -- Deployment to a computer that runs a previous version of App-V 5.0 SP3 Server components. You can install App-V 5.0 SP3 side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. - -- Deployment to a computer that runs Microsoft SQL Server Express edition. - -- Remote deployment of the management server database or the reporting database. You must run the installer directly on the computer that is running Microsoft SQL Server. - -- Deployment to a domain controller. - -- Short paths. If you plan to use a short path, you must create a new volume. - -### Management server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Management server installation. - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). See [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976) for more information. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -**Important**   -Deployment of the Management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported. - - - -### Management server hardware requirements - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—1 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Management server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.0 SP3 Management database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          SQL Server versionService packSystem architecture

          Microsoft SQL Server 2014

          32-bit or 64-bit

          Microsoft SQL Server 2012

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2008 R2

          SP3

          32-bit or 64-bit

          - - - -### Publishing server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Publishing server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -### Publishing server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Reporting server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Reporting server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -### Reporting server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -### Reporting server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.0 SP3 Reporting database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          SQL Server versionService packSystem architecture

          Microsoft SQL Server 2014

          32-bit or 64-bit

          Microsoft SQL Server 2012

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2008 R2

          SP3

          32-bit or 64-bit

          - - - -## App-V client system requirements - - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 client installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService packSystem architecture

          Microsoft Windows 8.1

          32-bit or 64-bit

          Microsoft Windows 8

          32-bit or 64-bit

          Windows 7

          SP1

          32-bit or 64-bit

          - - - -The following App-V client installation scenarios are not supported, except as noted: - -- Computers that run Windows Server - -- Computers that run App-V 4.6 SP1 or earlier versions - -- The App-V 5.0 SP3 Remote Desktop services client is supported only for RDS-enabled servers - -### App-V client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.0 SP3 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## Remote Desktop Services client system requirements - - -The following table lists the operating systems that are supported for App-V 5.0 SP3 Remote Desktop Services (RDS) client installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -### Remote Desktop Services client hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -## Sequencer system requirements - - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Sequencer installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService packSystem architecture

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          Microsoft Windows 8.1

          32-bit and 64-bit

          Microsoft Windows 8

          32-bit and 64-bit

          Microsoft Windows 7

          SP1

          32-bit and 64-bit

          - - - -### Sequencer hardware requirements - -See the Windows or Windows Server documentation for the hardware requirements. App-V adds no additional hardware requirements. - -## Supported versions of System Center Configuration Manager - - -The App-V client supports the following versions of System Center Configuration Manager: - -- Microsoft System Center 2012 Configuration Manager - -- System Center 2012 R2 Configuration Manager - -- System Center 2012 R2 Configuration Manager SP1 - -For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx). - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-supported-configurations.md b/mdop/appv-v5/app-v-50-supported-configurations.md deleted file mode 100644 index d8aebe5e0d..0000000000 --- a/mdop/appv-v5/app-v-50-supported-configurations.md +++ /dev/null @@ -1,532 +0,0 @@ ---- -title: App-V 5.0 Supported Configurations -description: App-V 5.0 Supported Configurations -author: manikadhiman -ms.assetid: 3787ff63-7ce7-45a8-8f01-81b4b6dced34 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 Supported Configurations - - -This topic specifies the requirements that are necessary to install and run Microsoft Application Virtualization (App-V) 5.0 in your environment. - -**Important** -**The supported configurations in this article apply only to App-V 5.0**. For supported configurations that apply to App-V 5.0 Service Packs, see the following web pages: - -- [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) - -- [About App-V 5.0 SP2](about-app-v-50-sp2.md) - -- [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md) - - - -## App-V 5.0 server system requirements - - -**Important** -The App-V 5.0 server does not support the following scenarios: - - - -- Deployment to a computer that runs Microsoft Windows Server Core. - -- Deployment to a computer that runs a previous version of App-V 5.0 server components. - - **Note** - You can install App-V 5.0 side-by-side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V 5.0 side-by-side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. - - - -- Deployment to a computer that runs Microsoft SQL Server Express edition. - -- Remote deployment of the management server database or the reporting database. The installer must be run directly on the computer running Microsoft SQL for the database installation to succeed. - -- Deployment to a domain controller. - -- Short paths are not supported. If you plan to use a short path you must create a new volume. - -### Management Server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 management server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)

          R2

          SP1 and higher

          64-bit

          Microsoft Windows Server 2012 (Standard, Datacenter)

          64-bit

          Microsoft Windows Server 2012 (Standard, Datacenter)

          R2

          64-bit

          - - - -**Important** -Deployment of the management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported. - - - -### Management Server hardware requirements - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM— 1 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory. - -### Publishing Server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 publishing server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)

          R2

          64-bit

          Microsoft Windows Server 2012 (Standard, Datacenter)

          64-bit

          Microsoft Windows Server 2012 (Standard, Datacenter)

          R2

          64-bit

          - - - -### Publishing Server hardware requirements - -- Processor—1.4 GHz or faster. 64-bit (x64) processor - -- RAM— 2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space. not including content directory - -### Reporting Server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 reporting server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService PackSystem architecture

          Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)

          R2

          64-bit

          Microsoft Windows Server 2012 (Standard, Datacenter)

          64-bit

          Microsoft Windows Server 2012 (Standard, Datacenter)

          R2

          64-bit

          - - - -### Reporting Server hardware requirements - -- Processor—1.4 GHz or faster. 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -### SQL Server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.0 database and server installation. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          App-V 5.0 server typeSQL Server versionEditionService packSystem architecture

          Management / Reporting

          Microsoft SQL Server 2008

          -

          (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)

          32-bit or 64-bit

          Management / Reporting

          Microsoft SQL Server 2008

          -

          (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)

          R2

          SP2

          32-bit or 64-bit

          Management / Reporting

          Microsoft SQL Server 2012

          -

          (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)

          32-bit or 64-bit

          - - - -## App-V 5.0 client system requirements - - -The following table lists the operating systems that are supported for the App-V 5.0 client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService packSystem architecture

          Microsoft Windows 7

          SP1

          32-bit or 64-bit

          Microsoft Windows 8

          32-bit or 64-bit

          -Important

          Windows 8.1 is only supported by App-V 5.0 SP2

          -
          -
          - -
          -

          Windows 8.1

          32-bit or 64-bit

          - - - -The following App-V client installation scenarios are not supported, except as noted: - -- Computers that run Windows Server - -- Computers that run App-V 4.6 SP1 or earlier versions - -- The App-V 5.0 Remote Desktop services client is supported only for RDS-enabled servers - -### Client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.0 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## App-V 5.0 Remote Desktop client system requirements - - -The following table lists the operating systems that are supported for App-V 5.0 Remote Desktop client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -Operating system -Edition -Service pack -Microsoft Windows Server 2008 - -R2 - -SP1 - -Microsoft Windows Server 2012 - -**Important** -Windows Server 2012 R2 is only supported by App-V 5.0 SP2 - - - -Microsoft Windows Server 2012 (Standard, Datacenter) - -R2 - -64-bit - - - -### Remote Desktop client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.0 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## App-V 5.0 Sequencer system requirements - - -The following table lists the operating systems that are supported for App-V 5.0 Sequencer installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Microsoft Windows 7

          SP1

          32-bit and 64-bit

          Microsoft Windows 8

          32-bit and 64-bit

          -Important

          Windows 8.1 is only supported by App-V 5.0 SP2

          -
          -
          - -
          -

          Windows 8.1

          32-bit or 64-bit

          Microsoft Windows Server 2008

          R2

          SP1

          32-bit and 64-bit

          Microsoft Windows Server 2012

          32-bit and 64-bit

          -Important

          Windows Server 2012 R2 is only supported by App-V 5.0 SP2

          -
          -
          - -
          -

          Microsoft Windows Server 2012

          R2

          64-bit

          - - - -## Supported versions of System Center Configuration Manager - - -You can use Microsoft System Center 2012 Configuration Manager or System Center 2012 R2 Configuration Manager to manage App-V virtual applications, reporting, and other functions. The following table lists the supported versions of Configuration Manager for each applicable version of App-V. - - ---- - - - - - - - - - - - - - - - - -
          Supported Configuration Manager versionApp-V version

          Microsoft System Center 2012 Configuration Manager

            -
          • App-V 5.0

          • -
          • App-V 5.0 SP1

          • -
          • App-V 5.0 SP2

          • -

          System Center 2012 R2 Configuration Manager

            -
          • App-V 5.0

          • -
          • App-V 5.0 SP1

          • -
          • App-V 5.0 SP2

          • -
          - - - -For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx). - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[App-V 5.0 Prerequisites](app-v-50-prerequisites.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-capacity-planning.md b/mdop/appv-v5/app-v-51-capacity-planning.md deleted file mode 100644 index 81fe9f8d6c..0000000000 --- a/mdop/appv-v5/app-v-51-capacity-planning.md +++ /dev/null @@ -1,963 +0,0 @@ ---- -title: App-V 5.1 Capacity Planning -description: App-V 5.1 Capacity Planning -author: manikadhiman -ms.assetid: 7a98062f-5a60-49d6-ab40-dc6057e1dd5a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Capacity Planning - - -The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V 5.1 infrastructure. - -**Important**   -Use the information in this section only as a general guide for planning your App-V 5.1 deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary. - - - -## Determine the Project Scope - - -Before you design the App-V 5.1 infrastructure, you must determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V 5.1 infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. - - ---- - - - - - - - - - - - - - - - - -
          TaskMore Information

          Determine Application Scope

          Depending on the applications to be virtualized, the App-V 5.1 infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize.

          Determine Location Scope

          Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed.

          - - - -## Determine Which App-V 5.1 Infrastructure is Required - - -**Important**   -Both of the following models require the App-V 5.1 client to be installed on the computer where you plan to run virtual applications. - -You can also manage your App-V 5.1 environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md). - - - -- **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V 5.1 in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios: - - - With disconnected remote users who cannot connect to the App-V 5.1 infrastructure. - - - When you are running a software management system, such as Configuration Manager 2012. - - - When network bandwidth limitations inhibit electronic software distribution. - -- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V 5.1 Full Infrastructure Model consists of one or more App-V 5.1 management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - - **Important**   - The App-V 5.1 full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - - - - - When you want to use the Management Server to publish the application to target computers. - - - For rapid provisioning of applications to target computers. - - - When you want to use App-V 5.1 reporting. - -## End-to-end Server Sizing Guidance - - -The following section provides information about end-to-end App-V 5.1 sizing and planning. For more specific information, refer to the subsequent sections. - -**Note**   -Round trip response time on the client is the time taken by the computer running the App-V 5.1 client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server. - - - -- 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds) - -- A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time. (<5 seconds) - -## App-V 5.1 Management Server Capacity Planning Recommendations - - -The App-V 5.1 publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V 5.1 management server supported configurations see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -**Note**   -The default refresh time on the App-V 5.1 publishing server is ten minutes. - - - -When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server: - -1. Number of publishing servers making simultaneous requests. - -2. Number of connection groups configured on the management server. - -3. Number of access groups configured on the management server. - -The following table displays more information about each factor that impacts round trip time. - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.1 publishing server to receive a successful package metadata update from the management server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          Factors impacting round trip response timeMore Information

          The number of publishing servers simultaneously requesting package metadata refreshes.

          -
            -
          • A single management server can respond to up to 320 publishing servers requesting publishing metadata simultaneously.

          • -
          • Round trip response time for 320 pub servers is ~40 seconds.

          • -
          • For <50 publishing servers requesting metadata simultaneously, the round trip response time is <5 seconds.

          • -
          • From 50 to 320 publishing servers, the response time increases linearly (approximately 2x).

          • -

          The number of connection groups configured on the management server.

          -

          -
            -
          • For up to 100 connection groups, there is no significant change in the round trip response time on the publishing server.

          • -
          • For 100 - 400 connection groups, there is a minor linear increase in the round trip response time.

          • -

          The number of access groups configured on the management server.

          -

          -
            -
          • For up to 40 access groups, there is a linear (approximately 3x) increase in the round trip response time on the publishing server.

          • -
          - - - -The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V 5.1management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

          Publishing servers simultaneously contacting management server for publishing metadata.

          Number of publishing servers

          -
            -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -

          -
            -
          • 50

          • -
          • 100

          • -
          • 200

          • -
          • 300

          • -
          • 315

          • -
          • 320

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 5

          • -
          • 10

          • -
          • 19

          • -
          • 32

          • -
          • 30

          • -
          • 37

          • -

          -
            -
          • 17

          • -
          • 17

          • -
          • 17

          • -
          • 15

          • -
          • 17

          • -
          • 15

          • -

          Publishing metadata contains connection groups

          Number of connection groups

          -
            -
          • 10

          • -
          • 50

          • -
          • 100

          • -
          • 150

          • -
          • 300

          • -
          • 400

          • -

          -
            -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -
          • 1

          • -

          -
            -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 10

          • -
          • 11

          • -
          • 11

          • -
          • 16

          • -
          • 22

          • -
          • 25

          • -

          -
            -
          • 17

          • -
          • 19

          • -
          • 22

          • -
          • 19

          • -
          • 20

          • -
          • 20

          • -

          Publishing metadata contains access groups

          Number of access groups

          -
            -
          • 0

          • -
          • 0

          • -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 10

          • -
          • 20

          • -
          • 40

          • -

          -
            -
          • 100

          • -
          • 100

          • -
          • 100

          • -
          • 100

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 10

          • -
          • 43

          • -
          • 153

          • -
          • 535

          • -

          -
            -
          • 17

          • -
          • 26

          • -
          • 24

          • -
          • 24

          • -
          - - - -The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6. - -Using a geographically distributed deployment, where the management server & publishing servers utilize a slow link network between them, the round trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

          Network connection between the publishing server and management server

          1.5 Mbps Slow link Network

          -
            -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 1

          • -

          -
            -
          • 50

          • -
          • 100

          • -

          -
            -
          • 1.5Mbps Cable DSL

          • -
          • 1.5Mbps Cable DSL

          • -

          -
            -
          • 4

          • -
          • 5

          • -

          -
            -
          • 1

          • -
          • 2

          • -

          Network connection between the publishing server and management server

          LAN / WIFI Network

          -
            -
          • 0

          • -
          • 0

          • -

          -
            -
          • 1

          • -
          • 1

          • -

          -
            -
          • 100

          • -
          • 200

          • -

          -
            -
          • Wifi

          • -
          • Wifi

          • -

          -
            -
          • 11

          • -
          • 20

          • -

          -
            -
          • 15

          • -
          • 17

          • -
          - - - -Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes. - -## App-V 5.1 Reporting Server Capacity Planning Recommendations - - -App-V 5.1 clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V 5.1 client. For more information about App-V 5.1 Reporting Server supported configurations see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.1 client to send the reporting information to the reporting server and receive a successful notification from the reporting server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ScenarioSummary

          Multiple App-V 5.1 clients send reporting information to the reporting server simultaneously.

          -
            -
          • Round trip response time from the reporting server is 2.6 seconds for 500 clients.

          • -
          • Round trip response time from the reporting server is 5.65 seconds for 1000 clients.

          • -
          • Round trip response time increases linearly depending on number of clients.

          • -

          Requests per second processed by the reporting server.

          -

          -
            -
          • A single reporting server and a single database, can process a maximum of 139 requests per second. The average is 121 requests/second.

          • -
          • Using two reporting servers reporting to the same Microsoft SQL Server database, the average requests/second is similar to a single reporting server = ~127, with a max of 278 requests/second.

          • -
          • A single reporting server can process 500 concurrent/active connections.

          • -
          • A single reporting server can process a maximum 1500 concurrent connections.

          • -

          Reporting Database.

          -

          -
            -
          • Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second.

          • -
          • Throughput and response time are independent of database size.

          • -
          - - - -**Calculating random delay**: - -The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data. - -Random delay = 4 \* number of clients / average requests per second. - -Example: For 500 clients, with 120 requests per second, the Random delay is, 4 \* 500 / 120 = ~17 minutes. - -## App-V 5.1 Publishing Server Capacity Planning Recommendations - - -Computers running the App-V 5.1 client connect to the App-V 5.1 publishing server to send a publishing refresh request and to receive a response. Round trip response time is measured on the computer running the App-V 5.1 client. Processor time is measured on the publishing server. For more information about App-V 5.1 Publishing Server supported configurations see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -**Important**   -The following list displays the main factors to consider when setting up the App-V 5.1 publishing server: - -- The number of clients connecting simultaneously to a single publishing server. - -- The number of packages in each refresh. - -- The available network bandwidth in your environment between the client and the App-V 5.1 publishing server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ScenarioSummary

          Multiple App-V 5.1 clients connect to a single publishing server simultaneously.

          -
            -
          • A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously.

          • -
          • For 5000-10000 clients, the publishing server requires a minimum quad core.

          • -
          • For 10000-20000 clients, the publishing server should have dual quad cores for more efficient response times.

          • -
          • A publishing server with a quad core can refresh up to 10000 packages within 3 seconds. (Supporting 10000 simultaneous clients)

          • -

          Number of packages in each refresh.

          -

          -
            -
          • Increasing number of packages will increase response time by ~40% (up to 1000 packages).

          • -

          Network between the App-V 5.1 client and the publishing server.

          -

          -
            -
          • Across a slow network (1.5 Mbps bandwidth), there is a 97% increase in response time compared to LAN (up to 1000 users).

          • -
          - - - -**Note**   -The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second. - - - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of App-V 5.1 clientsNumber of packagesProcessor configuration on the publishing serverNetwork connection type publishing server / App-V 5.1 clientRound trip time on the App-V 5.1 client (in seconds)CPU utilization on publishing server (in %)

          App-V 5.1 client sends publishing refresh request & receives response, each request containing 120 packages

          Number of clients

          -
            -
          • 100

          • -
          • 1000

          • -
          • 5000

          • -
          • 10000

          • -

          -
            -
          • 120

          • -
          • 120

          • -
          • 120

          • -
          • 120

          • -

          -
            -
          • Dual Core

          • -
          • Dual Core

          • -
          • Quad Core

          • -
          • Quad Core

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 1

          • -
          • 2

          • -
          • 2

          • -
          • 3

          • -

          -
            -
          • 100

          • -
          • 99

          • -
          • 89

          • -
          • 77

          • -

          Multiple packages in each refresh

          Number of packages

          -
            -
          • 1000

          • -
          • 1000

          • -

          -
            -
          • 500

          • -
          • 1000

          • -

          -
            -
          • Quad Core

          • -
          • Quad Core

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 2

          • -
          • 3

          • -

          -
            -
          • 92

          • -
          • 91

          • -

          Network between client and publishing server

          1.5 Mbps Slow link network

          -
            -
          • 100

          • -
          • 500

          • -
          • 1000

          • -

          -
            -
          • 120

          • -
          • 120

          • -
          • 120

          • -

          -
            -
          • Quad Core

          • -
          • Quad Core

          • -
          • Quad Core

          • -

          -
            -
          • 1.5 Mbps Intra-Continental Network

          • -

          -
            -
          • 3

          • -
          • 10 (with 0.2% failure rate)

          • -
          • 17 (with 1% failure rate)

          • -

          - - - -## App-V 5.1 Streaming Capacity Planning Recommendations - - -Computers running the App-V 5.1 client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V 5.1 client, and is the time taken to stream the entire package. - -**Important**   -The following list identifies the main factors to consider when setting up the App-V 5.1 streaming server: - -- The number of clients streaming application packages simultaneously from a single streaming server. - -- The size of the package being streamed. - -- The available network bandwidth in your environment between the client and the streaming server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
          ScenarioSummary

          Multiple App-V 5.1 clients stream applications from a single streaming server simultaneously.

          -
            -
          • If the number of clients simultaneously streaming from the same server increases, there is a linear relationship with the package download/streaming time.

          • -

          Size of the package being streamed.

          -

          -
            -
          • The package size has a significant impact on the streaming/download time only for larger packages with a size ~ 1GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.

          • -

          Network between the App-V 5.1 client and the streaming server.

          -

          -
            -
          • Across a slow network (1.5 Mbps bandwidth), there is a 70-80% increase in response time compared to LAN (up to 100 users).

          • -
          - - - -The following table displays sample values for each of the factors in the previous list: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ScenarioVariationNumber of App-V 5.1 clientsSize of each packageNetwork connection type streaming server / App-V 5.1 clientRound trip time on the App-V 5.1 client (in seconds)

          Multiple App-V 5.1 clients streaming virtual application packages from a streaming server.

          Number of clients.

          -
            -
          • 100

          • -
          • 200

          • -
          • 1000

          • -
          • -
          • 100

          • -
          • 200

          • -
          • 1000

          • -

          -
            -
          • 3.5 MB

          • -
          • 3.5 MB

          • -
          • 3.5 MB

          • -
          • -
          • 5 MB

          • -
          • 5 MB

          • -
          • 5 MB

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -
          • -
          • LAN

          • -
          • LAN

          • -
          • LAN

          • -

          -
            -
          • 29

          • -
          • 39

          • -
          • 391

          • -
          • -
          • 35

          • -
          • 68

          • -
          • 461

          • -

          Size of each package being streamed.

          Size of each package.

          -
            -
          • 100

          • -
          • 200

          • -
          • -
          • 100

          • -
          • 200

          • -

          -
            -
          • 21 MB

          • -
          • 21 MB

          • -
          • -
          • 109

          • -
          • 109

          • -

          -
            -
          • LAN

          • -
          • LAN

          • -
          • -
          • LAN

          • -
          • LAN

          • -

          -

          33

          -

          83

          -

          -

          100

          -

          160

          Network connection between client and App-V 5.1 streaming server.

          1.5 Mbps Slow link network.

          -
            -
          • 100

          • -
          • -
          • 100

          • -

          -
            -
          • 3.5 MB

          • -
          • -
          • 5 MB

          • -

          -
            -
          • 1.5 Mbps Intra-Continental Network

          • -

          -

          102

          -

          -

          121

          - - - -Each App-V 5.1 streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications. - -**Note**   -The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions. - - - -For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers. - -The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. - -## Combining App-V 5.1 Server Roles - - -Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another. - -Ignoring scaling requirements, the minimum number of servers necessary to provide a fault-tolerant implementation is four. The management server, and Microsoft SQL Server roles support being placed in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure. - -Although there are a number of fault-tolerance strategies and technologies available, not all are applicable to a given service. Additionally, if App-V 5.1 roles are combined, certain fault-tolerance options may no longer apply due to incompatibilities. - - - - - - -## Related topics - - -[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) - -[Planning for High Availability with App-V 5.1](planning-for-high-availability-with-app-v-51.md) - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-deployment-checklist.md b/mdop/appv-v5/app-v-51-deployment-checklist.md deleted file mode 100644 index 59236f1c84..0000000000 --- a/mdop/appv-v5/app-v-51-deployment-checklist.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: App-V 5.1 Deployment Checklist -description: App-V 5.1 Deployment Checklist -author: manikadhiman -ms.assetid: 44bed85a-e4f5-49d7-a308-a2b681f76372 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Deployment Checklist - - -This checklist can be used to help you during Microsoft Application Virtualization (App-V) 5.1 deployment. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V 5.1 features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Complete the planning phase to prepare the computing environment for App-V 5.1 deployment.

          App-V 5.1 Planning Checklist

          Checklist box

          Review the App-V 5.1 supported configurations information to make sure selected client and server computers are supported for App-V 5.1 feature installation.

          App-V 5.1 Supported Configurations

          Checklist box

          Run App-V 5.1 Setup to deploy the required App-V 5.1 features for your environment.

          -
          -Note

          Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.

          -
          -
          - -

          -

          - - - - - - - - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-planning-checklist.md b/mdop/appv-v5/app-v-51-planning-checklist.md deleted file mode 100644 index c662fbb94c..0000000000 --- a/mdop/appv-v5/app-v-51-planning-checklist.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: App-V 5.1 Planning Checklist -description: App-V 5.1 Planning Checklist -author: manikadhiman -ms.assetid: 1e26a861-0612-43a6-972f-375a40a8dcbc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Application Virtualization (App-V) 5.1 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for an App-V 5.1 deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the getting started information about App-V 5.1 to gain a basic understanding of the product before beginning deployment planning.

          Getting Started with App-V 5.1

          Checklist box

          Plan for App-V 5.1 1.0 Deployment Prerequisites and prepare your computing environment.

          App-V 5.1 Prerequisites

          Checklist box

          If you plan to use the App-V 5.1 management server, plan for the required roles.

          Planning for the App-V 5.1 Server Deployment

          Checklist box

          Plan for the App-V 5.1 sequencer and client so you to create and run virtualized applications.

          Planning for the App-V 5.1 Sequencer and Client Deployment

          Checklist box

          If applicable, review the options and steps for migrating from a previous version of App-V.

          Planning for Migrating from a Previous Version of App-V

          Checklist box

          Plan for running App-V 5.1 clients using in shared content store mode.

          How to Install the App-V 5.1 Client for Shared Content Store Mode

          - - - - - - - - -## Related topics - - -[Planning for App-V 5.1](planning-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-prerequisites.md b/mdop/appv-v5/app-v-51-prerequisites.md deleted file mode 100644 index 037f317f8d..0000000000 --- a/mdop/appv-v5/app-v-51-prerequisites.md +++ /dev/null @@ -1,665 +0,0 @@ ---- -title: App-V 5.1 Prerequisites -description: App-V 5.1 Prerequisites -author: manikadhiman -ms.assetid: 1bfa03c1-a4ae-45ec-8a2b-b10c2b94bfb0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Prerequisites - - -Before installing Microsoft Application Virtualization (App-V) 5.1, ensure that you have installed all of the following required prerequisite software. - -For a list of supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -## Summary of software preinstalled on each operating system - - -The following table indicates the software that is already installed for different operating systems. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemPrerequisite description

          Windows 10

          All of the prerequisite software is already installed.

          Windows 8.1

          All of the prerequisite software is already installed.

          -
          -Note

          If you are running Windows 8, upgrade to Windows 8.1 before using App-V 5.1.

          -
          -
          - -

          Windows Server 2012

          The following prerequisite software is already installed:

          -
            -
          • Microsoft .NET Framework 4.5

          • -
          • Windows PowerShell 3.0

            -
            -Note

            Installing PowerShell 3.0 requires a restart.

            -
            -
            - -
          • -

          Windows 7

          The prerequisite software is not already installed. You must install it before you can install App-V.

          - - - -## App-V Server prerequisite software - - -Install the required prerequisite software for the App-V 5.1 Server components. - -### What to know before you start - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Account for installing the App-V Server

          The account that you use to install the App-V Server components must have:

          -
            -
          • Administrative rights on the computer on which you are installing the components.

          • -
          • The ability to query Active Directory Domain Services.

          • -

          Port and firewall

            -
          • Specify a port where each component will be hosted.

          • -
          • Add the associated firewall rules to allow incoming requests to the specified ports.

          • -
          -

          Web Distributed Authoring and Versioning (WebDAV)

          WebDAV is automatically disabled for the Management Service.

          Supported deployment scenarios

            -
          • A stand-alone deployment, where all components are deployed on the same server.

          • -
          • A distributed deployment.

          • -

          Unsupported deployment scenarios

            -
          • Installing side-by-side instances of multiple App-V Server versions on the same server.

          • -
          • Installing the App-V server components on a computer that runs server core or domain controller.

          • -
          - - - -### Management server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Supported version of SQL Server

          For supported versions, see App-V 5.1 Supported Configurations.

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          Installing PowerShell 3.0 requires a restart.

          Download and install KB2533623

          Applies to Windows 7 only.

          Visual C++ Redistributable Packages for Visual Studio 2013

          64-bit ASP.NET registration

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Management server.

          Web Server (IIS) Management Tools

          Click IIS Management Scripts and Tools.

          Web Server Role Services

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -
          -

          Management Tools:

          -
            -
          • IIS Management Console

          • -

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Location of the Management database

          SQL Server database name, SQL Server database instance name, and database name.

          Management console and Management database permissions

          A user or group that can access the Management console and database after the deployment is complete. Only these users or groups will have access to the Management console and database unless additional administrators are added by using the Management console.

          Management service website name

          Name for the Management console website.

          Management service port binding

          Unique port number for the Management service. This port cannot be used by another process on the computer.

          - - - -**Important** -JavaScript must be enabled on the browser that opens the Web Management Console. - - - -### Management server database prerequisite software - -The Management database is required only if you are using the App-V 5.1 Management server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Custom SQL Server instance name (if applicable)

          Format to use: INSTANCENAME

          -

          This format is based on the assumption that the installation is on the local computer.

          -

          If you specify the name with the format SVR\INSTANCE, the installation will fail.

          Custom database name (if applicable)

          Unique database name.

          -

          Default: AppVManagement

          Management server location

          Machine account on which the Management server is deployed.

          -

          Format to use: Domain\MachineAccount

          Management server installation administrator

          Account used to install the Management server.

          -

          Format to use: Domain\AdministratorLoginName

          Microsoft SQL Server Service Agent

          Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see Configure SQL Server Agent to Restart Services Automatically.

          - - - -### Publishing server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          64-bit ASP.NET registration

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Management server.

          Web Server (IIS) Management Tools

          Click IIS Management Scripts and Tools.

          Web Server Role Services

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -
          -

          Management Tools:

          -
            -
          • IIS Management Console

          • -

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Management service URL

          URL of the App-V Management service. This is the port with which the Publishing server communicates.

          - ---- - - - - - - - - - - - - - - - - -
          Installation architectureFormat to use for the URL

          Management server and Publishing server are installed on the same server

          http://localhost:12345

          Management server and Publishing server are installed on different servers

          http://MyAppvServer.MyDomain.com

          -

          -

          Publishing service website name

          Name for the Publishing website.

          Publishing service port binding

          Unique port number for the Publishing service. This port cannot be used by another process on the computer.

          - - - -### Reporting server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Supported version of SQL Server

          For supported versions, see App-V 5.1 Supported Configurations.

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          64-bit ASP.NET registration

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Management server.

          Web Server (IIS) Management Tools

          Click IIS Management Scripts and Tools.

          Web Server Role Services

          To reduce the risk of unwanted or malicious data being sent to the Reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.

          -

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -
          -

          Management Tools:

          -
            -
          • IIS Management Console

          • -

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Reporting service website name

          Name for the Reporting website.

          Reporting service port binding

          Unique port number for the Reporting service. This port cannot be used by another process on the computer.

          - - - -### Reporting database prerequisite software - -The Reporting database is required only if you are using the App-V 5.1 Reporting server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Prerequisites and required settingsDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Visual C++ Redistributable Packages for Visual Studio 2013

          Default installation location

          %PROGRAMFILES%\Microsoft Application Virtualization Server

          Custom SQL Server instance name (if applicable)

          Format to use: INSTANCENAME

          -

          This format is based on the assumption that the installation is on the local computer.

          -

          If you specify the name with the format SVR\INSTANCE, the installation will fail.

          Custom database name (if applicable)

          Unique database name.

          -

          Default: AppVReporting

          Reporting server location

          Machine account on which the Reporting server is deployed.

          -

          Format to use: Domain\MachineAccount

          Reporting server installation administrator

          Account used to install the Reporting server.

          -

          Format to use: Domain\AdministratorLoginName

          Microsoft SQL Server Service and Microsoft SQL Server Service Agent

          Configure these services to be associated with user accounts that have access to query AD DS.

          - - - -## App-V client prerequisite software - - -Install the following prerequisite software for the App-V client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          -

          Installing PowerShell 3.0 requires a restart.

          KB2533623

          Applies to Windows 7 only: Download and install the KB.

          Visual C++ Redistributable Packages for Visual Studio 2013

          - - - -## Remote Desktop Services client prerequisite software - - -Install the following prerequisite software for the App-V Remote Desktop Services client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          -

          Installing PowerShell 3.0 requires a restart.

          KB2533623

          Applies to Windows 7 only: Download and install the KB.

          Visual C++ Redistributable Packages for Visual Studio 2013

          - - - -## Sequencer prerequisite software - - -**What to know before installing the prerequisites:** - -- Best practice: The computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. - -- The sequencing process is resource intensive, so make sure that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. The system requirements of locally installed applications cannot exceed those of the Sequencer. For more information, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Microsoft .NET Framework 4.5.1 (Web Installer)

          Windows PowerShell 3.0

          -

          Installing PowerShell 3.0 requires a restart.

          KB2533623

          Applies to Windows 7 only: Download and install the KB.

          - - - - - - - - -## Related topics - - -[Planning for App-V 5.1](planning-for-app-v-51.md) - -[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-security-considerations.md b/mdop/appv-v5/app-v-51-security-considerations.md deleted file mode 100644 index dac917b699..0000000000 --- a/mdop/appv-v5/app-v-51-security-considerations.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: App-V 5.1 Security Considerations -description: App-V 5.1 Security Considerations -author: manikadhiman -ms.assetid: 6bc6c1fc-f813-47d4-b763-06fd4faf6a72 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.1 Security Considerations - - -This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V) 5.1. - -**Important** -App-V 5.1 is not a security product and does not provide any guarantees for a secure environment. - - - -## PackageStoreAccessControl (PSAC) feature has been deprecated - - -Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that was introduced in Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2) has been deprecated in both single-user and multi-user environments. - -## General security considerations - - -**Understand the security risks.** The most serious risk to App-V 5.1 is that its functionality could be hijacked by an unauthorized user who could then reconfigure key data on App-V 5.1 clients. The loss of App-V 5.1 functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. - -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V 5.1 server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V 5.1 servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V 5.1, subscribe to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V 5.1 and App-V 5.1 administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and groups in App-V 5.1 - - -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V 5.1 local groups on the App-V 5.1 servers. - -**Note** -App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. - - - -### App-V 5.1 server security - -No groups are created automatically during App-V 5.1 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.1 server operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Group nameDetails

          App-V Management Admin group

          Used to manage the App-V 5.1 management server. This group is created during the App-V 5.1 Management Server installation.

          -
          -Important

          There is no method to create the group using the management console after you have completed the installation.

          -
          -
          - -

          Database read/write for Management Service account

          Provides read/write access to the management database. This account should be created during the App-V 5.1 management database installation.

          App-V Management Service install admin account

          -
          -Note

          This is only required if management database is being installed separately from the service.

          -
          -
          - -

          Provides public access to schema-version table in management database. This account should be created during the App-V 5.1 management database installation.

          App-V Reporting Service install admin account

          -
          -Note

          This is only required if reporting database is being installed separately from the service.

          -
          -
          - -

          Public access to schema-version table in reporting database. This account should be created during the App-V 5.1 reporting database installation.

          - - - -Consider the following additional information: - -- Access to the package shares - If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share. - - **Note** - In previous versions of App-V, package share was referred to as content share. - - - -- Registering publishing servers with Management Server - A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API. - -### App-V 5.1 package security - -The following will help you plan how to ensure that virtualized packages are secure. - -- If an application installer applies an access control list (ACL) to a file or directory, then that ACL is not persisted in the package. When the package is deployed, if the file or directory is modified by a user it will either inherit the ACL in the **%userprofile%** or inherit the ACL of the target computer’s directory. The former case occurs if the file or directory does not exist in a virtual file system location; the latter case occurs if the file or directory exists in a virtual file system location, for example **%windir%**. - -## App-V 5.1 log files - - -During App-V 5.1 Setup, setup log files are created in the **%temp%** folder of the installing user. - - - - - - -## Related topics - - -[Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md deleted file mode 100644 index 63e4f12d3c..0000000000 --- a/mdop/appv-v5/app-v-51-supported-configurations.md +++ /dev/null @@ -1,565 +0,0 @@ ---- -title: App-V 5.1 Supported Configurations -description: App-V 5.1 Supported Configurations -author: manikadhiman -ms.assetid: 8b8db63b-f71c-4ae9-80e7-a6752334e1f6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 09/27/2016 ---- - - -# App-V 5.1 Supported Configurations - - -This topic specifies the requirements to install and run Microsoft Application Virtualization (App-V) 5.1 in your environment. - -## App-V Server system requirements - - -This section lists the operating system and hardware requirements for all of the App-V Server components. - -### Unsupported App-V 5.1 Server scenarios - -The App-V 5.1 Server does not support the following scenarios: - -- Deployment to a computer that runs Microsoft Windows Server Core. - -- Deployment to a computer that runs a previous version of App-V 5.1 Server components. You can install App-V 5.1 side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. - -- Deployment to a computer that runs Microsoft SQL Server Express edition. - -- Deployment to a domain controller. - -- Short paths. If you plan to use a short path, you must create a new volume. - -### Management server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 Management server installation. - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). See [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976) for more information. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2016

          64-bit

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -**Important**   -Deployment of the Management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported. - - - -### Management server hardware requirements - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—1 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Management server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.1 Management database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SQL Server versionService packSystem architecture

          Microsoft SQL Server 2017

          32-bit or 64-bit

          Microsoft SQL Server 2016

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2014

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2012

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2008 R2

          SP3

          32-bit or 64-bit

          - - - -### Publishing server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 Publishing server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2016

          64-bit

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -### Publishing server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Reporting server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 Reporting server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2016

          64-bit

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -### Reporting server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -### Reporting server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.1 Reporting database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SQL Server versionService packSystem architecture

          Microsoft SQL Server 2017

          32-bit or 64-bit

          Microsoft SQL Server 2016

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2014

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2012

          SP2

          32-bit or 64-bit

          Microsoft SQL Server 2008 R2

          SP3

          32-bit or 64-bit

          - - - -## App-V client system requirements - - -The following table lists the operating systems that are supported for the App-V 5.1 client installation. - -**Note:** With the Windows 10 Anniversary release (aka 1607 version), the App-V client is in-box and will block installation of any previous version of the App-V client - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService packSystem architecture

          Microsoft Windows 10 (pre-1607 version)

          32-bit or 64-bit

          Microsoft Windows 8.1

          32-bit or 64-bit

          Windows 7

          SP1

          32-bit or 64-bit

          - - - -The following App-V client installation scenarios are not supported, except as noted: - -- Computers that run Windows Server - -- Computers that run App-V 4.6 SP1 or earlier versions - -- The App-V 5.1 Remote Desktop services client is supported only for RDS-enabled servers - -### App-V client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.1 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## Remote Desktop Services client system requirements - - -The following table lists the operating systems that are supported for App-V 5.1 Remote Desktop Services (RDS) client installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService PackSystem architecture

          Microsoft Windows Server 2016

          64-bit

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          - - - -### Remote Desktop Services client hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -## Sequencer system requirements - - -The following table lists the operating systems that are supported for the App-V 5.1 Sequencer installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemService packSystem architecture

          Microsoft Windows Server 2016

          64-bit

          Microsoft Windows Server 2012 R2

          64-bit

          Microsoft Windows Server 2012

          64-bit

          Microsoft Windows Server 2008 R2

          SP1

          64-bit

          Microsoft Windows 10

          32-bit and 64-bit

          Microsoft Windows 8.1

          32-bit and 64-bit

          Microsoft Windows 7

          SP1

          32-bit and 64-bit

          - - - -### Sequencer hardware requirements - -See the Windows or Windows Server documentation for the hardware requirements. App-V adds no additional hardware requirements. - -## Supported versions of System Center Configuration Manager - - -The App-V client supports the following versions of System Center Configuration Manager: - -- Microsoft System Center 2012 Configuration Manager - -- System Center 2012 R2 Configuration Manager - -- System Center 2012 R2 Configuration Manager SP1 - -The following App-V and System Center Configuration Manager version matrix shows all officially supported combinations of App-V and Configuration Manager. - -**Note:** Both App-V 4.5 and 4.6 have exited Mainstream support. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          App-V VersionSystem Center Configuration Manager 2007System Center 2012 Configuration ManagerSystem Center 2012 Configuration Manager SP1System Center 2012 R2 Configuration ManagerSystem Center 2012 R2 Configuration Manager SP1System Center 2012 Configuration Manager SP2System Center Configuration Manager Version 1511

          App-V 5.0 SP3

          MSI-Wrapper Only

          No

          2012 SP1 CU4

          2012 R2 CU1

          Yes

          Yes

          Yes

          App-V 5.1

          MSI-Wrapper Only

          No

          2012 SP1 CU4

          2012 R2 CU1

          Yes

          Yes

          Yes

          - - - -For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx). - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -[App-V 5.1 Prerequisites](app-v-51-prerequisites.md) - - - - - - - - - diff --git a/mdop/appv-v5/application-publishing-and-client-interaction.md b/mdop/appv-v5/application-publishing-and-client-interaction.md deleted file mode 100644 index 6623e796d2..0000000000 --- a/mdop/appv-v5/application-publishing-and-client-interaction.md +++ /dev/null @@ -1,1635 +0,0 @@ ---- -title: Application Publishing and Client Interaction -description: Application Publishing and Client Interaction -author: manikadhiman -ms.assetid: c69a724a-85d1-4e2d-94a2-7ffe0b47d971 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Publishing and Client Interaction - - -This article provides technical information about common App-V client operations and their integration with the local operating system. - -- [App-V package files created by the Sequencer](#bkmk-appv-pkg-files-list) - -- [What’s in the appv file?](#bkmk-appv-file-contents) - -- [App-V client data storage locations](#bkmk-files-data-storage) - -- [Package registry](#bkmk-pkg-registry) - -- [App-V package store behavior](#bkmk-pkg-store-behavior) - -- [Roaming registry and data](#bkmk-roaming-reg-data) - -- [App-V client application lifecycle management](#bkmk-clt-app-lifecycle) - -- [Integration of App-V packages](#bkmk-integr-appv-pkgs) - -- [Dynamic configuration processing](#bkmk-dynamic-config) - -- [Side-by-side assemblies](#bkmk-sidebyside-assemblies) - -- [Client logging](#bkmk-client-logging) - -For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](https://www.microsoft.com/download/details.aspx?id=27760). - -## App-V package files created by the Sequencer - - -The Sequencer creates App-V packages and produces a virtualized application. The sequencing process creates the following files: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FileDescription

          .appv

            -
          • The primary package file, which contains the captured assets and state information from the sequencing process.

          • -
          • Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.

          • -

          .MSI

          Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.

          _DeploymentConfig.XML

          File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.

          _UserConfig.XML

          File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.

          Report.xml

          Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.

          .CAB

          Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.

          .appvt

          Optional: Sequencer template file used to retain commonly reused Sequencer settings.

          - - - -For information about sequencing, see [Application Virtualization 5.0 Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760). - -## What’s in the appv file? - - -The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. - -To view the appv file contents, make a copy of the package, and then rename the copied file to a ZIP extension. - -The appv file contains the following folder and files, which are used when creating and publishing a virtual application: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameTypeDescription

          Root

          File folder

          Directory that contains the file system for the virtualized application that is captured during sequencing.

          [Content_Types].xml

          XML File

          List of the core content types in the appv file (e.g. DLL, EXE, BIN).

          AppxBlockMap.xml

          XML File

          Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.

          AppxManifest.xml

          XML File

          Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package.

          FilesystemMetadata.xml

          XML File

          List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names).

          PackageHistory.xml

          XML File

          Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version).

          Registry.dat

          DAT File

          Registry keys and values captured during the sequencing process for the package.

          StreamMap.xml

          XML File

          List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.

          - - - -## App-V client data storage locations - - -The App-V client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameLocationDescription

          Package Store

          %ProgramData%\App-V

          Default location for read only package files

          Machine Catalog

          %ProgramData%\Microsoft\AppV\Client\Catalog

          Contains per-machine configuration documents

          User Catalog

          %AppData%\Microsoft\AppV\Client\Catalog

          Contains per-user configuration documents

          Shortcut Backups

          %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups

          Stores previous integration points that enable restore on package unpublish

          Copy on Write (COW) Roaming

          %AppData%\Microsoft\AppV\Client\VFS

          Writeable roaming location for package modification

          Copy on Write (COW) Local

          %LocalAppData%\Microsoft\AppV\Client\VFS

          Writeable non-roaming location for package modification

          Machine Registry

          HKLM\Software\Microsoft\AppV

          Contains package state information, including VReg for machine or globally published packages (Machine hive)

          User Registry

          HKCU\Software\Microsoft\AppV

          Contains user package state information including VReg

          User Registry Classes

          HKCU\Software\Classes\AppV

          Contains additional user package state information

          - - - -Additional details for the table are provided in the section below and throughout the document. - -### Package store - -The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the `Set-AppVClientConfiguration` PowerShell command, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named for the Package GUID and Version GUID. - -Example of a path to a specific application: - -``` syntax -C:\ProgramData\App-V\PackGUID\VersionGUID -``` - -To change the default location of the package store during setup, see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md). - -### Shared Content Store - -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information on shared content store mode, see . - -**Note**   -The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. - - - -### Package catalogs - -The App-V Client manages the following two file-based locations: - -- **Catalogs (user and machine).** - -- **Registry locations** - depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  - -### Machine catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Description

          Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

          -

          If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location).

          -

          If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.

          Default storage location

          %programdata%\Microsoft\AppV\Client\Catalog</code>

          -

          This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.

          Files in the machine catalog

            -
          • Manifest.xml

          • -
          • DeploymentConfiguration.xml

          • -
          • UserManifest.xml (Globally Published Package)

          • -
          • UserDeploymentConfiguration.xml (Globally Published Package)

          • -

          Additional machine catalog location, used when the package is part of a connection group

          The following location is in addition to the specific package location mentioned above:

          -

          %programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID

          Additional files in the machine catalog when the package is part of a connection group

            -
          • PackageGroupDescriptor.xml

          • -
          • UserPackageGroupDescriptor.xml (globally published Connection Group)

          • -
          - - - -### User catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Description

          Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

          -

          When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

          -

          For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.

          Default storage location

          appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID

          Files in the user catalog

            -
          • UserManifest.xml

          • -
          • DynamicConfiguration.xml or UserDeploymentConfiguration.xml

          • -

          Additional user catalog location, used when the package is part of a connection group

          The following location is in addition to the specific package location mentioned above:

          -

          appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID

          Additional file in the machine catalog when the package is part of a connection group

          UserPackageGroupDescriptor.xml

          - - - -### Shortcut backups - -During the publishing process, the App-V Client backs up any shortcuts and integration points to `%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups.` This backup enables the restoration of these integration points to the previous versions when the package is unpublished. - -### Copy on Write files - -The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. These changes are not made in the package store in order to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. - -### COW roaming - -The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\{username}\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. - -### COW local - -The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (e.g. Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. - -## Package registry - - -Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. - -When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at `%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat`. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. - - ----- - - - - - - - -

          Registry.dat from Package Store

           > 

          %ProgramData%\Microsoft\AppV\Client\Vreg{VersionGuid}.dat

          - - - -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. - -### Package registry staging vs. connection group registry staging - -When connection groups are present, the previous process of staging the registry holds true, but instead of having one hive file to process, there are more than one. The files are processed in the order in which they appear in the connection group XML, with the first writer winning any conflicts. - -The staged registry persists the same way as in the single package case. Staged user registry data remains for the connection group until it is disabled; staged machine registry data is removed on connection group removal. - -### Virtual registry - -The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality – that is any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. - -### Registry locations - -There are two package registry locations and two connection group locations where the App-V Client stores registry information, depending on whether the Package is published individually or as part of a connection group. There are three COW locations for packages and three for connection groups, which are created and managed by the VREG. Settings for packages and connection groups are not shared: - -**Single Package VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

          Location

          Description

          COW

            -
          • Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)

          • -
          • User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes

          • -
          • User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)

          • -

          Package

            -
          • Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine

          • -
          • User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry

          • -

          Native

            -
          • Native application registry location

          • -
          - - - - - -**Connection Group VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

          Location

          Description

          COW

            -
          • Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)

          • -
          • User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes

          • -
          • User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY

          • -

          Package

            -
          • Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

          • -
          • User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

          • -

          Native

            -
          • Native application registry location

          • -
          - - - - - -There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. - -### Pass-through keys - -Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key `HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry`. Any key that appears under this multi-string value (and their children) will be treated as pass-through. - -The following locations are configured as pass-through locations by default: - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies - -The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI based applications. It is recommend that administers do not modify any of the default pass-through keys, but in some instances, based on application behavior may require adding additional pass-through keys. - -## App-V package store behavior - - -App-V 5 manages the Package Store, which is the location where the expanded asset files from the appv file are stored. By default, this location is stored at %ProgramData%\\App-V, and is limited in terms of storage capabilities only by free disk space. The package store is organized by the GUIDs for the package and version as mentioned in the previous section. - -### Add packages - -App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. During publishing or a manual Add-AppVClientPackage, the data structure is built in the package store (c:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml are added to the system and the top level folders and child files staged to ensure proper application assets exist at launch. - -### Mounting packages - -Packages can be explicitly loaded using the PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. - -### Streaming packages - -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MAcHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PolicyDescription

          AllowHighCostLaunch

          On Windows 8 it allows streaming over 3G and cellular networks

          AutoLoad

          Specifies the Background Load setting:

          -

          0 - Disabled

          -

          1 – Previously Used Packages only

          -

          2 – All Packages

          PackageInstallationRoot

          The root folder for the package store in the local machine

          PackageSourceRoot

          The root override where packages should be streamed from

          SharedContentStoreMode

          Enables the use of Shared Content Store for VDI scenarios

          - - - - - -These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained: - -- Background Streaming - -- Optimized Streaming - -- Stream Faults - -### Background streaming - -The PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. - -### Optimized streaming - -App-V packages can be configured with a primary feature block during sequencing. This setting allows the sequencing engineer to monitor launch files for a specific application, or applications, and mark the blocks of data in the App-V package for streaming at first launch of any application in the package. - -### Stream faults - -After the initial stream of any publishing data and the primary feature block, requests for additional files perform stream faults. These blocks of data are downloaded to the package store on an as-needed basis. This allows a user to download only a small part of the package, typically enough to launch the package and run normal tasks. All other blocks are downloaded when a user initiates an operation that requires data not currently in the package store. - -For more information on App-V Package streaming visit: . - -Sequencing for streaming optimization is available at: . - -### Package upgrades - -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: `%ProgramData%\App-V\{PkgGUID}\{newVerGUID}`. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. - -### Package removal - -The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. - -## Roaming registry and data - - -App-V 5 is able to provide a near-native experience when roaming, depending on how the application being used is written. By default, App-V roams AppData that is stored in the roaming location, based on the roaming configuration of the operating system. Other locations for storage of file-based data do not roam from computer to computer, since they are in locations that are not roamed. - -### Roaming requirements and user catalog data storage - -App-V stores data, which represents the state of the user’s catalog, in the form of: - -- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog - -- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` - -Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. - -**Note**   -The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. - - - -### Registry-based data - -App-V registry roaming falls into two scenarios, as shown in the following table. - - ---- - - - - - - - - - - - - - - - - -
          ScenarioDescription

          Applications that are run as standard users

          When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

          -
            -
          • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

          • -
          • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\REGISTRY\USER{UserSID}\SOFTWARE

          • -
          -

          The locations are enabled for roaming based on the operating system settings.

          Applications that are run with elevation

          When an application is launched with elevation:

          -
            -
          • HKLM data is stored in the HKLM hive on the local computer

          • -
          • HKCU data is stored in the User Registry location

          • -
          -

          In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:

          -
            -
          • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}{UserSID}\REGISTRY\MACHINE\SOFTWARE

          • -
          • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\Registry\User{UserSID}\SOFTWARE

          • -
          - - - -### App-V and folder redirection - -App-V 5.0 SP2 supports folder redirection of the roaming AppData folder (%AppData%). When the virtual environment is started, the roaming AppData state from the user’s roaming AppData directory is copied to the local cache. Conversely, when the virtual environment is shut down, the local cache that is associated with a specific user’s roaming AppData is transferred to the actual location of that user’s roaming AppData directory. - -A typical package has several locations mapped in the user’s backing store for settings in both AppData\\Local and AppData\\Roaming. These locations are the Copy on Write locations that are stored per user in the user’s profile, and that are used to store changes made to the package VFS directories and to protect the default package VFS. - -The following table shows local and roaming locations, when folder redirection has not been implemented. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          VFS directory in packageMapped location of backing store

          ProgramFilesX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

          SystemX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

          Windows

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

          appv_ROOT

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

          AppData

          C:\users\jsmith\AppData<strong>Roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

          - - - - - -The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          VFS directory in packageMapped location of backing store

          ProgramFilesX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

          SystemX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

          Windows

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

          appv_ROOT

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

          AppData

          \Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

          - - - - - -The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: - -1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. - -2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. - -3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. - -This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: - -1. App-V application is shut down, which shuts down the virtual environment. - -2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. - -3. A timestamp at the end of the ZIP packaging process is used to name the file. - -4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. - -5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. - -The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: - -1. The user starts the virtual environment by starting an application. - -2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. - -3. The registry is checked for the last known uploaded timestamp, if present. - -4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. - -5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. - -6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. - -7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. - -This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: - -1. During repair, detect if the path to the user’s roaming AppData directory is not local. - -2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. - -3. Delete the timestamp stored in the registry, if present. - -This process will re-create both the local and network locations for AppData and remove the registry record of the timestamp. - -## App-V client application lifecycle management - - -In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of PowerShell commands initiated on the computer running the App-V Client. - -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012 visit: . - -The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See the How to Deploy the Client section on TechNet at: [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) or utilize the PowerShell: - -```powershell -get-command *appv* -``` - -### Publishing refresh - -The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following PowerShell cmdlets: - -- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. - -- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. - -- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. - -- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. - -The focus of the following sections is to detail the operations that occur during different phases of an App-V Publishing Refresh. The topics include: - -- Adding an App-V Package - -- Publishing an App-V Package - -### Adding an App-V package - -Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. - -**How to add an App-V package** - -1. Manual initiation via PowerShell or Task Sequence initiation of the Publishing Refresh process. - - 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. - - 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. - -2. The Publishing Agent on the App-V Client performs all actions below serialized. - - Evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. - -3. Configure the packages by identifying an Add or Update operations. - - 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. - - 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. - - 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. - - - Icons: Targets of extension points. - - - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. - - - Scripts: Download scripts directory for use throughout the publishing process. - - 4. Populate the Package store: - - 1. Create sparse files on disk that represent the extracted package for any directories listed. - - 2. Stage top level files and directories under root. - - 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. - - 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). - - 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog - - 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat - - 8. Register the package with the App-V Kernel Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV - - 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. - -4. Configure Connection Groups by adding and enabling or disabling. - -5. Remove objects that are not published to the target (user or machine). - - **Note**   - This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). - - - -6. Invoke background load mounting based on client configuration. - -7. Packages that already have publishing information for the machine or user are immediately restored. - - **Note**   - This condition occurs as a product of removal without unpublishing with background addition of the package. - - - -This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). - -![package add file and registry data](images/packageaddfileandregistrydata.png) - -### Publishing an App-V package - -During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. - -**How to publish and App-V package** - -1. Package entries are added to the user catalog - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog - -2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -3. Perform integration tasks. - - 1. Create extension points. - - 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). - - **Note**   - This enables restore extension points if the package is unpublished. - - - - 3. Run scripts targeted for publishing timing. - -Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information above for details. - -![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) - -### Application launch - -After the Publishing Refresh process, the user launches and subsequently re-launches an App-V application. The process is very simple and optimized to launch quickly with a minimum of network traffic. The App-V Client checks the path to the user catalog for files created during publishing. After rights to launch the package are established, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. With the virtual environment created and configured for the specific package and application, the application starts. - -**How to launch App-V applications** - -1. User launches the application by clicking on a shortcut or file type invocation. - -2. The App-V Client verifies existence in the User Catalog for the following files - - - UserDeploymentConfiguration.xml - - - UserManifest.xml - -3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. - -4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. - -5. Upon finding the path to the package store, the virtual environment is created. If this is the first launch, the Primary Feature Block downloads if present. - -6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. - -7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. - - ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) - -### Upgrading an App-V package - -The App-V 5 package upgrade process differs from the older versions of App-V. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only the new files are added to the new version store location and hard links are created for unchanged files. This reduces the overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. The specific details of upgrading an App-V Package are as follows: - -**How to upgrade an App-V package** - -1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. - -2. Package entries are added to the appropriate catalog for the new version - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - -3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -4. Perform integration tasks. - - - Integrate extensions points (EP) from the Manifest and Dynamic Configuration files. - - 1. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. - - 2. Version 1 EPs already exist when a new version becomes available. - - 3. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. - -5. Run scripts targeted for publishing timing. - -6. Install Side by Side assemblies as required. - -### Upgrading an in-use App-V package - -**Starting in App-V 5 SP2**: If you try to upgrade a package that is in use by an end user, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
          Task typeApplicable rule

          User-based task, e.g., publishing a package to a user

          The pending task will be performed after the user logs off and then logs back on.

          Globally based task, e.g., enabling a connection group globally

          The pending task will be performed when the computer is shut down and then restarted.

          - - - -When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: - - ---- - - - - - - - - - - - - - - - - -
          User-based or globally based taskWhere the registry key is generated

          User-based tasks

          KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks

          Globally based tasks

          HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks

          - - - -The following operations must be completed before users can use the newer version of the package: - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Add the package to the computer

          This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above.

          Publish the package

          See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task.

          - - - -Use the following example scenarios as a guide for updating packages. - - ---- - - - - - - - - - - - - - - - - -
          ScenarioRequirements

          App-V package is not in use when you try to upgrade

          None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

          -

          The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and run. Nothing has changed in this scenario in App-V 5 SP2 from previous releases of App-V 5.

          App-V package is in use when the administrator publishes a newer version of the package

          The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use.

          -

          If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

          -

          If the package has shell extensions (Office 2013), which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade.

          - - - -### Global vs user publishing - -App-V Packages can be published in one of two ways; User which entitles an App-V package to a specific user or group of users and Global which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: - -- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. - -- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via PowerShell commands). - -### Removing an App-V package - -Removing App-V applications in a Full Infrastructure is an unpublish operation, and does not perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. - -### Repairing an App-V package - -The repair operation is very simple but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are de-integrated and then re-integrated. Please review the COW data placement locations by reviewing where they are registered in the registry. This operation is done automatically and there is no administrative control other than initiating a Repair operation from the App-V Client Console or via PowerShell (Repair-AppVClientPackage). - -## Integration of App-V packages - - -The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: - -- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. - -- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. - -- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. - -### Rules of integration - -When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the list below: - -- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. - -- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. - -- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. - - 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. - - 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. - - 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. - -### Extension points - -The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: - -- Shortcuts - -- File Type Associations - -- Shell Extensions - -- COM - -- Software Clients - -- Application capabilities - -- URL Protocol Handler - -- AppPath - -- Virtual Application - -### Shortcuts - -The short cut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. - -From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: - -```xml - - - [{Common Desktop}]\Adobe Reader 9.lnk - [{AppVPackageRoot}]\Reader\AcroRd32.exe - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\SC_Reader.ico - - - 1 - [{AppVPackageRoot}]\Reader\AcroRd32.exe - - -``` - -As mentioned previously, the App-V shortcuts are placed by default in the user’s profile based on the refresh operation. Global refresh places shortcuts in the All Users profile and user refresh stores them in the specific user’s profile. The actual executable is stored in the Package Store. The location of the ICO file is a tokenized location in the App-V package. - -### File type associations - -The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below: - -```xml - - - - .xdp - AcroExch.XDPDoc - application/vnd.adobe.xdp+xml - - - AcroExch.XDPDoc - Adobe Acrobat XML Data Package File - 65536 - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\XDPFile_8.ico - - Read - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Open - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Printto - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" /t "%1" "%2" "%3" "%4" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Read - Open with Adobe Reader 9 - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - - - -``` - -**Note**   -In this example: - -- `.xdp` is the extension - -- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) - -- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable - - - -### Shell extensions - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published globally, the shell extension gives users the same functionality as if the application were locally installed. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table displays the supported shell extensions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          HandlerDescription

          Context menu handler

          Adds menu items to the context menu. It is called before the context menu is displayed.

          Drag-and-drop handler

          Controls the action upon right-click drag-and-drop and modifies the context menu that appears.

          Drop target handler

          Controls the action after a data object is dragged-and-dropped over a drop target such as a file.

          Data object handler

          Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target.

          Property sheet handler

          Replaces or adds pages to the property sheet dialog box of an object.

          Infotip handler

          Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover.

          Column handler

          Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

          Preview handler

          Enables a preview of a file to be displayed in the Windows Explorer Preview Pane.

          - - - -### COM - -The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. - -App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). - -Details on App-V integration are available at: . - -### Software clients and application capabilities - -App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and media player. This operation is performed in the control panel with the Set Program Access and Computer Defaults, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. - -Example of software client registration of an App-V based mail client. - -```xml - - - - - - - Mozilla Thunderbird - Mozilla Thunderbird - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /SetAsDefaultAppGlobal - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /HideShortcuts - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /ShowShortcuts - - 1 - - - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -mail - - [{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll - - Thunderbird URL - 2 - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -osint -compose "%1" - - - - - - - -``` - -**Note**   -In this example: - -- `` is the overall Software Clients setting to integrate Email clients - -- `` is the flag to set a particular Email client as the default Email client - -- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration - - - -### URL Protocol handler - -Applications do not always specifically called virtualized applications utilizing file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user clicks on a mailto: link and expects to get their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL protocol handlers are automatically added to the package. - -For situations where there is more than one application that could register the specific URL Protocol handler, the dynamic configuration files can be utilized to modify the behavior and suppress or disable this feature for an application that should not be the primary application launched. - -### AppPath - -The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. - -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: . - -### Virtual application - -This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, it is possible to disable all extension points belonging to one application, in order to allow only integration of extension points of other application. - -### Extension point rules - -The extension points described above are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). - -Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Virtual ExtensionRequires target OS SequencingRequires Global Publishing

          Shortcut

          File Type Association

          URL Protocols

          X

          AppPaths

          X

          COM Mode

          Software Client

          X

          Application Capabilities

          X

          X

          Context Menu Handler

          X

          X

          Drag-and-drop Handler

          X

          Data Object Handler

          X

          Property Sheet Handler

          X

          Infotip Handler

          X

          Column Handler

          X

          Shell Extensions

          X

          Browser Helper Object

          X

          X

          Active X Object

          X

          X

          - - - -## Dynamic configuration processing - - -Deploying App-V packages to one machine or user is very simple. However, as organizations deploy AppV applications across business lines and geographic and political boundaries, the ability to sequence an application one time with one set of settings becomes impossible. App-V was designed for this scenario, as it captures specific settings and configurations during sequencing in the Manifest file, but also supports modification with Dynamic Configuration files. - -App-V dynamic configuration allows for specifying a policy for a package either at the machine level or at the user level. The Dynamic Configuration files enable sequencing engineers to modify the configuration of a package, post-sequencing, to address the needs of individual groups of users or machines. In some instances it may be necessary to make modifications to the application to provide proper functionality within the App-V environment. For example, it may be necessary to make modifications to the \_\*config.xml files to allow certain actions to be performed at a specified time during the execution of the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. - -App-V Packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow the publishing of an application to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. - -### Example for dynamic configuration files - -The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information review the App-V 5 Sequencing Guide at: - -**Manifest** - -```xml - - - [{Common Programs}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - -``` - -**Deployment Configuration** - -```xml - - - - - - - - - - -``` - -**User Configuration** - -```xml - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - - - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM.exe.O.ico - - - [{Common Programs}]\7-Zip\7-Zip File Manager.Ink - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot)]\7zFM.exe.O.ico - - - - - - - - - - - - -``` - -## Side-by-side assemblies - - -App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V 5 SP2 supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The Side by Side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. - -Side by Side Assembly support in App-V has the following features. - -- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. - -- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. - -- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. - -- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. - -### Automatic publishing of SxS assemblies - -During publishing of an App-V package with SxS assemblies the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the Side by Side assembly installations that are part of the base packages, as the connection group does not contain any information about assembly installation. - -**Note**   -UnPublishing or removing a package with an assembly does not remove the assemblies for that package. - - - -## Client logging - - -The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer, under Applications and Services Logs\\Microsoft\\AppV\\Client. - -**Note**   -In App-V 5.0 SP3, some logs have been consolidated and moved to the following location: - -`Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog` - -For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - - - -There are three specific categories of events recorded described below. - -**Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. - -**Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. - -**Virtual Application**: Logs virtual application launches and use of virtualization subsystems. - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/application-publishing-and-client-interaction51.md b/mdop/appv-v5/application-publishing-and-client-interaction51.md deleted file mode 100644 index 257cbe8a43..0000000000 --- a/mdop/appv-v5/application-publishing-and-client-interaction51.md +++ /dev/null @@ -1,1635 +0,0 @@ ---- -title: Application Publishing and Client Interaction -description: Application Publishing and Client Interaction -author: manikadhiman -ms.assetid: 36a4bf6f-a917-41a6-9856-6248686df352 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Publishing and Client Interaction - - -This article provides technical information about common App-V client operations and their integration with the local operating system. - -- [App-V package files created by the Sequencer](#bkmk-appv-pkg-files-list) - -- [What’s in the appv file?](#bkmk-appv-file-contents) - -- [App-V client data storage locations](#bkmk-files-data-storage) - -- [Package registry](#bkmk-pkg-registry) - -- [App-V package store behavior](#bkmk-pkg-store-behavior) - -- [Roaming registry and data](#bkmk-roaming-reg-data) - -- [App-V client application lifecycle management](#bkmk-clt-app-lifecycle) - -- [Integration of App-V packages](#bkmk-integr-appv-pkgs) - -- [Dynamic configuration processing](#bkmk-dynamic-config) - -- [Side-by-side assemblies](#bkmk-sidebyside-assemblies) - -- [Client logging](#bkmk-client-logging) - -For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](https://www.microsoft.com/download/details.aspx?id=27760). - -## App-V package files created by the Sequencer - - -The Sequencer creates App-V packages and produces a virtualized application. The sequencing process creates the following files: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FileDescription

          .appv

            -
          • The primary package file, which contains the captured assets and state information from the sequencing process.

          • -
          • Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.

          • -

          .MSI

          Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.

          _DeploymentConfig.XML

          File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.

          _UserConfig.XML

          File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.

          Report.xml

          Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.

          .CAB

          Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.

          .appvt

          Optional: Sequencer template file used to retain commonly reused Sequencer settings.

          - - - -For information about sequencing, see [Application Virtualization Sequencing Guide](https://go.microsoft.com/fwlink/?LinkID=269810). - -## What’s in the appv file? - - -The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. - -To view the appv file contents, make a copy of the package, and then rename the copied file to a ZIP extension. - -The appv file contains the following folder and files, which are used when creating and publishing a virtual application: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameTypeDescription

          Root

          File folder

          Directory that contains the file system for the virtualized application that is captured during sequencing.

          [Content_Types].xml

          XML File

          List of the core content types in the appv file (e.g. DLL, EXE, BIN).

          AppxBlockMap.xml

          XML File

          Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.

          AppxManifest.xml

          XML File

          Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package.

          FilesystemMetadata.xml

          XML File

          List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names).

          PackageHistory.xml

          XML File

          Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version).

          Registry.dat

          DAT File

          Registry keys and values captured during the sequencing process for the package.

          StreamMap.xml

          XML File

          List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.

          - - - -## App-V client data storage locations - - -The App-V client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameLocationDescription

          Package Store

          %ProgramData%\App-V

          Default location for read only package files

          Machine Catalog

          %ProgramData%\Microsoft\AppV\Client\Catalog

          Contains per-machine configuration documents

          User Catalog

          %AppData%\Microsoft\AppV\Client\Catalog

          Contains per-user configuration documents

          Shortcut Backups

          %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups

          Stores previous integration points that enable restore on package unpublish

          Copy on Write (COW) Roaming

          %AppData%\Microsoft\AppV\Client\VFS

          Writeable roaming location for package modification

          Copy on Write (COW) Local

          %LocalAppData%\Microsoft\AppV\Client\VFS

          Writeable non-roaming location for package modification

          Machine Registry

          HKLM\Software\Microsoft\AppV

          Contains package state information, including VReg for machine or globally published packages (Machine hive)

          User Registry

          HKCU\Software\Microsoft\AppV

          Contains user package state information including VReg

          User Registry Classes

          HKCU\Software\Classes\AppV

          Contains additional user package state information

          - - - -Additional details for the table are provided in the section below and throughout the document. - -### Package store - -The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the `Set-AppVClientConfiguration` PowerShell command, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named for the Package GUID and Version GUID. - -Example of a path to a specific application: - -``` syntax -C:\ProgramData\App-V\PackGUID\VersionGUID -``` - -To change the default location of the package store during setup, see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md). - -### Shared Content Store - -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information on shared content store mode, see . - -**Note**   -The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. - - - -### Package catalogs - -The App-V Client manages the following two file-based locations: - -- **Catalogs (user and machine).** - -- **Registry locations** - depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  - -### Machine catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Description

          Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

          -

          If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location).

          -

          If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.

          Default storage location

          %programdata%\Microsoft\AppV\Client\Catalog</code>

          -

          This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.

          Files in the machine catalog

            -
          • Manifest.xml

          • -
          • DeploymentConfiguration.xml

          • -
          • UserManifest.xml (Globally Published Package)

          • -
          • UserDeploymentConfiguration.xml (Globally Published Package)

          • -

          Additional machine catalog location, used when the package is part of a connection group

          The following location is in addition to the specific package location mentioned above:

          -

          %programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID

          Additional files in the machine catalog when the package is part of a connection group

            -
          • PackageGroupDescriptor.xml

          • -
          • UserPackageGroupDescriptor.xml (globally published Connection Group)

          • -
          - - - -### User catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Description

          Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

          -

          When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

          -

          For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.

          Default storage location

          appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID

          Files in the user catalog

            -
          • UserManifest.xml

          • -
          • DynamicConfiguration.xml or UserDeploymentConfiguration.xml

          • -

          Additional user catalog location, used when the package is part of a connection group

          The following location is in addition to the specific package location mentioned above:

          -

          appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID

          Additional file in the machine catalog when the package is part of a connection group

          UserPackageGroupDescriptor.xml

          - - - -### Shortcut backups - -During the publishing process, the App-V Client backs up any shortcuts and integration points to `%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups.` This backup enables the restoration of these integration points to the previous versions when the package is unpublished. - -### Copy on Write files - -The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. These changes are not made in the package store in order to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. - -### COW roaming - -The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\{username}\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. - -### COW local - -The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (e.g. Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. - -## Package registry - - -Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. - -When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at `%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat`. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. - - ----- - - - - - - - -

          Registry.dat from Package Store

           > 

          %ProgramData%\Microsoft\AppV\Client\Vreg{VersionGuid}.dat

          - - - -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. - -### Package registry staging vs. connection group registry staging - -When connection groups are present, the previous process of staging the registry holds true, but instead of having one hive file to process, there are more than one. The files are processed in the order in which they appear in the connection group XML, with the first writer winning any conflicts. - -The staged registry persists the same way as in the single package case. Staged user registry data remains for the connection group until it is disabled; staged machine registry data is removed on connection group removal. - -### Virtual registry - -The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality – that is any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. - -### Registry locations - -There are two package registry locations and two connection group locations where the App-V Client stores registry information, depending on whether the Package is published individually or as part of a connection group. There are three COW locations for packages and three for connection groups, which are created and managed by the VREG. Settings for packages and connection groups are not shared: - -**Single Package VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

          Location

          Description

          COW

            -
          • Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)

          • -
          • User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes

          • -
          • User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)

          • -

          Package

            -
          • Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine

          • -
          • User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry

          • -

          Native

            -
          • Native application registry location

          • -
          - - - - - -**Connection Group VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

          Location

          Description

          COW

            -
          • Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)

          • -
          • User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes

          • -
          • User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY

          • -

          Package

            -
          • Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

          • -
          • User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

          • -

          Native

            -
          • Native application registry location

          • -
          - - - - - -There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. - -### Pass-through keys - -Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key `HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry`. Any key that appears under this multi-string value (and their children) will be treated as pass-through. - -The following locations are configured as pass-through locations by default: - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies - -The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI based applications. It is recommend that administers do not modify any of the default pass-through keys, but in some instances, based on application behavior may require adding additional pass-through keys. - -## App-V package store behavior - - -App-V 5 manages the Package Store, which is the location where the expanded asset files from the appv file are stored. By default, this location is stored at %ProgramData%\\App-V, and is limited in terms of storage capabilities only by free disk space. The package store is organized by the GUIDs for the package and version as mentioned in the previous section. - -### Add packages - -App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. During publishing or a manual Add-AppVClientPackage, the data structure is built in the package store (c:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml are added to the system and the top level folders and child files staged to ensure proper application assets exist at launch. - -### Mounting packages - -Packages can be explicitly loaded using the PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. - -### Streaming packages - -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MAcHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PolicyDescription

          AllowHighCostLaunch

          On Windows 8 and later, it allows streaming over 3G and cellular networks

          AutoLoad

          Specifies the Background Load setting:

          -

          0 - Disabled

          -

          1 – Previously Used Packages only

          -

          2 – All Packages

          PackageInstallationRoot

          The root folder for the package store in the local machine

          PackageSourceRoot

          The root override where packages should be streamed from

          SharedContentStoreMode

          Enables the use of Shared Content Store for VDI scenarios

          - - - - - -These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained: - -- Background Streaming - -- Optimized Streaming - -- Stream Faults - -### Background streaming - -The PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. - -### Optimized streaming - -App-V packages can be configured with a primary feature block during sequencing. This setting allows the sequencing engineer to monitor launch files for a specific application, or applications, and mark the blocks of data in the App-V package for streaming at first launch of any application in the package. - -### Stream faults - -After the initial stream of any publishing data and the primary feature block, requests for additional files perform stream faults. These blocks of data are downloaded to the package store on an as-needed basis. This allows a user to download only a small part of the package, typically enough to launch the package and run normal tasks. All other blocks are downloaded when a user initiates an operation that requires data not currently in the package store. - -For more information on App-V Package streaming visit: . - -Sequencing for streaming optimization is available at: . - -### Package upgrades - -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: `%ProgramData%\App-V\{PkgGUID}\{newVerGUID}`. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. - -### Package removal - -The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. - -## Roaming registry and data - - -App-V 5 is able to provide a near-native experience when roaming, depending on how the application being used is written. By default, App-V roams AppData that is stored in the roaming location, based on the roaming configuration of the operating system. Other locations for storage of file-based data do not roam from computer to computer, since they are in locations that are not roamed. - -### Roaming requirements and user catalog data storage - -App-V stores data, which represents the state of the user’s catalog, in the form of: - -- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog - -- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` - -Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. - -**Note**   -The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. - - - -### Registry-based data - -App-V registry roaming falls into two scenarios, as shown in the following table. - - ---- - - - - - - - - - - - - - - - - -
          ScenarioDescription

          Applications that are run as standard users

          When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

          -
            -
          • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

          • -
          • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\REGISTRY\USER{UserSID}\SOFTWARE

          • -
          -

          The locations are enabled for roaming based on the operating system settings.

          Applications that are run with elevation

          When an application is launched with elevation:

          -
            -
          • HKLM data is stored in the HKLM hive on the local computer

          • -
          • HKCU data is stored in the User Registry location

          • -
          -

          In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:

          -
            -
          • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}{UserSID}\REGISTRY\MACHINE\SOFTWARE

          • -
          • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\Registry\User{UserSID}\SOFTWARE

          • -
          - - - -### App-V and folder redirection - -App-V 5.1 supports folder redirection of the roaming AppData folder (%AppData%). When the virtual environment is started, the roaming AppData state from the user’s roaming AppData directory is copied to the local cache. Conversely, when the virtual environment is shut down, the local cache that is associated with a specific user’s roaming AppData is transferred to the actual location of that user’s roaming AppData directory. - -A typical package has several locations mapped in the user’s backing store for settings in both AppData\\Local and AppData\\Roaming. These locations are the Copy on Write locations that are stored per user in the user’s profile, and that are used to store changes made to the package VFS directories and to protect the default package VFS. - -The following table shows local and roaming locations, when folder redirection has not been implemented. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          VFS directory in packageMapped location of backing store

          ProgramFilesX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

          SystemX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

          Windows

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

          appv_ROOT

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

          AppData

          C:\users\jsmith\AppData<strong>Roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

          - - - - - -The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          VFS directory in packageMapped location of backing store

          ProgramFilesX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

          SystemX86

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

          Windows

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

          appv_ROOT

          C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

          AppData

          \Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

          - - - - - -The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: - -1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. - -2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. - -3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. - -This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: - -1. App-V application is shut down, which shuts down the virtual environment. - -2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. - -3. A timestamp at the end of the ZIP packaging process is used to name the file. - -4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. - -5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. - -The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: - -1. The user starts the virtual environment by starting an application. - -2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. - -3. The registry is checked for the last known uploaded timestamp, if present. - -4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. - -5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. - -6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. - -7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. - -This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: - -1. During repair, detect if the path to the user’s roaming AppData directory is not local. - -2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. - -3. Delete the timestamp stored in the registry, if present. - -This process will re-create both the local and network locations for AppData and remove the registry record of the timestamp. - -## App-V client application lifecycle management - - -In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of PowerShell commands initiated on the computer running the App-V Client. - -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012 visit: . - -The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See the How to Deploy the Client section on TechNet at: [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) or utilize the PowerShell: - -```powershell -get-command *appv* -``` - -### Publishing refresh - -The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following PowerShell cmdlets: - -- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. - -- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. - -- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. - -- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. - -The focus of the following sections is to detail the operations that occur during different phases of an App-V Publishing Refresh. The topics include: - -- Adding an App-V Package - -- Publishing an App-V Package - -### Adding an App-V package - -Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. - -**How to add an App-V package** - -1. Manual initiation via PowerShell or Task Sequence initiation of the Publishing Refresh process. - - 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. - - 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. - -2. The Publishing Agent on the App-V Client performs all actions below serialized. - - Evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. - -3. Configure the packages by identifying an Add or Update operations. - - 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. - - 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. - - 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. - - - Icons: Targets of extension points. - - - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. - - - Scripts: Download scripts directory for use throughout the publishing process. - - 4. Populate the Package store: - - 1. Create sparse files on disk that represent the extracted package for any directories listed. - - 2. Stage top level files and directories under root. - - 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. - - 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). - - 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog - - 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat - - 8. Register the package with the App-V Kernel Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV - - 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. - -4. Configure Connection Groups by adding and enabling or disabling. - -5. Remove objects that are not published to the target (user or machine). - - **Note**   - This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). - - - -6. Invoke background load mounting based on client configuration. - -7. Packages that already have publishing information for the machine or user are immediately restored. - - **Note**   - This condition occurs as a product of removal without unpublishing with background addition of the package. - - - -This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). - -![package add file and registry data](images/packageaddfileandregistrydata.png) - -### Publishing an App-V package - -During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. - -**How to publish and App-V package** - -1. Package entries are added to the user catalog - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog - -2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -3. Perform integration tasks. - - 1. Create extension points. - - 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). - - **Note**   - This enables restore extension points if the package is unpublished. - - - - 3. Run scripts targeted for publishing timing. - -Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information above for details. - -![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) - -### Application launch - -After the Publishing Refresh process, the user launches and subsequently re-launches an App-V application. The process is very simple and optimized to launch quickly with a minimum of network traffic. The App-V Client checks the path to the user catalog for files created during publishing. After rights to launch the package are established, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. With the virtual environment created and configured for the specific package and application, the application starts. - -**How to launch App-V applications** - -1. User launches the application by clicking on a shortcut or file type invocation. - -2. The App-V Client verifies existence in the User Catalog for the following files - - - UserDeploymentConfiguration.xml - - - UserManifest.xml - -3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. - -4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. - -5. Upon finding the path to the package store, the virtual environment is created. If this is the first launch, the Primary Feature Block downloads if present. - -6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. - -7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. - - ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) - -### Upgrading an App-V package - -The App-V 5 package upgrade process differs from the older versions of App-V. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only the new files are added to the new version store location and hard links are created for unchanged files. This reduces the overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. The specific details of upgrading an App-V Package are as follows: - -**How to upgrade an App-V package** - -1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. - -2. Package entries are added to the appropriate catalog for the new version - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - -3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -4. Perform integration tasks. - - - Integrate extensions points (EP) from the Manifest and Dynamic Configuration files. - - 1. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. - - 2. Version 1 EPs already exist when a new version becomes available. - - 3. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. - -5. Run scripts targeted for publishing timing. - -6. Install Side by Side assemblies as required. - -### Upgrading an in-use App-V package - -**Starting in App-V 5 SP2**: If you try to upgrade a package that is in use by an end user, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
          Task typeApplicable rule

          User-based task, e.g., publishing a package to a user

          The pending task will be performed after the user logs off and then logs back on.

          Globally based task, e.g., enabling a connection group globally

          The pending task will be performed when the computer is shut down and then restarted.

          - - - -When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: - - ---- - - - - - - - - - - - - - - - - -
          User-based or globally based taskWhere the registry key is generated

          User-based tasks

          KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks

          Globally based tasks

          HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks

          - - - -The following operations must be completed before users can use the newer version of the package: - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Add the package to the computer

          This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above.

          Publish the package

          See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task.

          - - - -Use the following example scenarios as a guide for updating packages. - - ---- - - - - - - - - - - - - - - - - -
          ScenarioRequirements

          App-V package is not in use when you try to upgrade

          None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

          -

          The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and run. Nothing has changed in this scenario in App-V 5 SP2 from previous releases of App-V 5.

          App-V package is in use when the administrator publishes a newer version of the package

          The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use.

          -

          If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

          -

          If the package has shell extensions (Office 2013), which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade.

          - - - -### Global vs user publishing - -App-V Packages can be published in one of two ways; User which entitles an App-V package to a specific user or group of users and Global which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: - -- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. - -- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via PowerShell commands). - -### Removing an App-V package - -Removing App-V applications in a Full Infrastructure is an unpublish operation, and does not perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. - -### Repairing an App-V package - -The repair operation is very simple but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are de-integrated and then re-integrated. Please review the COW data placement locations by reviewing where they are registered in the registry. This operation is done automatically and there is no administrative control other than initiating a Repair operation from the App-V Client Console or via PowerShell (Repair-AppVClientPackage). - -## Integration of App-V packages - - -The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: - -- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. - -- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. - -- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. - -### Rules of integration - -When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the list below: - -- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. - -- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. - -- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. - - 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. - - 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. - - 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. - -### Extension points - -The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: - -- Shortcuts - -- File Type Associations - -- Shell Extensions - -- COM - -- Software Clients - -- Application capabilities - -- URL Protocol Handler - -- AppPath - -- Virtual Application - -### Shortcuts - -The short cut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. - -From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: - -```xml - - - [{Common Desktop}]\Adobe Reader 9.lnk - [{AppVPackageRoot}]\Reader\AcroRd32.exe - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\SC_Reader.ico - - - 1 - [{AppVPackageRoot}]\Reader\AcroRd32.exe - - -``` - -As mentioned previously, the App-V shortcuts are placed by default in the user’s profile based on the refresh operation. Global refresh places shortcuts in the All Users profile and user refresh stores them in the specific user’s profile. The actual executable is stored in the Package Store. The location of the ICO file is a tokenized location in the App-V package. - -### File type associations - -The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below: - -```xml - - - - .xdp - AcroExch.XDPDoc - application/vnd.adobe.xdp+xml - - - AcroExch.XDPDoc - Adobe Acrobat XML Data Package File - 65536 - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\XDPFile_8.ico - - Read - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Open - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Printto - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" /t "%1" "%2" "%3" "%4" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Read - Open with Adobe Reader 9 - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - - - -``` - -**Note**   -In this example: - -- `.xdp` is the extension - -- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) - -- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable - - - -### Shell extensions - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published globally, the shell extension gives users the same functionality as if the application were locally installed. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table displays the supported shell extensions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          HandlerDescription

          Context menu handler

          Adds menu items to the context menu. It is called before the context menu is displayed.

          Drag-and-drop handler

          Controls the action upon right-click drag-and-drop and modifies the context menu that appears.

          Drop target handler

          Controls the action after a data object is dragged-and-dropped over a drop target such as a file.

          Data object handler

          Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target.

          Property sheet handler

          Replaces or adds pages to the property sheet dialog box of an object.

          Infotip handler

          Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover.

          Column handler

          Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

          Preview handler

          Enables a preview of a file to be displayed in the Windows Explorer Preview Pane.

          - - - -### COM - -The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. - -App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). - -Details on App-V integration are available at: . - -### Software clients and application capabilities - -App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and media player. This operation is performed in the control panel with the Set Program Access and Computer Defaults, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. - -Example of software client registration of an App-V based mail client. - -```xml - - - - - - - Mozilla Thunderbird - Mozilla Thunderbird - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /SetAsDefaultAppGlobal - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /HideShortcuts - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /ShowShortcuts - - 1 - - - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -mail - - [{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll - - Thunderbird URL - 2 - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -osint -compose "%1" - - - - - - - -``` - -**Note**   -In this example: - -- `` is the overall Software Clients setting to integrate Email clients - -- `` is the flag to set a particular Email client as the default Email client - -- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration - - - -### URL Protocol handler - -Applications do not always specifically called virtualized applications utilizing file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user clicks on a mailto: link and expects to get their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL protocol handlers are automatically added to the package. - -For situations where there is more than one application that could register the specific URL Protocol handler, the dynamic configuration files can be utilized to modify the behavior and suppress or disable this feature for an application that should not be the primary application launched. - -### AppPath - -The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. - -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: . - -### Virtual application - -This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, it is possible to disable all extension points belonging to one application, in order to allow only integration of extension points of other application. - -### Extension point rules - -The extension points described above are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). - -Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Virtual ExtensionRequires target OS SequencingRequires Global Publishing

          Shortcut

          File Type Association

          URL Protocols

          X

          AppPaths

          X

          COM Mode

          Software Client

          X

          Application Capabilities

          X

          X

          Context Menu Handler

          X

          X

          Drag-and-drop Handler

          X

          Data Object Handler

          X

          Property Sheet Handler

          X

          Infotip Handler

          X

          Column Handler

          X

          Shell Extensions

          X

          Browser Helper Object

          X

          X

          Active X Object

          X

          X

          - - - -## Dynamic configuration processing - - -Deploying App-V packages to one machine or user is very simple. However, as organizations deploy AppV applications across business lines and geographic and political boundaries, the ability to sequence an application one time with one set of settings becomes impossible. App-V was designed for this scenario, as it captures specific settings and configurations during sequencing in the Manifest file, but also supports modification with Dynamic Configuration files. - -App-V dynamic configuration allows for specifying a policy for a package either at the machine level or at the user level. The Dynamic Configuration files enable sequencing engineers to modify the configuration of a package, post-sequencing, to address the needs of individual groups of users or machines. In some instances it may be necessary to make modifications to the application to provide proper functionality within the App-V environment. For example, it may be necessary to make modifications to the \_\*config.xml files to allow certain actions to be performed at a specified time during the execution of the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. - -App-V Packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow the publishing of an application to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. - -### Example for dynamic configuration files - -The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information review the App-V 5 Sequencing Guide at: - -**Manifest** - -```xml - - - [{Common Programs}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - -``` - -**Deployment Configuration** - -```xml - - - - - - - - - - -``` - -**User Configuration** - -```xml - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - - - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM.exe.O.ico - - - [{Common Programs}]\7-Zip\7-Zip File Manager.Ink - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot)]\7zFM.exe.O.ico - - - - - - - - - - - - -``` - -## Side-by-side assemblies - - -App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V 5 SP2 supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The Side by Side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. - -Side by Side Assembly support in App-V has the following features. - -- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. - -- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. - -- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. - -- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. - -### Automatic publishing of SxS assemblies - -During publishing of an App-V package with SxS assemblies the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the Side by Side assembly installations that are part of the base packages, as the connection group does not contain any information about assembly installation. - -**Note**   -UnPublishing or removing a package with an assembly does not remove the assemblies for that package. - - - -## Client logging - - -The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer, under Applications and Services Logs\\Microsoft\\AppV\\Client. - -**Note**   -In App-V 5.0 SP3, some logs were consolidated and moved to the following location: - -`Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog` - -For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - - - -There are three specific categories of events recorded described below. - -**Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. - -**Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. - -**Virtual Application**: Logs virtual application launches and use of virtualization subsystems. - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/check-reg-key-svr.md b/mdop/appv-v5/check-reg-key-svr.md deleted file mode 100644 index 84fc0d654a..0000000000 --- a/mdop/appv-v5/check-reg-key-svr.md +++ /dev/null @@ -1,246 +0,0 @@ ---- -title: Check Registry Keys before installing App-V 5.x Server -description: Check Registry Keys before installing App-V 5.x Server -author: manikadhiman -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - - -# Check Registry Keys before installing App-V 5.x Server - -If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in this section before installing the App-V 5.x Server - - ---- - - - - - - - - - - - - - - - - - - -

          When this step is required

          You are upgrading from App-V 5.0 SP1 with any subsequent Hotfix Packages that you installed by using an .msp file.

          Which components require that you do this step

          Only the App-V Server components that you are upgrading.

          When you need to do this step

          Before you upgrade the App-V Server to App-V 5.x

          What you need to do

          Using the information in the following tables, update each registry key value under HKLM\Software\Microsoft\AppV\Server with the value that you provided in your original server installation. Completing this step restores registry values that may have been removed when App-V 5.0 SP1 Hotfix Packages were installed.

          - -  - -**ManagementDatabase key** - -If you are installing the Management database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Key nameDescription

          IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

          Describes whether a public access account is required to access non-local management databases. Value is set to “1” if it is required.

          MANAGEMENT_DB_NAME

          Name of the Management database.

          MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT

          Account used for read (public) access to the Management database.

          -

          Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_SID

          Secure identifier (SID) of the account used for read (public) access to the Management database.

          -

          Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          MANAGEMENT_DB_SQL_INSTANCE

          SQL Server instance for the Management database.

          -

          If the value is blank, the default database instance is used.

          MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT

          Account used for write (administrator) access to the Management database.

          MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT_SID

          Secure identifier (SID) of the account used for write (administrator) access to the Management database.

          MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          Management server remote computer account (domain\account).

          MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          Installation administrator login for the Management server (domain\account).

          MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          Valid values are:

          -
            -
          • 1 – the Management service is on the local computer, that is, MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

          • -
          • 0 - the Management service is on a different computer from the local computer.

          • -
          - -  - -**ManagementService key** - -If you are installing the Management server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementService`. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Key nameDescription

          MANAGEMENT_ADMINACCOUNT

          Active Directory Domain Services (AD DS) group or account that is authorized to manage App-V (domain\account).

          MANAGEMENT_DB_SQL_INSTANCE

          SQL server instance that contains the Management database.

          -

          If the value is blank, the default database instance is used.

          MANAGEMENT_DB_SQL_SERVER_NAME

          Name of the remote SQL server with the Management database.

          -

          If the value is blank, the local computer is used.

          - -  - -**ReportingDatabase key** - -If you are installing the Reporting database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Key nameDescription

          IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

          Describes whether a public access account is required to access non-local reporting databases. Value is set to “1” if it is required.

          REPORTING_DB_NAME

          Name of the Reporting database.

          REPORTING_DB_PUBLIC_ACCESS_ACCOUNT

          Account used for read (public) access to the Reporting database.

          -

          Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_SID

          Secure identifier (SID) of the account used for read (public) access to the Reporting database.

          -

          Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

          REPORTING_DB_SQL_INSTANCE

          SQL Server instance for the Reporting database.

          -

          If the value is blank, the default database instance is used.

          REPORTING_DB_WRITE_ACCESS_ACCOUNT

          REPORTING_DB_WRITE_ACCESS_ACCOUNT_SID

          REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          Reporting server remote computer account (domain\account).

          REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          Installation administrator login for the Reporting server (domain\account).

          REPORTING_SERVER_MACHINE_USE_LOCAL

          Valid values are:

          -
            -
          • 1 – the Reporting service is on the local computer, that is, REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

          • -
          • 0 - the Reporting service is on a different computer from the local computer.

          • -
          - -  - -**ReportingService key** - -If you are installing the Reporting server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingService`. - - ---- - - - - - - - - - - - - - - - - -
          Key nameDescription

          REPORTING_DB_SQL_INSTANCE

          SQL Server instance for the Reporting database.

          -

          If the value is blank, the default database instance is used.

          REPORTING_DB_SQL_SERVER_NAME

          Name of the remote SQL server with the Reporting database.

          -

          If the value is blank, the local computer is used.

          - diff --git a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md deleted file mode 100644 index 89f4fc49d7..0000000000 --- a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md +++ /dev/null @@ -1,344 +0,0 @@ ---- -title: Creating and Managing App-V 5.0 Virtualized Applications -description: Creating and Managing App-V 5.0 Virtualized Applications -author: manikadhiman -ms.assetid: 66bab403-d7e0-4e7b-bc8f-a29a98a7160a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating and Managing App-V 5.0 Virtualized Applications - - -After you have properly deployed the Microsoft Application Virtualization (App-V) 5.0 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. - -**Note**   -For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx). - - - -## Sequencing an application - - -You can use the App-V 5.0 Sequencer to perform the following tasks: - -- Create virtual packages that can be deployed to computers running the App-V 5.0 client. - -- Upgrade existing packages. You can expand an existing package onto the computer running the sequencer and then upgrade the application to create a newer version. - -- Edit configuration information associated with an existing package. For example, you can add a shortcut or modify a file type association. - - **Note**   - You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V 5.0 client. - - - -- Convert existing virtual packages. - -The sequencer uses the **%TMP% \\ Scratch** or **%TEMP% \\ Scratch** directory and the **Temp** directory to store temporary files during sequencing. On the computer that runs the sequencer, you should configure these directories with free disk space equivalent to the estimated application installation requirements. Configuring the temp directories and the Temp directory on different hard drive partitions can help improve performance during sequencing. - -When you use the sequencer to create a new virtual application, the following listed files are created. These files comprise the App-V 5.0 package. - -- .msi file. This Windows Installer (.msi) file is created by the sequencer and is used to install the virtual package on target computers. - -- Report.xml file. In this file, the sequencer saves all issues, warnings, and errors that were discovered during sequencing. It displays the information after the package has been created. You can us this report for diagnosing and troubleshooting. - -- .appv file. This is the virtual application file. - -- Deployment configuration file. The deployment configuration file determines how the virtual application will be deployed to target computers. - -- User configuration file. The user configuration file determines how the virtual application will run on target computers. - -**Important**   -You must configure the %TMP% and %TEMP% folders that the package converter uses to be a secure location and directory. A secure location is only accessible by an administrator. Additionally, when you sequence the package you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion and monitoring process. - - - -The **Options** dialog box in the sequencer console contains the following tabs: - -- **General**. Use this tab to enable Microsoft Updates to run during sequencing. Select **Append Package Version to Filename** to configure the sequence to add a version number to the virtualized package that is being sequenced. Select **Always trust the source of Package Accelerators** to create virtualized packages using a package accelerator without being prompted for authorization. - - **Important**   - Package Accelerators created using App-V 4.6 are not supported by App-V 5.0. - - - -- **Parse Items**. This tab displays the associated file path locations that will be parsed or tokenized into in the virtual environment. Tokens are useful for adding files using the **Package Files** tab in **Advanced Editing**. - -- **Exclusion Items**. Use this tab to specify which folders and directories should not be monitored during sequencing. To add local application data that is saved in the Local App Data folder in the package, click **New** and specify the location and the associated **Mapping Type**. This option is required for some packages. - -App-V 5.0 supports applications that include Microsoft Windows Services. If an application includes a Windows service, the Service will be included in the sequenced virtual package as long as it is installed while being monitored by the sequencer. If a virtual application creates a Windows service when it initially runs, then later, after installation, the application must be run while the sequencer is monitoring so that the Windows Service will be added to the package. Only Services that run under the Local System account are supported. Services that are configured for AutoStart or Delayed AutoStart are started before the first virtual application in a package runs inside the package’s Virtual Environment. Windows Services that are configured to be started on demand by an application are started when the virtual application inside the package starts the Service via API call. - -[How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md) - -## App-V 5.0 SP2 shell extension support - - -App-V 5.0 SP2 supports shell extensions. Shell extensions will be detected and embedded in the package during sequencing. - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published, the shell extension gives users the same functionality as if the application were locally installed. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table lists the supported shell extensions: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          HandlerDescription

          Context menu handler

          Adds menu items to the context menu. It is called before the context menu is displayed.

          Drag-and-drop handler

          Controls the action where right-click, drag and drop and modifies the context menu that appears.

          Drop target handler

          Controls the action after a data object is dragged and dropped over a drop target such as a file.

          Data object handler

          Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target.

          Property sheet handler

          Replaces or adds pages to the property sheet dialog box of an object.

          Infotip handler

          Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover.

          Column handler

          Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

          Preview handler

          Enables a preview of a file to be displayed in the Windows Explorer Preview pane.

          - - - -## Copy on Write (CoW) file extension support - - -Copy on write (CoW) file extensions allow App-V 5.0 to dynamically write to specific locations contained in the virtual package while it is being used. - -The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V 5.0 client. All other files and directories can be modified. - -.acm - -.asa - -.asp - -.aspx - -.ax - -.bat - -.cer - -.chm - -.clb - -.cmd - -.cnt - -.cnv - -.com - -.cpl - -.cpx - -.crt - -.dll - -.drv - -.exe - -.fon - -.grp - -.hlp - -.hta - -.ime - -.inf - -.ins - -.isp - -.its - -.js - -.jse - -.lnk - -.msc - -.msi - -.msp - -.mst - -.mui - -.nls - -.ocx - -.pal - -.pcd - -.pif - -.reg - -.scf - -.scr - -.sct - -.shb - -.shs - -.sys - -.tlb - -.tsp - -.url - -.vb - -.vbe - -.vbs - -.vsmacros - -.ws - -.esc - -.wsf - -.wsh - - - -## Modifying an existing virtual application package - - -You can use the sequencer to modify an existing package. The computer on which you do this should match the chip architecture of the computer you used to create the application. For example, if you initially sequenced a package using a computer running a 64-bit operating system, you should modify the package using a computer running a 64-bit operating system. - -[How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md) - -## Creating a project template - - -A .appvt file is a project template that can be used to save commonly applied, customized settings. You can then more easily use these settings for future sequencings. - -App-V 5.0 project templates differ from App-V 5.0 Application Accelerators because App-V 5.0 Application Accelerators are application-specific, and App-V 5.0 project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. The following general settings are saved with an App-V 5.0 project template: - -A template can specify and store multiple settings as follows: - -- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings - -- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**. - -- **Exclusion Items.** Contains the Exclusion pattern list. - -[How to Create and Use a Project Template](how-to-create-and-use-a-project-template.md) - -## Creating a package accelerator - - -**Note**   -Package accelerators created using a previous version of App-V must be recreated using App-V 5.0. - - - -You can use App-V 5.0 package accelerators to automatically generate a new virtual application packages. After you have successfully created a package accelerator, you can reuse and share the package accelerator. - -In some situations, to create the package accelerator, you might have to install the application locally on the computer that runs the sequencer. In such cases, you should first try to create the package accelerator with the installation media. If multiple missing files are required, you should install the application locally to the computer that runs the sequencer, and then create the package accelerator. - -After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. Creating App-V 5.0 Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.0 Package Accelerator is applied. - -[How to Create a Package Accelerator](how-to-create-a-package-accelerator.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md) - -## Sequencer error reporting - - -The App-V 5.0 Sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. - -You can also find additional information about sequencing errors using the Windows Event Viewer. - - - - - - -## Other resources for the App-V 5.0 sequencer - - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md deleted file mode 100644 index c781eb4fea..0000000000 --- a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: Creating and Managing App-V 5.1 Virtualized Applications -description: Creating and Managing App-V 5.1 Virtualized Applications -author: dansimp -ms.assetid: 26be4331-88eb-4cfb-9d82-e63d7ee54576 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating and Managing App-V 5.1 Virtualized Applications - - -After you have properly deployed the Microsoft Application Virtualization (App-V) 5.1 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. - -**Note**   -For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx). - -**Note** -The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -## Sequencing an application - - -You can use the App-V 5.1 Sequencer to perform the following tasks: - -- Create virtual packages that can be deployed to computers running the App-V 5.1 client. - -- Upgrade existing packages. You can expand an existing package onto the computer running the sequencer and then upgrade the application to create a newer version. - -- Edit configuration information associated with an existing package. For example, you can add a shortcut or modify a file type association. - - **Note**   - You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V 5.1 client. - -- Convert existing virtual packages. - -The sequencer uses the **%TMP% \\ Scratch** or **%TEMP% \\ Scratch** directory and the **Temp** directory to store temporary files during sequencing. On the computer that runs the sequencer, you should configure these directories with free disk space equivalent to the estimated application installation requirements. Configuring the temp directories and the Temp directory on different hard drive partitions can help improve performance during sequencing. - -When you use the sequencer to create a new virtual application, the following listed files are created. These files comprise the App-V 5.1 package. - -- .msi file. This Windows Installer (.msi) file is created by the sequencer and is used to install the virtual package on target computers. - -- Report.xml file. In this file, the sequencer saves all issues, warnings, and errors that were discovered during sequencing. It displays the information after the package has been created. You can us this report for diagnosing and troubleshooting. - -- .appv file. This is the virtual application file. - -- Deployment configuration file. The deployment configuration file determines how the virtual application will be deployed to target computers. - -- User configuration file. The user configuration file determines how the virtual application will run on target computers. - -**Important**   -You must configure the %TMP% and %TEMP% folders that the package converter uses to be a secure location and directory. A secure location is only accessible by an administrator. Additionally, when you sequence the package you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion and monitoring process.  - -The **Options** dialog box in the sequencer console contains the following tabs: - -- **General**. Use this tab to enable Microsoft Updates to run during sequencing. Select **Append Package Version to Filename** to configure the sequence to add a version number to the virtualized package that is being sequenced. Select **Always trust the source of Package Accelerators** to create virtualized packages using a package accelerator without being prompted for authorization. - - **Important**   - Package Accelerators created using App-V 4.6 are not supported by App-V 5.1.   - -- **Parse Items**. This tab displays the associated file path locations that will be parsed or tokenized into in the virtual environment. Tokens are useful for adding files using the **Package Files** tab in **Advanced Editing**. - -- **Exclusion Items**. Use this tab to specify which folders and directories should not be monitored during sequencing. To add local application data that is saved in the Local App Data folder in the package, click **New** and specify the location and the associated **Mapping Type**. This option is required for some packages. - -App-V 5.1 supports applications that include Microsoft Windows Services. If an application includes a Windows service, the Service will be included in the sequenced virtual package as long as it is installed while being monitored by the sequencer. If a virtual application creates a Windows service when it initially runs, then later, after installation, the application must be run while the sequencer is monitoring so that the Windows Service will be added to the package. Only Services that run under the Local System account are supported. Services that are configured for AutoStart or Delayed AutoStart are started before the first virtual application in a package runs inside the package’s Virtual Environment. Windows Services that are configured to be started on demand by an application are started when the virtual application inside the package starts the Service via API call. - -[How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md) - -## App-V 5.1 shell extension support - - -App-V 5.1 supports shell extensions. Shell extensions will be detected and embedded in the package during sequencing. - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published, the shell extension gives users the same functionality as if the application were locally installed. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table lists the supported shell extensions: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          HandlerDescription

          Context menu handler

          Adds menu items to the context menu. It is called before the context menu is displayed.

          Drag-and-drop handler

          Controls the action where right-click, drag and drop and modifies the context menu that appears.

          Drop target handler

          Controls the action after a data object is dragged and dropped over a drop target such as a file.

          Data object handler

          Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target.

          Property sheet handler

          Replaces or adds pages to the property sheet dialog box of an object.

          Infotip handler

          Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover.

          Column handler

          Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

          Preview handler

          Enables a preview of a file to be displayed in the Windows Explorer Preview pane.

          - -## Copy on Write (CoW) file extension support - -Copy on write (CoW) file extensions allow App-V 5.1 to dynamically write to specific locations contained in the virtual package while it is being used. - -The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V 5.1 client. All other files and directories can be modified. - -| File Type | | | | | | -|------------ |------------- |------------- |------------ |------------ |------------ | -| .acm | .asa | .asp | .aspx | .ax | .bat | -| .cer | .chm | .clb | .cmd | .cnt | .cnv | -| .com | .cpl | .cpx | .crt | .dll | .drv | -| .esc | .exe | .fon | .grp | .hlp | .hta | -| .ime | .inf | .ins | .isp | .its | .js | -| .jse | .lnk | .msc | .msi | .msp | .mst | -| .mui | .nls | .ocx | .pal | .pcd | .pif | -| .reg | .scf | .scr | .sct | .shb | .shs | -| .sys | .tlb | .tsp | .url | .vb | .vbe | -| .vbs | .vsmacros | .ws | .wsf | .wsh | | - - -## Modifying an existing virtual application package - - -You can use the sequencer to modify an existing package. The computer on which you do this should match the chip architecture of the computer you used to create the application. For example, if you initially sequenced a package using a computer running a 64-bit operating system, you should modify the package using a computer running a 64-bit operating system. - -[How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-51.md) - -## Creating a project template - - -A .appvt file is a project template that can be used to save commonly applied, customized settings. You can then more easily use these settings for future sequencings. - -App-V 5.1 project templates differ from App-V 5.1 Application Accelerators because App-V 5.1 Application Accelerators are application-specific, and App-V 5.1 project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. The following general settings are saved with an App-V 5.1 project template: - -A template can specify and store multiple settings as follows: - -- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings - -- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**. - -- **Exclusion Items.** Contains the Exclusion pattern list. - -[How to Create and Use a Project Template](how-to-create-and-use-a-project-template51.md) - -## Creating a package accelerator - - -**Note**   -Package accelerators created using a previous version of App-V must be recreated using App-V 5.1. - -You can use App-V 5.1 package accelerators to automatically generate a new virtual application packages. After you have successfully created a package accelerator, you can reuse and share the package accelerator. - -In some situations, to create the package accelerator, you might have to install the application locally on the computer that runs the sequencer. In such cases, you should first try to create the package accelerator with the installation media. If multiple missing files are required, you should install the application locally to the computer that runs the sequencer, and then create the package accelerator. - -After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. Creating App-V 5.1 Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.1 Package Accelerator is applied. - -[How to Create a Package Accelerator](how-to-create-a-package-accelerator51.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md) - -## Sequencer error reporting - - -The App-V 5.1 Sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. - -You can also find additional information about sequencing errors using the Windows Event Viewer. - - -## Other resources for the App-V 5.1 sequencer - - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - diff --git a/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md b/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md deleted file mode 100644 index 4490ab666a..0000000000 --- a/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD) -description: Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD) -author: dansimp -ms.assetid: d1d74af4-229f-4578-8c95-554a3d7cd2f3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD) - - -You can deploy App-V 5.0 packages using an Electronic Software Distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md). - -To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) - -## How to deploy virtualized packages using an ESD - - -Describes the methods you can use to deploy App-V packages by using an ESD - -[How to deploy App-V 5.0 Packages Using Electronic Software Distribution](how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md) - -## How to Enable Only Administrators to Publish Packages by Using an ESD - - -Explains how to configure the App-V client to enable only administrators to publish and unpublish packages when you’re using an ESD. - -[How to Enable Only Administrators to Publish Packages by Using an ESD](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md) - - - - - - -## Other resources for using an ESD and App-V 5.0 - - -Use the following link for more information about [App-V and Citrix Integration](https://go.microsoft.com/fwlink/?LinkId=330294 ) (https://go.microsoft.com/fwlink/?LinkId=330294). - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-app-v-50.md b/mdop/appv-v5/deploying-app-v-50.md deleted file mode 100644 index 5f13c3d291..0000000000 --- a/mdop/appv-v5/deploying-app-v-50.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploying App-V 5.0 -description: Deploying App-V 5.0 -author: dansimp -ms.assetid: 77cb19d7-00e6-4b39-b35a-e8a8ca0b807b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying App-V 5.0 - - -Microsoft Application Virtualization (App-V) 5.0 (App-V 5.0) supports a number of different deployment options. This section of the App-V 5.0 Administrator’s Guide includes information you should consider about the deployment of App-V 5.0 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## App-V 5.0 Deployment Information - - -- [Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - - This section describes how to install the App-V 5.0 sequencer which is used to virtualize applications, and the App-V 5.0 client which runs on target computers to facilitate virtualized packages. - -- [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - This section provides information about installing the App-V 5.0 management, publishing, database and reporting severs. - -- [App-V 5.0 Deployment Checklist](app-v-50-deployment-checklist.md) - - This section provides a deployment checklist that can be used to assist with installing App-V 5.0. - -## Other Resources for Deploying App-V 5.0 - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md b/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md deleted file mode 100644 index de4772c416..0000000000 --- a/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD) -description: Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD) -author: dansimp -ms.assetid: c2e4d176-460d-44ca-9a1d-69d2a733aa42 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD) - - -You can deploy App-V 5.1 packages using an Electronic Software Distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md). - -To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) - -## How to deploy virtualized packages using an ESD - - -Describes the methods you can use to deploy App-V packages by using an ESD - -[How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md) - -## How to Enable Only Administrators to Publish Packages by Using an ESD - - -Explains how to configure the App-V client to enable only administrators to publish and unpublish packages when you’re using an ESD. - -[How to Enable Only Administrators to Publish Packages by Using an ESD](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md) - - - - - - -## Other resources for using an ESD and App-V 5.1 - - -Use the following link for more information about [App-V and Citrix Integration](https://go.microsoft.com/fwlink/?LinkId=330294 ) (https://go.microsoft.com/fwlink/?LinkId=330294). - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-app-v-51.md b/mdop/appv-v5/deploying-app-v-51.md deleted file mode 100644 index 719dc32571..0000000000 --- a/mdop/appv-v5/deploying-app-v-51.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Deploying App-V 5.1 -description: Deploying App-V 5.1 -author: dansimp -ms.assetid: af8742bf-e24b-402a-bcf4-0f2297f26bc4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying App-V 5.1 - - -Microsoft Application Virtualization (App-V) 5.1 supports a number of different deployment options. This section of the App-V 5.1 Administrator’s Guide includes information you should consider about the deployment of App-V 5.1 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## App-V 5.1 Deployment Information - - -- [Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - - This section describes how to install the App-V 5.1 sequencer which is used to virtualize applications, and the App-V 5.1 client which runs on target computers to facilitate virtualized packages. - -- [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - This section provides information about installing the App-V 5.1 management, publishing, database and reporting severs. - -- [App-V 5.1 Deployment Checklist](app-v-51-deployment-checklist.md) - - This section provides a deployment checklist that can be used to assist with installing App-V 5.1. - -## Other Resources for Deploying App-V 5.1 - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md deleted file mode 100644 index 88c3436957..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md +++ /dev/null @@ -1,315 +0,0 @@ ---- -title: Deploying Microsoft Office 2010 by Using App-V -description: Deploying Microsoft Office 2010 by Using App-V -author: dansimp -ms.assetid: 0a9e496e-82a1-4dc0-a496-7b21eaa00f53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying Microsoft Office 2010 by Using App-V - - -You can create Office 2010 packages for Application Virtualization 5.0 using one of the following methods: - -- Application Virtualization (App-V) Sequencer - -- Application Virtualization (App-V) Package Accelerator - -## App-V support for Office 2010 - - -The following table shows the App-V versions, methods of Office package creation, supported licensing, and supported deployments for Office 2010. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported itemLevel of support

          Supported App-V versions

            -
          • 4.6

          • -
          • 5.0

          • -

          Package creation

            -
          • Sequencing

          • -
          • Package Accelerator

          • -
          • Office Deployment Kit

          • -

          Supported licensing

          Volume Licensing

          Supported deployments

            -
          • Desktop

          • -
          • Personal VDI

          • -
          • RDS

          • -
          - - - -## Creating Office 2010 App-V 5.0 using the sequencer - - -Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V 5.0. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V 5.0, refer to the following link for detailed instructions: - -[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -## Creating Office 2010 App-V 5.0 packages using package accelerators - - -Office 2010 App-V 5.0 packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator: - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://go.microsoft.com/fwlink/p/?LinkId=330677) - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=330678) - -For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md). - -## Deploying the Microsoft Office package for App-V 5.0 - - -You can deploy Office 2010 packages by using any of the following App-V deployment methods: - -- System Center Configuration Manager - -- App-V server - -- Stand-alone through PowerShell commands - -## Office App-V package management and customization - - -Office 2010 packages can be managed like any other App-V 5.0 packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages. - -## Microsoft Office integration with Windows - - -The following table provides a full list of supported integration points for Office 2010. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Extension PointDescriptionOffice 2010

          Lync meeting Join Plug-in for Firefox and Chrome

          User can join Lync meetings from Firefox and Chrome

          Sent to OneNote Print Driver

          User can print to OneNote

          Yes

          OneNote Linked Notes

          OneNote Linked Notes

          Send to OneNote Internet Explorer Add-In

          User can send to OneNote from IE

          Firewall Exception for Lync and Outlook

          Firewall Exception for Lync and Outlook

          MAPI Client

          Native apps and add-ins can interact with virtual Outlook through MAPI

          SharePoint Plugin for Firefox

          User can use SharePoint features in Firefox

          Mail Control Panel Applet

          User gets the mail control panel applet in Outlook

          Yes

          Primary Interop Assemblies

          Support managed add-ins

          Office Document Cache Handler

          Allows Document Cache for Office applications

          Outlook Protocol Search handler

          User can search in outlook

          Yes

          Active X Controls:

          For more information on ActiveX controls, refer to ActiveX Control API Reference.

             Groove.SiteClient

          Active X Control

             PortalConnect.PersonalSite

          Active X Control

             SharePoint.openDocuments

          Active X Control

             SharePoint.ExportDatabase

          Active X Control

             SharePoint.SpreadSheetLauncher

          Active X Control

             SharePoint.StssyncHander

          Active X Control

             SharePoint.DragUploadCtl

          Active X Control

             SharePoint.DragDownloadCtl

          Active X Control

             Sharpoint.OpenXMLDocuments

          Active X Control

             Sharepoint.ClipboardCtl

          Active X control

             WinProj.Activator

          Active X Control

             Name.NameCtrl

          Active X Control

             STSUPld.CopyCtl

          Active X Control

             CommunicatorMeetingJoinAx.JoinManager

          Active X Control

             LISTNET.Listnet

          Active X Control

             OneDrive Pro Browser Helper

          Active X Control]

          OneDrive Pro Icon Overlays

          Windows explorer shell icon overlays when users look at folders OneDrive Pro folders

          - - - -## Additional resources - - -**Office 2013 App-V 5.0 Packages 5.0 Additional Resources** - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V 5.0 Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md deleted file mode 100644 index 8e68496eec..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md +++ /dev/null @@ -1,316 +0,0 @@ ---- -title: Deploying Microsoft Office 2010 by Using App-V -description: Deploying Microsoft Office 2010 by Using App-V -author: dansimp -ms.assetid: ae0b0459-c0d6-4946-b62d-ff153f52d1fb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying Microsoft Office 2010 by Using App-V - - -You can create Office 2010 packages for Microsoft Application Virtualization (App-V) 5.1 using one of the following methods: - -- Application Virtualization (App-V) Sequencer - -- Application Virtualization (App-V) Package Accelerator - -## App-V support for Office 2010 - - -The following table shows the App-V versions, methods of Office package creation, supported licensing, and supported deployments for Office 2010. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported itemLevel of support

          Supported App-V versions

            -
          • 4.6

          • -
          • 5.0

          • -
          • 5.1

          • -

          Package creation

            -
          • Sequencing

          • -
          • Package Accelerator

          • -
          • Office Deployment Kit

          • -

          Supported licensing

          Volume Licensing

          Supported deployments

            -
          • Desktop

          • -
          • Personal VDI

          • -
          • RDS

          • -
          - - - -## Creating Office 2010 App-V 5.1 using the sequencer - - -Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V 5.1. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V 5.1, refer to the following link for detailed instructions: - -[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -## Creating Office 2010 App-V 5.1 packages using package accelerators - - -Office 2010 App-V 5.1 packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 10, Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator: - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://go.microsoft.com/fwlink/p/?LinkId=330677) - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=330678) - -For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md). - -## Deploying the Microsoft Office package for App-V 5.1 - - -You can deploy Office 2010 packages by using any of the following App-V deployment methods: - -- System Center Configuration Manager - -- App-V server - -- Stand-alone through PowerShell commands - -## Office App-V package management and customization - - -Office 2010 packages can be managed like any other App-V 5.1 packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages. - -## Microsoft Office integration with Windows - - -The following table provides a full list of supported integration points for Office 2010. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Extension PointDescriptionOffice 2010

          Lync meeting Join Plug-in for Firefox and Chrome

          User can join Lync meetings from Firefox and Chrome

          Sent to OneNote Print Driver

          User can print to OneNote

          Yes

          OneNote Linked Notes

          OneNote Linked Notes

          Send to OneNote Internet Explorer Add-In

          User can send to OneNote from IE

          Firewall Exception for Lync and Outlook

          Firewall Exception for Lync and Outlook

          MAPI Client

          Native apps and add-ins can interact with virtual Outlook through MAPI

          SharePoint Plugin for Firefox

          User can use SharePoint features in Firefox

          Mail Control Panel Applet

          User gets the mail control panel applet in Outlook

          Yes

          Primary Interop Assemblies

          Support managed add-ins

          Office Document Cache Handler

          Allows Document Cache for Office applications

          Outlook Protocol Search handler

          User can search in outlook

          Yes

          Active X Controls:

          For more information on ActiveX controls, refer to ActiveX Control API Reference.

             Groove.SiteClient

          Active X Control

             PortalConnect.PersonalSite

          Active X Control

             SharePoint.openDocuments

          Active X Control

             SharePoint.ExportDatabase

          Active X Control

             SharePoint.SpreadSheetLauncher

          Active X Control

             SharePoint.StssyncHander

          Active X Control

             SharePoint.DragUploadCtl

          Active X Control

             SharePoint.DragDownloadCtl

          Active X Control

             Sharpoint.OpenXMLDocuments

          Active X Control

             Sharepoint.ClipboardCtl

          Active X control

             WinProj.Activator

          Active X Control

             Name.NameCtrl

          Active X Control

             STSUPld.CopyCtl

          Active X Control

             CommunicatorMeetingJoinAx.JoinManager

          Active X Control

             LISTNET.Listnet

          Active X Control

             OneDrive Pro Browser Helper

          Active X Control]

          OneDrive Pro Icon Overlays

          Windows explorer shell icon overlays when users look at folders OneDrive Pro folders

          - - - -## Additional resources - - -**Office 2013 App-V Packages Additional Resources** - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups51.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md deleted file mode 100644 index 6ac193ddbc..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md +++ /dev/null @@ -1,894 +0,0 @@ ---- -title: Deploying Microsoft Office 2013 by Using App-V -description: Deploying Microsoft Office 2013 by Using App-V -author: dansimp -ms.assetid: 02df5dc8-79e2-4c5c-8398-dbfb23344ab3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Deploying Microsoft Office 2013 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization 5.0, or later versions, to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and pp-V. - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2013 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.0](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2013 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
          Information to reviewDescription

          Planning for Using App-V with Office

            -
          • Supported versions of Office

          • -
          • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

          • -
          • Office licensing options

          • -

          Planning for Using App-V with Office

          Considerations for installing different versions of Office on the same computer

          - - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskRequirement

          Packaging

            -
          • All of the Office applications that you want to deploy to users must be in a single package.

          • -
          • In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

          • -
          • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2013 and Project 2013 with Office.

          • -

          Publishing

            -
          • You can publish only one Office package to each client computer.

          • -
          • You must publish the Office package globally. You cannot publish to the user.

          • -

          Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

          -
            -
          • Office 365 ProPlus

          • -
          • Visio Pro for Office 365

          • -
          • Project Pro for Office 365

          • -

          You must enable shared computer activation.

          -

          You don’t use shared computer activation if you’re deploying a volume licensed product, such as:

          -
            -
          • Office Professional Plus 2013

          • -
          • Visio Professional 2013

          • -
          • Project Professional 2013

          • -
          - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

            -
          • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

          • -
          • For more information, see ExcludeApp element.

          • -

          Modify the DeploymentConfig.xml file

            -
          • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

          • -
          • For more information, see Disabling Office 2013 applications.

          • -
          - - - -## Creating an Office 2013 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2013 package for App-V 5.0 or later. - -**Important** -In App-V 5.0 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
          PrerequisiteDescription

          Prerequisite software

          .Net Framework 4

          Supported operating systems

            -
          • 64-bit version of Windows 8

          • -
          • 64-bit version of Windows 7

          • -
          - - -**Note** -In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing. - - -### Create Office 2013 App-V Packages Using Office Deployment Tool - -You create Office 2013 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing. - -Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7 and Windows 8 computers. - -### Download the Office Deployment Tool - -Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778). - -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2013 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2013 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. After getting the Office applications, you create the Office 2013 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - **Note** - The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. - - The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          InputDescriptionExample

          Add element

          Specifies the products and languages to include in the package.

          N/A

          OfficeClientEdition (attribute of Add element)

          Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

          OfficeClientEdition="32"

          -

          OfficeClientEdition="64"

          Product element

          Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.

          Product ID ="O365ProPlusRetail "

          -

          Product ID ="VisioProRetail"

          -

          Product ID ="ProjectProRetail"

          -

          Product ID ="ProPlusVolume"

          -

          Product ID ="VisioProVolume"

          -

          Product ID = "ProjectProVolume"

          Language element

          Specifies the language supported in the applications

          Language ID="en-us"

          Version (attribute of Add element)

          Optional. Specifies a build to use for the package

          -

          Defaults to latest advertised build (as defined in v32.CAB at the Office source).

          15.1.2.3

          SourcePath (attribute of Add element)

          Specifies the location in which the applications will be saved to.

          Sourcepath = "\Server\Office2013”

          - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details: - - ``` syntax - \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2013

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /download

          downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.

          \server\Office2013\Customconfig.xml

          passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2013.

          - - - -### Convert the Office applications into an App-V package - -After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7 and Windows 8 computers. - -- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Product IDVolume LicensingSubscription Licensing

          Office 2013

          ProPlusVolume

          O365ProPlusRetail

          Office 2013 with Visio 2013

          ProPlusVolume

          -

          VisioProVolume

          O365ProPlusRetail

          -

          VisioProRetail

          Office 2013 with Visio 2013 and Project 2013

          ProPlusVolume

          -

          VisioProVolume

          -

          ProjectProVolume

          O365ProPlusRetail

          -

          VisioProRetail

          -

          ProjectProRetail

          - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterWhat to change the value to

          SourcePath

          Point to the Office applications downloaded earlier.

          ProductID

          Specify the type of licensing, as shown in the following examples:

          -
            -
          • Subscription Licensing

            -
            <Configuration>
            -      <Add SourcePath= "\server\Office 2013" OfficeClientEdition="32" >
            -       <Product ID="O365ProPlusRetail">
            -         <Language ID="en-us" />
            -       </Product>
            -       <Product ID="VisioProRetail">
            -         <Language ID="en-us" />
            -       </Product>
            -     </Add>
            -   </Configuration> 
            -

            In this example, the following changes were made to create a package with Subscription licensing:

            - - - - - - - - - - - - - - - - - - - -

            SourcePath

            is the path, which was changed to point to the Office applications that were downloaded earlier.

            Product ID

            for Office was changed to O365ProPlusRetail.

            Product ID

            for Visio was changed to VisioProRetail.

            -

            -

          • -
          • Volume Licensing

            -
            <Configuration>
            -      <Add SourcePath= "\Server\Office2013" OfficeClientEdition="32" >
            -       <Product ID="ProPlusVolume">
            -         <Language ID="en-us" />
            -       </Product>
            -       <Product ID="VisioProVolume">
            -         <Language ID="en-us" />
            -       </Product>
            -     </Add>
            -   </Configuration>
            -

            In this example, the following changes were made to create a package with Volume licensing:

            - - - - - - - - - - - - - - - - - - - -

            SourcePath

            is the path, which was changed to point to the Office applications that were downloaded earlier.

            Product ID

            for Office was changed to ProPlusVolume.

            Product ID

            for Visio was changed to VisioProVolume.

            -

            -

          • -

          ExcludeApp (optional)

          Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

          PACKAGEGUID (optional)

          By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

          -

          An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.

          -
          - Note

          Even if you use unique package IDs, you can still deploy only one App-V package to a single device.

          -
          -
          - -
          - - - -2. Use the /packager command to convert the Office applications to an Office 2013 App-V package. - - For example: - - ``` syntax - \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml \\server\share\Office2013AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2013

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /packager

          creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.

          \server\Office2013\Customconfig.xml

          passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

          \server\share\Office 2013AppV

          specifies the location of the newly created Office App-V package.

          - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** -To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2013 App-V package works correctly: - - 1. Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear. - - 2. Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V 5.0 - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2013 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
          Prerequisite or requirementDetails

          Enable PowerShell scripting on the App-V clients

          To publish Office 2013 packages, you must run a script.

          -

          Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

          -
          Set-AppvClientConfiguration –EnablePackageScripts 1

          Publish the Office 2013 package globally

          Extension points in the Office App-V package require installation at the computer level.

          -

          When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

          - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2013 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2013 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2013 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Managing Office 2013 licensing upgrades](#bkmk-manage-office-lic-upgrd) - -- [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V 5.0 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. - -3. Create an App-V 5.0 package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - **Important** - The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2013 App-V package has. - - Since the Office 2013 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2013 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2013 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2013 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2013 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -**Note** -To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx). - - - -**To disable an Office 2013 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2013. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2013 App-V Package with the new Deployment Configuration File. - - ```xml - - - InfoPath Filler 2013 - - - - - - - Lync 2013 - - - - - - - Access 2013 - - - - - ``` - -6. Re-add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -### Disabling Office 2013 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2013 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2013\Access 2013.lnk - [{AppvPackageRoot}])office15\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office15\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2013 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2013 package upgrades - -To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2013 package, perform the following steps. - -**How to upgrade a previously deployed Office 2013 package** - -1. Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - **Note** - Office App-V packages have two Version IDs: - - - An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. - - - A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package. - - - -2. Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - -### Managing Office 2013 licensing upgrades - -If a new Office 2013 App-V Package has a different license than the Office 2013 App-V Package currently deployed. For instance, the Office 2013 package deployed is a subscription based Office 2013 and the new Office 2013 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: - -**How to upgrade an Office 2013 License** - -1. Unpublish the already deployed Office 2013 Subscription Licensing App-V package. - -2. Remove the unpublished Office 2013 Subscription Licensing App-V package. - -3. Restart the computer. - -4. Add the new Office 2013 App-V Package Volume Licensing. - -5. Publish the added Office 2013 App-V Package with Volume Licensing. - -An Office 2013 App-V Package with your chosen licensing will be successfully deployed. - -### Deploying Visio 2013 and Project 2013 with Office - -The following table describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          How do I package and publish Visio 2013 and Project 2013 with Office?

          You must include Visio 2013 and Project 2013 in the same package with Office.

          -

          If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow Deploying Microsoft Office 2010 by Using App-V.

          How can I deploy Visio 2013 and Project 2013 to specific users?

          Use one of the following methods:

          - ---- - - - - - - - - - - - - - - - - -
          If you want to......then use this method

          Create two different packages and deploy each one to a different group of users

          Create and deploy the following packages:

          -
            -
          • A package that contains only Office - deploy to computers whose users need only Office.

          • -
          • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

          • -

          If you want only one package for the whole organization, or if you have users who share computers:

          Follows these steps:

          -
            -
          1. Create a package that contains Office, Visio, and Project.

          2. -
          3. Deploy the package to all users.

          4. -
          5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

          6. -
          -

          - - - -## Additional resources - - -**Office 2013 App-V 5.0 Packages 5.0 Additional Resources** - -[Office Deployment Tool for Click-to-Run](https://go.microsoft.com/fwlink/p/?LinkID=330672) - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V 5.0 Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md deleted file mode 100644 index 2e781bfa2b..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md +++ /dev/null @@ -1,902 +0,0 @@ ---- -title: Deploying Microsoft Office 2013 by Using App-V -description: Deploying Microsoft Office 2013 by Using App-V -author: dansimp -ms.assetid: 9a7be05e-2a7a-4874-af25-09c0f5037876 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Deploying Microsoft Office 2013 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization (App-V) 5.1, or later versions, to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and App-V. - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2013 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.1](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2013 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
          Information to reviewDescription

          Planning for Using App-V with Office

            -
          • Supported versions of Office

          • -
          • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

          • -
          • Office licensing options

          • -

          Planning for Using App-V with Office

          Considerations for installing different versions of Office on the same computer

          - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskRequirement

          Packaging

            -
          • All of the Office applications that you want to deploy to users must be in a single package.

          • -
          • In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

          • -
          • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2013 and Project 2013 with Office.

          • -

          Publishing

            -
          • You can publish only one Office package to each client computer.

          • -
          • You must publish the Office package globally. You cannot publish to the user.

          • -

          Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

          -
            -
          • Office 365 ProPlus

          • -
          • Visio Pro for Office 365

          • -
          • Project Pro for Office 365

          • -

          You must enable shared computer activation.

          -

          You don’t use shared computer activation if you’re deploying a volume licensed product, such as:

          -
            -
          • Office Professional Plus 2013

          • -
          • Visio Professional 2013

          • -
          • Project Professional 2013

          • -
          - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

            -
          • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

          • -
          • For more information, see ExcludeApp element.

          • -

          Modify the DeploymentConfig.xml file

            -
          • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

          • -
          • For more information, see Disabling Office 2013 applications.

          • -
          - - - -## Creating an Office 2013 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2013 package for App-V 5.1 or later. - -**Important** -In App-V 5.1 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - - - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
          PrerequisiteDescription

          Prerequisite software

          .Net Framework 4

          Supported operating systems

            -
          • 64-bit version of Windows 8 or later

          • -
          • 64-bit version of Windows 7

          • -
          - - - -**Note** -In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing. - - - -### Create Office 2013 App-V Packages Using Office Deployment Tool - -You create Office 2013 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing. - -Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. - -### Download the Office Deployment Tool - -Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778). - -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2013 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2013 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. After getting the Office applications, you create the Office 2013 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - **Note** - The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. - - - -~~~ - The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          InputDescriptionExample

          Add element

          Specifies the products and languages to include in the package.

          N/A

          OfficeClientEdition (attribute of Add element)

          Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

          OfficeClientEdition="32"

          -

          OfficeClientEdition="64"

          Product element

          Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.

          Product ID ="O365ProPlusRetail "

          -

          Product ID ="VisioProRetail"

          -

          Product ID ="ProjectProRetail"

          -

          Product ID ="ProPlusVolume"

          -

          Product ID ="VisioProVolume"

          -

          Product ID = "ProjectProVolume"

          Language element

          Specifies the language supported in the applications

          Language ID="en-us"

          Version (attribute of Add element)

          Optional. Specifies a build to use for the package

          -

          Defaults to latest advertised build (as defined in v32.CAB at the Office source).

          15.1.2.3

          SourcePath (attribute of Add element)

          Specifies the location in which the applications will be saved to.

          Sourcepath = "\\Server\Office2013”

          - - - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. -~~~ - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details: - - ``` syntax - \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2013

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /download

          downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.

          \server\Office2013\Customconfig.xml

          passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2013.

          - - - -### Convert the Office applications into an App-V package - -After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8, and Windows 10 computers. - -- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Product IDVolume LicensingSubscription Licensing

          Office 2013

          ProPlusVolume

          O365ProPlusRetail

          Office 2013 with Visio 2013

          ProPlusVolume

          -

          VisioProVolume

          O365ProPlusRetail

          -

          VisioProRetail

          Office 2013 with Visio 2013 and Project 2013

          ProPlusVolume

          -

          VisioProVolume

          -

          ProjectProVolume

          O365ProPlusRetail

          -

          VisioProRetail

          -

          ProjectProRetail

          - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterWhat to change the value to

          SourcePath

          Point to the Office applications downloaded earlier.

          ProductID

          Specify the type of licensing, as shown in the following examples:

          -
            -
          • Subscription Licensing

            -
            <Configuration>
            -      <Add SourcePath= "\server\Office 2013" OfficeClientEdition="32" >
            -       <Product ID="O365ProPlusRetail">
            -         <Language ID="en-us" />
            -       </Product>
            -       <Product ID="VisioProRetail">
            -         <Language ID="en-us" />
            -       </Product>
            -     </Add>
            -   </Configuration> 
            -

            In this example, the following changes were made to create a package with Subscription licensing:

            - - - - - - - - - - - - - - - - - - - -

            SourcePath

            is the path, which was changed to point to the Office applications that were downloaded earlier.

            Product ID

            for Office was changed to O365ProPlusRetail.

            Product ID

            for Visio was changed to VisioProRetail.

            -

            -

          • -
          • Volume Licensing

            -
            <Configuration>
            -      <Add SourcePath= "\Server\Office2013" OfficeClientEdition="32" >
            -       <Product ID="ProPlusVolume">
            -         <Language ID="en-us" />
            -       </Product>
            -       <Product ID="VisioProVolume">
            -         <Language ID="en-us" />
            -       </Product>
            -     </Add>
            -   </Configuration>
            -

            In this example, the following changes were made to create a package with Volume licensing:

            - - - - - - - - - - - - - - - - - - - -

            SourcePath

            is the path, which was changed to point to the Office applications that were downloaded earlier.

            Product ID

            for Office was changed to ProPlusVolume.

            Product ID

            for Visio was changed to VisioProVolume.

            -

            -

          • -

          ExcludeApp (optional)

          Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

          PACKAGEGUID (optional)

          By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

          -

          An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.

          -
          - Note

          Even if you use unique package IDs, you can still deploy only one App-V package to a single device.

          -
          -
          - -
          - - - -2. Use the /packager command to convert the Office applications to an Office 2013 App-V package. - - For example: - - ``` syntax - \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml \\server\share\Office2013AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2013

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /packager

          creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.

          \server\Office2013\Customconfig.xml

          passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

          \server\share\Office 2013AppV

          specifies the location of the newly created Office App-V package.

          - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** -To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2013 App-V package works correctly: - - 1. Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear. - - 2. Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V 5.1 - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2013 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
          Prerequisite or requirementDetails

          Enable PowerShell scripting on the App-V clients

          To publish Office 2013 packages, you must run a script.

          -

          Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

          -
          Set-AppvClientConfiguration –EnablePackageScripts 1

          Publish the Office 2013 package globally

          Extension points in the Office App-V package require installation at the computer level.

          -

          When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

          - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2013 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2013 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2013 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Managing Office 2013 licensing upgrades](#bkmk-manage-office-lic-upgrd) - -- [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V 5.1 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. - -3. Create an App-V 5.1 package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - **Important** - The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2013 App-V package has. - - Since the Office 2013 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2013 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2013 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2013 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2013 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -**Note** -To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx). - - - -**To disable an Office 2013 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2013. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2013 App-V Package with the new Deployment Configuration File. - - ```xml - - - InfoPath Filler 2013 - - - - - - - Lync 2013 - - - - - - - Access 2013 - - - - - ``` - -6. Re-add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -### Disabling Office 2013 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2013 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2013\Access 2013.lnk - [{AppvPackageRoot}])office15\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office15\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2013 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2013 package upgrades - -To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2013 package, perform the following steps. - -**How to upgrade a previously deployed Office 2013 package** - -1. Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - **Note** - Office App-V packages have two Version IDs: - - - An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. - - - A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package. - - - -2. Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - -### Managing Office 2013 licensing upgrades - -If a new Office 2013 App-V Package has a different license than the Office 2013 App-V Package currently deployed. For instance, the Office 2013 package deployed is a subscription based Office 2013 and the new Office 2013 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: - -**How to upgrade an Office 2013 License** - -1. Unpublish the already deployed Office 2013 Subscription Licensing App-V package. - -2. Remove the unpublished Office 2013 Subscription Licensing App-V package. - -3. Restart the computer. - -4. Add the new Office 2013 App-V Package Volume Licensing. - -5. Publish the added Office 2013 App-V Package with Volume Licensing. - -An Office 2013 App-V Package with your chosen licensing will be successfully deployed. - -### Deploying Visio 2013 and Project 2013 with Office - -The following table describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          How do I package and publish Visio 2013 and Project 2013 with Office?

          You must include Visio 2013 and Project 2013 in the same package with Office.

          -

          If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow Deploying Microsoft Office 2010 by Using App-V.

          How can I deploy Visio 2013 and Project 2013 to specific users?

          Use one of the following methods:

          - ---- - - - - - - - - - - - - - - - - -
          If you want to......then use this method

          Create two different packages and deploy each one to a different group of users

          Create and deploy the following packages:

          -
            -
          • A package that contains only Office - deploy to computers whose users need only Office.

          • -
          • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

          • -

          If you want only one package for the whole organization, or if you have users who share computers:

          Follows these steps:

          -
            -
          1. Create a package that contains Office, Visio, and Project.

          2. -
          3. Deploy the package to all users.

          4. -
          5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

          6. -
          -

          - - - -## Additional resources - - -**Office 2013 App-V Packages Additional Resources** - -[Office Deployment Tool for Click-to-Run](https://go.microsoft.com/fwlink/p/?LinkID=330672) - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups51.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md deleted file mode 100644 index 4dbf7f3b64..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md +++ /dev/null @@ -1,796 +0,0 @@ ---- -title: Deploying Microsoft Office 2016 by Using App-V -description: Deploying Microsoft Office 2016 by Using App-V -author: dansimp -ms.assetid: cc675cde-cb8d-4b7c-a700-6104b78f1d89 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 07/25/2017 ---- - - -# Deploying Microsoft Office 2016 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization 5.0, or later versions, to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md). - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2016 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.0](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2016 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
          Information to reviewDescription

          Supported versions of Microsoft Office

            -
          • Supported versions of Office

          • -
          • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

          • -
          • Office licensing options

          • -

          Planning for Using App-V with coexisting versions of Office

          Considerations for installing different versions of Office on the same computer

          - - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskRequirement

          Packaging

          -
            -
          • All of the Office applications that you want to deploy to users must be in a single package.

          • -
          • In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

          • -
          • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2016 and Project 2016 with Office.

          • -

          Publishing

            -
          • You can publish only one Office package to each client computer.

          • -
          • You must publish the Office package globally. You cannot publish to the user.

          • -

          Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

          -
            -
          • Office 365 ProPlus

          • -
          • Visio Pro for Office 365

          • -
          • Project Pro for Office 365

          • -

          You must enable shared computer activation.

          -
          - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

            -
          • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

          • -
          • For more information, see ExcludeApp element.

          • -

          Modify the DeploymentConfig.xml file

            -
          • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

          • -
          • For more information, see Disabling Office 2016 applications.

          • -
          - - - -## Creating an Office 2016 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2016 package for App-V 5.0 or later. - ->**Important**  In App-V 5.0 and later, you must use the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
          PrerequisiteDescription

          Prerequisite software

          .Net Framework 4

          Supported operating systems

            -
          • 64-bit version of Windows 10

          • -
          • 64-bit version of Windows 8 or 8.1

          • -
          • 64-bit version of Windows 7

          • -
          - - ->**Note** In this topic, the term “Office 2016 App-V package” refers to subscription licensing. - - -### Create Office 2016 App-V Packages Using Office Deployment Tool - -You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with Subscription Licensing. - -Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. - -### Download the Office Deployment Tool - -Office 2016 App-V Packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). - -> **Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages. -> 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2016 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2016 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - >**Note** The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line. - - The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          InputDescriptionExample

          Add element

          Specifies the products and languages to include in the package.

          N/A

          OfficeClientEdition (attribute of Add element)

          Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

          OfficeClientEdition="32"

          -

          OfficeClientEdition="64"

          Product element

          Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications. - - For more information about the product IDs, see Product IDs that are supported by the Office Deployment Tool for Click-to-Run -

          Product ID ="O365ProPlusRetail "

          -

          Product ID ="VisioProRetail"

          -

          Product ID ="ProjectProRetail"

          -

          Language element

          Specifies the language supported in the applications

          Language ID="en-us"

          Version (attribute of Add element)

          Optional. Specifies a build to use for the package

          -

          Defaults to latest advertised build (as defined in v32.CAB at the Office source).

          16.1.2.3

          SourcePath (attribute of Add element)

          Specifies the location in which the applications will be saved to.

          Sourcepath = "\Server\Office2016”

          Channel (attribute of Add element)

          Optional. Specifies the update channel for the product that you want to download or install.

          For more information about update channels, see Overview of update channels for Office 365 ProPlus.

          Channel="Deferred"

          - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details: - - ``` syntax - \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2016

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /download

          downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.

          \server\Office2016\Customconfig.xml

          passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2016.

          - - - -### Convert the Office applications into an App-V package - -After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers. - -- Create an Office App-V package for Subscription Licensing package by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - ->**Note**  You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Product IDSubscription Licensing

          Office 2016

          O365ProPlusRetail

          Office 2016 with Visio 2016

          O365ProPlusRetail

          -

          VisioProRetail

          Office 2016 with Visio 2016 and Project 2016

          O365ProPlusRetail

          -

          VisioProRetail

          -

          ProjectProRetail

          - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterWhat to change the value to

          SourcePath

          Point to the Office applications downloaded earlier.

          ProductID

          Specify Subscription licensing, as shown in the following example:

          -
          <Configuration>
          -      <Add SourcePath= "\server\Office 2016" OfficeClientEdition="32" >
          -       <Product ID="O365ProPlusRetail">
          -         <Language ID="en-us" />
          -       </Product>
          -       <Product ID="VisioProRetail">
          -         <Language ID="en-us" />
          -       </Product>
          -     </Add>
          -   </Configuration> 
          -

          In this example, the following changes were made to create a package with Subscription licensing:

          - - - - - - - - - - - - - - - - - - - -

          SourcePath

          is the path, which was changed to point to the Office applications that were downloaded earlier.

          Product ID

          for Office was changed to O365ProPlusRetail.

          Product ID

          for Visio was changed to VisioProRetail.

          -

          -

          ExcludeApp (optional)

          Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

          PACKAGEGUID (optional)

          By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

          -

          An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.

          - >Note Even if you use unique package IDs, you can still deploy only one App-V package to a single device. -
          - - - -2. Use the /packager command to convert the Office applications to an Office 2016 App-V package. - - For example: - - ``` syntax - \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2016

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /packager

          creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.

          \server\Office2016\Customconfig.xml

          passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

          \server\share\Office 2016AppV

          specifies the location of the newly created Office App-V package.

          - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2016 App-V package works correctly: - - 1. Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear. - - 2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2016 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
          Prerequisite or requirementDetails

          Enable PowerShell scripting on the App-V clients

          To publish Office 2016 packages, you must run a script.

          -

          Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

          -
          Set-AppvClientConfiguration –EnablePackageScripts 1

          Publish the Office 2016 package globally

          Extension points in the Office App-V package require installation at the computer level.

          -

          When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

          - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2016 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2016 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2016 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. - -3. Create an App-V package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2016 App-V package has. - - Since the Office 2016 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2016 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2016 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2016 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2016 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - ->**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. - - -**To disable an Office 2016 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2016. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2016 App-V Package with the new Deployment Configuration File. - - ```xml - - - Lync 2016 - - - - - - - Access 2016 - - - - - ``` - -6. Re-add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - -### Disabling Office 2016 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2016 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2016\Access 2016.lnk - [{AppvPackageRoot}])office16\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office16\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2016 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2016 package upgrades - -To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2016 package, perform the following steps. - -**How to upgrade a previously deployed Office 2016 package** - -1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - > **Note** Office App-V packages have two Version IDs: - >
            - >
          • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
          • - >
          • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
          • - >
          - - -2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - - -### Deploying Visio 2016 and Project 2016 with Office - -The following table describes the requirements and options for deploying Visio 2016 and Project 2016 with Office. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          How do I package and publish Visio 2016 and Project 2016 with Office?

          You must include Visio 2016 and Project 2016 in the same package with Office.

          -

          If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic.

          How can I deploy Visio 2016 and Project 2016 to specific users?

          Use one of the following methods:

          - ---- - - - - - - - - - - - - - - - - -
          If you want to......then use this method

          Create two different packages and deploy each one to a different group of users

          Create and deploy the following packages:

          -
            -
          • A package that contains only Office - deploy to computers whose users need only Office.

          • -
          • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

          • -

          If you want only one package for the whole organization, or if you have users who share computers:

          Follows these steps:

          -
            -
          1. Create a package that contains Office, Visio, and Project.

          2. -
          3. Deploy the package to all users.

          4. -
          5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

          6. -
          -

          - - - -## Additional resources - - -[Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) - -[Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) - -[Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md deleted file mode 100644 index 317e8df4e7..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md +++ /dev/null @@ -1,795 +0,0 @@ ---- -title: Deploying Microsoft Office 2016 by Using App-V -description: Deploying Microsoft Office 2016 by Using App-V -author: dansimp -ms.assetid: e0f4876-da99-4b89-977e-2fb6e89ea3d3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Deploying Microsoft Office 2016 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization (App-V) 5.1, or later versions, to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v51.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md). - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2016 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.1](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2016 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
          Information to reviewDescription

          Supported versions of Microsoft Office

            -
          • Supported versions of Office

          • -
          • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

          • -
          • Office licensing options

          • -

          Planning for Using App-V with coexisting versions of Office

          Considerations for installing different versions of Office on the same computer

          - - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskRequirement

          Packaging

          -
            -
          • All of the Office applications that you want to deploy to users must be in a single package.

          • -
          • In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

          • -
          • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2016 and Project 2016 with Office.

          • -

          Publishing

            -
          • You can publish only one Office package to each client computer.

          • -
          • You must publish the Office package globally. You cannot publish to the user.

          • -

          Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

          -
            -
          • Office 365 ProPlus

          • -
          • Visio Pro for Office 365

          • -
          • Project Pro for Office 365

          • -

          You must enable shared computer activation.

          -
          - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

            -
          • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

          • -
          • For more information, see ExcludeApp element.

          • -

          Modify the DeploymentConfig.xml file

            -
          • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

          • -
          • For more information, see Disabling Office 2016 applications.

          • -
          - - - -## Creating an Office 2016 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2016 package for App-V 5.1 or later. - ->**Important**  In App-V 5.1 and later, you must use the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
          PrerequisiteDescription

          Prerequisite software

          .Net Framework 4

          Supported operating systems

            -
          • 64-bit version of Windows 10

          • -
          • 64-bit version of Windows 8 or 8.1

          • -
          • 64-bit version of Windows 7

          • -
          - - ->**Note** In this topic, the term “Office 2016 App-V package” refers to subscription licensing. - - -### Create Office 2016 App-V Packages Using Office Deployment Tool - -You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with Subscription Licensing. - -Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. - -### Download the Office Deployment Tool - -Office 2016 App-V Packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). - -> **Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages. -> 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2016 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2016 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - >**Note** The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line. - - The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          InputDescriptionExample

          Add element

          Specifies the products and languages to include in the package.

          N/A

          OfficeClientEdition (attribute of Add element)

          Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

          OfficeClientEdition="32"

          -

          OfficeClientEdition="64"

          Product element

          Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications. - - For more information about the product IDs, see Product IDs that are supported by the Office Deployment Tool for Click-to-Run -

          Product ID ="O365ProPlusRetail "

          -

          Product ID ="VisioProRetail"

          -

          Product ID ="ProjectProRetail"

          -

          Language element

          Specifies the language supported in the applications

          Language ID="en-us"

          Version (attribute of Add element)

          Optional. Specifies a build to use for the package

          -

          Defaults to latest advertised build (as defined in v32.CAB at the Office source).

          16.1.2.3

          SourcePath (attribute of Add element)

          Specifies the location in which the applications will be saved to.

          Sourcepath = "\Server\Office2016”

          Branch (attribute of Add element)

          Optional. Specifies the update branch for the product that you want to download or install.

          For more information about update branches, see Overview of update branches for Office 365 ProPlus.

          Branch = "Business"

          - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details: - - ``` syntax - \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2016

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /download

          downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.

          \server\Office2016\Customconfig.xml

          passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2016.

          - - - -### Convert the Office applications into an App-V package - -After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers. - -- Create an Office App-V package for Subscription Licensing package by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - ->**Note**  You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Product IDSubscription Licensing

          Office 2016

          O365ProPlusRetail

          Office 2016 with Visio 2016

          O365ProPlusRetail

          -

          VisioProRetail

          Office 2016 with Visio 2016 and Project 2016

          O365ProPlusRetail

          -

          VisioProRetail

          -

          ProjectProRetail

          - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterWhat to change the value to

          SourcePath

          Point to the Office applications downloaded earlier.

          ProductID

          Specify Subscription licensing, as shown in the following example:

          -
          <Configuration>
          -      <Add SourcePath= "\server\Office 2016" OfficeClientEdition="32" >
          -       <Product ID="O365ProPlusRetail">
          -         <Language ID="en-us" />
          -       </Product>
          -       <Product ID="VisioProRetail">
          -         <Language ID="en-us" />
          -       </Product>
          -     </Add>
          -   </Configuration> 
          -

          In this example, the following changes were made to create a package with Subscription licensing:

          - - - - - - - - - - - - - - - - - - - -

          SourcePath

          is the path, which was changed to point to the Office applications that were downloaded earlier.

          Product ID

          for Office was changed to O365ProPlusRetail.

          Product ID

          for Visio was changed to VisioProRetail.

          -

          -

          ExcludeApp (optional)

          Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

          PACKAGEGUID (optional)

          By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

          -

          An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.

          - - >Note Even if you use unique package IDs, you can still deploy only one App-V package to a single device. -
          - - -2. Use the /packager command to convert the Office applications to an Office 2016 App-V package. - - For example: - - ``` syntax - \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          \server\Office2016

          is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

          Setup.exe

          is the Office Deployment Tool.

          /packager

          creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.

          \server\Office2016\Customconfig.xml

          passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

          \server\share\Office 2016AppV

          specifies the location of the newly created Office App-V package.

          - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2016 App-V package works correctly: - - 1. Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear. - - 2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2016 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
          Prerequisite or requirementDetails

          Enable PowerShell scripting on the App-V clients

          To publish Office 2016 packages, you must run a script.

          -

          Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

          -
          Set-AppvClientConfiguration –EnablePackageScripts 1

          Publish the Office 2016 package globally

          Extension points in the Office App-V package require installation at the computer level.

          -

          When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

          - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2016 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2016 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2016 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. - -3. Create an App-V package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2016 App-V package has. - - Since the Office 2016 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2016 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2016 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2016 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2016 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - ->**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. - - -**To disable an Office 2016 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2016. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2016 App-V Package with the new Deployment Configuration File. - - ```xml - - - Lync 2016 - - - - - - - Access 2016 - - - - - ``` - -6. Re-add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - -### Disabling Office 2016 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2016 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2016\Access 2016.lnk - [{AppvPackageRoot}])office16\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office16\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2016 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2016 package upgrades - -To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2016 package, perform the following steps. - -**How to upgrade a previously deployed Office 2016 package** - -1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - > **Note** Office App-V packages have two Version IDs: - >
            - >
          • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
          • - >
          • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
          • - >
          - - -2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - - -### Deploying Visio 2016 and Project 2016 with Office - -The following table describes the requirements and options for deploying Visio 2016 and Project 2016 with Office. - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          How do I package and publish Visio 2016 and Project 2016 with Office?

          You must include Visio 2016 and Project 2016 in the same package with Office.

          -

          If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic.

          How can I deploy Visio 2016 and Project 2016 to specific users?

          Use one of the following methods:

          - ---- - - - - - - - - - - - - - - - - -
          If you want to......then use this method

          Create two different packages and deploy each one to a different group of users

          Create and deploy the following packages:

          -
            -
          • A package that contains only Office - deploy to computers whose users need only Office.

          • -
          • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

          • -

          If you want only one package for the whole organization, or if you have users who share computers:

          Follows these steps:

          -
            -
          1. Create a package that contains Office, Visio, and Project.

          2. -
          3. Deploy the package to all users.

          4. -
          5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

          6. -
          -

          - - -## Additional resources - - -[Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) - -[Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) - -[Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md b/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md deleted file mode 100644 index 1ad01a6915..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Deploying the App-V 5.0 Sequencer and Client -description: Deploying the App-V 5.0 Sequencer and Client -author: dansimp -ms.assetid: 84cc84bd-5bc0-41aa-9519-0ded2932c078 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Deploying the App-V 5.0 Sequencer and Client - - -The App-V 5.0 Sequencer and client enable administrators to virtualize and run virtualized applications. - -## Deploy the client - - -The App-V 5.0 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and to double-click file types, so that they can start a virtualized application. The client can also obtain the virtual application content from the management server. - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - -[How to Uninstall the App-V 5.0 Client](how-to-uninstall-the-app-v-50-client.md) - -[How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) - -## Client Configuration Settings - - -The App-V 5.0 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. - -[About Client Configuration Settings](about-client-configuration-settings.md) - -## Configure the client by using the ADMX template and Group Policy - - -You can use the Microsoft ADMX template to configure the client settings for the App-V 5.0 client and the Remote Desktop Services client. The ADMX template manages common client configurations by using an existing Group Policy infrastructure and it includes settings for the App-V 5.0 client configuration. - -**Important**   -You can obtain the App-V 5.0 ADMX template from the Microsoft Download Center. - - - -After you download and install the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller. - -1. Save the **.admx** file to the following directory: **Windows \\ PolicyDefinitions** - -2. Save the **.adml** file to the following directory: **Windows \\ PolicyDefinitions \\ <Language Directory>** - -After you have completed the preceding steps, you can manage the App-V 5.0 client configuration settings with the **Group Policy Management** console. - -The App-V 5.0 client also stores its configuration in the registry. You can gather some useful information about the client if you understand the format of the data in the registry. You can also configure many client actions by changing registry entries. - -[How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md) - -## Deploy the client by using the Shared Content Store mode - - -The App-V 5.0 Shared Content Store (SCS) mode enables the SCS App-V 5.0 clients to run virtualized applications without saving any of the associated package data locally. All required virtualized package data is transmitted across the network; therefore, you should only use the SCS mode in environments with a fast connection. Both the Remote Desktop Services (RDS) and the standard version of the App-V 5.0 client are supported with SCS mode. - -**Important**   -If the App-V 5.0 client is configured to run in the SCS mode, the location where the App-V 5.0 packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V 5.0 client in the SCS mode across the internet. - - - -Additionally, the SCS is not a physical location that contains virtualized packages. It is a mode that allows the App-V 5.0 client to stream the required virtualized package data across the network. - -The SCS mode is helpful in the following scenarios: - -- Virtual desktop infrastructure (VDI) deployments - -- Remote desktop services (RDS) deployments - -To use SCS in your environment, you must enable the App-V 5.0 client to run in SCS mode. This setting should be specified during installation. By default, the client is not configured to use SCS mode. You should install the client by using the suggested procedure if you plan to use SCS. However, you can configure an existing App-V 5.0 client to run in SCS mode by entering the following PowerShell command on the computer that runs the App-V 5.0 client: - -**set-AppvClientConfiguration -SharedContentStoreMode 1** - -There might be cases when the administrator pre-loads some virtual applications on the computer that runs the App-V 5.0 client in SCS mode. This can be accomplished with PowerShell commands to add, publish, and mount the package. For example, if a package is pre-loaded on all computers, the administrator could add, publish, and mount the package by using PowerShell commands. The package would not stream across the network because it would be locally stored. - -[How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md) - -## Deploy the Sequencer - - -The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V 5.0 client. The Sequencer helps provide a simple and predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. - -For a list of changes in the App-V 5.0 Sequencer, see [What's New in App-V 5.0](whats-new-in-app-v-50.md). - -[How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) - -## App-V 5.0 Client and Sequencer logs - - -You can use the App-V 5.0 Sequencer log information to help troubleshoot the Sequencer installation and operational events while using App-V 5.0. The Sequencer-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Sequencer-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V**. Sequencer-related events are prepended with **AppV\_Sequencer**. Client-related events are prepended with **AppV\_Client**. - -In App-V 5.0 SP3, some logs have been consolidated. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - -## Other resources for deploying the Sequencer and client - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[Planning for App-V 5.0](planning-for-app-v-50-rc.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-50-server.md b/mdop/appv-v5/deploying-the-app-v-50-server.md deleted file mode 100644 index a9c5cecc6e..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-50-server.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Deploying the App-V 5.0 Server -description: Deploying the App-V 5.0 Server -author: dansimp -ms.assetid: a47f0dc8-2971-4e4d-8d57-6b69bbed4b63 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the App-V 5.0 Server - - -You can install the App-V 5.0 server features by using different deployment configurations, which described in this topic. Before you install the server features, review the server section of [App-V 5.0 Security Considerations](app-v-50-security-considerations.md). - -For information about deploying the App-V 5.0 SP3 Server, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-migrate-to-50sp3). - -**Important**   -Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. - - - -## App-V 5.0 Server overview - - -The App-V 5.0 Server is made up of five components. Each component serves a different purpose within the App-V 5.0 environment. Each of the five components is briefly described here: - -- Management Server – provides overall management functionality for the App-V 5.0 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.0 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.0 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.0 reporting. - -## App-V 5.0 stand-alone deployment - - -The App-V 5.0 standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V 5.0 components. Therefore, you should not use this topology for larger deployments. - -[How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) - -[How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) - -## App-V 5.0 Server distributed deployment - - -The distributed deployment topology can support a large App-V 5.0 client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V 5.0 Server components are deployed across multiple computers, based on the structure and requirements of the organization. - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md) - -[How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md) - -[How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer.md) - -[How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md) - -## Using an Enterprise Software Distribution (ESD) solution and App-V 5.0 - - -You can also deploy the App-V 5.0 clients and packages by using an ESD without having to deploy App-V 5.0. The full capabilities for integration will vary depending on the ESD that you use. - -**Note**   -The App-V 5.0 reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V 5.0 clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality. - - - -[Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) - -## App-V 5.0 Server logs - - -You can use App-V 5.0 server log information to help troubleshoot the server installation and operational events while using App-V 5.0. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** - -Associated setup logs are saved in the following directory: - -**%temp%** - -In App-V 5.0 SP3, some logs have been consolidated and moved. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - -## App-V 5.0 reporting - - -App-V 5.0 reporting allows App-V 5.0 clients to collect data and then send it back to be stored in a central repository. You can use this information to get a better view of the virtual application usage within your organization. The following list displays some of the types of information the App-V 5.0 client collects: - -- Information about the computer that runs the App-V 5.0 client. - -- Information about virtualized packages on a specific computer that runs the App-V 5.0 client. - -- Information about package open and shutdown for a specific user. - -The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services to generate any necessary reports. - -If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V 5.0 reporting server and it must be deployed separately to generate the associated reports. - -Use the following link for more information [About App-V 5.0 Reporting](about-app-v-50-reporting.md). - -[How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) - -## Other resources for the App-V server - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md b/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md deleted file mode 100644 index 0811cc8ca8..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Deploying the App-V 5.1 Sequencer and Client -description: Deploying the App-V 5.1 Sequencer and Client -author: dansimp -ms.assetid: 74f32794-4c76-436f-a542-f9e95d89063d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Deploying the App-V 5.1 Sequencer and Client - - -The Microsoft Application Virtualization (App-V) 5.1 Sequencer and client enable administrators to virtualize and run virtualized applications. - -## Deploy the client - - -The App-V 5.1 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and to double-click file types, so that they can start a virtualized application. The client can also obtain the virtual application content from the management server. - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -[How to Uninstall the App-V 5.1 Client](how-to-uninstall-the-app-v-51-client.md) - -[How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) - -## Client Configuration Settings - - -The App-V 5.1 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. - -[About Client Configuration Settings](about-client-configuration-settings51.md) - -## Configure the client by using the ADMX template and Group Policy - - -You can use the Microsoft ADMX template to configure the client settings for the App-V 5.1 client and the Remote Desktop Services client. The ADMX template manages common client configurations by using an existing Group Policy infrastructure and it includes settings for the App-V 5.1 client configuration. - -**Important**   -You can obtain the App-V 5.1 ADMX template from the Microsoft Download Center. - - - -After you download and install the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller. - -1. Save the **.admx** file to the following directory: **Windows \\ PolicyDefinitions** - -2. Save the **.adml** file to the following directory: **Windows \\ PolicyDefinitions \\ <Language Directory>** - -After you have completed the preceding steps, you can manage the App-V 5.1 client configuration settings with the **Group Policy Management** console. - -The App-V 5.1 client also stores its configuration in the registry. You can gather some useful information about the client if you understand the format of the data in the registry. You can also configure many client actions by changing registry entries. - -[How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md) - -## Deploy the client by using the Shared Content Store mode - - -The App-V 5.1 Shared Content Store (SCS) mode enables the SCS App-V 5.1 clients to run virtualized applications without saving any of the associated package data locally. All required virtualized package data is transmitted across the network; therefore, you should only use the SCS mode in environments with a fast connection. Both the Remote Desktop Services (RDS) and the standard version of the App-V 5.1 client are supported with SCS mode. - -**Important**   -If the App-V 5.1 client is configured to run in the SCS mode, the location where the App-V 5.1 packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V 5.1 client in the SCS mode across the internet. - - - -Additionally, the SCS is not a physical location that contains virtualized packages. It is a mode that allows the App-V 5.1 client to stream the required virtualized package data across the network. - -The SCS mode is helpful in the following scenarios: - -- Virtual desktop infrastructure (VDI) deployments - -- Remote desktop services (RDS) deployments - -To use SCS in your environment, you must enable the App-V 5.1 client to run in SCS mode. This setting should be specified during installation. By default, the client is not configured to use SCS mode. You should install the client by using the suggested procedure if you plan to use SCS. However, you can configure an existing App-V 5.1 client to run in SCS mode by entering the following PowerShell command on the computer that runs the App-V 5.1 client: - -**set-AppvClientConfiguration -SharedContentStoreMode 1** - -There might be cases when the administrator pre-loads some virtual applications on the computer that runs the App-V 5.1 client in SCS mode. This can be accomplished with PowerShell commands to add, publish, and mount the package. For example, if a package is pre-loaded on all computers, the administrator could add, publish, and mount the package by using PowerShell commands. The package would not stream across the network because it would be locally stored. - -[How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md) - -## Deploy the Sequencer - - -The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V 5.1 client. The Sequencer helps provide a simple and predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. - -For a list of changes in the App-V 5.1 Sequencer, see [About App-V 5.1](about-app-v-51.md). - -[How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) - -## App-V 5.1 Client and Sequencer logs - - -You can use the App-V 5.1 Sequencer log information to help troubleshoot the Sequencer installation and operational events while using App-V 5.1. The Sequencer-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Sequencer-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V**. Sequencer-related events are prepended with **AppV\_Sequencer**. Client-related events are prepended with **AppV\_Client**. - -## Other resources for deploying the Sequencer and client - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[Planning for App-V 5.1](planning-for-app-v-51.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-51-server.md b/mdop/appv-v5/deploying-the-app-v-51-server.md deleted file mode 100644 index 10380a684e..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-51-server.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Deploying the App-V 5.1 Server -description: Deploying the App-V 5.1 Server -author: dansimp -ms.assetid: 987b61dc-00d6-49ba-8f1b-92d7b948e702 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the App-V 5.1 Server - - -You can install the Microsoft Application Virtualization (App-V) 5.1 server features by using different deployment configurations, which described in this topic. Before you install the server features, review the server section of [App-V 5.1 Security Considerations](app-v-51-security-considerations.md). - -For information about deploying the App-V Server, see [About App-V 5.1](about-app-v-51.md#bkmk-migrate-to-51). - -**Important**   -Before you install and configure the App-V 5.1 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. - - - -## App-V 5.1 Server overview - - -The App-V 5.1 Server is made up of five components. Each component serves a different purpose within the App-V 5.1 environment. Each of the five components is briefly described here: - -- Management Server – provides overall management functionality for the App-V 5.1 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.1 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.1 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.1 reporting. - -## App-V 5.1 stand-alone deployment - - -The App-V 5.1 standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V 5.1 components. Therefore, you should not use this topology for larger deployments. - -[How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) - -[How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) - -## App-V 5.1 Server distributed deployment - - -The distributed deployment topology can support a large App-V 5.1 client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V 5.1 Server components are deployed across multiple computers, based on the structure and requirements of the organization. - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md) - -[How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) - -[How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer51.md) - -[How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) - -## Using an Enterprise Software Distribution (ESD) solution and App-V 5.1 - - -You can also deploy the App-V 5.1 clients and packages by using an ESD without having to deploy App-V 5.1. The full capabilities for integration will vary depending on the ESD that you use. - -**Note**   -The App-V 5.1 reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V 5.1 clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality. - - - -[Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) - -## App-V 5.1 Server logs - - -You can use App-V 5.1 server log information to help troubleshoot the server installation and operational events while using App-V 5.1. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** - -Associated setup logs are saved in the following directory: - -**%temp%** - -In App-V 5.0 SP3, some logs were consolidated and moved. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - -## App-V 5.1 reporting - - -App-V 5.1 reporting allows App-V 5.1 clients to collect data and then send it back to be stored in a central repository. You can use this information to get a better view of the virtual application usage within your organization. The following list displays some of the types of information the App-V 5.1 client collects: - -- Information about the computer that runs the App-V 5.1 client. - -- Information about virtualized packages on a specific computer that runs the App-V 5.1 client. - -- Information about package open and shutdown for a specific user. - -The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services to generate any necessary reports. - -If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V 5.1 reporting server and it must be deployed separately to generate the associated reports. - -Use the following link for more information [About App-V 5.1 Reporting](about-app-v-51-reporting.md). - -[How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md) - -## Other resources for the App-V server - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/evaluating-app-v-50.md b/mdop/appv-v5/evaluating-app-v-50.md deleted file mode 100644 index 1b2cc2ac24..0000000000 --- a/mdop/appv-v5/evaluating-app-v-50.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Evaluating App-V 5.0 -description: Evaluating App-V 5.0 -author: dansimp -ms.assetid: 0b4a6b12-559d-429f-9659-dc8f4883feab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating App-V 5.0 - - -Before you deploy Microsoft Application Virtualization (App-V) 5.0 into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V 5.0 in a lab environment for evaluation purposes only. - -## Configure lab computers for App-V 5.0 Evaluation - - -Use the following link for information about setting up the App-V 5.0 sequencer on a computer in your lab environment. - -### Installing the App-V 5.0 Sequencer and Creating Packages - -Use the following links for information about setting up the App-V 5.0 sequencer and creating packages in your lab environment. - -- [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) - -- [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) - -### Configuring the App-V 5.0 Server - -Use the following links for information about setting up the App-V 5.0 server in your lab environment. - -- [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) - -- [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) - -### Installing the App-V 5.0 Client - -Use the following link for more information about creating and managing virtualized packages in your lab environment. - -- [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md) - - - - - - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/evaluating-app-v-51.md b/mdop/appv-v5/evaluating-app-v-51.md deleted file mode 100644 index 84facb34f4..0000000000 --- a/mdop/appv-v5/evaluating-app-v-51.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Evaluating App-V 5.1 -description: Evaluating App-V 5.1 -author: dansimp -ms.assetid: 92d80b23-3eca-4be3-a771-e700ad1470db -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating App-V 5.1 - - -Before you deploy Microsoft Application Virtualization (App-V) 5.1 into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V 5.1 in a lab environment for evaluation purposes only. - -## Configure lab computers for App-V 5.1 Evaluation - - -Use the following link for information about setting up the App-V 5.1 sequencer on a computer in your lab environment. - -### Installing the App-V 5.1 Sequencer and Creating Packages - -Use the following links for information about setting up the App-V 5.1 sequencer and creating packages in your lab environment. - -- [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) - -- [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) - -### Configuring the App-V 5.1 Server - -Use the following links for information about setting up the App-V 5.1 server in your lab environment. - -- [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) - -- [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) - -### Installing the App-V 5.1 Client - -Use the following link for more information about creating and managing virtualized packages in your lab environment. - -- [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md) - - - - - - -## Related topics - - -[Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/getting-started-with-app-v-50--rtm.md b/mdop/appv-v5/getting-started-with-app-v-50--rtm.md deleted file mode 100644 index 861662bca5..0000000000 --- a/mdop/appv-v5/getting-started-with-app-v-50--rtm.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Getting Started with App-V 5.0 -description: Getting Started with App-V 5.0 -author: dansimp -ms.assetid: 3e16eafb-ce95-4d06-b214-fe0f4b1b495f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with App-V 5.0 - - -App-V 5.0 enables administrators to deploy, update, and support applications as services in real time, on an as-needed basis. Individual applications are transformed from locally installed products into centrally managed services and are available wherever you need, without the need to preconfigure computers or to change operating system settings. - -App-V consists of the following elements: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ElementDescription

          App-V Management Server

            -
          • Provides a central location for managing the App-V infrastructure, which delivers virtual applications to both the App-V Desktop Client and the Remote Desktop Services (formerly Terminal Services) Client.

          • -
          • Uses Microsoft SQL Server® for its data store, where one or more App-V Management servers can share a single SQL Server data store.

          • -
          • Authenticates requests and provides security, metering, monitoring, and data gathering. The server uses Active Directory and supporting tools to manage users and applications.

          • -
          • Has a Silverlight®-based management site, which enables you to configure the App-V infrastructure from any computer. You can add and remove applications, manipulate shortcuts, assign access permissions to users and groups, and create connection groups.

          • -
          • Enables communication between the App-V Web Management Console and the SQL Server data store. These components can all be installed on a single server computer, or on one or more separate computers, depending on the required system architecture.

          • -

          App-V Publishing Server

            -
          • Provides App-V Clients with entitled applications for the specific user

          • -
          • Hosts the virtual application package for streaming.

          • -

          App-V Desktop Client

            -
          • Retrieves virtual applications

          • -
          • Publishes the applications on the clients

          • -
          • Automatically sets up and manages virtual environments at runtime on Windows endpoints.

          • -
          • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.

          • -

          App-V Remote Desktop Services (RDS) Client

          Enables Remote Desktop Session Host servers to use the capabilities of the App-V Desktop Client for shared desktop sessions.

          App-V Sequencer

            -
          • Is a wizard-based tool that you use to transform traditional applications into virtual applications.

          • -
          • Produces the application “package,” which consists of:

            -
              -
            1. a sequenced application (APPV) file

            2. -
            3. a Windows Installer file (MSI) that can be deployed to clients configured for stand-alone operation

            4. -
            5. Several XML files including Report.XML, PackageName_DeploymentConfig.XML, and PackageName_UserConfig.XML. The UserConfig and DeploymentConfig XML files are used to configure custom changes to the default behavior of the package.

            6. -
          • -
          - - - -For more information about these elements, see [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md). - -If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272491). - - - -This section of the App-V 5.0 Administrator’s Guide includes high-level information about App-V 5.0 to provide you with a basic understanding of the product before you begin the deployment planning. - -## Getting started with App-V 5.0 - - -- [About App-V 5.0](about-app-v-50.md) - - Provides a high-level overview of App-V 5.0 and how it can be used in your organization. - -- [About App-V 5.0 SP1](about-app-v-50-sp1.md) - - Provides a high-level overview of App-V 5.0 SP1 and how it can be used in your organization. - -- [About App-V 5.0 SP2](about-app-v-50-sp2.md) - - Provides a high-level overview of App-V 5.0 SP2 and how it can be used in your organization. - -- [About App-V 5.0 SP3](about-app-v-50-sp3.md) - - Provides a high-level overview of App-V 5.0 SP2 and how it can be used in your organization. - -- [Evaluating App-V 5.0](evaluating-app-v-50.md) - - Provides information about how you can best evaluate App-V 5.0 for use in your organization. - -- [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md) - - Provides a description of the App-V 5.0 features and how they work together. - -- [Accessibility for App-V 5.0](accessibility-for-app-v-50.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/getting-started-with-app-v-51.md b/mdop/appv-v5/getting-started-with-app-v-51.md deleted file mode 100644 index f508e2c3a6..0000000000 --- a/mdop/appv-v5/getting-started-with-app-v-51.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Getting Started with App-V 5.1 -description: Getting Started with App-V 5.1 -author: dansimp -ms.assetid: 49a20e1f-0566-4e53-a417-1521393fc974 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with App-V 5.1 - - -Microsoft Application Virtualization (App-V) 5.1 enables administrators to deploy, update, and support applications as services in real time, on an as-needed basis. Individual applications are transformed from locally installed products into centrally managed services and are available wherever you need, without the need to preconfigure computers or to change operating system settings. - -App-V consists of the following elements: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ElementDescription

          App-V Management Server

            -
          • Provides a central location for managing the App-V infrastructure, which delivers virtual applications to both the App-V Desktop Client and the Remote Desktop Services (formerly Terminal Services) Client.

          • -
          • Uses Microsoft SQL Server® for its data store, where one or more App-V Management servers can share a single SQL Server data store.

          • -
          • Authenticates requests and provides security, metering, monitoring, and data gathering. The server uses Active Directory and supporting tools to manage users and applications.

          • -
          • Has a management site that lets you configure the App-V infrastructure from any computer. You can add and remove applications, manipulate shortcuts, assign access permissions to users and groups, and create connection groups.

          • -
          • Enables communication between the App-V Web Management Console and the SQL Server data store. These components can all be installed on a single server computer, or on one or more separate computers, depending on the required system architecture.

          • -

          App-V Publishing Server

            -
          • Provides App-V Clients with entitled applications for the specific user

          • -
          • Hosts the virtual application package for streaming.

          • -

          App-V Desktop Client

            -
          • Retrieves virtual applications

          • -
          • Publishes the applications on the clients

          • -
          • Automatically sets up and manages virtual environments at runtime on Windows endpoints.

          • -
          • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.

          • -

          App-V Remote Desktop Services (RDS) Client

          Enables Remote Desktop Session Host servers to use the capabilities of the App-V Desktop Client for shared desktop sessions.

          App-V Sequencer

            -
          • Is a wizard-based tool that you use to transform traditional applications into virtual applications.

          • -
          • Produces the application “package,” which consists of:

            -
              -
            1. a sequenced application (APPV) file

            2. -
            3. a Windows Installer file (MSI) that can be deployed to clients configured for stand-alone operation

            4. -
            5. Several XML files including Report.XML, PackageName_DeploymentConfig.XML, and PackageName_UserConfig.XML. The UserConfig and DeploymentConfig XML files are used to configure custom changes to the default behavior of the package.

            6. -
          • -
          - - - -For more information about these elements, see [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md). - -If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272491). - - - -This section of the App-V 5.1 Administrator’s Guide includes high-level information about App-V 5.1 to provide you with a basic understanding of the product before you begin the deployment planning. - -## Getting started with App-V 5.1 - - -- [About App-V 5.1](about-app-v-51.md) - - Provides a high-level overview of App-V 5.1 and how it can be used in your organization. - -- [Evaluating App-V 5.1](evaluating-app-v-51.md) - - Provides information about how you can best evaluate App-V 5.1 for use in your organization. - -- [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md) - - Provides a description of the App-V 5.1 features and how they work together. - -- [Accessibility for App-V 5.1](accessibility-for-app-v-51.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/high-level-architecture-for-app-v-50.md b/mdop/appv-v5/high-level-architecture-for-app-v-50.md deleted file mode 100644 index e23df5f0a1..0000000000 --- a/mdop/appv-v5/high-level-architecture-for-app-v-50.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: High Level Architecture for App-V 5.0 -description: High Level Architecture for App-V 5.0 -author: dansimp -ms.assetid: fdf8b841-918f-4672-b352-0f2b9519581b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High Level Architecture for App-V 5.0 - - -Use the following information to help you simplify you Microsoft Application Virtualization (App-V) 5.0 deployment. - -## Architecture Overview - - -A typical App-V 5.0 implementation consists of the following elements. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ElementMore information

          App-V 5.0 Management Server

          The App-V 5.0 Management server provides overall management functionality for the App-V 5.0 infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits:

          -
            -
          • Fault Tolerance and High Availability – Installing and configuring the App-V 5.0 Management server on two separate computers can help in situations when one of the servers is unavailable or offline.

            -

            You can also help increase App-V 5.0 availability by installing the Management server on multiple computers. In this scenario, a network load balancer should also be considered so that server requests are balanced.

          • -
          • Scalability – You can add additional management servers as necessary to support a high load, for example you can install multiple servers behind a load balancer.

          • -

          App-V 5.0 Publishing Server

          The App-V 5.0 publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols:

          -
            -
          • HTTP, and HTTPS

          • -
          -

          You can also help increase App-V 5.0 availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

          App-V 5.0 Reporting Server

          The App-V 5.0 Reporting server enables authorized users to run and view existing App-V 5.0 reports and ad hoc reports that can help them manage the App-V 5.0 infrastructure. The Reporting server requires a connection to the App-V 5.0 reporting database. You can also help increase App-V 5.0 availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

          App-V 5.0 Client

          The App-V 5.0 client enables packages created using App-V 5.0 to run on target computers.

          - - - -**Note**   -If you are using App-V 5.0 with Electronic Software Distribution (ESD) you are not required to use the App-V 5.0 Management server, however you can still utilize the reporting and streaming functionality of App-V 5.0. - - - - - - - - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - - - - - - - - diff --git a/mdop/appv-v5/high-level-architecture-for-app-v-51.md b/mdop/appv-v5/high-level-architecture-for-app-v-51.md deleted file mode 100644 index af616233b3..0000000000 --- a/mdop/appv-v5/high-level-architecture-for-app-v-51.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: High Level Architecture for App-V 5.1 -description: High Level Architecture for App-V 5.1 -author: dansimp -ms.assetid: 90406361-55b8-40b7-85c0-449436789d4c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High Level Architecture for App-V 5.1 - - -Use the following information to help you simplify you Microsoft Application Virtualization (App-V) 5.1 deployment. - -## Architecture Overview - - -A typical App-V 5.1 implementation consists of the following elements. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ElementMore information

          App-V 5.1 Management Server

          The App-V 5.1 Management server provides overall management functionality for the App-V 5.1 infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits:

          -
            -
          • Fault Tolerance and High Availability – Installing and configuring the App-V 5.1 Management server on two separate computers can help in situations when one of the servers is unavailable or offline.

            -

            You can also help increase App-V 5.1 availability by installing the Management server on multiple computers. In this scenario, a network load balancer should also be considered so that server requests are balanced.

          • -
          • Scalability – You can add additional management servers as necessary to support a high load, for example you can install multiple servers behind a load balancer.

          • -

          App-V 5.1 Publishing Server

          The App-V 5.1 publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols:

          -
            -
          • HTTP, and HTTPS

          • -
          -

          You can also help increase App-V 5.1 availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

          App-V 5.1 Reporting Server

          The App-V 5.1 Reporting server enables authorized users to run and view existing App-V 5.1 reports and ad hoc reports that can help them manage the App-V 5.1 infrastructure. The Reporting server requires a connection to the App-V 5.1 reporting database. You can also help increase App-V 5.1 availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

          App-V 5.1 Client

          The App-V 5.1 client enables packages created using App-V 5.1 to run on target computers.

          - - - -**Note**   -If you are using App-V 5.1 with Electronic Software Distribution (ESD) you are not required to use the App-V 5.1 Management server, however you can still utilize the reporting and streaming functionality of App-V 5.1. - - - - - - - - -## Related topics - - -[Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-access-the-client-management-console.md b/mdop/appv-v5/how-to-access-the-client-management-console.md deleted file mode 100644 index 90164220e0..0000000000 --- a/mdop/appv-v5/how-to-access-the-client-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Access the Client Management Console -description: How to Access the Client Management Console -author: dansimp -ms.assetid: 3f6303c7-f953-4623-8211-c20d1faa846b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Access the Client Management Console - - -Use the App-V 5.0 client management console to manage packages on the computer running the App-V 5.0 client. - -**Note**   -To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V 5.0 client. - - - -Use the following procedure to access the client management console. - -**To access the client management console** - -1. On the computer running the App-V 5.0 client, click **Start** and select **Microsoft Application Virtualization Client**. - - **Note**   - For computers running the App-V 5.0 Remote Desktop Services client version, to access client management console follow step 1 of this procedure on the server running the client. - - - -2. When the App-V 5.0 client management console is displayed, click the tab you want to review and perform any required tasks. For more information about the client management console tasks see, [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-access-the-client-management-console51.md b/mdop/appv-v5/how-to-access-the-client-management-console51.md deleted file mode 100644 index e98a45a0a3..0000000000 --- a/mdop/appv-v5/how-to-access-the-client-management-console51.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Access the Client Management Console -description: How to Access the Client Management Console -author: dansimp -ms.assetid: 22131251-acd5-44e7-a30b-7d389c518b6f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Access the Client Management Console - - -Use the App-V 5.1 client management console to manage packages on the computer running the App-V 5.1 client. - -**Note**   -To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V 5.1 client. - - - -Use the following procedure to access the client management console. - -**To access the client management console** - -1. On the computer running the App-V 5.1 client, click **Start** and select **Microsoft Application Virtualization Client**. - - **Note**   - For computers running the App-V 5.1 Remote Desktop Services client version, to access client management console follow step 1 of this procedure on the server running the client. - - - -2. When the App-V 5.1 client management console is displayed, click the tab you want to review and perform any required tasks. For more information about the client management console tasks see, [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md deleted file mode 100644 index 7f2daaca8d..0000000000 --- a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Add or Remove an Administrator by Using the Management Console -description: How to Add or Remove an Administrator by Using the Management Console -author: dansimp -ms.assetid: 0e8ab443-1931-4b1a-95df-6ccbecc9efc5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Remove an Administrator by Using the Management Console - - -Use the following procedures to add or remove an administrator on the App-V 5.0 server. - -**To add an administrator using the Management Console** - -1. Open the App-V 5.0 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of Access Directory (AD) users and groups that currently have administrative access to the App-V 5.0 server. - -2. To add a new administrator, click **Add Administrator** Type the name of the administrator that you want to add in the **Active Directory Name** field. Ensure you provide the associated user account domain name. For example, **Domain** \\ **UserName**. - -3. Select the account that you want to add and click **Add**. The new account is displayed in the list of server administrators. - -**To remove an administrator using the Management Console** - -1. Open the App-V 5.0 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the App-V 5.0 server. - -2. Right-click the account to be removed from the list of administrators and select **Remove**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md deleted file mode 100644 index e4d9c802e9..0000000000 --- a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Add or Remove an Administrator by Using the Management Console -description: How to Add or Remove an Administrator by Using the Management Console -author: dansimp -ms.assetid: 7ff8c436-9d2e-446a-9ea2-bbab7e25bf21 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Remove an Administrator by Using the Management Console - - -Use the following procedures to add or remove an administrator on the Microsoft Application Virtualization (App-V) 5.1 server. - -**To add an administrator using the Management Console** - -1. Open the Microsoft Application Virtualization (App-V) 5.1 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of Access Directory (AD) users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) 5.1 server. - -2. To add a new administrator, click **Add Administrator** Type the name of the administrator that you want to add in the **Active Directory Name** field. Ensure you provide the associated user account domain name. For example, **Domain** \\ **UserName**. - -3. Select the account that you want to add and click **Add**. The new account is displayed in the list of server administrators. - -**To remove an administrator using the Management Console** - -1. Open the Microsoft Application Virtualization (App-V) 5.1 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) 5.1 server. - -2. Right-click the account to be removed from the list of administrators and select **Remove**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md deleted file mode 100644 index 0d643c8054..0000000000 --- a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Add or Upgrade Packages by Using the Management Console -description: How to Add or Upgrade Packages by Using the Management Console -author: dansimp -ms.assetid: 62417b63-06b2-437c-8584-523e1dea97c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Upgrade Packages by Using the Management Console - - -You can the following procedure to add or upgrade a package to the App-V 5.1 Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. - -**To add a package to the Management Console** - -1. Click the **Packages** tab in the navigation pane of the Management Console display. - - The console displays the list of packages that have been added to the server along with status information about each package. When a package is selected, detailed information about the package is displayed in the **PACKAGES** pane. - - Click the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. - -2. To specify the package you want to add, click **Add or Upgrade Packages**. - -3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. - - **Important**   - You must select a package with the **.appv** file name extension. - - - -4. The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported. - - Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, click **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. - -5. Click **Close** to close the **Add or Upgrade Packages** page. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md deleted file mode 100644 index ac3caca510..0000000000 --- a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Add or Upgrade Packages by Using the Management Console -description: How to Add or Upgrade Packages by Using the Management Console -author: dansimp -ms.assetid: 4e389d7e-f402-44a7-bc4c-42c2a8440573 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Upgrade Packages by Using the Management Console - - -You can the following procedure to add or upgrade a package to the App-V 5.0 Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. - -**To add a package to the Management Console** - -1. Click the **Packages** tab in the navigation pane of the Management Console display. - - The console displays the list of packages that have been added to the server along with status information about each package. When a package is selected, detailed information about the package is displayed in the **PACKAGES** pane. - - Click the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. - -2. To specify the package you want to add, click **Add or Upgrade Packages**. - -3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. - - **Important**   - You must select a package with the **.appv** file name extension. - - - -4. The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported. - - Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, click **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. - -5. Click **Close** to close the **Add or Upgrade Packages** page. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md deleted file mode 100644 index ac99282ee1..0000000000 --- a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Allow Only Administrators to Enable Connection Groups -description: How to Allow Only Administrators to Enable Connection Groups -author: dansimp -ms.assetid: 60e62426-624f-4f26-851e-41cd78520883 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Allow Only Administrators to Enable Connection Groups - - -You can configure the App-V client so that only administrators (not end users) can enable or disable connection groups. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use one of the following methods to allow only administrators to enable or disable connection groups. - - ---- - - - - - - - - - - - - - - - - -
          MethodSteps

          Group Policy setting

          Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

          -

          Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing

          PowerShell cmdlet

          Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter.

          -

          Parameter values:

          -
            -
          • 0 - False

          • -
          • 1 - True

          • -
          -

          Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

          - - - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md deleted file mode 100644 index 1a6a35f007..0000000000 --- a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Allow Only Administrators to Enable Connection Groups -description: How to Allow Only Administrators to Enable Connection Groups -author: dansimp -ms.assetid: 42ca3157-5d85-467b-a148-09404f8f737a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Allow Only Administrators to Enable Connection Groups - - -You can configure the App-V client so that only administrators (not end users) can enable or disable connection groups. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use one of the following methods to allow only administrators to enable or disable connection groups. - - ---- - - - - - - - - - - - - - - - - -
          MethodSteps

          Group Policy setting

          Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

          -

          Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing

          PowerShell cmdlet

          Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter.

          -

          Parameter values:

          -
            -
          • 0 - False

          • -
          • 1 - True

          • -
          -

          Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

          - - - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md deleted file mode 100644 index 3f0b9b7a68..0000000000 --- a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Apply the Deployment Configuration File by Using PowerShell -description: How to Apply the Deployment Configuration File by Using PowerShell -author: dansimp -ms.assetid: 5df5d5bc-6c72-4087-8b93-d6d4b502a1f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the Deployment Configuration File by Using PowerShell - - -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V 5.0 client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V 5.0 client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - -**To Apply the Deployment Configuration File Using PowerShell** - -- To specify a new default set of configurations for all users who will run the package on a specific computer, using a PowerShell console type the following: - - **Add-AppVClientPackage –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - **Note** - This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - - **Set-AppVClientPackage –Name Myapp –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md deleted file mode 100644 index dac9fedce1..0000000000 --- a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Apply the Deployment Configuration File by Using PowerShell -description: How to Apply the Deployment Configuration File by Using PowerShell -author: dansimp -ms.assetid: 78fe0f15-4a36-41e3-96d6-7d5aa77c1e06 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the Deployment Configuration File by Using PowerShell - - -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V 5.1 client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V 5.1 client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - -**To Apply the Deployment Configuration File Using PowerShell** - -- To specify a new default set of configurations for all users who will run the package on a specific computer, using a PowerShell console type the following: - - **Add-AppVClientPackage –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - **Note** - This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - - **Set-AppVClientPackage –Name Myapp –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md deleted file mode 100644 index bf8e5bc775..0000000000 --- a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Apply the User Configuration File by Using PowerShell -description: How to Apply the User Configuration File by Using PowerShell -author: dansimp -ms.assetid: f7d7c595-4fdd-4096-b53d-9eead111c339 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the User Configuration File by Using PowerShell - - -The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. - -Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**To apply a user Configuration file** - -1. To add the package to the computer using the PowerShell console type the following command: - - **Add-AppVClientPackage c:\\Packages\\Contoso\\MyApp.appv**. - -2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: - - **Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath c:\\Packages\\Contoso\\config.xml** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md deleted file mode 100644 index 9ef045bf7b..0000000000 --- a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Apply the User Configuration File by Using PowerShell -description: How to Apply the User Configuration File by Using PowerShell -author: dansimp -ms.assetid: 986e638c-4a0c-4a7e-be73-f4615e8b8000 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the User Configuration File by Using PowerShell - - -The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. - -Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**To apply a user Configuration file** - -1. To add the package to the computer using the PowerShell console type the following command: - - **Add-AppVClientPackage c:\\Packages\\Contoso\\MyApp.appv**. - -2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: - - **Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath c:\\Packages\\Contoso\\config.xml** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md deleted file mode 100644 index b09260f550..0000000000 --- a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Configure Access to Packages by Using the Management Console -description: How to Configure Access to Packages by Using the Management Console -author: dansimp -ms.assetid: 8f4c91e4-f4e6-48cf-aa94-6085a054e8f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Access to Packages by Using the Management Console - - -Before you deploy an App-V 5.0 virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. - -Use the following procedure to configure access to virtualized packages. - -**To grant access to an App-V 5.0 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.0 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Provision a security group for the package: - - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. - - 2. Using the format **mydomain** \\ **groupname**, type the name or part of the name of an Active Directory group object, and click **Check**. - - **Note**   - Ensure that you provide an associated domain name for the group that you are searching for. - - - -3. To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. - -4. - - To accept the default configuration settings and close the **AD ACCESS** page, click **Close**. - - To customize configurations for a specific group, click the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To configure the custom configurations, click **EDIT**. After you grant access, click **Close**. - -**To remove access to an App-V 5.0 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.0 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Select the group you want to remove, and click **DELETE**. - -3. To close the **AD ACCESS** page, click **Close**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md deleted file mode 100644 index b7683c7b78..0000000000 --- a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Configure Access to Packages by Using the Management Console -description: How to Configure Access to Packages by Using the Management Console -author: dansimp -ms.assetid: 4fd39bc2-d814-46de-a108-1c21fa404e8a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Access to Packages by Using the Management Console - - -Before you deploy an App-V 5.1 virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. - -Use the following procedure to configure access to virtualized packages. - -**To grant access to an App-V 5.1 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.1 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Provision a security group for the package: - - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. - - 2. Using the format **mydomain** \\ **groupname**, type the name or part of the name of an Active Directory group object, and click **Check**. - - **Note**   - Ensure that you provide an associated domain name for the group that you are searching for. - - - -3. To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. - -4. - - To accept the default configuration settings and close the **AD ACCESS** page, click **Close**. - - To customize configurations for a specific group, click the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To configure the custom configurations, click **EDIT**. After you grant access, click **Close**. - -**To remove access to an App-V 5.1 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.1 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Select the group you want to remove, and click **DELETE**. - -3. To close the **AD ACCESS** page, click **Close**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md deleted file mode 100644 index 8e6b0c9389..0000000000 --- a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -description: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -author: dansimp -ms.assetid: 23b2d03a-20ce-4973-99ee-748f3b682207 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server - - -Deploying packages and connection groups using the App-V 5.1 publishing server is helpful because it offers single-point management and high scalability. - -Use the following steps to configure the App-V 5.1 client to receive updates from the publishing server. - -**Note**   -For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**. - - - -**To configure the App-V 5.1 client to receive updates from the publishing server** - -1. Deploy the App-V 5.1 management and publishing servers, and add the required packages and connection groups. For more information about adding packages and connection groups, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) and [How to Create a Connection Group](how-to-create-a-connection-group51.md). - -2. To open the management console click the following link, open a browser and type the following: http://MyMgmtSrv/AppvManagement/Console.html in a web browser, and import, publish, and entitle all the packages and connection groups which will be necessary for a particular set of users. - -3. On the computer running the App-V 5.1 client, open an elevated PowerShell command prompt, run the following command: - - **Add-AppvPublishingServer  -Name  ABC  -URL  http:// MyPubSrv/AppvPublishing** - - This command will configure the specified publishing server. You should see output similar to the following: - - Id                        : 1 - - SetByGroupPolicy          : False - - Name                      : ABC - - URL                       : http:// MyPubSrv/AppvPublishing - - GlobalRefreshEnabled      : False - - GlobalRefreshOnLogon      : False - - GlobalRefreshInterval     : 0 - - GlobalRefreshIntervalUnit : Day - - UserRefreshEnabled        : True - - UserRefreshOnLogon        : True - - UserRefreshInterval       : 0 - - UserRefreshIntervalUnit   : Day - - The returned Id – in this case 1 - -4. On the computer running the App-V 5.1 client, open a PowerShell command prompt, and type the following command: - - **Sync-AppvPublishingServer  -ServerId  1** - - The command will query the publishing server for the packages and connection groups that need to be added or removed for this particular client based on the entitlements for the packages and connection groups as configured on the management server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md deleted file mode 100644 index fd12886881..0000000000 --- a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -description: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -author: dansimp -ms.assetid: f5dfd96d-4b63-468c-8d93-9dfdf47c28fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server - - -Deploying packages and connection groups using the App-V 5.0 publishing server is helpful because it offers single-point management and high scalability. - -Use the following steps to configure the App-V 5.0 client to receive updates from the publishing server. - -**Note**   -For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**. - - - -**To configure the App-V 5.0 client to receive updates from the publishing server** - -1. Deploy the App-V 5.0 management and publishing servers, and add the required packages and connection groups. For more information about adding packages and connection groups, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) and [How to Create a Connection Group](how-to-create-a-connection-group.md). - -2. To open the management console click the following link, open a browser and type the following: http://MyMgmtSrv/AppvManagement/Console.html in a web browser, and import, publish, and entitle all the packages and connection groups which will be necessary for a particular set of users. - -3. On the computer running the App-V 5.0 client, open an elevated PowerShell command prompt, run the following command: - - **Add-AppvPublishingServer  -Name  ABC  -URL  http:// MyPubSrv/AppvPublishing** - - This command will configure the specified publishing server. You should see output similar to the following: - - Id                        : 1 - - SetByGroupPolicy          : False - - Name                      : ABC - - URL                       : http:// MyPubSrv/AppvPublishing - - GlobalRefreshEnabled      : False - - GlobalRefreshOnLogon      : False - - GlobalRefreshInterval     : 0 - - GlobalRefreshIntervalUnit : Day - - UserRefreshEnabled        : True - - UserRefreshOnLogon        : True - - UserRefreshInterval       : 0 - - UserRefreshIntervalUnit   : Day - - The returned Id – in this case 1 - -4. On the computer running the App-V 5.0 client, open a PowerShell command prompt, and type the following command: - - **Sync-AppvPublishingServer  -ServerId  1** - - The command will query the publishing server for the packages and connection groups that need to be added or removed for this particular client based on the entitlements for the packages and connection groups as configured on the management server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-connect-to-the-management-console-51.md b/mdop/appv-v5/how-to-connect-to-the-management-console-51.md deleted file mode 100644 index b6144f08ac..0000000000 --- a/mdop/appv-v5/how-to-connect-to-the-management-console-51.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Connect to the Management Console -description: How to Connect to the Management Console -author: dansimp -ms.assetid: 5a15ed86-7db7-4df3-80ca-bde26f3285e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Connect to the Management Console - - -Use the following procedure to connect to the App-V 5.1 Management Console. - -**To connect to the App-V 5.1 Management Console** - -1. Open Internet Explorer browser and type the address for the App-V 5.1. For example, **http://<Management server name>:<Management service port number>/Console.html**. - -2. To view different sections of the console, click the desired section in the navigation pane. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md b/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md deleted file mode 100644 index a460c12f62..0000000000 --- a/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Connect to the Management Console -description: How to Connect to the Management Console -author: dansimp -ms.assetid: 67dfdfa1-e7dd-4c5e-aa50-f016bd1dc643 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Connect to the Management Console - - -Use the following procedure to connect to the App-V 5.0 Management Console. - -**To connect to the App-V 5.0 Management Console** - -1. Open Internet Explorer browser and type the address for the App-V 5.0. For example, **http://<Management server name>:<Management service port number>/Console.html**. - -2. To view different sections of the console, click the desired section in the navigation pane. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md deleted file mode 100644 index e1e6432a8a..0000000000 --- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: How to Convert a Package Created in a Previous Version of App-V -description: How to Convert a Package Created in a Previous Version of App-V -author: dansimp -ms.assetid: b092a5f8-cc5f-4df8-a5a2-0a68fd7bd5b2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Convert a Package Created in a Previous Version of App-V - - -You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V. - -**Note** -If you are running a computer with a 64-bit architecture, you must use the x86 version of PowerShell. - - - -The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion. - -The following information provides direction for converting existing virtual application packages. - -**Important** -You must configure the package converter to always save the package ingredients file to a secure location and directory. A secure location is accessible only by an administrator. Additionally, when you deploy the package, you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion process. - - - -**Getting started** - -1. Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. Import the required Powershell Module - -```powershell -Import-Module AppVPkgConverter -``` - -3. The following cmdlets are available: - - - Test-AppvLegacyPackage – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using the PowerShell cmdline, type `Test-AppvLegacyPackage -?`. - - - ConvertFrom-AppvLegacyPackage – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V 5.0 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used for the App-V 5.0 filename. - - Additionally, the package converter optimizes performance of packages in App-V 5.0 by setting the package to stream fault the App-V package. This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default. - - **Note** - Before you specify the output directory, you must create the output directory. - - - -~~~ -**Advanced Conversion Tips** - -- Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.0 client. - -- Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`. - -- Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md deleted file mode 100644 index b146f4dd7f..0000000000 --- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Convert a Package Created in a Previous Version of App-V -description: How to Convert a Package Created in a Previous Version of App-V -author: dansimp -ms.assetid: 3366d399-2891-491d-8de1-f8cfdf39bbab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Convert a Package Created in a Previous Version of App-V - - -You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V. - -**Note** -If you are running a computer with a 64-bit architecture, you must use the x86 version of PowerShell. - - - -The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion. - -The following information provides direction for converting existing virtual application packages. - -**Important** -You must configure the package converter to always save the package ingredients file to a secure location and directory. A secure location is accessible only by an administrator. Additionally, when you deploy the package, you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion process. - - - -**App-V 4.6 installation folder is redirected to virtual file system root** - -When you convert packages from App-V 4.6 to 5.1, the App-V 5.1 package can access the hardcoded drive that you were required to use when you created 4.6 packages. The drive letter will be the drive you selected as the installation drive on the 4.6 sequencing machine. (The default drive letter is Q:\\.) - -Prior to App-V 5.1, the 4.6 root folder was not recognized and could not be accessed by App-V 5.0 packages. Now, App-V 5.1 packages can access hardcoded files by their full path or can programmatically enumerate files under the App-V 4.6 installation root. - -**Technical Details:** The App-V 5.1 package converter will save the App-V 4.6 installation root folder and short folder names in the FilesystemMetadata.xml file in the Filesystem element. When the App-V 5.1 client creates the virtual process, it will map requests from the App-V 4.6 installation root to the virtual file system root. - -**Getting started** - -1. Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. - - The following cmdlets are available: - - - Test-AppvLegacyPackage – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using the PowerShell cmdline, type `Test-AppvLegacyPackage -?`. - - - ConvertFrom-AppvLegacyPackage – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V 5.1 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used for the App-V 5.1 filename. - - Additionally, the package converter optimizes performance of packages in App-V 5.1 by setting the package to stream fault the App-V package. This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default. - - **Note** - Before you specify the output directory, you must create the output directory. - - - -~~~ -**Advanced Conversion Tips** - -- Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.1 client. - -- Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`. - -- Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md deleted file mode 100644 index f9ce72926a..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Create a Connection Group with User-Published and Globally Published Packages -description: How to Create a Connection Group with User-Published and Globally Published Packages -author: dansimp -ms.assetid: 82f7ea7f-7b14-4506-8940-fdcd6c3e117f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Create a Connection Group with User-Published and Globally Published Packages -You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: - -- [How to use PowerShell cmdlets to create the user-entitled connection groups](#bkmk-posh-userentitled-cg) - -- [How to use the App-V Server to create the user-entitled connection groups](#bkmk-appvserver-userentitled-cg) - -**What to know before you start:** - - ---- - - - - - - - - - - - - - - - - -
          Unsupported scenarios and potential issuesResult

          You cannot include user-published packages in globally entitled connection groups.

          The connection group will fail.

          If you publish a package globally and then create a user-published connection group in which you’ve made that package non-optional, you can still run Unpublish-AppvClientPackage <package> -global to unpublish the package, even when that package is being used in another connection group.

          If any other connection groups are using that package, the package will fail in those connection groups.

          -

          To avoid inadvertently unpublishing a non-optional package that is being used in another connection group, we recommend that you track the connection groups in which you’ve used a non-optional package.

          - -  -**How to use PowerShell cmdlets to create user-entitled connection groups** - -1. Add and publish packages by using the following commands: - - **Add-AppvClientPackage Package1\_AppV\_file\_Path** - - **Add-AppvClientPackage Package2\_AppV\_file\_Path** - - **Publish-AppvClientPackage -PackageId Package1\_ID -VersionId Package1\_Version ID -Global** - - **Publish-AppvClientPackage -PackageId Package2\_ID -VersionId Package2\_ID** - -2. Create the connection group XML file. For more information, see [About the Connection Group File](about-the-connection-group-file.md). - -3. Add and publish the connection group by using the following commands: - - **Add-AppvClientConnectionGroup Connection\_Group\_XML\_file\_Path** - - **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID** - -**How to use the App-V Server to create user-entitled connection groups** - -1. Open the App-V 5.0 Management Console. - -2. Follow the instructions in [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) to publish packages globally and to the user. - -3. Follow the instructions in [How to Create a Connection Group](how-to-create-a-connection-group.md) to create the connection group, and add the user-published and globally published packages. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - -[How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md deleted file mode 100644 index fe42b5278b..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Create a Connection Group with User-Published and Globally Published Packages -description: How to Create a Connection Group with User-Published and Globally Published Packages -author: dansimp -ms.assetid: 851b8742-0283-4aa6-b3a3-f7f6289824c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Create a Connection Group with User-Published and Globally Published Packages - - -You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: - -- [How to use PowerShell cmdlets to create the user-entitled connection groups](#bkmk-posh-userentitled-cg) - -- [How to use the App-V Server to create the user-entitled connection groups](#bkmk-appvserver-userentitled-cg) - -**What to know before you start:** - - ---- - - - - - - - - - - - - - - - - -
          Unsupported scenarios and potential issuesResult

          You cannot include user-published packages in globally entitled connection groups.

          The connection group will fail.

          If you publish a package globally and then create a user-published connection group in which you’ve made that package non-optional, you can still run Unpublish-AppvClientPackage <package> -global to unpublish the package, even when that package is being used in another connection group.

          If any other connection groups are using that package, the package will fail in those connection groups.

          -

          To avoid inadvertently unpublishing a non-optional package that is being used in another connection group, we recommend that you track the connection groups in which you’ve used a non-optional package.

          - -**How to use PowerShell cmdlets to create user-entitled connection groups** - -1. Add and publish packages by using the following commands: - - **Add-AppvClientPackage Package1\_AppV\_file\_Path** - - **Add-AppvClientPackage Package2\_AppV\_file\_Path** - - **Publish-AppvClientPackage -PackageId Package1\_ID -VersionId Package1\_Version ID -Global** - - **Publish-AppvClientPackage -PackageId Package2\_ID -VersionId Package2\_ID** - -2. Create the connection group XML file. For more information, see [About the Connection Group File](about-the-connection-group-file51.md). - -3. Add and publish the connection group by using the following commands: - - **Add-AppvClientConnectionGroup Connection\_Group\_XML\_file\_Path** - - **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID** - -**How to use the App-V Server to create user-entitled connection groups** - -1. Open the App-V 5.1 Management Console. - -2. Follow the instructions in [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md) to publish packages globally and to the user. - -3. Follow the instructions in [How to Create a Connection Group](how-to-create-a-connection-group51.md) to create the connection group, and add the user-published and globally published packages. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - -[How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group.md b/mdop/appv-v5/how-to-create-a-connection-group.md deleted file mode 100644 index 70a482f2c4..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Create a Connection Group -description: How to Create a Connection Group -author: dansimp -ms.assetid: 9d272052-2d28-4e41-989c-89610482a0ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Connection Group - - -Use these steps to create a connection group by using the App-V Management Console. To use PowerShell to create connection groups, see [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md). - -When you place packages in a connection group, their package root paths are merged. If you remove packages, only the remaining packages maintain the merged root. - -**To create a connection group** - -1. In the App-V 5.0 Management Console, select **Packages**. - -2. Select **CONNECTION GROUPS** to display the Connection Groups library. - -3. Select **ADD CONNECTION GROUP** to create a new connection group. - -4. In the **New Connection Group** pane, type a description for the group. - -5. Click **EDIT** in the **CONNECTED PACKAGES** pane to add a new application to the connection group. - -6. In the **PACKAGES Entire Library** pane, select the application to be added, and click the arrow to add the application. - - To remove an application, select the application to be removed in the **PACKAGES IN** pane and click the arrow. - - To reprioritize the applications in your connection group, use the arrows in the **PACKAGES IN** pane. - - **Important**   - By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane. - - - -7. After adding all the applications and configuring Active Directory access, click **Apply**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group51.md b/mdop/appv-v5/how-to-create-a-connection-group51.md deleted file mode 100644 index f5605affe1..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group51.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Create a Connection Group -description: How to Create a Connection Group -author: dansimp -ms.assetid: 221e2eed-7ebb-42e3-b3d6-11c37c0578e6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Connection Group - - -Use these steps to create a connection group by using the App-V Management Console. To use PowerShell to create connection groups, see [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md). - -When you place packages in a connection group, their package root paths are merged. If you remove packages, only the remaining packages maintain the merged root. - -**To create a connection group** - -1. In the App-V 5.1 Management Console, select **CONNECTION GROUPS** to display the Connection Groups library. - -2. Select **ADD CONNECTION GROUP** to create a new connection group. - -3. In the **New Connection Group** pane, type a description for the group. - -4. Click **EDIT** in the **CONNECTED PACKAGES** pane to add a new application to the connection group. - -5. In the **PACKAGES Entire Library** pane, select the application to be added, and click the arrow to add the application. - - To remove an application, select the application to be removed in the **PACKAGES IN** pane and click the arrow. - - To reprioritize the applications in your connection group, use the arrows in the **PACKAGES IN** pane. - - **Important**   - By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane. - - - -6. After adding all the applications and configuring Active Directory access, click **Apply**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md deleted file mode 100644 index 4837568ff0..0000000000 --- a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create a Custom Configuration File by Using the App-V 5.0 Management Console -description: How to Create a Custom Configuration File by Using the App-V 5.0 Management Console -author: dansimp -ms.assetid: 0d1f6768-be30-4682-8eeb-aa95918b24c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Custom Configuration File by Using the App-V 5.0 Management Console - - -You can use a dynamic configuration to customize an App-V 5.0 package for a specific user. However, you must first create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use the files. Creation of the file is an advanced manual operation. For general information about dynamic user configuration files, see, [About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md). - -Use the following procedure to create a Dynamic User Configuration file by using the App-V 5.0 Management console. - -**To create a Dynamic User Configuration file** - -1. Right-click the name of the package that you want to view and select **Edit active directory access** to view the configuration that is assigned to a given user group. Alternatively, select the package, and click **Edit**. - -2. Using the list of **AD Entities with Access**, select the AD group that you want to customize. Select **Custom** from the drop-down list, if it is not already selected. A link named **Edit** will be displayed. - -3. Click **Edit**. The Dynamic User Configuration that is assigned to the AD Group will be displayed. - -4. Click **Advanced**, and then click **Export Configuration**. Type in a filename and click **Save**. Now you can edit the file to configure a package for a user. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md deleted file mode 100644 index eb1da74435..0000000000 --- a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Create a Custom Configuration File by Using the App-V 5.1 Management Console -description: How to Create a Custom Configuration File by Using the App-V 5.1 Management Console -author: dansimp -ms.assetid: f5ab426a-f49a-47b3-93f3-b9d60aada8f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Custom Configuration File by Using the App-V 5.1 Management Console - - -You can use a dynamic configuration to customize an App-V 5.1 package for a specific user. However, you must first create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use the files. Creation of the file is an advanced manual operation. For general information about dynamic user configuration files, see, [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md). - -Use the following procedure to create a Dynamic User Configuration file by using the App-V 5.1 Management console. - -**To create a Dynamic User Configuration file** - -1. Right-click the name of the package that you want to view and select **Edit active directory access** to view the configuration that is assigned to a given user group. Alternatively, select the package, and click **Edit**. - -2. Using the list of **AD Entities with Access**, select the AD group that you want to customize. Select **Custom** from the drop-down list, if it is not already selected. A link named **Edit** will be displayed. - -3. Click **Edit**. The Dynamic User Configuration that is assigned to the AD Group will be displayed. - -4. Click **Advanced**, and then click **Export Configuration**. Type in a filename and click **Save**. Now you can edit the file to configure a package for a user. - - **Note** - To export a configuration while running on Windows Server, you must disable "IE Enhanced Security Configuration". If this is enabled and set to block downloads, you cannot download anything from the App-V Server. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md deleted file mode 100644 index 0f7df5d66c..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Create a Package Accelerator by Using PowerShell -description: How to Create a Package Accelerator by Using PowerShell -author: dansimp -ms.assetid: 8e527363-d961-4153-826a-446a4ad8d980 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator by Using PowerShell - - -App-V 5.0 package accelerators automatically sequence large, complex applications. Additionally, when you apply an App-V 5.0 package accelerator, you are not always required to manually install an application to create the virtualized package. - -**To create a package accelerator** - -1. Install the App-V 5.0 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. Use the **New-AppvPackageAccelerator** cmdlet. - -3. To create a package accelerator, make sure that you have the .appv package to create an accelerator from, the installation media or installation files, and optionally a read me file for consumers of the accelerator to use. The following parameters are required to use the package accelerator cmdlet: - - - **InstalledFilesPath** - specifies the application installation path. - - - **Installer** – specifies the path to the application installer media - - - **InputPackagePath** – specifies the path to the .appv package - - - **Path** – specifies the output directory for the package. - - The following example displays how you can create a package accelerator with an .appv package and the installation media: - - **New-AppvPackageAccelerator -InputPackagePath <path to the .appv file> -Installer <path to the installer executable> -Path <directory of the output path>** - - Additional optional parameters that can be used with the **New-AppvPackageAccelerator** cmdlet are displayed in the following list: - - - **AcceleratorDescriptionFile** - specifies the path to user created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be packaged with the package created using the package accelerator. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md deleted file mode 100644 index ef6e767d58..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Create a Package Accelerator by Using PowerShell -description: How to Create a Package Accelerator by Using PowerShell -author: dansimp -ms.assetid: 0cb98394-4477-4193-8c5f-1c1773c7263a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator by Using PowerShell - - -App-V 5.1 package accelerators automatically sequence large, complex applications. Additionally, when you apply an App-V 5.1 package accelerator, you are not always required to manually install an application to create the virtualized package. - -**To create a package accelerator** - -1. Install the App-V 5.1 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. Use the **New-AppvPackageAccelerator** cmdlet. - -3. To create a package accelerator, make sure that you have the .appv package to create an accelerator from, the installation media or installation files, and optionally a read me file for consumers of the accelerator to use. The following parameters are required to use the package accelerator cmdlet: - - - **InstalledFilesPath** - specifies the application installation path. - - - **Installer** – specifies the path to the application installer media - - - **InputPackagePath** – specifies the path to the .appv package - - - **Path** – specifies the output directory for the package. - - The following example displays how you can create a package accelerator with an .appv package and the installation media: - - **New-AppvPackageAccelerator -InputPackagePath <path to the .appv file> -Installer <path to the installer executable> -Path <directory of the output path>** - - Additional optional parameters that can be used with the **New-AppvPackageAccelerator** cmdlet are displayed in the following list: - - - **AcceleratorDescriptionFile** - specifies the path to user created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be packaged with the package created using the package accelerator. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator.md b/mdop/appv-v5/how-to-create-a-package-accelerator.md deleted file mode 100644 index b823c813a0..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: How to Create a Package Accelerator -description: How to Create a Package Accelerator -author: dansimp -ms.assetid: dfe305e5-7cf8-498f-9581-4805ffc722bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator - - -App-V 5.0 package accelerators automatically generate new virtual application packages. - -**Note** -You can use PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell.md). - - - -Use the following procedure to create a package accelerator. - -**Important** -Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.0 Package Accelerator is applied. - - - -**Important** -Before you begin the following procedure, you should perform the following: - -- Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. - -- Copy all required installation files associated with the virtual application package to the computer running the sequencer. - - - -**To create a package accelerator** - -1. **Important** - The App-V 5.0 Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V 5.0 Sequencer. - - - -~~~ -To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -~~~ - -2. To start the App-V 5.0 **Create Package Accelerator** wizard, in the App-V 5.0 sequencer console, click **Tools** / **Create Accelerator**. - -3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file). - - **Tip** - Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - - - -~~~ -Click **Next**. -~~~ - -4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. - - **Tip** - Copy the folder that contains the required installation files to the computer running the Sequencer. - - - -5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. - -6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. - - **Note** - You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. - - - -7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**. - -8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. - - If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**. - -9. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**. - -10. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory. - -11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. - - **Important** - To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator51.md b/mdop/appv-v5/how-to-create-a-package-accelerator51.md deleted file mode 100644 index 45092fa865..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator51.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: How to Create a Package Accelerator -description: How to Create a Package Accelerator -author: dansimp -ms.assetid: b61f3581-7933-443e-b872-a96bed9ff8d7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator - - -App-V 5.1 package accelerators automatically generate new virtual application packages. - -**Note** -You can use PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell51.md). - - - -Use the following procedure to create a package accelerator. - -**Important** -Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.1 Package Accelerator is applied. - - - -**Important** -Before you begin the following procedure, you should perform the following: - -- Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. - -- Copy all required installation files associated with the virtual application package to the computer running the sequencer. - - - -**To create a package accelerator** - -1. **Important** - The App-V 5.1 Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V 5.1 Sequencer. - - - -~~~ -To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -~~~ - -2. To start the App-V 5.1 **Create Package Accelerator** wizard, in the App-V 5.1 sequencer console, click **Tools** / **Create Accelerator**. - -3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file). - - **Tip** - Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - - - -~~~ -Click **Next**. -~~~ - -4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. - - **Tip** - Copy the folder that contains the required installation files to the computer running the Sequencer. - - - -5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. - -6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. - - **Note** - You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. - - - -7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**. - -8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. - - If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**. - -9. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**. - -10. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory. - -11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. - - **Important** - To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md deleted file mode 100644 index d6752dc7b3..0000000000 --- a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: How to Create a Virtual Application Package Using an App-V Package Accelerator -description: How to Create a Virtual Application Package Using an App-V Package Accelerator -author: dansimp -ms.assetid: 715e7526-e100-419c-8fc1-75cbfe433835 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Virtual Application Package Using an App-V Package Accelerator - - -**Important** -The App-V 5.0 Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V 5.0 Sequencer. - - - -Use the following procedure to create a virtual application package with the App-V 5.0 Package Accelerator. - -**Note** -Before you start this procedure, copy the required Package Accelerator locally to the computer that runs the App-V 5.0 Sequencer. You should also copy all required installation files for the package to a local directory on the computer that runs the Sequencer. This is the directory that you have to specify in step 5 of this procedure. - - - -**To create a virtual application package with an App-V 5.0 Package Accelerator** - -1. To start the App-V Sequencer, on the computer that runs the App-V 5.0 Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. - -3. To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**. - - **Important** - If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. - - - -4. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. - -5. On the **Select Installation Files** page, click **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, click **Browse** to select the folder. - - Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. - - **Note** - You can specify the following types of supported installation files: - - - Windows Installer files (**.msi**) - - - Cabinet files (.cab) - - - Compressed files with a .zip file name extension - - - The actual application files - - The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. - - - -~~~ -If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page. -~~~ - -6. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**. - -7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - To create the package, click **Create**. After the package is created, click **Next**. - -8. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements. - - If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step: - - - **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package. - - - **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**. - - - **Save Package**. The Sequencer saves the package. - - - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. - - If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**. - -9. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md deleted file mode 100644 index 2552432acc..0000000000 --- a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: How to Create a Virtual Application Package Using an App-V Package Accelerator -description: How to Create a Virtual Application Package Using an App-V Package Accelerator -author: dansimp -ms.assetid: eae1e4f8-f14f-4bc8-9867-052561c37297 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Virtual Application Package Using an App-V Package Accelerator - - -**Important** -The App-V 5.1 Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V 5.1 Sequencer. - - - -Use the following procedure to create a virtual application package with the App-V 5.1 Package Accelerator. - -**Note** -Before you start this procedure, copy the required Package Accelerator locally to the computer that runs the App-V 5.1 Sequencer. You should also copy all required installation files for the package to a local directory on the computer that runs the Sequencer. This is the directory that you have to specify in step 5 of this procedure. - - - -**To create a virtual application package with an App-V 5.1 Package Accelerator** - -1. To start the App-V Sequencer, on the computer that runs the App-V 5.1 Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. - -3. To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**. - - **Important** - If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. - - - -4. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. - -5. On the **Select Installation Files** page, click **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, click **Browse** to select the folder. - - Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. - - **Note** - You can specify the following types of supported installation files: - - - Windows Installer files (**.msi**) - - - Cabinet files (.cab) - - - Compressed files with a .zip file name extension - - - The actual application files - - The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. - - - -~~~ -If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page. -~~~ - -6. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**. - -7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - To create the package, click **Create**. After the package is created, click **Next**. - -8. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements. - - If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step: - - - **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package. - - - **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**. - - - **Save Package**. The Sequencer saves the package. - - - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. - - If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**. - -9. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-and-use-a-project-template.md b/mdop/appv-v5/how-to-create-and-use-a-project-template.md deleted file mode 100644 index 514740a212..0000000000 --- a/mdop/appv-v5/how-to-create-and-use-a-project-template.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Create and Use a Project Template -description: How to Create and Use a Project Template -author: dansimp -ms.assetid: 2063f0b3-47a1-4090-bf99-0f26b107331c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create and Use a Project Template - - -You can use an App-V 5.0 project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment. Using a project template can streamline the process of creating virtual application packages. - -**Note**   -You can, and often should apply an App-V 5.0 project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application. - -App-V 5.0 project templates differ from App-V 5.0 Application Accelerators because App-V 5.0 Application Accelerators are application-specific, and App-V 5.0 project templates can be applied to multiple applications. - -Use the following procedures to create and apply a new template. - -**To create a project template** - -1. To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -**Note**   - If the virtual application package is currently open in the App-V 5.0 Sequencer console, skip to step 3 of this procedure. - -2. To open the existing virtual application package that contains the settings you want to save with the App-V 5.0 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. - -3. In the App-V 5.0 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.0 project template. Click Save. - The new App-V 5.0 project template is saved in the directory specified in step 3 of this procedure. - -**To apply a project template** - -**Important**   - Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported. - -1. To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To create or upgrade a new virtual application package by using an App-V 5.0 project template, click **File** / **New From Template**. - -3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**. - - Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-and-use-a-project-template51.md b/mdop/appv-v5/how-to-create-and-use-a-project-template51.md deleted file mode 100644 index cc1d47dba3..0000000000 --- a/mdop/appv-v5/how-to-create-and-use-a-project-template51.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Create and Use a Project Template -description: How to Create and Use a Project Template -author: dansimp -ms.assetid: e5ac1dc8-a88f-4b16-8e3c-df07ef5e4c3b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create and Use a Project Template - - -You can use an App-V 5.1 project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment. Using a project template can streamline the process of creating virtual application packages. - -**Note** -You can, and often should apply an App-V 5.1 project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application. - - - -App-V 5.1 project templates differ from App-V 5.1 Application Accelerators because App-V 5.1 Application Accelerators are application-specific, and App-V 5.1 project templates can be applied to multiple applications. - -Use the following procedures to create and apply a new template. - -**To create a project template** - -1. To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. **Note** - If the virtual application package is currently open in the App-V 5.1 Sequencer console, skip to step 3 of this procedure. - - - -~~~ -To open the existing virtual application package that contains the settings you want to save with the App-V 5.1 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. -~~~ - -3. In the App-V 5.1 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.1 project template. Click Save. - - The new App-V 5.1 project template is saved in the directory specified in step 3 of this procedure. - -**To apply a project template** - -1. **Important** - Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported. - - - -~~~ -To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -~~~ - -2. To create or upgrade a new virtual application package by using an App-V 5.1 project template, click **File** / **New From Template**. - -3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**. - - Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md deleted file mode 100644 index 110fce61e0..0000000000 --- a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -description: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -author: dansimp -ms.assetid: 4f249ee3-cc2d-4b1e-afe5-d1cbf9cabd88 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console - - -Use the following procedure to customize the virtual application extensions for an Active Directory (AD) group. - -**To customize virtual applications extensions for an AD group** - -1. To view the package that you want to configure, open the App-V 5.0 Management Console. To view the configuration that is assigned to a given user group, select the package, and right-click the package name and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. To customize an AD group, you can find the group from the list of **AD Entities with Access**. Then, using the drop-down box in the **Assigned Configuration** pane, select **Custom**, and then click **EDIT**. - -3. To disable all extensions for a given application, clear **ENABLE**. - - To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane, and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane, and select **Remove Shortcut**. To edit an existing shortcut, right-click the application, and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced**, and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions that are associated with the package using the configuration file. - -5. To edit additional application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog, click **Overwrite** to complete the process. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md deleted file mode 100644 index 4d7754f265..0000000000 --- a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -description: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -author: dansimp -ms.assetid: dd71df05-512f-4eb4-a55f-e5b93601323d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console - - -Use the following procedure to customize the virtual application extensions for an Active Directory (AD) group. - -**To customize virtual applications extensions for an AD group** - -1. To view the package that you want to configure, open the App-V 5.1 Management Console. To view the configuration that is assigned to a given user group, select the package, and right-click the package name and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. To customize an AD group, you can find the group from the list of **AD Entities with Access**. Then, using the drop-down box in the **Assigned Configuration** pane, select **Custom**, and then click **EDIT**. - -3. To disable all extensions for a given application, clear **ENABLE**. - - To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane, and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane, and select **Remove Shortcut**. To edit an existing shortcut, right-click the application, and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced**, and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions that are associated with the package using the configuration file. - -5. To edit additional application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog, click **Overwrite** to complete the process. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-connection-group.md b/mdop/appv-v5/how-to-delete-a-connection-group.md deleted file mode 100644 index 8d3a29dee3..0000000000 --- a/mdop/appv-v5/how-to-delete-a-connection-group.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Delete a Connection Group -description: How to Delete a Connection Group -author: dansimp -ms.assetid: 92654019-a5ad-4ed7-8c39-45f658f60196 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Connection Group - - -Use the following procedure to delete an existing App-V connection group. - -**To delete a connection group** - -1. Open the App-V Management Console and select **Packages** > **CONNECTION GROUPS**. - -2. Right-click the connection group to be removed, and select **delete**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Managing Connection Groups](managing-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-connection-group51.md b/mdop/appv-v5/how-to-delete-a-connection-group51.md deleted file mode 100644 index 90aec39b89..0000000000 --- a/mdop/appv-v5/how-to-delete-a-connection-group51.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Delete a Connection Group -description: How to Delete a Connection Group -author: dansimp -ms.assetid: dfdfb507-8891-4f17-9125-5759c9b74483 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Connection Group - - -Use the following procedure to delete an existing App-V connection group. - -**To delete a connection group** - -1. Open the App-V Management Console and select **CONNECTION GROUPS**. - -2. Right-click the connection group to be removed, and select **delete**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Managing Connection Groups](managing-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md deleted file mode 100644 index 51e1ae3be1..0000000000 --- a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Delete a Package in the Management Console -description: How to Delete a Package in the Management Console -author: dansimp -ms.assetid: 4a2be40b-bbb8-4fab-992d-7466df432858 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package in the Management Console - - -Use the following procedure to delete an App-V 5.1 package. - -**To delete a package in the Management Console** - -1. To view the package you want to delete, open the App-V 5.1 Management Console and select **Packages**. Select the package to be removed. - -2. Click or right-click the package. Select **Delete** to remove the package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md deleted file mode 100644 index a9a1d7847a..0000000000 --- a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Delete a Package in the Management Console -description: How to Delete a Package in the Management Console -author: dansimp -ms.assetid: d780aafb-4097-4417-8ecc-30efac73c33a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package in the Management Console - - -Use the following procedure to delete an App-V 5.0 package. - -**To delete a package in the Management Console** - -1. To view the package you want to delete, open the App-V 5.0 Management Console and select **Packages**. Select the package to be removed. - -2. Right-click the package, and select **delete** to remove the package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md b/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md deleted file mode 100644 index c84a1d788d..0000000000 --- a/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to deploy App-V 5.0 Packages Using Electronic Software Distribution -description: How to deploy App-V 5.0 Packages Using Electronic Software Distribution -author: dansimp -ms.assetid: 08e5e05b-dbb8-4be7-b2d8-721ef627da81 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to deploy App-V 5.0 Packages Using Electronic Software Distribution - - -You can use an electronic software distribution (ESD) system to deploy App-V 5.0 virtual applications to App-V clients. For details, see the documentation available with the ESD you are using. - -For component requirements and options for using an ESD to deploy App-V packages, see [Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md). - -Use one of the following methods to publish packages to App-V client computers with an ESD: - - ---- - - - - - - - - - - - - - - - - - - - - -
          MethodDescription

          Functionality provided by a third-party ESD

          Use the functionality in a third-party ESD.

          Stand-alone Windows Installer

          Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V 5.0 package file information used to configure a package and copies the required package files to the client.

          PowerShell

          Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.0, see Administering App-V by Using PowerShell.

          - - - -**To deploy App-V 5.0 packages by using an ESD** - -1. Install the App-V 5.0 Sequencer on a computer in your environment. For more information about installing the sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. Use the App-V 5.0 Sequencer to create virtual application. For information about creating a virtual application, see [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md). - -3. After you create the virtual application, deploy the package by using your ESD solution. - - If you are using System Center Configuration Manager, start by reviewing [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) for information about using App-V 5.0 and System Center 2012 Configuration Manager. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md b/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md deleted file mode 100644 index 6171caac63..0000000000 --- a/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to deploy App-V 5.1 Packages Using Electronic Software Distribution -description: How to deploy App-V 5.1 Packages Using Electronic Software Distribution -author: dansimp -ms.assetid: e1957a5a-1f18-42da-b2c1-a5ae5a4cca7a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to deploy App-V 5.1 Packages Using Electronic Software Distribution - - -You can use an electronic software distribution (ESD) system to deploy App-V 5.1 virtual applications to App-V clients. For details, see the documentation available with the ESD you are using. - -For component requirements and options for using an ESD to deploy App-V packages, see [Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md). - -Use one of the following methods to publish packages to App-V client computers with an ESD: - - ---- - - - - - - - - - - - - - - - - - - - - -
          MethodDescription

          Functionality provided by a third-party ESD

          Use the functionality in a third-party ESD.

          Stand-alone Windows Installer

          Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V 5.1 package file information used to configure a package and copies the required package files to the client.

          PowerShell

          Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.1, see Administering App-V 5.1 by Using PowerShell.

          - - - -**To deploy App-V 5.1 packages by using an ESD** - -1. Install the App-V 5.1 Sequencer on a computer in your environment. For more information about installing the sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. Use the App-V 5.1 Sequencer to create virtual application. For information about creating a virtual application, see [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md). - -3. After you create the virtual application, deploy the package by using your ESD solution. - - If you are using System Center Configuration Manager, start by reviewing [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) for information about using App-V 5.1 and System Center 2012 Configuration Manager. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md deleted file mode 100644 index b201ab4069..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer -description: How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer -ms.assetid: 5b7e27e4-4360-464c-b832-f1c7939e5485 -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.date: 06/21/2016 ---- - -# How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer - -**Note:** App-V 4.6 has exited Mainstream support. The following assumes that the App-V 4.6 SP3 client is already installed. - -Use the following information to install the App-V 5.0 client (preferably, with the latest Service Packs and hotfixes) and the App-V 4.6 SP3 client on the same computer. For supported versions, requirements, and other planning information, see [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md). - -**To deploy the App-V 5.0 client and App-V 4.6 client on the same computer** - -1. Install the App-V 5.0 SP3 client on the computer that is running the App-V 4.6 version of the client. For best results, we recommend that you install all available updates to the App-V 5.0 SP3 client. - -2. Convert or re-sequence the packages gradually. - - - To convert the packages, use the App-V 5.0 package converter and convert the required packages to the App-V 5.0 (**.appv**) file format. - - - To re-sequence the packages, consider using the latest version of the Sequencer for best results. - - For more information about publishing packages, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md). - -3. Deploy packages to the client computers. - -4. Convert extension points, as needed. For more information, see the following resources: - - - [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) - - - [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md) - - - [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md) - -5. Test that your App-V 5.0 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](https://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md) - -[Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md deleted file mode 100644 index 90cb9db9a7..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer -description: How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer -ms.assetid: 498d50c7-f13d-4fbb-8ea1-b959ade26fdf -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer - -**Note:** App-V 4.6 has exited Mainstream support. - -Use the following information to install the Microsoft Application Virtualization (App-V) 5.1 client (preferably, with the latest Service Packs and hotfixes) and the App-V 4.6 SP2 client or the App-V 4.6 S3 client on the same computer. For supported versions, requirements, and other planning information, see [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md). - -**To deploy the App-V 5.1 client and App-V 4.6 client on the same computer** - -1. Install the following version of the App-V client on the computer that is running App-V 4.6. - - - [Microsoft Application Virtualization 4.6 Service Pack 3](https://www.microsoft.com/download/details.aspx?id=41187) - -2. Install the App-V 5.1 client on the computer that is running the App-V 4.6 SP3 version of the client. For best results, we recommend that you install all available updates to the App-V 5.1 client. - -3. Convert or re-sequence the packages gradually. - - - To convert the packages, use the App-V 5.1 package converter and convert the required packages to the App-V 5.1 (**.appv**) file format. - - - To re-sequence the packages, consider using the latest version of the Sequencer for best results. - - For more information about publishing packages, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md). - -4. Deploy packages to the client computers. - -5. Convert extension points, as needed. For more information, see the following resources: - - - [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) - - - [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md) - - - [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md) - -6. Test that your App-V 5.1 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](https://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md) - -[Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md deleted file mode 100644 index b58dcbe9cc..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md +++ /dev/null @@ -1,280 +0,0 @@ ---- -title: How to Deploy the App-V 5.0 Server -description: How to Deploy the App-V 5.0 Server -author: dansimp -ms.assetid: 4f8f16af-7d74-42b4-84b8-b04ce668225d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V 5.0 Server - - -Use the following procedure to install the App-V 5.0 server. For information about deploying the App-V 5.0 SP3 Server, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-migrate-to-50sp3). - -**Before you start:** - -- Ensure that you’ve installed prerequisite software. See [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -- Review the server section of [App-V 5.0 Security Considerations](app-v-50-security-considerations.md). - -- Specify a port where each component will be hosted. - -- Add firewall rules to allow incoming requests to access the specified ports. - -- If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md). - -**To install the App-V 5.0 server** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it. - -2. Start the App-V 5.0 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. - -3. Review and accept the license terms, and choose whether to enable Microsoft updates. - -4. On the **Feature Selection** page, select all of the following components. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ComponentDescription

          Management server

          Provides overall management functionality for the App-V infrastructure.

          Management database

          Facilitates database predeployments for App-V management.

          Publishing server

          Provides hosting and streaming functionality for virtual applications.

          Reporting server

          Provides App-V 5.0 reporting services.

          Reporting database

          Facilitates database predeployments for App-V reporting.

          - - - -5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. - -6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
          MethodWhat you need to do

          You are using a custom Microsoft SQL Server instance.

          Select Use the custom instance, and type the name of the instance.

          -

          Use the format INSTANCENAME. The assumed installation location is the local computer.

          -

          Not supported: A server name using the format ServerName<strong>INSTANCE.

          You are using a custom database name.

          Select Custom configuration and type the database name.

          -

          The database name must be unique, or the installation will fail.

          - - - -7. On the **Configure** page, accept the default value **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
          MethodWhat you need to do

          You are using a custom Microsoft SQL Server instance.

          Select Use the custom instance, and type the name of the instance.

          -

          Use the format INSTANCENAME. The assumed installation location is the local computer.

          -

          Not supported: A server name using the format ServerName<strong>INSTANCE.

          You are using a custom database name.

          Select Custom configuration and type the database name.

          -

          The database name must be unique, or the installation will fail.

          - - - -9. On the **Configure** page, accept the default value: **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -10. On the **Configure** (Management Server Configuration) page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Item to configureDescription and examples

          Type the AD group with sufficient permissions to manage the App-V environment.

          Example: MyDomain\MyUser

          -

          After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.

          Website name: Specify the custom name that will be used to run the publishing service.

          If you do not have a custom name, do not make any changes.

          Port binding: Specify a unique port number that will be used by App-V.

          Example: 12345

          -

          Ensure that the port specified is not being used by another website.

          - - - -11. On the **Configure** **Publishing Server Configuration** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Item to configureDescription and examples

          Specify the URL for the management service.

          Example: http://localhost:12345

          Website name: Specify the custom name that will be used to run the publishing service.

          If you do not have a custom name, do not make any changes.

          Port binding: Specify a unique port number that will be used by App-V.

          Example: 54321

          -

          Ensure that the port specified is not being used by another website.

          - - - -12. On the **Reporting Server** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - -
          Item to configureDescription and examples

          Website name: Specify the custom name that will be used to run the Reporting Service.

          If you do not have a custom name, do not make any changes.

          Port binding: Specify a unique port number that will be used by App-V.

          Example: 55555

          -

          Ensure that the port specified is not being used by another website.

          - - - -13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. - -14. To verify that the setup completed successfully, open a web browser, and type the following URL: - - **http://<Management server machine name>:<Management service port number>/Console.html**. - - Example: **http://localhost:12345/console.html**. If the installation succeeded, the App-V Management console is displayed with no errors. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer.md) - -[How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) - -[How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md deleted file mode 100644 index 03f183eae8..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md +++ /dev/null @@ -1,757 +0,0 @@ ---- -title: How to Deploy the App-V 5.0 Server Using a Script -description: How to Deploy the App-V 5.0 Server Using a Script -author: dansimp -ms.assetid: b91a35c8-df9e-4065-9187-abafbe565b84 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - - -# How to Deploy the App-V 5.0 Server Using a Script - - -In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. - -Use the following tables for more information about installing the App-V 5.0 server using the command line. - ->[!NOTE] -> The information in the following tables can also be accessed using the command line by typing the following command: ->``` -> appv\_server\_setup.exe /? ->``` - -## Common parameters and Examples - - - - - - - - - - - - -

          To Install the Management server and Management database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /MANAGEMENT_DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /MANAGEMENT_DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /MANAGEMENT_SERVER

          -

          /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

          -

          /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

          -

          /MANAGEMENT_WEBSITE_PORT=”8080”

          -

          /DB_PREDEPLOY_MANAGEMENT

          -

          /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /MANAGEMENT_DB_NAME=”AppVManagement”

          - - - - - - - - - - - - -

          To Install the Management server using an existing Management database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /MANAGEMENT_SERVER

          -

          /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

          -

          /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

          -

          /MANAGEMENT_WEBSITE_PORT=”8080”

          -

          /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          -

          /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

          -

          /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

            - - - - - - - - - - - - -

          To install the Management server using an existing Management database on a remote machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /MANAGEMENT_SERVER

          -

          /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

          -

          /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

          -

          /MANAGEMENT_WEBSITE_PORT=”8080”

          -

          /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”

          -

          /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

          -

          /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

          - - - - - - - - - - - - -

          To Install the Management database and the Management Server on the same computer.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_MANAGEMENT

          -

          /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /MANAGEMENT_DB_NAME=”AppVManagement”

          -

          /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          -

          /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - - - - - - - - - - - - -

          To install the Management database on a different computer than the Management server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_MANAGEMENT

          -

          /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /MANAGEMENT_DB_NAME=”AppVManagement”

          -

          /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

          -

          /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - - - - - - - - - - - - -

          To Install the publishing server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /PUBLISHING_SERVER

          • -
          • /PUBLISHING_MGT_SERVER

          • -
          • /PUBLISHING_WEBSITE_NAME

          • -
          • /PUBLISHING_WEBSITE_PORT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /PUBLISHING_SERVER

          -

          /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”

          -

          /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”

          -

          /PUBLISHING_WEBSITE_PORT=”8081”

          - - - - - - - - - - - - -

          To Install the Reporting server and Reporting database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /REPORTING _DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _ADMINACCOUNT

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /REPORTING _DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -
            -
          • /appv_server_setup.exe /QUIET

          • -
          • /REPORTING_SERVER

          • -
          • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

          • -
          • /REPORTING_WEBSITE_PORT=”8082”

          • -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          • -
          • /REPORTING_DB_NAME=”AppVReporting”

          • -
          - - - - - - - - - - - - -

          To Install the Reporting server and using an existing Reporting database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _ADMINACCOUNT

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /REPORTING_SERVER

          -

          /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

          -

          /REPORTING_WEBSITE_PORT=”8082”

          -

          /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          -

          /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /EXITING_REPORTING_DB_NAME=”AppVReporting”

          - - - - - - - - - - - - -

          To Install the Reporting server using an existing Reporting database on a remote machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _ADMINACCOUNT

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /REPORTING_SERVER

          -

          /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

          -

          /REPORTING_WEBSITE_PORT=”8082”

          -

          /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”

          -

          /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /EXITING_REPORTING_DB_NAME=”AppVReporting”

          - - - - - - - - - - - - -

          To install the Reporting database on the same computer as the Reporting server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_SERVER_MACHINE_USE_LOCAL

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_SERVER_MACHINE_USE_LOCAL

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_REPORTING

          -

          /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /REPORTING_DB_NAME=”AppVReporting”

          -

          /REPORTING_SERVER_MACHINE_USE_LOCAL

          -

          /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - - - - - - - - - - - - -

          To install the Reporting database on a different computer than the Reporting server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_REPORTING

          -

          /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /REPORTING_DB_NAME=”AppVReporting”

          -

          /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

          -

          /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - -## Parameter Definitions - -### General Parameters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /QUIET

          Specifies silent install.

          /UNINSTALL

          Specifies an uninstall.

          /LAYOUT

          Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.

          /LAYOUTDIR

          Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”

          /INSTALLDIR

          Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”

          /MUOPTIN

          Enables Microsoft Update. No value is expected

          /ACCEPTEULA

          Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

          - -### Management Server Installation Parameters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /MANAGEMENT_SERVER

          Specifies that the management server will be installed. No value is expected

          /MANAGEMENT_ADMINACCOUNT

          Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".

          /MANAGEMENT_WEBSITE_NAME

          Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”

          MANAGEMENT_WEBSITE_PORT

          Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.

          - -### Parameters for the Management Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /DB_PREDEPLOY_MANAGEMENT

          Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected

          /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          Indicates that the default SQL instance should be used. No value is expected.

          /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

          Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

          /MANAGEMENT_DB_NAME

          Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

          /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

          /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”

          /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”

          - -### Parameters for Installing Publishing Server - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /PUBLISHING_SERVER

          Specifies that the Publishing Server will be installed. No value is expected

          /PUBLISHING_MGT_SERVER

          Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored

          /PUBLISHING_WEBSITE_NAME

          Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”

          /PUBLISHING_WEBSITE_PORT

          Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83

          - -### Parameters for Reporting Server - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /REPORTING_SERVER

          Specifies that the Reporting Server will be installed. No value is expected

          /REPORTING_WEBSITE_NAME

          Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"

          /REPORTING_WEBSITE_PORT

          Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82

          - - - -### Parameters for using an Existing Reporting Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.

          /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

          Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

          /EXISTING_ REPORTING DB_SQLINSTANCE_USE_DEFAULT

          Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.

          /EXISTING REPORTING_DB_CUSTOM_SQLINSTANCE

          Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

          /EXISTING_ REPORTING _DB_NAME

          Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting"

          - -### Parameters for installing Reporting Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /DB_PREDEPLOY_REPORTING

          Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected

          /REPORTING_DB_SQLINSTANCE_USE_DEFAULT

          Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

          /REPORTING_DB_NAME

          Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"

          /REPORTING_SERVER_MACHINE_USE_LOCAL

          Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

          /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"

          /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"

          - -### Parameters for using an existing Management Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

          Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

          /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

          Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          /EXISTING_MANAGEMENT_DB_NAME

          Specifies the name of the existing management database that should be used. Example usage: /EXISTING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          -

          -

          Got a suggestion for App-V? Add or vote on suggestions here. Got an App-V issue? Use the App-V TechNet Forum.

          - - -## Related topics - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md b/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md deleted file mode 100644 index e3c13b3c79..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md +++ /dev/null @@ -1,796 +0,0 @@ ---- -title: How to Deploy the App-V 5.1 Server Using a Script -description: How to Deploy the App-V 5.1 Server Using a Script -author: dansimp -ms.assetid: 15c33d7b-9b61-4dbc-8674-399bb33e5f7e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V 5.1 Server Using a Script - - -In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. - -**To Install the App-V 5.1 server using a script** - -- Use the following tables for more information about installing the App-V 5.1 server using the command line. - - **Note** - The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. - - - -~~~ -**Common parameters and Examples** - - ---- - - - - - - -

          To Install the Management server and Management database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /MANAGEMENT_DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /MANAGEMENT_DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /MANAGEMENT_SERVER

          -

          /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

          -

          /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

          -

          /MANAGEMENT_WEBSITE_PORT=”8080”

          -

          /DB_PREDEPLOY_MANAGEMENT

          -

          /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /MANAGEMENT_DB_NAME=”AppVManagement”

          - - - - ---- - - - - - - -

          To Install the Management server using an existing Management database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /MANAGEMENT_SERVER

          -

          /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

          -

          /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

          -

          /MANAGEMENT_WEBSITE_PORT=”8080”

          -

          /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          -

          /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

          -

          /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

          - - - - ---- - - - - - - -

          To install the Management server using an existing Management database on a remote machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /MANAGEMENT_SERVER

          • -
          • /MANAGEMENT_ADMINACCOUNT

          • -
          • /MANAGEMENT_WEBSITE_NAME

          • -
          • /MANAGEMENT_WEBSITE_PORT

          • -
          • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_MANAGEMENT_DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /MANAGEMENT_SERVER

          -

          /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

          -

          /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

          -

          /MANAGEMENT_WEBSITE_PORT=”8080”

          -

          /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”

          -

          /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

          -

          /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

          - - - - ---- - - - - - - -

          To Install the Management database and the Management Server on the same computer.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_MANAGEMENT

          -

          /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /MANAGEMENT_DB_NAME=”AppVManagement”

          -

          /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          -

          /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - - - - ---- - - - - - - -

          To install the Management database on a different computer than the Management server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_MANAGEMENT

          • -
          • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

          • -
          • /MANAGEMENT_DB_NAME

          • -
          • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_MANAGEMENT

          -

          /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /MANAGEMENT_DB_NAME=”AppVManagement”

          -

          /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

          -

          /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - - - - ---- - - - - - - -

          To Install the publishing server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /PUBLISHING_SERVER

          • -
          • /PUBLISHING_MGT_SERVER

          • -
          • /PUBLISHING_WEBSITE_NAME

          • -
          • /PUBLISHING_WEBSITE_PORT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /PUBLISHING_SERVER

          -

          /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”

          -

          /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”

          -

          /PUBLISHING_WEBSITE_PORT=”8081”

          - - - - ---- - - - - - - -

          To Install the Reporting server and Reporting database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /REPORTING _DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _ADMINACCOUNT

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /REPORTING _DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -
            -
          • /appv_server_setup.exe /QUIET

          • -
          • /REPORTING_SERVER

          • -
          • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

          • -
          • /REPORTING_WEBSITE_PORT=”8082”

          • -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          • -
          • /REPORTING_DB_NAME=”AppVReporting”

          • -
          - - - - ---- - - - - - - -

          To Install the Reporting server and using an existing Reporting database on a local machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _ADMINACCOUNT

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          • -
          • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /REPORTING_SERVER

          -

          /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

          -

          /REPORTING_WEBSITE_PORT=”8082”

          -

          /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          -

          /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /EXITING_REPORTING_DB_NAME=”AppVReporting”

          - - - - ---- - - - - - - -

          To Install the Reporting server using an existing Reporting database on a remote machine.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /REPORTING _SERVER

          • -
          • /REPORTING _ADMINACCOUNT

          • -
          • /REPORTING _WEBSITE_NAME

          • -
          • /REPORTING _WEBSITE_PORT

          • -
          • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

          • -
          • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /EXISTING_REPORTING _DB_NAME

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /REPORTING_SERVER

          -

          /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

          -

          /REPORTING_WEBSITE_PORT=”8082”

          -

          /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”

          -

          /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /EXITING_REPORTING_DB_NAME=”AppVReporting”

          - - - - ---- - - - - - - -

          To install the Reporting database on the same computer as the Reporting server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_SERVER_MACHINE_USE_LOCAL

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_SERVER_MACHINE_USE_LOCAL

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_REPORTING

          -

          /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /REPORTING_DB_NAME=”AppVReporting”

          -

          /REPORTING_SERVER_MACHINE_USE_LOCAL

          -

          /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - - - - ---- - - - - - - -

          To install the Reporting database on a different computer than the Reporting server.

          To use the default instance of Microsoft SQL Server, use the following parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          To use a custom instance of Microsoft SQL Server, use these parameters:

          -
            -
          • /DB_PREDEPLOY_REPORTING

          • -
          • /REPORTING _DB_CUSTOM_SQLINSTANCE

          • -
          • /REPORTING _DB_NAME

          • -
          • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          • -
          • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          • -
          -

          Using a custom instance of Microsoft SQL Server example:

          -

          /appv_server_setup.exe /QUIET

          -

          /DB_PREDEPLOY_REPORTING

          -

          /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

          -

          /REPORTING_DB_NAME=”AppVReporting”

          -

          /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

          -

          /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

          - - - -**Parameter Definitions** - -**General Parameters** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /QUIET

          Specifies silent install.

          /UNINSTALL

          Specifies an uninstall.

          /LAYOUT

          Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.

          /LAYOUTDIR

          Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”

          /INSTALLDIR

          Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”

          /MUOPTIN

          Enables Microsoft Update. No value is expected

          /ACCEPTEULA

          Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

          - - - -**Management Server Installation Parameters** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /MANAGEMENT_SERVER

          Specifies that the management server will be installed. No value is expected

          /MANAGEMENT_ADMINACCOUNT

          Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".

          /MANAGEMENT_WEBSITE_NAME

          Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”

          MANAGEMENT_WEBSITE_PORT

          Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.

          - - - -**Parameters for the Management Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /DB_PREDEPLOY_MANAGEMENT

          Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected

          /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          Indicates that the default SQL instance should be used. No value is expected.

          /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

          Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

          /MANAGEMENT_DB_NAME

          Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

          /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

          Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

          /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

          Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”

          /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

          Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”

          - - - -**Parameters for Installing Publishing Server** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /PUBLISHING_SERVER

          Specifies that the Publishing Server will be installed. No value is expected

          /PUBLISHING_MGT_SERVER

          Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored

          /PUBLISHING_WEBSITE_NAME

          Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”

          /PUBLISHING_WEBSITE_PORT

          Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83

          - - - -**Parameters for Reporting Server** - - ---- - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /REPORTING_SERVER

          Specifies that the Reporting Server will be installed. No value is expected

          /REPORTING_WEBSITE_NAME

          Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"

          /REPORTING_WEBSITE_PORT

          Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82

          - - - -**Parameters for using an Existing Reporting Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

          Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.

          /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

          Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

          /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT

          Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.

          /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE

          Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

          /EXISTING_ REPORTING _DB_NAME

          Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting"

          - - - -**Parameters for installing Reporting Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /DB_PREDEPLOY_REPORTING

          Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected

          /REPORTING_DB_SQLINSTANCE_USE_DEFAULT

          Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

          /REPORTING_DB_NAME

          Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"

          /REPORTING_SERVER_MACHINE_USE_LOCAL

          Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

          /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

          Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"

          /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

          Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"

          - - - -**Parameters for using an existing Management Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterInformation

          /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

          Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

          Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

          /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

          Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

          Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          /EXISTING_MANAGEMENT_DB_NAME

          Specifies the name of the existing management database that should be used. Example usage: /EXISTING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

          -

          -

          Got a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).

          -~~~ - - - -## Related topics - - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md b/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md deleted file mode 100644 index 97b1877022..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md +++ /dev/null @@ -1,278 +0,0 @@ ---- -title: How to Deploy the App-V 5.1 Server -description: How to Deploy the App-V 5.1 Server -author: dansimp -ms.assetid: 4729beda-b98f-481b-ae74-ad71c59b1d69 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V 5.1 Server - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 server. For information about deploying the App-V 5.1 Server, see [About App-V 5.1](about-app-v-51.md#bkmk-migrate-to-51). - -**Before you start:** - -- Ensure that you’ve installed prerequisite software. See [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -- Review the server section of [App-V 5.1 Security Considerations](app-v-51-security-considerations.md). - -- Specify a port where each component will be hosted. - -- Add firewall rules to allow incoming requests to access the specified ports. - -- If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md). - -**To install the App-V 5.1 server** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it. - -2. Start the App-V 5.1 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. - -3. Review and accept the license terms, and choose whether to enable Microsoft updates. - -4. On the **Feature Selection** page, select all of the following components. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ComponentDescription

          Management server

          Provides overall management functionality for the App-V infrastructure.

          Management database

          Facilitates database predeployments for App-V management.

          Publishing server

          Provides hosting and streaming functionality for virtual applications.

          Reporting server

          Provides App-V 5.1 reporting services.

          Reporting database

          Facilitates database predeployments for App-V reporting.

          - - - -5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. - -6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
          MethodWhat you need to do

          You are using a custom Microsoft SQL Server instance.

          Select Use the custom instance, and type the name of the instance.

          -

          Use the format INSTANCENAME. The assumed installation location is the local computer.

          -

          Not supported: A server name using the format ServerName<strong>INSTANCE.

          You are using a custom database name.

          Select Custom configuration and type the database name.

          -

          The database name must be unique, or the installation will fail.

          - - - -7. On the **Configure** page, accept the default value **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
          MethodWhat you need to do

          You are using a custom Microsoft SQL Server instance.

          Select Use the custom instance, and type the name of the instance.

          -

          Use the format INSTANCENAME. The assumed installation location is the local computer.

          -

          Not supported: A server name using the format ServerName<strong>INSTANCE.

          You are using a custom database name.

          Select Custom configuration and type the database name.

          -

          The database name must be unique, or the installation will fail.

          - - - -9. On the **Configure** page, accept the default value: **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -10. On the **Configure** (Management Server Configuration) page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Item to configureDescription and examples

          Type the AD group with sufficient permissions to manage the App-V environment.

          Example: MyDomain\MyUser

          -

          After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.

          Website name: Specify the custom name that will be used to run the publishing service.

          If you do not have a custom name, do not make any changes.

          Port binding: Specify a unique port number that will be used by App-V.

          Example: 12345

          -

          Ensure that the port specified is not being used by another website.

          - - - -11. On the **Configure** **Publishing Server Configuration** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Item to configureDescription and examples

          Specify the URL for the management service.

          Example: http://localhost:12345

          Website name: Specify the custom name that will be used to run the publishing service.

          If you do not have a custom name, do not make any changes.

          Port binding: Specify a unique port number that will be used by App-V.

          Example: 54321

          -

          Ensure that the port specified is not being used by another website.

          - - - -12. On the **Reporting Server** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - -
          Item to configureDescription and examples

          Website name: Specify the custom name that will be used to run the Reporting Service.

          If you do not have a custom name, do not make any changes.

          Port binding: Specify a unique port number that will be used by App-V.

          Example: 55555

          -

          Ensure that the port specified is not being used by another website.

          - - - -13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. - -14. To verify that the setup completed successfully, open a web browser, and type the following URL: - - **http://<Management server machine name>:<Management service port number>/Console.html**. - - Example: **http://localhost:12345/console.html**. If the installation succeeded, the App-V Management console is displayed with no errors. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer51.md) - -[How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md deleted file mode 100644 index f89ee280f9..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md +++ /dev/null @@ -1,374 +0,0 @@ ---- -title: How to Deploy the App-V Client -description: How to Deploy the App-V Client -author: dansimp -ms.assetid: 981f57c9-56c3-45da-8261-0972bfad3e5b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Deploy the App-V Client - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer. - -**What to do before you start** - -1. Review and install the software prerequisites: - - Install the prerequisite software that corresponds to the version of App-V that you are installing: - - - [About App-V 5.1](about-app-v-51.md) - - - [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) - -2. Review the client coexistence and unsupported scenarios, as applicable to your installation: - - - - - - - - - - - - - - - - -

          Deploying coexisting App-V clients

          Planning for the App-V 5.1 Sequencer and Client Deployment

          Unsupported or limited installation scenarios

          See the client section in App-V 5.1 Supported Configurations

          - - - -3. Review the locations for client registry, log, and troubleshooting information: - - ---- - - - - - - - - - - - - - - -

          Client registry information

            -
          • By default, after you install the App-V 5.1 client, the client information is stored in the registry in the following registry key:

            -

            HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ APPV \ CLIENT

          • -
          • When you deploy a virtualized package to a computer that is running the App-V client, the associated package data is stored in the following location:

            -

            C: \ ProgramData \ App-V

            -

            However, you can reconfigure this location with the following registry key:

            -

            HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ SOFTWARE \ MICROSOFT \ APPV \ CLIENT \ STREAMING \ PACKAGEINSTALLATIONROOT

          • -

          Client log files

            -
          • For log file information that is associated with the App-V 5.1 Client, search in the following log:

            -

            Event logs / Applications and Services Logs / Microsoft / AppV

          • -
          • In App-V 5.0 SP3, some logs were consolidated and moved to the following location:

            -

            Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog

            -

            For a list of the moved logs, see About App-V 5.0 SP3.

          • -
          • Packages that are currently stored on computers that run the App-V 5.1 Client are saved to the following location:

            -

            C:\ProgramData\App-V&lt;package id>&lt;version id>

          • -

          Client installation troubleshooting information

          See the error log in the %temp% folder. To review the log files, click Start, type %temp%, and then look for the appv_ log.

          - - - -**To install the App-V 5.1 Client** - -1. Copy the App-V 5.1 client installation file to the computer on which it will be installed. Choose from the following client types: - - - - - - - - - - - - - - - - - - - - - - -
          Client typeFile to use

          Standard version of the client

          appv_client_setup.exe

          Remote Desktop Services version of the client

          appv_client_setup_rds.exe

          - - - -2. Double-click the installation file, and click **Install**. Before the installation begins, the installer checks the computer for any missing [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -3. Review and accept the Software License Terms, choose whether to use Microsoft Update and whether to participate in the Microsoft Customer Experience Improvement Program, and click **Install**. - -4. On the **Setup completed successfully** page, click **Close**. - - The installation creates the following entries for the App-V client in **Programs**: - - - **.exe** - - - **.msi** - - - **language pack** - - **Note** - After the installation, only the .exe file can be uninstalled. - - - -**To install the App-V 5.1 client using a script** - -1. Install all of the required prerequisite software on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If you install the client by using an .msi file, the installation will fail if any prerequisites are missing. - -2. To use a script to install the App-V 5.1 client, use the following parameters with **appv\_client\_setup.exe**. - - **Note** - The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          /INSTALLDIR

          Specifies the installation directory. Example usage: /INSTALLDIR=C:\Program Files\AppV Client

          /CEIPOPTIN

          Enables participation in the Customer Experience Improvement Program. Example usage: /CEIPOPTIN=[0|1]

          /MUOPTIN

          Enables Microsoft Update. Example usage: /MUOPTIN=[0|1]

          /PACKAGEINSTALLATIONROOT

          Specifies the directory in which to install all new applications and updates. Example usage: /PACKAGEINSTALLATIONROOT='C:\App-V Packages'

          /PACKAGESOURCEROOT

          Overrides the source location for downloading package content. Example usage: /PACKAGESOURCEROOT='http://packageStore'

          /AUTOLOAD

          Specifies how new packages will be loaded by App-V 5.1 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0].Example usage: /AUTOLOAD=[0|1|2]

          /SHAREDCONTENTSTOREMODE

          Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: /SHAREDCONTENTSTOREMODE=[0|1]

          /MIGRATIONMODE

          Allows the App-V 5.1 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage: /MIGRATIONMODE=[0|1]

          /ENABLEPACKAGESCRIPTS

          Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage: /ENABLEPACKAGESCRIPTS=[0|1]

          /ROAMINGREGISTRYEXCLUSIONS

          Specifies the registry paths that will not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients

          /ROAMINGFILEEXCLUSIONS

          Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS 'desktop;my pictures'

          /S[1-5]PUBLISHINGSERVERNAME

          Displays the name of the publishing server. Example usage: /S2PUBLISHINGSERVERNAME=MyPublishingServer

          /S[1-5]PUBLISHINGSERVERURL

          Displays the URL of the publishing server. Example usage: /S2PUBLISHINGSERVERURL=\pubserver

          /S[1-5]GLOBALREFRESHENABLED -

          Enables a global publishing refresh. Example usage: /S2GLOBALREFRESHENABLED=[0|1]

          /S[1-5]GLOBALREFRESHONLOGON

          Initiates a global publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]

          /S[1-5]GLOBALREFRESHINTERVAL -

          Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]

          /S[1-5]GLOBALREFRESHINTERVALUNIT

          Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2GLOBALREFRESHINTERVALUNIT=[0|1]

          /S[1-5]USERREFRESHENABLED

          Enables user publishing refresh. Example usage: /S2USERREFRESHENABLED=[0|1]

          /S[1-5]USERREFRESHONLOGON

          Initiates a user publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]

          /S[1-5]USERREFRESHINTERVAL -

          Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]

          /S[1-5]USERREFRESHINTERVALUNIT

          Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2USERREFRESHINTERVALUNIT=[0|1]

          /Log

          Specifies a location where the log information is saved. The default location is %Temp%. Example usage: /log C:\logs\log.log

          /q

          Specifies an unattended installation.

          /REPAIR

          Repairs a previous client installation.

          /NORESTART

          Prevents the computer from rebooting after the client installation.

          -

          The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.1 and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V.

          /UNINSTALL

          Uninstalls the client.

          /ACCEPTEULA

          Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

          /LAYOUT

          Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected.

          /LAYOUTDIR

          Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.

          /?, /h, /help

          Requests help about the previous installation parameters.

          - - - -**To install the App-V 5.1 client by using the Windows Installer (.msi) file** - -1. Install the required prerequisites on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If any prerequisites are not met, the installation will fail. - -2. Ensure that the target computers do not have any pending restarts before you install the client using the App-V 5.1 Windows Installer (.msi) files. The Windows Installer files do not flag a pending restart. - -3. Deploy one of the following Windows Installer files to the target computer. The file that you specify must match the configuration of the target computer. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Type of deploymentDeploy this file

          Computer is running a 32-bit Microsoft Windows operating system

          appv_client_MSI_x86.msi

          Computer is running a 64-bit Microsoft Windows operating system

          appv_client_MSI_x64.msi

          You are deploying the App-V 5.1 Remote Desktop Services client

          appv_client_rds_MSI_x64.msi

          - - - -4. Using the information in the following table, select the appropriate language pack **.msi** to install, based on the desired language for the target computer. The **xxxx** in the table refers to the target locale of the language pack. - - **What to know before you start:** - - - The language packs are common to both the standard App-V 5.1 client and the Remote Desktop Services version of the App-V 5.1 client. - - - If you install the App-V 5.1 client using the **.exe**, the installer will deploy only the language pack that matches the operating system running on the target computer. - - - To deploy additional language packs on a target computer, use the procedure **To install the App-V 5.1 client by using Windows Installer (.msi) file**. - - - - - - - - - - - - - - - - - - - - - - -
          Type of deploymentDeploy this file

          Computer is running a 32-bit Microsoft Windows operating system

          appv_client_LP_xxxx_ x86.msi

          Computer is running a 64-bit Microsoft Windows operating system

          appv_client_LP_xxxx_ x64.msi

          - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[About Client Configuration Settings](about-client-configuration-settings51.md) - -[How to Uninstall the App-V 5.1 Client](how-to-uninstall-the-app-v-51-client.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md deleted file mode 100644 index 3197e02c38..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: How to Deploy the App-V Client -description: How to Deploy the App-V Client -ms.author: dansimp -author: dansimp -ms.assetid: 9c4e67ae-ddaf-4e23-8c16-72d029a74a27 -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/05/2018 ---- - - -# How to Deploy the App-V Client - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer. - -**What to do before you start** - -1. Review and install the software prerequisites: - - Install the prerequisite software that corresponds to the version of App-V that you are installing: - - - [About App-V 5.0 SP3](about-app-v-50-sp3.md) - - - App-V 5.0 SP1 and App-V 5.0 SP2 – no new prerequisites in these versions - - - [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) - -2. Review the client coexistence and unsupported scenarios, as applicable to your installation: - - - | | | - |-----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------| - | Deploying coexisting App-V clients | [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) | - | Unsupported or limited installation scenarios | [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) | - - --- - -3. Review the locations for client registry, log, and troubleshooting information: - -#### Client registry information -
          • By default, after you install the App-V 5.0 client, the client information is stored in the registry in the following registry key:

            HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\APPV\CLIENT

          • When you deploy a virtualized package to a computer that is running the App-V client, the associated package data is stored in the following location:

            C:\ProgramData\App-V

            However, you can reconfigure this location with the following registry key:

            HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SOFTWARE\MICROSOFT\APPV\CLIENT\STREAMING\PACKAGEINSTALLATIONROOT

          - -#### Client log files -
          • For log file information that is associated with the App-V 5.0 Client, search in the following log:

            Event logs/Applications and Services Logs/Microsoft/AppV

          • In App-V 5.0 SP3, some logs have been consolidated and moved to the following location:

            Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog

            For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved).

          • Packages that are currently stored on computers that run the App-V 5.0 Client are saved to the following location:

            C:\ProgramData\App-V\<package id>\<version id>

          - -#### Client installation troubleshooting information -- See the error log in the **%temp%** folder. -- To review the log files, click **Start**, type **%temp%**, and then look for the **appv_ log**. - -## To install the App-V 5.0 Client - -1. Copy the App-V 5.0 client installation file to the computer on which it will be installed.

          Choose from the following client types: - - - | Client type | File to use | - |-----------------------------------------------|-------------------------------| - | Standard version of the client | **appv_client_setup.exe** | - | Remote Desktop Services version of the client | **appv_client_setup_rds.exe** | - - --- - -2. Double-click the installation file, and click **Install**. Before the installation begins, the installer checks the computer for any missing [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -3. Review and accept the Software License Terms, choose whether to use Microsoft Update and whether to participate in the Microsoft Customer Experience Improvement Program, and click **Install**. - -4. On the **Setup completed successfully** page, click **Close**. - - The installation creates the following entries for the App-V client in **Programs**: - - - **.exe** - - - **.msi** - - - **language pack** - - >[!NOTE] - >After the installation, only the .exe file can be uninstalled. - - -## To install the App-V 5.0 client using a script - -1. Install all of the required prerequisite software on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If you install the client by using an .msi file, the installation will fail if any prerequisites are missing. - -2. To use a script to install the App-V 5.0 client, use the following parameters with **appv\_client\_setup.exe**. - - >[!NOTE] - >The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter. - - | | | - |----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| - | /INSTALLDIR | Specifies the installation directory. Example usage:

          **/INSTALLDIR=C:\Program Files\AppV Client** | - | /CEIPOPTIN | Enables participation in the Customer Experience Improvement Program. Example usage:

          **/CEIPOPTIN=[0\|1\]** | - | /MUOPTIN | Enables Microsoft Update. Example usage:

          **/MUOPTIN=[0\|1\]** | - | /PACKAGEINSTALLATIONROOT | Specifies the directory in which to install all new applications and updates. Example usage:

          **/PACKAGEINSTALLATIONROOT='C:\App-V Packages'** | - | /PACKAGESOURCEROOT | Overrides the source location for downloading package content. Example usage:

          **/PACKAGESOURCEROOT=''** | - | /AUTOLOAD | Specifies how new packages will be loaded by App-V 5.0 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0]. Example usage:

          **/AUTOLOAD=[0\|1\|2\]** | - | /SHAREDCONTENTSTOREMODE | Specifies that streamed package contents will be not be saved to the local hard disk. Example usage:

          **/SHAREDCONTENTSTOREMODE=[0\|1\]** | - | /MIGRATIONMODE | Allows the App-V 5.0 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage:

          **/MIGRATIONMODE=[0\|1\]** | - | /ENABLEPACKAGESCRIPTS | Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage:

          **/ENABLEPACKAGESCRIPTS=[0\|1\]** | - | /ROAMINGREGISTRYEXCLUSIONS | Specifies the registry paths that will not roam with a user profile. Example usage:

          **/ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients** | - | /ROAMINGFILEEXCLUSIONS | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage:

          **/ROAMINGFILEEXCLUSIONS 'desktop;my pictures'** | - | /S[1-5]PUBLISHINGSERVERNAME | Displays the name of the publishing server. Example usage:

          **/S2PUBLISHINGSERVERNAME=MyPublishingServer** | - | /S[1-5]PUBLISHINGSERVERURL | Displays the URL of the publishing server. Example usage:

          **/S2PUBLISHINGSERVERURL=\\pubserver** | - | /S[1-5]GLOBALREFRESHENABLED | Enables a global publishing refresh. Example usage:

          **/S2GLOBALREFRESHENABLED=[0\|1\]** | - | /S[1-5]GLOBALREFRESHONLOGON | Initiates a global publishing refresh when a user logs on. Example usage:

          **/S2LOGONREFRESH=[0\|1\]** | - | /S[1-5]GLOBALREFRESHINTERVAL | Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]** | - | /S[1-5]GLOBALREFRESHINTERVALUNIT | Specifies the interval unit (Hours[0], Days[1]). Example usage:

          **/S2GLOBALREFRESHINTERVALUNIT=[0\|1\]** | - | /S[1-5]USERREFRESHENABLED | Enables user publishing refresh. Example usage: **/S2USERREFRESHENABLED=[0\|1\]** | - | /S[1-5]USERREFRESHONLOGON | Initiates a user publishing refresh when a user logs on. Example usage:

          **/S2LOGONREFRESH=[0\|1\]** | - | /S[1-5]USERREFRESHINTERVAL | Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]** | - | /S[1-5]USERREFRESHINTERVALUNIT | Specifies the interval unit (Hours[0], Days[1]). Example usage:

          **/S2USERREFRESHINTERVALUNIT=[0\|1\]** | - | /Log | Specifies a location where the log information is saved. The default location is %Temp%. Example usage:

          **/log C:\logs\log.log** | - | /q | Specifies an unattended installation. | - | /REPAIR | Repairs a previous client installation. | - | /NORESTART | Prevents the computer from rebooting after the client installation.

          The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.0 SPX and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V. | - | /UNINSTALL | Uninstalls the client. | - | /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage:

          **/ACCEPTEULA** or **/ACCEPTEULA=1** | - | /LAYOUT | Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected. | - | /LAYOUTDIR | Specifies the layout directory. Requires a string value. Example usage:

          **/LAYOUTDIR=”C:\Application Virtualization Client”** | - | /?, /h, /help | Requests help about the previous installation parameters. | - - --- - -## To install the App-V 5.0 client by using the Windows Installer (.msi) file - -1. Install the required prerequisites on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If any prerequisites are not met, the installation will fail. - -2. Ensure that the target computers do not have any pending restarts before you install the client using the App-V 5.0 Windows Installer (.msi) files. The Windows Installer files do not flag a pending restart. - -3. Deploy one of the following Windows Installer files to the target computer. The file that you specify must match the configuration of the target computer. - - - | Type of deployment | Deploy this file | - |-----------------------------------------------------------------|-----------------------------| - | Computer is running a 32-bit Microsoft Windows operating system | appv_client_MSI_x86.msi | - | Computer is running a 64-bit Microsoft Windows operating system | appv_client_MSI_x64.msi | - | You are deploying the App-V 5.0 Remote Desktop Services client | appv_client_rds_MSI_x64.msi | - - --- - -4. Using the information in the following table, select the appropriate language pack **.msi** to install, based on the desired language for the target computer. The **xxxx** in the table refers to the target locale of the language pack. - - **What to know before you start:** - - - The language packs are common to both the standard App-V 5.0 client and the Remote Desktop Services version of the App-V 5.0 client. - - - If you install the App-V 5.0 client using the **.exe**, the installer will deploy only the language pack that matches the operating system running on the target computer. - - - To deploy additional language packs on a target computer, use the procedure **To install the App-V 5.0 client by using Windows Installer (.msi) file**. - - | Type of deployment | Deploy this file | - |-----------------------------------------------------------------|------------------------------| - | Computer is running a 32-bit Microsoft Windows operating system | appv_client_LP_xxxx_ x86.msi | - | Computer is running a 64-bit Microsoft Windows operating system | appv_client_LP_xxxx_ x64.msi | - - --- - - **Got a suggestion for App-V**? Add or vote on [suggestions](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).

          **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[About Client Configuration Settings](about-client-configuration-settings.md) - -[How to Uninstall the App-V 5.0 Client](how-to-uninstall-the-app-v-50-client.md) diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md deleted file mode 100644 index 0427b800e1..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Deploy the App-V Databases by Using SQL Scripts -description: How to Deploy the App-V Databases by Using SQL Scripts -author: dansimp -ms.assetid: 23637936-475f-4ca5-adde-76bb27d2372b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V Databases by Using SQL Scripts - - -Use the following instructions to use SQL scripts, rather than the Windows Installer, to: - -- Install the App-V 5.0 databases - -- Upgrade the 5.0 databases to a later version - -**How to install the App-V databases by using SQL scripts** - -1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software. - -2. Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location. - -3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts. - - Example: appv\_server\_setup.exe /layout c:\\<temporary location path> - -4. Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate Readme.txt file for instructions: - - - - - - - - - - - - - - - - - - - - - - -
          DatabaseLocation of Readme.txt file to use

          Management database

          ManagementDatabase subfolder

          -
          - Important

          If you are upgrading to or installing the App-V 5.0 SP3 Management database, see SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail.

          -
          -
          - -

          Reporting database

          ReportingDatabase subfolder

          - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - -[How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md deleted file mode 100644 index c8faae6bae..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md +++ /dev/null @@ -1,241 +0,0 @@ ---- -title: How to Deploy the App-V Databases by Using SQL Scripts -description: How to Deploy the App-V Databases by Using SQL Scripts -author: dansimp -ms.assetid: 1183b1bc-d4d7-4914-a049-06e82bf2d96d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V Databases by Using SQL Scripts - - -Use the following instructions to use SQL scripts, rather than the Windows Installer, to: - -- Install the App-V 5.1 databases - -- Upgrade the App-V databases to a later version - -**Note** -If you have already deployed the App-V 5.0 SP3 database, the SQL scripts are not required to upgrade to App-V 5.1. - - - -**How to install the App-V databases by using SQL scripts** - -1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software. - -2. Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location. - -3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts. - - Example: appv\_server\_setup.exe /layout c:\\<temporary location path> - -4. Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate Readme.txt file for instructions: - - - - - - - - - - - - - - - - - - - - - - -
          DatabaseLocation of Readme.txt file to use

          Management database

          ManagementDatabase subfolder

          Reporting database

          ReportingDatabase subfolder

          - - - -~~~ -**Caution** -The readme.txt file in the ManagementDatabase subfolder is out of date. The information in the updated readme files below is the most current and should supersede the readme information provided in the **DatabaseScripts** folders. - - - -**Important** -The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. - -The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). **Step 1** is not required for versions of App-V later than App-V 5.0 SP3. -~~~ - - - -**Updated management database README file content** - -``` syntax -****************************************************************** -Before you install and use the Application Virtualization Database Scripts you must: -1.Review the Microsoft Application Virtualization Server 5.0 license terms. -2.Print and retain a copy of the license terms for your records. -By running the Microsoft Application Virtualization Database Scripts you agree to such license terms. If you do not accept them, do not use the software. -****************************************************************** - - -Steps to install "AppVManagement" schema in SQL SERVER. - - -## PREREQUISITES: - - 1. Review the installation package. The following files MUST exist: - - SQL files - --------- - Database.sql - CreateTables.sql - CreateStoredProcs.sql - UpdateTables.sql - Permissions.sql - - 2. Ensure the target SQL Server instance and SQL Server Agent service are running. - - 3. If you are not running the scripts directly on the server, ensure the - necessary SQL Server client software is installed and available from - the specified location. Specifically, the "osql" command must -## be supported for these scripts to run. - - - -## PREPARATION: - - 1. Review the database.sql file and modify as necessary. Although the - defaults are likely sufficient, it is suggested that the following - settings be reviewed: - - DATABASE - ensure name is satisfactory - default is "AppVManagement". - - 2. Review the Permissions.sql file and provide all the necessary account information - for setting up read and write access on the database. Note: Default settings -## in the file will not work. - - - -## INSTALLATION: - - 1. Run the database.sql against the "master" database. Your user - credential must have the ability to create databases. - This script will create the database. - - 2. Run the following scripts against the "AppVManagement" database using the - same account as above in order. - - CreateTables.sql - CreateStoredProcs.sql - UpdateTables.sql -## Permissions.sql - -``` - -**Updated reporting database README file content** - -``` syntax -****************************************************************** -Before you install and use the Application Virtualization Database Scripts you must: -1.Review the Microsoft Application Virtualization Server 5.0 license terms. -2.Print and retain a copy of the license terms for your records. -By running the Microsoft Application Virtualization Database Scripts you agree to such license terms. If you do not accept them, do not use the software. -****************************************************************** - -Steps to install "AppVReporting" schema in SQL SERVER. - - -## PREREQUISITES: - - 1. Review the installation package. The following files MUST exist: - - SQL files - --------- - Database.sql - UpgradeDatabase.sql - CreateTables.sql - CreateReportingStoredProcs.sql - CreateStoredProcs.sql - CreateViews.sql - InsertVersionInfo.sql - Permissions.sql - ScheduleReportingJob.sql - - 2. Ensure the target SQL Server instance and SQL Server Agent service are running. - - 3. If you are not running the scripts directly on the server, ensure the - necessary SQL Server client software is installed and executable from - the location you have chosen. Specifically, the "osql" command must -## be supported for these scripts to run. - - - -## PREPARATION: - - 1. Review the database.sql file and modify as necessary. Although the - defaults are likely sufficient, it is suggested that the following - settings be reviewed: - - DATABASE - ensure name is satisfactory - default is "AppVReporting". - - 2. Review the Permissions.sql file and provide all the necessary account information - for setting up read and write access on the database. Note: Default settings - in the file will not work. - - 3. Review the ScheduleReportingJob.sql file and make sure that the stored proc schedule - time is acceptable. The default stored proc schedule time is at 12.01 AM (line 84). - If this time is not suitable, you can change this to a more suitable time. The time is -## in the format HHMMSS. - - - -## INSTALLATION: - - 1. Run the database.sql against the "master" database. Your user - credential must have the ability to create databases. - This script will create the database. - - 2. If upgrading the database, run UpgradeDatabase.sql This will upgrade database schema. - - 2. Run the following scripts against the "AppVReporting" database using the - same account as above in order. - - CreateTables.sql - CreateReportingStoredProcs.sql - CreateStoredProcs.sql - CreateViews.sql - InsertVersionInfo.sql - Permissions.sql -## ScheduleReportingJob.sql - -``` - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - -[How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md deleted file mode 100644 index 094eff2814..0000000000 --- a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Enable Only Administrators to Publish Packages by Using an ESD -description: How to Enable Only Administrators to Publish Packages by Using an ESD -author: dansimp -ms.assetid: 03367b26-83d5-4299-ad52-b9177b9cf9a8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Only Administrators to Publish Packages by Using an ESD - - -Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md deleted file mode 100644 index 475dc5d892..0000000000 --- a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Enable Only Administrators to Publish Packages by Using an ESD -description: How to Enable Only Administrators to Publish Packages by Using an ESD -author: dansimp -ms.assetid: bbc9fda2-fc09-4d72-8d9a-e83d2fcfe234 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Only Administrators to Publish Packages by Using an ESD - - -Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md deleted file mode 100644 index 128470febf..0000000000 --- a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: How to Enable Reporting on the App-V 5.0 Client by Using PowerShell -description: How to Enable Reporting on the App-V 5.0 Client by Using PowerShell -author: dansimp -ms.assetid: a7aaf553-0f83-4cd0-8df8-93a5f1ebe497 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Reporting on the App-V 5.0 Client by Using PowerShell - - -Use the following procedure to configure the App-V 5.0 for reporting. - -**To configure the computer running the App-V 5.0 client for reporting** - -1. Install the App-V 5.0 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md). - -2. After you have installed the App-V 5.0 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SettingDescription

          ReportingEnabled

          Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.

          ReportingServerURL

          Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.

          -
          - Note

          This is the port number that was assigned during the Reporting Server setup

          -
          -
          - -

          Reporting Start Time

          This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.

          ReportingRandomDelay

          Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.

          ReportingInterval

          Specifies the retry interval that the client will use to resend data to the reporting server.

          ReportingDataCacheLimit

          Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

          ReportingDataBlockSize

          Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

          - - - -3. After the appropriate settings have been configured, the computer running the App-V 5.0 client will automatically collect data and will send the data back to the reporting server. - - Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md deleted file mode 100644 index 0bbe4ac487..0000000000 --- a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: How to Enable Reporting on the App-V 5.1 Client by Using PowerShell -description: How to Enable Reporting on the App-V 5.1 Client by Using PowerShell -author: dansimp -ms.assetid: c4c58be6-cc50-44f6-bf4f-8346fc5d0c0e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Reporting on the App-V 5.1 Client by Using PowerShell - - -Use the following procedure to configure the App-V 5.1 for reporting. - -**To configure the computer running the App-V 5.1 client for reporting** - -1. Install the App-V 5.1 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md). - -2. After you have installed the App-V 5.1 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          SettingDescription

          ReportingEnabled

          Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.

          ReportingServerURL

          Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.

          -
          - Note

          This is the port number that was assigned during the Reporting Server setup

          -
          -
          - -

          Reporting Start Time

          This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.

          ReportingRandomDelay

          Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.

          ReportingInterval

          Specifies the retry interval that the client will use to resend data to the reporting server.

          ReportingDataCacheLimit

          Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

          ReportingDataBlockSize

          Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

          - - - -3. After the appropriate settings have been configured, the computer running the App-V 5.1 client will automatically collect data and will send the data back to the reporting server. - - Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md b/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md deleted file mode 100644 index b9405a9529..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Install the App-V 5.0 Client for Shared Content Store Mode -description: How to Install the App-V 5.0 Client for Shared Content Store Mode -author: dansimp -ms.assetid: 88f09e6f-19e7-48ea-965a-907052d1a02f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the App-V 5.0 Client for Shared Content Store Mode - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 client so that it uses the App-V 5.0 Shared Content Store (SCS) mode. You should ensure that all required prerequisites are installed on the computer you plan to install to. Use the following link for a [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -**Note**   -Before performing this procedure if necessary uninstall any existing version of the App-V 5.0 client. - - - -For more information about SCS mode, see [Shared Content Store in Microsoft App-V 5.0 – Behind the Scenes](https://go.microsoft.com/fwlink/?LinkId=316879) (https://go.microsoft.com/fwlink/?LinkId=316879). - -**Install and configure the App-V 5.0 client for SCS mode** - -1. Copy the App-V 5.0 client installation files to the computer on which it will be installed. Open a command line and from the directory where the installation files are saved type one of the following options depending on the version of the client you are installing: - - - To install the RDS version of the App-V 5.0 client type: **appv\_client\_setup\_rds.exe /SHAREDCONTENTSTOREMODE=1 /q** - - - To install the standard version of the App-V 5.0 client type: **appv\_client\_setup.exe /SHAREDCONTENTSTOREMODE=1 /q** - - **Important**   - You must perform a silent installation or the installation will fail. - - - -2. After you have completed the installation you can deploy packages to the computer running the client and all package contents will be streamed across the network. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md b/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md deleted file mode 100644 index 25741ffb48..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Install the App-V 5.1 Client for Shared Content Store Mode -description: How to Install the App-V 5.1 Client for Shared Content Store Mode -author: dansimp -ms.assetid: 6f3ecb1b-b5b5-4ae0-8de9-b4ffdfd2c216 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the App-V 5.1 Client for Shared Content Store Mode - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 client so that it uses the App-V 5.1 Shared Content Store (SCS) mode. You should ensure that all required prerequisites are installed on the computer you plan to install to. Use the following link to see [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -**Note**   -Before performing this procedure if necessary uninstall any existing version of the App-V 5.1 client. - - - -For more information about SCS mode, see [Shared Content Store in Microsoft App-V 5.0 – Behind the Scenes](https://go.microsoft.com/fwlink/?LinkId=316879) (https://go.microsoft.com/fwlink/?LinkId=316879). - -**Install and configure the App-V 5.1 client for SCS mode** - -1. Copy the App-V 5.1 client installation files to the computer on which it will be installed. Open a command line and from the directory where the installation files are saved type one of the following options depending on the version of the client you are installing: - - - To install the RDS version of the App-V 5.1 client type: **appv\_client\_setup\_rds.exe /SHAREDCONTENTSTOREMODE=1 /q** - - - To install the standard version of the App-V 5.1 client type: **appv\_client\_setup.exe /SHAREDCONTENTSTOREMODE=1 /q** - - **Important**   - You must perform a silent installation or the installation will fail. - - - -2. After you have completed the installation you can deploy packages to the computer running the client and all package contents will be streamed across the network. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md deleted file mode 100644 index 22ca05448e..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -author: dansimp -ms.assetid: 9399342b-1ea7-41df-b988-33e302f9debe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell - - -Use the following PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. - -Before attempting this procedure, you should read and understand the information and examples displayed in the following list: - -- **.INPUTS** – The account or accounts used to convert to SID format. This can be a single account name or an array of account names. - -- **.OUTPUTS** - A list of account names with the corresponding SID in standard and hexadecimal formats. - -- **Examples** - - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List**. - - **$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200** - - \#> - -**To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** - -1. Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**. - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - - ```powershell - <# - .SYNOPSIS - This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. - - .DESCRIPTION - This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. - - .INPUTS - The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. - - .OUTPUTS - A list of account names with the corresponding SID in standard and hexadecimal formats - - .EXAMPLE - .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List - - .EXAMPLE - $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") - - .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 - #> - - function ConvertSIDToHexFormat - { - param([System.Security.Principal.SecurityIdentifier]$sidToConvert) - - $sb = New-Object System.Text.StringBuilder - - [int] $binLength = $sidToConvert.BinaryLength - - [Byte[]] $byteArray = New-Object Byte[] $binLength - - $sidToConvert.GetBinaryForm($byteArray, 0) - - foreach($byte in $byteArray) - { - $sb.Append($byte.ToString("X2")) |Out-Null - } - return $sb.ToString() - } - - [string[]]$myArgs = $args - - - - if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) - { - [string]::Format("{0}====== Description ======{0}{0}" + - " Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + - " Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + - " The output is written to the console in the format 'Account name SID as string SID as hexadecimal'{0}" + - " And can be written out to a file using standard PowerShell redirection{0}" + - " Please specify user accounts in the format 'DOMAIN\username'{0}" + - " Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + - " For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + - "{0}====== Arguments ======{0}" + - - - - "{0} /? Show this help message", [Environment]::NewLine) - } - else - { - #If an array was passed in, try to split it - if($myArgs.Length -eq 1) - { - $myArgs = $myArgs.Split(' ') - } - - #Parse the arguments for account names - foreach($accountName in $myArgs) - { - [string[]] $splitString = $accountName.Split('\') # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject - - if($splitString.Length -ne 2) - { - $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) - - Write-Error -Message $message - continue - } - - #Convert any account names to SIDs - try - { - [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) - - [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) - } - catch [System.Security.Principal.IdentityNotMappedException] - { - $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) - - Write-Error -Message $message - - continue - } - - #Convert regular SID to binary format used by SQL - - $hexSIDString = ConvertSIDToHexFormat $SID - - $SIDs = New-Object PSObject - - $SIDs | Add-Member NoteProperty Account $accountName - - $SIDs | Add-Member NoteProperty SID $SID.ToString() - - $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString - - Write-Output $SIDs - } - } - ``` - -3. Run the script you saved in step one of this procedure passing the accounts to convert as arguments. - - For example, - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) diff --git a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md deleted file mode 100644 index 5cabf37196..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -author: dansimp -ms.assetid: 2be6fb72-f3a6-4550-bba1-6defa78ca08a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell - - -Use the following PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. - -Before attempting this procedure, you should read and understand the information and examples displayed in the following list: - -- **.INPUTS** – The account or accounts used to convert to SID format. This can be a single account name or an array of account names. - -- **.OUTPUTS** - A list of account names with the corresponding SID in standard and hexadecimal formats. - -- **Examples** - - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List**. - - **$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200** - - \#> - -**To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** - -1. Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**. - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - - ```powershell - <# - .SYNOPSIS - This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. - .DESCRIPTION - This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. - .INPUTS - The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. - .OUTPUTS - A list of account names with the corresponding SID in standard and hexadecimal formats - .EXAMPLE - .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List - .EXAMPLE - $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") - .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 - #> - - function ConvertSIDToHexFormat - { - - param(\[System.Security.Principal.SecurityIdentifier\]$sidToConvert) - - $sb = New-Object System.Text.StringBuilder - [int] $binLength = $sidToConvert.BinaryLength - [Byte[]] $byteArray = New-Object Byte[] $binLength - $sidToConvert.GetBinaryForm($byteArray, 0) - foreach($byte in $byteArray) - { - $sb.Append($byte.ToString("X2")) |Out-Null - } - return $sb.ToString() - } - [string[]]$myArgs = $args - if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) - { - - [string]::Format("{0}====== Description ======{0}{0}" + - " Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + - " Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + - " The output is written to the console in the format 'Account name SID as string SID as hexadecimal'{0}" + - " And can be written out to a file using standard PowerShell redirection{0}" + - " Please specify user accounts in the format 'DOMAIN\username'{0}" + - " Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + - " For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + - "{0}====== Arguments ======{0}" + - "{0} /? Show this help message", [Environment]::NewLine) - } - else - { - #If an array was passed in, try to split it - if($myArgs.Length -eq 1) - { - $myArgs = $myArgs.Split(' ') - } - - #Parse the arguments for account names - foreach($accountName in $myArgs) - { - [string[]] $splitString = $accountName.Split('\') # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject - if($splitString.Length -ne 2) - { - $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) - Write-Error -Message $message - continue - } - - #Convert any account names to SIDs - try - { - [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) - [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) - } - catch [System.Security.Principal.IdentityNotMappedException] - { - $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) - Write-Error -Message $message - continue - } - - #Convert regular SID to binary format used by SQL - $hexSIDString = ConvertSIDToHexFormat $SID - - $SIDs = New-Object PSObject - $SIDs | Add-Member NoteProperty Account $accountName - $SIDs | Add-Member NoteProperty SID $SID.ToString() - $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString - - Write-Output $SIDs - } - } -3. Run the script you saved in step one of this procedure passing the accounts to convert as arguments. - - For example, - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) diff --git a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md deleted file mode 100644 index 924e89d919..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -author: dansimp -ms.assetid: 02afd6d6-4c33-4c0b-bd88-ae167b786fdf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services - - -Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. - -**Note** -After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. - - - -**To install the management database and the management server on separate computers** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Management Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Management Server Database page**, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the management server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the reporting database and the reporting server on separate computers** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Reporting Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Reporting Server Database** page, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the management and reporting databases using App-V 5.0 database scripts** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. - -2. To extract the App-V 5.0 database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - - **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”**. - -3. After the extraction has been completed, to access the App-V 5.0 database scripts and instructions readme file: - - - The App-V 5.0 Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. - - - The App-V 5.0 Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. - -4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - - **Note** - For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md). - - - -5. Run the scripts on the computer running Microsoft SQL Server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md deleted file mode 100644 index 77c7a3fd6a..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -author: dansimp -ms.assetid: 2a67402e-3119-40ea-a247-24d166af1ced -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services - - -Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. - -**Note** -After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. - - - -**To install the management database and the management server on separate computers** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Management Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Management Server Database page**, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the management server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the reporting database and the reporting server on separate computers** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Reporting Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Reporting Server Database** page, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the management and reporting databases using App-V 5.1 database scripts** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. - -2. To extract the App-V 5.1 database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - - **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”**. - -3. After the extraction has been completed, to access the App-V 5.1 database scripts and instructions readme file: - - - The App-V 5.1 Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. - - - The App-V 5.1 Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. - -4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - - **Note** - For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md). - - - -5. Run the scripts on the computer running Microsoft SQL Server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md deleted file mode 100644 index c27949ba3d..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to install the Management Server on a Standalone Computer and Connect it to the Database -description: How to install the Management Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: 95281287-cb56-4117-befd-854268ea147c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Management Server on a Standalone Computer and Connect it to the Database - - -Use the following procedure to install the management server on a standalone computer and connect it to the database. - -**To install the management server on a standalone computer and connect it to the database** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Management Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - - -~~~ -For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - -Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. -~~~ - -7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation - - Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**. - -8. Click **Install**. - -9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console.html if the installation was successful you should see the **Silverlight Management Console** appear without any error messages or warnings being displayed. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md deleted file mode 100644 index 988a91b3ff..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to install the Management Server on a Standalone Computer and Connect it to the Database -description: How to install the Management Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: 3f83c335-d976-4abd-b8f8-d7f5e50b4318 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Management Server on a Standalone Computer and Connect it to the Database - - -Use the following procedure to install the management server on a standalone computer and connect it to the database. - -**To install the management server on a standalone computer and connect it to the database** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Management Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - - -~~~ -For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - -Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. -~~~ - -7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation - - Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**. - -8. Click **Install**. - -9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md deleted file mode 100644 index ee45693fca..0000000000 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install the Publishing Server on a Remote Computer -description: How to Install the Publishing Server on a Remote Computer -author: dansimp -ms.assetid: 37970706-54ff-4799-9485-b9b49fd50f37 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Publishing Server on a Remote Computer - - -Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. - -**To install the publishing server on a separate computer** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Publishing Server Configuration** page, specify the following items: - - - The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. - - - Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name. - - - For the **Port Binding**, specify a unique port number that will be used by App-V 5.0, for example **54321**. - -7. On the **Ready to Install** page, click **Install**. - -8. After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.0 management console, use the following steps to register the server: - - 1. Open the App-V 5.0 management server console. - - 2. In the left pane, select **Servers**, and then select **Register New Server**. - - 3. Type the name of this server and a description (if required) and click **Add**. - -9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - - ```xml - - - - - - - - - ``` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md deleted file mode 100644 index c9ed253251..0000000000 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install the Publishing Server on a Remote Computer -description: How to Install the Publishing Server on a Remote Computer -author: dansimp -ms.assetid: 1c903f78-0558-458d-a149-d5f6fb55aefb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Publishing Server on a Remote Computer - - -Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. - -**To install the publishing server on a separate computer** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Publishing Server Configuration** page, specify the following items: - - - The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. - - - Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name. - - - For the **Port Binding**, specify a unique port number that will be used by App-V 5.1, for example **54321**. - -7. On the **Ready to Install** page, click **Install**. - -8. After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.1 management console, use the following steps to register the server: - - 1. Open the App-V 5.1 management server console. - - 2. In the left pane, select **Servers**, and then select **Register New Server**. - - 3. Type the name of this server and a description (if required) and click **Add**. - -9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - - ```xml - - - - - - - - - ``` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md deleted file mode 100644 index 4285fdefd0..0000000000 --- a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: d186bdb7-e522-4124-bc6d-7d5a41ba8266 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Reporting Server on a Standalone Computer and Connect it to the Database - - -Use the following procedure to install the reporting server on a standalone computer and connect it to the database. - -**Important** -Before performing the following procedure you should read and understand [About App-V 5.0 Reporting](about-app-v-50-reporting.md). - - - -**To install the reporting server on a standalone computer and connect it to the database** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Reporting Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - - -~~~ -For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - -Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. -~~~ - -7. On the **Configure Reporting Server Configuration** page. - - - Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name. - - - For the **Port binding**, specify a unique port number that will be used by App-V 5.0, for example **55555**. You should also ensure that the port specified is not being used by another website. - -8. Click **Install**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[About App-V 5.0 Reporting](about-app-v-50-reporting.md) - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md deleted file mode 100644 index 4d6223aabf..0000000000 --- a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: 11f07750-4045-4c8d-a583-7d70c9e9aa7b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Reporting Server on a Standalone Computer and Connect it to the Database - - -Use the following procedure to install the reporting server on a standalone computer and connect it to the database. - -**Important** -Before performing the following procedure you should read and understand [About App-V 5.1 Reporting](about-app-v-51-reporting.md). - - - -**To install the reporting server on a standalone computer and connect it to the database** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Reporting Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - - -~~~ -For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - -Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. -~~~ - -7. On the **Configure Reporting Server Configuration** page. - - - Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name. - - - For the **Port binding**, specify a unique port number that will be used by App-V 5.1, for example **55555**. You should also ensure that the port specified is not being used by another website. - -8. Click **Install**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[About App-V 5.1 Reporting](about-app-v-51-reporting.md) - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md b/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md deleted file mode 100644 index dac6a4e3dc..0000000000 --- a/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: How to Install the Sequencer -description: How to Install the Sequencer -author: dansimp -ms.assetid: 5e8f1696-9bc0-4f44-8cb7-b809b2daae10 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 sequencer. The computer that will run the sequencer must not be running any version of the App-V 5.1 client. - -Upgrading a previous installation of the App-V sequencer is not supported. - -**Important**   -For a full list of the sequencer requirements see sequencer sections of [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) and [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - - - -You can also use the command line to install the App-V 5.1 sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandDescription

          /INSTALLDIR

          Specifies the installation directory.

          /CEIPOPTIN

          Enables participation in the Microsoft Customer Experience Improvement Program.

          /Log

          Specifies where the installation log will be saved, the default location is %Temp%. For example, C:\ Logs \ log.log.

          /q

          Specifies a quiet or silent installation.

          /Uninstall

          Specifies the removal of the sequencer.

          /ACCEPTEULA

          Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

          /LAYOUT

          Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected.

          /LAYOUTDIR

          Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.

          /? Or /h or /help

          Displays associated help.

          - - - -**To install the App-V 5.1 sequencer** - -1. Copy the App-V 5.1 sequencer installation files to the computer on which it will be installed. Double-click **appv\_sequencer\_setup.exe** and then click **Install**. - -2. On the **Software License Terms** page, you should review the license terms. To accept the license terms select **I accept the license terms.** Click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates from running select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Customer Experience Improvement Program** page, to participate in the program select **Join the Customer Experience Improvement Program**. This will allow information to be collected about how you are using App-V 5.1. If you don’t want to participate in the program select **I don’t want to join the program at this time**. Click **Install**. - -5. To open the sequencer, click **Start** and then click **Microsoft Application Virtualization Sequencer**. - -**To troubleshoot the App-V 5.1 sequencer installation** - -- For more information regarding the sequencer installation, you can view the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv\_ log**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md b/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md deleted file mode 100644 index c02d94ec51..0000000000 --- a/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: How to Install the Sequencer -description: How to Install the Sequencer -author: dansimp -ms.assetid: a122caf0-f408-458c-b119-dc84123c1d58 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 sequencer. The computer that will run the sequencer must not be running any version of the App-V 5.0 client. - -Upgrading a previous installation of the App-V sequencer is not supported. - -**Important**   -For a full list of the sequencer requirements see sequencer sections of [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) and [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - - -You can also use the command line to install the App-V 5.0 sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandDescription

          /INSTALLDIR

          Specifies the installation directory.

          /CEIPOPTIN

          Enables participation in the Microsoft Customer Experience Improvement Program.

          /Log

          Specifies where the installation log will be saved, the default location is %Temp%. For example, C:\ Logs \ log.log.

          /q

          Specifies a quiet or silent installation.

          /Uninstall

          Specifies the removal of the sequencer.

          /ACCEPTEULA

          Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

          /LAYOUT

          Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected.

          /LAYOUTDIR

          Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.

          /? Or /h or /help

          Displays associated help.

          - - - -**To install the App-V 5.0 sequencer** - -1. Copy the App-V 5.0 sequencer installation files to the computer on which it will be installed. Double-click **appv\_sequencer\_setup.exe** and then click **Install**. - -2. On the **Software License Terms** page, you should review the license terms. To accept the license terms select **I accept the license terms.** Click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates from running select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Customer Experience Improvement Program** page, to participate in the program select **Join the Customer Experience Improvement Program**. This will allow information to be collected about how you are using App-V 5.0. If you don’t want to participate in the program select **I don’t want to join the program at this time**. Click **Install**. - -5. To open the sequencer, click **Start** and then click **Microsoft Application Virtualization Sequencer**. - -**To troubleshoot the App-V 5.0 sequencer installation** - -- For more information regarding the sequencer installation, you can view the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv\_ log**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md deleted file mode 100644 index e24a590f0a..0000000000 --- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md +++ /dev/null @@ -1,222 +0,0 @@ ---- -title: How to Load the PowerShell Cmdlets and Get Cmdlet Help -description: How to Load the PowerShell Cmdlets and Get Cmdlet Help -author: dansimp -ms.assetid: 0624495b-943e-485b-9e54-b50e4ee6591c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# How to Load the PowerShell Cmdlets and Get Cmdlet Help - - -What this topic covers: - -- [Requirements for using PowerShell cmdlets](#bkmk-reqs-using-posh) - -- [Loading the PowerShell cmdlets](#bkmk-load-cmdlets) - -- [Getting help for the PowerShell cmdlets](#bkmk-get-cmdlet-help) - -- [Displaying the help for a PowerShell cmdlet](#bkmk-display-help-cmdlet) - -## Requirements for using PowerShell cmdlets - - -Review the following requirements for using the App-V PowerShell cmdlets: - - ---- - - - - - - - - - - - - - - - - - - - - -
          RequirementDetails

          Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:

          Cmdlets that require an elevated command prompt

            -
          • Add-AppvClientPackage

          • -
          • Remove-AppvClientPackage

          • -
          • Set-AppvClientConfiguration

          • -
          • Add-AppvClientConnectionGroup

          • -
          • Remove-AppvClientConnectionGroup

          • -
          • Add-AppvPublishingServer

          • -
          • Remove-AppvPublishingServer

          • -
          • Send-AppvClientReport

          • -
          • Set-AppvClientMode

          • -
          • Set-AppvClientPackage

          • -
          • Set-AppvPublishingServer

          • -

          Cmdlets that end users can run, unless you configure them to require an elevated command prompt

            -
          • Publish-AppvClientPackage

          • -
          • Unpublish-AppvClientPackage

          • -
          -

          To configure these cmdlets to require an elevated command prompt, use one of the following methods:

          - ---- - - - - - - - - - - - - - - - - -
          MethodMore resources

          Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

          Enable the “Require publish as administrator” Group Policy setting for App-V Clients.

          How to Publish a Package by Using the Management Console

          -

           

          - - - -## Loading the PowerShell cmdlets -To load the PowerShell cmdlet modules: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type one of the following commands to load the cmdlets for the module you want: - - ---- - - - - - - - - - - - - - - - - - - - - -
          App-V componentCommand to type

          App-V Server

          Import-Module AppvServer

          App-V Sequencer

          Import-Module AppvSequencer

          App-V Client

          Import-Module AppvClient

          - - - -## Getting help for the PowerShell cmdlets -Starting in App-V 5.0 SP3, cmdlet help is available in two formats: - - ---- - - - - - - - - - - - - - - - - -
          FormatDescription

          As a downloadable module

          To download the latest help after downloading the cmdlet module:

          -
            -
          1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

          2. -
          3. Type one of the following commands to load the cmdlets for the module you want:

          4. -
          - ---- - - - - - - - - - - - - - - - - - - - - -
          App-V componentCommand to type

          App-V Server

          Update-Help -Module AppvServer

          App-V Sequencer

          Update-Help -Module AppvSequencer

          App-V Client

          Update-Help -Module AppvClient

          -

           

          On TechNet as web pages

          See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.

          - - - -## Displaying the help for a PowerShell cmdlet -To display help for a specific PowerShell cmdlet: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Get-Help** <*cmdlet*>, for example, **Get-Help Publish-AppvClientPackage**. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue**? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - - - - - - - - - diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md deleted file mode 100644 index c8f34160ab..0000000000 --- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md +++ /dev/null @@ -1,219 +0,0 @@ ---- -title: How to Load the PowerShell Cmdlets and Get Cmdlet Help -description: How to Load the PowerShell Cmdlets and Get Cmdlet Help -author: dansimp -ms.assetid: b6ae5460-2c3a-4030-b132-394d9d5a541e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# How to Load the PowerShell Cmdlets and Get Cmdlet Help - - -What this topic covers: - -- [Requirements for using PowerShell cmdlets](#bkmk-reqs-using-posh) - -- [Loading the PowerShell cmdlets](#bkmk-load-cmdlets) - -- [Getting help for the PowerShell cmdlets](#bkmk-get-cmdlet-help) - -- [Displaying the help for a PowerShell cmdlet](#bkmk-display-help-cmdlet) - -## Requirements for using PowerShell cmdlets - - -Review the following requirements for using the App-V PowerShell cmdlets: - - ---- - - - - - - - - - - - - - - - - - - - - -
          RequirementDetails

          Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:

          Cmdlets that require an elevated command prompt

            -
          • Add-AppvClientPackage

          • -
          • Remove-AppvClientPackage

          • -
          • Set-AppvClientConfiguration

          • -
          • Add-AppvClientConnectionGroup

          • -
          • Remove-AppvClientConnectionGroup

          • -
          • Add-AppvPublishingServer

          • -
          • Remove-AppvPublishingServer

          • -
          • Send-AppvClientReport

          • -
          • Set-AppvClientMode

          • -
          • Set-AppvClientPackage

          • -
          • Set-AppvPublishingServer

          • -

          Cmdlets that end users can run, unless you configure them to require an elevated command prompt

            -
          • Publish-AppvClientPackage

          • -
          • Unpublish-AppvClientPackage

          • -
          -

          To configure these cmdlets to require an elevated command prompt, use one of the following methods:

          - ---- - - - - - - - - - - - - - - - - -
          MethodMore resources

          Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

          Enable the “Require publish as administrator” Group Policy setting for App-V Clients.

          How to Publish a Package by Using the Management Console

          -

           

          - - - -## Loading the PowerShell cmdlets - -To load the PowerShell cmdlet modules: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type one of the following commands to load the cmdlets for the module you want: - - ---- - - - - - - - - - - - - - - - - - - - - -
          App-V componentCommand to type

          App-V Server

          Import-Module AppvServer

          App-V Sequencer

          Import-Module AppvSequencer

          App-V Client

          Import-Module AppvClient

          - -## Getting help for the PowerShell cmdlets -Starting in App-V 5.0 SP3, cmdlet help is available in two formats: - - ---- - - - - - - - - - - - - - - - - -
          FormatDescription

          As a downloadable module

          To download the latest help after downloading the cmdlet module:

          -
            -
          1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

          2. -
          3. Type one of the following commands to load the cmdlets for the module you want:

          4. -
          - ---- - - - - - - - - - - - - - - - - - - - - -
          App-V componentCommand to type

          App-V Server

          Update-Help -Module AppvServer

          App-V Sequencer

          Update-Help -Module AppvSequencer

          App-V Client

          Update-Help -Module AppvClient

          -

           

          On TechNet as web pages

          See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.

          - -## Displaying the help for a PowerShell cmdlet -To display help for a specific PowerShell cmdlet: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Get-Help** <*cmdlet*>, for example, **Get-Help Publish-AppvClientPackage**. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - - - - - - - - - diff --git a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md deleted file mode 100644 index 5cfa258188..0000000000 --- a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Make a Connection Group Ignore the Package Version -description: How to Make a Connection Group Ignore the Package Version -author: dansimp -ms.assetid: 6ebc1bff-d190-4f4c-a6da-e09a4cca7874 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Make a Connection Group Ignore the Package Version - - -Microsoft Application Virtualization (App-V) 5.0 SP3 enables you to configure a connection group to use any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. - -To upgrade a package in earlier versions of App-V, you had to perform several steps, including disabling the connection group and modifying the connection group’s XML definition file. - - ---- - - - - - - - - - - - - -
          Task description with App-V 5.0 SP3How to perform the task with App-V 5.0 SP3

          You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group.

          -

          How the feature works:

          -
            -
          • If the connection group has access to multiple versions of a package, the latest version is used.

          • -
          • If the connection group contains an optional package that has an incorrect version, the package is ignored and won’t block the connection group’s virtual environment from being created.

          • -
          • If the connection group contains a non-optional package that has an incorrect version, the connection group’s virtual environment cannot be created.

          • -
          ---- - - - - - - - - - - - - - - - - -
          MethodSteps

          App-V Server – Management Console

            -
          1. In the Management Console, select PACKAGES > CONNECTION GROUPS.

          2. -
          3. Select the correct connection group from the Connection Groups library.

          4. -
          5. Click EDIT in the CONNECTED PACKAGES pane.

          6. -
          7. Select Use Any Version check box next to the package name, and click Apply.

          8. -
          -

          For more about adding or upgrading packages, see How to Add or Upgrade Packages by Using the Management Console.

          App-V Client on a Stand-alone computer

            -
          1. Create the connection group XML document.

          2. -
          3. For the package to be upgraded, set the Package tag attribute VersionID to an asterisk (*).

          4. -
          5. Use the following cmdlet to add the connection group, and include the path to the connection group XML document:

            -

            Add-AppvClientConnectionGroup

          6. -
          7. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package:

            -
              -
            • RemoveAppvClientPackage

            • -
            • Add-AppvClientPackage

            • -
            • Publish-AppvClientPackage

            • -
          8. -
          -

          For more information, see:

          -
          -

           

          - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md deleted file mode 100644 index dd0494ceee..0000000000 --- a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Make a Connection Group Ignore the Package Version -description: How to Make a Connection Group Ignore the Package Version -author: dansimp -ms.assetid: db16b095-dbe2-42c7-863d-b0d5d91b2f4c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Make a Connection Group Ignore the Package Version - - -Microsoft Application Virtualization (App-V) 5.1 lets you configure a connection group to use any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. - -To upgrade a package in some earlier versions of App-V, you had to perform several steps, including disabling the connection group and modifying the connection group’s XML definition file. - - ---- - - - - - - - - - - - - -
          Task description with App-V 5.1How to perform the task with App-V 5.1

          You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group.

          -

          How the feature works:

          -
            -
          • If the connection group has access to multiple versions of a package, the latest version is used.

          • -
          • If the connection group contains an optional package that has an incorrect version, the package is ignored and won’t block the connection group’s virtual environment from being created.

          • -
          • If the connection group contains a non-optional package that has an incorrect version, the connection group’s virtual environment cannot be created.

          • -
          ---- - - - - - - - - - - - - - - - - -
          MethodSteps

          App-V Server – Management Console

            -
          1. In the Management Console, select CONNECTION GROUPS.

          2. -
          3. Select the correct connection group from the Connection Groups library.

          4. -
          5. Click EDIT in the CONNECTED PACKAGES pane.

          6. -
          7. Select Use Any Version check box next to the package name, and click Apply.

          8. -
          -

          For more about adding or upgrading packages, see How to Add or Upgrade Packages by Using the Management Console.

          App-V Client on a Stand-alone computer

            -
          1. Create the connection group XML document.

          2. -
          3. For the package to be upgraded, set the Package tag attribute VersionID to an asterisk (*).

          4. -
          5. Use the following cmdlet to add the connection group, and include the path to the connection group XML document:

            -

            Add-AppvClientConnectionGroup

          6. -
          7. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package:

            -
              -
            • RemoveAppvClientPackage

            • -
            • Add-AppvClientPackage

            • -
            • Publish-AppvClientPackage

            • -
          8. -
          -

          For more information, see:

          -
          -

           

          - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md deleted file mode 100644 index ef45d7b6df..0000000000 --- a/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell -description: How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell -author: dansimp -ms.assetid: 1d6c2d25-81ec-4ff8-9262-6b4cf484a376 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell - - -The following sections explain how to perform various management tasks on a stand-alone client computer by using PowerShell: - -- [To return a list of packages](#bkmk-return-pkgs-standalone-posh) - -- [To add a package](#bkmk-add-pkgs-standalone-posh) - -- [To publish a package](#bkmk-pub-pkg-standalone-posh) - -- [To publish a package to a specific user](#bkmk-pub-pkg-a-user-standalone-posh) - -- [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh) - -- [To unpublish an existing package](#bkmk-unpub-pkg-standalone-posh) - -- [To unpublish a package for a specific user](#bkmk-unpub-pkg-specfc-use) - -- [To remove an existing package](#bkmk-remove-pkg-standalone-posh) - -- [To enable only administrators to publish or unpublish packages](#bkmk-admins-pub-pkgs) - -- [Understanding pending packages (UserPending and GlobalPending)](#bkmk-understd-pend-pkgs) - -## To return a list of packages - - -Use the following information to return a list of packages that are entitled to a specific user: - -**Cmdlet**: Get-AppvClientPackage - -**Parameters**: -Name -Version -PackageID -VersionID - -**Example**: Get-AppvClientPackage –Name “ContosoApplication” -Version 2 - -## To add a package - - -Use the following information to add a package to a computer. - -**Important**   -This example only adds a package. It does not publish the package to the user or the computer. - - - -**Cmdlet**: Add-AppvClientPackage - -**Example**: $Contoso = Add-AppvClientPackage \\\\path\\to\\appv\\package.appv - -## To publish a package - - -Use the following information to publish a package that has been added to a specific user or globally to any user on the computer. - - ---- - - - - - - - - - - - - - - - - -
          Publishing methodCmdlet and example

          Publishing to the user

          Cmdlet: Publish-AppvClientPackage

          -

          Example: Publish-AppvClientPackage “ContosoApplication”

          Publishing globally

          Cmdlet: Publish-AppvClientPackage

          -

          Example: Publish-AppvClientPackage “ContosoApplication” -Global

          - - - -## To publish a package to a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can publish a package to a specific user by specifying the optional **–UserSID** parameter with the **Publish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Publish-AppvClientPackage - -**Example**: Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To add and publish a package - - -Use the following information to add a package to a computer and publish it to the user. - -**Cmdlet**: Add-AppvClientPackage - -**Example**: Add-AppvClientPackage \\\\path\\to\\appv\\package.appv | Publish-AppvClientPackage - -## To unpublish an existing package - - -Use the following information to unpublish a package which has been entitled to a user but not remove the package from the computer. - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” - -## To unpublish a package for a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can unpublish a package for a specific user by using the optional **–UserSID** parameter with the **Unpublish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To remove an existing package - - -Use the following information to remove a package from the computer. - -**Cmdlet**: Remove-AppvClientPackage - -**Example**: Remove-AppvClientPackage “ContosoApplication” - -**Note**   -App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://go.microsoft.com/fwlink/?LinkId=324466). - - - -## To enable only administrators to publish or unpublish packages - - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages: - - ---- - - - - - - - - - - -

          Cmdlet

          Set-AppvClientConfiguration

          Parameter

          -RequirePublishAsAdmin

          -

          Parameter values:

          -
            -
          • 0 - False

          • -
          • 1 - True

          • -
          -

          Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

          - - - -To use the App-V Management console to set this configuration, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md). - -## Understanding pending packages (UserPending and GlobalPending) - - -**Starting in App-V 5.0 SP2**: If you run a PowerShell cmdlet that affects a package that is currently in use, the task that you are trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows: - - ---- - - - - - - - - - - - - - - - - -
          Cmdlet output itemDescription

          UserPending

          Indicates whether the listed package has a pending task that is being applied to the user:

          -
            -
          • True

          • -
          • False

          • -

          GlobalPending

          Indicates whether the listed package has a pending task that is being applied globally to the computer:

          -
            -
          • True

          • -
          • False

          • -
          - - - -The pending task will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
          Task typeApplicable rule

          User-based task, e.g., publishing a package to a user

          The pending task will be performed after the user logs off and then logs back on.

          Globally based task, e.g., enabling a connection group globally

          The pending task will be performed when the computer is shut down and then restarted.

          - - - -For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md deleted file mode 100644 index fe66e53ac9..0000000000 --- a/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell -description: How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell -author: dansimp -ms.assetid: c3fd06f6-102f-43d1-a577-d5ced6ac537d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell - - -The following sections explain how to perform various management tasks on a stand-alone client computer by using PowerShell: - -- [To return a list of packages](#bkmk-return-pkgs-standalone-posh) - -- [To add a package](#bkmk-add-pkgs-standalone-posh) - -- [To publish a package](#bkmk-pub-pkg-standalone-posh) - -- [To publish a package to a specific user](#bkmk-pub-pkg-a-user-standalone-posh) - -- [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh) - -- [To unpublish an existing package](#bkmk-unpub-pkg-standalone-posh) - -- [To unpublish a package for a specific user](#bkmk-unpub-pkg-specfc-use) - -- [To remove an existing package](#bkmk-remove-pkg-standalone-posh) - -- [To enable only administrators to publish or unpublish packages](#bkmk-admins-pub-pkgs) - -- [Understanding pending packages (UserPending and GlobalPending)](#bkmk-understd-pend-pkgs) - -## To return a list of packages - - -Use the following information to return a list of packages that are entitled to a specific user: - -**Cmdlet**: Get-AppvClientPackage - -**Parameters**: -Name -Version -PackageID -VersionID - -**Example**: Get-AppvClientPackage –Name “ContosoApplication” -Version 2 - -## To add a package - - -Use the following information to add a package to a computer. - -**Important**   -This example only adds a package. It does not publish the package to the user or the computer. - - - -**Cmdlet**: Add-AppvClientPackage - -**Example**: $Contoso = Add-AppvClientPackage \\\\path\\to\\appv\\package.appv - -## To publish a package - - -Use the following information to publish a package that has been added to a specific user or globally to any user on the computer. - - ---- - - - - - - - - - - - - - - - - -
          Publishing methodCmdlet and example

          Publishing to the user

          Cmdlet: Publish-AppvClientPackage

          -

          Example: Publish-AppvClientPackage “ContosoApplication”

          Publishing globally

          Cmdlet: Publish-AppvClientPackage

          -

          Example: Publish-AppvClientPackage “ContosoApplication” -Global

          - - - -## To publish a package to a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can publish a package to a specific user by specifying the optional **–UserSID** parameter with the **Publish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Publish-AppvClientPackage - -**Example**: Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To add and publish a package - - -Use the following information to add a package to a computer and publish it to the user. - -**Cmdlet**: Add-AppvClientPackage - -**Example**: Add-AppvClientPackage \\\\path\\to\\appv\\package.appv | Publish-AppvClientPackage - -## To unpublish an existing package - - -Use the following information to unpublish a package which has been entitled to a user but not remove the package from the computer. - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” - -## To unpublish a package for a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can unpublish a package for a specific user by using the optional **–UserSID** parameter with the **Unpublish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To remove an existing package - - -Use the following information to remove a package from the computer. - -**Cmdlet**: Remove-AppvClientPackage - -**Example**: Remove-AppvClientPackage “ContosoApplication” - -**Note**   -App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://go.microsoft.com/fwlink/?LinkId=324466). - - - -## To enable only administrators to publish or unpublish packages - - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages: - - ---- - - - - - - - - - - -

          Cmdlet

          Set-AppvClientConfiguration

          Parameter

          -RequirePublishAsAdmin

          -

          Parameter values:

          -
            -
          • 0 - False

          • -
          • 1 - True

          • -
          -

          Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

          - - - -To use the App-V Management console to set this configuration, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md). - -## Understanding pending packages (UserPending and GlobalPending) - - -**Starting in App-V 5.0 SP2**: If you run a PowerShell cmdlet that affects a package that is currently in use, the task that you are trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows: - - ---- - - - - - - - - - - - - - - - - -
          Cmdlet output itemDescription

          UserPending

          Indicates whether the listed package has a pending task that is being applied to the user:

          -
            -
          • True

          • -
          • False

          • -

          GlobalPending

          Indicates whether the listed package has a pending task that is being applied globally to the computer:

          -
            -
          • True

          • -
          • False

          • -
          - - - -The pending task will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
          Task typeApplicable rule

          User-based task, e.g., publishing a package to a user

          The pending task will be performed after the user logs off and then logs back on.

          Globally based task, e.g., enabling a connection group globally

          The pending task will be performed when the computer is shut down and then restarted.

          - - - -For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md deleted file mode 100644 index 742f6905de..0000000000 --- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -description: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -author: dansimp -ms.assetid: b73ae74d-8a6f-4bb3-b1f2-0067c7bd5212 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell - - -An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. - -A connection group XML file defines the connection group that runs on the computer where you’ve installed the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](about-the-connection-group-file.md). - -This topic explains the following procedures: - -- [To add and publish the App-V packages in the connection group](#bkmk-add-pub-pkgs-in-cg) - -- [To add and enable the connection group on the App-V client](#bkmk-add-enable-cg-on-clt) - -- [To enable or disable a connection group for a specific user](#bkmk-enable-cg-for-user-poshtopic) - -- [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg) - -**To add and publish the App-V packages in the connection group** - -1. To add and publish the App-V 5.0 packages to the computer running the App-V client, type the following command: - - Add-AppvClientPackage –path c:\\tmpstore\\quartfin.appv | Publish-AppvClientPackage - -2. Repeat **step 1** of this procedure for each package in the connection group. - -**To add and enable the connection group on the App-V client** - -1. Add the connection group by typing the following command: - - Add-AppvClientConnectionGroup –path c:\\tmpstore\\financ.xml - -2. Enable the connection group by typing the following command: - - Enable-AppvClientConnectionGroup –name “Financial Applications” - - When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. - -**To enable or disable a connection group for a specific user** - -1. Review the parameter description and requirements: - - - The parameter enables an administrator to enable or disable a connection group for a specific user. - - - You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - You can run this cmdlet from the user or administrator session. - - - You must be logged in with administrative credentials to use the parameter. - - - The end user must be logged in. - - - You must provide the end user’s security identifier (SID). - -2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID): - - - - - - - - - - - - - - - - - - - - - - -
          CmdletExamples

          Enable-AppVClientConnectionGroup

          Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

          Disable -AppVClientConnectionGroup

          Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

          - -**To allow only administrators to enable connection groups** - -1. Review the description and requirement for using this cmdlet: - - - Use this cmdlet and parameter to configure the App-V client to allow only administrators (not end users) to enable or disable connection groups. - - - You must be using at least App-V 5.0 SP3 to use this cmdlet. - -2. Run the following cmdlet and parameter: - - - - - - - - - - - - - - - - - - - - - -
          CmdletParameter and valuesExample

          Set-AppvClientConfiguration

          –RequirePublishAsAdmin

          -
            -
          • 0 - False

          • -
          • 1 - True

          • -

          Set-AppvClientConfiguration –RequirePublishAsAdmin1

          - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md deleted file mode 100644 index fb63bd845f..0000000000 --- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -description: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -author: dansimp -ms.assetid: e1589eff-d306-40fb-a0ae-727190dafe26 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell - - -An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. - -A connection group XML file defines the connection group that runs on the computer where you’ve installed the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](about-the-connection-group-file51.md). - -This topic explains the following procedures: - -- [To add and publish the App-V packages in the connection group](#bkmk-add-pub-pkgs-in-cg) - -- [To add and enable the connection group on the App-V client](#bkmk-add-enable-cg-on-clt) - -- [To enable or disable a connection group for a specific user](#bkmk-enable-cg-for-user-poshtopic) - -- [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg) - -*To add and publish the App-V packages in the connection group** - -1. To add and publish the App-V 5.1 packages to the computer running the App-V client, type the following command: - - Add-AppvClientPackage –path c:\\tmpstore\\quartfin.appv | Publish-AppvClientPackage - -2. Repeat **step 1** of this procedure for each package in the connection group. - -**To add and enable the connection group on the App-V client** - -1. Add the connection group by typing the following command: - - Add-AppvClientConnectionGroup –path c:\\tmpstore\\financ.xml - -2. Enable the connection group by typing the following command: - - Enable-AppvClientConnectionGroup –name “Financial Applications” - - When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. - -**To enable or disable a connection group for a specific user** - -1. Review the parameter description and requirements: - - - The parameter enables an administrator to enable or disable a connection group for a specific user. - - - You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - You can run this cmdlet from the user or administrator session. - - - You must be logged in with administrative credentials to use the parameter. - - - The end user must be logged in. - - - You must provide the end user’s security identifier (SID). - -2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID): - - - - - - - - - - - - - - - - - - - - - - -
          CmdletExamples

          Enable-AppVClientConnectionGroup

          Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

          Disable -AppVClientConnectionGroup

          Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

          - -**To allow only administrators to enable connection groups** - -1. Review the description and requirement for using this cmdlet: - - - Use this cmdlet and parameter to configure the App-V client to allow only administrators (not end users) to enable or disable connection groups. - - - You must be using at least App-V 5.0 SP3 to use this cmdlet. - -2. Run the following cmdlet and parameter: - - - - - - - - - - - - - - - - - - - - - -
          CmdletParameter and valuesExample

          Set-AppvClientConfiguration

          –RequirePublishAsAdmin

          -
            -
          • 0 - False

          • -
          • 1 - True

          • -

          Set-AppvClientConfiguration –RequirePublishAsAdmin1

          - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index 02c3ed99ef..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer -description: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer -ms.assetid: 3ae9996f-71d9-4ca1-9aab-25b599158e55 -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer - -**Note:** App-V 4.6 has exited Mainstream support. - -Use the following procedure to migrate extension points from an App-V 4.6 package to a App-V 5.0 package using the deployment configuration file. - -**Note**   -The following procedure does not require an App-V 5.0 management server. - - - -**To migrate extension points from a package from an App-V 4.6 package to a converted App-V 5.0 package using the deployment configuration file** - -1. Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section: - - **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>** - - The following is an example of content from a deployment configuration file: - - <?xml version="1.0" ?> - - <DeploymentConfiguration - - xmlns="" PackageId=<Package ID> DisplayName=<Display Name> - - <MachineConfiguration/> - - <UserConfiguration> - - <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - - </DeploymentConfiguration> - -2. To add the App-V 5.0 package, in an elevated PowerShell command prompt type: - - PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg** - -3. To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.0. Both, the App-V 4.6 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index 19ee17d2ed..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer -description: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer -author: dansimp -ms.assetid: 4ef823a5-3106-44c5-aecc-29edf69c2fbb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer - - -Use the following procedure to migrate extension points from an App-V 4.6 package to a App-V 5.1 package using the deployment configuration file. - -**Note**   -This procedure assumes that you are running the latest version of App-V 4.6. -The following procedure does not require an App-V 5.1 management server. - - - -**To migrate extension points from a package from an App-V 4.6 package to a converted App-V 5.1 package using the deployment configuration file** - -1. Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section: - - **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>** - - The following is an example of content from a deployment configuration file: - - <?xml version="1.0" ?> - - <DeploymentConfiguration - - xmlns="" PackageId=<Package ID> DisplayName=<Display Name> - - <MachineConfiguration/> - - <UserConfiguration> - - <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - - </DeploymentConfiguration> - -2. To add the App-V 5.1 package, in an elevated PowerShell command prompt type: - - PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg** - -3. To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.1. Both, the App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md deleted file mode 100644 index 5221f2f8c7..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User -description: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User -ms.assetid: dad25992-3c75-4b7d-b4c6-c2edf43baaea -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User - -*Note:** App-V 4.6 has exited Mainstream support. - -Use the following procedure to migrate packages created with App-V using the user configuration file. - -**To convert a package** - -1. Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**. - - The following is an example of a user configuration file: - - <?xml version="1.0" ?> - - <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package> - - xmlns="; <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - -2. To add the App-V 5.0 package type the following in an elevated PowerShell command prompt: - - PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location> - - PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file> - -3. Open the application using FTAs or shortcuts now. The application should open using App-V 5.0. - - The App-V SP2 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md deleted file mode 100644 index ddcc67a299..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User -description: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User -author: dansimp -ms.assetid: 19da3776-5ebe-41e1-9890-12b84ef3c1c7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User - - -Use the following procedure to migrate packages created with App-V using the user configuration file. - -**Note**   -This procedure assumes that you are running the latest version of App-V 4.6. - -**To convert a package** - -1. Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**. - - The following is an example of a user configuration file: - - <?xml version="1.0" ?> - - <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package> - - xmlns="; <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - -2. To add the App-V 5.1 package, type the following in an elevated PowerShell command prompt window: - - PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location> - - PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file> - -3. Open the application using FTAs or shortcuts now. The application should open using App-V 5.1. - - The App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md deleted file mode 100644 index 8a537ea939..0000000000 --- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md +++ /dev/null @@ -1,168 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package -description: How to Modify an Existing Virtual Application Package -author: dansimp -ms.assetid: 6cdeec00-e4fe-4210-b4c7-6ca1ac643ddd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Modify an Existing Virtual Application Package - - -This topic explains how to: - -- [Update an application in an existing virtual application package](#bkmk-update-app-in-pkg) - -- [Modify the properties associated with an existing virtual application package](#bkmk-chg-props-in-pkg) - -- [Add a new application to an existing virtual application package](#bkmk-add-app-to-pkg) - -**Before you update a package:** - -- Ensure that you’ve installed the Microsoft Application Virtualization (App-V) Sequencer, which is required for modifying a virtual application package. To install the App-V Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -- Save the .appv file in a secure location and always trust the source before trying to open the package for editing. - -- The Managing Authority section is erroneously removed from the deployment configuration file when you update a package. Before starting the update, copy the Managing Authority section from the existing deployment configuration file, and then paste the copied section into the new configuration file after the conversion is complete. - -- If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. - -**Update an application in an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail or cause the updated application to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**.   - -10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - -**Modify the properties associated with an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Edit Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties to modify, and then click **Edit**. - -5. In the App-V Sequencer console, perform any of the following tasks as needed: - - - Import and export the manifest file. - - - Enable or disable Browser Helper Objects. - - - Import or export a VFS file. - - - Import a directory into the virtual file system. - - - Import and export virtual registry keys. - - - View package properties. - - - View associated package files. - - - Edit registry settings. - - - Review additional package settings (except operating system file properties). - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Add or edit shortcuts and file type associations. - - **Note**   - To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. - -6. When you finish changing the package properties, click **File** > **Save** to save the package. - -**Add a new application to an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Add New Application** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package to which you will add the application, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or cause the revised package to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. - -10. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 13 of this procedure. If you want to perform the following described customization, click **Customize**. - - If you are customizing, prepare the virtual package for streaming, and then click **Next**. Streaming improves the experience when the virtual application package is run on target computers. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. - -12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. - -13. On the **Completion** page, click **Close**. The package is now available in the sequencer. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md deleted file mode 100644 index cb4d6428ca..0000000000 --- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md +++ /dev/null @@ -1,158 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package -description: How to Modify an Existing Virtual Application Package -author: dansimp -ms.assetid: 86b0fe21-52b0-4a9c-9a66-c78935fe74f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Modify an Existing Virtual Application Package - - -This topic explains how to: - -- [Update an application in an existing virtual application package](#bkmk-update-app-in-pkg) - -- [Modify the properties associated with an existing virtual application package](#bkmk-chg-props-in-pkg) - -- [Add a new application to an existing virtual application package](#bkmk-add-app-to-pkg) - -**Before you update a package:** - -- Ensure that you’ve installed the Microsoft Application Virtualization (App-V) Sequencer, which is required for modifying a virtual application package. To install the App-V Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -- Save the .appv file in a secure location and always trust the source before trying to open the package for editing. - -- The Managing Authority section is erroneously removed from the deployment configuration file when you update a package. Before starting the update, copy the Managing Authority section from the existing deployment configuration file, and then paste the copied section into the new configuration file after the conversion is complete. - -- If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. - -**Update an application in an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail or cause the updated application to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**. - -10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - -**Modify the properties associated with an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Edit Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties to modify, and then click **Edit**. - -5. In the App-V Sequencer console, perform any of the following tasks as needed: - - - View package properties. - - - View associated package files. - - - Edit registry settings. - - - Review additional package settings (except operating system file properties). - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Add or edit shortcuts and file type associations. - - **Note**   - To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. - -6. When you finish changing the package properties, click **File** > **Save** to save the package. - -**Add a new application to an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Add New Application** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package to which you will add the application, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or cause the revised package to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. - -10. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 13 of this procedure. If you want to perform the following described customization, click **Customize**. - - If you are customizing, prepare the virtual package for streaming, and then click **Next**. Streaming improves the experience when the virtual application package is run on target computers. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. - -12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. - -13. On the **Completion** page, click **Close**. The package is now available in the sequencer. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md b/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md deleted file mode 100644 index 8ad3680354..0000000000 --- a/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy -description: How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy -author: dansimp -ms.assetid: 79d03a2b-2586-4ca7-bbaa-bdeb0a694279 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy - - -Use the App-V 5.0 ADMX template to configure App-V 5.0 client settings using the ADMX Template and Group Policy. - -**To modify App-V 5.0 client configuration using Group Policy** - -1. To modify the App-V 5.0 client configuration, locate the **ADMXTemplate** files that are available with App-V 5.0. - - **Note**   - Use the following link to download the App-V 5.0 **ADMX Templates**: . - - - -2. On the computer where you manage group Policy, typically the domain controller, copy the template **.admx** file to the following directory: **<Installation Drive> \\ Windows \\ PolicyDefinitions**. - - Next, on the same computer, copy the **.adml** file to the following directory: **<InstallationDrive> \\ Windows \\ PolicyDefinitions \\ en-US**. - -3. After you have copied the files open the Group Policy Management Console, to modify the policies associated with your App-V 5.0 clients browse to **Computer Configuration** / **Policies** / **Administrative Templates** / **System** / **App-V**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[About Client Configuration Settings](about-client-configuration-settings.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md b/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md deleted file mode 100644 index b316fe6660..0000000000 --- a/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy -description: How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy -author: dansimp -ms.assetid: 0d9cf13a-b29c-4c87-a776-15fea34027dd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy - - -Use the Microsoft Application Virtualization (App-V) 5.1 ADMX template to configure App-V 5.1 client settings using the ADMX Template and Group Policy. - -**To modify App-V 5.1 client configuration using Group Policy** - -1. To modify the App-V 5.1 client configuration, locate the **ADMXTemplate** files that are available with App-V 5.1. - - **Note**   - Use the following link to download the App-V 5.1 **ADMX Templates**: . - - - -2. On the computer where you manage group Policy, typically the domain controller, copy the template **.admx** file to the following directory: **<Installation Drive> \\ Windows \\ PolicyDefinitions**. - - Next, on the same computer, copy the **.adml** file to the following directory: **<InstallationDrive> \\ Windows \\ PolicyDefinitions \\ en-US**. - -3. After you have copied the files open the Group Policy Management Console, to modify the policies associated with your App-V 5.1 clients browse to **Computer Configuration** / **Policies** / **Administrative Templates** / **System** / **App-V**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[About Client Configuration Settings](about-client-configuration-settings51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md deleted file mode 100644 index b51429c229..0000000000 --- a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Modify Client Configuration by Using PowerShell -description: How to Modify Client Configuration by Using PowerShell -author: dansimp -ms.assetid: 53ccb2cf-ef81-4310-a853-efcb395f006e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Client Configuration by Using PowerShell - - -Use the following procedure to configure the App-V 5.0 client configuration. - -**To modify App-V 5.0 client configuration using PowerShell** - -1. To configure the client settings using PowerShell, use the **Set-AppvClientConfiguration** cmdlet. - -2. To modify the client configuration, open a PowerShell Command prompt and run the following cmdlet **Set-AppvClientConfiguration** with any required parameters. For example: - - `$config = Get-AppvClientConfiguration` - - `Set-AppvClientConfiguration $config` - - `Set-AppvClientConfiguration –AutoLoad 2` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md deleted file mode 100644 index ba031caf40..0000000000 --- a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Modify Client Configuration by Using PowerShell -description: How to Modify Client Configuration by Using PowerShell -author: dansimp -ms.assetid: c3a59592-bb0d-43b6-8f4e-44f3a2d5b7ea -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Client Configuration by Using PowerShell - - -Use the following procedure to configure the App-V 5.1 client configuration. - -**To modify App-V 5.1 client configuration using PowerShell** - -1. To configure the client settings using PowerShell, use the **Set-AppvClientConfiguration** cmdlet. For more information about installing PowerShell, and a list of cmdlets see, [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md). - -2. To modify the client configuration, open a PowerShell Command prompt and run the following cmdlet **Set-AppvClientConfiguration** with any required parameters. For example: - - `$config = Get-AppvClientConfiguration` - - `Set-AppvClientConfiguration $config` - - `Set-AppvClientConfiguration –AutoLoad 2` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md deleted file mode 100644 index 75439a513b..0000000000 --- a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Move the App-V Server to Another Computer -description: How to Move the App-V Server to Another Computer -author: dansimp -ms.assetid: 4fda21be-4d6b-499c-a38a-5afd57b34a47 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the App-V Server to Another Computer - - -Use the following information to create a new management server console in your environment. - -## To create a new management server console - - -The following list displays the steps necessary to create a new management server console: - -1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md). - -2. After you have completed the installation, use the following link to connect it to the App-V 5.0 database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md deleted file mode 100644 index 65179dff17..0000000000 --- a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Move the App-V Server to Another Computer -description: How to Move the App-V Server to Another Computer -author: dansimp -ms.assetid: 853af9eb-db5b-421d-a0fe-79ded8752cef -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the App-V Server to Another Computer - - -Use the following information to create a new management server console in your environment. - -## To create a new management server console - - -The following list displays the steps necessary to create a new management server console: - -1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md). - -2. After you have completed the installation, use the following link to connect it to the App-V 5.1 database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-connection-group.md b/mdop/appv-v5/how-to-publish-a-connection-group.md deleted file mode 100644 index d3e96c272e..0000000000 --- a/mdop/appv-v5/how-to-publish-a-connection-group.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Publish a Connection Group -description: How to Publish a Connection Group -author: dansimp -ms.assetid: c61db00a-8393-485c-949e-af2098b9e258 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Connection Group - - -After you create a connection group, you must publish it to computers that run the App-V client. - -**To publish a connection group** - -1. Open the App-V Management Console, and select **Packages** > **CONNECTION GROUPS**. - -2. Right-click the connection group to be published, and select **publish**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Managing Connection Groups](managing-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-connection-group51.md b/mdop/appv-v5/how-to-publish-a-connection-group51.md deleted file mode 100644 index 523eb51739..0000000000 --- a/mdop/appv-v5/how-to-publish-a-connection-group51.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Publish a Connection Group -description: How to Publish a Connection Group -author: dansimp -ms.assetid: fe89601c-23c6-4b7c-a61b-4ca50908f1b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Connection Group - - -After you create a connection group, you must publish it to computers that run the App-V client. - -**To publish a connection group** - -1. Open the App-V Management Console, and select **CONNECTION GROUPS**. - -2. Right-click the connection group to be published, and select **publish**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Managing Connection Groups](managing-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md deleted file mode 100644 index 99df93599f..0000000000 --- a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Publish a Package by Using the Management Console -description: How to Publish a Package by Using the Management Console -author: dansimp -ms.assetid: 7c6930fc-5c89-4519-a901-512dae155fd2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Package by Using the Management Console - - -Use the following procedure to publish an App-V 5.0 package. Once you publish a package, computers that are running the App-V 5.0 client can access and run the applications in that package. - -**Note**   -The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3. - - - -**To publish an App-V 5.0 package** - -1. In the App-V 5.0 Management console. right-click the name of the package to be published, and select **Publish**. - -2. Review the **Status** column to verify that the package has been published and is now available. If the package is available, the status **published** is displayed. - - If the package is not published successfully, the status **unpublished** is displayed, along with error text that explains why the package is not available. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md deleted file mode 100644 index 9a64b6ff65..0000000000 --- a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Publish a Package by Using the Management Console -description: How to Publish a Package by Using the Management Console -author: dansimp -ms.assetid: e34d2bcf-15ac-4a75-9dc8-79380b36a25f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Package by Using the Management Console - - -Use the following procedure to publish an App-V 5.1 package. Once you publish a package, computers that are running the App-V 5.1 client can access and run the applications in that package. - -**Note**   -The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3. - - - -**To publish an App-V 5.1 package** - -1. In the App-V 5.1 Management console. Click or right-click the name of the package to be published. Select **Publish**. - -2. Review the **Status** column to verify that the package has been published and is now available. If the package is available, the status **published** is displayed. - - If the package is not published successfully, the status **unpublished** is displayed, along with error text that explains why the package is not available. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md deleted file mode 100644 index abd93c7e0a..0000000000 --- a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Register and Unregister a Publishing Server by Using the Management Console -description: How to Register and Unregister a Publishing Server by Using the Management Console -author: dansimp -ms.assetid: c24f3b43-4888-41a9-9a39-973657f2b917 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Register and Unregister a Publishing Server by Using the Management Console - - -You can register and unregister publishing servers that will synchronize with the App-V 5.0 management server. You can also see the last attempt that the publishing server made to synchronize the information with the management server. - -Use the following procedure to register or unregister a publishing server. - -**To register a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md). - -2. A list of publishing servers that already synchronize with the management server is displayed. Click Register New Server to register a new server. - -3. Type a computer name of a domain joined computer on the **Server Name** line, to specify a name for the server. You should also include a domain name, for example, **MyDomain\\TestServer**. Click **Check**. - -4. Select the computer and click **Add** to add the computer to the list of servers. The new server will be displayed in the list. - -**To unregister a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md). - -2. A list of publishing servers that synchronize with the management server is displayed. - -3. To unregister the server, right-click the computer name and select the computer name and select **unregister server**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md deleted file mode 100644 index 7e06b09dbc..0000000000 --- a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Register and Unregister a Publishing Server by Using the Management Console -description: How to Register and Unregister a Publishing Server by Using the Management Console -author: dansimp -ms.assetid: 69cef0a8-8102-4697-b1ba-f16e0f25216b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Register and Unregister a Publishing Server by Using the Management Console - - -You can register and unregister publishing servers that will synchronize with the App-V 5.1 management server. You can also see the last attempt that the publishing server made to synchronize the information with the management server. - -Use the following procedure to register or unregister a publishing server. - -**To register a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-51.md). - -2. A list of publishing servers that already synchronize with the management server is displayed. Click Register New Server to register a new server. - -3. Type a computer name of a domain joined computer on the **Server Name** line, to specify a name for the server. You should also include a domain name, for example, **MyDomain\\TestServer**. Click **Check**. - -4. Select the computer and click **Add** to add the computer to the list of servers. The new server will be displayed in the list. - -**To unregister a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-51.md). - -2. A list of publishing servers that synchronize with the management server is displayed. - -3. To unregister the server, right-click the computer name and select the computer name and select **unregister server**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md deleted file mode 100644 index c290148b0d..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md +++ /dev/null @@ -1,56 +0,0 @@ -ms.reviewer: -title: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User -description: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User -ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a -author: dansimp -ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User - -*Note:** App-V 4.6 has exited Mainstream support. - -Use the following procedure to revert an App-V 5.0 package to the App-V file format using the user configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath** <path to user configuration file> - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6 SP2. - - **Note** - If you do not need the App-V 5.0 package anymore, you can unpublish the App-V 5.0 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index d154228918..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer -description: How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer -ms.assetid: 2a43ca1b-6847-4dd1-ade2-336ac4ac6af0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer - -*Note:** App-V 4.6 has exited Mainstream support. The following assumes that the App-V 4.6 SP3 client is already installed. - -Use the following procedure to revert extension points from an App-V 5.0 package to the App-V 4.6 file format using the deployment configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Set-AppvClientPackage $pkg –DynamicDeploymentConfiguration** <path to deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationType useDeploymentConfiguration** - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 SP2 package. - - Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6. - - **Note** - If you do not need the App-V 5.0 package anymore, you can unpublish the App-V 5.0 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md deleted file mode 100644 index b62aea5290..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User -description: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User -author: dansimp -ms.assetid: bd53c5d6-7fd2-4816-b03b-d59da0a35819 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User - - -Use the following procedure to revert an App-V 5.1 package to the App-V file format using the user configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath** <path to user configuration file> - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6. - - **Note** - If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index 7c6b1455cf..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer -description: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer -author: dansimp -ms.assetid: 64640b8e-de6b-4006-a33e-353d285af15e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer - - -Use the following procedure to revert extension points from an App-V 5.1 package to the App-V 4.6 file format using the deployment configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Set-AppvClientPackage $pkg –DynamicDeploymentConfiguration** <path to deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationType useDeploymentConfiguration** - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 package. - - Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6. - - **Note** - If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md deleted file mode 100644 index 8652ce06d6..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md +++ /dev/null @@ -1,332 +0,0 @@ ---- -title: How to Sequence a New Application with App-V 5.0 -description: How to Sequence a New Application with App-V 5.0 -author: dansimp -ms.assetid: a263fa84-cd6d-4219-a5c2-eb6a553b826c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application with App-V 5.0 - - -**To review or do before you start sequencing** - -1. Determine the type of virtualized application package you want to create: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Application typeDescription

          Standard

          Creates a package that contains an application or a suite of applications. This is the preferred option for most application types.

          Add-on or plug-in

          Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups.

          Middleware

          Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages by using connection groups.

          - - - -2. Copy all required installation files to the computer that is running the sequencer. - -3. Make a backup image of your virtual environment before sequencing an application, and then revert to that image each time after you finish sequencing an application. - -4. Review the following items: - - - If an application installer changes the security access to a new or existing file or directory, those changes are not captured in the package. - - - If short paths have been disabled for the virtualized package’s target volume, you must also sequence the package to a volume that was created and still has short-paths disabled. It cannot be the system volume. - - - Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden). - -**To sequence a new standard application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. - - **Note** - If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. - - - -~~~ -If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**. -~~~ - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. - - The **Primary Virtual Application Directory** displays the path where the application will be installed on target computers. To specify this location, select **Browse**. - - **Note** - Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden). - - - -~~~ -**Important** -The primary application virtual directory should match the installation location for the application that is being sequenced. For example, if you install Notepad to **C:\\Program Files\\Notepad**; you should configure **C:\\Program Files\\Notepad** as your primary virtual directory. Alternatively, you can choose to set **C:\\Notepad** as the primary virtual application directory, as long as during installation time, you configure the installer to install to **C:\\Notepad**. Editing the Application Virtualization path is an advanced configuration task. For most applications, the default path is recommended for the following reasons: - -- Application Compatibility. Some virtualized applications will not function correctly, or will fail to open if the directories are not configured with identical virtual directory paths. - -- Performance. Since no file system redirection is required, the runtime performance can improve. - - - -**Tip** -It is recommended that prior to Sequencing an application, you open the associated installer to determine the default installation directory, and then configure that location as the **Primary Virtual Application Directory**. - - - -Click **Next**. -~~~ - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. - - **Important** - You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring. - - - -~~~ -Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. -~~~ - -8. On the **Installation** page, wait while the sequencer configures the virtualized application package. - -9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. - - **Note** - To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. - - - -~~~ -Click **Next**. -~~~ - -10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -11. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note** - If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application. - - - -13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. Click **Next**. - - **Important** - Make sure that the operating systems you specify here are supported by the application you are sequencing. - - - -14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package. - - **Important** - The system does not support non-printable characters in **Comments** and **Descriptions**. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created. - - The package is now available in the sequencer. - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -**To sequence an add-on or plug-in application** - -1. - - **Note** - Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer. - - For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. - - - -~~~ -On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. -~~~ - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**. - - Click **Next**. - -7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path, or click **Browse**. - - **Note** - Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden). - - - -~~~ -Click **Next**. -~~~ - -8. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - - Optimize how the package will run across a slow or unreliable network. - - - Specify the operating systems that can run this package. - - Click **Next**. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**. - - **Note** - If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. - - - -12. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**. - -13. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package. - - **Important** - The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -**To sequence a middleware application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package. - - - -4. On the **Type of Application** page, select **Middleware**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path or click **Browse**. - - Click **Next**. - -7. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**. - -8. On the **Installation** page, wait while the sequencer configures the virtual application package. - -9. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**. - -11. On the **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package. - - **Important** - The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -12. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure. - - The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**. - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md deleted file mode 100644 index ba6d5a807d..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md +++ /dev/null @@ -1,308 +0,0 @@ ---- -title: How to Sequence a New Application with App-V 5.1 -description: How to Sequence a New Application with App-V 5.1 -author: dansimp -ms.assetid: 7d7699b1-0cb8-450d-94e7-5af937e16c21 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application with App-V 5.1 - - -**To review or do before you start sequencing** - -1. Determine the type of virtualized application package you want to create: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Application typeDescription

          Standard

          Creates a package that contains an application or a suite of applications. This is the preferred option for most application types.

          Add-on or plug-in

          Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups.

          Middleware

          Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages by using connection groups.

          - - - -2. Copy all required installation files to the computer that is running the sequencer. - -3. Make a backup image of your virtual environment before sequencing an application, and then revert to that image each time after you finish sequencing an application. - -4. Review the following items: - - - If an application installer changes the security access to a new or existing file or directory, those changes are not captured in the package. - - - If short paths have been disabled for the virtualized package’s target volume, you must also sequence the package to a volume that was created and still has short-paths disabled. It cannot be the system volume. - -> [!NOTE] -> The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -**To sequence a new standard application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - > [!IMPORTANT] - > If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -~~~ -> [!NOTE] -> There is currently no way to disable Windows Defender in Windows 10. If you receive a warning, you can safely ignore it. It is unlikely that Windows Defender will affect sequencing at all. -~~~ - - - -4. On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. - - > [!NOTE] - > If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. - - - -~~~ -If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**. -~~~ - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. - - Click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. - - > [!IMPORTANT] - > You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring. - - - -~~~ -Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. -~~~ - -8. On the **Installation** page, wait while the sequencer configures the virtualized application package. - -9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. - - > [!NOTE] - > To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. - - - -~~~ -Click **Next**. -~~~ - -10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -11. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - > [!NOTE] - > If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application. - - - -13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. Click **Next**. - - > [!IMPORTANT] - > Make sure that the operating systems you specify here are supported by the application you are sequencing. - - - -14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package. - - > [!IMPORTANT] - > The system does not support non-printable characters in **Comments** and **Descriptions**. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created. - - The package is now available in the sequencer. - - > [!IMPORTANT] - > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -**To sequence an add-on or plug-in application** - -1. > [!NOTE] - > Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer. - > - > For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. - - - -~~~ -On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. -~~~ - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - > [!IMPORTANT] - > If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**. - - Click **Next**. - -7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console. - - Click **Next**. - -8. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - - Optimize how the package will run across a slow or unreliable network. - - - Specify the operating systems that can run this package. - - Click **Next**. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**. - - > [!NOTE] - > If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. - - - -12. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**. - -13. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package. - - > [!IMPORTANT] - > The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -**To sequence a middleware application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - > [!IMPORTANT] - > If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package. - - - -4. On the **Type of Application** page, select **Middleware**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. - - Click **Next**. - -7. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**. - -8. On the **Installation** page, wait while the sequencer configures the virtual application package. - -9. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**. - -11. On the **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package. - - > [!IMPORTANT] - > The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -12. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure. - - The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**. - - > [!IMPORTANT] - > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md deleted file mode 100644 index d9728ec6c1..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Sequence a Package by Using PowerShell -description: How to Sequence a Package by Using PowerShell -author: dansimp -ms.assetid: b41feed9-d1c5-48a3-940c-9a21d594f4f8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a Package by Using PowerShell - - -Use the following procedure to create a new App-V 5.0 package using PowerShell. - -**Note**   -Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md). - - - -**To create a new virtual application using PowerShell** - -1. Install the App-V 5.0 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - -3. Using the PowerShell console, type the following: **import-module appvsequencer**. - -4. To create a package, use the **New-AppvSequencerPackage** cmdlet. The following parameters are required to create a package: - - - **Name** - specifies the name of the package. - - - **PrimaryVirtualApplicationDirectory** - specifies the path to the directory that will be used to install the application. This path must exist. - - - **Installer** - specifies the path to the associated application installer. - - - **Path** - specifies the output directory for the package. - - For example: - - **New-AppvSequencerPackage –Name <name of Package> -PrimaryVirtualApplicationDirectory <path to the package root> -Installer <path to the installer executable> -OutputPath <directory of the output path>** - - Wait for the sequencer to create the package. Creating a package using PowerShell can take time. If the package was not created successfully an error will be returned. - - The following list displays additional optional parameters that can be used with **New-AppvSequencerPackage** cmdlet: - - - AcceleratorFilePath – specifies the path to the accelerator .cab file to generate a package. - - - InstalledFilesPath - specifies the path to where the local installed files of the application are saved. - - - InstallMediaPath - specifies the path to where the installation media is - - - TemplateFilePath - specifies the path to a template file if you want to customize the sequencing process. - - - FullLoad - specifies that the package must be fully downloaded to the computer running the App-V 5.0 before it can be opened. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md deleted file mode 100644 index 8a8c74258e..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Sequence a Package by Using PowerShell -description: How to Sequence a Package by Using PowerShell -author: dansimp -ms.assetid: 6134c6be-937d-4609-a516-92d49154b290 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a Package by Using PowerShell - - -Use the following procedure to create a new App-V 5.1 package using PowerShell. - -**Note**   -Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md). - - - -**To create a new virtual application using PowerShell** - -1. Install the App-V 5.1 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - -3. Using the PowerShell console, type the following: **import-module appvsequencer**. - -4. To create a package, use the **New-AppvSequencerPackage** cmdlet. The following parameters are required to create a package: - - - **Name** - specifies the name of the package. - - - **PrimaryVirtualApplicationDirectory** - specifies the path to the directory that will be used to install the application. This path must exist. - - - **Installer** - specifies the path to the associated application installer. - - - **Path** - specifies the output directory for the package. - - For example: - - **New-AppvSequencerPackage –Name <name of Package> -PrimaryVirtualApplicationDirectory <path to the package root> -Installer <path to the installer executable> -OutputPath <directory of the output path>** - - Wait for the sequencer to create the package. Creating a package using PowerShell can take time. If the package was not created successfully an error will be returned. - - The following list displays additional optional parameters that can be used with **New-AppvSequencerPackage** cmdlet: - - - AcceleratorFilePath – specifies the path to the accelerator .cab file to generate a package. - - - InstalledFilesPath - specifies the path to where the local installed files of the application are saved. - - - InstallMediaPath - specifies the path to where the installation media is - - - TemplateFilePath - specifies the path to a template file if you want to customize the sequencing process. - - - FullLoad - specifies that the package must be fully downloaded to the computer running the App-V 5.1 before it can be opened. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md deleted file mode 100644 index 1979f1b044..0000000000 --- a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -author: dansimp -ms.assetid: d41d64a0-0333-4951-ab27-db595bf0f634 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - - -Use the following procedure to transfer the access and default package configurations to another version of a package by using the management console. - -**To transfer access and configurations to another version of a package** - -1. To view the package that you want to configure, open the App-V 5.0 Management Console. Select the package to which you will transfer the new configuration, right-click the package and select **transfer default configuration from** or **transfer access and configurations from**, depending on the configuration that you want to transfer. - -2. To transfer the configuration, in the **Select Previous Version** dialog box, select the package that contains the settings that you want to transfer, and then click **OK**. - - If you select **transfer default configuration from**, then only the underlying dynamic deployment configuration will be transferred. - - If you select **transfer access and configurations from**, then all access permissions, as well as the configuration settings, will be copied. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md deleted file mode 100644 index 17e0975836..0000000000 --- a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -author: dansimp -ms.assetid: bf53f064-76ae-4eac-9266-d087c480cda7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - - -Use the following procedure to transfer the access and default package configurations to another version of a package by using the management console. - -**To transfer access and configurations to another version of a package** - -1. To view the package that you want to configure, open the App-V 5.1 Management Console. Select the package to which you will transfer the new configuration, right-click the package and select **transfer default configuration from** or **transfer access and configurations from**, depending on the configuration that you want to transfer. - -2. To transfer the configuration, in the **Select Previous Version** dialog box, select the package that contains the settings that you want to transfer, and then click **OK**. - - If you select **transfer default configuration from**, then only the underlying dynamic deployment configuration will be transferred. - - If you select **transfer access and configurations from**, then all access permissions, as well as the configuration settings, will be copied. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md b/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md deleted file mode 100644 index b30443d81b..0000000000 --- a/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Uninstall the App-V 5.0 Client -description: How to Uninstall the App-V 5.0 Client -author: dansimp -ms.assetid: 7566fb19-8d52-439a-be42-e004d95fed6f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the App-V 5.0 Client - - -Use the following procedure to uninstall the App-V 5.0 client from a computer. When you uninstall the App-V 5.0 client all packages published to the computer running the client are also removed. If the uninstall operation does not complete the packages will need to be re-published to the computer running the App-V 5.0 client. - -**Important** -You should ensure that the App-V 5.0 client service is running prior to performing the uninstall procedure. - - - -**To uninstall the App-V 5.0 Client** - -1. In Control Panel, double-click **Programs** / **Uninstall a Program**, and then double-click **Microsoft Application Virtualization Client**. - -2. In the dialog box that appears, click **Yes** to continue with the uninstall process. - - **Important** - The uninstall process cannot be canceled or interrupted. - - - -3. A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process. - - **Note** - You can also use the command line to uninstall the App-V 5.0 client with the following switch: **/UNINSTALL**. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md b/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md deleted file mode 100644 index 119e3fda37..0000000000 --- a/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Uninstall the App-V 5.1 Client -description: How to Uninstall the App-V 5.1 Client -author: dansimp -ms.assetid: 21f2d946-fc9f-4cd3-899b-ac52b3fbc306 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the App-V 5.1 Client - - -Use the following procedure to uninstall the Microsoft Application Virtualization (App-V) 5.1 client from a computer. When you uninstall the App-V 5.1 client all packages published to the computer running the client are also removed. If the uninstall operation does not complete the packages will need to be re-published to the computer running the App-V 5.1 client. - -**Important** -You should ensure that the App-V 5.1 client service is running prior to performing the uninstall procedure. - - - -**To uninstall the App-V 5.1 Client** - -1. In Control Panel, double-click **Programs** / **Uninstall a Program**, and then double-click **Microsoft Application Virtualization Client**. - -2. In the dialog box that appears, click **Yes** to continue with the uninstall process. - - **Important** - The uninstall process cannot be canceled or interrupted. - - - -3. A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process. - - **Note** - You can also use the command line to uninstall the App-V 5.1 client with the following switch: **/UNINSTALL**. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md deleted file mode 100644 index c265b6155e..0000000000 --- a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md +++ /dev/null @@ -1,47 +0,0 @@ -ms.reviewer: -title: How to Use an App-V 4.6 Application From an App-V 5.0 Application -description: How to Use an App-V 4.6 Application From an App-V 5.0 Application -ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487 -author: msfttracyp -ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487 -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Use an App-V 4.6 Application From an App-V 5.0 Application - -*Note:** App-V 4.6 has exited Mainstream support. The following applies to an App-V 4.6 SP3 package. - -Use the following procedure to run an App-V 4.6 application with App-V 5.0 applications on a standalone client. - -**To run applications on a standalone client** - -1. Select two applications in your environment that can be opened from one another. For example, Microsoft Outlook and Adobe Acrobat Reader. You can access an email attachment created using Adobe Acrobat. - -2. Convert the packages, or create a new package for either of the applications using the App-V 5.0 format. For more information about converting packages see, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) or [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md). - -3. Add and provision the package using the App-V 5.0 management console. For more information adding and provisioning packages see, [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) and [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md). - -4. The converted application now runs using App-V 5.0 and you can open one application from the other. For example, if you converted a Microsoft Office package to an App-V 5.0 package and Adobe Acrobat is still running as an App-V 4.6 package, you can open an Adobe Acrobat Reader attachment using Microsoft Outlook. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md deleted file mode 100644 index 06eb564ecc..0000000000 --- a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Use an App-V 4.6 Application From an App-V 5.1 Application -description: How to Use an App-V 4.6 Application From an App-V 5.1 Application -author: msfttracyp -ms.assetid: 909b4391-762b-4988-b0cf-32b67f1fcf0e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Use an App-V 4.6 Application From an App-V 5.1 Application - -*Note:** App-V 4.6 has exited Mainstream support. The following applies to an App-V 4.6 SP3 package. - -Use the following procedure to run an App-V 4.6 application with App-V 5.1 applications on a standalone client. - -**Note**   -This procedure assumes that you are running the latest version of App-V 4.6. - -**To run applications on a standalone client** - -1. Select two applications in your environment that can be opened from one another. For example, Microsoft Outlook and Adobe Acrobat Reader. You can access an email attachment created using Adobe Acrobat. - -2. Convert the packages, or create a new package for either of the applications using the App-V 5.1 format. For more information about converting packages see, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) or [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md). - -3. Add and provision the package using the App-V 5.1 management console. For more information adding and provisioning packages see, [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) and [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md). - -4. The converted application now runs using App-V 5.1 and you can open one application from the other. For example, if you converted a Microsoft Office package to an App-V 5.1 package and Adobe Acrobat is still running as an App-V 4.6 package, you can open an Adobe Acrobat Reader attachment using Microsoft Outlook. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md deleted file mode 100644 index 3f0e318e6e..0000000000 --- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md +++ /dev/null @@ -1,301 +0,0 @@ ---- -title: How to Use Optional Packages in Connection Groups -description: How to Use Optional Packages in Connection Groups -author: msfttracyp -ms.assetid: 4d08a81b-55e5-471a-91dc-9a684fb3c9a1 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use Optional Packages in Connection Groups - - -Starting in Microsoft Application Virtualization (App-V) 5.0 SP3, you can add optional packages to your connection groups to simplify connection group management. The following table summarizes the tasks that you can complete more easily by using optional packages, and provides links to instructions for each task. - -**Note**   -**Optional packages are supported only in App-V 5.0 SP3.** - - - -Before using optional packages, see [Requirements for using optional packages in connection groups](#bkmk-reqs-using-cg). - - ---- - - - - - - - - - - - - - - - - -
          Link to instructionsTask

          Use one connection group, with optional packages, for multiple users who have different packages entitled to them

          Use a single connection group to make different groups of applications and plug-ins available to different end users.

          -

          For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users.

          Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group

          Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client.

          -

          You can also unpublish the optional package and republish it later without having to disable or republish the connection group.

          - - - -## Use one connection group, with optional packages, for multiple users with different packages entitled to them - - - ---- - - - - - - - - - - - - - - - - -
          Task descriptionHow to perform the task

          With App-V 5.0 SP3

          -

          You can add optional packages to connection groups, which enables you to provide different combinations of applications and plug-ins to different end users.

          -

          Example: You want to distribute Microsoft Office to your end users, but enable a certain plug-in for only a subset of users.

          -

          To do this, create a connection group that contains a package with Office, and another package with Office plug-ins, and then make the plug-ins package optional.

          -

          End users who are not entitled to the plug-in package will still be able to run Office.

          ---- - - - - - - - - - - - - - - - - - - - - -
          MethodSteps

          App-V Server – Management Console

            -
          1. In the Management Console, select PACKAGES to open the PACKAGES page.

          2. -
          3. Select CONNECTION GROUPS to display the Connection Groups library.

          4. -
          5. Select the correct connection group from the Connection Groups library.

          6. -
          7. Click EDIT in the CONNECTED PACKAGES pane.

          8. -
          9. Select Optional next to the package name.

          10. -
          11. Select the ADD PACKAGE ACCESS TO GROUP ACCESS check box. This required step adds to the connection group the package entitlements that you configured earlier when you assigned packages to Active Directory groups.

          12. -

          App-V Server - PowerShell cmdlet

          Use the following cmdlet, and specify the -Optional parameter:

          -

          Add-AppvServerConnectionGroupPackage

          -

          Syntax:

          -

          Add-AppvServerConnectionGroupPackage [-AppvServerConnectionGroup] <SerializableConnectionGroup> [[-AppvServerPackage] <PackageVersion>] [-Optional] [-Order <int>] [-UseAnyPackageVersion]

          -

          Example:

          -

          Add-AppvServerConnectionGroupPackage -Name "Connection Group 1" -PackageName "Package 1" -Optional

          App-V Client on a Stand-alone computer

            -
          1. Create the connection group XML document, and set the Package tag attribute IsOptional to “true”.

          2. -
          3. Use the following cmdlets to add and enable the connection group:

            -
              -
            • Add-AppvClientConnectionGroup

            • -
            • Enable-AppvClientConnectionGroup

            • -
          4. -
          -

          Example connection group XML document with optional packages:

          -
          <?xml version="1.0" ?>
          -<AppConnectionGroup
          -   xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
          -   AppConnectionGroupId="8105CCD5-244B-4BA1-8888-E321E688D2CB"
          -   VersionId="84CE3797-F1CB-4475-A223-757918929EB4"
          -   DisplayName="Contoso Software Connection Group" >
          -<Packages>
          -<Package
          -   PackageId="7735d1a8-5ef9-4df9-a1cf-3aa92ef54fe7"
          -   VersionId="ec560d6f-e62e-48eb-a9e5-7c52a8c2e149"
          -   DisplayName="Contoso Business Manager"
          -/>
          -
          -<Package
          -   PackageId="fc6fe0f7-be3d-4643-b37d-fc3f62d4dd5c"
          -   VersionId="c67a71cd-3542-4a48-93e8-20c643c50970"
          -   DisplayName="Contoso Forms"
          -   IsOptional="false"
          -/>
          -
          -<Package
          -   PackageId="8f6301a5-4348-4039-9560-b27a5bb72711"
          -   VersionId="6c694b45-3e19-46c6-a327-d159aa39e1d2"
          -   DisplayName="Contoso Tax"
          -   IsOptional="true"
          -/>
          -
          -<Package
          -   PackageId="89d701bc-d507-4299-b6b6-000000003472"
          -   VersionId="*"
          -   DisplayName="Contoso Accounts"
          -   IsOptional="true"
          -/>
          -
          -</Packages>
          -</AppConnectionGroup>
          -

           

          With versions earlier than App-V 5.0 SP3

          You had to create many connection groups to make specific application and plug-in combinations available to specific users.

          - - - -## Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group - - - ---- - - - - - - - - - - - - - - - - -
          Task descriptionHow to perform the task

          With App-V 5.0 SP3

          -

          You can unpublish, delete, or republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V Client.

          -

          You can also unpublish an optional package and republish it later without having to disable or republish the connection group.

          -

          Example: If you publish an optional package that contains a Microsoft Office plug-in, and you want to remove the plug-in, you can unpublish the package without having to disable the connection group.

          ---- - - - - - - - - - - - - - - - - -
          MethodSteps

          App-V Server – Management Console

            -
          • To unpublish the package: In the Management Console, select elect the PACKAGES page, right-click the package that you want to unpublish, and click unpublish.

          • -
          • To remove an optional package from a connection group: On the CONNECTION GROUPS page, select the package that you want to remove, and click the right arrow to remove the package from the connection group pane on the bottom left.

          • -

          App-V Client on a Stand-alone computer

          Use the following existing cmdlets:

          -
            -
          • Unpublish-AppvClientPackage

          • -
          • Remove-AppvClientPackage

          • -
          -

          For more information, see How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell.

          -

           

          With versions earlier than App-V 5.0 SP3

          You had to:

          -
            -
          1. Remove the connection group from each App-V Client computer where it was enabled.

          2. -
          3. Unpublish the package.

          4. -
          5. Remove the package from the connection group’s definition.

          6. -
          7. Republish the connection group.

          8. -
          - - - -## Requirements for using optional packages in connection groups - - -Review the following requirements before using optional packages in connection groups: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          RequirementDetails

          Connection groups must contain at least one non-optional package.

            -
          • Check carefully that you meet this requirement, as the App-V Server and the PowerShell cmdlet don’t validate that the requirement has been met.

          • -
          • If you accidentally create a connection group that does not contain at least one non-optional package, and the end user tries to open a packaged application in that connection group, the connection group will fail.

          • -
          -

            -
          • User-published connection groups can contain packages that are published globally or to the user.

          • -
          • Globally published connection groups must contain only globally published packages.

          • -

          Globally published connection groups must contain packages that are published globally to ensure that the packages will be available when starting the connection group’s virtual environment.

          -

          If you try to add or enable globally published connection groups that contain user-published packages, the connection group will fail.

          You must publish all non-optional packages before publishing the connection group that contains those packages.

          A connection group’s virtual environment cannot start if any non-optional packages are missing.

          -

          The App-V Client fails to add or enable a connection group if any non-optional packages have not been published.

          Before you unpublish a globally published package, ensure that the connection groups that are entitled to all the users on that computer no longer require the package.

          The system does not check whether the package is part of another user’s connection group. Unpublishing a global package will make it unavailable to every user on that computer, so make sure that each user’s connection groups no longer contain the package, or alternatively make the package optional.

          - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md deleted file mode 100644 index d507575d2e..0000000000 --- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md +++ /dev/null @@ -1,300 +0,0 @@ ---- -title: How to Use Optional Packages in Connection Groups -description: How to Use Optional Packages in Connection Groups -author: msfttracyp -ms.assetid: 67666f18-b704-4852-a1e4-d13633bd2baf -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use Optional Packages in Connection Groups - - -Starting in Microsoft Application Virtualization (App-V) 5.0 SP3, you can add optional packages to your connection groups to simplify connection group management. The following table summarizes the tasks that you can complete more easily by using optional packages, and provides links to instructions for each task. - -**Note**   -**Optional packages are not supported in releases prior to App-V 5.0 SP3.** - - - -Before using optional packages, see [Requirements for using optional packages in connection groups](#bkmk-reqs-using-cg). - - ---- - - - - - - - - - - - - - - - - -
          Link to instructionsTask

          Use one connection group, with optional packages, for multiple users who have different packages entitled to them

          Use a single connection group to make different groups of applications and plug-ins available to different end users.

          -

          For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users.

          Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group

          Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client.

          -

          You can also unpublish the optional package and republish it later without having to disable or republish the connection group.

          - - - -## Use one connection group, with optional packages, for multiple users with different packages entitled to them - - - ---- - - - - - - - - - - - - - - - - -
          Task descriptionHow to perform the task

          With App-V 5.0 SP3 and App-V 5.1

          -

          You can add optional packages to connection groups, which enables you to provide different combinations of applications and plug-ins to different end users.

          -

          Example: You want to distribute Microsoft Office to your end users, but enable a certain plug-in for only a subset of users.

          -

          To do this, create a connection group that contains a package with Office, and another package with Office plug-ins, and then make the plug-ins package optional.

          -

          End users who are not entitled to the plug-in package will still be able to run Office.

          ---- - - - - - - - - - - - - - - - - - - - - -
          MethodSteps

          App-V Server – Management Console

            -
          1. In the Management Console, select CONNECTION GROUPS to display the Connection Groups library.

          2. -
          3. Select the correct connection group from the Connection Groups library.

          4. -
          5. Click EDIT in the CONNECTED PACKAGES pane.

          6. -
          7. Select Optional next to the package name.

          8. -
          9. Select the ADD PACKAGE ACCESS TO GROUP ACCESS check box. This required step adds to the connection group the package entitlements that you configured earlier when you assigned packages to Active Directory groups.

          10. -

          App-V Server - PowerShell cmdlet

          Use the following cmdlet, and specify the -Optional parameter:

          -

          Add-AppvServerConnectionGroupPackage

          -

          Syntax:

          -

          Add-AppvServerConnectionGroupPackage [-AppvServerConnectionGroup] <SerializableConnectionGroup> [[-AppvServerPackage] <PackageVersion>] [-Optional] [-Order <int>] [-UseAnyPackageVersion]

          -

          Example:

          -

          Add-AppvServerConnectionGroupPackage -Name "Connection Group 1" -PackageName "Package 1" -Optional

          App-V Client on a Stand-alone computer

            -
          1. Create the connection group XML document, and set the Package tag attribute IsOptional to “true”.

          2. -
          3. Use the following cmdlets to add and enable the connection group:

            -
              -
            • Add-AppvClientConnectionGroup

            • -
            • Enable-AppvClientConnectionGroup

            • -
          4. -
          -

          Example connection group XML document with optional packages:

          -
          <?xml version="1.0" ?>
          -<AppConnectionGroup
          -   xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
          -   AppConnectionGroupId="8105CCD5-244B-4BA1-8888-E321E688D2CB"
          -   VersionId="84CE3797-F1CB-4475-A223-757918929EB4"
          -   DisplayName="Contoso Software Connection Group" >
          -<Packages>
          -<Package
          -   PackageId="7735d1a8-5ef9-4df9-a1cf-3aa92ef54fe7"
          -   VersionId="ec560d6f-e62e-48eb-a9e5-7c52a8c2e149"
          -   DisplayName="Contoso Business Manager"
          -/>
          -
          -<Package
          -   PackageId="fc6fe0f7-be3d-4643-b37d-fc3f62d4dd5c"
          -   VersionId="c67a71cd-3542-4a48-93e8-20c643c50970"
          -   DisplayName="Contoso Forms"
          -   IsOptional="false"
          -/>
          -
          -<Package
          -   PackageId="8f6301a5-4348-4039-9560-b27a5bb72711"
          -   VersionId="6c694b45-3e19-46c6-a327-d159aa39e1d2"
          -   DisplayName="Contoso Tax"
          -   IsOptional="true"
          -/>
          -
          -<Package
          -   PackageId="89d701bc-d507-4299-b6b6-000000003472"
          -   VersionId="*"
          -   DisplayName="Contoso Accounts"
          -   IsOptional="true"
          -/>
          -
          -</Packages>
          -</AppConnectionGroup>
          -

           

          With versions earlier than App-V 5.0 SP3

          You had to create many connection groups to make specific application and plug-in combinations available to specific users.

          - - - -## Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group - - - ---- - - - - - - - - - - - - - - - - -
          Task descriptionHow to perform the task

          With App-V 5.0 SP3 and App-V 5.1

          -

          You can unpublish, delete, or republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V Client.

          -

          You can also unpublish an optional package and republish it later without having to disable or republish the connection group.

          -

          Example: If you publish an optional package that contains a Microsoft Office plug-in, and you want to remove the plug-in, you can unpublish the package without having to disable the connection group.

          ---- - - - - - - - - - - - - - - - - -
          MethodSteps

          App-V Server – Management Console

            -
          • To unpublish the package: In the Management Console, select elect the PACKAGES page, click or right-click the package that you want to unpublish, and click Unpublish.

          • -
          • To remove an optional package from a connection group: On the CONNECTION GROUPS page, select the package that you want to remove, and click the right arrow to remove the package from the connection group pane on the bottom left.

          • -

          App-V Client on a Stand-alone computer

          Use the following existing cmdlets:

          -
            -
          • Unpublish-AppvClientPackage

          • -
          • Remove-AppvClientPackage

          • -
          -

          For more information, see How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell.

          -

           

          With versions earlier than App-V 5.0 SP3

          You had to:

          -
            -
          1. Remove the connection group from each App-V Client computer where it was enabled.

          2. -
          3. Unpublish the package.

          4. -
          5. Remove the package from the connection group’s definition.

          6. -
          7. Republish the connection group.

          8. -
          - - - -## Requirements for using optional packages in connection groups - - -Review the following requirements before using optional packages in connection groups: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          RequirementDetails

          Connection groups must contain at least one non-optional package.

            -
          • Check carefully that you meet this requirement, as the App-V Server and the PowerShell cmdlet don’t validate that the requirement has been met.

          • -
          • If you accidentally create a connection group that does not contain at least one non-optional package, and the end user tries to open a packaged application in that connection group, the connection group will fail.

          • -
          -

            -
          • User-published connection groups can contain packages that are published globally or to the user.

          • -
          • Globally published connection groups must contain only globally published packages.

          • -

          Globally published connection groups must contain packages that are published globally to ensure that the packages will be available when starting the connection group’s virtual environment.

          -

          If you try to add or enable globally published connection groups that contain user-published packages, the connection group will fail.

          You must publish all non-optional packages before publishing the connection group that contains those packages.

          A connection group’s virtual environment cannot start if any non-optional packages are missing.

          -

          The App-V Client fails to add or enable a connection group if any non-optional packages have not been published.

          Before you unpublish a globally published package, ensure that the connection groups that are entitled to all the users on that computer no longer require the package.

          The system does not check whether the package is part of another user’s connection group. Unpublishing a global package will make it unavailable to every user on that computer, so make sure that each user’s connection groups no longer contain the package, or alternatively make the package optional.

          - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md deleted file mode 100644 index 0dbc87a5e6..0000000000 --- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: msfttracyp -ms.assetid: 1e1941d3-fb22-4077-8ec6-7a0cb80335d8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 03/16/2017 ---- - - -# How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - - -Use the following procedure to view and configure default package extensions. - -**To view and configure default virtual application extensions** - -1. To view the package that you want to configure, open the App-V 5.1 Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**. - -2. To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**. - -3. To enable the application extensions, select **ENABLE**. - - To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file. - -5. To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process. - ->**Note** If the upload fails and the size of your configuration file is above 4MB, you will need to increase the maximum file size allowed by the server. This can be done by adding the maxRequestLength attribute with a value greater than the size of your configuration file (in KB) to the httpRuntime element on line 26 of `C:\Program Files\Microsoft Application Virtualization Server\ManagementService\Web.config`. -For example, changing `` to `` will increase the maximum size to 8MB - - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md deleted file mode 100644 index b7b66d2e47..0000000000 --- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: msfttracyp -ms.assetid: c77e6662-7a18-4da1-8da8-b58068b65fa1 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - - -Use the following procedure to view and configure default package extensions. - -**To view and configure default virtual application extensions** - -1. To view the package that you want to configure, open the App-V 5.0 Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**. - -2. To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**. - -3. To enable the application extensions, select **ENABLE**. - - To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file. - -5. To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/images/checklistbox.gif b/mdop/appv-v5/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/appv-v5/images/checklistbox.gif and /dev/null differ diff --git a/mdop/appv-v5/images/packageaddfileandregistrydata-global.png b/mdop/appv-v5/images/packageaddfileandregistrydata-global.png deleted file mode 100644 index 775e290a36..0000000000 Binary files a/mdop/appv-v5/images/packageaddfileandregistrydata-global.png and /dev/null differ diff --git a/mdop/appv-v5/images/packageaddfileandregistrydata-stream.png b/mdop/appv-v5/images/packageaddfileandregistrydata-stream.png deleted file mode 100644 index 0e1205c62b..0000000000 Binary files a/mdop/appv-v5/images/packageaddfileandregistrydata-stream.png and /dev/null differ diff --git a/mdop/appv-v5/images/packageaddfileandregistrydata.png b/mdop/appv-v5/images/packageaddfileandregistrydata.png deleted file mode 100644 index 603420e627..0000000000 Binary files a/mdop/appv-v5/images/packageaddfileandregistrydata.png and /dev/null differ diff --git a/mdop/appv-v5/index.md b/mdop/appv-v5/index.md deleted file mode 100644 index c51ad7bc30..0000000000 --- a/mdop/appv-v5/index.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Application Virtualization 5 -description: Application Virtualization 5 -author: dansimp -ms.assetid: e82eb44b-9ccd-41aa-923b-71400230ad23 -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Application Virtualization 5 - - -Microsoft Application Virtualization (App-V) 5 lets administrators make applications available to end users without having to install the applications directly on end user computers. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. - -## App-V 5 Versions - - -[Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -[Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -## More Information - - -[Release Notes for App-V 5.1](release-notes-for-app-v-51.md) -View updated product information and known issues for App-V 5.1. - -[Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md) -View updated product information and known issues for App-V 5.0 SP3. - -[Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md) -View updated product information and known issues for App-V 5.0 SP2. - -[Release Notes for App-V 5.0](release-notes-for-app-v-50.md) -View updated product information and known issues for App-V 5.0. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/maintaining-app-v-50.md b/mdop/appv-v5/maintaining-app-v-50.md deleted file mode 100644 index 21a91e196a..0000000000 --- a/mdop/appv-v5/maintaining-app-v-50.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Maintaining App-V 5.0 -description: Maintaining App-V 5.0 -author: msfttracyp -ms.assetid: 66851ec3-c674-493b-ad6d-db8fcbf1956c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining App-V 5.0 - - -After you have completed all the necessary planning, and then deployment of App-V 5.0, you can use the following information to maintain the App-V 5.0 infrastructure. - -## Move the App-V 5.0 Server - - -The App-V 5.0 server connects to the App-V 5.0 database. Therefore you can install the management component to any computer on the network and then connect it to the App-V 5.0 database. - -[How to Move the App-V Server to Another Computer](how-to-move-the-app-v-server-to-another-computer.md) - -## Determine if an App-V 5.0 Application is Running Virtualized - - -Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V 5.0 or above, should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. - -Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.0 and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. - - - - - - -## Other resources for maintaining App-V 5.0 - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/maintaining-app-v-51.md b/mdop/appv-v5/maintaining-app-v-51.md deleted file mode 100644 index f972cbfdae..0000000000 --- a/mdop/appv-v5/maintaining-app-v-51.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Maintaining App-V 5.1 -description: Maintaining App-V 5.1 -author: msfttracyp -ms.assetid: 5abd17d3-e8af-4261-b914-741ae116b0e7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining App-V 5.1 - - -After you have completed all the necessary planning, and then deployment of App-V 5.1, you can use the following information to maintain the App-V 5.1 infrastructure. - -## Move the App-V 5.1 Server - - -The App-V 5.1 server connects to the App-V 5.1 database. Therefore you can install the management component to any computer on the network and then connect it to the App-V 5.1 database. - -[How to Move the App-V Server to Another Computer](how-to-move-the-app-v-server-to-another-computer51.md) - -## Determine if an App-V 5.1 Application is Running Virtualized - - -Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V 5.1 or above, should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. - -Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.1 and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. - - - - - - -## Other resources for maintaining App-V 5.1 - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/managing-connection-groups.md b/mdop/appv-v5/managing-connection-groups.md deleted file mode 100644 index baca427994..0000000000 --- a/mdop/appv-v5/managing-connection-groups.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Managing Connection Groups -description: Managing Connection Groups -author: msfttracyp -ms.assetid: 1a9c8f26-f421-4b70-b7e2-da8118e8198c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Connection Groups - - -Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. - -**Note**   -In previous versions of App-V 5.0, connection groups were referred to as Dynamic Suite Composition. - - - -**In this topic:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -

          About the Connection Group Virtual Environment

          Describes the connection group virtual environment.

          About the Connection Group File

          Describes the connection group file.

          How to Create a Connection Group

          Explains how to create a new connection group.

          How to Create a Connection Group with User-Published and Globally Published Packages

          Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.

          How to Delete a Connection Group

          Explains how to delete a connection group.

          How to Publish a Connection Group

          Explains how to publish a connection group.

          - - - - - - - - -## Other resources for App-V 5.0 connection groups - - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/managing-connection-groups51.md b/mdop/appv-v5/managing-connection-groups51.md deleted file mode 100644 index 06ecc8b46b..0000000000 --- a/mdop/appv-v5/managing-connection-groups51.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Managing Connection Groups -description: Managing Connection Groups -author: msfttracyp -ms.assetid: 22c9d3cb-7246-4173-9742-4ba1c24b0a6a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Connection Groups - - -Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. - -**Note**   -In some previous versions of App-V, connection groups were referred to as Dynamic Suite Composition. - - - -**In this topic:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -

          About the Connection Group Virtual Environment

          Describes the connection group virtual environment.

          About the Connection Group File

          Describes the connection group file.

          How to Create a Connection Group

          Explains how to create a new connection group.

          How to Create a Connection Group with User-Published and Globally Published Packages

          Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.

          How to Delete a Connection Group

          Explains how to delete a connection group.

          How to Publish a Connection Group

          Explains how to publish a connection group.

          - - - - - - - - -## Other resources for App-V 5.1 connection groups - - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md deleted file mode 100644 index bcad0aeea4..0000000000 --- a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Microsoft Application Virtualization 5.0 Administrator's Guide -description: Microsoft Application Virtualization 5.0 Administrator's Guide -author: msfttracyp -ms.assetid: c46e94b5-32cd-4377-8dc3-8163539be897 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - -# Microsoft Application Virtualization 5.0 Administrator's Guide - -The Microsoft Application Virtualization (App-V) 5.0 Administrator’s Guide provides information and step-by-step procedures to help you administer the App-V 5.0 system and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - [About App-V 5.0](about-app-v-50.md) - - [About App-V 5.0 SP1](about-app-v-50-sp1.md) - - [About App-V 5.0 SP2](about-app-v-50-sp2.md) - - [About App-V 5.0 SP3](about-app-v-50-sp3.md) - - [Evaluating App-V 5.0](evaluating-app-v-50.md) - - [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md) - - [Accessibility for App-V 5.0](accessibility-for-app-v-50.md) -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - - [Preparing Your Environment for App-V 5.0](preparing-your-environment-for-app-v-50.md) - - [Planning to Deploy App-V](planning-to-deploy-app-v.md) - - [App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md) -- [Deploying App-V 5.0](deploying-app-v-50.md) - - [Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - - [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - [App-V 5.0 Deployment Checklist](app-v-50-deployment-checklist.md) - - [Deploying Microsoft Office 2016 by Using App-V](deploying-microsoft-office-2016-by-using-app-v.md) - - [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) - - [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) - - [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) - - [Managing Connection Groups](managing-connection-groups.md) - - [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) - - [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md) - - [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - - [Maintaining App-V 5.0](maintaining-app-v-50.md) - - [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) -- [Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) - - [Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) - - [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md) - - [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata.md) - - [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md) - -# - -- Add or vote on suggestions on the ["Microsoft Application Virtualization" forum on UserVoice.com](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -- For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md deleted file mode 100644 index f854875229..0000000000 --- a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Microsoft Application Virtualization 5.1 Administrator's Guide -description: Microsoft Application Virtualization 5.1 Administrator's Guide -author: msfttracyp -ms.assetid: 3049996a-7253-4599-a29a-1b58f9ab14a4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - -# Microsoft Application Virtualization 5.1 Administrator's Guide - -The Microsoft Application Virtualization (App-V) 5.1 Administrator’s Guide provides information and step-by-step procedures to help you administer the App-V 5.1 system and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - - [About App-V 5.1](about-app-v-51.md) - - [Evaluating App-V 5.1](evaluating-app-v-51.md) - - [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md) - - [Accessibility for App-V 5.1](accessibility-for-app-v-51.md) -- [Planning for App-V 5.1](planning-for-app-v-51.md) - - [Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) - - [Planning to Deploy App-V](planning-to-deploy-app-v51.md) -- [Deploying App-V 5.1](deploying-app-v-51.md) - - [Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - - [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - [App-V 5.1 Deployment Checklist](app-v-51-deployment-checklist.md) - - [Deploying Microsoft Office 2016 by Using App-V](deploying-microsoft-office-2016-by-using-app-v51.md) - - [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v51.md) - - [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md) -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) - - [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) - - [Managing Connection Groups](managing-connection-groups51.md) - - [Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) - - [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md) - - [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) - - [Maintaining App-V 5.1](maintaining-app-v-51.md) - - [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) - - [Application Publishing and Client Interaction](application-publishing-and-client-interaction51.md) - - [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata51.md) - - [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md) - -# - -- Add or vote on suggestions on the ["Microsoft Application Virtualization" forum on UserVoice.com](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -- For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md b/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md deleted file mode 100644 index b990ad8485..0000000000 --- a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: Migrating from a Previous Version -description: Migrating from a Previous Version -author: msfttracyp -ms.assetid: a13cd353-b22a-48f7-af1e-5d54ede2a7e5 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Migrating from a Previous Version - - -With App-V 5.0 you can migrate your existing App-V 4.6 infrastructure to the more flexible, integrated, and easier to manage App-V 5.0 infrastructure. - -Consider the following sections when you plan your migration strategy: - -**Note**   -For more information about the differences between App-V 4.6 and App-V 5.0, see the **Differences between App-V 4.6 and App-V 5.0 section** of [About App-V 5.0](about-app-v-50.md). - - - -## Converting packages created using a prior version of App-V - - -Use the package converter utility to upgrade virtual application packages created using previous versions of App-V. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - -**Important**   -After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. - - - -**What to know before you convert existing packages** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          IssueWorkaround

          Package scripts are not converted.

          Test the converted package. If necessary convert the script.

          Package registry setting overrides are not converted.

          Test the converted package. If necessary, re-add registry overrides.

          Virtual packages using DSC are not linked after conversion.

          Link the packages using connection groups. See Managing Connection Groups.

          Environment variable conflicts are detected during conversion.

          Resolve any conflicts in the associated .osd file.

          Hard-coded paths are detected during conversion.

          Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package.

          - - - -When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be hard-coded path. Convert the path. - -**Note**   -It is recommended that you use the App-V 5.0 sequencer for converting critical applications or applications that need to take advantage of features. See, [How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md). - -If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V 5.0 sequencer. - - - -[How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md) - -## Migrating Clients - - -The following table displays the recommended method for upgrading clients. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskMore Information

          Upgrade your environment to App-V 4.6 SP2

          Application Virtualization Deployment and Upgrade Considerations.

          Install the App-V 5.0 client with co-existence enabled.

          How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer.

          Sequence and roll out App-V 5.0 packages. As needed, unpublish App-V 4.6 packages.

          How to Sequence a New Application with App-V 5.0.

          - - - -**Important**   -You must be running App-V 4.6 SP3 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section. - - - -## Migrating the App-V 5.0 Server Full Infrastructure - - -There is no direct method to upgrade to a full App-V 5.0 infrastructure. Use the information in the following section for information about upgrading the App-V server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskMore Information

          Upgrade your environment to App-V 4.6 SP3.

          Application Virtualization Deployment and Upgrade Considerations.

          Deploy App-V 5.0 version of the client.

          How to Deploy the App-V Client.

          Install App-V 5.0 server.

          How to Deploy the App-V 5.0 Server.

          Migrate existing packages.

          See the Converting packages created using a prior version of App-V section of this article.

          - - - -## Additional Migration tasks - - -You can also perform additional migration tasks such as reconfiguring end points as well as opening a package created using a prior version on a computer running the App-V 5.0 client. The following links provide more information about performing these tasks. - -[How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) - -[How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md) - -[How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md) - - - - - - - -## Other resources for performing App-V migration tasks - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://go.microsoft.com/fwlink/p/?LinkId=786330) - - - - - - - - - diff --git a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md b/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md deleted file mode 100644 index 33eb8f92b7..0000000000 --- a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md +++ /dev/null @@ -1,335 +0,0 @@ ---- -title: Migrating to App-V 5.1 from a Previous Version -description: Migrating to App-V 5.1 from a Previous Version -author: msfttracyp -ms.assetid: e7ee0edc-7544-4c0a-aaca-d922a33bc1bb -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Migrating to App-V 5.1 from a Previous Version - - -With Microsoft Application Virtualization (App-V) 5.1, you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V 5.1 infrastructure. -However, you cannot migrate directly from App-V 4.x to App-V 5.1, you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - -**Note**   -App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V 5.1 packages. - -For more information about the differences between App-V 4.6 and App-V 5.1, see the **Differences between App-V 4.6 and App-V 5.0 section** of [About App-V 5.0](about-app-v-50.md). - - - -## Improvements to the App-V 5.1 Package Converter - - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom-AppvLegacyPackage` cmdlet to specify which .osd files’ information is converted and placed within the new package. - - ---- - - - - - - - - - - - - -
          New in App-V 5.1Prior to App-V 5.1

          New .xml files are created corresponding to the .osd files associated with a package; these files include the following information:

          -
            -
          • environment variables

          • -
          • shortcuts

          • -
          • file type associations

          • -
          • registry information

          • -
          • scripts

          • -
          -

          You can now choose to add information from a subset of the .osd files in the source directory to the package using the -OSDsToIncludeInPackage parameter.

          Registry information and scripts included in .osd files associated with a package were not included in package converter output.

          -

          The package converter would populate the new package with information from all of the .osd files in the source directory.

          - - - -### Example conversion statement - -To understand the new process, review the following example `ConvertFrom-AppvLegacyPackage` package converter statement. - -**If the source directory (\\\\OldPkgStore\\ContosoApp) includes the following:** - -- ContosoApp.sft - -- ContosoApp.msi - -- ContosoApp.sprj - -- ContosoApp\_manifest.xml - -- X.osd - -- Y.osd - -- Z.osd - -**And you run this command:** - -``` syntax -ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\ --DestinationPath \\NewPkgStore\ContosoApp\ --OSDsToIncludeInPackage X.osd,Y.osd -``` - -**The following is created in the destination directory (\\\\NewPkgStore\\ContosoApp):** - -- ContosoApp.appv - -- ContosoApp.msi - -- ContosoApp\_DeploymentConfig.xml - -- ContosoApp\_UserConfig.xml - -- X\_Config.xml - -- Y\_Config.xml - -- Z\_Config.xml - -**In the above example:** - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          These Source directory files……are converted to these Destination directory files……and will contain these itemsDescription
            -
          • X.osd

          • -
          • Y.osd

          • -
          • Z.osd

          • -
            -
          • X_Config.xml

          • -
          • Y_Config.xml

          • -
          • Z_Config.xml

          • -
            -
          • Environment variables

          • -
          • Shortcuts

          • -
          • File type associations

          • -
          • Registry information

          • -
          • Scripts

          • -

          Each .osd file is converted to a separate, corresponding .xml file that contains the items listed here in App-V 5.1 deployment configuration format. These items can then be copied from these .xml files and placed in the deployment configuration or user configuration files as desired.

          -

          In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file.

            -
          • X.osd

          • -
          • Y.osd

          • -
            -
          • ContosoApp.appv

          • -
          • ContosoApp_DeploymentConfig.xml

          • -
          • ContosoApp_UserConfig.xml

          • -
            -
          • Environment variables

          • -
          • Shortcuts

          • -
          • File type associations

          • -

          The information from the .osd files specified in the -OSDsToIncludeInPackage parameter are converted and placed inside the package. The converter then populates the deployment configuration file and the user configuration file with the contents of the package, just as App-V Sequencer does when sequencing a new package.

          -

          In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the -OSDsToIncludeInPackage parameter. No information from Z.osd was included in the package, because it was not included as one of these arguments.

          - - - -## Converting packages created using a prior version of App-V - - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - -**Important**   -After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. - - - -**What to know before you convert existing packages** - - ---- - - - - - - - - - - - - - - - - - - - - -
          IssueWorkaround

          Virtual packages using DSC are not linked after conversion.

          Link the packages using connection groups. See Managing Connection Groups.

          Environment variable conflicts are detected during conversion.

          Resolve any conflicts in the associated .osd file.

          Hard-coded paths are detected during conversion.

          Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package.

          - - - -When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. - -**Note**   -It is recommended that you use the App-V 5.1 sequencer for converting critical applications or applications that need to take advantage of features. See, [How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md). - -If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V 5.1 sequencer. - - - -[How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md) - -## Migrating Clients - - -The following table displays the recommended method for upgrading clients. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskMore Information

          Upgrade your environment to the latest version of App-V 4.6

          Application Virtualization Deployment and Upgrade Considerations.

          Install the App-V 5.1 client with co-existence enabled.

          How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer.

          Sequence and roll out App-V 5.1 packages. As needed, unpublish App-V 4.6 packages.

          How to Sequence a New Application with App-V 5.1.

          - - - -**Important**   -You must be running the latest version of App-V 4.6 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section. - - - -## Migrating the App-V 5.1 Server Full Infrastructure - - -There is no direct method to upgrade to a full App-V 5.1 infrastructure. Use the information in the following section for information about upgrading the App-V server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskMore Information

          Upgrade your environment to the latest version of App-V 4.6.

          Application Virtualization Deployment and Upgrade Considerations.

          Deploy App-V 5.1 version of the client.

          How to Deploy the App-V Client.

          Install App-V 5.1 server.

          How to Deploy the App-V 5.1 Server.

          Migrate existing packages.

          See the Converting packages created using a prior version of App-V section of this article.

          - - - -## Additional Migration tasks - - -You can also perform additional migration tasks such as reconfiguring end points as well as opening a package created using a prior version on a computer running the App-V 5.1 client. The following links provide more information about performing these tasks. - -[How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) - -[How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md) - -[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md) - - - - - - - -## Other resources for performing App-V migration tasks - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://go.microsoft.com/fwlink/p/?LinkId=786330) - - - - - - - - - diff --git a/mdop/appv-v5/operations-for-app-v-50.md b/mdop/appv-v5/operations-for-app-v-50.md deleted file mode 100644 index 040240cc28..0000000000 --- a/mdop/appv-v5/operations-for-app-v-50.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Operations for App-V 5.0 -description: Operations for App-V 5.0 -author: msfttracyp -ms.assetid: 4d0d41a6-f7da-4a2f-8ac9-2d67cc18ea93 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for App-V 5.0 - - -This section of the App-V 5.0 Administrator’s Guide includes information about the various types of App-V 5.0 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - - -- [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) - - Describes how to create, modify, and convert virtualized packages. - -- [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) - - Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. - -- [Managing Connection Groups](managing-connection-groups.md) - - Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. - -- [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) - - Describes how to deploy App-V packages by using an ESD. - -- [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md) - - Describes how perform client configuration tasks using the client management console. - -- [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - - Provides instructions for migrating to App-V 5.0 from a previous version. - -- [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V 5.0 server tasks. - - - - - - -## Other Resources for App-V Operations - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/operations-for-app-v-51.md b/mdop/appv-v5/operations-for-app-v-51.md deleted file mode 100644 index 4add886780..0000000000 --- a/mdop/appv-v5/operations-for-app-v-51.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Operations for App-V 5.1 -description: Operations for App-V 5.1 -author: msfttracyp -ms.assetid: dd13b5c9-2d1e-442f-91e4-43dec7f17ea2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for App-V 5.1 - - -This section of the Microsoft Application Virtualization (App-V) 5.1 Administrator’s Guide includes information about the various types of App-V 5.1 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - - -- [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) - - Describes how to create, modify, and convert virtualized packages. - -- [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) - - Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. - -- [Managing Connection Groups](managing-connection-groups51.md) - - Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. - -- [Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) - - Describes how to deploy App-V packages by using an ESD. - -- [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md) - - Describes how perform client configuration tasks using the client management console. - -- [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) - - Provides instructions for migrating to App-V 5.1 from a previous version. - -- [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V 5.1 server tasks. - - - - - - -## Other Resources for App-V Operations - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md deleted file mode 100644 index 8c33b0c43a..0000000000 --- a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md +++ /dev/null @@ -1,761 +0,0 @@ ---- -title: Performance Guidance for Application Virtualization 5.0 -description: Performance Guidance for Application Virtualization 5.0 -author: msfttracyp -ms.assetid: 6b3a3255-b957-4b9b-8bfc-a93fe8438a81 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Performance Guidance for Application Virtualization 5.0 - - -Learn how to configure App-V 5.0 for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. - -Implementing multiple methods can help you improve the end-user experience. However, your environment may not support all methods. - -You should read and understand the following information before reading this document. - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [App-V 5 SP2 Application Publishing and Client Interaction](https://go.microsoft.com/fwlink/?LinkId=395206) - -- [Microsoft Application Virtualization 5.0 Sequencing Guide](https://go.microsoft.com/fwlink/?LinkId=269953) - -**Note** -Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. - - - -Finally, this document will provide you with the information to configure the computer running App-V 5.0 client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V 5.0 in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). - -To help determine what information is relevant to your environment you should review each section’s brief overview and applicability checklist. - -## App-V 5.0 in stateful\* non-persistent deployments - - -This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V 5.0 publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. A number of conditions must be met and steps followed to provide the optimal user experience. - -Use the information in the following section for more information: - -[Usage Scenarios](#bkmk-us) - As you review the two scenarios, keep in mind that these are the approach extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users and/or virtual applications packages. - -- Optimized for Performance – To provide the optimal experience, you can expect the base image to include some of the App-V virtual application package. This and other requirements are discussed. - -- Optimized for Storage – If you are concerned with the storage impact, following this scenario will help address those concerns. - -[Preparing your Environment](#bkmk-pe) - -- Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. - -- Use UE-V 2.0 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. - -[User Experience Walk-through](#bkmk-uewt) - -- Walk-through – This is a step-by-step walk-through of the App-V and UE-V operations and the expectations users should have. - -- Outcome – This describes the expected results. - -[Impact to Package Lifecycle](#bkmk-plc) - -[Enhancing the VDI Experience through Performance Optimization/Tuning](#bkmk-evdi) - -### Applicability Checklist - -Deployment Environment - - ---- - - - - - - - - - - -
          Checklist box

          Non-Persistent VDI or RDSH.

          Checklist box

          User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).

          - - - -Expected Configuration - - ---- - - - - - - - - - - -
          Checklist box

          User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.

          Checklist box

          App-V Shared Content Store (SCS) is configured or can be configured.

          - - - -IT Administration - - ---- - - - - - - -
          Checklist box

          Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.

          - - - -### Usage Scenario - -As you review the two scenarios, keep in mind that these approach the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. - - ---- - - - - - - - - - - - - -
          Optimized for PerformanceOptimized for Storage

          To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.

          -

          The following describes many performance improvements in stateful non-persistent deployments. For more information, see the Sequencing Steps to Optimize Packages for Publishing Performance and reference to App-V 5.0 Sequencing Guide in the See Also section of this document.

          The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.

          -

          The impact of this alteration is detailed in the User Experience Walkthrough section of this document.

          - - - -### Preparing your Environment - -The following table displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach. - -**Prepare the Base Image** - - ---- - - - - - - - - - - - - -
          Optimized for PerformanceOptimized for Storage

          -
            -
          • Install the Hotfix Package 4 for Application Virtualization 5.0 SP2 client version of the client.

          • -
          • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

          • -
          • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.0 Client for Shared Content Store Mode.

          • -
          • Configure Preserve User Integrations on Login Registry DWORD.

          • -
          • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.

          • -
          • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.

          • -
          • Pre-publish all global-targeted packages.

            -

            -

            Alternatively,

            -
              -
            • Perform a global publishing/refresh.

            • -
            • Perform a user publishing/refresh.

            • -
            • Un-publish all user-targeted packages.

            • -
            • Delete the following user-Virtual File System (VFS) entries.

            • -
            -

            AppData\Local\Microsoft\AppV\Client\VFS

            -

            AppData\Roaming\Microsoft\AppV\Client\VFS

          • -

          -
            -
          • Install the Hotfix Package 4 for Application Virtualization 5.0 SP2 client version of the client.

          • -
          • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

          • -
          • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.0 Client for Shared Content Store Mode.

          • -
          • Configure Preserve User Integrations on Login Registry DWORD.

          • -
          • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.

          • -
          • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.

          • -
          • Pre-publish all global-targeted packages.

            -

          • -
          - - - -**Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Configuration SettingWhat does this do?How should I use it?

          Shared Content Store (SCS) Mode

          -
            -
          • Configurable in PowerShell using Set- AppvClientConfigurationSharedContentStoreMode, or

          • -
          • During installation of the App-V 5.0 client.

          • -

          When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).

          -

          This helps to conserve local storage and minimize disk I/O per second (IOPS).

          This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN.

          PreserveUserIntegrationsOnLogin

          -
            -
          • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Integration.

          • -
          • Create the DWORD value PreserveUserIntegrationsOnLogin with a value of 1.

          • -
          • Restart the App-V client service or restart the computer running the App-V Client.

          • -

          If you have not pre-configured (Add-AppvClientPackage) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*.

          -

          For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh.

          If you don’t plan to pre-configure every available user package in the base image, use this setting.

          MaxConcurrentPublishingRefresh

          -
            -
          • Configure in the Registry under HKEY_LOCAL_MACHINE <strong>Software \ Microsoft \ AppV <strong>Client \ Publishing.

          • -
          • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.

          • -
          • The App-V client service and computer do not need to be restarted.

          • -

          This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit.

          Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync.

          -

          If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time.

          - - - -### Configure UE-V solution for App-V Approach - -We recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. - -For more information see [Getting Started With User Experience Virtualization 2.0](https://technet.microsoft.com/library/dn458936.aspx) - -In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458936.aspx). - -**Note** -Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. - -UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following 2 scenarios, because the net result will be that the shortcut will be valid on one but not all devices. - -- If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. - -- If a user has an application installed on one device but not another with .lnk files enabled. - - - -**Important** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types. - -**Configure other User Profile Management (UPM) solution for App-V Approach** - -The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. - -The requirements for the UPM solution are as follows. - -To enable an optimized login experience, for example the App-V 5.0 approach for the user, the solution must be capable of: - -- Persisting the below user integrations as part of the user profile/persona. - -- Triggering a user profile sync on login (or application start), which can guarantee that all user integrations are applied before publishing/refresh begin, or, - -- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations. - -- Capturing changes to the locations, which constitute the user integrations, prior to session logoff. - -With App-V 5.0 when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during log on and/or after a specified refresh interval. In both cases a scheduled task is created. - -In previous versions of App-V 5.0, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. With Hotfix Package 4 for Application Virtualization 5.0 SP2 the user refresh on log on is initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process will delay the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. - -**User Integrations** - -Registry – HKEY\_CURRENT\_USER - -- Path - Software\\Classes - - Exclude: Local Settings, ActivatableClasses, AppX\* - -- Path - Software\\Microsoft\\AppV - -- Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths - -**File Locations** - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Catalog - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Integration - -- Root – “Environment Variable” APPDATA - - Path - Microsoft\\Windows\\Start Menu\\Programs - -- (To persist all desktop shortcuts, virtual and non-virtual) - - Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk - -**Microsoft User Experience Virtualization (UE-V)** - -Additionally, we recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -For more information see [Getting Started With User Experience Virtualization 1.0](https://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](https://technet.microsoft.com/library/jj679972.aspx). - -### User Experience Walk-through - -This following is a step-by-step walk-through of the App-V and UPM operations and the expectations users should expect. - - ---- - - - - - - - - - - - - -
          Optimized for PerformanceOptimized for Storage

          After implementing this approach in the VDI/RDSH environment, on first login,

          -
            -
          • (Operation) A user-publishing/refresh is initiated. (Expectation) If this is the first time a user has published virtual applications (e.g. non-persistent), this will take the usual duration of a publishing/refresh.

          • -
          • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.

          • -
          -

          On subsequent logins:

          -
            -
          • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

            -

            (Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (i.e., package entitlements change), some may go away.

          • -
          • (Operation) Publishing/refresh will process un-publish and publish operations for changes in user package entitlements. (Expectation) If there are no entitlement changes, publishing1 will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity* of virtual applications

          • -
          • (Operation) UPM solution will capture user integrations again at logoff. (Expectation) Same as previous.

          • -
          -

          ¹ The publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps.

          After implementing this approach in the VDI/RDSH environment, on first login,

          -
            -
          • (Operation) A user-publishing/refresh is initiated. (Expectation)

            -
              -
            • If this is the first time a user has published virtual applications (e.g., non-persistent), this will take the usual duration of a publishing/refresh.

            • -
            • First and subsequent logins will be impacted by pre-configuring of packages (add/refresh).

              -

            • -
          • -
          • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state

          • -
          -

          On subsequent logins:

          -
            -
          • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

          • -
          • (Operation) Add/refresh must pre-configure all user targeted applications. (Expectation)

            -
              -
            • This may increase the time to application availability significantly (on the order of 10’s of seconds).

            • -
            • This will increase the publishing refresh time relative to the number and complexity* of virtual applications.

              -

            • -
          • -
          • (Operation) Publishing/refresh will process un-publish and publish operations for changes to user package entitlements.

          • -
          - - - - ---- - - - - - - - - - - - - -
          OutcomeOutcome

          -
            -
          • Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of login.

          • -
          • The publishing/refresh will process changes to the users entitled virtual applications which impacts the experience.

          • -

          Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended.

          - - - -### Impact to Package Life Cycle - -Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (un-published) virtual application packages, it is recommended you update the base image to reflect these changes. To understand why review the following section: - -App-V 5.0 SP2 introduced the concept of pending states. In the past, - -- If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the un-publish or publish operation, respectively, would fail. - -- Now, if a package is in-use the operation will be pended. The un-publish and publish-pend operations will be processed on service restart or if another publish or un-publish command is issued. In the latter case, if the virtual application is in-use otherwise, the virtual application will remain in a pending state. For globally published packages, a restart (or service restart) often needed. - -In a non-persistent environment, it is unlikely these pended operations will be processed. The pended operations, for example tasks are captured under **HKEY\_CURRENT\_USER** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **PendingTasks**. Although this location is persisted by the UPM solution, if it is not applied to the environment prior to log on, it will not be processed. - -### Enhancing the VDI Experience through Performance Optimization Tuning - -The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. - -**.NET NGEN Blog and Script (Highly Recommended)** - -About NGEN technology - -- [How to speed up NGEN optimization](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) - -- [Script](https://aka.ms/DrainNGenQueue) - -**Windows Server and Server Roles** - -Server Performance Tuning Guidelines for - -- [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx) - -- [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx) - -- [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx) - -**Server Roles** - -- [Remote Desktop Virtualization Host](https://msdn.microsoft.com/library/windows/hardware/dn567643.aspx) - -- [Remote Desktop Session Host](https://msdn.microsoft.com/library/windows/hardware/dn567648.aspx) - -- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](https://msdn.microsoft.com/library/windows/hardware/dn567678.aspx) - -- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](https://technet.microsoft.com/library/jj134210.aspx) - -**Windows Client (Guest OS) Performance Tuning Guidance** - -- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx) - -- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx) - -- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf) - -- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx) - -## Sequencing Steps to Optimize Packages for Publishing Performance - - -App-V 5.0 and App-V 5.0 SP2 provide significant value in their respective releases. Several features facilitate new scenarios or enabled new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. - - ------ - - - - - - - - - - - - - - - - -
          StepConsiderationBenefitsTradeoffs

          No Feature Block 1 (FB1, also known as Primary FB)

          No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch.If there are network limitations, FB1 will:

          -
            -
          • Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.

          • -
          • Delay launch until the entire FB1 has been streamed.

          • -

          Stream faulting decreases the launch time.

          Virtual application packages with FB1 configured will need to be re-sequenced.

          - - - -### Removing FB1 - -Removing FB1 does not require the original application installer. After completing the following steps, it is suggested that you revert the computer running the sequencer to a clean snapshot. - -**Sequencer UI** - Create a New Virtual Application Package. - -1. Complete the sequencing steps up to Customize -> Streaming. - -2. At the Streaming step, do not select **Optimize the package for deployment over slow or unreliable network**. - -3. If desired, move on to **Target OS**. - -**Modify an Existing Virtual Application Package** - -1. Complete the sequencing steps up to Streaming. - -2. Do not select **Optimize the package for deployment over a slow or unreliable network**. - -3. Move to **Create Package**. - -**PowerShell** - Update an Existing Virtual Application Package. - -1. Open an elevated PowerShell session. - -2. Import-module **appvsequencer**. - -3. **Update-AppvSequencerPackage** - **AppvPackageFilePath** - - "C:\\Packages\\MyPackage.appv" -Installer - - "C:\\PackageInstall\\PackageUpgrade.exe empty.exe" -OutputPath - - "C:\\UpgradedPackages" - - **Note** - This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file. - - - - ------ - - - - - - - - - - - - - - - - -
          StepConsiderationsBenefitsTradeoffs

          No SXS Install at Publish (Pre-Install SxS assemblies)

          Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package.

          The SxS Assembly dependencies will not install at publishing time.

          SxS Assembly dependencies must be pre-installed.

          - - - -### Creating a new virtual application package on the sequencer - -If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is installed as part of an application’s installation, SxS Assembly will be automatically detected and included in the package. The administrator will be notified and will have the option to exclude the SxS Assembly. - -**Client Side**: - -When publishing a virtual application package, the App-V 5.0 SP2 Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur. - - ------ - - - - - - - - - - - - - - - - -
          StepConsiderationsBenefitsTradeoffs

          Selectively Employ Dynamic Configuration files

          The App-V 5.0 client must parse and process these Dynamic Configuration files.

          -

          Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.

          -

          Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.

          Publishing times will improve if these files are used selectively or not at all.

          Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.

          - - - -### Disabling a Dynamic Configuration using Powershell - -- For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without - - **-DynamicDeploymentConfiguration** parameter - -- Similarly, when adding new packages using `Add-AppVClientPackage –Path c:\Packages\Apps\MyApp.appv`, do not use the - - **-DynamicDeploymentConfiguration** parameter. - -For documentation on How to Apply a Dynamic Configuration, see: - -- [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md) - -- [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md) - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          StepConsiderationsBenefitsTradeoffs

          Account for Synchronous Script Execution during Package Lifecycle.

          If script collateral is embedded in the package, Add (Powershell) may be significantly slower.

          -

          Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.

          Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.

          This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.

          Remove Extraneous Virtual Fonts from Package.

          The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20.

          Virtual Fonts impact publishing refresh performance.

          Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.

          - - - -### Determining what virtual fonts exist in the package - -- Make a copy of the package. - -- Rename Package\_copy.appv to Package\_copy.zip - -- Open AppxManifest.xml and locate the following: - - <appv:Extension Category="AppV.Fonts"> - - <appv:Fonts> - - <appv:Font Path="\[{Fonts}\]\\private\\CalibriL.ttf" DelayLoad="true"></appv:Font> - - **Note** - If there are fonts marked as **DelayLoad**, those will not impact first launch. - - - -~~~ -</appv:Fonts> -~~~ - -### Excluding virtual fonts from the package - -Use the dynamic configuration file that best suits the user scope – deployment configuration for all users on computer, user configuration for specific user or users. - -- Disable fonts with the deployment or user configuration. - -Fonts - ---> - -<Fonts Enabled="false" /> - -<!-- - -## App-V 5.0 Performance Guidance Terminology - - -The following terms are used when describing concepts and actions related to App-V 5.0 performance optimization. - -- **Complexity** – Refers to the one or more package characteristics that may impact performance during pre-configure (**Add-AppvClientPackage**) or integration (**Publish-AppvClientPackage**). Some example characteristics are: manifest size, number of virtual fonts, number of files. - -- **De-Integrate** – Removes the user integrations - -- **Re-Integrate** – Applies the user integrations. - -- **Non-Persistent, Pooled** – Creates a computer running a virtual environment each time they log in. - -- **Persistent, Personal** – A computer running a virtual environment that remains the same for every login. - -- **Stateful** - For this document, implies that user integrations are persisted between sessions and a user environment management technology is used in conjunction with non-persistent RDSH or VDI. - -- **Stateless** – Represents a scenario when no user state is persisted between sessions. - -- **Trigger** – (or Native Action Triggers). UPM uses these types of triggers to initiate monitoring or synchronization operations. - -- **User Experience** - In the context of App-V 5.0, the user experience, quantitatively, is the sum of the following parts: - - - From the point that users initiate a log-in to when they are able to manipulate the desktop. - - - From the point where the desktop can be interacted with to the point a publishing refresh begins (in PowerShell terms, sync) when using the App-V 5.0 full server infrastructure. In standalone instances, it is when the **Add-AppVClientPackage** and **Publish-AppVClientPackage Powershell** commands are initiated. - - - From start to completion of the publishing refresh. In standalone instances, this is the first to last virtual application published. - - - From the point where the virtual application is available to launch from a shortcut. Alternatively, it is from the point at which the file type association is registered and will launch a specified virtual application. - -- **User Profile Management** – The controlled and structured approach to managing user components associated with the environment. For example, user profiles, preference and policy management, application control and application deployment. You can use scripting or third-party solutions configure the environment as needed. - - - - - - -## Related topics - - -[Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - - - - - - - - - diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md deleted file mode 100644 index adeaf0e07f..0000000000 --- a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md +++ /dev/null @@ -1,768 +0,0 @@ ---- -title: Performance Guidance for Application Virtualization 5.1 -description: Performance Guidance for Application Virtualization 5.1 -author: msfttracyp -ms.assetid: 5f2643c7-5cf7-4a29-adb7-45bf9f5b0364 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Performance Guidance for Application Virtualization 5.1 - - -Learn how to configure App-V 5.1 for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. - -Implementing multiple methods can help you improve the end-user experience. However, your environment may not support all methods. - -You should read and understand the following information before reading this document. - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [App-V 5 SP2 Application Publishing and Client Interaction](https://go.microsoft.com/fwlink/?LinkId=395206) - -- [Microsoft Application Virtualization Sequencing Guide](https://go.microsoft.com/fwlink/?LinkId=269953) - -**Note** -Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. - - - -Finally, this document will provide you with the information to configure the computer running App-V 5.1 client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V 5.1 in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). - -To help determine what information is relevant to your environment you should review each section’s brief overview and applicability checklist. - -## App-V 5.1 in stateful\* non-persistent deployments - - -This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V 5.1 publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. A number of conditions must be met and steps followed to provide the optimal user experience. - -Use the information in the following section for more information: - -[Usage Scenarios](#bkmk-us) - As you review the two scenarios, keep in mind that these are the approach extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users and/or virtual applications packages. - -- Optimized for Performance – To provide the optimal experience, you can expect the base image to include some of the App-V virtual application package. This and other requirements are discussed. - -- Optimized for Storage – If you are concerned with the storage impact, following this scenario will help address those concerns. - -[Preparing your Environment](#bkmk-pe) - -- Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. - -- Use UE-V 2.1 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. - -[User Experience Walk-through](#bkmk-uewt) - -- Walk-through – This is a step-by-step walk-through of the App-V and UE-V operations and the expectations users should have. - -- Outcome – This describes the expected results. - -[Impact to Package Lifecycle](#bkmk-plc) - -[Enhancing the VDI Experience through Performance Optimization/Tuning](#bkmk-evdi) - -### Applicability Checklist - -Deployment Environment - - ---- - - - - - - - - - - -
          Checklist box

          Non-Persistent VDI or RDSH.

          Checklist box

          User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).

          - - - -Expected Configuration - - ---- - - - - - - - - - - -
          Checklist box

          User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.

          Checklist box

          App-V Shared Content Store (SCS) is configured or can be configured.

          - - - -IT Administration - - ---- - - - - - - -
          Checklist box

          Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.

          - - - -### Usage Scenario - -As you review the two scenarios, keep in mind that these approach the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. - - ---- - - - - - - - - - - - - -
          Optimized for PerformanceOptimized for Storage

          To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.

          -

          The following describes many performance improvements in stateful non-persistent deployments. For more information, see the Sequencing Steps to Optimize Packages for Publishing Performance and reference to App-V Sequencing Guide in the See Also section of this document.

          The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.

          -

          The impact of this alteration is detailed in the User Experience Walkthrough section of this document.

          - - - -### Preparing your Environment - -The following table displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach. - -**Prepare the Base Image** - - ---- - - - - - - - - - - - - -
          Optimized for PerformanceOptimized for Storage

          -
            -
          • Install the App-V 5.1 client version of the client.

          • -
          • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

          • -
          • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.1 Client for Shared Content Store Mode.

          • -
          • Configure Preserve User Integrations on Login Registry DWORD.

          • -
          • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.

          • -
          • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.

          • -
          • Pre-publish all global-targeted packages.

            -

            -

            Alternatively,

            -
              -
            • Perform a global publishing/refresh.

            • -
            • Perform a user publishing/refresh.

            • -
            • Un-publish all user-targeted packages.

            • -
            • Delete the following user-Virtual File System (VFS) entries.

            • -
            -

            AppData\Local\Microsoft\AppV\Client\VFS

            -

            AppData\Roaming\Microsoft\AppV\Client\VFS

          • -

          -
            -
          • Install the App-V 5.1 client version of the client.

          • -
          • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

          • -
          • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.1 Client for Shared Content Store Mode.

          • -
          • Configure Preserve User Integrations on Login Registry DWORD.

          • -
          • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.

          • -
          • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.

          • -
          • Pre-publish all global-targeted packages.

            -

          • -
          - - - -**Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Configuration SettingWhat does this do?How should I use it?

          Shared Content Store (SCS) Mode

          -
            -
          • Configurable in PowerShell using Set- AppvClientConfigurationSharedContentStoreMode, or

          • -
          • During installation of the App-V client.

          • -

          When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).

          -

          This helps to conserve local storage and minimize disk I/O per second (IOPS).

          This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN.

          PreserveUserIntegrationsOnLogin

          -
            -
          • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Integration.

          • -
          • Create the DWORD value PreserveUserIntegrationsOnLogin with a value of 1.

          • -
          • Restart the App-V client service or restart the computer running the App-V Client.

          • -

          If you have not pre-configured (Add-AppvClientPackage) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*.

          -

          For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh.

          If you don’t plan to pre-configure every available user package in the base image, use this setting.

          MaxConcurrentPublishingRefresh

          -
            -
          • Configure in the Registry under HKEY_LOCAL_MACHINE <strong>Software \ Microsoft \ AppV <strong>Client \ Publishing.

          • -
          • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.

          • -
          • The App-V client service and computer do not need to be restarted.

          • -

          This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit.

          Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync.

          -

          If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time.

          - - - -### Configure UE-V solution for App-V Approach - -We recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. - -For more information see [Getting Started With User Experience Virtualization 2.0](https://technet.microsoft.com/library/dn458926.aspx) - -In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458926.aspx). - -**Note** -Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. - -UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following 2 scenarios, because the net result will be that the shortcut will be valid on one but not all devices. - -- If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. - -- If a user has an application installed on one device but not another with .lnk files enabled. - - - -**Important** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types. - -**Configure other User Profile Management (UPM) solution for App-V Approach** - -The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. - -The requirements for the UPM solution are as follows. - -To enable an optimized login experience, for example the App-V 5.1 approach for the user, the solution must be capable of: - -- Persisting the below user integrations as part of the user profile/persona. - -- Triggering a user profile sync on login (or application start), which can guarantee that all user integrations are applied before publishing/refresh begin, or, - -- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations. - - **Note** - App-V is supported when using UPD only when the entire profile is stored on the user profile disk. - - App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver does not handle UPD selected folders. - - - -- Capturing changes to the locations, which constitute the user integrations, prior to session logoff. - -With App-V 5.1 when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during log on and/or after a specified refresh interval. In both cases a scheduled task is created. - -In previous versions of App-V 5.1, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. With Hotfix Package 4 for Application Virtualization 5.0 SP2 the user refresh on log on was initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process delays the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. - -**User Integrations** - -Registry – HKEY\_CURRENT\_USER - -- Path - Software\\Classes - - Exclude: Local Settings, ActivatableClasses, AppX\* - -- Path - Software\\Microsoft\\AppV - -- Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths - -**File Locations** - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Catalog - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Integration - -- Root – “Environment Variable” APPDATA - - Path - Microsoft\\Windows\\Start Menu\\Programs - -- (To persist all desktop shortcuts, virtual and non-virtual) - - Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk - -**Microsoft User Experience Virtualization (UE-V)** - -Additionally, we recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -For more information see [Getting Started With User Experience Virtualization 1.0](https://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](https://technet.microsoft.com/library/jj679972.aspx). - -### User Experience Walk-through - -This following is a step-by-step walk-through of the App-V and UPM operations and the expectations users should expect. - - ---- - - - - - - - - - - - - -
          Optimized for PerformanceOptimized for Storage

          After implementing this approach in the VDI/RDSH environment, on first login,

          -
            -
          • (Operation) A user-publishing/refresh is initiated. (Expectation) If this is the first time a user has published virtual applications (e.g. non-persistent), this will take the usual duration of a publishing/refresh.

          • -
          • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.

          • -
          -

          On subsequent logins:

          -
            -
          • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

            -

            (Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (i.e., package entitlements change), some may go away.

          • -
          • (Operation) Publishing/refresh will process un-publish and publish operations for changes in user package entitlements. (Expectation) If there are no entitlement changes, publishing1 will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity* of virtual applications

          • -
          • (Operation) UPM solution will capture user integrations again at logoff. (Expectation) Same as previous.

          • -
          -

          ¹ The publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps.

          After implementing this approach in the VDI/RDSH environment, on first login,

          -
            -
          • (Operation) A user-publishing/refresh is initiated. (Expectation)

            -
              -
            • If this is the first time a user has published virtual applications (e.g., non-persistent), this will take the usual duration of a publishing/refresh.

            • -
            • First and subsequent logins will be impacted by pre-configuring of packages (add/refresh).

              -

            • -
          • -
          • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state

          • -
          -

          On subsequent logins:

          -
            -
          • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

          • -
          • (Operation) Add/refresh must pre-configure all user targeted applications. (Expectation)

            -
              -
            • This may increase the time to application availability significantly (on the order of 10’s of seconds).

            • -
            • This will increase the publishing refresh time relative to the number and complexity* of virtual applications.

              -

            • -
          • -
          • (Operation) Publishing/refresh will process un-publish and publish operations for changes to user package entitlements.

          • -
          - - - - ---- - - - - - - - - - - - - -
          OutcomeOutcome

          -
            -
          • Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of login.

          • -
          • The publishing/refresh will process changes to the users entitled virtual applications which impacts the experience.

          • -

          Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended.

          - - - -### Impact to Package Life Cycle - -Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (un-published) virtual application packages, it is recommended you update the base image to reflect these changes. To understand why review the following section: - -App-V 5.0 SP2 introduced the concept of pending states. In the past, - -- If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the un-publish or publish operation, respectively, would fail. - -- Now, if a package is in-use the operation will be pended. The un-publish and publish-pend operations will be processed on service restart or if another publish or un-publish command is issued. In the latter case, if the virtual application is in-use otherwise, the virtual application will remain in a pending state. For globally published packages, a restart (or service restart) often needed. - -In a non-persistent environment, it is unlikely these pended operations will be processed. The pended operations, for example tasks are captured under **HKEY\_CURRENT\_USER** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **PendingTasks**. Although this location is persisted by the UPM solution, if it is not applied to the environment prior to log on, it will not be processed. - -### Enhancing the VDI Experience through Performance Optimization Tuning - -The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. - -**.NET NGEN Blog and Script (Highly Recommended)** - -About NGEN technology - -- [How to speed up NGEN optimization](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) - -- [Script](https://aka.ms/DrainNGenQueue) - -**Windows Server and Server Roles** - -Server Performance Tuning Guidelines for - -- [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx) - -- [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx) - -- [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx) - -**Server Roles** - -- [Remote Desktop Virtualization Host](https://msdn.microsoft.com/library/windows/hardware/dn567643.aspx) - -- [Remote Desktop Session Host](https://msdn.microsoft.com/library/windows/hardware/dn567648.aspx) - -- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](https://msdn.microsoft.com/library/windows/hardware/dn567678.aspx) - -- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](https://technet.microsoft.com/library/jj134210.aspx) - -**Windows Client (Guest OS) Performance Tuning Guidance** - -- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx) - -- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx) - -- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf) - -- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx) - -## Sequencing Steps to Optimize Packages for Publishing Performance - - -Several App-V features facilitate new scenarios or enable new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. - - ------ - - - - - - - - - - - - - - - - -
          StepConsiderationBenefitsTradeoffs

          No Feature Block 1 (FB1, also known as Primary FB)

          No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch.If there are network limitations, FB1 will:

          -
            -
          • Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.

          • -
          • Delay launch until the entire FB1 has been streamed.

          • -

          Stream faulting decreases the launch time.

          Virtual application packages with FB1 configured will need to be re-sequenced.

          - - - -### Removing FB1 - -Removing FB1 does not require the original application installer. After completing the following steps, it is suggested that you revert the computer running the sequencer to a clean snapshot. - -**Sequencer UI** - Create a New Virtual Application Package. - -1. Complete the sequencing steps up to Customize -> Streaming. - -2. At the Streaming step, do not select **Optimize the package for deployment over slow or unreliable network**. - -3. If desired, move on to **Target OS**. - -**Modify an Existing Virtual Application Package** - -1. Complete the sequencing steps up to Streaming. - -2. Do not select **Optimize the package for deployment over a slow or unreliable network**. - -3. Move to **Create Package**. - -**PowerShell** - Update an Existing Virtual Application Package. - -1. Open an elevated PowerShell session. - -2. Import-module **appvsequencer**. - -3. **Update-AppvSequencerPackage** - **AppvPackageFilePath** - - "C:\\Packages\\MyPackage.appv" -Installer - - "C:\\PackageInstall\\PackageUpgrade.exe empty.exe" -OutputPath - - "C:\\UpgradedPackages" - - **Note** - This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file. - - - - ------ - - - - - - - - - - - - - - - - -
          StepConsiderationsBenefitsTradeoffs

          No SXS Install at Publish (Pre-Install SxS assemblies)

          Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package.

          The SxS Assembly dependencies will not install at publishing time.

          SxS Assembly dependencies must be pre-installed.

          - - - -### Creating a new virtual application package on the sequencer - -If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is installed as part of an application’s installation, SxS Assembly will be automatically detected and included in the package. The administrator will be notified and will have the option to exclude the SxS Assembly. - -**Client Side**: - -When publishing a virtual application package, the App-V Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur. - - ------ - - - - - - - - - - - - - - - - -
          StepConsiderationsBenefitsTradeoffs

          Selectively Employ Dynamic Configuration files

          The App-V 5.1 client must parse and process these Dynamic Configuration files.

          -

          Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.

          -

          Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.

          Publishing times will improve if these files are used selectively or not at all.

          Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.

          - - - -### Disabling a Dynamic Configuration using Powershell - -- For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without - - **-DynamicDeploymentConfiguration** parameter - -- Similarly, when adding new packages using `Add-AppVClientPackage –Path c:\Packages\Apps\MyApp.appv`, do not use the - - **-DynamicDeploymentConfiguration** parameter. - -For documentation on How to Apply a Dynamic Configuration, see: - -- [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md) - -- [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md) - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          StepConsiderationsBenefitsTradeoffs

          Account for Synchronous Script Execution during Package Lifecycle.

          If script collateral is embedded in the package, Add (Powershell) may be significantly slower.

          -

          Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.

          Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.

          This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.

          Remove Extraneous Virtual Fonts from Package.

          The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20.

          Virtual Fonts impact publishing refresh performance.

          Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.

          - - - -### Determining what virtual fonts exist in the package - -- Make a copy of the package. - -- Rename Package\_copy.appv to Package\_copy.zip - -- Open AppxManifest.xml and locate the following: - - <appv:Extension Category="AppV.Fonts"> - - <appv:Fonts> - - <appv:Font Path="\[{Fonts}\]\\private\\CalibriL.ttf" DelayLoad="true"></appv:Font> - - **Note** - If there are fonts marked as **DelayLoad**, those will not impact first launch. - - - -~~~ -</appv:Fonts> -~~~ - -### Excluding virtual fonts from the package - -Use the dynamic configuration file that best suits the user scope – deployment configuration for all users on computer, user configuration for specific user or users. - -- Disable fonts with the deployment or user configuration. - -Fonts - ---> - -<Fonts Enabled="false" /> - -<!-- - -## App-V 5.1 Performance Guidance Terminology - - -The following terms are used when describing concepts and actions related to App-V 5.1 performance optimization. - -- **Complexity** – Refers to the one or more package characteristics that may impact performance during pre-configure (**Add-AppvClientPackage**) or integration (**Publish-AppvClientPackage**). Some example characteristics are: manifest size, number of virtual fonts, number of files. - -- **De-Integrate** – Removes the user integrations - -- **Re-Integrate** – Applies the user integrations. - -- **Non-Persistent, Pooled** – Creates a computer running a virtual environment each time they log in. - -- **Persistent, Personal** – A computer running a virtual environment that remains the same for every login. - -- **Stateful** - For this document, implies that user integrations are persisted between sessions and a user environment management technology is used in conjunction with non-persistent RDSH or VDI. - -- **Stateless** – Represents a scenario when no user state is persisted between sessions. - -- **Trigger** – (or Native Action Triggers). UPM uses these types of triggers to initiate monitoring or synchronization operations. - -- **User Experience** - In the context of App-V 5.1, the user experience, quantitatively, is the sum of the following parts: - - - From the point that users initiate a log-in to when they are able to manipulate the desktop. - - - From the point where the desktop can be interacted with to the point a publishing refresh begins (in PowerShell terms, sync) when using the App-V 5.1 full server infrastructure. In standalone instances, it is when the **Add-AppVClientPackage** and **Publish-AppVClientPackage Powershell** commands are initiated. - - - From start to completion of the publishing refresh. In standalone instances, this is the first to last virtual application published. - - - From the point where the virtual application is available to launch from a shortcut. Alternatively, it is from the point at which the file type association is registered and will launch a specified virtual application. - -- **User Profile Management** – The controlled and structured approach to managing user components associated with the environment. For example, user profiles, preference and policy management, application control and application deployment. You can use scripting or third-party solutions configure the environment as needed. - - - - - - -## Related topics - - -[Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-app-v-50-rc.md b/mdop/appv-v5/planning-for-app-v-50-rc.md deleted file mode 100644 index a9830b1c28..0000000000 --- a/mdop/appv-v5/planning-for-app-v-50-rc.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning for App-V 5.0 -description: Planning for App-V 5.0 -author: msfttracyp -ms.assetid: 69df85b3-06c7-4123-af05-29d537a687ec -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for App-V 5.0 - - -Use this information to plan how to deploy Microsoft Application Virtualization (App-V) 5.0 so that it does not disrupt your users or the network. - -## Planning information - - -- [Preparing Your Environment for App-V 5.0](preparing-your-environment-for-app-v-50.md) - - This section describes the computing environment requirements and installation prerequisites that should be planned for before beginning App-V 5.0 setup. - -- [Planning to Deploy App-V](planning-to-deploy-app-v.md) - - This section describes the minimum hardware and software requirements necessary for App-V 5.0 client, sequencer and server feature installations. Additionally, associated feature planning information is also displayed. - -- [App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md) - - Planning checklist that can be used to assist in App-V 5.0 deployment planning. - - - - - - -## Other resources for App-V 5.0 Planning - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-for-app-v-51.md b/mdop/appv-v5/planning-for-app-v-51.md deleted file mode 100644 index c32ba654cf..0000000000 --- a/mdop/appv-v5/planning-for-app-v-51.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Planning for App-V 5.1 -description: Planning for App-V 5.1 -author: msfttracyp -ms.assetid: 8d84e679-0bd3-4864-976b-a3cbe6eafba6 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for App-V 5.1 - - -Use this information to plan how to deploy Microsoft Application Virtualization (App-V) 5.1 so that it does not disrupt your users or the network. - -## Planning information - - -- [Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) - - This section describes the computing environment requirements and installation prerequisites that should be planned for before beginning App-V 5.1 setup. - -- [Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - This section describes the minimum hardware and software requirements necessary for App-V 5.1 client, sequencer and server feature installations. Additionally, associated feature planning information is also displayed. - -- [App-V 5.1 Planning Checklist](app-v-51-planning-checklist.md) - - Planning checklist that can be used to assist in App-V 5.1 deployment planning. - - - - - - -## Other resources for App-V 5.1 Planning - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md deleted file mode 100644 index b861440d22..0000000000 --- a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md +++ /dev/null @@ -1,156 +0,0 @@ ---- -title: Planning for High Availability with App-V 5.0 -description: Planning for High Availability with App-V 5.0 -author: msfttracyp -ms.assetid: 6d9a6492-23f8-465c-82e5-49c863594156 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for High Availability with App-V 5.0 - - -Microsoft Application Virtualization 5.0 (App-V 5.0) system configurations can take advantage of options that maintain a high level of available service. - -Use the information in the following sections to help you understand the options to deploy App-V 5.0 in a highly available configuration. - -- [Support for Microsoft SQL Server clustering](#bkmk-sqlcluster) - -- [Support for IIS Network Load Balancing](#bkmk-iisloadbal) - -- [Support for clustered file servers when running (SCS) mode](#bkmk-clusterscsmode) - -- [Support for Microsoft SQL Server Mirroring](#bkmk-sqlmirroring) - -- [Support for Microsoft SQL Server Always On](#bkmk-sqlalwayson) - -## Support for Microsoft SQL Server clustering - - -You can run the App-V Management database and Reporting database on computers that are running Microsoft SQL Server clusters. However, you must install the databases using scripts. - -For instructions, see [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md). - -## Support for IIS Network Load Balancing - - -You can use Internet Information Services (IIS) Network Load Balancing to configure a highly available environment for computers running the App-V 5.x Management, Publishing, and Reporting services which are deployed through IIS. - -Review the following for more information about configuring IIS and Network Load Balancing for computers running Windows Server operating systems: - -- Provides information about configuring Internet Information Services (IIS) 7.0. - - [Achieving High Availability and Scalability - ARR and NLB](https://go.microsoft.com/fwlink/?LinkId=316369) (https://go.microsoft.com/fwlink/?LinkId=316369) - -- Configuring Microsoft Windows Server - - [Network Load Balancing](https://go.microsoft.com/fwlink/?LinkId=316370) (https://go.microsoft.com/fwlink/?LinkId=316370). - - This information also applies to IIS Network Load Balancing (NLB) clusters in Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012. - - **Note**   - The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are changed in Windows Server 2012. For information on new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371) (https://go.microsoft.com/fwlink/?LinkId=316371). - - - -## Support for clustered file servers when running (SCS) mode - - -Running App-V 5.0 in Share Content Store (SCS) mode with clustered file servers is supported. - -The following steps can be used to enable this configuration: - -- Configure App-V 5.0 to run in client SCS mode. For more information about configuring App-V 5.0 SCS mode, see [How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md). - -- Configure the file server cluster configured in both the Microsoft Server 2012 scale out mode and pre **2012** mode with a virtual SAN. - -The following steps can be used to validate the configuration: - -1. Add a package on the publishing server. For more information about adding a package, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md). - -2. Perform a publishing refresh on the computer running the App-V 5.0 client and open an application. - -3. Switch cluster nodes mid-publishing refresh and mid-streaming to ensure fail-over works correctly. - -Review the following for more information about configuring Windows Server Failover clusters: - -- [Checklist: Create a Clustered File Server](https://go.microsoft.com/fwlink/?LinkId=316372) (https://go.microsoft.com/fwlink/?LinkId=316372). - -- [Use Cluster Shared Volumes in a Windows Server 2012 Failover Cluster](https://go.microsoft.com/fwlink/?LinkId=316373) (https://go.microsoft.com/fwlink/?LinkId=316373). - -## Support for Microsoft SQL Server Mirroring - - -Using Microsoft SQL Server mirroring, where the App-V 5.0 management server database is mirrored utilizing two SQL Server instances, for App-V 5.0 management server databases is supported. - -Review the following for more information about configuring Microsoft SQL Server Mirroring: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=316375) (https://go.microsoft.com/fwlink/?LinkId=316375) - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=316377) (https://go.microsoft.com/fwlink/?LinkId=316377) - -The following steps can be used to validate the configuration: - -1. Initiate a Microsoft SQL Server Mirroring session. - -2. Select **Failover** to designate a new master Microsoft SQL Server instance. - -3. Verify that the App-V 5.0 management server continues to function as expected after the failover. - -The connection string on the management server can be modified to include **failover partner = <server2>**. This will only help when the primary on the mirror has failed over to the secondary and the computer running the App-V 5.0 client is doing a fresh connection (say after reboot). - -Use the following steps to modify the connection string to include **failover partner = <server2>**: - -**Important**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -1. Login to the management server and open **regedit**. - -2. Navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ManagementService**. - -3. Modify the **MANAGEMENT\_SQL\_CONNECTION\_STRING** value with the **failover partner = <server2>**. - -4. Restart management service using the IIS console. - - **Note**   - Database Mirroring is on the list of Deprecated Database Engine Features for Microsoft SQL Server 2012 due to the **AlwaysOn** feature available with Microsoft SQL Server 2012. - - - -Click any of the following links for more information: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=394235) (https://go.microsoft.com/fwlink/?LinkId=394235). - -- [How to: Configure a Database Mirroring Session (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394236) (https://go.microsoft.com/fwlink/?LinkId=394236). - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394237) (https://go.microsoft.com/fwlink/?LinkId=394237). - -- [Deprecated Database Engine Features in SQL Server 2012](https://go.microsoft.com/fwlink/?LinkId=394238) (https://go.microsoft.com/fwlink/?LinkId=394238). - -## Support for Microsoft SQL Server Always On configuration - - -The App-V 5.0 management server database supports deployments to computers running Microsoft SQL Server with the **Always On** configuration. - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md deleted file mode 100644 index c3e0e18888..0000000000 --- a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md +++ /dev/null @@ -1,161 +0,0 @@ ---- -title: Planning for High Availability with App-V 5.1 -description: Planning for High Availability with App-V 5.1 -author: msfttracyp -ms.assetid: 1f190a0e-10ee-4fbe-a602-7e807e943033 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for High Availability with App-V 5.1 - - -Microsoft Application Virtualization (App-V) 5.1 system configurations can take advantage of options that maintain a high level of available service. - -Use the information in the following sections to help you understand the options to deploy App-V 5.1 in a highly available configuration. - -- [Support for Microsoft SQL Server clustering](#bkmk-sqlcluster) - -- [Support for IIS Network Load Balancing](#bkmk-iisloadbal) - -- [Support for clustered file servers when running (SCS) mode](#bkmk-clusterscsmode) - -- [Support for Microsoft SQL Server Mirroring](#bkmk-sqlmirroring) - -- [Support for Microsoft SQL Server Always On](#bkmk-sqlalwayson) - -## Support for Microsoft SQL Server clustering - - -You can run the App-V Management database and Reporting database on computers that are running Microsoft SQL Server clusters. However, you must install the databases using scripts. - -For instructions, see [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md). - -## Support for IIS Network Load Balancing - - -You can use Internet Information Services (IIS) Network Load Balancing to configure a highly available environment for computers running the App-V 5.x Management, Publishing, and Reporting services which are deployed through IIS. - -Review the following for more information about configuring IIS and Network Load Balancing for computers running Windows Server operating systems: - -- Provides information about configuring Internet Information Services (IIS) 7.0. - - [Achieving High Availability and Scalability - ARR and NLB](https://go.microsoft.com/fwlink/?LinkId=316369) (https://go.microsoft.com/fwlink/?LinkId=316369) - -- Configuring Microsoft Windows Server - - [Network Load Balancing](https://go.microsoft.com/fwlink/?LinkId=316370) (https://go.microsoft.com/fwlink/?LinkId=316370). - - This information also applies to IIS Network Load Balancing (NLB) clusters in Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012. - - **Note**   - The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are changed in Windows Server 2012. For information on new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371) (https://go.microsoft.com/fwlink/?LinkId=316371). - - - -## Support for clustered file servers when running (SCS) mode - - -Running App-V 5.1 in Share Content Store (SCS) mode with clustered file servers is supported. - -The following steps can be used to enable this configuration: - -- Configure App-V 5.1 to run in client SCS mode. For more information about configuring App-V 5.1 SCS mode, see [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md). - -- Configure the file server cluster configured in both the Microsoft Server 2012 scale out mode and pre **2012** mode with a virtual SAN. - -The following steps can be used to validate the configuration: - -1. Add a package on the publishing server. For more information about adding a package, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md). - -2. Perform a publishing refresh on the computer running the App-V 5.1 client and open an application. - -3. Switch cluster nodes mid-publishing refresh and mid-streaming to ensure fail-over works correctly. - -Review the following for more information about configuring Windows Server Failover clusters: - -- [Checklist: Create a Clustered File Server](https://go.microsoft.com/fwlink/?LinkId=316372) (https://go.microsoft.com/fwlink/?LinkId=316372). - -- [Use Cluster Shared Volumes in a Windows Server 2012 Failover Cluster](https://go.microsoft.com/fwlink/?LinkId=316373) (https://go.microsoft.com/fwlink/?LinkId=316373). - -## Support for Microsoft SQL Server Mirroring - - -Using Microsoft SQL Server mirroring, where the App-V 5.1 management server database is mirrored utilizing two SQL Server instances, for App-V 5.1 management server databases is supported. - -Review the following for more information about configuring Microsoft SQL Server Mirroring: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=316375) (https://go.microsoft.com/fwlink/?LinkId=316375) - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=316377) (https://go.microsoft.com/fwlink/?LinkId=316377) - -The following steps can be used to validate the configuration: - -1. Initiate a Microsoft SQL Server Mirroring session. - -2. Select **Failover** to designate a new master Microsoft SQL Server instance. - -3. Verify that the App-V 5.1 management server continues to function as expected after the failover. - -The connection string on the management server can be modified to include **failover partner = <server2>**. This will only help when the primary on the mirror has failed over to the secondary and the computer running the App-V 5.1 client is doing a fresh connection (say after reboot). - -Use the following steps to modify the connection string to include **failover partner = <server2>**: - -**Important**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -1. Login to the management server and open **regedit**. - -2. Navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ManagementService**. - -3. Modify the **MANAGEMENT\_SQL\_CONNECTION\_STRING** value with the **failover partner = <server2>**. - -4. Restart management service using the IIS console. - - **Note**   - Database Mirroring is on the list of Deprecated Database Engine Features for Microsoft SQL Server 2012 due to the **AlwaysOn** feature available with Microsoft SQL Server 2012. - - - -Click any of the following links for more information: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=394235) (https://go.microsoft.com/fwlink/?LinkId=394235). - -- [How to: Configure a Database Mirroring Session (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394236) (https://go.microsoft.com/fwlink/?LinkId=394236). - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394237) (https://go.microsoft.com/fwlink/?LinkId=394237). - -- [Deprecated Database Engine Features in SQL Server 2012](https://go.microsoft.com/fwlink/?LinkId=394238) (https://go.microsoft.com/fwlink/?LinkId=394238). - -## Support for Microsoft SQL Server Always On configuration - - -The App-V 5.1 management server database supports deployments to computers running Microsoft SQL Server with the **Always On** configuration. - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md deleted file mode 100644 index 0413cff809..0000000000 --- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Planning for Migrating from a Previous Version of App-V -description: Planning for Migrating from a Previous Version of App-V -author: msfttracyp -ms.assetid: d4ca8f09-86fd-456f-8ec2-242ff94ae9a0 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for Migrating from a Previous Version of App-V - - -Use the following information to plan how to migrate to App-V 5.0 from previous versions of App-V. - -## Migration requirements - - -Before you start any upgrades, review the following requirements: - -- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.0 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components. -**Note:** App-V 4.6 has exited Mainstream support. - -- App-V 5.0 supports only packages that are created using App-V 5.0, or packages that have been converted to the App-V 5.0 (**.appv**) format. - -- App-V 5.0 SP3 only: If you are upgrading the App-V Server from App-V 5.0 SP1, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-migrate-to-50sp3) for instructions. - -## Running the App-V 5.0 client concurrently with App-V 4.6 - - -You can run the App-V 5.0 client concurrently on the same computer with the App-V 4.6 SP3 client. - -When you run coexisting App-V clients, you can: - -- Convert an App-V 4.6 SP3 package to the App-V 5.0 format and publish both packages, when you have both clients running. - -- Define the migration policy for the converted package, which allows the converted App-V 5.0 package to assume the file type associations and shortcuts from the App-V 4.6 package. - -### Supported coexistence scenarios - -The following table shows the supported App-V coexistence scenarios. We recommend that you install the latest available updates of a given release when you are running coexisting clients. - - ---- - - - - - - - - - - - - - - - - -
          App-V 4.6 client typeApp-V 5.0 client type

          App-V 4.6 SP3

          App-V 5.0

          App-V 4.6 SP3 RDS

          App-V 5.0 RDS

          - - - -### Requirements for running coexisting clients - -To run coexisting clients, you must: - -- Install the App-V 4.6 client before you install the App-V 5.0 client. - -- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To get the deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx). - -### Client downloads and documentation - -The following table provides link to the TechNet documentation about the releases. The TechNet documentation about the App-V client applies to both clients, unless stated otherwise. - - ---- - - - - - - - - - - - - - - - - -
          App-V versionLink to TechNet documentation

          App-V 4.6 SP3

          About Microsoft Application Virtualization 4.6 SP3

          App-V 5.0 SP3

          About Microsoft Application Virtualization 5.0 SP3

          - - - -For more information about how to configure App-V 5.0 client coexistence, see: - -- [How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) - -- [App-V 5.0 Coexistence and Migration](https://technet.microsoft.com/windows/jj835811.aspx) - -## Converting “previous-version” packages using the package converter - - -Before migrating a package, created using App-V 4.6 SP3 or earlier, to App-V 5.0, review the following requirements: - -- You must convert the package to the **.appv** file format. - -- The Package Converter supports only the direct conversion of packages that were created by using App-V 4.5 and later. To use the package converter on a package that was created using a previous version, you must use an App-V 4.5 or later version of the sequencer to upgrade the package, and then you can perform the package conversion. - -For more information about using the package converter to convert a package, see [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md). After you convert the file, you can deploy it to target computers that run the App-V 5.0 client. - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md deleted file mode 100644 index a895f50b35..0000000000 --- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Planning for Migrating from a Previous Version of App-V -description: Planning for Migrating from a Previous Version of App-V -author: msfttracyp -ms.assetid: 4a058047-9674-41bc-8050-c58c97a80a9b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for Migrating from a Previous Version of App-V - - -Use the following information to plan how to migrate to Microsoft Application Virtualization (App-V) 5.1 from previous versions of App-V. - -## Migration requirements - - -Before you start any upgrades, review the following requirements: - -- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.1 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components. -**Note:** App-V 4.6 has exited Mainstream support. - -- App-V 5.1 supports only packages that are created using App-V 5.0 or App-V 5.1, or packages that have been converted to the **.appv** format. - -- If you are upgrading the App-V Server from App-V 5.0 SP1, see [About App-V 5.1](about-app-v-51.md#bkmk-migrate-to-51) for instructions. - -## Running the App-V 5.1 client concurrently with App-V 4.6 - - -You can run the App-V 5.1 client concurrently on the same computer with the App-V 4.6 SP3 client. - -When you run coexisting App-V clients, you can: - -- Convert an App-V 4.6 SP3 package to the App-V 5.1 format and publish both packages, when you have both clients running. - -- Define the migration policy for the converted package, which allows the converted App-V 5.1 package to assume the file type associations and shortcuts from the App-V 4.6 package. - -### Supported coexistence scenarios - -The following table shows the supported App-V coexistence scenarios. We recommend that you install the latest available updates of a given release when you are running coexisting clients. - - ---- - - - - - - - - - - - - - - - - -
          App-V 4.6 client typeApp-V 5.1 client type

          App-V 4.6 SP3

          App-V 5.1

          App-V 4.6 SP3 RDS

          App-V 5.1 RDS

          - - - -### Requirements for running coexisting clients - -To run coexisting clients, you must: - -- Install the App-V 4.6 client before you install the App-V 5.1 client. - -- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx). - -**Note**   -App-V 5.1 packages can run side by side with App-V 4.6 packages if you have coexisting installations of App-V 5.1 and 4.6. However, App-V 5.1 packages cannot interact with App-V 4.6 packages in the same virtual environment. - - - -### Client downloads and documentation - -The following table provides links to the App-V 4.6 client downloads and to the TechNet documentation about the releases. The downloads include the App-V “regular” and RDS clients. The TechNet documentation about the App-V client applies to both clients, unless stated otherwise. - - ---- - - - - - - - - - - - - - - - - -
          App-V versionLink to TechNet documentation

          App-V 4.6 SP3

          About Microsoft Application Virtualization 4.6 SP3

          App-V 4.6 SP3

          About Microsoft Application Virtualization 5.1

          - - - -For more information about how to configure App-V 5.1 client coexistence, see: - -- [How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) - -- [App-V 5.0 Coexistence and Migration](https://technet.microsoft.com/windows/jj835811.aspx) - -## Converting “previous-version” packages using the package converter - - -Before migrating a package, created using App- 4.6 SP2 or earlier, to App-V 5.1, review the following requirements: - -- You must convert the package to the **.appv** file format. - -- The Package Converter supports only the direct conversion of packages that were created by using App-V 4.5 and later. To use the package converter on a package that was created using a previous version, you must use an App-V 4.5 or later version of the sequencer to upgrade the package, and then you can perform the package conversion. - -For more information about using the package converter to convert a package, see [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md). After you convert the file, you can deploy it to target computers that run the App-V 5.1 client. - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md deleted file mode 100644 index d27170ec67..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Planning for the App-V 5.0 Sequencer and Client Deployment -description: Planning for the App-V 5.0 Sequencer and Client Deployment -author: msfttracyp -ms.assetid: 57a604ad-90e1-4d32-86bb-eafff59aa43a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for the App-V 5.0 Sequencer and Client Deployment - - -Before you can start to use Microsoft Application Virtualization (App-V) 5.0, you must install the App-V 5.0 sequencer, the App-V 5.0 client, and optionally the App-V 5.0 shared content store. The following sections address planning for these installations. - -## Planning for App-V 5.0 sequencer deployment - - -App-V 5.0 uses a process called sequencing to create virtualized applications and application packages. Sequencing requires the use of a computer that runs the App-V 5.0 sequencer. - -**Note**   -For information about the new functionality of App-V 5.0 sequencer, see the **Changes to the sequencer** section of [What's New in App-V 5.0](whats-new-in-app-v-50.md). - - - -The computer that runs the App-V 5.0 sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -Ideally, you should install the sequencer on a computer running as a virtual machine. This enables you to more easily revert the computer running the sequencer to a “clean” state before sequencing another application. When you install the sequencer using a virtual machine, you should perform the following steps: - -1. Install all associated sequencer prerequisites. - -2. Install the sequencer. - -3. Take a “snapshot” of the environment. - -**Important**   -You should have your corporate security team review and approve the sequencing process plan. For security reasons, you should keep the sequencer operations in a lab that is separate from the production environment. The separation arrangement can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers must be able to connect to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they must not be on the corporate network unprotected. For example, you might be able to operate behind a firewall or on an isolated network segment. You might also be able to use virtual machines that are configured to share an isolated virtual network. Follow your corporate security policies to safely address these concerns. - - - -[How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) - -## Planning for App-V 5.0 client deployment - - -To run virtualized packages on target computers, you must install the App-V 5.0 client on the target computers. The App-V 5.0 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and specific file types to start virtualized applications. The client also helps obtain application content from the management server and caches the content before the client starts the application. There are two different client types: the client for Remote Desktop Services, which is used on Remote Desktop Session Host (RD Session Host) server systems and the App-V 5.0 client, which is used for all other computers. - -The App-V 5.0 client should be configured by using either the installer command line or by using a PowerShell script after the installation has been completed. - -The settings must be defined carefully in advance in order to expedite the deployment of the App-V 5.0 client software. This is especially important when you have computers in different offices where the clients must be configured to use different source locations. - -You must also determine how you will deploy the client software. Although it is possible to deploy the client manually on each computer, most organizations prefer to deploy the client through an automated process. A larger organization might have an operational Electronic Software Distribution (ESD) system, which is an ideal client deployment system. If no ESD system exists, you can use your organization’s standard method of installing software. Possible methods include Group Policy or various scripting techniques. Depending on the quantity and disparate locations of your client computers, this deployment process can be complex. You must use a structured approach to ensure that all computers get the client installed with the correct configuration. - -For a list of the client minimum requirements see [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - -## Planning for App-V client coexistence - - -You can deploy the App-V 5.0 client side by side with the App-V 4.6 client. Client coexistence requires that you add or publish virtualized applications by using either a deployment configuration file or a user configuration file, because there are certain settings in these configuration files that must be configured in order for App-V 5.0 to function with App-V 4.6 clients. When a package is upgraded by using either the client or the server, the package must resubmit the configuration file. This is true for any package that has a corresponding configuration file, so it is not specific to client coexistence. However, if you do not submit the configuration file during the package upgrade, then the package state will not function as expected in coexistence scenarios. - -App-V 5.0 dynamic configuration files customize a package for a specific user. You must create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use them. To create the file it requires an advanced manual operation. - -When a dynamic user configuration file is used, none of the App-V 5.0 information for the extension in the manifest file is used. This means that the dynamic user configuration file must include everything for the extension that is specific to App-V 5.0 in the manifest file, as well as the changes that you want to make, such as, deletions and updates. For more information about how to create a custom configuration file, see [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md). - -[How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) - -## Planning for the App-V 5.0 Shared Content Store (SCS) - - -The App-V 5.0 shared content store mode allows the computer running the App-V 5.0 client to run virtualized applications and none of the package contents is saved on the computer running the App-V 5.0 client. Virtual applications are streamed to target computers only when requested by the client. - -The following list displays some of the benefits of using the App-V 5.0 shared content store: - -- Reduced app-to-app and multi-user application conflicts and hence a reduced need for regression testing - -- Accelerated application deployment by reduction of deployment risk - -- Simplified profile management - -[How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md) - - - - - - -## Other resources for the App-V 5.0 deployment - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md deleted file mode 100644 index a86ccf90cc..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Planning for the App-V 5.0 Server Deployment -description: Planning for the App-V 5.0 Server Deployment -author: msfttracyp -ms.assetid: fd89b324-3961-471a-ad90-c8f9ae7a8155 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for the App-V 5.0 Server Deployment - - -The Microsoft Application Virtualization (App-V) 5.0 server infrastructure consists of a set of specialized features that can be installed on one or more server computers, based on the requirements of the enterprise. - -## Planning for App-V 5.0 Server Deployment - - -The App-V 5.0 server consists of the following features: - -- Management Server – provides overall management functionality for the App-V 5.0 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.0 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.0 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.0 reporting. - -The following list displays the recommended methods for installing the App-V 5.0 server infrastructure: - -- Install the App-V 5.0 server. For more information, see [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md). - -- Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md). - -- Use Electronic Software Distribution (ESD). For more information, see [How to deploy App-V 5.0 Packages Using Electronic Software Distribution](how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md). - -- Install all server features on a single computer. - -## App-V 5.0 Server Interaction - - -This section contains information about how the various App-V 5.0 server roles interact with each other. - -The App-V 5.0 Management Server contains the repository of packages and their assigned configurations. For Publishing Servers that are registered with the Management Server, the associated metadata is provided to the Publishing servers for use when publishing refresh requests are received from computers running the App-V 5.0 Client. App-V 5.0 publishing servers managed by a single management server can be serving different clients and can have different website names and port bindings. Additionally, all Publishing Servers managed by the same Management Server are replicas of each other. - -**Note**   -The Management Server does not perform any load balancing. The associated metadata is simply passed to the publishing server for use when processing client requests. - - - -## Server-Related Protocols and External Features - - -The following displays information about server-related protocols used by the App-V 5.0 servers. The table also includes the reporting mechanism for each server type. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
          Server TypeProtocolsExternal Features NeededReporting

          IIS server

          HTTP

          -

          HTTPS

          This server-protocol combination requires a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet.

          Internal

          File

          SMB

          This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer with file sharing or streaming capability.

          Internal

          - - - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md deleted file mode 100644 index 03e04d5ec3..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Planning for the App-V 5.1 Sequencer and Client Deployment -description: Planning for the App-V 5.1 Sequencer and Client Deployment -author: msfttracyp -ms.assetid: d92f8773-fa7d-4926-978a-433978f91202 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for the App-V 5.1 Sequencer and Client Deployment - - -Before you can start to use Microsoft Application Virtualization (App-V) 5.1, you must install the App-V 5.1 sequencer, the App-V 5.1 client, and optionally the App-V 5.1 shared content store. The following sections address planning for these installations. - -## Planning for App-V 5.1 sequencer deployment - - -App-V 5.1 uses a process called sequencing to create virtualized applications and application packages. Sequencing requires the use of a computer that runs the App-V 5.1 sequencer. - -**Note**   -For information about the new functionality of App-V 5.1 sequencer, see the **Sequencer Improvements** section of [About App-V 5.1](about-app-v-51.md). - - - -The computer that runs the App-V 5.1 sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -Ideally, you should install the sequencer on a computer running as a virtual machine. This enables you to more easily revert the computer running the sequencer to a “clean” state before sequencing another application. When you install the sequencer using a virtual machine, you should perform the following steps: - -1. Install all associated sequencer prerequisites. - -2. Install the sequencer. - -3. Take a “snapshot” of the environment. - -**Important**   -You should have your corporate security team review and approve the sequencing process plan. For security reasons, you should keep the sequencer operations in a lab that is separate from the production environment. The separation arrangement can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers must be able to connect to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they must not be on the corporate network unprotected. For example, you might be able to operate behind a firewall or on an isolated network segment. You might also be able to use virtual machines that are configured to share an isolated virtual network. Follow your corporate security policies to safely address these concerns. - - - -## Planning for App-V 5.1 client deployment - - -To run virtualized packages on target computers, you must install the App-V 5.1 client on the target computers. The App-V 5.1 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and specific file types to start virtualized applications. The client also helps obtain application content from the management server and caches the content before the client starts the application. There are two different client types: the client for Remote Desktop Services, which is used on Remote Desktop Session Host (RD Session Host) server systems and the App-V 5.1 client, which is used for all other computers. - -The App-V 5.1 client should be configured by using either the installer command line or by using a PowerShell script after the installation has been completed. - -The settings must be defined carefully in advance in order to expedite the deployment of the App-V 5.1 client software. This is especially important when you have computers in different offices where the clients must be configured to use different source locations. - -You must also determine how you will deploy the client software. Although it is possible to deploy the client manually on each computer, most organizations prefer to deploy the client through an automated process. A larger organization might have an operational Electronic Software Distribution (ESD) system, which is an ideal client deployment system. If no ESD system exists, you can use your organization’s standard method of installing software. Possible methods include Group Policy or various scripting techniques. Depending on the quantity and disparate locations of your client computers, this deployment process can be complex. You must use a structured approach to ensure that all computers get the client installed with the correct configuration. - -For a list of the client minimum requirements see [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -## Planning for App-V client coexistence - - -You can deploy the App-V 5.1 client side by side with the App-V 4.6 client. Client coexistence requires that you add or publish virtualized applications by using either a deployment configuration file or a user configuration file, because there are certain settings in these configuration files that must be configured in order for App-V 5.1 to function with App-V 4.6 clients. When a package is upgraded by using either the client or the server, the package must resubmit the configuration file. This is true for any package that has a corresponding configuration file, so it is not specific to client coexistence. However, if you do not submit the configuration file during the package upgrade, then the package state will not function as expected in coexistence scenarios. - -App-V 5.1 dynamic configuration files customize a package for a specific user. You must create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use them. To create the file it requires an advanced manual operation. - -When a dynamic user configuration file is used, none of the App-V 5.1 information for the extension in the manifest file is used. This means that the dynamic user configuration file must include everything for the extension that is specific to App-V 5.1 in the manifest file, as well as the changes that you want to make, such as, deletions and updates. For more information about how to create a custom configuration file, see [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md). - -## Planning for the App-V 5.1 Shared Content Store (SCS) - - -The App-V 5.1 shared content store mode allows the computer running the App-V 5.1 client to run virtualized applications and none of the package contents is saved on the computer running the App-V 5.1 client. Virtual applications are streamed to target computers only when requested by the client. - -The following list displays some of the benefits of using the App-V 5.1 shared content store: - -- Reduced app-to-app and multi-user application conflicts and hence a reduced need for regression testing - -- Accelerated application deployment by reduction of deployment risk - -- Simplified profile management - - - - - - -## Other resources for the App-V 5.1 deployment - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -## Related topics - - -[How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -[How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) - -[How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md deleted file mode 100644 index 7d2ec754d2..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Planning for the App-V 5.1 Server Deployment -description: Planning for the App-V 5.1 Server Deployment -author: msfttracyp -ms.assetid: eedd97c9-bee0-4749-9d1e-ab9528fba398 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for the App-V 5.1 Server Deployment - - -The Microsoft Application Virtualization (App-V) 5.1 server infrastructure consists of a set of specialized features that can be installed on one or more server computers, based on the requirements of the enterprise. - -## Planning for App-V 5.1 Server Deployment - - -The App-V 5.1 server consists of the following features: - -- Management Server – provides overall management functionality for the App-V 5.1 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.1 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.1 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.1 reporting. - -The following list displays the recommended methods for installing the App-V 5.1 server infrastructure: - -- Install the App-V 5.1 server. For more information, see [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md). - -- Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md). - -- Use Electronic Software Distribution (ESD). For more information, see [How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md). - -- Install all server features on a single computer. - -## App-V 5.1 Server Interaction - - -This section contains information about how the various App-V 5.1 server roles interact with each other. - -The App-V 5.1 Management Server contains the repository of packages and their assigned configurations. For Publishing Servers that are registered with the Management Server, the associated metadata is provided to the Publishing servers for use when publishing refresh requests are received from computers running the App-V 5.1 Client. App-V 5.1 publishing servers managed by a single management server can be serving different clients and can have different website names and port bindings. Additionally, all Publishing Servers managed by the same Management Server are replicas of each other. - -**Note**   -The Management Server does not perform any load balancing. The associated metadata is simply passed to the publishing server for use when processing client requests. - - - -## Server-Related Protocols and External Features - - -The following displays information about server-related protocols used by the App-V 5.1 servers. The table also includes the reporting mechanism for each server type. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
          Server TypeProtocolsExternal Features NeededReporting

          IIS server

          HTTP

          -

          HTTPS

          This server-protocol combination requires a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet.

          Internal

          File

          SMB

          This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer with file sharing or streaming capability.

          Internal

          - - - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office.md b/mdop/appv-v5/planning-for-using-app-v-with-office.md deleted file mode 100644 index 76440328d4..0000000000 --- a/mdop/appv-v5/planning-for-using-app-v-with-office.md +++ /dev/null @@ -1,398 +0,0 @@ ---- -title: Planning for Using App-V with Office -description: Planning for Using App-V with Office -author: msfttracyp -ms.assetid: c4371869-4bfc-4d13-9198-ef19f99fc192 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Using App-V with Office - - -Use the following information to plan how to deploy Office by using App-V. This article includes: - -- [App-V support for Language Packs](#bkmk-lang-pack) - -- [Supported versions of Microsoft Office](#bkmk-office-vers-supp-appv) - -- [Planning for using App-V with coexisting versions of Office](#bkmk-plan-coexisting) - -- [How Office integrates with Windows when you deploy use App-V to deploy Office](#bkmk-office-integration-win) - -## App-V support for Language Packs - - -You can use the App-V 5.0 Sequencer to create plug-in packages for Language Packs, Language Interface Packs, Proofing Tools and ScreenTip Languages. You can then include the plug-in packages in a Connection Group, along with the Office 2013 package that you create by using the Office Deployment Toolkit. The Office applications and the plug-in Language Packs interact seamlessly in the same connection group, just like any other packages that are grouped together in a connection group. - -**Note**   -Microsoft Visio and Microsoft Project do not provide support for the Thai Language Pack. - - - -## Supported versions of Microsoft Office - - -The following table lists the versions of Microsoft Office that App-V supports, methods of Office package creation, supported licensing, and supported deployments. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported Office VersionSupported App-V VersionsPackage CreationSupported LicensingSupported Deployments

          Office 365 ProPlus

          -

          Also supported:

          -
            -
          • Visio Pro for Office 365

          • -
          • Project Pro for Office 365

          • -
            -
          • App-V 5.0

          • -
          • App-V 5.0 SP1

          • -
          • App-V 5.0 SP2

          • -

          Office Deployment Tool

          Subscription

            -
          • Desktop

          • -
          • Personal VDI

          • -
          • Pooled VDI

          • -
          • RDS

          • -

          Office Professional Plus 2013

          -

          Also supported:

          -
            -
          • Visio Professional 2013

          • -
          • Project Professional 2013

          • -
            -
          • App-V 5.0

          • -
          • App-V 5.0 SP1

          • -
          • App-V 5.0 SP2

          • -

          Office Deployment Tool

          Volume Licensing

            -
          • Desktop

          • -
          • Personal VDI

          • -
          • Pooled VDI

          • -
          • RDS

          • -
          - - - -## Planning for using App-V with coexisting versions of Office - - -You can install more than one version of Microsoft Office side by side on the same computer by using “Microsoft Office coexistence.” You can implement Office coexistence with combinations of all major versions of Office and with installation methods, as applicable, by using the Windows Installer-based (MSi) version of Office, Click-to-Run, and App-V 5.0 SP2. However, using Office coexistence is not recommended by Microsoft. - -Microsoft’s recommended best practice is to avoid Office coexistence completely to prevent compatibility issues. However, when you are migrating to a newer version of Office, issues occasionally arise that can’t be resolved immediately, so you can temporarily implement coexistence to help facilitate a faster migration to the latest product version. Using Office coexistence on a long-term basis is never recommended, and your organization should have a plan to fully transition in the immediate future. - -### Before you implement Office coexistence - -Before implementing Office coexistence, review the following Office documentation. Choose the article that corresponds to the newest version of Office for which you plan to implement coexistence. - - ---- - - - - - - - - - - - - - - - - -
          Office versionLink to guidance

          Office 2013

          Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office

          Office 2010

          Information about how to use Office 2010 suites and programs on a computer that is running another version of Office

          - - - -The Office documentation provides extensive guidance on coexistence for Windows Installer-based (MSi) and Click-to-Run installations of Office. This App-V topic on coexistence supplements the Office guidance with information that is more specific to App-V deployments. - -### Supported Office coexistence scenarios - -The following tables summarize the supported coexistence scenarios. They are organized according to the version and deployment method you’re starting with and the version and deployment method you are migrating to. Be sure to fully test all coexistence solutions before deploying them to a production audience. - -**Note**   -Microsoft does not support the use of multiple versions of Office in Windows Server environments that have the Remote Desktop Session Host role service enabled. To run Office coexistence scenarios, you must disable this role service. - - - -### Windows integrations & Office coexistence - -The Windows Installer-based and Click-to-Run Office installation methods integrate with certain points of the underlying Windows operating system. When you use coexistence, common operating system integrations between two Office versions can conflict, causing compatibility and user experience issues. With App-V, you can sequence certain versions of Office to exclude integrations, thereby “isolating” them from the operating system. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Mode in which App-V can sequence this version of Office

          Office 2007

          Always non-integrated. App-V does not offer any operating system integrations with a virtualized version of Office 2007.

          Office 2010

          Integrated and non-integrated mode.

          Office 2013

          Always integrated. Windows operating system integrations cannot be disabled.

          - - - -Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069). - -### Known limitations of Office coexistence scenarios - -The following sections describe some issues that you might encounter when using App-V to implement coexistence with Office. - -### Limitations common to Windows Installer-based/Click-to-Run and App-V Office coexistence scenarios - -The following limitations can occur when you install the following versions of Office on the same computer: - -- Office 2010 by using the Windows Installer-based version - -- Office 2013 by using App-V - -After you publish Office 2013 by using App-V side by side with an earlier version of the Windows Installer-based Office 2010 might also cause the Windows Installer to start. This is because the Windows Installer-based or Click-to-Run version of Office 2010 is trying to automatically register itself to the computer. - -To bypass the auto-registration operation for native Word 2010, follow these steps: - -1. Exit Word 2010. - -2. Start the Registry Editor by doing the following: - - - In Windows 7: Click **Start**, type **regedit** in the Start Search box, and then press Enter. - - - In Windows 8, type **regedit** press Enter on the Start page and then press Enter. - - If you are prompted for an administrator password or for a confirmation, type the password, or click **Continue**. - -3. Locate and then select the following registry subkey: - - ``` syntax - HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options - ``` - -4. On the **Edit** menu, click **New**, and then click **DWORD Value**. - -5. Type **NoReReg**, and then press Enter. - -6. Right-click **NoReReg** and then click **Modify**. - -7. In the **Valuedata** box, type **1**, and then click **OK**. - -8. On the File menu, click **Exit** to close Registry Editor. - -## How Office integrates with Windows when you use App-V to deploy Office - - -When you deploy Office 2013 by using App-V, Office is fully integrated with the operating system, which provides end users with the same features and functionality as Office has when it is deployed without App-V. - -The Office 2013 App-V package supports the following integration points with the Windows operating system: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Extension PointDescription

          Lync meeting Join Plug-in for Firefox and Chrome

          User can join Lync meetings from Firefox and Chrome

          Sent to OneNote Print Driver

          User can print to OneNote

          OneNote Linked Notes

          OneNote Linked Notes

          Send to OneNote Internet Explorer Add-In

          User can send to OneNote from IE

          Firewall Exception for Lync and Outlook

          Firewall Exception for Lync and Outlook

          MAPI Client

          Native apps and add-ins can interact with virtual Outlook through MAPI

          SharePoint Plug-in for Firefox

          User can use SharePoint features in Firefox

          Mail Control Panel Applet

          User gets the mail control panel applet in Outlook

          Primary Interop Assemblies

          Support managed add-ins

          Office Document Cache Handler

          Allows Document Cache for Office applications

          Outlook Protocol Search handler

          User can search in outlook

          Active X Controls:

          For more information on ActiveX controls, refer to ActiveX Control API Reference.

             Groove.SiteClient

          Active X Control

             PortalConnect.PersonalSite

          Active X Control

             SharePoint.openDocuments

          Active X Control

             SharePoint.ExportDatabase

          Active X Control

             SharePoint.SpreadSheetLauncher

          Active X Control

             SharePoint.StssyncHander

          Active X Control

             SharePoint.DragUploadCtl

          Active X Control

             SharePoint.DragDownloadCtl

          Active X Control

             Sharepoint.OpenXMLDocuments

          Active X Control

             Sharepoint.ClipboardCtl

          Active X control

             WinProj.Activator

          Active X Control

             Name.NameCtrl

          Active X Control

             STSUPld.CopyCtl

          Active X Control

             CommunicatorMeetingJoinAx.JoinManager

          Active X Control

             LISTNET.Listnet

          Active X Control

             OneDrive Pro Browser Helper

          Active X Control]

          OneDrive Pro Icon Overlays

          Windows Explorer shell icon overlays when users look at folders OneDrive Pro folders

          Shell extensions

          Shortcuts

          Windows Search

          - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office51.md b/mdop/appv-v5/planning-for-using-app-v-with-office51.md deleted file mode 100644 index cb8f378a54..0000000000 --- a/mdop/appv-v5/planning-for-using-app-v-with-office51.md +++ /dev/null @@ -1,335 +0,0 @@ ---- -title: Planning for Using App-V with Office -description: Planning for Using App-V with Office -author: msfttracyp -ms.assetid: e7a19b43-1746-469f-bad6-8e75cf4b3f67 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 03/16/2017 ---- - - -# Planning for Using App-V with Office - - -Use the following information to plan how to deploy Office by using Microsoft Application Virtualization (App-V) 5.1. This article includes: - -- [App-V support for Language Packs](#bkmk-lang-pack) - -- [Supported versions of Microsoft Office](#bkmk-office-vers-supp-appv) - -- [Planning for using App-V with coexisting versions of Office](#bkmk-plan-coexisting) - -- [How Office integrates with Windows when you deploy use App-V to deploy Office](#bkmk-office-integration-win) - -## App-V support for Language Packs - - -You can use the App-V 5.1 Sequencer to create plug-in packages for Language Packs, Language Interface Packs, Proofing Tools and ScreenTip Languages. You can then include the plug-in packages in a Connection Group, along with the Office 2013 package that you create by using the Office Deployment Toolkit. The Office applications and the plug-in Language Packs interact seamlessly in the same connection group, just like any other packages that are grouped together in a connection group. - ->**Note**   -Microsoft Visio and Microsoft Project do not provide support for the Thai Language Pack. - - - -## Supported versions of Microsoft Office - -See [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click) for a list of supported Office products. ->**Note**  You must use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. You cannot use the App-V Sequencer. - - - -## Planning for using App-V with coexisting versions of Office - - -You can install more than one version of Microsoft Office side by side on the same computer by using “Microsoft Office coexistence.” You can implement Office coexistence with combinations of all major versions of Office and with installation methods, as applicable, by using the Windows Installer-based (MSi) version of Office, Click-to-Run, and App-V 5.1. However, using Office coexistence is not recommended by Microsoft. - -Microsoft’s recommended best practice is to avoid Office coexistence completely to prevent compatibility issues. However, when you are migrating to a newer version of Office, issues occasionally arise that can’t be resolved immediately, so you can temporarily implement coexistence to help facilitate a faster migration to the latest product version. Using Office coexistence on a long-term basis is never recommended, and your organization should have a plan to fully transition in the immediate future. - -### Before you implement Office coexistence - -Before implementing Office coexistence, review the following Office documentation. Choose the article that corresponds to the newest version of Office for which you plan to implement coexistence. - - ---- - - - - - - - - - - - - - - - - -
          Office versionLink to guidance

          Office 2013

          Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office

          Office 2010

          Information about how to use Office 2010 suites and programs on a computer that is running another version of Office

          - - - -The Office documentation provides extensive guidance on coexistence for Windows Installer-based (MSi) and Click-to-Run installations of Office. This App-V topic on coexistence supplements the Office guidance with information that is more specific to App-V deployments. - -### Supported Office coexistence scenarios - -The following tables summarize the supported coexistence scenarios. They are organized according to the version and deployment method you’re starting with and the version and deployment method you are migrating to. Be sure to fully test all coexistence solutions before deploying them to a production audience. - ->**Note**   -Microsoft does not support the use of multiple versions of Office in Windows Server environments that have the Remote Desktop Session Host role service enabled. To run Office coexistence scenarios, you must disable this role service. - - - -### Windows integrations & Office coexistence - -The Windows Installer-based and Click-to-Run Office installation methods integrate with certain points of the underlying Windows operating system. When you use coexistence, common operating system integrations between two Office versions can conflict, causing compatibility and user experience issues. With App-V, you can sequence certain versions of Office to exclude integrations, thereby “isolating” them from the operating system. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Mode in which App-V can sequence this version of Office

          Office 2007

          Always non-integrated. App-V does not offer any operating system integrations with a virtualized version of Office 2007.

          Office 2010

          Integrated and non-integrated mode.

          Office 2013

          Always integrated. Windows operating system integrations cannot be disabled.

          - - - -Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069). - -### Known limitations of Office coexistence scenarios - -The following sections describe some issues that you might encounter when using App-V to implement coexistence with Office. - -### Limitations common to Windows Installer-based/Click-to-Run and App-V Office coexistence scenarios - -The following limitations can occur when you install the following versions of Office on the same computer: - -- Office 2010 by using the Windows Installer-based version - -- Office 2013 by using App-V - -After you publish Office 2013 by using App-V side by side with an earlier version of the Windows Installer-based Office 2010 might also cause the Windows Installer to start. This is because the Windows Installer-based or Click-to-Run version of Office 2010 is trying to automatically register itself to the computer. - -To bypass the auto-registration operation for native Word 2010, follow these steps: - -1. Exit Word 2010. - -2. Start the Registry Editor by doing the following: - - - In Windows 7: Click **Start**, type **regedit** in the Start Search box, and then press Enter. - - - In Windows 8.1 or Windows 10, type **regedit** press Enter on the Start page and then press Enter. - - If you are prompted for an administrator password or for a confirmation, type the password, or click **Continue**. - -3. Locate and then select the following registry subkey: - - ``` syntax - HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options - ``` - -4. On the **Edit** menu, click **New**, and then click **DWORD Value**. - -5. Type **NoReReg**, and then press Enter. - -6. Right-click **NoReReg** and then click **Modify**. - -7. In the **Valuedata** box, type **1**, and then click **OK**. - -8. On the File menu, click **Exit** to close Registry Editor. - -## How Office integrates with Windows when you use App-V to deploy Office - - -When you deploy Office 2013 by using App-V, Office is fully integrated with the operating system, which provides end users with the same features and functionality as Office has when it is deployed without App-V. - -The Office 2013 App-V package supports the following integration points with the Windows operating system: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Extension PointDescription

          Lync meeting Join Plug-in for Firefox and Chrome

          User can join Lync meetings from Firefox and Chrome

          Sent to OneNote Print Driver

          User can print to OneNote

          OneNote Linked Notes

          OneNote Linked Notes

          Send to OneNote Internet Explorer Add-In

          User can send to OneNote from IE

          Firewall Exception for Lync and Outlook

          Firewall Exception for Lync and Outlook

          MAPI Client

          Native apps and add-ins can interact with virtual Outlook through MAPI

          SharePoint Plug-in for Firefox

          User can use SharePoint features in Firefox

          Mail Control Panel Applet

          User gets the mail control panel applet in Outlook

          Primary Interop Assemblies

          Support managed add-ins

          Office Document Cache Handler

          Allows Document Cache for Office applications

          Outlook Protocol Search handler

          User can search in outlook

          Active X Controls:

          For more information on ActiveX controls, refer to ActiveX Control API Reference.

             Groove.SiteClient

          Active X Control

             PortalConnect.PersonalSite

          Active X Control

             SharePoint.openDocuments

          Active X Control

             SharePoint.ExportDatabase

          Active X Control

             SharePoint.SpreadSheetLauncher

          Active X Control

             SharePoint.StssyncHander

          Active X Control

             SharePoint.DragUploadCtl

          Active X Control

             SharePoint.DragDownloadCtl

          Active X Control

             Sharepoint.OpenXMLDocuments

          Active X Control

             Sharepoint.ClipboardCtl

          Active X control

             WinProj.Activator

          Active X Control

             Name.NameCtrl

          Active X Control

             STSUPld.CopyCtl

          Active X Control

             CommunicatorMeetingJoinAx.JoinManager

          Active X Control

             LISTNET.Listnet

          Active X Control

             OneDrive Pro Browser Helper

          Active X Control]

          OneDrive Pro Icon Overlays

          Windows Explorer shell icon overlays when users look at folders OneDrive Pro folders

          Shell extensions

          Shortcuts

          Windows Search

          - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md deleted file mode 100644 index 4b5ea563cd..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System -description: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System -author: msfttracyp -ms.assetid: 8cd3f1fb-b84e-4260-9e72-a14d01e7cadf -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Deploy App-V 5.0 with an Electronic Software Distribution System - - -If you are using an electronic software distribution system to deploy App-V packages, review the following planning considerations. For information about using System Center Configuration Manager to deploy App-V, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816). - -Review the following component and architecture requirements options that apply when you use an ESD to deploy App-V packages: - - ---- - - - - - - - - - - - - - - - - -
          Deployment requirement or optionDescription

          The App-V Management server, Management database, and Publishing server are not required.

          These functions are handled by the implemented ESD solution.

          You can deploy the App-V Reporting server and Reporting database side by side with the ESD.

          The side-by-side deployment lets you to collect data and generate reports.

          -

          If you enable the App-V client to send report information, and you are not using the App-V Reporting server, the reporting data is stored in associated .xml files.

          - -  - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md deleted file mode 100644 index 4a91a19040..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System -description: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System -author: msfttracyp -ms.assetid: c26602c2-5e8d-44e6-90df-adacc593607e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Deploy App-V 5.1 with an Electronic Software Distribution System - - -If you are using an electronic software distribution system to deploy App-V packages, review the following planning considerations. For information about using System Center Configuration Manager to deploy App-V, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816). - -Review the following component and architecture requirements options that apply when you use an ESD to deploy App-V packages: - - ---- - - - - - - - - - - - - - - - - -
          Deployment requirement or optionDescription

          The App-V Management server, Management database, and Publishing server are not required.

          These functions are handled by the implemented ESD solution.

          You can deploy the App-V Reporting server and Reporting database side by side with the ESD.

          The side-by-side deployment lets you to collect data and generate reports.

          -

          If you enable the App-V client to send report information, and you are not using the App-V Reporting server, the reporting data is stored in associated .xml files.

          - -  - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v.md b/mdop/appv-v5/planning-to-deploy-app-v.md deleted file mode 100644 index 832c964236..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Planning to Deploy App-V -description: Planning to Deploy App-V -author: msfttracyp -ms.assetid: 28d3035c-3805-4339-90fc-6c3fd3b1123e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy App-V - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft Application Virtualization (App-V) 5.0. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## App-V 5.0 supported configurations - - -Describes the minimum hardware and operating system requirements for each App-V components. For information about software prerequisites that you must install before you install App-V, see [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) - -## App-V 5.0 capacity planning - - -Describes the available options for scaling your App-V 5.0 deployment. - -[App-V 5.0 Capacity Planning](app-v-50-capacity-planning.md) - -## Planning for high availability with App-V 5.0 - - -Describes the available options for ensuring high availability of App-V 5.0 databases and services. - -[Planning for High Availability with App-V 5.0](planning-for-high-availability-with-app-v-50.md) - -## Planning to Deploy App-V 5.0 with an Electronic Software Distribution System - - -Describes the options and requirements for deploying App-V with an electronic software distribution system. - -[Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md) - -## Planning for the App-V 5.0 Server deployment - - -Describes the planning considerations for the App-V Server components and their functions. - -[Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md) - -## Planning for the App-V 5.0 Sequencer and Client deployment - - -Describes the planning considerations for the App-V Client and for the Sequencer software, which you use to create virtual applications and application packages. - -[Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) - -## Planning for migrating from a previous version of App-V - - -Describes the recommended path for migrating from previous versions of App-V, while ensuring that existing server configurations, packages and clients continue to work in your new App-V environment. - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md) - -## Planning for using App-V with Office - - -Describes the requirements for using App-V with Office and explains the supported scenarios, including information about coexisting versions of Office. - -[Planning for Using App-V with Office](planning-for-using-app-v-with-office.md) - -## Planning to use folder redirection with App-V - - -Explains how folder redirection works with App-V. - -[Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v.md) - -## Other Resources for App-V 5.0 Planning - - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md)[Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v51.md b/mdop/appv-v5/planning-to-deploy-app-v51.md deleted file mode 100644 index 55b4441b42..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v51.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Planning to Deploy App-V -description: Planning to Deploy App-V -author: msfttracyp -ms.assetid: 39cbf981-d9c6-457f-b047-f9046e1a6442 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy App-V - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft Application Virtualization (App-V) 5.1. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## App-V 5.1 supported configurations - - -Describes the minimum hardware and operating system requirements for each App-V components. For information about software prerequisites that you must install before you install App-V, see [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) - -## App-V 5.1 capacity planning - - -Describes the available options for scaling your App-V 5.1 deployment. - -[App-V 5.1 Capacity Planning](app-v-51-capacity-planning.md) - -## Planning for high availability with App-V 5.1 - - -Describes the available options for ensuring high availability of App-V 5.1 databases and services. - -[Planning for High Availability with App-V 5.1](planning-for-high-availability-with-app-v-51.md) - -## Planning to Deploy App-V 5.1 with an Electronic Software Distribution System - - -Describes the options and requirements for deploying App-V with an electronic software distribution system. - -[Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md) - -## Planning for the App-V 5.1 Server deployment - - -Describes the planning considerations for the App-V Server components and their functions. - -[Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md) - -## Planning for the App-V 5.1 Sequencer and Client deployment - - -Describes the planning considerations for the App-V Client and for the Sequencer software, which you use to create virtual applications and application packages. - -[Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md) - -## Planning for migrating from a previous version of App-V - - -Describes the recommended path for migrating from previous versions of App-V, while ensuring that existing server configurations, packages and clients continue to work in your new App-V environment. - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md) - -## Planning for using App-V with Office - - -Describes the requirements for using App-V with Office and explains the supported scenarios, including information about coexisting versions of Office. - -[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md) - -## Planning to use folder redirection with App-V - - -Explains how folder redirection works with App-V. - -[Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v51.md) - -## Other Resources for App-V 5.1 Planning - - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md deleted file mode 100644 index e5be2f3b21..0000000000 --- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: Planning to Use Folder Redirection with App-V -description: Planning to Use Folder Redirection with App-V -author: msfttracyp -ms.assetid: 2a4deeed-fdc0-465c-b88a-3a2fbbf27436 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Use Folder Redirection with App-V - - -App-V 5.0 SP2 supports the use of folder redirection, a feature that enables users and administrators to redirect the path of a folder to a new location. - -This topic contains the following sections: - -- [Requirements for using folder redirection](#bkmk-folder-redir-reqs) - -- [How to configure folder redirection for use with App-V](#bkmk-folder-redir-cfg) - -- [How folder redirection works with App-V](#bkmk-folder-redir-works) - -- [Overview of folder redirection](#bkmk-folder-redir-overview) - -## Requirements and unsupported scenarios for using folder redirection - - - ---- - - - - - - - - - - -

          Requirements

          To use %AppData% folder redirection, you must:

          -
            -
          • Have an App-V package that has an AppData virtual file system (VFS) folder.

          • -
          • Enable folder redirection and redirect users’ folders to a shared folder, typically a network folder.

          • -
          • Roam both or neither of the following:

            -
          • -
          • Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:

            -
              -
            • %AppData% is configured to the desired network location (with or without Offline Files support).

            • -
            • %LocalAppData% is configured to the desired local folder.

            • -
          • -

          Unsupported scenarios

            -
          • Configuring %LocalAppData% as a network drive.

          • -
          • Redirecting the Start menu to a single folder for multiple users.

          • -
          • If roaming AppData (%AppData%) is redirected to a network share that is not available, App-V applications will fail to launch as follows:

            - ---- - - - - - - - - - - - - - - - - -
            App-V versionScenario description

            In App-V 5.0 through App-V 5.0 SP2 plus hotfixes

            This failure will occur regardless of whether Offline Files is enabled.

            In App-V 5.0 SP3

            If the unavailable network share has been enabled for Offline Files, the App-V application will start successfully.

            -

          • -
          - - - -## How to configure folder redirection for use with App-V - - -Folder redirection can be applied to different folders, such as Desktop, My Documents, My Pictures, etc. However, the only folder that impacts the use of App-V applications is the user’s roaming AppData folder (%AppData%). You can apply folder redirection to any other supported folders without impacting App-V. - -## How folder redirection works with App-V - - -The following table describes how folder redirection works when %AppData% is redirected to a network and when you have met the requirements listed earlier in this article. - - ---- - - - - - - - - - - - - - - - - -
          Virtual environment stateAction that occurs

          When the virtual environment starts

          The virtual file system (VFS) AppData folder is mapped to the local AppData folder (%LocalAppData%) instead of to the user’s roaming AppData folder (%AppData%).

          -
            -
          • LocalAppData contains a local cache of the user’s roaming AppData folder for the package in use. The local cache is located under:

            -

            %LocalAppData%\Microsoft\AppV\Client\VFS\PackageGUID\AppData

          • -
          • The latest data from the user’s roaming AppData folder is copied to and replaces the data currently in the local cache.

          • -
          • While the virtual environment is running, data continues to be saved to the local cache. Data is served only out of %LocalAppData% and is not moved or synchronized with %AppData% until the end user shuts down the computer.

          • -
          • Entries to the AppData folder are made using the user context, not the system context.

          • -
          -
          -Note

          The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See Release Notes for App-V 5.0 SP2.

          -
          -
          - -

          When the virtual environment shuts down

          The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under:

          -

          HKCU\Software\Microsoft\AppV\Client\Packages&lt;PACKAGE_GUID>\AppDataTime

          -

          To provide redundancy, App-V 5.0 keeps the three most recent copies of the compressed data under %AppData%.

          - - - -## Overview of folder redirection - - - ---- - - - - - - - - - - - - - - - - - - -

          Purpose

          Enables end users to work with files, which have been redirected to another folder, as if the files still existed on the local drive.

          Description

          Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

          -
            -
          • Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

          • -
          • The new location can be a folder on the local computer or a folder on a shared network.

          • -
          • Folder redirection updates the files immediately, whereas roaming data is typically synchronized when the user logs in or logs off.

          • -

          Usage example

          You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.

          More resources

          Folder redirection overview

          - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md deleted file mode 100644 index b64d421000..0000000000 --- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: Planning to Use Folder Redirection with App-V -description: Planning to Use Folder Redirection with App-V -author: msfttracyp -ms.assetid: 6bea9a8f-a915-4d7d-be67-ef1cca1398ed -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Use Folder Redirection with App-V - - -Microsoft Application Virtualization (App-V) 5.1 supports the use of folder redirection, a feature that enables users and administrators to redirect the path of a folder to a new location. - -This topic contains the following sections: - -- [Requirements for using folder redirection](#bkmk-folder-redir-reqs) - -- [How to configure folder redirection for use with App-V](#bkmk-folder-redir-cfg) - -- [How folder redirection works with App-V](#bkmk-folder-redir-works) - -- [Overview of folder redirection](#bkmk-folder-redir-overview) - -## Requirements and unsupported scenarios for using folder redirection - - - ---- - - - - - - - - - - -

          Requirements

          To use %AppData% folder redirection, you must:

          -
            -
          • Have an App-V package that has an AppData virtual file system (VFS) folder.

          • -
          • Enable folder redirection and redirect users’ folders to a shared folder, typically a network folder.

          • -
          • Roam both or neither of the following:

            -
          • -
          • Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:

            -
              -
            • %AppData% is configured to the desired network location (with or without Offline Files support).

            • -
            • %LocalAppData% is configured to the desired local folder.

            • -
          • -

          Unsupported scenarios

            -
          • Configuring %LocalAppData% as a network drive.

          • -
          • Redirecting the Start menu to a single folder for multiple users.

          • -
          • If roaming AppData (%AppData%) is redirected to a network share that is not available, App-V applications will fail to launch as follows:

            - ---- - - - - - - - - - - - - - - - - -
            App-V versionScenario description

            In App-V 5.0 through App-V 5.0 SP2 plus hotfixes

            This failure will occur regardless of whether Offline Files is enabled.

            In App-V 5.0 SP3 and later

            If the unavailable network share has been enabled for Offline Files, the App-V application will start successfully.

            -

          • -
          - - - -## How to configure folder redirection for use with App-V - - -Folder redirection can be applied to different folders, such as Desktop, My Documents, My Pictures, etc. However, the only folder that impacts the use of App-V applications is the user’s roaming AppData folder (%AppData%). You can apply folder redirection to any other supported folders without impacting App-V. - -## How folder redirection works with App-V - - -The following table describes how folder redirection works when %AppData% is redirected to a network and when you have met the requirements listed earlier in this article. - - ---- - - - - - - - - - - - - - - - - -
          Virtual environment stateAction that occurs

          When the virtual environment starts

          The virtual file system (VFS) AppData folder is mapped to the local AppData folder (%LocalAppData%) instead of to the user’s roaming AppData folder (%AppData%).

          -
            -
          • LocalAppData contains a local cache of the user’s roaming AppData folder for the package in use. The local cache is located under:

            -

            %LocalAppData%\Microsoft\AppV\Client\VFS\PackageGUID\AppData

          • -
          • The latest data from the user’s roaming AppData folder is copied to and replaces the data currently in the local cache.

          • -
          • While the virtual environment is running, data continues to be saved to the local cache. Data is served only out of %LocalAppData% and is not moved or synchronized with %AppData% until the end user shuts down the computer.

          • -
          • Entries to the AppData folder are made using the user context, not the system context.

          • -
          -
          -Note

          The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See Release Notes for App-V 5.0 SP2.

          -
          -
          - -

          When the virtual environment shuts down

          The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under:

          -

          HKCU\Software\Microsoft\AppV\Client\Packages&lt;PACKAGE_GUID>\AppDataTime

          -

          To provide redundancy, App-V keeps the three most recent copies of the compressed data under %AppData%.

          - - - -## Overview of folder redirection - - - ---- - - - - - - - - - - - - - - - - - - -

          Purpose

          Enables end users to work with files, which have been redirected to another folder, as if the files still existed on the local drive.

          Description

          Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

          -
            -
          • Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

          • -
          • The new location can be a folder on the local computer or a folder on a shared network.

          • -
          • Folder redirection updates the files immediately, whereas roaming data is typically synchronized when the user logs in or logs off.

          • -

          Usage example

          You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.

          More resources

          Folder redirection overview

          - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md b/mdop/appv-v5/preparing-your-environment-for-app-v-50.md deleted file mode 100644 index f20ba14b11..0000000000 --- a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Preparing Your Environment for App-V 5.0 -description: Preparing Your Environment for App-V 5.0 -author: msfttracyp -ms.assetid: 119d990e-a6c6-47b7-a7b0-52f88205e5ec -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing Your Environment for App-V 5.0 - - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements.” - -## App-V 5.0 prerequisites - - -- [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) - - Lists the prerequisite software that you must install before installing App-V 5.0. - -## App-V 5.0 SP3 prerequisites - - -- [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) - - Lists the prerequisite software that you must install before installing App-V 5.0 SP3. - -## App-V 5.0 security considerations - - -- [App-V 5.0 Security Considerations](app-v-50-security-considerations.md) - - Describes accounts, groups, log files, and other considerations for securing your App-V environment. - - - - - - -## Other resources for App-V 5.0 Planning - - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md b/mdop/appv-v5/preparing-your-environment-for-app-v-51.md deleted file mode 100644 index 3cef8f78e3..0000000000 --- a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Preparing Your Environment for App-V 5.1 -description: Preparing Your Environment for App-V 5.1 -author: msfttracyp -ms.assetid: 64b2e1ac-1561-4c99-9815-b4688a0ff48a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing Your Environment for App-V 5.1 - - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan for Microsoft Application Virtualization (App-V) 5.1. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## App-V 5.1 prerequisites - - -- [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) - - Lists the prerequisite software that you must install before installing App-V 5.1. - -## App-V 5.1 security considerations - - -- [App-V 5.1 Security Considerations](app-v-51-security-considerations.md) - - Describes accounts, groups, log files, and other considerations for securing your App-V environment. - - - - - - -## Other resources for App-V 5.1 Planning - - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md b/mdop/appv-v5/release-notes-for-app-v-50-sp1.md deleted file mode 100644 index 2437a3abaa..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Release Notes for App-V 5.0 SP1 -description: Release Notes for App-V 5.0 SP1 -author: msfttracyp -ms.assetid: 21a859cd-41b4-4cc4-9c9c-7ba236084bb0 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for App-V 5.0 SP1 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install App-V 5.0 SP1. - -These release notes contain information that is required to successfully install App-V 5.0 SP1. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other App-V 5.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about App-V 5.0 documentation, see the App-V 5.0 home page on Microsoft TechNet. - -## Provide Feedback - - -We are interested in your feedback on App-V 5.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with App-V 5.0 SP1 - - -There are no App-V 5.0 SP1 release notes at this time.  This topic will be updated if issues are reported in future. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md b/mdop/appv-v5/release-notes-for-app-v-50-sp2.md deleted file mode 100644 index 5f24db040f..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md +++ /dev/null @@ -1,170 +0,0 @@ ---- -title: Release Notes for App-V 5.0 SP2 -description: Release Notes for App-V 5.0 SP2 -author: msfttracyp -ms.assetid: fe73139d-240c-4ed5-8e59-6ae76ee8e80c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for App-V 5.0 SP2 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install App-V 5.0 SP2. - -These release notes contain information that is required to successfully install App-V 5.0 SP2. The release notes also contain information that is not available in the product documentation. If there are differences between these release notes and other App-V 5.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about App-V 5.0 documentation, see the App-V 5.0 home page on Microsoft TechNet. - -## Provide Feedback - - -We are interested in your feedback on App-V 5.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with Hotfix Package 4 for Application Virtualization 5.0 SP2 - - -### Packages stop working after you uninstall Hotfix Package 4 for Application Virtualization 5.0 SP2 - -Packages published when Hotfix Package 4 for Application Virtualization 5.0 SP2 is applied stop working when Hotfix Package 4 for Application Virtualization 5.0 SP2 is removed. - -WORKAROUND: - -If the following folder exists, then you must delete it: - -**%localappdata%** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **VFS** \\ **<package ID>** for each package that was published. - -**Note**   -You must have elevated privileges to delete this folder. - - - -To use a script, for each user account on the computer and for each package id that was published after installing Hotfix Package 4 for Application Virtualization 5.0 SP2: - -`Rd /s /q “%systemdrive%\users\[UserName]\AppData\Local\Microsoft\AppV\Client\VFS\[Package ID]` - -- The shortcuts will remain with the user sessions even after deleting the folder from the directory in the previous section, so you can click on the shortcut to run the application again. There is no need to re-publish the application. - -- This issue happens for both user published packaged and globally published packages for example, Microsoft Office 2013. The folder must be deleted for both types of packages. - -- You do not need to delete the VFS folder in the Roaming app data (**%appdata%**). Only the **%localappdata%** must be deleted. - -### Microsoft Office integration points to wrong file system location - -Microsoft Office integration points to wrong file system location (Groove.exe error message). - -WORKAROUND: - -Use one of the following methods: - -1. Delete the shortcut in the start-up folder after upgrade. - -2. Change the shortcut in the start-up folder using a script. - -3. Use the deployment configuration file to specify the shortcut target to the integration root. - -### Hotfix Package 4 for Application Virtualization 5.0 SP2 installer can take a long time - -The Hotfix Package 4 for Application Virtualization 5.0 SP2 installer can potentially take a long time depending on how many files are stored in the existing package cache. - -Updating associated package security descriptors during the Hotfix Package 4 for Application Virtualization 5.0 SP2 installation has a significant impact on how long it takes the installation will take. Previously, the installation install was standard in duration. However, it now depends on how many files you have staged in the package cache. - -WORKAROUND: None - -### Uninstalling Hotfix Package 4 for Application Virtualization 5.0 SP2 fails if JIT-V package is in use - -If you install Hotfix Package 4 for Application Virtualization 5.0 SP2 and then try to uninstall the hotfix when just-in-time virtualization (JIT-V) is being used, the operation will fail if all of the following conditions are true: - -- You installed by using a Windows Installer file (.msi), and then you apply updates by using a Microsoft Installer Patch File (.msp). - -- You try to uninstall an update by using the Add or Remove Programs item in Control Panel. - -- A JIT-V-enabled package is running on the computer. - -WORKAROUND: Complete the following steps: - -1. Open Windows PowerShell and run the following commands: - - - **Import-module appvclient** - - - **Get-AppvClientPackage | Stop-AppvClientPackage** - -2. Uninstall the update using Add or Remove Programs. - -## Known Issues with App-V 5.0 SP2 - - -### App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData% - -When %AppData% is a shared network folder that you have configured for folder redirection, the changes that end users make to AppData (Roaming) can be lost when they switch computers or when their local AppData is cleared when they log off and then log back on. This error occurs because the registry key (AppDataTime), which indicates the last known upload, gets out of synchronization with the local cached AppData. - -WORKAROUND: Manually delete the following registry key for each relevant package when an end user logs on or off: - -``` syntax -HKCU\Software\Microsoft\AppV\Client\Packages\\AppDataTime -``` - -The first time that end users start an application in the package after they log in, App-V forces a download of the zipped %AppData%, even if %LocalAppData% is already up to date. - -### App-V 5.0 Service Pack 2 (App-V 5.0 SP2) does not include a new version of the App-V Server - -App-V 5.0 SP2 does not include a new version of the App-V Server. If you deploy App-V 5.0 SP2 clients running Windows 8.1 in your environment and plan to manage the clients using the App-V infrastructure, you must install [Hotfix Package 2 for Microsoft Application Virtualization 5.0 Service Pack 1](https://go.microsoft.com/fwlink/?LinkId=386634). (https://go.microsoft.com/fwlink/?LinkId=386634) - -If you are running and managing App-V 5.0 SP2 clients using any of the following methods no client update is required: - -- Standalone mode. - -- Configuration Manager. - -- Third party ESD. - -The App-V 5.0 SP2 client is fully compatible with Windows 8.1 - -WORKAROUND: None. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - - - - - - -## Related topics - - -[About App-V 5.0 SP2](about-app-v-50-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md deleted file mode 100644 index a00754bd10..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Release Notes for App-V 5.0 SP3 -description: Release Notes for App-V 5.0 SP3 -author: msfttracyp -ms.assetid: bc4806e0-2aba-4c7b-9ecc-1b2cc54af1d0 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for App-V 5.0 SP3 - - -The following are known issues in Microsoft Application Virtualization (App-V) 5.0 SP3. - -## Server files fail to get deleted after a new App-V 5.0 SP3 Server installation - - -If you uninstall the App-V 5.0 SP1 Server and then install the App-V 5.0 SP3 Server, the installation fails and the wrong version of the Management server is installed. The following errors are displayed: - -`[0A5C:06F8][2014-09-12T19:08:00]i102: Detected related bundle: {bee44f0f-05be-48e4-81dd-d34a83600b95}, type: Upgrade, scope: PerMachine, version: 5.0.1218.0, operation: MajorUpgrade``[0A5C:06F8][2014-09-12T19:08:00]i000: AppvUX: A previous version of this product is installed; requesting upgrade.``[0A5C:06F8][2014-09-12T19:08:00]i102: Detected related bundle: {e1ca9d65-0ebf-4fd5-98e5-00d6453967a4}, type: Upgrade, scope: PerMachine, version: 5.0.1224.0, operation: MajorUpgrade``[0A5C:06F8][2014-09-12T19:08:00]i000: AppvUX: A previous version of this product is installed; requesting upgrade.` - -The issue occurs because the Server files are not being deleted when you uninstall App-V 5.0 SP1, so the App-V 5.0 SP3 installation process erroneously does an upgrade instead of a new installation. - -**Workaround**: Delete the following registry key before you start installing App-V 5.0 SP3: - -`HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall` - -## Querying AD DS can cause some applications to work incorrectly - - -When you receive updated packages by querying Active Directory Domain Services for updated group memberships, it can cause some applications to work incorrectly if the applications depend on the user’s access token. In addition, frequent group membership queries can cause the domain controller to overload. For more information about user access tokens, see [Access Tokens](https://msdn.microsoft.com/library/windows/desktop/aa374909.aspx). - -**Workaround**: Wait until the user logs off and then logs back on before you query for updated group memberships. Do not use the registry key, described in [Hotfix Package 2 for Microsoft Application Virtualization 5.0 Service Pack 1](https://support.microsoft.com/kb/2897087), to query for updated group memberships. - - - - - - -## Related topics - - -[About App-V 5.0 SP3](about-app-v-50-sp3.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50.md b/mdop/appv-v5/release-notes-for-app-v-50.md deleted file mode 100644 index 4e86811e9d..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Release Notes for App-V 5.0 -description: Release Notes for App-V 5.0 -author: msfttracyp -ms.assetid: 68a6a5a1-4b3c-4c09-b00c-9ca4237695d5 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for App-V 5.0 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install App-V 5.0. - -These release notes contain information that is required to successfully install App-V 5.0. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other App-V 5.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about App-V 5.0 documentation, see the App-V 5.0 home page on Microsoft TechNet. - -## Provide Feedback - - -We are interested in your feedback on App-V 5.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with App-V 5.0 - - -This section contains release notes about the known issues with App-V 5.0. - -### Unable to terminate adding packages when using server PowerShell cmdlets - -When you add a package using PowerShell, there is no method to exit adding new packages. - -WORKAROUND: To stop adding packages, press **enter** after you have added the final package. - -### App-V 5.0 client rejects packages from servers whose SSL certificate has been revoked - -When using the HTTPS protocol, the App-V 5.0 client will by default reject packages from servers whose SSL certificate has been revoked. This behavior can be turned off through configuration by modifying the **VerifyCertificateRevocationList** setting. Applying new configuration for this setting will not take effect until the App-V 5.0 service is restarted. - -WORKAROUND: Restart the App-V 5.0 service. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-51.md b/mdop/appv-v5/release-notes-for-app-v-51.md deleted file mode 100644 index 4f937ae374..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-51.md +++ /dev/null @@ -1,205 +0,0 @@ ---- -title: Release Notes for App-V 5.1 -description: Release Notes for App-V 5.1 -author: msfttracyp -ms.assetid: 62c5be3b-0a46-4512-93ed-97c23184f343 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 09/26/2016 ---- - - -# Release Notes for App-V 5.1 - - -The following are known issues in Microsoft Application Virtualization (App-V) 5.1. - -## Error occurs during publishing refresh between App-V 5.0 SP3 Management Server and App-V 5.1 Client on Windows 10 - - -An error is generated during publishing refresh when synchronizing packages from the App-V 5.0 SP3 management server to an App-V 5.1 client on Windows 10 . This error occurs because the App-V 5.0 SP3 server does not understand the Windows 10 operating system that is specified in the publishing URL. The issue is fixed for App-V 5.1 publishing server, but is not backported to versions of App-V 5.0 SP3 or earlier. - -**Workaround**: Upgrade the App-V 5.0 Management server to the App-V 5.1 Management server for Windows 10 Clients. - -## Custom configurations do not get applied for packages that will be published globally if they are set using the App-V 5.1 Server - - -If you assign a package to an AD group that contains machine accounts and apply a custom configuration to that group using the App-V Server, the custom configuration will not be applied to those machines. The App-V 5.1 Client will publish packages assigned to a machine account globally. However, it stores custom configuration files per user in each user’s profile. Globally published packages will not have access to this custom configuration. - -**Workaround**: Do one of the following: - -- Assign the package to groups containing only user accounts. This will ensure that the package’s custom configuration will be stored in each user’s profile and will be applied correctly. - -- Create a custom deployment configuration file and apply it to the package on the client using the Add-AppvClientPackage cmdlet with the –DynamicDeploymentConfiguration parameter. See [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) for more information. - -- Create a new package with the custom configuration using the App-V 5.1 Sequencer. - -## Server files not deleted after new App-V 5.1 Server installation - - -If you uninstall the App-V 5.0 SP1 Server and then install the App-V 5.1 Server, the installation fails, the wrong version of the Management server is installed, and an error message is returned. The issue occurs because the Server files are not being deleted when you uninstall App-V 5.0 SP1, so the installation process does an upgrade instead of a new installation. - -**Workaround**: Delete this registry key before you start installing App-V 5.1: - -Under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall, locate and delete the installation GUID key that contains the DWORD value "DisplayName" with value data "Microsoft Application Virtualization (App-V) Server". This is the only key that should be deleted. - -## File type associations added manually are not saved correctly - - -File type associations added to an application package manually using the Shortcuts and FTAs tab at the end of the application upgrade wizard are not saved correctly. They will not be available to the App-V Client or to the Sequencer when updating the saved package again. - -**Workaround**: To add a file type association, open the package for modification and run the update wizard. During the Installation step, add the new file type association through the operating system. The sequencer will detect the new association in the system registry and add it to the package’s virtual registry, where it will be available to the client. - -## When streaming packages in Shared Content Store (SCS) mode to a client that is also managed with AppLocker, additional data is written to the local disk. - - -To decrease the amount of data written to a client’s local disk, you can enable SCS mode on the App-V 5.1 Client to stream the contents of a package on demand. However, if AppLocker manages an application within the package, some data might be written to the client’s local disk that would not otherwise be written. - -**Workaround**: None - -## In the Management Console Add Package dialog box, the Browse button is not available when using Chrome or Firefox - - -On the Packages page of the Management Console, if you click **Add or Upgrade** in the lower-right corner, the **Add Package** dialog box appears. If you are accessing the Management Console using Chrome or Firefox as your browser, you will not be able to browse to the location of the package. - -**Workaround**: Type or copy and paste the path to the package into the **Add Package** input field. If the Management Console has access to this path, you will be able to add the package. If the package is on a network share, you can browse to the location using File Explorer by doing these steps: - -1. While pressing **Shift**, right-click on the package file - -2. Select **Copy as path** - -3. Paste the path into the **Add Package** dialog box input field - -## Upgrading App-V Management Server to 5.1 sometimes fails with the message “A database error occurred” - - -If you install the App-V 5.0 SP1 Management Server, and then try to upgrade to App-V 5.1 Server when multiple connection groups are configured and enabled, the following error is displayed: “A database error occurred. Reason: 'Invalid column name 'PackageOptional'. Invalid column name 'VersionOptional'.” - -**Workaround**: Run this command on your SQL database: - -`ALTER TABLE AppVManagement.dbo.PackageGroupMembers ADD PackageOptional bit NOT NULL DEFAULT 0, VersionOptional bit NOT NULL DEFAULT 0` - -where “AppVManagement” is the name of the database. - -## Users cannot open a package in a user-published connection group if you add or remove an optional package - - -In environments that are running the RDS Client or that have multiple concurrent users per computer, logged-in users cannot open applications in packages that are in a user-published connection group if an optional package is added to or removed from the connection group. - -**Workaround**: Have users log out and then log back in. - -## Error message is erroneously displayed when the connection group is published only to the user - - -When you run Repair-AppvClientConnectionGroup, the following error is displayed, even when the connection group is published only to the user: “Internal App-V Integration error: Package not integrated for the user. Please ensure that the package is added to the machine and published to the user.” - -**Workaround**: Do one of the following: - -- Publish all packages in a connection group. - - The problem arises when the connection group being repaired has packages that are missing or not available to the user (that is, not published globally or to the user). However, the repair will work if all of the connection group’s packages are available, so ensure that all packages are published. - -- Repair packages individually using the Repair-AppvClientPackage command rather than the Repair-AppvClientConnectionGroup command. - - Determine which packages are available to users and then run the Repair-AppvClientPackage command once for each package. Use PowerShell cmdlets to do the following: - - 1. Get all the packages in a connection group. - - 2. Check to see if each package is currently published. - - 3. If the package is currently published, run Repair-AppvClientPackage on that package. - -## Icons not displayed properly in Sequencer - - -Icons in the Shortcuts and File Type Associations tab are not displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons are not 16x16 or 32x32. - -**Workaround**: Only use icons that are 16x16 or 32x32. - -## InsertVersionInfo.sql script no longer required for the Management Database - - -The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. - -The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). - -**Important**   -**Step 1** is not required for versions of App-V later than App-V 5.0 SP3. - - - -## Microsoft Visual Studio 2012 not supported - - -App-V 5.1 does not support Visual Studio 2012. - -**Workaround**: None - -## Application filename restrictions for App-V 5.x Sequencer - - -The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -**Workaround**: Use a different filename - -## Intermittent "File Not Found" error when Mounting a Package - - -Occasionally when mounting a package, a "File Not Found" (0x80070002) error is generated. Typically, this occurs when a folder in an App-V package contains many files ( i.e. 20K or more). This can cause streaming to take longer than expected and to time out which generates the "File Not Found" error. - -**Workaround**: Starting with HF06, a new registry key has been introduced to enable extending this time-out period. - - ---- - - - - - - - - - - - - - - - - - - - - - - -
          PathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Streaming
          SettingStreamResponseWaitTimeout
          DataTypeDWORD
          UnitsSeconds
          Default5
          -Note: this value is the default if the registry key is not defined or a value <=5 is specified. -
          - - - - - - -## Related topics - - -[About App-V 5.1](about-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md deleted file mode 100644 index 8fb9c2b17a..0000000000 --- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: msfttracyp -ms.assetid: a8affa46-f1f7-416c-8125-9595cfbfdbc7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - - -You can run a locally installed application in a virtual environment, alongside applications that have been virtualized by using Microsoft Application Virtualization (App-V). You might want to do this if you: - -- Want to install and run an application locally on client computers, but want to virtualize and run specific plug-ins that work with that local application. - -- Are troubleshooting an App-V client package and want to open a local application within the App-V virtual environment. - -Use any of the following methods to open a local application inside the App-V virtual environment: - -- [RunVirtual registry key](#bkmk-runvirtual-regkey) - -- [Get-AppvClientPackage PowerShell cmdlet](#bkmk-get-appvclientpackage-posh) - -- [Command line switch /appvpid:<PID>](#bkmk-cl-switch-appvpid) - -- [Command line hook switch /appvve:<GUID>](#bkmk-cl-hook-switch-appvve) - -Each method accomplishes essentially the same task, but some methods may be better suited for some applications than others, depending on whether the virtualized application is already running. - -## RunVirtual registry key - - -To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. - -There is no Group Policy setting available to manage this registry key, so you have to use System Center Configuration Manager or another electronic software distribution (ESD) system, or manually edit the registry. - -### Supported methods of publishing packages when using RunVirtual - - ---- - - - - - - - - - - - - - - - - -
          App-V versionSupported publishing methods

          App-V 5.0 SP3

          Published globally or to the user

          App-V 5.0 through App-V 5.0 SP2

          Published globally only

          - - - -### Steps to create the subkey - -1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Package publishing methodWhere to create the registry key

          Published globally

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual

          -

          Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

          Published to the user

          HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual

          -

          Example: HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

          Connection group can contain:

          -
            -
          • Packages that are published just globally or just to the user

          • -
          • Packages that are published globally and to the user

          • -

          Either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER key, but all of the following must be true:

          -
            -
          • If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group.

          • -
          • Create only one subkey for one of the packages in the connection group. If, for example, you have one package that is published globally, and another package that is published to the user, you create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment.

          • -
          • The key under which you create the subkey must match the publishing method you used for the package.

            -

            For example, if you published the package to the user, you must create the subkey under HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual.

          • -
          - - - -2. Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore. - - **Syntax**: <PackageId>\_<VersionId> - - **Example**: 4c909996-afc9-4352-b606-0b74542a09c1\_be463724-Oct1-48f1-8604-c4bd7ca92fa - - The application in the previous example would produce a registry export file (.reg file) like the following: - - ``` syntax - Windows Registry Editor Version 5.00 - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual] - @="" - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe] - @="aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-555555555 - ``` - -## Get-AppvClientPackage PowerShell cmdlet - - -You can use the **Start-AppVVirtualProcess** cmdlet to retrieve the package name and then start a process within the specified package's virtual environment. This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - -Use the following example syntax, and substitute the name of your package for **<Package>**: - -`$AppVName = Get-AppvClientPackage ` - -`Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe` - -If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -## Command line switch /appvpid:<PID> - - -You can apply the **/appvpid:<PID>** switch to any command, which enables that command to run within a virtual process that you select by specifying its process ID (PID). Using this method launches the new executable in the same App-V environment as an executable that is already running. - -Example: `cmd.exe /appvpid:8108` - -To find the process ID (PID) of your App-V process, run the command **tasklist.exe** from an elevated command prompt. - -## Command line hook switch /appvve:<GUID> - - -This switch lets you run a local command within the virtual environment of an App-V package. Unlike the **/appvid** switch, where the virtual environment must already be running, this switch enables you to start the virtual environment. - -Syntax: `cmd.exe /appvve:` - -Example: `cmd.exe /appvve:aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-55555555` - -To get the package GUID and version GUID of your application, run the **Get-AppvClientPackage** cmdlet. Concatenate the **/appvve** switch with the following: - -- A colon - -- Package GUID of the desired package - -- An underscore - -- Version ID of the desired package - -If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md deleted file mode 100644 index 147684b66e..0000000000 --- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: msfttracyp -ms.assetid: 71baf193-a9e8-4ffa-aa7f-e0bffed2e4b2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - - -You can run a locally installed application in a virtual environment, alongside applications that have been virtualized by using Microsoft Application Virtualization (App-V). You might want to do this if you: - -- Want to install and run an application locally on client computers, but want to virtualize and run specific plug-ins that work with that local application. - -- Are troubleshooting an App-V client package and want to open a local application within the App-V virtual environment. - -Use any of the following methods to open a local application inside the App-V virtual environment: - -- [RunVirtual registry key](#bkmk-runvirtual-regkey) - -- [Get-AppvClientPackage PowerShell cmdlet](#bkmk-get-appvclientpackage-posh) - -- [Command line switch /appvpid:<PID>](#bkmk-cl-switch-appvpid) - -- [Command line hook switch /appvve:<GUID>](#bkmk-cl-hook-switch-appvve) - -Each method accomplishes essentially the same task, but some methods may be better suited for some applications than others, depending on whether the virtualized application is already running. - -## RunVirtual registry key - - -To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. - -There is no Group Policy setting available to manage this registry key, so you have to use System Center Configuration Manager or another electronic software distribution (ESD) system, or manually edit the registry. - -### Supported methods of publishing packages when using RunVirtual - - ---- - - - - - - - - - - - - - - - - -
          App-V versionSupported publishing methods

          App-V 5.0 SP3 and App-V 5.1

          Published globally or to the user

          App-V 5.0 through App-V 5.0 SP2

          Published globally only

          - - - -### Steps to create the subkey - -1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Package publishing methodWhere to create the registry key

          Published globally

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual

          -

          Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

          Published to the user

          HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual

          -

          Example: HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

          Connection group can contain:

          -
            -
          • Packages that are published just globally or just to the user

          • -
          • Packages that are published globally and to the user

          • -

          Either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER key, but all of the following must be true:

          -
            -
          • If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group.

          • -
          • Create only one subkey for one of the packages in the connection group. If, for example, you have one package that is published globally, and another package that is published to the user, you create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment.

          • -
          • The key under which you create the subkey must match the publishing method you used for the package.

            -

            For example, if you published the package to the user, you must create the subkey under HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual.

          • -
          - - - -2. Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore. - - **Syntax**: <PackageId>\_<VersionId> - - **Example**: 4c909996-afc9-4352-b606-0b74542a09c1\_be463724-Oct1-48f1-8604-c4bd7ca92fa - - The application in the previous example would produce a registry export file (.reg file) like the following: - - ``` syntax - Windows Registry Editor Version 5.00 - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual] - @="" - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe] - @="aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-555555555 - ``` - -## Get-AppvClientPackage PowerShell cmdlet - - -You can use the **Start-AppVVirtualProcess** cmdlet to retrieve the package name and then start a process within the specified package's virtual environment. This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - -Use the following example syntax, and substitute the name of your package for **<Package>**: - -`$AppVName = Get-AppvClientPackage ` - -`Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe` - -If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -## Command line switch /appvpid:<PID> - - -You can apply the **/appvpid:<PID>** switch to any command, which enables that command to run within a virtual process that you select by specifying its process ID (PID). Using this method launches the new executable in the same App-V environment as an executable that is already running. - -Example: `cmd.exe /appvpid:8108` - -To find the process ID (PID) of your App-V process, run the command **tasklist.exe** from an elevated command prompt. - -## Command line hook switch /appvve:<GUID> - - -This switch lets you run a local command within the virtual environment of an App-V package. Unlike the **/appvid** switch, where the virtual environment must already be running, this switch enables you to start the virtual environment. - -Syntax: `cmd.exe /appvve:` - -Example: `cmd.exe /appvve:aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-55555555` - -To get the package GUID and version GUID of your application, run the **Get-AppvClientPackage** cmdlet. Concatenate the **/appvve** switch with the following: - -- A colon - -- Package GUID of the desired package - -- An underscore - -- Version ID of the desired package - -If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/technical-reference-for-app-v-50.md b/mdop/appv-v5/technical-reference-for-app-v-50.md deleted file mode 100644 index 27f47f513c..0000000000 --- a/mdop/appv-v5/technical-reference-for-app-v-50.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Technical Reference for App-V 5.0 -description: Technical Reference for App-V 5.0 -author: msfttracyp -ms.assetid: aa899158-41e8-47d3-882c-8c5b96018308 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for App-V 5.0 - - -This section provides reference information related to managing App-V 5.0. - -## In This Section - - -- [Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) - - Provides strategy and context for a number of performance optimization practices. Not all practices will be applicable although they are supported and have been tested. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. - -- [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md) - - Describes how the following App-V client operations affect the local operating system: App-V files and data storage locations, package registry, package store behavior, roaming registry and data, client application lifecycle management, integration of App-V packages, dynamic configuration, side-by-side assemblies, and client logging. - - - - - - -## Related topics - - -[Creating App-V 4.5 Databases Using SQL Scripting](../solutions/creating-app-v-45-databases-using-sql-scripting.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/technical-reference-for-app-v-51.md b/mdop/appv-v5/technical-reference-for-app-v-51.md deleted file mode 100644 index 7920671469..0000000000 --- a/mdop/appv-v5/technical-reference-for-app-v-51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Technical Reference for App-V 5.1 -description: Technical Reference for App-V 5.1 -author: msfttracyp -ms.assetid: 2b9e8b2b-4cd1-46f3-ba08-e3bc8d5c6127 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for App-V 5.1 - - -This section provides reference information related to managing App-V 5.1. - -## In This Section - - -- [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) - - Provides strategy and context for a number of performance optimization practices. Not all practices will be applicable although they are supported and have been tested. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. - -- [Application Publishing and Client Interaction](application-publishing-and-client-interaction51.md) - - Describes how the following App-V client operations affect the local operating system: App-V files and data storage locations, package registry, package store behavior, roaming registry and data, client application lifecycle management, integration of App-V packages, dynamic configuration, side-by-side assemblies, and client logging. - - - - - - -## Related topics - - -[Creating App-V 4.5 Databases Using SQL Scripting](../solutions/creating-app-v-45-databases-using-sql-scripting.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/troubleshooting-app-v-50.md b/mdop/appv-v5/troubleshooting-app-v-50.md deleted file mode 100644 index 4ec64fd490..0000000000 --- a/mdop/appv-v5/troubleshooting-app-v-50.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Troubleshooting App-V 5.0 -description: Troubleshooting App-V 5.0 -author: msfttracyp -ms.assetid: a713b345-25b7-4cdf-ba55-66df672a1f3a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting App-V 5.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting App-V 5.0 - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/troubleshooting-app-v-51.md b/mdop/appv-v5/troubleshooting-app-v-51.md deleted file mode 100644 index f9c03ad8f8..0000000000 --- a/mdop/appv-v5/troubleshooting-app-v-51.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Troubleshooting App-V 5.1 -description: Troubleshooting App-V 5.1 -author: msfttracyp -ms.assetid: 435d0e56-0aa2-4168-b5a7-2f03a1f273d4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting App-V 5.1 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting App-V 5.1 - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/using-the-app-v-50-client-management-console.md b/mdop/appv-v5/using-the-app-v-50-client-management-console.md deleted file mode 100644 index bc2bbc0a7d..0000000000 --- a/mdop/appv-v5/using-the-app-v-50-client-management-console.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Using the App-V 5.0 Client Management Console -description: Using the App-V 5.0 Client Management Console -author: msfttracyp -ms.assetid: 36398307-57dd-40f3-9d4f-b09f44fd37c3 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using the App-V 5.0 Client Management Console - - -This topic provides information about how you can configure and manage the App-V 5.0 client. - -## Modify App-V 5.0 client configuration - - -The App-V 5.0 client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client or by using PowerShell or Group Policy. For more information about how to modify the client using PowerShell or Group Policy configuration see, [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell.md). - -## The App-V 5.0 client management console - - -You can obtain information about the App-V 5.0 client or perform specific tasks by using the App-V 5.0 client management console. Many of the tasks that you can perform in the client management console you can also perform by using PowerShell. The associated PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use PowerShell, see [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md). - -The client management console contains the following described main tabs. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TabDescription

          Overview

          The Overview tab contains the following elements:

          -
            -
          • Update – Use the Update tile to refresh a virtualized application or to receive a new virtualized package.

            -

            The Last Refresh displays the current version of the virtualized package.

          • -
          • Download all virtual applications – Use the Download tile to download all of the packages provisioned to the current user.

            -

            (Associated PowerShell cmdlet: Mount-AppvClientPackage)

            -

          • -
          • Work Offline – Use this tile to disallow all automatic and manual virtual application updates.

            -

            (Associated PowerShell cmdlet: Set-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled)

          • -

          Virtual Apps

          The VIRTUAL APPS tab displays all of the packages that have been published to the user. You can also click a specific package and see all of the applications that are part of that package. This displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads. Additionally, you can repair the user state. A repair will delete all user data that is associated with a package.

          -

          App Connection Groups

          The APP CONNECTION GROUPS tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group.

          -

          (Associated PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.)

          -

          - -  - -[How to Access the Client Management Console](how-to-access-the-client-management-console.md) - -[How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md) - - - - - - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/using-the-app-v-51-client-management-console.md b/mdop/appv-v5/using-the-app-v-51-client-management-console.md deleted file mode 100644 index ec85b78997..0000000000 --- a/mdop/appv-v5/using-the-app-v-51-client-management-console.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Using the App-V 5.1 Client Management Console -description: Using the App-V 5.1 Client Management Console -author: msfttracyp -ms.assetid: be6d4e35-5701-4f9a-ba8a-bede12662cf1 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using the App-V 5.1 Client Management Console - - -This topic provides information about how you can configure and manage the Microsoft Application Virtualization (App-V) 5.1 client. - -## Modify App-V 5.1 client configuration - - -The App-V 5.1 client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client or by using PowerShell or Group Policy. For more information about how to modify the client using PowerShell or Group Policy configuration see, [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell51.md). - -## The App-V 5.1 client management console - - -You can obtain information about the App-V 5.1 client or perform specific tasks by using the App-V 5.1 client management console. Many of the tasks that you can perform in the client management console you can also perform by using PowerShell. The associated PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use PowerShell, see [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md). - -The client management console contains the following described main tabs. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TabDescription

          Overview

          The Overview tab contains the following elements:

          -
            -
          • Update – Use the Update tile to refresh a virtualized application or to receive a new virtualized package.

            -

            The Last Refresh displays the current version of the virtualized package.

          • -
          • Download all virtual applications – Use the Download tile to download all of the packages provisioned to the current user.

            -

            (Associated PowerShell cmdlet: Mount-AppvClientPackage)

            -

          • -
          • Work Offline – Use this tile to disallow all automatic and manual virtual application updates.

            -

            (Associated PowerShell cmdlet: Set-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled)

          • -

          Virtual Apps

          The VIRTUAL APPS tab displays all of the packages that have been published to the user. You can also click a specific package and see all of the applications that are part of that package. This displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads. Additionally, you can repair the user state. A repair will delete all user data that is associated with a package.

          -

          App Connection Groups

          The APP CONNECTION GROUPS tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group.

          -

          (Associated PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.)

          -

          - -  - -[How to Access the Client Management Console](how-to-access-the-client-management-console51.md) - -[How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md) - - - - - - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md deleted file mode 100644 index ab6061698c..0000000000 --- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md +++ /dev/null @@ -1,258 +0,0 @@ ---- -title: Viewing App-V Server Publishing Metadata -description: Viewing App-V Server Publishing Metadata -author: msfttracyp -ms.assetid: 048dd42a-24d4-4cc4-81f6-7a919aadd9b2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing App-V Server Publishing Metadata - - -Use this procedure to view publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. - -This article contains the following information: - -- [App-V 5.0 SP3 requirements for viewing publishing metadata](#bkmk-50sp3-reqs-pub-meta) - -- [Syntax to use for viewing publishing metadata](#bkmk-syntax-view-pub-meta) - -- [Query values for client operating system and version](#bkmk-values-query-pub-meta) - -- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) - -## App-V 5.0 SP3 requirements for viewing publishing metadata - - -In App-V 5.0 SP3, you must provide the following values in the address when you query the App-V Publishing server for metadata: - - ---- - - - - - - - - - - - - - - - - -
          ValueAdditional details

          ClientVersion

          If you omit the ClientVersion parameter from the query, the metadata excludes the new App-V 5.0 SP3 features.

          ClientOS

          You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query.

          -

          If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata.

          - - - -## Query syntax for viewing publishing metadata - - -The following table provides the syntax and query examples. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Version of App-VQuery syntaxParameter descriptionsExample

          App-V 5.0 SP3

          http://<PubServer>:<Publishing Port#>/?ClientVersion=<AppvClientVersion>&ClientOS=<OSStringValue>

          ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          <PubServer>

          Name of the App-V Publishing server.

          <Publishing Port#>

          Port to the App-V Publishing server, which you defined when you configured the Publishing server.

          ClientVersion=<AppvClientVersion>

          Version of the App-V client. Refer to the following table for the correct value to use.

          ClientOS=<OSStringValue>

          Operating system of the computer that is running the App-V client. Refer to the following table for the correct value to use.

          -

          -

          To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet.

          http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64

          -

          In the example:

          -
            -
          • A Windows Server 2012 R2 named “pubsvr01” hosts the Publishing service.

          • -
          • The Windows client is Windows 8.1 64-bit.

          • -

          App-V 5.0 through App-V 5.0 SP2

          http://<PubServer>:<Publishing Port#>/

          -
          -Note

          ClientVersion and ClientOS are supported only in App-V 5.0 SP3.

          -
          -
          - -

          See the information for App-V 5.0 SP3.

          http://pubsvr01:2718

          -

          In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services.

          - - - -## Query values for client operating system and version - - -In your publishing metadata query, enter the string values that correspond to the client operating system and version that you’re using. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemArchitectureOperating string string value

          Windows 8.1

          64-bit

          WindowsClient_6.2_x64

          Windows 8.1

          32-bit

          WindowsClient_6.2_x86

          Windows 8

          64-bit

          WindowsClient_6.2_x64

          Windows 8

          32-bit

          WindowsClient_6.2_x86

          Windows Server 2012 R2

          64-bit

          WindowsServer_6.2_x64

          Windows Server 2012 R2

          32-bit

          WindowsServer_6.2_x86

          Windows Server 2012

          64-bit

          WindowsServer_6.2_x64

          Windows Server 2012

          32-bit

          WindowsServer_6.2_x86

          Windows 7

          64-bit

          WindowsClient_6.1_x64

          Windows 7

          32-bit

          WindowsClient_6.1_x86

          Windows Server 2008 R2

          64-bit

          WindowsServer_6.1_x64

          Windows Server 2008 R2

          32-bit

          WindowsServer_6.1_x86

          - - - -## Definition of publishing metadata - - -When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: - -- Packages and connection groups that are entitled to the client computer. - -- Packages and connection groups that are entitled to the current user. - -The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. - -You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md deleted file mode 100644 index 9d1b578f94..0000000000 --- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md +++ /dev/null @@ -1,268 +0,0 @@ ---- -title: Viewing App-V Server Publishing Metadata -description: Viewing App-V Server Publishing Metadata -author: msfttracyp -ms.assetid: d5fa9eb5-647c-478d-8a4d-0ecda018bce6 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing App-V Server Publishing Metadata - - -Use this procedure to view publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. - -This article contains the following information: - -- [App-V 5.1 requirements for viewing publishing metadata](#bkmk-51-reqs-pub-meta) - -- [Syntax to use for viewing publishing metadata](#bkmk-syntax-view-pub-meta) - -- [Query values for client operating system and version](#bkmk-values-query-pub-meta) - -- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) - -## App-V 5.1 requirements for viewing publishing metadata - - -In App-V 5.1, you must provide the following values in the address when you query the App-V Publishing server for metadata: - - ---- - - - - - - - - - - - - - - - - -
          ValueAdditional details

          ClientVersion

          If you omit the ClientVersion parameter from the query, the metadata excludes the features that were new in App-V 5.0 SP3.

          ClientOS

          You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query.

          -

          If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata.

          - - - -## Query syntax for viewing publishing metadata - - -The following table provides the syntax and query examples. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Version of App-VQuery syntaxParameter descriptionsExample

          App-V 5.0 SP3 and App-V 5.1

          http://<PubServer>:<Publishing Port#>/?ClientVersion=<AppvClientVersion>&ClientOS=<OSStringValue>

          ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          <PubServer>

          Name of the App-V Publishing server.

          <Publishing Port#>

          Port to the App-V Publishing server, which you defined when you configured the Publishing server.

          ClientVersion=<AppvClientVersion>

          Version of the App-V client. Refer to the following table for the correct value to use.

          ClientOS=<OSStringValue>

          Operating system of the computer that is running the App-V client. Refer to the following table for the correct value to use.

          -

          -

          To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet.

          http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64

          -

          In the example:

          -
            -
          • A Windows Server 2012 R2 named “pubsvr01” hosts the Publishing service.

          • -
          • The Windows client is Windows 8.1 64-bit.

          • -

          App-V 5.0 through App-V 5.0 SP2

          http://<PubServer>:<Publishing Port#>/

          -
          -Note

          ClientVersion and ClientOS are supported only in App-V 5.0 SP3 and App-V 5.1.

          -
          -
          - -

          See the information for App-V 5.0 SP3 and App-V 5.1.

          http://pubsvr01:2718

          -

          In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services.

          - - - -## Query values for client operating system and version - - -In your publishing metadata query, enter the string values that correspond to the client operating system and version that you’re using. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemArchitectureOperating string string value

          Windows 10

          64-bit

          WindowsClient_10.0_x64

          Windows 10

          32-bit

          WindowsClient_10.0_x86

          Windows 8.1

          64-bit

          WindowsClient_6.2_x64

          Windows 8.1

          32-bit

          WindowsClient_6.2_x86

          Windows 8

          64-bit

          WindowsClient_6.2_x64

          Windows 8

          32-bit

          WindowsClient_6.2_x86

          Windows Server 2012 R2

          64-bit

          WindowsServer_6.2_x64

          Windows Server 2012 R2

          32-bit

          WindowsServer_6.2_x86

          Windows Server 2012

          64-bit

          WindowsServer_6.2_x64

          Windows Server 2012

          32-bit

          WindowsServer_6.2_x86

          Windows 7

          64-bit

          WindowsClient_6.1_x64

          Windows 7

          32-bit

          WindowsClient_6.1_x86

          Windows Server 2008 R2

          64-bit

          WindowsServer_6.1_x64

          Windows Server 2008 R2

          32-bit

          WindowsServer_6.1_x86

          - - - -## Definition of publishing metadata - - -When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: - -- Packages and connection groups that are entitled to the client computer. - -- Packages and connection groups that are entitled to the current user. - -The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. - -You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md b/mdop/appv-v5/whats-new-in-app-v-50-sp1.md deleted file mode 100644 index 01777e0e36..0000000000 --- a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: What's new in App-V 5.0 SP1 -description: What's new in App-V 5.0 SP1 -author: msfttracyp -ms.assetid: e97c2dbb-7b40-46a0-8137-9ee4fc2bd071 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's new in App-V 5.0 SP1 - - -This section is for users who are already familiar with App-V and want to know what has changed in App-V 5.0 SP1. If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.0](planning-for-app-v-50-rc.md). - -## Changes in Standard Functionality - - -The following sections contain information about the changes in standard functionality for App-V 5.0 SP1. - -### Changes to Supported Languages - -For more information, see [About App-V 5.0 SP1](about-app-v-50-sp1.md). - -The following list contains more information about the new Language Packs: - -- The App-V 5.0 SP1 language packs are bundled into the **appv\_xxx\_setup.exe** installer for all the App-V 5.0 Components. - -- When you run the installer it will automatically install the most appropriate language pack based on the locale of the associated operating system running on the target computer. - -- If additional language packs are required, you must extract these language packs from the installer by running the following command: `appv_xxx_setup.exe /Layout /LayoutDir=””`. After this has been run, the contents of the installer are extracted to the specified location. - -- You must install the desired language pack by applying the appropriate Language pack Windows Installation file. For example, **appv\_hib\_LP\_jmmb\_x86.msi** or **appv\_hib\_LP\_jmmb\_x64.msi**, where **hib** refers to the component and **jmmb** refers to the locale. - -## Enhanced Support for Microsoft Office 2010 - - -**Microsoft Office 2010 Sequencing Kit for Application Virtualization 5.0** – helps provide users with a consistent experience using a virtualized version of Microsoft Office 2010. The **Microsoft Office 2010 Sequencing Kit for Application Virtualization 5.0** is used in conjunction with the **Microsoft Office 2010 Deployment Kit for App-V** and also provides the required Microsoft Office 2010 licensing service. - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/whats-new-in-app-v-50.md b/mdop/appv-v5/whats-new-in-app-v-50.md deleted file mode 100644 index 6f816996a0..0000000000 --- a/mdop/appv-v5/whats-new-in-app-v-50.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: What's New in App-V 5.0 -description: What's New in App-V 5.0 -author: msfttracyp -ms.assetid: 79ff6e02-e926-4803-87d8-248a6b28099d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in App-V 5.0 - - -This section is for users who are already familiar with App-V and want to know what has changed in App-V 5.0 If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.0](planning-for-app-v-50-rc.md). - -## Changes in Standard Functionality - - -The following sections contain information about the changes in standard functionality for App-V 5.0. - -### Changes to Supported Operating Systems - -For more information, see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -## Changes to the sequencer - - -The following sections contain information about the changes in the App-V 5.0 sequencer. - -### Specific change to the sequencer - -The following table displays information about what has changed with the App-V 5.0 sequencer - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Sequencer FeatureApp-V 5.0 Sequencer Functionality

          Reboot processing

          When an application prompts for a restart, you should allow the application to restart the computer running the sequencer. The computer running the sequencer will restart and the sequencer will resume in monitoring mode.

          Specifying the virtual application directory

          Virtual Application Directory is a mandatory parameter. For best results, it should match the installation directory of the application installer. This results in more optimal performance and application compatibility.

          Editing shortcuts/FTAs

          The Shortcuts/FTA page is on the Advanced editing page after the sequencing wizard has completed.

          Change History Tab

          The Change History tab has been removed for App-V 5.0.

          OSD Tab

          The OSD tab has been removed for App-V 5.0.

          Virtual Services Tab

          The virtual services tab has been removed for App-V 5.0.

          Files/Virtual File System Tab

          These tabs are combined and allow you to modify package files.

          Deployment Tab

          There are no longer options to configure the server URL in the packages. You should configure this now using deployment configuration, or the management server.

          Package Converter Tool

          You can now use PowerShell to convert packages created in previous versions.

          Add-on/Middleware

          You can expand parent packages when you are sequencing an Add-On or Middleware application. Add-ons and Middleware packages must be connected using connection groups in App-V 5.0.

          Files output

          The following files are created with App-V 5.0, Windows Installer (.msi), .appv, deployment configuration, user configuration, and the Report.XML.

          Compression/Security descriptors/MSI packages

          Compression and the creation of a Windows Installer (.msi) file are automatic for all packages and you can no longer override security descriptors.

          Tools / Options

          The Diagnostics window has been removed as well as several other settings.

          Installation Drive

          An installation drive is no longer required when you install an application.

          OOS Streaming

          If no stream optimization is performed, packages are stream faulted when they are requested by computers running the App-V 5.0 client until they can launch.

          Q:</p>

          App-V 5.0 uses the native file system and no longer requires a Q:.

          - - - -## Sequencing error detection - - -The App-V 5.0 sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. - -To display more detailed information about an event, double-click the item you want to review in the report. The sequencing issues, as well as suggestions about how to resolve the issues are displayed. Information from the system preparation report and the installation report are summarized when you have finished creating a package. The following list displays the types of issues available in the report: - -- Excluded files. - -- Driver information. - -- COM+ system differences. - -- Side-by-side (SxS) conflicts. - -- Shell Extensions. - -- Information about unsupported services. - -- DCOM. - -## Connection Groups - - -The App-V feature formerly known as **Dynamic Suite Composition** is now referred to as **Connection Groups** in App-V 5.0. For more information about using Connection Groups see [Managing Connection Groups](managing-connection-groups.md). - -## Licensing and Metering Functionality - - -The application and licensing functionality has been removed in App-V 5.0. The actual license positions in your environment depend on the specific software title license and usage rights granted by the associated license terms. - -## File and Application Cache - - -There is no file or application cache available with App-V 5.0. - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - - - - - - - - - diff --git a/mdop/breadcrumb/toc.yml b/mdop/breadcrumb/toc.yml deleted file mode 100644 index 904b8033a1..0000000000 --- a/mdop/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Microsoft Desktop Optimization Pack - tocHref: /microsoft-desktop-optimization-pack - topicHref: /microsoft-desktop-optimization-pack/index \ No newline at end of file diff --git a/mdop/dart-v10/TOC.md b/mdop/dart-v10/TOC.md deleted file mode 100644 index 5f3730e1c6..0000000000 --- a/mdop/dart-v10/TOC.md +++ /dev/null @@ -1,39 +0,0 @@ -# [Diagnostics and Recovery Toolset 10](index.md) -## [Getting Started with DaRT 10](getting-started-with-dart-10.md) -### [About DaRT 10](about-dart-10.md) -#### [Release Notes for DaRT 10](release-notes-for-dart-10.md) -### [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md) -### [Accessibility for DaRT 10](accessibility-for-dart-10.md) -## [Planning for DaRT 10](planning-for-dart-10.md) -### [Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) -#### [DaRT 10 Supported Configurations](dart-10-supported-configurations.md) -#### [Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md) -#### [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md) -### [DaRT 10 Planning Checklist](dart-10-planning-checklist.md) -## [Deploying DaRT 10](deploying-dart-10.md) -### [Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) -#### [How to Deploy DaRT 10](how-to-deploy-dart-10.md) -#### [How to Change, Repair, or Remove DaRT 10](how-to-change-repair-or-remove-dart-10.md) -### [Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) -### [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) -#### [How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md) -#### [How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md) -### [DaRT 10 Deployment Checklist](dart-10-deployment-checklist.md) -## [Operations for DaRT 10](operations-for-dart-10.md) -### [Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) -#### [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md) -#### [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md) -### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) -#### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md) -#### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md) -#### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md) -### [Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) -#### [Security Considerations for DaRT 10](security-considerations-for-dart-10.md) -#### [DaRT 10 Privacy Statement](dart-10-privacy-statement.md) -### [Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) -#### [How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md) -#### [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md) -## [Troubleshooting DaRT 10](troubleshooting-dart-10.md) -# [DaRT 10](dart-10--c--page.md) -# [DaRT 10](dart-10-cover-page.md) - diff --git a/mdop/dart-v10/about-dart-10.md b/mdop/dart-v10/about-dart-10.md deleted file mode 100644 index ad6c4560a0..0000000000 --- a/mdop/dart-v10/about-dart-10.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: About DaRT 10 -description: About DaRT 10 -author: msfttracyp -ms.assetid: 02378035-58d1-4095-82fe-d60734a746fb -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 10 - - -DaRT 10 includes the following enhancements and changes as described in this topic. - -## What’s new - - -- **Support for Windows 10** - - You can create DaRT images by using Windows 10. - - **Note**   - For earlier versions of the Windows operating systems, continue to use the earlier versions of DaRT. - - - -- **Windows Defender** - - Windows Defender is now part of the Windows 10 Preinstallation Environment (PE) image. As a result, Windows Defender has been removed from the DaRT 10 toolset. - -## Requirements - - -- **Windows Assessment and Development Kit 10.0** - - Windows Assessment and Development Kit (ADK) 10.0 is a required prerequisite for the DaRT Recovery Image Wizard. Windows ADK 10.0 contains deployment tools that are used to customize, deploy, and service Windows images. It also contains the Windows Preinstallation Environment (Windows PE). - - **Note**   - Windows ADK 10.0 is not required if you are installing only Remote Connection Viewer or Crash Analyzer. - - - -- **Windows 10 Debugging Tools** - - To use the Crash Analyzer tool in DaRT 10, you need the required debugging tools, which are available in the Software Development Kit for Windows 10. - -## Language availability - - -DaRT 10 is available in the following languages: - -- English (United States) en-US - -- French (France) fr-FR - -- Italian (Italy) it-IT - -- German (Germany) de-DE - -- Spanish, International Sort (Spain) es-ES - -- Korean (Korea) ko-KR - -- Japanese (Japan) ja-JP - -- Portuguese (Brazil) pt-BR - -- Russian (Russia) ru-RU - -- Chinese Traditional zh-TW - -- Chinese Simplified zh-CN - -## How to Get MDOP Technologies - - -DaRT 10 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Release Notes for DaRT 10](release-notes-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/accessibility-for-dart-10.md b/mdop/dart-v10/accessibility-for-dart-10.md deleted file mode 100644 index 7414466c4f..0000000000 --- a/mdop/dart-v10/accessibility-for-dart-10.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for DaRT 10 -description: Accessibility for DaRT 10 -author: msfttracyp -ms.assetid: 61d7a30c-3551-440d-bdcd-36333052c7b4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for DaRT 10 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in alternative formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer service for people with hearing impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For more information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/administering-dart-10-using-powershell.md b/mdop/dart-v10/administering-dart-10-using-powershell.md deleted file mode 100644 index fb6f1d06b6..0000000000 --- a/mdop/dart-v10/administering-dart-10-using-powershell.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Administering DaRT 10 Using PowerShell -description: Administering DaRT 10 Using PowerShell -author: msfttracyp -ms.assetid: eefe992f-077b-4e4b-8a5d-45b451614d7b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering DaRT 10 Using PowerShell - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 lets you use PowerShell commands to complete various DaRT 10 administrative tasks or to create the DaRT recovery image. - -## Perform DaRT tasks by using PowerShell commands - - -DaRT 10 provides four PowerShell commands that let you do the following: - -- Burn an ISO to a CD, DVD, or USB drive. - -- Allow the source WIM file, which contains a DaRT image, to be converted into an ISO file. - -- Create a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image. - -- Apply a DartConfiguration object to a mounted Windows Image. - -[How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md) - -## Use a PowerShell script to create the recovery image - - -Rather than use the DaRT Recovery Image wizard to create the recovery image, you can use a PowerShell script and specify the parameters you want. - -[How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md) - -## Other resources for administering DaRT 10 using PowerShell - - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/creating-the-dart-10-recovery-image.md b/mdop/dart-v10/creating-the-dart-10-recovery-image.md deleted file mode 100644 index 3f47366774..0000000000 --- a/mdop/dart-v10/creating-the-dart-10-recovery-image.md +++ /dev/null @@ -1,266 +0,0 @@ ---- -title: Creating the DaRT 10 Recovery Image -description: Creating the DaRT 10 Recovery Image -author: msfttracyp -ms.assetid: 173556de-2f20-4ea6-9e29-fc5ccc71ebd7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Creating the DaRT 10 Recovery Image - - -After installing Microsoft Diagnostics and Recovery Toolset (DaRT) 10, you create a DaRT 10 recovery image. The recovery image starts Windows RE, from which you can then start the DaRT tools. You can generate International Organization for Standardization (ISO) files and Windows Imaging Format (WIM) images. In addition, you can use PowerShell to generate scripts that use the settings you select in the DaRT Recovery Image wizard. You can use the script later to rebuild recovery images by using the same settings. The recovery image provides a variety of recovery tools. For a description of the tools, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). - -After you boot the computer into DaRT, you can run the different DaRT tools to try to diagnose and repair the computer. This section walks you through the process of creating the DaRT recovery image and lets you select the tools and features that you want to include as part of the image. - -You can create the DaRT recovery image by using either of two methods: - -- Use the DaRT Recovery Image wizard, which runs in a Windows environment. - -- Modify an example PowerShell script with the values you want. For more information, see [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md). - -You can write the ISO to a recordable CD or DVD, save it to a USB flash drive, or save it in a format that you can use to boot into DaRT from a remote partition or from a recovery partition. - -Once you have created the ISO image, you can burn it onto a blank CD or DVD (if your computer has a CD or DVD drive). If your computer does not have a drive for this purpose, you can use most generic programs that are used to burn CDs or DVDs. - -## Select the image architecture and specify the path - - -On the Windows 10 Media page, you select whether to create a 32-bit or 64-bit DaRT recovery image. Use the 32-bit Windows to build 32-bit DaRT recovery images, and 64-bit Windows to build 64-bit DaRT recovery images. You can use a single computer to create recovery images for both architecture types, but you cannot create one image that works on both 32-bit and 64-bit architectures. You also indicate the path of the Windows 10 installation media. Choose the architecture that matches the one of the recovery image that you are creating. - -**To select the image architecture and specify the path** - -1. On the **Windows 10 Media** page, select one of the following: - - - If you are creating a recovery image for 64-bit computers, select **Create x64 (64-bit) DaRT image**. - - - If you are creating a recovery image for 32-bit computers, select **Create x86 (32-bit) DaRT image**. - -2. In the **Specify the root path of the Windows 10 <64-bit or 32-bit> install media** box, type the path of the Windows 10 installation files. Use a path that matches the architecture of the recovery image that you are creating. - -3. Click **Next**. - -## Select the tools to include on the recovery image - - -On the Tools page, you can select numerous tools to include on the recovery image. These tools will be available to end users when they boot into the DaRT image. However, if you enable remote connectivity when creating the DaRT image, all of the tools will be available when a help desk worker connects to the end user’s computer, regardless of which tools you chose to include on the image. - -To restrict end-user access to these tools, but still retain full access to the tools through the Remote Connection Viewer, do not select those tools on the Tools page. End users will be able to use only Remote Connection and will be able to see, but not access, any tools that you exclude from the recovery image. - -**To select the tools to include on the recovery image** - -1. On the **Tools** page, select the check box beside each tool that you want to include on the image. - -2. Click **Next**. - -## Choose whether to allow remote connectivity by a help desk - - -On the Remote Connection page, you can choose to enable a help desk worker to remotely connect to and run the DaRT tools on an end user’s computer. The remote connectivity option is then shown as an available option in the Diagnostics and Recovery Toolset window. After help desk workers establish a remote connection, they can run the DaRT tools on the end-user computer from a remote location. - -**To choose whether to allow remote connectivity by help desk workers** - -1. On the **Remote Connection** page, select the **Allow remote connections** check box to allow remote connections, or clear the check box to prevent remote connections. - -2. If you cleared the **Allow remote connections** check box, click **Next**. Otherwise, go to the next step to continue configuring remote connectivity. - -3. Select one of the following: - - - Let Windows choose an open port number. - - - Specify the port number. If you select this option, enter a port number between 1 and 65535 in the field beneath the option. This port number will be used when establishing a remote connection. We recommend that the port number be 1024 or higher to minimize the possibility of a conflict. - -4. (Optional) in the **Remote connection welcome** message box, create a customized message that end users receive when they establish a remote connection. The message can be a maximum of 2048 characters. - -5. Click **Next**. - - For more information about running the DaRT tools remotely, see [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md). - -## Add drivers to the recovery image - - -On the Drivers tab of the Advanced Options page, you can add additional device drivers that you may need when repairing a computer. These may typically include storage or network controllers that Windows 10 does not provide. Drivers are installed when the image is created. - -**Important**   -When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT. - - - -**To add drivers to the recovery image** - -1. On the **Advanced Options** page, click the **Drivers** tab. - -2. Click **Add**. - -3. Browse to the file to be added for the driver, and then click **Open**. - - **Note**   - The driver file is provided by the manufacturer of the storage or network controller. - - - -4. Repeat Steps 2 and 3 for every driver that you want to include. - -5. Click **Next**. - -## Add WinPE optional packages to the recovery image - - -On the WinPE tab of the Advanced Options page, you can add WinPE optional packages to the DaRT image. These packages are part of the Windows ADK, which is an installation prerequisite for the DaRT Recovery Image wizard. The tools that you can select are all optional. Any required packages are added automatically, based on the tools you selected on the Tools page. - -You can also specify the size of the scratch space. Scratch space is the amount of RAM disk space that is set aside for DaRT to run. The scratch space is useful in case the end user’s hard disk is not available. If you are running additional tools and drivers, you may want to increase the scratch space. - -**To add WinPE optional packages to the recovery image** - -1. On the **Advanced Options** page, click the **WinPE** tab. - -2. Select the check box beside each package that you want to include on the image, or click the **Name** check box to select all of the packages. - -3. In the **Scratch Space** field, select the amount of RAM disk space to allocate for running DaRT in case the end user’s hard disk is not available. - -4. Click **Next**. - -## Add the debugging tools for Crash Analyzer - - -If you include the Crash Analyzer tool in the ISO image, you must also include the Debugging Tools for Windows. On the Crash Analyzer tab of the Advanced Options page, you enter the path of the Windows 10 Debugging Tools, which Crash Analyzer uses to analyze memory dump files. You can use the tools that are on the computer where you are running the DaRT Recovery Image wizard, or you can use the tools that are on the end-user computer. If you decide to use the tools on the end-user computer, remember that every computer that you diagnose must have the Debugging Tools installed. - -If you installed the Microsoft Windows Software Development Kit (SDK) or the Microsoft Windows Development Kit (WDK), the Windows 10 Debugging Tools are added to the recovery image by default, and the path to the Debugging Tools is automatically filled in. You can change the path of the Windows 10 Debugging Tools if the files are located somewhere other than the location indicated by the default file path. A link in the wizard lets you download and install debugging tools for Windows if they are not already installed. - -To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). Install the Debugging Tools to the default location. - -**Note**   -The DaRT wizard checks for the tools in the `HKLM\Software\Microsoft\Windows Kits\Installed Roots\WindowsDebuggersRoot` registry key. If the registry value is not there, the wizard looks in one of the following locations, depending on your system architecture: - -`%ProgramFilesX86%\Windows Kits\10.0\Debuggers\x64` - -`%ProgramFilesX86%\Windows Kits\10.0\Debuggers\x86` - - - -**To add the debugging tools for Crash Analyzer** - -1. On the **Advanced Options** page, click the **Crash Analyzer** tab. - -2. (Optional) Click **Download the Debugging Tools** to download the Debugging Tools for Windows. - -3. Select one of the following options: - - - **Include the Windows 10 <64-bit or 32-bit> Debugging Tools**. If you select this option, browse to and select the location of the tools if the path is not already displaying. - - - **Use the Debugging Tools from the system that is being debugged**. If you select this option, the Crash Analyzer will not work if the Debugging Tools for Windows are not found on the problem computer. - -4. Click **Next**. - -## Select the types of recovery image files to create - - -On the Create Image page, you choose an output folder for the recovery image, enter an image name, and select the types of DaRT recovery image files to create. During the recovery image creation process, Windows source files are unpacked, DaRT files are copied to it, and the image is then “re-packed” into the file formats that you select on this page. - -The available image file types are: - -- **Windows Imaging File (WIM)** - used to deploy DaRT to a preboot execution environment (PXE) or local partition). - -- **International Standards Organization (ISO)** – used to deploy to CD or DVD, or for use in virtual machines (VM)s). The wizard requires that the ISO image have an .iso file name extension because most programs that burn a CD or DVD require that extension. If you do not specify a different location, the ISO image is created on your desktop with the name DaRT10.ISO. - -- **PowerShell script** – creates a DaRT recovery image with commands that provide essentially the same options that you can select by using the DaRT Recovery Image wizard. The script also enables you to add or changes files in the DaRT recovery image. - -If you select the Edit Image check box on this page, you can customize the recovery image during the image creation process. For example, you can change the “winpeshl.ini” file to create a custom startup order or to add third-party tools. - -**To select the types of recovery image files to create** - -1. On the **Create Image** page, click **Browse** to choose the output folder for the image file. - - **Note**   - The size of the image will vary, depending on the tools that you select and the files that you add in the wizard. - - - -2. In the **Image name** box, enter a name for the DaRT recovery image, or accept the default name, which is DaRT10. - - The wizard creates a subfolder in the output path by this name. - -3. Select the types of image files that you want to create. - -4. Choose one of the following: - - - To change the files in the recovery image before you create the image files, select the **Edit Image** check box, and then click **Prepare**. - - - To create the recovery image without changing the files, click **Create**. - -5. - - Click **Next**. - -## Edit the recovery image files - - -You can edit the recovery image only if you selected the Edit Image check box on the Create Image page. After the recovery image has been prepared for editing, you can add and modify the recovery image files before creating the bootable media. For example, you can create a custom order for startup, add various third-party tools, and so on. - -**To edit the recovery image files** - -1. On the **Edit Image** page, click **Open** in Windows Explorer. - -2. Create a subfolder in the folder that is listed in the dialog box. - -3. Copy the files that you want to the new subfolder, or remove files that you don’t want. - -4. Click **Create** to start creating the recovery image. - -## Generate the recovery image files - - -On the Generate Files page, the DaRT recovery image is generated for the file types that you selected on the Create Image page. - -**To generate the recovery image files** - -- On the **Generate Files** page, click **Next** to generate the recovery image files. - -## Copy the recovery image to a CD, DVD, or USB - - -On the Create Bootable Media page, you can optionally copy the image file to a CD, DVD, or USB flash drive (UFD). You can also create additional bootable media from this page by restarting the wizard. - -**Note**   -The Preboot execution environment (PXE) and local image deployment are not supported natively by this tool since they require additional enterprise tools, such as System Center Configuration Manager server and Microsoft Development Toolkit. - - - -**To copy the recovery image to a CD, DVD, or USB** - -1. On the **Create Bootable Media** page, select the iso file that you want to copy. - -2. Insert a CD, DVD, or USB, and then select the drive. - - **Note**   - If a drive is not recognized and you install a new drive, you can click **Refresh** to force the wizard to update the list of available drives. - - - -3. Click the **Create Bootable Media** button. - -4. To create another recovery image, click Restart, or click **Close** if you have finished creating all of the media that you want. - -## Related topics - - -[Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/dart-10--c--page.md b/mdop/dart-v10/dart-10--c--page.md deleted file mode 100644 index a0e3d60f0d..0000000000 --- a/mdop/dart-v10/dart-10--c--page.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: DaRT 10 -description: DaRT 10 -author: msfttracyp -ms.assetid: 4f62abe6-d971-44b4-b1e7-9dcaf199ca31 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 - - -## Copyright - - -This document is provided "as-is". Information and views expressed in this document, including URL and other Internet website references, may change without notice. - -Some examples depicted herein are provided for illustration only and are fictitious.  No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - -This document is confidential and proprietary to Microsoft. It is disclosed and can be used only pursuant to a non-disclosure agreement. - - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - -## Revision History - - - ---- - - - - - - - - - - - - -
          Release DateChanges

          Month dd, yyyy

          Original release of this guide.

          - -  - -  - -  - - - - - diff --git a/mdop/dart-v10/dart-10-cover-page.md b/mdop/dart-v10/dart-10-cover-page.md deleted file mode 100644 index ab111cbe8e..0000000000 --- a/mdop/dart-v10/dart-10-cover-page.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: DaRT 10 -description: DaRT 10 -author: msfttracyp -ms.assetid: 875f6dc4-13f4-4625-8c6a-38215c2daf01 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 - - -![mbam logo](images/mbam-logo-sm.gif) - -## Administrator’s Guide for <Product Name> - - -Published: *<date published>* - -*Include an executive summary overview of the product, here.* - -This guide describes how to install and use *<Product Name>*. This guide is intended for administrators and IT personnel. - -For the most current documentation for *<Product Name>*, see the *insert link here* home page. - -For the release notes for *<Product Name>*, see *insert link here*. - -### Feedback - -Send suggestions and comments about this document to . - -  - -  - - - - - diff --git a/mdop/dart-v10/dart-10-deployment-checklist.md b/mdop/dart-v10/dart-10-deployment-checklist.md deleted file mode 100644 index 3dfa45cfc5..0000000000 --- a/mdop/dart-v10/dart-10-deployment-checklist.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 10 Deployment Checklist -description: DaRT 10 Deployment Checklist -author: msfttracyp -ms.assetid: a6b7ba27-a969-4da9-bef0-d019739413cc -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 Deployment Checklist - - -This checklist can be used to help you during Microsoft Diagnostics and Recovery Toolset (DaRT) 10 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferences
          Checklist box

          Decide on the best DaRT 10 deployment option for your requirements and deploy it.

          Deploying DaRT 10 to Administrator Computers

          Checklist box

          Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO.

          Creating the DaRT 10 Recovery Image

          Checklist box

          Decide on the best DaRT 10 recovery image deployment option for your requirements and deploy it.

          Deploying the DaRT Recovery Image

          - - - -## Related topics - - -[Deploying DaRT 10](deploying-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/dart-10-planning-checklist.md b/mdop/dart-v10/dart-10-planning-checklist.md deleted file mode 100644 index f7fc8ef40c..0000000000 --- a/mdop/dart-v10/dart-10-planning-checklist.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 10 Planning Checklist -description: DaRT 10 Planning Checklist -author: msfttracyp -ms.assetid: d6482534-cdf3-4997-bec0-33d0edf6924a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Diagnostics and Recovery Toolset (DaRT) 10 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferences
          Checklist box

          Review the DaRT 10 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.

          DaRT 10 Supported Configurations

          Checklist box

          Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.

          Planning to Create the DaRT 10 Recovery Image

          Checklist box

          Determine which method, or methods, you will use to deploy the DaRT recovery image.

          Planning How to Save and Deploy the DaRT 10 Recovery Image

          - - - -## Related topics - - -[Planning for DaRT 10](planning-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/dart-10-privacy-statement.md b/mdop/dart-v10/dart-10-privacy-statement.md deleted file mode 100644 index 2b640d3109..0000000000 --- a/mdop/dart-v10/dart-10-privacy-statement.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: DaRT 10 Privacy Statement -description: DaRT 10 Privacy Statement -author: msfttracyp -ms.assetid: 27ad36fe-6816-4fe8-8838-500c05b5b184 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 10 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Diagnostics and Recovery Toolset (“DaRT”). This disclosure focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft Diagnostics and Recovery Toolset (“DaRT”) enables administrators to easily recover PCs that have become unusable, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems, all faster than the average time it takes to reimage the machine. When necessary, you can also quickly restore critical lost files. This release provides support for Windows 10 as well as improvements on image creation and new hardware and software coverage. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by DaRT may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -The privacy details for each DaRT feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please [contact us](https://go.microsoft.com/fwlink/?LinkID=245853). - -Microsoft PrivacyMicrosoft CorporationOne Microsoft WayRedmond, Washington 98052 USA - -## Specific Features - - -## Microsoft Update - - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Use of Information:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Update Services Privacy Statement at [https://go.microsoft.com/fwlink/?LinkId=244000](https://go.microsoft.com/fwlink/?LinkId=244400). - -## Related topics - - -[Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/dart-10-supported-configurations.md b/mdop/dart-v10/dart-10-supported-configurations.md deleted file mode 100644 index e700bfa7fa..0000000000 --- a/mdop/dart-v10/dart-10-supported-configurations.md +++ /dev/null @@ -1,307 +0,0 @@ ---- -title: DaRT 10 Supported Configurations -description: DaRT 10 Supported Configurations -author: msfttracyp -ms.assetid: a07d6562-1fa9-499f-829c-9cc487ede0b7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 10 Supported Configurations - - -This topic specifies the prerequisite software and supported configurations requirements that are necessary to install and run Microsoft Diagnostics and Recovery Toolset (DaRT) 10 in your environment. Both the operating system requirements and the system requirements that are required to run DaRT 10 are specified. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md). - -For supported configurations that apply to later releases, see the documentation for the applicable release. - -You can install DaRT in one of two ways. You can install all functionality on an IT administrator computer, where you will perform all the tasks associated with running DaRT. Alternatively, you can install, on the administrator computer, only the DaRT functionality that creates the recovery image, and then install the functionality used to run DaRT (that is, the DaRT Remote Connection Viewer) on a help desk computer. - -## DaRT 10 prerequisite software - - -Make sure that the following prerequisites are met before you install DaRT. - -### Administrator computer prerequisites - -The following table lists the installation prerequisites for the administrator computer when you are installing DaRT 10 and all of the DaRT tools. - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Windows Assessment and Development Kit (ADK)

          Required for the DaRT Recovery Image wizard. Contains the Deployment Tools, which are used to customize, deploy, and service Windows images, and contains the Windows Preinstallation Environment (Windows PE). The ADK is not required if you are installing only the Remote Connection Viewer and/or Crash Analyzer.

          Windows Development Kit OR Software Development Kit (optional)

          Crash Analyzer requires the Windows 10 Debugging Tools from the Windows Driver Kit to analyze memory dump files.

          Windows 10 64-bit or 32-bit ISO image

          DaRT requires the Windows Recovery Environment (Windows RE) image from the Windows 10 media. Download the 32-bit or 64-bit version of Windows 10, depending on the type of DaRT recovery image you want to create. If you support both system types in your environment, download both versions of Windows 10.

          - - - -### Help desk computer prerequisites - -The following table lists the installation prerequisites for the help desk computer when you are running the DaRT 10 Remote Connection Viewer. - - ---- - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          DaRT 10 Remote Connection Viewer

          Must be installed on a Windows 10 operating system.

          Debugging Tools for Windows

          Required only if you are installing the Crash Analyzer tool

          - - - -### End-user computer prerequisites - -There is no prerequisite software that must be installed on end-user computers, other than the Windows 10 operating system. - -## DaRT 10 operating system requirements - - -### Administrator computer system requirements - -The following table lists the operating systems that are supported for the DaRT 10 administrator computer installation. - -**Note**   -Make sure that you allocate enough space for any additional tools that you want to install on the administrator computer. - - - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirement for Running DaRT

          Windows 10

          All editions

          N/A

          64-bit

          2 GB

          2.5 GB

          Windows 10

          All editions

          N/A

          32-bit

          1 GB

          1.5 GB

          - - - -### DaRT help desk computer system requirements - -If you allow a help desk to remotely troubleshoot computers, you must have the Remote Connection Viewer installed on the help desk computer. You can optionally install the Crash Analyzer tool on the help desk computer. - -DaRT 10 enables a help desk worker to connect to a DaRT 10 computer by using either the DaRT 7.0, DaRT 8.0, DaRt 8.1, or DaRT 10 Remote Connection Viewer. The DaRT 7.0, DaRT 8.0 and DaRt 8.1, Remote Connection Viewers require Windows 7, Windows 8, or Windows 8.1 operating systems respectively, while the DaRT 10 Remote Connection Viewer requires Windows 10. The DaRT 10 Remote Connection Viewer and all other DaRT 10 tools can be installed only on a computer running Windows 10. - -The following table lists the operating systems that are supported for the DaRT help desk computer installation. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements for Running DaRT

          Windows 10

          All editions

          N/A

          64-bit

          2 GB

          2.5 GB

          Windows 10 (with Remote Connection Viewer 10.0 only)

          All editions

          N/A

          32-bit

          1 GB

          1.5 GB

          Windows 8

          All editions

          N/A

          64-bit

          2 GB

          2.5 GB

          Windows 8 (with Remote Connection Viewer 8.0 only)

          All editions

          N/A

          32-bit

          1 GB

          1.5 GB

          Windows 7 (with Remote Connection Viewer 7.0 only)

          All editions

          SP1, SP2

          64-bit or 32-bit

          1 GB

          N/A

          Windows Server 2012

          Standard, Enterprise, Data Center

          N/A

          64-bit

          2 GB

          1.0 GB

          Windows Server 2012 R2

          Standard, Enterprise, Data Center

          N/A

          64-bit

          2 GB

          1.0 GB

          - - - -DaRT also has the following minimum hardware requirements for the end-user computer: - -A CD or DVD drive or a USB port - required only if you are deploying DaRT in your enterprise by using a CD, DVD, or USB. - -BIOS support for starting the computer from a CD or DVD, a USB flash drive, or from a remote or recovery partition. - -### DaRT 10 end-user computer system requirements - -The Diagnostics and Recovery Toolset window in DaRT 10 requires that the end-user computer use one of the following operating systems together with the specified amount of system memory available for DaRT: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements

          Windows 10

          All editions

          N/A

          64-bit

          2 GB

          2.5 GB

          Windows 10

          All editions

          N/A

          32-bit

          1 GB

          1.5 GB

          - - - -## Related topics - - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md b/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md deleted file mode 100644 index 0e84d83c2b..0000000000 --- a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying DaRT 10 to Administrator Computers -description: Deploying DaRT 10 to Administrator Computers -author: msfttracyp -ms.assetid: c1981cbe-10f8-41f6-8989-bcc9d57a2aa8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 10 to Administrator Computers - - -Before you begin the deployment of Microsoft Diagnostics and Recovery Toolset (DaRT) 10, review the requirements for your environment. This includes the hardware requirements for installing DaRT 10. For more information about DaRT hardware and software requirements, see [DaRT 10 Supported Configurations](dart-10-supported-configurations.md). - -The topics in this section can be used to help you deploy DaRT in your enterprise based on your environment and deployment strategy. - -## Deploy DaRT 10 - - -You can use the Windows Installer file for DaRT to install DaRT on a computer that you will use to first create the DaRT recovery image and then troubleshoot and fix end-user computers. Frequently, across an organization, you might install on the administrator computer only the DaRT functionality that you need to create a DaRT recovery image. Then, on a help desk administrator’s computer, you might install only the DaRT functionality that you must have to troubleshoot a problem computer, such as the DaRT Remote Connection Viewer and the Crash Analyzer. - -In addition to manually running the Windows Installer file to install DaRT, you can also install DaRT at the command prompt to support enterprise software deployment systems such as System Center Configuration Manager 2012. - -[How to Deploy DaRT 10](how-to-deploy-dart-10.md) - -## Change, repair, or remove DaRT 10 - - -You can change, repair, or remove the DaRT installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform or through the Windows Control Panel. - -[How to Change, Repair, or Remove DaRT 10](how-to-change-repair-or-remove-dart-10.md) - -## How to get DaRT 10 - - -To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for deploying DaRT 10 to administrator computers - - -[Deploying DaRT 10](deploying-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/deploying-dart-10.md b/mdop/dart-v10/deploying-dart-10.md deleted file mode 100644 index b2b9f2ace3..0000000000 --- a/mdop/dart-v10/deploying-dart-10.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Deploying DaRT 10 -description: Deploying DaRT 10 -author: msfttracyp -ms.assetid: 92cf70fd-006f-4fdc-9fb3-78d9d223148d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 10 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 supports a number of different deployment configurations. This section includes information you should consider about the deployment of DaRT 10 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment Information - - -- [Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) - - This section describes the different DaRT deployment options for your requirements and explains how to deploy them. - -- [Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) - - This section describes the methods you can use to create the DaRT recovery image and provides instructions to create the recovery image by using the DaRT Recovery Image wizard. - -- [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) - - This section provides information to help you decide on the best DaRT recovery image deployment option for your requirements and provides instructions on how to deploy the recovery image. - -- [DaRT 10 Deployment Checklist](dart-10-deployment-checklist.md) - - This section contains a deployment checklist that can help you to deploy DaRT. - -### How to get DaRT - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/p/?LinkId=322049) (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -## Other Resources for deploying DaRT - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md deleted file mode 100644 index 6367ad326e..0000000000 --- a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying the DaRT Recovery Image -description: Deploying the DaRT Recovery Image -author: msfttracyp -ms.assetid: 2b859da6-e31a-4240-8868-93a754328cf2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the DaRT Recovery Image - - -After you have created the International Organization for Standardization (ISO) file that contains the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image, you can deploy the DaRT 10 recovery image throughout your enterprise so that it is available to end users and help desk workers. There are four supported methods that you can use to deploy the DaRT recovery image. To review the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md). - -Burn the ISO image file to a CD or DVD by using the DaRT Recovery Image wizard - -Save the contents of the ISO image file to a USB Flash Drive (UFD) by using the DaRT Recovery Image wizard - -Extract the boot.wim file from the ISO image and deploy as a remote partition that is available to end-user computers - -Extract the boot.wim file from the ISO image and deploy in the recovery partition of a new Windows 10 installation - -**Important**   -The **DaRT Recovery Image Wizard** provides the option to burn the image to a CD, DVD or UFD, but the other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section. - - - -## Deploy the DaRT recovery image as part of a recovery partition - - -After you have finished running the DaRT Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 10 image. - -[How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md) - -## Deploy the DaRT recovery image as a remote partition - - -You can host the recovery image on a central network boot server, such as Windows Deployment Services, and allow users or support staff to stream the image to computers on demand. - -[How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md) - -## Other resources for deploying the DaRT recovery image - - -[Deploying DaRT 10](deploying-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md b/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md deleted file mode 100644 index 0e168029e5..0000000000 --- a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Diagnosing System Failures with Crash Analyzer -description: Diagnosing System Failures with Crash Analyzer -author: msfttracyp -ms.assetid: 7ebef49e-a294-4173-adb1-7e6994aa01ad -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Diagnosing System Failures with Crash Analyzer - - -The **Crash Analyzer** in Microsoft Diagnostics and Recovery Toolset (DaRT) 10 lets you debug a memory dump file on a Windows-based computer and then diagnose any related computer errors. The **Crash Analyzer** uses the Microsoft Debugging Tools for Windows to examine a memory dump file for the driver that caused the computer to fail. You can run the Crash Analyzer on an end-user computer or in stand-alone mode on a computer other than an end-user computer. - -## Run the Crash Analyzer on an end-user-computer - - -Typically, you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing the problem. The **Crash Analyzer** tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location, or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you included the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT 10 recovery image, the Tools and symbol files should be available when you run the **Crash Analyzer** on the problem computer. If you did not include them in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining them, you can alternatively run the Crash Analyzer in stand-alone mode on a computer other than the end user’s computer, as described in the following section. - -[How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md) - -## Run the Crash Analyzer in stand-alone mode on a computer other than an end user’s computer - - -Although you typically run **Crash Analyzer** on the end-user computer that is experiencing the problem, you can also run the Crash Analyzer in stand-alone mode, on a computer other than an end-user computer. You might choose this option if you did not include the Windows Debugging Tools in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining the Debugging Tools. In this case, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of **Crash Analyzer** installed, such as on a help desk agent’s computer. - -[How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md) - -## How to ensure that Crash Analyzer can access symbol files - - -To debug applications that have stopped responding, you need access to the symbol file, which is separate from the program. Although symbol files are automatically downloaded when you run Crash Analyzer, there might be times when the problem computer does not have access to the Internet. There are several ways to ensure that you have guaranteed access to symbol files. - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md) - -## Other resources for diagnosing system failures with Crash Analyzer - - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/getting-started-with-dart-10.md b/mdop/dart-v10/getting-started-with-dart-10.md deleted file mode 100644 index 634c9a9c74..0000000000 --- a/mdop/dart-v10/getting-started-with-dart-10.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Getting Started with DaRT 10 -description: Getting Started with DaRT 10 -author: msfttracyp -ms.assetid: 593dd317-4fba-4d51-8a80-951590acede6 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with DaRT 10 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 requires thorough planning before you deploy it or use its features. If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. - ->[!NOTE] -> A downloadable version of this administrator’s guide is not available. However, you can click **Download PDF** at the bottom of the Table of Contents pane to get a PDF version of this guide. -> ->Additional information about this product can also be found on the [Diagnostics and Recovery Toolset documentation download page.](https://www.microsoft.com/download/details.aspx?id=27754) - - -## Getting started with DaRT 10 - - -- [About DaRT 10](about-dart-10.md) - - Provides information specifically related to DaRT, including what is new in DaRT 10. - -- [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md) - - Describes the tools in DaRT 10. - -- [Accessibility for DaRT 10](accessibility-for-dart-10.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## How to Get DaRT 10 - - -DaRT 10 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for this product - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md b/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md deleted file mode 100644 index 166f07768a..0000000000 --- a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Change, Repair, or Remove DaRT 10 -description: How to Change, Repair, or Remove DaRT 10 -author: msfttracyp -ms.assetid: e7718c6f-06a1-48bb-b04b-1a0f659a0337 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change, Repair, or Remove DaRT 10 - - -You can change, repair, or remove the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 installation by double-clicking the DaRT 10 installation file and then clicking the button that corresponds to the action that you want to perform. - -You can also change, repair, or remove the DaRT installation using the Windows Control Panel by completing the following steps. - -## To change, repair, or remove DaRT - - -1. Click **Start**, and then click **Control Panel**. - -2. On **Control Panel**, navigate to the feature that lets you uninstall programs. - -3. Click **Microsoft Diagnostics and Recovery Toolset 10**, and then click the button that corresponds to the action that you want to perform. - -## Related topics - - -[Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-deploy-dart-10.md b/mdop/dart-v10/how-to-deploy-dart-10.md deleted file mode 100644 index 805de4c46d..0000000000 --- a/mdop/dart-v10/how-to-deploy-dart-10.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Deploy DaRT 10 -description: How to Deploy DaRT 10 -author: msfttracyp -ms.assetid: 13e8ba20-21c3-4870-94ed-6d3106d69f21 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy DaRT 10 - - -The following instructions explain how to deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 10 in your environment. To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). It is assumed that you are installing all functionality on one administrator computer. If you need to deploy or uninstall DaRT 10 on multiple computers, using an electronic software distribution system, for example, it might be easier to use command line installation options. Descriptions and examples of the available command line options are provided in this section. - -**Important**   -Before you install DaRT, see [DaRT 10 Supported Configurations](dart-10-supported-configurations.md) to ensure that you have installed all of the prerequisite software and that the computer meets the minimum system requirements. The computer onto which you install DaRT must be running Windows 10. - - - -You can install DaRT using one of two different configurations: - -- Install DaRT and all of the DaRT tools on the administrator computer. - -- Install on the administrator computer only the tools that you need to create the DaRT recovery image, and then install the **Remote Connection Viewer** and, optionally, **Crash Analyzer** on a help desk computer. - -The DaRT installation file is available in both 32-bit and 64-bit versions. Install the version that matches the architecture of the computer on which you are running the DaRT Recovery Image wizard, not the computer architecture of the recovery image that you are creating. - -You can use either version of the DaRT installation file to create a recovery image for either 32-bit or 64-bit computers, but you cannot create one recovery image for both 32-bit and 64-bit computers. - -**To install DaRT and all DaRT tools on an administrator computer** - -1. Download the 32-bit or 64-bit version of the DaRT 10 installer file. Choose the architecture that matches the computer on which you are installing DaRT and running the DaRT Recovery Image wizard. - -2. From the folder into which you downloaded DaRT 10, run the **MSDaRT.msi** installation file that corresponds to your system requirements. - -3. On the **Welcome to the Microsoft DaRT 10 Setup Wizard** page, click **Next**. - -4. Accept the Microsoft Software License Terms, and then click **Next**. - -5. On the **Microsoft Update** page, select **Use Microsoft Update when I check for updates**, and then click **Next**. - -6. On the **Select Installation Folder** page, select a folder, or click **Next** to install DaRT in the default installation location. - -7. On the **Setup Options** page, select the DaRT features that you want to install, or click **Next** to install DaRT with all of the features. - -8. To start the installation, click **Install**. - -9. After the installation has completed successfully, click **Finish** to exit the wizard. - -## To install DaRT and all DaRT tools on an administrator computer by using a command prompt - - -When you install or uninstall DaRT, you have the option of running the installation files at the command prompt. This section describes some examples of different options that you can specify when you install or uninstall DaRT at the command prompt. - -The following example shows how to install all DaRT functionality. - -``` syntax -msiexec /i MSDaRT.msi ADDLOCAL=CommonFiles, DaRTRecoveryImage,CrashAnalyzer,RemoteViewer -``` - -The following example shows how to install only the DaRT Recovery Image wizard. - -``` syntax -msiexec /i MSDaRT.msi ADDLOCAL=CommonFiles, ,DaRTRecoveryImage -``` - -The following example shows how to install only the Crash Analyzer and the DaRT Remote Connection Viewer. - -``` syntax -msiexec /i MSDaRT.msi ADDLOCAL=CommonFiles,CrashAnalyzer,RemoteViewer -``` - -The following example creates a setup log for the Windows Installer. This is valuable for debugging. - -``` syntax -msiexec.exe /i MSDaRT.msi /l*v log.txt -``` - -**Note**   -You can add /qn or /qb to perform a silent installation. - - - -**To validate the DaRT installation** - -1. Click **Start**, and select **Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. - -2. Check that all of the DaRT tools that you selected for installation were successfully installed. - -## Related topics - - -[Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md deleted file mode 100644 index 16d8853966..0000000000 --- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as a Remote Partition -description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: msfttracyp -ms.assetid: 06a5e250-b992-4f6a-ad74-e7715f9e96e7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -**To deploy DaRT 10 as a remote partition** - -1. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -2. Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise. - -3. Configure the WDS server to use the boot.wim file for DaRT by following your standard WDS deployment procedures. - -For more information about how to deploy DaRT as a remote partition, see [Walkthrough: Deploy an Image by Using PXE](https://go.microsoft.com/fwlink/?LinkId=212108) and [Windows Deployment Services Getting Started Guide](https://go.microsoft.com/fwlink/?LinkId=212106). - -## Related topics - - -[Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md deleted file mode 100644 index 4fa7467fc0..0000000000 --- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: msfttracyp -ms.assetid: 0d2192c1-4058-49fb-b0b6-baf4699ac7f5 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 10 image. A partition is recommended, because any corruption issues that prevent the Windows operating system from starting would also prevent the recovery image from starting. A separate partition also eliminates the need to provide the BitLocker recovery key twice. Consider hiding the partition to prevent users from storing files on it. - -**To deploy DaRT in the recovery partition of a Windows 10 image** - -1. Create a target partition in your Windows 10 image that is equal to or greater than the size of the ISO image file that you created by using the **DaRT 10 Recovery Image wizard**. - - The minimum size required for a DaRT partition is 500MB to accommodate the remote connection functionality in DaRT. - -2. Extract the boot.wim file from the DaRT ISO image file. - - 1. Using your company’s preferred method, mount the ISO image file that you created on the **Create Startup Image** page. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD, DVD, or USB of the recovery image, you can open the files on the removable media and copy the boot.wim file from the \\sources folder. If you copy boot.wim file, you don’t need to mount the image. - - - -3. Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image. - - For more information about how to create or customize a recovery partition, see [Customizing the Windows RE Experience](https://go.microsoft.com/fwlink/?LinkId=214222). - -4. Replace the target partition in your Windows 10 image with the recovery partition. - - For more information about how to deploy a recovery solution to reinstall the factory image in the event of a system failure, see [Deploy a System Recovery Image](https://go.microsoft.com/fwlink/?LinkId=214221). - -## Related topics - - -[Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md b/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md deleted file mode 100644 index 3eeda04d28..0000000000 --- a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Ensure that Crash Analyzer Can Access Symbol Files -description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: msfttracyp -ms.assetid: 39e307bd-5d21-4e44-bed6-bf532f580775 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Ensure that Crash Analyzer Can Access Symbol Files - - -Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding. - -Symbol files are automatically downloaded when you run **Crash Analyzer**. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -**To ensure that Crash Analyzer can access symbol files** - -1. **Copy the dump file to another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, copy the memory dump file to a computer that does have an Internet connection and run the stand-alone **Crash Analyzer Wizard** on that computer. - -2. **Access the symbol files from another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, you can download the symbols from a computer that does have an Internet connection and then copy them to the computer that does not have an Internet connection, or you can map a network drive to a location where the symbols are available on the local network. If you run the **Crash Analyzer** in a Windows Recovery Environment (Windows RE), you can include the symbol files on the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image. - -3. **Access symbol files through an HTTP proxy server.** If the symbols cannot be downloaded because an HTTP proxy server must be accessed, use the following steps to access an HTTP proxy server. In DaRT 10, the **Crash Analyzer Wizard** has a setting available on the **Specify Symbol Files Location** dialog page, marked with the label **Proxy server (optional, using the format "server:port")**. You can use this text box to specify a proxy server. Enter the proxy address in the form **<hostname>:<port>**, where the <**hostname**> is a DNS name or IP address, and the <**port**> is a TCP port number. There are two modes in which the **Crash Analyzer** can be run. Following is how you use the proxy setting in each of these modes: - - - **Online mode:** In this mode, if the proxy server field is left blank, the wizard uses the proxy settings from Internet Options in Control Panel. If you enter a proxy address in the text box which is provided, that address will be used, and it will override the setting in the Internet Options. - - - Windows Recovery Environment (Windows RE): When you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window, there is no default proxy address. If the computer is directly connected to the Internet, a proxy address is not required. Therefore, you can leave this field blank in the wizard setting. If the computer is not directly connected to the Internet, and it is in a network environment that has a proxy server, you must set the proxy field in the wizard to access the symbol store. The proxy address can be obtained from the network administrator. Setting the proxy server is important only when the public symbol store is connected to the Internet. If the symbols are already on the DaRT recovery image, or if they are available locally, setting the proxy server is not required. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md b/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md deleted file mode 100644 index 6fda5d22e9..0000000000 --- a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Perform DaRT Tasks by Using PowerShell Commands -description: How to Perform DaRT Tasks by Using PowerShell Commands -author: msfttracyp -ms.assetid: f5a5c5f9-d667-4c85-9e82-7baf0b2aec6e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform DaRT Tasks by Using PowerShell Commands - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various DaRT 10 server tasks from the command prompt rather than from the DaRT Recovery Image wizard. - -## To administer DaRT by using PowerShell commands - - -Use the PowerShell cmdlets described here to administer DaRT. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Copy-DartImage

          Burns an ISO to a CD, DVD, or USB drive.

          Export-DartImage

          Allows the source WIM file, which contains a DaRT image, to be converted into an ISO file.

          New-DartConfiguration

          Creates a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image.

          Set-DartImage

          Applies a DartConfiguration object to a mounted Windows Image. This includes adding all files, configuration, and package dependencies.

          - -  - -## Related topics - - -[Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md deleted file mode 100644 index 688b37b172..0000000000 --- a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Recover Local Computers by Using the DaRT Recovery Image -description: How to Recover Local Computers by Using the DaRT Recovery Image -author: msfttracyp -ms.assetid: a6adc717-827c-45e8-b9c3-06d0e919e0bd -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover Local Computers by Using the DaRT Recovery Image - - -Use these instructions to recover a computer when you are physically present at the end-user computer that is experiencing problems. - -**How to recover a local computer by using the DaRT recovery image** - -1. Boot the end-user computer by using the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image. - - As the computer is booting into the DaRT 10 recovery image, the **NetStart** dialog box appears. - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created. - -You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides. - -For general information about any of the DaRT tools, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). - -**How to run DaRT at the command prompt** - -- To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - -

          Parameter

          Description

          -network

          Initializes the network services.

          -remount

          Remaps the drive letters.

          -prompt

          Displays messages that ask the end user to specify whether to initialize the network and remap the drives.

          -
          - Warning

          The end user’s response to the prompt overrides the –network and –remount switches.

          -
          -
          - -
          - - - -## Related topics - - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md deleted file mode 100644 index 2a8e35021d..0000000000 --- a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -title: How to Recover Remote Computers by Using the DaRT Recovery Image -description: How to Recover Remote Computers by Using the DaRT Recovery Image -author: msfttracyp -ms.assetid: c0062208-39cd-4e01-adf8-36a11386e2ea -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover Remote Computers by Using the DaRT Recovery Image - - -Use the Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 10 to run the DaRT tools remotely on an end-user computer. After the end user provides the administrator or help desk worker with certain information, the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -If you disabled the DaRT tools when you created the recovery image, you still have access to all of the tools. All of the tools, except Remote Connection, are unavailable to end users. - -**To recover a remote computer by using the DaRT recovery image** - -1. Boot an end-user computer by using the DaRT recovery image. - - You will typically use one of the following methods to boot into DaRT to recover a remote computer, depending on how you deploy the DaRT recovery image. For more information about deploying the DaRT recovery image, see [Deploying DaRT 10](deploying-dart-10.md). - - - Boot into DaRT from a recovery partition on the problem computer. - - - Boot into DaRT from a remote partition on the network. - - For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md). - - Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - - **Note** - Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -~~~ -As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. -~~~ - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 10](troubleshooting-dart-10.md). - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**. - -8. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**. - - The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information. - -9. On the help desk computer, open the **DaRT Remote Connection Viewer**. - -10. Click **Start**, click **All Programs**, click **Microsoft DaRT 10**, and then click **DaRT Remote Connection Viewer**. - -11. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information. - - **Note** - This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer. - - - -12. Click **Connect**. - -The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely. - -**Note** -A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32. - - - -**To customize the Remote Connection process** - -1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413). - - Specify the following commands and parameters to customize how a remote connection is established with an end-user computer: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandParameterDescription

          RemoteRecovery.exe

          -nomessage

          Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.

          WaitForConnection.exe

          none

          Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.

          -
          - Important

          This command serves no function if it is specified independently. It must be specified in a script to function correctly.

          -
          -
          - -
          - - - -2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT: - - ```ini - [LaunchApps] - "%windir%\system32\netstart.exe -network -remount" - "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage" - "%windir%\system32\WaitForConnection.exe" - "%SYSTEMDRIVE%\sources\recovery\recenv.exe" - ``` - -When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the RAM disk. This file contains connection information: IP address, port, and ticket number. You can copy this file to a network share to trigger a Help desk workflow. For example, a custom program can check the network share for connection files, and then create a support ticket or send email notifications. - -**To run the Remote Connection Viewer at the command prompt** - -1. To run the **DaRT Remote Connection Viewer** at the command prompt, specify the **DartRemoteViewer.exe** command and use the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          -ticket=<ticketnumber>

          Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection.

          -ipaddress=<ipaddress>

          Where <ipaddress> is the IP address that is generated by Remote Connection.

          -port=<port>

          Where <port> is the port that corresponds to the specified IP address.

          - - - -~~~ -**Note** -The variables for these parameters are created on the end-user computer and must be provided by the end user. -~~~ - - - -2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified. - -## Related topics - - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md deleted file mode 100644 index c84297c5bf..0000000000 --- a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: msfttracyp -ms.assetid: 27c1e1c6-123a-4f8a-b7d2-5bddc9ca3249 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer - - -If you cannot access the Microsoft Debugging Tools for Windows or the symbol files on the end-user computer, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a help desk computer that contains Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - -To run Crash Analyzer in stand-alone mode, you copy the memory dump file from the problem computer and analyze it on another computer, such as a help desk computer, that has the **Crash Analyzer** installed. - -**To run the Crash Analyzer in stand-alone mode** - -1. On a computer that has DaRT 10 installed, click **Start**, type **Crash Analyzer**, and then click **Crash Analyzer**. - -2. Follow the steps in the wizard, as described in [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md). - -## Related topics - - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md deleted file mode 100644 index 7cf5e9a3d7..0000000000 --- a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Run the Crash Analyzer on an End-user Computer -description: How to Run the Crash Analyzer on an End-user Computer -author: msfttracyp -ms.assetid: 10334800-ff8e-43ac-a9c2-d28807473ec2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Run the Crash Analyzer on an End-user Computer - - -To run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing problems, you must have the Microsoft Debugging Tools for Windows and the symbol files installed. To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). - -**To run the Crash Analyzer on an end-user computer** - -1. On the **Diagnostics and Recovery Toolset** window on an end-user computer, click **Crash Analyzer**. - -2. Provide the required information for the Microsoft Debugging Tools for Windows. - -3. Provide the required information for the symbol files. For more information about symbol files, see [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md). - -4. Provide the required information for a memory dump file. To determine the location of the memory dump file: - - 1. Open the **System Properties** window. - - 2. Click **Start**, type **sysdm.cpl**, and then press **Enter**. - - 3. Click the **Advanced** tab. - - 4. In the **Startup and Recovery** area, click **Settings**. - - If you do not have access to the **System Properties** window, you can search for dump files on the end-user computer by using the **Search** tool in Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - - The **Crash Analyzer** scans the memory dump file and reports a probable cause of the problem. You can view more information about the failure, such as the specific memory dump message and description, the drivers loaded at the time of the failure, and the full output of the analysis. - -5. Identify the appropriate strategy to resolve the problem. The strategy may require disabling or updating the device driver that caused the failure by using the **Services and Drivers** node of the **Computer Management** tool in DaRT 10. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md b/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md deleted file mode 100644 index ef8ed9be21..0000000000 --- a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Use a PowerShell Script to Create the Recovery Image -description: How to Use a PowerShell Script to Create the Recovery Image -author: msfttracyp -ms.assetid: cf5b0814-71a8-4f0b-b1f1-1ac6d8b51c4f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a PowerShell Script to Create the Recovery Image - - -## To create the DaRT recovery image by using a PowerShell script - - -You can create the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image by using a PowerShell script instead of using the DaRT 10 Recovery Image wizard. See the following example script. - -`` - -`This script was auto generated by the Microsoft DaRT Recovery Image Wizard.``###``This script uses the DISM and DaRT PowerShell commands to create a bootable DaRT image.``###Both a WIM and ISO file are produced.``###``### Examples of how to burn/copy the DaRT ISO to DVD/USB are available at the end of this script.``###` - -`$ErrorActionPreference = "Stop";``### This variable tells PowerShell to stop if an error occurs.` - -`###``### Import the modules necessary for DaRT Image creation.``###` - -`Import-Module "Dism"`I`mport-Module "Microsoft.Dart"` - -`###``### Specifies where the Windows 10 media is located and where the ISO and WIM files will be saved.``### These can be changed as necessary.``###` - -`$Win10MediaPath = "D:\";``### This is the path of the Windows 10 media.``$DestinationWimPath = "C:\Users\Administrator\Desktop\DaRT10\x64\boot.wim";``### Specify where the WIM file will be saved.``$DestinationIsoPath = "C:\Users\Administrator\Desktop\DaRT10\x64\DaRT10.iso";``### Specify where the ISO will be saved.` - -`###``### These variables are used to specify temporary and output directories based on the paths above.``###` - -`$WimParentPath = (Split-Path -Path "$destinationWimPath" -Parent);``### Specify the directory where the DaRT WIM file will be saved.``$IsoParentPath = (Split-Path -Path "$destinationIsoPath" -Parent);``### This is the directory where the DaRT ISO file will be saved.``$TempMountPath = "$env:temp\DaRT10Mount_$(Get-Random)";``### Specify the temporary directory used to mount the Windows image.` - -`###``### Prepare the windows image.``###` - -`### Guarantee the output directories exists.``New-Item -Path $WimParentPath -Type Directory -Force``New-Item -Path $IsoParentPath -Type Directory -Force``New-Item -Path $TempMountPath -Type Directory -Force` - -`### Create a copy of the WIM and remove the read-only attribute.``### The WIM file will be the resulting dart image.``Copy-Item "$Win10MediaPath\sources\boot.wim" $DestinationWimPath -Force``Set-ItemProperty $DestinationWimPath -Name IsReadOnly -Value $false` - -`### Mount the bootable image within the WIM file (normally index 2).``Mount-WindowsImage -ImagePath $DestinationWimPath -Path $TempMountPath -Index 2` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified driver(s) into the image.``###` - -`Add-WindowsDriver -Path $TempMountPath -Driver "C:\Windows\System32\DriverStore\FileRepository``\xusb22.inf_amd64_89c20c625f14f923\xusb22.inf" -ForceUnsigned` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified WinPE package(s) into the image.``###` - -`Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-FMAPI.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-HTA.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-HTA_en-us.cab"` - -`###``### Add the DaRT tools to the image.``### The New-DartConfiguration cmdlet is used to specify how the DaRT image is configured.``### Modify this statement to configure how the DaRT tools will be applied to the image.``###` - -`$config = New-DartConfiguration -AddComputerManagement -AddCrashAnalyzer -AddDiskCommander -AddExplorer -AddFileRestore -AddFileSearch -AddHotfixUninstall -AddRegistryEditor -AddRemoteConnection -AddSfcScan -AddSolutionWizard -AddTcpConfig -RemoteMessage "Test welcome message" -RemotePort 3388 -ScratchSpace 512``$config | Set-DartImage -Path $TempMountPath` - -`###``### Perform any manual user-specific customizations here.``###` - -`# Read-Host -Prompt "Script is paused for any manual customization. Press ENTER to continue"` - -`### Save the changes to the WIM file by dismounting the image.``Dismount-WindowsImage -Path $TempMountPath -Save` - -`### Create a bootable DaRT ISO.``Export-DartImage -IsoPath $DestinationIsoPath -WimPath $DestinationWimPath` - -`### The following is an example of how to burn the ISO to a writeable CD/DVD.``### Specify the correct drive letter and uncomment the statement to burn an ISO.``# Copy-DartImage -IsoPath $DestinationIsoPath -Drive "G:" -Type DVD` - -`### Removes all temporary files.``Remove-Item $TempMountPath -Force -Recurse` - -## Related topics - - -[Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/images/checklistbox.gif b/mdop/dart-v10/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/dart-v10/images/checklistbox.gif and /dev/null differ diff --git a/mdop/dart-v10/images/mbam-logo-sm.gif b/mdop/dart-v10/images/mbam-logo-sm.gif deleted file mode 100644 index 2102b4540c..0000000000 Binary files a/mdop/dart-v10/images/mbam-logo-sm.gif and /dev/null differ diff --git a/mdop/dart-v10/index.md b/mdop/dart-v10/index.md deleted file mode 100644 index 5d88fce5c0..0000000000 --- a/mdop/dart-v10/index.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 10 -description: Diagnostics and Recovery Toolset 10 -author: dansimp -ms.assetid: 64403eca-ff05-4327-ac33-bdcc96e706c8 -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Diagnostics and Recovery Toolset 10 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 lets you diagnose and repair a computer that cannot be started or that has problems starting as expected. By using DaRT 10, you can recover end-user computers that have become unusable, diagnose probable causes of issues, and quickly repair unbootable or locked-out computers. When it is necessary, you can also quickly restore important lost files and detect and remove malware, even when the computer is not online. - -DaRT 10 lets you create a DaRT recovery image in International Organization for Standardization (ISO) and Windows Imaging (WIM) file formats and burn the image to a CD, DVD, or USB. You can then use the recovery image files and deploy them locally or to a remote partition or a recovery partition. - -DaRT 10 is an important part of the Microsoft Desktop Optimization Pack (MDOP), a dynamic solution available to Software Assurance customers that helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[About DaRT 10](about-dart-10.md)**|**[Release Notes for DaRT 10](release-notes-for-dart-10.md)**|**[Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md)**|**[Accessibility for DaRT 10](accessibility-for-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md)**|**[DaRT 10 Supported Configurations](dart-10-supported-configurations.md)**|**[Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md)**|**[Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md)**|**[DaRT 10 Planning Checklist](dart-10-planning-checklist.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md)**|**[Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md)**|**[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md)**|**[DaRT 10 Deployment Checklist](dart-10-deployment-checklist.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md)**|**[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md)**|**[Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md)**|**[Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -### More Information - -[How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) -Get information about how to download DaRT. - -[Release Notes for DaRT 10](release-notes-for-dart-10.md) -View updated product information and known issues for DaRT 10. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/dart-v10/operations-for-dart-10.md b/mdop/dart-v10/operations-for-dart-10.md deleted file mode 100644 index fb618d7c09..0000000000 --- a/mdop/dart-v10/operations-for-dart-10.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for DaRT 10 -description: Operations for DaRT 10 -author: msfttracyp -ms.assetid: 1776d5ed-96c6-4841-a097-721d8cf5c7f7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for DaRT 10 - - -This section includes information about the various types of Microsoft Diagnostics and Recovery Toolset (DaRT) 10 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) - - This section provides instructions on how to use DaRT 10 to recover local or remote computers by using the DaRT recovery image. - -- [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - - This section explains how to open and run the Crash Analyzer on either an end-user or non-end-user computer to debug a memory dump file and then diagnose computer errors. - -- [Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) - - This section describes measures for maintaining security while using DaRT. - -- [Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - - This section lists the Windows PowerShell commands that administrators can use to perform various DaRT tasks. - -## Other resources for DaRT 10 operations - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md b/mdop/dart-v10/overview-of-the-tools-in-dart-10.md deleted file mode 100644 index 61ca954cfa..0000000000 --- a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md +++ /dev/null @@ -1,148 +0,0 @@ ---- -title: Overview of the Tools in DaRT 10 -description: Overview of the Tools in DaRT 10 -author: msfttracyp -ms.assetid: 752467dd-b646-4335-82ce-9090d4651f65 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of the Tools in DaRT 10 - - -From the **Diagnostics and Recovery Toolset** window in Microsoft Diagnostics and Recovery Toolset (DaRT) 10, you can start any of the individual tools that you include when you create the DaRT 10 recovery image. For information about how to access the **Diagnostics and Recovery Toolset** window, see [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md). - -If it is available, you can use the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to select the tool that best addresses your particular issue, based on a brief interview that the wizard provides. - -## Exploring the DaRT tools - - -A description of the DaRT 10 tools follows. - -### Computer Management - -**Computer Management** is a collection of Windows administrative tools that help you troubleshoot a problem computer. You can use the **Computer Management** tools in DaRT to view system information and event logs, manage disks, list autoruns, and manage services and drivers. The **Computer Management** console is customized to help you diagnose and repair problems that might be preventing the Windows operating system from starting. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Crash Analyzer - -Use the **Crash Analyzer Wizard** to quickly determine the cause of a computer failure by analyzing the memory dump file on the Windows operating system that you are repairing. **Crash Analyzer** examines the memory dump file for the driver that caused a computer to fail. You can then disable the problem device driver by using the **Services and Drivers** node in the **Computer Management** tool. - -The **Crash Analyzer Wizard** requires the Debugging Tools for Windows and symbol files for the operating system that you are repairing. You can include both requirements when you create the DaRT recovery image. If they are not included on the recovery image and you do not have access to them on the computer that you are repairing, you can copy the memory dump file to another computer and use the stand-alone version of **Crash Analyzer** to diagnose the problem. - -Running **Crash Analyzer** is a good idea even if you plan to reimage the computer. The image could have a defective driver that is causing problems in your environment. By running **Crash Analyzer**, you can identify problem drivers and improve the image stability. - -For more information about **Crash Analyzer**, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md). - -### Disk Commander - -**Disk Commander** lets you recover and repair disk partitions or volumes by using one of the following recovery processes: - -- Restore the master boot record (MBR) - -- Recover one or more lost volumes - -- Restore partition tables from **Disk Commander** backup - -- Save partition tables to **Disk Commander** backup - -**Warning**   -We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table. - - - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Disk Wipe - -You can use **Disk Wipe** to delete all data from a disk or volume, even the data that is left behind after you reformat a hard disk drive. **Disk Wipe** lets you select from either a single-pass overwrite or a four-pass overwrite, which meets current U.S. Department of Defense standards. - -**Warning**   -After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it. - - - -### Explorer - -The **Explorer** tool lets you browse the computer’s file system and network shares so that you can remove important data that the user stored on the local drive before you try to repair or reimage the computer. And because you can map drive letters to network shares, you can easily copy and move files from the computer to the network for safekeeping or from the network to the computer to restore them. - -### File Restore - -**File Restore** lets you try to restore files that were accidentally deleted or that were too big to fit in the Recycle Bin. **File Restore** is not limited to regular disk volumes, but can find and restore files on lost volumes or on volumes that are encrypted by BitLocker. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### File Search - -Before reimaging a computer, recovering files from the local hard disk is important, especially when the user might not have backed up or stored the files elsewhere. - -The **Search** tool opens a **File Search** window that you can use to find documents when you do not know the file path or to search for general kinds of files across all local hard disks. You can search for specific file-name patterns in specific paths. You can also limit results to a date range or size range. - -### Hotfix Uninstall - -The **Hotfix Uninstall Wizard** lets you remove hotfixes or service packs from the Windows operating system on the computer that you are repairing. Use this tool when a hotfix or service pack is suspected in preventing the operating system from starting. - -We recommend that you uninstall only one hotfix at a time, even though the tool lets you uninstall more than one. - -**Important**   -Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix. - - - -### Locksmith - -The **Locksmith Wizard** lets you set or change the password for any local account on the Windows operating system that you are analyzing or repairing. You do not have to know the current password. However, the password that you set must comply with any requirements that are defined by a local Group Policy Object. This includes password length and complexity. - -You can use **Locksmith** when the password for a local account, such as the local Administrator account, is unknown. You cannot use **Locksmith** to set passwords for domain accounts. - -### Registry Editor - -You can use **Registry Editor** to access and change the registry of the Windows operating system that you are analyzing or repairing. This includes adding, removing, and editing keys and values, and importing registry (.reg) files. - -**Warning**   -Serious problems can occur if you change the registry incorrectly by using **Registry Editor**. These problems might require you to reinstall the operating system. Before you make changes to the registry, you should back up any valued data on the computer. Change the registry at your own risk. - - - -### SFC Scan - -The **SFC Scan** tool starts the **System File Repair Wizard** and lets you repair system files that are preventing the installed Windows operating system from starting. The **System File Repair Wizard** can automatically repair system files that are corrupted or missing, or it can prompt you before it performs any repairs. - -### Solution Wizard - -The **Solution Wizard** presents a series of questions and then recommends the best tool for the situation, based on your answers. This wizard helps you determine which tool to use when you are not familiar with the tools in DaRT. - -### TCP/IP Config - -When you boot a problem computer into DaRT, it is set to automatically obtain its TCP/IP configuration (IP address and DNS server) from Dynamic Host Configuration Protocol (DHCP). If DHCP is unavailable, you can manually configure TCP/IP by using the **TCP/IP Config** tool. You first select a network adapter, and then configure the IP address and DNS server for that adapter. - -## Related topics - - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/planning-for-dart-10.md b/mdop/dart-v10/planning-for-dart-10.md deleted file mode 100644 index b8b88230b8..0000000000 --- a/mdop/dart-v10/planning-for-dart-10.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning for DaRT 10 -description: Planning for DaRT 10 -author: msfttracyp -ms.assetid: 2ca0249a-6a9f-4b4e-91f1-f1b34be7b16c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for DaRT 10 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 10 so that it does not disrupt your users or the network. - -Before you deploy DaRT 10, you should consider the different deployment configurations and prerequisites. This section includes information that can help you gather the information to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -- [Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - There are several deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -- [DaRT 10 Planning Checklist](dart-10-planning-checklist.md) - - This checklist can assist you in preparing your computing environment for the DaRT deployment. - -## Other resources for DaRT planning - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md deleted file mode 100644 index 0b4856b406..0000000000 --- a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Planning How to Save and Deploy the DaRT 10 Recovery Image -description: Planning How to Save and Deploy the DaRT 10 Recovery Image -author: msfttracyp -ms.assetid: 9a3e5413-2621-49ce-8bd2-992616691703 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning How to Save and Deploy the DaRT 10 Recovery Image - - -You can save and deploy the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image by using the following methods. When you are determining the method that you will use, consider the advantages and disadvantages of each. You should also consider your infrastructure and support staff. If you have a small infrastructure, you might want to deploy DaRT 10 by using removable media, since the recovery image will always be available if you install it to the local hard drive. - -If your organization uses Active Directory Domain Services (AD DS), you may want to deploy recovery images as a network service by using Windows DS. Recovery images are always available to any connected computer. You can deploy multiple images from Windows DS and maintain them all in one place. - -**Note**   -You may want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -The following table shows some advantages and disadvantages of each method of using DaRT in your organization. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Method to Boot into DaRTAdvantagesDisadvantages

          Removable Media

          -

          The recovery image is written to a CD, DVD, or USB drive to enable support staff to take the recovery tools with them to the unstable computer.

          Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk and supports cases in which there is no network connection.

          -

          Enables you to create multiple recovery images with different tools to provide different levels of support.

          -

          Provides a built-in tool for burning recovery images to removable media.

          Requires that support staff are physically at the end-user computer to boot into DaRT.

          -

          Requires time and maintenance to create multiple media with different configurations for 32-bit and 64-bit computers.

          From a remote (network) partition

          -

          The recovery image is hosted on a network boot server like Windows Deployment Services (Windows DS), which allows users or support staff to stream it to computers on demand.

          Available to all computers that have access to the network boot server.

          -

          Recovery images are hosted on a central server, which enables centralized updates.

          -

          Centralized help desk staff can provide repairs by using remote connectivity.

          -

          No local storage requirement on the clients.

          -

          Ability to create multiple recovery images with different tools for specific support levels.

          The need to secure Windows DS infrastructure to ensure that regular users can start only the DaRT recovery image and not the full operating system imaging process.

          -

          -

          -

          Requires that the end-user computer is connected to the network at runtime.

          -

          Requires that the recovery image is brought across the network.

          From a recovery partition on the local hard drive

          -

          The recovery image is installed on a local hard drive either manually or by using electronic software distribution systems like System Center Configuration Manager.

          The recovery image is always available because it is pre-staged on the computer.

          -

          Centralized help desk staff can provide support by using Remote Connection.

          -

          The recovery image is centrally managed and deployed.

          -

          Additional recovery key requests on computers that are protected by Windows BitLocker drive encryption are eliminated.

          Local storage is required.

          -

          A dedicated, unencrypted partition for recovery image placement is recommended to reduce the risk of a failed boot partition.

          -

          When updating DaRT, you must update all computers in your enterprise instead of just one partition (on the network) or removable device.

          -

          Additional consideration is required if you deploy the recovery image after BitLocker has been enabled.

          - - - -## Related topics - - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md deleted file mode 100644 index 25cd1696fb..0000000000 --- a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Planning to Create the DaRT 10 Recovery Image -description: Planning to Create the DaRT 10 Recovery Image -author: msfttracyp -ms.assetid: a0087d93-b88f-454b-81b2-3c7ce3718023 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Create the DaRT 10 Recovery Image - - -Use the information in this section when you are planning to create the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image. - -## Planning to create the DaRT 10 recovery image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. To make the decision, consider that end users may have access to those tools. If support engineers will take the recovery image media to end users’ computers to diagnose issues, you may want to install all of the tools on the recovery image. If you plan to diagnose end user’s computers remotely, you may want to disable some of the tools, such as Disk Wipe and Registry Editor, and then enable other tools, including Remote Connection. - -When you create the DaRT recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -For more information about the DaRT tools, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). For more information about how to help create a secure recovery image, see [Security Considerations for DaRT 10](security-considerations-for-dart-10.md). - -## Prerequisites for the recovery image - - -The following items are required or recommended for creating the DaRT recovery image: - - ---- - - - - - - - - - - - - - - - - - - -

          Prerequisite

          Details

          Windows 10 source files

          Required to create the DaRT recovery image. Provide the path of a Windows 10 DVD or of Windows 10 source files.

          Windows Debugging Tools for your platform

          Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: Download and Install Debugging Tools for Windows.

          Optional: Windows symbols files for use with Crash Analyzer

          Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see Diagnosing System Failures with Crash Analyzer.

          - - - -## Related topics - - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/planning-to-deploy-dart-10.md b/mdop/dart-v10/planning-to-deploy-dart-10.md deleted file mode 100644 index 8d3571fea4..0000000000 --- a/mdop/dart-v10/planning-to-deploy-dart-10.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning to Deploy DaRT 10 -description: Planning to Deploy DaRT 10 -author: msfttracyp -ms.assetid: 32a39e97-a889-4aae-982c-b85cdc3d9134 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy DaRT 10 - - -You should consider all of the different deployment configurations and prerequisites before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Review the DaRT 10 software prerequisites and supported configurations - - -After preparing your computing environment for DaRT 10 installation, make sure that you review the prerequisite software to install and the supported configurations to confirm that the selected computers for the installation meet the minimum hardware and operating system requirements. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md). - -[DaRT 10 Supported Configurations](dart-10-supported-configurations.md) - -## Plan for creating the DaRT 10 recovery image - - -Before you start to create the DaRT recovery image, you need to consider possible security issues, the tools that you want to include on the recovery image, and the prerequisite software that you need to install. - -[Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md) - -## Plan how to save and deploy the DaRT recovery image - - -There are several methods that you can use to save and deploy the DaRT recovery image. Before you start to create the recovery image, review the advantages and disadvantages of each method and consider how you want to use DaRT in your enterprise. - -[Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md) - -## Other resources for planning to deploy DaRT 10 - - -[Planning for DaRT 10](planning-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/recovering-computers-using-dart-10.md b/mdop/dart-v10/recovering-computers-using-dart-10.md deleted file mode 100644 index 1d901afe01..0000000000 --- a/mdop/dart-v10/recovering-computers-using-dart-10.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Recovering Computers Using DaRT 10 -description: Recovering Computers Using DaRT 10 -author: msfttracyp -ms.assetid: 2ad7fab0-c22d-4171-8b5a-b2b7d7c0ad2d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recovering Computers Using DaRT 10 - - -After deploying the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image, you can use DaRT 10 to recover computers. The information in this section describes the recovery tasks that you can perform. - -You have several different methods to choose from to boot into DaRT, depending on how you deploy the DaRT recovery image. - -- Insert a DaRT recovery image CD, DVD, or USB flash drive into the problem computer and use it to boot into the computer. - -- Boot into DaRT from a recovery partition on the problem computer. - -- Boot into DaRT from a remote partition on the network. - -For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md). - -Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - -**Note**   -Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -## Recover a local computer by using the DaRT recovery image - - -To recover a local computer by using DaRT, you must be physically present at the end-user computer that is experiencing problems that require DaRT. - -[How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md) - -## Recover a remote computer by using the DaRT recovery image - - -The Remote Connection feature in DaRT lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a help desk professional working on the end-user computer), the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**. - -The Remote Connection feature on the end-user computer creates the following connection information: a ticket number, a port, and a list of all available IP addresses. The ticket number and port are generated randomly. - -The IT administrator or help desk worker enters this information into the **DaRT Remote Connection Viewer** to establish the terminal services connection to the end-user computer. The terminal services connection that is established lets an IT administrator remotely interact with the DaRT tools on the end-user computer. The end-user computer then processes the connection information, shares its screen, and responds to instructions from the IT administrator computer. - -[How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md) - -## Other resources for recovering computers using DaRT 10 - - -[Operations for DaRT 10](operations-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/release-notes-for-dart-10.md b/mdop/dart-v10/release-notes-for-dart-10.md deleted file mode 100644 index 0308185c37..0000000000 --- a/mdop/dart-v10/release-notes-for-dart-10.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Release Notes for DaRT 10 -description: Release Notes for DaRT 10 -author: msfttracyp -ms.assetid: eb996980-f9c4-42cb-bde9-6b3d4b82b58c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for DaRT 10 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - -These release notes contain information that is required to successfully install Diagnostics and Recovery Toolset 10. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Known issues with DaRT 10 - - -### Disk Commander is unable to repair a corrupt master boot record in a physical partition in Windows 10 - -In Windows 10, the “Restore the Master Boot Record (MBR) or the header of the GUID Partition Table (GPT)” option in Disk Commander is unable to repair a corrupt master boot record in a physical partition, and therefore is unable to boot the client computer. - -**Workaround:** Start **Startup Repair**, click **Troubleshoot**, click **Advanced options**, and then click **Start repair**. - -### Multiple instances of Disk Wipe that target the same drive cause all instances except the last one to report a failure - -If you start multiple instances of Disk Wipe, and then try to wipe the same drive by using two separate Disk Wipe instances, all instances except the last one report a failure to wipe the drive. - -**Workaround:** None. - -### Disk Wipe may not clear all data on solid-state drives that have flash memory - -If you use Disk Wipe to clear data on a solid-state drive (SSD) that has flash memory, all of the data may not be erased. This issue occurs because the SSD firmware controls the physical location of writes while Disk Wipe is running. - -**Workaround:** None. - -### System restore fails when you run Locksmith Wizard or Registry Editor - -If you run Locksmith Wizard, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT, and then start System Restore. - -### System File Checker (SFC) Scan fails to run after you start and close Locksmith Wizard or Computer Management - -If you start and then close Locksmith Wizard or tools in Computer Management, System File Checker fails to run. - -**Workaround:** Close and restart DaRT, and then start System File Checker. - -### DaRT installer does not fail when the Windows Assessment and Deployment Kit is not installed - -If you install DaRT 10 by using the command line to run the Windows Installer (.msi), and the Windows Assessment and Deployment Kit (Windows ADK) has not been installed, the DaRT installation should fail. Currently, the DaRT 10 installer installs all components except the DaRT recovery image. - -**Workaround:** None. - -## Related topics - - -[About DaRT 10](about-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/security-and-privacy-for-dart-10.md b/mdop/dart-v10/security-and-privacy-for-dart-10.md deleted file mode 100644 index 93b66f3a76..0000000000 --- a/mdop/dart-v10/security-and-privacy-for-dart-10.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for DaRT 10 -description: Security and Privacy for DaRT 10 -author: msfttracyp -ms.assetid: 9ce5d555-c4e9-4482-a147-27b26579c935 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for DaRT 10 - - -Use the following information to help you plan for security and privacy considerations in Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - -## Security considerations for DaRT 10 - - -There are several security-related considerations that you should plan for when deploying and using DaRT in your environment. The information in this section provides a brief overview about the security-related considerations for DaRT. - -[Security Considerations for DaRT 10](security-considerations-for-dart-10.md) - -## Privacy considerations for DaRT 10 - - -The information in this section explains many of the data collection and use practices of DaRT. - -[DaRT 10 Privacy Statement](dart-10-privacy-statement.md) - -## Other resources for DaRT 10 security and privacy - - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/security-considerations-for-dart-10.md b/mdop/dart-v10/security-considerations-for-dart-10.md deleted file mode 100644 index fc0621ba83..0000000000 --- a/mdop/dart-v10/security-considerations-for-dart-10.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Security Considerations for DaRT 10 -description: Security Considerations for DaRT 10 -author: msfttracyp -ms.assetid: c653daf1-f12a-4667-98cc-f0c89fa38e3f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for DaRT 10 - - -This topic contains a brief overview about the accounts and groups, log files, and other security-related considerations for Microsoft Diagnostics and Recovery Toolset (DaRT) 10. For more information, follow the links within this article. - -## General security considerations - - -**Understand the security risks**. DaRT 10 includes functionality that lets an administrator or a help desk worker run the DaRT tools remotely to resolve problems on an end-user computer. In addition, you can save the International Organization for Standardization (ISO) image to a USB flash drive or put the ISO image on a network to include its contents as a recovery partition on a computer’s hard disk. These capabilities provide flexibility, but also create potential security risks that you should consider when configuring DaRT. - -**Physically secure your computers**. When administrators and help desk workers are not physically at their computers, they should lock their computers and use a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems by subscribing to the Security Notification service (). - -## Limit end-user access to DaRT tools - - -When you are creating the DaRT recovery image, you can select the tools that you want to include. For security reasons, you might want to restrict end-user access to the more powerful DaRT tools, such as Disk Wipe and Locksmith. In DaRT 10, you can disable certain tools during configuration and still make them available to help desk workers when the end user starts the Remote Connection feature. - -You can even configure the DaRT image so that the option to start a remote connection session is the only tool available to an end user. - -**Important**   -After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to any help desk worker who is working on the end–user computer. - - - -For more information about including tools in the DaRT recovery image, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). - -## Secure the DaRT recovery image - - -If you deploy the DaRT recovery image by saving it to a USB flash drive or by creating a remote partition or a recovery partition, you might want to include your company’s preferred method of drive encryption on the ISO. Encrypting the ISO helps to ensure that end users cannot use DaRT functionality if they were to gain access to the recovery image, and it ensures that unauthorized users cannot boot into DaRT on computers that belong to someone else. If you use an encryption method, be sure to deploy and enable it in all computers. - -**Note**   -DaRT 10 supports BitLocker natively. - - - -To include drive encryption, add the encryption solution files when you create the recovery image. Your encryption solution must be able to run on WinPE. End users who boot from the ISO are then able to access that encryption solution and unblock the drive. - -## Maintain security between two computers when you use Remote Connection - - -By default, the communication between two computers that have established a **Remote Connection** session may not be encrypted. Therefore, to help maintain security between the two computers, we recommend that both computers are a part of the same network. - -## Related topics - - -[Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/troubleshooting-dart-10.md b/mdop/dart-v10/troubleshooting-dart-10.md deleted file mode 100644 index 181fef10dd..0000000000 --- a/mdop/dart-v10/troubleshooting-dart-10.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting DaRT 10 -description: Troubleshooting DaRT 10 -author: msfttracyp -ms.assetid: 76d42a00-3f6b-4730-8857-39fe49535d37 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting DaRT 10 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to find troubleshooting content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting DaRT 10 - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v65.md b/mdop/dart-v65.md deleted file mode 100644 index 050094ae6f..0000000000 --- a/mdop/dart-v65.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 6.5 -description: Diagnostics and Recovery Toolset 6.5 -author: eavena -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 -ms.reviewer: -manager: dansimp -ms.author: eravena ---- - -# Diagnostics and Recovery Toolset 6.5 - -Selecting the link for [Diagnostics and Recovery Toolset 6.5 documentation](https://technet.microsoft.com/library/jj713388.aspx) will take you to another website. Use your browser's **Back** button to return to this page. diff --git a/mdop/dart-v7/TOC.md b/mdop/dart-v7/TOC.md deleted file mode 100644 index 5688dce81f..0000000000 --- a/mdop/dart-v7/TOC.md +++ /dev/null @@ -1,36 +0,0 @@ -# [Diagnostics and Recovery Toolset 7](index.md) -## [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) -### [About DaRT 7.0](about-dart-70-new-ia.md) -#### [Release Notes for DaRT 7.0](release-notes-for-dart-70-new-ia.md) -### [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md) -### [Accessibility for DaRT 7.0](accessibility-for-dart-70.md) -## [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) -### [Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) -#### [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md) -#### [Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md) -#### [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md) -### [DaRT 7.0 Planning Checklist](dart-70-planning-checklist-dart-7.md) -## [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) -### [Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) -#### [How to Deploy DaRT 7.0](how-to-deploy-dart-70.md) -#### [How to Change, Repair, or Remove DaRT 7.0](how-to-change-repair-or-remove-dart-70.md) -### [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) -#### [How to Use the DaRT Recovery Image Wizard to Create the Recovery Image](how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md) -#### [How to Create a Time Limited Recovery Image](how-to-create-a-time-limited-recovery-image-dart-7.md) -### [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) -#### [How to Deploy the DaRT Recovery Image Using a USB Flash Drive](how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md) -#### [How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md) -#### [How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md) -### [DaRT 7.0 Deployment Checklist](dart-70-deployment-checklist-dart-7.md) -## [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) -### [Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) -#### [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md) -#### [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md) -### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) -#### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md) -#### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md) -#### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md) -### [Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md) -## [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) -## [Technical Reference for DaRT 7.0](technical-reference-for-dart-70-new-ia.md) - diff --git a/mdop/dart-v7/about-dart-70-new-ia.md b/mdop/dart-v7/about-dart-70-new-ia.md deleted file mode 100644 index 7669450607..0000000000 --- a/mdop/dart-v7/about-dart-70-new-ia.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: About DaRT 7.0 -description: About DaRT 7.0 -author: msfttracyp -ms.assetid: 217ffafc-6d73-4b80-88d9-71870460d4ab -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About DaRT 7.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 helps you troubleshoot and repair Windows-based desktops. This includes those desktops that cannot be started. DaRT is a powerful set of tools that extend the Windows Recovery Environment (WinRE). By using DaRT, you can analyze an issue to determine its cause, for example, by inspecting the computer’s event log or system registry. - -DaRT also provides tools to help you fix a problem as soon as you determine the cause. For example, you can use the tools in DaRT to disable a faulty device driver, remove hotfixes, restore deleted files, and scan the computer for malware even when you cannot or should not start the installed Windows operating system. - -DaRT can help you quickly recover computers that are running either 32-bit or 64-bit versions of Windows 7, typically in less time than it would take to reimage the computer. - -## About the DaRT 7 Recovery Image - - -Functionality in DaRT lets you create a recovery image that is based on WinRE combined with a set of tools that DaRT provides. The DaRT recovery image takes advantage of WinRE, from which you can access the **Diagnostics and Recovery Toolset** window. - -Use the **DaRT Recovery Image Wizard** to create the DaRT recovery image. By default, the wizard creates an International Organization for Standardization (ISO) image file on your desktop that is named DaRT70.iso, although you can specify a different location and file name. The wizard also lets you burn the image to a CD or DVD. After you have finished the wizard, you can save the recovery image to a USB flash drive or save it in a format that you can use to create a remote partition or a recovery partition. - -When you have to use DaRT to startup an end-user computer that will not start, you can follow the instructions at [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md). - -For detailed information about the tools in DaRT, see [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md). - -## What’s New in DaRT 7 - - -DaRT 7 continues to support all the scenarios included in previous versions and it adds a new Remote Connection feature in addition to three new deployment options. - -### DaRT 7 Image Creation - -The wizard that you use to create DaRT ISO images is now called **DaRT Recovery Image** and it now supports an option to enable or disable the new Remote Connection feature. Remote Connection lets a helpdesk agent run the DaRT tools from a remote location. In previous releases, the helpdesk agent had to be physically present at the end-user computer to run the DaRT tools. - -The wizard also lets you customize the Welcome message for the Remote Connection feature (the message is shown when end users run the Remote Connection tool). IT Admins can also configure which Port Number should be used by Remote Connection. - -For more information about the **DaRT Recovery Image Wizard** or Remote Connection, see [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md). - -### DaRT 7 ISO Deployment - -In addition to burning to a CD or DVD, DaRT 7 adds three new options when you deploy the ISO that contains the DaRT recovery image: - -- USB flash drive deployment - -- Remote partition deployment - -- Recovery partition deployment - -The USB flash drive deployment option lets a company use DaRT on computers that do not have CD or DVD drives available. The recovery and remote partition options let end users have easy access to the DaRT image and to enable the Remote Connection functionality. - -For more information about how to deploy DaRT recovery images, see [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md). - -## Related topics - - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -[Release Notes for DaRT 7.0](release-notes-for-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/accessibility-for-dart-70.md b/mdop/dart-v7/accessibility-for-dart-70.md deleted file mode 100644 index afb83c0c70..0000000000 --- a/mdop/dart-v7/accessibility-for-dart-70.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for DaRT 7.0 -description: Accessibility for DaRT 7.0 -author: msfttracyp -ms.assetid: 41f7bb72-4f1d-44fb-bc3f-8b66557fec2f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for DaRT 7.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md deleted file mode 100644 index 2fa4e1973e..0000000000 --- a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Creating the DaRT 7.0 Recovery Image -description: Creating the DaRT 7.0 Recovery Image -author: msfttracyp -ms.assetid: ebb2ec58-0349-469d-a23f-3f944fe4c1fa -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating the DaRT 7.0 Recovery Image - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 includes the **DaRT Recovery Image Wizard** that is used in Windows to create a bootable International Organization for Standardization (ISO) image. An ISO image is a file that represents the raw contents of a CD. - -## Use the DaRT Recovery Image Wizard to Create the Recovery Image - - -The ISO created by the DaRT Recovery Image Wizard contains the DaRT recovery image that lets you boot into a problem computer, even if it might otherwise not start. After you boot the computer into DaRT, you can run the different DaRT tools to try to diagnose and repair the computer. - -You can write the ISO to a recordable CD or DVD, save it to a USB flash drive, or save it in a format that you can use to boot into DaRT from a remote partition or from a recovery partition. For more information, see [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md). - -**Note**   -If your computer includes a CD-RW drive, the wizard offers to burn the ISO image to a blank CD or DVD. If your computer does not include a drive that is supported by the wizard, you can burn the ISO image onto a CD or DVD by using most programs that can burn a CD or DVD. - - - -To create a bootable CD or DVD from the ISO image, you must have: - -- A CD-RW drive. - -- A recordable CD or DVD (in a format supported by the recordable drive). - -- Software that supports the recordable drive and supports burning an ISO image directly to CD or DVD. - - **Important**   - Test the CD or DVD that you create on all the different kinds of computers that you intend to support because some computers cannot start from all kinds of recordable media. - - - -To save the ISO image to a USB flash drive (UFD), you must have: - -- A correctly formatted UFD. - -- A program that you can use to mount the ISO image. - -[How to Use the DaRT Recovery Image Wizard to Create the Recovery Image](how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md) - -## Create a Time Limited Recovery Image - - -You can create a DaRT recovery image that can only be used for a certain number of days after it is generated. To do this, you must run the **DaRT Recovery Image Wizard** at a command prompt and specify the number of days. - -[How to Create a Time Limited Recovery Image](how-to-create-a-time-limited-recovery-image-dart-7.md) - -## Other resources for creating the DaRT 7 recovery image - - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md b/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md deleted file mode 100644 index fe7a329faa..0000000000 --- a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 7.0 Deployment Checklist -description: DaRT 7.0 Deployment Checklist -author: msfttracyp -ms.assetid: 2c68ec15-0624-4a75-8237-05c68b61ad07 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 7.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft Diagnostics and Recovery Toolset (DaRT) 7 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferences
          Checklist box

          Decide on the best DaRT 7 deployment option for your requirements and deploy it.

          Deploying DaRT 7.0 to Administrator Computers

          Checklist box

          Use the DaRT Recovery Image Wizard to create the DaRT recovery image ISO.

          Creating the DaRT 7.0 Recovery Image

          Checklist box

          Decide on the best DaRT 7 recovery image deployment option for your requirements and deploy it.

          Deploying the DaRT 7.0 Recovery Image

          - - - -## Related topics - - -[Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md b/mdop/dart-v7/dart-70-planning-checklist-dart-7.md deleted file mode 100644 index 5d125aafaf..0000000000 --- a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 7.0 Planning Checklist -description: DaRT 7.0 Planning Checklist -author: msfttracyp -ms.assetid: f97a2318-6597-4774-a854-bb546279a8fd -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 7.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Diagnostics and Recovery Toolset (DaRT) 7 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferences
          Checklist box

          Review the DaRT 7 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.

          DaRT 7.0 Supported Configurations

          Checklist box

          Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.

          Planning to Create the DaRT 7.0 Recovery Image

          Checklist box

          Determine which method, or methods, you will use to deploy the DaRT recovery image.

          Planning How to Save and Deploy the DaRT 7.0 Recovery Image

          - - - -## Related topics - - -[Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md b/mdop/dart-v7/dart-70-supported-configurations-dart-7.md deleted file mode 100644 index 5c0de66ee4..0000000000 --- a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: DaRT 7.0 Supported Configurations -description: DaRT 7.0 Supported Configurations -author: msfttracyp -ms.assetid: e9ee87b0-3254-4625-b178-17b2f5b8f8c8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 7.0 Supported Configurations - - -Your environment may already meet the configuration requirements provided here so that you can install and run Microsoft Diagnostics and Recovery Toolset (DaRT) 7. These include the following recovery image and disk space requirements. - -## DaRT 7 Recovery Image Requirements - - -No cross-platform recovery image creation is supported. The following table specifies the kind of recovery image that you should create and deploy in your enterprise: - - ---- - - - - - - - - - - - - - - - - -
          Platform and DaRT VersionRecovery Image Requirements

          64-Bit DaRT 7.0

          Create and use a 64-Bit DaRT recovery image.

          32-Bit DaRT 7.0

          Create and use a 32-Bit DaRT recovery image.

          - -  - -## DaRT 7 End-user Computer Requirements - - -The **Diagnostics and Recovery Toolset** window in DaRT requires that the destination computer use one of the following operating systems together with the specified amount of system memory available for DaRT: - - ---- - - - - - - - - - - - - - - - - - - - - -
          Operating SystemSystem Requirements for DaRT

          Windows 7 64-Bit (2GB)

          2.5GB of system memory

          Windows 7 32-Bit (1GB)

          1.5GB of system memory

          Windows Server 2008 R2 (512MB)

          1GB of system memory

          - -  - -DaRT also has the following minimal hardware requirements: - -- A CD or DVD drive or a USB port - - This is required if you are deploying DaRT in your enterprise by using a CD, DVD, or USB. - -- BIOS support for starting the computer from a CD or DVD, a USB flash drive, or from a remote or recovery partition - -## Related topics - - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/deploying-dart-70-new-ia.md b/mdop/dart-v7/deploying-dart-70-new-ia.md deleted file mode 100644 index 9612cbbec2..0000000000 --- a/mdop/dart-v7/deploying-dart-70-new-ia.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying DaRT 7.0 -description: Deploying DaRT 7.0 -author: msfttracyp -ms.assetid: 7bc99bce-b94f-4074-ba88-986ed76f8a6c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying DaRT 7.0 - - -There are a number of different deployment configurations that Microsoft Diagnostics and Recovery Toolset (DaRT) 7 supports. This section includes information you should consider about the deployment of DaRT 7 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment information - - -- [Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) - - This section provides information to help you decide on the best DaRT 7 deployment option for your requirements and then how to deploy it. - -- [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) - - This section provides information to help you use the DaRT Recovery Image Wizard to create the DaRT recovery image ISO. - -- [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - This section provides information to help you decide on the best DaRT 7 recovery image deployment option for your requirements and then how to deploy it. - -- [DaRT 7.0 Deployment Checklist](dart-70-deployment-checklist-dart-7.md) - - This section provides a deployment checklist that can help you in deploying and using DaRT 7. - -## Other resources for deploying DaRT 7 - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md b/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md deleted file mode 100644 index c8e61e3bbb..0000000000 --- a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Deploying DaRT 7.0 to Administrator Computers -description: Deploying DaRT 7.0 to Administrator Computers -author: msfttracyp -ms.assetid: 8baf26aa-b168-463c-810f-a165918b9d9f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying DaRT 7.0 to Administrator Computers - - -Before you begin the deployment of Microsoft Diagnostics and Recovery Toolset (DaRT) 7, review the requirements for your environment. This includes the hardware requirements for installing DaRT. For more information about DaRT hardware and software requirements, see [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md). - -The topics in this section can be used to help you deploy DaRT in your enterprise based on your environment and deployment strategy. - -## Deploy DaRT 7.0 to administrator computers - - -You can use the Windows Installer file for DaRT to install DaRT on a computer that you will use to first create the DaRT recovery image and then troubleshoot and fix end-user computers. Frequently, across an organization, you might install on the administrator computer only the DaRT functionality that you need to create a DaRT recovery image. Then, on a helpdesk administrator’s computer, you might install only the DaRT functionality that you must have to troubleshoot a problem computer, such as the DaRT Remote Connection Viewer and the Crash Analyzer. - -In addition to manually running the Windows Installer file to install DaRT, you can also install DaRT at the command prompt to support enterprise software deployment systems such as System Center Configuration Manager 2012. - -[How to Deploy DaRT 7.0](how-to-deploy-dart-70.md) - -## Change, repair, or remove DaRT 7.0 - - -You can change, repair, or remove the DaRT installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform or through the Windows Control Panel. - -[How to Change, Repair, or Remove DaRT 7.0](how-to-change-repair-or-remove-dart-70.md) - -## Other resources for Deploying the DaRT 7.0 to Administrator Computers - - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md deleted file mode 100644 index b5bdee5e77..0000000000 --- a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Deploying the DaRT 7.0 Recovery Image -description: Deploying the DaRT 7.0 Recovery Image -author: msfttracyp -ms.assetid: 6bba7bff-800f-44e4-bcfc-e143115607ca -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying the DaRT 7.0 Recovery Image - - -After you have created the International Organization for Standardization (ISO) file that contains the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 recovery image, you can deploy the DaRT recovery image throughout your enterprise so that it is available to end users and helpdesk agents. There are four supported methods that you can use to deploy the DaRT recovery image. - -- Burn the ISO image file to a CD or DVD - -- Save the contents of the ISO image file to a USB Flash Drive (UFD) - -- Extract the boot.wim file from the ISO image and deploy as a remote partition that is available to end-user computers - -- Extract the boot.wim file from the ISO image and deploy in the recovery partition of a new Windows 7 installation - -**Important**   -The **DaRT Recovery Image Wizard** only provides the option to burn a CD or DVD. All other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section. - - - -## Deploy the DaRT Recovery Image Using a USB Flash Drive - - -After you have finished running the DaRT Recovery Image Wizard, you can use the tool at to copy the ISO image file to a USB flash drive (UFD). - -[How to Deploy the DaRT Recovery Image Using a USB Flash Drive](how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md) - -## Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 7 image. - -[How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md) - -## Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -[How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md) - -## Other resources for maintaining Deploying the DaRT Recovery Image - - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md b/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md deleted file mode 100644 index 5376233690..0000000000 --- a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Diagnosing System Failures with Crash Analyzer -description: Diagnosing System Failures with Crash Analyzer -author: msfttracyp -ms.assetid: 170d40ef-4edb-4a32-a349-c285c0ea5e56 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Diagnosing System Failures with Crash Analyzer - - -The Crash Analyzer in Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets you debug a crash dump file on a Windows-based computer and then diagnose any related computer errors. The Crash Analyzer uses the Microsoft Debugging Tools for Windows to examine a crash dump file for the driver that caused the computer to fail. - -## Run the Crash Analyzer on an End-user Computer - - -Typically, you run Crash Analyzer from the Diagnostics and Recovery Toolset window on an end-user computer that has problems. The Crash Analyzer tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you included the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT recovery image, they should be available when you run the Crash Analyzer on the problem computer. - -[How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md) - -## Run the Crash Analyzer in stand-alone mode on a computer other than an end-user computer - - -The Crash Analyzer tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you did not include the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining them, then you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a helpdesk administrator’s computer. - -[How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md) - -## Ensure that Crash Analyzer can access symbol files - - -Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. - -Symbol files are automatically downloaded when you run Crash Analyzer. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md) - -## Other resources for diagnosing system failures with Crash Analyzer - - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md b/mdop/dart-v7/getting-started-with-dart-70-new-ia.md deleted file mode 100644 index fe540dcf08..0000000000 --- a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Getting Started with DaRT 7.0 -description: Getting Started with DaRT 7.0 -author: msfttracyp -ms.assetid: 796f52ce-0935-4d3d-9437-289b4c7b16c3 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with DaRT 7.0 - - -DaRT requires thorough planning before you deploy it or use its features. If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at [https://go.microsoft.com/fwlink/p/?LinkId=80347](https://go.microsoft.com/fwlink/?LinkId=80347). - -This section provides general information for administrators who are evaluating and using Microsoft Diagnostics and Recovery Toolset (DaRT) 7. - -**Note**   -A downloadable version of this document and the DaRT 7 Evaluation Guide can be downloaded from . - - - -## Getting Started With DaRT 7 - - -- [About DaRT 7.0](about-dart-70-new-ia.md) - - Provides information specifically related to DaRT including what is new in DaRT 7. - -- [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md) - - Provides general information about the tools in Microsoft Diagnostics and Recovery Toolset (DaRT) 7. - -- [Accessibility for DaRT 7.0](accessibility-for-dart-70.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md b/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md deleted file mode 100644 index 3a447a185e..0000000000 --- a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Change, Repair, or Remove DaRT 7.0 -description: How to Change, Repair, or Remove DaRT 7.0 -author: msfttracyp -ms.assetid: a65ff4f3-2b6d-4105-a7a0-67c87e8e7300 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change, Repair, or Remove DaRT 7.0 - - -You can change, repair, or remove the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform. - -You can also change, repair, or remove the DaRT installation using the Windows Control Panel by following the steps described in the procedure in this topic. - -**To change, repair, or remove DaRT** - -1. Click **Start** and then click **Control Panel**. - -2. Click **Programs and Features**. - -3. Click **Microsoft Diagnostics and Recovery Toolset 7.0** and then click the button that corresponds to the action that you want to perform. - -## Related topics - - -[Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md b/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md deleted file mode 100644 index b86616043e..0000000000 --- a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Create a Time Limited Recovery Image -description: How to Create a Time Limited Recovery Image -author: msfttracyp -ms.assetid: d2e29cac-c24c-4239-997f-0320b8a830ae -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Time Limited Recovery Image - - -You can create a DaRT recovery image that can only be used for a certain number of days after it is generated. To do this, you must run the **DaRT Recovery Image Wizard** at a command prompt and specify the number of days. - -**To create a recovery image that has a time limit** - -1. Open a Command Prompt with administrator credentials. - -2. Change the directory to the location of the ERDC.exe program. - -3. Using the following syntax, run the **DaRT Recovery Image Wizard**. *NumberOfDays* is a positive integer that represents the number of days that the DaRT recovery image will be usable. - - ``` syntax - ERDC /e NumberOfDays - ``` - -## Related topics - - -[Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/how-to-deploy-dart-70.md b/mdop/dart-v7/how-to-deploy-dart-70.md deleted file mode 100644 index 5ea5704612..0000000000 --- a/mdop/dart-v7/how-to-deploy-dart-70.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Deploy DaRT 7.0 -description: How to Deploy DaRT 7.0 -author: msfttracyp -ms.assetid: 30522441-40cb-4eca-99b4-dff758f5c647 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy DaRT 7.0 - - -This topic provides instructions to deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 7 in your environment. The first procedure in this topic assumes that you are installing all functionality on one administrator computer. When you need to deploy or uninstall DaRT on multiple computers, using an electronic software distribution system for example, it might be easier to use command line installation options. Those options are defined in the second procedure in this topic which provides example usage for the available command line options. - -**Important**   -Before you install DaRT, ensure that the computer meets the minimum system requirements listed in [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md). - - - -**To install DaRT on an administrator computer** - -1. Locate the DaRT installation files that you received as part of your software download. - -2. Double-click the DaRT installation file that corresponds to your system requirements, either 32-bit or 64-bit. The DaRT installation file is named **MSDaRT70.msi**. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Select the destination folder for installing DaRT, select whether DaRT should be installed for all users or just the current user, and then click **Next**. - -5. Select whether the installation should be **Typical**, **Custom**, or **Complete**, and then click **Next**. - - - **Typical** installs the tools that are most frequently used. This method is recommended for most users. - - - **Custom** lets you select the tools that are installed and where they will be installed. This is recommended for advanced users, especially if you are installing different DaRT tools on different helpdesk computers. - - - **Complete** installs all DaRT tools and requires the most disk space. - - After you have selected your method of installation, click **Next**. - -6. To start the installation, click **Install**. - -7. After the installation is completed successfully, click **Finish** to exit the wizard. - -**To install DaRT at the command prompt** - -1. The following example shows how to install all DaRT functionality. - - ``` syntax - msiexec /i MSDaRT70.msi ADDLOCAL=CommonFiles,MSDaRTHelp,DaRTRecoveryImage,CrashAnalyzer,RemoteViewer - ``` - -2. The following example shows how to install only the **DaRT Recovery Image Wizard**. - - ``` syntax - msiexec /i MSDaRT70.msi ADDLOCAL=CommonFiles,MSDaRTHelp,DaRTRecoveryImage - ``` - -3. The following example shows how to install only the Crash Analyzer and the DaRT Remote Connection Viewer. - - ``` syntax - msiexec /i MSDaRT70.msi ADDLOCAL=CommonFiles,MSDaRTHelp,CrashAnalyzer,RemoteViewer - ``` - -4. The following example creates a setup log for the Windows Installer. This is valuable for debugging. - - ``` syntax - msiexec.exe /i MSDaRT70.msi /l*v log.txt - ``` - -**Note**   -You can add /qn or /qb to any of the DaRT installation command prompt options to perform a silent installation. - - - -## Related topics - - -[Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md deleted file mode 100644 index 032c998a69..0000000000 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as a Remote Partition -description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: msfttracyp -ms.assetid: 757c9340-8eac-42e8-85de-4302e436713a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -**To deploy DaRT as a remote partition** - -1. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -2. Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise. - -3. Configure the WDS server to use the boot.wim file for DaRT by following your standard WDS deployment procedures. - -For more information about how to deploy DaRT as a remote partition, see the following: - -- [Walkthrough: Deploy an Image by Using PXE](https://go.microsoft.com/fwlink/?LinkId=212108) - -- [Windows Deployment Services Getting Started Guide](https://go.microsoft.com/fwlink/?LinkId=212106) - -## Related topics - - -[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md deleted file mode 100644 index 53d9e0c199..0000000000 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: msfttracyp -ms.assetid: 462f2d08-f03b-4a07-b2d3-c69205dc6f70 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 7 image. - -**To deploy DaRT in the recovery partition of a Windows 7 image** - -1. Create a target partition in your Windows 7 image that is equal to or greater than the size of the ISO image file that you created by using the **DaRT Recovery Image Wizard**. - - The minimum size required for a DaRT partition is approximately 300MB. However, we recommend 450MB to accommodate for the remote connection functionality in DaRT. - -2. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -3. Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image. - - For more information about how to create or customize a recovery partition, see [Customizing the Windows RE Experience](https://go.microsoft.com/fwlink/?LinkId=214222). - -4. Replace the target partition in your Windows 7 image with the recovery partition. - -After your Windows 7 image is ready, distribute the image to computers in your enterprise by using your company’s standard image deployment process. For more information about how to create a Windows 7 image, see [Building a Standard Image of Windows 7: Step-by-Step Guide](https://go.microsoft.com/fwlink/?LinkId=212103). - -For more information about how to deploy a recovery solution to reinstall the factory image in the event of a system failure, see [Deploy a System Recovery Image](https://go.microsoft.com/fwlink/?LinkId=214221). - -## Related topics - - -[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md deleted file mode 100644 index dec6b0ee1f..0000000000 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image Using a USB Flash Drive -description: How to Deploy the DaRT Recovery Image Using a USB Flash Drive -author: msfttracyp -ms.assetid: 5b7aa843-731e-47e7-b5f9-48d08da732d6 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image Using a USB Flash Drive - - -After you have finished running the **DaRT Recovery Image Wizard**, you can use the tool at to copy the ISO image file to a USB flash drive (UFD). - -You can also manually copy the ISO image file to a UFD by following the steps provided in this section. - -**To save the DaRT recovery image to a USB flash drive** - -1. Format the USB flash drive. - - 1. From a running valid operating system or Windows PE session, insert your UFD. - - 2. At the command prompt with administrator permissions, type **DISKPART** and then type **LIST DISK**. - - The Command Prompt window displays the disk number of your UFD, for example **DISK 1**. - - 3. Enter the following commands one at a time at the command prompt. - - ``` syntax - SELECT DISK 1 - CLEAN - CREATE PARTITION PRIMARY - SELECT PARTITION 1 - ACTIVE - FORMAT FS=NTFS - ASSIGN - EXIT - ``` - - **Note**   - The previous code example assumes Disk 1 is the UFD. If it is necessary, replace DISK 1 with your disk number. - - - -2. By using your company’s preferred method of mounting an image, mount the ISO image file that you created in the **Create Startup Image** dialog box of the **DaRT Recovery Image Wizard**. This requires that you have a method available to mount an image file. - -3. Open the mounted ISO image file and copy all its contents to the formatted USB flash drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the contents to the UFD. This lets you skip the need to mount the image. - - - -## Related topics - - -[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md b/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md deleted file mode 100644 index 97919ebdaf..0000000000 --- a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Ensure that Crash Analyzer Can Access Symbol Files -description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: msfttracyp -ms.assetid: 150a2f88-68a5-40eb-8471-e5008488ab6e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Ensure that Crash Analyzer Can Access Symbol Files - - -Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. - -Symbol files are automatically downloaded when you run the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Crash Analyzer. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -## Ensure access to symbol files - - -Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. - -Symbol files are automatically downloaded when you run **Crash Analyzer**. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -The following is a list of options that are available for guaranteeing access to symbol files: - -- **Copy the dump file to another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, copy the crash dump file to a computer that does have an Internet connection and run the stand-alone **Crash Analyzer Wizard** on that computer. - -- **Access the symbol files from another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, you can download the symbols from a computer that does have an Internet connection and then copy them to the computer that does not have an Internet connection, or you can map a network drive to a location where the symbols are available on the local network. If you run the **Crash Analyzer** in a Windows Recovery Environment (Windows RE), you can include the symbol files on the DaRT recovery image. For more information about how to create a recovery image, see [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md). - -- **Access symbol files through an HTTP proxy server.** If the symbols cannot be downloaded because an HTTP proxy server must be accessed, use the following steps to access an HTTP proxy server. In DaRT 7, the **Crash Analyzer Wizard** has a setting available on the **Specify Symbol Files Location** dialog page, marked with the label **Proxy server (optional, using the format "server:port")**. You can use this text box to specify a proxy server. Enter the proxy address in the form **<hostname>:<port>**, where the <**hostname**> is a DNS name or IP address, and the <**port**> is a TCP port number, usually 80. There are two modes in which the **Crash Analyzer** can be run. Following is how you use the proxy setting in each of these modes: - - - **Online mode:** In this mode, if the proxy server field is left blank, the wizard uses the proxy settings from Internet Options in Control Panel. If you enter a proxy address in the text box which is provided, that address will be used, and it will override the setting in the Internet Options. - - - **Windows Recovery Environment (Windows RE):** When you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window, there is no default proxy address. If the computer is directly connected to the Internet, a proxy address is not required. Therefore, you can leave this field blank in the wizard setting. If the computer is not directly connected to the Internet, and it is in a network environment that has a proxy server, you must set the proxy field in the wizard to access the symbol store. The proxy address can be obtained from the network administrator. Setting the proxy server is important only when the public symbol store is connected to the Internet. If the symbols are already on the DaRT recovery image, or if they are available locally, setting the proxy server is not required. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md deleted file mode 100644 index 3c5e049cc4..0000000000 --- a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: How to Recover Local Computers Using the DaRT Recovery Image -description: How to Recover Local Computers Using the DaRT Recovery Image -author: msfttracyp -ms.assetid: be29b5a8-be08-4cf2-822e-77a51d3f3b65 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover Local Computers Using the DaRT Recovery Image - - -To recover a local computer by using Microsoft Diagnostics and Recovery Toolset (DaRT) 7, you must be physically present at the end-user computer that is experiencing problems that require DaRT. You can also run DaRT remotely by following the instructions at [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md). - -**To recover a local computer by using DaRT** - -1. As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. You are asked whether you want to initialize network services. If you click **Yes**, it is assumed that a DHCP server is present on the network and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - To skip the network initialization process, click **No**. - -2. Following the network initialization dialog box, you are asked whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -3. Following the remapping dialog box, a **System Recovery Options** dialog box appears and asks you to select a keyboard layout. Then it displays the system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers. This prompts you to insert the installation media for the device and to select the driver. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 7 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -4. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created. - -You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides. - -For general information about any of the DaRT tools, see [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md). - -**To run DaRT at the command prompt** - -1. You can run DaRT at the command prompt by specifying the **netstart.exe** command and by using any of the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          -network

          Initializes the network services.

          -remount

          Remaps the drive letters.

          -prompt

          Displays messages asking the end user to specify whether to initialize the network and remap the drives.

          -
          - Important

          The end user’s response to the prompts overrides the -network and -remount switches.

          -
          -
          - -
          - - - -2. You can customize DaRT so that a computer that boots into DaRT automatically opens the **Remote Connection** tool that is used to establish a remote connection with the help desk. - -## Related topics - - -[Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md deleted file mode 100644 index 92044dc55f..0000000000 --- a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md +++ /dev/null @@ -1,196 +0,0 @@ ---- -title: How to Recover Remote Computers Using the DaRT Recovery Image -description: How to Recover Remote Computers Using the DaRT Recovery Image -author: msfttracyp -ms.assetid: 66bc45fb-dc40-4d47-b583-5bb1ff5c97a7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover Remote Computers Using the DaRT Recovery Image - - -The Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator or helpdesk agent can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important** -The two computers establishing a remote connection must be part of the same network. - - - -**To recover a remote computer by using DaRT** - -1. Boot an end-user computer by using the DaRT recovery image. - - You will typically use one of the following methods to boot into DaRT to recover a remote computer, depending on how you deploy the DaRT recovery image. For more information about deploying the DaRT recovery image, see [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md). - - - Boot into DaRT from a recovery partition on the problem computer. - - - Boot into DaRT from a remote partition on the network. - - For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md). - - Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - - **Note** - Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -2. As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. You are asked whether you want to initialize network services. If you click **Yes**, it is assumed that a DHCP server is present on the network and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - To skip the network initialization process, click **No**. - -3. Following the network initialization dialog box, you are asked whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. Following the remapping dialog box, a **System Recovery Options** dialog box appears and asks you to select a keyboard layout. Then it displays the system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers. This prompts you to insert the installation media for the device and to select the driver. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 7 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about this situation including how to resolve it, see [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md). - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -5. On the **System Recovery Options** window, select **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset** window. - -6. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**. - - The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information. - -7. On the helpdesk agent computer, open the **DaRT Remote Connection Viewer**. - - Click **Start**, click **All Programs**, click **Microsoft DaRT 7**, and then click **DaRT Remote Connection Viewer**. - -8. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information. - - **Note** - This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer. - - - -9. Click **Connect**. - -The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely. - -**Note** -A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32. - - - -**To customize the Remote Connection process** - -1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413). - - Specify the following commands and parameters to customize how a remote connection is established with an end-user computer: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandParameterDescription

          RemoteRecovery.exe

          -nomessage

          Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.

          WaitForConnection.exe

          none

          Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.

          -
          - Important

          This command serves no function if it is specified independently. It must be specified in a script to function correctly.

          -
          -
          - -
          - - - -2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT: - - ```ini - [LaunchApps] - "%windir%\system32\netstart.exe -network -remount" - "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage" - "%windir%\system32\WaitForConnection.exe" - "%SYSTEMDRIVE%\sources\recovery\recenv.exe" - ``` - -**To run the Remote Connection Viewer at the command prompt** - -1. You can run the **DaRT Remote Connection Viewer** at the command prompt by specifying the **DartRemoteViewer.exe** command and by using the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          -ticket=<ticketnumber>

          Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection.

          -ipaddress=<ipaddress>

          Where <ipaddress> is the IP address that is generated by Remote Connection.

          -port=<port>

          Where <port> is the port that corresponds to the specified IP address.

          - - - -~~~ -**Note** -The variables for these parameters are created on the end-user computer and must be provided by the end user. -~~~ - - - -2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified. - -## Related topics - - -[Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md deleted file mode 100644 index ca96b96fa2..0000000000 --- a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: msfttracyp -ms.assetid: 881d573f-2f18-4c5f-838e-2f5320179f94 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer - - -If you cannot access the Microsoft Debugging Tools for Windows or the symbol files on the end-user computer, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a helpdesk administrator’s computer. - -**To run the Crash Analyzer in stand-alone mode** - -1. On a computer with DaRT 7 installed, click **Start** / **All Programs** / **Microsoft DaRT 7**. - -2. Provide the required information for the following: - - - Microsoft Debugging Tools for Windows - - - Symbol files - - For more information about symbol files, see, [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md). - - - A crash dump file - - **Note**   - Use the Search tool in DaRT 7 to locate the copied crash dump file. - - - -3. The **Crash Analyzer** scans the crash dump file and reports a probable cause of the crash. You can view more information about the crash, such as the specific crash message and description, the drivers loaded at the time of the crash, and the full output of the analysis. - -4. Decide upon an appropriate strategy to resolve the problem. This may require disabling or updating the device driver that caused the crash by using the **Services and Drivers** node of the **Computer Management** tool in DaRT. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md deleted file mode 100644 index 1cd1277d48..0000000000 --- a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Run the Crash Analyzer on an End-user Computer -description: How to Run the Crash Analyzer on an End-user Computer -author: msfttracyp -ms.assetid: 40af4ead-6588-4a81-8eaa-3dc00c397e1d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer on an End-user Computer - - -Typically, you run Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Crash Analyzer from the Diagnostics and Recovery Toolset window on an end-user computer that has problems. The Crash Analyzer tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -**To open and run the Crash Analyzer on an end-user computer** - -1. On the **Diagnostics and Recovery Toolset** window on an end-user computer, click **Crash Analyzer**. - -2. Provide the required information for the following: - - - Microsoft Debugging Tools for Windows - - - Symbol files - - For more information about symbol files, see, [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md). - - - A crash dump file - - Follow these steps to determine the location of the crash dump file: - - 1. Open the **System Properties** window. - - Click **Start**, type sysdm.cpl, and then press Enter. - - 2. Click the **Advanced** tab. - - 3. In the **Startup and Recovery** area, click **Settings**. - - **Note**   - If you do not have access to the **System Properties** window, you can search for dump files on the end-user computer by using the **Search** tool in DaRT. - - - -3. The **Crash Analyzer** scans the crash dump file and reports a probable cause of the crash. You can view more information about the crash, such as the specific crash message and description, the drivers loaded at the time of the crash, and the full output of the analysis. - -4. Decide upon an appropriate strategy to resolve the problem. This may require disabling or updating the device driver that caused the crash by using the **Services and Drivers** node of the **Computer Management** tool in DaRT. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md b/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md deleted file mode 100644 index 68bcaa762b..0000000000 --- a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image -description: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image -author: msfttracyp -ms.assetid: 1b8ef983-fff9-4d75-a2f6-53120c5c00c9 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Use the DaRT Recovery Image Wizard to Create the Recovery Image - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 includes the **DaRT Recovery Image Wizard** that is used in Windows to create a bootable International Organization for Standardization (ISO) image. An ISO image is a file that represents the raw contents of a CD. - -The **DaRT Recovery Image Wizard** requires the following information: - -- **Boot Image**˚˚You must provide the path of a Windows 7 DVD or Windows 7 source files that are required to create the DaRT recovery image. - -- **Tool Selection**˚˚You can select the tools to include on the DaRT recovery image. - -- **Remote Connections**˚˚You can select whether you want the DaRT recovery image to include the ability to establish a remote connection between the helpdesk and the end-user computer. - -- **Debugging Tools for Windows**˚˚You are asked to provide the location of the Debugging Tools for Windows. - -- **Definitions for Standalone System Sweeper**˚˚You can decide whether to download the latest definitions at the time that you create the recovery image or download the definitions later. - -- **Drivers**˚˚You are asked whether you want to add drivers to the ISO image. - -- **Additional Files**˚˚You can add files to the ISO image that might help diagnose problems. - -- **ISO Image Location**˚˚You are asked to specify where the ISO image should be located. - -- **CD/DVD Drive**˚˚You are asked to specify whether the CD or DVD drive should be used to burn the CD or DVD. - -**Note**   -The ISO image size can vary, depending on the tools that were selected in the **DaRT Recovery Image Wizard**. - - - -## To create the recovery image using the DaRT Recovery Image Wizard - - -Follow these instructions to use the **DaRT Recovery Image Wizard** to create the DaRT recovery image. - -### To select the tools to include on the DaRT recovery image - -The **DaRT Recovery Image Wizard** presents a **Tool Selection** dialog box. You can select or remove tools from the list of tools to be included on the DaRT recovery image by highlighting a tool and then clicking the **Enable** or **Disable** buttons. - -After you have selected all the tools that you want to include on the recovery image, click **Next**. - -### To add the option to allow remote connectivity - -You can select the **Allow remote connections** check box to provide the option in the **Diagnostics and Recovery Toolset** window to establish a remote connection between the helpdesk agent and an end-user computer. After a helpdesk agent establishes a remote connection, they can run the DaRT tools on the end-user computer from a remote location. - -You can select the **Specify the port number** check box to enter a specific port number that will be used when establishing a remote connection. You can specify a port number between 1 and 65535. We recommend that the port number be 1024 or higher to minimize the possibility of a conflict. - -You can also create a customized message that an end user will receive when they establish a remote connection. The message can be a maximum of 2048 characters. - -For more information about remotely running the DaRT tools, see [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md). - -### To add the Debugging Tools for Windows to the DaRT recovery image - -In the **Crash Analyzer** dialog box of the **DaRT Recovery Image Wizard**, you are asked to specify the location of the Debugging Tools for Windows. If you do not have a copy of the tools, you can download them from Microsoft. The following link to the download page is provided in the wizard: [Download and Install Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=99934). - -You can either specify the location of the debugging tools on the computer where you are running the **DaRT Recovery Image Wizard**, or you can decide to use the tools that are located on the destination computer. If you decide to use a copy on another computer, you must make sure that the tools are installed on each computer on which you are diagnosing a crash. - -**Note**   -If you include the **Crash Analyzer** in the ISO image, we recommend that you also include the Debugging Tools for Windows. - - - -Follow these steps to add the Debugging Tools for Windows: - -1. (Optional) Click the hyperlink to download the Debugging Tools for Windows. - -2. Select one of the following options: - - - **Use the Debugging Tools for Windows in the following location**. If you select this option, you can browse to the location of the tools. - - - **Locate the Debugging Tools for Windows on the system that you are repairing**. If you select this option, the **Crash Analyzer** will not work if the Debugging Tools for Windows are not found on the problem computer. - -3. After you have finished, click **Next**. - -### To add definitions for Standalone System Sweeper to the DaRT recovery image - -Definitions are a repository of known malware and other potentially unwanted software. Because malware is being continually developed, **Standalone System Sweeper** relies on current definitions to determine whether software that is trying to install, run, or change settings on a computer is potentially unwanted or malicious software. - -To include the latest definitions in the DaRT recovery image (recommended), click **Yes, download the latest definitions.** The definition update starts automatically. You must be connected to the Internet to complete this process. - -To skip the definition update, click **No, manually download definitions later**. Definitions will not be included in the DaRT recovery image. - -If you decide not to include the latest definitions on the recovery image, or if the definitions included on the recovery image are no longer current by the time that you are ready to use **Standalone System Sweeper**, obtain the latest definitions before you begin a scan by following the instructions that are provided in the **Standalone System Sweeper**. - -**Important**   -You cannot scan if there are no definitions. - - - -After you have finished, click **Next**. - -### To add drivers to the DaRT recovery image - -**Caution**   -By default, when you add a driver to the DaRT recovery image, all additional files and subfolders that are located in that folder are added into the recovery image. For more information, see [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md). - - - -You should include additional drivers on the recovery image for DaRT 7 that you may need when repairing a computer. These may typically include storage or network controllers that are not included on the Windows DVD. - -**Important**   -When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT. - - - -**To add a storage or network controller driver to the recovery image** - -1. In the **Additional Drivers** dialog box of the **DaRT Recovery Image Wizard**, click **Add Device**. - -2. Browse to the file to be added for the driver, and then click **Open**. - - **Note**   - The **driver** file is provided by the manufacturer of the storage or network controller. - - - -3. Repeat Steps 1 and 2 for every driver that you want to include. - -4. After you have finished, click **Next**. - -### To add files to the DaRT recovery image - -Follow these steps to add files to the recovery image so that you can use them to diagnose computer problems. - -1. In the **Additional Files** dialog box of the **DaRT Recovery Image Wizard**, click **Show Files**. This opens an Explorer window that displays the folder that holds the shared files. - -2. Create a subfolder in the folder that is listed in the dialog box. - -3. Copy the files that you want to the new subfolder. - -4. After you have finished, click **Next.** - -### To select a location for the ISO that contains the DaRT recovery image - -Follow these steps to specify the location where the ISO image is created: - -1. In the **Create Startup Image** dialog box of the **DaRT Recovery Image Wizard**, click **Browse**. - -2. Browse to the preferred location in the **Save As** window, and then click **Save**. - -3. After you have finished, click **Next**. - -The size of the ISO image will vary, depending on the tools that you select and the files that you add in the wizard. - -The wizard requires the ISO image to have an **.iso** file name extension because most programs that burn a CD or DVD require that extension. If you do not specify a different location, the ISO image is created on your desktop with the name **DaRT70.ISO**. - -### To burn the recovery image to a CD or DVD - -If the **DaRT Recovery Image Wizard** detects a compatible CD-RW drive on your computer, it offers to burn the ISO image to a disc for you. If you want to burn a CD or DVD and the wizard does not recognize your drive, you must use another program, such as the program that was included with your drive. You can use a duplicator, a duplicating service, or CD or DVD-burning software to make any additional copies. - -1. In the **Burn to a recordable CD/DVD** dialog box of the **DaRT Recovery Image Wizard**, select **Burn the image to the following recordable CD/DVD drive**. - -2. Select the CD or DVD drive. - - **Note**   - If a drive is not recognized and you install a new drive, you can click **Refresh Drive List** to force the wizard to update the list of available drives. - - - -3. Click **Next**. - -## Related topics - - -[Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/images/checklistbox.gif b/mdop/dart-v7/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/dart-v7/images/checklistbox.gif and /dev/null differ diff --git a/mdop/dart-v7/index.md b/mdop/dart-v7/index.md deleted file mode 100644 index ba12a07c9d..0000000000 --- a/mdop/dart-v7/index.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 7 Administrator's Guide -description: Diagnostics and Recovery Toolset 7 Administrator's Guide -author: dansimp -ms.assetid: bf89eccd-fc03-48ff-9019-a8640e11dd99 -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Diagnostics and Recovery Toolset 7 Administrator's Guide - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets you diagnose and repair a computer that cannot be started or that has problems starting as expected. By using DaRT, you can recover end-user computers that have become unusable, diagnose probable causes of issues, and quickly repair unbootable or locked-out computers. When it is necessary, you can also quickly restore important lost files and detect and remove malware, even when the computer is not online. - -DaRT is an important part of the Microsoft Desktop Optimization Pack (MDOP), a dynamic solution available to Software Assurance customers that helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -[About DaRT 7.0](about-dart-70-new-ia.md)**|**[Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md)**|**[Accessibility for DaRT 7.0](accessibility-for-dart-70.md) - -[Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md)**|**[DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md)**|**[Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md)**|**[Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md)**|**[DaRT 7.0 Planning Checklist](dart-70-planning-checklist-dart-7.md) - -[Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -[Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md)**|**[Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md)**|**[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md)**|**[DaRT 7.0 Deployment Checklist](dart-70-deployment-checklist-dart-7.md) - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -[Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md)**|**[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md)**|**[Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md) - -[Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -[Technical Reference for DaRT 7.0](technical-reference-for-dart-70-new-ia.md) - -### More Information - -[Release Notes for DaRT 7.0](release-notes-for-dart-70-new-ia.md) -View updated product information and known issues for DaRT 7. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/dart-v7/operations-for-dart-70-new-ia.md b/mdop/dart-v7/operations-for-dart-70-new-ia.md deleted file mode 100644 index aaeec42f32..0000000000 --- a/mdop/dart-v7/operations-for-dart-70-new-ia.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Operations for DaRT 7.0 -description: Operations for DaRT 7.0 -author: msfttracyp -ms.assetid: 5566d817-fc14-4408-ba01-1d87fbc132d9 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for DaRT 7.0 - - -This section of the Administrator’s Guide includes information about the various types of Microsoft Diagnostics and Recovery Toolset (DaRT) 7 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) - - This section provides information to help you recover computers using the DaRT 7 recovery image. - -- [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - - This section provides information to help you use the DaRT 7 Crash Analyzer to diagnose system failures. - -- [Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md) - - This section provides information to help you follow security best practices while using DaRT 7. - -## Other resources for DaRT operations - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md b/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md deleted file mode 100644 index 945180ced9..0000000000 --- a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Overview of the Tools in DaRT 7.0 -description: Overview of the Tools in DaRT 7.0 -author: msfttracyp -ms.assetid: 67c5991e-cbe6-4ce9-9fe5-f1761369d1fe -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of the Tools in DaRT 7.0 - - -From the **Diagnostics and Recovery Toolset** window in Microsoft Diagnostics and Recovery Toolset (DaRT) 7, you can start any of the individual tools that were included when the DaRT recovery image was created. For information about how to access the **Diagnostics and Recovery Toolset** window, see [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md). - -If it is available, you can use the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to select the tool that best addresses your particular issue, based on a brief interview. - -## Exploring the DaRT Tools - - -This section describes the various tools that are part of DaRT. - -### Registry Editor - -You can use **Registry Editor** to access and change the registry of the Windows operating system that you are analyzing or repairing. This includes adding, removing, and editing keys and values, and importing registry (.reg) files. - -**Caution**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -### Locksmith - -The **Locksmith Wizard** lets you set or change the password for any local account on the Windows operating system that you are analyzing or repairing. You do not have to know the current password. However, the password that you set must comply with any requirements that are defined by a local Group Policy object. This includes password length and complexity. - -You can use **Locksmith** when the password for a local account, such as the local Administrator account, is unknown. You cannot use **Locksmith** to set passwords for domain accounts. - -### Crash Analyzer - -Use the **Crash Analyzer Wizard** to quickly determine the cause of a computer crash by analyzing the memory dump file on the Windows operating system that you are repairing. **Crash Analyzer** examines the crash dump file for the driver that caused a computer to fail. Then, you can disable the problem device driver by using the **Services and Drivers** node in the **Computer Management** tool. - -The **Crash Analyzer Wizard** requires the Debugging Tools for Windows and symbol files for the operating system that you are repairing. You can include both requirements when you create the DaRT recovery image. If they are not included on the recovery image and you do not have access to them on the computer that you are repairing, you can copy the memory dump file to another computer and use the stand-alone version of **Crash Analyzer** to diagnose the problem. - -Running **Crash Analyzer** is a good idea even if you plan to reimage the computer. The image could have a defective driver that is causing problems in your environment. By running **Crash Analyzer**, you can identify problem drivers and improve the image stability. - -For more information about **Crash Analyzer**, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md). - -### File Restore - -**File Restore** lets you try to restore files that were accidentally deleted or that were too big to fit in the Recycle Bin. **File Restore** is not limited to regular disk volumes, but can find and restore files on lost volumes or on volumes that are encrypted by BitLocker. - -### Disk Commander - -**Disk Commander** lets you recover and repair disk partitions or volumes by using one of the following recovery processes: - -- Restore the master boot record (MBR) - -- Recover one or more lost volumes - -- Restore partition tables from **Disk Commander** backup - -- Save partition tables to **Disk Commander** backup - -**Warning**   -We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table. - - - -### Disk Wipe - -You can use **Disk Wipe** to delete all data from a disk or volume, even the data that is left behind after you reformat a hard disk drive. **Disk Wipe** lets you select from either a single-pass overwrite or a four-pass overwrite, which meets current U.S. Department of Defense standards. - -**Warning**   -After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it. - - - -### Computer Management - -**Computer Management** is a collection of Windows administrative tools that help you troubleshoot a problem computer. You can use the **Computer Management** tools in DaRT to view system information and event logs, manage disks, list autoruns, and manage services and drivers. The **Computer Management** console is customized to help you diagnose and repair problems that might be preventing the Windows operating system from starting. - -### Explorer - -The **Explorer** tool lets you browse the computer’s file system and network shares so that you can remove important data that the user stored on the local drive before you try to repair or reimage the computer. And because you can map drive letters to network shares, you can easily copy and move files from the computer to the network for safekeeping or from the network to the computer to restore them. - -### Solution Wizard - -The **Solution Wizard** presents a series of questions and then recommends the best tool for the situation, based on your answers. This wizard helps you determine which tool to use when you are not familiar with the tools in DaRT. - -### TCP/IP Config - -When you boot a problem computer into DaRT, it is set to automatically obtain its TCP/IP configuration (IP address and DNS server) from Dynamic Host Configuration Protocol (DHCP). If DHCP is unavailable, you can manually configure TCP/IP by using the **TCP/IP Config** tool. You first select a network adapter, and then configure the IP address and DNS server for that adapter. - -### Hotfix Uninstall - -The **Hotfix Uninstall Wizard** lets you remove hotfixes or service packs from the Windows operating system on the computer that you are repairing. Use this tool when a hotfix or service pack is suspected in preventing the operating system from starting. - -We recommend that you uninstall only one hotfix at a time, even though the tool lets you uninstall more than one. - -**Important**   -Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix. - - - -### SFC Scan - -The **SFC Scan** tool starts the **System File Repair Wizard** and lets you repair system files that are preventing the installed Windows operating system from starting. The **System File Repair Wizard** can automatically repair system files that are corrupted or missing, or it can prompt you before it performs any repairs. - -### Search - -Before reimaging a computer, recovering files from the local hard disk is important, especially when the user might not have backed up or stored the files elsewhere. - -The **Search** tool opens a **File Search** window that you can use to find documents when you do not know the file path or to search for general kinds of files across all local hard disks. You can search for specific file-name patterns in specific paths. You can also limit results to a date range or size range. - -### Standalone System Sweeper - -**Important**   -Environments with the Standalone System Sweeper deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Standalone System Sweeper tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. - - - -The **Standalone System Sweeper** can help detect malware and unwanted software and warn you of security risks. You can use this tool to scan a computer for and remove malware even when the installed Windows operating system is not running. When the **Standalone System Sweeper** detects malicious or unwanted software, it prompts you to remove, quarantine, or allow for each item. - -Malware that uses rootkits can mask itself from the running operating system. If a rootkit-enabled virus or spyware is in a computer, most real-time scanning and removal tools can no longer see it or remove it. Because you boot the problem computer into DaRT and the installed operating system is offline, you can detect the rootkit without it being able to mask itself. - -### Remote Connection - -The **Remote Connection** tool in DaRT lets you remotely run the DaRT tools on an end-user computer. After certain specific information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -## Related topics - - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/planning-for-dart-70-new-ia.md b/mdop/dart-v7/planning-for-dart-70-new-ia.md deleted file mode 100644 index 69e7f032bb..0000000000 --- a/mdop/dart-v7/planning-for-dart-70-new-ia.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning for DaRT 7.0 -description: Planning for DaRT 7.0 -author: msfttracyp -ms.assetid: 9a60cb08-5efb-40fe-b1e3-9ece831f3b43 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for DaRT 7.0 - - -The goal of deployment planning is to successfully and efficiently deploy a product so that it does not disrupt your users or the network. - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -- [Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - - There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -- [DaRT 7.0 Planning Checklist](dart-70-planning-checklist-dart-7.md) - - This checklist can be used to help you plan for preparing your computing environment for DaRT 7 deployment. - -## Other resources for DaRT 7 Planning - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md deleted file mode 100644 index dfe697ea8f..0000000000 --- a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Planning How to Save and Deploy the DaRT 7.0 Recovery Image -description: Planning How to Save and Deploy the DaRT 7.0 Recovery Image -author: msfttracyp -ms.assetid: d96e9363-6186-4fc3-9b83-ba15ed9694a5 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning How to Save and Deploy the DaRT 7.0 Recovery Image - - -Use the information in this section when you plan for saving and deploying the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 recovery image. - -## Planning How to Save and Deploy the DaRT Recovery Image - - -You can save and deploy the DaRT recovery image by using the following methods. When you are determining the method that you will use, consider the advantages and disadvantages of each. Also, consider how you want to use DaRT in your enterprise. - -**Note**   -You might want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -The following table shows some advantages and disadvantages of each method of using DaRT in your organization. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Method to Boot into DaRTAdvantagesDisadvantages

          From a CD or DVD

          Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk. Also supports cases in which there is no network connection.

          -

          This is most familiar to users of earlier versions of DaRT, and a CD or DVD can be burned directly from the DaRT Recovery Image Wizard.

          Requires that someone with access to the CD or DVD is physically at the end-user computer to boot into DaRT.

          From a USB flash drive (UFD)

          Provides same advantages as booting from a CD or DVD and also provides support to computers that have no CD or DVD drive.

          Requires you to format the UFD before you can use it to boot into DaRT. Also requires that someone with access to the UFD is physically at the end-user computer to boot into DaRT.

          From a remote (network) partition

          Lets you boot into DaRT without needing a CD, DVD, or UFD. Also allows for easy upgrades of DaRT because there is only one file location to update.

          Does not work if the end-user computer is not connected to the network.

          -

          Widely available to end users and might require additional security considerations when you are creating the recovery image.

          From a recovery partition

          Lets you boot into DaRT without needing a CD, DVD, or UFD that includes instances in which there is no network connectivity.

          -

          Also, can be implemented and managed as part of your standard Windows image process by using automated distribution tools, such as System Center Configuration Manager.

          When updating DaRT, requires you to update all computers in your enterprise instead of just one partition (on the network) or device (CD, DVD, or UFD).

          - - - -## Related topics - - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - - - - - - - - - diff --git a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md deleted file mode 100644 index 3aa6ed872f..0000000000 --- a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning to Create the DaRT 7.0 Recovery Image -description: Planning to Create the DaRT 7.0 Recovery Image -author: msfttracyp -ms.assetid: e5d49bee-ae4e-467b-9976-c1203f6355f9 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Create the DaRT 7.0 Recovery Image - - -Use the information in this section when you plan for creating the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 recovery image. - -## Planning to Create the DaRT 7 Recovery Image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. When you make that decision, remember that end users might have access occasionally to the various DaRT tools. For more information about the DaRT tools, see [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md). For more information about how to help create a secure recovery image, see [Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md). - -When you create the DaRT recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -## Prerequisites - - -The following items are required or recommended for creating the DaRT recovery image: - -- Windows 7 source files - - You must provide the path of a Windows 7 DVD or of Windows 7 source files. Windows 7 source files are required to create the DaRT recovery image. - -- Windows Debugging Tools for your platform - - Windows Debugging Tools are required when you run **Crash Analyzer** to determine the cause of a computer crash. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. If it is necessary, you can download the Windows Debugging Tools here: [Download and Install Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=99934). - -- Optional: **Standalone System Sweeper** definitions - - The latest definitions for the **Standalone System Sweeper** are required when you run this tool. Although you can download the definitions when you run **Standalone System Sweeper**, we recommend that you download the latest definitions at the time you create the DaRT recovery image. In this manner, you can still run the tool with the latest definitions even if the problem computer does not have network connectivity. - -- Optional: Windows symbols files for use with **Crash Analyzer** - - Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. For more information, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md). - -## Related topics - - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/planning-to-deploy-dart-70.md b/mdop/dart-v7/planning-to-deploy-dart-70.md deleted file mode 100644 index 5fa805cf89..0000000000 --- a/mdop/dart-v7/planning-to-deploy-dart-70.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Planning to Deploy DaRT 7.0 -description: Planning to Deploy DaRT 7.0 -author: msfttracyp -ms.assetid: 05e97cdb-a8c2-46e4-9c75-a7d12fe26fe8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy DaRT 7.0 - - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -Consider the following when you plan your Microsoft Diagnostics and Recovery Toolset (DaRT) 7 installation: - -- When you install DaRT, you can either install all functionality on an IT administrator computer where you will perform all the tasks associated with running DaRT. Or you can install only the DaRT functionality that creates the recovery image on the IT administrator computer. Then, install the functionality used to run DaRT, such as the **DaRT Remote Connection Viewer** and **Crash Analyzer**, on a helpdesk agent computer. - -- To be able to run DaRT remotely, make sure that the helpdesk agent computer and all computers that you might be troubleshooting remotely are on the same network. - -- Before you roll out DaRT into production, you can first build a lab environment for testing. A test lab should include a minimum of two computers, one to act as the IT administrator/helpdesk agent computer and one to act as an end-user computer. Or, you can use three computers in your lab if you want to separate the IT administrator responsibilities from those of the helpdesk agent. - -## Review the supported configurations - - -You should review the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements. - -[DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md) - -## Plan for creating the DaRT recovery image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. When you make that decision, remember that end users might have access occasionally to the various DaRT tools. When you create the recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -You should be aware of the prerequisites and other additional planning recommendations for creating the DaRT recovery image. - -[Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md) - -## Plan for saving and deploying the DaRT recovery image - - -Several methods can be used to save and deploy the DaRT recovery image. When you are determining the method that you will use, consider the advantages and disadvantages of each. Also, consider how you want to use DaRT in your enterprise. - -**Note**   -You might want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -[Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md) - -## Other resources for Planning to Deploy DaRT - - -[Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md b/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md deleted file mode 100644 index e3e5f4824e..0000000000 --- a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Recovering Computers Using DaRT 7.0 -description: Recovering Computers Using DaRT 7.0 -author: msfttracyp -ms.assetid: bcded7ca-237b-4971-ac34-4394b05cbc50 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recovering Computers Using DaRT 7.0 - - -There are two methods available to recover computers using Microsoft Diagnostics and Recovery Toolset (DaRT) 7. You can either run the DaRT 7 recovery image locally or use The Remote Connection feature available in DaRT 7 to recover a remote computer. Both methods are described in more detail in this section. - -## Recover Local Computers by Using the DaRT Recovery Image - - -To recover a local computer by using DaRT 7, you must be physically present at the end-user computer that is experiencing problems that require DaRT. - -You have several different methods to choose from to boot into DaRT, depending on how you deploy the DaRT recovery image. - -- Insert a DaRT recovery image CD, DVD, or USB flash drive into the problem computer and use it to boot into the computer. - -- Boot into DaRT from a recovery partition on the problem computer. - -- Boot into DaRT from a remote partition on the network. - -For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md). - -Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - -**Note**   -Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -[How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md) - -## Recover Remote Computers by Using the DaRT Recovery Image - - -The Remote Connection feature in DaRT lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator or helpdesk agent can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**. - -The Remote Connection feature on the end-user computer creates the following connection information: a ticket number, a port, and a list of all available IP addresses. The ticket number and port are generated randomly. - -The IT administrator or helpdesk agent enters this information into the **DaRT Remote Connection Viewer** to establish the terminal services connection to the end-user computer. The terminal services connection that is established lets an IT administrator remotely interact with the DaRT tools on the end-user computer. The end-user computer then processes the connection information, shares its screen, and responds to instructions from the IT administrator computer. - -[How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md) - -## Other resources for recovering computers using DaRT 7 - - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md b/mdop/dart-v7/release-notes-for-dart-70-new-ia.md deleted file mode 100644 index 035b7570cf..0000000000 --- a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Release Notes for DaRT 7.0 -description: Release Notes for DaRT 7.0 -author: msfttracyp -ms.assetid: fad227d0-5c22-4efd-9187-0e5922f7250b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for DaRT 7.0 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 7. - -## About Microsoft Diagnostics and Recovery Toolset 7.0 - - -These release notes contain information that is required to successfully install DaRT 7 and contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT platform documentation, the latest change should be considered authoritative. These release notes supersede the content included with this product. - -## About the Product Documentation - - -Documentation for Microsoft Diagnostics and Recovery Toolset (DaRT) 7 is distributed with the product and on the Connect site. - -For detailed help about how to use the tools in DaRT 7, see the Help file available on the **Diagnostics and Recovery Toolset** menu. - -## Providing feedback - - -We are interested in your feedback on DaRT 7. You can send your feedback to dart7feedback@microsoft.com. This email address is not a support channel, but your feedback will help us to plan future changes for these tools to make them more useful to you in the future. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see [Microsoft Security](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with DaRT 7.0 - - -### SFC Scan cannot start if Standalone System Sweeper is open - -If the Standalone System Sweeper is running, SFC Scan cannot start or run because of a resource conflict between the two tools. - -**Workaround:** Close the Standalone System Sweeper before you try to open or run the SFC Scan tool. - -### Unicode characters may not be displayed in file names - -If you delete a file that has Unicode characters in its file name and try to restore the file by using the File Restore tool, the file is not found. This only occurs when you use characters from a language other than the language of the Windows DVD that was used to create the recovery image. - -**Workaround:** Make sure that the language that is used by DaRT matches the language that is used by the operating system from which it is trying to restore files. - -### DaRT command-line installation may fail silently - -DaRT command-line installation fails silently if run with the quiet mode option unless it is run by using elevated administrator permissions. - -**Workaround:** Run the command-line installation by using elevated administrator permissions. DaRT installation supports the typical Windows Installer options for command-line installation. Please see [Command-Line Options](https://go.microsoft.com/fwlink/?LinkId=160689) for Windows Installer for more information about the several available switches. - -### File Search cannot move a folder to a different volume - -Moving folders between volumes is not supported by the File Search application. If you try to move a folder to a different volume in File Search, the following error is returned: "An error occurred while writing the file *<filename>*. Make sure that the drive has sufficient space and the destination path is accessible." - -**Workaround:** Use the Explorer to move a folder to a different volume. - -### Some data may not be available on computers where the drive letters are remapped - -This problem can occur on BitLocker-enabled computers and multiboot computers. This occurs because some information in the offline registry has hard-coded drive letters, and DaRT uses different letters for the same volumes. The typical effects include not having access to certain local user accounts in Registry Editor. Additionally, some tools may be unable to obtain properties that rely on resolving file paths. - -**Workaround:** Use the option to remap the drive letters as DaRT starts. This usually aligns the typical drive letters to what is expected. - -### Hotfix Uninstall might not uninstall certain updates - -Some updates and service packs cannot be uninstalled because they are marked as un-installable or because they need to be uninstalled from within Windows 7. In these instances, the Hotfix Uninstall tool may indicate that these updates have been uninstalled even though they have not been. - -**Workaround:** Uninstall these problematic updates from Windows 7. - -### Disk Wipe: Disks with spanned volumes, striped volumes, or mirrored volumes cannot be deleted - -Disk Wipe does not support deleting disks that are spanned, mirrored, or striped across one or more volumes. - -**Workaround:** Select and delete each disk in the volume separately. - -## Release Notes Copyright Information - - -This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. This document is confidential and proprietary to Microsoft. It is disclosed and can be used only pursuant to a nondisclosure agreement. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - -## Related topics - - -[About DaRT 7.0](about-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md b/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md deleted file mode 100644 index fb406cc6b9..0000000000 --- a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Security Considerations for DaRT 7.0 -description: Security Considerations for DaRT 7.0 -author: msfttracyp -ms.assetid: 52ad7e6c-c169-4ba4-aa76-56335a585eb8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security Considerations for DaRT 7.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 includes functionality that lets an administrator run the DaRT tools remotely to resolve problems on an end-user computer. In earlier releases of DaRT, a help desk technician or administrator had to physically be at an end-user computer and boot into DaRT by using the CD or DVD that included the DaRT recovery image. Now, the help desk technician or administrator can perform the same procedures remotely. - -Also in DaRT 7, in addition to burning a CD or DVD, you are now able to save the International Organization for Standardization (ISO) image to a USB flash drive. You can also put the ISO image on a network or include its contents as a recovery partition on a computer hard disk. - -The **Remote Connection** feature in DaRT 7 lets end users access DaRT by using one of these new deployment methods. Therefore, they can more easily start DaRT and access the DaRT tools. - -The new functionalities in DaRT 7 provide much more flexibility in how you use DaRT in your enterprise. However, they also create their own set of security issues that must be addressed. We recommend that you consider the following security tips when you configure DaRT. - -## To help maintain security when you create the DaRT recovery image - - -When you are creating the DaRT recovery image, you can select the tools that you want to include. For security reasons, you might want to restrict end-user access to the more powerful DaRT tools, such as Disk Wipe and Locksmith. In DaRT 7, you can disable certain tools during configuration and still make them available to helpdesk agents when the end user starts the Remote Connection feature. - -You can even configure the DaRT image so that the option to start a remote connection session is the only tool available to an end user. - -**Important**   -After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to the helpdesk agent working on the end–user computer. - - - -For more information about including tools in the DaRT recovery image, see [How to Use the DaRT Recovery Image Wizard to Create the Recovery Image](how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md). - -## To help maintain security by encrypting the DaRT recovery image - - -If you use one of the deployment options new in DaRT 7, for example, saving to a USB flash drive or creating a remote partition or a recovery partition, you can include your company’s preferred method of drive encryption on the ISO. This will help make sure that an end user cannot use the functionality of DaRT should they gain access to the recovery image. And it will also make sure that unauthorized users cannot boot into DaRT on computers that belong to someone else. - -Your encryption method should be deployed and enabled in all computers. - -**Note**   -DaRT 7 supports BitLocker natively. - - - -## To help maintain security between two computers during Remote Connection - - -By default, the communication between two computers that have established a **Remote Connection** session may not be encrypted. Therefore, to help maintain security between the two computers, we recommend that both computers are a part of the same network. - -## Related topics - - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md b/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md deleted file mode 100644 index 747af0760b..0000000000 --- a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Technical Reference for DaRT 7.0 -description: Technical Reference for DaRT 7.0 -author: msfttracyp -ms.assetid: f55c7e5e-713a-42d1-84c9-88370155f934 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for DaRT 7.0 - - -This section includes technical reference information about Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 that provide additional information an administrator. - -## Other resources for DaRT operations - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md b/mdop/dart-v7/troubleshooting-dart-70-new-ia.md deleted file mode 100644 index 7f1942cf6c..0000000000 --- a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting DaRT 7.0 -description: Troubleshooting DaRT 7.0 -author: msfttracyp -ms.assetid: 24c50efa-e9ac-45c4-aca2-b1dcfe834fdd -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting DaRT 7.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting DaRT 7 - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/TOC.md b/mdop/dart-v8/TOC.md deleted file mode 100644 index e6b9c3194c..0000000000 --- a/mdop/dart-v8/TOC.md +++ /dev/null @@ -1,43 +0,0 @@ -# [Diagnostics and Recovery Toolset 8](index.md) -## [Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) -### [About DaRT 8.0](about-dart-80-dart-8.md) -#### [Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md) -### [About DaRT 8.0 SP1](about-dart-80-sp1.md) -#### [Release Notes for DaRT 8.0 SP1](release-notes-for-dart-80-sp1.md) -### [About DaRT 8.1](about-dart-81.md) -#### [Release Notes for DaRT 8.1](release-notes-for-dart-81.md) -### [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md) -### [Accessibility for DaRT 8.0](accessibility-for-dart-80-dart-8.md) -## [Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) -### [Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) -#### [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) -#### [Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md) -#### [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md) -### [DaRT 8.0 Planning Checklist](dart-80-planning-checklist-dart-8.md) -## [Deploying DaRT 8.0](deploying-dart-80-dart-8.md) -### [Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) -#### [How to Deploy DaRT 8.0](how-to-deploy-dart-80-dart-8.md) -#### [How to Change, Repair, or Remove DaRT 8.0](how-to-change-repair-or-remove-dart-80-dart-8.md) -### [Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) -### [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) -#### [How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md) -#### [How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md) -### [DaRT 8.0 Deployment Checklist](dart-80-deployment-checklist-dart-8.md) -## [Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) -### [Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) -#### [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md) -#### [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md) -### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) -#### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md) -#### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md) -#### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md) -### [Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) -#### [Security Considerations for DaRT 8.0](security-considerations-for-dart-80--dart-8.md) -#### [DaRT 8.0 Privacy Statement](dart-80-privacy-statement-dart-8.md) -### [Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) -#### [How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md) -#### [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md) -## [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) -## [Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md) -### [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md) - diff --git a/mdop/dart-v8/about-dart-80-dart-8.md b/mdop/dart-v8/about-dart-80-dart-8.md deleted file mode 100644 index 75405ef53f..0000000000 --- a/mdop/dart-v8/about-dart-80-dart-8.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: About DaRT 8.0 -description: About DaRT 8.0 -author: msfttracyp -ms.assetid: ce91efd6-7d78-44cb-bb8f-1f43f768ebaa -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 8.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 helps you troubleshoot and repair Windows-based computers. This includes those computers that cannot be started. DaRT 8.0 is a powerful set of tools that extend the Windows Recovery Environment (WinRE). By using DaRT, you can analyze an issue to determine its cause, for example, by inspecting the computer’s event log or system registry. DaRT supports the recovery of basic hard disks that contain partitions, for example, primary partitions and logical drives, and supports the recovery of volumes. - -**Note**   -DaRT does not support the recovery of dynamic disks. - - - -DaRT also provides tools to help you fix a problem as soon as you determine the cause. For example, you can use the tools in DaRT to disable a faulty device driver, remove hotfixes, restore deleted files, and scan the computer for malware even when you cannot or should not start the installed Windows operating system. - -DaRT can help you quickly recover computers that are running either 32-bit or 64-bit versions of Windows 8, typically in less time than it would take to reimage the computer. - -Functionality in DaRT lets you create a recovery image. The recovery image starts Windows Recovery Environment (Windows RE), from which you can start the **Diagnostics and Recovery Toolset** window and access the DaRT tools. - -Use the **DaRT Recovery Image Wizard** to create the DaRT recovery image. By default, the wizard creates an International Organization for Standardization (ISO) image file and a Windows Imaging Format (WIM) file and let you burn the image to a CD, DVD, or USB. You can deploy the image locally at end user’s computers, or you can deploy it from a remote network partition or a recovery partition on the local hard drive. - -## What’s new in DaRT 8.0 - - -DaRT 8.0 can help you quickly recover computers that are running either 32-bit or 64-bit versions of Windows 8, typically in less time than it would take to reimage the computer. DaRT 8.0 has the following new features. - -### Create DaRT images by using Windows 8 or Windows Server 2012 - -DaRT 8.0 enables you to create DaRT images using either Windows® 8 or Windows Server® 2012. For versions of Windows earlier than Windows 8 and Windows Server 2012, customers should continue to use earlier versions of DaRT. - -### Generate both 32- and 64-bit images from one computer - -DaRT 8.0 enables you to generate both 32-bit and 64-bit images from a single computer that is running DaRT, regardless of whether the computer is a 32-bit or 64-bit computer. In DaRT 7, the image that was created had to be the same, bit-wise, as the computer that was running DaRT. - -### Create one image that supports computers that have either a BIOS or UEFI interface - -DaRT 8.0’s support for both the Unified Extensible Firmware Interface (UEFI) and BIOS interfaces enables you to create just one image that works with computers that have either interface. - -### Use a GUID partition table (GPT) for partitioning - -DaRT 8.0 tools now support Windows 8 GPT disks, which provide a more flexible mechanism for partitioning disks than the older master boot record (MBR) partitioning scheme. DaRT 8.0 tools continue to support MBR partitioning. - -### Install Windows 8 and Windows Server 2012 on the local hard disk - -DaRT 8.0 tools can be used only when Windows 8 and Windows Server 2012 are installed on the local hard disk. Currently, there is no support for Windows To Go. - -### DaRT 8.0 release notes - -For more information, and for late-breaking news that did not make it into the documentation, see the [Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md). - -## How to Get DaRT 8.0 - - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/about-dart-80-sp1.md b/mdop/dart-v8/about-dart-80-sp1.md deleted file mode 100644 index c6bec15027..0000000000 --- a/mdop/dart-v8/about-dart-80-sp1.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: About DaRT 8.0 SP1 -description: About DaRT 8.0 SP1 -author: msfttracyp -ms.assetid: 2e166444-4097-4b23-9f50-d8819f1f4960 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 8.0 SP1 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Service Pack 1 (SP1) provides the following enhancements, which are described in this topic. - -**Translation of Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 into Ten Languages plus English** - -DaRT 8.0 is now available in the following languages, in addition to English: - -- French (FR) - -- Italian (IT) - -- German (DE) - -- Spanish (ES) - -- Korean (KO) - -- Japanese (JA) - -- Brazilian Portuguese (PT-BR) - -- Russian (RU) - -- Chinese Traditional (ZH-TW) - -- Chinese Simplified (ZH-CN) - -**Updates to the DaRT Defender tool** - -Defender has been updated to include improved protection capabilities. The changes do not impact how you use Defender. - -**Customer feedback rollup** - -DaRT 8.0 SP1 includes a rollup of fixes to address issues found since the DaRT 8.0 release. - -## How to Get DaRT 8.0 SP1 - - -DaRT 8.0 SP1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Release Notes for DaRT 8.0 SP1](release-notes-for-dart-80-sp1.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/about-dart-81.md b/mdop/dart-v8/about-dart-81.md deleted file mode 100644 index 9af17ffe96..0000000000 --- a/mdop/dart-v8/about-dart-81.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: About DaRT 8.1 -description: About DaRT 8.1 -author: msfttracyp -ms.assetid: dcaddc57-0111-4a9d-8be9-f5ada0eefa7d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 8.1 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1 provides the following enhancements, which are described in this topic. - -## What’s new - - -- **Support for WIMBoot** - - Diagnostics and Recovery Toolset 8.1 supports the Windows image file boot (WIMBoot) environment if these conditions are met: - - - WIMBoot is based on Windows 8.1 Update 1 or later. - - - The DaRT 8.1 image is built on Windows 8.1 Update 1 or later. - - For more information about WIMBoot, see [Windows Image File Boot (WIMBoot) Overview](https://go.microsoft.com/fwlink/?LinkId=517536). - -- **Support for Windows Server 2012 R2 and Windows 8.1** - - You can create DaRT images by using Windows Server 2012 R2 or Windows 8.1. - - **Note** - For earlier versions of the Windows Server and Windows operating systems, continue to use the earlier versions of DaRT. - - - -- **Customer feedback** - - DaRT 8.1 includes updates that address issues found since the DaRT 8.0 SP1 release. - -- **Windows Defender** - - Windows Defender in Windows 8.1 includes improved protection. The changes do not impact how you use DaRT with Windows Defender. - -## Requirements - - -- **Windows Assessment and Development Kit 8.1** - - Windows Assessment and Development Kit (ADK) 8.1 is a required prerequisite for the DaRT Recovery Image Wizard. Windows ADK 8.1 contains deployment tools that are used to customize, deploy, and service Windows images. It also contains the Windows Preinstallation Environment (Windows PE). - - **Note** - Windows ADK 8.1 is not required if you are installing only Remote Connection Viewer or Crash Analyzer. - - - -~~~ -To download Windows ADK 8.1, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1](https://www.microsoft.com/download/details.aspx?id=39982) in the Microsoft Download Center. -~~~ - -- **Microsoft .NET Framework 4.5.1** - - DaRT 8.1 requires that .NET Framework 4.5.1 is installed. To download, see [Microsoft.NET Framework 4.5.1](https://go.microsoft.com/fwlink/?LinkId=329038) in the Microsoft Download Center. - -- **Windows 8.1 Debugging Tools** - - To use the Crash Analyzer tool in DaRT 8.1, you need the required debugging tools, which are available in the Software Development Kit for Windows 8.1. - - To download, see [Windows Software Development Kit (SDK) for Windows 8.1](https://msdn.microsoft.com/library/windows/desktop/bg162891.aspx) in the Microsoft Download Center. - -## Language availability - - -DaRT 8.1 is available in the following languages: - -- English (United States) en-US - -- French (France) fr-FR - -- Italian (Italy) it-IT - -- German (Germany) de-DE - -- Spanish, International Sort (Spain) es-ES - -- Korean (Korea) ko-KR - -- Japanese (Japan) ja-JP - -- Portuguese (Brazil) pt-BR - -- Russian (Russia) ru-RU - -- Chinese Traditional zh-TW - -- Chinese Simplified zh-CN - -## How to Get MDOP Technologies - - -DaRT 8.1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Release Notes for DaRT 8.1](release-notes-for-dart-81.md) - - - - - - - - - diff --git a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md b/mdop/dart-v8/accessibility-for-dart-80-dart-8.md deleted file mode 100644 index dedbc23dc8..0000000000 --- a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for DaRT 8.0 -description: Accessibility for DaRT 8.0 -author: msfttracyp -ms.assetid: 95f426de-222c-4ec0-9b9b-af817c7fff9b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for DaRT 8.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in alternative formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer service for people with hearing impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For more information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md b/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md deleted file mode 100644 index 1aaf5e577a..0000000000 --- a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Administering DaRT 8.0 Using PowerShell -description: Administering DaRT 8.0 Using PowerShell -author: msfttracyp -ms.assetid: 776430e0-d5c9-4919-877a-fab503451b37 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering DaRT 8.0 Using PowerShell - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 lets you use PowerShell commands to complete various DaRT 8.0 administrative tasks or to create the DaRT recovery image. - -## Perform DaRT tasks by using PowerShell commands - - -DaRT 8.0 provides four PowerShell commands that let you do the following: - -- Burn an ISO to a CD, DVD, or USB drive. - -- Allow the source WIM file, which contains a DaRT image, to be converted into an ISO file. - -- Create a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image. - -- Apply a DartConfiguration object to a mounted Windows Image. - -[How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md) - -## Use a PowerShell script to create the recovery image - - -Rather than use the DaRT Recovery Image wizard to create the recovery image, you can use a PowerShell script and specify the parameters you want. - -[How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md) - -## Other resources for administering DaRT 8.0 using PowerShell - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md deleted file mode 100644 index cec64c5c0e..0000000000 --- a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md +++ /dev/null @@ -1,290 +0,0 @@ ---- -title: Creating the DaRT 8.0 Recovery Image -description: Creating the DaRT 8.0 Recovery Image -author: msfttracyp -ms.assetid: 39001b8e-86c0-45ef-8f34-2d6199f9922d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/21/2017 ---- - - -# Creating the DaRT 8.0 Recovery Image - - -After installing Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0, you create a DaRT 8.0 recovery image. The recovery image starts Windows RE, from which you can then start the DaRT tools. You can generate International Organization for Standardization (ISO) files and Windows Imaging Format (WIM) images. In addition, you can use PowerShell to generate scripts that use the settings you select in the DaRT Recovery Image wizard. You can use the script later to rebuild recovery images by using the same settings. The recovery image provides a variety of recovery tools. For a description of the tools, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). - -After you boot the computer into DaRT, you can run the different DaRT tools to try to diagnose and repair the computer. This section walks you through the process of creating the DaRT recovery image and lets you select the tools and features that you want to include as part of the image. - -You can create the DaRT recovery image by using either of two methods: - -- Use the DaRT Recovery Image wizard, which runs in a Windows environment. - -- Modify an example PowerShell script with the values you want. For more information, see [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md). - -You can write the ISO to a recordable CD or DVD, save it to a USB flash drive, or save it in a format that you can use to boot into DaRT from a remote partition or from a recovery partition. - -Once you have created the ISO image, you can burn it onto a blank CD or DVD (if your computer has a CD or DVD drive). If your computer does not have a drive for this purpose, you can use most generic programs that are used to burn CDs or DVDs. - -## Select the image architecture and specify the path - - -On the Windows 8 Media page, you select whether to create a 32-bit or 64-bit DaRT recovery image. Use the 32-bit Windows to build 32-bit DaRT recovery images, and 64-bit Windows to build 64-bit DaRT recovery images. You can use a single computer to create recovery images for both architecture types, but you cannot create one image that works on both 32-bit and 64-bit architectures. You also indicate the path of the Windows 8 installation media. Choose the architecture that matches the one of the recovery image that you are creating. - -**To select the image architecture and specify the path** - -1. On the **Windows 8 Media** page, select one of the following: - - - If you are creating a recovery image for 64-bit computers, select **Create x64 (64-bit) DaRT image**. - - - If you are creating a recovery image for 32-bit computers, select **Create x86 (32-bit) DaRT image**. - -2. In the **Specify the root path of the Windows 8 <64-bit or 32-bit> install media** box, type the path of the Windows 8 installation files. Use a path that matches the architecture of the recovery image that you are creating. - -3. Click **Next**. - -## Select the tools to include on the recovery image - - -On the Tools page, you can select numerous tools to include on the recovery image. These tools will be available to end users when they boot into the DaRT image. However, if you enable remote connectivity when creating the DaRT image, all of the tools will be available when a help desk worker connects to the end user’s computer, regardless of which tools you chose to include on the image. - -To restrict end-user access to these tools, but still retain full access to the tools through the Remote Connection Viewer, do not select those tools on the Tools page. End users will be able to use only Remote Connection and will be able to see, but not access, any tools that you exclude from the recovery image. - -**To select the tools to include on the recovery image** - -1. On the **Tools** page, select the check box beside each tool that you want to include on the image. - -2. Click **Next**. - -## Choose whether to allow remote connectivity by a help desk - - -On the Remote Connection page, you can choose to enable a help desk worker to remotely connect to and run the DaRT tools on an end user’s computer. The remote connectivity option is then shown as an available option in the Diagnostics and Recovery Toolset window. After help desk workers establish a remote connection, they can run the DaRT tools on the end-user computer from a remote location. - -**To choose whether to allow remote connectivity by help desk workers** - -1. On the **Remote Connection** page, select the **Allow remote connections** check box to allow remote connections, or clear the check box to prevent remote connections. - -2. If you cleared the **Allow remote connections** check box, click **Next**. Otherwise, go to the next step to continue configuring remote connectivity. - -3. Select one of the following: - - - Let Windows choose an open port number. - - - Specify the port number. If you select this option, enter a port number between 1 and 65535 in the field beneath the option. This port number will be used when establishing a remote connection. We recommend that the port number be 1024 or higher to minimize the possibility of a conflict. - -4. (Optional) in the **Remote connection welcome** message box, create a customized message that end users receive when they establish a remote connection. The message can be a maximum of 2048 characters. - -5. Click **Next**. - - For more information about running the DaRT tools remotely, see [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md). - -## Add drivers to the recovery image - - -On the Drivers tab of the Advanced Options page, you can add additional device drivers that you may need when repairing a computer. These may typically include storage or network controllers that Windows 8 does not provide. Drivers are installed when the image is created. - -**Important**   -When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT. - - - -**To add drivers to the recovery image** - -1. On the **Advanced Options** page, click the **Drivers** tab. - -2. Click **Add**. - -3. Browse to the file to be added for the driver, and then click **Open**. - - **Note**   - The driver file is provided by the manufacturer of the storage or network controller. - - - -4. Repeat Steps 2 and 3 for every driver that you want to include. - -5. Click **Next**. - -## Add WinPE optional packages to the recovery image - - -On the WinPE tab of the Advanced Options page, you can add WinPE optional packages to the DaRT image. These packages are part of the Windows ADK, which is an installation prerequisite for the DaRT Recovery Image wizard. The tools that you can select are all optional. Any required packages are added automatically, based on the tools you selected on the Tools page. - -You can also specify the size of the scratch space. Scratch space is the amount of RAM disk space that is set aside for DaRT to run. The scratch space is useful in case the end user’s hard disk is not available. If you are running additional tools and drivers, you may want to increase the scratch space. - -**To add WinPE optional packages to the recovery image** - -1. On the **Advanced Options** page, click the **WinPE** tab. - -2. Select the check box beside each package that you want to include on the image, or click the **Name** check box to select all of the packages. - -3. In the **Scratch Space** field, select the amount of RAM disk space to allocate for running DaRT in case the end user’s hard disk is not available. - -4. Click **Next**. - -## Add the debugging tools for Crash Analyzer - - -If you include the Crash Analyzer tool in the ISO image, you must also include the Debugging Tools for Windows. On the Crash Analyzer tab of the Advanced Options page, you enter the path of the Windows 8 Debugging Tools, which Crash Analyzer uses to analyze memory dump files. You can use the tools that are on the computer where you are running the DaRT Recovery Image wizard, or you can use the tools that are on the end-user computer. If you decide to use the tools on the end-user computer, remember that every computer that you diagnose must have the Debugging Tools installed. - -If you installed the Microsoft Windows Software Development Kit (SDK) or the Microsoft Windows Development Kit (WDK), the Windows 8 Debugging Tools are added to the recovery image by default, and the path to the Debugging Tools is automatically filled in. You can change the path of the Windows 8 Debugging Tools if the files are located somewhere other than the location indicated by the default file path. A link in the wizard lets you download and install debugging tools for Windows if they are not already installed. - -To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). Install the Debugging Tools to the default location. - -**Note**   -The DaRT wizard checks for the tools in the `HKLM\Software\Microsoft\Windows Kits\Installed Roots\WindowsDebuggersRoot` registry key. If the registry value is not there, the wizard looks in one of the following locations, depending on your system architecture: - -`%ProgramFilesX86%\Windows Kits\8.0\Debuggers\x64` - -`%ProgramFilesX86%\Windows Kits\8.0\Debuggers\x86` - - - -**To add the debugging tools for Crash Analyzer** - -1. On the **Advanced Options** page, click the **Crash Analyzer** tab. - -2. (Optional) Click **Download the Debugging Tools** to download the Debugging Tools for Windows. - -3. Select one of the following options: - - - **Include the Windows 8 <64-bit or 32-bit> Debugging Tools**. If you select this option, browse to and select the location of the tools if the path is not already displaying. - - - **Use the Debugging Tools from the system that is being debugged**. If you select this option, the Crash Analyzer will not work if the Debugging Tools for Windows are not found on the problem computer. - -4. Click **Next**. - -## Add definitions for the Defender tool - - -On the Defender tab of the Advanced Options page, you add definitions, which are used by the Defender tool to determine whether software that is trying to install, run, or change settings on a computer is unwanted or malicious software. - -**To add definitions for the Defender tool** - -1. On the **Advanced Options** page, click the **Defender** tab. - -2. Select one of the following options: - - - **Download the latest definitions (Recommended)** – The definition update starts automatically, and the definitions are added to the DaRT recovery image. This option is recommended to help you avoid cases where the definitions might not be available. You must be connected to the Internet to download the definitions. - - - **Download the definitions later** – Definitions will not be included in the DaRT recovery image, and you will need to download the definitions from the computer that is running DaRT. - - If you decide not to include the latest definitions on the recovery image, or if the definitions included on the recovery image are no longer current by the time that you are ready to use Defender, obtain the latest definitions before you begin a scan by following the instructions that are provided in Defender. - - **Important**   - You cannot scan if there are no definitions. - - - -3. Click **Next**. - -## Select the types of recovery image files to create - - -On the Create Image page, you choose an output folder for the recovery image, enter an image name, and select the types of DaRT recovery image files to create. During the recovery image creation process, Windows source files are unpacked, DaRT files are copied to it, and the image is then “re-packed” into the file formats that you select on this page. - -The available image file types are: - -- **Windows Imaging File (WIM)** - used to deploy DaRT to a preboot execution environment (PXE) or local partition). - -- **ISO image file** – used to deploy to CD or DVD, or for use in virtual machines (VM)s). The wizard requires that the ISO image have an .iso file name extension because most programs that burn a CD or DVD require that extension. If you do not specify a different location, the ISO image is created on your desktop with the name DaRT8.ISO. - -- **PowerShell script** – creates a DaRT recovery image with commands that provide essentially the same options that you can select by using the DaRT Recovery Image wizard. The script also enables you to add or changes files in the DaRT recovery image. - -If you select the Edit Image check box on this page, you can customize the recovery image during the image creation process. For example, you can change the “winpeshl.ini” file to create a custom startup order or to add third-party tools. - -**To select the types of recovery image files to create** - -1. On the **Create Image** page, click **Browse** to choose the output folder for the image file. - - **Note**   - The size of the image will vary, depending on the tools that you select and the files that you add in the wizard. - - - -2. In the **Image name** box, enter a name for the DaRT recovery image, or accept the default name, which is DaRT8. - - The wizard creates a subfolder in the output path by this name. - -3. Select the types of image files that you want to create. - -4. Choose one of the following: - - - To change the files in the recovery image before you create the image files, select the **Edit Image** check box, and then click **Prepare**. - - - To create the recovery image without changing the files, click **Create**. - -5. - - Click **Next**. - -## Edit the recovery image files - - -You can edit the recovery image only if you selected the Edit Image check box on the Create Image page. After the recovery image has been prepared for editing, you can add and modify the recovery image files before creating the bootable media. For example, you can create a custom order for startup, add various third-party tools, and so on. - -**To edit the recovery image files** - -1. On the **Edit Image** page, click **Open** in Windows Explorer. - -2. Create a subfolder in the folder that is listed in the dialog box. - -3. Copy the files that you want to the new subfolder, or remove files that you don’t want. - -4. Click **Create** to start creating the recovery image. - -## Generate the recovery image files - - -On the Generate Files page, the DaRT recovery image is generated for the file types that you selected on the Create Image page. - -**To generate the recovery image files** - -- On the **Generate Files** page, click **Next** to generate the recovery image files. - -## Copy the recovery image to a CD, DVD, or USB - - -On the Create Bootable Media page, you can optionally copy the image file to a CD, DVD, or USB flash drive (UFD). You can also create additional bootable media from this page by restarting the wizard. - -**Note**   -The Preboot execution environment (PXE) and local image deployment are not supported natively by this tool since they require additional enterprise tools, such as System Center Configuration Manager server and Microsoft Development Toolkit. - - - -**To copy the recovery image to a CD, DVD, or USB** - -1. On the **Create Bootable Media** page, select the iso file that you want to copy. - -2. Insert a CD, DVD, or USB, and then select the drive. - - **Note**   - If a drive is not recognized and you install a new drive, you can click **Refresh** to force the wizard to update the list of available drives. - - - -3. Click the **Create Bootable Media** button. - -4. To create another recovery image, click Restart, or click **Close** if you have finished creating all of the media that you want. - -## Related topics - - -[Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md b/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md deleted file mode 100644 index 94c522e8cb..0000000000 --- a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 8.0 Deployment Checklist -description: DaRT 8.0 Deployment Checklist -author: msfttracyp -ms.assetid: 74e071fb-697c-463f-adce-d09b8d86495f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 8.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferences
          Checklist box

          Decide on the best DaRT 8.0 deployment option for your requirements and deploy it.

          Deploying DaRT 8.0 to Administrator Computers

          Checklist box

          Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO.

          Creating the DaRT 8.0 Recovery Image

          Checklist box

          Decide on the best DaRT 8.0 recovery image deployment option for your requirements and deploy it.

          Deploying the DaRT Recovery Image

          - - - -## Related topics - - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md b/mdop/dart-v8/dart-80-planning-checklist-dart-8.md deleted file mode 100644 index d94a6d2c8c..0000000000 --- a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 8.0 Planning Checklist -description: DaRT 8.0 Planning Checklist -author: msfttracyp -ms.assetid: 0a0f5a71-b1d6-424c-8174-fc5aad506928 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 8.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferences
          Checklist box

          Review the DaRT 8.0 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.

          DaRT 8.0 Supported Configurations

          Checklist box

          Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.

          Planning to Create the DaRT 8.0 Recovery Image

          Checklist box

          Determine which method, or methods, you will use to deploy the DaRT recovery image.

          Planning How to Save and Deploy the DaRT 8.0 Recovery Image

          - - - -## Related topics - - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md b/mdop/dart-v8/dart-80-privacy-statement-dart-8.md deleted file mode 100644 index 0be261d833..0000000000 --- a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: DaRT 8.0 Privacy Statement -description: DaRT 8.0 Privacy Statement -author: msfttracyp -ms.assetid: db474241-e44e-4bca-9be4-3557a3614c2a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 8.0 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Diagnostics and Recovery Toolset (“DaRT”). This disclosure focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft Diagnostics and Recovery Toolset (“DaRT”) enables administrators to easily recover PCs that have become unusable, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems, all faster than the average time it takes to reimage the machine. When necessary, you can also quickly restore critical lost files. This release provides support for Windows 8 Beta as well as improvements on image creation and new hardware and software coverage. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by DaRT may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -The privacy details for each DaRT feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please [contact us](https://go.microsoft.com/fwlink/?LinkID=245853). - -Microsoft PrivacyMicrosoft CorporationOne Microsoft WayRedmond, Washington 98052 USA - -## Specific Features - - -## Microsoft Update - - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Use of Information:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Update Services Privacy Statement at [https://go.microsoft.com/fwlink/?LinkId=244000](https://go.microsoft.com/fwlink/?LinkId=244400). - -## Windows Defender Offline - - -**What This Feature Does:** - -Windows Defender Offline (WDO) is included in the DaRT download. WDO helps protect your PC from malicious software (malware) such as viruses, spyware, and other potentially harmful software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the WDO Privacy Statement at [https://go.microsoft.com/fwlink/?LinkId=246081](https://go.microsoft.com/fwlink/?LinkID=211807). - -**Use of Information:** - -For details about what information is collected and how it is used, see the WDO Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Windows Defender Offline Privacy Statement at . - -## Related topics - - -[Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md b/mdop/dart-v8/dart-80-supported-configurations-dart-8.md deleted file mode 100644 index f659803a79..0000000000 --- a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md +++ /dev/null @@ -1,307 +0,0 @@ ---- -title: DaRT 8.0 Supported Configurations -description: DaRT 8.0 Supported Configurations -author: msfttracyp -ms.assetid: 95d68e5c-d202-4f4a-adef-d2098328172e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 8.0 Supported Configurations - - -This topic specifies the prerequisite software and supported configurations requirements that are necessary to install and run Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 in your environment. Both the operating system requirements and the system requirements that are required to run DaRT 8.0 are specified. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md). - -For supported configurations that apply to later releases, see the documentation for the applicable release. - -You can install DaRT in one of two ways. You can install all functionality on an IT administrator computer, where you will perform all the tasks associated with running DaRT. Alternatively, you can install, on the administrator computer, only the DaRT functionality that creates the recovery image, and then install the functionality used to run DaRT (that is, the DaRT Remote Connection Viewer) on a help desk computer. - -## DaRT 8.0 prerequisite software - - -Make sure that the following prerequisites are met before you install DaRT. - -### Administrator computer prerequisites - -The following table lists the installation prerequisites for the administrator computer when you are installing DaRT 8.0 and all of the DaRT tools. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Windows Assessment and Development Kit (ADK)

          Required for the DaRT Recovery Image wizard. Contains the Deployment Tools, which are used to customize, deploy, and service Windows images, and contains the Windows Preinstallation Environment (Windows PE). The ADK is not required if you are installing only the Remote Connection Viewer and/or Crash Analyzer.

          .NET Framework 4.5

          Required by the DaRT Recovery Image wizard.

          Windows Development Kit OR Software Development Kit (optional)

          Crash Analyzer requires the Windows 8 Debugging Tools from the Windows Driver Kit to analyze memory dump files.

          Windows 8 64-bit ISO image

          DaRT requires the Windows Recovery Environment (Windows RE) image from the Windows 8 media. Download the 32-bit or 64-bit version of Windows 8, depending on the type of DaRT recovery image you want to create. If you support both system types in your environment, download both versions of Windows 8.

          - - - -### Help desk computer prerequisites - -The following table lists the installation prerequisites for the help desk computer when you are running the DaRT 8.0 Remote Connection Viewer. - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          DaRT 8.0 Remote Connection Viewer

          Must be installed on a Windows 8 operating system.

          NET Framework 4.5

          Required by the DaRT Recovery Image wizard

          Debugging Tools for Windows

          Required only if you are installing the Crash Analyzer tool

          - - - -### End-user computer prerequisites - -There is no prerequisite software that must be installed on end-user computers, other than the Windows 8 operating system. - -## DaRT operating system requirements - - -### Administrator computer system requirements - -The following table lists the operating systems that are supported for the DaRT administrator computer installation. - -**Note**   -Make sure that you allocate enough space for any additional tools that you want to install on the administrator computer. - - - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirement for Running DaRT

          Windows 8

          All editions

          N/A

          64-bit

          2 GB

          2.5 GB

          Windows 8

          All editions

          N/A

          32-bit

          1 GB

          1.5 GB

          Windows Server 2012

          Standard, Enterprise, Data Center

          N/A

          64-bit

          512 MB

          1 .0 GB

          - - - -### DaRT help desk computer system requirements - -If you allow a help desk to remotely troubleshoot computers, you must have the Remote Connection Viewer installed on the help desk computer. You can optionally install the Crash Analyzer tool on the help desk computer. - -DaRT 8.0 enables a help desk worker to connect to a DaRT 8.0 computer by using either the DaRT 7.0 or DaRT 8.0 Remote Connection Viewer. The DaRT 7.0 Remote Connection Viewer requires a Windows 7 operating system, while the DaRT 8.0 Remote Connection Viewer requires Windows 8. The DaRT 8.0 Remote Connection Viewer and all other DaRT 8.0 tools can be installed only on a computer running Windows 8. - -The following table lists the operating systems that are supported for the DaRT help desk computer installation. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements for Running DaRT

          Windows 8

          All editions

          N/A

          64-bit

          2 GB

          2.5 GB

          Windows 8 (with Remote Connection Viewer 8.0 only)

          All editions

          N/A

          32-bit

          1 GB

          1.5 GB

          Windows 7 (with Remote Connection Viewer 7.0 only)

          All editions

          SP1, SP2

          64-bit or 32-bit

          1 GB

          N/A

          Windows Server 2012

          Standard, Enterprise, Data Center

          N/A

          64-bit

          51

          1.0 GB

          - - - -DaRT also has the following minimum hardware requirements for the end-user computer: - -A CD or DVD drive or a USB port - required only if you are deploying DaRT in your enterprise by using a CD, DVD, or USB. - -BIOS support for starting the computer from a CD or DVD, a USB flash drive, or from a remote or recovery partition. - -### DaRT end-user computer system requirements - -The Diagnostics and Recovery Toolset window in DaRT requires that the end-user computer use one of the following operating systems together with the specified amount of system memory available for DaRT: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements

          Windows 8

          All editions

          N/A

          64-bit

          2 GB

          2.5 GB

          Windows 8

          All editions

          N/A

          32-bit

          1 GB

          1.5 GB

          Windows Server 2012

          Standard, Enterprise, Data Center

          N/A

          64-bit

          512 MB

          1.0 GB

          - - - -## Related topics - - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/deploying-dart-80-dart-8.md b/mdop/dart-v8/deploying-dart-80-dart-8.md deleted file mode 100644 index c6a3f6f118..0000000000 --- a/mdop/dart-v8/deploying-dart-80-dart-8.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Deploying DaRT 8.0 -description: Deploying DaRT 8.0 -author: msfttracyp -ms.assetid: 5a976d4e-3372-4ef6-9095-1b48e99af21b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 8.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 supports a number of different deployment configurations. This section includes information you should consider about the deployment of DaRT 8.0 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment Information - - -- [Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) - - This section describes the different DaRT deployment options for your requirements and explains how to deploy them. - -- [Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) - - This section describes the methods you can use to create the DaRT recovery image and provides instructions to create the recovery image by using the DaRT Recovery Image wizard. - -- [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) - - This section provides information to help you decide on the best DaRT recovery image deployment option for your requirements and provides instructions on how to deploy the recovery image. - -- [DaRT 8.0 Deployment Checklist](dart-80-deployment-checklist-dart-8.md) - - This section contains a deployment checklist that can help you to deploy DaRT. - -### How to get DaRT - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/p/?LinkId=322049) (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -## Other Resources for deploying DaRT - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md b/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md deleted file mode 100644 index ddd014d2eb..0000000000 --- a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying DaRT 8.0 to Administrator Computers -description: Deploying DaRT 8.0 to Administrator Computers -author: msfttracyp -ms.assetid: f918ead8-742e-464a-8bf6-1fcedde66cae -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 8.0 to Administrator Computers - - -Before you begin the deployment of Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0, review the requirements for your environment. This includes the hardware requirements for installing DaRT 8.0. For more information about DaRT hardware and software requirements, see [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md). - -The topics in this section can be used to help you deploy DaRT in your enterprise based on your environment and deployment strategy. - -## Deploy DaRT 8.0 - - -You can use the Windows Installer file for DaRT to install DaRT on a computer that you will use to first create the DaRT recovery image and then troubleshoot and fix end-user computers. Frequently, across an organization, you might install on the administrator computer only the DaRT functionality that you need to create a DaRT recovery image. Then, on a help desk administrator’s computer, you might install only the DaRT functionality that you must have to troubleshoot a problem computer, such as the DaRT Remote Connection Viewer and the Crash Analyzer. - -In addition to manually running the Windows Installer file to install DaRT, you can also install DaRT at the command prompt to support enterprise software deployment systems such as System Center Configuration Manager 2012. - -[How to Deploy DaRT 8.0](how-to-deploy-dart-80-dart-8.md) - -## Change, repair, or remove DaRT 8.0 - - -You can change, repair, or remove the DaRT installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform or through the Windows Control Panel. - -[How to Change, Repair, or Remove DaRT 8.0](how-to-change-repair-or-remove-dart-80-dart-8.md) - -## How to get DaRT 8.0 - - -To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for deploying the DaRT 8.0 to administrator computers - - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md deleted file mode 100644 index c635accd35..0000000000 --- a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying the DaRT Recovery Image -description: Deploying the DaRT Recovery Image -author: msfttracyp -ms.assetid: df5cb54a-be8c-4ed2-89ea-d3c67c2ef4d4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the DaRT Recovery Image - - -After you have created the International Organization for Standardization (ISO) file that contains the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image, you can deploy the DaRT 8.0 recovery image throughout your enterprise so that it is available to end users and help desk workers. There are four supported methods that you can use to deploy the DaRT recovery image. To review the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md). - -Burn the ISO image file to a CD or DVD by using the DaRT Recovery Image wizard - -Save the contents of the ISO image file to a USB Flash Drive (UFD) by using the DaRT Recovery Image wizard - -Extract the boot.wim file from the ISO image and deploy as a remote partition that is available to end-user computers - -Extract the boot.wim file from the ISO image and deploy in the recovery partition of a new Windows 8 installation - -**Important**   -The **DaRT Recovery Image Wizard** provides the option to burn the image to a CD, DVD or UFD, but the other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section. - - - -## Deploy the DaRT recovery image as part of a recovery partition - - -After you have finished running the DaRT Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 8 image. - -[How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md) - -## Deploy the DaRT recovery image as a remote partition - - -You can host the recovery image on a central network boot server, such as Windows Deployment Services, and allow users or support staff to stream the image to computers on demand. - -[How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md) - -## Other resources for deploying the DaRT recovery image - - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md b/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md deleted file mode 100644 index 77522cf3fa..0000000000 --- a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Diagnosing System Failures with Crash Analyzer -description: Diagnosing System Failures with Crash Analyzer -author: msfttracyp -ms.assetid: ce3d3186-54fb-45b2-b5ce-9bb7841db28f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Diagnosing System Failures with Crash Analyzer - - -The **Crash Analyzer** in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 lets you debug a memory dump file on a Windows-based computer and then diagnose any related computer errors. The **Crash Analyzer** uses the Microsoft Debugging Tools for Windows to examine a memory dump file for the driver that caused the computer to fail. You can run the Crash Analyzer on an end-user computer or in stand-alone mode on a computer other than an end-user computer. - -## Run the Crash Analyzer on an end-user-computer - - -Typically, you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing the problem. The **Crash Analyzer** tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location, or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you included the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT 8.0 recovery image, the Tools and symbol files should be available when you run the **Crash Analyzer** on the problem computer. If you did not include them in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining them, you can alternatively run the Crash Analyzer in stand-alone mode on a computer other than the end user’s computer, as described in the following section. - -[How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md) - -## Run the Crash Analyzer in stand-alone mode on a computer other than an end user’s computer - - -Although you typically run **Crash Analyzer** on the end-user computer that is experiencing the problem, you can also run the Crash Analyzer in stand-alone mode, on a computer other than an end-user computer. You might choose this option if you did not include the Windows Debugging Tools in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining the Debugging Tools. In this case, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of **Crash Analyzer** installed, such as on a help desk agent’s computer. - -[How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md) - -## How to ensure that Crash Analyzer can access symbol files - - -To debug applications that have stopped responding, you need access to the symbol file, which is separate from the program. Although symbol files are automatically downloaded when you run Crash Analyzer, there might be times when the problem computer does not have access to the Internet. There are several ways to ensure that you have guaranteed access to symbol files. - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md) - -## Other resources for diagnosing system failures with Crash Analyzer - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md b/mdop/dart-v8/getting-started-with-dart-80-dart-8.md deleted file mode 100644 index e313b81a37..0000000000 --- a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Getting Started with DaRT 8.0 -description: Getting Started with DaRT 8.0 -author: msfttracyp -ms.assetid: 579d18c5-7434-4a0e-9725-fb81ca5e3c6d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with DaRT 8.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 requires thorough planning before you deploy it or use its features. If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at [https://go.microsoft.com/fwlink/p/?LinkId=80347](https://go.microsoft.com/fwlink/?LinkId=80347). - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272493). - -Additional downloadable information about this product can also be found at . - - - -## Getting started with DaRT 8.0 - - -- [About DaRT 8.0](about-dart-80-dart-8.md) - - Provides information specifically related to DaRT, including what is new in DaRT 8.0. - -- [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md) - - Describes the tools in DaRT 8.0. - -- [Accessibility for DaRT 8.0](accessibility-for-dart-80-dart-8.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## How to Get DaRT 8.0 - - -DaRT 8.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for this product - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md b/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md deleted file mode 100644 index 6c2e3fb612..0000000000 --- a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Change, Repair, or Remove DaRT 8.0 -description: How to Change, Repair, or Remove DaRT 8.0 -author: msfttracyp -ms.assetid: a9737635-aaf5-45bd-861f-f9dff4f02336 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change, Repair, or Remove DaRT 8.0 - - -You can change, repair, or remove the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 installation by double-clicking the DaRT 8.0 installation file and then clicking the button that corresponds to the action that you want to perform. - -You can also change, repair, or remove the DaRT installation using the Windows Control Panel by completing the following steps. - -## To change, repair, or remove DaRT - - -1. Click **Start**, and then click **Control Panel**. - -2. On **Control Panel**, navigate to the feature that lets you uninstall programs. - -3. Click **Microsoft Diagnostics and Recovery Toolset 8.0**, and then click the button that corresponds to the action that you want to perform. - -## Related topics - - -[Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md deleted file mode 100644 index f562dc65ba..0000000000 --- a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Deploy DaRT 8.0 -description: How to Deploy DaRT 8.0 -author: msfttracyp -ms.assetid: ab772e7a-c02f-4847-acdf-8bd362769a77 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy DaRT 8.0 - - -The following instructions explain how to deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 in your environment. To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). It is assumed that you are installing all functionality on one administrator computer. If you need to deploy or uninstall DaRT 8.0 on multiple computers, using an electronic software distribution system, for example, it might be easier to use command line installation options. Descriptions and examples of the available command line options are provided in this section. - -**Important**   -Before you install DaRT, see [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) to ensure that you have installed all of the prerequisite software and that the computer meets the minimum system requirements. The computer onto which you install DaRT must be running Windows 8 or Windows Server 2012. - - - -You can install DaRT using one of two different configurations: - -- Install DaRT and all of the DaRT tools on the administrator computer. - -- Install on the administrator computer only the tools that you need to create the DaRT recovery image, and then install the **Remote Connection Viewer** and, optionally, **Crash Analyzer** on a help desk computer. - -The DaRT installation file is available in both 32-bit and 64-bit versions. Install the version that matches the architecture of the computer on which you are running the DaRT Recovery Image wizard, not the computer architecture of the recovery image that you are creating. - -You can use either version of the DaRT installation file to create a recovery image for either 32-bit or 64-bit computers, but you cannot create one recovery image for both 32-bit and 64-bit computers. - -**To install DaRT and all DaRT tools on an administrator computer** - -1. Download the 32-bit or 64-bit version of the DaRT 8.0 installer file. Choose the architecture that matches the computer on which you are installing DaRT and running the DaRT Recovery Image wizard. - -2. From the folder into which you downloaded DaRT 8.0, run the **MSDaRT80.msi** installation file that corresponds to your system requirements. - -3. On the **Welcome to the Microsoft DaRT 8.0 Setup Wizard** page, click **Next**. - -4. Accept the Microsoft Software License Terms, and then click **Next**. - -5. On the **Microsoft Update** page, select **Use Microsoft Update when I check for updates**, and then click **Next**. - -6. On the **Select Installation Folder** page, select a folder, or click **Next** to install DaRT in the default installation location. - -7. On the **Setup Options** page, select the DaRT features that you want to install, or click **Next** to install DaRT with all of the features. - -8. To start the installation, click **Install**. - -9. After the installation has completed successfully, click **Finish** to exit the wizard. - -## To install DaRT and all DaRT tools on an administrator computer by using a command prompt - - -When you install or uninstall DaRT, you have the option of running the installation files at the command prompt. This section describes some examples of different options that you can specify when you install or uninstall DaRT at the command prompt. - -The following example shows how to install all DaRT functionality. - -``` syntax -msiexec /i MSDaRT80.msi ADDLOCAL=CommonFiles, DaRTRecoveryImage,CrashAnalyzer,RemoteViewer -``` - -The following example shows how to install only the DaRT Recovery Image wizard. - -``` syntax -msiexec /i MSDaRT80.msi ADDLOCAL=CommonFiles, ,DaRTRecoveryImage -``` - -The following example shows how to install only the Crash Analyzer and the DaRT Remote Connection Viewer. - -``` syntax -msiexec /i MSDaRT80.msi ADDLOCAL=CommonFiles,CrashAnalyzer,RemoteViewer -``` - -The following example creates a setup log for the Windows Installer. This is valuable for debugging. - -``` syntax -msiexec.exe /i MSDaRT80.msi /l*v log.txt -``` - -**Note**   -You can add /qn or /qb to perform a silent installation. - - - -**To validate the DaRT installation** - -1. Click **Start**, and select **Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. - -2. Check that all of the DaRT tools that you selected for installation were successfully installed. - -## Related topics - - -[Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md deleted file mode 100644 index cddcfef5e9..0000000000 --- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as a Remote Partition -description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: msfttracyp -ms.assetid: 58f4a6c6-6193-42bd-a095-0de868711af9 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -**To deploy DaRT 8.0 as a remote partition** - -1. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -2. Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise. - -3. Configure the WDS server to use the boot.wim file for DaRT by following your standard WDS deployment procedures. - -For more information about how to deploy DaRT as a remote partition, see [Walkthrough: Deploy an Image by Using PXE](https://go.microsoft.com/fwlink/?LinkId=212108) and [Windows Deployment Services Getting Started Guide](https://go.microsoft.com/fwlink/?LinkId=212106). - -## Related topics - - -[Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md deleted file mode 100644 index c84571d02c..0000000000 --- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: msfttracyp -ms.assetid: 07c5d539-51d9-4759-adc7-72b40d5d7bb3 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 8 image. A partition is recommended, because any corruption issues that prevent the Windows operating system from starting would also prevent the recovery image from starting. A separate partition also eliminates the need to provide the BitLocker recovery key twice. Consider hiding the partition to prevent users from storing files on it. - -**To deploy DaRT in the recovery partition of a Windows 8 image** - -1. Create a target partition in your Windows 8 image that is equal to or greater than the size of the ISO image file that you created by using the **DaRT 8.0 Recovery Image wizard**. - - The minimum size required for a DaRT partition is 500MB to accommodate the remote connection functionality in DaRT. - -2. Extract the boot.wim file from the DaRT ISO image file. - - 1. Using your company’s preferred method, mount the ISO image file that you created on the **Create Startup Image** page. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD, DVD, or USB of the recovery image, you can open the files on the removable media and copy the boot.wim file from the \\sources folder. If you copy boot.wim file, you don’t need to mount the image. - - - -3. Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image. - - For more information about how to create or customize a recovery partition, see [Customizing the Windows RE Experience](https://go.microsoft.com/fwlink/?LinkId=214222). - -4. Replace the target partition in your Windows 8 image with the recovery partition. - - For more information about how to deploy a recovery solution to reinstall the factory image in the event of a system failure, see [Deploy a System Recovery Image](https://go.microsoft.com/fwlink/?LinkId=214221). - -## Related topics - - -[Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md b/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md deleted file mode 100644 index dfdfa5bf01..0000000000 --- a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Ensure that Crash Analyzer Can Access Symbol Files -description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: msfttracyp -ms.assetid: 99839013-1cd8-44d1-8484-0e15261c5a4b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Ensure that Crash Analyzer Can Access Symbol Files - - -Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding. - -Symbol files are automatically downloaded when you run **Crash Analyzer**. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -**To ensure that Crash Analyzer can access symbol files** - -1. **Copy the dump file to another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, copy the memory dump file to a computer that does have an Internet connection and run the stand-alone **Crash Analyzer Wizard** on that computer. - -2. **Access the symbol files from another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, you can download the symbols from a computer that does have an Internet connection and then copy them to the computer that does not have an Internet connection, or you can map a network drive to a location where the symbols are available on the local network. If you run the **Crash Analyzer** in a Windows Recovery Environment (Windows RE), you can include the symbol files on the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image. - -3. **Access symbol files through an HTTP proxy server.** If the symbols cannot be downloaded because an HTTP proxy server must be accessed, use the following steps to access an HTTP proxy server. In DaRT 8.0, the **Crash Analyzer Wizard** has a setting available on the **Specify Symbol Files Location** dialog page, marked with the label **Proxy server (optional, using the format "server:port")**. You can use this text box to specify a proxy server. Enter the proxy address in the form **<hostname>:<port>**, where the <**hostname**> is a DNS name or IP address, and the <**port**> is a TCP port number, usually 80. There are two modes in which the **Crash Analyzer** can be run. Following is how you use the proxy setting in each of these modes: - - - **Online mode:** In this mode, if the proxy server field is left blank, the wizard uses the proxy settings from Internet Options in Control Panel. If you enter a proxy address in the text box which is provided, that address will be used, and it will override the setting in the Internet Options. - - - Windows Recovery Environment (Windows RE): When you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window, there is no default proxy address. If the computer is directly connected to the Internet, a proxy address is not required. Therefore, you can leave this field blank in the wizard setting. If the computer is not directly connected to the Internet, and it is in a network environment that has a proxy server, you must set the proxy field in the wizard to access the symbol store. The proxy address can be obtained from the network administrator. Setting the proxy server is important only when the public symbol store is connected to the Internet. If the symbols are already on the DaRT recovery image, or if they are available locally, setting the proxy server is not required. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md b/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md deleted file mode 100644 index c1eb0becc8..0000000000 --- a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Perform DaRT Tasks by Using PowerShell Commands -description: How to Perform DaRT Tasks by Using PowerShell Commands -author: msfttracyp -ms.assetid: bc788b00-38c7-4f57-a832-916b68264d89 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform DaRT Tasks by Using PowerShell Commands - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various DaRT 8.0 server tasks from the command prompt rather than from the DaRT Recovery Image wizard. - -## To administer DaRT by using PowerShell commands - - -Use the PowerShell cmdlets described here to administer DaRT. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Copy-DartImage

          Burns an ISO to a CD, DVD, or USB drive.

          Export-DartImage

          Allows the source WIM file, which contains a DaRT image, to be converted into an ISO file.

          New-DartConfiguration

          Creates a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image.

          Set-DartImage

          Applies a DartConfiguration object to a mounted Windows Image. This includes adding all files, configuration, and package dependencies.

          - -  - -## Related topics - - -[Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md deleted file mode 100644 index d4315fa44a..0000000000 --- a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Recover Local Computers by Using the DaRT Recovery Image -description: How to Recover Local Computers by Using the DaRT Recovery Image -author: msfttracyp -ms.assetid: f679d522-49ab-429c-93d0-294c3f3e5639 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover Local Computers by Using the DaRT Recovery Image - - -Use these instructions to recover a computer when you are physically present at the end-user computer that is experiencing problems. - -**How to recover a local computer by using the DaRT recovery image** - -1. Boot the end-user computer by using the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image. - - As the computer is booting into the DaRT 8.0 recovery image, the **NetStart** dialog box appears. - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 8 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created. - -You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides. - -For general information about any of the DaRT tools, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). - -**How to run DaRT at the command prompt** - -- To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - -

          Parameter

          Description

          -network

          Initializes the network services.

          -remount

          Remaps the drive letters.

          -prompt

          Displays messages that ask the end user to specify whether to initialize the network and remap the drives.

          -
          - Warning

          The end user’s response to the prompt overrides the –network and –remount switches.

          -
          -
          - -
          - - - -## Related topics - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md deleted file mode 100644 index 0b4c3efa63..0000000000 --- a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -title: How to Recover Remote Computers by Using the DaRT Recovery Image -description: How to Recover Remote Computers by Using the DaRT Recovery Image -author: msfttracyp -ms.assetid: 363ccd48-6820-4b5b-a43a-323c0b208a9d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover Remote Computers by Using the DaRT Recovery Image - - -Use the Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 to run the DaRT tools remotely on an end-user computer. After the end user provides the administrator or help desk worker with certain information, the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -If you disabled the DaRT tools when you created the recovery image, you still have access to all of the tools. All of the tools, except Remote Connection, are unavailable to end users. - -**To recover a remote computer by using the DaRT recovery image** - -1. Boot an end-user computer by using the DaRT recovery image. - - You will typically use one of the following methods to boot into DaRT to recover a remote computer, depending on how you deploy the DaRT recovery image. For more information about deploying the DaRT recovery image, see [Deploying DaRT 8.0](deploying-dart-80-dart-8.md). - - - Boot into DaRT from a recovery partition on the problem computer. - - - Boot into DaRT from a remote partition on the network. - - For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md). - - Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - - **Note** - Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -~~~ -As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. -~~~ - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 8 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md). - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**. - -8. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**. - - The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information. - -9. On the help desk computer, open the **DaRT Remote Connection Viewer**. - -10. Click **Start**, click **All Programs**, click **Microsoft DaRT 8.0**, and then click **DaRT Remote Connection Viewer**. - -11. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information. - - **Note** - This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer. - - - -12. Click **Connect**. - -The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely. - -**Note** -A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32. - - - -**To customize the Remote Connection process** - -1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413). - - Specify the following commands and parameters to customize how a remote connection is established with an end-user computer: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          CommandParameterDescription

          RemoteRecovery.exe

          -nomessage

          Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.

          WaitForConnection.exe

          none

          Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.

          -
          - Important

          This command serves no function if it is specified independently. It must be specified in a script to function correctly.

          -
          -
          - -
          - - - -2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT: - - ```ini - [LaunchApps] - "%windir%\system32\netstart.exe -network -remount" - "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage" - "%windir%\system32\WaitForConnection.exe" - "%SYSTEMDRIVE%\sources\recovery\recenv.exe" - ``` - -When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the RAM disk. This file contains connection information: IP address, port, and ticket number. You can copy this file to a network share to trigger a Help desk workflow. For example, a custom program can check the network share for connection files, and then create a support ticket or send email notifications. - -**To run the Remote Connection Viewer at the command prompt** - -1. To run the **DaRT Remote Connection Viewer** at the command prompt, specify the **DartRemoteViewer.exe** command and use the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          -ticket=<ticketnumber>

          Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection.

          -ipaddress=<ipaddress>

          Where <ipaddress> is the IP address that is generated by Remote Connection.

          -port=<port>

          Where <port> is the port that corresponds to the specified IP address.

          - - - -~~~ -**Note** -The variables for these parameters are created on the end-user computer and must be provided by the end user. -~~~ - - - -2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified. - -## Related topics - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md deleted file mode 100644 index 8b0b3c8a8c..0000000000 --- a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: msfttracyp -ms.assetid: b2f87144-6379-478a-802b-9cfef5242f34 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer - - -If you cannot access the Microsoft Debugging Tools for Windows or the symbol files on the end-user computer, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a help desk computer that contains Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - -To run Crash Analyzer in stand-alone mode, you copy the memory dump file from the problem computer and analyze it on another computer, such as a help desk computer, that has the **Crash Analyzer** installed. - -**To run the Crash Analyzer in stand-alone mode** - -1. On a computer that has DaRT 8.0 installed, click **Start**, type **Crash Analyzer**, and then click **Crash Analyzer**. - -2. Follow the steps in the wizard, as described in [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md). - -## Related topics - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md deleted file mode 100644 index e3a35791e8..0000000000 --- a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Run the Crash Analyzer on an End-user Computer -description: How to Run the Crash Analyzer on an End-user Computer -author: msfttracyp -ms.assetid: d36213e5-7719-44d7-be65-971c3ef7df2c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Run the Crash Analyzer on an End-user Computer - - -To run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing problems, you must have the Microsoft Debugging Tools for Windows and the symbol files installed. To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). - -**To run the Crash Analyzer on an end-user computer** - -1. On the **Diagnostics and Recovery Toolset** window on an end-user computer, click **Crash Analyzer**. - -2. Provide the required information for the Microsoft Debugging Tools for Windows. - -3. Provide the required information for the symbol files. For more information about symbol files, see [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md). - -4. Provide the required information for a memory dump file. To determine the location of the memory dump file: - - 1. Open the **System Properties** window. - - 2. Click **Start**, type **sysdm.cpl**, and then press **Enter**. - - 3. Click the **Advanced** tab. - - 4. In the **Startup and Recovery** area, click **Settings**. - - If you do not have access to the **System Properties** window, you can search for dump files on the end-user computer by using the **Search** tool in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - - The **Crash Analyzer** scans the memory dump file and reports a probable cause of the problem. You can view more information about the failure, such as the specific memory dump message and description, the drivers loaded at the time of the failure, and the full output of the analysis. - -5. Identify the appropriate strategy to resolve the problem. The strategy may require disabling or updating the device driver that caused the failure by using the **Services and Drivers** node of the **Computer Management** tool in DaRT 8.0. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md b/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md deleted file mode 100644 index b0a3f41ad7..0000000000 --- a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Use a PowerShell Script to Create the Recovery Image -description: How to Use a PowerShell Script to Create the Recovery Image -author: msfttracyp -ms.assetid: d0c71092-535e-43b1-9b1d-6ac819508348 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a PowerShell Script to Create the Recovery Image - - -## To create the DaRT recovery image by using a PowerShell script - - -You can create the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image by using a PowerShell script instead of using the DaRT 8.0 Recovery Image wizard. See the following example script. - -`` - -`This script was auto generated by the Microsoft DaRT Recovery Image Wizard.``###``This script uses the DISM and DaRT PowerShell commands to create a bootable DaRT image.``###Both a WIM and ISO file are produced.``###``### Examples of how to burn/copy the DaRT ISO to DVD/USB are available at the end of this script.``###` - -`$ErrorActionPreference = "Stop";``### This variable tells PowerShell to stop if an error occurs.` - -`###``### Import the modules necessary for DaRT Image creation.``###` - -`Import-Module "Dism"`I`mport-Module "Microsoft.Dart"` - -`###``### Specifies where the Windows 8 media is located and where the ISO and WIM files will be saved.``### These can be changed as necessary.``###` - -`$Win8MediaPath = "D:\";``### This is the path of the Windows 8 media.``$DestinationWimPath = "C:\Users\Administrator\Desktop\DaRT8\x64\boot.wim";``### Specify where the WIM file will be saved.``$DestinationIsoPath = "C:\Users\Administrator\Desktop\DaRT8\x64\DaRT8.iso";``### Specify where the ISO will be saved.` - -`###``### These variables are used to specify temporary and output directories based on the paths above.``###` - -`$WimParentPath = (Split-Path -Path "$destinationWimPath" -Parent);``### Specify the directory where the DaRT WIM file will be saved.``$IsoParentPath = (Split-Path -Path "$destinationIsoPath" -Parent);``### This is the directory where the DaRT ISO file will be saved.``$TempMountPath = "$env:temp\DaRT8Mount_$(Get-Random)";``### Specify the temporary directory used to mount the Windows image.` - -`###``### Prepare the windows image.``###` - -`### Guarantee the output directories exists.``New-Item -Path $WimParentPath -Type Directory -Force``New-Item -Path $IsoParentPath -Type Directory -Force``New-Item -Path $TempMountPath -Type Directory -Force` - -`### Create a copy of the WIM and remove the read-only attribute.``### The WIM file will be the resulting dart image.``Copy-Item "$Win8MediaPath\sources\boot.wim" $DestinationWimPath -Force``Set-ItemProperty $DestinationWimPath -Name IsReadOnly -Value $false` - -`### Mount the bootable image within the WIM file (normally index 2).``Mount-WindowsImage -ImagePath $DestinationWimPath -Path $TempMountPath -Index 2` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified driver(s) into the image.``###` - -`Add-WindowsDriver -Path $TempMountPath -Driver "C:\Windows\System32\DriverStore\FileRepository``\xusb22.inf_amd64_89c20c625f14f923\xusb22.inf" -ForceUnsigned` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified WinPE package(s) into the image.``###` - -`Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-FMAPI.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-HTA.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-HTA_en-us.cab"` - -`###``### Add the DaRT tools to the image.``### The New-DartConfiguration cmdlet is used to specify how the DaRT image is configured.``### Modify this statement to configure how the DaRT tools will be applied to the image.``###` - -`$config = New-DartConfiguration -AddComputerManagement -AddCrashAnalyzer -AddDefender -AddDiskCommander -AddExplorer -AddFileRestore -AddFileSearch -AddHotfixUninstall -AddRegistryEditor -AddRemoteConnection -AddSfcScan -AddSolutionWizard -AddTcpConfig -RemoteMessage "Test welcome message" -RemotePort 3388 -ScratchSpace 512 -UpdateDefender``$config | Set-DartImage -Path $TempMountPath` - -`###``### Perform any manual user-specific customizations here.``###` - -`# Read-Host -Prompt "Script is paused for any manual customization. Press ENTER to continue"` - -`### Save the changes to the WIM file by dismounting the image.``Dismount-WindowsImage -Path $TempMountPath -Save` - -`### Create a bootable DaRT ISO.``Export-DartImage -IsoPath $DestinationIsoPath -WimPath $DestinationWimPath` - -`### The following is an example of how to burn the ISO to a writeable CD/DVD.``### Specify the correct drive letter and uncomment the statement to burn an ISO.``# Copy-DartImage -IsoPath $DestinationIsoPath -Drive "G:" -Type DVD` - -`### Removes all temporary files.``Remove-Item $TempMountPath -Force -Recurse` - -## Related topics - - -[Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/images/checklistbox.gif b/mdop/dart-v8/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/dart-v8/images/checklistbox.gif and /dev/null differ diff --git a/mdop/dart-v8/index.md b/mdop/dart-v8/index.md deleted file mode 100644 index bcee6aaf64..0000000000 --- a/mdop/dart-v8/index.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 8 Administrator's Guide -description: Diagnostics and Recovery Toolset 8 Administrator's Guide -author: dansimp -ms.assetid: 33685dd7-844f-4864-b504-3ef384ef01de -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Diagnostics and Recovery Toolset 8 Administrator's Guide - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 lets you diagnose and repair a computer that cannot be started or that has problems starting as expected. By using DaRT 8.0, you can recover end-user computers that have become unusable, diagnose probable causes of issues, and quickly repair unbootable or locked-out computers. When it is necessary, you can also quickly restore important lost files and detect and remove malware, even when the computer is not online. - -DaRT 8.0 lets you create a DaRT recovery image in International Organization for Standardization (ISO) and Windows Imaging (WIM) file formats and burn the image to a CD, DVD, or USB. You can then use the recovery image files and deploy them locally or to a remote partition or a recovery partition. - -DaRT 8.0 is an important part of the Microsoft Desktop Optimization Pack (MDOP), a dynamic solution available to Software Assurance customers that helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[About DaRT 8.0](about-dart-80-dart-8.md)**|**[Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md)**|**[About DaRT 8.0 SP1](about-dart-80-sp1.md)**|**[Release Notes for DaRT 8.0 SP1](release-notes-for-dart-80-sp1.md)**|**[About DaRT 8.1](about-dart-81.md)**|**[Release Notes for DaRT 8.1](release-notes-for-dart-81.md)**|**[Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md)**|**[Accessibility for DaRT 8.0](accessibility-for-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md)**|**[DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md)**|**[Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md)**|**[Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md)**|**[DaRT 8.0 Planning Checklist](dart-80-planning-checklist-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md)**|**[Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md)**|**[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md)**|**[DaRT 8.0 Deployment Checklist](dart-80-deployment-checklist-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md)**|**[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md)**|**[Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md)**|**[Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - -[Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md) - -[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -### More Information - -[How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) -Get information about how to download DaRT. - -[Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md) -View updated product information and known issues for DaRT 8.0. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md b/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md deleted file mode 100644 index f2a4047807..0000000000 --- a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection -description: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection -author: msfttracyp -ms.assetid: 59678283-4b44-4d02-ba8f-0e7315efd5d1 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection - - -Environments that have the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. This applies to all currently supported versions of DaRT. These versions include DaRT 7, DaRT 8, and DaRT 8.1, together with their service packs. - -## About Windows Defender - - -The Windows Defender tool distributes anti-malware updates more frequently than the DaRT Defender tool. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. Without these updates, the DaRT Defender tool quickly becomes outdated. To make sure of up-to-date protection at scan time, you should download Windows Defender Offline to create a bootable image for scanning. - -Currently deployed DaRT images do not have to be removed or updated. We recommend that you deploy the bootable image that is provided by Windows Defender Offline for all future malware scans. Using an outdated version of the DaRT Defender tool could result in undetected malware. - -For more information about Windows Defender Offline downloads and FAQs, go to the following website: [What is Windows Defender Offline?](https://go.microsoft.com/fwlink/p/?LinkId=394127). - -  - -  - - - - - diff --git a/mdop/dart-v8/operations-for-dart-80-dart-8.md b/mdop/dart-v8/operations-for-dart-80-dart-8.md deleted file mode 100644 index c71925f264..0000000000 --- a/mdop/dart-v8/operations-for-dart-80-dart-8.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for DaRT 8.0 -description: Operations for DaRT 8.0 -author: msfttracyp -ms.assetid: a31615de-eb6e-41af-909c-d0b6f3eb3f2f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for DaRT 8.0 - - -This section includes information about the various types of Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) - - This section provides instructions on how to use DaRT 8.0 to recover local or remote computers by using the DaRT recovery image. - -- [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - - This section explains how to open and run the Crash Analyzer on either an end-user or non-end-user computer to debug a memory dump file and then diagnose computer errors. - -- [Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) - - This section describes measures for maintaining security while using DaRT. - -- [Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - - This section lists the Windows PowerShell commands that administrators can use to perform various DaRT tasks. - -## Other resources for DaRT 8.0 operations - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md deleted file mode 100644 index dc1608bbf2..0000000000 --- a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Overview of the Tools in DaRT 8.0 -description: Overview of the Tools in DaRT 8.0 -author: msfttracyp -ms.assetid: 1766c82e-c099-47d4-b186-4689b026a7e0 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of the Tools in DaRT 8.0 - - -From the **Diagnostics and Recovery Toolset** window in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0, you can start any of the individual tools that you include when you create the DaRT 8.0 recovery image. For information about how to access the **Diagnostics and Recovery Toolset** window, see [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md). - -If it is available, you can use the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to select the tool that best addresses your particular issue, based on a brief interview that the wizard provides. - -## Exploring the DaRT tools - - -A description of the DaRT 8.0 tools follows. - -### Computer Management - -**Computer Management** is a collection of Windows administrative tools that help you troubleshoot a problem computer. You can use the **Computer Management** tools in DaRT to view system information and event logs, manage disks, list autoruns, and manage services and drivers. The **Computer Management** console is customized to help you diagnose and repair problems that might be preventing the Windows operating system from starting. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Crash Analyzer - -Use the **Crash Analyzer Wizard** to quickly determine the cause of a computer failure by analyzing the memory dump file on the Windows operating system that you are repairing. **Crash Analyzer** examines the memory dump file for the driver that caused a computer to fail. You can then disable the problem device driver by using the **Services and Drivers** node in the **Computer Management** tool. - -The **Crash Analyzer Wizard** requires the Debugging Tools for Windows and symbol files for the operating system that you are repairing. You can include both requirements when you create the DaRT recovery image. If they are not included on the recovery image and you do not have access to them on the computer that you are repairing, you can copy the memory dump file to another computer and use the stand-alone version of **Crash Analyzer** to diagnose the problem. - -Running **Crash Analyzer** is a good idea even if you plan to reimage the computer. The image could have a defective driver that is causing problems in your environment. By running **Crash Analyzer**, you can identify problem drivers and improve the image stability. - -For more information about **Crash Analyzer**, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md). - -### Defender - -**Important**   -Environments with the DaRT Defender deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. For more information, see [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md). - - - -**Defender** can help detect malware and unwanted software and warn you of security risks. You can use this tool to scan a computer for and remove malware even when the installed Windows operating system is not running. When **Defender** detects malicious or unwanted software, it prompts you to remove, quarantine, or allow for each item. - -Malware that uses rootkits can mask itself from the running operating system. If a rootkit-enabled virus or spyware is in a computer, most real-time scanning and removal tools can no longer see it or remove it. Because you boot the problem computer into DaRT and the installed operating system is offline, you can detect the rootkit without it being able to mask itself. - -### Disk Commander - -**Disk Commander** lets you recover and repair disk partitions or volumes by using one of the following recovery processes: - -- Restore the master boot record (MBR) - -- Recover one or more lost volumes - -- Restore partition tables from **Disk Commander** backup - -- Save partition tables to **Disk Commander** backup - -**Warning**   -We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table. - - - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Disk Wipe - -You can use **Disk Wipe** to delete all data from a disk or volume, even the data that is left behind after you reformat a hard disk drive. **Disk Wipe** lets you select from either a single-pass overwrite or a four-pass overwrite, which meets current U.S. Department of Defense standards. - -**Warning**   -After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it. - - - -### Explorer - -The **Explorer** tool lets you browse the computer’s file system and network shares so that you can remove important data that the user stored on the local drive before you try to repair or reimage the computer. And because you can map drive letters to network shares, you can easily copy and move files from the computer to the network for safekeeping or from the network to the computer to restore them. - -### File Restore - -**File Restore** lets you try to restore files that were accidentally deleted or that were too big to fit in the Recycle Bin. **File Restore** is not limited to regular disk volumes, but can find and restore files on lost volumes or on volumes that are encrypted by BitLocker. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### File Search - -Before reimaging a computer, recovering files from the local hard disk is important, especially when the user might not have backed up or stored the files elsewhere. - -The **Search** tool opens a **File Search** window that you can use to find documents when you do not know the file path or to search for general kinds of files across all local hard disks. You can search for specific file-name patterns in specific paths. You can also limit results to a date range or size range. - -### Hotfix Uninstall - -The **Hotfix Uninstall Wizard** lets you remove hotfixes or service packs from the Windows operating system on the computer that you are repairing. Use this tool when a hotfix or service pack is suspected in preventing the operating system from starting. - -We recommend that you uninstall only one hotfix at a time, even though the tool lets you uninstall more than one. - -**Important**   -Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix. - - - -### Locksmith - -The **Locksmith Wizard** lets you set or change the password for any local account on the Windows operating system that you are analyzing or repairing. You do not have to know the current password. However, the password that you set must comply with any requirements that are defined by a local Group Policy Object. This includes password length and complexity. - -You can use **Locksmith** when the password for a local account, such as the local Administrator account, is unknown. You cannot use **Locksmith** to set passwords for domain accounts. - -### Registry Editor - -You can use **Registry Editor** to access and change the registry of the Windows operating system that you are analyzing or repairing. This includes adding, removing, and editing keys and values, and importing registry (.reg) files. - -**Warning**   -Serious problems can occur if you change the registry incorrectly by using **Registry Editor**. These problems might require you to reinstall the operating system. Before you make changes to the registry, you should back up any valued data on the computer. Change the registry at your own risk. - - - -### SFC Scan - -The **SFC Scan** tool starts the **System File Repair Wizard** and lets you repair system files that are preventing the installed Windows operating system from starting. The **System File Repair Wizard** can automatically repair system files that are corrupted or missing, or it can prompt you before it performs any repairs. - -### Solution Wizard - -The **Solution Wizard** presents a series of questions and then recommends the best tool for the situation, based on your answers. This wizard helps you determine which tool to use when you are not familiar with the tools in DaRT. - -### TCP/IP Config - -When you boot a problem computer into DaRT, it is set to automatically obtain its TCP/IP configuration (IP address and DNS server) from Dynamic Host Configuration Protocol (DHCP). If DHCP is unavailable, you can manually configure TCP/IP by using the **TCP/IP Config** tool. You first select a network adapter, and then configure the IP address and DNS server for that adapter. - -## Related topics - - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/planning-for-dart-80-dart-8.md b/mdop/dart-v8/planning-for-dart-80-dart-8.md deleted file mode 100644 index 55b249c5e7..0000000000 --- a/mdop/dart-v8/planning-for-dart-80-dart-8.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning for DaRT 8.0 -description: Planning for DaRT 8.0 -author: msfttracyp -ms.assetid: c8be3ab3-dc54-43b9-b9ff-fbd5e1ef29a7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for DaRT 8.0 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 so that it does not disrupt your users or the network. - -Before you deploy DaRT 8.0, you should consider the different deployment configurations and prerequisites. This section includes information that can help you gather the information to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -- [Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - There are several deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -- [DaRT 8.0 Planning Checklist](dart-80-planning-checklist-dart-8.md) - - This checklist can assist you in preparing your computing environment for the DaRT deployment. - -## Other resources for DaRT planning - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md deleted file mode 100644 index 00fe0bfbd8..0000000000 --- a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Planning How to Save and Deploy the DaRT 8.0 Recovery Image -description: Planning How to Save and Deploy the DaRT 8.0 Recovery Image -author: msfttracyp -ms.assetid: 939fbe17-0e30-4c85-8782-5b84d69442a7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning How to Save and Deploy the DaRT 8.0 Recovery Image - - -You can save and deploy the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image by using the following methods. When you are determining the method that you will use, consider the advantages and disadvantages of each. You should also consider your infrastructure and support staff. If you have a small infrastructure, you might want to deploy DaRT 8.0 by using removable media, since the recovery image will always be available if you install it to the local hard drive. - -If your organization uses Active Directory Domain Services (AD DS), you may want to deploy recovery images as a network service by using Windows DS. Recovery images are always available to any connected computer. You can deploy multiple images from Windows DS and maintain them all in one place. - -**Note**   -You may want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -The following table shows some advantages and disadvantages of each method of using DaRT in your organization. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Method to Boot into DaRTAdvantagesDisadvantages

          Removable Media

          -

          The recovery image is written to a CD, DVD, or USB drive to enable support staff to take the recovery tools with them to the unstable computer.

          Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk and supports cases in which there is no network connection.

          -

          Enables you to create multiple recovery images with different tools to provide different levels of support.

          -

          Provides a built-in tool for burning recovery images to removable media.

          Requires that support staff are physically at the end-user computer to boot into DaRT.

          -

          Requires time and maintenance to create multiple media with different configurations for 32-bit and 64-bit computers.

          From a remote (network) partition

          -

          The recovery image is hosted on a network boot server like Windows Deployment Services (Windows DS), which allows users or support staff to stream it to computers on demand.

          Available to all computers that have access to the network boot server.

          -

          Recovery images are hosted on a central server, which enables centralized updates.

          -

          Centralized help desk staff can provide repairs by using remote connectivity.

          -

          No local storage requirement on the clients.

          -

          Ability to create multiple recovery images with different tools for specific support levels.

          The need to secure Windows DS infrastructure to ensure that regular users can start only the DaRT recovery image and not the full operating system imaging process.

          -

          -

          -

          Requires that the end-user computer is connected to the network at runtime.

          -

          Requires that the recovery image is brought across the network.

          From a recovery partition on the local hard drive

          -

          The recovery image is installed on a local hard drive either manually or by using electronic software distribution systems like System Center Configuration Manager.

          The recovery image is always available because it is pre-staged on the computer.

          -

          Centralized help desk staff can provide support by using Remote Connection.

          -

          The recovery image is centrally managed and deployed.

          -

          Additional recovery key requests on computers that are protected by Windows BitLocker drive encryption are eliminated.

          Local storage is required.

          -

          A dedicated, unencrypted partition for recovery image placement is recommended to reduce the risk of a failed boot partition.

          -

          When updating DaRT, you must update all computers in your enterprise instead of just one partition (on the network) or removable device.

          -

          Additional consideration is required if you deploy the recovery image after BitLocker has been enabled.

          - - - -## Related topics - - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md deleted file mode 100644 index 3e41f760d4..0000000000 --- a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Planning to Create the DaRT 8.0 Recovery Image -description: Planning to Create the DaRT 8.0 Recovery Image -author: msfttracyp -ms.assetid: cfd0e1e2-c379-4460-b545-3f7be9f33583 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Create the DaRT 8.0 Recovery Image - - -Use the information in this section when you are planning to create the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image. - -## Planning to create the DaRT 8.0 recovery image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. To make the decision, consider that end users may have access to those tools. If support engineers will take the recovery image media to end users’ computers to diagnose issues, you may want to install all of the tools on the recovery image. If you plan to diagnose end user’s computers remotely, you may want to disable some of the tools, such as Disk Wipe and Registry Editor, and then enable other tools, including Remote Connection. - -When you create the DaRT recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -For more information about the DaRT tools, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). For more information about how to help create a secure recovery image, see [Security Considerations for DaRT 8.0](security-considerations-for-dart-80--dart-8.md). - -## Prerequisites for the recovery image - - -The following items are required or recommended for creating the DaRT recovery image: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Prerequisite

          Details

          Windows 8 source files

          Required to create the DaRT recovery image. Provide the path of a Windows 8 DVD or of Windows 8 source files.

          Windows Debugging Tools for your platform

          Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: Download and Install Debugging Tools for Windows.

          Optional: Defender definitions

          The latest definitions for Defender are required when you run Defender. Although you can download the definitions when you run Defender, we recommend that you download the latest definitions at the time you create the DaRT recovery image so that you can still run the tool with the latest definitions even if the problem computer does not have network connectivity.

          Optional: Windows symbols files for use with Crash Analyzer

          Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see Diagnosing System Failures with Crash Analyzer.

          - - - -## Related topics - - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md deleted file mode 100644 index 57ade193c4..0000000000 --- a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning to Deploy DaRT 8.0 -description: Planning to Deploy DaRT 8.0 -author: msfttracyp -ms.assetid: 36f2babb-9ac5-4ea2-932c-12c6211f5be2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy DaRT 8.0 - - -You should consider all of the different deployment configurations and prerequisites before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Review the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 software prerequisites and supported configurations - - -After preparing your computing environment for DaRT 8.0 installation, make sure that you review the prerequisite software to install and the supported configurations to confirm that the selected computers for the installation meet the minimum hardware and operating system requirements. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md). - -[DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) - -## Plan for creating the DaRT 8.0 recovery image - - -Before you start to create the DaRT recovery image, you need to consider possible security issues, the tools that you want to include on the recovery image, and the prerequisite software that you need to install. - -[Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md) - -## Plan how to save and deploy the DaRT recovery image - - -There are several methods that you can use to save and deploy the DaRT recovery image. Before you start to create the recovery image, review the advantages and disadvantages of each method and consider how you want to use DaRT in your enterprise. - -[Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md) - -## Other resources for planning to deploy DaRT 8.0 - - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md b/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md deleted file mode 100644 index 78ee035cb4..0000000000 --- a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Recovering Computers Using DaRT 8.0 -description: Recovering Computers Using DaRT 8.0 -author: msfttracyp -ms.assetid: 0caeb7d9-c1e6-4f32-bc27-157b91630989 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recovering Computers Using DaRT 8.0 - - -After deploying the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image, you can use DaRT 8.0 to recover computers. The information in this section describes the recovery tasks that you can perform. - -You have several different methods to choose from to boot into DaRT, depending on how you deploy the DaRT recovery image. - -- Insert a DaRT recovery image CD, DVD, or USB flash drive into the problem computer and use it to boot into the computer. - -- Boot into DaRT from a recovery partition on the problem computer. - -- Boot into DaRT from a remote partition on the network. - -For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md). - -Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - -**Note**   -Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -## Recover a local computer by using the DaRT recovery image - - -To recover a local computer by using DaRT, you must be physically present at the end-user computer that is experiencing problems that require DaRT. - -[How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md) - -## Recover a remote computer by using the DaRT recovery image - - -The Remote Connection feature in DaRT lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a help desk professional working on the end-user computer), the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**. - -The Remote Connection feature on the end-user computer creates the following connection information: a ticket number, a port, and a list of all available IP addresses. The ticket number and port are generated randomly. - -The IT administrator or help desk worker enters this information into the **DaRT Remote Connection Viewer** to establish the terminal services connection to the end-user computer. The terminal services connection that is established lets an IT administrator remotely interact with the DaRT tools on the end-user computer. The end-user computer then processes the connection information, shares its screen, and responds to instructions from the IT administrator computer. - -[How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md) - -## Other resources for recovering computers using DaRT 8.0 - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md b/mdop/dart-v8/release-notes-for-dart-80--dart-8.md deleted file mode 100644 index a96b501caa..0000000000 --- a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Release Notes for DaRT 8.0 -description: Release Notes for DaRT 8.0 -author: msfttracyp -ms.assetid: e8b373c8-7aa5-4930-a8f9-743d26145dad -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for DaRT 8.0 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - -These release notes contain information that is required to successfully install DaRT 8.0. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - -## About the product documentation - - -For information about documentation for DaRT, see the [DaRT home page](https://go.microsoft.com/fwlink/?LinkID=252096) on Microsoft TechNet. - -To obtain a downloadable copy of DaRT documentation, see on the Microsoft Download Center. - -## Providing feedback - - -We are interested in your feedback on DaRT 8.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan future changes for our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known issues with DaRT 8.0 - - -### System restore fails when you run Locksmith or Registry Editor - -If you run Locksmith, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT and then start System Restore. - -### SFC scan fails to run after you launch and close Locksmith or Computer Management - -If you start and then close the Locksmith or Computer Management tools, System File Checker fails to run. - -**Workaround:** Close and restart DaRT and then start SFC. - -### DaRT installer does not fail when ADK has not been installed - -If you install DaRT 8.0 by using the command line to execute the MSI, and the ADK has not been installed, the DaRT installation should fail. Currently, the DaRT 8.0 installer installs all components except the DaRT 8.0 recovery image. - -**Workaround:** None. - -### Defender cannot be launched after Locksmith, RegEdit, Crash Analyzer, and Computer Management are launched - -Defender does not launch if you have already launched Locksmith, RegEdit, Crash Analyzer, and Computer Management. - -**Workaround:** Close and restart DaRT and then launch Defender. - -### Defender may be slow to launch - -Defender sometimes takes a few minutes to launch. The progress bar indicates the current loading status. - -**Workaround:** None. - -## Release notes copyright information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About DaRT 8.0](about-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/release-notes-for-dart-80-sp1.md b/mdop/dart-v8/release-notes-for-dart-80-sp1.md deleted file mode 100644 index 28f2df8b60..0000000000 --- a/mdop/dart-v8/release-notes-for-dart-80-sp1.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Release Notes for DaRT 8.0 SP1 -description: Release Notes for DaRT 8.0 SP1 -author: msfttracyp -ms.assetid: fa7512d8-fb00-4c27-8f65-c15f3a8ff1cc -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for DaRT 8.0 SP1 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Service Pack 1 (SP1). - -These release notes contain information that is required to successfully install Diagnostics and Recovery Toolset 8.0 SP1. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the product documentation - - -For information about documentation for DaRT, see the [DaRT home page](https://go.microsoft.com/fwlink/?LinkID=252096) on Microsoft TechNet. - -## Known issues with DaRT 8.0 SP1 - - -### System restore fails when you run Locksmith or Registry Editor - -If you run Locksmith, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT and then start System Restore. - -### SFC scan fails to run after you launch and close Locksmith or Computer Management - -If you start and then close the Locksmith or Computer Management tools, System File Checker fails to run. - -**Workaround:** Close and restart DaRT and then start SFC. - -### DaRT installer does not fail when ADK has not been installed - -If you install DaRT 8.0 SP1 by using the command line to run the MSI, and the ADK has not been installed, the DaRT installation should fail. Currently, the DaRT 8.0 SP1 installer installs all components except the DaRT recovery image. - -**Workaround:** None. - -### Defender cannot be launched after Locksmith, RegEdit, Crash Analyzer, and Computer Management are launched - -Defender does not launch if you have already launched Locksmith, RegEdit, Crash Analyzer, and Computer Management. - -**Workaround:** Close and restart DaRT and then launch Defender. - -### Defender may be slow to launch - -Defender sometimes takes a few minutes to launch. The progress bar indicates the current loading status. - -**Workaround:** None. - -## Release notes copyright information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About DaRT 8.0 SP1](about-dart-80-sp1.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/release-notes-for-dart-81.md b/mdop/dart-v8/release-notes-for-dart-81.md deleted file mode 100644 index d1183586b4..0000000000 --- a/mdop/dart-v8/release-notes-for-dart-81.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Release Notes for DaRT 8.1 -description: Release Notes for DaRT 8.1 -author: msfttracyp -ms.assetid: 44303107-60f4-485c-848a-7e0529f142d4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for DaRT 8.1 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1. - -These release notes contain information that is required to successfully install Diagnostics and Recovery Toolset 8.1. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Known issues with DaRT 8.1 - - -### Disk Commander is unable to repair a corrupt master boot record in a physical partition in Windows 8.1 - -In Windows 8.1, the “Restore the Master Boot Record (MBR) or the header of the GUID Partition Table (GPT)” option in Disk Commander is unable to repair a corrupt master boot record in a physical partition, and therefore is unable to boot the client computer. - -**Workaround:** Start **Startup Repair**, click **Troubleshoot**, click **Advanced options**, and then click **Start repair**. - -### Multiple instances of Disk Wipe that target the same drive cause all instances except the last one to report a failure - -If you start multiple instances of Disk Wipe, and then try to wipe the same drive by using two separate Disk Wipe instances, all instances except the last one report a failure to wipe the drive. - -**Workaround:** None. - -### Disk Wipe may not clear all data on solid-state drives that have flash memory - -If you use Disk Wipe to clear data on a solid-state drive (SSD) that has flash memory, all of the data may not be erased. This issue occurs because the SSD firmware controls the physical location of writes while Disk Wipe is running. - -**Workaround:** None. - -### System restore fails when you run Locksmith Wizard or Registry Editor - -If you run Locksmith Wizard, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT, and then start System Restore. - -### System File Checker (SFC) Scan fails to run after you start and close Locksmith Wizard or Computer Management - -If you start and then close Locksmith Wizard or tools in Computer Management, System File Checker fails to run. - -**Workaround:** Close and restart DaRT, and then start System File Checker. - -### DaRT installer does not fail when the Windows Assessment and Deployment Kit is not installed - -If you install DaRT 8.1 by using the command line to run the Windows Installer (.msi), and the Windows Assessment and Deployment Kit (Windows ADK) has not been installed, the DaRT installation should fail. Currently, the DaRT 8.1 installer installs all components except the DaRT recovery image. - -**Workaround:** None. - -### Windows Defender cannot start after Locksmith Wizard, Registry Editor, Crash Analyzer, and Computer Management are started - -Windows Defender does not start if you have already started Locksmith Wizard, Registry Editor, Crash Analyzer, and Computer Management. - -**Workaround:** Close and restart DaRT, and then start Windows Defender. - -### Windows Defender may be slow to start - -Windows Defender sometimes takes a few minutes to start. The progress bar indicates the current loading status. - -**Workaround:** None. - -## Related topics - - -[About DaRT 8.1](about-dart-81.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md b/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md deleted file mode 100644 index f6a05dbbaf..0000000000 --- a/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for DaRT 8.0 -description: Security and Privacy for DaRT 8.0 -author: msfttracyp -ms.assetid: 668188fc-d9e9-4607-b90a-9e50bf53bc88 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for DaRT 8.0 - - -Use the following information to help you plan for security and privacy considerations in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - -## Security considerations for DaRT 8.0 - - -There are several security-related considerations that you should plan for when deploying and using DaRT in your environment. The information in this section provides a brief overview about the security-related considerations for DaRT. - -[Security Considerations for DaRT 8.0](security-considerations-for-dart-80--dart-8.md) - -## Privacy considerations for DaRT 8.0 - - -The information in this section explains many of the data collection and use practices of DaRT. - -[DaRT 8.0 Privacy Statement](dart-80-privacy-statement-dart-8.md) - -## Other resources for DaRT 8.0 security and privacy - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md b/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md deleted file mode 100644 index 716e3ed33f..0000000000 --- a/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Security Considerations for DaRT 8.0 -description: Security Considerations for DaRT 8.0 -author: msfttracyp -ms.assetid: 45ef8164-fee7-41a1-9a36-de4e3264e7a8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for DaRT 8.0 - - -This topic contains a brief overview about the accounts and groups, log files, and other security-related considerations for Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. For more information, follow the links within this article. - -## General security considerations - - -**Understand the security risks**. DaRT 8.0 includes functionality that lets an administrator or a help desk worker run the DaRT tools remotely to resolve problems on an end-user computer. In addition, you can save the International Organization for Standardization (ISO) image to a USB flash drive or put the ISO image on a network to include its contents as a recovery partition on a computer’s hard disk. These capabilities provide flexibility, but also create potential security risks that you should consider when configuring DaRT. - -**Physically secure your computers**. When administrators and help desk workers are not physically at their computers, they should lock their computers and use a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems by subscribing to the Security Notification service (). - -## Limit end-user access to DaRT tools - - -When you are creating the DaRT recovery image, you can select the tools that you want to include. For security reasons, you might want to restrict end-user access to the more powerful DaRT tools, such as Disk Wipe and Locksmith. In DaRT 8.0, you can disable certain tools during configuration and still make them available to help desk workers when the end user starts the Remote Connection feature. - -You can even configure the DaRT image so that the option to start a remote connection session is the only tool available to an end user. - -**Important**   -After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to any help desk worker who is working on the end–user computer. - - - -For more information about including tools in the DaRT recovery image, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). - -## Secure the DaRT recovery image - - -If you deploy the DaRT recovery image by saving it to a USB flash drive or by creating a remote partition or a recovery partition, you might want to include your company’s preferred method of drive encryption on the ISO. Encrypting the ISO helps to ensure that end users cannot use DaRT functionality if they were to gain access to the recovery image, and it ensures that unauthorized users cannot boot into DaRT on computers that belong to someone else. If you use an encryption method, be sure to deploy and enable it in all computers. - -**Note**   -DaRT 8.0 supports BitLocker natively. - - - -To include drive encryption, add the encryption solution files when you create the recovery image. Your encryption solution must be able to run on WinPE. End users who boot from the ISO are then able to access that encryption solution and unblock the drive. - -## Maintain security between two computers when you use Remote Connection - - -By default, the communication between two computers that have established a **Remote Connection** session may not be encrypted. Therefore, to help maintain security between the two computers, we recommend that both computers are a part of the same network. - -## Related topics - - -[Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md b/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md deleted file mode 100644 index 1084a0fc4e..0000000000 --- a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Technical Reference for DaRT 8.0 -description: Technical Reference for DaRT 8.0 -author: msfttracyp -ms.assetid: 1d0bf98b-b56b-4ce6-ad19-eb85e1ff1287 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for DaRT 8.0 - - -This section includes technical reference information about Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 that provide additional information an administrator. - -## Technical reference - - -- [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md) - - Environments with the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. - -## Other resources for DaRT 8.0 operations - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md b/mdop/dart-v8/troubleshooting-dart-80-dart-8.md deleted file mode 100644 index dd64f0665f..0000000000 --- a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting DaRT 8.0 -description: Troubleshooting DaRT 8.0 -author: msfttracyp -ms.assetid: 0444a390-3251-47f4-b6c8-828d4a2e8af4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting DaRT 8.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to find troubleshooting content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting DaRT 8.0 - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/docfx.json b/mdop/docfx.json index 55e32ba407..abcead924c 100644 --- a/mdop/docfx.json +++ b/mdop/docfx.json @@ -27,22 +27,36 @@ "ms.technology": "windows", "audience": "ITPro", "manager": "dansimp", + "ms.prod": "w10", + "ms.author": "dansimp", + "author": "dansimp", "ms.sitesec": "library", "ms.topic": "article", "ms.date": "04/05/2017", "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_github_repo": "https://github.com/MicrosoftDocs/mdop-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.mdop", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ], + "titleSuffix": "Microsoft Desktop Optimization Pack" }, "externalReference": [], "template": "op.html", "dest": "mdop", "markdownEngineName": "markdig" - } + } } diff --git a/mdop/index.md b/mdop/index.md deleted file mode 100644 index 93ce634a80..0000000000 --- a/mdop/index.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: MDOP Information Experience -description: MDOP Information Experience -ms.assetid: 12b8ab56-3267-450d-bb22-1c7e44cb8e52 -author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 07/24/2018 ---- - -# MDOP Information Experience - - -The Microsoft Desktop Optimization Pack (MDOP) is a portfolio of technologies available as a subscription for Software Assurance customers. MDOP helps to improve compatibility and management, reduce support costs, improve asset management, and improve policy control. - -The MDOP Information Experience provides product documentation, videos, blogs, and other resources to help users implement and optimize their experience with the MDOP technologies. You can learn about updates and events by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## MDOP Documentation Links - - -The following table provides links to the product documentation for the MDOP products by version. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of the Group Policy Management Console (GPMC) to provide change control and improved management.

          -

          AGPM 4.0 SP3 – Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2008, Windows Server 2008 R2

          -

          AGPM 4.0 SP2 - Windows 8.1, Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2008, Windows Server 2008 R2

          -

          AGPM 4.0 SP1 - Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2008, Windows Server 2008 R2

          -

          AGPM 4.0 - Windows Vista SP1, Windows 7, Windows Server 2008, Windows Server 2008 R2

          -

          AGPM 3.0- Windows Vista SP1, Windows Server 2008

          -

          AGPM 2.5 - Windows Vista, Windows Server 2003

          Overview of Microsoft Advanced Group Policy Management

          -

          AGPM 4.0 SP3

          -

          AGPM 4.0 SP2

          -

          AGPM 4.0 SP1 (https://go.microsoft.com/fwlink/p/?LinkId=286715)

          -

          AGPM 4.0

          -

          AGPM 3.0

          -

          AGPM 2.5

          -

          AGPM Whitepapers on the Microsoft Download Center

          Microsoft Application Virtualization (App-V) lets you make applications available to end user computers without installing the applications directly on those computers.

          Microsoft Application Virtualization 5.1 Administrator's Guide

          -

          About App-V 5.0 SP3

          -

          About App-V 5.0 SP2

          -

          About App-V 5.0 SP1

          -

          Microsoft Application Virtualization 5.0 Administrator's Guide

          -

          About Microsoft Application Virtualization 4.6 SP3

          -

          About Microsoft Application Virtualization 4.6 SP2

          -

          About Microsoft Application Virtualization 4.6 SP1

          -

          About Microsoft Application Virtualization 4.6

          -

          About Microsoft Application Virtualization 4.5

          -

          App-V Whitepapers on the Microsoft Download Center

          -

          App-V 5.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309570)

          Microsoft BitLocker Administration and Monitoring (MBAM) provides an administrative interface to enterprise-wide BitLocker drive encryption.

          Microsoft BitLocker Administration and Monitoring 2.5

          -

          MBAM 2.5 Video Demonstration: Deploying MBAM 2.5

          -

          About MBAM 2.5 SP1

          -

          About MBAM 2.0 SP1

          -

          Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide

          -

          Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide

          -

          MBAM Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=231905)

          -

          MBAM 1.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309571)

          Microsoft Diagnostics and Recovery Toolset (DaRT) helps troubleshoot and repair Windows-based computers.

          -

          DaRT 10 - Windows 10

          -

          DaRT 8.1 - Windows 8.1, Windows Server 2012 R2

          -

          DaRT 8.0 SP1 - Windows 8, Windows Server 2012

          -

          DaRT 8.0 - Windows 8, Windows Server 2012

          -

          DaRT 7.0 - Windows 7, Windows Server 2008 R2

          -

          DaRT 6.5 - Windows 7, Windows Server 2008 R2

          -

          DaRT 6.0 - Windows Vista, Windows Server 2008

          -

          DaRT 5.0 - Windows 2000, Windows XP, Windows Server 2003

          Diagnostics and Recovery Toolset 10

          -

          About DaRT 8.1

          -

          About DaRT 8.0 SP1

          -

          Diagnostics and Recovery Toolset 8 Administrator's Guide

          -

          Diagnostics and Recovery Toolset 7 Administrator's Guide

          -

          DaRT 6.5 (https://go.microsoft.com/fwlink/p/?LinkId=232983)

          -

          DaRT Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=232274)

          -

          DaRT 8.0 eBook (https://go.microsoft.com/fwlink/p/?LinkId=309573)

          -

          DaRT 7.0 eBook (https://go.microsoft.com/fwlink/p/?LinkId=309572)

          Microsoft Desktop Enterprise Monitoring (DEM) monitors and reports enterprise-wide desktop application and system failures.

          DEM 3.5 (https://go.microsoft.com/fwlink/p/?LinkId=232985)

          -

          DEM Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=232276)

          Microsoft Enterprise Desktop Virtualization (MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization.

          -

          MED-V 2.0 - Windows 7

          -

          MED-V 1.0 SP1 - Windows 7, Windows Vista, Windows XP

          -

          MED-V 1.0 - Windows Vista, Windows XP

          Microsoft Enterprise Desktop Virtualization 2.0

          -

          About MED-V 1.0 SP1

          -

          Microsoft Enterprise Desktop Virtualization 1.0

          -

          Microsoft User Experience Virtualization (UE-V) captures settings to apply to computers accessed by the user including desktop computers, laptop computers, and VDI sessions.

          Microsoft User Experience Virtualization (UE-V) 2.x

          -

          What's New in UE-V 2.1 SP1

          -

          What's New in UE-V 2.1

          -

          What's New in UE-V 2.0

          -

          About User Experience Virtualization 1.0 SP1

          -

          Microsoft User Experience Virtualization (UE-V) 1.0

          -

          UE-V 1.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309574)

          MDOP Solutions and Scenarios

          Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0

          -

          Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0

          -

          Creating App-V 4.5 Databases Using SQL Scripting

          -

          Application Publishing and Client Interaction for App-V 5

          -

          How to Download and Deploy MDOP Group Policy (.admx) Templates

          - - - -## Supplemental MDOP Product Guidance - - -In addition to the product documentation available online, supplemental product guidance such as informational videos and virtual labs are available for most MDOP products. - - ---- - - - - - - - - - - - - - - -

          MDOP Virtual Labs

          For a list of available MDOP virtual labs, go to Microsoft Desktop Optimization Pack (MDOP) Virtual Labs (https://go.microsoft.com/fwlink/p/?LinkId=234276).

          MDOP TechCenter

          For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to MDOP TechCenter (https://go.microsoft.com/fwlink/p/?LinkId=225286)

          -

          MDOP Forums

          Join in the MDOP community where you can ask and answer questions at the MDOP TechNet Forum (https://go.microsoft.com/fwlink/p/?LinkId=286973).

          - - - -## How to Get MDOP - - -MDOP is a suite of products that can help streamline desktop deployment, management, and support across the enterprise. MDOP is available as an additional subscription for Software Assurance customers. - -**Download MDOP** -MDOP subscribers can download the software at the [Microsoft Volume Licensing website (MVLS)](https://go.microsoft.com/fwlink/p/?LinkId=166331). - -**Purchase MDOP** -Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/licensing/how-to-buy/how-to-buy) website to find out how to purchase MDOP for your business. - - - - - - - - - diff --git a/mdop/mbam-v1/TOC.md b/mdop/mbam-v1/TOC.md deleted file mode 100644 index 8d49baf940..0000000000 --- a/mdop/mbam-v1/TOC.md +++ /dev/null @@ -1,59 +0,0 @@ -# [Microsoft BitLocker Administration and Monitoring 1](index.md) -## [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) -### [About MBAM 1.0](about-mbam-10.md) -#### [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md) -### [Evaluating MBAM 1.0](evaluating-mbam-10.md) -### [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md) -### [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md) -## [Planning for MBAM 1.0](planning-for-mbam-10.md) -### [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) -#### [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) -#### [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) -#### [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) -### [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) -#### [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) -#### [Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md) -#### [Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) -### [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) -## [Deploying MBAM 1.0](deploying-mbam-10.md) -### [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) -#### [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md) -#### [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md) -#### [How to Configure Network Load Balancing for MBAM](how-to-configure-network-load-balancing-for-mbam.md) -### [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) -#### [How to Install the MBAM 1.0 Group Policy Template](how-to-install-the-mbam-10-group-policy-template.md) -#### [How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md) -#### [How to Hide Default BitLocker Encryption in The Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md) -### [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) -#### [How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md) -#### [How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md) -### [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) -#### [How to Install the MBAM Language Update on a Single Server](how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md) -#### [How to Install the MBAM Language Update on Distributed Servers](how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md) -#### [Known Issues in the MBAM International Release](known-issues-in-the-mbam-international-release-mbam-1.md) -### [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) -## [Operations for MBAM 1.0](operations-for-mbam-10.md) -### [Administering MBAM 1.0 Features](administering-mbam-10-features.md) -#### [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md) -#### [How to Manage Hardware Compatibility](how-to-manage-hardware-compatibility-mbam-1.md) -#### [How to Manage Computer BitLocker Encryption Exemptions](how-to-manage-computer-bitlocker-encryption-exemptions.md) -#### [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md) -#### [How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md) -### [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) -#### [Understanding MBAM Reports](understanding-mbam-reports-mbam-1.md) -#### [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-1.md) -### [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) -#### [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-1.md) -#### [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-1.md) -#### [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-1.md) -#### [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-1.md) -#### [How to Determine the BitLocker Encryption State of a Lost Computers](how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md) -### [Maintaining MBAM 1.0](maintaining-mbam-10.md) -#### [High Availability for MBAM 1.0](high-availability-for-mbam-10.md) -#### [How to Move MBAM 1.0 Features to Another Computer](how-to-move-mbam-10-features-to-another-computer.md) -### [Security and Privacy for MBAM 1.0](security-and-privacy-for-mbam-10.md) -#### [Security Considerations for MBAM 1.0](security-considerations-for-mbam-10.md) -#### [Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) -### [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) -## [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - diff --git a/mdop/mbam-v1/about-mbam-10.md b/mdop/mbam-v1/about-mbam-10.md deleted file mode 100644 index de3e35c13d..0000000000 --- a/mdop/mbam-v1/about-mbam-10.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: About MBAM 1.0 -description: About MBAM 1.0 -author: msfttracyp -ms.assetid: 99254aaa-2b30-4b2e-8365-0d4b67a89a0c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 1.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative interface to BitLocker drive encryption and offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system volume and configured data volumes, which includes the Windows operating system, hibernation and paging files, applications, and the data that is used by applications. - -With Microsoft BitLocker Administration and Monitoring, you can select the BitLocker encryption policy options that are appropriate for your enterprise so that you can monitor the client compliance with those policies and then report the encryption status of both the enterprise and individual computers. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. - -**Note**   -BitLocker is not covered in detail in this guide. For an overview of BitLocker, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are tasked with ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for securing computers in remote or branch offices - -- Administrators who are responsible for servers or Windows client computers that are mobile - -- Administrators who are responsible for decommissioning servers that contain confidential data - -## MBAM 1.0 Release Notes - - -For more information and for latest updates, see [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md). - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/accessibility-for-mbam-10.md b/mdop/mbam-v1/accessibility-for-mbam-10.md deleted file mode 100644 index f360475a2c..0000000000 --- a/mdop/mbam-v1/accessibility-for-mbam-10.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for MBAM 1.0 -description: Accessibility for MBAM 1.0 -author: msfttracyp -ms.assetid: 5c1bf1a3-76cf-458c-ac4a-cd343aace4de -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for MBAM 1.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md b/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md deleted file mode 100644 index b9f38f7a3e..0000000000 --- a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Administering MBAM 1.0 by Using PowerShell -description: Administering MBAM 1.0 by Using PowerShell -author: msfttracyp -ms.assetid: 3bf2eca5-4ab7-4e84-9e80-c0c7d709647b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 1.0 by Using PowerShell - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various MBAM server tasks from the command prompt rather than from the MBAM administration website. - -## How to administer MBAM by using PowerShell - - -Use the PowerShell cmdlets described here to administer MBAM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Add-MbamHardwareType

          Adds a new hardware model to the MBAM hardware inventory. This cmdlet can also specify whether the hardware is supported or unsupported for BitLocker drive encryption.

          Get-MbamBitLockerRecoveryKey

          Requests an MBAM recovery key that will enable a user to unlock a computer or encrypted drive.

          Get-MbamHardwareType

          Gets a master hardware inventory that contains data that indicates whether hardware models are compatible or incompatible with BitLocker drive encryption.

          Get-MbamTPMOwnerPassword

          Provides a TPM owner password for a user to manage their TPM (Trusted Platform Module) access. Helps users when TPM has locked them out and will no longer accept their PIN.

          Install-Mbam

          Installs MBAM features that provide advanced group policy, encryption, key recovery, and compliance reporting tools.

          Remove-MbamHardwareType

          Removes the hardware models from the hardware inventory.

          Set-MbamHardwareType

          Allows management of a master hardware inventory to designate whether or not hardware models are capable or incapable to perform BitLocker encryption.

          Uninstall-Mbam

          Removes previously installed MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting tools.

          - -  - -## Related topics - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/administering-mbam-10-features.md b/mdop/mbam-v1/administering-mbam-10-features.md deleted file mode 100644 index 26d27aea64..0000000000 --- a/mdop/mbam-v1/administering-mbam-10-features.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Administering MBAM 1.0 Features -description: Administering MBAM 1.0 Features -author: msfttracyp -ms.assetid: dd9a9eff-f1ad-4af3-85d9-c19131a4ad22 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 1.0 Features - - -After you complete all necessary Microsoft BitLocker Administration and Monitoring (MBAM) planning and deployment, you can configure and use MBAM to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day MBAM feature operations tasks. - -## Manage MBAM Administrator Roles - - -After MBAM Setup is complete for all server features, administrative users must be granted access to these server features. As a best practice, administrators who will manage or use MBAM server features, should be assigned to Active Directory security groups and then those groups should be added to the appropriate MBAM administrative local group. - -[How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md) - -## Manage Hardware Compatibility - - -The MBAM Hardware Compatibility feature can help you to ensure that only the computer hardware that you specify as supporting BitLocker will be encrypted. When this feature is turned on, bit\_admmontla will encrypt only computers that are marked as Compatible. - -**Important**   -When this feature is turned off, all computers where the MBAM policy is deployed will be encrypted. - - - -MBAM can collect information on both the make and model of client computers if you deploy the “Allow Hardware Compatibility Checking” Group Policy. If you configure this policy, the MBAM agent reports the computer make and model information to the MBAM Server when the MBAM Client is deployed on a client computer. - -[How to Manage Hardware Compatibility](how-to-manage-hardware-compatibility-mbam-1.md) - -[How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md) - -## Manage BitLocker encryption exemptions - - -MBAM can grant two forms of exemption from BitLocker encryption: computer exemption and user exemption. Computer exemption is typically used when a company has computers that do not have to be encrypted, such as computers that are used in development or testing, or older computers that do not support BitLocker. In some cases, local law may also require that certain computers are not encrypted. You may also choose to exempt users who do not need or want their drives encrypted. - -[How to Manage Computer BitLocker Encryption Exemptions](how-to-manage-computer-bitlocker-encryption-exemptions.md) - -## Manage MBAM Client BitLocker Encryption Options by using the Control Panel - - -If enabled through a Group Policy Objects (GPO), a custom MBAM control panel that is named BitLocker Encryption Options will be available under **System and Security**. This customized control panel replaces the default Windows BitLocker control panel. The MBAM control panel enables you to unlock encrypted drives (fixed and removable), and also helps you manage your PIN or password. - -[How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md) - -## Other resources for Administering MBAM features - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md b/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md deleted file mode 100644 index f62d25bd4d..0000000000 --- a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Deploying MBAM 1.0 Group Policy Objects -description: Deploying MBAM 1.0 Group Policy Objects -author: msfttracyp -ms.assetid: 2129291e-d2b2-41ed-b643-1e311c49fee7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 1.0 Group Policy Objects - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you must first determine the Group Policies that you will use in your implementation of MBAM. For more information about the various available policies, see [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). When you have determined the policies that you are going to use, you must use the MBAM 1.0 Group Policy template to create and deploy one or more Group Policy objects (GPO) that include the MBAM policy settings. - -## Install the MBAM 1.0 Group Policy template - - -In addition to providing server-related features of MBAM, the server setup application includes an MBAM Group Policy template. You can install this template on any computer that is able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -[How to Install the MBAM 1.0 Group Policy Template](how-to-install-the-mbam-10-group-policy-template.md) - -## Deploy MBAM 1.0 Group Policy settings - - -After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. - -[How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md) - -## Display the MBAM Control Panel in Windows - - -Because MBAM offers a customized MBAM control panel that can replace the default Windows BitLocker control panel, you can also choose to hide the default BitLocker Control Panel from end users by using Group Policy. - -[How to Hide Default BitLocker Encryption in The Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md) - -## Other resources for deploying MBAM 1.0 Group Policy Objects - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-mbam-10.md b/mdop/mbam-v1/deploying-mbam-10.md deleted file mode 100644 index 086a3a721d..0000000000 --- a/mdop/mbam-v1/deploying-mbam-10.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Deploying MBAM 1.0 -description: Deploying MBAM 1.0 -author: msfttracyp -ms.assetid: ff952ed6-08b2-4ed0-97b8-bf89f22cccbc -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 1.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) supports a number of different deployment configurations. This section of the Administrator’s Guide for Microsoft BitLocker Administration and Monitoring includes information that you should consider about the deployment of MBAM and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment information - - -- [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - This section describes the different topology options for MBAM deployment and how to use MBAM Setup to deploy MBAM Server features. - -- [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - This section describes how to create and deploy the MBAM Group Policy Objects that are required to manage MBAM Clients and BitLocker encryption policies throughout the enterprise. - -- [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - This section describes how to use the MBAM Client Windows Installer files to deploy the MBAM Client software. - -- [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - This section describes how to deploy the MBAM language release update to provide support for additional non-English language user interfaces. - -- [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) - - This section provides a deployment checklist that can help you deploy MBAM Server and MBAM Client. - -## Other Resources for deploying MBAM - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-the-mbam-10-client.md b/mdop/mbam-v1/deploying-the-mbam-10-client.md deleted file mode 100644 index df62ed3b09..0000000000 --- a/mdop/mbam-v1/deploying-the-mbam-10-client.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Deploying the MBAM 1.0 Client -description: Deploying the MBAM 1.0 Client -author: msfttracyp -ms.assetid: f7ca233f-5035-4ff9-ab3a-f2453b4929d1 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 1.0 Client - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through tools like Active Directory Domain Services or by directly encrypting the client computers as part of the initial imaging process. - -Depending on when you deploy the MBAM Client, you can enable BitLocker encryption on a computer in your organization either before or after the end user receives the computer. To control this timing, you configure Group Policy and deploy the MBAM Client software by using an enterprise software deployment system. - -You can use either or both of these methods in your organization. If you use both methods, you can improve compliance, reporting, and key recovery support. - -## Deploy the MBAM Client to desktop or laptop computers - - -After you have configured Group Policy, you can deploy the MBAM Client installation Windows Installer files to target computers. You can do this by use of an enterprise software deployment system product like Microsoft System Center 2012 Configuration Manager or Active Directory Domain Services. The two available MBAM Client installation Windows Installer files are MBAMClient-64bit.msi and MBAMClient-32bit.msi. These files are provided with the MBAM software. For more information about how to deploy MBAM Group Policy Objects, see [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md). - -[How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md) - -## Deploy the MBAM Client as part of a Windows deployment - - -In some organizations, new computers are received and configured centrally. This situation enables administrators to install the MBAM Client to manage BitLocker encryption on each computer before any user data is written to the computer. This approach helps to ensure that computers are properly encrypted because the administrator performs the action without reliance on end-user action. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. - -[How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md) - -## Other resources for deploying the MBAM Client - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - -[Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md b/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md deleted file mode 100644 index 311a0ba253..0000000000 --- a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Deploying the MBAM 1.0 Language Release Update -description: Deploying the MBAM 1.0 Language Release Update -author: msfttracyp -ms.assetid: 9dbd85c3-e470-4752-a90f-25754dd46dab -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 1.0 Language Release Update - - -Microsoft BitLocker Administration and Monitoring (MBAM) 1.0 Language Release is an update to MBAM and includes the support of new languages. The new languages are: - -- English (en-us) - -- French (fr) - -- Italian (it) - -- German (de) - -- Spanish (es) - -- Korean (ko) - -- Japanese (ja) - -- Brazilian Portuguese (pt-br) - -- Russian (ru) - -- Chinese Traditional (zh-tw) - -- Chinese Simplified (zh-cn) - -The MBAM 1.0 language update will change the version number from MBAM 1.0.1237.1 to MBAM 1.0.2001. - -You do not need to reinstall all of the MBAM features in order to add these additional languages. This topic defines the steps required to add the newly supported languages. - -## Deploy the MBAM international release to MBAM Server features - - -To begin, you must update the following MBAM server features: - -- Compliance and Audit Report - -- Administration and Monitoring Server - -- Policy Templates - -Then, you must run **MbamSetup.exe** to upgrade the MBAM features that run on the same server at the same time. - -[How to Install the MBAM Language Update on a Single Server](how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md) - -[How to Install the MBAM Language Update on Distributed Servers](how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md) - -## Install the MBAM language update for Group Policies - - -The MBAM Group Policy templates can be installed on each management workstation or they can be copied to the Group Policy central store, in order to make the templates available to all Group Policy administrators. The policy templates cannot be directly installed on a domain controller. If you do not use a Group Policy central store, then you must copy the policies manually to each domain controller that manages MBAM Group Policy. - -To add the MBAM language policies templates, copy the Group Policy language files from %SystemRoot%\\PolicyDefinitions on the computer where the “Policy Templates” role was installed to the same location on the workstation computer. Here are some examples of Group Policy files: - -- BitLockerManagement.admx - -- BitLockerUserManagement.admx - -- en-us\\BitLockerManagement.adml - -- en-us\\BitLockerUserManagement.adml - -- fr-fr\\ BitLockerManagement.adml - -- fr-fr\\ BitLockerUserManagement.adml - -- (and similarly for each supported language) - -## Known issues in the MBAM international release - - -This topic contains known issues for Microsoft BitLocker Administration and Monitoring International Release. - -[Known Issues in the MBAM International Release](known-issues-in-the-mbam-international-release-mbam-1.md) - -## Other resources for deploying the MBAM 1.0 Language Update - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md b/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md deleted file mode 100644 index e802fbe9a3..0000000000 --- a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Deploying the MBAM 1.0 Server Infrastructure -description: Deploying the MBAM 1.0 Server Infrastructure -author: msfttracyp -ms.assetid: 90529379-b70e-4c92-b188-3d7aaf1844af -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying the MBAM 1.0 Server Infrastructure - - -You can install Microsoft BitLocker Administration and Monitoring (MBAM) Server features in different configurations by using one to five servers. Generally, you should use a configuration of three to five servers for production environments, depending on your scalability needs. For more information about performance scalability of MBAM and recommended deployment topologies, see the [MBAM Scalability and High-Availability Guide White Paper](https://go.microsoft.com/fwlink/p/?LinkId=258314). - -## Deploy all MBAM 1.0 on a single server - - -In this configuration, all MBAM features are installed on a single server. This deployment topology for MBAM server infrastructure will support up to 21,000 MBAM client computers. - -**Important**   -This configuration is supported, but we recommend it for testing only. - - - -The procedures in this section describe the full installation of the MBAM features on a single server. - -[How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md) - -## Deploy MBAM 1.0 on distributed servers - - -MBAM features can be installed in different configurations, depending on your scalability needs. For more information about how to plan for MBAM server feature deployment, see [Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md). - -The procedures in this section describe the full installation of the MBAM features on distributed servers. - -### Three-computer configuration - -The following diagram displays the three-computer deployment topology for MBAM. We recommend this topology for production environments that support up to 55,000 MBAM Clients. - -![mbam three computer deployment topology](images/mbam-3-server.jpg) - -In this configuration, MBAM features are installed in the following configuration: - -1. Recovery and Hardware Database, Compliance and Audit Database, and Compliance and Audit Reports are installed on a server. - -2. Administration and Monitoring Server feature is installed on a server. - -3. MBAM Group Policy template is installed on a computer that is capable of modifying Group Policy Objects (GPO). - -### Four-computer configuration - -The following diagram displays the four-computer deployment topology for MBAM. We recommended this topology for production environments that support up to 110,000 MBAM Clients. - -![mbam four computer deployment topology.](images/mbam-4-computer.jpg) - -In this configuration, MBAM features are installed in the following configuration: - -1. Recovery and Hardware Database, Compliance and Audit Database, and Compliance and Audit Reports are installed on a server. - -2. Administration and Monitoring Server feature is installed on a server that is configured in a Network Load Balancing (NLB) Server Cluster. - -3. MBAM Group Policy template is installed on a computer that is capable of modifying the Group Policy Objects. - -### Five-computer configuration - -The following diagram displays the five-computer deployment topology for MBAM. We recommend this topology for production environments that support up to 135,000 MBAM Clients. - -![mbam five computer deployment topology.](images/mbam-5-computer.jpg) - -In this configuration, MBAM features are installed in the following configuration: - -1. Recovery and Hardware Database is installed on a server. - -2. The Compliance and Audit Database and Compliance and Audit Reports are installed on a server. - -3. Administration and Monitoring Server feature is installed on a server that is configured in a Network Load Balancing (NLB) Server Cluster. - -4. MBAM Group Policy template is installed on a computer that is capable of modifying Group Policy Objects. - -[How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md) - -[How to Configure Network Load Balancing for MBAM](how-to-configure-network-load-balancing-for-mbam.md) - -## Other resources for MBAM 1.0 Server features deployment - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/evaluating-mbam-10.md b/mdop/mbam-v1/evaluating-mbam-10.md deleted file mode 100644 index c245904370..0000000000 --- a/mdop/mbam-v1/evaluating-mbam-10.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: Evaluating MBAM 1.0 -description: Evaluating MBAM 1.0 -author: msfttracyp -ms.assetid: a1e2b674-eda9-4e1c-9b4c-e748470c71f2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Evaluating MBAM 1.0 - - -Before you deploy Microsoft BitLocker Administration and Monitoring (MBAM) into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up MBAM in a single server lab environment for evaluation purposes only. - -While the actual deployment steps are very similar to the scenario that is described in [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md), this topic contains additional information to enable you to set up an MBAM evaluation environment in the least amount of time. - -## Set up the Lab Environment - - -Even when you set up a non-production instance of MBAM to evaluate in a lab environment, you should still verify that you have met the deployment prerequisites and the hardware and software requirements. For more information, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). You should also review [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) before you begin the MBAM evaluation deployment. - -### Plan for an MBAM Evaluation Deployment - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the Getting Started information about MBAM to gain a basic understanding of the product before you begin your deployment planning.

          Getting Started with MBAM 1.0

          Checklist box

          -

          Prepare your computing environment for the MBAM installation. To do so, you must enable the Transparent Data Encryption (TDE) on the SQL Server instances that will host MBAM databases. To enable TDE in your lab environment, you can create a .sql file to run against the master database that is hosted on the instance of the SQL Server that MBAM will use.

          -
          -Note

          You can use the following example to create a .sql file for your lab environment to quickly enable TDE on the SQL Server instance that will host the MBAM databases. These SQL Server commands will enable TDE by using a locally signed SQL Server certificate. Make sure to back up the TDE certificate and its associated encryption key to the example local backup path of C:\Backup</em>. The TDE certificate and key are required when recover the database or move the certificate and key to another server that has TDE encryption in place.

          -
          -
          - -
          -
          USE master;
          -GO
          -CREATE MASTER KEY ENCRYPTION BY PASSWORD = &amp;#39;P@55w0rd';
          -GO
          -CREATE CERTIFICATE tdeCert WITH SUBJECT = 'TDE Certificate';
          -GO
          -BACKUP CERTIFICATE tdeCert TO FILE = 'C:\Backup\TDECertificate.cer'
          -   WITH PRIVATE KEY (
          -         FILE = 'C:\Backup\TDECertificateKey.pvk',
          -         ENCRYPTION BY PASSWORD = &amp;#39;P@55w0rd');
          -GO

          MBAM 1.0 Deployment Prerequisites

          -

          Database Encryption in SQL Server 2008 Enterprise Edition

          Checklist box

          Plan for and configure MBAM Group Policy requirements.

          Planning for MBAM 1.0 Group Policy Requirements

          Checklist box

          Plan for and create the necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

          Planning for MBAM 1.0 Administrator Roles

          Checklist box

          Plan for MBAM Server feature deployment.

          Planning for MBAM 1.0 Server Deployment

          Checklist box

          Plan for MBAM Client deployment.

          Planning for MBAM 1.0 Client Deployment

          - - - -### Perform an MBAM Evaluation Deployment - -After you complete the necessary planning and software prerequisite installations to prepare your computing environment for an MBAM installation, you can begin the MBAM evaluation deployment. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Checklist box

          Review the MBAM supported configurations information to make sure that the selected client and server computers are supported for the MBAM feature installation.

          MBAM 1.0 Supported Configurations

          Checklist box

          Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes.

          How to Install and Configure MBAM on a Single Server

          Checklist box

          Add the Active Directory Domain Services security groups that you created during the planning phase to the appropriate local MBAM Server feature local groups on the new MBAM server.

          Planning for MBAM 1.0 Administrator Roles and How to Manage MBAM Administrator Roles

          Checklist box

          Create and deploy the required MBAM Group Policy Objects.

          Deploying MBAM 1.0 Group Policy Objects

          Checklist box

          Deploy the MBAM Client software.

          Deploying the MBAM 1.0 Client

          - - - -## Configure Lab Computers for MBAM Evaluation - - -You can change the frequency settings on the MBAM Client status reporting by using Registry Editor. However, these modifications should be used for testing purposes only. - -**Warning** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -### Modify the Frequency Settings on MBAM Client Status Reporting - -The MBAM Client wakeup and status reporting frequencies have a minimum value of 90 minutes when they are set to use Group Policy. You can change these frequencies on MBAM client computers by editing the Windows registry to lower values, which will help speed up the testing. To modify the frequency settings on MBAM Client status reporting, use a registry editor to navigate to **HKLM\\Software\\Policies\\FVE\\MDOPBitLockerManagement**, change the values for **ClientWakeupFrequency** and **StatusReportingFrequency** to **1** as the minimum client supported value, and then restart BitLocker Management Client Service. When you make this change, the MBAM Client will report every minute. You can set values this low only when you do so manually in the registry. - -### Modify the Startup Delay on MBAM Client Service - -In addition to the MBAM Client wakeup and status reporting frequencies, there is a random delay of up to 90 minutes when the MBAM Client agent service starts on client computers. If you do not want the random delay, create a **DWORD** value of **NoStartupDelay** under **HKLM\\Software\\Microsoft\\MBAM**, set its value to **1**, and then restart BitLocker Management Client Service. - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/getting-started-with-mbam-10.md b/mdop/mbam-v1/getting-started-with-mbam-10.md deleted file mode 100644 index 80cf2a07bf..0000000000 --- a/mdop/mbam-v1/getting-started-with-mbam-10.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Getting Started with MBAM 1.0 -description: Getting Started with MBAM 1.0 -author: msfttracyp -ms.assetid: 4fab4e4a-d25e-4661-b235-2b45bf5ac3e4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with MBAM 1.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) requires thorough planning before you deploy it or use its features. Because this product can affect every computer in your organization, you might disrupt your entire network if you do not plan your deployment carefully. However, if you plan your deployment carefully and manage it so that it meets your business needs, MBAM can help reduce your administrative overhead and total cost of ownership. - -If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -You can find a downloadable version of this documentation and the MBAM Evaluation Guide at . - - - -This section of the MBAM Administrator’s Guide includes high-level information about MBAM to provide you with a basic understanding of the product before you begin the deployment planning. Additional MBAM documentation can be found on the MBAM Documentation Resources Download page at . - -## Getting started with MBAM 1.0 - - -- [About MBAM 1.0](about-mbam-10.md) - - Provides a high-level overview of MBAM and how it can be used in your organization. - -- [Evaluating MBAM 1.0](evaluating-mbam-10.md) - - Provides information about how you can best evaluate MBAM for use in your organization. - -- [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md) - - Provides a description of the MBAM features and how they work together. - -- [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/high-availability-for-mbam-10.md b/mdop/mbam-v1/high-availability-for-mbam-10.md deleted file mode 100644 index 5817b9955d..0000000000 --- a/mdop/mbam-v1/high-availability-for-mbam-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: High Availability for MBAM 1.0 -description: High Availability for MBAM 1.0 -author: msfttracyp -ms.assetid: 5869ecf8-1056-4c32-aecb-838a37e05d39 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# High Availability for MBAM 1.0 - - -This topic describes how to configure a highly available installation of Microsoft BitLocker Administration and Monitoring (MBAM). - -## High Availability Scenarios for MBAM - - -Microsoft BitLocker Administration and Monitoring (MBAM) is designed to be fault-tolerant. If a server becomes unavailable, the users should not be negatively affected. For example, if the MBAM agent cannot connect to the MBAM web server, users should not be prompted for action. - -When you plan your MBAM installation, consider the following concerns that can affect the availability of the MBAM service: - -- Drive encryption and recovery password – If a recovery password cannot be escrowed, the encryption will not start on the client computer. - -- Compliance status data upload – If the server that hosts the compliance status report service is not available, the compliance data will not remain current. - -- Help Desk recovery key access - If the Help Desk cannot access MBAM database information, they will be unable to provide recovery keys to users. - -- Availability of reports – Reports will not be available if the server that hosts the Compliance and Audit Reports is not available. - -The main concern for MBAM high availability is BitLocker key recovery availability. If the help desk cannot provide recovery keys, users who are locked out cannot unlock their computers. To avoid this problem, consider implementing redundant web servers and databases to ensure high availability. - -For more information about MBAM scalability and high availability, see the [MBAM Scalability White Paper](https://go.microsoft.com/fwlink/p/?LinkId=229025) (https://go.microsoft.com/fwlink/p/?LinkId=229025). - -For general guidance on high availability for Microsoft SQL Server, see [High Availability](https://go.microsoft.com/fwlink/p/?LinkId=221504) (https://go.microsoft.com/fwlink/p/?LinkId=221504). - -For general guidance on availability and scalability for web servers, see [Availability and Scalability](https://go.microsoft.com/fwlink/p/?LinkId=221503) (https://go.microsoft.com/fwlink/p/?LinkId=221503). - -## Related topics - - -[Maintaining MBAM 1.0](maintaining-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md b/mdop/mbam-v1/high-level-architecture-for-mbam-10.md deleted file mode 100644 index d01784a142..0000000000 --- a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: High Level Architecture for MBAM 1.0 -description: High Level Architecture for MBAM 1.0 -author: msfttracyp -ms.assetid: b1349196-88ed-4d6c-8a1d-998f18127b6b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# High Level Architecture for MBAM 1.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) is a client/server data encryption solution that can help you simplify BitLocker provisioning and deployment, improve BitLocker compliance and reporting, and reduce support costs. MBAM includes the features that are described in this topic. - -Additionally, there is a video that provides an overview of the MBAM architecture and MBAM Setup. For more information, see [MBAM Deployment and Architecture Overview](https://go.microsoft.com/fwlink/p/?LinkId=258392). - -## Architecture Overview - - -The following diagram displays the MBAM architecture. The single-server MBAM deployment topology is shown to introduce the MBAM features. However, this MBAM deployment topology is recommended only for lab environments. - -**Note**   -At least a three-computer MBAM deployment topology is recommended for a production deployment. For more information about MBAM deployment topologies, see [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md). - - - -![mbam single server deployment topology](images/mbam-1-server.jpg) - -1. **Administration and Monitoring Server**. The MBAM Administration and Monitoring Server is installed on a Windows server and hosts the MBAM Administration and Management website and the monitoring web services. The MBAM Administration and Management website is used to determine enterprise compliance status, to audit activity, to manage hardware capability, and to access recovery data, such as the BitLocker recovery keys. The Administration and Monitoring Server connects to the following databases and services: - - - Recovery and Hardware Database. The Recovery and Hardware database is installed on a Windows-based server and supported SQL Server instance. This database stores recovery data and hardware information that is collected from MBAM client computers. - - - Compliance and Audit Database. The Compliance and Audit Database is installed on a Windows server and supported SQL Server instance. This database stores compliance data for MBAM client computers. This data is used primarily for reports that are hosted by SQL Server Reporting Services (SSRS). - - - Compliance and Audit Reports. The Compliance and Audit Reports are installed on a Windows-based server and supported SQL Server instance that has the SSRS feature installed. These reports provide Microsoft BitLocker Administration and Monitoring reports. These reports can be accessed from the MBAM Administration and Management website or directly from the SSRS Server. - -2. **MBAM Client**. The Microsoft BitLocker Administration and Monitoring Client performs the following tasks: - - - Uses Group Policy to enforce the BitLocker encryption of client computers in the enterprise. - - - Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - - - Collects recovery information and hardware information about the client computers. - - - Collects compliance data for the computer and passes the data to the reporting system. - -3. **Policy Template**. The MBAM Group Policy template is installed on a supported Windows-based server or client computer. This template is used to specify the MBAM implementation settings for BitLocker drive encryption. - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md b/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md deleted file mode 100644 index 9020faa354..0000000000 --- a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: How to Configure Network Load Balancing for MBAM -description: How to Configure Network Load Balancing for MBAM -author: msfttracyp -ms.assetid: df2208c3-352b-4a48-9722-237b0c8cd6a5 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure Network Load Balancing for MBAM - - -To verify that you have met the prerequisites and hardware and software requirements to install the Administration and Monitoring Server feature, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - -**Note**   -To obtain the setup log files, you must install Microsoft BitLocker Administration and Monitoring (MBAM) by using the **msiexec** package and the **/l** <location> option. The Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder of the user who installs MBAM. - - - -The Network Load Balancing (NLB) clusters for the Administration and Monitoring Server feature provides scalability in MBAM and it should support more than 55,000 MBAM client computers. - -**Note**   -Windows Server Network Load Balancing distributes client requests across a set of servers that are configured into a single server cluster. When Network Load Balancing is installed on each of the servers (hosts) in a cluster, the cluster presents a virtual IP address or fully qualified domain name (FQDN) to client requests. The initial client requests go to all the hosts in the cluster, but only one host accepts and handles the request. - -All computers that will be part of a NLB cluster have the following requirements: - -- All computers in the NLB cluster must be in the same domain. - -- Each computer in the NLB cluster must use a static IP address. - -- Each computer in the NLB cluster must have Network Load Balancing enabled. - -- The NLB cluster requires a static IP address, and a host record must be manually created in the domain name system (DNS). - - - -## Configuring Network Load Balancing for MBAM Administration and Monitoring Servers - - -The following steps describe how to configure an NLB cluster virtual name and IP address for two MBAM Administration and Monitoring servers, and how to configure MBAM Clients to use the NLB Cluster. - -Before you begin the procedures described in this topic, you must have the MBAM Administration and Monitoring Server feature successfully installed by using the same IIS port binding on two separate server computers that meet the prerequisites for both MBAM Server feature installation and NLB Cluster configuration. - -**Note**   -This topic describes the basic process of using Network Load Balancing Manager to create an NLB Cluster. The exact steps to configure a Windows Server as part of an NLB cluster depend on the Windows Server version in use.. For more information about how to create NLBs on Windows Server 2008, see [Creating Network Load Balancing Clusters](https://go.microsoft.com/fwlink/?LinkId=197176) in the Windows Server 2008 TechNet library. - - - -**To configure an NLB Cluster Virtual Name and IP address for two MBAM Administration and Monitoring Servers** - -1. Click **Start**, click **All Programs**, click **Administrative Tools**, and then click **Network Load Balancing Manager**. - - **Note**   - If the NLB Manager is not present, you can install it as a Windows Server feature. You must install this feature on both MBAM Administration and Monitoring servers if you want to configure it into the NLB cluster. - - - -2. On the menu bar, click **Cluster**, and then click **New** to open the **Cluster Parameters** dialog box. - -3. In the **Cluster Parameters** dialog box, enter the information for the NLB cluster IP configuration: - - - **IP address:** NLB cluster IP address registered in DNS - - - **Subnet mask:** NLB cluster IP address subnet mask registered in DNS - - - **Full Internet name:** FQDN of NLB cluster name registered in DNS - -4. Ensure that **Unicast** is selected in **Cluster operation mode**, and then click **Next**. - -5. On the **Cluster IP Addresses** page, click **Next**. - -6. On the **Port Rules** page, click **Edit** to define the ports that the NLB cluster will respond to and configure the ports that are used for client-to-site system communication as they are defined for the site, or click **Next** to enable the NLB cluster IP address to respond to all TCP/IP ports. - - **Note**   - Ensure that **Affinity** is set to **Single**. - - - -7. On the **Connect** page, enter an MBAM Administration and Monitoring server instance host name that will be part of the NLB cluster in **Host**, and then click **Connect**. - -8. In **Interfaces available for configuring a new cluster**, select the networking interface that will be configured to respond to NLB cluster communication, and then click **Next**. - -9. On the **Host Parameters** page, review the information displayed to ensure that the **Dedicated IP configuration** settings display the dedicated host IP configuration for the correct NLB cluster host, check that the Initial host state **Default state:** is **Started**, and then click **Finish**. - - **Note**   - The **Host Parameters** page also displays the NLB cluster host priority, which is 1 through 32. As new hosts are added to the NLB cluster, the host priority must differ from the previously added hosts. The priority is automatically incremented when you use the Network Load Balancing Manager. - - - -10. Click **<NLB cluster name>** and ensure that the NLB host interface **Status** displays **Converged** before you continue. This step might require that you refresh the NLB cluster display as the host TCP/IP configuration that is being modified by the NLB Manager. - -11. To add additional hosts to the NLB cluster, right-click **<NLB cluster name>**, click **Add Host to Cluster,** and then repeat steps 7 through 10 for each site system that will be part of the NLB cluster. - -12. On a computer that has MBAM Group Policy template installed, modify the MBAM Group Policy settings to configure the MBAM services endpoints to use the NLB Cluster name and the appropriate IIS port binding to access the MBAM Administration and Monitoring Server features that are installed on the NLB Cluster computers. For more information about how to edit MBAM GPO settings, see [How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md). If the MBAM Administration and Monitoring servers are new to your environment, ensure that the required local security group memberships have been properly configured. For more information about security group requirements, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -13. When the NLB Cluster configuration is complete, we recommend that you validate that the MBAM Administration and Monitoring NLB Cluster is functional. To do this, open a web browser on a computer other than the servers that are configured in the NLB, and ensure that you can access the MBAM Administration and Monitoring web site by using the NLB FQDN. - -## Related topics - - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md deleted file mode 100644 index 8390876b1e..0000000000 --- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: How to Deploy the MBAM Client as Part of a Windows Deployment -description: How to Deploy the MBAM Client as Part of a Windows Deployment -author: msfttracyp -ms.assetid: 8704bf33-535d-41da-b9b2-45b60754367e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client as Part of a Windows Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker Client can be integrated into an organization by enabling BitLocker management and encryption on client computers during the computer imaging and Windows deployment process. - -**Note** -To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -Encryption of client computers with BitLocker during the initial imaging stage of a Windows deployment can lower the administrative overhead for MBAM implementation. This approach also ensures that every computer that is deployed already has BitLocker running and is configured correctly. - -**Warning** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -**To encrypt a computer as part of Windows deployment** - -1. If your organization plans to use the Trusted Platform Module (TPM) protector or the TPM + PIN protector options in BitLocker, you must activate the TPM chip before the initial deployment of MBAM. When you activate the TPM chip, you avoid a reboot later in the process, and you ensure that the TPM chips are correctly configured according to the requirements of your organization. You must activate the TPM chip manually in the computer's BIOS. Refer to the manufacturer documentation for more details about how to configure the TPM chip. - -2. Install the MBAM client agent. - -3. We recommend that you join the computer to a domain... - - - If the computer is not joined to a domain, the recovery password is not stored in the MBAM Key Recovery service. By default, MBAM does not allow encryption to occur unless the recovery key can be stored. - - - If a computer starts in recovery mode before the recovery key is stored on the MBAM server, the computer has to be reimaged. No recovery method is available. - -4. Open a command prompt as an administrator, stop the MBAM service, and then set the service to **manual** or **on demand**. Then, run the following commands: - - **net stop mbamagent** - - **sc config mbamagent start= demand** - -5. Set the registry settings for the MBAM agent to ignore Group Policy and run the TPM for **operating system only encryption** To do this, run **regedit**, and then import the registry key template from C:\\Program Files\\Microsoft\\MDOP MBAM\\MBAMDeploymentKeyTemplate.reg. - -6. In regedit, go to HKLM\\SOFTWARE\\Microsoft\\MBAM and configure the settings that are listed in the following table. - - Registry entry - - Configuration settings - - DeploymentTime - - 0 = OFF - - 1 = Use deployment time policy settings (default) - - UseKeyRecoveryService - - 0 = Do not use key escrow (The next two registry entries are not required in this case.) - - 1 = Use key escrow in Key Recovery system (default) - - Recommended: The computer must be able to communicate with the Key Recovery service. Verify that the computer can communicate with the service before you proceed. - - KeyRecoveryOptions - - 0 = Upload Recovery Key Only - - 1 = Upload Recovery Key and Key Recovery Package (default) - - KeyRecoveryServiceEndPoint - - Set this value to the URL for the Key Recovery web server. - - Example: http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - - - -~~~ -**Note** -MBAM policy or registry values can be set here to override the previously set values. -~~~ - - - -7. The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator: - - **net start mbamagent** - -8. When the computers restarts and the BIOS prompts you to accept a TPM change, accept the change. - -9. During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service. Then, to set start to **automatic**, open a command prompt as an administrator and run the following commands: - - **sc config mbamagent start= auto** - - **net start mbamagent** - -10. Remove the bypass registry values. To do this, run regedit, browse to the HKLM\\SOFTWARE\\Microsoft registry entry, right-click the **MBAM** node, and then click **Delete**. - -## Related topics - - -[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md deleted file mode 100644 index 739b6c100e..0000000000 --- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the MBAM Client to Desktop or Laptop Computers -description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: msfttracyp -ms.assetid: f32927a2-4c05-4da8-acca-1108d1dfdb7e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client to Desktop or Laptop Computers - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The MBAM Client can be integrated into an organization by deploying the client through tools, such as Active Directory Domain Services or an enterprise software deployment tool such as Microsoft System Center 2012 Configuration Manager. - -**Note**   -To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -**To deploy the MBAM Client to desktop or laptop computers** - -1. Locate the MBAM Client installation files that are provided with the MBAM software. - -2. Deploy the Windows Installer package to target computers by using Active Directory Domain Services or an enterprise software deployment tool, such as Microsoft System Center 2012 Configuration Manager. - - **Note**   - You should not use Group Policy to deploy the Windows Installer package. - - - -3. Configure the distribution settings or Group Policy to run the MBAM Client installation file. After successful installation, the MBAM Client applies the Group Policy settings that are received from a domain controller to begin BitLocker encryption and management functions. For more information about MBAM Group Policy settings, see [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). - - **Important**   - The MBAM Client will not start BitLocker encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed before BitLocker encryption will begin. - - - -## Related topics - - -[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md b/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md deleted file mode 100644 index 9183a1ebb8..0000000000 --- a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Determine the BitLocker Encryption State of a Lost Computers -description: How to Determine the BitLocker Encryption State of a Lost Computers -author: msfttracyp -ms.assetid: 9440890a-9c63-463b-9113-f46071446388 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine the BitLocker Encryption State of a Lost Computers - - -Microsoft BitLocker Administration and Monitoring (MBAM) enables you to determine the last known BitLocker encryption status of computers that are lost or stolen. Use the following procedure to determine whether the volumes have been encrypted on computers that are no longer in your possession. - -**Determine a Computer's Last Known BitLocker Encryption state** - -1. Open the MBAM website. - - **Note**   - The default address for the MBAM website is http://*<computername>*. Use the fully qualified server name for faster browsing results. - - - -2. Select the **Report** node from the navigation pane, and then select the **Computer Compliance Report**. - -3. Use the filter fields in the right-side pane to narrow the search results, and then click **Search**. Results will be shown below your search query. - -4. Take the appropriate action as determined by your policy for lost devices. - - **Note**   - Device compliance is determined by the deployed BitLocker policies. You should verify these deployed policies when you are trying to determine the BitLocker encryption state of a device. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md b/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md deleted file mode 100644 index 7b594af29c..0000000000 --- a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Edit MBAM 1.0 GPO Settings -description: How to Edit MBAM 1.0 GPO Settings -author: msfttracyp -ms.assetid: 03d12fbc-4302-43fc-9b38-440607d778a1 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit MBAM 1.0 GPO Settings - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you must first determine the Group Policies that you will use in your implementation of Microsoft BitLocker Administration and Monitoring. For more information about the various available policies, see [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). After you have determined the policies that you are going to use, you then must modify one or more Group Policy Objects (GPO) that include the MBAM policy settings. - -The following steps describe how to configure the basic, recommended Group Policy object (GPO) settings to enable MBAM to manage BitLocker encryption for your organization’s client computers. - -**To edit the MBAM Client GPO settings** - -1. On a computer that has MBAM Group Policy template installed, make sure that MBAM services are enabled. - -2. Use the Group Policy Management Console (GPMC.msc) or the Advanced Group Policy Management (AGPM) MDOP product for these actions: Select **Computer configuration**, choose **Policies**, click **Administrative Templates**, select **Windows Components**, and then click **MDOP MBAM (BitLocker Management)**. - -3. Edit the Group Policy Object settings that are required to enable MBAM Client services on client computers. For each policy in the table that follows, select **Policy Group**, click the **Policy**, and then configure the **Setting**. - - Policy Group - - Policy - - Setting - - Client Management - - Configure MBAM Services - - Enabled. Set **MBAM Recovery and Hardware service endpoint** and **Select BitLocker recovery information to store**. - - Set **MBAM compliance service endpoint** and **Enter status report frequency in (minutes)**. - - Allow hardware compatibility checking - - Disabled. This policy is enabled by default, but is not needed for a basic MBAM implementation. - - Operating System Drive - - Operating system drive encryption settings - - Enabled. Set **Select protector for operating system drive**. This is required to save operating system drive data to the MBAM Key Recovery server. - - Removable Drive - - Control Use of BitLocker on removable drives - - Enabled. This is required if MBAM will save removable drive data to the MBAM Key Recovery server. - - Fixed Drive - - Control Use of BitLocker on fixed drives - - Enabled. This is required if MBAM will save fixed drive data to the MBAM Key Recovery server. - - Set **Choose how BitLocker-protected drives can be recovered** and **Allow data recovery agent**. - - - -~~~ -**Important** -Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) for Group Policy configuration details for all of the available MBAM GPO policy options. -~~~ - - - -## Related topics - - -[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md b/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md deleted file mode 100644 index 2117e28d4f..0000000000 --- a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: How to Generate MBAM Reports -description: How to Generate MBAM Reports -author: msfttracyp -ms.assetid: cdf4ae76-040c-447c-8736-c9e57068d221 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Generate MBAM Reports - - -Microsoft BitLocker Administration and Monitoring (MBAM) generates various reports to monitor BitLocker encryption usage and compliance. This topic describes how to open the MBAM administration website and how to generate MBAM reports on enterprise compliance, individual computers, hardware compatibility, and key recovery activity. For more information about MBAM reports, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-1.md). - -**Note**   -To run the reports, you must be a member of the **Report Users** role on the computers where you have installed the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports. - - - -**To open the MBAM Administration website** - -1. Open a web browser and navigate to the MBAM website. The default URL for the website is *http://<computername>* of the Microsoft BitLocker Administration and Monitoring server. - - **Note**   - If the MBAM administration website was installed on a port other than port 80, you must specify that port number in the URL. For example, *http://<computername>:<port>*. If you specified a Host Name for the MBAM administration website during the installation, the URL would be *http://<hostname>*. - - - -2. In the navigation pane, click **Reports**. In the main pane, click the tab for your report type: **Enterprise Compliance Report**, **Computer Compliance Report**, **Hardware Audit Report**, or **Recovery Audit Report**. - - **Note**   - Historical MBAM Client data is retained in the compliance database. This retained data may be needed in case a computer is lost or stolen. When running enterprise reports, you should use appropriate start and end dates to scope the time frames for the reports from one to two weeks to increase the reporting data accuracy. - - - -**To generate an enterprise Compliance Report** - -1. On the MBAM administration website, click **Reports** in the navigation pane, then click the **Enterprise Compliance Report** tab and select the appropriate filters for your report. For the Enterprise Compliance Report, you can set the following filters. - - - **Compliance Status**. Use this filter to specify the compliance status types (for example, Compliant or Noncompliant) to include in the report. - - - **Error State**. Use this filter to specify the Error State types, such as No Error or Error, to include in the report. - -2. Click **View Report** to display the specified report. - - The report results can be saved in any of several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - - **Note**   - The Enterprise Compliance report is generated by a SQL job that runs every six hours. Therefore, the first time you try to view the report you may find that some data is missing. - - - -3. To view information about a computer in the Computer Compliance Report, select the computer name. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - -**To generate the Computer Compliance Report** - -1. In the MBAM administration website, select the **Report** node in the navigation pane, and then select the **Computer Compliance Report**. Use the Computer Compliance report to search for **user name** or **computer name**. - -2. Click **View Report** to view the computer report. - - Results can be saved in any of several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - -3. To display more information about a computer in the Computer Compliance Report, select the computer name. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - - **Note**   - An MBAM Client computer is considered compliant if the computer matches the requirements of the MBAM policy settings or the computer’s hardware model is set to incompatible. Therefore, when you are viewing detailed information about the disk volumes associated with the computer, computers that are exempt from BitLocker encryption due to hardware compatibility can be displayed as compliant even though their drive volume encryption status is displayed as noncompliant. - - - -**To generate the Hardware Compatibility Audit Report** - -1. From the MBAM administration website, select the **Report** node from the navigation pane, and then select the **Hardware Audit Report**. Select the appropriate filters for your Hardware Audit report. The Hardware Audit report offers the following available filters: - - - **User (Domain\\User)**. Specifies the name of the user who made a change. - - - **Change Type**. Specifies the type of changes you are looking for. - - - **Start Date**. Specifies the Start Date part of the date range that you want to report on. - - - **End Date**. Specifies the End Date part of the date range that you want to report on. - -2. Click **View Report** to view the report. - - Results can be saved in several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - -**To generate the Recovery Key Audit Report** - -1. From the MBAM administration website, select the **Report** node in the navigation pane, and then select the **Recovery Audit Report**. Select the filters for your Recovery Key Audit report. The available filters for Recovery Key audits are as follows: - - - **Requestor**. Specifies the user name of the requestor. The requestor is the person in the help desk who accessed the key on behalf of a user. - - - **Requestee**. Specifies the user name of the requestee. The requestee is the person who called the help desk to obtain a recovery key. - - - **Request Result** Specifies the request result types, such as: Success or Failed. For example, you may want to view failed key access attempts. - - - **Key Type**. Specifies the Key Type, such as: Recovery Key Password or TPM Password Hash. - - - **Start Date**. Specifies the Start Date part of the date range. - - - **End Date**. Specifies the End Date part of the date range. - -2. Click **View Report** to display the report. - - Results can be saved in several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md b/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md deleted file mode 100644 index dbf5369cc9..0000000000 --- a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Hide Default BitLocker Encryption in The Windows Control Panel -description: How to Hide Default BitLocker Encryption in The Windows Control Panel -author: msfttracyp -ms.assetid: c8503743-220c-497c-9785-e2feeca484d6 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Hide Default BitLocker Encryption in The Windows Control Panel - - -Microsoft BitLocker Administration and Monitoring (MBAM) offers a customized control panel for MBAM client computers that is named called BitLocker Encryption Options. This customized control panel can replace the default Windows BitLocker control panel that is named BitLocker Drive Encryption. The BitLocker Encryption Options control panel, located under System and Security in the Windows control panel, enables users to manage their PIN and passwords, unlock drives, and hides the interface that allows administrators to decrypt a drive or to suspend or resume BitLocker encryption. - -**To hide default BitLocker Encryption in the Windows Control Panel** - -1. Browse to **User configuration** by using the Group Policy Management Console (GPMC), the Advanced Group Policy Management (AGPM), or the Local Group Policy Editor on the BitLocker Group Policies computer. - -2. Click **Policies**, select **Administrative Templates**, and then click **Control Panel**. - -3. In the **Details** pane, double-click **Hide specified Control Panel items**, and then select **Enabled**. - -4. Click **Show**, **click Add…**, and then type Microsoft.BitLockerDriveEncryption. This policy hides the default Windows BitLocker Management tool from the Windows Control Panel and allows the user to open the updated MBAM BitLocker Encryption Options tool from the Windows Control Panel. - -## Related topics - - -[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md deleted file mode 100644 index 178bb1e922..0000000000 --- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: How to Install and Configure MBAM on a Single Server -description: How to Install and Configure MBAM on a Single Server -author: msfttracyp -ms.assetid: 55841c63-bad9-44e7-b7fd-ea7037febbd7 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure MBAM on a Single Server - - -The procedures in this topic describe the full installation of the Microsoft BitLocker Administration and Monitoring (MBAM) features on a single server. - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and the hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). In addition, some features also have information that must be provided during the installation process to successfully deploy the feature. You should also review [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) before you begin the MBAM deployment. - -**Note**   -To obtain the setup log files, you must install MBAM by using the **msiexec** package and the **/l** <location> option. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder of the user who is installing MBAM. - - - -## To install MBAM Server features on a single server - - -The following steps describe how to install general MBAM features. - -**Note**   -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To start MBAM Server features installation** - -1. Start the MBAM installation wizard. Click **Install** at the Welcome page. - -2. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -3. By default, all MBAM features are selected for installation. Features that will be installed on the same computer must be installed together at the same time. Clear the features that you want to install elsewhere. You must install the MBAM features in the following order: - - - Recovery and Hardware Database - - - Compliance and Audit Database - - - Compliance Audit and Reports - - - Administration and Monitoring Server - - - MBAM Group Policy Template - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you must resolve the missing prerequisites, and then click **Check prerequisites again**. After all prerequisites are met, the installation resumes. - - - -4. You are prompted to configure the network communication security. MBAM can encrypt the communication between the Recovery and Hardware Database, the Administration and Monitoring Server, and the clients. If you decide to encrypt the communication, you are asked to select the authority-provisioned certificate that will be used for encryption. - -5. Click **Next** to continue. - -6. The MBAM Setup wizard will display the installation pages for the selected features. - -**To deploy MBAM Server features** - -1. In the **Configure the Recovery and Hardware database** window, specify the instance of SQL Server and the name of the database that will store the recovery and hardware data. You must also specify both the database files location and the log information location. - -2. Click **Next** to continue. - -3. In the **Configure the Compliance and Audit database** window, specify the instance of the SQL Server and the name of the database that will store the compliance and audit data. Then, specify the database files location and the log information location. - -4. Click **Next** to continue. - -5. In the **Compliance and Audit Reports** window, specify the report service instance that will be used and provide a domain user account for accessing the database. This should be a user account that is provisioned specifically for this use. The user account should be able to access all data available to the MBAM Reports Users group. - -6. Click **Next** to continue. - -7. In the **Configure the Administration and Monitoring Server** window, enter the **Port Binding**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring server. - - **Warning**   - The port number that you specify must be an unused port number on the Administration and Monitoring server, unless a unique host header name is specified. - - - -8. Click **Next** to continue. - -9. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. The Microsoft Updates option does not turn on the Automatic Updates in Windows. - -10. When the Setup wizard has collected the necessary feature information, the MBAM installation is ready to start. Click **Back** to move back through the wizard if you want to review or change your installation settings. Click **Install** to begin the installation. Click **Cancel** to exit Setup. Setup installs the MBAM features and notifies you that the installation is completed. - -11. Click **Finish** to exit the wizard. - -12. After you install MBAM server features, you must add users to the MBAM roles. For more information, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -**To perform post installation configuration** - -1. After Setup is finished, you must add user roles so that you can give users access to features in the MBAM administration website. On the Administration and Monitoring Server, add users to the following local groups: - - - **MBAM Hardware Users**: Members of this local group can access the Hardware feature in the MBAM administration website. - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage TPM features in the MBAM administration website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features in the MBAM administration website. For Advanced Helpdesk Users, only the Key ID field is required in Drive Recovery. For Manage TPM users, only the Computer Domain field and Computer Name field are required. - -2. On the Administration and Monitoring Server, Compliance and Audit Database, and on the computer that hosts the Compliance and Audit Reports, add users to the following local group to enable them to access the Reports feature in the MBAM administration website: - - - **MBAM Report Users**: Members of this local group can access the Reports features in the MBAM administration website. - - **Note**   - Identical user membership or group membership of the **MBAM Report Users** local group must be maintained on all computers where the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed. - - To maintain identical memberships on all computers, you should create a domain security group and add that domain group to each local MBAM Report Users group. When you do this, you can manage the group memberships by using the domain group. - - - -## Validating the MBAM Server feature installation - - -When the MBAM installation is complete, validate that the installation has successfully set up all the necessary MBAM features that are required for BitLocker management. Use the following procedure to confirm that the MBAM service is functional: - -**To validate MBAM Server feature installation** - -1. On each server where an MBAM feature is deployed, open **Control Panel**. Click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the installation, you must use a Domain Account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance and Audit Database** is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance is at http://<NameofMBAMReportsServer>/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup. - - Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and click **Internet Information Services (IIS) Manager** - -6. In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -7. On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges, and then browse to the following locations in the MBAM website to verify that they load successfully: - - - *http://<computername>/default.aspx* and confirm each of the links for navigation and reports - - - *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - - - *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - - - *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - - **Note** - Typically, the services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://<hostheadername>/default.aspx. - - If the services are installed with network encryption, change http:// to https://. - - - -## Related topics - - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md deleted file mode 100644 index 8415738e13..0000000000 --- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md +++ /dev/null @@ -1,246 +0,0 @@ ---- -title: How to Install and Configure MBAM on Distributed Servers -description: How to Install and Configure MBAM on Distributed Servers -author: msfttracyp -ms.assetid: 9ee766aa-6339-422a-8d00-4f58e4646a5e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure MBAM on Distributed Servers - - -The procedures in this topic describe the full installation of the Microsoft BitLocker Administration and Monitoring (MBAM) features on distributed servers. - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). In addition, some features require that you provide certain information during the installation process to successfully deploy the feature. - -**Note** -To obtain the setup log files, you have to install MBAM by using the **msiexec** package and the **/l <location>** option. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder of the user that runs the MBAM installation. - - - -## Deploy the MBAM Server features - - -The following steps describe how to install the general MBAM features. - -**Note** -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To Deploy MBAM Server features** - -1. Start the MBAM installation wizard, and click **Install** at the Welcome page. - -2. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -3. By default, all MBAM features are selected for installation. Clear the features that you want to install elsewhere. Features that you want to install on the same computer must be installed all at the same time. MBAM features must be installed in the following order: - - - Recovery and Hardware Database - - - Compliance and Audit Database - - - Compliance Audit and Reports - - - Administration and Monitoring Server - - - MBAM Group Policy Template - - **Note** - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation will resume. - - - -4. The MBAM Setup wizard will display the installation pages for the selected features. The following sections describe the installation procedures for each feature. - - **Note** - Typically, each feature is installed on a separate server. If you want to install multiple features on a single server, you may change or eliminate some of the following steps. - - - -~~~ -**To install the Recovery and Hardware Database** - -1. Choose an option for MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption. - -2. Click **Next** to continue. - -3. Specify the names of the computers that will be running the Administration and Monitoring Server feature, to configure access to the Recovery and Hardware Database.. Once the Administration and Monitoring Server feature is deployed, it connects to the database by using its domain account. - -4. Click **Next** to continue. - -5. Specify the **Database Configuration** for the SQL Server instance that stores the recovery and hardware data. You must also specify where the database will be located and where the log information will be located. - -6. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Compliance and Audit Database** - -1. Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Compliance and Audit Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that will be used for encryption. - -2. Click **Next** to continue. - -3. Specify the user account that will be used to access the database for reports. - -4. Click **Next** to continue. - -5. Specify the computer names of the computers that you want to run the Administration and Monitoring Server and the Compliance and Audit Reports, to configure the access to the Compliance and Audit Database.. After the Administration and Monitoring and the Compliance and Audit Reports Server are deployed, they will connect to the databases by using their domain accounts. - -6. Specify the **Database Configuration** for the SQL Server instance that will store the compliance and audit data. You must also specify where the database will be located and where the log information will be located. - -7. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Compliance and Audit Reports** - -1. Specify the remote SQL Server instance. For example, *<ServerName>*,where the Compliance and Audit Database are installed. - -2. Specify the name of the Compliance and Audit Database. By default, the database name is “MBAM Compliance Status”, but you can change the name when you install the Compliance and Audit Database. - -3. Click **Next** to continue. - -4. Select the SQL Server Reporting Services instance where the Compliance and Audit Reports will be installed. Provide the username and password used to access the compliance database. - -5. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Administration and Monitoring Server feature** - -1. Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption. - -2. Click **Next** to continue. - -3. Specify the remote SQL Server instance, For example, *<ServerName>*, where the Compliance and Audit Database are installed. - -4. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, but, you can change the name when you install the Compliance and Audit Database. - -5. Click **Next** to continue. - -6. Specify the remote SQL Server instance. For example, *<ServerName>*,where the Recovery and Hardware Database are installed. - -7. Specify the name of the Recovery and Hardware Database. By default, the database name is **MBAM Recovery and Hardware**, but you can change the name when you install the Recovery and Hardware Database feature. - -8. Click **Next** to continue. - -9. Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at: - - http://*<NameofMBAMReportsServer>/*ReportServer - - **Note** - If you configured the SQL Server Reporting Services as a named instance, the URL resembles the following:http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>* - - - -10. Click **Next** to continue. - -11. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring server - - **Warning** - The port number that you specify must be an unused port number on the Administration and Monitoring server, unless you specify a unique host header name. - - - -12. Click **Next** to continue with the MBAM Setup wizard. -~~~ - -5. - - Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. - -6. When the selected MBAM feature information is complete, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to begin the installation. Click **Cancel** to exit the Wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished. - -7. Click **Finish** to exit the wizard. - -8. Add users to appropriate MBAM roles, after the MBAM server features are installed.. For more information, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -**Post-installation configuration** - -1. After MBAM Setup is finished, you must add user Roles before users can access to features in the MBAM administration website. On the Administration and Monitoring Server, add users to the following local groups. - - - **MBAM Hardware Users**: Members of this local group can access the Hardware feature in the MBAM administration website. - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage Trusted Platform Modules (TPM) features in the MBAM administration website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features in the MBAM administration website. For Advanced Helpdesk Users, only the Key ID field is required in Drive Recovery. In Manage TPM, only the Computer Domain field and Computer Name field are required. - -2. On the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports, add users to the following local group to give them access to the Reports feature in the MBAM administration website. - - - **MBAM Report Users**: Members of this local group can access the Reports in the MBAM administration website. - - **Note** - Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and the Compliance and Audit Reports are installed. - - - -## Validate the MBAM Server feature installation - - -When the MBAM Server feature installation is complete, you should validate that the installation has successfully set up all the necessary features for MBAM. Use the following procedure to confirm that the MBAM service is functional. - -**To validate an MBAM installation** - -1. On each server, where an MBAM feature is deployed, open **Control Panel**, click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the MBAM installation, you must use a Domain Account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status** database is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance can be found at http://<NameofMBAMReportsServer>/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup. - - Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**. In **Connections** browse to *<computername>*, click **Sites**, and click **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -6. On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges and browse to the following locations in the MBAM web site, to verify that they load successfully: - - - *http://<computername>/default.aspx* and confirm each of the links for navigation and reports - - - *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - - - *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - - - *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - - **Note** - Typically, services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://<hostheadername>/default.aspx - - If the services were installed with network encryption, change http:// to https://. - - - -~~~ -Verify that each web page loads successfully. -~~~ - -## Related topics - - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md b/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md deleted file mode 100644 index 9a47bce6c6..0000000000 --- a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Install the MBAM 1.0 Group Policy Template -description: How to Install the MBAM 1.0 Group Policy Template -author: msfttracyp -ms.assetid: 451a50b0-939c-47ad-9248-a138deade550 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM 1.0 Group Policy Template - - -In addition to the server-related features of Microsoft BitLocker Administration and Monitoring (MBAM), the server setup application includes an MBAM Group Policy template. You can install this template on any computer that is capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -The following steps describe how to install the MBAM Group Policy template. - -**Note**   -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To install the MBAM Group Policy template** - -1. Start the MBAM installation wizard; then, click **Install** on the Welcome page. - -2. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -3. By default, all MBAM features are selected for installation. Clear all feature options except for **Policy Template**, and then click **Next** to continue the installation. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you must resolve the missing prerequisite and then click **Check prerequisites again**. Once all prerequisites are met, the installation will resume. - - - -4. After the MBAM Setup wizard displays installation pages for the selected features, click **Finish** to close MBAM Setup. - -## Related topics - - -[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md deleted file mode 100644 index 40aea24b1a..0000000000 --- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Install the MBAM Language Update on a Single Server -description: How to Install the MBAM Language Update on a Single Server -author: msfttracyp -ms.assetid: e6fe59a3-a3e1-455c-a059-1f23ee083cf6 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM Language Update on a Single Server - - -Microsoft BitLocker Administration and Monitoring (MBAM) includes four server roles that can be run on one or more computers. However, only two MBAM Server features require the update to support installation of the MBAM 1.0 language release and the MBAM Policy Template. To update all three of the required MBAM features to be installed on one computer, perform the steps described in this topic. - -**To install the MBAM language update on a single server** - -1. Open the Internet Information Services (IIS) Management Console, go to **Sites**, and then shut down the Microsoft BitLocker Administration and Monitoring website. - -2. Edit the bindings for the MBAM website, and then temporarily modify the bindings of the site. For example, change the port from 443 to 9443. - -3. Locate and run the MBAM setup wizard (MBAMsetup.exe) and select the following three features: - - 1. Compliance and Audit Reports - - 2. Administration and Monitoring Server - - 3. Group Policy Templates - - **Important**   - The MBAM server features must be updated in the following order: Compliance and Audit Reports first, then Administration and Monitoring Server. The Group Policy templates can be updated at any time without concern for sequence. - - - -4. After you upgrade the server database, open the IIS Management Console and review the bindings of the Microsoft BitLocker Administration and Monitoring website. - -5. Delete one of the bindings and ensure that the remaining binding has the correct host name, certificate, and port number for the MBAM enterprise configuration. - -6. Restart the MBAM website. - -7. Test the MBAM website functionality: - - - Open the MBAM web interface and ensure you can fetch a recovery key for a client. - - - Enforce encryption of a new or manually decrypted client computer. - - **Note**   - The MBAM client opens only if it can communicate with the Recovery and Hardware database. - - - -## Related topics - - -[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md deleted file mode 100644 index 1043c5be7b..0000000000 --- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Install the MBAM Language Update on Distributed Servers -description: How to Install the MBAM Language Update on Distributed Servers -author: msfttracyp -ms.assetid: 5ddc64c6-0417-4a04-843e-b5e18d9f1a52 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM Language Update on Distributed Servers - - -Microsoft BitLocker Administration and Monitoring (MBAM) includes four server roles that can be run on one or more computers. However, only two MBAM Server features require the update to support the installation of the MBAM 1.0 language release and the MBAM Policy Template. In configurations with the MBAM Server features installed on multiple computers, only the following server features need to be updated: - -- The MBAM Compliance and Audit Reports - -- The MBAM Administration and Monitoring Server - -**Important**   -The MBAM server features must be updated in this order: Compliance and Audit Reports first, and then the Administration and Monitoring Server. The MBAM Group Policy templates can be updated at any time without concern for sequence. - - - -**To install the MBAM Language Update on the MBAM Compliance and Audit Report Server feature** - -1. On the computer running the MBAM Compliance and Audit Report feature, locate and run the MBAM Language Update setup wizard (MBAMsetup.exe). - -2. Complete the wizard for the Compliance and Audit Reports and then close the wizard. - -**To install the MBAM Language Update on the MBAM Administration and Monitoring Server feature** - -1. On the computer that is running the MBAM Administration and Monitoring feature, open the Internet Information Services (IIS) management console, go to **Sites**, and then shut down the Microsoft BitLocker Administration and Monitoring website. - -2. Choose to edit the bindings for the MBAM website, and then modify the bindings of the site. For example, change the port from 443 to 9443. - -3. Locate and run the MBAM Language Update setup wizard (MBAMsetup.exe). Complete the wizard for the Administration and Monitoring Server feature and then close the wizard. - -4. After you upgrade the server database, open IIS Management Console and review the bindings of the Microsoft BitLocker Administration and Monitoring website. - -5. Delete the old binding and ensure that the remaining binding has the correct host name, certificate, and port number for the MBAM enterprise configuration. - -6. Restart the MBAM web site. - -7. Test the MBAM web site functionality: - - - Open the MBAM web interface and ensure that you can obtain a recovery key for a client. - - - Enforce encryption of a new or manually decrypted client computer. - - **Note**   - The MBAM client opens only if it can communicate with the Recovery and Hardware database. - - - -## Related topics - - -[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md b/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md deleted file mode 100644 index 56b13e75d8..0000000000 --- a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Manage Computer BitLocker Encryption Exemptions -description: How to Manage Computer BitLocker Encryption Exemptions -author: msfttracyp -ms.assetid: d4400a0d-b36b-4cf5-a294-1f53ec47f9ee -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Computer BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) can be used to exempt certain computers from BitLocker protection. For example, an organization may decide to control BitLocker exemption on a computer-by-computer basis. - -To exempt a computer from BitLocker encryption, you must add the computer to a security group in Active Directory Domain Services in order to bypass any computer-based BitLocker protection rules. - -**Note**   -If the computer is already BitLocker-protected, the computer exemption policy has no effect. - - - -**To exempt a computer from BitLocker encryption** - -1. Add the computer account that you want to be exempted to a security group in Active Directory Domain Services. This allows you to bypass any computer-based BitLocker protection rules. - -2. Create a Group Policy Object by using the MBAM Group Policy template, then associate the Group Policy Object with the Active Directory group that you created in the previous step. For more information about creating the necessary Group Policy Objects, see [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md). - -3. When an exempted computer starts, the MBAM client checks the Computer Exemption Policy setting and suspends protection based on whether the computer is part of the BitLocker exemption security group. - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md b/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md deleted file mode 100644 index 1ed110d24c..0000000000 --- a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: How to Manage Hardware Compatibility -description: How to Manage Hardware Compatibility -author: msfttracyp -ms.assetid: c74b96b9-8161-49bc-b5bb-4838734e7df5 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Hardware Compatibility - - -Microsoft BitLocker Administration and Monitoring (MBAM) can collect information about the manufacturer and model of client computers after you deploy the Allow Hardware Compatibility Checking Group Policy. If you configure this policy, the MBAM agent reports the computer make and model information to the MBAM Server when the MBAM Client is deployed on a client computer. - -The Hardware Compatibility feature is helpful when your organization has older computer hardware or computers that do not support Trusted Platform Module (TPM) chips. In these cases, you can use the Hardware Compatibility feature to ensure that BitLocker encryption is applied only to computer models that support it. If all computers in your organization will support BitLocker, you do not have to use the Hardware Compatibility feature. - -**Note**   -By default, MBAM Hardware Compatibility feature is not enabled. To enable it, select the **Hardware Compatibility** feature under the **Administration and Monitoring Server** feature during setup. For more information about how to set up and configure Hardware Compatibility, see [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md). - - - -The Hardware Compatibility feature works in the following way. - -**** - -1. The MBAM client agent discovers basic computer information such as manufacturer, model, BIOS maker, BIOS version, TPM maker, and TPM version, and then passes this information to the MBAM server. - -2. The MBAM server generates a list of client computer makes and models to enable you to differentiate between those that can or cannot support BitLocker - -3. The MBAM client agents that are deployed in the enterprise automatically update this list with all new computer makes and models that are discovered with a state of **Unknown**. An administrator can then use the MBAM administration website to change list entries to specify a particular computer make and model as **Compatible** or **Incompatible**. - -4. Before the MBAM client agent begins encrypting a drive, the agent first verifies the BitLocker encryption compatibility of the hardware it is running on. - - - If the hardware is marked as compatible, the BitLocker encryption process starts. MBAM will also recheck the hardware compatibility status of the computer one time per day. - - - If the hardware is marked as incompatible, the agent logs an event and passes a “hardware exempted” state as part of compliance reporting. The agent checks every seven days to see whether the state has changed to “compatible.” - - - If the hardware is marked as unknown, the BitLocker encryption process will not begin. The MBAM client agent will recheck the hardware compatibility status of the computer one time per day. - -**Warning**   -If the MBAM client agent tries to encrypt a computer that does not support BitLocker drive encryption, there is a possibility that the computer will become corrupted. Ensure that the hardware compatibility feature is correctly configured when your organization has older hardware that does not support BitLocker. - - - -**To manage hardware compatibility** - -1. Open a web browser and navigate to the Microsoft BitLocker Administration and Monitoring website. Select **Hardware** in the left menu bar. - -2. On the right pane, click **Advanced Search**, and then filter to display a list of all computer models that have a **Capability** status of **Unknown**. A list of computer models matching the search criteria is displayed. Administrators can add, edit, or remove new computer types from this page. - -3. Review each unknown hardware configuration to determine whether the configuration should be set to **Compatible** or **Incompatible**. - -4. Select one or more rows, and then click either **Set Compatible** or **Set Incompatible** to set the BitLocker compatibility, as appropriate, for the selected computer models. If set to **Compatible**, BitLocker tries to enforce drive encryption policy on computers that match the supported model. If set to **Incompatible**, BitLocker will not enforce drive encryption policy on those computers. - - **Note**   - After you set a computer model as compatible, it can take more than twenty-four hours for the MBAM Client to begin BitLocker encryption on the computers matching that hardware model. - - - -5. Administrators should regularly monitor the hardware compatibility list to review new models that are discovered by the MBAM agent, and then update their compatibility setting to **Compatible** or **Incompatible** as appropriate. - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md deleted file mode 100644 index 71eda0e490..0000000000 --- a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Manage MBAM Administrator Roles -description: How to Manage MBAM Administrator Roles -author: msfttracyp -ms.assetid: c0f25a42-dbff-418d-a776-4fe23ee07d16 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Administrator Roles - - -After Microsoft BitLocker Administration and Monitoring (MBAM) Setup is complete for all server features, administrative users must be granted access to these server features. As a best practice, administrators who will manage or use MBAM server features, should be assigned to Active Directory security groups and then those groups should be added to the appropriate MBAM administrative local group. - -**To manage MBAM Administrator Role memberships** - -1. Assign administrative users to security groups in Active Directory Domain Services. - -2. Add Active Directory Domain Services security groups to the roles for MBAM administrative local groups on the Microsoft BitLocker Administration and Monitoring server for the respective features. The user roles are as follows: - - - **MBAM System Administrators** have access to all Microsoft BitLocker Administration and Monitoring features in the MBAM administration website. - - - **MBAM Hardware Users** have access to the Hardware Compatibility features in the MBAM administration website. - - - **MBAM Helpdesk Users** have access to the Manage TPM and Drive Recovery options in the MBAM administration website, but must fill in all fields when they use either option. - - - **MBAM Report Users** have access to the Compliance and Audit reports in the MBAM administration website. - - - **MBAM Advanced Helpdesk Uses** have access to the Manage TPM and Drive Recovery options in the MBAM administration website. These users are not required to fill in all fields when they use either option. - - For more information about roles for Microsoft BitLocker Administration and Monitoring, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md deleted file mode 100644 index 6800cc91ac..0000000000 --- a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -author: msfttracyp -ms.assetid: c08077e1-5529-468f-9370-c3b33fc258f3 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel - - -A Microsoft BitLocker Administration and Monitoring (MBAM) control panel application, called BitLocker Encryption Options, will be available under **System and Security** when the MBAM Client is installed. This customized MBAM control panel replaces the default Windows BitLocker control panel. The MBAM control panel enables you to unlock encrypted drives (fixed and removable), and also helps you manage your PIN or password. For more information about enabling the MBAM control panel, see [How to Hide Default BitLocker Encryption in The Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md). - -**Note**   -For the BitLocker client, the Admin and Operational log files are located in Event Viewer, under **Application and Services Logs** / **Microsoft** / **Windows** / **BitLockerManagement**. - - - -**To use the MBAM Client Control Panel** - -1. To open BitLocker Encryption Options, click **Start**, and then select **Control Panel**. When **Control Panel** opens, select **System and Security**. - -2. Double-click **BitLocker Encryption Options** to open the customized MBAM control panel. You will see a list of all the hard disk drives on the computer and their encryption status. You will also see an option to manage your PIN or passwords. - -3. Use the list of hard disk drives on the computer to verify the encryption status, unlock a drive, or request an exemption for BitLocker protection if the User and Computer Exemption policies have been deployed. - -4. Non-administrators can use the BitLocker Encryption Options control panel to manage PINs or passwords. A user can select **Manage PIN,** and then enter both a current PIN and a new PIN. Users can also confirm their new PIN. The **Update PIN** function will reset the PIN to the new one that the user selects. - -5. To manage your password, select **Unlock drive** and enter your current password. As soon as the drive is unlocked, select **Reset Password** to change your current password. - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md b/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md deleted file mode 100644 index 48e9ef2121..0000000000 --- a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Manage User BitLocker Encryption Exemptions -description: How to Manage User BitLocker Encryption Exemptions -author: msfttracyp -ms.assetid: 48d69721-504f-4524-8a04-b9ce213ac9b4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage User BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) can be used to manage BitLocker protection by exempting users who do not need or want their drives encrypted. - -To exempt users from BitLocker protection, an organization must first create an infrastructure to support such exemptions. The supporting infrastructure might include a contact telephone number, webpage, or mailing address to request exemption. Also, any exempt user will have to be added to a security group for Group Policy created specifically for exempted users. When members of this security group log on to a computer, the user Group Policy shows that the user is exempted from BitLocker protection. The user policy overwrites the computer policy, and the computer will remain exempt from BitLocker encryption. - -**Note**   -If the computer is already BitLocker-protected, the user exemption policy has no effect. - - - -The following table shows how BitLocker protection is applied based on how exemptions are set. - - ----- - - - - - - - - - - - - - - - - - - - -
          User StatusComputer Not ExemptComputer Exempt

          User not exempt

          BitLocker protection is enforced on the computer.

          BitLocker protection is not enforced on the computer.

          User exempt

          BitLocker protection is not enforced on the computer.

          BitLocker protection is not enforced on the computer.

          - - - -**To exempt a user from BitLocker Encryption** - -1. Create an Active Directory Domain Services security group that will be used to manage user exemptions from BitLocker encryption. - -2. Create a Group Policy Object setting by using the MBAM Group Policy template. Associate the Group Policy Object with the Active Directory group that you created in the previous step. For more information about the necessary policy settings to enable users to request exemption from BitLocker encryption, see the Configure User Exemption Policy section in [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). - -3. After creating a security group for BitLocker-exempted users, add to this group the names of the users who are requesting exemption. When a user logs on to a computer controlled by BitLocker, the MBAM client will check the User Exemption Policy setting and will suspend protection based on whether the user is part of the BitLocker exemption security group. - - **Note**   - Shared computer scenarios require special consideration regarding user exemption. If a non-exempt user logs on to a computer shared with an exempt user, the computer may be encrypted. - - - -**To enable users to request exemption from BitLocker Encryption** - -1. After you have configured user-exemption policies by usingwith the MBAM Policy template, a user can request exemption from BitLocker protection through the MBAM client. - -2. When a user logs on to a computer that is marked as **Compatible** in the MBAM Hardware Compatibility list, the system presents the user with a notification that the computer is going to be encrypted. The user can select **Request Exemption** and postpone the encryption by selecting **Later**, or select **Start** to accept the BitLocker encryption. - - **Note**   - Selecting **Request Exemption** will postpone the BitLocker protection until the maximum time set in the User Exemption Policy. - - - -3. When a user selects **Request Exemption**, the user is notified to contact the organization's BitLocker administration group. Depending on how the Configure User Exemption Policy is configured, users are provided with one or more of the following contact methods: - - - Phone Number - - - Webpage URL - - - Mailing Address - - After submittal of the request, the MBAM Administrator can decide if it is appropriate to add the user to the BitLocker Exemption Active Directory group. - - **Note**   - Once the postpone time limit from the User Exemption Policy has expired, users will not see the option to request exemption to the encryption policy. At this point, users must contact the MBAM administrator directly in order to receive exemption from BitLocker Protection. - - - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md deleted file mode 100644 index 8da7ef40e8..0000000000 --- a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md +++ /dev/null @@ -1,698 +0,0 @@ ---- -title: How to Move MBAM 1.0 Features to Another Computer -description: How to Move MBAM 1.0 Features to Another Computer -author: msfttracyp -ms.assetid: e1907d92-6b42-4ba3-b0e4-60a9cc8285cc -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move MBAM 1.0 Features to Another Computer - - -This topic describes the steps that you should take to move one or more Microsoft BitLocker Administration and Monitoring (MBAM) features to a different computer. When you move more than one MBAM feature to another computer, you should move them in the following order: - -1. Recovery and Hardware Database - -2. Compliance and Audit Database - -3. Compliance and Audit Reports - -4. Administration and Monitoring - -## To move the Recovery and Hardware Database - - -You can use the following procedure to move the MBAM Recovery and Hardware Database from one computer to another (you can move this MBAM Server feature from Server A to Server B): - -**** - -1. Stop all instances of the MBAM Administration and Monitoring web site. - -2. Run the MBAM Setup on Server B. - -3. Back up the MBAM Recovery and Hardware database on Server A. - -4. MBAM Recovery and Hardware database from Server A to B - -5. Restore the MBAM Recovery and Hardware database on Server B - -6. Configure the access to the MBAM Recovery and Hardware database on Server B - -7. Update the database connection data on MBAM Administration and Monitoring servers - -8. Resume all instances of the MBAM Administration and Monitoring web site - -**To stop all instances of the MBAM Administration and Monitoring website** - -1. Use the Internet Information Services (IIS) Manager console to stop the MBAM website on each of the servers that run the MBAM Administration and Monitoring feature. The MBAM website is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command at the command prompt that is similar to the following, by using Windows PowerShell: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this PowerShell command prompt, you must add the IIS Module for PowerShell to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable the execution of scripts. - - - -**To run MBAM setup on Server B** - -1. Run the MBAM setup on Server B and select the Recovery and Hardware Database for installation. - -2. To automate this procedure, you can use a command at the command prompt that is similar to the following, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=KeyDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery and Hardware database will be moved. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain and server names of each MBAM Application and Monitoring Server that will contact the Recovery and Hardware database. If there are multiple domain and server names, use a semicolon to separate each one of them in the list. For example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$. Additionally, each server name must be followed by a **$**. For example, MyDomain\\MyServerName1$, MyDomain\\MyServerName2$. - - - -**To back up the Database on Server A** - -1. To back up the Recovery and Hardware database on Server A, use SQL Server Management Studio and the Task named **Back Up…**. By default, the database name is **MBAM Recovery and Hardware Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - Modify the MBAM Recovery and Hardware Database to use the full recovery mode. - - ```sql - USE master; - - GO - - ALTER DATABASE "MBAM Recovery and Hardware" - - SET RECOVERY FULL; - - GO - ``` - - Create MBAM Recovery and Hardware Database Data and MBAM Recovery logical backup devices. - - ```sql - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - - 'Z:\MBAM Recovery and Hardware Database Data.bak'; - - GO - ``` - - Back up the full MBAM Recovery and Hardware database. - - ```sql - BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - - GO - - BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - - TO FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - ENCRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $PASSWORD$ - Enter a password that you will use to encrypt the Private Key file. - - - -3. Execute the SQL file by using SQL Server PowerShell and a command that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value in the previous example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and the instance from which you back up the Recovery and Hardware database. - - - -**To move the Database and Certificate from Server A to B** - -1. Move the MBAM Recovery and Hardware database data.bak from Server A to Server B by using Windows Explorer. - -2. To move the certificate for the encrypted database, you will need to use the following automation steps. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - - `PS C:\> Copy-Item “Z:\MBAM Recovery and Hardware Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFile” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFilePrivateKey” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server to which the files will be copied. - - - $DESTINATIONSHARE$ - Enter the name of the share and path to which the files will be copied. - - - -**To restore the Database on Server B** - -1. Restore the Recovery and Hardware database on Server B by using the SQL Server Management Studio and the Task named **Restore Database**. - -2. Once the task has been executed, choose the database backup file by selecting the **From Device** option, and then use the **Add** command to choose the MBAM Recovery and Hardware database **Data.bak** file. - -3. Select **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ```sql - -- Restore MBAM Recovery and Hardware Database. - - USE master - - GO - ``` - - Drop the certificate created by MBAM Setup. - - ```sql - DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - - GO - ``` - - Add certificate - - ```sql - CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - - FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - DECRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - - Restore the MBAM Recovery and Hardware database data and the log files. - - ```sql - RESTORE DATABASE [MBAM Recovery and Hardware] - - FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak' - - WITH REPLACE - ``` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $PASSWORD$ - Enter the password that you used to encrypt the Private Key file. - - - -5. Use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value from the receding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and the instance to which the Recovery and Hardware Database will be restored. - - - -**Configure the access to the Database on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager, to add the computer accounts from each server that runs the MBAM Administration and Monitoring feature to the Local Group named **MBAM Recovery and Hardware DB Access**. - -2. To automate this procedure, you can use Windows PowerShell on Server B to enter a command that is similar to the following: - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the values from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain name and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**, for example, MyDomain\\MyServerName1$. - - - -~~~ -You must run the command for each Administration and Monitoring Server that will be accessing the database in your environment. -~~~ - -**To update the Database Connection data on MBAM Administration and Monitoring Servers** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Microsoft BitLocker Administration and Monitoring website: - - - MBAM Administration Service - - - MBAM Recovery And Hardware Service - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the Section list control. - -4. Choose the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, choose the row named **KeyRecoveryConnectionString** when you updated the configuration for the ‘MBAMAdministrationService’ application, or choose the row named Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString, when updating the configuration for the ‘MBAMRecoveryAndHardwareService’. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and the instance where the Recovery and Hardware Database was moved to. For example, $SERVERNAME$\\$SQLINSTANCENAME$. - -7. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery and Hardware database is. - - - -**To resume all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to Start the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - -## To move the Compliance Status Database feature - - -If you choose to move the MBAM Compliance Status Database feature from one computer to another, such as from Server A to Server B, you should use the following procedure: - -1. Stop all instances of the MBAM Administration and Monitoring website - -2. Run MBAM setup on Server B - -3. Backup the Database on Server A - -4. Move the Database from Server A to B - -5. Restore the Database on Server B - -6. Configure Access to the Database on Server B - -7. Update database connection data on MBAM Administration and Monitoring servers - -8. Resume all instances of the MBAM Administration and Monitoring website - -**To stop all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to Stop the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one,by using Windows PowerShell: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To execute this command, you must add the IIS Module for PowerShell to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable the execution of scripts. - - - -**To run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select the Compliance Status Database feature for installation. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal= ReportsDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$ COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNT=$DOMAIN$\$USERNAME$` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database will be moved to. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain names and server names of each MBAM Application and Monitoring Server that will contact the Compliance Status Database. If there are multiple domain names and server names, use a semicolon to separate each one of them in the list. For example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$. Each server name must be followed by a **$** as shown in the example. For example, MyDomain\\MyServerName1$, MyDomain\\MyServerName2$. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit reports feature to connect to the Compliance Status Database. - - - -**To back up the Compliance Database on Server A** - -1. To back up the Compliance Database on Server A, use SQL Server Management Studio and the Task named **Back Up…**. By default, the database name is **MBAM Compliance Status Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Modify the MBAM Compliance Status Database to use the full recovery model. - - USE master; - - GO - - ALTER DATABASE "MBAM Compliance Status" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Compliance Status Data logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - - 'Z: \MBAM Compliance Status Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery and Hardware database. - - BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - - GO - ``` - -3. Run the SQL file with a command that is similar to the following one, by using the SQL Server PowerShell: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and the instance from where the Compliance Status database will be backed up. - - - -**To move the Database from Server A to B** - -1. Move the following files from Server A to Server B, by using Windows Explorer: - - - MBAM Compliance Status Database Data.bak - -2. To automate this procedure, you can use a command that is similar to the following using Windows PowerShell: - - `PS C:\> Copy-Item “Z:\MBAM Compliance Status Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$ - Enter the server name where the files will be copied to. - - - $DESTINATIONSHARE$ - Enter the name of share and path where the files will be copied to. - - - -**To restore the Database on Server B** - -1. Restore the Compliance Status database on Server B by using SQL Server Management Studio and the Task named **Restore Database…**. - -2. Once the task is executed, select the database backup file, by selecting the From Device option, and then use the Add command to choose the MBAM Compliance Status Database Data.bak file. Click OK to complete the restoration process. - -3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Create MBAM Compliance Status Database Data logical backup devices. - - Use master - - GO - - -- Restore the MBAM Compliance Status database data files. - - RESTORE DATABASE [MBAM Compliance Status Database] - - FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - - WITH REPLACE - ``` - -4. Run the SQL File with a command that is similar to the following one, by using the SQL Server PowerShell: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database will be restored to. - - - -**To configure the Access to the Database on Server B** - -1. On Server B use the Local user and Groups snap-in from Server Manager to add the machine accounts from each server that runs the MBAM Administration and Monitoring feature to the Local Group named **MBAM Compliance Status DB Access**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on Server B: - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the value from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**.For example, MyDomain\\MyServerName1$. - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports - - - -~~~ -For each Administration and Monitoring Server that will access the database of your environment, you must run the command that will add the servers to the MBAM Compliance Auditing DB Access local group. -~~~ - -**To update the database connection data on MBAM Administration and Monitoring servers** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following Applications, which are hosted in the Microsoft BitLocker Administration and Monitoring website: - - - MBAMAdministrationService - - - MBAMComplianceStatusService - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the Section list control. - -4. Select the row named **(Collection)**, and open the Collection Editor by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **ComplianceStatusConnectionString**, when you update the configuration for the MBAMAdministrationService application, or the row named **Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString**, when you update the configuration for the MBAMComplianceStatusService. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and the instance name. For example, $SERVERNAME$\\$SQLINSTANCENAME, to which the Recovery and Hardware Database was moved. - -7. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following one on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="ComplianceStatusConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMComplianceStatusService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance name where the Recovery and Hardware Database is located. - - - -**To resume all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to start the MBAM web site named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - - **PS C:\\> Start-Website “Microsoft BitLocker Administration and Monitoring”** - -## To moving the Compliance and Audit Reports - - -If you choose to move the MBAM Compliance and Audit Reports from one computer to another (specifically, if you move feature from Server A to Server B), you should use the following procedure and steps: - -1. Run MBAM setup on Server B - -2. Configure Access to the Compliance and Audit Reports on Server B - -3. Stop all instances of the MBAM Administration and Monitoring website - -4. Update the reports connection data on MBAM Administration and Monitoring servers - -5. Resume all instances of the MBAM Administration and Monitoring website - -**To run MBAM setup on Server B** - -1. Run MBAM setup on Server B and only select the Compliance and Audit feature for installation. - -2. To automate this procedure, you can use a command that is similar to the following, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=Reports COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNTPW=$PASSWORD$` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain name and user name that will be used by the Compliance and Audit reports feature to connect to the Compliance Status Database. - - - $PASSWORD$ - Enter the password of the user account that will be used to connect to the Compliance Status Database. - - - -**To configure the access to the Compliance and Audit Reports on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the user accounts that will have access to the Compliance and Audit Reports. Add the user accounts to the local group named “MBAM Report Users”. - -2. To automate this procedure, you can use a command that is similar to the following, by using Windows PowerShell on Server B. - - `PS C:\> net localgroup "MBAM Report Users" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the following value from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports - - - -~~~ -The command to add the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment. -~~~ - -**To stop all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring Feature use the Internet Information Services (IIS) Manager console to Stop the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - -**To update the Database Connection Data on MBAM Administration and Monitoring Servers** - -1. On each of the servers that run the MBAM Administration and Monitoring Feature, use the Internet Information Services (IIS) Manager console to update the Compliance Reports URL. - -2. Select the **Microsoft BitLocker Administration and Monitoring** website and use the **Configuration Editor** feature which can be found under the **Management** section of the **Feature View**. - -3. Select the **appSettings** option from the Section list control. - -4. From here, select the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named “Microsoft.Mbam.Reports.Url”. - -6. Update the value for Microsoft.Mbam.Reports.Url to reflect the server name for Server B. If the Compliance and Audit reports feature was installed on a named SQL Reporting Services instance, make sure that you add or update the name of the instance to the URL. For example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages.... - -7. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following one on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/Malta+Compliance+Reports/”` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server to which the Compliance and Audit Reports were installed. - - - $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed. - - - -**To resume all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to Start the MBAM web site named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To execute this command, the IIS Module for PowerShell must be added to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable execution of scripts. - - - -## To move the Administration and Monitoring feature - - -If you choose to move the MBAM Administration and Monitoring Reports feature from one computer to another, (if you move feature from Server A to Server B), you should use the following procedure. The process includes the following steps: - -1. Run MBAM setup on Server B - -2. Configure Access to the Database on Server B - -**To run MBAM setup on Server B** - -1. Run MBAM setup on Server B and only select the Administration feature for installation. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=AdministrationMonitoringServer,HardwareCompatibility COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ SRS_REPORTSITEURL=$REPORTSSERVERURL$` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - For the COMPLIDB\_SQLINSTANCE parameter, input the server name and instance where the Compliance Status Database is located. For the RECOVERYANDHWDB\_SQLINSTANCE parameter, input the server name and instance where the Recovery and Hardware Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit reports feature to connect to the Compliance Status Database. - - - $ REPORTSSERVERURL$ - Enter the URL for the Home location of the SQL Reporting Service website. If the reports were installed to a default SRS instance the URL format will formatted “http:// $SERVERNAME$/ReportServer”. If the reports were installed to a default SRS instance, the URL format will be formatted to “http://$SERVERNAME$/ReportServer\_$SQLINSTANCENAME$”. - - - -**To configure the Access to the Databases** - -1. On server or servers where the Recovery and Hardware, and Compliance and Audit databases are deployed, use the Local user and Groups snap-in from Server Manager to add the machine accounts from each server that run the MBAM Administration and Monitoring feature to the Local Groups named “MBAM Recovery and Hardware DB Access” (Recovery and Hardware DB Server) and “MBAM Compliance Status DB Access” (Compliance and Audit DB Server). - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on the server where the Compliance and Audit databases were deployed. - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$ /add` - -3. On the server where the Recovery and Hardware databases were deployed, run a command that is similar to the following one, by using Windows PowerShell. - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the value from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**. For example, MyDomain\\MyServerName1$) - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports. - - - -~~~ -The commands listed for adding the server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment. -~~~ - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md deleted file mode 100644 index 4205bfe3db..0000000000 --- a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Recover a Corrupted Drive -description: How to Recover a Corrupted Drive -author: msfttracyp -ms.assetid: 715491ae-69c0-4fae-ad3f-3bd19a0db2f2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Corrupted Drive - - -To recover a corrupted drive that has been protected by BitLocker, a Microsoft BitLocker Administration and Monitoring (MBAM) help desk user must create a recovery key package file. This package file can be copied to the computer that contains the corrupted drive and then used to recover the drive. To accomplish this, use the following procedure. - -**To Recover a Corrupted Drive** - -1. Open the MBAM administration website. - -2. Select **Drive Recovery** from the navigation pane. Enter the user’s domain name and user name, the reason for unlocking the drive, and the user’s recovery password ID. - - **Note**   - If you are a member of the Help Desk Administrators role, you do not have to enter the user’s domain name or user name. - - - -3. Click **Submit**. The recovery key will be displayed. - -4. Click **Save**, and then select **Recovery Key Package**. The recovery key package will be created on your computer. - -5. Copy the recovery key package to the computer that has the corrupted drive. - -6. Open an elevated command prompt. To do this, click **Start** and type `cmd` in the **Search programs and files** box. In the search results list, right-click **cmd.exe** and select **Run as Administrator**. - -7. At the command prompt, type the following: - - `repair-bde -kp -rp ` - - **Note**   - For the <fixed drive> in the command, specify an available storage device that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified fixed drive. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md deleted file mode 100644 index 0e4e67dfcd..0000000000 --- a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Recover a Drive in Recovery Mode -description: How to Recover a Drive in Recovery Mode -author: msfttracyp -ms.assetid: 09d27e4b-57fa-47c7-a004-8b876a49f27e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Drive in Recovery Mode - - -Microsoft BitLocker Administration and Monitoring (MBAM) includes Encrypted Drive Recovery features. These features ensure the capture and storage of data and availability of tools that are required to access a BitLocker-protected volume when BitLocker puts that volume into recovery mode. A BitLocker-protected volume goes into recovery mode when a PIN or password is lost or forgotten, or when the Trusted Module Platform (TPM) chip detects a change to the computer's BIOS or startup files. - -Use this procedure to access the centralized Key Recovery data system that can provide a recovery password when a recovery password ID and associated user identifier are supplied. - -**Important**   -MBAM generates single-use recovery keys. Under this limitation, a recovery key can be used only once and then it is no longer valid. The single use of a recovery password is automatically applied to operating system drives and fixed drives. On removable drives, the single use is applied when the drive is removed and then re-inserted and unlocked on a computer that has the group policy settings activated to manage removable drives. - - - -**To recover a drive in Recovery Mode** - -1. Open the MBAM website. - -2. In the navigation pane, click **Drive Recovery**. The **Recover access to an encrypted drive** webpage opens. - -3. Enter the user's Windows Logon domain and user name and the first eight digits of the recovery key ID, to receive a list of possible matching recovery keys. Alternatively, enter the entire recovery key ID to receive the exact recovery key. Select one of the predefined options in the **Reason for Drive Unlock** drop-down list, and then click **Submit**. - - **Note**   - If you are an MBAM Advanced Helpdesk User, the user domain and user ID entries are not required. - - - -4. MBAM returns the following: - - 1. An error message if no matching recovery password is found - - 2. Multiple possible matches if the user has multiple matching recovery passwords - - 3. The recovery password and recovery package for the submitted user - - **Note**   - If you are recovering a damaged drive, the recovery package option provides BitLocker with the critical information necessary to attempt the recovery. - - - -5. After the recovery password and recovery package are retrieved, the recovery password is displayed. To copy the password, click **Copy Key**, and then paste the recovery password into an email or other text file for temporary storage. Or, to save the recovery password to a file, click **Save**. - -6. When the user types the recovery password into the system or uses the recovery package, the drive is unlocked. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md deleted file mode 100644 index 6425bd6b12..0000000000 --- a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Recover a Moved Drive -description: How to Recover a Moved Drive -author: msfttracyp -ms.assetid: 0c7199d8-9463-4f44-9af3-b70eceeaff1d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Moved Drive - - -When you move an operating system drive that has been previously encrypted by using Microsoft BitLocker Administration and Monitoring (MBAM), you must resolve certain issues. After a PIN is attached to the new computer, the drive will not accept the start-up PIN that was used in previous computer. The system considers the PIN to be invalid because of the change to the Trusted Platform Module (TPM) chip. You must obtain a recovery key ID to retrieve the recovery password in order to use the moved drive. To do this, use the following procedure. - -**To recover a moved drive** - -1. On the computer that contains the moved drive, start in Windows Recovery Environment (WinRE) mode, or start the computer by using the Microsoft Diagnostics and Recovery Toolset (DaRT). - -2. Once the computer has been started with WinRE or DaRT, MBAM will treat the moved operating system drive as a data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password. - - **Note**   - In some cases, you might be able to click **I forget the PIN** during the startup process to enter the recovery mode. This also displays the recovery key ID. - - - -3. On the MBAM administration website, use the recovery key ID to retrieve the recovery password and unlock the drive. - -4. If the moved drive was configured to use a TPM chip on the original computer, you must take additional steps after you unlock the drive and complete the start process. In WinRE mode, open a command prompt and use the **manage-bde** tool to decrypt the drive. The use of this tool is the only way to remove the TPM-plus-PIN protection without the original TPM chip. - -5. After the removal is complete, start the system normally. The MBAM agent will proceed to enforce the policy to encrypt the drive with the new computer’s TPM plus PIN. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md b/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md deleted file mode 100644 index 354f5be7d0..0000000000 --- a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Reset a TPM Lockout -description: How to Reset a TPM Lockout -author: msfttracyp -ms.assetid: 91ec6666-1ae2-4e76-9459-ad65c405f639 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset a TPM Lockout - - -The Encrypted Drive Recovery feature of Microsoft BitLocker Administration and Monitoring (MBAM) encompasses both the capture and storage of data and the availability for tools that are required to manage the Trusted Platform Module (TPM). This topic covers how to access the centralized Key Recovery data system in the bit\_admmon\_tlanextref administration website. The Key Recovery data system can provide a TPM owner password file when the computer identity and the associated user identifier are supplied. - -A TPM lockout can occur if a user enters an incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM lockout is based on the computer manufacturer's specification. - -**To reset a TPM lockout** - -1. Open the MBAM administration website. - -2. In the navigation pane, select **Manage TPM**. This opens the **Manage TPM** page. - -3. Enter the fully qualified domain name (FQDN) for the computer and the computer name. Enter the user’s Windows Logon domain and the user’s user name. Select one of the predefined options in the **Reason for requesting TPM owner password file** drop-down menu. Click **Submit**. - -4. MBAM will return one of the following: - - - An error message if no matching TPM owner password file is found - - - The TPM owner password file for the submitted computer - - **Note**   - If you are an Advanced Helpdesk User, the user domain and user ID fields are not required. - - - -5. Upon retrieval, the owner password is displayed. To save this password to a .tpm file, click the **Save** button. - -6. The user will run the TPM management console and select the **Reset TPM lockout** option and provide the TPM owner password file to reset the TPM lockout. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/images/checklistbox.gif b/mdop/mbam-v1/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/mbam-v1/images/checklistbox.gif and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-1-server.jpg b/mdop/mbam-v1/images/mbam-1-server.jpg deleted file mode 100644 index f49d4978c9..0000000000 Binary files a/mdop/mbam-v1/images/mbam-1-server.jpg and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-3-server.jpg b/mdop/mbam-v1/images/mbam-3-server.jpg deleted file mode 100644 index ffd6420bda..0000000000 Binary files a/mdop/mbam-v1/images/mbam-3-server.jpg and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-4-computer.jpg b/mdop/mbam-v1/images/mbam-4-computer.jpg deleted file mode 100644 index 9b1aa2ab35..0000000000 Binary files a/mdop/mbam-v1/images/mbam-4-computer.jpg and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-5-computer.jpg b/mdop/mbam-v1/images/mbam-5-computer.jpg deleted file mode 100644 index cd7b2668ae..0000000000 Binary files a/mdop/mbam-v1/images/mbam-5-computer.jpg and /dev/null differ diff --git a/mdop/mbam-v1/index.md b/mdop/mbam-v1/index.md deleted file mode 100644 index b25186a196..0000000000 --- a/mdop/mbam-v1/index.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide -description: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide -author: dansimp -ms.assetid: 4086e721-db24-4439-bdcd-ac5ef901811f -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - -# Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide - -Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative interface that you can use to manage BitLocker drive encryption. With MBAM, you can select BitLocker encryption policy options that are appropriate to your enterprise and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the entire enterprise. In addition, you can access recovery key information when users forget their PIN or password, or when their BIOS or boot record changes. - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - [About MBAM 1.0](about-mbam-10.md) - - [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md) - - [Evaluating MBAM 1.0](evaluating-mbam-10.md) - - [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md) - - [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md) - - [Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - - [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) - - [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - - [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) - - [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) -- [Deploying MBAM 1.0](deploying-mbam-10.md) - - [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - - [Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -## More Information -- [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) - Find documentation, videos, and other resources for MDOP technologies. diff --git a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md deleted file mode 100644 index 152ae6db90..0000000000 --- a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Known Issues in the MBAM International Release -description: Known Issues in the MBAM International Release -author: msfttracyp -ms.assetid: bbf888dc-93c1-4323-b43c-0ded098e9b93 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Known Issues in the MBAM International Release - - -This section contains known issues for Microsoft BitLocker Administration and Monitoring (MBAM) International Release. - -## Known Issues in the MBAM International Release - - -### The Installation Process Does Not Specify Update - -Upon updating the Microsoft BitLocker Administration and Monitoring server or servers, the Setup program does not state that an update is being installed. - -**Workaround**: None. - -### Certificates Used for the Administration and Monitoring Server Role - -If you are using a certificate for authentication between MBAM servers, after updating the MBAM Administration and Monitoring server you must ensure that the certificate is valid and not revoked or expired. - -**Workaround**: None. - -### MBAM Svclog File Filling Disk Space - -If you have followed Knowledge Base article 2668170, [http://support.microsoft.com/kb/2668170](https://go.microsoft.com/fwlink/?LinkID=247277), you might have to repeat the KB steps after you install this update. - -**Workaround**: None. - -## Related topics - - -[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/maintaining-mbam-10.md b/mdop/mbam-v1/maintaining-mbam-10.md deleted file mode 100644 index 6cdfa7c140..0000000000 --- a/mdop/mbam-v1/maintaining-mbam-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Maintaining MBAM 1.0 -description: Maintaining MBAM 1.0 -author: msfttracyp -ms.assetid: 02ffb093-c364-4837-bbe8-23d4c09fbd3d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Maintaining MBAM 1.0 - - -After you complete all the necessary planning and then deploy Microsoft BitLocker Administration and Monitoring (MBAM), you can configure MBAM to run in a highly available fashion while using it to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM, as well as how to move MBAM Server features if necessary. - -## MBAM Management Pack - - -The Microsoft System Center Operations Manager Management Pack for MBAM is available for download from the Microsoft Download Center. - -This management pack monitors the critical interactions in the server-side infrastructure, such as the connections between the web services and databases and the operational calls between websites and their supportive web service. It also uploads the requests between desktop clients and their respective receiving web service endpoints. - -[Microsoft BitLocker Administration And Monitoring Management Pack](https://go.microsoft.com/fwlink/p/?LinkId=258390) - -## Ensure high availability for MBAM 1.0 - - -MBAM is designed to be fault-tolerant. If a server becomes unavailable, the users should not be negatively affected. The information in this section can be used to configure a highly available MBAM installation. - -[High Availability for MBAM 1.0](high-availability-for-mbam-10.md) - -## Move MBAM 1.0 features to another server - - -When you need to move an MBAM Server feature from one server computer to another, there is a specific order and required steps that you should follow to avoid loss of productivity or data. This section describes the steps that you should take to move one or more MBAM Server features to a different computer. - -[How to Move MBAM 1.0 Features to Another Computer](how-to-move-mbam-10-features-to-another-computer.md) - -## Other resources for maintaining MBAM - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/mbam-10-deployment-checklist.md b/mdop/mbam-v1/mbam-10-deployment-checklist.md deleted file mode 100644 index 98918bcd19..0000000000 --- a/mdop/mbam-v1/mbam-10-deployment-checklist.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: MBAM 1.0 Deployment Checklist -description: MBAM 1.0 Deployment Checklist -author: msfttracyp -ms.assetid: 7e00be23-36a0-4b0f-8663-3c4f2c71546d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 1.0 Deployment Checklist - - -This checklist is designed to facilitate your deployment of Microsoft BitLocker Administration and Monitoring (MBAM). - -**Note** -This checklist outlines the recommended steps and provides a high-level list of items to consider when you deploy the MBAM features. We recommend that you copy this checklist into a spreadsheet program and customize it for your specific needs. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Complete the planning phase to prepare the computing environment for MBAM deployment.

          MBAM 1.0 Planning Checklist

          Checklist box

          Review the information on MBAM supported configurations to make sure that your selected client and server computers are supported for MBAM feature installation.

          MBAM 1.0 Supported Configurations

          Checklist box

          Run MBAM Setup to deploy MBAM Server features in the following order:

          -
            -
          1. Recovery and Hardware Database

          2. -
          3. Compliance Status Database

          4. -
          5. Compliance Audit and Reports

          6. -
          7. Administration and Monitoring Server

          8. -
          9. MBAM Group Policy Template

          10. -
          -
          -Note

          Keep track of the names of the servers each feature is installed on. You will use this information throughout the installation process.

          -
          -
          - -

          Deploying the MBAM 1.0 Server Infrastructure

          Checklist box

          Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on the appropriate servers.

          Planning for MBAM 1.0 Administrator Roles and How to Manage MBAM Administrator Roles

          Checklist box

          Create and deploy the required MBAM Group Policy Objects.

          Deploying MBAM 1.0 Group Policy Objects

          Checklist box

          Deploy the MBAM Client software.

          Deploying the MBAM 1.0 Client

          - - - -## Related topics - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md b/mdop/mbam-v1/mbam-10-deployment-prerequisites.md deleted file mode 100644 index efefe73d4b..0000000000 --- a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: MBAM 1.0 Deployment Prerequisites -description: MBAM 1.0 Deployment Prerequisites -author: msfttracyp -ms.assetid: bd9e1010-7d25-43e7-8dc6-b521226a659d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 1.0 Deployment Prerequisites - - -Before you begin the Microsoft BitLocker Administration and Monitoring (MBAM) Setup, make sure that you meet the necessary prerequisites to install the product. This section contains information to help you successfully prepare your computing environment before you deploy the MBAM Clients and Server features. - -## Installation prerequisites for MBAM Server features - - -Each of the MBAM server features has specific prerequisites that must be met before they can be successfully installed. MBAM Setup verifies if all prerequisites are met before the installation starts. - -### Installation prerequisites for Administration and Monitoring Server - -The following table contains the installation prerequisites for the MBAM Administration and Monitoring Server: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Windows ServerWeb Server Role

          This role must be added to a server operating system supported for the mbam Administration and Monitoring Server feature.

          Web Server (IIS) Management Tools

          IIS Management Scripts and Tools

          Web Server Role Services

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -

          Windows Server Features

          Microsoft .NET Framework 3.5.1 features:

          -
            -
          • .NET Framework 3.5.1

          • -
          • WCF Activation

            -
              -
            • HTTP Activation

            • -
            • Non-HTTP Activation

            • -
          • -
          -

          Windows Process Activation Service

          -
            -
          • Process Model

          • -
          • .NET Environment

          • -
          • Configuration APIs

          • -
          - - - -**Note**   -For a list of supported operating systems, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -### Installation prerequisites for the Compliance and Audit Reports - -The Compliance and Audit Reports must be installed on a supported version of SQL Server. Installation prerequisites for this feature include SQL Server Reporting Services (SSRS). - -SSRS must be installed and running during MBAM server installation. SSRS should also be configured in “native” mode, not in the “unconfigured” or “SharePoint” mode. - -**Note**   -For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -### Installation prerequisites for the Recovery and Hardware Database - -The Recovery and Hardware Database must be installed on a supported version of SQL Server. - -SQL Server must have Database Engine Services installed and running during the MBAM server installation. The Transparent Data Encryption (TDE) feature must be enabled. - -**Note**   -For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -The TDE SQL Server feature performs real-time input/output (I/O) encryption and decryption of the data and log files. TDE protects data that is "at rest,” which include the data and the log files. It provides the ability to comply with many laws, regulations, and guidelines that are established in various industries. - -**Note**   -Because TDE performs real-time decryption of database information, the recovery key information will be visible if the account under which you are logged in has permissions to the database when you view the recovery key information SQL tables. - - - -### Installation prerequisites for the Compliance and Audit Database - -The Compliance and Audit Database must be installed on a supported version of SQL Server. - -SQL Server must have Database Engine Services installed and running during MBAM server installation. - -**Note**   -For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -## Installation prerequisites for MBAM Clients - - -The necessary prerequisites that you must meet before you begin the MBAM Client installation are the following: - -- Trusted Platform Module (TPM) v1.2 capability - -- The TPM chip must be turned on in the BIOS and it must be resettable from the operating system. For more information, see the BIOS documentation. - -**Warning**   -Ensure that the keyboard, mouse, and video are directly connected to the computer, instead of to a keyboard, video, mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware. - - - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) - - - - - - - - - diff --git a/mdop/mbam-v1/mbam-10-planning-checklist.md b/mdop/mbam-v1/mbam-10-planning-checklist.md deleted file mode 100644 index f2ca3f0e3a..0000000000 --- a/mdop/mbam-v1/mbam-10-planning-checklist.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: MBAM 1.0 Planning Checklist -description: MBAM 1.0 Planning Checklist -author: msfttracyp -ms.assetid: e9439f16-d68b-48ed-99ce-5949356b180b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 1.0 Planning Checklist - - -You can use this checklist to plan and prepare your computing environment for Microsoft BitLocker Administration and Monitoring (MBAM) deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when you plan for an MBAM deployment. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the “getting started” information about MBAM to gain a basic understanding of the product before you begin the deployment planning.

          Getting Started with MBAM 1.0

          Checklist box

          Plan for MBAM 1.0 Deployment Prerequisites and prepare your computing environment.

          MBAM 1.0 Deployment Prerequisites

          Checklist box

          Plan for and configure MBAM Group Policy requirements.

          Planning for MBAM 1.0 Group Policy Requirements

          Checklist box

          Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

          Planning for MBAM 1.0 Administrator Roles

          Checklist box

          Review the MBAM 1.0 Supported Configurations documentation to ensure hardware that meets MBAM installation system requirements is available.

          MBAM 1.0 Supported Configurations

          Checklist box

          Plan for MBAM Server feature deployment.

          Planning for MBAM 1.0 Server Deployment

          Checklist box

          Plan for MBAM Client deployment.

          Planning for MBAM 1.0 Client Deployment

          Checklist box

          Validate your deployment plan in a lab environment.

          Evaluating MBAM 1.0

          - - - -## Related topics - - -[Planning for MBAM 1.0](planning-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/mbam-10-supported-configurations.md b/mdop/mbam-v1/mbam-10-supported-configurations.md deleted file mode 100644 index 71a4d85992..0000000000 --- a/mdop/mbam-v1/mbam-10-supported-configurations.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: MBAM 1.0 Supported Configurations -description: MBAM 1.0 Supported Configurations -author: msfttracyp -ms.assetid: 1f5ac58e-6a3f-47df-8a9b-4b57631ab9ee -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 1.0 Supported Configurations - - -This topic specifies the necessary requirements to install and run Microsoft BitLocker Administration and Monitoring (MBAM) in your environment. - -## MBAM server system Requirements - - -### Server operating system requirements - -The following table lists the operating systems that are supported for the Microsoft BitLocker Administration and Monitoring Server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2008

          Standard, Enterprise, Datacenter, or Web Server

          SP2 only

          32-bit or 64-bit

          Windows Server 2008 R2

          Standard, Enterprise, Datacenter, or Web Server

          64-bit

          - - - -**Warning** -There is no support for installing MBAM services, reports, or databases on a domain controller computer. - - - -### Server random access memory (RAM) requirements - -There are no RAM requirements that are specific to MBAM Server installation. - -### SQL Server Database requirements - -The following table lists the SQL Server versions that are supported for the MBAM Server feature installation. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          MBAM Server FeatureSQL Server VersionEditionService PackSystem Architecture

          Compliance and Audit Reports

          Microsoft SQL Server 2008

          R2, Standard, Enterprise, Datacenter, or Developer Edition

          SP2

          32-bit or 64-bit

          Recovery and Hardware Database

          Microsoft SQL Server 2008

          R2, Enterprise, Datacenter, or Developer Edition

          -
          -Important

          SQL Server Standard Editions are not supported for MBAM Recovery and Hardware Database Server feature installation.

          -
          -
          - -

          SP2

          32-bit or 64-bit

          Compliance and Audit Database

          Microsoft SQL Server 2008

          R2, Standard, Enterprise, Datacenter, or Developer Edition

          SP2

          32-bit or 64-bit

          - - - -## MBAM Client system requirements - - -### Client operating system requirements - -The following table lists the operating systems that are supported for MBAM Client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows 7

          Enterprise Edition

          None, SP1

          32-bit or 64-bit

          Windows 7

          Ultimate Edition

          None, SP1

          32-bit or 64-bit

          - - - -### Client RAM requirements - -There are no RAM requirements that are specific to the MBAM Client installation. - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) - - - - - - - - - diff --git a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md b/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md deleted file mode 100644 index e01d92edeb..0000000000 --- a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Monitoring and Reporting BitLocker Compliance with MBAM 1.0 -description: Monitoring and Reporting BitLocker Compliance with MBAM 1.0 -author: msfttracyp -ms.assetid: fb497d3f-ff33-4747-8e34-366440ee25c2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring and Reporting BitLocker Compliance with MBAM 1.0 - - -If you use Microsoft BitLocker Administration and Monitoring (MBAM), you can generate various reports to monitor BitLocker usage and compliance activities. - -## Understand MBAM reports - - -MBAM reports have many fields that you should be familiar with before you generate MBAM reports. - -[Understanding MBAM Reports](understanding-mbam-reports-mbam-1.md) - -## Generate MBAM Reports - - -If you use MBAM reporting, you can generate reports on enterprise compliance, individual computers, hardware compatibility, and key recovery activity. - -[How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-1.md) - -## Other resources for Monitoring and Reporting BitLocker Compliance with MBAM - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/operations-for-mbam-10.md b/mdop/mbam-v1/operations-for-mbam-10.md deleted file mode 100644 index 2c21229603..0000000000 --- a/mdop/mbam-v1/operations-for-mbam-10.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Operations for MBAM 1.0 -description: Operations for MBAM 1.0 -author: msfttracyp -ms.assetid: 2c358fa1-4795-45ab-9316-02db4aaa6d5f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MBAM 1.0 - - -This section of the Administrator’s Guide for Microsoft BitLocker Administration and Monitoring (MBAM) includes information about the various types of Microsoft BitLocker Administration and Monitoring administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - After you complete all necessary MBAM planning and deploying, you can configure and use MBAM features to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day MBAM feature operations and maintenance tasks. - -- [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - This section describes how to generate and understand the various MBAM reports to help you monitor the BitLocker usage and compliance activities throughout your enterprise environment. - -- [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - This section describes post-installation day-to-day BitLocker encryption management tasks that are accomplished by using MBAM. - -- [Maintaining MBAM 1.0](maintaining-mbam-10.md) - - This section describes how to configure MBAM to run in a highly available manner. It also describes how to use MBAM to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM, as well as how to move MBAM Server features if necessary. - -- [Security and Privacy for MBAM 1.0](security-and-privacy-for-mbam-10.md) - - This section provides an overview of MBAM security considerations and explains many of the data collection and use practices of MBAM. - -- [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) - - This section describes the set of Windows PowerShell cmdlets that are available for administrators to perform various MBAM server tasks from the command prompt rather than from the MBAM administration website. - -## Other resources for MBAM operations - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md b/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md deleted file mode 100644 index 466a1cc867..0000000000 --- a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Performing BitLocker Management with MBAM -description: Performing BitLocker Management with MBAM -author: msfttracyp -ms.assetid: 2d24390a-87bf-48b3-96a9-3882d6f2a15c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing BitLocker Management with MBAM - - -After you deploy Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use MBAM to manage enterprise BitLocker encryption. This section describes post-installation, day-to-day BitLocker encryption management tasks that can be accomplished by using MBAM. - -## Reset a TPM Lockout with MBAM - - -A Trusted Platform Module (TPM) microchip provides basic security-related functions. These functions are accomplished primarily by the use of encryption keys. The TPM is typically installed on the motherboard of a computer or laptop and communicates with the rest of the system by using a hardware bus. Computers that incorporate a TPM can create cryptographic keys that can be decrypted only by the TPM. A TPM lockout can occur if a user enters an incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. The Key Recovery data system on the MBAM administration website enables you to obtain a reset TPM owner password file. - -[How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-1.md) - -## Recover drives with MBAM - - -Make sure that you know how to attempt data recovery from encrypted drives in the event of hardware failure, changes in personnel, or other situations in which encryption keys are lost. The Encrypted Drive Recovery features of MBAM provide the capture and storage of data and availability of tools required to access a BitLocker-protected volume when the volume goes into recovery mode, is moved, or becomes corrupted. - -[How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-1.md) - -[How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-1.md) - -[How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-1.md) - -## Determine BitLocker Encryption State of lost computers by Using MBAM - - -When you use MBAM, you can determine the last known BitLocker encryption status of computers that were lost or stolen. - -[How to Determine the BitLocker Encryption State of a Lost Computers](how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md) - -## Other resources for performing BitLocker Management with MBAM - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md b/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md deleted file mode 100644 index 14a19f6fde..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Planning for MBAM 1.0 Administrator Roles -description: Planning for MBAM 1.0 Administrator Roles -author: msfttracyp -ms.assetid: 95be0eb4-25e9-43ca-a8e7-27373d35544d -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 Administrator Roles - - -This topic includes and describes the administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM), as well as the server locations where the local groups are created. - -## MBAM Administrator roles - - - **MBAM System Administrators** -Administrators in this role have access to all MBAM features. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Hardware Users** -Administrators in this role have access to the Hardware Capability features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Helpdesk Users** -Administrators in this role have access to the Helpdesk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Report Users** -Administrators in this role have access to the Compliance and Audit Reports feature from MBAM. The local group for this role is installed on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports. - - **MBAM Advanced Helpdesk Users** -Administrators in this role have increased access to the Helpdesk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. If a user is a member of both MBAM Helpdesk Users and MBAM Advanced Helpdesk Users, the MBAM Advanced Helpdesk Users permissions will overwrite the MBAM Helpdesk User permissions. - -**Important**   -To view the reports, an administrative user must be a member of the **MBAM Report Users** security group on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Reports feature. As a best practice, create a security group in Active Directory with rights on the local **MBAM Report Users** security group on both the Administration and Monitoring Server and on the server that hosts the Compliance and Reports. - - - -## Related topics - - -[Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md deleted file mode 100644 index 2820bf86ad..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Planning for MBAM 1.0 Client Deployment -description: Planning for MBAM 1.0 Client Deployment -author: msfttracyp -ms.assetid: 3af2e7f3-134b-4ab9-9847-b07474ca6ac3 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 Client Deployment - - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client, you can enable BitLocker encryption on a computer in your organization either before the end user receives the computer or afterwards. To enable BitLocker encryption after the end user receives the computer, configure Group Policy. To enable BitLocker encryption before the end user receives the computer, deploy the MBAM Client software by using an enterprise software deployment system. - -You can use one or both methods in your organization. If you use both methods, you can improve compliance, reporting, and key recovery support. - -**Note**   -To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -## Deploying the MBAM Client to enable BitLocker encryption after computer distribution to end users - - -After you configure the Group Policy, you can use an enterprise software deployment system product, such as Microsoft System Center Configuration Manager 2012 or Active Directory Domain Services, to deploy the MBAM Client installation Windows Installer files to the target computers. The two MBAM Client installation Windows Installer files are MBAMClient-64bit.msi and MBAMClient-32bit.msi, which are provided with the MBAM software. For more information about how to deploy MBAM Group Policy Objects, see [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md). - -When you deploy the MBAM Client, after you distribute the computers to end users, the end users are prompted to encrypt their computers. This lets MBAM collect the data, to include the PIN and password, and then begin the encryption process. - -**Note**   -In this approach, users are prompted to activate and initialize the Trusted Platform Module (TPM) chip, if it has not been previously activated. - - - -## Using the MBAM Client to enable BitLocker encryption before computer distribution to end users - - -In organizations where computers are received and configured centrally, you can install the MBAM Client to manage BitLocker encryption on each computer before any user data is written on it. The benefit of this process is that every computer will then be compliant with the BitLocker encryption. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. - -If your organization wants to use (TPM) to encrypt computers, the administrator must encrypt the operating system volume of the computer with TPM protector. If your organization wants to use the TPM chip and a PIN protector, the administrator must encrypt the system volume with the TPM protector, and then the users select a PIN the first time they log on. If your organization decides to use only the PIN protector, the administrator does not have to encrypt the volume first. When users log on their computers, MBAM prompts them to provide a PIN or a PIN and a password that they will use when they restart their computer later. - -**Note**   -The TPM protector option requires for the administrator to accept the BIOS prompt to activate and initialize the TPM before delivering the computer to the user. - - - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md b/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md deleted file mode 100644 index ce78024608..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md +++ /dev/null @@ -1,328 +0,0 @@ ---- -title: Planning for MBAM 1.0 Group Policy Requirements -description: Planning for MBAM 1.0 Group Policy Requirements -author: msfttracyp -ms.assetid: 0fc9c509-7850-4a8e-bb82-b949025bcb02 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 Group Policy Requirements - - -Microsoft BitLocker Administration and Monitoring (MBAM) Client management requires custom Group Policy settings to be applied. This topic describes the available policy options for Group Policy Object (GPO) when you use MBAM to manage BitLocker Drive Encryption in the enterprise. - -**Important** -MBAM does not use the default GPO settings for Windows BitLocker drive encryption. If the default settings are enabled, they can cause conflicting behavior. To enable MBAM to manage BitLocker, you must define the GPO policy settings after you install the MBAM Group Policy Template. - - - -After you install the MBAM Group Policy template, you can view and modify the available custom MBAM GPO policy settings that enable MBAM to manage the enterprise BitLocker encryption. The MBAM Group Policy template must be installed on a computer that is capable of running the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) MDOP technology. Next, to edit the applicable GPO, open the GPMC or AGPM, and then navigate to the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**. - -The MDOP MBAM (BitLocker Management) GPO node contains four global policy settings and four child GPO setting nodes, respectively. The four GPO global policy settings are: Client Management, Fixed Drive, Operating System Drive, and Removable Drive. The following sections provide policy definitions and suggested policy settings to help you plan for the MBAM GPO policy setting requirements. - -**Note** -For more information about configuring the minimum suggested GPO settings to enable MBAM to manage BitLocker encryption, see [How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md). - - - -## Global policy definitions - - -This section describes the MBAM Global policy definitions, which can be found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Choose drive encryption method and cipher strength

          Suggested Configuration: Not Configured

          -

          Configure this policy to use a specific encryption method and cipher strength.

          -

          When this policy is not configured, BitLocker uses the default encryption method of AES 128-bit with Diffuser or the encryption method specified by the setup script.

          Prevent memory overwrite on restart

          Suggested Configuration: Not Configured

          -

          Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart.

          -

          When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts.

          Validate smart card certificate usage rule

          Suggested Configuration: Not Configured

          -

          Configure this policy to use smartcard certificate-based BitLocker protection.

          -

          When this policy is not configured, a default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate.

          Provide the unique identifiers for your organization

          Suggested Configuration: Not Configured

          -

          Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader.

          -

          When this policy is not configured, the Identification field is not used.

          -

          If your company requires higher security measurements, you may want to configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting.

          - - - -## Client Management policy definitions - - -This section describes the Client Management policy definitions for MBAM, found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Client Management**. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Settings

          Configure MBAM Services

          Suggested Configuration: Enabled

          -
            -
          • MBAM Recovery and Hardware service endpoint. This is the first policy setting that you must configure to enable the MBAM Client BitLocker encryption management. For this setting, enter the endpoint location similar to the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMRecoveryAndHardwareService/CoreService.svc.

          • -
          • Select BitLocker recovery information to store. This policy setting lets you configure the key recovery service to back up the BitLocker recovery information. It also lets you configure the status reporting service for collecting compliance and audit reports. The policy provides an administrative method of recovering data encrypted by BitLocker to help prevent data loss due to the lack of key information. Status report and key recovery activity will automatically and silently be sent to the configured report server location.

            -

            If you do not configure or if you disable this policy setting, the key recovery information will not be saved, and status report and key recovery activity will not be reported to server. When this setting is set to Recovery Password and key package, the recovery password and key package will be automatically and silently backed up to the configured key recovery server location.

          • -
          • Enter the client checking status frequency in minutes. This policy setting manages how frequently the client checks the BitLocker protection policies and the status on the client computer. This policy also manages how frequently the client compliance status is saved to the server. The client checks the BitLocker protection policies and status on the client computer, and it also backs up the client recovery key at the configured frequency.

            -

            Set this frequency based on the requirement established by your company on how frequently to check the compliance status of the computer, and how frequently to back up the client recovery key.

          • -
          • MBAM Status reporting service endpoint. This is the second policy setting that you must configure to enable MBAM Client BitLocker encryption management. For this setting, enter the endpoint location by using the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMComplianceStatusService/StatusReportingService. svc.

          • -

          Allow hardware compatibility checking

          Suggested Configuration: Enabled

          -

          This policy setting lets you manage the verification of hardware compatibility before you enable BitLocker protection on drives of MBAM client computers.

          -

          You should enable this policy option if your enterprise has older computer hardware or computers that do not support Trusted Platform Module (TPM). If either of these criteria is true, enable the hardware compatibility verification to make sure that MBAM is applied only to computer models that support BitLocker. If all computers in your organization support BitLocker, you do not have to deploy the Hardware Compatibility, and you can set this policy to Not Configured.

          -

          If you enable this policy setting, the model of the computer is validated against the hardware compatibility list once every 24 hours, before the policy enables BitLocker protection on a computer drive.

          -
          -Note

          Before enabling this policy setting, make sure that you have configured the MBAM Recovery and Hardware service endpoint setting in the Configure MBAM Services policy options.

          -
          -
          - -
          -

          If you either disable or do not configure this policy setting, the computer model is not validated against the hardware compatibility list.

          Configure user exemption policy

          Suggested Configuration: Not Configured

          -

          This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption.

          -

          If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog with instructions on how to apply for an exemption from BitLocker protection. For more information about how to enable BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.

          -

          If you either disable or do not configure this policy setting, the instructions about how to apply for an exemption request will not be presented to users.

          -
          -Note

          User exemption is managed per user, not per computer. If multiple users log on to the same computer and one user is not exempt, the computer will be encrypted.

          -
          -
          - -
          - - - -## Fixed Drive policy definitions - - -This section describes the Fixed Drive policy definitions for MBAM, which can be found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Fixed Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Fixed data drive encryption settings

          Suggested Configuration: Enabled, and select the Enable auto-unlock fixed data drive check box if the operating system volume is required to be encrypted.

          -

          This policy setting lets you manage whether or not to encrypt the fixed drives.

          -

          When you enable this policy, do not disable the Configure use of password for fixed data drives policy.

          -

          If the Enable auto-unlock fixed data drive check box is selected, the operating system volume must be encrypted.

          -

          If you enable this policy setting, users are required to put all fixed drives under BitLocker protection, which will encrypt the drives.

          -

          If you do not configure this policy or if you disable this policy, users are not required to put fixed drives under BitLocker protection.

          -

          If you disable this policy, the MBAM agent decrypts any encrypted fixed drives.

          -

          If encrypting the operating system volume is not required, clear the Enable auto-unlock fixed data drive check box.

          Deny “write” permission to fixed drives that are not protected by BitLocker

          Suggested Configuration: Not Configured

          -

          This policy setting determines if BitLocker protection is required for fixed drives on a computer so that they are writable. This policy setting is applied when you turn on BitLocker.

          -

          When the policy is not configured, all fixed drives on the computer are mounted with read/write permissions.

          Allow access to BitLocker-protected fixed drives from earlier versions of Windows

          Suggested configuration: Not Configured

          -

          Enable this policy to unlock and view the fixed drives that are formatted with the file allocation table (FAT) file system on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          -

          These operating systems have read-only permissions to BitLocker-protected drives.

          -

          When the policy is disabled, fixed drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          Configure use of password for fixed drives

          Suggested configuration: Not Configured

          -

          Enable this policy to configure password protection on fixed drives.

          -

          When the policy is not configured, passwords will be supported with the default settings, which do not include password complexity requirements and require only eight characters.

          -

          For higher security, enable this policy and select Require password for fixed data drive, select Require password complexity, and set the desired minimum password length.

          Choose how BitLocker-protected fixed drives can be recovered

          Suggested Configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When this policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require the recovery information to be backed up to AD DS.

          - - - -## Operating System Drive policy definitions - - -This section describes the Operating System Drive policy definitions for MBAM, found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Operating System Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Operating system drive encryption settings

          Suggested configuration: Enabled

          -

          This policy setting determines if the operating system drive will be encrypted.

          -

          Configure this policy to do the following:

          -
            -
          • Enforce BitLocker protection for the operating system drive.

          • -
          • Configure PIN usage to use a Trusted Platform Module (TPM) PIN for operating system protection.

          • -
          • Configure enhanced startup PINs to permit characters such as uppercase and lowercase letters, and numbers. MBAM does not support the use of symbols and spaces for enhanced PINs, even though BitLocker supports symbols and spaces.

          • -
          -

          If you enable this policy setting, users are required to secure the operating system drive by using BitLocker.

          -

          If you do not configure or if you disable the setting, users are not required to secure the operating system drive by using BitLocker.

          -

          If you disable this policy, the MBAM agent decrypts the operating system volume if it is encrypted.

          -

          When it is enabled, this policy setting requires users to secure the operating system by using BitLocker protection, and the drive is encrypted. Based on your encryption requirements, you may select the method of protection for the operating system drive.

          -

          For higher security requirements, use TPM + PIN, allow enhanced PINs, and set the minimum PIN length to eight characters.

          -

          When this policy is enabled with the TPM + PIN protector, you can consider disabling the following policies under System / Power Management / Sleep Settings:

          -
            -
          • Allow Standby States (S1-S3) When Sleeping (Plugged In)

          • -
          • Allow Standby States (S1-S3) When Sleeping (On Battery)

          • -

          Configure TPM platform validation profile

          Suggested Configuration: Not Configured

          -

          This policy setting lets you configure how the TPM security hardware on a computer secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker already has TPM protection enabled.

          -

          When this policy is not configured, the TPM uses the default platform validation profile or the platform validation profile specified by the setup script.

          Choose how to recover BitLocker-protected operating system drives

          Suggested Configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When this policy is not configured, the data recovery agent is allowed, and the recovery information is not backed up to AD DS.

          -

          MBAM operation does not require the recovery information to be backed up to AD DS.

          - - - -## Removable Drive policy definitions - - -This section describes the Removable Drive Policy definitions for MBAM, found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Removable Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Control the use of BitLocker on removable drives

          Suggested configuration: Enabled

          -

          This policy controls the use of BitLocker on removable data drives.

          -

          Enable the Allow users to apply BitLocker protection on removable data drives option, to allow users to run the BitLocker setup wizard on a removable data drive.

          -

          Enable the Allow users to suspend and decrypt BitLocker on removable data drives option to allow users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed.

          -

          When this policy is enabled and the Allow users to apply BitLocker protection on removable data drives option is selected, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server, and it allows users to recover the drive if the password is lost.

          Deny the “write” permissions to removable drives that are not protected by BitLocker

          Suggested Configuration: Not Configured

          -

          Enable this policy to allow write-only permissions to BitLocker protected drives.

          -

          When this policy is enabled, all removable data drives on the computer require encryption before write permissions are allowed.

          Allow access to BitLocker-protected removable drives from earlier versions of Windows

          Suggested Configuration: Not Configured

          -

          Enable this policy to unlock and view the fixed drives that are formatted with the (FAT) file system on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          -

          These operating systems have read-only permissions to BitLocker-protected drives.

          -

          When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          Configure the use of password for removable data drives

          Suggested configuration: Not Configured

          -

          Enable this policy to configure password protection on removable data drives.

          -

          When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and require only eight characters.

          -

          For increased security, you can enable this policy and select Require password for removable data drive, select Require password complexity, and then set the preferred minimum password length.

          Choose how BitLocker-protected removable drives can be recovered

          Suggested Configuration: Not Configured

          -

          You can configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When the policy is set to Not Configured, the data recovery agent is allowed and recovery information is not backed up to AD DS.

          -

          MBAM operation does not require the recovery information to be backed up to AD DS.

          - - - -## Related topics - - -[Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md deleted file mode 100644 index e3fd8e1f24..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Planning for MBAM 1.0 Server Deployment -description: Planning for MBAM 1.0 Server Deployment -author: msfttracyp -ms.assetid: 3cbef284-3092-4c42-9234-2826b18ddef1 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for MBAM 1.0 Server Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of your enterprise. - -## Planning for MBAM Server deployment - - -The following MBAM features represent the server infrastructure for an MBAM server deployment: - -- Recovery and Hardware Database - -- Compliance and Audit Database - -- Compliance and Audit Reports - -- Administration and Monitoring Server - -MBAM server databases and features can be installed in different configurations, depending on your scalability needs. All MBAM Server features can be installed on a single server or distributed across multiple servers. Generally, we recommend that you use a three-server or five-server configuration for production environments, although configurations of two or four servers can also be used, depending on your computing needs. - -**Note**   -For more information about performance scalability of MBAM and recommended deployment topologies, see the MBAM Scalability and High-Availability Guide white paper at . - - - -Each MBAM feature has specific prerequisites. For a full list of server feature prerequisites and hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - -In addition to the server-related MBAM features, the server Setup application includes an MBAM Group Policy template. This template can be installed on any computer that is able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -## Order of deployment of MBAM Server Features - - -When you deploy the MBAM Server features, install the features in the following order: - -1. Recovery and Hardware Database - -2. Compliance and Audit Database - -3. Compliance Audit and Reports - -4. Administration and Monitoring Server - -5. Policy Template - -**Note**   -Keep track of the names of the computers on which you install each feature. You will use this information throughout the installation process. You can print and use a deployment checklist to assist you in the installation process. For more information about the MBAM deployment checklist, see [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md). - - - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10.md b/mdop/mbam-v1/planning-for-mbam-10.md deleted file mode 100644 index 633e4048d0..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Planning for MBAM 1.0 -description: Planning for MBAM 1.0 -author: msfttracyp -ms.assetid: d4e8a42f-2836-48c8-83c1-40bd58270e19 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft BitLocker Administration and Monitoring (MBAM) so that it does not disrupt your users or the network. - -There are a number of different deployment configurations and prerequisites that you should consider before you try to deploy the MBAM. This section includes information that can help you gather the information that you need to formulate a deployment plan that best meets your business requirements. It can assist you in preparing your network and computing environment, and it provides the information necessary for you to properly plan to deploy MBAM features. - -## Planning information - - -- [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - This section describes the computing environment requirements and installation prerequisites that you should plan for before you begin the MBAM Setup. - -- [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - - This section describes the minimum hardware and software requirements necessary for the MBAM Client and Server feature installation. It also provides information about the MBAM deployment topology that you can use, and other MBAM Server and Client planning considerations. - -- [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) - - This section provides a planning checklist that you can use throughout the MBAM deployment. - -## Other resources for MBAM planning - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/planning-to-deploy-mbam-10.md b/mdop/mbam-v1/planning-to-deploy-mbam-10.md deleted file mode 100644 index 0fe94548e9..0000000000 --- a/mdop/mbam-v1/planning-to-deploy-mbam-10.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Planning to Deploy MBAM 1.0 -description: Planning to Deploy MBAM 1.0 -author: msfttracyp -ms.assetid: 30ad4304-45c6-427d-8e33-ebe8053c7871 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy MBAM 1.0 - - -You should consider a number of different deployment configurations and prerequisites before you create your Microsoft BitLocker Administration and Monitoring (MBAM) 1.0 deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Review the MBAM 1.0 supported configurations - - -After you prepare your computing environment for the MBAM Client and Server feature installation, make sure that you review the Supported Configurations information for MBAM to confirm that the computers on which you install MBAM meet the minimum hardware and operating system requirements. For more information about MBAM deployment prerequisites, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md). - -[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) - -## Plan for MBAM 1.0 Server and Client deployment - - -The MBAM server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of the enterprise. These features can be installed on a single server or distributed across multiple servers. - -The MBAM Client enables administrators to enforce and monitor the BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through tools like Active Directory Domain Services or by directly encrypting the client computers as part of the initial imaging process. - -With MBAM, you can encrypt a computer in your organization either before the end user receives the computer or afterwards, by using Group Policy. You can use one or both methods in your organization. If you choose to use both methods, you can improve compliance, reporting, and key recovery support. - -[Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md) - -[Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) - -## Other resources for MBAM planning - - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md b/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md deleted file mode 100644 index 796672f8b3..0000000000 --- a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Preparing your Environment for MBAM 1.0 -description: Preparing your Environment for MBAM 1.0 -author: msfttracyp -ms.assetid: 915f7c3c-70ad-4a90-a434-73e7fba97ecb -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing your Environment for MBAM 1.0 - - -Before you begin the Microsoft BitLocker Administration and Monitoring (MBAM) Setup, make sure that you have met the necessary prerequisites to install the product. If you know the prerequisites in advance, you can efficiently deploy the product and enable its features, which can support the business objectives of your organization more effectively. - -## Review MBAM 1.0 deployment prerequisites - - -The MBAM Client and each of the MBAM Server features have specific prerequisites that must be met before they can be successfully installed. - -To ensure successful installation of MBAM Clients and MBAM Server features, you should plan to ensure that computers specified for MBAM Client or MBAM Server feature installation are properly prepared for MBAM Setup. - -**Note**   -MBAM Setup verifies if all prerequisites are met before installation starts. If they are not met, Setup will fail. - - - -[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) - -## Plan for MBAM 1.0 Group Policy requirements - - -Before MBAM can manage clients in the enterprise, you must define the Group Policy for the encryption requirements of your environment. - -**Important**   -MBAM will not work with policies for stand-alone BitLocker drive encryption. Group Policy must be defined for MBAM; otherwise, the BitLocker encryption and enforcement will fail. - - - -[Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) - -## Plan for MBAM 1.0 administrator roles - - -MBAM administrator roles are managed by local groups that are created by MBAM Setup when you install the following: BitLocker Administration and Monitoring Server, the Compliance and Audit Reports feature, and the Compliance and Audit Status Database. - -The membership of MBAM roles can be managed more effectively if you create security groups in Active Directory Domain Services, add the appropriate administrator accounts to those groups, and then add those security groups to the MBAM local groups. For more information, see [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md). - -[Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) - -## Other resources for MBAM planning - - -[Planning for MBAM 1.0](planning-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/privacy-statement-for-mbam-10.md b/mdop/mbam-v1/privacy-statement-for-mbam-10.md deleted file mode 100644 index 53d2f37793..0000000000 --- a/mdop/mbam-v1/privacy-statement-for-mbam-10.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Privacy Statement for MBAM 1.0 -description: Privacy Statement for MBAM 1.0 -author: msfttracyp -ms.assetid: db18cc93-a1c1-44da-a450-a5399a4427b9 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Privacy Statement for MBAM 1.0 - - -## Privacy Statement - - -At Microsoft, we're working hard to protect your privacy while delivering products that bring you the performance, power, and convenience that you want in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft BitLocker Administration and Monitoring (MBAM). This privacy statement focuses on features that communicate with the Internet and is not intended to be an exhaustive list. This privacy statement does not apply to other online or offline Microsoft sites, products or services. - -Collection and Use of Your Personal Information: - -When we need information that personally identifies you or allows us to contact you, we will explicitly ask you for it. The personal information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to provide the service(s) or carry out the transaction(s) you have requested or authorized, and may also be used to request additional information on feedback that you provide about the product or service that you are using; to provide critical updates and notifications regarding the software; to improve the product or service, for example bug and survey form inquiries, or to provide you with advance notice of events or to tell you about new product releases. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Information that is collected by or sent to Microsoft may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries or agents maintain facilities, and by using a Microsoft site or service, you consent to any such transfer of information outside of your country. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union. Microsoft may disclose personal information about you if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on Microsoft or the site; (b) protect and defend the rights or property of Microsoft (including enforcing our agreements); or (c) act in urgent circumstances to protect the personal safety of Microsoft employees, users of Microsoft products or services, or members of the public. - -Collection and Use of Information about Your Computer: - -Microsoft BitLocker Administration and Monitoring contains Internet-enabled features that can collect certain standard information from your computer ("standard computer information") along with information needed for a specific feature and send it to Microsoft. Standard computer information includes information such as your IP address, operating system version, a code that identifies the manufacturer of your computer, and your regional and language settings. This computer information is generally not personally identifiable. - -Security of Your Information: - -Microsoft is committed to protecting the security of your personal information. We use a variety of security technologies and procedures to help protect your personal information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer servers with limited access that are located in controlled facilities. - -Changes to the Privacy Statement: - -We may occasionally update this privacy statement. When we do, we will revise the "last updated" date at the top of the privacy statement. We encourage you to periodically review this privacy statement to be informed of how Microsoft is protecting your information. - -For More Information: - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement, please contact us at: - -Microsoft Privacy - -Microsoft Corporation - -One Microsoft Way - -Redmond, Washington 98052 USA - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/release-notes-for-mbam-10.md b/mdop/mbam-v1/release-notes-for-mbam-10.md deleted file mode 100644 index 9b9be836c6..0000000000 --- a/mdop/mbam-v1/release-notes-for-mbam-10.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: Release Notes for MBAM 1.0 -description: Release Notes for MBAM 1.0 -author: msfttracyp -ms.assetid: d82fddde-c360-48ef-86a0-d9b5fe066861 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for MBAM 1.0 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM). - -These release notes contain information that is required to successfully install MBAM. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other MBAM documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about MBAM documentation, see the MBAM home page on Microsoft TechNet. - -To obtain a downloadable copy of the MBAM documentation, see on the Microsoft Download Center. - -## Provide Feedback - - -We are interested in your feedback on MBAM. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with MBAM 1.0 - - -This section contains release notes about the known issues with MBAM setup and installation. - -### If you select the “Use a certificate to encrypt the network communication” option during Setup, existing database connections and dependent applications can stop functioning - -You can configure MBAM for **Encrypted network communication** after you install either the Recovery and Hardware Database or the Compliance Status Database features. If you choose to configure MBAM for Encrypted network communication, MBAM Setup configures the instance of the SQL Server Database Engine to use Secure Sockets Layer (SSL) for communication between the applicable database and both the Administration and Monitoring Server and the Compliance and Audit Report Server features. - -- If the instance of the SQL Server Database Engine is not already configured to use SSL, MBAM Setup configures it to do so. This can prevent applications that try to use non-MBAM databases on the instance of the SQL Server Database Engine from communicating with their databases. - -- If the instance of the SQL Server Database Engine is already configured to use SSL, it is configured to use the certificate that the user selected during setup. If this certificate differs from the one that was already in use, it can prevent applications that use SQL Server databases on the instance of the SQL Server Database Engine from running. - -**WORKAROUND:** None - -### MBAM Setup fails during installation when you use a local Administrator account - -MBAM Setup fails when you use a local Administrator account. The log file contains the following information: - -``` syntax -Locating group 'MBAM Report Users' -Adding ' to group 'MBAM Report Users' -Locating group 'MBAM Recovery and Hardware DB Access' -Adding 'S-1-5-20' to group 'MBAM Recovery and Hardware DB Access' -Exception: A new member could not be added to a local group because the member has the wrong account type. - - StackTrace:    at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes) - at System.DirectoryServices.AccountManagement.SDSUtils.ApplyChangesToDirectory(Principal p, StoreCtx storeCtx, GroupMembershipUpdater updateGroupMembership, NetCred credentials, AuthenticationTypes authTypes) - at System.DirectoryServices.AccountManagement.SAMStoreCtx.Update(Principal p) - at Microsoft.Windows.Mdop.BitlockerManagement.Setup.Groups.CreateGroupsDeferred(Session session) - InnerException:Exception: A new member could not be added to a local group because the member has the wrong account type. - - InnerException:StackTrace:    at System.DirectoryServices.AccountManagement.UnsafeNativeMethods.IADsGroup.Add(String bstrNewItem) - at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes) -CustomAction MbamCreateGroupsDeferred returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) -Action ended 11:41:29: InstallExecute. Return value 3. -``` - -**WORKAROUND:** Use a domain account with administrative credentials on the server computer when you install MBAM. - -### MBAM Setup reconfigures the instance of the SQL Server Database Engine to not use SSL if you select “Do not encrypt network communication” - -When you install either the Recovery and Hardware Database or the Compliance Status Database, you can use Setup to configure MBAM by selecting **Encrypted network communication**. If you decide not to encrypt the network communication, MBAM Setup reconfigures the instance of the SQL Server Database Engine so that it does not use SSL. - -- If the instance of the SQL Server Database Engine is already configured to use SSL, MBAM Setup disables SSL on the instance of the SQL Server Database Engine. This changes the communication security between the applications that use databases that are not related to MBAM databases on the instance of the SQL Server Database Engine. - -**WORKAROUND:** None - -### Missing prerequisite for the Internet Information Services (IIS) Management Scripts and Tools web server feature - -MBAM Setup is dependent on the IIS Management Scripts and Tools web server feature, but it is not an enforced prerequisite. Server setup lets you install MBAM when this feature is missing. However, this will cause the backup service MBAM VSS Writer to start and then stop, because it cannot locate the Windows Management Instrumentation (WMI) and the Internet Information Services (IIS) provider. There is no error message for this condition, except that which occurs in the event log. Installation of MBAM without IIS Management Scripts and Tools causes the backup operations not to run for MBAM. - -**WORKAROUND:** Ensure that the IIS Management Scripts and Tools web server feature is installed before you start the MBAM Setup. - -### MBAM Setup stops responding during the “Installing selected features” phase when setup is configured to use a certificate - -MBAM Setup stops responding during the **Installing selected features** phase of setup. This occurs during the installation of the Recovery and Hardware Database or the Compliance Status Database, after you select the **Use a certificate to encrypt the network communication** option. Furthermore, the MBAM Setup stops responding if the instance of the SQL Server Database Engine cannot access the certificate that was specified during setup. - -**WORKAROUND:** Update the permissions on the certificate, so that the Windows service for the applicable instance of the SQL Server Database Engine can access the certificate. You can also change the account under which the instance of the SQL Server Database Engine runs, for the database engine to use the certificate. To determine the permissions for the certificate, type the following command at the command prompt: **certutil -v -store MY** - -### MBAM Setup pauses when you install SQL Server Reporting Services - -During MBAM installation, when you select an instance of SQL Server Reporting Services (SSRS) and SSRS instance is not available or it is configured incorrectly, the MBAM Setup might pause for up to one minute while it attempts to communicate with the SSRS instance. - -**WORKAROUND:** Wait for at least one minute for MBAM Setup to resume while the Setup program attempts to contact the instance of SSRS. - -### Administration and Monitoring Server does not run after setup - -After MBAM Setup successfully installs the Administration and Monitoring Server feature, MBAM displays error messages when you try to access the MBAM administrator website. This issue occurs for one of the following reasons: - -- One or more prerequisites on the Administration and Monitoring Server were removed after the MBAM installation. - -- One or more prerequisites were installed on the server and later they were removed before running the MBAM Setup. - -**WORKAROUND:** Review the MBAM documentation and confirm that all MBAM prerequisites are installed. - -### Clicking documentation links during Setup results in an application error after Setup is finished - -When you click a documentation link during setup and then close the Setup program by clicking **Cancel** or **Finish** after Setup has successfully finished, an application error message appears.. The problem is caused by an access violation error in the Windows Task Scheduler. - -**WORKAROUND:** None. You can ignore this error. - -### Failed MBAM Setup does not remove new databases - -If the MBAM Setup fails, Setup might not remove the newly created databases. This can cause failures during subsequent installations. - -**WORKAROUND:** Choose a different name for the database instance during the subsequent installation. - -### MBAM Setup does not recognize valid network load-balancing cluster certificates - -During the MBAM Administration and Monitoring Server installation, with the network encryption option selected, the cluster certificate is not recognized as a valid certificate. It is recognized as valid when the certificate for communication with the database is installed, but it is rejected for communication by the load-balancing cluster. - -**WORKAROUND:** Confirm that the certificate revocation list (CRL) associated with the certificate is accessible, or use a certificate that does not require validation by using the CRL. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About MBAM 1.0](about-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md b/mdop/mbam-v1/security-and-privacy-for-mbam-10.md deleted file mode 100644 index 9b8209c9d4..0000000000 --- a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for MBAM 1.0 -description: Security and Privacy for MBAM 1.0 -author: msfttracyp -ms.assetid: ba4497f1-b9e3-41be-8953-3637d1f83f01 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for MBAM 1.0 - - -The topics in this guide will help you plan for security and privacy considerations for Microsoft BitLocker Administration and Monitoring (MBAM). - -## Security considerations for MBAM 1.0 - - -Before you deploy and use MBAM in your computing environment, you should consider potential security-related issues. The information in the Security Considerations topic provides a brief overview of Active Directory Domain Services user accounts and groups, log files, and other security-related considerations for MBAM. - -[Security Considerations for MBAM 1.0](security-considerations-for-mbam-10.md) - -## Privacy for MBAM 1.0 - - -This topic covers many of the data collection and use practices of MBAM. - -[Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) - -## Other resources MBAM Security and Privacy - - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/security-considerations-for-mbam-10.md b/mdop/mbam-v1/security-considerations-for-mbam-10.md deleted file mode 100644 index bcfe42f061..0000000000 --- a/mdop/mbam-v1/security-considerations-for-mbam-10.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -title: Security Considerations for MBAM 1.0 -description: Security Considerations for MBAM 1.0 -author: msfttracyp -ms.assetid: 5e1c8b8c-235b-4a92-8b0b-da50dca17353 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for MBAM 1.0 - - -This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for Microsoft BitLocker Administration and Monitoring (MBAM). For more information, follow the links in this article. - -## General security considerations - - -**Understand the security risks.** The most serious risk to MBAM is that its functionality could be hijacked by an unauthorized user who could then reconfigure BitLocker encryption and gain BitLocker encryption key data on MBAM Clients. However, the loss of MBAM functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. - -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an MBAM Server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. MBAM servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems, Microsoft SQL Server, and MBAM by subscribing to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM and MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and Groups in MBAM - - -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary MBAM local groups on the MBAM Servers. - -### Active Directory Domain Services Groups - -No groups are created automatically during MBAM Setup. However, you should create the following Active Directory Domain Services global groups to manage MBAM operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Group NameDetails

          MBAM Advanced Helpdesk Users

          Create this group to manage members of the MBAM Advanced Helpdesk Users local group that was created during MBAM Setup.

          MBAM Compliance Auditing DB Access

          Create this group to manage members of the MBAM Compliance Auditing DB Access local group that was created during MBAM Setup.

          MBAM Hardware Users

          Create this group to manage members of the MBAM Hardware Users local group that was created during MBAM Setup.

          MBAM Helpdesk Users

          Create this group to manage members of the MBAM Helpdesk Users local group that was created during MBAM Setup.

          MBAM Recovery and Hardware DB Access

          Create this group to manage members of the MBAM Recovery and Hardware DB Access local group that was created during MBAM Setup.

          MBAM Report Users

          Create this group to manage members of the MBAM Report Users local group that was created during MBAM Setup.

          MBAM System Administrators

          Create this group to manage members of the MBAM System Administrators local group that was created during MBAM Setup.

          BitLocker Encryption Exemptions

          Create this group to manage user accounts that should be exempted from BitLocker encryption starting on computers that they log on to.

          - - - -### MBAM Server Local Groups - -MBAM Setup creates local groups to support MBAM operations. You should add the Active Directory Domain Services Global Groups to the appropriate MBAM local groups to configure MBAM security and data access permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Group NameDetails

          MBAM Advanced Helpdesk Users

          Members of this group have expanded access to the Helpdesk features of Microsoft BitLocker Administration and Monitoring.

          MBAM Compliance Auditing DB Access

          This group contains the machines that have access to the MBAM Compliance Auditing Database.

          MBAM Hardware Users

          Members of this group have access to some of the Hardware Capability features from Microsoft BitLocker Administration and Monitoring.

          MBAM Helpdesk Users

          Members of this group have access to some of the Helpdesk features from Microsoft BitLocker Administration and Monitoring.

          MBAM Recovery and Hardware DB Access

          This group contains the computers that have access to the MBAM Recovery and Hardware Database.

          MBAM Report Users

          Members of this group have access to the Compliance and Audit reports from Microsoft BitLocker Administration and Monitoring.

          MBAM System Administrators

          Members of this group have access to all the features of Microsoft BitLocker Administration and Monitoring.

          - - - -### SSRS Reports Access Account - -The SQL Server Reporting Services (SSRS) Reports Service Account provides the security context to run the MBAM reports available through SSRS. This account is configured during MBAM Setup. - -## MBAM Log Files - - -During MBAM Setup, the following MBAM Setup log files are created in the %temp% folder of the user who installs the - -**MBAM Server Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Setup and MBAM Server Feature installation. - -InstallComplianceDatabase.log -Logs the actions taken to create the MBAM Compliance Status database setup. - -InstallKeyComplianceDatabase.log -Logs the actions taken to create the MBAM Recovery and Hardware database. - -AddHelpDeskDbAuditUsers.log -Logs the actions taken to create the SQL Server logins on the MBAM Compliance Status database and authorize helpdesk web service to the database for reports. - -AddHelpDeskDbUsers.log -Logs the actions taken to authorize web services to database for key recovery and create logins to the MBAM Recovery and Hardware database. - -AddKeyComplianceDbUsers.log -Logs the actions taken to authorize web services to MBAM Compliance Status database for compliance reporting. - -AddRecoveryAndHardwareDbUsers.log -Logs the actions taken to authorize web services to MBAM Recovery and Hardware database for key recovery. - -**Note**   -In order to obtain additional MBAM Setup log files, you must install Microsoft BitLocker Administration and Monitoring by using the **msiexec** package and the **/l** <location> option. Log files are created in the location specified. - - - -**MBAM Client Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Client installation. - -## MBAM Database TDE considerations - - -The Transparent Data Encryption (TDE) feature available in SQL Server 2008 is a required installation prerequisite for the database instances that will host MBAM database features. - -With TDE, you can perform real-time, full database-level encryption. TDE is a well-suited choice for bulk encryption to meet regulatory compliance or corporate data security standards. TDE works at the file level, which is similar to two Windows features: the Encrypting File System (EFS) and BitLocker Drive Encryption, both of which also encrypt data on the hard drive. TDE does not replace cell-level encryption, EFS, or BitLocker. - -When TDE is enabled on a database, all backups are encrypted. Thus, special care must be taken to ensure that the certificate that was used to protect the Database Encryption Key (DEK) is backed up and maintained with the database backup. Without a certificate, the data will be unreadable. Back up the certificate along with the database. Each certificate backup should have two files; both of these files should be archived .It is best to archive them separately from the database backup file for security. - -For an example of how to enable TDE for MBAM database instances, see [Evaluating MBAM 1.0](evaluating-mbam-10.md). - -For more information about TDE in SQL Server 2008, see [Database Encryption in SQL Server 2008 Enterprise Edition](https://go.microsoft.com/fwlink/?LinkId=269703). - -## Related topics - - -[Security and Privacy for MBAM 1.0](security-and-privacy-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/troubleshooting-mbam-10.md b/mdop/mbam-v1/troubleshooting-mbam-10.md deleted file mode 100644 index 5a72af69f9..0000000000 --- a/mdop/mbam-v1/troubleshooting-mbam-10.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting MBAM 1.0 -description: Troubleshooting MBAM 1.0 -author: msfttracyp -ms.assetid: 7d47fbfe-51c0-4619-bed3-163dfd18cdec -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting MBAM 1.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting MBAM 1.0 - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md b/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md deleted file mode 100644 index e6b066b08a..0000000000 --- a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md +++ /dev/null @@ -1,389 +0,0 @@ ---- -title: Understanding MBAM Reports -description: Understanding MBAM Reports -author: msfttracyp -ms.assetid: 34e4aaeb-7f89-41a1-b816-c6fe8397b060 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM Reports - - -Microsoft BitLocker Administration and Monitoring (MBAM) generates various reports to monitor BitLocker usage and compliance. This topic describes the MBAM reports for enterprise compliance, individual computers, hardware compatibility, and key recovery activity. - -## Understanding Reports - - -To access the Reports feature of MBAM, open the MBAM administration website. Select **Reports** in the navigation pane. Then, in the main content pane, click the tab for your report type: **Enterprise Compliance Report**, **Computer Compliance Report**, **Hardware Audit Report**, or **Recovery Audit Report**. - -### Enterprise Compliance Report - -An Enterprise Compliance Report provides information on overall BitLocker compliance in your organization. The available filters for this report allow you to narrow your search results according to Compliance state and Error status. This report runs every six hours. - -**Enterprise Compliance Report fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          The user-specified DNS name that is being managed by MBAM.

          Domain Name

          The fully qualified domain name where the client computer resides and is managed by MBAM.

          Compliance Status

          The state of compliance for the computer, according to the policy specified for the computer. The possible states are Noncompliant and Compliant. For more information, see Enterprise Compliance Report Compliance States in this topic.

          Exemption

          The state of the computer hardware for determining the identification of the hardware type and whether the computer is exempt from policy. There are three possible states: Hardware Unknown (the hardware type has not been identified by MBAM), Hardware Exempt (the hardware type was identified and was marked as exempt from MBAM policy), and Not Exempt (the hardware was identified and is not exempt from policy).

          Device Users

          Known users on the computer that is being managed by MBAM.

          Compliance Status Details

          Error and status messages about the compliance state of the computer in accordance to the specified policy.

          Last Contact

          Date and time when the computer last contacted the server to report compliance status. This time is configurable. See MBAM policy settings.

          - - - -**Enterprise Compliance Report Compliance states** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Compliance StatusExemptionDescriptionUser Action

          Noncompliant

          Not Exempt

          The computer is noncompliant according to the specified policy, and the hardware type has not been indicated as exempt from policy.

          Click Computer Name to expand the Computer Compliance Report and determine whether the state of each drive complies with the specified policy. If the encryption state indicates that the computer is not encrypted, encryption might still be in process, or there might be an error on the computer. If there is no error, the likely cause is that the computer is still in the process of connecting or establishing the encryption status. Check back later to determine if the state changes.

          Compliant

          Not Exempt

          The computer is compliant in accordance with the specified policy.

          No Action needed. Optionally, you can view the Computer Compliance Report to confirm the state of the computer.

          Compliant

          Hardware Exempt

          If the Hardware type is exempt. Regardless of how the policy is set or the individual status of each hard-drive, the overall state is considered to be compliant.

          No action needed.

          Compliant

          Hardware Unknown

          MBAM recognizes the hardware type, but MBAM does not know whether it is exempt or not exempt. This occurs if the administrator has not set the Compatible status for the hardware. Therefore, MBAM reverts to Compliant status by default.

          This is the initial state of a newly deployed MBAM client. It is typically only a transient state. Even if the administrator has marked the Hardware as Compatible, there can be a significant delay or configurable wait time before the client computer reports back in. Make note of the time of Last Contact, and check in again after the specified interval to see if the state has changed. If the state has not changed, there may be an error for this computer or hardware type.

          - - - -### Computer Compliance Report - -The Computer Compliance Report displays information that is specific to a computer or user. - -The Computer Compliance Report provides detailed encryption information and applicable policies for each drive on a computer, including operating system drives and fixed data drives. To view this report type, click the computer name in the Enterprise Compliance Report or type the computer name in the Computer Compliance Report. To view the details of each drive, expand the Computer Name entry. - -**Note**   -This report does not provide encryption status for Removable Data Volumes. - - - -**Computer Compliance Report fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          The user-specified DNS computer name that is being managed by MBAM.

          Domain Name

          The fully qualified domain name where the client computer resides and is managed by MBAM.

          Computer Type

          The portability type of computer. Valid types are non-Portable and Portable.

          Operating System

          Operating System type installed on the MBAM managed client computer.

          Compliance Status

          The overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. While it is possible to have Compliant and Noncompliant drives in the same computer, this field indicates the overall computer compliance per specified policy.

          Policy Cypher Strength

          The Cipher Strength selected by the Administrator during MBAM policy specification. For example, 128-bit with Diffuser

          Policy Operating System Drive

          Indicates whether encryption is required for the O/S and the protector type as applicable.

          Policy Fixed Data Drive

          Indicates whether encryption is required for the Fixed Drive.

          Policy Removable Data Drive

          Indicates whether encryption is required for the Removable Drive.

          Device Users

          Provides the identity of known users on the computer.

          Exemption

          Indicates whether the computer hardware type is recognized by MBAM and, if known, whether the computer has been indicated as exempt from policy. There are three states: Hardware Unknown (the hardware type has not been identified by MBAM); Hardware Exempt (the hardware type was identified and was marked as exempt from MBAM policy); and Not Exempt (the hardware was identified and is not exempt from policy).

          Manufacturer

          The computer manufacturer name as it appears in the computer BIOS.

          Model

          The computer manufacturer model name as it appears in the computer BIOS.

          Compliance Status Details

          Error and status messages of the compliance state of the computer in accordance with the specified policy.

          Last Contact

          Date and time that the computer last contacted the server to report compliance status. T

          - - - -**Computer Compliance Report Drive fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Drive Letter

          Computer drive letter that was assigned to this particular drive by the user.

          Drive Type

          Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

          Cypher Strength

          Cipher Strength selected by the Administrator during MBAM policy specification.

          Protector Type

          Type of protector selected via policy used to encrypt an operating system or Fixed volume. The valid protector types on an operating system drive are TPM or TPM+PIN. The only valid protector type for a Fixed Data Volume is Password.

          Protector State

          This field indicates whether the computer has enabled the protector type specified in the policy. The valid states are ON or OFF.

          Encryption State

          This is the current encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

          Compliance Status

          Indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant.

          Compliance Status Details

          Contains error and status messages regarding the compliance state of the computer.

          - - - -### Hardware Audit Report - -This report can help you audit changes to the Hardware Compatibility status of specific computer makes and models. To help you narrow your search results, this report includes filtering on criteria such as type of change and time of occurrence. Each state change is tracked by user and date and time. The Hardware Type is automatically populated by the MBAM agent that runs on the client computer. This report tracks user changes to the information collected directly from the MBAM managed computer. A typical administrative change is changing from Compatible to incompatible. However, the administrator can also revise any field. - -**Hardware Audit Report fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Date and Time

          Date and time that a change was made to the Hardware Type. Note that every unique hardware type is assigned to at least one entry.

          User

          Administrative user that has made the change for the particular entry.

          Change Type

          Type of change that was made to the hardware type information. Valid values are Addition (new entry), Update (change existing entry), or Deletion (remove existing entry).

          Original Value

          Value of the hardware type specification before the change was made.

          Current Value

          Value of the hardware type specification after the change was made.

          - - - -### Recovery Audit Report - -The Recovery Audit Report can help you audit users who have requested access to recovery keys. The filter criteria for this report includes type of user making the request, type of key requested, time of occurrence, success or fail, time of occurrence, and type of user requesting (help desk, end user). This report enables administrators to produce contextual reports based on need. - -**Recovery Audit Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Request Date and Time

          The date and time that a key retrieval request was made by an end user or help desk user.

          Request Status

          Status of the request. Valid statuses are either Successful (the key was retrieved) or Failed (the key was not retrieved).

          Helpdesk User

          The help desk user who initiated the request for key retrieval. If the help desk user retrieves the key on behalf of an end user, the End User field will be blank.

          User

          The end user who initiated the request for key retrieval.

          Key Type

          The type of key that was requested. MBAM collects three key types: Recovery Key Password (to recovery a computer in recovery mode); Recovery Key ID (to recover a computer in recovery mode on behalf of another user); and Trusted Platform Module (TPM) Password Hash (to recover a computer with a locked TPM).

          Reason Description

          The reason that the specified Key Type was requested. The reasons are specified in the Drive Recovery and Manage TPM features of the Administrative web site. Valid entries include user-entered text or one of the following reason codes:

          -
            -
          • Operating System Boot Order changed

          • -
          • BIOS changed

          • -
          • Operating System files changed

          • -
          • Lost Startup key

          • -
          • Lost PIN

          • -
          • TPM Reset

          • -
          • Lost Passphrase

          • -
          • Lost Smartcard

          • -
          • Reset PIN lockout

          • -
          • Turn on TPM

          • -
          • Turn off TPM

          • -
          • Change TPM password

          • -
          • Clear TPM

          • -
          -

          - - - -**Note**   -To save report results to a file, click the **Export** button on the reports menu bar. - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v2/TOC.md b/mdop/mbam-v2/TOC.md deleted file mode 100644 index ee098e3a8b..0000000000 --- a/mdop/mbam-v2/TOC.md +++ /dev/null @@ -1,73 +0,0 @@ -# [Microsoft BitLocker Administration and Monitoring 2](index.md) -## [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) -### [About MBAM 2.0](about-mbam-20-mbam-2.md) -#### [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md) -### [About MBAM 2.0 SP1](about-mbam-20-sp1.md) -#### [Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md) -### [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) -### [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md) -### [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) -## [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) -### [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) -#### [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) -#### [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) -#### [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) -### [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) -#### [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) -#### [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) -#### [Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) -### [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) -## [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) -### [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) -#### [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md) -#### [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md) -#### [How to Use a Command Line to Install the MBAM Server](how-to-use-a-command-line-to-install-the-mbam-server.md) -#### [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md) -### [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) -#### [How to Install the MBAM 2.0 Group Policy Template](how-to-install-the-mbam-20-group-policy-template-mbam-2.md) -#### [How to Edit MBAM 2.0 GPO Settings](how-to-edit-mbam-20-gpo-settings-mbam-2.md) -#### [How to Hide Default BitLocker Encryption in the Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md) -### [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) -#### [How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md) -#### [How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md) -#### [How to Use a Command Line to Install the MBAM Client](how-to-use-a-command-line-to-install-the-mbam-client.md) -### [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md) -### [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) -## [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) -### [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) -#### [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md) -#### [Planning to Deploy MBAM with Configuration Manager [2 [MBAM_2](planning-to-deploy-mbam-with-configuration-manager-2.md) -#### [Deploying MBAM with Configuration Manager [MBAM2 [MBAM_2](deploying-mbam-with-configuration-manager-mbam2.md) -##### [How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) -###### [Edit the Configuration.mof File](edit-the-configurationmof-file.md) -###### [Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file.md) -##### [How to Install MBAM with Configuration Manager](how-to-install-mbam-with-configuration-manager.md) -##### [How to Validate the MBAM Installation with Configuration Manager](how-to-validate-the-mbam-installation-with-configuration-manager.md) -#### [Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md) -### [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) -#### [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md) -#### [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md) -#### [How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md) -### [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) -#### [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md) -#### [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md) -### [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) -#### [How to Use the Help Desk Portal](how-to-use-the-help-desk-portal.md) -#### [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md) -#### [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md) -#### [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) -#### [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) -#### [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md) -#### [How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md) -#### [Helping End Users Manage BitLocker](helping-end-users-manage-bitlocker.md) -##### [Using Your PIN or Password](using-your-pin-or-password.md) -##### [About the Computer TPM Chip](about-the-computer-tpm-chip.md) -### [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) -#### [High Availability for MBAM 2.0](high-availability-for-mbam-20-mbam-2.md) -#### [How to Move MBAM 2.0 Features to Another Computer](how-to-move-mbam-20-features-to-another-computer-mbam-2.md) -### [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) -#### [MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md) -#### [MBAM 2.0 Privacy Statement](mbam-20-privacy-statement-mbam-2.md) -### [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) -## [Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - diff --git a/mdop/mbam-v2/about-mbam-20-mbam-2.md b/mdop/mbam-v2/about-mbam-20-mbam-2.md deleted file mode 100644 index f12cb7956f..0000000000 --- a/mdop/mbam-v2/about-mbam-20-mbam-2.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: About MBAM 2.0 -description: About MBAM 2.0 -author: msfttracyp -ms.assetid: b43a0ba9-1c83-4854-a2c5-14eea0070e36 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 provides a simplified administrative interface to BitLocker drive encryption. BitLocker offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system volume and configured data volumes. - -## About MBAM 2.0 - - -BitLocker Administration and Monitoring 2.0 enforces the BitLocker encryption policy options that you set for your enterprise, monitors the compliance of client computers with those policies, and reports on the encryption status of both the enterprise and the individual computers. In addition, MBAM lets you access the recovery key information when users forget their PIN or password, or when their BIOS or boot record changes. - -**Note**   -BitLocker is not covered in detail in this guide. For an overview of BitLocker, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are responsible for ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for computer security in remote or branch offices - -- Administrators who are responsible for client computers that are running Windows - -## What’s New in MBAM 2.0 - - -MBAM 2.0 provides the following new features and functionality. - -### Integration of System Center Configuration Manager with MBAM - -MBAM now supports integration with System Center Configuration Manager. This integration moves the MBAM compliance infrastructure into the native environment of Configuration Manager. IT administrators who use Configuration Manager in their enterprise can now view the compliance status of their enterprise in the Microsoft Management Console and drill into reports to view individual computers. - -### Hardware Compatibility is Available Only in the Configuration Manager Integration Topology - -Integrating Configuration Manager with MBAM enables Configuration Manager capabilities that allow or prohibit the use of certain hardware types with MBAM and provides more flexibility than the hardware compatibility that was available in MBAM 1.0. IT administrators can create their own collections to limit hardware and can deploy the MBAM configuration baseline to those collections. The MBAM hardware compatibility that was present in MBAM 1.0 is now available only in the MBAM Configuration Manager topology and is administered from Configuration Manager. - -### Protectors Flexible Policy - -Computers that are already encrypted with a protector (for example, TPM + PIN or Auto-Unlock and password) and that receive an MBAM policy that requires a subset of that encryption (for example, TPM or Auto-Unlock) are considered compliant. In the example above, PIN and password would not be removed automatically unless the IT administrator specifically defines these features as no longer allowed. - -Computers that are not encrypted and that receive an MBAM policy (for example, TPM or Auto-Unlock) are encrypted accordingly. Users who are local administrators are allowed to use the BitLocker tools (Control Panel item BitLocker Drive Encryption or Manage-bde) to add or modify the existing protectors (for example, TPM + PIN or Auto-Unlock and password). They remain compliant unless MBAM policies specifically define them. - -### Ability to Upgrade the MBAM Client - -The MBAM 2.0 Client Windows Installer detects the version of the existing client and performs the required steps to upgrade to the MBAM 2.0 Client from previous versions. - -### Ability to Upgrade the MBAM Server from Previous Versions - -You can upgrade the MBAM 2.0 Server infrastructure from previous versions of MBAM as follows: - -**Manual in-place server replacement** – You must manually uninstall the existing MBAM server infrastructure, and then install the MBAM 2.0 Server infrastructure. You do not have to remove the databases to do the upgrade. Instead, you select the existing databases, which the previous version of the MBAM Client created. The MBAM 2.0 upgrade installation then migrates the existing databases to MBAM 2.0. - -**Distributed client upgrade** – If you are using the Stand-alone MBAM topology, you can upgrade the MBAM Clients gradually after you install the MBAM 2.0 Server infrastructure. The MBAM 2.0 Server detects the version of the existing Client and performs the required steps to upgrade to the 2.0 Client. - -After you upgrade the MBAM 2.0 Server infrastructure, MBAM 1.0 Clients continue to report to the MBAM 2.0 Server successfully, escrowing recovery data, but compliance will be based on the policies in MBAM 1.0. You must upgrade clients to MBAM 2.0 to have client computers accurately report compliance against the MBAM 2.0 policies. You can upgrade the clients to the MBAM 2.0 Client without uninstalling the previous client, and the client will start to apply and report MBAM 2.0 policies. - -If you are using MBAM with Configuration Manager, you must upgrade the MBAM 1.0 clients to MBAM 2.0. - -### MBAM Support for BitLocker’s Enterprise Scenarios on the Windows 8 Platform - -MBAM supports the Windows 8 operating system as a target platform for the MBAM Client installation. This support enables IT administrators to install the MBAM agent, to encrypt Windows 8 operating system drives, and to report on the compliance of the computers. MBAM leverages the TPM and TPM+PIN protectors to manage the Windows 8 operating system just as it does the Windows 7 operating system. MBAM 2.0 also adds support for encrypting Windows To Go clients. - -### Addition of the Self-Service Portal - -End users can now use the Self-Service Portal to recover their recovery keys. The Self-Service Portal can be deployed on a single server with the other MBAM features, or on a separate server that gives IT administrators the flexibility to expose the Self-Server Portal to users, as required. After the Self-Service Portal authenticates users, users have to enter only the first eight digits of the recovery key ID to receive their recovery key. - -MBAM also secures the key by allowing users to recover keys only for those computers on which they are users, which reduces the risk that other users gain unauthorized access. - -### Ability to Automatically Resume BitLocker Protection from a Suspended State - -MBAM no longer allows IT administrators to keep BitLocker suspended and unprotected for prolonged periods of time. If an IT administrator suspends BitLocker, MBAM re-enables it automatically when the computer is rebooted, which reduces the risk that the computer can be attacked. - -### Fixed Data Drives Can Be Configured to Automatically Unlock Without a Password - -A Fixed Data Drive (FDD) policy can now be configured to allow automatic unlocking of the drive without a password. Users are not prompted for a password before the FDD is encrypted, and the FDD will be secured and auto-unlocked with the operating system drive. - -## MBAM 2.0 Release Notes - - -For more information, and for late-breaking news that is not included in the documentation, see the [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md). - -## How to Get MBAM 2.0 - - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/p/?LinkId=322049) - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/about-mbam-20-sp1.md b/mdop/mbam-v2/about-mbam-20-sp1.md deleted file mode 100644 index b5bf6aee5b..0000000000 --- a/mdop/mbam-v2/about-mbam-20-sp1.md +++ /dev/null @@ -1,490 +0,0 @@ ---- -title: About MBAM 2.0 SP1 -description: About MBAM 2.0 SP1 -author: msfttracyp -ms.assetid: 5ba89ed8-bb6e-407b-82c2-e2e36dd1078e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 2.0 SP1 - - -This topic describes the changes in Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1). For a general description of MBAM, see [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md). - -## What’s new in MBAM 2.0 SP1 - - -This version of MBAM provides the following new features and functionality. - -### Support for Windows 8.1, Windows Server 2012 R2, and System Center 2012 R2 Configuration Manager - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1) adds support for Windows 8.1, Windows Server 2012 R2, and System Center 2012 R2 Configuration Manager. - -### Support for Microsoft SQL Server 2008 R2 SP2 - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1) adds support for Microsoft SQL Server 2008 R2 SP2. You must use Microsoft SQL Server 2008 R2 or higher if you are running Microsoft System Center Configuration Manager 2007 R2. - -### Customer feedback rollup - -MBAM 2.0 SP1 includes a rollup of fixes to address issues that were found since the Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 release. As part of these changes, the Computer Name field now appears in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you run MBAM with Microsoft System Center Configuration Manager 2007. - -### Firewall exception must be set on ports for the Self-Service Portal and the Administration and Monitoring website - -When you configure the Self-Service Portal and the Administration and Monitoring website, you must set a firewall exception to enable communication through the specified ports. Previously, the MBAM server installation opened the ports automatically in Windows Firewall. - -### Location of MBAM reports has changed in Configuration Manager - -MBAM reports for the Configuration Manager integrated topology are now available under subfolders within the MBAM node. The subfolder names represent the language of the reports within the subfolder. - -### Ability to install MBAM on a primary site server when you install MBAM with Configuration Manager - -You can install MBAM on a primary site server or a central administration site server when you install MBAM with the Configuration Manager integrated topology. Previously, you were required to install MBAM on a central administration site server. - -**Important** -The server on which you install MBAM must be the top-tier server in your hierarchy. - - - -The MBAM installation works differently for Microsoft System Center Configuration Manager 2007 and Microsoft System Center 2012 Configuration Manager as follows: - -- **Configuration Manager 2007** : If you install MBAM on a primary site server that is part of a larger Configuration Manager hierarchy and has a central site parent server, MBAM resolves the central site parent server and performs all of the installation actions on that parent server. The installation actions include checking prerequisites and installing the Configuration Manager objects and reports. For example, if you install MBAM on a primary site server that is a child of a central site parent server, MBAM installs all of the Configuration Manager objects and reports on the parent server. If you install MBAM on the parent server, MBAM performs all of the installation actions on that parent server. - -- **System Center 2012 Configuration Manager** : If you install MBAM on a primary site server or on a central administration server, MBAM performs all of the installation actions on that site server. - -### Configuration Manager Console must be installed on the computer on which you install the MBAM Server - -When you install MBAM with the Configuration Manager integrated topology, you must install the Configuration Manager Console on the same computer on which MBAM will be installed. If you use the recommended architecture, which is described in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md), you would install MBAM on the Configuration Manager Primary Site Server. - -### New setup command-line parameters for the Configuration Manager integrated topology - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Command-Line ParameterDescriptionExample

          CM_SSRS_REMOTE_SERVER_NAME

          Enables you to install the Configuration Manager reports on a remote SQL Server Reporting Services (SSRS) server that is part of the same Configuration Manager site to which MBAM is installed. You can set the value to the fully qualified domain name of the remote SSRS point role server.

          MbamSetup.exe CM_SSRS_REMOTE_SERVER_NAME=ssrsServer.Contoso.com

          CM_REPORTS_ONLY

          Enables you to install only the Configuration Manager reports, without other Configuration Manager objects, such as the baseline, collection, and configuration items.

          -
          -Note

          You must combine this parameter with the CM_REPORTS_COLLECTION_ID parameter.

          -
          -
          - -
          -

          Valid parameter values:

          -
            -
          • True

          • -
          • False

          • -
          -

          You can combine this parameter with the CM_SSRS_REMOTE_SERVER_NAME parameter if you want to install the reports only to a remote SSRS point role server.

          -

          If you do not set the parameter or if you set it to False, MBAM Setup installs all of the Configuration Manager objects, including the reports.

          MbamSetup.exe CM_REPORTS_ONLY=True

          -

          CM_REPORTS_COLLECTION_ID=SMS00001

          CM_REPORTS_COLLECTION_ID

          An existing collection ID that identifies the collection for which reporting compliance data will be displayed. You can specify any collection ID. You are not required to use the “MBAM Supported Computers” collection ID.

          MbamSetup.exe CM_REPORTS_ONLY=True

          -

          CM_REPORTS_COLLECTION_ID=SMS00001

          - - - -### Ability to turn Self-Service Portal notice text on or off - -MBAM 2.0 SP1 enables you to turn off the notice text on the Self-Service Portal. Previously, the notice text displayed by default, and you could not turn it off. - -**To turn off the notice text** - -1. On the server where you installed the Self-Service Portal, open Internet Information Services (IIS) and browse to **Sites > Microsoft BitLocker Administration and Monitoring > SelfService > Application Settings**. - -2. From the **Name** column, select **DisplayNotice**, and set the value to **false**. - -### Ability to localize the HelpdeskText statement that points users to more Self-Service Portal information - -You can configure a localized version of the Self-Service Portal “HelpdeskText” statement, which tells end users how to get additional help when they are using the Self-Service Portal. If you configure localized text for the statement, as described in the following instructions, MBAM will display the localized version. If MBAM does not find the localized version, it displays the value that is in the **HelpdeskText** parameter. - -**To display a localized version of the HelpdeskText statement** - -1. On the server where you installed the Self-Service Portal, open IIS and browse to **Sites > Microsoft BitLocker Administration and Monitoring > SelfService > Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskText**\_<*language*>, where <*language*> is the appropriate language code for the text. For example, to create a localized HelpdeskText statement in Spanish, you would name the parameter HelpdeskText\_es-es. For a list of the valid language codes that you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized text that you want to display to end users. - -### Ability to localize the Self-Service Portal HelpdeskURL - -You can configure a localized version of the Self-Service Portal HelpdeskURL to display to end users by default. If you create a localized version, as described in the following instructions, MBAM finds and displays the localized version. If MBAM does not find a localized version, it displays the URL that is configured for the HelpDeskURL parameter. - -**To display a localized HelpdeskURL** - -1. On the server where you installed the Self-Service Portal, open IIS and browse to **Sites > Microsoft BitLocker Administration and Monitoring > SelfService > Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskURL**\_<*language*>, where <*language*> is the appropriate language code for the URL. For example, to create a localized HelpdeskURL in Spanish, you would name the parameter HelpdeskURL\_es-es. For a list of the valid language codes you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized HelpdeskURL that you want to display to end users. - -### Ability to localize the Self-Service Portal notice text - -You can configure localized notice text to display to end users by default in the Self-Service Portal. The notice.txt file, which displays the notice text, is located in the following root directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -To display localized notice text, you create a localized notice.txt file and save it under a specific language folder in the following directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -MBAM displays the notice text, based on the following rules: - -- If you create a localized notice.txt file in the appropriate language folder, MBAM displays the localized notice text. - -- If MBAM does not find a localized version of the notice.txt file, it displays the text in the default notice.txt file. - -- If MBAM does not find a default notice.txt file, it displays the default text in the Self-Service Portal. - -**Note** -If an end user’s browser is set to a language that does not have a corresponding language subfolder or notice.txt, the text that is in the notice.txt file in the following root directory is displayed: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - - -**To create a localized notice.txt file** - -1. On the server where you installed the Self-Service Portal, create a <*language*> folder in the following directory, where <*language*> represents the name of the localized language: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - **Note** - Some language folders already exist, so you may not have to create one. If you do need to create a language folder, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947) for a list of the valid names that you can use for the <*language*> folder. - - - -2. Create a notice.txt file that contains the localized notice text. - -3. Save the notice.txt file in the <*language*> folder. For example, to create a localized notice.txt file in Spanish, you would save the localized notice.txt file in the following folder: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\es-es - -## Upgrading to MBAM 2.0 SP1 - - -You can upgrade to MBAM 2.0 SP1 from any previous version of MBAM. - -### Upgrading the MBAM infrastructure - -You can upgrade the MBAM Server infrastructure to MBAM 2.0 SP1 as follows: - -**Manual in-place server replacement**: You must manually uninstall the existing MBAM Server infrastructure, and then install the MBAM 2.0 SP1 Server infrastructure. You do not have to remove the databases to do the upgrade. Instead, you select the existing databases, which the previous version of MBAM created. The MBAM 2.0 SP1 upgrade installation then migrates the existing databases to MBAM 2.0 SP1. - -**Distributed client upgrade**: If you are using the Stand-alone MBAM topology, you can upgrade the MBAM Clients gradually after you install the MBAM 2.0 SP1 Server infrastructure. - -After you upgrade the MBAM Server infrastructure, MBAM 1.0 or 2.0 Clients will report to the MBAM 2.0 SP1 Server successfully and will store the recovery data, but compliance will be based on the policies available for the MBAM Client version that is currently installed. To enable reporting against MBAM 2.0 SP1 policies, you must upgrade client computers to MBAM 2.0 SP1. You can upgrade the client computers to the MBAM 2.0 SP1 Client without uninstalling the previous Client, and the Client will start to apply and report, based on the MBAM 2.0 SP1 policies. - -For more information about upgrading the MBAM servers, see [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md). - -### Upgrading the MBAM Client to MBAM 2.0 SP1 - -To upgrade end-user computers to the MBAM 2.0 SP1 Client, run **MbamClientSetup.exe** on each client computer. The installer automatically updates the Client to the MBAM 2.0 SP1 Client. After the installation, client computers do not have to be rebooted, and the MBAM 2.0 SP1 Client starts to apply and report against MBAM 2.0 SP1 policies. - -If you are using MBAM with Configuration Manager, you must upgrade the MBAM client computers to MBAM 2.0 SP1. - -For more information about upgrading the MBAM client computers, see [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md). - -## Installing or upgrading to MBAM 2.0 SP1 with Configuration Manager - - -This section describes the requirements when you are installing MBAM 2.0 SP1 as a new installation or as an upgrade to a previous MBAM 2.0 SP1 installation. - -### Required files for installing MBAM 2.0 SP1 if you are using MBAM with Configuration Manager - -If you are installing MBAM for the first time and you are using MBAM 2.0 SP1 with System Center Configuration Manager, you must create or edit mof files to enable MBAM to work correctly with Configuration Manager. - -- **configuration.mof file** - - - If you are using Configuration Manager 2007, you must edit the configuration.mof file by completing step 3 from the item **Update the configuration.mof file if you upgrade to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007**, which follows this item. - - - If you are using System Center 2012 Configuration Manager, edit the configuration.mof file by following the instructions in [Edit the Configuration.mof File](edit-the-configurationmof-file.md). - -- **sms\_def.mof file** – follow the instructions in [Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file.md). - -### Update the configuration.mof file if you upgrade to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007 - -If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007, you must update the configuration.mof file to ensure that MBAM 2.0 SP1 works correctly. - -**To update the configuration.mof file:** - -1. On the Configuration Manager Server, browse to the location of the Configuration.mof file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files (x86)\\Microsoft Configuration Manager. - -2. Review the block of code that you appended to the configuration.mof file, and delete it. The block of code will be similar to the one shown in the following step. - -3. Copy the following block of code, and then append it to the configuration.mof file to add the following required MBAM classes to the file: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - -# pragma namespace ("\\\\.\\root\\cimv2") -# pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - }; - -# pragma namespace ("\\\\.\\root\\cimv2") -# pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - -# pragma namespace ("\\\\.\\root\\cimv2") -# pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy_64 - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy_64 - { - KeyName="BitLocker policy 64"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - -# pragma namespace ("\\\\.\\root\\cimv2") -# pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - -# pragma namespace ("\\\\.\\root\\cimv2") -# pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - - ``` - -### Translation of MBAM 2.0 SP1 - -MBAM 2.0 SP1 is now available in the following languages: - -- English (United States) en-US - -- French (France) fr-FR - -- Italian (Italy) it-IT - -- German (Germany) de-DE - -- Spanish, International Sort (Spain) es-ES - -- Korean (Korea) ko-KR - -- Japanese (Japan) ja-JP - -- Portuguese (Brazil) pt-BR - -- Russian (Russia) ru-RU - -- Chinese Traditional zh-TW - -- Chinese Simplified zh-CN - -## How to Get MDOP Technologies - - -MBAM 2.0 SP1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md) - - - - - - - - - diff --git a/mdop/mbam-v2/about-the-computer-tpm-chip.md b/mdop/mbam-v2/about-the-computer-tpm-chip.md deleted file mode 100644 index 053703ed72..0000000000 --- a/mdop/mbam-v2/about-the-computer-tpm-chip.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: About the Computer TPM Chip -description: About the Computer TPM Chip -author: msfttracyp -ms.assetid: 6f1cf18c-277a-4932-886d-14202ca8d175 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Computer TPM Chip - - -BitLocker provides additional protection when it is used with a Trusted Platform Module (TPM) chip. The TPM chip is a hardware component that is installed in many newer computers by the computer manufacturers. Microsoft BitLocker Administration and Monitoring (MBAM) uses BitLocker, in addition to the TPM chip, to help provide additional protection of your data and to make sure that your computer has not been tampered with. - -## How to Set Up Your TPM - - -When you start the BitLocker Drive Encryption wizard on your computer, BitLocker checks for a TPM chip if your organization has configured BitLocker to use a TPM chip. If BitLocker finds a compatible TPM chip, you may be prompted to restart your computer to enable the TPM chip for use. As soon as your computer has restarted, follow the instructions to configure the TPM chip in the BIOS (the BIOS is a pre-Windows layer of your computer software). - -After BitLocker is configured, you can access additional information about the TPM chip by opening the BitLocker Encryption Options tool in the Windows Control Panel, and then selecting **TPM Administration**. - -**Note**   -You must have administrative credentials on your computer to access this tool. - - - -In a TPM failure, a change in the BIOS, or certain Windows Updates, BitLocker will lock your computer and require you to contact your Help Desk to unlock it. You have to provide the name of your computer as well as your computer’s domain. Help Desk can give you a password file that can be used to unlock your computer. - -## Troubleshooting TPM Issues - - -If a TPM failure, change in the BIOS, or certain Windows Updates occur, BitLocker will lock your computer and require you to contact your Help Desk to unlock it. You have to provide the name of your computer as well as your computer’s domain. The Help Desk can give you a password file that you can use to unlock your computer. - -## Related topics - - -[Helping End Users Manage BitLocker](helping-end-users-manage-bitlocker.md) - -[Using Your PIN or Password](using-your-pin-or-password.md) - - - - - - - - - diff --git a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md b/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md deleted file mode 100644 index d4ab5fa177..0000000000 --- a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for MBAM 2.0 -description: Accessibility for MBAM 2.0 -author: msfttracyp -ms.assetid: 9cd628f1-f594-43ab-8095-4663272940a9 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for MBAM 2.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md deleted file mode 100644 index 8331189deb..0000000000 --- a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Administering MBAM 2.0 Features -description: Administering MBAM 2.0 Features -author: msfttracyp -ms.assetid: 065e0704-069e-4372-9b86-0b57dd7638dd -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 2.0 Features - - -After completing all necessary planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage BitLocker encryption across the enterprise The information in this section describes post-installation day-to-day Microsoft BitLocker Administration and Monitoring feature operations tasks. - -## Manage MBAM Administrator Roles - - -After MBAM Setup is complete for all server features, administrative users have to be granted access to them. As a best practice, administrators who will manage or use MBAM server features should be assigned to Active Directory Domain Services security groups, and then those groups should be added to the appropriate MBAM administrative local group. - -[How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md) - -## Manage BitLocker Encryption Exemptions - - -MBAM lets you grant encryption exemptions to specific users who do not need or want their drives encrypted. Computer exemption is typically used when a company has computers that do not have to be encrypted, such as computers that are used in development or testing, or older computers that do not support BitLocker. In some cases, local law may also require that certain computers are not encrypted. - -[How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md) - -## Manage MBAM Client BitLocker Encryption Options by Using the Control Panel - - -MBAM provides a custom control panel, called BitLocker Encryption Options, that will appear under **System and Security**. The MBAM control panel can be used to unlock encrypted fixed and removable drives, and also manage your PIN or password. - -**Note**   -This customized control panel does not replace the default Windows BitLocker control panel. - - - -[How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md) - -## Other Resources for Administering MBAM Features - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md deleted file mode 100644 index cd4cc7364f..0000000000 --- a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Administering MBAM 2.0 Using PowerShell -description: Administering MBAM 2.0 Using PowerShell -author: msfttracyp -ms.assetid: d785a8df-0a8c-4d70-abd2-93a762b4f3de -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 2.0 Using PowerShell - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various Microsoft BitLocker Administration and Monitoring server tasks from the command line rather than from the MBAM administration website. - -## How to Administer MBAM Using PowerShell - - -Use the PowerShell cmdlets described here to administer MBAM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDescription

          Install-Mbam

          Installs the MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting.

          Uninstall-Mbam

          Removes the MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting tools.

          Get-MbamBitLockerRecoveryKey

          Requests an MBAM recovery key that will enable users to unlock a computer or encrypted drive.

          Get-MbamTPMOwnerPassword

          Provides users with a TPM owner password that they can use to unlock a Trusted Platform Module (TPM) when the TPM has locked them out and will no longer accept their PIN.

          - -  - -## Related topics - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md b/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md deleted file mode 100644 index 1ce8e1b6f2..0000000000 --- a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md +++ /dev/null @@ -1,381 +0,0 @@ ---- -title: Create or Edit the Sms\_def.mof File -description: Create or Edit the Sms\_def.mof File -author: msfttracyp -ms.assetid: d1747e43-484e-4031-a63b-6342fe588aa2 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/04/2017 ---- - - -# Create or Edit the Sms\_def.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to create or edit the Sms\_def.mof file. - -If you are using System Center 2012 Configuration Manager, you must create the file. - -In Configuration Manager 2007, the file already exists, so you only have to edit it. **Do not overwrite the existing file**. - -In the following sections, complete the instructions that correspond to the version of Configuration Manager that you are using. - -**To create the Sms\_def.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location where you have to create the Sms\_def.mof file, for example, the Desktop. - -2. Create a text file called **Sms\_def.mof** and copy the following code to populate the file with the following Sms\_def.mof MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - }; - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0")] - - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Import the **Sms\_def.mof** file by doing the following: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**, and then click **Import**. - - 6. In the browser that opens, select your **.mof** file, and then click **Open**. The **Import Summary** window opens. - - 7. In the **Import Summary** window, ensure that the option to import both hardware inventory classes and class settings is selected, and then click **Import**. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -4. Enable the **Win32\_Tpm** class as follows: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**. - - 6. In the main window, scroll down, and then select the **TPM (Win32\_Tpm)** class. - - 7. Under **TPM**, ensure that the **SpecVersion** property is selected. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -**To edit the sms\_def.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **sms\_def.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive% \\Program Files (x86)\\Microsoft Configuration Manager. - -2. Copy the following code, and then append it to **Sms\_def.mof** file to add the following required MBAM classes to the file: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=32|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=64|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy_64: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Modify the **Win32\_Tpm** class as follows: - - - Set **SMS\_REPORT** to **TRUE** in the class attributes. - - - Set **SMS\_REPORT** to **TRUE** in the **SpecVersion** property attribute. - -## Related topics - - -[How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md deleted file mode 100644 index a117c6af21..0000000000 --- a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Deploying MBAM 2.0 Group Policy Objects -description: Deploying MBAM 2.0 Group Policy Objects -author: msfttracyp -ms.assetid: f17f3897-73ab-431b-a6ec-5a6cff9f279a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.0 Group Policy Objects - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you first have to determine the Group Policies that you will use in your implementation of Microsoft BitLocker Administration and Monitoring. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for more information on the different policies that are available. When you have determined the policies that you are going to use, you then must create and deploy one or more Group Policy Objects (GPO) that include the policy settings for MBAM by using the MBAM 2.0 Group Policy template. - -## Install the MBAM 2.0 Group Policy Template - - -In addition to the server-related Microsoft BitLocker Administration and Monitoring features, the server setup application includes a MBAM Group Policy template. This template can be installed on any computer able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -[How to Install the MBAM 2.0 Group Policy Template](how-to-install-the-mbam-20-group-policy-template-mbam-2.md) - -## Deploy MBAM 2.0 Group Policy Settings - - -After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. - -[How to Edit MBAM 2.0 GPO Settings](how-to-edit-mbam-20-gpo-settings-mbam-2.md) - -## Display the MBAM Control Panel in Windows - - -Because MBAM offers a customized MBAM control panel that can replace the default Windows BitLocker control panel, you can also choose to hide the default BitLocker Control Panel from end users by using Group Policy. - -[How to Hide Default BitLocker Encryption in the Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md) - -## Other Resources for Deploying MBAM 2.0 Group Policy Objects - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-mbam-2.md deleted file mode 100644 index 3123a95e40..0000000000 --- a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Deploying MBAM 2.0 -description: Deploying MBAM 2.0 -author: msfttracyp -ms.assetid: 4b0eaf10-81b4-427e-9d43-eb833de935a3 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) supports a number of different deployment configurations. This section includes information that you should consider about the deployment of MBAM and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -You can deploy MBAM either in a Stand-alone topology, or with a topology that integrates MBAM with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager. For information about installing MBAM with the Configuration Manager integrated topology, see [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md). - -## Deployment Information - - -- [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - This section describes the different MBAM deployment topology options and how to use MBAM Setup to deploy MBAM Server features. - -- [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - This section describes how to create and deploy MBAM Group Policy Objects that are required for managing MBAM Clients and BitLocker encryption policies throughout the enterprise. - -- [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - This section describes how to use the MBAM Client Installer files to deploy the MBAM Client software. - -- [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md) - - This section provides a deployment checklist that can be used to assist in MBAM Server feature and MBAM Client deployment. - -- [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) - - This section provides instructions for upgrading MBAM from previous versions. - -## Other Resources for Deploying MBAM - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md b/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md deleted file mode 100644 index b7254c63e3..0000000000 --- a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying MBAM with Configuration Manager -description: Deploying MBAM with Configuration Manager -author: msfttracyp -ms.assetid: 89d03e29-457a-471d-b893-e0b74a83ec50 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying MBAM with Configuration Manager - - -The following procedures describe how to deploy Microsoft BitLocker Administration and Monitoring (MBAM) with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager by usingthe recommended configuration, which is described in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md). The recommended configuration is to install the Administration and Monitoring features on one or more Microsoft BitLocker Administration and Monitoring servers, and install Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager on a separate server. - -Before you start the installation, ensure that you have met the prerequisites and hardware and software requirements for installing MBAM with Configuration Manager by reviewing [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -If you ever have to reinstall MBAM with the Configuration Manager topology, you will need to remove certain Configuration Manager objects first. Read the [Knowledge Base article](https://go.microsoft.com/fwlink/?LinkId=286306) for more information. - -The steps to install MBAM with Configuration Manager are grouped into the following categories. Complete the steps for each category to complete the installation. - -## How to Create or Edit the mof Files - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the **Configuration.mof** file, and either edit or create the Sms\_def.mof file, depending on which version of Configuration Manager you are using. - -[How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) - -## How to Install MBAM with Configuration Manager - - -This section provides steps about how to install the following: MBAM on the Configuration Manager Server; the Recovery and Audit Databases on the Database Server; and the Administration and Monitoring Server features on the Administration and Monitoring Server. - -[How to Install MBAM with Configuration Manager](how-to-install-mbam-with-configuration-manager.md) - -## How to Validate the MBAM Server Feature Installation on the Configuration Manager Server - - -When the Microsoft BitLocker Administration and Monitoring installation is complete, validate that the installation has successfully set up all the necessary MBAM features required for the Configuration Manager Server. - -[How to Validate the MBAM Installation with Configuration Manager](how-to-validate-the-mbam-installation-with-configuration-manager.md) - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md deleted file mode 100644 index ab113f1153..0000000000 --- a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying the MBAM 2.0 Client -description: Deploying the MBAM 2.0 Client -author: msfttracyp -ms.assetid: 3dd584fe-2a54-40f0-9bab-13ea74040b01 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.0 Client - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an electronic software distribution system, such as Active Directory Domain Services, or by directly encrypting the client computers as part of the initial imaging process. - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring Client, you can enable BitLocker encryption on a computer in your organization either before the end user receives the computer or afterwards by configuring Group Policy and deploying the MBAM Client software by using an enterprise software deployment system. - -## Deploy the MBAM Client to Desktop or Laptop Computers - - -After configuring Group Policy, you can use an enterprise software deployment system product like Microsoft System Center Configuration Manager 2012 or Active Directory Domain Services to deploy the MBAM Client installation Windows Installer files to target computers. You can deploy the client by using either the 32-bit or 64-bit MbamClientSetup.exe files, or the 32-bit or 64-bit MBAMClient.msi files, which are provided with the MBAM software. For more information about deploying MBAM Group Policy Objects, see [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md). - -[How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md) - -## Deploy the MBAM Client as Part of a Windows Deployment - - -In organizations where computers are received and configured centrally, you can install the MBAM Client to manage BitLocker encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then BitLocker encryption compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. If the Group Policy has been configured to require a PIN, users are prompted to set a PIN after they receive the Group Policy. - -[How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md) - -## How to Use a Command Line to Install the MBAM Client - - -This section explains how to install the MBAM Client by using a command line. - -[How to Use a Command Line to Install the MBAM Client](how-to-use-a-command-line-to-install-the-mbam-client.md) - -## Other Resources for Deploying the MBAM Client - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md)[Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md deleted file mode 100644 index 1b8e0bec49..0000000000 --- a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Deploying the MBAM 2.0 Server Infrastructure -description: Deploying the MBAM 2.0 Server Infrastructure -author: msfttracyp -ms.assetid: 52e68d94-e2b4-4b06-ae55-f900ea6cc59f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.0 Server Infrastructure - - -Microsoft BitLocker Administration and Monitoring (MBAM) Server features for the Stand-alone topology can be installed in different configurations on two or more servers in a production environment. The recommended configuration is two servers for a production environment, depending on your scalability requirements. Use a single server for an MBAM installation only in test environments. For more information about planning for the MBAM Server feature deployment, see [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md). - -The following diagram shows an example of how you can configure the recommended two-server MBAM deployment. This configuration supports up to 200,000 MBAM clients in a production environment. The server features and databases in the architecture image are described in the following section and are listed under the computer or server where we recommend that you install them. - -![mbam 2 two-server deployment topology](images/mbam2-3-servers.gif) - -## Administration and Monitoring Server - - -The following features are installed on this server: - -- **Administration and Monitoring Server**. The Administration and Monitoring Server feature is installed on a Windows server and consists of the Help Desk website and the monitoring web services. - -- **Self-Service Portal**. The Self-Service Portal is installed on a Windows server. The Self-Service Portal enables end users on client computers to independently log on to a website, where they can obtain a recovery key to recover a locked BitLocker volume. - -## Database Server - - -The following features are installed on this server: - -- **Recovery Database**. The Recovery Database is installed on a Windows server and a supported instance of Microsoft SQL Server. This database stores recovery data that is collected from MBAM client computers. - -- **Compliance and Audit Database**. The Compliance and Audit Database is installed on a Windows server and a supported instance of SQL Server. This database stores compliance data for MBAM client computers. This data is used primarily for reports that SQL Server Reporting Services (SSRS) hosts. - -- **Compliance and Audit Reports**. The Compliance and Audit Reports are installed on a Windows server and a supported instance of SQL Server that has the SQL Server Reporting Services (SSRS) feature installed. These reports provide MBAM reports that you can access from the Help Desk website or directly from the SSRS server. - -## Management Workstation - - -The following feature is installed on the Management Workstation, which can be a Windows server or a client computer. - -- **Policy Template**. The Policy Template consists of Group Policies that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation, which is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. - -## MBAM Client - - -The MBAM Client is installed on a Windows computer and has the following characteristics: - -- Uses Group Policy to enforce the BitLocker drive encryption of client computers in the enterprise. - -- Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - -- Collects compliance data for the computer and passes the data to the reporting system. - -## Other Resources for Deploying MBAM 2.0 Server Features - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/edit-the-configurationmof-file.md b/mdop/mbam-v2/edit-the-configurationmof-file.md deleted file mode 100644 index 09e536028a..0000000000 --- a/mdop/mbam-v2/edit-the-configurationmof-file.md +++ /dev/null @@ -1,389 +0,0 @@ ---- -title: Edit the Configuration.mof File -description: Edit the Configuration.mof File -author: msfttracyp -ms.assetid: 23e50ec9-4083-4b12-ad96-626cf30960bb -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/03/2017 ---- - - -# Edit the Configuration.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the **Configuration.mof** file, whether you are using Configuration Manager 2007 or System Center 2012 Configuration Manager. Complete the following instructions for the version of Configuration Manager that you are using. - -**Important**   -If you are installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1), either by doing a new installation or by upgrading from a previous version, see the appropriate item in [About MBAM 2.0 SP1](about-mbam-20-sp1.md) as described in the following bullets: - -- For a new MBAM 2.0 SP1 installation, see **Required files for installing MBAM 2.0 SP1 if you are using MBAM with Configuration Manager**. - -- For an upgrade to MBAM 2.0 SP1, see **Update the configuration.mof file if you upgrade to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007**. - - - -**To create the configuration.mof file if you are using MBAM 2.0 SP1 with Configuration Manager** - -- See the “Important” note about MBAM 2.0 SP1 earlier in this topic for the appropriate instructions to follow in [About MBAM 2.0 SP1](about-mbam-20-sp1.md). - -**To edit the Configuration.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files \\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -**To edit the Configuration.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files (x86)\\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy_64 - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy_64 - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - - ``` - -## Related topics - - -[How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md b/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md deleted file mode 100644 index 6499e380e6..0000000000 --- a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md +++ /dev/null @@ -1,178 +0,0 @@ ---- -title: Evaluating MBAM 2.0 -description: Evaluating MBAM 2.0 -author: msfttracyp -ms.assetid: bfc77eec-0fd7-4fec-9c78-6870afa87152 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating MBAM 2.0 - - -Before deploying Microsoft BitLocker Administration and Monitoring (MBAM) into a production environment, you should evaluate it in a test environment. The information in this topic can be used to set up Microsoft BitLocker Administration and Monitoring with a Stand-alone topology in a single-server test environment for evaluation purposes only. A single-server topology is not recommended for production environments. - -For instructions on deploying MBAM in a test environment, see [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md). - -## Setting up the Test Environment - - -Even though you are setting up a non-production instance of MBAM to evaluate in a test environment, you should still verify that you have met the prerequisites and hardware and software requirements. Before you start the installation, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md), [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md), and [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md). - -### Plan for an MBAM Evaluation Deployment - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the Getting Started information about MBAM to gain a basic understanding of the product before beginning deployment planning.

          Getting Started with MBAM 2.0

          Checklist box

          Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment.

          MBAM 2.0 Deployment Prerequisites

          Checklist box

          Plan for and configure MBAM Group Policy requirements.

          Planning for MBAM 2.0 Group Policy Requirements

          Checklist box

          Plan for and create necessary Active Directory Domain Services security groups, and plan for MBAM local security group membership requirements.

          Planning for MBAM 2.0 Administrator Roles

          Checklist box

          Plan for deploying MBAM Server feature deployment.

          Planning for MBAM 2.0 Server Deployment

          Checklist box

          Plan for deploying MBAM Client deployment.

          Planning for MBAM 2.0 Client Deployment

          - - - -### Perform an MBAM Evaluation Deployment - -After completing the necessary planning and software prerequisite installations to prepare your computing environment for the MBAM installation, you can begin the MBAM evaluation deployment. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Checklist box

          Review the MBAM supported configurations information to make sure that selected client and server computers are supported for MBAM feature installation.

          MBAM 2.0 Supported Configurations

          Checklist box

          Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes.

          How to Install and Configure MBAM on a Single Server

          Checklist box

          Add Active Directory Domain Services security groups, that you created during the planning phase, to the appropriate local MBAM Server feature local groups on the new MBAM Server.

          Planning for MBAM 2.0 Administrator Roles and How to Manage MBAM Administrator Roles

          Checklist box

          Create and deploy required MBAM Group Policy Objects.

          Deploying MBAM 2.0 Group Policy Objects

          Checklist box

          Deploy the MBAM Client software.

          Deploying the MBAM 2.0 Client

          - - - -## Configure Lab Computers for MBAM Evaluation - - -This section contains information that can be used to speed up the MBAM Client status reporting. However, these modifications should be used for testing purposes only. - -**Note**   -The information in following section describes how to modify the Windows registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. - - - -### Modify MBAM Client Status Reporting Frequency Settings - -The MBAM Client wakeup and status reporting frequencies have a minimum value of 90 minutes when they are set using Group Policy. You can use the Windows registry to change these frequencies to a lower value on MBAM client computers to help speed up testing. - -To modify the MBAM Client status reporting frequency settings: - -1. Use a registry editor to navigate to **HKLM\\Software\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement**. - -2. Change the values for **ClientWakeupFrequency** and **StatusReportingFrequency** to **1** as the minimum client-supported value. This change causes the MBAM Client to report every minute. - -3. Restart **BitLocker Management Client Service**. - -**Note**   -To set values that are this low, you must set them in the registry manually. - - - -### Modify MBAM Client Service Startup Delay - -In addition to the MBAM Client wakeup and status reporting frequencies, there is a random delay of up to 90 minutes when the MBAM Client agent service starts on client computers. If you do not want the random delay, create a **DWORD** value of **NoStartupDelay** under **HKLM\\Software\\Microsoft\\MBAM**, set its value to **1**, and then restart **BitLocker Management Client Service**. - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md b/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md deleted file mode 100644 index 9e4092ead8..0000000000 --- a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Getting Started - Using MBAM with Configuration Manager -description: Getting Started - Using MBAM with Configuration Manager -author: msfttracyp -ms.assetid: b0a1d3cc-0b01-4b69-a2cd-fd09fb3beda4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Getting Started - Using MBAM with Configuration Manager - - -When you install Microsoft BitLocker Administration and Monitoring (MBAM), you can choose a topology that integrates MBAM with Configuration Manager 2007 or System Center 2012 Configuration Manager. For a list of the supported versions of Configuration Manager that MBAM supports, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). In the integrated topology, the hardware compliance and reporting features are removed from MBAM and are accessed from Configuration Manager. - -**Important**   -Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007. - - - -## Using MBAM with Configuration Manager - - -The integration of MBAM is based on a new Configuration Pack that installs the following three items into Configuration Manager 2007 or System Center 2012 Configuration Manager, which are described in detail in the following sections: - -Configuration data that consists of configuration items and a configuration baseline - -Collection - -Reports - -### Configuration Data - -The configuration data installs a configuration baseline, called “BitLocker Protection,” which contains two configuration items: “BitLocker Operating System Drive Protection” and “BitLocker Fixed Data Drives Protection.” The configuration baseline is deployed to the collection, which is also created when MBAM is installed. The two configuration items provide the basis for evaluating the compliance status of the client computers. This information is captured, stored, and evaluated in Configuration Manager. The configuration items are based on the compliance requirements for operating system drives (OSDs) and Fixed Data Drives (FDDs). The required details for the deployed computers are collected so that the compliance for those drive types can be evaluated. By default, the configuration baseline evaluates the compliance status every 12 hours and sends the compliance data to Configuration Manager. - -### Collection - -MBAM creates a collection that is called MBAM Supported Computers. The configuration baseline is targeted to client computers that are in this collection. This is a dynamic collection that, by default, runs every 12 hours and evaluates membership. Membership is based on three criteria: - -- It is a supported version of the Windows operating system. Currently, MBAM supports only Windows 7 Enterprise and Windows 7 Ultimate, Windows 8 Enterprise, and Windows To Go, when Windows To Go is running on Windows 8 Enterprise. - -- It is a physical computer. Virtual machines are not supported. - -- Trusted Platform Module (TPM) is available. A compatible version of TPM 1.2 or later is required for Windows 7. Windows 8 and Windows To Go do not require a TPM. - -The collection is evaluated against all computers and creates the subset of compatible computers that provides the basis for compliance evaluation and reporting for the MBAM integration. - -### Reports - -There are four reports that you can use to view compliance. They are: - -- **BitLocker Enterprise Compliance Dashboard** – gives IT administrators three different views of information on a single report: Compliance Status Distribution, Non Compliant – Errors Distribution, and Compliance Status Distribution By Drive Type. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select. - -- **BitLocker Enterprise Compliance Details** – lets IT administrators view information about the BitLocker encryption compliance status of the enterprise and includes the compliance status for each computer. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select. - -- **BitLocker Computer Compliance** – lets IT administrators view an individual computer and determine why it was reported with a given status of compliant or not compliant. The report also displays the encryption state of the operating system drives (OSD) and fixed data drives (FDDs). - -- **BitLocker Enterprise Compliance Summary** – lets IT administrators view the status of the compliance of the enterprise with MBAM policy. Each computer’s state is evaluated, and the report shows a summary of the compliance of all computers in the enterprise against the policy. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select. - -## High-Level Architecture of MBAM with Configuration Manager - - -The following image shows the MBAM architecture with the Configuration Manager topology. This configuration supports up to 200,000 MBAM clients in a production environment. - -![mbam architecture with configuration manager](images/mbam2-cmserver.gif) - -A description of the servers, databases, and features of this architecture follows. The server features and databases in the architecture image are listed under the computer or server where we recommend that you install them. - -- **Database Server** – The **Recovery Database**, **Audit Database**, and **Audit Reports** are installed on a Windows server and supported SQL Server instance. The Recovery database stores recovery data that is collected from MBAM client computers. The Audit Database stores audit activity data that is collected from client computers that have accessed recovery data. The Audit Reports provide data about the compliance status of client computers in your enterprise. - -- **Configuration Manager Primary Site Server** – The Configuration Manager Server contains of the MBAM server installation with the System Center Configuration Manager Integration topology, which must be installed on a Configuration Manager primary site server. The Configuration Manager Server collects the hardware inventory information from client computers and is used to report BitLocker compliance of client computers. When you run the MBAM Setup server installation, a collection and the configuration data are installed on the Configuration Manager Primary Site Server. - -- **Administration and Monitoring Server** - The **Administration and Monitoring Server** is installed on a Windows server and consists of the Administration and Monitoring website and the monitoring web services. The Administration and Monitoring website is used to audit activity and to access recovery data (for example, BitLocker recovery keys). The **Self-Service Portal** is also installed on the Administration and Monitoring Server. The Portal enables end users on client computers to independently log onto a website to get a recovery key if they lose or forget their BitLocker password. The Audit reports are also installed on the Administration and Monitoring Server. - -- **Management Workstation** - The **Policy Template** consists of Group Policy Objects that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation that is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. - -- **MBAM Client** and **Configuration Manager Client** computer - - - The **MBAM Client** performs the following tasks: - - - Uses Group Policy Objects to enforce the BitLocker encryption of client computers in the enterprise. - - - Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - - - Collects recovery information and computer information about the client computers. - - - **Configuration Manager Client** – The Configuration Manager client enables Configuration Manager to collect hardware compatibility data about the client computers, and enables Configuration Manager to report compliance information. - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - - - - - - - - diff --git a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md b/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md deleted file mode 100644 index bfbd547d4b..0000000000 --- a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Getting Started with MBAM 2.0 -description: Getting Started with MBAM 2.0 -author: msfttracyp -ms.assetid: 29f5c9af-5bbf-4d37-aa0f-0716046904af -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 requires thorough planning before you deploy it or use its features. Because this product can affect every computer in your organization, you might disrupt your entire network if you do not plan your deployment carefully. However, if you plan your deployment carefully and manage it so that it meets your business requirements, BitLocker Administration and Monitoring 2.0 can help reduce your administrative overhead and total cost of ownership. - -If you are new to this product, we recommend that you read the documentation carefully. To get the MBAM software, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/p/?LinkId=322049). Before you deploy MBAM to a production environment, we also recommend that you validate your deployment plan in a test environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -This section of the MBAM 2.0 Administrator’s Guide includes high-level information about MBAM 2.0 to provide a basic understanding of the product before you begin to plan deployment. For specific information about deploying MBAM with the Configuration Manager integrated topology, see [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md). You can find additional MBAM documentation on the Microsoft BitLocker Administration and Monitoring (MBAM) Documentation Resources Download Page at . - -## Getting Started with MBAM 2.0 - - -- [About MBAM 2.0](about-mbam-20-mbam-2.md) - - Provides a high-level overview of MBAM 2.0 and describes how it can be used in your organization. - -- [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) - - Provides information about how you can best evaluate MBAM 2.0 for use in your organization. - -- [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md) - - Describes the MBAM 2.0 features and the recommended architecture for a production environment. - -- [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) - - Describes the keyboard shortcuts that are available for MBAM 2.0. - -## Other Resources for this Product - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md b/mdop/mbam-v2/helping-end-users-manage-bitlocker.md deleted file mode 100644 index 72286236c4..0000000000 --- a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Helping End Users Manage BitLocker -description: Helping End Users Manage BitLocker -author: msfttracyp -ms.assetid: 47776fb3-2d94-4970-b687-c35ec3dd6c64 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Helping End Users Manage BitLocker - - -Content on a lost or stolen computer is vulnerable to unauthorized access, which can present a security risk to both people and companies. Microsoft BitLocker Administration and Monitoring (MBAM) uses BitLocker to help prevent unauthorized access by locking your computer to help protect sensitive data from malicious users. - -## What is BitLocker? - - -BitLocker Drive Encryption can provide protection for operating system drives, data drives, and removable drives (such as a USB thumb drive) by encrypting the drives. Depending on how BitLocker is configured, users may have to provide a key (a password or PIN) to unlock the information that is stored on the encrypted drives. - -When you add new files to a drive that is encrypted with BitLocker, BitLocker encrypts them automatically. Files remain encrypted only while they are stored in the encrypted drive. Files that are copied to another drive or computer are decrypted. If you share files with other users, such as through a network, these files are encrypted while stored on the encrypted drive, but they can be accessed normally by authorized users. - -If you encrypt the operating system drive, BitLocker checks the computer during startup for any conditions that could represent a security risk (for example, a change to the BIOS or changes to any startup files). If a potential security risk is detected, BitLocker will lock the operating system drive and require a special BitLocker recovery key to unlock it. Make sure that you create this recovery key when you turn on BitLocker for the first time. Otherwise, you could permanently lose access to your files. - -If you encrypt data drives (fixed or removable), you can unlock an encrypted drive with a password or a smart card, or set the drive to automatically unlock when you log on to the computer. - -In addition to passwords and PINs, BitLocker can use the Trusted Platform Module (TPM) chip that is provided in many newer computers. The TPM chip is used to ensure that your computer has not been tampered with before BitLocker will unlock the operating system drive. During the encryption process, you may have to enable the TPM chip. When you start your computer, BitLocker asks the TPM for the keys to the drive and unlocks it. To enable the TPM chip, you will have to restart your computer and then change a setting in the BIOS, a pre-Windows layer of your computer software. For more information about the TPM, see [About the Computer TPM Chip](about-the-computer-tpm-chip.md). - -Once your computer is protected by BitLocker, you may have to enter a PIN or password every time that the computer wakes from hibernation or starts. The Help Desk for your company or organization can help if you ever forget your PIN or password. - -You can turn off BitLocker, either temporarily, by suspending it, or permanently, by decrypting the drive. - -**Note**   -Because BitLocker encrypts the whole drive and not just the individual files themselves, be careful when you move sensitive data between drives. If you move a file from a BitLocker-protected drive to a nonencrypted drive, the file will no longer be encrypted. - - - -## About the BitLocker Encryption Options Application - - -To unlock hard disk drives on your computer and to manage your PIN and passwords, use the BitLocker Encryption Options application in the Windows Control Panel by following the procedure outlined here. You can enter passwords to unlock protected drives and can check the BitLocker status of attached drives by using this application. - -**To open the BitLocker Encryption Options application** - -1. Click **Start**, and select **Control Panel**. The Control Panel opens in a new window. - -2. In **Control Panel**, select **System and Security**. - -3. Select **BitLocker Encryption Options** to open the BitLocker Encryption Options application. - - For a description of the available options, see the following section. - -## Options on the BitLocker Encryption Options Application - - -The BitLocker Encryption Options application on Control Panel lets you manage your PIN and passwords, which BitLocker uses to protect your computer. - -**BitLocker Drive Encryption – Fixed Disk Drives:** - -In this section, you can view information about hard disk drives connected to your computer and their current BitLocker Encryption status. - -- **Manage your PIN** - changes the PIN used by BitLocker to unlock your operating system drive. - -- **Manage your password** - changes the password that is used by BitLocker to unlock your other internal drives. - -**BitLocker Drive Encryption - External Drives:** - -In this section, you can view information about external drives (such as a USB thumb drive) connected to your computer, and their current BitLocker encryption status. - -- **Manage your password** - changes the password that is used by BitLocker to unlock your other internal drives. - -**Advanced:** - -- **TPM Administration** - opens the TPM Administration tool in a separate window. From here you can configure common TPM tasks and obtain information about the TPM chipset. You must have administrative permissions on your computer to access this tool. - -- **Disk Management** -open the Disk Management tool. From here you can view the information for all hard drives connected to the computer and configure partitions and drive options. You must have administrative rights on your computer to access this tool. - - - - - - - - - diff --git a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md deleted file mode 100644 index 21008d0070..0000000000 --- a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: High Availability for MBAM 2.0 -description: High Availability for MBAM 2.0 -author: msfttracyp -ms.assetid: 244ee013-9e2a-48d2-b842-4e10594fd74f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High Availability for MBAM 2.0 - - -This topic provides basic information about a highly available installation of Microsoft BitLocker Administration and Monitoring (MBAM). High-availability scenarios are not fully supported in this version of MBAM, so they are not described here. It is recommended that you search related blogs and forums, where users describe how they have successfully configured high availability for MBAM in their environments. - -## High Availability Scenarios for MBAM - - -Microsoft BitLocker Administration and Monitoring is designed to be fault-tolerant. If a server becomes unavailable, users should not be negatively affected. For example, if the MBAM agent cannot connect to the MBAM web server, users should not be prompted for action. - -When you plan your MBAM installation, consider the following items, which can affect the availability of the MBAM service: - -- Drive encryption and recovery password – If a recovery password cannot be escrowed, the encryption does not start on the client computer. - -- Compliance status data upload – If the server that hosts the compliance status report service is not available, the compliance data does not remain current. - -- Help Desk recovery key access - If the Help Desk cannot access MBAM database information, the Help Desk cannot provide recovery keys to users. - -- Availability of reports –If the server that hosts the Compliance and Audit Reports is not available, reports will not be available. - -## How the MBAM Backup Uses the Volume Shadow Copy Service (VSS) - - -MBAM 2.0 provides a Volume Shadow Copy Service (VSS) writer, called the Microsoft BitLocker Administration and Management Writer, which facilitates the backup of the Compliance and Audit Database and the Recovery Database. - -The MBAM Server Windows Installer registers the MBAM VSS Writer. Any failure during the VSS writer registration causes the MBAM Server installation to roll back. In a topology where the Compliance and Audit Database and the Recovery Database are installed on different servers, a separate instance of MBAM VSS Writer is registered on each server. The MBAM VSS Writer is dependent on the SQL Server VSS Writer. The SQL Server VSS Writer is registered as part of the Microsoft SQL Server installation. Any backup technology that uses VSS writers to perform backup can discover the MBAM VSS Writer. - -## Related topics - - -[Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md deleted file mode 100644 index 105afce636..0000000000 --- a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: High-Level Architecture for MBAM 2.0 -description: High-Level Architecture for MBAM 2.0 -author: msfttracyp -ms.assetid: 7f73dd3a-0b1f-4af6-a2f0-d0c5bc5d183a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture for MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) is a client/server solution that can help you simplify BitLocker provisioning and deployment, improve compliance and reporting on BitLocker, and reduce support costs. Microsoft BitLocker Administration and Monitoring includes the features that are described in this topic. - -Microsoft BitLocker Administration and Monitoring can be deployed in the Stand-alone topology, or in a topology that is integrated with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager. This topic describes the architecture for the Stand-alone topology. For information about deploying in the integrated Configuration Manager topology, see [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md). - -The following diagram shows the MBAM recommended architecture for a production environment, which consists of two servers and a management workstation. This architecture supports up to 200,000 MBAM clients. The server features and databases in the architecture image are described in the following section and are listed under the computer or server where we recommend that you install them. - -**Note**   -A single-server architecture should be used only in test environments. - - - -![mbam 2 two-server deployment topology](images/mbam2-3-servers.gif) - -## Administration and Monitoring Server - - -The following features are installed on this server: - -- **Administration and Monitoring Server**. The Administration and Monitoring Server feature is installed on a Windows server and consists of the Administration and Monitoring website, which includes the reports and the Help Desk Portal, and the monitoring web services. - -- **Self-Service Portal**. The Self-Service Portal is installed on a Windows server. The Self-Service Portal enables end users on client computers to independently log on to a website, where they can obtain a recovery key to recover a locked BitLocker volume. - -## Database Server - - -The following features are installed on this server: - -- **Recovery Database**. The Recovery Database is installed on a Windows server and a supported instance of Microsoft SQL Server. This database stores recovery data that is collected from MBAM client computers. - -- **Compliance and Audit Database**. The Compliance and Audit Database is installed on a Windows server and a supported instance of SQL Server. This database stores compliance data for MBAM client computers. This data is used primarily for reports that SQL Server Reporting Services (SSRS) hosts. - -- **Compliance and Audit Reports**. The Compliance and Audit Reports are installed on a Windows server and a supported instance of SQL Server that has the SQL Server Reporting Services (SSRS) feature installed. These reports provide MBAM reports that you can access from the Administration and Monitoring website or directly from the SSRS server. - -## Management Workstation - - -The following feature is installed on the Management workstation, which can be a Windows server or a client computer. - -- **Policy Template**. The Policy Template consists of Group Policy settings that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation, which is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. - -## MBAM Client - - -The MBAM Client is installed on a Windows computer and has the following characteristics: - -- Uses Group Policy to enforce the BitLocker drive encryption of client computers in the enterprise. - -- Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - -- Collects compliance data for the computer and passes the data to the reporting system. - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md b/mdop/mbam-v2/how-to-brand-the-self-service-portal.md deleted file mode 100644 index fadf286056..0000000000 --- a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: How to Brand the Self-Service Portal -description: How to Brand the Self-Service Portal -author: msfttracyp -ms.assetid: 3ef9e951-7c42-4f7f-b131-3765d39b3207 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Brand the Self-Service Portal - - -After you install the Microsoft BitLocker Administration and Monitoring (MBAM) Self-Service Portal, you can brand the Self-Service Portal with your company name, Help Desk URL, and “notice” text. You can also change the Session Timeout setting to make the end user’s session expire after a specified period of inactivity. - -**To set the session time-out and branding for the Self-Service Portal** - -1. To set the time-out period for the end user’s session, start the **Internet Information Services Manager**, or run **inetmgr.exe**. - -2. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **ASP.NET** > **Session State**, and change the **Time-out** value under **Cookie Settings** to the number of minutes after which the end user’s Self-Service Portal session will expire. The default is 5. To disable the setting so that there is no time-out, set the value to **0**. - -3. To set the branding items for the Self-Service Portal, start the **Internet Information Services Manager**, or run **inetmgr.exe**. - -4. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -5. From the **Name** column, select the item that you want to change, and change the default value to reflect the name that you want to use. The following table lists the values that you can set. - - **Caution** - Do not change the value in the Name column (CompanyName\*), as it will cause the Self-Service Portal to stop working. - - - -~~~ - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDefault Value

          CompanyName*

          Contoso IT

          HelpdeskText*

          Contact Help Desk or IT Department

          HelpdeskUrl*

          Http://www.microsoft.com

          jQueryPath

          //ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js

          MicrosoftAjaxPath

          //ajax.aspnetcdn.com/ajax/3.5/MicrosoftAjax.js

          MicrosoftMvcAjaxPath

          //ajax.aspnetcdn.com/ajax/mvc/2.0/MicrosoftMvcValidation.js

          NoticeTextPath

          Notice.txt

          -
          -Note -

          You can edit the Notice text either by using the IIS Manager or by opening and changing the Notice.txt file in the installation directory.

          -
          -
          - -
          -~~~ - - - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md b/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md deleted file mode 100644 index 4797ce3bfb..0000000000 --- a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create or Edit the mof Files -description: How to Create or Edit the mof Files -author: msfttracyp -ms.assetid: 4d19d707-b90f-4057-a6e9-e4221a607190 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create or Edit the mof Files - - -Before you install Microsoft BitLocker Administration and Monitoring (MBAM) with Configuration Manager, you need to edit the Configuration.mof file. You also need to either edit or create the Sms\_def.mof file, depending on which version of Configuration Manager you are using. - -## Edit the Configuration.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file for Microsoft System Center Configuration Manager 2007 and System Center 2012 Configuration Manager. - -[Edit the Configuration.mof File](edit-the-configurationmof-file.md) - -## Create or Edit the Sms\_def.mof File - - -To enable the client computers to report BitLocker compliance details in the MBAM Configuration Manager reports, you have to create or edit the Sms\_def.mof file. In Configuration Manager 2007, the file already exists, so you need to edit, but not overwrite, the existing file. If you are using System Center 2012 Configuration Manager, you must create the file. - -[Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file.md) - -## Related topics - - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md deleted file mode 100644 index 10ff64c8e7..0000000000 --- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -title: How to Deploy the MBAM Client as Part of a Windows Deployment -description: How to Deploy the MBAM Client as Part of a Windows Deployment -author: msfttracyp -ms.assetid: 67387de7-8b02-4412-9850-3b8d8e5c18af -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client as Part of a Windows Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. If computers that have a Trusted Platform Module (TPM) chip, the BitLocker client can be integrated into an organization by enabling BitLocker management and encryption on client computers as part of the imaging and Windows deployment process. - -**Note** -To review the Microsoft BitLocker Administration and Monitoring Client system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - - - -Encrypting client computers with BitLocker during the initial imaging stage of a Windows deployment can lower the administrative overhead necessary for implementing MBAM in an organization. It also ensures that every computer that is deployed already has BitLocker running and is configured correctly. - -**Note** -The procedure in this topic describes modifying the Windows registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. - - - -**To encrypt a computer as part of Windows deployment** - -1. If your organization is planning to use the Trusted Platform Module (TPM) protector or the TPM + PIN protector options in BitLocker, you must activate the TPM chip before the initial deployment of MBAM. When you activate the TPM chip, you avoid a reboot later in the process, and you ensure that the TPM chips are correctly configured according to the requirements of your organization. You must activate the TPM chip manually in the BIOS of the computer. - - **Note** - Some vendors provide tools to turn on and activate the TPM chip in the BIOS from within the operating system. Refer to the manufacturer documentation for more details about how to configure the TPM chip. - - - -2. Install the Microsoft BitLocker Administration and Monitoring client agent. - -3. Join the computer to a domain (recommended). - - - If the computer is not joined to the domain, the recovery password is not stored in the MBAM Key Recovery service. By default, MBAM does not allow encryption to occur unless the recovery key can be stored. - - - If a computer starts in recovery mode before the recovery key is stored on the MBAM Server, the computer has to be reimaged. No recovery method is available. - -4. Run the command prompt as an administrator, stop the MBAM service, and then set the service to **manual** or **on demand**, and then start by typing the following commands: - - **net stop mbamagent** - - **sc config mbamagent start= demand** - -5. Set the registry settings for the MBAM agent to ignore Group Policy and run the TPM for **operating system only encryption** by running **Regedit**, and then importing the registry key template from C:\\Program Files\\Microsoft\\MDOP MBAM\\MBAMDeploymentKeyTemplate.reg. - -6. In regedit, go to HKLM\\SOFTWARE\\Microsoft\\MBAM, and configure the settings that are listed in the following table. - - Registry entry - - Configuration settings - - DeploymentTime - - 0 = OFF - - 1 = Use deployment time policy settings (default) - - UseKeyRecoveryService - - 0 = Do not use key escrow ( the next two registry entries are not required in this case) - - 1 = Use key escrow in Key Recovery system (default) - - Recommended: The computer must be able to communicate with the Key Recovery service. Verify that the computer can communicate with the service before you proceed. - - KeyRecoveryOptions - - 0 = Uploads Recovery Key Only - - 1 = Uploads Recovery Key and Key Recovery Package (default) - - KeyRecoveryServiceEndPoint - - Set this value to the URL for the Key Recovery web server, for example, http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - - - -~~~ -**Note** -MBAM policy or registry values can be set here to override previously set values. -~~~ - - - -7. The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator: - - **net start mbamagent** - -8. When the computers restarts, and the BIOS prompts you to accept a TPM change, accept the change. - -9. During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service, and set start to **automatic** by running a command prompt as an administrator and typing the following commands: - - **sc config mbamagent start= auto** - - **net start mbamagent** - -10. Remove the bypass registry values by running Regedit and going to the HKLM\\SOFTWARE\\Microsoft registry entry. To delete the **MBAM** node, right-click the node and click **Delete**. - -## Related topics - - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md deleted file mode 100644 index 85cef41291..0000000000 --- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Deploy the MBAM Client to Desktop or Laptop Computers -description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: msfttracyp -ms.assetid: 56744922-bfdd-48f6-ae01-645ff53b64a8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client to Desktop or Laptop Computers - - -The Microsoft BitLocker Administration and Monitoring (MBAM) client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an electronic software distribution system, such as Active Directory Domain Services or Microsoft System Center Configuration Manager. - -**Note**   -To review the Microsoft BitLocker Administration and Monitoring Client system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - - - -**To deploy the MBAM Client to desktop or laptop computers** - -1. Locate the MBAM client installation files that are provided with the MBAM software. - -2. Use Active Directory Domain Services or an enterprise software deployment tool like Microsoft System Center Configuration Manager to deploy the Windows Installer package to target computers. - -3. Configure the distribution settings or Group Policy to run the MBAM Client installation file. After successful installation, the MBAM Client applies the Group Policy settings that are received from a domain controller to begin BitLocker encryption and management functions. For more information about MBAM group policy settings, see [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md). - - **Important**   - The MBAM Client will not start BitLocker encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed before BitLocker encryption will begin. - - - -## Related topics - - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md b/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md deleted file mode 100644 index 5d87de60b6..0000000000 --- a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Determine BitLocker Encryption State of Lost Computers -description: How to Determine BitLocker Encryption State of Lost Computers -author: msfttracyp -ms.assetid: dbd23b64-dff3-4913-9acd-affe67b9462e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine BitLocker Encryption State of Lost Computers - - -You can use Microsoft BitLocker Administration and Monitoring (MBAM) to determine the last known BitLocker encryption status of computers that were lost or stolen. The following procedure explains how to determine whether the volumes on a computer are encrypted if there is a loss or theft. - -**To determine the last known BitLocker encryption state of lost computers** - -1. Open a web browser and navigate to the Administration and Monitoring website. - - **Note**   - Note: The default address for the Administration and Monitoring website is http://*<computername>*. Using the fully qualified server name will yield faster browsing results. - - - -2. Selects the **Report** node from the navigation pane, and select the **Computer Compliance Report**. - -3. Use the filter fields in the right pane to narrow the search results, and then click **Search**. Results are shown below your search query. - -4. Take the appropriate action, as determined by your policy for lost devices. - - **Note**   - Device compliance is determined by the BitLocker policies that your enterprise has deployed. You may want to verify your deployed policies before you try to determine the BitLocker encryption state of a device. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md b/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md deleted file mode 100644 index 183ffd7a51..0000000000 --- a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Edit MBAM 2.0 GPO Settings -description: How to Edit MBAM 2.0 GPO Settings -author: msfttracyp -ms.assetid: f5ffa93d-b4d2-4317-8a1c-7d2be0264fe3 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit MBAM 2.0 GPO Settings - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you first have to determine the Group Policies that you will use in your implementation of Microsoft BitLocker Administration and Monitoring. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for more information on the different policies that are available. After you have determined the policies that you are going to use, you then must modify one or more Group Policy Objects (GPO) that include the policy settings for MBAM. - -You can use the following steps to configure the basic, recommended GPO settings to enable MBAM to manage BitLocker encryption for your organization’s client computers. - -**To Edit MBAM Client GPO Settings** - -1. On a computer that has MBAM Group Policy template installed, make sure that MBAM services are enabled. - -2. Using the Group Policy Management Console (GPMC.msc) or the Advanced Group Policy Management (AGPM) MDOP product on a computer with the MBAM Group Policy template installed, select **Computer configuration**, choose **Policies**, click **Administrative Templates**, select **Windows Components**, and then click **MDOP MBAM (BitLocker Management)**. - -3. Edit the Group Policy Object settings that are required to enable MBAM Client services on client computers. For each policy in the table that follows, select **Policy Group**, click the **Policy**, and then configure the **Setting**: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy GroupPolicySetting

          Client Management

          Configure MBAM Services

          Enabled. Set MBAM Recovery and Hardware service endpoint and Select BitLocker recovery information to store. Set MBAM compliance service endpoint and Enter status report frequency in (minutes).

          Operating System Drive

          Operating system drive encryption settings

          Enabled. Set Select protector for operating system drive. Required to save operating system drive data to the MBAMKey Recovery server.

          Removable Drive

          Control Use of BitLocker on removable drives

          Enabled. Required if MBAM will save removable drive data to the MBAM Key Recovery server.

          Fixed Drive

          Control Use of BitLocker on fixed drives

          Enabled. Required if MBAM will save fixed drive data to the MBAM Key Recovery server.

          -

          Set Choose how BitLocker-protected drives can be recovered and Allow data recovery agent.

          - - - -~~~ -**Important** -Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for Group Policy configuration details for all of the available MBAM GPO policy options. -~~~ - - - -## Related topics - - -[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md b/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md deleted file mode 100644 index 8f124cd31e..0000000000 --- a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: How to Generate MBAM Reports -description: How to Generate MBAM Reports -author: msfttracyp -ms.assetid: 083550cb-8c3f-49b3-a30e-97d85374d2f4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Generate MBAM Reports - - -When you install Microsoft BitLocker Administration and Monitoring (MBAM) with the Stand-alone topology, you can generate different reports to monitor BitLocker encryption usage and compliance. The procedures in this topic describe how to open the Administration and Monitoring website and the steps that are needed to generate Microsoft BitLocker Administration and Monitoring reports on enterprise compliance, individual computers, and key recovery activity. For detailed information to help understand MBAM reports, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md). - -**Note**   -To run the reports, you must be a member of the **Report Users Role** on the computers where the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed. - - - -**To open the Administration and Monitoring website** - -1. Open a web browser and navigate to the Administration and Monitoring website. The default URL for the Administration and Monitoring website is *http://<computername>*. - - **Note**   - If the Administration and Monitoring website was installed on a port other than 80, you have to specify the port in the URL (for example, *http://<computername>:<port>*. If you specified a host name for the Administration and Monitoring website during the installation, the URL is *http://<hostname>*. - - - -2. In the left pane, click **Reports** and then select the report you want to run from the top menu bar. - - Historical MBAM client data is retained in the compliance database for historical reference in case a computer is lost or stolen. When running enterprise reports, we recommend that you use appropriate start and end dates to scope the time frames for the reports from one to two weeks to increase reporting data accuracy. - - **Note**   - If SSRS was not configured to use Secure Socket Layer, the URL for the reports will be set to HTTP instead of to HTTPS when you install the MBAM Server. If you then go to the Help Desk portal and select a report, the following message displays: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. - - - -**To generate an Enterprise Compliance Report** - -1. From the Administration and Monitoring website, select the **Reports** node from the left navigation pane, select **Enterprise Compliance Report**, and select the filters that you want to use. The available filters for the Enterprise Compliance Report are the following: - - - **Compliance Status**. Use this filter to specify the compliance status types (for example, Compliant, or Noncompliant) of the report. - - - **Error State**. Use this filter to specify the error state types (for example, No Error, or Error) of the report. - -2. Click **View Report** to display the selected report. - - Results can be saved in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - - **Note**   - The Enterprise Compliance report is generated by a SQL job that runs every six hours. Therefore, the first time you view the report, you may find that some data is missing. You can generate updated report data manually by using SQL Management Studio. From the **Object Explorer** window, expand **SQL Server Agent**, expand **Jobs**, right-click the **CreateCache** job, and select **Start Job at Step….** - - - -3. Select a computer name to view information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - -**To generate the Computer Compliance Report** - -1. In the Administration and Monitoring website, select the **Report** node from the left navigation pane, and then select the **Computer Compliance Report**. Use the Computer Compliance report to search for **user name** or **computer name**. - -2. Click **View Report** to view the computer report. - - Results can be saved in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - -3. Select a computer name to display more information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - - **Note**   - An MBAM client computer is considered compliant if the computer matches the requirements of the MBAM policy settings. - - - -**To generate the Recovery Key Audit Report** - -1. From the Administration and Monitoring website, select the **Report** node in the left navigation pane, and then select the **Recovery Audit Report**. Select the filters for your Recovery Key Audit report. The available filters for Recovery Key audits are as follows: - - - **Requestor**. This filter enables users to specify the user name of the requester. The requester is the person in the Help Desk who accessed the key on behalf of a user. - - - **Requestee**. This filter enables users to specify the user name of the requestee. The requestee is the person who called the Help Desk to obtain a recovery key. - - - **Request Result**. This filter enables users to specify the request result types (for example, Success or Failed) that they want to base the report on. For example, users may want to view failed key access attempts. - - - **Key Type**. This filter enables users to specify the Key Type (for example: Recovery Key Password or TPM Password Hash) that they want to base the report on. - - - **Start Date**. This filter is used to define the Start Date part of the date range that the user wants to report on. - - - **End Date**. This filter is used to define the End Date part of the date range that the users want to report on. - -2. Click **View Report** to view the report. - - Results can be saved in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md deleted file mode 100644 index 0371722265..0000000000 --- a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Hide Default BitLocker Encryption in the Windows Control Panel -description: How to Hide Default BitLocker Encryption in the Windows Control Panel -author: msfttracyp -ms.assetid: 6674aa51-2b5d-4e4a-8b43-2cc18d008285 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Hide Default BitLocker Encryption in the Windows Control Panel - - -Microsoft BitLocker Administration and Monitoring (MBAM) offers a customized control panel for Microsoft BitLocker Administration and Monitoring client computers, called BitLocker Encryption Options. This customized control panel can replace the default Windows BitLocker control panel, which is called BitLocker Drive Encryption. The customized control panel, which is in Control Panel under System and Security, enables users to manage their PIN and passwords and to unlock drives, and hides the interface that enables administrators to decrypt a drive or to suspend or resume BitLocker drive encryption. - -**To hide default BitLocker drive encryption in Windows Control Panel** - -1. In the Group Policy Management Console (GPMC), the Advanced Group Policy Management (AGPM), or the Local Group Policy Editor on the BitLocker Group Policies computer, browse to **User configuration**. - -2. Next, click **Policies**, select **Administrative Templates**, and then click **Control Panel**. - -3. Double-click **Hide specified Control Panel items** in the **Details** pane, and then select **Enabled**. - -4. Click **Show**, click **Add**, and then type **Microsoft.BitLockerDriveEncryption**. This policy hides the default Windows BitLocker Management tool from the Windows Control Panel and, in Control Panel, lets the user open the updated MBAM BitLocker Encryption Options tool under System and Security. - -## Related topics - - -[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md deleted file mode 100644 index a9475663df..0000000000 --- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md +++ /dev/null @@ -1,206 +0,0 @@ ---- -title: How to Install and Configure MBAM on a Single Server -description: How to Install and Configure MBAM on a Single Server -author: msfttracyp -ms.assetid: 45e6a012-6c8c-4d90-902c-d09de9a0cbea -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure MBAM on a Single Server - - -The procedures in this topic describe how to install Microsoft BitLocker Administration and Monitoring (MBAM) in the Stand-alone topology on a single server. Use the single-server configuration only in a test environment. For production environments, use two or more servers. If you are installing Microsoft BitLocker Administration and Monitoring by using the Configuration Manager topology, see [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md). - -The following diagram shows an example of a single-server architecture. For a description of the databases and features, see [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md). - -![mbam 2 single server deployment topology](images/mbam2-1-server.gif) - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). In addition, some features also have information that must be provided during the installation process to successfully deploy the feature. You should also review [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) before you start MBAM deployment. - -**Note** -To obtain the setup log files, you have use the Msiexec package and the **/L** <location> option to install MBAM. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder on the server of the user who is installing MBAM. - - - -## To install MBAM Server features on a single server - - -The following steps describe how to install general MBAM features. - -**To start the MBAM Server features installation** - -1. On the server where you want to install MBAM, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** topology, and then click **Next**. - -5. On the **Select features to install** page, select the features that you want to install. By default, all MBAM features are selected for installation. Features that are to be installed on the same computer must be installed together at the same time. Clear the check boxes for any features that you want to install elsewhere. You must install MBAM features in the following order: - - - Recovery Database - - - Compliance and Audit Database - - - Compliance and Audit Reports - - - Self-Service Server - - - Administration and Monitoring Server - - - MBAM Group Policy template - - **Note** - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -6. On the **Configure network communication security** page, choose whether to encrypt the communication between the Web Services on the Administration and Monitoring Server and the clients. If you decide to encrypt the communication, select the certification authority-provisioned certificate to use for encryption. The certificate must be created prior to this step to enable you to select it on this page. - - **Note** - This page appears only if you selected the Self-Service Portal or the Administration and Monitoring Server feature on the **Select features to install** page. - - - -7. Click **Next**, and then continue to the next set of steps to configure the MBAM Server features. - -**To configure the MBAM Server features** - -1. On the **Configure the Recovery database** page, specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify both where the database files will be located and where the log information will be located. - -2. Click **Next** to continue. - -3. On the **Configure the Compliance and Audit database** page, specify the SQL Server instance name and the name of the database that will store the compliance and audit data. You must also specify where the database files will be located and where the log information will be located. - -4. Click **Next** to continue. - -5. On the **Configure the Compliance and Audit Reports** page, specify the SQL Server Reporting Services instance where the Compliance and Audit reports will be installed, and provide a domain user account and password for accessing the Compliance and Audit database. Configure the password for this account to never expire. The user account should be able to access all data available to the MBAM Reports Users group. - -6. Click **Next** to continue. - -7. On the **Configure the Self-Service Portal** page, enter the port number, host name, virtual directory name, and installation path for the Self-Service Portal. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -8. Click **Next** to continue. - -9. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. This does not turn on Automatic Updates in Windows. - -10. On the **Configure the Administration and Monitoring Server** page, enter the port number, host name, virtual directory name, and installation path for the Help Desk website. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -11. On the **Installation Summary** page, review the list of features that will be installed, and click **Install** to start installing the MBAM features. Click **Back** to move back through the wizard if you have to review or change your installation settings, or click **Cancel** to exit Setup. Setup installs the MBAM features and notifies you that the installation is complete. - -12. Click **Finish** to exit the wizard. After the Microsoft BitLocker Administration and Monitoring Server features have been installed, continue to the next section and complete the steps have to add users to the Microsoft BitLocker Administration and Monitoring roles. For more information about roles, see [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md). - -**To perform post-installation configuration** - -1. On the Administration and Monitoring Server, add users to the following local groups to give them access to the MBAM Help Desk website features: - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. For Advanced Helpdesk Users, only the **Key ID** field is required in Drive Recovery. In Manage TPM, only the **Computer Domain** field and **Computer Name** field are required. - -2. On the Administration and Monitoring Server, add users to the following local group to enable them to access the Reports feature on the MBAM Administration and Monitoring website: - - - **MBAM Report Users**: Members of this local group can access the Reports features on the MBAM Administration and Monitoring website. - - - Brand the Self-Service Portal with your company name, notice text, and other company-specific information. For instructions, see [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md). - - **Note** - Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed. The recommended way to do this is to create a domain security group and add that domain group to each local MBAM Report Users group. When you use this process, manage the group memberships by way of the domain group. - - - -## Validating the MBAM Server feature installation - - -When the Microsoft BitLocker Administration and Monitoring installation is completed, validate that the installation has successfully set up all the necessary MBAM features that are required for BitLocker management. Use the following procedure to confirm that the MBAM service is functional. - -**To validate the MBAM Server feature installation** - -1. On each server where a MBAM feature is deployed, open **Control Panel**. Select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the installation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery Database is installed, open SQL Server Management Studio, and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio, and verify that the **MBAM Compliance Status Database** is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance is at http://<NameofMBAMReportsServer>/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that are specified during setup. - - Confirm that a Reports folder named Microsoft BitLocker Administration and Monitoring contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following: http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -~~~ -**Note** -If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. -~~~ - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager.** - -6. In **Connections,** browse to *<computername>*, select **Sites**, and then select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMUserSupportService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -7. On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully: - - - *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports - - - *http://<hostname>/SelfService>/* - - - *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - - - *http://<hostname>/MBAMUserSupportService/UserSupportService.svc* - - - *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - - - *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - - **Note** - It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.asp*x or*http://<hostname>:<port>/<virtualdirectory>/default.aspx* - - If the server features were installed with network encryption, change http:// to https://. - - - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md deleted file mode 100644 index 4a108246e2..0000000000 --- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md +++ /dev/null @@ -1,345 +0,0 @@ ---- -title: How to Install and Configure MBAM on Distributed Servers -description: How to Install and Configure MBAM on Distributed Servers -author: msfttracyp -ms.assetid: 67b91e6b-ae2e-4e47-9ef2-6819aba95976 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install and Configure MBAM on Distributed Servers - - -The procedures in this topic describe how to install Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 in the Stand-alone topology on distributed servers. To see a diagram of the recommended architecture, along with a description of the databases and features, see [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md). To install Microsoft BitLocker Administration and Monitoring with the Configuration Manager topology, see [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md). - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). In addition, some features require that you provide certain information during the installation process to successfully deploy the feature. You should also review [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) before you start the MBAM deployment. - -**Note** -To obtain the setup log files, you have to use the Msiexec package and the **/L** <location> option to install MBAM. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder on the server of the user who is installing MBAM. - - - -## Deploying MBAM Server Features - - -The following steps describe how to install general MBAM features. - -**To start the MBAM Server installation wizard** - -1. On the server where you want to install Microsoft BitLocker Administration and Monitoring, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** topology, and then click **Next**. - - **Note** - If you want to install MBAM with the Configuration Manager integrated topology, see [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md). - - - -5. Select the features that you want to install. By default, all MBAM features are selected for installation. Clear the features that you want to install elsewhere. Features that will be installed on the same computer must be installed together at the same time. You must install MBAM features in the following order: - - - Recovery Database - - - Compliance and Audit Database - - - Compliance and Audit Reports - - - Self-Service Portal - - - Administration and Monitoring Server - - - MBAM Group Policy template - - **Note** - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -~~~ -The MBAM Setup wizard displays installation pages for the features that you select. The following sections describe the installation procedures for each feature. - -**Note** -For the following instructions, it is assumed that each feature is to be installed on a separate server. If you install multiple features on a single server, you can change or eliminate some steps. -~~~ - - - -**To install the Recovery Database** - -1. On the **Configure the Recovery database** page, specify the names of the computers that will be running the Administration and Monitoring Server feature. After the Administration and Monitoring Server feature is deployed, it uses its domain account to connect to the database. - -2. Click **Next** to continue. - -3. Specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify both where the database will be located and where the log information will be located. - -4. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Compliance and Audit Database** - -1. On the **Configure the Compliance and Audit Database** page, specify the user account that will be used to access the database for reports. - -2. Specify the computer names of the computers that will be running the Administration and Monitoring Server and the Compliance and Audit Reports. After the Administration and Monitoring and the Compliance and Audit Reports Server are deployed, they use their domain accounts to connect to the databases. - - **Note** - If you are installing the Compliance and Audit Database without the Compliance and Audit Reports feature, you must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433. - - - -3. Specify the SQL Server instance name and the name of the database that will store the compliance and audit data. You must also specify where the database and log information will be located. - -4. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -**To install the Compliance and Audit Reports** - -1. On the **Configure the Compliance and Audit Reports** page, specify the remote SQL Server instance name (for example, <ServerName>) where the Compliance and Audit Database was installed. - - **Note** - If you are installing the Compliance and Audit Reports without the Administration and Monitoring Server, you must add an exception on the Compliance and Audit Report computer to enable inbound traffic on the Reporting Server port (the default port is 80). - - - -2. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you install the Compliance and Audit Database. - -3. Click **Next** to continue. - -4. Select the instance of SQL Server Reporting Services where the Compliance and Audit Reports will be installed. Provide a domain user account and password to access the Compliance and Audit Database. Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group. - -5. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -**To install the Self-Service Portal** - -1. On the **Configure the Self-Service Portal** page, you can optionally encrypt the communication between the Self-Service Portal and the Administration and Monitoring servers. If you choose the option to encrypt the communication, you are prompted to select the certification authority-provisioned certificate to use for encryption. - -2. Click **Next** to continue. - -3. Specify the remote instance of SQL Server (for example, *<ServerName>*) where the Compliance and Audit Database was installed. - -4. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status. However, you can change the name when you install the Compliance and Audit Database. - -5. Click **Next** to continue. - -6. Specify the remote instance of SQL Server (for example, *<ServerName>*) where the Recovery Database was installed. - -7. Specify the name of the Recovery Database. By default, the database name is **MBAM Recovery and Hardware**. However, you can change the name when you install the Recovery Database feature. - -8. Click **Next** to continue. - -9. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring Server. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -10. To optionally register a Service Principal Name (SPN) for the Self-Service Portal, select **Register this machine’s Service Principal Names (SPN) with Active Directory (Required for Windows Authentication)**. If you select this check box, MBAM Setup will not try to register the existing SPNs, and you can manually register the SPN before or after the MBAM installation. For instructions on registering the SPN manually, see [Manual SPN Registration](https://go.microsoft.com/fwlink/?LinkId=286758). - -11. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -12. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. - -13. When the selected MBAM feature information is completed, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to start the installation. Click **Cancel** to exit the wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished. - -14. Click **Finish** to exit the wizard. - - **Note** - To configure the Self-Service Portal after you installed it, brand the Self-Service Portal with your company name and other company-specific information, see [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md) for instructions. - - - -15. If the client computers have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, you are finished with the Self-Service Portal installation. If the client computers does not have access to the Microsoft CDN, complete the steps in the next section to configure the Self-Service Portal to reference the JavaScript files from an accessible source. - -**To configure the Self-Service Portal when end users cannot access the Microsoft Content Delivery Network** - -1. If the client computers have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, the Self-Service Portal installation is completed. If the client computers do not have access to the Microsoft CDN, complete the remaining steps in this section to configure the Self-Service Portal to reference the JavaScript files from an accessible source. - -2. Download the four JavaScript files from the Microsoft CDN: - - - jQuery-1.7.2.min.js - [https://go.microsoft.com/p/fwlink/?LinkID=271736](https://go.microsoft.com/fwlink/p/?LinkID=271736) - - - MicrosoftAjax.js –[https://go.microsoft.com/p/fwlink/?LinkId=272283](https://go.microsoft.com/fwlink/p/?LinkId=272283) - - - MicrosoftMvcAjax.js - [https://go.microsoft.com/p/fwlink/?LinkId=272284](https://go.microsoft.com/fwlink/p/?LinkId=272284) - - - MicrosoftMvcValidation.js - - -3. Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in <MBAM Self-Service Install Directory>\\Self Service Website\\Scripts. - -4. Open **Internet Information Services (IIS) Manager**. - -5. Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**. - - **Note** - *SelfService* is the default virtual directory name. If you chose a different name for this directory during installation, remember to replace *SelfService* in the rest of these instructions with the name you chose. - - - -6. In the middle pane, double-click **Application Settings**. - -7. For each item in the following list, edit the application settings to reference the new location by replacing <virtual directory> with /SelfService/ (or the name you chose during installation). For example, the virtual directory path will be similar to /selfservice/scripts/jquery-1.7.2.min.js. - - - jQueryPath: /<virtual directory>/Scripts/ jQuery-1.7.2.min.js - - - MicrosoftAjaxPath: /<virtual directory>/Scripts/ MicrosoftAjax.js - - - MicrosoftMvcAjaxPath: /<virtual directory>/Scripts/ MicrosoftMvcAjax.js - - - MicrosoftMvcValidationPath: /<virtual directory>/Scripts/ MicrosoftMvcValidation.js - -**To install the Administration and Monitoring Server feature** - -1. MBAM can encrypt the communication between the Web Services and the Administration and Monitoring servers. If you choose the option to encrypt the communication, you are prompted to select the certification authority-provisioned certificate to use for encryption. - -2. Click **Next** to continue. - -3. Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Compliance and Audit Database was installed. - -4. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status. However, you can change the name when you install the Compliance and Audit Database. - -5. Click **Next** to continue. - -6. Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Recovery Database was installed. - -7. Specify the name of the Recovery Database. By default, the database name is **MBAM Recovery and Hardware**. However, you can change the name when you install the Recovery Database feature. - -8. Click **Next** to continue. - -9. Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at: - - http://<NameofMBAMReportsServer>/ReportServer - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL resembles the following: http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>*. - - - -10. Click **Next** to continue. - -11. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring Server. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -12. To optionally register a Service Principal Name (SPN) for the Self-Service Portal, select **Register this machine’s Service Principal Names (SPN) with Active Directory (Required for Windows Authentication)**. If you select this check box, MBAM Setup will not try to register the existing SPNs, and you can manually register the SPN before or after the MBAM installation. For instructions on registering the SPN manually, see [Manual SPN Registration](https://go.microsoft.com/fwlink/?LinkId=286758). - -13. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -14. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. - -15. When the selected MBAM feature information is completed, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to being the installation. Click **Cancel** to exit the wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished. - -16. Click **Finish** to exit the wizard. - -**To perform post-installation configuration** - -1. On the Administration and Monitoring Server, add users to the following local groups to give them access to the features on the MBAM Administration and Monitoring website. - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. For Advanced Helpdesk Users, only the Key ID field is required in Drive Recovery. In **Manage TPM**, only the **Computer Domain** field and **Computer Name** field are required. - -2. On the server that hosts Administration and Monitoring Server and the Compliance and Audit Database and on the server that hosts the Compliance and Audit Reports, add users to the following local group to give them access to the Reports feature on the MBAM Administration and Monitoring website. - - - **MBAM Report Users**: Members of this local group can access the reports on the MBAM Administration and Monitoring website. - - **Note** - Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and the Compliance and Audit Reports are installed. - - - -## Validating the MBAM Server Feature Installation - - -When Microsoft BitLocker Administration and Monitoring Server feature installation is completed, we recommend that you validate that the installation has successfully set up all the necessary features for MBAM. Use the following procedure to confirm that the Microsoft BitLocker Administration and Monitoring service is functional. - -**To validate an MBAM Server installation** - -1. On each server where an MBAM feature is deployed, open **Control Panel**, select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the MBAM installation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status Database** is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance can be found is at http://<NameofMBAMReportsServer>/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that were specified during setup. - - Confirm that a reports folder named **Microsoft BitLocker Administration and Monitoring** contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -~~~ -**Note** -If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. -~~~ - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**. - -6. In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -7. On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully. - - **Note** - The URLs ending in “.svc” do not display a website. Success is indicated by the message “Metadata publishing for this service is currently disabled” or by information resembling code. If you see some other error message or if the page cannot be found, the page has not loaded successfully. - - - -~~~ -- *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports - -- *http://<hostname>/SelfService>/* - -- *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - -- *http://<hostname>/MBAMUserSupportService/UserSupportService.svc* - -- *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - -- *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - -**Note** -It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.aspx* or*http://<hostname>:<port>/<virtualdirectory>/default.aspx* - -If the server features were installed with network encryption, change http:// to https://. -~~~ - - - -8. Verify that each webpage loads successfully. - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md b/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md deleted file mode 100644 index 6ada7f3b2f..0000000000 --- a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: How to Install MBAM with Configuration Manager -description: How to Install MBAM with Configuration Manager -author: msfttracyp -ms.assetid: fd0832e4-3b79-4e56-9550-d2f396be6d09 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MBAM with Configuration Manager - - -This section describes the steps to install MBAM with Configuration Manager by using the recommended configuration, which is illustrated in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md). The steps are divided into the following tasks: - -- Install and configure MBAM on the Configuration Manager Server - -- Install the Recovery and Audit Databases on the Database Server - -- Install the Administration and Monitoring Server features on the Administration and Monitoring Server - -Before you begin the installation, ensure that you have edited or created the necessary mof files. For instructions, see [How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md). - -**Important**   -If you are using a non-default SQL Server Reporting Services (SSRS) instance, you must start the MBAM Setup by using the following command line to specify the SSRS named instance: - -`MbamSetup.exe CM_SSRS_INSTANCE_NAME=` - - - -**To install MBAM on the Configuration Manager Server** - -1. On the Configuration Manager Server, run **MBAMSetup.exe** to start the MBAM installation wizard. - - **Note**   - To obtain the setup log files, you have to use the Msiexec package and the **/L** <location> option to install Configuration Manager. Log files are created in the location that you specify. - - Additional setup log files are created in the %temp% folder on the computer of the user who is installing Configuration Manager. - - - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select **System Center Configuration Manager Integration**, and then click **Next**. - -5. On the **Select features to install** page, select **System Center Configuration Manager Integration**. - - **Note**   - On the **Checking Prerequisites** page, click **Next** after the installation wizard checks the prerequisites for your installation and confirms that none are missing. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again.** - - - -6. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. Using Microsoft Updates does not turn on Automatic Updates in Windows. - -7. Click **Next** to continue. - -8. On the **Installation Summary** page, review the list of features that will be installed, and click **Install** to start installing the MBAM features. Click **Back** to move back through the wizard if you have to review or change your installation settings, or click **Cancel** to exit Setup. Setup installs the MBAM features and notifies you that the installation is completed. - -9. Click **Finish** to exit the wizard. - -**To install the Recovery and Audit Databases on the Database Server** - -1. On the Database Server, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. From the list of features to install, select **Recovery Database** and **Audit Database**, and clear the remaining features. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -6. On the **Configure the Recovery Database** page, specify the names of the computers that will be running the Administration and Monitoring Server feature. After the Administration and Monitoring Server feature is deployed, it uses its domain account to connect to the database. - -7. Click **Next** to continue. - -8. Specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify both where the database will be located and where the log information will be located. - -9. Click **Next** to continue with the MBAM Setup installation wizard. - -10. On the **Configure the Audit Database** page, specify the user account that will be used to access the database for reports. - -11. Specify the computer names of the computers that will be running the Administration and Monitoring Server and the Audit Reports. After the Administration and Monitoring and the Audit Reports features are deployed, their domain accounts will be used to connect to the databases. - - **Note**   - If you are installing the Audit Database without the Audit Reports feature, you must add an exception on the Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433. - - - -12. Specify the SQL Server instance name and the name of the database that will store the audit data. You must also specify where the database and log information will be located. - -13. Click **Install** to start the installation, and then click **Finish** to complete the installation. - -**To install the Administration and Monitoring Server features on the Administration and Monitoring Server** - -1. On the Administration and Monitoring Server, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. From the list of features to install, select **Administration and Monitoring Server** and **Self-Service Portal**, and clear the remaining features. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -6. Install the Self-Service Portal by following the steps in the **To install the Self-Service Portal** section in [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md). - - **Note**   - If the client computers will not have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, complete the steps in the **To configure the Self-Service Portal when end users cannot access the Microsoft Content Delivery Network** section [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md) to configure the Self-Service Portal to reference the JavaScript files from an accessible source. - - - -7. Install the Administration and Monitoring Server features by following the steps in the **To install the Administration and Monitoring Server feature** section in [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md). - -8. Click **Finish** to complete the installation. - -## Related topics - - -[How to Validate the MBAM Installation with Configuration Manager](how-to-validate-the-mbam-installation-with-configuration-manager.md) - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md deleted file mode 100644 index d69f082425..0000000000 --- a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Install the MBAM 2.0 Group Policy Template -description: How to Install the MBAM 2.0 Group Policy Template -author: msfttracyp -ms.assetid: bc193232-d060-4285-842e-d194a74dd3c9 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM 2.0 Group Policy Template - - -In addition to the server-related Microsoft BitLocker Administration and Monitoring (MBAM) features, the server setup application includes an Microsoft BitLocker Administration and Monitoring Group Policy template. This template can be installed on any computer capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -The following steps describe how to install the MBAM Group Policy template. - -**Note**   -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To install the MBAM Group Policy template** - -1. On the server where you want to install MBAM, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -4. By default, all Microsoft BitLocker Administration and Monitoring features are selected for installation. Clear all feature options except for **Policy Template**, and then click **Next** to continue the installation. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. Once all prerequisites are met, the installation will resume. - - - -5. For specific steps about how and where to install the templates, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx). - -6. After the Microsoft BitLocker Administration and Monitoring Setup wizard displays installation pages for the selected features, click **Finish** to close MBAM Setup. - -## Related topics - - -[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md deleted file mode 100644 index 8b70578b3a..0000000000 --- a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Manage MBAM Administrator Roles -description: How to Manage MBAM Administrator Roles -author: msfttracyp -ms.assetid: 813ac0c4-3cf9-47af-b4cb-9395fd915e5c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Administrator Roles - - -After Microsoft BitLocker Administration and Monitoring (MBAM) Setup is complete for all server features, administrative users will have to be granted access to them. As a best practice, administrators who will manage or use Microsoft BitLocker Administration and Monitoring Server features should be assigned to Domain Services security groups, and then those groups should be added to the appropriate MBAM administrative local group. - -**To manage MBAM Administrator Role memberships** - -1. Assign administrative users to security groups in Active Directory Domain Services. - -2. Add Active Directory security groups to the roles for MBAM administrative local groups on the MBAM server for the respective features. - - - **MBAM System Administrators** have access to all MBAM features in the MBAM Administration and Monitoring website. - - - **MBAM Helpdesk Users** have access to the Manage TPM and Drive Recovery options in the MBAM Administration and Monitoring website, but must fill in all fields when they use either option. - - - **MBAM Report Users** have access to the Compliance and Audit reports in the MBAM Administration and Monitoring website. - - - **MBAM Advanced Helpdesk Users** have access to the Manage TPM and Drive Recovery options in the MBAM Administration and Monitoring website, but are not required to fill in all fields when they use either option. - - For more information about roles for Microsoft BitLocker Administration and Monitoring, see [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md). - -## Related topics - - -[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md deleted file mode 100644 index 93609c42c5..0000000000 --- a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -author: msfttracyp -ms.assetid: e2ff153e-5770-4a12-b79d-cda998b8a8ab -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel - - -A Microsoft BitLocker Administration and Monitoring (MBAM) control panel application, called BitLocker Encryption Options, will be available under **System and Security** when the Microsoft BitLocker Administration and Monitoring Client is installed. This custom MBAM control panel is an additional control panel. It does not replace the default Windows BitLocker control panel. The MBAM control panel can be used to unlock encrypted fixed and removable drives, and also manage your PIN or password. For more information about enabling the MBAM control panel, see [How to Hide Default BitLocker Encryption in the Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md). - -**To use the MBAM Client Control Panel** - -1. To open BitLocker Encryption Options, click **Start** and then select **Control Panel**. When **Control Panel** opens, select **System and Security**. - -2. Double-click **BitLocker Encryption Options** to open the customized MBAM control panel. You will see a list of all the hard disk drives on the computer and their encryption status, in addition to an option to manage your PIN or passwords. - - The list of hard disk drives on the computer can be used to verify encryption status, unlock a drive, or request an exemption for BitLocker protection if the User and Computer Exemption policies have been deployed. - - The BitLocker Encryption Options control panel also allows for non-administrator users to manage their PIN or passwords. By selecting **Manage PIN**, users are prompted to enter both a current PIN and a new PIN (in addition to confirming the new PIN). Selecting **Update PIN** will reset the PIN to the new one that the users selected. - - To manage your password, select **Unlock drive** and enter your current password. As soon as the drive is unlocked, select **Reset Password** to change your current password. - -## Related topics - - -[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md b/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md deleted file mode 100644 index 94028e58e1..0000000000 --- a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Manage User BitLocker Encryption Exemptions -description: How to Manage User BitLocker Encryption Exemptions -author: msfttracyp -ms.assetid: 1bfd9d66-6a9a-4d0e-b54a-e5a6627f5ada -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage User BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) can be used to manage BitLocker protection by exempting users if there are users who do not need or want their drives encrypted. - -To exempt users from BitLocker protection, an organization will have to create an infrastructure to support exempted users, such as giving the user a contact telephone number, webpage, or mailing address to use to request an exemption. Also, an exempt user will have to be added to a security group for a Group Policy Object that was created specifically for exempted users. When members of this security group log on to a computer, the user’s Group Policy setting shows that the user is exempted from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption. - -**Note**   -If the computer is already BitLocker-protected, the user exemption policy has no effect. - - - -The following table shows how BitLocker protection is applied based on how exemptions are set. - - ----- - - - - - - - - - - - - - - - - - - - -
          User StatusComputer Not ExemptComputer Exempt

          User not exempt

          BitLocker protection is enforced on computer

          BitLocker protection is not enforced on computer

          User exempt

          BitLocker protection is not enforced on computer

          BitLocker protection is not enforced on computer

          - - - -**To exempt a user from BitLocker encryption** - -1. Create an Active Directory Domain Services security group that will be used to manage user exemptions from BitLocker encryption requirements. - -2. Create a Group Policy Object setting by using the Microsoft BitLocker Administration and Monitoring Group Policy template and associate it with the Active Directory group that you created in the previous step. The policy settings to exempt users can be found under **UserConfiguration\\Administrative Templates\\Windows Components\\MDOP MBAM (BitLocker Management)**. - -3. After creating a security group for BitLocker-exempted users, add to this group the names of the users who are requesting an exemption. When users log on to a computer controlled by BitLocker, the MBAM client will check the User Exemption Policy setting and will suspend protection based on whether the user is part of the BitLocker exemption security group. - - **Important**   - Shared computer scenarios require special consideration when using user exemptions. If a non-exempt user logs on to a computer shared with an exempt user, the computer may be encrypted. - - - -**To enable users to request an exemption from BitLocker encryption** - -1. If you have configured user exemption policies by using the MBAM policy template, a user can request an exemption from BitLocker protection through the MBAM client. - -2. When users log on to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Later**, or select **Start** to accept the BitLocker encryption. - - **Note**   - Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy. - - - -3. If users select **Request Exemption**, they receive a notification telling them to contact your organization’s BitLocker administration group. Depending on how the Configure User Exemption Policy is configured, users are provided with one or more of the following contact methods: - - - Phone Number - - - Webpage URL - - - Mailing Address - - After the exemption request is received, the MBAM Administrator can take decide if it is appropriate to add the user to the BitLocker Exemption Active Directory group. - - **Note**   - Once a user submits an exemption request, the MBAM agent reports the user as “temporarily exempt” and then waits a configurable number of days before it checks the computer’s compliance again. If the MBAM administrator rejects the exemption request, the exemption request option is deactivated, which prevents the user from being able to request the exemption again. - - - -## Related topics - - -[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md deleted file mode 100644 index bdffa741a7..0000000000 --- a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md +++ /dev/null @@ -1,700 +0,0 @@ ---- -title: How to Move MBAM 2.0 Features to Another Computer -description: How to Move MBAM 2.0 Features to Another Computer -author: msfttracyp -ms.assetid: 49bc0792-60a4-473f-89cc-ada30191e04a -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move MBAM 2.0 Features to Another Computer - - -This topic describes the steps that you should take to move one or more Microsoft BitLocker Administration and Monitoring (MBAM) features to a different computer. When moving more than one Microsoft BitLocker Administration and Monitoring feature, you should move them in the following order: - -1. Recovery Database - -2. Compliance and Audit Database - -3. Compliance and Audit Reports - -4. Administration and Monitoring - -## Moving the Recovery Database - - -To move the Recovery Database from one computer to another (for example, from Server A to Server B), use the following procedure. - -1. Stop all instances of the Administration and Monitoring web site. - -2. Run MBAM Setup on Server B. - -3. Back up the MBAM Recovery Database on Server A. - -4. Move the MBAM Recovery Database from Server A to B. - -5. Restore the MBAM Recovery Database on Server B. - -6. Configure access to the MBAM Recovery Database on Server B. - -7. Update the database connection data on MBAM Administration and Monitoring servers. - -8. Resume all instances of the MBAM Administration and Monitoring website. - -**Stop All Instances of the MBAM Administration and Monitoring Website** - -1. On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to stop the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter command line that is similar to the: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this PowerShell command line, the IIS Module for PowerShell must be added to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable execution of scripts. - - - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Recovery Database** for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=KeyDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ TOPOLOGY=$X$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery Database will be moved. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain and server names of each MBAM Administration and Monitoring Server that will contact the Recovery Database. Use a semi-colon to separate each domain and server pairs in the list (for example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$). Each server name must be followed by a “$” symbol, as shown in the example (MyDomain\\MyServerName1$; MyDomain\\MyServerName2$). - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Back Up the Recovery Database on Server A** - -1. To back up the Recovery Database on Server A, use SQL Server Management Studio and the Task named Back Up. By default, the database name is **MBAM Recovery Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - Modify the MBAM Recovery Database to use the full recovery mode. - - ```sql - USE master; - - GO - - ALTER DATABASE "MBAM Recovery and Hardware" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - - 'Z:\MBAM Recovery Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery Database. - - BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - - GO - - BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - - TO FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - ENCRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $PASSWORD$ - Enter a password that you will use to encrypt the Private Key file. - - - -3. Run the SQL File by using SQL Server PowerShell and a command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance from which the Recovery Database will be backed up. - - - -**Move the Recovery Database and Certificate from Server A to Server B** - -1. Move the following file from Server A to Server B by using Windows Explorer. - - - MBAM Recovery Database data.bak - -2. To move the certificate for the encrypted database, use the following automation steps. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Copy-Item “Z:\MBAM Recovery Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFile” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFilePrivateKey” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server to which the files will be copied. - - - $DESTINATIONSHARE$ - Enter the name of the share and path to which the files will be copied. - - - -**Restore the Recovery Database on Server B** - -1. Restore the Recovery Database on Server B by using SQL Server Management Studio and the task named **Restore Database**. - -2. Once the task has been completed, select the database backup file by selecting the **From Device** option and then use the **Add** command to select the MBAM Recovery database **Data.bak** file. - -3. Select **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Restore MBAM Recovery Database. - - USE master - - GO - - -- Drop certificate created by MBAM Setup. - - DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - - GO - - --Add certificate - - CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - - FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - DECRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - - -- Restore the MBAM Recovery Database data and log files. - - RESTORE DATABASE [MBAM Recovery and Hardware] - - FROM DISK = 'Z:\MBAM Recovery Database Data.bak' - - WITH REPLACE - ``` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $PASSWORD$ - Enter a password that you used to encrypt the Private Key file. - - - -5. You can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery Database will be restored. - - - -**Configure Access to the Recovery Database on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the computer accounts from each server that is running the MBAM Administration and Monitoring feature to the Local Group named **MBAM Recovery and Hardware DB Access**. - -2. Verify that the SQL login **MBAM Recovery and Hardware DB Access** on the restored database is mapped to the login name **$MachineName$\\MBAM Recovery and Hardware DB Access**. If it is not mapped as described, create another login with similar group memberships, and map it to the login name **$MachineName$\\MBAM Recovery and Hardware DB Access**. - -3. To automate this procedure, you can use Windows PowerShell on Server B to enter a command line that is similar to the following: - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the following values in the example above with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a $, as shown in the example (for example, MyDomain\\MyServerName1$). - - - -~~~ -This command line must be run for each Administration and Monitoring Server that will be accessing the database in your environment. -~~~ - -**Update the Recovery Database Connection Data on the MBAM Administration and Monitoring Servers** - -1. On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Administration and Monitoring website: - - - MBAMAdministrationService - - - MBAMRecoveryAndHardwareService - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the **Section list** control. - -4. Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **KeyRecoveryConnectionString** when updating the configuration for the MBAMAdministrationService application or the row named Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString when updating the configuration for the MBAMRecoveryAndHardwareService. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and instance (for example, $SERVERNAME$\\$SQLINSTANCENAME$) where the Recovery Database was moved to. - -7. To automate this procedure, you can use Windows to enter a command line, that is similar to the following, on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery Database is. - - - -**Resume all Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to start the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - -## Moving the Compliance and Audit Database Feature - - -If you want to move the MBAM Compliance and Audit Database from one computer to another (that is, move the database from Server A to Server B), use the following procedure. The process includes the following high-level steps: - -1. Stop all instances of the Administration and Monitoring website. - -2. Run MBAM setup on Server B. - -3. Back up the Database on Server A. - -4. Move the Database from Server A to B. - -5. Restore the Database on Server B. - -6. Configure access to the Database on Server B. - -7. Update the database connection data on the MBAM Administration and Monitoring servers. - -8. Update the SSRS reports data source connection string with the new location of the Compliance and Audit Database. - -9. Resume all instances of the Administration and Monitoring website. - -**Stop All Instances of the Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to stop the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Stop-s “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this command line, you must add the IIS Module for PowerShell to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable scripts to be run. - - - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Compliance and Audit Database** for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal= ReportsDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$ COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNT=$DOMAIN$\$USERNAME$ TOPOLOGY=$X$` - - **Note** - Note: Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database will be moved to. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain and server names of each MBAM Administration and Monitoring Server that will contact the Compliance and Audit Database. Use a semi-colon to separate each domain and server pair in the list (for example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$). Each server name must be followed by a “$” symbol, as shown in the example (MyDomain\\MyServerName1$; MyDomain\\MyServerName2$). - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit Reports feature to connect to the Compliance and Audit Database. - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Back Up the Compliance and Audit Database on Server A** - -1. To back up the Compliance and Audit Database on Server A, use SQL Server Management Studio and the task named **Back Up**. By default, the database name is **MBAM Compliance Status Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Modify the MBAM Compliance Status Database to use the full recovery model. - - USE master; - - GO - - ALTER DATABASE "MBAM Compliance Status" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Compliance Status Data logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - - 'Z: \MBAM Compliance Status Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery database. - - BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - - GO - ``` - -3. Run the SQL file by using a Windows PowerShell command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit database will be backed up from. - - - -**Move the Compliance and Audit Database from Server A to B** - -1. Move the following files from Server A to Server B using Windows Explorer. - - - MBAM Compliance Status Database Data.bak - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Copy-Item “Z:\MBAM Compliance Status Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$ - Enter the server name where the files will be copied to. - - - $DESTINATIONSHARE$ - Enter the name of share and path where the files will be copied to. - - - -**Restore the Compliance and Audit Database on Server B** - -1. Restore the Compliance and Audit Database on Server B by using SQL Server Management Studio and the task named **Restore Database**. - -2. Once the task has been completed, select the database backup file by selecting the **From Device** option and then use the **Add** command to select the MBAM Compliance Status Database Data.bak file. Select **OK** to complete the restoration process. - -3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Create MBAM Compliance Status Database Data logical backup devices. - - Use master - - GO - - -- Restore the MBAM Compliance Status database data files. - - RESTORE DATABASE [MBAM Compliance Status] - - FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - - WITH REPLACE - ``` - -4. Run the SQL File by using a Windows PowerShell command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database will be restored to. - - - -**Configure Access to the Compliance and Audit Database on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the computer accounts from each server that is running the MBAM Administration and Monitoring feature to the local group named **MBAM Compliance Status DB Access**. - -2. Verify that the SQL login **MBAM Compliance Auditing DB Access** on the restored database is mapped to the login name **$MachineName$\\ MBAM Compliance Auditing DB Access**. If it is not mapped as described, create another login with similar group memberships, and map it to the login name **$MachineName$\\ MBAM Compliance Auditing DB Access**. - -3. To automate this procedure, you can use Windows PowerShell to enter a command line on Server B that is similar to the following: - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the following values in the example above with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a “$” as shown in the example. (for example, MyDomain\\MyServerName1$) - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit Reports. - - - -~~~ -The command line for adding the servers to the MBAM Compliance and Audit Database access local group must be run for each Administration and Monitoring Server that will be accessing the database in your environment. -~~~ - -**Update the Database Connection Data on MBAM Administration and Monitoring Servers** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the connection string information for the following applications, which are hosted in the Administration and Monitoring website: - - - MBAMAdministrationService - - - MBAMComplianceStatusService - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the **Section list** control. - -4. Select the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **ComplianceStatusConnectionString** when updating the configuration for the MBAMAdministrationService application, or the row named **Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString** when updating the configuration for the MBAMComplianceStatusService. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the name of the server and instance (for example, $SERVERNAME$\\$SQLINSTANCENAME) to which the Recovery Database was moved. - -7. To automate this procedure, you can use Windows to enter a command line on each Administration and Monitoring Server that is similar to the following: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="ComplianceStatusConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMComplianceStatusService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery Database is located. - - - -**Resume All Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to start the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - -## Moving the Compliance and Audit Reports - - -If you want to move the MBAM Compliance and Audit Reports from one computer to another (that is, move the reports from Server A to Server B), use the following procedure, which includes the following high-level steps: - -1. Run MBAM setup on Server B. - -2. Configure access to the Compliance and Audit Reports on Server B. - -3. Stop all instances of the MBAM Administration and Monitoring website. - -4. Update the reports connection data on MBAM Administration and Monitoring servers. - -5. Resume all instances of the MBAM Administration and Monitoring website. - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Compliance and Audit Reports** feature for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=Reports COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNTPW=$PASSWORD$ TOPOLOGY=$X$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit Reports feature to connect to the Compliance and Audit Database. - - - $PASSWORD$ - Enter the password of the user account that will be used to connect to the Compliance and Audit Database. - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Configure Access to the Compliance and Audit Reports on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the user accounts that will have access to the Compliance and Audit Reports. Add the user accounts to the local group named MBAM Report Users. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line on Server B that is similar to the following: - - `PS C:\> net localgroup "MBAM Report Users" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the following values in the example above with the applicable values for your environment: - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports. - - - -~~~ -The command line for adding the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment. -~~~ - -**Stop All Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to stop the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - -**Update the Database Connection Data on the MBAM Administration and Monitoring Servers** - -1. On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to update the Compliance and Audit Reports URL. - -2. Select the **Microsoft BitLocker Administration and Monitoring** website, and use the **Configuration Editor** feature that is location under the **Management** section of the **Feature View**. - -3. Select the **appSettings** option from the **Section list** control. - -4. Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **Microsoft.Mbam.Reports.Url**. - -6. Update the value for **Microsoft.Mbam.Reports.Url** to reflect the server name for Server B. If the Compliance and Audit Reports feature was installed on a named SQL Reporting Services instance, be sure to add or update the name of the instance to the URL (for example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages....) - -7. To automate this procedure, you can use Windows PowerShell to enter a command line on each Administration and Monitoring Server that is similar to the following: - - `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\ \sites\Microsoft Bitlocker Administration and Monitoring\HelpDesk" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/ Microsoft+BitLocker+Administration+and+Monitoring/”` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server name to which the Compliance and Audit Reports were installed. - - - $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed. - - - -**Resume All Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to Start the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this command line, you must add the IIS Module for PowerShell to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable scripts to be run. - - - -## Moving the Administration and Monitoring Feature - - -If you want to move the MBAM Administration and Monitoring Reports feature from one computer to another (that is, move the feature from Server A to Server B), use the following procedure, which includes the following high-level steps: - -1. Run MBAM Setup on Server B. - -2. Configure access to the Database on Server B. - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Administration and Monitoring Server** feature for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=AdministrationMonitoringServer, COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ SRS_REPORTSITEURL=$REPORTSSERVERURL$ TOPOLOGY=$X$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - For the COMPLIDB\_SQLINSTANCE parameter, enter the server name and instance where the Compliance and Audit Database is located. For the RECOVERYANDHWDB\_SQLINSTANCE parameter, enter the server name and instance where the Recovery Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit Reports feature to connect to the Compliance and Audit Database. - - - $ REPORTSSERVERURL$ - Enter the URL for the Home location of the SQL Reporting Service website. If the reports were installed to a default SRS instance, the URL format will have the format “http:// $SERVERNAME$/ReportServer”. If the reports were installed to a default SRS instance, the URL format will have the format “http://$SERVERNAME$/ReportServer\_$SQLINSTANCENAME$”. - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Configure Access to the Databases** - -1. On the server or servers where the Recovery Database and Compliance and Audit Database are deployed, use the Local user and Groups snap-in from Server Manager to add the computer accounts from each server that is running the MBAM Administration and Monitoring Server feature to the local groups named **MBAM Recovery and Hardware DB Access** (Recovery DB Server) and **MBAM Compliance Status DB Access** (Compliance and Audit Database Server). - -2. To automate this procedure, you can use Windows PowerShell to enter a command line, that is similar to the following, on the server where the Compliance and Audit Database was deployed. - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - -3. On the server where the Recovery database was deployed, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the following value in the example above with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the Administration and Monitoring Server. The server name must be followed by a “$” symbol, as shown in the example (for example, MyDomain\\MyServerName1$). - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit Reports. - - - -~~~ -The command lines that are listed for adding server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment. -~~~ - -## Related topics - - -[Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md deleted file mode 100644 index 47c7f9cf92..0000000000 --- a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Recover a Corrupted Drive -description: How to Recover a Corrupted Drive -author: msfttracyp -ms.assetid: b0457a00-f72e-4ad8-ab3b-7701851ca87e -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Corrupted Drive - - -To recover a corrupted drive protected by BitLocker, a Microsoft BitLocker Administration and Monitoring (MBAM) Help Desk user will need to create a recovery key package file. This package file can then be copied to the computer that contains the corrupted drive, and then used to recover the drive. Use the following procedure for the steps needed to do this. - -**Important**   -To avoid a potential loss of data, it is strongly recommended that you read the “repair-bde” help and clearly understand how to use the command before completing the following instructions. - - - -**To recover a corrupted drive** - -1. To create the recovery key package necessary to recover a corrupted drive, start a web browser and open the MBAM Administration and Monitoring website. - -2. Select **Drive Recovery** from the left navigation pane. Enter the user’s domain name, user name, reason for unlocking the drive, and the user’s recovery password ID. - - **Note**   - If you are a member of the Help Desk Administrators role, you do not have to enter the user’s domain name or user name. - - - -3. Click **Submit**. The recovery key will be displayed. - -4. Click **Save**, and then select **Recovery Key Package**. The recovery key package will be created on your computer. - -5. Copy the recovery key package to the computer that has the corrupted drive. - -6. Open an elevated command prompt. To do this, click **Start** and type `cmd` in the **Search programs and files box**. Right-click **cmd.exe** and select **Run as Administrator**. - -7. At the command prompt, type the following: - - `repair-bde -kp -rp ` - - **Note**   - Replace <fixed drive> with an available hard disk drive that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified hard disk drive. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md deleted file mode 100644 index 3ba78dbcad..0000000000 --- a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Recover a Drive in Recovery Mode -description: How to Recover a Drive in Recovery Mode -author: msfttracyp -ms.assetid: 8b792bc8-b671-4345-9d37-0208db3e5b03 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Drive in Recovery Mode - - -The encrypted drive recovery features of Microsoft BitLocker Administration and Monitoring (MBAM) ensure the capture and storage of data and availability of tools required to access a BitLocker-protected volume when BitLocker goes into recovery mode. A BitLocker-protected volume goes into recovery mode when a PIN or password is lost or forgotten, or when the Trusted Module Platform (TPM) chip detects changes to the BIOS or startup files of a computer. - -Use this procedure to access the centralized key recovery data system, which can provide a recovery password if a recovery password ID and associated user identifier are supplied. - -**Important** -Microsoft BitLocker Administration and Monitoring uses single-use recovery keys that expire upon use. The single use of a recovery password is automatically applied to operating system drives and fixed drives. On removable drives, it is applied when the drive is removed and then re-inserted and unlocked on a computer that has Group Policy settings activated to manage removable drives. - - - -**To recover a drive in recovery mode** - -1. Open a web browser and navigate to the Administration and Monitoring website. - -2. In the navigation pane, click **Drive Recovery**. The “Recover access to an encrypted drive” webpage opens. - -3. Enter the Windows Logon domain and user name of the user to view recovery information and the first eight digits of the recovery key ID to receive a list of possible matching recovery keys or the entire recovery key ID to receive the exact recovery key. - -4. Select one of the predefined options from the **Reason for Drive Unlock** list, and then click **Submit**. - - **Note** - If you are an MBAM Advanced Helpdesk user, the user domain and user ID entries are not required. - - - -~~~ -MBAM returns the following: - -- An error message if no matching recovery password is found - -- Multiple possible matches if the user has multiple matching recovery passwords - -- The recovery password and recovery package for the submitted user - - **Note** - If you are recovering a damaged drive, the recovery package option provides BitLocker with critical information that it needs to recover the drive. - - - -After the recovery password and recovery package are retrieved, the recovery password is displayed. -~~~ - -5. To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file. - - When the user types the recovery password into the system or uses the recovery package, the drive is unlocked. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md deleted file mode 100644 index 0702c3658e..0000000000 --- a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Recover a Moved Drive -description: How to Recover a Moved Drive -author: msfttracyp -ms.assetid: 697cd78d-962c-411e-901a-2e9220ba6552 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Moved Drive - - -When you move an operating system drive that is encrypted by using Microsoft BitLocker Administration and Monitoring (MBAM), the drive will not accept the PIN that was used in a previous computer because of the change to the Trusted Platform Module (TPM) chip. To use the moved drive, you will need a way to obtain the recovery key ID to retrieve the recovery password. Use the following procedure to recover a drive that has moved. - -**To recover a moved drive** - -1. On the computer that contains the moved drive, start the computer in Windows recovery environment (WinRE) mode, or start the computer by using the Microsoft Diagnostic and Recovery Toolset (DaRT). - -2. Once the computer has been started with WinRE or DaRT, Microsoft BitLocker Administration and Monitoring will treat the moved operating system drive as a data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password. - - **Note**   - In some cases, you may be able to click **I forgot the PIN** during the startup process, and then enter the recovery mode to display the recovery key ID. - - - -3. Use the recovery key ID to retrieve the recovery password and unlock the drive from the Administration and Monitoring website. - -4. If the moved drive was configured to use a TPM chip on the original computer, you must take additional steps after unlocking the drive and completing the start process. In WinRE mode, open a command prompt and use the **manage-bde** tool to decrypt the drive. Using this tool is the only way to remove the TPM plus PIN protector without the original TPM chip. - -5. Once the removal is completed, start the computer normally. The MBAM agent will now enforce the policy to encrypt the drive with the new computer’s TPM plus PIN. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md b/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md deleted file mode 100644 index 09f2ccc21e..0000000000 --- a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Reset a TPM Lockout -description: How to Reset a TPM Lockout -author: msfttracyp -ms.assetid: 20719ab2-18ae-4d3b-989a-539341909816 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset a TPM Lockout - - -The Encrypted Drive Recovery feature of Microsoft BitLocker Administration and Monitoring (MBAM) encompasses both the capture and storage of data and the availability for tools that are needed to manage the Trusted Platform Module (TPM). This topic covers how to access the centralized Key Recovery data system in the Administration and Monitoring website, which can provide a TPM owner password file when a computer ID and associated user identifier are supplied. - -A TPM lockout can occur if a user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. - -You can reset a TPM lockout only if MBAM owns the TPM. - -**To reset a TPM lockout** - -1. Open a web browser and navigate to the Administration and Monitoring website. - -2. In the left navigation pane, select **Manage TPM** to open the **Manage TPM** page. - -3. Enter the fully qualified domain name for the computer and the computer name, and enter the user’s Windows logon domain and the user’s user name to retrieve the TPM owner password file. - -4. From the **Reason for requesting TPM owner password file** list, select a reason for the request, and click **Submit**. - - MBAM returns one of the following: - - - An error message, if no matching TPM owner password file is found - - - The TPM owner password file for the submitted computer - - **Note** - If you are an Advanced Helpdesk user, the user domain and user ID fields are not required. - - - -~~~ -After the TPM owner password is retrieved, the owner password is displayed. -~~~ - -5. To save the password to a .tpm file, click the **Save** button. - - The user will run the TPM management console, select the **Reset TPM lockout** option, and provide the TPM owner password file to reset the TPM lockout. - - **Important** - Help Desk administrators should not give the TPM hash value or TPM owner password file to end users. The TPM information does not change, so it could pose a security risk if the file is given to end users. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md deleted file mode 100644 index b9de2465f0..0000000000 --- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Use a Command Line to Install the MBAM Client -description: How to Use a Command Line to Install the MBAM Client -author: msfttracyp -ms.assetid: 4dc8f944-c2fd-4d89-aed6-e9dc77de3ae4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a Command Line to Install the MBAM Client - - -You can use a command line to deploy the Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Client. - -## Command Line for Deploying the MBAM 2.0 Client - - -Use the following command line to deploy the MBAM Client: - -`MBAMClientSetup.exe /q` - -## Related topics - - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md deleted file mode 100644 index 146fdd3729..0000000000 --- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md +++ /dev/null @@ -1,219 +0,0 @@ ---- -title: How to Use a Command Line to Install the MBAM Server -description: How to Use a Command Line to Install the MBAM Server -author: msfttracyp -ms.assetid: 6ffc6d41-a793-42c2-b997-95ba47550648 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a Command Line to Install the MBAM Server - - -You can use a command line to install the MBAM Server with either the Stand-alone or Configuration Manager topology. The following command line example is for deploying MBAM on a single server, which is an architecture that should be used only in a test environment. You will need to change the command line accordingly when you deploy MBAM to a production environment, which should have multiple servers. - -## Command Line for Deploying the MBAM 2.0 Server with the Stand-alone Topology - - -You can use a command line that is similar to the following to install the MBAM Server with the Stand-alone topology. - -``` syntax -MbamSetup.exe /qb /l*v MaltaServerInstall.log TOPOLOGY=0 I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 ADDLOCAL=KeyDatabase,ReportsDatabase,Reports,AdministrationMonitoringServer,SelfServiceServer,PolicyTemplate,REPORTS_USERACCOUNT=[UserDomain]\[UserName1] REPORTS_USERACCOUNTPW=[UserPwd1] COMPLIDB_SQLINSTANCE=%computername% RECOVERYANDHWDB_SQLINSTANCE=%computername% SRS_INSTANCENAME=%computername% ADMINANDMON_WEBSITE_PORT=83 WEBSITE_PORT=83 -``` - -The following table describes the command line parameters for deploying the MBAM Server with the Stand-alone topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterParameter ValueDescription

          TOPOLOGY

          0

          0 – Stand-alone topology

          I_ACCEPT_ENDUSER_LICENSE_AGREEMENT

          01

          0 – do not accept the license agreement1 – accept the license agreement

          ADDLOCAL

          Features to be installed on the Server

          KeyDatabase

          Recovery Database

          ReportsDatabase

          Compliance and Audit Reports Database

          Reports

          Compliance and Audit Reports

          AdministrationMonitoringServer

          Administration and Monitoring website

          SelfServiceServer

          Self-Service Portal

          PolicyTemplate

          MBAM Group Policy template

          REPORTS_USERACCOUNT

          [UserDomain][UserName1]

          Domain and user account of the Reporting Services service account that will access the Compliance and Audit database

          REPORTS_USERACCOUNTPW

          [UserPwd1]

          Password of the Reporting Services service account that will access the Compliance and Audit database

          COMPLIDB_SQLINSTANCE

          %computername%

          SQL Server instance name for the Compliance and Audit Database – replace %computername% with the computer name

          RECOVERYANDHWDB_SQLINSTANCE

          %computername%

          SQL Server instance name for the Recovery Database – replace %computername% with the computer name

          SRS_INSTANCENAME

          %computername%

          SQL Server Reporting Server instance where the Compliance and Audit reports will be installed – replace %computername% with the computer name

          ADMINANDMON_WEBSITE_PORT

          83

          Port for the Administration and Monitoring website; “83” is only an example

          WEBSITE_PORT

          83

          Port for the Self-Service Portal website; “83” is only an example

          - - - -## Command Line for Deploying the MBAM 2.0 Server with the Configuration Manager Topology - - -You can use a command line that is similar to the following to install the MBAM Server with the Configuration Manager topology. - -``` syntax -MbamSetup.exe /qn /l*v MaltaServerInstall.log I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 TOPOLOGY=1 COMPLIDB_SQLINSTANCE=%computername% RECOVERYANDHWDB_SQLINSTANCE=%computername% SRS_INSTANCENAME=%computername% REPORTS_USERACCOUNT=[UserDomain]\[UserName] REPORTS_USERACCOUNTPW=[UserPwd] ADMINANDMON_WEBSITE_PORT=83 WEBSITE_PORT=83 -``` - -The following table describes the command line parameters for installing the MBAM 2.0 Server with the Configuration Manager topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterParameter ValueDescription

          TOPOLOGY

          1

          1 – Configuration Manager topology

          I_ACCEPT_ENDUSER_LICENSE_AGREEMENT

          01

          0 – do not accept the license agreement1 – accept the license agreement

          COMPLIDB_SQLINSTANCE

          %computername%

          SQL Server instance name for the Audit Database – replace %computername% with the computer name

          RECOVERYANDHWDB_SQLINSTANCE

          %computername%

          SQL Server instance name for the Recovery Database - replace %computername% with the computer name

          SRS_INSTANCENAME

          %computername%

          SQL Server Reporting Server instance where the Audit reports will be installed – replace %computername% with the computer name

          REPORTS_USERACCOUNT

          [UserDomain][UserName1]

          Domain and user account of the Reporting Services service account that will access the Compliance and Audit database

          REPORTS_USERACCOUNTPW

          [UserPwd1]

          Password of the Reporting Services service account that will access the Compliance and Audit database

          ADMINANDMON_WEBSITE_PORT

          83

          Port for the Administration and Monitoring website; “83” is only an example

          WEBSITE_PORT

          83

          Port for the Self-Service Portal website; “83” is only an example

          - - - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md b/mdop/mbam-v2/how-to-use-the-help-desk-portal.md deleted file mode 100644 index 1d863d9452..0000000000 --- a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: How to Use the Help Desk Portal -description: How to Use the Help Desk Portal -author: msfttracyp -ms.assetid: c27f7737-10c8-4164-9de8-57987292c89c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Help Desk Portal - - -The MBAM Administration and Monitoring website, also referred to as the Help Desk Portal, is an administrative interface to BitLocker drive encryption that is installed as part of the Microsoft BitLocker Administration and Monitoring (MBAM) server infrastructure. The following sections describe how you can use this website to review reports, recover end users’ drives, and manage end users’ TPMs. - -## Reports - - -MBAM collects information from Active Directory and client computers, which enables you to run different reports to monitor BitLocker usage and compliance. Using the **Reports** section of the Administration and Monitoring website, you can generate reports on enterprise compliance, individual computers, and key recovery activity. For a description of each report, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md). - -**To access reports** - -1. Open a web browser and navigate to the MBAM Administration and Monitoring website. - -2. Select **Reports** in the left pane. - -3. From the top menu bar, select the report type you want to generate. To save reports, click the **Export** button on the Reports menu bar. - -For additional information about how to run MBAM reports, see [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md). - -## Drive Recovery - - -The **Drive Recovery** feature of the Administration and Monitoring website allows users with specific administrator roles (for example, Help Desk Users) to access recovery key data that has been collected by the MBAM Client. This data can be used to access a BitLocker-protected drive when BitLocker goes into recovery mode. For instructions on how to recover a drive that is in recovery mode, see [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md). - -You can also recover drives that have been moved or that are corrupted: - -- [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) - -- [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) - -For additional information about how to recover a BitLocker-protected drive, see [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md). - -## Manage TPM - - -The Manage TPM feature of the Administration and Monitoring website gives users with certain administrator roles (for example, “MBAM Helpdesk Users”) access to TPM data that has been collected by the MBAM Client. In a TPM lockout, an administrator can use the Administration and Monitoring website to retrieve the necessary password file to unlock the TPM. For instructions on how to reset a TPM after a TPM lockout, see [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md). - -## MBAM Help Desk Tasks - - -You can use the Administration and Monitoring website for many administrative tasks, such as managing BitLocker-protected hardware, recovering drives, and running reports. By default, the URL for the Administration and Monitoring website is http://<*MBAMAdministrationServername*>, although you can customize it during the installation process. - -**Note**   -To access the various features offered by the Administration and Monitoring website, you must have the appropriate roles associated with your user account. For more information about understanding user roles, see [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md). - - - -Use the following links to find information about the tasks that you can perform by using the Administration and Monitoring website: - -- [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md) - -- [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md) - -- [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) - -- [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) - -- [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md b/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md deleted file mode 100644 index 34f203bd9c..0000000000 --- a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Use the Self-Service Portal to Regain Access to a Computer -description: How to Use the Self-Service Portal to Regain Access to a Computer -author: msfttracyp -ms.assetid: bcf095de-0237-4bb0-b450-da8fb6d6f3d0 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Self-Service Portal to Regain Access to a Computer - - -If end users get locked out of Windows by BitLocker because they forgot their password or PIN, or because they changed operating system files or changed the BIOS or the Trusted Platform Module (TPM), they can use the Self-Service Portal to regain access to Windows without having to ask their Help Desk for assistance. - -**Note**   -If the IT administrator configured an IIS Session State time-out, a message is displayed 60 seconds prior to the time-out. - - - -**Note**   -These instructions are written for and from the perspective of end users. - - - -**To use the Self-Service Portal to regain access to a computer** - -1. In the **Recovery KeyId** field, enter a minimum of eight of the 32-digit BitLocker Key ID that is displayed on the BitLocker recovery screen of your computer. - - **Note**   - If the first eight digits match multiple keys, a message displays that requires you to enter all 32 digits of the recovery key ID. - - - -2. In the **Reason** field, select a reason for your request for the recovery key. - -3. Click **Get Key**. Your BitLocker recovery key is displayed in the “Your BitLocker Recovery Key” field. - -4. Enter the 48-digit code into the BitLocker recovery screen on your computer to regain access to the computer. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md b/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md deleted file mode 100644 index 7c89b836a2..0000000000 --- a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Validate the MBAM Installation with Configuration Manager -description: How to Validate the MBAM Installation with Configuration Manager -author: msfttracyp -ms.assetid: 8e268539-91c3-4e8a-baae-faf3605da818 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Validate the MBAM Installation with Configuration Manager - - -After installing Microsoft BitLocker Administration and Monitoring (MBAM) with Configuration Manager, validate that the installation has successfully set up all the necessary features for MBAM by completing the following steps. - -**To validate the MBAM Server feature installation with Configuration Manager** - -1. On the server where System Center Configuration Manager is deployed, open **Control Panel**. Select the program that is used to uninstall or change a program. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the list of programs and features. - - **Note**   - To validate the installation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. Use the Configuration Manager console to confirm that a new collection, called “MBAM Supported Computers,” is displayed. - - To view the collection with Configuration Manager 2007: Click **Site Database** (<**SiteCode**> - <**ServerName**>, <**SiteName**>), **Computer Management**. - - To view the collection with System Center 2012 Configuration Manager: Click the **Assets and Compliance** workspace, **Device Collections**. - -3. Use the Configuration Manager console to verify that the following reports are listed in the **MBAM** folder: - - - BitLocker Computer Compliance - - - BitLocker Enterprise Compliance Dashboard - - - BitLocker Enterprise Compliance Details - - - BitLocker Enterprise Compliance Summary - - To view the reports with Configuration Manager 2007: Click **Reporting**, **Reporting Services**, \\\\<**ServerName**>, **Report Folders** - - To view the reports with System Center 2012 Configuration Manager: Click the **Monitoring** workspace, **Reporting**, **Reports**. - -4. Use the Configuration Manager console to confirm that the configuration baseline “BitLocker Protection” is listed. - - To view the configuration baselines with Configuration Manager 2007: Click **Desired Configuration Management**, **Configuration Baselines**. - - To view the configuration baselines with System Center 2012 Configuration Manager: Click the **Assets and Compliance** workspace, **Compliance Settings**, **Configuration Baselines**. - -5. Use the Configuration Manager console to confirm that the following new configuration items are displayed: - - - BitLocker Fixed Data Drives Protection - - - BitLocker Operating System Drive Protection - - To view the configuration items with Configuration Manager 2007: Click **Desired Configuration Management**, **Configuration Items**. - - To view the configuration items with System Center 2012 Configuration Manager: Click the **Assets and Compliance** workspace, **Compliance Settings**, **Configuration Items**. - -## Related topics - - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/images/checklistbox.gif b/mdop/mbam-v2/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/mbam-v2/images/checklistbox.gif and /dev/null differ diff --git a/mdop/mbam-v2/images/mbam2-1-server.gif b/mdop/mbam-v2/images/mbam2-1-server.gif deleted file mode 100644 index 20f3f5adcb..0000000000 Binary files a/mdop/mbam-v2/images/mbam2-1-server.gif and /dev/null differ diff --git a/mdop/mbam-v2/images/mbam2-3-servers.gif b/mdop/mbam-v2/images/mbam2-3-servers.gif deleted file mode 100644 index 62f5d02a39..0000000000 Binary files a/mdop/mbam-v2/images/mbam2-3-servers.gif and /dev/null differ diff --git a/mdop/mbam-v2/images/mbam2-cmserver.gif b/mdop/mbam-v2/images/mbam2-cmserver.gif deleted file mode 100644 index 80a0444483..0000000000 Binary files a/mdop/mbam-v2/images/mbam2-cmserver.gif and /dev/null differ diff --git a/mdop/mbam-v2/index.md b/mdop/mbam-v2/index.md deleted file mode 100644 index ba76b06b55..0000000000 --- a/mdop/mbam-v2/index.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide -description: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide -author: dansimp -ms.assetid: fdb43f62-960a-4811-8802-50efdf04b4af -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - -# Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 provides a simplified administrative interface that you can use to manage BitLocker drive encryption. In BitLocker Administration and Monitoring 2.0, you can select BitLocker drive encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. - -## Outline - -- [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - [About MBAM 2.0](about-mbam-20-mbam-2.md) - - [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md) - - [About MBAM 2.0 SP1](about-mbam-20-sp1.md) - - [Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md) - - [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) - - [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md) - - [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) -- [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - - [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) - - [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - - [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - - [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - - [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) -- [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - - [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md) - - [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) -- [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - - [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - - [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - - [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - - [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) -- [Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -## More Information - -- [MDOP Information Experience](index.md) - - Find documentation, videos, and other resources for MDOP technologies. - -  - -  - - - - - diff --git a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md b/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md deleted file mode 100644 index 382a0458c3..0000000000 --- a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Maintaining MBAM 2.0 -description: Maintaining MBAM 2.0 -author: msfttracyp -ms.assetid: 6479e093-840d-45d5-b759-1179aeeeefeb -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining MBAM 2.0 - - -After completing all necessary planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure Microsoft BitLocker Administration and Monitoring to run in a highly available fashion while using it to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM as well as how to move MBAM Server features. - -## Ensure High Availability for MBAM 2.0 - - -MBAM was designed to be fault-tolerant and not negatively affect the users if a server is not available. The information in this section can be used to configure a highly available MBAM installation. - -[High Availability for MBAM 2.0](high-availability-for-mbam-20-mbam-2.md) - -## Move MBAM 2.0 Features to Another Server - - -If you need to move an MBAM Server feature from one server computer to another, you must complete required steps in a specific order to avoid a loss of productivity or data. This section describes the steps that you must complete to move one or more MBAM Server features to a different computer. - -[How to Move MBAM 2.0 Features to Another Computer](how-to-move-mbam-20-features-to-another-computer-mbam-2.md) - -## Other resources for Maintaining MBAM - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md deleted file mode 100644 index 3cdb1e8d9b..0000000000 --- a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: MBAM 2.0 Deployment Checklist -description: MBAM 2.0 Deployment Checklist -author: msfttracyp -ms.assetid: 7905d31d-f21c-4683-b9c4-95b815e08fab -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft BitLocker Administration and Monitoring (MBAM) deployment with a Stand-alone topology. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when deploying Microsoft BitLocker Administration and Monitoring features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Complete the planning phase to prepare the computing environment for MBAM deployment.

          MBAM 2.0 Planning Checklist

          Checklist box

          Review the MBAM supported configurations information to make sure selected client and server computers are supported for MBAM feature installation.

          MBAM 2.0 Supported Configurations

          Checklist box

          Run MBAM Setup to deploy MBAM Server features in the following order:

          -
            -
          1. Recovery Database

          2. -
          3. Compliance and Audit Database

          4. -
          5. Compliance Audit and Reports

          6. -
          7. Self-Service Server

          8. -
          9. Administration and Monitoring Server

          10. -
          11. MBAM Group Policy template

          12. -
          -
          -Note

          Keep track of the names of the servers each feature is installed on. This information will be used throughout the installation process.

          -
          -
          - -

          Deploying the MBAM 2.0 Server Infrastructure

          Checklist box

          Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on appropriate servers.

          Planning for MBAM 2.0 Administrator Roles and How to Manage MBAM Administrator Roles

          Checklist box

          Create and deploy required MBAM Group Policy Objects.

          Deploying MBAM 2.0 Group Policy Objects

          Checklist box

          Deploy the MBAM Client software.

          Deploying the MBAM 2.0 Client

          - - - -## Related topics - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md deleted file mode 100644 index f74d87fc3e..0000000000 --- a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md +++ /dev/null @@ -1,347 +0,0 @@ ---- -title: MBAM 2.0 Deployment Prerequisites -description: MBAM 2.0 Deployment Prerequisites -author: msfttracyp -ms.assetid: 57d1c2bb-5ea3-457e-badd-dd9206ff0f20 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Deployment Prerequisites - - -Before you start Microsoft BitLocker Administration and Monitoring (MBAM) Setup, you should ensure that you have met the prerequisites to install the product. This section contains information to help you successfully plan your computing environment before you deploy Microsoft BitLocker Administration and Monitoring Server features and Clients. If you are installing MBAM with Configuration Manager, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md) for additional prerequisites. - -## Installation Prerequisites for MBAM Server Features - - -Each of the MBAM Server features has specific prerequisites that must be met before the MBAM features can be successfully installed. MBAM Setup checks that all prerequisites are met before the installation starts. - -### Prerequisites for Administration and Monitoring Server - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Administration and Monitoring Server feature.

          Web Server (IIS) Management Tools

          Select IIS Management Scripts and Tools.

          SSL Certificate

          Optional. To secure communication between the clients and the web services, you have to obtain and install a certificate that a trusted security authority signed.

          Web Server Role Services

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -

          Windows Server Features

          .NET Framework 3.5.1 features:

          -
            -
          • .NET Framework 3.5.1

          • -
          • WCF Activation

            -
              -
            • HTTP Activation

            • -
            • Non-HTTP Activation

            • -
          • -
          -

          Windows Process Activation Service:

          -
            -
          • Process Model

          • -
          • .NET Environment

          • -
          • Configuration APIs

          • -
          - - - -**Note** -For a list of supported operating systems, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - - - -### Prerequisites for the Compliance and Audit Reports - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of SQL Server

          -

          See MBAM 2.0 Supported Configurations for supported versions.

          Install SQL Server with:

          -
            -
          • SQL_Latin1_General_CP1_CI_AS collation

          • -

          SQL Server Reporting Services (SSRS)

          SSRS instance rights – required for installing reports only if you are installing databases on a separate server from the reports.

          Required instance rights:

          -
            -
          • Create Folders

          • -
          • Publish Reports

          • -
          -

          SSRS must be installed and running during the MBAM Server installation. Configure SSRS in “native” mode and not in unconfigured or “SharePoint” mode.

          - - - -### Prerequisites for the Recovery Database - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of SQL Server

          -

          See MBAM 2.0 Supported Configurations for supported versions.

          Install SQL Server with:

          -
            -
          • SQL_Latin1_General_CP1_CI_AS collation

          • -
          • SQL Server Management Tools

          • -

          Required SQL Server permissions

          Required permissions:

          -
            -
          • SQL instance Login Server roles:

            -
              -
            • dbcreator

            • -
            • processadmin

            • -
          • -
          • SQL Server Reporting Services instance rights:

            -
              -
            • Create Folders

            • -
            • Publish Reports

            • -
          • -

          Optional - Install Transparent Data Encryption (TDE) feature available in SQL Server

          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.

          -
          -Note

          TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.

          -
          -
          - -
          -

          More about TDE: MBAM 2.0 Security Considerations.

          - - - -### Prerequisites for the Compliance and Audit Database - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of SQL Server

          -

          See MBAM 2.0 Supported Configurations for supported versions.

          Install SQL Server with:

          -
            -
          • SQL_Latin1_General_CP1_CI_AS collation

          • -
          • SQL Server Management Tools

          • -

          Required SQL Server permissions

          Required permissions:

          -
            -
          • SQL instance Login Server roles:

            -
              -
            • dbcreator

            • -
            • processadmin

            • -
          • -
          • SQL Server Reporting Services instance rights:

            -
              -
            • Create Folders

            • -
            • Publish Reports

            • -
          • -

          Optional - Install Transparent Data Encryption (TDE) feature in SQL Server.

          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.

          -
          -Note

          TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.

          -
          -
          - -
          -

          More about TDE: MBAM 2.0 Security Considerations

          SQL Server must have Database Engine Services installed and running during MBAM Server installation.

          The SQL Server Agent service must be running and set to auto-start on the selected instances of SQL Server.

          - - - -### Prerequisites for the Self-Service Portal - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of Windows Server

          -

          See MBAM 2.0 Supported Configurations for supported versions.

          ASP.NET MVC 2.0

          ASP.NET MVC 2 download

          Web Service IIS Management Tools

          - - - -## Prerequisites for MBAM Clients - - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Windows 7 clients only - must have Trusted Platform Module (TPM) capability.

          TPM version must be 1.2 or later.

          The TPM chip must be turned on in the BIOS and be resettable from the operating system.

          For more information, see the BIOS documentation.

          Windows 8 clients only: To have MBAM store and manage the TPM recovery keys: TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM. To turn off TPM auto-provisioning, see Disable-TpmAutoProvisioning.

          -
            -
          • TPM auto-provisioning must be turned off.

          • -
          • MBAM must be set as the owner of the TPM before you deploy MBAM.

          • -

          To turn off TPM auto-provisioning, see Disable-TpmAutoProvisioning.

          -
          -Note

          Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.

          -
          -
          - -
          - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md deleted file mode 100644 index 5b07a90aff..0000000000 --- a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: MBAM 2.0 Planning Checklist -description: MBAM 2.0 Planning Checklist -author: msfttracyp -ms.assetid: 16b27c27-5f5e-41e2-b526-89a036672fb8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft BitLocker Administration and Monitoring (MBAM) deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for an Microsoft BitLocker Administration and Monitoring deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the getting started information about MBAM to gain a basic understanding of the product before beginning deployment planning.

          Getting Started with MBAM 2.0

          Checklist box

          Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment.

          MBAM 2.0 Deployment Prerequisites

          Checklist box

          Plan for and configure MBAM Group Policy requirements.

          Planning for MBAM 2.0 Group Policy Requirements

          Checklist box

          Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

          Planning for MBAM 2.0 Administrator Roles

          Checklist box

          Review the MBAM 2.0 Supported Configurations documentation to ensure that hardware that meets MBAM installation system requirements is available.

          MBAM 2.0 Supported Configurations

          Checklist box

          Plan for deploying MBAM Server feature deployment.

          Planning for MBAM 2.0 Server Deployment

          Checklist box

          Plan for deploying MBAM Client deployment.

          Planning for MBAM 2.0 Client Deployment

          Checklist box

          Validate your deployment plan in a test environment.

          Evaluating MBAM 2.0

          - - - -## Related topics - - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md deleted file mode 100644 index ca24661fe9..0000000000 --- a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: MBAM 2.0 Privacy Statement -description: MBAM 2.0 Privacy Statement -author: msfttracyp -ms.assetid: fce72ad4-a837-4d17-8d3b-4d93f1a399be -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Privacy Statement - - -## Microsoft BitLocker Administration and Monitoring (MBAM) v2 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft BitLocker Administration and Monitoring v2 (MBAM). This is a preliminary disclosure that focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft BitLocker Administration and Monitoring (MBAM) enhances BitLocker by simplifying deployment and key recovery, centralizing provisioning, monitoring and reporting of encryption status for fixed and removable drives, and minimizing support costs. This release provides support for Windows 8 as well as improvements on Configuration Manager Integration and key recovery functionality. - -### Collection and Use of Your Information - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public.  We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by MBAM may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -### Collection and Use of Information about Your Computer - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -Because this is a pre-release version of the software, some of these Internet-enabled features are turned on by default so that we can collect enough information about how the software is working in order to improve the commercially released software. The default settings in this pre-release software do not necessarily reflect how these features will be configured in the commercially released software. - -The privacy details for each MBAM feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -### Security of your information - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -### Changes to this privacy statement - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -### For More Information - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us. - -Microsoft Privacy Microsoft Corporation One Microsoft Way Redmond, Washington 98052 USA - -### Specific Features - -### Microsoft Error Reporting - -The remainder of this document will address the following specific features: - -**What This Feature Does:** - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with MBAM to Microsoft and to receive information that may help you avoid or solve such problems. - -**Information Collected, Processed, or Transmitted:** - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at [https://go.microsoft.com](https://go.microsoft.com/fwlink/?LinkID=244395). - -**Use of Information:** - -We use the error reporting data to solve customer problems and improve our software and services. - -**Choice and control:** - -Microsoft Error Reporting is not turned on or off by MBAM. MBAM will utilize whatever configuration is active in Windows. You can change your Microsoft Error Reporting settings at any time disabling the automatic reporting of errors that may contain the names of folders on your PC by creating a registry value named "DisableGenericReports" with any type or value under: - -"HKLM\\Software\\Microsoft\\Microsoft Standalone System Sweeper Tool" (for the 32-bit version) - -"HKLM\\Software\\Wow6432Node\\Microsoft\\Microsoft Standalone System Sweeper Tool" (for the 64-bit version) - -**Warning** - -Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the PC. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied. - -Important Information: Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their PCs. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available on [TechNet](https://technet.microsoft.com/library/cc709644.aspx). - -Additional information on how to modify enable and disable error reporting is available at this support article: [(http://support.microsoft.com/kb/188296)](https://support.microsoft.com/kb/188296). - -### Microsoft Update - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Use of Information:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Update Services Privacy Statement at . - -### Customer Experience Improvement Program - -**What This Feature Does:** - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We won't collect your name, address, or other contact information. - -**Information Collected, Processed, or Transmitted:** - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -**Use of Information:** - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -**Choice/Control:** - -CEIP is off by default. You're offered the opportunity to participate in CEIP during setup. If you choose to participate and later change your mind, you can turn off CEIP at any time by: Using the CEIP Opt-out run-time dialog. From the Help menu, open the link named “Customer Experience Improvement Program” and check the ‘Don’t Join’ radio button. - -## Related topics - - -[Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md b/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md deleted file mode 100644 index 61fa70e2f9..0000000000 --- a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md +++ /dev/null @@ -1,206 +0,0 @@ ---- -title: MBAM 2.0 Security Considerations -description: MBAM 2.0 Security Considerations -author: msfttracyp -ms.assetid: 0aa5c6e2-d92c-4e30-9f6a-b48abb667ae5 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Security Considerations - - -This topic contains a brief overview about the accounts and groups, log files, and other security-related considerations for Microsoft BitLocker Administration and Monitoring (MBAM). For more information, follow the links within this article. - -## General Security Considerations - - -**Understand the security risks.** The most serious risk from Microsoft BitLocker Administration and Monitoring is that its functionality could be hijacked by an unauthorized user who could then reconfigure BitLocker encryption and gain BitLocker encryption key data on MBAM Clients. However, the loss of MBAM functionality for a short period of time, due to a denial-of-service attack, does not generally have a catastrophic impact, unlike, for example, e-mail, network communications, light, and power. - -**Physically secure your computers**. There is no security without physical security. An attacker who gets physical access to an MBAM Server could potentially use it to attack the entire client base. All potential physical attacks must be considered high risk and mitigated appropriately. MBAM servers should be stored in a secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems, Microsoft SQL Server, and MBAM by subscribing to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM and MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and Groups in MBAM - - -The best practice for managing user accounts is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary MBAM local groups on the MBAM Servers. - -### Active Directory Domain Services Groups - -No Active Directory groups are created automatically during the MBAM setup process. However, it is recommended that you create the following Active Directory Domain Services global groups to manage MBAM operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Group NameDetails

          MBAM Advanced Helpdesk Users

          Create this group to manage members of the MBAM Advanced Helpdesk Users local group created during MBAM Setup.

          MBAM Compliance Auditing DB Access

          Create this group to manage members of the MBAM Compliance Auditing DB Access local group created during MBAM Setup.

          MBAM Helpdesk Users

          Create this group to manage members of the MBAM Helpdesk Users local group created during MBAM Setup.

          MBAM Recovery and Hardware DB Access

          Create this group to manage members of the MBAM Recovery and Hardware DB Access local group created during MBAM Setup.

          MBAM Report Users

          Create this group to manage members of the MBAM Report Users local group created during MBAM Setup.

          MBAM System Administrators

          Create this group to manage members of the MBAM System Administrators local group created during MBAM Setup.

          BitLocker Encryption Exemptions

          Create this group to manage user accounts that should be exempted from BitLocker encryption starting on computers that they log on to.

          - - - -### MBAM Server Local Groups - -MBAM Setup creates local groups to support MBAM operations. You should add the Active Directory Domain Services global groups to the appropriate MBAM local groups to configure MBAM security and data access permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Group NameDetails

          MBAM Advanced Helpdesk Users

          Members of this group have increased access to the Help Desk features from MBAM.

          MBAM Compliance Auditing DB Access

          Contains the machines that have access to the MBAM Compliance and Auditing Database.

          MBAM Helpdesk Users

          Members of this group have access to some of the Help Desk features from MBAM.

          MBAM Recovery and Hardware DB Access

          Contains the machines that have access to the MBAM Recovery Database.

          MBAM Report Users

          Members of this group have access to the Compliance and Audit reports from MBAM.

          MBAM System Administrators

          Members of this group have access to all MBAM features.

          - - - -### SSRS Reports Service Account - -The SSRS Reports service account provides the security context to run the MBAM reports available through SSRS. It is configured during MBAM Setup. - -When you configure the SSRS Reports service account, specify a domain user account, and configure the password to never expire. - -**Note**   -If you change the name of the service account after you deploy MBAM, you must reconfigure the reporting data source to use the new service account credentials. Otherwise, you will not be able to access the Help Desk Portal. - - - -## MBAM Log Files - - -The following MBAM Setup log files are created in the installing user’s %temp% folder during MBAM Setup: - -**MBAM Server Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Setup and MBAM Server Feature installation. - -InstallComplianceDatabase.log -Logs actions taken to create the MBAM Compliance and Audit Database setup. - -InstallKeyComplianceDatabase.log -Logs actions taken to create the MBAM Recovery Database. - -AddHelpDeskDbAuditUsers.log -Logs actions taken to create the SQL Server logins on the MBAM Compliance and Audit database and authorize the HelpDesk web service to the database for reports. - -AddHelpDeskDbUsers.log -Logs actions taken to authorize web services to database for key recovery and create logins to the MBAM Recovery Database. - -AddKeyComplianceDbUsers.log -Logs actions taken to authorize web services to MBAM Compliance and Audit Database for compliance reporting. - -AddRecoveryAndHardwareDbUsers.log -Logs actions taken to authorize web services to the MBAM Recovery database for key recovery. - -**Note**   -In order to obtain additional MBAM Setup log files, you have to install MBAM by using the msiexec package and the /L <location> option. Log files are created in the location specified. - - - -**MBAM Client Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Client installation. - -## MBAM Database TDE Considerations - - -The transparent data encryption (TDE) feature that is available in SQL Server is an optional installation for the database instances that will host MBAM database features. - -With TDE, you can perform real-time, full database-level encryption. TDE is the optimal choice for bulk encryption to meet regulatory compliance or corporate data security standards. TDE works at the file level, which is similar to two Windows features: the Encrypting File System (EFS) and BitLocker Drive Encryption, both of which also encrypt data on the hard drive. TDE does not replace cell-level encryption, EFS, or BitLocker. - -When TDE is enabled on a database, all backups are encrypted. Thus, special care must be taken to ensure that the certificate that was used to protect the database encryption key is backed up and maintained with the database backup. If this certificate (or certificates) is lost, the data will be unreadable. Back up the certificate along with the database. Each certificate backup should have two files. Both of these files should be archived (ideally separately from the database backup file for security). You can alternatively consider using the extensible key management (EKM) feature (see Extensible Key Management) for storage and maintenance of keys used for TDE. - -For an example of how to enable TDE for MBAM database instances, see [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md). - -For more information about TDE in SQL Server 2008, see [SQL Server Encryption]( https://go.microsoft.com/fwlink/?LinkId=299883). - -## Related topics - - -[Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md b/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md deleted file mode 100644 index 926638dfd3..0000000000 --- a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md +++ /dev/null @@ -1,302 +0,0 @@ ---- -title: MBAM 2.0 Supported Configurations -description: MBAM 2.0 Supported Configurations -author: msfttracyp -ms.assetid: dca63391-39fe-4273-a570-76d0a2f8a0fd -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Supported Configurations - - -This topic specifies the requirements to install and run Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 in your environment by using the Stand-alone topology. For supported configurations that apply to later releases, see the documentation for the applicable release. - -If you plan to install MBAM 2.0 by using the Configuration Manager topology and want to review a list of the system requirements, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -The recommended configuration for running MBAM in a production environment is with two servers, depending on your scalability requirements. This configuration supports up to 200,000 MBAM clients. For an image and descriptions of the Stand-alone MBAM server infrastructure, see [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md). - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -## MBAM Server System Requirements - - -### Server Operating System Requirements - -The following table lists the operating systems that are supported for the Microsoft BitLocker Administration and Monitoring Server installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter Edition

          SP1

          64-bit

          Windows Server 2012

          Standard or Datacenter Edition

          64-bit

          - - - -**Note**   -There is no support for installing MBAM services, reports, or databases on a domain controller computer. - - - -### Server Processor, RAM, and Disk Space Requirements - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware componentMinimum requirementRecommended requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          8 GB

          12 GB

          Free disk space

          1 GB

          2 GB

          - - - -### SQL Server Database Requirements - -The following table lists the SQL Server versions that are supported for the Administration and Monitoring Server feature installation, which includes the Recovery Database, Compliance and Audit Database, and Compliance and Audit Reports. The databases additionally require the installation of SQL Server Management Tools. - -**Note**   -MBAM does not natively support SQL clustering, mirroring, or Availability Groups. To install the databases, you must run the MBAM Server installation on a stand-alone SQL server. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          SQL Server versionEditionService packSystem architecture

          Microsoft SQL Server 2008 R2

          Standard, Enterprise, or Datacenter Edition

          SP1

          64-bit

          Microsoft SQL Server 2012

          Standard, Enterprise, or Datacenter Edition

          SP1

          64-bit

          - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware componentMinimum requirementRecommended requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          8 GB

          12 GB

          Free disk space

          5 GB

          5 GB or greater

          - - - -## MBAM Client System Requirements - - -### Client Operating System Requirements - -The following table lists the operating systems that are supported for Microsoft BitLocker Administration and Monitoring Client installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Windows 7

          Enterprise or Ultimate Edition

          SP1

          32-bit or 64-bit

          Windows 8

          Enterprise Edition

          32-bit or 64-bit

          Windows To Go

          Windows 8 Enterprise Edition

          32-bit or 64-bit

          - - - -### Client RAM Requirements - -There are no RAM requirements that are specific to the Microsoft BitLocker Administration and Monitoring Client installation. - -## MBAM Group Policy System Requirements - - -The following table lists the operating systems that are supported for Microsoft BitLocker Administration and Monitoring Group Policy template installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Windows 7

          Enterprise, or Ultimate Edition

          SP1

          32-bit or 64-bit

          Windows 8

          Enterprise Edition

          32-bit or 64-bit

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter Edition

          SP1

          64-bit

          Windows Server 2012

          Standard or Datacenter Edition

          64-bit

          - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md b/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md deleted file mode 100644 index d4b80cfd3e..0000000000 --- a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Monitoring and Reporting BitLocker Compliance with MBAM 2.0 -description: Monitoring and Reporting BitLocker Compliance with MBAM 2.0 -author: msfttracyp -ms.assetid: 0b9ba701-0aad-4e16-9b32-73d358047ccc -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring and Reporting BitLocker Compliance with MBAM 2.0 - - -You can generate different reports to monitor BitLocker usage and compliance activities. - -If you chose the Configuration Manager topology when you installed Microsoft BitLocker Administration and Monitoring (MBAM), reports are generated from Configuration Manager rather than from MBAM. See [Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md) for more information. - -## Understand MBAM Reports - - -MBAM reports have many fields that you may want to be familiar with before generating MBAM reports. - -[Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md) - -## Generate MBAM Reports - - -You can generate reports on enterprise compliance, individual computer compliance, and key recovery activity. - -[How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md) - -## Other Resources for Monitoring and Reporting BitLocker Compliance with MBAM - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md b/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md deleted file mode 100644 index 34efacc60e..0000000000 --- a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Operations for MBAM 2.0 -description: Operations for MBAM 2.0 -author: msfttracyp -ms.assetid: ece72016-4ffa-48df-8c12-1e442ee9e980 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MBAM 2.0 - - -This section of the Microsoft BitLocker Administration and Monitoring (MBAM) Administrator’s Guide includes information about the various types of Microsoft BitLocker Administration and Monitoring administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - - -- [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - If you want to install MBAM to work with Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager, refer to this section for information about architecture, planning, deployment, and reporting. - -- [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - - After completing all necessary planning and then deploying MBAM, you can configure and use it to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day MBAM feature operations and maintenance tasks. - -- [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - This section describes how to generate and understand the different MBAM reports to monitor BitLocker usage and compliance activities throughout your enterprise environment. - -- [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - This section describes post-installation day-to-day BitLocker encryption management tasks that are accomplished by using MBAM. - -- [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - - This section describes how to configure MBAM to run in a highly available fashion while using it to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM as well as how to move MBAM Server features if necessary. - -- [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - - This section describes an overview of MBAM security considerations and explains many of the data collection and use practices of MBAM. - -- [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) - - This section describes the set of Windows PowerShell cmdlets available for administrators performing various MBAM Server tasks from the command line rather than from the Administration and Monitoring website. - -## Other Resources for MBAM Operations - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md b/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md deleted file mode 100644 index 5c2ed7373f..0000000000 --- a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Performing BitLocker Management with MBAM -description: Performing BitLocker Management with MBAM -author: msfttracyp -ms.assetid: 9bfc6c67-f12c-4daa-8f08-5884fb47443c -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing BitLocker Management with MBAM - - -After planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day BitLocker encryption management tasks that are accomplished by using Microsoft BitLocker Administration and Monitoring. - -## Reset a TPM Lockout by Using MBAM - - -A Trusted Platform Module (TPM) is a microchip that is designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer or laptop, and communicates with the rest of the system by using a hardware bus. Computers that incorporate a TPM have the ability to create cryptographic keys and encrypt them so that they can be decrypted only by the TPM. - -A TPM lockout can occur if a user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. You can use MBAM to access the centralized Key Recovery data system in the Administration and Monitoring website, where you can retrieve a TPM owner password file when you supply a computer ID and associated user identifier. - -[How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md) - -## Recover Drives with MBAM - - -When you are dealing with the encryption of data, especially in an enterprise environment, consider how that data can be recovered in the event of a hardware failure, changes in personnel, or other situations in which encryption keys can be lost. - -The encrypted drive recovery features of MBAM ensure that data can be captured and stored and that the required tools are available to access a BitLocker-protected volume when BitLocker goes into recovery mode, is moved, or becomes corrupted. - -[How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md) - -[How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) - -[How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) - -## Determine BitLocker Encryption State of Lost Computers by Using MBAM - - -Using MBAM, you can determine the last known BitLocker encryption status of computers that were lost or stolen. - -[How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md) - -## Use the Self-Service Portal to Regain Access to a Computer - - -If end users get locked out of Windows by BitLocker, they can use the instructions in this section to get a BitLocker recovery key to regain access to their computer. - -[How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md) - -## Other Resources for Performing BitLocker Management with MBAM - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md deleted file mode 100644 index 092ae557f4..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Planning for MBAM 2.0 Administrator Roles -description: Planning for MBAM 2.0 Administrator Roles -author: msfttracyp -ms.assetid: 6f813297-6479-42d3-a21b-896d54466b5b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Administrator Roles - - -This topic lists and describes the available administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM) as well as the server locations where the local groups are created. - -## MBAM Administrator Roles - - - **MBAM System Administrators** -Administrators in this role have access to all Microsoft BitLocker Administration and Monitoring features. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Helpdesk Users** -Administrators in this role have access to the Help Desk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Report Users** -Administrators in this role have access to the Compliance and Audit Reports from MBAM. The local group for this role is installed on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports. - - **MBAM Advanced Helpdesk Users** -Administrators in this role have increased access to the Help Desk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. If a user is a member of both MBAM Helpdesk Users and MBAM Advanced Helpdesk Users, the MBAM Advanced Helpdesk Users permissions will override the MBAM Helpdesk User permissions. - -**Important**   -To view reports, an administrative user must be a member of the **MBAM Report Users** security group on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports feature. As a best practice, create a security group in Active Directory Domain Services with rights on the local **MBAM Report Users** security group on both the Administration and Monitoring Server and the server that hosts the Compliance and Audit Reports. - - - -## Related topics - - -[Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md deleted file mode 100644 index 61c41aee4a..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Planning for MBAM 2.0 Client Deployment -description: Planning for MBAM 2.0 Client Deployment -author: msfttracyp -ms.assetid: 3a92cf29-092f-4cad-bdfa-d5f6aafe554b -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Client Deployment - - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client, you can enable BitLocker drive encryption on a computer in your organization either before the end user receives the computer or afterwards. For both the MBAM Stand-alone and the Configuration Manager topologies, you have to configure Group Policy settings for MBAM. - -If you are using the MBAM Stand-alone topology, it is recommended that you use an enterprise software deployment system to deploy the MBAM Client software to end-user computers. - -If you deploy MBAM with the Configuration Manager topology, you can use Configuration Manager to deploy the MBAM Client software to end-user computers. In Configuration Manager, the MBAM installation creates a collection of computers that MBAM can manage. This collection includes workstations and devices that do not have a Trusted Platform Module (TPM), but that are running Windows 8. - -**Note**   -Windows To Go is not supported for integrated Configuration Manager installations of MBAM if you are using Configuration Manager 2007. - - - -## Deploying the MBAM Client to Enable BitLocker Encryption After Computer Distribution to End Users - - -After you configure Group Policy, you can use an enterprise software deployment system product like Microsoft System Center Configuration Manager or Active Directory Domain Services (AD DS) to deploy the Windows Installer files of the MBAM Client installation to target computers. To deploy the MBAM Client, you can use either the 32-bit or 64-bit MbamClientSetup.exe files or MBAMClient.msi files, which are provided with the MBAM software. - -When you deploy the MBAM Client after you distribute computers to client computers, end users are prompted to encrypt their computer. This enables MBAM to collect the data, which includes the PIN and password, and then to begin the encryption process. - -**Note**   -In this approach, users who have computers with a TPM chip are prompted to activate and initialize the TPM chip if the chip has not been previously activated. - - - -## Using the MBAM Client to Enable BitLocker Encryption Before Computer Distribution to End Users - - -In organizations where computers are received and configured centrally, and where computers have a compliant TPM chip, you can install the MBAM Client to manage BitLocker encryption on each computer before any user data is written to it. The benefit of this process is that every computer will then be BitLocker encryption-compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. - -If your organization wants to use the TPM chip to encrypt computers, the administrator adds the TPM protector to encrypt the operating system volume of the computer. If your organization wants to use the TPM chip and a PIN protector, the administrator encrypts the operating system volume with the TPM protector, and then users select a PIN when they log on for the first time. If your organization decides to use only the PIN protector, the administrator does not have to encrypt the volume first. When users log on, Microsoft BitLocker Administration and Monitoring prompts them to provide a PIN, or a PIN and password to be used on later computer restarts. - -**Note**   -The TPM protector option requires the administrator to accept the BIOS prompt to activate and initialize the TPM before the computer is delivered to the user. - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md deleted file mode 100644 index 64b9b557da..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md +++ /dev/null @@ -1,328 +0,0 @@ ---- -title: Planning for MBAM 2.0 Group Policy Requirements -description: Planning for MBAM 2.0 Group Policy Requirements -author: msfttracyp -ms.assetid: f5e19dcb-eb15-4722-bb71-0734b3799eb8 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Group Policy Requirements - - -To manage Microsoft BitLocker Administration and Monitoring (MBAM) client computers, you need to consider the types of BitLocker protectors that you want to support in your organization, and then configure the corresponding Group Policy settings that you want to apply. This topic describes the Group Policy settings that are available for use when you are using Microsoft BitLocker Administration and Monitoring to manage BitLocker Drive Encryption in the enterprise. - -MBAM supports the following types of BitLocker protectors for operating system drives: Trusted Platform Module (TPM), TPM + PIN, TPM + USB key, and TPM + PIN + USB key, password, numerical password, and Data Recovery Agent. The password protector is supported only for Windows To Go devices and for Windows 8 devices that do not have a TPM. MBAM supports the TPM + USB key and the TPM + PIN + USB key protectors only when the operating system volume is encrypted before MBAM is installed. - -MBAM supports the following types of BitLocker protectors for fixed data drives: password, auto-unlock, numerical password, and Data Recovery Agent. - -The numeric password protector is applied automatically as part of volume encryption and does not need to be configured. - -**Important** -The default Windows BitLocker drive encryption Group Policy Object (GPO) settings are not used by MBAM and can cause conflicting behavior if they are enabled. To enable MBAM to manage BitLocker, you must define the MBAM Group Policy settings only after installing the MBAM Group Policy template. - - - -Enhanced startup PINs can contain characters, such as uppercase and lowercase letters, and numbers. Unlike BitLocker, MBAM does not support the use of symbols and spaces for enhanced PINs. - -Install the MBAM Group Policy template on a computer that is capable of running the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) MDOP technology. To edit the GPO settings that enable MBAM functionality, you must first install the MBAM Group Policy template, open the GPMC or AGPM to edit the applicable GPO, and then navigate to the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management).** - -The MDOP MBAM (BitLocker Management) GPO node contains four global policy settings and four child GPO settings nodes: Client Management, Fixed Drive, Operating System Drive, and Removable Drive. The following sections provide policy definitions and suggested policy settings to assist you in planning for MBAM GPO policy setting requirements. - -**Note** -For more information about configuring the minimum, recommended GPO settings to enable MBAM to manage BitLocker encryption, see [How to Edit MBAM 2.0 GPO Settings](how-to-edit-mbam-20-gpo-settings-mbam-2.md). - - - -## Global Policy Definitions - - -This section describes MBAM Global policy definitions found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Choose drive encryption method and cipher strength

          Suggested Configuration: Not Configured

          -

          Configure this policy to use a specific encryption method and cipher strength.

          -

          When this policy is not configured, BitLocker uses the default encryption method of AES 128-bit with Diffuser or the encryption method specified by the setup script.

          Prevent memory overwrite on restart

          Suggested Configuration: Not Configured

          -

          Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart.

          -

          When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts.

          Validate smart card certificate usage rule

          Suggested Configuration: Not Configured

          -

          Configure this policy to use smartcard certificate-based BitLocker protection.

          -

          When this policy is not configured, a default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate.

          Provide the unique identifiers for your organization

          Suggested Configuration: Not Configured

          -

          Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader.

          -

          When this policy is not configured, the Identification field is not used.

          -

          If your company requires higher security measurements, you may want to configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting.

          - - - -## Client Management Policy Definitions - - -This section describes Client Management policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Client Management**. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Settings

          Configure MBAM Services

          Suggested Configuration: Enabled

          -
            -
          • MBAM Recovery and Hardware service endpoint. Use this setting to enable MBAM Client BitLocker encryption management. Enter an endpoint location that is similar to the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMRecoveryAndHardwareService/CoreService.svc.

          • -
          • Select BitLocker recovery information to store. This policy setting lets you configure the key recovery service to back up BitLocker recovery information. It also lets you configure status reporting service for collecting compliance and audit reports. The policy provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to the lack of key information. Status report and key recovery activity will automatically and silently be sent to the configured report server location.

            -

            If you do not configure or if you disable this policy setting, the Key recovery information will not be saved, and status report and key recovery activity will not be reported to server. When this setting is set to Recovery Password and key package, the recovery password and key package will be automatically and silently backed up to the configured key recovery server location.

          • -
          • Enter client checking status frequency in minutes. This policy setting manages how frequently the client checks the BitLocker protection policies and status on the client computer. This policy also manages how frequently the client compliance status is saved to the server. The client checks the BitLocker protection policies and status on the client computer and also backs up the client recovery key at the configured frequency.

            -

            Set this frequency based on the requirement set by your company on how frequently to check the compliance status of the computer, and how frequently to back up the client recovery key.

          • -
          • MBAM Status reporting service endpoint. You must configure this setting to enable MBAM Client BitLocker encryption management. Enter an endpoint location that is similar to the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMComplianceStatusService/StatusReportingService.svc.

          • -

          Configure user exemption policy

          Suggested Configuration: Not Configured

          -

          This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption.

          -

          If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog that gives them instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.

          -

          If you either disable or do not configure this policy setting, the exemption request instructions will not be presented to users.

          -
          -Note

          User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer will be encrypted.

          -
          -
          - -

          Configure customer experience improvement program

          This policy setting lets you configure how MBAM users can join the Customer Experience Improvement Program. This program collects information about computer hardware and how users use MBAM without interrupting their work. The information helps Microsoft to identify which MBAM features to improve. Microsoft will not use this information to identify or contact MBAM users.

          -

          If you enable this policy setting, users will be able to join the Customer Experience Improvement Program.

          -

          If you disable this policy setting, users will not be able to join the Customer Experience Improvement Program.

          -

          If you do not configure this policy setting, users will have the option to join the Customer Experience Improvement Program.

          - - - -## Fixed Drive Policy Definitions - - -This section describes Fixed Drive policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Fixed Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Fixed data drive encryption settings

          Suggested Configuration: Enabled

          -

          This policy setting let you manage whether fixed drives must be encrypted.

          -

          If the operating system volume is required to be encrypted, select the Enable auto-unlock fixed data drive option.

          -

          When enabling this policy, you must not disable the Configure use of password for fixed data drives policy unless the use of Auto-Unlock for fixed data drives is allowed or required.

          -

          If you require the use of Auto-Unlock for fixed data drives, you must configure operating system volumes to be encrypted.

          -

          If you enable this policy setting, users are required to put all fixed drives under BitLocker protection, and the drives will be encrypted.

          -

          If you do not configure this policy setting, users are not required to put fixed drives under BitLocker protection. If you apply this policy after fixed data drives are encrypted, the MBAM agent decrypts the encrypted fixed drives.

          -

          If you disable this policy setting, users will not be able to put their fixed data drives under BitLocker protection.

          Deny write access to fixed drives not protected by BitLocker

          Suggested Configuration: Not Configured

          -

          This policy setting determines whether BitLocker protection is required for fixed drives to be writable on a computer. This policy setting is applied when you turn on BitLocker.

          -

          When the policy is not configured, all fixed data drives on the computer are mounted with read and write access.

          Allow access to BitLocker-protected fixed drives from earlier versions of Windows

          Suggested configuration: Not Configured

          -

          Enable this policy to let fixed drives with the FAT file system be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          -

          When the policy is enabled or not configured, fixed drives formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only access to BitLocker-protected drives.

          -

          When the policy is disabled, fixed drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          Configure use of password for fixed drives

          Suggested configuration: Not Configured

          -

          Use this policy to specify whether a password is required to unlock BitLocker-protected fixed data drives.

          -

          If you enable this policy setting, users can configure a password that meets the requirements you define. BitLocker will allow users to unlock a drive with any of the protectors that are available on the drive.

          -

          These settings are enforced when turning on BitLocker, not when unlocking a volume.

          -

          If you disable this policy setting, users are not allowed to use a password.

          -

          When the policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

          -

          For higher security, enable this policy and select Require password for fixed data drive, select Require password complexity, and set the desired minimum password length.

          -

          If you disable this policy setting, users are not allowed to use a password.

          -

          If you do not configure this policy setting, passwords will be supported with the default settings, which do not include password complexity requirements and which require only eight characters.

          Choose how BitLocker-protected fixed drives can be recovered

          Suggested Configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When the policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require recovery information to be backed up to AD DS.

          - - - -## Operating System Drive Policy Definitions - - -This section describes Operating System Drive policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Operating System Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Operating system drive encryption settings

          Suggested configuration: Enabled

          -

          This policy setting lets you manage whether the operating system drive must be encrypted.

          -

          For higher security, consider disabling the following policy settings in System/Power Management/Sleep Settings when you enable them with TPM + PIN protector:

          -
            -
          • Allow Standby States (S1-S3) When Sleeping (Plugged In)

          • -
          • Allow Standby States (S1-S3) When Sleeping (On Battery)

          • -
          -

          If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.

          -

          On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN).

          -

          If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive will be encrypted.

          -

          If you disable this policy, users will not be able to put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive will be decrypted.

          -

          If you do not configure this policy, the operating system drive is not required to be placed under BitLocker protection.

          Configure TPM platform validation profile

          Suggested Configuration: Not Configured

          -

          This policy setting lets you configure how the TPM security hardware on a computer secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

          -

          When this policy setting is not configured, the TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.

          Choose how BitLocker-protected operating system drives can be recovered

          Suggested Configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When this policy is not configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS.

          -

          MBAM operation does not require recovery information to be backed up to AD DS.

          - - - -## Removable Drive Policy Definitions - - -This section describes Removable Drive Policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Removable Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy NameOverview and Suggested Policy Setting

          Control use of BitLocker on removable drives

          Suggested configuration: Enabled

          -

          This policy controls the use of BitLocker on removable data drives.

          -

          Enable the Allow users to apply BitLocker protection on removable data drives option to allow users to run the BitLocker setup wizard on a removable data drive.

          -

          Enable the Allow users to suspend and decrypt BitLocker on removable data drives option to allow users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed.

          -

          When this policy is enabled and the Allow users to apply BitLocker protection on removable data drives option is selected, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server and allows users to recover the drive if the password is lost.

          Deny write access to removable drives not protected by BitLocker

          Suggested Configuration: Not Configured

          -

          Enable this policy to allow only write access to BitLocker protected drives.

          -

          When this policy is enabled, all removable data drives on the computer require encryption before write access is allowed.

          Allow access to BitLocker-protected removable drives from earlier versions of Windows

          Suggested Configuration: Not Configured

          -

          Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          -

          When this policy is not configured, removable data drives formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only access to BitLocker-protected drives.

          -

          When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          Configure use of password for removable data drives

          Suggested configuration: Not Configured

          -

          Enable this policy to configure password protection on removable data drives.

          -

          When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

          -

          For increased security, you may enable this policy and check Require password for removable data drive, select Require password complexity, and set the preferred minimum password length.

          Choose how BitLocker-protected removable drives can be recovered

          Suggested Configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When set to Not Configured, the data recovery agent is allowed and recovery information is not backed up to AD DS.

          -

          MBAM operation does not require recovery information to be backed up to AD DS.

          - - - -## Related topics - - -[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md deleted file mode 100644 index 49f97005ab..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Planning for MBAM 2.0 -description: Planning for MBAM 2.0 -author: msfttracyp -ms.assetid: 1206bd18-05ea-4ca8-9362-07e512503c3f -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft BitLocker Administration and Monitoring (MBAM) with the Stand-alone topology so that it does not disrupt your users or the network. If you want to install Microsoft BitLocker Administration and Monitoring with the Configuration Manager topology, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -You should consider a number of different deployment configurations and prerequisites before you deploy MBAM. This section describes the information that you need to formulate a deployment plan that best meets your business requirements, assists you in preparing your network and computing environment, and provides the information necessary for you to properly plan to deploy MBAM features. - -## Planning Information - - -- [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) - - This section describes the computing environment requirements and installation prerequisites that you should consider before beginning MBAM Setup. - -- [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - - This section describes the minimum hardware and software requirements for MBAM Client and Server feature installation. It also provides information about choosing an MBAM deployment topology, and lists other MBAM Server and Client planning considerations. - -- [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) - - This section provides a planning checklist that can assist you in MBAM deployment planning. - -## Other Resources for Planning for MBAM - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md deleted file mode 100644 index 63dda787ef..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Planning for MBAM 2.0 Server Deployment -description: Planning for MBAM 2.0 Server Deployment -author: msfttracyp -ms.assetid: b57f1a42-134f-4997-8697-7fbed08e2fc4 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Server Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of the enterprise. If you are installing Microsoft BitLocker Administration and Monitoring with the Configuration Manager topology, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -**Note**   -Installations of Microsoft BitLocker Administration and Monitoring on a single server are recommended only for test environments. - - - -## Planning for MBAM Server Deployment - - -The infrastructure for an MBAM Server deployment includes the following features: - -- Recovery Database - -- Compliance and Audit Database - -- Compliance and Audit Reports - -- Self-Service Portal - -- Administration and Monitoring Server - -- MBAM Group Policy Template - -MBAM Server databases and features can be installed in different configurations, depending on your scalability requirements. All MBAM Server features can be installed on a single server or distributed across multiple servers. We recommend that you use a two-server configuration for production environments, although configurations of two to four servers can also be used, depending on your computing requirements. - -Each MBAM feature has specific prerequisites. For a full list of server feature prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - -In addition to the server-related MBAM features, the Server Setup application includes an MBAM Group Policy template. The template contains Group Policy Object (GPO) settings that you configure to manage BitLocker Drive Encryption in the enterprise. You can install this template on any computer that can run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -As you plan the MBAM Server deployment, consider that BitLocker recovery keys in MBAM are intended for single use only, after which recovery keys expire. In order for the keys to expire after use, they must be retrieved through the Help Desk Portal or the Self-Service Portal. - -## Order of Deployment of MBAM Server Features - - -To deploy MBAM features on multiple servers, you have to install the features in the following order: - -1. Recovery Database - -2. Compliance and Audit Database - -3. Compliance Audit and Reports - -4. Self-Service Portal - -5. Administration and Monitoring Server - -6. MBAM Group Policy Template - -**Note**   -Keep track of the names of the computers on which you install each feature. You have to use this information throughout the installation process. You can print and use a deployment checklist to assist in this effort. For more information about the MBAM Deployment Checklist, see [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md). - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md deleted file mode 100644 index 58205559b9..0000000000 --- a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Planning to Deploy MBAM 2.0 -description: Planning to Deploy MBAM 2.0 -author: msfttracyp -ms.assetid: 2dc05fcd-aed9-4315-aeaf-92aaa9e0e955 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy MBAM 2.0 - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft BitLocker Administration and Monitoring (MBAM). This section includes information that can help you gather the necessary information to formulate a deployment plan that best meets your business requirements. If you are installing MBAM with the Configuration Manager topology, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md) for additional planning information. - -## Review the MBAM 2.0 Supported Configurations - - -After preparing your computing environment for the MBAM Server and Client feature installation, make sure that you review the Supported Configurations to confirm that the computers on which you are installing MBAM meet the minimum hardware and operating system requirements. For more information about MBAM deployment prerequisites, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md). - -[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - -## Plan for MBAM 2.0 Server and Client Deployment - - -The MBAM Server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of the enterprise. These features can be installed in a distributed configuration across multiple servers. - -**Note**   -An MBAM installation on a single server is recommended only for lab environments. - - - -The MBAM Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an enterprise software delivery system or by installing the client agent on client computers as part of the initial imaging process. - -With MBAM, you can encrypt a computer in your organization either before the end user receives the computer, or afterwards by using Group Policy. - -[Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) - -[Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) - -## Other Resources for MBAM Planning - - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md deleted file mode 100644 index 5a97d7bef6..0000000000 --- a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md +++ /dev/null @@ -1,368 +0,0 @@ ---- -title: Planning to Deploy MBAM with Configuration Manager -description: Planning to Deploy MBAM with Configuration Manager -author: msfttracyp -ms.assetid: fb768306-48c2-40b4-ac4e-c279db987391 -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Deploy MBAM with Configuration Manager - - -To deploy MBAM with the Configuration Manager topology, a three-server architecture, which supports 200,000 clients, is recommended. Use a separate server to run Configuration Manager, and install the basic Administration and Monitoring features on two servers, as shown in the architecture image in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md). - -**Important** -Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007. - - - -## Deployment Prerequisites for Installing MBAM with Configuration Manager - - -Ensure that you have met the following prerequisites before you install MBAM with Configuration Manager: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteAdditional Information

          Ensure that the Configuration Manager Server is a primary site in the Configuration Manager system.

          N/A

          Enable the Hardware Inventory Client Agent on the Configuration Manager Server.

          For Configuration Manager 2007, see How to Configure Hardware Inventory for a Site.

          -

          For System Center 2012 Configuration Manager, see How to Configure Hardware Inventory in Configuration Manager.

          Enable the Desired Configuration Management (DCM) agent or the compliance settings, depending on the version of Configuration Manager that you are using.

          For Configuration Manager 2007, enable the see Desired Configuration Management Client Agent Properties.

          -

          For System Center 2012 Configuration Manager, see Configuring Compliance Settings in Configuration Manager.

          Define a reporting services point in Configuration Manager. Required for SQL Reporting Services.

          For Configuration Manager 2007, see How to Create a Reporting Services Point for SQL Reporting Services.

          -

          For System Center 2012 Configuration Manager, see Prerequisites for Reporting in Configuration Manager.

          - - - -## Configuration Manager Supported Versions - - -MBAM supports the following versions of Configuration Manager: - - ----- - - - - - - - - - - - - - - - - - - - -
          Supported versionService packSystem architecture

          Microsoft System Center Configuration Manager 2007 R2

          SP1 or later

          64-bit

          -
          -Note

          Although Configuration Manager 2007 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software.

          -
          -
          - -

          Microsoft System Center 2012 Configuration Manager

          SP1

          64-bit

          - - - -For a list of supported configurations for the Configuration Manager Server, see the appropriate webpage for the version of Configuration Manager that you are using. MBAM has no additional system requirements for the Configuration Manager Server. - -## MBAM and SQL Server System Requirements - - -The supported configurations and system requirements for the MBAM servers and SQL Server for the Configuration Manager topology are the same as those for the Stand-alone topology. For the Stand-alone system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). For the MBAM Server and SQL Server processor, RAM, and disk space requirements for the Configuration Manager topology, see the following sections. - -## MBAM Server Processor, RAM, and Disk Space Requirements for MBAM - - -The following table lists the server processor, RAM, and disk space requirements for MBAM servers when you are using the Configuration Manager Integration topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware ComponentMinimum RequirementRecommended Requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          4 GB

          8 GB

          Free disk space

          1 GB

          2 GB

          - - - -## SQL Server Processor, RAM, and Disk Space Requirements - - -The following table lists the server processor, RAM, and disk space requirements for the SQL Server computer when you are using the Configuration Manager Integration topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware ComponentMinimum RequirementRecommended Requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          4 GB

          8 GB

          Free disk space

          5 GB

          5 GB or greater

          - - - -## Required permissions to install the MBAM Server - - -To install MBAM with Configuration Manager, you must have an administrative user in Configuration Manager who has a security role with the minimum permissions listed in the following table. The table also shows the rights that you must have, beyond basic computer administrator rights, to install the MBAM Server. - - ---- - - - - - - - - - - - - - - - - -
          PermissionsMBAM Server Feature

          SQL instance Login Server Roles: - dbcreator- processadmin

          - Recovery Database- Audit Database

          SQL Server Reporting Services instance rights: - Create Folders- Publish Reports

          - System Center Configuration Manager Integration

          - - - -**System Center 2012 Configuration Manager** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PermissionsConfiguration Manager Server Feature

          Configuration Manager site rights:- Read

          System Center Configuration Manager integration

          Configuration Manager collection rights: - Create- Delete- Read- Modify- Deploy Configuration Items

          System Center Configuration Manager integration

          Configuration Manager configuration item rights: - Create- Delete- Read

          System Center Configuration Manager integration

          - - - -**Configuration Manager 2007** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PermissionsConfiguration Manager Server Feature

          Configuration Manager site rights:- Read

          System Center Configuration Manager integration

          Configuration Manager collection rights: - Create- Delete- Read- ReadResource

          System Center Configuration Manager integration

          Configuration Manager configuration item rights: - Create- Delete- Read- Distribute

          System Center Configuration Manager integration

          - - - -## Order of Deployment of MBAM Features for the Configuration Manager Topology - - -When deploying MBAM on the Configuration Manager Server, you must complete the deployment tasks in the following order: - -1. Edit the configuration.mof file on the Configuration Manager Server. - -2. Create or edit the sms\_def.mof file Configuration Manager Server. - -3. Install MBAM on the Configuration Manager Server. - -4. Install the Recovery Database and the Audit Database on the Database server. - -5. Install the MBAM features on the Administration and Monitoring Server. - -## Planning Checklist for Installing MBAM with Configuration Manager - - -This checklist outlines the recommended steps and a high-level list of items to consider when planning for an Microsoft BitLocker Administration and Monitoring deployment with Configuration Manager. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the getting started information, which describes how Configuration Manager works with MBAM and shows the recommended high-level architecture.

          Getting Started - Using MBAM with Configuration Manager

          Checklist box

          Review the planning information, which describes the deployment prerequisites, supported configurations, required permissions, and deployment order for each feature.

          Planning to Deploy MBAM with Configuration Manager

          Checklist box

          Plan for and configure MBAM Group Policy requirements.

          Planning for MBAM 2.0 Group Policy Requirements

          Checklist box

          Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

          Planning for MBAM 2.0 Administrator Roles

          Checklist box

          Plan for deploying MBAM Client deployment.

          Planning for MBAM 2.0 Client Deployment

          - - - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - - - - - - - - diff --git a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md b/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md deleted file mode 100644 index 726098f4e6..0000000000 --- a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Preparing your Environment for MBAM 2.0 -description: Preparing your Environment for MBAM 2.0 -author: msfttracyp -ms.assetid: 5fb01da9-620e-4992-9e54-2ed3fb69e6af -ms.reviewer: -manager: dansimp -ms.author: tracyp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing your Environment for MBAM 2.0 - - -Before beginning Microsoft BitLocker Administration and Monitoring (MBAM) Setup, you should make sure that you have met the prerequisites to install the product. When you know what the prerequisites are ahead of time, you can efficiently deploy the product and enable its features so that it most effectively supports your organization’s business objectives. - -If you are deploying Microsoft BitLocker Administration and Monitoring with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -## Review MBAM 2.0 Deployment Prerequisites - - -The MBAM Client and each of the MBAM Server features have specific prerequisites that must be met before they can be successfully installed. - -To ensure successful installation of MBAM Clients and MBAM Server features, ensure that computers specified for MBAM Client or MBAM Server feature installation are properly prepared for MBAM Setup. - -**Note**   -MBAM Setup checks that all prerequisites are met before installation starts. If all prerequisites are not met, Setup will fail. - - - -[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - -## Plan for MBAM 2.0 Group Policy Requirements - - -Before MBAM can manage clients in the enterprise, you must define Group Policy for the encryption requirements of your environment. - -**Important**   -MBAM will not work with policies for stand-alone BitLocker drive encryption. Group Policy settings must be defined for MBAM, or BitLocker encryption and enforcement will fail. - - - -[Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) - -## Plan for MBAM 2.0 Administrator Roles - - -MBAM administrator roles are managed by local groups that are created by MBAM Setup when you install the BitLocker Administration and Monitoring Server, the Compliance and Audit Reports feature, and the Compliance and Audit Status Database. - -The membership of Microsoft BitLocker Administration and Monitoring roles can best be managed by creating security groups in Active Directory Domain Services, adding the appropriate administrator accounts to those groups, and then adding those security groups to the BitLocker Administration and Monitoring local groups. For more information, see [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md). - -## Other Resources for MBAM Planning - - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md deleted file mode 100644 index 2bbbd782ed..0000000000 --- a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,296 +0,0 @@ ---- -title: Release Notes for MBAM 2.0 -description: Release Notes for MBAM 2.0 -author: dansimp -ms.assetid: c3f16cf3-94f2-47ac-b3a4-3dc505c6a8dd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for MBAM 2.0 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.0. These release notes contain information that is required to successfully install BitLocker Administration and Monitoring 2.0 and contain information that is not available in the product documentation. If there is a difference between these release notes and other MBAM 2.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.0 Known Issues - - -This section contains release notes for MBAM 2.0. - -### Computer Name field may not appear in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you run MBAM with Microsoft System Center Configuration Manager 2007 - -The Computer Name field may be blank in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you use MBAM with Configuration Manager 2007. - -WORKAROUND: None. - -### Enterprise Compliance Report fails to update after you upgrade the Stand-alone MBAM server infrastructure - -If you are using the MBAM Stand-alone topology, and you upgrade the server infrastructure from version 1.0 to 2.0, the Enterprise Compliance Report fails to update. - -WORKAROUND: After the upgrade, run the following script on the Compliance and Audit Database: - -```sql --- ============================================= --- Script Template --- ============================================= - -DECLARE @DatabaseName nvarchar(255); -SET @DatabaseName = DB_NAME() - -USE msdb; - -DECLARE @JobID BINARY(16) -SELECT @JobID = job_id -FROM msdb.dbo.sysjobs -WHERE (name = N'CreateCache') - -if (@JobID IS NOT NULL) -BEGIN - EXEC dbo.sp_delete_job - @job_name = N'CreateCache'; -END - -EXEC dbo.sp_add_job - @job_name = N'CreateCache', - @enabled = 1; - -EXEC dbo.sp_add_jobstep - @job_name = N'CreateCache', - @step_name = N'Copy Data', - @subsystem = N'TSQL', - @command = N'EXEC [ComplianceCore].UpdateCache', - @database_name = @DatabaseName, - @retry_attempts = 5, - @retry_interval = 5; - - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule1am', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 010000, - @active_end_time = 020000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule1am'; - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule7am', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 070000, - @active_end_time = 080000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule7am'; - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule1pm', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 130000, - @active_end_time = 140000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule1pm'; - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule7pm', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 190000, - @active_end_time = 200000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule7pm'; - -EXEC dbo.sp_add_jobserver - @job_name = N'CreateCache'; -``` - -### Reports in the Help Desk Portal display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then browse to the Help Desk Portal and select a report, the following message displays: “Only Secure Content is Displayed.” - -WORKAROUND: To show the report, click **Show All Content**. To address this issue, go to the MBAM computer where SQL Server Reporting Services is installed, run **Reporting Services Configuration Manager**, and then click **Web Service URL**. Select the appropriate SSL certificate for the server, enter the appropriate SSL port (the default port is 443), and then click **Apply**. - -### Non-default instances of the Configuration Manager database are not supported - -MBAM looks only for the default instance of the Configuration Manager database in Configuration Manager 2007 and System Center 2012 Configuration Manager. If you use a non-default instance, you cannot install MBAM. - -WORKAROUND: None. - -### Clicking “Back” in the Compliance Summary report might throw an error - -If you drill down into a Compliance Summary report, and then click the **Back** link in the SSRS report, an error might be thrown. - -WORKAROUND: None. - -### Used Space Only Encryption does not work correctly - -If you encrypt a computer for the first time after you install the MBAM Client, and you have set a Group Policy Object to implement Used Space Only encryption, MBAM erroneously encrypts the entire disk instead of encrypting only the disk’s used space. If a computer is already encrypted when you install the MBAM Client, and you have set the same Group Policy Object, the encryption works correctly and encrypts only the used disk space on your computer. - -WORKAROUND: None. - -### Cipher strength displays incorrectly on the Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the Computer Compliance report in the Configuration Manager Integration topology always displays “unknown” for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -WORKAROUND: Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution By Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -WORKAROUND: None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration may cause reports to display incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an “Access Denied” message might appear when you try to view reports on the MBAM Server. By default, ESC is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -WORKAROUND: If the “Access Denied” message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which ESC is not enabled. - -### MBAM Server installation fails when you upgrade from SQL Server 2008 to SQL Server 2012 - -If you upgrade from SQL Server 2008 to SQL Server 2012, and then try to install the Compliance and Audit Database or the Recovery Database, the installation fails and rolls back. The failure occurs because the required SQLCMD.exe file was removed during the SQL upgrade and cannot be found by the MBAM installer. The MSI log file lines may look similar to the following: - -RunDbInstallScript Recovery Db CA: BinDir - E:\\MSSQL\\100\\Tools\\Binn\\SqlCmd.exeRunDbInstallScript Recovery Db CA: dbInstance - xxxxxx\\I01RunDbInstallScript Recovery Db CA: sqlScript- C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sqlRunDbInstallScript Recovery Db CA: dbName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultFileName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultDataPath- F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\RunDbInstallScript Recovery Db CA: defaultLogPath- K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\RunDbInstallScript Recovery Db CA: scriptLogPath - C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log-e -E -S xxxxxxx\\I01 -i "C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sql" -v DatabaseName="MBAM\_Recovery\_and\_Hardware" DefaultFileName="MBAM\_Recovery\_and\_Hardware" DefaultDataPath="F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\" DefaultLogPath="K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\" -o "C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log"RunDbInstallScript Recovery Db CA:Starting to run the Recovery database install scriptRunDbInstallScript Recovery Db CA: Sqlcmd log file is located in C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\\\InstallKeyRecoveryDatabase.logRunDbInstallScript Recovery Db CA Exception: Install Recovery database Custom Action command line output Exception: The system cannot find the file specified - -The MBAM Server Windows Installer is hardcoded to find the SQLCMD.exe path by looking in the Path string value in the registry under HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup. The key is still present during the migration from SQL Server 2008 to SQL Server 2012, but the path that is referenced by the data value does not contain the SQLCMD.exe file, because the SQL upgrade process removed the file. - -WORKAROUND: Temporarily rename the HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup Path string value to **Path\_old**, and then re-run the MBAM Server Windows Installer. When the installation completes successfully and creates the databases in SQL Server 2012, rename the **Path\_old** value to **Path**. - -## Hotfixes and Knowledge Base articles for MBAM 2.0 - - -This section contains hotfixes and KB articles for MBAM 2.0. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KB ArticleTitleLink

          2831166

          Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed"

          support.microsoft.com/kb/2831166/EN-US

          2870849

          Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal

          support.microsoft.com/kb/2870849/EN-US

          2756402

          MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description

          support.microsoft.com/kb/2756402/EN-US

          2620287

          Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM

          support.microsoft.com/kb/2620287/EN-US

          2639518

          Error opening Enterprise or Computer Compliance Reports in MBAM

          support.microsoft.com/kb/2639518/EN-US

          2620269

          MBAM Enterprise Reporting Not Getting Updated

          support.microsoft.com/kb/2620269/EN-US

          2712461

          Installing MBAM on a Domain Controller is not supported

          support.microsoft.com/kb/2712461/EN-US

          2876732

          You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0

          support.microsoft.com/kb/2876732/EN-US

          2754259

          MBAM and Secure Network Communication

          support.microsoft.com/kb/2754259/EN-US

          2870842

          MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008

          support.microsoft.com/kb/2870842/EN-US

          2668533

          MBAM Setup fails if SQL SSRS is not configured properly

          support.microsoft.com/kb/2668533/EN-US

          2870847

          MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"

          support.microsoft.com/kb/2870847/EN-US

          2870839

          MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure

          support.microsoft.com/kb/2870839/EN-US

          2620269

          MBAM Enterprise Reporting Not Getting Updated

          support.microsoft.com/kb/2620269/EN-US

          2935997

          MBAM Supported Computers compliance reporting incorrectly includes unsupported products

          support.microsoft.com/kb/2935997/EN-US

          2612822

          Computer Record is Rejected in MBAM

          support.microsoft.com/kb/2612822/EN-US

          - - - -## Related topics - - -[About MBAM 2.0](about-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md b/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md deleted file mode 100644 index 9fb4028a56..0000000000 --- a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md +++ /dev/null @@ -1,244 +0,0 @@ ---- -title: Release Notes for MBAM 2.0 SP1 -description: Release Notes for MBAM 2.0 SP1 -author: dansimp -ms.assetid: b39002ba-33c6-45ec-9d1b-464327b60f5c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for MBAM 2.0 SP1 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1). These release notes contain information that is required to successfully install BitLocker Administration and Monitoring 2.0 SP1, and they contain information that is not available in the product documentation. If there is a difference between these release notes and other MBAM 2.0 SP1 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.0 SP1 known issues - - -This section contains known issues for MBAM 2.0 SP1. - -### Upgrade of MBAM with Configuration Manager Integrated topology to MBAM 2.0 SP1 requires manual removal of Configuration Manager objects - -If you are using MBAM with Configuration Manager, and you want to upgrade to MBAM 2.0 SP1, you must manually remove all of the Configuration Manager objects that were installed into Configuration Manager as a part of the MBAM installation. The objects that you must manually remove are the MBAM reports, MBAM Supported Computers collection, and the BitLocker Protection Configuration Baseline and its associated configuration items. - -**Workaround**: Upgrade the Configuration Manager objects by completing the following steps: - -1. Back up existing compliance data to an external file, as described in the following steps. - - **Note**   - All existing BitLocker compliance data will be deleted when you delete the existing baseline in Configuration Manager. The data will be regenerated over time, but it is recommended that you save a copy of the data in case you need the compliance data for a particular computer before the compliance data has been regenerated. - - - - 1. To save historical BitLocker compliance data, open the **BitLocker Enterprise Compliance Details** Report. - - 2. Click the **Save** icon in the report and select **Excel**. - - The saved report will contain data such as the computer name, domain name, compliance status, exemption, device users, compliance status details, and last contact date/time. Some information, such as detailed volume information and encryption strength, are not saved. - -2. Uninstall **MBAM** from the server by using the **MBAM** installer. - -3. Manually delete the following objects from Configuration Manager: - - - MBAM Supported Computers collection - - - BitLocker Protection baseline - - - BitLocker Operating System Drive Protection configuration item - - - BitLocker Fixed Data Drives Protection configuration item - -4. Manually delete the MBAM Reports folder in the Configuration Manager SQL Server Reporting Services site. To do this: - - 1. Use Internet Explorer to browse to the reporting services point, for example, http://<yourcmserver>/reports. - - 2. Click the appropriate Configuration Manager site code link. - - 3. Delete the MBAM folder. - -5. Use the MBAM Server installer to reinstall the Configuration Manager Integration objects. The client computers will begin to upload BitLocker compliance data again over time. - -### Submit button on Self-Service Portal does not work in Internet Explorer 10 - -When you use Internet Explorer 10 to access the Administration and Monitoring Website, the **Submit** button on the website does not work. - -**Workaround**: On the server where you installed the Administration and Monitoring Website, install [Hotfix for ASP.NET browser definition files](https://go.microsoft.com/fwlink/?LinkId=317798). - -### International domain names are not supported - -MBAM 2.0 SP1 does not support international domain names. - -**Workaround**: None. - -### Reports in the Administration and Monitoring website display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then browse to the Administration and Monitoring website and select a report, the following message displays: “Only Secure Content is Displayed.” - -**Workaround**: To correct this issue, configure SSL in **Reporting Services Configuration Manager** on the MBAM server where SQL Server Reporting Services is installed. Uninstall and then reinstall the Administration and Monitoring Server website. - -### Clicking Back in the Compliance Summary report might create an error - -If you drill down into a Compliance Summary report, and then click the **Back** link in the SSRS report, an error might occur. - -**Workaround**: None. - -### Used Space Only Encryption does not work correctly - -If you encrypt a computer for the first time after you install the MBAM Client, and you have set a Group Policy Object to implement Used Space Only Encryption, MBAM erroneously encrypts the entire disk instead of encrypting only the disk’s used space. If a computer is already encrypted with Used Space Only Encryption before you install the MBAM Client, and you have set the same Used Space Only Encryption Group Policy Object, MBAM recognizes the setting and reports the encryption correctly in the compliance reports. - -**Workaround**: None. - -### Cipher strength displays incorrectly in the Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the Computer Compliance report in the Configuration Manager integrated topology always displays **Unknown** for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -**Workaround**: Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution By Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -**Workaround**: None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration may cause reports to display incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an **Access Denied** message might appear when you try to view reports on the MBAM Server. By default, Enhanced Security Configuration is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -**Workaround**: If the **Access Denied** message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which Enhanced Security Configuration is not enabled. - -### MBAM Server installation fails when you upgrade from SQL Server 2008 to SQL Server 2012 - -If you upgrade from SQL Server 2008 to SQL Server 2012, and then try to install the Compliance and Audit Database or the Recovery Database, the installation fails and rolls back. The failure occurs because the required SQLCMD.exe file was removed during the SQL Server upgrade, and it cannot be found by the MBAM installer. The MSI log file lines may look similar to the following: - -RunDbInstallScript Recovery Db CA: BinDir - E:\\MSSQL\\100\\Tools\\Binn\\SqlCmd.exeRunDbInstallScript Recovery Db CA: dbInstance - xxxxxx\\I01RunDbInstallScript Recovery Db CA: sqlScript- C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sqlRunDbInstallScript Recovery Db CA: dbName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultFileName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultDataPath- F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\RunDbInstallScript Recovery Db CA: defaultLogPath- K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\RunDbInstallScript Recovery Db CA: scriptLogPath - C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log-e -E -S xxxxxxx\\I01 -i "C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sql" -v DatabaseName="MBAM\_Recovery\_and\_Hardware" DefaultFileName="MBAM\_Recovery\_and\_Hardware" DefaultDataPath="F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\" DefaultLogPath="K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\" -o "C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log"RunDbInstallScript Recovery Db CA:Starting to run the Recovery database install scriptRunDbInstallScript Recovery Db CA: Sqlcmd log file is located in C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\\\InstallKeyRecoveryDatabase.logRunDbInstallScript Recovery Db CA Exception: Install Recovery database Custom Action command line output Exception: The system cannot find the file specified - -The MBAM Server Windows Installer is hardcoded to find the SQLCMD.exe path by looking in the Path string value in the registry under HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup. The key is still present during the migration from SQL Server 2008 to SQL Server 2012, but the path that is referenced by the data value does not contain the SQLCMD.exe file, because the SQL upgrade process removed the file. - -**Workaround**: Temporarily rename the HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup path string value to **Path\_old**, and then run Windows Installer on the MBAM Server again. When the installation completes successfully and creates the databases in SQL Server 2012, rename **Path\_old** to **Path**. - -## Hotfixes and Knowledge Base articles for MBAM 2.0 SP1 - - -This section contains hotfixes and KB articles for MBAM 2.0 SP1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KB ArticleTitleLink

          2831166

          Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed"

          support.microsoft.com/kb/2831166/EN-US

          2870849

          Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal

          support.microsoft.com/kb/2870849/EN-US

          2756402

          MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description

          support.microsoft.com/kb/2756402/EN-US

          2620287

          Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM

          support.microsoft.com/kb/2620287/EN-US

          2639518

          Error opening Enterprise or Computer Compliance Reports in MBAM

          support.microsoft.com/kb/2639518/EN-US

          2620269

          MBAM Enterprise Reporting Not Getting Updated

          support.microsoft.com/kb/2620269/EN-US

          2712461

          Installing MBAM on a Domain Controller is not supported

          support.microsoft.com/kb/2712461/EN-US

          2876732

          You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0

          support.microsoft.com/kb/2876732/EN-US

          2754259

          MBAM and Secure Network Communication

          support.microsoft.com/kb/2754259/EN-US

          2870842

          MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008

          support.microsoft.com/kb/2870842/EN-US

          2668533

          MBAM Setup fails if SQL SSRS is not configured properly

          support.microsoft.com/kb/2668533/EN-US

          2870847

          MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"

          support.microsoft.com/kb/2870847/EN-US

          2870839

          MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure

          support.microsoft.com/kb/2870839/EN-US

          2620269

          MBAM Enterprise Reporting Not Getting Updated

          support.microsoft.com/kb/2620269/EN-US

          2935997

          MBAM Supported Computers compliance reporting incorrectly includes unsupported products

          support.microsoft.com/kb/2935997/EN-US

          2612822

          Computer Record is Rejected in MBAM

          support.microsoft.com/kb/2612822/EN-US

          - - - -## Related topics - - -[About MBAM 2.0 SP1](about-mbam-20-sp1.md) - - - - - - - - - diff --git a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md b/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md deleted file mode 100644 index 0a0a6f60c0..0000000000 --- a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for MBAM 2.0 -description: Security and Privacy for MBAM 2.0 -author: dansimp -ms.assetid: 1b2859f8-2381-4ad7-8744-2caed88570ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for MBAM 2.0 - - -Use the following information to help you plan for security and privacy considerations in Microsoft BitLocker Administration and Monitoring (MBAM). - -## Security Considerations for MBAM 2.0 - - -There are many security-related considerations that should be planned for when deploying and using MBAM in your environment. The information in this section provides a brief overview about the Active Directory Domain Services user accounts and groups, log files, and other security-related considerations for MBAM. - -[MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md) - -## Privacy for MBAM 2.0 - - -The information in this section explains many of the data collection and use practices of MBAM. - -[MBAM 2.0 Privacy Statement](mbam-20-privacy-statement-mbam-2.md) - -## Other resources MBAM Security and Privacy - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md b/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md deleted file mode 100644 index 7ea7004d1c..0000000000 --- a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting MBAM 2.0 -description: Troubleshooting MBAM 2.0 -author: dansimp -ms.assetid: 43933ec7-b5b8-49c5-813f-4c06aa7314ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting MBAM 2.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting MBAM - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md b/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md deleted file mode 100644 index 4e367f90d7..0000000000 --- a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md +++ /dev/null @@ -1,450 +0,0 @@ ---- -title: Understanding MBAM Reports in Configuration Manager -description: Understanding MBAM Reports in Configuration Manager -author: dansimp -ms.assetid: b2582190-c9de-4e64-bd5a-f31ac1916f53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM Reports in Configuration Manager - - -When Microsoft BitLocker Administration and Monitoring (MBAM) is installed with the Configuration Manager Integrated topology, the hardware compliance and reporting features are moved into the Configuration Manager infrastructure and out of MBAM. When you use the Configuration Manager topology, you run reports from Configuration Manager rather than from MBAM, except for the Recovery Audit Report, which you continue to access by using the Administration and Monitoring Website. - -The reports for the Configuration Manager Integrated topology show BitLocker compliance for the enterprise and for individual computers and devices that MBAM manages. The reports provide both tabular information and charts, and enable you to filter reports to view data from different perspectives. - -The information in this topic describes the MBAM reports that you run from Configuration Manager. For information about MBAM reports for the Stand-alone topology, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md). - -## Accessing Reports in Configuration Manager - - -To access the Reports feature in Configuration Manager, open the **Configuration Manager console**. To display the list of available reports: - -- In Configuration Manager 2007, expand the **Computer Management** node, and then expand the **Reporting** node. - -- In System Center 2012 Configuration Manager, in the Monitoring workspace under **Overview**, expand the **Reporting** node and then click **Reports**. - -### BitLocker Enterprise Compliance Dashboard - -The BitLocker Enterprise Compliance Dashboard provides the following graphs, which show BitLocker compliance status across the enterprise: - -- Compliance Status Distribution - -- Non Compliant Errors Distribution - -- Compliance Status Distribution by Drive Type - -**Compliance Status Distribution** - -This pie chart shows computer compliance statuses within the enterprise, and shows the percentage of computers, compared to the total number of computers in the selected collection, that have that compliance status. The actual number of computers with each status is also shown. The pie chart shows the following compliance statuses: - -- Compliant - -- Non Compliant - -- User Exempt - -- Temporary User Exempt - -- Policy Not Enforced - -- Unknown -computers whose status was reported as an error, or devices that are part of the collection but have never reported their compliance status, for example, if they are disconnected from the organization - -**Non Compliant Errors Distribution** - -This pie chart shows the categories of computers in the enterprise that are not compliant with the BitLocker drive encryption policy, and shows the number of computers in each category. Each category percentage is calculated from the total number of non-compliant computers in the collection. - -- User postponed encryption - -- Unable to find compatible TPM - -- System Partition not available or large enough - -- Policy conflict - -- Waiting for TPM auto provisioning - -- An unknown error has occurred - -- No information – computers that do not have the MBAM Client installed, or that have the MBAM Client installed but not activated, for example, the service is not working - -**Compliance Status Distribution by Drive Type** - -This bar chart shows the current BitLocker compliance status by drive type. The statuses are “Compliant” and “Non Compliant.” Bars are shown for fixed data drives and operating system drives. Computers that do not have a fixed data drive are included and show a value only in the Operating System Drive bar. The chart does not include users who have been granted an exemption from the BitLocker drive encryption policy or the “No Policy” category. - -### BitLocker Enterprise Compliance Details Report - -This report shows information about the overall BitLocker compliance across your enterprise for the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Details Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Managed Computers

          Number of computers that MBAM manages.

          % Compliant

          Percentage of compliant computers in the enterprise.

          % Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          % Unknown Compliance

          Percentage of computers whose compliance state is not known.

          % Exempt

          Percentage of computers exempt from the BitLocker encryption requirement.

          % Non-Exempt

          Percentage of computers exempt from the BitLocker encryption requirement.

          Compliant

          Percentage of compliant computers in the enterprise.

          Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          Unknown Compliance

          Percentage of computers whose compliance state is not known.

          Exempt

          Total computers that are exempt from the BitLocker encryption requirement.

          Non-Exempt

          Total computers that are not exempt from the BitLocker encryption requirement.

          - - - -**BitLocker Enterprise Compliance Details Report - Compliance States** - - ----- - - - - - - - - - - - - - - - - - - - -
          Compliance StatusExemptionDescription

          Noncompliant

          Not Exempt

          The computer is noncompliant, according to the specified policy.

          Compliant

          Not Exempt

          The computer is compliant in accordance with the specified policy.

          - - - -### BitLocker Enterprise Compliance Summary Report - -Use this report type to show information about the overall BitLocker compliance across your enterprise and to show the compliance for individual computers that are in the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Summary Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Managed Computers

          Number of computers that MBAM manages.

          % Compliant

          Percentage of compliant computers in the enterprise.

          % Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          % Unknown Compliance

          Percentage of computers whose compliance state is not known.

          % Exempt

          Percentage of computers exempt from the BitLocker encryption requirement.

          % Non-Exempt

          Percentage of computers exempt from the BitLocker encryption requirement.

          Compliant

          Percentage of compliant computers in the enterprise.

          Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          Unknown Compliance

          Percentage of computers whose compliance state is not known.

          Exempt

          Total computers that are exempt from the BitLocker encryption requirement.

          Non-Exempt

          Total computers that are not exempt from the BitLocker encryption requirement.

          - - - -**BitLocker Enterprise Compliance Summary Report - Computer Details** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS computer name that is being managed by MBAM.

          Domain Name

          Fully qualified domain name, where the client computer resides and is managed by MBAM.

          Compliance Status

          Overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified.

          Exemption

          Status that indicates whether the user is exempt or non-exemption from the BitLocker policy.

          Device Users

          User of the device.

          Compliance Status Details

          Error and status messages of the compliance state of the computer in accordance to the policy specified.

          Last Contact

          Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

          - - - -### BitLocker Computer Compliance Report - -Use this report type to collect information that is specific to a computer. The Computer Compliance Report provides detailed encryption information about each drive (Operating System and Fixed data drives) on a computer, and also an indication of the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note**   -Removable Data Volume encryption status is not shown in the report. - - - -**BitLocker Computer Compliance Report – Computer Details Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS computer name that is being managed by MBAM.

          Domain Name

          Fully qualified domain name, where the client computer resides and is managed by MBAM.

          Computer Type

          Type of computer. Valid types are non-Portable and Portable.

          Operating System

          Operating System type found on the MBAM managed client computer.

          Overall Compliance

          Overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified.

          Operating System Compliance

          Compliance status of the operating system that is managed by MBAM. Valid states are Compliant and Noncompliant.

          Fixed Data Drive Compliance

          Compliance status of the Fixed Data Drive that is managed by MBAM. Valid states are Compliant and Noncompliant.

          Last Update Date

          Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

          Exemption

          Status that indicates whether the user is exempt or non-exemption from the BitLocker policy.

          Exempted User

          User who is exempt from the BitLocker policy.

          Exemption Date

          Date on which the exemption was granted.

          Compliance Status Details

          Error and status messages of the compliance state of the computer in accordance to the policy specified.

          Policy Cipher Strength

          Cipher Strength selected by the Administrator during MBAM policy specification. (for example, 128-bit with Diffuser).

          Policy: Operating System Drive

          Indicates if encryption is required for the O/S and the appropriate protector type.

          Policy:Fixed Data Drive

          Indicates if encryption is required for the Fixed Drive.

          Manufacturer

          Computer manufacturer name as it appears in the computer BIOS.

          Model

          Computer manufacturer model name as it appears in the computer BIOS.

          Device Users

          Known users on the computer that is being managed by MBAM.

          - - - -**BitLocker Computer Compliance Report – Computer Volume Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Drive Letter

          Computer drive letter that was assigned to the particular drive by the user.

          Drive Type

          Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

          Cipher Strength

          Cipher Strength selected by the Administrator during MBAM policy specification.

          Protector Types

          Type of protector selected via policy used to encrypt an operating system or Fixed volume. The valid protector types on an operating system are TPM or TPM+PIN and for a Fixed Data Volume is Password.

          Protector State

          Indicates that the computer being managed by MBAM has enabled the protector type specified in the policy. The valid states are ON or OFF.

          Encryption State

          Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

          - - - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - - - - - - - - diff --git a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md b/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md deleted file mode 100644 index 4e1f2addc4..0000000000 --- a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md +++ /dev/null @@ -1,326 +0,0 @@ ---- -title: Understanding MBAM Reports -description: Understanding MBAM Reports -author: dansimp -ms.assetid: 8778f333-760e-4f26-acb4-4e73b6fbb536 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM Reports - - -If you chose the Stand-alone topology when you installed Microsoft BitLocker Administration and Monitoring (MBAM), you can run different reports in MBAM to monitor BitLocker usage and compliance. MBAM reports compliance and other information about all of the computers and devices it manages. The information in this topic can be used to help you understand the Microsoft BitLocker Administration and Monitoring reports for enterprise and individual computer compliance and for key recovery activity. - -**Note**   -If you chose the Configuration Manager topology when you installed Microsoft BitLocker Administration and Monitoring (MBAM), reports are generated from Configuration Manager rather than from MBAM. For more information about reports that are run from Configuration Manager, see [Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md). - - - -## Understanding Reports - - -To access the Reports feature of Microsoft BitLocker Administration and Monitoring, open a web browser and open the Administration and Monitoring website. Select **Reports** in the left menu bar and then select from the top menu bar the kind of report that you want to generate. - -### Enterprise Compliance Report - -Use this report type to collect information on overall BitLocker compliance in your organization. You can use different filters to narrow your search results to Compliance state and Error status. The report information is updated every six hours. - -**Enterprise Compliance Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS name that is being managed by MBAM.

          Domain Name

          Fully qualified domain name where the client computer resides and is managed by MBAM.

          Compliance Status

          State of compliance for the computer, according to the policy specified for the computer. The states are Noncompliant and Compliant. See the Enterprise Compliance Report Compliance States table for more information about how to interpret compliance states.

          Compliance Status Details

          Error and status messages of the compliance state of the computer in accordance to the policy specified.

          Last Contact

          Date and time when the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

          - - - -**Enterprise Compliance Report Compliance States** - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Compliance StatusExemptionDescriptionUser Action

          Noncompliant

          Not Exempt

          The computer is noncompliant, according to the specified policy.

          Expand the Computer Compliance Report details by clicking Computer Name, and determine whether the state of each drive complies with the specified policy. If the encryption state indicates that the computer is not encrypted, encryption may be in process, or there is an error on the computer. If there is no error, the likely cause is that the computer is still in the process of connecting or establishing the encryption status. Check back later to determine if the state changes.

          Compliant

          Not Exempt

          The computer is compliant, according to the specified policy.

          No action needed; the state of the computer can be confirmed by viewing the Computer Compliance Report.

          - - - -### Computer Compliance Report - -Use this report type to collect information that is specific to a computer or user. - -This report can be viewed by clicking the computer name in the Enterprise Compliance Report, or by typing the computer name in the Computer Compliance Report. The Computer Compliance Report provides detailed encryption information about each drive (operating system and fixed data drives) on a computer, and also an indication of the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note**   -Removable Data Volume encryption status will not be shown in the report. - - - -**Computer Compliance Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS computer name that is being managed by MBAM.

          Domain Name

          Fully qualified domain name, where the client computer resides and is managed by MBAM.

          Computer Type

          Type of computer. Valid types are non-Portable and Portable.

          Operating System

          Operating system type found on the MBAM-managed client computer.

          Compliance Status

          Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the following table) may indicate different compliance states. However, this field represents that compliance state, according to the specified policy.

          Policy Cipher Strength

          Cipher strength selected by the administrator during MBAM policy specification (for example, 128-bit with Diffuser).

          Policy Operating System Drive

          Indicates if encryption is required for the operating system and shows the appropriate protector type.

          Policy-Fixed Data Drive

          Indicates if encryption is required for the fixed data drive.

          Policy Removable Data Drive

          Indicates if encryption is required for the removable drive.

          Device Users

          Known users on the computer that is being managed by MBAM.

          Manufacturer

          Computer manufacturer name, as it appears in the computer BIOS.

          Model

          Computer manufacturer model name, as it appears in the computer BIOS.

          Compliance Status Details

          Error and status messages of the compliance state of the computer, in accordance with the specified policy.

          Last Contact

          Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

          - - - -**Computer Compliance Report Drive Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Drive Letter

          Computer drive letter that was assigned to the particular drive by the user.

          Drive Type

          Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

          Cipher Strength

          Cipher strength selected by the administrator during MBAM policy specification.

          Protector Type

          Type of protector selected via the policy used to encrypt an operating system or fixed data volume.

          Protector State

          Indicates that the computer being managed by MBAM has enabled the protector type that is specified in the policy. The valid states are ON or OFF.

          Encryption State

          Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

          Compliance Status

          State that indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant.

          Compliance Status Details

          Error and status messages of the compliance state of the computer, according to the specified policy.

          - - - -### Recovery Audit Report - -Use this report type to audit users who have requested access to recovery keys. The report offers several filters based on the desired filtering criteria. Users can filter on a specific type of user, either a Help Desk user or an end user, whether the request failed or was successful, the specific type of key requested, and a date range during which the retrieval occurred. The administrator can produce contextual reports based on need. - -**Recovery Audit Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Request Date and Time

          Date and time that a key retrieval request was made by an end user or Help Desk user.

          Request Status

          Status of the request. Valid statuses are either Successful (the key was retrieved), or Failed (the key was not retrieved).

          Helpdesk User

          Help Desk user that initiated the request for key retrieval. Note: If the Help Desk user retrieves the key on behalf on an end-user, the End User field will be blank.

          User

          End user who initiated the request for key retrieval.

          Key Type

          Type of key that was requested by either the Help Desk user or the end user. The three types of keys that MBAM collects are: Recovery Key Password (used to recovery a computer in recovery mode), Recovery Key ID (used to recover a computer in recovery mode on behalf of another user), and TPM Password Hash (used to recover a computer with a locked TPM).

          Reason Description

          Reason the specified Key Type was requested by the Help Desk user or the end user. The reasons are specified in the Drive Recovery and Manage TPM features of the Administration and Monitoring website. The valid entries are either user-entered text, or one of the following reason codes:

          -
            -
          • Operating System Boot Order changed

          • -
          • BIOS Changed

          • -
          • Operating System files changed

          • -
          • Lost Startup key

          • -
          • Lost PIN

          • -
          • TPM Reset

          • -
          • Lost Passphrase

          • -
          • Lost Smartcard

          • -
          • Reset PIN lockout

          • -
          • Turn on TPM

          • -
          • Turn off TPM

          • -
          • Change TPM password

          • -
          • Clear TPM

          • -
          - - - -**Note**   -Report results can be saved to a file by clicking the **Export** button on the reports menu bar. For more information about how to run MBAM reports, see [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md). - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md b/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md deleted file mode 100644 index ab076703c4..0000000000 --- a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Upgrading from Previous Versions of MBAM -description: Upgrading from Previous Versions of MBAM -author: dansimp -ms.assetid: 73b425cf-9cd9-4ebc-a35e-1b3bf18596ce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Upgrading from Previous Versions of MBAM - - -You can upgrade Microsoft BitLocker Administration and Monitoring (MBAM) to MBAM 2.0, with the Stand-alone topology or Configuration Manager topology, by doing the following: - -- **Manual in-place server replacement** – To upgrade the MBAM Server, manually uninstall MBAM by using either the installer or Control Panel, and then install the MBAM 2.0 infrastructure. You do not have to remove the databases. Uninstalling the MBAM 1.0 Server leaves the MBAM databases intact. If you specify the same databases that MBAM 1.0 was using, the MBAM 2.0 installation retains MBAM 1.0 data in the databases and converts the databases to work with MBAM 2.0. - -- **Distributed Client Upgrade** - If you are using the Stand-alone MBAM topology, you can upgrade the MBAM Clients gradually after you install the MBAM 2.0 Server infrastructure. The MBAM 2.0 Server detects the version of the existing Client and performs the required steps to upgrade to the 2.0 Client. - - After you upgrade the MBAM 2.0 Server infrastructure, MBAM 1.0 Clients continue to report to the MBAM 2.0 Server successfully, escrowing recovery data, but compliance will be based on the policies in MBAM 1.0. You must upgrade clients to MBAM 2.0 to have client computers accurately report compliance against the MBAM 2.0 policies. You can upgrade the clients to the MBAM 2.0 Client without uninstalling the previous client, and the client will start to apply and report MBAM 2.0 policies. - - If you are using MBAM with Configuration Manager, you must upgrade the MBAM 1.0 clients to MBAM 2.0. - -## Upgrading MBAM from a Two-Server Architecture - - -Use the following instructions to upgrade from a previous version of MBAM when you are using a two-server architecture, where one server is hosting the Microsoft SQL Server components, and the other server is hosting the websites and services. - -**To upgrade MBAM from a two-server architecture** - -1. On the server with the SQL Server features, in Control Panel, select **Programs and Features**, and then uninstall **Microsoft BitLocker Administration and Monitoring**. The Recovery Database and Compliance and Audit database remain unchanged. - -2. Run **MBAMSetup.exe** for version MBAM 2.0, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** or **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. On the **Select features to install** page, clear the **Self-Service Server** and **Administration and Monitoring Server** features, and then click **Next**. - -6. Wait for the prerequisite checks to finish, and then click **Next**. If a missing prerequisite is detected, resolve the missing prerequisites, and then click **Check prerequisites again**. - -7. On the **Provide account used to access the MBAM databases** page, provide the computer name for the server that will host the sites and services, and then click **Next**. - -8. On the **Configure the Recovery database** page, specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify where the database files and log information will be located. - -9. Click **Next** to continue. - -10. On the **Configure the Compliance and Audit database** page, specify the SQL Server instance name and the name of the database that will store the compliance and audit data. - -11. Click **Next** to continue. - -12. On the **Configure the Compliance and Audit Reports** page, specify the SQL Server Reporting Services instance where the Compliance and Audit reports will be installed, and provide a domain user account and password to access the Compliance and Audit database. Configure the password for this account to never expire. The user account can access all data available to the MBAM Reports Users group. - -13. Click **Next** to continue. - -14. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. This does not turn on Automatic Updates in Windows. If you previously chose to use Microsoft Update for this product or another product, the Microsoft Update page does not appear. - -15. On the **Installation Summary** page, review the features that will be installed, and then click **Install** to start the installation. - -**To uninstall the Administration and Monitoring Server features and to complete the upgrade** - -1. On the computer that hosts the Administration and Monitoring Server features, in Control Panel, select **Programs and Features**, and then uninstall MBAM to remove the previously installed websites and services. - -2. Run the **MBAMSetup.exe** for version 2.0, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** or **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. On the **Select features to install** page, clear the **Recovery Database** and **Compliance and Audit Database** and **Compliance and Audit Reports** features, and then click **Next**. - -6. Wait for the prerequisite checks to finish, and then click **Next**. If a missing prerequisite is detected, resolve the missing prerequisites first, and then click **Check prerequisites again**. - -7. On the **Configure network communication security** page, choose whether to use Secure Socket Layer (SSL) encryption for the websites and services. If you decide to encrypt the communication, select the certification authority (CA) certificate to use for encryption. - - **Note**   - The certificate must be created before this step to enable you to select it on this page. - - - -8. On the **Configure the location of the Compliance Status database** page, specify the SQL Server instance name and the name of the database that stores the compliance and audit data. You must also specify where the database files and log information will be located. - -9. Click **Next** to continue. - -10. On the **Configure the location of the Recovery Database** page, specify the SQL Server instance name and the name of the database that stores the recovery data. - -11. Click **Next** to continue. - -12. On the **Configure the Compliance and Audit Reports** page, enter the URL for the reporting instance that you configured on the other server. Use the **Test** button to verify that you can reach the site. - -13. Click **Next** to continue. - -14. On the **Configure the Self-Service Portal** page, enter the port number, host name, virtual directory name, and installation path for the Self-Service Portal. - - **Note**   - The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. - - - -15. On the **Configure the Administration and Monitoring Server** page, specify the desired virtual directory for the Help Desk website. - -16. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. This step does not turn on Automatic Updates in Windows. If you previously chose to use Microsoft Update for this product or another product, the Microsoft Update page does not appear. - -17. On the **Installation Summary** page, review the features that will be installed, and then click **Install** to start the installation. - -18. To validate that the upgrade was successful, verify that you can reach each site from another computer in the domain. - -## Upgrading the MBAM Client on End-User Computers - - -To upgrade end-user computers to the MBAM 2.0 Client, run **MbamClientSetup.exe** on each client computer. The installer automatically updates the Client to the MBAM 2.0 Client. You can install the MBAM Client through an electronic software distribution system, tools such as Active Directory Domain Services or System Center Configuration Manager. - -To validate the Client upgrade, do the following: - -1. Wait until the configured reporting cycle is finished, and then start **SQL Server Management Studio** on the SQL Server computer. - -2. On the SQL Server computer, start **SQL Server Management Studio**. - -3. Verify that the **RecoveryAndHardwareCore.Machines** table contains a row that shows the end-user’s computer name. - -## Related topics - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/using-mbam-with-configuration-manager.md b/mdop/mbam-v2/using-mbam-with-configuration-manager.md deleted file mode 100644 index 10be5afa15..0000000000 --- a/mdop/mbam-v2/using-mbam-with-configuration-manager.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Using MBAM with Configuration Manager -description: Using MBAM with Configuration Manager -author: dansimp -ms.assetid: 03868717-4aa7-4897-8166-9a3df5e9519e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using MBAM with Configuration Manager - - -When you install Microsoft BitLocker Administration and Monitoring (MBAM), you can choose an installation that integrates Microsoft BitLocker Administration and Monitoring with System Center Configuration Manager. For a list of the supported versions of Configuration Manager, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -This integration moves the Microsoft BitLocker Administration and Monitoring compliance and reporting infrastructure into the native environment of Microsoft System Center Configuration Manager. With the Configuration Manager topology, IT administrators can view reports and the compliance status of their enterprise from the Configuration Manager Management Console. - -**Important**   -Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007. - - - -## Getting Started – Using MBAM with Configuration Manager - - -This section describes how MBAM works with Configuration Manager and explains the recommended architecture for deploying MBAM with the Configuration Manager Integration topology. - -[Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md) - -## Planning to Deploy MBAM with Configuration Manager - - -This section describes the installation prerequisites, supported configurations, and hardware and software requirements that you need to consider before you install MBAM with the Configuration Manager topology. - -[Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md) - -## Deploying MBAM with Configuration Manager - - -This section describes how to deploy MBAM with Configuration Manager, and includes instructions for installing and configuring the MBAM on the Administration and Monitoring Server and Configuration Manager Server. - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - -## Understanding MBAM Reports in Configuration Manager - - -This section describes the MBAM reports that you can run from Configuration Manager to show the compliance of your enterprise and compliance of individual computers in your enterprise. - -[Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md) - -## Related topics - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/using-your-pin-or-password.md b/mdop/mbam-v2/using-your-pin-or-password.md deleted file mode 100644 index b2e8471007..0000000000 --- a/mdop/mbam-v2/using-your-pin-or-password.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Using Your PIN or Password -description: Using Your PIN or Password -author: dansimp -ms.assetid: 7fe2aef4-d3e0-49c8-877d-7fee13dc5b7b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using Your PIN or Password - - -BitLocker helps secure your computer by requiring a personal identification number (PIN) or password to unlock the information that is stored on your computer. The PIN or password requirements are set by your organization and depend on the kind of drive being encrypted. Data on the encrypted drives cannot be viewed without entering the PIN or password. If your computer hardware includes an enabled Trusted Platform Module (TPM), the TPM chip prompts you for your PIN before Windows starts on your computer. - -## About Your BitLocker PIN and Passwords - - -Your company specifies the complexity required for your PIN or password. These requirements for your PIN or password are explained during the BitLocker setup process. - -The password is used to unlock drives on your computer that do not contain the operating system. BitLocker will ask for your password after the PIN is requested during startup. Each BitLocker protected hard disk on your computer has its own unique password. You cannot unlock a BitLocker protected drive until you provide your password. - -**Note**   -Your Help Desk may set drives to unlock automatically. This eliminates the need to provide a PIN or password to view the information on the drives. - - - -## Unlocking Your Computer if You Forget Your PIN or Password - - -If you forget your PIN or password, your Help Desk can help you unlock BitLocker protected drives. To unlock a drive protected with BitLocker, contact your Help Desk if you need help. - -**How to unlock your computer if you forget your PIN or password** - -1. When you contact your Help Desk, you will need to provide them with the following information: - - - Your user name - - - Your domain - - - The first eight digits of your recovery key ID. This is a 32-digit code that BitLocker will display if you forget your PIN or password. - - - If you forget your PIN, you will have to enter the first eight digits of the recovery key ID, which will appear in the BitLocker Recovery console. The BitLocker Recovery console is a pre-Windows screen that will be displayed if you do not enter the correct PIN. - - - If you forget your password, look for the recovery key ID in the BitLocker Encryption Options Control Panel application. Select **Unlock Drive** and then click **I cannot remember my password**. The BitLocker Encryption Options application will then display a recovery key ID that you provide to Help Desk. - -2. Once your Help Desk receives the necessary information, it will provide you with a recovery key over the phone or through e-mail. - - - If you forgot your PIN, enter the recovery key in the BitLocker Recovery console to unlock your computer. - - - If you forgot your password, enter the recovery key in the BitLocker Encryption Options Control Panel application, in the same location where you found the recovery key ID earlier. This will unlock the protected hard drive. - -## Changing your PIN or Password - - -Before you can change the password on a BitLocker protected drive, you must unlock the drive. If the drive is not unlocked, select **Unlock Drive**, and then enter your current password. As soon as the drive is unlocked, you can select **Manage your Password** to change your current password. - -**How to Change your PIN or password** - -1. Click **Start**, and then select **Control Panel**. Control Panel opens in a new window. - -2. Select **System and Security**, and then select **BitLocker Encryption Options**. - - - To change your PIN, select **Manage Your PIN**. Type your new PIN into both fields and select **Reset PIN**. - - - To change your password, select **Manage Your Password**. Enter your new password into both fields and select **Reset Password**. - - - - - - - - - diff --git a/mdop/mbam-v25/TOC.md b/mdop/mbam-v25/TOC.md deleted file mode 100644 index a33c126e12..0000000000 --- a/mdop/mbam-v25/TOC.md +++ /dev/null @@ -1,91 +0,0 @@ -# [Microsoft BitLocker Administration and Monitoring 2.5](index.md) -## [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) -### [About MBAM 2.5](about-mbam-25.md) -#### [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) -### [About MBAM 2.5 SP1](about-mbam-25-sp1.md) -#### [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md) -### [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md) -### [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) -#### [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md) -#### [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md) -#### [Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) -### [Accessibility for MBAM 2.5](accessibility-for-mbam-25.md) -## [Planning for MBAM 2.5](planning-for-mbam-25.md) -### [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) -#### [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) -##### [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) -##### [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) -###### [Prerequisites for the Configuration Manager Integration Feature](prerequisites-for-the-configuration-manager-integration-feature.md) -###### [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) -###### [Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) -##### [Prerequisites for MBAM 2.5 Clients](prerequisites-for-mbam-25-clients.md) -#### [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) -#### [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) -#### [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md) -### [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) -#### [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) -#### [Planning for MBAM 2.5 Server Deployment](planning-for-mbam-25-server-deployment.md) -#### [Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) -#### [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md) -#### [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) -### [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) -## [Deploying MBAM 2.5](deploying-mbam-25.md) -### [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) -#### [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) -#### [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) -##### [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md) -##### [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) -##### [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) -###### [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md) -###### [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) -####### [How to Set the Self-Service Portal Branding and Session Time-out](how-to-set-the-self-service-portal-branding-and-session-time-out.md) -####### [How to Turn the Self-Service Portal Notice Text On or Off](how-to-turn-the-self-service-portal-notice-text-on-or-off.md) -####### [How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information](how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md) -####### [How to Localize the Self-Service Portal “HelpdeskURL”](how-to-localize-the-self-service-portal-helpdeskurl.md) -####### [How to Localize the Self-Service Portal Notice Text](how-to-localize-the-self-service-portal-notice-text.md) -##### [How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md) -##### [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) -#### [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) -### [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) -#### [Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) -#### [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) -#### [Hiding the Default BitLocker Drive Encryption Item in Control Panel](hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md) -### [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) -#### [How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md) -#### [How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md) -#### [How to Deploy the MBAM Client by Using a Command Line](how-to-deploy-the-mbam-client-by-using-a-command-line.md) -### [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) -### [Upgrading to MBAM 2.5 SP1 from MBAM 2.5](upgrading-to-mbam-25-sp1-from-mbam-25.md) -### [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md) -### [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) -## [Operations for MBAM 2.5](operations-for-mbam-25.md) -### [Administering MBAM 2.5 Features](administering-mbam-25-features.md) -#### [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md) -#### [Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) -### [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) -#### [Viewing MBAM 2.5 Reports for the Stand-alone Topology](viewing-mbam-25-reports-for-the-stand-alone-topology.md) -##### [Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md) -##### [Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md) -#### [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md) -### [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) -#### [How to Use the Administration and Monitoring Website](how-to-use-the-administration-and-monitoring-website.md) -##### [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-25.md) -##### [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-25.md) -##### [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-25.md) -##### [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-25.md) -##### [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md) -#### [How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md) -### [Maintaining MBAM 2.5](maintaining-mbam-25.md) -#### [Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) -##### [How to Move the MBAM 2.5 Databases](how-to-move-the-mbam-25-databases.md) -##### [How to Move the MBAM 2.5 Reports](how-to-move-the-mbam-25-reports.md) -##### [How to Move the MBAM 2.5 Websites](how-to-move-the-mbam-25-websites.md) -#### [Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md) -### [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) -## [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) -## [Applying hotfixes on MBAM 2.5 SP1](apply-hotfix-for-mbam-25-sp1.md) -## [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) -### [Client Event Logs](client-event-logs.md) -### [Server Event Logs](server-event-logs.md) -### [Determining why a Device Receives a Noncompliance Message](determining-why-a-device-receives-a-noncompliance-message.md) - diff --git a/mdop/mbam-v25/about-mbam-25-sp1.md b/mdop/mbam-v25/about-mbam-25-sp1.md deleted file mode 100644 index e9fefc297b..0000000000 --- a/mdop/mbam-v25/about-mbam-25-sp1.md +++ /dev/null @@ -1,253 +0,0 @@ ---- -title: About MBAM 2.5 SP1 -description: About MBAM 2.5 SP1 -author: dansimp -ms.assetid: 6f12e605-44e6-4646-9c20-aee89c8ff0b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/27/2016 ---- - - -# About MBAM 2.5 SP1 - - -MBAM 2.5 SP1 provides a simplified administrative interface for BitLocker Drive Encryption. BitLocker offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system and drives and configured data drives. - -## Overview of MBAM - - -MBAM 2.5 SP1 has the following features: - -- Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. - -- Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. - -- Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. - -- Reduces the workload on the Help Desk to assist end users with BitLocker PIN and recovery key requests. - -- Enables end users to recover encrypted devices independently by using the Self-Service Portal. - -- Enables security officers to easily audit access to recover key information. - -- Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. - -MBAM enforces the BitLocker encryption policy options that you set for your enterprise, monitors the compliance of client computers with those policies, and reports on the encryption status of the enterprise’s and individual’s computers. In addition, MBAM lets you access the recovery key information when users forget their PIN or password, or when their BIOS or boot records change. - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are responsible for ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for computer security in remote or branch offices - -- Administrators who are responsible for client computers that are running Windows - -**Note**   -BitLocker is not explained in detail in this MBAM documentation. For more information, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -## What’s new in MBAM 2.5 SP1 - - -This section describes the new features in MBAM 2.5 SP1. - -### Newly Supported Languages for the MBAM 2.5 SP1 Client - -The following additional languages are now supported in MBAM 2.5 SP1 for the MBAM Client only, including the Self-Service Portal: - -Czech (Czech Republic) cs-CZ - -Danish (Denmark) da-DK - -Dutch (Netherlands) nl-NL - -Finnish (Finland) fi-FI - -Greek (Greece) el-GR - -Hungarian (Hungary) hu-HU - -Norwegian, Bokmål (Norway) nb-NO - -Polish (Poland) pl-PL - -Portuguese (Portugal) pt-PT - -Slovak (Slovakia) sk-SK - -Slovenian (Slovenia) sl-SI - -Swedish (Sweden) sv-SE - -Turkish (Turkey) tr-TR - -For a list of all languages supported for client and server in MBAM 2.5 and MBAM 2.5 SP1, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -### Support for Windows 10 - -MBAM 2.5 SP1 adds support for Windows 10 and Windows Server 2016, in addition to the same software that is supported in earlier versions of MBAM. - -Windows 10 is supported in both MBAM 2.5 and MBAM 2.5 SP1. - -### Support for Microsoft SQL Server 2014 SP1 - -MBAM 2.5 SP1 adds support for Microsoft SQL Server 2014 SP1, in addition to the same software that is supported in earlier versions of MBAM. - -### MBAM no longer ships with separate MSI - -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product. - -### MBAM can escrow OwnerAuth passwords without owning the TPM - -Previously, if MBAM did not own the TPM, the TPM OwnerAuth could not be escrowed to the MBAM database. To configure MBAM to own the TPM and to store the passwords, you had to disable TPM auto-provisioning and clear the TPM on the client computer. - -In Windows 8 and higher, MBAM 2.5 SP1 can now escrow the OwnerAuth passwords without owning the TPM. During service startup, MBAM queries to see if the TPM is already owned and if so, it requests the passwords from the operating system. The passwords are then escrowed to the MBAM database. In addition, Group Policy must be set to prevent the OwnerAuth from being deleted locally. - -In Windows 7, MBAM must own the TPM to automatically escrow TPM OwnerAuth information in the MBAM database. If MBAM does not own the TPM and Active Directory (AD) backup of the TPM is configured through Group Policy, you must use the **MBAM Active Directory (AD) Data Import cmdlets** to copy TPM OwnerAuth from AD into the MBAM database. These are five new PowerShell cmdlets that pre-populate MBAM databases with the Volume recovery and TPM owner information stored in Active Directory. - -For more information, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-tpm). - -### MBAM can automatically unlock the TPM after a lockout - -On computers running TPM 1.2, you can now configure MBAM to automatically unlock the TPM in case of a lockout. If the TPM lockout auto reset feature is enabled, MBAM can detect that a user is locked out and then get the OwnerAuth password from the MBAM database to automatically unlock the TPM for the user. - -This feature must be enabled on both the server side and in Group Policy on the client side. For more information, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-autounlock). - -### Support for FIPS-compliant BitLocker numerical password protectors - -In MBAM 2.5, support was added for Federal Information Processing Standard (FIPS)-compliant BitLocker recovery keys on devices running the Windows 8.1 operating system. However, Windows did not implement FIPS-compliant recovery keys in Windows 7. Therefore, Windows 7 and Windows 8 devices still required a Data Recovery Agent (DRA) protector for recovery. - -The Windows team has backported FIPS-compliant recovery keys with a hotfix, and MBAM 2.5 SP1 has added support for them as well. - -**Note**   -Client computers that are running the Windows 8 operating system still require a DRA protector since the hotfix was not backported to that OS. See [Hotfix Package 2 for BitLocker Administration and Monitoring 2.5](https://support.microsoft.com/kb/3015477) to download and install the BitLocker hotfix for Windows 7 and Windows 8 computers. For information about DRA, see [Using Data Recovery Agents with BitLocker](https://go.microsoft.com/fwlink/?LinkId=393557). - - - -To enable FIPS compliance in your organization, you must configure the Federal Information Processing Standard (FIPS) Group Policy settings. For configuration instructions, see [BitLocker Group Policy Settings](https://go.microsoft.com/fwlink/?LinkId=393560). - -### Customize pre-boot recovery message and URL with new Group Policy setting - -A new Group Policy setting, **Configure pre-boot recovery message and URL**, lets you configure a custom recovery message or specify a URL that is then displayed on the pre-boot BitLocker recovery screen when the OS drive is locked. This setting is only available on client computers running Windows 10. - -If you enable this policy setting, you can you can select one of these options for the pre-boot recovery message: - -- **Use custom recovery message**: Select this option to include a custom message in the pre-boot BitLocker recovery screen. - -- **Use custom recovery URL**: Select this option to replace the default URL that is displayed in the pre-boot BitLocker recovery screen. - -- **Use default recovery message and URL**: Select this option to display the default BitLocker recovery message and URL in the pre-boot BitLocker recovery screen. If you previously configured a custom recovery message or URL and want to revert to the default message, you must enable this policy and select this option. - -The new Group Policy setting is located in the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Operating System Drive**. For more information, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - -### MBAM added support for Used Space Encryption - -In MBAM 2.5 SP1, if you enable Used Space Encryption via BitLocker Group Policy, the MBAM Client honors it. - -This Group Policy setting is called **Enforce drive encryption type on operating system drives** and is located in the following GPO node: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives**. If you enable this policy and select the encryption type as **Used Space Only encryption**, MBAM will honor the policy and BitLocker will only encrypt disk space that is used on the volume. - -For more information, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - -### MBAM Client support for Encrypted Hard Drives - -MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification requirements for Opal as well as IEEE 1667 standards. When BitLocker is enabled on these devices, it will generate keys and perform management functions on the encrypted drive. See [Encrypted Hard Drive](https://technet.microsoft.com/library/hh831627.aspx) for more information. - -### Delegation configuration no longer required when registering SPNs - -The requirement to configure constrained delegation for SPNs that you register for the application pool account is no longer necessary in MBAM 2.5 SP1. However, it is still a requirement for MBAM 2.5. - -### Enable BitLocker using MBAM as Part of a Windows Deployment - -In MBAM 2.5 SP1, you can use a PowerShell script to configure BitLocker drive encryption and escrow recovery keys to the MBAM Server. - -For more information, see [How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md) - -### Self-Service Portal can be customized by using either PowerShell or the SSP customization wizard - -As of MBAM 2.5 SP1, the Self-Service Portal can be configured by using the customization wizard as well as by using PowerShell. See [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - -### Web browser no longer unintentionally runs as administrator - -An issue in MBAM 2.5 caused help links in the Server Configuration tool to cause browser windows to open with administrator rights. This issue is fixed in MBAM 2.5 SP1. - -### No longer need to download the JavaScript files to configure the Self-Service Portal when the CDN is inaccessible - -In MBAM 2.5 and earlier, the jQuery files used for configuration of the Self-Service Portal had to be downloaded from the CDN in advance if clients accessing the Self-Service Portal did not have internet access. In MBAM 2.5 SP1, all JavaScript files are included in the product, so downloading them is unnecessary. - -### Reports can be opened in Report Builder 3.0 - -In MBAM 2.5 SP1, the reports have been updated to the latest report definition language schema, allowing users to open and customize the reports in Report Builder 3.0 and save them immediately without corrupting the report file. - -### New PowerShell cmdlets - -New PowerShell cmdlets for MBAM 2.5 SP1 enable you to configure and manage different MBAM features, including databases, reports, and web applications. Each feature has a corresponding PowerShell cmdlet that you can use to enable or disable features, or to get information about the feature. - -The following cmdlets have been implemented for MBAM 2.5 SP1: - -- Write-MbamTpmInformation - -- Write-MbamRecoveryInformation - -- Read-ADTpmInformation - -- Read-ADRecoveryInformation - -- Write-MbamComputerUser - -The following parameters have been implemented in the Enable-MbamWebApplication and Test-MbamWebApplication cmdlets for MBAM 2.5 SP1: - -- DataMigrationAccessGroup - -- TpmAutoUnlock - -For information about the cmdlets, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) and [Microsoft Bitlocker Administration and Monitoring Cmdlet Help](https://technet.microsoft.com/library/dn720418.aspx). - -### MBAM agent detects presentation mode - -The MBAM agent can detect when the computer is in presentation mode and avoid invoking the MBAM UI at that time. - -### MBAM agent service now configured to use delayed start - -After installation, the service will now set the MBAM agent service to use delayed start, decreasing the amount of time it takes to start Windows. - -### Locked Fixed Data volumes now report as Compliant - -The compliance calculation logic for "Locked Fixed Data" volumes has been changed to report the volumes as "Compliant," but with a Protector State and Encryption State of "Unknown" and with a Compliance Status Detail of "Volume is locked". Previously, locked volumes were reported as “Non-Compliant”, a Protector State of "Encrypted", an Encryption State of "Unknown", and a Compliance Status Detail of "An unknown error". - - -## How to Get MDOP Technologies - - -MBAM is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of the Microsoft Software Assurance program. For more information about the Microsoft Software Assurance program and how to acquire the MDOP, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/?LinkId=322049). - -## MBAM 2.5 SP1 Release Notes - - -For more information and late-breaking news that is not included in this documentation, see [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md). - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - - - - - - - - diff --git a/mdop/mbam-v25/about-mbam-25.md b/mdop/mbam-v25/about-mbam-25.md deleted file mode 100644 index 7afb0c3d9f..0000000000 --- a/mdop/mbam-v25/about-mbam-25.md +++ /dev/null @@ -1,378 +0,0 @@ ---- -title: About MBAM 2.5 -description: About MBAM 2.5 -author: dansimp -ms.assetid: 1ce218ec-4d2e-4a75-8d1a-68d737a8f3c9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 2.5 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides a simplified administrative interface for BitLocker Drive Encryption. BitLocker offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system volumes and drives and configured data drives. - -## Overview of MBAM - - -MBAM 2.5 has the following features: - -- Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. - -- Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. - -- Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. - -- Reduces the workload on the Help Desk to assist end users with BitLocker PIN and recovery key requests. - -- Enables end users to recover encrypted devices independently by using the Self-Service Portal. - -- Enables security officers to easily audit access to recover key information. - -- Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. - -MBAM enforces the BitLocker encryption policy options that you set for your enterprise, monitors the compliance of client computers with those policies, and reports on the encryption status of the enterprise’s and individual’s computers. In addition, MBAM lets you access the recovery key information when users forget their PIN or password, or when their BIOS or boot records change. - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are responsible for ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for computer security in remote or branch offices - -- Administrators who are responsible for client computers that are running Windows - -**Note**   -BitLocker is not explained in detail in this MBAM documentation. For more information, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -## What’s new in MBAM 2.5 - - -This section describes the new features in MBAM 2.5. - -### Support for Microsoft SQL Server 2014 - -MBAM adds support for Microsoft SQL Server 2014, in addition to the same software that is supported in earlier versions of MBAM. - -### MBAM Group Policy Templates downloaded separately - -The MBAM Group Policy Templates must be downloaded separately from the MBAM installation. In previous versions of MBAM, the MBAM installer included an MBAM Policy Template, which contained the required MBAM-specific Group Policy Objects (GPOs) that define MBAM implementation settings for BitLocker Drive Encryption. These GPOs have been removed from the MBAM installer. You now download the GPOs from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and copy them to a server or workstation before you begin the MBAM Client installation. You can copy the Group Policy Templates to any server or workstation that is running a supported version of the Windows Server or Windows operating system. - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the BitLocker Drive Encryption settings for you. - - - -The template files that you need to copy to a server or workstation are: - -- BitLockerManagement.adml - -- BitLockerManagement.admx - -- BitLockerUserManagement.adml - -- BitLockerUserManagement.admx - -Copy the template files to the location that best meets your needs. For the language-specific files, which must be copied to a language-specific folder, the Group Policy Management Console is required to view the files. - -- To install the template files locally on a server or workstation, copy the files to one of the following locations. - - - - - - - - - - - - - - - - - - - - - - -
          File typeFile location

          language neutral (.admx)

          %systemroot%\policyDefinitions

          language specific (.adml)

          %systemroot%\policyDefinitions[MUIculture] (for example, the U.S. English language specific file will be stored in %systemroot%</em>policyDefinitions\en-us)

          - - - -- To make the templates available to all Group Policy administrators in a domain, copy the files to one of the following locations on a domain controller. - - - - - - - - - - - - - - - - - - - - - - -
          File typeDomain controller file location

          Language neutral (.admx)

          %systemroot%sysvol\domain\policies\PolicyDefinitions

          Language specific (.adml)

          %systemroot%\sysvol\domain\policies\PolicyDefinitions[MUIculture] (for example, the U.S. English language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us)

          - - - -For more information about template files, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/?LinkId=392818). - -### Ability to enforce encryption policies on operating system and fixed data drives - -MBAM 2.5 enables you to enforce encryption policies on operating system and fixed data drives for computers in your organization and limit the number of days that end users can request a postponement of the requirement to comply with MBAM encryption policies. - -To enable you to configure encryption policy enforcement, a new Group Policy setting, called Encryption Policy Enforcement Settings, has been added for operating system drives and fixed data drives. This policy is described in the following table. - - ----- - - - - - - - - - - - - - - - - - - - -
          Group Policy settingDescriptionGroup Policy node used to configure this setting

          Encryption Policy Enforcement Settings (Operating System Drive)

          For this setting, use the option Configure the number of noncompliance grace period days for operating system drives to configure a grace period.

          -

          The grace period specifies the number of days that end users can postpone compliance with MBAM policies for their operating system drive after the drive is first detected as noncompliant.

          -

          After the configured grace period expires, users cannot postpone the required action or request an exemption from it.

          -

          If user interaction is required (for example, if you are using the Trusted Platform Module (TPM) + PIN or using a password protector), a dialog box appears, and users cannot close it until they provide the required information. If the protector is TPM only, encryption begins immediately in the background without user input.

          -

          Users cannot request exemptions through the BitLocker encryption wizard. Instead, they must contact their Help Desk or use whatever process their organization uses for exemption requests.

          Computer Configuration > Policies > Administrative Templates > Windows Components > MDOP MBAM (BitLocker Management) > Operating System Drive

          Encryption Policy Enforcement Settings (Fixed Data Drives)

          For this setting, use the option Configure the number of noncompliance grace period days for fixed drives to configure a grace period.

          -

          The grace period specifies the number of days that end users can postpone compliance with MBAM policies for their fixed drive after the drive is first detected as noncompliant.

          -

          The grace period begins when the fixed drive is determined to be noncompliant. If you are using auto-unlock, the policy will not be enforced until the operating system drive is compliant. However, if you are not using auto-unlock, encryption of the fixed data drive can begin before the operating system drive is fully encrypted.

          -

          After the configured grace period expires, users cannot postpone the required action or request an exemption from it. If user interaction is required, a dialog box appears and users cannot close it until they provide the required information.

          Computer Configuration > Policies > Administrative Templates > Windows Components > MDOP MBAM (BitLocker Management) > Fixed Drive

          - - - -### Ability to provide a URL in the BitLocker Drive Encryption wizard to point to your security policy - -A new Group Policy setting, **Provide the URL for the Security Policy link**, enables you to configure a URL that will be presented to end users as a link called **Company Security Policy**. This link will appear when MBAM prompts users to encrypt a volume. - -If you enable this policy setting, you can configure the URL for the **Company Security Policy** link. If you disable or do not configure this policy setting, the **Company Security Policy** link is not displayed to users. - -The new Group Policy setting is located in the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management) > Client Management**. - -### Support for FIPS-compliant recovery keys - -MBAM 2.5 supports Federal Information Processing Standard (FIPS)-compliant BitLocker recovery keys on devices that are running the Windows 8.1 operating system. The recovery key was not FIPS compliant in earlier versions of Windows. This enhancement improves the drive recovery process in organizations that require FIPS compliance because it enables end users to use the Self-Service Portal or Administration and Monitoring Website (Help Desk) to recover their drives if they forget their PIN or password or get locked out of their computers. The new FIPS compliance feature does not extend to password protectors. - -To enable FIPS compliance in your organization, you must configure the Federal Information Processing Standard (FIPS) Group Policy settings. For configuration instructions, see [BitLocker Group Policy Settings](https://go.microsoft.com/fwlink/?LinkId=393560). - -For client computers that are running the Windows 8 or Windows 7 operating systems without the [installed BitLocker hotfix](https://support.microsoft.com/kb/3015477), IT administrators will continue to use the Data Recovery Agents (DRA) protector in FIPS-compliant environments. For information about DRA, see [Using Data Recovery Agents with BitLocker](https://go.microsoft.com/fwlink/?LinkId=393557). - -See [Hotfix Package 2 for BitLocker Administration and Monitoring 2.5](https://support.microsoft.com/kb/3015477) to download and install the BitLocker hotfix for Windows 7 and Windows 8 computers. - -### Support for high availability deployments - -MBAM supports the following high-availability scenarios in addition to the standard two-server and Configuration Manager Integration topologies: - -- SQL Server AlwaysOn availability groups - -- SQL Server clustering - -- Network load balancing (NLB) - -- SQL Server mirroring - -- Volume Shadow Copy Service (VSS) Backup - -For more information about these features, see [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md). - -### Management of roles for Administration and Monitoring Website changed - -In MBAM 2.5, you must create security groups in Active Directory Domain Services (AD DS) to manage the roles that provide access rights to the Administration and Monitoring Website. Roles enable users who are in specific security groups to perform different tasks in the website such as viewing reports or helping end users recover encrypted drives. In previous versions of MBAM, roles were managed by using local groups. - -In MBAM 2.5, the term “roles” replaces the term “administrator roles,” which was used in earlier versions of MBAM. In addition, in MBAM 2.5 the “MBAM System Administrators” role has been removed. - -The following table lists the security groups that you must create in AD DS. You can use any name for the security groups. - - ---- - - - - - - - - - - - - - - - - - - - - -
          RoleAccess rights for this role on the Administration and Monitoring Website

          MBAM Helpdesk Users

          Provides access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. Users who have access to these areas must fill in all fields when they use either area.

          MBAM Report Users

          Provides access to the Reports in the Administration and Monitoring Website.

          MBAM Advanced Helpdesk Users

          Provides access to all areas in the Administration and Monitoring Website. Users in this group have to enter only the recovery key, not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users group permissions.

          - - - -After you create the security groups in AD DS, assign users and/or groups to the appropriate security group to enable the corresponding level of access to the Administration and Monitoring Website. To enable individuals with each role to access the Administration and Monitoring Website, you must also specify each security group when you are configuring the Administration and Monitoring Website. - -### Windows PowerShell cmdlets for configuring MBAM Server features - -Windows PowerShell cmdlets for MBAM 2.5 enable you to configure and manage the MBAM Server features. Each feature has a corresponding Windows PowerShell cmdlet that you can use to enable or disable features, or to get information about the feature. - -For prerequisites and prerequisites for using Windows PowerShell, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md). - -**To load the MBAM 2.5 Help for Windows PowerShell cmdlets after installing the MBAM Server software** - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Update-Help –Module Microsoft.MBAM**. - -Windows PowerShell Help for MBAM is available in the following formats: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows PowerShell Help formatMore information

          At a Windows PowerShell command prompt, type Get-Help <cmdlet>

          To upload the latest Windows PowerShell cmdlets, follow the instructions in the previous section on how to load Windows PowerShell Help for MBAM.

          On TechNet as webpages

          https://go.microsoft.com/fwlink/?LinkId=393498

          On the Download Center as a Word .docx file

          https://go.microsoft.com/fwlink/?LinkId=393497

          On the Download Center as a .pdf file

          https://go.microsoft.com/fwlink/?LinkId=393499

          - - - -### Support for ASCII-only and enhanced PINs and ability to prevent sequential and repeating characters - -**Allow enhanced PINs for startup Group Policy setting** - -The Group Policy setting, **Allow enhanced PINs for startup**, enables you to configure whether enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit users to enter any keys on a full keyboard, including uppercase and lowercase letters, symbols, numbers, and spaces. If you enable this policy setting, all new BitLocker startup PINs that are set will be enhanced PINs. If you disable or do not configure this policy setting, enhanced PINs cannot be used. - -Not all computers support the entry of enhanced PINs in the Pre-Boot Execution Environment (PXE). Before you enable this Group Policy setting for your organization, run a system check during the BitLocker setup process to ensure that the computer’s BIOS supports the use of the full keyboard in PXE. For more information, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - -**Require ASCII-only PINs check box** - -The **Allow enhanced PINs for startup** Group Policy setting also contains a **Require ASCII-only PINs** check box. If the computers in your organization do not support the use of the full keyboard in PXE, you can enable the **Allow enhanced PINs for startup** Group Policy setting, and then select the **Require ASCII-only PINs** check box to require that enhanced PINs use only printable ASCII characters. - -**Enforced use of nonsequential and nonrepeating characters** - -MBAM 2.5 prevents end users from creating PINs that consist of repeating numbers (such as 1111) or sequential numbers (such as 1234). If end users try to enter a password that contains three or more repeating or sequential numbers, the Bitlocker Drive Encryption wizard displays an error message and prevents users from entering a PIN with the prohibited characters. - -### Addition of DRA Certificate to BitLocker Computer Compliance report - -A new protector type, the Data Recovery Agent (DRA) Certificate, has been added to the BitLocker Computer Compliance Report in Configuration Manager. This protector type applies to operating system drives, and it appears in the **Computer Volume(s)** section in the **Protector Types** column. - -### Support for multi-forest support deployments - -MBAM 2.5 supports the following types of multi-forest deployments: - -- Single forest with single domain - -- Single forest with a single tree and multiple domains - -- Single forest with multiple trees and disjoint namespaces - -- Multiple forests in a central forest topology - -- Multiple forests in a resource forest topology - -There is no support for forest migration (going from single to multiple, multiple to single, resource to across the forest, etc.), or upgrade or downgrade. - -The prerequisites for deploying MBAM in multi-forest deployments are: - -- Forest must be running on supported versions of Windows Server. - -- A two-way or one-way trust is required. One-way trusts require that the server’s domain trusts the client’s domain. In other words, the server’s domain is pointed at the client’s domain. - -### MBAM Client support for Encrypted Hard Drives - -MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification requirements for Opal as well as IEEE 1667 standards. When BitLocker is enabled on these devices, it will generate keys and perform management functions on the encrypted drive. See [Encrypted Hard Drive](https://technet.microsoft.com/library/hh831627.aspx) for more information. - -## How to Get MDOP Technologies - - -MBAM is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of the Microsoft Software Assurance program. For more information about the Microsoft Software Assurance program and how to acquire the MDOP, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/?LinkId=322049). - -## MBAM 2.5 Release Notes - - -For more information and late-breaking news that is not included in this documentation, see [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md). - -## Got a suggestion for MBAM? -- Send your feedback [here](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - - - - - - - - diff --git a/mdop/mbam-v25/accessibility-for-mbam-25.md b/mdop/mbam-v25/accessibility-for-mbam-25.md deleted file mode 100644 index 5618291576..0000000000 --- a/mdop/mbam-v25/accessibility-for-mbam-25.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Accessibility for MBAM 2.5 -description: Accessibility for MBAM 2.5 -author: dansimp -ms.assetid: 03b343a6-9e8e-4868-a52b-cedf0b696d56 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for MBAM 2.5 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in alternative formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

          - - - -## Customer service for people with hearing impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For more information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - - - - - - - - diff --git a/mdop/mbam-v25/administering-mbam-25-features.md b/mdop/mbam-v25/administering-mbam-25-features.md deleted file mode 100644 index ba93616f8c..0000000000 --- a/mdop/mbam-v25/administering-mbam-25-features.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Administering MBAM 2.5 Features -description: Administering MBAM 2.5 Features -author: dansimp -ms.assetid: ca15f818-cf07-4437-8ffa-425af603a3c8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 2.5 Features - - -After completing all necessary planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage BitLocker encryption across the enterprise The information in this section describes post-installation day-to-day Microsoft BitLocker Administration and Monitoring feature operations tasks. - -## Manage BitLocker Encryption Exemptions - - -MBAM lets you grant encryption exemptions to specific users who do not need or want their drives encrypted. Computer exemption is typically used when a company has computers that do not have to be encrypted, such as computers that are used in development or testing, or older computers that do not support BitLocker. In some cases, local law may also require that certain computers are not encrypted. - -[How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md) - -## Understand the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel - - -MBAM provides a custom control panel, called BitLocker Encryption Options, that appears under **System and Security**. The MBAM control panel can be used to unlock encrypted fixed and removable drives, and also manage your PIN or password. - -**Note**   -This customized control panel does not replace the default Windows BitLocker control panel. - - - -[Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) - -## Other Resources for Administering MBAM Features - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md deleted file mode 100644 index 3013d8a294..0000000000 --- a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Applying hotfixes on MBAM 2.5 SP1 -description: Applying hotfixes on MBAM 2.5 SP1 -ms.author: ppriya-msft -author: intothedarkness -ms.assetid: -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 8/30/2018 -ms.author: pashort -author: shortpatti ---- - -# Applying hotfixes on MBAM 2.5 SP1 -This topic describes the process for applying the hotfixes for Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 - -### Before you begin, download the latest hotfix of Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 -[Desktop Optimization Pack](https://www.microsoft.com/en-us/download/details.aspx?id=58345) - -#### Steps to update the MBAM Server for existing MBAM environment -1. Remove MBAM server feature (do this by opening the MBAM Server Configuration Tool, then selecting Remove Features). -2. Remove MDOP MBAM from Control Panel | Programs and Features. -3. Install MBAM 2.5 SP1 RTM server components. -4. Install lastest MBAM 2.5 SP1 hotfix rollup. -5. Configure MBAM features using MBAM Server Configurator. - -#### Steps to install the new MBAM 2.5 SP1 server hotfix -Refer to the document for [new server installation](deploying-the-mbam-25-server-infrastructure.md). diff --git a/mdop/mbam-v25/client-event-logs.md b/mdop/mbam-v25/client-event-logs.md deleted file mode 100644 index 747ad55211..0000000000 --- a/mdop/mbam-v25/client-event-logs.md +++ /dev/null @@ -1,275 +0,0 @@ ---- -title: Client Event Logs -description: Client Event Logs -author: dansimp -ms.assetid: d5c2f270-db6a-45f1-8557-8c6fb28fd568 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Event Logs - -MBAM Client event logs are located in Event Viewer – Applications and Services Logs – Microsoft – Windows – MBAM - Operational path. -The following table contains event IDs that can occur on the MBAM Client. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Event IDChannelEvent symbolMessage

          1

          Operational

          VolumeEnactmentSuccessful

          The MBAM policies were applied successfully.

          2

          Admin

          VolumeEnactmentFailed

          An error occurred while applying MBAM policies.

          3

          Operational

          TransferStatusDataSuccessful

          The encryption status data was sent successfully.

          4

          Admin

          TransferStatusDataFailed

          An error occurred while sending encryption status data.

          8

          Admin

          SystemVolumeNotFound

          The system volume is missing. SystemVolume is needed to encrypt the operating system drive.

          9

          Admin

          TPMNotFound

          The TPM hardware is missing. TPM is needed to encrypt the operating system drive with any TPM protector.

          10

          Admin

          MachineHWExempted

          The computer is exempted from Encryption. Machine’s hardware status: Exempted

          11

          Admin

          MachineHWUnknown

          The computer is exempted from encryption. Machine’s hardware status: Unknown

          12

          Admin

          HWCheckFailed

          Hardware exemption check failed.

          13

          Admin

          UserIsExempted

          The user is exempt from encryption.

          14

          Admin

          UserIsWaiting

          The user requested an exemption.

          15

          Admin

          UserExemptionCheckFailed

          User exemption check failed.

          16

          Admin

          UserPostponed

          The user postponed the encryption process.

          17

          Admin

          TPMInitializationFailed

          TPM initialization failed. The user rejected the BIOS changes.

          18

          Admin

          CoreServiceDown

          Unable to connect to the MBAM Recovery and Hardware service.

          19

          Operational

          CoreServiceUp

          Successfully connected to the MBAM Recovery and Hardware service.

          20

          Admin

          PolicyMismatch

          The MBAM policy is in conflict or corrupt.

          21

          Admin

          ConflictingOSVolumePolicies

          Detected OS volume encryption policies conflict. Check BitLocker and MBAM policies related to OS drive protectors.

          22

          Admin

          ConflictingFDDVolumePolicies

          Detected Fixed Data Drive volume encryption policies conflict. Check BitLocker and MBAM policies related to FDD drive protectors.

          27

          Admin

          EncryptionFailedNoDra

          An error occurred while encrypting. A Data Recovery Agent (DRA) protector is required in FIPS mode for pre-Windows 8.1 machines.

          28

          Operational

          TpmOwnerAuthEscrowed

          The TPM OwnerAuth has been escrowed.

          29

          Operational

          RecoveryKeyEscrowed

          The BitLocker recovery key for the volume has been escrowed.

          30

          Operational

          RecoveryKeyReset

          The BitLocker recovery key for the volume has been updated.

          31

          Operational

          EnforcePolicyDateSet

          The enforce policy date, <date>, has been set for the volume

          32

          Operational

          EnforcePolicyDateCleared

          The enforce policy date, <date>, has been cleared for the volume.

          33

          Operational

          TpmLockOutResetSucceeded

          Successfully reset TPM lockout.

          34

          Admin

          TpmLockOutResetFailed

          Failed to reset TPM lockout.

          35

          Operational

          TpmOwnerAuthRetrievalSucceeded

          Successfully retrieved TPM OwnerAuth from MBAM services.

          36

          Admin

          TpmOwnerAuthRetrievalFailed

          Failed to retrieve TPM OwnerAuth from MBAM services.

          37

          Admin

          WmiProviderDllSearchPathUpdateFailed

          Failed to update the DLL search path for WMI provider.

          38

          Admin

          TimedOutWaitingForWmiProvider

          Agent Stopping - Timed-out waiting for MBAM WMI Provider Instance.

          39

          Operational

          RemovableDriveMounted

          Removable drive was mounted.

          40

          Operational

          RemovableDriveDismounted

          Removable drive was unmounted.

          41

          Operational

          FailedToEnactEndpointUnreachable

          Failure to connect to the MBAM Recovery and Hardware service prevented MBAM policies from being applied successfully to the volume.

          42

          Operational

          FailedToEnactLockedVolume

          Locked volume state prevented MBAM policies from being applied successfully to the volume.

          43

          Operational

          TransferStatusDataFailedEndpointUnreachable

          Failure to connect to the MBAM Compliance and Status service prevented the transfer of encryption status data.

          - -  - - -## Related topics -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Server Event Logs](server-event-logs.md) - -  - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md b/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md deleted file mode 100644 index 3e68d38e01..0000000000 --- a/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md +++ /dev/null @@ -1,376 +0,0 @@ ---- -title: Configuring MBAM 2.5 Server Features by Using Windows PowerShell -description: Configuring MBAM 2.5 Server Features by Using Windows PowerShell -author: dansimp -ms.assetid: 826429fd-29bb-44be-b47e-5f5c7d20dd1d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring MBAM 2.5 Server Features by Using Windows PowerShell - - -After you install the MBAM 2.5 Server software, you can use configure MBAM 2.5 Server features by using Windows PowerShell cmdlets or the MBAM Server Configuration wizard. This topic describes how to configure MBAM 2.5 by using the Windows PowerShell cmdlets. To use the wizard instead, see [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md). - -## In this topic - - -This topic includes the following information about using Windows PowerShell to configure MBAM: - -- [How to load Windows PowerShell Help for MBAM 2.5](#bkmk-load-posh-help) - -- [How to get Help about an MBAM Windows PowerShell cmdlet](#bkmk-help-specific-cmdlet) - -- [Configurations that you can do only with Windows PowerShell but not with the MBAM Server Configuration wizard](#bkmk-config-only-posh) - -- [Prerequisites and requirements for using Windows PowerShell to configure MBAM Server features](#bkmk-prereqs-posh-mbamsvr) - -- [Using Windows PowerShell to configure MBAM on a remote computer](#bkmk-remote-config) - -- [Required accounts and corresponding Windows PowerShell cmdlet parameters](#bkmk-reqd-posh-accts) - -For information about the **Get-MbamBitLockerRecoveryKey** and **Get-MbamTPMOwnerPassword** Windows PowerShell cmdlets, which are used to administer MBAM, see [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md). - -## How to load Windows PowerShell Help for MBAM 2.5 - - -For a list of the Windows PowerShell cmdlets on TechNet, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://go.microsoft.com/fwlink/?LinkId=392816). - -**To load the MBAM 2.5 Help for Windows PowerShell cmdlets after installing the MBAM Server software** - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Update-Help –Module Microsoft.MBAM**. - -## How to get Help about an MBAM Windows PowerShell cmdlet - - -Windows PowerShell Help for MBAM is available in the following formats: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows PowerShell Help formatMore information

          At a Windows PowerShell command prompt, type Get-Help <cmdlet>

          To upload the latest Windows PowerShell cmdlets, follow the instructions in the previous section on how to load Windows PowerShell Help for MBAM.

          On TechNet as webpages

          https://go.microsoft.com/fwlink/?LinkId=393498

          On the Download Center as a Word .docx file

          https://go.microsoft.com/fwlink/?LinkId=393497

          On the Download Center as a .pdf file

          https://go.microsoft.com/fwlink/?LinkId=393499

          - - - -## Configurations that you can do only with Windows PowerShell but not with the MBAM Server Configuration wizard - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Configurations that you can do only by using Windows PowerShellDetails

          Install the web services on a separate computer from the web applications.

          Using the wizard, you must install the web services and web applications on the same computer.

          Enable reports on a separate reporting services point without installing all of the Configuration Manager objects.

          Delete all of the objects from Configuration Manager.

          Deleting the objects in turn deletes all of the compliance data from Configuration Manager.

          Enter a custom connection string for the databases.

          Example: To configure the web applications to work with mirroring, you must use the Enable-MbamWebApplication cmdlet to specify the appropriate failover partner syntax in the connection string.

          Skip validation and configure a feature even though the prerequisite check failed.

          - - - -**Note**   -You cannot disable the MBAM databases with a Windows PowerShell cmdlet or the MBAM Server Configuration wizard. To prevent the accidental removal of your compliance and audit data, database administrators must remove databases manually. - - - -## Prerequisites and requirements for using Windows PowerShell to configure MBAM Server features - - -Before starting the configuration, complete the following prerequisites. - -**Account-related prerequisites** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails or additional information

          Create the required accounts.

          See section Required accounts and corresponding Windows PowerShell cmdlet parameters later in this topic.

          User accounts and groups that you pass as parameters to the Windows PowerShell cmdlets must be valid accounts in the domain.

          You cannot use local accounts.

          Specify accounts in the down-level format.

          Examples:

          -

          domainNetBiosName\userdomainNetBiosName\group

          - - - -**Permission-related prerequisites** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails or additional information

          You must be an administrator on the local computer where you are configuring the MBAM feature.

          Use an elevated Windows PowerShell command prompt to run all Windows PowerShell cmdlets.

          For the Enable-MbamDatabase cmdlet only:

          -

          You must have "create any database" permissions on the instance of the target Microsoft SQL Server database.

          -

          This user account must be a part of the local administrators group or the Backup Operators group to register the MBAM Volume Shadow Copy Service (VSS) Writer.

          By default, the database administrator or system administrator has the required "create any database" permissions.

          -

          -

          For more information about VSS Writer, see Volume Shadow Copy Service.

          For the System Center Configuration Manager Integration feature only:

          -

          The user who enables this feature must have these rights in Configuration Manager:

          ---- - - - - - - - - - - - - - - - - - - - - -
          Type of rights in Configuration ManagerRequired rights

          Configuration Manager Site rights:

          - Read

          Configuration Manager Collection rights:

          - Create- Delete- Read- Modify- Deploy Configuration Items

          Configuration Manager Configuration item rights:

          - Create- Delete- Read

          -

           

          -

          - - - -## Using Windows PowerShell to configure MBAM on a remote computer - - - ---- - - - - - - - - - - - - - - - - - - -

          When to use this capability

          When you want to configure the MBAM 2.5 Server features on a remote computer. The Windows PowerShell cmdlets are running on one computer, and you are configuring the features on a different, remote computer.

          What you have to do

          To use Windows PowerShell to configure MBAM 2.5 Server features on a remote computer, you must:

          -
            -
          • Ensure that the MBAM 2.5 Server software has been installed on the remote computer.

          • -
          • Use the Credential Security Support Provider (CredSSP) Protocol to open the Windows PowerShell session.

          • -
          • Enable Windows Remote Management (WinRM). If you fail to enable WinRM and to configure it correctly, the New-PSSession cmdlet that is described in this table displays an error and describes how to fix the issue. For more information about WinRM, see Using Windows Remote Management.

          • -

          Why you have to do it

          This protocol enables the Windows PowerShell cmdlets to connect to Active Directory Domain Services by using the user’s administrative credentials. You might get a validation error if you start the Windows PowerShell session without this protocol.

          How to start a Windows PowerShell session with the CredSSP protocol

          Type the following code at the Windows PowerShell prompt:

          -

          $s = New-PSSession -ComputerName xxx -Authentication Credssp -Credential xxx

          -

          The following code shows an example.

          -

          $session = New-PSSession -ComputerName <MBAM_server_name> -Authentication Credssp -Credential (Get-Credential)

          -

          Enter-PSSession $session

          - - - -## Required accounts and corresponding Windows PowerShell cmdlet parameters - - -The following table describes the accounts that are required to configure MBAM 2.5 Server features. It also lists the corresponding Windows PowerShell cmdlet and parameter for which you have to specify the account during configuration. - -Cmdlet -Parameter -Type (User or Group) -Description -Enable-MBAMDatabase - -AccessAccount - -User or Group - -Specify a domain user or group that has read/write permission to this database to give the web applications access to data and reports in this database. If the value is a domain user, then the **WebServiceApplicationPoolCredential** parameter that is used when running the **Enable-MbamWebApplication** cmdlet must use the same user account. If the value is a domain Users group, then the domain account that is used by the **WebServiceApplicationPoolCredential** parameter must be a member of this group. - -ReportAccount - -User or Group - -Specify a domain user or Users group that has read-only permission to this database to provide the MBAM reports access to the compliance and audit data. If the value is a domain user, then the **ComplianceAndAuditDBCredential** parameter of the **Enable-MbamReport** cmdlet must use the same user account. If the value is a domain Users group, then the domain account that is used by the **ComplianceAndAuditDBCredential** parameter must be a member of this group. - -Enable-MbamReport - -ComplianceAndAuditDBCredential - -User - -Specifies the administrative credential that the local SSRS instance uses to connect to the MBAM Compliance and Audit Database. The domain user in the administrative credential must be the same as the user account that is used for the **ReportAccount** parameter, which is used while running the **Enable-MbamDatabase** cmdlet. If a domain Users group was used with the **ReportAccount** parameter, this account should be a member of that group. - -**Important**   -The account specified in the administrative credentials should have limited user rights for improved security. Also, the password of the account should be set to not expire. - - - -ReportsReadOnlyAccessGroup - -Group - -Specifies the domain user group that has read permissions to the reports. The specified group must be the same group that is used for the **ReportsReadOnlyAccessGroup** parameter in the **Enable-MbamWebApplication** cmdlet. - -Enable-MBAMWebApplication - -AdvancedHelpdeskAccessGroup - -Group - -Specifies the domain Users group that has access to all areas of the Administration and Monitoring Website except the Reports area. - -HelpdeskAccessGroup - -Group - -Specifies the domain Users group that has access to the **Manage TPM** and **Drive Recovery** areas of the Administration and Monitoring Website. - -ReportsReadOnlyAccessGroup - -Group - -Specifies the domain Users group that has read permission to the **Reports** area of the Administration and Monitoring Website. The specified group must be the same group that is used for the **ReportsReadOnlyAccessGroup** parameter in the **Enable-MbamReport** cmdlet. - -WebServiceApplicationPoolCredential - -User - -Specifies the domain user to be used by the application pool for the MBAM web applications. It must be the same domain user account that is specified in the **AccessAccount** parameter of the **Enable-MbamDatabase** cmdlet. If a domain Users group was used by the **AccessAccount** parameter when running the **Enable-MbamDatabase** cmdlet, the domain user that is specified here must be a member of that group. If you do not specify the administrative credentials, the administrative credentials that were specified by any previously enabled web application are used. All of the web applications use the same application pool identity. If it is specified multiple times, the most recently specified value is used. - -**Important**   -For improved security, set the account that is specified in the administrative credentials to limited user rights. Also, set the password of the account to never expire. Ensure that either the built-in IIS\_IUSRS account or the account that is used for the **WebServiceApplicationPoolCredential** parameter has been added to the **Impersonate a client after authentication** local security setting. - -To view the local security setting, open the **Local Security Policy editor**, expand the **Local Policies** node, select the **User Rights Assignment** node, and then double-click the **Impersonate a client after authentication** and **Log on as a batch job** Group Policy settings in the details pane. - - - - - - - - -## Related topics - - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - -[Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/configuring-the-mbam-25-server-features.md b/mdop/mbam-v25/configuring-the-mbam-25-server-features.md deleted file mode 100644 index d5431e95f6..0000000000 --- a/mdop/mbam-v25/configuring-the-mbam-25-server-features.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Configuring the MBAM 2.5 Server Features -description: Configuring the MBAM 2.5 Server Features -author: dansimp -ms.assetid: 894d1080-5f13-48f7-8fde-82f8d440a4ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the MBAM 2.5 Server Features - - -Use this information as a starting place for configuring Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server features after [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). There are two methods you can use to configure MBAM: - -- MBAM Server Configuration wizard - -- Windows PowerShell cmdlets - -## Before you start configuring MBAM Server features - - -Review and complete the following steps before you start configuring the MBAM Server features: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepWhere to get instructions

          Review the recommended architecture for MBAM.

          High-Level Architecture for MBAM 2.5

          Review the supported configurations for MBAM.

          MBAM 2.5 Supported Configurations

          Complete the required prerequisites on each server.

          Install the MBAM Server software on each server where you will configure an MBAM Server feature.

          Installing the MBAM 2.5 Server Software

          Review the prerequisites for using Windows PowerShell to configure MBAM Server features (if you are using this method to configure MBAM Server features).

          Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          - - - -## Steps for configuring MBAM Server features - - -Each row in the following table describes the features that you will configure on a separate server, according to the recommended [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Features to installWhere to get instructions

          Configure the databases.

          How to Configure the MBAM 2.5 Databases

          Configure the reports.

          How to Configure the MBAM 2.5 Reports

          Configure the web applications.

          How to Configure the MBAM 2.5 Web Applications

          Configure the System Center Configuration Manager Integration (if applicable).

          How to Configure the MBAM 2.5 System Center Configuration Manager Integration

          - - - -For a list of events about MBAM Server feature configuration, see [Server Event Logs](server-event-logs.md). - - - -## Related topics - - -Configuring the MBAM 2.5 Server Features - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md b/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md deleted file mode 100644 index 185ace5f1b..0000000000 --- a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Copying the MBAM 2.5 Group Policy Templates -description: Copying the MBAM 2.5 Group Policy Templates -author: dansimp -ms.assetid: e526ecec-07ff-435e-bc90-3084b617b84b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/28/2017 ---- - - -# Copying the MBAM 2.5 Group Policy Templates - - -Before deploying the MBAM Client installation, you must download the MBAM Group Policy Templates, which contain Group Policy settings that define MBAM implementation settings for BitLocker Drive Encryption. After downloading the templates, you then set the Group Policy settings to implement across your enterprise. - -## Downloading and deploying the MDOP Group Policy templates - - -MDOP Group Policy templates are available for download in a self-extracting, compressed file, grouped by technology and version. - -**How to download and deploy the MDOP Group Policy templates** - -1. Download the MDOP Group Policy templates from [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531). - -2. Run the downloaded file to extract the template folders. - - **Warning** - Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file. - - - -3. In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings. - -4. Locate the appropriate .adml file by language-culture (that is, *en* for English-United States). - -5. Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain. - - **Local files.** To configure Group Policy settings from the local device, copy template files to the following locations: - - - - - - - - - - - - - - - - - - - - - - -
          File typeFile location

          Group Policy template (.admx)

          %systemroot%<strong>policyDefinitions

          Group Policy language file (.adml)

          %systemroot%<strong>policyDefinitions[MUIculture]

          - - - -~~~ -**Domain central store.** To enable Group Policy settings configuration by a Group Policy administrator from any computer on the domain, copy files to the following locations on the domain controller: - - ---- - - - - - - - - - - - - - - - - -
          File typeFile location

          Group Policy template (.admx)

          %systemroot%\sysvol\domain\policies\PolicyDefinitions

          Group Policy language file (.adml)

          %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture]\[MUIculture]

          -

          For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.

          -~~~ - - - -6. Edit the Group Policy settings using Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) to configure Group Policy settings for the MDOP technology. See [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) for more information. - - For descriptions of the Group Policy settings, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - - -## Related topics - - -[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md b/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md deleted file mode 100644 index efae4b682d..0000000000 --- a/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md +++ /dev/null @@ -1,395 +0,0 @@ ---- -title: Create or Edit the Sms\_def.mof File -description: Create or Edit the Sms\_def.mof File -author: dansimp -ms.assetid: 0bc5e7d8-9747-4da6-a1b3-38d8f27ba121 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create or Edit the Sms\_def.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to create or edit the Sms\_def.mof file. - -If you are using System Center 2012 Configuration Manager, you must create the file. Create the file on the top-tier site. The changes will be replicated to the other sites in your infrastructure. - -In Configuration Manager 2007, the file already exists, so you only have to edit it. **Do not overwrite the existing file.** - -In the following sections, complete the instructions that correspond to the version of Configuration Manager that you are using. - -**To create the Sms\_def.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location where you have to create the Sms\_def.mof file, for example, the Desktop. - -2. Create a text file called **Sms\_def.mof** and copy the following code to populate the file with the following Sms\_def.mof MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - [ SMS_Report (TRUE) ] - String NoncomplianceDetectedDate; - [ SMS_Report (TRUE) ] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0")] - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Import the **Sms\_def.mof** file by doing the following: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**, and then click **Import**. - - 6. In the browser that opens, select your **.mof** file, and then click **Open**. The **Import Summary** window opens. - - 7. In the **Import Summary** window, ensure that the option to import both hardware inventory classes and class settings is selected, and then click **Import**. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -4. Enable the **Win32\_Tpm** class as follows: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**. - - 6. In the main window, scroll down, and then select the **TPM (Win32\_Tpm)** class. - - 7. Under **TPM**, ensure that the **SpecVersion** property is selected. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -**To edit the sms\_def.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **sms\_def.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive% \\Program Files (x86)\\Microsoft Configuration Manager. - -2. Copy the following code, and then append it to **Sms\_def.mof** file to add the following required MBAM classes to the file: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - [ SMS_Report (TRUE) ] - String NoncomplianceDetectedDate; - [ SMS_Report (TRUE) ] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=32|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=64|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy_64: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Modify the **Win32\_Tpm** class as follows: - - - Set **SMS\_REPORT** to **TRUE** in the class attributes. - - - Set **SMS\_REPORT** to **TRUE** in the **SpecVersion** property attribute. - - **Got a suggestion for MBAM**? Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). **Got a MBAM issue**? Use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - -[Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) - -[MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md b/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md deleted file mode 100644 index b5343853e6..0000000000 --- a/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Customizing the Self-Service Portal for Your Organization -description: Customizing the Self-Service Portal for Your Organization -author: dansimp -ms.assetid: f007e02b-e2df-47a9-9762-5909e230aa3f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Customizing the Self-Service Portal for Your Organization - - -After configuring the Self-Service Portal, you will want to customize it for your organization by adding custom notice text, your company name, and other company-specific information. - -## Customizing the Self-Service Portal information - - -You can customize the Self-Service Portal in the following ways: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          What you can doInstructions

          You can brand the Self-Service Portal with your company name, Help Desk URL, and can change the Session Time-out setting to make the end user’s session expire after a specified period of inactivity.

          How to Set the Self-Service Portal Branding and Session Time-out

          You can turn the Self-Service Portal notice text on or off.

          How to Turn the Self-Service Portal Notice Text On or Off

          You can configure a localized version of the Self-Service Portal "HelpdeskText" statement, which tells end users how to get additional help when they are using the Self-Service Portal.

          How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information

          You can configure a localized version of the Self-Service Portal "HelpdeskURL" to display to end users by default.

          How to Localize the Self-Service Portal “HelpdeskURL”

          You can configure localized notice text to display to end users by default in the Self-Service Portal.

          How to Localize the Self-Service Portal Notice Text

          - - - - - -## Related topics - - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md b/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md deleted file mode 100644 index ea0c9dff8f..0000000000 --- a/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Deploying MBAM 2.5 Group Policy Objects -description: Deploying MBAM 2.5 Group Policy Objects -author: dansimp -ms.assetid: 4b835054-6846-463d-af58-8ac4639a1188 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.5 Group Policy Objects - - -To deploy MBAM, you have to set Group Policy settings that define MBAM implementation settings for BitLocker drive encryption. To complete this task, you must copy the MBAM Group Policy Templates to a server or workstation that are capable of running Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM), and then edit the settings. - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you. - - - -## Copying the MBAM 2.5 Group Policy Templates - - -Before you install the MBAM Client, you must copy MBAM-specific Group Policy Objects (GPOs) to the Management Workstation. These GPOs define MBAM implementation settings for BitLocker drive encryption. You can copy the Group Policy templates to any server or workstation that is a supported Windows server or client computer and that is able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -[Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) - -## Editing MBAM 2.0 GPO settings - - -After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. To view and create GPOs, you must have Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) installed. - -[Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) - -## Showing or hiding the MBAM Control Panel in Windows Control Panel - - -Since MBAM offers a customized MBAM control panel that can replace the default Windows BitLocker control panel, you can also choose to show or hide the default BitLocker Control Panel from end users by using Group Policy settings. - -[Hiding the Default BitLocker Drive Encryption Item in Control Panel](hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md) - -## Other Resources for deploying MBAM 2.0 Group Policy Objects - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/deploying-mbam-25.md b/mdop/mbam-v25/deploying-mbam-25.md deleted file mode 100644 index 48ab4bb17d..0000000000 --- a/mdop/mbam-v25/deploying-mbam-25.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Deploying MBAM 2.5 -description: Deploying MBAM 2.5 -author: dansimp -ms.assetid: 45403607-1f4d-42fe-8413-0d4da01808a6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.5 - - -Use this information to identify the procedures you can follow to deploy and configure Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server features to upgrade to MBAM 2.5 from previous versions, or to remove MBAM Server features. - -## Deployment information - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Topic descriptionLinks to topics
            -
          • Deployment topology options.

          • -
          • How to install the MBAM Server software.

          • -
          • How to configure the MBAM Server features.

          • -

          Deploying the MBAM 2.5 Server Infrastructure

          How to download and deploy the MBAM Group Policy Templates, which are required to manage MBAM Clients and BitLocker encryption policies in the enterprise.

          Deploying MBAM 2.5 Group Policy Objects

          How to use the MBAM Client Windows Installer files to deploy the MBAM Client software.

          Deploying the MBAM 2.5 Client

          Checklist that can assist you in deploying the MBAM Server features and MBAM Client.

          MBAM 2.5 Deployment Checklist

          How to upgrade MBAM from previous versions.

          Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions

          How to remove MBAM Server features or software.

          Removing MBAM Server Features or Software

          - - - -## Other resources for deploying MBAM - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Deploying MBAM 2.5 in a stand-alone configuration](https://support.microsoft.com/kb/3046555) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/deploying-the-mbam-25-client.md b/mdop/mbam-v25/deploying-the-mbam-25-client.md deleted file mode 100644 index 0a20208aa0..0000000000 --- a/mdop/mbam-v25/deploying-the-mbam-25-client.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Deploying the MBAM 2.5 Client -description: Deploying the MBAM 2.5 Client -author: dansimp -ms.assetid: 0a96a0ee-f280-49d9-a244-88f4147fe9fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.5 Client - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client software enables administrators to enforce and monitor BitLocker Drive Encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an electronic software distribution system, such as Active Directory Domain Services, or by directly encrypting the client computers as part of the initial imaging process. - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring Client software, you can enable BitLocker Drive Encryption on a computer in your organization either before the end user receives the computer or afterwards by configuring Group Policy and deploying the MBAM Client software by using an enterprise software deployment system. - -## Deploy the MBAM Client to desktop or laptop computers - - -After configuring Group Policy settings, you can use an enterprise software deployment system product like Microsoft System Center 2012 Configuration Manager or Active Directory Domain Services to deploy the MBAM Client installation Windows Installer files to target computers. You can use either the 32-bit or 64-bit MbamClientSetup.exe files or the 32-bit or 64-bit MBAMClient.msi files, which are provided with the MBAM Client software. For more information about deploying MBAM Group Policy settings, see [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md). - -**Note**   -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product. - - - -[How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md) - -## Deploy the MBAM Client as part of a Windows deployment - - -In organizations where computers are received and configured centrally, you can install the MBAM Client to manage BitLocker Drive Encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then BitLocker Drive Encryption-compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. If the Group Policy settings has been configured to require a PIN, users are prompted to set a PIN after they receive the policy. - -[How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md) - -## How to deploy the MBAM Client by using a command line - - -This section explains how to install the MBAM Client by using a command line. - -[How to Deploy the MBAM Client by Using a Command Line](how-to-deploy-the-mbam-client-by-using-a-command-line.md) - -## Other resources for deploying the MBAM Client - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md b/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md deleted file mode 100644 index d60e1044e5..0000000000 --- a/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Deploying the MBAM 2.5 Server Infrastructure -description: Deploying the MBAM 2.5 Server Infrastructure -author: dansimp -ms.assetid: e85a60cf-4cc1-4906-8da3-442232c374af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.5 Server Infrastructure - - -To deploy the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server infrastructure, you complete the following three high-level tasks: - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskWhere to get instructions

          Install the MBAM 2.5 Server software on each server where you want to configure an MBAM Server feature.

          Installing the MBAM 2.5 Server Software

          Configure the databases, reports, web applications, and the optional System Center Configuration Manager Integration topology.

          -

          You can use the MBAM Server Configuration wizard or Windows PowerShell cmdlets to do the configuration.

          Configuring the MBAM 2.5 Server Features

          Validate the MBAM Server configuration.

          Validating the MBAM 2.5 Server Feature Configuration

          - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md b/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md deleted file mode 100644 index 9ce836f5eb..0000000000 --- a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Determining why a Device Receives a Noncompliance Message -description: Determining why a Device Receives a Noncompliance Message -author: dansimp -ms.assetid: 793df330-a0ee-4759-b53a-95618ac74428 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/22/2017 ---- - - -# Determining why a Device Receives a Noncompliance Message - - -The following noncompliance codes are provided by WMI and describe the reasons why a particular device is reported by MBAM as noncompliant. - -You can use your preferred method to view WMI. If you use PowerShell, run `gwmi -class mbam_volume -Namespace root\microsoft\mbam` from a PowerShell prompt and search for ReasonsForNoncompliance. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Non-Compliance CodeReason for Non-Compliance

          0

          Cipher strength not AES 256.

          1

          MBAM Policy requires this volume to be encrypted but it is not.

          2

          MBAM Policy requires this volume to NOT be encrypted, but it is.

          3

          MBAM Policy requires this volume use a TPM protector, but it does not.

          4

          MBAM Policy requires this volume use a TPM+PIN protector, but it does not.

          5

          MBAM Policy does not allow non TPM machines to report as compliant.

          6

          Volume has a TPM protector but the TPM is not visible (booted with recover key after disabling TPM in BIOS?).

          7

          MBAM Policy requires this volume use a password protector, but it does not have one.

          8

          MBAM Policy requires this volume NOT use a password protector, but it has one.

          9

          MBAM Policy requires this volume use an auto-unlock protector, but it does not have one.

          10

          MBAM Policy requires this volume NOT use an auto-unlock protector, but it has one.

          11

          Policy conflict detected preventing MBAM from reporting this volume as compliant.

          12

          A system volume is needed to encrypt the OS volume but it is not present.

          13

          Protection is suspended for the volume.

          14

          AutoUnlock unsafe unless the OS volume is encrypted.

          15

          Policy requires minimum cypher strength is XTS-AES-128 bit, actual cypher strength is weaker than that.

          16

          Policy requires minimum cypher strength is XTS-AES-256 bit, actual cypher strength is weaker than that.

          - -  - -## Related topics - - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). -  - - - - - diff --git a/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md b/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md deleted file mode 100644 index a3a45c975d..0000000000 --- a/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md +++ /dev/null @@ -1,389 +0,0 @@ ---- -title: Edit the Configuration.mof File -description: Edit the Configuration.mof File -author: dansimp -ms.assetid: 5d8cd76b-8ffc-4d46-b761-1b8350310c48 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit the Configuration.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the **Configuration.mof** file, whether you are using System Center 2012 Configuration Manager or Configuration Manager 2007. Complete the following instructions for the version of Configuration Manager that you are using. - -**To edit the Configuration.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files \\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled, NoncomplianceDetectedDate, EnforcePolicyDate from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - [PropertySources{"NoncomplianceDetectedDate"}] - String NoncomplianceDetectedDate; - [PropertySources{"EnforcePolicyDate"}] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded Computer Name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -**To edit the Configuration.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files (x86)\\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled, NoncomplianceDetectedDate, EnforcePolicyDate from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - [PropertySources{"NoncomplianceDetectedDate"}] - String NoncomplianceDetectedDate; - [PropertySources{"EnforcePolicyDate"}] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded Computer Name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy_64 - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - UInt32 MBAMMachineError; - - // Encoded Computer Name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy_64 - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - - -## Related topics - - -[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - -[Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) - -[MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md b/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md deleted file mode 100644 index 8e285009f6..0000000000 --- a/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md +++ /dev/null @@ -1,113 +0,0 @@ ---- -title: Editing the MBAM 2.5 Group Policy Settings -description: Editing the MBAM 2.5 Group Policy Settings -author: dansimp -ms.assetid: a50b6b0c-6818-4419-8447-d0520a533dba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing the MBAM 2.5 Group Policy Settings - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you have to: - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskMore information

          Copy the MBAM 2.5 Group Policy Templates.

          Copying the MBAM 2.5 Group Policy Templates

          Determine which Group Policy Objects (GPOs) you want to use in your MBAM implementation. Based on the needs of your organization, you might have to configure additional Group Policy settings.

          Planning for MBAM 2.5 Group Policy Requirements – contains descriptions of the GPOs

          Set the Group Policy settings for your organization.

          - - - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you. - - - -**To edit MBAM Client Group Policy settings** - -1. On a computer that has the MBAM Group Policy Templates installed, make sure that MBAM Services are enabled. - -2. Using the Group Policy Management Console (GPMC.msc) or the Microsoft Advanced Group Policy Management MDOP product on a computer with the MBAM Group Policy Templates installed, select **Computer configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)**. - -3. Edit the Group Policy settings that are required to enable MBAM Client services on client computers. For each policy in the following table, select **Policy Group**, click the **Policy** you want, and then configure the settings. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy GroupPolicy

          Client Management

          Configure MBAM Services

          Operating System Drive

          Operating system drive encryption settings

          Removable Drive

          Control use of BitLocker on removable drives

          Fixed Drive

          Control use of BitLocker on fixed drives

          - - - -## Related topics - - -[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - -[Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md b/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md deleted file mode 100644 index 67c54060da..0000000000 --- a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md +++ /dev/null @@ -1,413 +0,0 @@ ---- -title: Evaluating MBAM 2.5 in a Test Environment -description: Evaluating MBAM 2.5 in a Test Environment -author: dansimp -ms.assetid: 72959b7a-e55f-4797-91b3-5be23c8c2844 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating MBAM 2.5 in a Test Environment - - -This topic describes how you can set up a test environment to evaluate Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 in the Stand-alone or System Center Configuration Manager Integration topology. - -## Evaluating MBAM 2.5 by using the Stand-alone topology - - -To evaluate MBAM by using the Stand-alone topology, use the information in the following tables to install the MBAM Server software, and then configure the MBAM Server features in your test environment. - -**To evaluate MBAM 2.5 by using the Stand-alone topology** - -1. Before installing MBAM, do the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskWhere to get instructions

          Ensure that you have installed all of the prerequisite software.

          MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

          Check the required hardware, RAM, and other specifications.

          MBAM 2.5 Supported Configurations

          Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.

          Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          - - - -2. Install the MBAM Server software, and then configure the features you want. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskWhere to get instructions

          Install the MBAM Server software on each server where you want to configure an MBAM Server feature.

          Installing the MBAM 2.5 Server Software

          Configure the Compliance and Audit Database and the Recovery Database.

          How to Configure the MBAM 2.5 Databases

          Configure the Reports feature.

          How to Configure the MBAM 2.5 Reports

          Configure the web applications.

          How to Configure the MBAM 2.5 Web Applications

          - - - -3. On a client computer, do the following: - - 1. Install the MBAM Client on a client computer. - - 2. Apply the MBAM Group Policy Objects (GPOs) to the computer. - - 3. Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals: - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement - "ClientWakeupFrequency"=dword:00000001 - "StatusReportingFrequency"=dword:00000001 - ``` - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM] - "NoStartupDelay"=dword:00000001 - ``` - - **Note** - Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment. - - - - 4. Restart the **BitLocker Management Client Service**. - -## Evaluating MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology - - -To evaluate MBAM by using the Configuration Manager Integration topology, use the information in the following tables to install the MBAM Server software, and then configure the MBAM Server features in your test environment. After installing the MBAM Client on a client computer, you will complete additional steps to force the MBAM Client to report the computer’s status to MBAM more quickly. - -**To evaluate MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology** - -1. Before installing MBAM, review the prerequisite software and supported configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskWhere to get instructions

          Ensure that you have installed all of the prerequisite software.

          MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

          -

          MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology

          Check the required hardware, RAM, and other specifications.

          MBAM 2.5 Supported Configurations

          Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.

          Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          Create or edit the .mof files.

          Edit the Configuration.mof File

          -

          Create or Edit the Sms_def.mof File

          - - - -2. Install the MBAM Server software, and then configure the features you want. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskWhere to get instructions

          Install the MBAM Server software on each server where you want to configure an MBAM Server feature.

          -
          - Note

          You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.

          -
          -
          - -

          Installing the MBAM 2.5 Server Software

          Configure the Compliance and Audit Database and the Recovery Database.

          How to Configure the MBAM 2.5 Databases

          Configure the Reports feature.

          How to Configure the MBAM 2.5 Reports

          Configure the web applications.

          How to Configure the MBAM 2.5 Web Applications

          Configure the System Center Configuration Manager to install the Configuration Manager objects.

          How to Configure the MBAM 2.5 System Center Configuration Manager Integration

          - - - -3. On a client computer, do the following: - - 1. Install the MBAM Client and the Configuration Manager Client on a client computer. - - 2. Apply the MBAM Group Policy Objects to the computer. - - 3. Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals: - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement - "ClientWakeupFrequency"=dword:00000001 - "StatusReportingFrequency"=dword:00000001 - ``` - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM] - "NoStartupDelay"=dword:00000001 - ``` - - **Note** - Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment. - - - - 4. Restart the **BitLocker Management Client Service**. - - 5. In Control Panel, open **Configuration Manager**, and then click the **Actions** tab. - - 6. Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files, and then sends the data to the Configuration Manager server. - - 7. Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer. - - - -4. In the Configuration Manager console, do the following: - - 1. In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately. - - 2. In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection. - -5. On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following: - - 1. Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**. - - 2. Click the **Configurations** tab, select the BitLocker baseline, and then click **Evaluate**. - -6. In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report: as follows: - - 1. In the navigation pane, select the **Monitoring** workspace. - - 2. In the console tree, expand **Overview** > **Reporting** > **Reports** > **MBAM**. - - 3. Select the folder that represents the language in which you want to view reports, and then select the report in the results pane. - -## Evaluating MBAM 2.5 by using the System Center Configuration Manager 2007 Integration topology - - -To evaluate MBAM by using the Configuration Manager Integration topology, follow the same steps to install and configure MBAM in your test environment as you use in a production environment. After installing the MBAM Client on a client computer, complete the additional steps in this topic to enable the MBAM Client to start reporting the computer’s status to MBAM more quickly. - -**To evaluate MBAM by using the Configuration Manager 2007 Integration topology** - -1. Before you install MBAM, do the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskWhere to get instructions

          Ensure that you have installed all of the prerequisite software.

          MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

          -

          MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology

          Check the required hardware, RAM, and other specifications.

          MBAM 2.5 Supported Configurations

          Create or edit the .mof files.

          Edit the Configuration.mof File

          -

          Create or Edit the Sms_def.mof File

          - - - -2. Install the MBAM Server software, and then configure the features you want. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskWhere to get instructions

          Install the MBAM Server software on each server where you want to configure an MBAM Server feature.

          -
          - Note

          You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.

          -
          -
          - -

          Installing the MBAM 2.5 Server Software

          Configure the Compliance and Audit Database and the Recovery Database.

          How to Configure the MBAM 2.5 Databases

          Configure the Reports feature.

          How to Configure the MBAM 2.5 Reports

          Configure the web applications.

          How to Configure the MBAM 2.5 Web Applications

          Configure the System Center Configuration Manager to install the Configuration Manager objects.

          How to Configure the MBAM 2.5 System Center Configuration Manager Integration

          - - - -3. On a client computer, do the following: - - 1. Install the MBAM Client on a client computer. - - 2. Apply the MBAM Group Policy Objects to the computer. - - 3. Set the following registry keys to force the MBAM Client to wake up more quickly and at faster intervals: - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement - "ClientWakeupFrequency"=dword:00000001 - "StatusReportingFrequency"=dword:00000001 - ``` - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM] - "NoStartupDelay"=dword:00000001 - ``` - - **Note** - Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in an evaluation environment. - - - - 4. Restart the **BitLocker Management Client Service**. - - 5. In Control Panel, open **Configuration Manager**, and then click the **Actions** tab. - - 6. Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer. - - 7. Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files and then sends the data to the Configuration Manager server. - -4. In the Configuration Manager console, do the following: - - 1. In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately. - - 2. In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection. - -5. On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following: - - 1. Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**. - - 2. Click the **Configurations** tab, select the BitLocker baseline, and click **Evaluate**. - -6. In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report, as follows - - 1. In the navigation pane, expand **Computer Management** > **Reporting** > **Reporting Services** > **<server name>MBAM**. - - 2. Within the **MBAM** node, select the folder that represents the language in which you want to view reports, and then select the report from the results pane. - - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md deleted file mode 100644 index 9fe1680548..0000000000 --- a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: Generating MBAM 2.5 Stand-alone Reports -description: Generating MBAM 2.5 Stand-alone Reports -author: dansimp -ms.assetid: 0ec623ff-5155-4906-aef2-20cdc0f84667 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# Generating MBAM 2.5 Stand-alone Reports - - -When you configure Microsoft BitLocker Administration and Monitoring (MBAM) with the Stand-alone topology, you can generate reports to monitor BitLocker drive encryption usage and compliance. This topic contains the following procedures: - -- [To open the Administration and Monitoring Website](#bkmk-openadmin) - -- [To generate an Enterprise Compliance Report](#bkmk-enterprise) - -- [To generate a Computer Compliance Report](#bkmk-computercomp) - -- [To generate a Recovery Key Audit Report](#bkmk-recoverykey) - -For descriptions of the Stand-alone reports, see [Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md). - -**Note**   -To run the reports, you must be a member of the **MBAM Report Users** group, which you configure in Active Directory Domain Services. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md). - - - -**To open the Administration and Monitoring Website** - -1. Open a web browser and navigate to the Administration and Monitoring Website. The default URL for the Administration and Monitoring Website is: - - *http(s)://<MBAMAdministrationServerName>:<port>/Helpdesk* - -2. In the left pane, click **Reports**. From the top menu bar, select the report you want to run. - - MBAM client data is retained in the Compliance and Audit Database for historical reference in case a computer is lost or stolen. When running enterprise reports, we recommend that you use appropriate start and end dates to scope the time frames for the reports from one to two weeks to increase reporting data accuracy. - - After you generate a report, you can save the results in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - - **Note**   - Configure SQL Server Reporting Services (SSRS) to use Secure Sockets Layer (SSL) before configuring the Administration and Monitoring Website. If, for any reason, SSRS is not configured to use SSL, the URL for the Reports will be set to HTTP instead of to HTTPS when you configure the Administration and Monitoring Website. If you then go to the Administration and Monitoring Website and select a report, the following message displays: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. - - - -**To generate an Enterprise Compliance Report** - -1. From the Administration and Monitoring Website, select the **Reports** node from the left navigation pane, select **Enterprise Compliance Report**, and select the filters that you want to use. The available filters for the Enterprise Compliance Report are: - - - **Compliance Status**. Use this filter to specify the compliance status types of the report (for example, Compliant or Noncompliant). - - - **Error State**. Use this filter to specify the error state types of the report (for example, No Error or Error). - -2. Click **View Report** to display the selected report. - -3. Select a computer name to view information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - -**To generate a Computer Compliance Report** - -1. From the Administration and Monitoring Website, select the **Report** node from the left navigation pane, and then select **Computer Compliance Report**. Use the Computer Compliance Report to search for **User name** or **Computer name**. - -2. Click **View Report** to view the Computer Compliance Report. - -3. Select a computer name to display more information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - - **Note**   - An MBAM client computer is considered compliant if the computer matches or exceeds the requirements of the MBAM Group Policy settings. - -**To generate a Recovery Key Audit Report** - -1. From the Administration and Monitoring Website, select the **Report** node in the left navigation pane, and then select **Recovery Audit Report**. Select the filters for your Recovery Key Audit Report. The available filters for recovery key audits are as follows: - - - **Helpdesk User**. This filter enables users to specify the user name of the requester. The requester is the person in the Help Desk who accessed the key on behalf of an end user. - - - **End User**. This filter enables users to specify the user name of the requestee. The requestee is the end user who called the Help Desk to obtain a recovery key. - - - **Request Result**. This filter enables users to specify the request result types (for example, Success or Failed) that they want to base the report on. For example, users may want to view failed key access attempts. - - - **Key Type**. This filter enables users to specify the key type (for example, Recovery Key Password or TPM Password Hash) that they want to base the report on. - - - **Start Date**. This filter is used to define the Start Date part of the date range that the user wants to report on. - - - **End Date**. This filter is used to define the End Date part of the date range that the users want to report on. - -2. Click **View Report** to view the report. - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - -[Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/getting-started-with-mbam-25.md b/mdop/mbam-v25/getting-started-with-mbam-25.md deleted file mode 100644 index 27038fd66a..0000000000 --- a/mdop/mbam-v25/getting-started-with-mbam-25.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Getting Started with MBAM 2.5 -description: Getting Started with MBAM 2.5 -author: dansimp -ms.assetid: 23d0cfbb-e2ef-4c34-bf29-1b7ab4c48f00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with MBAM 2.5 - - -This topic provides a list of links to help you learn about Microsoft BitLocker Administration and Monitoring (MBAM) 2.5, its purpose, features, recommended architecture, and steps for evaluating MBAM in a test environment. - -See the following resources for additional MBAM documentation: - -- [Microsoft BitLocker Administration and Monitoring Deployment Guide](https://go.microsoft.com/fwlink/?LinkId=396653) - -Before you deploy MBAM to a production environment, we recommend that you validate your deployment plan in a test environment. - -## Getting started with MBAM 2.5 - - -Before you start planning your MBAM deployment, review the following topics. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Topic descriptionLinks to topics

          High-level overview of MBAM 2.5 that describes how you can use it in your organization.

          About MBAM 2.5

          Release notes, which lists known issues in the product.

          Release Notes for MBAM 2.5

          Information about how you can evaluate MBAM 2.5 in a test environment.

          Evaluating MBAM 2.5 in a Test Environment

          Description of the MBAM 2.5 features and the recommended architecture of the Stand-alone and Configuration Manager Integration topologies in a production environment.

          High-Level Architecture for MBAM 2.5

          Description and illustration of each MBAM Server feature, without the recommended architecture.

          Illustrated Features of an MBAM 2.5 Deployment

          Describes the keyboard shortcuts that are available for MBAM 2.5.

          Accessibility for MBAM 2.5

          - - - -## How to get MDOP technologies - - -MBAM 2.5 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and about acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for this product - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md b/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md deleted file mode 100644 index 5ef9f09421..0000000000 --- a/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Hiding the Default BitLocker Drive Encryption Item in Control Panel -description: Hiding the Default BitLocker Drive Encryption Item in Control Panel -author: dansimp -ms.assetid: 6e2a9a02-a809-43a1-80a3-1b03c7192c89 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Hiding the Default BitLocker Drive Encryption Item in Control Panel - - -This topic describes how to hide the **BitLocker Drive Encryption** Control Panel item, which appears by default on Control Panel as part of the Windows operating system. - -**Note**   -Microsoft BitLocker Administration and Monitoring (MBAM) creates an additional, custom Control Panel item, called **BitLocker Encryption Options**, which enables end users to manage their PIN and password, turn on BitLocker for a drive, and check encryption. - - - -See [Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) to read about: - -- Differences between the MBAM and the default Control Panel items - -- **Manage BitLocker** shortcut menu that appears when you right-click a drive in Windows Explorer - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node. If you do, MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you. - - - -**To hide the default BitLocker Drive Encryption item in Control Panel** - -1. In the Group Policy Management Console (GPMC) or in Advanced Group Policy Management, browse to **User configuration** > **Policies** > **Administrative Templates** > **Control Panel**. - -2. In the **Details** pane, double-click **Hide specified Control Panel items**, and then click **Enabled**. - -3. Click **Show**, click **Add**, and then type **Microsoft.BitLockerDriveEncryption**. - - - -## Related topics - - -[Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) - -[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/high-level-architecture-for-mbam-25.md b/mdop/mbam-v25/high-level-architecture-for-mbam-25.md deleted file mode 100644 index 10db3f3710..0000000000 --- a/mdop/mbam-v25/high-level-architecture-for-mbam-25.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: High-Level Architecture for MBAM 2.5 -description: High-Level Architecture for MBAM 2.5 -author: dansimp -ms.assetid: b42af25c-961b-4a6a-92d2-916a373eb68b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture for MBAM 2.5 - - -Microsoft BitLocker Administration and Monitoring can be deployed in a Stand-alone topology, where you run MBAM as a stand-alone product, or in a topology that is integrated with System Center 2012 R2 Configuration Manager, System Center 2012 Configuration Manager, or Microsoft System Center Configuration Manager 2007. The high-level architecture information describes and illustrates the recommended architecture and servers for each topology and the features that you configure on each server. - -## High-level architecture information - - -- [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md) - - This section describes and illustrates the recommended MBAM architecture for the MBAM Stand-alone topology. It also lists the servers and the features that you configure on the servers. - -- [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md) - - This section describes and illustrates the recommended MBAM architecture for the System Center Configuration Manager Integration topology. It also lists the servers and the features that you configure on the servers. - -## Other resources - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md deleted file mode 100644 index 3f47fccbd0..0000000000 --- a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md +++ /dev/null @@ -1,297 +0,0 @@ ---- -title: High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology -description: High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology -author: dansimp -ms.assetid: 075bafa1-792b-4c24-9d8e-5d3153e2112c -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/23/2018 -ms.author: dansimp ---- - - -# High-level architecture of MBAM 2.5 with Configuration Manager Integration topology - -This topic describes the recommended architecture for deploying Microsoft BitLocker Administration and Monitoring (MBAM) with the Configuration Manager Integration topology. This topology integrates MBAM with System Center Configuration Manager. To deploy MBAM with the Stand-alone topology, see [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md). - -For a list of the supported versions of the software mentioned in this topic, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**Important**   -Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007. - - - -## Recommended number of servers and supported number of clients - - -The recommended number of servers and supported number of clients in a production environment is as follows: - - ---- - - - - - - - - - - - - - - - - -
          Recommended architectureDetails

          Number of servers and other computers

          Three servers

          -

          One workstation

          Number of client computers supported

          500,000

          - - - -## Differences between Configuration Manager Integration and stand-alone topologies - - -The main differences between the topologies are: - -- The compliance and reporting features are removed from MBAM and are accessed from Configuration Manager. - -- Reports are viewed from the Configuration Manager Management Console, with the exception of the Recovery Audit Report, which you continue to view from the MBAM Administration and Monitoring Website. - -## Recommended MBAM high-level architecture with the Configuration Manager Integration topology - - -The following diagram and table describe the recommended high-level architecture for MBAM with the Configuration Manager Integration topology. MBAM multi-forest deployments require a one-way or two-way trust. One-way trusts require that the server domain trusts the client domain. - -![mbam2\-5](images/mbam2-5-cmserver.png) - -### Database server - -#### Recovery database - -This feature is configured on a computer running Windows Server and supported SQL Server instance. - -The **Recovery Database** stores recovery data that is collected from MBAM Client computers. - -#### Audit database - -This feature is configured on a computer running Windows Server and supported SQL Server instance. - -The **Audit Database** stores audit activity data that is collected from client computers that have accessed recovery data. - -#### Reports - -This feature is configured on a computer running Windows Server and supported SQL Server instance. - -The **Reports** provide recovery audit data for the client computers in your enterprise. You can view reports from the Configuration Manager console or directly from SQL Server Reporting Services. - -### Configuration Manager primary site server - -System Center Configuration Manager Integration feature - -- This feature is configured on the Configuration Manager Primary Site Server, which is the top-tier server in your Configuration Manager infrastructure. - -- The **Configuration Manager Server** collects the hardware inventory information from client computers and is used to report BitLocker compliance of client computers. - -- When you run the Microsoft BitLocker Administration and Monitoring Setup wizard to install the server software, the MBAM Supported Computers collection, configuration baseline, and reports are configured on the Configuration Manager Primary Site Server. - -- The **Configuration Manager console** must be installed on the same computer on which you install the MBAM Server software. - -### Administration and monitoring server - -#### Administration and monitoring website - -This feature is configured on a computer running Windows Server. - -The **Administration and monitoring website** is used to: - -- Help end users regain access to their computers when they are locked out. (This area of the Website is commonly called the Help Desk.) - -- View the Recovery Audit Report, which shows recovery activity for client computers. Other reports are viewed from the Configuration Manager console. - -#### Self-service portal - -This feature is configured on a computer running Windows Server. - -The **Self-Service Portal** is a website that enables end users on client computers to independently log on to a website to get a recovery key if they lose or forget their BitLocker password. - -#### Monitoring web services for this website - -This feature is installed on a computer running Windows Server. - -The **monitoring web services** are used by the MBAM Client and the websites to communicate to the database. - -**Important**
          The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM websites communicate directly with the Recovery Database. - - - -### Management workstation - -#### MBAM group policy templates - -- The **MBAM Group Policy Templates** are Group Policy settings that define implementation settings for MBAM, which enable you to manage BitLocker drive encryption. - -- Before you run MBAM, you must download the Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and copy them to a server or workstation that is running a supported Windows Server or Windows operating system. - - **NOTE**
          The workstation does not have to be a dedicated computer. - - - -### MBAM Client and Configuration Manager Client computer - -#### MBAM Client software - -The **MBAM Client**: - -- Uses Group Policy Objects to enforce BitLocker drive encryption on client computers in the enterprise. - -- Collects the BitLocker recovery key for three data drive types: operating system drives, fixed data drives, and removable (USB) data drives. - -- Collects recovery information and computer information about the client computers. - -#### Configuration Manager Client - -The **Configuration Manager Client** enables Configuration Manager to collect hardware compatibility data about the client computers and report compliance information. - - - -## Differences in MBAM deployment for supported Configuration Manager versions - - -When you deploy MBAM with the Configuration Manager Integration topology, you can install MBAM on a primary site server. However, the MBAM installation works differently for System Center 2012 Configuration Manager and Configuration Manager 2007. - - ---- - - - - - - - - - - - - - - - - -
          Configuration Manager versionDescription

          System Center 2012 R2 Configuration Manager

          -

          System Center 2012 Configuration Manager

          If you install MBAM on a primary site server or on a central administration server, MBAM performs all of the installation actions on that site server.

          Configuration Manager 2007 R2

          -

          Configuration Manager 2007

          If you install MBAM on a primary site server that is part of a larger Configuration Manager hierarchy with a central site parent server, MBAM identifies the central site parent server and performs all of the installation actions on that parent server. The installation includes checking prerequisites and installing the Configuration Manager objects and reports.

          -

          For example, if you install MBAM on a primary site server that is a child of a central site parent server, MBAM installs all of the Configuration Manager objects and reports on the parent server. If you install MBAM on the parent server, MBAM performs all of the installation actions on that parent server.

          - - - -## How MBAM works with Configuration Manager - - -The integration of MBAM with Configuration Manager is based on a configuration pack that installs the items described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Items installed into Configuration ManagerDescription

          Configuration data

          The configuration data installs a configuration baseline, called “BitLocker Protection,” which contains two configuration items:

          -
            -
          • BitLocker Operating System Drive Protection

          • -
          • BitLocker Fixed Data Drives Protection

          • -
          -

          The configuration baseline is deployed to the MBAM Supported Computers collection, which is also created when MBAM is installed.

          -

          The two configuration items provide the basis for evaluating the compliance status of the client computers. This information is captured, stored, and evaluated in Configuration Manager.

          -

          The configuration items are based on the compliance requirements for operating system drives and fixed data drives. The required details for the deployed computers are collected so that the compliance for those drive types can be evaluated.

          -

          By default, the configuration baseline evaluates the compliance status every 12 hours and sends the compliance data to Configuration Manager.

          MBAM Supported Computers collection

          MBAM creates a collection that is called MBAM Supported Computers. The configuration baseline is targeted to client computers that are in this collection.

          -

          This is a dynamic collection. By default, it runs every 12 hours and evaluates membership, based on three criteria:

          -
            -
          • The computer is a supported version of the Windows operating system.

          • -
          • The computer is a physical computer. Virtual machines are not supported.

          • -
          • The computer has a Trusted Platform Module (TPM) that is available. A compatible version of TPM 1.2 or later is required for Windows 7. Windows 10, Windows 8.1, Windows 8, and Windows To Go do not require a TPM.

          • -
          -

          The collection is evaluated against all computers and a subset of compatible computers is created, which provides the basis for compliance evaluation and reporting for the MBAM integration.

          Reports

          When you configure MBAM with the Configuration Manager Integration topology, you view all reports in Configuration Manager, except the Recovery Audit Report, the latter of which you continue to view in the MBAM Administration and Monitoring Website. The reports available in Configuration Manager are:

          - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ReportDescription

          BitLocker Enterprise Compliance Dashboard

          Gives IT administrators three views of information in a single report: Compliance Status Distribution, Non Compliant – Errors Distribution, and Compliance Status Distribution By Drive Type. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the selected state.

          BitLocker Enterprise Compliance Details

          Lets IT administrators view information about the BitLocker encryption compliance status of the enterprise and includes the compliance status for each computer. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the selected state.

          BitLocker Computer Compliance

          Lets IT administrators view an individual computer and determine why it was reported with a status of compliant or not compliant. The report also displays the encryption state of the operating system drives and fixed data drives.

          BitLocker Enterprise Compliance Summary

          Lets IT administrators view the status of MBAM policy compliance in the enterprise. Each computer’s state is evaluated, and the report shows a summary of the compliance of all computers in the enterprise against the policy. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the selected state.

          -

           

          - - - - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md) - -[Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md deleted file mode 100644 index 48a70ddaaa..0000000000 --- a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md +++ /dev/null @@ -1,161 +0,0 @@ ---- -title: High-Level Architecture of MBAM 2.5 with Stand-alone Topology -description: High-Level Architecture of MBAM 2.5 with Stand-alone Topology -author: dansimp -ms.assetid: 35f8c5f6-8be3-443d-baf0-56d68b08f3bc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# High-Level Architecture of MBAM 2.5 with Stand-alone Topology - - -This topic describes the recommended architecture for deploying Microsoft BitLocker Administration and Monitoring (MBAM) with the Configuration Manager Stand-alone topology. In this topology, MBAM is deployed as a stand-alone product. You can alternatively deploy MBAM with the Configuration Manager Integration topology, which integrates MBAM with Configuration Manager. For more information, see [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). - -For a list of the supported versions of the software mentioned in this topic, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**Note**   -We recommend you use a single-server architecture in test environments only. - - - -## Recommended number of servers and supported number of clients - - -The recommended number of servers and supported number of clients in a production environment is as follows: - - ---- - - - - - - - - - - - - - - - - -
          Recommended architecture in a production environmentDetails

          Number of servers and other computers

          Two servers

          -

          One workstation

          Number of client computers supported

          500,000

          - - - -## Recommended MBAM high-level architecture with the Stand-alone topology - - -The following diagram and table describe the recommended high-level, two-server architecture for MBAM with the Stand-alone topology. MBAM multi-forest deployments require a one-way or two-way trust. One-way trusts require that the server domain trusts the client domain. - -![mbam2](images/mbam2-5-2servers.png) - -Server -Features to configure on this server -Description -Database server - -Compliance and Audit Database - -This feature is configured on a server running Windows Server and supported SQL Server instance. - -The **Compliance and Audit Database** stores compliance data, which is used primarily for reports that SQL Server Reporting Services hosts. - -Recovery Database - -This feature is configured on a server running Windows Server and supported SQL Server instance. - -The **Recovery Database** stores recovery data that is collected from MBAM client computers. - -Reports - -This feature is configured on a server running Windows Server and supported SQL Server instance. - -The **Reports** provide recovery audit and compliance status data about the client computers in your enterprise. You can access the reports from the Administration and Monitoring Website or directly from SQL Server Reporting Services. - -Administration and Monitoring Server - -Administration and Monitoring Website - -This feature is configured on a computer running Windows Server. - -The **Administration and Monitoring Website** is used to: - -- Help end users regain access to their computers when they are locked out. (This area of the Website is commonly called the Help Desk.) - -- View reports that show compliance status and recovery activity for client computers. - -Self-Service Portal - -This feature is configured on a computer running Windows Server. - -The **Self-Service Portal** is a website that enables end users on client computers to independently log on to a website to get a recovery key if they lose or forget their BitLocker password. - -Monitoring web services for this website - -This feature is configured on a computer running Windows Server. - -The **monitoring web services** are used by the MBAM Client and the websites to communicate to the database. - -**Important**   -The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM websites communicate directly with the Recovery Database. - - - -Management workstation - -MBAM Group Policy Templates - -- The MBAM Group Policy Templates are Group Policy settings that define implementation settings for MBAM, which enable you to manage BitLocker Drive Encryption. - -- Before you run MBAM, you must download the Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and copy them to a server or workstation that is running a supported Windows Server or Windows operating system. - -- The workstation does not have to be a dedicated computer. - -MBAM Client and Configuration Manager client computer - -MBAM Client software - -The MBAM Client: - -- Uses Group Policy Objects to enforce BitLocker Drive Encryption on client computers in the enterprise. - -- Collects the Bitlocker recovery key for three data drive types: operating system drives, fixed data drives, and removable (USB) data drives. - -- Collects recovery information and computer information about the client computers. - - - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md) - -[Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md deleted file mode 100644 index 1c818b89dc..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md +++ /dev/null @@ -1,237 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 Databases -description: How to Configure the MBAM 2.5 Databases -author: dansimp -ms.assetid: 66e1c81b-f785-4398-9175-bb5f112c2a35 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 Databases - - -This topic explains how to configure the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Compliance and Audit Database and the Recovery Database by using: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The instructions are based on the recommended architecture in [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepWhere to get instructions

          Review the recommended architecture for MBAM.

          High-Level Architecture for MBAM 2.5

          Review the supported configurations for MBAM.

          MBAM 2.5 Supported Configurations

          Complete the required prerequisites on each server.

          Install the MBAM Server software on each server where you plan to configure an MBAM Server feature.

          -
          -Note

          You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.

          -
          -
          - -

          Installing the MBAM 2.5 Server Software

          Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features.

          Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          - - - -**To configure the databases by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamDatabase** Windows PowerShell cmdlet to configure the databases. To get information about this Windows PowerShell cmdlet, type **Get-Help Enable-MbamDatabase**. - -**To configure the Compliance and Audit Database by using the wizard** - -1. On the server where you want to configure the databases, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **Compliance and Audit Database** and **Recovery Database**, and then click **Next**. The wizard checks that all prerequisites for the databases have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**. - -4. Using the following descriptions, enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          SQL Server name

          Name of the server where you are configuring the Compliance and Audit Database.

          -
          - Note

          You must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.

          -
          -
          - -

          SQL Server database instance

          Name of the database instance where the compliance and audit data will be stored. You must also specify where the database information will be located.

          Database name

          Name of the database that will store the compliance data.

          -
          - Note

          If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.

          -
          -
          - -

          Read/write access domain user or group

          Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.

          -

          If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.

          -

          If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.

          Read-only access domain user or group

          Name of the user or group that will have read-only permission to this database to enable the reports to access the compliance data in this database.

          -

          If you enter a user in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page.

          -

          If you enter a group in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field.

          - - - -5. Continue to the next section to configure the Recovery Database. - -**To configure the Recovery Database by using the wizard** - -1. Using the following descriptions, enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          SQL Server name

          Name of the server where you are configuring the Recovery Database.

          -
          - Note

          You must add an exception on the Recovery Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.

          -
          -
          - -

          SQL Server database instance

          Name of the database instance where the recovery data will be stored. You must also specify where the database information will be located.

          Database name

          Name of the database that will store the recovery data.

          -
          - Note

          If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.

          -
          -
          - -

          Read/write access domain user or group

          Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.

          -

          If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.

          -

          If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.

          - - - -2. When you finish your entries, click **Next**. - - The wizard checks that all prerequisites for the databases have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Next** again. - -4. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script. - - - -5. Click **Add** to add the MBAM databases on the server, and then click **Close**. - - - -## Related topics - - -[Server Event Logs](server-event-logs.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md deleted file mode 100644 index b76b25843c..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 Reports -description: How to Configure the MBAM 2.5 Reports -author: dansimp -ms.assetid: ec462879-0253-4d9c-83c7-a9bcad479725 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 Reports - - -This topic explains how to configure the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Reports feature by using: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The instructions are based on the recommended architecture in [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepWhere to get instructions

          Review the recommended architecture for MBAM.

          High-Level Architecture for MBAM 2.5

          Review the supported configurations for MBAM.

          MBAM 2.5 Supported Configurations

          Complete the required prerequisites on each server.

          Install the MBAM Server software on each server where you plan to configure an MBAM Server feature.

          Installing the MBAM 2.5 Server Software

          Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features.

          Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          - - - -**To configure the Reports by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamReport** Windows PowerShell cmdlet to configure the Reports. To get information about this Windows PowerShell cmdlet, type **Get-Help Enable-MbamReport**. - -**To configure the Reports by using the wizard** - -1. On the server where you want to configure the Reports, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **Reports**, and then click **Next**. The wizard checks that all prerequisites for the Reports have been met. - -3. Click **Next** to continue. - -4. Using the following descriptions, enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          SQL Server Reporting Services instance

          Instance of SQL Server Reporting Services where the Reports will be configured.

          Reporting role domain group

          Name of the domain Users group whose members have rights to access the reports on the Administration and Monitoring Server.

          SQL Server name

          Name of the server where the Compliance and Audit Database is configured.

          SQL Server database instance

          Name of the instance of SQL Server (for example, MSSQLSERVER) where the Compliance and Audit Database is configured.

          -
          - Note

          You must add an exception on the Reports computer to enable inbound traffic on the port of the Reporting Server (the default port is 80).

          -
          -
          - -

          Database name

          Name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you configure the Compliance and Audit Database.

          -
          - Note

          If you are upgrading from a previous version of MBAM, you must use the same database name as the name used in your previous deployment.

          -
          -
          - -

          Compliance and Audit Database domain account

          Domain user account and password to access the Compliance and Audit Database.

          -

          If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user, you must enter that same value in this field.

          -

          If the value that you enter in the Read-only access domain user or group field on the Configure Databases page is a group, the value that you enter in this field must be a member of that group.

          -

          Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group.

          - - - -5. When you finish your entries, click **Next**. - - The wizard checks that all prerequisites for the Reports feature have been met. - -6. Click **Next** to continue. - -7. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script. - - - -8. Click **Add** to add the Reports on the server, and then click **Close**. - - - -## Related topics - - -[Server Event Logs](server-event-logs.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md deleted file mode 100644 index 38766dc323..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 System Center Configuration Manager Integration -description: How to Configure the MBAM 2.5 System Center Configuration Manager Integration -author: dansimp -ms.assetid: 2b8a4c13-1dad-41e8-89ac-6889c5f7e051 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 System Center Configuration Manager Integration - - -This topic explains how to configure Microsoft BitLocker Administration and Monitoring (MBAM) to use the System Center Configuration Manager Integration topology, which integrates MBAM with Configuration Manager. - -The instructions explain how to configure Configuration Manager Integration by using: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The instructions are based on the recommended architecture in [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepWhere to get instructions

          Review the recommended architecture for MBAM.

          High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology

          Review the supported configurations for MBAM.

          MBAM 2.5 Supported Configurations

          Complete the required prerequisites on each server.

          Install the MBAM Server software on each server where you will configure an MBAM Server feature.

          -
          -Note

          For this topology, you must install the Configuration Manager console on the computer where you are installing the MBAM Server software.

          -
          -
          - -

          Installing the MBAM 2.5 Server Software

          Review Windows PowerShell prerequisites (applicable only if you are going to use Windows PowerShell cmdlets to configure MBAM).

          Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          - - - -**To configure Configuration Manager Integration by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamCMIntegration** Windows PowerShell cmdlet to configure the Reports. To get information about this cmdlet, type **Get-Help Enable-MbamCMIntegration**. - -**To configure the System Center Configuration Manager Integration by using the wizard** - -1. On the server where you want to configure the System Center Configuration Manager Integration feature, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **System Center Configuration Manager Integration**, and then click **Next**. - - The wizard checks that all prerequisites for the Configuration Manager Integration have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**. - -4. Use the following descriptions to enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          SQL Server Reporting Services server

          Fully qualified domain name (FQDN) of the server with the Reporting Service point role. This is the server to which the MBAM Configuration Manager Reports are deployed.

          -

          If you don’t specify a server, the Configuration Manager Reports will be deployed to the local server.

          SQL Server Reporting Services instance

          Name of the SQL Server Reporting Services (SSRS) instance where the Configuration Manager Reports are deployed.

          -

          If you don’t specify an instance, the Configuration Manager Reports will be deployed to the default SSRS instance name. The value you enter is ignored if the server has System Center 2012 Configuration Manager installed.

          - - - -5. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script of the entries you just made, click **Export PowerShell Script** and save the script. - - - -6. Click **Add** to add the Configuration Manager Integration feature to the server, and then click **Close**. - - - -## Related topics - - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md deleted file mode 100644 index dba8888b3b..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md +++ /dev/null @@ -1,430 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 Web Applications -description: How to Configure the MBAM 2.5 Web Applications -author: dansimp -ms.assetid: 909bf2d3-028c-4ac1-9247-171532a1eeae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 Web Applications - - -This topic explains how to configure the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 web applications for the recommended [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) by using one of the following methods: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The web applications comprise the following websites and their corresponding web services: - - ---- - - - - - - - - - - - - - - - - -
          WebsiteDescription

          Administration and Monitoring Website

          Website where specified users can view reports and help end users recover their computers when they forget their PIN or password

          Self-Service Portal

          Website that end users can access to independently regain access to their computers if they forget their PIN or password

          - - - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepWhere to get instructions

          Review the recommended architecture for MBAM.

          High-Level Architecture for MBAM 2.5

          Review the supported configurations for MBAM.

          MBAM 2.5 Supported Configurations

          Complete the required prerequisites on each server.

          -
          -Note

          Ensure that you configure SQL ServerReporting Services (SSRS) to use the Secure Sockets Layer (SSL) before you configure the Administration and Monitoring Website. Otherwise, the Reports feature will use HTTP instead of HTTPS.

          -
          -
          - -

          Register service principal names (SPNs) for the application pool account for the websites. You need to do this step only if you do not have administrative domain rights in Active Directory Domain Services (AD DS). If you do have these rights in AD DS, MBAM will create the SPNs for you.

          Planning How to Secure the MBAM Websites

          Install the MBAM Server software on each server where you will configure an MBAM Server feature.

          -
          -Note

          If you plan to install the websites on one server and the web services on another, you will be able to configure them only by using the Enable-MbamWebApplication Windows PowerShell cmdlet. The MBAM Server Configuration wizard does not support configuring these items on separate servers.

          -
          -
          - -

          Installing the MBAM 2.5 Server Software

          Review the prerequisites for using Windows PowerShell if you plan to use cmdlets to configure MBAM Server features.

          Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          - - - -**To configure the web applications by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamWebApplication** cmdlet to configure the web applications using Windows PowerShell. To get information about this cmdlet, type **Get-Help Enable-MbamWebApplication**. - -**To configure the settings for all web applications using the wizard** - -1. On the server where you want to configure the web applications, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **Administration and Monitoring Website** and **Self-Service Portal**, and then click **Next**. The wizard checks that all prerequisites for the web applications have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**. - -4. Use the following descriptions to enter the field values in the wizard. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          Security certificate

          Select a previously created certificate to optionally encrypt the communication between the web services and the server on which you are configuring the websites. If you choose Do not use a certificate, your web communication may not be secure.

          Host name

          Name of the host computer where you are configuring the websites.

          Installation path

          Path where you are installing the websites.

          Port

          Port number to use for website and service communication.

          -
          - Note

          You must set a firewall exception to enable communication through the specified port.

          -
          -
          - -

          Web service application pool domain account and password

          Domain user account and password for the web service application pool.

          -

          If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field.

          -

          If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group.

          -

          If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used.

          -
          - Important

          For improved security, set the account that is specified in the credentials to have limited user rights. Also, set the password of the account to never expire.

          -
          -
          - -
          - - - -5. Verify that the built-in IIS\_IUSRS account or the application pool account has been added to the **Impersonate a client after authentication** and the **Log on as a batch job** local security settings. - - To check whether it has been added to the local security settings, open the **Local Security Policy editor**, expand the **Local Policies** node, click the **User Rights Assignment** node, and double-click **Impersonate a client after authentication** and **Log on as a batch job** policies in the right pane. - -**To configure connection information for the databases by using the wizard** - -1. Use the following field descriptions to configure the connection information in the wizard for the Compliance and Audit Database. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          SQL Server name

          Name of the server where the Compliance and Audit Database is configured.

          SQL Server database instance

          SQL Server instance name where the Compliance and Audit Database is configured.

          Database name

          Name of the Compliance and Audit Database.

          - - - -2. Use the following field descriptions to configure the connection information in the wizard for the Recovery Database. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          SQL Server name

          Name of the server where the Recovery Database is configured.

          SQL Server database instance

          SQL Server instance name where the Recovery Database is configured.

          Database name

          Name of the Recovery Database.

          - - - -**To configure the web applications by using the wizard** - -1. Use the following descriptions to enter the field values in the wizard to configure the Administration and Monitoring Website. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          Advanced Helpdesk role domain group

          Domain user group whose members have access to all areas of the Administration and Monitoring Website except the Reports area.

          Helpdesk role domain group

          Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website.

          Use System Center Configuration Manager Integration

          Select this check box if you are configuring MBAM with the Configuration Manager Integration topology. Selecting this check box makes all reports, except the Recovery Audit report, appear in Configuration Manager instead of in the Administration and Monitoring Website.

          Reporting role domain group

          Domain user group whose members have read-only access to the Reports area of the Administration and Monitoring Website.

          SQL Server Reporting Services URL

          URL for the SSRS server where the MBAM Reports are configured.

          -

          Examples of report URLs:

          - - - - - - - - - - - - - - - - - - - - - -
          Type of host nameExample

          Example with a fully qualified domain name

          https://MyReportServer.Contoso.com/ReportServer

          Example with a custom host name

          https://MyReportServer/ReportServer

          -

          Virtual directory

          Virtual directory of the Administration and Monitoring Website. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name, for example:

          -

          http(s)://<hostname>:<port>/HelpDesk/

          -

          If you do not specify a virtual directory, the value HelpDesk will be used.

          Data Migration role domain group (optional)

          Domain user group whose members have access to use the Write-Mbam*Information Cmdlets to write recovery information via this endpoint.

          - - - -2. Use the following description to enter the field values in the wizard to configure the Self-Service Portal. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FieldDescription

          Virtual directory

          Virtual directory of the web application. This name corresponds to the website’s physical directory on the server, and is appended to the website’s host name, for example:

          -

          http(s)://<hostname>:<port>/SelfService/

          -

          If you do not specify a virtual directory, the value SelfService will be used.

          Company name

          Specify a company name for the Self-Service Portal, for example:

          -

          Contoso IT

          -

          This company name is viewed by all Self-Service Portal users.

          Helpdesk URL text

          Specify a text statement that directs users to your organization's Helpdesk website, for example:

          -

          Contact Helpdesk or IT department

          Helpdesk URL

          Specify the URL for your organization's Helpdesk website, for example:

          -

          http(s)://<companyHelpdeskURL>/

          Notice text file

          Select a file that contains the notice you want displayed to users on the Self-Service Portal landing page.

          Do not display notice text to users

          Select this check box to specify that the notice text is not displayed to users.

          - - - -3. When you finish your entries, click **Next**. - - The wizard checks that all prerequisites for the web applications have been met. - -4. Click **Next** to continue. - -5. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script for the entries you made, click **Export PowerShell Script** and save the script. - - - -6. Click **Add** to add the web applications to the server, and then click **Close**. - - To customize the Self-Service Portal by adding custom notice text, your company name, pointers to more information, and so on, see [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md). - -**To configure the Self-Service Portal if client computers cannot access the CDN** - -1. Determine whether you are running Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1. If so, do nothing. Your Self-Service Portal configuration is complete. - - **Note** - Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 installs the JavaScript files in setup, and so does not need to be connected to the Microsoft Ajax Content Delivery Network in order to configure the Self-Service Portal. The following steps are necessary only if you are using a version of Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 previous to SP1. - - - -2. Determine if your client computers have access to the Microsoft Ajax Content Delivery Network (CDN). - - The CDN gives the Self-Service Portal the access it requires to certain JavaScript files. If you don’t configure the Self-Service Portal when client computers cannot access the CDN, only the company name and the account under which the end user signed in will be displayed. No error message will be shown. - -3. Do one of the following: - - - If your client computers have access to the CDN, do nothing. Your Self-Service Portal configuration is complete. - - - If your client computers do not have access to the CDN, complete the steps in [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md). - - -## Related topics - - -[Server Event Logs](server-event-logs.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md) - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md b/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md deleted file mode 100644 index c187bc1e3c..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network -description: How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network -author: dansimp -ms.assetid: 90ee76db-9876-41b5-994a-118556d5ed3b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network - - -Follow these instructions if the client computers in your organization do not have access to the Microsoft Ajax Content Delivery Network (CDN). - -**Why you need to configure this:** - -Your client computers need access to the CDN, which gives the Self-Service Portal the required access to certain JavaScript files. If you don’t configure the Self-Service Portal when client computers cannot access CDN, only the company name and the account under which the end user logs in will be displayed. No error message will be shown. - -**Note**   -In MBAM 2.5 SP1, the JavaScript files are included in the product, and you do not need to follow the instructions in this section to configure the SSP to support clients that cannot access the internet. - - - -**How to configure the Self-Service Portal when client computers cannot access the CDN** - -1. Download the following JavaScript files from the CDN: - - - [jQuery-1.10.2.min.js](https://go.microsoft.com/fwlink/?LinkID=390515) - - - [jQuery.validate.min.js](https://go.microsoft.com/fwlink/?LinkID=390516) - - - [jQuery.validate.unobtrusive.min.js](https://go.microsoft.com/fwlink/?LinkID=390517) - -2. Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in <MBAM Self-Service Install Directory>\\Self Service Website\\Scripts. - -3. Open Internet Information Services (IIS) Manager. - -4. Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**. - - **Note** - *SelfService* is the default virtual directory name. If you chose a different name for this directory during the configuration, remember to replace *SelfService* in these instructions with the name you chose. - - - -5. In the middle pane, double-click **Application Settings**. - -6. For each item in the following list, edit the application settings to reference the new location by replacing /<*virtual directory*>/ with /SelfService/ (or whatever name you chose during configuration). For example, the virtual directory path will be similar to /selfservice/Scripts/ jQuery-1.10.2.min.js. - - - jQueryPath: /<*virtual directory*>/Scripts/jQuery-1.10.2.min.js - - - jQueryValidatePath: /<*virtual directory*>/Scripts/jQuery.validate.min.js - - - jQueryValidateUnobtrusivePath: /<*virtual directory*>/Scripts/jQuery.validate.unobtrusive.min.js - - - -## Related topics - - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md b/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md deleted file mode 100644 index 27bfffcf2d..0000000000 --- a/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Deploy the MBAM Client by Using a Command Line -description: How to Deploy the MBAM Client by Using a Command Line -author: dansimp -ms.assetid: ac1d4ffe-c26d-41c9-9737-a4f2b37fde24 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client by Using a Command Line - - -You can use a command line to deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client software. - -## Command Line to deploy the MBAM Client software - - -Type the following command at the command prompt to automatically accept the end user license agreement when deploying the MBAM Client software. - -**MBAMClientSetup.exe /acceptEula=Yes** - -**Note**   -The **/ju** and **/jm** command-line options are not supported and cannot be used to install the MBAM Client software. - - - -Type the following command at the command prompt to extract and install the MSP: - -**MBAMClientSetup.exe /extract <path to extract MSI> /acceptEula=Yes** - -Then, install the MSI silently by running the following command: - -**msiexec /i <path to extracted MSI> /qb ALLUSERS=1 REBOOT=ReallySuppress** - -**Note**   -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product, after accepting the EULA. - - - -## OPTIN\_FOR\_MICROSOFT\_UPDATES=1 command-line option - - -You can optionally specify the command-line option `OPTIN_FOR_MICROSOFT_UPDATES=1` during the Client software installation to automatically install Microsoft Updates on client computers. Specifying this option makes Microsoft Update automatically start and search for available updates to install after the Client software installation finishes. - -You can use this command-line option with either of the following installation methods. - - ---- - - - - - - - - - - - - - - - - -
          Install the MBAM Client software by usingExample

          MBAMClientSetup.exe

          MbamClientSetup.exe OPTIN_FOR_MICROSOFT_UPDATES=1

          msiexec /i MBAMClient.msi

          msiexec /i MBAMClient.msi OPTIN_FOR_MICROSOFT_UPDATES=1

          - - - - -## Related topics - - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md b/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md deleted file mode 100644 index 04cb113b89..0000000000 --- a/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Deploy the MBAM Client to Desktop or Laptop Computers -description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: dansimp -ms.assetid: 3a7639e0-468e-4496-8be2-ed29b8e07c53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client to Desktop or Laptop Computers - - -This topic explains how to deploy the MBAM Client to end users’ computers. You can deploy the MBAM Client through an electronic software distribution system, such as Active Directory Domain Services or Microsoft System Center Configuration Manager. - -To deploy the MBAM Client as part of a Windows deployment, see [How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md). - -Before you start the MBAM Client deployment, review the [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**To deploy the MBAM Client to desktop or laptop computers** - -1. Locate the MBAM Client installation files that are provided with the MBAM software. - -2. Use Active Directory Domain Services or an enterprise software deployment tool like Microsoft System Center Configuration Manager to deploy the Windows Installer package to target computers. - -3. Configure the distribution settings or Group Policy settings to run the MBAM Client installation file. - - After successful installation, the MBAM Client applies the Group Policy settings that are received from a domain controller to begin BitLocker Drive Encryption and management functions. - - **Important**   - The MBAM Client does not start BitLocker Drive Encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed and a user must be logged on to a physical console session before BitLocker Drive Encryption begins. - - - - -## Related topics -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - -[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md b/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md deleted file mode 100644 index 58fc45a61e..0000000000 --- a/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Determine BitLocker Encryption State of Lost Computers -description: How to Determine BitLocker Encryption State of Lost Computers -author: dansimp -ms.assetid: 4f4bec1b-df3e-40ee-b431-291440268d64 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine BitLocker Encryption State of Lost Computers - - -Use this procedure with the Administration and Monitoring Website to determine the following: - -- The last known BitLocker encryption status of lost or stolen computers - -- Whether the volumes on a lost or stolen computer were encrypted - -To complete this task, you need access to the **Reports** area of the Administration and Monitoring Website. To get access to this area, you must be assigned the MBAM Report Users role. You may have given these roles different names when you created them. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - -**Note**   -Device compliance is determined by the BitLocker policies that your enterprise has deployed. You may want to verify your deployed policies before you try to determine the BitLocker encryption state of a device. - - - -**To determine the last known BitLocker encryption state of lost computers** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, select **Reports** to open the Reports page. - -3. Select the **Computer Compliance Report**. - -4. Use the filter fields in the right pane to narrow the search results, and then click **Search**. Results are shown under your search query. - -5. Take the appropriate action, as determined by your policy for lost devices. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md deleted file mode 100644 index 1eacd30123..0000000000 --- a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md +++ /dev/null @@ -1,336 +0,0 @@ ---- -title: How to Enable BitLocker by Using MBAM as Part of a Windows Deployment -description: How to Enable BitLocker by Using MBAM as Part of a Windows Deployment -author: dansimp -ms.assetid: 7609ad7a-bb06-47be-b186-0a2db787c8a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/23/2017 ---- - - -# How to Enable BitLocker by Using MBAM as Part of a Windows Deployment - - -This topic explains how to enable BitLocker on an end user's computer by using MBAM as part of your Windows imaging and deployment process. If you see a black screen at restart (after Install phase concludes) indicating that the drive cannot be unlocked, see [Earlier Windows versions don't start after "Setup Windows and Configuration Manager" step if Pre-Provision BitLocker is used with Windows 10, version 1511](https://support.microsoft.com/en-us/help/4494799/earlier-windows-versions-don-t-start-after-you-use-pre-provision-bitlo). - -**Prerequisites:** - -- An existing Windows image deployment process – Microsoft Deployment Toolkit (MDT), Microsoft System Center Configuration Manager, or some other imaging tool or process – must be in place - -- TPM must be enabled in the BIOS and visible to the OS - -- MBAM server infrastructure must be in place and accessible - -- The system partition required by BitLocker must be created - -- The machine must be domain joined during imaging before MBAM fully enables BitLocker - -**To enable BitLocker using MBAM 2.5 SP1 as part of a Windows deployment** - -1. In MBAM 2.5 SP1, the recommended approach to enable BitLocker during a Windows Deployment is by using the `Invoke-MbamClientDeployment.ps1` PowerShell script. - - - The `Invoke-MbamClientDeployment.ps1` script enacts BitLocker during the imaging process. When required by BitLocker policy, the MBAM agent immediately prompts the domain user to create a PIN or password when the domain user first logs on after imaging. - - - Easy to use with MDT, System Center Configuration Manager, or standalone imaging processes - - - Compatible with PowerShell 2.0 or higher - - - Encrypt OS volume with TPM key protector - - - Fully support BitLocker pre-provisioning - - - Optionally encrypt FDDs - - - Escrow TPM OwnerAuth - For Windows 7, MBAM must own the TPM for escrow to occur. - For Windows 8.1, Windows 10 RTM and Windows 10 version 1511, escrow of TPM OwnerAuth is supported. - For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details. - - - Escrow recovery keys and recovery key packages - - - Report encryption status immediately - - - New WMI providers - - - Detailed logging - - - Robust error handling - - You can download the `Invoke-MbamClientDeployment.ps1` script from [Microsoft.com Download Center](https://www.microsoft.com/download/details.aspx?id=54439). This is the main script that your deployment system will call to configure BitLocker drive encryption and record recovery keys with the MBAM Server. - - **WMI deployment methods for MBAM:** The following WMI methods have been added in MBAM 2.5 SP1 to support enabling BitLocker by using the `Invoke-MbamClientDeployment.ps1` PowerShell script. - - **MBAM\_Machine WMI Class** - **PrepareTpmAndEscrowOwnerAuth:** Reads the TPM OwnerAuth and sends it to the MBAM recovery database by using the MBAM recovery service. If the TPM is not owned and auto-provisioning is not on, it generates a TPM OwnerAuth and takes ownership. If it fails, an error code is returned for troubleshooting. - - **Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details. - -| Parameter | Description | -| -------- | ----------- | -| RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | - -Here are a list of common error messages: - -| Common return values | Error message | -| -------------------- | ------------- | -| **S_OK**
          0 (0x0) | The method was successful. | -| **MBAM_E_TPM_NOT_PRESENT**
          2147746304 (0x80040200) | TPM is not present in the computer or is disabled in the BIOS configuration. | -| **MBAM_E_TPM_INCORRECT_STATE**
          2147746305 (0x80040201) | TPM is not in the correct state (enabled, activated and owner installation allowed). | -| **MBAM_E_TPM_AUTO_PROVISIONING_PENDING**
          2147746306 (0x80040202) | MBAM cannot take ownership of TPM because auto-provisioning is pending. Try again after auto-provisioning is completed. | -| **MBAM_E_TPM_OWNERAUTH_READFAIL**
          2147746307 (0x80040203) | MBAM cannot read the TPM owner authorization value. The value might have been removed after a successful escrow. On Windows 7, MBAM cannot read the value if the TPM is owned by others. | -| **MBAM_E_REBOOT_REQUIRED**
          2147746308 (0x80040204) | The computer must be restarted to set TPM to the correct state. You might need to manually reboot the computer. | -| **MBAM_E_SHUTDOWN_REQUIRED**
          2147746309 (0x80040205) | The computer must be shut down and turned back on to set TPM to the correct state. You might need to manually reboot the computer. | -| **WS_E_ENDPOINT_ACCESS_DENIED**
          2151481349 (0x803D0005) | Access was denied by the remote endpoint. | -| **WS_E_ENDPOINT_NOT_FOUND**
          2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | -| **WS_E_ENDPOINT_FAILURE
          2151481357 (0x803D000F) | The remote endpoint could not process the request. | -| **WS_E_ENDPOINT_UNREACHABLE**
          2151481360 (0x803D0010) | The remote endpoint was not reachable. | -| **WS_E_ENDPOINT_FAULT_RECEIVED**
          2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | -| **WS_E_INVALID_ENDPOINT_URL** 2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | - - **ReportStatus:** Reads the compliance status of the volume and sends it to the MBAM compliance status database by using the MBAM status reporting service. The status includes cipher strength, protector type, protector state and encryption state. If it fails, an error code is returned for troubleshooting. - - | Parameter | Description | - | --------- | ----------- | - | ReportingServiceEndPoint | A string specifying the MBAM status reporting service endpoint. | - - Here are a list of common error messages: - - | Common return values | Error message | - | -------------------- | ------------- | - | **S_OK**
          0 (0x0) | The method was successful | - | **WS_E_ENDPOINT_ACCESS_DENIED**
          2151481349 (0x803D0005) | Access was denied by the remote endpoint.| - | **WS_E_ENDPOINT_NOT_FOUND**
          2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | - | **WS_E_ENDPOINT_FAILURE**
          2151481357 (0x803D000F) | The remote endpoint could not process the request. | - | **WS_E_ENDPOINT_UNREACHABLE**
          2151481360 (0x803D0010) | The remote endpoint was not reachable. | - | **WS_E_ENDPOINT_FAULT_RECEIVED**
          2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | - | **WS_E_INVALID_ENDPOINT_URL**
          2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | - - **MBAM\_Volume WMI Class** - **EscrowRecoveryKey:** Reads the recovery numerical password and key package of the volume and sends them to the MBAM recovery database by using the MBAM recovery service. If it fails, an error code is returned for troubleshooting. - - | Parameter | Description | - | --------- | ----------- | - | RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | - - Here are a list of common error messages: - - | Common return values | Error message | - | -------------------- | ------------- | - | **S_OK**
          0 (0x0) | The method was successful | - | **FVE_E_LOCKED_VOLUME**
          2150694912 (0x80310000) | The volume is locked. | - | **FVE_E_PROTECTOR_NOT_FOUND**
          2150694963 (0x80310033) | A Numerical Password protector was not found for the volume. | - | **WS_E_ENDPOINT_ACCESS_DENIED**
          2151481349 (0x803D0005) | Access was denied by the remote endpoint. | - | **WS_E_ENDPOINT_NOT_FOUND**
          2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | - | **WS_E_ENDPOINT_FAILURE**
          2151481357 (0x803D000F) | The remote endpoint could not process the request. | - | **WS_E_ENDPOINT_UNREACHABLE**
          2151481360 (0x803D0010) | The remote endpoint was not reachable. | - | **WS_E_ENDPOINT_FAULT_RECEIVED**
          2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | - | **WS_E_INVALID_ENDPOINT_URL**
          2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | - - -2. **Deploy MBAM by using Microsoft Deployment Toolkit (MDT) and PowerShell** - - 1. In MDT, create a new deployment share or open an existing deployment share. - - **Note** - The `Invoke-MbamClientDeployment.ps1` PowerShell script can be used with any imaging process or tool. This section shows how to integrate it by using MDT, but the steps are similar to integrating it with any other process or tool. - - **Caution** - If you are using BitLocker pre-provisioning (WinPE) and want to maintain the TPM owner authorization value, you must add the `SaveWinPETpmOwnerAuth.wsf` script in WinPE immediately before the installation reboots into the full operating system. **If you do not use this script, you will lose the TPM owner authorization value on reboot.** - - 2. Copy `Invoke-MbamClientDeployment.ps1` to **<DeploymentShare>\\Scripts**. If you are using pre-provisioning, copy the `SaveWinPETpmOwnerAuth.wsf` file into **<DeploymentShare>\\Scripts**. - - 3. Add the MBAM 2.5 SP1 client application to the Applications node in the deployment share. - - 1. Under the **Applications** node, click **New Application**. - - 2. Select **Application with Source Files**. Click **Next**. - - 3. In **Application Name**, type “MBAM 2.5 SP1 Client”. Click **Next**. - - 4. Browse to the directory containing `MBAMClientSetup-.msi`. Click **Next**. - - 5. Type “MBAM 2.5 SP1 Client” as the directory to create. Click **Next**. - - 6. Enter `msiexec /i MBAMClientSetup-.msi /quiet` at the command line. Click **Next**. - - 7. Accept the remaining defaults to complete the New Application wizard. - - 4. In MDT, right-click the name of the deployment share and click **Properties**. Click the **Rules** tab. Add the following lines: - - `SkipBitLocker=YES``BDEInstall=TPM``BDEInstallSuppress=NO``BDEWaitForEncryption=YES` - - Click OK to close the window. - - 5. Under the Task Sequences node, edit an existing task sequence used for Windows Deployment. If you want, you can create a new task sequence by right-clicking the **Task Sequences** node, selecting **New Task Sequence**, and completing the wizard. - - On the **Task Sequence** tab of the selected task sequence, perform these steps: - - 1. Under the **Preinstall** folder, enable the optional task **Enable BitLocker (Offline)** if you want BitLocker enabled in WinPE, which encrypts used space only. - - 2. To persist TPM OwnerAuth when using pre-provisioning, allowing MBAM to escrow it later, do the following: - - 1. Find the **Install Operating System** step - - 2. Add a new **Run Command Line** step after it - - 3. Name the step **Persist TPM OwnerAuth** - - 4. Set the command line to `cscript.exe "%SCRIPTROOT%/SaveWinPETpmOwnerAuth.wsf"` - **Note:** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details. - - 3. In the **State Restore** folder, delete the **Enable BitLocker** task. - - 4. In the **State Restore** folder under **Custom Tasks**, create a new **Install Application** task and name it **Install MBAM Agent**. Click the **Install Single Application** radio button and browse to the MBAM 2.5 SP1 client application created earlier. - - 5. In the **State Restore** folder under **Custom Tasks**, create a new **Run PowerShell Script** task (after the MBAM 2.5 SP1 Client application step) with the following settings (update the parameters as appropriate for your environment): - - - Name: Configure BitLocker for MBAM - - - PowerShell script: `Invoke-MbamClientDeployment.ps1` - - - Parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          -RecoveryServiceEndpoint

          Required

          MBAM recovery service endpoint

          -StatusReportingServiceEndpoint

          Optional

          MBAM status reporting service endpoint

          -EncryptionMethod

          Optional

          Encryption method (default: AES 128)

          -EncryptAndEscrowDataVolume

          Switch

          Specify to encrypt data volume(s) and escrow data volume recovery key(s)

          -WaitForEncryptionToComplete

          Switch

          Specify to wait for the encryption to complete

          -DoNotResumeSuspendedEncryption

          Switch

          Specify that the deployment script will not resume suspended encryption

          -IgnoreEscrowOwnerAuthFailure

          Switch

          Specify to ignore TPM owner-auth escrow failure. It should be used in the scenarios where MBAM is not able to read the TPM owner-auth, e.g. if TPM auto provisioning is enabled

          -IgnoreEscrowRecoveryKeyFailure

          Switch

          Specify to ignore volume recovery key escrow failure

          -IgnoreReportStatusFailure

          Switch

          Specify to ignore status reporting failure

          - - - -**To enable BitLocker using MBAM 2.5 or earlier as part of a Windows deployment** - -1. Install the MBAM Client. For instructions, see [How to Deploy the MBAM Client by Using a Command Line](how-to-deploy-the-mbam-client-by-using-a-command-line.md). - -2. Join the computer to a domain (recommended). - - - If the computer is not joined to a domain, the recovery password is not stored in the MBAM Key Recovery service. By default, MBAM does not allow encryption to occur unless the recovery key can be stored. - - - If a computer starts in recovery mode before the recovery key is stored on the MBAM Server, no recovery method is available, and the computer has to be reimaged. - -3. Open a command prompt as an administrator, and stop the MBAM service. - -4. Set the service to **Manual** or **On demand** by typing the following commands: - - **net stop mbamagent** - - **sc config mbamagent start= demand** - -5. Set the registry values so that the MBAM Client ignores the Group Policy settings and instead sets encryption to start the time Windows is deployed to that client computer. - - **Caution**   - This step describes how to modify the Windows registry. Using Registry Editor incorrectly can cause serious issues that can require you to reinstall Windows. We cannot guarantee that issues resulting from the incorrect use of Registry Editor can be resolved. Use Registry Editor at your own risk. - - 1. Set the TPM for **Operating system only encryption**, run Regedit.exe, and then import the registry key template from C:\\Program Files\\Microsoft\\MDOP MBAM\\MBAMDeploymentKeyTemplate.reg. - - 2. In Regedit.exe, go to HKLM\\SOFTWARE\\Microsoft\\MBAM, and configure the settings that are listed in the following table. - - **Note**   - You can set Group Policy settings or registry values related to MBAM here. These settings will override previously set values. - - Registry entry - Configuration settings - - DeploymentTime - - 0 = Off - - 1 = Use deployment time policy settings (default) – use this setting to enable encryption at the time Windows is deployed to the client computer. - - UseKeyRecoveryService - - 0 = Do not use key escrow (the next two registry entries are not required in this case) - - 1 = Use key escrow in Key Recovery system (default) - - This is the recommended setting, which enables MBAM to store the recovery keys. The computer must be able to communicate with the MBAM Key Recovery service. Verify that the computer can communicate with the service before you proceed. - - KeyRecoveryOptions - - 0 = Uploads Recovery Key only - - 1 = Uploads Recovery Key and Key Recovery Package (default) - - KeyRecoveryServiceEndPoint - - Set this value to the URL for the server running the Key Recovery service, for example, http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - - -6. The MBAM Client will restart the system during the MBAM Client deployment. When you are ready for this restart, run the following command at a command prompt as an administrator: - - **net start mbamagent** - -7. When the computers restarts, and the BIOS prompts you, accept the TPM change. - -8. During the Windows client operating system imaging process, when you are ready to start encryption, open a command prompt as an administrator, and type the following commands to set the start to **Automatic** and to restart the MBAM Client agent: - - **sc config mbamagent start= auto** - - **net start mbamagent** - -9. To delete the bypass registry values, run Regedit.exe, and go to the HKLM\\SOFTWARE\\Microsoft registry entry. Right-click the **MBAM** node, and then click **Delete**. - -## Related topics - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - -[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md b/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md deleted file mode 100644 index ff06699bd3..0000000000 --- a/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information -description: How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information -author: dansimp -ms.assetid: 09ba2a07-3186-45d9-adef-4034c70ae7cf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information - - -You can configure a localized version of the Self-Service Portal "HelpdeskText" statement, which informs end users about how to get additional help when they are using the Self-Service Portal. If you configure localized text for the statement, as described in the following instructions, MBAM displays the localized version. If MBAM does not find the localized version, it displays the value that is in the **HelpdeskText** parameter. - -**Note**   -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To display a localized version of the HelpdeskText statement** - -1. On the server where you configured the Self-Service Portal, browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskText**\_<*Language*>, where <*Language*> is the appropriate language code for the text. - - For example, to create a localized HelpdeskText statement in Spanish, name the parameter **HelpdeskText\_es-es**. - - The name of the Language folder can also be the language neutral name **es** instead of **es-es**. If the end user’s browser is set to **es-es** and that folder does not exist, the parent locale (as defined in .NET) is recursively retrieved and checked, resolving to <MBAM Self-Service Install Directory>\\SelfServiceWebsite\\es\\Notice.txt before finally becoming the default Notice.txt file. This recursive fallback mimics the .NET resource loading rules. - - For a list of the valid language codes you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized text that you want to display to end users. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md b/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md deleted file mode 100644 index 39f6b21718..0000000000 --- a/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Localize the Self-Service Portal “HelpdeskURL” -description: How to Localize the Self-Service Portal “HelpdeskURL” -author: dansimp -ms.assetid: 86798460-077b-459b-8d54-4b605e07d2f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Localize the Self-Service Portal “HelpdeskURL” - - -You can configure a localized version of the Self-Service Portal URL to display to end users by default. The Self-Service Portal URL is represented by the parameter **HelpdeskURL**. - -If you create a localized version, as described in the following instructions, Microsoft BitLocker Administration and Monitoring (MBAM) finds and displays the localized version. If MBAM does not find a localized version, it displays the URL that is configured for the parameter **HelpDeskURL**. - -**Note**   -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To localize the Self-Service Portal URL** - -1. On the server where you configured the Self-Service Portal, browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskURL**\_<*Language*>, where <*Language*> is the appropriate language code for the URL. - - For example, to create a localized version of the `HelpdeskURL` value in Spanish, name the parameter **HelpdeskURL\_es-es**. - - The name of the Language folder can also be the language neutral name **es** instead of **es-es**. If the end user’s browser is set to **es-es** and that folder does not exist, the parent locale (as defined in .NET) is recursively retrieved and checked, resolving to <MBAM Self-Service Install Directory>\\SelfServiceWebsite\\es\\Notice.txt before finally becoming the default Notice.txt file. This recursive fallback mimics the .NET resource loading rules. - - For a list of the valid language codes you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized version of the `HelpdeskURL` value that you want to display to end users. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md b/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md deleted file mode 100644 index 65d97745b3..0000000000 --- a/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: How to Localize the Self-Service Portal Notice Text -description: How to Localize the Self-Service Portal Notice Text -author: dansimp -ms.assetid: a4c878b7-e5c8-45af-a537-761bb2991659 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Localize the Self-Service Portal Notice Text - - -You can configure localized notice text to display to end users by default in the Self-Service Portal. The Notice.txt file that displays the notice text is in the following root directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -To display localized notice text, you create a localized Notice.txt file, and then save it under a specific language folder in the following example directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -**Note**   -You can configure the path by using the **NoticeTextPath** item in **Application Settings**. - - - -MBAM displays the notice text, based on the following rules: - -- If you create a localized **Notice.txt** file in the appropriate language folder, MBAM displays the localized notice text if the default **Notice.txt** file exists. If the default **Notice.txt** file is missing, a message displays indicating that the default file is missing. - -- If MBAM does not find a localized version of the Notice.txt file, it displays the text in the default Notice.txt file. - -- If MBAM does not find a default Notice.txt file, it displays the default text in the Self-Service Portal. - -**Note**   -If an end user’s browser is set to a language that does not have a corresponding language subfolder or Notice.txt, the text in the Notice.txt file in the following root directory is displayed: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - - -**To create a localized Notice.txt file** - -1. On the server where you configured the Self-Service Portal, create a <*Language*> folder in the following example directory, where <*Language*> represents the name of the localized language: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - **Note**   - Some language folders already exist, so you might not have to create a folder. If you do have to create a language folder, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947) for a list of the valid names that you can use for the <*Language*> folder. - - - -2. Create a Notice.txt file that contains the localized notice text. - -3. Save the Notice.txt file in the <*Language*> folder. For example, to create a localized Notice.txt file in Spanish, save the localized Notice.txt file in the following example directory: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\Es-es - - The name of the Language folder can also be the language neutral name **es** instead of **es-es**. If the end user’s browser is set to **es-es** and that folder does not exist, the parent locale (as defined in .NET) is recursively retrieved and checked, resolving to <MBAM Self-Service Install Directory>\\SelfServiceWebsite\\es\\Notice.txt before finally becoming the default Notice.txt file. This recursive fallback mimics the .NET resource loading rules. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md b/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md deleted file mode 100644 index 5cb63887d0..0000000000 --- a/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md +++ /dev/null @@ -1,166 +0,0 @@ ---- -title: How to Manage User BitLocker Encryption Exemptions -description: How to Manage User BitLocker Encryption Exemptions -author: dansimp -ms.assetid: f582ab82-5bb5-4cd3-ad7c-483240533cf9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage User BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) enables you to exempt users from BitLocker Drive Encryption requirements. - -To exempt users from BitLocker protection, you have to: - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Create an infrastructure to support exempted users.

          Examples of this infrastructure include providing users with a contact telephone number, webpage, or mailing address that they can use to request an exemption.

          Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users.

          When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption.

          -
          -Note

          MBAM does not enact the encryption policy if the computer is already BitLocker-protected and the user is exempted. However, if another user who is not exempt from the encryption policy signs in to the computer, encryption will take place.

          -
          -
          - -
          - - - -The following steps describe what occurs when end users request an exemption from the BitLocker Drive Encryption exemption process through the MBAM Client or through whatever process your organization uses. You must configure MBAM Group Policy settings to allow end users to request an exemption from BitLocker Drive Encryption. - -1. When end users sign in to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Postpone**, or they can select **Start Encryption** to accept the BitLocker encryption. - - **Note** - Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy. - - - -2. If end users select **Request Exemption**, they receive a notification telling them to contact the organization’s BitLocker administration group. Depending on how the **Configure User Exemption Policy** is configured, users are provided with one or more of the following contact methods: - - - Phone number - - - Webpage URL - - - Mailing address - -3. After the exemption request is received, the MBAM administrator decides whether to add the user to the BitLocker Exemption Active Directory Domain Services (AD DS) group. - -4. After an end user submits an exemption request, the MBAM Client reports the user as “Temporarily exempt.” The Client then waits a specified number of days, which IT administrators configure, before it checks the computer’s compliance again. If the MBAM administrator rejects the exemption request, the exemption request option is deactivated, which prevents the user from requesting the exemption again. - -Microsoft BitLocker Administration and Monitoring (MBAM) enables you to exempt users from BitLocker Drive Encryption requirements. - -To exempt users from BitLocker protection, you have to: - - ---- - - - - - - - - - - - - - - - - -
          TaskDetails

          Create an infrastructure to support exempted users.

          Examples of this infrastructure include providing users with a contact telephone number, webpage, or mailing address that they can use to request an exemption.

          Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users.

          When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption.

          -
          -Note

          If the computer is already BitLocker-protected, the User Exemption Policy has no effect. In addition, if another user signs in to a computer that is not exempt from the encryption policy, encryption will take place.

          -
          -
          - -
          - - - -The following steps describe what occurs when end users request an exemption from the BitLocker Drive Encryption exemption process through the MBAM Client or through whatever process your organization uses. You must configure MBAM Group Policy settings to allow end users to request an exemption from BitLocker Drive Encryption. - -1. When end users sign in to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Postpone**, or they can select **Start Encryption** to accept the BitLocker encryption. - - **Note** - Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy. - - - -2. If end users select **Request Exemption**, they receive a notification telling them to contact the organization’s BitLocker administration group. Depending on how the **Configure User Exemption Policy** is configured, users are provided with one or more of the following contact methods: - - - Phone number - - - Webpage URL - - - Mailing address - -3. After the exemption request is received, the MBAM administrator decides whether to add the user to the BitLocker Exemption Active Directory Domain Services (AD DS) group. - -4. After an end user submits an exemption request, the MBAM Client reports the user as “Temporarily exempt.” The Client then waits a specified number of days, which IT administrators configure, before it checks the computer’s compliance again. If the MBAM administrator rejects the exemption request, the exemption request option is deactivated, which prevents the user from requesting the exemption again. - -**To exempt a user from BitLocker Drive Encryption** - -1. Create an AD DS security group that will be used to manage user exemptions from BitLocker encryption requirements. - -2. Create a Group Policy Object by using the Microsoft BitLocker Administration and Monitoring Group Policy Templates. - -3. Associate the Group Policy Object with the AD DS group that you created in the previous step. The policy settings to exempt users are located at: **UserConfiguration** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)**. - -4. To the security group you created for BitLocker exempted users, add the names of the users who are requesting an exemption. - - When a user signs in to a computer controlled by BitLocker, the MBAM Client checks the User Exemption Policy setting. If the computer is already encrypted, BitLocker protection is not suspended. If the computer is not encrypted, MBAM does not prompt the user to encrypt. - - **Important** - Shared computer scenarios require special consideration when you are using BitLocker user exemptions. If a non-exempt user signs in to a computer that is shared with an exempt user, the computer may be encrypted. - - - - -## Related topics - - -[Administering MBAM 2.5 Features](administering-mbam-25-features.md) - -[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md deleted file mode 100644 index 2500ec0e02..0000000000 --- a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md +++ /dev/null @@ -1,497 +0,0 @@ ---- -title: How to Move the MBAM 2.5 Databases -description: How to Move the MBAM 2.5 Databases -author: dansimp -ms.assetid: 34b46f2d-0add-4377-8e4e-04b628fdfcf1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - -# How to Move the MBAM 2.5 Databases - -Use these procedures to move the following databases from one computer to another; from Server A to Server B, for example: - -- Compliance and Audit Database - -- Recovery Database - ->[!NOTE] ->It is important that the databases be restored to Machine B PRIOR to running the MBAM Configuration Wizard to update/configure them. - -If the databases are NOT present, the Configuration Wizard creates NEW, empty, databases. When your existing databases are then restored, this process will break the MBAM configuration. - -Restore the databases FIRST, then run the MBAM Configuration Wizard, choose the database option, and the Configuration Wizard will “connect” to the databases you restored; upgrading them if needed as part of the process. - -**If you are moving multiple features, move them in the following order:** - -1. Recovery Database - -2. Compliance and Audit Database - -3. Reports - -4. Administration and Monitoring Website - -5. Self-Service Portal - ->[!Note] ->To run the example Windows PowerShell scripts provided in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](https://technet.microsoft.com/library/ee176949.aspx) for instructions. - -## Move the Recovery Database - -The high-level steps for moving the Recovery Database are: - -1. Stop all instances of the MBAM Administration and Monitoring Website - -2. Back up the Recovery Database on Server A - -3. Move the Recovery Database from Server A to Server B - -4. Restore the Recovery Database on Server B - -5. Configure access to the Database on Server B and update connection data - -6. Install MBAM Server software and run the MBAM Server Configuration wizard on Server B - -7. Resume the instance of the Administration and Monitoring Website - -### How to move the Recovery Database - -**Stop all instances of the MBAM Administration and Monitoring Website.** On each server that is running the MBAM Administration and Monitoring Server Website, use the Internet Information Services (IIS) Manager console to stop the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - -```powershell -Stop-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the Internet Information Services (IIS) module for Windows PowerShell to the current instance of Windows PowerShell. - -### Back up the Recovery Database on Server A - -1. Use the **Back Up** task in SQL Server Management Studio to back up the Recovery Database on Server A. By default, the database name is **MBAM Recovery Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script, and change the MBAM Recovery Database to use the full recovery mode: - - ``` - USE master; - - GO - - ALTER DATABASE "MBAM Recovery and Hardware" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - - 'Z:\MBAM Recovery Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery Database. - - BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - - GO - - BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - - TO FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - ENCRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - -3. Use the following value to replace the values in the code example with values that match your environment: - - **$PASSWORD$** - password that you use to encrypt the Private Key file. - -4. In Windows PowerShell, run the script that is stored in the file and similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile - 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - ``` -5. Use the following value to replace the values in the code example with values that match your environment: - - **$SERVERNAME$\$SQLINSTANCENAME$** - server name and instance from which the Recovery Database will be backed up. - -### Move the Recovery Database from Server A to Server B - -Use Windows Explorer to move the **MBAM Recovery Database Data.bak** file from Server A to Server B. - -To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - -```powershell -Copy-Item "Z:\MBAM Recovery Database Data.bak" -\\$SERVERNAME$\$DESTINATIONSHARE$ - -Copy-Item "Z:\SQLServerInstanceCertificateFile" -\\$SERVERNAME$\$DESTINATIONSHARE$ - -Copy-Item "Z:\SQLServerInstanceCertificateFilePrivateKey" -\\$SERVERNAME$\$DESTINATIONSHARE$ -``` -Use the information in the following table to replace the values in the code example with values that match your environment. - -| **Parameter** | **Description** | -|----------------------|------------------| -| $SERVERNAME$ | Name of the server to which the files will be copied. | -| $DESTINATIONSHARE$ | Name of the share and path to which the files will be copied. | - - -### Restore the Recovery Database on Server B - -1. Restore the Recovery Database on Server B by using the **Restore Database** task in SQL Server Management Studio. - -2. When the previous task finishes, select **From Device**, and then select the database backup file. - -3. Use the **Add** command to select the **MBAM Recovery Database Data.bak** file, and click **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ``` - -- Restore MBAM Recovery Database. - - USE master - - GO - - -- Drop certificate created by MBAM Setup. - - DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - - GO - - --Add certificate - - CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - - FROM FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - DECRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - - -- Restore the MBAM Recovery Database data and log files. - - RESTORE DATABASE [MBAM Recovery and Hardware] - - FROM DISK = 'Z:\MBAM Recovery Database Data.bak' - - WITH REPLACE - ``` - -5. Use the following value to replace the values in the code example with values that match your environment. - - **$PASSWORD$** - password that you used to encrypt the Private Key file. - -6. In Windows PowerShell, run the script that is stored in the file and similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - ``` -7. Use the following value to replace the values in the code example with values that match your environment. - - **$SERVERNAME$\$SQLINSTANCENAME$** - Server name and instance to which the Recovery Database will be restored. - -### Configure access to the Database on Server B and update connection data - -1. Verify that the Microsoft SQL Server user login that enables Recovery Database access on the restored database is mapped to the access account that you provided during the configuration process. - - >[!NOTE] - >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user. - -2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the MBAM websites. - -3. Edit the following registry key: - - **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\RecoveryDBConnectionString** - -4. Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved. - -5. Update the **Initial Catalog** value with the recovered database name. - -6. To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following: - - ```powershell - reg add "HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\MBAM Server\\Web" /v - RecoveryDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial - Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f - - Set-WebConfigurationProperty - 'connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath - "IIS:\sites\Microsoft Bitlocker Administration and - Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data - Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and - Hardware;Integrated Security=SSPI;" - - Set-WebConfigurationProperty - 'connectionStrings/add[\@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' - -PSPath "IIS:\sites\Microsoft Bitlocker Administration and - Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value - "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery - and Hardware;Integrated Security=SSPI;" - ``` - - >[!Note] - >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server. - - -7. Use the following table to replace the values in the code example with values that match your environment. - - |Parameter|Description| - |---------|-----------| - |$SERVERNAME$/\$SQLINSTANCENAME$|Server name and instance of SQL Server where the Recovery Database is located.| - |$DATABASE$|Name of the Recovery database.| - - -### Install MBAM Server software and run the MBAM Server Configuration wizard on Server B - -1. Install the MBAM 2.5 Server software on Server B. For details, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Recovery Database** feature. For details on how to configure the databases, see [How to Configure the MBAM 2.5 Databases](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-mbam-25-databases). - - >[!TIP] - >Alternatively, you can use the **Enable-MbamDatabase** Windows PowerShell cmdlet to configure the Recovery Database. - - -### Resume the instance of the Administration and Monitoring Website - -On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to start the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - -```powershell -Start-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell. - -## Move the Compliance and Audit Database - -The high-level steps for moving the Compliance and Audit Database are: - -1. Stop all instances of the MBAM Administration and Monitoring Website - -2. Back up the Compliance and Audit Database on Server A - -3. Move the Compliance and Audit Database from Server A to Server B - -4. Restore the Compliance and Audit Database on Server B - -5. Configure access to the Database on Server B and update connection data - -6. Install MBAM Server software and run the MBAM Server Configuration wizard on - Server B - -7. Resume the instance of the Administration and Monitoring Website - -### How to move the Compliance and Audit Database - -**Stop all instances of the MBAM Administration and Monitoring Website.** On each server that is running the MBAM Administration and Monitoring Server Website, use the Internet Information Services (IIS) Manager console to stop the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - -```powershell -Stop-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the Internet Information Services (IIS) module for Windows PowerShell to the current instance of Windows PowerShell. - -### Back up the Compliance and Audit Database on Server A - -1. Use the **Back Up** task in SQL Server Management Studio to back up the Compliance and Audit Database on Server A. By default, the database name is **MBAM Compliance Status Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ``` - USE master; - - GO - - ALTER DATABASE "MBAM Compliance Status" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Compliance Status Data logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - - 'Z: \MBAM Compliance Status Database Data.bak'; - - GO - - -- Back up the full MBAM Compliance Recovery database. - - BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - - GO - - ``` - -3. Run the script that is stored in the .sql file by using a Windows PowerShell command that is similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - - ``` - -4. Using the following value, replace the values in the code example with values that match your environment: - - **$SERVERNAME$\$SQLINSTANCENAME$** - server name and instance from which the Compliance and Audit Database will be backed up. - -### Move the Compliance and Audit Database from Server A to Server B** - -1. Use Windows Explorer to move the **MBAM Compliance Status Database Data.bak** file from Server A to Server B. - -2. To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - - ```powershell - Copy-Item "Z:\MBAM Compliance Status Database Data.bak" - \\$SERVERNAME$\$DESTINATIONSHARE$ - ``` - -3. Using the following table, replace the values in the code example with values that match your environment. - - | **Parameter** | **Description** | - |----------------------|---------------------------------------------------------------| - | $SERVERNAME$ | Name of the server to which the files will be copied. | - | $DESTINATIONSHARE$ | Name of the share and path to which the files will be copied. | - - -### Restore the Compliance and Audit Database on Server B - -1. Restore the Compliance and Audit Database on Server B by using the **Restore Database** task in SQL Server Management Studio. - -2. When the previous task finishes, select **From Device**, and then select the database backup file. - -3. Use the **Add** command to select the **MBAM Compliance Status Database Data.bak** file and click **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ``` - -- Create MBAM Compliance Status Database Data logical backup devices. - - Use master - - GO - - -- Restore the MBAM Compliance Status database data files. - - RESTORE DATABASE [MBAM Compliance Status] - - FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - - WITH REPLACE - - ``` - -5. In Windows PowerShell, run the script that is stored in the file and similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - - ``` - -6. Using the following value, replace the values in the code example with values that match your environment. - - **$SERVERNAME$\$SQLINSTANCENAME$** - Server name and instance to which the Compliance and Audit Database will be restored. - -### Configure access to the Database on Server B and update connection data - -1. Verify that the Microsoft SQL Server user login that enables Compliance and Audit Database access on the restored database is mapped to the access account that you provided during the configuration process. - - >[!NOTE] - >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user. - -2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the Website. - -3. Edit the following registry key: - - **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\ComplianceDBConnectionString** - -4. Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved. - -5. Update the **Initial Catalog** value with the recovered database name. - -6. To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following: - - ```powershell - reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\Web" /v - ComplianceDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial - Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f - ``` - >[!NOTE] - >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server. - - -7. Using the following table, replace the values in the code example with values that match your environment. - - |Parameter | Description | - |---------|------------| - |$SERVERNAME$\$SQLINSTANCENAME$ | Server name and instance of SQL Server where the Recovery Database is located.| - |$DATABASE$|Name of the recovered database.| - -### Install MBAM Server software and run the MBAM Server Configuration wizard on Server B - -1. Install the MBAM 2.5 Server software on Server B. For details, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Compliance and Audit Database** feature. For details on how to configure the databases, see [How to Configure the MBAM 2.5 Databases](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-mbam-25-databases). - - >[!TIP] - >Alternatively, you can use the **Enable-MbamDatabase** Windows PowerShell cmdlet to configure the Compliance and Audit Database. - - -### Resume the instance of the Administration and Monitoring Website - -On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to start the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - -```powershell -Start-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell. diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md b/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md deleted file mode 100644 index c77b29982c..0000000000 --- a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: How to Move the MBAM 2.5 Reports -description: How to Move the MBAM 2.5 Reports -author: dansimp -ms.assetid: c8223656-ca9d-41c8-94a3-64d07a6b99e9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the MBAM 2.5 Reports - - -Use these procedures to move the Reports feature from one computer to another, that is, to move the Reports feature from Server A to Server B. - -The high-level steps for moving the Reports feature are: - -1. Stop all instances of the MBAM Administration and Monitoring Website. - -2. Install the MBAM 2.5 Server software on Server B and configure the Reports feature on Server B. - -3. Update the reports connection data on the MBAM Administration and Monitoring servers. - -4. Resume the instance of the MBAM Administration and Monitoring Website. - -**Note**   -To run the example Windows PowerShell scripts in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](https://technet.microsoft.com/library/ee176949.aspx) for instructions. - - - -**Stop the MBAM Administration and Monitoring Website** - -- On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to stop the Administration and Monitoring Website. - - To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - - ``` syntax - PS C:\> Stop-Website "Microsoft BitLocker Administration and Monitoring" - ``` - -**Install MBAM Server software and run the MBAM Server Configuration wizard on Server B** - -1. Install the MBAM Server software on Server B. For instructions, see [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Reports** feature. - - Alternatively, you can use the **Enable-MbamReport** Windows PowerShell cmdlet to configure the Reports. - - For instructions on how to configure the Reports, see [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md). - -**Update the reports connection data on the Administration and Monitoring Server** - -1. On the server that is running the Reports feature, use the Internet Information Services (IIS) Manager console to update the Reports URL. - -2. Expand **Microsoft BitLocker Administration and Monitoring**, and then select the **HelpDesk** node. - -3. In the **Management** section of the **Features View**, select **Configuration Editor**. - -4. In the **Section** field, select **appSettings**. - -5. Select the **Collection** row, and then click the "ellipses" button **(…)** at the far right of the pane to open the **Collection Editor**. - -6. In the **Collection Editor**, select the row that contains **Microsoft.Mbam.Reports.Url**, and update the value for **Microsoft.Mbam.Reports.Url** to reflect the server name for Server B. - - If you previously configured the Reports feature on a named instance of SQL Server Reporting Services, add or update the name of the instance to the URL, for example: - - `http://$SERVERNAME$/ReportServer_$SQLSRSINSTANCENAME$/Pages....)` - -7. To automate this procedure, you can use Windows PowerShell to run a command on the Administration and Monitoring Server that is similar to the following code example. - - ``` syntax - PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\\sites\Microsoft Bitlocker Administration and Monitoring\HelpDesk" -Name "Value" -Value "http://$SERVERNAME$/ReportServer[_$SRSINSTANCENAME$]/Pages/ReportViewer.aspx?/Microsoft+BitLocker+Administration+and+Monitoring/" - ``` - - Using the descriptions in the following table, replace the values in the code example with values that match your environment. - - - - - - - - - - - - - - - - - - - - - - -
          ParameterDescription

          $SERVERNAME$

          Name of the server to which the Reports were moved.

          $SRSINSTANCENAME$

          Name of the instance of SQL Server Reporting Services to which the Reports were moved.

          - - - -**Resume the instance of the Administration and Monitoring Website** - -1. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to start the Administration and Monitoring Website. - -2. To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - - ``` syntax - PS C:\> Start-Website "Microsoft BitLocker Administration and Monitoring" - ``` - - **Note**   - To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell. - - - - - -## Related topics - - -[How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - -[Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md b/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md deleted file mode 100644 index 6b57070737..0000000000 --- a/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Move the MBAM 2.5 Websites -description: How to Move the MBAM 2.5 Websites -author: dansimp -ms.assetid: 71af9a54-c27b-408f-9d75-37c0d02e730e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the MBAM 2.5 Websites - - -Use these procedures to move the following MBAM websites from one computer to another, that is, to move the following features from Server A to Server B: - -- Administration and Monitoring Website - -- Self-Service Portal - -**Important**   -During the configuration of both websites, you must provide the same connection string, Reports URL, group accounts, and web service application pool domain account as the ones that you are currently using. If you don’t use the same values, you cannot access some of the servers. To get the current values, use the **Get-MbamWebApplication** Windows PowerShell cmdlet. - - - -**To move the Administration and Monitoring Website to another server** - -1. On Server B, install the MBAM 2.5 Server software. For instructions, see [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Administration and Monitoring Website** feature. - - Alternatively, you can use the **Enable-MbamWebApplication** Windows PowerShell cmdlet to configure the Administration and Monitoring Website. - - For instructions on how to configure the Administration and Monitoring Website, see [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - -**To move the Self-Service Portal to another server** - -1. On Server B, install the MBAM 2.5 Server software. For instructions, see [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Self-Service Portal** feature. - - Alternatively, you can use the **Enable-MbamWebApplication** Windows PowerShell cmdlet to configure the Self-Service Portal. - - For instructions on how to configure the Administration and Monitoring Website, see [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - -3. If the client computers in your organization do not have access to the Microsoft Content Delivery Network, you also have to move the JavaScript files. See [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md) for more information. - -4. Customize the Self-Service Portal for your organization. Use the instructions in [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) to review your current customizations and to configure custom settings on the Self-Server Portal on Server B. - - - -## Related topics - - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - -[Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md deleted file mode 100644 index 5ee41f6f49..0000000000 --- a/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Recover a Corrupted Drive -description: How to Recover a Corrupted Drive -author: dansimp -ms.assetid: fa5b846b-dda6-4ae4-bf6c-39e4f1d8aa00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover a Corrupted Drive - - -You can use this procedure with the Administration and Monitoring Website (also referred to as the Help Desk) Website to recover a corrupted drive that is protected by BitLocker. To do this, you will complete the tasks outlined in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - -
          TaskDetails and more information

          Create a recovery key package file by accessing the Drive Recovery area of the Administration and Monitoring Website.

          To access the Drive Recovery area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. You may have given these roles different names when you created them. For more information, see Planning for MBAM 2.5 Groups and Accounts.

          Copy the package file to the computer that contains the corrupted drive.

          Use the repair-bde command to complete the recovery process.

          To avoid a potential loss of data, it is strongly recommended that you review the Manage-bde command before using it.

          - - - -**To recover a corrupted drive** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, select **Drive Recovery** to open the **Recover access to an encrypted drive** page. - -3. Enter the end user’s Windows log-on domain and user name, the reason for unlocking the drive, and the end user’s recovery password ID. - - **Note**   - If you are a member of the Advanced Helpdesk Users access group, you do not have to enter the user’s domain name or user name. - - - -4. Click **Submit**. The recovery key will be displayed. - -5. Click **Save**, and then select **Recovery Key Package**. The recovery key package will be created on your computer. - -6. Copy the recovery key package to the computer that has the corrupted drive. - -7. Open an elevated command prompt. To do this, click **Start** and type `cmd` in the **Search programs and files** text box. Right-click **cmd.exe**, and select **Run as Administrator**. - -8. At the command prompt, type the following: - - `repair-bde -kp -rp ` - - **Note**   - Replace <*fixed drive*> with an available hard disk drive that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified hard disk drive. - - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md deleted file mode 100644 index 9dec2442fb..0000000000 --- a/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: How to Recover a Drive in Recovery Mode -description: How to Recover a Drive in Recovery Mode -author: dansimp -ms.assetid: e126eaf8-9ae7-40fe-a28e-dbd78d26859e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Drive in Recovery Mode - - -This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to get a recovery password to give to end users if their BitLocker-protected drive goes into recovery mode. Drives go into recovery mode if users lose or forget their PIN or password or if the Trusted Module Platform (TPM) chip detects changes to the BIOS or startup files of a computer. - -To get a recovery password, use the **Drive Recovery** area of the Administration and Monitoring Website. You must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role to access this area of the website. - -**Note** -You may have given these roles different names when you created them. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - - - -**Important** -Recovery passwords expire after a single use. On operating system drives and fixed data drives, the single-use rule is applied automatically. On removable drives, it is applied when the drive is removed and then reinserted and unlocked on a computer that has Group Policy settings activated to manage removable drives. - - - -**To recover a drive in recovery mode** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, select **Drive Recovery** to open the **Recover access to an encrypted drive** page. - -3. Enter the end user’s Windows log-on domain and user name to view recovery information. - - **Note** - If you are in the MBAM Advanced Helpdesk Users group, the user domain and user ID fields are not required. - - - -4. Enter the first eight digits of the recovery key ID to see a list of possible matching recovery keys, or enter the entire recovery key ID to get the exact recovery key. - -5. From the **Reason for Drive Unlock** list, select one of the predefined options, and then click **Submit**. - - MBAM returns the following: - - - An error message if no matching recovery password is found - - - Multiple possible matches if the user has multiple matching recovery passwords - - - The recovery password and recovery package for the submitted user - - **Note** - If you are recovering a damaged drive, the recovery package option provides BitLocker with critical information that it needs to recover the drive. - - - -~~~ -After the recovery password and recovery package are retrieved, the recovery password is displayed. -~~~ - -6. To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file. - - When the user types the recovery password into the system or uses the recovery package, the drive is unlocked. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md deleted file mode 100644 index 59ee1c423d..0000000000 --- a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Recover a Moved Drive -description: How to Recover a Moved Drive -author: dansimp -ms.assetid: 0d38ce7e-bc64-473e-ae85-99b7099ca758 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Recover a Moved Drive -This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to recover an operating system drive that was moved after being encrypted by Microsoft BitLocker Administration and Monitoring (MBAM). When a drive is moved, it no longer accepts the PIN that was used in the previous computer because the Trusted Platform Module (TPM) chip has changed. To recover the moved drive, you must obtain the recovery key ID to retrieve the recovery password. - -To recover a moved drive, you must use the **Drive Recovery** area of the Administration and Monitoring Website. To access the **Drive Recovery** area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. For more information about these roles, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - -**To recover a moved drive** -1. On the computer that contains the moved drive, start the computer in Windows Recovery Environment (WinRE) mode, or start the computer by using the Microsoft Diagnostic and Recovery Toolset (DaRT). - -2. After the computer has been started with WinRE or DaRT, MBAM will treat the moved operating system drive as a fixed data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password. - - **Note**   - In some cases, you may be able to click **I forgot the PIN** during the startup process, and then enter the recovery mode to display the recovery key ID. - - - -3. Use the recovery key ID to retrieve the recovery password and unlock the drive from the Administration and Monitoring Website. For instructions, see [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-25.md). - - If the moved drive was configured to use a TPM chip on the original computer, complete the following additional steps. Otherwise, the recovery process is complete. - -4. After unlocking the drive and completing the start process, open a command prompt in WinRE mode and use the `manage-bde` command to decrypt the drive. Using this tool is the only way to remove the TPM plus the PIN protector without the original TPM chip. For information about the `manage-bde` command, see [Manage-bde](https://go.microsoft.com/fwlink/?LinkId=393567). - -5. When the removal is completed, start the computer normally. The MBAM agent will now enforce the policy to encrypt the drive with the new computer’s TPM plus the PIN. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md b/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md deleted file mode 100644 index fc80c4324c..0000000000 --- a/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: How to Reset a TPM Lockout -description: How to Reset a TPM Lockout -author: dansimp -ms.assetid: dd20a728-c52e-48e6-9f6c-1311c71dee74 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset a TPM Lockout - - -This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to reset a TPM lockout. TPM lockouts can occur if an end user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. - -From the **Manage TPM** area of the Administration and Monitoring Website, you can access the centralized Key Recovery data system, which provides a TPM owner password file when you supply a computer ID and associated user identifier. - -To access the Manage TPM area of the Administration and Monitoring Website, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. These roles are groups that administrators create in Active Directory. You can use any name for these groups. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - -For information about MBAM and TPM ownership, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-tpm). - -**To reset a TPM lockout** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, click **Manage TPM** to open the **Manage TPM** page. - -3. Enter the fully qualified domain name for the computer and the computer name. - -4. Enter the end user’s Windows log-on domain and user name to retrieve the TPM owner password file. - - **Note**   - If you are in the MBAM Advanced Helpdesk Users group, the user domain and user ID fields are not required. - - - -5. From the **Reason for requesting TPM owner password file** list, select a reason for the request, and click **Submit**. - - MBAM returns one of the following: - - - An error message if no matching TPM owner password file is found - - - The TPM owner password file for the submitted computer - - After the TPM owner password is retrieved, the owner password is displayed. - -6. To save the password to a .tpm file, click the **Save** button. - -7. In the **Manage TPM** area of the **Administration and Monitoring Website**, select the **Reset TPM lockout** option and provide the TPM owner password file. - - The TPM lockout is reset and the end user’s access is restored. - - **Important**   - Do not give the TPM hash value or TPM owner password file to end users. Because the TPM information does not change, giving the file to end users creates a security risk. - - - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md b/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md deleted file mode 100644 index 67f433c862..0000000000 --- a/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: How to Set the Self-Service Portal Branding and Session Time-out -description: How to Set the Self-Service Portal Branding and Session Time-out -author: dansimp -ms.assetid: 031eedfc-fade-4d2f-8771-b329e1d38c0d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set the Self-Service Portal Branding and Session Time-out - - -After you configure the Self-Service Portal, you can brand it with your company name, Help Desk URL, and "notice" text. You can also change the Session Time-out setting to make the end user’s session expire after a specified period of inactivity. - -**Note** -You can also brand the Self-Service Portal by using the **Enable-MbamWebApplication** Windows PowerShell cmdlet or the MBAM Server Configuration wizard. For instructions on using the wizard, see [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - - - -**Note** -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To set the session time-out and branding for the Self-Service Portal** - -1. To set the time-out period for the end user’s session, start the **Internet Information Services Manager**, or run **inetmgr.exe**. - -2. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **ASP.NET** > **Session State**, and change the **Time-out** value under **Cookie Settings** to the number of minutes after which the end user’s Self-Service Portal session expires. The default value is **5**. To disable the setting so that there is no time-out, set the value to **0**. - -3. To set the branding items for the Self-Service Portal, start the **Internet Information Services Manager** or run **inetmgr.exe**. - -4. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -5. In the **Name** column, select the item that you want to change, and change the default value to reflect the name that you want to use. The following table lists the values that you can set. - - **Caution** - Do not change the value in the Name column (CompanyName\*), as it will cause Self-Service Portal to stop working. - - - -~~~ - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameDefault value

          ClientValidationEnabled

          true

          CompanyName

          Contoso IT

          DisplayNotice

          true

          HelpdeskText

          Contact Helpdesk or IT Department

          HelpdeskUrl

          #

          -
          -Note -

          In MBAM 2.5 SP1, the HelpdeskUrl default value is empty.

          -
          -
          - -

          jQueryPath

          [//go.microsoft.com/fwlink/?LinkID=390515](//go.microsoft.com/fwlink/?LinkID=390515)

          -
          -Note -

          In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery-1.10.2.min.js

          -
          -
          - -

          jQueryValidatePath

          [//go.microsoft.com/fwlink/?LinkID=390516](//go.microsoft.com/fwlink/?LinkID=390516)

          -
          -Note -

          In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.min.js

          -
          -
          - -

          jQueryValidateUnobtrusivePath

          [//go.microsoft.com/fwlink/?LinkID=390517](//go.microsoft.com/fwlink/?LinkID=390517)

          -
          -Note -

          In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.unobtrusive.min.js

          -
          -
          - -

          NoticeTextPath

          Notice.txt

          -
          -Note -

          You can edit the notice text either by using the Internet Information Services (IIS) Manager or by opening and changing the Notice.txt file in the installation directory.

          -
          -
          - -

          UnobtrusiveJavaScriptEnabled

          true

          -~~~ - - - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md b/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md deleted file mode 100644 index 015d00c47f..0000000000 --- a/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Turn the Self-Service Portal Notice Text On or Off -description: How to Turn the Self-Service Portal Notice Text On or Off -author: dansimp -ms.assetid: e786685b-ffdb-4557-ae71-e79528097264 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Turn the Self-Service Portal Notice Text On or Off - - -You can turn the Self-Service Portal notice text on or off. By default, the notice text is turned on. To set the notice text, see [How to Set the Self-Service Portal Branding and Session Time-out](how-to-set-the-self-service-portal-branding-and-session-time-out.md). - -**Note**   -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To turn off the notice text** - -1. On the server where you configured the Self-Service Portal, browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -2. In the **Name** column, select **DisplayNotice**, and set the value to **false**. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md b/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md deleted file mode 100644 index 6999def5bb..0000000000 --- a/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: How to Use the Administration and Monitoring Website -description: How to Use the Administration and Monitoring Website -author: dansimp -ms.assetid: bb96a4e8-d4f4-4e6f-b7db-82d96998bfa6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Administration and Monitoring Website - - -The Administration and Monitoring Website, also referred to as the Help Desk, is an administrative interface for BitLocker Drive Encryption. Use the website to review reports, recover end users’ drives, and manage end users’ TPMs, as described in the following sections. - -**Note**   -If you are using MBAM in the Stand-alone topology, you view all reports from the Administration and Monitoring Website. If you are using the Configuration Manager Integration topology, you view all reports in Configuration Manager, except the Recovery Audit report, which you continue to view from the Administration and Monitoring Website. For more information about reports, see [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md). - - - -## Required roles for using the Administration and Monitoring Website - - -To access specific areas of the Administration and Monitoring Website, you must have one of the following roles, which are groups that you create in Active Directory. You can use any name for these groups. - - ---- - - - - - - - - - - - - - - - - - - - - -
          AccountDescription

          MBAM Advanced Helpdesk Users

          Provides access to all areas of the Administration and Monitoring Website. Users who have this role enter only the recovery key, and not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users Group permissions.

          -

          MBAM Helpdesk Users

          Provides access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website. Individuals who have this role must fill in all fields, including the end-user’s domain and account name, when they use either area.

          -

          If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users Group permissions.

          MBAM Report Users

          Provides access to the reports in the Reports area of the Administration and Monitoring Website.

          - - - -## Tasks you can perform on the Administration and Monitoring Website - - -The following table summarizes the tasks you can perform on the Administration and Monitoring Website and provides links to more information about each task. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskArea of the Website where you access the taskDescriptionFor more information

          View reports

          Reports

          Enables you to run reports to monitor BitLocker usage, compliance, and key recovery activity. Reports provide data about enterprise compliance, individual computers, and who requested recovery keys or the TPM OwnerAuth package for a specific computer.

          Viewing MBAM 2.5 Reports for the Stand-alone Topology

          Determine the BitLocker encryption status of lost or stolen computers

          Reports

          Determine if a volume was encrypted if the computer is lost or stolen.

          How to Determine BitLocker Encryption State of Lost Computers

          Recover lost drives

          Drive Recovery

          Recover drives that are:

          -
            -
          • In recovery mode

          • -
          • Have been moved

          • -
          • Are corrupted

          • -

          Reset a TPM lockout

          Manage TPM

          Provides access to TPM data that has been collected by the MBAM Client. In a TPM lockout, use the Administration and Monitoring Website to retrieve the necessary password file to unlock the TPM.

          How to Reset a TPM Lockout

          - - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md b/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md deleted file mode 100644 index 3be2d5cf4a..0000000000 --- a/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Use the Self-Service Portal to Regain Access to a Computer -description: How to Use the Self-Service Portal to Regain Access to a Computer -author: dansimp -ms.assetid: 3c24b13a-d1b1-4763-8ac0-0b2db46267e3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Self-Service Portal to Regain Access to a Computer - - -The Self-Service Portal is a website that IT administrators configure as part of their Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 deployment. The website enables end users to independently regain access to their computers if they get locked out of Windows. The Self-Service Portal requires no assistance from Help Desk staff. - -The following instructions are written from the perspective of end users, but the information may be useful for IT administrators to understand. - -**Important**   -An end user must have physically logged on to the computer (not remotely) at least one time successfully to be able to recover their key using the Self-Service Portal. Otherwise, they must use the Helpdesk Portal for key recovery. - - - -End users may experience lockouts if they: - -- Forget their password or PIN - -- Change operating system files, the BIOS, or the Trusted Platform Module (TPM) - -**Note**   -If the IT administrator configured an IIS Session State time-out, a message is displayed in the Self-Service Portal 60 seconds prior to the time-out. - - - -**To use the Self-Service Portal to regain access to a computer** - -1. In the **Recovery KeyId** field, enter a minimum of eight of the 32-digit BitLocker Key ID that is displayed on the BitLocker recovery screen of your computer. If the first eight digits match multiple keys, a message displays that requires you to enter all 32 digits of the recovery key ID. - -2. In the **Reason** field, select a reason for your request for the recovery key. - -3. Click **Get Key**. Your BitLocker recovery key is displayed in the **Your BitLocker Recovery Key** field. - -4. Enter the 48-digit code into the BitLocker recovery screen on your computer to regain access to the computer. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md b/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md deleted file mode 100644 index 7d2a8d5f0e..0000000000 --- a/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Illustrated Features of an MBAM 2.5 Deployment -description: Illustrated Features of an MBAM 2.5 Deployment -author: dansimp -ms.assetid: 7b5eff42-af8c-4bd0-a20a-18cc2e779f01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - - -# Illustrated Features of an MBAM 2.5 Deployment - - -This topic describes the individual features that make up a Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 deployment for the following topologies: - -- MBAM Stand-alone - -- System Center Configuration Manager Integration - -**Important** -These features do not represent the recommended architecture for deploying MBAM. Use this information only as a guide to understand the individual features that make up an MBAM deployment. See [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) for the recommended architecture for MBAM. - - - -For a list of the supported versions of the software mentioned in this topic, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -## MBAM Stand-alone topology - - -The following image and table explain the features in an MBAM Stand-alone topology. - -![mbab2\-5](images/mbam2-5-standalonecomponents.png) - -|Feature type|Description|Database| -|-|-|-| -|Recovery Database|This database stores recovery data that is collected from MBAM client computers.|This feature is configured on a server running Windows Server and a supported SQL Server instance.| -|Compliance and Audit Database|This database stores compliance data, which is used primarily for the Reports that SQL Server Reporting Services hosts.|This feature is configured on a server running Windows Server and a supported SQL Server instance.| -|Compliance and Audit Reports||| -|Reporting Web Service|This web service enables communication between the Administration and Monitoring Website and the SQL Server instance where reporting data is stored.|This feature is installed on a server running Windows Server.| -|Reporting Website (Administration and Monitoring Website)|You view Reports from the Administration and Monitoring Website. The Reports provide recovery audit and compliance status data about the client computers in your enterprise.|This feature is configured on a server running Windows Server.| -|SQL Server Reporting Services (SSRS)|Reports are configured in an SSRS database instance. Reports can be viewed directly from SSRS or from the Administration and Monitoring Website.|This feature is configured on a server running Windows Server and a supported SQL Server instance that is running SSRS.| -|Self-Service Server||| -|Self-Service Web Service|This web service is used by the MBAM Client and the Administration and Monitoring Website and Self-Service Portal to communicate to the Recovery Database.|This feature is installed on a computer running Windows Server.| -|Self-Service Website (Self-Service Portal)|This website enables end users on client computers to independently sign in to a website to get a recovery key if they lose or forget their BitLocker password.|This feature is configured on a computer running Windows Server.| -|Administration and Monitoring Server||| -|Administration and Monitoring Web Service|The Monitoring Web Service is used by the MBAM Client and the websites to communicate to the databases.|This feature is installed on a computer running Windows Server.| - -**Important** -The Self-Service Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1, in which the MBAM Client, the Administration and Monitoring Website, and the Self-Service Portal communicate directly with the Recovery Database. - -**Important** -The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM Client and the websites communicate directly with the Recovery Database. - - -## System Center Configuration Manager Integration topology - -The following image and table explain the features in the System Center Configuration Manager Integration topology. - -![mbam2\-5](images/mbam2-5-cmcomponents.png) - -**Important** -The Self-Service Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1, in which the MBAM Client, the Administration and Monitoring Website, and the Self-Service Portal communicate directly with the Recovery Database. - -**Warning** -The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM Client and the websites communicate directly with the Recovery Database. - - -| Feature type | Description | -|------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Self-Service Server | | -| Self-Service Web Service | This web service is used by the MBAM Client and the Self-Service Portal to communicate to the Recovery Database. | -| Self-Service Website | This website enables end users on client computers to independently sign in to a website to get a recovery key if they lose or forget their BitLocker password. | -| Administration and Monitoring Server/Recovery Audit Report | | -| Administration and Monitoring Web Service | This web service enables communication between the Administration and Monitoring Website and the SQL Server databases where reporting data is stored. | -| Administration and Monitoring Website | The Recovery Audit report is viewed from the Administration and Monitoring Website. Use the Configuration Manager console to view all other reports, or view reports directly from SQL Server Reporting Services. | -| Databases | | -| Recovery Database | This database stores recovery data that is collected from MBAM client computers. | -| Audit Database | This database stores audit information about recovery attempts and activity. | -| Configuration Manager Features | | -| Configuration Manager Management console | This console is built into Configuration Manager and is used to view reports. | -| Configuration Manager Reports | Reports show compliance and recovery audit data for client computers in your enterprise. | -| SQL Server Reporting Services | SSRS enables the MBAM Reports. Reports can be viewed directly from SSRS or from the Configuration Manager console. | - -## Related topics - -[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/images/checklistbox.gif b/mdop/mbam-v25/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/mbam-v25/images/checklistbox.gif and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-2servers.png b/mdop/mbam-v25/images/mbam2-5-2servers.png deleted file mode 100644 index 2db19008d6..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-2servers.png and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-cmcomponents.png b/mdop/mbam-v25/images/mbam2-5-cmcomponents.png deleted file mode 100644 index 8b5f59f115..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-cmcomponents.png and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-cmserver.png b/mdop/mbam-v25/images/mbam2-5-cmserver.png deleted file mode 100644 index 2fb56b9435..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-cmserver.png and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-standalonecomponents.png b/mdop/mbam-v25/images/mbam2-5-standalonecomponents.png deleted file mode 100644 index 8a96c611d0..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-standalonecomponents.png and /dev/null differ diff --git a/mdop/mbam-v25/index.md b/mdop/mbam-v25/index.md deleted file mode 100644 index e5988391c0..0000000000 --- a/mdop/mbam-v25/index.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Microsoft BitLocker Administration and Monitoring 2.5 -description: Microsoft BitLocker Administration and Monitoring 2.5 -author: dansimp -ms.assetid: fd81d7de-b166-47e8-b6c7-d984830762b6 -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - -# Microsoft BitLocker Administration and Monitoring 2.5 - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides a simplified administrative interface that you can use to manage BitLocker Drive Encryption. You configure MBAM Group Policy Templates that enable you to set BitLocker Drive Encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. For a more detailed description of MBAM, see [About MBAM 2.5](about-mbam-25.md). - -To obtain MBAM, see [How Do I Get MDOP](index.md#how-to-get-mdop). - -## Outline - -- [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - [About MBAM 2.5](about-mbam-25.md) - - [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) - - [About MBAM 2.5 SP1](about-mbam-25-sp1.md) - - [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md) - - [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md) - - [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) - - [Accessibility for MBAM 2.5](accessibility-for-mbam-25.md) -- [Planning for MBAM 2.5](planning-for-mbam-25.md) - - [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - - [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - - [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) - - [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md) - - [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - - [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md) - - [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) - - [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) -- [Deploying MBAM 2.5](deploying-mbam-25.md) - - [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) - - [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) - - [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - - [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) - - [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md) - - [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) -- [Operations for MBAM 2.5](operations-for-mbam-25.md) - - [Administering MBAM 2.5 Features](administering-mbam-25-features.md) - - [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - [Maintaining MBAM 2.5](maintaining-mbam-25.md) - - [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) -- [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) -- [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - - [Client Event Logs](client-event-logs.md) - - [Server Event Logs](server-event-logs.md) - -## More Information - -- [MDOP Information Experience](index.md) - - Find documentation, videos, and other resources for MDOP technologies. - -- [MBAM Deployment Guide](https://www.microsoft.com/download/details.aspx?id=38398) - - Get help in choosing a deployment method for MBAM, including step-by-step instructions for each method. - -- [Apply Hotfixes on MBAM 2.5 SP1 Server](apply-hotfix-for-mbam-25-sp1.md) - - Guide of how to apply MBAM 2.5 SP1 Server hotfixes diff --git a/mdop/mbam-v25/installing-the-mbam-25-server-software.md b/mdop/mbam-v25/installing-the-mbam-25-server-software.md deleted file mode 100644 index d238b982fe..0000000000 --- a/mdop/mbam-v25/installing-the-mbam-25-server-software.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Installing the MBAM 2.5 Server Software -description: Installing the MBAM 2.5 Server Software -author: dansimp -ms.assetid: b9dbe697-5400-4bac-acfb-ee6dc6586c30 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installing the MBAM 2.5 Server Software - - -This topic describes how to install the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard or by using command-line parameters. Repeat the server installation process for each server on which you are configuring MBAM 2.5 Server features. After you finish the installation, see [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) for steps about configuring the Server features. - - ---- - - - - - - - - - - - - - - - - -
          Before you startDescription

          Review the MBAM 2.5 planning information

          Read how to get log files

          By default, log files are created in the local computer’s %temp% folder. To write the log files to a specific location rather than to the %temp% folder, use the /log <location> argument.

          -

          Additional events might be logged in Event Viewer in the MBAM-Setup or MBAM-Web nodes under Applications and Services Logs > Microsoft > Windows. For example, if you uninstall MBAM, the uninstaller will also uninstall the MBAM-Setup and MBAM-Web logs in EventViewer.

          - - - -## Installing the MBAM 2.5 Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard - - -Use these steps to install the MBAM Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard. - -**To install the MBAM 2.5 Server software by using the wizard** - -1. On the server where you want to install MBAM, run **MBAMserversetup.exe** to start the Microsoft BitLocker Administration and Monitoring Setup wizard. - -2. On the **Welcome** page, click **Next**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. Choose whether to use Microsoft Update when you check for updates, and then click **Next**. - -5. Choose whether to participate in the Customer Experience Improvement Program, and then click **Next**. - -6. To start the installation, click **Install**. - -7. To configure the server features after the MBAM Server software finishes installing, select the **Run MBAM Server Configuration after the wizard closes** check box. Alternatively, you can configure MBAM later by using the **MBAM Server Configuration** shortcut that the server installation creates on your **Start** menu. - -8. Click **Finish**. - -## Installing the MBAM 2.5 Server software by using a Command Prompt window - - -At a command prompt, type a command similar to the following command to install the MBAM Server software. - -``` syntax -MbamServerSetup.exe MBAMServerInstall.log -CEIPENABLED=True OPTIN_FOR_MICROFOST_UPDATES=True INSTALLDIR=c:\mbaminstall -``` - -The following table describes the command-line parameters for installing the MBAM 2.5 Server software. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterParameter valueDescription

          CEIPENABLED

          True False

          True - participate in the Customer Improvement Experience Program, which helps Microsoft identify which MBAM features to improve.

          -

          False – do not participate in the Customer Improvement Experience Program.

          OPTIN_FOR_MICROSOFT_UPDATES

          True False

          True - use Microsoft Update to keep your computer secure and up-to-date for Windows and other Microsoft products, including MBAM.

          -

          False – do not use Microsoft Update

          INSTALLDIR

          <Path>

          Location where you want to install MBAM.

          -

          Example:

          -

          INSTALLDIR=c:\mbaminstall

          FORCE_UNINSTALL

          True False

          True - continue the process of uninstalling MBAM, even if any features fail to be removed.

          -

          False (default) if the uninstallation custom action fails to remove an added MBAM Server feature, the uninstallation fails, and MBAM remains installed.

          -

          In both instances, any features that were successfully removed during the attempt to uninstall MBAM stay removed.

          - - - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/maintaining-mbam-25.md b/mdop/mbam-v25/maintaining-mbam-25.md deleted file mode 100644 index 56128367b9..0000000000 --- a/mdop/mbam-v25/maintaining-mbam-25.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Maintaining MBAM 2.5 -description: Maintaining MBAM 2.5 -author: dansimp -ms.assetid: 44d398a0-2ca0-4d47-943c-322345409b59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining MBAM 2.5 - - -The topics in this section describe maintenance tasks that you can perform with Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Moving MBAM 2.5 features to another server - - -Use the steps in this topic to move an MBAM Server feature from one server computer to another. - -[Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) - -## Monitoring web service request performance counters - - -Use the steps in this topic to monitor the performance counters that record the performance of requests that are sent to the web services for the Administration and Monitoring Website and the Self-Service Portal. - -[Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md) - -## Other resources for maintaining MBAM - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/mbam-25-deployment-checklist.md b/mdop/mbam-v25/mbam-25-deployment-checklist.md deleted file mode 100644 index 660b1ebf79..0000000000 --- a/mdop/mbam-v25/mbam-25-deployment-checklist.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: MBAM 2.5 Deployment Checklist -description: MBAM 2.5 Deployment Checklist -author: dansimp -ms.assetid: 2ba7de17-e3a4-4798-99e0-cd1dc28c5b76 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Deployment Checklist - - -You can use this checklist to help you during Microsoft BitLocker Administration and Monitoring (MBAM) deployment with a Stand-alone topology. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when you deploy Microsoft BitLocker Administration and Monitoring features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review and complete all planning steps to prepare your environment for MBAM deployment.

          MBAM 2.5 Planning Checklist

          Checklist box

          Review the supported configurations information to ensure that MBAM supports the selected client and server computers.

          MBAM 2.5 Supported Configurations

          Checklist box

          Install the MBAM Server software.

          Installing the MBAM 2.5 Server Software

          Checklist box

          Configure the MBAM Server features:

          -
            -
          • Compliance and Audit Database and Recovery Database

          • -
          • Reports

          • -
          • Web applications

          • -
          • Configuration Manager Integration topology (needed only if you are running MBAM with this topology)

          • -
          -
          -Note

          Note the names of the servers on which you configure each feature. You will use this information throughout the configuration process.

          -
          -
          - -

          Configuring the MBAM 2.5 Server Features

          Checklist box

          Validate the MBAM configuration.

          Validating the MBAM 2.5 Server Feature Configuration

          Checklist box

          Copy the MBAM Group Policy Template and edit the Group Policy settings.

          Copying the MBAM 2.5 Group Policy Templates and Editing the MBAM 2.5 Group Policy Settings

          Checklist box

          Deploy the MBAM Client software.

          Deploying the MBAM 2.5 Client

          - - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-deployment-prerequisites.md b/mdop/mbam-v25/mbam-25-deployment-prerequisites.md deleted file mode 100644 index aecfb3c56b..0000000000 --- a/mdop/mbam-v25/mbam-25-deployment-prerequisites.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: MBAM 2.5 Deployment Prerequisites -description: MBAM 2.5 Deployment Prerequisites -author: dansimp -ms.assetid: a7b02d01-d182-4031-b373-0271177af14e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Deployment Prerequisites - - -This section contains the software that you must install before starting the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 installation. - -## MBAM 2.5 prerequisites topics - - -- [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - - This topic lists the prerequisites that apply to the Stand-alone topology and System Center Configuration Manager Integration topology. - -- [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - - This topic lists the prerequisites that apply only to the System Center Configuration Manager Integration topology. - - - [Prerequisites for the Configuration Manager Integration Feature](prerequisites-for-the-configuration-manager-integration-feature.md) - - This topic lists the software prerequisites for the System Center Configuration Manager Integration topology. - - - [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) - - Instructions for editing the **Configuration.mof** file are described. - - - [Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) - - Instructions for editing or creating the **Sms\_def.mof** file are described. - -- [Prerequisites for MBAM 2.5 Clients](prerequisites-for-mbam-25-clients.md) - - This topic lists the MBAM 2.5 Client prerequisites. - -## Other resources for MBAM 2.5 prerequisites - - -- [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -- [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -- [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/mbam-25-planning-checklist.md b/mdop/mbam-v25/mbam-25-planning-checklist.md deleted file mode 100644 index 015403224b..0000000000 --- a/mdop/mbam-v25/mbam-25-planning-checklist.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: MBAM 2.5 Planning Checklist -description: MBAM 2.5 Planning Checklist -author: dansimp -ms.assetid: ffe11eb8-44db-4886-8300-6dffec8bcfa4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Planning Checklist - - -You can use the following checklists to help you prepare your computing environment for the Microsoft BitLocker Administration and Monitoring (MBAM) deployment. The checklists provide a high-level list of items to consider when planning the deployment. There are separate checklists for the Stand-alone topology and the Configuration Manager Integration topology. You might want to copy the desired checklist into a spreadsheet and customize it for your use. - -**Planning checklist for an MBAM deployment** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferencesNotes
          Checklist box

          Review the "Getting started" information to understand the product before you start deployment planning.

          Getting Started with MBAM 2.5

          Checklist box

          Review the recommended high-level architecture for an MBAM deployment. You might also want to review an illustration and description of the individual parts (databases, websites, Reports) of an MBAM deployment.

          High-Level Architecture for MBAM 2.5

          -

          Illustrated Features of an MBAM 2.5 Deployment

          Checklist box

          Review and complete the prerequisites for the MBAM Stand-alone and Configuration Manager Integration topologies.

          MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

          Checklist box

          If you plan to use the Configuration Manager Integration topology, complete the additional prerequisites that apply only to this topology.

          MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology

          Checklist box

          Review and meet the MBAM 2.5 prerequisites for the MBAM Client.

          Prerequisites for MBAM 2.5 Clients

          Checklist box

          Plan for and configure MBAM Group Policy requirements.

          Planning for MBAM 2.5 Group Policy Requirements

          Checklist box

          Plan for and create the necessary Active Directory Domain Services security groups.

          Planning for MBAM 2.5 Groups and Accounts

          Checklist box

          Plan how you will secure the MBAM websites.

          Planning How to Secure the MBAM Websites

          Checklist box

          Review the MBAM Supported Configurations to ensure that your hardware meets the installation system requirements.

          MBAM 2.5 Supported Configurations

          Checklist box

          Review the considerations for deploying the MBAM Server features.

          Planning for MBAM 2.5 Server Deployment

          Checklist box

          Review the considerations for deploying the MBAM Client.

          Planning for MBAM 2.5 Client Deployment

          Checklist box

          Review the requirements and steps to deploy MBAM in a highly available configuration.

          Planning for MBAM 2.5 High Availability

          Checklist box

          Review the MBAM security considerations that pertain to the Trusted Platform Module, log files, and transparent data encryption.

          MBAM 2.5 Security Considerations

          Checklist box

          Optionally, review the steps to evaluate MBAM in a test environment.

          Evaluating MBAM 2.5 in a Test Environment

          - - - - -## Related topics - - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-security-considerations.md b/mdop/mbam-v25/mbam-25-security-considerations.md deleted file mode 100644 index 05695a6beb..0000000000 --- a/mdop/mbam-v25/mbam-25-security-considerations.md +++ /dev/null @@ -1,317 +0,0 @@ ---- -title: MBAM 2.5 Security Considerations -description: MBAM 2.5 Security Considerations -author: dansimp -ms.assetid: f6613c63-b32b-45fb-a6e8-673d6dae7d16 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/23/2017 ---- - - -# MBAM 2.5 Security Considerations - - -This topic contains the following information about how to secure Microsoft BitLocker Administration and Monitoring (MBAM): - -- [Configure MBAM to escrow the TPM and store OwnerAuth passwords](#bkmk-tpm) - -- [Configure MBAM to automatically unlock the TPM after a lockout](#bkmk-autounlock) - -- [Secure connections to SQL Server](#bkmk-secure-databases) - -- [Create accounts and groups](#bkmk-accts-groups) - -- [Use MBAM log files](#bkmk-logfiles) - -- [Review MBAM database TDE considerations](#bkmk-tde) - -- [Understand general security considerations](#bkmk-general-security) - -## Configure MBAM to escrow the TPM and store OwnerAuth passwords - -**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addition, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password) for further details. - -Depending on its configuration, the Trusted Platform Module (TPM) will lock itself in certain situations ─ such as when too many incorrect passwords are entered ─ and can remain locked for a period of time. During TPM lockout, BitLocker cannot access the encryption keys to perform unlock or decryption operations, requiring the user to enter their BitLocker recovery key to access the operating system drive. To reset TPM lockout, you must provide the TPM OwnerAuth password. - -MBAM can store the TPM OwnerAuth password in the MBAM database if it owns the TPM or if it escrows the password. OwnerAuth passwords are then easily accessible on the Administration and Monitoring Website when you must recover from a TPM lockout, eliminating the need to wait for the lockout to resolve on its own. - -### Escrowing TPM OwnerAuth in Windows 8 and higher - -**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password) for further details. - -In Windows 8 or higher, MBAM no longer must own the TPM to store the OwnerAuth password, as long as the OwnerAuth is available on the local machine. - -To enable MBAM to escrow and then store TPM OwnerAuth passwords, you must configure these Group Policy settings. - - ---- - - - - - - - - - - - - - - - - -
          Group Policy SettingConfiguration

          Turn on TPM backup to Active Directory Domain Services

          Disabled or Not Configured

          Configure the level of TPM owner authorization information available to the operating system

          Delegated/None or Not Configured

          - - - -The location of these Group Policy settings is **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services**. - -**Note**   -Windows removes the OwnerAuth locally after MBAM successfully escrows it with these settings. - - - -### Escrowing TPM OwnerAuth in Windows 7 - -In Windows 7, MBAM must own the TPM to automatically escrow TPM OwnerAuth information in the MBAM database. If MBAM does not own the TPM, you must use the MBAM Active Directory (AD) Data Import cmdlets to copy TPM OwnerAuth from Active Directory into the MBAM database. - -### MBAM Active Directory Data Import cmdlets - -The MBAM Active Directory Data Import cmdlets let you retrieve recovery key packages and OwnerAuth passwords that are stored in Active Directory. - -The MBAM 2.5 SP1 server ships with four PowerShell cmdlets that pre-populate MBAM databases with the Volume recovery and TPM owner information stored in Active Directory. - -For Volume Recovery keys and packages: - -- Read-ADRecoveryInformation - -- Write-MbamRecoveryInformation - -For TPM Owner Information: - -- Read-ADTpmInformation - -- Write-MbamTpmInformation - -For Associating Users to Computers: - -- Write-MbamComputerUser - -The Read-AD\* cmdlets read information from Active Directory. The Write-Mbam\* cmdlets push the data into the MBAM databases. See [Cmdlet Reference for Microsoft Bitlocker Administration and Monitoring 2.5](https://technet.microsoft.com/library/dn459018.aspx) for detailed information about these cmdlets, including syntax, parameters, and examples. - -**Create user-to-computer associations:** The MBAM Active Directory Data Import cmdlets gather information from Active Directory and insert the data into MBAM database. However, they do not associate users to volumes. You can download the Add-ComputerUser.ps1 PowerShell script to create user-to-machine associations, which let users regain access to a computer through the Administration and Monitoring Website or by using the Self-Service Portal for recovery. The Add-ComputerUser.ps1 script gathers data from the **Managed By** attribute in Active Directory (AD), the object owner in AD, or from a custom CSV file. The script then adds the discovered users to the recovery information pipeline object, which must be passed to Write-MbamRecoveryInformation to insert the data into the recovery database. - -Download the Add-ComputerUser.ps1 PowerShell script from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=613122). - -You can specify **help Add-ComputerUser.ps1** to get help for the script, including examples of how to use the cmdlets and the script. - -To create user-to-computer associations after you have installed the MBAM server, use the Write-MbamComputerUser PowerShell cmdlet. Similar to the Add-ComputerUser.ps1 PowerShell script, this cmdlet lets you specify users that can use the Self-Service Portal to get TPM OwnerAuth information or volume recovery passwords for the specified computer. - -**Note**   -The MBAM agent will override user-to-computer associations when that computer begins reporting up to the server. - - - -**Prerequisites:** The Read-AD\* cmdlets can retrieve information from AD only if they are either run as a highly privileged user account, such as a Domain Administrator, or run as an account in a custom security group granted read access to the information (recommended). - -[BitLocker Drive Encryption Operations Guide: Recovering Encrypted Volumes with AD DS](https://technet.microsoft.com/library/cc771778(WS.10).aspx) provides details about creating a custom security group (or multiple groups) with read access to the AD information. - -**MBAM Recovery and Hardware Web Service Write Permissions:** The Write-Mbam\* cmdlets accept the URL of the MBAM Recovery and Hardware Service, used to publish the recovery or TPM information. Typically, only a domain computer service account can communicate with the MBAM Recovery and Hardware Service. In MBAM 2.5 SP1, you can configure the MBAM Recovery and Hardware Service with a security group called DataMigrationAccessGroup whose members are allowed to bypass the domain computer service account check. The Write-Mbam\* cmdlets must be run as a user belonging to this configured group. (Alternatively, the credentials of an individual user in the configured group can be specified by using the –Credential parameter in the Write-Mbam\* cmdlets.) - -You can configure the MBAM Recovery and Hardware Service with the name of this security group in one of these ways: - -- Provide the name of the security group (or individual) in the -DataMigrationAccessGroup parameter of the Enable-MbamWebApplication –AgentService Powershell cmdlet. - -- Configure the group after the MBAM Recovery and Hardware Service has been installed by editing the web.config file in the <inetpub>\\Microsoft Bitlocker Management Solution\\Recovery and Hardware Service\\ folder. - - ```xml - - ``` - - where <groupName> is replaced with the domain and the group name (or the individual user) that will be used to allow data migration from Active Directory. - -- Use the Configuration Editor in IIS Manager to edit this appSetting. - -In the following example, the command, when run as a member of both the ADRecoveryInformation group and the Data Migration Users group, will pull the volume recovery information from computers in the WORKSTATIONS organizational unit (OU) in the contoso.com domain and write them to MBAM by using the MBAM Recovery and Hardware Service running on the mbam.contoso.com server. - -``` syntax -PS C:\> Read-ADRecoveryInformation -Server contoso.com -SearchBase "OU=WORKSTATIONS,DC=CONTOSO,DC=COM" | Write-MbamRecoveryInformation -RecoveryServiceEndPoint "https://mbam.contoso.com/MBAMRecoveryAndHardwareService/CoreService.svc" -``` - -**Read-AD\* cmdlets** accept the name or IP address of an Active Directory hosting server machine to query for recovery or TPM information. We recommend providing the distinguished names of the AD containers in which the computer object resides as the value of the SearchBase parameter. If computers are stored across several OUs, the cmdlets can accept pipeline input to run once for each container. The distinguished name of an AD container will look similar to OU=Machines,DC=contoso,DC=com. Performing a search targeted to specific containers provides the following benefits: - -- Reduces the risk of timeout while querying a large AD dataset for computer objects. - -- Can omit OUs containing datacenter servers or other classes of computers for which the backup might not be desired or necessary. - -Another option is to provide the –Recurse flag with or without the optional SearchBase to search for computer objects across all containers under the specified SearchBase or the entire domain respectively. When you use the -Recurse flag, you can also use the -MaxPageSize parameter to control the amount of local and remote memory required to service the query. - -These cmdlets write to the pipeline objects of type PsObject. Each PsObject instance contains a single volume recovery key or TPM owner string with its associated computer name, timestamp, and other information required to publish it to the MBAM data store. - -**Write-Mbam\* cmdlets** accept recovery information parameter values from the pipeline by property name. This allows the Write-Mbam\* cmdlets to accept the pipeline output of the Read-AD\* cmdlets (for example, Read-ADRecoveryInformation –Server contoso.com –Recurse | Write-MbamRecoveryInformation –RecoveryServiceEndpoint mbam.contoso.com). - -The **Write-Mbam\* cmdlets** include optional parameters that provide options for fault tolerance, verbose logging, and preferences for WhatIf and Confirm. - -The **Write-Mbam\* cmdlets** also include an optional *Time* parameter whose value is a **DateTime** object. This object includes a *Kind* attribute that can be set to `Local`, `UTC`, or `Unspecified`. When the *Time* parameter is populated from data taken from the Active Directory, the time is converted to UTC and this *Kind* attribute is set automatically to `UTC`. However, when populating the *Time* parameter using another source, such as a text file, you must explicitly set the *Kind* attribute to its appropriate value. - -**Note**   -The Read-AD\* cmdlets do not have the ability to discover the user accounts that represent the computer users. User account associations are needed for the following: - -- Users to recover volume passwords/packages by using the Self-Service portal - -- Users who are not in the MBAM Advanced Helpdesk Users security group as defined during installation, recovering on behalf of other users - - - -## Configure MBAM to automatically unlock the TPM after a lockout - - -You can configure MBAM 2.5 SP1 to automatically unlock the TPM in case of a lockout. If TPM lockout auto reset is enabled, MBAM can detect that a user is locked out and then get the OwnerAuth password from the MBAM database to automatically unlock the TPM for the user. TPM lockout auto reset is only available if the OS recovery key for that computer was retrieved by using the Self Service Portal or the Administration and Monitoring Website. - -**Important**   -To enable TPM lockout auto reset, you must configure this feature on both the server side and in Group Policy on the client side. - - - -- To enable TPM lockout auto reset on the client side, configure the Group Policy setting "Configure TPM lockout auto reset" located at **Computer Configuration** > **Administrative Templates** > **Windows Components** > **MDOP MBAM** > **Client Management**. - -- To enable TPM lockout auto reset on the server side, you can check "Enable TPM lockout auto reset" in the MBAM Server Configuration wizard during setup. - - You can also enable TPM lockout auto reset in PowerShell by specifying the "-TPM lockout auto reset" switch while enabling the agent service web component. - -After a user enters the BitLocker recovery key they obtained from the Self Service Portal or the Administration and Monitoring Website, the MBAM agent will determine if the TPM is locked out. If it is locked out, it will attempt to retrieve the TPM OwnerAuth for the computer from the MBAM database. If the TPM OwnerAuth is successfully retrieved, it will be used to unlock the TPM. Unlocking the TPM makes the TPM fully functional and the user will not be forced to enter the recovery password during subsequent reboots from a TPM lockout. - -TPM lockout auto reset is disabled by default. - -**Note**   -TPM lockout auto reset is only supported on computers running TPM version 1.2. TPM 2.0 provides built-in lockout auto reset functionality. - - - -**The Recovery Audit Report** includes events related to TPM lockout auto reset. If a request is made from the MBAM client to retrieve a TPM OwnerAuth password, an event is logged to indicate recovery. Audit entries will include the following events: - - ---- - - - - - - - - - - - - - - - - - - - - -
          EntryValue

          Audit Request Source

          Agent TPM unlock

          Key Type

          TPM Password Hash

          Reason Description

          TPM Reset

          - - - -## Secure connections to SQL Server - - -In MBAM, SQL Server communicates with SQL Server Reporting Services and with the web services for the Administration and Monitoring Website and Self-Service Portal. We recommend that you secure the communication with SQL Server. For more information, see [Encrypting Connections to SQL Server](https://technet.microsoft.com/library/ms189067.aspx). - -For more information about securing the MBAM websites, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md). - -## Create accounts and groups - - -The best practice for managing user accounts is to create domain global groups and add user accounts to them. For a description of the recommended accounts and groups, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md). - -## Use MBAM log files - - -This section describes the MBAM Server and MBAM Client log files. - -**MBAM Server Setup log files** - -The **MBAMServerSetup.exe** file generates the following log files in the user’s **%temp%** folder during the MBAM installation: - -- **Microsoft\_BitLocker\_Administration\_and\_Monitoring\_<14 numbers>.log** - - Logs the actions taken during the MBAM setup and the MBAM Server feature configuration. - -- **Microsoft\_BitLocker\_Administration\_and\_Monitoring\_<14\_numbers>\_0\_MBAMServer.msi.log** - - Logs additional action taken during installation. - -**MBAM Server Configuration log files** - -- **Applications and Services Logs/Microsoft Windows/MBAM-Setup** - - Logs the errors that occur when you are using Windows Powershell cmdlets or the MBAM Server Configuration wizard to configure the MBAM Server features. - -**MBAM Client setup log files** - -- **MSI<five random characters>.log** - - Logs the actions taken during the MBAM Client installation. - -**MBAM-Web log files** - -- Shows activity from the web portals and services. - -## Review MBAM database TDE considerations - - -The transparent data encryption (TDE) feature that is available in SQL Server is an optional installation for the database instances that will host the MBAM database features. - -With TDE, you can perform real-time, full database-level encryption. TDE is the optimal choice for bulk encryption to meet regulatory compliance or corporate data security standards. TDE works at the file level, which is similar to two Windows features: the Encrypting File System (EFS) and BitLocker Drive Encryption. Both features also encrypt data on the hard drive. TDE does not replace cell-level encryption, EFS, or BitLocker. - -When TDE is enabled on a database, all backups are encrypted. Thus, special care must be taken to ensure that the certificate that was used to protect the database encryption key is backed up and maintained with the database backup. If this certificate (or certificates) is lost, the data will be unreadable. - -Back up the certificate with the database. Each certificate backup should have two files. Both of these files should be archived. Ideally for security, they should be backed up separately from the database backup file. You can alternatively consider using the extensible key management (EKM) feature (see Extensible Key Management) for storage and maintenance of keys that are used for TDE. - -For an example of how to enable TDE for MBAM database instances, see [Understanding Transparent Data Encryption (TDE)](https://technet.microsoft.com/library/bb934049.aspx). - -## Understand general security considerations - - -**Understand the security risks.** The most serious risk when you use Microsoft BitLocker Administration and Monitoring is that its functionality could be compromised by an unauthorized user who could then reconfigure BitLocker Drive Encryption and gain BitLocker encryption key data on MBAM Clients. However, the loss of MBAM functionality for a short period of time, due to a denial-of-service attack, does not generally have a catastrophic impact, unlike, for example, losing e-mail or network communications, or power. - -**Physically secure your computers**. There is no security without physical security. An attacker who gets physical access to an MBAM Server could potentially use it to attack the entire client base. All potential physical attacks must be considered high risk and mitigated appropriately. MBAM Servers should be stored in a secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for Windows operating systems, SQL Server, and MBAM by subscribing to the Security Notification service at the [Security TechCenter](https://go.microsoft.com/fwlink/?LinkId=28819). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](https://technet.microsoft.com/library/hh994572.aspx). - - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md deleted file mode 100644 index e6b0faca0c..0000000000 --- a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md +++ /dev/null @@ -1,429 +0,0 @@ ---- -title: MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies -description: MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies -author: dansimp -ms.assetid: 76a6047a-5c6e-42ff-af09-a6f382a69537 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies - - -Before starting the Microsoft BitLocker Administration and Monitoring (MBAM) installation, you must complete the prerequisites listed in this topic. These prerequisites apply to the MBAM Stand-alone topology and System Center Configuration Manager Integration topology. - -If you are deploying MBAM with System Center Configuration Manager, you must complete additional prerequisites, which are listed in [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md). - -For a list of the supported hardware and operating systems for MBAM, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**Important** -If BitLocker was used without MBAM, you must decrypt the drive and then clear TPM using tpm.msc. MBAM cannot take ownership of TPM if the client PC is already encrypted and the TPM owner password created. - - - -## Required MBAM roles and accounts - - - ---- - - - - - - - - - - - - -
          PrerequisiteDetails

          Groups created in Active Directory Domain Services (AD DS)

          See Planning for MBAM 2.5 Groups and Accounts for a description of these groups and accounts.

          - - - -## Prerequisites for the Recovery Database - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of SQL Server

          Install Microsoft SQL Server with SQL_Latin1_General_CP1_CI_AS collation.

          -

          See MBAM 2.5 Supported Configurations for supported versions.

          Required SQL Server permissions

          Required permissions:

          -
            -
          • SQL Server instance login server roles:

            -
              -
            • dbcreator

            • -
            • processadmin

            • -
          • -
          • SQL Server Reporting Services instance rights:

            -
              -
            • Create Folders

            • -
            • Publish Reports

            • -
          • -

          Optional - Install the Transparent Data Encryption (TDE) feature available in SQL Server

          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.

          -
          -Note

          TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see MBAM 2.5 Security Considerations.

          -
          -
          - -

          SQL Server Database Engine Services

          SQL Server Database Engine Services must be installed and running during MBAM Server installation.

          Windows PowerShell 3.0 or later

          Windows PowerShell does not have to be installed on the Recovery Database server if you are using Windows PowerShell to configure the database from a remote computer.

          - - - -## Prerequisites for the Compliance and Audit Database - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of SQL Server

          Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation.

          -

          See MBAM 2.5 Supported Configurations for supported versions.

          Required SQL Server permissions

          Required permissions:

          -
            -
          • SQL Server instance login server roles:

            -
              -
            • dbcreator

            • -
            • processadmin

            • -
          • -
          • SQL Server Reporting Services instance rights:

            -
              -
            • Create Folders

            • -
            • Publish Reports

            • -
          • -

          Optional - Install the Transparent Data Encryption (TDE) feature in SQL Server

          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.

          -

          TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see MBAM 2.5 Security Considerations.

          SQL Server Database Engine Services

          SQL Server Database Engine Services must be installed and running during MBAM Server installation. However, SQL Server can be running remotely; it doesn’t have to be on the same server on which you are installing the MBAM Server software.

          Windows PowerShell 3.0 or later

          Windows PowerShell does not have to be installed on the Compliance and Audit Database server if you are using Windows PowerShell to configure the database from a remote computer.

          - - - -## Prerequisites for the Reports - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of SQL Server

          Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation.

          -

          See MBAM 2.5 Supported Configurations for supported versions.

          SQL Server Reporting Services (SSRS)

          SSRS must be installed and running during the MBAM Server installation.

          -

          Configure SSRS in "native" mode and not in unconfigured or "SharePoint" mode.

          SSRS instance rights – required for configuring Reports only if you are installing databases on a separate server from the server where Reports are configured.

          Required instance rights:

          -
            -
          • Create Folders

          • -
          • Publish Reports

          • -

          Windows PowerShell 3.0 or later

          Windows PowerShell does not have to be installed on this Database server if you are using Windows PowerShell to configure the database from a remote computer.

          - - - -## Prerequisites for the Administration and Monitoring Server - - -The following table lists the installation prerequisites for the MBAM Administration and Monitoring Server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Windows Server Web Server Role

          This role must be added to a server operating system that is supported for the Administration and Monitoring Server feature.

          Web Server (IIS) Management Tools

          Click IIS Management Scripts and Tools.

          SSL Certificate

          Optional. To secure communication between the client computers and the web services, you must obtain and install a certificate that a trusted security authority signed.

          Web Server Role Services

          Common HTTP Features:

          -
            -
          • Static Content

          • -
          • Default Document

          • -
          -

          Application Development:

          -
            -
          • ASP.NET

          • -
          • .NET Extensibility

          • -
          • ISAPI Extensions

          • -
          • ISAPI Filters

          • -
          -

          Security:

          -
            -
          • Windows Authentication

          • -
          • Request Filtering

          • -

          Windows Server Features

          .NET Framework 4.5 features:

          -
            -
          • .NET Framework 4.5

            -
              -
            • Windows Server 2012 or Windows Server 2012 R2 - .NET Framework 4.5 is already installed for these versions of Windows Server, but you must enable it.

            • -
            • Windows Server 2008 R2 - .NET Framework 4.5 is not included with Windows Server 2008 R2, so you must download Microsoft .NET Framework 4.5 and install it separately.

              -
              -Note

              If you are upgrading from MBAM 2.0 or MBAM 2.0 SP1 and need to install .NET Framework 4.5, see Release Notes for MBAM 2.5 for an additional required step to make the websites work.

              -
              -
              - -
            • -
          • -
          • WCF Activation

            -
              -
            • HTTP Activation

            • -
            • Non-HTTP Activation

              -

            • -
          • -
          • TCP Activation

          • -
          -

          Windows Process Activation Service:

          -
            -
          • Process Model

          • -
          • .NET Framework Environment

          • -
          • Configuration APIs

          • -

          ASP.NET MVC 4.0

          ASP.NET MVC 4 download

          Service Principal Name (SPN)

          The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.

          -

          If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See Setspn for information about the rights required to create SPNs.

          -

          If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization to create the SPN for you by using the following command.

          -
          Setspn -s http/mbamvirtual contoso\mbamapppooluser
          -Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
          -

          In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser.

          -
          -Note

          If you are setting up Load Balancing, use the same application pool account on all servers.

          -
          -
          - -
          -

          For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see Planning How to Secure the MBAM Websites.

          - - - -## Prerequisites for the Self-Service Portal - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          Supported version of Windows Server

          See MBAM 2.5 Supported Configurations for supported versions.

          ASP.NET MVC 4.0

          ASP.NET MVC 4 download

          Web Service IIS Management Tools

          Service Principal Name (SPN)

          The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.

          -

          If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See Setspn for information about the rights required to create SPNs.

          -

          If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization administrators in your organization to create the SPN for you by using the following command.

          -
          Setspn -s http/mbamvirtual contoso\mbamapppooluser
          -Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
          -

          In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser.

          -
          -Note

          If you are setting up Load Balancing, use the same application pool account on all servers.

          -
          -
          - -
          -

          For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see Planning How to Secure the MBAM Websites.

          - - - -## Prerequisites for the Management Workstation - - - ---- - - - - - - - - - - - - -
          PrerequisiteDetails

          Before installing the MBAM Client, download the MBAM Group Policy Templates from How to Get MDOP Group Policy (.admx) Templates and configure them with the settings that you want to implement in your enterprise for BitLocker Drive Encryption.

          Before installing the MBAM Client, do the following:

          - ---- - - - - - - - - - - - - - - - - -
          What to doWhere to get instructions

          Copy the MBAM Group Policy Templates

          Copying the MBAM 2.5 Group Policy Templates

          Edit the Group Policy settings

          Editing the MBAM 2.5 Group Policy Settings

          -

          - - - - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md deleted file mode 100644 index 58cc6cf2fe..0000000000 --- a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology -description: MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology -author: dansimp -ms.assetid: 74180d8d-7b0f-460f-b301-53595cde8381 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology - - -If you are installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 by using the System Center Configuration Manager Integration feature, you must complete the prerequisites described in this topic, in addition to those in [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md). You must also create or modify .mof files that are needed for the Configuration Manager Integration topology. - -## Prerequisites for the Configuration Manager Integration Feature - - -If you are configuring MBAM with the System Center Configuration Manager Integration topology, you must complete additional prerequisites that are required for Configuration Manager. - -[Prerequisites for the Configuration Manager Integration Feature](prerequisites-for-the-configuration-manager-integration-feature.md) - -## Edit the Configuration.mof file - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager Reports, you have to edit the Configuration.mof file for System Center 2012 Configuration Manager and Microsoft System Center Configuration Manager 2007. - -[Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) - -## Create or edit the Sms\_def.mof file - - -To enable the client computers to report BitLocker compliance details in the MBAM Configuration Manager Reports, you have to create or edit the Sms\_def.mof file. If you are using System Center 2012 Configuration Manager, you must create the file. In Configuration Manager 2007, the file already exists, so you need to edit, but not overwrite, the existing file. - -[Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md deleted file mode 100644 index 970711d8a8..0000000000 --- a/mdop/mbam-v25/mbam-25-supported-configurations.md +++ /dev/null @@ -1,618 +0,0 @@ ---- -title: MBAM 2.5 Supported Configurations -description: MBAM 2.5 Supported Configurations -author: dansimp -ms.assetid: ce689aff-9a55-4ae7-a968-23c7bda9b4d6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 10/24/2018 ---- - - -# MBAM 2.5 Supported Configurations - - -You can run Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 in a Stand-alone topology or in a Configuration Manager Integration topology that integrates MBAM with System Center Configuration Manager. If you use the recommended configuration for either topology in a production environment, MBAM supports up to 500,000 MBAM clients. For information about the recommended architecture and features that are configured on each server for each topology, see [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -For additional configurations that are specific to the Configuration Manager Integration topology, see [Versions of Configuration Manager that MBAM supports](#bkmk-cm-ramreqs). - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -## MBAM Supported Languages - - -The following tables show the languages that are supported for the MBAM Client (including the Self-Service Portal) and the MBAM Server in MBAM 2.5 and MBAM 2.5 SP1. - -**Supported Languages in MBAM 2.5 SP1:** - - ---- - - - - - - - - - - - - -
          Client LanguagesServer Languages

          Czech (Czech Republic) cs-CZ

          -

          Danish (Denmark) da-DK

          -

          Dutch (Netherlands) nl-NL

          -

          English (United States) en-US

          -

          Finnish (Finland) fi-FI

          -

          French (France) fr-FR

          -

          German (Germany) de-DE

          -

          Greek (Greece) el-GR

          -

          Hungarian (Hungary) hu-HU

          -

          Italian (Italy) it-IT

          -

          Japanese (Japan) ja-JP

          -

          Korean (Korea) ko-KR

          -

          Norwegian, Bokmål (Norway) nb-NO

          -

          Polish (Poland) pl-PL

          -

          Portuguese (Brazil) pt-BR

          -

          Portuguese (Portugal) pt-PT

          -

          Russian (Russia) ru-RU

          -

          Slovak (Slovakia) sk-SK

          -

          Spanish (Spain) es-ES

          -

          Swedish (Sweden) sv-SE

          -

          Turkish (Turkey) tr-TR

          -

          Slovenian (Slovenia) sl-SI

          -

          Simplified Chinese (PRC) zh-CN

          -

          Traditional Chinese (Taiwan) zh-TW

            -
          • English (United States) en-US

          • -
          • French (France) fr-FR

          • -
          • German (Germany) de-DE

          • -
          • Italian (Italy) it-IT

          • -
          • Japanese (Japan) ja-JP

          • -
          • Korean (Korea) ko-KR

          • -
          • Portuguese (Brazil) pt-BR

          • -
          • Russian (Russia) ru-RU

          • -
          • Spanish (Spain) es-ES

          • -
          • Simplified Chinese (PRC) zh-CN

          • -
          • Traditional Chinese (Taiwan) zh-TW

          • -
          - - - -**Supported Languages in MBAM 2.5:** - - ---- - - - - - - - - - - - - -
          Client LanguagesServer Languages
            -
          • English (United States) en-US

          • -
          • French (France) fr-FR

          • -
          • German (Germany) de-DE

          • -
          • Italian (Italy) it-IT

          • -
          • Japanese (Japan) ja-JP

          • -
          • Korean (Korea) ko-KR

          • -
          • Portuguese (Brazil) pt-BR

          • -
          • Russian (Russia) ru-RU

          • -
          • Spanish (Spain) es-ES

          • -
          • Simplified Chinese (PRC) zh-CN

          • -
          • Traditional Chinese (Taiwan) zh-TW

          • -
            -
          • English (United States) en-US

          • -
          • French (France) fr-FR

          • -
          • German (Germany) de-DE

          • -
          • Italian (Italy) it-IT

          • -
          • Japanese (Japan) ja-JP

          • -
          • Korean (Korea) ko-KR

          • -
          • Portuguese (Brazil) pt-BR

          • -
          • Russian (Russia) ru-RU

          • -
          • Spanish (Spain) es-ES

          • -
          • Simplified Chinese (PRC) zh-CN

          • -
          • Traditional Chinese (Taiwan) zh-TW

          • -
          - - - -## MBAM Server system requirements - - -### MBAM Server operating system requirements - -We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -The following table lists the operating systems that are supported for the MBAM Server installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Windows Server 2016

          Standard or Datacenter

          64-bit

          Windows Server 2012 R2

          Standard or Datacenter

          64-bit

          Windows Server 2012

          Standard or Datacenter

          64-bit

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter

          SP1

          64-bit

          - - - -The enterprise domain must contain at least one Windows Server 2008 (or later) domain controller. - -### MBAM Server processor, RAM, and disk space requirements – Stand-alone topology - -These requirements are for the MBAM Stand-alone topology. For the requirements for the Configuration Manager Integration topology, see [MBAM Server Processor, RAM, and Disk Space Requirements - Configuration Manager Integration Topology](#bkmk-cm-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware itemMinimum requirementRecommended requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          8 GB

          12 GB

          Free disk space

          1 GB

          2 GB

          - - - -### MBAM Server processor, RAM, and disk space requirements - Configuration Manager Integration topology - -The following table lists the server processor, RAM, and disk space requirements for MBAM servers when you are using the Configuration Manager Integration topology. For the requirements for the Stand-alone topology, see [MBAM Server Processor, RAM, and Disk Space Requirements – Stand-alone Topology](#bkmk-stand-alone-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware itemMinimum requirementRecommended requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          4 GB

          8 GB

          Free disk space

          1 GB

          2 GB

          - - - -### Versions of Configuration Manager that MBAM supports - -MBAM supports the following versions of Configuration Manager. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Supported versionService packSystem architecture

          Microsoft System Center Configuration Manager (Current Branch), versions up to 1902

          64-bit

          Microsoft System Center Configuration Manager 1806

          64-bit

          Microsoft System Center Configuration Manager (LTSB - version 1606)

          64-bit

          Microsoft System Center 2012 Configuration Manager

          SP1

          64-bit

          Microsoft System Center Configuration Manager 2007 R2 or later

          64-bit

          - ->Note Although Configuration Manager 2007 R2 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software. -
          - - - -For a list of supported configurations for the Configuration Manager Server, see the appropriate TechNet documentation for the version of Configuration Manager that you are using. MBAM has no additional system requirements for the Configuration Manager Server. - -### SQL Server database requirements - -The following table lists the Microsoft SQL Server versions that are supported for the MBAM Server features, which include the Recovery Database, Compliance and Audit Database, and the Reports feature. The required versions apply to the Stand-alone or the Configuration Manager Integration topologies. - -You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** collation. - - ------ - - - - - - - - - - - - - -
          - - - -https://www.microsoft.com/en-us/download/details.aspx?id=54967 - - - - - - - - - - - - - - - - - -
          SQL Server versionEditionService packSystem architecture

          Microsoft SQL Server 2017

          Standard, Enterprise, or Datacenter

          64-bit

          Microsoft SQL Server 2016

          Standard, Enterprise, or Datacenter

          SP1

          64-bit

          Microsoft SQL Server 2014

          Standard, Enterprise, or Datacenter

          SP1, SP2

          64-bit

          Microsoft SQL Server 2012

          Standard, Enterprise, or Datacenter

          SP3

          64-bit

          Microsoft SQL Server 2008 R2

          Standard or Enterprise

          SP3

          64-bit

          - -**Note** -In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=54967 and to support SQL 2017 you must install the July 2018 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=57157. In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features. - - -### SQL Server processor, RAM, and disk space requirements – Stand-alone topology - -The following table lists the recommended server processor, RAM, and disk space requirements for the SQL Server computer when you are using the Stand-alone topology. Use these requirements as a guide. Your specific requirements will vary based on the number of client computers you are supporting in your enterprise. To view the requirements for the Configuration Manager Integration topology, see [SQL Server Processor, RAM, and Disk Space Requirements - Configuration Manager Integration Topology](#bkmk-cm-sql-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware itemMinimum requirementRecommended requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          8 GB

          12 GB

          Free disk space

          5 GB

          5 GB or greater

          - - - -### SQL Server processor, RAM, and disk space requirements - Configuration Manager Integration topology - -The following table lists the server processor, RAM, and disk space requirements for the Microsoft SQL Server computer when you are using the Configuration Manager Integration topology, see [SQL Server Processor, RAM, and Disk Space Requirements – Stand-alone Topology](#bkmk-sql-stand-alone-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          Hardware itemMinimum requirementRecommended requirement

          Processor

          2.33 GHz

          2.33 GHz or greater

          RAM

          4 GB

          8 GB

          Free disk space

          5 GB

          5 GB

          - - - -## MBAM Client system requirements - - -### Client operating system requirements - -We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -The following table lists the operating systems that are supported for MBAM Client installation. The same requirements apply to the Stand-alone and the Configuration Manager Integration topologies. - - ------ - - - - - - - - - - - - - - -
          - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Windows 10 IoT

          Enterprise

          32-bit or 64-bit

          Windows 10

          Enterprise

          32-bit or 64-bit

          Windows 8.1

          Enterprise

          32-bit or 64-bit

          Windows 7

          Enterprise or Ultimate

          SP1

          32-bit or 64-bit

          Windows To Go

          Windows 8.1 and Windows 10 Enterprise

          32-bit or 64-bit

          - - - -### Client RAM requirements - -There are no RAM requirements that are specific to the MBAM Client installation. - -## MBAM Group Policy system requirements - - -The following table lists the operating systems that are supported for MBAM Group Policy Templates installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architecture

          Windows 10 IoT

          Enterprise

          32-bit or 64-bit

          Windows 10

          Enterprise

          32-bit or 64-bit

          Windows 8.1

          Enterprise

          32-bit or 64-bit

          Windows 7

          Enterprise, or Ultimate

          SP1

          32-bit or 64-bit

          Windows Server 2012 R2

          Standard or Datacenter

          64-bit

          Windows Server 2012

          Standard or Datacenter

          64-bit

          Windows Server 2008 R2

          Standard, Enterprise, or Datacenter

          SP1

          64-bit

          - -## MBAM In Azure IaaS - -The MBAM server can be deployed in Azure Infrastructure as a Service (IaaS) on any of the supported OS versions listed above, connecting to an Active Directory hosted on premises or an Active Directory also hosted in Azure IaaS. Documentation for setting up and configuring Active Directory on Azure IaaS is [here](https://msdn.microsoft.com/library/azure/jj156090.aspx). - -The MBAM client is not supported on virtual machines and is also not supported on Azure IaaS. - - -## Service releases - -- [April 2016 hotfix](https://support.microsoft.com/help/3144445/april-2016-hotfix-rollup-for-microsoft-desktop-optimization-pack) -- [September 2016](https://support.microsoft.com/ms-my/help/3168628/september-2016-servicing-release-for-microsoft-desktop-optimization-pa) -- [December 2016](https://support.microsoft.com/help/3198158/december-2016-servicing-release-for-microsoft-desktop-optimization-pac) -- [March 2017](https://support.microsoft.com/en-ie/help/4014009/march-2017-servicing-release-for-microsoft-desktop-optimization-pack) -- [June 2017](https://support.microsoft.com/af-za/help/4018510/june-2017-servicing-release-for-microsoft-desktop-optimization-pack) -- [September 2017](https://support.microsoft.com/en-ie/help/4041137/september-2017-servicing-release-for-microsoft-desktop-optimization) -- [March 2018](https://support.microsoft.com/help/4074878/march-2018-servicing-release-for-microsoft-desktop-optimization-pack) -- [July 2018](https://support.microsoft.com/help/4340040/july-2018-servicing-release-for-microsoft-desktop-optimization-pack) - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md b/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md deleted file mode 100644 index 45f2ee0794..0000000000 --- a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Monitoring and Reporting BitLocker Compliance with MBAM 2.5 -description: Monitoring and Reporting BitLocker Compliance with MBAM 2.5 -author: dansimp -ms.assetid: 24a3bccd-8b67-4baa-a181-e4572eaba5bf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring and Reporting BitLocker Compliance with MBAM 2.5 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides several reports that you can use to monitor BitLocker usage and compliance activities in your enterprise. - -Reports for the MBAM Stand-alone topology and the MBAM Configuration Manager Integration topology differ in the following ways: - -- In the Stand-alone topology, you view reports in the Administration and Monitoring Website. In the Configuration Manager Integration topology, you view reports in the Configuration Manager console, with one exception: you continue to view the Recovery Audit report from the Administration and Monitoring Website. - -- The names of the reports differ slightly between the two topologies. Visit the following links for the names and descriptions of the reports for each topology. - -## Viewing MBAM 2.5 Reports – Stand-alone topology - - -The following topics describe the reports and explain how to generate and view them in the Administration and Monitoring Website. - -[Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md) - -[Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md) - -## Viewing MBAM 2.5 Reports – Configuration Manager Integration topology - - -The topic in this section describes the reports for the Configuration Manager Integration topology and explains how to view them in the Configuration Manager console. - -[Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md) - -## Other resources for monitoring and reporting BitLocker compliance with MBAM - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md b/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md deleted file mode 100644 index 6a03158661..0000000000 --- a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Monitoring Web Service Request Performance Counters -description: Monitoring Web Service Request Performance Counters -author: dansimp -ms.assetid: bdb812a1-465a-4098-b4c0-cb99890d1b0d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Monitoring Web Service Request Performance Counters - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides performance counters that record the performance of requests that are sent to the following web services: - -- **StatusReportingService.svc** – service that receives requests for compliance status - -- **CoreService.svc** – service that receives requests for key recovery attempts - -## Performance counters that MBAM provides - - -MBAM provides the following performance counters for each of the public methods that is implemented by its StatusReportingService and CoreService web services: - - ---- - - - - - - - - - - - - - - - - - - - - -
          Type of performance counterDescription

          Total number of requests

          Provides an incrementing count that starts from zero when the server is started or restarted.

          -

          Provides an overall view of system activity. Can be monitored by automated tools to ensure the health of the server and to validate that the counter continually increments over a specified period of time.

          Requests per second

          Indicates the current throughput of the MBAM Server as it supports the MBAM client base.

          -

          Enables site administrators to:

          -
            -
          • Calculate the average number of requests per second, based on the number of MBAM Clients and their reporting frequency.

          • -
          • Validate that the number of requests per second broadly correlates with the calculated average number of requests per second. A significant variance can indicate that the MBAM Client isn't installed on a percentage of the client base or that an MBAM Group Policy Object hasn't been successfully deployed.

          • -

          Request duration

          Records the duration of requests in milliseconds.

          -

          Although this counter is updated with the duration of each request, Windows Performance Monitor samples it only periodically (typically every second), so you might see some variability in the value. For this reason, consider using the average value displayed by Performance Monitor.

          - -  - -## Performance counter results and recommendations - - -As you add new MBAM Clients to an MBAM Server with spare capacity, expect to see an increase in the number of requests per second. This increase will be proportional to the number of new client computers. The average request duration will remain relatively static. As the server nears its maximum capacity, the requests per second start to level out, and the average request duration starts to get longer. - -If you are concerned about whether your MBAM Servers can support your client base, consider deploying MBAM in phases across different collections of client computers. As you deploy MBAM to each collection of client computers, we recommend that you take snapshots of the performance counters to see the relative impact of deploying to each new client collection. If the number of requests per second starts to level off and the average request duration increases, consider enhancing your MBAM Server infrastructure by doing one of the following: - -- Moving the MBAM database onto a dedicated Microsoft SQL Server or SQL Server cluster - -- Load-balancing MBAM across multiple Internet Information Services (IIS) web servers - -- Deploying MBAM on more powerful server hardware - -## Viewing performance counters - - -The recommended tool for viewing MBAM performance counters is Windows Performance Monitor, which comes with Windows. If you are using Windows PowerShell, you don’t need to enable the counters before viewing them, as they are automatically registered by the Windows PowerShell **Enable-webapplication** cmdlet. - -For detailed instructions on how to view performance counters, see [How to View MBAM Performance Counters](https://go.microsoft.com/fwlink/?LinkId=393457). - - - -## Related topics - - -[Maintaining MBAM 2.5](maintaining-mbam-25.md) - -  - -  - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - diff --git a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md b/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md deleted file mode 100644 index 75b47a4907..0000000000 --- a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Moving MBAM 2.5 Features to Another Server -description: Moving MBAM 2.5 Features to Another Server -author: dansimp -ms.assetid: 9767a0e4-e8ab-49f0-98c5-5cd671975501 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Moving MBAM 2.5 Features to Another Server - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 enables you to move the databases, Reports feature, and the websites to another server. - -## Moving MBAM Server features topics - - -- [How to Move the MBAM 2.5 Databases](how-to-move-the-mbam-25-databases.md) - - This topic explains how to move the Compliance and Audit Database (or Audit Database, if you are using the Configuration Manager Integration topology) and the Recovery Database. - -- [How to Move the MBAM 2.5 Reports](how-to-move-the-mbam-25-reports.md) - - This topic explains how to move the Reports to another server. - -- [How to Move the MBAM 2.5 Websites](how-to-move-the-mbam-25-websites.md) - - This topic explains how to move the Administration and Monitoring Website and Self-Service Portal to another server. - -## Other resources for moving MBAM features - - -- [Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -- [Maintaining MBAM 2.5](maintaining-mbam-25.md) - -- [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/operations-for-mbam-25.md b/mdop/mbam-v25/operations-for-mbam-25.md deleted file mode 100644 index e318d1bba3..0000000000 --- a/mdop/mbam-v25/operations-for-mbam-25.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Operations for MBAM 2.5 -description: Operations for MBAM 2.5 -author: dansimp -ms.assetid: da0e35be-2dc4-4a24-b69a-530436eb48fc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MBAM 2.5 - - -This topic describes the types of administrative tasks that you can perform with Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Operations information - - -- [Administering MBAM 2.5 Features](administering-mbam-25-features.md) - - After deploying MBAM, you can use it to manage BitLocker encryption in your enterprise. The information in this section describes day-to-day MBAM feature operations and maintenance tasks. - -- [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - This section describes the MBAM reports that you use to monitor BitLocker usage and compliance activities throughout your enterprise. - -- [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - This section describes the day-to-day BitLocker encryption management tasks that you can do with MBAM. - -- [Maintaining MBAM 2.5](maintaining-mbam-25.md) - - This section describes how to move MBAM Server features and how to monitor web service request performance counters. - -- [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) - - This section describes Windows PowerShell cmdlets that administrators can use to perform various MBAM Server tasks. - -## Other resources for MBAM operations - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md b/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md deleted file mode 100644 index d6ef03091b..0000000000 --- a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Performing BitLocker Management with MBAM 2.5 -description: Performing BitLocker Management with MBAM 2.5 -author: dansimp -ms.assetid: 068f3ee0-300c-4083-ba18-7065eef997ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing BitLocker Management with MBAM 2.5 - - -After planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage BitLocker Drive Encryption across your enterprise. The information in this section describes post-installation, day-to-day BitLocker encryption management tasks that are accomplished by using Microsoft BitLocker Administration and Monitoring. - -## Reset a TPM lockout - - -A Trusted Platform Module (TPM) is a microchip that is designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer, and it communicates with the rest of the system by using a host bus adapter. On computers that incorporate a TPM, you can create cryptographic keys and encrypt them so that they can be decrypted only by the TPM. - -A TPM lockout can occur if a user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies by manufacturer. You can use MBAM to access the centralized key recovery data system on the Administration and Monitoring Website, where you can retrieve a TPM owner password file when you supply a computer ID and an associated user identifier. - -[How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-25.md) - -## Recover drives - - -When you are dealing with the encryption of data, especially in an enterprise environment, consider how that data can be recovered in the event of a hardware failure, changes in personnel, or other situations in which encryption keys can be lost. - -The encrypted drive recovery features in MBAM ensure that data can be captured and stored and that the required tools are available to access a BitLocker-protected volume when BitLocker goes into recovery mode, is moved, or becomes corrupted. - -[How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-25.md) - -[How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-25.md) - -[How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-25.md) - -## Determine BitLocker encryption state of lost computers - - -By using MBAM, you can determine the last known BitLocker encryption status of computers that were lost or stolen. - -[How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md) - -## Use the Self-Service Portal to regain access to a computer - - -If end users get locked out of Windows by BitLocker, they can use the instructions in this section to get a BitLocker recovery key to regain access to their computer. - -[How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md) - - - -## Related topics - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -  - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md deleted file mode 100644 index 6fce394daa..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Planning for MBAM 2.5 Client Deployment -description: Planning for MBAM 2.5 Client Deployment -author: dansimp -ms.assetid: 23c89976-af24-4753-9412-ce0ea42d1964 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.5 Client Deployment - - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client software, you can enable BitLocker Drive Encryption on a computer in your organization either before the end user receives the computer or afterwards. For both the MBAM Stand-alone and the System Center Configuration Manager Integration topologies, you have to configure Group Policy settings for MBAM. - -If you are using the MBAM Stand-alone topology, we recommend that you use an enterprise software deployment system to deploy the MBAM Client software to end-user computers. - -If you deploy MBAM with the Configuration Manager Integration topology, you can use Configuration Manager to deploy the MBAM Client software to end-user computers. In Configuration Manager, the MBAM installation creates a collection of computers that MBAM can manage. This collection includes workstations and devices that do not have a Trusted Platform Module (TPM), but that are running Windows 8, Windows 8.1, or Windows 10. - -**Note**   -Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007. - - - -## Deploying the MBAM Client to enable BitLocker Drive Encryption after computer distribution to end users - - -After you configure Group Policy, you can use an enterprise software deployment system product like Microsoft System Center Configuration Manager or Active Directory Domain Services (AD DS) to deploy the Windows Installer files of the MBAM Client installation to target computers. To deploy the MBAM Client, you can use either the 32-bit or 64-bit MbamClientSetup.exe files or MBAMClient.msi files, which are provided with the MBAM Client software. - -**Note**   -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product. - - - -When you deploy the MBAM Client after you distribute computers to client computers, end users are prompted to encrypt their computer. This action enables MBAM to collect the data, which includes the PIN and password (if required by policy), and then to begin the encryption process. - -**Note**   -In this approach, end users who have computers with a TPM chip are prompted to activate and initialize the TPM chip if the chip has not been previously activated. - - - -## Using the MBAM Client to enable BitLocker Drive Encryption before computer distribution to end users - - -In organizations where computers are received and configured centrally, and where computers have a compliant TPM chip, you can use the MBAM Client to manage BitLocker Drive Encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then compliant. This method does not rely on end-user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the end user. - -If your organization wants to use the TPM chip to encrypt computers, the administrator adds the TPM protector to encrypt the operating system volume of the computer. If your organization wants to use the TPM chip and a PIN protector, the administrator encrypts the operating system volume with the TPM protector, and then end users select a PIN when they log on for the first time. If your organization decides to use only the PIN protector, the administrator does not have to encrypt the volume first. When end users log on, Microsoft BitLocker Administration and Monitoring prompts them to provide a PIN, or a PIN and password to be used on later computer restarts. - -**Note**   -The TPM protector option requires the administrator to accept the BIOS prompt to activate and initialize the TPM before the computer is delivered to the end user. - - - -## MBAM Client support for Encrypted Hard Drives - - -MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification requirements for Opal as well as IEEE 1667 standards. When BitLocker is enabled on these devices, it will generate keys and perform management functions on the encrypted drive. See [Encrypted Hard Drive](https://technet.microsoft.com/library/hh831627.aspx) for more information. - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md b/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md deleted file mode 100644 index 9003490cee..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md +++ /dev/null @@ -1,528 +0,0 @@ ---- -title: Planning for MBAM 2.5 Group Policy Requirements -description: Planning for MBAM 2.5 Group Policy Requirements -author: dansimp -ms.assetid: 82d545dc-3fbf-4b46-b62f-47fe178a7c44 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for MBAM 2.5 Group Policy Requirements - - -Use the following information to determine the types of BitLocker protectors that you can use to manage the Microsoft BitLocker Administration and Monitoring (MBAM) client computers in your enterprise. - -## Types of BitLocker protectors that MBAM supports - - -MBAM supports the following types of BitLocker protectors. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Type of drive or volumeSupported BitLocker protectors

          Operating system volumes

            -
          • Trusted Platform Module (TPM)

          • -
          • TPM + PIN

          • -
          • TPM + USB key – supported only when the operating system volume is encrypted before MBAM is installed

          • -
          • TPM + PIN + USB key - supported only when the operating system volume is encrypted before MBAM is installed

          • -
          • Password - supported only for Windows To Go devices, fixed data drives, and Windows 8, Windows 8.1, and Windows 10 devices that do not have a TPM

          • -
          • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7

          • -
          • Data recovery agent (DRA)

          • -

          Fixed data drives

            -
          • Password

          • -
          • Auto-unlock

          • -
          • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7

          • -
          • Data recovery agent (DRA)

          • -

          Removable drives

            -
          • Password

          • -
          • Auto-unlock

          • -
          • Numerical password - applied automatically as part of volume encryption and does not need to be configured

          • -
          • Data recovery agent (DRA)

          • -
          - - - -### Support for the Used Space Encryption BitLocker policy - -In MBAM 2.5 SP1, if you enable Used Space Encryption via BitLocker Group policy, the MBAM Client honors it. - -This Group Policy setting is called **Enforce drive encryption type on operating system drives** and is located in the following GPO node: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives**. If you enable this policy and select the encryption type as **Used Space Only encryption**, MBAM will honor the policy and BitLocker will only encrypt disk space that is used on the volume. - -## How to get the MBAM Group Policy Templates and edit the settings - - -When you are ready to configure the MBAM Group Policy settings you want, do the following: - - ---- - - - - - - - - - - - - - - - - -
          Steps to followWhere to get instructions

          Copy the MBAM Group Policy Templates from How to Get MDOP Group Policy (.admx) Templates and install them on a computer that is capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM).

          Copying the MBAM 2.5 Group Policy Templates

          Configure the Group Policy settings that you want to use in your enterprise.

          Editing the MBAM 2.5 Group Policy Settings

          - - - -## Descriptions of the MBAM Group Policy settings - - -The **MDOP MBAM (BitLocker Management)** GPO node contains four global policy settings and four child GPO nodes: **Client Management**, **Fixed Drive**, **Operating System Drive**, and **Removable Drive**. The following sections describe and suggest settings for the MBAM Group Policy settings. - -**Important** -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. MBAM automatically configures the settings in this node for you when you configure the settings in the **MDOP MBAM (BitLocker Management)** node. - - - -### Global Group Policy definitions - -This section describes MBAM Global Group Policy definitions at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy nameOverview and suggested Group Policy settings

          Choose drive encryption method and cipher strength

          Suggested configuration: Enabled

          -

          Configure this policy to use a specific encryption method and cipher strength.

          -

          When this policy is not configured, BitLocker uses the default encryption method: AES 128-bit with Diffuser.

          -
          -Note

          An issue with the BitLocker Computer Compliance report causes it to display "unknown" for the cipher strength, even if you are using the default value. To work around this issue, make sure you enable this setting and set a value for cipher strength.

          -
          -
          - -
          -
            -
          • AES 128-bit with Diffuser – for Windows 7 only

          • -
          • AES 128 for Windows 8, Windows 8.1, and Windows 10

          • -

          Prevent memory overwrite on restart

          Suggested configuration: Not Configured

          -

          Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart.

          -

          When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts.

          Validate smart card certificate usage rule

          Suggested configuration: Not Configured

          -

          Configure this policy to use smartcard certificate-based BitLocker protection.

          -

          When this policy is not configured, the default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate.

          Provide the unique identifiers for your organization

          Suggested configuration: Not Configured

          -

          Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader.

          -

          When this policy is not configured, the Identification field is not used.

          -

          If your company requires higher security measurements, you can configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting.

          - - - -### Client Management Group Policy definitions - -This section describes Client Management policy definitions for MBAM at the following GPO node: **Computer Configuration** > **Policies** >**Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Client Management**. - -You can set the same Group Policy settings for the Stand-alone and System Center Configuration Manager Integration topologies, with one exception: Disable the **Configure MBAM Services > MBAM Status reporting service endpoint** setting if you are using the Configuration Manager Integration topology, as indicated in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy nameOverview and suggested Group Policy settings

          Configure MBAM Services

          Suggested configuration: Enabled

          -
            -
          • MBAM Recovery and Hardware service endpoint. Use this setting to enable MBAM Client BitLocker encryption management. Enter an endpoint location that is similar to the following example: http(s)://<MBAM Administration and Monitoring Server Name>:<the port the web service is bound to>/MBAMRecoveryAndHardwareService/CoreService.svc.

          • -
          • Select BitLocker recovery information to store. This policy setting lets you configure the key recovery service to back up BitLocker recovery information. It also lets you configure a status reporting service for collecting reports. The policy provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to the lack of key information. The status report and key recovery activity are automatically and silently sent to the configured report server location.

            -

            If you do not configure this policy setting or if you disable it, the key recovery information is not saved, and the status report and key recovery activity are not reported to the server. When this setting is set to Recovery Password and key package, the recovery password and key package are automatically and silently backed up to the configured key recovery server location.

          • -
          • Enter client checking status frequency in minutes. This policy setting manages how frequently the client checks the BitLocker protection policies and status on the client computer. This policy also manages how frequently the client compliance status is saved to the server. The client checks the BitLocker protection policies and status on the client computer and also backs up the client recovery key at the configured frequency.

            -

            Set this frequency based on the requirement set by your company on how frequently to check the compliance status of the computer and how frequently to back up the client recovery key.

          • -
          • MBAM Status reporting service endpoint:

            -

            For MBAM in a Stand-alone topology: You must configure this setting to enable MBAM Client BitLocker encryption management.

            -

            Enter an endpoint location that is similar to the following example:

            -

            http(s)://<MBAM Administration and Monitoring Server Name>:<the port the web service is bound to>/MBAMComplianceStatusService/StatusReportingService.svc

            -

            For MBAM in the Configuration Manager Integration topology: Disable this setting.

          • -

          Configure user exemption policy

          Suggested configuration: Not Configured

          -

          This policy setting lets you configure a website address, email address, or phone number that instructs a user to request an exemption from BitLocker encryption.

          -

          If you enable this policy setting and provide a website address, email address, or phone number, users see a dialog box with instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.

          -

          If you either disable or do not configure this policy setting, the exemption request instructions are not displayed to users.

          -
          -Note

          User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer is encrypted.

          -
          -
          - -

          Configure customer experience improvement program

          Suggested configuration: Enabled

          -

          This policy setting lets you configure how MBAM users can join the Customer Experience Improvement Program. This program collects information about computer hardware and how users use MBAM without interrupting their work. The information helps Microsoft to identify which MBAM features to improve. Microsoft does not use this information to identify or contact MBAM users.

          -

          If you enable this policy setting, users can join the Customer Experience Improvement Program.

          -

          If you disable this policy setting, users cannot join the Customer Experience Improvement Program.

          -

          If you do not configure this policy setting, users have the option to join the Customer Experience Improvement Program.

          Provide the URL for the Security Policy link

          Suggested configuration: Enabled

          -

          Use this policy setting to specify a URL that is displayed to end users as a link named "Company Security Policy." The link points to your company’s internal security policy and provides end users with information about encryption requirements. The link appears when users are prompted by MBAM to encrypt a drive.

          -

          If you enable this policy setting, you can configure the URL for the Security Policy link.

          -

          If you disable or do not configure this policy setting, the Security Policy link is not displayed to users.

          - - - -### Fixed Drive Group Policy definitions - -This section describes Fixed Drive policy definitions for Microsoft BitLocker Administration and Monitoring at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Fixed Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy nameOverview and suggested Group Policy settings

          Fixed data drive encryption settings

          Suggested configuration: Enabled

          -

          This policy setting lets you manage whether fixed data drives must be encrypted.

          -

          If the operating system volume is required to be encrypted, click Enable auto-unlock fixed data drive.

          -

          When you enable this policy, you must not disable the Configure use of password for fixed data drives policy unless you are enabling or requiring the use of auto-unlock for fixed data drives.

          -

          If you have to use auto-unlock for fixed data drives, you must configure operating system volumes to be encrypted.

          -

          If you enable this policy setting, users are required to put all fixed data drives under BitLocker protection, and the data drives are then encrypted.

          -

          If you do not configure this policy setting, users are not required to put fixed data drives under BitLocker protection. If you apply this policy after fixed data drives are encrypted, the MBAM agent decrypts the encrypted fixed data drives.

          -

          If you disable this policy setting, users cannot put their fixed data drives under BitLocker protection.

          Deny write access to fixed drives not protected by BitLocker

          Suggested configuration: Not Configured

          -

          This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. This policy setting is applied when you turn on BitLocker.

          -

          When the policy is not configured, all fixed data drives on the computer are mounted with read/write permission.

          Allow access to BitLocker-protected fixed drives from earlier versions of Windows

          Suggested configuration: Not Configured

          -

          Enable this policy so that fixed drives with the FAT file system can be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          -

          When the policy is enabled or not configured, fixed drives that are formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only permission to BitLocker-protected drives.

          -

          When the policy is disabled, fixed drives that are formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          Configure use of password for fixed drives

          Suggested configuration: Not Configured

          -

          Use this policy to specify whether a password is required to unlock BitLocker-protected fixed data drives.

          -

          If you enable this policy setting, users can configure a password that meets the requirements that you define. BitLocker enables users to unlock a drive with any of the protectors that are available on the drive.

          -

          These settings are enforced when you turn on BitLocker, not when you unlock a volume.

          -

          If you disable this policy setting, users are not allowed to use a password.

          -

          When the policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

          -

          For higher security, enable this policy, and then select Require password for fixed data drive, click Require password complexity, and set the minimum password length that you want.

          -

          If you disable this policy setting, users are not allowed to use a password.

          -

          If you do not configure this policy setting, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

          Choose how BitLocker-protected fixed drives can be recovered

          Suggested configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When the policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require recovery information to be backed up to AD DS.

          Encryption Policy Enforcement Settings

          Suggested configuration: Enabled

          -

          Use this policy setting to configure the number of days that fixed data drives can remain noncompliant until they are forced to comply with MBAM policies. Users cannot postpone the required action or request an exemption from it after the grace period. The grace period starts when the fixed data drive is determined to be noncompliant. However, the fixed data drive policy is not enforced until the operating system drive is compliant.

          -

          If the grace period expires and the fixed data drive is still not compliant, users do not have the option to postpone or to request an exemption. If the encryption process requires user input, a dialog box appears that users cannot close until they provide the required information.

          -

          Enter 0 in the Configure the number of noncompliance grace period days for fixed drives to force the encryption process to begin immediately after the grace period expires for the operating system drive.

          -

          If you disable or do not configure this setting, users are not forced to comply with MBAM policies.

          -

          If no user interaction is required to add a protector, encryption begins in the background after the grace period expires.

          - - - -### Operating System Drive Group Policy definitions - -This section describes Operating System Drive policy definitions for Microsoft BitLocker Administration and Monitoring at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Operating System Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy nameOverview and suggested Group Policy settings

          Operating system drive encryption settings

          Suggested configuration: Enabled

          -

          This policy setting lets you manage whether the operating system drive must be encrypted.

          -

          For higher security, consider disabling the following policy settings in System > Power Management > Sleep Settings when you enable them with TPM + PIN protector:

          -
            -
          • Allow Standby States (S1-S3) When Sleeping (Plugged In)

          • -
          • Allow Standby States (S1-S3) When Sleeping (On Battery)

          • -
          -

          If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.

          -

          On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN).

          -

          If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive is then encrypted.

          -

          If you disable this policy, users cannot put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive is then decrypted.

          -

          If you do not configure this policy, the operating system drive is not required to be placed under BitLocker protection.

          Allow enhanced PINs for startup

          Suggested configuration: Not Configured

          -

          Use this policy setting to configure whether enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is applied when you turn on BitLocker.

          -

          If you enable this policy setting, all new BitLocker startup PINs set will enable end user to create enhanced PINs. However, not all computers can support enhanced PINs in the pre-boot environment. We strongly recommend that administrators evaluate whether their systems are compatible with this feature before enabling its use.

          -

          Select the Require ASCII-only PINs check box to help make enhanced PINs more compatible with computers that limit the type or number of characters that can be entered in the pre-boot environment.

          -

          If you disable or do not configure this policy setting, enhanced PINs are not used.

          Choose how BitLocker-protected operating system drives can be recovered

          Suggested configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When this policy is not configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS.

          -

          MBAM operation does not require recovery information to be backed up to AD DS.

          Configure use of passwords for operating system drives

          Suggested configuration: Not Configured

          -

          Use this policy setting to set the constraints for passwords that are used to unlock BitLocker-protected operating system drives. If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, you must also enable the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy.

          -
          -Note

          These settings are enforced when you turn on BitLocker, not when you unlock a volume. BitLocker lets you unlock a drive with any of the protectors that are available on the drive.

          -
          -
          - -
          -

          If you enable this policy setting, users can configure a password that meets the requirements that you define. To enforce complexity requirements on the password, click Require password complexity.

          Configure TPM platform validation profile for BIOS-based firmware configurations

          Suggested configuration: Not Configured

          -

          This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

          -
          -Important

          This Group Policy setting applies only to computers with BIOS configurations or to computers with UEFI firmware with a Compatibility Service Module (CSM) enabled. Computers that use a native UEFI firmware configuration store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for native UEFI firmware configurations" Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware.

          -
          -
          - -
          -

          If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.

          -

          If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the Setup script.

          Configure TPM platform validation profile

          Suggested configuration: Not Configured

          -

          This policy setting enables you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

          -

          If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.

          -

          If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.

          Configure TPM platform validation profile for native UEFI firmware configurations

          Suggested configuration: Not Configured

          -

          This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

          -
          -Important

          This Group Policy setting applies only to computers with a native UEFI firmware configuration.

          -
          -
          - -
          -

          If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.

          -

          If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.

          Reset platform validation data after BitLocker recovery

          Suggested configuration: Not Configured

          -

          Use this policy setting to control whether platform validation data is refreshed when Windows is started after BitLocker recovery.

          -

          If you enable this policy setting, platform validation data are refreshed when Windows is started after BitLocker recovery. If you disable this policy setting, platform validation data are not refreshed when Windows is started after BitLocker recovery. If you do not configure this policy setting, platform validation data are refreshed when Windows is started after BitLocker recovery.

          Use enhanced Boot Configuration Data validation profile

          Suggested configuration: Not Configured

          -

          This policy setting allows you to choose specific Boot Configuration Data (BCD) settings to verify during platform validation.

          -

          If you enable this policy setting, you can add additional settings, remove the default settings, or both. If you disable this policy setting, the computer reverts to a BCD profile similar to the default BCD profile that is used by Windows 7. If you do not configure this policy setting, the computer verifies the default Windows BCD settings.

          -
          -Note

          When BitLocker uses Secure Boot for platform and Boot Configuration Data (BCD) integrity validation, as defined by the "Allow Secure Boot for integrity validation" policy, the "Use enhanced Boot Configuration Data validation profile" policy is ignored.

          -
          -
          - -
          -

          The setting that controls boot debugging (0x16000010) is always validated and has no effect if it is included in the provided fields.

          Encryption Policy Enforcement Settings

          Suggested configuration: Enabled

          -

          Use this policy setting to configure the number of days that users can postpone complying with MBAM policies for their operating system drive. The grace period begins when the operating system is first detected as noncompliant. After this grace period expires, users cannot postpone the required action or request an exemption from it.

          -

          If the encryption process requires user input, a dialog box appears that users cannot close until they provide the required information.

          -

          If you disable or do not configure this setting, users are not forced to comply with MBAM policies.

          -

          If no user interaction is required to add a protector, encryption begins in the background after the grace period expires.

          Configure pre-boot recovery message and URL

          Suggested configuration: Not Configured

          -

          Enable this policy setting to configure a custom recovery message or to specify a URL that is then displayed on the pre-boot BitLocker recovery screen when the OS drive is locked. This setting is only available on client computers running Windows 10.

          -

          When this policy is enabled, you can select one of these options for the pre-boot recovery message:

          -
            -
          • Use custom recovery message: Select this option to include a custom message in the pre-boot BitLocker recovery screen. In the Custom recovery message option box, type the message that you want displayed. If you also want to specify a recovery URL, include it as part of your custom recovery message.

          • -
          • Use custom recovery URL: Select this option to replace the default URL that is displayed in the pre-boot BitLocker recovery screen. In the Custom recovery URL option box, type the URL that you want displayed.

          • -
          • Use default recovery message and URL: Select this option to display the default BitLocker recovery message and URL in the pre-boot BitLocker recovery screen. If you previously configured a custom recovery message or URL and want to revert to the default message, you must enable this policy and select the Use default recovery message and URL option.

          • -
          -
          -Note

          Not all characters and languages are supported in pre-boot. We recommend that you test that the characters you use for the custom message or URL appear correctly on the pre-boot BitLocker recovery screen.

          -
          -
          - -
          - - - -### Removable Drive Group Policy definitions - -This section describes Removable Drive Group Policy definitions for Microsoft BitLocker Administration and Monitoring at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Removable Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Policy nameOverview and suggested Group Policy settings

          Control use of BitLocker on removable drives

          Suggested configuration: Enabled

          -

          This policy controls the use of BitLocker on removable data drives.

          -

          Click Allow users to apply BitLocker protection on removable data drives to allow users to run the BitLocker setup wizard on a removable data drive.

          -

          Click Allow users to suspend and decrypt BitLocker on removable data drives to enable users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed.

          -

          When this policy is enabled, and you click Allow users to apply BitLocker protection on removable data drives, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server and allows users to recover the drive if the password is lost.

          Deny write access to removable drives not protected by BitLocker

          Suggested configuration: Not Configured

          -

          Enable this policy to allow only write permission to BitLocker-protected drives.

          -

          When this policy is enabled, all removable data drives on the computer require encryption before write permission is allowed.

          Allow access to BitLocker-protected removable drives from earlier versions of Windows

          Suggested configuration: Not Configured

          -

          Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          -

          When this policy is not configured, removable drives that are formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only permission to BitLocker-protected drives.

          -

          When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

          Configure use of password for removable data drives

          Suggested configuration: Not Configured

          -

          Enable this policy to configure password protection on removable data drives.

          -

          When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

          -

          For increased security, you can enable this policy and select Require password for removable data drive, click Require password complexity, and set the preferred minimum password length.

          Choose how BitLocker-protected removable drives can be recovered

          Suggested configuration: Not Configured

          -

          Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

          -

          When set to Not Configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS.

          -

          MBAM operation does not require recovery information to be backed up to AD DS.

          - - - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md deleted file mode 100644 index 7f91892a01..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md +++ /dev/null @@ -1,194 +0,0 @@ ---- -title: Planning for MBAM 2.5 Groups and Accounts -description: Planning for MBAM 2.5 Groups and Accounts -author: dansimp -ms.assetid: 73bb9fe5-5900-4b6f-b271-ade62991fca1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Planning for MBAM 2.5 Groups and Accounts - - -This topic lists the roles and accounts that you must create in Active Directory Domain Services (AD DS) to provide security and access rights for the Microsoft BitLocker Administration and Monitoring (MBAM) databases, reports, and web applications. For each role and account, the corresponding field in the MBAM Server Configuration wizard is provided. For a list of Windows PowerShell cmdlets and parameters that correspond to these accounts, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md#bkmk-reqd-posh-accts). - -**Note** -MBAM does not support the use of managed service accounts. - - - -## Database accounts - - -Create the following accounts for the Compliance and Audit Database and the Recovery Database. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Account name and purposeAccount typeMBAM Server Configuration wizard field that corresponds to this accountDescription of the MBAM Server Configuration wizard field that corresponds to this account

          Compliance and Audit Database and Recovery Database read/write user or group for reports

          User or Group

          Read/write access domain user or group

          Domain user or group that has read/write access to the Compliance and Audit Database and the Recovery Database to enable the web applications to access the data and reports in these databases.

          -

          If you enter a user name in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.

          -

          If you enter a group name in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.

          Compliance and Audit Database read-only user or group for reports

          User or Group

          Read-only access domain user or group

          Name of the user or group that will have read-only access to the Compliance and Audit Database to enable the reports to access the compliance and audit data in this database.

          -

          If you enter a user name in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page.

          -

          If you enter a group name in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field.

          - - - -## Reporting accounts - - -Create the following accounts for the Reports feature. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Account name/purposeAccount typeMBAM Server Configuration wizard field that corresponds to this accountDescription of the MBAM Server Configuration wizard field that corresponds to this account

          Reports read-only domain access group

          Group

          Reporting role domain group

          Specifies the domain user group that has read-only access to the reports in the Administration and Monitoring Website. The group you specify must be the same group you specified for the Reports Read Only Access Group parameter when the web apps are enabled.

          Compliance and Audit Database domain user account

          User

          Compliance and Audit Database domain account

          Domain user account and password that the local SQL Server Reporting Services instance uses to access the Compliance and Audit Database. This account requires Log On as Batch rights to the SQL Server Reporting Services server.

          -

          If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user name, you must enter that same value in this field.

          -

          If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a group name, the value that you enter in this field must be a member of that group.

          -

          Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group.

          - - - -## Administration and Monitoring Website (Help Desk) accounts - - -Create the following accounts for the Administration and Monitoring Website. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Account name/purposeAccount typeMBAM Server Configuration wizard field that corresponds to this accountDescription of the MBAM Server Configuration wizard field that corresponds to this account

          Web service application pool domain account

          User

          Web service application pool domain account

          Domain user account to be used by the application pool for the web applications.

          -

          If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field.

          -

          If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group.

          -

          If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used.

          -
          -Important

          For improved security, set the account that is specified in the credentials to have limited user rights.

          -
          -
          - -

          MBAM Advanced Helpdesk Users access group

          Group

          MBAM Advanced Helpdesk Users

          Domain user group whose members have access to all recovery areas of the Administration and Monitoring Website. Users who have this role have to enter only the recovery key, and not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions.

          MBAM Helpdesk Users access group

          Group

          MBAM Helpdesk Users

          Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. Individuals who have this role must fill-in all fields, including the end-user’s domain and account name, when they use either option.

          -

          If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions.

          MBAM Report Users access group

          Group

          MBAM Report Users

          Domain user group whose members have read-only access to the reports in the Reports area of the Administration and Monitoring Website.

          MBAM Data Migration User Group

          Group

          MBAM Data Migration Users

          Optional domain user group whose members have permissions to write data to MBAM by using the MBAM Recovery and Hardware Service running on the MBAM server. This account is generally used with the Write-Mbam* cmdlets to write recovery and TPM data from Active Directory into the MBAM database.

          -

          For more information, see MBAM 2.5 Security Considerations.

          - - - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md deleted file mode 100644 index 0a95efbd31..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Planning for MBAM 2.5 High Availability -description: Planning for MBAM 2.5 High Availability -author: dansimp -ms.assetid: 1e29b30c-33f1-4a52-9442-8c1391f0049c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for MBAM 2.5 High Availability - - -Microsoft BitLocker Administration and Monitoring (MBAM) can maintain high availability through use of one or more of the following technologies, which are described in the following sections: - -- [SQL Server AlwaysOn availability groups](#bkmk-alwayson) - -- [Microsoft SQL Server clustering](#bkmk-sql-clustering) - -- [IIS Network Load Balancing](#bkmk-load-balance) - -- [Database mirroring in SQL Server](#bkmk-db-mirroring) - -- [Backing up MBAM databases by using the Volume Shadow Copy Service (VSS)](#bkmk-vss) - -Use the information in the following sections to help you understand the options to deploy MBAM in a highly available configuration. - -## Support for SQL Server AlwaysOn availability groups - - -MBAM enables you to configure and manage availability groups for the databases in Microsoft SQL Server. An availability group for MBAM supports a failover environment where the Compliance and Audit Database and the Recovery Database fail over together rather than separately. - -An availability group supports a set of read/write primary databases and one to four sets of corresponding secondary databases. Optionally, secondary databases can be made available for read-only permission, some backup operations, or for both. - -For information about how to set up availability groups, see [AlwaysOn Availability Groups](https://go.microsoft.com/fwlink/?LinkId=393277). - -## Microsoft SQL Server clustering - - -You can run the MBAM 2.5 Compliance and Audit Database and the Recovery Database on computers that are running SQL Server clusters. - -## IIS Network Load Balancing - - -You can use Network Load Balancing to configure a highly available environment for computers that are running the Administration and Monitoring Website (also known as Help Desk), the Self-Service Portal, and the web services, which are deployed through Internet Information Services (IIS). - -### Prerequisites - -Before configuring load balancing, ensure that you have met the following prerequisites: - -- A load balancer must be available. You can use load balancers from Microsoft or another company. For more information about Microsoft load balancer technology, see [Build a Web Farm with IIS Servers](https://go.microsoft.com/fwlink/?LinkId=393326). - -- At least two servers are running IIS and have met all of the MBAM prerequisites to support its web features, including ASP.NET MVC 4. - -- MBAM databases and reports are running on a server. - -### MBAM-specific changes that are required to enable Load Balancing - -Complete the following tasks: - -1. Register a Service Principal Name (SPN) for the virtual host name under the domain account that you are using for the web application pools. For example, if the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\\mbamapppooluser, the following command registers the SPN appropriately. - - `Setspn -s http//mbamvirtual contoso\mbamapppooluser` - - `Setspn -s http//mbamvirtual.contoso.com contoso\mbamapppooluser` - -2. Configure the following MBAM web features: - - - On each server that will host the MBAM web features, use the same domain account for the application pool administrative credentials. - - - Specify a host name that matches the virtual host name (DNS name) of the Load Balancing cluster. For example, when you install MBAM on a server called "NLB1" with a virtual host name of **mbamvirtual.contoso.com**, ensure that the host name that you specify in the Windows PowerShell cmdlet is **mbamvirtual.contoso.com**. - -3. If you are configuring the websites in a web farm with a load balancer, you must configure the websites to use the same machine key. - - For more information, see the following sections in [machineKey Element (ASP.NET Settings Schema)](https://msdn.microsoft.com/library/vstudio/w8h3skw9.aspx): - - - Machine Key Explained - - - Web Farm Deployment Considerations - - For instructions about how to automatically generate a key, see [Generate a Machine Key (IIS 7)](https://technet.microsoft.com/library/cc772287.aspx). - -The information about Load Balancing also applies to IIS Network Load Balancing (NLB) clusters in Windows Server 2012 or Windows Server 2008 R2. The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are different in Windows Server 2012. For information about new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371). - -## Database mirroring in SQL Server - - -MBAM supports the use of SQL Server mirroring, where the Compliance and Audit Database and the Recovery Database are mirrored by using two instances of SQL Server for each database. Before implementing mirroring, be aware that mirroring is slowly being phased out, in favor of availability groups, which are discussed earlier in this topic. - -To implement mirroring for MBAM, you must specify the appropriate connection strings for the mirrored database configuration by using the **Enable-MbamWebApplication** Windows PowerShell cmdlet. For more information about the MBAM 2.5 Windows PowerShell cmdlets, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md). - -### Examples of implementing SQL Server mirroring by using Windows PowerShell - -The following examples show how you might implement SQL Server mirroring by using Windows PowerShell cmdlets. - -**Example 1** - -``` syntax -Enable-MbamWebApplication -AdministrationPortal -ComplianceAndAuditDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer;Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Compliance Status";' -RecoveryDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer;Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Recovery and Hardware";' -AdvancedHelpdeskAccessGroup “MyDomain\AdvancedUserGroup” -HelpdeskAccessGroup “MyDomain\StandardUserGroup” -ReportsReadOnlyAccessGroup "MyDomain\ReportUserGroup" -ReportUrl "https://MyReportServer/ReportServer" -Port 443 -WebServiceApplicationPoolCredential (Get-Credential) -Certificate (dir cert:\LocalMachine\My\E2A7EA5533890D6567E40DFC46F53B3D31D6B689) -``` - -**Example 2** - -``` syntax -Enable-MbamWebApplication -SelfServicePortal -ComplianceAndAuditDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer; Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Compliance Status";' -RecoveryDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer;I Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Recovery and Hardware";' -Port 443 -WebServiceApplicationPoolCredential (Get-Credential) -Certificate (dir cert:\LocalMachine\My\E2A7EA5533890D6567E40DFC46F53B3D31D6B689) -``` - -### More information about SQL Server mirroring - -The following links provide more information about configuring SQL Server mirroring: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=316375) - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=316377) - -## Backing up MBAM databases by using the Volume Shadow Copy Service (VSS) - - -MBAM provides a Volume Shadow Copy Service (VSS) writer, called the Microsoft BitLocker Administration and Management Writer. This VSS writer facilitates the backup of the Compliance and Audit Database and the Recovery Database. - -The VSS writer is registered on every server where you enable an MBAM web application. The MBAM VSS writer depends on the SQL Server VSS Writer, which is registered as part of the Microsoft SQL Server installation. Any backup technology that uses VSS writers to perform backup can discover the MBAM VSS writer. - - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md deleted file mode 100644 index 41ccde26df..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Planning for MBAM 2.5 Server Deployment -description: Planning for MBAM 2.5 Server Deployment -author: dansimp -ms.assetid: 88774c89-31c8-4eb8-a845-a00bbec8c870 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.5 Server Deployment - - -This topic lists the features that you deploy for the MBAM Stand-alone and Configuration Manager topologies and lists the order in which you need to deploy them. There is a recommended configuration for each topology. However, you can configure MBAM server databases and features in different configurations and across multiple servers, depending on your scalability requirements. - -## Important planning considerations for both topologies - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          ConsiderationsDetails or purpose

          Review the following before you start the deployment:

          -

          Each MBAM feature has specific prerequisites that must be met before you start the MBAM installation.

          BitLocker recovery keys in MBAM expire after a single use.

          A single use means that the recovery key has been retrieved through the Administration and Monitoring Website (also known as Help Desk), Self-Service Portal, or by using the Get-MbamBitLockerRecoveryKey Windows PowerShell cmdlet.

          Keep track of the names of the computers on which you configure each feature. You will use this information throughout the configuration process.

          You may want to use the MBAM 2.5 Deployment Checklist for this purpose.

          Configure only the Group Policy settings in the MDOP MBAM (BitLocker Management) node. Do not change the Group Policy settings in the BitLocker Drive Encryption node.

          If you change the Group Policy settings in the BitLocker Drive Encryption node, MBAM will not work.

          - - - -## Planning for MBAM Server deployment – Stand-alone topology - - -For the Stand-alone topology, a two-server configuration is recommended for production environments, although configurations of three to four servers can be used. - -The Server infrastructure for the MBAM Stand-alone topology contains the following features, which must be configured in the order listed: - -1. Databases (Compliance and Audit Database and Recovery Database) - -2. Reports - -3. Web applications (and their corresponding web services) - - - Administration and Monitoring Website - - - Self-Service Portal - -For a description of these features, see [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md). - -## Planning for MBAM Server deployment – Configuration Manager topology - - -For the Configuration Manager Integration topology, a three-server configuration is recommended for production environments, although configurations of additional servers can be used. - -The Server infrastructure for the MBAM Configuration Manager topology contains the following features, which must be configured or performed in the order listed: - -1. Databases (Compliance and Audit Database and Recovery Database) - -2. Reports - -3. Web applications (and their corresponding web services) - - - Administration and Monitoring Website - - - Self-Service Portal - -4. System Center Configuration Manager Integration - -For a description of these features, see [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). - - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25.md b/mdop/mbam-v25/planning-for-mbam-25.md deleted file mode 100644 index 5be4741f7c..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Planning for MBAM 2.5 -description: Planning for MBAM 2.5 -author: dansimp -ms.assetid: aebe82c0-e3b6-4bfb-beb0-b99f9c5c5267 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.5 - - -This topic lists the tasks, prerequisites, and requirements that you need to complete when you are planning to deploy Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Planning information - - -- [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - - This section describes the installation prerequisites, Group Policy settings, groups and accounts, and website security that are required before you deploy MBAM. - -- [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - This section describes the minimum hardware and software requirements for installing the MBAM Client and configuring the MBAM Server features, and describes the MBAM Server features to be deployed and the order in which to deploy them. It also explains how to configure a highly available environment and lists some security considerations to be aware of. - -- [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) - - This section provides a planning checklist that can assist you in MBAM deployment planning. - -## Other resources for planning for MBAM - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - - - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md deleted file mode 100644 index 56e258088e..0000000000 --- a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md +++ /dev/null @@ -1,336 +0,0 @@ ---- -title: Planning How to Secure the MBAM Websites -description: Planning How to Secure the MBAM Websites -author: dansimp -ms.assetid: aea1d137-62cf-4da4-9989-541e0b5ad8d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning How to Secure the MBAM Websites - - -This topic describes the following methods for securing the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Administration and Monitoring Website and Self-Service Portal: - - ---- - - - - - - - - - - - - - - - - -
          MethodRequired or optional?

          Using certificates to secure MBAM websites

          Optional, but highly recommended

          Registering Service Principal Names (SPN) for the application pool account

          Required

          - - - -For more information about how to secure your MBAM deployment, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md). - -## Using certificates to secure MBAM websites - - -We recommend that you use a certificate to secure the communication between the: - -- MBAM Client and the web services - -- Browser and the Administration and Monitoring Website and the Self-Service Portal websites - -For information about requesting and installing a certificate, see [Configuring Internet Server Certificates](https://technet.microsoft.com/library/cc731977.aspx). - -**Note** -You can configure the websites and web services on different servers only if you are using Windows PowerShell. If you use the MBAM Server Configuration wizard to configure the websites, you must configure the websites and the web services on the same server. - - - -To secure the communication between the web services and the databases, we also recommend that you force encryption in SQL Server. For information about securing all connections to SQL Server, including communication between the web services and SQL Server, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-secure-databases). - -## Registering SPNs for the application pool account - - -To enable the MBAM Servers to authenticate communication from the Administration and Monitoring Website and the Self-Service Portal, you must register a Service Principal Name (SPN) for the host name under the domain account that you are using for the web application pool. - -This topic contains instructions on how to register SPNs for the following types of host names: - -- Fully qualified domain name - -- NetBIOS name - -- Virtual name - -### Before you create SPNs for an initial MBAM installation - -Review the information in the following table before you start creating SPNs. - - ---- - - - - - - - - - - - - - - - - - - - - -
          Task or itemMore information

          Create a service account in Active Directory Domain Services (AD DS).

          The service account is a user account that you create in AD DS to provide security for the MBAM websites. The MBAM websites run under an application pool, whose identity is the name of the service account. The SPNs are then registered in the application pool account.

          -
          -Note

          You must use the same application pool account for all web servers.

          -
          -
          - -

          Verify that either the IIS-IUSRS group account or the application pool account has been granted the necessary rights.

          To check this, follow these steps:

          -
            -
          1. Open the Local Security Policy editor and expand the Local Policies node.

          2. -
          3. Select the User Rights Assignment node, and double-click the Impersonate a client after authentication and Log on as a batch job Group Policy settings in the right pane.

          4. -

          If you configure the MBAM websites by using a domain administrative account, MBAM will create the SPNs for you.

          If you configure the MBAM websites by using a domain administrative account, follow the steps in this topic to register SPNs manually for the type of host name that you are using.

          - - - -### Registering SPNs when you use a fully qualified domain host name - -If you use a fully qualified domain host name when you configure MBAM, you have to register only one SPN, as shown in the following example. - - ---- - - - - - - - - - - - - - - - - -
          What you need to doExamples and more information

          Register an SPN for the fully qualified domain name.

          Setspn -s http/mybitlockerrecovery.contoso.com contoso\mbamapppooluser

          -

          The fully qualified host name is mybitlockerrecovery.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

          Configure constrained delegation for the SPN that you are registering for the application pool account.

          Configuring Constrained Delegation

          -

          This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.

          - - - -### Registering SPNs when you use a NetBIOS host name - -If you use a NetBIOS host name when you configure MBAM, register one SPN for the NetBIOS name, and another SPN for the fully qualified domain name, as shown in the following examples. - - ---- - - - - - - - - - - - - - - - - - - - - -
          What you need to doExamples and more information

          Register an SPN for the NetBIOS host name.

          Setspn -s http/nbname01 contoso\mbamapppooluser

          -

          The NetBIOS host name is nbname01, and the domain account used for the web application pool is contoso\mbamapppooluser.

          Register an SPN for the fully qualified domain name.

          Setspn –s http/nbname01.corp.contoso.com contoso\mbamapppooluser

          -

          The fully qualified domain name is nbname01.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

          Configure constrained delegation for the SPNs that you are registering for the application pool account.

          Configuring Constrained Delegation

          -

          This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.

          - - - -### Registering SPNs when you use a virtual host name - -If you configure MBAM with a virtual host name that is a fully qualified domain name, register only one SPN for the virtual host name. If the virtual host name that you configure is not a fully qualified domain name, you must create a second SPN that specifies the fully qualified domain name, as described in the following examples. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          What you need to doExamples and more information

          If your virtual host name is a fully qualified domain name, as in this example, register only one SPN.

          Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser

          -

          In the example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

          Register this additional SPN if your virtual host name is not a fully qualified domain name.

          Setspn -s http/mbamvirtual contoso\mbamapppooluser

          -

          In the example, the virtual host name is mbamvirtual, and the domain account used for the web application pool is contoso\mbamapppooluser.

          Register this additional SPN if your virtual host name is not a fully qualified domain name.

          Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser

          -

          In the example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

          On the Domain Name Server (DNS) server, create an “A record” for the custom host name and point it to a web server or a load balancer.

          See the “To configure DNS Host A Records” section in Configure DNS Host Records.

          -

          We recommend that you use A records instead of CNAMES. If you use CNAMES to point to the domain address, you must also register SPNs for the web server name in the application pool account.

          Configure constrained delegation for the SPNs that you are registering for the application pool account.

          Configuring Constrained Delegation

          -

          This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.

          - - - -### Registering an SPN when you upgrade from previous versions of MBAM - -Complete the steps in this section only if you want to: - -- Upgrade from a previous version of MBAM. - -- Run the websites in MBAM 2.5 in a load-balanced or distributed configuration, and you are currently running in a configuration that is not load balanced. - -If you already registered SPNs on the machine account rather than in an application pool account, MBAM uses the existing SPNs, and you cannot configure the websites in a load-balanced or distributed configuration. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          What you need to doExamples and more information

          Create an application pool account in Active Directory Domain Services (AD DS).

          Remove the currently installed websites and web services.

          Removing MBAM Server Features or Software

          Remove SPNs from the machine account.

          Setspn –d http/mbamwebserver mbamwebserver

          -

          Setspn –d http/mbamwebserver.contoso.com mbamwebserver

          Register SPNs in the application pool account.

          Follow the steps for Registering SPNs when you use a virtual host name.

          Reconfigure the web applications and web services.

          How to Configure the MBAM 2.5 Web Applications

          Do one of the following, depending on the method you use for the configuration:

          - ---- - - - - - - - - - - - - - - - - -
          MethodDetails

          MBAM Server Configuration wizard

          Enter the application pool account in the Web service application pool domain account field.

          Enable-MbamWebApplication Windows PowerShell cmdlet

          Enter the account in the WebServiceApplicationPoolCredential parameter.

          -

          -Important

          The host name that you enter must be the same name as the virtual host name for which you are creating the SPNs. Also, in your web farm, the host names and the application pool credentials must be the same on every server that you are configuring.

          -
          -
          - -
          -

          When MBAM configures the web applications, it will try to register the SPNs for you, but it can do so only if you have Domain Admin rights on the server on which you are installing MBAM. If you do not have these rights, you can complete the configuration, but you will have to set the SPNs before or after you configure MBAM.

          - -## Required Request Filtering Settings - - 'Allow unlisted file name extensions' is required for the application to operate as expected. This can be found by navigating to the 'Microsoft BitLocker Administration and Monitoring' -> Request Filtering -> Edit Feature Settings. - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/planning-to-deploy-mbam-25.md b/mdop/mbam-v25/planning-to-deploy-mbam-25.md deleted file mode 100644 index e0e73d9033..0000000000 --- a/mdop/mbam-v25/planning-to-deploy-mbam-25.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Planning to Deploy MBAM 2.5 -description: Planning to Deploy MBAM 2.5 -author: dansimp -ms.assetid: 1343b80c-d87a-42e7-b912-e84ba997d7e3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy MBAM 2.5 - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft BitLocker Administration and Monitoring (MBAM). This section includes information that can help you gather the necessary information to formulate a deployment plan that best meets your business requirements. - -## Review the MBAM 2.5 supported configurations - - -After preparing your computing environment for the MBAM Server and Client feature deployment, make sure that you review the Supported Configurations to confirm that the computers on which you are installing MBAM meet the minimum hardware and operating system requirements. For more information about MBAM deployment prerequisites, see [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md). - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -## Plan for MBAM 2.5 Server and Client deployment - - -The MBAM Server infrastructure depends on a set of server features that can be configured on one or more server computers, based on the requirements of the enterprise. These features can be configured in a distributed configuration across multiple servers. - -**Note**   -An MBAM installation on a single server is recommended only for lab environments. - - - -The MBAM Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an enterprise software delivery system or by installing the Client on client computers as part of the initial imaging process. - -With MBAM, you can encrypt a computer in your organization either before the end user receives the computer, or afterwards by using Group Policy. - -[Planning for MBAM 2.5 Server Deployment](planning-for-mbam-25-server-deployment.md) - -[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) - -## Other resources for MBAM planning - - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md b/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md deleted file mode 100644 index bfc0fff5d3..0000000000 --- a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Preparing your Environment for MBAM 2.5 -description: Preparing your Environment for MBAM 2.5 -author: dansimp -ms.assetid: 7552ba08-9dbf-40cd-8920-203d733fd242 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing your Environment for MBAM 2.5 - - -Before beginning Microsoft BitLocker Administration and Monitoring (MBAM) Setup, you should make sure that you have met the prerequisites to install the product. When you know what the prerequisites are ahead of time, you can efficiently deploy the product and enable its features so that it most effectively supports your organization’s business objectives. - -If you are deploying Microsoft BitLocker Administration and Monitoring with Configuration Manager, ensure that you meet the additional requirements for Configuration Manager, which are listed later in this topic. - -## Review MBAM 2.5 deployment prerequisites - - -To ensure that your MBAM deployment is successful, make sure that you review and complete the required software prerequisites before you install the MBAM Client and configure the MBAM Server features. - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - -## Plan for MBAM 2.5 Group Policy requirements - - -Before MBAM can manage clients in the enterprise, you must download and configure Group Policy templates that are specific to MBAM, and then configure the Group Policy settings that you want for your environment. - -[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - -## Plan for MBAM 2.5 roles and accounts - - -As part of the prerequisites, you must define certain roles and accounts, which are used in MBAM to provide security and access rights to specific servers and features, such as the databases running on SQL Server and the web applications running on the Administration and Monitoring Server. - -[Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) - -## Other resources for MBAM planning - - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md deleted file mode 100644 index 2329a20a37..0000000000 --- a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Prerequisites for MBAM 2.5 Clients -description: Prerequisites for MBAM 2.5 Clients -author: dansimp -ms.assetid: fc230679-9c84-4b99-a77c-bae7e7bf8145 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/23/2017 ---- - - -# Prerequisites for MBAM 2.5 Clients - - -Before you install the MBAM Client software on end users' computers, ensure that your environment and the client computers meet the following prerequisites. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteDetails

          The enterprise domain must contain at least one Windows Server 2008 (or later) domain controller.

          The client computer must be logged on to the enterprise intranet.

          For Windows 7 client computers only: Each client must have Trusted Platform Module (TPM) capability (TPM 1.2 or later).

          For Windows 8.1, Windows 10 RTM or Windows 10 version 1511 client computers only: If you want MBAM to be able to store and manage the TPM recovery keys, TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM.

          -

          In MBAM 2.5 SP1 only, you no longer need to turn off TPM auto-provisioning, but you must make sure that the TPM Group Policy Objects are set to not escrow TPM OwnerAuth to Active Directory.

          MBAM 2.5 Security Considerations

          For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM.

          -

          In MBAM 2.5 SP1, you must turn on auto-provisioning.

          -

          See TPM owner password for further details. -

          The TPM chip must be turned on in the BIOS and be resettable from the operating system.

          See the BIOS documentation for more information.

          The computer’s hard disk must have at least two partitions and must be formatted with the NTFS file system.

          The computer’s hard disk must have a BIOS that is compatible with TPM and that supports USB devices during computer startup.

          -Note

          Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.

          -
          -
          - -

          If you use a proxy, it must be visible in the system context. MBAM runs under the system context, not the user context.

          - - - -**Important** -If BitLocker was used without MBAM, MBAM can be installed and utilize the existing TPM information. - - - - -## Related topics - - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md b/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md deleted file mode 100644 index f7ff13527a..0000000000 --- a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: Prerequisites for the Configuration Manager Integration Feature -description: Prerequisites for the Configuration Manager Integration Feature -author: dansimp -ms.assetid: b318cbd3-b009-44b8-991b-f7364c1cae88 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Prerequisites for the Configuration Manager Integration Feature - - -If you deploy MBAM with the System Center Configuration Manager Integration topology, we recommend a three-server architecture, as described in [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). This architecture can support 500,000 client computers. - -**Important** -Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007. - - - -## General prerequisites for the Configuration Manager Integration feature - - -When you install MBAM with Configuration Manager, the following additional prerequisites are required in addition to the prerequisites for the Stand-alone topology. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PrerequisiteAdditional information

          The Configuration Manager Server is a primary site in the Configuration Manager system.

          N/A

          The Hardware Inventory Client Agent is on the Configuration Manager Server.

          For System Center 2012 Configuration Manager, see How to Configure Hardware Inventory in Configuration Manager.

          -

          For Configuration Manager 2007, see How to Configure Hardware Inventory for a Site.

          One of the following is enabled, depending on the version of Configuration Manager that you are using:

          -
            -
          • Compliance Settings - (System Center 2012 Configuration Manager)

          • -
          • Desired Configuration Management (DCM) Client Agent – (Configuration Manager 2007)

          • -

          For System Center 2012 Configuration Manager, see Configuring Compliance Settings in Configuration Manager.

          -

          For Configuration Manager 2007, see Desired Configuration Management Client Agent Properties.

          A reporting services point is defined in Configuration Manager. Required for SQL Server Reporting Services (SSRS).

          For System Center 2012 Configuration Manager, see Prerequisites for Reporting in Configuration Manager.

          -

          For Configuration Manager 2007, see How to Create a Reporting Services Point for SQL Reporting Services.

          Configuration Manager 2007 requires Microsoft .NET Framework 2.0

          The Desired Configuration Management (DCM) Client Agent in Configuration Manager 2007 requires .NET Framework 2.0 to report compliance.

          -
          -Note

          Installing .NET Framework 3.5 automatically installs .NET Framework 2.0.

          -
          -
          - -
          - - - -## Required permissions to install MBAM with Configuration Manager - - -To install MBAM with Configuration Manager, you must have an administrative user in Configuration Manager who has a security role with the minimum permissions listed in the following table. The table also shows the rights that you must have, beyond basic computer administrator rights, to install the MBAM Server. - -**The permissions in the following table apply to both versions of Configuration Manager.** - - ---- - - - - - - - - - - - - - - - - -
          PermissionsMBAM Server feature

          SQL Server instance login server roles: - dbcreator- processadmin

          - Recovery Database- Audit Database

          SSRS instance rights: - Create Folders- Publish Reports

          - System Center Configuration Manager Integration

          - - - -**System Center 2012 Configuration Manager** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PermissionsConfiguration Manager Server feature

          Configuration Manager site rights:- Read

          System Center Configuration Manager Integration

          Configuration Manager collection rights: - Create- Delete- Read- Modify- Deploy Configuration Items

          System Center Configuration Manager Integration

          Configuration Manager configuration item rights: - Create- Delete- Read

          System Center Configuration Manager Integration

          - - - -**Configuration Manager 2007** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PermissionsConfiguration Manager Server feature

          Configuration Manager site rights:- Read

          System Center Configuration Manager Integration

          Configuration Manager collection rights: - Create- Delete- Read- ReadResource

          System Center Configuration Manager Integration

          Configuration Manager configuration item rights: - Create- Delete- Read- Distribute

          System Center Configuration Manager Integration

          - - - -## Required changes for the .mof files - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file and Sms\_def.mof file for System Center 2012 Configuration Manager and Microsoft System Center Configuration Manager 2007. For instructions, see [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md). - - - -## Related topics - - -[MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - -[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md deleted file mode 100644 index 3e71f9ec51..0000000000 --- a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: Release Notes for MBAM 2.5 SP1 -description: Release Notes for MBAM 2.5 SP1 -author: dansimp -ms.assetid: 3ac424c8-c490-4d62-aba4-1b462c02e962 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/06/2017 ---- - - -# Release Notes for MBAM 2.5 SP1 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1. These release notes contain information that is required to successfully install MBAM and can contain information that is not available in the product documentation. If these release notes differ from other MBAM 2.5 SP1 documentation, consider the latest change to be authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.5 SP1 known issues - - -This section contains release notes for MBAM 2.5 SP1. - -### PowerShell Read-AD\* cmdlets do not provide feedback if user does not have sufficient rights - -If a user trying to use the PowerShell Read-AD\* cmdlets for the MBAM Server does not have user rights to read the Active Directory recovery information or to read the TPM information, the cmdlets will not provide the user with any error or warning. - -**Workaround:** Only use the PowerShell Read-AD\* cmdlets if you have the required user rights. - -### MBAM Active Directory (AD) Migration cmdlets do not retrieve volume recovery information - -MBAM Active Directory (AD) Migration cmdlets fail to retrieve volume recovery information for computers in organizational units (OUs) if the forward slash character (/) is part of the OU name. Repeated AD pulls will fail with a pipeline terminating error when this error is encountered. - -**Technical Details:** You will see this error when running the command: - -``` syntax -Read-ADRecoveryInformation : Unknown error (0x80005000) -At line:1 char:1 -+ Read-ADRecoveryInformation -Server "…" -SearchBase " ... -+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - + CategoryInfo : NotSpecified: (:) [Read-ADRecoveryInformation], COMException - + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Microsoft.Mbam.Server.Commands.ADPullCommands.ReadADRecoveryInformationCommand -``` - -In addition, the Exception stack trace `Error[0].Exception.StackTrace` will look like this: - -``` syntax - at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) - at System.DirectoryServices.DirectoryEntry.Bind() - at System.DirectoryServices.DirectoryEntry.get_AdsObject() - at System.DirectoryServices.PropertyValueCollection.PopulateList() - at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName) - at System.DirectoryServices.PropertyCollection.get_Item(String propertyName) - at Microsoft.Mbam.Server.Commands.ADPullCommands.ReadCore.VerifySettingsConnectivity() - at Microsoft.Mbam.Server.Commands.ADPullCommands.ReadCore.ExecuteRead() - at Microsoft.Mbam.Server.Commands.ADPullCommands.ReadADInformationBase.ProcessRecord() - at System.Management.Automation.CommandProcessor.ProcessRecord() -``` - -**Workaround:** Perform one of these tasks to resolve this situation: - -- Rename the OU to remove the forward slash character and then run the script. - -- To exclude any problematic OU from the backup process, find a list of OUs whose names do not contain the forward slash character. Run the script on these OUs, one OU at a time. - -### MBAM fails to encrypt a volume and reports an error if you set a TPM + PIN protector on a tablet device - -If end users try to set a TPM + PIN protector on a tablet device, MBAM fails to encrypt, and it reports an error. This issue occurs because tablet devices do not have a pre-boot environment keyboard. - -**Workaround:** Enable the **Enable use of BitLocker authentication requiring preboot keyboard input on tablets** Group Policy setting. This setting is a BitLocker Group Policy setting and is not available in the MBAM Group Policy Templates. - -### User principal name is required for all service accounts - -A user principal name (UPN) must be set for all service accounts in MBAM. If you fail to create a UPN for an account, an error message appears during the configuration process to indicate that the user or group could not be found in Active Directory. - -**Workaround:** Add the UPN to the service account. - -### Self-Service Portal and the Administration and Monitoring Website do not open after you upgrade IIS to .NET Framework 4.5 - -When you upgrade Internet Information Services (IIS) to the Microsoft .NET Framework 4.5, the Self-Service Portal and the Administration and Monitoring Website do not open. - -**Workaround:** See the article [Error message after you install the .NET Framework 4.0: "Could not load type 'System.ServiceModel.Activation.HttpModule'](https://go.microsoft.com/fwlink/?LinkId=393568). - -### Administration and Monitoring Website displays a "Report cannot be found" error message when Reports are not configured - -If you configure the Administration and Monitoring Website and then try to view a report without configuring the Reports feature first, an error message indicates that the report cannot be found. - -**Workaround:** Configure the Reports feature before you configure the web applications. - -### Reports in the Administration and Monitoring Website display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the Reports feature will be set to HTTP instead of to HTTPS when you configure the MBAM Server. If you then open the Administration and Monitoring Website and select a report, the following error message appears: "Only Secure Content is Displayed." - -**Workaround:** To show the report, click **Show All Content**. To correct this issue, go to the MBAM computer where SQL Server Reporting Services is installed, run **Reporting Services Configuration Manager**, and then click **Web Service URL**. Select the appropriate SSL certificate for the server, enter the appropriate SSL port (the default port is 443), and then click **Apply**. - -### Clicking "Back" in the BitLocker Compliance Summary report might throw an error - -If you drill down into a BitLocker Compliance Summary report, and then click the **Back** link in the SSRS report, an error might be thrown. - -**Workaround:** None. - -### Cipher strength displays incorrectly on the BitLocker Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the BitLocker Computer Compliance report in the Configuration Manager Integration topology always displays "unknown" for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -**Workaround:** Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution By Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -**Workaround:** None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration might cause reports to display an error message incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an "Access Denied" error message might appear when you try to view reports on the MBAM Server. By default, ESC is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -**Workaround:** If the "Access Denied" error message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which ESC is not enabled. - -### Support for Bitlocker XTS-AES encryption algorithm -Bitlocker added support for the XTS-AES encryption algorithm in Windows 10, version 1511. With HF02, MBAM added client support for this Bitlocker option and in HF04, the server-side support was added. However, there is one known limitation: - -* Customers must use the same encryption strength for OS and data volumes on the same machine. -If different encryption strengths are used, MBAM will report the machine as **non-compliant**. - -### Self-Service Portal automatically adds "-" on Key ID entry -As of HF02, the MBAM Self-Service Portal automatically adds the '-' on Key ID entry. -**Note:** The Server has to be reconfigured for the Javascript to take effect. - -### MBAM 2.5 Sp1 Reports does not work / render properly -Reports Page does not render properly when SSRS is hosted on SQL Server 2016 edition.  -For example – Browsing to Helpdesk – Clicking on Reports –  ( Highlighted portion have “x”  on it ) -Digging this further with Fiddler – it does look like once we click on Reports – it calls the SSRS page with HTML 4.0 rendering format. - -**Workaround:** Looking at the site.master code and noticed the X-UA mode was dictated as IE8. As IE8 is WAY past the end of life, and customer is using IE11. Update the setting to the below code. This allows the site to utilize IE11 rendering technologies - - - -Original setting is: - - - - -This is the reason why the issue was not seen with other browsers like Chrome, Firefox etc. - - - -## Related topics - - -[About MBAM 2.5](about-mbam-25.md) - -  - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/release-notes-for-mbam-25.md b/mdop/mbam-v25/release-notes-for-mbam-25.md deleted file mode 100644 index ca65e45a7a..0000000000 --- a/mdop/mbam-v25/release-notes-for-mbam-25.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: Release Notes for MBAM 2.5 -description: Release Notes for MBAM 2.5 -author: dansimp -ms.assetid: fcaf03e6-5e39-4771-af3c-a3cd468f3961 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for MBAM 2.5 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. These release notes contain information that is required to successfully install MBAM and can contain information that is not available in the product documentation. If these release notes differ from other MBAM 2.5 documentation, consider the latest change to be authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.5 known issues - - -This section contains release notes for MBAM 2.5. - -### Web browser unintentionally run as administrator - -Help links in the MBAM Server Configuration tool can cause browser windows to open with administrator rights. - -**Workaround:** Enable Internet Explorer Enhanced Security Configuration (IESC) or close your web browser before navigating to other sites. - -**Note**   -This is fixed in MBAM 2.5 SP1. - - - -### MBAM reports as noncompliant a client encrypted with AES 256-bit encryption keys and Diffuser - -If a computer has the MBAM 2.5 client installed and is encrypted by using the AES 256-bit with Diffuser cipher strength, the MBAM client is reported as noncompliant in the MBAM compliance reports. - -**Workaround:** Install the hotfix at [KB2975636](https://go.microsoft.com/fwlink/?LinkId=511972). - -### MBAM fails to encrypt a volume and reports an error if you set a TPM + PIN protector on a tablet device - -If end users try to set a TPM + PIN protector on a tablet device, MBAM fails to encrypt, and it reports an error. This issue occurs because tablet devices do not have a pre-boot environment keyboard. - -**Workaround:** Enable the **Enable use of BitLocker authentication requiring preboot keyboard input on tablets** Group Policy setting. This setting is a BitLocker Group Policy setting and is not available in the MBAM Group Policy Templates. - -### User principal name is required for all service accounts - -A user principal name (UPN) must be set for all service accounts in MBAM. If you fail to create a UPN for an account, an error message appears during the configuration process to indicate that the user or group could not be found in Active Directory. - -**Workaround:** Add the UPN to the service account. - -### Self-Service Portal requires additional configuration if client computers cannot access Microsoft Ajax Content Delivery Network - -If your client computers do not have access to the Microsoft Ajax Content Delivery Network (CDN), which gives the Self-Service Portal the access that it requires to certain JavaScript files, you must configure the Self-Service Portal to reference the JavaScript files from an accessible source. If you don’t configure the Self-Service Portal when client computers cannot access CDN, only the company name and the account under which you logged on is displayed. No error message appears. - -**Workaround:** Install MBAM 2.5 SP1. or configure the Self-Service Portal by following these instructions: [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md). - -### Self-Service Portal and the Administration and Monitoring Website do not open after you upgrade IIS to .NET Framework 4.5 - -When you upgrade Internet Information Services (IIS) to the Microsoft .NET Framework 4.5, the Self-Service Portal and the Administration and Monitoring Website do not open. - -**Workaround:** See the article [Error message after you install the .NET Framework 4.0: "Could not load type 'System.ServiceModel.Activation.HttpModule'](https://go.microsoft.com/fwlink/?LinkId=393568). - -### Administration and Monitoring Website displays a "Report cannot be found" error message when Reports are not configured - -If you configure the Administration and Monitoring Website and then try to view a report without configuring the Reports feature first, an error message indicates that the report cannot be found. - -**Workaround:** Configure the Reports feature before you configure the web applications. - -### Reports in the Administration and Monitoring Website display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the Reports feature will be set to HTTP instead of to HTTPS when you configure the MBAM Server. If you then open the Administration and Monitoring Website and select a report, the following error message appears: "Only Secure Content is Displayed." - -**Workaround:** To show the report, click **Show All Content**. To correct this issue, go to the MBAM computer where SQL Server Reporting Services is installed, run **Reporting Services Configuration Manager**, and then click **Web Service URL**. Select the appropriate SSL certificate for the server, enter the appropriate SSL port (the default port is 443), and then click **Apply**. - -### Clicking "Back" in the BitLocker Compliance Summary report might throw an error - -If you drill down into a BitLocker Compliance Summary report, and then click the **Back** link in the SSRS report, an error might be thrown. - -**Workaround:** None. - -### Used Space Only Encryption does not work correctly - -If you encrypt a computer for the first time after you install the MBAM Client, and you have configured a Group Policy setting to implement Used Space Only encryption, MBAM erroneously encrypts the entire disk instead of encrypting only the disk’s used space. If a computer is already encrypted with Used Space Only when you install the MBAM Client, and you have configured the same Group Policy setting, MBAM reports that the drive is encrypted correctly, and does not try to re-encrypt the drive. - -**Workaround:** None. - -### Cipher strength displays incorrectly on the BitLocker Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the BitLocker Computer Compliance report in the Configuration Manager Integration topology always displays "unknown" for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -**Workaround:** Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution by Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -**Workaround:** None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration might cause reports to display an error message incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an "Access Denied" error message might appear when you try to view reports on the MBAM Server. By default, ESC is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -**Workaround:** If the "Access Denied" error message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which ESC is not enabled. - -## Hotfixes and Knowledge Base articles for MBAM 2.5 - - -This table lists the hotfixes and KB articles for MBAM 2.5. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KB ArticleTitleLink

          2975636

          Hotfix Package 1 for Microsoft BitLocker Administration and Monitoring 2.5

          support.microsoft.com/kb/2975636/EN-US

          3015477

          Hotfix Package 2 for BitLocker Administration and Monitoring 2.5

          support.microsoft.com/kb/3015477

          3011022

          MBAM 2.5 installation or Configuration Manager reporting fails if the name of SSRS instance contains an underscore

          support.microsoft.com/kb/3011022/EN-US

          2756402

          MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description

          support.microsoft.com/kb/2756402/EN-US

          2639518

          Error opening Enterprise or Computer Compliance Reports in MBAM

          support.microsoft.com/kb/2639518/EN-US

          2870842

          MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008

          support.microsoft.com/kb/2870842/EN-US

          2975472

          SQL deadlocks when many MBAM clients connect to the MBAM recovery database

          support.microsoft.com/kb/2975472/EN-US

          - - - - -## Related topics - - -[About MBAM 2.5](about-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/removing-mbam-server-features-or-software.md b/mdop/mbam-v25/removing-mbam-server-features-or-software.md deleted file mode 100644 index 640588cc30..0000000000 --- a/mdop/mbam-v25/removing-mbam-server-features-or-software.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Removing MBAM Server Features or Software -description: Removing MBAM Server Features or Software -author: dansimp -ms.assetid: 5212ba3f-124d-43c5-824a-608e9a192e86 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Removing MBAM Server Features or Software - - -These instructions explain how to remove software and features from Microsoft BitLocker Administration and Monitoring (MBAM). If you remove MBAM Server features, only the configured features are removed from the server, not the MBAM Server software. If you remove the MBAM Server software, the software and any MBAM Server features that you configured on that server are removed. - -**Note**   -To prevent the accidental removal of data, MBAM provides no mechanism for removing the databases; you must do that manually. - - - -## Removing MBAM Server features - - -You can use either of the following methods to remove MBAM Server features that you have configured: - -- MBAM Server Configuration wizard - -- Windows PowerShell cmdlets - -### Using the MBAM Server Configuration wizard to remove features - -Follow these instructions to use the MBAM Server Configuration wizard to remove configured MBAM Server features from a server. - -**To remove MBAM features by using the wizard** - -1. On the server where you want to remove features, select **MBAM Server Configuration** to open the configuration wizard. - -2. Click **Remove Features**, select the features to remove, and then click **Next**. A **Summary** page displays the features you selected for removal. - -3. Click **Remove** to start removing the features, and then click **Close**. - -### Using Windows PowerShell to remove features - -Use the following steps as a general guide to remove MBAM Server features by using Windows PowerShell cmdlets. - -**To remove MBAM features by using Windows PowerShell** - -1. Before removing any features, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the following cmdlets to remove MBAM Server features: - - - Disable-MbamReport - - - Disable-MbamWebApplication - - - Disable-MbamCMIntegration - - To get help with Windows PowerShell cmdlets, type **Get-Help** <*cmdlet*> or see the [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://go.microsoft.com/fwlink/?LinkId=393498) page for the MBAM Windows PowerShell cmdlets. - -## Removing MBAM Server software - - -Use the following steps to remove the MBAM Server software and any MBAM Server features that you configured on that server. - -**To remove the MBAM Server software** - -1. On the server where you want to uninstall the MBAM Server software, run **MBAMserversetup.exe** to start the Microsoft BitLocker Administration and Monitoring Setup wizard. - -2. Select **Uninstall**, and follow the remaining prompts to complete the process of uninstalling the MBAM Server software. - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/server-event-logs.md b/mdop/mbam-v25/server-event-logs.md deleted file mode 100644 index b02ad84d6d..0000000000 --- a/mdop/mbam-v25/server-event-logs.md +++ /dev/null @@ -1,683 +0,0 @@ ---- -title: Server Event Logs -description: Server Event Logs -author: dansimp -ms.assetid: 04e724d2-28cc-4fa8-86a1-0d4ab0234b11 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Event Logs - - -The tables in this section provide information about MBAM Server log event IDs. - -## Configuration - - -The following table contains messages and troubleshooting information for event IDs that can occur on the MBAM Server during configuration. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Event IDSourceEvent symbolMessageTroubleshooting

          103

          Microsoft-Windows-MBAM-Server/Operational

          VssRegistrationException

          An exception was thrown during VSS registration.

          104

          Microsoft-Windows-MBAM-Server/Operational

          VssDeregistrationException

          An exception was thrown during VSS deregistration.

          300

          Microsoft-Windows-MBAM-Server /Admin

          CmdletError

          Failed in removing folder.

          Indicates that a terminating error occurred while performing a task. Inspect other event messages in the log to further diagnose MBAM setup.

          301

          Microsoft-Windows-MBAM-Server /Admin

          cmdletUnexpectedError

          Unexpected Cmdlet error.

          302

          Microsoft-Windows-MBAM-Server /Admin

          CmdletWarning

          Cmdlet warning.

          303

          Microsoft-Windows-MBAM-Server/Operational

          CmdletInformation

          Cmdlet information.

          Informational only; no troubleshooting required. The event indicates that a task is taking place by the Cmdlets such as enabling\disabling a feature or cancelling an operation.

          400

          Microsoft-Windows-MBAM-Server /Admin

          ConfiguratorError

          Configurator error.

          Indicates that an error has occurred while launching the MBAM Configurator. Ensure that the user has adequate privileges to launch the MBAM Configurator.

          401

          Microsoft-Windows-MBAM-Server /Admin

          ConfiguratorUnexpectedError

          Unexpected Configurator error.

          Indicates that a terminating error has occurred while performing an MBAM Configurator task. The error message will contain more details about the error. Inspect other error messages in the event log to further diagnose MBAM setup. Known errors include:

          -
            -
          • Failure to retrieve or validate a Certificate that was selected by the user

          • -
          • Failure to parse the Reports URL

          • -
          • Failure to open Event Logs for the user

          • -

          402

          Microsoft-Windows-MBAM-Server /Admin

          ConfiguratorWarning

          Configurator warning.

          Indicates that an MBAM Configurator task is not complete as expected but did not fail completely. Known tasks include missing certificate in the LocalMachine\My store that was configured in the web application feature, or a timeout for a pending task.

          410

          Microsoft-Windows-MBAM-Server/Operational

          ConfiguratorInformation

          Configurator information.

          Informational only; no troubleshooting required. The event indicates that a task is being invoked by the MBAM Configurator. Known tasks include:

          -
            -
          • Launching the configurator

          • -
          • Checking software prerequisites for an MBAM feature

          • -
          • Validating parameters for an MBAM feature

          • -
          • Enabling\disabling\committing an MBAM feature

          • -
          • Generating a PowerShell script from the configurator

          • -

          500

          Microsoft_Windows_MBAM_Server_Admin

          WebProviderUnexpectedError

          Web application provider unexpected error.

          Indicates that an error has occurred while enabling and configuring an MBAM web site or web service in IIS. Known errors include:

          -
            -
          • Failure to find IIS WWW root folder

          • -
          • Failure to access IIS configuration in web.config due to malformed files or missing settings

          • -
          • Failure to create or remove a web application

          • -
          • IIS access violation

          • -
          -

          This error is also logged if MBAM cannot access Active Directory (AD) to validate user accounts. Verify that IIS is installed, correctly configured, and the IIS service is running. Verify that all the MBAM software prerequisite checks pass. Verify that the user has the correct permissions to create web applications on the IIS instance. Verify that the user has access to read user account objects in AD.

          501

          Microsoft-Windows-MBAM-Server /Admin

          WebProviderError

          Web application provider unexpected error.

          Indicates that an error has occurred while enabling, disabling, or configuring an MBAM web site or web service in IIS. Known errors include:

          -
            -
          • Failure to read basic or WSHttp binding information from IIS

          • -
          • Missing identity section or DNS entry in identity section in IIS config files

          • -
          • Failure to open registry key HKLM\SOFTWARE\Microsoft\InetStp

          • -
          • Failure to read value PathWWWRoot from registry key HKLM\SOFTWARE\Microsoft\InetStp

          • -
          • User is trying to specify a virtual directory name with a reserved name for MBAM

          • -
          -

          Verify that IIS is installed and correctly configured. Verify that the registry key HKLM\SOFTWARE\Microsoft\InetStp:PathWWWRoot exists and accessible. Verify that the binding information in IIS is not corrupt.

          502

          Microsoft-Windows-MBAM-Server /Admin

          WebProviderWarning

          Web application provider warning.

          Indicates that a non-terminating error has occurred while enabling an MBAM web site or web service. Known errors include:

          -
            -
          • Failure to access AD to validate the Service Principal Name (SPN) on the app pool account

          • -
          • Failure to validate SPN because it is assigned to multiple accounts in AD

          • -
          • Failure to register an SPN on the app pool account in AD

          • -
          • SPN is registered on an account other than the app pool in AD

          • -
          • Failure to remove SPN from the app pool account in AD during a rollback operation

          • -
          • Failure to check if the IIS_IUSRS group has been granted the logon as batch privilege on the IIS server

          • -
          -

          The event message will contain more information about the specific error. Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has read permissions on the app pool account in AD. If an SPN is already registered on the app pool account in AD then make sure that it is not registered on other accounts.

          503

          Microsoft-Windows-MBAM-Server/Operational

          WebProviderInformation

          Web application provider information. {Description}

          Informational only; no troubleshooting required. The event indicates that a task is being invoked by the MBAM Setup. Known tasks include getting IIS configuration such as binding information and root site, and configuring Service Principal Name (SPN).

          600

          Microsoft-Windows-MBAM-Server /Admin

          SetupUnexpectedError

          Unexpected setup error.

          Indicates that a terminating error has occurred while enabling\disabling or configuring an MBAM feature. Known errors include:

          -
            -
          • Failure to rollback a task after an error

          • -
          • Failure to read from the registry

          • -
          • Failure to create or delete a folder in the file system

          • -
          • Failure to read SQL version information

          • -
          • Failure to register VSS writer in SQL

          • -
          -

          The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Make sure the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has read permissions in AD.

          -

          For a successful VSS writer registration, verify that a supported version of SQL is installed and an instance is accessible to the user who is running the MBAM setup. If disabling an MBAM feature or uninstalling MBAM verify that all files such as log files and web.config files are closed so MBAM can remove its web sites and web services.

          601

          Microsoft-Windows-MBAM-Server /Admin

          SetupError

          Setup error.

          Indicates that a terminating error has occurred while enabling\disabling or configuring an MBAM feature. Known errors include:

          -
            -
          • Failure to read MBAM configuration in IIS

          • -
          • Corrupt appSettings section in IIS configuration or misconfigured settings

          • -
          • Failure to validate host name

          • -
          • Failure to read SQL version information

          • -
          • Failure to register VSS writer in SQL

          • -
          -

          The event message will contain more information about the specific error. Verify that IIS is installed and configured correctly. Verify that all MBAM software prerequisite checks pass. For a successful VSS writer registration, verify that a supported version of SQL is installed and an instance is accessible to the user who is running the MBAM setup.

          602

          Microsoft-Windows-MBAM-Server /Admin

          SetupWarning

          Setup warning.

          Indicates that a non-terminating error has occurred while enabling\disabling or configuring an MBAM feature such as Configuration Manager (CM) Integration or MBAM web application. Known errors include: failure to delete MBAM Reports from SRS Role point in the CM, and failure to resolve a host name from the domain controller. The event message will contain more information about the specific error.

          -

          Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has remove permissions on the SSRS instance that is configured as an SRS Role point in CM.

          603

          Microsoft-Windows-MBAM-Server/Operational

          SetupInformation

          Setup information.

          Informational only; no troubleshooting required.

          605

          Microsoft-Windows-MBAM-Server /Admin

          WebProviderSoftwareCheckFailure

          Web application cannot be enabled because one or more software dependencies are not being met.

          During MBAM web site/web service installation, MBAM setup verifies if necessary prerequisites are in place. This message indicates that MBAM failed to install the requested web site/web service as the necessary prerequisite is missing. Refer to error messages preceding this message to get more information about missing prerequisites.

          606

          Microsoft-Windows-MBAM-Server /Admin

          SetupParameterValidationFailure

          The parameter that is needed to enable the server feature was either not specified or it did not pass the validation.

          Indicates that the parameter that is needed to configure an MBAM feature was either not specified or it did not pass the validation.

          607

          Microsoft-Windows-MBAM-Server /Admin

          SetupParameterValidationFailureWithError

          Error encountered while trying to validate specified parameter that is needed to enable the server feature.

          Indicates that an error was encountered while trying to validate specified parameter that is needed to enable the server feature.

          700

          Microsoft-Windows-MBAM-Server /Admin

          DbProviderUnexpectedError

          DB provider unexpected error.

          701

          Microsoft-Windows-MBAM-Server /Admin

          DbProviderError

          DB provider error.

          The message contained in the EventDetails section should provide more information about actual error. These are some of the areas to verify:

          -
            -
          • MBAM Setup failed to connect to Database using the provided connection information. Verify the connection string details provided to MBAM setup.

          • -
          • MBAM Setup could not connect to the given database using the supplied domain account credentials. Verify that domain account user name and password are valid.

          • -
          • MBAM Setup could not connect to the given database using the supplied domain account credentials. Verify that the provided domain account has necessary permissions in place to connect to MBAM database.

          • -
          • MBAM Dac pac will fail if a newer version of MBAM database is already installed. Verify that a new version of MBAM DBs does not exist on the given SQL server.

          • -

          702

          Microsoft-Windows-MBAM-Server /Admin

          DbProviderWarning

          DB provider warning.

          703

          Microsoft-Windows-MBAM-Server/Operational

          DbProviderInformation

          DB provider information.

          Informational only; no troubleshooting required.

          704

          Microsoft-Windows-MBAM-Server /Admin

          DbProviderDacError

          An error occurred while deploying the Data-Tier Application.

          MBAM packages its databases as data tier applications and tries to register them using Microsoft.SqlServer.Dac.DacServices. The error message in context is reported by DAC service. The event should contain detailed information about what caused it. Read the information in the error message to troubleshoot and fix the issue.

          705

          Microsoft-Windows-MBAM-Server /Admin

          DbProviderDacWarning

          A warning occurred while deploying the Data-Tier Application.

          MBAM packages its databases as data tier application and tries to register them using Microsoft.SqlServer.Dac.DacServices. The warning message in context is reported by DAC service. The event should contain detailed information about what caused it. Read the information in the warning message to troubleshoot and fix the issue.

          706

          Microsoft-Windows-MBAM-Server/Operational

          DbProviderDacInformation

          A message was raised while deploying the Data-Tier Application.

          Informational only; no troubleshooting required.

          800

          Microsoft-Windows-MBAM-Server /Admin

          ReportProviderUnexpectedError

          Report provider unexpected error.

          Report provider unexpected error. {Description} {exceptionDetails} These are some of the possible exception details:

          -

          An error occurred while getting the name of directory '{directoryName}'

          -

          An exception occurred while getting files for directory '{directoryName}'

          -

          An exception occurred while enumerating directories in directory '{directoryName}'

          -

          An exception occurred while reading all bytes for file '{fileName}'

          -

          During MBAM installation, MBAM setup unzips all the report files to the specified installation path. As a part of report installation, install module tries to access the unzipped report files at installation path and communicates with SQL Reporting services to publish the report files. The above errors occur when MBAM cannot access the files/folders at unzipped Installation path. These are some tips to troubleshoot this issue:

          -
            -
          • Verify that MBAM is installed.

          • -
          • Verify that regkey HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\InstallationPath is present and accessible to the executing user.

          • -
          • Verify that Path to Report files under MBAM InstallationPath does not exceed 248 characters.

          • -
          • Verify that MBAM Setup folder or the files contained in MBAM Installation path has not been modified since installation.

          • -
          • Verify that user running the setup is authorized to read from/write to MBAM Installation folder.

          • -
          -

          Reporting Services connectivity failed.{exceptionDetails}

          -

          During MBAM reports installation, modules tries to communicate with SSRS web services to create folders and publish reports. The above message indicates that MBAM could not find or communicate with SSRS web services. These are some tips to troubleshoot this issue:

          -
            -
          • Verify that SSRS is installed on the specified machine.

          • -
          • Using SSRS console verify that SSRS is enabled and running.

          • -
          • Verify that user running the setup is authorized to access SSRS.

          • -
          -

          Failed to remove the MBAM Reports using Reporting Services instance URL '{SSRSInstanceUrl}'.Make sure the SSRS instance required for MBAM Reports is running and configured correctly.

          -

          When MBAM installation fails or When user disables MBAM Reporting features, setup module removes SSRS reports. The above message indicates that MBAM failed to remove SSRS reports. These are some tips to troubleshoot this issue:

          -
            -
          • Verify that SSRS is installed on the specified machine.

          • -
          • Using SSRS console verify that SSRS is enabled and running.

          • -
          • Verify that the user running the setup is authorized to access SSRS.

          • -
          -

          An error occurred while publishing reports.{exceptionDetails}.

          -

          During MBAM reports installation, modules tries to communicate with SSRS web services to create folders and publish reports. The above message indicates that SSRS web service reported and exception while publishing reports. These are some tips to troubleshoot this issue:

          -
            -
          • Using SSRS console verify that SSRS is enabled and running.

          • -
          • Verify that the user running the setup is authorized to access/publish reports to SSRS.

          • -
          -

          A policy for group user name '{userName}' already exists. In case this is not correct, manually revise the Reporting Service for duplicate or invalid policies.

          -

          After Publishing MBAM reports, MBAM setup tries to create a MBAM Report Users roles (if it does not exist already) and sets corresponding user policy. The above error indicates that SSRS web service threw an exception while setting up report user role policy. Follow the instructions in the event message and refer to "https://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=SQL+Server+Reporting+Services&ProdVer=8.00&EvtID=rsInvalidPolicyDefinition&EvtSrc=Microsoft.ReportingServices.Diagnostics.ErrorStrings.resources.Strings&LCID=1033"; for more help.

          -

          An error occurred while validating access to SSRS {exceptionDetails}.

          -

          As part of prerequisite check, MBAM setup verifies if the user has necessary permissions to access/create folder under SSRS. The error message indicates that an exception has occurred while verifying access to SSRS. Refer to the exception details for debugging tips.

          -

          A SOAP error occurred while checking the SSRS URL.{exceptionDetails}

          -

          A web error occurred while checking the SSRS URL.{exceptionDetails}

          -

          An http/https error occurred while checking the SSRS URL.{exceptionDetails}

          -

          An error occurred while checking the SSRS URL.{exceptionDetails}

          -

          As part of prerequisite check, MBAM setup retrieves URLs associated with the supplied SSRS instance and tries to communicate with SSRS web service. The above error message indicates that SSRS web service at the given URL threw an exception, Refer to exception details for more information. These are some tips to resolve SSRS communication issues.

          -
            -
          • Verify that SSRS is installed on the specified machine.

          • -
          • Using SSRS console verify that SSRS is enabled and running.

          • -
          • Verify that the user running the setup is authorized to access SSRS.

          • -
          -

          An error occurred while retrieving the SSRS version. {exceptionDetails}

          -

          As part of prerequisite check, MBAM setup queries WMI to retrieve the version number associated to the supplied SSRS instance. The above error message indicates that an exception occurred while querying WMI. Refer to exceptionDetails for more information. These are some checks you can perform:

          -
            -
          • Verify that SSRS with given instance name is installed on the specified machine.

          • -
          • Using SSRS console verify that SSRS is enabled and running.

          • -
          • Verify that the user executing the setup is authorized to query SSRS class under WMI namespace.

          • -
          -

          The current user is not authorized to access the WMI namespace '{ssrsWMINamespace}'.

          -

          An error occurred while enumerating the namespace '{ssrsWMINamespace}'. RPC server for SSRS WMI provider on the local host is not found.

          -

          An error occurred while enumerating the namespace '{ssrsNamespace}'. Unable to find an instance of SSRS on the local host.

          -

          An error occurred while accessing WMI. RPC server for instance '{ssrsInstance}' was not found.

          -

          An error occurred while accessing WMI. Instance name '{ssrsInstanceName}' is not correct.

          -

          An error occurred while accessing WMI. Unable to find instance '{ssrsInstanceName}' on the local host.

          -

          As part of prerequisite check, MBAM setup queries WMI to retrieve WMI namespace associated to given instance. The above error message indicates that and exception was occurred while querying WMI. Refer to exceptionDetails for more information. These are some checks you can perform:

          -
            -
          • Verify that SSRS with given instance name is installed on the specified machine.

          • -
          • Using SSRS console verify that SSRS is enabled and running.

          • -
          • Verify that the user running the setup is authorized to access/query SSRS class under WMI namespace.

          • -

          801

          Microsoft-Windows-MBAM-Server /Admin

          ReportProviderError

          Report provider unexpected error.

          Given the SQL server reporting services instance name, MBAM tries to find the WMI namespace corresponding to the reporting instance and connect to it. This error occurs if MBAM encounters an exception when MBAM searches for or tries to connect to SSRS WMI namespace. Read the information in the error messages logged in the MBAM setup channel before this message to get more details. Here are some things you can check:

          -
            -
          • Verify that SSRS with supplied instance name is up and running

          • -
          • Verify that the user account running MBAM installation has necessary permissions to query/connect to SSRS WMI namespace

          • -

          802

          Microsoft-Windows-MBAM-Server /Admin

          ReportProviderWarning

          Report provider warning.

          803

          Microsoft-Windows-MBAM-Server/Operational

          ReportProviderInformation

          Report provider information.

          Informational only; no troubleshooting required.

          900

          Microsoft-Windows-MBAM-Server /Admin

          CMProviderUnexpectedError

          CM provider unexpected error.

          Indicates that a terminating error has occurred while enabling\disabling or configuring the Configuration Manager (CM) Integration feature in MBAM. Known errors include:

          -
            -
          • Failure to connect to the CM site server via the SMS Provider

          • -
          • Failure to read from the registry

          • -
          • Failure to create or delete a folder in the file system

          • -
          • Failure to locate the Configuration Manager Console installation on the local machine

          • -
          • Failure to retrieve information for the SSRS instance that is configured as an SRS Role point in CM

          • -
          -

          The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Verify that the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that MBAM is being integrated with a supported version of Configuration Manager. Verify that the Configuration Manager Console is installed on the machine where the MBAM setup is being invoked and that the console can be used to connect to the target CM Site Server. Verify that a valid SSRS instance is configured as an SRS Role point in CM and that the user who is running the MBAM setup has read\write permissions on the SSRS instance.

          901

          Microsoft-Windows-MBAM-Server /Admin

          CMProviderError

          CM provider unexpected error.

          Indicates that a terminating error has occurred while enabling\disabling or configuring the Configuration Manager (CM) Integration feature in MBAM. Known errors include:

          -
            -
          • failure to connect to the CM Site Server via the SMS Provider

          • -
          • failure to read from the registry

          • -
          • failure to create or delete a folder in the file system

          • -
          • failure to locate the Configuration Manager Console installation on the local machine

          • -
          • missing ConfigMgr folder in SSRS as the root folder for the SRS Role point reports

          • -
          • missing ConfigMgr shared data source in SSRS

          • -
          • failure to deploy SSRS reports in the SSRS instance that is configured as an SRS Role point in CM

          • -
          • failure to create Configuration Items and baselines in CM

          • -
          -

          The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Verify that the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that MBAM is being integrated with a supported version of Configuration Manager. Verify that the Configuration Manager Console is installed on the machine where the MBAM setup is being invoked and that the console can be used to connect to the target CM Site Server. Verify that the user has the required read\write permissions to create Configuration Items, Baselines, and Collections in CM. Verify that a valid SSRS instance is configured as an SRS Role point in CM and that the user who is running the MBAM setup has read\write permissions on the SSRS instance.

          902

          Microsoft_Windows_MBAM_Server_Admin

          CMProviderWarning

          CM provider warning.

          Indicates that a non-terminating error has occurred while enabling the Configuration Manager (CM) Integration feature. Known errors include: failure to commit collection rules in the MBAM Supported Computers collection in CM, and other SSRS and network related errors.

          -

          The event message will contain more information about the specific error. Some operations that caused this warning are retired after the warning. If after several retries the error persists, then MBAM might end with an actual error. Inspect other event messages in the log to further diagnose MBAM setup.

          903

          Microsoft-Windows-MBAM-Server/Operational

          CMProviderInformation

          CM provider information.

          Informational only; no troubleshooting required.

          - - - -## Operation - - -The following table contains messages and troubleshooting information for event IDs that can occur while MBAM is running. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Event IDSourceEvent SymbolMessageTroubleshooting

          1

          Microsoft-Windows-MBAM-Web/Admin

          WebAppSpnError

          Application: {SiteName}{VirtualDirectory} is missing the following Service Principal Names (SPNs):{ListOfSpns} Register the required SPNs on the account: {ExecutionAccount}.

          For Integrated Windows Authentication to succeed, necessary SPNs needs to be in place. This message indicates that the SPN required for MBAM application has not been correctly configured. Details contained in this event should provide more information.

          -

          See “Service Principal Name (SPN)” in MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies for more information.

          4

          Microsoft-Windows-MBAM-Web/Operational

          PerformanceCounterError

          An error occurred while retrieving a performance counter.

          -

          Message:{EventMessage}Category:{CategoryOfPerformanceCounter} Performance Counter:{NameOfPerformanceCounter} Instance:{Name of performance counter category instance} Exception:{ExceptionThrown}

          -

          Trace message will contain the actual exception message, some of which are explained here:

          -

          ArgumentNullException: This exception is thrown if the category, counter or instance of requested Performance counter is invalid.

          -

          System.InvalidOperationException: categoryName is an empty string ("").-or- counterName is an empty string("").

          -

          -or- The read/write permission setting requested is invalid for this counter.

          -

          -or- The category specified does not exist (if readOnly is true).

          -

          -or- The category specified is not a .NET Framework custom category (if readOnly is false).

          -

          -or-The category specified is marked as multi-instance and requires the performance counter to be created with an instance name.

          -

          -or-instanceName is longer than 127 characters.

          -

          -or-categoryName and counterName have been localized into different languages.

          -

          System.ComponentModel.Win32Exception: An error occurred when accessing a system API.

          -

          System.PlatformNotSupportedException: The platform is Windows 98 or Windows Millennium Edition (ME), which does not support performance counters.

          -

          System.UnauthorizedAccessException: Code that is executing without administrative privileges attempted to read a performance counter.

          The message contained in the event will provide more details around the exception that was thrown. If a System.UnauthorizedAccessException was thrown, verify that MBAM execution account (app pool) has access to performance counter APIs.

          100

          Microsoft-Windows-MBAM-Web/Admin

          AdminServiceRecoveryDbError

          GetMachineUsers: An error occurred while getting user information from the database. Message:{message} -or-

          -

          GetRecoveryKey: an error occurred while getting recovery key from the database. Message:{message} -or-

          -

          GetRecoveryKey: an error occurred while getting user information from the database. Message:{message} -or-

          -

          GetRecoveryKeyIds: an error occurred while getting recovery key Ids from the database. Message:{message} -or-

          -

          GetTpmHashForUser: An error occurred while getting TPM hash data from the recovery database. Message:{message} -or-

          -

          GetTpmHashForUser: An error occurred while getting TPM hash data from the recovery database. Message:{message}-or-

          -

          QueryDriveRecoveryData: An error occurred while getting drive recovery data from the database. Message:{message}-or-

          -

          QueryRecoveryKeyIdsForUser: An error occurred while getting recovery key Ids from the database. Message:{message} -or-

          -

          QueryVolumeUsers: An error occurred while getting user information from the database.

          This message is logged whenever there is an exception while communicating with the MBAM recovery database. Read through the information contained in the trace to get specific details about the exception.

          -

          For detailed troubleshooting steps, see the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine.

          101

          Microsoft-Windows-MBAM-Web/Admin

          AdminServiceComplianceDbError

          GetRecoveryKey: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

          -

          GetRecoveryKeyIds: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

          -

          GetTpmHashForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

          -

          QueryRecoveryKeyIdsForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

          -

          QueryDriveRecoveryData: An error occurred while logging an audit event to the compliance database. Message:{message}

          This message is logged whenever there is an exception while communicating the MBAM compliance database. Read through the information contained in the trace to get specific details about the exception.

          -

          For detailed troubleshooting steps, see the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine.

          102

          Microsoft-Windows-MBAM-Web/Admin

          AgentServiceRecoveryDbError

          This message indicates an exception when MBAM Agent service tries to communicate with the recovery database. Read through the message contained in the event to get specific information about the exception.

          -

          See the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether the MBAM app pool account has required permissions in place to connect or execute on MBAM recovery database.

          103

          Microsoft-Windows-MBAM-Web/Admin

          AgentServiceError

          Unable to detect client machine account or data migration user account. -or-

          -

          Account verification failed for caller identity.

          Whenever a call is made to the "PostKeyRecoveryInfo", "IsRecoveryKeyResetRequired", "CommitRecoveryKeyRest", or "GetTpmHash" web methods on MBAM Agent services, it retrieves the caller context to obtain caller credentials. If the caller context is null or empty, the MBAM Agent service logs "Unable to detect client machine account or data migration user account."

          -

          The message "Account verification failed for caller identity " is logged if the web method is expecting the caller to a be computer account and the caller is not a computer account, or if the web method is excepting the caller to be a user account and the caller is not a user account or member of data migration group account.

          104

          Microsoft-Windows-MBAM-Web/Admin

          StatusServiceComplianceDbConfigError

          "The Compliance database connection string in the registry is empty."

          This message is logged whenever the compliance db connection string is invalid.

          -

          Verify the value at the registry key HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString

          105

          Microsoft-Windows-MBAM-Web/Admin

          StatusServiceComplianceDbError

          This error indicates that MBAM websites/web services were unable to connect to the MBAMCompliance database.

          -

          See the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify that the IIS app pool account could connect to the MBAM compliance database.

          106

          Microsoft-Windows-MBAM-Web/Admin

          HelpdeskError

          The request to URL {url} caused an internal error. -or-

          -

          An error occurred while obtaining execution context information. Unable to verify Service Principal Name (SPN) registration. -or-

          -

          An error occurred while verifying Service Principal Name (SPN) registration.

          Indicates that an unhandled exception has been raised in Helpdesk application. Review the log entries in the MBAM Admin operational channel to find the specific exception. –or-

          -

          During the initial Helpdesk website load operation, an SPN check is performed. To verify SPN, the Helpdesk requires execution account information, IIS Sitename, and ApplicationVirtualPath corresponding to Helpdesk website. This error message is logged when one or more of these is invalid or missing. –or-

          -

          This message indicates that a security exception is thrown while performing SPN verification. Refer to the exception contained in event details section.

          107

          Microsoft-Windows-MBAM-Web/Admin

          SelfServicePortalError

          An error occurred while getting recovery key for a user. EventDetails:{ExceptionMessage} -or-

          -

          An error occurred while obtaining execution context information. Unable to verify Service Principal Name (SPN) registration. EventDetails: User: {username Identity} Application:{SiteName\ApplicationVirtualPath} -or-

          -

          An error occurred while verifying Service Principal Name (SPN) registration. EventDetails:{ExceptionMessage}

          Indicates that an unexpected exception was thrown when a request was made to retrieve recovery key. Refer to the exception message contained in event details section. If tracing is enabled on MBAM Helpdesk, refer to trace data to obtain detailed exception messages. –or-

          -

          During an initial load operation, the Self-Service Portal (SSP) retrieves execution account information, IIS Sitename, and ApplicationVirtualPath corresponding to the Self-Service website to verify SPN. This error message is logged when one or more of these is invalid. –or-

          -

          This message indicates that a security exception was thrown while performing SPN verification. Refer to the exception contained in event details section.

          108

          Microsoft-Windows-MBAM-Web/Admin

          DomainControllerError

          An error occurred while resolving domain name {DomainName}, A memory allocation failure occurred. -or-

          -

          Could not invoke DsGetDcName method. EventDetails:{ExceptionMessage}

          To resolve Domain name, MBAM leverages "DsGetDcName" windows API. This message is logged when "DsGetDcName" returns "ERROR_NOT_ENOUGH_MEMORY" indicating a memory allocation failure. –or-

          -

          This message indicates that "DsGetDcName" API method is unavailable on the hosting system.

          109

          Microsoft-Windows-MBAM-Web/Admin

          WebAppRecoveryDbError

          An error occurred while reading the configuration of the Recovery database. The connection string to the Recovery database is not configured. Message:{message} -or-

          -

          DoesUserHaveMatchingRecoveryKey: an error occurred while getting recovery key Ids for a user. Message:{message} -or-

          -

          QueryDriveRecoveryData: an error occurred while getting drive recovery data. Message:{message} -or-

          -

          QueryRecoveryKeyIdsForUser: an error occurred while getting recovery key Ids for a user. Message:{message} -or-

          -

          An error occurred while getting TPM password hash from the Recovery database. EventDetails:{ExceptionMessage}

          This message indicates that recovery database connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\RecoveryDBConnectionString" is invalid. Verify the given registry key value. –or-

          -

          If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether a connection could be made to the MBAM Recovery database from IIS server using app pool credentials.

          110

          Microsoft-Windows-MBAM-Web/Admin

          WebAppComplianceDbError

          An error occurred while reading the configuration of the Compliance database. The connection string to the Compliance database is not configured. -or-

          -

          GetRecoveryKeyForCurrentUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or-

          -

          QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or-

          -

          QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the compliance database. Message:{message}

          This message indicates that compliance db connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString" is invalid. Verify the value corresponding to above registry key. –or-

          -

          If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether a connection could be made to the MBAM Compliance database from IIS server using app pool credentials.

          111

          Microsoft-Windows-MBAM-Web/Admin

          WebAppDbError

          These errors indicate one of the following two conditions

          -
            -
          • MBAM websites/webservices were unable to either connect to MBAMCompliance OR MBAMRecovery database

          • -
          • MBAM websites/webservices execution account(app pool account) could not run the GetVersion stored procedure on MBAMCompliance OR MBAMRecovery database

          • -
          -

          The message contained in the event will provide more details about the exception.

          -

          Refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify that the MBAM execution account (app pool account) could connect to MBAM compliance/recovery database and it has permissions in place to execute GetVersion stored procedure.

          112

          Microsoft-Windows-MBAM-Web/Admin

          WebAppError

          An error occurred while verifying Service Principal Name (SPN) registration. EventDetails:{ExceptionMessage}

          To perform SPN verification, MBAM queries Active Directory to retrieve a list of SPNs mapped execution account. MBAM also queries the "ApplicationHost.config" to obtain MBAM website bindings. This error message indicates that MBAM could not communicate with Active Directory or it could not load the applicationHost.config file.

          -

          Verify that the execution account (app pool account) has permissions to query AD or the ApplicationHost.config file. Also verify the site binding entries in ApplicationHost.config file.

          200

          Microsoft-Windows-MBAM-Web/Operational

          HelpDeskInformation

          The administration website application successfully found and connected to a supported version of the Recovery database. -or-

          -

          The administration website application successfully found and connected to a supported version of the Compliance database.

          Indicates successful connection to the Recovery/Compliance database from the MBAM Helpdesk website.

          201

          Microsoft-Windows-MBAM-Web/Operational

          SelfServicePortalInformation

          The Self-Service Portal application successfully found and connected to a supported version of the Recovery database. -or-

          -

          The Self-Service Portal application successfully found and connected to a supported version of the Compliance database.

          Indicates successful connection to the Recovery/Compliance database from the MBAM Self-Service Portal.

          202

          Microsoft-Windows-MBAM-Web/Operational

          WebAppInformation

          Application has its SPNs registered correctly.

          Indicates that the SPNs required for the MBAM Helpdesk website are correctly registered against the executing account.

          - - - - -## Related topics - - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Client Event Logs](client-event-logs.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/technical-reference-for-mbam-25.md b/mdop/mbam-v25/technical-reference-for-mbam-25.md deleted file mode 100644 index a8b62bb56d..0000000000 --- a/mdop/mbam-v25/technical-reference-for-mbam-25.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Technical Reference for MBAM 2.5 -description: Technical Reference for MBAM 2.5 -author: dansimp -ms.assetid: da77a5b6-d5cf-4bae-9475-13a75088ab23 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for MBAM 2.5 - - -This section includes technical information about features in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Technical reference information - - -- [Client Event Logs](client-event-logs.md) - - This topic provides a list of Client events for MBAM. - -- [Server Event Logs](server-event-logs.md) - - This topic provides a list of Server events for MBAM. - -## Other resources for MBAM operations - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/troubleshooting-mbam-25.md b/mdop/mbam-v25/troubleshooting-mbam-25.md deleted file mode 100644 index e756c4cc34..0000000000 --- a/mdop/mbam-v25/troubleshooting-mbam-25.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Troubleshooting MBAM 2.5 -description: Troubleshooting MBAM 2.5 -author: dansimp -ms.assetid: f35e7aef-2c3c-4d43-b170-6830d2756063 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting MBAM 2.5 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to find troubleshooting content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting MBAM - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Troubleshooting MBAM 2.5 installation problems](https://support.microsoft.com/kb/3049652) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md deleted file mode 100644 index 5f546b0f97..0000000000 --- a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md +++ /dev/null @@ -1,388 +0,0 @@ ---- -title: Understanding MBAM 2.5 Stand-alone Reports -description: Understanding MBAM 2.5 Stand-alone Reports -author: dansimp -ms.assetid: 78b5aaf4-8257-4722-8eb9-e0de48db6a11 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM 2.5 Stand-alone Reports - - -This topic describes the reports that are available when you are running Microsoft BitLocker Administration and Monitoring (MBAM) in the Stand-alone topology. - -**Note** -If you are running MBAM with the Configuration Manager Integration topology, you generate reports from Configuration Manager rather than from MBAM. See [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md) for more information about these reports. - - - -## Understanding the MBAM Stand-alone topology reports - - -MBAM provides three report types that you can use to monitor your organization for BitLocker compliance: - -- [Enterprise Compliance Report](#bkmk-enterprisecompliance) - -- [Computer Compliance Report](#bkmk-compliance) - -- [Recovery Audit Report](#bkmk-recovery) - -To access MBAM reports when you are running MBAM in the Stand-alone topology, open a web browser, and then open the Administration and Monitoring Website. Select **Reports** in the left menu bar. From the top menu bar, select the kind of report that you want to generate. For more information about generating these reports, see [Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md). - -### Enterprise Compliance Report - -Use this report type to collect information about overall BitLocker compliance in your organization. You can use filters to narrow your search results to learn more about the compliance state and error status of computers in your organization. - -**Enterprise Compliance Overview** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Managed Computers

          Number of computers that MBAM manages.

          % Compliant

          Percentage of compliant computers in the enterprise.

          % Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          % Exempt

          Percentage of computers exempt from the BitLocker encryption requirement.

          % Non-Exempt

          Percentage of computers not exempt from the BitLocker encryption requirement.

          Compliant

          Percentage of compliant computers in the enterprise.

          Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          Exempt

          Total computers that are exempt from the BitLocker encryption requirement.

          Non-Exempt

          Total computers that are not exempt from the BitLocker encryption requirement.

          - - - -**Enterprise Compliance Computer Details** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS name that is managed by MBAM.

          Domain Name

          Fully qualified domain name where the client computer resides and is managed by MBAM.

          Compliance Status

          State of compliance for the computer, according to the policy specified for the computer. The states are Noncompliant and Compliant. See the following Enterprise Compliance Report Compliance States table for more information about how to interpret compliance states.

          Exemption

          Status that indicates whether this computer is exempt from the BitLocker policy.

          Compliance Status Details

          Error and status messages about the compliance state of the computer in accordance to the policy specified.

          Last Contact

          Date and time when the computer last contacted the server to report compliance status. The contact frequency is configurable. For more information, see the MBAM Group Policy settings.

          - - - -### Computer Compliance Report - -Use this report type to collect information that is specific to a computer or user. - -View this report by clicking the computer name in the Enterprise Compliance Report, or by typing the computer name in the Computer Compliance Report. This report shows detailed encryption information about each drive (operating system and fixed data drives) on a computer. It also indicates the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note** -Removable Data Volume encryption status is not shown in this report. - - - -**Computer Compliance Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS computer name that is managed by MBAM.

          Domain Name

          Fully qualified domain name where the client computer resides and is managed by MBAM.

          Computer Type

          Type of computer. Valid types are Non-Portable and Portable.

          Operating System

          Operating system type found on the client computer that is managed by MBAM.

          Compliance Status

          Overall compliance status of the computer that is managed by MBAM. Valid states are Compliant and Noncompliant.

          -

          Notice that the compliance status per drive (see the following table) may indicate different compliance states. However, this field represents that compliance state, according to the specified policy.

          Policy Cipher Strength

          Cipher strength selected by the administrator during MBAM policy specification (for example, 128-bit with diffuser).

          Policy Operating System Drive

          Indicates if encryption is required for the operating system and shows the appropriate protector type.

          Policy-Fixed Data Drive

          Indicates if encryption is required for the fixed data drive.

          Policy Removable Data Drive

          Indicates if encryption is required for the removable drive.

          Device Users

          Known users on the computer that is managed by MBAM.

          Exemption

          Status that indicates whether this computer is exempt from the BitLocker policy.

          Manufacturer

          Computer manufacturer name, as it appears in the computer BIOS.

          Model

          Computer manufacturer model name, as it appears in the computer BIOS.

          Compliance Status Details

          Error and status messages about the compliance state of the computer, in accordance with the specified policy.

          Last Contact

          Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable. For more information, see the MBAM Group Policy settings.

          - - - -**Computer Compliance Report Drive Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Drive Letter

          Computer drive letter that was assigned to the particular drive by the user.

          Drive Type

          Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

          Cipher Strength

          Cipher strength selected by the administrator during MBAM policy specification.

          Protector Type

          Type of protector selected through the Group Policy setting used to encrypt an operating system or fixed data volume.

          Protector State

          Indicates that the computer being managed by MBAM has enabled the protector type that is specified in the policy. The valid states are ON or OFF.

          Encryption State

          Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

          Compliance Status

          State that indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant.

          Compliance Status Details

          Error and status messages of the compliance state of the computer, according to the specified policy.

          - - - -### Recovery Audit Report - -Use this report type to audit users who have requested access to BitLocker recovery keys. The report offers several filters based on the desired filtering criteria. You can filter on a specific type of user (a Help Desk user or an end user), whether the request failed or was successful, the specific type of key requested, and a date range during which the retrieval occurred. - -**Recovery Audit Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Request Date and Time

          Date and time that a key retrieval request was made by an end user or Help Desk user.

          Audit Request Source

          The site from which the request was initiated. This entry will have one of two values: Self-Service Portal or Helpdesk.

          Request Status

          Status of the request. Valid statuses are Successful (the key was retrieved), or Failed (the key was not retrieved).

          Helpdesk User

          Help Desk user who initiated the request for key retrieval.

          -
          -Note

          If an Advanced Helpdesk User recovers the key without specifying the end user, the End User field will be blank. A standard Helpdesk User must specify the end user, and that user will appear in this field.

          -

          A recovery via the Self-Service Portal will list the requesting end user both in this field and in the End User field.

          -
          -
          - -

          End User

          End user who initiated the request for key retrieval.

          Computer

          Computer name of the computer that was recovered.

          Key Type

          Type of key that was requested by the Help Desk user or the end user. The three types of keys that MBAM collects are:

          -
            -
          • Recovery Key Password (used to recover a computer in recovery mode)

          • -
          • Recovery Key ID (used to recover a computer in recovery mode on behalf of another user)

          • -
          • TPM Password Hash (used to recover a computer with a locked TPM)

          • -

          Reason Description

          Reason the specified key type was requested by the Help Desk user or the end user. The reasons are specified in the Drive Recovery and Manage TPM features of the Administration and Monitoring Website. The valid entries are user-entered text or one of the following reason codes:

          -
            -
          • Operating System Boot Order changed

          • -
          • BIOS Changed

          • -
          • Operating System files changed

          • -
          • Lost Startup key

          • -
          • Lost PIN

          • -
          • TPM Reset

          • -
          • Lost Passphrase

          • -
          • Lost Smartcard

          • -
          • Reset PIN lockout

          • -
          • Turn on TPM

          • -
          • Turn off TPM

          • -
          • Change TPM password

          • -
          • Clear TPM

          • -
          - - - -**Note** -Report results can be saved to a file by clicking the **Export** button on the **Reports** menu bar. - - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - -[Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md b/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md deleted file mode 100644 index 39cd813d57..0000000000 --- a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel -description: Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel -author: dansimp -ms.assetid: f8a01cc2-0c77-48b9-8351-8194e80b0cf8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel - - -This topic describes the **BitLocker Encryption Options** and **BitLocker Drive Encryption** Control Panel items and explains the following: - -- How these items are created - -- Tasks they enable you to perform - -- **Manage BitLocker** “right-click” shortcut menu, when it is visible versus hidden, and how to set it to be visible by default - -## BitLocker Encryption Options and BitLocker Drive Encryption Control Panel items - - -The following table lists the tasks you can perform from each Control Panel item and describes how these items are created. - - ----- - - - - - - - - - - - - - - - - - - - -
          BitLocker Encryption Options (MBAM)BitLocker Drive Encryption (Windows)

          Tasks you can do

            -
          • Change your PIN or password

          • -
          • Check encryption status for a drive

          • -
          • Open the TPM Management console

          • -
          • Turn on BitLocker

          • -
            -
          • Suspend protection for a drive

          • -
          • Back up your recovery key

          • -
          • Change your PIN

          • -
          • Turn off BitLocker for a drive

          • -
          • Turn on BitLocker for a drive

          • -
          • Open the TPM Management console

          • -
          • Decrypt a drive (appears only if the MBAM Client is NOT installed)

          • -

          How the Control Panel item is created

          Created in Control Panel when you install the MBAM Client. This item cannot be hidden.

          -
          -Note

          This item appears in addition to, but does not replace, the default BitLocker Drive Encryption Control Panel item.

          -
          -
          - -

          Appears by default in Control Panel as part of the Windows operating system, but you can hide it.

          -

          To hide it, see Hiding the Default BitLocker Drive Encryption Item in Control Panel.

          - - - -## “Manage BitLocker” shortcut menu - - -The following table describes how the **Manage BitLocker** shortcut menu differs depending on whether the MBAM Client is installed. The term “shortcut menu” refers to options that appear when you right-click a drive in Windows Explorer. - - ----- - - - - - - - - - - - - - - - - - - - -
          When MBAM Client is installedWhen MBAM Client is not installed

          Visibility of shortcut menu

          The Manage BitLocker option is hidden.

          -

          To make the Manage BitLocker option visible on the shortcut menu, which displays the option to decrypt a drive, delete the following registry key:

          -
          HKEY_CLASSES_ROOT\Drive\Shell\manage-bde \REG_SZ LegacyDisable

          The Manage BitLocker option appears on the shortcut menu.

          What users can do

          With the shortcut hidden, users can open the BitLocker Drive Encryption Control Panel item, but the option to decrypt a drive is not available.

          With the shortcut visible, selecting the Manage BitLocker option opens the BitLocker Drive Encryption Control Panel item, which displays the option to decrypt a drive.

          - - - - -## Related topics - - -[Administering MBAM 2.5 Features](administering-mbam-25-features.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md deleted file mode 100644 index eb867b9ba1..0000000000 --- a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions -description: Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions -author: dansimp -ms.assetid: a9edb4b8-5d5e-42ab-8db6-619db2878e50 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions - - -This topic describes the process for upgrading the Microsoft BitLocker Administration and Monitoring (MBAM) Server and the MBAM Client from earlier versions of MBAM. - -**Note**   -You can upgrade directly to MBAM 2.5 or MBAM 2.5 SP1 from any previous version of MBAM. - - - -## Before you start the upgrade - - -Review the following information before you start the upgrade. - - ---- - - - - - - - - - - - - - - - - - - - - -
          What to know before you startDetails

          If you are installing the MBAM websites on one server and the web services on another server, you have to use Windows PowerShell cmdlets to configure them.

          The MBAM Server Configuration wizard does not support configuring the websites on one server and the web services on a different server.

          If you are upgrading to MBAM 2.5 or 2.5 SP1 from MBAM 2.0 or 2.0 SP1 in Windows Server 2008 R2:

          -

          The Administration and Monitoring Website and the Self-Service Portal will not work if you install the required .NET Framework 4.5 software after Internet Information Services (IIS) is already installed.

          -

          This issue occurs because ASP.NET cannot be registered correctly with IIS if the .NET Framework is installed after IIS has already been installed.

          To resolve this issue:

          -

          Run aspnet_regiis –i from the following location:

          -

          C:\windows\microsoft.net\Framework\v4.0.30319

          -

          For more information, see: ASP.NET IIS Registration Tool.

          Register an SPN on the application pool account if all of the following are true:

          -
            -
          • You are upgrading from a previous version of MBAM.

          • -
          • Currently, you are not running the MBAM websites in a load-balanced or distributed configuration, but you would like to do so when you upgrade to MBAM 2.5 or 2.5 SP1.

          • -

          For instructions, see Planning How to Secure the MBAM Websites.

          - ---- - - - - - - - - - - - - - - -

          What we recommend

          Register a service principal name (SPN) for the application pool account, even though you may already have registered SPNs for the machine account.

          Why we recommend it

          Registering an SPN on the application pool account is required to configure the websites in a load-balanced or distributed configuration.

          What happens if SPNs are already configured on a machine account?

          MBAM will use the SPNs that you have already registered, and you don’t need to configure additional SPNs, but you are not able to configure the websites in a load-balanced or distributed configuration.

          -

           

          - - - -## Steps to upgrade the MBAM Server infrastructure - - -Use the steps in the following sections to upgrade MBAM for the Stand-alone topology or the System Center Configuration Manager Integration topology. - -**To upgrade the MBAM Server infrastructure for Stand-alone topology** - -1. Uninstall previous versions of MBAM from **Programs and Features** and from web servers to make sure that information is not being written from MBAM clients to the MBAM infrastructure. For instructions, see [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md#bkmk-removeserverfeatures). - -2. Back up your databases. - -3. Uninstall previous versions of MBAM from SQL Server by using **Programs and Features**, including SQL Servers hosting the MBAM reports via SQL Server Reporting Services. Remove any remaining MBAM server temporary files or folders from the database server and reporting services. - - **Note**   - The databases will not be removed, and all compliance and recovery data is maintained in the database. - - - -4. Install and configure the MBAM 2.5 or 2.5 SP1 databases, reports, and web applications, in that order. The databases are upgraded in place. - -5. Update the Group Policy Objects (GPOs) using the MBAM 2.5 Templates to leverage the new features in MBAM, such as enforced encryption. If you do not update the GPOs and the MBAM client to MBAM 2.5, earlier versions of MBAM clients will continue to report against your current GPOs with reduced functionality. See [How to Get MDOP Group Policy (.admx) Templates](https://www.microsoft.com/download/details.aspx?id=41183) to download the latest ADMX templates. - - After you upgrade the MBAM Server infrastructure, the existing client computers continue to successfully report to the MBAM 2.5 or 2.5 SP1 Server, and recovery data continues to be stored. - -6. Install the latest MBAM 2.5 or 2.5 SP1 Client. Client computers do not need to be rebooted after the deployment. - -**To upgrade the MBAM infrastructure for System Center Configuration Manager Integration topology** - -1. Uninstall previous versions of MBAM from **Programs and Features** and from web servers to make sure that information is not being written from MBAM clients to the MBAM infrastructure. For instructions, see [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md#bkmk-removeserverfeatures). - -2. Back up your databases. - -3. Uninstall previous versions of MBAM from SQL Server by using **Programs and Features**, including SQL Servers hosting the MBAM reports via SQL Server Reporting Services. Remove any remaining MBAM server temporary files or folders from the database server and reporting services. - -4. Uninstall MBAM from the Configuration Manager server. - - **Note**   - The databases and the Configuration Manager objects (baseline, MBAM supported computers collection, and Reports) will not be removed, and all compliance and recovery data is maintained in the database. - - - -5. Update the .mof files. - -6. Install and configure the MBAM 2.5 or 2.5 SP1 databases, reports, web applications, and Configuration Manager integration, in that order. The databases and Configuration Manager objects are upgraded in place. - -7. Optionally, update the Group Policy Objects (GPOs), and edit the settings if you want to implement new features in MBAM, such as enforced encryption. If you do not update the GPOs, MBAM will continue to report against your current GPOs. See [How to Get MDOP Group Policy (.admx) Templates](https://docs.microsoft.com/microsoft-desktop-optimization-pack/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates) to download the latest ADMX templates. - - After you upgrade the MBAM Server infrastructure, the existing client computers continue to successfully report to the MBAM 2.5 or 2.5 SP1 Server, and recovery data continues to be stored. - -8. Install the latest MBAM 2.5 or 2.5 SP1 Client. Client computers do not need to be rebooted after the deployment. - -## Upgrade support for the MBAM Client - - -MBAM supports upgrades to the MBAM 2.5 Client from any earlier version of the MBAM Client. - -**Ways to install the MBAM Client:** - -- Upgrade the computers running MBAM Client all at once or gradually after you install the MBAM 2.5 Server infrastructure. - -- Install the MBAM Client through an electronic software distribution system or through tools such as Active Directory Domain Services or System Center Configuration Manager. - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md deleted file mode 100644 index d71c2b2b2a..0000000000 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Upgrading to MBAM 2.5 SP1 from MBAM 2.5 -description: Upgrading to MBAM 2.5 SP1 from MBAM 2.5 -author: dansimp -ms.assetid: -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 2/16/2018 ---- - -# Upgrading to MBAM 2.5 SP1 from MBAM 2.5 -This topic describes the process for upgrading the Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 and the MBAM Client from 2.5 to MBAM 2.5 SP1. - -### Before you begin -#### Download the July 2018 servicing release -[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=57157) - -#### Verify the installation documentaion -Verify you have a current documentation of your MBAM environment, including all server names, database names, service accounts and their passwords. - -### Upgrade steps -#### Steps to upgrade the MBAM Database (SQL Server) -1. Using the MBAM Configurator; remove the Reports role from the SQL server, or wherever the SSRS database is hosted. Depending on your environment, this can be the same server or a separate one. - Note: You will not see an option to remove the Databases; this is expected. -2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site: -3. Do not configure it at this time  -4. Install the July 2018 Rollup: https://www.microsoft.com/download/details.aspx?id=57157 -5. Using the MBAM Configurator; re-add the Reports role -6. This will configure the SSRS connection using the latest MBAM code from the rollup  -7. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server. -8. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected. -9. This process updates the existing databases to the current version being installed - -#### Steps to upgrade the MBAM Server (Running MBAM and IIS) -1. Using the MBAM Configurator; remove the Admin and Self Service Portals from the IIS server -2. Install MBAM 2.5 SP1 -3. Do not configure it at this time   -4. Install the July 2018 Rollup on the IIS server(https://www.microsoft.com/download/details.aspx?id=57157) -5. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server  -6. This will configure the sites using the latest MBAM code from the July 2018 Rollup -7. Open an elevated command prompt, Type: **IISRESET** and Hit Enter. - -#### Steps to upgrade the MBAM Clients/Endpoints -1. Uninstall the 2.5 Agent from client endpoints -2. Install the 2.5 SP1 Agent on the client endpoints -3. Push out the July 2018 Rollup Client update to clients running the 2.5 SP1 Agent  -4. There is no need to uninstall the existing client prior to installing the July 2018 Rollup.   diff --git a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md b/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md deleted file mode 100644 index 33509cf80e..0000000000 --- a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Using Windows PowerShell to Administer MBAM 2.5 -description: Using Windows PowerShell to Administer MBAM 2.5 -author: dansimp -ms.assetid: 64668e76-2cba-433d-8d2d-50df0a4b2997 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Using Windows PowerShell to Administer MBAM 2.5 - - -This topic describes Windows PowerShell cmdlets for Microsoft BitLocker Administration and Monitoring (MBAM) that relate to recovering computers or drives when users get locked out. - -For cmdlets that you use to configure MBAM Server features, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md). - -## Cmdlets for recovering computers or drives that are managed by MBAM - - -Use the following Windows PowerShell cmdlets to recover computers or drives that are managed by MBAM. - - ---- - - - - - - - - - - - - - - - - -
          NameDescription

          Get-MbamBitLockerRecoveryKey

          Requests an MBAM recovery key that enables users to unlock a computer or encrypted drive.

          Get-MbamTPMOwnerPassword

          Provides users with a TPM owner password that they can use to unlock a Trusted Platform Module (TPM) when the TPM has locked them out and will no longer accept their PIN.

          - - - -## MBAM cmdlet Help - - -Windows PowerShell Help for MBAM cmdlets is available in the following formats: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows PowerShell Help formatMore information

          At a Windows PowerShell command prompt, type Get-Help <cmdlet>

          To upload the latest Windows PowerShell cmdlets, follow the instructions in Configuring MBAM 2.5 Server Features by Using Windows PowerShell

          On TechNet as webpages

          https://go.microsoft.com/fwlink/?LinkId=393498

          On the Download Center as a Word .docx file

          https://go.microsoft.com/fwlink/?LinkId=393497

          On the Download Center as a .pdf file

          https://go.microsoft.com/fwlink/?LinkId=393499

          - - - - - -## Related topics - - -[Administering MBAM 2.5 Features](administering-mbam-25-features.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md deleted file mode 100644 index 76b918713f..0000000000 --- a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md +++ /dev/null @@ -1,192 +0,0 @@ ---- -title: Validating the MBAM 2.5 Server Feature Configuration -description: Validating the MBAM 2.5 Server Feature Configuration -author: dansimp -ms.assetid: f4983a33-ce18-4186-a471-dd6415940504 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Validating the MBAM 2.5 Server Feature Configuration - - -When you finish the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server feature deployment, we recommend that you validate the deployment to ensure that all features have been successfully configured. Use the procedure that matches the topology (Stand-alone or System Center Configuration Manager Integration) that you deployed. - -## Validating the MBAM Server deployment with the Stand-alone topology - - -Use the following steps to validate your MBAM Server deployment with the Stand-alone topology. - -**To validate a Stand-alone MBAM Server deployment** - -1. On each server where an MBAM feature is deployed, click **Control Panel** > **Programs** > **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To do the validation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery Database is configured, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is configured. - -3. On the server where the Compliance and Audit Database is configured, open SQL Server Management Studio and verify that the **MBAM Compliance Status Database** is configured. - -4. On the server where the Reports feature is configured, open a web browser with administrative credentials and browse to the "Home" of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance is at: - - http(s)://< *MBAMReportsServerName*>:<*port*>/Reports.aspx - - To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that you specified during setup. - -5. Confirm that a reports folder named **Microsoft BitLocker Administration and Monitoring** contains a data source called **MaltaDataSource** as well as the language folders. The data source contains folders with names that represent languages (for example, en-us). The reports are in the language folders. - - **Note** - If SQL Server Reporting Services (SSRS) was configured as a named instance, the URL should resemble the following: http(s)://< *MBAMReportsServerName*>:<*port*>/Reports\_<*SSRSInstanceName*> - - - -~~~ -**Note** -If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring Website (also known as Help Desk) and select a report, the following message appears: "Only Secure Content is Displayed." To show the report, click **Show All Content**. -~~~ - - - -6. On the server where the Administration and Monitoring Website feature is configured, run **Server Manager**, browse to **Roles**, and then select **Web Server (IIS)** > **Internet Information Services (IIS) Manager**. - -7. In **Connections**, browse to *<computer name>* and select **Sites** > **Microsoft BitLocker Administration and Monitoring**. Verify that the following are listed: - - - **MBAMAdministrationService** - - - **MBAMComplianceStatusService** - - - **MBAMRecoveryAndHardwareService** - -8. On the server where the Administration and Monitoring Website and Self-Service Portal are configured, open a web browser with administrative credentials. - -9. Browse to the following websites to verify that they load successfully: - - - https(s)://<*MBAMAdministrationServerName*>:<*port*>/HelpDesk/ - confirm each of the links for navigation and reports - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/SelfService/ - - **Note** - It is assumed that you configured the server features on the default port without network encryption. If you configured the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example: - - http(s)://< *host name*>:<*port*>/HelpDesk/ - - http(s)://< *host name*>:<*port*>/<*virtualdirectory*>/ - - If the server features were configured with network encryption, change http:// to https://. - - - -10. Browse to the following web services to verify that they load successfully. A page opens to indicate that the service is running, but the page does not display any metadata. - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMAdministrationService/AdministrationService.svc - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMUserSupportService/UserSupportService.svc - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMComplianceStatusService/StatusReportingService.svc - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMRecoveryAndHardwareService/CoreService.svc - -## Validating the MBAM Server deployment with the Configuration Manager Integration topology - - -Use the following steps to validate your MBAM deployment with the Configuration Manager Integration topology. Complete the validation steps that match the version of Configuration Manager that you are using. - -### Validating the MBAM Server deployment with System Center 2012 Configuration Manager - -Use these steps to validate your MBAM Server deployment when you are using MBAM with System Center 2012 Configuration Manager. - -**To validate a Configuration Manager Integration MBAM Server deployment – System Center 2012 Configuration Manager** - -1. On the server where System Center 2012 Configuration Manager is deployed, open **Programs and Features** in **Control Panel**, and verify that **Microsoft BitLocker Administration and Monitoring** appears. - - **Note** - To validate the configuration, you must use a domain account that has local computer administrative credentials on each server. - - - -2. In the Configuration Manager console, click the **Assets and Compliance** workspace > **Device Collections**, and confirm that a new collection called **MBAM Supported Computers** is displayed. - -3. In the Configuration Manager console, click the **Monitoring** workspace > **Reporting** > **Reports** > **MBAM**. - -4. Verify that the **MBAM** folder contains subfolders, with names that represent different languages, and that the following reports are listed in each language subfolder: - - - BitLocker Computer Compliance - - - BitLocker Enterprise Compliance Dashboard - - - BitLocker Enterprise Compliance Details - - - BitLocker Enterprise Compliance Summary - -5. In the Configuration Manager console, click the **Assets and Compliance** workspace > **Compliance Settings** > **Configuration Baselines**, and confirm that the configuration baseline **BitLocker Protection** is listed. - -6. In the Configuration Manager console, click the **Assets and Compliance** workspace > **Compliance Settings** > **Configuration Items**, and confirm that the following new configuration items are displayed: - - - BitLocker Fixed Data Drives Protection - - - BitLocker Operating System Drive Protection - -### Validating the MBAM Server deployment with Configuration Manager 2007 - -Use these steps to validate your MBAM Server deployment when you are using MBAM with Configuration Manager 2007. - -**To validate a Configuration Manager Integration MBAM Server deployment – Configuration Manager 2007** - -1. On the server where Configuration Manager 2007 is deployed, open **Programs and Features** on **Control Panel** , and verify that **Microsoft BitLocker Administration and Monitoring** appears. - - **Note** - To validate the configuration, you must use a domain account that has local computer administrative credentials on each server. - - - -2. In the Configuration Manager console, click **Site Database <SiteCode> - <ServerName>, <SiteName>), Computer Management**, and confirm that a new collection called **MBAM Supported Computers** is displayed. - -3. In the Configuration Manager console, click **Reporting** > **Reporting Services** > **\\\\<ServerName>** > **Report Folders** > **MBAM**. - - Verify that the **MBAM** folder contains subfolders, with names that represent different languages, and that the following reports are listed in each language subfolder: - - - BitLocker Computer Compliance - - - BitLocker Enterprise Compliance Dashboard - - - BitLocker Enterprise Compliance Details - - - BitLocker Enterprise Compliance Summary - -4. In the Configuration Manager console, click **Desired Configuration Management** > **Configuration Baselines**, and confirm that the configuration baseline **BitLocker Protection** is listed. - -5. In the Configuration Manager console, click **Desired Configuration Management** > **Configuration Items**, and confirm that the following new configuration items are displayed: - - - BitLocker Fixed Data Drives Protection - - - BitLocker Operating System Drive Protection - - - -## Related topics - - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md deleted file mode 100644 index 66de3b12f9..0000000000 --- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md +++ /dev/null @@ -1,493 +0,0 @@ ---- -title: Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology -description: Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology -author: dansimp -ms.assetid: 60d11b2f-3a76-4023-8da4-f89e9f35b790 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology - - -This topic describes the reports that are available when you configure Microsoft BitLocker Administration and Monitoring (MBAM) with the Configuration Manager Integration topology. The reports show BitLocker compliance for the enterprise and for individual computers and devices that MBAM manages. The reports provide tabular information and charts, and they have filters that let you view data from different perspectives. - -In the Configuration Manager Integration topology, you view reports from Configuration Manager rather than from the Administration and Monitoring Website, with the exception of the **Recovery Audit Report**, which you continue to view from the Administration and Monitoring Website. - -For information about MBAM reports for the Stand-alone topology, see [Viewing MBAM 2.5 Reports for the Stand-alone Topology](viewing-mbam-25-reports-for-the-stand-alone-topology.md). - -## Accessing reports in Configuration Manager - - -To access the Reports feature in Configuration Manager: - - ---- - - - - - - - - - - - - - - - - -
          Version of Configuration ManagerHow to view the reports

          System Center 2012 Configuration Manager

            -
          1. In the left pane, select the Monitoring workspace.

          2. -
          3. In the tree, expand Overview > Reporting > Reports > MBAM.

          4. -
          5. Select the folder that represents the language in which you want to view reports, and then select the report from the right pane.

          6. -

          Configuration Manager 2007

            -
          1. In the left pane, expand Computer Management > Reporting > Reporting Services > <server name> > Report folders > MBAM.

          2. -
          3. Select the folder that represents the language in which you want to view reports, and then select the report from the right pane.

          4. -
          - - - -## Description of reports in Configuration Manager - - -There are a few minor differences in the reports for the Configuration Manager Integration topology and the Stand-alone topology. The following sections describe the data in the MBAM reports for the Configuration Manager Integration topology: - -- [BitLocker Enterprise Compliance Dashboard](#bkmk-dashboard) - -- [BitLocker Enterprise Compliance Details](#bkmk-compliancedetails) - -- [BitLocker Enterprise Compliance Summary](#bkmk-compliancesummary) - -- [BitLocker Computer Compliance Report](#bkmk-compliancereport) - -### BitLocker Enterprise Compliance Dashboard - -The BitLocker Enterprise Compliance Dashboard provides the following graphs, which show BitLocker compliance status across the enterprise: - -- Compliance Status Distribution - -- Non Compliant Errors Distribution - -- Compliance Status Distribution by Drive Type - -**Compliance Status Distribution** - -This pie chart shows compliance status for computers within the enterprise. It also shows the percentage of computers, compared to the total number of computers in the selected collection, that has that compliance status. The actual number of computers with each status is also shown. The pie chart shows the following compliance statuses: - -- Compliant - -- Non Compliant - -- User Exempt - -- Temporary User Exempt - -- Policy Not Enforced - -- Unknown. These computers reported a status error, or they are part of the collection, but have never reported their compliance status. The lack of a compliance status could occur if the computer is disconnected from the organization. - -**Non Compliant Errors Distribution** - -This pie chart shows the categories of computers in the enterprise that are not compliant with the BitLocker Drive Encryption policy, and shows the number of computers in each category. Each category percentage is calculated from the total number of non-compliant computers in the collection. - -- User postponed encryption - -- Unable to find compatible TPM - -- System partition not available or large enough - -- Policy conflict - -- Waiting for TPM auto provisioning - -- An unknown error has occurred - -- No information. These computers do not have the MBAM Client installed, or they have the MBAM Client installed but not activated (for example, the service is not working). - -**Compliance Status Distribution by Drive Type** - -This bar chart shows the current BitLocker compliance status by drive type. The statuses are **Compliant** and **Non Compliant**. Bars are shown for fixed data drives and operating system drives. Computers that do not have a fixed data drive are included and show a value only in the **Operating System Drive** bar. The chart does not include users who have been granted an exemption from the BitLocker Drive Encryption policy or the No Policy category. - -### BitLocker Enterprise Compliance Details - -This report shows information about the overall BitLocker compliance across your enterprise for the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Details Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Managed Computers

          Number of computers that MBAM manages.

          % Compliant

          Percentage of compliant computers in the enterprise.

          % Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          % Unknown Compliance

          Percentage of computers with a compliance state that is not known.

          % Exempt

          Percentage of computers exempt from the BitLocker encryption requirement.

          % Non-Exempt

          Percentage of computers not exempt from the BitLocker encryption requirement.

          Compliant

          Percentage of compliant computers in the enterprise.

          Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          Unknown Compliance

          Percentage of computers with a compliance state that is not known.

          Exempt

          Total computers that are exempt from the BitLocker encryption requirement.

          Non-Exempt

          Total computers that are not exempt from the BitLocker encryption requirement.

          - - - -**BitLocker Enterprise Compliance Details States** - - ----- - - - - - - - - - - - - - - - - - - - -
          Compliance StatusExemptionDescription

          Noncompliant

          Not exempt

          The computer is noncompliant, according to the specified policy.

          Compliant

          Not exempt

          The computer is compliant in accordance with the specified policy.

          - - - -### BitLocker Enterprise Compliance Summary - -Use this report type to show information about the overall BitLocker compliance across your enterprise and to show the compliance for individual computers that are in the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Summary Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Managed Computers

          Number of computers that MBAM manages.

          % Compliant

          Percentage of compliant computers in the enterprise.

          % Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          % Unknown Compliance

          Percentage of computers with a compliance state that is not known.

          % Exempt

          Percentage of computers exempt from the BitLocker encryption requirement.

          % Non-Exempt

          Percentage of computers not exempt from the BitLocker encryption requirement.

          Compliant

          Percentage of compliant computers in the enterprise.

          Non-Compliant

          Percentage of non-compliant computers in the enterprise.

          Unknown Compliance

          Percentage of computers with a compliance state that is not known.

          Exempt

          Total computers that are exempt from the BitLocker encryption requirement.

          Non-Exempt

          Total computers that are not exempt from the BitLocker encryption requirement.

          - - - -**BitLocker Enterprise Compliance Summary Computer Details** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS computer name that is being managed by MBAM.

          Domain Name

          Fully qualified domain name, where the client computer resides and is managed by MBAM.

          Compliance Status

          Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified.

          Exemption

          Status that indicates whether the user is exempt or non-exempt from the BitLocker policy.

          Device Users

          User of the device.

          Compliance Status Details

          Error and status messages about the compliance state of the computer in accordance with the policy specified.

          Last Contact

          Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable through the Group Policy settings.

          - - - -### BitLocker Computer Compliance Report - -Use this report type to collect information that is specific to a computer. The BitLocker Computer Compliance Report provides detailed encryption information about each drive on a computer (operating system and fixed data drives). It also provides an indication of the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note**   -The Removable Data Volume encryption status is not shown in this report. - - - -**BitLocker Computer Compliance Report: Computer Details Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Computer Name

          User-specified DNS computer name that is being managed by MBAM.

          Domain Name

          Fully qualified domain name, where the client computer resides and is managed by MBAM.

          Computer Type

          Type of computer. Valid types are Non-Portable and Portable.

          Operating System

          Operating System type found on the MBAM managed client computer.

          Overall Compliance

          Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the table that follows) may indicate different compliance states. However, this field represents that compliance state in accordance with the policy specified.

          Operating System Compliance

          Compliance status of the operating system that is managed by MBAM. Valid states are Compliant and Noncompliant.

          Fixed Data Drive Compliance

          Compliance status of the fixed data drive that is managed by MBAM. Valid states are Compliant and Noncompliant.

          Last Update Date

          Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable through the Group Policy settings.

          Exemption

          Status that indicates whether the user is exempt or non-exempt from the BitLocker policy.

          Exempted User

          User who is exempt from the BitLocker policy.

          Exemption Date

          Date on which the exemption was granted.

          Compliance Status Details

          Error and status messages about the compliance state of the computer in accordance with the policy specified.

          Policy Cipher Strength

          Cipher strength selected by the Administrator during the MBAM policy specification (for example, 128-bit with diffuser).

          Policy: Operating System Drive

          Indicates if encryption is required for the operating system and the appropriate protector type.

          Policy: Fixed Data Drive

          Indicates if encryption is required for the fixed data drive.

          Manufacturer

          Computer manufacturer name as it appears in the computer BIOS.

          Model

          Computer manufacturer model name as it appears in the computer BIOS.

          Device Users

          Known users on the computer that is being managed by MBAM.

          - - - -**BitLocker Computer Compliance Report: Computer Volume Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Column NameDescription

          Drive Letter

          Computer drive letter that was assigned to the particular drive by the user.

          Drive Type

          Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

          Cipher Strength

          Cipher strength selected by the Administrator during MBAM policy specification.

          Protector Types

          Type of protector selected through the policy used to encrypt an operating system or fixed data drive. The valid protector types for an operating system are TPM or TPM+PIN. The valid protector type for a fixed data drive is a password.

          Protector State

          Indicates that the computer being managed by MBAM has enabled the protector type specified in the policy. The valid states are ON or OFF.

          Encryption State

          Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

          - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md deleted file mode 100644 index 9de3997194..0000000000 --- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Viewing MBAM 2.5 Reports for the Stand-alone Topology -description: Viewing MBAM 2.5 Reports for the Stand-alone Topology -author: dansimp -ms.assetid: 50e93c3a-baf1-4378-8fc0-74dd65d76306 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing MBAM 2.5 Reports for the Stand-alone Topology - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Stand-alone topology provides reports that you use to monitor BitLocker usage and compliance. MBAM reports key recovery activity and the compliance status of the computers and devices that it manages across your enterprise. - -See the following topics for information about Stand-alone reports: - - ---- - - - - - - - - - - - - - - - - -
          Report informationLink to detailed information

          Report descriptions - MBAM Stand-alone topology

          Understanding MBAM 2.5 Stand-alone Reports

          Instructions for generating reports - MBAM Stand-alone topology

          Generating MBAM 2.5 Stand-alone Reports

          - - - -**Note**   -If you are using the Configuration Manager Integration topology, most reports are generated from Configuration Manager rather than from MBAM. See [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md). - - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/medv-v1/TOC.md b/mdop/medv-v1/TOC.md deleted file mode 100644 index c6dd794c5c..0000000000 --- a/mdop/medv-v1/TOC.md +++ /dev/null @@ -1,87 +0,0 @@ -# [Microsoft Enterprise Desktop Virtualization 1](index.md) -## [About This Guide](about-this-guidemedv.md) -## [Getting Started with MED-V](getting-started-with-med-v.md) -### [Overview of MED-V](overview-of-med-v.md) -### [High-Level Architecture](high-level-architecturemedv.md) -### [Key Scenarios for Using MED-V](key-scenarios-for-using-med-v.md) -### [About MED-V 1.0](about-med-v-10.md) -#### [MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -#### [MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -#### [MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) -### [About MED-V 1.0 SP1](about-med-v-10-sp1.md) -#### [MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -#### [MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -#### [MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) -## [MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) -### [Define the Project Scope](define-the-project-scope.md) -### [Identify the Number of MED-V Instances](identify-the-number-of-med-v-instances.md) -### [Design the MED-V Server Infrastructure](design-the-med-v-server-infrastructure.md) -### [Design the MED-V Image Repositories](design-the-med-v-image-repositories.md) -## [MED-V Deployment and Configuration](med-v-deployment-and-configuration.md) -### [MED-V Installation Prerequisites](med-v-installation-prerequisites.md) -### [Supported Configurations](supported-configurationsmedv-orientation.md) -#### [MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -#### [MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -### [Installation and Upgrade Checklists](installation-and-upgrade-checklists.md) -#### [MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -#### [MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -### [Installing and Configuring MED-V Components](installing-and-configuring-med-v-components.md) -#### [How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md) -#### [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) -#### [How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) -#### [How to Uninstall MED-V Components](how-to-uninstall-med-v-componentsmedvv2.md) -### [Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) -### [Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) -### [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) -#### [How to Apply General Settings to a MED-V Workspace](how-to-apply-general-settings-to-a-med-v-workspace.md) -#### [How to Apply Virtual Machine Settings to a MED-V Workspace](how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md) -#### [How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) -#### [How to Configure Published Applications](how-to-configure-published-applicationsmedvv2.md) -#### [How to Configure Web Settings for a MED-V Workspace](how-to-configure-web-settings-for-a-med-v-workspace.md) -#### [How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md) -##### [How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) -##### [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) -##### [Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) -#### [How to Apply Network Settings to a MED-V Workspace](how-to-apply-network-settings-to-a-med-v-workspace.md) -#### [How to Apply Performance Settings to a MED-V Workspace](how-to-apply-performance-settings-to-a-med-v-workspace.md) -#### [How to Import and Export a Policy](how-to-import-and-export-a-policy.md) -### [Configuring MED-V for Remote Networks](configuring-med-v-for-remote-networks.md) -### [Configuring MED-V Server for Cluster Mode](configuring-med-v-server-for-cluster-mode.md) -## [MED-V Operations](med-v-operations.md) -### [Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) -### [Creating a MED-V Image](creating-a-med-v-image.md) -#### [How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) -#### [How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) -#### [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) -#### [How to Localize a MED-V Image](how-to-localize-a-med-v-image.md) -#### [How to Update a MED-V Image](how-to-update-a-med-v-image.md) -#### [How to Delete a MED-V Image](how-to-delete-a-med-v-image.md) -### [Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md) -#### [How to Install MED-V Client](how-to-install-med-v-clientesds.md) -#### [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imageesds.md) -### [Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md) -#### [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md) -#### [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md) -#### [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imagedeployment-package.md) -### [Updating a MED-V Workspace Image](updating-a-med-v-workspace-image.md) -### [MED-V Client Operations](med-v-client-operations.md) -#### [How to Start and Exit the MED-V Client](how-to-start-and-exit-the-med-v-client.md) -#### [How to Start, Stop, and Restart a MED-V Workspace](how-to-start-stop-and-restart-a-med-v-workspace.md) -#### [How to View MED-V Settings and General Information](how-to-view-med-v-settings-and-general-information.md) -#### [How to Lock and Unlock a Workspace](how-to-lock-and-unlock-a-workspace.md) -#### [MED-V Client Tools](med-v-client-toolsv2.md) -## [Troubleshooting MED-V](troubleshooting-med-v.md) -## [Technical Reference](technical-referencemedv-10-sp1.md) -### [MED-V Reporting](med-v-reporting.md) -#### [How to Generate Reports](how-to-generate-reports-medvv2.md) -#### [How to Work with Reports](how-to-work-with-reports.md) -### [MED-V Trim Transfer Technology](med-v-trim-transfer-technology-medvv2.md) -### [How to Back Up and Restore a MED-V Server](how-to-back-up-and-restore-a-med-v-server.md) -### [How to Share Folders Between the Host and the MED-V Workspace](how-to-share-folders-between-the-host-and-the-med-v-workspace.md) -### [How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md) -### [How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md) -### [How to Edit a Published Application with Advanced Settings](how-to-edit-a-published-application-with-advanced-settings.md) -### [How to Set Up Script Actions](how-to-set-up-script-actions.md) -### [Client Installation Command Line Reference](client-installation-command-line-reference.md) -### [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md) - diff --git a/mdop/medv-v1/about-med-v-10-sp1.md b/mdop/medv-v1/about-med-v-10-sp1.md deleted file mode 100644 index f9d3fc4573..0000000000 --- a/mdop/medv-v1/about-med-v-10-sp1.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: About MED-V 1.0 SP1 -description: About MED-V 1.0 SP1 -author: dansimp -ms.assetid: 4c16e935-46c4-49c3-9e53-c60404d5da0c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About MED-V 1.0 SP1 - - -Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 Service Pack 1 (SP1) provides support for Windows 7 and Windows Server 2008 R2. - -The topics in this section provide information relating specifically to MED-V 1.0 SP1. - -## In This Section - - -[MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -Delineates the supported configurations for MED-V 1.0 SP1. - -[MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -Provides a step-by-step procedure for upgrading from MED-V 1.0 to MED-V 1.0 SP1. - -[MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) -Provides known issues specific to MED-V 1.0 SP1. - -## Related topics - - -[MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/about-med-v-10.md b/mdop/medv-v1/about-med-v-10.md deleted file mode 100644 index 8a99314de9..0000000000 --- a/mdop/medv-v1/about-med-v-10.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: About MED-V 1.0 -description: About MED-V 1.0 -author: dansimp -ms.assetid: 89651022-a2ba-4d8a-a3ff-68539ea7a235 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About MED-V 1.0 - - -## In This Section - - -This section provides information related specifically to MED-V 1.0 and includes the following topics: - -[MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -Delineates the supported configurations for MED-V 1.0. - -[MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -Provides a list of all the steps required for installing MED-V 1.0. - -[MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) -Provides a list of known issues with MED-V. - -## Related topics - - -[MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/about-this-guidemedv.md b/mdop/medv-v1/about-this-guidemedv.md deleted file mode 100644 index cf20d13c06..0000000000 --- a/mdop/medv-v1/about-this-guidemedv.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: About This Guide -description: About This Guide -author: dansimp -ms.assetid: 17d8f150-226e-45f8-87e3-f425a77243e4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About This Guide - - -This Planning, Deployment, and Operations guide for Microsoft Enterprise Desktop Virtualization (MED-V) provides background information about MED-V, installing MED-V, and how it works and explains how to correctly use the product. The guide includes the following: - -- System requirements and supported platforms - -- Environmental prerequisites and considerations - -- Step-by-step instructions for installing MED-V server, management, and client - -- Step-by-step instructions for configuring MED-V image, workspace, and policy - -- Step-by-step instructions for deploying a MED-V workspace - -- MED-V client operations - -  - -  - - - - - diff --git a/mdop/medv-v1/client-installation-command-line-reference.md b/mdop/medv-v1/client-installation-command-line-reference.md deleted file mode 100644 index 44326e2a47..0000000000 --- a/mdop/medv-v1/client-installation-command-line-reference.md +++ /dev/null @@ -1,130 +0,0 @@ ---- -title: Client Installation Command Line Reference -description: Client Installation Command Line Reference -author: dansimp -ms.assetid: 122a593d-3314-4e9b-858a-08a25ed00c32 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Installation Command Line Reference - - -**To install MED-V from the command line** - -1. From the command line, run the MED-V .msi package followed by any of the optional parameters described in the following table. - -2. The MED-V .msi package is called *MED-V\_x.msi*, where *x* is the version number. - - For example, *MED-V\_1.0.65.msi*. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterValueDescription

          /quiet

          Silent installation

          /log <full path to log file>

          The full path to the log file.

          INSTALLDIR

          The full path to the installation directory.

          VMSFOLDER

          The full path to the virtual machine folder.

          INSTALL_ADMIN_TOOLS

          1,0

          -

          Default: 0

          Installs MED-V administration tools.

          START_AUTOMATICALLY

          1,0

          -

          Default: 0

          Automatically starts MED-V client every time the user logs on to Windows.

          SERVER_ADDRESS

          host name or IP

          SERVER_PORT

          port

          SERVER_SSL

          1,0

          -

          for https or http

          START_MEDV

          1,0

          -

          Default: 1

          Starts MED-V at the completion of the MED-V installation.

          -
          -Note

          It is recommended to set START_MEDV=0 in case MED-V is installed by the system.

          -
          -
          - -

          DESKTOP_SHORTCUT

          1,0

          -

          Default: 1

          Creates a shortcut on the desktop, which starts MED-V client.

          MINIMAL_RAM_REQUIRED

          RAM in MB

          When installing MED-V, checks whether the computer has the minimum amount of RAM specified. If not, installation is aborted.

          SKIP_OS_CHECK

          1,0

          Omits the operating system validation.

          - - - - - - - - - - - diff --git a/mdop/medv-v1/configuring-med-v-for-remote-networks.md b/mdop/medv-v1/configuring-med-v-for-remote-networks.md deleted file mode 100644 index cdb27ae2fd..0000000000 --- a/mdop/medv-v1/configuring-med-v-for-remote-networks.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Configuring MED-V for Remote Networks -description: Configuring MED-V for Remote Networks -author: dansimp -ms.assetid: 4d2f0081-622f-4a6f-8d73-f8c2108036e0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring MED-V for Remote Networks - - -You can configure MED-V to work from inside a network, remotely, or both from inside the network and remotely. - -## - - -**To configure MED-V to work from inside a network** - -- Configure a MED-V server and image distribution inside the network. - -**To configure MED-V to work remotely** - -1. Configure a MED-V server and an image distribution server that are accessible from the Internet. - -2. If needed, configure a perimeter network (also called a DMZ) reverse proxy. - -3. Set the authentication method, in the *ClientSettings.xml* file, which can be found in the **Servers\\Configuration Server\\** folder. - -**To configure MED-V to work both from inside a network and remotely** - -1. Configure a MED-V server and image distribution server inside the network. - -2. Ensure that the servers are accessible from the Internet. - -3. Configure the DNS resolution so that when the client attempts to connect to a server, it automatically connects to the correct server (within the network or over the Internet) based on the client location. - -4. If needed, configure a perimeter network reverse proxy. - -5. Set the authentication method, in the *ClientSettings.xml* file, which can be found in the **Servers\\Configuration Server\\** folder. - -**Note**   -When applying new settings, the service must be restarted. - - - -- You can change the IIS authentication scheme to one of the following: BASIC, DIGEST, NTLM, or NEGOTIATE. The default is NEGOTIATE and uses the following entry: - - ```xml - - - - - - - - - BG_AUTH_SCHEME_NEGOTIATE - - - ``` - -## Related topics - - -[MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) - - - - - - - - - diff --git a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md b/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md deleted file mode 100644 index 1b03f70a10..0000000000 --- a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Configuring MED-V Server for Cluster Mode -description: Configuring MED-V Server for Cluster Mode -author: dansimp -ms.assetid: 41f0b2a3-4ce9-48e1-a6fb-4c13c4228515 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring MED-V Server for Cluster Mode - - -You can configure the MED-V server in cluster mode. In cluster mode, two servers are used and all files identified as mutual to both servers are placed on a file system. The server accesses the files from the file system rather than storing the files locally. - -## - - -**To configure the MED-V server in cluster mode** - -1. Install and configure MED-V on one of the servers. - -2. Create a shared network in a central location where all of the servers can access it. - -3. Copy the contents of the *<InstallDir>/Servers/ConfigurationServer* folder to the shared network. - -4. Install MED-V server on all designated servers. - -5. On the shared network, assign full access to all MED-V server system accounts. - -6. On each server, do the following: - - 1. In the *<InstallDir>/Servers/ServerConfiguration.xml* file, set the value of *<StorePath>* to the shared network path. - - 2. Copy the *<InstsallDir>/Servers/KeyPair.xml* file from the original server to all MED-V servers. - - 3. Restart the MED-V service. - -**Note**   -If all servers have the same local settings (such as listening ports, IIS server, management permissions, report database, and so on), the *<InstallDir>/Servers/ServerSettings.xml* can be shared by all servers as well. - - - -## Related topics - - -[MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) - - - - - - - - - diff --git a/mdop/medv-v1/configuring-med-v-workspace-policies.md b/mdop/medv-v1/configuring-med-v-workspace-policies.md deleted file mode 100644 index 34784f4a18..0000000000 --- a/mdop/medv-v1/configuring-med-v-workspace-policies.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Configuring MED-V Workspace Policies -description: Configuring MED-V Workspace Policies -author: dansimp -ms.assetid: 0eaed981-cbf3-4b16-a4b7-4705c5705dc7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring MED-V Workspace Policies - - -A MED-V workspace policy is a group of configurable settings that define how the virtualized environment and applications perform on the host machine. The topics in this section describe all the configurable settings in the MED-V workspace policy as well as how these settings influence the MED-V workspace. - -The following MED-V workspace types are available: - -- **Persistent**—In a persistent MED-V workspace, all changes and additions the user makes to the MED-V workspace are saved in the MED-V workspace between sessions. Additionally, a persistent MED-V workspace is generally used in a domain environment. - -- **Revertible**—In a revertible MED-V workspace, at the completion of each session (that is, when the MED-V workspace is stopped), the MED-V workspace reverts to its original state during deployment. No changes or additions that the user made are saved on the MED-V workspace between sessions. A revertible MED-V workspace cannot be used in a domain environment. - -It is important to decide on the type of MED-V workspace you are creating before deploying the MED-V workspace, because it is not recommended to reconfigure the type of MED-V workspace after a policy has been deployed to users. - -**Note**   -When configuring a policy, a warning symbol appears next to mandatory fields that are not filled in. If a mandatory field is not filled in, the symbol appears on the tab as well. - - - -## In This Section - - -[How to Apply General Settings to a MED-V Workspace](how-to-apply-general-settings-to-a-med-v-workspace.md) -Describes the general settings of a MED-V workspace, and how to apply them to a policy. - -[How to Apply Virtual Machine Settings to a MED-V Workspace](how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md) -Describes the virtual machine settings for a MED-V workspace, and how to apply them to a policy. - -[How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) -Describes how to configure domain users and groups. - -[How to Configure Published Applications](how-to-configure-published-applicationsmedvv2.md) -Describes published applications and menus, and how to apply them to a policy. - -[How to Configure Web Settings for a MED-V Workspace](how-to-configure-web-settings-for-a-med-v-workspace.md) -Describes the Web settings available for a MED-V workspace, and how to apply them to a policy. - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md) -Describes the virtual machine setup for a MED-V workspace, and how to apply it to a policy. - -[How to Apply Network Settings to a MED-V Workspace](how-to-apply-network-settings-to-a-med-v-workspace.md) -Describes the network settings of a MED-V workspace, and how to apply them to a policy. - -[How to Apply Performance Settings to a MED-V Workspace](how-to-apply-performance-settings-to-a-med-v-workspace.md) -Describes the performance settings of a MED-V workspace, and how to apply them to a policy. - -[How to Import and Export a Policy](how-to-import-and-export-a-policy.md) -Describes how to import and export a policy. - - - - - - - - - diff --git a/mdop/medv-v1/creating-a-med-v-image.md b/mdop/medv-v1/creating-a-med-v-image.md deleted file mode 100644 index 4b9d3222fb..0000000000 --- a/mdop/medv-v1/creating-a-med-v-image.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Creating a MED-V Image -description: Creating a MED-V Image -author: dansimp -ms.assetid: 7cbbcd22-83f5-4b60-825f-781b4c6a2d36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a MED-V Image - - -## In This Section - - -This section describes how to configure a MED-V image on a computer on which the MED-V client and MED-V management application are installed, and explains the following: - -[How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) -Describes how to create a MED-V image, and then test the image locally. - -[How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) -Describes how to pack a MED-V image so that it can be added to a deployment package or uploaded to the server. - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) -Describes how to upload a MED-V image to the server. - -[How to Localize a MED-V Image](how-to-localize-a-med-v-image.md) -Describes how to localize a MED-V image either through extracting or downloading the image. - -[How to Update a MED-V Image](how-to-update-a-med-v-image.md) -Describes how to update a MED-V image to create a new version of the image. - -[How to Delete a MED-V Image](how-to-delete-a-med-v-image.md) -Describes how to delete a MED-V image. - -**Note**   -After the MED-V image is configured, the computer should not be part of a domain because the join domain procedure should be performed on the client after the deployment, as part of the MED-V workspace setup. - - - - - - - - - - - diff --git a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md b/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md deleted file mode 100644 index 49db131ccf..0000000000 --- a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Creating a MED-V Workspace -description: Creating a MED-V Workspace -author: dansimp -ms.assetid: 9578bb99-8a09-44c1-b88f-538901f16ad3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a MED-V Workspace - - -A MED-V workspace is the desktop environment in which end users interact with the virtual machine provided by MED-V. The MED-V workspace is created and customized by the administrator. It consists of an image and the policy, which defines the rules and functionality of the MED-V workspace. Multiple MED-V workspaces can be created, each customized with its own configuration, settings, and rules. A user, group, or multiple users or groups can be associated with each MED-V workspace, thereby making the MED-V workspace available only for the associated user's or group's computers. - -## How to Add a MED-V Workspace - - -**To add a MED-V workspace** - -1. Click the **Policy** management button to open the **Policy** module. - - The **Policy** module consists of the **Workspaces** menu on the left and the **General**, **Virtual Machine**, **Deployment**, **Applications**, **Web**, **VM Setup**, **Network**, and **Performance** tabs. - -2. On the **Policy** menu, select **New Workspace**, or click **Add** to create a new MED-V workspace. - -3. On the **General** tab, in the **Name** field, enter the name of the MED-V workspace. - -4. In the **Description** field, enter a description for the MED-V workspace. - -5. In the **Support contact info** field, enter the contact information for technical support. - - For more information about configuring a MED-V workspace, see [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -## How to Clone a MED-V Workspace - - -A MED-V workspace can be cloned so that you can create a MED-V workspace identical to an existing MED-V workspace. - -**To clone a MED-V workspace** - -1. Click the MED-V workspace to clone. - -2. On the **Policy** menu, select **Clone Workspace**. - - A new MED-V workspace is created with the name <Original MED-V workspace name> - 2. - -## How to Delete a MED-V Workspace - - -**To delete a MED-V workspace** - -- In the **Policy** module, while the workspace pane is in focus, click **Remove**. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md b/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md deleted file mode 100644 index c73b1b9457..0000000000 --- a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md +++ /dev/null @@ -1,256 +0,0 @@ ---- -title: Creating a Virtual PC Image for MED-V -description: Creating a Virtual PC Image for MED-V -author: dansimp -ms.assetid: 5e02ea07-25b9-41a5-a803-d70c55eef586 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Creating a Virtual PC Image for MED-V - - -To create a Virtual PC (VPC) image for MED-V, you must perform the following: - -1. [Create a VPC image](#bkmk-creatingavirtualmachinebyusingmicrosoftvirtualpc). - -2. [Install the MED-V workspace .msi package onto the VPC image](#bkmk-howtoinstallthemedvworkspacemsipackage). - -3. [Run the MED-V virtual machine prerequisites tool on the VPC image](#bkmk-howtorunthevirtualmachineprerequisitestool). - -4. [Manually configure virtual machine prerequisites on the VPC image](#bkmk-howtoconfiguremedvvirtualmachinemanualinstallationprerequisites). - -5. [Configure Sysprep for MED-V images](#bkmk-howtoconfiguresysprepformedvimages) (optional). - -6. [Turn off Microsoft Virtual PC](#bkmk-turningoffmicrosoftvirtualpc). - -## Creating a Virtual PC Image by Using Microsoft Virtual PC - - -To create a Virtual PC image using Microsoft Virtual PC, refer to the Virtual PC documentation. - -For more information, see the following: - -- [Windows Virtual PC Help](https://go.microsoft.com/fwlink/?LinkId=182378) - -- [Create a virtual machine and install a guest operating system](https://go.microsoft.com/fwlink/?LinkId=182379) - -## How to Install the MED-V Workspace .msi Package - - -After the Virtual PC image is created, install the MED-V workspace .msi package onto the image. - -**To install the MED-V workspace image** - -1. Start the virtual machine, and copy the MED-V workspace .msi package inside. - - The MED-V workspace .msi package is called *MED-V\_workspace\_x.msi*, where *x* is the version number. - - For example, *MED-V\_workspace\_1.0.65.msi*. - -2. Double-click the MED-V workspace .msi package, and follow the installation wizard instructions. - - **Note** - When a new MED-V version is released, and an existing Virtual PC image is updated, uninstall the existing MED-V workspace .msi package, reboot the computer, and install the new MED-V workspace .msi package. - - - -~~~ -**Note** -After the MED-V workspace .msi package is installed, other products that replace GINA cannot be installed. -~~~ - - - -## How to Run the Virtual Machine Prerequisites Tool - - -The virtual machine (VM) prerequisites tool is a wizard that automates several of the prerequisites. - -**Note** -Although many parameters are configurable in the wizard, the properties required for the proper functioning of MED-V are not configurable. - - - -**To run the virtual machine prerequisites tool** - -1. After the MED-V workspace .msi package is installed, on the Windows **Start** menu, select **All Programs > MED-V > VM Prerequisites Tool**. - - **Note** - The user running the virtual machine prerequisites tool must have local administrator rights and must be the only user logged in. - - - -~~~ -The **MED-V VM Prerequisite Wizard Welcome** page appears. -~~~ - -2. Click **Next**. - -3. On the **Windows Settings** page, from the following configurable properties, select the ones to be configured: - - - **Clear users’ personal history information** - - - **Clear local profiles temp directory** - - - **Disable sounds on following Windows events: start, logon, logoff** - - **Note** - Do not enable Windows page saver in a group policy. - - - -4. Click **Next**. - -5. On the **Internet Explorer Settings** page, from the following configurable properties, select the ones to be configured: - - - **Don't use auto complete features** - - - **Disable reuse of windows for launching shortcuts** - - - **Clear browsing history** - - - **Enable tabbed browsing in Internet Explorer 7** - -6. Click **Next**. - -7. On the **Windows Services** page, from the following configurable properties, select the ones to be configured: - - - **Security center service** - - - **Task scheduler service** - - - **Automatic updates service** - - - **System restore service** - - - **Indexing service** - - - **Wireless Zero Configuration** - - - **Fast User Switching Compatibility** - -8. Click **Next**. - -9. On the **Windows Auto Logon** page, do the following: - - 1. Select the **Enable Windows Auto Logon** check box. - - 2. Assign a **User name** and **Password**. - -10. Click **Apply**, and in the confirmation box that appears, click **Yes**. - -11. On the **Summary** page, click **Finish** to quit the wizard - -**Note** -Verify that group policies do not overwrite the mandatory settings set in the prerequisites tool. - - - -## How to Configure MED-V Virtual Machine Manual Installation Prerequisites - - -Several of the configurations cannot be configured through the virtual machine prerequisites tool and must be performed manually. - -- Virtual Machine Settings - - It is recommended to configure the following virtual machine settings in the Microsoft Virtual PC console: - - - Disable floppy disk drives. - - - Disable undo-disks (**Settings > undo-disks**). - - - Ensure that the image has only one virtual CPU. - - - Eliminate interactions between the virtual machine and the user, where they are not related to published applications (such as, messages requiring user input). - -- Image Settings - - Configure the following manual settings inside the image: - - 1. In the **Power Options Properties** window, disable hibernation and sleep. - - 2. Apply the most recent Windows updates. - - 3. In the **Windows Startup and Recovery** dialog box, in the **System Failure** section, clear the **Automatically restart** check box. - - 4. Ensure that the image uses a VLK license key. - -- Installing VPC Additions - - On the **Action** menu, select **Install or Update Virtual Machine Additions**. - -- Configuring Printing - - You can configure printing from the MED-V workspace in either of the following ways: - - - Add a printer to the virtual machine. - - - Allow printing with printers that are configured on the host computer. - -## How to Configure Sysprep for MED-V Images - - -In a MED-V workspace, Sysprep can be configured in order to assign unique security ID (SID), particularly when multiple MED-V workspaces are run on a single computer. It is not recommended to use Sysprep to join a domain; instead, use the MED-V join domain script action as described in [How to Set Up Script Actions](how-to-set-up-script-actions.md). - -**Note** -Sysprep is Microsoft's system preparation utility for the Windows operating system. - - - -**To configure Sysprep in a MED-V workspace** - -1. Create a directory in the root of the system drive named *Sysprep*. - -2. From the Windows installation CD, extract *deploy.cab* to the root of the system drive, or download the latest Deployment Tools update from the Microsoft Web site. - - - For Windows 2000, see [Deployment Tools update for Windows 2000](https://go.microsoft.com/fwlink/?LinkId=143001). - - - For Windows XP, see [Deployment Tools update for Windows XP](https://go.microsoft.com/fwlink/?LinkId=143000). - -3. Run **Setup Manager** (setupmgr.exe). - -4. Follow the Setup Manager wizard. - -After Sysprep is configured and the MED-V workspace is created, Sysprep must be executed. - -**To run Sysprep** - -1. From the Sysprep folder located in the root of the system drive, run the System Preparation Tool (Sysprep.exe). - -2. In the warning message box that appears, click **OK**. - -3. In the **Sysprep Properties** dialog box, select the **Don't reset grace period for activation** and **Use Mini-Setup** check boxes. - -4. Click **Reseal**. - -5. If you are not satisfied with the information listed in the confirmation message box that appears, click **Cancel** and change the selections. - -6. Click **OK** to complete the system preparation process. - -## Turning Off Microsoft Virtual PC - - -After all the components are installed and configured, close Microsoft Virtual PC and select **Turn Off**. - -## Related topics - - -Creating a MED-V Image -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - - - - - - - - - diff --git a/mdop/medv-v1/define-the-project-scope.md b/mdop/medv-v1/define-the-project-scope.md deleted file mode 100644 index 2d628bd096..0000000000 --- a/mdop/medv-v1/define-the-project-scope.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Define the Project Scope -description: Define the Project Scope -author: dansimp -ms.assetid: 84637d2a-2e30-417d-b150-dc81f414b3a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Define the Project Scope - - -When defining the project scope, determine the following: - -1. The MED-V end users—the location and number of end users are used in determining the location of MED-V client installations and the number of MED-V instances, as well as the number and placement of MED-V image repositories. - -2. The virtual machine (VM) images to be managed by MED-V—to determine the method of distributing images and placement of image repositories. - -3. The organization’s service level expectations—to determine the performance and fault-tolerance requirements for the MED-V server and database as well as the image repository. - -4. Validate with the business—ensure there is a complete understanding of how the planned infrastructure affects the business. - -## Define the MED-V End Users - - -First, determine where the end users are located, as well as the number of users in each location. Second, obtain a network infrastructure diagram that displays the user locations and the available bandwidth to those locations. Third, find out if users travel between locations. If users travel, additional capacity may be required in the design of the server infrastructure and image repositories. - -## Determine the MED-V Images to Be Managed by MED-V - - -After the MED-V end users have been defined, determine which VMs will be managed by MED-V for the users in each location. - -If any of the VMs are stored in a centralized library, determine the location of the library so that it may be evaluated for use as a MED-V repository. - -## Determine the Organization’s Service Level Expectations - - -For each MED-V workspace, note the acceptable time for a new image to load and the timeframe for critical updates to be deployed. - -If applicable, record the service level expectations for MED-V reporting, to be used in the design of the server infrastructure. - -## Validate with the Business - - -Ask business stakeholders and application owners the following questions: - -- Are there any existing images that can be combined? For example, if application A on Windows XP is one VPC image and application B on Windows XP is another VPC image, perhaps a single image can contain both applications, thereby reducing repository space and bandwidth required for image download. - -- Are the in-scope applications licensable and supportable if delivered in a VM by MED-V? Check with the application supplier to ensure that licensing and support terms will not be violated by delivering the application through MED-V. - -  - -  - - - - - diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md deleted file mode 100644 index 52e0292edc..0000000000 --- a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Deploying a MED-V Workspace Using a Deployment Package -description: Deploying a MED-V Workspace Using a Deployment Package -author: dansimp -ms.assetid: e07fa70a-1a9f-486f-9a86-b33593b234da -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying a MED-V Workspace Using a Deployment Package - - -The deployment package installation provides a method of installing MED-V client together with all its required prerequisites as well as any settings predefined by the administrator. - -When using a deployment package, the package is distributed via a shared network or removable media. The image can be included in the package or can be distributed separately. - -Before creating a deployment package, ensure that you have created a MED-V image ready for deployment. For more information on creating a MED-V image, see [Creating a MED-V Image](creating-a-med-v-image.md). - -After the MED-V image is prepared, consider the best method for distributing the image in your environment. The image can be distributed in one of the following ways: - -- Uploaded to the Web and distributed via Web download, optionally using Trim Transfer technology. - -- Distributed using image pre-staging. - -- Included in the deployment package and distributed together with all the other MED-V components. - -If the image will be included in the package, no other configurations are necessary for the image. If the image will not be included in the deployment package, do one of the following: - -- If you are deploying the image via the Web, upload the MED-V image to the image Web distribution server. For information on configuring an image Web distribution server, see [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md). For information on uploading an image to the server, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -- If you are deploying the image via image pre-staging, configure the pre-stage folder, and push the MED-V image to the folder. For more information on configuring the image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -**Note**   -If you are using image pre-staging, it is important to configure the image pre-stage folder prior to creating the deployment package. The folder path needs to be included in the deployment package. - - - -Finally, create the deployment package. For more information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). After the package is complete, distribute it for deployment. - -After the deployment package is distributed, MED-V client can be installed and the image deployed. For more information on installing MED-V client, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). For more information on deploying the image, see [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imagedeployment-package.md). - - - - - - - - - diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md deleted file mode 100644 index 4167d9099f..0000000000 --- a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Deploying a MED-V Workspace Using an Enterprise Software Distribution System -description: Deploying a MED-V Workspace Using an Enterprise Software Distribution System -author: dansimp -ms.assetid: 867faed6-74ce-4573-84be-8bf26e66c08c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying a MED-V Workspace Using an Enterprise Software Distribution System - - -MED-V client can be distributed using an enterprise software distribution system, such as Microsoft System Center Configuration Manager. - -**Note**   -If MED-V is installed by using Microsoft System Center Configuration Manager, when creating a package for MED-V, set the run mode to administrative rights. - - - -Before deploying MED-V using an enterprise software distribution system, ensure that you have created a MED-V image ready for deployment. For more information on creating a MED-V image, see [Creating a MED-V Image](creating-a-med-v-image.md). - -After the MED-V image is prepared, consider the best method for distributing the image in your environment. The image can be distributed in one of the following ways: - -- Uploaded to the Web and distributed via Web download, optionally utilizing Trim Transfer technology. - -- Distributed using image pre-staging. - -## Deploying the Image via the Web - - -If you are deploying the image via the Web, upload the MED-V image to an image Web distribution server. For information on configuring an image Web distribution server, see [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md). For information on uploading an image to the server, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -## Deploying the Image via Pre-staging - - -If you are deploying the image via image pre-staging, configure the pre-stage folder, and push the MED-V image to the folder. For more information on configuring image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -**Note**   -If you are using image pre-staging, it is important to configure the image pre-stage folder prior to pushing the client .msi package. The folder path needs to be included in the client .msi package. - - - -Finally, push the client .msi package using your enterprise software distribution center. MED-V can then be installed and the image deployed. For more information on installing MED-V client, see [How to Install MED-V Client](how-to-install-med-v-clientesds.md). For more information on deploying the image, see [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imageesds.md). - - - - - - - - - diff --git a/mdop/medv-v1/design-the-med-v-image-repositories.md b/mdop/medv-v1/design-the-med-v-image-repositories.md deleted file mode 100644 index 8302861536..0000000000 --- a/mdop/medv-v1/design-the-med-v-image-repositories.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Design the MED-V Image Repositories -description: Design the MED-V Image Repositories -author: dansimp -ms.assetid: e153154d-2751-4990-b94d-a2d76242c15f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Design the MED-V Image Repositories - - -After MED-V images are created and packed, they can be stored on a file server in any location. The files may be sent over HTTP or HTTPS by one or more IIS servers. The image repository can be shared by multiple MED-V instances. - -To design the image repositories, you must first decide how the images will be deployed to each client and then whether that client requires a local image repository. Each repository is then designed and placed, along with its accompanying IIS server. - -## Determine How Images Will Be Deployed - - -For each MED-V workspace, decide how you plan to deploy MED-V images to the client. This is important in determining how many repositories are necessary to store the packed images, where those repositories will be placed, and then to design those repositories. - -Packed images can be deployed in the following ways: - -- Downloaded over the network from an image distribution server, which comprises a file server and IIS server. - -- On removable media, such as a USB drive or DVD. - -- Pre-staged to an image store directory on the client computer using an enterprise software distribution center. - -Decide which method, or methods, will be used to deploy MED-V images to each of the clients and whether the location will require an image repository. - -## Determine the Number of Image Repositories - - -Now that you have determined the minimum number of repositories you need, add more if any of the following criteria apply: - -- Organizational or regulatory reasons to separate the MED-V images—some MED-V images may not be able to coexist in the same repository. For example, sensitive personal data may require storage on a server that is only available to a limited set of employees who need access to the data. - -- Clients in isolated networks—if images will be deployed over the network, determine whether any networks are isolated and require a separate repository. For example, organizations often isolate lab networks from production networks. - -- Clients in remote networks—if images will be deployed over the network, some client machines may be separated from the repository by network links that have insufficient bandwidth to provide an adequate experience when a client loads a MED-V workspace. If necessary, design additional MED-V instances to address this need. - -Add these repositories to the design. Decide on a name for each repository and the reason for designing it. Decide which MED-V images the repositories will hold and which MED-V clients will load MED-V workspaces with images from the repository. - -## Design and Place the Image Repositories - - -When a new image is available to clients, clients begin downloading the image, possibly simultaneously. This creates a high demand on the repository and must be taken into account when designing the image repository. - -For each repository, determine the amount of data it will store. Sum the sizes of images that will be stored in the repository. This is the value of the disk space required on the file server. - -Next, add up the number of clients that may download MED-V images from the repository. This is the maximum number of concurrent downloads that can occur when a new MED-V image is loaded into the repository. The file server must be designed with a disk subsystem that can meet the IO demands this will create. - -The image repository can reside on the same system as the MED-V server and the server running SQL Server, or on a remote file share. You can also run it in a Windows Server 2008 Hyper-V VM. Check the network location of the clients that the image repository will service, and place the repository in a network location where it will have sufficient bandwidth to meet the service level expectations of those clients. - -### Fault Tolerance - -If the image repository is unavailable, clients will not be able to download new or updated MED-V images. To design fault-tolerance options for the file server and fault-tolerant disks, see the [Infrastructure Planning and Design Microsoft SQL Server 2008](https://go.microsoft.com/fwlink/?LinkId=163302) guide. - -## Design and Place the IIS Servers - - -This section is only relevant if clients will download image files over the network using HTTP or HTTPS. - -The IIS server can coexist on the same system as the MED-V server and the server running SQL Server. It can also run in a Windows Server 2008 Hyper-V VM. The IIS server infrastructure must have sufficient throughput to deliver images to clients within the service level expectations of the organization. It must be designed with a disk subsystem that can meet the IO demands this creates. - -For each image repository, sum the number of clients that may download MED-V images using IIS. This is the maximum number of concurrent downloads that can occur when an image is loaded into the repository. Use the throughput sum and the service level expectations determined in [Define the Project Scope](define-the-project-scope.md) to plan the design of the IIS server infrastructure and to determine the appropriate amount of bandwidth to allocate for the repository. - -To design the IIS infrastructure, see the [Infrastructure Planning and Design Microsoft Internet Information Services](https://go.microsoft.com/fwlink/?LinkId=160826) guide. - -### Fault Tolerance - -If the IIS server infrastructure is unavailable, clients will not be able to download new or updated images. To configure fault tolerance, the Windows Server 2008-based IIS server can be placed in a failover cluster. To design the fault tolerance for the IIS server infrastructure, see the [Infrastructure Planning and Design Microsoft Internet Information Services](https://go.microsoft.com/fwlink/?LinkId=160826) guide. - -## Related topics - - -[Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md) - -[Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/design-the-med-v-server-infrastructure.md b/mdop/medv-v1/design-the-med-v-server-infrastructure.md deleted file mode 100644 index 40536204ff..0000000000 --- a/mdop/medv-v1/design-the-med-v-server-infrastructure.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Design the MED-V Server Infrastructure -description: Design the MED-V Server Infrastructure -author: dansimp -ms.assetid: 2781040f-880e-4e16-945d-a38c0adb4151 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Design the MED-V Server Infrastructure - - -In this topic, you will design the server infrastructure for each MED-V instance. This includes determining whether the SQL Server instance will exist on the MED-V server or on a remote server, as well as the size of the SQL Server database. You will also determine the location of the management console. - -## Design and Place the Server for Each MED-V Instance - - -The MED-V server implements policies and stores state and history data about its clients. - -### Form Factor - -MED-V recommends using a 2.8-GHz dual core CPU server with 2 GB of RAM. This recommendation is based on the assumption that the MED-V server will run on a dedicated machine and that SQL Server and the MED-V management console will run on separate machines. - -Given this workload, the MED-V server should be relatively lightly loaded. In the absence of specific architectural guidance on the server form factor, design the server using the MED-V recommendation, with memory that matches the organization’s standard form factor. The MED-V server can be run on a virtual machine (VM) on Windows Server 2008 Hyper-V. If a VM will be used, ensure that it has access to CPU and memory resources equivalent to those specified for a physical machine. - -The disk capacity the MED-V server requires must be sufficient to store the MED-V workspace configuration files. A MED-V workspace can only use one VM, and one policy, for one or more users. Therefore, the number of MED-V workspaces that must be stored depends on the degree to which different policies are required for different users of the same VM, as well as the number of VMs that will be used. The MED-V workspace XML files are around 30 KB in size for a typical MED-V workspace. To determine the required disk capacity, multiply 30 KB by the number of MED-V workspaces that the MED-V server will store. - -The MED-V server’s most important network connections are the links to its clients, therefore place the server in a network location that provides the most available bandwidth and the most robust links to its clients. - -### Fault Tolerance - -There can only be one active MED-V server in a MED-V instance, and MED-V does not include standard capabilities to place the server in a Microsoft Cluster Server (MSCS) cluster to provide fault tolerance. A passive backup server can be manually configured. - -To decide whether a passive backup server should be manually configured for the MED-V instance, determine whether users will be permitted to use the MED-V images in offline mode. For information on offline mode, see [How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md). If users are not allowed to work offline, they will be unable to continue working in the event of a MED-V server failure, even if the MED-V workspace has already been started on the client. If offline work is permitted, for each MED-V workspace, determine how long the client is allowed to work offline before it must authenticate. This is the maximum amount of time that the server can be unavailable. - -## Design and Place the SQL Server Database - - -The MED-V server uses the SQL Server database to store client status and events. You can install the SQL Server database on the same machine as the MED-V server or you can place it on a separate server running SQL Server, which can optionally be remote. You can share the database with other MED-V instances, in which case events and alerts from those instances will be stored in the same database, and reports will include events from all instances. You can install the database in an existing SQL Server instance, and the databases of other MED-V servers can reside in that same instance. - -If you place the database server in a location that is remote from the MED-V server, across networks links that do not have sufficient bandwidth available, reports may be slow to load in the console and may not display the latest data from clients. Refer to the organization service level expectations that you determined in [Define the Project Scope](define-the-project-scope.md) and use that information to decide where to place the SQL Server database. - -### Form Factor - -If you will run SQL Server on the same server as MED-V, and if SQL Server will only be used to store data for that server, start with the MED-V recommendation and add resources for the SQL Server load. If SQL Server will store events and alerts from more than one MED-V instance, for information on how to scale up the server form factor, see the [Infrastructure Planning and Design Microsoft SQL Server 2008](https://go.microsoft.com/fwlink/?LinkId=163302) guide (http:// go.microsoft.com/fwlink/?LinkId=163302). - -The size of the database depends on the number of client events that the database will store. Events are created by normal operation of the client, such as when a MED-V workspace is started, or when there is an error in the MED-V workspace. The default interval at which the client sends events is 1 minute. - -To estimate the size of the database, determine the following: - -- Number of clients in the MED-V instance. The maximum is 5,000. - -- Typical event arrival rate. This rate depends on client usage behavior but is approximately 15 to 20 events per day per client. - -- Event size. The size is typically around 200 bytes. - -- Storage amount. The number of days for which events will be stored. - -Multiply these values together to calculate the size of the required data storage in bytes, and then add a safety factor to account for the following: - -- Errors, which could create a large number of events from a client in a short period of time. - -- Database table and organizational space. - -To approximate the infrastructure optimization per second (IOPs) requirement, use the above values, multiplying the typical event arrival rate by the number of clients in the instance. This yields the number of records that can be written per day. Divide that number by 86,400 to derive the number of records written per second. If a write operations can be equated with a single infrastructure optimization (IO) operation, this number is the write IOPs required. Add a buffer to that for reporting activity. This is difficult to determine but depends on the number of consoles in use with the instance and the frequency with which they are used to generate reports. - -### Fault Tolerance - -When MED-V client is running, if the server is unavailable, events will be backed up on the client and reports will be unavailable in the management console. Refer to the organization’s service level expectations determined in [Define the Project Scope](define-the-project-scope.md) to decide whether the design of a fault-tolerant SQL Server infrastructure is necessary. - -MED-V does not provide support for running SQL Server in an MSCS cluster. In order to provide warm standby and to avoid data loss in the event of a failure, you can place SQL Server in a log shipping configuration. For information on log shipping, see the [Infrastructure Planning and Design Microsoft SQL Server 2008](https://go.microsoft.com/fwlink/?LinkId=163302) guide (https://go.microsoft.com/fwlink/?LinkId=163302). - -## Design the Management Console - - -Part of the functionality of the MED-V management console is to test VMs before they are packed for distribution to MED-V clients. Therefore, the management console should be designed with a form factor that resembles, as closely as possible, the form factor of a typical MED-V client machine. - -The management console application is installed together with the MED-V client and uses Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918. A client operating system must be used; the MED-V management console cannot run on the same system as the MED-V server. - -You cannot share a management console with multiple MED-V server instances. The address of the MED-V server is specified during the installation of the management console’s MED-V client; this can be changed after installation, but at any time the management console can only work with a single MED-V server. - -You can use multiple management consoles with a single MED-V server. To avoid conflicts, a mechanism is available that notifies other console users when one console has made changes to a MED-V workspace. - -For each MED-V instance, determine how many management consoles will be needed and where they will be placed. Select a typical MED-V client form factor to be used for the management console. - -## Related topics - - -[MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) - -[Configuring MED-V Server for Cluster Mode](configuring-med-v-server-for-cluster-mode.md) - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md b/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md deleted file mode 100644 index 5165183f3c..0000000000 --- a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Examples of Virtual Machine Configurations -description: Examples of Virtual Machine Configurations -author: dansimp -ms.assetid: 5937601e-41ab-4ca2-8fa1-3c9154710cd6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Examples of Virtual Machine Configurations - - -The following are examples of typical virtual machine configurations: one in a persistent MED-V workspace and one in a revertible MED-V workspace. - -**Note**   -These examples are not intended for use in all environments. Adjust the configuration according to your environment. - - - -**To configure a typical domain setup in a persistent MED-V workspace** - -1. Configure Sysprep on the base image to create a unique SID. For more information, see [Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md#bkmk-howtoconfiguresysprepformedvimages). - -2. On the **VM Setup** tab, select the **Run VM Setup** check box. - -3. In the **VM Computer Name Pattern** section, configure the pattern for the machine image name. For more information, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md). - -4. Click **Script Editor**, and in the **VM Setup Script Editor** dialog box, configure the following actions: - - 1. **Rename Computer** - - 2. **Restart Windows** - - 3. **Check Connectivity** - - 4. **Join Domain** - - 5. **Disable Auto-Logon** - - For more information, see [How to Set Up Script Actions](how-to-set-up-script-actions.md). - -5. On the **Policy** menu, click **Commit**. - -**To configure a typical setup in a revertible workspace** - -1. On the **VM Setup** tab, select the **Rename the VM based on the computer name pattern** check box. - -2. In the **VM Computer Name Pattern** section, configure the pattern for the machine image name. For more information, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md). - -3. On the **Policy** menu, click **Commit**. - -## Related topics - - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) - -[How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - - - - - - - - - diff --git a/mdop/medv-v1/getting-started-with-med-v.md b/mdop/medv-v1/getting-started-with-med-v.md deleted file mode 100644 index 969a8b0a46..0000000000 --- a/mdop/medv-v1/getting-started-with-med-v.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Getting Started with MED-V -description: Getting Started with MED-V -author: dansimp -ms.assetid: 5832cdb3-3892-4048-b29d-7644e75117f0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Getting Started with MED-V - - -This section provides general information for administrators using Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 and MED-V 1.0 SP1. - -## In This Section - - -[Overview of MED-V](overview-of-med-v.md) - -[High-Level Architecture](high-level-architecturemedv.md) - -[Key Scenarios for Using MED-V](key-scenarios-for-using-med-v.md) - -[About MED-V 1.0](about-med-v-10.md) - -[About MED-V 1.0 SP1](about-med-v-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/high-level-architecturemedv.md b/mdop/medv-v1/high-level-architecturemedv.md deleted file mode 100644 index 7badb94bbd..0000000000 --- a/mdop/medv-v1/high-level-architecturemedv.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: High-Level Architecture -description: High-Level Architecture -author: dansimp -ms.assetid: a78e12ad-5aa6-40e0-ae8b-51acaf005712 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture - - -The MED-V solution comprises the following elements: - -- **Administrator-defined virtual machine**—Encapsulates a full desktop environment, including an operating system, applications, and optional management and security tools. - -- **Image repository**—Stores all virtual images on a standard IIS server and enables virtual images version management, client-authenticated image retrieval, and efficient download (of a new image or updates) via Trim Transfer technology. - -- **Management server**—Associates virtual images from the image repository along with administrator usage policies to Active Directory® users or groups. The management server also aggregates clients' events and stores them in an external database (Microsoft SQL Server®) for monitoring and reporting purposes. - -- **Management console**—Enables administrators to control the management server and the image repository. - -- **End-user client** - - 1. Virtual image life-cycle—Authentication, image retrieval, enforcement of usage policies. - - 2. Virtual machine session management—Start, stop, lock the virtual machine. - - 3. Single desktop experience—Applications installed in the virtual machine seamlessly available through the standard desktop Start menu and integrated with other applications on the user desktop. - -All communication between the client and the servers (management server and image repository) is carried on top of a standard HTTP or HTTPS channel. - -![](images/506f54d0-38fa-446a-8070-17ae26da5355.gif) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md deleted file mode 100644 index 5d9bdb7412..0000000000 --- a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: How to Apply General Settings to a MED-V Workspace -description: How to Apply General Settings to a MED-V Workspace -author: dansimp -ms.assetid: 6152dced-e301-4fa2-bfa0-aecf3c23f23a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply General Settings to a MED-V Workspace - - -The general settings enable you to configure the basic user experience when working with a MED-V workspace, by defining whether the MED-V workspace will appear in seamless integration or full desktop mode. Seamless integration includes legacy applications in the host desktop so that they appear as if they are installed directly on the host. Full desktop presents the desktop of the MED-V workspace operating system in a separate window on the host. - -All general settings are configured in the **Policy** module, on the **General** tab. - -**To apply general settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. Configure the general properties as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**General Workspace Properties** - -Property -Description -*Workspace Properties* - -Name - -The name of the MED-V workspace. - -**Warning**   -Do not rename an existing MED-V workspace while it is running on a client computer. - - - -Description - -Description of the MED-V workspace, which can include the content or status of the MED-V workspace and any other useful information. - -**Note**   -The description is for administrator use and has no impact on the policy. - - - -Support contact info - -The contact information for technical support. The information entered will be displayed in the support contact information screen that can be accessed from the MED-V client notification area. - -*Workspace UI* - -Seamless Integration - -Select this option for the MED-V workspace windows, taskbar, and notification area icons to integrate seamlessly into the host desktop. - -Draw a frame around each workspace window - -When using seamless integration, select this option to create a colored border around all applications running within the MED-V workspace and a colored background for all taskbar button icons. In the **Frame color** field, select the color. - -Full Desktop - -Select this option to display the MED-V workspace as the entire desktop, without integrating with the host. - -*Host Verification* - -Command line - -Type a command line to run on the host before starting the MED-V workspace. - -Do not start the Workspace if the verification fails (exit code is not '0') - -Select this check box if you are using a command line and want to start the MED-V workspace only if the script is completed successfully. - - - -A command line can be run on the host prior to starting the MED-V workspace. - -**To run a command line before starting a MED-V workspace** - -1. In the **Command line** field, enter a command line. - -2. To start the MED-V workspace only if the command line was successful, select the **Do not start the workspace if the verification fails** check box. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md deleted file mode 100644 index 4846278e8e..0000000000 --- a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: How to Apply Network Settings to a MED-V Workspace -description: How to Apply Network Settings to a MED-V Workspace -author: dansimp -ms.assetid: 641f46b3-a56f-478a-823b-1d90aa1716b3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply Network Settings to a MED-V Workspace - - -Administrators can define the network settings for each MED-V workspace. - -All network settings are configured in the **Policy** module, on the **Network** tab. - -**To apply network settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Network** pane, configure the settings as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**MED-V Workspace Network Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          TCP/IP Properties

            -
          • Use host's IP address (NAT)—The workspace will use NAT to share the host's IP for outgoing traffic.

          • -
          • Use different IP address than host (Bridge)—The MED-V workspace will have its own network address, usually obtained via DHCP.

          • -
          -

          Select the Map multiple adapters into Workspace check box when the host computer has multiple adapters. It is recommended to use this configuration when the host moves between different networks using different adapters.

          DNS Server

            -
          • Don't change—DNS settings that are set within the MED-V workspace virtual machine will not be changed.

          • -
          • Use Host's DNS address—MED-V workspace DNS settings will be synchronized to match the host's settings. The DNS synchronization is dynamic. It is synchronized periodically with the host so that if it is changed on the host, it will change dynamically in the MED-V workspace.

          • -
          • Use specific DNS addresses—The MED-V workspace will use a specific DNS, as specified.

            -

            In the Primary and Secondary fields, enter the primary and secondary DNS addresses.

            -

            Select the Append Host's DNS addresses check box to append the host to the configured DNS addresses.

          • -

          Assign DNS Suffixes

            -
          • Assign the following suffixes—Select this check box to assign specific DNS suffixes; in the box, enter a suffix or multiple suffixes separated by commas.

          • -
          • Append host suffixes—Select this check box to append the host suffixes to the DNS address.

          • -
          - -  - -## Related topics - - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md deleted file mode 100644 index bb5b64f7e8..0000000000 --- a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Apply Performance Settings to a MED-V Workspace -description: How to Apply Performance Settings to a MED-V Workspace -author: dansimp -ms.assetid: e0fed1e1-6e8f-4d65-ab83-b950a17661c0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply Performance Settings to a MED-V Workspace - - -The following performance setting can be defined for each MED-V workspace: - -VM memory allocation - -Performance settings are configured in the **Policy** module, on the **Performance** tab. - -**To apply performance settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Performance** pane, configure the settings as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**Performance Settings Properties** - - ---- - - - - - - - - - - - - -
          PropertyDescription

          Adjust VM memory, based on amount of the Host machine's physical memory

          Select this check box, and configure the following virtual machine properties in the table:

          -
            -
          • Host Memory—Define the common host RAM configuration in your organization based on any numbers of groups to configure.

          • -
          • VM Memory—Enter the amount of host memory to allocate to the virtual machine.

          • -
          - -  - -## Related topics - - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md deleted file mode 100644 index 197b944570..0000000000 --- a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: How to Apply Virtual Machine Settings to a MED-V Workspace -description: How to Apply Virtual Machine Settings to a MED-V Workspace -author: dansimp -ms.assetid: b50d0dfb-8d61-4543-9607-a29bbb1ed45f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply Virtual Machine Settings to a MED-V Workspace - - -Every MED-V workspace must have a Microsoft Virtual PC image associated with it. The virtual machine settings enable you to assign a Virtual PC image as well as set other virtual machine properties. - -All virtual machine settings are configured in the **Policy** module, on the **Virtual Machine Settings** tab. - -**To apply virtual machine settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. Configure the virtual machine properties as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**Virtual Machine Properties** - -Property -Description -*Virtual Machine Settings* - -Assigned Image - -The actual Microsoft Virtual PC image assigned to the MED-V workspace. The menu provides a list of all available Virtual PC images. The following image types are in the **Active** image list: - -- **Local test images**—Images on the local computer that are not yet packed. These image names are followed by the word “test” in parentheses (test) and are for testing purposes only. - -- **Local packed images**—Packed images on the local computer. These images are followed by the word “local” in parentheses (local) and cannot be downloaded by clients until the administrator uploads them to the server. - - A local image can be selected if you are creating a package that will be distributed to the client via removable media (such as USB or DVD). - -- **Packed images on server**—Images that are on the server and are available for download by clients. Click Refresh to refresh the images list. - - **Note**   - Each MED-V workspace image can only be used by one Windows user. - - - -Workspace is persistent - -Select this check box to configure the MED-V workspace as persistent. In a persistent MED-V workspace, when the MED-V workspace is stopped, changes and additions to the MED-V workspace are saved in the MED-V workspace. - -For a Domain MED-V workspace, this option must be selected. - -**Note**   -This setting should not be changed after a MED-V workspace is deployed to users. - - - -Shut down the VM when stopping the Workspace - -Select this check box to shut down the virtual machine when stopping the MED-V workspace. If this check box is cleared, at the completion of each session, the virtual machine is not shut down but instead takes a snapshot of the virtual machine. Upon the initiation of a new session, Windows starts from the snapshot (that is, Windows does not restart and no login is required). - -**Note**   -This property is enabled only if **Workspace is persistent** is selected. - - - -Logon to Windows in VM using MED-V credentials (SSO) - -Select this check box to log in to Windows on the virtual machine by using the MED-V credentials entered when logging in to MED-V client. - -**Note**   -This property is enabled only when **Workspace is persistent** is selected. - - - -Workspace is revertible - -Select this check box to configure the MED-V workspace as revertible. In a revertible MED-V workspace, at the completion of each session (that is, when the user stops the MED-V workspace), the MED-V workspace reverts to the original state it was in during deployment. No changes or additions that the user made are saved on the MED-V workspace between sessions. - -**Note**   -This setting should not be changed after a MED-V workspace is deployed to users. - - - -Synchronize Workspace time zone with host - -Select this check box to synchronize the time zone in the MED-V workspace with the host. - -The synchronization works differently depending on whether the MED-V workspace is persistent or revertible, as follows: - -- In a persistent MED-V workspace, the time zone first tries to synchronize with the server. If that fails, it synchronizes with the host. - -- In a revertible MED-V workspace, the time zone synchronizes with the host. - -*Lock Settings* - -Lock the Workspace on host standby/hibernate event - -Select this check box to automatically lock the MED-V workspace when the host computer goes into standby or hibernate. - -Lock the Workspace after - -Select this check box to lock the MED-V workspace when the MED-V workspace is idle for a specified period of time. When selected, the number box is enabled. Enter the number of minutes of idle time before locking the MED-V workspace. - -**Note**   -The idle time refers to the MED-V workspace applications (not the host applications). - - - -*Image Update Settings* - -Keep only - -Select this check box to limit the number of old image versions to keep. - -When selected, the number box is enabled. Enter the number of old versions to keep. - -Suggest update when a new version is available - -Select this check box to suggest (but not force) an update when a new version of the image is available. - -Clients should use Trim Transfer when downloading images for this Workspace - -Select this check box to enable Trim Transfer (for more information, see [MED-V Trim Transfer Technology](med-v-trim-transfer-technology-medvv2.md)) when downloading images associated with this MED-V workspace. If this check box is cleared, the full image will be downloaded. - -**Note**   -Trim Transfer requires indexing the hard drive, which might take a considerable amount of time. It is recommended to use Trim Transfer when indexing the hard drive is more efficient than downloading the new image version, such as when downloading an image version that is similar to the existing version. - - - - - -## Related topics - - -[Creating a MED-V Image](creating-a-med-v-image.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md b/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md deleted file mode 100644 index 3a7c44c436..0000000000 --- a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Back Up and Restore a MED-V Server -description: How to Back Up and Restore a MED-V Server -author: dansimp -ms.assetid: 8d05e3a4-279b-4ce6-a319-8a09e7a30c60 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Back Up and Restore a MED-V Server - - -XML files located on the server can be backed up and then restored in case of loss of data on the server. - -**To back up a MED-V server** - -- Back up the following files, located in *<InstallDir>\\Servers\\ConfigurationServer*: - - **Note**   - If the configuration has been changed from the default, the files might be stored in a different location. - - - - - ClientPolicy.xml - - - ClientSettings.xml - - - ConfigurationFiles.xml - - - OrganizationPolicy.xml - - - WorkspaceKeys.xml - - **Note**   - The ServerSettings.xml file can be backed up as well. However, if a specific configuration has been changed (for example, on the original server, the MED-V VMS directory is located in "*C:\\Vms*" and such a directory does not exist on the new server), it can cause an error. - - - -**To restore a MED-V server** - -1. Install a new MED-V server. - -2. Copy the backup files to the following directory: - - *<InstallDir>\\Servers\\ConfigurationServer* - -3. Restart the MED-V service. - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-a-deployment-package.md b/mdop/medv-v1/how-to-configure-a-deployment-package.md deleted file mode 100644 index 6d2a5b4f31..0000000000 --- a/mdop/medv-v1/how-to-configure-a-deployment-package.md +++ /dev/null @@ -1,162 +0,0 @@ ---- -title: How to Configure a Deployment Package -description: How to Configure a Deployment Package -author: dansimp -ms.assetid: 748272a1-6af2-476e-a3f1-87435b8e94b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure a Deployment Package - - -The Packaging wizard walks you through the creation of a package by creating a folder on your local computer and transferring all the required installation files to the single folder. The contents of the folder can then be moved to multiple removable media drives for distribution. - -**Note** -A single package cannot contain installation files for both x86 and x64 systems. - - - -## How to Create a Deployment Package - - -**To create a deployment package** - -1. Verify in the **Images** module that you have created at least one local packed image. - -2. On the **Tools** menu, select **Packaging wizard**. - -3. On the **Packaging wizard** welcome page, click **Next**. - -4. On the **Workspace Image** page, select the **Include image in the package** check box to include an image in the package. - - The **Image** field is enabled. - - **Note** - An image is not required in a MED-V package; the package can be created without an image. In such a case, the image should be uploaded to the server so that it can later be downloaded over the network to the client, or pushed to an image pre-stage folder. - - - -5. Click the **Image** list to view all available images. Select the image to be copied to the package. Click **Refresh** to refresh the list of available images. - -6. Click **Next**. - -7. On the **MED-V Installation Settings** page, select the MED-V installation file by doing one of the following: - - - In the **MED-V installation file** field, type the full path to the directory where the installation file is located. - - - Click **...** to browse to the directory where the installation file is located. - - **Note** - This field is mandatory, and the wizard will not continue without a valid file name. - - - -8. In the **Server address** field, type the server name or IP address. - -9. In the **Server port** field, type the server port. - -10. Select the **Server is accessed using https** check box to require an https connection to connect to the server. - -11. Do one of the following: - - - Click **Default installation settings**, and then click **Next** to continue and leave the default settings. - - - Click **Custom installation settings**, and then click **Next** to customize the installation settings. - - 1. On the **MED-V Installation Custom Settings** page, in the **Installation folder** field, type the path of the folder where the MED-V files will be installed on the host computer. - - **Note** - It is recommended to use variables in the path rather than constants, which might vary from computer to computer. - - For example, use *%ProgramFiles%\\MED-V* instead of *c:\\MED-V*. - - - - ~~~ - 2. In the **Virtual machines images folder** field, type the path of the folder where the virtual images files will be installed on the host computer. - - **Note** - If you are using image pre-staging, this is the image pre-stage folder where the image is located. - - - - 3. In the **Minimal required RAM** field, enter the RAM required to install a MED-V package. If the user installing the MED-V package does not have the minimal required RAM, the installation will fail. - - 4. Select the **Install the MED-V management application** check box to include the MED-V management console application in the installation. - - 5. Select the **Create a shortcut to MED-V on the desktop** check box to create a shortcut to MED-V on the host's desktop. - - 6. Select the **Start automatically on computer startup** check box to start MED-V automatically on startup. - - 7. Click **Next**. - ~~~ - -12. On the **Additional Installations** page, select the **Include installation of virtualization software** check box to include the Virtual PC installation in the package. - - The **Installation file** field is enabled. Type the full path of the virtualization software installation file, or click **...** to browse to the directory. - -13. Select the **Include installation of Virtual PC QFE** check box to include Virtual PC update installation in the package. - - The **Installation file** field is enabled. Type the full path of the Virtual PC update installation file, or click **...** to browse to the directory. - -14. Select the **Include installation of Microsoft .NET Framework 2.0** check box to include the Microsoft .NET Framework 2.0 installation in the package. - - The **Installation file** field is enabled. Type the full path of the Microsoft .NET Framework 2.0 installation file, or click **...** to browse to the directory. - -15. Click **Next**. - -16. On the **Finalize** page, select the location where the package should be saved by doing one of the following: - - - In the **Package destination** field, type the full path to the directory where the package should be saved. - - - Click **...** to browse to the directory where the installation files should be saved. - - **Note** - Building the package might consume more space than the actual package size. It is therefore recommended to build the package on the hard drive. After the package is created, it can then be copied to the USB. - - - -17. In the **Package name** field, enter a name for the package. - -18. Click **Finish** to create the package. - - The package is created. This might take several minutes. - - After the package is created, a message appears notifying you that it has been completed successfully. - -**Note** -If you saved all the files locally, and not directly on the removable media, ensure that you copy only the contents of the folder and not the folder itself to the removable media. - - - -**Note** -The removable media must be large enough so that the package contents consume a maximum of only three-quarters of the removable media's memory. - - - -**Note** -When creating the package, up to double the size of the actual package size might be required when the build is complete. - - - -## Related topics - - -[Creating a MED-V Image](creating-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md b/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md deleted file mode 100644 index 7669269fc7..0000000000 --- a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: How to Configure a Domain User or Group -description: How to Configure a Domain User or Group -author: dansimp -ms.assetid: 055aba81-a9c9-4b98-969d-775e603becf3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure a Domain User or Group - - -The deployment settings enable you to control which users or groups can access the MED-V workspace, as well as how long the MED-V workspace can be utilized and whether it can be used offline. You can also configure additional rules to control access between the MED-V workspace and the host. - -All MED-V workspace permissions are configured in the **Policy** module, on the **Deployment** tab. - -To allow users to utilize the MED-V workspace, you must first add domain users or groups to the MED-V workspace permissions. You can then set permissions for each user or group. - -## How to Add a Domain User or Group - - -**To add a domain user or group** - -1. In the **Users / Groups** window, click **Add.** - -2. In the **Enter User or Group names** dialog box, select domain users or groups by doing one of the following: - - - In the **Enter User or Group names** field, type a user or group that exists in the domain or as a local user or group on the computer. Then click **Check Names** to resolve it to the full existent name. - - - Click **Find** to open the standard **Select Users or Groups** dialog box. Then select domain users or groups. - -3. Click **OK**. - - The domain users or groups are added. - - **Note** - Users from trusted domains should be added manually. - - - -~~~ -**Warning** -Do not run the management application from a computer that is part of a domain that is not trusted by the domain the server is installed on. -~~~ - - - -## How to Remove a Domain User or Group - - -**To remove a domain user or group** - -1. In the **Users / Groups** window, select a user or group. - -2. Click **Remove**. - - The user or group is deleted. - -## How to Set Permissions for a User or a Group - - -**To set permissions for a user or a group** - -1. Click the user or group for which you are setting the permissions. - -2. Configure the MED-V workspace properties as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**Workspace Deployment Properties** - -Property -Description -*General* - -Enable Workspace for <user or group> - -Select this check box to enable the MED-V workspace for this user or group. - -Workspace expires on this date - -Select this check box to assign an expiration date for the permissions set for this user or group. - -When selected, the date box is enabled. Set the date, and permissions will expire at the end of the date specified. - -Offline work is restricted to - -Select this check box to assign a time period in which the policy must be refreshed for this user or group. When selected, the time period box is enabled. Set the number of days or hours, and at the end of the specified time period, the user or group will not be able to connect if the policy is not refreshed. - -Workspace deletion options - -Click to set the MED-V workspace deletion options. For more information, see [How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md). - -*Data Transfer* - -Support clipboard between host and Workspace - -Select this check box to enable copying and pasting between the host and the MED-V workspace. - -Support file transfer between the host and Workspace - -Select this check box to enable transferring files between the host and MED-V workspace. Select one of the following options from the **File Transfer** box: - -- **Both**—Enable transferring files between the host and the MED-V workspace. - -- **Host to Workspace**—Enable transferring files from the host to the MED-V workspace. - -- **Workspace to Host**—Enable transferring files from the MED-V workspace to the host. - -**Note** -If a user without permissions attempts to transfer files, a window will appear prompting him to enter the credentials of a user with permissions to perform the file transfer. - - - -**Important** -To support file transfer in Windows XP SP3, you must disable offline file synchronization by editing the registry as follows: - -`REG ADD HKLM\software\microsoft\windows\currentversion\netcache /V Enabled /T REG_DWORD /F /D 0` - - - -Advanced - -Click to set the advanced file transfer options. For more information, see [How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md). - -*Device Control* - -Enable printing to printers connected to the host - -Select this check box to enable users to print from the MED-V workspace using the host printer. - -**Note** -The printing is performed by the printers defined on the host. - - - -Enable access to CD / DVD - -Select this check box to allow access to a CD or DVD drive from this MED-V workspace. - - - -**Multiple Memberships** - -1. If the user is part of a group and permissions are applied to the user as well as to the group they are part of, all permissions are applied. - -2. If the user is a member of two different groups, the least restrictive permissions are applied. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md) - -[How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-image-pre-staging.md b/mdop/medv-v1/how-to-configure-image-pre-staging.md deleted file mode 100644 index 5503edfefa..0000000000 --- a/mdop/medv-v1/how-to-configure-image-pre-staging.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: How to Configure Image Pre-staging -description: How to Configure Image Pre-staging -author: dansimp -ms.assetid: 92781b5a-208f-45a4-a078-ee90cf9efd9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Image Pre-staging - - -**Note**   -Image pre-staging is useful only for the initial image download. It is not supported for image update. - - - -## How to Configure Image Pre-staging - - -**To configure image pre-staging** - -1. On the client computer, under the image store directory, create a folder for the pre-staging image, and name it *MED-V Images*. - - **Note**   - This folder must be called *MED-V Images*. - - - -2. Inside the MED-V Images folder, create a subfolder and name it *PrestagedImages*. - - **Note**   - This folder must be called *PrestagedImages*. - - - -3. To apply Access Control Lists (ACL) security to the *MED-V Images* folder, set the following ACL: - - **NT AUTHORITY\\Authenticated Users:(OI)(CI)(special access:)** - - **READ\_CONTROL** - - **SYNCHRONIZE** - - **FILE\_GENERIC\_READ** - - **FILE\_READ\_DATA** - - **                                 FILE\_APPEND\_DATA** - - **FILE\_READ\_EA** - - **FILE\_READ\_ATTRIBUTES** - - **NT AUTHORITY\\SYSTEM:(OI)(CI)F** - - **BUILTIN\\Administrators:(OI)(CI)F** - - **Note**   - It is recommended to apply ACL security to the *MED-V Images* folder. - - - -4. To apply ACL security to the *PrestagedImages* folder, set the following ACL: - - **NT AUTHORITY\\Authenticated Users:(OI)(CI)(special access:)** - - **READ\_CONTROL** - - **SYNCHRONIZE** - - **FILE\_GENERIC\_READ** - - **FILE\_READ\_DATA** - - **FILE\_READ\_EA** - - **FILE\_READ\_ATTRIBUTES** - - **NT AUTHORITY\\SYSTEM:(OI)(CI)F** - - **BUILTIN\\Administrators:(OI)(CI)F** - - **Note**   - It is recommended to apply ACL security to the *PrestagedImages* folder. - - - -5. Push the image files (CKM and INDEX files) to the *PrestagedImages* folder. - - **Note**   - After the image files have been pushed to the pre-stage folder, it is recommended to run a data integrity check and to mark the files as read-only. - - - -6. Include the following parameter in the MED-V client installation: *Client.MSI VMSFOLDER=”C:\\MED-V Images”*. - -## How to Update the Pre-stage Location - - -**To update the pre-stage location** - -1. The registry key, *PrestagedImagesPath*, points to the default image location. It is located in the following directory: - - - On an x86 - `KEY_LOCAL_MACHINE\SOFTWARE\Kidaro` - - - On an x64 - `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432node` - -2. If the image is in a different location, change the path. - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md b/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md deleted file mode 100644 index 5d812e35d6..0000000000 --- a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md +++ /dev/null @@ -1,240 +0,0 @@ ---- -title: How to Configure Published Applications -description: How to Configure Published Applications -author: dansimp -ms.assetid: 43a59ff7-5d4e-49dc-84e5-1082bc4dd8f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Published Applications - - -Applications that are not compatible with the host operating system can be run within the MED-V workspace and initiated from within the MED-V workspace the same way they are initiated from the desktop—from the Start menu or from a local host shortcut. Applications selected and defined are called published applications. The procedures in this section describe how to add and remove published applications. - -An application can be published in one of the following ways: - -- As an application—Select a specific application by typing in the command line for the application. Only the application selected is published. - -- As a menu—Select a folder that contains multiple applications. All applications within the folder are published and displayed as a menu. - -## How to Add a Published Application to a MED-V Workspace - - -**To add an application to the MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Applications** pane, in the **Published Applications** section, click **Add** to add a new application. - -3. Configure the application properties as described in the following table. - -4. On the **Policy** menu, select **Commit**. - - **Note** - If you are setting Internet Explorer as a published application to ensure that Web redirection works properly, make certain that any parameters are not in parentheses. - - - -**Published Application Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Enabled

          Select this check box to enable the published application.

          Display name

          The name of the shortcut in the user's Windows Start menu.

          -
          -Note

          The display name is not case sensitive.

          -
          -
          - -

          Description

          A description of the published application, which appears as a tooltip when the user's mouse hovers over the shortcut.

          Command line

          The command used to run the application from within the MED-V workspace. The full path is required, and the parameters can be passed to the application in a similar fashion as in any other Windows command.

          -

          In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \tux\date".

          -

          For example, to publish Windows Explorer, use the following syntax: "c:</em>" or "c:\windows."

          -
          -Note

          To have a name resolution, you need to perform one of the following:

          -
          -
          - -
          -
            -
          • Configure the DNS in the base MED-V workspace image.

          • -
          • Verify the DNS resolution is defined in the host, and configure it to use the host DNS.

          • -
          • Use the IP for defining the network drive.

          • -
          -
          -Note

          If the path includes spaces, the entire path must be inside quotation marks.

          -
          -
          - -
          -
          -Note

          The path should not end with a backslash ().

          -
          -
          - -

          Start menu

          Select this check box to create a shortcut for the application in the user's Windows Start menu.

          - - - -All published applications appear as shortcuts in the Windows **Start** menu (**Start >All Programs> MED-V Applications**). - -## How to Remove a Published Application from a MED-V Workspace - - -**To remove an application from the MED-V workspace** - -1. Click a MED-V workspace. - -2. In the **Applications** pane, in the **Published Applications** section, select an application to remove. - -3. Click **Remove**. - - The application is removed from the list of published applications. - -4. On the **Policy** menu, select **Commit**. - -## How to Add a Published Menu to a MED-V Workspace - - -**To add a published menu to the MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Applications** pane, in the **Published Menus** section, click **Add** to add a new menu. - -3. Configure the menu properties as described in the following table. - -4. On the **Policy** menu, select **Commit**. - -**Published Menu Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Enabled

          Select this check box to enable the published menu.

          Display name

          The name of the shortcut in the user's Windows Start menu.

          Description

          The description, which appears as a tooltip when the user's mouse hovers over the shortcut.

          Folder in workspace

          Select the folder to publish as a menu containing all the applications within the folder.

          -

          The text displayed is a relative path from the Programs folder.

          -
          -Note

          If left blank, all programs on the host will be published as a menu.

          -
          -
          - -
          - - - -All published menus appear as shortcuts in the Windows **Start** menu (**Start >All Programs> MED-V Applications**). You can change the name of the shortcut in the **Start-menu shortcuts folder** field. - -**Note** -When configuring two MED-V workspaces, it is recommended to configure a different name for the Start menu shortcuts folder. - - - -## How to Remove a Published Menu from a MED-V Workspace - - -**To remove a published menu from a MED-V workspace** - -1. Click a MED-V workspace. - -2. In the **Applications** pane, in the **Published Menus** section, select a menu to remove. - -3. Click **Remove**. - - The menu is removed from the list of published menus. - -4. On the **Policy** menu, select **Commit**. - -## Running a Published Application from a Command Line on the Client - - -The administrator can run published applications from any location, such as a desktop shortcut, using the following command: - -``` syntax -"\Manager\KidaroCommands.exe" /run "" "" -``` - -**Note** -The MED-V workspace in which the published application is defined must be running. - - - -## Related topics - - -[How to Edit a Published Application with Advanced Settings](how-to-edit-a-published-application-with-advanced-settings.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md b/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md deleted file mode 100644 index 3db5f49a03..0000000000 --- a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Configure the Image Web Distribution Server -description: How to Configure the Image Web Distribution Server -author: dansimp -ms.assetid: 2d32ae79-dff5-4c05-a412-dd15452b6007 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure the Image Web Distribution Server - - -An image repository is an optional server that is used for image distribution (where administrators upload new images and client computers check the server every 15 minutes and update their image if a new one is available). - -## - - -An image distribution server requires the following: - -- Internet Information Services (IIS)—For information, see [Internet Information Services](https://go.microsoft.com/fwlink/?LinkId=142995). - - During the IIS installation, when adding role services, select the following supported authentication methods: - - - **Basic Authentication** - - - **Windows Authentication** - - - **Client Certificate Mapping Authentication** - - When configuring IIS, include the following: - - - Add a virtual directory, with the alias named **MEDVImages**. The physical path should point to the location of the images. - - - Enable BITS. - - - Add the following MIME types: - - - **.ckm (application/octet-stream)** - - - **.index (application/octet-stream**) - - - On the MED-V site, add read permissions to **Everyone**. - - - Restart IIS. - -- BITS Server Extensions for IIS—For information, see [Install BITS Server Extensions](https://go.microsoft.com/fwlink/?LinkId=142996). - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - -[Design the MED-V Image Repositories](design-the-med-v-image-repositories.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md deleted file mode 100644 index 61a363f290..0000000000 --- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Configure the Virtual Machine Setup for a MED-V Workspace -description: How to Configure the Virtual Machine Setup for a MED-V Workspace -author: dansimp -ms.assetid: a4659b4d-18b2-45b1-9605-8b5adc438f53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Virtual Machine Setup for a MED-V Workspace - - -The procedures in this section describe how to configure the virtual machine for first-time setup. - -The virtual machine setup configures the setup performed when the virtual machine is run on the client for the first time. The virtual machine setup is configured differently for persistent and revertible MED-V workspaces. For more information about persistent and revertible MED-V workspaces, see [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -## In This Section - - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) -Describes how to configure the virtual machine setup for persistent and revertible MED-V workspaces. - -[How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) -Describes how to configure virtual machine computer name pattern properties for persistent and revertible MED-V workspaces. - -[Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) -Provides examples of virtual machine configurations in both persistent and revertible MED-V workspaces. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md deleted file mode 100644 index aded377291..0000000000 --- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: How to Configure the Virtual Machine Setup for a MED-V Workspace -description: How to Configure the Virtual Machine Setup for a MED-V Workspace -author: dansimp -ms.assetid: 50bbf58b-842c-4b63-bb93-3783903f6c7d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Virtual Machine Setup for a MED-V Workspace - - -All virtual machine setup configuration settings are configured in the **Policy** module, on the **VM Setup** tab. - -## How to Configure the Virtual Machine Setup for a Persistent MED-V Workspace - - -**To configure the virtual machine setup for a persistent MED-V workspace** - -1. Click a persistent MED-V workspace to be configured. - -2. In the **Persistent VM Setup** section, configure the properties as described in the following table. - - **Note** - The persistent VM setup properties are enabled only for a persistent MED-V workspace. - - - -3. On the **Policy** menu, select **Commit**. - -**Persistent VM Setup Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Run VM Setup

          Select this check box to run a setup script the first time the MED-V workspace is run.

          Script Editor

          Click to configure the setup script. For more information, see How to Set Up Script Actions.

          -
          -Note

          This button is enabled only when Run VM Setup script is selected.

          -
          -
          - -

          Message displayed when script is running

          A message to be displayed while the script is running. If left blank, the default message is displayed.

          -
          -Note

          This field is enabled only when Run VM Setup script is checked.

          -
          -
          - -
          - - - -## How to Configure the Virtual Machine Setup for a Revertible MED-V Workspace - - -**To configure the virtual machine setup for a revertible MED-V workspace** - -1. Click a revertible MED-V workspace to configure. - -2. In the **Revertible VM Setup** section, configure the properties as described in the following table. - - **Note** - The revertible VM setup properties are enabled only for a revertible MED-V workspace. - - - -3. On the **Policy** menu, select **Commit**. - -**Revertible VM Setup Properties** - - ---- - - - - - - - - - - - - -
          PropertyDescription

          Rename the VM based on the computer name pattern

          Select this check box to assign a unique name to each computer using the MED-V workspace so that you can differentiate between multiple computers using the same MED-V workspace.

          -

          For more information on configuring computer image names, see How to Configure VM Computer Name Pattern Properties.

          - - - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md b/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md deleted file mode 100644 index 6bea34fef3..0000000000 --- a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: How to Configure VM Computer Name Pattern Properties -description: How to Configure VM Computer Name Pattern Properties -author: dansimp -ms.assetid: ddf79ace-8cc3-4ee6-be5a-5940b4df5c36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure VM Computer Name Pattern Properties - - -A virtual machine computer name pattern can be assigned both for revertible and for persistent MED-V workspaces. - -- Revertible—Administrators can assign a unique name to each revertible MED-V workspace instance to differentiate between multiple computers using the same MED-V workspace. - -- Persistent—In a persistent MED-V workspace, administrators can set a computer to be renamed during a setup script. - -## How to Assign a Virtual Machine Computer Name Pattern to a Revertible MED-V Workspace - - -**To assign a virtual machine computer name pattern to a revertible MED-V workspace** - -1. Click the revertible MED-V workspace to configure. - -2. In the **Revertible VM Setup** section, select the **Rename the VM based on the computer name pattern** check box. - -3. In the **VM Computer Name Pattern** section, enter the pattern to use for naming virtual machine images, using the following options: - - - **Constant**—Enter free text that will be constant on all computers using the MED-V workspace. - - - **Variable**—Enter a variable, by clicking **Insert Variable**, and select from one of the following: - - - **User name** - - - **Domain name** - - - **Host name** - - - **Workspace name** - - - **Virtual machine name** - - The variable selected will be specific to the computer using the MED-V workspace. For example, if **Domain name** is selected, the unique name for each computer will include the computer's domain name. - - - **Random characters**—Enter “\#” for each random character to include in the pattern. Each computer using the MED-V workspace will have a suffix of the length specified, which is generated randomly. - - **Note** - The computer name has a limit of 15 characters. If the pattern exceeds the limit, it will be truncated. - - - -4. On the **Policy** menu, select **Commit**. - - **Note** - A revertible VM computer name pattern can be assigned only when **Rename the VM based on the computer name patterns** (in the **Revertible VM Setup** section) is checked. - - - -~~~ -**Note** -A unique computer name can be assigned only if it is configured prior to MED-V workspace setup. Changing the name will not affect MED-V workspaces that were already set up. -~~~ - - - -## How to Assign a Virtual Machine Computer Name Pattern to a Persistent MED-V Workspace - - -**To assign a virtual machine computer name pattern to a persistent MED-V workspace** - -1. Click the persistent MED-V workspace to configure. - -2. In the **Persistent VM Setup** section, click **Script Editor**. - -3. In the **Script Actions** dialog box, click **Add**, and on the submenu, click **Rename Computer**. - -4. Click **OK** to close the **Script Actions** dialog box. - -5. On the **VM Setup** tab, in the **VM Computer Name Pattern** section, enter the pattern to use for renaming the computer, using the following: - - - **Constant**— Enter free text that will be included in the computer name. - - - **Variable**—Enter a variable, by clicking **Insert Variable**, and select from one of the following: - - - **User name** - - - **Domain name** - - - **Host name** - - - **Workspace name** - - - **Virtual machine name** - - The variable selected will be specific to the computer that is being renamed. For example, if **Domain name** is selected, the computer name will include the computer's domain name. - - - **Random characters**— Enter “\#” for each random character to include in the pattern. The computer will have a suffix of the length specified, which is generated randomly. - - **Note** - The computer name has a limit of 15 characters. If the pattern exceeds the limit, it will be truncated. - - - -6. On the **Policy** menu, select **Commit**. - - **Note** - The computer will be renamed only if it is set as an action in the **Script Actions** dialog box. For detailed information, see [How to Set Up Script Actions](how-to-set-up-script-actions.md). - - - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - -[Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md deleted file mode 100644 index 463ab388e1..0000000000 --- a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md +++ /dev/null @@ -1,139 +0,0 @@ ---- -title: How to Configure Web Settings for a MED-V Workspace -description: How to Configure Web Settings for a MED-V Workspace -author: dansimp -ms.assetid: 9a6cd28f-7e4f-468f-830a-7b1d9abd3af3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Web Settings for a MED-V Workspace - - -Web sites that can only be displayed in older versions of Internet Explorer and that do not exist in the host operating system can be viewed in older versions of Internet Explorer within the MED-V workspace. The user does not need to open a browser in the MED-V workspace to view the specified Web sites. The user can open a browser on the host and automatically be redirected to the MED-V workspace and vice versa. - -The following procedures describe how you can set a list of Web browsing rules for a MED-V workspace. All sites included in the rules can be browsed either in the MED-V workspace or on the host, as defined by the administrator. All sites not defined within the rules are browsed from the environment in which they were requested. However, you can configure them as a group as well, to be browsed in the MED-V workspace or the host. - -**Note** -Web settings are applied only to Internet Explorer and to no other browsers. - - - -All Web settings are configured in the **Policy** module, on the **Web** tab. - -## How to Configure Web Settings for the MED-V Workspace - - -**To configure Web settings for the MED-V workspace** - -1. Click the MED-V workspace to be configured. - -2. Select the **Browse the list of URLs defined in the following table** check box to redirect the user to a browser within the MED-V workspace or host, when the user browses to a URL that conforms to the Web rules specified. - -3. Click one of the following: - - - **In the Workspace**—Redirect to a browser in the MED-V workspace. - - - **In the host**—Redirect to a browser on the host. - -4. Select the **Browse all other URLs** check box to redirect all URLs excluded from the Web rules to the host or MED-V workspace. - -5. Click one of the following: - - - **In the Workspace**—Redirect all other URLs to a browser in the MED-V workspace. - - - **In the host**—Redirect all other URLs to a browser on the host. - -6. On the **Policy** menu, select **Commit**. - -## How to Add a Web Rule - - -**To add a Web rule** - -1. Select the **Browse the list of URLs defined in the following table** check box to enable the Web browsing rules. - -2. Click **Add**. - - A new Web rule is added. - -3. Configure the Web rule properties as described in the following table. - -4. On the **Policy** menu, select **Commit**. - -**MED-V Workspace Web Properties** - - ---- - - - - - - - - - - - - - - - - -
          PropertyDescription

          Type

            -
          • Domain suffix—Access to any host address ending with the suffix specified in the Value property and is set according to the option set in Web Browsing.

          • -
          • IP Prefix—Access to any full or partial IP address in the range of the prefix specified in the Value property and is set according to the option set in Web Browsing.

          • -
          • All Local Addresses—Access to all addresses without a '.' and is set according to the option set in Web Browsing.

          • -

          Value

            -
          • If Domain suffix is selected in the Type property, enter a domain suffix.

            -
            -Note
              -
            • Do not enter "*" before the suffix.

            • -
            • Domain suffixes support aliases as well.

            • -
            -
            -
            - -
          • -
          • If IP Prefix is selected in the Type property, enter a full or partial IP address.

          • -
          - - - -## How to Delete a Web Rule - - -**To delete a Web rule** - -1. In the **Web** pane, select the Web rule to delete. - -2. Click **Remove**. - - The Web rule is deleted. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md b/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md deleted file mode 100644 index c63893f150..0000000000 --- a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md +++ /dev/null @@ -1,156 +0,0 @@ ---- -title: How to Create and Test a MED-V Image -description: How to Create and Test a MED-V Image -author: dansimp -ms.assetid: 40e4aba6-12cb-4794-967d-2c09dc20d808 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create and Test a MED-V Image - - -The MED-V administrator creates a MED-V image so that it can be uploaded, associated with a MED-V workspace, and then distributed to the client over the Web, added to a MED-V package, or downloaded to the client by using a third-party system. It is recommended to first create a test image and test it on MED-V client before deploying it. - -When creating a MED-V image, it goes through the following stages: - -1. **Local test image**—A basic image that can be tested locally. - -2. **Local packed image**—After the image is tested, the image is packed as it existed prior to testing. No changes made during testing are included in the packed image. - -3. **Packed image on server**—The packed image is uploaded to the server. - -## How to Create a MED-V Test Image - - -**To create a new MED-V test image** - -1. Click the **Images** management button. - - The **Images** module appears. - - - The **Images** module consists of the following panes: - - - **Local Test Images**—Local unpacked images. - - - **Local Packed Images**—All packed images on the local computer. - - - **Packed Images on Server**—All images that have been packed and uploaded to the server. - - - In the **Local Packed Images** and **Packed Images on Server** panes, the most recent version of each image is displayed as the parent node. Click the parent node to view all other existing versions of the image. - -2. In the **Local Test Images** pane, click **New**. - -3. On the **Test Image Creation** dialog box, select the virtual machine image that you want to configure as a MED-V test image by doing one of the following: - - - In the **Base image** file field, type the full path to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - - - Click **Browse** to browse to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - -4. In the **Image name** field, type or select the desired name. - - **Note**   - The following characters cannot be included in the image name: space " < > | \\ / : \* ? - - - -5. Click **OK**. - - A new MED-V test image is created on your host computer with the properties defined in the following table. - - For more information about configuring the MED-V workspace image, refer to [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -**Local Test Images Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Image Name

          The name of the test image as it was defined when the administrator created the image.

          Image Path

          The local path of the test image.

          Created

          The date the test image was created.

          - - - -## How to Test a MED-V Image from the MED-V Client - - -After a MED-V test image is created, use the following procedure to test the image locally. - -**To test a MED-V image** - -1. Click the **Policy** management button. - -2. In the **Policy** module, assign the MED-V test image to a MED-V workspace by doing the following: - - 1. Click the **Virtual Machine** tab. - - 2. In the **Assigned Image** field, select the MED-V test image you created. If your test image is not in the list, click **Refresh**. - - 3. On the toolbar, click **Save changes**. - -3. Configure any other MED-V workspace settings to be tested. For more information, see [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -4. Start MED-V client. - -5. In the **Confirm Running Test** confirmation box, click **Use Test Image**. - -6. Test the MED-V workspace test image. - - For information about starting and running MED-V client, see [MED-V Client Operations](med-v-client-operations.md). - -**Note**   -While testing an image, do not open VPC and make changes to the image. - - - -**Note**   -When testing an image, no changes are saved to the image between sessions; instead, they are saved in a separate, temporary file. This is to ensure that when the image is packed and run on the production environment, it is the original, clean image. - - - -## Related topics - - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) - -[MED-V Client Operations](med-v-client-operations.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-delete-a-med-v-image.md b/mdop/medv-v1/how-to-delete-a-med-v-image.md deleted file mode 100644 index 02d9bb6115..0000000000 --- a/mdop/medv-v1/how-to-delete-a-med-v-image.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: How to Delete a MED-V Image -description: How to Delete a MED-V Image -author: dansimp -ms.assetid: 974a493a-7627-4c64-9294-89441f127916 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a MED-V Image - - -## How to Delete a MED-V Image - - -**To delete a MED-V image** - -1. Click the image or the version of the image to delete. - -2. On the **Images** menu, click **Delete**. - - The image is deleted. - -## Related topics - - -[How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md b/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md deleted file mode 100644 index d849956376..0000000000 --- a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Deploy a Workspace Image -description: How to Deploy a Workspace Image -author: dansimp -ms.assetid: b2c77e0d-101d-4956-a27c-8beb0e4f262e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy a Workspace Image - - -When using a deployment package, a new image can be deployed onto client computers in one of the following ways: - -- [Web download](#bkmk-howtodeployaworkspaceimageviatheweb) - -- [Image pre-staging](#bkmk-howtodeployaworkspaceimageusingimageprestaging) - -- [Deploying the image inside the deployment package](#bkmk-howtodeployaworkspaceimageusingadeploymentapackage) - -## How to Deploy a Workspace Image via the Web - - -**To deploy a workspace image via the Web** - -1. Upload the MED-V image to the server. - - For information on uploading the image, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -2. Create a deployment package, and include the server path to the location of the image. - - For information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). - -3. Deploy the package to end users. - - For information on deploying the package, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). - - MED-V client is installed and started for the first time. On first-time startup, the client downloads the image from the server address specified in the client installation. - -## How to Deploy a Workspace Image Using Image Pre-staging - - -**To deploy a workspace image using image pre-staging** - -1. Create an image pre-stage folder, and push the image to the folder. - - For information on configuring image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -2. Create a deployment package, and include the path to the image pre-stage folder. - - For information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). - -3. Deploy the package to end users. - - For information on deploying the package, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). - - MED-V client is installed and started for the first time. On first-time startup, the client fetches the image from the pre-stage folder specified in the client installation. - -## How to Deploy a Workspace Image Using a Deployment Package - - -**To deploy a workspace image using a deployment package** - -1. Create a deployment package, and include the image in the package. - - For information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). - -2. Deploy the package to end users. - - For information on deploying the package, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). - - The image is imported to the host as part of the package installation. - -## Related topics - - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) - -[How to Configure a Deployment Package](how-to-configure-a-deployment-package.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md b/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md deleted file mode 100644 index 5eb6dd5c1c..0000000000 --- a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Deploy a Workspace Image -description: How to Deploy a Workspace Image -author: dansimp -ms.assetid: ccc8e89b-1625-4b58-837e-4c6d93d46070 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy a Workspace Image - - -When using an enterprise software distribution system, a new image can be deployed onto client computers in one of the following ways: - -- [Web download](#bkmk-howtodeployaworkspaceimageviatheweb) - -- [Image pre-staging](#bkmk-howtodeployaworkspaceimageusingimageprestaging) - -## How to Deploy a Workspace Image via the Web - - -**To deploy a workspace image via the Web** - -1. Upload the MED-V image to the server. - - For information on uploading the image, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -2. Using your enterprise software distribution system, install the MED-V client .msi package on users’ computers. - - For information on installing the MED-V client .msi package, see [How to Install MED-V Client](how-to-install-med-v-clientesds.md). - - MED-V client is installed and started for the first time. On first-time startup, the client downloads the image from the server address specified in the client installation. - -## How to Deploy a Workspace Image Using Image Pre-staging - - -**To deploy a workspace image using image pre-staging** - -1. Create an image pre-stage folder, and push the image to the folder. - - For information on configuring image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -2. Using your enterprise software distribution system, install the MED-V client .msi package on users’ computers. - - For information on installing the MED-V client .msi package, see [How to Install MED-V Client](how-to-install-med-v-clientesds.md). - - MED-V client is installed and started for the first time. On first-time startup, the client fetches the image from the pre-stage folder specified in the client installation. - -## Related topics - - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md b/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md deleted file mode 100644 index babf8996d1..0000000000 --- a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: How to Edit a Published Application with Advanced Settings -description: How to Edit a Published Application with Advanced Settings -author: dansimp -ms.assetid: 06a79049-9ce9-490f-aad7-fd4fdf185590 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit a Published Application with Advanced Settings - - -After a published application has been added and configured, the published application can be edited and additional advanced settings can be configured. - -**To edit a published application with advanced settings** - -1. In the **Applications** pane, add and configure a published application. - -2. Select the published application to edit. - -3. Click **Edit**. - -4. In the **Published Application** dialog box, configure the parameters as described in the following table. - -5. Click **OK**. - -6. On the **Policy** menu, select **Commit**. - -**Editing Published Application Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Display name

          The name of the shortcut in the user's Windows Start menu.

          -
          -Note

          The display name is not case sensitive.

          -
          -
          - -

          Description

          A description of the published menu.

          Start in

          The directory from which to start the application.

          -
          -Note

          The path does not need to include quotation marks.

          -
          -
          - -

          Command line

          The command with which to run the application from within the MED-V workspace.

          -

          The full path is required, and the parameters can be passed to the application in a similar fashion as in any other Windows command.

          -

          In a domain configuration, a shared drive usually exists on the server where all domain computers map to. The directory should be mapped here, and if it is a folder that requires user authentication, the Use MED-V credentials to run this application check box must be selected.

          -

          In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \tux\data".

          -

          For example, to publish Windows Explorer, use the following syntax: "c:&quot; or "c:\windows".

          -
          -Note

          To have a name resolution, you need to perform one of the following:

          -
          -
          - -
          -
            -
          • Configure the DNS in the base MED-V workspace image.

          • -
          • Verify that the DNS resolution is defined in the host, and configure it to use the host DNS.

          • -
          • Use the IP for defining the network drive.

          • -
          -
          -Note

          If the path includes spaces, the entire path must be inside quotation marks.

          -
          -
          - -
          -
          -Note

          The path should not end with a backslash ().

          -
          -
          - -

          Add a shortcut in the host Windows Start menu

          Select this check box to create a shortcut for the application in the user's Windows Start menu.

          Launch this application when the Workspace is started

          Select this check box to run the application automatically when the MED-V workspace starts.

          Use MED-V credentials to run this application

          Select this check box to authenticate applications that request a user name and password using the MED-V credentials instead of the credentials set for the application.

          -
          -Note

          When using SSO, the command line should be C:\Windows\Explorer.exe "folder path". When not using SSO, the command line should be "folder path".

          -
          -
          - -
          - - - -## Related topics - - -[How to Configure Published Applications](how-to-configure-published-applicationsmedvv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-generate-reports-medvv2.md b/mdop/medv-v1/how-to-generate-reports-medvv2.md deleted file mode 100644 index e9219aa508..0000000000 --- a/mdop/medv-v1/how-to-generate-reports-medvv2.md +++ /dev/null @@ -1,313 +0,0 @@ ---- -title: How to Generate Reports -description: How to Generate Reports -author: dansimp -ms.assetid: 9f8ba28e-1993-4c11-a28a-493718051e5d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Generate Reports - - -The following report types can be created by administrators in MED-V: - -- [Status](#bkmk-generatingastatusreport)—Use the status report to review the current status of all active users and all MED-V workspaces of each user based on a defined period of time. This includes viewing computers that are currently connected to the server or, if they are not currently connected, the date and time they were last connected to the server, the status of each computer, and other relevant information. - -- [Activity Log](#bkmk-generatinganactivitylogreport)—Use this report to review events that originated from a specific host or user in a defined date range. - -- [Error Log](#bkmk-generatinganerrorlogreport)—Use this report to view errors that originated from a specific host or user in a defined date range. - -The report results can be sorted by any column by clicking the appropriate column name. - -The report results can be grouped by dragging a column header to the top of the report. Drag multiple column headers to group one column after another. - -## How to Generate a Status Report - - -**To generate a status report** - -1. Click the **Reports** management button. - -2. In the **Reports** module, on the **Report Types** menu, select **Status**, and click **Generate**. - - The Report Parameters dialog box appears. - -3. In the **Report Parameters** dialog box, in the **Number of days** field, enter a number or use the arrows to select the number of days to include in the status report, and click **OK**. - - A status report is generated. The report parameters are defined in the following table. - -**Client MED-V Workspace Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Time

          The date and time the event occurred.

          -
          -Note

          By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.

          -
          -
          - -

          User Name

          The user who initiated the event.

          -
          -Note

          If the event occurred before a user logged on, the user name is SYSTEM.

          -
          -
          - -

          Host Name

          The name of the host computer.

          Workspace Name

          The name of the MED-V workspace.

          Workspace Computer Name

          The name of the computer the MED-V workspace is running on.

          Online

          The current state of the client computer:

          -
            -
          • Stopped

          • -
          • Started at <date and time the workspace was started>

          • -

          Client Version

          The version number of the client.

          Policy Version

          The policy version that the MED-V workspace is currently using.

          Image Name

          The name of the image.

          Image Version

          The image version that the MED-V workspace is currently using.

          -
          -Note

          MED-V workspace version can be Unknown if it has not yet been downloaded onto a computer.

          -
          -
          - -
          - - - -## How to Generate an Activity Log Report - - -**To generate an activity log report** - -1. Click the **Reports** management button. - - The Reports module appears. - -2. In the **Reports** module, on the **Report Types** menu, select **Activity Log**, and click **Generate**. - -3. In the **Report Parameters** dialog box, configure one or more of the following parameters: - - - **Number of days**—The number of days to display in the report. - - - **User name contains**—Any event where the user name contains the text entered is included in the report. - - - **Host name contains**—Any event where the host name contains the text entered is included in the report. - -4. Click **OK**. - - A report is generated with the events and dates selected. The report parameters are defined in the following table. - -**Activity Log Report Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Event ID

          The event ID.

          Severity

          Information, Error, Warning

          Category

          The module that the report is referring to.

          Description

          A description of the event.

          Time Received

          The date and time the event was received on the server.

          -
          -Note

          If the client is working offline, the server receives the reports when the client is online.

          -
          -
          - -
          -
          -Note

          By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.

          -
          -
          - -

          Client Time

          The date and time the event occurred according to the client clock.

          Host Name

          The name of the host computer.

          User Name

          The user who initiated the event.

          Workspace Name

          The name of the MED-V workspace.

          Workspace Computer Name

          The name of the computer the MED-V workspace is running on.

          - - - -## How to Generate an Error Log Report - - -**To generate an error log report** - -1. Click the **Reports** management button. - -2. In the **Reports** module, on the **Report Types** menu, select **Error Log**, and click **Generate**. - -3. In the **Report Parameters** dialog box, configure one or more of the following parameters: - - - **Number of days**—The number of days to display in the report. - - - **User name contains**—Any event where the user name contains the text entered is included in the report. - - - **Host name contains**—Any event where the host name contains the text entered is included in the report. - -4. Click **OK**. - - A report is generated with the events and dates selected. The report parameters are defined in the following table. - -**Error Log Report Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Event ID

          The event ID.

          Category

          The module that the report is referring to.

          Description

          A description of the event.

          Time Received

          The date and time the event was received on the server.

          -
          -Note

          If the client is working offline, the server receives the reports when the client is online.

          -
          -
          - -
          -
          -Note

          By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.

          -
          -
          - -

          Client Time

          The date and time the event occurred according to the client clock.

          Host Name

          The name of the host computer.

          User Name

          The user who initiated the event.

          Workspace Name

          The name of the MED-V workspace.

          - - - - - - - - - - - diff --git a/mdop/medv-v1/how-to-import-and-export-a-policy.md b/mdop/medv-v1/how-to-import-and-export-a-policy.md deleted file mode 100644 index aaa08137dc..0000000000 --- a/mdop/medv-v1/how-to-import-and-export-a-policy.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Import and Export a Policy -description: How to Import and Export a Policy -author: dansimp -ms.assetid: c86455de-2096-4bb1-b9d3-22efb42f3317 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Import and Export a Policy - - -A MED-V workspace policy can be imported into MED-V or exported from MED-V. - -## How to Import a Policy - - -**To import an existing policy** - -1. In the **Policy** module, on the **Policy** menu, select **Import**. - -2. In the **Import policy** dialog box, browse to the file containing the policy to import. - -3. Click **Open**. - - The policy is imported, replacing the existing policy. - -## How to Export a Policy - - -**To export a policy** - -1. In the **Policy** module, on the **Policy** menu, select **Export**. - -2. In the **Export policy** dialog box, browse to the directory where the policy will be exported. - -3. Enter a name for the policy file. - -4. Click **Save**. - - The policy is exported. - -## Related topics - - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md deleted file mode 100644 index 16597d58b2..0000000000 --- a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md +++ /dev/null @@ -1,197 +0,0 @@ ---- -title: How to Install and Configure the MED-V Server Component -description: How to Install and Configure the MED-V Server Component -author: dansimp -ms.assetid: 2d3c5b15-df2c-4ab6-bf78-f47ef8ae7418 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install and Configure the MED-V Server Component - - -This section explains how to [install](#bkmk-howtoinstallthemedvserver) and [configure](#bkmk-howtoconfigurethemedvserver) the MED-V server. - -## How to Install the MED-V Server - - -**To install the MED-V server** - -1. Install the MED-V Server .msi package. - - The MED-V Server .msi package is called *MED-V\_Server\_x.msi*, where x is the version number. - - For example, *MED-V\_Server\_1.0.65.msi*. - -2. When the **InstallShield Wizard Welcome** screen appears, click **Next**. - -3. On the **License Agreement** screen, read the license agreement, click **I accept the terms in the license agreement**, and then click **Next**. - - The **Destination Folder** screen appears, with the default installation folder displayed. - - The default installation folder is *%systemdrive%\\Program Files\\Microsoft Enterprise Desktop Virtualization\\*. - - - To change the folder where MED-V should be installed, click **Change** and browse to an existing folder. - -4. Click **Next**. - -5. On the **Ready to Install the Program** screen, click **Install**. - - The MED-V server installation starts. This can take several minutes, and the screen might not display text. During installation, several progress screens appear. If a message appears, follow the instructions provided. - -6. When the **InstallShield Wizard Completed** screen appears, click **Finish** to complete the wizard. - -**Note** -If you are installing the MED-V server via Microsoft Remote Desktop, use the following syntax: **mstsc/admin**. Ensure that your RDP session is directed to the console. - - - -## How to Configure the MED-V Server - - -The following server settings can be configured: - -- [Connections](#bkmk-configuringconnections) - -- [Images](#bkmk-configuringimages) - -- [Permissions](#bkmk-configuringpermissions) - -- [Reports](#bkmk-configuringreports) - -### Configuring Connections - -**To configure connections** - -1. On the Windows Start menu, select **All Programs > MED-V > MED-V Server Configuration Manager**. - - **Note** - Note: If you selected the **Launch MED-V Server Configuration Manager** check box during the server installation, the MED-V server configuration manager starts automatically after the server installation is complete. - - - -~~~ -The MED-V Server Configuration Manager appears. -~~~ - -2. On the **Connections** tab, configure the following client connections settings: - - - **Enable unencrypted connections (http), using port**—Select this check box to enable unencrypted connections using a specified port. In the port box, enter the server port on which to accept unencrypted connections (http). - - - **Enable encrypted connections (https), using port**—Select this check box to enable encrypted connections using a specified port. In the port box, enter the server port on which to accept encrypted connections (https). - - Https is an optional configuration which can be set to ensure secure transactions between the MED-V server and MED-V clients. To configure https, you must perform the following procedures: - - - Configure a certificate on the server. - - - Associate the server certificate with the port specified using netsh. For information, see the following: - - - [Netsh Commands for Hypertext Transfer Protocol (HTTP)](https://go.microsoft.com/fwlink/?LinkId=183314) - - - [How to: Configure a Port with an SSL Certificate](https://go.microsoft.com/fwlink/?LinkID=183315) - - - [How to: Configure a Port with an SSL Certificate](https://msdn.microsoft.com/library/ms733791.aspx) - -3. Click **OK**. - -### Configuring Images - -**To configure images** - -1. Click the **Images** tab. - -2. Configure the following image management settings: - - - **VMs Directory**—The virtual machine directory (the directory where the images are stored). This field contains a UNC path to the image directory on the image distribution server that should be accessible from the MED-V server. - - - **VMs URL**—The location of the server where the images are stored. - -3. Click **OK**. - -### Configuring Permissions - -**To configure permissions** - -1. Click the **Permissions** tab. - -2. A list of all users who can log in is provided. To apply read and write permissions to a user, select the check box next to the user. To apply read-only permissions to a user, clear the check box. - -3. To add domain users or groups, click **Add**. - - The **Enter User or Group names** dialog box appears. - - 1. Select domain users or groups by doing one of the following: - - - In the **Enter User or Group names** field, type a user or group that exists in the domain or exists as a local user or group on the computer. Then click **Check Names** to resolve it to the full existent name. - - - Click **Find** to open the standard **Select Users or Groups** dialog box. Then select domain users or groups. - - 2. Click **OK**. - -4. To remove domain users or groups, select a user or group and click **Remove**. - -5. Click **OK**. - -### Configuring Reports - -**To configure reports** - -1. Click the **Reports** tab. - -2. To support reports, select **Enable reports**. - -3. In the **Connection String** box, enter a connection string for the MSSQL database. - - - When SQL Server is installed on a remote server, use the following connection string: - - `Data Source=;Initial Catalog=;uid=sa;pwd=;` - - **Note** - Note: To connect to SQL Express, use: `Data Source=\sqlexpress.` - - - -4. To create the database, click **Create Database**. - -5. To test the connection, click **Test Connection**. - -6. To configure database clearing options, click **Clear Options**. - - The **Clear Database Options** dialog box appears. - - 1. Choose one of the following options: - - - **Clear data older than**—Clear all data older than the number of days specified; in the number box, enter a number of days. - - - **Clear all data from database**—Clear all existent data in the database. - - - **Drop database**—Delete the database. - - 2. Click **OK** to apply changes and close the dialog box. - -7. Click **OK** to save the changes, or click **Cancel** to close the dialog box without saving changes. - -8. If prompted, restart the MED-V server service to apply changes to the network settings. - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - -[Design the MED-V Server Infrastructure](design-the-med-v-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md b/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md deleted file mode 100644 index 2ab92353b5..0000000000 --- a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: How to Install MED-V Client and MED-V Management Console -description: How to Install MED-V Client and MED-V Management Console -author: dansimp -ms.assetid: 8a5f3010-3a50-487e-99d8-e352e5cb51c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MED-V Client and MED-V Management Console - - -The following MED-V components are included in the client .msi package: - -- MED-V client—The MED-V software that must be installed on client computers for running MED-V workspaces. - -- MED-V management console—The administrative tool that administrators can use to create and maintain images, MED-V workspaces, and policies. - -The MED-V management console and the MED-V client are both installed from the MED-V client .msi package. The MED-V client, however, can be installed independently without the MED-V management console by clearing the **Install the MED-V Management application** check box during installation. - -**Note** -The MED-V client and MED-V management console can only be installed on Windows 7-, Windows Vista-, and Windows XP-based computers. They cannot be installed on server products. - - - -**Note** -Do not install the MED-V client using the Windows **runas** command. - - - -**To install the MED-V client** - -1. Log in as a user with local administrator rights on the local computer. - -2. Run the MED-V .msi package. - - The MED-V .msi package is called *MED-V\_x.msi*, where *x* is the version number. - - For example, *MED-V\_1.0.65.msi*. - -3. When the **InstallShield Wizard Welcome** screen appears, click **Next**. - -4. On the **License Agreement** screen, read the license agreement, click **I accept the terms in the license agreement**, and click **Next**. - - The **Destination Folder** screen appears, with the default installation folder displayed. - - The default installation folder is the directory where the operating system is installed. - - - To change the folder where MED-V should be installed, click **Change**, and browse to an existing folder. - -5. Click **Next**. - -6. On the **MED-V Settings** screen, configure the MED-V installation as follows: - - - Select the **Install the MED-V management application** check box to include the management component in the installation. - - **Note** - Enterprise Desktop Virtualization administrators should install the MED-V management application. This application is required for configuring desktop images and MED-V workspaces. - - - -~~~ -- Select the **Load MED-V when Windows starts** check box to start MED-V automatically on startup. - -- Select the **Add a MED-V shortcut to my desktop** check box to create a MED-V shortcut on your desktop. - -- In the **Server address** field, type the server address. - -- In the **Server port** field, type the server's port. - -- Select the **Server requires encrypted connections (https)** check box to work with https. - -- The default virtual machine images folder is displayed. The default installation folder is *%systemdrive%\\MED-V Images\\*. To change the folder where MED-V should be installed, click **Change**, and browse to an existing folder. -~~~ - -7. Click **Next**. - -8. On the **Ready to Install the Program** screen, click **Install**. - - The MED-V client installation starts. This can take several minutes, and the screen might not display text. During installation, several progress screens appear. If a message appears, follow the instructions provided. - - Upon successful installation, the **InstallShield Wizard Completed** screen appears. - -9. Click **Finish** to close the wizard. - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - -[Installation and Upgrade Checklists](installation-and-upgrade-checklists.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md b/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md deleted file mode 100644 index 908b387c82..0000000000 --- a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install MED-V Client -description: How to Install MED-V Client -author: dansimp -ms.assetid: bfac6de7-d96d-4b3e-bd8b-183e051e53c8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MED-V Client - - -In a deployment package-based scenario, the MED-V client installation is included in the deployment package and installed directly from the package. - -**Important** -When using a deployment package that does not include an image, ensure that the image is uploaded to the Web or pushed to the pre-stage folder prior to installing the deployment package. - - - -**To install a deployment package** - -1. Do one of the following: - - - Download the MED-V package from the Web. - - - Insert the deployment USB or DVD into the host drive. - -2. If MED-V does not launch automatically, double-click MED-VAutoInstaller.exe. - - A dialog box appears listing the components that are already installed and those that are currently being installed. - - **Note** - If a version of the Microsoft Virtual PC that is not supported exists on the host computer, a message will appear telling you to uninstall the existing version and run the installer again. - - - -~~~ -**Note** -If an older version of the MED-V client exists, it will prompt you asking whether you want to upgrade. - - - -Depending on the components that have been installed, you might need to reboot. If rebooting is necessary, a message appears notifying you that you must reboot. -~~~ - -3. If necessary, reboot the computer. - - When the installation is complete, MED-V starts and a message appears notifying you that the installation is complete. - -4. Log in to MED-V using the following user name and password: - - - Type in the domain name and user name followed by the password of the domain user who is permitted to work with MED-V. - - Example: "domain\_name\\user\_name", "password" - -## Related topics - - -[How to Configure a Deployment Package](how-to-configure-a-deployment-package.md) - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) - -[Client Installation Command Line Reference](client-installation-command-line-reference.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-install-med-v-clientesds.md b/mdop/medv-v1/how-to-install-med-v-clientesds.md deleted file mode 100644 index 46cf4d5fea..0000000000 --- a/mdop/medv-v1/how-to-install-med-v-clientesds.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: How to Install MED-V Client -description: How to Install MED-V Client -author: dansimp -ms.assetid: fb35f618-684c-474f-9053-b70bb29c3cc0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MED-V Client - - -Before installing the MED-V client .msi package on users’ computers, ensure that the image is uploaded to the Web or pushed to the image pre-stage folder. - -To install MED-V client using an enterprise software distribution center, refer to the documentation on how to install applications using the system you are using. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-localize-a-med-v-image.md b/mdop/medv-v1/how-to-localize-a-med-v-image.md deleted file mode 100644 index b5f0bdf42a..0000000000 --- a/mdop/medv-v1/how-to-localize-a-med-v-image.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Localize a MED-V Image -description: How to Localize a MED-V Image -author: dansimp -ms.assetid: adc148b3-8cfe-42a0-8847-be6b689a673a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Localize a MED-V Image - - -A MED-V image can be localized, either by unpacking a packed image or by downloading an image from the server. All local images appear in the local repository. - -## How to Extract a MED-V Image for Use by the Local Client - - -A packed image can be unpacked to the local repository by extracting it. It then does not need to be downloaded from the server. - -**To extract a MED-V image** - -1. In the **Local Packed Images** pane, select an image. - -2. Right-click, and from the drop-down menu, select **Extract image**. - - The image is extracted to the local drive and can now be used by the local client running on the computer. - -## How to Download a MED-V Image to the Local Repository - - -**To download a MED-V image** - -1. In the **Packed Images on Server** pane, select the image or version of the image to download. - -2. Click **Download**. - - The image is downloaded to your local computer. - - **Note**   - The downloaded image will not appear in the **Local Images** pane until you refresh the page. Click Refresh to see the downloaded image in the **Local Images** pane. - - - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md b/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md deleted file mode 100644 index e620f98a5e..0000000000 --- a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Lock and Unlock a Workspace -description: How to Lock and Unlock a Workspace -author: dansimp -ms.assetid: 027166b9-0e06-4a4e-a8ac-a4d5f429656f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Lock and Unlock a Workspace - - -## How to Lock a Workspace - - -**To lock a MED-V workspace that is currently running** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Lock Workspace**. - - The MED-V workspace is locked. - -## How to Unlock a Workspace - - -**To unlock a MED-V workspace** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Unlock Workspace**. - -3. In the **Unlock Workspace** dialog box, enter your **Password**. - -4. Click **Unlock**. - - The MED-V workspace is unlocked. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-pack-a-med-v-image.md b/mdop/medv-v1/how-to-pack-a-med-v-image.md deleted file mode 100644 index 08ccd86ef5..0000000000 --- a/mdop/medv-v1/how-to-pack-a-med-v-image.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: How to Pack a MED-V Image -description: How to Pack a MED-V Image -author: dansimp -ms.assetid: e1ce2307-0f1b-4bf8-b146-e4012dc138d2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Pack a MED-V Image - - -A MED-V image must be packed before it can be added to a deployment package or uploaded to the server. - -**To create a packed MED-V image** - -1. Click the **Images** management button. - -2. In the **Images** module, in the **Local Packed Images** pane, click **New**. - -3. In the **Packed Image Creation** dialog box, select the virtual machine image by doing one of the following: - - - In the **Base image file** field, type the full path to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - - - Click **Browse** to browse to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - -4. Specify the name of the new image by doing one of the following: - - - In the **Image name** field, type the desired name. - - **Note** - The following characters cannot be included in the image name: space " < > | \\ / : \* ? - - - -~~~ - A new packed image will be created. - -- From the drop-down list, select an existing name. - - A new version of the existing image will be created. -~~~ - -5. Click **OK**. - - A new MED-V packed image is created on your host computer with the properties defined in the following table. - -**Note** -In the **Local Packed Images** and **Packed Images on Server** panes, the most recent version of each image is displayed as the parent node. Click the parent node to view all other existing versions of the image. - - - -**Local Packed Images Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Image Name

          The name of the packed image as it was defined when the administrator created the image.

          Version

          The version of the displayed image.

          -
          -Note

          All previous versions are kept unless deleted.

          -
          -
          - -

          File Size (compressed)

          The physical compressed size of the image.

          Image Size (uncompressed)

          The physical uncompressed size of the image.

          - - - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md b/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md deleted file mode 100644 index 9c9183aebe..0000000000 --- a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Set Advanced File Transfer Options -description: How to Set Advanced File Transfer Options -author: dansimp -ms.assetid: 5e9f8749-a5a9-48c6-9bfc-6b8e0cbe6cab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Advanced File Transfer Options - - -**To set advanced file transfer options** - -1. In the **Deployment** pane, click **Advanced**. - -2. In the **File Transfer Options** dialog box, configure the parameters as described in the following table. - -3. Click **OK**. - -**File Transfer Options Properties** - -Property -Description -*Workspace to Host* - -Run command on received files - -Select this check box to run a command line on all files transferred to the host. In the command-line box, enter the command line to run on all received files. - -File types - -- **Allow all file extensions**—Click to enable transferring files of any file name extension from the MED-V workspace to the host. - -- **Allow the following file extensions**—Click to enable only files with specified file name extensions to be transferred. In the empty field, enter all file name extensions allowed, separated by commas. - -*Host to Workspace* - -Run command on received files - -Select this check box to run a command line on all files transferred to the MED-V workspace. In the command-line box, enter the command line to run on all transferred files. - -File types - -- **Allow all file extensions**—Click to enable transferring files of any file name extension. - -- **Allow the following file extensions**—Click to enable only files with specified file name extensions to be transferred from the host to the MED-V workspace. In the empty field, enter all file name extensions allowed, separated by colons. - -  - -## Related topics - - -[How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md b/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md deleted file mode 100644 index f06380a126..0000000000 --- a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Set MED-V Workspace Deletion Options -description: How to Set MED-V Workspace Deletion Options -author: dansimp -ms.assetid: 0f85aa81-c188-4115-9141-ceba2473c00e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set MED-V Workspace Deletion Options - - -## Workspace Deletion Options - - -The administrator can set the MED-V workspace deletion options for each user or group so that the MED-V workspace is automatically deleted under certain conditions. - -**To set MED-V workspace deletion options** - -1. In the **Deployment** pane, click **Workspace deletion options**. - -2. In the **Workspace Deletion Options** dialog box, select from the following options: - - - **The Workspace has been disabled**—If the administrator disables the MED-V workspace, the MED-V workspace is deleted from the user or group computer. - - - **The Workspace has expired**—If the MED-V workspace expires according to the date specified, the MED-V workspace is deleted from the user or group computer. - - - **User is offline for more than the allowed period**—If the policy is not refreshed in the time period specified since the user was offline, the MED-V workspace is deleted from the user or group computer. - -3. Click **OK**. - -## Related topics - - -[How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-set-up-script-actions.md b/mdop/medv-v1/how-to-set-up-script-actions.md deleted file mode 100644 index cff5da73d1..0000000000 --- a/mdop/medv-v1/how-to-set-up-script-actions.md +++ /dev/null @@ -1,274 +0,0 @@ ---- -title: How to Set Up Script Actions -description: How to Set Up Script Actions -author: dansimp -ms.assetid: 367e28f1-d8c2-4845-a01b-2fff9128ccfd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Script Actions - - -The script actions editor allows the administrator to create actions to be performed during MED-V workspace setup, as well as to define the order in which they are performed. - -The following is a list of actions that can be added to the domain setup script: - -- **Restart Windows**—Restart Windows. - -- **Join Domain**—If joining a domain, include this action and configure the user name, password, fully qualified domain name, NetBIOS domain name, and organization unit (optional). - -- **Check Connectivity**—Configure a server to connect to and verify that the MED-V workspace can connect to a network resource (such as the domain server). - -- **Command Line**—Configure a script in the MED-V workspace, and enter a command line that includes the path of the script and the script arguments. - -- **Rename Computer**—Rename the virtual machine computer based on the defined settings. - -- **Disable Auto-Logon**—Disable Windows Auto-Logon. This action should be added at the end of scripts that add the computer to the domain. - -## How to Set Up Script Actions - - -**To set up script actions** - -1. On the **VM Setup** tab, click **Script Editor**. - -2. In the **Script Actions** dialog box, click **Add**, and on the submenu, click the desired actions. - -3. Configure the actions as described in the following tables. - - **Note**   - **Rename Computer** is configured in the **VM Settings** tab. For more information, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md). - - - -~~~ -**Note** -To rename a computer, Windows must be restarted. It is recommended to add a Restart Windows action following a Rename Computer action. -~~~ - - - -4. Set the order of the actions by selecting an action and clicking **Up** or **Down**. - -5. Click **OK**. - -**Note** -When running the Join Domain script, for the script to work, the user logged into the MED-V workspace virtual machine must have local administrator rights. - - - -**Note** -When running the Disable Auto-Logon script, it is recommended to disable the local guest account used for the auto-logon once the initial setup is complete. - - - -### - -**Join Domain Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Credentials to use when joining the VM to the domain

          Select one of the following credentials to use when joining the VM to the domain:

          -
            -
          • Use MED-V credentials—The end-user credentials.

          • -
          • Use the following credentials—The credentials specified; enter a user name and password in the corresponding fields.

          • -
          -
          -Note

          The credentials you enter are visible to all MED-V workspace users. It is not recommended to provide domain administrator credentials.

          -
          -
          - -

          Domain to join

          Select one of the following:

          -
            -
          • Use the domain name utilized in starting the Workspace—Join the domain entered by the end user when logging into the MED-V client.

            -

            To define the mapping from NetBIOS to fully qualified domain names, click Global domain mapping table. In the global domain mapping table, click Add, enter a NetBIOS domain name and a Fully qualified domain name, and click OK.

          • -
          • Use the following domain name—Join the domain specified; enter a domain name and NetBIOS domain name in the corresponding fields.

          • -

          Organization Unit

          An organization unit (OU) may be specified to join the computer to a specific OU. The format must follow an OU distinguished name: OU=<Organization Unit>,<Domain Controller> (for example, OU=QATest, DC=il, DC=MED-V, DC=com).

          -
          -Warning

          Only a single level OU is supported as is shown in the example above.

          -
          -
          - -
          - - - -### - -**Check Connectivity Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          IP Address

          The IP Address of the server that you are verifying connection to.

          Port

          The port of the server that you are verifying connection to.

          Timeout

          The number of seconds to wait for a response before timing out.

          - - - -### - -**Command-Line Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Path

          The path of the command line.

          Arguments

          Command-line arguments.

          Wait for exit

          Select the check box to wait for a return before continuing with the script actions.

          Fail on error

          Select this check box if the return is anything but the value specified.

          -

          Enter the value that will indicate the command as a success.

          -

          Default: 0

          Perform only once

          Select this check box to run the command line only once. If the script fails or is canceled, this command will not be performed again.

          This command line causes a restart of Windows in the Workspace

          Select this check box if the command line causes a restart after completion.

          Allow interaction

          Select this check box if the command will require user interaction.

          Progress message

          Message to be displayed to the user while the command is running.

          Failure message

          Message to be displayed to the user if the command fails.

          - - - -When configuring the command-line action, several variables can be used as defined in the following table. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ParameterValueDescription

          %MEDVUser%

          An authenticated user name.

          MED-V authenticated user name. The user name and password can be used in the join domain VM setup script.

          %MEDVPassword%

          An authenticated password.

          MED-V authenticated password. The user name and password can be used in the join domain VM setup script.

          %MEDVDomain%

          Configured domain.

          The domain configured in the MED-V authentication. It can be used on the VM setup script.

          %DesiredMachineName%

          Computer name.

          The unique computer name configured in the management application. It can be used in the VM setup script.

          - - - -## Related topics - - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) - -[How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md b/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md deleted file mode 100644 index d77de77862..0000000000 --- a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Share Folders Between the Host and the MED-V Workspace -description: How to Share Folders Between the Host and the MED-V Workspace -author: dansimp -ms.assetid: 3cb295f2-c07e-4ee6-aa3c-ce4c8c45c191 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Share Folders Between the Host and the MED-V Workspace - - -You can share folders between the host and the MED-V workspace. The shared folders can be stored on the following: - -- An external computer on the network - -- The host computer - -The following procedures demonstrate how to share folders between the host and the MED-V workspace. - -**To share folders located on the network** - -1. Configure MED-V in full desktop mode. - -2. In MED-V management, on the Network tab, click **Use different IP address than host (Bridge)**. - -3. Do the following on the host computer: - - 1. In Control Panel, click **View network status and tasks**, and set **Network discovery** to **On**. - - 2. On the Start menu, right-click **Computer**, and click **Map network drive**. - - 3. In the **Map Network Drive** dialog box, in the **Drive** field, select a drive. - - **Note**   - Ensure that the same drive letter is not in use on both computers. - - - - 4. Click **Browse**. - - 5. In the **Browse For Folder** dialog box, browse to the shared drive, and click **OK**. - - 6. Click **Finish**. - -4. Repeat step 3 in the MED-V workspace. Point to the same drive as on the host computer. - -**To share folders located on the host** - -1. Configure the folder to be shared with the appropriate permissions. - -2. From the MED-V workspace, go to **My network places** and locate the shared folder. - -3. From the MED-V workspace, locate the shared folder. - -**Note**   -Ensure that both the host and MED-V workspace computers are in the same domain or workgroup. - - - - - - - - - - - diff --git a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md b/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md deleted file mode 100644 index 491c545b20..0000000000 --- a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Start and Exit the MED-V Client -description: How to Start and Exit the MED-V Client -author: dansimp -ms.assetid: 3762bad1-6937-40fa-ab5d-61a905865214 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Start and Exit the MED-V Client - - -## - - -**To start the MED-V client** - -- On the Windows Start menu, point to **All Programs**, point to **MED V**, and then click **MED-V** or, on the desktop, double-click the **MED-V** icon. - -**Note**   -MED-V cannot be started from an elevated command prompt. - - - -**To exit the MED-V client** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Exit**. - - The MED-V client exits. - - - - - - - - - diff --git a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md b/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md deleted file mode 100644 index b765e2f19c..0000000000 --- a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Start, Stop, and Restart a MED-V Workspace -description: How to Start, Stop, and Restart a MED-V Workspace -author: dansimp -ms.assetid: 54ce139c-8f32-499e-944b-72f123ebfd2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Start, Stop, and Restart a MED-V Workspace - - -**To start a MED-V workspace** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Start Workspace**. - - - If there are multiple MED-V workspaces running on the computer, the **Workspace Selection** window appears. - - 1. Select a MED-V workspace. - - 2. Select the **Start the selected Workspace without asking me** check box to skip this window the next time the client is started and to automatically open the selected MED-V workspace. - - 3. Click **OK**. - - The **Start Workspace Authentication** window appears. - - - If there are several MED-V workspaces on the computer and you have opted to use a specified MED-V workspace, the window shown in the following figure appears. - - ![](images/medv-logon.gif) - - - If there is only one MED-V workspace on the computer, the “Start last used Workspace” option is unavailable. - -3. Type in your domain user credentials. - - **Note**   - The first time a MED-V workspace is started, the user name should be in the following format: <domain name>\\<user name>. - - - -4. Select **Save my password** to save your password between sessions. - - **Note**   - To enable the save password feature, the EnableSavePassword attribute must be set to True in the ClientSettings.xml file. The file can be found in the *Servers\\Configuration Server\\* folder. - - - -5. Clear the **Start last used workspace** check box to choose a different MED-V workspace. - -6. Click **OK**. - - Several status screens appear depending on the MED-V workspace configuration. - - The **Starting Workspace** screen appears. - -**To restart a MED-V workspace** - -1. When the client is running, in the notification area, right-click the MED-V icon. - -2. On the submenu, click **Restart Workspace**. - - The MED-V workspace is restarted. - - - In a persistent MED-V workspace, the virtual machine is shut down and then restarted. - - - In a revertible MED-V workspace, the virtual machine does not actually shut down; instead, it returns to its original state. - -**To stop a MED-V workspace** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Stop Workspace**. - - The MED-V workspace is stopped. - -## Related topics - - -[How to Start and Exit the MED-V Client](how-to-start-and-exit-the-med-v-client.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md b/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md deleted file mode 100644 index 125a45d5b6..0000000000 --- a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Uninstall MED-V Components -description: How to Uninstall MED-V Components -author: dansimp -ms.assetid: 91bdf488-14e7-43ab-972d-9d92421acb86 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall MED-V Components - - -This section explains how to uninstall the MED-V client and server. - -## How to Uninstall the MED-V Client - - -**To uninstall MED-V client** - -1. If using Windows XP: - - - In Control Panel, open **Add or Remove Programs**. - -2. If using Windows Vista: - - - In Control Panel, open **Uninstall a Program**. - -3. Select **Microsoft Enterprise Desktop Virtualization**, and click **Uninstall**. - -4. It is recommended to delete the MED-V virtual machine folder. (The default folder is *C:\\MED-V Images*.) - -## How to Uninstall the MED-V Server - - -**To uninstall the MED-V server** - -1. In Control Panel, open **Add or Remove Programs**. - -2. Select **Microsoft Enterprise Desktop Virtualization (Server)**, and click **Uninstall**. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-update-a-med-v-image.md b/mdop/medv-v1/how-to-update-a-med-v-image.md deleted file mode 100644 index 742368d6ac..0000000000 --- a/mdop/medv-v1/how-to-update-a-med-v-image.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Update a MED-V Image -description: How to Update a MED-V Image -author: dansimp -ms.assetid: 61eacf50-3a00-4bb8-b2f3-7350a6467fa1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Update a MED-V Image - - -## How to Update a MED-V Image - - -An existing MED-V image can be updated, thereby creating a new version of the image. The new version can then be deployed on client computers, replacing the existing image. - -**Note**   -When a new version is deployed on the client, it overwrites the existing image. When updating an image, ensure that no data on the client needs to be saved. - - - -**To update a MED-V image** - -1. Open the existing image in Virtual PC 2007. - -2. Make the required changes to the image, updating the image (such as installing new software). - -3. Close Virtual PC 2007. - -4. Test the image. - -5. After the image is tested, pack it to the local repository, using the same name as the existing image. - - **Note**   - If you name the image a different name than the existing version, a new image will be created rather than a new version of the existing image. - - - -6. Upload the new version to the server or distribute it via a deployment package. - -## Related topics - - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - -[How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) - -[How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) - -[Updating a MED-V Workspace Image](updating-a-med-v-workspace-image.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md b/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md deleted file mode 100644 index 18cf02c554..0000000000 --- a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: How to Upload a MED-V Image to the Server -description: How to Upload a MED-V Image to the Server -author: dansimp -ms.assetid: 0e70dfdf-3e3a-4860-970c-535806caa907 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upload a MED-V Image to the Server - - -After a MED-V image has been tested, it can be packed and then uploaded to the server. For information on configuring an image Web distribution server, see [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md). - -Once a MED-V image is packed and uploaded to the server, it can be distributed to users by using an enterprise software distribution center, or it can be downloaded by users using a deployment package. For information on deployment using an enterprise software distribution center, see [Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md). For information on deployment using a package, see [Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md). - -**Note** -Before uploading an image, verify that a Web proxy is not defined in your browser settings and that Windows Update is not currently running. - - - -**To upload a MED-V image to the server** - -1. In the **Local Packed Images** pane, select the image you created. - -2. Click **Upload**. - - The image is uploaded to the server. This might take a considerable amount of time. - - Images on the server are defined with the properties listed in the following table. - -**Packed Images on Server Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Image Name

          The name of the packed image as it was defined when the administrator created the image.

          Version

          The version of the displayed image.

          -
          -Note

          All previous versions are kept unless deleted.

          -
          -
          - -

          File Size (compressed)

          The physical compressed size of the image.

          Image Size (uncompressed)

          The physical uncompressed size of the image.

          - - - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - -[How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md b/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md deleted file mode 100644 index cae37d85c9..0000000000 --- a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: How to View MED-V Settings and General Information -description: How to View MED-V Settings and General Information -author: dansimp -ms.assetid: c14e3f30-c4e5-47a3-8ad1-0570fc62d991 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to View MED-V Settings and General Information - - -## How to View MED-V Settings - - -**To view MED-V settings** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Settings**. - -3. In the **Settings** dialog box, select the **Load MED-V after Windows logon** check box to load MED-V on startup. - -4. Select the **Start Workspace when MED-V starts** check box to automatically start the MED-V workspace on startup. - -5. Configure the server properties described in the following table. - -**Server Settings** - - ---- - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Server address

          The server's DNS name or IP address.

          Server port

          The server's port.

          Encrypt connections (HTTPS)

          Select this check box to use encrypted connections.

          - -  - -## How to View MED-V General Information - - -**To view MED-V general information** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Help**, and then click **About**. - - The **About Microsoft Enterprise Desktop Virtualization** screen appears. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-work-with-reports.md b/mdop/medv-v1/how-to-work-with-reports.md deleted file mode 100644 index d9c80fd178..0000000000 --- a/mdop/medv-v1/how-to-work-with-reports.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Work with Reports -description: How to Work with Reports -author: dansimp -ms.assetid: b7a660c6-74c3-4ced-a395-9e76a4362a46 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Work with Reports - - -The following functions can be used to work with MED-V reports: - -- [Refreshing an existing report](#bkmk-howtorefreshanexistingreport) - -- [Editing report parameters](#bkmk-howtoeditreportparameters) - -- [Exporting a report to Microsoft Excel](#bkmk-howtoexportareporttoexcel) - -- [Closing a report](#bkmk-howtocoseareport) - -Report results can be sorted by any column by clicking the appropriate column name. - -The report results can be grouped by dragging a column header to the top of the report. Drag multiple column headers to group one column after another. - -## How to Refresh an Existing Report - - -**To refresh an existing report** - -1. Select the report to refresh. - -2. On the management toolbar, click **Refresh**. - - The report is regenerated. - -## How to Edit Report Parameters - - -**To edit report parameters** - -1. Generate a report. - -2. On the management toolbar, click **Edit report**. - - The Report Parameters dialog box appears. - -3. In the **Report Parameters** dialog box, configure the parameters, and click **OK**. - - The report is regenerated with the new parameters. - -## How to Export a Report to Microsoft Excel - - -**To export a report to Microsoft Excel** - -1. Generate a report. - -2. On the management toolbar, click **Export to Excel**. - -3. In the **Save Report** dialog box, enter a name, and click **Save**. - - The report is exported to Microsoft Excel. - -## How to Close a Report - - -**To close a report** - -1. Select the report to close. - -2. On the management toolbar, click **Close report**. - - The report closes. - -  - -  - - - - - diff --git a/mdop/medv-v1/identify-the-number-of-med-v-instances.md b/mdop/medv-v1/identify-the-number-of-med-v-instances.md deleted file mode 100644 index 1d78567667..0000000000 --- a/mdop/medv-v1/identify-the-number-of-med-v-instances.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Identify the Number of MED-V Instances -description: Identify the Number of MED-V Instances -author: dansimp -ms.assetid: edea9bdf-a28c-4d24-9298-7bd6536c3a94 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify the Number of MED-V Instances - - -You need to determine the number of MED-V instances, as well as define the scope for each instance so that you can design the server infrastructure. A MED-V instance includes the following: - -- The MED-V server and the MED-V workspaces stored on the server, including Active Directory permissions. - -- A SQL Server database that stores client events. The database may be shared by multiple MED-V instances. - -- The image repository for the packed MED-V images. The repository may be shared by multiple MED-V instances. - -- The management console used to create and pack images and to create MED-V workspaces. The console cannot be used simultaneously by multiple MED-V instances, but it can be disconnected from one MED-V server and then connected to a different MED-V server. - -- MED-V clients that receive MED-V workspaces, and authorization to use them, from the server. - -Separate MED-V instances cannot be integrated or share MED-V workspaces. Therefore, each additional instance decentralizes the virtualization management. - -## Determine the Number of MED-V Instances Required - - -Start by assuming you are using one MED-V instance. Then, consider the following conditions, and add additional instances for each condition that applies to your infrastructure. - -- Number of supported users—Each MED-V instance can support up to 5,000 concurrently active clients. Concurrently active means the client is online with the MED-V server and sending polls to the server for policy and image updates, as well as events. If your infrastructure will include more than 5,000 active users, add one instance for every 5,000 users. - -- Users in untrusted domains—The MED-V server associates MED-V workspace permissions with Active Directory users and/or groups. This requires MED-V users to exist within the trust boundary of the MED-V server. Add one MED-V instance for each group of MED-V users that is in a separate, untrusted domain. - -- Clients in isolated networks—Determine whether any clients reside in networks that are isolated and therefore require a separate MED-V instance. For example, organizations often isolate lab networks from production networks. Add a MED-V instance for each isolated network that will contain MED-V clients. - -- Organizational requirements—The organization may require that a group of clients be managed by a separate MED-V instance for security reasons, such as when sensitive applications are delivered only to a restricted set of users within a domain. For example, the payroll department may deny users from other departments access to the MED-V instance that stores policy for payroll processing. Additionally, if the organization uses a distributed management model, a separate MED-V instance may be required for each business group having MED-V clients in order to enable the group to manage its own virtualized environment. Add one MED-V instance for each separate organizational requirement. - -- Legal considerations—National security or privacy issues and fiduciary laws could require the separation of certain data or prevent other data from crossing national borders. If necessary, add additional MED-V instances to address this need. - -After you determine the number of MED-V instances required for your infrastructure, as well as the reasoning for each one, provide a name for each instance. - -  - -  - - - - - diff --git a/mdop/medv-v1/images/506f54d0-38fa-446a-8070-17ae26da5355.gif b/mdop/medv-v1/images/506f54d0-38fa-446a-8070-17ae26da5355.gif deleted file mode 100644 index 751dd1cdd0..0000000000 Binary files a/mdop/medv-v1/images/506f54d0-38fa-446a-8070-17ae26da5355.gif and /dev/null differ diff --git a/mdop/medv-v1/images/medv-logon.gif b/mdop/medv-v1/images/medv-logon.gif deleted file mode 100644 index bcc102a289..0000000000 Binary files a/mdop/medv-v1/images/medv-logon.gif and /dev/null differ diff --git a/mdop/medv-v1/images/medv-ui-console-general.gif b/mdop/medv-v1/images/medv-ui-console-general.gif deleted file mode 100644 index 128e43aea0..0000000000 Binary files a/mdop/medv-v1/images/medv-ui-console-general.gif and /dev/null differ diff --git a/mdop/medv-v1/images/medv.gif b/mdop/medv-v1/images/medv.gif deleted file mode 100644 index 29b45a998f..0000000000 Binary files a/mdop/medv-v1/images/medv.gif and /dev/null differ diff --git a/mdop/medv-v1/index.md b/mdop/medv-v1/index.md deleted file mode 100644 index c056dfeeaf..0000000000 --- a/mdop/medv-v1/index.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide -description: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide -author: dansimp -ms.assetid: 7bc3e120-df77-4f4c-bc8e-7aaa4c2a6525 -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide - - -![microsoft enterprise desktop virtualization](images/medv.gif) - -Microsoft Enterprise Desktop Virtualization (MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. - -MED-V is an integral component of the Microsoft Desktop Optimization Pack, a dynamic solution available to Software Assurance customers, which helps reduce application deployment costs, enables delivery of applications as services, and helps to better manage and control enterprise desktop environments. - -## In This Section - - -The following topics are covered in this guide: - -[About This Guide](about-this-guidemedv.md) - -[Getting Started with MED-V](getting-started-with-med-v.md) - -[MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) - -[MED-V Deployment and Configuration](med-v-deployment-and-configuration.md) - -[MED-V Operations](med-v-operations.md) - -[Troubleshooting MED-V](troubleshooting-med-v.md) - -[Technical Reference](technical-referencemedv-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/installation-and-upgrade-checklists.md b/mdop/medv-v1/installation-and-upgrade-checklists.md deleted file mode 100644 index 581101261f..0000000000 --- a/mdop/medv-v1/installation-and-upgrade-checklists.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Installation and Upgrade Checklists -description: Installation and Upgrade Checklists -author: dansimp -ms.assetid: ccfdde26-4a28-4c14-888d-71b96fe7626e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation and Upgrade Checklists - - -This section provides installation and upgrade checklists for MED-V 1.0 and MED-V 1.0 SP1. - -## In This Section - - -[MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -Provides a list of all the steps required for installing MED-V 1.0. - -[MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -Provides a step-by-step procedure for upgrading from MED-V 1.0 to MED-V 1.0 SP1. - -  - -  - - - - - diff --git a/mdop/medv-v1/installing-and-configuring-med-v-components.md b/mdop/medv-v1/installing-and-configuring-med-v-components.md deleted file mode 100644 index 8128182f05..0000000000 --- a/mdop/medv-v1/installing-and-configuring-med-v-components.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Installing and Configuring MED-V Components -description: Installing and Configuring MED-V Components -author: dansimp -ms.assetid: 4af90e9f-3c6b-4f7c-8274-56ad24173662 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installing and Configuring MED-V Components - - -This section explains how to install the MED-V server, MED-V client, and MED-V management, as well as how to configure the MED-V server and image repository. It includes the procedure on uninstalling the components as well. - -## In This Section - - -[How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md) -Describes how to install the MED-V server and configure connections, images, permissions, and report settings. - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) -Describes how to configure an image Web distribution server using IIS. - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) -Describes how to install the MED-V client and MED-V management using the client .msi package. - -[How to Uninstall MED-V Components](how-to-uninstall-med-v-componentsmedvv2.md) -Describes how to uninstall the MED-V components. - -  - -  - - - - - diff --git a/mdop/medv-v1/key-scenarios-for-using-med-v.md b/mdop/medv-v1/key-scenarios-for-using-med-v.md deleted file mode 100644 index 377facde64..0000000000 --- a/mdop/medv-v1/key-scenarios-for-using-med-v.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Key Scenarios for Using MED-V -description: Key Scenarios for Using MED-V -author: dansimp -ms.assetid: e35075e2-3401-49ae-810d-1bd51ebc7924 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Key Scenarios for Using MED-V - - -## Enable Legacy Applications and Accelerate Upgrades to New Operating Systems - - -Incompatibility of legacy applications with new versions of Windows can often delay enterprise upgrades to the latest version of Windows. Testing and migrating applications takes time, and users are unable to take advantage of the new capabilities and enhancements offered by the newest operating system. - -By delivering applications in a Virtual PC that runs a previous version of the operating system (for example, Windows XP or Windows 2000), MED-V removes the barriers to operating system upgrades and allows administrators to complete testing and address incompatible applications after the upgrade. - -From the user's perspective, these applications are accessible from the standard desktop Start menu and appear side-by-side with native applications—so there is minimal change to the user experience. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-10-installation-checklist.md b/mdop/medv-v1/med-v-10-installation-checklist.md deleted file mode 100644 index 6e306306a6..0000000000 --- a/mdop/medv-v1/med-v-10-installation-checklist.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: MED-V 1.0 Installation Checklist -description: MED-V 1.0 Installation Checklist -author: dansimp -ms.assetid: a81fd5b0-29b3-4ddc-8f60-7d44c2be9794 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 Installation Checklist - - -The following checklist is intended to provide a high-level list of items to consider and outlines the steps you should take to install Microsoft Enterprise Desktop Virtualization (MED-V) 1.0. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Ensure your computing environment meets the supported configurations required for installing MED-V 1.0.

          MED-V 1.0 Supported Configurations

          Plan and design the MED-V server infrastructure.

          MED-V Infrastructure Planning and Design

          Verify the required prerequisites are configured.

          MED-V Installation Prerequisites

          Install and configure the MED-V server.

          How to Install and Configure the MED-V Server Component

          If using an image repository, configure the image Web distribution server.

          How to Configure the Image Web Distribution Server

          Install the MED-V client and management console.

          How to Install MED-V Client and MED-V Management Console

          - - - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-release-notesmedv-10.md b/mdop/medv-v1/med-v-10-release-notesmedv-10.md deleted file mode 100644 index ba7e8f9ef6..0000000000 --- a/mdop/medv-v1/med-v-10-release-notesmedv-10.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: MED-V 1.0 Release Notes -description: MED-V 1.0 Release Notes -author: dansimp -ms.assetid: 006a3537-5c5b-43b5-8df8-4bf6ddd3cd2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 Release Notes - - -## Known Issues with MED-V - - -This section provides the most up-to-date information about general issues with the Microsoft Enterprise Desktop Virtualization (MED-V) platform. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases. - -### File downloads do not follow Web redirection rules - -File downloads do not follow Web redirection rules set in a MED-V workspace policy. - -### When expanding a console-published application window to full screen, it disappears - -If you expand a console-published application (such as cmd.exe) window to full screen inside a MED-V workspace configured in seamless integration mode, the application window might disappear or not respond. - -### When working in full desktop mode, icon locations on the desktop are not saved - -When working in full desktop mode, manual location changes of icons on the desktop are not saved between MED-V workspace sessions. - -### A local image and a test image with the same name cannot exist in the same domain - -If a local image is joined to the domain and the administrator creates a new version of the same image with the same computer name as a test image, when the test image joins the domain, either the join domain action fails or it succeeds and the local image is removed from the domain. - -### MED-V does not support Windows Aero features - -MED-V does not support Windows Aero features (such as Aero Flip 3D). - -### The management console can be used by only one Windows user per computer - -The MED-V management console can be used only by administrators and the Windows user who installed the management application. - -### The MED-V Server configuration utility tests Microsoft SQL Server connectivity under user context rather than under MED-V Server service context - -MED-V uses MED-V Server service context to collect reports from the Microsoft SQL Server reports database. The MED-V Server configuration utility verifies the database and tests the database connection string. It does not validate the access of MED-V Server service to the database. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md deleted file mode 100644 index dce6ffe881..0000000000 --- a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: MED-V 1.0 SP1 and SP2 Release Notes -description: MED-V 1.0 SP1 and SP2 Release Notes -author: dansimp -ms.assetid: 0fde8732-8ad2-483c-b094-7996ed9f2766 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 1.0 SP1 and SP2 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Note**   -Read these Release Notes thoroughly before you install the Microsoft Enterprise Desktop Virtualization (MED-V) platform. These Release Notes contain information that you must have to successfully install the MED-V platform. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other MED-V platform documentation, the latest change should be considered authoritative. These Release Notes supersede the content included with this product. - - - -## About the Product Documentation - - -Comprehensive documentation for Microsoft Enterprise Desktop Virtualization (MED-V) platform is available. Refer to the Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, you should install the latest available security updates for any new software that you are installing. For more information, see the Microsoft Security website at . - -## What’s New in MED-V 1.0 SP2 - - -MED-V 1.0 SP2 includes the following updates to the MED-V 1.0 SP1 features and functionality: - -- Support for running MED-V on a Chinese traditional or Chinese simplified workstation. - -- Support for the MED-V 1.0 SP2 client to run on Windows 7 SP1. - -- Improved performance for the applications that are running in the MED-V workspace when MED-V frames around the published applications are turned-on. Previously, under some instances the MED-V frames had to be turned-off for the applications to run correctly. - -## Known Issues with MED-V 1.0 SP1 and MED-V 1.0 SP2 - - -This section provides the most up-to-date information about issues with the Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 SP1 platform. These issues do not appear in the product documentation and in some cases may contradict existing product documentation. Whenever possible, these issues are addressed in later releases. - -### MED-V does not provide Windows 7 advanced user experience support - -MED-V 1.0 SP1 does not provide Windows 7 advanced user experience support, such as the following: - -Docking windows to the top, left, or right is not applied to published application windows. - -The Windows 7 taskbar preview does not display the published application content. - -## Release Notes Copyright Information - - -Information in this document, including URL and other Internet website references, is subject to change without notice, and is provided for informational purposes only. The entire risk of the use or results of the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, Microsoft Enterprise Desktop Virtualization, MS-DOS, Windows, Windows Server, Windows Vista, Active Directory, and ActiveSync are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. - -The names of actual companies and products mentioned herein may be the trademarks of their respective owners. - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md deleted file mode 100644 index 6beb4ac562..0000000000 --- a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md +++ /dev/null @@ -1,349 +0,0 @@ ---- -title: MED-V 1.0 SP1 Supported Configurations -description: MED-V 1.0 SP1 Supported Configurations -author: dansimp -ms.assetid: 4dcf37c4-a061-43d2-878c-28efc87c3cdd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 1.0 SP1 Supported Configurations - - -This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 Service Pack 1 (SP1) in your environment. - -## MED-V 1.0 SP1 Client System Requirements - - -### MED-V Client Operating System Requirements - -The following table lists the operating systems that are supported for MED-V 1.0 SP1 client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows XP

          Professional Edition

          SP2 or SP3

          x86

          Windows Vista

          Business, Enterprise, or Ultimate

          SP1 or SP2

          x86

          Windows 7

          Professional, Enterprise, or Ultimate

          None

          x86 or x64

          - - - -**Note** -MED-V client does not run in native x64 mode. Instead, MED-V runs in Windows on Windows 64-bit (WOW64) mode on 64-bit computers. - - - -The following table lists the minimal RAM required for each operating system supported in MED-V 1.0 SP1. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemMinimal Required RAM

          Windows XP Professional

          1 GB

          Windows Vista

          2 GB

          Windows 7 x86

          2 GB

          Windows 7 x64

          3 GB

          - - - -### MED-V 1.0 SP1 Client Configuration - -**.NET Framework Version** - -The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 SP1 client installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Virtualization Engine** - -Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 SP1 client installation in the following configurations: - -- Static Virtual Hard Disk (VHD) file - -- Multiple VHD files located within the same directory - -- Dynamic VHD file - -**Internet Browser** - -Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 SP1 client installation. - -**Microsoft Hyper-V Server** - -The MED-V client is not supported in a Microsoft Hyper-V Server environment. - -## MED-V 1.0 SP1 Workspace System Requirements - - -MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0. - -### MED-V Workspace Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 SP1 workspaces. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows 2000

          Professional

          SP4

          X86

          Windows XP

          Professional Edition

          SP2 or SP3

          -
          -Note

          SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.

          -
          -
          - -

          x86

          - - - -### MED-V 1.0 SP1 Workspace Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation: - -- .NET Framework 2.0 SP1 - -- .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Note** -We recommend the .NET Framework 3.5 SP1 to ensure that the MED-V workspace is compatible with future versions of MED-V. - - - -**Internet Browser** - -Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 SP1 workspace installation. - -### MED-V Workspace Images - -MED-V workspace images must be created by using Virtual PC 2007 SP1. - -## MED-V 1.0 SP1 Server System Requirements - - -MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0. - -### MED-V 1.0 Server Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 SP1 server installations. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2008

          Standard or Enterprise

          SP1 or SP2

          X86 or x64

          Windows Server 2008 R2

          Standard or Enterprise

          None

          x64

          - - - -### MED-V 1.0 SP1 Server Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Microsoft SQL Server Version** - -The following versions of Microsoft SQL Server are supported for MED-V 1.0 SP1 when SQL Server is installed locally or remotely from the MED-V 1.0 SP1 Server: - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          SQL Server VersionEditionService PackSystem Architecture

          SQL Server 2005

          Express, Standard, or Enterprise Edition

          SP2

          X86 or x64

          SQL Server 2008

          Express, Standard, or Enterprise

          None

          X86 or x64

          - - - -**Microsoft Hyper-V Server** - -The MED-V server is supported in a Microsoft Hyper-V server environment. - -## MED-V 1.0 SP1 Globalization Information - - -Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 SP1 client, workspace, and server installations: - -- English - -- French - -- German - -- Italian - -- Spanish - -- Portuguese (Brazil) - -- Dutch (Netherlands) - -- Japanese - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md deleted file mode 100644 index 2ae432d713..0000000000 --- a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: MED-V 1.0 SP1 Upgrade Checklist -description: MED-V 1.0 SP1 Upgrade Checklist -author: dansimp -ms.assetid: 1a462b37-8c7a-4826-9175-0b1b701d345b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 SP1 Upgrade Checklist - - -To upgrade Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 to MED-V 1.0 Service Pack 1 (SP1), the client must be upgraded. The server can optionally be upgraded. - -## Server Upgrade - - -**To upgrade the MED-V 1.0 server to MED-V 1.0 SP1** - -1. Back up the following files that are located in the *<InstallDir> / Servers / ConfigurationServer* directory: - - - OrganizationalPolicy.XML - - - ClientPolicy.XML - - - WorkspaceKeys.XML - -2. Back up the *<InstallDir> / Servers / ServerSettings.xml* file. - -3. Uninstall the MED-V 1.0 server. - -4. Install the MED-V 1.0 SP1 server. - -5. Restore the backup files to the appropriate directories. - -6. Restart the MED-V server service. - -**Note**   -If the server configuration has been changed from the default, the files might be stored in a different location. - - - -## Client Upgrade - - -To upgrade the MED-V 1.0 client to MED-V 1.0 SP1, install the .msp file on a MED-V 1.0 client. The client and MED-V are automatically upgraded. - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md b/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md deleted file mode 100644 index 0ad376e710..0000000000 --- a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md +++ /dev/null @@ -1,279 +0,0 @@ ---- -title: MED-V 1.0 Supported Configurations -description: MED-V 1.0 Supported Configurations -author: dansimp -ms.assetid: 74643de6-549e-4177-a559-6407e156ed3a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 Supported Configurations - - -This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 in your environment. - -## MED-V 1.0 Client System Requirements - - -### MED-V Client Operating System Requirements - -The following table lists the operating systems that are supported for MED-V 1.0 client installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows XP

          Professional Edition

          SP2 or SP3

          x86

          Windows Vista

          Business, Enterprise, or Ultimate Edition

          SP1 or SP2

          x86

          - - - -**Note** -MED-V client does not run in native x64 mode. Instead, MED-V runs in Windows on Windows 64-bit (WOW64) mode on 64-bit computers. - - - -### MED-V 1.0 Client Configuration - -**.NET Framework Version** - -The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 client installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Virtualization Engine** - -Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 client installation in the following configurations: - -- Static Virtual Hard Disk (VHD) file - -- Multiple VHD files located within the same directory - -- Dynamic VHD file - -**Internet Browser** - -Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 client installation. - -**Microsoft Hyper-V Server** - -The MED-V client is not supported in a Microsoft Hyper-V server environment. - -## MED-V 1.0 Workspace System Requirements - - -### MED-V Workspace Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 workspaces. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows 2000

          Professional

          SP4

          X86

          Windows XP

          Professional Edition

          SP2 or SP3

          -
          -Note

          SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.

          -
          -
          - -

          x86

          - - - -### MED-V 1.0 Workspace Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation: - -- .NET Framework 2.0 SP1 - -- .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Note** -.NET Framework 3.5 SP1 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V. - - - -**Internet Browser** - -Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 workspace installation. - -### MED-V Workspace Images - -MED-V workspace images must be created by using Virtual PC 2007 SP1. - -## MED-V 1.0 Server System Requirements - - -### MED-V 1.0 Server Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 server installations. - - ------ - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows Server 2008

          Standard or Enterprise

          None

          X86 or x64

          - - - -### MED-V 1.0 Server Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Microsoft SQL Server Version** - -The following versions of Microsoft SQL Server are supported for MED-V 1.0 when SQL Server is installed locally or remotely from the MED-V 1.0 Server: - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          SQL Server VersionEditionService PackSystem Architecture

          SQL Server 2005

          Express, Standard, or Enterprise Edition

          SP2

          X86 or x64

          SQL Server 2008

          Express, Standard, or Enterprise

          None

          X86 or x64

          - - - -**Microsoft Hyper-V Server** - -The MED-V server is supported in a Microsoft Hyper-V server environment. - -## MED-V 1.0 Globalization Information - - -Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 client, workspace, and server installations: - -- English - -- French - -- German - -- Italian - -- Spanish - -- Portuguese (Brazil) - - - - - - - - - diff --git a/mdop/medv-v1/med-v-client-operations.md b/mdop/medv-v1/med-v-client-operations.md deleted file mode 100644 index e295ac9750..0000000000 --- a/mdop/medv-v1/med-v-client-operations.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: MED-V Client Operations -description: MED-V Client Operations -author: dansimp -ms.assetid: 4a5fffd2-f3f4-4e86-8529-e1386ba46c9a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Client Operations - - -## In This Section - - -This section describes the MED-V operations and explains the following tasks: - -[How to Start and Exit the MED-V Client](how-to-start-and-exit-the-med-v-client.md) -Describes how to start and exit the MED-V client. - -[How to Start, Stop, and Restart a MED-V Workspace](how-to-start-stop-and-restart-a-med-v-workspace.md) -Describes how to start, stop, and restart a MED-V workspace. - -[How to View MED-V Settings and General Information](how-to-view-med-v-settings-and-general-information.md) -Describes how to view MED-V settings and general information. - -[How to Lock and Unlock a Workspace](how-to-lock-and-unlock-a-workspace.md) -Describes how to lock and unlock a MED-V workspace. - -[MED-V Client Tools](med-v-client-toolsv2.md) -Describes the file transfer tool, image downloads, and diagnostics. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-client-toolsv2.md b/mdop/medv-v1/med-v-client-toolsv2.md deleted file mode 100644 index a49324c8b9..0000000000 --- a/mdop/medv-v1/med-v-client-toolsv2.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: MED-V Client Tools -description: MED-V Client Tools -author: dansimp -ms.assetid: ea18d82e-2433-4754-85ac-6eac84bcbb01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Client Tools - - -MED-V includes the following client tools: - -- [File Transfer Tool](#bkmk-filetransfertool) - -- [Image Downloads](#bkmk-imagedownloads) - -- [Diagnostics](#bkmk-diagnostics) - -## File Transfer Tool - - -The File Transfer Tool can be used to copy files or folders from the MED-V workspace to the host and vice versa. - -**Note**   -The File Transfer Tool is enabled only when the MED-V workspace is running. - - - -**To copy files or folders from a MED-V workspace that is currently running** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Tools**, and then click **File Transfer**. - -3. In the **File Transfer** tool, in the **Select transfer direction** field, click one of the following transfer options: - - - **Copy from My Computer to 'default workspace' Workspace**—Transfer a file or folder from the host to the active MED-V workspace. - - - **Copy from 'default workspace' Workspace to My Computer**—Transfer a file or folder from the active MED-V workspace to the host. - -4. Select the file or folder to copy by doing one of the following: - - - In the **File to copy** field, type the full path to the directory where the file or folder to copy is located. - - - Click **Browse** to browse the directory where the file or folder to copy is located. - -5. Select the **Copy a folder** check box to copy an entire folder. - -6. Select the destination where the file is being transferred by doing one of the following: - - - In the **Destination** field, type the full path of the directory where the file or folder will be transferred. - - - Click **Browse** to browse to the directory where the file or folder will be transferred. - -7. Click **Start**. - - The file transfer begins. - -## Image Downloads - - -When a new image update is available for a MED-V workspace and the MED-V workspace is active, the user receives a message indicating that a new image is ready for download. - -**To view available images for download** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Tools**, and then click **Image Downloads**. - - All available image downloads are displayed. - -## Diagnostics - - -The diagnostics tool provides all diagnostic information. - -**To view diagnostics** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Help**, and then click **MED-V Diagnostics**. - -3. In the **Diagnostics** tool, review all diagnostic information. - -The following functions can be performed using the diagnostic tool: - -- Gather diagnostic logs—Gather the diagnostic logs, and place them on the desktop. - -- Update policy—The MED-V workspace policy automatically connects to the MED-V server to refresh the policy every 15 minutes. However, a user can use this option to perform a manual refresh immediately. - -- Enable or Disable diagnostic mode—Display the virtual machine window. This function is helpful when, for example, you need to see MED-V workspace windows that are not displayed. - -- Browse image store—View all available MED-V workspace images. - - - - - - - - - diff --git a/mdop/medv-v1/med-v-deployment-and-configuration.md b/mdop/medv-v1/med-v-deployment-and-configuration.md deleted file mode 100644 index 38648cf7f4..0000000000 --- a/mdop/medv-v1/med-v-deployment-and-configuration.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: MED-V Deployment and Configuration -description: MED-V Deployment and Configuration -author: dansimp -ms.assetid: 3a224c78-58b0-454c-ad6d-5ce87fbb2526 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Deployment and Configuration - - -## In This Section - - -This section describes Microsoft Enterprise Desktop Virtualization (MED-V) deployment and configuration and includes the following: - -[MED-V Installation Prerequisites](med-v-installation-prerequisites.md) -Describes the prerequisites required before installing MED-V. - -[Supported Configurations](supported-configurationsmedv-orientation.md) -Describes the supported configurations for both MED-V 1.0 and MED-V 1.0 SP1. - -[Installation and Upgrade Checklists](installation-and-upgrade-checklists.md) -Provides the installation checklist for MED-V 1.0 and an upgrade checklist for MED-V 1.0 SP1. - -[Installing and Configuring MED-V Components](installing-and-configuring-med-v-components.md) -Provides procedures for installing and configuring the MED-V server, image repository, MED-V client, and MED-V management console, and the procedure for uninstalling the MED-V components. - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) -Describes how to create and configure a VPC image for MED-V. - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) -Describes how to create a MED-V workspace. - -[Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) -Describes how to configure MED-V workspace policies. - -[Configuring MED-V for Remote Networks](configuring-med-v-for-remote-networks.md) -Describes how to configure MED-V to work from inside a network, remotely, or both from inside the network and remotely. - -[Configuring MED-V Server for Cluster Mode](configuring-med-v-server-for-cluster-mode.md) -Describes how to configure MED-V server using two servers and place all files mutual to both servers on a file system. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md b/mdop/medv-v1/med-v-infrastructure-planning-and-design.md deleted file mode 100644 index a0654e7a12..0000000000 --- a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: MED-V Infrastructure Planning and Design -description: MED-V Infrastructure Planning and Design -author: dansimp -ms.assetid: 6129b8f6-4b20-4403-8edd-68b007791139 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Infrastructure Planning and Design - - -## In This Section - - -This section provides direction in planning and designing a Microsoft Enterprise Desktop Virtualization (MED-V) infrastructure and addresses the following tasks: - -[Define the Project Scope](define-the-project-scope.md) -Describes how to define the project scope by defining the end users, determining the MED-V images to be managed, determining the organization’s service level expectations, and validating with the business. - -[Identify the Number of MED-V Instances](identify-the-number-of-med-v-instances.md) -Describes how to identify the number of MED-V instances required. - -[Design the MED-V Server Infrastructure](design-the-med-v-server-infrastructure.md) -Describes how to design the server for each MED-V instance, the SQL Server database, and the management console. - -[Design the MED-V Image Repositories](design-the-med-v-image-repositories.md) -Describes the steps required in designing the MED-V image repositories. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-installation-prerequisites.md b/mdop/medv-v1/med-v-installation-prerequisites.md deleted file mode 100644 index 08db5ec442..0000000000 --- a/mdop/medv-v1/med-v-installation-prerequisites.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: MED-V Installation Prerequisites -description: MED-V Installation Prerequisites -author: dansimp -ms.assetid: cf3c0906-23eb-4c4a-8951-a65741720f95 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V Installation Prerequisites - - -The following are prerequisites for installing MED-V: - -[Active Directory Requirements](#bkmk-activedirectoryrequirements) - -[Report Database](#bkmk-howtoinstallthereportdatabase) - -[Antivirus/Backup Software Configuration](#bkmk-antivirusbackupsoftwareconfiguration) - -[Microsoft Virtual PC 2007 SP1](#bkmk-howtoinstallandconfiguremicrosoftvirtualpc2007sp1) - -## Active Directory Requirements - - -When configuring the MED-V server, if users are not part of the same domain the server belongs to, a trust must be set between the domains. - -## How to Install the Report Database - - -The report database is required for storing all MED-V workspace logs. The log database is then used for generating MED-V reports. For information about reports, see [MED-V Reporting](med-v-reporting.md). - -SQL Server can be installed on the same server as the MED-V server or on a remote server. If installing on a remote server, see [Installing SQL Server on a Remote Server](#bkmk-installingsqlserveronaremoteserver). - -### Installing SQL Server on a Remote Server - -**To install SQL Server on a remote server** - -1. Configure the following on the remote server: - - - Instance name—Default instance - - - Authentication mode—Mixed mode - - - User—The default user created is “sa” - - - Password—Desired password - - - Collation Settings—Default - - - Error in usage report settings—Default - -2. Install the following files on the MED-V server: - - - To install the prerequisites for the management pack objects collection for Microsoft SQL Server 2008, download [Microsoft SQL Server 2008 Native Client](https://go.microsoft.com/fwlink/?LinkId=164039) from the Microsoft Download Center. - - - To install the prerequisites for the management pack objects collection for Microsoft SQL Server 2005, download [Microsoft SQL Server 2005 Native Client](https://go.microsoft.com/fwlink/?LinkId=164038) from the Microsoft Download Center. - - - To install the required dll files for Microsoft SQL Server 2008, download [Microsoft SQL Server 2008 Management Objects Collection](https://go.microsoft.com/fwlink/?LinkId=164041) from the Microsoft Download Center. - - - To install the required dll files for Microsoft SQL Server 2005, download [Microsoft SQL Server 2005 Management Objects](https://go.microsoft.com/fwlink/?LinkId=164040) from the Microsoft Download Center. - - - To install the stand-alone install packages that provide additional value for SQL Server 2008, download the [Microsoft SQL Server 2008 Feature Pack](https://go.microsoft.com/fwlink/?LinkId=163960) from the Microsoft Download Center. - - - To install the stand-alone install packages that provide additional value for SQL Server 2005, download the [Feature Pack for Microsoft SQL Server 2005]( https://go.microsoft.com/fwlink/?LinkId=163961) from the Microsoft Download Center. - - For more information about these files, see [Microsoft SQL Server 2008 Feature Pack](https://go.microsoft.com/fwlink/?LinkId=163960) on the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=163960) or [Feature Pack for Microsoft SQL Server 2005](https://go.microsoft.com/fwlink/?LinkId=163961) on the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=163961). - -## Antivirus/Backup Software Configuration - - -To prevent antivirus activity from affecting the performance of the virtual desktop, it is recommended where possible to exclude the following virtual machine file types from any antivirus or backup processing running on the host: - -- \*.VMC - -- \*.VUD - -- \*.VSV - -- \*.CKM - -- \*.EVHD - -## How to Install and Configure Microsoft Virtual PC 2007 SP1 - - -**Important**   -If Virtual PC for Windows exists on the host computer, uninstall it before installing Virtual PC 2007 SP1. - - - -**To install Microsoft Virtual PC 2007 SP1** - -1. Download Virtual PC 2007 SP1 from the Microsoft Download Center [Virtual PC 2007 SP1](https://go.microsoft.com/fwlink/?LinkId=142994). - -2. Run the installation file on the host computer, and follow the wizard. - -3. Install Virtual PC 2007 SP1 update on the host computer in elevated mode. - - For more information, see [the description of the hotfix package for Virtual PC 2007 SP1](https://go.microsoft.com/fwlink/?LinkId=150575). - - **Note**   - The Virtual PC 2007 SP1 update is required for running Virtual PC 2007 SP1. - - - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - - - - - - - - - diff --git a/mdop/medv-v1/med-v-operations.md b/mdop/medv-v1/med-v-operations.md deleted file mode 100644 index c76249664e..0000000000 --- a/mdop/medv-v1/med-v-operations.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: MED-V Operations -description: MED-V Operations -author: dansimp -ms.assetid: ce362dc0-47a4-4e66-af64-66734fa50c08 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Operations - - -## In This Section - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) -Describes the Microsoft Enterprise Desktop Virtualization (MED-V) management console, as well as how to open it and log in. - -[Creating a MED-V Image](creating-a-med-v-image.md) -Describes how to configure a MED-V image on a computer on which the MED-V client and MED-V management application are installed. - -[Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md) -Describes how to deploy a MED-V workspace using an enterprise software distribution system. - -[Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md) -Describes how to deploy a MED-V workspace using a deployment package. - -[Updating a MED-V Workspace Image](updating-a-med-v-workspace-image.md) -Describes the various ways of updating a MED-V workspace image. - -[MED-V Client Operations](med-v-client-operations.md) -Describes the operations that can be performed using MED-V client. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-reporting.md b/mdop/medv-v1/med-v-reporting.md deleted file mode 100644 index 17674e3619..0000000000 --- a/mdop/medv-v1/med-v-reporting.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: MED-V Reporting -description: MED-V Reporting -author: dansimp -ms.assetid: b379153b-be89-4a76-a284-2bb4591c3490 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Reporting - - -MED-V provides status, activity log, and error reports to help the administrator review the status, activity, and errors of MED-V users and MED-V workspace. - -## In This Section - - -[How to Generate Reports](how-to-generate-reports-medvv2.md) -Describes how to generate the different types of reports. - -[How to Work with Reports](how-to-work-with-reports.md) -Describes the functions used when working with reports. - -## Related topics - - -[How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md b/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md deleted file mode 100644 index 1aaecaa5a4..0000000000 --- a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: MED-V Trim Transfer Technology -description: MED-V Trim Transfer Technology -author: dansimp -ms.assetid: 2744e855-a486-4028-9606-f0084794ec65 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Trim Transfer Technology - - -## - - -The MED-V advanced Trim Transfer de-duplication technology accelerates the download of initial and updated virtual machine images over the LAN or WAN, thereby reducing the network bandwidth needed to transport a MED-V workspace virtual machine to multiple end users. - -This breakthrough technology uses existing local data to build the virtual machine image, leveraging the fact that in many cases, much of the virtual machine (for example, system and application files) already exists on the end user's disk. For example, if a virtual machine containing Windows XP is delivered to a client running a local copy of Windows XP, MED-V will automatically remove the redundant Windows XP elements from the transfer. To ensure a valid and functional workspace, the MED-V client cryptographically verifies the integrity of local data before it is utilized, guaranteeing that the local blocks of data are absolutely bit-by-bit identical to those in the desired virtual machine image. Blocks that do not match are not used. - -The process is bandwidth-efficient and transparent, and transfers run in the background, utilizing unused network and CPU resources. - -When updating to a new image version (for example, when administrators want to distribute a new application or patch), only the elements that have changed ("deltas") are downloaded, and not the entire virtual machine, significantly reducing the required network bandwidth and delivery time. - -You can configure which folders are indexed on the host as part of the Trim Transfer protocol, based on the host operating system. These settings are configured in the *ClientSettings.xml* file, which can be found in the **Servers\\Configuration Server\\** folder. - -When applying new settings, the service must be restarted. - -```xml - -- -%WINDIR% -%ProgramFiles%\Common Files -%ProgramFiles%\Internet Explorer -%ProgramFiles%\MED-V -%ProgramFiles%\Microsoft Office -%ProgramFiles%\Windows NT -%ProgramFiles%\Messenger -%ProgramFiles%\Adobe -%ProgramFiles%\Outlook Express - - -- -- -%WINDIR%\MSAgent -%WINDIR%\winsxs -%WINDIR%\system -%WINDIR%\system32 -%WINDIR%\Microsoft.NET -%WINDIR%\SoftwareDistribution -%WINDIR%\L2Schemas -%WINDIR%\Cursors -%WINDIR%\Boot -%WINDIR%\Help -%WINDIR%\assembly -%WINDIR%\inf -%WINDIR%\fonts -%WINDIR%\Installer -%WINDIR%\IME -%WINDIR%\Resources -%WINDIR%\servicing -%ProgramFiles%\MED-V -%ProgramFiles%\Microsoft Office - - -``` - -  - -  - - - - - diff --git a/mdop/medv-v1/overview-of-med-v.md b/mdop/medv-v1/overview-of-med-v.md deleted file mode 100644 index 0d46bf93a7..0000000000 --- a/mdop/medv-v1/overview-of-med-v.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Overview of MED-V -description: Overview of MED-V -author: dansimp -ms.assetid: 32a85b79-91b0-4507-a57a-01ff0fa029f5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of MED-V - - -MED-V uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. - -MED-V is an integral component of the Microsoft Desktop Optimization Pack, a dynamic solution available to Software Assurance customers, which helps reduce application deployment costs, enables delivery of applications as services, and helps to better manage and control enterprise desktop environments. - -  - -  - - - - - diff --git a/mdop/medv-v1/supported-configurationsmedv-orientation.md b/mdop/medv-v1/supported-configurationsmedv-orientation.md deleted file mode 100644 index c66ad41ec2..0000000000 --- a/mdop/medv-v1/supported-configurationsmedv-orientation.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Supported Configurations -description: Supported Configurations -author: dansimp -ms.assetid: c1438455-445a-4bc8-ae20-483b26181f6f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Supported Configurations - - -This section provides the supported configurations for MED-V 1.0 and MED-V 1.0 SP1. - -## In This Section - - -[MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -Delineates the supported configurations for MED-V 1.0. - -[MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -Delineates the supported configurations for MED-V 1.0 SP1. - -  - -  - - - - - diff --git a/mdop/medv-v1/technical-referencemedv-10-sp1.md b/mdop/medv-v1/technical-referencemedv-10-sp1.md deleted file mode 100644 index 77b1fc1045..0000000000 --- a/mdop/medv-v1/technical-referencemedv-10-sp1.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Technical Reference -description: Technical Reference -author: dansimp -ms.assetid: 387462c7-bb46-40b8-b4cf-ee9453972582 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference - - -## In This Section - - -This section provides the following technical references for Microsoft Enterprise Desktop Virtualization (MED-V): - -[MED-V Reporting](med-v-reporting.md) -Describes how to generate reports and how to work with reports. - -[MED-V Trim Transfer Technology](med-v-trim-transfer-technology-medvv2.md) -Describes the MED-V Trim Transfer technology concept. - -[How to Back Up and Restore a MED-V Server](how-to-back-up-and-restore-a-med-v-server.md) -Describes how to back up and restore a MED-V server. - -[How to Share Folders Between the Host and the MED-V Workspace](how-to-share-folders-between-the-host-and-the-med-v-workspace.md) -Describes how to share folders located on the network and folders located on the host. - -[How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md) -Describes how to set MED-V workspace deletion options for each user or group. - -[How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md) -Describes the advanced file transfer options. - -[How to Edit a Published Application with Advanced Settings](how-to-edit-a-published-application-with-advanced-settings.md) -Describes editing a published application with advanced settings. - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) -Describes the script actions editor. - -[Client Installation Command Line Reference](client-installation-command-line-reference.md) -Describes how to install MED-V from the command line. - -[How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md) -Describes how to configure image pre-staging and how to update the pre-stage location. - -  - -  - - - - - diff --git a/mdop/medv-v1/troubleshooting-med-v.md b/mdop/medv-v1/troubleshooting-med-v.md deleted file mode 100644 index 52b110ec3b..0000000000 --- a/mdop/medv-v1/troubleshooting-med-v.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: Troubleshooting MED-V -description: Troubleshooting MED-V -author: dansimp -ms.assetid: f43dae36-6485-4e06-9c66-0a646e27079d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting MED-V - - -This section provides information to help troubleshoot general issues with Microsoft Enterprise Desktop Virtualization (MED-V). - -## Changing the host resolution and then maximizing the MED-V workspace causes the desktop to appear black - - -When working in full desktop mode, if you change the host resolution and then maximize the MED-V workspace window, the desktop appears black and the MED-V workspace might not respond. - -### Solution - -Stop and then start the MED-V workspace. - -## Starting a MED-V workspace with a network adapter disabled and then later enabling the adapter does not restore network connectivity - - -If you configure a MED-V workspace in bridge mode and then start the MED-V workspace while a network adapter is disabled, if the adapter is later enabled, the network connectivity through that adapter is not restored. - -### Solution - -Stop and then start the MED-V workspace. - -## An image can be used by only one Windows user per computer - - -A MED-V workspace image can be used only by the Windows user who downloaded or imported the image. This user is the only user aside from administrators who have permissions to the folder where the downloaded images are located. - -### Solution - -Manually change the access control list (ACL) on the image store. - -## When installing MED-V by using Configuration Manager with users rights enabled, uninstall fails - - -If MED-V is installed by using Microsoft System Center Configuration Manager and the run mode of the package is set to users rights, uninstall fails with an error message that says that only administrative users can uninstall MED-V. - -### Solution - -When creating a Configuration Manager package for MED-V, set the run mode to administrative rights. - -## When installing MED-V by using a corporate deployment system, where the installation is configured to run the client following installation, you cannot run the client - - -If MED-V is installed by using a corporate deployment system and the installation package is configured to run MED-V client following the installation, after the client is running under the system account, you cannot see that the client is running (except in the notification area), and you cannot interact with it. - -### Solution - -When installing MED-V by using a corporate deployment system, use the *START\_MEDV=0* .msi parameter. - -## MED-V test image fails to start - - -If a MED-V test image fails to start, it will never recover and all future startups will fail with a “GINA fail to load” error message. - -### Solution - -Delete the existing test image and then re-create it. - -## After attempting to join a domain with the wrong credentials, the image never succeeds in joining the domain - - -If there is a configuration error in the join domain building block, which is part of the virtual machine first-time setup script, it causes the MED-V workspace to fail when attempting to join a domain. After the configuration error is repaired, the image included in the MED-V workspace cannot join the domain. - -### Solution - -If the image was deployed, redistribute the image. If the image was a test image, re-create the image. - -## MED-V does not support multiple monitors - - -MED-V does not support displaying published applications across multiple monitors. Published applications and other client windows may be displayed in the wrong screen, and sometimes after a screen is disconnected, MED-V attempts to send the screen to the monitor so that the connected monitor appears blank. - -### Solution - -Disconnect the additional screen, and restart the client. - -## MED-V workspace might fail to start if the host crashes during MED-V workspace startup - - -If the host crashes during the MED-V workspace startup process and an error message appears that says “Root element is missing,” the MED-V workspace might add data to an empty virtual machine configuration (VMC) file, which will cause the startup process to fail. - -### Solution - -Replace the empty VMC file with a VMC file from the base image. - -## The keyboard does not respond in published application windows - - -In a MED-V workspace, if you press the Windows logo key when a published application is in focus, the keyboard no longer responds in published application windows. - -### Solution - -Press the Windows logo key while a published application is in focus. - -## A domain MED-V workspace does not update domain credentials - - -When using a persistent MED-V workspace in a domain environment, if you change your domain password, the MED-V client does not update the MED-V workspace domain credentials. When a published application attempts to access a network resource, you will receive an error message notifying you that your credentials expired. - -### Solution - -Restart the MED-V workspace operating system. - -## Maximized published application windows cover the host taskbar - - -If you maximize a published application window to full screen, it might cover the host taskbar. - -### Solution - -Do one of the following: - -Minimize the published application window to gain access to the notification area, and restart the MED-V workspace. - -Minimize the published application window, and then restore the window to its maximized state. - -## Adding users or groups in the MED-V Server Configuration Manager does not work - - -When adding users or groups in the **Select Users or Groups** dialog box, the selected users or groups are not added to the access control list in the MED-V Server Configuration Manager. - -### Solution - -Add users or groups using the **Enter User or Group names** dialog box. For detailed information, see [How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md#bkmk-configuringpermissions). - -## MED-V does not work on computers with Windows Virtual PC for Windows 7 installed - - -MED-V requires Windows Virtual PC 2007. Windows Virtual PC for Windows 7 and Virtual PC 2007 SP1 cannot be installed on the same computer. - -### Solution - -Uninstall Virtual PC for Windows 7 before installing Virtual PC 2007 SP1 and MED-V. - -## MED-V does not support Virtual PC and Windows XP Mode images - - -MED-V 1.0 SP1 does not support images created by Windows Virtual PC for Windows 7. If a Virtual PC for Windows 7 image is used, the client will fail during startup. - -### Solution - -Create MED-V images by using Virtual PC 2007 SP1. - -## Windows firewall blocks Virtual PC 2007 SP1 network activity - - -By default, Windows firewall blocks Virtual PC 2007 SP1 network activity, and when Virtual PC 2007 SP1 initiates on the client computer, there is a firewall message that blocks its startup sequence and all network access. - -### Solution - -Update the firewall exception by using Group Policy before MED-V is used by the end user. - -## When upgrading the client an error message appears - - -When upgrading the client from MED-V 1.0 to MED-V 1.0 SP1, a message may appear notifying you that no MED-V workspace is defined. - -### Solution - -Close the client and restart it. - -## Related topics - - -[MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) - -[MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/updating-a-med-v-workspace-image.md b/mdop/medv-v1/updating-a-med-v-workspace-image.md deleted file mode 100644 index c030f2922c..0000000000 --- a/mdop/medv-v1/updating-a-med-v-workspace-image.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Updating a MED-V Workspace Image -description: Updating a MED-V Workspace Image -author: dansimp -ms.assetid: 1b9c4a73-3487-43d2-98e3-43dbc79e10e3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Updating a MED-V Workspace Image - - -An image can be updated in one of the following ways: - -- The update can be pushed to the guest operating system using your enterprise software distribution system. - -- The update can be uploaded to the image Web distribution server, and then downloaded by the client and applied to the MED-V image. - -- The MED-V base image can be updated and redeployed. - -## How to Update a MED-V Image Using an Enterprise Software Distribution System - - -**To update a MED-V image using an enterprise software distribution system** - -- Refer to the documentation of the system you are using. - -## How to Update a MED-V Image Using Web Download - - -**To update a MED-V image using Web download** - -1. In MED-V management, on the **Virtual Machine** tab, ensure that the following settings are applied to the MED-V workspace policies that are associated with the MED-V image being updated: - - - The **Suggest update when a new version is available** check box is selected. - - - Optionally, the **Clients should use Trim Transfer when downloading images for this Workspace** check box is selected. - - For more information, see [How to Apply Virtual Machine Settings to a MED-V Workspace](how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md). - -2. Upload the image update to the image Web distribution server. - - All clients with images that need to be updated automatically download the update and apply it to the image. - -## How to Update a MED-V Base Image - - -**To update a MED-V base image** - -1. Open the existing image in Virtual PC 2007. - -2. Make the required changes to the image, updating the image (such as installing new software). - -3. Close Virtual PC 2007. - -4. Test the image. - -5. After the image is tested, pack it to the local repository, using the same name as the existing image. - - **Note**   - If you name the image a different name than the existing version, a new image will be created rather than a new version of the existing image. - - - -6. Upload the new version to the server, push it to the image pre-stage folder, or distribute it via a deployment package. - -## Related topics - - -[Creating a MED-V Image](creating-a-med-v-image.md) - -[How to Update a MED-V Image](how-to-update-a-med-v-image.md) - -[Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) - - - - - - - - - diff --git a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md b/mdop/medv-v1/using-the-med-v-management-console-user-interface.md deleted file mode 100644 index 58bf527214..0000000000 --- a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Using the MED-V Management Console User Interface -description: Using the MED-V Management Console User Interface -author: dansimp -ms.assetid: f42714d7-6f0c-4995-ab31-d4ef0845a22c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using the MED-V Management Console User Interface - - -The console user interface is divided into the following sections: - -- The following **MED-V management buttons**, which correspond to the three modules: - - - **Policy**—The **Policy** module is used to define the MED-V workspaces and their related settings and permissions. - - - **Images**—The **Images** module is used to manage MED-V workspace images. - - - **Reports**—The **Reports** module is used for generating and viewing MED-V workspace reports. - -- The **toolbar** displays shortcuts relevant to the button selected. - -- The **display pane** displays a module corresponding to the button that is selected. - -![](images/medv-ui-console-general.gif) - -## How to Log In to the MED-V Management Console - - -**To open the MED-V management console** - -- On the Windows **Start** menu, select **All Programs > MED-V > MED-V Management**, or on the desktop, double-click the MED-V Management icon. - - The **MED-V Management Login** window appears. - -**Note**   -For security reasons, the first user to log in to the MED-V management console will become the only user on that computer allowed to access the management console. - - - -**To log in** - -1. Type in your domain user credentials in the following format: - - "domain\_name\\user\_name", "password" - - **Note**   - When configuring the server, users with full access as well as users with read-only access are defined. All users must be domain users. The domain user name and password is used for MED-V management login. - - - -2. Click **OK**. - - The **MED-V Management** console appears. - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - - - - - - - - - diff --git a/mdop/medv-v2/TOC.md b/mdop/medv-v2/TOC.md deleted file mode 100644 index 80bb2410e7..0000000000 --- a/mdop/medv-v2/TOC.md +++ /dev/null @@ -1,85 +0,0 @@ -# [Microsoft Enterprise Desktop Virtualization 2](index.md) -## [Getting Started with MED-V](getting-started-with-med-vmedv2.md) -### [Overview of MED-V](overview-of-med-vmedv2.md) -### [Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) -### [High-Level Architecture](high-level-architecturemedv2.md) -### [About MED-V 2.0](about-med-v-20.md) -#### [What's New in MED-V 2.0](whats-new-in-med-v-20.md) -#### [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -#### [MED-V 2.0 Release Notes](med-v-20-release-notes.md) -## [Planning for MED-V](planning-for-med-v.md) -### [End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) -### [Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) -#### [Determining How MED-V Will Be Deployed](determining-how-med-v-will-be-deployed.md) -#### [Identifying the Number and Types of MED-V Workspaces](identifying-the-number-and-types-of-med-v-workspaces.md) -### [MED-V 2.0 Best Practices](med-v-20-best-practices.md) -## [Deployment of MED-V](deployment-of-med-v.md) -### [End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) -### [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -### [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) -### [Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) -#### [Configure Environment Prerequisites](configure-environment-prerequisites.md) -#### [Configure Installation Prerequisites](configure-installation-prerequisites.md) -### [Deploy the MED-V Components](deploy-the-med-v-components.md) -#### [How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md) -#### [How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md) -#### [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md) -#### [How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) -## [Operations for MED-V](operations-for-med-v.md) -### [End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) -### [Prepare a MED-V Image](prepare-a-med-v-image.md) -#### [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md) -#### [Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) -#### [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) -### [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) -#### [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md) -### [Test And Deploy the MED-V Workspace Package](test-and-deploy-the-med-v-workspace-package.md) -#### [Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) -##### [How to Create a Test Environment](how-to-create-a-test-environment.md) -##### [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) -##### [How to Test URL Redirection](how-to-test-url-redirection.md) -##### [How to Test Application Publishing](how-to-test-application-publishing.md) -#### [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) -##### [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) -##### [How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) -##### [How to Deploy a MED-V Workspace Manually](how-to-deploy-a-med-v-workspace-manually.md) -### [Monitor MED-V Workspaces](monitor-med-v-workspaces.md) -#### [Monitoring MED-V Workspace Deployments](monitoring-med-v-workspace-deployments.md) -#### [Detecting Network Changes that Affect MED-V](detecting-network-changes-that-affect-med-v.md) -### [Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) -#### [Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md) -##### [Installing and Removing an Application on the MED-V Workspace](installing-and-removing-an-application-on-the-med-v-workspace.md) -##### [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) -#### [Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) -#### [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md) -### [Manage MED-V URL Redirection](manage-med-v-url-redirection.md) -#### [How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md) -#### [How to Manage URL Redirection by Using the MED-V Workspace Packager](how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md) -### [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) -#### [Managing MED-V Workspace Settings by Using the MED-V Workspace Packager](managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md) -#### [Managing MED-V Workspace Settings by Using a WMI](managing-med-v-workspace-settings-by-using-a-wmi.md) -#### [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) -#### [Managing Printers on a MED-V Workspace](managing-printers-on-a-med-v-workspace.md) -## [Troubleshooting MED-V](troubleshooting-med-vmedv2.md) -### [Deployment Troubleshooting](deployment-troubleshooting.md) -### [Operations Troubleshooting](operations-troubleshooting-medv2.md) -### [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md) -#### [Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) -#### [Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) -#### [Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) -## [Security and Protection for MED-V](security-and-protection-for-med-v.md) -### [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) -### [Authentication of MED-V End Users](authentication-of-med-v-end-users.md) -## [Technical Reference for MED-V](technical-reference-for-med-v.md) -### [Command-Line Options for MED-V Installation Files](command-line-options-for-med-v-installation-files.md) -### [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md) -### [MED-V Event Log Messages](med-v-event-log-messages.md) -### [Updating MED-V 2.0](updating-med-v-20.md) -### [Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md) -### [Example MED-V Checklists](example-med-v-checklists.md) -#### [Example MED-V Environment Planning Checklist](example-med-v-environment-planning-checklist.md) -#### [Example MED-V Project Planning Checklist](example-med-v-project-planning-checklist.md) -#### [Example MED-V System Installation Checklist](example-med-v-system-installation-checklist.md) -#### [Example MED-V Image Preparation Checklist](example-med-v-image-preparation-checklist.md) -#### [Example MED-V Workspace Deployment Checklist](example-med-v-workspace-deployment-checklist.md) - diff --git a/mdop/medv-v2/about-med-v-20.md b/mdop/medv-v2/about-med-v-20.md deleted file mode 100644 index dd2c32be10..0000000000 --- a/mdop/medv-v2/about-med-v-20.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: About MED-V 2.0 -description: About MED-V 2.0 -author: dansimp -ms.assetid: 7ec53f2c-db6e-4a6b-a069-99d0c25cd101 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About MED-V 2.0 - - -## In This Section - - -This section provides information related specifically to MED-V 2.0 and includes the following topics: - -[What's New in MED-V 2.0](whats-new-in-med-v-20.md) -Describes system requirements and new and changed features in MED-V 2.0. - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -Describes the supported configurations for MED-V 2.0. - -[MED-V 2.0 Release Notes](med-v-20-release-notes.md) -Provides a list of known issues with MED-V 2.0. - -## Related topics - - -[Getting Started with MED-V](getting-started-with-med-vmedv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/authentication-of-med-v-end-users.md b/mdop/medv-v2/authentication-of-med-v-end-users.md deleted file mode 100644 index 843a257c5b..0000000000 --- a/mdop/medv-v2/authentication-of-med-v-end-users.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Authentication of MED-V End Users -description: Authentication of MED-V End Users -author: dansimp -ms.assetid: aaf96eb6-91d1-4f4d-9854-5fc73c7ae7ab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Authentication of MED-V End Users - - -The authentication of Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 end users is a very important security issue. In this context, authentication refers to verifying the identity of the MED-V end user. - -The following section provides information and guidance about end-user authentication in MED-V. - -## User Authentication in MED-V - - -Authentication in MED-V generally occurs at two levels: when a user first accesses MED-V and every time that they change their password. - -Depending on how you have configured MED-V settings for authentication, the end user is typically prompted at some point to enter their password, either the first time MED-V is started or the first time that they try to open a published application. - -There are several aspects of end-user authentication that you can control, including the following: - -Whether the credentials the end user enters are stored in Credential Manager - -In what manner the end user is presented with the option of entering and saving their password - -Depending on your company’s preferred process for managing end-user authentication, you can specify whether credential caching occurs for a particular MED-V workspace. Caching the credentials of an end user is helpful because they are only prompted one time for their password. If the end user is not allowed to save their password or they decide not to, every time that they start a new MED-V session, they must enter it again. For example, if MED-V is configured to start when the end user logs on to the host but Authentication is disabled, the end user is only prompted one time during logon. In this case, credentials are valid until the end user logs off from the host. - -If it is necessary, you can use Credential Manager to remove any stored end-user credentials. - -By default, credential storing is disabled, but you can change this setting through one of the following methods: - -**While you are creating the MED-V workspace package**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -**After you have deployed the MED-V workspace**. Edit the MED-V cmdlet parameter UxCredentialCacheEnabled to set the Terminal Services registry key. For more information, see Windows PowerShell Help. - -After MED-V workspace deployment, you can set your preference for end-user authentication by modifying the Terminal Services policy named DisablePasswordSaving. DisablePasswordSaving controls whether the password saving check box appears on the RDP client dialog window and whether the MED-V credential prompt is displayed. - -Following is the policy path for the Terminal Services policy named DisablePasswordSaving. - -**Regedit:** - -HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Virtual Machine\\Policies\\DisablePasswordSaving - -**Note** -The changes that you make to DisablePasswordSaving only affect the RDP prompt to a virtual machine. - - - -The following table lists the different ways you can configure your settings for credential storing and the effects of the different configurations: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          ValueConfigurationResult

          DisablePasswordSaving

          Disabled

          The MED-V prompt is presented and a check box to accept is available and cleared. If the end user selects the check box, credentials are cached for subsequent use. The end user also has the benefit of only being prompted when the password expires.

          -

          If the end user does not select the check box, the Remote Desktop Connection (RDC) Client prompt is presented instead of the MED-V prompt, and the check box to accept is cleared. If the end user selects the check box, the RDC Client credential is stored for later use.

          -
          -Important

          RDC does not validate credentials when the end user enters them. If the end user caches the credentials through the RDC prompt, there is a risk that incorrect credentials might be stored. In this case, the incorrect credentials must be deleted in the Windows Credential Manager.

          -
          -
          - -

          DisablePasswordSaving

          Enabled

          -Note

          This configuration is more secure because it does not allow end user credentials to be cached.

          -
          -
          - -
          - - - -By default, the MED-V installation sets a registry key in the guest to suppress the "password about to expire" prompt. The end user is only prompted for a password change on the host. Credentials that are updated on the host are passed to the guest. - -**Caution** -If you use Group Policy in your environment, know that it can override the registry key causing the password prompts from the guest to reappear. - - - -### Security Concerns with Authentication - -Even though caching the end user’s credentials provides the best user experience, you must be aware of the risks involved. - -When credential caching is enabled, the end user’s domain credential is stored in a reversible format within the Windows Credential Manager. As a result, an attacker could write a tool that runs as either a system level process or an end user process and that retrieves the end user's credentials. You can only lessen this risk by setting DisablePasswordSaving to **Enabled**. - -This same concern exists when MED-V authentication is disabled but the Terminal Services policy setting is enabled. - -## Related topics - - -[Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) - - - - - - - - - diff --git a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md b/mdop/medv-v2/command-line-options-for-med-v-installation-files.md deleted file mode 100644 index f6e9a21158..0000000000 --- a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: Command-Line Options for MED-V Installation Files -description: Command-Line Options for MED-V Installation Files -author: dansimp -ms.assetid: 7b8cd3e4-1d09-44a0-b690-f85b0d0a6b02 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Command-Line Options for MED-V Installation Files - - -When you install or uninstall Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, you have the option of running the installation files at the command prompt. This section describes different options that you can specify when you install or uninstall MED-V at the command prompt. - -### Command-Line Arguments - -You can use the following command-line arguments together with their respective MED-V installation files. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Installation FileArgumentAccepted ValuesTypeDescriptionDefault

          Host Agent

          MEDVDIR

          <install path>

          Installation

          Change installed directory

          Installation goes to Program Files\Microsoft Enterprise Desktop Virtualization.

          MED-V Workspace Packager

          MEDVDIR

          <install path>

          Installation

          Change installed directory

          Installation goes to Program Files\Microsoft Enterprise Desktop Virtualization.

          MED-V workspace

          INSTALLDIR

          <install path>

          Installation

          Change installed directory

          Installation goes to ProgramData\Microsoft\Medv\Workspace.

          MED-V workspace

          OVERWRITE VHD

          0 or 1

          Installation

          Fail installation if VHD exists(0) or overwrite existing VHD(1).

          Overwrite does not occur and installation fails if a virtual hard disk (VHD) already exists.

          MED-V workspace

          SUPPRESSMEDVLAUNCH

          0 or 1

          Installation

          Start(0) or do not start(1) MED-V after MED-V workspace is installed.

          If the MED-V workspace was installed with the user interface (UI), a check box on the Finish page controls whether to start MED-V.

          MED-V workspace

          DELETEDIFFDISKS

          0 or 1

          Uninstallation

          Keep(0) or delete(1) VHDs created by MED-V

          No VHDs are deleted.

          - -  - -### Examples of Command-Line Arguments - -The following example installs the MED-V workspace created by the MED-V workspace Packager. The installation file creates a log file in the Temp directory and runs the installation file in quiet mode, but does not start the MED-V Host Agent on completion. The installation file overwrites any VHD left behind by a previous installation that has the same name. - -``` syntax -setup.exe /l* %temp%\medv-workspace-install.log /qn SUPPRESSMEDVLAUNCH=1 OVERWRITEVHD=1 -``` - -The following example uninstalls the MED-V workspace that was previously installed. The installation file creates a log file in the Temp directory and runs the installation file in quiet mode. The installation file deletes any remaining virtual hard disk files from the file system. - -``` syntax -%ProgramData%\Microsoft\Medv\Workspace\uninstall.exe /l* %temp%\medv-workspace-uninstall.log /qn DELETEDIFFDISKS=1 -``` - -## Related topics - - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md b/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md deleted file mode 100644 index 66fc177330..0000000000 --- a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Compacting the MED-V Virtual Hard Disk -description: Compacting the MED-V Virtual Hard Disk -author: dansimp -ms.assetid: 5e6122d1-9847-4b33-adab-594919eec3c5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Compacting the MED-V Virtual Hard Disk - - -Although it is optional, you can compact the virtual hard disk (VHD) to reclaim empty disk space and reduce the size of the VHD before you configure the Windows Virtual PC image. - -**Important**   -Before you proceed, create a backup copy of your Windows XP image. - - - -**Preparing the Virtual Hard Disk** - -1. Open your Windows XP image. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, click **Windows Virtual PC**, then double-click your Windows XP image. - -2. Clear the DLL cache. - - 1. At a command prompt in the virtual machine, type **sfc /cachesize=1**. - - 2. Restart the virtual machine. - - 3. At a command prompt in the virtual machine, type **sfc /purgecache**. - -3. Delete unnecessary files, such as uninstallers, temp files, log files, page files, shared folders, and so on. - -4. Turn off System Restore. You can also specify this step in your Sysprep.inf file. - - 1. In **Control Panel**, double-click **System**, and then select the **System Restore** tab. - - 2. Select **Turn off System Restore**, and then click **OK**. - -5. Set maximum event log sizes and clear all events. - - 1. Open the event viewer. - - Click **Start**, click **Control Panel**, double-click **Administrative Tools**, then double-click **Event Viewer**. - - 2. Right-click **Application**, and click **Properties**. - - 3. In the **Log Size** area, set **Maximum Log Size** to 512KB and then select **Overwrite events as needed**. - - 4. Click **Clear Log**. In the **Event Viewer** dialog box that appears, click **No**. - - 5. In the **Properties** window, click **OK**. - - 6. Repeat steps a through e for the **Security** and **System** logs. - -6. Run the Disk Cleanup Tool. - - Click **Start**, click **All Programs**, click **Accessories**, click **System Tools**, and then click **Disk Cleanup**. - -7. Configure your page file as needed for your applications. - - 1. In **Control Panel**, double-click **System**, and then select the **Advanced** tab. - - 2. In the **Performance** area, click **Settings**. - - 3. In the **Virtual Memory** area, click **Change**. - - 4. Configure your page file settings. - -8. Shut down the Windows XP image. - -**Defragmenting and Pre-compacting the Virtual Hard Disk** - -1. In **Control Panel** on the host computer that is running Windows 7, click **Administrative Tools**, double-click **Computer Management**, then click **Disk Management**. - -2. By using the Disk Management Console, attach (mount) the virtual hard disk and then defragment the disk. - -3. By using an ISO extraction tool, extract the precompact.iso located in the \\Program Files\\Windows Virtual PC\\Integration Components folder. - -4. Use the precompact.exe program to compress the Windows XP virtual hard disk. - -5. By using the Disk Management Console, detach the virtual hard disk. - -**Compacting the Virtual Hard Disk** - -1. Open Windows Virtual PC. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, then click **Windows Virtual PC**. - -2. Right-click your Windows XP image and select **Settings**. - -3. Click **Hard Disk** for the one that corresponds to your Windows XP image, and then click **Modify**. - -4. Click **Compact virtual hard disk**. - -5. Click **Compact** and then click **OK**. - -Create a backup copy of your compacted virtual hard disk. - -## Related topics - - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/configure-environment-prerequisites.md b/mdop/medv-v2/configure-environment-prerequisites.md deleted file mode 100644 index 061ec06592..0000000000 --- a/mdop/medv-v2/configure-environment-prerequisites.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Configure Environment Prerequisites -description: Configure Environment Prerequisites -author: dansimp -ms.assetid: 7379e8e5-1cb2-4b8e-8acc-5c04e26f8c91 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configure Environment Prerequisites - - -Before you can deploy and run Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, you must ensure that your environment meets the following minimum prerequisites. - -**Windows 7** - -The MED-V Host Agent and the MED-V Workspace Packager are only supported in Windows 7 or newer. - -**Windows XP SP3** - -The MED-V Guest Agent is only supported in Windows XP SP3. - -**.NET Framework 3.5 SP1** - -The MED-V Host and Guest agents and the MED-V Workspace Packager require the Microsoft .NET Framework 3.5 SP1. - -**Important**   -You must also install the update [KB959209](https://go.microsoft.com/fwlink/?LinkId=204950) (https://go.microsoft.com/fwlink/?LinkId=204950), which addresses several known application compatibility issues. - - - -**Note**   -You must manually install the .NET Framework 3.5 SP1 and the update KB959209 into the Windows Virtual PC image that you prepare for use with MED-V. However, by default, the Microsoft .NET Framework 3.5 SP1 and the update are included when you install Windows 7 on the host computer. - - - -**An Active Directory Infrastructure** - -Group Policy provides the centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment. - -## Related topics - - -[Configure Installation Prerequisites](configure-installation-prerequisites.md) - -[High-Level Architecture](high-level-architecturemedv2.md) - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/configure-installation-prerequisites.md b/mdop/medv-v2/configure-installation-prerequisites.md deleted file mode 100644 index efb17dc81e..0000000000 --- a/mdop/medv-v2/configure-installation-prerequisites.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Configure Installation Prerequisites -description: Configure Installation Prerequisites -author: dansimp -ms.assetid: ff9cf28a-3eac-4b6c-8ce9-bfc202f57947 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configure Installation Prerequisites - - -The following instructions are prerequisites for installing and using Microsoft Enterprise Desktop Virtualization (MED-V) 2.0: - -[Windows Virtual PC](#bkmk-howtoinstallandconfiguremicrosoftvirtualpc7) - -[Windows Virtual PC Update](#bkmk-howtoinstallandconfiguremicrosoftvirtualpc7update) - -[Antivirus/Backup Software Configuration](#bkmk-antivirusbackupsoftwareconfiguration) - -## How to Install and Configure Windows Virtual PC - - -**Important**   -If a version of Virtual PC for Windows already exists on the host computer, you must uninstall it before you install Windows Virtual PC. - - - -**To install Windows Virtual PC** - -1. Download [Windows Virtual PC](https://go.microsoft.com/fwlink/?LinkId=195918) from the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=195918). - -2. Run the installation file on the host computer, and follow the steps in the wizard. - -**Important**   -Windows Virtual PC includes the Integration Components package, which provides features that improve the interaction between the virtual environment and the physical computer. For example, it lets your mouse move between the host and the guest computers. MED-V requires the installation of the Integration Components package. - - - -## How to Install and Configure the Windows Virtual PC Update - - -The Microsoft update associated with article KB977206 enables Windows XP Mode for computers without hardware-assisted virtualization (HAV) technology. We recommended that you install this update because some integration features might not work correctly if the Integration Components package in the guest operating system do not match the version of Windows Virtual PC that is installed on the host computer. - -**Important**   -You do not have to install this update when you are installing MED-V on host computers that are running Windows 7 with Service Pack 1. - - - -**Tip**   -In addition to the update listed here, we recommend that you review all available Windows Virtual PC updates and apply those updates that are appropriate or necessary for your environment. - - - -**To install the Windows Virtual PC Update** - -1. Download the required Windows Virtual PC update from the Microsoft Download Center. - - [32-bit Update](https://go.microsoft.com/fwlink/?LinkId=195919) (https://go.microsoft.com/fwlink/?LinkId=195919). - - [64-bit Update](https://go.microsoft.com/fwlink/?LinkId=195920) (https://go.microsoft.com/fwlink/?LinkId=195920). - -2. Run the installation file on the host computer in elevated mode, and follow the steps in the wizard. - - For more information about the hotfix package for Windows Virtual PC, see [article 977206](https://go.microsoft.com/fwlink/?LinkId=195921) (https://go.microsoft.com/fwlink/?LinkId=195921). - -## How to Configure Antivirus/Backup Software - - -To prevent antivirus activity from affecting the performance of the virtual desktop, we recommend, where you can, to exclude the following virtual machine file types from any antivirus or backup process that is running on the host computer: - -- \*.VMC - -- \*.VUD - -- \*.VSV - -- \*.VHD - -## Related topics - - -[Configure Environment Prerequisites](configure-environment-prerequisites.md) - -[High-Level Architecture](high-level-architecturemedv2.md) - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md deleted file mode 100644 index 90b935ecef..0000000000 --- a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Configuring a Windows Virtual PC Image for MED-V -description: Configuring a Windows Virtual PC Image for MED-V -author: levinec -ms.assetid: d87a0df8-9e08-4d1e-bfb0-9dc3cebf0d28 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# Configuring a Windows Virtual PC Image for MED-V - - -After you have installed everything that you want to include in your MED-V image, you can configure the image for use in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. The topics in this section provide guidance for configuring your MED-V image to run first time setup before you create your MED-V workspace package. - -First time setup prepares the MED-V workspace for an end user. The process creates a virtual machine from the image packaged in the MED-V workspace and then runs Windows Mini-Setup on the virtual machine. This includes the running of both custom setup scripts and the first time setup completion application, FtsCompletion.exe. - -Follow these steps to configure your MED-V image for running first time setup: - -1. As an option, you can compact the virtual hard disk (VHD) to reclaim empty disk space and reduce the size of the VHD before you continue with configuring the Windows Virtual PC image. For more information, see [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md). - -2. Customize the virtual machine setup process. - -3. Seal the MED-V image by using Sysprep. - - **Customizing the Virtual Machine Setup Process** - -4. As part of preparing your image for use with MED-V, you can configure various settings on the virtual machine, such as specifying the settings for running Windows Update. Specify all the necessary virtual machine settings before you create the MED-V workspace package. - -5. Before you create the MED-V workspace package, we recommend that you disable restore points on the virtual machine to prevent the differencing disk from growing unbounded. For more information, see [How to turn off and turn on System Restore in Windows XP](https://go.microsoft.com/fwlink/?LinkId=195927) (https://go.microsoft.com/fwlink/?LinkId=195927). - - **Note** - You can set up your Sysprep.inf file to disable restore points when first time setup is run. For an example of setting this GuiRunOnce key, see the sample Sysprep.inf file later in this section. - - - -6. Configure the setup process to run Mini-Setup instead of the default Windows Welcome. You must either run the Sysprep tool by using the **-mini** switch, or select the **MiniSetup** check box in the graphical user interface. For more information, see [How to Seal the Image with Sysprep](#bkmk-seal). - - **Calling the First time setup Completion File** - - 1. An executable called FtsCompletion.exe is included as part of the installation of the MED-V Guest Agent. By default, it is located in the system drive of your MED-V image under **Program Files – Microsoft Enterprise Desktop Virtualization**. - - **Important** - As the final step in the first time setup process, you must run this executable program. The user for whom the executable program is being called must be a member of the guest’s local administrator group. - - - - 2. You can decide how you want to call this executable program, for example, through a script that is deployed with the MED-V workspace. You can call this executable as the last line of your Sysprep.inf file. For an example of how to call this executable program in your Sysprep.inf file, see the sample file later in this section. - -After you have completed customization of your MED-V image, you are ready to seal the image by using Sysprep. - -**Sealing the MED-V Image by Using Sysprep** - -1. The System Preparation tool (Sysprep) is a technology that you can use to perform image-based installations throughout the network with minimal intervention by an administrator or IT-Professional. - -2. In a MED-V environment, you can use Sysprep to assign unique security IDs (SID) and other settings to each MED-V workspace the first time that they are started. - - **Note** - For more information about how to use Sysprep, see [Sysprep Technical Reference](https://go.microsoft.com/fwlink/?LinkId=195930) (https://go.microsoft.com/fwlink/?LinkId=195930). - - - -~~~ -**Caution** -When you use non-ASCII characters in the Sysprep.inf file, you must save the file by using the encoding appropriate for the characters entered. Windows XP expects the Sysprep.inf file to be encoded by using the code page for the language that you are targeting. - -You must also make sure that the System Locale of the computers to which the MED-V workspace is deployed is set to handle the language specific characters that might be present in the Sysprep.inf file. To change the settings for the System Locale, follow these steps: - -1. To open Region and Language, click **Start**, click **Control Panel**, and then click **Region and Language**. - -2. Click the **Administrative** tab, and then click **Change System Locale** under **Language for non-Unicode programs**. - - If you are prompted for an administrator password or confirmation, type the administrator password or provide confirmation. - -3. Select your preferred language and then click **OK**. - - - -**To configure Sysprep on the MED-V Guest Computer** - -1. Create a folder named *Sysprep* in the root of the MED-V image system drive. - -2. Download the deploy.cab file. For more information, see [Windows XP Service Pack 3 Deployment Tools](https://go.microsoft.com/fwlink/?LinkId=195928) From the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=195928). - -3. From the deploy.cab file, copy or extract the Setupmgr.exe, Sysprep.exe, and Setupcl.exe files to the Sysprep folder. - -4. In the Sysprep folder, run **Setup Manager** (Setupmgr.exe) to create a Sysprep.inf answer file. - - Or, you can create this file manually or use your company’s existing file. For more information, see [How to use the Sysprep tool to automate successful deployment of Windows XP](https://go.microsoft.com/fwlink/?LinkId=195929) (https://go.microsoft.com/fwlink/?LinkId=195929). - -5. Follow the **Setup Manager** wizard. - - **Important** - You must configure the MED-V guest to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host. - - - - **Caution** - When you configure a proxy account for joining virtual machines to the domain, know that it is possible for an end user to obtain the proxy account credentials. Take all the necessary security precautions to minimize risk, such as limiting account user rights. For more information about security concerns when you configure a Windows Virtual PC image for MED-V, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md). - - - - If end users must provide information during the first time setup process based on the parameters specified in the Sysprep.inf file, you must also specify that first time setup is run in **Attended** mode when you are creating your MED-V workspace package. If no information will be required from the end user, you can specify that first time setup is run in **Unattended** mode when you are creating your MED-V workspace package. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - Although you can specify any settings that you prefer, a MED-V best practice is that you create the Sysprep.inf file so that first time setup can be run in **Unattended** mode. This requires that you provide all of the required settings information as you continue through the **Setup Manager** wizard. - - **Caution** - If you have set a local policy or registry entry to include a service level agreement (SLA) in your image (VHD), you must specify that first time setup is run in **Attended** mode or first time setup will fail. Or, a MED-V best practice is to enforce the SLA through Group Policy later so that the SLA is displayed to the end user after first time setup is finished. - - - - **Note** - You can configure the MED-V workspace to set certain Sysprep.inf settings based on the configuration of the host and the identity of the end user. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - - -6. Seal the MED-V image. - - **Important** - We recommend that you make a backup copy of the MED-V image before sealing it. - - - - After you have completed all the steps in the **Setup Manager** wizard, you are ready to run Sysprep to seal the MED-V image. - -**To run Sysprep** - -1. Run the System Preparation Tool (Sysprep.exe) from the *Sysprep* folder that you created when you configured Sysprep in the MED-V virtual machine. - -2. In the warning message box that appears, click **OK**. - -3. In the **Options** dialog box, select the **Don't reset grace period for activation** and **Use Mini-Setup** check boxes. Also, make sure that the **Shutdown mode** box is set to **Shut down**. - -4. Click **Reseal**. This removes identity information and clears event logs to prepare for first time setup. - -5. If you are not satisfied with the information listed in the confirmation message box that appears, click **Cancel** and then change the selections. - -6. Click **OK** to complete the system preparation process. - -After you have run Sysprep on your MED-V image, the virtual machine shuts down and is ready for use in creating a MED-V workspace. -~~~ - -## Example - - -Here is an example of a Sysprep.inf file. - -``` syntax -;SetupMgrTag -[GuiUnattended] - EncryptedAdminPassword=NO - TimeZone=10 - OEMDuplicatorstring="MED_V v2 Host" - AdminPassword="administrator" - AutoLogon=Yes - AutoLogonCount=1 - OEMSkipRegional=1 - OemSkipWelcome=1 - -[UserData] - ProductKey= - FullName="MED-V User" - OrgName="Contoso" - ComputerName=* - -[Identification] - JoinDomain=domain.corp.contoso.com - DomainAdmin=UserName - DomainAdminPassword=Password - -[Networking] - InstallDefaultComponents=Yes - -[Branding] - BrandIEUsingUnattended=Yes - -[Proxy] - Proxy_Enable=0 - Use_Same_Proxy=0 - -[Unattended] - InstallFilesPath=C:\sysprep\i386 - TargetPath=\WINDOWS - UpdateServerProfileDirectory=1 - OemSkipEula=Yes - -[RegionalSettings] - LanguageGroup=1 - Language=00000409 - -[GuiRunOnce] - Command0="wmic /namespace:\\root\default path SystemRestore call Disable %SystemDrive%\" - Command1="c:\Program Files\Microsoft Enterprise Desktop Virtualization\FtsCompletion.exe" - -[sysprepcleanup] -``` - -## Related topics - - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) - -[Prepare a MED-V Image](prepare-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md b/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md deleted file mode 100644 index 83a07e743e..0000000000 --- a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: Configuring Advanced Settings by Using Windows PowerShell -description: Configuring Advanced Settings by Using Windows PowerShell -author: levinec -ms.assetid: 437a31cc-2a11-456f-b448-b0b869fb53f7 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Advanced Settings by Using Windows PowerShell - - -The MED-V workspace package that you create includes a Windows PowerShell script (.ps1) file that you can edit before you test and deploy your MED-V workspace package. This section provides information and guidance to help you manage MED-V configuration settings by using Windows PowerShell before you deploy the MED-V workspaces. - -## Using Windows PowerShell Cmdlets in MED-V - - -The following Windows PowerShell cmdlets are available in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0: - -**New-MedvConfiguration** - -**Export-MedvConfiguration** - -**New-MedvWorkspace** - -**Export-MedvWorkspace** - -To access Windows PowerShell cmdlets for MED-V, open Windows PowerShell and type the following command to import the MED-V modules. - -``` syntax -Import-Module microsoft.medv -``` - -After the modules are imported, you can access inline help for the cmdlets by using the standard Windows PowerShell Help commands, **man** or **get-help**. For example, to access a description of the **New-MedvConfiguration** cmdlet including a complete list of available parameters, type the following command. - -``` syntax -get-help New-MedvConfiguration -``` - -You can also view help for specific parameters. For example, to view help for the parameter VmMemory, type the following: - -``` syntax -get-help New-MedvConfiguration -parameter VmMemory -``` - -To view a list of all MED-V configuration settings and their defaults, type the following command. - -``` syntax -New-MedvConfiguration -ForceDefaults -``` - -To view a list of all MED-V configuration settings and their current values, type the following command. - -``` syntax -gwmi -Class "Setting” -Namespace "root/microsoft/medv” -``` - -## Creating a MED-V Workspace with Custom Settings - - -After you successfully create a MED-V workspace package by using the MED-V Workspace Packager, a Windows PowerShell script is generated in the folder you specified for saving your packager files. The contents of this script show some of the available MED-V configuration settings that you can edit. - -Following these steps, you can customize the script and then run it in Windows PowerShell to create a MED-V workspace with the new settings. - -**Important**   -Run Windows PowerShell with administrative credentials, and ensure that the Windows PowerShell execution policy allows the running of scripts. - -1. Edit the Windows PowerShell script that was generated by the MED-V Workspace Packager, or author a new script with the configuration settings that you want. - -2. Run Windows PowerShell with administrative credentials and at the command prompt, type the following command. - - ``` syntax - & “.\.ps1” - ``` - - This command runs the Windows PowerShell script and runs the **New-MedvWorkspace** cmdlet to generate a new MED-V workspace package. The new packager files are saved in the folder that you originally specified for storing your MED-V Workspace Packager files. For additional help about this cmdlet, see the Windows PowerShell Help. - - - -## Exporting a MED-V Configuration to a Registry File - - -You can update MED-V configuration settings after the MED-V workspace is installed. Use the **New-MedvConfiguration** cmdlet to specify the parameters that you want to change. For example, to create a registry file that changes the virtual machine memory setting, type the following commands. - -``` syntax -New-MedvConfiguration -VmMemory 1024 | Export-MedvConfiguration -Path c:\medvConfiguration\myConfig.reg -``` - -You can import the resultant registry file from the host computer to a MED-V workspace to apply the new configuration settings. - -## Related topics - - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) - -[Test And Deploy the MED-V Workspace Package](test-and-deploy-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/create-a-med-v-workspace-package.md b/mdop/medv-v2/create-a-med-v-workspace-package.md deleted file mode 100644 index 0409a20532..0000000000 --- a/mdop/medv-v2/create-a-med-v-workspace-package.md +++ /dev/null @@ -1,460 +0,0 @@ ---- -title: Create a MED-V Workspace Package -description: Create a MED-V Workspace Package -author: levinec -ms.assetid: 3f75fe73-41ac-4389-ae21-5efb2d437f4d -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a MED-V Workspace Package - - -A MED-V workspace is the Windows XP desktop environment where end users interact with the virtual machine provided by MED-V. The administrator creates and customizes the MED-V workspace. The workspace consists of an image and the Group Policy that defines the rules and functionality of the MED-V workspace. - -You can create multiple MED-V workspaces, each customized with its own configuration, settings, and rules. A user, group, or multiple users or groups can be associated with each MED-V workspace. The customization makes that MED-V workspace available only for that user or group. - -Use the **MED-V Workspace Packager** to create MED-V workspaces. The **MED-V Workspace Packager** is divided into two main sections: - -- A main panel that includes three buttons that you use to create and manage MED-V workspaces. The **Create a MED-V Workspace Package** button opens the **Create MED-V Workspace Package Wizard** that you use to create your MED-V workspaces. - -- A **Help Center** on the right-hand side of the window that provides information and guidance to help you create, test, and manage your MED-V workspaces. - -**Important** -Before you can use the **MED-V Workspace Packager**, you must first make sure that the Windows PowerShell execution policy is set to Unrestricted. - -`Set-ExecutionPolicy Unrestricted` - -In addition, the SAN policy for the computer on which the **MED-V Workspace Packager** is run must be set to “Online All”. To check the setting of the SAN policy, run the following commands at a command prompt with administrative credentials: - -`diskpart.exe` - -`DISKPART> san` - -`DISKPART> exit` - -If it is necessary, change the SAN policy to "Online All" by typing the following commands at the command prompt with administrative credentials: - -`diskpart.exe` - -`DISKPART> san policy=onlineall` - -`DISKPART> exit` - - - -**Important** -If automatic disk encryption software is installed on the computer that you use to mount the virtual hard disk and build the MED-V workspace package, you must disable the software before you start. Otherwise, you cannot use the MED-V workspace on any other computer. - - - -The information we provide here can help you create your MED-V workspace deployment package. - -## Prerequisites - - -Before you start to build your MED-V workspace deployment package, verify that you have access to the following items: - -- **A prepared Windows XP image** - - For more information about how to create a Windows XP image for use with MED-V, see [Prepare a MED-V Image](prepare-a-med-v-image.md). - -- **A text file or list that contains URL redirection information** - - Your URL redirection text file or list contains those URLs that you want redirected from the host computer to Internet Explorer in the MED-V workspace. When you are using the packaging wizard to create your MED-V workspace, you import, type, or copy and paste this redirection information as one of the steps in the package creation process. - - **Note** - URL redirection in MED-V only supports the protocols HTTP and HTTPS. MED-V does not provide support for FTP or any other protocols. - - - -~~~ -Enter each web address on a single line, for example: - -http://www.contoso.com/webapps/webapp1 - -http://www.contoso.com/webapps/webapp2 - -http://\*.contoso.com - -http://www.contoso.com/webapps/\* - -**Important** -If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding. -~~~ - - - -## Packaging a MED-V Workspace for a Language Other than the Language of the MED-V Workspace Packager Computer - - -By default, the MED-V workspace supports characters in both the language of the computer and in English. To create a MED-V workspace for a language other than the one installed on the computer, specify **-loc \[locale\]** in the PowerShell script (.ps1) after the MED-V workspace name. - -To create a MED-V workspace package in a language other than the default language of the MED-V Workspace Packager computer, generate a script in the default language by running the MED-V Workspace Packager and then modifying the output script as required for your locale. The script is located in the MED-V workspace output directory that was specified during packaging. The names of the locale settings are on the .WXL files in the following directory: - -C:\\Program Files\\Microsoft Enterprise Desktop Virtualization\\WindowsPowerShell\\Modules\\Microsoft.Medv.Administration.Commands.WorkspacePackager\\locale - -## Creating a MED-V Workspace Package - - -To create a MED-V workspace package, follow these steps: - -**** - -1. To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**. - -2. On the **MED-V Workspace Packager** main panel, click **Create a MED-V Workspace Package**. - - The MED-V **Create MED-V Workspace Package Wizard** appears. The wizard consists of the following pages: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Package Information

          Specify a name for the MED-V workspace and select a folder where the MED-V workspace package files are saved.

          Select Windows XP Image

          Specify your prepared Windows XP Virtual PC image.

          First Time Setup

          Specify the setup process that MED-V follows during first time setup.

          MED-V Messages

          Specify the messages and optional URL for Help information that the end user sees during first time setup.

          Naming Computers

          Specify how the MED-V virtual machine is named.

          Copy Settings from Host

          Specify how the settings for the MED-V workspace are defined.

          Startup and Networking

          Specify the settings for starting the MED-V workspace, networking, and user credentials.

          Web Redirection

          Specify a text file or a list of the URLs you want redirected to Internet Explorer in the MED-V workspace.

          Summary

          Verify your MED-V workspace settings and start to build your MED-V workspace deployment package.

          - - - -3. On the **Package Information** page, enter a name for the MED-V workspace and select a folder where the MED-V workspace package files are saved. - - **Warning** - You must name the MED-V workspace and specify a folder to continue. - - - -~~~ -After you have finished, click **Next**. -~~~ - -4. On the **Select Windows XP Image** page, specify the location of your prepared MED-V Windows XP Virtual PC image (.vhd file). - - **Warning** - You must specify a Windows XP VHD image to continue. - - - -~~~ -After you have finished, click **Next**. -~~~ - -5. On the **First Time Setup** page, select whether you want first time setup to run while attended or unattended and whether you want the MED-V workspace used separately or used by all end users on a shared computer. - - If you select **Unattended setup, without any notification**, the end user is not informed before first time setup is run and the virtual machine is not shown to the end user during first time setup. In addition, the **MED-V Messages** page of the wizard is hidden because no messages are required if first time setup runs in a completely unattended mode. - - If you select **Unattended setup, but notify end users before first time setup begins**, the end user is informed before first time setup is run. However, the virtual machine is not shown to the end user during first time setup. - - Select **Attended setup** if the end user must enter information during first time setup. - - The default behavior is **Unattended setup, but notify end users before first time setup begins**. - - **Caution** - If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, you must select **Attended setup** or problems might occur during first time setup. - - - -~~~ -You can also specify how a MED-V workspace is used on computers that are shared by multiple end users. You can decide that you want to create a unique MED-V workspace for each end user or that you want the MED-V workspace made available to all end users who share the computer. The default is that the MED-V workspace is unique for each end user. - -**Important** -We recommend that you disable the fast user switching feature in Windows if you configure the MED-V workspace to be accessed by all users on a shared computer. Problems can occur if an end user logs on by using the fast user switching feature in Windows when another user is still logged on. - - - -**Tip** -When you create a name mask for the MED-V workspace on the **Naming Computers** page, make sure that each virtual machine on a shared computer has a unique computer name. - - - -You can also specify whether the MED-V workspace is added to the Administrators group or administrator credentials are managed outside MED-V. By default, the MED-V workspace is not automatically added to the Administrators group. - -After you have finished, click **Next**. -~~~ - -6. On the **MED-V Messages** page, specify the following messages that the end user sees during first time setup: - - - The message that the end user sees when first time setup starts. - - - The message that the end user sees if first time setup fails or an error occurs. - - **Note** - The **MED-V Messages** page of the wizard is hidden if you selected **Unattended setup, without any notification** on the **First Time Setup** page. - - - -~~~ -You can also specify an optional URL location for help information that is provided to the end user when first time setup is running. - -For example, the URL can point to an internal IT webpage with answers to questions such as "How long will this take and how will I know when it has completed?" or "What do you do if you get an error message?" - -**Note** -If you specify a URL, a link is shown during first time setup that points the end user to this help information. If you do not specify a URL, no link is provided. - - - -After you have finished, click **Next**. -~~~ - -7. On the **Naming Computers** page, you can specify whether computer naming is managed by MED-V or by a system management tool, such as Sysprep. The default is that computer naming is managed by a system management tool. - - If you specify that computer naming is managed by MED-V, select a predefined computer naming convention (mask) from the drop-down list. A preview of a sample computer name appears that is based on the computer that you are using to build the MED-V workspace package. - - If you select one of the custom naming conventions, the fields you can specify are limited to the following characters: - - - The prefix and suffix fields are limited to the characters A-Z, a-z, 0-9, and the special characters ! @ \# $ % ^ & ( ) - \_ ' { } . and ~. - - - The hostname and username fields are limited to the digits 0 through 9. - - **Important** - Computer names must be unique and are limited to a maximum of 15 characters. When you decide on your computer naming method, consider end users who have multiple computers or that share a computer, and avoid using computer name masks that could cause a collision on the network. - - - -~~~ -**Caution** -The computer name settings that you specify on this page override those specified in the Sysprep.inf answer file. - - - -After you have finished, click **Next**. -~~~ - -8. On the **Copy Settings from Host** page, you can select the following settings to specify how the MED-V workspace is configured: - - **Caution** - The settings that you specify on this page that are copied from the host computer to the MED-V workspace override those specified in the Sysprep.inf answer file. - - - -~~~ - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Copy regional settings

          Select this check box to copy the regional settings from the host computer to the MED-V workspace.

          If you select this check box, the following settings are set in the Sysprep.inf file:

          -
          [RegionalSettings]
          -Language
          -SystemLocale
          -UserLocale
          -UserLocale_DefaultUser
          -InputLocale
          -InputLocale_DefaultUser
          -

          Copy user settings

          Select this check box to copy certain user settings, such as user name and company name, from the host to the MED-V workspace.

          If you select this check box, the following settings are set in the Sysprep.inf file:

          -
          [UserData]
          -OrgName
          -FullName
          -
          -Note -

          Personal settings, such as Internet browsing history, are not copied over to the MED-V workspace.

          -
          -
          - -

          Copy domain name

          Select this check box to let the guest join the same domain as the host.

          -Important -

          The MED-V guest must be configured to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host.

          -
          -
          - -

          Copy domain organizational unit

          Select this check box to copy the domain organizational unit from the host computer to the MED-V workspace. This check box is only enabled if you select to copy the domain name from the host computer.

          - - - -After you have finished, click **Next**. -~~~ - -9. On the **Startup and Networking** page, you can change the default behavior for the following settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Start MED-V workspace

          Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.

          The MED-V workspace starts in one of two ways: either when the end user logs on or when they first start an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.

          -

          You can either define this setting for the end user or let the end user control how MED-V starts.

          -
          - Note

          If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change how MED-V starts.

          -
          -
          - -

          Networking

          Select Shared or Bridged for your networking setting. The default is Shared.

          Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.

          -

          Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.

          Store credentials

          Choose whether you want to store the end user credentials.

          The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.

          -
          - Important

          Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.

          -

          The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. As a result, an attacker could write a program that retrieves the password and could gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end-user credentials.

          -
          -
          - -
          - - - -~~~ -After you have finished, click **Next**. -~~~ - -10. On the **Web Redirection** page, you can enter, paste, or import a list of the URLs that are redirected to Internet Explorer in the MED-V workspace. For more information about how to configure your URL redirection information, see [Prerequisites](#bkmk-prereq). - - You can also specify how Internet Explorer in the MED-V workspace is configured for end users. By default, the Internet zone security level is set to High. Also, certain default browsing capabilities, such as the address bar, are removed. This default configuration of Internet Explorer in the MED-V workspace provides a more secure browsing environment for end users. - - **Caution** - By changing the default settings, you can customize Internet Explorer in the MED-V workspace. However, realize that if you change the default settings so as to make them less secure, you can expose your organization to those security risks that are present in older versions of Internet Explorer. For more information, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md). - - - -~~~ -After you have finished, click **Next**. -~~~ - -11. On the **Summary** page, you can review the packaging settings for this MED-V workspace. If you want to change any settings, click the **Previous** button to return to the relevant page. After you have finished reviewing the settings, click **Create**. - - The **Completion** page of the **Create MED-V Workspace Package Wizard** opens to show the progress of the package creation. - - **Note** - The MED-V workspace package creation process might take several minutes to complete, depending on the size of the VHD specified. - - - -~~~ -If the MED-V workspace package is created successfully, the **Completion** page displays a list of the files that you created and their respective locations. The following is a list of the files that are created and their descriptions: - -- **setup.exe**—an installation program that you deploy and run on end-user computers to install the MED-V workspaces. - -- **<*workspace\_name*>.msi**—an installer file that you deploy to the end-user computers. The setup.exe file will run this file to install the MED-V workspaces. - -- **<*vhd\_name*>.medv**—a compressed VHD file that you deploy to the end-user computers. The setup.exe file uses it when it installs the MED-V workspaces. - -- **<*workspace\_name*>.reg**—the configuration settings that are installed when the setup.exe, <*workspace\_name*>.msi, and <*vhd\_name*>.medv files are deployed and setup.exe is run. - -- **<*workspace\_name*>.ps1**—a Windows PowerShell script that you can use to rebuild the registry file and re-build the MED-V workspace package. - - **Important** - Before deployment, you can edit configuration settings by updating the .ps1 file that has your preferred method of script editing, such as Windows PowerShell. After you change the .ps1 file, use that file to rebuild the MED-V workspace package that you deploy to your enterprise. For more information, see [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md). - - However, after the MED-V workspace is deployed, you must edit configuration settings through the registry. For a list and description of the configuration settings, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md). -~~~ - - - -12. Click **Close** to close the packaging wizard and return to the **MED-V Workspace Packager**. - -Your MED-V workspace package is now ready for testing before deployment. - -## Related topics - - -[Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md) - -[Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) - -[Prepare a MED-V Image](prepare-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md deleted file mode 100644 index a4506e27a5..0000000000 --- a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Creating a Windows Virtual PC Image for MED-V -description: Creating a Windows Virtual PC Image for MED-V -author: levinec -ms.assetid: fd7c0b1a-0769-4e7b-ad1a-dad19cca081f -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Creating a Windows Virtual PC Image for MED-V - - -Before you can deliver a MED-V workspace to users, you have to first prepare a virtual hard disk that you use to build the MED-V workspace installer package for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. To prepare the necessary virtual hard disk, you must create a Windows Virtual PC image that contains the required operating system, updates, and software to let you later deploy applications and URL redirection information to users. This section provides guidance about how to create the virtual hard disk. - -To create a virtual image for MED-V, you must follow these steps. - -1. [Create a Windows Virtual PC image](#bkmk-creatingavirtualmachinebyusingmicrosoftvirtualpc) - -2. [Install Windows XP on the image](#bkmk-installingwindowsxpontovpc) - -3. [Install the .NET Framework on the image](#bkmk-installingnet) - -4. [Apply updates to the image](#bkmk-applypatchestovpc) - -5. [Install Integration Components](#bkmk-installintegration) - -## Creating a Windows Virtual PC Image - - -To create a Windows Virtual PC image, see the Windows Virtual PC documentation: - -- [Windows Virtual PC Home Page](https://go.microsoft.com/fwlink/?LinkId=148103) (https://go.microsoft.com/fwlink/?LinkId=148103). - -- [Windows Virtual PC Help](https://go.microsoft.com/fwlink/?LinkId=182378) (https://go.microsoft.com/fwlink/?LinkId=182378). - -Alternately, if you already have a Windows Imaging (WIM) file that you want to use as the basis for your virtual image, you can convert it to a VHD that you use to build the MED-V workspace. For more information about how to convert a WIM to a virtual hard disk, see [Native VHD Support in Windows 7](https://go.microsoft.com/fwlink/?LinkId=195922) (https://go.microsoft.com/fwlink/?LinkId=195922). - -**Important**   -MED-V only supports one virtual hard disk per virtual machine and only one partition on each virtual disk. - - - -After you have created your virtual hard disk, install Windows XP on the image. - -## Installing Windows XP on a Windows Virtual PC Image - - -MED-V requires that Windows XP SP3 is installed on the Windows Virtual PC image before you build the MED-V workspace. - -For more information about how to install Windows XP, see [Create a virtual machine and install a guest operating system](https://go.microsoft.com/fwlink/?LinkId=182379) (https://go.microsoft.com/fwlink/?LinkId=182379). - -## Installing the .NET Framework 3.5 SP1 on a Windows Virtual PC Image - - -You must manually install the .NET Framework 3.5 SP1 and the update KB959209 into the Windows Virtual PC image that you prepare for use with MED-V. The update [KB959209](https://go.microsoft.com/fwlink/?LinkId=204950) (https://go.microsoft.com/fwlink/?LinkId=204950) addresses several known application compatibility issues. - -## Applying Updates to the Windows Virtual PC Image - - -After you have installed Windows XP on your virtual machine, install any required Windows XP updates on the image, such as SP3. You can also install certain optional updates for better performance. - -**Important**   -MED-V requires that Windows XP SP3 be running on the guest operating system. - - - -**Warning**   -When you install updates to Windows XP, make sure that you remain on the version of Internet Explorer in the guest that you intend to use in the MED-V workspace. For example, if you intend to run Internet Explorer 6 in the MED-V workspace, make sure that any updates that you install now do not include Internet Explorer 7 or Internet Explorer 8. In addition, we recommend that you configure the registry to prevent automatic updates from upgrading Internet Explorer. - - - -### Installing an Optional Performance Update - -Although it is optional, we recommend that you install the following update for [hotfix KB972435](https://go.microsoft.com/fwlink/?LinkId=201077) (https://go.microsoft.com/fwlink/?LinkId=201077). This update increases the performance of shared folders in a Terminal Services session: - -**Note**   -The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. - - - -### Configuring a Group Policy Performance Update - -By default, Group Policy is downloaded to a computer one byte at a time. This causes delays while MED-V is being joined to the domain. To increase the performance of Group Policy, set the following registry key value to the registry: - -Registry subkey: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon - -Entry: BufferPolicyReads - -Type: DWORD - -Value: 1 - -## Installing Integration Components - - -Windows Virtual PC includes the Integration Components package. This provides features that improve the interaction between the virtual environment and the physical computer. For example, the Integration Components package lets your mouse move between the host and the guest computers. - -**Important**   -MED-V requires the installation of the Integration Components package. - - - -When you configure the virtual image to work with MED-V, you must manually install the Integration Components package on the guest operating system to make the integration features that are available. - -For more information about how to install and use the Integration Components package, see the following: - -- [Install or Upgrade the Integration Components Package](https://go.microsoft.com/fwlink/?LinkId=195923) (https://go.microsoft.com/fwlink/?LinkId=195923). - -- [About Integration Features](https://go.microsoft.com/fwlink/?LinkId=195924) (https://go.microsoft.com/fwlink/?LinkId=195924). - -### Installing RemoteApp Update - -After you install the Integration Components package, you are prompted to install the following update: "Update for Windows XP SP3 to enable RemoteApp." This is a required component for MED-V. - -**Important**   -If you are not prompted to install the RemoteApp update, you must download and install it manually. For more information and instructions about how to download this update, see [Update for Windows XP SP3 to enable RemoteApp](https://go.microsoft.com/fwlink/?LinkId=195925) (https://go.microsoft.com/fwlink/?LinkId=195925). - - - -### Enabling Remote Desktop - -By default, Remote Desktop is enabled after you install the Integration Components package. For MED-V to be operational, ensure that Remote Desktop is enabled, and do not distribute any Group Policy that disables it. - -For information about how to enable Remote Desktop, see [Enable or disable Remote Desktop](https://go.microsoft.com/fwlink/?LinkId=201162) (https://go.microsoft.com/fwlink/?LinkId=201162). - -## Customizing Internet Explorer by Using the Internet Explorer Administration Kit - - -If you want, you can use the Internet Explorer Administration Kit to customize Internet Explorer on the guest operating system. For more information, see the [Internet Explorer 6 Administration Kit and Deployment Guide](https://go.microsoft.com/fwlink/?LinkId=200007) (http:// go.microsoft.com/fwlink/?LinkId=200007). - -**Warning**   -You should consider security concerns associated with customizing Internet Explorer in the MED-V workspace. For more information, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md). - - - -After your virtual hard disk is installed with an up-to-date guest operating system, you can install applications on the image. - -## Related topics - - -[Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md b/mdop/medv-v2/define-and-plan-your-med-v-deployment.md deleted file mode 100644 index ae00fa5f9f..0000000000 --- a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Define and Plan your MED-V Deployment -description: Define and Plan your MED-V Deployment -author: levinec -ms.assetid: a90945cc-dc37-4548-963d-e0c6f8ba0467 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Define and Plan your MED-V Deployment - - -Use the information in this section when you plan your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 project. - -## In This Section - - -[Determining How MED-V Will Be Deployed](determining-how-med-v-will-be-deployed.md) -Provides information to help you determine how to deploy MED-V throughout your enterprise. - -[Identifying the Number and Types of MED-V Workspaces](identifying-the-number-and-types-of-med-v-workspaces.md) -Provides information to help you identify the computers in your enterprise that require MED-V and to calculate the disk space necessary for a MED-V deployment. - -## Related topics - - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) - -[Planning for MED-V](planning-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/deploy-the-med-v-components.md b/mdop/medv-v2/deploy-the-med-v-components.md deleted file mode 100644 index 13bcf6dbf1..0000000000 --- a/mdop/medv-v2/deploy-the-med-v-components.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Deploy the MED-V Components -description: Deploy the MED-V Components -author: levinec -ms.assetid: fc2c5ef2-9c71-412a-8f6c-93df248f77d6 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy the MED-V Components - - -This section provides information about how to deploy the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 components and how to uninstall the components. - -## In This Section - - -[How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md) -Describes how to install the MED-V Workspace Packager, which you use to create MED-V workspaces. - -[How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md) -Describes how to manually install the MED-V components by using an electronic software distribution (ESD) system. - -[How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md) -Describes how to install the MED-V Host Agent. - -[How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) -Describes how to uninstall the MED-V components. - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/deploying-the-med-v-workspace-package.md b/mdop/medv-v2/deploying-the-med-v-workspace-package.md deleted file mode 100644 index d7c6ce9753..0000000000 --- a/mdop/medv-v2/deploying-the-med-v-workspace-package.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Deploying the MED-V Workspace Package -description: Deploying the MED-V Workspace Package -author: levinec -ms.assetid: f314425a-d60f-4b8d-b71f-d13d1da9297f -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MED-V Workspace Package - - -After you have tested your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 installer package, you can deploy it throughout your enterprise by using your company’s preferred method of provisioning software and other applications. - -**Note**   -When you are ready to deploy, we recommend that you install the MED-V workspace by running the setup.exe executable program that is included in your MED-V workspace installer package. - - - -**Warning**   -Before you can install the MED-V workspace, you must first install the MED-V Host Agent. - - - -## In This Section - - -[How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) -Provides information about how to deploy MED-V workspaces by using an ESD system. - -[How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) -Provides information about how to deploy a MED-V workspace in a Windows 7 image. - -[How to Deploy a MED-V Workspace Manually](how-to-deploy-a-med-v-workspace-manually.md) -Provides information about how to manually deploy a MED-V workspace. - - - - - - - - - diff --git a/mdop/medv-v2/deployment-of-med-v.md b/mdop/medv-v2/deployment-of-med-v.md deleted file mode 100644 index 9681fb0717..0000000000 --- a/mdop/medv-v2/deployment-of-med-v.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Deployment of MED-V -description: Deployment of MED-V -author: levinec -ms.assetid: 52ea8ae4-ec2e-4cb8-ab38-e6400f47d3ba -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deployment of MED-V - - -The topics in this section help you prepare your environment for deploying Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) -Describes an end-to-end deployment scenario for MED-V 2.0. - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -Describes the supported configurations for MED-V 2.0. - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) -Describes the requirements for deploying MED-V 2.0. - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) -Provides procedures for configuring the MED-V 2.0 environment and installation prerequisites. - -[Deploy the MED-V Components](deploy-the-med-v-components.md) -Describes how to install the MED-V Host Agent, the MED-V Workspace Packager, and other components required to run MED-V 2.0. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/deployment-troubleshooting.md b/mdop/medv-v2/deployment-troubleshooting.md deleted file mode 100644 index 551edaa3e3..0000000000 --- a/mdop/medv-v2/deployment-troubleshooting.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Deployment Troubleshooting -description: Deployment Troubleshooting -author: levinec -ms.assetid: 9ee980f2-4e77-4020-9f0e-8c2ffdc390ad -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deployment Troubleshooting - - -This topic includes information to help you troubleshoot deployment issues in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Troubleshooting Issues in MED-V Deployment - - -The following issue might occur when you deploy MED-V. The solution helps troubleshoot this issue. - -**Problems Occur if Installing MED-V for Current User Only.** MED-V only supports the installation of the MED-V Workspace Packager, the MED-V Host Agent, and the MED-V workspace for all users. Installing for the current user only causes failures in the installation of the components and in the setup of the MED-V workspace. - -**Solution** - -Never use the option **ALLUSERS=””** when installing the MED-V components. - -**MED-V Requires Exclusive Use of the Virtualization Stack.** Only one virtualization stack can be run at a time on a computer. Windows Virtual PC must use the virtual stack, and MED-V depends on Windows Virtual PC. Therefore, if you try to deploy or use MED-V when other applications are running that use the virtual stack, MED-V cannot run or be successfully installed. - -**Solution** - -Close any application that is running that uses the virtualization stack before you install or run MED-V. - -**Shortcuts Remain after Uninstall.** By default, when you uninstall MED-V, shortcuts in the end user’s **Start** menu are removed. However, in certain situations, such as for end users who are running roaming profiles, shortcuts to MED-V published applications remain in the end user’s **Start** menu. - -**Solution** - -To manually delete the remaining shortcuts on the **Start** menu, right-click the shortcuts, and then click **Remove**. - -**Disable Logon Message Group Policy Setting in the MED-V Workspace.** If the Windows XP logon message is enabled in the MED-V workspace, the end user must log on every time they want to open a MED-V virtual application. This creates a poor user experience. - -**Solution** - -Disable the following Group Policy settings in the MED-V virtual machine: - -**Interactive logon: Message text for users attempting to log on** - -**Interactive logon: Message title for users attempting to log on** - -## Related topics - - -[Operations Troubleshooting](operations-troubleshooting-medv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md b/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md deleted file mode 100644 index da66303d5f..0000000000 --- a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Detecting Network Changes that Affect MED-V -description: Detecting Network Changes that Affect MED-V -author: levinec -ms.assetid: fd29b95a-cda2-464d-b86d-50b6bd64b4ca -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Detecting Network Changes that Affect MED-V - - -The Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 solution lets you configure your environment to detect certain network changes that might occur after MED-V workspaces are deployed and that can affect MED-V. - -The feature includes a component running in the guest operating system that is notified of network configuration changes on the host computer. It allows a non-Microsoft ESD or other application that is running in the guest to resolve to the same network endpoints that the host ESD or application resolves to. - -**Note**   -This feature is only available if the virtual machine is configured for network address translation (NAT) mode. If the virtual machine is configured for BRIDGED mode, no change indications are generated. - - - -This section provides information and instruction to assist you in monitoring those network changes that can affect MED-V. - -## To detect network changes for MED-V - - -After you have deployed your MED-V workspaces, you can monitor changes to certain network configurations by preforming the following tasks: - -1. Create a Managed Object Format (MOF) file that will look for the network configuration changes that you want to monitor. The following code shows an example of the MOF file that you can create. - - ``` syntax - #pragma namespace ("\\\\.\\root\\ccm\\NetworkConfig") - - class CCM_IPConfig - { - [NotNull: ToInstance ToSubClass] uint32 AddressFamily; // AF_INET, AF_INET6 - [Key, NotNull: ToInstance ToSubClass] string IPAddress; // IPv4 or IPv6 address - [NotNull: ToInstance ToSubClass] string SubnetMask; // IPv4 subnet mask - }; - - class CCM_NetworkAdapter - { - [Key, NotNull: ToInstance ToSubClass] string Name; - [NotNull: ToInstance ToSubClass] uint32 DHCPEnabled = 0; - [NotNull: ToInstance ToSubClass] uint32 Quarantined = 0; // To check if it is quarantined. - CCM_IPConfig IPConfigInfo[]; - }; - - [singleton] - class CCM_NetworkAdapters - { - [NotNull: ToInstance ToSubClass] String ProviderName; // MED-V or other provider - CCM_NetworkAdapter AdaptersInfo[]; - }; - ``` - -2. Compile the MOF file. - -3. Install the MOF file in the guest. - -After you have installed the MOF file, you can create an event subscription that subscribes to Windows Management Instrumentation (WMI) creation, modification, or deletion events for the **CCM\_NetworkAdapters** class. This detects the following changes to the host: - -Are there any configuration changes to the network, such as changes to the IP address or network adapter? - -Is the network available or unavailable? - -Was the network setup changed from BRIDGED mode to NAT mode? - -Was the network setup changed from NAT mode to BRIDGED mode? - -A MED-V component on the host monitors the network for these changes and then signals the guest of the change. A component in the guest creates a WMI instance to monitor the MED-V workspace for these changes. - -The event subscription you created provides notification through the WMI system when one or more of these network changes – creation, modification, or deletion – occurs. - -## Related topics - - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md b/mdop/medv-v2/determining-how-med-v-will-be-deployed.md deleted file mode 100644 index 7750f6a2bb..0000000000 --- a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Determining How MED-V Will Be Deployed -description: Determining How MED-V Will Be Deployed -author: levinec -ms.assetid: addbfef6-799e-4fe7-87d2-7e096a5ef5a5 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Determining How MED-V Will Be Deployed - - -You can determine how you might deploy MED-V throughout your enterprise by evaluating your existing infrastructure, a review of which you can take advantage of for your deployment. - -## Determine How You Will Deploy MED-V - - -Because MED-V is a desktop-based solution, it works with your existing infrastructure. For example, if you currently deploy applications to physical computers by using an electronic software distribution system, you can also use your electronic software distribution system to deploy to MED-V workspaces. - -If you are currently using an electronic software distribution solution, you can use that to distribute MED-V workspaces and their dependent applications. You can also use this solution for distribution of subsequent applications after MED-V is deployed. For more information about deploying MED-V with an ESD, see [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md). - -**Note**   -Whichever electronic software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999). - - - -You might prefer to install MED-V in a Windows 7 image. Then, after you deploy the Windows 7 images throughout your enterprise, MED-V is ready to be installed when an end user needs it. For more information, see [How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md). - -## Related topics - - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) - -[Planning for MED-V](planning-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md deleted file mode 100644 index 3856ccbf80..0000000000 --- a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: End-to-End Deployment Scenario for MED-V 2.0 -description: End-to-End Deployment Scenario for MED-V 2.0 -author: levinec -ms.assetid: 91bb5a9a-5fb1-4743-8494-9d4dee2ec222 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# End-to-End Deployment Scenario for MED-V 2.0 - - -This sample scenario for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 helps you deploy the MED-V components in your enterprise by using multiple scenarios end-to-end. You can think of this sample scenario as a case study that helps put the individual scenarios and procedures in context. - -This section provides basic information and directions for deploying MED-V components as an end-to-end solution in your enterprise. - -## MED-V Deployment Step-by-step Scenario - - -The topics in this step-by-step scenario include the following: - -- [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) discusses the requirements that you must have to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 in your environment. This topic specifies the operating system requirements, configuration requirements, and MED-V workspace requirements. This topic also includes localization information about the languages that MED-V 2.0 supports. - -- [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) discusses general information and instructions to help you install and deploy MED-V throughout your enterprise. The MED-V components are client-based and are delivered and managed by using your existing enterprise infrastructure and processes. This topic provides an overview of the MED-V solution that includes information about the MED-V installation files and the MED-V components that you deploy. This topic also provides a high-level overview of the MED-V installation and deployment process. - -- [Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) discusses how to prepare your environment for a MED-V 2.0 deployment. This section describes the prerequisites that are required for the MED-V environment, such as Microsoft Windows 7 and an Active Directory infrastructure in which you use Group Policy to provide centralized management and configuration of operating systems, applications, and users' settings. This section also describes the prerequisites that you must have for installing and deploying MED-V 2.0 throughout your enterprise, such as Windows Virtual PC and the required Windows Virtual PC update. - -- [Deploy the MED-V Components](deploy-the-med-v-components.md) discusses the different ways you can install all of the necessary installation files and MED-V components throughout your enterprise. To install and deploy MED-V, you typically follow these steps: - - 1. Install the **MED-V Workspace Packager** on the administrator computer that you will use to build the MED-V workspace packages. For more information, see [How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md). - - 2. Create and test your MED-V workspace packages. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) and [Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md). - - 3. Deploy MED-V throughout your enterprise by using your company’s existing method for deploying applications. For more information, see [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md). - -## Related topics - - -[Deployment of MED-V](deployment-of-med-v.md) - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) - -[End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md deleted file mode 100644 index 67d3cefef5..0000000000 --- a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: End-to-End Operations Scenario for MED-V 2.0 -description: End-to-End Operations Scenario for MED-V 2.0 -author: levinec -ms.assetid: 1d87f5f3-9fc5-4731-8bd1-c155714f34ee -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# End-to-End Operations Scenario for MED-V 2.0 - - -This sample scenario for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 helps you deploy and manage MED-V by using multiple scenarios end-to-end. You can think of this sample scenario as a case study that helps put the individual scenarios and procedures in context. - -This section provides basic information and directions for creating, deploying, and managing MED-V workspaces as an end-to-end solution in your enterprise. - -## MED-V Operations Step-by-step Scenario - - -The step-by-step procedures that you follow in a MED-V operations scenario include the following: - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-creatingavirtualmachinebyusingmicrosoftvirtualpc) reviews how to create and configure a Windows Virtual PC image for MED-V. Before you can deliver a MED-V workspace to users, you must first prepare a virtual hard disk (VHD) that you use to build the MED-V workspace installer package for MED-V. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-installingwindowsxpontovpc) reviews how to install the Windows XP SP3 operating system on your Windows Virtual PC image. MED-V requires that Windows XP SP3 is installed on the Windows Virtual PC image before you build the MED-V workspace. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-installingnet) reviews how to manually install the .NET Framework 3.5 SP1 and the update KB959209 into the Windows Virtual PC image that you prepare for use with MED-V. MED-V requires the .NET Framework 3.5 SP1, and the update [KB959209](https://go.microsoft.com/fwlink/?LinkId=204950) (https://go.microsoft.com/fwlink/?LinkId=204950) addresses several known application compatibility issues. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-applypatchestovpc) reviews how to update your Windows XP image with the latest software updates and other hotfixes necessary or important for running MED-V. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-installintegration) reviews how to install the integration components package in your Windows XP image. These provide features that improve the interaction between the virtual environment and the physical computer. - -- [Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) reviews how you can install certain kinds of software on your Windows XP image that are helpful when you are running MED-V, such as an electronic software distribution system and antivirus software. - -- [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) discusses how to configure the image by using Sysprep to make sure that it is ready for use with MED-V. The prepared MED-V image is then used to create your MED-V workspace package. - -- [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) reviews how to build the MED-V workspace package that you deploy throughout your enterprise. You deploy the MED-V workspace package to install the MED-V workspace on end-user computers. A MED-V workspace is the Windows XP desktop environment from which end users interact with the virtual machine provided by MED-V. - -- [Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) discusses how to create a test environment in which you can test the functionality of the MED-V workspace package, such as first time setup settings and application publishing. After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy it throughout your enterprise. - -- [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) discusses how to deploy the MED-V workspace either by using an electronic software distribution system or in a Windows 7 image. Or if you prefer, this section also shows you how you can deploy the MED-V workspace manually. - -- [Monitor MED-V Workspaces](monitor-med-v-workspaces.md) reviews how to monitor the deployment of MED-V workspaces to determine whether first time setup completed successfully. Monitoring the success of first time setup is important because MED-V is not in a usable state until first time setup has completed successfully. This section also shows you can set up your environment to detect those network changes that can affect MED-V. - -- [Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) reviews how to install and remove or publish and unpublish applications on a deployed MED-V workspace. This section also shows how to manually update software in a MED-V workspace and how to manage automatic updates. The MED-V workspace is a virtual machine that contains a separate operating system whose automatic software update process must be managed exactly like the physical computers in your enterprise. - -- [Manage MED-V URL Redirection](manage-med-v-url-redirection.md) reviews how to add and remove web address redirection settings on the deployed MED-V workspace. You can add or remove URL redirection information through the registry or by rebuilding the MED-V workspace. You can also use the wizard on the MED-V Workspace Packager to manage web address redirection. - -- [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) reviews how to view and edit MED-V configuration settings by using the MED-V Workspace Packager. This section lists all the configurable MED-V registry keys and includes the type, default, and description of each. This section also includes information about how to manage printers in MED-V workspaces. In MED-V 2.0, printer redirection gives users a consistent printing experience between the MED-V virtual machine and the host computer. - -## Related topics - - -[Operations for MED-V](operations-for-med-v.md) - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) - -[End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md deleted file mode 100644 index 679b4bb74d..0000000000 --- a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: End-to-End Planning Scenario for MED-V 2.0 -description: End-to-End Planning Scenario for MED-V 2.0 -author: levinec -ms.assetid: e7833883-be93-4b42-9fa3-5c4d9a919058 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# End-to-End Planning Scenario for MED-V 2.0 - - -This sample scenario for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 helps you achieve your goal of planning your MED-V deployment by using multiple scenarios end-to-end. You can think of this sample scenario as a case study that helps put the individual scenarios and procedures in context. - -This section provides basic information and directions for planning you MED-V deployment as an end-to-end solution in your enterprise. - -## MED-V Planning Step-by-Step Scenario - - -The topics in this step-by-step scenario include the following: - -- [High-Level Architecture](high-level-architecturemedv2.md) discusses the high-level system architecture and component design of MED-V 2.0. MED-V enhances Windows Virtual PC to run two operating systems on one device, adding virtual image delivery, Group Policy-based provisioning, and centralized management. By using MED-V, you can easily configure, deploy, and manage corporate Windows Virtual PC images on any Windows-based desktop running Windows 7 Professional, Enterprise, or Windows 7 Ultimate. - -- [Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) discusses the considerations for planning your MED-V 2.0 deployment. This topic provides direction about identifying the systems in your enterprise that receive MED-V and calculating disk space requirements. This topic also helps evaluate your existing infrastructure and determines how it can be used for MED-V deployment. - -- [MED-V 2.0 Best Practices](med-v-20-best-practices.md) discusses the recommended best practices for planning, installing, deploying, and managing MED-V 2.0 in your environment. These best practices include recommendations that produce faster run times, better operability during first time setup, increased performance, and better virtual machine management. - -## Related topics - - -[Planning for MED-V](planning-for-med-v.md) - -[End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) - -[End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/example-med-v-checklists.md b/mdop/medv-v2/example-med-v-checklists.md deleted file mode 100644 index 8779d34476..0000000000 --- a/mdop/medv-v2/example-med-v-checklists.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Example MED-V Checklists -description: Example MED-V Checklists -author: levinec -ms.assetid: cf9c33e8-1b7a-4306-92f6-edbb70ab23b5 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Checklists - - -This section provides example checklists that you can reference when you plan your MED-V project, prepare your environment, and deploy the MED-V components and MED-V workspaces throughout your enterprise. - -## In this Section - - -[Example MED-V Environment Planning Checklist](example-med-v-environment-planning-checklist.md) -Describes the tasks to be completed when planning your MED-V environment. - -[Example MED-V Project Planning Checklist](example-med-v-project-planning-checklist.md) -Describes the tasks to be completed when planning your MED-V project. - -[Example MED-V System Installation Checklist](example-med-v-system-installation-checklist.md) -Provides a list of all the steps required for installing MED-V 2.0. - -[Example MED-V Image Preparation Checklist](example-med-v-image-preparation-checklist.md) -Describes the tasks to be completed when you prepare your MED-V image for deployment. - -[Example MED-V Workspace Deployment Checklist](example-med-v-workspace-deployment-checklist.md) -Describes the tasks to be completed when you deploy your MED-V workspace. - -## Related topics - - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/example-med-v-environment-planning-checklist.md b/mdop/medv-v2/example-med-v-environment-planning-checklist.md deleted file mode 100644 index 5901becc57..0000000000 --- a/mdop/medv-v2/example-med-v-environment-planning-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V Environment Planning Checklist -description: Example MED-V Environment Planning Checklist -author: levinec -ms.assetid: 877d1660-abef-4e81-ab3a-a8a3ec181d26 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Environment Planning Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps that you should take when planning your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 environment. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Review the components of a MED-V deployment.

          High-Level Architecture

          Ensure that your computing environment meets the supported configurations required for installing MED-V 2.0.

          MED-V 2.0 Supported Configurations

          Determine how you want to design your MED-V deployment.

          Define and Plan your MED-V Deployment

          Review the list of best practices for ensuring that your MED-V deployment environment is more secure.

          Security and Protection for MED-V

          - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-image-preparation-checklist.md b/mdop/medv-v2/example-med-v-image-preparation-checklist.md deleted file mode 100644 index 99b5c5de4c..0000000000 --- a/mdop/medv-v2/example-med-v-image-preparation-checklist.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Example MED-V Image Preparation Checklist -description: Example MED-V Image Preparation Checklist -author: levinec -ms.assetid: d69f252f-624b-439e-814b-b68cdaf7d582 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Image Preparation Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps to take when you prepare your MED-V image for deployment. - - ---- - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Create a virtual machine that is running Windows XP SP3 with updates and additions.

          Creating a Windows Virtual PC Image for MED-V

          Install any predeployment software that you want on the MED-V image.

          Installing Applications on a Windows Virtual PC Image

          Package the MED-V image by using Sysprep.

          Configuring a Windows Virtual PC Image for MED-V

          - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-project-planning-checklist.md b/mdop/medv-v2/example-med-v-project-planning-checklist.md deleted file mode 100644 index 20208fccd3..0000000000 --- a/mdop/medv-v2/example-med-v-project-planning-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V Project Planning Checklist -description: Example MED-V Project Planning Checklist -author: levinec -ms.assetid: 2b599bcb-1808-43ba-a689-1642bda24511 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Project Planning Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps that you can take when planning your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 project. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Determine how you can use MED-V to help solve your application compatibility issues.

          Planning for Application Operating System Compatibility

          Plan an end-to-end deployment scenario for your organization.

          End-to-End Planning Scenario for MED-V 2.0

          Define the project scope by defining the end users and determining the MED-V images to be managed.

          Define and Plan your MED-V Deployment

          Review the list of best practices for ensuring that your MED-V deployment is more secure.

          Security and Protection for MED-V

          - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-system-installation-checklist.md b/mdop/medv-v2/example-med-v-system-installation-checklist.md deleted file mode 100644 index d61559d1f1..0000000000 --- a/mdop/medv-v2/example-med-v-system-installation-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V System Installation Checklist -description: Example MED-V System Installation Checklist -author: levinec -ms.assetid: 9e5673ba-dee4-4680-9c57-a149beab14d3 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V System Installation Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps to take when you install Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Ensure that your computing environment meets the supported configurations that are required for installing MED-V 2.0.

          MED-V 2.0 Supported Configurations

          Plan and design the MED-V deployment.

          Planning for MED-V

          Verify that the required installation prerequisites are configured.

          Configure Installation Prerequisites

          Install the MED-V Host Agent and MED-V Workspace Packager.

          Deploy the MED-V Components

          - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md b/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md deleted file mode 100644 index 163025ee77..0000000000 --- a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V Workspace Deployment Checklist -description: Example MED-V Workspace Deployment Checklist -author: levinec -ms.assetid: d8857883-9b2d-40ac-9136-59e4e20e02fe -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Workspace Deployment Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps that you should take when you deploy your MED-V workspace. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          StepReference

          Prepare the MED-V image for deployment.

          Prepare a MED-V Image

          Create the MED-V workspace deployment package.

          Create a MED-V Workspace Package

          Test the MED-V workspace installer package.

          Testing the MED-V Workspace Package

          Deploy the MED-V workspace installer package.

          Deploying the MED-V Workspace Package

          - - - - - - - - - - - diff --git a/mdop/medv-v2/getting-started-with-med-vmedv2.md b/mdop/medv-v2/getting-started-with-med-vmedv2.md deleted file mode 100644 index 1515965dfb..0000000000 --- a/mdop/medv-v2/getting-started-with-med-vmedv2.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Getting Started with MED-V -description: Getting Started with MED-V -author: levinec -ms.assetid: 283734d7-231c-45b6-92c9-c95a46ec3628 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Getting Started with MED-V - - -This section provides general information for administrators who are evaluating and using Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[Overview of MED-V](overview-of-med-vmedv2.md) -Provides general information about the MED-V solution to your application compatibility issues. - -[Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) -Provides planning guidance for evaluating MED-V to help solve application operating system compatibility issues. - -[High-Level Architecture](high-level-architecturemedv2.md) -Describes the components of a MED-V deployment. - -[About MED-V 2.0](about-med-v-20.md) -Provides information specifically related to MED-V including what’s new in MED-V 2.0 and MED-V 2.0 supported configurations. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/high-level-architecturemedv2.md b/mdop/medv-v2/high-level-architecturemedv2.md deleted file mode 100644 index 6f60819758..0000000000 --- a/mdop/medv-v2/high-level-architecturemedv2.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: High-Level Architecture -description: High-Level Architecture -author: levinec -ms.assetid: a00edb9f-207b-4f32-9e8f-522ea2739d2f -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture - - -This section describes the high-level system architecture and component design of Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## System Architecture - - -MED-V enhances Windows Virtual PC to run two operating systems on one device, adding virtual image delivery, Group Policy-based provisioning, and centralized management. By using MED-V, you can easily configure, deploy, and manage corporate Windows Virtual PC images on any Windows-based desktop running Windows 7 Professional, Enterprise, or Windows 7 Ultimate. The MED-V solution includes the following components: - - **MED-V Host** -A Windows 7 environment that includes a MED-V Host Agent, an electronic software distribution (ESD) system, a registry management system, and a MED-V guest. The MED-V host interacts with the MED-V guest so that certain setup functions and system information can be processed. - - **MED-V Host Agent** -The MED-V software contained in the MED-V host that provides a channel to communicate with the MED-V guest. It also provides functionality such as first time setup and application publishing. - -**Note**   -After MED-V and its required components are installed MED-V must be configured. The configuration of MED-V is referred to as first time setup. - - - -**ESD System** -Your existing software distribution method that lets you deploy and install the MED-V workspace package files that MED-V creates. - -**Registry Management System** -Your existing method of managing Group Policy settings and preferences. - -**Windows Virtual PC Image** -An administrator-defined virtual machine that contains the following components: - -**Corporate Operating System** -Your standard corporate operating system. - -**Management and Security Tools** -Your standard management and security tools, such as virus protection. - - **MED-V Guest** -A Windows XP SP3 environment, as part of a Windows Virtual PC running on Windows 7 that contains the following components: - - **MED-V Guest Agent** -The MED-V software contained in the MED-V guest that provides a channel to communicate with the MED-V host. It also supports the MED-V Host Agent with functions like performing first time setup. - -**Note**   -The MED-V Guest Agent is installed automatically during first time setup. - - - -**ESD Client** -An optional part of your ESD system that installs software packages and reports status to the ESD system. - -## Related topics - - -[Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md deleted file mode 100644 index 0140b859a5..0000000000 --- a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace -description: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace -author: levinec -ms.assetid: bf55848d-bf77-452e-aaa5-4dd4868ff5bd -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace - - -To edit URL redirection information in a deployed MED-V workspace, we recommend that you update the system registry by using Group Policy. Although we do not recommend it, you can also rebuild and redeploy the MED-V workspace with the updated URL redirection information. - -The registry key is usually located at: - -Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MEDV\\v2\\UserExperience - -The following multi-string value must be present: `RedirectUrls` - -The value data for `RedirectUrls` is a list of all of the URLs that you specified for redirection when you built the MED-V workspace package by using the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -You can add and remove URL redirection information by performing one of the following tasks: - -- [Edit the URL Redirection Registry Key and Deploy Using Group Policy](#bkmk-editreg) - -- [Edit the URL Redirection Text File and Rebuild the MED-V Workspace](#bkmk-edittext) - -**To update URL Redirection information by using Group Policy** - -1. Edit the registry key multi-string value that is named `RedirectUrls`. This value is typically located at: - - Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MEDV\\v2\\UserExperience - - If you are adding URLs to the registry key, enter them one per line, as was required when you built the MED-V workspace package. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -2. Deploy the updated registry key by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - -**Note**   -This method of editing URL redirection information is a MED-V best practice. - - - -**To rebuild the MED-V workspace by using an updated URL text file** - -- Another method of adding and removing URLs from the redirection list is to update the URL redirection text file and then use it to build a new MED-V workspace. You can then redeploy the MED-V workspace as before, by using your standard process of deployment, such as an ESD system. - - **Important**   - We do not recommend this method of editing URL redirection information. In addition, any time that you redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved in the virtual machine is lost. - - - -## Related topics - - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md) - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-create-a-test-environment.md b/mdop/medv-v2/how-to-create-a-test-environment.md deleted file mode 100644 index a7dbfca85a..0000000000 --- a/mdop/medv-v2/how-to-create-a-test-environment.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Create a Test Environment -description: How to Create a Test Environment -author: levinec -ms.assetid: a0db2299-16f3-4516-8769-7d55ca4a1e98 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Test Environment - - -The following are some steps and instructions to help you create a test environment that you can use to test your MED-V workspace package locally before deploying it throughout your enterprise. This section provides guidance about how to create a test environment, either manually or by using an electronic software distribution system. - -**To create a test environment by using an ESD** - -1. Use your company’s method of deploying software throughout the enterprise to deploy the following necessary components to a test computer. Install them in the following order: - - - **Windows Virtual PC** – if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **Windows Virtual PC Additions and Updates**– if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - - **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important**   - The VHD and Setup executable program must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe. - - - -2. After all of the components are installed on the test computer, run the MED-V Host Agent to start first time setup. - - Click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - - **Note**   - If you cannot physically run the MED-V Host Agent on the test computer, first time setup starts automatically the next time that the computer restarts. - - - -First time setup starts and can take ten minutes or more to finish. - -For information about testing your configuration settings when first time setup is running, see [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md). - -**To create a test environment manually** - -1. Install the MED-V Host Agent in a local test environment that includes MED-V prerequisites, such as Windows Virtual PC with additions and updates. For information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - -2. Copy the MED-V workspace files to your test environment. The MED-V workspace files are located in the destination folder that you specified in the **MED-V Workspace Packager**. - - **Important**   - The VHD and Setup executable program must be in the same folder on your test environment as the MED-V workspace installer. - - - -3. Install the MED-V workspace by running setup.exe. - -4. Start first time setup by running the MED-V Host Agent. - - Click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - -First time setup starts and might take several minutes to complete, depending on the size of the VHD specified. - -You are now ready to test the different settings for configuration, application publishing, and URL redirection that you specified for your MED-V workspace. - -**Note**   -By default, MED-V overrides the screen lock policy in the guest. However, this does not pose a security problem because the host computer still honors the screen lock policy. - - - -## Related topics - - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Test URL Redirection](how-to-test-url-redirection.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md deleted file mode 100644 index 9c0bc61d68..0000000000 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Deploy a MED-V Workspace in a Windows 7 Image -description: How to Deploy a MED-V Workspace in a Windows 7 Image -author: levinec -ms.assetid: a83aba4e-8681-4906-9872-f431c0bb15f9 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy a MED-V Workspace in a Windows 7 Image - - -You can install all the MED-V components into a Windows 7 image that you distribute throughout your enterprise just as you would any new installation of Windows 7. The end user then finishes the installation of the MED-V workspace by clicking a **Start** menu shortcut that you configure to start MED-V. First time setup starts and the end user follows the instructions to complete the configuration. - -The following section provides information and instructions to help you deploy the MED-V workspace throughout your enterprise by using a Windows 7 image. - -**To deploy a MED-V workspace in a Windows 7 image** - -1. Create a standard image of Windows 7. For more information, see [Building a Standard Image of Windows 7: Step-by-Step Guide](https://go.microsoft.com/fwlink/?LinkId=204843) (https://go.microsoft.com/fwlink/?LinkId=204843). - -2. In the Windows 7 image, install Windows Virtual PC and the Windows Virtual PC updates. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - -3. Install the MED-V Host Agent by using the MED-V\_HostAgent\_Setup installation file. For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - **Warning**   - Internet Explorer must be closed before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - -4. Copy the MED-V workspace package files to the Windows 7 image. The MED-V workspace package files are the MED-V workspace installer, .medv file, and setup.exe file that you created by using the **MED-V Workspace Packager**. - - **Important**   - The .medv and setup.exe file must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace by running setup.exe. - - - -5. Configure a shortcut on the **Start** menu to open the MED-V workspace package installation. - - Create a **Start** menu shortcut to the setup.exe file that lets the end user start a MED-V installation as required. - -6. By using your company’s standard image deployment process, distribute the Windows 7 image to computers in your enterprise that require MED-V. - -When the end user has to access an application published in the MED-V workspace, they can click the **Start** menu shortcut to install the MED-V workspace. This automatically starts first time setup and completes the configuration of MED-V. After first time setup is complete, the end user can access the MED-V applications on the **Start** menu. - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md deleted file mode 100644 index 6dcc4e29de..0000000000 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Deploy a MED-V Workspace Manually -description: How to Deploy a MED-V Workspace Manually -author: levinec -ms.assetid: 94bfb209-2230-49b6-bb40-9c6ab088dbf4 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy a MED-V Workspace Manually - - -In some instances, you might want to deploy your MED-V workspace manually, for example, if your company does not use an electronic software distribution system to deploy applications. - -This section provides instruction about how to manually deploy a MED-V workspace. - -**To deploy a MED-V workspace manually** - -1. Copy all prerequisite applications and the MED-V workspace package files to a shared drive or to a DVD. The following is a list of the required applications and files. - - - **Windows Virtual PC**. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **Windows Virtual PC Additions and Updates**. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). - - **Warning** - Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - -~~~ -- **MED-V Workspace Installer, VHD, and Setup Executable** – created with the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important** - The compressed VHD file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. -~~~ - - - -2. Install the following in the order listed. The end user can perform this task manually or you can create a script to install the following: - - - Windows Virtual PC and the Windows Virtual PC additions and updates. A computer restart is required. - - - The MED-V Host Agent. - - **Note** - If it is running, Internet Explorer must be restarted before the installation of the MED-V Host Agent can finish. - - - -~~~ -- The MED-V workspace package. - - Install the MED-V workspace by running the setup.exe program that is included in the MED-V workspace package files. -~~~ - -3. Complete first time setup. - - After the MED-V workspace is installed, you have the option of starting MED-V. This starts the MED-V Host Agent. You can either start MED-V at that time, or start the MED-V Host Agent later to complete first time setup. - - To start the MED-V Host Agent, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - -## Related topics - - -[How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) - -[How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md deleted file mode 100644 index ce2798f0eb..0000000000 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,189 +0,0 @@ ---- -title: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System -description: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System -author: levinec -ms.assetid: b5134c35-e1de-470c-93f8-ead6218d9dce -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy a MED-V Workspace Through an Electronic Software Distribution System - - -An electronic software distribution system is designed to efficiently move software to many different computers over slow or fast network connections. The following section provides information and instructions to help you deploy your MED-V workspace throughout your enterprise by using a software distribution system. - -**Note** -Whichever software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999). - - - -**Important** -If you are using System Center Configuration Manager 2007 SP2 and your MED-V workspaces are configured to operate in **NAT** mode, the virtual machines are classified as Internet-based clients and cannot find the closest distribution points from which to download content. - -The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client. - -The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. - - - -You can also deploy the MED-V components together by using a batch file, but this requires a restart after the installation of Windows Virtual PC. To bypass this requirement, you can specify a single restart after all of the components are installed. The single restart also automatically starts MED-V because the MED-V workspace installation places an entry in the RUNKEY. - -**To deploy a MED-V workspace by using a software distribution system** - -1. Define a group of computers and users in the electronic software distribution system as the target set of computers/users. - -2. Create packages for each Microsoft installation file that needs to be distributed. The following are the required files and the order in which they must be installed: - - 1. **Windows Virtual PC** – if not already installed (a computer restart is required). For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 2. **Windows Virtual PC Additions and Updates** – if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 3. **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - **Warning** - Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - - 4. **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important** - The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe. - - - -~~~ - **Tip** - Because problems can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. -~~~ - - - -3. Configure the packages to run in silent mode (no user interaction is required). - - Running in silent mode eliminates the prompt to close Internet Explorer if it is running and the prompt to start the MED-V Host Agent. Both actions are performed when the computer is restarted. - - **Note** - Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md#bkmk-batch). MED-V automatically starts when the computer is restarted. - - - -4. Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic. - - **Important** - Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart. - - - -5. Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space. - -6. Assign the packages to the target set of computers/users. - - As computers are running, the software distribution system client recognizes that new packages are available and begins to install the packages per the definition and requirements. The installations should run sequentially in silent. We recommend that this is performed as a single process that does not require a restart until all the packages are installed. - -7. After the installations are complete, restart the updated computers. - - Depending on the software distribution system, you can schedule a restart of the computer or the end users can restart the computers manually during their regular work. After the computer is restarted, MED-V automatically starts after an end user logs on. When MED-V starts for the first time, it runs first time setup. - -First time setup starts and might take several minutes to finish, depending on the size of the virtual hard disk that you specified and the number of policies applied to the MED-V workspace on startup. The end user can track the progress by watching the MED-V icon in the notification area. For more information about first time setup, see [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md). - -**To install the MED-V workspace by using a batch file** - -1. Run the installation at a command prompt with administrative credentials. - -2. Deploy each component to a single directory. If run from a network share, a longer time is required to decompress the .medv file. - -3. As a best practice, specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This means that Windows Update will not cause any interference with the installation process by requiring a restart. - -4. Restart the computer after the batch file is finished. - -After the restart, the user is prompted to run first time setup and complete the configuration of MED-V. - -The following example, with the specified arguments, shows how to install 64-bit MED-V components in a single process: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ArgumentDescription

          /norestart

          Prevents the installation of Windows Virtual PC and the Windows Virtual PC update from restarting the host computer.

          /quiet

          Installs the MED-V components in quiet mode without user interaction.

          /qn

          Installs the MED-V components without a user interface.

          IGNORE_PREREQUISITES

          Installs without checking for Windows Virtual PC.

          -
          -Note

          Only specify this argument if you are installing Windows Virtual PC as part of this installation.

          -
          -
          - -

          OVERWRITEVHD

          Forces the installation of the MED-V workspace and prevents any prompts that it might generate.

          - - - -## Example - - -``` syntax -:: Install MED-V and the Pre-requisites - -:: Install the MED-V Host Agent: install in quiet mode, ignore that Windows Virtual PC is not installed completely, and log results -start /WAIT .\MED-V_HostAgent_Setup.exe /qn IGNORE_PREREQUISITES=1 /l* %TEMP%\MEDVhost.log - -:: Install the MED-V Workspace: install in quiet mode, Overwrite the VHD if it already exists, and log results -start /WAIT .\setup.exe /qn OVERWRITEVHD=1 /l* %TEMP%\MEDVworkspace.log - -:: Install Windows Virtual PC: install in quiet mode and do not reboot -start /WAIT wusa.exe Windows6.1-KB958559-x64.msu /norestart /quiet - -:: Install Windows Virtual PC patch to support non-HAV: install in quiet mode and do not reboot -wusa.exe Windows6.1-KB977206-x64.msu /norestart /quiet - -:: After successful installation of the above components, a reboot of the host computer is required to complete installation. -``` - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md deleted file mode 100644 index 4daa663cad..0000000000 --- a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,180 +0,0 @@ ---- -title: How to Deploy the MED-V Components Through an Electronic Software Distribution System -description: How to Deploy the MED-V Components Through an Electronic Software Distribution System -author: levinec -ms.assetid: 8a800bdf-6fa4-47b4-b417-df053289d4e8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Deploy the MED-V Components Through an Electronic Software Distribution System - - -An electronic software distribution system can help you efficiently move software to many computers over slow or fast network connections. The following section provides information and instructions to help you deploy the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 components throughout your enterprise by using a software distribution system. - -**Note** -Whichever software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999). - - - -**Important** -If you are using System Center Configuration Manager 2007 SP2 and your MED-V workspaces are configured to operate in **NAT** mode, the virtual machines are classified as Internet-based clients and cannot find the closest distribution points from which to download content. - -The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client. - -The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. - - - -**Note** -You must install the MED-V workspace packager and build your MED-V workspaces before you can deploy the MED-V components through your software distribution system. For more information about how to prepare an image and to build your MED-V workspaces, see [Operations for MED-V](operations-for-med-v.md). - - - -**To deploy the MED-V components by using a software distribution system** - -1. Define a group of computers and users in the electronic software distribution system as the target set of computers/users. - -2. Create packages for each Microsoft installation file that needs to be distributed. The following are the required files and the order in which they must be installed: - - 1. **Windows Virtual PC** – if not already installed (a computer restart is required). For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 2. **Windows Virtual PC Additions and Updates** – if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 3. **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - **Warning** - Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - 4. **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important** - The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe. - - **Tip** - Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. - -3. Configure the packages to run in silent mode (no user interaction is required). - - Running in silent mode eliminates the prompt to close Internet Explorer if it is running and the prompt to start the MED-V Host Agent. Both actions are performed when the computer is restarted. - - **Note** - Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [To install the MED-V components by using a batch file](#bkmk-batch). MED-V automatically starts when the computer is restarted. - -4. Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic. - - **Important** - Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart. - -5. Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space. - -6. Assign the packages to the target set of computers/users. - - As computers are running, the software distribution system client recognizes that new packages are available and begins to install the packages per the definition and requirements. The installations should run sequentially in silent mode. We recommend that this is performed as a single process that does not require a restart until all the packages are installed. - -7. After the installations are complete, restart the updated computers. - - Depending on the software distribution system, you can schedule a restart of the computer or the end users can restart the computers manually during their regular work. After the computer is restarted, MED-V automatically starts after an end user logs on. When MED-V starts for the first time, it runs first time setup. - -First time setup starts and might take several minutes to finish, depending on the size of the virtual hard disk that you specified and the number of policies applied to the MED-V workspace on startup. The end user can track the progress by watching the MED-V icon in the notification area. For more information about first time setup, see [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md). - -**To install the MED-V components by using a batch file** - -1. Run the installation at a command prompt with administrative credentials. - -2. Deploy each component to a single directory. If run from a network share, a longer time is required to decompress the .medv file. - -3. As a best practice, specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This means that Windows Update will not cause any interference with the installation process by requiring a restart. - -4. Restart the computer after the batch file is finished. - -After the restart, the user is prompted to run first time setup and complete the configuration of MED-V. - -The following example, with the specified arguments, shows how to install 64-bit MED-V components in a single process: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ArgumentDescription

          /norestart

          Prevents the installation of Windows Virtual PC and the Windows Virtual PC update from restarting the host computer.

          /quiet

          Installs the MED-V components in quiet mode without user interaction.

          /qn

          Installs the MED-V components without a user interface.

          IGNORE_PREREQUISITES

          Installs without checking for Windows Virtual PC.

          -
          -Note

          Only specify this argument if you are installing Windows Virtual PC as part of this installation.

          -
          -
          - -

          OVERWRITEVHD

          Forces the installation of the MED-V workspace and prevents any prompts that it might generate.

          - - - -## Example - - -``` syntax -:: Install MED-V and the Pre-requisites - -:: Install the MED-V Host Agent: install in quiet mode, ignore that Windows Virtual PC is not installed completely, and log results -start /WAIT .\MED-V_HostAgent_Setup.exe /qn IGNORE_PREREQUISITES=1 /l* %TEMP%\MEDVhost.log - -:: Install the MED-V Workspace: install in quiet mode, Overwrite the VHD if it already exists, and log results -start /WAIT .\setup.exe /qn OVERWRITEVHD=1 /l* %TEMP%\MEDVworkspace.log - -:: Install Windows Virtual PC: install in quiet mode and do not reboot -start /WAIT wusa.exe Windows6.1-KB958559-x64.msu /norestart /quiet - -:: Install Windows Virtual PC patch to support non-HAV: install in quiet mode and do not reboot -wusa.exe Windows6.1-KB977206-x64.msu /norestart /quiet - -:: After successful installation of the above components, a reboot of the host computer is required to complete installation. -``` - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md deleted file mode 100644 index 3255998810..0000000000 --- a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install the MED-V Workspace Packager -description: How to Install the MED-V Workspace Packager -author: levinec -ms.assetid: 627478e9-6798-4b32-9a50-7a1b72bea295 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MED-V Workspace Packager - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 includes a **MED-V Workspace Packager**, which the desktop administrator uses to create the MED-V workspace deployment packages that are distributed to the end users. The packager provides step-by-step guidance on how to create MED-V workspaces and contains wizards that help in the process. - -**Important**   -Before you start to run the wizards, make sure that you have a prepared VHD ready to install. For more information, see [Prepare a MED-V Image](prepare-a-med-v-image.md). - - - -This section provides step-by-step instructions for installing or repairing the **MED-V Workspace Packager**. - -**To install the MED-V Workspace Packager** - -1. Locate the MED-V installation files that you received as part of your software download. - -2. Double-click the MED-V\_WorkspacePackager\_Setup installation file. - - The **Microsoft Enterprise Desktop Virtualization (MED-V) Workspace Packager Setup** wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Select the destination folder for installing the MED-V Workspace Packager, and then click **Next**. - -5. To begin the installation, click **Install**. - -6. After the installation is completed successfully, click **Finish** to close the wizard. - - To verify that the installation of the packager was successful, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager.** - - For information about how to use the **MED-V Workspace Packager**, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -If the packager does not open as expected, you can try to repair the installation. - -**To repair the MED-V Workspace Packager installation** - -1. Double-click the MED-V\_WorkspacePackager\_Setup installation file. - - The **Microsoft Enterprise Desktop Virtualization (MED-V) Workspace Packager Setup** wizard opens. Click **Next** to continue. - -2. To repair errors that might have occurred in the installation, click **Repair**. - -3. To begin the repair process, click **Repair** again. - -4. After the repair is completed successfully, click **Finish** to close the wizard. - - To verify that the repair of the packager was successful, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager.** - -## Related topics - - -[How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md) - -[How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md deleted file mode 100644 index 8085afe33e..0000000000 --- a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Manage URL Redirection by Using the MED-V Workspace Packager -description: How to Manage URL Redirection by Using the MED-V Workspace Packager -author: levinec -ms.assetid: 1a8d25af-479f-42d3-bf5f-c7fd974bbf8c -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage URL Redirection by Using the MED-V Workspace Packager - - -You can use the MED-V Workspace Packager to manage URL redirection in the MED-V workspace. - -**To manage web address redirection in a MED-V workspace** - -1. To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**. - -2. On the **MED-V Workspace Packager** main panel, click **Manage Web Redirection**. - -3. In the **Manage Web Redirection** window, you can type, paste, or import a list of the URLs that are redirected to Internet Explorer in the MED-V workspace. - - **Note** - URL redirection in MED-V only supports the protocols HTTP and HTTPS. MED-V does not provide support for FTP or any other protocols. - - - -~~~ -Enter each web address on a single line, for example: - -http://www.contoso.com/webapps/webapp1 - -http://www.contoso.com/webapps/webapp2 - -http://\*.contoso.com - -http://www.contoso.com/webapps/\* - -**Important** -If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding. -~~~ - - - -4. Click **Save as…** to save the updated URL redirection files in the specified folder. MED-V creates a registry file that contains the updated URL redirection information. Deploy the updated registry key by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - - MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create the updated MED-V workspace package. - -## Related topics - - -[How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md) - -[Manage MED-V URL Redirection](manage-med-v-url-redirection.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md b/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md deleted file mode 100644 index e53fe97cee..0000000000 --- a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: How to Manually Install the MED-V Host Agent -description: How to Manually Install the MED-V Host Agent -author: levinec -ms.assetid: 4becc90b-6481-4e1f-a4d3-aec74c8821ec -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manually Install the MED-V Host Agent - - -There are two separate but related components to the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 solution: the MED-V Host Agent and Guest Agent. The Host Agent resides on the host computer (a user’s computer that is running Windows 7) and provides a channel to communicate with the MED-V guest (the MED-V virtual machine running in the host computer). It also provides certain MED-V related functionality, such as application publishing. - -Typically, you deploy and install the MED-V Host Agent by using your company’s preferred method of provisioning software. However, before deploying MED-V across your enterprise, you might prefer to install the Host Agent locally for testing. This section provides step-by-step instructions for manually installing the MED-V Host Agent. - -**Note**   -The MED-V Guest Agent is installed automatically during first time setup. - - - -**Important**   -Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - -**To install the MED-V Host Agent** - -1. Locate the MED-V installation files that you received as part of your software download. - -2. Double-click the MED-V\_HostAgent\_Setup installation file. - - The **Microsoft Enterprise Desktop Virtualization (MED-V) Host Agent Setup** wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Select the destination folder for installing the MED-V Host Agent. Click **Next**. - -5. To begin the Host Agent installation, click **Install**. - -6. After the installation is completed successfully, click **Finish** to close the wizard. - - To verify that the installation of the Host Agent was successful, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - -**Note**   -Until a MED-V workspace is installed, the MED-V Host Agent can be started and runs, but provides no functionality. - - - -## Related topics - - -[How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md) - -[How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md) - -[How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md deleted file mode 100644 index e0a740c3ec..0000000000 --- a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Publish and Unpublish an Application on the MED-V Workspace -description: How to Publish and Unpublish an Application on the MED-V Workspace -author: levinec -ms.assetid: fd5a62e9-0577-44d2-ae17-61c0aef78ce8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish and Unpublish an Application on the MED-V Workspace - - -Even though an application is installed in a MED-V workspace, you might also have to publish the application before it becomes available to the end user. By default, most applications are published at the time that they are installed and shortcuts are created and enabled. - -In some cases, you might want to install applications on the MED-V workspace without making them available to the end user, for example, virus-scanning software. Similarly, there are occasions in which you want to publish an application that is installed on the MED-V workspace that was previously unavailable to the end user. For example, you might have to publish an installed application if the installation did not automatically create a shortcut on the **Start** menu. - -**Important**   -If you publish an application that does not support UNC paths, we recommend that you map the application to a drive. - - - -You can publish or unpublish applications to a deployed MED-V workspace by performing one of the following tasks: - -**To publish or unpublish an installed application** - -1. To publish an application on a deployed MED-V workspace, copy a shortcut for that application to the following folder on the virtual machine: - - C:\\Documents and Settings\\All Users\\Start Menu - - If it is necessary, use Group Policy or an ESD system to deploy a script that copies the shortcut for that application to the All Users\\Start Menu folder. - -2. To unpublish an application on a deployed MED-V workspace, delete the shortcut for that application from the following folder on the virtual machine: - - C:\\Documents and Settings\\All Users\\Start Menu - - If it is necessary, use Group Policy or an ESD system to deploy a script that deletes the shortcut for that application from the All Users\\Start Menu folder. - - **Note**   - Frequently, the shortcut is automatically deleted from the host computer **Start** menu when you uninstall the application. However, in some cases, such as for a MED-V workspace that is configured for all users of a shared computer, you might have to manually delete the shortcut on the **Start** menu after the application is uninstalled. The end-user can do this by right-clicking the shortcut and selecting **Delete**. - - - -To test that the application was published or unpublished, verify on the MED-V workspace whether the corresponding shortcut is available or not. - -**Note**   -Applications that are included in Windows XP SP3 and are located in the virtual machine Start Menu folder are not automatically published to the host. They are controlled by registry settings that block automatic publishing. For more information, see [Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md). - - - -**To publish Control Panel items** - -1. Create a shortcut on the virtual machine where the target is the name of the item, such as C:\\WINDOWS\\system32\\appwiz.cpl. - - The shortcut must be either created in or moved to the "%ALLUSERSPROFILE%\\Start Menu\\" folder or one of its subfolders. - - The item will be published to the host computer in the corresponding location in the host Start Menu folder. - -2. Start the shortcut for the item in the host. - -**Caution**   -When you create the shortcut, do not specify %SystemRoot%\\control.exe. This application will not be published because it is contained in the registry settings that block automatic publishing. - - - -**How MED-V handles automatic application publishing** - -1. During application publishing, MED-V copies the shortcuts from the guest virtual machine to the host computer by trying to match the folder hierarchy that exists in the guest. By doing this, MED-V copies shortcuts from the guest to the host by following these steps: - - 1. MED-V tries to locate a folder under Start Menu\\Programs in the host computer that is named the same as the folder in the guest where the shortcut resides. - - 2. If there is no matching folder, MED-V then tries to locate a folder in the host Start Menu folder that is named the same as the folder in the guest where the shortcut resides. - - 3. If there is no matching folder, MED-V copies the shortcut to the default folder on the host, the Start Menu\\Programs folder. - -2. Example of application publishing process: - - 1. If an application shortcut is published to the Start Menu\\Programs\\AppShortcuts folder in the guest, then MED-V looks in the host computer for a Start Menu\\Programs\\ AppShortcuts folder and if found, copies the shortcut to that folder. - - 2. If the folder is not found, then MED-V looks in the host computer for a Start Menu\\AppShortcuts folder and if found, copies the shortcut to that folder. - - 3. If the folder is not found, then MED-V copies the shortcut to the Start Menu\\Programs folder. - -**Note**   -A folder must already exist in the host computer Start Menu folder for MED-V to copy the shortcut there. MED-V does not create the folder if it does not already exist. - - - -## Related topics - - -[Installing and Removing an Application on the MED-V Workspace](installing-and-removing-an-application-on-the-med-v-workspace.md) - -[Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) - -[Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-test-application-publishing.md b/mdop/medv-v2/how-to-test-application-publishing.md deleted file mode 100644 index aceb82dbf6..0000000000 --- a/mdop/medv-v2/how-to-test-application-publishing.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Test Application Publishing -description: How to Test Application Publishing -author: levinec -ms.assetid: 17ba2e12-50a0-4f41-8300-f61f09db9f6c -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Test Application Publishing - - -After your test of first time setup finishes, you can verify that the application publishing functionality is working as expected by performing the following tasks. - -**To test application publishing** - -1. Verify that the applications that you specified for publishing are visible. - - Click **Start** and then click **All Programs** and search for the specified applications. - - In some cases, you might have the same application installed two times, one time on the host computer and one time on the guest. If a published application that has the same name is published to the same location on the host **Start** menu, it is distinguished from the host application shortcut by adding the virtual machine name to the shortcut name. For example, for a virtual machine named “MEDVHost1”, a host application might be "Notepad" and a published application might be "Notepad (MEDVHost1)". - -2. Verify that the applications function as intended. - - On the host computer, start the applications that you published and verify that they open in Windows XP SP3 on the guest. The application must appear in a Windows XP-style window on the host computer desktop. - -3. If applicable, verify that document redirection functions as intended. - - If a published application on the guest has to open a folder on the host system drive, ensure that it can open the specified folder. - - **Important**   - Because Windows Virtual PC does not support creating a share from a folder that is already shared, redirection does not occur for any documents that open from a shared folder, such as a My Documents folder that is located on the network. For more information, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - -After you have verified that published applications are installed and functioning correctly, you can test whether applications can be added or removed from the MED-V workspace. - -**To test that an application can be added or removed** - -1. Add or remove an application from the MED-V workspace. - - For information about how to add and remove applications from a MED-V workspace, see [Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md). - -2. If you added an application, repeat the steps in [To Test Application Publishing](#bkmk-apppub) to verify that the new application functions as intended. - -3. If you removed an application, click **Start** and then click **All Programs** and verify that any applications that you removed are no longer listed. - -**Note**   -If you encounter any problems when verifying your application publication settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - -After you have completed testing application publishing, you can test other MED-V workspace configurations to verify that they function as intended. - -After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. - -## Related topics - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-test-url-redirection.md b/mdop/medv-v2/how-to-test-url-redirection.md deleted file mode 100644 index be02f53d3e..0000000000 --- a/mdop/medv-v2/how-to-test-url-redirection.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Test URL Redirection -description: How to Test URL Redirection -author: levinec -ms.assetid: 38d80088-da1d-4098-b27e-76f9e78f81dc -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Test URL Redirection - - -After your test of first time setup finishes, you can verify that the URL redirection functionality is working as expected by performing the following tasks. - -**Important**   -The MED-V Host Agent must be running for URL redirection to function correctly. - -**To test URL Redirection** - -1. Open an Internet Explorer browser in the host computer and enter a URL that you specified for redirection. - -2. Verify that the webpage is opened in Internet Explorer on the guest virtual machine. - -3. Repeat this process for each URL that you want to test. - -**To test that a URL can be added or removed** - -1. Add or remove a URL from the MED-V workspace. - - For information about how to add and remove URLs for redirection on a MED-V workspace, see [Manage MED-V URL Redirection](manage-med-v-url-redirection.md). - -2. If you added a URL to the redirection list, repeat the steps in [To Test URL Redirection](#bkmk-urlredir) to verify that the new URL redirects as intended. - -3. If you removed a URL from the redirection list, verify that it is removed by following these steps: - - 1. Open an Internet Explorer browser in the host computer and enter the URL that you removed from the redirection list. - - 2. Verify that the webpage is opened in Internet Explorer on the host computer instead of on the guest virtual machine. - - **Note**   - It can take several seconds for the URL redirection changes to take place. - -**Note**   -If you encounter any problems when verifying your URL redirection settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - -After you have completed testing URL redirection in your MED-V workspace, you can test other configurations to verify that they function as intended. - -After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. - -## Related topics - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md b/mdop/medv-v2/how-to-uninstall-the-med-v-components.md deleted file mode 100644 index b937152091..0000000000 --- a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Uninstall the MED-V Components -description: How to Uninstall the MED-V Components -author: levinec -ms.assetid: c121dd27-6b2f-4d41-a21a-c6e8608c5c41 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the MED-V Components - - -Under certain circumstances, you might want to uninstall all or part of the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 components from your enterprise. For example, you have resolved all application operating system compatibility issues, or you want to deploy a different MED-V workspace in your enterprise. - -Typically, you can configure your electronic software distribution (ESD) system to uninstall the MED-V components by using a Windows-based Installer. Alternately, you can uninstall all or some MED-V components manually. - -**Important**   -Before you can uninstall the MED-V Host Agent, you must first uninstall any installed MED-V workspace. - - - -Use the following procedures to uninstall the MED-V components from your enterprise. - -**To uninstall MED-V using an electronic software distribution System** - -1. Use your ESD system to distribute a script that invokes the uninstall.exe executable program for every MED-V workspace that you want to uninstall. The file is located at C:\\ProgramData\\Microsoft\\Medv\\Workspace. You can set a flag to run the uninstall executable program silently so that end users are unaware of the uninstallation. - -2. Create a package to distribute the MED-V Host Agent installation file to each computer on which a MED-V workspace was uninstalled. Configure the package to run the uninstallation in silent mode. - -The ESD client recognizes when the new packages are available and starts to uninstall the packages per the definition and requirements. - -**To manually uninstall a MED-V workspace** - -1. On the host computer, click **Start**, click **Control Panel**, and then click **Programs and Features**. - -2. In the **Programs and Features** window, select the MED-V workspace that you want to remove, and then click **Uninstall**. (The MED-V workspace is named "MED-V Workspace - <*workspace\_name*>"). The <*workspace\_name*> **Setup Wizard** opens. - -3. On the **Setup Wizard**, click **Next**, and then click **Remove**. - -4. If you prefer, select the check box to delete the master VHD disk and differencing disks created by MED-V. This is not required, but frees disk space after the uninstallation finishes. - -5. Click **Remove**. - - **Note**   - If MED-V is currently running, a dialog box appears and prompts you whether you want to shut it down. Click **Yes** to continue with the uninstallation. Click **No** to cancel the uninstallation. - - - -Alternately, you can remove a MED-V workspace by running the `uninstall.exe` file, typically located at C:\\ProgramData\\Microsoft\\Medv\\Workspace. - -**To manually uninstall the MED-V Host Agent** - -1. On the Windows 7 host computer, click **Start**, click **Control Panel**, and then click **Programs and Features**. - -2. In the **Programs and Features** window, select **MED-V Host Agent**, and then click **Uninstall**. - - The Windows Installer removes the MED-V Host Agent. - - **Note**   - If you try to uninstall the MED-V Host Agent before you uninstall the MED-V workspace, a dialog box appears that states that you must first uninstall the MED-V workspace. Click **OK** to continue. - - - -**To manually uninstall the MED-V Workspace Packager** - -1. On the host computer, click **Start**, click **Control Panel**, and then click **Programs and Features**. - -2. In the **Programs and Features** window, select **MED-V Workspace Packager**, and then click **Uninstall**. - - The Windows Installer removes the MED-V Workspace Packager. - - **Note**   - You can uninstall the MED-V Workspace Packager at any time without affecting any deployed MED-V workspaces. - - - -## Related topics - - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md b/mdop/medv-v2/how-to-verify-first-time-setup-settings.md deleted file mode 100644 index c7e07d9a20..0000000000 --- a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Verify First Time Setup Settings -description: How to Verify First Time Setup Settings -author: levinec -ms.assetid: e8a07d4c-5786-4455-ac43-2deac4042efd -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Verify First Time Setup Settings - - -While your test of first time setup is running or after it finishes, you can verify the settings that you configured in your MED-V workspace by performing the following tasks. - -**Note**   -For information about how to monitor the successful completion of first time setup throughout your enterprise after deployment, see [Monitoring MED-V Workspace Deployments](monitoring-med-v-workspace-deployments.md). - - - -**To verify settings during first time setup** - -1. While first time setup is running, verify the following: - - If you specified **Unattended** mode, verify that the virtual machine does not appear when first time setup is running. - - If you specified attended mode, verify that the virtual machine appears and that all fields that require user input are displayed. - -2. You can also monitor the complete first time setup process by viewing the virtual machine when first time setup is running. To do this, follow these steps: - - 1. Open the Windows Virtual PC Console. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, and then click **Windows Virtual PC**. - - 2. Start MED-V if it is not already running. - - If not already present, in a short time, a virtual machine with the name of the deployed MED-V workspace appears in the list of virtual machines. - - 3. Double-click the MED-V virtual machine to open it. - - You can observe the MED-V virtual machine when it is being set up, and you can troubleshoot the Mini-Setup procedure. Verify the information in the different screens as they go by, such as configuring networking settings, computer domain join information, configuring of the Guest Agent, set up of personal settings, and shutdown. - - 4. The virtual machine closes automatically when first time setup finishes. - - **Note**   - You can close the virtual machine window at any time and first time setup continues. - - - -**To verify settings after first time setup finishes** - -1. Ensure that first time setup finished successfully. - -2. Verify that the MED-V workspace is set up correctly. - - 1. Open the Windows Virtual PC Console. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, and then click **Windows Virtual PC**. - - 2. Double-click your installed MED-V workspace. - - If the MED-V workspace is already running a virtual application, you might be prompted to close the application before you can open the virtual machine. - - 3. In the MED-V workspace, right-click **My Computer**, and then click **Properties**. - - 4. Verify that the MED-V workspace joined the correct domain. If applicable to your organization, test domain joining by specifying two different domains to verify that the guest domain is overridden by the host domain. - - 5. Verify that the MED-V workspace joined the domain organizational unit that you specified. - - 6. If you specified the computer name mask, verify that the new computer name matches what was specified. - -3. Verify that the locale settings that you specified are correct. - - 1. In the MED-V workspace, click **Start** and then click **Control Panel**. - - 2. Verify your specified configuration settings, for example, **Date and Time** and **Regional and Language**. - -**Note**   -If you encounter any problems when verifying your first time setup settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - - - -After you have verified that your first time setup settings are correct, you can test other MED-V workspace configurations to verify that they function as intended, such as application publishing and URL redirection. - -After you have completed all testing of your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. - -## Related topics - - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md b/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md deleted file mode 100644 index a8ab87367d..0000000000 --- a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Identifying the Number and Types of MED-V Workspaces -description: Identifying the Number and Types of MED-V Workspaces -author: levinec -ms.assetid: 11642253-6b1f-4c4a-a11e-48d8a360e1ea -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identifying the Number and Types of MED-V Workspaces - - -MED-V creates a virtual environment for running applications that require Windows XP or that require a version of Internet Explorer that differs from the version on the host computer. This virtual environment is known as a MED-V workspace. - -Depending on the application compatibility requirements faced by your organization as you migrate to Windows 7, only certain users or departments might require MED-V workspaces. As you plan your deployment, you have to determine the number of MED-V workspaces required in your enterprise. You also have to define the requirements of each MED-V workspace. - -## Identify the Number and Types of MED-V Workspaces - - -Identify the computers and groups in your enterprise for which you will be creating MED-V workspaces. Typically, these are the users who require access to those applications that cannot be migrated to Windows 7. Identify those applications that cannot be migrated and the users who require a MED-V workspace to run these applications. - -You might also have intranet addresses that have not yet been optimized for Windows 7. The MED-V workspace provides an Internet Explorer browser through which end users can better access those web addresses that are not yet ready for the migration to Windows 7. As you are preparing and planning your MED-V deployment, you will have to identify and compile a list of the URL addresses to redirect from Internet Explorer on the host computer to Internet Explorer in the MED-V workspace. - -Finally, you have to evaluate your disk space requirements. Most MED-V workspaces are 2 gigabytes (GB) or larger. The available disk space on a system can be consumed quickly, depending on the number of users and the configuration of MED-V. Also, your company’s preferred method of distribution can require additional space. Generally, you should free a minimum of 10 GB of disk space for a MED-V workspace, but this varies greatly, depending on the size of the image. - -### Calculate the Disk Space Requirements for MED-V Workspaces - -A MED-V workspace requires memory and disk space from the host computer on which it is installed. At a minimum, 2 GB of disk space are required on the host. Disk space is variable and depends on the number of applications and the data in a user’s MED-V workspace. - -We recommend a minimum of 10 GB of disk space for MED-V. This amount allows for a basic Windows XP workspace and some basic installed applications and web redirection. It also provides available space for the host swap drive. In a basic configuration, MED-V and a single deployed MED-V workspace consume as much as 6 to 8 GB. If you include lots of applications on the MED-V workspace or have more than one user per computer, then you can use the following calculation to more accurately determine the disk space your MED-V workspace requires: - -*Base VHD + (User per computer x (Difference Disk + Saved State))* - -To calculate the required disk space, determine the following: - -- **Size of the base VHD** – the virtual hard disk that was used to create the MED-V workspace. - - **Important**   - Do not use the .medv file size for your calculation because the .medv file is compressed. - - - -- **Users per computer** – MED-V creates a MED-V workspace for each user on a computer; the MED-V workspace consumes disk space as each user logs on and the MED-V workspace is created. - -- **Size of the differencing disk** – used to track the difference from the base VHD. This size varies as you add applications and software updates to the virtual hard disk. A differencing disk is created for each MED-V user when they start MED-V for the first time. - -- **Size of the Saved State file** – used to maintain state in the virtual machine. Typically, this is just a bit larger than the allocated RAM for the virtual machine. For example, 1 GB of RAM allocated creates a file about 1,081,000 KB. - -The following example shows a calculation based on three users of a MED-V workspace that has a 2.6 GB virtual hard disk: - -*2.6gb + (3 x (1.5gb + 1gb)) = 10.1gb* - -**Note**   -A MED-V best practice is to calculate the required space by using a lab deployment to validate the requirements. - - - -### Locate the Files to Determine File Size - -The following locations contain the files for the computer and user settings: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
          TypeLocationFiles

          Base VHD

          %ProgramData%\Microsoft\Medv\Workspace

          InternalName.vhd - Where InternalName is the name of the virtual hard disk that you selected in the MED-V Workspace Packager.

          Differencing Disk

          %LocalAppData%\Microsoft\MEDV\v2\Virtual Machines

          WorkspaceName.vhd

          Saved State File

          %LocalAppData%\Microsoft\MEDV\v2\Virtual Machines

          WorkspaceName.vsv

          - - - -### Calculate the Disk Space Requirements for Shared MED-V Workspaces - -If you are calculating for a shared MED-V workspace deployment on a single computer, then the number of users per computer in your calculation is always “1” because MED-V only configures a single differencing disk for all users. - -You can find the differencing disk and the saved state file for shared MED-V workspaces in %ProgramData%\\Microsoft\\Medv\\AllUsers. - -## Related topics - - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) - -[Planning for MED-V](planning-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/images/med-v2logo.gif b/mdop/medv-v2/images/med-v2logo.gif deleted file mode 100644 index 4334fde270..0000000000 Binary files a/mdop/medv-v2/images/med-v2logo.gif and /dev/null differ diff --git a/mdop/medv-v2/index.md b/mdop/medv-v2/index.md deleted file mode 100644 index aa6fcbf448..0000000000 --- a/mdop/medv-v2/index.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Microsoft Enterprise Desktop Virtualization 2.0 -description: Microsoft Enterprise Desktop Virtualization 2.0 -author: dansimp -ms.assetid: 84109be0-4613-42e9-85fc-fcda8de6e4c4 -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Enterprise Desktop Virtualization 2.0 - - -![med-v logotype](images/med-v2logo.gif) - -Welcome to Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. MED-V 2.0 uses Windows Virtual PC to provide an enterprise solution for desktop virtualization. By using MED-V, you can easily create, deliver, and manage corporate Windows Virtual PC images on any Windows-based desktop running Windows 7 Professional, Enterprise, or Windows 7 Ultimate. - -MED-V is an integral component of the Microsoft Desktop Optimization Pack, a dynamic solution available to Software Assurance customers, which helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -For more information about how to perform MED-V tasks, use the following sections. - -## In This Section - - -[Getting Started with MED-V](getting-started-with-med-vmedv2.md) - -[Planning for MED-V](planning-for-med-v.md) - -[Deployment of MED-V](deployment-of-med-v.md) - -[Operations for MED-V](operations-for-med-v.md) - -[Troubleshooting MED-V](troubleshooting-med-vmedv2.md) - -[Security and Protection for MED-V](security-and-protection-for-med-v.md) - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -## Reference - - -For more information about MED-V, see - -[Microsoft Windows Enterprise: Improving Virtual PCs with MED-V](https://go.microsoft.com/fwlink/?LinkId=195917) (https://go.microsoft.com/fwlink/?LinkId=195917). - -  - -  - - - - - diff --git a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md deleted file mode 100644 index e8ceecb9a4..0000000000 --- a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Installing and Removing an Application on the MED-V Workspace -description: Installing and Removing an Application on the MED-V Workspace -author: levinec -ms.assetid: 24f32720-51ab-4385-adfe-4f5a65e45fdf -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Installing and Removing an Application on the MED-V Workspace - - -Applications that are incompatible with the host operating system can be run in the MED-V workspace and opened in the MED-V workspace in the same manner in which they are opened from the host computer, on the **Start** menu or by using a localhost shortcut. - -After you have deployed a MED-V workspace, you have several different options available to you for installing and removing applications in the MED-V workspace. These options include the following: - -- [Using Group Policy](#bkmk-grouppolicy) - -- [Using an Electronic Software Distribution System](#bkmk-esd) - -- [Using Application Virtualization (APP-V)](#bkmk-appv) - -- [Updating the Core Image](#bkmk-coreimage) - -**Important**   -To make sure that an installed application is automatically published to the host, install the application on the virtual machine for **All Users**. For more information about application publishing, see [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md). - - - -**Tip**   -MED-V does not support guest-to-host redirection for content handling, such as double-clicking a Microsoft Word document in Internet Explorer in the MED-V workspace. Therefore, the required applications, such as Microsoft Word, must be installed in MED-V workspace to provide the default content handling functionality that an end user might expect. - - - -## Adding and Removing Applications by Using Group Policy - - -You can use Group Policy and Group Policy objects to assign or publish applications to all or some MED-V workspaces in your enterprise. For assigned applications, when an end user logs on to their computer, the application appears on the **Start** menu. When they select the new application for the first time, the application installs and is ready for use. For published applications, the application does not appear on the **Start** menu. It is only available for the end user to install by using **Add or Remove Programs** in **Control Panel** or by opening a file that is associated with the application. - -You can also use Group Policy and Group Policy objects in the same manner to remove applications from the MED-V workspace. - -For more information about how to add and remove applications by using Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - -## Adding and Removing Applications by Using an ESD System - - -An electronic software distribution (ESD) system is designed to efficiently deploy software and other information to many different computers over network connections. If your organization uses an ESD system to deploy software, you can use it to add and remove applications on MED-V workspaces just as you add and remove applications on physical computers. - -## Adding and Removing Applications by Using APP-V - - -Microsoft Application Virtualization (App-V) provides the administrative capability to make applications available to end-user computers without having to install the applications directly on those computers. You might want to use MED-V and App-V together if, for example, your organization has applications that you sequenced with App-V in Windows XP, and re-sequencing them would delay your migration to Windows 7. - -You can use MED-V together with App-V to add and remove virtual applications on a deployed MED-V workspace. To manage applications in this manner, you must first install the App-V agent on the MED-V guest operating system. You can then use App-V in the MED-V workspace to add and remove the virtual applications. - -For information about how to install and use App-V, see [Application Virtualization](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939). - -**Important**   -App-V applications that you publish to the MED-V workspace have file-type associations that cannot redirect from the host computer to the guest virtual machine. However, the end user can still access these file types by clicking **File**, and then by clicking **Open** on the published App-V application. - -To force redirection of those file-type associations, query App-V for mapped file type associations by typing the following at a command prompt in the guest virtual machine: **sftmime /QUERY OBJ:TYPE**. Then, map those file type associations in the host computer. - - - -## Adding and Removing Applications on the Core Image - - -Although not considered a MED-V best practice, you can add and remove applications directly on the core image. After you have added or removed an application, you can redeploy the MED-V workspace back out to your enterprise just as you deployed it originally. - -For more information about how to add or remove applications on the core image, see [Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md). - -**Important**   -We do not recommend this method of managing applications. If you add or remove applications on the core image and redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved on the virtual machine is lost. - - - -**Note**   -Even though an application is installed into a MED-V workspace, you might also have to publish the application before it becomes available to the end user. For example, you might have to publish an installed application if the installation did not automatically create a shortcut on the **Start** menu. Likewise, to unpublish an application, you might have to manually remove a shortcut from the **Start** menu. - -By default, most applications are published at the time that they are installed, when shortcuts are automatically created and enabled. - - - -## Related topics - - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) - - - - - - - - - diff --git a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md b/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md deleted file mode 100644 index 250f5c9b1d..0000000000 --- a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Installing Applications on a Windows Virtual PC Image -description: Installing Applications on a Windows Virtual PC Image -author: levinec -ms.assetid: 32651eff-e3c6-4ef4-947d-2beddc695eac -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Installing Applications on a Windows Virtual PC Image - - -After you have created a Windows Virtual PC image for use with Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, you can install other components that are helpful when running MED-V, such as an electronic software distribution (ESD) system and antivirus software. - -The following section provides information to help you install software on the MED-V image. - -**Caution**   -For ease of MED-V workspace management after deployment, we recommend that you limit the number of components that you install on the MED-V image to those components that are required or that are helpful when using MED-V. For example, although they are not required to run MED-V, you can install an ESD system to use later for installing applications to a MED-V workspace and antivirus software for security on the image. - - - -**Installing Software on a MED-V Image** - -1. If it is not currently running, open your MED-V virtual machine. - - 1. Click **Start**, click **All Programs**, click **Windows Virtual PC** and then click **Windows Virtual PC**. - - 2. Double-click your MED-V virtual machine. - -2. From inside the virtual machine operating system, locate the installation files for the software that you want to install. - -3. Follow the installation instructions that are provided by the software vendor. - - **Note**   - After installation is complete, you might have to close and then restart the virtual machine. - - - -Repeat these steps for any software or application that you want to install on the MED-V image. We recommend that you limit the number of applications that you preinstall on the image. The recommended process for installing applications and other software on the image is to preinstall an ESD system now and to use it later to deploy software to the image. Alternately, you can also use Group Policy or App-V to add or remove applications on a MED-V workspace. For more information, see [Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md). - -For more information about how to install software on a virtual image, see the following articles: - -- [Publish and Use Virtual Applications](https://go.microsoft.com/fwlink/?LinkId=195926) (https://go.microsoft.com/fwlink/?LinkId=195926). - -- [Windows Virtual PC Help](https://go.microsoft.com/fwlink/?LinkId=182378) (https://go.microsoft.com/fwlink/?LinkId=182378). - -After you have installed all of the software that you want on the MED-V image, your image is ready to be packaged. - -## Related topics - - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) - -[Prepare a MED-V Image](prepare-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/manage-med-v-url-redirection.md b/mdop/medv-v2/manage-med-v-url-redirection.md deleted file mode 100644 index f14da219a0..0000000000 --- a/mdop/medv-v2/manage-med-v-url-redirection.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Manage MED-V URL Redirection -description: Manage MED-V URL Redirection -author: levinec -ms.assetid: 274161c0-b54a-4364-bb63-89996afccd04 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage MED-V URL Redirection - - -After you deploy your MED-V workspace, you can select from different methods to add or remove URL redirection information in the MED-V workspaces. - -Included in this section are both information and instructions to help you manage URL redirection information on assigned MED-V workspaces. - -## In This Section - - -[How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md) -Provides assistance in adding and removing URL redirection information on MED-V workspaces. - -[How to Manage URL Redirection by Using the MED-V Workspace Packager](how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md) -Provides assistance in managing URL redirection information through the MED-V Workspace Packager. - -## Related topics - - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) - -[Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/manage-med-v-workspace-applications.md b/mdop/medv-v2/manage-med-v-workspace-applications.md deleted file mode 100644 index f7038cbe03..0000000000 --- a/mdop/medv-v2/manage-med-v-workspace-applications.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Manage MED-V Workspace Applications -description: Manage MED-V Workspace Applications -author: levinec -ms.assetid: f58c7504-a77a-41a8-ac38-7e618da131fb -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage MED-V Workspace Applications - - -This section provides information about how to manage MED-V workspace applications. - -## In This Section - - -[Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md) -Describes how to install and remove applications on the VHD and how to publish existing applications. - -[Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) -Describes how to manage software updates for MED-V workspaces. - -[Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md) -Describes how to manage automatic software updates for MED-V workspaces. - -## Related topics - - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/manage-med-v-workspace-settings.md b/mdop/medv-v2/manage-med-v-workspace-settings.md deleted file mode 100644 index be8f5b08c0..0000000000 --- a/mdop/medv-v2/manage-med-v-workspace-settings.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Manage MED-V Workspace Settings -description: Manage MED-V Workspace Settings -author: levinec -ms.assetid: 35ebd16e-31c7-4996-81be-af1d56346803 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage MED-V Workspace Settings - - -The information provided here can help administrators manage MED-V workspace settings. - -## In This Section - - -[Managing MED-V Workspace Settings by Using the MED-V Workspace Packager](managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md) -Describes how to use the MED-V Workspace Packager to manage certain MED-V workspace settings. - -[Managing MED-V Workspace Settings by Using a WMI](managing-med-v-workspace-settings-by-using-a-wmi.md) -Describes how to use Windows Management Instrumentation to manage MED-V workspace settings. - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) -Describes how to manage MED-V workspace configuration settings. - -[Managing Printers on a MED-V Workspace](managing-printers-on-a-med-v-workspace.md) -Describes how MED-V manages printer redirection in a MED-V workspace. - -## Related topics - - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md b/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md deleted file mode 100644 index d89ba616c8..0000000000 --- a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Managing Applications Deployed to MED-V Workspaces -description: Managing Applications Deployed to MED-V Workspaces -author: levinec -ms.assetid: 9a9bcdf5-0aa7-42a3-b6f0-6065adb01bcb -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Applications Deployed to MED-V Workspaces - - -After you deploy your MED-V workspace, you have several different methods to select from to install, remove, publish, and unpublish applications on the MED-V workspaces. - -This section provides information and instructions to help you manage applications after you have deployed the MED-V workspace. - -## In This Section - - -[Installing and Removing an Application on the MED-V Workspace](installing-and-removing-an-application-on-the-med-v-workspace.md) -Provides assistance in installing and removing applications on MED-V workspaces. - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) -Provides assistance in publishing and unpublishing applications on MED-V workspaces. - -## Related topics - - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md deleted file mode 100644 index 1c1d68922c..0000000000 --- a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Managing Automatic Updates for MED-V Workspaces -description: Managing Automatic Updates for MED-V Workspaces -author: levinec -ms.assetid: 306f28a2-d653-480d-b737-4b8b3132de5d -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing Automatic Updates for MED-V Workspaces - - -The MED-V workspace is a virtual machine that contains a separate operating system, whose automatic software update process must be managed just like the physical computers in your enterprise. Because the guest operating system is not always necessarily running when the host operating system is running, you must ensure that the MED-V virtual machine is configured in such a way that software updates can be applied to the guest operating system as required. The Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 solution provides the functionality that lets you determine how automatic software updates are processed in a MED-V workspace. - -## Managing MED-V Workspace Wake-Up Policy - - -The MED-V workspace wake-up policy guarantees that the MED-V virtual machine is made available for updates for the time that you specify in your MED-V configuration settings. This applies to both updates that are published from Microsoft through Windows Update and updates deployed and controlled by non-Microsoft solutions, such as antivirus applications. - -**Important**   -The MED-V workspace wake-up policy is optimized for the Microsoft Update infrastructure. If you are using Microsoft System Center Configuration Manager to deploy non-Microsoft updates, we recommend that you also use the System Center Updates Publisher, which takes advantage of the same infrastructure as Microsoft Update and therefore benefits from the MED-V workspace wake-up policy. For more information, see [System Center Updates Publisher](https://go.microsoft.com/fwlink/?LinkId=200035) (https://go.microsoft.com/fwlink/?LinkId=200035). - - - -When you created your MED-V workspace package, you configured when and how it starts, either when the end user logs on (**Fast Start**) or when the end user first opens a published application (**Normal Start**). Or you set the option to let the end user control this setting. - -Either way, whenever the **Fast Start** option is selected, the virtual machine continues to run as long as the MED-V host is logged on as User. In this configuration, because MED-V is active when the host is active, automatic updates are applied without requiring any extra processing from MED-V. - -However, for those cases in which **Fast Start** is not specified or the virtual machine hibernates or stops, MED-V guarantees through its MED-V workspace wake-up policy that the guest operating system is being regularly updated even when MED-V is not used regularly. MED-V performs this function by regularly waking up the virtual machine based on the configuration settings that you specify. This enables the automatic update clients in the virtual machine to execute based on their configurations. After the time period defined by the MED-V configuration setting elapses, MED-V returns the virtual machine to its previous state. - -**Note**   -If the end user opens a published application during the update period, the required updates are applied, but MED-V is not automatically hibernated or shut down after the update period ends. Instead, MED-V continues running. - - - -The MED-V workspace wake-up policy includes three main components: - -**Guest Update Manager** - -Residing on the MED-V host, this stand-alone executable program is responsible for waking up the virtual machine according to a predefined, configurable schedule. Specify the configuration settings to indicate at what time the update manager should wake up the virtual machine every day, and how long the virtual machine should be kept awake (in minutes) to allow for updates to be applied. After the number of minutes specified has been reached, the guest update manager puts the virtual machine into hibernation, prepared for the next use. You can schedule the execution of this executable program through the Windows Task Manager. - -**Guest Restart Management Service** - -Residing on the MED-V host, this service has three primary responsibilities. Along with the Guest Update Manager, it manages the restart of the virtual machine at user logon, if it is required. It detects when virtual machine restarts are required caused by updates being installed. And it ensures that the task for the Guest Update Manager is always scheduled according to configuration. - -**Guest Update Service** - -Residing on the MED-V virtual machine, this Windows service has the responsibility of monitoring when installed updates require a restart. After the service becomes aware of the need for a restart, it notifies the guest restart management service on the host. - -### Configuration Settings for MED-V Workspace Wake-Up Policy - -You control when and for how long the virtual machine awakens to receive automatic updates by defining the following two configuration values in the registry. Both of these values are located under the HKLM\\Software\\Microsoft\\MEDV\\v2\\VM key. - -**GuestUpdateTime** – Configures the hour and minute each day when MED-V must wake up the virtual machine for updating, based on the 24-hour clock standard. Specify the time in the format HH:MM. The default value is 00:00 (midnight). - -**GuestUpdateDuration** – Configures the number of minutes that MED-V must keep the virtual machine awake for updating, starting at the time specified in the GuestUpdateTime configuration setting. The default value is 240 (4 hours). Setting this value to zero (0) disables the MED-V workspace wake-up policy. - -For more information about how to define your MED-V configuration values, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md). - -**Note**   -A MED-V best practice is to set your wake up interval to match the time when MED-V virtual machines are planned to be updated regularly. In addition, we recommend that you configure these settings to resemble the host computer’s behavior. - - - -### Reboot Notification Using your ESD System - -You can configure your ESD system to notify MED-V whenever a restart is required for the MED-V workspace after automatic updates have been applied. When you apply automatic updates through your ESD system that you know require a restart, you should write a script to signal the following global event on the MED-V workspace: - -**Important**   -You must open the event with Modify Only rights and then signal it. If you do not open it with the correct permissions, it does not work. - - - -``` syntax -///

          -/// The guest is required to be restarted due to an ESD update. -/// -public const string MedvGuestRebootRequiredEventName = @"Global\MedvGuestRebootRequiredEvent"; -using (EventWaitHandle notificationEvent = -EventWaitHandle.OpenExisting(eventName, EventWaitHandleRights.Modify)) -{ -notificationEvent.Set(); -} -``` - -When you signal this event, MED-V captures it and informs the virtual machine that a restart is required. - -## Related topics - - -[Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md b/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md deleted file mode 100644 index 4277a3ed48..0000000000 --- a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md +++ /dev/null @@ -1,779 +0,0 @@ ---- -title: Managing MED-V Workspace Configuration Settings -description: Managing MED-V Workspace Configuration Settings -author: levinec -ms.assetid: 517d04de-c31f-4b50-b2b3-5f8c312ed37b -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing MED-V Workspace Configuration Settings - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 stores its configuration settings in the registry. The information we include here about the registry may help you better manage your MED-V services. - -MED-V uses the following search path when looking for the resultant settings values: - -MED-V first looks in the machine policy. - -If the value is not found, MED-V looks in the user policy. - -If the value is not found, MED-V looks in the HKEY\_LOCAL\_MACHINE\\System hive. - -If the value is not found, MED-V looks in the HKEY\_CURRENT USER registry hive. - -If the value is still not found, MED-V uses the default. - -A general best practice is to set the value in the HKEY\_LOCAL\_MACHINE\\System hive or in the machine policy. But if you want the end user to be able to configure a particular setting, then you should leave it out. - -**Note** -Before you deploy your MED-V workspaces, you can use a script editor to change the Windows PowerShell script (.ps1 file) that the MED-V workspace packager created. For more information, see [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md). - -After you have deployed your MED-V workspaces, you can change certain MED-V configuration settings by editing the registry entries. - - - -This section lists all the configurable MED-V registry keys and explains their uses. - -## Diagnostics Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\Diagnostics key. - - ------ - - - - - - - - - - - - - - - - -
          Name Type Data/Default Description

          EventLogLevel

          DWORD

          Default=3

          The type of information that is logged in the event log. Levels include the following: 0 (None), 1 (Error), 2 (Warning), 3 (Information), 4 (Debug).

          - - - -## Fts Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\Fts key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameTypeData/DefaultDescription

          AddUserToAdminGroupEnabled

          DWORD

          Default=0

          Configures whether first time setup automatically adds the end user to the administrator's group. 0 = false; 1 = true.

          0 = false: First time setup does not automatically add the end user to the administrator's group.

          1 = true: First time setup automatically adds the end user to the administrator's group.

          ComputerNameMask

          SZ

          MEDV*

          The computer name mask that is used to create the guest virtual machine's computer name.

          The mask can contain a %username% tag to insert the username as part of the computer name. Likewise, the %hostname% tag inserts the name of the host computer.

          -

          Every "#" character in the mask is replaced by a random digit. An asterisk (*) character at the end of the mask is replaced by random alphanumeric characters.

          -

          A specific number of characters from %hostname% and %username% can be captured by using square brackets. For example, "%username%[3]" would use the first three characters of the username.

          DeleteVMStateTimeout

          DWORD

          Default=90

          The time-out value, in seconds, when first time setup tries to delete the virtual machine. Range = 0 to 2147483647.

          DetachVfdTimeout

          DWORD

          Default=120

          The time-out value, in seconds, when first time setup tries to detach the virtual floppy disk from the virtual machine. Range = 0 to 2147483647.

          DialogUrl

          SZ

          Customizable URL that links to internal webpage and is displayed by first time setup dialog messages.

          ExplorerTimeout

          DWORD

          Default=900

          The time-out value, in seconds, that first time setup waits for Windows Explorer. Range = 0 to 2147483647.

          FailureDialogMsg

          MULTI_SZ

          Message is found in resource file

          Customizable message that is displayed to the end user when first time setup cannot be completed.

          GiveUserGroupRightsMaxRetryCount

          DWORD

          Default=3

          The maximum number of times that MED-V tries to give an end user group rights. Exceeding the specified retry value without being able to successfully give an end user group rights most likely causes a virtual machine preparation failure that is then subject to the MaxRetryCount value. Range = 0 to 2147483647.

          GiveUserGroupRightsTimeout

          DWORD

          Default=300

          The time-out value, in seconds, when giving a user group rights. Range = 0 to 2147483647.

          LogFilePaths

          MULTI_SZ

          A list of the log file paths that MED-V collects during first time setup.

          MaxPostponeTime

          DWORD

          Default=120

          The maximum number of hours that first time setup can be postponed by the end user. Range = 0 to 2147483647.

          MaxRetryCount

          DWORD

          Default=3

          The maximum number of times that MED-V tries to prepare a virtual machine if each attempt ends in a failure other than a software error. When virtual machine preparation fails and the number of first time setup retries is exceeded, then MED-V informs the end user about the failure and does not give the option to retry. The count is re-set every time that MED-V is started. Range = 0 to 2147483647.

          Mode

          SZ

          Default=Unattended

          Configures how first time setup interacts with the user. Possible values are as follows:

          Attended. The end user must enter information during first time setup.

          -
          -Note

          If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, then you must select Attended mode or problems might occur during first time setup.

          -
          -
          - -

          Unattended. The virtual machine is not shown to the end user during first time setup, but the end user is prompted before first time setup starts.

          Silent. The virtual machine is not shown to the end user at all during first time setup.

          NonInteractiveRetryTimeoutInc

          DWORD

          Default=15

          The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode when re-attempting setup. Range = 0 to 2147483647.

          NonInteractiveTimeout

          DWORD

          Default=45

          The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode. Range = 0 to 2147483647.

          PostponeUtcDateTimeLimit

          SZ

          The date and time, in UTC DateTime format, that first time setup can be postponed. Enter in the format "yyyy-MM-dd hh:mm" with hours specified by using the 24-hour clock standard.

          RetryDialogMsg

          MULTI_SZ

          Message is found in resource file

          Customizable message that is displayed to the end user when first time setup must re-attempt setup.

          SetComputerNameEnabled

          DWORD

          Default=0

          Configures whether the ComputerName entry under the [UserData] section of the Sysprep.inf file in the guest should be updated according to the specified ComputerNameMask. 0 = false; 1 = true.

          0 = false: The ComputerName entry in the Sysprep.inf file is not updated according to the ComputerNameMask.

          1 = true: The ComputerName entry in the Sysprep.inf file is updated according to the ComputerNameMask.

          SetJoinDomainEnabled

          DWORD

          Default=0

          Configures whether the JoinDomain setting under the [Identification] section of the Sysprep.inf file in the guest should be updated to match the settings on the host. 0 = false; 1 = true.

          0 = false: The JoinDomain setting in the Sysprep.inf file is not updated to match the settings on the host.

          1 = true: The JoinDomain setting in the Sysprep.inf file is updated to match the settings on the host.

          SetMachineObjectOUEnabled

          DWORD

          Default=0

          Configures whether the MachineObjectOU setting under the [Identification] section of the Sysprep.inf file in the guest is updated to match the host. 0 = false; 1 = true.

          0 = false: The MachineObjectOU setting in the Sysprep.inf file is not updated to match the settings on the host.

          1 = true: The MachineObjectOU setting in the Sysprep.inf file is updated to match the settings on the host.

          SetRegionalSettingsEnabled

          DWORD

          Default=0

          Configures whether the settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host. 0 = false; 1 = true.

          -
          -Note

          By default, the setting for TimeZone in the guest is always synchronized with the TimeZone setting in the host.

          -
          -
          - -

          0 = false: The settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are not updated to match the host.

          1 = true: The settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host.

          SetUserDataEnabled

          DWORD

          Default=0

          Configures whether the FullName and the OrgName settings under the [UserData] section of the Sysprep.inf file in the guest are updated to match the settings on the host. 0 = false; 1 = true.

          0 = false: The FullName and OrgName settings in the Sysprep.inf file are not updated to match the settings on the host.

          1 = true: The FullName and OrgName settings in the Sysprep.inf file are updated to match the settings on the host.

          StartDialogMsg

          MULTI_SZ

          Message is found in resource file

          Customizable message that is displayed to the end user when first time setup is ready to start.

          TaskCancelTimeout

          DWORD

          Default=30

          The time-out value, in seconds, that first time setup waits for a response from the virtual machine for a Cancel operation. Range = 0 to 2147483647.

          TaskVMTurnOffTimeout

          DWORD

          Default=60

          The time-out value, in seconds, that first time setup waits for the virtual machine to shut down. Range = 0 to 2147483647.

          UpgradeTimeout

          DWORD

          Default=600

          The time, in seconds, before an attempted upgrade of the MED-V Guest Agent software times out. Range = 0 to 2147483647.

          - - - -## UserExperience Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\UserExperience key and the HKEY\_CURRENT\_USER\\Software\\Microsoft\\Medv\\v2\\UserExperience key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameTypeData/DefaultDescription

          AppPublishingEnabled

          DWORD

          Default=1

          Configures whether application publication from the guest to the host is enabled. 0 = false; 1 = true.

          0 = false: Disables application publishing from the guest to the host.

          1 = true: Enables application publishing from the guest to the host.

          AudioSharingEnabled

          DWORD

          Default=1

          Configures whether the sharing of the audio I/O device between the guest and the host is enabled. 0 = false; 1 = true.

          0 = false: Disables the sharing of the audio I/O device between the guest and the host.

          1 = true: Enables the sharing of the audio I/O device between the guest and the host.

          ClipboardSharingEnabled

          DWORD

          Default=1

          Configures whether the sharing of the Clipboard between the guest and the host is enabled. 0 = false; 1 = true.

          0 = false: Disables the sharing of the Clipboard between the guest and the host.

          1 = true: Enables the sharing of the Clipboard between the guest and the host.

          DialogTimeout

          DWORD

          Default=300

          The time, in seconds, before the first time setup Start Dialog times out. Range = 0 to 2147483647.

          HideVmTimeout

          DWORD

          Default=30

          The time-out value, in minutes, that the full-screen virtual machine window is hidden from the end user during a long logon attempt.

          LogonStartEnabled

          DWORD

          Default=1

          Configures whether the guest should be started when the end user logs on to the desktop or when the first guest application is started. 0 = false; 1 = true.

          0 = false: The guest is started when the first guest application is started.

          1 = true: The guest is started when the end user logs on to the desktop.

          PrinterSharingEnabled

          DWORD

          Default=1

          Configures whether the sharing of printers between the guest and the host is enabled. 0 = false; 1 = true.

          0 = false: Disables the sharing of printers between the guest and the host.

          1 = true: Enables the sharing of printers between the guest and the host.

          RebootAbsoluteDelayTimeout

          DWORD

          Default=1440

          The time-out value, in minutes, that first time setup waits for a restart. Range = 0 to 2147483647.

          RedirectUrls

          MULTI_SZ

          Specified URL list

          Specifies a list of URLs to be redirected from the host to the guest.

          SmartCardLogonEnabled

          DWORD

          Default=0

          Configures whether smart cards can be used to authenticate users to MED-V. 0 = false; 1 = true.

          0 = false: Does not let Smart Cards authenticate end users to MED-V.

          1 = true: Lets Smart Cards authenticate end users to MED-V.

          -
          -Important

          If SmartCardLogonEnabled and CredentialCacheEnabled are both enabled, SmartCardLogonEnabled overrides CredentialCacheEnabled.

          -
          -
          - -

          SmartCardSharingEnabled

          DWORD

          Default=1

          Configures whether the sharing of Smart Cards between the guest and the host is enabled. 0 = false; 1 = true.

          0 = false: Disables the sharing of Smart Cards between the guest and the host.

          1 = true: Enables the sharing of Smart Cards between the guest and the host.

          USBDeviceSharingEnabled

          DWORD

          Default=1

          Configures whether the sharing of USB devices between the guest and the host is enabled. 0 = false; 1 = true.

          0 = false: Disables the sharing of USB devices between the guest and the host.

          1 = true: Enables the sharing of USB devices between the guest and the host.

          - - - -## VM Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\VM key and the HKEY\_CURRENT\_USER\\Software\\Microsoft\\Medv\\v2\\VM key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          NameTypeData/DefaultDescription

          CloseAction

          SZ

          Default=HIBERNATE

          The action that the virtual machine performs after the last application that is running is closed. This setting is ignored if the LogonStartEnabled value is enabled. Possible options are as follows:

          HIBERNATE . This option releases all physical resources that the virtual machine is using, such as memory and CPU, and saves the state of all running applications and operations.

          SHUTDOWN . This option shuts down the guest operating system safely and then releases all physical resources that the virtual machine is using, such as memory and CPU.

          TURN-OFF. This option can cause data loss because it is the same as turning off the power button or pulling out the power cord on a physical computer. Use this option only if you cannot use one of the other two options.

          GuestMemFromHostMem

          MULTI_SZ

          378, 512, 1024, 1536, 2048

          A list of memory (MB) values for the guest. This value is used to determine how much RAM is available to the guest. Combined with HostMemToGuestMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 128 to 3712.

          GuestUpdateDuration

          DWORD

          Default=240

          The number of minutes that MED-V should keep the guest awake for automatic updating, starting at the time specified in the GuestUpdateTime value. Range = 0 to 1440. Setting this value to zero (0) disables the guest patching functionality.

          -

          For more information about guest patching for automatic updating, see Managing Automatic Updates for MED-V Workspaces.

          GuestUpdateTime

          SZ

          Default=00:00

          The hour and minute each day when MED-V should wake up the guest for automatic updating, by using the 24-hour clock standard. Specify the time in the format HH:MM

          -

          For more information about guest patching for automatic updating, see Managing Automatic Updates for MED-V Workspaces.

          HostMemToGuestMem

          MULTI_SZ

          1024, 2048, 4096, 8192, 16384

          A list of memory (MB) values for the guest, determined by the RAM available on the host. Combined with GuestMemFromHostMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 1024 to 16384.

          HostMemToGuestMemCalcEnabled

          DWORD

          Default=1

          Configures whether the memory allocated for the guest is calculated from the memory present on the host. 0 = false; 1 = true.

          0 = false: The memory allocated for the guest is not calculated from the memory present on the host.

          1 = true: The memory allocated for the guest is calculated from the memory present on the host.

          Memory

          DWORD

          Default=512

          The RAM (MB) that should be allocated for the guest virtual machine. This setting is ignored if the HostMemToGuestMemEnabled setting is enabled. Range=128 to 2048.

          MultiUserEnabled

          DWORD

          Default=0

          Configures whether multiple users share the same MED-V workspace. 0 = false; 1 = true.

          0 = false: Multiple users do not share the same MED-V workspace.

          1 = true: Multiple users share the same MED-V workspace.

          NetworkingMode

          SZ

          Default=NAT

          The kind of network connection used on the guest. Possible values are as follows:

          Bridged. MED-V has its own network address, typically obtained through DHCP.

          NAT. MED-V uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.

          TaskTimeout

          DWORD

          Default=600

          A general time-out value, in seconds, that MED-V waits for a task to be completed, such as restarting and shutting down. Range = 0 to 2147483647.

          - - - -## Guest Registry Settings - - -This section lists the configurable MED-V guest registry keys and explains their uses. - -### v2 - -The following table provides information about the guest registry value associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\ key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
          Name Type Data/Default Description

          EnableGPWorkarounds

          DWORD

          Default=1

          Configures how MED-V handles the keys BufferPolicyReads and GroupPolicyMinTransferRate.

          By default, MED-V sets these keys as follows:

          -

          BufferPolicyReads=1 and GroupPolicyMinTransferRate=0.

          -

          Create the EnableGPWorkarounds key, if it is necessary, and set the key to zero if you do not want MED-V to change the default settings of BufferPolicyReads and GroupPolicyMinTransferRate.

          -
          -Note

          If your MED-V workspace is running in NAT mode, EnableGPWorkarounds affects the registry keys BufferPolicyReads and GroupPolicyMinTransferRate. If your MED-V workspace is running in BRIDGED mode, EnableGPWorkarounds only affects the registry key BufferPolicyReads.

          -
          -
          - -
          -

          1=true: MED-V sets the keys BufferPolicyReads=1 and GroupPolicyMinTransferRate=0 (if running in NAT mode) or just BufferPolicyReads=1 (if running in BRIDGED mode).

          -

          0=false: MED-V does not make any changes to the keys BufferPolicyReads and GroupPolicyMinTransferRate.

          - - - -## Related topics - - -[Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) - -[Manage MED-V URL Redirection](manage-med-v-url-redirection.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md deleted file mode 100644 index 58f9226ff5..0000000000 --- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Managing MED-V Workspace Settings by Using a WMI -description: Managing MED-V Workspace Settings by Using a WMI -author: levinec -ms.assetid: 05a665a3-2309-46c1-babb-a3e3bbb0b1f9 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing MED-V Workspace Settings by Using a WMI - - -You can use Windows Management Instrumentation (WMI) in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 to manage your current configuration settings. - -## To manage MED-V workspace settings with a WMI - - -A WMI browsing tool lets you view and edit the settings in a MED-V workspace. The WMI provider is implemented by using the WMI Provider Extension framework from the Microsoft .Net Framework 3.5. - -The WMI provider is implemented in the **root\\microsoft\\medv** namespace and implements the class **Setting**. The class **Setting** contains properties that correspond to the settings in the system registry under the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv registry key. - -**Caution**   -WMI browsing tools can be used to delete or modify classes and instances. Deleting or modifying certain classes and instances can result in the loss of valuable data and cause MED-V to function unpredictably. - - - -You can use your preferred WMI browsing tool to view and edit MED-V configuration settings by following these steps. - -1. Open your preferred WMI browsing tool with administrator permissions. - -2. Connect to the namespace **root\\microsoft\\medv**. - -3. Enumerate the instances to connect to the running instance. You want to connect to the instance of the class **Setting**. - - An **Object Editor** window opens. The MED-V configuration settings are listed as **Properties**. - -Perform the following steps to edit a MED-V configuration setting in the WMI. - -1. In the list of **Properties** on the **Object Editor** window, double-click the name of the configuration setting you want to edit. For example, to edit MED-V URL redirection information, double-click the property **UxRedirectUrls**. - - A **Property Editor** window opens. - -2. Edit the value to update the configuration information. For example, to edit MED-V URL redirection information, add or remove a web address in the list. - -3. Save the updated property settings. - -After you have finished viewing or editing MED-V configuration settings, close the WMI browsing tool. - -**Important**   -In some cases, a restart of the MED-V workspace is required for changes to MED-V configuration settings to take effect. - - - -The following code shows the Managed Object Format (MOF) file that defines the **Setting** class. - -``` syntax -[dynamic: ToInstance, provider("TroubleShooting, Version=2.0.392.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"), singleton: DisableOverride ToInstance ToSubClass] -class Setting : ConfigValueProvider -{ - boolean UxSmartCardLogonEnabled = TRUE; - [read] string User; - [implemented] void Clear([in] string propertyName); -}; -``` - -The **Setting** class inherits from the **ConfigValueProvider** class. The following code shows the Managed Object Format (MOF) file that defines the **ConfigValueProvider** class. - -``` syntax -[abstract] -class ConfigValueProvider -{ - [write] string DiagEventLogLevel; - [write] boolean FtsAddUserToAdminGroupEnabled; - [write] string FtsComputerNameMask; - [write] sint32 FtsDeleteVMStateTimeout; - [write] sint32 FtsDetachVfdTimeout; - [write] string FtsDialogUrl; - [write] sint32 FtsExplorerTimeout; - [write] string FtsFailureDialogMsg; - [write] string FtsLogFilePaths[]; - [write] sint32 FtsMaxPostponeTime; - [write] sint32 FtsMaxRetryCount; - [write] string FtsMode; - [write] sint32 FtsNonInteractiveRetryTimeoutInc; - [write] sint32 FtsNonInteractiveTimeout; - [write] string FtsPostponeUtcDateTimeLimit; - [write] string FtsRetryDialogMsg; - [write] boolean FtsSetComputerNameEnabled; - [write] boolean FtsSetJoinDomainEnabled; - [write] boolean FtsSetMachineObjectOUEnabled; - [write] boolean FtsSetRegionalSettingsEnabled; - [write] boolean FtsSetUserDataEnabled; - [write] string FtsStartDialogMsg; - [write] sint32 FtsTaskCancelTimeout; - [write] sint32 FtsTaskVMTurnOffTimeout; - [write] sint32 FtsUpgradeTimeout; - [write] boolean UxAppPublishingEnabled; - [write] boolean UxAudioSharingEnabled; - [write] boolean UxClipboardSharingEnabled; - [write] boolean UxCredentialCacheEnabled; - [write] sint32 UxDialogTimeout; - [write] sint32 UxHideVmTimeout; - [write] boolean UxLogonStartEnabled; - [write] boolean UxPrinterSharingEnabled; - [write] sint32 UxRebootAbsoluteDelayTimeout; - [write] string UxRedirectUrls[]; - [write] boolean UxShowExit; - [write] boolean UxSmartCardLogonEnabled; - [write] boolean UxSmartCardSharingEnabled; - [write] boolean UxUSBDeviceSharingEnabled; - [write] string VmCloseAction; - [write] sint32 VmGuestMemFromHostMem[]; - [write] sint32 VmGuestUpdateDuration; - [write] string VmGuestUpdateTime; - [write] sint32 VmHostMemToGuestMem[]; - [write] boolean VmHostMemToGuestMemCalcEnabled; - [write] sint32 VmMemory; - [write] boolean VmMultiUserEnabled; - [write] string VmNetworkingMode; - [write] sint32 VmTaskTimeout; -}; -``` - -## Related topics - - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md deleted file mode 100644 index 34e986503c..0000000000 --- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager -description: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager -author: levinec -ms.assetid: e4b2c516-b9f8-44f9-9eae-caac6c2af3e7 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing MED-V Workspace Settings by Using the MED-V Workspace Packager - - -You can use the MED-V Workspace Packager to manage certain settings in the MED-V workspace. - -**To manage settings in a MED-V workspace** - -1. To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**. - -2. On the **MED-V Workspace Packager** main panel, click **Manage Settings**. - -3. In the **Manage Settings** window, you can configure the following MED-V workspace settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Start MED-V workspace

          Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.

          The MED-V workspace starts in one of two ways: either when the end user logs on or when they first perform an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.

          -

          You can either define this setting for the end user or let the end user control how MED-V starts.

          -
          - Note

          If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change the way in which MED-V starts.

          -
          -
          - -

          Networking

          Select Shared or Bridged for your networking setting. The default is Shared.

          Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.

          -

          Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.

          Store credentials

          Choose whether you want to store the end user credentials.

          The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.

          -
          - Important

          Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.

          -

          The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. An attacker could write a program that retrieves the password and thus gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end user credentials.

          -
          -
          - -
          - - - -4. Click **Save as…** to save the updated configuration settings in the specified folder. MED-V creates a registry file that contains the updated settings. Deploy the updated registry file by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - - MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create this updated registry file. - -## Related topics - - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md b/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md deleted file mode 100644 index 66e002ef70..0000000000 --- a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Managing Printers on a MED-V Workspace -description: Managing Printers on a MED-V Workspace -author: levinec -ms.assetid: ba0a65ad-444f-4d18-95eb-8b9fa1a3ffba -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Printers on a MED-V Workspace - - -In Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, printer redirection provides end users with a consistent printing experience between the MED-V virtual machine and the host computer. - -This topic provides information about how to manage printing in a MED-V workspace. - -## Managing Printers in MED-V Workspaces - - -In most cases, MED-V handles printer redirection automatically. After first time setup finishes, MED-V identifies all network printers installed on the host, retrieves the corresponding drivers from the network print server, and if found, installs the relevant drivers in the MED-V workspace. After all drivers are found and installed, MED-V reboots the MED-V workspace. Only after the MED-V workspace restarts, the host printers are present and available on the guest, typically in a few minutes. - -**Note**   -If applications are running on the MED-V workspace, the end user is prompted to let the restart continue or postpone it until later. If no applications are running, the restart is automatic and not shown to the end user. - - - -Every time MED-V is re-started, it checks whether any new printers are installed on the host and, if found, retrieves the corresponding drivers from the network print server and installs them on the guest. MED-V then restarts the MED-V workspace just as when first time setup was completed. - -**Important**   -After the relevant drivers are installed on the guest, the printers only become visible on the guest after the restart occurs. - - - -If at any time a driver cannot be located or installed, it must be manually installed on the guest for the network printer to be available to the end user. - -The following list offers some additional guidance: - -**MED-V only manages network printers**. Drivers for printers that are installed locally on the host are not automatically installed on the guest. - -**MED-V only installs printer drivers if found on the print server**. If not found, printer drivers must be manually installed. - -**Printers manually installed on the guest are not accessible to the host**. By default, MED-V only supports printer redirection from the guest to the host. - -**Warning**   -If a printer is manually installed on the guest, and the same printer is later installed on the host, the result is that the printer is installed two times in the guest. To avoid this situation, a MED-V best practice is to manage printer redirection in one manner only: either disable redirection and install printers manually on the guest, or enable redirection and do not install printers manually on the guest. - - - -## Related topics - - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md deleted file mode 100644 index 94e6dc437e..0000000000 --- a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Managing Software Updates for MED-V Workspaces -description: Managing Software Updates for MED-V Workspaces -author: levinec -ms.assetid: a28d6dcd-cb9f-46ba-8dac-1d990837a3a3 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing Software Updates for MED-V Workspaces - - -You have several different options available to you for providing software updates for the applications in the deployed MED-V workspace. - -**Note**   -For information about how to specify the configuration settings that define how MED-V receives automatic updates, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md). - - - -**Updating Software in a MED-V Workspace** - -1. **Using an Electronic Software Distribution System** - - If your organization uses an Electronic Software Distribution System (ESD) system to deploy software, you can use it to provide software updates for applications on MED-V workspaces just as you provide updates for applications on physical computers. - -2. **Using Group Policy** - - If your organization deploys software by using Group Policy, you can use it to provide software updates for applications on MED-V workspaces just as you provide updates for applications on physical computers. - -3. **Using Application Virtualization (APP-V)** - - If you use MED-V together with App-V, you can provide software updates to applications in the MED-V workspace by following the steps that are required by App-V for updating software. For more information, see [Application Virtualization](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939). - -4. **Updating Software in the Core Image** - - Although not considered a MED-V best practice, you can install software updates to applications on the core image. After you have installed the updates, you can then redeploy the MED-V workspace back out to your enterprise just as you deployed it originally. - - **Important**   - We do not recommend this method of managing software updates. In addition, if you update software in the core image and redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved in the virtual machine is lost. - - - -## Related topics - - -[Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md) - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-best-practices.md b/mdop/medv-v2/med-v-20-best-practices.md deleted file mode 100644 index 6d2adae7e4..0000000000 --- a/mdop/medv-v2/med-v-20-best-practices.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: MED-V 2.0 Best Practices -description: MED-V 2.0 Best Practices -author: levinec -ms.assetid: 47ba2dd1-6c6e-4d6e-8e18-b42291f8e02a -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 2.0 Best Practices - - -When you are planning, deploying, and managing MED-V in your enterprise, you may find the best practice recommendations to be useful. - -### Configure first time setup to run unattended - -Although you can specify any settings that you prefer, a MED-V best practice is that you create the Sysprep.inf file so that first time setup can be run in **Unattended** mode. This requires you to provide all the required settings information as you continue through the **Setup Manager** wizard. For more information about how to configure the MED-V image, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -### Disable restore points on the virtual machine - -Before you create the MED-V workspace package, we recommend that you disable restore points on the virtual machine to prevent the differencing disk from growing unbounded. For more information, see [How to turn off and turn on System Restore in Windows XP](https://go.microsoft.com/fwlink/?LinkId=195927) (https://go.microsoft.com/fwlink/?LinkId=195927). - -### Configure MED-V image to use local profiles - -We recommend that you apply only those policies that make sense in an application compatibility environment for Windows XP. For example, desktop customization policies do not typically have to be applied and should be disabled. For more information about how to allow only local profiles, see [Group Policy Settings for Roaming User Profiles](https://go.microsoft.com/fwlink/?LinkId=205072) (https://go.microsoft.com/fwlink/?LinkId=205072). - -### Configure a Group Policy performance update - -By default, Group Policy is downloaded to a computer one byte at a time. This causes delays when MED-V is being joined to the domain. To increase the performance of Group Policy, we recommend that you set the following registry key value to the registry: - -Registry subkey: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon - -Entry: BufferPolicyReads - -Type: DWORD - -Value: 1 - -### Distribute legal notice through Group Policy instead of in the MED-V image - -If you want end users to see a service level agreement (SLA) before they access MED-V, we recommend that you enforce the SLA through Group Policy later so that the SLA is displayed to the end user after the first time setup is finished. - -**Caution**   -Even though a best practice is to run first time setup in **Unattended** mode, if you decide to set the local policy or registry entry to include an SLA in your image (virtual hard disk), you must also specify that first time setup is run in **Attended** mode, or first time setup can fail. - - - -### Compact the virtual hard disk - -We recommend that you compact your virtual hard disk to reclaim empty disk space and reduce the size of the virtual hard disk. For more information about how to compact your virtual hard disk, see [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md). - -### Configure virtual machine to restart on blue screen crash - -We recommend that you configure the MED-V workspace virtual machine to automatically restart when it encounters a blue screen crash. To configure this setting in the guest, set the AutoReboot value in the HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CrashControl key to “1”. - -You can also configure this setting by clicking **Start**, clicking **Control Panel**, and then clicking **System**. Then, in the **Startup and Recovery** area of the **Advanced** tab, click **Settings**. Select the **Automatically restart** check box and click **OK**. - -### Back up MED-V image before sealing it - -We recommend that you create a backup copy of the MED-V image before you seal it. For more information about sealing your MED-V image, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -### Install Windows Virtual PC last when installing from a batch file - -When you install the MED-V components by using a batch file, specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This ensures that Windows Update will not cause any interference with the installation process by requiring a restart. - -### Install MED-V workspace from local folder - -Because of problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. - -### Manage printer redirection in one manner only - -If a printer is manually installed on the MED-V guest virtual machine, and the same printer is later installed on the host computer, the result is that it is installed two times in the guest. To avoid this situation, we recommend as MED-V best practice that you manage printer redirection in one manner only: either disable redirection and install printers manually on the guest, or enable redirection and do not install printers manually on the guest. - -### Configure settings for MED-V guest patching - -You can control when and for how long the MED-V virtual machine awakens to receive automatic updates by defining the relevant configuration values in the registry. A MED-V best practice is to set your wake-up interval to match the time when you have scheduled regular updates for MED-V virtual machines. In addition, we recommend that you configure these settings to resemble the host computer’s behavior. - -For more information about how to configure settings for MED-V guest patching, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md). - -### Configure antivirus/backup software - -To prevent antivirus activity from affecting the performance of the virtual desktop, we recommend that when you can, you exclude the following virtual machine file types from any antivirus or backup process that is running on the MED-V host computer: - -- \*.VMC - -- \*.VUD - -- \*.VSV - -- \*.VHD - -## Related topics - - -[Security and Protection for MED-V](security-and-protection-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-deployment-overview.md b/mdop/medv-v2/med-v-20-deployment-overview.md deleted file mode 100644 index aecc8e0691..0000000000 --- a/mdop/medv-v2/med-v-20-deployment-overview.md +++ /dev/null @@ -1,166 +0,0 @@ ---- -title: MED-V 2.0 Deployment Overview -description: MED-V 2.0 Deployment Overview -author: levinec -ms.assetid: 0b8998ea-c46f-4c81-a304-f380b2ed7cf8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 2.0 Deployment Overview - - -This section provides general information and instructions about how to install and deploy Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Overview - - -MED-V 2.0 is based on an application model, where the same methods that you use to deploy applications can be used to deploy and manage MED-V. A deployed MED-V solution includes two components: the MED-V Host Agent and Guest Agent. The MED-V Host Agent is installed on the Windows 7 desktop and the MED-V Guest Agent is installed on Windows XP inside the MED-V workspace. MED-V also includes a MED-V Workspace Packager that provides the information and tools necessary for creating and configuring MED-V workspaces. - -**Important** -MED-V only supports the installation of the MED-V Workspace Packager, the MED-V Host Agent, and the MED-V workspace for all users. Installing MED-V for the current user only by selecting **ALLUSERS=””** causes failures in the installation of the components and in the setup of the MED-V workspace. - - - -### The MED-V Installation Files - -MED-V includes the following installation files, required for running MED-V: - -**The MED-V Host Agent Installation File** - -The Host Agent installation file is named MED-V\_HostAgent\_Setup.exe. This file is distributed and installed on each relevant end-user computer as part of your enterprise-wide deployment of MED-V. - -**The MED-V Workspace Packager Installation File** - -The MED-V Workspace Packager installation file is named MED-V\_WorkspacePackager\_Setup.exe. Use this file to install the MED-V Workspace Packager on a computer where you have administrator rights and permissions. The desktop administrator uses the MED-V Workspace Packager to create and manage MED-V workspaces. - -**Note** -The MED-V Guest Agent is installed automatically during first time setup. - - - -### The MED-V Deployment Process - -The following is a high-level overview of the MED-V installation and deployment process: - -1. Install the MED-V Workspace Packager on the computer where you have administrative credentials and that you will be using to build the MED-V workspace packages. For more information, see [How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md). - -2. Prepare your MED-V image and create your MED-V workspace packages by using the MED-V Workspace Packager. For more information, see [Operations for MED-V](operations-for-med-v.md). - -3. Deploy the required MED-V components throughout your enterprise. The required components of MED-V are Windows Virtual PC, the MED-V Host Agent, and the MED-V workspace. - -**Important** -Installation of the MED-V components requires administrative credentials. If an end user is installing MED-V, they are prompted to enter administrative credentials. Alternately, administrative credentials can be provided in context if you are installing by using an electronic software distribution (ESD) system. - - - -### The MED-V Components - -The MED-V components that you deploy throughout your enterprise consist of the following: - -**Windows Virtual PC** - -MED-V functions inside Windows Virtual PC images for its compatibility solution. Windows Virtual PC and the update for Windows 7 (KB977206) are required. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - -**The MED-V Host Agent Installation File** - -MED-V\_HostAgent\_Setup.exe. - -**The MED-V Workspace Installation Files** - -The MED-V workspace installation files are created when you build your MED-V workspace package that consists of the following: - -A setup.exe executable program that executes the MED-V workspace installation - -A <MED-V\_workspace\_name>.msi installer - -A <VHD\_filename>.medv file, which is the compressed virtual hard disk - -The files for configuration settings (<workspace\_name>.reg and <workspace\_name>.ps1) - -To deploy MED-V, copy all the required installation files to the host computer or to a share that can be accessed by the host computer. Run the component installation files for Windows Virtual PC, the MED-V Host Agent, and the MED-V workspace. Then start the MED-V Host Agent to complete the first time setup of MED-V. - -You can perform the installation manually. However, we recommend that you use an electronic software distribution method to automate the deployment of the components. For more information, see [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md). - -**Note** -For information about available command-line arguments to control install options, see [Command-Line Options for MED-V Installation Files](command-line-options-for-med-v-installation-files.md). - - - -## Deployment Steps - - -When you deploy MED-V throughout your enterprise, there are two main considerations: installation and first time setup. - -### Installation - -1. **Windows Virtual PC** - During installation, MED-V checks for Windows Virtual PC and its required update for Windows 7 (KB977206). For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - You can install these as part of the Windows 7 installations before you install MED-V, or you can install them as part of the MED-V distribution. However, MED-V does not include a mechanism for their deployment; they must be deployed by using an electronic software distribution (ESD) system or as part of the Windows 7 image. - - **Important** - When you install the MED-V components by using a batch file, a best practice is to specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This means that Windows Update will not cause any interference with the installation process by requiring a restart. - - - -~~~ -**Note** -After you install Windows Virtual PC, the computer must be restarted. -~~~ - - - -2. **MED-V Host Agent** – Install the MED-V Host Agent on the Windows 7 computer where MED-V will be run. This must be installed before installing the MED-V workspace and checks to make sure that Windows Virtual PC is installed. - -3. **MED-V workspace** – You create the files that are required in this installation by using the MED-V Workspace Packager: the setup.exe, .medv, and .msi files. To install the MED-V workspace, run setup.exe; this triggers the other files as required. The installation places an entry in the registry under the local machine run key to start the MED-V Host Agent, which always runs MED-V when Windows is started. - - **Important** - The installation of the MED-V workspace can be run interactively by the end user or silently through an electronic software distribution system. Installation of the MED-V workspace requires administrative credentials, so end users must be administrators of their computers to install the MED-V workspace. Alternately, an electronic software distribution system typically runs in the system context and has sufficient permissions. - - - -~~~ -**Tip** -Because of problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. -~~~ - - - -### First Time Setup - -After MED-V and its required components are installed, MED-V must be configured. The configuration of MED-V is known as first time setup. By using the **MED-V Workspace Packager**, you can configure first time setup to run silently or interactively. First time setup of MED-V requires end users to enter their password to authenticate to the MED-V workspace, but otherwise can be almost invisible to the user. Notifications are shown in the notification area, such as when first time setup is complete and applications are ready. The following are the actions that occur during first time setup of MED-V: - -1. The virtual hard disk must be configured. Mini-Setup runs and expands the Windows XP image. Typically, this occurs in a hidden window, but MED-V can be configured to display during this configuration. - -2. After Mini-Setup finishes, you can run commands that you must have for additional configuration, such as installing ESD software or other applications, or configuring the image. These can be called in the Sysprep.inf file, but are not required there. For more information, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -3. Ftscompletion.exe is run as the last step in configuration. This process completes the MED-V configuration, adds the user to the RDP group to let them access the MED-V workspace, copies logs, signals MED-V that the MED-V workspace is ready, and then restarts the MED-V workspace. This process can also add the user as an administrator of the MED-V workspace if this was configured when the MED-V workspace was created. Ftscompletion.exe is typically called through the Sysprep,inf file but can also be run through another method, such as a script. However, Ftscompletion.exe must be the last action that is performed when the workstation is configured. For more information, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -4. After the MED-V workspace is restarted by Ftscompletion.exe, the end user is logged on. If they did not save their password during first time setup, they are prompted for it again. The MED-V workspace is then started and configured for the user. Configuration includes applying Group Policy. - - We recommend that you apply only those policies that make sense in an application compatibility environment for Windows XP. For example, desktop personalization policies do not typically need to be applied and should be disabled. For more information about how to allow only local profiles, see [Group Policy Settings for Roaming User Profiles](https://go.microsoft.com/fwlink/?LinkId=205072) (https://go.microsoft.com/fwlink/?LinkId=205072). - -After first time setup is complete, the end user is notified that the published applications are ready. They are then able to access the applications installed in the MED-V workspace from their **Start** menu. - -## Related topics - - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) - -[Deployment of MED-V](deployment-of-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-release-notes.md b/mdop/medv-v2/med-v-20-release-notes.md deleted file mode 100644 index 959cff985c..0000000000 --- a/mdop/medv-v2/med-v-20-release-notes.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: MED-V 2.0 Release Notes -description: MED-V 2.0 Release Notes -author: levinec -ms.assetid: b8f7d938-566e-434c-b4b8-28b67cdfd0b1 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 2.0 Release Notes - - -Updated: March 10, 2011 - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 platform. These release notes contain information that is required to successfully install MED-V 2.0 and contain information that is not available in the product documentation. If there is a difference between these release notes and other MED-V platform documentation, the latest change should be considered authoritative. These release notes supersede the content included with this product. - -## About the Product Documentation - - -Documentation for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 is distributed with the product and is also located at [Microsoft Enterprise Desktop Virtualization 2.0](https://go.microsoft.com/fwlink/?LinkID=207065) (https://go.microsoft.com/fwlink/?LinkId=207065). - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see [Microsoft Security](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with MED-V 2.0 - - -This section provides the most up-to-date information about issues with the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 platform. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. When it is possible, these issues will be addressed in later releases. - -**Note**   -There are currently no known issues with MED-V 2.0. - - - -## Release Notes Copyright Information - - -This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. This document is confidential and proprietary to Microsoft. It is disclosed and can be used only pursuant to a nondisclosure agreement. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-supported-configurations.md b/mdop/medv-v2/med-v-20-supported-configurations.md deleted file mode 100644 index 082fdcce21..0000000000 --- a/mdop/medv-v2/med-v-20-supported-configurations.md +++ /dev/null @@ -1,242 +0,0 @@ ---- -title: MED-V 2.0 Supported Configurations -description: MED-V 2.0 Supported Configurations -author: levinec -ms.assetid: 88f1d232-aa01-45ab-8da7-d086269250b5 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 2.0 Supported Configurations - - -Your environment may already meet the configuration requirements provided here so that you can install and run Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. We have included requirements including host operating system, disk space, and MED-V workspace requirements. - -## MED-V 2.0 Host Computer Requirements - - -### MED-V 2.0 Host Operating System Requirements - -The following table lists the operating systems that are supported for MED-V 2.0 installation on the host computer. - - ------ - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows 7

          Professional, Enterprise, or Ultimate

          None or SP1

          x86 or x64

          - -  - -The following table lists the minimal RAM required for each operating system supported in MED-V 2.0. - - ---- - - - - - - - - - - - - - - - - -
          Operating SystemMinimum Required RAM

          Windows 7 x86

          2GB

          Windows 7 x64

          2GB

          - -  - -### Minimum Recommended Disk Space - -We recommend a minimum of 10GB of available storage. However, the disk space that is required varies greatly and depends on the number of applications published in the MED-V workspace. - -### MED-V 2.0 Host Configuration - -**.NET Framework Version** - -The .NET Framework 3.5 SP1 version of the Microsoft .NET Framework is required for MED-V 2.0. However, you can install the .NET Framework 4 or later version if the .NET Framework 3.5 is already installed. - -**Virtualization Engine** - -Windows Virtual PC with the hotfix that is described in Microsoft Knowledge Base article 977206 is supported for MED-V 2.0. - -**Internet Browser** - -Windows Internet Explorer 8 and Windows Internet Explorer 9 are supported for MED-V 2.0. - -**Microsoft Server Environments** - -The MED-V Host Agent and the MED-V Workspace Packager are not supported in any server environment. - -## MED-V 2.0 Workspace Requirements - - -### MED-V 2.0 Workspace Operating System Requirements - -The following table lists the operating systems supported for MED-V 2.0 workspaces. - - ------ - - - - - - - - - - - - - - - - -
          Operating SystemEditionService PackSystem Architecture

          Windows XP

          Professional Edition

          SP3

          x86

          - -  - -### MED-V 2.0 Workspace Configuration - -**.NET Framework Version** - -Only the .NET Framework 3.5 SP1 version of the Microsoft .NET Framework is supported for MED-V 2.0 workspace installation. - -**Internet Browser** - -Windows Internet Explorer 6, Windows Internet Explorer 7, Windows Internet Explorer 8, and Windows Internet Explorer 9 are supported for the MED-V 2.0 workspace installation. - -### MED-V 2.0 Workspace Creation - -The virtual hard disk used to build a MED-V 2.0 workspace package must be created by using Windows Virtual PC. - -## MED-V 2.0 Globalization Information - - -### MED-V 2.0 Host Agent Globalization Information - -The following Windows operating system language versions are supported for the MED-V 2.0 Host Agent: - -- French - -- Italian - -- German - -- Spanish - -- Korean - -- Japanese - -- Brazilian Portuguese - -- Russian - -- Chinese Traditional - -- Chinese Simplified - -- Dutch - -- Swedish - -- Danish - -- Finnish - -- Portuguese - -- Norwegian - -- Polish - -- Turkish - -- Hungarian - -- Czech - -- Greek - -- Slovak - -- Slovenian - -### MED-V 2.0 Workspace Packager Globalization Information - -The following Windows operating system language versions are supported for the MED-V 2.0 Workspace Packager: - -- French - -- Italian - -- German - -- Spanish - -- Korean - -- Japanese - -- Brazilian Portuguese - -- Russian - -- Chinese Traditional - -- Chinese Simplified - -## Related topics - - -[Deployment of MED-V](deployment-of-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/med-v-event-log-messages.md b/mdop/medv-v2/med-v-event-log-messages.md deleted file mode 100644 index 337ce6e33e..0000000000 --- a/mdop/medv-v2/med-v-event-log-messages.md +++ /dev/null @@ -1,485 +0,0 @@ ---- -title: MED-V Event Log Messages -description: MED-V Event Log Messages -author: levinec -ms.assetid: 7ba7344d-153b-4cc4-a00a-5d42aee9986b -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Event Log Messages - - -The log files for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 provide detailed information about how to deploy and manage MED-V in your enterprise and help verify functionality or help troubleshoot issues. - -## Event IDs - - -The following are a list of MED-V event IDs to help troubleshoot issues that you might encounter when you deploy or manage MED-V. - -### Fts - -Shows the event IDs for first time setup. - -### Event ID 3066 - -Start virtual machine operation failed. - -**Description** -A potential problem exists with the virtual hard disk (VHD) that you are using to create a MED-V workspace. - -**Solution** -Verify that you can create a virtual machine with the VHD for MED-V and that it can be started. - -### Event ID 3071 - -Virtual machine preparation failed. - -**Description** -A problem occurred with first time setup that might have been caused by many different issues. These include problems with network connectivity. - -**Solution** -Restart the MED-V Host Agent to rerun first time setup. - -### Event ID 3078 - -Virtual machine preparation failed. - -**Description** -A potential problem exists with the VHD that you are using to create a MED-V workspace. - -**Solution** -Verify that you can create a virtual machine with the VHD for MED-V and that it can be started. - -### Event ID 3079 - -Retrying virtual machine preparation. - -**Description** -MED-V is trying to prepare the virtual machine. - -**Solution** -No action is required. Let first time setup finish. - -### Event ID 3080 - -The client was stopped when preparing the virtual machine. - -**Description** -MED-V stops unexpectedly when it tries to prepare the virtual machine. - -**Solution** -Start the MED-V Host Agent and let first time setup complete - -### Event ID 3084 - -Virtual machine is not valid. First time setup needs to be re-run. - -**Description** -The MED-V Host Agent detected a problem with the virtual machine. - -**Solution** -No action is required. Let first time setup finish. - -### Event ID 3099 - -Call to start virtual machine failed. - -**Description** -A potential problem exists with the VHD you are using to create a MED-V workspace. - -**Solution** -Verify that you can create a virtual machine with the VHD for MED-V and that it can be opened. - -### VM Management - -### Event ID 4022 - -VMManagerException Fatal error while issuing command to VM. - -**Description** -The end user tried to exit MED-V by logging off or by shutting down the MED-V host, and the VMTaskTimeout configuration setting was exceeded. - -**Solution** -Restart MED-V. - -### Event ID 4028 - -VM Operation timed out. - -**Description** -The end user tried to exit MED-V by logging off or by shutting down the host, and the VMTaskTimeout configuration setting was exceeded. - -**Solution** -Restart MED-V. - -### Event ID 4038 - -Vmsal posted an error message to the user. - -**Description** -An error message is displayed to the end user stating that MED-V could not start the virtual application. - -**Solution** -If the error is logged two or more times in a row, stop MED-V and connect to the virtual machine by using Windows Virtual PC console and attempt to start the application in Full Screen. - -### Event ID 4040 - -Recycling Additions because TerminalServices is not initialized in the guest. - -**Description** -MED-V rebooted the virtual machine because Remote Desktop Services was not initialized on the virtual machine. - -**Solution** -If the error is logged two or more times in a row, stop MED-V and connect to the virtual machine by using Windows Virtual PC console. - -### Event ID 4042 - -Failed to recycle additions in the guest. - -**Description** -MED-V failed to recycle virtual machine additions on the virtual machine. - -**Solution** -If the error is logged two or more times in a row, stop MED-V and connect to the virtual machine by using Windows Virtual PC console. - -### Event ID 4043 - -Failed to reset expired password in the virtual machine. - -**Description** -The end user did not reset the password in the virtual machine before it expired. As a result, the user might not be able to access network resources or save work. - -**Solution** -Shut down the MED-V guest and restart it. - -### URL Redirection - -### Event ID 5005 - -Couldn’t get VM name from configuration; can’t launch guest browser. - -**Description** -URL Redirection could not obtain the MED-V workspace name from the configuration. As a result, it cannot inform Windows Virtual PC to open the redirected URL in the MED-V workspace browser. - -**Solution** -Ensure that the MED-V workspace name is set and that it matches a virtual machine name in the C:\\Users\\<*user*>\\Virtual Machines directory. The MED-V workspace name is located at HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name. - -For example, if the user is "Matt" and the workspace name is "mattsworkspace", the value of HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name should be "mattsworkspace", and there should be a file that is named C:\\Users\\Matt\\Virtual Machines\\mattsworkspace.vcmx. - -### Event ID 5006 - -Failed to create pipe server. - -**Description** -The URL Redirection service could not create the pipe server to communicate with Internet Explorer. - -**Solution** -Check system event logs for attempts to create a file or resource whose path begins similar to the following: "\\\\.\\pipe\\MEDVUrlRedirectionPipe\_" and ends with the user’s user name and domain name. If this is not present in the event log, restart the computer. - -### ConfigMgr (Guest) - -### Event ID 7001 - -The host network configuration data is not properly formatted. - -**Description** -Either the network configuration received from the host is an incorrectly formatted XML string, or the network information returned from the host cannot be written to an XML document. - -**Solution** -Restart the host computer and the virtual machine. - -### Event ID 7005 - -A change to the host network configuration was detected, but was not able to be applied because the host network configuration data was not properly formatted. - -**Description** -A change to the host network configuration was communicated to the virtual machine, but could not be processed in the virtual machine because of an error. This error could be caused by incorrectly formatted data or the inability to set the information into the Windows Management Instrumentation (WMI) CCMNetworkAdapter instance. - -**Solution** -Restart the host and virtual machine. - -### ConfigMgr (Host) - -### Event ID 8006 - -The virtual machine cannot be found. - -**Description** -Windows Virtual PC 7 cannot locate the virtual machine. The virtual machine might have been deleted, moved, removed, or access was denied. - -**Solution** -Reinstall the virtual machine. - -### Event ID 8008 - -The workstation's network configuration information could not be retrieved. - -**Description** -Network configuration information could not be collected from the MED-V host, most likely because of a system call failure in the .NET Framework. This failure can also occur if the network information returned from the MED-V host cannot be written to an XML document. - -**Solution** -Restart the host workstation. - -### Event ID 8010 - -The network configuration data could not be set in the virtual machine. - -**Description** -The MED-V host network address translation (NAT) could not be communicated to the virtual machine, most likely because the virtual machine is in a bad state or the Windows Virtual PC Additions were not installed or enabled. - -**Solution** -Shut down and restart the virtual machine. In addition, you might have to reinstall the virtual machine. - -### Event ID 8011 - -The network configuration data could not be reset in the virtual machine. - -**Description** -The MED-V host network configuration (BRIDGED) could not be communicated to the virtual machine, most likely because the virtual machine is in a bad state or the Windows Virtual PC Additions were not installed or enabled. - -**Solution** -Shut down and restart the virtual machine. In addition, you might have to reinstall the virtual machine. - -### Printer Redirection - -### Event ID 9001 - -File Permission Error. - -**Description** -The end user is not authorized to access the folder required to open or create the MED-V printer file for reading. - -**Solution** -Verify that the User\\AppData\\ path can be accessed and that the user has permission to read and write to it. For example, if the user is "Matt", the path C:\\Users\\Matt\\AppData\\, and all files therein should have Read and Write permissions. And if it exists, the path C:\\Users\\Matt\\AppData\\Local\\Microsoft\\MEDV\\v2\\ and all files therein should have Read and Write permissions. - -### Event ID 9002 - -File Permission Error. - -**Description** -The end user is not authorized to access the folder required to open or create the MED-V printer file for writing. - -**Solution** -Ensure that the User\\AppData\\ path can be accessed, and that the user has permission to read and write to it. For example, if the user is "Matt", the path C:\\Users\\Matt\\AppData\\ and all files therein should have Read and Write permissions. And if it exists, the path C:\\Users\\Matt\\AppData\\Local\\Microsoft\\MEDV\\v2\\ and all files therein should have Read and Write permissions. - -### Event ID 9004 - -Could not create path for storing MEDV printer files. - -**Description** -The printer redirection service could not access files or create directories required for storing the printer information. - -**Solution** -Verify that the User\\AppData\\ path can be accessed and that the user has permission to read and write to it. For example, if the user is "Matt", the path C:\\Users\\Matt\\AppData\\ and all files therein should have Read and Write permissions. And if it exists, the path C:\\Users\\Matt\\AppData\\Local\\Microsoft\\MEDV\\v2\\ and all files therein should have Read and Write permissions. - -### Event ID 9005 - -Couldn’t get VM name from configuration; cannot launch guest installer. Cannot update MED-V – No host network detected. - -**Description** -The printer redirection service was not able to obtain the MED-V workspace name from the MED-V configuration and cannot inform Windows Virtual PC to start the installer on the MED-V guest. - -**Solution** -Ensure that the MED-V workspace name is set and that it matches a virtual machine name in the C:\\Users\\<*user*>\\Virtual Machines directory. The MED-V workspace name is located at HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name. - -For example, if the user is "Matt" and the workspace name is "mattsworkspace", the value of HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name should be "mattsworkspace" and there should be a file that is named C:\\Users\\Matt\\Virtual Machines\\mattsworkspace.vcmx. - -### Application Publishing - -### Event ID 10015 - -A file system error occurred during the reconcile process. The reconcile process will not process the file <*filename*> but will continue to process any other changes. - -**Description** -An unauthorized access or I/O error occurred when a shortcut was being created or deleted. - -**Solution** -Check that the file path can be accessed and that the user has permissions to create or delete the specified file. - -### Event ID 10021 - -Error <*error\_information*> for file operation <*operation\_name*> on file <*filename*>. - -**Description** -An unauthorized access or I/O error occurred when a shortcut was being created or deleted. - -**Solution** -Check that the file path can be accessed and that the user has permissions to create or delete the specified file. - -### Guest Patching - -### Event ID 11001 - -Guest wakeup task usage message. - -**Description** -MedvHost.exe with the /GuestWakeup option was executed incorrectly, or the command is formatted incorrectly. - -**Solution** -Ensure that the command is executed with the following format: - -Medvhost.exe /GuestWakeup /d:< *duration\_in\_minutes*> /v:”< *workspace\_name*>” where - -<*duration\_in\_minutes*> is the number of minutes that the virtual machine should stay awake (default is 240) and - -<*workspace\_name*> is the name of the virtual machine that should be awakened. - -### Event ID 11002 - -Cannot update MED-V – No host network detected. - -**Description** -Guest patching could not finish because no host network connection was detected. - -**Solution** -Connect the MED-V host to an active network connection before you run guest patching. - -### Event ID 11003 - -Cannot update MED-V – Host not running on A/C powerFailed to create pipe server. - -**Description** -Guest patching could not finish because the host appears to be running on battery power instead of from a power cord. - -**Solution** -Connect the host computer to a power cord before you run guest patching. - -### Client UX - -### Event ID 14003 - -The following tray status message was too long and could not be displayed: <*tray\_status\_message*> - -**Description** -MED-V created an unanticipated string that was too long for the tray tooltip or balloon message. As a result, the displayed message was truncated. - -**Solution** -This is a rare error that can occur when MED-V is randomly creating the tooltip text. There is no solution. - -### Event ID 14004 - -MED-V stopped due to an unhandled exception. - -**Description** -An unhandled exception caused MED-V to stop unexpectedly. - -**Solution** -Restart MED-V. - -### Event ID 14005 - -Server attempted to create mutex but it already existed. - -**Description** -A second instance of MedvHost.exe is stuck in memory. - -**Solution** -Open TaskManager and end all MedvHost.exe processes. - -### Event ID 14006 - -Error modifying or deleting registry value <*registry\_value*>. - -**Description** -MED-V is unable to modify the specified entry in the registry. - -**Solution** -Ensure that you install or uninstall MED-V with administrative credentials. - -### Event ID 14007 - -The file specified (<*filename*>) is not valid. - -**Description** -During install or uninstall, a corrupted temp file was passed to MED-V host. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. - -### Event ID 14008 - -File not found: <*filename*>. - -**Description** -During install or uninstall, a path of a required temp file was not found. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. - -### Event ID 14009 - -Unable to read parameter file <*filename*>. - -**Description** -During the install or uninstall process, MED-V was unable to read a temp file. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. In addition, verify that the user has the necessary rights and permissions to the Temp folder. - -### Event ID 14010 - -Error deserializing parameter file <*filename*>. - -**Description** -During the install or uninstall process, MED-V encountered a corrupted temp file. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. In addition, verify that the user has the necessary rights and permissions to the Temp folder. - -### Event ID 14011 - -Unexpected error deserializing parameter file <*filename*>. - -**Description** -During the install or uninstall process, MED-V encountered a corrupted temp file. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. In addition, verify that the user has the necessary rights and permissions to the Temp folder. - -### Event ID 14012 - -Unexpected error when settings rights on folder <*folder\_name*> for user <*username*>. - -**Description** -An error occurs when MED-V is unable to set rights and permissions on certain folders during installation. - -**Solution** -Check the administrator rights to the following folders: - -@"%ProgramData%\\Microsoft\\Medv\\AllUsers" - -@"%ProgramData%\\Microsoft\\Medv\\MedvLock" - -@"%ProgramData%\\Microsoft\\Medv\\Monitoring" - -### Event ID 14013 - -Unexpected error when creating lock file. - -**Description** -An error occurs when MED-V is unable to create a file in the @"%ProgramData%\\Microsoft\\Medv\\MedvLock" folder during installation. - -**Solution** -Check the administrator rights to the MedvLock folder. - -## Related topics - - -[Troubleshooting MED-V](troubleshooting-med-vmedv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/monitor-med-v-workspaces.md b/mdop/medv-v2/monitor-med-v-workspaces.md deleted file mode 100644 index 39790987a2..0000000000 --- a/mdop/medv-v2/monitor-med-v-workspaces.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Monitor MED-V Workspaces -description: Monitor MED-V Workspaces -author: levinec -ms.assetid: f514afe2-8add-4105-9520-1a491733fa79 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitor MED-V Workspaces - - -This section provides information and contains procedures to help administrators monitor MED-V workspaces. - -## In This Section - - -[Monitoring MED-V Workspace Deployments](monitoring-med-v-workspace-deployments.md) -Describes how to monitor the deployment of MED-V workspaces to determine whether first time setup finished. - -[Detecting Network Changes that Affect MED-V](detecting-network-changes-that-affect-med-v.md) -Describes how to set up your environment to detect those network changes that can affect MED-V. - -## Related topics - - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md b/mdop/medv-v2/monitoring-med-v-workspace-deployments.md deleted file mode 100644 index 5622eb9a9b..0000000000 --- a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Monitoring MED-V Workspace Deployments -description: Monitoring MED-V Workspace Deployments -author: levinec -ms.assetid: 5de0cb06-b8a9-48a5-b8b3-836954295765 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring MED-V Workspace Deployments - - -The monitoring feature in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 lets you run queries on individual MED-V workspaces to determine whether first time setup succeeded throughout your enterprise after the MED-V workspaces are deployed. Monitoring the success of first time setup is important because MED-V is not in a usable state until first time setup has been completed successfully. - -This section provides information and instruction to assist you in monitoring the success or failure of first time setup. - -## To monitor MED-V workspace deployments - - -The monitoring feature consists of a coupled in-process Windows Management Instrumentation (WMI) provider that you can query using WMI Query Language to discover the status of first time setup for all end users on a MED-V workspace. - -The WMI provider is implemented by using the WMI Provider Extension framework from the Microsoft .Net Framework 3.5. The WMI provider executes in the context of LocalService and stores the first time setup state securely under \\ProgramData. - -The WMI provider is implemented in the **root\\microsoft\\medv** namespace and implements the class **FTS\_Status**, which exposes the method **SetFtsState**. MED-V uses **SetFtsState** to set the first time setup state. - -The class contains the following properties. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          PropertyDescription

          Machine

          Read Only property that contains the name of the guest virtual machine provisioned by first time setup. This key contains the name that the guest would have had on first time setup failure.

          StatusCode

          Read Only property that contains zero if first time setup succeeded. Any other value returned equals the event ID for the error that is logged.

          Time

          The UTC time that first time setup completed.

          User

          The user for which first time setup was run.

          - -  - -The following code shows the Managed Object Format (MOF) file that defines the **FTS\_Status** class. - -``` syntax -[dynamic: ToInstance, provider("MedvWmi, Version=2.0.258.0, Culture=neutral, PublicKeyToken=14986c3f172d1c2c")] -class FTS_Status -{ -[read, key] string User; -[read] string Machine; -[read] sint32 StatusCode; -[read] datetime Time; -[static, implemented] void SetFtsState([in] sint32 statusCode, [in] string machine); -}; -``` - -Because your main concern is most likely those MED-V workspaces for which first time setup was not completed successfully, you can write your query to only return those that failed first time setup, for example: - -``` syntax -Select * from FTS_Status where StatusCode != 0 -``` - -In this case, the monitoring feature returns a list of those MED-V workspaces that failed first time setup, which you can use to take the appropriate actions to resolve the failure. - -## Related topics - - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/operations-for-med-v.md b/mdop/medv-v2/operations-for-med-v.md deleted file mode 100644 index 584edcd307..0000000000 --- a/mdop/medv-v2/operations-for-med-v.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for MED-V -description: Operations for MED-V -author: levinec -ms.assetid: 8f3f367d-fa9d-4468-814a-f0495adfaea4 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MED-V - - -The topics in this section provide step-by-step instructions and help you deploy and manage the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 environment and its components. - -## In This Section - - -[End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) -Describes an end-to-end operations scenario for MED-V 2.0. - -[Prepare a MED-V Image](prepare-a-med-v-image.md) -Describes how to create, install, configure, package, and test a Windows Virtual PC image for MED-V 2.0. - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) -Describes how to use the MED-V Workspace Packager to create or modify a MED-V workspace deployment package. - -[Test And Deploy the MED-V Workspace Package](test-and-deploy-the-med-v-workspace-package.md) -Describes how to test and deploy a MED-V workspace deployment package. - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) -Describes how to monitor successful MED-V workspace deployments. - -[Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) -Describes how to manage the applications that are deployed to a MED-V workspace. - -[Manage MED-V URL Redirection](manage-med-v-url-redirection.md) -Describes how to manage URL redirection in a MED-V workspace. - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) -Describes how to manage configuration settings and printers in a MED-V workspace. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/operations-troubleshooting-medv2.md b/mdop/medv-v2/operations-troubleshooting-medv2.md deleted file mode 100644 index a47f2e1541..0000000000 --- a/mdop/medv-v2/operations-troubleshooting-medv2.md +++ /dev/null @@ -1,141 +0,0 @@ ---- -title: Operations Troubleshooting -description: Operations Troubleshooting -author: levinec -ms.assetid: 948d7869-accd-44da-974f-93409234dee7 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Operations Troubleshooting - - -This topic includes information that you can use to help troubleshoot general operational issues in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Troubleshooting Issues in MED-V Operations - - -The following are some issues end users might encounter when they run MED-V and solutions to help troubleshoot these issues: - -**Documentation Redirection Fails**. This issue typically occurs when an end user’s My Documents folder points to a network location. Windows does not support creating a share from another shared folder. When a drive or folder is redirected to the guest, RDP\\Windows Virtual PC creates a share for that folder. Therefore, if the My Documents folder on the host is already pointing to a share, RDP\\Windows Virtual PC cannot create a share of a share. - -Another possible cause of this issue is that the credentials that are required to connect to the network resource might differ from the user’s domain credentials. MED-V might be detecting that documents are redirected on the host, send that information to the guest, and then try to reconnect the network resource. If the user’s credentials do not authenticate, MED-V might stop trying to authenticate. - -**Solution** - -Try one of the following to resolve this issue: - -- Set the user’s root directory inside Active Directory. The guest and host should then connect to the same network resource. - -- Instead of redirecting the My Documents folder to a UNC path, map it to a drive letter (on the host, map a drive that points to the network resource). The My Documents folder can then be set to use the drive letter instead of the UNC path. The guest will then redirect to that same mapped drive as expected. - -- Create a startup script in the guest that redirects the My Documents folder to the network resource and provides additional credentials as needed. - -**URL Redirection Fails**. A URL that you have specified for redirection from the host to the guest is not redirecting as intended or is returning an error message that indicates that the website does not exist. - -**Solution** - -This error can occur when there is a misspelling or incorrect use of characters, such as asterisk (\*), in the URL redirection information. Check the registry value for URL redirection and correct any mistakes. - -The registry key is called `RedirectUrls` and is typically located at: - -Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MEDV\\v2\\UserExperience - -**Icon in Taskbar Misleading**. By default, the icon that appears in an end user’s taskbar for published applications and redirected URLs is the icon for Windows Virtual PC. If an end user is not aware of this default behavior, they can become confused when looking at the taskbar to locate their application. - -**Solution** - -The only way to avoid this default behavior is to change the user settings for the taskbar properties as follows: - -1. Right-click the taskbar and then click **Properties**. - -2. In the **Taskbar and Start Menu Properties** dialog box, click the **Taskbar** tab. - -3. In the drop-down bar for the **Taskbar buttons** box, select **Never combine**. - -4. Click **OK**. - -The expected icons for published applications and redirected URLs are displayed. - -**Warning Issued if Second User Attempts Log on or if Virtual Machine is in Use**. A warning message is issued when a second user logs on to a MED-V workspace while a first user is still running MED-V. The warning is also issued if MED-V is started while the virtual machine is being used, for example, if the virtual machine was started through Windows Virtual PC on the **Start** menu. When the end user accepts the warning message, MED-V shuts down. - -**Solution** - -An end user must verify that all other users are logged off MED-V before they try to log on. This ensures that no other instance of MED-V is running and that Windows Virtual PC is not in control of the virtual machine. - -**Beeps Heard During First Time Setup**. Occasionally, beeps are heard while MED-V is running first time setup. This can be confusing to an end user. The beeps are originating from the virtual machine when it performs certain actions, such as shutting down. - -**Solution** - -You can stop the beep service by specifying the "net stop beep" command at the beginning of each virtual machine start sequence. Or you can disable the beep service by specifying the “sc config beep start= disabled" command. You can specify these commands either before you seal the image or as part of Sysprep. - -**Multiple Network Connections Created for MED-V Workspaces in BRIDGED Mode**. If first time setup is creating a MED-V workspace that is configured for NAT mode, it only creates a single network connection in Windows Virtual PC. However, if first time setup is creating a MED-V workspace that is configured for BRIDGED mode, it creates a separate network connection for each network adapter that is installed in the computer, because MED-V cannot determine which network adapter is active. This also ensures that roaming users always have a network adapter available for wired and wireless connections. - -**Solution** - -None. - -**MED-V Application is Unresponsive for Too Long when Closing**. In some instances, a MED-V application stops responding when it is trying to close. - -**Solution** - -You can specify the length of time that MED-V waits to close unresponsive applications by setting the WaitToKillAppTimeout registry key in the guest virtual machine. For more information, see [How To Increase Shutdown Time So That Processes Can Quit Properly in Windows XP](https://go.microsoft.com/fwlink/?LinkId=206819) (https://go.microsoft.com/fwlink/?LinkId=206819). - -**Renaming a Published Application Shortcut in the Guest Virtual Machine does not Change the Published Name in the Host**. When you publish an application by creating a shortcut and then rename the shortcut in the guest virtual machine, the original application name remains in the host **Start** menu. The program continues to run as expected, however the program will always retain the original name. - -**Solution** - -None. This is a known behavior of Windows Virtual PC. - -**Moving a Shortcut in the Guest Virtual Machine does not Update the Location on the Host Computer Start Menu**. MED-V application shortcuts that are published to the host computer **Start** menu are cataloged in the registry. If you move an application shortcut into a subfolder, the registry is not updated to reflect the change. - -**Solution** - -Follow these steps to change the location of a MED-V application shortcut: - -1. When MED-V is running, open up Windows Explorer on the MED-V guest virtual machine. - -2. Browse to the "%ALLUSERSPROFILE%\\Start Menu\\Programs" directory. - -3. Move the application shortcuts out of the startmenu or programs folders. - -4. After about 30 seconds, validate that the shortcuts are removed from the host computer **Start** menu. - -5. Move the application shortcuts back in to the new program folders under the Start Menu\\Programs directory. - -6. After about 30 seconds, validate that the shortcuts are updated in the host computer **Start** Menu. - -**Published Applications can Time Out after Sitting Idle**. In some cases, published applications will time out if they have sat idle for some time. This situation only occurs if IPsec is enabled and the MED-V workspace is configured for NAT mode. This situation does not occur if running in BRIDGED mode. - -**Solution** - -Disable IPsec when you are running the MED-V workspace in NAT mode. - -**Pinning a Published Application to the Taskbar Bypasses MED-V**. If an end user pins a published application to the taskbar and then closes the application, MED-V is bypassed the next time that the application is opened from the taskbar icon. Instead, the application opens directly in a VMSAL window. - -**Solution** - -Do not pin the applications published in MED-V to the taskbar. - -## Related topics - - -[Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) - -[Deployment Troubleshooting](deployment-troubleshooting.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/overview-of-med-vmedv2.md b/mdop/medv-v2/overview-of-med-vmedv2.md deleted file mode 100644 index 8682b653fc..0000000000 --- a/mdop/medv-v2/overview-of-med-vmedv2.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Overview of MED-V -description: Overview of MED-V -author: levinec -ms.assetid: 393daa9b-2d76-43e1-861a-9d8c00f68cf6 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of MED-V - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 enables the deployment and management of Windows Virtual PC images throughout an enterprise. By providing large-scale deployments of desktops running Windows XP Professional SP3 that are hosted through Windows Virtual PC, MED-V lets businesses upgrade to Windows 7, even though some of their applications might not yet be fully functional or supported. - -This guide helps you understand, deploy, and manage your MED-V environment. By using the information provided in this guide, you can plan for and prepare your MED-V deployment, learn how to monitor and manage MED-V workspaces, and understand how to use MED-V to benefit your IT organization. - -## Key Scenarios for Using MED-V - - -Incompatibility of legacy applications together with new versions of Windows can often delay enterprise upgrades to the latest version of Windows. Testing and migrating applications takes time, and users cannot take advantage of the new capabilities and enhancements offered by the newest operating system. - -By delivering applications in a Windows Virtual PC that is running Windows XP SP3, MED-V removes the barriers to operating system upgrades and lets administrators complete testing and address incompatible applications after the upgrade. - -From the user's perspective, these applications can be accessed from the standard desktop **Start** menu and appear side-by-side with native applications, so there is minimal change to the user experience. - -## Related topics - - -[Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md b/mdop/medv-v2/planning-for-application-operating-system-compatibility.md deleted file mode 100644 index c542d50527..0000000000 --- a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: Planning for Application Operating System Compatibility -description: Planning for Application Operating System Compatibility -author: levinec -ms.assetid: cdb0a7f0-9da4-4562-8277-12972eb0fea8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Application Operating System Compatibility - - -This topic helps determine how to resolve application operating system compatibility issues, and discusses how Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 works as a solution for your organization. - -This topic discusses the business requirements for MED-V and compares MED-V to Windows XP Mode and Microsoft Application Virtualization (App-V): - -- [Business Requirements for MED-V](#bkmk-whenmedv) - -- [Benefits of MED-V versus Windows XP Mode](#bkmk-medvvsxp) - -- [Benefits of MED-V versus App-V](#bkmk-medvvsappv) - -## Business Requirements for MED-V - - -When your company’s IT department is determining whether to upgrade to Windows 7, it must pay attention to its line-of-business applications and web-based line-of-business applications to make certain that these can run on the new operating system. Often, these applications and URLs were created to work specifically with an older version of Windows or Internet Explorer, and problems can occur when trying to use them in the new operating system. Microsoft offers many different methods for handling the various compatibility issues that can occur when you upgrade, such as the Application Compatibility Toolkit (ACT) and the Windows 7 Program Compatibility Assistant. But even after all applications have been tested for compatibility and fixes have been determined, some applications still do not work correctly on Windows 7 or are too costly to resolve. - -By using MED-V, you can run these legacy applications through a Windows Virtual PC environment that is running Windows XP. Because you no longer have to test and validate these problem applications on the new operating system before upgrading, your migration to Windows 7 is much smoother and quicker. - -### Using MED-V Checklist - -Consider MED-V if any of the following scenarios apply to you: - -- You are a large organization (for example, 500 users and more), have an Enterprise Agreement with Microsoft, and plan to upgrade to Windows 7. - -- You have tested your line-of-business applications and have found some that are incompatible with Windows 7. - -- You have resolved the compatibility issues for some of these problem applications by upgrading the application or by using a Microsoft-provided shim, such as the Application Compatibility Toolkit (ACT), but compatibility issues remain for some applications. - -- You have considered App-V as an option for delivering the incompatible applications and have concluded that even after you implement App-V, you still have application operating system compatibility issues that you must address. - -- You have considered Windows XP Mode as a solution and have determined that it is not an efficient option because: - - - You want to be able to deploy virtual images that contain the problem applications to all end users at the same time, instead of individually, and have the virtual images automatically joined to the domain. - - - You have decided it is much more cost effective to manage these legacy applications (that are delivered virtually) and control the Windows Virtual PC settings from a centralized location instead of on each end user’s desktop. - - - You want to be able to update and support the virtual machines in scale instead of per desktop. - - - You want the ability to redirect URLs that run better on an older version of Internet Explorer to the virtual machines and to easily manage URL redirection later. - -- You have determined that it would be more cost effective and helpful to upgrade to Windows 7 as soon as possible and have decided to postpone resolving your remaining application compatibility issues until a later date, knowing that you have a solution available in MED-V. - -## Benefits of MED-V versus Windows XP Mode - - -Windows Virtual PC for Windows 7 lets you run different versions of an operating system at the same time on a single device and is included in Windows 7 Professional Edition and higher. - -Windows XP Mode functionality takes advantage of Windows Virtual PC by providing a preconfigured Windows XP image that lets you create a virtual Windows XP environment. In this virtual environment, you can manually install applications that are incompatible with Windows 7 and that run seamlessly from your desktop through Windows Virtual PC. - -**By using Windows XP Mode, you can do the following:** - -- Run applications that are compatible with Windows XP inside a virtual machine that runs in Windows Virtual PC. - -- Publish these applications to the host’s desktop or Program menu. - -When you want to deliver these virtual machines on a large scale as part of an enterprise migration to Windows 7, you must be able to deploy the virtual machines quickly, provision, and customize them efficiently, control their settings, and support them easily. - -MED-V builds upon Windows XP Mode to deliver enterprise-wide application compatibility. Whereas Windows XP mode is limited to providing virtual application functionality to individuals and small businesses, MED-V allows for large-scale deployments of preconfigured Windows XP images throughout your corporate network. It gives you an enterprise-ready management solution for the configuration, deployment, and maintenance of these virtual MED-V workspaces. MED-V also gives enterprise administrators a set of policies to control image use. This includes which users will have access to which specific applications within these images. - -**By using MED-V, you can do the following:** - -- Upgrade to your new operating system without having to test and resolve every incompatible application and URL. - -- Deploy virtual Windows XP images that are automatically domain-joined and customized per user. - -- Provision applications and URL redirection information to users. - -- Control the Windows Virtual PC settings. - -- Maintain and support endpoints through monitoring and troubleshooting. - -- Ensure that guest computers are patched, even if in a suspended state. - -- Automate per-user virtual machine creation and sysprep initialization. - -- Easily diagnose issues on the host and guest computers. - -- Seamlessly manage guest computers that are connected through Windows Virtual PC NAT mode. - -## Benefits of MED-V versus App-V - - -MED-V and App-V are two very different technologies that can easily work together to solve your application operating system compatibility issues. By using App-V, you create an individualized package for each application, each of which is then kept separate from the others. Each virtual application can then be immediately delivered to the end user, which is very useful for a Windows 7 deployment strategy. - -MED-V does not handle applications individually. Instead, it creates an additional instance of Windows XP on the same desktop that is running Windows 7. You can install as many applications as necessary into this virtual image and manage the image just as you would any other desktop in your organization. - -In addition, you can use MED-V together with App-V so that virtual applications that are sequenced through App-V are installed, published, and managed by using MED-V. - -## Related topics - - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/planning-for-med-v.md b/mdop/medv-v2/planning-for-med-v.md deleted file mode 100644 index ae3cd69ad0..0000000000 --- a/mdop/medv-v2/planning-for-med-v.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Planning for MED-V -description: Planning for MED-V -author: levinec -ms.assetid: 8124b765-6930-4607-8bd9-93068403c7a2 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MED-V - - -The topics in this section help you plan and design your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 deployment. - -## In This Section - - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) -Provides planning guidance for end-to-end deployment scenarios. - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) -Describes how to define the project scope by defining the end users, determining the MED-V images to be managed, and determining the organization’s service level expectations. - -[MED-V 2.0 Best Practices](med-v-20-best-practices.md) -Provides guidance for planning your deployment following MED-V 2.0 best practices. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/prepare-a-med-v-image.md b/mdop/medv-v2/prepare-a-med-v-image.md deleted file mode 100644 index da36437444..0000000000 --- a/mdop/medv-v2/prepare-a-med-v-image.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Prepare a MED-V Image -description: Prepare a MED-V Image -author: levinec -ms.assetid: 1bc757e5-8aef-4163-8542-1bdccc028961 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Prepare a MED-V Image - - -To deploy a Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 image to multiple computers, you must first prepare the image for deployment. - -This section provides information about the steps that are required to prepare a MED-V image for deployment. - -## In This Section - - -[Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md) -Describes how to create and configure a Windows Virtual PC image for MED-V. This includes installing Windows XP on the image with the required updates and integration components. - -[Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) -Describes the process of installing applications on your MED-V image. - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) -Describes how to configure and package a Windows Virtual PC image for MED-V by using Sysprep. - -## Related topics - - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md b/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md deleted file mode 100644 index 1ed2801a3b..0000000000 --- a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Prepare the Deployment Environment for MED-V -description: Prepare the Deployment Environment for MED-V -author: levinec -ms.assetid: d15ea370-7fdb-4852-a1ba-730ec7568e3e -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Prepare the Deployment Environment for MED-V - - -This section provides information about preparing your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 deployment environment. - -## In This Section - - -[Configure Environment Prerequisites](configure-environment-prerequisites.md) -Describes the prerequisites that are required as part of the MED-V 2.0 environment. - -[Configure Installation Prerequisites](configure-installation-prerequisites.md) -Describes the prerequisites that are required before you install MED-V 2.0. - -## Related topics - - -[Example MED-V System Installation Checklist](example-med-v-system-installation-checklist.md) - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md b/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md deleted file mode 100644 index 1127851da2..0000000000 --- a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Restarting and Resetting a MED-V Workspace -description: Restarting and Resetting a MED-V Workspace -author: levinec -ms.assetid: a959cdb3-a727-47c7-967e-e58f224e74de -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restarting and Resetting a MED-V Workspace - - -During troubleshooting, you may sometimes find it necessary to restart or reset the MED-V workspace. Restarting the MED-V workspace is basically the same as restarting a physical computer. Resetting the MED-V workspace reruns first time setup and deletes all data that is stored in the virtual machine. Because all stored data is deleted, you typically should only reset the MED-V workspace to resolve the most serious troubleshooting issues, or to restore a previously working MED-V workspace back to a working state. - -For information about how to open the MED-V Administration Toolkit, see [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md). - -**Restarting a MED-V Workspace** - -1. On the **MED-V Administration Toolkit** window, click **Restart MED-V Workspace**. A dialog window opens in which you must confirm that you want to restart the MED-V workspace. - -2. Click **Restart**. - - Any published applications that are running or redirected web sites that are open will be closed when the MED-V workspace restarts. - -**Resetting a MED-V Workspace** - -1. On the **MED-V Administration Toolkit** window, click **Reset MED-V Workspace**. A dialog window opens in which you must confirm that you want to reset the MED-V workspace. - - **Warning**   - Resetting the MED-V workspace causes first time setup to run again, and thus reloads the original virtual hard disk. All data that is stored in the MED-V workspace since first time setup was originally run will be deleted. - - - -2. Click **Reset**. - - Any published applications that are running or redirected web sites that are open will be closed when the MED-V workspace resets. - -## Related topics - - -[Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) - -[Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/security-and-protection-for-med-v.md b/mdop/medv-v2/security-and-protection-for-med-v.md deleted file mode 100644 index d4ccad2f97..0000000000 --- a/mdop/medv-v2/security-and-protection-for-med-v.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Security and Protection for MED-V -description: Security and Protection for MED-V -author: levinec -ms.assetid: 5db66d56-eb65-4bff-a9e4-3d52de4256bd -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Protection for MED-V - - -The following section contains best practices that we recommend for running Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 in a secure configuration. - -## In This Section - - -[Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) -Describes best practices to follow to help maintain security when preparing, building, testing, deploying, and managing MED-V workspaces. - -[Authentication of MED-V End Users](authentication-of-med-v-end-users.md) -Describes best practices to follow to help maintain security when verifying the identity of MED-V end users. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/security-best-practices-for-med-v-operations.md b/mdop/medv-v2/security-best-practices-for-med-v-operations.md deleted file mode 100644 index bd23d54f15..0000000000 --- a/mdop/medv-v2/security-best-practices-for-med-v-operations.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Security Best Practices for MED-V Operations -description: Security Best Practices for MED-V Operations -author: levinec -ms.assetid: 231e2b9a-8b49-42fe-93b5-2ef12fe17bac -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security Best Practices for MED-V Operations - - -As an authorized administrator, you are responsible to protect the information of the users and maintain security of your organization during and after the deployment of MED-V workspaces. In particular, consider the following issues. - -**Customizing Internet Explorer in the MED-V workspace**. Earlier versions of the Windows operating system and of Internet Explorer are not as secure as current versions. Therefore, Internet Explorer in the MED-V workspace is configured to prevent browsing and other activities that can pose security risks. In addition, the Internet security zone setting for Internet Explorer in the MED-V workspace is set to the highest level. By default, both of these configurations are set in the MED-V Workspace Packager when you create your MED-V workspace package. - -By using Internet Explorer Administration Kit (IEAK) or by changing the defaults in the MED-V Workspace Packager, you can customize Internet Explorer in the MED-V workspace. However, realize that if you customize Internet Explorer in the MED-V workspace in such a way as to make it less secure, you can expose your organization to those security risks that are present in older versions of Internet Explorer. - -From a security perspective, best practices for managing Internet Explorer in the MED-V workspace are as follows: - -- When creating your MED-V workspace package, leave the defaults set so that Internet Explorer in the MED-V workspace is configured to prevent browsing and other activities that can pose security risks. - -- When creating your MED-V workspace package, leave the defaults set so that the security setting for the Internet security zone remains at the highest level. - -- Configure your enterprise proxy or Internet Explorer Content Advisor to block domains that are outside your company’s intranet. - -**Configuring a MED-V workspace for all users on a shared computer.** When configuring a MED-V workspace so that it can be accessed by all users on a shared computer, realize that the guest virtual machine (VHD) is put in a location that gives Read and Write access to all users on that system. - -**Configuring a proxy account for domain joining.** When configuring a proxy account for joining virtual machines to the domain, you must know that it is possible for an end user to obtain the proxy account credentials. Thus, necessary precautions must be taken, such as limiting account user rights, to prevent an end user from using the credentials for causing harm. - -**Sysprep Configuration.** Although the Sysprep.inf file is encrypted by default, its contents can be decrypted and read by any determined end user who can successfully log on to the virtual machine. This raises security concerns because the Sysprep.inf file can contain credentials in addition to a Windows product key. - -You can lessen this risk by setting up a limited account for joining virtual machines to the domain and specifying the credentials for that account when configuring Sysprep. Alternately, you can also configure Sysprep and first time setup to run in **Attended** mode and require end users to provide their credentials for joining the virtual machine to the domain. - -A MED-V best practice is to specify that FtsCompletion.exe is run under an account that gives the end user rights to connect to the guest through the Remote Desktop Connection (RDC) Client. - -**End-user authentication.** Enabling the caching of end-user credentials provides the best user experience of MED-V, but creates the potential that someone could gain access to the end user’s credentials. The only way to lessen this risk is by specifying on the **MED-V Workspace Packager** that end-user credentials are not stored. For more information about authentication of end users, see [Authentication of MED-V End Users](authentication-of-med-v-end-users.md). - -## Related topics - - -[Operations Troubleshooting](operations-troubleshooting-medv2.md) - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/technical-reference-for-med-v.md b/mdop/medv-v2/technical-reference-for-med-v.md deleted file mode 100644 index e9f819cd55..0000000000 --- a/mdop/medv-v2/technical-reference-for-med-v.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Technical Reference for MED-V -description: Technical Reference for MED-V -author: levinec -ms.assetid: 52aa15ae-6ca8-4494-8660-313c7b723406 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Technical Reference for MED-V - - -The technical reference information we provide here includes example checklists for planning, deployment, and operations for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[Command-Line Options for MED-V Installation Files](command-line-options-for-med-v-installation-files.md) -Provides a list and description of the options that you can specify when you install or uninstall MED-V at the command prompt. - -[Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md) -Describes the steps to follow to compact your virtual hard disk before you configure your Windows XP image for use with MED-V. - -[MED-V Event Log Messages](med-v-event-log-messages.md) -Describes how to use the event logs in MED-V to troubleshoot deployment and operations issues. - -[Updating MED-V 2.0](updating-med-v-20.md) -Provides information about how to upgrade your MED-V installation. - -[Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md) -Describes how to specify certain installed applications that you do not want published to the host computer. - -[MED-V 2 Configuration Cmdlets](https://go.microsoft.com/fwlink/?LinkId=213301) -Provides information about cmdlets you can use to perform various MED-V configuration tasks from the command line. - -[MED-V 2 Workspace Cmdlets](https://go.microsoft.com/fwlink/?LinkId=213302) -Provides information about cmdlets you can use to perform various MED-V workspace configuration tasks from the command line. - -[Example MED-V Checklists](example-med-v-checklists.md) -Provides several checklist examples that you can reference when planning, deploying, or managing MED-V. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -[Security and Protection for MED-V](security-and-protection-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md b/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md deleted file mode 100644 index 1997d4910d..0000000000 --- a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Test And Deploy the MED-V Workspace Package -description: Test And Deploy the MED-V Workspace Package -author: levinec -ms.assetid: 0238dea7-a08c-4859-b8b1-2b52bc63fda6 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Test And Deploy the MED-V Workspace Package - - -This section provides information and instructions for testing and deploying your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 image. - -## In This Section - - -[Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) -Provides instructions and guidance for testing the MED-V workspace installer package. - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) -Provides general information about how to deploy MED-V workspaces. - -  - -  - - - - - diff --git a/mdop/medv-v2/testing-the-med-v-workspace-package.md b/mdop/medv-v2/testing-the-med-v-workspace-package.md deleted file mode 100644 index f28b7e1b9b..0000000000 --- a/mdop/medv-v2/testing-the-med-v-workspace-package.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Testing the MED-V Workspace Package -description: Testing the MED-V Workspace Package -author: levinec -ms.assetid: 83edcb6e-9615-4d18-96b8-f085a647294e -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Testing the MED-V Workspace Package - - -After you have created your MED-V workspace deployment package, you can test the package locally before deploying it throughout your enterprise. The topics in this section provide some steps and instructions to help you test your MED-V workspace deployment package. - -## In This Section - - -[How to Create a Test Environment](how-to-create-a-test-environment.md) -Provides information about how to create a test environment, either manually or by using an electronic software distribution (ESD) system. - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) -Provides information and guidance for testing your first time setup settings. - -[How to Test URL Redirection](how-to-test-url-redirection.md) -Provides information and guidance for testing your URL redirection settings. - -[How to Test Application Publishing](how-to-test-application-publishing.md) -Provides information and guidance for testing application publishing. - -  - -  - - - - - diff --git a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md b/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md deleted file mode 100644 index 737042b22b..0000000000 --- a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Troubleshooting MED-V by Using the Administration Toolkit -description: Troubleshooting MED-V by Using the Administration Toolkit -author: levinec -ms.assetid: 6c096a1c-b9ce-4ec7-8dfd-5286e3b9a617 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting MED-V by Using the Administration Toolkit - - -Use the MED-V Administration Toolkit to troubleshoot certain problems in a MED-V workspace. The MED-V Administration Toolkit lets you access and configure event logs, restart or reset the MED-V workspace, and view the published applications and redirected web addresses in the MED-V workspace. You can also use the MED-V Administration Toolkit to open the MED-V workspace virtual machine in full-screen mode. - -## To Open the MED-V Administration Toolkit - - -Perform the following steps to open the MED-V Administration Toolkit: - -1. On the host computer that contains the MED-V workspace you are troubleshooting, open a Command Prompt window. - -2. Browse to %systemdrive%\\Program Files\\Microsoft Enterprise Desktop Virtualization. - -3. At the command prompt, type **MedvHost /toolkit**. - -After the MED-V Administration Toolkit opens, you can use the toolkit to help resolve issues in the MED-V workspace found during troubleshooting. - -## In this Section - - -[Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) -Describes how to use the MED-V Administration Toolkit to collect and manage MED-V event logs in the host computer and the guest virtual machine. - -[Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) -Describes how to restart and reset MED-V workspaces by using the MED-V Administration Toolkit. - -[Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) -Describes how to use the MED-V Administration Toolkit to view the published applications and redirected web addresses in a MED-V workspace and how to open the MED-V workspace virtual machine in full-screen mode. - -## Related topics - - -[MED-V Event Log Messages](med-v-event-log-messages.md) - -[Troubleshooting MED-V](troubleshooting-med-vmedv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/troubleshooting-med-vmedv2.md b/mdop/medv-v2/troubleshooting-med-vmedv2.md deleted file mode 100644 index 0418c22024..0000000000 --- a/mdop/medv-v2/troubleshooting-med-vmedv2.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Troubleshooting MED-V -description: Troubleshooting MED-V -author: levinec -ms.assetid: 4502d62b-a7db-4f83-81e2-23fd8b0820e1 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting MED-V - - -You can use the information provided here to help you troubleshoot issues in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[Deployment Troubleshooting](deployment-troubleshooting.md) -Describes how to troubleshoot deployment issues in your MED-V environment. - -[Operations Troubleshooting](operations-troubleshooting-medv2.md) -Describes how to troubleshoot common issues that can occur during the operation of MED-V. - -[Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md) -Describes how to access and use the MED-V Administration Toolkit to troubleshoot deployment and operations issues. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/updating-med-v-20.md b/mdop/medv-v2/updating-med-v-20.md deleted file mode 100644 index 5b5c16d8a6..0000000000 --- a/mdop/medv-v2/updating-med-v-20.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Updating MED-V 2.0 -description: Updating MED-V 2.0 -author: levinec -ms.assetid: beea2f54-42d7-4a17-98e0-d243a8562265 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Updating MED-V 2.0 - - -Help secure your system by applying the appropriate security updates for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Updating MED-V - - -You can update MED-V interactively, by the end user, or silently by using an electronic software distribution system. Installation of the MED-V Host Agent upgrades the MED-V Host Agent and then updates the MED-V workspace if required. The MED-V Host Agent and Guest Agent keep in sync. If applications are running from the MED-V workspace while the MED-V Host Agent is being updated, a restart of the host computer is required to complete the update. If no applications are running, MED-V is restarted automatically and the upgrade is completed without a restart of the host computer. - -If you are updating MED-V by using an electronic software distribution system, you can control the restart behavior. To do this, suppress the restart by typing **REBOOT=”ReallySuppress”** at the command prompt when installing MED-V\_HostAgent\_Setup.exe. Then, configure the electronic software distribution system to capture the 3010 return code (which signals that a restart is required) and perform the set restart behavior. - -## Related topics - - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md b/mdop/medv-v2/viewing-and-configuring-med-v-logs.md deleted file mode 100644 index e0444fb438..0000000000 --- a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Viewing and Configuring MED-V Logs -description: Viewing and Configuring MED-V Logs -author: levinec -ms.assetid: a15537ce-981d-4f55-9c3c-e7fbf94b8fe5 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing and Configuring MED-V Logs - - -When you are troubleshooting MED-V issues and problems, you may find it helpful or necessary to access the MED-V event logs. You can open Event Viewer for the host computer and the guest virtual machine by using the MED-V Administration Toolkit. You can also use the MED-V Administration Toolkit to set the logging level at which the MED-V event logs report MED-V events. - -For information about how to open the MED-V Administration Toolkit, see [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md). - -## Viewing MED-V Event Logs - - -On the **MED-V Administration Toolkit** window, click **Host Events** to open the event viewer for the host computer. Or, click **Guest Events** to open Event Viewer for the guest virtual machine. - -Event Viewer opens and displays the corresponding event logs that you can use to troubleshoot the issues that you might encounter when you deploy or manage MED-V. By default, only errors and warnings are displayed. For more information about specific event IDs and messages, see [MED-V Event Log Messages](med-v-event-log-messages.md). - -**Note**   -End users can only save event log files in the guest if they have administrative permissions. - - - -### To manually open the Event Viewer in the host computer - -1. Click **Start**, click **Control Panel**, and then click **Administrative Tools**. - -2. Double-click **Event Viewer**, and then click **Applications and Services Logs**. - -3. Double-click **MEDV**. - -## Configuring MED-V Event Logs - - -You can specify the MED-V event logging level by selecting the corresponding option button on the MED-V Administration Toolkit. You can decide whether event logging includes errors only, errors and warnings, or errors, warnings and informational messages. The event logging level specified is set for both the host computer and the guest virtual machine. - -You can also specify the event logging level by editing the EventLogLevel registry value. For more information, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md). - -**Note**   -The level you specify on the **MED-V Administration Toolkit** window applies to future MED-V event logging. If you set the level to capture all errors, warnings, and informational messages, then the event logs fill more quickly and older events are removed. - - - -## Related topics - - -[Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) - -[Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/viewing-med-v-workspace-configurations.md b/mdop/medv-v2/viewing-med-v-workspace-configurations.md deleted file mode 100644 index 8df18d9a30..0000000000 --- a/mdop/medv-v2/viewing-med-v-workspace-configurations.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Viewing MED-V Workspace Configurations -description: Viewing MED-V Workspace Configurations -author: levinec -ms.assetid: 5de6cf04-6beb-4ac9-ad52-26ac8c0c8ce6 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing MED-V Workspace Configurations - - -When you are troubleshooting MED-V issues and problems, you can use the MED-V Administration Toolkit to view the published applications and redirected web addresses in the MED-V workspace. You can also use the MED-V Administration Toolkit to open the MED-V workspace in full-screen mode. - -For information about how to open the MED-V Administration Toolkit, see [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md). - -## Viewing MED-V Published Applications - - -On the **MED-V Administration Toolkit** window, click **View Published Applications**. - -The **MED-V Workspace Published Applications** window opens and displays a list of the applications that were published in the MED-V workspace. You can use this information to troubleshoot certain issues, such as determining whether an application was published as expected. - -For information about how to publish applications to the MED-V workspace, see [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md). - -## Viewing MED-V Redirected Web Addresses - - -On the **MED-V Administration Toolkit** window, click **View Redirected Web Addresses**. - -The **Web Addresses Redirected to the MED-V Workspace** window opens and displays a list of the redirected web addresses specified for the MED-V workspace. You can use this information to troubleshoot certain issues, such as determining whether a web address was specified correctly for redirection. - -For information about how to manage web addresses redirection in the MED-V workspace, see [How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md). - -## Opening the MED-V Workspace Virtual Machine - - -On the **MED-V Administration Toolkit** window, click **View MED-V Workspace Full Screen**. - -MED-V closes if it was running, and the MED-V workspace virtual machine opens in full-screen mode. You can use this full-screen window to easily access all the components of the virtual machine that might be helpful in troubleshooting, such as its hard disk and settings files. - -## Related topics - - -[Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) - -[Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/whats-new-in-med-v-20.md b/mdop/medv-v2/whats-new-in-med-v-20.md deleted file mode 100644 index 70f277ff9c..0000000000 --- a/mdop/medv-v2/whats-new-in-med-v-20.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: What's New in MED-V 2.0 -description: What's New in MED-V 2.0 -author: levinec -ms.assetid: 53b10bff-2b6f-463b-bdc2-5edc56526792 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in MED-V 2.0 - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 has evolved the application compatibility support for Windows 7 and removed functionality that is not required for this scenario. For example, features such as encryption of the MED-V workspace, the centralized MED-V server, and MED-V workspace trim transfer have been removed. - -## Changes in Standard Functionality - - -This section discusses the key areas where MED-V 2.0 functionality has changed. - -### MED-V Workspace Creation - -The virtual hard disk used for the MED-V workspace is now created in Windows Virtual PC. The methods that are used to create the MED-V workspace include installing Windows XP SP3, updating the operating system, and preparing it to be managed through software management infrastructure. - -The offline management and trim transfer functionality were removed, in addition to the proprietary MED-V workspace encryption and compression functionality. When you create a MED-V workspace, an administrator should prepare and configure appropriate applications and management tools in the image instead of using the virtual machine preparation tool that is provided in MED-V 1.0. - -Running Sysprep on the MED-V image is now required and validated during the packaging of the MED-V workspace. The MED-V Workspace Packager provides a graphical user interface (GUI) that guides the administrator through the packaging process. The console from MED-V 1.0 was removed together with the functionality of managing images, managing MED-V workspace profiles, and the requirement to stage and encrypt MED-V workspaces. - -### MED-V Workspace Deployment - -To deploy a MED-V workspace, an administrator is now able to take advantage of their electronic software distribution tools. The client-pull method available in MED-V 1.0 was removed and the MED-V workspace is now delivered by using methods outside MED-V. Administrators can treat MED-V workspaces as they would any other application package and can schedule deployments and installations of MED-V by using their existing tools and processes. MED-V installations can be deployed silently and can easily be managed inside an existing software distribution infrastructure. - -### MED-V Workspace Management - -The MED-V workspace in MED-V 2.0 is based on a Windows Virtual PC virtual hard disk. MED-V has extended the capabilities that Windows Virtual PC provides by improving the seamless experience without requiring encryption or special tools to access the MED-V workspace. - -After MED-V is deployed to a workstation, the MED-V workspace can be opened in full-screen mode by using Windows Virtual PC. This new functionality removed the requirement for policies that set a preference for seamless or full-screen modes and also removed the need to force full-screen for diagnostics and troubleshooting. - -Publishing applications to the MED-V workspace is no longer performed with profiles and by manually entering the path to applications. Instead, it occurs automatically as applications are installed on the guest. The central image repository that included versions of the images that were delivered through trim transfer is removed. Instead, MED-V enables administrators to manage the MED-V workspace as they would a physical computer, by letting applications and updates be distributed without the complexity of a dedicated MED-V infrastructure. - -## Changes in MED-V Features - - -Several key areas of MED-V 2.0 reflect improvements or additions to the following features. - -### MED-V Workspace Creation - -MED-V workspaces must be created by using Windows Virtual PC. Existing Virtual PC 2007 images must be migrated. The virtual machine Prep tool is not included in MED-V 2.0 and administrators should configure, update, and optimize their images according to the MED-V 2.0 Help file. Running Sysprep on the MED-V image is a required step and must be performed before packaging. - -### MED-V Workspace Packaging - -Windows PowerShell is the foundation of the MED-V Workspace Packager. This functionality replaces some former console abilities and functionality that managed centralized functions of MED-V. The MED-V Workspace Packager merely packages the virtual hard disk with the appropriate settings and image so that it can be easily deployed by administrators. Advanced features are provided by using Windows PowerShell. - -### MED-V Workspace Distribution - -Dedicated server infrastructure is no longer required for MED-V 2.0 and the client pull method to deploy MED-V workspaces was removed. MED-V workspaces are now deployed using your electronic software distribution infrastructure and can be stored on common shares that are used for other installation packages. - -### First Time Setup - -The first time setup process is now integrated with the standard imaging convention of Sysprep. The MED-V workspace first time setup process can dynamically apply settings specified in the MED-V Workspace Packager to the image as it begins Mini-Setup. The scripting tool in the console was removed and the first time setup process is now based on options that are configured in the MED-V Workspace Packager by the administrator. - -### Application Publishing - -Administrators can install applications on the MED-V image either before packaging, after the MED-V workspace is deployed, or by using a combination of both. MED-V no longer examines MED-V workspace policy to publish applications, but instead refers to what is actually installed on the guest. As applications are installed on the guest, they are automatically detected and published to the host **Start** menu and are ready to be started by the end user. - -### URL Redirection - -MED-V 2.0 provides seamless host-to-guest web address redirection based on the policies configured and managed by the administrator. After a URL is redirected to the guest browser, the default experience is to attempt to limit the user to that redirected site. This minimizes the browsing activities that a user can perform that are not intended by the administrator. Guest-to-host browser redirection was removed. - -### Troubleshooting - -MED-V now takes advantage of standard host-based processes for troubleshooting. Because the MED-V workspace is no longer encrypted, it can be opened in full-screen mode within the Windows Virtual PC console, where it can be viewed and worked with as a standard workstation. In addition, the logs are no longer encrypted locally and logged centrally. MED-V now makes extensive use of the local event logs, and the logging level of the output, from informational to debug levels, can be easily configured. Finally, a troubleshooting toolkit is now provided so administrators and helpdesk personnel can have a graphical, aggregated view of all the troubleshooting options, and they can effortlessly select the activities that most suit their needs. - -MED-V is no longer run as a system service. Instead, it is run as user-owned processes, and it only runs when a user is logged on. Functionality that was formerly provided by the system-owned service is now provided in the user-side processes. - -## Related topics - - -[Deployment of MED-V](deployment-of-med-v.md) - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md b/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md deleted file mode 100644 index 2d91d0e163..0000000000 --- a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Windows Virtual PC Application Exclude List -description: Windows Virtual PC Application Exclude List -author: levinec -ms.assetid: 7715f198-f5ed-421e-8740-0cec2ca4ece3 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/28/2017 ---- - - -# Windows Virtual PC Application Exclude List - - -In some instances, you might not want applications that are installed in the MED-V workspace to be published to the host computer **Start** menu. You can unpublish these applications by following the instructions at [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md). However, if the program ever automatically updates, it might also be automatically republished. This causes you to have to unpublish the application again. - -Windows Virtual PC includes a feature known as the "Exclude List" that lets you specify certain installed applications that you do not want published to the host **Start** menu. The "Exclude List" is located in the guest registry in the HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Virtual Machine\\VPCVAppExcludeList key and lists those applications that are not published to the host **Start** menu. You can think of the “Exclude List” as permanently unpublishing the specified applications because any automatic updates to the applications that are listed will not cause them to be automatically republished. - -## Managing Applications by Using the Exclude List in Windows Virtual PC - - -**** - -1. Open the MED-V workspace in full screen. - - For information about opening the MED-V workspace in full-screen mode by using the MED-V Administration Toolkit, see [Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md#bkmk-fullscreen). Or you can manually open it in full screen by clicking **Start**, click **All Programs**, click **Windows Virtual PC**, click **Windows Virtual PC**, and then double-click the MED-V workspace. - -2. In the MED-V workspace Windows Virtual PC window, open Registry Editor. - - Click **Start**, click **Run**, and then type regedit. Then click **OK**. - -3. In Registry Editor, locate the HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Virtual Machine\\VPCVAppExcludeList registry key. - -4. Create a new registry value for the installed application that you do not want published to the host computer **Start** menu. For example, if you want to unpublish the automatically published program Microsoft Silverlight, follow these steps: - - 1. With the VPCVAppExcludeList registry key highlighted, click **Edit**, click **New**, and then click **String Value**. - - 2. Enter the name for the new registry value. For example, for Microsoft Silverlight, you might enter sllauncher.exe. - - 3. Double-click the new registry value and enter the value data. - - The value data is the full path for the command that you want to unpublish. You can find the full path by right-clicking on the shortcut on the **Start** menu for the application that you do not want published and then clicking **Properties**. The full path is listed in the **Shortcut** tab under **Target**. - - For example, for the program Microsoft Silverlight, the full path might be "C:\\Program Files\\Microsoft Silverlight\\4.0.50917.0\\Silverlight.Configuration.exe." - - **Important**   - If applicable, remove the quotation marks from the full path when you enter it into the value data field. - - - -5. Close Registry Editor and restart the MED-V workspace virtual machine. - - The application is still installed in the MED-V workspace but is now removed from the host computer **Start** menu. - -You can also republish an excluded application to the host **Start** menu by deleting the corresponding value from the VPCVAppExcludeList key. For example, to republish Microsoft Silverlight, right-click the registry value sllauncher.exe and select **Delete**. - -## Related topics - - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) - - - - - - - - - diff --git a/mdop/softgrid-application-virtualization.md b/mdop/softgrid-application-virtualization.md deleted file mode 100644 index a7950b25d2..0000000000 --- a/mdop/softgrid-application-virtualization.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: SoftGrid Application Virtualization -description: SoftGrid Application Virtualization -author: eavena -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 -ms.reviewer: -manager: dansimp -ms.author: eravena ---- - -# SoftGrid Application Virtualization - -Selecting the link for [SoftGrid Application Virtualization documentation](https://technet.microsoft.com/library/bb906040.aspx) will take you to another website. Use your browser's **Back** button to return to this page. diff --git a/mdop/solutions/TOC.md b/mdop/solutions/TOC.md deleted file mode 100644 index dcd2d78a28..0000000000 --- a/mdop/solutions/TOC.md +++ /dev/null @@ -1,7 +0,0 @@ -# [MDOP Solutions and Scenarios](index.md) -## [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md) -## [Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0](virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md) -## [Creating App-V 4.5 Databases Using SQL Scripting](creating-app-v-45-databases-using-sql-scripting.md) -## [Application Publishing and Client Interaction for App-V 5](application-publishing-and-client-interaction-for-app-v-5-solutions.md) -## [How to Download and Deploy MDOP Group Policy (.admx) Templates](how-to-download-and-deploy-mdop-group-policy--admx--templates.md) - diff --git a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md b/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md deleted file mode 100644 index 3f173b9548..0000000000 --- a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Publishing and Client Interaction for App-V 5 -description: Application Publishing and Client Interaction for App-V 5 -author: levinec -ms.assetid: 9854afdc-00f9-40ec-8275-d168e5151286 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Publishing and Client Interaction for App-V 5 - - -This article has been moved to [Application Publishing and Client Interaction](../appv-v5/application-publishing-and-client-interaction.md) in the App-V 5.0 library. - -The article describes how the following App-V client operations affect the local operating system: - -- App-V Files and Data Storage Locations - -- Package Registry - -- App-V Package Store Behavior - -- Roaming Registry and Data - -- App -V Client Application Lifecycle Management - -- Integration of App-V Packages - -- Dynamic Configuration - -- Side by Side Assemblies - -- Client Logging - -  - -  - - - - - diff --git a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md b/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md deleted file mode 100644 index 747c14c3de..0000000000 --- a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md +++ /dev/null @@ -1,258 +0,0 @@ ---- -title: Creating App-V 4.5 Databases Using SQL Scripting -description: Creating App-V 4.5 Databases Using SQL Scripting -author: levinec -ms.assetid: 6cd0b180-163e-463f-a658-939ab9a7cfa1 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating App-V 4.5 Databases Using SQL Scripting - - -**Who is this solution intended for?** Information technology professionals who manage Application Virtualization (App-V) 4.5 databases. - -**How can this guide help you?** This solution explains and documents the procedure to install the Microsoft Application Virtualization Server when the administrator installing does not have “sysadmin” privileges to the SQL Server. - -## Overview - - -One of the challenges of installing Microsoft Application Virtualization 4.5 (App-V) is that the install program assumes that the user installing the server features will not only be a local computer administrator, but also have SQL administrator privileges on the SQL server that will host the Data Store. This requirement is based on the fact that the database, as well as the appropriate roles and permissions, are created as part of the install. However, in most enterprises, SQL servers are managed separately from the infrastructure team who will be installing App-V. These security requirements will make it difficult to get SQL administrators to give the infrastructure administrator installing App-V adequate rights; similarly, the SQL administrators will not have the required privileges to install the product for the infrastructure team. - -Currently, an administrator attempting the installation of App-V must have SQL “sysadmin” privileges. In previous versions of the product the setup allowed for the SQL administrators to either create a temporary “sysadmin” account or be present during installation to provide credentials with “sysadmin” privileges. In this release, scripts are provided in the released product for all administrators to use when implementing their infrastructure. - -This whitepaper discusses the scenario in which the install will need to be divided into two separate tasks: creating the SQL database, and installing the App-V server features. The SQL administrators would be able to review the SQL scripts and make modifications to resolve any conflicts with other databases, or to support integration with other tools. The result of the scripts is to allow SQL administrators to prepare the database so that the infrastructure administrators do not have to be granted any advanced rights on the SQL server. This is important in environments where security policies would prohibit this. - -### SQL Database Creation Process - -The SQL scripts allow for SQL administrators to create the required database and also set up the privileges for the App-V administrators to successfully install and manage the environment. The steps for completing these tasks are listed later in this document. - -This process separates the database creation and configuration actions from the actual App-V installation. - -**Information to be provided to SQL administrators** - -- Name of AD group that is going to be the App-V admin’s - -- Name of the server where App-V Management Server will be installed - -**Information to be returned to the Infrastructure administrators** - -- Name of the database server or instance and the name of the App-V database - -Once the database has been prepared, the App-V administrators can run the App-V installation without SQL administrator privileges. - -### Using the SQL Setup Scripts - -**Requirements** - -The following is a list of requirements for using the scripts which are located in the support\\createdb folder at the root of the selected extract location. - -- Scripts must be copied to a writeable location on the computer where they will be run (be sure to remove the read only attribute from these scripts after they have been copied) and SQL client tools must be loaded on that computer (osql is only required for running the sample batch files on the local computer). - -- The SQL Server must support Windows Authentication. - -- Ensure that the SQL Server Instance and SQL Agent Service are running. - -- Log on with a domain account that is a SQL administrator (sysadmin) on the computer where the scripts will be done. - -The scripts runs under the logged-on user’s domain credentials. - -**Database Creation Using SQL Scripts** - -**Tasks to be performed by SQL administrators:** - -1. Copy the scripts contained in the support\\createdb folder from the root of the selected extract location to the computer where the scripts will be run. The following files are required for the scripts to run properly and must be called in the order presented below. - - - database.sql - - - roles.sql - - - table\_CODES.sql - - - functions\_before\_tables.sql - - - tables.sql - - - functions.sql - - - views.sql - - - procedures.sql - - - triggers.sql - - - data\_codes.sql - - - data\_messages.sql - - - data\_defaults.sql - - - alerts\_jobs.sql - - - dbversion.sql - -2. Review and modify, if necessary, the `database.sql` file. The default settings will name the database “APPVIRTDB.” - - - If necessary replace instances of `APPVIRTDB` with the `database name` that will be used. - - - Modify the `FILENAME` property in the script with the appropriate path for the SQL Server where the database will be created. - -3. Review and modify, if necessary, the `database name [APPVIRTDB]` in the `roles.sql` file that was used in the database.sql file. - -**** - -### Example of how to automate the process using batch files - -If used, the two sample batch files provided run the SQL scripts in the following manner: - -1. **Create\_schema.bat (1)** - - - database.sql - - - roles.sql - -2. **Create\_tables.bat (2)** - - - table\_CODES.sql - - - functions\_before\_tables.sql - - - tables.sql - - - functions.sql - - - views.sql - - - procedures.sql - - - triggers.sql - - - data\_codes.sql - - - data\_messages.sql - - - data\_defaults.sql - - - alerts\_jobs.sql - - - dbversion.sql - -**Note** -Careful consideration when modifying the scripts must be taken and should only be done by someone with the appropriate knowledge. Also, of the sample files presented only the following should be changed: **create\_schema.bat**, **create\_tables.bat**, **database.sql**, and **roles.sql**. All other files should not be modified in any way as this could cause the database to be created incorrectly, which will lead to the failure of App-V services to be installed. - - - -The two sample batch files must be placed in the same directory where the rest of the SQL scripts were copied to on the computer. - -1. Run the sample **create\_schema.bat** file to create the database. This script will take several seconds to complete and should not be interrupted. - - - Run the create schema.bat file from the directory where it was copied to. Syntax is: “Create\_schema.bat `SQLSERVERNAME`” - - ![AppV46SQLcreatebat](images/appv46sqlcreatebat.bmp) - - - If this script fails during the creation of the new “APPVIRTDB” database, check the log as indicated to correct the issue. It will be necessary to delete the database that was created with a partial running of the scripts in order to ensure that subsequent attempts will work properly. - -2. Run the `create_tables.bat` file to create the tables in the database. This script will take several seconds to complete and should not be interrupted. - - - Run the create\_tables.bat file from the directory where it was copied. Syntax is: “create\_tables.bat `SQLSERVERNAME DBNAME`” - - ![app-v 4.6 sql create\-table.bat](images/appv46sqlcreate-tablebat.gif) - - If the script fails during the creation of the tables, check the log as indicated to correct the issue. It will be necessary to delete the database and run create\_schema.bat before attempting to run the create\_tables.bat file on all subsequent attempts. - -### Setting permissions on the App-V database - -The following accounts will need to be created on the SQL server with specific permissions and roles to the new database for the installation, deployment and ongoing administration of the App-V environment. - -- Create a login for the App-V administrators group on the SQL Server and the APPVIRTDB database for the “domain\\App-V Admins” (where “domain” and “App-V Admins” will be changed to reflect your own environment) and add them to the SFTAdmin and SFTEveryone database role. - - ![app-v 4.6 sql script set permissions and roles](images/appv46sqlscriptsetpermsroles.gif) - -- Grant this group “VIEW ANY DEFINITION” permission at the global level (This allows the Microsoft Application Virtualization Management Server setup process to verify that the Management Server login already exists). Under MS-SQL 2005 and above access restrictions to the metadata contained in master.db were added. The user created in the previous step will by default not have the rights needed by the server installation. Open the properties of the previously created login, Login Properties->Securables. Add the Database instance and enable “GRANT” for “View any definition” as shown in the screenshot below. - - ![app-v 4.6 sql script grant perm for view any def](images/appv46sqlscriptviewanydef.gif) - -- Add a role to the ROLE\_ASSIGNMENTS table for the login created in the previous step to allow App-V administrators access to the Application Virtualization Management Console, with role = “ADMIN” and group\_ref = “domain\\App-V Admins” (where “domain” and “App-V Admins” will be changed to reflect your own environment). - - ![app-v 4.6 sql script role assignment](images/appv46sqlscriptroleassign.gif) - -- Create login for SQL Server and App-V database for the Management Server. This account is used by the Microsoft Application Virtualization Management Server to connect to the data store and is responsible for servicing client requests for streamed applications. There are two options, depending on where the SQL Server and Management Server are to be installed: - - 1. If Management Server and SQL Server are going to be installed on the same computer, add a login for NT AUTHORITY\\NETWORK SERVICE and add it to the SFTUser and SFTEveryone database roles. - - 2. If the Management Server and SQL Server are to be installed on different computers, add a login for “domain\\App-V Server Name$” (where “App-V Server Name” is the name of the server where the App-V Management Server will be installed) and add it to the SFTUser and SFTEveryone database roles. - -- Open the query window on the SQL window and run the following SQL: - - ``` syntax - USE APPVIRTDB - GRANT ALTER ON ROLE::SFTuser TO “domain\App-V Admins” - ``` - - Where the APPVIRTDB is the name of the App-V Database created on the SQL Server in the previous step, and the user who is going to do the install of the App-v server needs to be a member of “domain\\App-V Admins” (where “domain” and “App-V Admins” will be changed to reflect your own environment). - -### Tasks to be performed by the Infrastructure administrators - -1. Administrator in the “App-V Admins” group should install App-V. - - Use information from the SQL administrators for selecting the SQL Server and database created in the previous steps. - -2. Administrator in the “App-V Admins” group logs in to Application Virtualization Management Console and deletes the following objects from the Management Console. - - **Warning** - This is required as the traditional setup populates certain records in the database that are not populated if you run the install against an already existing database. Delete the following objects: - - - Under “Server Groups,” “Default Server Group,” delete “Application Virtualization Management Server” - - - Under “Server Groups,” delete “Default Server Group” - - - Under “Provider Policies,” delete “Default Provider” - - - -3. Administrator in the App-V admins group should then create: - - - Under “Provider Policies,” create a New Provider Policy - - - Create a “Default Server Group” - - **Note** - You must create a “Default Server” group even if you will not be used. The server installer only looks for the "Default Server Group" when trying to add the server. If there is no "Default Server Group" then the installation will fail. If you plan on using server groups other than the default that is fine, it’s just necessary to retain the "Default Server Group" if you plan on adding subsequent App-V Management Servers to your infrastructure. - - - -~~~ -- Assign the App-V Users Group to the New Provider Policy created above - -- Under “Server Groups,” create a New Server Group, specifying the New Provider Policy - -- Under the New Server group, create a New Application Virtualization Management Server - - **Important** - Do not restart the service before completing all of the above steps! - - - -- Administrator restarts the Application Virtualization Management Server service. -~~~ - -## Conclusion - - -In conclusion, the information in this document allows an administrator to work with the SQL administrators to develop a deployment path that works for the security and administrative divisions in an organization. After reading this document and testing the tasks documented, an administrator should be ready to implement their App-V infrastructure in this type of environment. - - - - - - - - - diff --git a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md deleted file mode 100644 index bd1795d759..0000000000 --- a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: How to Download and Deploy MDOP Group Policy (.admx) Templates -description: How to Download and Deploy MDOP Group Policy (.admx) Templates -author: levinec -ms.assetid: fdb64505-6c66-4fdf-ad74-a6a161191e3f -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - - -# How to Download and Deploy MDOP Group Policy (.admx) Templates - - -You can manage the feature settings of certain Microsoft Desktop Optimization Pack (MDOP) technologies (for example, App-V, UE-V, or MBAM) by using Group Policy templates, the .admx and .adml files. MDOP Group Policy templates are available for download in a self-extracting, compressed file, grouped by technology and version. - -## MDOP Group Policy templates - -**How to download and deploy the MDOP Group Policy templates** - -1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531) - -2. Expand the downloaded .cab file by running `expand \MDOP_ADMX_Templates.cab -F:* ` - - **Warning** - Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file. - -3. In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings. - -4. Locate the appropriate .adml file by language-culture (that is, *en-us* for English-United States). - -5. Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain. - - - **Local files:** To configure Group Policy settings from the local device, copy template files to the following locations: - - - - - - - - - - - - - - - - - - - - - - -
          File typeFile location

          Group Policy template (.admx)

          %systemroot%<strong>policyDefinitions

          Group Policy language file (.adml)

          %systemroot%<strong>policyDefinitions[MUIculture]

          - - - **Domain central store:** To enable Group Policy settings configuration by a Group Policy administrator from any computer on the domain, copy files to the following locations on the domain controller: - - - - - - - - - - - - - - - - - - - - - - -
          File typeFile location

          Group Policy template (.admx)

          %systemroot%<strong>sysvol\domain\policies\PolicyDefinitions

          Group Policy language file (.adml)

          %systemroot%<strong>sysvol\domain\policies\PolicyDefinitions[MUIculture][MUIculture]

          -

          For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.

          - -6. Edit the Group Policy settings using Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) to configure Group Policy settings for the MDOP technology. - -### MDOP Group Policy by technology - -For more information about supported MDOP Group Policy, see the specific documentation for the technology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          MDOP TechnologyVersion bundlesNotes

          Application Virtualization (App-V)

          App-V 5.0 and App-V 5.0 Service Packs

          How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy

          User Experience Virtualization (UE-V)

          UE-V 2.0 and UE-V 2.1

          Configuring UE-V 2.x with Group Policy Objects

          UE-V 1.0 including 1.0 SP1

          Configuring UE-V with Group Policy Objects

          Microsoft BitLocker Administration and Monitoring (MBAM)

          MBAM 2.5

          Planning for MBAM 2.5 Group Policy Requirements

          MBAM 2.0 including 2.0 SP1

          Planning for MBAM 2.0 Group Policy Requirements

          -

          Deploying MBAM 2.0 Group Policy Objects

          MBAM 1.0

          How to Edit MBAM 1.0 GPO Settings

          - - - - - - - - - - - diff --git a/mdop/solutions/images/appv46sqlcreate-tablebat.gif b/mdop/solutions/images/appv46sqlcreate-tablebat.gif deleted file mode 100644 index da105aa8ee..0000000000 Binary files a/mdop/solutions/images/appv46sqlcreate-tablebat.gif and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlcreatebat.bmp b/mdop/solutions/images/appv46sqlcreatebat.bmp deleted file mode 100644 index 4c71e8ab17..0000000000 Binary files a/mdop/solutions/images/appv46sqlcreatebat.bmp and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlscriptroleassign.gif b/mdop/solutions/images/appv46sqlscriptroleassign.gif deleted file mode 100644 index 58d3090997..0000000000 Binary files a/mdop/solutions/images/appv46sqlscriptroleassign.gif and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlscriptsetpermsroles.gif b/mdop/solutions/images/appv46sqlscriptsetpermsroles.gif deleted file mode 100644 index 18dc004aed..0000000000 Binary files a/mdop/solutions/images/appv46sqlscriptsetpermsroles.gif and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlscriptviewanydef.gif b/mdop/solutions/images/appv46sqlscriptviewanydef.gif deleted file mode 100644 index 682cd43de0..0000000000 Binary files a/mdop/solutions/images/appv46sqlscriptviewanydef.gif and /dev/null differ diff --git a/mdop/solutions/index.md b/mdop/solutions/index.md deleted file mode 100644 index 20c7e2da8e..0000000000 --- a/mdop/solutions/index.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: MDOP Solutions and Scenarios -description: MDOP Solutions and Scenarios -author: dansimp -ms.assetid: 1cb18bef-fbae-4e96-a4f1-90cf111c3b5f -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MDOP Solutions and Scenarios - - -The Solutions for Microsoft Desktop Optimization Pack (MDOP) guide provides documentation that presents example customer scenarios that are solved by using technologies that are part of the MDOP suite. - -## Application Virtualization Solutions - - -- [Deploying Microsoft Office 2013 by Using App-V](../appv-v5/deploying-microsoft-office-2013-by-using-app-v.md) - - This solution explains how to deploy Office 2013 by using App-V 5.0 and includes procedures for customization, upgrading, and licensing for deployment in the enterprise. - -- [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md) - - This solution explains how to deploy Office 2010 by using App-V 5.0. - -- [Creating App-V 4.5 Databases Using SQL Scripting](creating-app-v-45-databases-using-sql-scripting.md) - - This solution explains and documents the procedure to install the Microsoft Application Virtualization Server when the administrator installing does not have “sysadmin” privileges to the SQL Server. - -- [Application Publishing and Client Interaction](../appv-v5/application-publishing-and-client-interaction.md) - - This solution explains and how the App-V Client processes packages and presents them to users. It includes typical client operations with important locations for data storage, how the publishing refresh process works, and the available integration points with the local operating system. - -- [How to Download and Deploy MDOP Group Policy (.admx) Templates](how-to-download-and-deploy-mdop-group-policy--admx--templates.md) - - You can manage the feature settings of certain Microsoft Desktop Optimization Pack (MDOP) technologies (for example, App-V, UE-V, or MBAM) by using Group Policy templates, the .admx and .adml files. MDOP Group Policy templates are available for download in a self-extracting, compressed file, grouped by technology and version. - -  - -  - - - - - diff --git a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md deleted file mode 100644 index 87a025ba59..0000000000 --- a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 -description: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 -author: levinec -ms.assetid: bd16c20f-cc47-4172-ae16-47b23c9b7f5c -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 - - -This article has been moved to the TechNet Application Virtualization (App-V) 5.0 library and renamed to: - -[Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md) - -  - -  - - - - - diff --git a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md deleted file mode 100644 index 33f773621c..0000000000 --- a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 -description: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 -author: levinec -ms.assetid: 742e64de-6ace-4eb4-901a-7a282ca7ae85 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 - - -This article has been moved to the TechNet Application Virtualization (App-V) 5.0 library and renamed to: - -[Deploying Microsoft Office 2013 by Using App-V](../appv-v5/deploying-microsoft-office-2013-by-using-app-v.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/TOC.md b/mdop/uev-v1/TOC.md deleted file mode 100644 index d52629378d..0000000000 --- a/mdop/uev-v1/TOC.md +++ /dev/null @@ -1,43 +0,0 @@ -# [Microsoft User Experience Virtualization (UE-V) 1.0](index.md) -## [Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) -### [About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md) -#### [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md) -### [About User Experience Virtualization 1.0 SP1](about-user-experience-virtualization-10-sp1.md) -#### [Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md) -### [High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md) -### [Accessibility for UE-V](accessibility-for-ue-v.md) -## [Planning for UE-V 1.0](planning-for-ue-v-10.md) -### [Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md) -#### [Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) -### [Planning for UE-V Configuration](planning-for-ue-v-configuration.md) -#### [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) -#### [Checklist for Evaluating Line-of-Business Applications for UE-V 1.0](checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md) -#### [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) -#### [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) -### [UE-V Checklist](ue-v-checklist.md) -## [Deploying UE-V 1.0](deploying-ue-v-10.md) -### [Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) -### [Deploying the UE-V Agent](deploying-the-ue-v-agent.md) -### [Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md) -### [Installing the UE-V Generator](installing-the-ue-v-generator.md) -### [Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md) -### [Deploying UE-V Settings Location Templates for UE-V 1.0](deploying-ue-v-settings-location-templates-for-ue-v-10.md) -## [Operations for UE-V 1.0](operations-for-ue-v-10.md) -### [Administering UE-V 1.0](administering-ue-v-10.md) -#### [Changing the Frequency of UE-V Scheduled Tasks](changing-the-frequency-of-ue-v-scheduled-tasks.md) -#### [Sharing Settings Location Templates with the UE-V Template Gallery](sharing-settings-location-templates-with-the-ue-v-template-gallery.md) -#### [Restoring Application and Windows Settings Synchronized with UE-V 1.0](restoring-application-and-windows-settings-synchronized-with-ue-v-10.md) -#### [Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) -#### [Migrating UE-V Settings Packages](migrating-ue-v-settings-packages.md) -### [Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) -#### [Create UE-V Settings Location Templates with the UE-V Generator](create-ue-v-settings-location-templates-with-the-ue-v-generator.md) -#### [Edit UE-V Settings Location Templates with the UE-V Generator](edit-ue-v-settings-location-templates-with-the-ue-v-generator.md) -#### [Validate UE-V Settings Location Templates with UE-V Generator](validate-ue-v-settings-location-templates-with-ue-v-generator.md) -### [Administering UE-V with PowerShell and WMI](administering-ue-v-with-powershell-and-wmi.md) -#### [Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) -#### [Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI](managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md) -### [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) -#### [UE-V 1.0 Security Considerations](ue-v-10-security-considerations.md) -#### [User Experience Virtualization Privacy Statement](user-experience-virtualization-privacy-statement.md) -## [Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - diff --git a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md b/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md deleted file mode 100644 index b9209ac16f..0000000000 --- a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md +++ /dev/null @@ -1,273 +0,0 @@ ---- -title: About User Experience Virtualization 1.0 SP1 -description: About User Experience Virtualization 1.0 SP1 -author: levinec -ms.assetid: 0212d3fb-e882-476c-9496-9eb52301703d -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About User Experience Virtualization 1.0 SP1 - - -Microsoft User Experience Virtualization (UE-V) 1.0 Service Pack 1 changes the version from 1.0.414 to 1.0.520. When the UE-V Agent setup.exe or UE-V Generator setup.exe is launched it will detect the need for an upgrade and will upgrade the UE-V Agent or Generator. - -## Additional Languages Now Supported - - -UE-V 1.0 Service Pack 1 provides updates for both the UE-V Agent and the UE-V Generator supporting additional languages. All supported languages are installed when the setup program runs. The following languages are included in UE-V 1 SP1: - - ---- - - - - - - - - - - - - -
          UE-V AgentUE-V Generator
            -
          • Chinese Simplified (PRC) zh-CN

          • -
          -
            -
          • Chinese Traditional - Taiwan zh-TW

          • -
          -
            -
          • Czech (Czech Republic) cs-CZ

          • -
          -
            -
          • Danish (Denmark) da-DK

          • -
          -
            -
          • Dutch (Netherlands) nl-NL

          • -
          -
            -
          • Finnish (Finland) fi-FI

          • -
          -
            -
          • French (France) fr-FR

          • -
          -
            -
          • German (Germany) de-DE

          • -
          -
            -
          • Greek (Greece) el-GR

          • -
          -
            -
          • Hungarian (Hungary) hu-HU

          • -
          -
            -
          • Italian (Italy) it-IT

          • -
          -
            -
          • Japanese (Japan) ja-JP

          • -
          -
            -
          • Korean (Korea) ko-KR

          • -
          -
            -
          • Norwegian - Norway Bokmal nb-NO

          • -
          -
            -
          • Polish (Poland) pl-PL

          • -
          -
            -
          • Portuguese (Brazil) pt-BR

          • -
          -
            -
          • Portuguese (Portugal) pt-PT

          • -
          -
            -
          • Russian (Russia) ru-RU

          • -
          -
            -
          • Slovak (Slovakia) sk-SK

          • -
          -
            -
          • Slovenian (Slovenia) sl-SL

          • -
          -
            -
          • Spanish, International Sort (Spain) es-ES

          • -
          -
            -
          • Swedish (Sweden) sv-SE

          • -
          -
            -
          • Turkish (Turkey) tr-TR

          • -
          -

            -
          • Chinese Simplified (PRC) zh-CN

          • -
          -
            -
          • Chinese Traditional - Taiwan zh-TW

          • -
          -
            -
          • French (France) fr-FR

          • -
          -
            -
          • German (Germany) de-DE

          • -
          -
            -
          • Italian (Italy) it-IT

          • -
          -
            -
          • Japanese (Japan) ja-JP

          • -
          -
            -
          • Korean (Korea) ko-KR

          • -
          -
            -
          • Portuguese (Brazil) pt-BR

          • -
          -
            -
          • Russian (Russia) ru-RU

          • -
          -
            -
          • Spanish, International Sort (Spain) es-ES

          • -
          - - - -**Important**   -While the UE-V Agent installation program (AgentSetup.exe) and UE-V Generator installation program (ToolSetup.exe) are translated into the languages above, the Windows Installer (.msi) files are only available in English. - - - -## Office 2007 Settings Location Templates - - -The UE-V Agent installation software installs the agent and registers a default group of settings location templates for common Microsoft applications. Microsoft Office 2007 is now part of these applications. There are two Office 2007 templates: MicrosoftOffice2007.xml and MicrosoftCommunicator2007.xml. These settings location templates capture settings in Microsoft Office 2007 for the following applications: - -- Microsoft Access 2007 - -- Microsoft Communicator 2007 - -- Microsoft Excel 2007 - -- Microsoft InfoPath 2007 - -- Microsoft OneNote 2007 - -- Microsoft Outlook 2007 - -- Microsoft PowerPoint 2007 - -- Microsoft Project 2007 - -- Microsoft Publisher 2007 - -- Microsoft SharePoint Designer 2007 - -- Microsoft Visio 2007 - -- Microsoft Word 2007 - -### Office 2010 Settings Location Templates Updates - -An update to the Settings Location Templates has also been made. Those changes include: - -- Added support for Microsoft SharePoint Designer 2010 by adding a new template to the Office 2010 templates (MicrosoftOffice2010Win32.xml and MicrosoftOffice2010Win64.xml) - -- Minor bug fixes, including Customize Status Bar – Word, Excel, and PowerPoint - -## Scheduled Task for Catalog Updates is now randomized - - -The Template Auto Update task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The Template Auto Update task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent install directory and with UE-V SP1 has been changed to randomize the update over a one hour period. - -## Support for Citrix EdgeSight - - -There was a conflict discovered with UE-V running on a server with Citrix EdgeSight. UE-V 1.0 SP1 resolves this issue. - -## Indexing of Internet Explorer favorites - - -When UE-V roams Internet Explorer favorites from one computer to another computer, the indexing of favorite addresses in the address bar on the synced computer is now updated. When a user types in the address bar, the roamed favorites now appear as available search result on synced computers. - -## New setup.exe command line parameters for UE-V Agent and UE-V Generator - - -With the release of UE-V 1.0 SP1, the setup.exe for both the UE-V Agent and the UE-V Generator have been updated to allow the following additional command line parameters: - -1. `CEIPENABLED` – Allows setup to accept the option to be included in the Microsoft Customer Experience Improvement Program. - -2. `INSTALLFOLDER` – Allows a different installation folder to be set for the Agent or Generator. - -3. `MUENABLED` – Allows setup to accept the option to be included in the Microsoft Update program. - -## New error codes for setup - - -When running the UE-V setup for UE-V Agent (AgentSetup.exe), the following return codes can be viewed in the install log “/log <log.txt>.” - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          0

          Setup completed successfully.

          2

          An older version of UE-V was used in attempting to uninstall. To uninstall UE-V, use the same version of UE-V that was used to install.

          3

          A newer version of UE-V was used to uninstall. To uninstall UE-V, use the same version of UE-V that was used to install.

          4

          Unexpected error from the setup program.

          5

          The Full version of UE-V cannot be installed on top of the Trial (Evaluation) version. Uninstall the Trial version and try again.

          6

          Unexpected error during installation.

          7

          The .NET 3.5 Framework was not found on Windows 7 or Windows Server2008 R2 computer.

          8

          The Offline Files feature is not enabled.

          9

          The UE-V setup program cannot determine whether UE-V is already installed or there was an error in the setup file.

          - - - - - - - - - - - diff --git a/mdop/uev-v1/about-user-experience-virtualization-10.md b/mdop/uev-v1/about-user-experience-virtualization-10.md deleted file mode 100644 index 9fa34927b9..0000000000 --- a/mdop/uev-v1/about-user-experience-virtualization-10.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: About User Experience Virtualization 1.0 -description: About User Experience Virtualization 1.0 -author: levinec -ms.assetid: 3758b100-35a8-4e10-ac08-f583fb8ddbd9 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About User Experience Virtualization 1.0 - - -Microsoft User Experience Virtualization (UE-V) monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -User Experience Virtualization uses settings location templates to specify what applications and Windows settings on the user computers are monitored and centralized. The settings location template is an XML file that specifies which file and registry locations are associated with each application or operating system setting. The template does not contain values for the settings; it contains only the locations of the settings that are to be monitored. - -The application settings and Windows settings are monitored by UE-V when users are working on their computers. The values for the application settings are stored on the settings storage server when the user closes the application. The values for the Windows settings are stored when the user logs off, when the computer is locked, or when they disconnect remotely from a computer. - -An administrator can create a UE-V settings location template to specify which enterprise application settings will roam. UE-V includes a set of settings location templates for some Microsoft applications and Windows settings. For a list of default applications and settings in UE-V, see [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md). - -## UEV 1.0 Release Notes - - -For more information, and for late-breaking news that did not make it into the documentation, see [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md). - -## Related topics - - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/accessibility-for-ue-v.md b/mdop/uev-v1/accessibility-for-ue-v.md deleted file mode 100644 index 79d9e9d678..0000000000 --- a/mdop/uev-v1/accessibility-for-ue-v.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Accessibility for UE-V -description: Accessibility for UE-V -author: levinec -ms.assetid: 059a76e5-bcf0-4459-b5d2-8b71ff2ef433 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for UE-V - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -You can access most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -### Documentation in alternative formats - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally, formerly known as Recording for the Blind & Dyslexic, Inc. Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here.

          - - - -### Customer service for people with hearing impairments - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time that the service is used. - -## For more information - - -For more information about how accessible technology for computers can help to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/p/?linkid=8431). - -## Related topics - - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/administering-ue-v-10.md b/mdop/uev-v1/administering-ue-v-10.md deleted file mode 100644 index b5a5d8efb1..0000000000 --- a/mdop/uev-v1/administering-ue-v-10.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Administering UE-V 1.0 -description: Administering UE-V 1.0 -author: levinec -ms.assetid: c399ae8d-c839-4f84-9bfc-adacd8f89f34 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering UE-V 1.0 - - -After you have deployed Microsoft User Experience Virtualization (UE-V), you must be able to perform various ongoing administrative tasks. These post-installation tasks are described in the following sections. - -## Managing UE-V resources - - -In the course of the UE-V lifecycle, you will need to manage the configuration of the UE-V agent and also manage storage locations for resources such as settings packages. You might need to perform other tasks such as to restore a user’s settings to their original state from before UE-V was installed in order to recover lost settings. The following topics provide guidance for managing UE-V resources. - -### Changing the Frequency of UE-V Scheduled Tasks - -You can configure the scheduled tasks that manage when UE-V checks for new, updated, or removed custom settings location templates in the settings template catalog. - -[Changing the Frequency of UE-V Scheduled Tasks](changing-the-frequency-of-ue-v-scheduled-tasks.md) - -### Sharing Settings Location Templates with the UE-V Template Gallery - -The UE-V template gallery facilitates the sharing of UE-V settings location templates. The gallery enables you to upload your settings location templates to share with other people and to download templates that other people have created. - -[Sharing Settings Location Templates with the UE-V Template Gallery](sharing-settings-location-templates-with-the-ue-v-template-gallery.md) - -### Restoring application and Windows settings synchronized with UE-V 1.0 - -WMI and PowerShell features of UE-V provide the ability to restore settings packages. WMI and PowerShell commands allow you to restore application settings and Windows settings to the settings values that were on the computer the first time the application was started after the UE-V agent was launched. - -[Restoring Application and Windows Settings Synchronized with UE-V 1.0](restoring-application-and-windows-settings-synchronized-with-ue-v-10.md) - -### Configuring UE-V with Group Policy Objects - -You can use Group Policy to modify the settings that define how UE-V synchronizes settings on computers. - -[Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) - -### Administering UE-V with PowerShell and WMI - -You can use PowerShell and WMI to modify the settings that define how UE-V synchronizes settings on computers. - -[Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) - -### Migrating UE-V Settings Packages - -You can relocate the user settings packages either when migrating to a new server or for backup purposes. - -[Migrating UE-V Settings Packages](migrating-ue-v-settings-packages.md) - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md b/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md deleted file mode 100644 index cd78b0f3d8..0000000000 --- a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Administering UE-V with PowerShell and WMI -description: Administering UE-V with PowerShell and WMI -author: levinec -ms.assetid: 26cc864f-c628-4c04-a18c-dd60fce8187c -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering UE-V with PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets which can help administrators perform various UE-V tasks. The following sections provide more information about using PowerShell with UE-V. - -## Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI - - -You can use PowerShell and WMI to manage Microsoft User Experience Virtualization (UE-V) Agent configuration and synchronization behavior. - -[Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) - -## Managing UE-V 1.0 Settings Location Templates with PowerShell and WMI - - -After you create and deploy UE-V settings location templates you can manage those templates using PowerShell or WMI. - -[Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI](managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md) - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md b/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md deleted file mode 100644 index 1416e566c1..0000000000 --- a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Changing the Frequency of UE-V Scheduled Tasks -description: Changing the Frequency of UE-V Scheduled Tasks -author: levinec -ms.assetid: 33c2674e-0df4-4717-9c3d-820a90b16e19 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Changing the Frequency of UE-V Scheduled Tasks - - -The Microsoft User Experience Virtualization (UE-V) Agent installer, AgentSetup.exe, creates two scheduled tasks during the UE-V Agent installation. The two tasks are the **Template Auto Update** task and the **Setting Storage Location Status** task. These scheduled tasks are not configurable with the UE-V tools. Administrators who wish to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options. - -For more information about Schtasks.exe, see [How to use Schtasks,exe to Schedule Tasks in Windows Server 2003](https://go.microsoft.com/fwlink/?LinkID=264854). - -## Template Auto-Update - - -The **Template Auto Update** task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The **Template Auto Update** task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent install directory. - - ---- - - - - - - - - - - - - -
          Task nameDefault trigger

          \Microsoft\UE-V\Template Auto Update

          3:30 AM every day

          - -  - -**Example:** The following command configures the agent to check the settings template catalog store every hour. - -``` syntax -schtasks /change /tn "Microsoft\UE-V\Template Auto Update" /ri 60 -``` - -## Settings Storage Location Status - - -The **Setting Storage Location Status** task performs the following actions: - -1. Checks to make sure the UE-V folders are still pinned or registered with the offline files feature. - -2. Checks whether the settings storage location is offline or online. - -3. Forces a synchronization on the specified interval instead of the default interval for offline files. - -4. Synchronizes any settings packages that are configured to be pre-fetched. - -5. Checks if the Active Directory home directory path has changed. - -6. Writes the current settings storage configuration under the following location - - - - - - - - - - - - - - - - - - -
          Task nameDefault trigger

          \Microsoft\UE-V\Settings Storage Location Status

          At logon of any user – After triggered, repeat every 30 minutes indefinitely.

          - -   - -**Example:** The following command configures the agent to run the action above every hour. - -``` syntax -schtasks /change /tn "\Microsoft\UE-V\Settings Storage Location Status" /ri 60 -``` - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md b/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md deleted file mode 100644 index d41fbb33ce..0000000000 --- a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 -description: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 -author: levinec -ms.assetid: 3bfaab30-59f7-4099-abb1-d248ce0086b8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 - - -To evaluate which line-of-business applications should be included in your UE-V deployment, consider the following: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Description
          Checklist box

          Does this application contain settings that the user can customize?

          Checklist box

          Is it important for the user that these settings roam?

          Checklist box

          Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application launch and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings policy solutions, users might experience inconsistency across roamed settings.

          Checklist box

          Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations do not consistently roam across sessions and can cause a poor application experience.

          Checklist box

          Does the application store settings in the Program Files directory or in the file directory that is located in the Users \ [User name] \ AppData \ LocalLow directory? Application data that is stored in either of these locations usually should not roam with the user, because this data is specific to the computer or because the data is too large to roam.

          Checklist box

          Does the application store any settings in a file that contains other application data that should not roam? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this additional data may cause a poor application experience.

          Checklist box

          How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can impact the performance of settings synchronization.

          - -  - -## Related topics - - -[Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md b/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md deleted file mode 100644 index 1d793732cd..0000000000 --- a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Configuring UE-V with Group Policy Objects -description: Configuring UE-V with Group Policy Objects -author: levinec -ms.assetid: 5c9be706-a05f-4397-9a38-e6b73ebff1e5 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring UE-V with Group Policy Objects - - -Some Microsoft User Experience Virtualization (UE-V) Group Policy settings can be defined for computers and others can be defined for users. UE-V agent configuration policy settings can be defined for computers or users. For information about how to install UE-V Group Policy ADMX files, see [Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md). - -The following policy settings can be configured for UE-V: - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Policy setting name

          Target

          Policy setting description

          Configuration options

          Use User Experience Virtualization (UE-V)

          Computers and Users

          This policy setting allows you to enable or disable User Experience Virtualization (UE-V).

          Enable or disable this policy setting.

          Settings storage path

          Computers and Users

          This policy setting configures where the user settings will be stored.

          Provide a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.

          Settings template catalog path

          Computers Only

          This policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog will be used to replace the default Microsoft templates that are installed with the UE-V agent.

          Provide a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.

          -

          -

          Select the check box to replace the default Microsoft templates.

          Do not use Offline Files

          Computers and Users

          This policy setting allows you to configure whether UE-V will use the Windows Offline Files feature. This policy setting also allows you to enable notification to occur when the import of user settings is delayed.

          To configure the UE-V Agent to not use offline files, enable this setting.

          -

          -

          Specify if notifications should be given when settings import is delayed.

          -

          -

          Specify the length of time in seconds to wait before the notification appears.

          Synchronization timeout

          Computers and Users

          This policy setting configures the number of milliseconds that the computer waits before a timeout when retrieving user settings from the remote settings location. If the remote storage location is unavailable, the application launch is delayed by this many milliseconds.

          Specify the preferred synchronization timeout in milliseconds. The default value of 2000 milliseconds.

          Package size warning threshold

          Computers and Users

          This policy setting allows you to configure the UE-V agent to report when a settings package file size reaches a defined threshold.

          Specified the preferred threshold for settings package sizes in kilobytes.

          -

          By default, the UE-V agent does not have a package file size threshold.

          Roaming Application settings

          Users Only

          This policy setting configures the roaming of user settings of applications.

          Select which Windows settings will roam between computers.

          -

          By default, the user settings of applications with settings template provided by UE-V are roamed between computers.

          Roaming Windows settings

          Users Only

          This policy setting configures the roaming of Windows settings.

          Select which applications will roam between computers.

          -

          By default, Windows themes are roamed between computers of the same operating system version. Windows desktop settings and Ease of Access settings are not roamed.

          - - - -**To configure computer-targeted policies** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) on the domain controller computer that manages Group Policy for UE-V computers. Navigate to **Computer configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the policy setting to be edited. - -**To configure user-targeted policies** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) tool in Microsoft Desktop Optimization Pack (MDOP) on the domain controller computer that manages Group Policy for UE-V. Navigate to **User configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the policy setting edited. - -The UE-V agent uses the following order of precedence to determine synchronization. - -**Order of precedence for UE-V settings** - -1. User-targeted settings managed by Group Policy - These configuration settings are stored in the registry key by Group Policy under `HKEY_CURRENT_USER\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -2. Computer-targeted settings managed by Group Policy - These configuration settings are stored in the registry key by Group Policy under `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -3. Configuration settings defined by the current user using PowerShell or WMI - These configuration settings are stored by the UE-V agent under this registry location: `HKEY_CURRENT_USER\Software\Microsoft\Uev\Agent\Configuration`. - -4. Configuration settings defined for the computer using PowerShell or WMI. These configuration settings are stored by the UE-V agent under the `HKEY_LOCAL_MACHINE \Software\Microsoft\Uev\Agent\Configuration`. - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md deleted file mode 100644 index b2fb85109b..0000000000 --- a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Create UE-V Settings Location Templates with the UE-V Generator -description: Create UE-V Settings Location Templates with the UE-V Generator -author: levinec -ms.assetid: b8e50e2f-0cc6-4f74-bb48-c471fefdc7d8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create UE-V Settings Location Templates with the UE-V Generator - - -Microsoft User Experience Virtualization (UE-V) uses *settings location templates* to roam application settings between user computers. Some standard settings location templates are included with User Experience Virtualization. You can also create, edit, or validate custom settings location templates with the UE-V Generator. - -The UE-V Generator monitors an application to discover and capture the locations where the application stores its settings. The application that is being monitored must be a traditional application. The UE-V Generator cannot create a settings location template from the following application types: - -- Virtualized applications - -- Application offered through terminal services - -- Java applications - -- Windows 8 applications - -**Note**   -UE-V templates cannot be created from virtualized applications or terminal services applications. However, settings synchronized using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and terminal services applications, open a Windows Installer File (.msi) version of the application with UE-V Generator. - - - -**Excluded Locations** - -The discovery process excludes locations which commonly store application software files that do not roam well between user computers or environments. The following are excluded: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files associated with the core functionality of the Windows operating system - -- All registry keys located in the HKEY\_LOCAL\_MACHINE hive - -- Files located in Program Files directories - -- Files located in Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files located in %systemroot% - -If registry keys and files stored in these excluded locations are required in order to roam application settings, administrators can manually add the locations to the settings location template during the template creation process. - -## Create UE-V templates - - -Use the UE-V Generator to create settings location templates for line-of-business applications or other applications. After the template for an application is created, you can deploy the template to computers so users can roam the settings for that application. - -**To create a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Create a settings location template**. - -3. Specify the application. Browse to the file path of the application (.exe) or the application shortcut (.lnk) for which you want to create a settings location template. Specify the command line arguments, if any, and working directory, if any. Click **Next** to continue. - - **Note**   - Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings. - - - -4. After the application starts, close the application. The UE-V Generator records the locations where the application stores its settings. - -5. After the process is complete, click **Next** to continue. - -6. Review and select the check boxes next to the appropriate registry settings locations and settings file locations to roam for this application. The list includes the following two categories for settings locations: - - - **Standard**: Application settings that are stored in the registry under the HKEY\_CURRENT\_USER keys or in the file folders under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming**. The UE-V Generator includes these settings by default. - - - **Nonstandard**: Application settings that are stored outside the locations specified in the best practices for settings data storage (optional). These include files and folders under **Users** \\ \[User name\] \\ **AppData** \\ **Local**. Review these locations to determine whether to include them in the settings location template. Select the locations check boxes to include them. - - Click **Next** to continue. - -7. Review and edit any **Properties**, **Registry** locations, and **Files** locations for the settings location template. - - - Edit the following properties on the **Properties** tab: - - - **Application Name**: The application name written in the description of the program files properties. - - - **Program name**: The name of the program taken from the program file properties. This name usually has the .exe extension. - - - **Product version**: The product version number of the .exe file of the application. This property, in conjunction with the File version, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template will apply to all versions of the product. - - - **File version**: The file version number of the.exe file of the application. This property, in conjunction with the Product version, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template will apply to all versions of the program. - - - **Template author name** (optional): The name of the settings location template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. Edit the registry locations by use of the **Tasks** drop-down menu. Tasks include adding new keys, editing the name or scope of existing keys, deleting keys, and browsing the registry where the keys are located. Use the **All Settings** scope to include all the registry settings under the specified key. Use the **All Settings and Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations included in the settings location template. Edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations include adding new files or folder locations, editing the scope of existing files or folders, deleting files or folders, and opening the selected location in Windows Explorer. Leave the file mask empty to include all files in the specified folder. - -8. Click **Create** and save the settings location template on the computer. - -9. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you have created the settings location template for an application, you should test the template. Deploy the template in a lab environment before putting it into production in the enterprise. - -## Related topics - - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md deleted file mode 100644 index 8ca6ac6836..0000000000 --- a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: Deploying the Settings Storage Location for UE-V 1.0 -description: Deploying the Settings Storage Location for UE-V 1.0 -author: levinec -ms.assetid: b187d44d-649b-487e-98d3-a61ee2be8c2f -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the Settings Storage Location for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) deployment requires a settings storage location where the user settings are stored in a settings package file. The settings storage location can be configured in one of the following two ways: - -- **Active Directory home directory** – if a home directory is defined for the user in Active Directory, the UE-V agent will use this location to store settings location packages. The UE-V agent dynamically creates the user-specific storage folder below the root of the home directory. The agent only uses the home directory of the Active Directory if a settings storage location is not defined. - -- **Create a settings storage share** – the settings storage share is a standard network share that is accessible by UE-V users. - -## Deploy a UE-V settings storage share - - -When you create the settings storage share, you should limit access only to users that need access. The necessary permissions are shown in the tables below. - -**To deploy the UE-V network share** - -1. Create a new security group for UE-V users. - -2. Create a new folder on the centrally located computer that will store the UE-V settings packages, and then grant the UE-V users with group permissions to the folder. The administrator supporting UE-V will need permissions to this shared folder. - -3. Set the following share-level (SMB) permissions for the setting storage location folder: - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissions

          Everyone

          No Permissions

          Security group of UE-V users

          Full Control

          - - - -4. Set the following NTFS permissions for the settings storage location folder: - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissionsFolder

          Creator/Owner

          Full Control

          Subfolders and Files Only

          Security group of UE-V users

          List Folder/Read Data, Create Folders/Append Data

          This Folder Only

          - - - -5. Click **OK** to close the dialog boxes. - -This permission configuration allows users to create folders for settings storage. The UE-V agent creates and secures a `settingspackage` folder while running in the context of the user. The user receives full control to their `settingspackage` folder. Other users do not inherit access to this folder. You do not need to create and secure individual user directories, because this will be done automatically by the agent that runs in the context of the user. - -**Note**   -Additional security can be configured when a Windows server is utilized for the settings storage share. UE-V can be configured to verify that either the local administrator's group or the current user is the owner of the folder where settings packages are stored. To enable additional security complete the following: - -1. Add a **REG\_DWORD** registry key named "RepositoryOwnerCheckEnabled" to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration.** - -2. Set registry key value to 1. - - - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -Deploy the Central Storage for User Experience Virtualization Settings Templates and Settings Packages -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -[Deploying the UE-V Agent](deploying-the-ue-v-agent.md) - - - - - - - - - diff --git a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md deleted file mode 100644 index b7aea24dd9..0000000000 --- a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Deploying the Settings Template Catalog for UE-V 1.0 -description: Deploying the Settings Template Catalog for UE-V 1.0 -author: levinec -ms.assetid: 0e6ab5ef-8eeb-40b4-be7b-a841bd83be96 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the Settings Template Catalog for UE-V 1.0 - - -Custom settings location templates can be stored on a folder path on Microsoft User Experience Virtualization (UE-V) computers or on a Server Message Block (SMB) network share. A scheduled task on the computer checks for new or updated templates from this location. The task checks this location once each day and updates its synchronization behavior based on the templates in this folder. Templates that are added or updated in this folder since the last check are registered by the UE-V agent. The UE-V agent deregisters templates that were removed from this folder. The scheduled task runs as SYSTEM. At a minimum, the network share must grant permissions for the Domain Computers group. In addition, grant access permissions for the network share folder to administrators who will manage the stored templates. For more information about custom setting location templates, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -**To configure the settings template catalog for UE-V** - -1. Create a new folder on the computer that will store the UE-V settings template catalog. - -2. Set the following share-level (SMB) permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommend permissions

          Everyone

          No Permissions

          Domain Computers

          Read Permission Levels

          Administrators

          Read/Write Permission Levels

          - -   - -3. Set the following NTFS permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User AccountRecommended PermissionsApply To

          Creator/Owner

          Full Control

          This Folder, Subfolders and Files

          Domain Computers

          List Folder Contents and Read

          This Folder, Subfolders and Files

          Everyone

          No Permissions

          No Permissions

          Administrators

          Full Control

          This Folder, Subfolders and Files

          - -   - -4. Click **OK** to close the dialog boxes. - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/deploying-the-ue-v-agent.md b/mdop/uev-v1/deploying-the-ue-v-agent.md deleted file mode 100644 index 9c6b40a75c..0000000000 --- a/mdop/uev-v1/deploying-the-ue-v-agent.md +++ /dev/null @@ -1,204 +0,0 @@ ---- -title: Deploying the UE-V Agent -description: Deploying the UE-V Agent -author: levinec -ms.assetid: ec1c16c4-4be0-41ff-93bc-3e2b1afb5832 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the UE-V Agent - - -The Microsoft User Experience Virtualization (UE-V) agent must run on each computer that uses UE-V to roam application and Windows settings. A single installer file, AgentSetup.exe, installs the UE-V agent on both 32-bit and 64-bit operating systems. The command-line parameters of the UE-V Agent are the following: - -**AgentSetup.exe command-line parameters** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Command-line parameterDefinitionNotes

          /help or /h or /?

          Displays the AgentSetup.exe usage dialog.

          SettingsStoragePath

          Indicates the Universal Naming Convention (UNC) path that defines where settings are stored.

          %username% or %computername% environment variables are accepted. Scripting may require escaped variables.

          -

          Default: <none> (Active Directory user home)

          SettingsTemplateCatalogPath

          Indicates the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates.

          Only required for custom settings location templates

          RegisterMSTemplates

          Specifies whether the default Microsoft templates should be registered during installation.

          True | False

          -

          Default: True

          SyncMethod

          Specifies which synchronization method should be used.

          OfflineFiles | None

          -

          Default: OfflineFiles

          SyncTimeoutInMilliseconds

          Specifies the number of milliseconds that the computer waits before timeout when it retrieves user settings from the settings storage location.

          Default: 2000 milliseconds

          -

          (wait up to 2 seconds)

          SyncEnabled

          Specifies whether UE-V synchronization is enabled or disabled.

          True | False

          -

          Default: True

          MaxPackageSizeInBytes

          Specifies a settings package file size in bytes when the UE-V agent reports that files exceed the threshold.

          <size>

          -

          Default: none (no warning threshold)

          CEIPEnabled

          Specifies the setting for participation in the Customer Experience Improvement program. If set to true, then installer information is uploaded to the Microsoft Customer Experience Improvement Program site. If set to false, then no information is uploaded.

          True | False

          -

          Default: False

          -

          On Windows 7: True

          - - - -During installation, the SettingsStoragePath command-line parameter specifies the settings storage location for the settings values. A settings storage location can be defined before deploying the UE-V Agent. If no settings storage location is defined, then UE-V uses the Active Directory user Home Directory as the settings storage location. When you specify the SettingsStoragePath configuration during setup and use the %username% as part of the value, this will roam the same user settings experience on all computers or sessions that a user logs into. If you specify the %username%\\%computername% variables as part of the SettingsStoragePath value, this will preserve the settings experience for each computer. - -Architecture-specific Windows Installer (.msi) files are provided for the UE-V agent installation in addition to the combined 32-bit and 64-bit installer. The AgentSetupx86.msi or AgentSetupx64.msi install files are smaller than the AgentSetup.exe file and might streamline the agent deployments. The command-line parameters for the AgentSetup.exe installer are supported for the Windows Installer (.msi) installation. - -**Note**   -During UE-V agent installation or uninstallation you can either use the AgentSetup.exe file or the AgentSetup<arch>.msi file, but not both. The same file must be used to uninstall the UE-V Agent as it was used to install the UE-V Agent. - - - -Be sure to use the correct variable format when you install the UE-V agent. The following table provides examples of deployment options for using the AgentSetup.exe or the Windows Installer (.msi) installation files. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Deployment typeDeployment descriptionExample

          Command prompt

          When you install the UE-V agent from a command prompt, use the %^username% variable format. If quotation marks are needed because of spaces in the settings storage path, use a batch script file for deployment.

          -

          AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

          -

          -

          msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

          Batch script

          When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this install method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at install time, rather than at run time, causing UE-V to use a single settings storage location for all users.

          AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

          -

          -

          msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

          -

          PowerShell

          When you install the UE-V agent from a PowerShell prompt or PowerShell script, use the %username% variable format.

          & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

          -

          -

          & msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

          -

          Electronic software distribution, such as deployment of Configuration Manager Software Deployment)

          When you install the UE-V Agent with Configuration Manager, use the ^%username^% variable format.

          AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

          -

          -

          msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

          - - - -**Note**   -The installation of the U-EV Agent requires Administrator rights and the computer will require a restart before the UE-V agent can run. - - - -## UE-V Agent deployment methods from a network share - - -You can use the following methods to deploy the UE-V agent: - -- An electronic software distribution (ESD) solution that can install a Windows Installer (.msi) file. - -- An installation script that references the Windows Installer (.msi) file that is stored centrally on a share. - -- Manually running the installation program on the computer. - -To deploy the UE-V agent from a network share, use the following steps: - -**To install and configure the UE-V Agent from a network share** - -1. Stage the UE-V agent installation file (AgentSetup.exe) on a network share to which users have “read” permission. - -2. Deploy a script to user computers that installs the UE-V agent. The script should specify the settings storage location. - -**Update the UE-V Agent** - -Updates for the UE-V agent software will be provided through Microsoft Update. During a UE-V agent upgrade, the default group of settings location templates for common Microsoft applications and Windows settings may be updated. UE-V agent updates can be deployed by using Enterprise Software Distribution (ESD) infrastructure. - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) - -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -Deploy the User Experience Virtualization Agent - - - - - - - - diff --git a/mdop/uev-v1/deploying-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-10.md deleted file mode 100644 index 9b56dbf52e..0000000000 --- a/mdop/uev-v1/deploying-ue-v-10.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Deploying UE-V 1.0 -description: Deploying UE-V 1.0 -author: levinec -ms.assetid: 519598bb-8c81-4af7-bee7-357696bff880 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying UE-V 1.0 - - -There are a number of different deployment configurations that Microsoft User Experience Virtualization (UE-V) supports. This section includes general information and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment information for UE-V - - -A UE-V deployment requires a settings storage location on a network share and a UE-V agent installed on every computer that synchronizes settings. The UE-V Group Policy templates can be used to manage UE-V settings. The following topics describe how to deploy these features. - -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) - -All UE-V deployments require a settings storage location where the settings packages that contain the synchronized setting values are located. - -[Deploying the UE-V Agent](deploying-the-ue-v-agent.md) - -To synchronize settings by using UE-V, a computer must have the UE-V Agent installed and running. - -[Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md) - -You can use Group Policy to preconfigure UE-V settings before you deploy the UE-V Agent as well as standard UE-V configuration. - -## Deployment information for custom template deployment - - -If you plan to create custom settings location templates for applications other than the Microsoft applications that are included in UE-V, such as line-of-business applications, then you can deploy a settings template catalog and you must install the UE-V Generator to create those templates. For more information, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -Use the UE-V Generator to create, edit, and validate custom settings location templates that help synchronize settings of applications other than the default applications. - -[Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md) - -If you need to deploy custom settings location templates to support applications other than the default applications in the UE-V Agent, you must configure a settings template catalog to store them. - -[Deploying UE-V Settings Location Templates for UE-V 1.0](deploying-ue-v-settings-location-templates-for-ue-v-10.md) - -If you need to synchronize applications other than the default applications in the UE-V Agent, the custom setting location templates that are created with UE-V Generator can be distributed to the UE-V settings template catalog. - -**Note**   -Deploying custom templates requires a settings template catalog. The default Microsoft application templates are deployed with the UE-V Agent. - - - -## Topics for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md deleted file mode 100644 index 9485eeb780..0000000000 --- a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Deploying UE-V Settings Location Templates for UE-V 1.0 -description: Deploying UE-V Settings Location Templates for UE-V 1.0 -author: levinec -ms.assetid: 7e0cc553-14f7-40fa-828a-281c8d2d1934 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying UE-V Settings Location Templates for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings that are captured and applied by User Experience Virtualization. UE-V includes a set of standard templates, as well as a tool, the UE-V Generator, which allows you to create custom settings location templates. After you create a settings location template, you should test it to ensure that the application settings roam correctly in a test environment. You can then safely deploy the settings location template to computers in the enterprise. - -Settings location templates can be deployed by using enterprise software distribution (ESD), Group Policy preferences, or by configuring a UE-V settings template catalog. Templates that are deployed by using an ESD or Group Policy must be registered through UE-V WMI or PowerShell. Templates that are stored in the settings template catalog location are automatically registered by the UE-V agent. - -## Deploy the settings location templates with a settings template catalog path - - -The UE-V settings location template catalog path can be defined by using the following methods: Group Policy, the agent install command-line parameters, WMI, or PowerShell. After the template catalog path has been defined, the UE-V agent retrieves the new or updated templates from this location. The UE-V agent checks this location once each day and updates its synchronization behavior based on the templates found in this folder. Templates that have been added or updated in this folder since the last check are registered by the UE-V agent. The UE-V agent also unregisters templates that have been removed from this folder. Templates are registered and unregistered one time per day by the task scheduler. - -**To use settings template catalog path to deploy UE-V settings location templates** - -1. Navigate to the network share folder that is defined as the settings template catalog. - -2. Add, remove, or update settings location templates in the settings template catalog to reflect the desired UE-V agent template configuration for UE-V computers. - -3. Templates on computers are updated daily based on changes to the settings template catalog. - -4. Open an elevated command prompt and navigate to **%program files%\\Microsoft user Experience Virtualization \\ Agent \\ <x86 or x64 >**, and then run **ApplySettingsTemplateCatalog.exe** to manually update templates on a computer that runs the UE-V agent. - -## Related topics - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md deleted file mode 100644 index 169f17d7ed..0000000000 --- a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Edit UE-V Settings Location Templates with the UE-V Generator -description: Edit UE-V Settings Location Templates with the UE-V Generator -author: levinec -ms.assetid: da78f9c8-1624-4111-8c96-79db7224bd0b -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit UE-V Settings Location Templates with the UE-V Generator - - -Use the Microsoft User Experience Virtualization (UE-V) Generator to edit settings location templates. When the revised settings are added to the templates using the UE-V Generator, the version information within the template is automatically updated to ensure that any existing templates deployed in the enterprise are updated correctly. - -**How to edit a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Edit a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, **Browse** to the settings template file. Click **Next** to continue. - -4. Review the **Properties**, **Registry** locations, and **Files** locations for the settings template. Edit as needed. - - - The **Properties** tab allows you to view and edit the following properties: - - - **Application name**: The application name written in the description of the program file properties. - - - **Program name**: The name of the program taken from the program file properties. This name usually has the .exe extension. - - - **Product version**: The product version number of the .exe file of the application. This property, together with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, then the settings location template will apply to all versions of the product. - - - **File version**: The file version number of the.exe file of the application. This property, along with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template will apply to all versions of the program. - - - **Template author name** (optional): The name of the settings template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. You can edit the registry locations by use of the **Tasks** drop-down menu. Tasks include adding new keys, editing the name or scope of existing keys, deleting keys, and browsing the registry in which the keys are located. When you define the scope for the registry, you can use the **All Settings** scope to include all the registry settings under the specified key. Use **All Settings** and **Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations included in the settings location template. You can edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations include adding new files or folder locations, editing the scope of existing files or folders, deleting files or folders, and opening the selected location in Windows Explorer. To include all files in the specified folder, leave the file mask empty. - -5. Click **Save** to save the changes to the settings location template. - -6. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After editing the settings location template for an application, you should test the template. Deploy the revised settings location template in a lab environment before putting it into production in the enterprise. - -**How to manually edit a settings location template** - -1. Create a local copy of the settings location template (.xml file). UE-V settings location templates are .xml files identifying the locations where application store settings values. - -2. Open the settings location template file with an XML editor. - -3. Edit the settings location template file. All changes must conform to the UE-V schema file defined in SettingsLocationTempate.xsd. A copy of the .xsd file is located in `\ProgramData\Microsoft\UEV\Templates` by default. - -4. Save the settings location template file and close the XML editor. - -5. Validate the modified settings location template file with the UE-V Generator. For more information about validating with the UE-V Generator, see [Validate UE-V Settings Location Templates with UE-V Generator](validate-ue-v-settings-location-templates-with-ue-v-generator.md). - -## Related topics - - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md b/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md deleted file mode 100644 index 88b04b4510..0000000000 --- a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Getting Started With User Experience Virtualization 1.0 -description: Getting Started With User Experience Virtualization 1.0 -author: levinec -ms.assetid: 74a068dc-4f87-4cb4-b114-8ca2a37149f7 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started With User Experience Virtualization 1.0 - - -Microsoft User Experience Virtualization (UE-V) captures and centralizes application settings and Windows operating system settings for the user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -UE-V offers settings synchronization for common Microsoft applications and Windows settings. It also delivers user settings at any time to wherever users work throughout the enterprise. UE-V allows administrators to specify which application settings and Windows settings roam. UE-V helps administrators to create custom settings location templates for third-party or line-of-business applications that are used in the enterprise. - -User Experience Virtualization delivers an enhanced user state virtualization experience. It provides consistent personalization of the user’s settings in the following scenarios: - -- Roaming user application and Windows settings between computers. - -- Roaming user settings between the instances of an application that are deployed by using different methods: - - - Installed applications - - - Application Virtualization (App-V) sequenced applications - - - RemoteApp (Remote Desktop Virtualization) applications - -- Recovering settings for a computer after replacement, hardware upgrade, or reimage. - -This product requires thorough planning before you deploy it or use its features. Because this product can affect every computer in your organization, you might disrupt your entire network if you do not plan your deployment carefully. However, if you plan your deployment carefully and manage it so that it meets your business needs, this product can help reduce your administrative overhead and total cost of ownership. - -If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272497). - - - -## Getting started with Microsoft User Experience Virtualization topics - - -- [About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md) - - Describes the functionality and features of User Experience Virtualization. - -- [High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md) - - Explains the features of User Experience Virtualization. - -- [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md) - - Describes the known issues for UE-V. - -- [Accessibility for UE-V](accessibility-for-ue-v.md) - - Describes the keyboard shortcuts and accessibility information for UE-V. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -- [Planning for UE-V 1.0](planning-for-ue-v-10.md) - -- [Deploying UE-V 1.0](deploying-ue-v-10.md) - -- [Operations for UE-V 1.0](operations-for-ue-v-10.md) - -- [Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md b/mdop/uev-v1/high-level-architecture-for-ue-v-10.md deleted file mode 100644 index df5036bb3c..0000000000 --- a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: High-Level Architecture for UE-V 1.0 -description: High-Level Architecture for UE-V 1.0 -author: levinec -ms.assetid: d54f9f10-1a4d-4e56-802d-22d51646e1cc -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture for UE-V 1.0 - - -This topic describes high-level architectural elements of the Microsoft User Experience Virtualization (UE-V) settings roaming solution. The following elements are part of a standard UE-V deployment. - -![ue-v agent architectural diagram](images/ue-vagentarchitecturaldiagram.gif) - -The UE-V Agent monitors the applications and the operating system processes as they are identified in the UE-V settings location templates. When the application or operating system starts, the settings are read from the settings package and applied to the computer. When the application closes or when the operating system is locked or shut down, settings are saved in a UE-V settings package in the settings storage location. - -## Settings storage location - - -The settings storage location is a file share that the User Experience Virtualization agent accesses to read and write settings. This location is either the Active Directory home directory or defined during the UE-V installation. You can set the location during the installation of the UE-V agent, or you can set it later with Group Policy, WMI, or PowerShell. The location can be on any common file share that users can access. If no setting storage location is set during installation then UE-V will use the home directory in Active Directory. The UE-V agent verifies the location and creates a system folder that is hidden from the user in which to store and access the user settings. For more information about settings storage, see [Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md). - -## UE-V Agent - - -The UE-V agent is installed on each computer with settings that are synchronized by User Experience Virtualization. The agent monitors the registered applications and the operating system for any changes to that are made to settings, and it synchronizes those settings between computers. Settings are applied from the settings storage location to the application when the application is started. The settings are then saved back to the settings storage location when the application closes. The operating system settings are applied when the user logs on, when the computer is unlocked, or when the user connects remotely to the computer by using remote desktop protocol (RDP). The agent saves settings when the user logs off, when the computer is locked, or when a remote connection is disconnected. For more information about the UE-V Agent, see [Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md). - -## Settings location templates - - -The settings location template is an XML file that defines the settings locations to be monitored by User Experience Virtualization. Only the settings locations defined in these settings templates are captured or applied on computers running the UE-V Agent. The settings location template does not contain settings values, only the locations where values are stored on the computer. - -UE-V includes a set of settings location templates that specify settings locations for some Microsoft applications and Windows settings. An administrator can create custom settings location templates by using the UE-V Generator. - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -## Settings packages - - -Application settings and Windows settings are stored in settings packages, which are created by the UE-V Agent. A settings package is a collection of the settings that are represented in the settings location templates. These settings packages are built, locally stored, and then copied to the settings storage location. “Last write wins” determines which settings are preserved when a single user synchronizes the more than one computer to a storage location. The agent that runs on one computer reads and writes to the settings location independent of agents that run on other computers. The most recently written settings and values are applied when the next agent reads from the settings storage location. - -![ue-v generator process](images/ue-vgeneratorprocess.gif) - -## Settings template catalog - - -The settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. The UE-V agent retrieves new or updated templates from this location. The UE-V agent checks this location once each day and it updates its synchronization behavior based on the templates in this folder. The templates that were added or updated in this folder since the last check are registered by the UE-V agent. The UE-V agent deregisters the templates that were removed from this folder. Templates are registered and unregistered one time per day by the task scheduler. If you will use only the default settings location templates that are included with UE-V, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -## User Experience Virtualization Generator - - -The User Experience Virtualization Generator enables you to create custom settings location templates which will store the settings locations of the applications that are used in the enterprise and that you want to include in the roaming settings solution. The UE-V Generator will seek to discover the locations of registry values and the settings files for applications and then it will record those locations in a settings location template XML file. You can then distribute these settings location templates to the user computers. The UE-V Generator also allows an administrator to edit an existing template or validate a template that was created with another XML editor. - -The UE-V Generator monitors an application to discover and record where it stores its settings. To do this, it monitors where the application reads or writes in the HKEY\_CURRENT\_USER registry or in the file folders under **Users** \\ \[User name\] \\ **AppData** \\ **Roaming and Users** \\ \[User name\] \\ **AppData** \\ **Local**. - -The discovery process excludes registry keys and files to which the logged-in user cannot write values. None of these will be included in the XML file. The discovery process also excludes registry keys and files that are associated with the core functionality of the Windows operating system. - -For more information about the UE-V Generator, see [Installing the UE-V Generator](installing-the-ue-v-generator.md). - -## Related topics - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md) - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/images/checklistbox.gif b/mdop/uev-v1/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/uev-v1/images/checklistbox.gif and /dev/null differ diff --git a/mdop/uev-v1/images/ue-vagentarchitecturaldiagram.gif b/mdop/uev-v1/images/ue-vagentarchitecturaldiagram.gif deleted file mode 100644 index a09e120130..0000000000 Binary files a/mdop/uev-v1/images/ue-vagentarchitecturaldiagram.gif and /dev/null differ diff --git a/mdop/uev-v1/images/ue-vgeneratorprocess.gif b/mdop/uev-v1/images/ue-vgeneratorprocess.gif deleted file mode 100644 index 1c1ef4331d..0000000000 Binary files a/mdop/uev-v1/images/ue-vgeneratorprocess.gif and /dev/null differ diff --git a/mdop/uev-v1/index.md b/mdop/uev-v1/index.md deleted file mode 100644 index 3fe3f036fa..0000000000 --- a/mdop/uev-v1/index.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 1.0 -description: Microsoft User Experience Virtualization (UE-V) 1.0 -author: dansimp -ms.assetid: 7c2b59f6-bbe9-4373-8b08-c1738665a37b -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Microsoft User Experience Virtualization (UE-V) 1.0 - ->[!NOTE] ->This documentation is a for version of UE-V that was included in the Microsoft Desktop Optimization Pack (MDOP). For information about the latest version of UE-V which is included in Windows 10 Enterprise, see [Get Started with UE-V](https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started). - - -Microsoft User Experience Virtualization (UE-V) captures and centralizes application settings and Windows operating system settings for the user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[About User Experience Virtualization 1.0 SP1](about-user-experience-virtualization-10-sp1.md)  **|**  [Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md)  **|**  [About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md)  **|**  [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md)  **|**  [High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md)  **|**  [Accessibility for UE-V](accessibility-for-ue-v.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md)  **|**  [Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md)  **|**  [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md)  **|**  [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md)  **|**  [UE-V Checklist](ue-v-checklist.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md)  **|**  [Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md)  **|**  [Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md)  **|**  [Deploying UE-V Settings Location Templates for UE-V 1.0](deploying-ue-v-settings-location-templates-for-ue-v-10.md)  **|**  [Deploying the UE-V Agent](deploying-the-ue-v-agent.md)  **|**  [Installing the UE-V Generator](installing-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Administering UE-V 1.0](administering-ue-v-10.md)  **|**  [Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md)  **|**  [Administering UE-V with PowerShell and WMI](administering-ue-v-with-powershell-and-wmi.md)  |  [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - -### More information - -[Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md) -View updated product information and known issues for UE-V 1.0. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/uev-v1/installing-the-ue-v-generator.md b/mdop/uev-v1/installing-the-ue-v-generator.md deleted file mode 100644 index 821aca1fc3..0000000000 --- a/mdop/uev-v1/installing-the-ue-v-generator.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Installing the UE-V Generator -description: Installing the UE-V Generator -author: levinec -ms.assetid: 198b9a5f-3dfc-46be-9005-d33451914f87 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installing the UE-V Generator - - -The Microsoft User Experience Virtualization (UE-V) generator can be installed on a computer and used to create a custom settings location template. This computer should have the applications installed for which custom settings location templates will be generated. To install the UE-V Generator, run **ToolsSetup.exe**. If the architecture of the computer is known, then you can run the appropriate Windows Installer (.msi) file, **ToolsSetupx64.msi** or **ToolsSetupx86.msi**. - -**To install the UE-V Generator** - -1. As a user with local computer administrator rights, locate the UE-V Generator installation file (ToolSetup.exe) provided with the User Experience Virtualization software. - -2. Double-click the installation file. The User Experience Virtualization Generator Setup wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Specify the options for Microsoft Updates and the Customer Experience Improvement Program. - -5. Select the destination folder in which the UE-V Generator will be installed, and then click **Next**. - -6. Click **Install** to begin the installation. - - **Note**   - A prompt for User Account Control appears before the application is installed. Permission is required to install the UE-V generator. - - - -7. Click **Finish** to close the wizard after the installation is complete. You will need to restart your computer before you can run the UE-V Generator. - - To verify that the installation was successful, click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md b/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md deleted file mode 100644 index cbdc80df01..0000000000 --- a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Installing the UE-V Group Policy ADMX Templates -description: Installing the UE-V Group Policy ADMX Templates -author: levinec -ms.assetid: 7bd1f12e-7ba6-49f9-af9c-22c496b13b39 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 07/12/2017 ---- - - -# Installing the UE-V Group Policy ADMX Templates - - -The Microsoft User Experience Virtualization (UE-V) agent can be managed by using the existing Group Policy infrastructure. The UE-V ADMX template configures the synchronization settings for the UE-V agent. The ADMX template enables the central management of common UE-V Agent configuration settings by using an existing Group Policy infrastructure. - -**System requirements** - -Supported operating systems for the Domain Controller that deploys the Group Policy Objects include the following: - -- Windows Server 2008 R2 - -- Windows Server 2012 - -ADMX files can be installed and tested locally on any computer that runs the Windows operating system. - -**To download the UE-V ADMX templates** - -1. Download the UE-V ADMX template files: . - -2. For more information about how to deploy the Group Policy templates, see . - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md b/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md deleted file mode 100644 index 394c3b4ec6..0000000000 --- a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md +++ /dev/null @@ -1,292 +0,0 @@ ---- -title: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI -description: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI -author: levinec -ms.assetid: c8989b01-1769-4e69-82b1-4aadb261d2d5 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI - - -You can use WMI and PowerShell to manage Microsoft User Experience Virtualization (UE-V) Agent configuration and synchronization behavior. - -**How to deploy the UE-V agent with PowerShell** - -1. Stage the UE-V installer file in an accessible network share. - - **Note** - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer Files versions, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time using the installation file, you must use the same file type. - - - -2. Use one of the following PowerShell commands to install the agent. - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -**How to configure the UE-V Agent with PowerShell** - -1. Use an account with administrator rights to open a PowerShell window. Import the UE-V PowerShell module by using the following command. - - ``` syntax - Import-module UEV - ``` - -2. Use the following PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          PowerShell command

          Description

          Get-UevConfiguration

          -

          View the effective UE-V agent settings. User-specific settings have precedence over the computer settings.

          Get-UevConfiguration - CurrentComputerUser

          -

          View the UE-V agent settings values for the current user only.

          Get-UevConfiguration -Computer

          View the UE-V agent configuration settings values for all users on the computer.

          Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location>

          Define a per-computer settings storage location.

          Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location>

          Define a per-user settings storage location.

          Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds>

          Set the synchronization timeout in milliseconds

          Set-UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds>

          Set the synchronization timeout for the current user.

          Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>

          Configure the UE-V agent to report when a settings package file size reaches a defined threshold. Set the threshold package size in bytes.

          Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>

          Set the package size warning threshold for the current user.

          Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog>

          Set the settings template catalog path.

          Set-UevConfiguration -Computer -SyncMethod <sync method>

          Set the synchronization method: OfflineFiles or None.

          Set-UevConfiguration -CurrentComputerUser -SyncMethod <sync method>

          Set the synchronization method for the current user: OfflineFiles or None.

          Set-UEVConfiguration -Computer –EnableSettingsImportNotify

          Enable notification to occur when the import of user settings is delayed.

          -

          Use –DisableSettingsImportNotify to disable notification.

          Set-UEVConfiguration - CurrentComputerUser -EnableSettingsImportNotify

          Enable notification for the current user when the import of user settings is delayed.

          -

          Use –DisableSettingsImportNotify to disable notification.

          Set-UEVConfiguration -Computer -SettingsImportNotifyDelayInSeconds

          Specify the time in seconds before the user is notified

          Set-UEVConfiguration - CurrentComputerUser -SettingsImportNotifyDelayInSeconds

          Specify the time in seconds before notification for the current user.

          Set-UevConfiguration –Computer –DisableSync

          Disable UE-V for all the users on the computer.

          -

          Use –EnableSync to enable or re-enable.

          Set-UevConfiguration –CurrentComputerUser -DisableSync

          Disable UE-V for the current user on the computer.

          -

          Use –EnableSync to enable or re-enable.

          Clear-UevConfiguration –Computer -<setting name>

          Clear a specific setting for all users on the computer.

          Clear-UevConfiguration –CurrentComputerUser -<setting name>

          Clear a specific setting for the current user only.

          Export-UevConfiguration <settings migration file>

          Export the UE-V computer configuration to a settings migration file. The extension of the file must be “.uev”.

          -

          The export cmdlet exports all UE-V agent settings that are configurable with the -computer parameter.

          Import-UevConfiguration <settings migration file>

          Import the UE-V computer configuration from a settings migration file (.uev file).

          - - - -**How to export UE-V package settings and repair UE-V templates with PowerShell** - -1. Open a PowerShell window as an Administrator. Import the UE-V PowerShell module with the following command. - - ``` syntax - Import-module UEV - ``` - -2. Use the following PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - -

          PowerShell command

          Description

          Export-UevPackage MicrosoftCalculator6.pkgx

          Extracts the settings from a Microsoft Calculator package file and converts them into a human-readable format in XML.

          Repair-UevTemplateIndex

          Repairs the index of the UE-V settings location templates.

          - - - -**How to configure the UE-V Agent with WMI** - -1. User Experience Virtualization provides the following set of WMI commands. Administrators can use this interface to configure the UE-V agent from the command line and automate typical configuration tasks. - - Use an account with administrator rights to open a PowerShell window. - -2. Use the following WMI commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PowerShell commandDescription

          Get-WmiObject -Namespace root\Microsoft\UEV Configuration

          -

          View the active UE-V agent settings. User-specific settings have precedence over the computer settings.

          Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

          View the UE-V agent configuration that is defined for user.

          Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          View the UE-V agent configuration that is defined for computer.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.SettingsStoragePath = <path_to_settings_storage_location>

          -

          $config.Put()

          Define a per-computer settings storage location.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

          -

          $config.SettingsStoragePath = <path_to_settings_storage_location>

          -

          $config.Put()

          Define a per-user settings storage location.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.SyncTimeoutInMilliseconds = <timeout_in_milliseconds>

          -

          $config.Put()

          Set the synchronization timeout in milliseconds.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.MaxPackageSizeInBytes = <size_in_bytes>

          -

          $config.Put()

          Configure the UE-V agent to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.SyncMethod = <sync_method>

          -

          $config.Put()

          Set the synchronization method: OfflineFiles or None.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.<setting name> = <setting value>

          -

          $config.Put()

          Update a specific per-computer setting. To clear the setting, use $null as the setting value.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.<setting name> = <setting value>

          -

          $config.Put()

          Update a specific per-user setting. To clear the setting, use $null as the setting value.

          - - - -~~~ -Upon configuration of the UE-V Agent with WMI and PowerShell, the defined configuration is stored in the registry in the following locations: - -`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration` - -`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration` -~~~ - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md b/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md deleted file mode 100644 index 337ac0882d..0000000000 --- a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md +++ /dev/null @@ -1,198 +0,0 @@ ---- -title: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI -description: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI -author: levinec -ms.assetid: 4b911c78-a5e9-4199-bfeb-72ab764d47c1 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings captured and applied by User Experience Virtualization. UE-V includes a set of standard settings location templates. It also includes the UE-V Generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates you can manage those templates using PowerShell or WMI. - -## Manage settings location templates with WMI and PowerShell - - -The WMI and PowerShell features of UE-V include the ability to enable, disable, register, update, and unregister settings location templates. By using these features, you can automate the process of registering, updating, or unregistering templates with the UE-V agent. You can also manually register templates using WMI and PowerShell commands. By using these features in conjunction with an electronic software distribution solution, Group Policy, or another automated deployment method such as a script, you can further automate that process. - -You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable or disable templates. - -**To manage settings location templates with PowerShell** - -1. Use an account with administrator rights to open a Windows PowerShell window. To import the **Microsoft UE-V PowerShell** module, type the following command at the PowerShell command prompt. - - ``` syntax - Import-module UEV - ``` - -2. Use the following PowerShell cmdlets to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PowerShell commandDescription

          Get-UevTemplate

          Lists all the settings location templates registered on the computer.

          Register-UevTemplate

          Registers a settings location template with UE-V. Once a template is registered, UE-V will synchronize the settings that are defined in the template between computers that have the template registered.

          Unregister-UevTemplate

          Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V will no longer synchronize the settings that are defined in the template between computers.

          Update-UevTemplate

          Updates a settings location template with a more recent version of the template. The new template should have a version that is later than the existing one.

          Disable-UevTemplate

          Disables a settings location template for the current user of the computer.

          Enable-UevTemplate

          Enables a settings location template for the current user of the computer.

          Test-UevTemplate

          Determines whether a given settings location template complies with its XML schema.

          - - - -The UE-V PowerShell features allow you to manage a group of settings templates deployed in your enterprise. To manage a group of templates using PowerShell, do the following. - -**To manage a group of settings location templates with PowerShell** - -1. Modify or update the desired settings location templates. - -2. Deploy the desired settings location templates to a folder accessible to the local computer. - -3. On the local computer, open a Windows PowerShell window with administrator rights. - -4. Import the Microsoft UE-V PowerShell module, by typing the following command. - - ``` syntax - Import-module UEV - ``` - -5. Unregister all the previously registered versions of the templates by typing the following command. - - ``` syntax - Get-UevTemplate | Unregister-UevTemplate - ``` - - This will unregister all active templates on the computer. - -6. Register the updated templates by typing the following command. - - ``` syntax - Register-UevTemplate \*.xml - ``` - - This will register all of the settings location templates located in the specified template folder. - -User Experience Virtualization provides the following set of WMI commands. Administrators can use these interfaces to manage settings location templates from Windows PowerShell and automate template administrative tasks. - -**To manage settings location templates with WMI** - -1. Use an account with administrator rights to open a Windows PowerShell window. - -2. Use the following WMI commands to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          PowerShell command

          Description

          Get-WmiObject -Namespace root\Microsoft\UEV SettingsLocationTemplate | Select-Object TemplateId,TemplateName, TemplateVersion,Enabled | Format-Table -Autosize

          Lists all the settings location templates registered for the computer.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Register -ArgumentList <template path >

          Registers a settings location template with UE-V.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name UnregisterByTemplateId -ArgumentList <template ID>

          Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V will no longer synchronize the settings that are defined in the template between computers.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name EnableByTemplateId -ArgumentList <template ID>

          Enables a settings location template with UE-V

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name DisableByTemplateId -ArgumentList <template ID>

          Disables a settings location template with UE-V

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Update -ArgumentList <template path>

          Updates a settings location template with UE-V. The new template should have a version that is higher than the existing one.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Validate -ArgumentList <template path>

          Determines whether a given settings location template complies with its XML schema.

          - - - -**How to deploy the UE-V agent with PowerShell** - -1. Stage the UE-V installer file in an accessible network share. - - **Note**   - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer Files versions, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time using the installation file, you must use the same file type. - - - -2. Use one of the following PowerShell commands to install the agent. - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -## Related topics - - -[Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md deleted file mode 100644 index 5d165bb12f..0000000000 --- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes -author: levinec -ms.assetid: 920f3fae-e9b5-4b94-beda-32c19d31e94b -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization. - -### Registry settings fail to synchronize between App-V and native applications on the same computer - -When a computer has an application that is available through both the Application Virtualization (App-V) application and a native installation application (installed with an .msi file), the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Windows 8 setting synchronization fails with error: "boost::filesystem::exists::Incorrect user name or password" - -The Windows® 8 operating system settings synchronization fails with the following error message: **boost::filesystem::exists::Incorrect user name or password**. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. Network shares that are used for UE-V settings storage locations should reside in the same Active Directory domain as the user. Otherwise, the following error might occur: "Incorrect user name or password". - -WORKAROUND: Use network shares from the same Active Directory domain as the user. . - -### Email signature roaming for Outlook 2010 - -UE-V will roam the Outlook 2010 signature files between devices. However, the default signature options for new messages and replies/forwards are not.  These two settings are stored in the Outlook profile, which UE-Vdoes not roam. - -WORKAROUND: None. - -### Synchronization settings do not synchronize on expected interval when running in slow-link mode - -Under normal conditions, settings storage locations should be available over a fast link network connection. In slow-link mode, synchronization will only occur on a periodic basis. By default, the slow-link mode synchronization schedule is set to every 360 minutes. - -WORKAROUND: To change the frequency of the background synchronization for computers in slow-link mode, you can configure the Group Policy for Background Sync policy for **Offline files**. - -### Special characters do not synchronize - -Certain characters, such as currency symbols, do not synchronize between Windows 7 and Windows 8 computers that run the UE-V agent. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here. ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### Other folders on the share with the setting storage location are unavailable in slow-connection mode - -Settings store shares should not be located on a network share that is used for other folders that must always be available. When the network share that hosts the setting storage location goes into slow-connection mode, the only available folder is the settings storage location folder. Other folders on the Share are not available in slow-connection mode. - -Workaround: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Paths longer than 260 characters are not supported - -Settings storage paths that are longer than 260 characters are not supported. Copying the UE-V settings packages to settings storage paths that are longer than 260 characters will fail and generate the following exception message in the UE-V operational event log: **\[boost::filesystem::copy\_file: The system cannot find the path specified\]**. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. - -File settings paths that are longer than 260 characters are not currently supported. File settings that are referenced in UE-V settings location templates cannot be located in a directory path that is longer than 260 characters. - -WORKAROUND: None. - -### UE-V agent delays upon logout or login - -If a logon or logout occurs before Offline Files has determined that a slow link is in place, logout or login might be delayed. The Offline Files feature may take up to three minutes to detect the current network state. If the logon or shutdown occurs before Offline Files has determined that the computer is connected to a slow link, the UE-V settings package will be sent to the server instead of the local cache. - -WORKAROUND: None. - -### Settings conflict when trying to roam operating system settings on Windows 8 - -On Windows 8 if Microsoft Account Sync is enabled along with UE-V for operating system settings, the settings that are applied may be inconsistent. - -WORKAROUND: Do one of the following: - -- Disable Microsoft Account Sync if you are using UE-V to roam operating system settings - -- Disable UE-V for operating system settings - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale will only roam across like operating system versions of Windows. For example currency characters will only roam from Windows 7 to Windows 7. - -WORKAROUND: None - -### Internet Explorer bookmarks do not appear in the Internet Explorer smartbar - -When Internet Explorer bookmarks roam from one computer to another computer, the index on the second computer cannot update, so when typing in the address bar, the favorite will not appear as a possible search result on computer 2. - -WORKAROUND: None - - - - - - - - - diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md deleted file mode 100644 index f7a444bf69..0000000000 --- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes -author: levinec -ms.assetid: 447fae0c-fe87-4d1c-b616-6f92fbdaf6d5 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) 1.0 Service Pack 1 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization 1.0 SP1. - -### Registry settings fail to synchronize between App-V and native applications on the same computer - -When a computer has an application that is available through both the Application Virtualization (App-V) application and a native installation application installed with a Windows Installer (.msi file), the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Windows 8 setting synchronization fails when network share is outside user’s domain - -When Windows® 8 attempts operating system settings synchronization, the synchrnization fails with the following error message: **boost::filesystem::exists::Incorrect user name or password**. This error can indicate that the network share is outside the user’s domain. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. Network shares that are used for UE-V settings storage locations should reside in the same Active Directory domain as the user. - -WORKAROUND: Use network shares from the same Active Directory domain as the user. . - -### Email signature roaming for Outlook 2010 - -UE-V will roam the Outlook 2010 signature files between devices. However, the default signature options for new messages and replies/forwards are not roamed. These two settings are stored in the Outlook profile, which UE-V does not roam. - -WORKAROUND: None. - -### Synchronization settings do not synchronize on expected interval when running in slow-link mode - -Under normal conditions, settings storage locations should be available over a fast link network connection. In slow-link mode, synchronization will only occur on a periodic basis. By default, the slow-link mode synchronization schedule is set to every 360 minutes. - -WORKAROUND: To change the frequency of the background synchronization for computers in slow-link mode, you can configure the Group Policy for Background Sync policy for **Offline files**. - -### Special characters do not synchronize - -Certain characters, such as currency symbols, do not synchronize between Windows 7 and Windows 8 computers that run the UE-V agent. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### MSI’s are not localized - -UE-V 1.0 SP1 includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -WORKAROUND: None - -### Other folders on the share with the setting storage location are unavailable in slow-connection mode - -Settings store shares should not be located on a network share that is used for other folders that must always be available. When the network share that hosts the setting storage location goes into slow-connection mode, the only available folder is the settings storage location folder. Other folders on the Share are not available in slow-connection mode. - -Workaround: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID). If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -WORKAROUND: None. - -### UE-V agent delays upon logout or login - -If a logon or logout occurs before Offline Files has determined that a slow link is in place, logout or login might be delayed. The Offline Files feature may take up to three minutes to detect the current network state. If the logon or shutdown occurs before Offline Files has determined that the computer is connected to a slow link, the UE-V settings package will be sent to the server instead of the local cache. - -WORKAROUND: None. - -### Settings conflict when trying to roam operating system settings on Windows 8 - -On Windows 8 if Microsoft Account Sync is enabled along with UE-V for operating system settings, the settings that are applied may be inconsistent. - -WORKAROUND: Do one of the following: - -- Disable Microsoft Account Sync if you are using UE-V to roam operating system settings - -- Disable UE-V for operating system settings - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale will only roam across like operating system versions of Windows. For example currency characters will only roam from Windows 7 to Windows 7. - -WORKAROUND: None - -  - -  - - - - - diff --git a/mdop/uev-v1/migrating-ue-v-settings-packages.md b/mdop/uev-v1/migrating-ue-v-settings-packages.md deleted file mode 100644 index a1b84ee0b2..0000000000 --- a/mdop/uev-v1/migrating-ue-v-settings-packages.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Migrating UE-V Settings Packages -description: Migrating UE-V Settings Packages -author: levinec -ms.assetid: 93d99254-3e17-4e96-92ad-87059d8554a7 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Migrating UE-V Settings Packages - - -In the lifecycle of a Microsoft User Experience Virtualization (UE-V) deployment, you might need to relocate the user settings packages either when migrating to a new server or for backup purposes. Migration of settings packages might be needed in the following scenarios: - -- Upgrade of existing server hardware to a more modern server. - -- Migration of a settings storage location share from a lab to a production server. - -Simply copying the files and folders will not preserve the security settings and permissions. The following described steps will properly copy the settings package files with their NTFS permissions to a new share. - -**How to preserve UE-V settings packages when migrating to a new server** - -1. In a new location on a different server, create a new folder; for example, MySettings. - -2. Disable sharing for the old folder share on the old server. - -3. Move the existing settings packages to the new server with Robocopy from the command line. For example: - - ``` syntax - c:\start robocopy "\\servername\E$\MySettings" "\\servername\E$\MySettings" /b /sec /secfix /e /LOG:D:\Robocopylogs\MySettings.txt - ``` - - **Note**   - To monitor the copy progress, open MySettings.txt with a log file reader such as Trace32. - - - -4. Grant share-level permissions to the new share. Leave the NTFS permissions as they were set by Robocopy. - - On computers that run the UE-V agent, update the SettingsStoragePath configuration setting to the UNC path of the new share. - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/operations-for-ue-v-10.md b/mdop/uev-v1/operations-for-ue-v-10.md deleted file mode 100644 index e2b682e720..0000000000 --- a/mdop/uev-v1/operations-for-ue-v-10.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for UE-V 1.0 -description: Operations for UE-V 1.0 -author: levinec -ms.assetid: 5b4a82fd-3145-49e8-ac06-f9cc583abe5f -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for UE-V 1.0 - - -This operations section includes information about the various types of Microsoft User Experience Virtualization (UE-V) administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform these tasks. - -## Operations information - - -- [Administering UE-V 1.0](administering-ue-v-10.md) - - This topic provides instructions for how to restore user settings, change synchronization frequency, and configure UE-V settings. - -- [Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - - This topic provides instructions for how to use the UE-V Generator and manage custom settings location templates. - -- [Administering UE-V with PowerShell and WMI](administering-ue-v-with-powershell-and-wmi.md) - - Microsoft User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets which can help administrators perform various UE-V tasks. - -- [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - - This topic covers general security considerations for UE-V and the UE-V privacy statement. - -## Other resources for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md b/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md deleted file mode 100644 index 358b709352..0000000000 --- a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Planning for Custom Template Deployment for UE-V 1.0 -description: Planning for Custom Template Deployment for UE-V 1.0 -author: levinec -ms.assetid: be76fc9a-31ca-4290-af11-7640dcb87d50 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Custom Template Deployment for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings that are captured and applied by UE-V. You can use the UE-V Generator to create custom settings location templates that let users roam the settings of applications other than those that are included in the default UE-V templates. After you test the custom template to ensure that the application settings roam correctly in a test environment, you can deploy these settings location templates to computers in the enterprise. - -You can deploy your custom settings location templates with an existing deployment infrastructure, such as Enterprise Software Distribution (ESD), with Group Policy preferences, or by configuring a UE-V settings template catalog. Templates that are deployed by using ESD or Group Policy must be registered with UE-V WMI or PowerShell. - -## Settings template catalog - - -The User Experience Virtualization settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. The UE-V agent retrieves new or updated templates from this location. The UE-V agent checks this location once each day and updates its synchronization behavior based on the templates in this folder. Templates that were added or updated in this folder since the last time that the folder was checked are registered by the UE-V agent. The UE-V agent deregisters templates that are removed from this folder. By default, templates are registered and unregistered one time per day at 3:30 A.M. local time by the task scheduler. For more information about the UE-V tasks, see [Changing the Frequency of UE-V Scheduled Tasks](changing-the-frequency-of-ue-v-scheduled-tasks.md). - -You can configure the settings template catalog path by using the install command-line options, Group Policy, WMI, or PowerShell. Templates that are stored at the settings template catalog path are automatically registered and unregistered by a scheduled task. You can customize this scheduled task as needed. - -## Replace the default Microsoft templates - - -The UE-V agent installs a default group of settings location templates for common Microsoft applications and Windows settings. If your enterprise needs customized versions of these templates, the UE-V agent can be configured to use a settings template catalog and you should then replace the default Microsoft templates. - -During the installation of the UE-V agent, the command-line parameter, `RegisterMSTemplates`, can be used to disable the registration of the default Microsoft templates. For more information about how to set the UE-V parameters, see [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md). - -When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed by the UE-V agent will be deleted from the computer, and only the templates that are located in the settings template catalog will be used. The UE-V Agent configuration setting `RegisterMSTemplates` must be set to true in order to override the default Microsoft template. - -**Note**   -If you disable this policy setting after it has been enabled, the UE-V agent will not restore the default Microsoft templates. - - - -If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, and the UE-V agent is not configured to replace the default Microsoft templates, the Microsoft templates in the catalog will be ignored. - -You can also replace the default templates by using the UE-V PowerShell features. To replace the default Microsoft Template with PowerShell, unregister all of the default Microsoft templates, and then register the customized templates. - -**Note**   -Old settings packages remain in the settings storage location even if new settings templates are deployed for an application. These packages are not read by the agent, but neither are they automatically deleted. - - - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -[Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) - -Planning for Custom Template Deployment - - - - - - - - diff --git a/mdop/uev-v1/planning-for-ue-v-10.md b/mdop/uev-v1/planning-for-ue-v-10.md deleted file mode 100644 index 5e8d26f148..0000000000 --- a/mdop/uev-v1/planning-for-ue-v-10.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Planning for UE-V 1.0 -description: Planning for UE-V 1.0 -author: levinec -ms.assetid: fc44aa5f-1d4f-4c03-b326-37ecd6bd913f -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for UE-V 1.0 - - -The goal of deployment planning is to help you successfully and efficiently deploy Microsoft User Experience Virtualization (UE-V) so that it does not disrupt the user experience or the network. There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the necessary information to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -[Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md) - -Provides prerequisites and recommended network configurations for UE-V. - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -Lists the operating systems and computer configurations that are required for UE-V. - -[Planning for UE-V Configuration](planning-for-ue-v-configuration.md) - -Includes the following topics which provide specific guidance on UE-V configuration: - -- [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) – specifies whether to use the default Microsoft settings location templates or to deploy custom templates that are created with the UE-V Generator. - -- [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) – provides options for creation and deployment of custom settings location templates. - -- [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) – helps you decide how to configure the UE-V Agent and manage settings synchronization. - -[UE-V Checklist](ue-v-checklist.md) - -Provides a list of steps to plan, deploy, and manage UE-V. - -## Other resources for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md b/mdop/uev-v1/planning-for-ue-v-configuration-methods.md deleted file mode 100644 index 7df8ae7d06..0000000000 --- a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Planning for UE-V Configuration Methods -description: Planning for UE-V Configuration Methods -author: levinec -ms.assetid: 57bce7ab-1be5-434b-9ee5-c96026bbe010 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for UE-V Configuration Methods - - -Microsoft User Experience Virtualization (UE-V) configurations determine how settings are synchronized throughout the enterprise. This topic describes how UE-V configurations are created to help you formulate a configuration plan that best meets your business requirements. - -## Configuration methods for UE-V - - -You can configure UE-V before, during, or after agent installation, depending on the configuration method that you use. - -**Group Policy:** existing Group Policy infrastructure can be used to configure UE-V before or after UE-V Agent deployment. The UE-V ADMX template enables the central management of common UE-V Agent configuration options, and it includes settings to configure UE-V synchronization. Network environments that use Group Policy can preconfigure UE-V in anticipation of agent deployment. - -[Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) - -[Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md) - -**Command-line or Batch Script Installation:** parameters that are used with the deployment of the UE-V Agent allow the configuration of many UE-V settings. Electronic software distribution systems, such as System Center Configuration Manager, use these parameters to configure their clients when deploying and installing the UE-V Agent software. For a list of installation parameters and sample installation scripts, see [Deploying the UE-V Agent](deploying-the-ue-v-agent.md). - -**PowerShell and WMI:** scripted commands using PowerShell or WMI can be used to modify configurations after the UE-V Agent has been installed. For a list of PowerShell and WMI commands, see [Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md). - -**Edit Registry Settings:** UE-V settings are stored in the registry and can be modified by using any tool that can modify registry settings, such as RegEdit. - -**Note**   -Registry modification can result in data loss or the computer becoming unresponsive. We recommend that you use other configuration methods. - - - -### UE-V configuration settings - -The following are examples of UE-V configuration settings: - -- **Setting Storage Path:** specifies the location of the file share that stores the UE-V settings. - -- **Settings Template Catalog Path:** specifies the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. - -- **Register Microsoft Templates:** specifies whether the default Microsoft templates should be registered during installation. - -- **Synchronization Method:** specifies whether the Windows Offline Files feature is used for offline support. - -- **Synchronization Timeout:** specifies the number of milliseconds that the computer waits before timeout when retrieving the user settings from the settings storage location. - -- **Synchronization Enable:** specifies whether the UE-V settings synchronization is enabled or disabled. - -- **Maximum Package Size:** specifies a settings package file threshold size in bytes at which the UE-V Agent reports a warning. - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Planning for UE-V Configuration](planning-for-ue-v-configuration.md) - - - - - - - - - diff --git a/mdop/uev-v1/planning-for-ue-v-configuration.md b/mdop/uev-v1/planning-for-ue-v-configuration.md deleted file mode 100644 index 107ce3f225..0000000000 --- a/mdop/uev-v1/planning-for-ue-v-configuration.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning for UE-V Configuration -description: Planning for UE-V Configuration -author: levinec -ms.assetid: db78dad4-78e0-45d6-a235-8b7345cb79f8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for UE-V Configuration - - -You can configure Microsoft User Experience Virtualization (UE-V) to meet the specific needs of your enterprise by defining which applications are deployed and which configurations define the UE-V behavior. - -## Plan which applications to synchronize with UE-V - - -UE-V includes a set of predefined settings location templates. UE-V also allows administrators to create custom settings location templates for other applications, including third-party or line-of-business applications that are used in the enterprise. This topic includes a list of applications that are included with the UE-V client and guidance on how to include custom settings location templates. - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -## Checklist for Evaluating Line-of-Business Applications for UE-V - - -Guidance on whether a line-of-business application should be synchronized. - -[Checklist for Evaluating Line-of-Business Applications for UE-V 1.0](checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md) - -## Plan custom template deployment - - -In order to support other applications, including third-party applications, you must create custom settings location templates by using the UE-V Generator, and deploy them to a settings template catalog. - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -## Plan for UE-V configuration - - -UE-V configurations determine how settings are synchronized throughout the enterprise. These configurations can be made before, during, or after the UE-V Agent is deployed. UE-V provides a variety of configuration methods - -[Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md b/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md deleted file mode 100644 index 86c03473c2..0000000000 --- a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: Planning Which Applications to Synchronize with UE-V 1.0 -description: Planning Which Applications to Synchronize with UE-V 1.0 -author: levinec -ms.assetid: c718274f-87b4-47f3-8ef7-5e1bd5557a9d -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning Which Applications to Synchronize with UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings that are captured and applied by UE-V. UE-V includes a set of predefined settings location templates and also allows administrators to create custom settings location templates for third-party or line-of-business applications that are used in the enterprise. - -As an administrator, when you consider which applications to include in your UE-V solution, consider which settings can be customized by users, and how and where the application stores its settings. Not all applications have settings that can be customized or that are routinely customized by users. In addition, not all applications settings can safely roam across multiple computers or environments. Synchronize settings that meet the following criteria: - -- Settings that are stored in user-accessible locations. For example, do not synchronize settings that are stored in system32 or outside HKCU section of the registry. - -- Settings that are not specific to the particular computer. For example, exclude network or hardware configurations. - -- Settings that can be synchronized between computers without risk of corrupted data. For example, do not use settings that are stored in a database file. - -## Settings location templates that are included in UE-V - - -**UE-V application settings location templates** - -The UE-V agent installation software installs the agent and registers a default group of settings location templates for common Microsoft applications. These settings location templates capture settings values for the following applications: - - ---- - - - - - - - - - - - - - - - - - - - - -
          Application categoryDescription

          Microsoft Office 2010 applications

          Microsoft Word 2010

          -

          Microsoft Excel 2010

          -

          Microsoft Outlook 2010

          -

          Microsoft Access 2010

          -

          Microsoft Project 2010

          -

          Microsoft PowerPoint 2010

          -

          Microsoft Publisher 2010

          -

          Microsoft Visio 2010

          -

          Microsoft SharePoint Workspace 2010

          -

          Microsoft InfoPath 2010

          -

          Microsoft Lync 2010

          -

          Microsoft OneNote 2010

          Browser options (Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10)

          Favorites, home page, tabs, and toolbars.

          Windows accessories

          Calculator, Notepad, WordPad.

          - - - -Application settings are applied to the application when the application is started. They are saved when the application closes. - -**UE-V Windows settings location templates** - -User Experience Virtualization includes settings location templates that capture settings values for the following Windows settings: - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows settingsDescriptionApply onDefault state

          Desktop background

          Currently active desktop background.

          Logon, unlock, remote connect.

          Enabled

          Ease of Access

          Accessibility and input settings, magnifier, Narrator, and on-Screen keyboard.

          Logon, unlock, remote connect.

          Disabled

          Desktop settings

          Start menu and Taskbar settings, Folder options, default desktop icons, additional clocks, and region and Language settings.

          Logon only.

          Disabled

          - - - -The Windows desktop background and Ease of Access settings are applied when the user logs on, when the computer is unlocked, or upon remote connection to another computer. The agent saves these settings when the user logs off, when the computer is locked, or when a remote connection is disconnected. By default, Windows desktop background settings are roamed between computers of the same operating system version. - -Windows desktop and Ease of Access settings are applied at logon before the desktop is presented to the user. To optimize the logon experience, these settings are not roamed by default. Desktop and Ease of Access settings can be enabled by using Group Policy, PowerShell, and WMI. - -UE-V does not support the roaming of settings between operating systems with different languages. For example, synchronization between English and German is not supported. The language of all computers to which UE-V roams the user settings must match. - -**Note**   -If you change the settings location templates that are provided by Microsoft, User Experience Virtualization might not work properly for the designated application or Windows settings group. - - - -## Prevent unintentional user Settings configuration - - -User Experience Virtualization checks for new user settings information, and downloads that information accordingly from a settings storage location. Then, it applies the settings to the local computer in the following cases: - -- Every time an application is launched that has a registered UE-V template. - -- When a user logs on to their computer. - -- When a user unlocks their computer. - -- When a connection is made to a remote desktop computer that has UE-V installed. - -If UE-V is installed on computer A and computer B, and the desired settings for the application are on computer A, then computer A must open and close the application first. If an application is opened and closed on computer B first, then the application settings on computer A will be configured to be the same as the application settings on computer B. - -This scenario also applies to Windows settings. If the Windows settings on computer B should be the same as the Windows settings on computer A, then the user should logon and logoff computer A first. - -If the desired user settings are applied in the wrong order, they can be recovered by performing a restore operation for the specific application or Windows configuration on the computer on which the settings were overwritten. For more information, see [Restoring Application and Windows Settings Synchronized with UE-V 1.0](restoring-application-and-windows-settings-synchronized-with-ue-v-10.md). - -## Custom UE-V settings location templates - - -You can create custom settings location templates by using the UE-V Generator. After you create and test a custom settings location template in a test environment, you can deploy the settings location templates to computers in the enterprise. Custom settings location templates must be deployed with an existing deployment infrastructure, such as enterprise software distribution (ESD) method, with preferences, or by configuring an UE-V settings template catalog. Templates that are deployed with ESD or Group Policy must be registered by using UE-V WMI or PowerShell. For more information about custom settings location templates, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -For guidance on whether a line-of-business application should be synchronized, see [Checklist for Evaluating Line-of-Business Applications for UE-V 1.0](checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md). - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/preparing-your-environment-for-ue-v.md b/mdop/uev-v1/preparing-your-environment-for-ue-v.md deleted file mode 100644 index 17d0fcb2c2..0000000000 --- a/mdop/uev-v1/preparing-your-environment-for-ue-v.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Preparing Your Environment for UE-V -description: Preparing Your Environment for UE-V -author: levinec -ms.assetid: c93d3b33-e032-451a-9e1b-8534e1625396 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing Your Environment for UE-V - - -Microsoft User Experience Virtualization (UE-V) roams settings between computers by the use of a settings storage location. The settings storage location is a file share and should be configured during the UE-V Agent deployment. It must be defined either as a settings storage location or as an Active Directory home directory. In addition, the administrator should configure a time server to support consistent synchronization. To prepare your environment for UE-V, you should consider the following: - -- [UE-V Settings Storage](#bkmk-uevsettingsstorage): - - - [Defining a Settings Storage Location](#bkmk-definingsettingsstoragelocation) - - - [Using Active Directory Home Directory with UE-V](#bkmk-usingactivedirectoryhomedirectory) - -- [Synchronize Computer Clocks for UE-V Settings Synchronization](#bkmk-synchronizecomputerclocks) - -- [Performance and Capacity Planning](#bkmk-performancecapacityplanning) - -For more information about operating system and computer requirements, see [Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md). - -## UE-V settings storage - - -You can define the User Experience Virtualization settings storage in one of two configurations: a settings storage location or an Active Directory home directory. - -### Define a settings storage location - -The UE-V settings storage location is a standard network share that is accessible by UE-V users. Before you define the settings storage location, you must create a root directory. Users who will store settings on the share must have read/write permissions to the storage location. The UE-V Agent will create user-specific folders under this root directory. The settings storage location is defined by setting the **SettingsStoragePath** configuration option. This option can be configured in the following ways: - -- During the installation of the UE-V agent through a command-line parameter or in a batch script. - -- Using Group Policy. - -- After installation, by using PowerShell or WMI. - -The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\\\server\\settingsshare\\**. This configuration option supports the use of variables to enable specific roaming scenarios. - -You can use the `%username%` variable with the UNC path of the server and share. This will provide the same settings experience on all computers or sessions that a user logs into. Consider this configuration for the following scenarios: - -1. Users in the enterprise have multiple, similarly configured physical computers and each user’s settings should be the same across all computers. - -2. Users in the enterprise use virtual desktop infrastructure (VDI) pools where settings should be retained across each user’s VDI sessions. - -3. Users in the enterprise have one physical computer and additionally use a VDI. Each user’s settings experience should be the same whether using the physical computer or VDI session. - -4. Multiple enterprise computers are used by multiple users. Each user’s settings experience should be the same across all computers. - -You can use the **%username%\\%computername%** variables with the UNC path of the server and share. This will preserve the settings experience for each computer. Consider this configuration for the following scenarios: - -1. Users in the enterprise have multiple physical computers and you want to preserve the settings experience for each computer. - -2. The enterprise computers are used by multiple users. The settings experience should be preserved for each computer that the user logs into. - -The UE-V agent dynamically creates the user-specific settings storage path based on a UE-V `SettingsStoragePath` configuration setting and the variables that are defined. - -The UE-V agent dynamically creates a hidden system folder named `SettingsPackages` within each user-specific storage location. The UE-V agent reads and writes settings to this location as defined by registered UE-V settings location templates. - -If the settings storage location is the same for a set of managed computers of a user, the applicable UE-V settings are determined by a “Last write wins” rule. The agent that runs on one computer reads and writes to the settings location independently of agents that run on other computers. The last settings and values written are the settings that are applied when the next agent reads from the settings storage location. For more information, see [Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md). - -### Use Active Directory home directory with UE-V - -If no settings storage location is configured for UE-V when the agent is deployed, then the user’s Active Directory (AD) home directory is used to store settings location packages. The UE-V agent dynamically creates the settings storage folder below the root of the AD home directory of each user. The agent only uses the Active Directory home directory if a settings storage location (SettingsStoragePath) is not otherwise defined. - -## Synchronize computer clocks for UE-V settings synchronization - - -Computers that run the UE-V agent to synchronize settings must use a time server. Time stamps are used to determine if settings need to be synchronized from the settings storage location. If the computer clock is inaccurate, older settings can overwrite newer settings, or the new settings might not be saved to the settings storage location. The use of a time server enables UE-V to maintain a consistent settings experience. - -## Performance and capacity planning - - -Capacity requirements for UE-V can be determined by use of standard disk capacity and network health monitoring. UE-V uses a Server Message Block (SMB) share for the storage of settings packages. The size of settings packages varies depending on the settings information for a specific application. While most settings packages are small, the synchronization of potentially large files, such as desktop images, can result in poor performance, particularly on slower networks. To minimize problems with network latency, you should create settings storage locations on the same local networks where the users’ computers reside. - -By default, the UE-V synchronization will time out after 2 seconds if the network is slow or the settings package is large. You can configure the timeout with Group Policy. For more information about how to set the timeout, see [Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md). - -## Related topics - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md b/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md deleted file mode 100644 index 0e614c1ba2..0000000000 --- a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Restoring Application and Windows Settings Synchronized with UE-V 1.0 -description: Restoring Application and Windows Settings Synchronized with UE-V 1.0 -author: levinec -ms.assetid: 254a16b1-f186-44a4-8e22-49a4ee87c734 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restoring Application and Windows Settings Synchronized with UE-V 1.0 - - -WMI and PowerShell features of Microsoft User Experience Virtualization (UE-V) provide the ability to restore settings packages. WMI and PowerShell commands allow you to restore application and Windows settings to the settings values that were on the computer the first time the application launched after the UE-V Agent was installed. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application is run or when the user logs on to the operating system. - -**To restore application settings and Windows settings with PowerShell** - -1. Open the Windows PowerShell window. To import the Microsoft UE-V PowerShell module, enter the following command: - - ``` syntax - Import-module UEV - ``` - -2. Enter the following PowerShell cmdlet to restore the application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
          PowerShell cmdletDescription

          Restore-UevUserSetting

          Restores the user settings for an application or restores a group of Windows settings

          - -   - -**To restore application settings and Windows settings with WMI** - -1. Open a PowerShell window. - -2. Enter the following WMI command to restore application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
          WMI commandDescription

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList <template_ID>

          Restores the user settings for an application or restores a group of Windows settings

          - -   - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md b/mdop/uev-v1/security-and-privacy-for-ue-v-10.md deleted file mode 100644 index 8c096e4a6a..0000000000 --- a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Security and Privacy for UE-V 1.0 -description: Security and Privacy for UE-V 1.0 -author: levinec -ms.assetid: c23d867d-7991-4c78-a123-a8a92758e5ba -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for UE-V 1.0 - - -The following listed topics can help you plan for security and privacy considerations in Microsoft User Experience Virtualization (UE-V). - -## Security considerations for UE-V 1.0 - - -There are many security-related considerations that you should plan for when you deploy and use UE-V. The Security Considerations topic provides an overview of Active Directory Domain Services user accounts and groups, log files, and other security-related considerations for UE-V. - -[UE-V 1.0 Security Considerations](ue-v-10-security-considerations.md) - -## Privacy for UE-V 1.0 - - -The information in this section explains many of the data collection and use practices of UE-V. - -[User Experience Virtualization Privacy Statement](user-experience-virtualization-privacy-statement.md) - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Administering UE-V 1.0](administering-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md b/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md deleted file mode 100644 index df91e27c64..0000000000 --- a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Sharing Settings Location Templates with the UE-V Template Gallery -description: Sharing Settings Location Templates with the UE-V Template Gallery -author: levinec -ms.assetid: 3830ae0c-96dd-4a8d-96a2-df87aea81b27 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Sharing Settings Location Templates with the UE-V Template Gallery - - -## Share location templates with the template gallery - - -The Microsoft User Experience Virtualization (UE-V) template gallery allows administrators to share their UE-V settings location templates. In the gallery, you can upload your settings location templates for other people to use, and you can download templates that other people have created. The UE-V template gallery is located on Microsoft TechNet here: . - -Before you share a settings location template on the UE-V template gallery, make sure it does not contain any personal or company information. You can use any XML viewer to open and view the contents of a settings location template file. The following template values should be reviewed before you share it with anyone outside your company. - -- Template Author Name – Specify a general, non-identifying name for the template author name or exclude this data from the template. - -- Template Author Email – Specify a general, non-identifying template author email or exclude this data from the template. - -Before you deploy any settings location template that you have downloaded from the UE-V gallery, you should first test the template to ensure that the application settings roam correctly in a test environment. - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/supported-configurations-for-ue-v-10.md b/mdop/uev-v1/supported-configurations-for-ue-v-10.md deleted file mode 100644 index 38776f7cf8..0000000000 --- a/mdop/uev-v1/supported-configurations-for-ue-v-10.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -title: Supported Configurations for UE-V 1.0 -description: Supported Configurations for UE-V 1.0 -author: levinec -ms.assetid: d90ab83e-741f-48eb-b1d8-a64cb9259f7a -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Supported Configurations for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) supports the following described configurations. - -**Note**   -Microsoft provides support for the current service pack, and in some cases, the preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For more information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -## Supported configurations for UE-V Agent and UE-V Generator - - -The following table lists the operating systems that support the User Experience Virtualization Generator and the User Experience Virtualization agent. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architectureMicrosoft .NET Framework

          Windows 7

          Ultimate, Enterprise, or Professional Edition

          SP1

          32-bit or 64-bit

          .NET Framework 3.5 SP1

          -

          .NET Framework 4 (Generator)

          Windows Server 2008 R2

          Standard, Enterprise, Data Center, or Web Server

          SP1

          64-bit

          .NET Framework 3.5 SP1

          -

          .NET Framework 4 (Generator)

          Windows 8

          Enterprise or Professional Edition

          None

          32-bit or 64-bit

          .NET Framework 4 or .NET Framework 3.5 SP1 (Agent)

          -

          .NET Framework 4 (Generator)

          Windows Server 2012

          Standard or Datacenter

          None

          64-bit

          .NET Framework 4 or .NET Framework 3.5 SP1 (Agent)

          -

          .NET Framework 4 (Generator)

          - - - -There are no special RAM requirements that are specific to UE-V. - -The installation of the UE-V agent requires administrative rights and will require a restart the computer before the UE-V agent can run. - -**Important**   -The Sync Your Settings feature in Windows 8 must be disabled to allow UE-V to function properly. Synchronization of settings with both Windows 8 and UE-V will result in unpredictable synchronization behavior. - - - -### Requirements for the Offline Files feature - -The UE-V agent can synchronize user settings for computers that are not always connected to the enterprise network, such as a laptop computer or computers that are located at remote offices, as well as computers that are always connected to the enterprise network, such as Windows Servers that host virtual desktop interface (VDI) sessions. - -The UE-V default configuration uses the Windows Offline File feature to synchronize settings. Offline Files ensures that the user’s settings are available even when the computer leaves the enterprise network. Any changes that are made to settings are automatically synchronized with the settings storage location when the connection to the enterprise network is reestablished. Offline Files also ensures that the user’s settings are available for computers that are located in a remote office with a slow or limited connection. - -To synchronize settings for computers that occasionally leave the enterprise network, the Offline Files feature must be enabled and started before the UE-V agent deployment begins. The Offline Files feature is enabled by default on Windows 7. The feature is disabled by default on Windows Server 2008 R2, Windows Server 2012, and Windows 8. If the Offline Files feature is not enabled, then UE-V settings synchronization will fail. - -- **Windows 7** - - The Offline Files feature is enabled by default on Windows 7. If necessary, Offline Files can be enabled by using the following command at an elevated command prompt: - - ``` syntax - sc config CscService start=auto - ``` - -- **Windows 8** - - The Offline Files feature is disabled by default on Windows 8 version. Offline Files can be enabled on Windows 8 by using the following command at an elevated command prompt: - - ``` syntax - sc config CscService start=auto - ``` - -- **Windows Server 2008 R2, and Windows Server 2012** - - The Offline Files feature is not installed by default on Windows Server 2008 R2 or Windows Server 2012. In order to enable the Offline Files feature, the Desktop Experience pack must be installed. This is an optional server component that includes the Offline Files feature. Once it is installed, start the Offline Files feature with the following commands at an elevated command prompt: - - ``` syntax - sc config csc start= system - ``` - - ``` syntax - sc config cscservice start= auto - ``` - -The computer must be rebooted before the settings will start to synchronize. - -### Synchronization for computers with always-available connections - -When you use UE-V on computers that are always connected to the enterprise network, such as a Windows Server computer that hosts VDI sessions, then Offline Files should be disabled. - -When the UE-V agent is configured to synchronize settings without using Offline Files, the settings storage server is treated as a standard network share. Settings are synchronized when the network is available. In this configuration the UE-V agent can be configured to give a notification if the import of the application settings is delayed. - -If the Offline Files feature will not be used, you must disable the UE-V default behavior before or during the UE-V agent deployment. To disable Offline Files for UE-V, do one of the following: - -- Before you deploy the UE-V agent, mark the “Do not use Offline Files” checkbox in the UE-V Group Policy setting. - -- During UE-V installation, set the AgentSetup.exe parameter `SyncMethod = None` at the command prompt or in a batch file. For more information about how to deploy the agent, see [Deploying the UE-V Agent](deploying-the-ue-v-agent.md). - -If you disable the Offline Files setting for UE-V and you do not specify the **SyncMethod** parameter at the installation time, the UE-V agent installation will fail. You can also disable the Offline Files with PowerShell or WMI. For more information about WMI and PowerShell commands, see [Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md). - -The computer must be rebooted before the settings will start to synchronize. - -### Prerequisites for the UE-V PowerShell feature - -The UE-V PowerShell feature of the agent requires .NET Framework version 3.5 SP1 to be enabled and PowerShell version 2.0 or higher. - -### Prerequisites for UE-V Generator support - -Install the UE-V Generator on the computer that is used to create custom settings location templates. This computer should have those applications installed whose settings will roam. You must be a member of the Administrators group on the computer that runs the UE-V Generator software. Additionally, the UE-V Generator must be installed on a computer that uses an NTFS file system. The UE-V Generator software requires .NET Framework version 4. For more information, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -Supported Configurations for User Experience Virtualization -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) - -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -[Deploying the UE-V Agent](deploying-the-ue-v-agent.md) - - - - - - - - - diff --git a/mdop/uev-v1/troubleshooting-ue-v-10.md b/mdop/uev-v1/troubleshooting-ue-v-10.md deleted file mode 100644 index 74d1546a02..0000000000 --- a/mdop/uev-v1/troubleshooting-ue-v-10.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Troubleshooting UE-V 1.0 -description: Troubleshooting UE-V 1.0 -author: levinec -ms.assetid: e40f46a9-34f6-40ee-801b-9bf91f65c0e1 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting UE-V 1.0 - - -Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## Find troubleshooting information - - -You can use the following information to find troubleshooting content or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. After you search the MDOP documentation, you can search the troubleshooting information for the product in the TechNet Wiki. These search methods are described in the following sections. - -**To search the MDOP product documentation** - -1. Open a web browser and navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) home page on TechNet. - -2. Locate the **Search TechNet with Bing** search box and enter your search term. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Open a web browser and navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Locate the **Search TechNet Wiki** search box and enter your search term. - -3. Review the search results for assistance. - -## Create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Open a web browser and navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log on with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article** in the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Give the article a descriptive title and then overwrite the template information as needed to create your article. - -7. After you review your article, add a tag that is named **Troubleshooting** and another tag for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/ue-v-10-security-considerations.md b/mdop/uev-v1/ue-v-10-security-considerations.md deleted file mode 100644 index 0fec0a0670..0000000000 --- a/mdop/uev-v1/ue-v-10-security-considerations.md +++ /dev/null @@ -1,256 +0,0 @@ ---- -title: UE-V 1.0 Security Considerations -description: UE-V 1.0 Security Considerations -author: levinec -ms.assetid: c5cdf9ff-dc96-4491-98e9-0eada898ffe0 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UE-V 1.0 Security Considerations - - -This topic contains a brief overview of accounts and groups, log files, and other security-related considerations for Microsoft User Experience Virtualization (UE-V). For more information, follow the links that are provided here. - -## Security considerations for UE-V configuration - - -**When you create the settings storage share, limit the share access to users that need access.** - -Because settings packages may contain personal information, you should take care to protect them as well as possible. In general, do the following: - -- Restrict the share to only the users that need access. Create a security group for users that have redirected folders on a particular share, and limit access to only those users. - -- When you create the share, hide the share by putting a $ after the share name. This will hide the share from casual browsers, and the share will not be visible in My Network Places. - -- Only give users the minimum amount of permissions needed. The permissions needed are shown in the tables below. - - 1. Set the following share-level (SMB) permissions for the setting storage location folder: - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissions

          Everyone

          No Permissions

          Security group of UE-V

          Full Control

          - - - -~~~ -2. Set the following NTFS permissions for the settings storage location folder: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissionsFolder

          Creator/Owner

          No Permissions

          No Permissions

          Domain Admins

          Full Control

          This Folder, Subfolders and Files

          Security group of UE-V users

          List Folder/Read Data, Create Folders/Append Data

          This Folder Only

          Everyone

          Remove all Permissions

          No Permissions

          - - - -3. Set the following share-level (SMB) permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommend permissions

          Everyone

          No Permissions

          Domain Computers

          Read Permission Levels

          Administrators

          Read/Write Permission Levels

          - - - -4. Set the following NTFS permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissionsApply to

          Creator/Owner

          Full Control

          This Folder, Subfolders and Files

          Domain Computers

          List Folder Contents and Read

          This Folder, Subfolders and Files

          Everyone

          No Permissions

          No Permissions

          Administrators

          Full Control

          This Folder, Subfolders and Files

          -~~~ - - - -### Use Windows Server 2003 or later servers to host redirected file shares - -User settings package files contain personal information that is transferred between the client computer and the server that stores the settings packages. Because of this, you should ensure that the data is protected while it travels over the network. - -User settings data is vulnerable to these potential threats: interception of the data as it passes over the network; tampering with the data as it passes over the network; and spoofing of the server that hosts the data. - -Several features of Windows Server 2003 and above can help to secure user data: - -- **Kerberos** - Kerberos is standard on all versions of Windows 2000 and Windows Server 2003 and later. Kerberos ensures the highest level of security to network resources. NTLM authenticates the client only; Kerberos authenticates the server and the client. When NTLM is used, the client does not know whether the server is valid. This is particularly important if the client is exchanging personal files with the server, as is the case with Roaming Profiles. Kerberos provides better security than NTLM. Kerberos is not available on Windows NT version 4.0 or earlier operating systems. - -- **IPsec** - The IP Security Protocol (IPsec) provides network-level authentication, data integrity, and encryption. IPsec ensures the following: - - - Roamed data is safe from data modification while en route. - - - Roamed data is safe from interception, viewing, or copying. - - - Roamed data is safe from being accessed by unauthenticated parties. - -- **SMB Signing** - The Server Message Block (SMB) authentication protocol supports message authentication which prevents active message and "man-in-the-middle" attacks. SMB signing provides this authentication by placing a digital signature into each SMB. The digital signature is then verified by both the client and the server. In order to use SMB signing, you must first either enable it or require it on both the SMB client and the SMB server. Note that the SMB signing imposes a performance penalty. It does not consume any more network bandwidth, but it uses more CPU cycles on the client and server side. - -### Always use the NTFS File system for volumes holding users data - -For the most secure configuration, configure servers that host the UE-V settings files to use the NTFS File System. Unlike FAT, NTFS supports Discretionary access control lists (DACLs) and system access control lists (SACLs). DACLs and SACLs control who can perform operations on a file and what events will trigger the logging of actions performed on a file. - -### Do not rely on EFS to encrypt users’ files when transmitted over the network - -When you use Encrypting File System (EFS) to encrypt files on a remote server, the encrypted data is not encrypted during transit over the network; It only becomes encrypted when stored on disk. - -The exceptions to this are when your system includes Internet Protocol security (IPsec) or Web Distributed Authoring and Versioning (WebDAV). IPsec encrypts data while it is transported over a TCP/IP network. If the file is encrypted before being copied or moved to a WebDAV folder on a server, it will remain encrypted during the transmission and while it is stored on the server. - -### Encrypt the Offline Files cache - -By default, the Offline Files cache is protected on NTFS partitions by ACLs, but encrypting the cache further enhances security on a local computer. By default, the cache on the local computer is not encrypted, so any encrypted files cached from the network will not be encrypted on the local computer. This may pose a security risk in some environments. - -When encryption is enabled, all files in the Offline Files cache are encrypted. This includes encrypting existing files as well as files that are added later. The cached copy on the local computer is affected, but the associated network copy is not. - -The cache can be encrypted in one of two ways: - -1. Via Group Policy. - Enable the **Encrypt the Offline Files Cache** setting, located at Computer Configuration\\Administrative Templates\\Network\\Offline Files, in the Group Policy editor. - -2. Manually. - Select Tools and then Folder Options in the command menu of Windows Explorer. Select the Offline Files tab, and then select the **Encrypt offline files to secure data** check box. - -### Let the UE-V Agent create folders for each user - -To ensure that UE-V works optimally, create only the root share on the server, and let the UE-V Agent create the folders for each user. UE-V will create these user folders with the appropriate security. - -This permission configuration allows users to create folders for settings storage. The UE-V agent creates and secures a settingspackage folder while running in the context of the user. The user receives full control to their settingspackage folder. Other users do not inherit access to this folder. You do not need to create and secure individual user directories. This will be done automatically by the agent that runs in the context of the user. - -**Note** -Additional security can be configured when a Windows server is utilized for the settings storage share. UE-V can be configured to verify that either the local administrator's group or the current user is the owner of the folder where settings packages are stored. To enable additional security use the following command: - -1. Add a REG\_DWORD registry key named "RepositoryOwnerCheckEnabled" to `HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration`. - -2. Set registry key value to 1. - -When this configuration setting is in place, the UE-V agent verifies that the local administrator’s group or current user is the owner of the settingspackage folder. If not, then the UE-V agent will not allow access to the folder. - - - -If you must create folders for the users and ensure that you have the correct permissions set. - -We strongly recommend that you do not precreate folders and that instead, you allow the UE-V agent to create the folder for the user. - -### Ensure that correct permissions are set when storing UE-V settings in a user’s home directory - -If you redirect UE-V settings to a user’s home directory, be sure that the permissions on the user's home directory are set appropriately for your organization. - -## Related topics - - -[Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/ue-v-checklist.md b/mdop/uev-v1/ue-v-checklist.md deleted file mode 100644 index 50eda2adfd..0000000000 --- a/mdop/uev-v1/ue-v-checklist.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: UE-V Checklist -description: UE-V Checklist -author: levinec -ms.assetid: 0e4b9bd5-4e60-4673-b698-90612008fc2b -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UE-V Checklist - - -Use this checklist to plan for preparing your computing environment for Microsoft User Experience Virtualization (UE-V) deployment. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TaskReferences

          Review the Getting Started information about UE-V to gain a basic understanding of the product before you begin the deployment planning.

          Getting Started With User Experience Virtualization 1.0

          Prepare your environment for UE-V 1.0 deployment.

          Preparing Your Environment for UE-V

          Plan which applications end users can synchronize with UE-V 1.0.

          Planning Which Applications to Synchronize with UE-V 1.0

          Custom settings templates only - create custom settings location templates and then define a setting template catalog.

          Deploying the Settings Template Catalog for UE-V 1.0

          -

          Create UE-V Settings Location Templates with the UE-V Generator

          Decide which method of configuration (Group Policy, PowerShell, ESD-command line, or batch file) works best for your environment and plan how to configure UE-V 1.0.

          Planning for UE-V Configuration Methods

          Deploy the network share to store settings packages.

          Deploying the Settings Storage Location for UE-V 1.0

          Custom settings templates only – deploy the features that are required to create and store applications other than the UE-V default applications.

          Deploying the Settings Template Catalog for UE-V 1.0

          -

          Installing the UE-V Generator

          Familiarize yourself with the administration and management tasks for UE-V.

          Administering UE-V 1.0

          - - - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md b/mdop/uev-v1/user-experience-virtualization-privacy-statement.md deleted file mode 100644 index 2be967fb55..0000000000 --- a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: User Experience Virtualization Privacy Statement -description: User Experience Virtualization Privacy Statement -author: levinec -ms.assetid: c2919034-f2cf-48d6-b18e-4dd318252426 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# User Experience Virtualization Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft User Experience Virtualization (“UE-V”). This is a preliminary disclosure that focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft User Experience Virtualization allows the separation of settings from an application or operating system. Those settings can then be transferred to a remote storage location, eliminating the constraints of local storage and giving users the ability to have their settings follow them to other computers. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by UE-V may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -The privacy details for each UE-V feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of Your Information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to This Privacy Statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us [MSUEVPrivacy@microsoft.com](mailto:%20MSUEVPrivacy@microsoft.com). - -## Specific features - - -The remainder of this document will address the following specific features: - -### UE-V Generator - -**What This Feature Does**: - -The UE-V generator is used to create settings location templates. These templates allow users to roam the settings for their applications. - -**Information Collected, Processed, or Transmitted**: - -When creating a settings location template the UE-V generator uses a Lightweight Directory Access Protocol (LDAP) query to get username and email address of the current logged in user. This information is stored in the template as the template author name and template author email. None of this information is sent to Microsoft. - -If you plan to share settings location templates with anyone outside your organization you should review all the settings locations and ensure the settings location template do not contain any personal or company information. You can view the contents by opening the settings location template files using any XML viewer. The following are ways you can view and remove any personal or company information from the settings location template files before sharing with anyone outside your company: - -- **Template Author Name** – Specify a general, non-identifying name for the template author name or exclude this data from the template. - -- **Template Author Email** – Specify a general, non-identifying template author email or exclude this data from the template. - -**Use of Information**: - -The template author name and template author email can be used to identify the author of settings location template. If you share the template, the author name and email is viewable to all who use the template. No information is sent to Microsoft. - -**Choice/Control**:  - -To remove the template author name or template author email, start the UE-V generator application. Select **Edit a Settings Location Template**. Select the settings location template to edit from the recently used templates or Browse to the settings template file. Select **Next** to continue. On the Properties page, remove the data from the Template author name or Template author email text fields. Save the settings location template. - -## Customer Experience Improvement Program - - -**What This Feature Does:** - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We will not collect your name, address, or other contact information. - -**Information Collected, Processed, or Transmitted:** - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -**Use of Information:** - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -**Choice/Control:** - -You are offered the opportunity to participate in CEIP during setup of the UE-V Agent. If you choose to participate and later change your mind, you can turn off CEIP at any time by:Re-running the UE-V agent setup and opting out of CEIP or by setting the following registry key either manually or via Group Policy: - -``` syntax -Key = HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent -RegEntry name = CustomerExperienceImprovementProgram -Entry type REG_DWORD (Hexadecimal): -0 is off -1 is on -``` - -## Microsoft Error Reporting - - -**What This Feature Does:** - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with UE-V or other enabled applications to Microsoft and to receive information that may help you avoid or solve such problems. - -**Information Collected, Processed, or Transmitted:** - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . - -**Use of Information:** - -We use the error reporting data to solve customer problems and improve our software and services. - -**Choice/Control:** - -If you choose the recommended settings during Windows setup, you turn on automatic checking for solutions, which will send basic error reports and look for solutions to the problems reported. If you use automatic checking, you are not typically prompted to send basic information about errors to Microsoft. If a more detailed error report is required, you will be prompted to review it. You can change this setting at any time by going to Action Center in Control Panel. - -**Important Information:** - -Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at . - -UE-V will not modify the Microsoft Error Reporting preference and will honor the system setting in the Control Panel and/or the setting enforced via Group Policy. - -## Microsoft Update - - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at - -**Use of Information:** - -- For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -- Choice/Control: - - For details about controlling this feature, see the Update Services Privacy Statement at . - -## Related topics - - -[Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md b/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md deleted file mode 100644 index 0f1b3de72d..0000000000 --- a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Validate UE-V Settings Location Templates with UE-V Generator -description: Validate UE-V Settings Location Templates with UE-V Generator -author: levinec -ms.assetid: 131c636c-173a-4b41-af5d-9a75b453b9d8 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Validate UE-V Settings Location Templates with UE-V Generator - - -It is possible to create or edit settings locations templates in an XML editor without using the UE-V Generator. If you do so, you can use the UE-V Generator to validate that the new or revised XML matches the schema that has been defined for the template. - -**To validate a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, and then point to **All Programs**. Point to **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Validate a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, you can **Browse** to the settings template file. Click **Next** to continue. - -4. Click **Validate** to continue. - -5. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you validate the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into production in the enterprise. - -## Related topics - - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md b/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md deleted file mode 100644 index dd61401c21..0000000000 --- a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Working with Custom UE-V Templates and the UE-V Generator -description: Working with Custom UE-V Templates and the UE-V Generator -author: levinec -ms.assetid: 7bb2583a-b032-4800-9bf9-eb33528e1d0d -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Working with Custom UE-V Templates and the UE-V Generator - - -In order to roam applications between user computers, Microsoft User Experience Virtualization (UE-V) uses *settings location templates*. Some settings location templates are included with User Experience Virtualization. You can also create, edit, or validate custom settings location templates with the UE-V Generator. - -The UE-V Generator monitors an application to discover and capture the locations where the application stores its settings. The application being monitored must be a traditional application. The UE-V Generator cannot create a settings location template for the following application types: - -- Virtualized applications - -- Application offered through terminal services - -- Java applications - -- Windows 8 applications - -## Create UE-V Settings Location Templates with the UE-V Generator - - -How to use the UE-V Generator to create settings location templates. - -[Create UE-V Settings Location Templates with the UE-V Generator](create-ue-v-settings-location-templates-with-the-ue-v-generator.md) - -## Edit UE-V Settings Location Templates with the UE-V Generator - - -How to use the UE-V Generator to edit settings location templates. - -[Edit UE-V Settings Location Templates with the UE-V Generator](edit-ue-v-settings-location-templates-with-the-ue-v-generator.md) - -## Validate UE-V Settings Location Templates with UE-V Generator - - -How to use the UE-V Generator to validate settings location templates modified outside the UE-V Generator. - -[Validate UE-V Settings Location Templates with UE-V Generator](validate-ue-v-settings-location-templates-with-ue-v-generator.md) - -## Standard and Nonstandard settings locations - - -The UE-V Generator helps you identify where applications look for settings files and registry settings that applications use to store settings information. You can use the UE-V Generator to open the application as part of the discovery process to capture settings in standard locations. Standard locations include the following: - -- **Registry Settings** – Registry locations under **HKEY\_CURRENT\_USER** - -- **Application Settings Files** – Files stored under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming** - -The UE-V Generator excludes locations which commonly store application software files do not roam well between user computers or environments. The UE-V Generator excludes these locations. Excluded locations are as follows: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system - -- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive (Requires Administrator rights and might require UAC agreement to set) - -- Files that are located in Program Files directories (Requires Administrator rights and might require UAC agreement to set) - -- Files located in Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files that are located in %systemroot% (Requires Administrator rights and might require UAC agreement to set) - -If registry keys and files stored in these locations are required in order to roam application settings, you can manually add the excluded locations to the settings location template during the template creation process. - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Administering UE-V 1.0](administering-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v2/TOC.md b/mdop/uev-v2/TOC.md deleted file mode 100644 index 3b2e1f1d06..0000000000 --- a/mdop/uev-v2/TOC.md +++ /dev/null @@ -1,33 +0,0 @@ -# [User Experience Virtualization 2.x](index.md) -## [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) -### [What's New in UE-V 2.1 SP1](whats-new-in-ue-v-21-sp1uevv21-sp1.md) -#### [Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) -### [What's New in UE-V 2.1](whats-new-in-ue-v-21-new-uevv2.md) -#### [Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) -### [What's New in UE-V 2.0](whats-new-in-ue-v-20-new-uevv2.md) -#### [Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) -## [Prepare and Deploy UE-V 2.x](prepare-a-ue-v-2x-deployment-new-uevv2.md) -### [Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) -### [Custom Application Deployment for UE-V 2.x](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) -## [Administer UE-V 2.x](administering-ue-v-2x-new-uevv2.md) -### [Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) -#### [Configure UE-V 2.x with Group Policy](configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md) -#### [Configure UE-V 2.x with Configuration Manager](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md) -#### [Administer UE-V 2.x with PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) -##### [Manage UE-V 2.x Agent and Packages](managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md) -##### [Manage UE-V 2.x Templates](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md) -#### [Configure the Company Settings Center for UE-V 2.x](configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md) -### [Custom UE-V 2.x Templates and the UE-V 2.x Generator](working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md) -### [Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md) -### [UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md) -### [Migrate UE-V 2.x Settings Packages](migrating-ue-v-2x-settings-packages-both-uevv2.md) -### [UE-V 2.x and App-V](using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md) -## [Troubleshoot UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) -## [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) -### [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md) -### [Sync Trigger Events for UE-V 2.x](sync-trigger-events-for-ue-v-2x-both-uevv2.md) -### [Sync Office 2013 with UE-V 2.0](synchronizing-office-2013-with-ue-v-20-both-uevv2.md) -### [Schema Reference for UE-V 2.x](application-template-schema-reference-for-ue-v-2x-both-uevv2.md) -### [Accessibility for UE-V 2.x](accessibility-for-ue-v-2x-both-uevv2.md) -### [Security Considerations for UE-V 2.x](security-considerations-for-ue-v-2x-both-uevv2.md) - diff --git a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index 349a791c43..0000000000 --- a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Accessibility for UE-V 2.x -description: Accessibility for UE-V 2.x -author: levinec -ms.assetid: ec05da5f-4558-4d4d-9b58-3b8ed68cf2fe -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for UE-V 2.x - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -You can access most commands by using two keystrokes. To use an access key: - -1. Press Alt. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter that is shown in the keyboard shortcut over the feature that you want to use. - -### Documentation in alternative formats - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally, formerly known as Recording for the Blind & Dyslexic, Inc. Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, use the following contact. - - ---- - - - - - - - - - - - - - - - - - - - - - - -

          Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

          -

          20 Roszel Road

          -

          Princeton, NJ 08540

          Telephone number from within the United States:

          (800) 221-4792

          Telephone number from outside the United States and Canada:

          (609) 452-0606

          Fax:

          (609) 987-8116

          http://www.learningally.org/

          Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here.

          - - - -### Customer service for people with hearing impairments - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time that the service is used. - -## For more information - - -For more information about how accessible technology for computers can help to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/p/?linkid=8431). - - - - - - -## Related topics - - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md deleted file mode 100644 index e25587766a..0000000000 --- a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Administering UE-V 2.x -description: Administering UE-V 2.x -author: levinec -ms.assetid: 996e4797-8383-4627-b714-24a84c907798 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering UE-V 2.x - - -After you have deployed Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1, you must be able to perform various ongoing administrative tasks, such as managing the configuration of the UE-V Agent and recovering lost settings. These post-installation tasks are described in the following sections. - -## Managing UE-V 2.x configurations - - -In the course of the UE-V lifecycle, you have to manage the configuration of the UE-V Agent and also manage storage locations for resources such as settings package files. - -[Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) - -## Working with custom UE-V templates and the UE-V 2.x Generator - - -This topic provides instructions for how to use the UE-V Generator and manage custom settings location templates. - -[Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator](working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md) - -## Backup and restore application and Windows settings that are synchronized with UE-V 2.x - - -Windows Management Instrumentation (WMI) and Windows PowerShell features of UE-V provide the ability to restore settings packages. By using WMI and Windows PowerShell commands, you can restore application and Windows settings to their original state and restore additional settings when a user adopts a new device. - -[Manage Administrative Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md) - -## Changing the frequency of UE-V 2.x scheduled tasks - - -You can configure the scheduled tasks that manage when UE-V checks for new or updated settings or for updated custom settings location templates in the settings template catalog. - -[Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md) - -## Migrating UE-V 2.x settings packages - - -You can relocate the user settings packages either when they migrate to a new server or for backup purposes. - -[Migrating UE-V 2.x Settings Packages](migrating-ue-v-2x-settings-packages-both-uevv2.md) - -## Using UE-V 2.x with Application Virtualization applications - - -You can use UE-V with Microsoft Application Virtualization (App-V) to share settings between virtual applications and installed applications across multiple computers. - -[Using UE-V 2.x with Application Virtualization Applications](using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md) - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md deleted file mode 100644 index 6acd7dcdd5..0000000000 --- a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Administering UE-V 2.x with Windows PowerShell and WMI -description: Administering UE-V 2.x with Windows PowerShell and WMI -author: levinec -ms.assetid: e749ac03-0adf-475a-a4f2-5cc023549b12 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Administering UE-V 2.x with Windows PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 provide Windows PowerShell cmdlets, which can help administrators perform various UE-V tasks. The following sections provide more information about using Windows PowerShell in UE-V. - -**Note**   -Administering UE-V 2 with Windows PowerShell requires Windows PowerShell 3.0 or higher. For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://go.microsoft.com/fwlink/p/?LinkId=393495). - - - -## Managing the UE-V 2.x Agent and packages by using Windows PowerShell and WMI - - -You can use Windows PowerShell and Windows Management Instrumentation (WMI) to manage UE-V Agent configuration and synchronization behavior. The following topic describes how to manage configuration and synchronization. The following topic describes how to manage configuration and synchronization. - -[Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI](managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md) - -## Managing UE-V 2.x settings location templates by using Windows PowerShell and WMI - - -After you create and deploy UE-V settings location templates, you can manage those templates by using Windows PowerShell or WMI. The following topic describes how to manage the settings location templates by using Windows PowerShell and WMI. - -[Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md) - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index fd3074b66a..0000000000 --- a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,1888 +0,0 @@ ---- -title: Application Template Schema Reference for UE-V 2.x -description: Application Template Schema Reference for UE-V 2.x -author: levinec -ms.assetid: be8735a5-6a3e-4b1f-ba14-2a3bc3e5a8b6 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Template Schema Reference for UE-V 2.x - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 use XML settings location templates to define the desktop application settings and Windows settings that are captured and applied by UE-V. UE-V includes a set of default settings location templates. You can also create custom settings location templates with the UE-V Generator. - -An advanced user can customize the XML file for a settings location template. This topic details the XML structure of the UE-V 2.1 (SP1) and 2.0 settings location templates and provides guidance for editing these files. - -## UE-V 2.1 and 2.1 SP1 Application Template Schema Reference - - -This section details the XML structure of the UE-V 2.1 and 2.1 SP1 settings location template and provides guidance for editing this file. - -### In This Section - -- [XML Declaration and Encoding Attribute](#xml21) - -- [Namespace and Root Element](#namespace21) - -- [Data types](#data21) - -- [Name Element](#name21) - -- [ID Element](#id21) - -- [Version Element](#version21) - -- [Author Element](#author21) - -- [Processes and Process Element](#processes21) - -- [Application Element](#application21) - -- [Common Element](#common21) - -- [SettingsLocationTemplate Element](#settingslocationtemplate21) - -- [Appendix: SettingsLocationTemplate.xsd](#appendix21) - -### XML Declaration and Encoding Attribute - -**Mandatory: True** - -**Type: String** - -The XML declaration must specify the XML version 1.0 attribute (<?xml version="1.0">). Settings location templates created by the UE-V Generator are saved in UTF-8 encoding, although the encoding is not explicitly specified. We recommend that you include the encoding="UTF-8" attribute in this element as a best practice. All templates included with the product specify this tag as well (see the documents in %ProgramFiles%\\Microsoft User Experience Virtualization\\Templates for reference). For example: - -`` - -### Namespace and Root Element - -**Mandatory: True** - -**Type: String** - -UE-V uses the http://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: - -`` - -### Data types - -These are the data types for the UE-V application template schema. - -**GUID** -GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders. - -**FilenameString** -FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters). - -**IDString** -IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+). - -**TemplateVersion** -TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647. - -**Empty** -Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates. - -**Author** -The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element. - -**Range** -Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included. - -**ProcessVersion** -ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional. - -**Architecture** -Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture. - -**Process** -The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Element

          Data Type

          Mandatory

          Filename

          FilenameString

          True

          Architecture

          Architecture

          False

          ProductName

          String

          False

          FileDescription

          String

          False

          ProductVersion

          ProcessVersion

          False

          FileVersion

          ProcessVersion

          False

          - - - -**Processes** -The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence. - -**Path** -Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”. - -Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items. - -The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server. - -**FileMask** -FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files. - -**RegistrySetting** -RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V Agent. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**. - -**FileSetting** -FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional. - -**Settings** -Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described: - - ---- - - - - - - - - - - - - - - - - - - -

          Element

          Description

          Asynchronous

          Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those get/set through an API, like SystemParameterSetting.

          PreventOverlappingSynchronization

          By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.

          AlwaysApplySettings

          (introduced in 2.1)

          -

          This parameter forces an imported settings package to be applied even if there are no differences between the package and the current state of the application. This parameter should be used only in special cases since it can slow down settings import.

          - - - -### Name Element - -**Mandatory: True** - -**Type: String** - -Name specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. In general, avoid referencing version information, as this can be objected from the ProductVersion element. For example, specify `My Application` rather than `My Application 1.1`. - -**Note**   -UE-V does not reference external DTDs, so it is not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document. - -See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V Generator converts character entities to their Unicode representations automatically. - - - -### ID Element - -**Mandatory: True** - -**Type: String** - -ID populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime (for example, see the output of the Get-UevTemplate and Get-UevTemplateProgram PowerShell cmdlets). By convention, this tag should not contain any spaces, which simplifies scripting. Version numbers of applications should be specified in this element to allow for easy identification of the template, such as `MicrosoftCalculator6` or `MicrosoftOffice2010Win64`. - -### Version Element - -**Mandatory: True** - -**Type: Integer** - -**Minimum Value: 0** - -**Maximum Value: 2147483647** - -Version identifies the version of the settings location template for administrative tracking of changes. The UE-V Generator automatically increments this number by one each time the template is saved. Notice that this field must be a whole number integer; fractional values, such as `2.5` are not allowed. - -**Hint:** You can save notes about version changes using XML comment tags ``, for example: - -```xml - - 4 -``` - -**Important**   -This value is queried to determine if a new version of a template should be applied to an existing template in these instances: - -- When the scheduled Template Auto Update task executes - -- When the Update-UevTemplate PowerShell cmdlet is executed - -- When the microsoft\\uev:SettingsLocationTemplate Update method is called through WMI - - - -### Author Element - -**Mandatory: False** - -**Type: String** - -Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V). - -### Processes and Process Element - -**Mandatory: True** - -**Type: Element** - -Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: - -```xml - - MyApplication.exe - Win64 - MyApplication - MyApplication.exe - - - - - - - - - - - - - -``` - -### Filename - -**Mandatory: True** - -**Type: String** - -Filename refers to the actual file name of the executable as it appears in the file system. This element specifies the primary criterion that UE-V uses to evaluate whether a template applies to a process or not. This element must be specified in the settings location template XML. - -Valid filenames must not match the regular expression \[^\\\\\\?\\\*\\|<>/:\]+, that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon (the \\ ? \* | < > / or : characters.). - -**Hint:** To test a string against this regex, use a PowerShell command window and substitute your executable’s name for **YourFileName**: - -`"YourFileName.exe" -match "[\\\?\*\|<>/:]+"` - -A value of **True** indicates that the string contains illegal characters. Here are some examples of illegal values: - -- \\\\server\\share\\program.exe - -- Program\*.exe - -- Pro?ram.exe - -- Program<1>.exe - -**Note**   -The UE-V Generator encodes the greater than and less than characters as > and < respectively. - - - -In rare circumstances, the FileName value will not necessarily include the .exe extension, but it should be specified as part of the value. For example, `MyApplictication.exe` should be specified instead of `MyApplictication`. The second example will not apply the template to the process if the actual name of the executable file is “MyApplication.exe”. - -### Architecture - -**Mandatory: False** - -**Type: Architecture (String)** - -Architecture refers to the processor architecture for which the target executable was compiled. Valid values are Win32 for 32-bit applications or Win64 for 64-bit applications. If present, this tag limits the applicability of the settings location template to a particular application architecture. For an example of this, compare the %ProgramFiles%\\Microsoft User Experience Virtualization\\templates\\ MicrosoftOffice2010Win32.xml and MicrosoftOffice2010Win64.xml files included with UE-V. This is useful when relative paths change between different versions of an executable or if settings have been added or removed when moving from one processor architecture to another. - -If this element is absent, the settings location template ignores the process’ architecture and applies to both 32 and 64-bit processes if the file name and other attributes apply. - -**Note**   -UE-V does not support ARM processors in this version. - - - -### ProductName - -**Mandatory: False** - -**Type: String** - -ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: - -```xml - - MyApplication.exe - My Application 6.x by Contoso.com - - - - -``` - -### FileDescription - -**Mandatory: False** - -**Type: String** - -FileDescription is an optional tag that allows for an administrative description of the executable file. This is a free text field and can be useful in distinguishing multiple executables within a software package where there is a need to identify the function of the executable. - -For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: - -```xml - - - MyApplication.exe - My Application Main Engine - - - - - - MyApplicationHelper.exe - My Application Background Process Executable - - - - - -``` - -### ProductVersion - -**Mandatory: False** - -**Type: String** - -ProductVersion refers to the major and minor product versions of a file, as well as a build and patch level. ProductVersion is an optional element, but if specified, it must contain at least the Major child element. The value must express a range in the form Minimum="X" Maximum="Y" where X and Y are integers. The Minimum and Maximum values can be identical. - -The product and file version elements may be left unspecified. Doing so makes the template “version agnostic”, meaning that the template will apply to all versions of the specified executable. - -**Example 1:** - -Product version: 1.0 specified in the UE-V Generator produces the following XML: - -```xml - - - - -``` - -**Example 2:** - -File version: 5.0.2.1000 specified in the UE-V Generator produces the following XML: - -```xml - - - - - - -``` - -**Incorrect Example 1 – incomplete range:** - -Only the Minimum attribute is present. Maximum must be included in a range as well. - -```xml - - - -``` - -**Incorrect Example 2 – Minor specified without Major element:** - -Only the Minor element is present. Major must be included as well. - -```xml - - - -``` - -### FileVersion - -**Mandatory: False** - -**Type: String** - -FileVersion differentiates between the release version of a published application and the internal build details of a component executable. For the majority of commercial applications, these numbers are identical. Where they vary, the product version of a file indicates a generic version identification of a file, while file version indicates a specific build of a file (as in the case of a hotfix or update). This uniquely identifies files without breaking detection logic. - -To determine the product version and file version of a particular executable, right-click on the file in Windows Explorer, select Properties, then click on the Details tab. - -Including a FileVersion element for an application allows for more granular fine-tuning detection logic, but is not necessary for most applications. The ProductVersion element settings are checked first, and then FileVersion is checked. The more restrictive setting will apply. - -The child elements and syntax rules for FileVersion are identical to those of ProductVersion. - -```xml - - MSACCESS.EXE - Win32 - - - - - - - - - -``` - -### Application Element - -Application is a container for settings that apply to a particular application. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Field/Type

          Description

          Name

          Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

          ID

          Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

          Description

          An optional description of the template.

          LocalizedNames

          An optional name displayed in the UI, localized by a language locale.

          LocalizedDescriptions

          An optional template description localized by a language locale.

          Version

          Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

          DeferToMSAccount

          Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

          DeferToOffice365

          Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

          FixedProfile (Introduced in 2.1)

          Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.

          Processes

          A container for a collection of one or more Process elements. For more information, see Processes.

          Settings

          A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

          - - - -### Common Element - -Common is similar to an Application element, but it is always associated with two or more Application elements. The Common section represents the set of settings that are shared between those Application instances. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Field/Type

          Description

          Name

          Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

          ID

          Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

          Description

          An optional description of the template.

          LocalizedNames

          An optional name displayed in the UI, localized by a language locale.

          LocalizedDescriptions

          An optional template description localized by a language locale.

          Version

          Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

          DeferToMSAccount

          Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

          DeferToOffice365

          Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

          FixedProfile (Introduced in 2.1)

          Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.

          Settings

          A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

          - - - -### SettingsLocationTemplate Element - -This element defines the settings for a single application or a suite of applications. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Field/Type

          Description

          Name

          Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

          ID

          Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

          Description

          An optional description of the template.

          LocalizedNames

          An optional name displayed in the UI, localized by a language locale.

          LocalizedDescriptions

          An optional template description localized by a language locale.

          - - - -### Appendix: SettingsLocationTemplate.xsd - -Here is the SettingsLocationTemplate.xsd file showing its elements, child elements, attributes, and parameters: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## UE-V 2.0 Application Template Schema Reference - - -This section details the XML structure of the UE-V 2.0 settings location template and provides guidance for editing this file. - -### In This Section - -- [XML Declaration and Encoding Attribute](#xml) - -- [Namespace and Root Element](#namespace) - -- [Data types](#data) - -- [Name Element](#name) - -- [ID Element](#id) - -- [Version Element](#version) - -- [Author Element](#author) - -- [Processes and Process Element](#processes) - -- [Application Element](#application) - -- [Common Element](#common) - -- [SettingsLocationTemplate Element](#settingslocationtemplate) - -- [Appendix: SettingsLocationTemplate.xsd](#appendix) - -### XML Declaration and Encoding Attribute - -**Mandatory: True** - -**Type: String** - -The XML declaration must specify the XML version 1.0 attribute (<?xml version="1.0">). Settings location templates created by the UE-V Generator are saved in UTF-8 encoding, although the encoding is not explicitly specified. We recommend that you include the encoding="UTF-8" attribute in this element as a best practice. All templates included with the product specify this tag as well (see the documents in %ProgramFiles%\\Microsoft User Experience Virtualization\\Templates for reference). For example: - -`` - -### Namespace and Root Element - -**Mandatory: True** - -**Type: String** - -UE-V uses the http://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: - -`` - -### Data types - -These are the data types for the UE-V application template schema. - -**GUID** -GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders. - -**FilenameString** -FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters). - -**IDString** -IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+). - -**TemplateVersion** -TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647. - -**Empty** -Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates. - -**Author** -The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element. - -**Range** -Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included. - -**ProcessVersion** -ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional. - -**Architecture** -Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture. - -**Process** -The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ElementData TypeMandatory

          Filename

          FilenameString

          True

          Architecture

          Architecture

          False

          ProductName

          String

          False

          FileDescription

          String

          False

          ProductVersion

          ProcessVersion

          False

          FileVersion

          ProcessVersion

          False

          - - - -**Processes** -The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence. - -**Path** -Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”. - -Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items. - -The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server. - -**FileMask** -FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files. - -**RegistrySetting** -RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V Agent. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**. - -**FileSetting** -FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional. - -**Settings** -Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described: - - ---- - - - - - - - - - - - - - - - - -
          ElementDescription

          Asynchronous

          Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those get/set through an API, like SystemParameterSetting.

          PreventOverlappingSynchronization

          By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.

          - - - -### Name Element - -**Mandatory: True** - -**Type: String** - -Name specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. In general, avoid referencing version information, as this can be objected from the ProductVersion element. For example, specify `My Application` rather than `My Application 1.1`. - -**Note**   -UE-V does not reference external DTDs, so it is not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document. - -See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V Generator converts character entities to their Unicode representations automatically. - - - -### ID Element - -**Mandatory: True** - -**Type: String** - -ID populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime (for example, see the output of the Get-UevTemplate and Get-UevTemplateProgram PowerShell cmdlets). By convention, this tag should not contain any spaces, which simplifies scripting. Version numbers of applications should be specified in this element to allow for easy identification of the template, such as `MicrosoftCalculator6` or `MicrosoftOffice2010Win64`. - -### Version Element - -**Mandatory: True** - -**Type: Integer** - -**Minimum Value: 0** - -**Maximum Value: 2147483647** - -Version identifies the version of the settings location template for administrative tracking of changes. The UE-V Generator automatically increments this number by one each time the template is saved. Notice that this field must be a whole number integer; fractional values, such as `2.5` are not allowed. - -**Hint:** You can save notes about version changes using XML comment tags ``, for example: - -```xml - -4 -``` - -**Important**   -This value is queried to determine if a new version of a template should be applied to an existing template in these instances: - -- When the scheduled Template Auto Update task executes - -- When the Update-UevTemplate PowerShell cmdlet is executed - -- When the microsoft\\uev:SettingsLocationTemplate Update method is called through WMI - - - -### Author Element - -**Mandatory: False** - -**Type: String** - -Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V). - -### Processes and Process Element - -**Mandatory: True** - -**Type: Element** - -Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: - -```xml - - MyApplication.exe - Win64 - MyApplication - MyApplication.exe - - - - - - - - - - - - - -``` - -### Filename - -**Mandatory: True** - -**Type: String** - -Filename refers to the actual file name of the executable as it appears in the file system. This element specifies the primary criterion that UE-V uses to evaluate whether a template applies to a process or not. This element must be specified in the settings location template XML. - -Valid filenames must not match the regular expression \[^\\\\\\?\\\*\\|<>/:\]+, that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon (the \\ ? \* | < > / or : characters.). - -**Hint:** To test a string against this regex, use a PowerShell command window and substitute your executable’s name for **YourFileName**: - -`"YourFileName.exe" -match "[\\\?\*\|<>/:]+"` - -A value of **True** indicates that the string contains illegal characters. Here are some examples of illegal values: - -- \\\\server\\share\\program.exe - -- Program\*.exe - -- Pro?ram.exe - -- Program<1>.exe - -**Note**   -The UE-V Generator encodes the greater than and less than characters as > and < respectively. - - - -In rare circumstances, the FileName value will not necessarily include the .exe extension, but it should be specified as part of the value. For example, `MyApplictication.exe` should be specified instead of `MyApplictication`. The second example will not apply the template to the process if the actual name of the executable file is “MyApplication.exe”. - -### Architecture - -**Mandatory: False** - -**Type: Architecture (String)** - -Architecture refers to the processor architecture for which the target executable was compiled. Valid values are Win32 for 32-bit applications or Win64 for 64-bit applications. If present, this tag limits the applicability of the settings location template to a particular application architecture. For an example of this, compare the %ProgramFiles%\\Microsoft User Experience Virtualization\\templates\\ MicrosoftOffice2010Win32.xml and MicrosoftOffice2010Win64.xml files included with UE-V. This is useful when relative paths change between different versions of an executable or if settings have been added or removed when moving from one processor architecture to another. - -If this element is absent, the settings location template ignores the process’ architecture and applies to both 32 and 64-bit processes if the file name and other attributes apply. - -**Note**   -UE-V does not support ARM processors in this version. - - - -### ProductName - -**Mandatory: False** - -**Type: String** - -ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: - -```xml - - MyApplication.exe - My Application 6.x by Contoso.com - - - - -``` - -### FileDescription - -**Mandatory: False** - -**Type: String** - -FileDescription is an optional tag that allows for an administrative description of the executable file. This is a free text field and can be useful in distinguishing multiple executables within a software package where there is a need to identify the function of the executable. - -For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: - -```xml - - - MyApplication.exe - My Application Main Engine - - - - - - MyApplicationHelper.exe - My Application Background Process Executable - - - - - -``` - -### ProductVersion - -**Mandatory: False** - -**Type: String** - -ProductVersion refers to the major and minor product versions of a file, as well as a build and patch level. ProductVersion is an optional element, but if specified, it must contain at least the Major child element. The value must express a range in the form Minimum="X" Maximum="Y" where X and Y are integers. The Minimum and Maximum values can be identical. - -The product and file version elements may be left unspecified. Doing so makes the template “version agnostic”, meaning that the template will apply to all versions of the specified executable. - -**Example 1:** - -Product version: 1.0 specified in the UE-V Generator produces the following XML: - -```xml - - - - -``` - -**Example 2:** - -File version: 5.0.2.1000 specified in the UE-V Generator produces the following XML: - -```xml - - - - - - -``` - -**Incorrect Example 1 – incomplete range:** - -Only the Minimum attribute is present. Maximum must be included in a range as well. - -```xml - - - -``` - -**Incorrect Example 2 – Minor specified without Major element:** - -Only the Minor element is present. Major must be included as well. - -```xml - - - -``` - -### FileVersion - -**Mandatory: False** - -**Type: String** - -FileVersion differentiates between the release version of a published application and the internal build details of a component executable. For the majority of commercial applications, these numbers are identical. Where they vary, the product version of a file indicates a generic version identification of a file, while file version indicates a specific build of a file (as in the case of a hotfix or update). This uniquely identifies files without breaking detection logic. - -To determine the product version and file version of a particular executable, right-click on the file in Windows Explorer, select Properties, then click on the Details tab. - -Including a FileVersion element for an application allows for more granular fine-tuning detection logic, but is not necessary for most applications. The ProductVersion element settings are checked first, and then FileVersion is checked. The more restrictive setting will apply. - -The child elements and syntax rules for FileVersion are identical to those of ProductVersion. - -```xml - - MSACCESS.EXE - Win32 - - - - - - - - - -``` - -### Application Element - -Application is a container for settings that apply to a particular application. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Field/TypeDescription

          Name

          Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

          ID

          Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

          Description

          An optional description of the template.

          LocalizedNames

          An optional name displayed in the UI, localized by a language locale.

          LocalizedDescriptions

          An optional template description localized by a language locale.

          Version

          Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

          DeferToMSAccount

          Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

          DeferToOffice365

          Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

          Processes

          A container for a collection of one or more Process elements. For more information, see Processes.

          Settings

          A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

          - - - -### Common Element - -Common is similar to an Application element, but it is always associated with two or more Application elements. The Common section represents the set of settings that are shared between those Application instances. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Field/TypeDescription

          Name

          Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

          ID

          Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

          Description

          An optional description of the template.

          LocalizedNames

          An optional name displayed in the UI, localized by a language locale.

          LocalizedDescriptions

          An optional template description localized by a language locale.

          Version

          Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

          DeferToMSAccount

          Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

          DeferToOffice365

          Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

          Settings

          A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

          - - - -### SettingsLocationTemplate Element - -This element defines the settings for a single application or a suite of applications. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Field/TypeDescription

          Name

          Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

          ID

          Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

          Description

          An optional description of the template.

          LocalizedNames

          An optional name displayed in the UI, localized by a language locale.

          LocalizedDescriptions

          An optional template description localized by a language locale.

          - - - -### Appendix: SettingsLocationTemplate.xsd - -Here is the SettingsLocationTemplate.xsd file showing its elements, child elements, attributes, and parameters: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - - - - - - -## Related topics - - -[Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator](working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md) - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md b/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md deleted file mode 100644 index e6dc6513a3..0000000000 --- a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md +++ /dev/null @@ -1,337 +0,0 @@ ---- -title: Changing the Frequency of UE-V 2.x Scheduled Tasks -description: Changing the Frequency of UE-V 2.x Scheduled Tasks -author: levinec -ms.assetid: ee486570-c6cf-4fd9-ba48-0059ba877c10 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 09/29/2016 ---- - - -# Changing the Frequency of UE-V 2.x Scheduled Tasks - - -The Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 Agent installer, AgentSetup.exe, creates the following scheduled tasks during the UE-V Agent installation: - -- **Monitor Application Settings** - -- **Sync Controller Application** - -- **Synchronize Settings at Logoff** - -- **Template Auto Update** - -- **Collect CEIP data** - -- **Upload CEIP Data** - -**Note**   -With the exception of Collect CEIP Data, these tasks must remain enabled as UE-V cannot function without them. - - - -These scheduled tasks are not configurable with the UE-V tools. Administrators who want to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options. - -For more information about Schtasks.exe, see [How to use Schtasks,exe to Schedule Tasks in Windows Server 2003](https://go.microsoft.com/fwlink/?LinkID=264854). - -For more information about - -## UE-V Scheduled Tasks - - -The following scheduled tasks are included in UE-V 2 with sample scheduled task configuration commands. - -### Collect CEIP Data - -If upon installation the user or administrator choses to participate in the Customer Experience Improvement Program (CEIP), UE-V collects data to help improve the product in future releases. This scheduled task only runs at logon. The **Collect CEIP Data** task runs the UevSqmSession.exe, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
          Task nameDefault event

          \Microsoft\UE-V\Collect CEIP data

          Logon

          - - - -### Monitor Application Settings - -The **Monitor Application Settings** task is used to synchronize settings for Windows apps. It is run at logon but is delayed by 30 seconds to not affect the logon detrimentally. The Monitor Application Status task runs the UevAppMonitor.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
          Task nameDefault event

          \Microsoft\UE-V\Monitor Application Status

          Logon

          - - - -### Sync Controller Application - -The **Sync Controller Application** task is used to start the Sync Controller to synchronize settings from the computer to the settings storage location. By default, the task runs every 30 minutes. At that time, local settings are synchronized to the settings storage location, and updated settings on the settings storage location are synchronized to the computer. The Sync Controller application runs the Microsoft.Uev.SyncController.exe, which is located in the UE-V Agent installation directory. -**Note:** As per the **Monitor Application Settings** task, this task is run at logon but is delayed by 30 seconds to not affect the logon detrimentally. - ---- - - - - - - - - - - - - -
          Task nameDefault event

          \Microsoft\UE-V\Sync Controller Application

          Logon, and every 30 minutes thereafter

          - - - -For example, the following command configures the agent to synchronize settings every 15 minutes instead of the default 30 minutes. - -``` syntax -Schtasks /change /tn “Microsoft\UE-V\Sync Controller Application” /ri 15 -``` - -### Synchronize Settings at Logoff - -The **Synchronize Settings at Logoff** task is used to start an application at logon that controls the synchronization of applications at logoff for UE-V. The Synchronize Settings at Logoff task runs the Microsoft.Uev.SyncController.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
          Task nameDefault event

          \Microsoft\UE-V\Synchronize Settings at Logoff

          Logon

          - - - -### Template Auto Update - -The **Template Auto Update** task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The **Template Auto Update** task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
          Task nameDefault event

          \Microsoft\UE-V\Template Auto Update

          System startup and at 3:30 AM every day, at a random time within a 1-hour window

          - - - -**Example:** The following command configures the UE-V Agent to check the settings template catalog store every hour. - -``` syntax -schtasks /change /tn "Microsoft\UE-V\Template Auto Update" /ri 60 -``` - -### Upload CEIP Data - -The **Upload CEIP Data** task runs during the installation if the user or the administrator chose to participate in the Customer Experience Improvement Program (CEIP). This task uploads the data to the CEIP servers where the data is used to help improve the product for future releases of UE-V. This scheduled task runs at logon and every 4 hours afterwards. The **Upload CEIP data** task runs the UevSqmUploader.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
          Task nameDefault event

          \Microsoft\UE-V\Upload CEIP data

          At logon and every 4 hours

          - - - -## UE-V 2 Scheduled Task Details - - -The following chart provides additional information about scheduled tasks for UE-V 2: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Task Name (file name)

          Default Frequency

          Power Toggle

          Idle Only

          Network Connection

          Description

          Monitor Application Settings (UevAppMonitor.exe)

          Starts 30 seconds after logon and continues until logoff.

          No

          Yes

          N/A

          Synchronizes settings for Windows (AppX) apps.

          Sync Controller Application (Microsoft.Uev.SyncController.exe)

          At logon and every 30 min thereafter.

          Yes

          Yes

          Only if Network is connected

          Starts the Sync Controller which synchronizes local settings with the settings storage location.

          Synchronize Settings at Logoff (Microsoft.Uev.SyncController.exe)

          Runs at logon and then waits for Logoff to Synchronize settings.

          No

          Yes

          N/A

          Start an application at logon that controls the synchronization of applications at logoff.

          Template Auto Update (ApplySettingsCatalog.exe)

          Runs at initial logon and at 3:30 AM every day thereafter.

          Yes

          No

          N/A

          Checks the settings template catalog for new, updated, or removed templates. This task only runs if SettingsTemplateCatalog is configured.

          Collect CEIP data (UevSqmSession.exe)

          At logon launches service

          No

          Yes

          N/A

          If the user or administrator opts in to the Customer Experience Improvement Program (CEIP), this task collects data that helps improve UE-V future releases.

          Upload CEIP Data (UevSqmUploader.exe)

          Runs at logon and at 4:00 AM every day thereafter.

          No

          Yes

          Only if Network is connected

          If the user or administrator opts in to the Customer Experience Improvement Program (CEIP), this task uploads the data to the CEIP servers.

          - - - -**Legend** - -- **Power Toggle** – Task Scheduler will optimize power consumption when not connected to AC power. The task might stop running if the computer switches to battery power. - -- **Idle Only** – The task will stop running if the computer ceases to be idle. By default the task will not restart when the computer is idle again. Instead the task will begin again on the next task trigger. - -- **Network Connection** – Tasks marked “Yes” only run if the computer has a network connection available. Tasks marked “N/A” run regardless of network connectivity. - -### How to Manage Scheduled Tasks - -To find Scheduled Tasks, perform the following: - -1. Open “Schedule Tasks” on the user computer. - -2. Navigate to: Task Scheduler -> Task Scheduler Library -> Microsoft -> UE-V - -3. Select the scheduled task you wish to manage and configure in the details pane. - -### Additional information - -The following additional information applies to UE-V scheduled tasks: - -- ll task sequence programs are located in the UE-V Agent installation folder, `%programFiles%\Microsoft User Experience Virtualization\Agent\[architecture]\`, by default. - -- The Sync Controller Application Scheduled task is the crucial component when the UE-V SyncMethod is set to “SyncProvider” (UE-V 2 default configuration). This scheduled task keeps the SettingsSToragePath synchronized with the locally cached versions of the settings package files. If users complain that settings do not synchronize often enough, then you can reduce the scheduled task setting to as little as 1 minute.  You can also increase the 30 min default to a higher amount if necessary. If users complain that settings do not synchronize fast enough on logon, then you can remove the delay setting for the scheduled task. (You can find the delay setting in the **Edit Trigger** dialogue box) - -- You do not need to disable the Template Auto Update scheduled task if you use another method to keep the clients’ templates in sync (i.e. Group Policy or Configuration Manager Baselines). Leaving the SettingsTemplateCatalog property value blank prevents UE-V from checking the settings catalog for custom templates. This scheduled task runs ApplySettingsCatalog.exe and will essentially return immediately. - -- The Monitor Application Settings scheduled task will update Windows app (AppX) settings in real time, based on Windows app program setting triggers built into each app. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md#deploycatalogue) - - - - - - - - - diff --git a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index 8b371ea90a..0000000000 --- a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Configuring the Company Settings Center for UE-V 2.x -description: Configuring the Company Settings Center for UE-V 2.x -author: levinec -ms.assetid: 48fadb0a-c0dc-4287-9474-f94ce1417003 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring the Company Settings Center for UE-V 2.x - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 include a new application, the Company Settings Center, which helps users manage settings to synchronize. The Company Settings Center is installed by using the UE-V Agent. Users access the Company Settings Center in Control Panel, in the **Start** menu or on the **Start** screen, and via the UE-V notification area icon. Company Settings Center displays which settings are synchronized and helps users see the synchronization status of UE-V. Users can use the Company Settings Center to select which applications or Windows features synchronize their settings between computers. They can also click the **Sync Now** button to synchronize all settings immediately. The administrator can also include a link for support in the Company Settings Center. - -## About the Company Settings Center - - -The Company Settings Center desktop application provides users with information about UE-V settings synchronization. The Company Settings Center is accessible in several different ways: - -- Notification area icon – With the **Tray Icon** Group Policy setting or Windows PowerShell configuration enabled, the UE-V icon appears in the notification area. Click the UE-V icon to open the Company Settings Center. - - **Note**   - The notification area icon can be disabled by using the following settings: - - - Group Policy setting: `Policy Tray Icon` - - - Windows PowerShell cmdlet: `TrayIconEnabled` - - - Configuration item in the UE-V Configuration Pack for System Center 2012 Configuration Manager: `Tray icon enabled` - - - -- Control Panel application – In Control Panel, browse to **Appearance and Personalization**, and then click **Company Settings Center**. - -- First use notification – Unless disabled, the UE-V Agent alerts the user that settings are now synchronized when the UE-V agent runs for the first time on a computer. Click the notification dialog box to open the Company Settings Center. - -- The **Start** screen or **Start** menu includes a link to the Company Settings Center. A search for Company Settings Center finds the application. - -## Configuring the support link in the Company Settings Center - - -The Company Settings Center can include a hyperlink that users can click to get support with UE-V settings synchronization problems. This link can open any valid URL protocol, such as http:// for a webpage or mailto:// for an email. The support link can be configured by using Group Policy, Windows PowerShell, or the System Center 2012 Configuration Manager UE-V Configuration Pack. - -**How to configure the Company Settings Center support link** - -1. Open your preferred management tool: - - - **Group Policy** - If you have not already done so, download the ADMX template for UE-V 2 from [MDOP Administrative Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941). - - - **Windows PowerShell** – On a computer with the UE-V Agent installed, open **Windows PowerShell**. For more information about administering UE-V by using Windows PowerShell, see [Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md). - - - **System Center 2012 Configuration Pack for Microsoft User Experience Virtualization (UE-V)** – Import the UE-V Configuration Pack and follow the Configuration Pack documentation to create configuration items. For more information about the UE-V Configuration Pack, see [Configuring UE-V 2.x with System Center Configuration Manager 2012](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md). - -2. Edit the settings for the following policies: - - - **Contact IT Link Text** - This setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center. If you enable this setting, the Company Settings Center displays the specified text in the link to the Contact IT URL. - - - Group Policy settings: `Contact IT Link Text` - - - Windows PowerShell cmdlet: `ContactITDescription` - - - Configuration Pack configuration item: `IT contact descriptive text` - - - **Contact IT URL** - This setting specifies the URL for the Contact IT link in the Company Settings Center in a valid URL protocol, such as http:// for a webpage or mailto:// for an email. - - - Group Policy settings: `Contact IT URL` - - - Windows PowerShell cmdlet: `ContactITUrl` - - - Configuration Pack configuration item: `IT contact URL` - -3. Deploy settings to users’ computers by using the management tool. - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md deleted file mode 100644 index 94ee14b167..0000000000 --- a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: Configuring UE-V 2.x with Group Policy Objects -description: Configuring UE-V 2.x with Group Policy Objects -author: levinec -ms.assetid: 2bb55834-26ee-4f19-9860-dfdf3c797143 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring UE-V 2.x with Group Policy Objects - - -Some Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Group Policy settings can be defined for computers, and other Group Policy settings can be defined for users. For information about how to install UE-V Group Policy ADMX files, see [Installing the UE-V 2 Group Policy ADMX Templates](https://technet.microsoft.com/library/dn458891.aspx#admx). - -The following policy settings can be configured for UE-V. - -**Group Policy settings** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Group Policy setting nameTargetGroup Policy setting descriptionConfiguration options

          Contact IT Link Text

          Computers Only

          This Group Policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center.

          If you enable this Group Policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL.

          Contact IT URL

          Computers Only

          This Group Policy setting specifies the URL for the Contact IT link in the Company Settings Center.

          If you enable this setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol, such as HTTP or mailto.

          Do not use the sync provider

          Computers and Users

          By using this Group Policy setting, you can configure whether UE-V uses the sync provider feature. This policy setting also lets you enable notification to appear when the import of user settings is delayed.

          Enable this setting to configure the UE-V Agent not to use the sync provider.

          First Use Notification

          Computers Only

          This Group Policy setting enables a notification in the notification area that appears when the UE-V

          -

          agent runs for the first time.

          The default is enabled.

          Roam Windows settings

          Computers and Users

          This Group Policy setting configures the synchronization of Windows settings.

          Select which Windows settings synchronize between computers.

          -

          By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version.

          Settings package size warning threshold

          Computers and Users

          This Group Policy setting lets you configure the UE-V Agent to report when a settings package file size reaches a defined threshold.

          Specify the preferred threshold for settings package sizes in kilobytes (KB).

          -

          By default, the UE-V Agent does not have a package file size threshold.

          Settings storage path

          Computers and Users

          This Group Policy setting configures where the user settings are to be stored.

          Enter a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.

          Settings template catalog path

          Computers Only

          This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V Agent.

          Enter a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.

          -

          Select the check box to replace the default Microsoft templates.

          Sync settings over metered connections

          Computers and Users

          This Group Policy setting defines whether UE-V synchronizes settings over metered connections.

          By default, the UE-V Agent does not synchronize settings over a metered connection.

          Sync settings over metered connections even when roaming

          Computers and Users

          This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode.

          By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode.

          Synchronization timeout

          Computers and Users

          This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds.

          Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds.

          Tray Icon

          Computers Only

          This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon.

          The default is enabled.

          Use User Experience Virtualization (UE-V)

          Computers and Users

          This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V).

          Enable or disable this Group Policy setting.

          - - - -**Note**   -In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications. - - - -**Windows App Group Policy settings** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Group Policy setting nameTargetGroup Policy setting descriptionConfiguration options

          Do not synchronize Windows Apps

          Computers and Users

          This Group Policy setting defines whether the UE-V Agent synchronizes settings for Windows apps.

          The default is to synchronize Windows apps.

          Windows App List

          Computer and User

          This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app’s settings.

          You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized.

          Sync Unlisted Windows Apps

          Computer and User

          This Group Policy setting defines the default settings sync behavior of the UE-V Agent for Windows apps that are not explicitly listed in the Windows app list.

          By default, the UE-V Agent only synchronizes settings of those Windows apps that are included in the Windows app list.

          - - - -For more information about synchronizing Windows apps, see [Windows App List](https://technet.microsoft.com/library/dn458925.aspx#win8applist). - -**To configure computer-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) on the computer that acts as a domain controller to manage Group Policy settings for UE-V computers. Navigate to **Computer configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the Group Policy setting to be edited. - -**To configure user-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) tool in Microsoft Desktop Optimization Pack (MDOP) on the domain controller computer to manage Group Policy settings for UE-V. Navigate to **User configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the edited Group Policy setting. - -The UE-V Agent uses the following order of precedence to determine synchronization. - -**Order of precedence for UE-V settings** - -1. User-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_CURRENT_USER\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -2. Computer-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -3. Configuration settings that are defined by the current user by using Windows PowerShell or Windows management Instrumentation (WMI) - These configuration settings are stored by the UE-V Agent under this registry location: `HKEY_CURRENT_USER\Software\Microsoft\Uev\Agent\Configuration`. - -4. Configuration settings that are defined for the computer by using Windows PowerShell or WMI. These configuration settings are stored by the UE-V Agent under this registry location: `HKEY_LOCAL_MACHINE\Software\Microsoft\Uev\Agent\Configuration`. - - **Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md deleted file mode 100644 index c5936123dc..0000000000 --- a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md +++ /dev/null @@ -1,248 +0,0 @@ ---- -title: Configuring UE-V 2.x with System Center Configuration Manager 2012 -description: Configuring UE-V 2.x with System Center Configuration Manager 2012 -author: levinec -ms.assetid: 9a4e2a74-7646-4a77-b58f-2b4456487295 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Configuring UE-V 2.x with System Center Configuration Manager 2012 - - -After you install Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 and their required features, UE-V must be configured. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of System Center Configuration Manager 2012 SP1 or later to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - -## UE-V Configuration Pack supported features - - -The UE-V Configuration Pack includes tools to perform the following tasks: - -- Create or update UE-V settings location template distribution baselines. - - - Define UE-V templates to be registered or unregistered - - - Update UE-V template configuration items and baselines as templates are added or updated - - - Distribute and register UE-V templates using standard Configuration Item remediation - -- Create or update a UE-V Agent policy configuration item to set or clear these settings. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          Max package size

          Enable/disable Windows app sync

          Wait for sync on application start

          Setting import delay

          Sync unlisted Windows apps

          Wait for sync on logon

          Settings import notification

          IT contact URL

          Wait for sync timeout

          Settings storage path

          IT contact descriptive text

          Settings template catalog path

          Sync enablement

          Tray icon enabled

          Start/Stop UE-V agent service

          Sync method

          First use notification

          Define which Windows apps will roam settings

          Sync timeout

          - - - -- Verify compliance by confirming that UE-V is running. - -## Generate a UE-V Agent Policy Configuration Item - - -All UE-V Agent policy and configuration is distributed through a single configuration item that is generated using the UevAgentPolicyGenerator.exe tool. This tool reads the desired configuration from an XML configuration file and creates a CI containing the discovery and remediation settings needed to bring the machine into compliance. - -The UE-V Agent policy configuration item CAB file is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> - -- PolicyName <name> Optional: Defaults to “UE-V Agent Policy” if not present - -- PolicyDescription <description> Optional: A description is provided if not present - -- CabFilePath <full path to configuration item .CAB file> - -- ConfigurationFile <full path to agent configuration XML file> - -**Note**   -It might be necessary to change the PowerShell execution policy to allow these scripts to run in your environment. Perform these steps in the Configuration Manager console: - -1. Select **Administration > Client Settings > Properties** - -2. In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass** - -**Create the First UE-V Policy Configuration Item** - -1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console: - - ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\AgentConfiguration.xml c:\ - ``` - - The default configuration file contains five sections: - - **Computer Policy** - All UE-V machine level settings. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - - **Clear** to remove the setting - - - **Unmanaged** to have the configuration item left at its current state - - Do not remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you do not want Configuration Manager to alter current or default values. - - **CurrentComputerUserPolicy** - All UE-V user level settings. These entries override the machine settings for a user. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - - **Clear** to remove the setting - - - **Unmanaged** to have the configuration item left at its current state - - Do not remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you do not want Configuration Manager to alter current or default values. - - **Services** - Entries in this section control service operation. The default configuration file contains a single entry for the UevAgentService. The DesiredState attribute can be set to **Running** or **Stopped**. - - **Windows8AppsComputerPolicy** - All machine level Windows app synchronization settings. Each PackageFamilyName listed in this section can be assigned a DesiredState of - - - **Enabled** to have settings roam - - - **Disabled** to prevent settings from roaming - - - **Cleared** to have the entry removed from UE-V control - - Additional lines can be added to this section based on the list of installed Windows apps that can be viewed using the PowerShell cmdlet GetAppxPackage. - - **Windows8AppsCurrentComputerUserPolicy** - Identical to the Windows8AppsComputerPolicy with settings that override machine settings for an individual user. - -2. Edit the configuration file by changing the desired state and value fields. - -3. Run this command on a machine running the ConfigMgr Admin Console: - - ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe –Site ABC –CabFilePath "C:\MyCabFiles\UevPolicyItem.cab" –ConfigurationFile "c:\AgentConfiguration.xml" - ``` - -4. Import the CAB file using ConfigMgr console or PowerShell Import-CMConfigurationItem - -**Update a UE-V Policy Configuration Item** - -1. Edit the configuration file by changing the desired state and value fields. - -2. Run the command from Step 3 in [Create the First UE-V Policy Configuration Item](#create). If you changed the name with the PolicyName parameter, make sure you enter the same name. - -3. Reimport the CAB file. The version in ConfigMgr will be updated. - -## Generate a UE-V Template Baseline -UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality. - -The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> - -- BaselineName <name> (Optional: defaults to “UE-V Template Distribution Baseline” if not present) - -- BaselineDescription <description> (Optional: a description is provided if not present) - -- TemplateFolder <UE-V template folder> - -- Register <comma separated template file list> - -- Unregister <comma separated template list> - -- CabFilePath <Full path to baseline CAB file to generate> - -The result is a baseline CAB file that is ready for import into Configuration Manager. If at a future date, you update or add a template, you can rerun the command using the same baseline name. Importing the CAB results in CI version updates on the changed templates. - -### Create the First UE-V Template Baseline - -1. Create a “master” set of UE-V templates in a stable folder location visible to the machine running your ConfigMgr Admin Console. As templates are added or updated, this folder is where they are pulled for distribution. The initial list of templates can be copied from a machine with UE-V installed. The default template location is C:\\Program Files\\Microsoft User Experience Virtualization\\Templates. - -2. Create a text.bat file where you can add the template generator command. This is optional, but will make regeneration simpler if you save the command parameters. - -3. Add the command and parameters to the .bat file that will generate the baseline. The following example creates a baseline that distributes Notepad and Calculator: - - ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe –Site "ABC" –TemplateFolder "C:\ProductionUevTemplates" –Register "MicrosoftNotepad.xml, MicrosoftCalculator.xml" –CabFilePath "C:\MyCabFiles\UevTemplateBaseline.cab" - ``` - -4. Run the .bat file to create UevTemplateBaseline.cab ready for import into Configuration Manager. - -### Update a UE-V Template Baseline - -The template generator uses the template version to determine if a template should be updated. If you make a template change and update the version, the baseline generator compares the template in your master folder with the template contained in the CI on the ConfigMgr server. If a difference is found, the generated baseline and modified CI versions are updated. - -To distribute a new Notepad template, you would perform these steps: - -1. Update the template and template version located in the <Version> element of the template. - -2. Copy the template to your master template directory. - -3. Run the command in the .bat file that you created in Step 3 in [Create the First UE-V Template Baseline](#create2). - -4. Import the generated CAB file into ConfigMgr using the console or PowerShell Import-CMBaseline. - -## Get the UE-V Configuration Pack - - -The UE-V Configuration Pack for Configuration Manager 2012 SP1 or later can be downloaded [here](https://go.microsoft.com/fwlink/?LinkId=317263). - - - - - - -## Related topics - - -[Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md deleted file mode 100644 index b88d290654..0000000000 --- a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,459 +0,0 @@ ---- -title: Deploy Required Features for UE-V 2.x -description: Deploy Required Features for UE-V 2.x -author: levinec -ms.assetid: 10399bb3-cc7b-4578-bc0c-2f6b597abe4d -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy Required Features for UE-V 2.x - - -All Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 deployments require these features - -- [Deploy a Settings Storage Location](#ssl) that is accessible to end users. - - This is a standard network share that stores and retrieves user settings. - -- [Choose the Configuration Method for UE-V](#config) - - UE-V can be deployed and configured using common management tools including group policy, Configuration Manager, or Windows Management Infrastructure and Powershell. - -- [Deploy a UE-V Agent](#agent) to be installed on every computer that synchronizes settings. - - This monitors registered applications and the operating system for any settings changes and synchronizes those settings between computers. - -The topics in this section describe how to deploy these features. - -## Deploy a UE-V Settings Storage Location - - -UE-V requires a location in which to store user settings in settings package files. You can configure this settings storage location in one of these ways: - -- Create your own settings storage location - -- Use existing Active Directory for your settings storage location - -If you don’t create a settings storage location, the UE-V Agent will use Active Directory (AD) by default. - -**Note** -As a matter of [performance and capacity planning](https://technet.microsoft.com/library/dn458932.aspx#capacity) and to reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location. - - - -### Create a UE-V Settings Storage Location - -Before you define the settings storage location, you must create a root directory with read/write permissions for users who store settings on the share. The UE-V Agent creates user-specific folders under this root directory. - -The settings storage location is defined by setting the SettingsStoragePath configuration option, which you can configure by using one of these methods: - -- When you [Deploy the UE-V Agent](#agent) through a command-line parameter or in a batch script - -- Through [Group Policy](https://technet.microsoft.com/library/dn458893.aspx) settings - -- With the [System Center Configuration Pack](https://technet.microsoft.com/library/dn458917.aspx) for UE-V - -- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](https://technet.microsoft.com/library/dn458937.aspx) - -The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\\\Server\\Settingsshare\\**. This configuration option supports the use of variables to enable specific synchronization scenarios. For example, you can use the `%username%\%computername%` variables to preserve the end user settings experience in these scenarios: - -- End users that use multiple physical computers in your enterprise - -- Enterprise computers that are used by multiple end users - -The UE-V Agent dynamically creates a user-specific settings storage path, with a hidden system folder named `SettingsPackages`, based on the configuration setting of **SettingsStoragePath**. The agent reads and writes settings to this location as defined by the registered UE-V settings location templates. - -**UE-V settings are determined by a "Last write wins" rule:** If the settings storage location is the same for user with multiple managed computers, one UE-V Agent reads and writes to the settings location independently of agents running on other computers. The last written settings and values are the ones applied when the next agent reads from the settings storage location. - -**Deploy the settings storage location:** Follow these steps to define the settings storage location rather than using your existing Active Directory service. You should limit access to the settings storage share to those users that require it, as shown in the tables below. - -**To deploy the UE-V network share** - -1. Create a new security group for UE-V users. - -2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant the UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. - -3. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissions

          Everyone

          No permissions

          Security group of UE-V users

          Full control

          - - - -4. Set the following NTFS file system permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissionsFolder

          Creator/owner

          Full control

          Subfolders and files only

          Security group of UE-V users

          List folder/read data, create folders/append data

          This folder only

          - - - -With this configuration, the UE-V Agent creates and secures a Settingspackage folder while it runs in the context of the user, and grants each user permission to create folders for settings storage. Users receive full control to their Settingspackage folder while other users cannot access it. - -**Note** -If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: - -1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. - -2. Set the registry key value to *1*. - - - -### Use Active Directory with UE-V 2.x - -The UE-V Agent uses Active Directory (AD) by default if a settings storage location is not otherwise defined. In these cases, the UE-V Agent dynamically creates the settings storage folder under the root of the AD home directory of each user. But, if a custom directory setting is configured in AD, then that directory is used instead. - -## Choose the Configuration Method for UE-V 2.x - - -You want to figure out which configuration method you'll use to manage UE-V after deployment since this will be the configuration method you use to deploy the UE-V Agent. Typically, this is the configuration method that you already use in your environment, such as Windows PowerShell or Configuration Manager. - -You can configure UE-V before, during, or after UE-V Agent installation, depending on the configuration method that you use. - -- [Group Policy](https://technet.microsoft.com/library/dn458893.aspx)**:** You can use your existing Group Policy infrastructure to configure UE-V before or after UE-V Agent deployment. The UE-V Group Policy ADMX template enables the central management of common UE-V Agent configuration options, and it includes settings to configure UE-V synchronization. - - **Installing the UE-V Group Policy ADMX Templates:** Group Policy ADMX templates for UE-V configure the synchronization settings for the UE-V Agent and enable the central management of common UE-V Agent configuration settings by using an existing Group Policy infrastructure. - - Supported operating systems for the domain controller that deploys the Group Policy Objects include the following: - - Windows Server 2008 R2 - - Windows Server 2012 and Windows Server 2012 R2 - -- [Configuration Manager](https://technet.microsoft.com/library/dn458917.aspx)**:** The UE-V Configuration Pack lets you use the Compliance Settings feature of System Center Configuration Manager 2012 SP1 or later to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - -- [Windows PowerShell and WMI](https://technet.microsoft.com/library/dn458937.aspx)**:** You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify configurations after you install the UE-V Agent. - - **Note** - Registry modification can result in data loss, or the computer becomes unresponsive. We recommend that you use other configuration methods. - - - -- **Command-line or Batch Script Installation:** Parameters that are used when you [Deploy the UE-V Agent](#agent) configure many UE-V settings. Electronic software distribution systems, such as System Center 2012 Configuration Manager, use these parameters to configure their clients when they deploy and install the UE-V Agent software. - -## Deploy the UE-V 2.x Agent - - -The UE-V Agent is the core of a UE-V deployment and must run on each computer that uses UE-V to synchronize application and Windows settings. - -**UE-V Agent Installation Files:** A single installation file, AgentSetup.exe, installs the UE-V Agent on both 32-bit and 64-bit operating systems. In addition, AgentSetupx86.msi or AgentSetupx64.msi architecture-specific Windows Installer files are provided, and since they are smaller, they might streamline the agent deployments. The [command-line parameters for the AgentSetup.exe installer](#params) are supported for the Windows Installer installation as well. - -**Important** -During UE-V Agent installation or uninstallation, you can either use the AgentSetup.exe file or the AgentSetup<arch>.msi file, but not both. The same file must be used to uninstall the UE-V Agent that was used to install the UE-V Agent. - - - -### To Deploy the UE-V Agent - -You can use the following methods to deploy the UE-V Agent: - -- An electronic software distribution (ESD) solution system, such as Configuration Manager, that can install a Windows Installer (.msi) file. - -- An installation script that references the Windows Installer (.msi) file that is stored centrally on a share. - -- An installation program that you run manually on the computer. - -Use the following procedure to deploy the UE-V Agent from a network share. - -**To install and configure the UE-V Agent from a network share** - -1. Stage the UE-V Agent installation file AgentSetup.exe on a network share to which users have Read permission. - -2. Deploy a script to user computers that installs the UE-V Agent. The script should specify the settings storage location. - -**Deployment options:** Be sure to use the correct variable format when you install the UE-V Agent. The following table provides examples of deployment options for using the AgentSetup.exe or the Windows Installer (.msi) files. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Deployment typeDeployment descriptionExample

          Command prompt

          When you install the UE-V Agent at a command prompt, use the %^username% variable format. If quotation marks are required because of spaces in the settings storage path, use a batch script file for deployment.

          -

          AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

          -

          -

          msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

          Batch script

          When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this installation method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at installation time, rather than at run time, which causes UE-V to use a single settings storage location for all users.

          AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

          -

          -

          msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

          -

          Windows PowerShell

          When you install the UE-V Agent from a Windows PowerShell prompt or a Windows PowerShell script, use the %username% variable format.

          & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

          -

          -

          & msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

          -

          Electronic software distribution, such as deployment of Configuration Manager Software Deployment

          When you install the UE-V Agent by using Configuration Manager, use the ^%username^% variable format.

          AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

          -

          -

          msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

          - - - -**Note** -The installation of the UE-V Agent requires administrator rights, and the computer requires a restart before the UE-V Agent can run. - - - -### Command-line parameters for UE-V Agent deployment - -The command-line parameters of the UE-V Agent are as follows. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Command-line parameterDefinitionNotes

          /help or /h or /?

          Displays the AgentSetup.exe usage dialog box.

          SettingsStoragePath

          Indicates the Universal Naming Convention (UNC) path that defines where settings are stored.

          -Important

          You must specify a SettingsStoragePath in UE-V 2.1 and UE-V 2.1 SP1. You can set the AdHomePath string to specify that the user's Active Directory home path is used. For example, SettingsStoragePath = \share\path|AdHomePath.

          -

          In UE-V 2.0, you can leave SettingsStoragePath blank to use the Active Directory home path instead.

          -
          -
          - -
          -

          %username% or %computername% environment variables are accepted. Scripting can require escaped variables.

          -

          Default: <none>

          SettingsStoragePathReg

          Gets the SettingsStoragePath value from the registry during installation.

          At the command prompt, type the following example to force UE-V to use the Active Directory home path instead of a specific UNC.

          -

          msiexec.exe /i AgentSetupx64.msi acceptlicenseterms=true SettingsStoragePathReg=TRUE /quiet /norestart

          SettingsTemplateCatalogPath

          Indicates the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates.

          Only required for custom settings location templates

          RegisterMSTemplates

          Specifies whether the default Microsoft templates should be registered during installation.

          True | False

          -

          Default: True

          SyncMethod

          Specifies which synchronization method should be used.

          SyncProvider | None

          -

          Default: SyncProvider

          SyncTimeoutInMilliseconds

          Specifies the number of milliseconds that the computer waits before time-out when it retrieves user settings from the settings storage location.

          Default: 2000 milliseconds

          -

          (wait up to 2 seconds)

          SyncEnabled

          Specifies whether UE-V synchronization is enabled or disabled.

          True | False

          -

          Default: True

          MaxPackageSizeInBytes

          Specifies a settings package file size in bytes when the UE-V Agent reports that files exceed the threshold.

          <size>

          -

          Default: none (no warning threshold)

          CEIPEnabled

          Specifies the setting for participation in the Customer Experience Improvement program. If set to True, installer information is uploaded to the Microsoft Customer Experience Improvement Program site. If set to False, no information is uploaded.

          True | False

          -

          Default: False

          NoRestart

          Supports deferral of the restart of the computer after the UE-V Agent is installed.

          INSTALLFOLDER

          Enables a different installation folder to be set for the UE-V Agent or UE-V Generator.

          MUENABLED

          Enables Setup to accept the option to be included in the Microsoft Update program.

          ACCEPTLICENSETERMS

          Lets UE-V be installed silently. This must be set to True to install UE-V silently and bypass the requirement that the user accepts the UE-V license terms. If set to False or left empty, the user receives an error message and UE-V is not installed.

          -Important

          This parameter is required to install UE-V silently.

          -
          -
          - -

          NORESTART

          Prevents a mandatory restart after the UE-V Agent is installed.

          - - - -### Update the UE-V Agent - -Updates for the UE-V Agent software are provided through Microsoft Update. You can deploy UE-V Agent updates by using Enterprise Software Distribution (ESD) infrastructure systems. - -During a UE-V Agent upgrade, the default group of settings location templates for common Microsoft applications and Windows settings can be updated. - -### Upgrade the UE-V 2.x Agent - -The UE-V 2.x Agent introduces many new features and modifies how and when the agent uploads content to the settings storage share. The upgrade process automates these changes. To upgrade the UE-V Agent, run the UE-V Agent install package (AgentSetup.exe, AgentSetupx86.msi, or AgentSetupx64.msi) on users’ computers. - -**Note** -When you upgrade the UE-V Agent, you must use the same installer type (.exe file or .msi packet) that installed the previous UE-V Agent. For example, use the UE-V 2 AgentSetup.exe to upgrade UE-V 1.0 Agents that were installed by using AgentSetup.exe. - - - -The following configurations are preserved when the Agent Setup program runs: - -- Settings storage path - -- Registry settings - -- Scheduled tasks (Interval settings are reset to their defaults) - -**Note** -A computer with UE-V 2.x settings location templates that are registered in the UE-V 1.0 Agent register errors in the Windows Event Log. - - - -You can use Microsoft System Center 2012 Configuration Manager or another enterprise software distribution tool to automate and distribute the UE-V Agent upgrade. - -**Recommendations:** We recommend that you upgrade all of the UE-V 1.0 Agents in a computing environment, but it is not required. UE-V 2.x settings location templates can interact with a UE-V 1.0 Agent because they only share the settings from the settings storage path. We recommend, however, that you move the deployments to a single agent version to simplify management and to support UE-V. - -### Repair the UE-V Agent after an unsuccessful upgrade - -You might experience errors after you attempt one of the following operations: - -- Upgrade from UE-V 1.0 to UE-V 2 - -- Upgrade to a newer version of Windows, for example, from Windows 7 to Windows 8 or from Windows 8 to Windows 8.1. - -- Uninstall the agent after upgrading the UE-V Agent - -To resolve any issues, attempt to repair the UE-V Agent by entering this command at a command prompt on the computer where the agent is installed. - -``` syntax -msiexec.exe /f "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log -``` - -You can then retry the uninstall process or upgrade by installing the newer version of the UE-V Agent. - - - - - - -## Related topics - - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md deleted file mode 100644 index e86cfa6fc0..0000000000 --- a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md +++ /dev/null @@ -1,344 +0,0 @@ ---- -title: Deploy UE-V 2.x for Custom Applications -description: Deploy UE-V 2.x for Custom Applications -author: levinec -ms.assetid: f7cb089f-d764-4a93-82b6-926fe0385a23 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 07/19/2016 ---- - - -# Deploy UE-V 2.x for Custom Applications - - -Microsoft User Experience Virtualization (UE-V) 2.0. 2.1, and 2.1 SP1 use XML files called **settings location templates** to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. But if you want to synchronize settings for desktop applications other than those included in the default templates, you can create your own custom settings location templates by using the UE-V Generator. - -Once you have read through the planning material in [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) and have decided that you want to synchronize settings for custom applications (third-party, line-of-business, etc.), you will deploy the features of UE-V as described in this topic. To start, here are the main steps required to synchronize settings for custom applications: - -- [Install the UEV Generator](#uevgen) - - Use the UEV Generator to create custom XML settings location templates. - -- [Configure a UE-V settings template catalog](#deploycatalogue) - - You can define this path where custom settings location templates are stored. - -- [Create custom settings location templates](#createcustomtemplates) - - These custom templates let users sync settings for custom applications. - -- [Deploy the custom settings location templates](#deploycustomtemplates) - - After you test the custom template to ensure that settings are synced correctly, you can deploy these templates in one of these ways: - - - Through your existing deployment infrastructure, such as Configuration Manager - - - By using Group Policy preferences - - - [Deploy a UE-V settings template catalog](#deploycatalogue) - - **Note**   - Templates that are deployed by using ESD or Group Policy must be registered with UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. - - - -## Prepare to Deploy UE-V 2.x for Custom Applications - - -Before you start deploying the UE-V features that handle custom applications, there are just a couple things to review. - -### The UE-V Generator - -The UE-V Generator monitors an application to discover and capture the locations where the application stores its settings. The application that is monitored must be a traditional application. You use the UE-V Generator to create settings location templates, but it cannot create a settings location template from these application types: - -- Virtualized applications - -- Applications that are offered through Terminal Services - -- Java applications - -- Windows apps - -**Note**   -UE-V settings location templates cannot be created from virtualized applications or Terminal Services applications. However, settings that are synchronized by using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and Terminal Services applications, open a version of the Windows Installer (.msi) package of the application by using the UE-V Generator. For more information about synchronizing settings for virtual applications, see [Using UE-V 2.x with Application Virtualization Applications](using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md). - - - -**Excluded Locations:** The discovery process excludes locations that commonly store application software files that do not synchronize settings well between user computers or computing environments. By default, these are excluded: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system - -- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive - -- Files that are located in Program Files directories - -- Files that are located in Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files that are located in %Systemroot% - -If registry keys and files that are stored in excluded locations are required to synchronize application settings, you can manually add the locations to the settings location template during the template creation process. -However, only changes to the HKEY\_CURRENT\_USER hive will be sync-ed. - -### Replace the default Microsoft templates - -The UE-V Agent installs a default group of settings location templates for common Microsoft applications and Windows settings. If you customize these templates, or create settings location templates to synchronize settings for custom applications, the UE-V Agent can be configured to use a settings template catalog to store the templates. In this case, you will need to include the default templates along with the custom templates in the settings template catalog. - -When you [Deploy a UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent), you can use the command-line parameter `RegisterMSTemplates` to disable the registration of the default Microsoft templates. - -When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed by the UE-V Agent are deleted and only the templates that are located in the settings template catalog are used. The UE-V Agent configuration setting parameter `RegisterMSTemplates` must be set to *true* in order to override the default Microsoft template. - -**Note**   -If you disable this policy setting after it has been enabled, the UE-V Agent does not restore the default Microsoft templates. - - - -If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, and the UE-V Agent is not configured to replace the default Microsoft templates, the Microsoft templates are ignored. - -You can also replace the default templates by using the UE-V Windows PowerShell features. To replace the default Microsoft template with Windows PowerShell, unregister all of the default Microsoft templates, and then register the customized templates. - -**Note**   -Old settings packages remain in the settings storage location even if you deploy new settings location templates for an application. These packages are not read by the agent, but neither are they automatically deleted. - - - -## Install the UEV 2.x Generator - - -Install the Microsoft User Experience Virtualization (UE-V) 2.0 Generator on a computer that you can then use to create a custom settings location template. This computer should have the applications installed for which custom settings location templates are to be generated. - -**To install the UE-V Generator** - -1. As a user with local administrator rights, locate the UE-V Generator installation file **ToolSetup.exe** provided with the UE-V software. Or, if you know the computer architecture, you can run the appropriate Windows Installer (.msi) file, **ToolsSetupx64.msi** or **ToolsSetupx86.msi**. - -2. Double-click the installation file. The User Experience Virtualization Generator Setup wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Click the options for Microsoft Updates and the Customer Experience Improvement Program. - -5. Select the destination folder in which to install the UE-V Generator, and then click **Next**. - -6. Click **Install** to begin the installation. - - **Note**   - A prompt for **User Account Control** appears before the application is installed. Permission is required to install the UE-V Generator. - - - -7. Click **Finish** to close the wizard after the installation is finished. You must restart your computer before you can run the UE-V Generator. - - To verify that the installation was successful, click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - - **Note**   - The UE-V 2 Generator can only be used to create templates for UE-V 2 Agents. In a mixed deployment of UE-V 1.0 Agents and UE-V 2 Agents, you should continue to use the UE-V 1.0 Generator until you have upgraded all UE-V Agents. - - - -## Deploy a Settings Template Catalog - - -The User Experience Virtualization settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. A scheduled task in the UE-V Agent checks this location one time each day and updates its synchronization behavior, based on the templates in this folder. - -The UE-V Agent registers templates that were added or updated in this folder after the last time that the folder was checked and unregisters templates that are removed. By default, templates are registered and unregistered one time per day at 3:30 A.M. local time by the Task Scheduler and at system startup. To customize the frequency of this scheduled task, see [Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md). - -You can configure the settings template catalog path by using the installation command-line options, Group Policy, WMI, or Windows PowerShell. Templates that are stored at the settings template catalog path are automatically registered and unregistered by a scheduled task. - -**To configure the settings template catalog for UE-V 2.x** - -1. Create a new folder on the computer that stores the UE-V settings template catalog. - -2. Set the following share-level (SMB) permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissions

          Everyone

          No Permissions

          Domain Computers

          Read Permission Levels

          Administrators

          Read/Write Permission Levels

          - - - -3. Set the following NTFS file system permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissionsApply to

          Creator/Owner

          Full Control

          This Folder, Subfolders and Files

          Domain Computers

          List Folder Contents and Read

          This Folder, Subfolders and Files

          Everyone

          No Permissions

          No Permissions

          Administrators

          Full Control

          This Folder, Subfolders and Files

          - - - -4. Click **OK** to close the dialog boxes. - -At a minimum, the network share must grant permissions for the Domain Computers group. In addition, grant access permissions for the network share folder to administrators who are to manage the stored templates. - -## Create Custom Settings Location Templates - - -Use the UE-V Generator to create settings location templates for line-of-business applications or other custom applications. After the template for an application is created, you can deploy it to computers so that settings are synchronized for that application. - -**To create a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Create a settings location template**. - -3. Specify the application. Browse to the file path of the application (.exe) or the application shortcut (.lnk) for which you want to create a settings location template. Specify the command-line arguments, if any, and working directory, if any. Click **Next** to continue. - - **Note**   - Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings. - - - -4. After the application starts, close the application. The UE-V Generator records the locations where the application stores its settings. - -5. After the process is completed, click **Next** to continue. - -6. Review and select the check boxes that are next to the appropriate registry settings locations and settings file locations to synchronize for this application. The list includes the following two categories for settings locations: - - - **Standard**: Application settings that are stored in the registry under the HKEY\_CURRENT\_USER keys or in the file folders under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming**. The UE-V Generator includes these settings by default. - - - **Nonstandard**: Application settings that are stored outside the locations are specified in the best practices for settings data storage (optional). These include files and folders under **Users** \\ \[User name\] \\ **AppData** \\ **Local**. Review these locations to determine whether to include them in the settings location template. Select the locations check boxes to include them. - - Click **Next** to continue. - -7. Review and edit any **Properties**, **Registry** locations, and **Files** locations for the settings location template. - - - Edit the following properties on the **Properties** tab: - - - **Application Name**: The application name that is written in the description of the program files properties. - - - **Program name**: The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. - - - **Product version**: The product version number of the .exe file of the application. This property, in conjunction with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the product. - - - **File version**: The file version number of the .exe file of the application. This property, in conjunction with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. - - - **Template author name** (optional): The name of the settings location template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. Edit the registry locations by using the **Tasks** drop-down menu. Tasks enable you to add new keys, edit the name or scope of existing keys, delete keys, and browse the registry where the keys are located. Use the **All Settings** scope to include all the registry settings under the specified key. Use the **All Settings and Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. Edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations enable you to add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. Leave the file mask empty to include all files in the specified folder. - -8. Click **Create**, and then click **Save** to save the settings location template on the computer. - -9. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you have created the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into production in the enterprise. - -[Application Template Schema Reference for UE-V](https://technet.microsoft.com/library/dn763947.aspx) details the XML structure of the UE-V settings location template and provides guidance for editing these files. - -## Deploy the Custom Settings Location Templates - - -After you create a settings location template with the UE-V Generator, you should test it to ensure that the application settings are synchronized correctly. You can then safely deploy the settings location template to computers in the enterprise. - -Settings location templates can be deployed by using one of these methods: - -- An enterprise software distribution (ESD) system such as System Center Configuration Manager - -- Group Policy preferences - -- A UE-V settings template catalog - -Templates that are deployed by using an ESD system or Group Policy Objects must be registered through UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. Templates that are stored in the settings template catalog location are automatically registered by the UE-V Agent. - -**To use the settings template catalog path to deploy UE-V settings location templates** - -1. Browse to the network share folder that is defined as the settings template catalog. - -2. Add, remove, or update settings location templates in the settings template catalog to reflect the UE-V Agent template configuration that you want for UE-V computers. - - **Note**   - Templates on computers are updated daily. The update is based on changes to the settings template catalog. - - - -3. To manually update templates on a computer that runs the UE-V Agent, open an elevated command prompt, and browse to **%Program Files%\\Microsoft User Experience Virtualization \\ Agent \\ <x86 or x64 >**, and then run **ApplySettingsTemplateCatalog.exe**. - - **Note**   - This program runs automatically during computer startup and daily at 3:30 A. M. to gather any new templates that were recently added to the catalog. - - - - - - - - -## Related topics - - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md deleted file mode 100644 index d918fb1b54..0000000000 --- a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,269 +0,0 @@ ---- -title: Get Started with UE-V 2.x -description: Get Started with UE-V 2.x -author: levinec -ms.assetid: 526ecbf0-0dee-4f0b-b017-8f8d25357b14 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 02/13/2017 ---- - - -# Get Started with UE-V 2.x - - -Follow the steps in this guide to quickly deploy Microsoft User Experience Virtualization (UE-V) 2.0 or 2.1 in a small test environment. This helps you determine whether UE-V is the right solution to manage user settings across multiple devices within your enterprise. - -**Note**   -The information in this section is repeated in greater detail throughout the rest of the documentation. So if you already know that UE-V 2 is the right solution and you don’t need to evaluate it, you can just go right to [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md). - - - -The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows app settings. Make sure your test environment includes two or more user computers that share network access and you’ll be evaluating UE-V in just a short time. - -- [Step 1: Confirm Prerequisites](#step1): Make sure your environment is able to run UE-V, including details about supported configurations. - -- [Step 2: Deploy the Settings Storage Location for UE-V 2](#step2): All UE-V deployments require a location for settings packages that contain the synchronized setting values. - -- [Step 3: Deploy the UE-V 2 Agent](#step3): To synchronize settings using UE-V, devices must have the UE-V Agent installed and running. - -- [Step 4: Test Your UE-V 2 Evaluation Deployment](#step4): Run a few tests on two computers that have the UE-V Agent installed and see how UE-V works. - -That’s it! Once you follow the steps, you’ll be able to evaluate how UE-V can work in your enterprise. - -**Further evaluation:** You can also perform additional steps to configure some third-party and line-of-business applications to synchronize their settings using UE-V as detailed in [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md). - -## Step 1: Confirm Prerequisites - - -Before you proceed, make sure your environment includes these requirements for running UE-V. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architectureWindows PowerShellMicrosoft .NET Framework

          Windows 7

          Ultimate, Enterprise, or Professional Edition

          SP1

          32-bit or 64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4 or higher

          Windows Server 2008 R2

          Standard, Enterprise, Datacenter, or Web Server

          SP1

          64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4 or higher

          Windows 8.1

          Enterprise or Pro

          None

          32-bit or 64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5

          Windows Server 2012 or Windows Server 2012 R2

          Standard or Datacenter

          None

          64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5

          Windows 10, pre-1607 verison

          Enterprise or Pro

          32-bit or 64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5

          Windows Server 2016

          Standard or Datacenter

          None

          64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5

          - -**Note:** Starting with Windows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack - -Also… - -- **MDOP License:** This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see How Do I Get MDOP (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -- **Administrative Credentials** for any computer on which you’ll be installing - -## Step 2: Deploy the Settings Storage Location for UE-V 2 - - -You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. [Deploy a Settings Storage Location](https://technet.microsoft.com/library/dn458891.aspx#ssl) provides more detailed information. - -**Create a network share** - -1. Create a new security group and add UE-V users to it. - -2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant the UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. - -3. Assign UE-V users permission to create a directory when they connect. Grant full permission to all subdirectories of that directory, but block access to anything above. - - 1. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissions

          Everyone

          No permissions

          Security group of UE-V users

          Full control

          - - - - 2. Set the following NTFS file system permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
          User accountRecommended permissionsFolder

          Creator/owner

          Full control

          Subfolders and files only

          Security group of UE-V users

          List folder/read data, create folders/append data

          This folder only

          - - - -**Security Note:** - -If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: - -1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. - -2. Set the registry key value to *1*. - -## Step 3: Deploy the UE-V 2 Agent - - -The UE-V Agent synchronizes application and Windows settings between users’ computers and devices. For evaluation purposes, install the agent on at least two computers in your test environment that belong to the same user. - -Run the AgentSetup.exe file from the command line to install the UE-V Agent. It installs on both 32-bit and 64-bit operating systems. - -``` syntax -AgentSetup.exe SettingsStoragePath=\\server\settingsshare\%username% -``` - -You must specify the SettingsStoragePath command line parameter as the network share from Step 2. [Deploy a UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) provides more detailed information. - -## Step 4: Test Your UE-V 2 Evaluation Deployment - - -You can now run a few tests on your UE-V evaluation deployment to see how UE-V works. - -**** - -1. On the first computer (Computer A), make one or more of these changes: - - 1. Open to Windows Desktop and move the taskbar to a different location in the window. - - 2. Change the default fonts. - - 3. Open Calculator and set to **scientific**. - - 4. Change the behavior of any Windows app, as detailed in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md). - - 5. Disable Microsoft Account settings synchronization and Roaming Profiles. - -2. Log off Computer A. Settings are saved in a UE-V settings package when users lock, logoff, exit an application, or when the sync provider runs (every 30 minutes by default). - -3. Log in to the second computer (Computer B) as the same user as Computer A. - -4. Open to Windows Desktop and verify that the taskbar location matches that of Computer A. Verify that the default fonts match and that Calculator is set to **scientific**. Also verify the change you made to any Windows app. - -You can change the settings in Computer B back to the original Computer A settings. Then log off Computer B and log in to Computer A to verify the changes. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/images/checklistbox.gif b/mdop/uev-v2/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/uev-v2/images/checklistbox.gif and /dev/null differ diff --git a/mdop/uev-v2/images/deploymentworkflow.png b/mdop/uev-v2/images/deploymentworkflow.png deleted file mode 100644 index b665a0bfea..0000000000 Binary files a/mdop/uev-v2/images/deploymentworkflow.png and /dev/null differ diff --git a/mdop/uev-v2/images/ue-vgeneratorprocess.gif b/mdop/uev-v2/images/ue-vgeneratorprocess.gif deleted file mode 100644 index 1c1ef4331d..0000000000 Binary files a/mdop/uev-v2/images/ue-vgeneratorprocess.gif and /dev/null differ diff --git a/mdop/uev-v2/images/uev2archdiagram.gif b/mdop/uev-v2/images/uev2archdiagram.gif deleted file mode 100644 index 8b1647b48c..0000000000 Binary files a/mdop/uev-v2/images/uev2archdiagram.gif and /dev/null differ diff --git a/mdop/uev-v2/index.md b/mdop/uev-v2/index.md deleted file mode 100644 index b0a92410ba..0000000000 --- a/mdop/uev-v2/index.md +++ /dev/null @@ -1,324 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.x -description: Microsoft User Experience Virtualization (UE-V) 2.x -author: dansimp -ms.assetid: b860fed0-b846-415d-bdd6-ba60231a64be -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.x - ->[!NOTE] ->This documentation is a for version of UE-V that was included in the Microsoft Desktop Optimization Pack (MDOP). For information about the latest version of UE-V which is included in Windows 10 Enterprise, see [Get Started with UE-V](https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started). - - -Capture and centralize your users’ application settings and Windows OS settings by implementing Microsoft User Experience Virtualization (UE-V) 2.0 or 2.1. Then, apply these settings to the devices users access in your enterprise, like desktop computers, laptops, or virtual desktop infrastructure (VDI) sessions. - -**With UE-V you can…** - -- Specify which application and desktop settings synchronize - -- Deliver the settings anytime and anywhere users work throughout the enterprise - -- Create custom templates for your third-party or line-of-business applications - -- Recover settings after hardware replacement or upgrade, or after reimaging a virtual machine to its initial state - -## Components of UE-V 2.x - - -This diagram shows how deployed UE-V components work together to synchronize settings. - -![uev2 architectural diagram](images/uev2archdiagram.gif) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ComponentFunction

          UE-V Agent

          Installed on every computer that needs to synchronize settings, the UE-V Agent monitors registered applications and the operating system for any settings changes, then synchronizes those settings between computers.

          Settings packages

          Application settings and Windows settings are stored in settings packages created by the UE-V Agent. Settings packages are built, locally stored, and copied to the settings storage location.

          -
            -
          • The setting values for desktop applications are stored when the user closes the application.

          • -
          • Values for Windows settings are stored when the user logs off, when the computer is locked, or when the user disconnects remotely from a computer.

          • -
          -

          The sync provider determines when the application or operating system settings are read from the Settings Packages and synchronized.

          Settings storage location

          This is a standard network share that your users can access. The UE-V Agent verifies the location and creates a hidden system folder in which to store and retrieve user settings.

          Settings location templates

          UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V . You can also create, edit, or validate custom settings location templates by managing settings synchronization for custom applications.

          -
          -Note

          Settings location templates are not required for Windows apps.

          -
          -
          - -

          Windows app list

          Settings for Windows apps are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows apps are enabled for settings synchronization using a managed list of apps. By default, this list includes most Windows apps.

          -

          You can add or remove applications in the Windows app list by following the procedures shown here.

          - - - -### Managing Settings Synchronization for Custom Applications - -Use these UE-V components to create and manage custom templates for your third-party or line-of-business applications. - - ---- - - - - - - - - - - -

          UE-V Generator

          Use the UE-V Generator to create custom settings location templates that you can then distribute to user computers. The UE-V Generator also lets you edit an existing template or validate a template that was created by using another XML editor.

          Settings template catalog

          The settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V Agent checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior.

          -

          If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see Configure a UE-V settings template catalog.

          - - - -![ue-v generator process](images/ue-vgeneratorprocess.gif) - -## Settings Synchronized by Default - - -UE-V synchronizes settings for these applications by default. For a complete list and more detailed information, see [Settings that are automatically synchronized in a UE-V deployment](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). - -Microsoft Office 2013 applications (UE-V 2.1 SP1 and 2.1) - -Microsoft Office 2010 applications (UE-V 2.1 SP1, 2.1, and 2.0) - -Microsoft Office 2007 applications (UE-V 2.0 only) - -Internet Explorer 8, 9, and 10 - -Internet Explorer 11 in UE-V 2.1 SP1 and 2.1 - -Many Windows applications, such as Xbox - -Many Windows desktop applications, such as Notepad - -Many Windows settings, such as desktop background or wallpaper - -**Note** -You can also [customize UE-V to synchronize settings](https://technet.microsoft.com/library/dn458942.aspx) for applications other than those synchronized by default. - - - -## Compare UE-V to other Microsoft products - - -Use this table to compare UE-V to Synchronize Profiles in Windows 7, Synchronize Profiles in Windows 8, and the Sync PC Settings feature of Microsoft account. - - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          FeatureSynchronize Profiles using Windows 7Synchronize Profiles using Windows 8Synchronize Profiles using Windows 10Microsoft accountUE-V 2.0UE-V 2.1 and 2.1 SP1

          Synchronize settings between multiple computers

          Synchronize settings between physical and virtual apps

          Synchronize Windows app settings

          Manage via WMI

          Synchronize settings changes on a regular basis

          Minimal configuration for Setup

          Supported on non-domain joined computers

          Supports Primary Computer Active Directory attribute

          Synchronizes settings between virtual desktop infrastructure (VDI)/Remote Desktop Services (RDS) and rich desktops

          Unlimited setting storage space

          Choice in which app settings to synchronize

          Backup/Restore for IT Pro

          Partial

          - - - -## UE-V 2.x Release Notes - - -For more information, and for late-breaking news that did not make it into the documentation, see - -- [Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) - -- [Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) - -- [Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) - -## Other resources for this product - - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - -### More information - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md deleted file mode 100644 index 2716ff5ef7..0000000000 --- a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -title: Manage Administrative Backup and Restore in UE-V 2.x -description: Manage Administrative Backup and Restore in UE-V 2.x -author: levinec -ms.assetid: 2eb5ae75-65e5-4afc-adb6-4e83cf4364ae -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage Administrative Backup and Restore in UE-V 2.x - - -As an administrator of Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1, you can restore application and Windows settings to their original state. And new in UE-V 2.1, you can also restore additional settings when a user adopts a new device. - -## Restore Settings in UE-V 2.1 or UE-V 2.1 SP1 when a User Adopts a New Device - - -To restore settings when a user adopts a new device, you can put a settings location template in **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To backup settings for a template, use the following cmdlet in Windows PowerShell: - -``` syntax -Set-UevTemplateProfile -ID -Profile -``` - -- <TemplateID> is the UE-V Template ID - -- <backup> can either be Backup or Roaming - -When replacing a user’s device UE-V automatically restores settings if the user’s domain, username, and device name all match. All synchronized and any backup data is restored on the device automatically. - -You can also use the new PowerShell cmdlet, Restore-UevBackup, to restore settings from a different device. To clone the settings packages for the new device, use the following cmdlet in Windows PowerShell: - -``` syntax -Restore-UevBackup –Machine -``` - -where <MachineName> is the computer name of the device. - -Templates such as the Office 2013 template that include many applications can either all be included in the roamed (default) or backed up profile. Individual apps in a template suite follow the group. Office 2013 in-box templates include both roaming and backup-only settings. Backup-only settings cannot be included in a roaming profile. - -As part of the Backup/Restore feature, UE-V added **last known good (LKG)** to the options for rolling back to settings. In this release, you can roll back to either the original settings or LKG settings. The LKG settings let users roll back to an intermediate and stable point ahead of the pre-UE-V state of the settings. - -### How to Backup/Restore Templates with UE-V - -These are the key backup and restore components of UE-V: - -- Template profiles - -- Settings packages location within the Settings Storage Location template - -- Backup trigger - -- How settings are restored - -**Template Profiles** - -A UE-V template profile is defined when the template is registered on the device or post registration through the PowerShell/WMI configuration utility. The profile types include: - -- Roaming (default) - -- Backup - -- BackupOnly - -All templates are included in the roaming profile when registered unless otherwise specified. These templates synchronize settings to all UE-V enabled devices with the corresponding template enabled. - -Templates can be added to the Backup Profile with PowerShell or WMI using the Set-UevTemplateProfile cmdlet. Templates in the Backup Profile back up these settings to the Settings Storage Location in a special Device name directory. Specified settings are backed up to this location. - -Templates designated BackupOnly include settings specific to that device that should not be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. - -**Settings packages location within the Settings Storage Location template** - -Roaming Profile settings are stored on the settings storage location. Templates assigned to the Backup or the BackupOnly profile store their settings to the Settings Storage Location in a special Device name directory. Each device with templates in these profiles has its own device name. UE-V does not clean up these directories. - -**Backup trigger** - -Backup is triggered by the same events that trigger a UE-V synchronization. - -**How settings are restored** - -Restoring a user’s device restores the currently registered Template’s settings from another device’s backup folder and all synchronized settings to the current machine. Settings are restored in these two ways: - -- **Automatic restore** - - If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user logs on to a new device for the first time and these criteria are met, the settings data is applied to that device. - - **Note** - Accessibility and Windows Desktop settings require the user to re-logon to Windows to be applied. - - - -- **Manual Restore** - - If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command causes the user’s settings to be downloaded from the Settings Storage Location. - -## Restore Application and Windows Settings to Original State - - -WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V Agent was installed. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user logs on to the operating system. - -**To restore application settings and Windows settings with Windows PowerShell for UE-V 2.x** - -1. Open the Windows PowerShell window. - -2. Enter the following Windows PowerShell cmdlet to restore the application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
          Windows PowerShell cmdletDescription

          Restore-UevUserSetting -<TemplateID>

          Restores the user settings for an application or restores a group of Windows settings.

          - - - -**To restore application settings and Windows settings with WMI** - -1. Open a Windows PowerShell window. - -2. Enter the following WMI command to restore application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
          WMI commandDescription

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList <template_ID>

          Restores the user settings for an application or restores a group of Windows settings.

          - - - -~~~ -**Note** -UE-V does not provide a settings rollback for Windows apps. -~~~ - - - - - - - - -## Related topics - - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md deleted file mode 100644 index 7b0ce9f869..0000000000 --- a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Manage Configurations for UE-V 2.x -description: Manage Configurations for UE-V 2.x -author: levinec -ms.assetid: e2332eca-a9cd-4446-8f7c-d17058b03466 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage Configurations for UE-V 2.x - - -In the course of the Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 lifecycle, you have to manage the configuration of the UE-V Agent and also manage storage locations for resources such as settings package files. You might have to perform other tasks, for example, configuring the Company Settings Center to define how users interact with UE-V. The following topics provide guidance for managing these UE-V resources. - -## Configuring UE-V 2.x by using Group Policy Objects - - -You can use Group Policy Objects to modify the settings that define how UE-V synchronizes settings on computers. - -[Configuring UE-V 2.x with Group Policy Objects](configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md) - -## Configuring UE-V 2.x with System Center Configuration Manager 2012 - - -You can use System Center 2012 Configuration Manager to manage the UE-V Agent by using the UE-V 2 Configuration Pack. - -[Configuring UE-V 2.x with System Center Configuration Manager 2012](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md) - -## Administering UE-V 2.x with PowerShell and WMI - - -UE-V provides Windows PowerShell cmdlets, which can help administrators perform various UE-V tasks. - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -## Configuring the Company Settings Center for UE-V 2.x - - -You can configure the Company Settings Center that is installed by using the UE-V Agent to define how users interact with UE-V. - -[Configuring the Company Settings Center for UE-V 2.x](configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md) - -## Examples of configuration settings for UE-V 2.x - - -Here are some examples of UE-V configuration settings: - -- **Settings Storage Path:** Specifies the location of the file share that stores the UE-V settings. - -- **Settings Template Catalog Path:** Specifies the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. - -- **Register Microsoft Templates:** Specifies whether the default Microsoft templates should be registered during installation. - -- **Synchronization Method:** Specifies whether UE-V uses the sync provider or "none". The "SyncProvider" supports computers that are disconnected from the network. "None" applies when the computer is always connected to the network. For more information about the Sync Method, see [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md). - -- **Synchronization Timeout:** Specifies the number of milliseconds that the computer waits before time-out when it retrieves the user settings from the settings storage location. - -- **Synchronization Enable:** Specifies whether the UE-V settings synchronization is enabled or disabled. - -- **Maximum Package Size:** Specifies a settings package file threshold size in bytes at which the UE-V Agent reports a warning. - -- **Don’t Sync Windows App Settings:** Specifies that UE-V should not synchronize Windows apps. - -- **Enable/Disable First Use Notification:** Specifies whether UE-V displays a dialog box the first time that the UE-V Agent runs on a user’s computer. - -- **Enable/Disable Tray Icon:** Specifies whether UE-V displays an icon in the notification area and any notifications associated with it. The icon provides a link to the Company Settings Center. - -- **Custom Contact IT Hyperlink:** Defines the path, text, and description for the **Contact IT** hyperlink in the Company Settings Center. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - -  - -  - - - - - diff --git a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md deleted file mode 100644 index ba8db1fb4b..0000000000 --- a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md +++ /dev/null @@ -1,380 +0,0 @@ ---- -title: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI -description: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI -author: levinec -ms.assetid: 56e6780b-8b2c-4717-91c8-2af63062ab75 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI - - -You can use Windows Management Instrumentation (WMI) and Windows PowerShell to manage Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Agent configuration and synchronization behavior. For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://go.microsoft.com/fwlink/?LinkId=393495) (https://go.microsoft.com/fwlink/?LinkId=393495). - -**To deploy the UE-V Agent by using Windows PowerShell** - -1. Stage the UE-V installer file in an accessible network share. - - **Note** - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer packages, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time by using the installation file, you must use the same file type. - - - -2. Use one of the following Windows PowerShell commands to install the UE-V Agent. - - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -**To configure the UE-V Agent by using Windows PowerShell** - -1. Open a Windows PowerShell window. To manage computer settings that affect all users of the computer by using the *Computer* parameter, open the window with an account that has administrator rights. - -2. Use the following Windows PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows PowerShell commandDescription

          Get-UevConfiguration

          -

          Gets the effective UE-V Agent settings. User-specific settings have precedence over the computer settings.

          Get-UevConfiguration - CurrentComputerUser

          -

          Gets the UE-V Agent settings values for the current user only.

          Get-UevConfiguration -Computer

          Gets the UE-V Agent configuration settings values for all users on the computer.

          Get-UevConfiguration -Details

          Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.

          Set-UevConfiguration -Computer –ContactITDescription <IT description>

          Sets the text that is displayed in the Company Settings Center for the help link.

          Set-UevConfiguration -Computer -ContactITUrl <string>

          Sets the URL of the link in the Company Settings Center for the help link. Any URL protocol can be used.

          Set-UevConfiguration -Computer –EnableDontSyncWindows8AppSettings

          Configures the UE-V Agent to not synchronize any Windows apps for all users on the computer.

          Set-UevConfiguration -CurrentComputerUser – EnableDontSyncWindows8AppSettings

          Configures the UE-V Agent to not synchronize any Windows apps for the current computer user.

          Set-UevConfiguration -Computer –EnableFirstUseNotification

          Configures the UE-V Agent to display notification the first time the agent runs for all users on the computer.

          Set-UevConfiguration -Computer –DisableFirstUseNotification

          Configures the UE-V Agent to not display notification the first time that the agent runs for all users on the computer.

          Set-UevConfiguration -Computer –EnableSettingsImportNotify

          Configures the UE-V Agent to notify all users on the computer when settings synchronization is delayed.

          -

          Use the DisableSettingsImportNotify parameter to disable notification.

          Set-UevConfiguration - CurrentComputerUser -EnableSettingsImportNotify

          Configures the UE-V Agent to notify the current user when settings synchronization is delayed.

          -

          Use the DisableSettingsImportNotify parameter to disable notification.

          Set-UevConfiguration -Computer –EnableSyncUnlistedWindows8Apps

          Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI.

          -

          Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.

          Set-UevConfiguration - CurrentComputerUser - EnableSyncUnlistedWindows8Apps

          Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI.

          -

          Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.

          Set-UevConfiguration –Computer –DisableSync

          Disables UE-V for all the users on the computer.

          -

          Use the EnableSync parameter to enable or re-enable.

          Set-UevConfiguration –CurrentComputerUser -DisableSync

          Disables UE-V for the current user on the computer.

          -

          Use the EnableSync parameter to enable or re-enable.

          Set-UevConfiguration -Computer –EnableTrayIcon

          Enables the UE-V icon in the notification area for all users of the computer.

          -

          Use the DisableTrayIcon parameter to disable the icon.

          Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>

          Configures the UE-V agent to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes.

          Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>

          Configures the UE-V agent to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user.

          Set-UevConfiguration -Computer -SettingsImportNotifyDelayInSeconds

          Specifies the time in seconds before the user is notified for all users of the computer

          Set-UevConfiguration - CurrentComputerUser -SettingsImportNotifyDelayInSeconds

          Specifies the time in seconds before notification for the current user is sent.

          Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location>

          Defines a per-computer settings storage location for all users of the computer.

          Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location>

          Defines a per-user settings storage location.

          Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog>

          Sets the settings template catalog path for all users of the computer.

          Set-UevConfiguration -Computer -SyncMethod <sync method>

          Sets the synchronization method for all users of the computer: SyncProvider or None.

          Set-UevConfiguration -CurrentComputerUser -SyncMethod <sync method>

          Sets the synchronization method for the current user: SyncProvider or None.

          Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds>

          Sets the synchronization time-out in milliseconds for all users of the computer

          Set- UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds>

          Set the synchronization time-out for the current user.

          Clear-UevConfiguration –Computer -<setting name>

          Clears the specified setting for all users on the computer.

          Clear-UevConfiguration –CurrentComputerUser -<setting name>

          Clears the specified setting for the current user only.

          Export-UevConfiguration <settings migration file>

          Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev.

          -

          The Export cmdlet exports all UE-V Agent settings that are configurable with the Computer parameter.

          Import-UevConfiguration <settings migration file>

          Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev.

          - - - -**To export UE-V package settings and repair UE-V templates by using Windows PowerShell** - -1. Open a Windows PowerShell window as an administrator. - -2. Use the following Windows PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - -

          Windows PowerShell command

          Description

          Export-UevPackage MicrosoftCalculator6.pkgx

          Extracts the settings from a Microsoft Calculator package file and converts them into a human-readable format in XML.

          Repair-UevTemplateIndex

          Repairs the index of the UE-V settings location templates.

          - - - -**To configure the UE-V Agent by using WMI** - -1. User Experience Virtualization provides the following set of WMI commands. Administrators can use this interface to configure the UE-V agent at the command line and automate typical configuration tasks. - - Use an account with administrator rights to open a Windows PowerShell window. - -2. Use the following WMI commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows PowerShell commandDescription

          Get-WmiObject -Namespace root\Microsoft\UEV Configuration

          -

          Displays the active UE-V Agent settings. User-specific settings have precedence over the computer settings.

          Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

          Displays the UE-V Agent configuration that is defined for a user.

          Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          Displays the UE-V Agent configuration that is defined for a computer.

          Get-WmiObject –Namespace root\Microsoft\Uev ConfigurationItem

          Displays the details for each configuration item.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.SettingsStoragePath = <path_to_settings_storage_location>

          -

          $config.Put()

          Defines a per-computer settings storage location.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

          -

          $config.SettingsStoragePath = <path_to_settings_storage_location>

          -

          $config.Put()

          Defines a per-user settings storage location.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.SyncTimeoutInMilliseconds = <timeout_in_milliseconds>

          -

          $config.Put()

          Sets the synchronization time-out in milliseconds for all users of the computer.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.MaxPackageSizeInBytes = <size_in_bytes>

          -

          $config.Put()

          Configures the UE-V Agent to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes for all users of the computer.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.SyncMethod = <sync_method>

          -

          $config.Put()

          Sets the synchronization method for all users of the computer: SyncProvider or None.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.<setting name> = $true

          -

          $config.Put()

          To enable a specific per-computer setting, clear the setting, and use $null as the setting value. Use UserConfiguration for per-user settings.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.<setting name> = $false

          -

          $config.Put()

          To disable a specific per-computer setting, clear the setting, and use $null as the setting value. Use User Configuration for per-user settings.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.<setting name> = <setting value>

          -

          $config.Put()

          Updates a specific per-computer setting. To clear the setting, use $null as the setting value.

          $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

          -

          $config.<setting name> = <setting value>

          -

          $config.Put()

          Updates a specific per-user setting for all users of the computer. To clear the setting, use $null as the setting value.

          - - - -~~~ -Upon configuration of the UE-V Agent with WMI and Windows PowerShell, the defined configuration is stored in the registry in the following locations. - -`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration` - -`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration` -~~~ - -**To export UE-V package settings and repair UE-V templates by using WMI** - -1. UE-V provides the following set of WMI commands. Administrators can use this interface to export a package or repair UE-V templates. - -2. Use the following WMI commands. - - - - - - - - - - - - - - - - - - - - - - -
          WMI commandDescription

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name ExportPackage -ArgumentList <package name>

          Extracts the settings from a package file and converts them into a human-readable format in XML.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name RebuildIndex

          Repairs the index of the UE-V settings location templates. Must be run as administrator.

          - - - -~~~ -**Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). -~~~ - -## Related topics - - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md deleted file mode 100644 index 8de1e74734..0000000000 --- a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md +++ /dev/null @@ -1,379 +0,0 @@ ---- -title: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI -description: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI -author: levinec -ms.assetid: b5253050-acc3-4274-90d0-1fa4c480331d -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 use XML settings location templates to define the settings that User Experience Virtualization captures and applies. UE-V includes a set of standard settings location templates. It also includes the UE-V Generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates, you can manage those templates by using Windows PowerShell and the Windows Management Instrumentation (WMI). For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://go.microsoft.com/fwlink/p/?LinkId=393495) (https://go.microsoft.com/fwlink/p/?LinkId=393495). - -## Manage UE-V 2 settings location templates by using Windows PowerShell - - -The WMI and Windows PowerShell features of UE-V include the ability to enable, disable, register, update, and unregister settings location templates. By using these features, you can automate the process of registering, updating, or unregistering templates with the UE-V Agent. You can also manually register templates by using WMI and Windows PowerShell commands. By using these features in conjunction with an electronic software distribution solution, Group Policy, or another automated deployment method such as a script, you can further automate that process. - -You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable, disable, or list templates. - -***To manage settings location templates by using Windows PowerShell*** - -1. Use an account with administrator rights to open a Windows PowerShell command prompt. - -2. Use the following Windows PowerShell cmdlets to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows PowerShell commandDescription

          Get-UevTemplate

          Lists all the settings location templates that are registered on the computer.

          Get-UevTemplate –Application <string>

          Lists all the settings location templates that are registered on the computer where the application name or template name contains <string>.

          Get-UevTemplate –TemplateID <string>

          Lists all the settings location templates that are registered on the computer where the template ID contains <string>.

          Get-UevTemplate [-ApplicationOrTemplateID] <string>

          Lists all the settings location templates that are registered on the computer where the application or template name, or template ID contains <string>.

          Get-UevTemplateProgram [-ID] <template ID>

          Gets the name of the program and version information, which depend on the template ID.

          Get-UevAppXPackage

          Gets the effective list of Windows apps.

          Get-UevAppXPackage -Computer

          Gets the list of Windows apps that are configured for the computer.

          Get-UevAppXPackage -CurrentComputerUser

          Gets the list of Windows apps that are configured for the current user.

          Register-UevTemplate [-Path] <template file path>[,<template file path>]

          Registers one or more settings location template with UE-V by using relative paths and/or wildcard characters in file paths. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

          Register-UevTemplate –LiteralPath <template file path>[,<template file path>]

          Registers one or more settings location template with UE-V by using literal paths, where no characters can be interpreted as wildcard characters. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

          Unregister-UevTemplate [-ID] <template ID>

          Unregisters a settings location template with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

          Unregister-UevTemplate -All

          Unregisters all settings location templates with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

          Update-UevTemplate [-Path] <template file path>[,<template file path>]

          Updates one or more settings location templates with a more recent version of the template. Use relative paths and/or wildcard characters in the file paths. The new template should be a newer version than the existing template.

          Update-UevTemplate –LiteralPath <template file path>[,<template file path>]

          Updates one or more settings location templates with a more recent version of the template. Use full paths to template files, where no characters can be interpreted as wildcard characters. The new template should be a newer version than the existing template.

          Clear-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

          Removes one or more Windows apps from the computer Windows app list.

          Clear-UevAppXPackage -CurrentComputerUser

          Removes Windows app from the current user Windows app list.

          Clear-UevAppXPackage –Computer -All

          Removes all Windows apps from the computer Windows app list.

          Clear-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

          Removes one or more Windows apps from the current user Windows app list.

          Clear-UevAppXPackage [–CurrentComputerUser] -All

          Removes all Windows apps from the current user Windows app list.

          Disable-UevTemplate [-ID] <template ID>

          Disables a settings location template for the current user of the computer.

          Disable-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

          Disables one or more Windows apps in the computer Windows app list.

          Disable-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

          Disables one or more Windows apps in the current user Windows app list.

          Enable-UevTemplate [-ID] <template ID>

          Enables a settings location template for the current user of the computer.

          Enable-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

          Enables one or more Windows apps in the computer Windows app list.

          Enable-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

          Enables one or more Windows apps in the current user Windows app list.

          Test-UevTemplate [-Path] <template file path>[,<template file path>]

          Determines whether one or more settings location templates comply with its XML schema. Can use relative paths and wildcard characters.

          Test-UevTemplate –LiteralPath <template file path>[,<template file path>]

          Determines whether one or more settings location templates comply with its XML schema. The path must be a full path to the template file, but does not include wildcard characters.

          - - - -The UE-V Windows PowerShell features enable you to manage a group of settings templates that are deployed in your enterprise. Use the following procedure to manage a group of templates by using Windows PowerShell. - -**To manage a group of settings location templates by using Windows PowerShell** - -1. Modify or update the desired settings location templates. - -2. If you want to modify or update the settings location templates, deploy those settings location templates to a folder that is accessible to the local computer. - -3. On the local computer, open a Windows PowerShell window with administrator rights. - -4. Unregister all the previously registered versions of the templates by typing the following command. - - ``` syntax - Unregister-UevTemplate -All - ``` - - This command unregisters all active templates on the computer. - -5. Register the updated templates by typing the following command. - - ``` syntax - Register-UevTemplate \*.xml - ``` - - This command registers all of the settings location templates that are located in the specified template folder. - -### Windows app list - -By listing a Windows app in the Windows app list, you specify whether that app is enabled or disabled for settings synchronization. Apps are identified in the list by their Package Family name and whether settings synchronization should be enabled or disabled for that app. When you use these settings along with the Unlisted Default Sync Behavior setting, you can control whether Windows apps are synchronized. - -To display the Package Family Name of installed Windows apps, at a Windows PowerShell command prompt, enter: - -``` syntax -Get-AppxPackage | Sort-Object PackageFamilyName | Format-Table PackageFamilyName -``` - -To display a list of Windows apps that can synchronize settings on a computer with their package family name, enabled status, and enabled source, at a Windows PowerShell command prompt, enter: `Get-UevAppxPackage` - -**Definitions of Get-UevAppxPackage properties** - -**DisplayName** -The name that is displayed to the user in the Company Settings Center application. The `DisplayName` property is derived from the `PackageFamilyName` property. - -**PackageFamilyName** -The name of the package that is installed for the current user. - -**Enabled** -Defines whether the settings for the app are configured to synchronize. - -**EnabledSource** -The location where the configuration that enables or disables the app is set. Possible values are: *NotSet*, *LocalMachine*, *LocalUser*, *PolicyMachine*, and *PolicyUser*. - -**NotSet** -The policy is not configured to synchronize this app. - -**LocalMachine** -The enabled state is set in the local computer section of the registry. - -**LocalUser** -The enabled state is set in the current user section of the registry. - -**PolicyMachine** -The enabled state is set in the policy section of the local computer section of the registry. - -To get the user-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage –CurrentComputerUser` - -To get the computer-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage –Computer` - -For either parameter, CurrentComputerUser or Computer, the cmdlet returns a list of the Windows apps that are configured at the user or at the computer level. - -**Definitions of properties** - -**DisplayName** -The name that is displayed to the user in the Company Settings Center application. The `DisplayName` property is derived from the `PackageFamilyName` property. - -**PackageFamilyName** -The name of the package that is installed for the current user. - -**Enabled** -Defines whether the settings for the app are configured to synchronize for the specified switch, that is, **user** or **computer**. - -**Installed** -True if the app, that is, the PackageFamilyName is installed for the current user. - -### Manage UE-V 2 settings location templates by using WMI - -User Experience Virtualization provides the following set of WMI commands. Administrators can use these interfaces to manage settings location templates from Windows PowerShell and automate template administrative tasks. - -**To manage settings location templates by using WMI** - -1. Use an account with administrator rights to open a Windows PowerShell window. - -2. Use the following WMI commands to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows PowerShell commandDescription

          Get-WmiObject -Namespace root\Microsoft\UEV SettingsLocationTemplate | Select-Object TemplateId,TemplateName, TemplateVersion,Enabled | Format-Table -Autosize

          Lists all the settings location templates that are registered for the computer.

          Invoke-WmiMethod –Namespace root\Microsoft\UEV –Class SettingsLocationTemplate –Name GetProcessInfoByTemplateId <template Id>

          Gets the name of the program and version information, which depends on the template name.

          Get-WmiObject -Namespace root\Microsoft\UEV EffectiveWindows8App

          Gets the effective list of Windows apps.

          Get-WmiObject -Namespace root\Microsoft\UEV MachineConfiguredWindows8App

          Gets the list of Windows apps that are configured for the computer.

          Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguredWindows8App

          Gets the list of Windows apps that are configured for the current user.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Register -ArgumentList <template path >

          Registers a settings location template with UE-V.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name UnregisterByTemplateId -ArgumentList <template ID>

          Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Update -ArgumentList <template path>

          Updates a settings location template with UE-V. The new template should be a newer version than the existing one.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>

          Removes one or more Windows apps from the computer Windows app list.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>

          Removes one or more Windows apps from the current user Windows app list.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name DisableByTemplateId -ArgumentList <template ID>

          Disables one or more settings location templates with UE-V.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>

          Disables one or more Windows apps in the computer Windows app list.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>

          Disables one or more Windows apps in the current user Windows app list.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name EnableByTemplateId -ArgumentList <template ID>

          Enables a settings location template with UE-V.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>

          Enables Windows apps in the computer Windows app list.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>

          Enables Windows apps in the current user Windows app list.

          Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Validate -ArgumentList <template path>

          Determines whether a given settings location template complies with its XML schema.

          - - - -~~~ -**Note** -Where a list of Package Family Names is called by the WMI command, the list must be in quotes and separated by a pipe symbol, for example, `""`. -~~~ - - - -### Deploying the UE-V Agent using Windows PowerShell - -**How to deploy the UE-V Agent by using Windows PowerShell** - -1. Stage the UE-V Agent installation package in an accessible network share. - - **Note** - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. The Windows Installer packages, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time by using the installation file, you must use the same file type. - - - -2. Use one of the following Windows PowerShell commands to install the UE-V Agent. - - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -**Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). - -## Related topics - - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md deleted file mode 100644 index 72c09ecf9e..0000000000 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes -author: levinec -ms.assetid: 5ef66cd1-ba2b-4383-9f45-e7cde41f1ba1 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) 2.0 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization. - -### Registry settings do not synchronize between App-V and native applications on the same computer - -When a computer has an application that is installed through both Application Virtualization (App-V) and a locally with a Windows Installer (.msi) file, the registry-based settings do not synchronize between the technologies. - -**WORKAROUND:** To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Settings do not synchronization when network share is outside user’s domain - -When Windows® 8 attempts operating system settings synchronization, the synchronization fails with the following error message: **boost::filesystem::exists::Incorrect user name or password**. This error can indicate that the network share is outside the user’s domain or a domain with a trust relationship to that domain. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. Network shares that are used for UE-V settings storage locations should reside in the same Active Directory domain as the user or a trusted domain of the user’s domain. - -**WORKAROUND:** Use network shares from the same Active Directory domain as the user. - -### Unpredictable results with both Office 2010 and Office 2013 installed - -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. - -**WORKAROUND:** Install only one version of Office or limit which settings are synchronized by UE-V. - -### Uninstall and re-install of Windows 8 app reverts settings to initial state - -While using UE-V settings synchronization for a Windows 8 app, if the user uninstalls the app and then reinstalls the app, the app’s settings revert to their default values.  This happens because the uninstall removes the local (cached) copy of the app’s settings but does not remove the local UE-V settings package.  When the app is reinstalled and launched, UE-V gather the app settings that were reset to the app defaults and then uploads the default settings to the central storage location.  Other computers running the app then download the default settings.  This behavior is identical to the behavior of desktop applications. - -**WORKAROUND:** None. - -### Email signature roaming for Outlook 2010 - -UE-V will roam the Outlook 2010 signature files between devices. However, the default signature options for new messages and replies or forwards are not synchronized. These two settings are stored in the Outlook profile, which UE-V does not roam. - -**WORKAROUND:** None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 64-bit version of Microsoft Office for modern computers. To determine which version you need, [click here](https://support.office.com/article/choose-between-the-64-bit-or-32-bit-version-of-office-2dee7807-8f95-4d0c-b5fe-6c6f49b8d261?ui=en-US&rs=en-US&ad=US#32or64Bit=Newer_Versions). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -**WORKAROUND:** None - -### MSI’s are not localized - -UE-V 2.0 includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -**WORKAROUND:** None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -**WORKAROUND:** Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -**WORKAROUND:** Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -**WORKAROUND:** None. - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. - -**WORKAROUND:** None - -### Windows 8 apps do not sync settings when the app restarts after closing unexpectedly - -If a Windows 8 app closes unexpectedly soon after startup, settings for the application may not be synchronized when the application is restarted. - -**WORKAROUND:** Close the Windows 8 app, close and restart the UevAppMonitor.exe application (can use TaskManager), and then restart the Windows 8 app. - -### UE-V 1 agent generates errors when running UE-V 2 templates - -If a UE-V 2 settings location template is distributed to a computer installed with a UE-V 1 agent, some settings fail to synchronize between computers and the agent reports errors in the event log. - -**WORKAROUND:** When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have computers running the previous version of the agent, create a separate UE-V 2.0 catalog to support the UE-V 2.0 Agent and templates. - -## Hotfixes and Knowledge Base articles for UE-V 2.0 - - -This section contains hotfixes and KB articles for UE-V 2.0. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KB ArticleTitleLink

          2927019

          Hotfix Package 1 for Microsoft User Experience Virtualization 2.0

          support.microsoft.com/kb/2927019

          2903501

          UE-V: User Experience Virtualization (UE-V) compatibility with user profiles

          support.microsoft.com/kb/2903501/EN-US

          2770042

          UE-V Registry Settings

          support.microsoft.com/kb/2770042/EN-US

          2847017

          UE-V settings replicated by Internet Explorer

          support.microsoft.com/kb/2847017/EN-US

          2930271

          Understanding the limitations of roaming Outlook signatures in Microsoft UE-V

          support.microsoft.com/kb/2930271/EN-US

          2769631

          How to repair a corrupted UE-V install

          support.microsoft.com/kb/2769631/EN-US

          2850989

          Migrating MAPI profiles with Microsoft UE-V is not supported

          support.microsoft.com/kb/2850989/EN-US

          2769586

          UE-V roams empty folders and registry keys

          support.microsoft.com/kb/2769586/EN-US

          2782997

          How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)

          support.microsoft.com/kb/2782997/EN-US

          2769570

          UE-V does not update the theme on RDS or VDI sessions

          support.microsoft.com/kb/2769570/EN-US

          2901856

          Application settings do not sync after you force a restart on a UE-V-enabled computer

          support.microsoft.com/kb/2901856/EN-US

          2850582

          How To Use Microsoft User Experience Virtualization With App-V Applications

          support.microsoft.com/kb/2850582/EN-US

          3041879

          Current file versions for Microsoft User Experience Virtualization

          support.microsoft.com/kb/3041879/EN-US

          2843592

          Information on User Experience Virtualization and High Availability

          support.microsoft.com/kb/2843592/EN-US

          - - - - - - - - - - - diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md deleted file mode 100644 index d8f9534765..0000000000 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md +++ /dev/null @@ -1,233 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes -author: levinec -ms.assetid: 79a36c77-fa0c-4651-8028-4a79763a2fd2 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) 2.0 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization. - -### UE-V settings location templates for Skype cause Skype to crash - -When a user generates a valid settings location template for the Skype desktop application, registers it, and then launches the Skype desktop application, Skype crashes. An ACCESS\_VIOLATION is recorded in the Application Event Log. - -WORKAROUND: Remove or unregister the Skype template to allow Skype to work again. - -### Existing scripts for silent installations of UE-V may fail - -Two changes made to the UE-V installer can cause silent installation scripts that worked for previous versions of UE-V to fail when installing UE-V 2.1. The first is a new requirement that users must accept the license terms and agree to or decline participation in the Customer Experience Improvement Program (CEIP), even during a silent installation. Using the /q parameter is no longer sufficient to indicate acceptance of the license terms and agreement to participate in CEIP. - -Second, the installer now forces a computer restart after installing the UE-V Agent. This can cause an install script to fail if it is not expecting the restart (for example, it installs the UE-V Agent first and then immediately installs the generator). - -WORKAROUND: The UE-V installer (.msi) has two new command-line parameters that support silent installations. - - ---- - - - - - - - - - - - - - - - - -
          ParameterDescription

          /ACCEPTLICENSETERMS=True

          Set this parameter to True to install UE-V silently. Adding this parameter implies that the user accepts the UE-V license terms, which are found (by default) here: %ProgramFiles%\Microsoft User Experience Virtualization\Agent

          /NORESTART

          This parameter prevents the mandatory restart after the UE-V agent is installed. A return code of 3010 indicates that a restart is required prior to using UE-V.

          - - - -### Registry settings do not synchronize between App-V and native applications on the same computer - -When a computer has an application that is installed through both Application Virtualization (App-V) and locally with a Windows Installer (.msi) file, the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Unpredictable results with both Office 2010 and Office 2013 installed - -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. - -WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V. - -### Uninstall and re-install of Windows 8 app reverts settings to initial state - -While using UE-V settings synchronization for a Windows 8 app, if the user uninstalls the app and then reinstalls the app, the app’s settings revert to their default values.  This happens because the uninstall removes the local (cached) copy of the app’s settings but does not remove the local UE-V settings package.  When the app is reinstalled and launched, UE-V gather the app settings that were reset to the app defaults and then uploads the default settings to the central storage location.  Other computers running the app then download the default settings.  This behavior is identical to the behavior of desktop applications. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here. ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### MSI’s are not localized - -UE-V 2.0 includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -WORKAROUND: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -WORKAROUND: None. - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. - -WORKAROUND: None - -### UE-V 1 agent generates errors when running UE-V 2 templates - -If a UE-V 2 settings location template is distributed to a computer installed with a UE-V 1 agent, some settings fail to synchronize between computers and the agent reports errors in the event log. - -WORKAROUND: When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have computers running the previous version of the agent, create a separate UE-V 2.0 catalog to support the UE-V 2.0 Agent and templates. - -## Hotfixes and Knowledge Base articles for UE-V 2.1 - - -This section contains hotfixes and KB articles for UE-V 2.1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KB ArticleTitleLink

          3018608

          UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing

          support.microsoft.com/kb/3018608/EN-US

          2903501

          UE-V: User Experience Virtualization (UE-V) compatibility with user profiles

          support.microsoft.com/kb/2903501/EN-US

          2770042

          UE-V Registry Settings

          support.microsoft.com/kb/2770042/EN-US

          2847017

          UE-V settings replicated by Internet Explorer

          support.microsoft.com/kb/2847017/EN-US

          2769631

          How to repair a corrupted UE-V install

          support.microsoft.com/kb/2769631/EN-US

          2850989

          Migrating MAPI profiles with Microsoft UE-V is not supported

          support.microsoft.com/kb/2850989/EN-US

          2769586

          UE-V roams empty folders and registry keys

          support.microsoft.com/kb/2769586/EN-US

          2782997

          How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)

          support.microsoft.com/kb/2782997/EN-US

          2769570

          UE-V does not update the theme on RDS or VDI sessions

          support.microsoft.com/kb/2769570/EN-US

          2850582

          How To Use Microsoft User Experience Virtualization With App-V Applications

          support.microsoft.com/kb/2850582/EN-US

          3041879

          Current file versions for Microsoft User Experience Virtualization

          support.microsoft.com/kb/3041879/EN-US

          2843592

          Information on User Experience Virtualization and High Availability

          support.microsoft.com/kb/2843592/EN-US

          - - - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md deleted file mode 100644 index f2d84f5f5c..0000000000 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md +++ /dev/null @@ -1,244 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes -author: levinec -ms.assetid: 561988c4-cc5c-4e15-970b-16e942c8f2ef -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 03/30/2017 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes - - -To search Microsoft User Experience Virtualization 2.1 SP1 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization 2.1 SP1. - -### UE-V settings location templates for Skype cause Skype to crash - -When a user generates a valid settings location template for the Skype desktop application, registers it, and then launches the Skype desktop application, Skype crashes. An ACCESS\_VIOLATION is recorded in the Application Event Log. - -WORKAROUND: Remove or unregister the Skype template to allow Skype to work again. - -### Existing scripts for silent installations of UE-V may fail - -Two changes made to the UE-V installer can cause silent installation scripts that worked for previous versions of UE-V to fail when installing UE-V 2.1 SP1. The first is a new requirement that users must accept the license terms and agree to or decline participation in the Customer Experience Improvement Program (CEIP), even during a silent installation. Using the /q parameter is no longer sufficient to indicate acceptance of the license terms and agreement to participate in CEIP. - -Second, the installer now forces a computer restart after installing the UE-V Agent. This can cause an install script to fail if it is not expecting the restart (for example, it installs the UE-V Agent first and then immediately installs the generator). - -WORKAROUND: The UE-V installer (.msi) has two new command-line parameters that support silent installations. - - ---- - - - - - - - - - - - - - - - - -
          ParameterDescription

          /ACCEPTLICENSETERMS=True

          Set this parameter to True to install UE-V silently. Adding this parameter implies that the user accepts the UE-V license terms, which are found (by default) here: %ProgramFiles%\Microsoft User Experience Virtualization\Agent

          /NORESTART

          This parameter prevents the mandatory restart after the UE-V agent is installed. A return code of 3010 indicates that a restart is required prior to using UE-V.

          - - - -### Registry settings do not synchronize between App-V and native applications on the same computer - -When a computer has an application that is installed through both Application Virtualization (App-V) and locally with a Windows Installer (.msi) file, the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Unpredictable results with both Office 2010 and Office 2013 installed - -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. - -WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V. - -### Uninstall and re-install of Windows 8 app reverts settings to initial state - -While using UE-V settings synchronization for a Windows 8 app, if the user uninstalls the app and then reinstalls the app, the app’s settings revert to their default values.  This happens because the uninstall removes the local (cached) copy of the app’s settings but does not remove the local UE-V settings package.  When the app is reinstalled and launched, UE-V gather the app settings that were reset to the app defaults and then uploads the default settings to the central storage location.  Other computers running the app then download the default settings.  This behavior is identical to the behavior of desktop applications. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here. ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### MSI’s are not localized - -UE-V includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -WORKAROUND: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -WORKAROUND: None. - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. - -WORKAROUND: None - -### UE-V 1 agent generates errors when running UE-V 2 templates - -If a UE-V 2 settings location template is distributed to a computer installed with a UE-V 1 agent, some settings fail to synchronize between computers and the agent reports errors in the event log. - -WORKAROUND: When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have computers running the previous version of the agent, create a separate UE-V 2.x catalog to support the UE-V 2.x Agent and templates. - -### UE-V logoff delay - -Occasionally on logoff, UE-V takes a long time to sync settings. Typically, this is due to a high latency network or incorrect use of Distrubuted File System (DFS). -For DFS support, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://support.microsoft.com/kb/2533009) for further details. - -WORKAROUND: Starting with HF03, a new registry key has been introduced -The following registry key provides a mechanism by which the maximum logoff delay can be specified -\\Software\\Microsoft\\UEV\\Agent\\Configuration\\LogOffWaitInterval - -See [UE-V registry settings](https://support.microsoft.com/kb/2770042) for further details - -## Hotfixes and Knowledge Base articles for UE-V 2.1 SP1 - - -This section contains hotfixes and KB articles for UE-V 2.1 SP1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          KB ArticleTitleLink

          3018608

          UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing

          support.microsoft.com/kb/3018608/EN-US

          2903501

          UE-V: User Experience Virtualization (UE-V) compatibility with user profiles

          support.microsoft.com/kb/2903501/EN-US

          2770042

          UE-V Registry Settings

          support.microsoft.com/kb/2770042/EN-US

          2847017

          UE-V settings replicated by Internet Explorer

          support.microsoft.com/kb/2847017/EN-US

          2769631

          How to repair a corrupted UE-V install

          support.microsoft.com/kb/2769631/EN-US

          2850989

          Migrating MAPI profiles with Microsoft UE-V is not supported

          support.microsoft.com/kb/2850989/EN-US

          2769586

          UE-V roams empty folders and registry keys

          support.microsoft.com/kb/2769586/EN-US

          2782997

          How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)

          support.microsoft.com/kb/2782997/EN-US

          2769570

          UE-V does not update the theme on RDS or VDI sessions

          support.microsoft.com/kb/2769570/EN-US

          2850582

          How To Use Microsoft User Experience Virtualization With App-V Applications

          support.microsoft.com/kb/2850582/EN-US

          3041879

          Current file versions for Microsoft User Experience Virtualization

          support.microsoft.com/kb/3041879/EN-US

          2843592

          Information on User Experience Virtualization and High Availability

          support.microsoft.com/kb/2843592/EN-US

          - - - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md b/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md deleted file mode 100644 index 6b13a80d3d..0000000000 --- a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Migrating UE-V 2.x Settings Packages -description: Migrating UE-V 2.x Settings Packages -author: levinec -ms.assetid: f79381f4-e142-405c-b728-5c048502aa70 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Migrating UE-V 2.x Settings Packages - - -In the lifecycle of a Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 deployment, you might have to relocate the user settings packages either when you migrate to a new server or when you perform backups. Settings packages might have to be migrated in the following scenarios: - -- Upgrade of existing server hardware to a more modern server. - -- Migration of a settings storage location share from a test server to a production server. - -Simply copying the files and folders does not preserve the security settings and permissions. The following steps describe how to correctly copy the settings package along with their NTFS file system permissions to a new share. - -**To preserve UE-V 2 settings packages when you migrate to a new server** - -1. In a new location on a different server, create a new folder, for example, MySettings. - -2. Disable sharing for the old folder share on the old server. - -3. To copy the existing settings packages to the new server with Robocopy - - ``` syntax - C:\start robocopy "\\servername\E$\MySettings" "\\servername\E$\MySettings" /b /sec /secfix /e /LOG:D:\Robocopylogs\MySettings.txt - ``` - - **Note**   - To monitor the copy progress, open MySettings.txt with a log viewer such as Trace32. - - - -4. Grant share-level permissions to the new share. Leave the NTFS file system permissions as they were set by Robocopy. - - On computers that run the UE-V Agent, update the **SettingsStoragePath** configuration setting to the Universal Naming Convention (UNC) path of the new share. - - **Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md deleted file mode 100644 index 9d9a9348ec..0000000000 --- a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md +++ /dev/null @@ -1,804 +0,0 @@ ---- -title: Prepare a UE-V 2.x Deployment -description: Prepare a UE-V 2.x Deployment -author: levinec -ms.assetid: c429fd06-13ff-48c5-b9c9-fa1ec01ab800 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Prepare a UE-V 2.x Deployment - - -There is some planning and preparation to do before you deploy Microsoft User Experience Virtualization (UE-V) 2.0 or 2.1 as a solution for synchronizing settings between devices that users access in your enterprise. This topic helps you determine what type of deployment you'll be doing and what preparation you can make beforehand so that your deployment is successful. - -First, let’s look at the tasks you’ll do to deploy UE-V: - -- Plan your UE-V Deployment - - Before you deploy anything, a good first step is to do a little bit of planning so that you can determine which UE-V features you’ll deploy. So if you leave this page, make sure you come back and read through the planning information below. - -- [Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) - - Every UE-V deployment requires these activities: - - - [Define a settings storage location](https://technet.microsoft.com/library/dn458891.aspx#ssl) - - - [Decide how to deploy the UE-V Agent and manage UE-V configurations](https://technet.microsoft.com/library/dn458891.aspx#config) - - - [Install the UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) on every user computer that needs settings synchronized - -- Optionally, you can [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - - Planning will help you figure out whether you want UE-V to support the synchronization of settings for custom applications (third-party or line-of-business), which requires these UE-V features: - - - [Install the UEV Generator](https://technet.microsoft.com/library/dn458942.aspx#uevgen) so you can create, edit, and validate the custom settings location templates required to synchronize custom application settings - - - [Create custom settings location templates](https://technet.microsoft.com/library/dn458942.aspx#createcustomtemplates) by using the UE-V Generator - - - [Deploy a UE-V settings template catalog](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue) that you use to store your custom settings location templates - -This workflow diagram provides a high-level understanding of a UE-V deployment and the decisions that determine how you deploy UE-V in your enterprise. - -![deploymentworkflow](images/deploymentworkflow.png) - -**Planning a UE-V deployment:** First, you want to do a little bit of planning so that you can determine which UE-V components you’ll be deploying. Planning a UE-V deployment involves these things: - -- [Decide whether to synchronize settings for custom applications](#deciding) - - This determines whether you will install the UE-V Generator during deployment, which lets you create custom settings location templates. It involves the following: - - Review the [settings that are synchronized automatically in a UE-V deployment](#autosyncsettings). - - [Determine whether you need settings synchronized for other applications](#determinesettingssync). - -- Review [other considerations for deploying UE-V](#considerations), such as high availability and capacity planning. - -- [Confirm prerequisites and supported configurations for UE-V](#prereqs) - -## Decide Whether to Synchronize Settings for Custom Applications - - -In a UE-V deployment, many settings are automatically synchronized. But you can also customize UE-V to synchronize settings for other applications, such as line-of-business and third-party apps. - -Deciding if you want UE-V to synchronize settings for custom applications is probably the most important part of planning your UE-V deployment. The topics in this section will help you make that decision. - -### Settings that are automatically synchronized in a UE-V deployment - -This section provides information about the settings that are synchronized by default in UE-V, including the following: - -Desktop applications whose settings are synchronized by default - -Windows desktop settings that are synchronized by default - -A statement of support for Windows app setting synchronization - -See [User Experience Virtualization (UE-V) settings templates for Microsoft Office](https://www.microsoft.com/download/details.aspx?id=46367) to download a complete list of the specific Microsoft Office 2013, Microsoft Office 2010, and Microsoft Office 2007 settings that are synchronized by UE-V. - -### Desktop applications synchronized by default in UE-V 2.1 and UE-V 2.1 SP1 - -When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of settings location templates that capture settings values for these common Microsoft applications. - -**Tip** -**Microsoft Office 2007 Settings Synchronization** – In UE-V 2.1 and 2.1 SP1, a settings location template is no longer included by default for Office 2007 applications. However, you can still use Office 2007 templates from UE-V 2.0 or earlier and can get the templates from the [UE-V template gallery](https://go.microsoft.com/fwlink/p/?LinkID=246589). - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Application categoryDescription

          Microsoft Office 2010 applications

          -

          (Download a list of all settings synced)

          Microsoft Word 2010

          -

          Microsoft Excel 2010

          -

          Microsoft Outlook 2010

          -

          Microsoft Access 2010

          -

          Microsoft Project 2010

          -

          Microsoft PowerPoint 2010

          -

          Microsoft Publisher 2010

          -

          Microsoft Visio 2010

          -

          Microsoft SharePoint Workspace 2010

          -

          Microsoft InfoPath 2010

          -

          Microsoft Lync 2010

          -

          Microsoft OneNote 2010

          -

          Microsoft SharePoint Designer 2010

          Microsoft Office 2013 applications

          -

          (Download a list of all settings synced)

          Microsoft Word 2013

          -

          Microsoft Excel 2013

          -

          Microsoft Outlook 2013

          -

          Microsoft Access 2013

          -

          Microsoft Project 2013

          -

          Microsoft PowerPoint 2013

          -

          Microsoft Publisher 2013

          -

          Microsoft Visio 2013

          -

          Microsoft InfoPath 2013

          -

          Microsoft Lync 2013

          -

          Microsoft OneNote 2013

          -

          Microsoft SharePoint Designer 2013

          -

          Microsoft Office 2013 Upload Center

          -

          Microsoft OneDrive for Business 2013

          -

          The UE-V 2.1 and 2.1 SP1 Microsoft Office 2013 settings location templates include improved Outlook signature support. We’ve added synchronization of default signature settings for new, reply, and forwarded emails.

          -
          -Note

          An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.

          -
          -
          - -

          Browser options: Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11

          Favorites, home page, tabs, and toolbars.

          -
          -Note

          UE-V does not roam settings for Internet Explorer cookies.

          -
          -
          - -

          Windows accessories

          Microsoft Calculator, Notepad, WordPad.

          - - - -**Note** -UE-V 2.1 SP1 does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems. - - - -### Desktop applications synchronized by default in UE-V 2.0 - -When you install the UE-V 2.0 Agent, it registers a default group of settings location templates that capture settings values for these common Microsoft applications. - -**Tip** -**Microsoft Office 2013 Settings Synchronization** – In UE-V 2.0, a settings location template is not included by default for Office 2013 applications, but is available for download from the [UE-V template gallery](https://go.microsoft.com/fwlink/p/?LinkID=246589). [Synchronizing Office 2013 with UE-V 2.0](synchronizing-office-2013-with-ue-v-20-both-uevv2.md) provides details about the supported templates that synchronize Office 2013 settings. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
          Application categoryDescription

          Microsoft Office 2007 applications

          -

          (Download a list of all settings synced)

          Microsoft Access 2007

          -

          Microsoft Communicator 2007

          -

          Microsoft Excel 2007

          -

          Microsoft InfoPath 2007

          -

          Microsoft OneNote 2007

          -

          Microsoft Outlook 2007

          -

          Microsoft PowerPoint 2007

          -

          Microsoft Project 2007

          -

          Microsoft Publisher 2007

          -

          Microsoft SharePoint Designer 2007

          -

          Microsoft Visio 2007

          -

          Microsoft Word 2007

          Microsoft Office 2010 applications

          -

          (Download a list of all settings synced)

          Microsoft Word 2010

          -

          Microsoft Excel 2010

          -

          Microsoft Outlook 2010

          -

          Microsoft Access 2010

          -

          Microsoft Project 2010

          -

          Microsoft PowerPoint 2010

          -

          Microsoft Publisher 2010

          -

          Microsoft Visio 2010

          -

          Microsoft SharePoint Workspace 2010

          -

          Microsoft InfoPath 2010

          -

          Microsoft Lync 2010

          -

          Microsoft OneNote 2010

          -

          Microsoft SharePoint Designer 2010

          Browser options: Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10

          Favorites, home page, tabs, and toolbars.

          -
          -Note

          UE-V does not roam settings for Internet Explorer cookies.

          -
          -
          - -

          Windows accessories

          Microsoft Calculator, Notepad, WordPad.

          - - - -### Windows settings synchronized by default - -UE-V includes settings location templates that capture settings values for these Windows settings. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Windows settingsDescriptionApply onExport onDefault state

          Desktop background

          Currently active desktop background or wallpaper.

          Logon, unlock, remote connect, Scheduled Task events.

          Logoff, lock, remote disconnect, user clicking Sync Now in Company Settings Center, or scheduled task interval

          Enabled

          Ease of Access

          Accessibility and input settings, Microsoft Magnifier, Narrator, and on-Screen Keyboard.

          Logon only.

          Logoff, user clicking Sync Now in Company Settings Center, or scheduled task interval

          Enabled

          Desktop settings

          Start menu and Taskbar settings, Folder options, Default desktop icons, Additional clocks, and Region and Language settings.

          Logon only.

          Logoff, user clicking Sync Now in Company Settings Center, or scheduled task

          Enabled

          - - - -**Note** -Starting in Windows 8, UE-V does not roam settings related to the Start screen, such as items and locations. In addition, UE-V does not support synchronization of pinned taskbar items or Windows file shortcuts. - - - -**Important** -UE-V 2.1 SP1 roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Settings groupCategoryCaptureApply

          Application Settings

          Windows apps

          Close app

          -

          Windows app settings change event

          Start the UE-V App Monitor at startup

          -

          Open app

          -

          Windows App Settings change event

          -

          Arrival of a settings package

          Desktop applications

          Application closes

          Application opens and closes

          Desktop settings

          Desktop background

          Lock or logoff

          Logon, unlock, remote connect, notification of new package arrival, user clicks Sync Now in Company Settings Center, or scheduled task runs.

          Ease of Access (Common – Accessibility, Narrator, Magnifier, On-Screen-Keyboard)

          Lock or Logoff

          Logon

          Ease of Access (Shell - Audio, Accessibility, Keyboard, Mouse)

          Lock or logoff

          Logon, unlock, remote connect, notification of new package arrival, user clicks Sync Now in Company Settings Center, or scheduled task runs

          Desktop settings

          Lock or logoff

          Logon

          - - - -### UE-V-support for Windows Apps - -For Windows apps, the app developer specifies the settings that are synchronized. You can specify which Windows apps are enabled for settings synchronization. - -To display a list of Windows apps that can synchronize settings on a computer with their package family name, enabled status, and enabled source, at a Windows PowerShell command prompt, enter: `Get-UevAppxPackage` - -**Note** -As of Windows 8, UE-V does not synchronize Windows app settings if the domain user links their sign-in credentials to their Microsoft Account. This linking synchronizes settings to Microsoft OneDrive so UE-V, which disables synchronization of Windows app settings. - - - -### UE-V-support for Roaming Printers - -UE-V 2.1 SP1 lets network printers roam between devices so that a user has access to their network printers when logged on to any device on the network. This includes roaming the printer that they set as the default. - -Printer roaming in UE-V requires one of these scenarios: - -- The print server can download the required driver when it roams to a new device. - -- The driver for the roaming network printer is pre-installed on any device that needs to access that network printer. - -- The printer driver can be obtained from Windows Update. - -**Note** -The UE-V printer roaming feature does **not** roam printer settings or preferences, such as printing double-sided. - - - -### Determine whether you need settings synchronized for other applications - -After you have reviewed the settings that are synchronized automatically in a UE-V deployment, you want to decide whether you will synchronize settings for other applications since this determines how you deploy UE-V throughout your enterprise. - -As an administrator, when you consider which desktop applications to include in your UE-V solution, consider which settings can be customized by users, and how and where the application stores its settings. Not all desktop applications have settings that can be customized or that are routinely customized by users. In addition, not all desktop applications settings can safely be synchronized across multiple computers or environments. - -In general, you can synchronize settings that meet the following criteria: - -- Settings that are stored in user-accessible locations. For example, do not synchronize settings that are stored in System32 or outside the HKEY\_CURRENT\_USER (HKCU) section of the registry. - -- Settings that are not specific to the particular computer. For example, exclude network or hardware configurations. - -- Settings that can be synchronized between computers without risk of corrupted data. For example, do not use settings that are stored in a database file. - -### Checklist for evaluating custom applications - -If you’ve decided that you need settings synchronized for other applications, you can use this checklist to help figure out which applications you’ll include. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Description
          Checklist box

          Does this application contain settings that the user can customize?

          Checklist box

          Is it important for the user that these settings are synchronized?

          Checklist box

          Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application startup and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings sharing solutions, users might experience inconsistency across synchronized settings.

          Checklist box

          Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations do not consistently synchronize across sessions and can cause a poor application experience.

          Checklist box

          Does the application store settings in the Program Files directory or in the file directory that is located in the Users[User name]<strong>AppData<strong>LocalLow directory? Application data that is stored in either of these locations usually should not synchronize with the user, because this data is specific to the computer or because the data is too large to synchronize.

          Checklist box

          Does the application store any settings in a file that contains other application data that should not synchronize? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this additional data can cause a poor application experience.

          Checklist box

          How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can affect the performance of settings synchronization.

          - - - -## Other Considerations when Preparing a UE-V Deployment - - -You should also consider these things when you are preparing to deploy UE-V: - -- [Managing credentials synchronization](#creds) - -- [Windows app settings synchronization](#appxsettings) - -- [Custom UE-V settings location templates](#custom) - -- [Unintentional user settings configurations](#prevent) - -- [Performance and capacity](#capacity) - -- [High availability](#high) - -- [Computer clock synchronization](#clocksync) - -### Managing credentials synchronization in UE-V 2.1 and UE-V 2.1 SP1 - -Many enterprise applications, including Microsoft Outlook and Lync, prompt users for their domain credentials at login. Users have the option of saving their credentials to disk to prevent having to enter them every time they open these applications. Enabling roaming credentials synchronization lets users save their credentials on one computer and avoid re-entering them on every computer they use in their environment. Users can synchronize some domain credentials with UE-V 2.1 and 2.1 SP1. - -**Important** -Credentials synchronization is disabled by default. You must explicitly enable credentials synchronization during deployment to implement this feature. - - - -UE-V 2.1 and 2.1 SP1 can synchronize enterprise credentials, but do not roam credentials intended only for use on the local computer. - -Credentials are synchronous settings, meaning they are applied to your profile the first time you log in to your computer after UE-V synchronizes. - -Credentials synchronization is managed by its own settings location template, which is disabled by default. You can enable or disable this template through the same methods used for other templates. The template identifier for this feature is RoamingCredentialSettings. - -**Important** -If you are using Active Directory Credential Roaming in your environment, we recommend that you don’t enable the UE-V credential roaming template. - - - -Use one of these methods to enable credentials synchronization: - -- Company Settings Center - -- PowerShell - -- Group Policy - -**Note** -Credentials are encrypted during synchronization. - - - -[Company Settings Center](https://technet.microsoft.com/library/dn458903.aspx)**:** Check the Roaming Credential Settings check box under Windows Settings to enable credential synchronization. Uncheck the box to disable it. This check box only appears in Company Settings Center if your account is not configured to synchronize settings using a Microsoft Account. - -[PowerShell](https://technet.microsoft.com/library/dn458937.aspx)**:** This PowerShell cmdlet enables credential synchronization: - -``` syntax -Enable-UevTemplate RoamingCredentialSettings -``` - -This PowerShell cmdlet disables credential synchronization: - -``` syntax -Disable-UevTemplate RoamingCredentialSettings -``` - -[Group Policy](https://technet.microsoft.com/library/dn458893.aspx)**:** You must [deploy the latest MDOP ADMX template](https://go.microsoft.com/fwlink/p/?LinkId=393944) to enable credential synchronization through group policy. Credentials synchronization is managed with the Windows settings. To manage this feature with Group Policy, enable the Synchronize Windows settings policy. - -1. Open Group Policy Editor and navigate to **User Configuration – Administrative Templates – Windows Components – Microsoft User Experience Virtualization**. - -2. Double-click on **Synchronize Windows settings**. - -3. If this policy is enabled, you can enable credentials synchronization by checking the **Roaming Credentials** check box, or disable credentials synchronization by unchecking it. - -4. Click **OK**. - -### Credential locations synchronized by UE-V - -Credential files saved by applications into the following locations are synchronized: - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\Credentials\\ - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\Crypto\\ - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\Protect\\ - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\SystemCertificates\\ - -Credentials saved to other locations are not synchronized by UE-V. - -### Windows app settings synchronization - -UE-V manages Windows app settings synchronization in three ways: - -- **Sync Windows Apps:** Allow or deny any Windows app synchronization - -- **Windows App List:** Synchronize a list of Windows apps - -- **Unlisted Default Sync Behavior:** Determine the synchronization behavior of Windows apps that are not in the Windows app list. - -For more information, see the [Windows App List](https://technet.microsoft.com/library/dn458925.aspx#win8applist). - -### Custom UE-V settings location templates - -If you are deploying UE-V to synchronize settings for custom applications, you will use the UE-V Generator to create custom settings location templates for those desktop applications. After you create and test a custom settings location template in a test environment, you can deploy the settings location templates to computers in the enterprise. - -Custom settings location templates must be deployed with an existing deployment infrastructure, like an enterprise software distribution (ESD) method such as System Center Configuration Manager, with preferences, or by configuring an UE-V settings template catalog. Templates that are deployed with Configuration Manager or Group Policy must be registered by using UE-V WMI or Windows PowerShell. - -For more information about custom settings location templates, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md). For more information about using UE-V with Configuration Manager, see [Configuring UE-V 2.x with System Center Configuration Manager 2012](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md). - -### Prevent unintentional user settings configuration - -UE-V downloads new user settings information from a settings storage location and applies the settings to the local computer in these instances: - -- Every time an application is started that has a registered UE-V template. - -- When a user logs on to a computer. - -- When a user unlocks a computer. - -- When a connection is made to a remote desktop computer that has UE-V installed. - -- When the Sync Controller Application scheduled task is run. - -If UE-V is installed on computer A and computer B, and the settings that you want for the application are on computer A, then computer A should open and close the application first. If the application is opened and closed on computer B first, then the application settings on computer A are configured to the application settings on computer B. Settings are synchronized between computers on per-application basis. Over time, settings become consistent between computers as they are opened and closed with preferred settings. - -This scenario also applies to Windows settings. If the Windows settings on computer B should be the same as the Windows settings on computer A, then the user should log on and log off computer A first. - -If the user settings that the user wants are applied in the wrong order, they can be recovered by performing a restore operation for the specific application or Windows configuration on the computer on which the settings were overwritten. For more information, see [Manage Administrative Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md). - -### Performance and capacity planning - -Specify your requirements for UE-V with standard disk capacity and network health monitoring. - -UE-V uses a Server Message Block (SMB) share for the storage of settings packages. The size of settings packages varies depending on the settings information for each application. While most settings packages are small, the synchronization of potentially large files, such as desktop images, can result in poor performance, particularly on slower networks. - -To reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location. - -By default, UE-V synchronization times out after 2 seconds to prevent excessive lag due to a large settings package. You can configure the SyncMethod=SyncProvider setting by using [Group Policy Objects](https://technet.microsoft.com/library/dn458893.aspx). - -### High Availability for UE-V - -The UE-V settings storage location and settings template catalog support storing user data on any writable share. To ensure high availability, follow these criteria: - -- Format the storage volume with an NTFS file system. - -- The share can use Distributed File System (DFS) but there are restrictions. -Specifically, Distributed File System Replication (DFS-R) single target configuration with or without a Distributed File System Namespace (DFS-N) is supported. -Likewise, only single target configuration is supported with DFS-N. -For detailed information, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://go.microsoft.com/fwlink/p/?LinkId=313991) -and also [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009). - - In addition, because SYSVOL uses DFS-R for replication, SYSVOL cannot be used for UE-V data file replication. - -- Configure the share permissions and NTFS access control lists (ACLs) as specified in [Deploying the Settings Storage Location for UE-V 2.x](https://technet.microsoft.com/library/dn458891.aspx#ssl). - -- Use file server clustering along with the UE-V Agent to provide access to copies of user state data in the event of communications failures. - -- You can store the settings storage path data (user data) and settings template catalog templates on clustered shares, on DFS-N shares, or on both. - -### Synchronize computer clocks for UE-V settings synchronization - -Computers that run the UE-V Agent must use a time server to maintain a consistent settings experience. UE-V uses time stamps to determine if settings must be synchronized from the settings storage location. If the computer clock is inaccurate, older settings can overwrite newer settings, or the new settings might not be saved to the settings storage location. - -## Confirm Prerequisites and Supported Configurations for UE-V - - -Before you proceed, make sure your environment includes these requirements for running UE-V. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Operating systemEditionService packSystem architectureWindows PowerShellMicrosoft .NET Framework

          Windows 7

          Ultimate, Enterprise, or Professional Edition

          SP1

          32-bit or 64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5 or higher for UE-V 2.1.

          -

          .NET Framework 4 or higher for UE-V 2.0.

          Windows Server 2008 R2

          Standard, Enterprise, Datacenter, or Web Server

          SP1

          64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5 or higher for UE-V 2.1.

          -

          .NET Framework 4 or higher for UE-V 2.0.

          Windows 8 and Windows 8.1

          Enterprise or Pro

          None

          32-bit or 64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5 or higher

          Windows 10, pre-1607 version

          -
          -Note

          Only UE-V 2.1 SP1 supports Windows 10, pre-1607 version

          -
          -
          - -

          Enterprise or Pro

          None

          32-bit or 64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.6

          Windows Server 2012 and Windows Server 2012 R2

          Standard or Datacenter

          None

          64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.5 or higher

          Windows Server 2016

          Standard or Datacenter

          None

          64-bit

          Windows PowerShell 3.0 or higher

          .NET Framework 4.6 or higher

          - - - -Also… - -- **MDOP License:** This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see How Do I Get MDOP (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -- **Administrative Credentials** for any computer on which you’ll be installing - -**Note** - -- Starting with WIndows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack. - -- The UE-V Windows PowerShell feature of the UE-V Agent requires .NET Framework 4 or higher and Windows PowerShell 3.0 or higher to be enabled. Download Windows PowerShell 3.0 [here](https://go.microsoft.com/fwlink/?LinkId=309609). - -- Install .NET Framework 4 or .NET Framework 4.5 on computers that run the Windows 7 or the Windows Server 2008 R2 operating system. The Windows 8, Windows 8.1, and Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed. -- The “Delete Roaming Cache” policy for Mandatory profiles is not supported with UE-V and should not be used. - - - -There are no special random access memory (RAM) requirements specific to UE-V. - -### Synchronization of Settings through the Sync Provider - -Sync Provider is the default setting for users, which synchronizes a local cache with the settings storage location in these instances: - -- Logon/logoff - -- Lock/unlock - -- Remote desktop connect/disconnect - -- Application open/close - -A scheduled task manages this synchronization of settings every 30 minutes or through certain trigger events for certain applications. For more information, see [Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md). - -The UE-V Agent synchronizes user settings for computers that are not always connected to the enterprise network (remote computers and laptops) and computers that are always connected to the network (computers that run Windows Server and host virtual desktop interface (VDI) sessions). - -**Synchronization for computers with always-available connections:** When you use UE-V on computers that are always connected to the network, you must configure the UE-V Agent to synchronize settings by using the *SyncMethod=None* parameter, which treats the settings storage server as a standard network share. In this configuration, the UE-V Agent can be configured to notify if the import of the application settings is delayed. - -Enable this configuration through one of these methods: - -- During UE-V installation, at the command prompt or in a batch file, set the AgentSetup.exe parameter *SyncMethod = None*. [Deploying the UE-V 2.x Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) provides more information. - -- After the UE-V installation, use the Settings Management feature in System Center 2012 Configuration Manager or the MDOP ADMX templates to push the *SyncMethod = None* configuration. - -- Use Windows PowerShell or Windows Management Instrumentation (WMI) to set the *SyncMethod = None* configuration. - - **Note** - These last two methods do not work for pooled virtual desktop infrastructure (VDI) environments. - - - -You must restart the computer before the settings start to synchronize. - -**Note** -If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on logoff, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path. - - - -**Synchronization for external sync engines:** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access. - -**Support for shared VDI sessions:** UE-V 2.1 and 2.1 SP1 provide support for VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions. - -**Note** -If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](https://technet.microsoft.com/library/dn878331.aspx). - - - -The VDI template is provided with UE-V 2.1 and 2.1 SP1 and is typically available here after installation: C:\\Program Files\\Microsoft User Experience Virtualization\\Templates\\VdiState.xml - -### Prerequisites for UE-V Generator support - -Install the UE-V Generator on the computer that is used to create custom settings location templates. This computer should be able to run the applications whose settings are synchronized. You must be a member of the Administrators group on the computer that runs the UE-V Generator software. - -The UE-V Generator must be installed on a computer that uses an NTFS file system. The UE-V Generator software requires .NET Framework 4. For more information, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md). - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index bc93749e20..0000000000 --- a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: Security Considerations for UE-V 2.x -description: Security Considerations for UE-V 2.x -author: levinec -ms.assetid: 9d5c3cae-9fcb-4dea-bd67-741b3dea63be -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for UE-V 2.x - - -This topic contains a brief overview of accounts and groups, log files, and other security-related considerations for Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1. For more information, follow the links that are provided here. - -## Security considerations for UE-V configuration - - -**Important**   -When you create the settings storage share, limit the share access to users who require access. - - - -Because settings packages might contain personal information, you should take care to protect them as well as possible. In general, do the following: - -- Restrict the share to only those users who require access. Create a security group for users who have redirected folders on a particular share and limit access to only those users. - -- When you create the share, hide the share by putting a $ after the share name. This addition hides the share from casual browsers, and the share is not visible in My Network Places. - -- Only give users the minimum amount of permissions that they must have. The following tables show the required permissions. - - 1. Set the following share-level SMB permissions for the setting storage location folder. - - | User account | Recommended permissions | - | - | - | - | Everyone | No permissions | - |Security group of UE-V | Full control | - - 2. Set the following NTFS file system permissions for the settings storage location folder. - - | User account | Recommended permissions | Folder | - | - | - | - | - | Creator/Owner | Full control | Subfolders and files only| - | Domain Admins | Full control | This folder, subfolders, and files | - | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | - | Everyone | Remove all permissions | No permissions | - - 3. Set the following share-level SMB permissions for the settings template catalog folder. - - | User account | Recommend permissions | - | - | - | - | Everyone | No permissions | - | Domain computers | Read permission Levels | - | Administrators | Read/write permission levels | - - 4. Set the following NTFS permissions for the settings template catalog folder. - - | User account | Recommended permissions | Apply to | - | - | - | - | - | Creator/Owner | Full control | This folder, subfolders, and files | - | Domain Computers | List folder contents and Read permissions | This folder, subfolders, and files| - | Everyone| No permissions| No permissions| - | Administrators| Full Control| This folder, subfolders, and files| - -### Use Windows Server as of Windows Server 2003 to host redirected file shares - -User settings package files contain personal information that is transferred between the client computer and the server that stores the settings packages. Because of this process, you should ensure that the data is protected while it travels over the network. - -User settings data is vulnerable to these potential threats: interception of the data as it passes over the network, tampering with the data as it passes over the network, and spoofing of the server that hosts the data. - -As of Windows Server 2003, several features of the Windows Server operating system can help secure user data: - -- **Kerberos** - Kerberos is standard on all versions of Microsoft Windows 2000 Server and Windows Server beginning with Windows Server 2003. Kerberos ensures the highest level of security to network resources. NTLM authenticates the client only; Kerberos authenticates the server and the client. When NTLM is used, the client does not know whether the server is valid. This difference is particularly important if the client exchanges personal files with the server, as is the case with Roaming User Profiles. Kerberos provides better security than NTLM. Kerberos is not available on the Microsoft Windows NT Server 4.0 or earlier operating systems. - -- **IPsec** - The IP Security Protocol (IPsec) provides network-level authentication, data integrity, and encryption. IPsec ensures the following: - - - Roamed data is safe from data modification while data is en route. - - - Roamed data is safe from interception, viewing, or copying. - - - Roamed data is safe from access by unauthenticated parties. - -- **SMB Signing** - The Server Message Block (SMB) authentication protocol supports message authentication, which prevents active message and "man-in-the-middle" attacks. SMB signing provides this authentication by placing a digital signature into each SMB. The digital signature is then verified by both the client and the server. In order to use SMB signing, you must first either enable it, or you must require it on both the SMB client and the SMB server. Note that the SMB signing imposes a performance penalty. It does not consume any more network bandwidth, but it uses more CPU cycles on the client and server side. - -### Always use the NTFS file system for volumes that hold user data - -For the most secure configuration, configure servers that host the UE-V settings files to use the NTFS file system. Unlike the FAT file system, NTFS supports Discretionary access control lists (DACLs) and system access control lists (SACLs). DACLs and SACLs control who can perform operations on a file and what events trigger the logging of actions that is performed on a file. - -### Do not rely on EFS to encrypt user files when they are transmitted over the network - -When you use the Encrypting File System (EFS) to encrypt files on a remote server, the encrypted data is not encrypted during transit over the network; it only becomes encrypted when it is stored on disk. - -This encryption process does not apply when your system includes Internet Protocol security (IPsec) or Web Distributed Authoring and Versioning (WebDAV). IPsec encrypts data while it is transported over a TCP/IP network. If the file is encrypted before it is copied or moved to a WebDAV folder on a server, it remains encrypted during the transmission and while it is stored on the server. - -### Let the UE-V Agent create folders for each user - -To ensure that UE-V works optimally, create only the root share on the server, and let the UE-V Agent create the folders for each user. UE-V creates these user folders with the appropriate security. - -This permission configuration enables users to create folders for settings storage. The UE-V Agent creates and secures a settings package folder while it runs in the context of the user. Users receive full control to their settings package folder. Other users do not inherit access to this folder. You do not have to create and secure individual user directories. The agent that runs in the context of the user does it automatically. - -**Note**   -Additional security can be configured when a Windows Server is used for the settings storage share. UE-V can be configured to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable additional security, use the following command: - -1. Add the REG\_DWORD registry key RepositoryOwnerCheckEnabled to `HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration`. - -2. Set the registry key value to *1*. - -When this configuration setting is in place, the UE-V Agent verifies that the local Administrators group or current user is the owner of the settings package folder. If not, then the UE-V Agent does not grant access to the folder. - - - -If you must create folders for the users, ensure that you have the correct permissions set. - -We strongly recommend that you do not pre-create folders. Instead, let the UE-V Agent create the folder for the user. - -### Ensure correct permissions to store UE-V 2 settings in a home directory or custom directory - -If you redirect UE-V settings to a user’s home directory or a custom Active Directory (AD) directory, ensure that the permissions on the directory are set appropriately for your organization. - - - - - - -## Related topics - - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index 4eefbd2641..0000000000 --- a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Sync Methods for UE-V 2.x -description: Sync Methods for UE-V 2.x -author: levinec -ms.assetid: af0ae894-dfdc-41d2-927b-c2ab1b355ffe -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sync Methods for UE-V 2.x - - -The Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Agent lets you synchronize users’ application and Windows settings with the settings storage location. The *Sync Method* configuration defines how the UE-V Agent uploads and downloads those settings to the settings storage location. UE-V 2.x introduces a new SyncMethod called the *SyncProvider*. For more information about trigger events that start the synchronization of application and Windows settings, see [Sync Trigger Events for UE-V 2.x](sync-trigger-events-for-ue-v-2x-both-uevv2.md). - -## SyncMethod Configuration - - -This table explains the changes to SyncMethod from UE-V v1.0 to v2.0 to v2.1, as well as the settings for each configuration: - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          SyncMethod Configuration

          V1.0

          V2.0

          V2.1 and V2.1 SP1

          Description

          SyncProvider

          n/a

          Default

          Default

          Settings changes for a specific application or for global Windows desktop settings are saved locally to a cache folder. These changes are then synchronized with the settings storage location when a synchronization trigger event takes place. Pushing out changes will save the local changes to the settings storage path.

          -

          This default setting is the gold standard for computers. This option attempts to synchronize the setting and times out after a short delay to ensure that the application or operating system startup isn’t delayed for a long period of time.

          -

          This functionality is also tied to the Scheduled task – Sync Controller Application. The administrator controls the frequency of the Scheduled task. By default, computers synchronize their settings every 30 min after logging on.

          OfflineFiles

          Default

          Deprecated

          Deprecated

          Behaves the same as SyncProvider in V2.0.

          -

          If Offline files are enabled and the folder is pinned then UE-V will unpin this folder and sync directly to the central SMB directory.

          -

          NOTE: In V1.0 if you wanted to use UE-V in a CorpNet disconnected manner (aka traveling with a Laptop), then the guidance is to use Offline Files to ensure that your settings roamed.  We received sufficient customer feedback that turning on Offline files is a non-trivial enterprise blocker. So in UE-V 2, we created a tightly coupled synchronization engine to cache your data locally and synchronize the settings to the central server. This feature area does not replace Offline Files or Folder Redirection.

          -

          UE-V 2 does not work well with Offline folders so the guidance is not to set the settings storage path to a pinned Offline or CSC folder.

          External

          n/a

          n/a

          Supported

          New in UE-V 2.1, this configuration method specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access.

          None

          Yes

          Yes

          Yes

          This configuration setting is designed for the Virtual Desktop Infrastructure (VDI) and Streamed Application experience primarily. This setting should be used on Windows Server boxes used in a datacenter, where the connection will always be available.

          -

          Any settings changes are saved directly to the server. If the network connection to the settings storage path is not available, then the settings changes are cached on the device and are synchronized the next time that the Sync Provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on logoff, then these settings changes are lost, and the user must reapply the change when the computer can again reach the settings storage path.

          -

          Apps and OS will wait indefinitely for the location to be present. This could cause App load or OS logon time to dramatically increase if the location is not found.

          - -  - -You can configure the sync method in these ways: - -- When you [Deploy the UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) through a command-line parameter or in a batch script - -- Through [Group Policy](https://technet.microsoft.com/library/dn458893.aspx) settings - -- With the [System Center Configuration Pack](https://technet.microsoft.com/library/dn458917.aspx) for UE-V - -- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](https://technet.microsoft.com/library/dn458937.aspx) - - - - - - -## Related topics - - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md#ssl) - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md#config) - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - -  - -  - - - - - diff --git a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index 8b8c565dc8..0000000000 --- a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Sync Trigger Events for UE-V 2.x -description: Sync Trigger Events for UE-V 2.x -author: levinec -ms.assetid: 4ed71a13-6a4f-4376-996f-74b126536bbc -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sync Trigger Events for UE-V 2.x - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 lets you synchronize your application and Windows settings across all your domain-joined devices. *Sync trigger events* define when the UE-V Agent synchronizes those settings with the settings storage location. UE-V 2 introduces a new *Sync Method* called the *SyncProvider*. For more information about Sync Method configuration, see [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md). - -## UE-V 2 Sync Trigger Events - - -The following table explains the trigger events for classic applications and Windows settings. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

          UE-V 2 Trigger Event

          SyncMethod=SyncProvider

          SyncMethod=None

          Windows Logon

            -
          • Application and Windows settings are imported to the local cache from the settings storage location.

          • -
          • Asynchronous Windows settings are applied.

          • -
          • Synchronous Windows settings will be applied during the next Windows logon.

          • -
          • Application settings will be applied when the application starts.

          • -
            -
          • Application and Windows settings are read directly from the settings storage location.

          • -
          • Asynchronous and synchronous Windows settings are applied.

          • -
          • Application settings will be applied when the application starts.

          • -

          Windows Logoff

          Store changes locally and cache and copy asynchronous and synchronous Windows settings to the settings storage location server, if available

          Store changes to asynchronous and synchronous Windows settings storage location

          Windows Connect (RDP) / Unlock

          Synchronize any asynchronous Windows settings from settings storage location to local cache, if available.

          -

          Apply cached Windows settings

          Download and apply asynchronous windows settings from settings storage location

          Windows Disconnect (RDP) / Lock

          Store asynchronous Windows settings changes to the local cache.

          -

          Synchronize any asynchronous Windows settings from the local cache to settings storage location, if available

          Store asynchronous Windows settings changes to the settings storage location

          Application start

          Apply application settings from local cache as the application starts

          Apply application settings from settings storage location as the application starts

          Application closes

          Store any application settings changes to the local cache and copy settings to settings storage location, if available

          Store any application settings changes to settings storage location

          Sync Controller Scheduled Task or “Sync Now” is run from the Company Settings Center

          -

          Application and Windows settings are synchronized between the settings storage location and the local cache.

          -
          -Note

          Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application.

          -

          For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous).

          -
          -
          - -
          -

          Settings are applied in these cases:

          -
            -
          • Asynchronous Windows settings are applied directly.

          • -
          • Application settings are applied when the application starts.

          • -
          • Both asynchronous and synchronous Windows settings are applied during the next Windows logon.

          • -
          • Windows app (AppX) settings are applied during the next refresh. See Monitor Application Settings for more information.

          • -

          NA

          Asynchronous Settings updated on remote store*

          Load and apply new asynchronous settings from the cache.

          Load and apply settings from central server

          - - - - - - - - -## Related topics - - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - -[Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md) - -[Choose the Configuration Method for UE-V 2.x](https://technet.microsoft.com/library/dn458891.aspx#config) - - - - - - - - - diff --git a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md deleted file mode 100644 index 8d25af0236..0000000000 --- a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Synchronizing Office 2013 with UE-V 2.0 -description: Synchronizing Office 2013 with UE-V 2.0 -author: levinec -ms.assetid: c46feb6d-28a8-4799-888d-053531dc5842 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Synchronizing Office 2013 with UE-V 2.0 - - -Microsoft User Experience Virtualization (UE-V) 2.0 supports the synchronization of Microsoft Office 2013 application setting using a template available from the UE-V template gallery. The combination of UE-V 2 and App-V 5.0 SP2 support of Office 2013 Professional Plus enables the same experience on virtualized instance of Office 2013 from any UE-V-enabled device or virtualized desktop. - -To activate UE-V application settings support of Office 2013, you can download official UE-V Office 2013 templates from the [Microsoft User Experience Virtualization (UE-V) 2 Template Gallery](https://go.microsoft.com/fwlink/p/?LinkId=246589). This resource provides Microsoft-authored UE-V settings location templates as well as community-developed settings location templates. - -## Microsoft Office support in UE-V - - -UE-V 1.0 and UE-V 2 include settings location templates for Microsoft Office 2010. These templates are distributed and registered as part of the UE-V Agent installation process. These templates help synchronize users’ Office experience between devices. The UE-V templates for Office 2013 provide a very similar settings experience to the templates for Office 2010. Microsoft Office 2013 settings roamed by Office 365 experience are not included in these settings. For a list of Office 365-specific settings, see [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=391220). - -## Synchronized Office 2013 Settings - - -The following tables contain the details for Office 2013 support in UE-V: - -### Supported UE-V templates for Microsoft Office - - ---- - - - - - - - - - - - - -
          Office 2013 templates (UE-V 2.0, available on UE-V gallery):Office 2010 templates (UE-V 1.0 & 1.0 SP1):

          MicrosoftOffice2013Win32.xml

          -

          MicrosoftOffice2013Win64.xml

          -

          MicrosoftLync2013Win32.xml

          -

          MicrosoftLync2013Win64.xml

          MicrosoftOffice2010Win32.xml

          -

          MicrosoftOffice2010Win64.xml

          -

          MicrosoftLync2010.xml

          -

          - -  - -### Microsoft Office Applications supported by the UE-V templates - - ---- - - - - - - -

          Microsoft Access 2013

          -

          Microsoft Lync 2013

          -

          Microsoft Excel 2013

          -

          Microsoft InfoPath 2013

          -

          Microsoft OneNote 2013

          -

          Microsoft Outlook 2013

          -

          Microsoft PowerPoint 2013

          -

          Microsoft Project 2013

          -

          Microsoft Publisher 2013

          -

          Microsoft SharePoint Designer 2013

          -

          Microsoft Visio 2013

          -

          Microsoft Word 2013

          -

          Microsoft Office Upload Manager

          Microsoft Access 2010

          -

          Microsoft Lync 2010

          -

          Microsoft Excel 2010

          -

          Microsoft InfoPath 2010

          -

          Microsoft OneNote 2010

          -

          Microsoft Outlook 2010

          -

          Microsoft PowerPoint 2010

          -

          Microsoft Project 2010

          -

          Microsoft Publisher 2010

          -

          Microsoft SharePoint Designer 2010

          -

          Microsoft Visio 2010

          -

          Microsoft Word 2010

          -

          - -  - -## Deploying the Office 2013 templates - - -You can deploy UE-V settings location template with the following methods: - -- **Registering template via PowerShell**. If you use Windows PowerShell to manage computers, run the following Windows PowerShell command open as an administrator to register this settings location template: - - ``` syntax - Register-UevTemplate -Path - ``` - - For more information using UE-V and Windows PowerShell, see [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md). - -- **Registering template via Template Catalog Path**. If you use the Settings Template Catalog Path to manage templates on users’ computers, copy the Office 2013 template into the folder defined in the UE-V Agent. The next time the Template Auto Update (ApplySettingsCatalog.exe) scheduled task runs, the settings location template will be registered on the device. For more information, see [Deploying the Settings Template Catalog for UE-V 2](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue). - -- **Registering template via Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, then recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to your clients. For more information, see the guidance provided in the documentation for the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2](https://go.microsoft.com/fwlink/?LinkId=317263). - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index 7df413058d..0000000000 --- a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Technical Reference for UE-V 2.x -description: Technical Reference for UE-V 2.x -author: levinec -ms.assetid: 303cff9a-a96d-4e83-9e94-19b0d3744e1e -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for UE-V 2.x - - -This technical reference section includes additional technical documentation about the various features of Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1. This information is provided to help the administrator better understand UE-V. - -## Technical reference topics for UE-V 2.x - - -- [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md) - - Defines how UE-V synchronizes settings between computers and the settings storage location. Sync Provider is the default sync method for UE-V 2.0. This topic provides technical reference information for sync methods, including the Sync Provider. - -- [Sync Trigger Events for UE-V 2.x](sync-trigger-events-for-ue-v-2x-both-uevv2.md) - - Defines when the UE-V Agent synchronizes those settings with the settings storage location. This topic provides technical reference information about when synchronization takes place based upon the sync method deployed. - -- [Synchronizing Office 2013 with UE-V 2.0](synchronizing-office-2013-with-ue-v-20-both-uevv2.md) - - Provides guidance for downloading and enabling the Microsoft-authored UE-V 2.0 settings location template that supports Office 2013 settings synchronization. - -- [Application Template Schema Reference for UE-V 2.x](application-template-schema-reference-for-ue-v-2x-both-uevv2.md) - - Details the XML structure of UE-V settings location templates and provides guidance for editing these files. - -- [Accessibility for UE-V 2.x](accessibility-for-ue-v-2x-both-uevv2.md) - - Describes features and services that make UE-V more accessible for people with disabilities. - -- [Security Considerations for UE-V 2.x](security-considerations-for-ue-v-2x-both-uevv2.md) - - Provides a brief overview of accounts, groups, and other security-related considerations for UE-V. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md b/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md deleted file mode 100644 index 161015c807..0000000000 --- a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Troubleshooting UE-V 2.x -description: Troubleshooting UE-V 2.x -author: levinec -ms.assetid: a02847f8-6986-4612-8307-ba1b72d7919b -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting UE-V 2.x - - -Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## Find troubleshooting information - - -You can use the following information to find troubleshooting content or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. After you search the MDOP documentation, you can search the troubleshooting information for the product in the TechNet Wiki. These search methods are described in the following sections. - -**To search the MDOP product documentation** - -1. Open a web browser and browse to the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) home page on TechNet. - -2. Locate the **Search TechNet with Bing** search box and enter your search term. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Open a web browser and browse to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Locate the **Search TechNet Wiki** search box and enter your search term. - -3. Review the search results for assistance. - -## Create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Open a web browser and browse to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Sign in with your Microsoft account. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article** in the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template, which is named **Troubleshooting.html**, and then click **Insert**. - -6. Give the article a descriptive title, and then overwrite the template information as needed to create your article. - -7. After you review your article, add a tag that is named **Troubleshooting** and another tag for the product name. To add tags help other users find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md b/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md deleted file mode 100644 index 16c4897c6f..0000000000 --- a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Using UE-V 2.x with Application Virtualization Applications -description: Using UE-V 2.x with Application Virtualization Applications -author: levinec -ms.assetid: 4644b810-fc48-4fd0-96e4-2fc6cd64d8ad -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using UE-V 2.x with Application Virtualization Applications - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 support Microsoft Application Virtualization (App-V) applications without any required modifications to either the App-V package or the UE-V template. However, an additional step is required because you cannot run the UE-V Generator directly on a virtualized App-V application. Instead, you must install the application locally, generate the template, and then apply the template to the virtualized application. UE-V supports App-V 4.5, App-V 4.6, and App-V 5.0 packages. - -## UE-V settings synchronization for App-V applications - - -UE-V monitors when an application opens by the program name and, optionally, by file version numbers and product version numbers, whether the application is installed locally or virtually by using App-V. When the application starts, UE-V monitors the App-V process, applies any settings that are stored in the user's settings storage path, and then enables the application to start normally. UE-V monitors App-V applications and automatically translates the relevant file and registry paths to the virtualized location as opposed to the physical location outside the App-V computing environment. - - **To implement settings synchronization for a virtualized application** - -1. Run the UE-V Generator to collect the settings of the locally installed application whose settings you want to synchronize between computers. This process creates a settings location template. If you use a built-in template such as the Microsoft Office 2010 template, skip this step. For more information about running the UE-V Generator, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md#createcustomtemplates). - -2. Install the App-V application package if you have not already done so. - -3. Publish the template to the location of your settings template catalog or manually install the template by using the `Register-UEVTemplate` Windows PowerShell cmdlet. - - **Note**   - If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**. - - - -4. Start the App-V package. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md deleted file mode 100644 index ad1e2132a4..0000000000 --- a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: What's New in UE-V 2.0 -description: What's New in UE-V 2.0 -author: levinec -ms.assetid: 5d852beb-f293-4e3a-a33b-c40df59a7515 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in UE-V 2.0 - - -Microsoft User Experience Virtualization (UE-V) 2.0 provides these new features and functionality compared to UE-V 1.0. The [Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) provide more information about the UE-V 2.0 release. - -## Client-side cache (CSC) no longer required - - -This version of UE-V introduces the **sync provider**, which replaces the requirement for the Windows Offline Files feature to support a client-side cache of settings. - -Whereas UE-V used to synchronize settings only when an application opened, closed, or when Windows locked or unlocked, or at logon or logoff, the sync provider also … - -- Synchronizes local application and Windows settings out-of-band using "**trigger events**" - -- Uses a **scheduled task** to sync the settings storage package in any interval you choose for your enterprise requirements (every 30 minutes by default) - -Certain conditions provide more frequent synchronization. - -- Settings synchronize when the user clicks the **Sync Now** button in the new Company Settings Center application. - -- The sync provider can also start for a single application without waiting for the scheduled synchronization task. For example, when an application is closed, any settings changes are written to the local cache, and the sync provider process runs asynchronously to move those new settings changes to the settings storage location. - -## Windows app synchronization - - -The developer of a Windows app can define which settings, if any, are to be synchronized, and these settings can now be captured and synchronized with UE-V. - -By default, UE-V synchronizes the settings of many of the Windows apps included in Windows 8 and Windows 8.1. You can modify the list of synchronized apps with Windows PowerShell, Windows Management Instrumentation (WMI), or Group Policy. - -**Note**   -UE-V does not synchronize Windows app settings if the domain users link their sign-in credentials to their Microsoft account. This linking synchronizes settings to Microsoft OneDrive so UE-V only synchronizes the desktop applications. - - - -## Microsoft account linking - - -Settings synchronization via OneDrive is new to Windows 8 when you are signed in with a Microsoft account or if you link your Microsoft account to your domain account. If a domain user uses UE-V and has signed in to a Microsoft account, then… - -- UE-V only synchronizes settings for desktop applications - -- Microsoft account handles Windows app settings and Windows desktop settings - -## Company Settings Center - - -You can provide your users with some control over which settings are synchronized through an application in UE-V 2 called Company Settings Center. Company Settings Center is installed along with the UE-V Agent, and users can access it from Control Panel, the **Start** menu or **Start** screen, and from the UE-V notification area icon. - -Company Settings Center displays which settings are synchronized and lets users see the synchronization status of UE-V. If you let them, users can use Company Settings Center to select which settings to synchronize. They can also click the **Sync Now** button to synchronize all settings immediately. - - - - - - -## Related topics - - -[Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md deleted file mode 100644 index de567fa610..0000000000 --- a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: What's New in UE-V 2.1 -description: What's New in UE-V 2.1 -author: levinec -ms.assetid: 7f385183-7d97-4602-b19a-baa710334ade -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in UE-V 2.1 - - -User Experience Virtualization 2.1 provides these new features and functionality compared to UE-V 2.0. The [Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) provide more information about the UE-V 2.1 release. - -## Office 2013 Settings Location Template - - -UE-V 2.1 includes the Microsoft Office 2013 settings location template with improved Outlook signature support. In UE-V 2.1, the signature data synchronizes between user devices. We’ve added synchronization of default signature settings for new, reply, and forwarded emails. Customers no longer have to choose the default signature settings. - -**Note**   -An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization. - - - -Previously UE-V included Microsoft Office 2010 settings location templates that were automatically distributed and registered with the UE-V Agent. UE-V 2.1 works with Office 365 to determine whether Office 2013 settings are roamed by Office 365. If settings are roamed by Office 365 they are not roamed by UE-V. [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkID=391220) provides more information. - -To enable settings synchronization using UE-V 2.1, do one of the following: - -- Use Group Policy to disable Office 365 synchronization - -- Do not enable the Office 365 synchronization experience during Office 2013 installation - -UE-V 2.1 ships [Office 2013 and Office 2010 templates](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589). - -## Fix for Distributed File System Namespace Users - - -UE-V has improved Distributed File System Namespace (DFSN) support by adding a UE-V configuration called SyncProviderPingEnabled. Disabling this configuration using PowerShell or WMI allows users to disable the UE-V ping. The UE-V ping causes an error when using DFSN servers because these servers do not respond to pings. The non-response prevents UE-V from synchronizing settings. Disabling the UE-V ping allows UE-V synchronization to work normally. - -To disable UE-V ping, use this PowerShell cmdlet: - -``` syntax -Set-UevConfiguration -DisableSyncProviderPing -``` - -## Synchronization for Credentials - - -UE-V 2.1 gives customers the ability to synchronize credentials and certificates stored in the Windows Credential Manager. This component is disabled by default. Enabling this component lets users keep their domain credentials and certificates in sync. Users can sign in one time on a device, and these credentials will roam for that user across all of their UE-V enabled devices. [Manage Credentials with UE-V 2.1](https://technet.microsoft.com/library/dn458932.aspx#creds) provides more information. - -**Note**   -In Windows 8 and later, Credential Manager contains web credentials. These credentials are not synchronized between users’ devices. - - - -## UE-V and Microsoft Account Synchronization - - -UE-V detects if “Sync settings with OneDrive”, also known as Microsoft Account synchronization, is on. If the Microsoft Account is not configured to synchronize settings, UE-V synchronizes Windows apps, AppX packages, and Windows desktop settings between devices. This lets users access their Store apps, music, pictures and other Microsoft Account-enabled applications without syncing outside of the enterprise firewall. UE-V checks whether Group Policy will stop synchronizing settings with OneDrive or if the user disables **Sync your settings on this computer** in the user controls. - -## Support for the SyncMethod External - - -A new [SyncMethod configuration](https://technet.microsoft.com/library/dn554321.aspx) called **External** specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access. - -## Enhanced Support for VDI Mode - - -UE-V 2.1 includes [support for VDI sessions](https://technet.microsoft.com/library/dn458932.aspx#vdi) that are shared among end users. As an administrator, you can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions. - -**Note**   -If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as back-up/restore and LKG. - - - -## Administrative Backup and Restore - - -You can restore additional settings when a user adopts a new device by putting a settings location template in **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. [Manage Administrative Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md) provides more information. - -## Synchronization for Additional Windows Settings - - -UE-V now synchronizes touch keyboard personalization, the spelling dictionary, and enables the App Switching for recent apps and screen edge settings to synchronize between Windows 8 and Windows 8.1 devices. - - - - - - -## Related topics - - -[Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) - - - - - - - - - diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md deleted file mode 100644 index b146bb839e..0000000000 --- a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: What's New in UE-V 2.1 SP1 -description: What's New in UE-V 2.1 SP1 -author: levinec -ms.assetid: 9a40c737-ad9a-4ec1-b42b-31bfabe0f170 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in UE-V 2.1 SP1 - - -User Experience Virtualization 2.1 SP1 provides these new features and functionality compared to UE-V 2.1. The [Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) provide more information about the UE-V 2.1 SP1 release. - -## Support for Windows 10 - - -UE-V 2.1 SP1 adds support for Windows 10, in addition to the same software that is supported in earlier versions of UE-V. - -### Compatibility with Microsoft Azure - -Windows 10 lets enterprise users synchronize Windows app settings and Windows operating system settings to Azure instead of to OneDrive. You can use the Windows 10 enterprise sync functionality together with UE-V for on-premises domain-joined computers only. To enable coexistence between Windows 10 and UE-V, you must disable the following UE-V templates using either PowerShell on each client or Group Policy. - -In Group Policy, under the Microsoft User Experience Virtualization node, configure these policy settings: - -- Enable “Do Not Synchronize Windows Apps” - -- Disable “Sync Windows Settings” - -### Settings Synchronization Behavior Changed for Windows 10 Support - -UE-V 2.1 SP1 roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems. - -In addition, UE-V 2.1 SP1 does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems. - -## Support Added for Roaming Network Printers - - -UE-V 2.1 SP1 lets network printers roam between devices so that a user has access to their network printers when logged on to any device on the network. This includes roaming the printer that they set as the default. - -Printer roaming in UE-V requires one of these scenarios: - -- The print server can download the required driver when it roams to a new device. - -- The driver for the roaming network printer is pre-installed on any device that needs to access that network printer. - -- The printer driver can be obtained from Windows Update. - -**Note**   -The UE-V printer roaming feature does **not** roam printer settings or preferences, such as printing double-sided. - - - -## Office 2013 Settings Location Template - - -UE-V 2.1 and 2.1 SP1 include the Microsoft Office 2013 settings location template with improved Outlook signature support. We’ve added synchronization of default signature settings for new, reply, and forwarded emails. Customers no longer have to choose the default signature settings. - -**Note**   -An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization. - - - -Previously UE-V included Microsoft Office 2010 settings location templates that were automatically distributed and registered with the UE-V Agent. UE-V 2.1 works with Office 365 to determine whether Office 2013 settings are roamed by Office 365. If settings are roamed by Office 365 they are not roamed by UE-V. [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkID=391220) provides more information. - -To enable settings synchronization using UE-V 2.1, do one of the following: - -- Use Group Policy to disable Office 365 synchronization - -- Do not enable the Office 365 synchronization experience during Office 2013 installation - -UE-V 2.1 ships [Office 2013 and Office 2010 templates](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589). - - - - - - -## Related topics - - -[Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) - - - - - - - - - diff --git a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md deleted file mode 100644 index a925e62689..0000000000 --- a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator -description: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator -author: levinec -ms.assetid: f0bb4920-0132-472c-a564-abf06a884275 -ms.reviewer: -manager: dansimp -ms.author: ellevin -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator - - -To synchronize application settings between user computers, Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 use *settings location templates*. Some settings location templates are included in User Experience Virtualization. You can also create, edit, or validate custom settings location templates by using the UE-V Generator. - -The UE-V Generator monitors Windows desktop applications to discover and capture the locations where the application stores its settings. The application that is monitored must be a desktop application. The UE-V Generator cannot create a settings location template for the following application types: - -- Virtualized applications - -- Applications that are offered through Terminal Services - -- Java applications - -- Windows apps - -This topic - -**Standard and Nonstandard settings locations:** The UE-V Generator helps you identify where applications search for settings files and registry settings that applications use to store settings information. The generator only discovers settings in locations that are accessible to a standard user. Settings that are stored in other locations are excluded. Discovered settings are grouped into two categories: **Standard** and **Non-standard**. Standard settings are recommended for synchronization, and UE-V can readily capture and apply them. Non-standard settings can potentially synchronize settings but, because of the rules that UE-V uses, these settings might not consistently or dependably synchronize settings. These settings might depend on temporary files, result in unreliable synchronization, or might not be useful. These settings locations are presented in the UE-V Generator. You can choose to include or exclude them on a case-by-case basis. - -The UE-V Generator opens the application as part of the discovery process. The generator can capture settings in the following locations: - -- **Registry Settings** – Registry locations under **HKEY\_CURRENT\_USER** - -- **Application Settings Files** – Files that are stored under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming** - -The UE-V Generator excludes locations, which commonly store application software files, but do not synchronize well between user computers or environments. The UE-V Generator excludes these locations. Excluded locations are as follows: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system - -- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive, which requires administrator rights and might require to set a User Account Control (UAC) agreement - -- Files that are located in Program Files directories, which requires administrator rights and might require to set a UAC agreement - -- Files that are located under Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files that are located in %Systemroot%, which requires administrator rights and might require to set a UAC agreement - -If registry keys and files that are stored in these locations are required to synchronize application settings, you can manually add the excluded locations to the settings location template during the template creation process - (except for registry entries in the HKEY\_LOCAL\_MACHINE hive). - -## Edit Settings Location Templates with the UE-V Generator - - -Use the UE-V Generator to edit settings location templates. When the revised settings are added to the templates by using the UE-V Generator, the version information within the template is automatically updated to ensure that any existing templates that are deployed in the enterprise are updated correctly. - -**Note**   -If you edit a UE-V 1.0 template by using the UE-V 2 Generator, the template is automatically converted to a UE-V 2 template. UE-V 1.0 Agents can no longer use the edited template. - - - -**To edit a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Edit a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, click **Browse** to search for the settings template file. Click **Next** to continue. - -4. Review the **Properties**, **Registry** locations, and **Files** locations for the settings template. Edit as required. - - - On the **Properties** tab, you can view and edit the following properties: - - - **Application name**: The application name that is written in the description of the program file properties. - - - **Program name**: The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. - - - **Product version**: The product version number of the .exe file of the application. This property, together with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, then the settings location template applies to all versions of the product. - - - **File version**: The file version number of the .exe file of the application. This property, along with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. - - - **Template author name** (optional): The name of the settings template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. You can edit the registry locations by using the **Tasks** drop-down menu. In the Tasks menu, you can add new keys, edit the name or scope of existing keys, delete keys, and browse the registry in which the keys are located. When you define the scope for the registry, you can use the **All Settings** scope to include all the registry settings under the specified key. Use **All Settings** and **Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. You can edit the file locations by using the **Tasks** drop-down menu. In the **Tasks** menu for file locations, you can add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. To include all files in the specified folder, leave the file mask empty. - -5. Click **Save** to save the changes to the settings location template. - -6. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you edit the settings location template for an application, you should test the template. Deploy the revised settings location template in a lab environment before you put it into production in the enterprise. - -**How to manually edit a settings location template** - -1. Create a local copy of the settings location template .xml file. UE-V settings location templates are .xml files that identify the locations where application store settings values. - - **Note**   - A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template. - - - -2. Open the settings location template file with an XML editor. - -3. Edit the settings location template file. All changes must conform to the UE-V schema file that is defined in [SettingsLocationTempate.xsd](https://technet.microsoft.com/library/dn763947.aspx). By default, a copy of the .xsd file is located in \\ProgramData\\Microsoft\\UEV\\Templates. - -4. Increment the **Version** number for the settings location template. - -5. Save the settings location template file, and then close the XML editor. - -6. Validate the modified settings location template file by using the UE-V Generator. - -7. You must register the edited UE-V settings location template before it can synchronize settings between client computers. To register a template, open Windows PowerShell, and then run the following cmdlet: `update-uevtemplate [templatefilename]`. You can then copy the file to the settings storage catalog. The UE-V Agent on users’ computers should then update as scheduled in the scheduled task. - -## Validate Settings Location Templates with the UE-V Generator - - -It is possible to create or edit settings location templates in an XML editor without using the UE-V Generator. If you do, you can use the UE-V Generator to validate that the new or revised XML matches the schema that has been defined for the template. - -**To validate a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, point to **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Validate a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, you can **Browse** to the settings template file. Click **Next** to continue. - -4. Click **Validate** to continue. - -5. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you validate the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into a production environment in enterprise. - -## Share Settings Location Templates with the Template Gallery - - -The Microsoft User Experience Virtualization (UE-V) 2.0 template gallery enables administrators to share their UE-V settings location templates. In the gallery, you can upload your settings location templates for other users to use, and you can download templates that other users have created. The UE-V template gallery is located on Microsoft TechNet [here](https://go.microsoft.com/fwlink/p/?LinkId=246589). - -Before you share a settings location template on the UE-V template gallery, ensure it does not contain any personal or company information. You can use any XML viewer to open and view the contents of a settings location template file. The following template values should be reviewed before you share a template with anyone outside your company. - -- Template Author Name – Specify a general, non-identifying name for the template author name or exclude this data from the template. - -- Template Author Email – Specify a general, non-identifying template author email or exclude this data from the template. - -Before you deploy any settings location template that you have downloaded from the UE-V gallery, you should first test the template to ensure that the application settings synchronize settings correctly in a test environment. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - - - - - - - - - diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index 5db1de9950..9b5f3ae040 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -3,17 +3,17 @@ title: Deploy and manage a full cloud IT solution for your business description: Learn how to set up a cloud infrastructure for your business, acquire devices and apps, and configure and deploy policies to your devices. keywords: smb, full cloud IT solution, small to medium business, deploy, setup, manage, Windows, Intune, Office 365 ms.prod: w10 -ms.technology: smb-windows -ms.topic: hero-article +ms.technology: ms.author: eravena +audience: itpro ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: smb author: eavena -ms.date: 10/30/2017 ms.reviewer: manager: dansimp ms.localizationpriority: medium +ms.topic: conceptual --- # Get started: Deploy and manage a full cloud IT solution for your business @@ -22,12 +22,12 @@ ms.localizationpriority: medium **Applies to:** -- Office 365 Business Premium, Azure AD Premium, Intune, Microsoft Store for Business, Windows 10 +- Microsoft 365 Business Standard, Azure AD Premium, Intune, Microsoft Store for Business, Windows 10 Are you ready to move your business to the cloud or wondering what it takes to make this happen with Microsoft cloud services and tools? -In this walkthrough, we'll show you how to deploy and manage a full cloud IT solution for your small to medium business using Office 365 Business Premium, Microsoft Azure AD, Intune, Microsoft Store for Business, and Windows 10. We'll show you the basics on how to: -- Acquire an Office 365 business domain +In this walkthrough, we'll show you how to deploy and manage a full cloud IT solution for your small to medium business using Microsoft 365 Business Standard, Microsoft Azure AD, Intune, Microsoft Store for Business, and Windows 10. We'll show you the basics on how to: +- Acquire an Microsoft 365 for business domain - Add Microsoft Intune and Azure Active Directory (AD) Premium licenses to your business tenant - Set up Microsoft Store for Business and manage app deployment and sync with Intune - Add users and groups in Azure AD and Intune @@ -53,11 +53,11 @@ See Get Started with Office 365 for business. +To set up your Microsoft 365 for business tenant, see Get Started with Microsoft 365 for business. If this is the first time you're setting this up, and you'd like to see how it's done, you can follow these steps to get started: -1. Go to the Office 365 page in the Microsoft Business site. Select **Try now** to use the Office 365 Business Premium Trial or select **Buy now** to sign up for Office 365 Business Premium. In this walkthrough, we'll select **Try now**. +1. Go to the Office 365 page in the Microsoft Business site. Select **Try now** to use the Microsoft 365 Business Standard Trial or select **Buy now** to sign up for Microsoft 365 Business Standard. In this walkthrough, we'll select **Try now**. **Figure 1** - Try or buy Office 365 @@ -69,14 +69,14 @@ If this is the first time you're setting this up, and you'd like to see how it's This step creates an onmicrosoft.com email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into https://portal.office.com (the admin portal). 4. Select **Create my account** and then enter the phone number you used in step 2 to verify your identity. You'll be asked to enter your verification code. -5. Select **You're ready to go...** which will take you to the Office 365 portal. +5. Select **You're ready to go...** which will take you to the Microsoft 365 admin center. > [!NOTE] - > In the Office 365 portal, icons that are greyed out are still installing. + > In the Microsoft 365 admin center, icons that are greyed out are still installing. - **Figure 2** - Office 365 portal + **Figure 2** - Microsoft 365 admin center - ![Office 365 portal](images/office365_portal.png) + ![Microsoft 365 admin center](images/office365_portal.png) 6. Select the **Admin** tile to go to the admin center. @@ -561,7 +561,7 @@ For other devices, such as those personally-owned by employees who need to conne 9. You can confirm that the new device and user are showing up as Intune-managed by going to the Intune management portal and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. ### 4.2 Add a new user -You can add new users to your tenant simply by adding them to the Office 365 groups. Adding new users to Office 365 groups automatically adds them to the corresponding groups in Microsoft Intune. +You can add new users to your tenant simply by adding them to the Microsoft 365 groups. Adding new users to Microsoft 365 groups automatically adds them to the corresponding groups in Microsoft Intune. See [Add users to Office 365](https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc?ui=en-US&rs=en-US&ad=US&fromAR=1) to learn more. Once you're done adding new users, go to the Intune management portal and verify that the same users were added to the Intune groups as well. diff --git a/smb/docfx.json b/smb/docfx.json index f4e4a7783a..379f9d6f3e 100644 --- a/smb/docfx.json +++ b/smb/docfx.json @@ -30,19 +30,30 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/smb/breadcrumb/toc.json", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "uhfHeaderId": "MSDocsHeader-M365-IT", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "TechNet.smb", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ], + "titleSuffix": "Windows for Small to Midsize Business" }, "fileMetadata": {}, "template": [], "dest": "smb", "markdownEngineName": "markdig" - } + } } diff --git a/smb/index.md b/smb/index.md index 4df3e742c1..1f9527ebf2 100644 --- a/smb/index.md +++ b/smb/index.md @@ -3,15 +3,16 @@ title: Windows 10 for small to midsize businesses description: Microsoft products and devices to transform and grow your businessLearn how to use Windows 10 for your small to midsize business. keywords: Windows 10, SMB, small business, midsize business, business ms.prod: w10 -ms.technology: smb-windows +ms.technology: ms.topic: article -ms.author: celested +ms.author: dansimp ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: smb -author: CelesteDG -ms.date: 05/01/2017 +author: dansimp ms.localizationpriority: medium +manager: dansimp +audience: itpro --- # Windows 10 for SMB diff --git a/store-for-business/TOC.md b/store-for-business/TOC.md index fe8f3b7411..bdfb8ea979 100644 --- a/store-for-business/TOC.md +++ b/store-for-business/TOC.md @@ -24,7 +24,7 @@ ### [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) ### [Microsoft Store for Business and Education PowerShell module - preview](microsoft-store-for-business-education-powershell-module.md) ### [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](manage-mpsa-software-microsoft-store-for-business.md) -### [Working with solution providers in Microsoft Store for Business](work-with-partner-microsoft-store-business.md) +### [Working with solution providers](work-with-partner-microsoft-store-business.md) ## [Billing and payments](billing-payments-overview.md) ### [Understand your invoice](billing-understand-your-invoice-msfb.md) ### [Payment methods](payment-methods.md) diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index cfbb3dcb99..3989e6d860 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -61,7 +61,7 @@ People in your org can request license for apps that they need, or that others n ## Acquire apps **To acquire an app** -1. Sign in to http://businessstore.microsoft.com +1. Sign in to https://businessstore.microsoft.com 2. Select **Shop for my group**, or use Search to find an app. 3. Select the app you want to purchase. 4. On the product description page, choose your license type - either online or offline. diff --git a/store-for-business/add-profile-to-devices.md b/store-for-business/add-profile-to-devices.md index de500f83cb..1215008fc9 100644 --- a/store-for-business/add-profile-to-devices.md +++ b/store-for-business/add-profile-to-devices.md @@ -23,7 +23,7 @@ Windows Autopilot simplifies device set up for IT Admins. For an overview of ben Watch this video to learn more about Windows Autopilot in Microsoft Store for Business.
          -> [!video https://www.microsoft.com/en-us/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false] +> [!video https://www.microsoft.com/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false] ## What is Windows Autopilot? In Microsoft Store for Business, you can manage devices for your organization and apply an *Autopilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. diff --git a/store-for-business/add-unsigned-app-to-code-integrity-policy.md b/store-for-business/add-unsigned-app-to-code-integrity-policy.md index 8c1e9402e7..a7fff81d4b 100644 --- a/store-for-business/add-unsigned-app-to-code-integrity-policy.md +++ b/store-for-business/add-unsigned-app-to-code-integrity-policy.md @@ -17,6 +17,23 @@ ms.date: 10/17/2017 # Add unsigned app to code integrity policy +> [!IMPORTANT] +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> +> Following are the major changes we are making to the service: +> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. +> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> +> The following functionality will be available via these PowerShell cmdlets: +> - Get a CI policy +> - Sign a CI policy +> - Sign a catalog +> - Download root cert +> - Download history of your signing operations +> +> For any questions, please contact us at DGSSMigration@microsoft.com. + **Applies to** @@ -45,7 +62,7 @@ Before you get started, be sure to review these best practices and requirements: **Best practices** -- **Naming convention** -- Using a naming convention makes it easier to find deployed catalog files. We'll use \*-Contoso.cat as the naming convention in this topic. For more information, see the section Inventorying catalog files by using Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). +- **Naming convention** -- Using a naming convention makes it easier to find deployed catalog files. We'll use \*-Contoso.cat as the naming convention in this topic. For more information, see the section Inventorying catalog files by using Microsoft Endpoint Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). - **Where to deploy code integrity policy** -- The [code integrity policy that you created](#create-ci-policy) should be deployed to the system on which you are running Package Inspector. This will ensure that the code integrity policy binaries are trusted. Copy the commands for each step into an elevated Windows PowerShell session. You'll use Package Inspector to find and trust all binaries in the app. @@ -100,4 +117,4 @@ Catalog signing is a vital step to adding your unsigned apps to your code integr When you use the Device Guard signing portal to sign a catalog file, the signing certificate is added to the default policy. When you download the signed catalog file, you should also download the default policy and merge this code integrity policy with your existing code integrity policies to protect machines running the catalog file. You need to do this step to trust and run your catalog files. For more information, see the Merging code integrity policies in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). 6. Open the root certificate that you downloaded, and follow the steps in **Certificate Import wizard** to install the certificate in your machine's certificate store. -7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with System Center Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). +7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with Microsoft Endpoint Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md index ecc4e1f38e..b9df263894 100644 --- a/store-for-business/billing-understand-your-invoice-msfb.md +++ b/store-for-business/billing-understand-your-invoice-msfb.md @@ -26,7 +26,6 @@ Invoices are your bill from Microsoft. A few things to note: - **Billing profile** - Billing profiles are created during your purchase. Invoices are created for each billing profile. Billing profiles let you customize what products are purchased, how you pay for them, and who can make purchases. For more information, see [Understand billing profiles](billing-profile.md) - **Items included** - Your invoice includes total charges for all first and third-party software and hardware products purchased under a Microsoft Customer Agreement. That includes items purchased from Microsoft Store for Business and Azure Marketplace. - **Charges** - Your invoice provides information about products purchased and their related charges and taxes. Purchases are aggregated to provide a concise view of your bill. -- **International customers** - Charges on invoices for international customers are converted to their local currencies. Exchange rate information is listed at the bottom of the invoice. ## Online invoice For Store for Business customers, invoices are also available online. A few things to note: @@ -107,9 +106,6 @@ At the bottom of the invoice, there are instructions for paying your bill. You c ### Publisher information If you have third-party services in your bill, the name and address of each publisher is listed at the bottom of your invoice. -### Exchange rate -If prices were converted to your local currency, the exchange rates are listed in this section at the bottom of the invoice. All Azure charges are priced in USD and third-party services are priced in the seller's currency. - ## Next steps If there are Azure charges on your invoice that you would like more details on, see [Understand the Azure charges on your Microsoft Customer Agreement invoice](https://docs.microsoft.com/azure/billing/billing-understand-your-invoice-mca). diff --git a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md index 298857630c..d00eb08313 100644 --- a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md +++ b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md @@ -43,6 +43,6 @@ After your management tool is added to your Azure AD directory, you can configur Your MDM tool is ready to use with Microsoft Store. To learn how to configure synchronization and deploy apps, see these topics: - [Manage apps you purchased from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune-classic/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune) -- [Manage apps from Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- [Manage apps from Microsoft Store for Business with Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) For third-party MDM providers or management servers, check your product documentation. diff --git a/store-for-business/device-guard-signing-portal.md b/store-for-business/device-guard-signing-portal.md index 6a2720e035..a891ecd541 100644 --- a/store-for-business/device-guard-signing-portal.md +++ b/store-for-business/device-guard-signing-portal.md @@ -17,6 +17,23 @@ ms.date: 10/17/2017 # Device Guard signing +> [!IMPORTANT] +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> +> Following are the major changes we are making to the service: +> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. +> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> +> The following functionality will be available via these PowerShell cmdlets: +> - Get a CI policy +> - Sign a CI policy +> - Sign a catalog +> - Download root cert +> - Download history of your signing operations +> +> For any questions, please contact us at DGSSMigration@microsoft.com. + **Applies to** diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md index 52c8ea4a6b..33b58da4ab 100644 --- a/store-for-business/distribute-offline-apps.md +++ b/store-for-business/distribute-offline-apps.md @@ -44,7 +44,7 @@ You can't distribute offline-licensed apps directly from Microsoft Store. Once y - **Create provisioning package**. You can use Windows Imaging and Configuration Designer (ICD) to create a provisioning package for your offline app. Once you have the package, there are options to [apply the provisioning package](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package). For more information, see [Provisioning Packages for Windows 10](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages). - **Mobile device management provider or management server.** You can use a mobile device management (MDM) provider or management server to distribute offline apps. For more information, see these topics: - - [Manage apps from Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) + - [Manage apps from Microsoft Store for Business with Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - [Manage apps from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
          For third-party MDM providers or management servers, check your product documentation. diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index 2825ff309d..2a30faf3ef 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -40,19 +40,28 @@ "searchScope": [ "Store" ], - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.store-for-business", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ] }, "fileMetadata": {}, "template": [], "dest": "store-for-business", "markdownEngineName": "markdig" - } + } } diff --git a/store-for-business/includes/store-for-business-content-updates.md b/store-for-business/includes/store-for-business-content-updates.md new file mode 100644 index 0000000000..a69df6d2ff --- /dev/null +++ b/store-for-business/includes/store-for-business-content-updates.md @@ -0,0 +1,21 @@ + + + + +## Week of November 23, 2020 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 11/23/2020 | [Microsoft Store for Business and Microsoft Store for Education overview (Windows 10)](/microsoft-store/microsoft-store-for-business-overview) | modified | +| 11/23/2020 | [Prerequisites for Microsoft Store for Business and Education (Windows 10)](/microsoft-store/prerequisites-microsoft-store-for-business) | modified | + + +## Week of October 26, 2020 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 10/27/2020 | [Add unsigned app to code integrity policy (Windows 10)](/microsoft-store/add-unsigned-app-to-code-integrity-policy) | modified | +| 10/27/2020 | [Device Guard signing (Windows 10)](/microsoft-store/device-guard-signing-portal) | modified | +| 10/27/2020 | [Sign code integrity policy with Device Guard signing (Windows 10)](/microsoft-store/sign-code-integrity-policy-with-device-guard-signing) | modified | diff --git a/store-for-business/index.md b/store-for-business/index.md index 71a8c271d1..9ec42cc879 100644 --- a/store-for-business/index.md +++ b/store-for-business/index.md @@ -2,6 +2,7 @@ title: Microsoft Store for Business and Education (Windows 10) description: Welcome to the Microsoft Store for Business and Education. You can use Microsoft Store, to find, acquire, distribute, and manage apps for your organization or school. ms.assetid: 527E611E-4D47-44F0-9422-DCC2D1ACBAB8 +manager: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -10,7 +11,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: high -ms.date: 10/17/2017 +ms.date: 05/14/2020 --- # Microsoft Store for Business and Education diff --git a/store-for-business/manage-private-store-settings.md b/store-for-business/manage-private-store-settings.md index 57fea58899..32c45c18ee 100644 --- a/store-for-business/manage-private-store-settings.md +++ b/store-for-business/manage-private-store-settings.md @@ -102,7 +102,7 @@ We've recently made performance improvements for changes in the private store. T | ------------------------------------------------------ | -------------- | | Add a product to the private store
          - Apps recently added to your inventory, including line-of-business (LOB) apps and new purchases, will take up to 36 hours to add to the private store. That time begins when the product is purchased, or added to your inventory.
          - It will take an additional 36 hours for the product to be searchable in private store, even if you see the app available from the private store tab. | - 15 minutes: available on private store tab
          - 36 hours: searchable in private store
          - 36 hours: searchable in private store tab | | Remove a product from private store | - 15 minutes: private store tab
          - 36 hours: searchable in private store | -| Accept a new LOB app into your inventory (under **Products & services)**) | - 15 minutes: available on private store tab
          - 36 hours: searchable in private store | +| Accept a new LOB app into your inventory (under **Products & services**) | - 15 minutes: available on private store tab
          - 36 hours: searchable in private store | | Create a new collection | 15 minutes| | Edit or remove a collection | 15 minutes | | Create private store tab | 4-6 hours | diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md index b7fea1a9ef..04c86ceb64 100644 --- a/store-for-business/microsoft-store-for-business-education-powershell-module.md +++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md @@ -9,7 +9,6 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.author: ms.date: 10/22/2017 ms.reviewer: manager: dansimp diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md index 4b9707b563..59be6fdc1c 100644 --- a/store-for-business/microsoft-store-for-business-overview.md +++ b/store-for-business/microsoft-store-for-business-overview.md @@ -12,7 +12,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.date: 10/17/2017 +ms.date: --- # Microsoft Store for Business and Microsoft Store for Education overview @@ -22,7 +22,10 @@ ms.date: 10/17/2017 - Windows 10 - Windows 10 Mobile -Designed for organizations, Microsoft Store for Business and Microsoft Store for Education give IT decision makers and administrators in businesses or schools a flexible way to find, acquire, manage, and distribute free and paid apps in select markets to Windows 10 devices in volume. IT administrators can manage Microsoft Store apps and private line-of-business apps in one inventory, plus assign and re-use licenses as needed. You can choose the best distribution method for your organization: directly assign apps to individuals and teams, publish apps to private pages in Microsoft Store, or connect with management solutions for more options. +Designed for organizations, Microsoft Store for Business and Microsoft Store for Education give IT decision makers and administrators in businesses or schools a flexible way to find, acquire, manage, and distribute free and paid apps in select markets to Windows 10 devices in volume. IT administrators can manage Microsoft Store apps and private line-of-business apps in one inventory, plus assign and re-use licenses as needed. You can choose the best distribution method for your organization: directly assign apps to individuals and teams, publish apps to private pages in Microsoft Store, or connect with management solutions for more options. + +> [!IMPORTANT] +> Customers who are in the Office 365 GCC environment or are eligible to buy with government pricing cannot use Microsoft Store for Business. ## Features Organizations or schools of any size can benefit from using Microsoft Store for Business or Microsoft Store for Education: diff --git a/store-for-business/prerequisites-microsoft-store-for-business.md b/store-for-business/prerequisites-microsoft-store-for-business.md index 0d054ed947..0dc7ab9ece 100644 --- a/store-for-business/prerequisites-microsoft-store-for-business.md +++ b/store-for-business/prerequisites-microsoft-store-for-business.md @@ -12,7 +12,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.date: 10/13/2017 +ms.date: --- # Prerequisites for Microsoft Store for Business and Education @@ -22,6 +22,9 @@ ms.date: 10/13/2017 - Windows 10 - Windows 10 Mobile +> [!IMPORTANT] +> Customers who are in the Office 365 GCC environment or are eligible to buy with government pricing cannot use Microsoft Store for Business. + There are a few prerequisites for using Microsoft Store for Business or Microsoft Store for Education. ## Prerequisites @@ -63,7 +66,8 @@ If your organization restricts computers on your network from connecting to the - www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com starting with Windows 10, version 1607) - +Store for Business requires Microsoft Windows HTTP Services (WinHTTP) to install, or update apps. +For more information about how to configure WinHTTP proxy settings to devices, see [Use Group Policy to apply WinHTTP proxy settings to Windows clients](https://support.microsoft.com/help/4494447/use-group-policy-to-apply-winhttp-proxy-settings-to-clients). diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index cc3bbbad3c..03c3b38bdf 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -45,7 +45,7 @@ Looking for info on the latest release? Check out [What's new in Microsoft Store - **Private store collection updates** - We’ve made it easier to find apps when creating private store collections – now you can search and filter results. [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-collections) - **Manage Skype Communication credits** - Office 365 customers that own Skype Communication Credits can now see and manage them in Microsoft Store for Business. You can view your account, add funds to your account, and manage auto-recharge settings. -- **Upgrade Office 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 Business to Office 365 Business Premium. +- **Upgrade Microsoft 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 for business subscription to a Microsoft 365 for business subscription. ## January and February 2018 - **One place for apps, software, and subscriptions** - The new **Products & services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. @@ -61,7 +61,7 @@ Looking for info on the latest release? Check out [What's new in Microsoft Store - **Export list of Minecraft: Education Edition users** - Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file. ## October 2017 -- Bug fixes and performance improvements. +- Bug fixes and performance improvements. ## September 2017 diff --git a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md index e0db1ee7c7..6512584c76 100644 --- a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md +++ b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md @@ -17,6 +17,24 @@ ms.date: 10/17/2017 # Sign code integrity policy with Device Guard signing +> [!IMPORTANT] +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> +> Following are the major changes we are making to the service: +> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. +> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> +> The following functionality will be available via these PowerShell cmdlets: +> - Get a CI policy +> - Sign a CI policy +> - Sign a catalog +> - Download root cert +> - Download history of your signing operations +> +> For any questions, please contact us at DGSSMigration@microsoft.com. + + **Applies to** - Windows 10 diff --git a/store-for-business/sign-up-microsoft-store-for-business-overview.md b/store-for-business/sign-up-microsoft-store-for-business-overview.md index 0159084242..68548aeb8b 100644 --- a/store-for-business/sign-up-microsoft-store-for-business-overview.md +++ b/store-for-business/sign-up-microsoft-store-for-business-overview.md @@ -12,7 +12,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.date: 10/13/2017 +ms.date: 10/03/2019 --- # Sign up and get started @@ -29,10 +29,10 @@ IT admins can sign up for Microsoft Store for Business and Education, and get st | Topic | Description | | ----- | ----------- | | [Microsoft Store for Business and Education overview](windows-store-for-business-overview.md) | Learn about Microsoft Store for Business. | -| [Prerequisites for Microsoft Store for Business and Education](prerequisites-windows-store-for-business.md) | There are a few prerequisites for using Microsoft Store for Business and Education. | -| [Sign up for Microsoft Store for Business or Microsoft Store for Education](sign-up-windows-store-for-business.md) | Before you sign up for Store for Business and Education, at a minimum, you'll need an Azure Active Directory (AD) or Office 365 account for your organization, and you'll need to be the global administrator for your organization. If your organization is already using Azure AD, you can go ahead and sign up for Store for Business. If not, we'll help you create an Azure AD or Office 365 account and directory as part of the sign up process. | -| [Roles and permissions in Microsoft Store for Business and Education](roles-and-permissions-windows-store-for-business.md) | The first person to sign in to Microsoft Store for Business and Education must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees. | -| [Settings reference: Microsoft Store for Business and Education](settings-reference-windows-store-for-business.md) | Microsoft Store for Business and Education has a group of settings that admins use to manage the store. | +| [Prerequisites for Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business) | There are a few prerequisites for using Microsoft Store for Business and Education.](https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business) | +| [Sign up for Microsoft Store for Business or Microsoft Store for Education](https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business) | Before you sign up for Store for Business and Education, at a minimum, you'll need an Azure Active Directory (AD) or Office 365 account for your organization, and you'll need to be the global administrator for your organization. If your organization is already using Azure AD, you can go ahead and sign up for Store for Business. If not, we'll help you create an Azure AD or Office 365 account and directory as part of the sign up process. | +| [Roles and permissions in Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business)| The first person to sign in to Microsoft Store for Business and Education must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees. | +| [Settings reference: Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business) | Microsoft Store for Business and Education has a group of settings that admins use to manage the store. | diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md index 2855e4cd43..0c9d5e23e1 100644 --- a/store-for-business/troubleshoot-microsoft-store-for-business.md +++ b/store-for-business/troubleshoot-microsoft-store-for-business.md @@ -51,7 +51,7 @@ The private store for your organization is a page in Microsoft Store app that co ![Private store for Contoso publishing](images/wsfb-privatestoreapps.png) -## Troubleshooting Microsoft Store for Business integration with System Center Configuration Manager +## Troubleshooting Microsoft Store for Business integration with Microsoft Endpoint Configuration Manager If you encounter any problems when integrating Microsoft Store for Business with Configuration Manager, use the [troubleshooting guide](https://support.microsoft.com/help/4010214/understand-and-troubleshoot-microsoft-store-for-business-integration-w). diff --git a/store-for-business/work-with-partner-microsoft-store-business.md b/store-for-business/work-with-partner-microsoft-store-business.md deleted file mode 100644 index e2829a08cb..0000000000 --- a/store-for-business/work-with-partner-microsoft-store-business.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Work with solution providers in Microsoft Store for Business and Education (Windows 10) -description: You can work with Microsoft-certified solution providers to purchase and manage products and services for your organization or school. -keywords: partner, solution provider -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa -ms.topic: conceptual -ms.date: 10/12/2018 -ms.reviewer: -manager: dansimp ---- - -# Working with solution providers in Microsoft Store for Business - -You can work with Microsoft-certified solution providers to purchase and manage products and services for your organization or school. There's a few steps involved in getting the things set up. - -The process goes like this: -- Admins find and contact a solution provider using **Find a solution provider** in Microsoft Store for Business. -- Solution providers send a request from Partner center to customers to become their solution provider. -- Customers accept the invitation in Microsoft Store for Business and start working with the solution provider. -- Customers can manage settings for the relationship with Partner in Microsoft Store for Business. - -## What can a solution provider do for my organization or school? - -There are several ways that a solution provider can work with you. Solution providers will choose one of these when they send their request to work as a partner with you. - -| Solution provider function | Description | -| ------ | ------------------- | -| Reseller | Solution providers sell Microsoft products to your organization or school. | -| Delegated administrator | Solution provider manages products and services for your organization or school. In Azure Active Directory (AD), the Partner will be a Global Administrator for tenant. This allows them to manage services like creating user accounts, assigning and managing licenses, and password resets. | -| Reseller & delegated administrator | Solution providers that sell and manage Microsoft products and services to your organization or school. | -| Partner | You can give your solution provider a user account in your tenant, and they work on your behalf with other Microsoft services. | -| Microsoft Products & Services Agreement (MPSA) partner | If you've worked with multiple solution providers through the MPSA program, you can allow partners to see purchases made by each other. | -| OEM PC partner | Solution providers can upload device IDs for PCs that you're [managing with Autopilot](https://docs.microsoft.com/microsoft-store/add-profile-to-devices). | -| Line-of-business (LOB) partner | Solution providers can develop, submit, and manage LOB apps specific for your organization or school. | - -## Find a solution provider - -You can find partner in Microsoft Store for Business and Education. - -1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com/). -2. Select **Find a solution provider**. - - ![Image shows Find a solution provider option in Microsoft Store for Business.](images/msfb-find-partner.png) - -3. Refine the list, or search for a solution provider. - - ![Image shows Find a solution provider option in Microsoft Store for Business.](images/msfb-provider-list.png) - -4. When you find a solution provider you're interested in working with, click **Contact**. -5. Complete and send the form. - -The solution provider will get in touch with you. You'll have a chance to learn more about them. If you decide to work with the solution provider, they will send you an email invitation from Partner Center. - -## Work with a solution provider - -Once you've found a solution provider and decided to work with them, they'll send you an invitation to work together from Partner Center. In Microsoft Store for Business or Education, you'll need to accept the invitation. After that, you can manage their permissions. - -**To accept a solution provider invitation** -1. **Follow email link** - You'll receive an email with a link to accept the solution provider invitation from your solution provider. The link will take you to Microsoft Store for Business or Education. -2. **Accept invitation** - On **Accept Partner Invitation**, select **Authorize** to accept the invitation, accept terms of the Microsoft Cloud Agreement, and start working with the solution provider. - -![Image shows accepting an invitation from a solution provider in Microsoft Store for Business.](images/msft-accept-partner.png) - -## Delegate admin privileges - -Depending on the request made by the solution provider, part of accepting the invitation will include agreeing to give delegated admin privileges to the solution provider. This will happen when the solution provider request includes acting as a delegated administrator. For more information, see [Delegated admin privileges in Azure AD](https://docs.microsoft.com/partner-center/customers_revoke_admin_privileges#delegated-admin-privileges-in-azure-ad). - -If you don't want to delegate admin privileges to the solution provider, you'll need to cancel the invitation instead of accepting it. - -If you delegate admin privileges to a solution provider, you can remove that later. - -**To remove delegate admin privileges** -1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com/). -2. Select **Partner** -3. Choose the Partner you want to manage. -4. Select **Remove Delegated Permissions**. - -The solution provider will still be able to work with you, for example, as a Reseller. diff --git a/surface-hub-2s-ports-keypad.md b/surface-hub-2s-ports-keypad.md deleted file mode 100644 index de36eacd73..0000000000 --- a/surface-hub-2s-ports-keypad.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Surface Hub 2S ports and keypad overview" -description: "This page describes the ports, physical buttons, and configuration information for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -audience: Admin -ms.topic: article -ms.localizationpriority: Normal ---- - -# Surface Hub 2S ports and keypad overview - -This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S whether via wired, Wi-Fi, or Bluetooth methods. It also includes best practice recommendations for key connectivity scenarios. - -Figure 1 shows the location ports and physical buttons located on a keypad attached to the underside of the device. Table 1 includes detailed descriptions of each element. -*Figure 1. Front facing and underside view of I/O connections and physical buttons* -*Table 1. Surface Hub 2S port and keypad component reference* - -| Key | Component | Description | Key parameters | -| --- | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | -| ① | USB C | USB 3.0 Port

          - Use as a walk-up port for plugging in peripherals such as thumb-drives. Guest ports are located on each side of the device (4).
          -

          NOTE: This is the recommended port for connecting an external camera. Additional camera mount features are incorporated into the design to help support retention of attached cameras.


          - NOTE: TouchBack and video ingest are not supported on these ports. | Type C

          - 15 W Port (5V/3A) | -| ② | AC power | 100-240V input
          Connect to standard AC power and Surface Hub 2S will auto switch to the local power standard such as110 volts in the US and Canada or 220 volts in the UK or other countries.

          NOTE: When the AC cord is plugged in, the system remains in an off state in which only the system management controller (SMC), real time clock (RTC), and keypad are running. | IEC 60320 C14 | -| ③ | DC power | 24V DC input port
          Use for connecting to mobile battery. | Xbox1 Dual barrel to Anderson connector | -| ④ | Ethernet | 1000/100/10 BaseT
          Use for providing a continuous connection in a corporate environment and related scenarios requiring maximum stability or capacity. | RJ45 | -| ⑤ | USB-A | USB 3.0 Port
          Use as a walk-up port for plugging in peripherals such as thumb-drives. | Type A
          7.5 W Port (5V/1.5A) | -| ⑥ | USB-C | USB 3.0 Port
          Use as a walk-up port for connecting external PCs and related devices or plugging in peripherals such as thumb-drives.

          NOTE: This is the recommended video input port, supporting both TouchBack and InkBack. | Type C
          18 W Port (5V/3A, 9V/2A) | -| ⑦ | HDMI in | HDMI 2.0, HDCP 2.2 /1.4
          Use for multiple scenarios including HDMI-to-HDMI guest input. | Standard HDMI | -| ⑧ | Mini DisplayPort out | DisplayPort 1.2 output
          Use for video-out scenarios such as mirroring the Surface Hub 2S display to a larger projector. | Mini DisplayPort | -| ⑨ | Source | Use to toggle among connected ingest sources — external PC, HDMI, and DisplayPort modes. | n/a | -| ⑩ | Volume | Use +/- to adjust audio locally on the device.

          NOTE: When navigating to the brightness control, use +/- on the volume slider to control display brightness. | n/a | -| ⑪ | Power | Power device on/off.
          Use also to navigate display menus and select items. | n/a | - - ** - ** -*Figure 2. Rear facing view of wireless, audio, & related components* -NOTE: **many of these components are internal and may not be obviously visible from the outside. - -*Figure 3. Wired port connections on Surface Hub-2S* \ No newline at end of file diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md index bb0195c0dc..81f0da756e 100644 --- a/windows/application-management/add-apps-and-features.md +++ b/windows/application-management/add-apps-and-features.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: article -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.localizationpriority: medium ms.date: 04/26/2018 diff --git a/windows/application-management/app-v/appv-about-appv.md b/windows/application-management/app-v/appv-about-appv.md index 91926ff30c..910454c958 100644 --- a/windows/application-management/app-v/appv-about-appv.md +++ b/windows/application-management/app-v/appv-about-appv.md @@ -42,7 +42,7 @@ Previous versions of App-V have required you to manually remove your unpublished ### App-V is now a feature in Windows 10 -With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. +With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. To learn more about earlier versions of App-V, see [MDOP Information Experience](https://docs.microsoft.com/microsoft-desktop-optimization-pack/index). diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md index 1ef657304d..8e37f9eb2f 100644 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to Add or Remove an Administrator by Using the Management Console (Windows 10) -description: How to add or remove an administrator by using the Management Console +description: Add or remove an administrator on the Microsoft Application Virtualization (App-V) server by using the Management Console. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index ce050e817b..c26f77e8e4 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to Add or Upgrade Packages by Using the Management Console (Windows 10) -description: How to add or upgrade packages by using the Management Console +description: Add or remove an administrator on the Microsoft Application Virtualization (App-V) server by using the Management Console. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md index ea02c9ad1f..58a0c8b25d 100644 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md @@ -1,6 +1,6 @@ --- title: Administering App-V by using Windows PowerShell (Windows 10) -description: Administering App-V by Using Windows PowerShell +description: Administer App-V by using Windows PowerShell and learn where to find more information about PowerShell for App-V. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md index e2ed065b74..e9537f973b 100644 --- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md +++ b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md @@ -1,6 +1,6 @@ --- -title: How to Allow Only Administrators to Enable Connection Groups (Windows 10) -description: How to Allow Only Administrators to Enable Connection Groups +title: Only Allow Admins to Enable Connection Groups (Windows 10) +description: Configure the App-V client so that only administrators, not users, can enable or disable connection groups. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 3dbd5d0ae9..88430660e3 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -1,6 +1,6 @@ --- title: Application Publishing and Client Interaction (Windows 10) -description: Application publishing and client interaction. +description: Learn technical information about common App-V Client operations and their integration with the local operating system. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -346,7 +346,7 @@ This process will recreate both the local and network locations for AppData and In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are input as PowerShell commands on the computer running the App-V Client. -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177). +This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/download/details.aspx?id=38177). The App-V application lifecycle tasks are triggered at user sign in (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell). @@ -799,7 +799,7 @@ App-V packages contain the Manifest file inside of the App-V Package file, which ### Examples of dynamic configuration files -The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). +The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760). #### Manifest diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index b6d62b3219..5ba6786e15 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -1,5 +1,5 @@ --- -title: How to apply the deployment configuration file by using Windows PowerShell (Windows 10) +title: Apply deployment config file via Windows PowerShell (Windows 10) description: How to apply the deployment configuration file by using Windows PowerShell for Windows 10. author: dansimp ms.pagetype: mdop, appcompat, virtualization diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 5af97d8c38..3acd5f85db 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -1,5 +1,5 @@ --- -title: Automatically clean up unpublished packages on the App-V client (Windows 10) +title: Auto-remove unpublished packages on App-V client (Windows 10) description: How to automatically clean up any unpublished packages on your App-V client devices. author: dansimp ms.pagetype: mdop, appcompat, virtualization @@ -62,5 +62,5 @@ Using Group Policy, you can turn on the **Enable automatic cleanup of unused App ## Related topics - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -- [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/en-us/download/details.aspx?id=41186) +- [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/download/details.aspx?id=41186) - [Using the App-V Client Management Console](appv-using-the-client-management-console.md) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 6bb52f7eb3..8c4f4b2b2d 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -1,6 +1,6 @@ --- title: Available Mobile Device Management (MDM) settings for App-V (Windows 10) -description: A list of the available MDM settings for App-V on Windows 10. +description: Learn the available Mobile Device Management (MDM) settings you can use to configure App-V on Windows 10. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md index 099bcdf1c4..d3c80a88c9 100644 --- a/windows/application-management/app-v/appv-capacity-planning.md +++ b/windows/application-management/app-v/appv-capacity-planning.md @@ -1,6 +1,6 @@ --- title: App-V Capacity Planning (Windows 10) -description: App-V Capacity Planning +description: Use these recommendations as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-client-configuration-settings.md b/windows/application-management/app-v/appv-client-configuration-settings.md index 693a058d7e..f641b232d6 100644 --- a/windows/application-management/app-v/appv-client-configuration-settings.md +++ b/windows/application-management/app-v/appv-client-configuration-settings.md @@ -1,6 +1,6 @@ --- title: About Client Configuration Settings (Windows 10) -description: About Client Configuration Settings +description: Learn about the App-V client configuration settings and how to use Windows PowerShell to modify the client configuration settings. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md index ae887fc389..52632f558e 100644 --- a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md +++ b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md @@ -1,6 +1,6 @@ --- title: How to make a connection group ignore the package version (Windows 10) -description: How to make a connection group ignore the package version. +description: Learn how to make a connection group ignore the package version with the App-V Server Management Console. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-connect-to-the-management-console.md b/windows/application-management/app-v/appv-connect-to-the-management-console.md index f878e5f7a4..009019e015 100644 --- a/windows/application-management/app-v/appv-connect-to-the-management-console.md +++ b/windows/application-management/app-v/appv-connect-to-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to connect to the Management Console (Windows 10) -description: How to Connect to the App-V Management Console. +description: In this article, learn the procedure for connecting to the App-V Management Console through your web browser. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-connection-group-virtual-environment.md b/windows/application-management/app-v/appv-connection-group-virtual-environment.md index 7fa1f3d1b5..a16ae77ec8 100644 --- a/windows/application-management/app-v/appv-connection-group-virtual-environment.md +++ b/windows/application-management/app-v/appv-connection-group-virtual-environment.md @@ -1,6 +1,6 @@ --- title: About the connection group virtual environment (Windows 10) -description: Overview of how the connection group virtual environment works. +description: Learn how the connection group virtual environment works and how package priority is determined. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 06/25/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # About the connection group virtual environment diff --git a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md index b6228dd6cd..60c1c72c77 100644 --- a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md +++ b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md @@ -1,6 +1,6 @@ --- title: How to convert a package created in a previous version of App-V (Windows 10) -description: How to convert a package created in a previous version of App-V. +description: Use the package converter utility to convert a virtual application package created in a previous version of App-V. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to convert a package created in a previous version of App-V diff --git a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md index c7df167fba..312adeb09b 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a connection croup with user-published and globally published packages diff --git a/windows/application-management/app-v/appv-create-a-connection-group.md b/windows/application-management/app-v/appv-create-a-connection-group.md index 2dca44be85..829708fe4f 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group.md +++ b/windows/application-management/app-v/appv-create-a-connection-group.md @@ -1,6 +1,6 @@ --- title: How to create a connection group (Windows 10) -description: How to create a connection group with the App-V Management Console. +description: Learn how to create a connection group with the App-V Management Console and where to find information about managing connection groups. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a connection group diff --git a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md index 098316aee4..273b520a59 100644 --- a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md +++ b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a custom configuration file by using the App-V Management Console diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md index a33e8e481a..600df5f713 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md @@ -1,6 +1,6 @@ --- title: How to create a package accelerator by using Windows PowerShell (Windows 10) -description: How to create a package accelerator with Windows PowerShell. +description: Learn how to create an App-v Package Accelerator by using Windows PowerShell. App-V Package Accelerators automatically sequence large, complex applications. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a package accelerator by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator.md b/windows/application-management/app-v/appv-create-a-package-accelerator.md index e16200acad..db4fe23b68 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator.md @@ -1,6 +1,6 @@ --- title: How to create a package accelerator (Windows 10) -description: How to create a package accelerator. +description: Learn how to create App-V Package Accelerators to automatically generate new virtual application packages. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a package accelerator diff --git a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md index 936ec0bf29..c6983aab02 100644 --- a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a virtual application package using an App-V Package Accelerator diff --git a/windows/application-management/app-v/appv-create-and-use-a-project-template.md b/windows/application-management/app-v/appv-create-and-use-a-project-template.md index 5e2bef4061..54aa412604 100644 --- a/windows/application-management/app-v/appv-create-and-use-a-project-template.md +++ b/windows/application-management/app-v/appv-create-and-use-a-project-template.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Create and apply an App-V project template to a sequenced App-V package diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md index 66e540afb8..b7ee707a61 100644 --- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md +++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md @@ -1,6 +1,6 @@ --- title: Creating and managing App-V virtualized applications (Windows 10) -description: Creating and managing App-V virtualized applications +description: Create and manage App-V virtualized applications to monitor and record the installation process for an application to be run as a virtualized application. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Creating and managing App-V virtualized applications @@ -18,7 +18,7 @@ ms.topic: article After you have properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. -For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](). +For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx). >[!NOTE] >The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. diff --git a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md index d1a19673a2..aae5ad7d4c 100644 --- a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to customize virtual applications extensions for a specific AD group by using the Management Console diff --git a/windows/application-management/app-v/appv-delete-a-connection-group.md b/windows/application-management/app-v/appv-delete-a-connection-group.md index cce79c8074..20c62b4398 100644 --- a/windows/application-management/app-v/appv-delete-a-connection-group.md +++ b/windows/application-management/app-v/appv-delete-a-connection-group.md @@ -1,6 +1,6 @@ --- title: How to delete a connection group (Windows 10) -description: How to delete a connection group. +description: Learn how to delete an existing App-V connection group in the App-V Management Console and where to find information about managing connection groups. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to delete a connection group diff --git a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md index efb08e96ef..16a77e0287 100644 --- a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to delete a package in the Management Console (Windows 10) -description: How to delete a package in the Management Console. +description: Learn how to delete a package in the App-V Management Console and where to find information about operations for App-V. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to delete a package in the Management Console diff --git a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md index a8d4e50173..4717b5e4ef 100644 --- a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md @@ -1,6 +1,6 @@ --- title: How to Deploy the App-V Databases by Using SQL Scripts (Windows 10) -description: How to Deploy the App-V Databases by Using SQL Scripts +description: Learn how to use SQL scripts to install the App-V databases and upgrade the App-V databases to a later version. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to deploy the App-V databases by using SQL scripts diff --git a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md index f71def779b..3c47fd5076 100644 --- a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md @@ -1,6 +1,6 @@ --- title: How to deploy App-V packages using electronic software distribution (Windows 10) -description: How to deploy App-V packages using electronic software distribution. +description: Learn how use an electronic software distribution (ESD) system to deploy App-V virtual applications to App-V clients. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to deploy App-V packages using electronic software distribution diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md index a2d5fcd633..07407291fe 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md @@ -1,6 +1,6 @@ --- title: How to Deploy the App-V Server Using a Script (Windows 10) -description: How to Deploy the App-V Server Using a Script +description: 'Learn how to deploy the App-V server by using a script (appv_server_setup.exe) from the command line.' author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to deploy the App-V server using a script diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server.md b/windows/application-management/app-v/appv-deploy-the-appv-server.md index 79a0d77597..9284a9bfc6 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server.md @@ -1,6 +1,6 @@ --- title: How to Deploy the App-V Server (Windows 10) -description: How to Deploy the App-V Server in App-V for Windows 10 +description: Use these instructions to deploy the Application Virtualization (App-V) Server in App-V for Windows 10. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Deploy the App-V Server (new installation) @@ -32,7 +32,7 @@ ms.topic: article 1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations: * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site. - * The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). + * The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home). 2. Copy the App-V server installation files to the computer on which you want to install it. 3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. 4. Review and accept the license terms, and choose whether to enable Microsoft updates. diff --git a/windows/application-management/app-v/appv-deploying-appv.md b/windows/application-management/app-v/appv-deploying-appv.md index ee60adece8..14493f0b25 100644 --- a/windows/application-management/app-v/appv-deploying-appv.md +++ b/windows/application-management/app-v/appv-deploying-appv.md @@ -1,6 +1,6 @@ --- title: Deploying App-V (Windows 10) -description: Deploying App-V +description: App-V supports several different deployment options. Learn how to complete App-V deployment at different stages in your App-V deployment. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying App-V for Windows 10 diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md index 126da2945c..736d772dfc 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md @@ -1,6 +1,6 @@ --- title: Deploying Microsoft Office 2010 by Using App-V (Windows 10) -description: Deploying Microsoft Office 2010 by Using App-V +description: Create Office 2010 packages for Microsoft Application Virtualization (App-V) using the App-V Sequencer or the App-V Package Accelerator. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying Microsoft Office 2010 by Using App-V @@ -48,7 +48,7 @@ For detailed instructions on how to create virtual application packages using Ap You can deploy Office 2010 packages by using any of the following App-V deployment methods: -* System Center Configuration Manager +* Microsoft Endpoint Configuration Manager * App-V server * Stand-alone through Windows PowerShell commands @@ -86,7 +86,7 @@ The following table provides a full list of supported integration points for Off ### Office 2010 App-V Packages -* [Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399) +* [Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399) * [Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/kb/2828619) * [How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069) diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md index 2b22d0a46a..fee5c296a1 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md @@ -1,6 +1,6 @@ --- title: Deploying Microsoft Office 2013 by Using App-V (Windows 10) -description: Deploying Microsoft Office 2013 by Using App-V +description: Use Application Virtualization (App-V) to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying Microsoft Office 2013 by Using App-V @@ -39,7 +39,7 @@ Before you deploy Office with App-V, review the following requirements. |---|---| |Packaging|All Office applications you wish to deploy to users must be in a single package.
          In App-V and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
          If you're deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#deploying-visio-2013-and-project-2013-with-office).| |Publishing|You can only publish one Office package per client computer.
          You must publish the Office package globally, not to the user.| -|Deploying Office 365 ProPlus, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).
          You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.| +|Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).
          You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.| ### Excluding Office applications from a package @@ -246,7 +246,7 @@ Use the following information to publish an Office package. Deploy the App-V package for Office 2013 by using the same methods you use for any other package: -* System Center Configuration Manager +* Microsoft Endpoint Configuration Manager * App-V Server * Stand-alone through Windows PowerShell commands @@ -284,10 +284,10 @@ Use the steps in this section to enable Office plug-ins with your Office package #### To enable plug-ins for Office App-V packages -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a Windows PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It's a good idea to use Office 365 ProPlus (non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. +1. Add a Connection Group through App-V Server, Microsoft Endpoint Configuration Manager, or a Windows PowerShell cmdlet. +2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It's a good idea to use Microsoft 365 Apps for enterprise (non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. 3. Create an App-V package that includes the desired plug-ins. -4. Add a Connection Group through App-V Server, System Center Configuration Manager, or a Windows PowerShell cmdlet. +4. Add a Connection Group through App-V Server, Configuration Manager, or a Windows PowerShell cmdlet. 5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. >[!IMPORTANT] diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md index f9239225d9..ba7107286e 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md @@ -1,6 +1,6 @@ --- title: Deploying Microsoft Office 2016 by using App-V (Windows 10) -description: Deploying Microsoft Office 2016 by using App-V +description: Use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying Microsoft Office 2016 by using App-V @@ -39,7 +39,7 @@ Before you deploy Office with App-V, review the following requirements. |-----------|-------------------| | Packaging. | All Office applications that you deploy to users must be in a single package.
          In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
          If you're deploying Microsoft Visio 2016 and Microsoft Project 2016 at the same time as Office, you must put them all in the same package. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office). | | Publishing. | You can only publish one Office package per client computer.
          You must publish the Office package globally, not to the user. | -| Deploying Office 365 ProPlus, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer with Remote Desktop Services. | You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus). | +| Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer with Remote Desktop Services. | You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus). | ### Excluding Office applications from a package @@ -124,7 +124,7 @@ The XML file included in the Office Deployment Tool specifies the product detail | Language element | Specifies which language the applications support. | `Language ID="en-us"` | | Version (attribute of **Add** element) | Optional. Specifies which build the package will use.
          Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` | | SourcePath (attribute of **Add** element) | Specifies the location the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` | - | Channel (part of **Add** element) | Optional. Defines which channel will be used to update Office after installation.
          The default is **Deferred** for Office 365 ProPlus and **Current** for Visio Pro for Office 365 and Project Desktop Client.
          For more information about update channels, see [Overview of update channels for Office 365 ProPlus](https://docs.microsoft.com/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
          `Channel="Deferred"`
          `Channel="FirstReleaseDeferred"`
          `Channel="FirstReleaseCurrent"` | + | Channel (part of **Add** element) | Optional. Defines which channel will be used to update Office after installation.
          The default is **Deferred** for Microsoft 365 Apps for enterprise and **Current** for Visio Pro for Office 365 and Project Desktop Client.
          For more information about update channels, see [Overview of update channels for Microsoft 365 Apps for enterprise](https://docs.microsoft.com/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
          `Channel="Deferred"`
          `Channel="FirstReleaseDeferred"`
          `Channel="FirstReleaseCurrent"` | After editing the **configuration.xml** file to specify the desired product, languages, and the location where the Office 2016 applications will be saved to, you can save the configuration file under a name of your choice, such as "Customconfig.xml." 2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2016 applications that will later be converted into an App-V package. The following is an example command: @@ -152,7 +152,7 @@ After you download the Office 2016 applications through the Office Deployment To The following table summarizes the values you need to enter in the **Customconfig.xml** file. The steps in the sections that follow the table will specify the exact entries you need to make. >[!NOTE] ->You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. +>You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. | Product ID | Subscription licensing | |---|---| @@ -230,7 +230,7 @@ Use the following information to publish an Office package. Deploy the App-V package for Office 2016 by using the same methods as the other packages that you've already deployed: -* System Center Configuration Manager +* Microsoft Endpoint Configuration Manager * App-V Server * Stand-alone through Windows PowerShell commands @@ -267,10 +267,10 @@ The following steps will tell you how to enable Office plug-ins with your Office #### Enable plug-ins for Office App-V packages -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a Windows PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer that will be used to sequence the plug-in. We recommend that you use Office 365 ProPlus (non-virtual) on the sequencing computer when sequencing Office 2016 plug-ins. +1. Add a Connection Group through App-V Server, Microsoft Endpoint Configuration Manager, or a Windows PowerShell cmdlet. +2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer that will be used to sequence the plug-in. We recommend that you use Microsoft 365 Apps for enterprise (non-virtual) on the sequencing computer when sequencing Office 2016 plug-ins. 3. Create an App-V package that includes the plug-ins you want. -4. Add a Connection Group through the App-V Server, System Center Configuration Manager, or a Windows PowerShell cmdlet. +4. Add a Connection Group through the App-V Server, Configuration Manager, or a Windows PowerShell cmdlet. 5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. >[!IMPORTANT] diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md index 0bc8d491a1..37adcaae5e 100644 --- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying App-V packages by using electronic software distribution (ESD) @@ -30,7 +30,7 @@ To learn how to configure the App-V client to enable only administrators to publ ## Related topics -- [App-V and Citrix integration](https://www.microsoft.com/en-us/download/details.aspx?id=40885) +- [App-V and Citrix integration](https://www.microsoft.com/download/details.aspx?id=40885) - [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md index b1535ba7a9..8cb954168b 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md @@ -1,6 +1,6 @@ --- title: Deploying the App-V Sequencer and configuring the client (Windows 10) -description: Deploying the App-V Sequencer and configuring the client +description: Learn how to deploy the App-V Sequencer and configure the client by using the ADMX template and Group Policy. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying the App-V Sequencer and configuring the client diff --git a/windows/application-management/app-v/appv-deploying-the-appv-server.md b/windows/application-management/app-v/appv-deploying-the-appv-server.md index ae16a7025e..97f97275be 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-server.md @@ -1,6 +1,6 @@ --- title: Deploying the App-V Server (Windows 10) -description: Deploying the App-V Server in App-V for Windows 10 +description: Learn how to deploy the Application Virtualization (App-V) Server in App-V for Windows 10 by using different deployment configurations described in this article. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying the App-V server @@ -45,7 +45,7 @@ App-V offers the following five server components, each of which serves a specif All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations: * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site. -* The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). +* The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home). In large organizations, you might want to install more than one instance of the server components to get the following benefits. diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md index da297a75ef..d09d0141d8 100644 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ b/windows/application-management/app-v/appv-deployment-checklist.md @@ -1,6 +1,6 @@ --- title: App-V Deployment Checklist (Windows 10) -description: App-V Deployment Checklist +description: Use the App-V deployment checklist to understand the recommended steps and items to consider when deploying App-V features. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V Deployment Checklist diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md index 61c8be02a4..196cb62ece 100644 --- a/windows/application-management/app-v/appv-dynamic-configuration.md +++ b/windows/application-management/app-v/appv-dynamic-configuration.md @@ -1,6 +1,6 @@ --- title: About App-V Dynamic Configuration (Windows 10) -description: About App-V Dynamic Configuration +description: Learn how to create or edit an existing Application Virtualization (App-V) dynamic configuration file. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # About App-V dynamic configuration diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md index 007503ac03..601bfd8297 100644 --- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md @@ -1,6 +1,6 @@ --- title: How to Enable Only Administrators to Publish Packages by Using an ESD (Windows 10) -description: How to Enable Only Administrators to Publish Packages by Using an ESD +description: Learn how to enable only administrators to publish packages by bsing an electronic software delivery (ESD). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to enable only administrators to publish packages by using an ESD diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md index cbaef2e7a4..39a072c558 100644 --- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Enable Reporting on the App-V Client by Using Windows PowerShell diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md index 39b561ebe4..c7985565d4 100644 --- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md +++ b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md @@ -1,6 +1,6 @@ --- title: Enable the App-V in-box client (Windows 10) -description: How to enable the App-V in-box client installed with Windows 10. +description: Learn how to enable the Microsoft Application Virtualization (App-V) in-box client installed with Windows 10. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Enable the App-V in-box client diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md index 6381b20416..9eb57e8521 100644 --- a/windows/application-management/app-v/appv-evaluating-appv.md +++ b/windows/application-management/app-v/appv-evaluating-appv.md @@ -1,6 +1,6 @@ --- title: Evaluating App-V (Windows 10) -description: Evaluating App-V for Windows 10 +description: Learn how to evaluate App-V for Windows 10 in a lab environment before deploying into a production environment. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md index c05dd40169..bec88a55bf 100644 --- a/windows/application-management/app-v/appv-for-windows.md +++ b/windows/application-management/app-v/appv-for-windows.md @@ -1,6 +1,6 @@ --- title: Application Virtualization (App-V) (Windows 10) -description: Application Virtualization (App-V) +description: See various topics that can help you administer Application Virtualization (App-V) and its components. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Application Virtualization (App-V) for Windows 10 overview diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md index a05b56167e..03f116312a 100644 --- a/windows/application-management/app-v/appv-getting-started.md +++ b/windows/application-management/app-v/appv-getting-started.md @@ -1,6 +1,6 @@ --- title: Getting Started with App-V (Windows 10) -description: Getting Started with App-V for Windows 10 +description: Get started with Microsoft Application Virtualization (App-V) for Windows 10. App-V for Windows 10 delivers Win32 applications to users as virtual applications. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Getting started with App-V for Windows 10 @@ -18,7 +18,7 @@ ms.topic: article Microsoft Application Virtualization (App-V) for Windows 10 delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. -With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). +With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). If you’re already using App-V, performing an in-place upgrade to Windows 10 on user devices automatically installs the App-V client and migrates users’ App-V applications and settings. For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md). @@ -35,13 +35,13 @@ To start using App-V to deliver virtual applications to users, you’ll need to | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more details, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

          If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:

          If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.

          If you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx).

          See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components.| +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more details, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

          If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:

          If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.

          If you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx).

          See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components.| | App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices, allowing users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.

          To learn how to enable the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | | App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must run the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). -If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx). +If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/learning/default.aspx). ## Getting started with App-V diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md index a74cef34c4..941e4f58e7 100644 --- a/windows/application-management/app-v/appv-high-level-architecture.md +++ b/windows/application-management/app-v/appv-high-level-architecture.md @@ -1,6 +1,6 @@ --- title: High-level architecture for App-V (Windows 10) -description: High-level Architecture for App-V. +description: Use the information in this article to simplify your Microsoft Application Virtualization (App-V) deployment. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # High-level architecture for App-V diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index f4075f53b1..82b6545be6 100644 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md index 30f57f3cb7..ffffedff20 100644 --- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md index 314545131f..44e1be2801 100644 --- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to install the Management Server on a Standalone Computer and Connect it to the Database diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md index c2f081dd15..f08f5dfe4d 100644 --- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md @@ -1,6 +1,6 @@ --- -title: How to Install the Publishing Server on a Remote Computer (Windows 10) -description: How to Install the App-V Publishing Server on a Remote Computer +title: Install the Publishing Server on a Remote Computer (Windows 10) +description: Use the procedures in this article to install the Microsoft Application Virtualization (App-V) publishing server on a separate computer. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to install the publishing server on a remote computer @@ -38,7 +38,7 @@ Use the following procedure to install the publishing server on a separate compu 3. Enter the server name and a description (if required), then select **Add**. 9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle that package to an AD group, then publish it. Using an internet browser, open the following URL: https://publishingserver:pubport. If the server is running correctly, information like the following example should appear. - ```SQL + ```xml diff --git a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md index a0a7912e96..d476fda616 100644 --- a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to install the reporting server on a standalone computer and connect it to the database diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index 6fe3e63862..7a13e789c6 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -1,6 +1,6 @@ --- title: Install the App-V Sequencer (Windows 10) -description: Install the App-V Sequencer +description: Learn how to install the App-V Sequencer to convert Win32 applications into virtual packages for deployment to user devices. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Install the App-V Sequencer diff --git a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index a4597fb812..bc8cd9361e 100644 --- a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to load the Windows PowerShell cmdlets for App-V and get cmdlet help diff --git a/windows/application-management/app-v/appv-maintaining-appv.md b/windows/application-management/app-v/appv-maintaining-appv.md index 65f4a157a0..e03e524b5a 100644 --- a/windows/application-management/app-v/appv-maintaining-appv.md +++ b/windows/application-management/app-v/appv-maintaining-appv.md @@ -1,6 +1,6 @@ --- title: Maintaining App-V (Windows 10) -description: Maintaining App-V +description: After you have deployed App-V for Windows 10, you can use the following information to maintain the App-V infrastructure. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Maintaining App-V diff --git a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md index f0f0b0ad03..c7f1214405 100644 --- a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/24/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to manage App-V packages running on a stand-alone computer by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md index c3653ce3be..d4e01266f8 100644 --- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md index 76ced5b4de..9b5aa14320 100644 --- a/windows/application-management/app-v/appv-managing-connection-groups.md +++ b/windows/application-management/app-v/appv-managing-connection-groups.md @@ -1,6 +1,6 @@ --- title: Managing Connection Groups (Windows 10) -description: Managing Connection Groups +description: Connection groups can allow administrators to manage packages independently and avoid having to add the same application multiple times to a client computer. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md index cd519bf28a..a3600bfa4c 100644 --- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md @@ -1,6 +1,6 @@ --- title: Migrating to App-V from a Previous Version (Windows 10) -description: Migrating to App-V for Windows 10 from a previous version +description: Learn how to migrate to Microsoft Application Virtualization (App-V) for Windows 10 from a previous version. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md index a783bac0cb..c065c9a2a5 100644 --- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md +++ b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md @@ -1,6 +1,6 @@ --- title: How to Modify an Existing Virtual Application Package (Windows 10) -description: How to Modify an Existing Virtual Application Package +description: Learn how to modify an existing virtual application package and add a new application to an existing virtual application package. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md index 11bcc0117b..816015f740 100644 --- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md +++ b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md @@ -1,6 +1,6 @@ --- title: How to Modify Client Configuration by Using Windows PowerShell (Windows 10) -description: How to Modify Client Configuration by Using Windows PowerShell +description: Learn how to modify the Application Virtualization (App-V) client configuration by using Windows PowerShell. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md index de47148927..e34dd4f7dc 100644 --- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md +++ b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md @@ -1,6 +1,6 @@ --- title: How to Move the App-V Server to Another Computer (Windows 10) -description: How to Move the App-V Server to Another Computer +description: Learn how to create a new management server console in your environment and learn how to connect it to the App-V database. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md index d5f38d7982..b68da536ab 100644 --- a/windows/application-management/app-v/appv-operations.md +++ b/windows/application-management/app-v/appv-operations.md @@ -1,6 +1,6 @@ --- title: Operations for App-V (Windows 10) -description: Operations for App-V +description: Learn about the various types of App-V administration and operating tasks that are typically performed by an administrator. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Operations for App-V diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md index 40047a8bd9..ea4f11a42b 100644 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ b/windows/application-management/app-v/appv-performance-guidance.md @@ -1,6 +1,6 @@ --- title: Performance Guidance for Application Virtualization (Windows 10) -description: Performance Guidance for Application Virtualization +description: Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- @@ -31,7 +31,7 @@ You should read and understand the following information before reading this doc - [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) -- [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760) +- [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760) **Note**   Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk * review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index dc6488afb9..4c098ba090 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -1,6 +1,6 @@ --- title: App-V Planning Checklist (Windows 10) -description: App-V Planning Checklist +description: Learn about the recommended steps and items to consider when planning an Application Virtualization (App-V) deployment. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V Planning Checklist diff --git a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md index 3a1d781f17..2a6724419a 100644 --- a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md +++ b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md @@ -1,6 +1,6 @@ --- title: Planning to Use Folder Redirection with App-V (Windows 10) -description: Planning to Use Folder Redirection with App-V +description: Learn about folder redirection with App-V. Folder redirection enables users and administrators to redirect the path of a folder to a new location. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning to Use Folder Redirection with App-V diff --git a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md index 289e32ec6f..8aa07c226e 100644 --- a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md @@ -1,6 +1,6 @@ --- title: Planning for the App-V Server Deployment (Windows 10) -description: Planning for the App-V 5.1 Server Deployment +description: Learn what you need to know so you can plan for the Microsoft Application Virtualization (App-V) 5.1 server deployment. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for the App-V server deployment diff --git a/windows/application-management/app-v/appv-planning-for-appv.md b/windows/application-management/app-v/appv-planning-for-appv.md index 175946673a..0ebf3ccaf3 100644 --- a/windows/application-management/app-v/appv-planning-for-appv.md +++ b/windows/application-management/app-v/appv-planning-for-appv.md @@ -1,6 +1,6 @@ --- title: Planning for App-V (Windows 10) -description: Planning for App-V +description: Use the information in this article to plan to deploy App-V without disrupting your existing network or user experience. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for App-V diff --git a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md index e6167f8707..29d772054e 100644 --- a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md +++ b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md @@ -1,6 +1,6 @@ --- title: Planning for High Availability with App-V Server -description: Planning for High Availability with App-V Server +description: Learn what you need to know so you can plan for high availability with Application Virtualization (App-V) server. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for high availability with App-V Server @@ -18,7 +18,7 @@ ms.topic: article Microsoft Application Virtualization (App-V) system configurations can take advantage of options that maintain a high available service level. -The following sections will he following sections to help you understand the options to deploy App-V in a highly available configuration. +The following sections will help you understand the options to deploy App-V in a highly available configuration. ## Support for Microsoft SQL Server clustering diff --git a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md index adcfe14ddc..0f797ad9d7 100644 --- a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md @@ -1,6 +1,6 @@ --- title: Planning for the App-V Sequencer and Client Deployment (Windows 10) -description: Planning for the App-V Sequencer and Client Deployment +description: Learn what you need to do to plan for the App-V Sequencer and Client deployment, and where to find additional information about the deployment process. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for the App-V Sequencer and Client Deployment diff --git a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md index ae79aea7c4..91ade82d46 100644 --- a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md +++ b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md @@ -1,6 +1,6 @@ --- title: Planning for Deploying App-V with Office (Windows 10) -description: Planning for Using App-V with Office +description: Use the information in this article to plan how to deploy Office within Microsoft Application Virtualization (App-V). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for deploying App-V with Office @@ -30,7 +30,7 @@ You can use the App-V Sequencer to create plug-in packages for language packs, l For a list of supported Office products, see [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click). >[!NOTE] ->You must use the Office Deployment Tool instead of the App-V Sequencer to create App-V packages for Office 365 ProPlus. App-V does not support package creation for volume-licensed versions of Office Professional Plus or Office Standard. Support for the [Office 2013 version of Office 365 ended in February 2017](https://support.microsoft.com/kb/3199744). +>You must use the Office Deployment Tool instead of the App-V Sequencer to create App-V packages for Microsoft 365 Apps for enterprise. App-V does not support package creation for volume-licensed versions of Office Professional Plus or Office Standard. Support for the [Office 2013 version of Office 365 ended in February 2017](https://support.microsoft.com/kb/3199744). ## Using App-V with coexisting versions of Office diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md index 4fec6e664e..49e7266314 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md @@ -9,14 +9,14 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning to Deploy App-V with an electronic software distribution system >Applies to: Windows 10, version 1607 -If you are using an electronic software distribution (ESD) system to deploy App-V packages, review the following planning considerations. For information about deploying App-V with System Center Configuration Manager, see [Introduction to application management in Configuration Manager](https://technet.microsoft.com/library/gg682125.aspx#BKMK_Appv). +If you are using an electronic software distribution (ESD) system to deploy App-V packages, review the following planning considerations. For information about deploying App-V with Microsoft Endpoint Configuration Manager, see [Introduction to application management in Configuration Manager](https://technet.microsoft.com/library/gg682125.aspx#BKMK_Appv). Review the following component and architecture requirements options that apply when you use an ESD to deploy App-V packages: diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv.md b/windows/application-management/app-v/appv-planning-to-deploy-appv.md index 8b30ecd4ff..be621c72e2 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv.md @@ -1,6 +1,6 @@ --- title: Planning to Deploy App-V (Windows 10) -description: Planning to Deploy App-V +description: Learn about the different deployment configurations and requirements to consider before you deploy App-V for Windows 10. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning to Deploy App-V for Windows 10 diff --git a/windows/application-management/app-v/appv-preparing-your-environment.md b/windows/application-management/app-v/appv-preparing-your-environment.md index 33dcf85901..991209bd1b 100644 --- a/windows/application-management/app-v/appv-preparing-your-environment.md +++ b/windows/application-management/app-v/appv-preparing-your-environment.md @@ -1,15 +1,15 @@ --- title: Preparing Your Environment for App-V (Windows 10) -description: Preparing Your Environment for App-V -author: lomayor +description: Use this info to prepare for deployment configurations and prerequisites for Microsoft Application Virtualization (App-V). ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: +author: dansimp manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Preparing your environment for App-V diff --git a/windows/application-management/app-v/appv-prerequisites.md b/windows/application-management/app-v/appv-prerequisites.md index 841c318800..652eabd063 100644 --- a/windows/application-management/app-v/appv-prerequisites.md +++ b/windows/application-management/app-v/appv-prerequisites.md @@ -1,6 +1,6 @@ --- title: App-V Prerequisites (Windows 10) -description: App-V Prerequisites +description: Learn about the prerequisites you need before you begin installing Application Virtualization (App-V). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V for Windows 10 prerequisites diff --git a/windows/application-management/app-v/appv-publish-a-connection-group.md b/windows/application-management/app-v/appv-publish-a-connection-group.md index c8c8da79fa..e48f4c43c6 100644 --- a/windows/application-management/app-v/appv-publish-a-connection-group.md +++ b/windows/application-management/app-v/appv-publish-a-connection-group.md @@ -1,6 +1,6 @@ --- title: How to Publish a Connection Group (Windows 10) -description: How to Publish a Connection Group +description: Learn how to publish a connection group to computers that run the Application Virtualization (App-V) client. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Publish a Connection Group diff --git a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md index 47e033fcbe..565f150699 100644 --- a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to publish a package by using the Management console (Windows 10) -description: How to publish a package by using the Management console. +description: Learn how the Management console in App-V can help you enable admin controls as well as publish App-V packages. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to publish a package by using the Management console diff --git a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md index da72c8bd99..2134edc7bb 100644 --- a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md +++ b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md index 9179e46022..dc744d16c2 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index daf1783e49..704d0954f7 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- # Release Notes for App-V for Windows 10, version 1607 @@ -145,6 +145,8 @@ App-V doesn't support Visual Studio 2012. **Workaround**: Use a newer version of Microsoft Visual Studio. +Currently, Visual Studio 2012 doesn't support app virtualization, whether using Microsoft App-V or third party solutions such as VMWare ThinApp. While it is possible you might find that Visual Studio works well enough for your purposes when running within one of these environments, we are unable to address any bugs or issues found when running in a virtualized environment at this time. + ## Application filename restrictions for App-V Sequencer The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md index 99a25f7fda..41c995543f 100644 --- a/windows/application-management/app-v/appv-reporting.md +++ b/windows/application-management/app-v/appv-reporting.md @@ -1,6 +1,6 @@ --- title: About App-V Reporting (Windows 10) -description: About App-V Reporting +description: Learn how the App-V reporting feature collects information about computers running the App-V client and virtual application package usage. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # About App-V reporting @@ -30,7 +30,7 @@ The following list displays the end–to-end high-level workflow for reporting i To confirm SQL Server Reporting Services is running, enter in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear. 2. Install the App-V reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md). Configure the time when the computer running the App-V client should send data to the reporting server. -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports](https://www.microsoft.com/en-us/download/details.aspx?id=42630). +3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports](https://www.microsoft.com/download/details.aspx?id=42630). > [!NOTE] >If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V. diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md index 5582efb79c..b1a6caca2c 100644 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 03/08/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- @@ -44,7 +44,7 @@ Each method accomplishes essentially the same task, but some methods may be bett To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. -There is no Group Policy setting available to manage this registry key, so you have to use System Center Configuration Manager or another electronic software distribution (ESD) system, or manually edit the registry. +There is no Group Policy setting available to manage this registry key, so you have to use Microsoft Endpoint Configuration Manager or another electronic software distribution (ESD) system, or manually edit the registry. Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages globally or to the user. diff --git a/windows/application-management/app-v/appv-security-considerations.md b/windows/application-management/app-v/appv-security-considerations.md index 32939d5452..d2dd484a97 100644 --- a/windows/application-management/app-v/appv-security-considerations.md +++ b/windows/application-management/app-v/appv-security-considerations.md @@ -1,6 +1,6 @@ --- title: App-V Security Considerations (Windows 10) -description: App-V Security Considerations +description: Learn about accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V security considerations diff --git a/windows/application-management/app-v/appv-sequence-a-new-application.md b/windows/application-management/app-v/appv-sequence-a-new-application.md index bdb63f9a46..2eb919d9b5 100644 --- a/windows/application-management/app-v/appv-sequence-a-new-application.md +++ b/windows/application-management/app-v/appv-sequence-a-new-application.md @@ -1,6 +1,6 @@ --- title: Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10) -description: How to manually sequence a new app using the App-V Sequencer +description: Learn how to manually sequence a new app by using the App-V Sequencer that's included with the Windows ADK. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) diff --git a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md index 1ccb908974..2a353b9121 100644 --- a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md +++ b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md @@ -1,6 +1,6 @@ --- title: How to sequence a package by using Windows PowerShell (Windows 10) -description: How to sequence a package by using Windows PowerShell +description: Learn how to sequence a new Microsoft Application Virtualization (App-V) package by using Windows PowerShell. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md index cdf2a4782e..340244864b 100644 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ b/windows/application-management/app-v/appv-supported-configurations.md @@ -1,6 +1,6 @@ --- title: App-V Supported Configurations (Windows 10) -description: App-V Supported Configurations +description: Learn the requirements to install and run App-V supported configurations in your Windows 10 environment. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,12 +9,12 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V Supported Configurations ->Applies to: Windows 10, version 1607; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 +>Applies to: Windows 10, version 1607; Window Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 (Extended Security Update) This topic specifies the requirements to install and run App-V in your Windows 10 environment. For information about prerequisite software such as the .NET Framework, see [App-V prerequisites](appv-prerequisites.md). @@ -34,7 +34,7 @@ The App-V server does not support the following scenarios: ### Management server operating system requirements -You can install the App-V Management server on a server running Windows Server 2008 R2 with SP1 or later. +You can install the App-V Management server on a server running Windows Server 2008 R2 with SP1 (Extended Security Update) or later. >[!IMPORTANT] >Deploying a Management server role to a computer with Remote Desktop Services enabled is not supported. @@ -51,12 +51,15 @@ The following table lists the SQL Server versions that the App-V Management data |SQL Server version|Service pack|System architecture| |---|---|---| +|Microsoft SQL Server 2019||32-bit or 64-bit| |Microsoft SQL Server 2017||32-bit or 64-bit| |Microsoft SQL Server 2016|SP2|32-bit or 64-bit| |Microsoft SQL Server 2014||32-bit or 64-bit| |Microsoft SQL Server 2012|SP2|32-bit or 64-bit| |Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit| +For more information on user configuration files with SQL server 2016 or later, see the [support article](https://support.microsoft.com/help/4548751/app-v-server-publishing-might-fail-when-you-apply-user-configuration-f). + ### Publishing server operating system requirements The App-V Publishing server can be installed on a server that runs Windows Server 2008 R2 with SP1 or later. @@ -101,25 +104,15 @@ Similarly, the App-V Remote Desktop Services (RDS) client is included with Windo ## Sequencer system requirements -The following table lists the operating systems that the App-V Sequencer installation supports. - -|Operating system|Service pack|System architecture| -|---|---|---| -|Microsoft Windows Server 2012 R2||64-bit| -|Microsoft Windows Server 2012||64-bit| -|Microsoft Windows Server 2008 R2|SP1|64-bit| -|Microsoft Windows 10||32-bit and 64-bit| -|Microsoft Windows 8.1||32-bit and 64-bit| -|Microsoft Windows 8||32-bit and 64-bit| -|Microsoft Windows 7|SP1|32-bit and 64-bit| +Sequencer is now part of the Windows Assessment and Deployment Kit (Windows ADK). [Download the latest Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install) that is recommended for your version of the Windows OS. ### Sequencer hardware requirements See the Windows or Windows Server documentation for the hardware requirements. -## Supported versions of System Center Configuration Manager +## Supported versions of Microsoft Endpoint Configuration Manager -The App-V client works with System Center Configuration Manager versions starting with Technical Preview for System Center Configuration Manager, version 1606. +The App-V client works with Configuration Manager versions starting with Technical Preview for System Center Configuration Manager, version 1606. ## Related topics diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md index 910287f6d3..8cd6653c77 100644 --- a/windows/application-management/app-v/appv-technical-reference.md +++ b/windows/application-management/app-v/appv-technical-reference.md @@ -1,6 +1,6 @@ --- title: Technical Reference for App-V (Windows 10) -description: Technical Reference for App-V +description: Learn strategy and context for a number of performance optimization practices in this techincal reference for Application Virtualization (App-V). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md index 92cd2124d8..a085b22759 100644 --- a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md index fdacc04362..29240949b5 100644 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ b/windows/application-management/app-v/appv-troubleshooting.md @@ -1,6 +1,6 @@ --- title: Troubleshooting App-V (Windows 10) -description: Troubleshooting App-V +description: Learn how to find information about troubleshooting Application Virtualization (App-V) and information about other App-V topics. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index 5234b80231..8660d86846 100644 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -1,6 +1,6 @@ --- title: Upgrading to App-V for Windows 10 from an existing installation (Windows 10) -description: Upgrading to App-V for Windows 10 from an existing installation +description: Learn about upgrading to Application Virtualization (App-V) for Windows 10 from an existing installation. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- # Upgrading to App-V for Windows 10 from an existing installation diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md index 83bfa11219..7dc0a15d0a 100644 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ b/windows/application-management/app-v/appv-using-the-client-management-console.md @@ -1,6 +1,6 @@ --- title: Using the App-V Client Management Console (Windows 10) -description: Using the App-V Client Management Console +description: Learn how to use the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- @@ -22,7 +22,7 @@ This topic provides information about using the Application Virtualization (App- ## Obtain the client management console -The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=41186). +The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=41186). > [!NOTE] > To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V client. diff --git a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md index 2d1bb8bb98..e949a9406e 100644 --- a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md index 771291c90e..acbd96ca6e 100644 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md @@ -1,6 +1,6 @@ --- title: Viewing App-V Server Publishing Metadata (Windows 10) -description: Viewing App-V Server Publishing Metadata +description: Use this procedure to view App-V Server publishing metadata, which can help you resolve publishing-related issues. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 5ce9e92dc8..31da1afc51 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -2,12 +2,12 @@ title: Windows 10 - Apps ms.reviewer: manager: dansimp -description: What are Windows, UWP, and Win32 apps +description: Use this article to understand the different types of apps that run on Windows 10, such as UWP and Win32 apps. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.localizationpriority: medium ms.topic: article @@ -31,64 +31,61 @@ The following tables list the system apps, installed Windows apps, and provision Some of the apps show up in multiple tables - that's because their status changed between versions. Make sure to check the version column for the version you are currently running. - ## Provisioned Windows apps -Here are the provisioned Windows apps in Windows 10 versions 1703, 1709, 1803 and 1809. +You can list all provisioned Windows apps with this PowerShell command: -> [!TIP] -> You can list all provisioned Windows apps with this PowerShell command: -> ``` -> Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName -> ``` +```Powershell +Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName +``` -
          - -| Package name | App name | 1703 | 1709 | 1803 | 1809 | Uninstall through UI? | -|----------------------------------------|--------------------------------------------------------------------------------------------------------------------|:----:|:----:|:----:|:----:|:---------------------:| -| Microsoft.3DBuilder | [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | x | | | | Yes | -| Microsoft.BingWeather | [MSN Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.DesktopAppInstaller | [App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | x | x | x | x | Via Settings App | -| Microsoft.GetHelp | [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.Getstarted | [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.HEIFImageExtension | [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | | | | x | No | -| Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Microsoft3DViewer | [Mixed Reality Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.MicrosoftOfficeHub | [My Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.MicrosoftSolitaireCollection | [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.MicrosoftStickyNotes | [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.MixedReality.Portal | [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | | | | x | No | -| Microsoft.MSPaint | [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Office.OneNote | [OneNote](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.OneConnect | [Paid Wi-Fi & Cellular](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.ScreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | | | x | No | -| Microsoft.SkypeApp | [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | x | x | x | x | No | -| Microsoft.StorePurchaseApp | [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.VP9VideoExtensions | | | | | x | No | -| Microsoft.Wallet | [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WebMediaExtensions | [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | | | x | x | No | -| Microsoft.WebpImageExtension | [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | | | | x | No | -| Microsoft.Windows.Photos | [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsAlarms | [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsCalculator | [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsCamera | [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | x | x | x | x | No | -| microsoft.windowscommunicationsapps | [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsFeedbackHub | [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsMaps | [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsSoundRecorder | [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsStore | [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Xbox.TCUI | [Xbox TCUI](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.XboxApp | [Xbox](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGameOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGamingOverlay | [Xbox Gaming Overlay](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | | | x | x | No | -| Microsoft.XboxIdentityProvider | [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxSpeechToTextOverlay | | x | x | x | x | No | -| Microsoft.YourPhone | [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | | | | x | No | -| Microsoft.ZuneMusic | [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.ZuneVideo | [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | x | x | x | x | No | +Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, 1909, and 2004. +| Package name | App name | 1803 | 1809 | 1903 | 1909 | 2004 | Uninstall through UI? | +|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------|:----:|:----:|:----:|:----:|:----:|:---------------------:| +| Microsoft.3DBuilder | [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | | | | | | Yes | +| Microsoft.BingWeather | [MSN Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.DesktopAppInstaller | [App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | x | x | x | x | x | Via Settings App | +| Microsoft.GetHelp | [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Getstarted | [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.HEIFImageExtension | [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Microsoft3DViewer | [Mixed Reality Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.MicrosoftOfficeHub | [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.MicrosoftSolitaireCollection | [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.MicrosoftStickyNotes | [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.MixedReality.Portal | [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.MSPaint | [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Office.OneNote | [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.OneConnect | [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Outlook.DesktopIntegrationServices | | | | | x | x | | +| Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.ScreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.SkypeApp | [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | x | x | x | x | x | No | +| Microsoft.StorePurchaseApp | [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.VP9VideoExtensions | | | x | x | x | x | No | +| Microsoft.Wallet | [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WebMediaExtensions | [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WebpImageExtension | [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.Windows.Photos | [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsAlarms | [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsCalculator | [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsCamera | [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | x | x | x | x | x | No | +| microsoft.windowscommunicationsapps | [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsFeedbackHub | [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsMaps | [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsSoundRecorder | [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsStore | [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Xbox.TCUI | [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxApp | [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxGameOverlay | [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxGamingOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxIdentityProvider | [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxSpeechToTextOverlay | | x | x | x | x | x | No | +| Microsoft.YourPhone | [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.ZuneMusic | [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.ZuneVideo | [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | x | x | x | x | x | No | >[!NOTE] >The Store app can't be removed. If you want to remove and reinstall the Store app, you can only bring Store back by either restoring your system from a backup or resetting your system. Instead of removing the Store app, you should use group policies to hide or disable it. @@ -97,13 +94,11 @@ Here are the provisioned Windows apps in Windows 10 versions 1703, 1709, 1803 an System apps are integral to the operating system. Here are the typical system apps in Windows 10 versions 1709, 1803, and 1809. -> [!TIP] -> You can list all system apps with this PowerShell command: -> ``` -> Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation -> ``` +You can list all system apps with this PowerShell command: -
          +```Powershell +Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation +``` | Name | Package Name | 1709 | 1803 | 1809 |Uninstall through UI? | |----------------------------------|---------------------------------------------|:-----:|:----:|:----:|-----------------------| @@ -149,7 +144,7 @@ System apps are integral to the operating system. Here are the typical system ap > [!NOTE] -> - The Contact Support app changed to Get Help in version 1709. Get Help is a provisioned app (instead of system app like Contact Support). +> The Contact Support app changed to Get Help in version 1709. Get Help is a provisioned app (instead of system app like Contact Support). ## Installed Windows apps diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md index 394767a6af..e7e6041a1d 100644 --- a/windows/application-management/change-history-for-application-management.md +++ b/windows/application-management/change-history-for-application-management.md @@ -1,14 +1,14 @@ --- title: Change history for Application management in Windows 10 (Windows 10) -description: This topic lists changes to documentation for configuring Windows 10. +description: View new release information and updated topics in the documentation for application management in Windows 10. keywords: ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: msfttracyp -ms.author: tracyp +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 10/24/2017 ms.reviewer: diff --git a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md b/windows/application-management/deploy-app-upgrades-windows-10-mobile.md index d2c0c0bc21..cab2bb9669 100644 --- a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md +++ b/windows/application-management/deploy-app-upgrades-windows-10-mobile.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 07/21/2017 ms.reviewer: @@ -16,7 +16,7 @@ ms.topic: article > Applies to: Windows 10 -When you have a new version of an application, how do you get that to the Windows 10 Mobile devices in your environment? With [application supersedence in System Center Configuration Manager](/sccm/apps/deploy-use/revise-and-supersede-applications#application-supersedence). +When you have a new version of an application, how do you get that to the Windows 10 Mobile devices in your environment? With [application supersedence in Microsoft Endpoint Configuration Manager](/configmgr/apps/deploy-use/revise-and-supersede-applications#application-supersedence). There are two steps to deploy an app upgrade: @@ -58,4 +58,4 @@ You don't need to delete the deployment associated with the older version of the ![Monitoring view in Configuration Manager for the old version of the app](media/app-upgrade-old-version.png) -If you haven't deployed an app through Configuration Manager before, check out [Deploy applications with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications). You can also see how to delete deployments (although you don't have to) and notify users about the upgraded app. +If you haven't deployed an app through Configuration Manager before, check out [Deploy applications with Microsoft Endoint Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications). You can also see how to delete deployments (although you don't have to) and notify users about the upgraded app. diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index ee08c91bcf..abbb5fac56 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -32,19 +32,19 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", "ms.author": "elizapo", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-app-management", "folder_relative_path_in_docset": "./" } - } + }, + "titleSuffix": "Windows Application Management" }, "fileMetadata": {}, "template": [], diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index dfb14cdb36..dc56d686c7 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -1,14 +1,13 @@ --- -author: msfttracyp +author: dansimp title: Remove background task resource restrictions description: Allow enterprise background tasks unrestricted access to computer resources. -ms.author: tracyp +ms.author: dansimp ms.date: 10/03/2017 ms.reviewer: manager: dansimp ms.topic: article ms.prod: w10 -ms.technology: uwp keywords: windows 10, uwp, enterprise, background task, resources --- diff --git a/windows/application-management/index.md b/windows/application-management/index.md index 31196fe532..f9a00fdc84 100644 --- a/windows/application-management/index.md +++ b/windows/application-management/index.md @@ -1,12 +1,12 @@ --- title: Windows 10 application management -description: Windows 10 application management +description: Learn about managing applications in Windows 10 and Windows 10 Mobile clients, including how to remove background task resource restrictions. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +manager: dansimp +author: dansimp ms.localizationpriority: high -ms.date: 09/26/2017 --- # Windows 10 application management diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index 56d7147923..4414bb6e96 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -1,19 +1,19 @@ --- title: Enable or block Windows Mixed Reality apps in the enterprise (Windows 10) +description: Learn how to enable Windows Mixed Reality apps in WSUS or block the Windows Mixed Reality portal in enterprises. ms.reviewer: manager: dansimp -description: Learn how to enable or block Windows Mixed Reality apps. keyboards: ["mr", "mr portal", "mixed reality portal", "mixed reality"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium -author: msfttracyp -ms.author: tracyp +author: dansimp +ms.author: dansimp ms.topic: article --- -# Enable or block Windows Mixed Reality apps in the enterprise +# Enable or block Windows Mixed Reality apps in enterprises **Applies to** @@ -33,19 +33,21 @@ Organizations that use Windows Server Update Services (WSUS) must take action to 2. Windows Mixed Reality Feature on Demand (FOD) is downloaded from Windows Update. If access to Windows Update is blocked, you must manually install the Windows Mixed Reality FOD. - a. Download the FOD .cab file for [Windows 10, version 1903](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](http://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). + 1. Download the FOD .cab file for [Windows 10, version 2004](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), [Windows 10, version 1903 and 1909](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). - >[!NOTE] - >You must download the FOD .cab file that matches your operating system version. + > [!NOTE] + > You must download the FOD .cab file that matches your operating system version. - b. Use `Add-Package` to add Windows Mixed Reality FOD to the image. + 1. Use `Dism` to add Windows Mixed Reality FOD to the image. - ``` - Add-Package - Dism /Online /add-package /packagepath:(path) - ``` + ```powershell + Dism /Online /Add-Package /PackagePath:(path) + ``` + + > [!NOTE] + > You must rename the FOD .CAB file to : **Microsoft-Windows-Holographic-Desktop-FOD-Package\~31bf3856ad364e35\~amd64\~\~.cab** - c. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. + 1. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. IT admins can also create [Side by side feature store (shared folder)](https://technet.microsoft.com/library/jj127275.aspx) to allow access to the Windows Mixed Reality FOD. diff --git a/windows/application-management/media/app-upgrade-cm-console.png b/windows/application-management/media/app-upgrade-cm-console.png index 8681e2fb39..2ce9cd411e 100644 Binary files a/windows/application-management/media/app-upgrade-cm-console.png and b/windows/application-management/media/app-upgrade-cm-console.png differ diff --git a/windows/application-management/msix-app-packaging-tool.md b/windows/application-management/msix-app-packaging-tool.md index 1d38d2f161..b1c60124ea 100644 --- a/windows/application-management/msix-app-packaging-tool.md +++ b/windows/application-management/msix-app-packaging-tool.md @@ -1,12 +1,12 @@ --- title: Repackage your existing win32 applications to the MSIX format. -description: Learn how to install and use the MSIX packaging tool. +description: Learn how to install and use the MSIX packaging tool to repackage your existing win32 applications to the MSIX format. keywords: ["MSIX", "application", "app", "win32", "packaging tool"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium -ms.author: tracyp +ms.author: dansimp ms.topic: article ms.date: 12/03/2018 ms.reviewer: @@ -30,11 +30,11 @@ You can either run your installer interactively (through the UI) or create a pac - Windows 10, version 1809 (or later) - Participation in the Windows Insider Program (if you're using an Insider build) -- A valid Microsoft account (MSA) alias to access the app from the Microsoft Store +- A valid Microsoft work or school account to access the app from the Microsoft Store - Admin privileges on your PC account ### Get the app from the Microsoft Store -1. Use the MSA login associated with your Windows Insider Program credentials in the [Microsoft Store](https://www.microsoft.com/store/r/9N5LW3JBCXKF). +1. Use the Microsoft work or school account login associated with your Windows Insider Program credentials in the [Microsoft Store](https://www.microsoft.com/store/r/9N5LW3JBCXKF). 2. Open the product description page. 3. Click the install icon to begin installation. diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 53121c3c18..4245e9fb23 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -1,11 +1,11 @@ --- -title: Per-user services in Windows 10 and Windows Server -description: Learn about per-user services introduced in Windows 10. +title: Per-user services in Windows 10 and Windows Server +description: Learn about per-user services, how to change the template service Startup Type, and manage per-user services through Group Policy and security templates. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 09/14/2017 ms.reviewer: @@ -92,7 +92,7 @@ Revision=1 If a per-user service can't be disabled using a the security template, you can disable it by using Group Policy preferences. -1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/en-us/download/details.aspx?id=45520) installed, click **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. +1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/download/details.aspx?id=45520) installed, click **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. 2. Create a new Group Policy Object (GPO) or use an existing GPO. diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index a828991d9d..27c49f97ae 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -4,7 +4,7 @@ description: How to keep provisioned apps that were removed from your machine fr ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 05/25/2018 ms.reviewer: diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index 3928061aa3..7305ea48e2 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -1,10 +1,10 @@ --- title: Sideload LOB apps in Windows 10 (Windows 10) -description: Sideload line-of-business apps in Windows 10. +description: Learn how to sideload line-of-business (LOB) apps in Windows 10. When you sideload an app, you deploy a signed app package to a device. ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D ms.reviewer: manager: dansimp -ms.author: tracyp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index 58e0e60b57..3bd1bf1897 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 07/20/2017 ms.reviewer: diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index d3c28bfc73..aac950751a 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -1,9 +1,11 @@ # [Manage clients in Windows 10](index.md) ## [Administrative Tools in Windows 10](administrative-tools-in-windows-10.md) +### [Use Quick Assist to help users](quick-assist.md) ## [Create mandatory user profiles](mandatory-user-profile.md) ## [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [New policies for Windows 10](new-policies-for-windows-10.md) +## [Windows 10 default media removal policy](change-default-removal-policy-external-storage-media.md) ## [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) ## [Manage the Settings app with Group Policy](manage-settings-app-with-group-policy.md) ## [What version of Windows am I running](windows-version-search.md) @@ -22,9 +24,15 @@ ##### [Troubleshoot port exhaustion](troubleshoot-tcpip-port-exhaust.md) ##### [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md) ### [Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md) +#### [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md) +#### [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md) +#### [Introduction to the page file](introduction-page-file.md) +#### [Configure system failure and recovery options in Windows](system-failure-recovery-options.md) #### [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md) #### [Advanced troubleshooting for Windows-based computer freeze](troubleshoot-windows-freeze.md) #### [Advanced troubleshooting for stop error or blue screen error](troubleshoot-stop-errors.md) #### [Advanced troubleshooting for stop error 7B or Inaccessible_Boot_Device](troubleshoot-inaccessible-boot-device.md) +#### [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) +#### [Stop error occurs when you update the in-box Broadcom network adapter driver](troubleshoot-stop-error-on-broadcom-driver-update.md) ## [Mobile device management for solution providers](mdm/index.md) ## [Change history for Client management](change-history-for-client-management.md) diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 84c3b8c3d2..189e952207 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -4,11 +4,11 @@ description: Administrative Tools is a folder in Control Panel that contains too ms.assetid: FDC63933-C94C-43CB-8373-629795926DC8 ms.reviewer: manager: dansimp -ms.author: tracyp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article @@ -29,7 +29,7 @@ The tools in the folder might vary depending on which edition of Windows you are ![Screenshot of folder of admin tools](images/admin-tools-folder.png) -These tools were included in previous versions of Windows and the associated documentation for each tool should help you use these tools in Windows 10. The following list links to documentation for each tool. +These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. @@ -43,6 +43,8 @@ These tools were included in previous versions of Windows and the associated doc - [ODBC Data Sources]( https://go.microsoft.com/fwlink/p/?LinkId=708494) - [Performance Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708495) - [Print Management](https://go.microsoft.com/fwlink/p/?LinkId=708496) +- [Recovery Drive](https://support.microsoft.com/help/4026852/windows-create-a-recovery-drive) +- [Registry Editor](https://docs.microsoft.com/windows/win32/sysinfo/registry) - [Resource Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708497) - [Services](https://go.microsoft.com/fwlink/p/?LinkId=708498) - [System Configuration](https://go.microsoft.com/fwlink/p/?LinkId=708499) @@ -60,7 +62,3 @@ These tools were included in previous versions of Windows and the associated doc - - - - diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index 878b065aa7..c27a78fa4c 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -2,12 +2,12 @@ title: Advanced Troubleshooting 802.1X Authentication ms.reviewer: manager: dansimp -description: Learn how 802.1X Authentication works +description: Troubleshoot authentication flow by learning how 802.1X Authentication works for wired and wireless clients. keywords: advanced troubleshooting, 802.1X authentication, troubleshooting, authentication, Wi-Fi ms.prod: w10 -ms.mktglfcycl: +ms.mktglfcycl: ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium ms.author: tracyp ms.topic: troubleshooting @@ -17,17 +17,17 @@ ms.topic: troubleshooting ## Overview -This is a general troubleshooting of 802.1X wireless and wired clients. With 802.1X and wireless troubleshooting, it's important to know how the flow of authentication works, and then figuring out where it's breaking. It involves a lot of third party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. Since we don't make access points or switches, it won't be an end-to-end Microsoft solution. +This article includes general troubleshooting for 802.1X wireless and wired clients. While troubleshooting 802.1X and wireless, it's important to know how the flow of authentication works, and then figure out where it's breaking. It involves a lot of third-party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. We don't make access points or switches, so it's not an end-to-end Microsoft solution. ## Scenarios -This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 - 10 for clients, and Windows Server 2008 R2 - 2012 R2 for NPS. +This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS. -## Known Issues +## Known issues None -## Data Collection +## Data collection See [Advanced troubleshooting 802.1X authentication data collection](data-collection-for-802-authentication.md). @@ -35,11 +35,11 @@ See [Advanced troubleshooting 802.1X authentication data collection](data-collec Viewing [NPS authentication status events](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735320(v%3dws.10)) in the Windows Security [event log](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc722404(v%3dws.11)) is one of the most useful troubleshooting methods to obtain information about failed authentications. -NPS event log entries contain information on the connection attempt, including the name of the connection request policy that matched the connection attempt and the network policy that accepted or rejected the connection attempt. If you are not seeing both success and failure events, see the section below on [NPS audit policy](#audit-policy). +NPS event log entries contain information about the connection attempt, including the name of the connection request policy that matched the connection attempt and the network policy that accepted or rejected the connection attempt. If you don't see both success and failure events, see the [NPS audit policy](#audit-policy) section later in this article. -Check Windows Security Event log on the NPS Server for NPS events corresponding to rejected ([event ID 6273](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735399(v%3dws.10))) or accepted ([event ID 6272](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735388(v%3dws.10))) connection attempts. +Check Windows Security Event log on the NPS Server for NPS events that correspond to rejected ([event ID 6273](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735399(v%3dws.10))) or accepted ([event ID 6272](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735388(v%3dws.10))) connection attempts. -In the event message, scroll to the very bottom, and check the [Reason Code](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text associated with it. +In the event message, scroll to the very bottom, and then check the [Reason Code](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text that's associated with it. ![example of an audit failure](images/auditfailure.png) *Example: event ID 6273 (Audit Failure)*

          @@ -47,35 +47,35 @@ In the event message, scroll to the very bottom, and check the [Reason Code](htt ![example of an audit success](images/auditsuccess.png) *Example: event ID 6272 (Audit Success)*
          -‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, Wired AutoConfig operational log is equivalent one. +‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one. -On the client side, navigate to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, navigate to **..\Wired-AutoConfig/Operational**. See the following example: +On the client side, go to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, go to **..\Wired-AutoConfig/Operational**. See the following example: ![event viewer screenshot showing wired-autoconfig and WLAN autoconfig](images/eventviewer.png) -Most 802.1X authentication issues are due to problems with the certificate that is used for client or server authentication (e.g. invalid certificate, expiration, chain verification failure, revocation check failure, etc.). +Most 802.1X authentication issues are because of problems with the certificate that's used for client or server authentication. Examples include invalid certificate, expiration, chain verification failure, and revocation check failure. -First, validate the type of EAP method being used: +First, validate the type of EAP method that's used: ![eap authentication type comparison](images/comparisontable.png) -If a certificate is used for its authentication method, check if the certificate is valid. For server (NPS) side, you can confirm what certificate is being used from the EAP property menu: +If a certificate is used for its authentication method, check whether the certificate is valid. For the server (NPS) side, you can confirm what certificate is being used from the EAP property menu. In **NPS snap-in**, go to **Policies** > **Network Policies**. Select and hold (or right-click) the policy, and then select **Properties**. In the pop-up window, go to the **Constraints** tab, and then select the **Authentication Methods** section. ![Constraints tab of the secure wireless connections properties](images/eappropertymenu.png) -The CAPI2 event log will be useful for troubleshooting certificate-related issues. -This log is not enabled by default. You can enable this log by expanding **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2**, right-clicking **Operational** and then clicking **Enable Log**. +The CAPI2 event log is useful for troubleshooting certificate-related issues. +By default, this log isn't enabled. To enable this log, expand **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2**, select and hold (or right-click) **Operational**, and then select **Enable Log**. ![screenshot of event viewer](images/capi.png) -The following article explains how to analyze CAPI2 event logs: +For information about how to analyze CAPI2 event logs, see [Troubleshooting PKI Problems on Windows Vista](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-vista/cc749296%28v=ws.10%29). -When troubleshooting complex 802.1X authentication issues, it is important to understand the 802.1X authentication process. The following figure is an example of wireless connection process with 802.1X authentication: +When troubleshooting complex 802.1X authentication issues, it's important to understand the 802.1X authentication process. Here's an example of wireless connection process with 802.1X authentication: -![authenticatior flow chart](images/authenticator_flow_chart.png) +![authenticator flow chart](images/authenticator_flow_chart.png) -If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both the client and the server (NPS) side, you can see a flow like the one below. Type **EAPOL** in the Display Filter in for a client side capture, and **EAP** for an NPS side capture. See the following examples: +If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both the client and the server (NPS) side, you can see a flow like the one below. Type **EAPOL** in the Display Filter for a client-side capture, and **EAP** for an NPS-side capture. See the following examples: ![client-side packet capture data](images/clientsidepacket_cap_data.png) *Client-side packet capture data*

          @@ -85,16 +85,16 @@ If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both ‎ > [!NOTE] -> If you have a wireless trace, you can also [view ETL files with network monitor](https://docs.microsoft.com/windows/desktop/ndf/using-network-monitor-to-view-etl-files) and apply the **ONEX_MicrosoftWindowsOneX** and **WLAN_MicrosoftWindowsWLANAutoConfig** Network Monitor filters. Follow the instructions under the **Help** menu in Network Monitor to load the reqired [parser](https://blogs.technet.microsoft.com/netmon/2010/06/04/parser-profiles-in-network-monitor-3-4/) if needed. See the example below. +> If you have a wireless trace, you can also [view ETL files with network monitor](https://docs.microsoft.com/windows/desktop/ndf/using-network-monitor-to-view-etl-files) and apply the **ONEX_MicrosoftWindowsOneX** and **WLAN_MicrosoftWindowsWLANAutoConfig** Network Monitor filters. If you need to load the required [parser](https://blogs.technet.microsoft.com/netmon/2010/06/04/parser-profiles-in-network-monitor-3-4/), see the instructions under the **Help** menu in Network Monitor. Here's an example: ![ETL parse](images/etl.png) ## Audit policy -NPS audit policy (event logging) for connection success and failure is enabled by default. If you find that one or both types of logging are disabled, use the following steps to troubleshoot. +By default, NPS audit policy (event logging) for connection success and failure is enabled. If you find that one or both types of logging are disabled, use the following steps to troubleshoot. View the current audit policy settings by running the following command on the NPS server: -``` +```console auditpol /get /subcategory:"Network Policy Server" ``` @@ -106,16 +106,14 @@ Logon/Logoff Network Policy Server Success and Failure -If it shows ‘No auditing’, you can run this command to enable it: - -``` +If it says, "No auditing," you can run this command to enable it: +```console auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable ``` -Even if audit policy appears to be fully enabled, it sometimes helps to disable and then re-enable this setting. You can also enable Network Policy Server logon/logoff auditing via Group Policy. The success/failure setting can be found under **Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff -> Audit Network Policy Server**. +Even if audit policy appears to be fully enabled, it sometimes helps to disable and then re-enable this setting. You can also enable Network Policy Server logon/logoff auditing by using Group Policy. To get to the success/failure setting, select **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Advanced Audit Policy Configuration** > **Audit Policies** > **Logon/Logoff** > **Audit Network Policy Server**. ## Additional references [Troubleshooting Windows Vista 802.11 Wireless Connections](https://technet.microsoft.com/library/cc766215%28v=ws.10%29.aspx)
          [Troubleshooting Windows Vista Secure 802.3 Wired Connections](https://technet.microsoft.com/library/cc749352%28v=ws.10%29.aspx) - diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index e83a4bf8bd..29e2d01d30 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -1,11 +1,11 @@ --- title: Advanced troubleshooting for Windows boot problems -description: Learn how to troubleshoot when Windows is unable to boot +description: Learn to troubleshoot when Windows can't boot. This article includes advanced troubleshooting techniques intended for use by support agents and IT professionals. ms.prod: w10 ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium -ms.author: tracyp +ms.author: dansimp ms.date: 11/16/2018 ms.reviewer: manager: dansimp @@ -14,8 +14,8 @@ ms.topic: troubleshooting # Advanced troubleshooting for Windows boot problems ->[!NOTE] ->This article is intended for use by support agents and IT professionals. If you're looking for more general information about recovery options, see [Recovery options in Windows 10](https://support.microsoft.com/help/12415). +> [!NOTE] +> This article is intended for use by support agents and IT professionals. If you're looking for more general information about recovery options, see [Recovery options in Windows 10](https://support.microsoft.com/help/12415). ## Summary @@ -58,14 +58,14 @@ Here is a summary of the boot sequence, what will be seen on the display, and ty Each phase has a different approach to troubleshooting. This article provides troubleshooting techniques for problems that occur during the first three phases. ->[!NOTE] ->If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle: +> [!NOTE] +> If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle: > ->`Bcdedit /set {default} recoveryenabled no` +> `Bcdedit /set {default} recoveryenabled no` > ->If the F8 options don't work, run the following command: +> If the F8 options don't work, run the following command: > ->`Bcdedit /set {default} bootmenupolicy legacy` +> `Bcdedit /set {default} bootmenupolicy legacy` ## BIOS phase @@ -98,11 +98,10 @@ The Startup Repair tool automatically fixes many common problems. The tool also To do this, follow these steps. ->[!NOTE] ->For additional methods to start WinRE, see [Entry points into WinRE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). +> [!NOTE] +> For additional methods to start WinRE, see [Windows Recovery Environment (Windows RE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). -1. Start the system to the installation media for the installed version of Windows. - **Note** For more information, see [Create installation media for Windows](https://support.microsoft.com/help/15088). +1. Start the system to the installation media for the installed version of Windows. For more information, see [Create installation media for Windows](https://support.microsoft.com/help/15088). 2. On the **Install Windows** screen, select **Next** > **Repair your computer**. @@ -132,8 +131,8 @@ To repair the boot sector, run the following command: BOOTREC /FIXBOOT ``` ->[!NOTE] ->Running **BOOTREC** together with **Fixmbr** overwrites only the master boot code. If the corruption in the MBR affects the partition table, running **Fixmbr** may not fix the problem. +> [!NOTE] +> Running **BOOTREC** together with **Fixmbr** overwrites only the master boot code. If the corruption in the MBR affects the partition table, running **Fixmbr** may not fix the problem. ### Method 3: Fix BCD errors @@ -152,20 +151,25 @@ If you receive BCD-related errors, follow these steps: ``` 4. You might receive one of the following outputs: - - - Scanning all disks for Windows installations. Please wait, since this may take a while...Successfully scanned Windows installations. Total identified Windows installations: 0 + ```dos + Scanning all disks for Windows installations. Please wait, since this may take a while ... + Successfully scanned Windows installations. Total identified Windows installations: 0 The operation completed successfully. + ``` - - Scanning all disks for Windows installations. Please wait, since this may take a while... Successfully scanned Windows installations. Total identified Windows installations: 1 + ```dos + Scanning all disks for Windows installations. Please wait, since this may take a while ... + Successfully scanned Windows installations. Total identified Windows installations: 1 D:\Windows Add installation to boot list? Yes/No/All: + ``` If the output shows **windows installation: 0**, run the following commands: ```dos bcdedit /export c:\bcdbackup -attrib c:\\boot\\bcd -h -r –s +attrib c:\\boot\\bcd -r –s -h ren c:\\boot\\bcd bcd.old @@ -174,39 +178,41 @@ bootrec /rebuildbcd After you run the command, you receive the following output: - Scanning all disks for Windows installations. Please wait, since this may take a while...Successfully scanned Windows installations. Total identified Windows installations: 1{D}:\Windows +```dos +Scanning all disks for Windows installations. Please wait, since this may take a while ... +Successfully scanned Windows installations. Total identified Windows installations: 1 +{D}:\Windows Add installation to boot list? Yes/No/All: Y +``` -5. Try again to start the system. +5. Try restarting the system. ### Method 4: Replace Bootmgr -If methods 1 and 2 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps: +If methods 1, 2 and 3 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps: 1. At a command prompt, change the directory to the System Reserved partition. 2. Run the **attrib** command to unhide the file: ```dos - attrib-s -h -r + attrib -r -s -h ``` 3. Run the same **attrib** command on the Windows (system drive): ```dos - attrib-s -h –r + attrib -r -s -h ``` 4. Rename the Bootmgr file as Bootmgr.old: ```dos - ren c:\\bootmgr bootmgr.old + ren c:\bootmgr bootmgr.old ``` -5. Start a text editor, such as Notepad. +5. Navigate to the system drive. -6. Navigate to the system drive. +6. Copy the Bootmgr file, and then paste it to the System Reserved partition. -7. Copy the Bootmgr file, and then paste it to the System Reserved partition. - -8. Restart the computer. +7. Restart the computer. ### Method 5: Restore System Hive @@ -214,6 +220,8 @@ If Windows cannot load the system registry hive into memory, you must restore th If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced. +> [!NOTE] +> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start). ## Kernel Phase @@ -222,8 +230,9 @@ If the system gets stuck during the kernel phase, you experience multiple sympto - A Stop error appears after the splash screen (Windows Logo screen). - Specific error code is displayed. - For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on. - (To troubleshoot the 0x0000007B error, see [Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)](https://internal.support.services.microsoft.com/help/4343769/troubleshooting-guide-for-windows-boot-problems#0x7bstoperror)) + For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on. + - [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) + - [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) - The screen is stuck at the "spinning wheel" (rolling dots) "system busy" icon. @@ -267,16 +276,16 @@ For detailed instructions, see [How to perform a clean boot in Windows](https:// If the computer starts in Disable Driver Signature mode, start the computer in Disable Driver Signature Enforcement mode, and then follow the steps that are documented in the following article to determine which drivers or files require driver signature enforcement: [Troubleshooting boot problem caused by missing driver signature (x64)](https://blogs.technet.microsoft.com/askcore/2012/04/15/troubleshooting-boot-issues-due-to-missing-driver-signature-x64/) ->[!NOTE] ->If the computer is a domain controller, try Directory Services Restore mode (DSRM). +> [!NOTE] +> If the computer is a domain controller, try Directory Services Restore mode (DSRM). > ->This method is an important step if you encounter Stop error "0xC00002E1" or "0xC00002E2" +> This method is an important step if you encounter Stop error "0xC00002E1" or "0xC00002E2" **Examples** ->[!WARNING] ->Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these +> [!WARNING] +> Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk. *Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)* @@ -301,17 +310,15 @@ To troubleshoot this Stop error, follow these steps to filter the drivers: For additional troubleshooting steps, see the following articles: -- [Troubleshooting a Stop 0x7B in Windows](https://blogs.technet.microsoft.com/askcore/2013/08/05/troubleshooting-a-stop-0x7b-in-windows/) - -- [Advanced troubleshooting for "Stop error code 0x0000007B (INACCESSIBLE_BOOT_DEVICE)" errors in Windows XP](https://internal.support.services.microsoft.com/help/324103). +- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) To fix problems that occur after you install Windows updates, check for pending updates by using these steps: -1. Open a Command Prompt winodw in WinRE. +1. Open a Command Prompt window in WinRE. 2. Run the command: ```dos - dism /image:C:\ /get-packages + DISM /image:C:\ /get-packages ``` 3. If there are any pending updates, uninstall them by running the following commands: @@ -319,7 +326,7 @@ To fix problems that occur after you install Windows updates, check for pending DISM /image:C:\ /remove-package /packagename: name of the package ``` ```dos - Dism /Image:C:\ /Cleanup-Image /RevertPendingActions + DISM /Image:C:\ /Cleanup-Image /RevertPendingActions ``` Try to start the computer. @@ -352,17 +359,15 @@ If the computer does not start, follow these steps: 12. Try to start the computer. -If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For details, see the following Knowledge Base article: +If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For details, see the following articles: -- [969028](https://support.microsoft.com/help/969028) How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2 +- [Generate a kernel or complete crash dump](https://docs.microsoft.com/windows/client-management/generate-kernel-or-complete-crash-dump) -For more information about page file problems in Windows 10 or Windows Server 2016, see the following Knowledge Base article: - -- [4133658](https://support.microsoft.com/help/4133658) Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows +For more information about page file problems in Windows 10 or Windows Server 2016, see the following: +- [Introduction to page files](https://docs.microsoft.com/windows/client-management/introduction-page-file) For more information about Stop errors, see the following Knowledge Base article: - -- [3106831](https://support.microsoft.com/help/3106831) Troubleshooting Stop error problems for IT Pros +- [Advanced troubleshooting for Stop error or blue screen error issue](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) If the dump file shows an error that is related to a driver (for example, windows\system32\drivers\stcvsm.sys is missing or corrupted), follow these guidelines: @@ -390,3 +395,6 @@ If the dump file shows an error that is related to a driver (for example, window 3. Navigate to C:\Windows\System32\Config\. 4. Rename the all five hives by appending ".old" to the name. 5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode. + +> [!NOTE] +> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start). diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index dbd429f2e5..ce50bd2b54 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -2,14 +2,14 @@ title: Advanced Troubleshooting Wireless Network Connectivity ms.reviewer: manager: dansimp -description: Learn how troubleshooting of establishing Wi-Fi connections +description: Learn how to troubleshoot Wi-Fi connections. Troubleshooting Wi-Fi connections requires understanding the basic flow of the Wi-Fi autoconnect state machine. keywords: troubleshooting, wireless network connectivity, wireless, Wi-Fi ms.prod: w10 -ms.mktglfcycl: +ms.mktglfcycl: ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium -ms.author: tracyp +ms.author: dansimp ms.topic: troubleshooting --- @@ -92,7 +92,7 @@ The following is a high-level view of the main wifi components in Windows. - Scanning for wireless networks in range - Managing connectivity of wireless networks The Media Specific Module (MSM) handles security aspects of connection being established. -The Native Wifi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc. +The Native WiFi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc. Third-party wireless miniport drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows. diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md new file mode 100644 index 0000000000..69fa51d4e4 --- /dev/null +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -0,0 +1,57 @@ +--- +title: Windows 10 default media removal policy +description: In Windows 10, version 1809, the default removal policy for external storage media changed from "Better performance" to "Quick removal." +ms.prod: w10 +author: Teresa-Motiv +ms.author: v-tea +ms.date: 11/25/2020 +ms.topic: article +ms.custom: +- CI 111493 +- CI 125140 +- CSSTroubleshooting +audience: ITPro +ms.localizationpriority: medium +manager: kaushika +--- + +# Change in default removal policy for external storage media in Windows 10, version 1809 + +Windows defines two main policies, **Quick removal** and **Better performance**, that control how the system interacts with external storage devices such as USB thumb drives or Thunderbolt-enabled external drives. Beginning in Windows 10 version 1809, the default policy is **Quick removal**. + +In earlier versions of Windows, the default policy was **Better performance**. + +You can change the policy setting for each external device, and the policy that you set remains in effect if you disconnect the device and then connect it again to the same computer port. + +## More information + +You can use the storage device policy setting to change the manner in which Windows manages storage devices to better meet your needs. The policy settings have the following effects: + +* **Quick removal**: This policy manages storage operations in a manner that keeps the device ready to remove at any time. You can remove the device without using the Safely Remove Hardware process. However, to do this, Windows cannot cache disk write operations. This may degrade system performance. +* **Better performance**: This policy manages storage operations in a manner that improves system performance. When this policy is in effect, Windows can cache write operations to the external device. However, you must use the Safely Remove Hardware process to remove the external drive. The Safely Remove Hardware process protects the integrity of data on the device by making sure that all cached operations finish. + > [!IMPORTANT] + > If you use the **Better performance** policy, you must use the Safely Remove Hardware process to remove the device. If you remove or disconnect the device without following the safe removal instructions, you risk losing data. + + > [!NOTE] + > If you select **Better performance**, we recommend that you also select **Enable write caching on the device**. + +To change the policy for an external storage device: + +1. Connect the device to the computer. +2. Right-click **Start**, then select **File Explorer**. +3. In File Explorer, identify the letter or label that is associated with the device (for example, **USB Drive (D:)**). +4. Right-click **Start**, then select **Disk Management**. +5. In the lower section of the Disk Management window, right-click the label of the device, and then select **Properties**. + + ![In Disk Management, right-click the device and click Properties.](./images/change-def-rem-policy-1.png) + +6. Select **Policies**. + + > [!NOTE] + > Some recent versions of Windows may use a different arrangement of tabs in the disk properties dialog box. + > + > If you do not see the **Policies** tab, select **Hardware**, select the removable drive from the **All disk drives** list, and then select **Properties**. The **Policies** tab should now be available. + +7. Select the policy that you want to use. + + ![Policy options for disk management](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index 771366616a..3c7c213761 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -1,15 +1,15 @@ --- title: Change history for Client management (Windows 10) -description: This topic lists changes to documentation for configuring Windows 10. +description: Learn about new and updated topics in the Client management documentation for Windows 10 and Windows 10 Mobile. keywords: ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: msfttracyp -ms.author: tracyp -ms.date: 12/06/2018 +author: dansimp +ms.author: dansimp +ms.date: 1/21/2020 ms.reviewer: manager: dansimp ms.topic: article @@ -19,6 +19,21 @@ ms.topic: article This topic lists new and updated topics in the [Client management](index.md) documentation for Windows 10 and Windows 10 Mobile. +## February 2020 + +New or changed topic | Description +--- | --- +[Blue screen occurs when you update the in-box Broadcom NIC driver](troubleshoot-stop-error-on-broadcom-driver-update.md) | New +[Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md) | Updated + +## December 2019 + +New or changed topic | Description +--- | --- +[Change in default removal policy for external storage media in Windows 10, version 1809](change-default-removal-policy-external-storage-media.md) | New +[Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md) | Updated +[Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) | New + ## December 2018 New or changed topic | Description diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index e1365a820c..13ee43e312 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -20,81 +20,82 @@ ms.topic: article **Applies to** -- Windows 10 +- Windows 10 -From its release, Windows 10 has supported remote connections to PCs that are joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/user-help/device-management-azuread-joined-devices-setup). +From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/user-help/device-management-azuread-joined-devices-setup). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). ![Remote Desktop Connection client](images/rdp.png) ->[!TIP] ->Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session.](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics) - ## Set up -- Both PCs (local and remote) must be running Windows 10, version 1607 (or later). Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. -- Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. -- On the PC that you want to connect to: - 1. Open system properties for the remote PC. - 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. +- Both PCs (local and remote) must be running Windows 10, version 1607 or later. Remote connections to an Azure AD-joined PC running earlier versions of Windows 10 are not supported. +- Your local PC (where you are connecting from) must be either Azure AD joined or Hybrid Azure AD joined if using Windows 10 version 1607 and above, or Azure AD registered if using Windows 10 version 2004 and above. Remote connections to an Azure AD joined PC from an unjoined device or a non-Windows 10 device are not supported. + +Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC you are using to connect to the remote PC. + +- On the PC you want to connect to: + + 1. Open system properties for the remote PC. + + 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. ![Allow remote connections to this computer](images/allow-rdp.png) - 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users to connect to the PC, you must allow remote connections for the local **Authenticated Users** group. Click **Select Users**. - >[!NOTE] - >You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once and then running the following PowerShell cmdlet: - > - >`net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"`, where *FirstnameLastname* is the name of the user profile in C:\Users\, which is created based on DisplayName attribute in Azure AD. - > - >In Windows 10, version 1709, the user does not have to sign in to the remote device first. - > - >In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices. + 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Click **Select Users -> Add** and enter the name of the user or group. - 4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC. + > [!NOTE] + > You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once, and then running the following PowerShell cmdlet: + > ```powershell + > net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user" + > ``` + > where *the-UPN-attribute-of-your-user* is the name of the user profile in C:\Users\, which is created based on the DisplayName attribute in Azure AD. + > + > This command only works for AADJ device users already added to any of the local groups (administrators). + > Otherwise this command throws the below error. For example: + > - for cloud only user: "There is no such global user or group : *name*" + > - for synced user: "There is no such global user or group : *name*"
          + + > [!NOTE] + > In Windows 10, version 1709, the user does not have to sign in to the remote device first. + > + > In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices. + + 4. Click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC. - >[!TIP] - >When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant. + > [!TIP] + > When you connect to the remote PC, enter your account name in this format: AzureAD\yourloginid@domain.com. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant. + + > [!Note] + > If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e). - ## Supported configurations - -In organizations that have integrated Active Directory and Azure AD, you can connect from a domain-joined PC to an Azure AD-joined PC using: + +In organizations using integrated Active Directory and Azure AD, you can connect from a Hybrid-joined PC to an Azure AD-joined PC by using any of the following: - Password - Smartcards -- Windows Hello for Business, if the domain is managed by System Center Configuration Manager +- Windows Hello for Business, if the domain is managed by Microsoft Endpoint Configuration Manager. -In organizations that have integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to an AD-joined PC when the Azure AD-joined PC is on the corporate network using: +In organizations using integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to an AD-joined PC when the Azure AD-joined PC is on the corporate network by using any of the following: - Password - Smartcards -- Windows Hello for Business, if the organization has a mobile device management (MDM) subscription. +- Windows Hello for Business, if the organization has a mobile device management (MDM) subscription. -In organizations that have integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC using: +In organizations using integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC by using any of the following: - Password - Smartcards -- Windows Hello for Business, with or without an MDM subscription. +- Windows Hello for Business, with or without an MDM subscription. - -In organizations using only Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC using: +In organizations using only Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC by using any of the following: - Password -- Windows Hello for Business, with or without an MDM subscription. - +- Windows Hello for Business, with or without an MDM subscription. +> [!NOTE] +> If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure Active Directory-joined PCs, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities). ## Related topics [How to use Remote Desktop](https://support.microsoft.com/instantanswers/ff521c86-2803-4bc0-a5da-7df445788eb9/how-to-use-remote-desktop) - - - - - - - - - - - - diff --git a/windows/client-management/data-collection-for-802-authentication.md b/windows/client-management/data-collection-for-802-authentication.md index e866b0d7c4..58f94bd27e 100644 --- a/windows/client-management/data-collection-for-802-authentication.md +++ b/windows/client-management/data-collection-for-802-authentication.md @@ -2,7 +2,7 @@ title: Data collection for troubleshooting 802.1X authentication ms.reviewer: manager: dansimp -description: Data needed for reviewing 802.1X Authentication issues +description: Use the steps in this article to collect data that can be used to troubleshoot 802.1X authentication issues. keywords: troubleshooting, data collection, data, 802.1X authentication, authentication, data ms.prod: w10 ms.mktglfcycl: diff --git a/windows/client-management/determine-appropriate-page-file-size.md b/windows/client-management/determine-appropriate-page-file-size.md new file mode 100644 index 0000000000..8daf0f4ce4 --- /dev/null +++ b/windows/client-management/determine-appropriate-page-file-size.md @@ -0,0 +1,129 @@ +--- +title: How to determine the appropriate page file size for 64-bit versions of Windows +description: Learn how to determine the appropriate page file size for 64-bit versions of Windows. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/28/2019 +ms.reviewer: dcscontentpm +manager: dansimp +--- + +# How to determine the appropriate page file size for 64-bit versions of Windows + +Page file sizing depends on the system crash dump setting requirements and the peak usage or expected peak usage of the system commit charge. Both considerations are unique to each system, even for systems that are identical. This means that page file sizing is also unique to each system and cannot be generalized. + +## Determine the appropriate page file size + +Use the following considerations for page file sizing for all versions of Windows and Windows Server. + +### Crash dump setting + +If you want a crash dump file to be created during a system crash, a page file or a dedicated dump file must exist and be large enough to back up the system crash dump setting. Otherwise, a system memory dump file is not created. + +For more information, see [Support for system crash dumps](introduction-page-file.md#support-for-system-crash-dumps) section. + +### Peak system commit charge + +The system commit charge cannot exceed the system commit limit. This limit is the sum of physical memory (RAM) and all page files combined. If no page files exist, the system commit limit is slightly less than the physical memory that is installed. Peak system-committed memory usage can vary greatly between systems. Therefore, physical memory and page file sizing also vary. + +### Quantity of infrequently accessed pages + +The purpose of a page file is to *back* (support) infrequently accessed modified pages so that they can be removed from physical memory. This provides more available space for more frequently accessed pages. The "\Memory\Modified Page List Bytes" performance counter measures, in part, the number of infrequently accessed modified pages that are destined for the hard disk. However, be aware that not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. Therefore, consider extending or adding a page file if all the following conditions are true: + +- More available physical memory (\Memory\Available MBytes) is required. + +- The modified page list contains a significant amount of memory. + +- The existing page files are fairly full (\Paging Files(*)\% Usage). + +## Support for system crash dumps + +A system crash (also known as a “bug check” or a "Stop error") occurs when the system cannot run correctly. The dump file that is produced from this event is called a system crash dump. A page file or dedicated dump file is used to write a crash dump file (Memory.dmp) to disk. Therefore, a page file or a dedicated dump file must be large enough to support the kind of crash dump selected. Otherwise, the system cannot create the crash dump file. + +>[!Note] +>During startup, system-managed page files are sized respective to the system crash dump settings. This assumes that enough free disk space exists. + +|System crash dump setting |Minimum page file size requirement| +|-----------|-------------------| +|Small memory dump (256 KB) |1 MB| +|Kernel memory dump |Depends on kernel virtual memory usage| +|Complete memory dump |1 x RAM plus 257 MB*| +|Automatic memory dump |Depends on kernel virtual memory usage. For details, see Automatic memory dump.| + +\* 1 MB of header data and device drivers can total 256 MB of secondary crash dump data. + +The **Automatic memory dump** setting is enabled by default. This is a setting instead of a kind of crash dump. This setting automatically selects the best page file size, depending on the frequency of system crashes. + +The Automatic memory dump feature initially selects a small paging file size. It would accommodate the kernel memory most of the time. If the system crashes again within four weeks, the Automatic memory dump feature sets the page file size as either the RAM size or 32 GB, whichever is smaller. + +Kernel memory crash dumps require enough page file space or dedicated dump file space to accommodate the kernel mode side of virtual memory usage. If the system crashes again within four weeks of the previous crash, a Complete memory dump is selected at restart. This requires a page file or dedicated dump file of at least the size of physical memory (RAM) plus 1 MB for header information plus 256 MB for potential driver data to support all the potential data that is dumped from memory. Again, the system-managed page file will be increased to back this kind of crash dump. If the system is configured to have a page file or a dedicated dump file of a specific size, make sure that the size is sufficient to back the crash dump setting that is listed in the table earlier in this section together with and the peak system commit charge. + +### Dedicated dump files + +Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators now have the option to create a dedicated dump file instead. + +A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file. + +## System-managed page files + +By default, page files are system-managed. This means that the page files increase and decrease based on many factors, such as the amount of physical memory installed, the process of accommodating the system commit charge, and the process of accommodating a system crash dump. + +For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. This all assumes that the logical disk that is hosting the page file is large enough to accommodate the growth. + +The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10. + +|Minimum page file size |Maximum page file size| +|---------------|------------------| +|Varies based on page file usage history, amount of RAM (RAM ÷ 8, max 32 GB) and crash dump settings. |3 × RAM or 4 GB, whichever is larger. This is then limited to the volume size ÷ 8. However, it can grow to within 1 GB of free space on the volume if required for crash dump settings.| + +## Performance counters + +Several performance counters are related to page files. This section describes the counters and what they measure. + +### \Memory\Page/sec and other hard page fault counters + +The following performance counters measure hard page faults (which include, but are not limited to, page file reads): + +- \Memory\Page/sec + +- \Memory\Page Reads/sec + +- \Memory\Page Inputs/sec + +The following performance counters measure page file writes: + +- \Memory\Page Writes/sec + +- \Memory\Page Output/sec + +Hard page faults are faults that must be resolved by retrieving the data from disk. Such data can include portions of DLLs, .exe files, memory-mapped files, and page files. These faults might or might not be related to a page file or to a low-memory condition. Hard page faults are a standard function of the operating system. They occur when the following items are read: + +- Parts of image files (.dll and .exe files) as they are used + +- Memory-mapped files + +- A page file + +High values for these counters (excessive paging) indicate disk access of generally 4 KB per page fault on x86 and x64 versions of Windows and Windows Server. This disk access might or might not be related to page file activity but may contribute to poor disk performance that can cause system-wide delays if the related disks are overwhelmed. + +Therefore, we recommend that you monitor the disk performance of the logical disks that host a page file in correlation with these counters. Be aware that a system that has a sustained 100 hard page faults per second experiences 400 KB per second disk transfers. Most 7,200 RPM disk drives can handle about 5 MB per second at an IO size of 16 KB or 800 KB per second at an IO size of 4 KB. No performance counter directly measures which logical disk the hard page faults are resolved for. + +### \Paging File(*)\% Usage + +The \Paging File(*)\% Usage performance counter measures the percentage of usage of each page file. 100 percent usage of a page file does not indicate a performance problem as long as the system commit limit is not reached by the system commit charge, and if a significant amount of memory is not waiting to be written to a page file. + +>[!Note] +>The size of the Modified Page List (\Memory\Modified Page List Bytes) is the total of modified data that is waiting to be written to disk. + +If the Modified Page List (a list of physical memory pages that are the least frequently accessed) contains lots of memory, and if the **% Usage** value of all page files is greater than 90, you can make more physical memory available for more frequently access pages by increasing or adding a page file. + +>[!Note] +>Not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. + +## Multiple page files and disk considerations + +If a system is configured to have more than one page files, the page file that responds first is the one that is used. This means that page files that are on faster disks are used more frequently. Also, whether you put a page file on a “fast” or “slow” disk is important only if the page file is frequently accessed and if the disk that is hosting the respective page file is overwhelmed. Be aware that actual page file usage depends greatly on the amount of modified memory that the system is managing. This means that files that already exist on disk (such as .txt, .doc, .dll, and .exe) are not written to a page file. Only modified data that does not already exist on disk (for example, unsaved text in Notepad) is memory that could potentially be backed by a page file. After the unsaved data is saved to disk as a file, it is backed by the disk and not by a page file. diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index bb9c73976e..c81879ba3f 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -32,9 +32,11 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", + "manager": "dansimp", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", @@ -43,7 +45,8 @@ "depot_name": "MSDN.win-client-management", "folder_relative_path_in_docset": "./" } - } + }, + "titleSuffix": "Windows Client Management" }, "fileMetadata": {}, "template": [], diff --git a/windows/client-management/generate-kernel-or-complete-crash-dump.md b/windows/client-management/generate-kernel-or-complete-crash-dump.md new file mode 100644 index 0000000000..835007dc33 --- /dev/null +++ b/windows/client-management/generate-kernel-or-complete-crash-dump.md @@ -0,0 +1,113 @@ +--- +title: Generate a kernel or complete crash dump +description: Learn how to generate a kernel or complete crash dump, and then use the output to troubleshoot several issues. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/28/2019 +ms.reviewer: +manager: willchen +--- + +# Generate a kernel or complete crash dump + +A system crash (also known as a “bug check” or a "Stop error") occurs when Windows can't run correctly. The dump file that is produced from this event is called a system crash dump. + +A manual kernel or complete memory dump file is useful when you troubleshoot several issues because the process captures a record of system memory at the time of a crash. + +## Set up page files + +See [Support for system crash dumps](determine-appropriate-page-file-size.md#support-for-system-crash-dumps) for the page file size requirement for system crash dump. + +## Enable memory dump setting + +You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure. + +To enable memory dump setting, follow these steps: + +1. In **Control Panel**, select **System and Security** > **System**. + +2. Select **Advanced system settings**, and then select the **Advanced** tab. + +3. In the **Startup and Recovery** area, select **Settings**. + +4. Make sure that **Kernel memory dump** or **Complete memory dump** is selected under **Writing Debugging Information**. + +5. Restart the computer. + +>[!Note] +>You can change the dump file path by edit the **Dump file** field. In other words, you can change the path from %SystemRoot%\Memory.dmp to point to a local drive that has enough disk space, such as E:\Memory.dmp. + +### Tips to generate memory dumps + +When the computer crashes and restarts, the contents of physical RAM are written to the paging file that is located on the partition on which the operating system is installed. + +Depending on the speed of the hard disk on which Windows is installed, dumping more than 2 gigabytes (GB) of memory may take a long time. Even in a best case scenario, if the dump file is configured to reside on another local hard drive, a significant amount of data will be read and written to the hard disks. This can cause a prolonged server outage. + +>[!Note] +>Use this method to generate complete memory dump files with caution. Ideally, you should do this only when you are explicitly requested to by the Microsoft Support engineer. Any kernel or complete memory dump file debugging should be the last resort after all standard troubleshooting methods have been completely exhausted. + +## Manually generate a memory dump file + +### Use the NotMyFault tool + +If you can log on while the problem is occurring, you can use the Microsoft Sysinternals NotMyFault tool. To do this, follow these steps: + +1. Download the [NotMyFault](https://download.sysinternals.com/files/NotMyFault.zip) tool. + +2. Select **Start**, and then select **Command Prompt**. +3. At the command line, run the following command: + + ```console + notMyfault.exe /crash + ``` + +>[!Note] +>This operation generates a memory dump file and a D1 Stop error. + +### Use NMI + +On some computers, you cannot use keyboard to generate a crash dump file. For example, Hewlett-Packard (HP) BladeSystem servers from the Hewlett-Packard Development Company are managed through a browser-based graphical user interface (GUI). A keyboard is not attached to the HP BladeSystem server. + +In these cases, you must generate a complete crash dump file or a kernel crash dump file by using the Non-Maskable Interrupt (NMI) switch that causes an NMI on the system processor. + +To do this, follow these steps: + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +1. In Registry Editor, locate the following registry subkey: + + **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl** + +2. Right-click **CrashControl**, point to **New**, and then click **DWORD Value**. + +3. Type NMICrashDump, and then press Enter. + +4. Right-click **NMICrashDump**, and then select **Modify**. + +5. In the **Value data** box, type **1**, and then select **OK**. + +6. Restart the computer. + +7. Hardware vendors, such as HP, IBM, and Dell, may provide an Automatic System Recovery (ASR) feature. You should disable this feature during troubleshooting. For example, if the HP and Compaq ASR feature is enabled in the BIOS, disable this feature while you troubleshoot to generate a complete Memory.dmp file. For the exact steps, contact your hardware vendor. + +8. Enable the NMI switch in the BIOS or by using the Integrated Lights Out (iLO) Web interface. + + >[!Note] + >For the exact steps, see the BIOS reference manual or contact your hardware vendor. + +9. Test this method on the server by using the NMI switch to generate a dump file. You will see a STOP 0x00000080 hardware malfunction. + +If you want to run NMI in Microsoft Azure using Serial Console, see [Use Serial Console for SysRq and NMI calls](https://docs.microsoft.com/azure/virtual-machines/linux/serial-console-nmi-sysrq). + +### Use the keyboard + +[Forcing a System Crash from the Keyboard](https://docs.microsoft.com/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard) + +### Use Debugger + +[Forcing a System Crash from the Debugger](https://docs.microsoft.com/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-debugger) diff --git a/windows/client-management/images/change-def-rem-policy-1.png b/windows/client-management/images/change-def-rem-policy-1.png new file mode 100644 index 0000000000..4d99854104 Binary files /dev/null and b/windows/client-management/images/change-def-rem-policy-1.png differ diff --git a/windows/client-management/images/change-def-rem-policy-2.png b/windows/client-management/images/change-def-rem-policy-2.png new file mode 100644 index 0000000000..d05d5dd16f Binary files /dev/null and b/windows/client-management/images/change-def-rem-policy-2.png differ diff --git a/windows/client-management/images/out-of-memory.png b/windows/client-management/images/out-of-memory.png new file mode 100644 index 0000000000..c377389128 Binary files /dev/null and b/windows/client-management/images/out-of-memory.png differ diff --git a/windows/client-management/images/quick-assist-flow.png b/windows/client-management/images/quick-assist-flow.png new file mode 100644 index 0000000000..5c1d83741f Binary files /dev/null and b/windows/client-management/images/quick-assist-flow.png differ diff --git a/windows/client-management/images/task-manager-commit.png b/windows/client-management/images/task-manager-commit.png new file mode 100644 index 0000000000..86d289eebe Binary files /dev/null and b/windows/client-management/images/task-manager-commit.png differ diff --git a/windows/client-management/images/task-manager.png b/windows/client-management/images/task-manager.png new file mode 100644 index 0000000000..c52163f46e Binary files /dev/null and b/windows/client-management/images/task-manager.png differ diff --git a/windows/client-management/images/windows-10-management-range-of-options.png b/windows/client-management/images/windows-10-management-range-of-options.png index e4de546709..c37b489954 100644 Binary files a/windows/client-management/images/windows-10-management-range-of-options.png and b/windows/client-management/images/windows-10-management-range-of-options.png differ diff --git a/windows/client-management/img-boot-sequence.md b/windows/client-management/img-boot-sequence.md index e0d86a8a23..b1077e5be6 100644 --- a/windows/client-management/img-boot-sequence.md +++ b/windows/client-management/img-boot-sequence.md @@ -1,6 +1,6 @@ --- -description: A full-sized view of the boot sequence flowchart. title: Boot sequence flowchart +description: View a full-sized view of the boot sequence flowchart. Use the link to return to the Advanced troubleshooting for Windows boot problems article. ms.date: 11/16/2018 ms.reviewer: manager: dansimp @@ -10,8 +10,8 @@ ms.topic: article ms.prod: w10 --- +# Boot sequence flowchart + Return to: [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
          - ![Full-sized boot sequence flowchart](images/boot-sequence.png) - diff --git a/windows/client-management/index.md b/windows/client-management/index.md index f47496e3b0..477c88252a 100644 --- a/windows/client-management/index.md +++ b/windows/client-management/index.md @@ -1,12 +1,12 @@ --- title: Client management (Windows 10) -description: Windows 10 client management +description: Learn about the administrative tools, tasks and best practices for managing Windows 10 and Windows 10 Mobile clients across your enterprise. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.date: 08/16/2017 +ms.author: dansimp --- # Client management @@ -23,6 +23,7 @@ Learn about the administrative tools, tasks and best practices for managing Wind |[Connect to remote Azure Active Directory-joined PCs](connect-to-remote-aadj-pc.md)| Instructions for connecting to a remote PC joined to Azure Active Directory (Azure AD)| |[Join Windows 10 Mobile to Azure AD](join-windows-10-mobile-to-azure-active-directory.md)| Describes the considerations and options for using Windows 10 Mobile with Azure AD in your organization.| |[New policies for Windows 10](new-policies-for-windows-10.md)| Listing of new group policy settings available in Windows 10| +|[Windows 10 default media removal policy](change-default-removal-policy-external-storage-media.md) |In Windows 10, version 1809, the default removal policy for external storage media changed from "Better performance" to "Quick removal." | |[Group policies for enterprise and education editions](group-policies-for-enterprise-and-education-editions.md)| Listing of all group policy settings that apply specifically to Windows 10 Enterprise and Education editions| | [Manage the Settings app with Group Policy](manage-settings-app-with-group-policy.md) | Starting in Windows 10, version 1703, you can now manage the pages that are shown in the Settings app by using Group Policy. | |[Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)| Instructions for resetting a Windows 10 Mobile device using either *factory* or *'wipe and persist'* reset options| diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md new file mode 100644 index 0000000000..b1964db01a --- /dev/null +++ b/windows/client-management/introduction-page-file.md @@ -0,0 +1,70 @@ +--- +title: Introduction to the page file +description: Learn about the page files in Windows. A page file is an optional, hidden system file on a hard disk. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.reviewer: dcscontentpm +manager: dansimp +--- + +# Introduction to page files + +A page file (also known as a "paging file") is an optional, hidden system file on a hard disk. + +## Functionality + +Page files have the following functionalities. + +### Physical extension of RAM + +Page files enable the system to remove infrequently accessed modified pages from physical memory to let the system use physical memory more efficiently for more frequently accessed pages. + +### Application requirements + +Some products or services require a page file for various reasons. For specific information, check the product documentation. + +For example, the following Windows servers requires page files: + +- Windows Server domain controllers (DCs) +- DFS Replication (DFS-R) servers +- Certificate servers +- ADAM/LDS servers + +This is because the algorithm of the database cache for Extensible Storage Engine (ESENT, or ESE in Microsoft Exchange Server) depends on the "\Memory\Transition Pages RePurposed/sec" performance monitor counter. A page file is required to make sure that the database cache can release memory if other services or applications request memory. + +For Windows Server 2012 Hyper-V and Windows Server 2012 R2 Hyper-V, the page file of the management OS (commonly called the host OS) should be left at the default of setting of "System Managed" . + +### Support for system crash dumps + +Page files can be used to "back" (or support) system crash dumps and extend how much system-committed memory (also known as “virtual memory”) a system can support. + +For more information about system crash dumps, see [system crash dump options](system-failure-recovery-options.md#under-write-debugging-information). + +## Page files in Windows with large physical memory + +When large physical memory is installed, a page file might not be required to support the system commit charge during peak usage. For example, 64-bit versions of Windows and Windows Server support more physical memory (RAM) than 32-bit versions support. The available physical memory alone might be large enough. + +However, the reason to configure the page file size has not changed. It has always been about supporting a system crash dump, if it is necessary, or extending the system commit limit, if it is necessary. For example, when a lot of physical memory is installed, a page file might not be required to back the system commit charge during peak usage. The available physical memory alone might be large enough to do this. However, a page file or a dedicated dump file might still be required to back a system crash dump. + +## System committed memory + +Page files extend how much "committed memory" (also known as "virtual memory") is used to store modified data. + +The system commit memory limit is the sum of physical memory and all page files combined. It represents the maximum system-committed memory (also known as the "system commit charge") that the system can support. + +![Task manager](images/task-manager.png) + +The system commit charge is the total committed or "promised" memory of all committed virtual memory in the system. If the system commit charge reaches the system commit limit, the system and processes might not get committed memory. This condition can cause freezing, crashing, and other malfunctions. Therefore, make sure that you set the system commit limit high enough to support the system commit charge during peak usage. + +![Out of memory](images/out-of-memory.png) + +![Task Manager](images/task-manager-commit.png) + +The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values. + +>[!Note] +>System-managed page files automatically grow up to three times the physical memory or 4 GB (whichever is larger) when the system commit charge reaches 90 percent of the system commit limit. This assumes that enough free disk space is available to accommodate the growth. diff --git a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md index 688b2e776c..0511eea424 100644 --- a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md @@ -31,7 +31,7 @@ When a device running Windows 10 Mobile is joined to Azure AD, the device can e - Single sign-on (SSO) in applications like Mail, Word, and OneDrive using resources backed by Azure AD. -- SSO in Microsoft Edge browser to Azure AD-connected web applications like Office 365 Portal, Visual Studio, and more than [2500 non-Microsoft apps](https://go.microsoft.com/fwlink/p/?LinkID=746211). +- SSO in Microsoft Edge browser to Azure AD-connected web applications like Microsoft 365 admin center, Visual Studio, and more than [2500 non-Microsoft apps](https://go.microsoft.com/fwlink/p/?LinkID=746211). - SSO to resources on-premises. @@ -177,7 +177,7 @@ The OneDrive application also uses SSO, showing you all your documents and enabl ![onedrive](images/aadjonedrive.jpg) -In addition to application SSO, Azure AD joined devices also get SSO for browser applications which trust Azure AD, such as web applications, Visual Studio, Office 365 portal, and OneDrive for Business. +In addition to application SSO, Azure AD joined devices also get SSO for browser applications which trust Azure AD, such as web applications, Visual Studio, Microsoft 365 admin center, and OneDrive for Business. ![browser apps](images/aadjbrowser.jpg) diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index fad72959e6..7d344924f1 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -42,7 +42,7 @@ You can use the same management tools to manage all device types running Windows ## Learn more -[How to bulk-enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://technet.microsoft.com/library/mt627898.aspx) +[How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627898.aspx) [Azure AD, Microsoft Intune and Windows 10 - Using the cloud to modernize enterprise mobility](https://blogs.technet.microsoft.com/enterprisemobility/2015/06/12/azure-ad-microsoft-intune-and-windows-10-using-the-cloud-to-modernize-enterprise-mobility/) diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index ef2bf77cba..2950a6c6d9 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -1,6 +1,6 @@ --- title: Manage the Settings app with Group Policy (Windows 10) -description: Find out how to manage the Settings app with Group Policy. +description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -12,20 +12,20 @@ ms.author: dansimp ms.topic: article --- +# Manage the Settings app with Group Policy + + **Applies to** - Windows 10, Windows Server 2016 - -# Manage the Settings app with Group Policy - -You can now manage the pages that are shown in the Settings app by using Group Policy. This lets you hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. -To make use of the Settings App group polices on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. +You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. +To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. >[!Note] >Each server that you want to manage access to the Settings App must be patched. -To centrally manage the new policies copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) if your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management. +If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra). This policy is available for both User and Computer depending on the version of the OS. Windows Server 2016 with KB 4457127 applied will have both User and Computer policy. Windows 10, version 1703, added Computer policy for the Settings app. Windows 10, version 1809, added User policy for the Settings app. @@ -39,7 +39,7 @@ Policy paths: ## Configuring the Group Policy -The Group Policy can be configured in one of two ways: specify a list of pages that are shown or specify a list of pages to hide. To do this, add either **ShowOnly:** or **Hide:** followed by a semicolon delimited list of URIs in **Settings Page Visiblity**. For a full list of URIs, see the URI scheme reference section in [Launch the Windows Settings app](https://docs.microsoft.com/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference). +The Group Policy can be configured in one of two ways: specify a list of pages that are shown or specify a list of pages to hide. To do this, add either **ShowOnly:** or **Hide:** followed by a semicolon-delimited list of URIs in **Settings Page Visibility**. For a full list of URIs, see the URI scheme reference section in [Launch the Windows Settings app](https://docs.microsoft.com/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference). >[!NOTE] > When you specify the URI in the Settings Page Visibility textbox, don't include **ms-settings:** in the string. diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 4a0423c1e7..f4a048f445 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -21,7 +21,7 @@ Use of personal devices for work, as well as employees working outside the offic Your organization might have considered bringing in Windows 10 devices and downgrading them to Windows 7 until everything is in place for a formal upgrade process. While this may appear to save costs due to standardization, greater savings can come from avoiding the downgrade and immediately taking advantage of the cost reductions Windows 10 can provide. Because Windows 10 devices can be managed using the same processes and technology as other previous Windows versions, it’s easy for versions to coexist. -Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as System Center Configuration Manager, Microsoft Intune, or other third-party products. This “managed diversity” enables you to empower your users to benefit from the productivity enhancements available on their new Windows 10 devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows 10 much faster. +Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as Microsoft Endpoint Configuration Manager, Microsoft Intune, or other third-party products. This “managed diversity” enables you to empower your users to benefit from the productivity enhancements available on their new Windows 10 devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows 10 much faster. This six-minute video demonstrates how users can bring in a new retail device and be up and working with their personalized settings and a managed experience in a few minutes, without being on the corporate network. It also demonstrates how IT can apply policies and configurations to ensure device compliance. @@ -46,18 +46,18 @@ Windows 10 offers a range of management options, as shown in the following diagr The path to modern IT -As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and System Center Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, Office 365, and the Microsoft Store for Business. +As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and Microsoft Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, Office 365, and the Microsoft Store for Business. ## Deployment and Provisioning With Windows 10, you can continue to use traditional OS deployment, but you can also “manage out of the box.” To transform new devices into fully-configured, fully-managed devices, you can: -- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services such as [Microsoft Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) or [Microsoft Intune](https://docs.microsoft.com/intune/understand-explore/introduction-to-microsoft-intune). +- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services such as [Microsoft Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) or [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/). - Create self-contained provisioning packages built with the [Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages). -- Use traditional imaging techniques such as deploying custom images using [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction). +- Use traditional imaging techniques such as deploying custom images using [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/core/understand/introduction). You have multiple options for [upgrading to Windows 10](https://technet.microsoft.com/itpro/windows/deploy/windows-10-deployment-scenarios). For existing devices running Windows 7 or Windows 8.1, you can use the robust in-place upgrade process for a fast, reliable move to Windows 10 while automatically preserving all the existing apps, data, and settings. This can mean significantly lower deployment costs, as well as improved productivity as end users can be immediately productive – everything is right where they left it. Of course, you can also use a traditional wipe-and-load approach if you prefer, using the same tools that you use today with Windows 7. @@ -69,7 +69,7 @@ You can envision user and device management as falling into these two categories - **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows 10, your employees can self-provision their devices: - - For corporate devices, they can set up corporate access with [Azure AD Join](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-overview/). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud.
          Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. + - For corporate devices, they can set up corporate access with [Azure AD Join](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-overview/). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud.
          Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-windows10-devices/) to add their work account to Windows, then access work resources on the device. @@ -86,7 +86,7 @@ You can envision user and device management as falling into these two categories - Windows Hello - Domain joined PCs and tablets can continue to be managed with the [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) client or Group Policy. + Domain joined PCs and tablets can continue to be managed with the [Configuration Manager](https://docs.microsoft.com/configmgr/core/understand/introduction) client or Group Policy. For more information about how Windows 10 and Azure AD optimize access to work resources across a mix of devices and scenarios, see [Using Windows 10 devices in your workplace](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-windows10-devices/). @@ -98,9 +98,9 @@ As you review the roles in your organization, you can use the following generali Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. With Windows 10, you can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer.  -**MDM**: [MDM](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using GP that requires on-premises domain-joined devices. This makes MDM the best choice for devices that are constantly on the go. +**MDM**: [MDM](https://www.microsoft.com/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using GP that requires on-premises domain-joined devices. This makes MDM the best choice for devices that are constantly on the go. -**Group Policy** and **System Center Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings. If so, Group Policy and System Center Configuration Manager continue to be excellent management choices: +**Group Policy** and **Microsoft Endpoint Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings. If so, Group Policy and Configuration Manager continue to be excellent management choices: - Group Policy is the best way to granularly configure domain joined Windows PCs and tablets connected to the corporate network using Windows-based tools. Microsoft continues to add Group Policy settings with each new version of Windows. @@ -128,13 +128,13 @@ There are a variety of steps you can take to begin the process of modernizing de **Optimize your existing investments**. On the road from traditional on-premises management to modern cloud-based management, take advantage of the flexible, hybrid architecture of Configuration Manager and Intune. Starting with Configuration Manager 1710, co-management enables you to concurrently manage Windows 10 devices by using both Configuration Manager and Intune. See these topics for details: -- [Co-management for Windows 10 devices](https://docs.microsoft.com/sccm/core/clients/manage/co-management-overview) -- [Prepare Windows 10 devices for co-management](https://docs.microsoft.com/sccm/core/clients/manage/co-management-prepare) -- [Switch Configuration Manager workloads to Intune](https://docs.microsoft.com/sccm/core/clients/manage/co-management-switch-workloads) -- [Co-management dashboard in System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/co-management-dashboard) +- [Co-management for Windows 10 devices](https://docs.microsoft.com/configmgr/core/clients/manage/co-management-overview) +- [Prepare Windows 10 devices for co-management](https://docs.microsoft.com/configmgr/core/clients/manage/co-management-prepare) +- [Switch Configuration Manager workloads to Intune](https://docs.microsoft.com/configmgr/core/clients/manage/co-management-switch-workloads) +- [Co-management dashboard in Configuration Manager](https://docs.microsoft.com/configmgr/core/clients/manage/co-management-dashboard) ## Related topics -- [What is Intune?](https://docs.microsoft.com/intune/introduction-intune) +- [What is Intune?](https://docs.microsoft.com//mem/intune/fundamentals/what-is-intune) - [Windows 10 Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) - [Windows 10 Configuration service Providers](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference) diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 9197370e84..211519bdec 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -15,22 +15,18 @@ ms.topic: article # Create mandatory user profiles - **Applies to** -- Windows 10 +- Windows 10 +A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. +Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. -A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. - -Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. - -When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. +When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. - ## Profile extension for each Windows version The name of the folder in which you store the mandatory profile must use the correct extension for the operating system it will be applied to. The following table lists the correct extension for each operating system version. @@ -38,129 +34,118 @@ The name of the folder in which you store the mandatory profile must use the cor | Client operating system version | Server operating system version | Profile extension | | --- | --- | --- | | Windows XP | Windows Server 2003
          Windows Server 2003 R2 | none | -| Windows Vista
          Windows 7 | Windows Server 2008
          Windows Server 2008 R2 | v2 | +| Windows Vista
          Windows 7 | Windows Server 2008
          Windows Server 2008 R2 | v2 | | Windows 8 | Windows Server 2012 | v3 | | Windows 8.1 | Windows Server 2012 R2 | v4 | | Windows 10, versions 1507 and 1511 | N/A | v5 | -| Windows 10, versions 1607, 1703, 1709, 1803, 1809 and 1903 | Windows Server 2016 and Windows Server 2019 | v6 | +| Windows 10, versions 1607, 1703, 1709, 1803, 1809, 1903 and 1909 | Windows Server 2016 and Windows Server 2019 | v6 | -For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). +For more information, see [Deploy Roaming User Profiles, Appendix B](https://docs.microsoft.com/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). -## How to create a mandatory user profile +## Mandatory user profile First, you create a default user profile with the customizations that you want, run Sysprep with CopyProfile set to **True** in the answer file, copy the customized default user profile to a network share, and then you rename the profile to make it mandatory. -**To create a default user profile** +### How to create a default user profile 1. Sign in to a computer running Windows 10 as a member of the local Administrator group. Do not use a domain account. > [!NOTE] > Use a lab or extra computer running a clean installation of Windows 10 to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. -2. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. +1. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. - >[!NOTE] - >Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). + > [!NOTE] + > Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). -3. [Create an answer file (Unattend.xml)](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) that sets the [CopyProfile](https://msdn.microsoft.com/library/windows/hardware/dn922656.aspx) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. +1. [Create an answer file (Unattend.xml)](https://docs.microsoft.com/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) that sets the [CopyProfile](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-copyprofile) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://docs.microsoft.com/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. -3. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows 10 Application see [Remove-AppxProvisionedPackage](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage?view=winserver2012-ps). For a list of uninstallable applications, see [Understand the different apps included in Windows 10](https://docs.microsoft.com/windows/application-management/apps-in-windows-10). +1. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows 10 Application see [Remove-AppxProvisionedPackage](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps). For a list of uninstallable applications, see [Understand the different apps included in Windows 10](https://docs.microsoft.com/windows/application-management/apps-in-windows-10). + > [!NOTE] + > It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. -~~~ - >[!NOTE] - >It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. -~~~ +1. At a command prompt, type the following command and press **ENTER**. -3. At a command prompt, type the following command and press **ENTER**. + ```dos + sysprep /oobe /reboot /generalize /unattend:unattend.xml + ``` - `sysprep /oobe /reboot /generalize /unattend:unattend.xml` - - (Sysprep.exe is located at: C:\Windows\System32\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) + (Sysprep.exe is located at: C:\\Windows\\System32\\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) > [!TIP] - > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\System32\Sysprep\Panther\setupact.log and look for an entry like the following: - > + > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\\System32\\Sysprep\\Panther\\setupact.log and look for an entry like the following: + > > ![Microsoft Bing Translator package](images/sysprep-error.png) - > - > Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) and [Remove-AppxPackage -AllUsers](https://docs.microsoft.com/powershell/module/appx/remove-appxpackage?view=win10-ps) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. + > + > Use the [Remove-AppxProvisionedPackage](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps) and [Remove-AppxPackage -AllUsers](https://docs.microsoft.com/powershell/module/appx/remove-appxpackage?view=win10-ps) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. -4. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. +1. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. -5. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. +1. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. -6. In **User Profiles**, click **Default Profile**, and then click **Copy To**. +1. In **User Profiles**, click **Default Profile**, and then click **Copy To**. ![Example of UI](images/copy-to.png) -7. In **Copy To**, under **Permitted to use**, click **Change**. +1. In **Copy To**, under **Permitted to use**, click **Change**. ![Example of UI](images/copy-to-change.png) -8. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. +1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. -9. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#extension) for the operating system version. For example, the folder name must end with “.v6” to identify it as a user profile folder for Windows 10, version 1607. +1. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#profile-extension-for-each-windows-version) for the operating system version. For example, the folder name must end with ".v6" to identify it as a user profile folder for Windows 10, version 1607. - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. + - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - ![Example of UI](images/copy-to-path.png) + ![Example of UI](images/copy-to-path.png) -10. Click **OK** to copy the default user profile. +1. Click **OK** to copy the default user profile. +### How to make the user profile mandatory -**To make the user profile mandatory** +1. In File Explorer, open the folder where you stored the copy of the profile. + > [!NOTE] + > If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. -3. In File Explorer, open the folder where you stored the copy of the profile. +1. Rename `Ntuser.dat` to `Ntuser.man`. - >[!NOTE] - >If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. - -4. Rename `Ntuser.dat` to `Ntuser.man`. - -## How to apply a mandatory user profile to users +## Apply a mandatory user profile to users In a domain, you modify properties for the user account to point to the mandatory profile in a shared folder residing on the server. -**To apply a mandatory user profile to users** +### How to apply a mandatory user profile to users 1. Open **Active Directory Users and Computers** (dsa.msc). -2. Navigate to the user account that you will assign the mandatory profile to. +1. Navigate to the user account that you will assign the mandatory profile to. -3. Right-click the user name and open **Properties**. +1. Right-click the user name and open **Properties**. -4. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\profile.v6, you would enter \\\\*server*\profile. +1. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\\profile.v6, you would enter \\\\*server*\\profile. -5. Click **OK**. +1. Click **OK**. It may take some time for this change to replicate to all domain controllers. - - ## Apply policies to improve sign-in time When a user is configured with a mandatory profile, Windows 10 starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the Group Policy settings shown in the following table. (The table shows which operating system versions each policy setting can apply to.) - | Group Policy setting | Windows 10 | Windows Server 2016 | Windows 8.1 | Windows Server 2012 | | --- | --- | --- | --- | --- | | Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | | Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | | Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | -> [!Note] +> [!NOTE] > The Group Policy settings above can be applied in Windows 10 Professional edition. - - - - ## Related topics - [Manage Windows 10 Start layout and taskbar options](/windows/configuration/windows-10-start-layout-options-and-policies) - [Lock down Windows 10 to specific apps](/windows/configuration/lock-down-windows-10-to-specific-apps) - [Windows Spotlight on the lock screen](/windows/configuration/windows-spotlight) - [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm) - diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index d77896805e..d5168b9828 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -1,5 +1,6 @@ # [Mobile device management](index.md) ## [What's new in MDM enrollment and management](new-in-windows-mdm-enrollment-management.md) +### [Change history for MDM documentation](change-history-for-mdm-documentation.md) ## [Mobile device enrollment](mobile-device-enrollment.md) ### [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md) #### [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md) @@ -159,18 +160,112 @@ #### [Personalization DDF file](personalization-ddf.md) ### [Policy CSP](policy-configuration-service-provider.md) #### [Policy DDF file](policy-ddf-file.md) -#### [ApplicationRestrictions XSD](applicationrestrictions-xsd.md) +#### [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +#### [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) +#### [Policies in Policy CSP supported by HoloLens 2](policy-csps-supported-by-hololens2.md) +#### [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +#### [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +#### [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +#### [Policies in Policy CSP supported by Windows 10 IoT Core](policy-csps-supported-by-iot-core.md) +#### [Policies in Policy CSP supported by Microsoft Surface Hub](policy-csps-supported-by-surface-hub.md) +#### [Policy CSPs that can be set using Exchange Active Sync (EAS)](policy-csps-that-can-be-set-using-eas.md) #### [AboveLock](policy-csp-abovelock.md) #### [Accounts](policy-csp-accounts.md) #### [ActiveXControls](policy-csp-activexcontrols.md) +#### [ADMX_ActiveXInstallService](policy-csp-admx-activexinstallservice.md) +#### [ADMX_AddRemovePrograms](policy-csp-admx-addremoveprograms.md) +#### [ADMX_AppCompat](policy-csp-admx-appcompat.md) +#### [ADMX_AppxPackageManager](policy-csp-admx-appxpackagemanager.md) +#### [ADMX_AppXRuntime](policy-csp-admx-appxruntime.md) +#### [ADMX_AttachmentManager](policy-csp-admx-attachmentmanager.md) +#### [ADMX_AuditSettings](policy-csp-admx-auditsettings.md) +#### [ADMX_Bits](policy-csp-admx-bits.md) +#### [ADMX_CipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md) +#### [ADMX_COM](policy-csp-admx-com.md) +#### [ADMX_ControlPanel](policy-csp-admx-controlpanel.md) +#### [ADMX_ControlPanelDisplay](policy-csp-admx-controlpaneldisplay.md) +#### [ADMX_Cpls](policy-csp-admx-cpls.md) +#### [ADMX_CredentialProviders](policy-csp-admx-credentialproviders.md) +#### [ADMX_CredSsp](policy-csp-admx-credssp.md) +#### [ADMX_CredUI](policy-csp-admx-credui.md) +#### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) +#### [ADMX_DataCollection](policy-csp-admx-datacollection.md) +#### [ADMX_Desktop](policy-csp-admx-desktop.md) +#### [ADMX_DeviceInstallation](policy-csp-admx-deviceinstallation.md) +#### [ADMX_DeviceSetup](policy-csp-admx-devicesetup.md) +#### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) +#### [ADMX_DnsClient](policy-csp-admx-dnsclient.md) +#### [ADMX_DWM](policy-csp-admx-dwm.md) +#### [ADMX_EAIME](policy-csp-admx-eaime.md) +#### [ADMX_EncryptFilesonMove](policy-csp-admx-encryptfilesonmove.md) +#### [ADMX_EnhancedStorage](policy-csp-admx-enhancedstorage.md) +#### [ADMX_ErrorReporting](policy-csp-admx-errorreporting.md) +#### [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) +#### [ADMX_EventLog](policy-csp-admx-eventlog.md) +#### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) +#### [ADMX_FileSys](policy-csp-admx-filesys.md) +#### [ADMX_FolderRedirection](policy-csp-admx-folderredirection.md) +#### [ADMX_Help](policy-csp-admx-help.md) +#### [ADMX_HelpAndSupport](policy-csp-admx-helpandsupport.md) +#### [ADMX_kdc](policy-csp-admx-kdc.md) +#### [ADMX_Kerberos](policy-csp-admx-kerberos.md) +#### [ADMX_LanmanServer](policy-csp-admx-lanmanserver.md) +#### [ADMX_LinkLayerTopologyDiscovery](policy-csp-admx-linklayertopologydiscovery.md) +#### [ADMX_MicrosoftDefenderAntivirus](policy-csp-admx-microsoftdefenderantivirus.md) +#### [ADMX_MMC](policy-csp-admx-mmc.md) +#### [ADMX_MMCSnapins](policy-csp-admx-mmcsnapins.md) +#### [ADMX_MSAPolicy](policy-csp-admx-msapolicy.md) +#### [ADMX_nca](policy-csp-admx-nca.md) +#### [ADMX_NCSI](policy-csp-admx-ncsi.md) +#### [ADMX_Netlogon](policy-csp-admx-netlogon.md) +#### [ADMX_NetworkConnections](policy-csp-admx-networkconnections.md) +#### [ADMX_OfflineFiles](policy-csp-admx-offlinefiles.md) +#### [ADMX_PeerToPeerCaching](policy-csp-admx-peertopeercaching.md) +#### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) +#### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) +#### [ADMX_Programs](policy-csp-admx-programs.md) +#### [ADMX_Reliability](policy-csp-admx-reliability.md) +#### [ADMX_Scripts](policy-csp-admx-scripts.md) +#### [ADMX_sdiageng](policy-csp-admx-sdiageng.md) +#### [ADMX_Securitycenter](policy-csp-admx-securitycenter.md) +#### [ADMX_Sensors](policy-csp-admx-sensors.md) +#### [ADMX_Servicing](policy-csp-admx-servicing.md) +#### [ADMX_SettingSync](policy-csp-admx-settingsync.md) +#### [ADMX_SharedFolders](policy-csp-admx-sharedfolders.md) +#### [ADMX_Sharing](policy-csp-admx-sharing.md) +#### [ADMX_ShellCommandPromptRegEditTools](policy-csp-admx-shellcommandpromptregedittools.md) +#### [ADMX_Smartcard](policy-csp-admx-smartcard.md) +#### [ADMX_Snmp](policy-csp-admx-snmp.md) +#### [ADMX_StartMenu](policy-csp-admx-startmenu.md) +#### [ADMX_SystemRestore](policy-csp-admx-systemrestore.md) +#### [ADMX_Taskbar](policy-csp-admx-taskbar.md) +#### [ADMX_tcpip](policy-csp-admx-tcpip.md) +#### [ADMX_Thumbnails](policy-csp-admx-thumbnails.md) +#### [ADMX_TPM](policy-csp-admx-tpm.md) +#### [ADMX_UserExperienceVirtualization](policy-csp-admx-userexperiencevirtualization.md) +#### [ADMX_UserProfiles](policy-csp-admx-userprofiles.md) +#### [ADMX_W32Time](policy-csp-admx-w32time.md) +#### [ADMX_WCM](policy-csp-admx-wcm.md) +#### [ADMX_WinCal](policy-csp-admx-wincal.md) +#### [ADMX_WindowsAnytimeUpgrade](policy-csp-admx-windowsanytimeupgrade.md) +#### [ADMX_WindowsConnectNow](policy-csp-admx-windowsconnectnow.md) +#### [ADMX_WindowsExplorer](policy-csp-admx-windowsexplorer.md) +#### [ADMX_WindowsMediaDRM](policy-csp-admx-windowsmediadrm.md) +#### [ADMX_WindowsMediaPlayer](policy-csp-admx-windowsmediaplayer.md) +#### [ADMX_WindowsStore](policy-csp-admx-windowsstore.md) +#### [ADMX_WinInit](policy-csp-admx-wininit.md) +#### [ADMX_WinLogon](policy-csp-admx-winlogon.md) +#### [ADMX_wlansvc](policy-csp-admx-wlansvc.md) +#### [ADMX_WPN](policy-csp-admx-wpn.md) #### [ApplicationDefaults](policy-csp-applicationdefaults.md) #### [ApplicationManagement](policy-csp-applicationmanagement.md) #### [AppRuntime](policy-csp-appruntime.md) #### [AppVirtualization](policy-csp-appvirtualization.md) #### [AttachmentManager](policy-csp-attachmentmanager.md) +#### [Audit](policy-csp-audit.md) #### [Authentication](policy-csp-authentication.md) #### [Autoplay](policy-csp-autoplay.md) -#### [Bitlocker](policy-csp-bitlocker.md) +#### [BitLocker](policy-csp-bitlocker.md) #### [BITS](policy-csp-bits.md) #### [Bluetooth](policy-csp-bluetooth.md) #### [Browser](policy-csp-browser.md) @@ -208,11 +303,14 @@ #### [LanmanWorkstation](policy-csp-lanmanworkstation.md) #### [Licensing](policy-csp-licensing.md) #### [LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md) +#### [LocalUsersAndGroups](policy-csp-localusersandgroups.md) #### [LockDown](policy-csp-lockdown.md) #### [Maps](policy-csp-maps.md) #### [Messaging](policy-csp-messaging.md) +#### [MixedReality](policy-csp-mixedreality.md) #### [MSSecurityGuide](policy-csp-mssecurityguide.md) #### [MSSLegacy](policy-csp-msslegacy.md) +#### [Multitasking](policy-csp-multitasking.md) #### [NetworkIsolation](policy-csp-networkisolation.md) #### [Notifications](policy-csp-notifications.md) #### [Power](policy-csp-power.md) @@ -228,7 +326,6 @@ #### [Security](policy-csp-security.md) #### [ServiceControlManager](policy-csp-servicecontrolmanager.md) #### [Settings](policy-csp-settings.md) -#### [SmartScreen](policy-csp-smartscreen.md) #### [Speech](policy-csp-speech.md) #### [Start](policy-csp-start.md) #### [Storage](policy-csp-storage.md) @@ -244,9 +341,11 @@ #### [Wifi](policy-csp-wifi.md) #### [WindowsConnectionManager](policy-csp-windowsconnectionmanager.md) #### [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md) +#### [WindowsDefenderSmartScreen](policy-csp-smartscreen.md) #### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md) #### [WindowsLogon](policy-csp-windowslogon.md) #### [WindowsPowerShell](policy-csp-windowspowershell.md) +#### [WindowsSandbox](policy-csp-windowssandbox.md) #### [WirelessDisplay](policy-csp-wirelessdisplay.md) ### [PolicyManager CSP](policymanager-csp.md) ### [Provisioning CSP](provisioning-csp.md) diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 7dd8c78df7..04edf1f24d 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -1,7 +1,7 @@ --- title: AccountManagement CSP -description: Used to configure settings in the Account Manager service -ms.author: lomayor +description: Learn about the AccountManagement CSP, which is used to configure settings in the Account Manager service. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -31,7 +31,7 @@ Root node for the AccountManagement configuration service provider. Interior node. **UserProfileManagement/EnableProfileManager** -Enable profile lifetime mangement for shared or communal device scenarios. Default value is false. +Enable profile lifetime management for shared or communal device scenarios. Default value is false. Supported operations are Add, Get,Replace, and Delete. Value type is bool. diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index 1007c05b28..35fd257acb 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -1,7 +1,7 @@ --- title: AccountManagement DDF file -description: Used to configure settings in the Account Manager service -ms.author: lomayor +description: View the OMA DM device description framework (DDF) for the AccountManagement configuration service provider. This file is used to configure settings. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index 810e5c83fa..455f749b5b 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -1,12 +1,12 @@ --- title: Accounts CSP -description: The Accounts configuration service provider (CSP) is used by the enterprise (1) to rename a device, (2) to create a new local Windows account and joint it to a local user group. -ms.author: lomayor +description: The Accounts configuration service provider (CSP) is used by the enterprise to rename devices, as well as create local Windows accounts & joint them to a group. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 04/17/2018 +ms.date: 03/27/2020 ms.reviewer: manager: dansimp --- @@ -39,6 +39,9 @@ Available naming macros: Supported operation is Add. +> [!Note] +> For desktop PCs on Windows 10, version 2004 or later, use the **Ext/Microsoft/DNSComputerName** node in [DevDetail CSP](devdetail-csp.md). + **Users** Interior node for the user account information. @@ -49,6 +52,7 @@ This node specifies the username for a new local user account. This setting can This node specifies the password for a new local user account. This setting can be managed remotely. Supported operation is Add. +GET operation is not supported. This setting will report as failed when deployed from the Endpoint Manager. **Users/_UserName_/LocalUserGroup** This optional node specifies the local user group that a local user account should be joined to. If the node is not set, the new local user account is joined just to the Standard Users group. Set the value to 2 for Administrators group. This setting can be managed remotely. diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md index 623ad0d420..c1b570d222 100644 --- a/windows/client-management/mdm/accounts-ddf-file.md +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -1,7 +1,7 @@ --- title: Accounts DDF file -description: XML file containing the device description framework -ms.author: lomayor +description: XML file containing the device description framework (DDF) for the Accounts configuration service provider. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index 9761cd0e66..37f6157570 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -1,10 +1,10 @@ --- title: ActiveSync CSP -description: ActiveSync CSP +description: Learn how the ActiveSync configuration service provider is used to set up and change settings for Exchange ActiveSync. ms.assetid: c65093ef-bd36-4f32-9dab-edb7bcfb3188 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 839dfccba1..1b1ae61c78 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -1,10 +1,10 @@ --- title: ActiveSync DDF file -description: ActiveSync DDF file +description: Learn about the OMA DM device description framework (DDF) for the ActiveSync configuration service provider. ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 174966d463..79b168c90e 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -4,7 +4,7 @@ description: Here's a step-by-step guide to adding an Azure Active Directory ten ms.assetid: 36D94BEC-A6D8-47D2-A547-EBD7B7D163FA ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -45,7 +45,7 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a ![login to office 365](images/azure-ad-add-tenant5.png) -7. In the Office 365 portal, select **Purchase Services** from the left nagivation. +7. In the Microsoft 365 admin center, select **Purchase Services** from the left nagivation. ![purchase service option in admin center menu](images/azure-ad-add-tenant6.png) @@ -67,7 +67,7 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. Here's a step-by-step guide to register your free Azure AD subscription using an Office 365 Premium Business subscription. -1. Sign in to the Office 365 portal at using your organization's account. +1. Sign in to the Microsoft 365 admin center at using your organization's account. ![register azuread](images/azure-ad-add-tenant10.png) diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index 1c55f8740e..e4d45bd4fd 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -4,7 +4,7 @@ description: The AllJoynManagement configuration service provider (CSP) allows a ms.assetid: 468E0EE5-EED3-48FF-91C0-89F9D159AA8C ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index 07ae810983..4ad36bbd99 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -1,10 +1,10 @@ --- title: AllJoynManagement DDF -description: AllJoynManagement DDF +description: Learn the OMA DM device description framework (DDF) for the AllJoynManagement configuration service provider. ms.assetid: 540C2E60-A041-4749-A027-BBAF0BB046E4 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index 265cdca9fe..69a0b61ca3 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -1,10 +1,10 @@ --- title: APPLICATION configuration service provider -description: APPLICATION configuration service provider +description: Learn how the APPLICATION configuration service provider is used to configure an application transport using Open Mobile Alliance (OMA) Client Provisioning. ms.assetid: 0705b5e9-a1e7-4d70-a73d-7f758ffd8099 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/applicationcontrol-csp-ddf.md b/windows/client-management/mdm/applicationcontrol-csp-ddf.md index 0cd8b04e7c..f6d3ef7a2f 100644 --- a/windows/client-management/mdm/applicationcontrol-csp-ddf.md +++ b/windows/client-management/mdm/applicationcontrol-csp-ddf.md @@ -1,6 +1,6 @@ --- -title: ApplicationControl CSP -description: ApplicationControl CSP +title: ApplicationControl CSP DDF +description: View the OMA DM device description framework (DDF) for the ApplicationControl configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 7dc2e66ea2..2c64c89cd9 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -1,27 +1,27 @@ --- title: ApplicationControl CSP -description: ApplicationControl CSP +description: The ApplicationControl CSP allows you to manage multiple Windows Defender Application Control (WDAC) policies from a MDM server. +keywords: security, malware ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: ManikaDhiman -ms.date: 05/21/2019 +ms.reviewer: jsuther1974 +ms.date: 09/10/2020 --- # ApplicationControl CSP -Windows Defender Application Control (WDAC) policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). This CSP provides expanded diagnostic capabilities and support for [multiple policies](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for rebootless policy deployment (introduced in Windows 10, version 1709). Unlike [AppLocker CSP](applocker-csp.md), ApplicationControl CSP correctly detects the presence of no-reboot option and consequently does not schedule a reboot. -Existing WDAC policies deployed using AppLocker CSP’s CodeIntegrity node can now be deployed using ApplicationControl CSP URI. Although WDAC policy deployment via AppLocker CSP will continue to be supported, all new feature work will be done in ApplicationControl CSP only. +Windows Defender Application Control (WDAC) policies can be managed from an MDM server or locally using PowerShell via the WMI Bridge through the ApplicationControl configuration service provider (CSP). The ApplicationControl CSP was added in Windows 10, version 1903. This CSP provides expanded diagnostic capabilities and support for [multiple policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for rebootless policy deployment (introduced in Windows 10, version 1709). Unlike the [AppLocker CSP](applocker-csp.md), the ApplicationControl CSP correctly detects the presence of no-reboot option and consequently does not schedule a reboot. +Existing WDAC policies deployed using the AppLocker CSP's CodeIntegrity node can now be deployed using the ApplicationControl CSP URI. Although WDAC policy deployment via the AppLocker CSP will continue to be supported, all new feature work will be done in the ApplicationControl CSP only. -ApplicationControl CSP was added in Windows 10, version 1903. - -The following diagram shows ApplicationControl CSP in tree format. +The following diagram shows the ApplicationControl CSP in tree format. ![tree diagram for applicationcontrol csp](images/provisioning-csp-applicationcontrol.png) **./Vendor/MSFT/ApplicationControl** -Defines the root node for ApplicationControl CSP. +Defines the root node for the ApplicationControl CSP. Scope is permanent. Supported operation is Get. @@ -31,7 +31,7 @@ An interior node that contains all the policies, each identified by their global Scope is permanent. Supported operation is Get. **ApplicationControl/Policies/_Policy GUID_** -ApplicationControl CSP enforces that the “ID” segment of a given policy URI is the same GUID as the policy ID in the policy blob. Each *Policy GUID* node contains a Policy node and a corresponding PolicyInfo node. +The ApplicationControl CSP enforces that the "ID" segment of a given policy URI is the same GUID as the policy ID in the policy blob. Each *Policy GUID* node contains a Policy node and a corresponding PolicyInfo node. Scope is dynamic. Supported operation is Get. @@ -40,7 +40,7 @@ This node is the policy binary itself, which is encoded as base64. Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. -Value type is b64. Supported value is any well-formed WDAC policy, i.e. the base64-encoded content output by the ConvertFrom-CIPolicy cmdlet. +Value type is b64. Supported value is a binary file, converted from the policy XML file by the ConvertFrom-CIPolicy cmdlet. Default value is empty. @@ -61,7 +61,8 @@ This node specifies whether a policy is actually loaded by the enforcement engin Scope is dynamic. Supported operation is Get. -Value type is bool. Supported values are as follows: +Value type is bool. Supported values are as follows: + - True — Indicates that the policy is actually loaded by the enforcement engine and is in effect on a system. - False — Indicates that the policy is not loaded by the enforcement engine and is not in effect on a system. This is the default. @@ -70,7 +71,8 @@ This node specifies whether a policy is deployed on the system and is present on Scope is dynamic. Supported operation is Get. -Value type is bool. Supported values are as follows: +Value type is bool. Supported values are as follows: + - True — Indicates that the policy is deployed on the system and is present on the physical machine. - False — Indicates that the policy is not deployed on the system and is not present on the physical machine. This is the default. @@ -79,7 +81,8 @@ This node specifies whether the policy is authorized to be loaded by the enforce Scope is dynamic. Supported operation is Get. -Value type is bool. Supported values are as follows: +Value type is bool. Supported values are as follows: + - True — Indicates that the policy is authorized to be loaded by the enforcement engine on the system. - False — Indicates that the policy is not authorized to be loaded by the enforcement engine on the system. This is the default. @@ -112,34 +115,43 @@ Scope is dynamic. Supported operation is Get. Value type is char. -## Usage guidance +## Microsoft Endpoint Manager (MEM) Intune Usage Guidance -To use ApplicationControl CSP, you must: -- Know a generated policy’s GUID, which can be found in the policy xml as ``. -- Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned. -- Create a policy node (a Base64-encoded blob of the binary policy representation) using the [certutil -encode](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_encode) command line tool. +For customers using Intune standalone or hybrid management with Configuration Manager (MEMCM) to deploy custom policies via the ApplicationControl CSP, refer to [Deploy Windows Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune) -Here is a sample certutil invocation: -``` -certutil -encode WinSiPolicy.p7b WinSiPolicy.cer +## Generic MDM Server Usage Guidance + +In order to leverage the ApplicationControl CSP without using Intune, you must: + +1. Know a generated policy's GUID, which can be found in the policy xml as `` or `` for pre-1903 systems. +2. Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned. +3. Create a policy node (a Base64-encoded blob of the binary policy representation) using the certutil -encode command line tool. + +Below is a sample certutil invocation: + +```cmd +certutil -encode WinSiPolicy.p7b WinSiPolicy.cer ``` + An alternative to using certutil would be to use the following PowerShell invocation: -``` -[Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path )) -``` -If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI -functionality to apply the Code Integrity policy. -### Deploy policies +```powershell +[Convert]::toBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path )) +``` + +### Deploy Policies + To deploy a new base policy using the CSP, perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** using the Base64-encoded policy node as {Data}. Refer to the the Format section in the Example 1 below. To deploy base policy and supplemental policies: -- Perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** using the Base64-encoded policy node as {Data} with the GUID and policy data for the base policy. -- Repeat for each base or supplemental policy (with its own GUID and data). + +1. Perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** using the Base64-encoded policy node as {Data} with the GUID and policy data for the base policy. +2. Repeat for each base or supplemental policy (with its own GUID and data). The following example shows the deployment of two base policies and a supplemental policy (which already specifies the base policy it supplements and does not need that reflected in the ADD). -**Example 1: Add first base policy** +#### Example 1: Add first base policy + ```xml 1 @@ -154,7 +166,9 @@ The following example shows the deployment of two base policies and a supplement ``` -**Example 2: Add second base policy** + +#### Example 2: Add second base policy + ```xml 1 @@ -169,7 +183,9 @@ The following example shows the deployment of two base policies and a supplement ``` -**Example 3: Add supplemental policy** + +#### Example 3: Add supplemental policy + ```xml 1 @@ -184,9 +200,10 @@ The following example shows the deployment of two base policies and a supplement ``` + ### Get policies -Perform a GET using a deployed policy’s GUID to interrogate/inspect the policy itself or information about it. +Perform a GET using a deployed policy's GUID to interrogate/inspect the policy itself or information about it. The following table displays the result of Get operation on different nodes: @@ -200,7 +217,8 @@ The following table displays the result of Get operation on different nodes: |./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/Status|Was the deployment successful| |./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/FriendlyName|Friendly name per the policy| -The following is an example of Get command: +The following is an example of Get command: + ```xml 1 @@ -213,17 +231,28 @@ The following is an example of Get command: ``` ### Delete policies + +#### Rebootless Deletion + +Upon deletion, policies deployed via the ApplicationControl CSP are removed from the system but stay in effect until the next reboot. In order to functionally do a rebootless delete, first replace the existing policy with an Allow All policy (found at C:\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml) and then delete the updated policy. This will immediately prevent anything from being blocked and fully deactive the policy on the next reboot. + +#### Unsigned Policies + To delete an unsigned policy, perform a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy**. -> [!Note] -> Only signed things should be able to update signed policies. Hence, performing a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** is not sufficient to delete a signed policy. - +#### Signed Policies + +> [!NOTE] +> A signed policy by default can only be replaced by another signed policy. Hence, performing a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** is not sufficient to delete a signed policy. + To delete a signed policy: + 1. Replace it with a signed update allowing unsigned policy. -2. Deploy another update with unsigned policy. +2. Deploy another update with unsigned Allow All policy. 3. Perform delete. - + The following is an example of Delete command: + ```xml 1 @@ -233,4 +262,34 @@ The following is an example of Delete command:
          -``` \ No newline at end of file +``` + +## PowerShell and WMI Bridge Usage Guidance + +The ApplicationControl CSP can also be managed locally from PowerShell or via Microsoft Endpoint Manager Configuration Manager's (MEMCM, formerly known as SCCM) task sequence scripting by leveraging the [WMI Bridge Provider](https://docs.microsoft.com/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). + +### Setup for using the WMI Bridge + +1. Convert your WDAC policy to Base64 +2. Open PowerShell in Local System context (through PSExec or something similar) +3. Use WMI Interface: + + ```powershell + $namespace = "root\cimv2\mdm\dmmap" + $policyClassName = "MDM_AppControl_Policies" + $policyBase64 = … + ``` + +### Deploying a policy via WMI Bridge + +Run the following command. PolicyID is a GUID which can be found in the policy xml, and should be used here without braces. + +```powershell + New-CimInstance -Namespace $namespace -ClassName $policyClassName -Property @{ParentID="./Vendor/MSFT/ApplicationControl/Policies";InstanceID="";Policy=$policyBase64} +``` + +### Querying all policies via WMI Bridge + +```powershell +Get-CimInstance -Namespace $namespace -ClassName $policyClassName +``` diff --git a/windows/client-management/mdm/applicationrestrictions-xsd.md b/windows/client-management/mdm/applicationrestrictions-xsd.md deleted file mode 100644 index fbdbc5c383..0000000000 --- a/windows/client-management/mdm/applicationrestrictions-xsd.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: ApplicationRestrictions XSD -description: Here's the XSD for the ApplicationManagement/ApplicationRestrictions policy. -ms.assetid: A5AA2B59-3736-473E-8F70-A90FD61EE426 -ms.reviewer: -manager: dansimp -ms.author: lomayor -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: lomayor -ms.date: 06/26/2017 ---- - -# ApplicationRestrictions XSD - - -Here's the XSD for the ApplicationManagement/ApplicationRestrictions policy. - -```xml - - - - - - - - - - - - - - - - - - - - - GUID must use lowercase letters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -  - -  - - - - - - diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 356fa67a5f..9904301173 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -1,15 +1,15 @@ --- title: AppLocker CSP -description: AppLocker CSP +description: Learn how the AppLocker configuration service provider is used to specify which applications are allowed or disallowed. ms.assetid: 32FEA2C9-3CAD-40C9-8E4F-E3C69637580F ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 07/25/2019 +ms.date: 11/19/2019 --- # AppLocker CSP @@ -17,35 +17,157 @@ ms.date: 07/25/2019 The AppLocker configuration service provider is used to specify which applications are allowed or disallowed. There is no user interface shown for apps that are blocked. -> **Note** -> When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need. -> -> In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps. -> -> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node. - - The following diagram shows the AppLocker configuration service provider in tree format. ![applocker csp](images/provisioning-csp-applocker.png) -**./Vendor/MSFT/AppLocker** +**./Vendor/MSFT/AppLocker** Defines the root node for the AppLocker configuration service provider. -**ApplicationLaunchRestrictions** +**AppLocker/ApplicationLaunchRestrictions** Defines restrictions for applications. > [!NOTE] > When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need. > > In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps. +> +> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node. + +> [!NOTE] +> The AppLocker CSP will schedule a reboot when a policy is applied or a deletion occurs using the AppLocker/ApplicationLaunchRestrictions/Grouping/CodeIntegrity/Policy URI. Additional information: - [Find publisher and product name of apps](#productname) - step-by-step guide for getting the publisher and product names for various Windows apps. -- [Whitelist example](#whitelist-examples) - example for Windows 10 Mobile that denies all apps except the ones listed. -**EnterpriseDataProtection** +**AppLocker/ApplicationLaunchRestrictions/_Grouping_** +Grouping nodes are dynamic nodes, and there may be any number of them for a given enrollment (or a given context). The actual identifiers are selected by the management endpoint, whose job it is to determine what their purpose is, and to not conflict with other identifiers that they define. +Different enrollments and contexts may use the same Authority identifier, even if many such identifiers are active at the same time. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE** +Defines restrictions for launching executable applications. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE/NonInteractiveProcessEnforcement** +The data type is a string. + +Supported operations are Add, Delete, Get, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/MSI** +Defines restrictions for executing Windows Installer files. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/MSI/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/MSI/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/Script** +Defines restrictions for running scripts. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/Script/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/Script/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/StoreApps** +Defines restrictions for running apps from the Microsoft Store. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/StoreApps/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/StoreApps/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL** +Defines restrictions for processing DLL files. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL/NonInteractiveProcessEnforcement** +The data type is a string. + +Supported operations are Add, Delete, Get, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/CodeIntegrity** +This node is only supported on the desktop. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/CodeIntegrity/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is Base64. + +Supported operations are Get, Add, Delete, and Replace. + +> [!NOTE] +> To use Code Integrity Policy, you first need to convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet. Then a Base64-encoded blob of the binary policy representation should be created (for example, using the [certutil -encode](https://go.microsoft.com/fwlink/p/?LinkId=724364) command line tool) and added to the Applocker-CSP. + +**AppLocker/EnterpriseDataProtection** Captures the list of apps that are allowed to handle enterprise data. Should be used in conjunction with the settings in **./Device/Vendor/MSFT/EnterpriseDataProtection** in [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md). In Windows 10, version 1607 the Windows Information Protection has a concept for allowed and exempt applications. Allowed applications can access enterprise data and the data handled by those applications are protected with encryption. Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems with encrypted data. @@ -66,115 +188,35 @@ Additional information: - [Recommended deny list for Windows Information Protection](#recommended-deny-list-for-windows-information-protection) - example for Windows 10, version 1607 that denies known unenlightened Microsoft apps from accessing enterprise data as an allowed app. This ensures an administrator does not accidentally make these apps Windows Information Protection allowed, and avoid known compatibility issues related to automatic file encryption with these applications. -Each of the previously listed nodes contains a **Grouping** node. +**AppLocker/EnterpriseDataProtection/_Grouping_** +Grouping nodes are dynamic nodes, and there may be any number of them for a given enrollment (or a given context). The actual identifiers are selected by the management endpoint, whose job it is to determine what their purpose is, and to not conflict with other identifiers that they define. +Different enrollments and contexts may use the same Authority identifier, even if many such identifiers are active at the same time. - ---- - - - - - - - - - - - - -
          TermDescription

          Grouping

          Grouping nodes are dynamic nodes, and there may be any number of them for a given enrollment (or a given context). The actual identifiers are selected by the management endpoint, whose job it is to determine what their purpose is, and to not conflict with other identifiers that they define.

          -

          Different enrollments and contexts may use the same Authority identifier, even if many such identifiers are active at the same time.

          -

          Supported operations are Get, Add, Delete, and Replace.

          +Supported operations are Get, Add, Delete, and Replace. +**AppLocker/EnterpriseDataProtection/_Grouping_/EXE** +Defines restrictions for launching executable applications. +Supported operations are Get, Add, Delete, and Replace. -In addition, each **Grouping** node contains one or more of the following nodes: +**AppLocker/EnterpriseDataProtection/_Grouping_/EXE/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          TermDescription

          EXE

          Defines restrictions for launching executable applications.

          -

          Supported operations are Get, Add, Delete, and Replace.

          MSI

          Defines restrictions for executing Windows Installer files.

          -

          Supported operations are Get, Add, Delete, and Replace.

          Script

          Defines restrictions for running scripts.

          -

          Supported operations are Get, Add, Delete, and Replace.

          StoreApps

          Defines restrictions for running apps from the Microsoft Store.

          -

          Supported operations are Get, Add, Delete, and Replace.

          DLL

          Defines restrictions for processing DLL files.

          -

          Supported operations are Get, Add, Delete, and Replace.

          CodeIntegrity

          This node is only supported on the desktop. Supported operations are Get, Add, Delete, and Replace.

          +Data type is string. +Supported operations are Get, Add, Delete, and Replace. +**AppLocker/EnterpriseDataProtection/_Grouping_/StoreApps** +Defines restrictions for running apps from the Microsoft Store. -Each of the previous nodes contains one or more of the following leaf nodes: +Supported operations are Get, Add, Delete, and Replace. - ---- - - - - - - - - - - - - - - - - - - - - -
          TermDescription

          Policy

          Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy.

          -

          For nodes, other than CodeIntegrity, policy leaf data type is string. Supported operations are Get, Add, Delete, and Replace.

          -

          For CodeIntegrity/Policy, data type is Base64. Supported operations are Get, Add, Delete, and Replace.

          EnforcementMode

          The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection).

          -

          The data type is a string. Supported operations are Get, Add, Delete, and Replace.

          NonInteractiveProcessEnforcement

          The data type is a string.

          -

          Supported operations are Add, Delete, Get, and Replace.

          +**AppLocker/EnterpriseDataProtection/_Grouping_/StoreApps/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. -> [!NOTE] -> To use Code Integrity Policy, you first need to convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet. Then a Base64-encoded blob of the binary policy representation should be created (for example, using the [certutil -encode](https://go.microsoft.com/fwlink/p/?LinkId=724364) command line tool) and added to the Applocker-CSP. +Data type is string. +Supported operations are Get, Add, Delete, and Replace. ## Find publisher and product name of apps @@ -244,7 +286,6 @@ The following table show the mapping of information to the AppLocker publisher r - Here is an example AppLocker publisher rule: ``` syntax @@ -324,7 +365,7 @@ Result

          windowsPhoneLegacyId

          Same value maps to the ProductName and Publisher name

          This value will only be present if there is a XAP package associated with the app in the Store.

          -

          If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and anothe one using the windowsPhoneLegacyId value.

          +

          If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and another one using the windowsPhoneLegacyId value.

          @@ -363,7 +404,8 @@ The product name is first part of the PackageFullName followed by the version nu The following list shows the apps that may be included in the inbox. -> **Note** This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience. +> [!NOTE] +> This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience. @@ -442,7 +484,7 @@ The following list shows the apps that may be included in the inbox. -Colour profile +Color profile b08997ca-60ab-4dce-b088-f92e9c7994f3 @@ -672,12 +714,12 @@ The following list shows the apps that may be included in the inbox. Microsoft.MSPodcast -Posdcast downloads +Podcast downloads 063773e7-f26f-4a92-81f0-aa71a1161e30 -Powerpoint +PowerPoint b50483c4-8046-4e1b-81ba-590b24935798 Microsoft.Office.PowerPoint @@ -826,7 +868,7 @@ The following list shows the apps that may be included in the inbox. -## Whitelist examples +## Allow list examples The following example disables the calendar application. @@ -1713,7 +1755,7 @@ In this example, Contoso is the node name. We recommend using a GUID for this no - + diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index 0a2f4eefd2..4ea2ef6556 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -1,10 +1,10 @@ --- title: AppLocker DDF file -description: AppLocker DDF file +description: Learn about the OMA DM device description framework (DDF) for the AppLocker DDF file configuration service provider. ms.assetid: 79E199E0-5454-413A-A57A-B536BDA22496 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/applocker-xsd.md b/windows/client-management/mdm/applocker-xsd.md index d8895fa244..3e03f501a8 100644 --- a/windows/client-management/mdm/applocker-xsd.md +++ b/windows/client-management/mdm/applocker-xsd.md @@ -1,10 +1,10 @@ --- title: AppLocker XSD -description: Here's the XSD for the AppLocker CSP. +description: View the XSD for the AppLocker CSP. The AppLocker CSP XSD provides an example of how the schema is organized. ms.assetid: 70CF48DD-AD7D-4BCF-854F-A41BFD95F876 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/appv-deploy-and-config.md b/windows/client-management/mdm/appv-deploy-and-config.md index 80079aaef9..0e1870a49d 100644 --- a/windows/client-management/mdm/appv-deploy-and-config.md +++ b/windows/client-management/mdm/appv-deploy-and-config.md @@ -1,7 +1,7 @@ --- title: Deploy and configure App-V apps using MDM -description: Deploy and configure App-V apps using MDM -ms.author: lomayor +description: Configure, deploy, and manage Microsoft Application Virtualization (App-V) apps using Microsoft Endpoint Configuration Manager or App-V server. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -15,7 +15,7 @@ manager: dansimp ## Executive summary -

          Microsoft Application Virtualization (App-V) apps have typically been configured, deployed, and managed through on-premises group policies using System Center Configuration Manager (SCCM) or App-V server. In Windows 10, version 1703, App-V apps can be configured, deployed, and managed using mobile device management (MDM), matching their on-premises counterparts.

          +

          Microsoft Application Virtualization (App-V) apps have typically been configured, deployed, and managed through on-premises group policies using Microsoft Endpoint Configuration Manager or App-V server. In Windows 10, version 1703, App-V apps can be configured, deployed, and managed using mobile device management (MDM), matching their on-premises counterparts.

          MDM services can be used to publish App-V packages to clients running Windows 10, version 1703 (or later). All capabilities such as App-V enablement, configuration, and publishing can be completed using the EnterpriseAppVManagement CSP.

          diff --git a/windows/client-management/mdm/assign-seats.md b/windows/client-management/mdm/assign-seats.md index a69a0c6478..7fe33916b6 100644 --- a/windows/client-management/mdm/assign-seats.md +++ b/windows/client-management/mdm/assign-seats.md @@ -4,7 +4,7 @@ description: The Assign seat operation assigns seat for a specified user in the ms.assetid: B42BF490-35C9-405C-B5D6-0D9F0E377552 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index d1e42bc7aa..3a48ac399e 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -4,7 +4,7 @@ description: The AssignedAccess configuration service provider (CSP) is used set ms.assetid: 421CC07D-6000-48D9-B6A3-C638AAF83984 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -14,8 +14,6 @@ ms.date: 09/18/2018 # AssignedAccess CSP -**Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.** - The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a kiosk on Windows 10 Pro, Enterprise, or Education.](https://go.microsoft.com/fwlink/p/?LinkID=722211) diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index c831222412..703958aa0e 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,10 +1,10 @@ --- title: AssignedAccess DDF -description: AssignedAccess DDF +description: Learn how the OMA DM device description framework (DDF) for the AssignedAccess configuration service provider. ms.assetid: 224FADDB-0EFD-4E5A-AE20-1BD4ABE24306 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index 6fc893ba99..b511fd100f 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -4,12 +4,11 @@ description: Azure Active Directory is the world largest enterprise cloud identi ms.assetid: D03B0765-5B5F-4C7B-9E2B-18E747D504EE ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 09/05/2017 --- # Azure Active Directory integration with MDM @@ -31,13 +30,14 @@ For personal devices (BYOD): ### Azure AD Join -Company owned devices are traditionally joined to the on-premises Active Directory domain of the organization. These devices can be managed using Group Policy or computer management software such as System Center Configuration Manager. In Windows 10, it’s also possible to manage domain joined devices with an MDM. +Company owned devices are traditionally joined to the on-premises Active Directory domain of the organization. These devices can be managed using Group Policy or computer management software such as Microsoft Endpoint Configuration Manager. In Windows 10, it’s also possible to manage domain joined devices with an MDM. Windows 10 introduces a new way to configure and deploy corporate owned Windows devices. This mechanism is called Azure AD Join. Like traditional domain join, Azure AD Join allows devices to become known and managed by an organization. However, with Azure AD Join, Windows authenticates to Azure AD instead of authenticating to a domain controller. Azure AD Join also enables company owned devices to be automatically enrolled in, and managed by an MDM. Furthermore, Azure AD Join can be performed on a store-bought PC, in the out-of-box experience (OOBE), which helps organizations streamline their device deployment. An administrator can require that users belonging to one or more groups enroll their devices for management with an MDM. If a user is configured to require automatic enrollment during Azure AD Join, this enrollment becomes a mandatory step to configure Windows. If the MDM enrollment fails, then the device will not be joined to Azure AD. -> **Important**  Every user enabled for automatic MDM enrollment with Azure AD Join must be assigned a valid [Azure Active Directory Premium](https://msdn.microsoft.com/library/azure/dn499825.aspx) license. +> [!IMPORTANT] +> Every user enabled for automatic MDM enrollment with Azure AD Join must be assigned a valid [Azure Active Directory Premium](https://msdn.microsoft.com/library/azure/dn499825.aspx) license. ### BYOD scenario @@ -60,7 +60,8 @@ For Azure AD enrollment to work for an Active Directory Federated Services (AD F Once a user has an Azure AD account added to Windows 10 and enrolled in MDM, the enrollment can be manages through **Settings** > **Accounts** > **Work access**. Device management of either Azure AD Join for corporate scenarios or BYOD scenarios are similar. -> **Note**  Users cannot remove the device enrollment through the **Work access** user interface because management is tied to the Azure AD or work account. +> [!NOTE] +> Users cannot remove the device enrollment through the **Work access** user interface because management is tied to the Azure AD or work account. ### MDM endpoints involved in Azure AD integrated enrollment @@ -80,7 +81,7 @@ To support Azure AD enrollment, MDM vendors must host and expose a Terms of Use **Terms of Use endpoint** Use this endpoint to inform users of the ways in which their device can be controlled by their organization. The Terms of Use page is responsible for collecting user’s consent before the actual enrollment phase begins. -It’s important to understand that the Terms of Use flow is a "black box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL, and the user is expected to be redirected back after approving (or in some cases rejecting) the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios (e.g., different levels of control are applied on BYOD vs. company-owned devices) or implement user/group based targeting (e.g. users in certain geographies may be subject to stricter device management policies). +It’s important to understand that the Terms of Use flow is an "opaque box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL, and the user is expected to be redirected back after approving (or in some cases rejecting) the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios (e.g., different levels of control are applied on BYOD vs. company-owned devices) or implement user/group based targeting (e.g., users in certain geographies may be subject to stricter device management policies). The Terms of Use endpoint can be used to implement additional business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which could lead to a highly degraded user experience. It’s not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Azure AD. @@ -103,7 +104,8 @@ A cloud-based MDM is a SaaS application that provides device management capabili The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. Here a code sample from GitHub that explains how to add multi-tenant applications to Azure AD, [WepApp-WebAPI-MultiTenant-OpenIdConnect-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613661). -> **Note**  For the MDM provider, if you don't have an existing Azure AD tentant with an Azure AD subscription that you manage, follow the step-by-step guide in [Add an Azure AD tenant and Azure AD subscription](add-an-azure-ad-tenant-and-azure-ad-subscription.md) to set up a tenant, add a subscription, and manage it via the Azure Portal. +> [!NOTE] +> For the MDM provider, if you don't have an existing Azure AD tentant with an Azure AD subscription that you manage, follow the step-by-step guide in [Add an Azure AD tenant and Azure AD subscription](add-an-azure-ad-tenant-and-azure-ad-subscription.md) to set up a tenant, add a subscription, and manage it via the Azure Portal. The keys used by the MDM application to request access tokens from Azure AD are managed within the tenant of the MDM vendor and not visible to individual customers. The same key is used by the multi-tenant MDM application to authenticate itself with Azure AD, regardless of the customer tenent to which the device being managed belongs. @@ -136,7 +138,7 @@ For more information about how to register a sample application with Azure AD, s An on-premises MDM application is inherently different that a cloud MDM. It is a single-tenant application that is present uniquely within the tenant of the customer. Therefore, customers must add the application directly within their own tenant. Additionally, each instance of an on-premises MDM application must be registered separately and has a separate key for authentication with Azure AD. -The customer experience for adding an on-premises MDM to their tenant is similar to that as the cloud-based MDM. There is an entry in the Azure AD app gallery to add an on-premises MDN to the tenant and administrators can configure the required URLs for enrollment and Terms of Use. +To add an on-premises MDM application to the tenant, there is an entry under the Azure AD service, specifically under **Mobility (MDM and MAM)** > **Add application**. Administrators can configure the required URLs for enrollment and Terms of Use. Your on-premises MDM product must expose a configuration experience where administrators can provide the client ID, app ID, and the key configured in their directory for that MDM application. You can use this client ID and key to request tokens from Azure AD when reporting device compliance. @@ -163,7 +165,10 @@ The following image illustrates how MDM applications will show up in the Azure a ### Add cloud-based MDM to the app gallery -You should work with the Azure AD engineering team if your MDM application is cloud-based. The following table shows the required information to create an entry in the Azure AD app gallery. +> [!NOTE] +> You should work with the Azure AD engineering team if your MDM application is cloud-based and needs to be enabled as a multi-tenant MDM application + +The following table shows the required information to create an entry in the Azure AD app gallery. @@ -236,7 +241,7 @@ An MDM page must adhere to a predefined theme depending on the scenario that is - + @@ -343,14 +348,14 @@ The following claims are expected in the access token passed by Windows to the T
          CXH-HOST (HTTP HEADER)SenarioScenario Background Theme WinJS Scenario CSS
          -> Note There is no device ID claim in the access token because the device may not yet be enrolled at this time. +> [!NOTE] +> There is no device ID claim in the access token because the device may not yet be enrolled at this time. - To retrieve the list of group memberships for the user, you can use the [Azure AD Graph API](https://go.microsoft.com/fwlink/p/?LinkID=613654). Here's an example URL. -``` syntax +```console https://fabrikam.contosomdm.com/TermsOfUse?redirect_uri=ms-appx-web://ContosoMdm/ToUResponse&client-request-id=34be581c-6ebd-49d6-a4e1-150eff4b7213&api-version=1.0 Authorization: Bearer eyJ0eXAiOi ``` @@ -390,7 +395,7 @@ If an error was encountered during the terms of use processing, the MDM can retu Here is the URL format: -``` syntax +```console HTTP/1.1 302 Location: ?error=access_denied&error_description=Access%20is%20denied%2E @@ -426,7 +431,7 @@ The following table shows the error codes.

          unsupported version

          -

          Tenant or user data are missingor other required prerequisites for device enrollment are not met

          +

          Tenant or user data are missing or other required prerequisites for device enrollment are not met

          302

          unauthorized_client

          unauthorized user or tenant

          @@ -601,7 +606,7 @@ In this scenario, the MDM enrollment applies to a single user who initially adde **Evaluating Azure AD user tokens** The Azure AD token is in the HTTP Authorization header in the following format: -``` syntax +```console Authorization:Bearer ``` @@ -621,7 +626,7 @@ Access token issued by Azure AD are JSON web tokens (JWTs). A valid JWT token is An alert is sent when the DM session starts and there is an Azure AD user logged in. The alert is sent in OMA DM pkg\#1. Here's an example: -``` syntax +```xml Alert Type: com.microsoft/MDM/AADUserToken Alert sample: @@ -636,7 +641,7 @@ Alert sample: UserToken inserted here - … other xml tags … + … other XML tags … ``` @@ -665,7 +670,7 @@ Here's an example. user - … other xml tags … + … other XML tags … ``` @@ -682,9 +687,10 @@ For a sample that illustrates how an MDM can obtain an access token using OAuth The following sample REST API call illustrates how an MDM can use the Azure AD Graph API to report compliance status of a device currently being managed by it. -> **Note**  This is only applicable for approved MDM apps on Windows 10 devices. +> [!NOTE] +> This is only applicable for approved MDM apps on Windows 10 devices. -``` syntax +```console Sample Graph API Request: PATCH https://graph.windows.net/contoso.com/devices/db7ab579-3759-4492-a03f-655ca7f52ae1?api-version=beta HTTP/1.1 @@ -713,7 +719,7 @@ Response: When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. -![aadj unenerollment](images/azure-ad-unenrollment.png) +![aadj unenrollment](images/azure-ad-unenrollment.png) ## Error codes @@ -921,4 +927,3 @@ When a user is enrolled into MDM through Azure Active Directory Join and then di - diff --git a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index 548ad13c84..61ff7e767b 100644 --- a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -1,24 +1,29 @@ --- title: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal -description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal -ms.author: lomayor +description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new portal +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 01/17/2018 +ms.date: 12/18/2020 ms.reviewer: manager: dansimp --- # Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal -Go to your Azure AD Blade, select the Mobility (MDM and MAM) and there should be the Microsoft Intune "App" Visible, select the Microsoft Intune and configure the Blade +> [!NOTE] +> Microsoft Intune portal can be accessed at the following link: [https://endpoint.microsoft.com](https://endpoint.microsoft.com). + +1. Go to your Azure AD Blade. +2. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. +3. Select **Microsoft Intune** and configure the blade. ![How to get to the Blade](images/azure-mdm-intune.png) -Configure the Blade +Configure the blade ![Configure the Blade](images/azure-intune-configure-scope.png) -Select all for allow all users to enroll a Device and make it Intune ready, or Some, then you can add a Group of Users. +You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 90c5a2b411..07f3aa7f0f 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1,20 +1,18 @@ --- title: BitLocker CSP -description: BitLocker CSP -ms.author: lomayor +description: Learn how the BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 05/02/2019 +ms.localizationpriority: medium +ms.date: 04/16/2020 ms.reviewer: manager: dansimp --- # BitLocker CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it is also supported in Windows 10 Pro. > [!NOTE] @@ -24,18 +22,21 @@ The BitLocker configuration service provider (CSP) is used by the enterprise to A Get operation on any of the settings, except for RequireDeviceEncryption and RequireStorageCardEncryption, returns the setting configured by the admin. -For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if TPM protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption does not verify that the a minimum PIN length is enforced (SystemDrivesMinimumPINLength). +For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if Trusted Platform Module (TPM) protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption does not verify that the a minimum PIN length is enforced (SystemDrivesMinimumPINLength). The following diagram shows the BitLocker configuration service provider in tree format. -![bitlocker csp](images/provisioning-csp-bitlocker.png) +![BitLocker csp](images/provisioning-csp-bitlocker.png) + **./Device/Vendor/MSFT/BitLocker** -

          Defines the root node for the BitLocker configuration service provider.

          - +Defines the root node for the BitLocker configuration service provider. + **RequireStorageCardEncryption** -

          Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.

          - + +Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU. + + @@ -56,15 +57,16 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecheck mark
          + -

          Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.

          - +Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on. + - 0 (default) – Storage cards do not need to be encrypted. -- 1 – Require Storage cards to be encrypted. +- 1 – Require storage cards to be encrypted. + +Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on. -

          Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

          - -

          If you want to disable this policy use the following SyncML:

          +If you want to disable this policy use the following SyncML: ```xml @@ -85,12 +87,14 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

          Data type is integer. Supported operations are Add, Get, Replace, and Delete.

          - +Data type is integer. Supported operations are Add, Get, Replace, and Delete. + + **RequireDeviceEncryption** - -

          Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption.

          - + +Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption. + + @@ -111,10 +115,27 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecheck mark
          + +Data type is integer. Sample value for this node to enable this policy: 1. +Supported operations are Add, Get, Replace, and Delete. -

          Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

          +Status of OS volumes and encryptable fixed data volumes are checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value [EncryptionMethodByDriveType](#encryptionmethodbydrivetype) policy is set to. However, this policy setting will be ignored for self-encrypting fixed drives and self-encrypting OS drives. -

          If you want to disable this policy use the following SyncML:

          +Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable: + +- It must not be a dynamic volume. +- It must not be a recovery partition. +- It must not be a hidden volume. +- It must not be a system partition. +- It must not be backed by virtual storage. +- It must not have a reference in the BCD store. + +The following list shows the supported values: + +- 0 (default) — Disable. If the policy setting is not set or is set to 0, the device's enforcement status is not checked. The policy does not enforce encryption and it does not decrypt encrypted volumes. +- 1 – Enable. The device's enforcement status is checked. Setting this policy to 1 triggers encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy). + +If you want to disable this policy, use the following SyncML: ```xml @@ -134,11 +155,13 @@ The following diagram shows the BitLocker configuration service provider in tree ``` - -

          Data type is integer. Supported operations are Add, Get, Replace, and Delete.

          - -**EncryptionMethodByDriveType** -

          Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".

          + + +**EncryptionMethodByDriveType** + +Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". + + @@ -159,44 +182,47 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name: Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)
          • GP name: EncryptionMethodWithXts_Name
          • GP path: Windows Components/Bitlocker Drive Encryption
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.

          +This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. -

          If you enable this setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511.

          +If you enable this setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511. -

          If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.

          +If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script. -

          Sample value for this node to enable this policy and set the encryption methods is:

          + Sample value for this node to enable this policy and set the encryption methods is: ```xml ``` -

          EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives

          -

          EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives.

          -

          EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives.

          - -

          The possible values for 'xx' are:

          +EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives +EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives. +EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives. + + The possible values for 'xx' are: - 3 = AES-CBC 128 - 4 = AES-CBC 256 - 6 = XTS-AES 128 - 7 = XTS-AES 256 - + > [!NOTE] > When you enable EncryptionMethodByDriveType, you must specify values for all three drives (operating system, fixed data, and removable data), otherwise it will fail (500 return status). For example, if you only set the encrytion method for the OS and removable drives, you will get a 500 return status. -

          If you want to disable this policy use the following SyncML:

          + If you want to disable this policy use the following SyncML: ```xml @@ -208,15 +234,19 @@ The following diagram shows the BitLocker configuration service provider in tree chr - <disabled/> + ``` -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          - +Data type is string. Supported operations are Add, Get, Replace, and Delete. + + **SystemDrivesRequireStartupAuthentication** -

          This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup".

          + +This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup". + + @@ -237,42 +267,45 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name: Require additional authentication at startup
          • GP name: ConfigureAdvancedStartup_Name
          • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker.

          +This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a TPM. This setting is applied when you turn on BitLocker. > [!NOTE] > Only one of the additional authentication options can be required at startup, otherwise an error occurs. -

          If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive.

          +If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. -

          On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.

          +On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both. > [!NOTE] > In Windows 10, version 1703 release B, you can use a minimum PIN of 4 digits. SystemDrivesMinimumPINLength policy must be set to allow PINs shorter than 6 digits. -

          If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.

          +If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard. -

          If you disable or do not configure this setting, users can configure only basic options on computers with a TPM.

          +If you disable or do not configure this setting, users can configure only basic options on computers with a TPM. > [!NOTE] > If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. -

          Sample value for this node to enable this policy is:

          +Sample value for this node to enable this policy is: ```xml ``` -

          Data id:

          +Data id:
          • ConfigureNonTPMStartupKeyUsage_Name = Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).
          • ConfigureTPMStartupKeyUsageDropDown_Name = (for computer with TPM) Configure TPM startup key.
          • @@ -280,40 +313,44 @@ The following diagram shows the BitLocker configuration service provider in tree
          • ConfigureTPMPINKeyUsageDropDown_Name = (for computer with TPM) Configure TPM startup key and PIN.
          • ConfigureTPMUsageDropDown_Name = (for computer with TPM) Configure TPM startup.
          - -

          The possible values for 'xx' are:

          + +The possible values for 'xx' are:
          • true = Explicitly allow
          • false = Policy not set
          -

          The possible values for 'yy' are:

          +The possible values for 'yy' are:
          • 2 = Optional
          • 1 = Required
          • 0 = Disallowed
          - -

          Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

          + +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication + + + chr + + + + ``` -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          - +Data type is string. Supported operations are Add, Get, Replace, and Delete. + + **SystemDrivesMinimumPINLength** -

          This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup".

          + +This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup". + + @@ -334,55 +371,63 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name:Configure minimum PIN length for startup
          • GP name: MinimumPINLength_Name
          • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.

          +This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits. > [!NOTE] > In Windows 10, version 1703 release B, you can use a minimum PIN length of 4 digits. > >In TPM 2.0 if minimum PIN length is set below 6 digits, Windows will attempt to update the TPM lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. This does not apply to TPM 1.2. -

          If you enable this setting, you can require a minimum number of digits to be used when setting the startup PIN.

          +If you enable this setting, you can require a minimum number of digits to be used when setting the startup PIN. -

          If you disable or do not configure this setting, users can configure a startup PIN of any length between 6 and 20 digits.

          +If you disable or do not configure this setting, users can configure a startup PIN of any length between 6 and 20 digits. -

          Sample value for this node to enable this policy is:

          +Sample value for this node to enable this policy is: ```xml ``` -

          Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

          +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength + + + chr + + + + ``` -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          - -**SystemDrivesRecoveryMessage** -

          This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name).

          +Data type is string. Supported operations are Add, Get, Replace, and Delete. + + +**SystemDrivesRecoveryMessage** + +This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" +(PrebootRecoveryInfo_Name). + + @@ -403,32 +448,36 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name: Configure pre-boot recovery message and URL
          • GP name: PrebootRecoveryInfo_Name
          • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. -

          +This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. -

          If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). -

          If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message.

          +If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). -

          If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen.

          +If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message. -

          Sample value for this node to enable this policy is:

          +If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen. + +Sample value for this node to enable this policy is: ```xml ``` -

          The possible values for 'xx' are:

          + +The possible values for 'xx' are: - 0 = Empty - 1 = Use default recovery message and URL (in this case you don't need to specify a value for "RecoveryMessage_Input" or "RecoveryUrl_Input"). @@ -436,34 +485,38 @@ The following diagram shows the BitLocker configuration service provider in tree - 3 = Custom recovery URL is set. - 'yy' = string of max length 900. - 'zz' = string of max length 500. - + > [!NOTE] > When you enable SystemDrivesRecoveryMessage, you must specify values for all three settings (pre-boot recovery screen, recovery message, and recovery URL), otherwise it will fail (500 return status). For example, if you only specify values for message and URL, you will get a 500 return status. -

          Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

          +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage + + + chr + + + + ``` > [!NOTE] > Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen. -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          - +Data type is string. Supported operations are Add, Get, Replace, and Delete. + + **SystemDrivesRecoveryOptions** -

          This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).

          + +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name). + + @@ -484,83 +537,83 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name: Choose how BitLocker-protected operating system drives can be recovered
          • GP name: OSRecoveryUsage_Name
          • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker.

          +This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker. -

          The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.

          +The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -

          In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.

          +In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -

          Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.

          +Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -

          Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS.

          +Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS. -

          Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.

          +Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -> [!Note]
          > If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. +> [!NOTE] +> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. -

          If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives.

          +If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. -

          If this setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

          +If this setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS. -

          Sample value for this node to enable this policy is:

          +Sample value for this node to enable this policy is: ```xml ``` + +The possible values for 'xx' are: +- true = Explicitly allow +- false = Policy not set -

          The possible values for 'xx' are:

          -
            -
          • true = Explicitly allow
          • -
          • false = Policy not set
          • -
          • -
          +The possible values for 'yy' are: +- 2 = Allowed +- 1 = Required +- 0 = Disallowed -

          The possible values for 'yy' are:

          -
            -
          • 2 = Allowed
          • -
          • 1 = Required
          • -
          • 0 = Disallowed
          • -
          - -

          The possible values for 'zz' are:

          -
            -
          • 2 = Store recovery passwords only
          • -
          • 1 = Store recovery passwords and key packages
          • -
          • -
          - -

          Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

          +The possible values for 'zz' are: +- 2 = Store recovery passwords only +- 1 = Store recovery passwords and key packages + +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions + + + chr + + + + ``` -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          - +Data type is string. Supported operations are Add, Get, Replace, and Delete. + + **FixedDrivesRecoveryOptions** -

          This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().

          + +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" (). + + @@ -581,50 +634,54 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name: Choose how BitLocker-protected fixed drives can be recovered
          • GP name: FDVRecoveryUsage_Name
          • GP path: Windows Components/Bitlocker Drive Encryption/Fixed Drives
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker.

          +This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker. -

          The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.

          +The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -

          In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.

          +In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -

          Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.

          +Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -

          Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD.

          +Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD. -

          Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.

          +Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -

          Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS.

          +Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS. -> [!Note]
          > If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated. +> [!NOTE] +> If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated. -

          If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives.

          +If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. -

          If this setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

          +If this setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS. -

          Sample value for this node to enable this policy is:

          +Sample value for this node to enable this policy is: ```xml ``` - -

          The possible values for 'xx' are:

          + +The possible values for 'xx' are:
          • true = Explicitly allow
          • false = Policy not set
          -

          The possible values for 'yy' are:

          +The possible values for 'yy' are:
          • 2 = Allowed
          • 1 = Required
          • @@ -632,33 +689,37 @@ The following diagram shows the BitLocker configuration service provider in tree
          -

          The possible values for 'zz' are:

          +The possible values for 'zz' are:
          • 2 = Store recovery passwords only
          • 1 = Store recovery passwords and key packages
          - -

          Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

          + +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions + + + chr + + + + ``` -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          - +Data type is string. Supported operations are Add, Get, Replace, and Delete. + + **FixedDrivesRequireEncryption** -

          This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).

          + +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name). + + @@ -679,48 +740,55 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name: Deny write access to fixed drives not protected by BitLocker
          • GP name: FDVDenyWriteAccess_Name
          • GP path: Windows Components/Bitlocker Drive Encryption/Fixed Drives
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.

          +This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. -

          If you enable this setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.

          +If you enable this setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -

          Sample value for this node to enable this policy is:

          +Sample value for this node to enable this policy is: ```xml ``` -

          If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML:

          +If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption + + + chr + + + + ``` -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          - +Data type is string. Supported operations are Add, Get, Replace, and Delete. + + **RemovableDrivesRequireEncryption** -

          This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).

          + +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name). + + @@ -741,66 +809,71 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          + + +ADMX Info:
          • GP English name: Deny write access to removable drives not protected by BitLocker
          • GP name: RDVDenyWriteAccess_Name
          • GP path: Windows Components/Bitlocker Drive Encryption/Removeable Drives
          • GP ADMX file name: VolumeEncryption.admx
          + > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.

          +This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive. -

          If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.

          +If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -

          If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting.

          +If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting. -

          If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access.

          +If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access. -> [!Note]
          > This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. +> [!NOTE] +> This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. -

          Sample value for this node to enable this policy is:

          +Sample value for this node to enable this policy is: ```xml ``` - -

          The possible values for 'xx' are:

          + +The possible values for 'xx' are:
          • true = Explicitly allow
          • false = Policy not set
          - -

          Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

          + +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption + + + chr + + + + ``` - + + **AllowWarningForOtherDiskEncryption** - -

          Allows the admin to disable the warning prompt for other disk encryption on the user machines that are targeted when the RequireDeviceEncryption policy is also set to 1.

          - + +Allows the admin to disable the warning prompt for other disk encryption on the user machines that are targeted when the RequireDeviceEncryption policy is also set to 1. + > [!IMPORTANT] > Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. When RequireDeviceEncryption is set to 1 and AllowWarningForOtherDiskEncryption is set to 0, Windows will attempt to silently enable [BitLocker](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview). > [!Warning] > When you enable BitLocker on a device with third-party encryption, it may render the device unusable and require you to reinstall Windows. - + @@ -821,12 +894,13 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          - -

          The following list shows the supported values:

          + + +The following list shows the supported values: - 0 – Disables the warning prompt. Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0. - 1 (default) – Warning prompt allowed. - + ```xml 110 @@ -836,7 +910,6 @@ The following diagram shows the BitLocker configuration service provider in tree int - 0 @@ -851,9 +924,12 @@ The following diagram shows the BitLocker configuration service provider in tree >3. The user's personal OneDrive (MDM/MAM only). > >Encryption will wait until one of these three locations backs up successfully. - -**AllowStandardUserEncryption** + + +**AllowStandardUserEncryption** + Allows Admin to enforce "RequireDeviceEncryption" policy for scenarios where policy is pushed while current logged on user is non-admin/standard user Azure AD account. + > [!NOTE] > This policy is only supported in Azure AD accounts. @@ -861,12 +937,34 @@ Allows Admin to enforce "RequireDeviceEncryption" policy for scenarios where pol "AllowStandardUserEncryption" policy is tied to "AllowWarningForOtherDiskEncryption" policy being set to "0", i.e, silent encryption is enforced. If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user is the current logged on user in the system. - + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcross markcross mark
          + + The expected values for this policy are: - 1 = "RequireDeviceEncryption" policy will try to enable encryption on all fixed drives even if a current logged in user is standard user. - 0 = This is the default, when the policy is not set. If current logged on user is a standard user, "RequireDeviceEncryption" policy will not try to enable encryption on any drive. - + If you want to disable this policy use the following SyncML: ```xml @@ -883,6 +981,246 @@ If you want to disable this policy use the following SyncML: ``` + + + + +**ConfigureRecoveryPasswordRotation** + + +This setting initiates a client-driven recovery password refresh after an OS drive recovery (either by using bootmgr or WinRE) and recovery password unlock on a Fixed data drive. This setting will refresh the specific recovery password that was used, and other unused passwords on the volume will remain unchanged. If the initialization of the refresh fails, the device will retry the refresh during the next reboot. When password refresh is initiated, the client will generate a new recovery password. The client will use the existing API in Azure AD to upload the new recovery key and retry on failure. After the recovery password has been successfully backed up to Azure AD, the recovery key that was used locally will be removed. This setting refreshes only the used key and retains other unused keys. + + + + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcross markcross mark
          + + +Value type is int. Supported operations are Add, Delete, Get, and Replace. + + + +Supported values are: +- 0 – Refresh off (default) +- 1 – Refresh on for Azure AD-joined devices +- 2 – Refresh on for both Azure AD-joined and hybrid-joined devices + + + + + + +**RotateRecoveryPasswords** + + + +This setting refreshes all recovery passwords for OS and fixed drives (removable drives are not included so they can be shared between users). All recovery passwords for all drives will be refreshed and only one password per volume is retained. In case of errors, an error code will be returned so that server can take appropriate action to remediate. + + +The client will generate a new recovery password. The client will use the existing API in Azure AD to upload the new recovery key and retry on failure. + +Policy type is Execute. When “Execute Policy” is pushed, the client sets the status as Pending and initiates an asynchronous rotation operation. After refresh is complete, pass or fail status is updated. The client will not retry, but if needed, the server can re-issue the execute request. + +Server can call Get on the RotateRecoveryPasswordsRotationStatus node to query the status of the refresh. + +Recovery password refresh will only occur for devices that are joined to Azure AD or joined to both Azure AD and on-premises (hybrid Azure AD-joined) that run a Windows 10 edition with the BitLocker CSP (Pro/Enterprise). Devices cannot refresh recovery passwords if they are only registered in Azure AD (also known as workplace-joined) or signed in with a Microsoft account. + +Each server-side recovery key rotation is represented by a request ID. The server can query the following nodes to make sure it reads status/result for same rotation request. +- RotateRecoveryPasswordsRequestID: Returns request ID of last request processed. +- RotateRecoveryPasswordsRotationStatus: Returns status of last request processed. + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcross markcross mark
          + + +Value type is string. Supported operation is Execute. Request ID is expected as a parameter. + +> [!TIP] +> Key rotation feature will only work when: +> +> - For Operating system drives: +> - OSRequireActiveDirectoryBackup_Name is set to 1 ("Required") +> - OSActiveDirectoryBackup_Name is set to true +> - For Fixed data drives: +> - FDVRequireActiveDirectoryBackup_Name is set to 1 = ("Required") +> - FDVActiveDirectoryBackup_Name is set to true + +**Status** +Interior node. Supported operation is Get. + + + + +**Status/DeviceEncryptionStatus** + +This node reports compliance state of device encryption on the system. + + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcross markcross mark
          + + + +Value type is int. Supported operation is Get. + +Supported values: +- 0 - Indicates that the device is compliant. +- Any non-zero value - Indicates that the device is not compliant. This value represents a bitmask with each bit and the corresponding error code described in the following table: + +| Bit | Error Code | +|-----|------------| +| 0 |The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| +| 1 |The encryption method of the OS volume doesn't match the BitLocker policy.| +| 2 |The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| +| 3 |The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| +| 4 |The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| +| 5 |The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| +| 6 |The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| +| 7 |The OS volume is unprotected.| +| 8 |Recovery key backup failed.| +| 9 |A fixed drive is unprotected.| +| 10 |The encryption method of the fixed drive doesn't match the BitLocker policy.| +| 11 |To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Azure AD, the AllowStandardUserEncryption policy must be set to 1.| +| 12 |Windows Recovery Environment (WinRE) isn't configured.| +| 13 |A TPM isn't available for BitLocker, either because it isn't present, it has been made unavailable in the Registry, or the OS is on a removable drive. | +| 14 |The TPM isn't ready for BitLocker.| +| 15 |The network isn't available, which is required for recovery key backup. | +| 16-31 |For future use.| + + + + + + + +**Status/RotateRecoveryPasswordsStatus** + + +This node reports the status of RotateRecoveryPasswords request. + + +Status code can be one of the following: + +- 2 – Not started +- 1 - Pending +- 0 - Pass +- Any other code - Failure HRESULT + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcross markcross mark
          + + +Value type is int. Supported operation is Get. + + + + + +**Status/RotateRecoveryPasswordsRequestID** + + +This node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. +This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus to ensure the status is correctly matched to the request ID. + + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcross markcross mark
          + + + +Value type is string. Supported operation is Get. + ### SyncML example The following example is provided to show proper format and should not be taken as a recommendation. @@ -926,10 +1264,10 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/EncryptionMethodByDriveType - <enabled/> - <data id="EncryptionMethodWithXtsOsDropDown_Name" value="4"/> - <data id="EncryptionMethodWithXtsFdvDropDown_Name" value="7"/> - <data id="EncryptionMethodWithXtsRdvDropDown_Name" value="4"/> + + + + @@ -941,12 +1279,12 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication - <enabled/> - <data id="ConfigureNonTPMStartupKeyUsage_Name" value="true"/> - <data id="ConfigureTPMStartupKeyUsageDropDown_Name" value="2"/> - <data id="ConfigurePINUsageDropDown_Name" value="2"/> - <data id="ConfigureTPMPINKeyUsageDropDown_Name" value="2"/> - <data id="ConfigureTPMUsageDropDown_Name" value="2"/> + + + + + + @@ -958,8 +1296,8 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength - <enabled/> - <data id="MinPINLength" value="6"/> + + @@ -971,10 +1309,10 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage - <enabled/> - <data id="RecoveryMessage_Input" value="blablablabla"/> - <data id="PrebootRecoveryInfoDropDown_Name" value="2"/> - <data id="RecoveryUrl_Input" value="blablabla"/> + + + + @@ -986,14 +1324,14 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions - <enabled/> - <data id="OSAllowDRA_Name" value="true"/> - <data id="OSRecoveryPasswordUsageDropDown_Name" value="2"/> - <data id="OSRecoveryKeyUsageDropDown_Name" value="2"/> - <data id="OSHideRecoveryPage_Name" value="true"/> - <data id="OSActiveDirectoryBackup_Name" value="true"/> - <data id="OSActiveDirectoryBackupDropDown_Name" value="2"/> - <data id="OSRequireActiveDirectoryBackup_Name" value="true"/> + + + + + + + + @@ -1005,14 +1343,14 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions - <enabled/> - <data id="FDVAllowDRA_Name" value="true"/> - <data id="FDVRecoveryPasswordUsageDropDown_Name" value="2"/> - <data id="FDVRecoveryKeyUsageDropDown_Name" value="2"/> - <data id="FDVHideRecoveryPage_Name" value="true"/> - <data id="FDVActiveDirectoryBackup_Name" value="true"/> - <data id="FDVActiveDirectoryBackupDropDown_Name" value="2"/> - <data id="FDVRequireActiveDirectoryBackup_Name" value="true"/> + + + + + + + + @@ -1024,7 +1362,7 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption - <enabled/> + @@ -1036,8 +1374,8 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption - <enabled/> - <data id="RDVCrossOrg" value="true"/> + + @@ -1046,3 +1384,5 @@ The following example is provided to show proper format and should not be taken ``` + + diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index bb69c429fb..693a48b687 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -1,26 +1,24 @@ --- title: BitLocker DDF file -description: BitLocker DDF file -ms.author: lomayor +description: Learn about the OMA DM device description framework (DDF) for the BitLocker configuration service provider. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 06/29/2018 +ms.localizationpriority: medium +ms.date: 09/30/2019 ms.reviewer: manager: dansimp --- # BitLocker DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **BitLocker** configuration service provider. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the current version Windows 10, version 1809. +The XML below is the current version for this CSP. ```xml @@ -46,7 +44,7 @@ The XML below is the current version Windows 10, version 1809. - com.microsoft/3.0/MDM/BitLocker + com.microsoft/5.0/MDM/BitLocker @@ -736,6 +734,206 @@ The XML below is the current version Windows 10, version 1809. + + + ConfigureRecoveryPasswordRotation + + + + + + + + Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on AAD and Hybrid domain joined devices. + When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when + Active Directory back up for recovery password is configured to required. + For OS drive: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives" + For Fixed drives: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives" + + Supported Values: 0 - Numeric Recovery Passwords rotation OFF. + 1 - Numeric Recovery Passwords Rotation upon use ON for AAD joined devices. Default value + 2 - Numeric Recovery Passwords Rotation upon use ON for both AAD and Hybrid devices + + If you want to disable this policy use the following SyncML: + + + 112 + + + ./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotation + + + int + + 0 + + + + + + + + + + + + + + text/plain + + + + + + + + + + + RotateRecoveryPasswords + + + + + Allows admin to push one-time rotation of all numeric recovery passwords for OS and Fixed Data drives on an Azure Active Directory or hybrid-joined device. + This policy is Execute type and rotates all numeric passwords when issued from MDM tools. + +The policy only comes into effect when Active Directory backup for a recovery password is configured to "required." + * For OS drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for operating system drives." + *For fixed drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for fixed data drives." + + Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes: + +* status\RotateRecoveryPasswordsStatus + * status\RotateRecoveryPasswordsRequestID + + + +Supported Values: String form of request ID. Example format of request ID is GUID. Server can choose the format as needed according to the management tools.\ + + + 113 + + + ./Device/Vendor/MSFT/BitLocker/RotateRecoveryPasswords + + + chr + + <RequestID/> + + + + + + + + + + + + + + text/plain + + + + + + Status + + + + + + + + + + + + + + + + + + + DeviceEncryptionStatus + + + + + This node reports compliance state of device encryption on the system. + Value '0' means the device is compliant. Any other value represents a non-compliant device. + + + + + + + + + + + + text/plain + + + + + + RotateRecoveryPasswordsStatus + + + + + This Node reports the status of RotateRecoveryPasswords request. + Status code can be one of the following: + NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure + + + + + + + + + + + + + text/plain + + + + + + RotateRecoveryPasswordsRequestID + + + + + This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. + This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus + To ensure the status is correctly matched to the request ID. + + + + + + + + + + + + + text/plain + + + + ``` diff --git a/windows/client-management/mdm/bootstrap-csp.md b/windows/client-management/mdm/bootstrap-csp.md index 509638a1e4..2381889266 100644 --- a/windows/client-management/mdm/bootstrap-csp.md +++ b/windows/client-management/mdm/bootstrap-csp.md @@ -1,10 +1,10 @@ --- title: BOOTSTRAP CSP -description: BOOTSTRAP CSP +description: Use the BOOTSTRAP configuration service provider to set the Trusted Provisioning Server (TPS) for the device. ms.assetid: b8acbddc-347f-4543-a45b-ad2ffae3ffd0 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index 1d59d8ade7..908672c4ef 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -1,10 +1,10 @@ --- title: BrowserFavorite CSP -description: BrowserFavorite CSP +description: Learn how the BrowserFavorite configuration service provider is used to add and remove URLs from the favorites list on a device. ms.assetid: 5d2351ff-2d6a-4273-9b09-224623723cbf ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md b/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md index 9e077af341..d5a9dfc966 100644 --- a/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md +++ b/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md @@ -4,7 +4,7 @@ description: The Bulk assign and reclaim seats from users operation returns recl ms.assetid: 99E2F37D-1FF3-4511-8969-19571656780A ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md index 955a7207d1..2818c2e55f 100644 --- a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,13 +1,13 @@ --- title: Bulk enrollment description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. In Windows 10. -MS-HAID: -- 'p\_phdevicemgmt.bulk\_enrollment' -- 'p\_phDeviceMgmt.bulk\_enrollment\_using\_Windows\_provisioning\_tool' +MS-HAID: + - 'p\_phdevicemgmt.bulk\_enrollment' + - 'p\_phDeviceMgmt.bulk\_enrollment\_using\_Windows\_provisioning\_tool' ms.assetid: DEB98FF3-CC5C-47A1-9277-9EF939716C87 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -35,9 +35,8 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro > [!NOTE] > - Bulk-join is not supported in Azure Active Directory Join. > - Bulk enrollment does not work in Intune standalone environment. -> - Bulk enrollment works in System Center Configuration Manager (SCCM) + Intune hybrid environment where the ppkg is generated from the SCCM console. - - +> - Bulk enrollment works in Microsoft Endpoint Configuration Manager where the ppkg is generated from the Configuration Manager console. +> - To change bulk enrollment settings, login to **AAD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. ## What you need @@ -169,4 +168,3 @@ Here are links to step-by-step provisioning topics in Technet. - diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index d982a50e25..953ddf78ae 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -1,10 +1,10 @@ --- title: CellularSettings CSP -description: CellularSettings CSP +description: Learn how the CellularSettings configuration service provider is used to configure cellular settings on a mobile device. ms.assetid: ce8b6f16-37ca-4aaf-98b0-306d12e326df ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/certificate-authentication-device-enrollment.md b/windows/client-management/mdm/certificate-authentication-device-enrollment.md index 3e90f99dc8..565fd3436d 100644 --- a/windows/client-management/mdm/certificate-authentication-device-enrollment.md +++ b/windows/client-management/mdm/certificate-authentication-device-enrollment.md @@ -4,7 +4,7 @@ description: This section provides an example of the mobile device enrollment pr ms.assetid: 57DB3C9E-E4C9-4275-AAB5-01315F9D3910 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -14,15 +14,13 @@ ms.date: 06/26/2017 # Certificate authentication device enrollment +This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). -This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). - -> **Note**  To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). - +> [!Note] +> To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). ## In this topic - - [Discovery service](#discovery-service) - [Enrollment policy web service](#enrollment-policy-web-service) - [Enrollment web service](#enrollment-web-service) @@ -507,10 +505,3 @@ The following example shows the encoded provisioning XML. protocol. This configuration service provider is being deprecated for Windows 10. --> ``` - -  - - - - - diff --git a/windows/client-management/mdm/certificate-renewal-windows-mdm.md b/windows/client-management/mdm/certificate-renewal-windows-mdm.md index 162fbea922..0db0669275 100644 --- a/windows/client-management/mdm/certificate-renewal-windows-mdm.md +++ b/windows/client-management/mdm/certificate-renewal-windows-mdm.md @@ -1,13 +1,13 @@ --- title: Certificate Renewal -description: The enrolled client certificate expires after a period of use. -MS-HAID: -- 'p\_phdevicemgmt.certificate\_renewal' -- 'p\_phDeviceMgmt.certificate\_renewal\_windows\_mdm' +description: Learn how to find all the resources that you need to provide continuous access to client certificates. +MS-HAID: + - 'p\_phdevicemgmt.certificate\_renewal' + - 'p\_phDeviceMgmt.certificate\_renewal\_windows\_mdm' ms.assetid: F910C50C-FF67-40B0-AAB0-CA7CE02A9619 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -17,16 +17,13 @@ ms.date: 06/26/2017 # Certificate Renewal - The enrolled client certificate expires after a period of use. The expiration date of the certificate is specified by the server. To ensure continuous access to enterprise applications, Windows supports a user-triggered certificate renewal process. The user is prompted to provide the current password for the corporate account, and the enrollment client gets a new client certificate from the enrollment server and deletes the old certificate. The client generates a new private/public key pair, generates a PKCS\#7 request, and signs the PKCS\#7 request with the existing certificate. In Windows, automatic MDM client certificate renewal is also supported. -> **Note**  Make sure that the EntDMID in the DMClient configuration service provider is set before the certificate renewal request is triggered. - -  +> [!Note] +> Make sure that the EntDMID in the DMClient configuration service provider is set before the certificate renewal request is triggered. ## In this topic - - [Automatic certificate renewal request](#automatic-certificate-renewal-request) - [Certificate renewal schedule configuration](#certificate-renewal-schedule-configuration) - [Certificate renewal response](#certificate-renewal-response) @@ -35,12 +32,10 @@ The enrolled client certificate expires after a period of use. The expiration da ## Automatic certificate renewal request - In addition to manual certificate renewal, Windows includes support for automatic certificate renewal, also known as Renew On Behalf Of (ROBO), that does not require any user interaction. For auto renewal, the enrollment client uses the existing MDM client certificate to perform client Transport Layer Security (TLS). The user security token is not needed in the SOAP header. As a result, the MDM certificate enrollment server is required to support client TLS for certificate based client authentication for automatic certificate renewal. -> **Note**  Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. - -  +> [!Note] +> Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. Auto certificate renewal is the only supported MDM client certificate renewal method for the device that is enrolled using WAB authentication (meaning that the AuthPolicy is set to Federated). It also means if the server supports WAB authentication, the MDM certificate enrollment server MUST also support client TLS in order to renew the MDM client certificate. @@ -54,7 +49,7 @@ During the automatic certificate renew process, the device will deny HTTP redire The following example shows the details of an automatic renewal request. -``` +``` xml @@ -106,7 +101,6 @@ The following example shows the details of an automatic renewal request. ``` - ## Certificate renewal schedule configuration @@ -116,11 +110,10 @@ For more information about the parameters, see the CertificateStore configuratio Unlike manual certificate renewal, the device will not perform an automatic MDM client certificate renewal if the certificate is already expired. To make sure that the device has enough time to perform an automatic renewal, we recommend that you set a renewal period a couple months (40-60 days) before the certificate expires and set the renewal retry interval to be every few days such as every 4-5 days instead every 7 days (weekly) to increase the chance that the device will a connectivity at different days of the week. -> **Note**  For PCs that were previously enrolled in MDM in Windows 8.1 and then upgraded to Windows 10, renewal will be triggered for the enrollment certificate. Thereafter, renewal will happen at the configured ROBO interval. +> [!Note] +> For PCs that were previously enrolled in MDM in Windows 8.1 and then upgraded to Windows 10, renewal will be triggered for the enrollment certificate. Thereafter, renewal will happen at the configured ROBO interval. > For Windows Phone 8.1 devices upgraded to Windows 10 Mobile, renewal will happen at the configured ROBO internal. This is expected and by design. -  - ## Certificate renewal response When RequestType is set to Renew, the web service verifies the following (in additional to initial enrollment): @@ -133,12 +126,12 @@ When RequestType is set to Renew, the web service verifies the following (in add After validation is completed, the web service retrieves the PKCS\#10 content from the PKCS\#7 BinarySecurityToken. The rest is the same as initial enrollment, except that the Provisioning XML only needs to have the new certificate issued by the CA. -> **Note**  The HTTP server response must not be chunked; it must be sent as one message. - +> [!Note] +> The HTTP server response must not be chunked; it must be sent as one message. The following example shows the details of an certificate renewal response. -``` +``` xml @@ -163,25 +156,15 @@ The following example shows the details of an certificate renewal response. ``` -> **Note**  The client receives a new certificate, instead of renewing the initial certificate. The administrator controls which certificate template the client should use. The templates may be different at renewal time than the initial enrollment time. - -  +> [!Note] +The client receives a new certificate, instead of renewing the initial certificate. The administrator controls which certificate template the client should use. The templates may be different at renewal time than the initial enrollment time. ## Configuration service providers supported during MDM enrollment and certificate renewal - The following configuration service providers are supported during MDM enrollment and certificate renewal process. See Configuration service provider reference for detailed descriptions of each configuration service provider. - CertificateStore - w7 APPLICATION - DMClient - EnterpriseAppManagement - -  - - - - - - diff --git a/windows/client-management/mdm/certificatestore-csp.md b/windows/client-management/mdm/certificatestore-csp.md index 276c00951a..f709de39d0 100644 --- a/windows/client-management/mdm/certificatestore-csp.md +++ b/windows/client-management/mdm/certificatestore-csp.md @@ -1,15 +1,15 @@ --- title: CertificateStore CSP -description: CertificateStore CSP +description: Use the The CertificateStore configuration service provider (CSP) to add secure socket layers (SSL), intermediate, and self-signed certificates. ms.assetid: 0fe28629-3cc3-42a0-91b3-3624c8462fd3 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 06/26/2017 +ms.date: 02/28/2020 --- # CertificateStore CSP @@ -17,7 +17,9 @@ ms.date: 06/26/2017 The CertificateStore configuration service provider is used to add secure socket layers (SSL), intermediate, and self-signed certificates. -> **Note**   The CertificateStore configuration service provider does not support installing client certificates. +> [!Note] +> The CertificateStore configuration service provider does not support installing client certificates. +> The Microsoft protocol version of Open Mobile Alliance (OMA) is case insensitive. @@ -144,7 +146,13 @@ Required for enrollment. Specifies the key usage bits (0x80, 0x20, 0xA0, etc.) f Supported operations are Get, Add, Delete, and Replace. **My/SCEP/*UniqueID*/Install/SubjectName** -Required. Specifies the subject name. Value type is chr. +Required. Specifies the subject name. + +The SubjectName value is quoted if it contains leading or trailing white space or one of the following characters: (“,” “=” “+” “;” ). + +For more details, see [CertNameToStrA function](https://docs.microsoft.com/windows/win32/api/wincrypt/nf-wincrypt-certnametostra#remarks). + +Value type is chr. Supported operations are Get, Add, Delete, and Replace. @@ -637,4 +645,3 @@ Configure the device to automatically renew an MDM client certificate with the s - diff --git a/windows/client-management/mdm/certificatestore-ddf-file.md b/windows/client-management/mdm/certificatestore-ddf-file.md index 248e475b20..9a2630fdb4 100644 --- a/windows/client-management/mdm/certificatestore-ddf-file.md +++ b/windows/client-management/mdm/certificatestore-ddf-file.md @@ -1,10 +1,10 @@ --- title: CertificateStore DDF file -description: This topic shows the OMA DM device description framework (DDF) for the CertificateStore configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: Learn about OMA DM device description framework (DDF) for the CertificateStore configuration service provider. DDF files are used with OMA DM provisioning XML. ms.assetid: D9A12D4E-3122-45C3-AD12-CC4FFAEC08B8 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/change-history-for-mdm-documentation.md b/windows/client-management/mdm/change-history-for-mdm-documentation.md new file mode 100644 index 0000000000..556ff58e7a --- /dev/null +++ b/windows/client-management/mdm/change-history-for-mdm-documentation.md @@ -0,0 +1,1085 @@ +--- +title: Change history for MDM documentation +description: This article lists new and updated articles for Mobile Device Management. +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/19/2020 +--- + +# Change history for Mobile Device Management documentation + +This article lists new and updated articles for the Mobile Device Management (MDM) documentation. Updated articles are those that had content addition, removal, or corrections—minor fixes, such as correction of typos, style, or formatting issues are not listed. + +## November 2020 + +|New or updated article | Description| +|--- | ---| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policy:
          - [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following new node:
          -Properties/SleepMode | + +## October 2020 + +|New or updated article | Description| +|--- | ---| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies
          - [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)
          - [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)
          - [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)
          - [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)
          - [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)
          - [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)
          - [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)
          - [Update/DisableWUfBSafeguards](policy-csp-update.md#update-disablewufbsafeguards)
          - [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)
          - [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)
          - [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)
          - [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)
          - [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)
          - [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) | + +## September 2020 + +|New or updated article | Description| +|--- | ---| +|[NetworkQoSPolicy CSP](networkqospolicy-csp.md)|Updated support information of the NetworkQoSPolicy CSP.| +|[Policy CSP - LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md)|Removed the following unsupported LocalPoliciesSecurityOptions policy settings from the documentation:
          - RecoveryConsole_AllowAutomaticAdministrativeLogon
          - DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
          - DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
          - DomainMember_DisableMachineAccountPasswordChanges
          - SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
          | + +## August 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - System](policy-csp-system.md)|Removed the following policy settings:
          - System/AllowDesktopAnalyticsProcessing
          - System/AllowMicrosoftManagedDesktopProcessing
          - System/AllowUpdateComplianceProcessing
          - System/AllowWUfBCloudProcessing
          | + +## July 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policy settings:
          - System/AllowDesktopAnalyticsProcessing
          - System/AllowMicrosoftManagedDesktopProcessing
          - System/AllowUpdateComplianceProcessing
          - System/AllowWUfBCloudProcessing


          Updated the following policy setting:
          - System/AllowCommercialDataPipeline
          | + +## June 2020 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added SKU support table for **AllowStandardUserEncryption**.| +|[Policy CSP - NetworkIsolation](policy-csp-networkisolation.md)|Updated the description from Boolean to Integer for the following policy settings:
          EnterpriseIPRangesAreAuthoritative, EnterpriseProxyServersAreAuthoritative.| + +## May 2020 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the bitmask table for the Status/DeviceEncryptionStatus node.| +|[Policy CSP - RestrictedGroups](policy-csp-restrictedgroups.md)| Updated the topic with additional details. Added policy timeline table. + +## February 2020 + +|New or updated article | Description| +|--- | ---| +|[CertificateStore CSP](certificatestore-csp.md)
          [ClientCertificateInstall CSP](clientcertificateinstall-csp.md)|Added details about SubjectName value.| + +## January 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Added descriptions for supported actions for Defender/ThreatSeverityDefaultAction.| + +## November 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added option 5 in the supported values list for DeliveryOptimization/DOGroupIdSource.| +|[DiagnosticLog CSP](diagnosticlog-csp.md)|Added substantial updates to this CSP doc.| + +## October 2019 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
          ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.| +|[Defender CSP](defender-csp.md)|Added the following new nodes:
          Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.| + +## September 2019 + +|New or updated article | Description| +|--- | ---| +|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node:
          IsStub.| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| +|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
          DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| + +## August 2019 + +|New or updated article | Description| +|--- | ---| +|[DiagnosticLog CSP](diagnosticlog-csp.md)
          [DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
          Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| +|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
          Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| + +## July 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
          Policies supported by HoloLens 2| +|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| +|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
          SecurityKey, SecurityKey/UseSecurityKeyForSignin| +|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
          LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| +|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
          Create a custom configuration service provider
          Design a custom configuration service provider
          IConfigServiceProvider2
          IConfigServiceProvider2::ConfigManagerNotification
          IConfigServiceProvider2::GetNode
          ICSPNode
          ICSPNode::Add
          ICSPNode::Clear
          ICSPNode::Copy
          ICSPNode::DeleteChild
          ICSPNode::DeleteProperty
          ICSPNode::Execute
          ICSPNode::GetChildNodeNames
          ICSPNode::GetProperty
          ICSPNode::GetPropertyIdentifiers
          ICSPNode::GetValue
          ICSPNode::Move
          ICSPNode::SetProperty
          ICSPNode::SetValue
          ICSPNodeTransactioning
          ICSPValidate
          Samples for writing a custom configuration service provider.| + +## June 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
          AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| +|[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
          ConfigureTimeZone.| + +## May 2019 + +|New or updated article | Description| +|--- | ---| +|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
          DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| +|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
          DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

          Updated description of the following policies:
          DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| +|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
          ShowLockOnUserTile.| +|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
          AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| +|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
          EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| +|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
          AllowFindMyFiles.| +|[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
          SvchostProcessMitigation.| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
          AllowCommercialDataPipeline, TurnOffFileHistory.| +|[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
          AllowRecommendations.| +|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
          AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| +|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
          AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

          Removed the following policy:
          SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| + +## April 2019 + +| New or updated article | Description | +|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
          Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | +| [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | + +## March 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
          AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

          Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| + +## February 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP](policy-configuration-service-provider.md)|Updated supported policies for Holographic.| + +## January 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Added the following new policies: AllowStorageSenseGlobal, ConfigStorageSenseGlobalCadence, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseRecycleBinCleanupThreshold, ConfigStorageSenseDownloadsCleanupThreshold, and ConfigStorageSenseCloudContentCleanupThreshold.| +|[SharedPC CSP](sharedpc-csp.md)|Updated values and supported operations.| +|[Mobile device management](index.md)|Updated information about MDM Security Baseline.| + +## December 2018 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Updated AllowWarningForOtherDiskEncryption policy description to describe silent and non-silent encryption scenarios, as well as where and how the recovery key is backed up for each scenario.| + +## September 2018 + +|New or updated article | Description| +|--- | ---| +|[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| +|[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| + +## August 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          BitLocker CSP

          Added support for Windows 10 Pro starting in the version 1809.

          +
          Office CSP

          Added FinalStatus setting in Windows 10, version 1809.

          +
          RemoteWipe CSP

          Added new settings in Windows 10, version 1809.

          +
          TenantLockdown CSP

          Added new CSP in Windows 10, version 1809.

          +
          WindowsDefenderApplicationGuard CSP

          Added new settings in Windows 10, version 1809.

          +
          Policy DDF file

          Posted an updated version of the Policy DDF for Windows 10, version 1809.

          +
          Policy CSP

          Added the following new policies in Windows 10, version 1809:

          +
            +
          • Browser/AllowFullScreenMode
          • +
          • Browser/AllowPrelaunch
          • +
          • Browser/AllowPrinting
          • +
          • Browser/AllowSavingHistory
          • +
          • Browser/AllowSideloadingOfExtensions
          • +
          • Browser/AllowTabPreloading
          • +
          • Browser/AllowWebContentOnNewTabPage
          • +
          • Browser/ConfigureFavoritesBar
          • +
          • Browser/ConfigureHomeButton
          • +
          • Browser/ConfigureKioskMode
          • +
          • Browser/ConfigureKioskResetAfterIdleTimeout
          • +
          • Browser/ConfigureOpenMicrosoftEdgeWith
          • +
          • Browser/ConfigureTelemetryForMicrosoft365Analytics
          • +
          • Browser/PreventCertErrorOverrides
          • +
          • Browser/SetHomeButtonURL
          • +
          • Browser/SetNewTabPageURL
          • +
          • Browser/UnlockHomeButton
          • +
          • Experience/DoNotSyncBrowserSettings
          • +
          • Experience/PreventUsersFromTurningOnBrowserSyncing
          • +
          • Kerberos/UPNNameHints
          • +
          • Privacy/AllowCrossDeviceClipboard
          • +
          • Privacy/DisablePrivacyExperience
          • +
          • Privacy/UploadUserActivities
          • +
          • System/AllowDeviceNameInDiagnosticData
          • +
          • System/ConfigureMicrosoft365UploadEndpoint
          • +
          • System/DisableDeviceDelete
          • +
          • System/DisableDiagnosticDataViewer
          • +
          • Storage/RemovableDiskDenyWriteAccess
          • +
          • Update/UpdateNotificationLevel
          • +
          +

          Start/DisableContextMenus - added in Windows 10, version 1803.

          +

          RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

          +
          + +## July 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          AssignedAccess CSP

          Added the following note:

          +
            +
          • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
          • +
          +
          PassportForWork CSP

          Added new settings in Windows 10, version 1809.

          +
          EnterpriseModernAppManagement CSP

          Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

          +
          Win32CompatibilityAppraiser CSP

          Added new configuration service provider in Windows 10, version 1809.

          +
          WindowsLicensing CSP

          Added S mode settings and SyncML examples in Windows 10, version 1809.

          +
          SUPL CSP

          Added 3 new certificate nodes in Windows 10, version 1809.

          +
          Defender CSP

          Added a new node Health/ProductStatus in Windows 10, version 1809.

          +
          BitLocker CSP

          Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

          +
          DevDetail CSP

          Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

          +
          Policy CSP

          Added the following new policies in Windows 10, version 1809:

          +
            +
          • ApplicationManagement/LaunchAppAfterLogOn
          • +
          • ApplicationManagement/ScheduleForceRestartForUpdateFailures
          • +
          • Authentication/EnableFastFirstSignIn (Preview mode only)
          • +
          • Authentication/EnableWebSignIn (Preview mode only)
          • +
          • Authentication/PreferredAadTenantDomainName
          • +
          • Defender/CheckForSignaturesBeforeRunningScan
          • +
          • Defender/DisableCatchupFullScan
          • +
          • Defender/DisableCatchupQuickScan
          • +
          • Defender/EnableLowCPUPriority
          • +
          • Defender/SignatureUpdateFallbackOrder
          • +
          • Defender/SignatureUpdateFileSharesSources
          • +
          • DeviceGuard/ConfigureSystemGuardLaunch
          • +
          • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
          • +
          • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
          • +
          • DeviceInstallation/PreventDeviceMetadataFromNetwork
          • +
          • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
          • +
          • DmaGuard/DeviceEnumerationPolicy
          • +
          • Experience/AllowClipboardHistory
          • +
          • Security/RecoveryEnvironmentAuthentication
          • +
          • TaskManager/AllowEndTask
          • +
          • WindowsDefenderSecurityCenter/DisableClearTpmButton
          • +
          • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
          • +
          • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
          • +
          • WindowsLogon/DontDisplayNetworkSelectionUI
          • +
          +

          Recent changes:

          +
            +
          • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
          • +
          +
          + +## June 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          Wifi CSP

          Added a new node WifiCost in Windows 10, version 1809.

          +
          Diagnose MDM failures in Windows 10

          Recent changes:

          +
            +
          • Added procedure for collecting logs remotely from Windows 10 Holographic.
          • +
          • Added procedure for downloading the MDM Diagnostic Information log.
          • +
          +
          BitLocker CSP

          Added new node AllowStandardUserEncryption in Windows 10, version 1809.

          +
          Policy CSP

          Recent changes:

          +
            +
          • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
          • +
          • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
          • +
          • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
          • +
          • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
          • +
          • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
          • +
          • Security/RequireDeviceEncryption is supported in the Home SKU.
          • +
          • Start/StartLayout - added a table of SKU support information.
          • +
          • Start/ImportEdgeAssets - added a table of SKU support information.
          • +
          +

          Added the following new policies in Windows 10, version 1809:

          +
            +
          • Update/EngagedRestartDeadlineForFeatureUpdates
          • +
          • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
          • +
          • Update/EngagedRestartTransitionScheduleForFeatureUpdates
          • +
          • Update/SetDisablePauseUXAccess
          • +
          • Update/SetDisableUXWUAccess
          • +
          +
          WiredNetwork CSPNew CSP added in Windows 10, version 1809. +
          + +## May 2018 + + ++++ + + + + + + + + + + + +
          New or updated articleDescription
          Policy DDF file

          Updated the DDF files in the Windows 10 version 1703 and 1709.

          + +
          + +## April 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          WindowsDefenderApplicationGuard CSP

          Added the following node in Windows 10, version 1803:

          +
            +
          • Settings/AllowVirtualGPU
          • +
          • Settings/SaveFilesToHost
          • +
          +
          NetworkProxy CSP

          Added the following node in Windows 10, version 1803:

          +
            +
          • ProxySettingsPerUser
          • +
          +
          Accounts CSP

          Added a new CSP in Windows 10, version 1803.

          +
          MDM Migration Analysis Tool (MMAT)

          Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

          +
          CSP DDF files download

          Added the DDF download of Windows 10, version 1803 configuration service providers.

          +
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          +
            +
          • Bluetooth/AllowPromptedProximalConnections
          • +
          • KioskBrowser/EnableEndSessionButton
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
          • +
          +
          + +## March 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          eUICCs CSP

          Added the following node in Windows 10, version 1803:

          +
            +
          • IsEnabled
          • +
          +
          DeviceStatus CSP

          Added the following node in Windows 10, version 1803:

          +
            +
          • OS/Mode
          • +
          +
          Understanding ADMX-backed policies

          Added the following videos:

          + +
          AccountManagement CSP

          Added a new CSP in Windows 10, version 1803.

          +
          RootCATrustedCertificates CSP

          Added the following node in Windows 10, version 1803:

          +
            +
          • UntrustedCertificates
          • +
          +
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          +
            +
          • ApplicationDefaults/EnableAppUriHandlers
          • +
          • ApplicationManagement/MSIAllowUserControlOverInstall
          • +
          • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
          • +
          • Connectivity/AllowPhonePCLinking
          • +
          • Notifications/DisallowCloudNotification
          • +
          • Notifications/DisallowTileNotification
          • +
          • RestrictedGroups/ConfigureGroupMembership
          • +
          +

          The following existing policies were updated:

          +
            +
          • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
          • +
          • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
          • +
          • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
          • +
          +

          Added a new section:

          + +
          Policy CSP - Bluetooth

          Added new section ServicesAllowedList usage guide.

          +
          MultiSIM CSP

          Added SyncML examples and updated the settings descriptions.

          +
          RemoteWipe CSP

          Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

          +
          + +## February 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          +
            +
          • Display/DisablePerProcessDpiForApps
          • +
          • Display/EnablePerProcessDpi
          • +
          • Display/EnablePerProcessDpiForApps
          • +
          • Experience/AllowWindowsSpotlightOnSettings
          • +
          • TextInput/ForceTouchKeyboardDockedState
          • +
          • TextInput/TouchKeyboardDictationButtonAvailability
          • +
          • TextInput/TouchKeyboardEmojiButtonAvailability
          • +
          • TextInput/TouchKeyboardFullModeAvailability
          • +
          • TextInput/TouchKeyboardHandwritingModeAvailability
          • +
          • TextInput/TouchKeyboardNarrowModeAvailability
          • +
          • TextInput/TouchKeyboardSplitModeAvailability
          • +
          • TextInput/TouchKeyboardWideModeAvailability
          • +
              +
          VPNv2 ProfileXML XSD

          Updated the XSD and Plug-in profile example for VPNv2 CSP.

          +
          AssignedAccess CSP

          Added the following nodes in Windows 10, version 1803:

          +
            +
          • Status
          • +
          • ShellLauncher
          • +
          • StatusConfiguration
          • +
          +

          Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

          +
          MultiSIM CSP

          Added a new CSP in Windows 10, version 1803.

          +
          EnterpriseModernAppManagement CSP

          Added the following node in Windows 10, version 1803:

          +
            +
          • MaintainProcessorArchitectureOnUpdate
          • +
          +
          + +## January 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          +
            +
          • Browser/AllowConfigurationUpdateForBooksLibrary
          • +
          • Browser/AlwaysEnableBooksLibrary
          • +
          • Browser/EnableExtendedBooksTelemetry
          • +
          • Browser/UseSharedFolderForBooks
          • +
          • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
          • +
          • DeliveryOptimization/DODelayForegroundDownloadFromHttp
          • +
          • DeliveryOptimization/DOGroupIdSource
          • +
          • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
          • +
          • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
          • +
          • DeliveryOptimization/DORestrictPeerSelectionBy
          • +
          • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
          • +
          • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
          • +
          • KioskBrowser/BlockedUrlExceptions
          • +
          • KioskBrowser/BlockedUrls
          • +
          • KioskBrowser/DefaultURL
          • +
          • KioskBrowser/EnableHomeButton
          • +
          • KioskBrowser/EnableNavigationButtons
          • +
          • KioskBrowser/RestartOnIdleTime
          • +
          • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
          • +
          • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
          • +
          • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
          • +
          • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
          • +
          • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
          • +
          • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
          • +
          • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
          • +
          • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
          • +
          • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
          • +
          • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
          • +
          • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
          • +
          • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
          • +
          • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
          • +
          • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
          • +
          • RestrictedGroups/ConfigureGroupMembership
          • +
          • Search/AllowCortanaInAAD
          • +
          • Search/DoNotUseWebResults
          • +
          • Security/ConfigureWindowsPasswords
          • +
          • System/FeedbackHubAlwaysSaveDiagnosticsLocally
          • +
          • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
          • +
          • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
          • +
          • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
          • +
          • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
          • +
          • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
          • +
          • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
          • +
          • TaskScheduler/EnableXboxGameSaveTask
          • +
          • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
          • +
          • Update/ConfigureFeatureUpdateUninstallPeriod
          • +
          • UserRights/AccessCredentialManagerAsTrustedCaller
          • +
          • UserRights/AccessFromNetwork
          • +
          • UserRights/ActAsPartOfTheOperatingSystem
          • +
          • UserRights/AllowLocalLogOn
          • +
          • UserRights/BackupFilesAndDirectories
          • +
          • UserRights/ChangeSystemTime
          • +
          • UserRights/CreateGlobalObjects
          • +
          • UserRights/CreatePageFile
          • +
          • UserRights/CreatePermanentSharedObjects
          • +
          • UserRights/CreateSymbolicLinks
          • +
          • UserRights/CreateToken
          • +
          • UserRights/DebugPrograms
          • +
          • UserRights/DenyAccessFromNetwork
          • +
          • UserRights/DenyLocalLogOn
          • +
          • UserRights/DenyRemoteDesktopServicesLogOn
          • +
          • UserRights/EnableDelegation
          • +
          • UserRights/GenerateSecurityAudits
          • +
          • UserRights/ImpersonateClient
          • +
          • UserRights/IncreaseSchedulingPriority
          • +
          • UserRights/LoadUnloadDeviceDrivers
          • +
          • UserRights/LockMemory
          • +
          • UserRights/ManageAuditingAndSecurityLog
          • +
          • UserRights/ManageVolume
          • +
          • UserRights/ModifyFirmwareEnvironment
          • +
          • UserRights/ModifyObjectLabel
          • +
          • UserRights/ProfileSingleProcess
          • +
          • UserRights/RemoteShutdown
          • +
          • UserRights/RestoreFilesAndDirectories
          • +
          • UserRights/TakeOwnership
          • +
          • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
          • +
          • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
          • +
          • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
          • +
          • WindowsDefenderSecurityCenter/HideSecureBoot
          • +
          • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
          • +
          +

          Added the following policies the were added in Windows 10, version 1709

          +
            +
          • DeviceLock/MinimumPasswordAge
          • +
          • Settings/AllowOnlineTips
          • +
          • System/DisableEnterpriseAuthProxy
          • +
          +

          Security/RequireDeviceEncryption - updated to show it is supported in desktop.

          +
          BitLocker CSP

          Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

          +
          EnterpriseModernAppManagement CSP

          Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

          +
          DMClient CSP

          Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

          +
            +
          • AADSendDeviceToken
          • +
          • BlockInStatusPage
          • +
          • AllowCollectLogsButton
          • +
          • CustomErrorText
          • +
          • SkipDeviceStatusPage
          • +
          • SkipUserStatusPage
          • +
          +
          Defender CSP

          Added new node (OfflineScan) in Windows 10, version 1803.

          +
          UEFI CSP

          Added a new CSP in Windows 10, version 1803.

          +
          Update CSP

          Added the following nodes in Windows 10, version 1803:

          +
            +
          • Rollback
          • +
          • Rollback/FeatureUpdate
          • +
          • Rollback/QualityUpdateStatus
          • +
          • Rollback/FeatureUpdateStatus
          • +
          +
          + +## December 2017 + + ++++ + + + + + + + + + + + +
          New or updated articleDescription
          Configuration service provider reference

          Added new section CSP DDF files download

          +
          + +## November 2017 + + ++++ + + + + + + + + + + + +
          New or updated articleDescription
          Policy CSP

          Added the following policies for Windows 10, version 1709:

          +
            +
          • Authentication/AllowFidoDeviceSignon
          • +
          • Cellular/LetAppsAccessCellularData
          • +
          • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
          • +
          • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
          • +
          • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
          • +
          • Start/HidePeopleBar
          • +
          • Storage/EnhancedStorageDevices
          • +
          • Update/ManagePreviewBuilds
          • +
          • WirelessDisplay/AllowMdnsAdvertisement
          • +
          • WirelessDisplay/AllowMdnsDiscovery
          • +
          +

          Added missing policies from previous releases:

          +
            +
          • Connectivity/DisallowNetworkConnectivityActiveTest
          • +
          • Search/AllowWindowsIndexer
          • +
          +
          + +## October 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          Policy DDF file

          Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

          +
          Policy CSP

          Updated the following policies:

          +
            +
          • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
          • +
          • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
          • +
          +
          eUICCs CSP

          Added new CSP in Windows 10, version 1709.

          +
          AssignedAccess CSP

          Added SyncML examples for the new Configuration node.

          +
          DMClient CSP

          Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

          +
          + +## September 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          Policy CSP

          Added the following new policies for Windows 10, version 1709:

          +
            +
          • Authentication/AllowAadPasswordReset
          • +
          • Handwriting/PanelDefaultModeDocked
          • +
          • Search/AllowCloudSearch
          • +
          • System/LimitEnhancedDiagnosticDataWindowsAnalytics
          • +
          +

          Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

          +
          AssignedAccess CSP

          Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

          +
          Microsoft Store for Business and Microsoft Store

          Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

          +
          The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

          The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

          +
            +
          • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
          • +
          • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
          • +
          • DomainName - fully qualified domain name if the device is domain-joined.
          • +
          +

          For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

          +
          EnterpriseAPN CSP

          Added a SyncML example.

          +
          VPNv2 CSP

          Added RegisterDNS setting in Windows 10, version 1709.

          +
          Enroll a Windows 10 device automatically using Group Policy

          Added new topic to introduce a new Group Policy for automatic MDM enrollment.

          +
          MDM enrollment of Windows-based devices

          New features in the Settings app:

          +
            +
          • User sees installation progress of critical policies during MDM enrollment.
          • +
          • User knows what policies, profiles, apps MDM has configured
          • +
          • IT helpdesk can get detailed MDM diagnostic information using client tools
          • +
          +

          For details, see Managing connections and Collecting diagnostic logs

          +
          + +## August 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          New or updated articleDescription
          Enable ADMX-backed policies in MDM

          Added new step-by-step guide to enable ADMX-backed policies.

          +
          Mobile device enrollment

          Added the following statement:

          +
            +
          • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
          • +
          +
          CM_CellularEntries CSP

          Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

          +
          EnterpriseDataProtection CSP

          Updated the Settings/EDPEnforcementLevel values to the following:

          +
            +
          • 0 (default) – Off / No protection (decrypts previously protected data).
          • +
          • 1 – Silent mode (encrypt and audit only).
          • +
          • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
          • +
          • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
          • +
          +
          AppLocker CSP

          Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Allow list examples.

          +
          DeviceManageability CSP

          Added the following settings in Windows 10, version 1709:

          +
            +
          • Provider/ProviderID/ConfigInfo
          • +
          • Provider/ProviderID/EnrollmentInfo
          • +
          +
          Office CSP

          Added the following setting in Windows 10, version 1709:

          +
            +
          • Installation/CurrentStatus
          • +
          +
          BitLocker CSPAdded information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. +
          Firewall CSPUpdated the CSP and DDF topics. Here are the changes: +
            +
          • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
          • +
          • Changed some data types from integer to bool.
          • +
          • Updated the list of supported operations for some settings.
          • +
          • Added default values.
          • +
          +
          Policy DDF fileAdded another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: +
            +
          • Browser/AllowMicrosoftCompatibilityList
          • +
          • Update/DisableDualScan
          • +
          • Update/FillEmptyContentUrls
          • +
          +
          Policy CSP

          Added the following new policies for Windows 10, version 1709:

          +
            +
          • Browser/ProvisionFavorites
          • +
          • Browser/LockdownFavorites
          • +
          • ExploitGuard/ExploitProtectionSettings
          • +
          • Games/AllowAdvancedGamingServices
          • +
          • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
          • +
          • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
          • +
          • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
          • +
          • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
          • +
          • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
          • +
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
          • +
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
          • +
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
          • +
          • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
          • +
          • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
          • +
          • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
          • +
          • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
          • +
          • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
          • +
          • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
          • +
          • Privacy/EnableActivityFeed
          • +
          • Privacy/PublishUserActivities
          • +
          • Update/DisableDualScan
          • +
          • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
          • +
          +

          Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

          +

          Changed the names of the following policies:

          +
            +
          • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
          • +
          • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
          • +
          • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
          • +
          +

          Added links to the additional ADMX-backed BitLocker policies.

          +

          There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

          +
            +
          • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
          • +
          • Start/HideAppList
          • +
          +
          diff --git a/windows/client-management/mdm/cleanpc-csp.md b/windows/client-management/mdm/cleanpc-csp.md index 5b7d432911..c70da05dae 100644 --- a/windows/client-management/mdm/cleanpc-csp.md +++ b/windows/client-management/mdm/cleanpc-csp.md @@ -1,6 +1,6 @@ --- title: CleanPC CSP -description: The CleanPC configuration service provider (CSP) allows removal of user-installed and pre-installed applications, with the option to persist user data. This CSP was added in Windows 10, version 1703. +description: The CleanPC configuration service provider (CSP) allows you to remove user-installed and pre-installed applications, with the option to persist user data. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index 41612181c5..0337dad577 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -1,6 +1,6 @@ --- title: ClientCertificateInstall CSP -description: ClientCertificateInstall CSP +description: The ClientCertificateInstall configuration service provider (CSP) enables the enterprise to install client certificates. ms.assetid: B624EB73-2972-47F2-9D7E-826D641BF8A7 ms.reviewer: manager: dansimp @@ -9,52 +9,50 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 10/16/2018 +ms.date: 02/28/2020 --- # ClientCertificateInstall CSP - -The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the *\[UniqueID\]* for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request. +The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the *\[UniqueID\]* for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request. For PFX certificate installation and SCEP installation, the SyncML commands must be wrapped in atomic commands to ensure enrollment execution is not triggered until all settings are configured. The Enroll command must be the last item in the atomic block. -> **Note**   -Currently in Windows 10, version 1511, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We are working to fix this issue. +> [!Note] +> Currently in Windows 10, version 1511, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We are working to fix this issue. You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. - The following image shows the ClientCertificateInstall configuration service provider in tree format. ![clientcertificateinstall csp](images/provisioning-csp-clientcertificateinstall.png) -**Device or User** -

          For device certificates, use ./Device/Vendor/MSFT path and for user certificates use ./User/Vendor/MSFT path. +**Device or User** +For device certificates, use ./Device/Vendor/MSFT path and for user certificates use ./User/Vendor/MSFT path. -**ClientCertificateInstall** -

          The root node for the ClientCertificateInstaller configuration service provider. +**ClientCertificateInstall** +The root node for the ClientCertificateInstaller configuration service provider. -**ClientCertificateInstall/PFXCertInstall** -

          Required for PFX certificate installation. The parent node grouping the PFX certificate related settings. +**ClientCertificateInstall/PFXCertInstall** +Required for PFX certificate installation. The parent node grouping the PFX certificate related settings. -

          Supported operation is Get. +Supported operation is Get. -**ClientCertificateInstall/PFXCertInstall/***UniqueID* -

          Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. +**ClientCertificateInstall/PFXCertInstall/***UniqueID* +Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. -

          The data type format is node. +The data type format is node. -

          Supported operations are Get, Add, and Replace. +Supported operations are Get, Add, and Replace. -

          Calling Delete on this node should delete the certificates and the keys that were installed by the corresponding PFX blob. +Calling Delete on this node should delete the certificates and the keys that were installed by the corresponding PFX blob. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/KeyLocation** -

          Required for PFX certificate installation. Indicates the KeyStorage provider to target the private key installation to. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/KeyLocation** +Required for PFX certificate installation. Indicates the KeyStorage provider to target the private key installation to. -

          Supported operations are Get, Add, and Replace. +Supported operations are Get, Add, and Replace. -

          The data type is an integer corresponding to one of the following values: +The data type is an integer corresponding to one of the following values: | Value | Description | |-------|---------------------------------------------------------------------------------------------------------------| @@ -63,226 +61,227 @@ The following image shows the ClientCertificateInstall configuration service pro | 3 | Install to software. | | 4 | Install to Windows Hello for Business (formerly known as Microsoft Passport for Work) whose name is specified | +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/ContainerName** +Optional. Specifies the Windows Hello for Business (formerly known as Microsoft Passport for Work) container name (if Windows Hello for Business storage provider (KSP) is chosen for the KeyLocation). If this node is not specified when Windows Hello for Business KSP is chosen, enrollment will fail. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/ContainerName** -

          Optional. Specifies the Windows Hello for Business (formerly known as Microsoft Passport for Work) container name (if Windows Hello for Business storage provider (KSP) is chosen for the KeyLocation). If this node is not specified when Windows Hello for Business KSP is chosen, enrollment will fail. +Date type is string. -

          Date type is string. +Supported operations are Get, Add, Delete, and Replace. -

          Supported operations are Get, Add, Delete, and Replace. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertBlob** +CRYPT_DATA_BLOB structure that contains a PFX packet with the exported and encrypted certificates and keys. The Add operation triggers the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, KeyExportable) are present before this is called. This also sets the Status node to the current Status of the operation. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertBlob** -

          CRYPT_DATA_BLOB structure that contains a PFX packet with the exported and encrypted certificates and keys. The Add operation triggers the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, KeyExportable) are present before this is called. This also sets the Status node to the current Status of the operation. +The data type format is binary. -

          The data type format is binary. +Supported operations are Get, Add, and Replace. -

          Supported operations are Get, Add, and Replace. +If a blob already exists, the Add operation will fail. If Replace is called on this node, the existing certificates are overwritten. -

          If a blob already exists, the Add operation will fail. If Replace is called on this node, the existing certificates are overwritten. +If Add is called on this node for a new PFX, the certificate will be added. When a certificate does not exist, Replace operation on this node will fail. -

          If Add is called on this node for a new PFX, the certificate will be added. When a certificate does not exist, Replace operation on this node will fail. +In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate CRYPT_DATA_BLOB, which can be found in CRYPT_INTEGER_BLOB. -

          In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate CRYPT_DATA_BLOB, which can be found in CRYPT_INTEGER_BLOB. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPassword** +Password that protects the PFX blob. This is required if the PFX is password protected. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPassword** -

          Password that protects the PFX blob. This is required if the PFX is password protected. +Data Type is a string. -

          Data Type is a string. +Supported operations are Get, Add, and Replace. -

          Supported operations are Get, Add, and Replace. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionType** +Optional. Used to specify whether the PFX certificate password is encrypted with the MDM certificate by the MDM server. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionType** -

          Optional. Used to specify whether the PFX certificate password is encrypted with the MDM certificate by the MDM server. - -

          The data type is int. Valid values: +The data type is int. Valid values: - 0 - Password is not encrypted. - 1 - Password is encrypted with the MDM certificate. - 2 - Password is encrypted with custom certificate. -

          When PFXCertPasswordEncryptionType =2, you must specify the store name in PFXCertPasswordEncryptionStore setting. +When PFXCertPasswordEncryptionType =2, you must specify the store name in PFXCertPasswordEncryptionStore setting. -

          Supported operations are Get, Add, and Replace. +Supported operations are Get, Add, and Replace. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXKeyExportable** -

          Optional. Used to specify if the private key installed is exportable (and can be exported later). The PFX is not exportable when it is installed to TPM. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXKeyExportable** +Optional. Used to specify if the private key installed is exportable (and can be exported later). The PFX is not exportable when it is installed to TPM. -> **Note**  You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. +> [!Note] +> You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. - -

          The data type bool. +The data type bool. -

          Supported operations are Get, Add, and Replace. +Supported operations are Get, Add, and Replace. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Thumbprint** -

          Returns the thumbprint of the installed PFX certificate. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Thumbprint** +Returns the thumbprint of the installed PFX certificate. -

          The datatype is a string. +The datatype is a string. -

          Supported operation is Get. +Supported operation is Get. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Status** -

          Required. Returns the error code of the PFX installation from the GetLastError command called after the PfxImportCertStore. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Status** +Required. Returns the error code of the PFX installation from the GetLastError command called after the PfxImportCertStore. -

          Data type is an integer. +Data type is an integer. -

          Supported operation is Get. +Supported operation is Get. -**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionStore** -

          Added in Windows 10, version 1511. When PFXCertPasswordEncryptionType = 2, it specifies the store name of the certificate used for decrypting the PFXCertPassword. - -

          Data type is string. - -

          Supported operations are Add, Get, and Replace. - -**ClientCertificateInstall/SCEP** -

          Node for SCEP. - -> **Note**  An alert is sent after the SCEP certificate is installed. - - -**ClientCertificateInstall/SCEP/***UniqueID* -

          A unique ID to differentiate different certificate installation requests. - - -**ClientCertificateInstall/SCEP/*UniqueID*/Install** -

          A node required for SCEP certificate enrollment. Parent node to group SCEP cert installation related requests. - -

          Supported operations are Get, Add, Replace, and Delete. - -> **Note**  Although the child nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values that are set when the Exec command is accepted. The server should not expect the node value change after Exec command is accepted, as it will impact the current enrollment underway. The server should check the Status node value and make sure the device is not at an unknown state before changing child node values. - - -**ClientCertificateInstall/SCEP/*UniqueID*/Install/ServerURL** -

          Required for SCEP certificate enrollment. Specifies the certificate enrollment server. Multiple server URLs can be listed, separated by semicolons. - -

          Data type is string. - -

          Supported operations are Get, Add, Delete, and Replace. - -**ClientCertificateInstall/SCEP/*UniqueID*/Install/Challenge** -

          Required for SCEP certificate enrollment. B64 encoded SCEP enrollment challenge. Challenge is deleted shortly after the Exec command is accepted. - -

          Data type is string. - -

          Supported operations are Add, Get, Delete, and Replace. - -**ClientCertificateInstall/SCEP/*UniqueID*/Install/EKUMapping** -

          Required. Specifies extended key usages. Subject to SCEP server configuration. The list of OIDs are separated by a plus +. For example, OID1+OID2+OID3. +**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionStore** +Added in Windows 10, version 1511. When PFXCertPasswordEncryptionType = 2, it specifies the store name of the certificate used for decrypting the PFXCertPassword. Data type is string. -

          Required for enrollment. Specifies the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have the second (0x20), fourth (0x80) or both bits set. If the value doesn’t have those bits set, the configuration will fail. -

          Data type is int. +Supported operations are Add, Get, and Replace. -

          Supported operations are Add, Get, Delete, and Replace. +**ClientCertificateInstall/SCEP** +Node for SCEP. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectName** -

          Required. Specifies the subject name. +> [!Note] +> An alert is sent after the SCEP certificate is installed. -

          Data type is string. +**ClientCertificateInstall/SCEP/***UniqueID* +A unique ID to differentiate different certificate installation requests. -

          Supported operations are Add, Get, and Replace. +**ClientCertificateInstall/SCEP/*UniqueID*/Install** +A node required for SCEP certificate enrollment. Parent node to group SCEP cert installation related requests. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyProtection** -

          Optional. Specifies where to keep the private key. +Supported operations are Get, Add, Replace, and Delete. -> **Note**  Even if the private key is protected by TPM, it is not protected with a TPM PIN. +> [!Note] +> Although the child nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values that are set when the Exec command is accepted. The server should not expect the node value change after Exec command is accepted, as it will impact the current enrollment underway. The server should check the Status node value and make sure the device is not at an unknown state before changing child node values. - -

          The data type is an integer corresponding to one of the following values: +**ClientCertificateInstall/SCEP/*UniqueID*/Install/ServerURL** +Required for SCEP certificate enrollment. Specifies the certificate enrollment server. Multiple server URLs can be listed, separated by semicolons. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**ClientCertificateInstall/SCEP/*UniqueID*/Install/Challenge** +Required for SCEP certificate enrollment. B64 encoded SCEP enrollment challenge. Challenge is deleted shortly after the Exec command is accepted. + +Data type is string. + +Supported operations are Add, Get, Delete, and Replace. + +**ClientCertificateInstall/SCEP/*UniqueID*/Install/EKUMapping** +Required. Specifies extended key usages. Subject to SCEP server configuration. The list of OIDs are separated by a plus +. For example, OID1+OID2+OID3. + +Data type is string. +Required for enrollment. Specifies the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have the second (0x20), fourth (0x80) or both bits set. If the value doesn’t have those bits set, the configuration will fail. + +Data type is int. + +Supported operations are Add, Get, Delete, and Replace. + +**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectName** +Required. Specifies the subject name. + +The SubjectName value is quoted if it contains leading or trailing white space or one of the following characters: (“,” “=” “+” “;” ). + +For more details, see [CertNameToStrA function](https://docs.microsoft.com/windows/win32/api/wincrypt/nf-wincrypt-certnametostra#remarks). + +Data type is string. + +Supported operations are Add, Get, and Replace. + +**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyProtection** +Optional. Specifies where to keep the private key. + +> [!Note] +> Even if the private key is protected by TPM, it is not protected with a TPM PIN. + +The data type is an integer corresponding to one of the following values: | Value | Description | |-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 | Private key protected by TPM. | | 2 | Private key protected by phone TPM if the device supports TPM. All Windows Phone 8.1 devices support TPM and will treat value 2 as 1. | | 3 | (Default) Private key saved in software KSP. | -| 4 | Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specifed, otherwise enrollment will fail. | +| 4 | Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specified, otherwise enrollment will fail. | - -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyUsage** -

          Required for enrollment. Specify the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have second (0x20) or forth (0x80) or both bits set. If the value doesn’t have those bits set, configuration will fail. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyUsage** +Required for enrollment. Specify the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have second (0x20) or forth (0x80) or both bits set. If the value doesn’t have those bits set, configuration will fail. -

          Supported operations are Add, Get, Delete, and Replace. Value type is integer. + Supported operations are Add, Get, Delete, and Replace. Value type is integer. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryDelay** -

          Optional. When the SCEP server sends a pending status, this value specifies the device retry waiting time in minutes. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryDelay** +Optional. When the SCEP server sends a pending status, this value specifies the device retry waiting time in minutes. -

          Data type format is an integer. +Data type format is an integer. -

          The default value is 5. +The default value is 5. -

          The minimum value is 1. +The minimum value is 1. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryCount** -

          Optional. Unique to SCEP. Specifies the device retry times when the SCEP server sends a pending status. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryCount** +Optional. Unique to SCEP. Specifies the device retry times when the SCEP server sends a pending status. -

          Data type is integer. +Data type is integer. -

          Default value is 3. +Default value is 3. -

          Maximum value is 30. If the value is larger than 30, the device will use 30. +Maximum value is 30. If the value is larger than 30, the device will use 30. -

          Minimum value is 0, which indicates no retry. +Minimum value is 0, which indicates no retry. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/TemplateName** -

          Optional. OID of certificate template name. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/TemplateName** +Optional. OID of certificate template name. -> **Note**  This name is typically ignored by the SCEP server; therefore the MDM server typically doesn’t need to provide it. +> [!Note] +> This name is typically ignored by the SCEP server; therefore the MDM server typically doesn’t need to provide it. - -

          Data type is string. +Data type is string. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyLength** -

          Required for enrollment. Specify private key length (RSA). +**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyLength** +Required for enrollment. Specify private key length (RSA). -

          Data type is integer. +Data type is integer. -

          Valid values are 1024, 2048, and 4096. +Valid values are 1024, 2048, and 4096. -

          For Windows Hello for Business (formerly known as Microsoft Passport for Work) , only 2048 is the supported key length. +For Windows Hello for Business (formerly known as Microsoft Passport for Work) , only 2048 is the supported key length. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/HashAlgorithm** -

          Required. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated with +. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/HashAlgorithm** +Required. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated with +. -

          For Windows Hello for Business, only SHA256 is the supported algorithm. +For Windows Hello for Business, only SHA256 is the supported algorithm. -

          Data type is string. +Data type is string. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/CAThumbprint** -

          Required. Specifies Root CA thumbprint. This is a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates the SCEP server, it checks the CA certificate from the SCEP server to verify a match with this certificate. If it is not a match, the authentication will fail. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/CAThumbprint** +Required. Specifies Root CA thumbprint. This is a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates the SCEP server, it checks the CA certificate from the SCEP server to verify a match with this certificate. If it is not a match, the authentication will fail. -

          Data type is string. +Data type is string. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectAlternativeNames** -

          Optional. Specifies subject alternative names (SAN). Multiple alternative names can be specified by this node. Each name is the combination of name format+actual name. Refer to the name type definitions in MSDN for more information. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectAlternativeNames** +Optional. Specifies subject alternative names (SAN). Multiple alternative names can be specified by this node. Each name is the combination of name format+actual name. Refer to the name type definitions in MSDN for more information. -

          Each pair is separated by semicolon. For example, multiple SANs are presented in the format of [name format1]+[actual name1];[name format 2]+[actual name2]. +Each pair is separated by semicolon. For example, multiple SANs are presented in the format of [name format1]+[actual name1];[name format 2]+[actual name2]. -

          Data type is string. +Data type is string. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriod** -

          Optional. Specifies the units for the valid certificate period. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriod** +Optional. Specifies the units for the valid certificate period. -

          Data type is string. +Data type is string. -

          Valid values are: +Valid values are: - Days (Default) - Months @@ -290,62 +289,61 @@ Data type is string. > **Note**  The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) to the SCEP server as part of certificate enrollment request. Depending on the server configuration, the server defines how to use this valid period to create the certificate. - -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriodUnits** -

          Optional. Specifies the desired number of units used in the validity period. This is subject to SCEP server configuration. Default value is 0. The unit type (days, months, or years) are defined in the ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in the certificate template. For example, if ValidPeriod is Days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriodUnits** +Optional. Specifies the desired number of units used in the validity period. This is subject to SCEP server configuration. Default value is 0. The unit type (days, months, or years) are defined in the ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in the certificate template. For example, if ValidPeriod is Days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. -

          Data type is string. +Data type is string. ->**Note**  The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) to the SCEP server as part of certificate enrollment request. Depending on the server configuration, the server defines how to use this valid period to create the certificate. +> [!Note] +> The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) to the SCEP server as part of certificate enrollment request. Depending on the server configuration, the server defines how to use this valid period to create the certificate. - -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/ContainerName** -

          Optional. Specifies the Windows Hello for Business container name (if Windows Hello for Business KSP is chosen for the node). If this node is not specified when Windows Hello for Business KSP is chosen, the enrollment will fail. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/ContainerName** +Optional. Specifies the Windows Hello for Business container name (if Windows Hello for Business KSP is chosen for the node). If this node is not specified when Windows Hello for Business KSP is chosen, the enrollment will fail. -

          Data type is string. +Data type is string. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/CustomTextToShowInPrompt** -

          Optional. Specifies the custom text to show on the Windows Hello for Business PIN prompt during certificate enrollment. The admin can choose to provide more contextual information in this field for why the user needs to enter the PIN and what the certificate will be used for. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/CustomTextToShowInPrompt** +Optional. Specifies the custom text to show on the Windows Hello for Business PIN prompt during certificate enrollment. The admin can choose to provide more contextual information in this field for why the user needs to enter the PIN and what the certificate will be used for. -

          Data type is string. +Data type is string. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/Enroll** -

          Required. Triggers the device to start the certificate enrollment. The device will not notify MDM server after certificate enrollment is done. The MDM server could later query the device to find out whether new certificate is added. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/Enroll** +Required. Triggers the device to start the certificate enrollment. The device will not notify MDM server after certificate enrollment is done. The MDM server could later query the device to find out whether new certificate is added. -

          The date type format is Null, meaning this node doesn’t contain a value. +The date type format is Null, meaning this node doesn’t contain a value. -

          The only supported operation is Execute. +The only supported operation is Execute. -**ClientCertificateInstall/SCEP/*UniqueID*/Install/AADKeyIdentifierList** -

          Optional. Specify the AAD Key Identifier List as a list of semicolon separated values. On Enroll, the values in this list are validated against the AAD Key present on the device. If no match is found, enrollment will fail. +**ClientCertificateInstall/SCEP/*UniqueID*/Install/AADKeyIdentifierList** +Optional. Specify the AAD Key Identifier List as a list of semicolon separated values. On Enroll, the values in this list are validated against the AAD Key present on the device. If no match is found, enrollment will fail. -

          Data type is string. +Data type is string. -

          Supported operations are Add, Get, Delete, and Replace. +Supported operations are Add, Get, Delete, and Replace. -**ClientCertificateInstall/SCEP/*UniqueID*/CertThumbprint** -

          Optional. Specifies the current certificate’s thumbprint if certificate enrollment succeeds. It is a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. +**ClientCertificateInstall/SCEP/*UniqueID*/CertThumbprint** +Optional. Specifies the current certificate’s thumbprint if certificate enrollment succeeds. It is a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. -

          If the certificate on the device becomes invalid (Cert expired, Cert chain is not valid, private key deleted) then it will return an empty string. +If the certificate on the device becomes invalid (Cert expired, Cert chain is not valid, private key deleted) then it will return an empty string. -

          Data type is string. +Data type is string. -

          The only supported operation is Get. +The only supported operation is Get. -**ClientCertificateInstall/SCEP/*UniqueID*/Status** -

          Required. Specifies latest status of the certificated during the enrollment request. +**ClientCertificateInstall/SCEP/*UniqueID*/Status** +Required. Specifies latest status of the certificated during the enrollment request. -

          Data type is string. Valid values: +Data type is string. Valid values: -

          The only supported operation is Get. +The only supported operation is Get. | Value | Description | |-------|---------------------------------------------------------------------------------------------------| @@ -354,22 +352,20 @@ Data type is string. | 16 | Action failed | | 32 | Unknown | - -**ClientCertificateInstall/SCEP/*UniqueID*/ErrorCode** -

          Optional. An integer value that indicates the HRESULT of the last enrollment error code. +**ClientCertificateInstall/SCEP/*UniqueID*/ErrorCode** +Optional. An integer value that indicates the HRESULT of the last enrollment error code. -

          The only supported operation is Get. +The only supported operation is Get. **ClientCertificateInstall/SCEP/*UniqueID*/RespondentServerUrl** -

          Required. Returns the URL of the SCEP server that responded to the enrollment request. +Required. Returns the URL of the SCEP server that responded to the enrollment request. -

          Data type is string. +Data type is string. -

          The only supported operation is Get. +The only supported operation is Get. ## Example - Enroll a client certificate through SCEP. ```xml @@ -665,15 +661,4 @@ Add a PFX certificate. The PFX certificate password is encrypted with a custom c ## Related topics - [Configuration service provider reference](configuration-service-provider-reference.md) - - - - - - - - - - diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index 8601f82b20..ed787a3b0f 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -1,6 +1,6 @@ --- title: ClientCertificateInstall DDF file -description: ClientCertificateInstall DDF file +description: Learn about the OMA DM device description framework (DDF) for the ClientCertificateInstall configuration service provider. ms.assetid: 7F65D045-A750-4CDE-A1CE-7D152AA060CA ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 567dfd207e..5063181c3f 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -1,6 +1,6 @@ --- title: CM\_CellularEntries CSP -description: CM\_CellularEntries CSP +description: Learn how to configure the General Packet Radio Service (GPRS) entries using the CM\_CellularEntries CSP. ms.assetid: f8dac9ef-b709-4b76-b6f5-34c2e6a3c847 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cm-proxyentries-csp.md b/windows/client-management/mdm/cm-proxyentries-csp.md index 301c28ea8e..816b5c188b 100644 --- a/windows/client-management/mdm/cm-proxyentries-csp.md +++ b/windows/client-management/mdm/cm-proxyentries-csp.md @@ -1,6 +1,6 @@ --- title: CM\_ProxyEntries CSP -description: CM\_ProxyEntries CSP +description: Learn how the CM\_ProxyEntries configuration service provider is used to configure proxy connections on the mobile device. ms.assetid: f4c3dc71-c85a-4c68-9ce9-19f408ff7a0a ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index 1dfca8abb1..67872d03da 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -1,6 +1,6 @@ --- title: CMPolicy CSP -description: CMPolicy CSP +description: Learn how the CMPolicy configuration service provider (CSP) is used to define rules that the Connection Manager uses to identify correct connections. ms.assetid: 62623915-9747-4eb1-8027-449827b85e6b ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index 08d0040594..df773dcb43 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -1,6 +1,6 @@ --- title: CMPolicyEnterprise CSP -description: CMPolicyEnterprise CSP +description: Learn how the CMPolicyEnterprise CSP is used to define rules that the Connection Manager uses to identify the correct connection for a connection request. ms.assetid: A0BE3458-ABED-4F80-B467-F842157B94BF ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md index 1eb4a02627..5c1c136c23 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md +++ b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md @@ -1,6 +1,6 @@ --- title: CMPolicyEnterprise DDF file -description: CMPolicyEnterprise DDF file +description: Learn about the OMA DM device description framework (DDF) for the CMPolicyEnterprise configuration service provider. ms.assetid: 065EF07A-0CF3-4EE5-B620-3464A75B7EED ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 6889f31898..dcf8eec173 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/13/2019 +ms.date: 09/18/2020 --- # Configuration service provider reference -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - A configuration service provider (CSP) is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. Some configuration service providers support the WAP format, some support SyncML, and some support both. SyncML is only used over–the–air for Open Mobile Alliance Device Management (OMA DM), whereas WAP can be used over–the–air for OMA Client Provisioning, or it can be included in the phone image as a .provxml file that is installed during boot. For information about the bridge WMI provider classes that map to these CSPs, see [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224). For CSP DDF files, see [CSP DDF files download](#csp-ddf-files-download). @@ -1111,7 +1108,8 @@ Additional lists: Mobile Enterprise - cross mark + check mark +Only for mobile application management (MAM) check mark check mark @@ -1559,13 +1557,13 @@ Additional lists: Mobile Enterprise - cross mark - cross mark - cross mark - cross mark - cross mark - cross mark - cross mark + check mark + check mark + check mark + check mark + check mark + check mark + check mark @@ -2552,8 +2550,6 @@ Additional lists: - - [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) @@ -2701,8 +2697,9 @@ Additional lists: ## CSP DDF files download You can download the DDF files for various CSPs from the links below: -- [Download all the DDF files for Windows 10, version 1903](http://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) -- [Download all the DDF files for Windows 10, version 1809](http://download.microsoft.com/download/6/A/7/6A735141-5CFA-4C1B-94F4-B292407AF662/Windows10_1809_DDF_download.zip) +- [Download all the DDF files for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/Windows10_2004_DDF_download.zip) +- [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) +- [Download all the DDF files for Windows 10, version 1809](https://download.microsoft.com/download/6/A/7/6A735141-5CFA-4C1B-94F4-B292407AF662/Windows10_1809_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1803](https://download.microsoft.com/download/6/2/7/6276FE19-E3FD-4254-9C16-3C31CAA2DE50/Windows10_1803_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1709](https://download.microsoft.com/download/9/7/C/97C6CF99-F75C-475E-AF18-845F8CECCFA4/Windows10_1709_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) @@ -2716,29 +2713,32 @@ The following list shows the CSPs supported in HoloLens devices: | Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 | |------|--------|--------|--------| -| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) +| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | | [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | -| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | | [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | | [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | +| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | | [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | | [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | | [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| | [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | [PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | -| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | | [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | | [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [VPNv2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | @@ -2747,6 +2747,9 @@ The following list shows the CSPs supported in HoloLens devices: ## CSPs supported in Microsoft Surface Hub +- [Accounts CSP](accounts-csp.md)9 + > [!NOTE] + > Support in Surface Hub is limited to **Domain\ComputerName**. - [AccountManagement CSP](accountmanagement-csp.md) - [APPLICATION CSP](application-csp.md) - [CertificateStore CSP](certificatestore-csp.md) @@ -2760,18 +2763,21 @@ The following list shows the CSPs supported in HoloLens devices: - [DMAcc CSP](dmacc-csp.md) - [DMClient CSP](dmclient-csp.md) - [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +- [Firewall-CSP](firewall-csp.md)9 - [HealthAttestation CSP](healthattestation-csp.md) - [NetworkQoSPolicy CSP](networkqospolicy-csp.md) - [NodeCache CSP](nodecache-csp.md) - [PassportForWork CSP](passportforwork-csp.md) - [Policy CSP](policy-configuration-service-provider.md) - [Reboot CSP](reboot-csp.md) -- [RemoteWipe CSP](remotewipe-csp.md) +- [RemoteWipe CSP](remotewipe-csp.md)9 - [Reporting CSP](reporting-csp.md) - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [SurfaceHub CSP](surfacehub-csp.md) - [UEFI CSP](uefi-csp.md) +- [Wifi-CSP](wifi-csp.md)9 - [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) +- [Wirednetwork-CSP](wirednetwork-csp.md)9 ## CSPs supported in Windows 10 IoT Core @@ -2808,3 +2814,7 @@ The following list shows the CSPs supported in HoloLens devices: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. +- 7 - Added in Windows 10, version 1909. +- 8 - Added in Windows 10, version 2004. +- 9 - Added in Windows 10 Team 2020 Update +- 10 - Added in [Windows Holographic, version 20H2](https://docs.microsoft.com/hololens/hololens-release-notes#windows-holographic-version-20h2) diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 05add93e6a..17b165ed51 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -1,6 +1,6 @@ --- title: CustomDeviceUI CSP -description: CustomDeviceUI CSP +description: Learn how the CustomDeviceUI configuration service provider (CSP) allows OEMs to implement their custom foreground application. ms.assetid: 20ED1867-7B9E-4455-B397-53B8B15C95A3 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 12b590ef8c..7623b155f2 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -1,6 +1,6 @@ --- title: CustomDeviceUI DDF -description: CustomDeviceUI DDF +description: Learn about the OMA DM device description framework (DDF) for the CustomDeviceUI configuration service provider. ms.assetid: E6D6B902-C57C-48A6-9654-CCBA3898455E ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 744a4be799..da9959c0a2 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,6 +1,6 @@ --- title: Defender CSP -description: Defender CSP +description: Learn how the Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. ms.assetid: 481AA74F-08B2-4A32-B95D-5A3FD05B335C ms.reviewer: manager: dansimp @@ -9,13 +9,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/19/2018 +ms.localizationpriority: medium +ms.date: 08/11/2020 --- # Defender CSP > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. The Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. @@ -50,7 +51,7 @@ Supported operation is Get. **Detections/*ThreatId*/Severity** Threat severity ID. -The data type is a integer. +The data type is integer. The following list shows the supported values: @@ -65,7 +66,7 @@ Supported operation is Get. **Detections/*ThreatId*/Category** Threat category ID. -The data type is a integer. +The data type is integer. The following table describes the supported values: @@ -122,14 +123,12 @@ The following table describes the supported values: | 50 | Ransomware | | 51 | ASR Rule | - - Supported operation is Get. **Detections/*ThreatId*/CurrentStatus** Information about the current status of the threat. -The data type is a integer. +The data type is integer. The following list shows the supported values: @@ -138,7 +137,7 @@ The following list shows the supported values: - 2 = Manual steps required - 3 = Full scan required - 4 = Reboot required -- 5 = Remediated with non critical failures +- 5 = Remediated with noncritical failures - 6 = Quarantined - 7 = Removed - 8 = Cleaned @@ -150,7 +149,7 @@ Supported operation is Get. **Detections/*ThreatId*/ExecutionStatus** Information about the execution status of the threat. -The data type is a integer. +The data type is integer. Supported operation is Get. @@ -171,7 +170,7 @@ Supported operation is Get. **Detections/*ThreatId*/NumberOfDetections** Number of times this threat has been detected on a particular client. -The data type is a integer. +The data type is integer. Supported operation is Get. @@ -181,9 +180,9 @@ An interior node to group information about Windows Defender health status. Supported operation is Get. **Health/ProductStatus** -Added in Windows 10, version 1809. Provide the current state of the product. This is a bitmask flag value that can represent one or multiple product states from below list. +Added in Windows 10, version 1809. Provide the current state of the product. This is a bitmask flag value that can represent one or multiple product states from below list. -Data type is integer. Supported operation is Get. +The data type is integer. Supported operation is Get. Supported product status values: - No status = 0 @@ -234,7 +233,7 @@ Example: **Health/ComputerState** Provide the current state of the device. -The data type is a integer. +The data type is integer. The following list shows the supported values: @@ -243,63 +242,67 @@ The following list shows the supported values: - 2 = Pending reboot - 4 = Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan) - 8 = Pending offline scan -- 16 = Pending critical failure (Windows Defender has failed critically and an Adminsitrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) +- 16 = Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) Supported operation is Get. **Health/DefenderEnabled** Indicates whether the Windows Defender service is running. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/RtpEnabled** Indicates whether real-time protection is running. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/NisEnabled** Indicates whether network protection is running. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/QuickScanOverdue** Indicates whether a Windows Defender quick scan is overdue for the device. -The data type is a boolean. +A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and [catchup Quick scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupquickscan) are disabled (default). + +The data type is a Boolean. Supported operation is Get. **Health/FullScanOverdue** Indicates whether a Windows Defender full scan is overdue for the device. -The data type is a boolean. +A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and [catchup Full scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupfullscan) are disabled (default). + +The data type is a Boolean. Supported operation is Get. **Health/SignatureOutOfDate** Indicates whether the Windows Defender signature is outdated. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/RebootRequired** Indicates whether a device reboot is needed. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/FullScanRequired** Indicates whether a Windows Defender full scan is required. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. @@ -352,6 +355,73 @@ The data type is a string. Supported operation is Get. +**Health/TamperProtectionEnabled** +Indicates whether the Windows Defender tamper protection feature is enabled.​ + +The data type is a Boolean. + +Supported operation is Get. + +**Health/IsVirtualMachine** +Indicates whether the device is a virtual machine. + +The data type is a string. + +Supported operation is Get. + +**Configuration** +An interior node to group Windows Defender configuration information. + +Supported operation is Get. + +**Configuration/TamperProtection** +Tamper protection helps protect important security features from unwanted changes and interference. This includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions. + +Send off blob to device to reset tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune. + +The data type is a Signed blob. + +Supported operations are Add, Delete, Get, Replace. + +Intune tamper protection setting UX supports three states: +- Not configured (default): Does not have any impact on the default state of the device. +- Enabled: Enables the tamper protection feature. +- Disabled: Turns off the tamper protection feature. + +When enabled or disabled exists on the client and admin moves the setting to not configured, it will not have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. + +**Configuration/EnableFileHashComputation** +Enables or disables file hash computation feature. +When this feature is enabled Windows defender will compute hashes for files it scans. + +The data type is integer. + +Supported operations are Add, Delete, Get, Replace. + +Valid values are: +- 1 – Enable. +- 0 (default) – Disable. + +**Configuration/SupportLogLocation** +The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (**MpCmdRun.exe**) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise. + +Data type is string. + +Supported operations are Add, Delete, Get, Replace. + +Intune Support log location setting UX supports three states: + +- Not configured (default) - Does not have any impact on the default state of the device. +- 1 - Enabled. Enables the Support log location feature. Requires admin to set custom file path. +- 0 - Disabled. Turns off the Support log location feature. + +When enabled or disabled exists on the client and admin moves the setting to not configured, it will not have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. + +More details: + +- [Microsoft Defender AV diagnostic data](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data) +- [Collect investigation package from devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#collect-investigation-package-from-devices) + **Scan** Node that can be used to start a Windows Defender scan on a device. @@ -367,12 +437,10 @@ Node that can be used to perform signature updates for Windows Defender. Supported operations are Get and Execute. **OfflineScan** -Added in Windows 10, version 1803. OfflineScan action starts a Windows Defender offline scan on the computer where you run the command. After the next OS reboot, the device will start in Windows Defender offline mode to begin the scan. +Added in Windows 10, version 1803. OfflineScan action starts a Microsoft Defender Offline scan on the computer where you run the command. After the next OS reboot, the device will start in Microsoft Defender Offline mode to begin the scan. Supported operations are Get and Execute. ## Related topics - [Configuration service provider reference](configuration-service-provider-reference.md) - diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index fb7628c241..a63f4dec92 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,6 +1,6 @@ --- title: Defender DDF file -description: Defender DDF file +description: Learn how the OMA DM device description framework (DDF) for the Defender configuration service provider is used. ms.assetid: 39B9E6CF-4857-4199-B3C3-EC740A439F65 ms.reviewer: manager: dansimp @@ -9,17 +9,17 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/12/2018 +ms.localizationpriority: medium +ms.date: 08/11/2020 --- # Defender DDF file - This topic shows the OMA DM device description framework (DDF) for the **Defender** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is the current version for this CSP. ```xml @@ -45,7 +45,7 @@ The XML below is for Windows 10, version 1809. - com.microsoft/1.2/MDM/Defender + com.microsoft/1.3/MDM/Defender @@ -628,6 +628,135 @@ The XML below is for Windows 10, version 1809. + + TamperProtectionEnabled + + + + + + + + + + + + + + + text/plain + + + + + IsVirtualMachine + + + + + + + + + + + + + + + text/plain + + + + + + Configuration + + + + + + + + + + + + + + + + + + + TamperProtection + + + + + + + + + + + + + + + + + + text/plain + + + + + EnableFileHashComputation + + + + + + + + + + + + + + + + + + text/plain + + + + + SupportLogLocation + + + + + + + + + + + + + + + + + + text/plain + + + Scan diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index 9292eb002c..11ab51bf9e 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -1,6 +1,6 @@ --- title: DevDetail CSP -description: DevDetail CSP +description: Learn how the DevDetail configuration service provider handles the management object which provides device-specific parameters to the OMA DM server. ms.assetid: 719bbd2d-508d-439b-b175-0874c7e6c360 ms.reviewer: manager: dansimp @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/11/2018 +ms.date: 03/27/2020 --- # DevDetail CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The DevDetail configuration service provider handles the management object which provides device-specific parameters to the OMA DM server. These device parameters are not sent from the client to the server automatically, but can be queried by servers using OMA DM commands. > [!NOTE] @@ -29,121 +26,136 @@ The following diagram shows the DevDetail configuration service provider managem ![devdetail csp (dm)](images/provisioning-csp-devdetail-dm.png) **DevTyp** -

          Required. Returns the device model name /SystemProductName as a string. +Required. Returns the device model name /SystemProductName as a string. -

          Supported operation is Get. +Supported operation is Get. **OEM** -

          Required. Returns the name of the Original Equipment Manufacturer (OEM) as a string, as defined in the specification SyncML Device Information, version 1.1.2. +Required. Returns the name of the Original Equipment Manufacturer (OEM) as a string, as defined in the specification SyncML Device Information, version 1.1.2. -

          Supported operation is Get. +Supported operation is Get. **FwV** -

          Required. Returns the firmware version, as defined in the registry key HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo\PhoneFirmwareRevision. +Required. Returns the firmware version, as defined in the registry key HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo\PhoneFirmwareRevision. -

          For Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), it returns the BIOS version as defined in the registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion. +For Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), it returns the BIOS version as defined in the registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion. -

          Supported operation is Get. +Supported operation is Get. **SwV** -

          Required. Returns the Windows 10 OS software version in the format MajorVersion.MinorVersion.BuildNumber.QFEnumber. Currently the BuildNumber returns the build number on the desktop and mobile build number on the phone. In the future, the build numbers may converge. +Required. Returns the Windows 10 OS software version in the format MajorVersion.MinorVersion.BuildNumber.QFEnumber. Currently the BuildNumber returns the build number on the desktop and mobile build number on the phone. In the future, the build numbers may converge. -

          Supported operation is Get. +Supported operation is Get. **HwV** -

          Required. Returns the hardware version, as defined in the registry key HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo\PhoneRadioHardwareRevision. +Required. Returns the hardware version, as defined in the registry key HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo\PhoneRadioHardwareRevision. -

          For Windows 10 for desktop editions, it returns the BIOS version as defined in the registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion. +For Windows 10 for desktop editions, it returns the BIOS version as defined in the registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion. -

          Supported operation is Get. +Supported operation is Get. **LrgObj** -

          Required. Returns whether the device uses OMA DM Large Object Handling, as defined in the specification SyncML Device Information, version 1.1.2. +Required. Returns whether the device uses OMA DM Large Object Handling, as defined in the specification SyncML Device Information, version 1.1.2. -

          Supported operation is Get. +Supported operation is Get. **URI/MaxDepth** -

          Required. Returns the maximum depth of the management tree that the device supports. The default is zero (0). +Required. Returns the maximum depth of the management tree that the device supports. The default is zero (0). -

          Supported operation is Get. +Supported operation is Get. -

          This is the maximum number of URI segments that the device supports. The default value zero (0) indicates that the device supports a URI of unlimited depth. +This is the maximum number of URI segments that the device supports. The default value zero (0) indicates that the device supports a URI of unlimited depth. **URI/MaxTotLen** -

          Required. Returns the maximum total length of any URI used to address a node or node property. The default is zero (0). +Required. Returns the maximum total length of any URI used to address a node or node property. The default is zero (0). -

          Supported operation is Get. +Supported operation is Get. -

          This is the largest number of characters in the URI that the device supports. The default value zero (0) indicates that the device supports a URI of unlimited length. +This is the largest number of characters in the URI that the device supports. The default value zero (0) indicates that the device supports a URI of unlimited length. **URI/MaxSegLen** -

          Required. Returns the total length of any URI segment in a URI that addresses a node or node property. The default is zero (0). +Required. Returns the total length of any URI segment in a URI that addresses a node or node property. The default is zero (0). -

          Supported operation is Get. +Supported operation is Get. -

          This is the largest number of characters that the device can support in a single URI segment. The default value zero (0) indicates that the device supports URI segment of unlimited length. +This is the largest number of characters that the device can support in a single URI segment. The default value zero (0) indicates that the device supports URI segment of unlimited length. **Ext/Microsoft/MobileID** -

          Required. Returns the mobile device ID associated with the cellular network. Returns 404 for devices that do not have a cellular network support. +Required. Returns the mobile device ID associated with the cellular network. Returns 404 for devices that do not have a cellular network support. -

          Supported operation is Get. +Supported operation is Get. -

          The IMSI value is returned for GSM and UMTS networks. CDMA and worldwide phones will return a 404 Not Found status code error if queried for this element. - -**Ext/Microsoft/LocalTime** -

          Required. Returns the client local time in ISO 8601 format. - -

          Supported operation is Get. - -**Ext/Microsoft/OSPlatform** -

          Required. Returns the OS platform of the device. For Windows 10 for desktop editions, it returns the ProductName as defined in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName. - -

          Supported operation is Get. - -**Ext/Microsoft/ProcessorType** -

          Required. Returns the processor type of the device as documented in SYSTEM_INFO. - -

          Supported operation is Get. +The IMSI value is returned for GSM and UMTS networks. CDMA and worldwide phones will return a 404 Not Found status code error if queried for this element. **Ext/Microsoft/RadioSwV** -

          Required. Returns the radio stack software version number. +Required. Returns the radio stack software version number. -

          Supported operation is Get. +Supported operation is Get. **Ext/Microsoft/Resolution** -

          Required. Returns the UI screen resolution of the device (example: "480x800"). +Required. Returns the UI screen resolution of the device (example: "480x800"). -

          Supported operation is Get. +Supported operation is Get. **Ext/Microsoft/CommercializationOperator** -

          Required. Returns the name of the mobile operator if it exists; otherwise it returns 404.. +Required. Returns the name of the mobile operator if it exists; otherwise it returns 404.. -

          Supported operation is Get. +Supported operation is Get. **Ext/Microsoft/ProcessorArchitecture** -

          Required. Returns the processor architecture of the device as "arm" or "x86". +Required. Returns the processor architecture of the device as "arm" or "x86". -

          Supported operation is Get. +Supported operation is Get. + +**Ext/Microsoft/ProcessorType** +Required. Returns the processor type of the device as documented in SYSTEM_INFO. + +Supported operation is Get. + +**Ext/Microsoft/OSPlatform** +Required. Returns the OS platform of the device. For Windows 10 for desktop editions, it returns the ProductName as defined in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName. + +Supported operation is Get. + +**Ext/Microsoft/LocalTime** +Required. Returns the client local time in ISO 8601 format. + +Supported operation is Get. **Ext/Microsoft/DeviceName** -

          Required. Contains the user-specified device name. +Required. Contains the user-specified device name. -

          Support for Replace operation for Windows 10 Mobile was added in Windows 10, version 1511. Replace operation is not supported in the desktop or IoT Core. When you change the device name using this node, it triggers a dialog on the device asking the user to reboot. The new device name does not take effect until the device is restarted. If the user cancels the dialog, it will show again until a reboot occurs. +Support for Replace operation for Windows 10 Mobile was added in Windows 10, version 1511. Replace operation is not supported in the desktop or IoT Core. When you change the device name using this node, it triggers a dialog on the device asking the user to reboot. The new device name does not take effect until the device is restarted. If the user cancels the dialog, it will show again until a reboot occurs. -

          Value type is string. +Value type is string. -

          Supported operations are Get and Replace. +Supported operations are Get and Replace. + +**Ext/Microsoft/DNSComputerName** +Added in Windows 10, version 2004. This node specifies the DNS computer name for a device. The server must explicitly reboot the device for this value to take effect. A couple of macros can be embedded within the value for dynamic substitution. Using any of these macros will limit the new name to 63 characters. This node replaces the **Domain/ComputerName** node in [Accounts CSP](accounts-csp.md). + +The following are the available naming macros: + +| Macro | Description | Example | Generated Name | +| -------| -------| -------| -------| +| %RAND:<# of digits> | Generates the specified number of random digits. | Test%RAND:6% | Test123456| +| %SERIAL% | Generates the serial number derived from the device. If the serial number causes the new name to exceed the 63 character limit, the serial number will be truncated from the beginning of the sequence.| Test-Device-%SERIAL% | Test-Device-456| + +Value type is string. Supported operations are Get and Replace. + +> [!Note] +> On desktop PCs, this setting specifies the DNS hostname of the computer (Computer Name) up to 63 characters. Use `%RAND:x%` to generate x number of random digits in the name, where x must be a number less than 63. For domain joined computers, the unique name must use `%RAND:x%`. Use `%SERIAL%` to generate the name with the `computer"s` serial number embedded. If the serial number exceeds the character limit, it will be truncated from the beginning of the sequence. The character restriction limit does not count the length of the macros, `%RAND:x%` and `%SERIAL%`. This setting is supported only in Windows 10, version 1803 and later. To change this setting in Windows 10, version 1709 and earlier releases, use the **ComputerName** setting under **Accounts** > **ComputerAccount**. **Ext/Microsoft/TotalStorage** -

          Added in Windows 10, version 1511. Integer that specifies the total available storage in MB from first internal drive on the device (may be less than total physical storage). +Added in Windows 10, version 1511. Integer that specifies the total available storage in MB from first internal drive on the device (may be less than total physical storage). -

          Supported operation is Get. +Supported operation is Get. > [!NOTE] > This is only supported in Windows 10 Mobile. **Ext/Microsoft/TotalRAM** -

          Added in Windows 10, version 1511. Integer that specifies the total available memory in MB on the device (may be less than total physical memory). +Added in Windows 10, version 1511. Integer that specifies the total available memory in MB on the device (may be less than total physical memory). Supported operation is Get. @@ -153,45 +165,45 @@ Added in Windows 10, version 1809. SMBIOS Serial Number of the device. Value type is string. Supported operation is Get. **Ext/WLANMACAddress** -

          The MAC address of the active WLAN connection, as a 12-digit hexadecimal number. +The MAC address of the active WLAN connection, as a 12-digit hexadecimal number. -

          Supported operation is Get. +Supported operation is Get. > [!NOTE] > This is not supported in Windows 10 for desktop editions. **Ext/VoLTEServiceSetting** -

          Returns the VoLTE service to on or off. This is only exposed to mobile operator OMA-DM servers. +Returns the VoLTE service to on or off. This is only exposed to mobile operator OMA-DM servers. -

          Supported operation is Get. +Supported operation is Get. **Ext/WlanIPv4Address** -

          Returns the IPv4 address of the active Wi-Fi connection. This is only exposed to enterprise OMA DM servers. +Returns the IPv4 address of the active Wi-Fi connection. This is only exposed to enterprise OMA DM servers. -

          Supported operation is Get. +Supported operation is Get. **Ext/WlanIPv6Address** -

          Returns the IPv6 address of the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers. +Returns the IPv6 address of the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers. -

          Supported operation is Get. +Supported operation is Get. **Ext/WlanDnsSuffix** -

          Returns the DNS suffix of the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers. +Returns the DNS suffix of the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers. -

          Supported operation is Get. +Supported operation is Get. **Ext/WlanSubnetMask** -

          Returns the subnet mask for the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers. +Returns the subnet mask for the active Wi-Fi connection. This is only exposed to enterprise OMA-DM servers. -

          Supported operation is Get. +Supported operation is Get. **Ext/DeviceHardwareData** -

          Added in Windows 10 version 1703. Returns a base64-encoded string of the hardware parameters of a device. +Added in Windows 10 version 1703. Returns a base64-encoded string of the hardware parameters of a device. > [!NOTE] > This node contains a raw blob used to identify a device in the cloud. It's not meant to be human readable by design and you cannot parse the content to get any meaningful hardware information. -

          Supported operation is Get. +Supported operation is Get. ## Related topics diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index b313ad3605..25be11c21b 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,6 +1,6 @@ --- title: DevDetail DDF file -description: DevDetail DDF file +description: Learn about the OMA DM device description framework (DDF) for the DevDetail configuration service provider. ms.assetid: 645fc2b5-2d2c-43b1-9058-26bedbe9f00d ms.reviewer: manager: dansimp @@ -9,19 +9,16 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/11/2018 +ms.date: 06/03/2020 --- # DevDetail DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **DevDetail** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is the current version for this CSP. ```xml @@ -488,6 +485,28 @@ The XML below is for Windows 10, version 1809. + + DNSComputerName + + + + + + This node specifies the DNS name for a device. This setting can be managed remotely. A couple of macros can be embedded within the value for dynamic substitution: %RAND:<# of digits>% and %SERIAL%. Examples: (a) "Test%RAND:6%" will generate a name "Test" followed by 6 random digits (e.g., "Test123456"). (b) "Foo%SERIAL%", will generate a name "Foo" followed by the serial number derived from device's ID. If both macros are in the string, the RANDOM macro will take priority over the SERIAL macro (SERIAL will be ignored). The server must explicitly reboot the device for this value to take effect. This value has a maximum allowed length of 63 characters as per DNS standards. + + + + + + + + + + + text/plain + + + TotalStorage @@ -702,4 +721,5 @@ The XML below is for Windows 10, version 1809. + ``` diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 13a78b2032..eb09896b90 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -1,6 +1,6 @@ --- title: Mobile device management MDM for device updates -description: In the current device landscape of PC, tablets, phones, and IoT devices, the Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. +description: Windows 10 provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. ms.assetid: C27BAEE7-2890-4FB7-9549-A6EACC790777 ms.reviewer: manager: dansimp @@ -90,7 +90,7 @@ The response of the GetUpdateData call returns an array of ServerSyncUpdateData - **Language** – The language code identifier (LCID). For example, en or es. - **Title** – Title of the update. For example, “Windows SharePoint Services 3.0 Service Pack 3 x64 Edition (KB2526305)” - **Description** – Description of the update. For example, “Windows SharePoint Services 3.0 Service Pack 3 (KB2526305) provides the latest updates to Windows SharePoint Services 3.0. After you install this item, you may have to restart your computer. After you have installed this item, it cannot be removed.” -- **KBArticleID** – The KB article number for this update that has details regarding the particular update. For example, . +- **KBArticleID** – The KB article number for this update that has details regarding the particular update. For example, . ## Recommended Flow for Using the Server-Server Sync Protocol @@ -635,7 +635,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise > [!Important] -> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enteprise and IoT Enterprise. +> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enterprise and IoT Enterprise.

          Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet. diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index 09d6af05e4..f24564545c 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -1,6 +1,6 @@ --- title: DeviceInstanceService CSP -description: DeviceInstanceService CSP +description: Learn how the DeviceInstanceService configuration service provider (CSP) provides some device inventory information that could be useful for an enterprise. ms.assetid: f113b6bb-6ce1-45ad-b725-1b6610721e2d ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index 246408076e..cef65071ec 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -1,6 +1,6 @@ --- title: DeviceLock CSP -description: DeviceLock CSP +description: Learn how the DeviceLock configuration service provider (CSP) is used by the enterprise management server to configure device lock related policies. ms.assetid: 9a547efb-738e-4677-95d3-5506d350d8ab ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index 545ebcdb9b..eb63ef11fe 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -1,6 +1,6 @@ --- title: DeviceLock DDF file -description: DeviceLock DDF file +description: Learn about the OMA DM device description framework (DDF) for the DeviceLock configuration service provider (CSP). ms.assetid: 46a691b9-6350-4987-bfc7-f8b1eece3ad9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md index 724027f5f0..3bf0368ffd 100644 --- a/windows/client-management/mdm/devicemanageability-csp.md +++ b/windows/client-management/mdm/devicemanageability-csp.md @@ -1,6 +1,6 @@ --- title: DeviceManageability CSP -description: The DeviceManageability configuration service provider (CSP) is used retrieve the general information about MDM configuration capabilities on the device. This CSP was added in Windows 10, version 1607. +description: The DeviceManageability configuration service provider (CSP) is used retrieve general information about MDM configuration capabilities on the device. ms.assetid: FE563221-D5B5-4EFD-9B60-44FE4066B0D2 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index 2191e66e9c..6ab35ba018 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -1,6 +1,6 @@ --- title: DeviceStatus CSP -description: The DeviceStatus configuration service provider is used by the enterprise to keep track of device inventory and query the state of compliance of these devices with their enterprise policies. +description: The DeviceStatus configuration service provider keeps track of device inventory and queries the compliance state of devices within the enterprise. ms.assetid: 039B2010-9290-4A6E-B77B-B2469B482360 ms.reviewer: manager: dansimp @@ -36,9 +36,8 @@ Supported operation is Get. **DeviceStatus/CellularIdentities** Required. Node for queries on the SIM cards. -> **Note**  Multiple SIMs are supported. - - +>[!NOTE] +>Multiple SIMs are supported. **DeviceStatus/CellularIdentities/***IMEI* The unique International Mobile Station Equipment Identity (IMEI) number of the mobile device. An IMEI is present for each SIM card on the device. @@ -107,7 +106,7 @@ Supported operation is Get. Node for the compliance query. **DeviceStatus/Compliance/EncryptionCompliance** -Boolean value that indicates compliance with the enterprise encryption policy. The value is one of the following: +Boolean value that indicates compliance with the enterprise encryption policy for OS (system) drives. The value is one of the following: - 0 - not encrypted - 1 - encrypted diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index 7252e076c2..ba02947ada 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -1,6 +1,6 @@ --- title: DevInfo CSP -description: DevInfo CSP +description: Learn now the DevInfo configuration service provider handles the managed object which provides device information to the OMA DM server. ms.assetid: d3eb70db-1ce9-4c72-a13d-651137c1713c ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index b81a21b82e..aec2b4cc91 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,6 +1,6 @@ --- title: DevInfo DDF file -description: DevInfo DDF file +description: Learn about the OMA DM device description framework (DDF) for the DevInfo configuration service provider (CSP). ms.assetid: beb07cc6-4133-4c0f-aa05-64db2b4a004f ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 85de08a137..db52ac149a 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -1,6 +1,6 @@ --- title: Diagnose MDM failures in Windows 10 -description: To help diagnose enrollment or device management issues in Windows 10 devices managed by an MDM server, you can examine the MDM logs collected from the desktop or mobile device. The following sections describe the procedures for collecting MDM logs. +description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows 10 devices managed by an MDM server. ms.assetid: 12D8263B-D839-4B19-9346-31E0CDD0CBF9 ms.reviewer: manager: dansimp @@ -114,11 +114,11 @@ Example: Export the Debug logs ## Collect logs from Windows 10 Mobile devices -Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medic](https://www.microsoft.com/en-us/p/field-medic/9wzdncrfjb82?activetab=pivot%3aoverviewtab) app to collect logs. +Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medic](https://www.microsoft.com/p/field-medic/9wzdncrfjb82?activetab=pivot%3aoverviewtab) app to collect logs. **To collect logs manually** -1. Download and install the [Field Medic]( http://go.microsoft.com/fwlink/p/?LinkId=718232) app from the store. +1. Download and install the [Field Medic]( https://go.microsoft.com/fwlink/p/?LinkId=718232) app from the store. 2. Open the Field Medic app and then click on **Advanced**. ![field medic screenshot](images/diagnose-mdm-failures2.png) diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 44c558fde0..2c49067d90 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -1,6 +1,6 @@ --- title: DiagnosticLog CSP -description: DiagnosticLog CSP +description: Learn about the feature areas of the DiagnosticLog configuration service provider (CSP), including the DiagnosticLog area and Policy area. ms.assetid: F76E0056-3ACD-48B2-BEA1-1048C96571C3 ms.reviewer: manager: dansimp @@ -9,22 +9,683 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/26/2017 +ms.date: 11/19/2019 --- # DiagnosticLog CSP +The DiagnosticLog configuration service provider (CSP) provides the following feature areas: +- [DiagnosticArchive area](#diagnosticarchive-area). Capture and upload event logs, log files, and registry values for troubleshooting. +- [Policy area](#policy-area). Configure Windows event log policies, such as maximum log size. +- [EtwLog area](#etwlog-area). Control ETW trace sessions. +- [DeviceStateData area](#devicestatedata-area). Provide additional device information. +- [FileDownload area](#filedownload-area). Pull trace and state data directly from the device. + +The following are the links to different versions of the DiagnosticLog CSP DDF files: +- [DiagnosticLog CSP version 1.4](diagnosticlog-ddf.md#version-1-4) +- [DiagnosticLog CSP version 1.3](diagnosticlog-ddf.md#version-1-3) +- [DiagnosticLog CSP version 1.2](diagnosticlog-ddf.md#version-1-2) -The DiagnosticLog configuration service provider (CSP) is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device. +The following diagram shows the DiagnosticLog CSP in tree format. +![diagnosticlog csp diagram](images/provisioning-csp-diagnosticlog.png) -DiagnosticLog CSP supports the following type of event tracing: +**./Vendor/MSFT/DiagnosticLog** +The root node for the DiagnosticLog CSP. -- Collector-based tracing -- Channel-based tracing +Rest of the nodes in the DiagnosticLog CSP are described within their respective feature area sections. + +## DiagnosticArchive area + +The DiagnosticArchive functionality within the DiagnosticLog CSP is used to trigger devices to gather troubleshooting data into a zip archive file and upload that archive to cloud storage. DiagnosticArchive is designed for ad-hoc troubleshooting scenarios, such as an IT admin investigating an app installation failure using a collection of event log events, registry values, and app or OS log files. + +> [!Note] +> DiagnosticArchive is a "break glass" backstop option for device troubleshooting. Diagnostic data such as log files can grow to many gigabytes. Gathering, transferring, and storing large amounts of data may burden the user's device, the network and cloud storage. Management servers invoking DiagnosticArchive must take care to minimize data gathering frequency and scope. + +The following section describes the nodes for the DiagnosticArchive functionality. + +**DiagnosticArchive** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root node for the DiagnosticArchive functionality. + +The supported operation is Get. + +**DiagnosticArchive/ArchiveDefinition** +Added in version 1.4 of the CSP in Windows 10, version 1903. + +The supported operations are Add and Execute. + +The data type is string. + +Expected value: +Set and Execute are functionality equivalent, and each accepts a `Collection` XML snippet (as a string) describing what data to gather and where to upload it. The results are zipped and uploaded to the specified SasUrl. The zipped filename format is "DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip". + +The following is an example of a `Collection` XML. + +``` xml + + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + + + HKLM\Software\Policies + %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out %ProgramData%\temp\ + %ProgramData%\temp\*.* + Application + + +``` +The XML should include the following elements within the `Collection` element: + +**ID** +The ID value uniquely identifies this data-gathering request. To avoid accidental repetition of data gathering, the CSP ignores subsequent Set or Execute invocations with the same ID value. The CSP expects the value to be populated when the request is received, so it must be generated by the IT admin or the management server. + +**SasUrl** +The SasUrl value is the target URI to which the CSP uploads the zip file containing the gathered data. It is the responsibility of the management server to provision storage in such a way that the storage server accepts the device's HTTP PUT to this URL. For example, the device management service could: +- Provision cloud storage reachable by the target device, such as a Microsoft Azure blob storage container +- Generate a Shared Access Signature URL granting the possessor (the target device) time-limited write access to the storage container +- Pass this value to the CSP on the target device through the `Collection` XML as the `SasUrl` value. + +**One or more data gathering directives, which may include any of the following:** + +- **RegistryKey** + - Exports all of the key names and values under a given path (recursive). + - Expected input value: Registry path such as "HKLM\Software\Policies". + - Output format: Creates a .reg file, similar to the output of reg.exe EXPORT command. + - Privacy guardrails: To enable diagnostic log capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, registry paths are restricted to those under HKLM and HKCR. + +- **Events** + - Exports all events from the named Windows event log. + - Expected input value: A named event log channel such as "Application" or "Microsoft-Windows-DeviceGuard/Operational". + - Output format: Creates a .evtx file. + +- **Commands** + - This directive type allows the execution of specific commands such as ipconfig.exe. Note that DiagnosticArchive and the Commands directives are not a general-purpose scripting platform. These commands are allowed in the DiagnosticArchive context to handle cases where critical device information may not be available through existing log files. + - Expected input value: The full command line including path and any arguments, such as `%windir%\\system32\\ipconfig.exe /all`. + - Output format: Console text output from the command is captured in a text file and included in the overall output archive. For commands which may generate file output rather than console output, a subsequent FolderFiles directive would be used to capture that output. The example XML above demonstrates this pattern with mdmdiagnosticstool.exe's -out parameter. + - Privacy guardrails: To enable diagnostic data capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, only the following commands are allowed: + - %windir%\\system32\\certutil.exe + - %windir%\\system32\\dxdiag.exe + - %windir%\\system32\\gpresult.exe + - %windir%\\system32\\msinfo32.exe + - %windir%\\system32\\netsh.exe + - %windir%\\system32\\nltest.exe + - %windir%\\system32\\ping.exe + - %windir%\\system32\\powercfg.exe + - %windir%\\system32\\w32tm.exe + - %windir%\\system32\\wpr.exe + - %windir%\\system32\\dsregcmd.exe + - %windir%\\system32\\dispdiag.exe + - %windir%\\system32\\ipconfig.exe + - %windir%\\system32\\logman.exe + - %windir%\\system32\\tracelog.exe + - %programfiles%\\windows defender\\mpcmdrun.exe + - %windir%\\system32\\MdmDiagnosticsTool.exe + - %windir%\\system32\\pnputil.exe + +- **FoldersFiles** + - Captures log files from a given path (without recursion). + - Expected input value: File path with or without wildcards, such as "%windir%\\System32", or "%programfiles%\\*.log". + - Privacy guardrails: To enable diagnostic log capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, only paths under the following roots are allowed: + - %PROGRAMFILES% + - %PROGRAMDATA% + - %PUBLIC% + - %WINDIR% + - %TEMP% + - %TMP% + - Additionally, only files with the following extensions are captured: + - .log + - .txt + - .dmp + - .cab + - .zip + - .xml + - .html + - .evtx + - .etl + +**DiagnosticArchive/ArchiveResults** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting displays the results of the last archive run. + +The supported operation is Get. + +The data type is string. + +A Get to the above URI will return the results of the data gathering for the last diagnostics request. For the example above it returns: + +``` xml + + + + + 1 + 1 + 0 + SyncHdr + 200 + + + 2 + 1 + 1 + Get + 200 + + + 3 + 1 + 1 + + + ./Vendor/MSFT/DiagnosticLog/DiagnosticArchive/ArchiveResults + + + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + HKLM\Software\Policies + C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\ + c:\ProgramData\temp\*.* + Application + + + + + + + +``` + +Each data gathering node is annotated with the HRESULT of the action and the collection is also annotated with an overall HRESULT. In this example, note that the mdmdiagnosticstool.exe command failed. + +The zip file which is created also contains a results.xml file whose contents align to the Data section in the SyncML for ArchiveResults. Accordingly, an IT admin using the zip file for troubleshooting can determine the order and success of each directive without needing a permanent record of the SyncML value for DiagnosticArchive/ArchiveResults. + + +## Policy area + +The Policy functionality within the DiagnosticLog CSP configures Windows event log policies, such as maximum log size. + +The following section describes the nodes for the Policy functionality. + +**Policy** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root node to control settings for channels in Event Log. + +The supported operation is Get. + +**Policy/Channels** +Added in version 1.4 of the CSP in Windows 10, version 1903. Node that contains Event Log channel settings. + +The supported operation is Get. + +**Policy/Channels/_ChannelName_** +Added in version 1.4 of the CSP in Windows 10, version 1903. Dynamic node to represent a registered channel. The node name must be a valid Windows event log channel name, such as ``Microsoft-Client-Licensing-Platform%2FAdmin``. When specifying the name in the LocURI, it must be URL encoded, otherwise it may unexpectedly translate into a different URI. + +Supported operations are Add, Delete, and Get. + +Add **Channel** +``` xml + + ​ + ​ + 2​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + node​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Delete **Channel** +``` xml + + ​ + ​ + 3​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **Channel** +``` xml + + ​ + ​ + 4​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +**Policy/Channels/_ChannelName_/MaximumFileSize** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies the maximum size of the log file in megabytes. + +If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte and 2 terabytes in megabyte increments. + +If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is integer. + +Add **MaximumFileSize** +``` xml + + ​ + ​ + 6​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 3​ + ​ + ​ + ​ + ​ + +``` + +Delete **MaximumFileSize** +``` xml + + ​ + ​ + 7​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **MaximumFileSize** +``` xml + + ​ + ​ + 5​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **MaximumFileSize** +``` xml + + ​ + ​ + 8​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 5​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/SDDL** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting represents SDDL string controlling access to the channel. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +Default string is as follows: + +https://docs.microsoft.com/windows/desktop/WES/eventmanifestschema-channeltype-complextype. + +Add **SDDL** +``` xml + + ​ + ​ + 10​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourSDDL​ + ​ + ​ + ​ + ​ + +``` + +Delete **SDDL** +``` xml + + + ​ + ​ + 11​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **SDDL** +``` xml + + ​ + ​ + 9​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **SDDL** +``` xml + + ​ + ​ + 12​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourNewSDDL​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/ActionWhenFull** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +The following are the possible values: +- Truncate — When the log file reaches its maximum file size, new events are not written to the log and are lost. +- Overwrite — When the log file reaches its maximum file size, new events overwrite old events. +- Archive — When the log file reaches its maximum size, the log file is saved to the location specified by the "Archive Location" policy setting. If archive location value is not set, the new file is saved in the same directory as current log file. + +If you disable or do not configure this policy setting, the locally configured value will be used as default. Every channel that is installed, whether inbox or by ISVs, is responsible for defining its own local configuration, and that configuration can be changed by any administrator. Values set via this policy override but do not replace local configuration. + + +Add **ActionWhenFull** +``` xml + + ​ + ​ + 14​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Archive​ + ​ + ​ + ​ + ​ + +``` + +Delete **ActionWhenFull** +``` xml + + ​ + ​ + 15​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **ActionWhenFull** +``` xml + + ​ + ​ + 13​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **ActionWhenFull** +``` xml + + ​ + ​ + 16​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Truncate​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/Enabled** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies whether the channel should be enabled or disabled. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is boolean. + +The following are the possible values: +- TRUE — Enables the channel. +- FALSE — Disables the channel. + +If you disable or do not configure this policy setting, the locally configured value is used as default. + +Get **Enabled** +``` xml + + ​ + ​ + 17​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Add **Enabled** +``` xml + + ​ + ​ + 18​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + TRUE​ + ​ + ​ + ​ + ​ + +``` + +Delete **Enabled** +``` xml + + ​ + ​ + 19​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **Enabled** +``` xml + + ​ + ​ + 20​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + FALSE​ + ​ + ​ + ​ + ​ + +``` + +## EtwLog area + +The Event Tracing for Windows (ETW) log feature of the DiagnosticLog CSP is used to control the following types of event tracing: +- [Collector-based tracing](#collector-based-tracing) +- [Channel-based tracing](#channel-based-tracing) + +The ETW log feature is designed for advanced usage, and assumes developers' familiarity with ETW. For more information, see [About Event Tracing](https://docs.microsoft.com/windows/win32/etw/about-event-tracing). ### Collector-based tracing -This type of event tracing simultaneously collects event data from a collection of registered ETW providers. +This type of event tracing collects event data from a collection of registered ETW providers. An event collector is a container of registered ETW providers. Users can add or delete a collector node and register or unregister multiple providers in this collector. @@ -47,13 +708,12 @@ For each registered provider in this collector, the user can: - Change trace level to filter events from this provider - Enable or disable the provider in the trace session -The changes on **State**, **Keywords** and **TraceLevel** takes effect immediately while trace session is in progress. +The changes on **State**, **Keywords**, and **TraceLevel** takes effect immediately while trace session is in progress. -> **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. +> [!Note] +> Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. - - -### Channel-based tracing + ### Channel-based tracing The type of event tracing exports event data from a specific channel. This is only supported on the desktop. @@ -69,40 +729,24 @@ For each channel node, the user can: For more information about using DiagnosticLog to collect logs remotely from a PC or mobile device, see [Diagnose MDM failures in Windows 10](diagnose-mdm-failures-in-windows-10.md). -Here are the links to the DDFs: - -- [DiagnosticLog CSP version 1.2](diagnosticlog-ddf.md#version-1-2) -- [DiagnosticLog CSP version 1.3](diagnosticlog-ddf.md#version-1-3) - -The following diagram shows the DiagnosticLog configuration service provider in tree format. - -![diagnosticlog csp diagram](images/provisioning-csp-diagnosticlog.png) - -**./Vendor/MSFT/DiagnosticLog** -The root node for the DiagnosticLog configuration service provider. - -The following steps describe the process for gathering diagnostics using this CSP. +To gather diagnostics using this CSP: 1. Specify a *CollectorName* for the container of the target ETW providers. 2. (Optional) Set logging and log file parameters using the following options: - - **TraceLogFileMode** - - **LogFileSizeLimitMB** - - Each of these are described later in this topic. + - TraceLogFileMode + - LogFileSizeLimitMB 3. Indicate one or more target ETW providers by supplying its *ProviderGUID* to the Add operation of EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*. 4. (Optional) Set logging and log file parameters using the following options: - - - **TraceLevel** - - **Keywords** - - Each of these are described later in this topic. - -5. Start logging using **TraceControl** EXECUTE command “START” + - TraceLevel + - Keywords +5. Start logging using **TraceControl** EXECUTE command “START”. 6. Perform actions on the target device that will generate activity in the log files. -7. Stop logging using **TraceControl** EXECUTE command “STOP” -8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file) +7. Stop logging using **TraceControl** EXECUTE command “STOP”. +8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file). + +The following section describes the nodes for EtwLog functionality. **EtwLog** Node to contain the Error Tracing for Windows log. @@ -174,8 +818,6 @@ The following table represents the possible values: | 0 | Stopped | | 1 | Started | - - **EtwLog/Collectors/*CollectorName*/TraceLogFileMode** Specifies the log file logging mode. @@ -185,30 +827,10 @@ Supported operations are Get and Replace. The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
          ValueDescription

          EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001)

          Writes events to a log file sequentially; stops when the file reaches its maximum size.

          EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002)

          Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events.

          - - +| Value | Description | +|-------|--------------------| +| EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001) | Writes events to a log file sequentially; stops when the file reaches its maximum size. | +| EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002) | Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events. | **EtwLog/Collectors/*CollectorName*/TraceControl** Specifies the logging and report action state. @@ -222,8 +844,6 @@ The following table lists the possible values: | START | Start log tracing. | | STOP | Stop log tracing | - - The supported operation is Execute. After you have added a logging task, you can start a trace by running an Execute command on this node with the value START. @@ -293,9 +913,8 @@ The supported operation is Get. **EtwLog/Collectors/*CollectorName*/Providers/***ProviderGUID* Dynamic nodes to represent active provider configuration per provider GUID. -> **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. - - +> [!Note] +> Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. Supported operations are Add, Delete, and Get. @@ -347,44 +966,15 @@ The data type is an integer. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ValueDescription

          1 – TRACE_LEVEL_CRITICAL

          Abnormal exit or termination events

          2 – TRACE_LEVEL_ERROR

          Severe error events

          3 – TRACE_LEVEL_WARNING

          Warning events such as allocation failures

          4 – TRACE_LEVEL_INFORMATION

          Non-error events, such as entry or exit events

          5 – TRACE_LEVEL_VERBOSE

          Detailed information

          - - +| Value | Description | +|-------|--------------------| +| 1 – TRACE_LEVEL_CRITICAL | Abnormal exit or termination events | +| 2 – TRACE_LEVEL_ERROR | Severe error events | +| 3 – TRACE_LEVEL_WARNING | Warning events such as allocation failures | +| 4 – TRACE_LEVEL_INFORMATION | Non-error events, such as entry or exit events | +| 5 – TRACE_LEVEL_VERBOSE | Detailed information | Set provider **TraceLevel** @@ -412,7 +1002,7 @@ Set provider **TraceLevel** **EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/Keywords** Specifies the provider keywords to be used as MatchAnyKeyword for this provider. -the data type is a string. +The data type is a string. Supported operations are Get and Replace. @@ -470,32 +1060,12 @@ The data type is a boolean. Supported operations are Get and Replace. This change will be effective during active trace session. -The following table lists the possible values. Default value is TRUE. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
          ValueDescription

          TRUE

          Provider is enabled in the trace session.

          FALSE

          Provider is disables in the trace session.

          - - +| Value | Description | +|-------|--------------------| +| TRUE | Provider is enabled in the trace session. This is the default. | +| FALSE | Provider is disabled in the trace session. | Set provider **State** @@ -630,32 +1200,12 @@ The data type is a boolean. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
          ValueDescription

          TRUE

          Channel is enabled.

          FALSE

          Channel is disabled.

          - - +| Value | Description | +|-------|--------------------| +| TRUE | Channel is enabled. | +| FALSE | Channel is disabled. | Get channel **State** @@ -699,6 +1249,12 @@ Set channel **State** ``` +## DeviceStateData area + +The DeviceStateData functionality within the DiagnosticLog CSP provides additional device information. + +The following section describes the nodes for the DeviceStateData functionality. + **DeviceStateData** Added in version 1.3 of the CSP in Windows 10, version 1607. Node for all types of device state data that are exposed. @@ -728,6 +1284,17 @@ The supported value is Execute. ``` +## FileDownload area +The FileDownload feature of the DiagnosticLog CSP enables a management server to pull data directly from the device. In the FileDownload context the client and server roles are conceptually reversed, with the management server acting as a client to download the data from the managed device. + +### Comparing FileDownload and DiagnosticArchive +Both the FileDownload and DiagnosticArchive features can be used to get data from the device to the management server, but they are optimized for different workflows. + +- FileDownload enables the management server to directly pull byte-level trace data from the managed device. The data transfer takes place through the existing OMA-DM/SyncML context. It is typically used together with the EtwLogs feature as part of an advanced monitoring or diagnostic flow. FileDownlod requires granular orchestration by the management server, but avoids the need for dedicated cloud storage. +- DiagnosticArchive allows the management server to give the CSP a full set of instructions as single command. Based on those instructions the CSP orchestrates the work client-side to package the requested diagnostic files into a zip archive and upload that archive to cloud storage. The data transfer happens outside of the OMA-DM session, via an HTTP PUT. + +The following section describes the nodes for the FileDownload functionality. + **FileDownload** Node to contain child nodes for log file transportation protocols and corresponding actions. @@ -897,26 +1464,15 @@ Node to transfer the selected log file block to the DM server. **FileDownload/DMChannel/*FileContext*/DataBlocks/***BlockNumber* The data type is Base64. -The only supported operation is Get. - -## Reading a log file - - -1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel** -2. Select a log file in the Enumeration result -3. Set **BlockSizeKB** per DM server payload limitation -4. Get **BlockCount** to determine total read request -5. Set **BlockIndexToRead** to initialize read start point -6. Get **BlockData** for upload log block -7. Increase **BlockIndexToRead** -8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)** - - - - - - - - - +The supported operation is Get. +### Reading a log file +To read a log file: +1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel**. +2. Select a log file in the Enumeration result. +3. Set **BlockSizeKB** per DM server payload limitation. +4. Get **BlockCount** to determine total read request. +5. Set **BlockIndexToRead** to initialize read start point. +6. Get **BlockData** for upload log block. +7. Increase **BlockIndexToRead**. +8. Repeat steps 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**. diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index dc23032029..f635ed44c6 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,6 +1,6 @@ --- title: DiagnosticLog DDF -description: DiagnosticLog DDF +description: Learn about the the OMA DM device description framework (DDF) for the DiagnosticLog configuration service provider (CSP). ms.assetid: 9DD75EDA-5913-45B4-9BED-20E30CDEBE16 ms.reviewer: manager: dansimp @@ -23,6 +23,7 @@ The content below are the latest versions of the DDF files: - [DiagnosticLog CSP version 1.2](#version-1-2) - [DiagnosticLog CSP version 1.3](#version-1-3) +- [DiagnosticLog CSP version 1.4](#version-1-4) ## DiagnosticLog CSP version 1.2 @@ -1284,6 +1285,893 @@ The content below are the latest versions of the DDF files: ``` +## DiagnosticLog CSP version 1.4 +```xml + + +]> + + 1.2 + + DiagnosticLog + ./Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.4/MDM/DiagnosticLog + + + + EtwLog + + + + + Root node of all types of event logging nodes that CSP manages. + + + + + + + + + + + + + + + Collectors + + + + + Root node of registered "Collector" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Collector' node. CSP will maintain an ETW trace session for this collector with its name used as a unique identifier. In a collector, a valid ETW provider can be registered and unregistered. The collector's associated trace session will enable the registered providers in it if the provider's state is 'Enabled'. Each provider's state, trace level and keywords can be controlled separately. The name of this node must not be a valid Windows event channel name. It can be a etw provider guid as long as it is not equal to an already registered 'Provider' node name. + + + + + + + + + + CollectorName + + + + + + TraceStatus + + + + + This node is used for getting the status of this collector node's associated trace session. 1 means "in progress"; 0 means "not started or stopped". + + + + + + + + + + + text/plain + + + + + TraceLogFileMode + + + + + + 1 + This node is used for setting or getting the trace log file mode of this collector node's associated trace session. The only two allowed values are 1 and 2, which are EVENT_TRACE_FILE_MODE_SEQUENTIAL and EVENT_TRACE_FILE_MODE_CIRCULAR. Default value is 1. + + + + + + + + + + + text/plain + + + + + TraceControl + + + + + + This node is to trigger "start" and "stop" of this collector node's associated trace session. "Get" returns the name of this node. + + + + + + + + + + + text/plain + + + + + LogFileSizeLimitMB + + + + + + 4 + This node is used for setting or getting the trace log file size limit(in Megabytes) of this collector node's associated trace session. The value range is 1~2048. Default value is 4. + + + + + + + + + + + text/plain + + + + + Providers + + + + + Root node of all providers registered in this collector node. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents an ETW provider registered in this collector node. The node name must be a valid provider GUID. + + + + + + + + + + ProviderGuid + + + + + + Keywords + + + + + + "0" + This node is used for setting or getting the keywords of the event provider in this collector node's associated trace session. The string is in the form of hexadecimal digits and 16 chars wide. It'll be internally converted into ULONGLONG data type in the CSP. Default value is "0", which means all events from this provider are included. If the associated trace session is in progress, new keywords setting is applied immediately; if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + TraceLevel + + + + + + 5 + This node is used for setting or getting the trace level of this event provider in this collector node's associated trace session. Default value is 5, which is TRACE_LEVEL_VERBOSE. If the associated trace session is in progress, new trace level setting is applied immediately;if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + State + + + + + + true + This node is used for setting or getting the state of the event provider in this collector node's associated trace session. If the trace session isn't started, changing the value controls whether to enable the provider or not when session is started; if trace session is already started, changing its value causes enabling or disabling the provider in the live trace session. Default value is true. + + + + + + + + + + + text/plain + + + + + + + + + Channels + + + + + Root node of registered "Channel" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + Export + + + + + + This node is to trigger exporting events into a log file from this node's associated Windows event channel. The log file's extension is .evtx, which is the standard extension of windows event channel log. The "Get" command returns the name of this node. + + + + + + + + + + + text/plain + + + + + State + + + + + + This node is used for setting or getting the 'Enabled' state of this node's associated windows event channel in the system. Setting it to "TRUE" enables the channel; setting it to "FALSE" disables the channel. + + + + + + + + + + + text/plain + + + + + Filter + + + + + + "" + This node is used for setting or getting the xpath query string to filter the events when exporting the log file from the channel. Default value is empty string. + + + + + + + + + + + text/plain + + + + + + + + DeviceStateData + + + + + Root node of all types of device state data that CSP exposes. + + + + + + + + + + + + + + + MdmConfiguration + + + + + This node is to trigger snapping of the Device Management state data with "SNAP". + + + + + + + + + + + text/plain + + + + + + FileDownload + + + + + Root node of all csp nodes that are related to log file download in csp. + + + + + + + + + + + + + + + DMChannel + + + + + Root node of all csp nodes that are used for controlling file download for their associated log file generated by logging csp nodes. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'FileContext' node corresponding to a log file generated by one of the logging CSP nodes(underneath 'EtwLog' node). The node name must be the name of a registered 'Provider', 'Collector' or 'Channel' node. The log file and its location will be determined by CSP based on the node name. File download is done by dividing the log file into multiple blocks of configured block size and then sending the blocks as requested by MDM server. + + + + + + + + + + FileContext + + + + + + BlockSizeKB + + + + + + 4 + This node is used for setting or getting the block size (in Kilobytes) for the download of associated log file. The value range is 1~16. Default value is 4. + + + + + + + + + + + text/plain + + + + + BlockCount + + + + + This node is used for getting the total number of blocks for the associated log file. If the log file isn't generated yet, the value returned is -1; if the trace session is in progress, the value returned is -2. + + + + + + + + + + + text/plain + + + + + BlockIndexToRead + + + + + + This node is used for setting and getting the block index that points to the data block for 'BlockData' node. The value range is 0~(BlockCount-1). + + + + + + + + + + + text/plain + + + + + BlockData + + + + + This node is used to get the binary data of the block that 'BlockIndexToRead' node is pointing to. + + + + + + + + + + + + + + + + DataBlocks + + + + + Root node of all 'BlockNumber' nodes for the associated log file. The number of its children should be the total block count of the log file. No children nodes exist if 'BlockCount' node's value is less than 0. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'BlockNumber' node. The node name is an integer equal to the index of the block which this node stands for. Therefore the node name should be ranging from 0 to (BlockCount -1). It returns the binary data of the block which this node is referring to. + + + + + + + + + + BlockNumber + + + + + + + + + + + Policy + + + + + Contains policy for diagnostic settings. + + + + + + + + + + + + + + + + + + Channels + + + + + Contains policy for Event Log channel settings. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + MaximumFileSize + + + + + + + + Maximum size of the channel log file in MB. + + + + + + + + + + + text/plain + + + + + SDDL + + + + + + + + SDDL String controlling access to the channel. Default: https://docs.microsoft.com/windows/desktop/WES/eventmanifestschema-channeltype-complextype + + + + + + + + + + + + + + text/plain + + + + + ActionWhenFull + + + + + + + + Action to take when the log file reaches maximum size. "Truncate", "Overwrite", "Archive". + + + + + + + + + + + + + + text/plain + + + + + Enabled + + + + + + + + This policy setting specifies whether the channel should be enabled or disabled. Set value to TRUE to enable and FALSE to disable. + + + + + + + + + + + text/plain + + + + + + + + DiagnosticArchive + + + + + Root note for archive definition and collection. + + + + + + + + + + + + + + + ArchiveDefinition + + + + + + + + + + + + + + + + text/plain + + + + + ArchiveResults + + + + + Pull up the results of the last archive run. + + + + + + + + + + + + + + text/plain + + + + + + +``` + ## Related topics diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index aa61f9d50b..4a45bf4eb2 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,6 +1,6 @@ --- title: DMAcc CSP -description: DMAcc CSP +description: Learn how the DMAcc configuration service provider (CSP) allows an OMA Device Management (DM) version 1.2 server to handle OMA DM account objects. ms.assetid: 43e73d8a-6617-44e7-8459-5c96f4422e63 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 232f5672cd..b10dcad38a 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,6 +1,6 @@ --- title: DMAcc DDF file -description: DMAcc DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMAcc configuration service provider (CSP). ms.assetid: 44dc99aa-2a85-498b-8f52-a81863765606 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 7946edba39..6ed30e55f1 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -1,6 +1,6 @@ --- title: DMClient CSP -description: The DMClient configuration service provider is used to specify additional enterprise-specific mobile device management configuration settings for identifying the device in the enterprise domain, security mitigation for certificate renewal, and server-triggered enterprise unenrollment. +description: Understand how the DMClient configuration service provider (CSP) is used to specify enterprise-specific mobile device management (MDM) configuration settings. ms.assetid: a5cf35d9-ced0-4087-a247-225f102f2544 ms.reviewer: manager: dansimp @@ -15,17 +15,21 @@ ms.date: 11/01/2017 # DMClient CSP -The DMClient configuration service provider is used to specify additional enterprise-specific mobile device management configuration settings for identifying the device in the enterprise domain, security mitigation for certificate renewal, and server-triggered enterprise unenrollment. +The DMClient configuration service provider (CSP) is used to specify additional enterprise-specific mobile device management (MDM) configuration settings for identifying the device in the enterprise domain, for security mitigation for certificate renewal, and for server-triggered enterprise unenrollment. -The following diagram shows the DMClient configuration service provider in tree format. +The following diagram shows the DMClient CSP in tree format. ![dmclient csp](images/provisioning-csp-dmclient-th2.png) + +**./Vendor/MSFT** +All the nodes in this CSP are supported in the device context, except for the **ExchangeID** node, which is supported in the user context. For the device context, use the **./Device/Vendor/MSFT** path and for the user context, use the **./User/Vendor/MSFT** path. + **DMClient** Root node for the CSP. **UpdateManagementServiceAddress** -For provisioning packages only. Specifies the list of servers (semicolon delimited). The first server in the semi-colon delimited list is the server that will be used to instantiate MDM sessions. The list can be a permutation or a subset of the existing server list. You cannot add new servers to the list using this node. +For provisioning packages only. Specifies the list of servers (semicolon delimited). The first server in the semicolon-delimited list is the server that will be used to instantiate MDM sessions. The list can be a permutation or a subset of the existing server list. You cannot add new servers to the list using this node. **HWDevID** Added in Windows 10, version 1703. Returns the hardware device ID. @@ -45,16 +49,17 @@ For Intune, use **MS DM Server** for Windows desktop or **SCConfigMgr** for Wind Supported operations are Get and Add. **Provider/*ProviderID*/EntDeviceName** -Optional. Character string that contains the user-friendly device name used by the IT admin console. The value is set during the enrollment process by way of the DMClient configuration service provider. You can retrieve it later during an OMA DM session. +Optional. Character string that contains the user-friendly device name used by the IT admin console. The value is set during the enrollment process by way of the DMClient CSP. You can retrieve it later during an OMA DM session. Supported operations are Get and Add. **Provider/*ProviderID*/EntDMID** -Optional. Character string that contains the unique enterprise device ID. The value is set by the management server during the enrollment process by way of the DMClient configuration service provider. You can retrieve it later during an OMA DM session. +Optional. Character string that contains the unique enterprise device ID. The value is set by the management server during the enrollment process by way of the DMClient CSP. You can retrieve it later during an OMA DM session. Supported operations are Get and Add. -> **Note**   Although hardware device IDs are guaranteed to be unique, there is a concern that this is not ultimately enforceable during a DM session. The device ID could be changed through the w7 APPLICATION configuration service provider’s **USEHWDEVID** parm by another management server. So during enterprise bootstrap and enrollment, a new device ID is specified by the enterprise server. +> [!NOTE] +> Although hardware device IDs are guaranteed to be unique, there is a concern that this is not ultimately enforceable during a DM session. The device ID could be changed through the w7 APPLICATION CSP’s **USEHWDEVID** parm by another management server. So during enterprise bootstrap and enrollment, a new device ID is specified by the enterprise server. This node is required and must be set by the server before the client certificate renewal is triggered. @@ -62,7 +67,8 @@ This node is required and must be set by the server before the client certificat **Provider/*ProviderID*/ExchangeID** Optional. Character string that contains the unique Exchange device ID used by the Outlook account of the user the session is running against. This is useful for the enterprise management server to correlate and merge records for a device that is managed by exchange and natively managed by a dedicated management server. -> **Note**  In some cases for the desktop, this node will return "not found" until the user sets up their email. +> [!NOTE] +> In some cases for the desktop, this node will return "not found" until the user sets up their email. @@ -87,7 +93,7 @@ The following is a Get command example. Supported operation is Get. **Provider/*ProviderID*/SignedEntDMID** -Optional. Character string that contains the device ID. This node and the nodes **CertRenewTimeStamp** can be used by the mobile device management server to verify client identity in order to update the registration record after the device certificate is renewed. The device signs the **EntDMID** with the old client certificate during the certificate renewal process and saves the signature locally. +Optional. Character string that contains the device ID. This node and the nodes **CertRenewTimeStamp** can be used by the MDM server to verify client identity in order to update the registration record after the device certificate is renewed. The device signs the **EntDMID** with the old client certificate during the certificate renewal process and saves the signature locally. Supported operation is Get. @@ -99,11 +105,12 @@ Supported operation is Get. **Provider/*ProviderID*/ManagementServiceAddress** Required. The character string that contains the device management server address. It can be updated during an OMA DM session by the management server to allow the server to load balance to another server in situations where too many devices are connected to the server. -> **Note**  When the ManagementServerAddressList value is set, the device ignores the value in ManagementServiceAddress. +> [!NOTE] +> When the **ManagementServerAddressList** value is set, the device ignores the value. -The DMClient configuration service provider will save the address to the same location as the w7 and DMS configuration service providers to ensure the management client has a single place to retrieve the current server address. The initial value for this node is the same server address value as bootstrapped via the [w7 APPLICATION configuration service provider](w7-application-csp.md). +The DMClient CSP will save the address to the same location as the w7 and DMS CSPs to ensure the management client has a single place to retrieve the current server address. The initial value for this node is the same server address value as bootstrapped via the [w7 APPLICATION configuration service provider](w7-application-csp.md). Starting in Windows 10, version 1511, this node supports multiple server addresses in the format <URL1><URL2><URL3>. If there is only a single URL, then the <> are not required. This is supported for both desktop and mobile devices. @@ -132,7 +139,7 @@ Optional. The character string that allows the user experience to include a cust Supported operations are Get, Replace, and Delete. **Provider/*ProviderID*/RequireMessageSigning** -Boolean type. Primarly used for SSL bridging mode where firewalls and proxies are deployed and where device client identity is required. When enabled, every SyncML message from the device will carry an additional HTTP header named MDM-Signature. This header contains BASE64-encoded Cryptographic Message Syntax using a Detached Signature of the complete SyncML message SHA-2 (inclusive of the SyncHdr and SyncBody). Signing is performed using the private key of the management session certificate that was enrolled as part of the enrollment process. The device public key and PKCS9 UTC signing time stamp are included as part of the authenticated attributes in the signature. +Boolean type. Primarily used for SSL bridging mode where firewalls and proxies are deployed and where device client identity is required. When enabled, every SyncML message from the device will carry an additional HTTP header named MDM-Signature. This header contains BASE64-encoded Cryptographic Message Syntax using a Detached Signature of the complete SyncML message SHA-2 (inclusive of the SyncHdr and SyncBody). Signing is performed using the private key of the management session certificate that was enrolled as part of the enrollment process. The device public key and PKCS9 UTC signing time stamp are included as part of the authenticated attributes in the signature. Default value is false, where the device management client does not include authentication information in the management session HTTP header. Optionally set to true, where the client authentication information is provided in the management session HTTP header. @@ -143,8 +150,8 @@ Supported operations are Get, Replace, and Delete. **Provider/*ProviderID*/SyncApplicationVersion** Optional. Used by the management server to set the DM session version that the server and device should use. Default is 1.0. In Windows 10, the DM session protocol version of the client is 2.0. If the server is updated to support 2.0, then you should set this value to 2.0. In the next session, check to see if there is a client behavior change between 1.0 and 2.0. -> **Note**   -This node is only supported in Windows 10 and later. +> [!NOTE] +> This node is only supported in Windows 10 and later. Once you set the value to 2.0, it will not go back to 1.0. @@ -160,9 +167,9 @@ When you query this node, a Windows 10 client will return 2.0 and a Windows 8. Supported operation is Get. **Provider/*ProviderID*/AADResourceID** -Optional. This is the ResourceID used when requesting the user token from the OMA DM session for Azure Active Directory enrollments (AAD Join or Add Accounts). The token is audience specific, which allows for different service principals (enrollment vs. device management). It can be an application ID or the endpoint that you are trying to access. +Optional. This is the ResourceID used when requesting the user token from the OMA DM session for Azure Active Directory (Azure AD) enrollments (Azure AD Join or Add Accounts). The token is audience-specific, which allows for different service principals (enrollment vs. device management). It can be an application ID or the endpoint that you are trying to access. -For more information about Azure Active Directory enrollment, see [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md). +For more information about Azure AD enrollment, see [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md). **Provider/*ProviderID*/EnableOmaDmKeepAliveMessage** Added in Windows 10, version 1511. A boolean value that specifies whether the DM client should send out a request pending alert in case the device response to a DM request is too slow. @@ -203,7 +210,7 @@ Here is an example of DM message sent by the device when it is in pending state: ``` **Provider/*ProviderID*/AADDeviceID** -Added in Windows 10, version 1607. Returns the device ID for the Azure Active Directory device registration. +Added in Windows 10, version 1607. Returns the device ID for the Azure AD device registration. Supported operation is Get. @@ -218,14 +225,15 @@ Added in Windows 10, version 1607. Returns the hardware device ID. Supported operation is Get. **Provider/*ProviderID*/CommercialID** -Added in Windows 10, version 1607. Configures the identifier used to uniquely associate this diagnostic data of this device as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data with your organization.. +Added in Windows 10, version 1607. Configures the identifier used to uniquely associate this diagnostic data of this device as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data with your organization. Supported operations are Add, Get, Replace, and Delete. **Provider/*ProviderID*/ManagementServerAddressList** -Added in Windows 10, version 1607. The list of management server URLs in the format <URL1><URL2><URL3>, etc... If there is only one, the angle brackets (<>) are not required. +Added in Windows 10, version 1607. The list of management server URLs in the format <URL1><URL2><URL3>, and so on. If there is only one, the angle brackets (<>) are not required. -> **Note**  The < and > should be escaped. +> [!NOTE] +> The < and > should be escaped. @@ -255,12 +263,13 @@ Optional. Added in Windows 10, version 1703. Specify the Discovery server URL o Supported operations are Add, Delete, Get, and Replace. Value type is string. **Provider/*ProviderID*/NumberOfDaysAfterLostContactToUnenroll** -Optional. Number of days after last sucessful sync to unenroll. +Optional. Number of days after last successful sync to unenroll. Supported operations are Add, Delete, Get, and Replace. Value type is integer. **Provider/*ProviderID*/AADSendDeviceToken** -Device. Added in Windows 10 version 1803. For AZure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained. + +Device. Added in Windows 10 version 1803. For Azure AD backed enrollments, this will cause the client to send a Device Token if the User Token cannot be obtained. Supported operations are Add, Delete, Get, and Replace. Value type is bool. @@ -377,7 +386,8 @@ If there is no infinite schedule set, then a 24-hour schedule is created and sch **Invalid poll schedule: disable all poll schedules** -> **Note**   Disabling poll schedules results in UNDEFINED behavior and enrollment may fail if poll schedules are all set to zero. +> [!NOTE] +> Disabling poll schedules results in UNDEFINED behavior and enrollment may fail if poll schedules are all set to zero. @@ -552,12 +562,12 @@ Optional. Boolean value that allows the IT admin to require the device to start Supported operations are Add, Get, and Replace. **Provider/*ProviderID*/Push** -Optional. Not configurable during WAP Provisioining XML. If removed, DM sessions triggered by Push will no longer be supported. +Optional. Not configurable during WAP Provisioning XML. If removed, DM sessions triggered by Push will no longer be supported. Supported operations are Add and Delete. **Provider/*ProviderID*/Push/PFN** -Required. A string provided by the Windows 10 ecosystem for a Mobile Device Management solution. Used to register a device for Push Notifications. The server must use the same PFN as the devices it is managing. +Required. A string provided by the Windows 10 ecosystem for an MDM solution. Used to register a device for Push Notifications. The server must use the same PFN as the devices it is managing. Supported operations are Add, Get, and Replace. @@ -665,7 +675,7 @@ Required. Added in Windows 10, version 1709. This node contains a list of LocURI Supported operations are Add, Delete, Get, and Replace. Value type is string. **Provider/*ProviderID*/FirstSyncStatus/ExpectedMSIAppPackages** -Required. Added in Windows 10, version 1709. This node contains a list of LocURIs that refer to App Packages the management service provider expects to provision via EnterpriseDesktopAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the amount of apps included in the App Package. We will not verify that number. For example, `./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID1/Status;4"\xF000" ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID2/Status;2` This represents App Package ProductID1 containing 4 apps, and ProductID2 containing 2 apps. +Required. Added in Windows 10, version 1709. This node contains a list of LocURIs that refer to App Packages the management service provider expects to provision via EnterpriseDesktopAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We will not verify that number. For example, `./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID1/Status;4"\xF000" ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID2/Status;2` This represents App Package ProductID1 containing four apps, and ProductID2 containing two apps. Supported operations are Add, Delete, Get, and Replace. Value type is string. @@ -677,7 +687,7 @@ Required. Added in Windows 10, version 1709. This node contains a list of LocURI ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName2/Name;2 ``` -This represents App Package PackageFullName containing 4 apps, and PackageFullName2 containing 2 apps. +This represents App Package PackageFullName containing four apps, and PackageFullName2 containing two apps. Supported operations are Add, Delete, Get, and Replace. Value type is string. diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index c93fe4da96..c5ba87da90 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,6 +1,6 @@ --- title: DMClient DDF file -description: DMClient DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMClient configuration service provider (CSP). ms.assetid: A21B33AF-DB76-4059-8170-FADF2CB898A0 ms.reviewer: manager: dansimp @@ -957,7 +957,7 @@ The XML below is for Windows 10, version 1803. - Number of days after last sucessful sync to unenroll + Number of days after last successful sync to unenroll @@ -1022,7 +1022,6 @@ The XML below is for Windows 10, version 1803. - diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index 25b59bccc1..b9ed5780d0 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -1,6 +1,6 @@ --- title: DMProcessConfigXMLFiltered function -description: Configures phone settings by using OMA Client Provisioning XML. +description: Learn how the DMProcessConfigXMLFiltered function configures phone settings by using OMA Client Provisioning XML. Search.Refinement.TopicID: 184 ms.assetid: 31D79901-6206-454C-AE78-9B85A3B3487F ms.reviewer: @@ -24,8 +24,8 @@ ms.date: 06/26/2017 # DMProcessConfigXMLFiltered function -> **Important**   -The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses. +> [!Important] +> The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses. Configures phone settings by using OMA Client Provisioning XML. Use of this function is strictly limited to the following scenarios. diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index b395c7c3ba..65aeb1a961 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -1,6 +1,6 @@ --- title: DMSessionActions CSP -description: DMSessionActions CSP +description: Learn how the DMSessionActions configuration service provider (CSP) is used to manage the number of sessions the client skips if the device is in a low power state. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index aef1210842..61b4b4754a 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -1,6 +1,6 @@ --- title: DMSessionActions DDF file -description: DMSessionActions DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMSessionActions configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index e7d55aedc0..b6fe50d931 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -1,6 +1,6 @@ --- title: DynamicManagement CSP -description: DynamicManagement CSP +description: Learn how the Dynamic Management configuration service provider (CSP) enables configuration of policies that change how the device is managed. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index 3439bf646a..2690fa4e23 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: DynamicManagement DDF file -description: DynamicManagement DDF file +description: Learn about the OMA DM device description framework (DDF) for the DynamicManagement configuration service provider (CSP). ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 03e82dc9e8..7ccca3fe88 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -1,6 +1,6 @@ --- title: EAP configuration -description: The topic provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for the VPN profile and information about EAP certificate filtering in Windows 10. +description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows 10. ms.assetid: DD3F2292-4B4C-4430-A57F-922FED2A8FAE ms.reviewer: manager: dansimp @@ -15,46 +15,46 @@ ms.date: 06/26/2017 # EAP configuration -The topic provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for the VPN profile and information about EAP certificate filtering in Windows 10. +This article provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including information about EAP certificate filtering in Windows 10. -## Create an Extensible Authentication Protocol (EAP) configuration XML for the VPN profile +## Create an EAP configuration XML for a VPN profile -Here is an easy way to get the EAP configuration from your desktop using the rasphone tool that is shipped in the box. +To get the EAP configuration from your desktop using the rasphone tool that is shipped in the box: 1. Run rasphone.exe. ![vpnv2 rasphone](images/vpnv2-csp-rasphone.png) -2. If you don't currently have any VPN connections and you see the following message, click **OK**. +1. If you don't currently have a VPN connection and you see the following message, select **OK**. ![vpnv2 eap configuration](images/vpnv2-csp-networkconnections.png) -3. Select **Workplace network** in the wizard. +1. In the wizard, select **Workplace network**. ![vpnv2 eap configuration](images/vpnv2-csp-setupnewconnection.png) -4. Enter any dummy information for the internet address and connection name. These can be fake since it does not impact the authentication parameters. +1. Enter an Internet address and connection name. These can be fake since it does not impact the authentication parameters. ![vpnv2 eap configuration](images/vpnv2-csp-setupnewconnection2.png) -5. Create a fake VPN connection. In the UI shown below, click **Properties**. +1. Create a fake VPN connection. In the UI shown here, select **Properties**. ![vpnv2 eap configuration](images/vpnv2-csp-choosenetworkconnection.png) -6. In the **Test Properties** dialog, click the **Security** tab. +1. In the **Test Properties** dialog, select the **Security** tab. ![vpnv2 eap configuration](images/vpnv2-csp-testproperties.png) -7. In the **Security** tab, select **Use Extensible Authentication Protocol (EAP)** radio button. +1. On the **Security** tab, select **Use Extensible Authentication Protocol (EAP)**. ![vpnv2 eap configuration](images/vpnv2-csp-testproperties2.png) -8. From the drop down menu, select the EAP method that you want to configure. Then click **Properties** to configure as needed. +1. From the drop-down menu, select the EAP method that you want to configure, and then select **Properties** to configure as needed. ![vpnv2 eap configuration](images/vpnv2-csp-testproperties3.png)![vpnv2 eap configuration](images/vpnv2-csp-testproperties4.png) -9. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. +1. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. ```powershell Get-VpnConnection -Name Test @@ -88,7 +88,7 @@ Here is an easy way to get the EAP configuration from your desktop using the ras $a.EapConfigXmlStream.InnerXml ``` - Here is an example output + Here is an example output. ```xml - - - 2 - - - chr - text/plain - - - ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/AllowAppVClient - - - - - - - -``` + > [!NOTE] + > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. + + ```xml + + + + 2 + + + chr + text/plain + + + ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/AllowAppVClient + + + + + + + + ``` ## Enable a policy that requires parameters -1. Create the SyncML to enable the policy that requires parameters. + 1. Create the SyncML to enable the policy that requires parameters. - In this example, the policy is in **Administrative Templates > System > App-V > Publishing**. + In this example, the policy is in **Administrative Templates > System > App-V > Publishing**. 1. Double-click **Publishing Server 2 Settings** to see the parameters you need to configure when you enable this policy. @@ -106,7 +107,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). - ![Publishing server 2 policy description](images/admx-appv-policy-description.png) + ![Publishing server 2 policy description](images/admx-appv-policy-description.png) 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx. @@ -226,41 +227,41 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( Here is the example for **AppVirtualization/PublishingAllowServer2**: -> [!NOTE] -> The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. - - ```xml - - - - - 2 - - - chr - text/plain - - - ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2 - - - ]]> - - - - - - - ``` + > [!NOTE] + > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. + + ```xml + + + + + 2 + + + chr + text/plain + + + ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2 + + + ]]> + + + + + + + ``` ## Disable a policy diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index e05ab31e6f..7ef806784f 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -1,6 +1,6 @@ --- title: Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices -description: Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. +description: Overview of how to enable offline updates using Microsoft Endpoint Configuration Manager. ms.assetid: ED3DAF80-847C-462B-BDB1-486577906772 ms.reviewer: manager: dansimp @@ -15,9 +15,9 @@ ms.date: 06/26/2017 # Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices -Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. However, in some enterprise environments, devices may not be able to access the Internet to retrieve their updates. Because of network restrictions or other enterprise policies, devices must download their updates from an internal location. This document describes how to enable offline updates using System Center Configuration Manager. +Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. However, in some enterprise environments, devices may not be able to access the Internet to retrieve their updates. There are also situations where network restrictions or other enterprise policies require that devices download updates from an internal location. This article describes how to enable offline updates using Microsoft Endpoint Configuration Manager. -Here is a table of update path to Windows 10 Mobile. +The following table describes the update path to Windows 10 Mobile. @@ -47,9 +47,7 @@ Here is a table of update path to Windows 10 Mobile.
            -To configure the MDM service provider and enable the mobile devices to download updates from a predefined internal location, an IT administrator or device administrator must perform a series of manual and automated steps. - -Here is the outline of the process: +To configure the mobile device management (MDM) service provider and enable mobile devices to download updates from a predefined internal location, an IT administrator or device administrator must perform a series of manual and automated steps: 1. Prepare a test device that can connect to the Internet to download the released update packages. 2. After the updates are downloaded and before pressing the install button, retrieve an XML file on the device that contains all the metadata about each update package. @@ -61,64 +59,65 @@ Here is the outline of the process: 8. Create two additional XML files that define the specific updates to download and the specific locations from which to download the updates, and deploy them onto the production device. 9. Start the update process from the devices. -As a part of the update process, Windows will run data migrators to bring forward configured settings and data on the device. For instance, if the device was configured with a maintenance time or other update policy in Windows Embedded 8.1 Handheld, these settings will automatically get migrated to Windows 10 as part of the update process. If the Handheld device was configured for assigned access lockdown, then this configuration will also get migrated to Windows 10 as part of the update process. This includes ProductId & AumId conversion for all internal apps (including buttonremapping apps). +As a part of the update process, Windows runs data migrators to bring forward configured settings and data on the device. For instance, if the device was configured with a maintenance time or other update policy in Windows Embedded 8.1 Handheld, these settings are automatically migrated to Windows 10 as part of the update process. If the handheld device was configured for assigned access lockdown, then this configuration is also migrated to Windows 10 as part of the update process. This includes ProductId and AumId conversion for all internal apps (including buttonremapping apps). -Note that the migrators do not take care of the following: +Be aware that the migrators do not take care of the following: -- 3rd party apps provided by OEMs -- deprecated 1st party apps, such as Bing News -- deprecated system/application settings, such as Microsoft.Game, Microsoft.IE +- Third-party apps provided by OEMs. +- Deprecated first-party apps, such as Bing News. +- Deprecated system or application settings, such as Microsoft.Game and Microsoft.IE. In the event of an Enterprise Reset, these migrated settings are automatically persisted. -Down the road, after the upgrade to Windows 10 is complete, if you decide to push down a new wehlockdown.xml, you would need to take the following steps to ensure that the updated settings are persisted through an Enterprise Reset: +After the upgrade to Windows 10 is complete, if you decide to push down a new wehlockdown.xml, you need to take the following steps to ensure that the updated settings are persisted through an Enterprise Reset: 1. Delete the TPK\*ppkg and push down a new ppkg with your new configuration to the persistent folder. -2. Push down a new ppkg with your new configuration with higher priority. Note that in ICD, Owner=Microsoft, Rank=0 is the lowest priority; and vise versa. With this step, the old assigned access lockdown configuration will be overwritten. +2. Push down a new ppkg with your new configuration with higher priority. (Be aware that in ICD, Owner=Microsoft, Rank=0 is the lowest priority, and vice versa. With this step, the old assigned access lockdown configuration is overwritten.) **Requirements:** - The test device must be same as the other production devices that are receiving the updates. -- Your test device must be enrolled with System Center Configuration Manager. -- Your device can connect to the Internet. -- Your device must have an SD card with at least 0.5 GB of free space. -- Ensure that the settings app and PhoneUpdate applet are available via Assigned Access. +- The test device must be enrolled with Microsoft Endpoint Configuration Manager. +- The test device must be connected to the Internet. +- The test device must have an SD card with at least 0.5 GB of free space. +- Ensure that the settings app and PhoneUpdate applet are available through Assigned Access. -The following diagram is a high-level overview of the process. +The following diagram shows a high-level overview of the process. ![update process for windows embedded 8.1 devices](images/windowsembedded-update.png) ## Step 1: Prepare a test device to download updates from Microsoft Update -Define the baseline update set that will be applied to other devices. Use a device that is running the most recent image as the test device. +Define the baseline update set that you want to apply to other devices. Use a device that is running the most recent image as the test device. -Trigger the device to check for updates either manually or using System Center Configuration Manager. +Trigger the device to check for updates either manually or using Microsoft Endpoint Configuration Manager. -**Manually** +**Check for updates manually** -1. From the device, go to **Settings** > **Phone updates** > **Check for updates**. -2. Sync the device. Go to **Settings** > **Workplace** > **Enrolled** and click the refresh icon. Repeat as needed. -3. Follow the prompts to download the updates, but do not press the install button. +1. On the device, go to **Settings** > **Phone updates** > **Check for updates**. +2. Sync the device, go to **Settings** > **Workplace** > **Enrolled**, and then select the refresh icon. Repeat as needed. +3. Follow the prompts to download the updates, but do not select the **Install** button. -> **Note**  There is a bug in all OS versions up to GDR2 where the CSP will not set the assigned value. There is no way to change or set this until GDR2 is deployed onto the device. +> [!NOTE] +> There is a bug in all OS versions up to GDR2 where the Cloud Solution Provider (CSP) does not set the assigned value. There is no way to change or set this until GDR2 is deployed onto the device. -**Using System Center Configuration Manager** +**Check for updates by using Microsoft Endpoint Configuration Manager** -1. Remotely trigger a scan of the test device by deploying a Trigger Scan Configuration Baseline. +1. Remotely trigger a scan of the test device by deploying a Trigger Scan configuration baseline. - ![device scan using sccm](images/windowsembedded-update2.png) + ![device scan using Configuration Manager](images/windowsembedded-update2.png) -2. Set the value of this OMA-URI by browsing to the settings of this Configuration Item and selecting the newly created Trigger Scan settings from the previous step. +2. Set the value of this OMA-URI by going to **Configuration Item**, and then selecting the newly created Trigger Scan settings from the previous step. - ![device scan using sccm](images/windowsembedded-update3.png) + ![device scan using Configuration Manager](images/windowsembedded-update3.png) -3. Ensure that the value that is specified for this URI is greater than the value on the device(s) and that the Remediate noncompliant rules when supported option is checked. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. +3. Ensure that the value that is specified for this URI is greater than the value on the device(s), and that the **Remediate noncompliant rules when supported** option is selected. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. - ![device scan using sccm](images/windowsembedded-update4.png) + ![device scan using Configuration Manager](images/windowsembedded-update4.png) -4. Create a Configuration Baseline for TriggerScan and Deploy. It is recommended that this Configuration Baseline be deployed after the Controlled Updates Baseline has been applied to the device (the corresponding files are deployed on the device through a device sync session). +4. Create a configuration baseline for Trigger Scan and Deploy. We recommend that this configuration baseline be deployed after the Controlled Updates baseline has been applied to the device. (The corresponding files are deployed on the device through a device sync session.) 5. Follow the prompts for downloading the updates, but do not install the updates on the device. @@ -130,23 +129,24 @@ There are two ways to retrieve this file from the device; one pre-GDR1 and one p **Pre-GDR1: Parse a compliance log from the device in ConfigMgr** -1. Create a Configuration Item using ConfigMgr to look at the registry entry ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/ApprovedUpdatesXml. +1. Use ConfigMgr to create a configuration item to look at the registry entry ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/ApprovedUpdatesXml. - > **Note**  In System Center Configuration Manager, you may see an error about exceeding the file limit when using ApprovedUpdatesXml. However, the process still completes even if the file is large. + > [!NOTE] + > In Microsoft Endpoint Configuration Manager, you may see an error about exceeding the file limit when using ApprovedUpdatesXml, but the process still completes even if the file is large. - If the XML file is greater than 32K you can also use ./Vendor/MSFT/FileSystem/<*filename*>. -2. Set a baseline for this Configuration Item with a “dummy” value (such as zzz), and ensure that you do not remediate it. + If the XML file is greater than 32 KB, you can also use ./Vendor/MSFT/FileSystem/<*filename*>. +2. Set a baseline for this configuration item with a “dummy” value (such as zzz), and ensure that you do not remediate it. - The dummy value is not be set; it is only used for comparison. -3. After the report XML is sent to the device, System Center Configuration Manager displays a compliance log that contains the report information. The log can contain significant amount of data. + The dummy value is not set; it is only used for comparison. +3. After the report XML is sent to the device, Microsoft Endpoint Configuration Manager displays a compliance log that contains the report information. The log can contain significant amount of data. 4. Parse this log for the report XML content. -For a step-by-step walkthrough, see [How to retrieve a device update report using System Center Configuration Manager logs](#how-to-retrieve-a-device-update-report-using-system-center-configuration-manager-logs). +For a step-by-step walkthrough, see [Retrieve a device update report using Microsoft Endpoint Configuration Manager logs](#retrieve-a-device-update-report-using-microsoft-endpoint-configuration-manager-logs). **Post-GDR1: Retrieve the report xml file using an SD card** -1. Create a Configuration Item using ConfigMgr to set a registry value for ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/CopyUpdateReportToSDCard. -2. The value that you define for this Configuration Item is defined by the relative path to the SD card which includes the filename of the XML file (such as SDCardRoot\\Update\\DUReport.xml). +1. Use ConfigMgr to create a configuration item to set a registry value for ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/CopyUpdateReportToSDCard. +2. The value that you define for this configuration item is defined by the relative path to the SD card, which includes the filename of the XML file (such as SDCardRoot\\Update\\DUReport.xml). 3. Remove the SD card from device and copy the XML file to your PC. ## Step 3: Check the status code in the XML file @@ -197,80 +197,84 @@ Here are the two files.   -For a walkthrough of these steps, [How to deploy controlled updates](#how-to-deploy-controlled-updates). Ensure that the trigger scan configuration baseline HAS NOT been deployed. +For a walkthrough of these steps, see [Deploy controlled updates](#deploy-controlled-updates). Ensure that the Trigger Scan configuration baseline has NOT been deployed. -### How to deploy controlled updates -This process has three parts: +### Deploy controlled updates -- Create a configuration item for DUControlledUpdates.xml -- Create a configuration item for DUCustomContentURIs.xml +The deployment process has three parts: + +- Create a configuration item for DUControlledUpdates.xml. +- Create a configuration item for DUCustomContentURIs.xml. - Create a configuration item for approved updates. + **Create a configuration item for DUControlledUpdates.xml** -1. Create a configuration item. In the **Browse Settings** window, select **Device File** as a filter, and then click **Select**. +1. Create a configuration item. In the **Browse Settings** window, select **Device File** as a filter, and then select **Select**. ![embedded device update](images/windowsembedded-update18.png) -2. Browse to the DUControlledUpdates.xml that was created from the test device and specify that file path and name on the device as `NonPersistent\DUControlledUpdates.xml`. +2. Browse to the DUControlledUpdates.xml that was created from the test device, and then specify the file path and name on the device as `NonPersistent\DUControlledUpdates.xml`. ![embedded device update](images/windowsembedded-update19.png) -3. Check the box **Remediate noncompliant settings**. -4. Click **OK**. +3. Select **Remediate noncompliant settings**, and then select **OK**. + **Create a configuration item for DUCustomContentURIs.xml** -1. Create a configuration item and specify that file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` -2. Check the box **Remediate noncompliant settings**. +1. Create a configuration item and specify the file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` +2. Select **Remediate noncompliant settings**. - ![embedded device upate](images/windowsembedded-update21.png) + ![embedded device update](images/windowsembedded-update21.png) -3. Click **OK**. +3. Select **OK**. + **Create a configuration baseline for approved updates** 1. Create a configuration baseline item and give it a name (such as ControlledUpdates). -2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then click **OK**. +2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then select **OK**. - ![embedded device upate](images/windowsembedded-update22.png) + ![embedded device update](images/windowsembedded-update22.png) 3. Deploy the configuration baseline to the appropriate device or device collection. - ![embedded device upate](images/windowsembedded-update23.png) + ![embedded device update](images/windowsembedded-update23.png) -4. Click **OK**. +4. Select **OK**. ## Step 7: Trigger the other devices to scan, download, and install updates Now that the other "production" or "in-store" devices have the necessary information to download updates from an internal share, the devices are ready for updates. -### Use this process for unmanaged devices +### Update unmanaged devices -If the update policy of the device is not managed or restricted by System Center Configuration Manager, an update process can be initiated on the device in one of the following ways: +If the update policy of the device is not managed or restricted by Microsoft Endpoint Configuration Manager, an update process can be initiated on the device in one of the following ways: -- Initiated by a periodic scan that the device automatically performs. -- Initiated manually through **Settings** -> **Phone Update** -> **Check for Updates**. +- A periodic scan that the device automatically performs. +- Manually through **Settings** > **Phone Update** > **Check for Updates**. -### Use this process for managed devices +### Update managed devices If the update policy of the device is managed or restricted by MDM, an update process can be initiated on the device in one of the following ways: -- Trigger the device to scan for updates through System Center Configuration Manager. +- Trigger the device to scan for updates through Microsoft Endpoint Configuration Manager. Ensure that the trigger scan has successfully executed, and then remove the trigger scan configuration baseline. - > **Note**  Ensure that the PhoneUpdateRestriction Policy is set to a value of 0, to ensure that the device will not perform an automatic scan. + > [!NOTE] + > Ensure that the PhoneUpdateRestriction Policy is set to a value of 0 so that the device doesn't perform an automatic scan. -- Trigger the device to scan as part of a Maintenance Window defined by the IT Admin in System Center Configuration Manager. +- Trigger the device to scan as part of a Maintenance Window defined by the IT Admin in Microsoft Endpoint Configuration Manager. -After the installation of updates is completed, the IT Admin can use the DUReport generated in the production devices to determine if the device successfully installed the list of updates. If the device did not, error codes are provided in the DUReport.xml. To retrieve the device update report from a device, perform the same steps defined in [Step 2](#step2). +After the updates are installed, the IT Admin can use the DUReport generated in the production devices to determine whether the device successfully installed the list of updates. If the device did not, error codes are provided in the DUReport.xml. To retrieve the device update report from a device, perform the same steps defined in [Step 2](#step2). ## Example PowerShell script @@ -456,71 +460,70 @@ DownloadFiles $inputFile $downloadCache $localCacheURL ``` -## How to retrieve a device update report using System Center Configuration Manager logs - -Use this procedure for pre-GDR1 devices. +## Retrieve a device update report using Microsoft Endpoint Configuration Manager logs **For pre-GDR1 devices** +Use this procedure for pre-GDR1 devices: -1. Trigger a device scan. Go to **Settings** -> **Phone Update** -> **Check for Updates**. +1. Trigger a device scan by going to **Settings** > **Phone Update** > **Check for Updates**. Since the DUReport settings have not been remedied, you should see a non-compliance. -2. In System Center Configuration Manager under **Assets and Compliance** > **Compliance Settings**, right-click on **Configuration Items**. +2. In Microsoft Endpoint Configuration Manager, under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Items**. 3. Select **Create Configuration Item**. - ![device update using sccm](images/windowsembedded-update5.png) -4. Enter a filename (such as GetDUReport) and then choose **Mobile Device**. -5. In the **Mobile Device Settings** page, check the box **Configure Additional Settings that are not in the default settings group**, and the click **Next**. + ![device update using Configuration Manager](images/windowsembedded-update5.png) +4. Enter a filename (such as GetDUReport), and then select **Mobile Device**. +5. On the **Mobile Device Settings** page, select **Configure Additional Settings that are not in the default settings group**, and then select **Next**. - ![device update using sccm](images/windowsembedded-update6.png) -6. In the **Additional Settings** page, click **Add**. + ![device update using Configuration Manager](images/windowsembedded-update6.png) +6. On the **Additional Settings** page, select **Add**. - ![device update using sccm](images/windowsembedded-update7.png) -7. In the **Browse Settings** page, click **Create Setting**. + ![device update using Configuration Manager](images/windowsembedded-update7.png) +7. On the **Browse Settings** page, select **Create Setting**. ![device update](images/windowsembedded-update8.png) -8. Enter a unique **Name**. For the **Setting type**, select **OMA-URI** and for the **Data type**, select **String**. -9. In the **OMA-URI** text box, enter `./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml`, the click **OK**. +8. Enter a unique **Name**. For **Setting type**, select **OMA-URI**, and for **Data type**, select **String**. +9. In the **OMA-URI** text box, enter `./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml`, and then select **OK**. ![handheld device update](images/windowsembedded-update9.png) -10. In the **Browse Settings** page, click **Close**. -11. In the **Create Configuration Item Wizard** page, check **All Windows Embedded 8.1 Handheld** as the supported platform, and then click **Next**. +10. On the **Browse Settings** page, select **Close**. +11. On the **Create Configuration Item Wizard** page, select **All Windows Embedded 8.1 Handheld** as the supported platform, and then select **Next**. ![embedded device update](images/windowsembedded-update10.png) 12. Close the **Create Configuration Item Wizard** page. 13. Right-click on the newly create configuration item, and then select the **Compliance Rules** tab. -14. Click the new created mobile device setting (such as DUReport) and then click **Select**. +14. Select the new created mobile device setting (such as DUReport), and then select **Select**. 15. Enter a dummy value (such as zzz) that is different from the one on the device. ![embedded device update](images/windowsembedded-update11.png) -16. Disable remediation by unchecking the **Remediate noncompliant rules when supported** option. -17. Click **OK** to close the Edit Rule page. -18. Create a new configuration baseline. Under **Assets and Compliance** > **Compliance Settings**, right-click on **Configuration Baselines**. +16. Disable remediation by deselecting the **Remediate noncompliant rules when supported** option. +17. Select **OK** to close the **Edit Rule** page. +18. Create a new configuration baseline. Under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Baselines**. 19. Select **Create Configuration Item**. ![embedded device update](images/windowsembedded-update12.png) 20. Enter a baseline name (such as RetrieveDUReport). -21. Add the configuration item that you just created. Select **Add** and then select the configuration item that you just created (such as DUReport). +21. Add the configuration item that you just created. Select **Add**, and then select the configuration item that you just created (such as DUReport). ![embedded device update](images/windowsembedded-update13.png) -22. Click **OK**, then click **OK** again to complete the configuration baseline. -23. Deploy the newly created configuration baseline to the appropriate device collection. Right-click on the configuration baseline that you created and the select **Deploy**. +22. Select **OK**, and then select **OK** again to complete the configuration baseline. +23. Deploy the newly created configuration baseline to the appropriate device collection. Right-click on the configuration baseline that you created, and then select **Deploy**. ![embedded device update](images/windowsembedded-update14.png) -24. Check the check box **Remediate noncompliant rules when supported**. +24. Select **Remediate noncompliant rules when supported**. 25. Select the appropriate device collection and define the schedule. ![device update](images/windowsembedded-update15.png) -26. To view the DUReport content, select the appropriate deployment for the configuration saseline that you created. Right-click on the deployment and select **View Status**. -27. Click **Run Summarization** and then click **Refresh**. On the Non-Compliant tab, the test device(s) should be listed. +26. To view the DUReport content, select the appropriate deployment for the configuration baseline that you created. Right-click on the deployment, and then select **View Status**. +27. Select **Run Summarization**, and then select **Refresh**. The test device(s) should be listed on the **Non-Compliant** tab. 28. Under **Asset Details**, right-click on the test device, and then select **Mode Details**. ![device update](images/windowsembedded-update16.png) -29. In the Non-compliant tab, you will see the DUReport, but you cannot retrieve the content from here. +29. On the **Non-compliant** tab, you can see the DUReport, but you cannot retrieve the content from here. ![device update](images/windowsembedded-update17.png) -30. To retrieve the DUReport, open an Explorer windows to C:\\Program Files\\SMS\_CCM\\SMS\_DM.log. -31. In the log file, search from the bottom for "./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml" RuleExression="Equals zzz" where zzz is the dummy value. Just above this copy the information for UpdateData and use this information to create the DUControlledUpdates.xml. +30. To retrieve the DUReport, open C:\\Program Files\\SMS\_CCM\\SMS\_DM.log. +31. In the log file, search from the bottom for "./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml" RuleExression="Equals zzz," where zzz is the dummy value. Just above this, copy the information for UpdateData and use this information to create the DUControlledUpdates.xml.   diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 9f3f924a14..08073b46d6 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,57 +1,62 @@ --- title: Enroll a Windows 10 device automatically using Group Policy -description: Enroll a Windows 10 device automatically using Group Policy +description: Learn how to use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/29/2019 -ms.reviewer: +ms.date: +ms.reviewer: manager: dansimp --- # Enroll a Windows 10 device automatically using Group Policy -Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. +Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. Requirements: - AD-joined PC running Windows 10, version 1709 or later -- The enterprise has configured a mobile device management (MDM) service -- The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md) +- The enterprise has configured a mobile device management (MDM) service +- The on-premises AD must be [integrated with Azure AD (via Azure AD Connect)](https://docs.microsoft.com/azure/architecture/reference-architectures/identity/azure-ad) - The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) +- The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. > [!TIP] > For additional information, see the following topics: > - [How to configure automatic registration of Windows domain-joined devices with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup) -> - [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan) -> - [Azure Active Directory integration with MDM](https://docs.microsoft.com/en-us/windows/client-management/mdm/azure-active-directory-integration-with-mdm) +> - [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) +> - [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm) -The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically AAD registered. +The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD–registered. > [!NOTE] -> In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. +> In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. -In Windows 10, version 1709, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](https://blogs.technet.microsoft.com/cbernier/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/). +In Windows 10, version 1709 or later, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](https://blogs.technet.microsoft.com/cbernier/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/) For this policy to work, you must verify that the MDM service provider allows the GP triggered MDM enrollment for domain joined devices. ## Verify auto-enrollment requirements and settings -To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. +To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. The following steps demonstrate required settings using the Intune service: 1. Verify that the user who is going to enroll the device has a valid Intune license. ![Intune license verification](images/auto-enrollment-intune-license-verification.png) -2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/en-us/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). -Also verify that the **MAM user scope** is set to **None**. Otherwise, it will have precedence over the MDM scope that will lead to issues. +2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) + > [!IMPORTANT] + > For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. + > + > For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. + 3. Verify that the device OS version is Windows 10, version 1709 or later. 4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. This means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. @@ -61,13 +66,13 @@ Also verify that the **MAM user scope** is set to **None**. Otherwise, it will h Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. - ![Auto-enrollment azure AD prt verification](images/auto-enrollment-azureadprt-verification.png) + ![Auto-enrollment Azure AD prt verification](images/auto-enrollment-azureadprt-verification.png) This information can also be found on the Azure AD device list. ![Azure AD device list](images/azure-ad-device-list.png) -5. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery. +5. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc ![MDM discovery URL](images/auto-enrollment-mdm-discovery-url.png) @@ -75,7 +80,7 @@ Also verify that the **MAM user scope** is set to **None**. Otherwise, it will h ![Mobility setting MDM intune](images/auto-enrollment-microsoft-intune-setting.png) -7. Verify that the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is properly deployed to all devices which should be enrolled into Intune. +7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. 8. Verify that the device is not enrolled with the old Intune client used on the Intune Silverlight Portal (this is the Intune portal used before the Azure portal). @@ -89,35 +94,46 @@ You may contact your domain administrators to verify if the group policy has bee This procedure is only for illustration purposes to show how the new auto-enrollment policy works. It is not recommended for the production environment in the enterprise. For bulk deployment, you should use the [Group Policy Management Console process](#configure-the-auto-enrollment-for-a-group-of-devices). Requirements: -- AD-joined PC running Windows 10, version 1709 -- Enterprise has MDM service already configured +- AD-joined PC running Windows 10, version 1709 or later +- Enterprise has MDM service already configured - Enterprise AD must be registered with Azure AD 1. Run GPEdit.msc - Click Start, then in the text box type gpedit. + Click Start, then in the text box type gpedit. ![GPEdit desktop app search result](images/autoenrollment-gpedit.png) 2. Under **Best match**, click **Edit group policy** to launch it. -3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. +3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. - ![MDM policies](images/autoenrollment-mdm-policies.png) + ![MDM policies](images/autoenrollment-mdm-policies.png) -4. Double-click **Auto MDM Enrollment with AAD Token**. +4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. - ![MDM autoenrollment policy](images/autoenrollment-policy.png) + > [!NOTE] + > **Device Credential** Credential Type may work, however, it is not yet supported by Intune. We don't recommend using this option until it's supported. + ![MDM autoenrollment policy](images/autoenrollment-policy.png) -5. Click **Enable**, then click **OK**. +5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. - A task is created and scheduled to run every 5 minutes for the duration of 1 day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." + > [!NOTE] + > In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. + > The default behavior for older releases is to revert to **User Credential**. + > **Device Credential** is not supported for enrollment type when you have a ConfigMgr Agent on your device. - To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). + When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." - If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. + To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). - ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) + If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. + + ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) + + > [!Tip] + > You can avoid this behavior by using Conditional Access Policies in Azure AD. + Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview). 6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. @@ -136,51 +152,80 @@ Requirements: 2. Under **Best match**, click **Task Scheduler** to launch it. -3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. +3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) - To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. + To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. If the device enrollment is blocked, your IT admin may have enabled the **Disable MDM Enrollment** policy. Note that the GPEdit console does not reflect the status of policies set by your IT admin on your device. It is only used by the user to set policies. ## Configure the auto-enrollment for a group of devices Requirements: -- AD-joined PC running Windows 10, version 1709 -- Enterprise has MDM service already configured (with Intune or a third party service provider) +- AD-joined PC running Windows 10, version 1709 or later +- Enterprise has MDM service already configured (with Intune or a third-party service provider) - Enterprise AD must be integrated with Azure AD. - Ensure that PCs belong to same computer group. ->[!IMPORTANT] ->If you do not see the policy, it may be because you don’t have the ADMX installed for Windows 10, version 1803 or version 1809. To fix the issue, follow these steps: -> 1. Download: -> 1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/en-us/download/details.aspx?id=56880) or -> 1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/en-us/download/details.aspx?id=57576). -> 2. Install the package on the Primary Domain Controller (PDC). -> 3. Navigate, depending on the version to the folder: -> 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2**, or -> 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2** -> 4. Copy policy definitions folder to **C:\Windows\SYSVOL\domain\Policies**. -> 5. Restart the Primary Domain Controller for the policy to be available. -> This procedure will work for any future version as well. +> [!IMPORTANT] +> If you do not see the policy, it may be because you don't have the ADMX for Windows 10, version 1803, version 1809, or version 1903 installed. To fix the issue, use the following procedures. Note that the latest MDM.admx is backwards compatible. + +1. Download: + + - 1803 --> [Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) + + - 1809 --> [Administrative Templates (.admx) for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) + + - 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495) + + - 1909 --> [Administrative Templates (.admx) for Windows 10 November 2019 Update (1909)](https://www.microsoft.com/download/confirmation.aspx?id=100591) + + - 2004 --> [Administrative Templates (.admx) for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/confirmation.aspx?id=101445) + + - 20H2 --> [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) + +2. Install the package on the Domain Controller. + +3. Navigate, depending on the version to the folder: + + - 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2** + + - 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2** + + - 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3** + + - 1909 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2019 Update (1909)** + + - 2004 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2020 Update (2004)** + + - 20H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2020 Update (20H2)** + +4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**. + +5. Copy PolicyDefinitions folder to **C:\Windows\SYSVOL\domain\Policies**. + + If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain. + +6. Restart the Domain Controller for the policy to be available. + +This procedure will work for any future version as well. 1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. -2. Create a Security Group for the PCs. -3. Link the GPO. -4. Filter using Security Groups. -5. Enforce a GPO link. -> [!NOTE] -> Version 1903 (March 2019) is actually on the Insider program and doesn't yet contain a downloadable version of Templates (version 1903). +2. Create a Security Group for the PCs. + +3. Link the GPO. + +4. Filter using Security Groups. ## Troubleshoot auto-enrollment of devices -Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device. +Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device. To collect Event Viewer logs: 1. Open Event Viewer. -2. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin. +2. Navigate to **Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin**. > [!Tip] > For guidance on how to collect event logs for Intune, see [Collect MDM Event Viewer Log YouTube video](https://www.youtube.com/watch?v=U_oCe2RmQEc). @@ -194,11 +239,14 @@ To collect Event Viewer logs: To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information. - The auto-enrollment did not trigger at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section. - The auto-enrollment process is triggered by a task (Microsoft > Windows > EnterpriseMgmt) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is successfully deployed to the target machine as shown in the following screenshot: + The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot: ![Task scheduler](images/auto-enrollment-task-scheduler.png) + > [!Note] + > This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task. + This task runs every 5 minutes for the duration of 1 day. To confirm if the task succeeded, check the task scheduler event logs: - Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational. + **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107. ![Event ID 107](images/auto-enrollment-event-id-107.png) @@ -208,13 +256,13 @@ To collect Event Viewer logs: Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment. - If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. - One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (HKLM > Software > Microsoft > Enrollments). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: + If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. + One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: ![Outdated enrollment entries](images/auto-enrollment-outdated-enrollment-entries.png) - By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational event log file under event ID 7016. - A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display less entries as shown in the following screenshot: + By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016. + A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: ![Manually deleted entries](images/auto-enrollment-activation-verification-less-entries.png) @@ -225,8 +273,10 @@ To collect Event Viewer logs: - [Link a Group Policy Object](https://technet.microsoft.com/library/cc732979(v=ws.11).aspx) - [Filter Using Security Groups](https://technet.microsoft.com/library/cc752992(v=ws.11).aspx) - [Enforce a Group Policy Object Link](https://technet.microsoft.com/library/cc753909(v=ws.11).aspx) +- [Group Policy Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) ### Useful Links +- [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591) +- [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495) - [Windows 10 Administrative Templates for Windows 10 October 2018 Update 1809](https://www.microsoft.com/download/details.aspx?id=57576) -- [Windows 10 Administrative Templates for Windows 10 April 2018 Update 1803](https://www.microsoft.com/download/details.aspx?id=56880) diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index 429bf2fe21..98739efcb1 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -1,6 +1,6 @@ --- -title: EnrollmentStatusTracking CSP -description: EnrollmentStatusTracking CSP +title: EnrollmentStatusTracking DDF +description: View the OMA DM DDF for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md index 080db28b5c..6faa0a9b38 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -1,6 +1,6 @@ --- title: EnrollmentStatusTracking CSP -description: EnrollmentStatusTracking CSP +description: Learn how to perform a hybrid certificate trust deployment of Windows Hello for Business, for systems with no previous installations. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -11,7 +11,6 @@ ms.date: 05/21/2019 # EnrollmentStatusTracking CSP - During Autopilot deployment, you can configure the Enrollment Status Page (ESP) to block the device use until the required apps are installed. You can select the apps that must be installed before using the device. The EnrollmentStatusTracking configuration service provider (CSP) is used by Intune's agents, such as SideCar to configure ESP for blocking the device use until the required Win32 apps are installed. It tracks the installation status of the required policy providers and the apps they install and sends it to ESP, which displays the installation progress message to the user. For more information on ESP, see [Windows Autopilot Enrollment Status page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status). ESP uses the EnrollmentStatusTracking CSP along with the DMClient CSP to track the installation of different apps. The EnrollmentStatusTracking CSP tracks Win32 apps installations and DMClient CSP tracks MSI and Universal Windows Platform apps installations. In DMClient CSP, the **FirstSyncStatus/ExpectedMSIAppPackages** and **FirstSyncStatus/ExpectedModernAppPackages** nodes list the apps to track their installation. See [DMClient CSP](dmclient-csp.md) for more information. diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index 319356f336..5e7af9b60d 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAPN DDF -description: EnterpriseAPN DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAPN configuration service provider (CSP). ms.assetid: A953ADEF-4523-425F-926C-48DA62EB9E21 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index 486334505b..011e741b15 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppManagement CSP -description: EnterpriseAppManagement CSP +description: Handle enterprise application management tasks using EnterpriseAppManagement configuration service provider (CSP). ms.assetid: 698b8bf4-652e-474b-97e4-381031357623 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index 1fe417dd0f..272f60f44f 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppVManagement CSP -description: EnterpriseAppVManagement CSP +description: Examine the tree format for EnterpriseAppVManagement CSP to manage virtual applications in Windows 10 PCs.(Enterprise and Education editions). ms.author: dansimp ms.topic: article ms.prod: w10 @@ -89,7 +89,7 @@ The following diagram shows the EnterpriseAppVManagement configuration service p - SYNC\_ERR\_PUBLISH\_GROUP_PACKAGES (3) - Publish group packages failed during publish. - SYNC\_ERR\_UNPUBLISH_PACKAGES (4) - Unpublish packages failed during publish. - SYNC\_ERR\_NEW_POLICY_WRITE (5) - New policy write failed during publish. -- SYNC\_ERR\_MULTIPLE\_DURING_PUBLISH (6) - Multiple non-fatal errors occured during publish. +- SYNC\_ERR\_MULTIPLE\_DURING_PUBLISH (6) - Multiple non-fatal errors occurred during publish.

          Value type is string. Supported operation is Get.

          diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index 626981e0ff..8cf951cf55 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppVManagement DDF file -description: EnterpriseAppVManagement DDF file +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAppVManagement configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enterpriseassignedaccess-csp.md b/windows/client-management/mdm/enterpriseassignedaccess-csp.md index 118cc974f5..45d11904d5 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-csp.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAssignedAccess CSP -description: EnterpriseAssignedAccess CSP +description: Use the EnterpriseAssignedAccess configuration service provider (CSP) to configure custom layouts on a device. ms.assetid: 5F88E567-77AA-4822-A0BC-3B31100639AA ms.reviewer: manager: dansimp @@ -306,7 +306,7 @@ Starting in Windows 10, version 1511, you can specify the following quick acti

          Dependencies - none

          -Starting in Windows 10, version 1703, Quick action settings no longer require any dependencis from related group or page. Here is the list: +Starting in Windows 10, version 1703, Quick action settings no longer require any dependencies from related group or page. Here is the list: - QuickActions_Launcher_AllSettings - QuickActions_Launcher_DeviceDiscovery - SystemSettings_BatterySaver_LandingPage_OverrideControl @@ -1600,7 +1600,7 @@ The following table lists the product ID and AUMID for each app that is included Microsoft.MSPodcast_8wekyb3d8bbwe!xc3215724yb279y4206y8c3ey61d1a9d63ed3x -Powerpoint +PowerPoint B50483C4-8046-4E1B-81BA-590B24935798 Microsoft.Office.PowerPoint_8wekyb3d8bbwe!microsoft.pptim @@ -1665,4 +1665,4 @@ The following table lists the product ID and AUMID for each app that is included Microsoft.XboxApp_8wekyb3d8bbwe!Microsoft.XboxApp - \ No newline at end of file + diff --git a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md index e5392fcc55..5d0a19de74 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAssignedAccess DDF -description: EnterpriseAssignedAccess DDF +description: Utilize the OMA DM device description framework (DDF) for the EnterpriseAssignedAccess configuration service provider. ms.assetid: 8BD6FB05-E643-4695-99A2-633995884B37 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md b/windows/client-management/mdm/enterpriseassignedaccess-xsd.md index f73c18d744..3ee96832c7 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-xsd.md @@ -1,6 +1,6 @@ --- title: EnterpriseAssignedAccess XSD -description: EnterpriseAssignedAccess XSD +description: This XSD can be used to validate that the lockdown XML in the \ block of the AssignedAccessXML node. ms.assetid: BB3B633E-E361-4B95-9D4A-CE6E08D67ADA ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index 3e69ceaa92..8cc8149b7f 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseDataProtection CSP -description: The EnterpriseDataProtection configuration service provider (CSP) is used to configure Windows Information Protection (WIP) (formerly known as Enterprise Data Protection) specific settings. +description: The EnterpriseDataProtection configuration service provider (CSP) configures Windows Information Protection (formerly, Enterprise Data Protection) settings. ms.assetid: E2D4467F-A154-4C00-9208-7798EF3E25B3 ms.reviewer: manager: dansimp @@ -14,17 +14,17 @@ ms.date: 08/09/2017 # EnterpriseDataProtection CSP -The EnterpriseDataProtection configuration service provider (CSP) is used to configure Windows Information Protection (WIP) (formerly known as Enterprise Data Protection) specific settings. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip). +The EnterpriseDataProtection configuration service provider (CSP) is used to configure settings for Windows Information Protection (WIP), formerly known as Enterprise Data Protection. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip). -> **Note**   ->- To make WIP functional the AppLocker CSP and the network isolation specific settings must also be configured. For more information, see [AppLocker CSP](applocker-csp.md) and NetworkIsolation policies in [Policy CSP](policy-configuration-service-provider.md). ->- This CSP was added in Windows 10, version 1607. +> [!Note] +> To make WIP functional, the AppLocker CSP and the network isolation-specific settings must also be configured. For more information, see [AppLocker CSP](applocker-csp.md) and NetworkIsolation policies in [Policy CSP](policy-configuration-service-provider.md). +> - This CSP was added in Windows 10, version 1607. While WIP has no hard dependency on VPN, for best results you should configure VPN profiles first before you configure the WIP policies. For VPN best practice recommendations, see [VPNv2 CSP](vpnv2-csp.md). -To learn more about WIP, see the following TechNet topics: +To learn more about WIP, see the following articles: - [Create a Windows Information Protection (WIP) policy](https://technet.microsoft.com/itpro/windows/keep-secure/overview-create-wip-policy) - [General guidance and best practices for Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/guidance-and-best-practices-wip) @@ -34,79 +34,82 @@ The following diagram shows the EnterpriseDataProtection CSP in tree format. ![enterprisedataprotection csp diagram](images/provisioning-csp-enterprisedataprotection.png) **./Device/Vendor/MSFT/EnterpriseDataProtection** -

          The root node for the CSP. +The root node for the CSP. **Settings** -

          The root node for the Windows Information Protection (WIP) configuration settings. +The root node for the Windows Information Protection (WIP) configuration settings. **Settings/EDPEnforcementLevel** -

          Set the WIP enforcement level. Note that setting this value is not sufficient to enable WIP on the device. Attempts to change this value will fail when the WIP cleanup is running. +Set the WIP enforcement level. Note that setting this value is not sufficient to enable WIP on the device. Attempts to change this value will fail when the WIP cleanup is running. -

          The following list shows the supported values: +The following list shows the supported values: - 0 (default) – Off / No protection (decrypts previously protected data). - 1 – Silent mode (encrypt and audit only). - 2 – Allow override mode (encrypt, prompt and allow overrides, and audit). - 3 – Hides overrides (encrypt, prompt but hide overrides, and audit). -

          Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/EnterpriseProtectedDomainNames** -

          A list of domains used by the enterprise for its user identities separated by pipes ("|").The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for WIP. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running. +A list of domains used by the enterprise for its user identities separated by pipes ("|").The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for WIP. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running. -

          Changing the primary enterprise ID is not supported and may cause unexpected behavior on the client. +Changing the primary enterprise ID is not supported and may cause unexpected behavior on the client. -> **Note**  The client requires domain name to be canonical, otherwise the setting will be rejected by the client. +> [!Note] +> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. -

          Here are the steps to create canonical domain names: +Here are the steps to create canonical domain names: -1. Transform the ASCII characters (A-Z only) to lower case. For example, Microsoft.COM -> microsoft.com. +1. Transform the ASCII characters (A-Z only) to lowercase. For example, Microsoft.COM -> microsoft.com. 2. Call [IdnToAscii](https://msdn.microsoft.com/library/windows/desktop/dd318149.aspx) with IDN\_USE\_STD3\_ASCII\_RULES as the flags. 3. Call [IdnToUnicode](https://msdn.microsoft.com/library/windows/desktop/dd318151.aspx) with no flags set (dwFlags = 0). -

          Supported operations are Add, Get, Replace and Delete. Value type is string. +Supported operations are Add, Get, Replace, and Delete. Value type is string. **Settings/AllowUserDecryption** -

          Allows the user to decrypt files. If this is set to 0 (Not Allowed), then the user will not be able to remove protection from enterprise content through the operating system or the application user experiences. +Allows the user to decrypt files. If this is set to 0 (Not Allowed), then the user will not be able to remove protection from enterprise content through the operating system or the application user experiences. > [!IMPORTANT] > Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported. -

          The following list shows the supported values: +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed. -

          Most restricted value is 0. +Most restricted value is 0. -

          Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/RequireProtectionUnderLockConfig** -

          Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured. A PIN must be configured on the device before you can apply this policy. +Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured. A PIN must be configured on the device before you can apply this policy. -

          The following list shows the supported values: +The following list shows the supported values: - 0 (default) – Not required. - 1 – Required. -

          Most restricted value is 1. +Most restricted value is 1. -

          The CSP checks the current edition and hardware support (TPM), and returns an error message if the device does not have the required hardware. +The CSP checks the current edition and hardware support (TPM), and returns an error message if the device does not have the required hardware. -> **Note**  This setting is only supported in Windows 10 Mobile. +> [!Note] +> This setting is only supported in Windows 10 Mobile. -

          Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/DataRecoveryCertificate** -

          Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. +Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through mobile device management (MDM) instead of Group Policy. -> **Note**  If this policy and the corresponding Group Policy setting are both configured, the Group Policy setting is enforced. +> [!Note] +> If this policy and the corresponding Group Policy setting are both configured, the Group Policy setting is enforced. -

          DRA information from MDM policy must be a serialized binary blob identical to what we expect from GP. +DRA information from MDM policy must be a serialized binary blob identical to what we expect from GP. The binary blob is the serialized version of following structure: ``` syntax @@ -231,60 +234,59 @@ typedef enum _PUBLIC_KEY_SOURCE_TAG { ``` -

          For EFSCertificate KeyTag, it is expected to be a DER ENCODED binary certificate. +For EFSCertificate KeyTag, it is expected to be a DER ENCODED binary certificate. -

          Supported operations are Add, Get, Replace and Delete. Value type is base-64 encoded certificate. +Supported operations are Add, Get, Replace, and Delete. Value type is base-64 encoded certificate. **Settings/RevokeOnUnenroll** -

          This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently. Prior to sending the unenroll command, when you want a device to do a selective wipe when it is unenrolled, then you should explicitly set this policy to 1. +This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently. Prior to sending the unenroll command, when you want a device to do a selective wipe when it is unenrolled, then you should explicitly set this policy to 1. -

          The following list shows the supported values: +The following list shows the supported values: - 0 – Don't revoke keys. - 1 (default) – Revoke keys. -

          Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/RevokeOnMDMHandoff** -

          Added in Windows 10, version 1703. This policy controls whether to revoke the WIP keys when a device upgrades from MAM to MDM. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after upgrade. This is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service. +Added in Windows 10, version 1703. This policy controls whether to revoke the WIP keys when a device upgrades from mobile application management (MAM) to MDM. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after upgrade. This is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service. - 0 - Don't revoke keys -- 1 (dafault) - Revoke keys +- 1 (default) - Revoke keys -

          Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/RMSTemplateIDForEDP** -

          TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access. +TemplateID GUID to use for Rights Management Service (RMS) encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access. -

          Supported operations are Add, Get, Replace and Delete. Value type is string (GUID). +Supported operations are Add, Get, Replace, and Delete. Value type is string (GUID). **Settings/AllowAzureRMSForEDP** -

          Specifies whether to allow Azure RMS encryption for WIP. +Specifies whether to allow Azure RMS encryption for WIP. - 0 (default) – Don't use RMS. - 1 – Use RMS. -

          Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/SMBAutoEncryptedFileExtensions** -

          Added in Windows 10, version 1703. Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary as defined in the Policy CSP nodes for NetworkIsolation/EnterpriseIPRange and NetworkIsolation/EnterpriseNetworkDomainNames. Use semicolon (;) delimiter in the list. -

          When this policy is not specified, the existing auto-encryption behavior is applied. When this policy is configured, only files with the extensions in the list will be encrypted. -

          Supported operations are Add, Get, Replace and Delete. Value type is string. +Added in Windows 10, version 1703. Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an Server Message Block (SMB) share within the corporate boundary as defined in the Policy CSP nodes for NetworkIsolation/EnterpriseIPRange and NetworkIsolation/EnterpriseNetworkDomainNames. Use semicolon (;) delimiter in the list. +When this policy is not specified, the existing auto-encryption behavior is applied. When this policy is configured, only files with the extensions in the list will be encrypted. +Supported operations are Add, Get, Replace and Delete. Value type is string. **Settings/EDPShowIcons** -

          Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app. - -

          The following list shows the supported values: +Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles on the **Start** menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app. +The following list shows the supported values: - 0 (default) - No WIP overlays on icons or tiles. - 1 - Show WIP overlays on protected files and apps that can only create enterprise content. -

          Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Status** -

          A read-only bit mask that indicates the current state of WIP on the Device. The MDM service can use this value to determine the current overall state of WIP. WIP is only on (bit 0 = 1) if WIP mandatory policies and WIP AppLocker settings are configured. +A read-only bit mask that indicates the current state of WIP on the Device. The MDM service can use this value to determine the current overall state of WIP. WIP is only on (bit 0 = 1) if WIP mandatory policies and WIP AppLocker settings are configured. -

          Suggested values: +Suggested values: @@ -319,13 +321,13 @@ typedef enum _PUBLIC_KEY_SOURCE_TAG { -

          Bit 0 indicates whether WIP is on or off. +Bit 0 indicates whether WIP is on or off. -

          Bit 1 indicates whether AppLocker WIP policies are set. +Bit 1 indicates whether AppLocker WIP policies are set. -

          Bit 3 indicates whether the mandatory WIP policies are configured. If one or more of the mandatory WIP policies are not configured, the bit 3 is set to 0 (zero). +Bit 3 indicates whether the mandatory WIP policies are configured. If one or more of the mandatory WIP policies are not configured, the bit 3 is set to 0 (zero). -

          Here's the list of mandatory WIP policies: +Here's the list of mandatory WIP policies: - EDPEnforcementLevel in EnterpriseDataProtection CSP - DataRecoveryCertificate in EnterpriseDataProtection CSP @@ -333,9 +335,9 @@ typedef enum _PUBLIC_KEY_SOURCE_TAG { - NetworkIsolation/EnterpriseIPRange in Policy CSP - NetworkIsolation/EnterpriseNetworkDomainNames in Policy CSP -

          Bits 2 and 4 are reserved for future use. +Bits 2 and 4 are reserved for future use. -

          Supported operation is Get. Value type is integer. +Supported operation is Get. Value type is integer. diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md index 97c5865d7e..f52b397125 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseDesktopAppManagement CSP -description: The EnterpriseDesktopAppManagement configuration service provider is used to handle enterprise desktop application management tasks, such as querying installed enterprise applications, installing applications, or removing applications. +description: The EnterpriseDesktopAppManagement CSP handles enterprise desktop application management tasks, such as installing or removing applications. ms.assetid: 2BFF7491-BB01-41BA-9A22-AB209EE59FC5 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseext-csp.md b/windows/client-management/mdm/enterpriseext-csp.md index 782bc735ed..24cadf3270 100644 --- a/windows/client-management/mdm/enterpriseext-csp.md +++ b/windows/client-management/mdm/enterpriseext-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseExt CSP -description: EnterpriseExt CSP +description: Learn how the EnterpriseExt CSP allows OEMs to set their own unique ID for their devices, set display brightness values, and set the LED behavior. ms.assetid: ACA5CD79-BBD5-4DD1-86DA-0285B93982BD ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseext-ddf.md b/windows/client-management/mdm/enterpriseext-ddf.md index e30ceeb37f..4b3d4b0afd 100644 --- a/windows/client-management/mdm/enterpriseext-ddf.md +++ b/windows/client-management/mdm/enterpriseext-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseExt DDF -description: EnterpriseExt DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExt configuration service provider (CSP). ms.assetid: 71BF81D4-FBEC-4B03-BF99-F7A5EDD4F91B ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseextfilessystem-csp.md b/windows/client-management/mdm/enterpriseextfilessystem-csp.md index 3e7c2b1693..8f00e3fe0b 100644 --- a/windows/client-management/mdm/enterpriseextfilessystem-csp.md +++ b/windows/client-management/mdm/enterpriseextfilessystem-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseExtFileSystem CSP -description: EnterpriseExtFileSystem CSP +description: Add, retrieve, or change files through the Mobile Device Management (MDM) service using the EnterpriseExtFileSystem CSP. ms.assetid: F773AD72-A800-481A-A9E2-899BA56F4426 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md index 997493aee9..7efb54af20 100644 --- a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md +++ b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseExtFileSystem DDF -description: EnterpriseExtFileSystem DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExtFileSystem configuration service provider (CSP). ms.assetid: 2D292E4B-15EE-4AEB-8884-6FEE8B92D2D1 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 0088ae7f8f..77b6e72ff9 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement CSP -description: EnterpriseModernAppManagement CSP +description: Learn how the EnterpriseModernAppManagement configuration service provider (CSP) is used for the provisioning and reporting of modern enterprise apps. ms.assetid: 9DD0741A-A229-41A0-A85A-93E185207C42 ms.reviewer: manager: dansimp @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/27/2018 +ms.date: 09/27/2019 --- # EnterpriseModernAppManagement CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The EnterpriseModernAppManagement configuration service provider (CSP) is used for the provisioning and reporting of modern enterprise apps. For details about how to use this CSP to for reporting apps inventory, installation and removal of apps for users, provisioning apps to devices, and managing app licenses, see [Enterprise app management](enterprise-app-management.md). > [!Note] @@ -68,7 +65,7 @@ Added in Windows 10, version 1511. Required. Specifies the query for app invento Query parameters: -- Output - Specifies the parameters for the information returned in AppInventoryResults operation. Mutiple value must be separate by |. Valid values are: +- Output - Specifies the parameters for the information returned in AppInventoryResults operation. Multiple value must be separate by |. Valid values are: - PackagesName - returns the *PackageFamilyName* and *PackageFullName* of the app. Default if nothing is specified. - PackageDetails - returns all inventory attributes of the package. This includes all information from PackageNames parameter, but does not validate RequiresReinstall. - RequiredReinstall - Validates the app status of the apps in the inventory query to determine if they require a reinstallation. This attribute may impact system performance depending on the number of apps installed. Requiring reinstall occurs when resource package updates or when the app is in a tampered state. @@ -180,7 +177,7 @@ Added in Windows 10, version 1809. Specifies the app channel ID. Value type is string. Supported operations are Add, Get, Replace, and Delete. **AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/ReleaseManagementId** -Added in Windows 10, version 1809. The IT admin can specify a release ID to indicate a specific release they would like the user or device to be on. +Added in Windows 10, version 1809. The IT admin can specify a release ID to indicate a specific release that they would like the user or device to be on. Value type is string. Supported operations are Add, Get, Replace, and Delete. @@ -328,6 +325,14 @@ Required. The value is 0 or 1 that indicates if the app is provisioned on the de Supported operation is Get. +**.../*PackageFamilyName*/*PackageFullName*/IsStub** +Added in Windows 10, version 2004. +Required. This node is used to identify whether the package is a stub package. A stub package is a version of the package with minimal functionality that will reduce the size of the app. + +The value is 1 if the package is a stub package and 0 (zero) for all other cases. Value type is int. + +Supported operation is Get. + **.../*PackageFamilyName*/DoNotUpdate** Required. Specifies whether you want to block a specific app from being updated via auto-updates. @@ -485,6 +490,18 @@ Supported operation is Execute, Add, Delete, and Get. **AppInstallation/*PackageFamilyName*/HostedInstall** Required. Command to perform an install of an app package from a hosted location (this can be a local drive, a UNC, or https data source). +The following list shows the supported deployment options: +- ForceApplicationShutdown +- DevelopmentMode  +- InstallAllResources +- ForceTargetApplicationShutdown  +- ForceUpdateToAnyVersion +- DeferRegistration="1". If the app is in use at the time of installation. This stages the files for an app update and completes the registration of the app update after the app closes. Available in the latest insider flight of 20H1. +- StageOnly="1". Stages the files for an app installation or update without installing the app. Available in 1803. +- LicenseUri="\\server\license.lic". Deploys an offline license from the Microsoft Store for Business. Available in 1607. +- ValidateDependencies="1". This is used at provisioning/staging time. If it is set to 1, deployment will perform the same dependency validation during staging that we would normally do at registration time, failing and rejecting the provision request if the dependencies are not present. Available in the latest insider flight of 20H1. +- ExcludeAppFromLayoutModification="1". Sets that the app will be provisioned on all devices and will be able to retain the apps provisioned without pinning them to start layout. Available in 1809. + Supported operation is Execute, Add, Delete, and Get. **AppInstallation/*PackageFamilyName*/LastError** @@ -497,7 +514,7 @@ Supported operation is Get. -**AppInstallation/*PackageFamilyName*/LastErrorDescription** +**AppInstallation/*PackageFamilyName*/LastErrorDesc** Required. Description of last error relating to the app installation. Supported operation is Get. @@ -547,7 +564,7 @@ Added in Windows 10, version 1511. Required. Category of license that is used to - Retail - license sold through retail channels, typically from the Microsoft Store - Enterprise - license sold through the enterprise sales channel, typically from the Store for Business - OEM - license issued to an OEM -- Developer - developer license, typically installed during the app development or side-loading scernarios. +- Developer - developer license, typically installed during the app development or side-loading scenarios. Supported operation is Get. diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 4b86f38ff0..237000b2f0 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement DDF -description: EnterpriseModernAppManagement DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider (CSP). ms.assetid: ms.reviewer: manager: dansimp @@ -9,19 +9,16 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/27/2018 +ms.date: 10/01/2019 --- # EnterpriseModernAppManagement DDF -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **EnterpriseModernAppManagement** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is the current version for this CSP. ```xml @@ -395,6 +392,26 @@ The XML below is for Windows 10, version 1809. + + IsStub + + + + + + + + + + + + + + + text/plain + + + DoNotUpdate @@ -522,6 +539,7 @@ The XML below is for Windows 10, version 1809. + @@ -543,6 +561,7 @@ The XML below is for Windows 10, version 1809. + diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md index 99150bef80..f8b15504cc 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement XSD -description: Here is the XSD for the application parameters. +description: In this article, view the EnterpriseModernAppManagement XSD example so you can set application parameters. ms.assetid: D393D094-25E5-4E66-A60F-B59CC312BF57 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/esim-enterprise-management.md b/windows/client-management/mdm/esim-enterprise-management.md index 386f5a8c48..4f516e8c19 100644 --- a/windows/client-management/mdm/esim-enterprise-management.md +++ b/windows/client-management/mdm/esim-enterprise-management.md @@ -1,6 +1,6 @@ --- title: eSIM Enterprise Management -description: Managing eSIM devices in an enterprise +description: Learn how Mobile Device Management (MDM) Providers support the eSIM Profile Management Solution on Windows. keywords: eSIM enterprise management ms.prod: w10 ms.mktglfcycl: @@ -8,19 +8,21 @@ ms.sitesec: library author: dansimp ms.localizationpriority: medium ms.author: dansimp -ms.topic: +ms.topic: conceptual --- # How Mobile Device Management Providers support eSIM Management on Windows -The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to leverage an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will leverage the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and installation happens on the background and not impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. - If you are a Mobile Device Management (MDM) Provider and would like to support eSIM Management on Windows, you should do the following: +The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to use an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will use the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and the installation happen in the background without impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. + If you are a Mobile Device Management (MDM) Provider and want to support eSIM Management on Windows, perform the following steps: - Onboard to Azure Active Directory -- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, please contact them and learn more about their onboarding. If you would like to support multiple mobile operators, [orchestrator providers]( https://www.idemia.com/esim-management-facilitation) are there to act as a proxy that will handle MDM onboarding as well as mobile operator onboarding. Their main [role]( https://www.idemia.com/smart-connect-hub) is to enable the process to be as painless but scalable to all parties. +- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, contact them and learn more about their onboarding. If you would like to integrate and work with only one MDM provider, contact that provider directly. If you would like to offer eSIM management to customers using different MDM providers, contact an orchestrator provider. Orchestrator providers act as proxy handling MDM onboarding as well as mobile operator onboarding. Their role is to make the process as painless and scalable as possible for all parties. Potential orchestrator providers you could contact include: + - [HPE’s Device Entitlement Gateway](https://www.hpe.com/emea_europe/en/solutions/digital-communications-services.html) + - [IDEMIA’s The Smart Connect - Hub](https://www.idemia.com/smart-connect-hub) - Assess solution type that you would like to provide your customers - Batch/offline solution - IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. -- Operator does not have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to +- Operator doesn't have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to - Real-time solution - MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. - Operator is notified of the status of each eSIM profile and has visibility on which devices are being used -**Note:** The solution type is not noticeable to the end-user. The choice between the two is made between the MDM and the Mobile Operator. +**Note:** End users don't notice the solution type. The choice between the two is made between the MDM and the Mobile Operator. diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 43626310a0..1f42e3e43d 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -1,6 +1,6 @@ --- title: eUICCs CSP -description: eUICCs CSP +description: Learn how the eUICCs CSP is used to support eUICC enterprise use cases and enables the IT admin to manage (assign, re-assign, remove) subscriptions to employees. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 3f3e71df8d..38bb8e5f6f 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -1,6 +1,6 @@ --- title: eUICCs DDF file -description: eUICCs DDF file +description: Learn about the OMA DM device description framework (DDF) for the eUICCs configuration service provider (CSP). ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index dff91fd372..01d4daf010 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -14,16 +14,14 @@ ms.date: 07/28/2017 # Federated authentication device enrollment - This section provides an example of the mobile device enrollment protocol using federated authentication policy. When the authentication policy is set to Federated, the web authentication broker is leveraged by the enrollment client to get a security token. The enrollment client calls the web authentication broker API within the response message to start the process. The server should build the web authentication broker pages to fit the device screen and should be consistent with the existing enrollment UI. The opaque security token that is returned from the broker as an end page is used by the enrollment client as the device security secret during the client certificate request call. The <AuthenticationServiceURL> element the discovery response message specifies web authentication broker page start URL. -For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). +For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). ## In this topic - [Discovery service](#discovery-service) [Enrollment policy web service](#enrollment-policy-web-service) [Enrollment web service](#enrollment-web-service) @@ -32,12 +30,10 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme ## Discovery service - The discovery web service provides the configuration information necessary for a user to enroll a phone with a management service. The service is a restful web service over HTTPS (server authentication only). -> **Note**  The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. - - +> [!NOTE] +> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -45,28 +41,28 @@ The first request is a standard HTTP GET request. The following example shows a request via HTTP GET to the discovery server given user@contoso.com as the email address. -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: unknown Header Byte Count: 153 Body Byte Count: 0 ``` -``` +```http GET /EnrollmentServer/Discovery.svc HTTP/1.1 User-Agent: Windows Phone 8 Enrollment Client Host: EnterpriseEnrollment.contoso.com Pragma: no-cache ``` -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: text/html Header Byte Count: 248 Body Byte Count: 0 ``` -``` +```http HTTP/1.1 200 OK Connection: Keep-Alive Pragma: no-cache @@ -86,7 +82,7 @@ The following logic is applied: The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address -``` +```http https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc ``` @@ -131,24 +127,21 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - In Windows, Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +> [!Note] +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. When authentication policy is set to be Federated, Web Authentication Broker (WAB) will be leveraged by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client will call the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage will be used by the enrollment client as the device security secret during the client certificate enrollment request call. -> **Note**  Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: +> [!Note] +> Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: > - Parse the OS version from the data sent up during the discovery request. > - Append the OS version as a parameter in the AuthenticationServiceURL. > - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. - - A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. -> **Note**  The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. - - +> [!Note] +> The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. The following are the explicit requirements for the server. @@ -167,7 +160,10 @@ AuthenticationServiceUrl?appru=&login_hint= After authentication is complete, the auth server should return an HTML form document with a POST method action of appid identified in the query string parameter. -``` +> [!NOTE] +> To make an application compatible with strict Content Security Policy, it is usually necessary to make some changes to HTML templates and client-side code, add the policy header, and test that everything works properly once the policy is deployed. + +```html HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding @@ -234,7 +230,6 @@ The following example shows a response received from the discovery web service w ## Enrollment policy web service - Policy service is optional. By default, if no policies are specified, the minimum key length is 2k and the hash algorithm is SHA-1. This web service implements the X.509 Certificate Enrollment Policy Protocol (MS-XCEP) specification that allows customizing certificate enrollment to match different security needs of enterprises at different times (cryptographic agility). The service processes the GetPolicies message from the client, authenticates the client, and returns matching enrollment policies in the GetPoliciesResponse message. @@ -299,9 +294,8 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. For Windows device, we will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +> [!NOTE] +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -384,7 +378,6 @@ The following snippet shows the policy web service response. ## Enrollment web service - This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DM client. The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on match the certificate template), the client can enroll successfully. @@ -393,9 +386,8 @@ Note that the RequestSecurityToken will use a custom TokenType (http: **Note**  The policy service and the enrollment service must be on the same server; that is, they must have the same host name. - - +> [!Note] +> The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for federated authentication. @@ -484,9 +476,8 @@ The following example shows the enrollment web service request for federated aut After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR). -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +> [!Note] +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc), because the token is more than an X.509 v3 certificate. @@ -550,7 +541,7 @@ The following example shows the enrollment web service response. The following code shows sample provisioning XML (presented in the preceding package as a security token): -``` +```xml @@ -637,11 +628,3 @@ The following code shows sample provisioning XML (presented in the preceding pac - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. - - - - - - - - diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 653b03b527..9bad3fe712 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -1,6 +1,6 @@ --- title: FileSystem CSP -description: FileSystem CSP +description: Learn how the FileSystem CSP is used to query, add, modify, and delete files, file directories, and file attributes on the mobile device. ms.assetid: 9117ee16-ca7a-4efa-9270-c9ac8547e541 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index b8f27a73dc..bf8a5ea5ad 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -1,6 +1,6 @@ --- title: Firewall CSP -description: Firewall CSP +description: The Firewall configuration service provider (CSP) allows the mobile device management (MDM) server to configure the Windows Defender Firewall global settings. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -248,10 +248,10 @@ Sample syncxml to provision the firewall settings to evaluate

          Value type is string. Supported operations are Add, Get, Replace, and Delete.

          **FirewallRules/*FirewallRuleName*/LocalAddressRanges** -

          Comma separated list of local addresses covered by the rule. The default value is "". Valid tokens include:

          +

          Comma separated list of local addresses covered by the rule. The default value is "*". Valid tokens include:

            -
          • "" indicates any local address. If present, this must be the only token included.
          • -
          • A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.
          • +
          • "*" indicates any local address. If present, this must be the only token included.
          • +
          • A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.
          • A valid IPv6 address.
          • An IPv4 address range in the format of "start address - end address" with no spaces included.
          • An IPv6 address range in the format of "start address - end address" with no spaces included.
          • @@ -260,9 +260,9 @@ Sample syncxml to provision the firewall settings to evaluate

            Value type is string. Supported operations are Add, Get, Replace, and Delete.

            **FirewallRules/*FirewallRuleName*/RemoteAddressRanges** -

            List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "". Valid tokens include:

            +

            List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "*". Valid tokens include:

              -
            • "" indicates any remote address. If present, this must be the only token included.
            • +
            • "*" indicates any remote address. If present, this must be the only token included.
            • "Defaultgateway"
            • "DHCP"
            • "DNS"
            • diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index 20172a8f10..72829fc3a9 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1,6 +1,6 @@ --- title: Firewall DDF file -description: Firewall DDF file +description: Learn about the OMA DM device description framework (DDF) for the Firewall configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/get-localized-product-details.md b/windows/client-management/mdm/get-localized-product-details.md index c2e89912d8..52848ed620 100644 --- a/windows/client-management/mdm/get-localized-product-details.md +++ b/windows/client-management/mdm/get-localized-product-details.md @@ -1,6 +1,6 @@ --- title: Get localized product details -description: The Get localized product details operation retrieves the localization information of a product from the Micosoft Store for Business. +description: The Get localized product details operation retrieves the localization information of a product from the Microsoft Store for Business. ms.assetid: EF6AFCA9-8699-46C9-A3BB-CD2750C07901 ms.reviewer: manager: dansimp @@ -9,12 +9,12 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/18/2017 +ms.date: 12/07/2020 --- # Get localized product details -The **Get localized product details** operation retrieves the localization information of a product from the Micosoft Store for Business. +The **Get localized product details** operation retrieves the localization information of a product from the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-offline-license.md b/windows/client-management/mdm/get-offline-license.md index 772d402b87..87699a8b11 100644 --- a/windows/client-management/mdm/get-offline-license.md +++ b/windows/client-management/mdm/get-offline-license.md @@ -1,6 +1,6 @@ --- title: Get offline license -description: The Get offline license operation retrieves the offline license information of a product from the Micosoft Store for Business. +description: The Get offline license operation retrieves the offline license information of a product from the Microsoft Store for Business. ms.assetid: 08DAD813-CF4D-42D6-A783-994A03AEE051 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get offline license -The **Get offline license** operation retrieves the offline license information of a product from the Micosoft Store for Business. +The **Get offline license** operation retrieves the offline license information of a product from the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-product-details.md b/windows/client-management/mdm/get-product-details.md index 9ab64f1f8b..18a0174509 100644 --- a/windows/client-management/mdm/get-product-details.md +++ b/windows/client-management/mdm/get-product-details.md @@ -1,6 +1,6 @@ --- title: Get product details -description: The Get product details operation retrieves the product information from the Micosoft Store for Business for a specific application. +description: The Get product details operation retrieves the product information from the Microsoft Store for Business for a specific application. ms.assetid: BC432EBA-CE5E-43BD-BD54-942774767286 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get product details -The **Get product details** operation retrieves the product information from the Micosoft Store for Business for a specific application. +The **Get product details** operation retrieves the product information from the Microsoft Store for Business for a specific application. ## Request diff --git a/windows/client-management/mdm/get-product-package.md b/windows/client-management/mdm/get-product-package.md index 7f75857534..662580acde 100644 --- a/windows/client-management/mdm/get-product-package.md +++ b/windows/client-management/mdm/get-product-package.md @@ -1,6 +1,6 @@ --- title: Get product package -description: The Get product package operation retrieves the information about a specific application in the Micosoft Store for Business. +description: The Get product package operation retrieves the information about a specific application in the Microsoft Store for Business. ms.assetid: 4314C65E-6DDC-405C-A591-D66F799A341F ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get product package -The **Get product package** operation retrieves the information about a specific application in the Micosoft Store for Business. +The **Get product package** operation retrieves the information about a specific application in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-product-packages.md b/windows/client-management/mdm/get-product-packages.md index 394b64e58c..5ad2851bc5 100644 --- a/windows/client-management/mdm/get-product-packages.md +++ b/windows/client-management/mdm/get-product-packages.md @@ -1,6 +1,6 @@ --- title: Get product packages -description: The Get product packages operation retrieves the information about applications in the Micosoft Store for Business. +description: The Get product packages operation retrieves the information about applications in the Microsoft Store for Business. ms.assetid: 039468BF-B9EE-4E1C-810C-9ACDD55C0835 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get product packages -The **Get product packages** operation retrieves the information about applications in the Micosoft Store for Business. +The **Get product packages** operation retrieves the information about applications in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-seat.md b/windows/client-management/mdm/get-seat.md index 2169488622..598d24ea19 100644 --- a/windows/client-management/mdm/get-seat.md +++ b/windows/client-management/mdm/get-seat.md @@ -1,6 +1,6 @@ --- title: Get seat -description: The Get seat operation retrieves the information about an active seat for a specified user in the Micosoft Store for Business. +description: The Get seat operation retrieves the information about an active seat for a specified user in the Microsoft Store for Business. ms.assetid: 715BAEB2-79FD-4945-A57F-482F9E7D07C6 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get seat -The **Get seat** operation retrieves the information about an active seat for a specified user in the Micosoft Store for Business. +The **Get seat** operation retrieves the information about an active seat for a specified user in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-seats.md b/windows/client-management/mdm/get-seats.md index 21d8f631c1..a510b2460c 100644 --- a/windows/client-management/mdm/get-seats.md +++ b/windows/client-management/mdm/get-seats.md @@ -1,6 +1,6 @@ --- title: Get seats -description: The Get seats operation retrieves the information about active seats in the Micosoft Store for Business. +description: The Get seats operation retrieves the information about active seats in the Micorsoft Store for Business. ms.assetid: 32945788-47AC-4259-B616-F359D48F4F2F ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get seats -The **Get seats** operation retrieves the information about active seats in the Micosoft Store for Business. +The **Get seats** operation retrieves the information about active seats in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 3870f7d385..f128954ea6 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1,6 +1,6 @@ --- title: Device HealthAttestation CSP -description: Device HealthAttestation CSP +description: Learn how the DHA-CSP enables enterprise IT managers to assess if a device is booted to a trusted and compliant state, and take enterprise policy actions. ms.assetid: 6F2D783C-F6B4-4A81-B9A2-522C4661D1AC ms.reviewer: manager: dansimp @@ -74,7 +74,7 @@ The following is a list of functions performed by the Device HealthAttestation C DHA-Enabled MDM (Device HealthAttestation enabled device management solution)

              Device HealthAttestation enabled (DHA-Enabled) device management solution is a device management tool that is integrated with the DHA feature.

              -

              DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromized by advanced security threats or running a malicious (jailbroken) operating system.

              +

              DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromised by advanced security threats or running a malicious (jailbroken) operating system.

              The following list of operations are performed by DHA-Enabled-MDM:

              • Enables the DHA feature on a DHA-Enabled device
              • @@ -195,10 +195,10 @@ The following diagram shows the Device HealthAttestation configuration service p

                The following list shows some examples of supported values. For the complete list of status see Device HealthAttestation CSP status and error codes.

                -- 0 - (HEALTHATTESTATION\_CERT\_RETRI_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service -- 1 - (HEALTHATTESTATION\_CERT\_RETRI_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device +- 0 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service +- 1 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device - 2 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_FAILED): A valid DHA-EncBlob could not be retrieved from the DHA-Service for reasons other than discussed in the DHA error/status codes -- 3 - (HEALTHATTESTATION\_CERT\_RETRI_COMPLETE): DHA-Data is ready for pick up +- 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pick up **ForceRetrieve** (Optional)

                Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.

                @@ -220,7 +220,7 @@ The following diagram shows the Device HealthAttestation configuration service p **CorrelationId** (Required)

                Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting.

                -

                Value type is integer, the minimum value is - 2,147,483,648 and the maximun value is 2,147,483,647. The supported operation is Get.

                +

                Value type is integer, the minimum value is - 2,147,483,648 and the maximum value is 2,147,483,647. The supported operation is Get.

                **HASEndpoint** (Optional)

                Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service.

                @@ -359,8 +359,8 @@ The following example shows a sample call that triggers collection and verificat After the client receives the health attestation request, it sends a response. The following list describes the responses, along with a recommended action to take. -- If the response is HEALTHATTESTATION\_CERT_RETRI_COMPLETE (3) then proceed to the next section. -- If the response is HEALTHATTESTATION_CERT_RETRI_REQUESTED (1) or HEALTHATTESTATION_CERT_RETRI_UNINITIALIZED (0) wait for an alert, then proceed to the next section. +- If the response is HEALTHATTESTATION\_CERT_RETRIEVAL_COMPLETE (3) then proceed to the next section. +- If the response is HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTED (1) or HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZED (0) wait for an alert, then proceed to the next section. Here is a sample alert that is issued by DHA_CSP: @@ -748,13 +748,13 @@ Each of these are described in further detail in the following sections, along w **PCR0**

                The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.

                -

                Enterprise managers can create a whitelist of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the whitelist, and then make a trust decision based on the result of the comparison.

                +

                Enterprise managers can create a allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.

                -

                If your enterprise does not have a whitelist of accepted PCR[0] values, then take no action.

                +

                If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.

                -

                If PCR[0] equals an accepted whitelisted value, then allow access.

                +

                If PCR[0] equals an accepted allow list value, then allow access.

                -

                If PCR[0] does not equal any accepted whitelisted value, then take one of the following actions that align with your enterprise policies:

                +

                If PCR[0] does not equal any accepted listed value, then take one of the following actions that align with your enterprise policies:

                - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. @@ -762,9 +762,9 @@ Each of these are described in further detail in the following sections, along w **SBCPHash**

                SBCPHash is the finger print of the Custom Secure Boot Configuration Policy (SBCP) that was loaded during boot in Windows devices, except PCs.

                -

                If SBCPHash is not present, or is an accepted (whitelisted) value, then allow access. +

                If SBCPHash is not present, or is an accepted allow-listed value, then allow access. -

                If SBCPHash is present in DHA-Report, and is not a whitelisted value, then take one of the following actions that align with your enterprise policies:

                +

                If SBCPHash is present in DHA-Report, and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

                - Disallow all access - Place the device in a watch list to monitor the device more closely for potential risks. @@ -772,9 +772,9 @@ Each of these are described in further detail in the following sections, along w **CIPolicy**

                This attribute indicates the Code Integrity policy that is controlling the security of the boot environment.

                -

                If CIPolicy is not present, or is an accepted (whitelisted) value, then allow access.

                +

                If CIPolicy is not present, or is an accepted allow-listed value, then allow access.

                -

                If CIPolicy is present and is not a whitelisted value, then take one of the following actions that align with your enterprise policies:

                +

                If CIPolicy is present and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

                - Disallow all access - Place the device in a watch list to monitor the device more closely for potential risks. @@ -830,7 +830,7 @@ Each of these are described in further detail in the following sections, along w
          - + diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 21934f6452..d7209b1cf2 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -1,6 +1,6 @@ --- title: HealthAttestation DDF -description: HealthAttestation DDF +description: Learn about the OMA DM device description framework (DDF) for the HealthAttestation configuration service provider. ms.assetid: D20AC78D-D2D4-434B-B9FD-294BCD9D1DDE ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md index 025ce63385..f4a14359a1 100644 --- a/windows/client-management/mdm/hotspot-csp.md +++ b/windows/client-management/mdm/hotspot-csp.md @@ -1,6 +1,6 @@ --- title: HotSpot CSP -description: HotSpot CSP +description: Learn how HotSpot configuration service provider (CSP) is used to configure and enable Internet sharing on a device. ms.assetid: ec49dec1-fa79-420a-a9a7-e86668b3eebf ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/images/Provisioning_CSP_Defender.png b/windows/client-management/mdm/images/Provisioning_CSP_Defender.png deleted file mode 100644 index 6ee31a8f16..0000000000 Binary files a/windows/client-management/mdm/images/Provisioning_CSP_Defender.png and /dev/null differ diff --git a/windows/client-management/mdm/images/autoenrollment-mdm-policies.png b/windows/client-management/mdm/images/autoenrollment-mdm-policies.png index 29cb6d14da..6833b4ac8b 100644 Binary files a/windows/client-management/mdm/images/autoenrollment-mdm-policies.png and b/windows/client-management/mdm/images/autoenrollment-mdm-policies.png differ diff --git a/windows/client-management/mdm/images/autoenrollment-policy.png b/windows/client-management/mdm/images/autoenrollment-policy.png index f9bb009514..1de089a0c6 100644 Binary files a/windows/client-management/mdm/images/autoenrollment-policy.png and b/windows/client-management/mdm/images/autoenrollment-policy.png differ diff --git a/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png b/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png new file mode 100644 index 0000000000..226f4850aa Binary files /dev/null and b/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png index d3d33ff9f6..63ccb6fc89 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png and b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-defender.png b/windows/client-management/mdm/images/provisioning-csp-defender.png index c4a743deeb..ccf57208df 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-defender.png and b/windows/client-management/mdm/images/provisioning-csp-defender.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png b/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png index 6926801241..76df1eafea 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png and b/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png b/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png index 44449d7e6f..a12415ae84 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png and b/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png index 018354545f..4328edcad7 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png and b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png b/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png index 6c4c961a58..f123d98073 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png and b/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png index 5d8eaab42f..5896b7c1df 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png and b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-38.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-38.png deleted file mode 100644 index 7ee23eda5d..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-38.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-39.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-39.png deleted file mode 100644 index a1ca65c3f4..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-39.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-40.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-40.png deleted file mode 100644 index 87f685d460..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-40.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-41.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-41.png deleted file mode 100644 index 1832454fbc..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-41.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-42.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-42.png deleted file mode 100644 index c85e74d141..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-42.png and /dev/null differ diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md index a3dc006fc8..57d1c57718 100644 --- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md +++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md @@ -1,6 +1,6 @@ --- -title: Implement server-side support for mobile application management on Windows -description: The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP). +title: Implement server-side support for mobile application management on Windows +description: Learn about implementing the Windows version of mobile application management (MAM), which is a lightweight solution for managing company data access and security on personal devices. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -16,21 +16,21 @@ manager: dansimp The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10, version 1703. -## Integration with Azure Active Directory +## Integration with Azure AD MAM on Windows is integrated with Azure Active Directory (Azure AD) identity service. The MAM service supports Azure AD integrated authentication for the user and the device during enrollment and the downloading of MAM policies. MAM integration with Azure AD is similar to mobile device management (MDM) integration. See [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md).  -MAM enrollment is integrated with adding a work account flow to a personal device. If both MAM and Azure AD integrated MDM services are provided in an organization, a users’ personal devices will be enrolled to MAM or MDM depending on the user’s actions. If a user adds their work or school Azure AD account as a secondary account to the machine, their device will be enrolled to MAM. If a user joins their device to Azure AD, it will be enrolled to MDM.  In general, a device that has a personal account as its primary account is considered a personal device and should be enrolled to MAM. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices. +MAM enrollment is integrated with adding a work account flow to a personal device. If both MAM and Azure AD integrated MDM services are provided in an organization, a users’ personal devices will be enrolled to MAM or MDM, depending on the user’s actions. If a user adds their work or school Azure AD account as a secondary account to the machine, their device will be enrolled to MAM. If a user joins their device to Azure AD, it will be enrolled to MDM.  In general, a device that has a personal account as its primary account is considered a personal device and should be enrolled to MAM. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices. -On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD integrated application, such as the next update of Microsoft Office 365 or Microsoft Office Mobile. Alternatively, users can add an Azure AD account from **Settings>Accounts>Access work or school**. +On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD integrated application, such as the next update of Microsoft Office 365 or Microsoft Office Mobile. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**. Regular non-admin users can enroll to MAM.  ## Integration with Windows Information Protection -MAM on Windows takes advantage of [built-in Windows Information Protection (WIP) policies](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip) to protect company data on the device. To protect user-owned applications on personal devices, MAM limits enforcement of WIP policies to [enlightened apps](https://technet.microsoft.com/itpro/windows/keep-secure/enlightened-microsoft-apps-and-wip) and WIP-aware applications. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on WIP policies. WIP-aware apps indicate to Windows that they do not handle personal data, and therefore it is safe for Windows to protect data on their behalf.  +MAM on Windows takes advantage of [built-in Windows Information Protection (WIP) policies](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip) to protect company data on the device. To protect user-owned applications on personal devices, MAM limits enforcement of WIP policies to [enlightened apps](https://technet.microsoft.com/itpro/windows/keep-secure/enlightened-microsoft-apps-and-wip) and WIP-aware apps. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on WIP policies. WIP-aware apps indicate to Windows that they do not handle personal data, and therefore it is safe for Windows to protect data on their behalf.  -To make applications WIP-aware, app developers need to include the following data in the app resource file: +To make applications WIP-aware, app developers need to include the following data in the app resource file. ``` syntax // Mark this binary as Allowed for WIP (EDP) purpose  @@ -42,20 +42,20 @@ To make applications WIP-aware, app developers need to include the following dat ## Configuring an Azure AD tenant for MAM enrollment -MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the Management app for an IT admin configuration.  +MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration.  ![Mobile application management app](images/implement-server-side-mobile-application-management.png) MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that will contain both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. Please note: if the MDM service in an organization is not integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured.  -## MAM enrollment +## MAM enrollment MAM enrollment is based on the MAM extension of [[MS-MDE2] protocol](https://msdn.microsoft.com/library/mt221945.aspx). MAM enrollment supports Azure AD [federated authentication](federated-authentication-device-enrollment.md) as the only authentication method.  Below are protocol changes for MAM enrollment:  -- MDM discovery is not supported -- APPAUTH node in [DMAcc CSP](dmacc-csp.md) is optional -- MAM enrollment variation of [MS-MDE2] protocol does not support the client authentication certificate, and therefore, does not support the [MS-XCEP] protocol. Servers must use an Azure AD token for client authentication during policy syncs. Policy sync sessions must be performed over one-way SSL using server certificate authentication. +- MDM discovery is not supported. +- APPAUTH node in [DMAcc CSP](dmacc-csp.md) is optional. +- MAM enrollment variation of [MS-MDE2] protocol does not support the client authentication certificate, and therefore does not support the [MS-XCEP] protocol. Servers must use an Azure AD token for client authentication during policy syncs. Policy sync sessions must be performed over one-way SSL using server certificate authentication. Here is an example provisioning XML for MAM enrollment. @@ -73,39 +73,36 @@ Here is an example provisioning XML for MAM enrollment. Since the [Poll](dmclient-csp.md#provider-providerid-poll) node isn’t provided above, the device would default to once every 24 hours. -## Supported Configuration Service Providers (CSPs) +## Supported CSPs -MAM on Windows support the following CSPs. All other CSPs will be blocked. Note the list may change later based on customer feedback. +MAM on Windows supports the following configuration service providers (CSPs). All other CSPs will be blocked. Note the list may change later based on customer feedback: -- [AppLocker CSP](applocker-csp.md) for configuration of WIP enterprise allowed apps -- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) for installing VPN and Wi-Fi certs -- [DeviceStatus CSP](devicestatus-csp.md) required for Conditional Access support (starting with Windows 10, version 1703) -- [DevInfo CSP](devinfo-csp.md) -- [DMAcc CSP](dmacc-csp.md) -- [DMClient CSP](dmclient-csp.md) for polling schedules configuration and MDM discovery URL -- [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) has WIP policies -- [Health Attestation CSP](healthattestation-csp.md) required for Conditional Access support (starting with Windows 10, version 1703) -- [PassportForWork CSP](passportforwork-csp.md) for Windows Hello for Business PIN management -- [Policy CSP](policy-configuration-service-provider.md) specifically for NetworkIsolation and DeviceLock areas -- [Reporting CSP](reporting-csp.md) for retrieving WIP logs -- [RootCaTrustedCertificates CSP](rootcacertificates-csp.md) -- [VPNv2 CSP](vpnv2-csp.md) should be omitted for deployments where IT is planning to allow access and protect cloud-only resources with MAM -- [WiFi CSP](wifi-csp.md) should be omitted for deployments where IT is planning to allow access and protect cloud-only resources with MAM +- [AppLocker CSP](applocker-csp.md) for configuration of WIP enterprise allowed apps. +- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) for installing VPN and Wi-Fi certs. +- [DeviceStatus CSP](devicestatus-csp.md) required for Conditional Access support (starting with Windows 10, version 1703). +- [DevInfo CSP](devinfo-csp.md). +- [DMAcc CSP](dmacc-csp.md). +- [DMClient CSP](dmclient-csp.md) for polling schedules configuration and MDM discovery URL. +- [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) has WIP policies. +- [Health Attestation CSP](healthattestation-csp.md) required for Conditional Access support (starting with Windows 10, version 1703). +- [PassportForWork CSP](passportforwork-csp.md) for Windows Hello for Business PIN management. +- [Policy CSP](policy-configuration-service-provider.md) specifically for NetworkIsolation and DeviceLock areas. +- [Reporting CSP](reporting-csp.md) for retrieving WIP logs. +- [RootCaTrustedCertificates CSP](rootcacertificates-csp.md). +- [VPNv2 CSP](vpnv2-csp.md) should be omitted for deployments where IT is planning to allow access and protect cloud-only resources with MAM. +- [WiFi CSP](wifi-csp.md) should be omitted for deployments where IT is planning to allow access and protect cloud-only resources with MAM. ## Device lock policies and EAS MAM supports device lock policies similar to MDM. The policies are configured by DeviceLock area of Policy CSP and PassportForWork CSP. -We do not recommend configuring both Exchange Active Sync (EAS) and MAM policies for the same device. However, if both are configured, the client will behave as follows: +We do not recommend configuring both Exchange ActiveSync (EAS) and MAM policies for the same device. However, if both are configured, the client will behave as follows: -
            -
          1. When EAS policies are sent to a device that already has MAM policies, Windows evaluates whether the existing MAM policies are compliant with the configured EAS policies and reports compliance to EAS:
            • -
            • If the device is found to be compliant, EAS will report compliance to the server to allow mail to sync. MAM supports mandatory EAS policies only. Checking EAS compliance does not require device admin rights.
            • -
            • If the device is found to be non-compliant, EAS will enforce its own policies to the device and the resultant set of policies will be a superset of both. Applying EAS policies to the device requires admin rights.
            • -
            -
          2. If a device that already has EAS policies is enrolled to MAM, the device will have both sets of policies: MAM, EAS, and the resultant set of policies will be a superset of both.
          3. -
          +- When EAS policies are sent to a device that already has MAM policies, Windows evaluates whether the existing MAM policies are compliant with the configured EAS policies and reports compliance to EAS. +- If the device is found to be compliant, EAS will report compliance to the server to allow mail to sync. MAM supports mandatory EAS policies only. Checking EAS compliance does not require device admin rights. +- If the device is found to be non-compliant, EAS will enforce its own policies to the device and the resultant set of policies will be a superset of both. Applying EAS policies to the device requires admin rights. +- If a device that already has EAS policies is enrolled to MAM, the device will have both sets of policies: MAM and EAS, and the resultant set of policies will be a superset of both. ## Policy sync @@ -115,20 +112,18 @@ MAM policy syncs are modeled after MDM. The MAM client uses an Azure AD token to Windows does not support applying both MAM and MDM policies to the same devices. If configured by the admin, a user can change his MAM enrollment to MDM. -> [!Note] -> When users upgrade from MAM to MDM on Windows Home edition, they lose access to WIP. On the Home edition, we do not recommend pushing MDM policies to enable users to upgrade. +> [!NOTE] +> When users upgrade from MAM to MDM on Windows Home edition, they lose access to WIP. On Windows Home edition, we do not recommend pushing MDM policies to enable users to upgrade. To configure MAM device for MDM enrollment, the admin needs to configure the MDM Discovery URL in the DMClient CSP. This URL will be used for MDM enrollment. In the process of changing MAM enrollment to MDM, MAM policies will be removed from the device after MDM policies have been successfully applied. Normally when WIP policies are removed from the device, the user’s access to WIP-protected documents is revoked (selective wipe) unless EDP CSP RevokeOnUnenroll is set to false. To prevent selective wipe on enrollment change from MAM to MDM, the admin needs to ensure that: -
            -
          1. Both MAM and MDM policies for the organization support WIP
          2. -
          3. EDP CSP Enterprise ID is the same for both MAM and MDM
          4. -
          5. EDP CSP RevokeOnMDMHandoff is set to FALSE
          6. -
          +- Both MAM and MDM policies for the organization support WIP. +- EDP CSP Enterprise ID is the same for both MAM and MDM. +- EDP CSP RevokeOnMDMHandoff is set to false. -If the MAM device is properly configured for MDM enrollment, then the Enroll only to device management link will be displayed in **Settings>Accounts>Access work or school**. The user can click on this link, provide their credentials, and the enrollment will be changed to MDM. Their Azure AD account will not be affected. +If the MAM device is properly configured for MDM enrollment, then the Enroll only to device management link will be displayed in **Settings > Accounts > Access work or school**. The user can select this link, provide their credentials, and the enrollment will be changed to MDM. Their Azure AD account will not be affected. ## Skype for Business compliance with MAM @@ -156,15 +151,15 @@ We have updated Skype for Business to work with MAM. The following table explain +

          Microsoft 365 Apps for business (the version of Office that comes with some Microsoft 365 plans, such as Business Premium.)

          - + - + diff --git a/windows/client-management/mdm/index.md b/windows/client-management/mdm/index.md index 682ae5b63d..aef061ccd2 100644 --- a/windows/client-management/mdm/index.md +++ b/windows/client-management/mdm/index.md @@ -1,6 +1,6 @@ --- title: Mobile device management -description: Windows 10 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users’ privacy on their personal devices. +description: Windows 10 provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy MS-HAID: - 'p\_phDeviceMgmt.provisioning\_and\_device\_management' - 'p\_phDeviceMgmt.mobile\_device\_management\_windows\_mdm' @@ -10,7 +10,6 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: dansimp -ms.date: 01/25/2019 --- # Mobile device management @@ -34,7 +33,7 @@ With Windows 10, version 1809, Microsoft is also releasing a Microsoft MDM secur The MDM security baseline includes policies that cover the following areas: -- Microsoft inbox security technology (not deprecated) such as Bitlocker, Smartscreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall +- Microsoft inbox security technology (not deprecated) such as BitLocker, Windows Defender SmartScreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall - Restricting remote access to devices - Setting credential requirements for passwords and PINs - Restricting use of legacy technology @@ -42,14 +41,17 @@ The MDM security baseline includes policies that cover the following areas: - And much more For more details about the MDM policies defined in the MDM security baseline and what Microsoft’s recommended baseline policy values are, see: + +- [MDM Security baseline for Windows 10, version 2004](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/2004-MDM-SecurityBaseLine-Document.zip) +- [MDM Security baseline for Windows 10, version 1909](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1909-MDM-SecurityBaseLine-Document.zip) - [MDM Security baseline for Windows 10, version 1903](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1903-MDM-SecurityBaseLine-Document.zip) - [MDM Security baseline for Windows 10, version 1809](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1809-MDM-SecurityBaseLine-Document-[Preview].zip) -For information about the MDM policies defined in the Intune security baseline public preview, see [Windows security baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-windows) - +For information about the MDM policies defined in the Intune security baseline public preview, see [Windows security baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-windows). + ## Learn about migrating to MDM When an organization wants to move to MDM to manage devices, they should prepare by analyzing their current Group Policy settings to see what they need to transition to MDM management. Microsoft created the [MDM Migration Analysis Tool](https://aka.ms/mmat/) (MMAT) to help. MMAT determines which Group Policies have been set for a target user or computer and then generates a report that lists the level of support for each policy settings in MDM equivalents. For more information, see [MMAT Instructions](https://github.com/WindowsDeviceManagement/MMAT/blob/master/MDM%20Migration%20Analysis%20Tool%20Instructions.pdf). diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 98f5020545..f1f4f5b05f 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -81,43 +81,7 @@ For code samples, see [Microsoft Azure Active Directory Samples and Documentatio ## Configure your Azure AD application -Here are the steps to configure your Azure AD app. For additional information, see [Integrating Applications with Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623021): - -1. Log into Microsoft Azure Management Portal (https:manage.windowsazure.com) -2. Go to the Active Directory module. -3. Select your directory. -4. Click the **Applications** tab. - - ![business store management tool](images/businessstoreportalservices8.png) - -5. Click **Add**. - - ![business store management tool](images/businessstoreportalservices9.png) - -6. Select **Add an application that my organization is developing**. - - ![business store management tool](images/businessstoreportalservices10.png) - -7. Specify a name and then select **WEB APPLICATION AND/OR WEB API**. - - ![business store management tool](images/businessstoreportalservices11.png) - -8. Specify the **SIGN-ON URL** to your application. - - ![business store management tool](images/businessstoreportalservices12.png) - -9. Specify whether your app is multi-tenant or single tenant. For more information, see [Integrating Applications with Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623021). - - ![business store management tool](images/businessstoreportalservices13.png) - -10. Create a client key. - - ![business store management tool](images/businessstoreportalservices14.png) - - > **Note** In the prior version of the tool, an update to the app manifest was required to authorize the application. This is no longer necessary. - -11. Login to Store for Business and enable your application. For step-by-step guide, see [Configure an MDM provider](https://technet.microsoft.com/library/mt606939.aspx). - +See [Quickstart: Register an application with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app) for the steps to configure your Azure AD app. ## Azure AD Authentication for MTS diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index 08bae9914c..f74caeda09 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -1,6 +1,6 @@ --- -title: MDM enrollment of Windows-based devices -description: MDM enrollment of Windows-based devices +title: MDM enrollment of Windows 10-based devices +description: Learn about mobile device management (MDM) enrollment of Windows 10-based devices to simplify access to your organization’s resources. MS-HAID: - 'p\_phdevicemgmt.enrollment\_ui' - 'p\_phDeviceMgmt.mdm\_enrollment\_of\_windows\_devices' @@ -12,38 +12,32 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 11/15/2017 +ms.date: 11/19/2020 --- -# MDM enrollment of Windows-based devices +# MDM enrollment of Windows 10-based devices +In today’s cloud-first world, enterprise IT departments increasingly want to let employees use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization’s resources, such as apps, the corporate network, and email. -This topic describes the user experience of enrolling Windows 10-based PCs and devices. +> [!NOTE] +> When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. -In today’s cloud-first world, enterprise IT departments increasingly want to let employees bring their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization’s resources (such as apps, the corporate network, and email). +## Connect corporate-owned Windows 10-based devices -> **Note**  When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. - - - -## Connecting corporate-owned Windows 10-based devices - - -Corporate owned devices can be connected to work either by joining the device to an Active Directory domain or an Azure Active Directory (Azure AD) domain. Windows 10 does not require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. +You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 does not require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. ![active directory azure ad signin](images/unifiedenrollment-rs1-1.png) -### Connecting your device to an Active Directory domain (Join a domain) +### Connect your device to an Active Directory domain (join a domain) -Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education can be connected to an Active Directory domain. These devices can be connected using the Settings app. +Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education can be connected to an Active Directory domain using the Settings app. -> **Note**  Mobile devices cannot be connected to an Active Directory domain. +> [!NOTE] +> Mobile devices cannot be connected to an Active Directory domain. - +### Out-of-box-experience -### Out-of-box-experience (OOBE) - -Because joining your device to an Active Directory domain during the OOBE is not supported, you’ll need to first create a local account and then connect the device using the Settings app. +Joining your device to an Active Directory domain during the out-of-box-experience (OOBE) is not supported. To join a domain: 1. On the **Who Owns this PC?** page, select **My work or school owns it**. @@ -53,11 +47,13 @@ Because joining your device to an Active Directory domain during the OOBE is not ![select domain or azure ad](images/unifiedenrollment-rs1-3.png) -3. You will next see a prompt to set up a local account on the device. Enter your local account details and then click **Next** to continue. +3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. ![create pc account](images/unifiedenrollment-rs1-4.png) -### Using the Settings app +### Use the Settings app + +To create a local account and connect the device: 1. Launch the Settings app. @@ -71,42 +67,44 @@ Because joining your device to an Active Directory domain during the OOBE is not ![select access work or school](images/unifiedenrollment-rs1-7.png) -4. Click **Connect**. +4. Select **Connect**. ![connect to work or school](images/unifiedenrollment-rs1-8.png) -5. Under **Alternate actions**, click **Join this device to a local Active Directory domain**. +5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. ![join account to active directory domain](images/unifiedenrollment-rs1-9.png) -6. Type in your domain name, follow the instructions, and then click **Next** to continue. After you complete the flow and reboot your device, it should be connected to your Active Directory domain. You can now log into the device using your domain credentials. +6. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. ![type in domain name](images/unifiedenrollment-rs1-10.png) ### Help with connecting to an Active Directory domain -There are a few instances where your device cannot be connected to an Active Directory domain: +There are a few instances where your device cannot be connected to an Active Directory domain. -| Connection issue | Explanation | +| Connection issue | Description | |-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Your device is already connected to an Active Directory domain. | Your device can be connected to only a single Active Directory domain at a time. | +| Your device is already connected to an Active Directory domain. | Your device can only be connected to a single Active Directory domain at a time. | | Your device is connected to an Azure AD domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You cannot connect to both simultaneously. | | You are logged in as a standard user. | Your device can only be connected to an Azure AD domain if you are logged in as an administrative user. You’ll need to switch to an administrator account to continue. | | Your device is running Windows 10 Home. | This feature is not available on Windows 10 Home, so you will be unable to connect to an Active Directory domain. You will need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | -### Connecting your device to an Azure AD domain (Join Azure AD) +### Connect your device to an Azure AD domain (join Azure AD) All Windows devices can be connected to an Azure AD domain. These devices can be connected during OOBE. Additionally, desktop devices can be connected to an Azure AD domain using the Settings app. -### Out-of-box-experience (OOBE) +### Out-of-box-experience -1. Select **My work or school owns it**, then click **Next.** +To join a domain: + +1. Select **My work or school owns it**, then select **Next.** ![oobe local account creation](images/unifiedenrollment-rs1-11.png) -2. Click **Join Azure AD**, then click **Next.** +2. Select **Join Azure AD**, and then select **Next.** ![select domain or azure ad](images/unifiedenrollment-rs1-12.png) @@ -118,7 +116,9 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ![azure ad signin](images/unifiedenrollment-rs1-13.png) -### Using the Settings app +### Use the Settings app + +To create a local account and connect the device: 1. Launch the Settings app. @@ -132,11 +132,11 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ![select access work or school](images/unifiedenrollment-rs1-16.png) -4. Click **Connect**. +4. Select **Connect**. ![connect to work or school](images/unifiedenrollment-rs1-17.png) -5. Under **Alternate Actions**, click **Join this device to Azure Active Directory**. +5. Under **Alternate Actions**, selct **Join this device to Azure Active Directory**. ![join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) @@ -144,7 +144,7 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ![azure ad sign in](images/unifiedenrollment-rs1-19.png) -7. If the tenant is a cloud only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly on this page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. +7. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. @@ -156,9 +156,9 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ### Help with connecting to an Azure AD domain -There are a few instances where your device cannot be connected to an Azure AD domain: +There are a few instances where your device cannot be connected to an Azure AD domain. -| Connection issue | Explanation | +| Connection issue | Description | |-----------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Your device is connected to an Azure AD domain. | Your device can only be connected to a single Azure AD domain at a time. | | Your device is already connected to an Active Directory domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You cannot connect to both simultaneously. | @@ -169,18 +169,20 @@ There are a few instances where your device cannot be connected to an Azure AD d -## Connecting personally-owned devices (Bring your own device) +## Connect personally-owned devices -Personally owned devices, also known as bring your own device or BYOD, can be connected to a work or school account or to MDM. Windows 10 does not require a personal Microsoft account on devices to connect to work or school. +Personally-owned devices, also known as bring your own device (BYOD), can be connected to a work or school account, or to MDM. Windows 10 does not require a personal Microsoft account on devices to connect to work or school. -### Connecting to a work or school account +### Connect to a work or school account -All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps such as the universal Office apps. +All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. -### Using the Settings app +### Use the Settings app -1. Launch the Settings app and then click **Accounts**. Click **Start**, then the Settings icon, and then select **Accounts** +To create a local account and connect the device: + +1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. ![windows settings page](images/unifiedenrollment-rs1-21-b.png) @@ -188,7 +190,7 @@ All Windows 10-based devices can be connected to a work or school account. You ![select access work or school](images/unifiedenrollment-rs1-23-b.png) -3. Click **Connect**. +3. Select **Connect**. ![connect to work or school](images/unifiedenrollment-rs1-24-b.png) @@ -196,7 +198,7 @@ All Windows 10-based devices can be connected to a work or school account. You ![join work or school account to azure ad](images/unifiedenrollment-rs1-25-b.png) -5. If the tenant is a cloud only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly into the page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. +5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. @@ -210,11 +212,13 @@ All Windows 10-based devices can be connected to a work or school account. You ![account successfully added](images/unifiedenrollment-rs1-27.png) -### Connecting to MDM on a desktop (Enrolling in device management) +### Connect to MDM on a desktop (enrolling in device management) -All Windows 10-based devices can be connected to an MDM. You can connect to an MDM through the Settings app. +All Windows 10-based devices can be connected to MDM. You can connect to an MDM through the Settings app. -### Using the Settings app +### Use the Settings app + +To create a local account and connect the device: 1. Launch the Settings app. @@ -228,7 +232,7 @@ All Windows 10-based devices can be connected to an MDM. You can connect to an ![access work or school](images/unifiedenrollment-rs1-30.png) -4. Click the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link). +4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). ![connect to work or school](images/unifiedenrollment-rs1-31.png) @@ -244,60 +248,33 @@ All Windows 10-based devices can be connected to an MDM. You can connect to an After you complete the flow, your device will be connected to your organization’s MDM. - -### Connecting to MDM on a phone (Enrolling in device management) - -1. Launch the **Settings** app and then click **Accounts**. - - ![phone settings](images/unifiedenrollment-rs1-38.png) - -2. Click **Access work or school**. - - ![phone settings](images/unifiedenrollment-rs1-39.png) - -3. Click the **Enroll only in device management** link. This is only available in the servicing build 14393.82 (KB3176934). For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link). - - ![access work or school page](images/unifiedenrollment-rs1-40.png) - -4. Enter your work email address. - - ![enter your email address](images/unifiedenrollment-rs1-41.png) - -5. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. - - Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - -6. After you complete the flow, your device will be connected to your organization’s MDM. - - ![completed mdm enrollment](images/unifiedenrollment-rs1-42.png) - ### Help with connecting personally-owned devices -There are a few instances where your device may not be able to connect to work, as described in the following table. +There are a few instances where your device may not be able to connect to work. | Error Message | Description | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Your device is already connected to your organization’s cloud. | Your device is already connected to either Azure AD, a work or school account, or an AD domain. | | We could not find your identity in your organization’s cloud. | The username you entered was not found on your Azure AD tenant. | -| Your device is already being managed by an organization. | Your device is either already managed by MDM or System Center Configuration Manager. | +| Your device is already being managed by an organization. | Your device is either already managed by MDM or Microsoft Endpoint Configuration Manager. | | You don’t have the right privileges to perform this operation. Please talk to your admin. | You cannot enroll your device into MDM as a standard user. You must be on an administrator account. | | We couldn’t auto-discover a management endpoint matching the username entered. Please check your username and try again. If you know the URL to your management endpoint, please enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | -## Connecting your Windows 10-based device to work using a deep link +## Connect your Windows 10-based device to work using a deep link -Windows 10-based devices may be connected to work using a deep link. Users will be able to click or open a link in a particular format from anywhere in Windows 10 and be directed to the new enrollment experience. +Windows 10-based devices may be connected to work using a deep link. Users will be able to select or open a link in a particular format from anywhere in Windows 10, and be directed to the new enrollment experience. In Windows 10, version 1607, deep linking will only be supported for connecting devices to MDM. It will not support adding a work or school account, joining a device to Azure AD, and joining a device to Active Directory. -The deep link used for connecting your device to work will always use the following format: +The deep link used for connecting your device to work will always use the following format. **ms-device-enrollment:?mode={mode\_name}** | Parameter | Description | Supported Value for Windows 10| |-----------|--------------------------------------------------------------|----------------------------------------------| -| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| MDM (Mobile Device Management), AWA (Adding Work Account), and AADJ (Azure Active Directory Joined). | +| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory Joined (AADJ). | |username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string | | servername | Specifies the MDM server URL that will be used to enroll the device. Added in Windows 10, version 1703. | string| | accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this can be used as a token to validate the enrollment request. Added in Windows 10, version 1703. | string | @@ -305,47 +282,45 @@ The deep link used for connecting your device to work will always use the follow | tenantidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this can be used to identify which tenant the device or user belongs to. Added in Windows 10, version 1703. | GUID or string | | ownership | Custom parameter for MDM servers to use as they see fit. Typically, this can be used to determine whether the device is BYOD or Corp Owned. Added in Windows 10, version 1703. | 1, 2, or 3 | -> **Note** "awa" and "aadj" values for mode are only supported on Windows 10, version 1709 and later. +> [!NOTE] +> AWA and AADJ values for mode are only supported on Windows 10, version 1709 and later. -### Connecting to MDM using a deep link +### Connect to MDM using a deep link -> **Note** Deep links only work with Internet Explorer or Edge browsers. -When connecting to MDM using a deep link, the URI you should use is +> [!NOTE] +> Deep links only work with Internet Explorer or Microsoft Edge browsers. When connecting to MDM using a deep link, the URI you should use is: +> **ms-device-enrollment:?mode=mdm** +> **ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=** -**ms-device-enrollment:?mode=mdm** -**ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=** +To connect your devices to MDM using deep links: -The following procedure describes how users can connect their devices to MDM using deep links. +1. Starting with Windows 10, version 1607, create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm**, and user-friendly display text, such as **Click here to connect Windows to work**: -1. Starting with Windows 10, version 1607, you can create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm** and user-friendly display text, such as **Click here to connect Windows to work**: + (Be aware that this will launch the flow equivalent to the Enroll into the device management option in Windows 10, version 1511.) - > **Note**  This will launch the flow equivalent to the Enroll into device management option in Windows 10, version 1511. - - - IT admins can add this link to a welcome email that users can click on to enroll into MDM. + - IT admins can add this link to a welcome email that users can select to enroll into MDM. ![using enrollment deeplink in email](images/deeplinkenrollment1.png) - IT admins can also add this link to an internal web page that users refer to enrollment instructions. -2. After clicking the link or running it, Windows 10 will launch the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option in Windows 10, version 1511). +2. After you select the link or run it, Windows 10 launches the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option in Windows 10, version 1511). Type in your work email address. ![set up work or school account](images/deeplinkenrollment3.png) -3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. +3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - > **Note**  Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - - After you complete the flow, your device will be connected to your organization’s MDM. + After you complete the flow, your device will be connected to your organization's MDM. ![corporate sign in](images/deeplinkenrollment4.png) -## Managing connections +## Manage connections -Your work or school connections can be managed on the **Settings** > **Accounts** > **Access work or school** page. Your connections will show on this page and clicking on one will expand options for that connection. +To manage your work or school connections, select **Settings** > **Accounts** > **Access work or school**. Your connections will show on this page and selecting one will expand options for that connection. ![managing work or school account](images/unifiedenrollment-rs1-34-b.png) @@ -357,30 +332,31 @@ The **Info** button can be found on work or school connections involving MDM. Th - Connecting your device to a work or school account that has auto-enroll into MDM configured. - Connecting your device to MDM. -Clicking the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You’ll be able to view your organization’s support information (if configured) on this page. You’ll also be able to start a sync session which will force your device to communicate to the MDM server and fetch any updates to policies if needed. +Selecting the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You’ll be able to view your organization’s support information (if configured) on this page. You’ll also be able to start a sync session which forces your device to communicate to the MDM server and fetch any updates to policies if needed. -Starting in Windows 10, version 1709, clicking the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screehshot. +Starting in Windows 10, version 1709, selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screenshot. ![work or school info](images/unifiedenrollment-rs1-35-b.png) -> [NOTE] +> [!NOTE] > Starting in Windows 10, version 1709, the **Manage** button is no longer available. ### Disconnect -The **Disconnect** button can be found on all work connections. Generally, clicking the **Disconnect** button will remove the connection from the device. There are a few exceptions to this: +The **Disconnect** button can be found on all work connections. Generally, selecting the **Disconnect** button will remove the connection from the device. There are a few exceptions to this: - Devices that enforce the AllowManualMDMUnenrollment policy will not allow users to remove MDM enrollments. These connections must be removed by a server-initiated unenroll command. - On mobile devices, you cannot disconnect from Azure AD. These connections can only be removed by wiping the device. -> **Warning**  Disconnecting might result in the loss of data on the device. +> [!WARNING] +> Disconnecting might result in the loss of data on the device. ## Collecting diagnostic logs -You can collect diagnostic logs around your work connections by going to **Settings** > **Accounts** > **Access work or school**, and clicking the **Export your management logs** link under **Related Settings**. After you click the link, click **Export** and follow the path displayed to retrieve your management log files. +You can collect diagnostic logs around your work connections by going to **Settings** > **Accounts** > **Access work or school**, and then selecting the **Export your management logs** link under **Related Settings**. Next, select **Export**, and follow the path displayed to retrieve your management log files. -Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and clicking the **Info** button. At the bottom of the Settings page you will see the button to create a report. Here is an example screenshot. +Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you will see the button to create a report, as shown here. ![collecting enrollment management log files](images/unifiedenrollment-rs1-37-c.png) diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index e7fcc04cf0..e9383e871f 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -1,6 +1,6 @@ --- title: Messaging CSP -description: Messaging CSP +description: Use the Messaging configuration service provider (CSP) to configure the ability to get text messages audited on a mobile device. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/messaging-ddf.md b/windows/client-management/mdm/messaging-ddf.md index 3dd896d26b..22207f104b 100644 --- a/windows/client-management/mdm/messaging-ddf.md +++ b/windows/client-management/mdm/messaging-ddf.md @@ -1,6 +1,6 @@ --- title: Messaging DDF file -description: Messaging DDF file +description: Utilize the OMA DM device description framework (DDF) for the Messaging configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 3b50e8d5cf..061a5abdb2 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -1,6 +1,6 @@ --- title: Mobile device enrollment -description: Mobile device enrollment is the first phase of enterprise management. +description: Learn how mobile device enrollment verifies that only authenticated and authorized devices can be managed by their enterprise. ms.assetid: 08C8B3DB-3263-414B-A368-F47B94F47A11 ms.reviewer: manager: dansimp @@ -14,7 +14,6 @@ ms.date: 08/11/2017 # Mobile device enrollment - Mobile device enrollment is the first phase of enterprise management. The device is configured to communicate with the MDM server using security precautions during the enrollment process. The enrollment service verifies that only authenticated and authorized devices can be managed by their enterprise. The enrollment process includes the following steps: @@ -33,21 +32,20 @@ The enrollment process includes the following steps: ## Enrollment protocol - -There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). +There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). The enrollment process involves the following steps: -**Discovery request** +### Discovery request The discovery request is a simple HTTP post call that returns XML over HTTP. The returned XML includes the authentication URL, the management service URL, and the user credential type. -**Certificate enrollment policy** +### Certificate enrollment policy The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in \[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619345) -**Certificate enrollment** +### Certificate enrollment The certificate enrollment is an implementation of the MS-WSTEP protocol. -**Management configuration** +### Management configuration The server sends provisioning XML that contains a server certificate (for SSL server authentication), a client certificate issued by enterprise CA, DM client bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. The following topics describe the end-to-end enrollment process using various authentication methods: @@ -56,19 +54,18 @@ The following topics describe the end-to-end enrollment process using various au - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) -> **Note**  As a best practice, do not use hardcoded server-side checks on values such as: +> [!Note] +> As a best practice, do not use hardcoded server-side checks on values such as: > - User agent string > - Any fixed URIs that are passed during enrollment > - Specific formatting of any value unless otherwise noted, such as the format of the device ID. - ## Enrollment support for domain-joined devices -  + Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in **Settings**. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device. ## Disable MDM enrollments - Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. ![Disable MDM enrollment policy in GP Editor](images/mdm-enrollment-disable-policy.png) @@ -89,7 +86,6 @@ The following scenarios do not allow MDM enrollments: ## Enrollment migration - **Desktop:** After the MDM client upgrade from Windows 8.1 to Windows 10, enrollment migration starts at the first client-initiated sync with the MDM service. The enrollment migration start time depends on the MDM server configuration. For example, for Intune it runs every 6 hours. Until the enrollment migration is completed, the user interface will show no enrollment and server push will not work. @@ -100,7 +96,6 @@ To manually trigger enrollment migration, you can run MDMMaintenenceTask. ## Enrollment error messages - The enrollment server can decline enrollment messages using the SOAP Fault format. Errors created can be sent as follows: ```xml @@ -196,8 +191,6 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma
          3 HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETEThis state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.This state signifies that the device has successfully retrieved DHA-EncBlob from the DHA-Server.
          4March 9 2017

          Visio Pro for Office 365

          Project Desktop Client

          -

          Office 365 Business (the version of Office that comes with some Office 365 plans, such as Business Premium.)

          Deferred channel Provide users with new features of Office only a few times a year. October 10 2017Office 365 ProPlusMicrosoft 365 Apps for enterprise
          First release for deferred channelFirst release for Deferred channel Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel. June 13 2017
          -  - In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here is an example: ```xml @@ -291,20 +284,11 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. -  - TraceID is a freeform text node which is logged. It should identify the server side state for this enrollment attempt. This information may be used by support to look up why the server declined the enrollment. ## Related topics - - [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) - - - - - - diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index 7d719b40aa..3597ffa5fe 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -1,6 +1,6 @@ --- title: MultiSIM CSP -description: MultiSIM CSP allows the enterprise to manage devices with dual SIM single active configuration. +description: MultiSIM configuration service provider (CSP) allows the enterprise to manage devices with dual SIM single active configuration. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md index 24cf91748a..2e34159750 100644 --- a/windows/client-management/mdm/multisim-ddf.md +++ b/windows/client-management/mdm/multisim-ddf.md @@ -1,6 +1,6 @@ --- title: MultiSIM DDF file -description: XML file containing the device description framework +description: XML file containing the device description framework for the MultiSIM configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index c4dbd6410a..dcaef76767 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -1,6 +1,6 @@ --- title: NAP CSP -description: NAP CSP +description: Learn how the Network Access Point (NAP) configuration service provider (CSP) is used to manage and query GPRS and CDMA connections. ms.assetid: 82f04492-88a6-4afd-af10-a62b8d444d21 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 80a87e53d1..1b5f5ecdd4 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -1,6 +1,6 @@ --- title: NAPDEF CSP -description: NAPDEF CSP +description: Learn how the NAPDEF configuration service provider (CSP) is used to add, modify, or delete WAP network access points (NAPs). ms.assetid: 9bcc65dd-a72b-4f90-aba7-4066daa06988 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 12cc7ab347..43aff61d37 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,6 +1,6 @@ --- title: NetworkProxy CSP -description: NetworkProxy CSP +description: Learn how the NetworkProxy configuration service provider (CSP) is used to configure a proxy server for ethernet and Wi-Fi connections. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -40,10 +40,10 @@ Added in Windows 10, version 1803. When set to 0, it enables proxy configuration Supported operations are Add, Get, Replace, and Delete. -> [!NOTE] -> Per user proxy configuration setting is not supported. +> [!Note] +> Per user proxy configuration setting is not supported using a configuration file, only modifying registry settings on a local machine. -**AutoDetect** +**AutoDetect** Automatically detect settings. If enabled, the system tries to find the path to a PAC script. Valid values: @@ -52,9 +52,9 @@ Valid values:

        • 1 (default) - Enabled
        • -The data type is int. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. +The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. -**SetupScriptUrl** +**SetupScriptUrl** Address to the PAC script you want to use. The data type is string. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. @@ -82,4 +82,55 @@ Valid values:
        • 1 - Do not use proxy server for local addresses
        • -The data type is int. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. +The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. + +## Configuration Example + +These generic code portions for the options **ProxySettingsPerUser**, **Autodetect**, and **SetupScriptURL** can be used for a specific operation, for example Replace. Only enter the portion of code needed in the **Replace** section. +```xml + + 1 + + + ./Vendor/MSFT/NetworkProxy/ProxySettingsPerUser + + + int + text/plain + + 0 + + +``` + +```xml + + 2 + + + ./Vendor/MSFT/NetworkProxy/AutoDetect + + + int + text/plain + + 1 + + +``` + +```xml + + 3 + + + ./Vendor/MSFT/NetworkProxy/SetupScriptUrl + + + chr + text/plain + + Insert the proxy PAC URL location here: + + +``` diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index debd9dbd5a..19a52ed0be 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -25,7 +25,7 @@ The following actions are supported: - Layer 3 tagging using a differentiated services code point (DSCP) value > [!NOTE] -> The NetworkQoSPolicy configuration service provider is supported only in Microsoft Surface Hub. +> The NetworkQoSPolicy configuration service provider is officially supported for devices that are Intune managed and Azure AD joined. Currently, this CSP is not supported on Azure AD Hybrid joined devices and for devices using GPO and CSP at the same time. The minimum operating system requirement for this CSP is Windows 10, version 2004. This CSP is supported only in Microsoft Surface Hub prior to Window 10, version 2004. The following diagram shows the NetworkQoSPolicy configuration service provider in tree format. @@ -106,3 +106,10 @@ The following diagram shows the NetworkQoSPolicy configuration service provider

          The supported operations are Add, Get, Delete, and Replace. + +## Related topics + +Read more about the XML DDF structure to create this policy by following the links below: + +- [More Information about DDF and structure](networkqospolicy-ddf.md) +- [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 7ee6042e75..c2d3ea4a5e 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,6 +1,6 @@ --- title: NetworkQoSPolicy DDF -description: This topic shows the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index f12fe88286..15c29f831f 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1,6 +1,6 @@ --- title: What's new in MDM enrollment and management -description: This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. +description: Discover what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. MS-HAID: - 'p\_phdevicemgmt.mdm\_enrollment\_and\_management\_overview' - 'p\_phDeviceMgmt.new\_in\_windows\_mdm\_enrollment\_management' @@ -12,1594 +12,210 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/01/2019 +ms.localizationpriority: medium +ms.date: 10/20/2020 --- # What's new in mobile device enrollment and management +This article provides information about what's new in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. This article also provides details about the breaking changes and known issues and frequently asked questions. -This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. +For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). -For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). +## What’s new in MDM for Windows 10, version 20H2 -- **What’s new in MDM for Windows 10 versions** - - [What’s new in MDM for Windows 10, version 1903](#whats-new-in-mdm-for-windows-10-version-1903) - - [What’s new in MDM for Windows 10, version 1809](#whats-new-in-mdm-for-windows-10-version-1809) - - [What’s new in MDM for Windows 10, version 1803](#whats-new-in-mdm-for-windows-10-version-1803) - - [What’s new in MDM for Windows 10, version 1709](#whats-new-in-mdm-for-windows-10-version-1709) - - [What’s new in MDM for Windows 10, version 1703](#whats-new-in-mdm-for-windows-10-version-1703) - - [What’s new in MDM for Windows 10, version 1607](#whats-new-in-mdm-for-windows-10-version-1607) - - [What’s new in MDM for Windows 10, version 1511](#whats-new-in-mdm-for-windows-10-version-1511) +|New or updated article|Description| +|-----|-----| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:
          - [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)
          - [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)
          - [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)
          - [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)
          - [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)
          - [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)
          - [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)
          - [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following new node:
          -Properties/SleepMode | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Updated the description of the following node:
          - Settings/AllowWindowsDefenderApplicationGuard | -- **Breaking changes and known issues** - - [Get command inside an atomic command is not supported](#get-command-inside-an-atomic-command-is-not-supported) - - [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#notification-channel-uri-not-preserved-during-upgrade-from-windows-81-to-windows-10) - - [Apps installed using WMI classes are not removed](#apps-installed-using-wmi-classes-are-not-removed) - - [Passing CDATA in SyncML does not work](#passing-cdata-in-syncml-does-not-work) - - [SSL settings in IIS server for SCEP must be set to "Ignore"](#ssl-settings-in-iis-server-for-scep-must-be-set-to-ignore) - - [MDM enrollment fails on the mobile device when traffic is going through proxy](#mdm-enrollment-fails-on-the-mobile-device-when-traffic-is-going-through-proxy) - - [Server-initiated unenrollment failure](#server-initiated-unenrollment-failure) - - [Certificates causing issues with Wi-Fi and VPN](#certificates-causing-issues-with-wi-fi-and-vpn) - - [Version information for mobile devices](#version-information-for-mobile-devices) - - [Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues](#upgrading-windows-phone-81-devices-with-app-whitelisting-using-applicationrestriction-policy-has-issues) - - [Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218](#apps-dependent-on-microsoft-frameworks-may-get-blocked-in-phones-prior-to-build-10586218) - - [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#multiple-certificates-might-cause-wi-fi-connection-instabilities-in-windows-10-mobile) - - [Remote PIN reset not supported in Azure Active Directory joined mobile devices](#remote-pin-reset-not-supported-in-azure-active-directory-joined-mobile-devices) - - [MDM client will immediately check-in with the MDM server after client renews WNS channel URI](#mdm-client-will-immediately-check-in-with-the-mdm-server-after-client-renews-wns-channel-uri) - - [User provisioning failure in Azure Active Directory joined Windows 10 PC](#user-provisioning-failure-in-azure-active-directory-joined-windows-10-pc) - - [Requirements to note for VPN certificates also used for Kerberos Authentication](#requirements-to-note-for-vpn-certificates-also-used-for-kerberos-authentication) - - [Device management agent for the push-button reset is not working](#device-management-agent-for-the-push-button-reset-is-not-working) +## What’s new in MDM for Windows 10, version 2004 -- **Frequently Asked Questions** - - [Can there be more than 1 MDM server to enroll and manage devices in Windows 10?](#can-there-be-more-than-1-mdm-server-to-enroll-and-manage-devices-in-windows-10) - - [How do I set the maximum number of Azure Active Directory joined devices per user?](#how-do-i-set-the-maximum-number-of-azure-active-directory-joined-devices-per-user) - - [What is dmwappushsvc?](#what-is-dmwappushsvc) +| New or updated article | Description | +|-----|-----| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 2004:
          - [ApplicationManagement/BlockNonAdminUserInstall](policy-csp-applicationmanagement.md#applicationmanagement-blocknonadminuserinstall)
          - [Bluetooth/SetMinimumEncryptionKeySize](policy-csp-bluetooth.md#bluetooth-setminimumencryptionkeysize)
          - [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource)
          - [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth)
          - [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth)
          - [Education/AllowGraphingCalculator](policy-csp-education.md#education-allowgraphingcalculator)
          - [TextInput/ConfigureJapaneseIMEVersion](policy-csp-textinput.md#textinput-configurejapaneseimeversion)
          - [TextInput/ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#textinput-configuresimplifiedchineseimeversion)
          - [TextInput/ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#textinput-configuretraditionalchineseimeversion)

          Updated the following policy in Windows 10, version 2004:
          - [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost)

          Deprecated the following policies in Windows 10, version 2004:
          - [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth)
          - [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth)
          - [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) | +| [DevDetail CSP](devdetail-csp.md) | Added the following new node:
          - Ext/Microsoft/DNSComputerName | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following new node:
          - IsStub | +| [SUPL CSP](supl-csp.md) | Added the following new node:
          - FullVersion | -- **Change history in MDM documentation** - - [August 2019](#august-2019) - - [July 2019](#july-2019) - - [June 2019](#june-2019) - - [May 2019](#may-2019) - - [April 2019](#april-2019) - - [March 2019](#march-2019) - - [February 2019](#february-2019) - - [January 2019](#january-2019) - - [December 2018](#december-2018) - - [September 2018](#september-2018) - - [August 2018](#august-2018) - - [July 2018](#july-2018) - - [June 2018](#june-2018) - - [May 2018](#may-2018) - - [April 2018](#april-2018) - - [March 2018](#march-2018) - - [February 2018](#february-2018) - - [January 2018](#january-2018) - - [December 2017](#december-2017) - - [November 2017](#november-2017) - - [October 2017](#october-2017) - - [September 2017](#september-2017) - - [August 2017](#august-2017) +## What’s new in MDM for Windows 10, version 1909 + +| New or updated article | Description | +|-----|-----| +| [BitLocker CSP](bitlocker-csp.md) | Added the following new nodes in Windows 10, version 1909:
          - ConfigureRecoveryPasswordRotation
          - RotateRecoveryPasswords
          - RotateRecoveryPasswordsStatus
          - RotateRecoveryPasswordsRequestID| ## What’s new in MDM for Windows 10, version 1903 - ---- - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Policy CSP

          Added the following new policies in Windows 10, version 1903:

          - -
          ApplicationControl CSP

          Added new CSP in Windows 10, version 1903.

          -
          EnrollmentStatusTracking CSP

          Added new CSP in Windows 10, version 1903.

          -
          PassportForWork CSP

          Added the following new nodes in Windows 10, version 1903:
          SecurityKey, SecurityKey/UseSecurityKeyForSignin

          -
          + +| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 1903:
          - [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground)
          - [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground)
          - [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring)
          - [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope)
          - [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination)
          - [DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceinstanceids)
          - [DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceinstanceids)
          - [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile)
          - [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar)
          - [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload)
          - [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview)
          - [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync)
          - [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation)
          - [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete)
          - [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage)
          - [Power/EnergySaverBatteryThresholdOnBattery](policy-csp-power.md#power-energysaverbatterythresholdonbattery)
          - [Power/EnergySaverBatteryThresholdPluggedIn](policy-csp-power.md#power-energysaverbatterythresholdpluggedin)
          - [Power/SelectLidCloseActionOnBattery](policy-csp-power.md#power-selectlidcloseactiononbattery)
          - [Power/SelectLidCloseActionPluggedIn](policy-csp-power.md#power-selectlidcloseactionpluggedin)
          - [Power/SelectPowerButtonActionOnBattery](policy-csp-power.md#power-selectpowerbuttonactiononbattery)
          - [Power/SelectPowerButtonActionPluggedIn](policy-csp-power.md#power-selectpowerbuttonactionpluggedin)
          - [Power/SelectSleepButtonActionOnBattery](policy-csp-power.md#power-selectsleepbuttonactiononbattery)
          - [Power/SelectSleepButtonActionPluggedIn](policy-csp-power.md#power-selectsleepbuttonactionpluggedin)
          - [Power/TurnOffHybridSleepOnBattery](policy-csp-power.md#power-turnoffhybridsleeponbattery)
          - [Power/TurnOffHybridSleepPluggedIn](policy-csp-power.md#power-turnoffhybridsleeppluggedin)
          - [Power/UnattendedSleepTimeoutOnBattery](policy-csp-power.md#power-unattendedsleeptimeoutonbattery)
          - [Power/UnattendedSleepTimeoutPluggedIn](policy-csp-power.md#power-unattendedsleeptimeoutpluggedin)
          - [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice)
          - [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock)
          - [Search/AllowFindMyFiles](policy-csp-search.md#search-allowfindmyfiles)
          - [ServiceControlManager/SvchostProcessMitigation](policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation)
          - [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline)
          - [System/TurnOffFileHistory](policy-csp-system.md#system-turnofffilehistory)
          - [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#timelanguagesettings-configuretimezone)
          - [Troubleshooting/AllowRecommendations](policy-csp-troubleshooting.md#troubleshooting-allowrecommendations)
          - [Update/AutomaticMaintenanceWakeUp](policy-csp-update.md#update-automaticmaintenancewakeup)
          - [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates)
          - [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates)
          - [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod)
          - [WindowsLogon/AllowAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon)
          - [WindowsLogon/ConfigAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon)
          - [WindowsLogon/EnableFirstLogonAnimation](policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation)| +| [Policy CSP - Audit](policy-csp-audit.md) | Added the new Audit policy CSP. | +| [ApplicationControl CSP](applicationcontrol-csp.md) | Added the new CSP. | +| [Defender CSP](defender-csp.md) | Added the following new nodes:
          - Health/TamperProtectionEnabled
          - Health/IsVirtualMachine
          - Configuration
          - Configuration/TamperProtection
          - Configuration/EnableFileHashComputation | +| [DiagnosticLog CSP](diagnosticlog-csp.md)
          [DiagnosticLog DDF](diagnosticlog-ddf.md) | Added version 1.4 of the CSP in Windows 10, version 1903.
          Added the new 1.4 version of the DDF.
          Added the following new nodes:
          - Policy
          - Policy/Channels
          - Policy/Channels/ChannelName
          - Policy/Channels/ChannelName/MaximumFileSize
          - Policy/Channels/ChannelName/SDDL
          - Policy/Channels/ChannelName/ActionWhenFull
          - Policy/Channels/ChannelName/Enabled
          - DiagnosticArchive
          - DiagnosticArchive/ArchiveDefinition
          - DiagnosticArchive/ArchiveResults | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | Added the new CSP. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new nodes:
          - SecurityKey
          - SecurityKey/UseSecurityKeyForSignin | + ## What’s new in MDM for Windows 10, version 1809 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Policy CSP

          Added the following new policies in Windows 10, version 1809:

          -
            -
          • ApplicationManagement/LaunchAppAfterLogOn
          • -
          • ApplicationManagement/ScheduleForceRestartForUpdateFailures
          • -
          • Authentication/EnableFastFirstSignIn (Preview mode only)
          • -
          • Authentication/EnableWebSignIn (Preview mode only)
          • -
          • Authentication/PreferredAadTenantDomainName
          • -
          • Browser/AllowFullScreenMode
          • -
          • Browser/AllowPrelaunch
          • -
          • Browser/AllowPrinting
          • -
          • Browser/AllowSavingHistory
          • -
          • Browser/AllowSideloadingOfExtensions
          • -
          • Browser/AllowTabPreloading
          • -
          • Browser/AllowWebContentOnNewTabPage
          • -
          • Browser/ConfigureFavoritesBar
          • -
          • Browser/ConfigureHomeButton
          • -
          • Browser/ConfigureKioskMode
          • -
          • Browser/ConfigureKioskResetAfterIdleTimeout
          • -
          • Browser/ConfigureOpenMicrosoftEdgeWith
          • -
          • Browser/ConfigureTelemetryForMicrosoft365Analytics
          • -
          • Browser/PreventCertErrorOverrides
          • -
          • Browser/SetHomeButtonURL
          • -
          • Browser/SetNewTabPageURL
          • -
          • Browser/UnlockHomeButton
          • -
          • Defender/CheckForSignaturesBeforeRunningScan
          • -
          • Defender/DisableCatchupFullScan
          • -
          • Defender/DisableCatchupQuickScan
          • -
          • Defender/EnableLowCPUPriority
          • -
          • Defender/SignatureUpdateFallbackOrder
          • -
          • Defender/SignatureUpdateFileSharesSources
          • -
          • DeviceGuard/ConfigureSystemGuardLaunch
          • -
          • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
          • -
          • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
          • -
          • DeviceInstallation/PreventDeviceMetadataFromNetwork
          • -
          • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
          • -
          • DmaGuard/DeviceEnumerationPolicy
          • -
          • Experience/AllowClipboardHistory
          • -
          • Experience/DoNotSyncBrowserSettings
          • -
          • Experience/PreventUsersFromTurningOnBrowserSyncing
          • -
          • Kerberos/UPNNameHints
          • -
          • Privacy/AllowCrossDeviceClipboard
          • -
          • Privacy/DisablePrivacyExperience
          • -
          • Privacy/UploadUserActivities
          • -
          • Security/RecoveryEnvironmentAuthentication
          • -
          • System/AllowDeviceNameInDiagnosticData
          • -
          • System/ConfigureMicrosoft365UploadEndpoint
          • -
          • System/DisableDeviceDelete
          • -
          • System/DisableDiagnosticDataViewer
          • -
          • Storage/RemovableDiskDenyWriteAccess
          • -
          • TaskManager/AllowEndTask
          • -
          • Update/EngagedRestartDeadlineForFeatureUpdates
          • -
          • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
          • -
          • Update/EngagedRestartTransitionScheduleForFeatureUpdates
          • -
          • Update/SetDisablePauseUXAccess
          • -
          • Update/SetDisableUXWUAccess
          • -
          • WindowsDefenderSecurityCenter/DisableClearTpmButton
          • -
          • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
          • -
          • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
          • -
          • WindowsLogon/DontDisplayNetworkSelectionUI
          • -
          -
          PassportForWork CSP

          Added new settings in Windows 10, version 1809.

          -
          EnterpriseModernAppManagement CSP

          Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

          -
          Win32CompatibilityAppraiser CSP

          Added new configuration service provider in Windows 10, version 1809.

          -
          WindowsLicensing CSP

          Added S mode settings and SyncML examples in Windows 10, version 1809.

          -
          SUPL CSP

          Added 3 new certificate nodes in Windows 10, version 1809.

          -
          Defender CSP

          Added a new node Health/ProductStatus in Windows 10, version 1809.

          -
          BitLocker CSP

          Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro.

          -
          DevDetail CSP

          Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

          -
          Wifi CSP

          Added a new node WifiCost in Windows 10, version 1809.

          -
          WindowsDefenderApplicationGuard CSP

          Added new settings in Windows 10, version 1809.

          -
          RemoteWipe CSP

          Added new settings in Windows 10, version 1809.

          -
          TenantLockdown CSP

          Added new CSP in Windows 10, version 1809.

          -
          Office CSP

          Added FinalStatus setting in Windows 10, version 1809.

          -
          +| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings in Windows 10, version 1809:
          - ApplicationManagement/LaunchAppAfterLogOn
          - ApplicationManagement/ScheduleForceRestartForUpdateFailures
          - Authentication/EnableFastFirstSignIn (Preview mode only)
          - Authentication/EnableWebSignIn (Preview mode only)
          - Authentication/PreferredAadTenantDomainName
          - Browser/AllowFullScreenMode
          - Browser/AllowPrelaunch
          - Browser/AllowPrinting
          - Browser/AllowSavingHistory
          - Browser/AllowSideloadingOfExtensions
          - Browser/AllowTabPreloading
          - Browser/AllowWebContentOnNewTabPage
          - Browser/ConfigureFavoritesBar
          - Browser/ConfigureHomeButton
          - Browser/ConfigureKioskMode
          - Browser/ConfigureKioskResetAfterIdleTimeout
          - Browser/ConfigureOpenMicrosoftEdgeWith
          - Browser/ConfigureTelemetryForMicrosoft365Analytics
          - Browser/PreventCertErrorOverrides
          - Browser/SetHomeButtonURL
          - Browser/SetNewTabPageURL
          - Browser/UnlockHomeButton
          - Defender/CheckForSignaturesBeforeRunningScan
          - Defender/DisableCatchupFullScan
          - Defender/DisableCatchupQuickScan
          - Defender/EnableLowCPUPriority
          - Defender/SignatureUpdateFallbackOrder
          - Defender/SignatureUpdateFileSharesSources
          - DeviceGuard/ConfigureSystemGuardLaunch
          - DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
          - DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
          - DeviceInstallation/PreventDeviceMetadataFromNetwork
          - DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
          - DmaGuard/DeviceEnumerationPolicy
          - Experience/AllowClipboardHistory
          - Experience/DoNotSyncBrowserSettings
          - Experience/PreventUsersFromTurningOnBrowserSyncing
          - Kerberos/UPNNameHints
          - Privacy/AllowCrossDeviceClipboard
          - Privacy/DisablePrivacyExperience
          - Privacy/UploadUserActivities
          - Security/RecoveryEnvironmentAuthentication
          - System/AllowDeviceNameInDiagnosticData
          - System/ConfigureMicrosoft365UploadEndpoint
          - System/DisableDeviceDelete
          - System/DisableDiagnosticDataViewer
          - Storage/RemovableDiskDenyWriteAccess
          - TaskManager/AllowEndTask
          - Update/DisableWUfBSafeguards
          - Update/EngagedRestartDeadlineForFeatureUpdates
          - Update/EngagedRestartSnoozeScheduleForFeatureUpdates
          - Update/EngagedRestartTransitionScheduleForFeatureUpdates
          - Update/SetDisablePauseUXAccess
          - Update/SetDisableUXWUAccess
          - WindowsDefenderSecurityCenter/DisableClearTpmButton
          - WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
          - WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
          - WindowsLogon/DontDisplayNetworkSelectionUI | +| [BitLocker CSP](bitlocker-csp.md) | Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro. | +| [Defender CSP](defender-csp.md) | Added a new node Health/ProductStatus in Windows 10, version 1809. | +| [DevDetail CSP](devdetail-csp.md) | Added a new node SMBIOSSerialNumber in Windows 10, version 1809. | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added NonRemovable setting under AppManagement node in Windows 10, version 1809. | +| [Office CSP](office-csp.md) | Added FinalStatus setting in Windows 10, version 1809. | +| [PassportForWork CSP](passportforwork-csp.md) | Added new settings in Windows 10, version 1809. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new settings in Windows 10, version 1809. | +| [SUPL CSP](supl-csp.md) | Added 3 new certificate nodes in Windows 10, version 1809. | +| [TenantLockdown CSP](tenantlockdown-csp.md) | Added new CSP in Windows 10, version 1809. | +| [Wifi CSP](wifi-csp.md) | Added a new node WifiCost in Windows 10, version 1809. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Added new settings in Windows 10, version 1809. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added S mode settings and SyncML examples in Windows 10, version 1809. | +| [Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md) | Added new configuration service provider in Windows 10, version 1809. | + ## What’s new in MDM for Windows 10, version 1803 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          -
            -
          • ApplicationDefaults/EnableAppUriHandlers
          • -
          • ApplicationManagement/MSIAllowUserControlOverInstall
          • -
          • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
          • -
          • Bluetooth/AllowPromptedProximalConnections
          • -
          • Browser/AllowConfigurationUpdateForBooksLibrary
          • -
          • Browser/AlwaysEnableBooksLibrary
          • -
          • Browser/EnableExtendedBooksTelemetry
          • -
          • Browser/UseSharedFolderForBooks
          • -
          • Connectivity/AllowPhonePCLinking
          • -
          • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
          • -
          • DeliveryOptimization/DODelayForegroundDownloadFromHttp
          • -
          • DeliveryOptimization/DOGroupIdSource
          • -
          • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
          • -
          • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
          • -
          • DeliveryOptimization/DORestrictPeerSelectionBy
          • -
          • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
          • -
          • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
          • -
          • Display/DisablePerProcessDpiForApps
          • -
          • Display/EnablePerProcessDpi
          • -
          • Display/EnablePerProcessDpiForApps
          • -
          • Experience/AllowWindowsSpotlightOnSettings
          • -
          • KioskBrowser/BlockedUrlExceptions
          • -
          • KioskBrowser/BlockedUrls
          • -
          • KioskBrowser/DefaultURL
          • -
          • KioskBrowser/EnableEndSessionButton
          • -
          • KioskBrowser/EnableHomeButton
          • -
          • KioskBrowser/EnableNavigationButtons
          • -
          • KioskBrowser/RestartOnIdleTime
          • -
          • LanmanWorkstation/EnableInsecureGuestLogons
          • -
          • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
          • -
          • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
          • -
          • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
          • -
          • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
          • -
          • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
          • -
          • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
          • -
          • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
          • -
          • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
          • -
          • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
          • -
          • Notifications/DisallowCloudNotification
          • -
          • RestrictedGroups/ConfigureGroupMembership
          • -
          • Search/AllowCortanaInAAD
          • -
          • Search/DoNotUseWebResults
          • -
          • Security/ConfigureWindowsPasswords
          • -
          • Start/DisableContextMenus
          • -
          • System/FeedbackHubAlwaysSaveDiagnosticsLocally
          • -
          • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
          • -
          • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
          • -
          • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
          • -
          • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
          • -
          • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
          • -
          • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
          • -
          • TaskScheduler/EnableXboxGameSaveTask
          • -
          • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
          • -
          • TextInput/ForceTouchKeyboardDockedState
          • -
          • TextInput/TouchKeyboardDictationButtonAvailability
          • -
          • TextInput/TouchKeyboardEmojiButtonAvailability
          • -
          • TextInput/TouchKeyboardFullModeAvailability
          • -
          • TextInput/TouchKeyboardHandwritingModeAvailability
          • -
          • TextInput/TouchKeyboardNarrowModeAvailability
          • -
          • TextInput/TouchKeyboardSplitModeAvailability
          • -
          • TextInput/TouchKeyboardWideModeAvailability
          • -
          • Update/ConfigureFeatureUpdateUninstallPeriod
          • -
          • UserRights/AccessCredentialManagerAsTrustedCaller
          • -
          • UserRights/AccessFromNetwork
          • -
          • UserRights/ActAsPartOfTheOperatingSystem
          • -
          • UserRights/AllowLocalLogOn
          • -
          • UserRights/BackupFilesAndDirectories
          • -
          • UserRights/ChangeSystemTime
          • -
          • UserRights/CreateGlobalObjects
          • -
          • UserRights/CreatePageFile
          • -
          • UserRights/CreatePermanentSharedObjects
          • -
          • UserRights/CreateSymbolicLinks
          • -
          • UserRights/CreateToken
          • -
          • UserRights/DebugPrograms
          • -
          • UserRights/DenyAccessFromNetwork
          • -
          • UserRights/DenyLocalLogOn
          • -
          • UserRights/DenyRemoteDesktopServicesLogOn
          • -
          • UserRights/EnableDelegation
          • -
          • UserRights/GenerateSecurityAudits
          • -
          • UserRights/ImpersonateClient
          • -
          • UserRights/IncreaseSchedulingPriority
          • -
          • UserRights/LoadUnloadDeviceDrivers
          • -
          • UserRights/LockMemory
          • -
          • UserRights/ManageAuditingAndSecurityLog
          • -
          • UserRights/ManageVolume
          • -
          • UserRights/ModifyFirmwareEnvironment
          • -
          • UserRights/ModifyObjectLabel
          • -
          • UserRights/ProfileSingleProcess
          • -
          • UserRights/RemoteShutdown
          • -
          • UserRights/RestoreFilesAndDirectories
          • -
          • UserRights/TakeOwnership
          • -
          • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
          • -
          • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
          • -
          • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
          • -
          • WindowsDefenderSecurityCenter/HideSecureBoot
          • -
          • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
          • -
          -

          Security/RequireDeviceEncryption - updated to show it is supported in desktop.

          -
          BitLocker CSP

          Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

          -
          DMClient CSP

          Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

          -
            -
          • AADSendDeviceToken
          • -
          • BlockInStatusPage
          • -
          • AllowCollectLogsButton
          • -
          • CustomErrorText
          • -
          • SkipDeviceStatusPage
          • -
          • SkipUserStatusPage
          • -
          -
          Defender CSP

          Added new node (OfflineScan) in Windows 10, version 1803.

          -
          UEFI CSP

          Added a new CSP in Windows 10, version 1803.

          -
          Update CSP

          Added the following nodes in Windows 10, version 1803:

          -
            -
          • Rollback
          • -
          • Rollback/FeatureUpdate
          • -
          • Rollback/QualityUpdateStatus
          • -
          • Rollback/FeatureUpdateStatus
          • -
          -
          AssignedAccess CSP

          Added the following nodes in Windows 10, version 1803:

          -
            -
          • Status
          • -
          • ShellLauncher
          • -
          • StatusConfiguration
          • -
          -

          Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

          -
          MultiSIM CSP

          Added a new CSP in Windows 10, version 1803.

          -
          EnterpriseModernAppManagement CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • MaintainProcessorArchitectureOnUpdate
          • -
          -
          eUICCs CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • IsEnabled
          • -
          -
          DeviceStatus CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • OS/Mode
          • -
          -
          AccountManagement CSP

          Added a new CSP in Windows 10, version 1803.

          -
          RootCATrustedCertificates CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • UntrustedCertificates
          • -
          -
          NetworkProxy CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • ProxySettingsPerUser
          • -
          -
          Accounts CSP

          Added a new CSP in Windows 10, version 1803.

          -
          MDM Migration Analysis Too (MMAT)

          Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

          -
          CSP DDF files download

          Added the DDF download of Windows 10, version 1803 configuration service providers.

          -
          +| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1803:
          - ApplicationDefaults/EnableAppUriHandlers
          - ApplicationManagement/MSIAllowUserControlOverInstall
          - ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
          - Bluetooth/AllowPromptedProximalConnections
          - Browser/AllowConfigurationUpdateForBooksLibrary
          - Browser/AlwaysEnableBooksLibrary
          - Browser/EnableExtendedBooksTelemetry
          - Browser/UseSharedFolderForBooks
          - Connectivity/AllowPhonePCLinking
          - DeliveryOptimization/DODelayBackgroundDownloadFromHttp
          - DeliveryOptimization/DODelayForegroundDownloadFromHttp
          - DeliveryOptimization/DOGroupIdSource
          - DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
          - DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
          - DeliveryOptimization/DORestrictPeerSelectionBy
          - DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
          - DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
          - Display/DisablePerProcessDpiForApps
          - Display/EnablePerProcessDpi
          - Display/EnablePerProcessDpiForApps
          - Experience/AllowWindowsSpotlightOnSettings
          - KioskBrowser/BlockedUrlExceptions
          - KioskBrowser/BlockedUrls
          - KioskBrowser/DefaultURL
          - KioskBrowser/EnableEndSessionButton
          - KioskBrowser/EnableHomeButton
          - KioskBrowser/EnableNavigationButtons
          - KioskBrowser/RestartOnIdleTime
          - LanmanWorkstation/EnableInsecureGuestLogons
          - LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
          - LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
          - LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
          - LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
          - LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
          - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
          - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
          - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
          - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
          - LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
          - LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
          - LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
          - LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
          - LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
          - LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
          - LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
          - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
          - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
          - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
          - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
          - LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
          - LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
          - LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
          - Notifications/DisallowCloudNotification
          - RestrictedGroups/ConfigureGroupMembership
          - Search/AllowCortanaInAAD
          - Search/DoNotUseWebResults
          - Security/ConfigureWindowsPasswords
          - Start/DisableContextMenus
          - System/FeedbackHubAlwaysSaveDiagnosticsLocally
          - SystemServices/ConfigureHomeGroupListenerServiceStartupMode
          - SystemServices/ConfigureHomeGroupProviderServiceStartupMode
          - SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
          - SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
          - SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
          - SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
          - TaskScheduler/EnableXboxGameSaveTask
          - TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
          - TextInput/ForceTouchKeyboardDockedState
          - TextInput/TouchKeyboardDictationButtonAvailability
          - TextInput/TouchKeyboardEmojiButtonAvailability
          - TextInput/TouchKeyboardFullModeAvailability
          - TextInput/TouchKeyboardHandwritingModeAvailability
          - TextInput/TouchKeyboardNarrowModeAvailability
          - TextInput/TouchKeyboardSplitModeAvailability
          - TextInput/TouchKeyboardWideModeAvailability
          - Update/ConfigureFeatureUpdateUninstallPeriod
          - Update/TargetReleaseVersion
          - UserRights/AccessCredentialManagerAsTrustedCaller
          - UserRights/AccessFromNetwork
          - UserRights/ActAsPartOfTheOperatingSystem
          - UserRights/AllowLocalLogOn
          - UserRights/BackupFilesAndDirectories
          - UserRights/ChangeSystemTime
          - UserRights/CreateGlobalObjects
          - UserRights/CreatePageFile
          - UserRights/CreatePermanentSharedObjects
          - UserRights/CreateSymbolicLinks
          - UserRights/CreateToken
          - UserRights/DebugPrograms
          - UserRights/DenyAccessFromNetwork
          - UserRights/DenyLocalLogOn
          - UserRights/DenyRemoteDesktopServicesLogOn
          - UserRights/EnableDelegation
          - UserRights/GenerateSecurityAudits
          - UserRights/ImpersonateClient
          - UserRights/IncreaseSchedulingPriority
          - UserRights/LoadUnloadDeviceDrivers
          - UserRights/LockMemory
          - UserRights/ManageAuditingAndSecurityLog
          - UserRights/ManageVolume
          - UserRights/ModifyFirmwareEnvironment
          - UserRights/ModifyObjectLabel
          - UserRights/ProfileSingleProcess
          - UserRights/RemoteShutdown
          - UserRights/RestoreFilesAndDirectories
          - UserRights/TakeOwnership
          - WindowsDefenderSecurityCenter/DisableAccountProtectionUI
          - WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
          - WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
          - WindowsDefenderSecurityCenter/HideSecureBoot
          - WindowsDefenderSecurityCenter/HideTPMTroubleshooting
          - Security/RequireDeviceEncryption - updated to show it is supported in desktop. | +| [Accounts CSP](accounts-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AccountManagement CSP](accountmanagement-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following nodes in Windows 10, version 1803:
          - Status
          - ShellLauncher
          - StatusConfiguration

          Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite. | +| [BitLocker CSP](bitlocker-csp.md) | Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803. | +| [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) | Added the DDF download of Windows 10, version 1803 configuration service providers. | +| [Defender CSP](defender-csp.md) | Added new node (OfflineScan) in Windows 10, version 1803. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following node in Windows 10, version 1803:
          - OS/Mode | +| [DMClient CSP](dmclient-csp.md) | Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:
          - AADSendDeviceToken
          - BlockInStatusPage
          - AllowCollectLogsButton
          - CustomErrorText
          - SkipDeviceStatusPage
          - SkipUserStatusPage | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following node in Windows 10, version 1803:
          - MaintainProcessorArchitectureOnUpdate | +| [eUICCs CSP](euiccs-csp.md) | Added the following node in Windows 10, version 1803:
          - IsEnabled | +| [MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat) | MDM Migration Analysis Too (MMAT)
          Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies. | +| [MultiSIM CSP](multisim-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the following node in Windows 10, version 1803:
          - ProxySettingsPerUser | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | Added the following node in Windows 10, version 1803:
          - UntrustedCertificates | +| [UEFI CSP](uefi-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [Update CSP](update-csp.md) | Added the following nodes in Windows 10, version 1803:
          - Rollback
          - Rollback/FeatureUpdate
          - Rollback/QualityUpdateStatus
          - Rollback/FeatureUpdateStatus | ## What’s new in MDM for Windows 10, version 1709 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ItemDescription
          The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

          The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

          -
            -
          • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
          • -
          • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
          • -
          • DomainName - fully qualified domain name if the device is domain-joined.
          • -
          -

          For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

          -
          Firewall CSP

          Added new CSP in Windows 10, version 1709.

          -
          eUICCs CSP

          Added new CSP in Windows 10, version 1709.

          -
          WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
          CM_ProxyEntries CSP and CMPolicy CSPIn Windows 10, version 1709, support for desktop SKUs were added to these CSPs. The table of SKU information in the Configuration service provider reference was updated.
          WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
          VPNv2 CSP

          Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.

          -
          DeviceStatus CSP

          Added the following settings in Windows 10, version 1709:

          -
            -
          • DeviceStatus/DomainName
          • -
          • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
          • -
          • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
          • -
          • DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus
          • -
          -
          AssignedAccess CSP

          Added the following setting in Windows 10, version 1709.

          -
            -
          • Configuration
          • -
          -

          Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro.

          -
          DeviceManageability CSP

          Added the following settings in Windows 10, version 1709:

          -
            -
          • Provider/ProviderID/ConfigInfo
          • -
          • Provider/ProviderID/EnrollmentInfo
          • -
          -
          Office CSP

          Added the following setting in Windows 10, version 1709:

          -
            -
          • Installation/CurrentStatus
          • -
          -
          DMClient CSP

          Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

          -
          Bitlocker CSP

          Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

          -
          ADMX-backed policies in Policy CSP

          Added new policies.

          -
          Microsoft Store for Business and Microsoft Store

          Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

          -
          MDM enrollment of Windows-based devices

          New features in the Settings app:

          -
            -
          • User sees installation progress of critical policies during MDM enrollment.
          • -
          • User knows what policies, profiles, apps MDM has configured
          • -
          • IT helpdesk can get detailed MDM diagnostic information using client tools
          • -
          -

          For details, see Managing connection and Collecting diagnostic logs

          -
          Enroll a Windows 10 device automatically using Group Policy

          Added new topic to introduce a new Group Policy for automatic MDM enrollment.

          -
          Policy CSP

          Added the following new policies for Windows 10, version 1709:

          -
            -
          • Authentication/AllowAadPasswordReset
          • -
          • Authentication/AllowFidoDeviceSignon
          • -
          • Browser/LockdownFavorites
          • -
          • Browser/ProvisionFavorites
          • -
          • Cellular/LetAppsAccessCellularData
          • -
          • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
          • -
          • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
          • -
          • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
          • -
          • CredentialProviders/DisableAutomaticReDeploymentCredentials
          • -
          • DeviceGuard/EnableVirtualizationBasedSecurity
          • -
          • DeviceGuard/RequirePlatformSecurityFeatures
          • -
          • DeviceGuard/LsaCfgFlags
          • -
          • DeviceLock/MinimumPasswordAge
          • -
          • ExploitGuard/ExploitProtectionSettings
          • -
          • Games/AllowAdvancedGamingServices
          • -
          • Handwriting/PanelDefaultModeDocked
          • -
          • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
          • -
          • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
          • -
          • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
          • -
          • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
          • -
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
          • -
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
          • -
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
          • -
          • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
          • -
          • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
          • -
          • Power/DisplayOffTimeoutOnBattery
          • -
          • Power/DisplayOffTimeoutPluggedIn
          • -
          • Power/HibernateTimeoutOnBattery
          • -
          • Power/HibernateTimeoutPluggedIn
          • -
          • Power/StandbyTimeoutOnBattery
          • -
          • Power/StandbyTimeoutPluggedIn
          • -
          • Privacy/EnableActivityFeed
          • -
          • Privacy/PublishUserActivities
          • -
          • Defender/AttackSurfaceReductionOnlyExclusions
          • -
          • Defender/AttackSurfaceReductionRules
          • -
          • Defender/CloudBlockLevel
          • -
          • Defender/CloudExtendedTimeout
          • -
          • Defender/ControlledFolderAccessAllowedApplications
          • -
          • Defender/ControlledFolderAccessProtectedFolders
          • -
          • Defender/EnableControlledFolderAccess
          • -
          • Defender/EnableNetworkProtection
          • -
          • Education/DefaultPrinterName
          • -
          • Education/PreventAddingNewPrinters
          • -
          • Education/PrinterNames
          • -
          • Search/AllowCloudSearch
          • -
          • Security/ClearTPMIfNotReady
          • -
          • Settings/AllowOnlineTips
          • -
          • Start/HidePeopleBar
          • -
          • Storage/AllowDiskHealthModelUpdates
          • -
          • System/DisableEnterpriseAuthProxy
          • -
          • System/LimitEnhancedDiagnosticDataWindowsAnalytics
          • -
          • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
          • -
          • Update/DisableDualScan
          • -
          • Update/ManagePreviewBuilds
          • -
          • Update/ScheduledInstallEveryWeek
          • -
          • Update/ScheduledInstallFirstWeek
          • -
          • Update/ScheduledInstallFourthWeek
          • -
          • Update/ScheduledInstallSecondWeek
          • -
          • Update/ScheduledInstallThirdWeek
          • -
          • WindowsDefenderSecurityCenter/CompanyName
          • -
          • WindowsDefenderSecurityCenter/DisableAppBrowserUI
          • -
          • WindowsDefenderSecurityCenter/DisableEnhancedNotifications
          • -
          • WindowsDefenderSecurityCenter/DisableFamilyUI
          • -
          • WindowsDefenderSecurityCenter/DisableHealthUI
          • -
          • WindowsDefenderSecurityCenter/DisableNetworkUI
          • -
          • WindowsDefenderSecurityCenter/DisableNotifications
          • -
          • WindowsDefenderSecurityCenter/DisableVirusUI
          • -
          • WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
          • -
          • WindowsDefenderSecurityCenter/Email
          • -
          • WindowsDefenderSecurityCenter/EnableCustomizedToasts
          • -
          • WindowsDefenderSecurityCenter/EnableInAppCustomization
          • -
          • WindowsDefenderSecurityCenter/Phone
          • -
          • WindowsDefenderSecurityCenter/URL
          • -
          • WirelessDisplay/AllowMdnsAdvertisement
          • -
          • WirelessDisplay/AllowMdnsDiscovery
          • -
          -
          +| New or updated article | Description | +|-----|-----| +| The [The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2](https://docs.microsoft.com/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692?redirectedfrom=MSDN) | The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:
          - UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
          -ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
          - DomainName - fully qualified domain name if the device is domain-joined. | +| [Firewall CSP](firewall-csp.md) | Added new CSP in Windows 10, version 1709. | +| [eUICCs CSP](euiccs-csp.md) | Added new CSP in Windows 10, version 1709. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)
          [WindowsDefenderApplicationGuard DDF file](windowsdefenderapplicationguard-ddf-file.md) | New CSP added in Windows 10, version 1709. Also added the DDF topic. | +| [CM_ProxyEntries CSP](cm-proxyentries-csp.md) and [CMPolicy CSP](cmpolicy-csp.md) | In Windows 10, version 1709, support for desktop SKUs were added to these CSPs. | +| [VPNv2 CSP](vpnv2-csp.md) | Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following settings in Windows 10, version 1709:
          - DeviceStatus/DomainName
          - DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
          - DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
          - DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following setting in Windows 10, version 1709:
          - Configuration
          Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro. | +| [DeviceManageability CSP](devicemanageability-csp.md) | Added the following settings in Windows 10, version 1709:
          - Provider/_ProviderID_/ConfigInfo
          - Provider/_ProviderID_/EnrollmentInfo | +| [Office CSP](office-csp.md) | Added the following setting in Windows 10, version 1709:
          - Installation/CurrentStatus | +| [DMClient CSP](dmclient-csp.md) | Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF articles. | +| [Bitlocker CSP](bitlocker-csp.md) | Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. | +| [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) | Added new policies. | +| Microsoft Store for Business and Microsoft Store | Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store. | +| [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) | New features in the Settings app:
          - User sees installation progress of critical policies during MDM enrollment.
          - User knows what policies, profiles, apps MDM has configured
          - IT helpdesk can get detailed MDM diagnostic information using client tools
          For details, see [Managing connection](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#manage-connections) and [Collecting diagnostic logs](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#collecting-diagnostic-logs).| +| [Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md) | Added new topic to introduce a new Group Policy for automatic MDM enrollment. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1709:
          - Authentication/AllowAadPasswordReset
          - Authentication/AllowFidoDeviceSignon
          - Browser/LockdownFavorites
          - Browser/ProvisionFavorites
          - Cellular/LetAppsAccessCellularData
          - Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
          - Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
          - Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
          - CredentialProviders/DisableAutomaticReDeploymentCredentials
          - DeviceGuard/EnableVirtualizationBasedSecurity
          - DeviceGuard/RequirePlatformSecurityFeatures
          - DeviceGuard/LsaCfgFlags
          - DeviceLock/MinimumPasswordAge
          - ExploitGuard/ExploitProtectionSettings
          - Games/AllowAdvancedGamingServices
          - Handwriting/PanelDefaultModeDocked
          - LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
          - LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
          - LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
          - LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
          - LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
          - LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
          - LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
          - LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
          - LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
          - LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
          - LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
          - LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
          - LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
          - LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
          - LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
          - LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
          - LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
          - LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
          - LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
          - LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
          - LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
          - LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
          - Power/DisplayOffTimeoutOnBattery
          - Power/DisplayOffTimeoutPluggedIn
          - Power/HibernateTimeoutOnBattery
          - Power/HibernateTimeoutPluggedIn
          - Power/StandbyTimeoutOnBattery
          - Power/StandbyTimeoutPluggedIn
          - Privacy/EnableActivityFeed
          - Privacy/PublishUserActivities
          - Defender/AttackSurfaceReductionOnlyExclusions
          - Defender/AttackSurfaceReductionRules
          - Defender/CloudBlockLevel
          - Defender/CloudExtendedTimeout
          - Defender/ControlledFolderAccessAllowedApplications
          - Defender/ControlledFolderAccessProtectedFolders
          - Defender/EnableControlledFolderAccess
          - Defender/EnableNetworkProtection
          - Education/DefaultPrinterName
          - Education/PreventAddingNewPrinters
          - Education/PrinterNames
          - Search/AllowCloudSearch
          - Security/ClearTPMIfNotReady
          - Settings/AllowOnlineTips
          - Start/HidePeopleBar
          - Storage/AllowDiskHealthModelUpdates
          - System/DisableEnterpriseAuthProxy
          - System/LimitEnhancedDiagnosticDataWindowsAnalytics
          - Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
          - Update/DisableDualScan
          - Update/ManagePreviewBuilds
          - Update/ScheduledInstallEveryWeek
          - Update/ScheduledInstallFirstWeek
          - Update/ScheduledInstallFourthWeek
          - Update/ScheduledInstallSecondWeek
          - Update/ScheduledInstallThirdWeek
          - WindowsDefenderSecurityCenter/CompanyName
          - WindowsDefenderSecurityCenter/DisableAppBrowserUI
          - WindowsDefenderSecurityCenter/DisableEnhancedNotifications
          - WindowsDefenderSecurityCenter/DisableFamilyUI
          - WindowsDefenderSecurityCenter/DisableHealthUI
          - WindowsDefenderSecurityCenter/DisableNetworkUI
          - WindowsDefenderSecurityCenter/DisableNotifications
          - WindowsDefenderSecurityCenter/DisableVirusUI
          - WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
          - WindowsDefenderSecurityCenter/Email
          - WindowsDefenderSecurityCenter/EnableCustomizedToasts
          - WindowsDefenderSecurityCenter/EnableInAppCustomization
          - WindowsDefenderSecurityCenter/Phone
          - WindowsDefenderSecurityCenter/URL
          - WirelessDisplay/AllowMdnsAdvertisement
          - WirelessDisplay/AllowMdnsDiscovery | + ## What’s new in MDM for Windows 10, version 1703 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ItemDescription

          Update CSP

          Added the following nodes:

          -
            -
          • FailedUpdates/Failed Update Guid/RevisionNumber
          • -
          • InstalledUpdates/Installed Update Guid/RevisionNumber
          • -
          • PendingRebootUpdates/Pending Reboot Update Guid/RevisionNumber
          • -
          -
          CM_CellularEntries CSP

          To PurposeGroups setting, added the following values:

          -
            -
          • Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
          • -
          • Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364
          • -
          -

          CertificateStore CSP

          Added the following setting:

          -
            -
          • My/WSTEP/Renew/RetryAfterExpiryInterval
          • -
          -

          ClientCertificateInstall CSP

          Added the following setting:

          -
            -
          • SCEP/UniqueID/Install/AADKeyIdentifierList
          • -
          -

          DMAcc CSP

          Added the following setting:

          -
            -
          • AccountUID/EXT/Microsoft/InitiateSession
          • -
          -

          DMClient CSP

          Added the following nodes and settings:

          -
            -
          • HWDevID
          • -
          • Provider/ProviderID/ManagementServerToUpgradeTo
          • -
          • Provider/ProviderID/CustomEnrollmentCompletePage
          • -
          • Provider/ProviderID/CustomEnrollmentCompletePage/Title
          • -
          • Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
          • -
          • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
          • -
          • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText
          • -
          -

          CellularSettings CSP

          CM_CellularEntries CSP

          EnterpriseAPN CSP

          For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.

          -
          SecureAssessment CSP

          Added the following settings:

          -
            -
          • AllowTextSuggestions
          • -
          • RequirePrinting
          • -
          -
          EnterpriseAPN CSP

          Added the following setting:

          -
            -
          • Roaming
          • -
          -
          Messaging CSP

          Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enteprise editions.

          -
          Policy CSP

          Added the following new policies:

          -
            -
          • Accounts/AllowMicrosoftAccountSignInAssistant
          • -
          • ApplicationDefaults/DefaultAssociationsConfiguration
          • -
          • Browser/AllowAddressBarDropdown
          • -
          • Browser/AllowFlashClickToRun
          • -
          • Browser/AllowMicrosoftCompatibilityList
          • -
          • Browser/AllowSearchEngineCustomization
          • -
          • Browser/ClearBrowsingDataOnExit
          • -
          • Browser/ConfigureAdditionalSearchEngines
          • -
          • Browser/DisableLockdownOfStartPages
          • -
          • Browser/PreventFirstRunPage
          • -
          • Browser/PreventLiveTileDataCollection
          • -
          • Browser/SetDefaultSearchEngine
          • -
          • Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
          • -
          • Connectivity/AllowConnectedDevices
          • -
          • DeliveryOptimization/DOAllowVPNPeerCaching
          • -
          • DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
          • -
          • DeliveryOptimization/DOMinDiskSizeAllowedToPeer
          • -
          • DeliveryOptimization/DOMinFileSizeToCache
          • -
          • DeliveryOptimization/DOMinRAMAllowedToPeer
          • -
          • DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
          • -
          • Display/TurnOffGdiDPIScalingForApps
          • -
          • Display/TurnOnGdiDPIScalingForApps
          • -
          • EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
          • -
          • EnterpriseCloudPrint/CloudPrintOAuthAuthority
          • -
          • EnterpriseCloudPrint/CloudPrintOAuthClientId
          • -
          • EnterpriseCloudPrint/CloudPrintResourceId
          • -
          • EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
          • -
          • EnterpriseCloudPrint/MopriaDiscoveryResourceId
          • -
          • Experience/AllowFindMyDevice
          • -
          • Experience/AllowTailoredExperiencesWithDiagnosticData
          • -
          • Experience/AllowWindowsSpotlightOnActionCenter
          • -
          • Experience/AllowWindowsSpotlightWindowsWelcomeExperience
          • -
          • Location/EnableLocation
          • -
          • Messaging/AllowMMS
          • -
          • Messaging/AllowRCS
          • -
          • Privacy/LetAppsAccessTasks
          • -
          • Privacy/LetAppsAccessTasks_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessTasks_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsGetDiagnosticInfo
          • -
          • Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
          • -
          • Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
          • -
          • Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsRunInBackground
          • -
          • Privacy/LetAppsRunInBackground_ForceAllowTheseApps
          • -
          • Privacy/LetAppsRunInBackground_ForceDenyTheseApps
          • -
          • Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
          • -
          • Settings/ConfigureTaskbarCalendar
          • -
          • Settings/PageVisibilityList
          • -
          • SmartScreen/EnableAppInstallControl
          • -
          • SmartScreen/EnableSmartScreenInShell
          • -
          • SmartScreen/PreventOverrideForFilesInShell
          • -
          • Start/AllowPinnedFolderDocuments
          • -
          • Start/AllowPinnedFolderDownloads
          • -
          • Start/AllowPinnedFolderFileExplorer
          • -
          • Start/AllowPinnedFolderHomeGroup
          • -
          • Start/AllowPinnedFolderMusic
          • -
          • Start/AllowPinnedFolderNetwork
          • -
          • Start/AllowPinnedFolderPersonalFolder
          • -
          • Start/AllowPinnedFolderPictures
          • -
          • Start/AllowPinnedFolderSettings
          • -
          • Start/AllowPinnedFolderVideos
          • -
          • Start/HideAppList
          • -
          • Start/HideChangeAccountSettings
          • -
          • Start/HideFrequentlyUsedApps
          • -
          • Start/HideHibernate
          • -
          • Start/HideLock
          • -
          • Start/HidePowerButton
          • -
          • Start/HideRecentJumplists
          • -
          • Start/HideRecentlyAddedApps
          • -
          • Start/HideRestart
          • -
          • Start/HideShutDown
          • -
          • Start/HideSignOut
          • -
          • Start/HideSleep
          • -
          • Start/HideSwitchAccount
          • -
          • Start/HideUserTile
          • -
          • Start/ImportEdgeAssets
          • -
          • Start/NoPinningToTaskbar
          • -
          • System/AllowFontProviders
          • -
          • System/DisableOneDriveFileSync
          • -
          • TextInput/AllowKeyboardTextSuggestions
          • -
          • TimeLanguageSettings/AllowSet24HourClock
          • -
          • Update/ActiveHoursMaxRange
          • -
          • Update/AutoRestartDeadlinePeriodInDays
          • -
          • Update/AutoRestartNotificationSchedule
          • -
          • Update/AutoRestartRequiredNotificationDismissal
          • -
          • Update/DetectionFrequency
          • -
          • Update/EngagedRestartDeadline
          • -
          • Update/EngagedRestartSnoozeSchedule
          • -
          • Update/EngagedRestartTransitionSchedule
          • -
          • Update/IgnoreMOAppDownloadLimit
          • -
          • Update/IgnoreMOUpdateDownloadLimit
          • -
          • Update/PauseFeatureUpdatesStartTime
          • -
          • Update/PauseQualityUpdatesStartTime
          • -
          • Update/SetAutoRestartNotificationDisable
          • -
          • Update/SetEDURestart
          • -
          • WiFi/AllowWiFiDirect
          • -
          • WindowsLogon/HideFastUserSwitching
          • -
          • WirelessDisplay/AllowProjectionFromPC
          • -
          • WirelessDisplay/AllowProjectionFromPCOverInfrastructure
          • -
          • WirelessDisplay/AllowProjectionToPCOverInfrastructure
          • -
          • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
          • -

          Removed TextInput/AllowLinguisticDataCollection

          -

          Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enteprise and IoT Enterprise

          -

          Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

          -

          Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

          -

          Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

          -

          Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files.

          -
          DevDetail CSP

          Added the following setting:

          -
            -
          • DeviceHardwareData
          • -
          -
          CleanPC CSP

          Added new CSP.

          DeveloperSetup CSP

          Added new CSP.

          NetworkProxy CSP

          Added new CSP.

          BitLocker CSP

          Added new CSP.

          -

          Added the following setting:

          -
            -
          • AllowWarningForOtherDiskEncryption
          • -
          -
          EnterpriseDataProtection CSP

          Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.

          Added the following settings:

          -
            -
          • RevokeOnMDMHandoff
          • -
          • SMBAutoEncryptedFileExtensions
          • -
          DynamicManagement CSP

          Added new CSP.

          Implement server-side support for mobile application management on Windows

          New mobile application management (MAM) support added in Windows 10, version 1703.

          PassportForWork CSP

          Added the following new node and settings:

          -
            -
          • TenantId/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
          • -
          • TenantId/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
          • -
          • TenantId/Policies/EnablePinRecovery
          • -
          Office CSP

          Added new CSP.

          Personalization CSP

          Added new CSP.

          EnterpriseAppVManagement CSP

          Added new CSP.

          HealthAttestation CSP

          Added the following settings:

          -
            -
          • HASEndpoint - added in Windows 10, version 1607, but not documented
          • -
          • TpmReadyStatus - added in the March service release of Windows 10, version 1607
          • -

          SurfaceHub CSP

          Added the following nodes and settings:

          -
            -
          • InBoxApps/SkypeForBusiness
          • -
          • InBoxApps/SkypeForBusiness/DomainName
          • -
          • InBoxApps/Connect
          • -
          • InBoxApps/Connect/AutoLaunch
          • -
          • Properties/DefaultVolume
          • -
          • Properties/ScreenTimeout
          • -
          • Properties/SessionTimeout
          • -
          • Properties/SleepTimeout
          • -
          • Properties/AllowSessionResume
          • -
          • Properties/AllowAutoProxyAuth
          • -
          • Properties/DisableSigninSuggestions
          • -
          • Properties/DoNotShowMyMeetingsAndFiles
          • -
          -
          NetworkQoSPolicy CSP

          Added new CSP.

          WindowsLicensing CSP

          Added the following setting:

          -
            -
          • ChangeProductKey
          • -
          -
          WindowsAdvancedThreatProtection CSP

          Added the following setting:

          -
            -
          • Configuration/TelemetryReportingFrequency
          • -
          -
          DMSessionActions CSP

          Added new CSP.

          -
          SharedPC CSP

          Added new settings in Windows 10, version 1703.

          -
            -
          • RestrictLocalStorage
          • -
          • KioskModeAUMID
          • -
          • KioskModeUserTileDisplayText
          • -
          • InactiveThreshold
          • -
          • MaxPageFileSizeMB
          • -
          -

          The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300.

          -
          RemoteLock CSP

          Added following setting:

          -
            -
          • LockAndRecoverPIN
          • -
          -
          NodeCache CSP

          Added following settings:

          -
            -
          • ChangedNodesData
          • -
          • AutoSetExpectedValue
          • -
          -
          Download all the DDF files for Windows 10, version 1703

          Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.

          -
          RemoteWipe CSP

          Added new setting in Windows 10, version 1703.

          -
            -
          • doWipeProtected
          • -
          -
          MDM Bridge WMI Provider

          Added new classes and properties.

          -
          Understanding ADMX-backed policies

          Added a section describing SyncML examples of various ADMX elements.

          -
          Win32 and Desktop Bridge app policy configurationNew topic.
          Deploy and configure App-V apps using MDM

          Added a new topic describing how to deploy and configure App-V apps using MDM.

          -
          EnterpriseDesktopAppManagement CSP

          Added new setting in the March service release of Windows 10, version 1607.

          -
            -
          • MSI/UpgradeCode/[Guid]
          • -
          -
          Reporting CSP

          Added new settings in Windows 10, version 1703.

          -
            -
          • EnterpriseDataProtection/RetrieveByTimeRange/Type
          • -
          • EnterpriseDataProtection/RetrieveByCount/Type
          • -
          -
          Connecting your Windows 10-based device to work using a deep link

          Added following deep link parameters to the table:

          -
            -
          • Username
          • -
          • Servername
          • -
          • Accesstoken
          • -
          • Deviceidentifier
          • -
          • Tenantidentifier
          • -
          • Ownership
          • -
          -
          MDM support for Windows 10 S

          Updated the following topics to indicate MDM support in Windows 10 S.

          - -
          TPMPolicy CSPNew CSP added in Windows 10, version 1703.
            - +| New or updated article | Description | +|-----|-----| +| [Update CSP](update-csp.md) | Added the following nodes:
          - FailedUpdates/_Failed Update Guid_/RevisionNumber
          - InstalledUpdates/_Installed Update Guid_/RevisionNumber
          - PendingRebootUpdates/_Pending Reboot Update Guid_/RevisionNumber | +| [CM_CellularEntries CSP](cm-cellularentries-csp.md) | To PurposeGroups setting, added the following values:
          - Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
          - Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364 | +| [CertificateStore CSP](certificatestore-csp.md) | Added the following setting:
          - My/WSTEP/Renew/RetryAfterExpiryInterval | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | Added the following setting:
          - SCEP/UniqueID/Install/AADKeyIdentifierList | +| [DMAcc CSP](dmacc-csp.md) | Added the following setting:
          - AccountUID/EXT/Microsoft/InitiateSession | +| [DMClient CSP](dmclient-csp.md) | Added the following nodes and settings:
          - HWDevID
          - Provider/ProviderID/ManagementServerToUpgradeTo
          - Provider/ProviderID/CustomEnrollmentCompletePage
          - Provider/ProviderID/CustomEnrollmentCompletePage/Title
          - Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
          - Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
          - Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText | +| [CellularSettings CSP](cellularsettings-csp.md)
          [CM_CellularEntries CSP](cm-cellularentries-csp.md)
          [EnterpriseAPN CSP](enterpriseapn-csp.md) | For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions. | +| [SecureAssessment CSP](secureassessment-csp.md) | Added the following settings:
          - AllowTextSuggestions
          - RequirePrinting | +| [EnterpriseAPN CSP](enterpriseapn-csp.md) | Added the following setting:
          - Roaming | +| [Messaging CSP](messaging-csp.md) | Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies:
          - Accounts/AllowMicrosoftAccountSignInAssistant
          - ApplicationDefaults/DefaultAssociationsConfiguration
          - Browser/AllowAddressBarDropdown
          - Browser/AllowFlashClickToRun
          - Browser/AllowMicrosoftCompatibilityList
          - Browser/AllowSearchEngineCustomization
          - Browser/ClearBrowsingDataOnExit
          - Browser/ConfigureAdditionalSearchEngines
          - Browser/DisableLockdownOfStartPages
          - Browser/PreventFirstRunPage
          - Browser/PreventLiveTileDataCollection
          - Browser/SetDefaultSearchEngine
          - Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
          - Connectivity/AllowConnectedDevices
          - DeliveryOptimization/DOAllowVPNPeerCaching
          - DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
          - DeliveryOptimization/DOMinDiskSizeAllowedToPeer
          - DeliveryOptimization/DOMinFileSizeToCache
          - DeliveryOptimization/DOMinRAMAllowedToPeer
          - DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
          - Display/TurnOffGdiDPIScalingForApps
          - Display/TurnOnGdiDPIScalingForApps
          - EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
          - EnterpriseCloudPrint/CloudPrintOAuthAuthority
          - EnterpriseCloudPrint/CloudPrintOAuthClientId
          - EnterpriseCloudPrint/CloudPrintResourceId
          - EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
          - EnterpriseCloudPrint/MopriaDiscoveryResourceId
          - Experience/AllowFindMyDevice
          - Experience/AllowTailoredExperiencesWithDiagnosticData
          - Experience/AllowWindowsSpotlightOnActionCenter
          - Experience/AllowWindowsSpotlightWindowsWelcomeExperience
          - Location/EnableLocation
          - Messaging/AllowMMS
          - Messaging/AllowRCS
          - Privacy/LetAppsAccessTasks
          - Privacy/LetAppsAccessTasks_ForceAllowTheseApps
          - Privacy/LetAppsAccessTasks_ForceDenyTheseApps
          - Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
          - Privacy/LetAppsGetDiagnosticInfo
          - Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
          - Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
          - Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
          - Privacy/LetAppsRunInBackground
          - Privacy/LetAppsRunInBackground_ForceAllowTheseApps
          - Privacy/LetAppsRunInBackground_ForceDenyTheseApps
          - Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
          - Settings/ConfigureTaskbarCalendar
          - Settings/PageVisibilityList
          - SmartScreen/EnableAppInstallControl
          - SmartScreen/EnableSmartScreenInShell
          - SmartScreen/PreventOverrideForFilesInShell
          - Start/AllowPinnedFolderDocuments
          - Start/AllowPinnedFolderDownloads
          - Start/AllowPinnedFolderFileExplorer
          - Start/AllowPinnedFolderHomeGroup
          - Start/AllowPinnedFolderMusic
          - Start/AllowPinnedFolderNetwork
          - Start/AllowPinnedFolderPersonalFolder
          - Start/AllowPinnedFolderPictures
          - Start/AllowPinnedFolderSettings
          - Start/AllowPinnedFolderVideos
          - Start/HideAppList
          - Start/HideChangeAccountSettings
          - Start/HideFrequentlyUsedApps
          - Start/HideHibernate
          - Start/HideLock
          - Start/HidePowerButton
          - Start/HideRecentJumplists
          - Start/HideRecentlyAddedApps
          - Start/HideRestart
          - Start/HideShutDown
          - Start/HideSignOut
          - Start/HideSleep
          - Start/HideSwitchAccount
          - Start/HideUserTile
          - Start/ImportEdgeAssets
          - Start/NoPinningToTaskbar
          - System/AllowFontProviders
          - System/DisableOneDriveFileSync
          - TextInput/AllowKeyboardTextSuggestions
          - TimeLanguageSettings/AllowSet24HourClock
          - Update/ActiveHoursMaxRange
          - Update/AutoRestartDeadlinePeriodInDays
          - Update/AutoRestartNotificationSchedule
          - Update/AutoRestartRequiredNotificationDismissal
          - Update/DetectionFrequency
          - Update/EngagedRestartDeadline
          - Update/EngagedRestartSnoozeSchedule
          - Update/EngagedRestartTransitionSchedule
          - Update/IgnoreMOAppDownloadLimit
          - Update/IgnoreMOUpdateDownloadLimit
          - Update/PauseFeatureUpdatesStartTime
          - Update/PauseQualityUpdatesStartTime
          - Update/SetAutoRestartNotificationDisable
          - Update/SetEDURestart
          - WiFi/AllowWiFiDirect
          - WindowsLogon/HideFastUserSwitching
          - WirelessDisplay/AllowProjectionFromPC
          - WirelessDisplay/AllowProjectionFromPCOverInfrastructure
          - WirelessDisplay/AllowProjectionToPCOverInfrastructure
          - WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
          Removed TextInput/AllowLinguisticDataCollection
          Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise
          Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.
          Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.
          Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.
          Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files. | +| [DevDetail CSP](devdetail-csp.md) | Added the following setting:
          - DeviceHardwareData | +| [CleanPC CSP](cleanpc-csp.md) | Added the new CSP. | +| [DeveloperSetup CSP](developersetup-csp.md) | Added the new CSP. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the new CSP. | +| [BitLocker CSP](bitlocker-csp.md) | Added the new CSP.

          Added the following setting:
          - AllowWarningForOtherDiskEncryption | +| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.
          Added the following settings:
          - RevokeOnMDMHandoff
          - SMBAutoEncryptedFileExtensions | +| [DynamicManagement CSP](dynamicmanagement-csp.md) | Added the new CSP. | +| [Implement server-side support for mobile application management on Windows](https://docs.microsoft.com/windows/client-management/mdm/implement-server-side-mobile-application-management) | New mobile application management (MAM) support added in Windows 10, version 1703. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new node and settings:
          - _TenantId_/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
          - _TenantId_/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
          - _TenantId_/Policies/EnablePinRecovery | +| [Office CSP](office-csp.md) | Added the new CSP. | +| [Personalization CSP](personalization-csp.md) | Added the new CSP. | +| [EnterpriseAppVManagement CSP](enterpriseappvmanagement-csp.md) | Added the new CSP. | +| [HealthAttestation CSP](healthattestation-csp.md) | Added the following settings:
          - HASEndpoint - added in Windows 10, version 1607, but not documented
          - TpmReadyStatus - added in the March service release of Windows 10, version 1607 | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following nodes and settings:
          - InBoxApps/SkypeForBusiness
          - InBoxApps/SkypeForBusiness/DomainName
          - InBoxApps/Connect
          - InBoxApps/Connect/AutoLaunch
          - Properties/DefaultVolume
          - Properties/ScreenTimeout
          - Properties/SessionTimeout
          - Properties/SleepTimeout
          - Properties/AllowSessionResume
          - Properties/AllowAutoProxyAuth
          - Properties/DisableSigninSuggestions
          - Properties/DoNotShowMyMeetingsAndFiles | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | Added the new CSP. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added the following setting:
          - ChangeProductKey | +| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | Added the following setting:
          - Configuration/TelemetryReportingFrequency | +| [DMSessionActions CSP](dmsessionactions-csp.md) | Added the new CSP. | +| [SharedPC CSP](dmsessionactions-csp.md) | Added new settings in Windows 10, version 1703:
          - RestrictLocalStorage
          - KioskModeAUMID
          - KioskModeUserTileDisplayText
          - InactiveThreshold
          - MaxPageFileSizeMB
          The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300. | +| [RemoteLock CSP](remotelock-csp.md) | Added following setting:
          - LockAndRecoverPIN | +| [NodeCache CSP](nodecache-csp.md) | Added following settings:
          - ChangedNodesData
          - AutoSetExpectedValue | +| [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) | Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF articles of various CSPs. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new setting in Windows 10, version 1703:
          - doWipeProtected | +| [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) | Added new classes and properties. | +| [Understanding ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies) | Added a section describing SyncML examples of various ADMX elements. | +| [Win32 and Desktop Bridge app policy configuration](https://docs.microsoft.com/windows/client-management/mdm/win32-and-centennial-app-policy-configuration) | New article. | +| [Deploy and configure App-V apps using MDM](https://docs.microsoft.com/windows/client-management/mdm/appv-deploy-and-config) | Added a new article describing how to deploy and configure App-V apps using MDM. | +| [EnterpriseDesktopAppManagement CSP](enterprisedesktopappmanagement-csp.md) | Added new setting in the March service release of Windows 10, version 1607.
          - MSI/UpgradeCode/[Guid] | +| [Reporting CSP](reporting-csp.md) | Added new settings in Windows 10, version 1703.
          - EnterpriseDataProtection/RetrieveByTimeRange/Type
          - EnterpriseDataProtection/RetrieveByCount/Type | +| [Connect your Windows 10-based device to work using a deep link](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#connect-your-windows-10-based-device-to-work-using-a-deep-link) | Added following deep link parameters to the table:
          - Username
          - Servername
          - Accesstoken
          - Deviceidentifier
          - Tenantidentifier
          - Ownership | +| MDM support for Windows 10 S | Updated the following articles to indicate MDM support in Windows 10 S.
          - [Configuration service provider reference](configuration-service-provider-reference.md)
          - [Policy CSP](policy-configuration-service-provider.md) | +| [TPMPolicy CSP](tpmpolicy-csp.md) | Added the new CSP. | ## What’s new in MDM for Windows 10, version 1607 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ItemDescription

          Sideloading of apps

          Starting in Windows 10, version 1607, sideloading of apps is only allowed through EnterpriseModernAppManagement CSP. Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices.

          New value for NodeCache CSP

          In NodeCache CSP, the value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache.

          EnterpriseDataProtection CSP

          New CSP.

          Policy CSP

          Removed the following policies:

          -
            -
          • DataProtection/AllowAzureRMSForEDP - moved this policy to EnterpriseDataProtection CSP
          • -
          • DataProtection/AllowUserDecryption - moved this policy to EnterpriseDataProtection CSP
          • -
          • DataProtection/EDPEnforcementLevel - moved this policy to EnterpriseDataProtection CSP
          • -
          • DataProtection/RequireProtectionUnderLockConfig - moved this policy to EnterpriseDataProtection CSP
          • -
          • DataProtection/RevokeOnUnenroll - moved this policy to EnterpriseDataProtection CSP
          • -
          • DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
          • -
          • DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
          • -
          • DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
          • -
          • DataProtection/EnterpriseNetworkDomainNames - moved this policy to NetworkIsolation policy
          • -
          • DataProtection/EnterpriseProxyServers - moved this policy to NetworkIsolation policy
          • -
          • Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices - this policy has been deprecated.
          • -
          -

          Added the WiFi/AllowManualWiFiConfiguration and WiFi/AllowWiFi policies for Windows 10, version 1607:

          -
            -
          • Windows 10 Pro
          • -
          • Windows 10 Enterprise
          • -
          • Windows 10 Education
          • -
          -

          Added the following new policies:

          -
            -
          • AboveLock/AllowCortanaAboveLock
          • -
          • ApplicationManagement/DisableStoreOriginatedApps
          • -
          • Authentication/AllowSecondaryAuthenticationDevice
          • -
          • Bluetooth/AllowPrepairing
          • -
          • Browser/AllowExtensions
          • -
          • Browser/PreventAccessToAboutFlagsInMicrosoftEdge
          • -
          • Browser/ShowMessageWhenOpeningSitesInInternetExplorer
          • -
          • DeliveryOptimization/DOAbsoluteMaxCacheSize
          • -
          • DeliveryOptimization/DOMaxDownloadBandwidth
          • -
          • DeliveryOptimization/DOMinBackgroundQoS
          • -
          • DeliveryOptimization/DOModifyCacheDrive
          • -
          • DeliveryOptimization/DOMonthlyUploadDataCap
          • -
          • DeliveryOptimization/DOPercentageMaxDownloadBandwidth
          • -
          • DeviceLock/EnforceLockScreenAndLogonImage
          • -
          • DeviceLock/EnforceLockScreenProvider
          • -
          • Defender/PUAProtection
          • -
          • Experience/AllowThirdPartySuggestionsInWindowsSpotlight
          • -
          • Experience/AllowWindowsSpotlight
          • -
          • Experience/ConfigureWindowsSpotlightOnLockScreen
          • -
          • Experience/DoNotShowFeedbackNotifications
          • -
          • Licensing/AllowWindowsEntitlementActivation
          • -
          • Licensing/DisallowKMSClientOnlineAVSValidation
          • -
          • LockDown/AllowEdgeSwipe
          • -
          • Maps/EnableOfflineMapsAutoUpdate
          • -
          • Maps/AllowOfflineMapsDownloadOverMeteredConnection
          • -
          • Messaging/AllowMessageSync
          • -
          • NetworkIsolation/EnterpriseCloudResources
          • -
          • NetworkIsolation/EnterpriseInternalProxyServers
          • -
          • NetworkIsolation/EnterpriseIPRange
          • -
          • NetworkIsolation/EnterpriseIPRangesAreAuthoritative
          • -
          • NetworkIsolation/EnterpriseNetworkDomainNames
          • -
          • NetworkIsolation/EnterpriseProxyServers
          • -
          • NetworkIsolation/EnterpriseProxyServersAreAuthoritative
          • -
          • NetworkIsolation/NeutralResources
          • -
          • Notifications/DisallowNotificationMirroring
          • -
          • Privacy/DisableAdvertisingId
          • -
          • Privacy/LetAppsAccessAccountInfo
          • -
          • Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessCalendar
          • -
          • Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessCallHistory
          • -
          • Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessCamera
          • -
          • Privacy/LetAppsAccessCamera_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessCamera_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessContacts
          • -
          • Privacy/LetAppsAccessContacts_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessContacts_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessEmail
          • -
          • Privacy/LetAppsAccessEmail_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessEmail_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessLocation
          • -
          • Privacy/LetAppsAccessLocation_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessLocation_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessMessaging
          • -
          • Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessMicrophone
          • -
          • Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessMotion
          • -
          • Privacy/LetAppsAccessMotion_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessMotion_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessNotifications
          • -
          • Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessPhone
          • -
          • Privacy/LetAppsAccessPhone_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessPhone_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessRadios
          • -
          • Privacy/LetAppsAccessRadios_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessRadios_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsAccessTrustedDevices
          • -
          • Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
          • -
          • Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
          • -
          • Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
          • -
          • Privacy/LetAppsSyncWithDevices
          • -
          • Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
          • -
          • Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
          • -
          • Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
          • -
          • Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
          • -
          • Settings/AllowEditDeviceName
          • -
          • Speech/AllowSpeechModelUpdate
          • -
          • System/TelemetryProxy
          • -
          • Update/ActiveHoursStart
          • -
          • Update/ActiveHoursEnd
          • -
          • Update/AllowMUUpdateService
          • -
          • Update/BranchReadinessLevel
          • -
          • Update/DeferFeatureUpdatesPeriodInDays
          • -
          • Update/DeferQualityUpdatesPeriodInDays
          • -
          • Update/ExcludeWUDriversInQualityUpdate
          • -
          • Update/PauseFeatureUpdates
          • -
          • Update/PauseQualityUpdates
          • -
          • Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
          • -
          • WindowsInkWorkspace/AllowWindowsInkWorkspace
          • -
          • WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
          • -
          • WirelessDisplay/AllowProjectionToPC
          • -
          • WirelessDisplay/RequirePinForPairing
          • -
          -

          Updated the Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts description to remove outdated information.

          -

          Updated DeliveryOptimization/DODownloadMode to add new values.

          -

          Updated Experience/AllowCortana description to clarify what each supported value does.

          -

          Updated Security/AntiTheftMode description to clarify what each supported value does.

          DMClient CSP

          Added the following settings:

          -
            -
          • ManagementServerAddressList
          • -
          • AADDeviceID
          • -
          • EnrollmentType
          • -
          • HWDevID
          • -
          • CommercialID
          • -
          -

          Removed the EnrollmentID setting.

          DeviceManageability CSP

          New CSP.

          DeviceStatus CSP

          Added the following new settings:

          -
            -
          • DeviceStatus/TPM/SpecificationVersion
          • -
          • DeviceStatus/OS/Edition
          • -
          • DeviceStatus/Antivirus/SignatureStatus
          • -
          • DeviceStatus/Antivirus/Status
          • -
          • DeviceStatus/Antispyware/SignatureStatus
          • -
          • DeviceStatus/Antispyware/Status
          • -
          • DeviceStatus/Firewall/Status
          • -
          • DeviceStatus/UAC/Status
          • -
          • DeviceStatus/Battery/Status
          • -
          • DeviceStatus/Battery/EstimatedChargeRemaining
          • -
          • DeviceStatus/Battery/EstimatedRuntime
          • -
          AssignedAccess CSP

          Added SyncML examples.

          EnterpriseAssignedAccess CSP
            -
          • Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
          • -
          • Updated the DDF and XSD file sections.
          • -
          SecureAssessment CSP

          New CSP for Windows 10, version 1607

          DiagnosticLog CSP -

          DiagnosticLog DDF

          Added version 1.3 of the CSP with two new settings. Added the new 1.3 version of the DDF. Added the following new settings in Windows 10, version 1607.

          -
            -
          • DeviceStateData
          • -
          • DeviceStateData/MdmConfiguration
          • -
          Reboot CSP

          New CSP for Windows 10, version 1607

          CMPolicyEnterprise CSP

          New CSP for Windows 10, version 1607

          VPNv2 CSP

          Added the following settings for Windows 10, version 1607

          -
            -
          • ProfileName/RouteList/routeRowId/ExclusionRoute
          • -
          • ProfileName/DomainNameInformationList/dniRowId/AutoTrigger
          • -
          • ProfileName/DomainNameInformationList/dniRowId/Persistent
          • -
          • ProfileName/ProfileXML
          • -
          • ProfileName/DeviceCompliance/Enabled
          • -
          • ProfileName/DeviceCompliance/Sso
          • -
          • ProfileName/DeviceCompliance/Sso/Enabled
          • -
          • ProfileName/DeviceCompliance/Sso/IssuerHash
          • -
          • ProfileName/DeviceCompliance/Sso/Eku
          • -
          • ProfileName/NativeProfile/CryptographySuite
          • -
          • ProfileName/NativeProfile/CryptographySuite/AuthenticationTransformConstants
          • -
          • ProfileName/NativeProfile/CryptographySuite/CipherTransformConstants
          • -
          • ProfileName/NativeProfile/CryptographySuite/EncryptionMethod
          • -
          • ProfileName/NativeProfile/CryptographySuite/IntegrityCheckMethod
          • -
          • ProfileName/NativeProfile/CryptographySuite/DHGroup
          • -
          • ProfileName/NativeProfile/CryptographySuite/PfsGroup
          • -
          • ProfileName/NativeProfile/L2tpPsk
          • -
          Win32AppInventory CSP -

          Win32AppInventory DDF

          New CSP for Windows 10, version 1607.

          SharedPC CSP

          New CSP for Windows 10, version 1607.

          WindowsAdvancedThreatProtection CSP

          New CSP for Windows 10, version 1607.

          MDM Bridge WMI Provider

          Added new classes for Windows 10, version 1607.

          MDM enrollment of Windows devices

          Topic renamed from "Enrollment UI".

          -

          Completely updated enrollment procedures and screenshots.

          UnifiedWriteFilter CSP -

          UnifiedWriteFilter DDF File

          Added the following new setting for Windows 10, version 1607:

          -
            -
          • NextSession/HORMEnabled
          • -
          CertificateStore CSP -

          CertificateStore DDF file

          Added the following new settings in Windows 10, version 1607:

          -
            -
          • My/WSTEP/Renew/LastRenewalAttemptTime
          • -
          • My/WSTEP/Renew/RenewNow
          • -

          WindowsLicensing CSP

          Added the following new node and settings in Windows 10, version 1607, but not documented:

          -
            -
          • Subscriptions
          • -
          • Subscriptions/SubscriptionId
          • -
          • Subscriptions/SubscriptionId/Status
          • -
          • Subscriptions/SubscriptionId/Name
          • -
          -

          WiFi CSP

          Deprecated the following node in Windows 10, version 1607:

          -
            -
          • DisableInternetConnectivityChecks
          • -
          -
          +| New or updated article | Description | +|-----|-----| +| Sideloading of apps | Starting in Windows 10, version 1607, sideloading of apps is only allowed through [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md). Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices. | +| [NodeCache CSP](nodecache-csp.md) | The value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache. | +| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | New CSP. | +| [Policy CSP](policy-configuration-service-provider.md) | Removed the following policies:
          - DataProtection/AllowAzureRMSForEDP - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
          - DataProtection/AllowUserDecryption - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
          - DataProtection/EDPEnforcementLevel - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
          - DataProtection/RequireProtectionUnderLockConfig - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
          - DataProtection/RevokeOnUnenroll - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
          - DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
          - DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
          - DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
          - DataProtection/EnterpriseNetworkDomainNames - moved this policy to NetworkIsolation policy
          - DataProtection/EnterpriseProxyServers - moved this policy to NetworkIsolation policy
          - Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices - this policy has been deprecated.

          Added the WiFi/AllowManualWiFiConfiguration and WiFi/AllowWiFi policies for Windows 10, version 1607:
          - Windows 10 Pro
          - Windows 10 Enterprise
          - Windows 10 Education

          Added the following new policies:
          - AboveLock/AllowCortanaAboveLock
          - ApplicationManagement/DisableStoreOriginatedApps
          - Authentication/AllowSecondaryAuthenticationDevice
          - Bluetooth/AllowPrepairing
          - Browser/AllowExtensions
          - Browser/PreventAccessToAboutFlagsInMicrosoftEdge
          - Browser/ShowMessageWhenOpeningSitesInInternetExplorer
          - DeliveryOptimization/DOAbsoluteMaxCacheSize
          - DeliveryOptimization/DOMaxDownloadBandwidth
          - DeliveryOptimization/DOMinBackgroundQoS
          - DeliveryOptimization/DOModifyCacheDrive
          - DeliveryOptimization/DOMonthlyUploadDataCap
          - DeliveryOptimization/DOPercentageMaxDownloadBandwidth
          - DeviceLock/EnforceLockScreenAndLogonImage
          - DeviceLock/EnforceLockScreenProvider
          - Defender/PUAProtection
          - Experience/AllowThirdPartySuggestionsInWindowsSpotlight
          - Experience/AllowWindowsSpotlight
          - Experience/ConfigureWindowsSpotlightOnLockScreen
          - Experience/DoNotShowFeedbackNotifications
          - Licensing/AllowWindowsEntitlementActivation
          - Licensing/DisallowKMSClientOnlineAVSValidation
          - LockDown/AllowEdgeSwipe
          - Maps/EnableOfflineMapsAutoUpdate
          - Maps/AllowOfflineMapsDownloadOverMeteredConnection
          - Messaging/AllowMessageSync
          - NetworkIsolation/EnterpriseCloudResources
          - NetworkIsolation/EnterpriseInternalProxyServers
          - NetworkIsolation/EnterpriseIPRange
          - NetworkIsolation/EnterpriseIPRangesAreAuthoritative
          - NetworkIsolation/EnterpriseNetworkDomainNames
          - NetworkIsolation/EnterpriseProxyServers
          - NetworkIsolation/EnterpriseProxyServersAreAuthoritative
          - NetworkIsolation/NeutralResources
          - Notifications/DisallowNotificationMirroring
          - Privacy/DisableAdvertisingId
          - Privacy/LetAppsAccessAccountInfo
          - Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
          - Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
          - Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
          - Privacy/LetAppsAccessCalendar
          - Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
          - Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
          - Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
          - Privacy/LetAppsAccessCallHistory
          - Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
          - Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
          - Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
          - Privacy/LetAppsAccessCamera
          - Privacy/LetAppsAccessCamera_ForceAllowTheseApps
          - Privacy/LetAppsAccessCamera_ForceDenyTheseApps
          - Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
          - Privacy/LetAppsAccessContacts
          - Privacy/LetAppsAccessContacts_ForceAllowTheseApps
          - Privacy/LetAppsAccessContacts_ForceDenyTheseApps
          - Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
          - Privacy/LetAppsAccessEmail
          - Privacy/LetAppsAccessEmail_ForceAllowTheseApps
          - Privacy/LetAppsAccessEmail_ForceDenyTheseApps
          - Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
          - Privacy/LetAppsAccessLocation
          - Privacy/LetAppsAccessLocation_ForceAllowTheseApps
          - Privacy/LetAppsAccessLocation_ForceDenyTheseApps
          - Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
          - Privacy/LetAppsAccessMessaging
          - Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
          - Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
          - Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
          - Privacy/LetAppsAccessMicrophone
          - Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
          - Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
          - Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
          - Privacy/LetAppsAccessMotion
          - Privacy/LetAppsAccessMotion_ForceAllowTheseApps
          - Privacy/LetAppsAccessMotion_ForceDenyTheseApps
          - Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
          - Privacy/LetAppsAccessNotifications
          - Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
          - Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
          - Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
          - Privacy/LetAppsAccessPhone
          - Privacy/LetAppsAccessPhone_ForceAllowTheseApps
          - Privacy/LetAppsAccessPhone_ForceDenyTheseApps
          - Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
          - Privacy/LetAppsAccessRadios
          - Privacy/LetAppsAccessRadios_ForceAllowTheseApps
          - Privacy/LetAppsAccessRadios_ForceDenyTheseApps
          - Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
          - Privacy/LetAppsAccessTrustedDevices
          - Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
          - Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
          - Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
          - Privacy/LetAppsSyncWithDevices
          - Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
          - Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
          - Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
          - Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
          - Settings/AllowEditDeviceName
          - Speech/AllowSpeechModelUpdate
          - System/TelemetryProxy
          - Update/ActiveHoursStart
          - Update/ActiveHoursEnd
          - Update/AllowMUUpdateService
          - Update/BranchReadinessLevel
          - Update/DeferFeatureUpdatesPeriodInDays
          - Update/DeferQualityUpdatesPeriodInDays
          - Update/ExcludeWUDriversInQualityUpdate
          - Update/PauseFeatureUpdates
          - Update/PauseQualityUpdates
          - Update/SetProxyBehaviorForUpdateDetection
          - Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
          - WindowsInkWorkspace/AllowWindowsInkWorkspace
          - WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
          - WirelessDisplay/AllowProjectionToPC
          - WirelessDisplay/RequirePinForPairing

          Updated the Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts description to remove outdated information.

          Updated DeliveryOptimization/DODownloadMode to add new values.

          Updated Experience/AllowCortana description to clarify what each supported value does.

          Updated Security/AntiTheftMode description to clarify what each supported value does. | +| [DMClient CSP](dmclient-csp.md) | Added the following settings:
          - ManagementServerAddressList
          - AADDeviceID
          - EnrollmentType
          - HWDevID
          - CommercialID

          Removed the EnrollmentID setting. | +| [DeviceManageability CSP](devicemanageability-csp.md) | New CSP. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following new settings:
          - DeviceStatus/TPM/SpecificationVersion
          - DeviceStatus/OS/Edition
          - DeviceStatus/Antivirus/SignatureStatus
          - DeviceStatus/Antivirus/Status
          - DeviceStatus/Antispyware/SignatureStatus
          - DeviceStatus/Antispyware/Status
          - DeviceStatus/Firewall/Status
          - DeviceStatus/UAC/Status
          - DeviceStatus/Battery/Status
          - DeviceStatus/Battery/EstimatedChargeRemaining
          - DeviceStatus/Battery/EstimatedRuntime | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added SyncML examples. | +| [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md) | Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
          Updated the DDF and XSD file sections. | +| [SecureAssessment CSP](secureassessment-csp.md) | New CSP. | +| [DiagnosticLog CSP](diagnosticlog-csp.md)
          [DiagnosticLog DDF](diagnosticlog-ddf.md) | Added version 1.3 of the CSP with two new settings.

          Added the new 1.3 version of the DDF.

          Added the following new settings in Windows 10, version 1607
          - DeviceStateData
          - DeviceStateData/MdmConfiguration | +| [Reboot CSP](reboot-csp.md) | New CSP. | +| [CMPolicyEnterprise CSP](cmpolicyenterprise-csp.md) | New CSP. | +| [VPNv2 CSP](vpnv2-csp.md) | Added the following settings for Windows 10, version 1607:
          - _ProfileName_/RouteList/routeRowId/ExclusionRoute
          - _ProfileName_/DomainNameInformationList/_dniRowId_/AutoTrigger
          - _ProfileName_/DomainNameInformationList/dniRowId/Persistent
          - _ProfileName_/ProfileXML
          - _ProfileName_/DeviceCompliance/Enabled
          - _ProfileName_/DeviceCompliance/Sso
          - _ProfileName_/DeviceCompliance/Sso/Enabled
          - _ProfileName_/DeviceCompliance/Sso/IssuerHash
          - _ProfileName_/DeviceCompliance/Sso/Eku
          - _ProfileName_/NativeProfile/CryptographySuite
          - _ProfileName_/NativeProfile/CryptographySuite/AuthenticationTransformConstants
          - _ProfileName_/NativeProfile/CryptographySuite/CipherTransformConstants
          - _ProfileName_/NativeProfile/CryptographySuite/EncryptionMethod
          - _ProfileName_/NativeProfile/CryptographySuite/IntegrityCheckMethod
          - _ProfileName_/NativeProfile/CryptographySuite/DHGroup
          - _ProfileName_/NativeProfile/CryptographySuite/PfsGroup
          - _ProfileName_/NativeProfile/L2tpPsk | +| [Win32AppInventory CSP](win32appinventory-csp.md) | New CSP. | +| [SharedPC CSP](sharedpc-csp.md) | New CSP. | +| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | New CSP. | +| [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) | Added new classes for Windows 10, version 1607. | +| [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md) | Article renamed from "Enrollment UI".

          Completely updated enrollment procedures and screenshots. | +| [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md)
          [UnifiedWriteFilter DDF File](unifiedwritefilter-ddf.md) | Added the following new setting for Windows 10, version 1607:
          - NextSession/HORMEnabled | +| [CertificateStore CSP](certificatestore-csp.md)
          [CertificateStore DDF file](certificatestore-ddf-file.md) | Added the following new settings in Windows 10, version 1607:
          - My/WSTEP/Renew/LastRenewalAttemptTime
          - My/WSTEP/Renew/RenewNow | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added the following new node and settings in Windows 10, version 1607, but not documented:
          - Subscriptions
          - Subscriptions/SubscriptionId
          - Subscriptions/SubscriptionId/Status
          - Subscriptions/SubscriptionId/Name | +| [WiFi CSP](wifi-csp.md) | Deprecated the following node in Windows 10, version 1607:
          - DisableInternetConnectivityChecks | ## What’s new in MDM for Windows 10, version 1511 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ItemDescription

          New configuration service providers added in Windows 10, version 1511

          New and updated policies in Policy CSP

          The following policies have been added to the Policy CSP:

          -
            -
          • ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
          • -
          • Bluetooth/ServicesAllowedList
          • -
          • DataProtection/AllowAzureRMSForEDP
          • -
          • DataProtection/RevokeOnUnenroll
          • -
          • DeviceLock/DevicePasswordExpiration
          • -
          • DeviceLock/DevicePasswordHistory
          • -
          • TextInput/AllowInputPanel
          • -
          • Update/PauseDeferrals
          • -
          • Update/RequireDeferUpdate
          • -
          • Update/RequireUpdateApproval
          • -
          -

          The following policies have been updated in the Policy CSP:

          -
            -
          • System/AllowLocation
          • -
          • Update/RequireDeferUpgrade
          • -
          -

          The following policies have been deprecated in the Policy CSP:

          -
            -
          • TextInput/AllowKoreanExtendedHanja
          • -
          • WiFi/AllowWiFiHotSpotReporting
          • -

          Management tool for the Micosoft Store for Business

          New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

          Custom header for generic alert

          The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format:

          -MDM-GenericAlert: <AlertType1><AlertType2> -

          If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this OMA website.

          Alert message for slow client response

          When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

          -

          To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the DMClient CSP.

          New node in DMClient CSP

          Added a new node EnableOmaDmKeepAliveMessage to the DMClient CSP and updated the ManagementServerAddress to indicate that it can contain a list of URLs.

          New nodes in EnterpriseModernAppManagement CSP

          Added the following nodes to the EnterpriseModernAppManagement CSP:

          -
            -
          • AppManagement/GetInventoryQuery
          • -
          • AppManagement/GetInventoryResults
          • -
          • .../PackageFamilyName/AppSettingPolicy/SettingValue
          • -
          • AppLicenses/StoreLicenses/LicenseID/LicenseCategory
          • -
          • AppLicenses/StoreLicenses/LicenseID/LicenseUsage
          • -
          • AppLicenses/StoreLicenses/LicenseID/RequesterID
          • -
          • AppLicenses/StoreLicenses/LicenseID/GetLicenseFromStore
          • -

          New nodes in EnterpriseExt CSP

          Added the following nodes to the EnterpriseExt CSP:

          -
            -
          • DeviceCustomData (CustomID, CustomeString)
          • -
          • Brightness (Default, MaxAuto)
          • -
          • LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount)
          • -

          New node in EnterpriseExtFileSystem CSP

          Added OemProfile node to EnterpriseExtFileSystem CSP.

          New nodes in PassportForWork CSP

          Added the following nodes to PassportForWork CSP:

          -
            -
          • TenantId/Policies/PINComplexity/History
          • -
          • TenantId/Policies/PINComplexity/Expiration
          • -
          • TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
          • -
          • Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
          • -
          • Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT)
          • -

          Updated EnterpriseAssignedAccess CSP

          Here are the changes to the EnterpriseAssignedAccess CSP:

          -
            -
          • In AssignedAccessXML node, added new page settings and quick action settings.
          • -
          • In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
          • -
          • Updated the EnterpriseAssignedAccess XSD topic.
          • -

          New nodes in the DevDetail CSP

          Here are the changes to the DevDetail CSP:

          -
            -
          • Added TotalStore and TotalRAM settings.
          • -
          • Added support for Replace command for the DeviceName setting.
          • -

          Handling large objects

          Added support for the client to handle uploading of large objects to the server.

          +| New or updated article | Description | +|-----|-----| +| New configuration service providers added in Windows 10, version 1511 | - [AllJoynManagement CSP](alljoynmanagement-csp.md)
          - [Maps CSP](maps-csp.md)
          - [Reporting CSP](reporting-csp.md)
          - [SurfaceHub CSP](surfacehub-csp.md)
          - [WindowsSecurityAuditing CSP](windowssecurityauditing-csp.md) | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings:
          - ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
          - Bluetooth/ServicesAllowedList
          - DataProtection/AllowAzureRMSForEDP
          - DataProtection/RevokeOnUnenroll
          - DeviceLock/DevicePasswordExpiration
          - DeviceLock/DevicePasswordHistory
          - TextInput/AllowInputPanel
          - Update/PauseDeferrals
          - Update/RequireDeferUpdate
          - Update/RequireUpdateApproval

          Updated the following policy settings:
          - System/AllowLocation
          - Update/RequireDeferUpgrade

          Deprecated the following policy settings:
          - TextInput/AllowKoreanExtendedHanja
          - WiFi/AllowWiFiHotSpotReporting | +| Management tool for the Microsoft Store for Business | New articles. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates. | +| Custom header for generic alert | The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format: `MDM-GenericAlert: `

          If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526). | +| Alert message for slow client response | When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

          To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the [DMClient CSP](dmclient-csp.md). | +| [DMClient CSP](dmclient-csp.md) | Added a new node EnableOmaDmKeepAliveMessage to the [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) and updated the ManagementServerAddress to indicate that it can contain a list of URLs. | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following new nodes:
          - AppManagement/GetInventoryQuery
          - AppManagement/GetInventoryResults
          - .../_PackageFamilyName_/AppSettingPolicy/_SettingValue_
          - AppLicenses/StoreLicenses/_LicenseID_/LicenseCategory
          - AppLicenses/StoreLicenses/_LicenseID_/LicenseUsage
          - AppLicenses/StoreLicenses/_LicenseID_/RequesterID
          - AppLicenses/StoreLicenses/_LicenseID_/GetLicenseFromStore | +| [EnterpriseExt CSP](enterpriseext-csp.md) | Added the following new nodes:
          - DeviceCustomData (CustomID, CustomeString)
          - Brightness (Default, MaxAuto)
          - LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount) | +| [EnterpriseExtFileSystem CSP](enterpriseextfilessystem-csp.md) | Added the OemProfile node. +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new nodes:
          - TenantId/Policies/PINComplexity/History
          - TenantId/Policies/PINComplexity/Expiration
          - TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
          - Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
          - Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT) | +| [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md) | The following updates are done to the [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md):
          - In AssignedAccessXML node, added new page settings and quick action settings.
          - In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
          - Updated the [EnterpriseAssignedAccess XSD](enterpriseassignedaccess-xsd.md) article. | +| [DevDetail CSP](devdetail-csp.md) | The following updates are done to [DevDetail CSP](devdetail-csp.md):
          - Added TotalStore and TotalRAM settings.
          - Added support for Replace command for the DeviceName setting. | +| Handling large objects | Added support for the client to handle uploading of large objects to the server. | ## Breaking changes and known issues @@ -1645,7 +261,7 @@ Currently in Windows 10, version 1511, when using the ClientCertificateInstall The software version information from **DevDetail/SwV** does not match the version in **Settings** under **System/About**. -### Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues +### Upgrading Windows Phone 8.1 devices with app allow-listing using ApplicationRestriction policy has issues - When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile using ApplicationRestrictions with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps. @@ -1715,8 +331,7 @@ The following list describes the prerequisites for a certificate to be used with The following XML sample explains the properties for the EAP TLS XML including certificate filtering. > [!NOTE] ->For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. - +> For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. ```xml @@ -1818,18 +433,17 @@ The following XML sample explains the properties for the EAP TLS XML including c ``` > [!NOTE] ->The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** - - +> The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** Alternatively you can use the following procedure to create an EAP Configuration XML. -1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) topic. +1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) article. 2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop down (this selects EAP TLS.) ![vpn selfhost properties window](images/certfiltering1.png) - > **Note**  For PEAP or TTLS, select the appropriate method and continue following this procedure. + > [!NOTE] + > For PEAP or TTLS, select the appropriate method and continue following this procedure. 3. Click the **Properties** button underneath the drop down menu. 4. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. @@ -1840,10 +454,10 @@ Alternatively you can use the following procedure to create an EAP Configuration ![configure certificate selection window](images/certfiltering3.png) 6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. 7. Close the rasphone dialog box. -8. Continue following the procedure in the [EAP configuration](eap-configuration.md) topic from Step 9 to get an EAP TLS profile with appropriate filtering. +8. Continue following the procedure in the [EAP configuration](eap-configuration.md) article from Step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] ->You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](https://technet.microsoft.com/library/hh945104.aspx) topic. +> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](https://technet.microsoft.com/library/hh945104.aspx). ### Remote PIN reset not supported in Azure Active Directory joined mobile devices @@ -1869,7 +483,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Frequently Asked Questions -### **Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** +### **Can there be more than one MDM server to enroll and manage devices in Windows 10?** No. Only one MDM is allowed. ### **How do I set the maximum number of Azure Active Directory joined devices per user?** @@ -1887,1003 +501,9 @@ No. Only one MDM is allowed. Entry | Description --------------- | -------------------- What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operating system as a part of the windows management platform. It is used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | -What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. | -How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | +What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. This service does not send telemetry.| +How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. Disabling this will cause your management to fail.| -## Change history in MDM documentation +## Change history for MDM documentation -### August 2019 - -|New or updated topic | Description| -|--- | ---| -|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
          Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| - -### July 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
          Policies supported by HoloLens 2| -|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| -|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
          SecurityKey, SecurityKey/UseSecurityKeyForSignin| -|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
          LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| -|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
          Create a custom configuration service provider
          Design a custom configuration service provider
          IConfigServiceProvider2
          IConfigServiceProvider2::ConfigManagerNotification
          IConfigServiceProvider2::GetNode
          ICSPNode
          ICSPNode::Add
          ICSPNode::Clear
          ICSPNode::Copy
          ICSPNode::DeleteChild
          ICSPNode::DeleteProperty
          ICSPNode::Execute
          ICSPNode::GetChildNodeNames
          ICSPNode::GetProperty
          ICSPNode::GetPropertyIdentifiers
          ICSPNode::GetValue
          ICSPNode::Move
          ICSPNode::SetProperty
          ICSPNode::SetValue
          ICSPNodeTransactioning
          ICSPValidate
          Samples for writing a custom configuration service provider| - - -### June 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
          AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| -|[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
          ConfigureTimeZone.| - - -### May 2019 - -|New or updated topic | Description| -|--- | ---| -|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
          DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| -|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| -|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
          DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

          Updated description of the following policies:
          DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| -|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
          ShowLockOnUserTile.| -|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
          AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| -|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
          EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| -|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
          AllowFindMyFiles.| -|[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
          SvchostProcessMitigation.| -|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
          AllowCommercialDataPipeline, TurnOffFileHistory.| -|[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
          AllowRecommendations.| -|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
          AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| -|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
          AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

          Removed the following policy:
          SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| - -### April 2019 - -| New or updated topic | Description | -|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
          Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | -| [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | - -### March 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
          AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

          Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| - - -### February 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP](policy-configuration-service-provider.md)|Updated supported policies for Holographic.| - -### January 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Storage](policy-csp-storage.md)|Added the following new policies: AllowStorageSenseGlobal, ConfigStorageSenseGlobalCadence, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseRecycleBinCleanupThreshold, ConfigStorageSenseDownloadsCleanupThreshold, and ConfigStorageSenseCloudContentCleanupThreshold.| -|[SharedPC CSP](sharedpc-csp.md)|Updated values and supported operations.| -|[Mobile device management](index.md)|Updated information about MDM Security Baseline.| - -### December 2018 - -|New or updated topic | Description| -|--- | ---| -|[BitLocker CSP](bitlocker-csp.md)|Updated AllowWarningForOtherDiskEncryption policy description to describe silent and non-silent encryption scenarios, as well as where and how the recovery key is backed up for each scenario.| - -### September 2018 - -|New or updated topic | Description| -|--- | ---| -|[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| -|[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| - -### August 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          BitLocker CSP

          Added support for Windows 10 Pro starting in the version 1809.

          -
          Office CSP

          Added FinalStatus setting in Windows 10, version 1809.

          -
          RemoteWipe CSP

          Added new settings in Windows 10, version 1809.

          -
          TenantLockdown CSP

          Added new CSP in Windows 10, version 1809.

          -
          WindowsDefenderApplicationGuard CSP

          Added new settings in Windows 10, version 1809.

          -
          Policy DDF file

          Posted an updated version of the Policy DDF for Windows 10, version 1809.

          -
          Policy CSP

          Added the following new policies in Windows 10, version 1809:

          -
            -
          • Browser/AllowFullScreenMode
          • -
          • Browser/AllowPrelaunch
          • -
          • Browser/AllowPrinting
          • -
          • Browser/AllowSavingHistory
          • -
          • Browser/AllowSideloadingOfExtensions
          • -
          • Browser/AllowTabPreloading
          • -
          • Browser/AllowWebContentOnNewTabPage
          • -
          • Browser/ConfigureFavoritesBar
          • -
          • Browser/ConfigureHomeButton
          • -
          • Browser/ConfigureKioskMode
          • -
          • Browser/ConfigureKioskResetAfterIdleTimeout
          • -
          • Browser/ConfigureOpenMicrosoftEdgeWith
          • -
          • Browser/ConfigureTelemetryForMicrosoft365Analytics
          • -
          • Browser/PreventCertErrorOverrides
          • -
          • Browser/SetHomeButtonURL
          • -
          • Browser/SetNewTabPageURL
          • -
          • Browser/UnlockHomeButton
          • -
          • Experience/DoNotSyncBrowserSettings
          • -
          • Experience/PreventUsersFromTurningOnBrowserSyncing
          • -
          • Kerberos/UPNNameHints
          • -
          • Privacy/AllowCrossDeviceClipboard
          • -
          • Privacy/DisablePrivacyExperience
          • -
          • Privacy/UploadUserActivities
          • -
          • System/AllowDeviceNameInDiagnosticData
          • -
          • System/ConfigureMicrosoft365UploadEndpoint
          • -
          • System/DisableDeviceDelete
          • -
          • System/DisableDiagnosticDataViewer
          • -
          • Storage/RemovableDiskDenyWriteAccess
          • -
          • Update/UpdateNotificationLevel
          • -
          -

          Start/DisableContextMenus - added in Windows 10, version 1803.

          -

          RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

          -
          - -### July 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          AssignedAccess CSP

          Added the following note:

          -
            -
          • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
          • -
          -
          PassportForWork CSP

          Added new settings in Windows 10, version 1809.

          -
          EnterpriseModernAppManagement CSP

          Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

          -
          Win32CompatibilityAppraiser CSP

          Added new configuration service provider in Windows 10, version 1809.

          -
          WindowsLicensing CSP

          Added S mode settings and SyncML examples in Windows 10, version 1809.

          -
          SUPL CSP

          Added 3 new certificate nodes in Windows 10, version 1809.

          -
          Defender CSP

          Added a new node Health/ProductStatus in Windows 10, version 1809.

          -
          BitLocker CSP

          Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

          -
          DevDetail CSP

          Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

          -
          Policy CSP

          Added the following new policies in Windows 10, version 1809:

          -
            -
          • ApplicationManagement/LaunchAppAfterLogOn
          • -
          • ApplicationManagement/ScheduleForceRestartForUpdateFailures
          • -
          • Authentication/EnableFastFirstSignIn (Preview mode only)
          • -
          • Authentication/EnableWebSignIn (Preview mode only)
          • -
          • Authentication/PreferredAadTenantDomainName
          • -
          • Defender/CheckForSignaturesBeforeRunningScan
          • -
          • Defender/DisableCatchupFullScan
          • -
          • Defender/DisableCatchupQuickScan
          • -
          • Defender/EnableLowCPUPriority
          • -
          • Defender/SignatureUpdateFallbackOrder
          • -
          • Defender/SignatureUpdateFileSharesSources
          • -
          • DeviceGuard/ConfigureSystemGuardLaunch
          • -
          • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
          • -
          • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
          • -
          • DeviceInstallation/PreventDeviceMetadataFromNetwork
          • -
          • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
          • -
          • DmaGuard/DeviceEnumerationPolicy
          • -
          • Experience/AllowClipboardHistory
          • -
          • Security/RecoveryEnvironmentAuthentication
          • -
          • TaskManager/AllowEndTask
          • -
          • WindowsDefenderSecurityCenter/DisableClearTpmButton
          • -
          • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
          • -
          • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
          • -
          • WindowsLogon/DontDisplayNetworkSelectionUI
          • -
          -

          Recent changes:

          -
            -
          • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
          • -
          -
          - -### June 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Wifi CSP

          Added a new node WifiCost in Windows 10, version 1809.

          -
          Diagnose MDM failures in Windows 10

          Recent changes:

          -
            -
          • Added procedure for collecting logs remotely from Windows 10 Holographic.
          • -
          • Added procedure for downloading the MDM Diagnostic Information log.
          • -
          -
          Bitlocker CSP

          Added new node AllowStandardUserEncryption in Windows 10, version 1809.

          -
          Policy CSP

          Recent changes:

          -
            -
          • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
          • -
          • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
          • -
          • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
          • -
          • System/AllowFontProviders is not supported in Windows Holographic for Business.
          • -
          • Security/RequireDeviceEncryption is suported in the Home SKU.
          • -
          • Start/StartLayout - added a table of SKU support information.
          • -
          • Start/ImportEdgeAssets - added a table of SKU support information.
          • -
          -

          Added the following new policies in Windows 10, version 1809:

          -
            -
          • Update/EngagedRestartDeadlineForFeatureUpdates
          • -
          • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
          • -
          • Update/EngagedRestartTransitionScheduleForFeatureUpdates
          • -
          • Update/SetDisablePauseUXAccess
          • -
          • Update/SetDisableUXWUAccess
          • -
          -
          WiredNetwork CSPNew CSP added in Windows 10, version 1809. -
          - - -### May 2018 - - ---- - - - - - - - - - - - -
          New or updated topicDescription
          Policy DDF file

          Updated the DDF files in the Windows 10 version 1703 and 1709.

          - -
          - -### April 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          WindowsDefenderApplicationGuard CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • Settings/AllowVirtualGPU
          • -
          • Settings/SaveFilesToHost
          • -
          -
          NetworkProxy CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • ProxySettingsPerUser
          • -
          -
          Accounts CSP

          Added a new CSP in Windows 10, version 1803.

          -
          MDM Migration Analysis Too (MMAT)

          Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

          -
          CSP DDF files download

          Added the DDF download of Windows 10, version 1803 configuration service providers.

          -
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          -
            -
          • Bluetooth/AllowPromptedProximalConnections
          • -
          • KioskBrowser/EnableEndSessionButton
          • -
          • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
          • -
          • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
          • -
          • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
          • -
          -
          - -### March 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          eUICCs CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • IsEnabled
          • -
          -
          DeviceStatus CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • OS/Mode
          • -
          -
          Understanding ADMX-backed policies

          Added the following videos:

          - -
          AccountManagement CSP

          Added a new CSP in Windows 10, version 1803.

          -
          RootCATrustedCertificates CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • UntrustedCertificates
          • -
          -
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          -
            -
          • ApplicationDefaults/EnableAppUriHandlers
          • -
          • ApplicationManagement/MSIAllowUserControlOverInstall
          • -
          • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
          • -
          • Connectivity/AllowPhonePCLinking
          • -
          • Notifications/DisallowCloudNotification
          • -
          • Notifications/DisallowTileNotification
          • -
          • RestrictedGroups/ConfigureGroupMembership
          • -
          -

          The following existing policies were updated:

          -
            -
          • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
          • -
          • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
          • -
          • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
          • -
          -

          Added a new section:

          -
            -
          • Policies supported by GP - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.
          • -
          -
          Policy CSP - Bluetooth

          Added new section ServicesAllowedList usage guide.

          -
          MultiSIM CSP

          Added SyncML examples and updated the settings descriptions.

          -
          RemoteWipe CSP

          Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

          -
          - -### February 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          -
            -
          • Display/DisablePerProcessDpiForApps
          • -
          • Display/EnablePerProcessDpi
          • -
          • Display/EnablePerProcessDpiForApps
          • -
          • Experience/AllowWindowsSpotlightOnSettings
          • -
          • TextInput/ForceTouchKeyboardDockedState
          • -
          • TextInput/TouchKeyboardDictationButtonAvailability
          • -
          • TextInput/TouchKeyboardEmojiButtonAvailability
          • -
          • TextInput/TouchKeyboardFullModeAvailability
          • -
          • TextInput/TouchKeyboardHandwritingModeAvailability
          • -
          • TextInput/TouchKeyboardNarrowModeAvailability
          • -
          • TextInput/TouchKeyboardSplitModeAvailability
          • -
          • TextInput/TouchKeyboardWideModeAvailability
          • -
              -
          VPNv2 ProfileXML XSD

          Updated the XSD and Plug-in profile example for VPNv2 CSP.

          -
          AssignedAccess CSP

          Added the following nodes in Windows 10, version 1803:

          -
            -
          • Status
          • -
          • ShellLauncher
          • -
          • StatusConfiguration
          • -
          -

          Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

          -
          MultiSIM CSP

          Added a new CSP in Windows 10, version 1803.

          -
          EnterpriseModernAppManagement CSP

          Added the following node in Windows 10, version 1803:

          -
            -
          • MaintainProcessorArchitectureOnUpdate
          • -
          -
          - -### January 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Policy CSP

          Added the following new policies for Windows 10, version 1803:

          -
            -
          • Browser/AllowConfigurationUpdateForBooksLibrary
          • -
          • Browser/AlwaysEnableBooksLibrary
          • -
          • Browser/EnableExtendedBooksTelemetry
          • -
          • Browser/UseSharedFolderForBooks
          • -
          • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
          • -
          • DeliveryOptimization/DODelayForegroundDownloadFromHttp
          • -
          • DeliveryOptimization/DOGroupIdSource
          • -
          • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
          • -
          • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
          • -
          • DeliveryOptimization/DORestrictPeerSelectionBy
          • -
          • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
          • -
          • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
          • -
          • KioskBrowser/BlockedUrlExceptions
          • -
          • KioskBrowser/BlockedUrls
          • -
          • KioskBrowser/DefaultURL
          • -
          • KioskBrowser/EnableHomeButton
          • -
          • KioskBrowser/EnableNavigationButtons
          • -
          • KioskBrowser/RestartOnIdleTime
          • -
          • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
          • -
          • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
          • -
          • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
          • -
          • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
          • -
          • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
          • -
          • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
          • -
          • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
          • -
          • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
          • -
          • RestrictedGroups/ConfigureGroupMembership
          • -
          • Search/AllowCortanaInAAD
          • -
          • Search/DoNotUseWebResults
          • -
          • Security/ConfigureWindowsPasswords
          • -
          • System/FeedbackHubAlwaysSaveDiagnosticsLocally
          • -
          • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
          • -
          • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
          • -
          • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
          • -
          • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
          • -
          • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
          • -
          • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
          • -
          • TaskScheduler/EnableXboxGameSaveTask
          • -
          • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
          • -
          • Update/ConfigureFeatureUpdateUninstallPeriod
          • -
          • UserRights/AccessCredentialManagerAsTrustedCaller
          • -
          • UserRights/AccessFromNetwork
          • -
          • UserRights/ActAsPartOfTheOperatingSystem
          • -
          • UserRights/AllowLocalLogOn
          • -
          • UserRights/BackupFilesAndDirectories
          • -
          • UserRights/ChangeSystemTime
          • -
          • UserRights/CreateGlobalObjects
          • -
          • UserRights/CreatePageFile
          • -
          • UserRights/CreatePermanentSharedObjects
          • -
          • UserRights/CreateSymbolicLinks
          • -
          • UserRights/CreateToken
          • -
          • UserRights/DebugPrograms
          • -
          • UserRights/DenyAccessFromNetwork
          • -
          • UserRights/DenyLocalLogOn
          • -
          • UserRights/DenyRemoteDesktopServicesLogOn
          • -
          • UserRights/EnableDelegation
          • -
          • UserRights/GenerateSecurityAudits
          • -
          • UserRights/ImpersonateClient
          • -
          • UserRights/IncreaseSchedulingPriority
          • -
          • UserRights/LoadUnloadDeviceDrivers
          • -
          • UserRights/LockMemory
          • -
          • UserRights/ManageAuditingAndSecurityLog
          • -
          • UserRights/ManageVolume
          • -
          • UserRights/ModifyFirmwareEnvironment
          • -
          • UserRights/ModifyObjectLabel
          • -
          • UserRights/ProfileSingleProcess
          • -
          • UserRights/RemoteShutdown
          • -
          • UserRights/RestoreFilesAndDirectories
          • -
          • UserRights/TakeOwnership
          • -
          • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
          • -
          • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
          • -
          • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
          • -
          • WindowsDefenderSecurityCenter/HideSecureBoot
          • -
          • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
          • -
          -

          Added the following policies the were added in Windows 10, version 1709

          -
            -
          • DeviceLock/MinimumPasswordAge
          • -
          • Settings/AllowOnlineTips
          • -
          • System/DisableEnterpriseAuthProxy
          • -
          -

          Security/RequireDeviceEncryption - updated to show it is supported in desktop.

          -
          BitLocker CSP

          Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

          -
          EnterpriseModernAppManagement CSP

          Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

          -
          DMClient CSP

          Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

          -
            -
          • AADSendDeviceToken
          • -
          • BlockInStatusPage
          • -
          • AllowCollectLogsButton
          • -
          • CustomErrorText
          • -
          • SkipDeviceStatusPage
          • -
          • SkipUserStatusPage
          • -
          -
          Defender CSP

          Added new node (OfflineScan) in Windows 10, version 1803.

          -
          UEFI CSP

          Added a new CSP in Windows 10, version 1803.

          -
          Update CSP

          Added the following nodes in Windows 10, version 1803:

          -
            -
          • Rollback
          • -
          • Rollback/FeatureUpdate
          • -
          • Rollback/QualityUpdateStatus
          • -
          • Rollback/FeatureUpdateStatus
          • -
          -
          - -### December 2017 - - ---- - - - - - - - - - - - -
          New or updated topicDescription
          Configuration service provider reference

          Added new section CSP DDF files download

          -
          - -### November 2017 - - ---- - - - - - - - - - - - -
          New or updated topicDescription
          Policy CSP

          Added the following policies for Windows 10, version 1709:

          -
            -
          • Authentication/AllowFidoDeviceSignon
          • -
          • Cellular/LetAppsAccessCellularData
          • -
          • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
          • -
          • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
          • -
          • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
          • -
          • Start/HidePeopleBar
          • -
          • Storage/EnhancedStorageDevices
          • -
          • Update/ManagePreviewBuilds
          • -
          • WirelessDisplay/AllowMdnsAdvertisement
          • -
          • WirelessDisplay/AllowMdnsDiscovery
          • -
          -

          Added missing policies from previous releases:

          -
            -
          • Connectivity/DisallowNetworkConnectivityActiveTest
          • -
          • Search/AllowWindowsIndexer
          • -
          -
          - -### October 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Policy DDF file

          Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

          -
          Policy CSP

          Updated the following policies:

          -
            -
          • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
          • -
          • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
          • -
          -
          eUICCs CSP

          Added new CSP in Windows 10, version 1709.

          -
          AssignedAccess CSP

          Added SyncML examples for the new Configuration node.

          -
          DMClient CSP

          Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

          -
          - - -### September 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Policy CSP

          Added the following new policies for Windows 10, version 1709:

          -
            -
          • Authentication/AllowAadPasswordReset
          • -
          • Handwriting/PanelDefaultModeDocked
          • -
          • Search/AllowCloudSearch
          • -
          • System/LimitEnhancedDiagnosticDataWindowsAnalytics
          • -
          -

          Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

          -
          AssignedAccess CSP

          Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

          -
          Microsoft Store for Business and Microsoft Store

          Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

          -
          The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

          The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

          -
            -
          • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
          • -
          • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
          • -
          • DomainName - fully qualified domain name if the device is domain-joined.
          • -
          -

          For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

          -
          EntepriseAPN CSP

          Added a SyncML example.

          -
          VPNv2 CSP

          Added RegisterDNS setting in Windows 10, version 1709.

          -
          Enroll a Windows 10 device automatically using Group Policy

          Added new topic to introduce a new Group Policy for automatic MDM enrollment.

          -
          MDM enrollment of Windows-based devices

          New features in the Settings app:

          -
            -
          • User sees installation progress of critical policies during MDM enrollment.
          • -
          • User knows what policies, profiles, apps MDM has configured
          • -
          • IT helpdesk can get detailed MDM diagnostic information using client tools
          • -
          -

          For details, see Managing connections and Collecting diagnostic logs

          -
          - -### August 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          New or updated topicDescription
          Enable ADMX-backed policies in MDM

          Added new step-by-step guide to enable ADMX-backed policies.

          -
          Mobile device enrollment

          Added the following statement:

          -
            -
          • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
          • -
          -
          CM_CellularEntries CSP

          Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

          -
          EnterpriseDataProtection CSP

          Updated the Settings/EDPEnforcementLevel values to the following:

          -
            -
          • 0 (default) – Off / No protection (decrypts previously protected data).
          • -
          • 1 – Silent mode (encrypt and audit only).
          • -
          • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
          • -
          • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
          • -
          -
          AppLocker CSP

          Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Whitelist examples.

          -
          DeviceManageability CSP

          Added the following settings in Windows 10, version 1709:

          -
            -
          • Provider/ProviderID/ConfigInfo
          • -
          • Provider/ProviderID/EnrollmentInfo
          • -
          -
          Office CSP

          Added the following setting in Windows 10, version 1709:

          -
            -
          • Installation/CurrentStatus
          • -
          -
          BitLocker CSPAdded information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. -
          Firewall CSPUpdated the CSP and DDF topics. Here are the changes: -
            -
          • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
          • -
          • Changed some data types from integer to bool.
          • -
          • Updated the list of supported operations for some settings.
          • -
          • Added default values.
          • -
          -
          Policy DDF fileAdded another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: -
            -
          • Browser/AllowMicrosoftCompatibilityList
          • -
          • Update/DisableDualScan
          • -
          • Update/FillEmptyContentUrls
          • -
          -
          Policy CSP

          Added the following new policies for Windows 10, version 1709:

          -
            -
          • Browser/ProvisionFavorites
          • -
          • Browser/LockdownFavorites
          • -
          • ExploitGuard/ExploitProtectionSettings
          • -
          • Games/AllowAdvancedGamingServices
          • -
          • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
          • -
          • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
          • -
          • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
          • -
          • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
          • -
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
          • -
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
          • -
          • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
          • -
          • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
          • -
          • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
          • -
          • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
          • -
          • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
          • -
          • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
          • -
          • Privacy/EnableActivityFeed
          • -
          • Privacy/PublishUserActivities
          • -
          • Update/DisableDualScan
          • -
          • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
          • -
          -

          Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

          -

          Changed the names of the following policies:

          -
            -
          • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
          • -
          • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
          • -
          • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
          • -
          -

          Added links to the additional ADMX-backed BitLocker policies.

          -

          There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

          -
            -
          • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
          • -
          • Start/HideAppList
          • -
          -
          +To know what's changed in MDM documentation, see [Change history for MDM documentation](change-history-for-mdm-documentation.md). diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index 9072c3eb82..045b8152d9 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -1,6 +1,6 @@ --- title: NodeCache CSP -description: NodeCache CSP +description: Use the NodeCache configuration service provider (CSP) to synchronize, monitor, and manage the client cache. ms.assetid: b4dd2b0d-79ef-42ac-ab5b-ee07b3097876 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 7d58ebbea3..06a74f2979 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -1,6 +1,6 @@ --- title: NodeCache DDF file -description: NodeCache DDF file +description: Learn about the OMA DM device description framework (DDF) for the NodeCache configuration service provider (CSP). ms.assetid: d7605098-12aa-4423-89ae-59624fa31236 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index ec46006921..58e1e0a8e9 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -65,7 +65,7 @@ The only supported operation is Get. ## Examples -Sample SyncML to install Office 365 Business Retail from current channel. +Sample SyncML to install Microsoft 365 Apps for business Retail from current channel. ```xml diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 7f8b60345e..88e2b4dee5 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -14,9 +14,6 @@ ms.date: 08/15/2018 # Office DDF -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **Office** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md index 5378bd3600..40757af748 100644 --- a/windows/client-management/mdm/oma-dm-protocol-support.md +++ b/windows/client-management/mdm/oma-dm-protocol-support.md @@ -1,6 +1,6 @@ --- title: OMA DM protocol support -description: OMA DM protocol support +description: See how the OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. ms.assetid: e882aaae-447e-4bd4-9275-463824da4fa0 ms.reviewer: manager: dansimp @@ -349,7 +349,7 @@ The following LocURL shows a per device CSP node configuration: **./device/vendo ## SyncML response status codes -When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification. +When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification. | Status code | Description | |-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| diff --git a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md index fc1667fcc2..2ff94e841f 100644 --- a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md @@ -14,7 +14,7 @@ ms.date: 06/26/2017 # On-premises authentication device enrollment -This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). +This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). ## In this topic @@ -31,7 +31,7 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The discovery web service provides the configuration information necessary for a user to enroll a device with a management service. The service is a restful web service over HTTPS (server authentication only). > [!NOTE] ->The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. +> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The device’s automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -78,7 +78,7 @@ The following logic is applied: - If the device is not redirected, it prompts the user for the server address. - If the device is redirected, it prompts the user to allow the redirect. -The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address +The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address: ``` https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc @@ -130,7 +130,7 @@ The discovery response is in the XML format and includes the following fields: - Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. > [!NOTE] ->The HTTP server response must not be chunked; it must be sent as one message. +> The HTTP server response must not be chunked; it must be sent as one message. The following example shows a response received from the discovery web service for OnPremise authentication: @@ -215,7 +215,7 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. We will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. > [!NOTE] ->The HTTP server response must not be chunked; it must be sent as one message. +> The HTTP server response must not be chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -307,7 +307,7 @@ The RequestSecurityToken will use a custom TokenType (http://schema The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. > [!NOTE] ->The policy service and the enrollment service must be on the same server; that is, they must have the same host name. +> The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for OnPremise authentication. diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index b7b64e75fe..fbb49aae1f 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -190,7 +190,7 @@ Default value is false. If you set this policy to true, Remote Windows Hello for Supported operations are Add, Get, Delete, and Replace. -*Not supported on Windows Holographic and Windows Holographic for Business.* +*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).* ***TenantId*/Policies/UseHelloCertificatesAsSmartCardCertificates** (only for ./Device/Vendor/MSFT) Added in Windows 10, version 1809. If you enable this policy setting, applications use Windows Hello for Business certificates as smart card certificates. Biometric factors are unavailable when a user is asked to authorize the use of the certificate's private key. This policy setting is designed to allow compatibility with applications that rely exclusively on smart card certificates. @@ -217,7 +217,7 @@ Default value is true, enabling the biometric gestures for use with Windows Hell Supported operations are Add, Get, Delete, and Replace. -*Not supported on Windows Holographic and Windows Holographic for Business.* +*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).* **Biometrics/FacialFeaturesUseEnhancedAntiSpoofing** (only for ./Device/Vendor/MSFT) Boolean value used to enable or disable enhanced anti-spoofing for facial feature recognition on Windows Hello face authentication. This node was added in Windows 10, version 1511. @@ -230,7 +230,7 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re Supported operations are Add, Get, Delete, and Replace. -*Not supported on Windows Holographic and Windows Holographic for Business.* +*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).* **DeviceUnlock** (only for ./Device/Vendor/MSFT) Added in Windows 10, version 1803. Interior node. @@ -271,7 +271,7 @@ Scope is permanent. Supported operation is Get. **SecurityKey/UseSecurityKeyForSignin** (only for ./Device/Vendor/MSFT) -Added in Windows 10, version 1903. Enables users to sign-in to their device with a [FIDO2 security key](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys) that is compatible with Microsoft’s implementation. +Added in Windows 10, version 1903. Enables users to sign-in to their device with a [FIDO2 security key](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys) that is compatible with Microsoft’s implementation. Scope is dynamic. Supported operations are Add, Get, Replace, and Delete. diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index 7eaea8a237..f5b345d7d6 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,6 +1,6 @@ --- title: PassportForWork DDF -description: This topic shows the OMA DM device description framework (DDF) for the PassportForWork configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the PassportForWork configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: A2182898-1577-4675-BAE5-2A3A9C2AAC9B ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index e3914d786d..8d4f260502 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,6 +1,6 @@ --- title: Personalization CSP -description: Personalization CSP +description: Use the Personalization CSP to lock screen and desktop background images, prevent users from changing the image, and use the settings in a provisioning package. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index 2492302fed..5a9ac5cc69 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,6 +1,6 @@ --- title: Personalization DDF file -description: Personalization DDF file +description: Learn how to set the OMA DM device description framework (DDF) for the Personalization configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md new file mode 100644 index 0000000000..8771145e8a --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -0,0 +1,1495 @@ +--- +title: ADMX-backed policies in Policy CSP +description: ADMX-backed policies in Policy CSP +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/08/2020 +--- + +# ADMX-backed policies in Policy CSP + +> [!div class="op_single_selector"] +> +> - [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +> - [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) +> + +- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [ADMX_ActiveXInstallService/AxISURLZonePolicies](./policy-csp-admx-activexinstallservice.md#admx-activexinstallservice-axisurlzonepolicies) +- [ADMX_AddRemovePrograms/DefaultCategory](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-defaultcategory) +- [ADMX_AddRemovePrograms/NoAddFromCDorFloppy](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromcdorfloppy) +- [ADMX_AddRemovePrograms/NoAddFromInternet](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfrominternet) +- [ADMX_AddRemovePrograms/NoAddFromNetwork](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromnetwork) +- [ADMX_AddRemovePrograms/NoAddPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddpage) +- [ADMX_AddRemovePrograms/NoAddRemovePrograms](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddremoveprograms) +- [ADMX_AddRemovePrograms/NoChooseProgramsPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nochooseprogramspage) +- [ADMX_AddRemovePrograms/NoRemovePage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noremovepage) +- [ADMX_AddRemovePrograms/NoServices](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noservices) +- [ADMX_AddRemovePrograms/NoSupportInfo](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nosupportinfo) +- [ADMX_AddRemovePrograms/NoWindowsSetupPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nowindowssetuppage) +- [ADMX_AppCompat/AppCompatPrevent16BitMach](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatprevent16bitmach) +- [ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatremoveprogramcompatproppage) +- [ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffapplicationimpacttelemetry) +- [ADMX_AppCompat/AppCompatTurnOffSwitchBack](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffswitchback) +- [ADMX_AppCompat/AppCompatTurnOffEngine](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffengine) +- [ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant_1) +- [ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant_2) +- [ADMX_AppCompat/AppCompatTurnOffUserActionRecord](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffuseractionrecord) +- [ADMX_AppCompat/AppCompatTurnOffProgramInventory](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprograminventory) +- [ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles](./policy-csp-admx-appxpackagemanager.md#admx-appxpackagemanager-allowdeploymentinspecialprofiles) +- [ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeapplicationcontenturirules) +- [ADMX_AppXRuntime/AppxRuntimeBlockFileElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation) +- [ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockhostedappaccesswinrt) +- [ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation) +- [ADMX_AttachmentManager/AM_EstimateFileHandlerRisk](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-estimatefilehandlerrisk) +- [ADMX_AttachmentManager/AM_SetFileRiskLevel](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setfilerisklevel) +- [ADMX_AttachmentManager/AM_SetHighRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-sethighriskinclusion) +- [ADMX_AttachmentManager/AM_SetLowRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setlowriskinclusion) +- [ADMX_AttachmentManager/AM_SetModRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setmodriskinclusion) +- [ADMX_AuditSettings/IncludeCmdLine](./policy-csp-admx-auditsettings.md#admx-auditsettings-includecmdline) +- [ADMX_Bits/BITS_DisableBranchCache](./policy-csp-admx-bits.md#admx-bits-bits-disablebranchcache) +- [ADMX_Bits/BITS_DisablePeercachingClient](./policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingclient) +- [ADMX_Bits/BITS_DisablePeercachingServer](./policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingserver) +- [ADMX_Bits/BITS_EnablePeercaching](./policy-csp-admx-bits.md#admx-bits-bits-enablepeercaching) +- [ADMX_Bits/BITS_MaxBandwidthServedForPeers](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthservedforpeers) +- [ADMX_Bits/BITS_MaxBandwidthV2_Maintenance](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-maintenance) +- [ADMX_Bits/BITS_MaxBandwidthV2_Work](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-work) +- [ADMX_Bits/BITS_MaxCacheSize](./policy-csp-admx-bits.md#admx-bits-bits-maxcachesize) +- [ADMX_Bits/BITS_MaxContentAge](./policy-csp-admx-bits.md#admx-bits-bits-maxcontentage) +- [ADMX_Bits/BITS_MaxDownloadTime](./policy-csp-admx-bits.md#admx-bits-bits-maxdownloadtime) +- [ADMX_Bits/BITS_MaxFilesPerJob](./policy-csp-admx-bits.md#admx-bits-bits-maxfilesperjob) +- [ADMX_Bits/BITS_MaxJobsPerMachine](./policy-csp-admx-bits.md#admx-bits-bits-maxjobspermachine) +- [ADMX_Bits/BITS_MaxJobsPerUser](./policy-csp-admx-bits.md#admx-bits-bits-maxjobsperuser) +- [ADMX_Bits/BITS_MaxRangesPerFile](./policy-csp-admx-bits.md#admx-bits-bits-maxrangesperfile) +- [ADMX_CipherSuiteOrder/SSLCipherSuiteOrder](./policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslciphersuiteorder) +- [ADMX_CipherSuiteOrder/SSLCurveOrder](./policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslcurveorder) +- [ADMX_COM/AppMgmt_COM_SearchForCLSID_1](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-1) +- [ADMX_COM/AppMgmt_COM_SearchForCLSID_2](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-2) +- [ADMX_ControlPanel/DisallowCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-disallowcpls) +- [ADMX_ControlPanel/ForceClassicControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-forceclassiccontrolpanel) +- [ADMX_ControlPanel/NoControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-nocontrolpanel) +- [ADMX_ControlPanel/RestrictCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-restrictcpls) +- [ADMX_ControlPanelDisplay/CPL_Display_Disable](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-disable) +- [ADMX_ControlPanelDisplay/CPL_Display_HideSettings](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-hidesettings) +- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablecolorschemechoice) +- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablethemechange) +- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablevisualstyle) +- [ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-enablescreensaver) +- [ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen) +- [ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-lockfontsize) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nolockscreen) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nomousepointersui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-noscreensaverui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nosoundschemeui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-personalcolors) +- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensaverissecure) +- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensavertimeout) +- [ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setscreensaver) +- [ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme) +- [ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setvisualstyle) +- [ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-startbackground) +- [ADMX_Cpls/UseDefaultTile](./policy-csp-admx-cpls.md#admx-cpls-usedefaulttile) +- [ADMX_CredentialProviders/AllowDomainDelayLock](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-allowdomaindelaylock) +- [ADMX_CredentialProviders/DefaultCredentialProvider](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-defaultcredentialprovider) +- [ADMX_CredentialProviders/ExcludedCredentialProviders](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-excludedcredentialproviders) +- [ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowdefcredentialswhenntlmonly) +- [ADMX_CredSsp/AllowDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowdefaultcredentials) +- [ADMX_CredSsp/AllowEncryptionOracle](./policy-csp-admx-credssp.md#admx-credssp-allowencryptionoracle) +- [ADMX_CredSsp/AllowFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentials) +- [ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentialswhenntlmonly) +- [ADMX_CredSsp/AllowSavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentials) +- [ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentialswhenntlmonly) +- [ADMX_CredSsp/DenyDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-denydefaultcredentials) +- [ADMX_CredSsp/DenyFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-denyfreshcredentials) +- [ADMX_CredSsp/DenySavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-denysavedcredentials) +- [ADMX_CredSsp/RestrictedRemoteAdministration](./policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration) +- [ADMX_CredUI/EnableSecureCredentialPrompting](./policy-csp-admx-credui.md#admx-credui-enablesecurecredentialprompting) +- [ADMX_CredUI/NoLocalPasswordResetQuestions](./policy-csp-admx-credui.md#admx-credui-nolocalpasswordresetquestions) +- [ADMX_CtrlAltDel/DisableChangePassword](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablechangepassword) +- [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) +- [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) +- [ADMX_CtrlAltDel/NoLogoff](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) +- [ADMX_DataCollection/CommercialIdPolicy](./policy-csp-admx-datacollection.md#admx-datacollection-commercialidpolicy) +- [ADMX_Desktop/AD_EnableFilter](./policy-csp-admx-desktop.md#admx-desktop-ad-enablefilter) +- [ADMX_Desktop/AD_HideDirectoryFolder](./policy-csp-admx-desktop.md#admx-desktop-ad-hidedirectoryfolder) +- [ADMX_Desktop/AD_QueryLimit](./policy-csp-admx-desktop.md#admx-desktop-ad-querylimit) +- [ADMX_Desktop/ForceActiveDesktopOn](./policy-csp-admx-desktop.md#admx-desktop-forceactivedesktopon) +- [ADMX_Desktop/NoActiveDesktop](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktop) +- [ADMX_Desktop/NoActiveDesktopChanges](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktopchanges) +- [ADMX_Desktop/NoDesktop](./policy-csp-admx-desktop.md#admx-desktop-nodesktop) +- [ADMX_Desktop/NoDesktopCleanupWizard](./policy-csp-admx-desktop.md#admx-desktop-nodesktopcleanupwizard) +- [ADMX_Desktop/NoInternetIcon](./policy-csp-admx-desktop.md#admx-desktop-nointerneticon) +- [ADMX_Desktop/NoMyComputerIcon](./policy-csp-admx-desktop.md#admx-desktop-nomycomputericon) +- [ADMX_Desktop/NoMyDocumentsIcon](./policy-csp-admx-desktop.md#admx-desktop-nomydocumentsicon) +- [ADMX_Desktop/NoNetHood](./policy-csp-admx-desktop.md#admx-desktop-nonethood) +- [ADMX_Desktop/NoPropertiesMyComputer](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmycomputer) +- [ADMX_Desktop/NoPropertiesMyDocuments](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmydocuments) +- [ADMX_Desktop/NoRecentDocsNetHood](./policy-csp-admx-desktop.md#admx-desktop-norecentdocsnethood) +- [ADMX_Desktop/NoRecycleBinIcon](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinicon) +- [ADMX_Desktop/NoRecycleBinProperties](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinproperties) +- [ADMX_Desktop/NoSaveSettings](./policy-csp-admx-desktop.md#admx-desktop-nosavesettings) +- [ADMX_Desktop/NoWindowMinimizingShortcuts](./policy-csp-admx-desktop.md#admx-desktop-nowindowminimizingshortcuts) +- [ADMX_Desktop/Wallpaper](./policy-csp-admx-desktop.md#admx-desktop-wallpaper) +- [ADMX_Desktop/sz_ATC_DisableAdd](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableadd) +- [ADMX_Desktop/sz_ATC_DisableClose](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableclose) +- [ADMX_Desktop/sz_ATC_DisableDel](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disabledel) +- [ADMX_Desktop/sz_ATC_DisableEdit](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableedit) +- [ADMX_Desktop/sz_ATC_NoComponents](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-nocomponents) +- [ADMX_Desktop/sz_AdminComponents_Title](./policy-csp-admx-desktop.md#admx-desktop-sz-admincomponents-title) +- [ADMX_Desktop/sz_DB_DragDropClose](./policy-csp-admx-desktop.md#admx-desktop-sz-db-dragdropclose) +- [ADMX_Desktop/sz_DB_Moving](./policy-csp-admx-desktop.md#admx-desktop-sz-db-moving) +- [ADMX_Desktop/sz_DWP_NoHTMLPaper](./policy-csp-admx-desktop.md#admx-desktop-sz-dwp-nohtmlpaper) +- [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) +- [ADMX_DeviceInstallation/DeviceInstall_InstallTimeout](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) +- [ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) +- [ADMX_DeviceInstallation/DeviceInstall_Removable_Deny](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) +- [ADMX_DeviceInstallation/DeviceInstall_SystemRestore](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) +- [ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-classes-allowuser) +- [ADMX_DeviceSetup/DeviceInstall_BalloonTips](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) +- [ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) +- [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) +- [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-2) +- [ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-allowfqdnnetbiosqueries) +- [ADMX_DnsClient/DNS_AppendToMultiLabelName](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-appendtomultilabelname) +- [ADMX_DnsClient/DNS_Domain](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domain) +- [ADMX_DnsClient/DNS_DomainNameDevolutionLevel](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domainnamedevolutionlevel) +- [ADMX_DnsClient/DNS_IdnEncoding](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnencoding) +- [ADMX_DnsClient/DNS_IdnMapping](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnmapping) +- [ADMX_DnsClient/DNS_NameServer](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-nameserver) +- [ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-preferlocalresponsesoverlowerorderdns) +- [ADMX_DnsClient/DNS_PrimaryDnsSuffix](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-primarydnssuffix) +- [ADMX_DnsClient/DNS_RegisterAdapterName](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registeradaptername) +- [ADMX_DnsClient/DNS_RegisterReverseLookup](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registerreverselookup) +- [ADMX_DnsClient/DNS_RegistrationEnabled](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationenabled) +- [ADMX_DnsClient/DNS_RegistrationOverwritesInConflict](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationoverwritesinconflict) +- [ADMX_DnsClient/DNS_RegistrationRefreshInterval](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationrefreshinterval) +- [ADMX_DnsClient/DNS_RegistrationTtl](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationttl) +- [ADMX_DnsClient/DNS_SearchList](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-searchlist) +- [ADMX_DnsClient/DNS_SmartMultiHomedNameResolution](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartmultihomednameresolution) +- [ADMX_DnsClient/DNS_SmartProtocolReorder](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartprotocolreorder) +- [ADMX_DnsClient/DNS_UpdateSecurityLevel](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatesecuritylevel) +- [ADMX_DnsClient/DNS_UpdateTopLevelDomainZones](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatetopleveldomainzones) +- [ADMX_DnsClient/DNS_UseDomainNameDevolution](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-usedomainnamedevolution) +- [ADMX_DnsClient/Turn_Off_Multicast](./policy-csp-admx-dnsclient.md#admx-dnsclient-turn-off-multicast) +- [ADMX_DWM/DwmDefaultColorizationColor_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-1) +- [ADMX_DWM/DwmDefaultColorizationColor_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-2) +- [ADMX_DWM/DwmDisallowAnimations_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-1) +- [ADMX_DWM/DwmDisallowAnimations_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-2) +- [ADMX_DWM/DwmDisallowColorizationColorChanges_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-1) +- [ADMX_DWM/DwmDisallowColorizationColorChanges_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-2) +- [ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList](./policy-csp-admx-eaime.md#admx-eaime-l-donotincludenonpublishingstandardglyphinthecandidatelist) +- [ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion](./policy-csp-admx-eaime.md#admx-eaime-l-restrictcharactercoderangeofconversion) +- [ADMX_EAIME/L_TurnOffCustomDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffcustomdictionary) +- [ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffhistorybasedpredictiveinput) +- [ADMX_EAIME/L_TurnOffInternetSearchIntegration](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffinternetsearchintegration) +- [ADMX_EAIME/L_TurnOffOpenExtendedDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffopenextendeddictionary) +- [ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffsavingautotuningdatatofile) +- [ADMX_EAIME/L_TurnOnCloudCandidate](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidate) +- [ADMX_EAIME/L_TurnOnCloudCandidateCHS](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidatechs) +- [ADMX_EAIME/L_TurnOnLexiconUpdate](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlexiconupdate) +- [ADMX_EAIME/L_TurnOnLiveStickers](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlivestickers) +- [ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport](./policy-csp-admx-eaime.md#admx-eaime-l-turnonmisconversionloggingformisconversionreport) +- [ADMX_EncryptFilesonMove/NoEncryptOnMove](./policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) +- [ADMX_EnhancedStorage/ApprovedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedenstordevices) +- [ADMX_EnhancedStorage/ApprovedSilos](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedsilos) +- [ADMX_EnhancedStorage/DisablePasswordAuthentication](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disablepasswordauthentication) +- [ADMX_EnhancedStorage/DisallowLegacyDiskDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disallowlegacydiskdevices) +- [ADMX_EnhancedStorage/LockDeviceOnMachineLock](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-lockdeviceonmachinelock) +- [ADMX_EnhancedStorage/RootHubConnectedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-roothubconnectedenstordevices) +- [ADMX_ErrorReporting/PCH_AllOrNoneDef](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornonedef) +- [ADMX_ErrorReporting/PCH_AllOrNoneEx](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneex) +- [ADMX_ErrorReporting/PCH_AllOrNoneInc](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneinc) +- [ADMX_ErrorReporting/PCH_ConfigureReport](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-configurereport) +- [ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-reportoperatingsystemfaults) +- [ADMX_ErrorReporting/WerArchive_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-1) +- [ADMX_ErrorReporting/WerArchive_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-2) +- [ADMX_ErrorReporting/WerAutoApproveOSDumps_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-1) +- [ADMX_ErrorReporting/WerAutoApproveOSDumps_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-2) +- [ADMX_ErrorReporting/WerBypassDataThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-1) +- [ADMX_ErrorReporting/WerBypassDataThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-2) +- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-1) +- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-2) +- [ADMX_ErrorReporting/WerBypassPowerThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-1) +- [ADMX_ErrorReporting/WerBypassPowerThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-2) +- [ADMX_ErrorReporting/WerCER](./policy-csp-admx-errorreporting.md#admx-errorreporting-wercer) +- [ADMX_ErrorReporting/WerConsentCustomize_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentcustomize-1) +- [ADMX_ErrorReporting/WerConsentOverride_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-1) +- [ADMX_ErrorReporting/WerConsentOverride_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-2) +- [ADMX_ErrorReporting/WerDefaultConsent_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-1) +- [ADMX_ErrorReporting/WerDefaultConsent_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-2) +- [ADMX_ErrorReporting/WerDisable_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdisable-1) +- [ADMX_ErrorReporting/WerExlusion_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-1) +- [ADMX_ErrorReporting/WerExlusion_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-2) +- [ADMX_ErrorReporting/WerNoLogging_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-1) +- [ADMX_ErrorReporting/WerNoLogging_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-2) +- [ADMX_ErrorReporting/WerNoSecondLevelData_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernosecondleveldata-1) +- [ADMX_ErrorReporting/WerQueue_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-1) +- [ADMX_ErrorReporting/WerQueue_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-2) +- [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) +- [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) +- [ADMX_EventLog/Channel_LogEnabled](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logenabled) +- [ADMX_EventLog/Channel_LogFilePath_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-1) +- [ADMX_EventLog/Channel_LogFilePath_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-2) +- [ADMX_EventLog/Channel_LogFilePath_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-3) +- [ADMX_EventLog/Channel_LogFilePath_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-4) +- [ADMX_EventLog/Channel_LogMaxSize_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logmaxsize-3) +- [ADMX_EventLog/Channel_Log_AutoBackup_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-1) +- [ADMX_EventLog/Channel_Log_AutoBackup_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-2) +- [ADMX_EventLog/Channel_Log_AutoBackup_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-3) +- [ADMX_EventLog/Channel_Log_AutoBackup_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-4) +- [ADMX_EventLog/Channel_Log_FileLogAccess_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-1) +- [ADMX_EventLog/Channel_Log_FileLogAccess_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-2) +- [ADMX_EventLog/Channel_Log_FileLogAccess_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-3) +- [ADMX_EventLog/Channel_Log_FileLogAccess_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-4) +- [ADMX_EventLog/Channel_Log_FileLogAccess_5](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-5) +- [ADMX_EventLog/Channel_Log_FileLogAccess_6](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-6) +- [ADMX_EventLog/Channel_Log_FileLogAccess_7](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-7) +- [ADMX_EventLog/Channel_Log_FileLogAccess_8](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-8) +- [ADMX_EventLog/Channel_Log_Retention_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-2) +- [ADMX_EventLog/Channel_Log_Retention_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-3) +- [ADMX_EventLog/Channel_Log_Retention_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-4) +- [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) +- [ADMX_FileSys/DisableCompression](./policy-csp-admx-filesys.md#admx-filesys-disablecompression) +- [ADMX_FileSys/DisableDeleteNotification](./policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification) +- ADMX_FileSys/DisableEncryption](./policy-csp-admx-filesys.md#admx-filesys-disableencryption) +- [ADMX_FileSys/EnablePagefileEncryption](./policy-csp-admx-filesys.md#admx-filesys-enablepagefileencryption) +- [ADMX_FileSys/LongPathsEnabled](./policy-csp-admx-filesys.md#admx-filesys-longpathsenabled) +- [ADMX_FileSys/ShortNameCreationSettings](./policy-csp-admx-filesys.md#admx-filesys-shortnamecreationsettings) +- [ADMX_FileSys/SymlinkEvaluation](./policy-csp-admx-filesys.md#admx-filesys-symlinkevaluation) +- [ADMX_FileSys/TxfDeprecatedFunctionality](./policy-csp-admx-filesys.md#admx-filesys-txfdeprecatedfunctionality) +- [ADMX_FolderRedirection/DisableFRAdminPin](./policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpin) +- [ADMX_FolderRedirection/DisableFRAdminPinByFolder](./policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpinbyfolder) +- [ADMX_FolderRedirection/FolderRedirectionEnableCacheRename](./policy-csp-admx-folderredirection.md#admx-folderredirection-folderredirectionenablecacherename) +- [ADMX_FolderRedirection/LocalizeXPRelativePaths_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-1) +- [ADMX_FolderRedirection/LocalizeXPRelativePaths_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2) +- [ADMX_FolderRedirection/PrimaryComputer_FR_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1) +- [ADMX_FolderRedirection/PrimaryComputer_FR_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2) +- [ADMX_Help/DisableHHDEP](./policy-csp-admx-help.md#admx-help-disablehhdep) +- [ADMX_Help/HelpQualifiedRootDir_Comp](./policy-csp-admx-help.md#admx-help-helpqualifiedrootdir-comp) +- [ADMX_Help/RestrictRunFromHelp](./policy-csp-admx-help.md#admx-help-restrictrunfromhelp) +- [ADMX_Help/RestrictRunFromHelp_Comp](./policy-csp-admx-help.md#admx-help-restrictrunfromhelp-comp) +- [ADMX_HelpAndSupport/ActiveHelp](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-activehelp) +- [ADMX_HelpAndSupport/HPExplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpexplicitfeedback) +- [ADMX_HelpAndSupport/HPImplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpimplicitfeedback) +- [ADMX_HelpAndSupport/HPOnlineAssistance](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hponlineassistance) +- [ADMX_kdc/CbacAndArmor](./policy-csp-admx-kdc.md#admx-kdc-cbacandarmor) +- [ADMX_kdc/ForestSearch](./policy-csp-admx-kdc.md#admx-kdc-forestsearch) +- [ADMX_kdc/PKINITFreshness](./policy-csp-admx-kdc.md#admx-kdc-pkinitfreshness) +- [ADMX_kdc/RequestCompoundId](./policy-csp-admx-kdc.md#admx-kdc-requestcompoundid) +- [ADMX_kdc/TicketSizeThreshold](./policy-csp-admx-kdc.md#admx-kdc-ticketsizethreshold) +- [ADMX_kdc/emitlili](./policy-csp-admx-kdc.md#admx-kdc-emitlili) +- [ADMX_Kerberos/AlwaysSendCompoundId](./policy-csp-admx-kerberos.md#admx-kerberos-alwayssendcompoundid) +- [ADMX_Kerberos/DevicePKInitEnabled](./policy-csp-admx-kerberos.md#admx-kerberos-devicepkinitenabled) +- [ADMX_Kerberos/HostToRealm](./policy-csp-admx-kerberos.md#admx-kerberos-hosttorealm) +- [ADMX_Kerberos/KdcProxyDisableServerRevocationCheck](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxydisableserverrevocationcheck) +- [ADMX_Kerberos/KdcProxyServer](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxyserver) +- [ADMX_Kerberos/MitRealms](./policy-csp-admx-kerberos.md#admx-kerberos-mitrealms) +- [ADMX_Kerberos/ServerAcceptsCompound](./policy-csp-admx-kerberos.md#admx-kerberos-serveracceptscompound) +- [ADMX_Kerberos/StrictTarget](./policy-csp-admx-kerberos.md#admx-kerberos-stricttarget) +- [ADMX_LanmanServer/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-ciphersuiteorder) +- [ADMX_LanmanServer/Pol_HashPublication](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashpublication) +- [ADMX_LanmanServer/Pol_HashSupportVersion](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashsupportversion) +- [ADMX_LanmanServer/Pol_HonorCipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-honorciphersuiteorder) +- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio) +- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr) +- [ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-allowfastservicestartup) +- [ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableantispywaredefender) +- [ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableautoexclusions) +- [ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableblockatfirstseen) +- [ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablelocaladminmerge) +- [ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablerealtimemonitoring) +- [ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableroutinelytakingaction) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-extensions) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-paths) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-processes) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-asronlyexclusions) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-rules) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-allowedapplications) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-protectedfolders) +- [ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-mpengine-enablefilehashcomputation) +- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-disablesignatureretirement) +- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-sku-differentiation-signature-set-guid) +- [ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-disableprotocolrecognition) +- [ADMX_MicrosoftDefenderAntivirus/ProxyBypass](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxybypass) +- [ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxypacurl) +- [ADMX_MicrosoftDefenderAntivirus/ProxyServer](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxyserver) +- [ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-localsettingoverridepurgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-purgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-randomizescheduletasktimes) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablebehaviormonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableioavprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableonaccessprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablerawwritenotification) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablescanonrealtimeenable) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-ioavmaxsize) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablebehaviormonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableioavprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableonaccessprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablerealtimemonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverriderealtimescandirection) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-localsettingoverridescan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-additionalactiontimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-criticalfailuretimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disableenhancednotifications) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disablegenericreports) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-noncriticaltimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-recentlycleanedtimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracingcomponents) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracinglevel) +- [ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-allowpause) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxdepth) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxsize) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablearchivescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableemailscanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableheuristics) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablepackedexescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableremovabledrivescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablereparsepointscanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablerestorepoint) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningmappednetworkdrivesforfullscan) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningnetworkfiles) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideavgcpuloadfactor) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescanparameters) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideschedulequickscantime) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-lowcpupriority) +- [ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-missedscheduledscancountbeforecatchup) +- [ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-purgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-quickscaninterval) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scanonlyifidle) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-servicekeepalive) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-assignaturedue) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-avsignaturedue) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-definitionupdatefilesharessources) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescanonupdate) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescheduledsignatureupdateonbattery) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disableupdateonstartupwithoutengine) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-fallbackorder) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-forceupdatefrommu) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-realtimesignaturedelivery) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-sharedsignatureslocation) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signaturedisablenotification) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signatureupdatecatchupinterval) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-updateonstartup) +- [ADMX_MicrosoftDefenderAntivirus/SpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynetreporting) +- [ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynet-localsettingoverridespynetreporting) +- [ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-threats-threatiddefaultaction) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-customdefaultactiontoaststring) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-notification-suppress) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-suppressrebootnotification) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-uilockdown) +- [ADMX_MMC/MMC_ActiveXControl](./policy-csp-admx-mmc.md#admx-mmc-mmc-activexcontrol) +- [ADMX_MMC/MMC_ExtendView](./policy-csp-admx-mmc.md#admx-mmc-mmc-extendview) +- [ADMX_MMC/MMC_LinkToWeb](./policy-csp-admx-mmc.md#admx-mmc-mmc-linktoweb) +- [ADMX_MMC/MMC_Restrict_Author](./policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-author) +- [ADMX_MMC/MMC_Restrict_To_Permitted_Snapins](./policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-to-permitted-snapins) +- [ADMX_MMCSnapins/MMC_ADMComputers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-1) +- [ADMX_MMCSnapins/MMC_ADMComputers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-2) +- [ADMX_MMCSnapins/MMC_ADMUsers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-1) +- [ADMX_MMCSnapins/MMC_ADMUsers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-2) +- [ADMX_MMCSnapins/MMC_ADSI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-adsi) +- [ADMX_MMCSnapins/MMC_ActiveDirDomTrusts](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirdomtrusts) +- [ADMX_MMCSnapins/MMC_ActiveDirSitesServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirsitesservices) +- [ADMX_MMCSnapins/MMC_ActiveDirUsersComp](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activediruserscomp) +- [ADMX_MMCSnapins/MMC_AppleTalkRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-appletalkrouting) +- [ADMX_MMCSnapins/MMC_AuthMan](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-authman) +- [ADMX_MMCSnapins/MMC_CertAuth](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauth) +- [ADMX_MMCSnapins/MMC_CertAuthPolSet](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauthpolset) +- [ADMX_MMCSnapins/MMC_Certs](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certs) +- [ADMX_MMCSnapins/MMC_CertsTemplate](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certstemplate) +- [ADMX_MMCSnapins/MMC_ComponentServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-componentservices) +- [ADMX_MMCSnapins/MMC_ComputerManagement](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-computermanagement) +- [ADMX_MMCSnapins/MMC_ConnectionSharingNAT](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-connectionsharingnat) +- [ADMX_MMCSnapins/MMC_DCOMCFG](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dcomcfg) +- [ADMX_MMCSnapins/MMC_DFS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dfs) +- [ADMX_MMCSnapins/MMC_DHCPRelayMgmt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dhcprelaymgmt) +- [ADMX_MMCSnapins/MMC_DeviceManager_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-1) +- [ADMX_MMCSnapins/MMC_DeviceManager_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-2) +- [ADMX_MMCSnapins/MMC_DiskDefrag](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskdefrag) +- [ADMX_MMCSnapins/MMC_DiskMgmt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskmgmt) +- [ADMX_MMCSnapins/MMC_EnterprisePKI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-enterprisepki) +- [ADMX_MMCSnapins/MMC_EventViewer_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-1) +- [ADMX_MMCSnapins/MMC_EventViewer_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-2) +- [ADMX_MMCSnapins/MMC_EventViewer_3](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-3) +- [ADMX_MMCSnapins/MMC_EventViewer_4](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-4) +- [ADMX_MMCSnapins/MMC_FAXService](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-faxservice) +- [ADMX_MMCSnapins/MMC_FailoverClusters](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-failoverclusters) +- [ADMX_MMCSnapins/MMC_FolderRedirection_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-1) +- [ADMX_MMCSnapins/MMC_FolderRedirection_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-2) +- [ADMX_MMCSnapins/MMC_FrontPageExt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-frontpageext) +- [ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicymanagementsnapin) +- [ADMX_MMCSnapins/MMC_GroupPolicySnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicysnapin) +- [ADMX_MMCSnapins/MMC_GroupPolicyTab](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicytab) +- [ADMX_MMCSnapins/MMC_HRA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-hra) +- [ADMX_MMCSnapins/MMC_IAS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ias) +- [ADMX_MMCSnapins/MMC_IASLogging](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iaslogging) +- [ADMX_MMCSnapins/MMC_IEMaintenance_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-1) +- [ADMX_MMCSnapins/MMC_IEMaintenance_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-2) +- [ADMX_MMCSnapins/MMC_IGMPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-igmprouting) +- [ADMX_MMCSnapins/MMC_IIS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iis) +- [ADMX_MMCSnapins/MMC_IPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iprouting) +- [ADMX_MMCSnapins/MMC_IPSecManage_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage-gp) +- [ADMX_MMCSnapins/MMC_IPXRIPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxriprouting) +- [ADMX_MMCSnapins/MMC_IPXRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxrouting) +- [ADMX_MMCSnapins/MMC_IPXSAPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxsaprouting) +- [ADMX_MMCSnapins/MMC_IndexingService](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-indexingservice) +- [ADMX_MMCSnapins/MMC_IpSecManage](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage) +- [ADMX_MMCSnapins/MMC_IpSecMonitor](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmonitor) +- [ADMX_MMCSnapins/MMC_LocalUsersGroups](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-localusersgroups) +- [ADMX_MMCSnapins/MMC_LogicalMappedDrives](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-logicalmappeddrives) +- [ADMX_MMCSnapins/MMC_NPSUI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-npsui) +- [ADMX_MMCSnapins/MMC_NapSnap](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap) +- [ADMX_MMCSnapins/MMC_NapSnap_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap-gp) +- [ADMX_MMCSnapins/MMC_Net_Framework](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-net-framework) +- [ADMX_MMCSnapins/MMC_OCSP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ocsp) +- [ADMX_MMCSnapins/MMC_OSPFRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ospfrouting) +- [ADMX_MMCSnapins/MMC_PerfLogsAlerts](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-perflogsalerts) +- [ADMX_MMCSnapins/MMC_PublicKey](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-publickey) +- [ADMX_MMCSnapins/MMC_QoSAdmission](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-qosadmission) +- [ADMX_MMCSnapins/MMC_RAS_DialinUser](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ras-dialinuser) +- [ADMX_MMCSnapins/MMC_RIPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-riprouting) +- [ADMX_MMCSnapins/MMC_RIS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ris) +- [ADMX_MMCSnapins/MMC_RRA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rra) +- [ADMX_MMCSnapins/MMC_RSM](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rsm) +- [ADMX_MMCSnapins/MMC_RemStore](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remstore) +- [ADMX_MMCSnapins/MMC_RemoteAccess](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remoteaccess) +- [ADMX_MMCSnapins/MMC_RemoteDesktop](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remotedesktop) +- [ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-resultantsetofpolicysnapin) +- [ADMX_MMCSnapins/MMC_Routing](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-routing) +- [ADMX_MMCSnapins/MMC_SCA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sca) +- [ADMX_MMCSnapins/MMC_SMTPProtocol](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-smtpprotocol) +- [ADMX_MMCSnapins/MMC_SNMP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-snmp) +- [ADMX_MMCSnapins/MMC_ScriptsMachine_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-1) +- [ADMX_MMCSnapins/MMC_ScriptsMachine_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-2) +- [ADMX_MMCSnapins/MMC_ScriptsUser_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-1) +- [ADMX_MMCSnapins/MMC_ScriptsUser_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-2) +- [ADMX_MMCSnapins/MMC_SecuritySettings_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-1) +- [ADMX_MMCSnapins/MMC_SecuritySettings_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-2) +- [ADMX_MMCSnapins/MMC_SecurityTemplates](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitytemplates) +- [ADMX_MMCSnapins/MMC_SendConsoleMessage](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sendconsolemessage) +- [ADMX_MMCSnapins/MMC_ServerManager](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servermanager) +- [ADMX_MMCSnapins/MMC_ServiceDependencies](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servicedependencies) +- [ADMX_MMCSnapins/MMC_Services](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-services) +- [ADMX_MMCSnapins/MMC_SharedFolders](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders) +- [ADMX_MMCSnapins/MMC_SharedFolders_Ext](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders-ext) +- [ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-1) +- [ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-2) +- [ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-1) +- [ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-2) +- [ADMX_MMCSnapins/MMC_SysInfo](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysinfo) +- [ADMX_MMCSnapins/MMC_SysProp](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysprop) +- [ADMX_MMCSnapins/MMC_TPMManagement](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-tpmmanagement) +- [ADMX_MMCSnapins/MMC_Telephony](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-telephony) +- [ADMX_MMCSnapins/MMC_TerminalServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-terminalservices) +- [ADMX_MMCSnapins/MMC_WMI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wmi) +- [ADMX_MMCSnapins/MMC_WindowsFirewall](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall) +- [ADMX_MMCSnapins/MMC_WindowsFirewall_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall-gp) +- [ADMX_MMCSnapins/MMC_WiredNetworkPolicy](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirednetworkpolicy) +- [ADMX_MMCSnapins/MMC_WirelessMon](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessmon) +- [ADMX_MMCSnapins/MMC_WirelessNetworkPolicy](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessnetworkpolicy) +- [ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine](./policy-csp-admx-msapolicy.md#admx-msapolicy-microsoftaccount-disableuserauth) +- [ADMX_nca/CorporateResources](./policy-csp-admx-nca.md#admx-nca-corporateresources) +- [ADMX_nca/CustomCommands](./policy-csp-admx-nca.md#admx-nca-customcommands) +- [ADMX_nca/DTEs](./policy-csp-admx-nca.md#admx-nca-dtes) +- [ADMX_nca/FriendlyName](./policy-csp-admx-nca.md#admx-nca-friendlyname) +- [ADMX_nca/LocalNamesOn](./policy-csp-admx-nca.md#admx-nca-localnameson) +- [ADMX_nca/PassiveMode](./policy-csp-admx-nca.md#admx-nca-passivemode) +- [ADMX_nca/ShowUI](./policy-csp-admx-nca.md#admx-nca-showui) +- [ADMX_nca/SupportEmail](./policy-csp-admx-nca.md#admx-nca-supportemail) +- [ADMX_NCSI/NCSI_CorpDnsProbeContent](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobecontent) +- [ADMX_NCSI/NCSI_CorpDnsProbeHost](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobehost) +- [ADMX_NCSI/NCSI_CorpSitePrefixes](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpsiteprefixes) +- [ADMX_NCSI/NCSI_CorpWebProbeUrl](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpwebprobeurl) +- [ADMX_NCSI/NCSI_DomainLocationDeterminationUrl](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-domainlocationdeterminationurl) +- [ADMX_NCSI/NCSI_GlobalDns](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-globaldns) +- [ADMX_NCSI/NCSI_PassivePolling](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-passivepolling) +- [ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresslookuponpingbehavior) +- [ADMX_Netlogon/Netlogon_AddressTypeReturned](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresstypereturned) +- [ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowdnssuffixsearch) +- [ADMX_Netlogon/Netlogon_AllowNT4Crypto](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allownt4crypto) +- [ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowsinglelabeldnsdomain) +- [ADMX_Netlogon/Netlogon_AutoSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-autositecoverage) +- [ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidfallbacknetbiosdiscovery) +- [ADMX_Netlogon/Netlogon_AvoidPdcOnWan](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidpdconwan) +- [ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryinitialperiod) +- [ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretrymaximumperiod) +- [ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryquittime) +- [ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundsuccessfulrefreshperiod) +- [ADMX_Netlogon/Netlogon_DebugFlag](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-debugflag) +- [ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsavoidregisterrecords) +- [ADMX_Netlogon/Netlogon_DnsRefreshInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsrefreshinterval) +- [ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnssrvrecorduselowercasehostnames) +- [ADMX_Netlogon/Netlogon_DnsTtl](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsttl) +- [ADMX_Netlogon/Netlogon_ExpectedDialupDelay](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-expecteddialupdelay) +- [ADMX_Netlogon/Netlogon_ForceRediscoveryInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-forcerediscoveryinterval) +- [ADMX_Netlogon/Netlogon_GcSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-gcsitecoverage) +- [ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ignoreincomingmailslotmessages) +- [ADMX_Netlogon/Netlogon_LdapSrvPriority](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvpriority) +- [ADMX_Netlogon/Netlogon_LdapSrvWeight](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvweight) +- [ADMX_Netlogon/Netlogon_MaximumLogFileSize](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-maximumlogfilesize) +- [ADMX_Netlogon/Netlogon_NdncSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ndncsitecoverage) +- [ADMX_Netlogon/Netlogon_NegativeCachePeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-negativecacheperiod) +- [ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-netlogonsharecompatibilitymode) +- [ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-nonbackgroundsuccessfulrefreshperiod) +- [ADMX_Netlogon/Netlogon_PingUrgencyMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-pingurgencymode) +- [ADMX_Netlogon/Netlogon_ScavengeInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-scavengeinterval) +- [ADMX_Netlogon/Netlogon_SiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitecoverage) +- [ADMX_Netlogon/Netlogon_SiteName](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitename) +- [ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sysvolsharecompatibilitymode) +- [ADMX_Netlogon/Netlogon_TryNextClosestSite](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-trynextclosestsite) +- [ADMX_Netlogon/Netlogon_UseDynamicDns](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-usedynamicdns) +- [ADMX_NetworkConnections/NC_AddRemoveComponents](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-addremovecomponents) +- [ADMX_NetworkConnections/NC_AdvancedSettings](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-advancedsettings) +- [ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-allowadvancedtcpipconfig) +- [ADMX_NetworkConnections/NC_ChangeBindState](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-changebindstate) +- [ADMX_NetworkConnections/NC_DeleteAllUserConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deletealluserconnection) +- [ADMX_NetworkConnections/NC_DeleteConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deleteconnection) +- [ADMX_NetworkConnections/NC_DialupPrefs](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-dialupprefs) +- [ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-donotshowlocalonlyicon) +- [ADMX_NetworkConnections/NC_EnableAdminProhibits](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-enableadminprohibits) +- [ADMX_NetworkConnections/NC_ForceTunneling](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-forcetunneling) +- [ADMX_NetworkConnections/NC_IpStateChecking](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-ipstatechecking) +- [ADMX_NetworkConnections/NC_LanChangeProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanchangeproperties) +- [ADMX_NetworkConnections/NC_LanConnect](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanconnect) +- [ADMX_NetworkConnections/NC_LanProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanproperties) +- [ADMX_NetworkConnections/NC_NewConnectionWizard](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-newconnectionwizard) +- [ADMX_NetworkConnections/NC_PersonalFirewallConfig](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-personalfirewallconfig) +- [ADMX_NetworkConnections/NC_RasAllUserProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasalluserproperties) +- [ADMX_NetworkConnections/NC_RasChangeProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-raschangeproperties) +- [ADMX_NetworkConnections/NC_RasConnect](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasconnect) +- [ADMX_NetworkConnections/NC_RasMyProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasmyproperties) +- [ADMX_NetworkConnections/NC_RenameAllUserRasConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamealluserrasconnection) +- [ADMX_NetworkConnections/NC_RenameConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renameconnection) +- [ADMX_NetworkConnections/NC_RenameLanConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamelanconnection) +- [ADMX_NetworkConnections/NC_RenameMyRasConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamemyrasconnection) +- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) +- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) +- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) +- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) +- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) +- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) +- [ADMX_OfflineFiles/Pol_BackgroundSyncSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-backgroundsyncsettings) +- [ADMX_OfflineFiles/Pol_CacheSize](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-cachesize) +- [ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-1) +- [ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-2) +- [ADMX_OfflineFiles/Pol_DefCacheSize](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-defcachesize) +- [ADMX_OfflineFiles/Pol_Enabled](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-enabled) +- [ADMX_OfflineFiles/Pol_EncryptOfflineFiles](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-encryptofflinefiles) +- [ADMX_OfflineFiles/Pol_EventLoggingLevel_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-1) +- [ADMX_OfflineFiles/Pol_EventLoggingLevel_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-2) +- [ADMX_OfflineFiles/Pol_ExclusionListSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-exclusionlistsettings) +- [ADMX_OfflineFiles/Pol_ExtExclusionList](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-extexclusionlist) +- [ADMX_OfflineFiles/Pol_GoOfflineAction_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-1) +- [ADMX_OfflineFiles/Pol_GoOfflineAction_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-2) +- [ADMX_OfflineFiles/Pol_NoCacheViewer_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-1) +- [ADMX_OfflineFiles/Pol_NoCacheViewer_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-2) +- [ADMX_OfflineFiles/Pol_NoConfigCache_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-1) +- [ADMX_OfflineFiles/Pol_NoConfigCache_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-2) +- [ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-1) +- [ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-2) +- [ADMX_OfflineFiles/Pol_NoPinFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-1) +- [ADMX_OfflineFiles/Pol_NoPinFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-2) +- [ADMX_OfflineFiles/Pol_NoReminders_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-1) +- [ADMX_OfflineFiles/Pol_NoReminders_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-2) +- [ADMX_OfflineFiles/Pol_OnlineCachingSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-onlinecachingsettings) +- [ADMX_OfflineFiles/Pol_PurgeAtLogoff](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-purgeatlogoff) +- [ADMX_OfflineFiles/Pol_QuickAdimPin](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-quickadimpin) +- [ADMX_OfflineFiles/Pol_ReminderFreq_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-1) +- [ADMX_OfflineFiles/Pol_ReminderFreq_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-2) +- [ADMX_OfflineFiles/Pol_ReminderInitTimeout_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-1) +- [ADMX_OfflineFiles/Pol_ReminderInitTimeout_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-2) +- [ADMX_OfflineFiles/Pol_ReminderTimeout_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-1) +- [ADMX_OfflineFiles/Pol_ReminderTimeout_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-2) +- [ADMX_OfflineFiles/Pol_SlowLinkSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinksettings) +- [ADMX_OfflineFiles/Pol_SlowLinkSpeed](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinkspeed) +- [ADMX_OfflineFiles/Pol_SyncAtLogoff_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-1) +- [ADMX_OfflineFiles/Pol_SyncAtLogoff_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-2) +- [ADMX_OfflineFiles/Pol_SyncAtLogon_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-1) +- [ADMX_OfflineFiles/Pol_SyncAtLogon_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-2) +- [ADMX_OfflineFiles/Pol_SyncAtSuspend_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-1) +- [ADMX_OfflineFiles/Pol_SyncAtSuspend_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-2) +- [ADMX_OfflineFiles/Pol_SyncOnCostedNetwork](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-synconcostednetwork) +- [ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-1) +- [ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-2) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-distributed) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hosted) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedcachediscovery) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedmultipleservers) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-smb) +- [ADMX_PeerToPeerCaching/SetCachePercent](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setcachepercent) +- [ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdatacacheentrymaxage) +- [ADMX_PeerToPeerCaching/SetDowngrading](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdowngrading) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-1) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-2) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-3) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-4) +- [ADMX_PowerShellExecutionPolicy/EnableModuleLogging](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablemodulelogging) +- [ADMX_PowerShellExecutionPolicy/EnableScripts](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) +- [ADMX_PowerShellExecutionPolicy/EnableTranscripting](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) +- [ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) +- [ADMX_Programs/NoDefaultPrograms](./policy-csp-admx-programs.md#admx-programs-nodefaultprograms) +- [ADMX_Programs/NoGetPrograms](./policy-csp-admx-programs.md#admx-programs-nogetprograms) +- [ADMX_Programs/NoInstalledUpdates](./policy-csp-admx-programs.md#admx-programs-noinstalledupdates) +- [ADMX_Programs/NoProgramsAndFeatures](./policy-csp-admx-programs.md#admx-programs-noprogramsandfeatures) +- [ADMX_Programs/NoProgramsCPL](./policy-csp-admx-programs.md#admx-programs-noprogramscpl) +- [ADMX_Programs/NoWindowsFeatures](./policy-csp-admx-programs.md#admx-programs-nowindowsfeatures) +- [ADMX_Programs/NoWindowsMarketplace](./policy-csp-admx-programs.md#admx-programs-nowindowsmarketplace) +- [ADMX_Reliability/EE_EnablePersistentTimeStamp](./policy-csp-admx-reliability.md#admx-reliability-ee-enablepersistenttimestamp) +- [ADMX_Reliability/PCH_ReportShutdownEvents](./policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) +- [ADMX_Reliability/ShutdownEventTrackerStateFile](./policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) +- [ADMX_Reliability/ShutdownReason](./policy-csp-admx-reliability.md#admx-reliability-shutdownreason) +- [ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled](./policy-csp-admx-scripts.md#admx-scripts-allow-logon-script-netbiosdisabled) +- [ADMX_Scripts/MaxGPOScriptWaitPolicy](./policy-csp-admx-scripts.md#admx-scripts-maxgposcriptwaitpolicy) +- [ADMX_Scripts/Run_Computer_PS_Scripts_First](./policy-csp-admx-scripts.md#admx-scripts-run-computer-ps-scripts-first) +- [ADMX_Scripts/Run_Legacy_Logon_Script_Hidden](./policy-csp-admx-scripts.md#admx-scripts-run-legacy-logon-script-hidden) +- [ADMX_Scripts/Run_Logoff_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-logoff-script-visible) +- [ADMX_Scripts/Run_Logon_Script_Sync_1](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-1) +- [ADMX_Scripts/Run_Logon_Script_Sync_2](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-2) +- [ADMX_Scripts/Run_Logon_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-visible) +- [ADMX_Scripts/Run_Shutdown_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-shutdown-script-visible) +- [ADMX_Scripts/Run_Startup_Script_Sync](./policy-csp-admx-scripts.md#admx-scripts-run-startup-script-sync) +- [ADMX_Scripts/Run_Startup_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-startup-script-visible) +- [ADMX_Scripts/Run_User_PS_Scripts_First](./policy-csp-admx-scripts.md#admx-scripts-run-user-ps-scripts-first) +- [ADMX_sdiageng/BetterWhenConnected](./policy-csp-admx-sdiageng.md#admx-sdiageng-betterwhenconnected) +- [ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticsexecutionpolicy) +- [ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticssecuritypolicy) +- [ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain](/policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain) +- [ADMX_Sensors/DisableLocationScripting_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-1) +- [ADMX_Sensors/DisableLocationScripting_2](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-2) +- [ADMX_Sensors/DisableLocation_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocation-1) +- [ADMX_Sensors/DisableSensors_1](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-1) +- [ADMX_Sensors/DisableSensors_2](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-2) +- [ADMX_Servicing/Servicing](./policy-csp-admx-servicing.md#admx-servicing-servicing) +- [ADMX_SettingSync/DisableAppSyncSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableappsyncsettingsync) +- [ADMX_SettingSync/DisableApplicationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableapplicationsettingsync) +- [ADMX_SettingSync/DisableCredentialsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablecredentialssettingsync) +- [ADMX_SettingSync/DisableDesktopThemeSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disabledesktopthemesettingsync) +- [ADMX_SettingSync/DisablePersonalizationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablepersonalizationsettingsync) +- [ADMX_SettingSync/DisableSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablesettingsync) +- [ADMX_SettingSync/DisableStartLayoutSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablestartlayoutsettingsync) +- [ADMX_SettingSync/DisableSyncOnPaidNetwork](./policy-csp-admx-settingsync.md#admx-settingsync-disablesynconpaidnetwork) +- [ADMX_SettingSync/DisableWindowsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablewindowssettingsync) +- [ADMX_SharedFolders/PublishDfsRoots](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishdfsroots) +- [ADMX_SharedFolders/PublishSharedFolders](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishsharedfolders) +- [ADMX_Sharing/NoInplaceSharing](./policy-csp-admx-sharing.md#admx-sharing-noinplacesharing) +- [ADMX_ShellCommandPromptRegEditTools/DisableCMD](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) +- [ADMX_ShellCommandPromptRegEditTools/DisableRegedit](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disableregedit) +- [ADMX_ShellCommandPromptRegEditTools/DisallowApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disallowapps) +- [ADMX_ShellCommandPromptRegEditTools/RestrictApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) +- [ADMX_Smartcard/AllowCertificatesWithNoEKU](./policy-csp-admx-smartcard.md#admx-smartcard-allowcertificateswithnoeku) +- [ADMX_Smartcard/AllowIntegratedUnblock](./policy-csp-admx-smartcard.md#admx-smartcard-allowintegratedunblock) +- [ADMX_Smartcard/AllowSignatureOnlyKeys](./policy-csp-admx-smartcard.md#admx-smartcard-allowsignatureonlykeys) +- [ADMX_Smartcard/AllowTimeInvalidCertificates](./policy-csp-admx-smartcard.md#admx-smartcard-allowtimeinvalidcertificates) +- [ADMX_Smartcard/CertPropEnabledString](./policy-csp-admx-smartcard.md#admx-smartcard-certpropenabledstring) +- [ADMX_Smartcard/CertPropRootCleanupString](./policy-csp-admx-smartcard.md#admx-smartcard-certproprootcleanupstring) +- [ADMX_Smartcard/CertPropRootEnabledString](./policy-csp-admx-smartcard.md#admx-smartcard-certproprootenabledstring) +- [ADMX_Smartcard/DisallowPlaintextPin](./policy-csp-admx-smartcard.md#admx-smartcard-disallowplaintextpin) +- [ADMX_Smartcard/EnumerateECCCerts](./policy-csp-admx-smartcard.md#admx-smartcard-enumerateecccerts) +- [ADMX_Smartcard/FilterDuplicateCerts](./policy-csp-admx-smartcard.md#admx-smartcard-filterduplicatecerts) +- [ADMX_Smartcard/ForceReadingAllCertificates](./policy-csp-admx-smartcard.md#admx-smartcard-forcereadingallcertificates) +- [ADMX_Smartcard/IntegratedUnblockPromptString](./policy-csp-admx-smartcard.md#admx-smartcard-integratedunblockpromptstring) +- [ADMX_Smartcard/ReverseSubject](./policy-csp-admx-smartcard.md#admx-smartcard-reversesubject) +- [ADMX_Smartcard/SCPnPEnabled](./policy-csp-admx-smartcard.md#admx-smartcard-scpnpenabled) +- [ADMX_Smartcard/SCPnPNotification](./policy-csp-admx-smartcard.md#admx-smartcard-scpnpnotification) +- [ADMX_Smartcard/X509HintsNeeded](./policy-csp-admx-smartcard.md#admx-smartcard-x509hintsneeded) +- [ADMX_Snmp/SNMP_Communities](./policy-csp-admx-snmp.md#admx-snmp-snmp-communities) +- [ADMX_Snmp/SNMP_PermittedManagers](./policy-csp-admx-snmp.md#admx-snmp-snmp-permittedmanagers) +- [ADMX_Snmp/SNMP_Traps_Public](./policy-csp-admx-snmp.md#admx-snmp-snmp-traps-public) +- [ADMX_StartMenu/AddSearchInternetLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-addsearchinternetlinkinstartmenu) +- [ADMX_StartMenu/ClearRecentDocsOnExit](./policy-csp-admx-startmenu.md#admx-startmenu-clearrecentdocsonexit) +- [ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-clearrecentprogfornewuserinstartmenu) +- [ADMX_StartMenu/ClearTilesOnExit](./policy-csp-admx-startmenu.md#admx-startmenu-cleartilesonexit) +- [ADMX_StartMenu/DesktopAppsFirstInAppsView](./policy-csp-admx-startmenu.md#admx-startmenu-desktopappsfirstinappsview) +- [ADMX_StartMenu/DisableGlobalSearchOnAppsView](./policy-csp-admx-startmenu.md#admx-startmenu-disableglobalsearchonappsview) +- [ADMX_StartMenu/ForceStartMenuLogOff](./policy-csp-admx-startmenu.md#admx-startmenu-forcestartmenulogoff) +- [ADMX_StartMenu/GoToDesktopOnSignIn](./policy-csp-admx-startmenu.md#admx-startmenu-gotodesktoponsignin) +- [ADMX_StartMenu/GreyMSIAds](./policy-csp-admx-startmenu.md#admx-startmenu-greymsiads) +- [ADMX_StartMenu/HidePowerOptions](./policy-csp-admx-startmenu.md#admx-startmenu-hidepoweroptions) +- [ADMX_StartMenu/Intellimenus](./policy-csp-admx-startmenu.md#admx-startmenu-intellimenus) +- [ADMX_StartMenu/LockTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-locktaskbar) +- [ADMX_StartMenu/MemCheckBoxInRunDlg](./policy-csp-admx-startmenu.md#admx-startmenu-memcheckboxinrundlg) +- [ADMX_StartMenu/NoAutoTrayNotify](./policy-csp-admx-startmenu.md#admx-startmenu-noautotraynotify) +- [ADMX_StartMenu/NoBalloonTip](./policy-csp-admx-startmenu.md#admx-startmenu-noballoontip) +- [ADMX_StartMenu/NoChangeStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nochangestartmenu) +- [ADMX_StartMenu/NoClose](./policy-csp-admx-startmenu.md#admx-startmenu-noclose) +- [ADMX_StartMenu/NoCommonGroups](./policy-csp-admx-startmenu.md#admx-startmenu-nocommongroups) +- [ADMX_StartMenu/NoFavoritesMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nofavoritesmenu) +- [ADMX_StartMenu/NoFind](./policy-csp-admx-startmenu.md#admx-startmenu-nofind) +- [ADMX_StartMenu/NoGamesFolderOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nogamesfolderonstartmenu) +- [ADMX_StartMenu/NoHelp](./policy-csp-admx-startmenu.md#admx-startmenu-nohelp) +- [ADMX_StartMenu/NoInstrumentation](./policy-csp-admx-startmenu.md#admx-startmenu-noinstrumentation) +- [ADMX_StartMenu/NoMoreProgramsList](./policy-csp-admx-startmenu.md#admx-startmenu-nomoreprogramslist) +- [ADMX_StartMenu/NoNetAndDialupConnect](./policy-csp-admx-startmenu.md#admx-startmenu-nonetanddialupconnect) +- [ADMX_StartMenu/NoPinnedPrograms](./policy-csp-admx-startmenu.md#admx-startmenu-nopinnedprograms) +- [ADMX_StartMenu/NoRecentDocsMenu](./policy-csp-admx-startmenu.md#admx-startmenu-norecentdocsmenu) +- [ADMX_StartMenu/NoResolveSearch](./policy-csp-admx-startmenu.md#admx-startmenu-noresolvesearch) +- [ADMX_StartMenu/NoResolveTrack](./policy-csp-admx-startmenu.md#admx-startmenu-noresolvetrack) +- [ADMX_StartMenu/NoRun](./policy-csp-admx-startmenu.md#admx-startmenu-norun) +- [ADMX_StartMenu/NoSMConfigurePrograms](./policy-csp-admx-startmenu.md#admx-startmenu-nosmconfigureprograms) +- [ADMX_StartMenu/NoSMMyDocuments](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmydocuments) +- [ADMX_StartMenu/NoSMMyMusic](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmymusic) +- [ADMX_StartMenu/NoSMMyNetworkPlaces](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmynetworkplaces) +- [ADMX_StartMenu/NoSMMyPictures](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmypictures) +- [ADMX_StartMenu/NoSearchCommInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomminstartmenu) +- [ADMX_StartMenu/NoSearchComputerLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomputerlinkinstartmenu) +- [ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearcheverywherelinkinstartmenu) +- [ADMX_StartMenu/NoSearchFilesInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchfilesinstartmenu) +- [ADMX_StartMenu/NoSearchInternetInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchinternetinstartmenu) +- [ADMX_StartMenu/NoSearchProgramsInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchprogramsinstartmenu) +- [ADMX_StartMenu/NoSetFolders](./policy-csp-admx-startmenu.md#admx-startmenu-nosetfolders) +- [ADMX_StartMenu/NoSetTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-nosettaskbar) +- [ADMX_StartMenu/NoStartMenuDownload](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenudownload) +- [ADMX_StartMenu/NoStartMenuHomegroup](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuhomegroup) +- [ADMX_StartMenu/NoStartMenuRecordedTV](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenurecordedtv) +- [ADMX_StartMenu/NoStartMenuSubFolders](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenusubfolders) +- [ADMX_StartMenu/NoStartMenuVideos](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuvideos) +- [ADMX_StartMenu/NoStartPage](./policy-csp-admx-startmenu.md#admx-startmenu-nostartpage) +- [ADMX_StartMenu/NoTaskBarClock](./policy-csp-admx-startmenu.md#admx-startmenu-notaskbarclock) +- [ADMX_StartMenu/NoTaskGrouping](./policy-csp-admx-startmenu.md#admx-startmenu-notaskgrouping) +- [ADMX_StartMenu/NoToolbarsOnTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-notoolbarsontaskbar) +- [ADMX_StartMenu/NoTrayContextMenu](./policy-csp-admx-startmenu.md#admx-startmenu-notraycontextmenu) +- [ADMX_StartMenu/NoTrayItemsDisplay](./policy-csp-admx-startmenu.md#admx-startmenu-notrayitemsdisplay) +- [ADMX_StartMenu/NoUninstallFromStart](./policy-csp-admx-startmenu.md#admx-startmenu-nouninstallfromstart) +- [ADMX_StartMenu/NoUserFolderOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nouserfolderonstartmenu) +- [ADMX_StartMenu/NoUserNameOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nousernameonstartmenu) +- [ADMX_StartMenu/NoWindowsUpdate](./policy-csp-admx-startmenu.md#admx-startmenu-nowindowsupdate) +- [ADMX_StartMenu/PowerButtonAction](./policy-csp-admx-startmenu.md#admx-startmenu-powerbuttonaction) +- [ADMX_StartMenu/QuickLaunchEnabled](./policy-csp-admx-startmenu.md#admx-startmenu-quicklaunchenabled) +- [ADMX_StartMenu/RemoveUnDockPCButton](./policy-csp-admx-startmenu.md#admx-startmenu-removeundockpcbutton) +- [ADMX_StartMenu/ShowAppsViewOnStart](./policy-csp-admx-startmenu.md#admx-startmenu-showappsviewonstart) +- [ADMX_StartMenu/ShowRunAsDifferentUserInStart](./policy-csp-admx-startmenu.md#admx-startmenu-showrunasdifferentuserinstart) +- [ADMX_StartMenu/ShowRunInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-showruninstartmenu) +- [ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey](./policy-csp-admx-startmenu.md#admx-startmenu-showstartondisplaywithforegroundonwinkey) +- [ADMX_StartMenu/StartMenuLogOff](./policy-csp-admx-startmenu.md#admx-startmenu-startmenulogoff) +- [ADMX_StartMenu/StartPinAppsWhenInstalled](./policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) +- [ADMX_SystemRestore/SR_DisableConfig](./policy-csp-admx-systemrestore.md#admx-systemrestore-sr-disableconfig) +- [ADMX_Taskbar/DisableNotificationCenter](./policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) +- [ADMX_Taskbar/EnableLegacyBalloonNotifications](./policy-csp-admx-taskbar.md#admx-taskbar-enablelegacyballoonnotifications) +- [ADMX_Taskbar/HideSCAHealth](./policy-csp-admx-taskbar.md#admx-taskbar-hidescahealth) +- [ADMX_Taskbar/HideSCANetwork](./policy-csp-admx-taskbar.md#admx-taskbar-hidescanetwork) +- [ADMX_Taskbar/HideSCAPower](./policy-csp-admx-taskbar.md#admx-taskbar-hidescapower) +- [ADMX_Taskbar/HideSCAVolume](./policy-csp-admx-taskbar.md#admx-taskbar-hidescavolume) +- [ADMX_Taskbar/NoBalloonFeatureAdvertisements](./policy-csp-admx-taskbar.md#admx-taskbar-noballoonfeatureadvertisements) +- [ADMX_Taskbar/NoPinningStoreToTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningstoretotaskbar) +- [ADMX_Taskbar/NoPinningToDestinations](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningtodestinations) +- [ADMX_Taskbar/NoPinningToTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningtotaskbar) +- [ADMX_Taskbar/NoRemoteDestinations](./policy-csp-admx-taskbar.md#admx-taskbar-noremotedestinations) +- [ADMX_Taskbar/NoSystraySystemPromotion](./policy-csp-admx-taskbar.md#admx-taskbar-nosystraysystempromotion) +- [ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-showwindowsstoreappsontaskbar) +- [ADMX_Taskbar/TaskbarLockAll](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarlockall) +- [ADMX_Taskbar/TaskbarNoAddRemoveToolbar](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoaddremovetoolbar) +- [ADMX_Taskbar/TaskbarNoDragToolbar](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnodragtoolbar) +- [ADMX_Taskbar/TaskbarNoMultimon](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnomultimon) +- [ADMX_Taskbar/TaskbarNoNotification](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnonotification) +- [ADMX_Taskbar/TaskbarNoPinnedList](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnopinnedlist) +- [ADMX_Taskbar/TaskbarNoRedock](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoredock) +- [ADMX_Taskbar/TaskbarNoResize](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoresize) +- [ADMX_Taskbar/TaskbarNoThumbnail](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnothumbnail) +- [ADMX_tcpip/6to4_Router_Name](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name) +- [ADMX_tcpip/6to4_Router_Name_Resolution_Interval](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name-resolution-interval) +- [ADMX_tcpip/6to4_State](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-state) +- [ADMX_tcpip/IPHTTPS_ClientState](./policy-csp-admx-tcpip.md#admx-tcpip-iphttps-clientstate) +- [ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State](./policy-csp-admx-tcpip.md#admx-tcpip-ip-stateless-autoconfiguration-limits-state) +- [ADMX_tcpip/ISATAP_Router_Name](./policy-csp-admx-tcpip.md#admx-tcpip-isatap-router-name) +- [ADMX_tcpip/ISATAP_State](./policy-csp-admx-tcpip.md#admx-tcpip-isatap-state) +- [ADMX_tcpip/Teredo_Client_Port](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-client-port) +- [ADMX_tcpip/Teredo_Default_Qualified](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-default-qualified) +- [ADMX_tcpip/Teredo_Refresh_Rate](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-refresh-rate) +- [ADMX_tcpip/Teredo_Server_Name](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-server-name) +- [ADMX_tcpip/Teredo_State](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-state) +- [ADMX_tcpip/Windows_Scaling_Heuristics_State](./policy-csp-admx-tcpip.md#admx-tcpip-windows-scaling-heuristics-state) +- [ADMX_Thumbnails/DisableThumbnails](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnails) +- [ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnailsonnetworkfolders) +- [ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbsdbonnetworkfolders) +- [ADMX_TPM/BlockedCommandsList_Name](./policy-csp-admx-tpm.md#admx-tpm-blockedcommandslist-name) +- [ADMX_TPM/ClearTPMIfNotReady_Name](./policy-csp-admx-tpm.md#admx-tpm-cleartpmifnotready-name) +- [ADMX_TPM/IgnoreDefaultList_Name](./policy-csp-admx-tpm.md#admx-tpm-ignoredefaultlist-name) +- [ADMX_TPM/IgnoreLocalList_Name](./policy-csp-admx-tpm.md#admx-tpm-ignorelocallist-name) +- [ADMX_TPM/OSManagedAuth_Name](./policy-csp-admx-tpm.md#admx-tpm-osmanagedauth-name) +- [ADMX_TPM/OptIntoDSHA_Name](./policy-csp-admx-tpm.md#admx-tpm-optintodsha-name) +- [ADMX_TPM/StandardUserAuthorizationFailureDuration_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureduration-name) +- [ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureindividualthreshold-name) +- [ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailuretotalthreshold-name) +- [ADMX_TPM/UseLegacyDAP_Name](./policy-csp-admx-tpm.md#admx-tpm-uselegacydap-name) +- [ADMX_UserExperienceVirtualization/Calculator](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-calculator) +- [ADMX_UserExperienceVirtualization/ConfigureSyncMethod](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configuresyncmethod) +- [ADMX_UserExperienceVirtualization/ConfigureVdi](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configurevdi) +- [ADMX_UserExperienceVirtualization/ContactITDescription](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactitdescription) +- [ADMX_UserExperienceVirtualization/ContactITUrl](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactiturl) +- [ADMX_UserExperienceVirtualization/DisableWin8Sync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewin8sync) +- [ADMX_UserExperienceVirtualization/DisableWindowsOSSettings](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewindowsossettings) +- [ADMX_UserExperienceVirtualization/EnableUEV](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-enableuev) +- [ADMX_UserExperienceVirtualization/Finance](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-finance) +- [ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-firstusenotificationenabled) +- [ADMX_UserExperienceVirtualization/Games](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-games) +- [ADMX_UserExperienceVirtualization/InternetExplorer8](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer8) +- [ADMX_UserExperienceVirtualization/InternetExplorer9](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer9) +- [ADMX_UserExperienceVirtualization/InternetExplorer10](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer10) +- [ADMX_UserExperienceVirtualization/InternetExplorer11](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer11) +- [ADMX_UserExperienceVirtualization/InternetExplorerCommon](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorercommon) +- [ADMX_UserExperienceVirtualization/Maps](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maps) +- [ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maxpackagesizeinbytes) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010access) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010common) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010excel) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010infopath) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010lync) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010onenote) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010outlook) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010powerpoint) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010project) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010publisher) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010visio) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010word) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013access) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013accessbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013common) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013commonbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excel) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excelbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopath) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lync) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenote) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlook) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpoint) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013project) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013projectbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisher) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visio) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visiobackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013word) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013wordbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016access) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016accessbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016common) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016commonbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excel) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excelbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lync) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenote) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlook) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpoint) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016project) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016projectbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisher) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visio) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visiobackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016word) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016wordbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365infopath2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2016) +- [ADMX_UserExperienceVirtualization/Music](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-music) +- [ADMX_UserExperienceVirtualization/News](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-news) +- [ADMX_UserExperienceVirtualization/Notepad](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-notepad) +- [ADMX_UserExperienceVirtualization/Reader](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-reader) +- [ADMX_UserExperienceVirtualization/RepositoryTimeout](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-repositorytimeout) +- [ADMX_UserExperienceVirtualization/SettingsStoragePath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingsstoragepath) +- [ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingstemplatecatalogpath) +- [ADMX_UserExperienceVirtualization/Sports](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-sports) +- [ADMX_UserExperienceVirtualization/SyncEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncenabled) +- [ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetwork) +- [ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming) +- [ADMX_UserExperienceVirtualization/SyncProviderPingEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncproviderpingenabled) +- [ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncunlistedwindows8apps) +- [ADMX_UserExperienceVirtualization/Travel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-travel) +- [ADMX_UserExperienceVirtualization/TrayIconEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-trayiconenabled) +- [ADMX_UserExperienceVirtualization/Video](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video) +- [ADMX_UserExperienceVirtualization/Weather](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather) +- [ADMX_UserExperienceVirtualization/Wordpad](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad) +- [ADMX_UserProfiles/CleanupProfiles](./policy-csp-admx-userprofiles.md#admx-userprofiles-cleanupprofiles) +- [ADMX_UserProfiles/DontForceUnloadHive](./policy-csp-admx-userprofiles.md#admx-userprofiles-dontforceunloadhive) +- [ADMX_UserProfiles/LeaveAppMgmtData](./policy-csp-admx-userprofiles.md#admx-userprofiles-leaveappmgmtdata) +- [ADMX_UserProfiles/LimitSize](./policy-csp-admx-userprofiles.md#admx-userprofiles-limitsize) +- [ADMX_UserProfiles/ProfileErrorAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-profileerroraction) +- [ADMX_UserProfiles/SlowLinkTimeOut](./policy-csp-admx-userprofiles.md#admx-userprofiles-slowlinktimeout) +- [ADMX_UserProfiles/USER_HOME](./policy-csp-admx-userprofiles.md#admx-userprofiles-user-home) +- [ADMX_UserProfiles/UserInfoAccessAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-userinfoaccessaction) +- [ADMX_W32Time/W32TIME_POLICY_CONFIG](./policy-csp-admx-w32time.md#admx-w32time-policy-config) +- [ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-configure-ntpclient) +- [ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-enable-ntpclient) +- [ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER](./policy-csp-admx-w32time.md#admx-w32time-policy-enable-ntpserver) +- [ADMX_WCM/WCM_DisablePowerManagement](./policy-csp-admx-wcm.md#admx-wcm-wcm-disablepowermanagement) +- [ADMX_WCM/WCM_EnableSoftDisconnect](./policy-csp-admx-wcm.md#admx-wcm-wcm-enablesoftdisconnect) +- [ADMX_WCM/WCM_MinimizeConnections](./policy-csp-admx-wcm.md#admx-wcm-wcm-minimizeconnections) +- [ADMX_WinCal/TurnOffWinCal_1](./policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-1) +- [ADMX_WinCal/TurnOffWinCal_2](./policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-2) +- [ADMX_WindowsAnytimeUpgrade/Disabled](./policy-csp-admx-windowsanytimeupgrade.md#admx-windowsanytimeupgrade-disabled) +- [ADMX_WindowsConnectNow/WCN_DisableWcnUi_1](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-1) +- [ADMX_WindowsConnectNow/WCN_DisableWcnUi_2](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-2) +- [ADMX_WindowsConnectNow/WCN_EnableRegistrar](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-enableregistrar) +- [ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-checksamesourceandtargetforfranddfs) +- [ADMX_WindowsExplorer/ClassicShell](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-classicshell) +- [ADMX_WindowsExplorer/ConfirmFileDelete](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-confirmfiledelete) +- [ADMX_WindowsExplorer/DefaultLibrariesLocation](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-defaultlibrarieslocation) +- [ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablebinddirectlytopropertysetstorage) +- [ADMX_WindowsExplorer/DisableIndexedLibraryExperience](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableindexedlibraryexperience) +- [ADMX_WindowsExplorer/DisableKnownFolders](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableknownfolders) +- [ADMX_WindowsExplorer/DisableSearchBoxSuggestions](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablesearchboxsuggestions) +- [ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enableshellshortcuticonremotepath) +- [ADMX_WindowsExplorer/EnableSmartScreen](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enablesmartscreen) +- [ADMX_WindowsExplorer/EnforceShellExtensionSecurity](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enforceshellextensionsecurity) +- [ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-explorerribbonstartsminimized) +- [ADMX_WindowsExplorer/HideContentViewModeSnippets](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-hidecontentviewmodesnippets) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restricted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trusted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachine) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restricted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trusted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown) +- [ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-linkresolveignorelinkinfo) +- [ADMX_WindowsExplorer/MaxRecentDocs](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-maxrecentdocs) +- [ADMX_WindowsExplorer/NoBackButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nobackbutton) +- [ADMX_WindowsExplorer/NoCDBurning](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocdburning) +- [ADMX_WindowsExplorer/NoCacheThumbNailPictures](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocachethumbnailpictures) +- [ADMX_WindowsExplorer/NoChangeAnimation](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangeanimation) +- [ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangekeyboardnavigationindicators) +- [ADMX_WindowsExplorer/NoDFSTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodfstab) +- [ADMX_WindowsExplorer/NoDrives](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodrives) +- [ADMX_WindowsExplorer/NoEntireNetwork](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noentirenetwork) +- [ADMX_WindowsExplorer/NoFileMRU](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemru) +- [ADMX_WindowsExplorer/NoFileMenu](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemenu) +- [ADMX_WindowsExplorer/NoFolderOptions](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofolderoptions) +- [ADMX_WindowsExplorer/NoHardwareTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nohardwaretab) +- [ADMX_WindowsExplorer/NoManageMyComputerVerb](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomanagemycomputerverb) +- [ADMX_WindowsExplorer/NoMyComputerSharedDocuments](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomycomputershareddocuments) +- [ADMX_WindowsExplorer/NoNetConnectDisconnect](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonetconnectdisconnect) +- [ADMX_WindowsExplorer/NoNewAppAlert](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonewappalert) +- [ADMX_WindowsExplorer/NoPlacesBar](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noplacesbar) +- [ADMX_WindowsExplorer/NoRecycleFiles](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norecyclefiles) +- [ADMX_WindowsExplorer/NoRunAsInstallPrompt](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norunasinstallprompt) +- [ADMX_WindowsExplorer/NoSearchInternetTryHarderButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosearchinternettryharderbutton) +- [ADMX_WindowsExplorer/NoSecurityTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosecuritytab) +- [ADMX_WindowsExplorer/NoShellSearchButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noshellsearchbutton) +- [ADMX_WindowsExplorer/NoStrCmpLogical](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nostrcmplogical) +- [ADMX_WindowsExplorer/NoViewContextMenu](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewcontextmenu) +- [ADMX_WindowsExplorer/NoViewOnDrive](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewondrive) +- [ADMX_WindowsExplorer/NoWindowsHotKeys](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nowindowshotkeys) +- [ADMX_WindowsExplorer/NoWorkgroupContents](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noworkgroupcontents) +- [ADMX_WindowsExplorer/PlacesBar](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-placesbar) +- [ADMX_WindowsExplorer/PromptRunasInstallNetPath](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-promptrunasinstallnetpath) +- [ADMX_WindowsExplorer/RecycleBinSize](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-recyclebinsize) +- [ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-1) +- [ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-2) +- [ADMX_WindowsExplorer/ShowHibernateOption](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showhibernateoption) +- [ADMX_WindowsExplorer/ShowSleepOption](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showsleepoption) +- [ADMX_WindowsExplorer/TryHarderPinnedLibrary](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedlibrary) +- [ADMX_WindowsExplorer/TryHarderPinnedOpenSearch](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedopensearch) +- [ADMX_WindowsMediaDRM/DisableOnline](./policy-csp-admx-windowsmediadrm.md#admx-windowsmediadrm-disableonline) +- [ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurehttpproxysettings) +- [ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configuremmsproxysettings) +- [ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurertspproxysettings) +- [ADMX_WindowsMediaPlayer/DisableAutoUpdate](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disableautoupdate) +- [ADMX_WindowsMediaPlayer/DisableNetworkSettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablenetworksettings) +- [ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablesetupfirstuseconfiguration) +- [ADMX_WindowsMediaPlayer/DoNotShowAnchor](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-donotshowanchor) +- [ADMX_WindowsMediaPlayer/DontUseFrameInterpolation](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-dontuseframeinterpolation) +- [ADMX_WindowsMediaPlayer/EnableScreenSaver](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-enablescreensaver) +- [ADMX_WindowsMediaPlayer/HidePrivacyTab](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hideprivacytab) +- [ADMX_WindowsMediaPlayer/HideSecurityTab](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hidesecuritytab) +- [ADMX_WindowsMediaPlayer/NetworkBuffering](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-networkbuffering) +- [ADMX_WindowsMediaPlayer/PolicyCodecUpdate](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-policycodecupdate) +- [ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventcddvdmetadataretrieval) +- [ADMX_WindowsMediaPlayer/PreventLibrarySharing](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventlibrarysharing) +- [ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventmusicfilemetadataretrieval) +- [ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventquicklaunchshortcut) +- [ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventradiopresetsretrieval) +- [ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventwmpdesktopshortcut) +- [ADMX_WindowsMediaPlayer/SkinLockDown](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-skinlockdown) +- [ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-windowsstreamingmediaprotocols) +- [ADMX_WindowsStore/DisableAutoDownloadWin8](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableautodownloadwin8) +- [ADMX_WindowsStore/DisableOSUpgrade_1](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-1) +- [ADMX_WindowsStore/DisableOSUpgrade_2](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-2) +- [ADMX_WindowsStore/RemoveWindowsStore_1](./policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-1) +- [ADMX_WindowsStore/RemoveWindowsStore_2](./policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-2) +- [ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription](./policy-csp-admx-wininit.md#admx-wininit-disablenamedpipeshutdownpolicydescription) +- [ADMX_WinInit/Hiberboot](./policy-csp-admx-wininit.md#admx-wininit-hiberboot) +- [ADMX_WinInit/ShutdownTimeoutHungSessionsDescription](./policy-csp-admx-wininit.md#admx-wininit-shutdowntimeouthungsessionsdescription) +- [ADMX_WinLogon/CustomShell](./policy-csp-admx-winlogon.md#admx-winlogon-customshell) +- [ADMX_WinLogon/DisplayLastLogonInfoDescription](./policy-csp-admx-winlogon.md#admx-winlogon-displaylastlogoninfodescription) +- [ADMX_WinLogon/LogonHoursNotificationPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhoursnotificationpolicydescription) +- [ADMX_WinLogon/LogonHoursPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhourspolicydescription) +- [ADMX_WinLogon/ReportCachedLogonPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription) +- [ADMX_WinLogon/SoftwareSASGeneration](./policy-csp-admx-winlogon.md#admx-winlogon-softwaresasgeneration) +- [ADMX_wlansvc/SetCost](./policy-csp-admx-wlansvc.md#admx-wlansvc-setcost) +- [ADMX_wlansvc/SetPINEnforced](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinenforced) +- [ADMX_wlansvc/SetPINPreferred](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred) +- [ADMX_WPN/NoCallsDuringQuietHours](./policy-csp-admx-wpn.md#admx-wpn-nocallsduringquiethours) +- [ADMX_WPN/NoLockScreenToastNotification](./policy-csp-admx-wpn.md#admx-wpn-nolockscreentoastnotification) +- [ADMX_WPN/NoQuietHours](./policy-csp-admx-wpn.md#admx-wpn-noquiethours) +- [ADMX_WPN/NoToastNotification](./policy-csp-admx-wpn.md#admx-wpn-notoastnotification) +- [ADMX_WPN/QuietHoursDailyBeginMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailybeginminute) +- [ADMX_WPN/QuietHoursDailyEndMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailyendminute) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) +- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) +- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) +- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) +- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) +- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) +- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) +- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) +- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) +- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) +- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) +- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) +- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) +- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) +- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) +- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md new file mode 100644 index 0000000000..09c680512c --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -0,0 +1,910 @@ +--- +title: Policies in Policy CSP supported by Group Policy +description: Policies in Policy CSP supported by Group Policy +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP supported by Group Policy + +> [!div class="op_single_selector"] +> +> - [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +> - [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) +> + +- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) +- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) +- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) +- [ApplicationDefaults/EnableAppUriHandlers](./policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) +- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) +- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) +- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) +- [ApplicationManagement/MSIAllowUserControlOverInstall](./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) +- [ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges](./policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) +- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) +- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) +- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) +- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) +- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [BITS/BandwidthThrottlingEndTime](./policy-csp-bits.md#bits-bandwidththrottlingendtime) +- [BITS/BandwidthThrottlingStartTime](./policy-csp-bits.md#bits-bandwidththrottlingstarttime) +- [BITS/BandwidthThrottlingTransferRate](./policy-csp-bits.md#bits-bandwidththrottlingtransferrate) +- [BITS/CostedNetworkBehaviorBackgroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) +- [BITS/CostedNetworkBehaviorForegroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) +- [BITS/JobInactivityTimeout](./policy-csp-bits.md#bits-jobinactivitytimeout) +- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) +- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) +- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) +- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) +- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) +- [Browser/AllowFullScreenMode](./policy-csp-browser.md#browser-allowfullscreenmode) +- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) +- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) +- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowPrelaunch](./policy-csp-browser.md#browser-allowprelaunch) +- [Browser/AllowPrinting](./policy-csp-browser.md#browser-allowprinting) +- [Browser/AllowSavingHistory](./policy-csp-browser.md#browser-allowsavinghistory) +- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) +- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSideloadingOfExtensions](./policy-csp-browser.md#browser-allowsideloadingofextensions) +- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) +- [Browser/AllowTabPreloading](./policy-csp-browser.md#browser-allowtabpreloading) +- [Browser/AllowWebContentOnNewTabPage](./policy-csp-browser.md#browser-allowwebcontentonnewtabpage) +- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) +- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) +- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) +- [Browser/ConfigureFavoritesBar](./policy-csp-browser.md#browser-configurefavoritesbar) +- [Browser/ConfigureHomeButton](./policy-csp-browser.md#browser-configurehomebutton) +- [Browser/ConfigureKioskMode](./policy-csp-browser.md#browser-configurekioskmode) +- [Browser/ConfigureKioskResetAfterIdleTimeout](./policy-csp-browser.md#browser-configurekioskresetafteridletimeout) +- [Browser/ConfigureOpenMicrosoftEdgeWith](./policy-csp-browser.md#browser-configureopenmicrosoftedgewith) +- [Browser/ConfigureTelemetryForMicrosoft365Analytics](./policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) +- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) +- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) +- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) +- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) +- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) +- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) +- [Browser/PreventCertErrorOverrides](./policy-csp-browser.md#browser-preventcerterroroverrides) +- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) +- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) +- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) +- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) +- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) +- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) +- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) +- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) +- [Browser/SetHomeButtonURL](./policy-csp-browser.md#browser-sethomebuttonurl) +- [Browser/SetNewTabPageURL](./policy-csp-browser.md#browser-setnewtabpageurl) +- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) +- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) +- [Browser/UnlockHomeButton](./policy-csp-browser.md#browser-unlockhomebutton) +- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) +- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) +- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) +- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) +- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) +- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) +- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [Connectivity/AllowPhonePCLinking](./policy-csp-connectivity.md#connectivity-allowphonepclinking) +- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) +- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) +- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) +- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) +- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) +- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) +- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) +- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) +- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) +- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) +- [Defender/CheckForSignaturesBeforeRunningScan](./policy-csp-defender.md#defender-checkforsignaturesbeforerunningscan) +- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) +- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) +- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) +- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) +- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) +- [Defender/DisableCatchupFullScan](./policy-csp-defender.md#defender-disablecatchupfullscan) +- [Defender/DisableCatchupQuickScan](./policy-csp-defender.md#defender-disablecatchupquickscan) +- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) +- [Defender/EnableLowCPUPriority](./policy-csp-defender.md#defender-enablelowcpupriority) +- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) +- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) +- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) +- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) +- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) +- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) +- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) +- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) +- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) +- [Defender/SignatureUpdateFallbackOrder](./policy-csp-defender.md#defender-signatureupdatefallbackorder) +- [Defender/SignatureUpdateFileSharesSources](./policy-csp-defender.md#defender-signatureupdatefilesharessources) +- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) +- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) +- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) +- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) +- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) +- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) +- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) +- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) +- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) +- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) +- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) +- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) +- [DmaGuard/DeviceEnumerationPolicy](./policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) +- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) +- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [Experience/AllowClipboardHistory](./policy-csp-experience.md#experience-allowclipboardhistory) +- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) +- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) +- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) +- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) +- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) +- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) +- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) +- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) +- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) +- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) +- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) +- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) +- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) +- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) +- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) +- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) +- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) +- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) +- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [LanmanWorkstation/EnableInsecureGuestLogons](./policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) +- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) +- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) +- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) +- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) +- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) +- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) +- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) +- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) +- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) +- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) +- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) +- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) +- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) +- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) +- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) +- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) +- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) +- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) +- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) +- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) +- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) +- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) +- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) +- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) +- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) +- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) +- [Notifications/DisallowCloudNotification](./policy-csp-notifications.md#notifications-disallowcloudnotification) +- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) +- [Notifications/DisallowTileNotification](./policy-csp-notifications.md#notifications-disallowtilenotification) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) +- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) +- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) +- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [Power/SelectLidCloseActionOnBattery](./policy-csp-power.md#power-selectlidcloseactiononbattery) +- [Power/SelectLidCloseActionPluggedIn](./policy-csp-power.md#power-selectlidcloseactionpluggedin) +- [Power/SelectPowerButtonActionOnBattery](./policy-csp-power.md#power-selectpowerbuttonactiononbattery) +- [Power/SelectPowerButtonActionPluggedIn](./policy-csp-power.md#power-selectpowerbuttonactionpluggedin) +- [Power/SelectSleepButtonActionOnBattery](./policy-csp-power.md#power-selectsleepbuttonactiononbattery) +- [Power/SelectSleepButtonActionPluggedIn](./policy-csp-power.md#power-selectsleepbuttonactionpluggedin) +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) +- [Power/TurnOffHybridSleepOnBattery](./policy-csp-power.md#power-turnoffhybridsleeponbattery) +- [Power/TurnOffHybridSleepPluggedIn](./policy-csp-power.md#power-turnoffhybridsleeppluggedin) +- [Power/UnattendedSleepTimeoutOnBattery](./policy-csp-power.md#power-unattendedsleeptimeoutonbattery) +- [Power/UnattendedSleepTimeoutPluggedIn](./policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) +- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) +- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) +- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) +- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) +- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) +- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) +- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) +- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) +- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) +- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) +- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) +- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) +- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) +- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) +- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) +- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) +- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) +- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) +- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) +- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) +- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) +- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) +- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) +- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) +- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) +- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) +- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) +- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) +- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) +- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) +- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) +- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) +- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) +- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) +- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) +- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) +- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) +- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) +- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) +- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) +- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) +- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) +- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) +- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) +- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) +- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) +- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) +- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) +- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) +- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) +- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) +- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) +- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) +- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) +- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) +- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) +- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) +- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) +- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) +- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) +- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) +- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) +- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) +- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) +- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) +- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) +- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) +- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) +- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) +- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) +- [Search/AllowCortanaInAAD](./policy-csp-search.md#search-allowcortanainaad) +- [Search/AllowFindMyFiles](./policy-csp-search.md#search-allowfindmyfiles) +- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) +- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) +- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) +- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) +- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) +- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) +- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) +- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) +- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) +- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) +- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) +- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) +- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) +- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) +- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) +- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) +- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) +- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) +- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) +- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) +- [Start/StartLayout](./policy-csp-start.md#start-startlayout) +- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) +- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) +- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) +- [System/AllowCommercialDataPipeline](./policy-csp-system.md#system-allowcommercialdatapipeline) +- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata) +- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) +- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) +- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) +- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint) +- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) +- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) +- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete) +- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer) +- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) +- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) +- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) +- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) +- [System/TurnOffFileHistory](./policy-csp-system.md#system-turnofffilehistory) +- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) +- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) +- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) +- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) +- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) +- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) +- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [TextInput/AllowLinguisticDataCollection](./policy-csp-textinput.md#textinput-allowlinguisticdatacollection) +- [Troubleshooting/AllowRecommendations](./policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) +- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) +- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) +- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) +- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) +- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) +- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) +- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) +- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) +- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](./policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) +- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) +- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) +- [Update/AutomaticMaintenanceWakeUp](./policy-csp-update.md#update-automaticmaintenancewakeup) +- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) +- [Update/ConfigureDeadlineForFeatureUpdates](./policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](./policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](./policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](./policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) +- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) +- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) +- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) +- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) +- [Update/EngagedRestartDeadlineForFeatureUpdates](./policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) +- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) +- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) +- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) +- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) +- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) +- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) +- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) +- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) +- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) +- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) +- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) +- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) +- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) +- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) +- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) +- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) +- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) +- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) +- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) +- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) +- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) +- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) +- [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) +- [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) +- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) +- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) +- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) +- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) +- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) +- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) +- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) +- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) +- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) +- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) +- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) +- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) +- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) +- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) +- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) +- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) +- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) +- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) +- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) +- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) +- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) +- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) +- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) +- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) +- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) +- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) +- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) +- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) +- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) +- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) +- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) +- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) +- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) +- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) +- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) +- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) +- [WindowsDefenderSecurityCenter/DisableClearTpmButton](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) +- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) +- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) +- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) +- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) +- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) +- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) +- [WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) +- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) +- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) +- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) +- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) +- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) +- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) +- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) +- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) +- [WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) +- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) +- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) +- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) +- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) +- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) +- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) +- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnableFirstLogonAnimation](./policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md new file mode 100644 index 0000000000..0a8beec733 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md @@ -0,0 +1,71 @@ +--- +title: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite +description: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/17/2019 +--- + +# Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policy-csps-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +> + +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) +- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) +- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md new file mode 100644 index 0000000000..256ddb3528 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md @@ -0,0 +1,69 @@ +--- +title: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition +description: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP supported by HoloLens (1st gen) Development Edition + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policy-csps-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +> + +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md new file mode 100644 index 0000000000..bd4bcafd21 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -0,0 +1,131 @@ +--- +title: Policies in Policy CSP supported by HoloLens 2 +description: Policies in Policy CSP supported by HoloLens 2 +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/08/2020 +--- + +# Policies in Policy CSP supported by HoloLens 2 + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policy-csps-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +> + +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Experience/AllowManualMDMUnenrollment](policy-csp-experience.md#experience-allowmanualmdmunenrollment) +- [MixedReality/AADGroupMembershipCacheValidityInDays](./policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays) 9 +- [MixedReality/BrightnessButtonDisabled](./policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled) 9 +- [MixedReality/FallbackDiagnostics](./policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics) 9 +- [MixedReality/MicrophoneDisabled](./policy-csp-mixedreality.md#mixedreality-microphonedisabled) 9 +- [MixedReality/VolumeButtonDisabled](./policy-csp-mixedreality.md#mixedreality-volumebuttondisabled) 9 +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) 9 +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) 9 +- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) 9 +- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) 9 +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) 9 +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) 9 +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Privacy/LetAppsAccessAccountInfo](policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) 8 +- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) 8 +- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) 8 +- [Privacy/LetAppsAccessGazeInput](policy-csp-privacy.md#privacy-letappsaccessgazeinput) 8 +- [Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessgazeinput-forceallowtheseapps) 8 +- [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessgazeinput-forcedenytheseapps) 8 +- [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessgazeinput-userincontroloftheseapps) 8 +- [Privacy/LetAppsAccessCamera](policy-csp-privacy.md#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) 8 +- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) 8 +- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) 8 +- [RemoteLock/Lock](https://docs.microsoft.com/windows/client-management/mdm/remotelock-csp) 9 +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/AllowAddProvisioningPackage](policy-csp-security.md#security-allowaddprovisioningpackage) 9 +- [Security/AllowRemoveProvisioningPackage](policy-csp-security.md#security-allowremoveprovisioningpackage) 9 +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Settings/PageVisibilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) 9 +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#timelanguagesettings-configuretimezone) 9 +- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) 9 +- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) 9 +- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) 9 +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/BranchReadinessLevel](policy-csp-update.md#update-branchreadinesslevel) +- [Update/DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [Update/ManagePreviewBuilds](policy-csp-update.md#update-managepreviewbuilds) +- [Update/PauseFeatureUpdates](policy-csp-update.md#update-pausefeatureupdates) +- [Update/PauseQualityUpdates](policy-csp-update.md#update-pausequalityupdates) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/SetDisablePauseUXAccess](policy-csp-update.md#update-setdisablepauseuxaccess) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) 8 + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. +- 9 - Available in [Windows Holographic, version 20H2](https://docs.microsoft.com/hololens/hololens-release-notes#windows-holographic-version-20h2) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md new file mode 100644 index 0000000000..f3143ed222 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md @@ -0,0 +1,77 @@ +--- +title: Policies in Policy CSP supported by Windows 10 IoT Core +description: Policies in Policy CSP supported by Windows 10 IoT Core +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/16/2019 +--- + +# Policies in Policy CSP supported by Windows 10 IoT Core + +> [!div class="op_single_selector"] +> +> - [IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +> - [IoT Core](policy-csps-supported-by-iot-core.md) +> + +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [CredentialProviders/AllowPINLogon](policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md#dataprotection-allowdirectmemoryaccess) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) (deprecated) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) +- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) +- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) +- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) +- [Wifi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise.md new file mode 100644 index 0000000000..afb79c5bfe --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise.md @@ -0,0 +1,73 @@ +--- +title: Policies in Policy CSP supported by Windows 10 IoT Enterprise +description: Policies in Policy CSP supported by Windows 10 IoT Enterprise +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP supported by Windows 10 IoT Enterprise + +> [!div class="op_single_selector"] +> +> - [IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +> - [IoT Core](policy-csps-supported-by-iot-core.md) +> + +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) (deprecated) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) +- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) +- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) +- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Update/SetProxyBehaviorForUpdateDetection](policy-csp-update.md#update-setproxybehaviorforupdatedetection) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md new file mode 100644 index 0000000000..e39b0aef27 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -0,0 +1,98 @@ +--- +title: Policies in Policy CSP supported by Microsoft Surface Hub +description: Policies in Policy CSP supported by Microsoft Surface Hub +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/22/2020 +--- + +# Policies in Policy CSP supported by Microsoft Surface Hub + + +- [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) +- [Accounts/AllowMicrosoftAccountConnection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection) +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#cryptography-tlsciphersuites) +- [Defender/AllowArchiveScanning](policy-csp-defender.md#defender-allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#defender-allowbehaviormonitoring) +- [Defender/AllowCloudProtection](policy-csp-defender.md#defender-allowcloudprotection) +- [Defender/AllowEmailScanning](policy-csp-defender.md#defender-allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](policy-csp-defender.md#defender-allowioavprotection) +- [Defender/AllowIntrusionPreventionSystem](policy-csp-defender.md#defender-allowintrusionpreventionsystem) +- [Defender/AllowOnAccessProtection](policy-csp-defender.md#defender-allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#defender-allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#defender-allowscanningnetworkfiles) +- [Defender/AllowScriptScanning](policy-csp-defender.md#defender-allowscriptscanning) +- [Defender/AllowUserUIAccess](policy-csp-defender.md#defender-allowuseruiaccess) +- [Defender/AvgCPULoadFactor](policy-csp-defender.md#defender-avgcpuloadfactor) +- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#defender-daystoretaincleanedmalware) +- [Defender/ExcludedExtensions](policy-csp-defender.md#defender-excludedextensions) +- [Defender/ExcludedPaths](policy-csp-defender.md#defender-excludedpaths) +- [Defender/ExcludedProcesses](policy-csp-defender.md#defender-excludedprocesses) +- [Defender/PUAProtection](policy-csp-defender.md#defender-puaprotection) +- [Defender/RealTimeScanDirection](policy-csp-defender.md#defender-realtimescandirection) +- [Defender/ScanParameter](policy-csp-defender.md#defender-scanparameter) +- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#defender-schedulequickscantime) +- [Defender/ScheduleScanDay](policy-csp-defender.md#defender-schedulescanday) +- [Defender/ScheduleScanTime](policy-csp-defender.md#defender-schedulescantime) +- [Defender/SignatureUpdateInterval](policy-csp-defender.md#defender-signatureupdateinterval) +- [Defender/SubmitSamplesConsent](policy-csp-defender.md#defender-submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#defender-threatseveritydefaultaction) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [RestrictedGroups/ConfigureGroupMembership](policy-csp-restrictedgroups.md) +- [TextInput/AllowIMELogging](policy-csp-textinput.md#textinput-allowimelogging) +- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#textinput-allowimenetworkaccess) +- [TextInput/AllowInputPanel](policy-csp-textinput.md#textinput-allowinputpanel) +- [TextInput/AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#textinput-allowjapaneseimesurrogatepaircharacters) +- [TextInput/AllowJapaneseIVSCharacters](policy-csp-textinput.md#textinput-allowjapaneseivscharacters) +- [TextInput/AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#textinput-allowjapanesenonpublishingstandardglyph) +- [TextInput/AllowJapaneseUserDictionary](policy-csp-textinput.md#textinput-allowjapaneseuserdictionary) +- [TextInput/AllowLanguageFeaturesUninstall](policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208) +- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) +- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) +- [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) +- [WiFi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode) +- [Wifi/AllowWiFiDirect](policy-csp-wifi.md#wifi-allowwifidirect) +- [WirelessDisplay/AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#wirelessdisplay-allowmdnsadvertisement) +- [WirelessDisplay/AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#wirelessdisplay-allowmdnsdiscovery) +- [WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectionfrompc) +- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectionfrompcoverinfrastructure) +- [WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopcoverinfrastructure) +- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) +- [WirelessDisplay/RequirePinForPairing](policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) + + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md new file mode 100644 index 0000000000..4fa3380c87 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md @@ -0,0 +1,40 @@ +--- +title: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) +description: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP that can be set using Exchange Active Sync (EAS) + +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowCellularDataRoaming](policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [DeviceLock/PreventLockScreenSlideShow](policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) +- [System/TelemetryProxy](policy-csp-system.md#system-telemetryproxy) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 05ec05440b..2efe519667 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,6 +1,6 @@ --- title: Policy CSP -description: Policy CSP +description: Learn how the Policy configuration service provider (CSP) enables the enterprise to configure policies on Windows 10. ms.assetid: 4F3A1134-D401-44FC-A583-6EDD3070BA4F ms.reviewer: manager: dansimp @@ -9,12 +9,12 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman +ms.localizationpriority: medium ms.date: 07/18/2019 --- # Policy CSP - The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. The Policy configuration service provider has the following sub-categories: @@ -137,9 +137,6 @@ The following diagram shows the Policy configuration service provider in tree fo ### AboveLock policies

          -
          - AboveLock/AllowActionCenterNotifications -
          AboveLock/AllowCortanaAboveLock
          @@ -171,6 +168,3636 @@ The following diagram shows the Policy configuration service provider in tree fo
          +### ADMX_ActiveXInstallService policies + +
          +
          + ADMX_ActiveXInstallService/AxISURLZonePolicies +
          +
          + +### ADMX_AddRemovePrograms policies +
          +
          + ADMX_AddRemovePrograms/DefaultCategory +
          +
          + ADMX_AddRemovePrograms/NoAddFromCDorFloppy +
          +
          + ADMX_AddRemovePrograms/NoAddFromInternet +
          +
          + ADMX_AddRemovePrograms/NoAddFromNetwork +
          +
          + ADMX_AddRemovePrograms/NoAddPage +
          +
          + ADMX_AddRemovePrograms/NoAddRemovePrograms +
          +
          + ADMX_AddRemovePrograms/NoChooseProgramsPage +
          +
          + ADMX_AddRemovePrograms/NoRemovePage +
          +
          + ADMX_AddRemovePrograms/NoServices +
          +
          + ADMX_AddRemovePrograms/NoSupportInfo +
          +
          + ADMX_AddRemovePrograms/NoWindowsSetupPage +
          +
          + +### ADMX_AppCompat policies + +
          +
          + ADMX_AppCompat/AppCompatPrevent16BitMach +
          +
          + ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage +
          +
          + ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry +
          +
          + ADMX_AppCompat/AppCompatTurnOffSwitchBack +
          +
          + ADMX_AppCompat/AppCompatTurnOffEngine +
          +
          + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1 +
          +
          + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2 +
          +
          + ADMX_AppCompat/AppCompatTurnOffUserActionRecord +
          +
          + ADMX_AppCompat/AppCompatTurnOffProgramInventory +
          +
          + +### ADMX_AppxPackageManager policies + +
          +
          + ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles +
          +
          + +### ADMX_AppXRuntime policies + +
          +
          + ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules +
          +
          + ADMX_AppXRuntime/AppxRuntimeBlockFileElevation +
          +
          + ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT +
          +
          + ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation +
          +
          + +### ADMX_AttachmentManager policies + +
          +
          + ADMX_AttachmentManager/AM_EstimateFileHandlerRisk +
          +
          + ADMX_AttachmentManager/AM_SetFileRiskLevel +
          +
          + ADMX_AttachmentManager/AM_SetHighRiskInclusion +
          +
          + ADMX_AttachmentManager/AM_SetLowRiskInclusion +
          +
          + ADMX_AttachmentManager/AM_SetModRiskInclusion +
          +
          + +### ADMX_AuditSettings policies + +
          +
          + ADMX_AuditSettings/IncludeCmdLine +
          +
          + + +### ADMX_Bits policies + +
          +
          + ADMX_Bits/BITS_DisableBranchCache +
          +
          + ADMX_Bits/BITS_DisablePeercachingClient +
          +
          + ADMX_Bits/BITS_DisablePeercachingServer +
          +
          + ADMX_Bits/BITS_EnablePeercaching +
          +
          + ADMX_Bits/BITS_MaxBandwidthServedForPeers +
          +
          + ADMX_Bits/BITS_MaxBandwidthV2_Maintenance +
          +
          + ADMX_Bits/BITS_MaxBandwidthV2_Work +
          +
          + ADMX_Bits/BITS_MaxCacheSize +
          +
          + ADMX_Bits/BITS_MaxContentAge +
          +
          + ADMX_Bits/BITS_MaxDownloadTime +
          +
          + ADMX_Bits/BITS_MaxFilesPerJob +
          +
          + ADMX_Bits/BITS_MaxJobsPerMachine +
          +
          + ADMX_Bits/BITS_MaxJobsPerUser +
          +
          + ADMX_Bits/BITS_MaxRangesPerFile +
          +
          + +### ADMX_CipherSuiteOrder policies + +
          +
          + ADMX_CipherSuiteOrder/SSLCipherSuiteOrder +
          +
          + ADMX_CipherSuiteOrder/SSLCurveOrder +
          +
          + +### ADMX_COM policies + +
          +
          + ADMX_COM/AppMgmt_COM_SearchForCLSID_1 +
          +
          + ADMX_COM/AppMgmt_COM_SearchForCLSID_2 +
          +
          + +### ADMX_ControlPanel policies + +
          +
          + ADMX_ControlPanel/DisallowCpls +
          +
          + ADMX_ControlPanel/ForceClassicControlPanel +
          +
          + ADMX_ControlPanel/NoControlPanel +
          +
          + ADMX_ControlPanel/RestrictCpls +
          +
          + +### ADMX_ControlPanelDisplay policies + +
          +
          + ADMX_ControlPanelDisplay/CPL_Display_Disable +
          +
          + ADMX_ControlPanelDisplay/CPL_Display_HideSettings +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground +
          +
          + +### ADMX_Cpls policies + +
          +
          + ADMX_CtrlAltDel/DisableChangePassword +
          +
          + ADMX_CtrlAltDel/DisableLockComputer +
          +
          + ADMX_CtrlAltDel/DisableTaskMgr +
          +
          + ADMX_CtrlAltDel/NoLogoff +
          +
          + +### ADMX_CredentialProviders policies + +
          +
          + ADMX_CredentialProviders/AllowDomainDelayLock +
          +
          + ADMX_CredentialProviders/DefaultCredentialProvider +
          +
          + ADMX_CredentialProviders/ExcludedCredentialProviders +
          +
          + +### ADMX_CredSsp policies + +
          +
          + ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly +
          +
          + ADMX_CredSsp/AllowDefaultCredentials +
          +
          + ADMX_CredSsp/AllowEncryptionOracle +
          +
          + ADMX_CredSsp/AllowFreshCredentials +
          +
          + ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly +
          +
          + ADMX_CredSsp/AllowSavedCredentials +
          +
          + ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly +
          +
          + ADMX_CredSsp/DenyDefaultCredentials +
          +
          + ADMX_CredSsp/DenyFreshCredentials +
          +
          + ADMX_CredSsp/DenySavedCredentials +
          +
          + ADMX_CredSsp/RestrictedRemoteAdministration + +### ADMX_CredUI policies + +
          +
          + ADMX_CredUI/EnableSecureCredentialPrompting +
          +
          + ADMX_CredUI/NoLocalPasswordResetQuestions +
          +
          + +### ADMX_CtrlAltDel policies +
          +
          + ADMX_Cpls/UseDefaultTile +
          +
          + +### ADMX_DataCollection policies + +
          +
          + ADMX_DataCollection/CommercialIdPolicy +
          +
          + +### ADMX_Desktop policies + +
          +
          + ADMX_Desktop/AD_EnableFilter +
          +
          + ADMX_Desktop/AD_HideDirectoryFolder +
          +
          + ADMX_Desktop/AD_QueryLimit +
          +
          + ADMX_Desktop/ForceActiveDesktopOn +
          +
          + ADMX_Desktop/NoActiveDesktop +
          +
          + ADMX_Desktop/NoActiveDesktopChanges +
          +
          + ADMX_Desktop/NoDesktop +
          +
          + ADMX_Desktop/NoDesktopCleanupWizard +
          +
          + ADMX_Desktop/NoInternetIcon +
          +
          + ADMX_Desktop/NoMyComputerIcon +
          +
          + ADMX_Desktop/NoMyDocumentsIcon +
          +
          + ADMX_Desktop/NoNetHood +
          +
          + ADMX_Desktop/NoPropertiesMyComputer +
          +
          + ADMX_Desktop/NoPropertiesMyDocuments +
          +
          + ADMX_Desktop/NoRecentDocsNetHood +
          +
          + ADMX_Desktop/NoRecycleBinIcon +
          +
          + ADMX_Desktop/NoRecycleBinProperties +
          +
          + ADMX_Desktop/NoSaveSettings +
          +
          + ADMX_Desktop/NoWindowMinimizingShortcuts +
          +
          + ADMX_Desktop/Wallpaper +
          +
          + ADMX_Desktop/sz_ATC_DisableAdd +
          +
          + ADMX_Desktop/sz_ATC_DisableClose +
          +
          + ADMX_Desktop/sz_ATC_DisableDel +
          +
          + ADMX_Desktop/sz_ATC_DisableEdit +
          +
          + ADMX_Desktop/sz_ATC_NoComponents +
          +
          + ADMX_Desktop/sz_AdminComponents_Title +
          +
          + ADMX_Desktop/sz_DB_DragDropClose +
          +
          + ADMX_Desktop/sz_DB_Moving +
          +
          + ADMX_Desktop/sz_DWP_NoHTMLPaper +
          +
          + +### ADMX_DeviceInstallation policies + +
          +
          + ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall +
          +
          + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText +
          +
          + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText +
          +
          + ADMX_DeviceInstallation/DeviceInstall_InstallTimeout +
          +
          + ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime +
          +
          + ADMX_DeviceInstallation/DeviceInstall_Removable_Deny +
          +
          + ADMX_DeviceInstallation/DeviceInstall_SystemRestore +
          +
          + ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser +
          +
          + +### ADMX_DeviceSetup policies + +
          +
          + ADMX_DeviceSetup/DeviceInstall_BalloonTips +
          +
          + ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration +
          +
          + +### ADMX_DigitalLocker policies +
          +
          + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1 +
          +
          + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2 +
          +
          + +### ADMX_DnsClient policies + +
          +
          + ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries +
          +
          + ADMX_DnsClient/DNS_AppendToMultiLabelName +
          +
          + ADMX_DnsClient/DNS_Domain +
          +
          + ADMX_DnsClient/DNS_DomainNameDevolutionLevel +
          +
          + ADMX_DnsClient/DNS_IdnEncoding +
          +
          + ADMX_DnsClient/DNS_IdnMapping +
          +
          + ADMX_DnsClient/DNS_NameServer +
          +
          + ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns +
          +
          + ADMX_DnsClient/DNS_PrimaryDnsSuffix +
          +
          + ADMX_DnsClient/DNS_RegisterAdapterName +
          +
          + ADMX_DnsClient/DNS_RegisterReverseLookup +
          +
          + ADMX_DnsClient/DNS_RegistrationEnabled +
          +
          + ADMX_DnsClient/DNS_RegistrationOverwritesInConflict +
          +
          + ADMX_DnsClient/DNS_RegistrationRefreshInterval +
          +
          + ADMX_DnsClient/DNS_RegistrationTtl +
          +
          + ADMX_DnsClient/DNS_SearchList +
          +
          + ADMX_DnsClient/DNS_SmartMultiHomedNameResolution +
          +
          + ADMX_DnsClient/DNS_SmartProtocolReorder +
          +
          + ADMX_DnsClient/DNS_UpdateSecurityLevel +
          +
          + ADMX_DnsClient/DNS_UpdateTopLevelDomainZones +
          +
          + ADMX_DnsClient/DNS_UseDomainNameDevolution +
          +
          + ADMX_DnsClient/Turn_Off_Multicast +
          +
          + +### ADMX_DWM policies + +
          +
          + ADMX_DWM/DwmDefaultColorizationColor_1 +
          +
          + ADMX_DWM/DwmDefaultColorizationColor_2 +
          +
          + ADMX_DWM/DwmDisallowAnimations_1 +
          +
          + ADMX_DWM/DwmDisallowAnimations_2 +
          +
          + ADMX_DWM/DwmDisallowColorizationColorChanges_1 +
          +
          + ADMX_DWM/DwmDisallowColorizationColorChanges_2 +
          +
          + +### ADMX_EAIME policies + +
          +
          + ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList +
          +
          + ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion +
          +
          + ADMX_EAIME/L_TurnOffCustomDictionary +
          +
          + ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput +
          +
          + ADMX_EAIME/L_TurnOffInternetSearchIntegration +
          +
          + ADMX_EAIME/L_TurnOffOpenExtendedDictionary +
          +
          + ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile +
          +
          + ADMX_EAIME/L_TurnOnCloudCandidate +
          +
          + ADMX_EAIME/L_TurnOnCloudCandidateCHS +
          +
          + ADMX_EAIME/L_TurnOnLexiconUpdate +
          +
          + ADMX_EAIME/L_TurnOnLiveStickers +
          +
          + ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport +
          +
          + +### ADMX_EncryptFilesonMove policies +
          +
          + ADMX_EncryptFilesonMove/NoEncryptOnMove +
          +
          + +### ADMX_EnhancedStorage policies + +
          +
          + ADMX_EnhancedStorage/ApprovedEnStorDevices +
          +
          + ADMX_EnhancedStorage/ApprovedSilos +
          +
          + ADMX_EnhancedStorage/DisablePasswordAuthentication +
          +
          + ADMX_EnhancedStorage/DisallowLegacyDiskDevices +
          +
          + ADMX_EnhancedStorage/LockDeviceOnMachineLock +
          +
          + ADMX_EnhancedStorage/RootHubConnectedEnStorDevices +
          +
          + +### ADMX_ErrorReporting policies + +
          +
          + ADMX_ErrorReporting/PCH_AllOrNoneDef +
          +
          + ADMX_ErrorReporting/PCH_AllOrNoneEx +
          +
          + ADMX_ErrorReporting/PCH_AllOrNoneInc +
          +
          + ADMX_ErrorReporting/PCH_ConfigureReport +
          +
          + ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults +
          +
          + ADMX_ErrorReporting/WerArchive_1 +
          +
          + ADMX_ErrorReporting/WerArchive_2 +
          +
          + ADMX_ErrorReporting/WerAutoApproveOSDumps_1 +
          +
          + ADMX_ErrorReporting/WerAutoApproveOSDumps_2 +
          +
          + ADMX_ErrorReporting/WerBypassDataThrottling_1 +
          +
          + ADMX_ErrorReporting/WerBypassDataThrottling_2 +
          +
          + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1 +
          +
          + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2 +
          +
          + ADMX_ErrorReporting/WerBypassPowerThrottling_1 +
          +
          + ADMX_ErrorReporting/WerBypassPowerThrottling_2 +
          +
          + ADMX_ErrorReporting/WerCER +
          +
          + ADMX_ErrorReporting/WerConsentCustomize_1 +
          +
          + ADMX_ErrorReporting/WerConsentOverride_1 +
          +
          + ADMX_ErrorReporting/WerConsentOverride_2 +
          +
          + ADMX_ErrorReporting/WerDefaultConsent_1 +
          +
          + ADMX_ErrorReporting/WerDefaultConsent_2 +
          +
          + ADMX_ErrorReporting/WerDisable_1 +
          +
          + ADMX_ErrorReporting/WerExlusion_1 +
          +
          + ADMX_ErrorReporting/WerExlusion_2 +
          +
          + ADMX_ErrorReporting/WerNoLogging_1 +
          +
          + ADMX_ErrorReporting/WerNoLogging_2 +
          +
          + ADMX_ErrorReporting/WerNoSecondLevelData_1 +
          +
          + ADMX_ErrorReporting/WerQueue_1 +
          +
          + ADMX_ErrorReporting/WerQueue_2 +
          +
          + +### ADMX_EventForwarding policies + +
          +
          + ADMX_EventForwarding/ForwarderResourceUsage +
          +
          + ADMX_EventForwarding/SubscriptionManager +
          +
          + +### ADMX_EventLog policies + +
          +
          + ADMX_EventLog/Channel_LogEnabled +
          +
          + ADMX_EventLog/Channel_LogFilePath_1 +
          +
          + ADMX_EventLog/Channel_LogFilePath_2 +
          +
          + ADMX_EventLog/Channel_LogFilePath_3 +
          +
          + ADMX_EventLog/Channel_LogFilePath_4 +
          +
          + ADMX_EventLog/Channel_LogMaxSize_3 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_1 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_2 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_3 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_4 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_1 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_2 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_3 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_4 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_5 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_6 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_7 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_8 +
          +
          + ADMX_EventLog/Channel_Log_Retention_2 +
          +
          + ADMX_EventLog/Channel_Log_Retention_3 +
          +
          + ADMX_EventLog/Channel_Log_Retention_4 +
          +
          + +### ADMX_FileServerVSSProvider policies +
          +
          + ADMX_FileServerVSSProvider/Pol_EncryptProtocol +
          +
          + +### ADMX_FileSys policies +
          +
          + ADMX_FileSys/DisableCompression +
          +
          + ADMX_FileSys/DisableDeleteNotification +
          +
          + ADMX_FileSys/DisableEncryption +
          +
          + ADMX_FileSys/EnablePagefileEncryption +
          +
          + ADMX_FileSys/LongPathsEnabled +
          +
          + ADMX_FileSys/ShortNameCreationSettings +
          +
          + ADMX_FileSys/SymlinkEvaluation +
          +
          + ADMX_FileSys/TxfDeprecatedFunctionality +
          +
          + +### ADMX_FolderRedirection policies +
          +
          + ADMX_FolderRedirection/DisableFRAdminPin +
          +
          + ADMX_FolderRedirection/DisableFRAdminPinByFolder +
          +
          + ADMX_FolderRedirection/FolderRedirectionEnableCacheRename +
          +
          + ADMX_FolderRedirection/LocalizeXPRelativePaths_1 +
          +
          + ADMX_FolderRedirection/LocalizeXPRelativePaths_2 +
          +
          + ADMX_FolderRedirection/PrimaryComputer_FR_1 +
          +
          + ADMX_FolderRedirection/PrimaryComputer_FR_2 +
          +
          + +### ADMX_Help policies +
          +
          + ADMX_Help/DisableHHDEP +
          +
          + ADMX_Help/HelpQualifiedRootDir_Comp +
          +
          + ADMX_Help/RestrictRunFromHelp +
          +
          + ADMX_Help/RestrictRunFromHelp_Comp +
          +
          + +### ADMX_HelpAndSupport policies +
          +
          + ADMX_HelpAndSupport/ActiveHelp +
          +
          + ADMX_HelpAndSupport/HPExplicitFeedback +
          +
          + ADMX_HelpAndSupport/HPImplicitFeedback +
          +
          + ADMX_HelpAndSupport/HPOnlineAssistance +
          +
          + +### ADMX_kdc policies +
          +
          + ADMX_kdc/CbacAndArmor +
          +
          + ADMX_kdc/ForestSearch +
          +
          + ADMX_kdc/PKINITFreshness +
          +
          + ADMX_kdc/RequestCompoundId +
          +
          + ADMX_kdc/TicketSizeThreshold +
          +
          + ADMX_kdc/emitlili +
          +
          + +### ADMX_Kerberos policies + +
          +
          + ADMX_Kerberos/AlwaysSendCompoundId +
          +
          + ADMX_Kerberos/DevicePKInitEnabled +
          +
          + ADMX_Kerberos/HostToRealm +
          +
          + ADMX_Kerberos/KdcProxyDisableServerRevocationCheck +
          +
          + ADMX_Kerberos/KdcProxyServer +
          +
          + ADMX_Kerberos/MitRealms +
          +
          + ADMX_Kerberos/ServerAcceptsCompound +
          +
          + ADMX_Kerberos/StrictTarget +
          +
          + +### ADMX_LanmanServer policies +
          +
          + ADMX_LanmanServer/Pol_CipherSuiteOrder +
          +
          + ADMX_LanmanServer/Pol_HashPublication +
          +
          + ADMX_LanmanServer/Pol_HashSupportVersion +
          +
          + ADMX_LanmanServer/Pol_HonorCipherSuiteOrder +
          +
          + +### ADMX_LinkLayerTopologyDiscovery policies +
          +
          + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO +
          +
          + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr +
          +
          + +### ADMX_MicrosoftDefenderAntivirus policies + +
          +
          + ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction +
          +
          + ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions +
          +
          + ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths +
          +
          + ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders +
          +
          + ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation +
          +
          + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement +
          +
          + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid +
          +
          + ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition +
          +
          + ADMX_MicrosoftDefenderAntivirus/ProxyBypass +
          +
          + ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl +
          +
          + ADMX_MicrosoftDefenderAntivirus/ProxyServer +
          +
          + ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay +
          +
          + ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection +
          +
          + ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup +
          +
          + ADMX_MicrosoftDefenderAntivirus/SpynetReporting +
          +
          + ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting +
          +
          + ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown +
          +
          + +### ADMX_MMC policies +
          +
          + ADMX_MMC/MMC_ActiveXControl +
          +
          + ADMX_MMC/MMC_ExtendView +
          +
          + ADMX_MMC/MMC_LinkToWeb +
          +
          + ADMX_MMC/MMC_Restrict_Author +
          +
          + ADMX_MMC/MMC_Restrict_To_Permitted_Snapins +
          +
          + +### ADMX_MMCSnapins policies + +
          +
          + ADMX_MMCSnapins/MMC_ADMComputers_1 +
          +
          + ADMX_MMCSnapins/MMC_ADMComputers_2 +
          +
          + ADMX_MMCSnapins/MMC_ADMUsers_1 +
          +
          + ADMX_MMCSnapins/MMC_ADMUsers_2 +
          +
          + ADMX_MMCSnapins/MMC_ADSI +
          +
          + ADMX_MMCSnapins/MMC_ActiveDirDomTrusts +
          +
          + ADMX_MMCSnapins/MMC_ActiveDirSitesServices +
          +
          + ADMX_MMCSnapins/MMC_ActiveDirUsersComp +
          +
          + ADMX_MMCSnapins/MMC_AppleTalkRouting +
          +
          + ADMX_MMCSnapins/MMC_AuthMan +
          +
          + ADMX_MMCSnapins/MMC_CertAuth +
          +
          + ADMX_MMCSnapins/MMC_CertAuthPolSet +
          +
          + ADMX_MMCSnapins/MMC_Certs +
          +
          + ADMX_MMCSnapins/MMC_CertsTemplate +
          +
          + ADMX_MMCSnapins/MMC_ComponentServices +
          +
          + ADMX_MMCSnapins/MMC_ComputerManagement +
          +
          + ADMX_MMCSnapins/MMC_ConnectionSharingNAT +
          +
          + ADMX_MMCSnapins/MMC_DCOMCFG +
          +
          + ADMX_MMCSnapins/MMC_DFS +
          +
          + ADMX_MMCSnapins/MMC_DHCPRelayMgmt +
          +
          + ADMX_MMCSnapins/MMC_DeviceManager_1 +
          +
          + ADMX_MMCSnapins/MMC_DeviceManager_2 +
          +
          + ADMX_MMCSnapins/MMC_DiskDefrag +
          +
          + ADMX_MMCSnapins/MMC_DiskMgmt +
          +
          + ADMX_MMCSnapins/MMC_EnterprisePKI +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_1 +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_2 +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_3 +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_4 +
          +
          + ADMX_MMCSnapins/MMC_FAXService +
          +
          + ADMX_MMCSnapins/MMC_FailoverClusters +
          +
          + ADMX_MMCSnapins/MMC_FolderRedirection_1 +
          +
          + ADMX_MMCSnapins/MMC_FolderRedirection_2 +
          +
          + ADMX_MMCSnapins/MMC_FrontPageExt +
          +
          + ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn +
          +
          + ADMX_MMCSnapins/MMC_GroupPolicySnapIn +
          +
          + ADMX_MMCSnapins/MMC_GroupPolicyTab +
          +
          + ADMX_MMCSnapins/MMC_HRA +
          +
          + ADMX_MMCSnapins/MMC_IAS +
          +
          + ADMX_MMCSnapins/MMC_IASLogging +
          +
          + ADMX_MMCSnapins/MMC_IEMaintenance_1 +
          +
          + ADMX_MMCSnapins/MMC_IEMaintenance_2 +
          +
          + ADMX_MMCSnapins/MMC_IGMPRouting +
          +
          + ADMX_MMCSnapins/MMC_IIS +
          +
          + ADMX_MMCSnapins/MMC_IPRouting +
          +
          + ADMX_MMCSnapins/MMC_IPSecManage_GP +
          +
          + ADMX_MMCSnapins/MMC_IPXRIPRouting +
          +
          + ADMX_MMCSnapins/MMC_IPXRouting +
          +
          + ADMX_MMCSnapins/MMC_IPXSAPRouting +
          +
          + ADMX_MMCSnapins/MMC_IndexingService +
          +
          + ADMX_MMCSnapins/MMC_IpSecManage +
          +
          + ADMX_MMCSnapins/MMC_IpSecMonitor +
          +
          + ADMX_MMCSnapins/MMC_LocalUsersGroups +
          +
          + ADMX_MMCSnapins/MMC_LogicalMappedDrives +
          +
          + ADMX_MMCSnapins/MMC_NPSUI +
          +
          + ADMX_MMCSnapins/MMC_NapSnap +
          +
          + ADMX_MMCSnapins/MMC_NapSnap_GP +
          +
          + ADMX_MMCSnapins/MMC_Net_Framework +
          +
          + ADMX_MMCSnapins/MMC_OCSP +
          +
          + ADMX_MMCSnapins/MMC_OSPFRouting +
          +
          + ADMX_MMCSnapins/MMC_PerfLogsAlerts +
          +
          + ADMX_MMCSnapins/MMC_PublicKey +
          +
          + ADMX_MMCSnapins/MMC_QoSAdmission +
          +
          + ADMX_MMCSnapins/MMC_RAS_DialinUser +
          +
          + ADMX_MMCSnapins/MMC_RIPRouting +
          +
          + ADMX_MMCSnapins/MMC_RIS +
          +
          + ADMX_MMCSnapins/MMC_RRA +
          +
          + ADMX_MMCSnapins/MMC_RSM +
          +
          + ADMX_MMCSnapins/MMC_RemStore +
          +
          + ADMX_MMCSnapins/MMC_RemoteAccess +
          +
          + ADMX_MMCSnapins/MMC_RemoteDesktop +
          +
          + ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn +
          +
          + ADMX_MMCSnapins/MMC_Routing +
          +
          + ADMX_MMCSnapins/MMC_SCA +
          +
          + ADMX_MMCSnapins/MMC_SMTPProtocol +
          +
          + ADMX_MMCSnapins/MMC_SNMP +
          +
          + ADMX_MMCSnapins/MMC_ScriptsMachine_1 +
          +
          + ADMX_MMCSnapins/MMC_ScriptsMachine_2 +
          +
          + ADMX_MMCSnapins/MMC_ScriptsUser_1 +
          +
          + ADMX_MMCSnapins/MMC_ScriptsUser_2 +
          +
          + ADMX_MMCSnapins/MMC_SecuritySettings_1 +
          +
          + ADMX_MMCSnapins/MMC_SecuritySettings_2 +
          +
          + ADMX_MMCSnapins/MMC_SecurityTemplates +
          +
          + ADMX_MMCSnapins/MMC_SendConsoleMessage +
          +
          + ADMX_MMCSnapins/MMC_ServerManager +
          +
          + ADMX_MMCSnapins/MMC_ServiceDependencies +
          +
          + ADMX_MMCSnapins/MMC_Services +
          +
          + ADMX_MMCSnapins/MMC_SharedFolders +
          +
          + ADMX_MMCSnapins/MMC_SharedFolders_Ext +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1 +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2 +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1 +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2 +
          +
          + ADMX_MMCSnapins/MMC_SysInfo +
          +
          + ADMX_MMCSnapins/MMC_SysProp +
          +
          + ADMX_MMCSnapins/MMC_TPMManagement +
          +
          + ADMX_MMCSnapins/MMC_Telephony +
          +
          + ADMX_MMCSnapins/MMC_TerminalServices +
          +
          + ADMX_MMCSnapins/MMC_WMI +
          +
          + ADMX_MMCSnapins/MMC_WindowsFirewall +
          +
          + ADMX_MMCSnapins/MMC_WindowsFirewall_GP +
          +
          + ADMX_MMCSnapins/MMC_WiredNetworkPolicy +
          +
          + ADMX_MMCSnapins/MMC_WirelessMon +
          +
          + ADMX_MMCSnapins/MMC_WirelessNetworkPolicy +
          +
          + +### ADMX_MSAPolicy policies +
          +
          + ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine +
          +
          + +### ADMX_nca policies +
          +
          + ADMX_nca/CorporateResources +
          +
          + ADMX_nca/CustomCommands +
          +
          + ADMX_nca/DTEs +
          +
          + ADMX_nca/FriendlyName +
          +
          + ADMX_nca/LocalNamesOn +
          +
          + ADMX_nca/PassiveMode +
          +
          + ADMX_nca/ShowUI +
          +
          + ADMX_nca/SupportEmail +
          +
          + +### ADMX_NCSI policies +
          +
          + ADMX_NCSI/NCSI_CorpDnsProbeContent +
          +
          + ADMX_NCSI/NCSI_CorpDnsProbeHost +
          +
          + ADMX_NCSI/NCSI_CorpSitePrefixes +
          +
          + ADMX_NCSI/NCSI_CorpWebProbeUrl +
          +
          + ADMX_NCSI/NCSI_DomainLocationDeterminationUrl +
          +
          + ADMX_NCSI/NCSI_GlobalDns +
          +
          + ADMX_NCSI/NCSI_PassivePolling +
          +
          + +### ADMX_Netlogon policies + +
          +
          + ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior +
          +
          + ADMX_Netlogon/Netlogon_AddressTypeReturned +
          +
          + ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch +
          +
          + ADMX_Netlogon/Netlogon_AllowNT4Crypto +
          +
          + ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain +
          +
          + ADMX_Netlogon/Netlogon_AutoSiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery +
          +
          + ADMX_Netlogon/Netlogon_AvoidPdcOnWan +
          +
          + ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod +
          +
          + ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod +
          +
          + ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime +
          +
          + ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod +
          +
          + ADMX_Netlogon/Netlogon_DebugFlag +
          +
          + ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords +
          +
          + ADMX_Netlogon/Netlogon_DnsRefreshInterval +
          +
          + ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames +
          +
          + ADMX_Netlogon/Netlogon_DnsTtl +
          +
          + ADMX_Netlogon/Netlogon_ExpectedDialupDelay +
          +
          + ADMX_Netlogon/Netlogon_ForceRediscoveryInterval +
          +
          + ADMX_Netlogon/Netlogon_GcSiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages +
          +
          + ADMX_Netlogon/Netlogon_LdapSrvPriority +
          +
          + ADMX_Netlogon/Netlogon_LdapSrvWeight +
          +
          + ADMX_Netlogon/Netlogon_MaximumLogFileSize +
          +
          + ADMX_Netlogon/Netlogon_NdncSiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_NegativeCachePeriod +
          +
          + ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode +
          +
          + ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod +
          +
          + ADMX_Netlogon/Netlogon_PingUrgencyMode +
          +
          + ADMX_Netlogon/Netlogon_ScavengeInterval +
          +
          + ADMX_Netlogon/Netlogon_SiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_SiteName +
          +
          + ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode +
          +
          + ADMX_Netlogon/Netlogon_TryNextClosestSite +
          +
          + ADMX_Netlogon/Netlogon_UseDynamicDns +
          +
          + +### ADMX_NetworkConnections policies + +
          +
          + ADMX_NetworkConnections/NC_AddRemoveComponents +
          +
          + ADMX_NetworkConnections/NC_AdvancedSettings +
          +
          + ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig +
          +
          + ADMX_NetworkConnections/NC_ChangeBindState +
          +
          + ADMX_NetworkConnections/NC_DeleteAllUserConnection +
          +
          + ADMX_NetworkConnections/NC_DeleteConnection +
          +
          + ADMX_NetworkConnections/NC_DialupPrefs +
          +
          + ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon +
          +
          + ADMX_NetworkConnections/NC_EnableAdminProhibits +
          +
          + ADMX_NetworkConnections/NC_ForceTunneling +
          +
          + ADMX_NetworkConnections/NC_IpStateChecking +
          +
          + ADMX_NetworkConnections/NC_LanChangeProperties +
          +
          + ADMX_NetworkConnections/NC_LanConnect +
          +
          + ADMX_NetworkConnections/NC_LanProperties +
          +
          + ADMX_NetworkConnections/NC_NewConnectionWizard +
          +
          + ADMX_NetworkConnections/NC_PersonalFirewallConfig +
          +
          + ADMX_NetworkConnections/NC_RasAllUserProperties +
          +
          + ADMX_NetworkConnections/NC_RasChangeProperties +
          +
          + ADMX_NetworkConnections/NC_RasConnect +
          +
          + ADMX_NetworkConnections/NC_RasMyProperties +
          +
          + ADMX_NetworkConnections/NC_RenameAllUserRasConnection +
          +
          + ADMX_NetworkConnections/NC_RenameConnection +
          +
          + ADMX_NetworkConnections/NC_RenameLanConnection +
          +
          + ADMX_NetworkConnections/NC_RenameMyRasConnection +
          +
          + ADMX_NetworkConnections/NC_ShowSharedAccessUI +
          +
          + ADMX_NetworkConnections/NC_Statistics +
          +
          + ADMX_NetworkConnections/NC_StdDomainUserSetLocation +
          +
          + +### ADMX_OfflineFiles policies + +
          + ADMX_OfflineFiles/Pol_AlwaysPinSubFolders +
          +
          + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1 +
          +
          + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2 +
          +
          + ADMX_OfflineFiles/Pol_BackgroundSyncSettings +
          +
          + ADMX_OfflineFiles/Pol_CacheSize +
          +
          + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1 +
          +
          + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2 +
          +
          + ADMX_OfflineFiles/Pol_DefCacheSize +
          +
          + ADMX_OfflineFiles/Pol_Enabled +
          +
          + ADMX_OfflineFiles/Pol_EncryptOfflineFiles +
          +
          + ADMX_OfflineFiles/Pol_EventLoggingLevel_1 +
          +
          + ADMX_OfflineFiles/Pol_EventLoggingLevel_2 +
          +
          + ADMX_OfflineFiles/Pol_ExclusionListSettings +
          +
          + ADMX_OfflineFiles/Pol_ExtExclusionList +
          +
          + ADMX_OfflineFiles/Pol_GoOfflineAction_1 +
          +
          + ADMX_OfflineFiles/Pol_GoOfflineAction_2 +
          +
          + ADMX_OfflineFiles/Pol_NoCacheViewer_1 +
          +
          + ADMX_OfflineFiles/Pol_NoCacheViewer_2 +
          +
          + ADMX_OfflineFiles/Pol_NoConfigCache_1 +
          +
          + ADMX_OfflineFiles/Pol_NoConfigCache_2 +
          +
          + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1 +
          +
          + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2 +
          +
          + ADMX_OfflineFiles/Pol_NoPinFiles_1 +
          +
          + ADMX_OfflineFiles/Pol_NoPinFiles_2 +
          +
          + ADMX_OfflineFiles/Pol_NoReminders_1 +
          +
          + ADMX_OfflineFiles/Pol_NoReminders_2 +
          +
          + ADMX_OfflineFiles/Pol_OnlineCachingSettings +
          +
          + ADMX_OfflineFiles/Pol_PurgeAtLogoff +
          +
          + ADMX_OfflineFiles/Pol_QuickAdimPin +
          +
          + ADMX_OfflineFiles/Pol_ReminderFreq_1 +
          +
          + ADMX_OfflineFiles/Pol_ReminderFreq_2 +
          +
          + ADMX_OfflineFiles/Pol_ReminderInitTimeout_1 +
          +
          + ADMX_OfflineFiles/Pol_ReminderInitTimeout_2 +
          +
          + ADMX_OfflineFiles/Pol_ReminderTimeout_1 +
          +
          + ADMX_OfflineFiles/Pol_ReminderTimeout_2 +
          +
          + ADMX_OfflineFiles/Pol_SlowLinkSettings +
          +
          + ADMX_OfflineFiles/Pol_SlowLinkSpeed +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogoff_1 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogoff_2 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogon_1 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogon_2 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtSuspend_1 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtSuspend_2 +
          +
          + ADMX_OfflineFiles/Pol_SyncOnCostedNetwork +
          +
          + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1 +
          +
          + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2 +
          +
          + +### ADMX_PeerToPeerCaching policies + +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB +
          +
          + ADMX_PeerToPeerCaching/SetCachePercent +
          +
          + ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge +
          +
          + ADMX_PeerToPeerCaching/SetDowngrading +
          +
          + +### ADMX_PerformanceDiagnostics policies + +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1 +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2 +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3 +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4 +
          +
          + +### ADMX_PowerShellExecutionPolicy policies + +
          +
          + ADMX_PowerShellExecutionPolicy/EnableModuleLogging +
          +
          + ADMX_PowerShellExecutionPolicy/EnableScripts +
          +
          + ADMX_PowerShellExecutionPolicy/EnableTranscripting +
          +
          + ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath +
          +
          + +### ADMX_Programs policies + +
          +
          + ADMX_Programs/NoDefaultPrograms +
          +
          + ADMX_Programs/NoGetPrograms +
          +
          + ADMX_Programs/NoInstalledUpdates +
          +
          + ADMX_Programs/NoProgramsAndFeatures +
          +
          + ADMX_Programs/NoProgramsCPL +
          +
          + ADMX_Programs/NoWindowsFeatures +
          +
          + ADMX_Programs/NoWindowsMarketplace +
          +
          + +### ADMX_Reliability policies + +
          +
          + ADMX_Reliability/EE_EnablePersistentTimeStamp +
          +
          + ADMX_Reliability/PCH_ReportShutdownEvents +
          +
          + ADMX_Reliability/ShutdownEventTrackerStateFile +
          +
          + ADMX_Reliability/ShutdownReason +
          +
          + +### ADMX_Scripts policies + +
          +
          + ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled +
          +
          + ADMX_Scripts/MaxGPOScriptWaitPolicy +
          +
          + ADMX_Scripts/Run_Computer_PS_Scripts_First +
          +
          + ADMX_Scripts/Run_Legacy_Logon_Script_Hidden +
          +
          + ADMX_Scripts/Run_Logoff_Script_Visible +
          +
          + ADMX_Scripts/Run_Logon_Script_Sync_1 +
          +
          + ADMX_Scripts/Run_Logon_Script_Sync_2 +
          +
          + ADMX_Scripts/Run_Logon_Script_Visible +
          +
          + ADMX_Scripts/Run_Shutdown_Script_Visible +
          +
          + ADMX_Scripts/Run_Startup_Script_Sync +
          +
          + ADMX_Scripts/Run_Startup_Script_Visible +
          +
          + ADMX_Scripts/Run_User_PS_Scripts_First +
          +
          + +### ADMX_sdiageng policies + +
          +
          + ADMX_sdiageng/BetterWhenConnected +
          +
          + ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy +
          +
          + ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy +
          +
          + +### ADMX_Securitycenter policies + +
          +
          + ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain +
          +
          + +### ADMX_Sensors policies + +
          +
          + ADMX_Sensors/DisableLocationScripting_1 +
          +
          + ADMX_Sensors/DisableLocationScripting_2 +
          +
          + ADMX_Sensors/DisableLocation_1 +
          +
          + ADMX_Sensors/DisableSensors_1 +
          +
          + ADMX_Sensors/DisableSensors_2 +
          +
          + +### ADMX_Servicing policies + +
          +
          + ADMX_Servicing/Servicing +
          +
          + +### ADMX_SettingSync policies + +
          +
          + ADMX_SettingSync/DisableAppSyncSettingSync +
          +
          + ADMX_SettingSync/DisableApplicationSettingSync +
          +
          + ADMX_SettingSync/DisableCredentialsSettingSync +
          +
          + ADMX_SettingSync/DisableDesktopThemeSettingSync +
          +
          + ADMX_SettingSync/DisablePersonalizationSettingSync +
          +
          + ADMX_SettingSync/DisableSettingSync +
          +
          + ADMX_SettingSync/DisableStartLayoutSettingSync +
          +
          + ADMX_SettingSync/DisableSyncOnPaidNetwork +
          +
          + ADMX_SettingSync/DisableWindowsSettingSync +
          +
          + +### ADMX_SharedFolders policies + +
          +
          + ADMX_SharedFolders/PublishDfsRoots +
          +
          + ADMX_SharedFolders/PublishSharedFolders +
          +
          + +### ADMX_Sharing policies + +
          +
          + ADMX_Sharing/NoInplaceSharing +
          +
          + +## ADMX_ShellCommandPromptRegEditTools policies + +
          +
          + ADMX_ShellCommandPromptRegEditTools/DisableCMD +
          +
          + ADMX_ShellCommandPromptRegEditTools/DisableRegedit +
          +
          + ADMX_ShellCommandPromptRegEditTools/DisallowApps +
          +
          + ADMX_ShellCommandPromptRegEditTools/RestrictApps +
          +
          + +### ADMX_Smartcard policies + +
          +
          + ADMX_Smartcard/AllowCertificatesWithNoEKU +
          +
          + ADMX_Smartcard/AllowIntegratedUnblock +
          +
          + ADMX_Smartcard/AllowSignatureOnlyKeys +
          +
          + ADMX_Smartcard/AllowTimeInvalidCertificates +
          +
          + ADMX_Smartcard/CertPropEnabledString +
          +
          + ADMX_Smartcard/CertPropRootCleanupString +
          +
          + ADMX_Smartcard/CertPropRootEnabledString +
          +
          + ADMX_Smartcard/DisallowPlaintextPin +
          +
          + ADMX_Smartcard/EnumerateECCCerts +
          +
          + ADMX_Smartcard/FilterDuplicateCerts +
          +
          + ADMX_Smartcard/ForceReadingAllCertificates +
          +
          + ADMX_Smartcard/IntegratedUnblockPromptString +
          +
          + ADMX_Smartcard/ReverseSubject +
          +
          + ADMX_Smartcard/SCPnPEnabled +
          +
          + ADMX_Smartcard/SCPnPNotification +
          +
          + ADMX_Smartcard/X509HintsNeeded +
          +
          + +### ADMX_Snmp policies + +
          +
          + ADMX_Snmp/SNMP_Communities +
          +
          + ADMX_Snmp/SNMP_PermittedManagers +
          +
          + ADMX_Snmp/SNMP_Traps_Public +
          +
          + +### ADMX_StartMenu policies + +
          +
          + ADMX_StartMenu/AddSearchInternetLinkInStartMenu +
          +
          + ADMX_StartMenu/ClearRecentDocsOnExit +
          +
          + ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu +
          +
          + ADMX_StartMenu/ClearTilesOnExit +
          +
          + ADMX_StartMenu/DesktopAppsFirstInAppsView +
          +
          + ADMX_StartMenu/DisableGlobalSearchOnAppsView +
          +
          + ADMX_StartMenu/ForceStartMenuLogOff +
          +
          + ADMX_StartMenu/GoToDesktopOnSignIn +
          +
          + ADMX_StartMenu/GreyMSIAds +
          +
          + ADMX_StartMenu/HidePowerOptions +
          +
          + ADMX_StartMenu/Intellimenus +
          +
          + ADMX_StartMenu/LockTaskbar +
          +
          + ADMX_StartMenu/MemCheckBoxInRunDlg +
          +
          + ADMX_StartMenu/NoAutoTrayNotify +
          +
          + ADMX_StartMenu/NoBalloonTip +
          +
          + ADMX_StartMenu/NoChangeStartMenu +
          +
          + ADMX_StartMenu/NoClose +
          +
          + ADMX_StartMenu/NoCommonGroups +
          +
          + ADMX_StartMenu/NoFavoritesMenu +
          +
          + ADMX_StartMenu/NoFind +
          +
          + ADMX_StartMenu/NoGamesFolderOnStartMenu +
          +
          + ADMX_StartMenu/NoHelp +
          +
          + ADMX_StartMenu/NoInstrumentation +
          +
          + ADMX_StartMenu/NoMoreProgramsList +
          +
          + ADMX_StartMenu/NoNetAndDialupConnect +
          +
          + ADMX_StartMenu/NoPinnedPrograms +
          +
          + ADMX_StartMenu/NoRecentDocsMenu +
          +
          + ADMX_StartMenu/NoResolveSearch +
          +
          + ADMX_StartMenu/NoResolveTrack +
          +
          + ADMX_StartMenu/NoRun +
          +
          + ADMX_StartMenu/NoSMConfigurePrograms +
          +
          + ADMX_StartMenu/NoSMMyDocuments +
          +
          + ADMX_StartMenu/NoSMMyMusic +
          +
          + ADMX_StartMenu/NoSMMyNetworkPlaces +
          +
          + ADMX_StartMenu/NoSMMyPictures +
          +
          + ADMX_StartMenu/NoSearchCommInStartMenu +
          +
          + ADMX_StartMenu/NoSearchComputerLinkInStartMenu +
          +
          + ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu +
          +
          + ADMX_StartMenu/NoSearchFilesInStartMenu +
          +
          + ADMX_StartMenu/NoSearchInternetInStartMenu +
          +
          + ADMX_StartMenu/NoSearchProgramsInStartMenu +
          +
          + ADMX_StartMenu/NoSetFolders +
          +
          + ADMX_StartMenu/NoSetTaskbar +
          +
          + ADMX_StartMenu/NoStartMenuDownload +
          +
          + ADMX_StartMenu/NoStartMenuHomegroup +
          +
          + ADMX_StartMenu/NoStartMenuRecordedTV +
          +
          + ADMX_StartMenu/NoStartMenuSubFolders +
          +
          + ADMX_StartMenu/NoStartMenuVideos +
          +
          + ADMX_StartMenu/NoStartPage +
          +
          + ADMX_StartMenu/NoTaskBarClock +
          +
          + ADMX_StartMenu/NoTaskGrouping +
          +
          + ADMX_StartMenu/NoToolbarsOnTaskbar +
          +
          + ADMX_StartMenu/NoTrayContextMenu +
          +
          + ADMX_StartMenu/NoTrayItemsDisplay +
          +
          + ADMX_StartMenu/NoUninstallFromStart +
          +
          + ADMX_StartMenu/NoUserFolderOnStartMenu +
          +
          + ADMX_StartMenu/NoUserNameOnStartMenu +
          +
          + ADMX_StartMenu/NoWindowsUpdate +
          +
          + ADMX_StartMenu/PowerButtonAction +
          +
          + ADMX_StartMenu/QuickLaunchEnabled +
          +
          + ADMX_StartMenu/RemoveUnDockPCButton +
          +
          + ADMX_StartMenu/ShowAppsViewOnStart +
          +
          + ADMX_StartMenu/ShowRunAsDifferentUserInStart +
          +
          + ADMX_StartMenu/ShowRunInStartMenu +
          +
          + ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey +
          +
          + ADMX_StartMenu/StartMenuLogOff +
          +
          + ADMX_StartMenu/StartPinAppsWhenInstalled +
          +
          + +### ADMX_SystemRestore policies + +
          +
          + ADMX_SystemRestore/SR_DisableConfig +
          +
          + +### ADMX_Taskbar policies + +
          +
          + ADMX_Taskbar/DisableNotificationCenter +
          +
          + ADMX_Taskbar/EnableLegacyBalloonNotifications +
          +
          + ADMX_Taskbar/HideSCAHealth +
          +
          + ADMX_Taskbar/HideSCANetwork +
          +
          + ADMX_Taskbar/HideSCAPower +
          +
          + ADMX_Taskbar/HideSCAVolume +
          +
          + ADMX_Taskbar/NoBalloonFeatureAdvertisements +
          +
          + ADMX_Taskbar/NoPinningStoreToTaskbar +
          +
          + ADMX_Taskbar/NoPinningToDestinations +
          +
          + ADMX_Taskbar/NoPinningToTaskbar +
          +
          + ADMX_Taskbar/NoRemoteDestinations +
          +
          + ADMX_Taskbar/NoSystraySystemPromotion +
          +
          + ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar +
          +
          + ADMX_Taskbar/TaskbarLockAll +
          +
          + ADMX_Taskbar/TaskbarNoAddRemoveToolbar +
          +
          + ADMX_Taskbar/TaskbarNoDragToolbar +
          +
          + ADMX_Taskbar/TaskbarNoMultimon +
          +
          + ADMX_Taskbar/TaskbarNoNotification +
          +
          + ADMX_Taskbar/TaskbarNoPinnedList +
          +
          + ADMX_Taskbar/TaskbarNoRedock +
          +
          + ADMX_Taskbar/TaskbarNoResize +
          +
          + ADMX_Taskbar/TaskbarNoThumbnail +
          +
          + +### ADMX_tcpip policies + +
          +
          + ADMX_tcpip/6to4_Router_Name +
          +
          + ADMX_tcpip/6to4_Router_Name_Resolution_Interval +
          +
          + ADMX_tcpip/6to4_State +
          +
          + ADMX_tcpip/IPHTTPS_ClientState +
          +
          + ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State +
          +
          + ADMX_tcpip/ISATAP_Router_Name +
          +
          + ADMX_tcpip/ISATAP_State +
          +
          + ADMX_tcpip/Teredo_Client_Port +
          +
          + ADMX_tcpip/Teredo_Default_Qualified +
          +
          + ADMX_tcpip/Teredo_Refresh_Rate +
          +
          + ADMX_tcpip/Teredo_Server_Name +
          +
          + ADMX_tcpip/Teredo_State +
          +
          + ADMX_tcpip/Windows_Scaling_Heuristics_State +
          +
          + +### ADMX_Thumbnails policies + +
          +
          + ADMX_Thumbnails/DisableThumbnails +
          +
          + ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders +
          +
          + ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders +
          +
          + +### ADMX_TPM policies + +
          +
          + ADMX_TPM/BlockedCommandsList_Name +
          +
          + ADMX_TPM/ClearTPMIfNotReady_Name +
          +
          + ADMX_TPM/IgnoreDefaultList_Name +
          +
          + ADMX_TPM/IgnoreLocalList_Name +
          +
          + ADMX_TPM/OSManagedAuth_Name +
          +
          + ADMX_TPM/OptIntoDSHA_Name +
          +
          + ADMX_TPM/StandardUserAuthorizationFailureDuration_Name +
          +
          + ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name +
          +
          + ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name +
          +
          + ADMX_TPM/UseLegacyDAP_Name +
          +
          + +### ADMX_UserExperienceVirtualization policies + +
          +
          + ADMX_UserExperienceVirtualization/Calculator +
          +
          + ADMX_UserExperienceVirtualization/ConfigureSyncMethod +
          +
          + ADMX_UserExperienceVirtualization/ConfigureVdi +
          +
          + ADMX_UserExperienceVirtualization/ContactITDescription +
          +
          + ADMX_UserExperienceVirtualization/ContactITUrl +
          +
          + ADMX_UserExperienceVirtualization/DisableWin8Sync +
          +
          + ADMX_UserExperienceVirtualization/DisableWindowsOSSettings +
          +
          + ADMX_UserExperienceVirtualization/EnableUEV +
          +
          + ADMX_UserExperienceVirtualization/Finance +
          +
          + ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled +
          +
          + ADMX_UserExperienceVirtualization/Games +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer8 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer9 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer10 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer11 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorerCommon +
          +
          + ADMX_UserExperienceVirtualization/Maps +
          +
          + ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016 +
          +
          + ADMX_UserExperienceVirtualization/Music +
          +
          + ADMX_UserExperienceVirtualization/News +
          +
          + ADMX_UserExperienceVirtualization/Notepad +
          +
          + ADMX_UserExperienceVirtualization/Reader +
          +
          + ADMX_UserExperienceVirtualization/RepositoryTimeout +
          +
          + ADMX_UserExperienceVirtualization/SettingsStoragePath +
          +
          + ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath +
          +
          + ADMX_UserExperienceVirtualization/Sports +
          +
          + ADMX_UserExperienceVirtualization/SyncEnabled +
          +
          + ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork +
          +
          + ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming +
          +
          + ADMX_UserExperienceVirtualization/SyncProviderPingEnabled +
          +
          + ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps +
          +
          + ADMX_UserExperienceVirtualization/Travel +
          +
          + ADMX_UserExperienceVirtualization/TrayIconEnabled +
          +
          + ADMX_UserExperienceVirtualization/Video +
          +
          + ADMX_UserExperienceVirtualization/Weather +
          +
          + ADMX_UserExperienceVirtualization/Wordpad +
          +
          + +### ADMX_UserProfiles policies + +
          +
          + ADMX_UserProfiles/CleanupProfiles +
          +
          + ADMX_UserProfiles/DontForceUnloadHive +
          +
          + ADMX_UserProfiles/LeaveAppMgmtData +
          +
          + ADMX_UserProfiles/LimitSize +
          +
          + ADMX_UserProfiles/ProfileErrorAction +
          +
          + ADMX_UserProfiles/SlowLinkTimeOut +
          +
          + ADMX_UserProfiles/USER_HOME +
          +
          + ADMX_UserProfiles/UserInfoAccessAction +
          +
          + +### ADMX_W32Time policies + +
          +
          + ADMX_W32Time/W32TIME_POLICY_CONFIG +
          +
          + ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT +
          +
          + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT +
          +
          + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER +
          +
          + +### ADMX_WCM policies + +
          +
          + ADMX_WCM/WCM_DisablePowerManagement +
          +
          + ADMX_WCM/WCM_EnableSoftDisconnect +
          +
          + ADMX_WCM/WCM_MinimizeConnections +
          +
          + +### ADMX_WinCal policies + +
          +
          + ADMX_WinCal/TurnOffWinCal_1 +
          +
          + ADMX_WinCal/TurnOffWinCal_2 +
          +
          + +### ADMX_WindowsAnytimeUpgrade policies + +
          +
          + ADMX_WindowsAnytimeUpgrade/Disabled +
          +
          + +### ADMX_WindowsConnectNow policies + +
          +
          + ADMX_WindowsConnectNow/WCN_DisableWcnUi_1 +
          +
          + ADMX_WindowsConnectNow/WCN_DisableWcnUi_2 +
          +
          + ADMX_WindowsConnectNow/WCN_EnableRegistrar +
          +
          + + +### ADMX_WindowsExplorer policies + +
          +
          + ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS +
          +
          + ADMX_WindowsExplorer/ClassicShell +
          +
          + ADMX_WindowsExplorer/ConfirmFileDelete +
          +
          + ADMX_WindowsExplorer/DefaultLibrariesLocation +
          +
          + ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage +
          +
          + ADMX_WindowsExplorer/DisableIndexedLibraryExperience +
          +
          + ADMX_WindowsExplorer/DisableKnownFolders +
          +
          + ADMX_WindowsExplorer/DisableSearchBoxSuggestions +
          +
          + ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath +
          +
          + ADMX_WindowsExplorer/EnableSmartScreen +
          +
          + ADMX_WindowsExplorer/EnforceShellExtensionSecurity +
          +
          + ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized +
          +
          + ADMX_WindowsExplorer/HideContentViewModeSnippets +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown +
          +
          + ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo +
          +
          + ADMX_WindowsExplorer/MaxRecentDocs +
          +
          + ADMX_WindowsExplorer/NoBackButton +
          +
          + ADMX_WindowsExplorer/NoCDBurning +
          +
          + ADMX_WindowsExplorer/NoCacheThumbNailPictures +
          +
          + ADMX_WindowsExplorer/NoChangeAnimation +
          +
          + ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators +
          +
          + ADMX_WindowsExplorer/NoDFSTab +
          +
          + ADMX_WindowsExplorer/NoDrives +
          +
          + ADMX_WindowsExplorer/NoEntireNetwork +
          +
          + ADMX_WindowsExplorer/NoFileMRU +
          +
          + ADMX_WindowsExplorer/NoFileMenu +
          +
          + ADMX_WindowsExplorer/NoFolderOptions +
          +
          + ADMX_WindowsExplorer/NoHardwareTab +
          +
          + ADMX_WindowsExplorer/NoManageMyComputerVerb +
          +
          + ADMX_WindowsExplorer/NoMyComputerSharedDocuments +
          +
          + ADMX_WindowsExplorer/NoNetConnectDisconnect +
          +
          + ADMX_WindowsExplorer/NoNewAppAlert +
          +
          + ADMX_WindowsExplorer/NoPlacesBar +
          +
          + ADMX_WindowsExplorer/NoRecycleFiles +
          +
          + ADMX_WindowsExplorer/NoRunAsInstallPrompt +
          +
          + ADMX_WindowsExplorer/NoSearchInternetTryHarderButton +
          +
          + ADMX_WindowsExplorer/NoSecurityTab +
          +
          + ADMX_WindowsExplorer/NoShellSearchButton +
          +
          + ADMX_WindowsExplorer/NoStrCmpLogical +
          +
          + ADMX_WindowsExplorer/NoViewContextMenu +
          +
          + ADMX_WindowsExplorer/NoViewOnDrive +
          +
          + ADMX_WindowsExplorer/NoWindowsHotKeys +
          +
          + ADMX_WindowsExplorer/NoWorkgroupContents +
          +
          + ADMX_WindowsExplorer/PlacesBar +
          +
          + ADMX_WindowsExplorer/PromptRunasInstallNetPath +
          +
          + ADMX_WindowsExplorer/RecycleBinSize +
          +
          + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1 +
          +
          + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2 +
          +
          + ADMX_WindowsExplorer/ShowHibernateOption +
          +
          + ADMX_WindowsExplorer/ShowSleepOption +
          +
          + ADMX_WindowsExplorer/TryHarderPinnedLibrary +
          +
          + ADMX_WindowsExplorer/TryHarderPinnedOpenSearch +
          +
          + +### ADMX_WindowsMediaDRM policies + +
          +
          + ADMX_WindowsMediaDRM/DisableOnline +
          +
          + +### ADMX_WindowsMediaPlayer policies + +
          +
          + ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings +
          +
          + ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings +
          +
          + ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings +
          +
          + ADMX_WindowsMediaPlayer/DisableAutoUpdate +
          +
          + ADMX_WindowsMediaPlayer/DisableNetworkSettings +
          +
          + ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration +
          +
          + ADMX_WindowsMediaPlayer/DoNotShowAnchor +
          +
          + ADMX_WindowsMediaPlayer/DontUseFrameInterpolation +
          +
          + ADMX_WindowsMediaPlayer/EnableScreenSaver +
          +
          + ADMX_WindowsMediaPlayer/HidePrivacyTab +
          +
          + ADMX_WindowsMediaPlayer/HideSecurityTab +
          +
          + ADMX_WindowsMediaPlayer/NetworkBuffering +
          +
          + ADMX_WindowsMediaPlayer/PolicyCodecUpdate +
          +
          + ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval +
          +
          + ADMX_WindowsMediaPlayer/PreventLibrarySharing +
          +
          + ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval +
          +
          + ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut +
          +
          + ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval +
          +
          + ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut +
          +
          + ADMX_WindowsMediaPlayer/SkinLockDown +
          +
          + ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols +
          +
          + +### ADMX_WindowsStore policies + +
          +
          + ADMX_WindowsStore/DisableAutoDownloadWin8 +
          +
          + ADMX_WindowsStore/DisableOSUpgrade_1 +
          +
          + ADMX_WindowsStore/DisableOSUpgrade_2 +
          +
          + ADMX_WindowsStore/RemoveWindowsStore_1 +
          +
          + ADMX_WindowsStore/RemoveWindowsStore_2 +
          +
          + +### ADMX_WinInit policies + +
          +
          + ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription +
          +
          + ADMX_WinInit/Hiberboot +
          +
          + ADMX_WinInit/ShutdownTimeoutHungSessionsDescription +
          +
          + +### ADMX_WinLogon policies + +
          +
          + ADMX_WinLogon/CustomShell +
          +
          + ADMX_WinLogon/DisplayLastLogonInfoDescription +
          +
          + ADMX_WinLogon/LogonHoursNotificationPolicyDescription +
          +
          + ADMX_WinLogon/LogonHoursPolicyDescription +
          +
          + ADMX_WinLogon/ReportCachedLogonPolicyDescription +
          +
          + ADMX_WinLogon/SoftwareSASGeneration +
          +
          + +### ADMX_wlansvc policies + +
          +
          + ADMX_wlansvc/SetCost +
          +
          + ADMX_wlansvc/SetPINEnforced +
          +
          + ADMX_wlansvc/SetPINPreferred +
          +
          + +### ADMX_WPN policies + +
          +
          + ADMX_WPN/NoCallsDuringQuietHours +
          +
          + ADMX_WPN/NoLockScreenToastNotification +
          +
          + ADMX_WPN/NoQuietHours +
          +
          + ADMX_WPN/NoToastNotification +
          +
          + ADMX_WPN/QuietHoursDailyBeginMinute +
          +
          + ADMX_WPN/QuietHoursDailyEndMinute +
          +
          + ### ApplicationDefaults policies
          @@ -200,11 +3827,8 @@ The following diagram shows the Policy configuration service provider in tree fo
          ApplicationManagement/AllowSharedUserAppData
          -
          - ApplicationManagement/AllowStore -
          -
          - ApplicationManagement/ApplicationRestrictions +
          + ApplicationManagement/BlockNonAdminUserInstall
          ApplicationManagement/DisableStoreOriginatedApps @@ -343,6 +3967,188 @@ The following diagram shows the Policy configuration service provider in tree fo
          +### Audit policies + +
          +
          + Audit/AccountLogonLogoff_AuditAccountLockout +
          +
          + Audit/AccountLogonLogoff_AuditGroupMembership +
          +
          + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
          +
          + Audit/AccountLogonLogoff_AuditIPsecMainMode +
          +
          + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
          +
          + Audit/AccountLogonLogoff_AuditLogoff +
          +
          + Audit/AccountLogonLogoff_AuditLogon +
          +
          + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
          +
          + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
          +
          + Audit/AccountLogonLogoff_AuditSpecialLogon +
          +
          + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
          +
          + Audit/AccountLogon_AuditCredentialValidation +
          +
          + Audit/AccountLogon_AuditKerberosAuthenticationService +
          +
          + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
          +
          + Audit/AccountLogon_AuditOtherAccountLogonEvents +
          +
          + Audit/AccountManagement_AuditApplicationGroupManagement +
          +
          + Audit/AccountManagement_AuditComputerAccountManagement +
          +
          + Audit/AccountManagement_AuditDistributionGroupManagement +
          +
          + Audit/AccountManagement_AuditOtherAccountManagementEvents +
          +
          + Audit/AccountManagement_AuditSecurityGroupManagement +
          +
          + Audit/AccountManagement_AuditUserAccountManagement +
          +
          + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
          +
          + Audit/DSAccess_AuditDirectoryServiceAccess +
          +
          + Audit/DSAccess_AuditDirectoryServiceChanges +
          +
          + Audit/DSAccess_AuditDirectoryServiceReplication +
          +
          + Audit/DetailedTracking_AuditDPAPIActivity +
          +
          + Audit/DetailedTracking_AuditPNPActivity +
          +
          + Audit/DetailedTracking_AuditProcessCreation +
          +
          + Audit/DetailedTracking_AuditProcessTermination +
          +
          + Audit/DetailedTracking_AuditRPCEvents +
          +
          + Audit/DetailedTracking_AuditTokenRightAdjusted +
          +
          + Audit/ObjectAccess_AuditApplicationGenerated +
          +
          + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
          +
          + Audit/ObjectAccess_AuditCertificationServices +
          +
          + Audit/ObjectAccess_AuditDetailedFileShare +
          +
          + Audit/ObjectAccess_AuditFileShare +
          +
          + Audit/ObjectAccess_AuditFileSystem +
          +
          + Audit/ObjectAccess_AuditFilteringPlatformConnection +
          +
          + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
          +
          + Audit/ObjectAccess_AuditHandleManipulation +
          +
          + Audit/ObjectAccess_AuditKernelObject +
          +
          + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
          +
          + Audit/ObjectAccess_AuditRegistry +
          +
          + Audit/ObjectAccess_AuditRemovableStorage +
          +
          + Audit/ObjectAccess_AuditSAM +
          +
          + Audit/PolicyChange_AuditAuthenticationPolicyChange +
          +
          + Audit/PolicyChange_AuditAuthorizationPolicyChange +
          +
          + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
          +
          + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
          +
          + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
          +
          + Audit/PolicyChange_AuditPolicyChange +
          +
          + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
          +
          + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
          +
          + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
          +
          + Audit/System_AuditIPsecDriver +
          +
          + Audit/System_AuditOtherSystemEvents +
          +
          + Audit/System_AuditSecurityStateChange +
          +
          + Audit/System_AuditSecuritySystemExtension +
          +
          + Audit/System_AuditSystemIntegrity +
          +
          + ### Authentication policies
          @@ -386,11 +4192,11 @@ The following diagram shows the Policy configuration service provider in tree fo
          -### Bitlocker policies +### BitLocker policies
          - Bitlocker/EncryptionMethod + BitLocker/EncryptionMethod
          @@ -438,6 +4244,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          Bluetooth/ServicesAllowedList
          +
          + Bluetooth/SetMinimumEncryptionKeySize +
          ### Browser policies @@ -449,9 +4258,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          Browser/AllowAutofill
          -
          - Browser/AllowBrowser -
          Browser/AllowConfigurationUpdateForBooksLibrary
          @@ -554,9 +4360,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          Browser/EnterpriseSiteListServiceUrl
          -
          - Browser/FirstRunURL -
          Browser/HomePages
          @@ -656,9 +4459,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          Connectivity/AllowConnectedDevices
          -
          - Connectivity/AllowNFC -
          Connectivity/AllowPhonePCLinking
          @@ -905,6 +4705,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          DeliveryOptimization/DOCacheHost
          +
          + DeliveryOptimization/DOCacheHostSource +
          DeliveryOptimization/DODelayBackgroundDownloadFromHttp
          @@ -925,6 +4728,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          DeliveryOptimization/DOGroupIdSource +
          +
          + DeliveryOptimization/DOMaxBackgroundDownloadBandwidth
          DeliveryOptimization/DOMaxCacheAge @@ -933,10 +4739,13 @@ The following diagram shows the Policy configuration service provider in tree fo DeliveryOptimization/DOMaxCacheSize
          - DeliveryOptimization/DOMaxDownloadBandwidth + DeliveryOptimization/DOMaxDownloadBandwidth (deprecated)
          - DeliveryOptimization/DOMaxUploadBandwidth + DeliveryOptimization/DOMaxForegroundDownloadBandwidth +
          +
          + DeliveryOptimization/DOMaxUploadBandwidth (deprecated)
          DeliveryOptimization/DOMinBackgroundQos @@ -963,7 +4772,7 @@ The following diagram shows the Policy configuration service provider in tree fo DeliveryOptimization/DOPercentageMaxBackgroundBandwidth
          - DeliveryOptimization/DOPercentageMaxDownloadBandwidth + DeliveryOptimization/DOPercentageMaxDownloadBandwidth (deprecated)
          DeliveryOptimization/DOPercentageMaxForegroundBandwidth @@ -1027,6 +4836,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
          +
          + DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs +
          DeviceInstallation/PreventDeviceMetadataFromNetwork
          @@ -1036,6 +4848,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
          +
          + DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs +
          DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
          @@ -1047,9 +4862,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          DeviceLock/AllowIdleReturnWithoutPassword
          -
          - DeviceLock/AllowScreenTimeoutWhileLockedUserConfig -
          DeviceLock/AllowSimpleDevicePassword
          @@ -1068,18 +4880,12 @@ The following diagram shows the Policy configuration service provider in tree fo
          DeviceLock/EnforceLockScreenAndLogonImage
          -
          - DeviceLock/EnforceLockScreenProvider -
          DeviceLock/MaxDevicePasswordFailedAttempts
          DeviceLock/MaxInactivityTimeDeviceLock
          -
          - DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay -
          DeviceLock/MinDevicePasswordComplexCharacters
          @@ -1095,9 +4901,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          DeviceLock/PreventLockScreenSlideShow
          -
          - DeviceLock/ScreenTimeoutWhileLocked -
          ### Display policies @@ -1131,6 +4934,9 @@ The following diagram shows the Policy configuration service provider in tree fo ### Education policies
          +
          + Education/AllowGraphingCalculator +
          Education/DefaultPrinterName
          @@ -1208,9 +5014,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          Experience/AllowClipboardHistory
          -
          - Experience/AllowCopyPaste -
          Experience/AllowCortana
          @@ -1223,15 +5026,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          Experience/AllowManualMDMUnenrollment
          -
          - Experience/AllowSIMErrorDialogPromptWhenNoSIM -
          Experience/AllowSaveAsOfOfficeFiles
          -
          - Experience/AllowScreenCapture -
          Experience/AllowSharingOfOfficeFiles
          @@ -1241,15 +5038,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          Experience/AllowTailoredExperiencesWithDiagnosticData
          -
          - Experience/AllowTaskSwitcher -
          Experience/AllowThirdPartySuggestionsInWindowsSpotlight
          -
          - Experience/AllowVoiceRecording -
          Experience/AllowWindowsConsumerFeatures
          @@ -1271,6 +5062,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          Experience/ConfigureWindowsSpotlightOnLockScreen
          +
          + Experience/DisableCloudOptimizedContent +
          Experience/DoNotShowFeedbackNotifications
          @@ -2178,15 +5972,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
          -
          - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways -
          -
          - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible -
          -
          - LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges -
          LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
          @@ -2211,18 +5996,12 @@ The following diagram shows the Policy configuration service provider in tree fo
          LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
          -
          - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways -
          LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
          LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
          -
          - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession -
          LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
          @@ -2271,18 +6050,12 @@ The following diagram shows the Policy configuration service provider in tree fo
          LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
          -
          - LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon -
          LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
          LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
          -
          - LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems -
          LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
          @@ -2315,7 +6088,13 @@ The following diagram shows the Policy configuration service provider in tree fo
          +### LocalUsersAndGroups policies +
          +
          + LocalUsersAndGroups/Configure +
          +
          ### LockDown policies @@ -2339,14 +6118,28 @@ The following diagram shows the Policy configuration service provider in tree fo ### Messaging policies
          -
          - Messaging/AllowMMS -
          Messaging/AllowMessageSync
          +
          + +### MixedReality policies + +
          - Messaging/AllowRCS + MixedReality/AADGroupMembershipCacheValidityInDays +
          +
          + MixedReality/BrightnessButtonDisabled +
          +
          + MixedReality/FallbackDiagnostics +
          +
          + MixedReality/MicrophoneDisabled +
          +
          + MixedReality/VolumeButtonDisabled
          @@ -2390,6 +6183,14 @@ The following diagram shows the Policy configuration service provider in tree fo +### Multitasking policies + +
          +
          + Multitasking/BrowserAltTabBlowout +
          +
          + ### NetworkIsolation policies
          @@ -2985,9 +6786,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          Search/PreventRemoteQueries
          -
          - Search/SafeSearchPermissions -
          ### Security policies @@ -2999,15 +6797,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices
          -
          - Security/AllowManualRootCertificateInstallation -
          Security/AllowRemoveProvisioningPackage
          -
          - Security/AntiTheftMode -
          Security/ClearTPMIfNotReady
          @@ -3050,9 +6842,6 @@ The following diagram shows the Policy configuration service provider in tree fo
          Settings/AllowDateTime
          -
          - Settings/AllowEditDeviceName -
          Settings/AllowLanguage
          @@ -3085,7 +6874,7 @@ The following diagram shows the Policy configuration service provider in tree fo -### SmartScreen policies +### Windows Defender SmartScreen policies
          @@ -3208,6 +6997,23 @@ The following diagram shows the Policy configuration service provider in tree fo
          Storage/AllowDiskHealthModelUpdates
          +
          + Storage/AllowStorageSenseGlobal +
          +
          + Storage/AllowStorageSenseTemporaryFilesCleanup +
          +
          + Storage/ConfigStorageSenseCloudContentDehydrationThreshold +
          +
          + Storage/ConfigStorageSenseDownloadsCleanupThreshold +
          +
          + Storage/ConfigStorageSenseGlobalCadence +
          +
          + Storage/ConfigStorageSenseRecycleBinCleanupThreshold
          Storage/EnhancedStorageDevices
          @@ -3368,6 +7174,15 @@ The following diagram shows the Policy configuration service provider in tree fo
          TextInput/AllowLinguisticDataCollection
          +
          + TextInput/ConfigureJapaneseIMEVersion +
          +
          + TextInput/ConfigureSimplifiedChineseIMEVersion +
          +
          + TextInput/ConfigureTraditionalChineseIMEVersion +
          TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
          @@ -3409,9 +7224,6 @@ The following diagram shows the Policy configuration service provider in tree fo ### TimeLanguageSettings policies
          -
          - TimeLanguageSettings/AllowSet24HourClock -
          TimeLanguageSettings/ConfigureTimeZone
          @@ -3503,6 +7315,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          Update/DisableDualScan
          +
          + Update/DisableWUfBSafeguards +
          Update/EngagedRestartDeadline
          @@ -3599,6 +7414,13 @@ The following diagram shows the Policy configuration service provider in tree fo
          Update/SetEDURestart
          +
          + Update/SetProxyBehaviorForUpdateDetection +
          +
          + Update/TargetReleaseVersion +
          +
          Update/UpdateNotificationLevel
          @@ -3852,6 +7674,29 @@ The following diagram shows the Policy configuration service provider in tree fo
          +### WindowsSandbox policies + +
          +
          + WindowsSandbox/AllowAudioInput +
          +
          + WindowsSandbox/AllowClipboardRedirection +
          +
          + WindowsSandbox/AllowNetworking +
          +
          + WindowsSandbox/AllowPrinterRedirection +
          +
          + WindowsSandbox/AllowVGPU +
          +
          + WindowsSandbox/AllowVideoInput +
          +
          + ### WirelessDisplay policies
          @@ -3881,1701 +7726,27 @@ The following diagram shows the Policy configuration service provider in tree fo
          +## Policies in Policy CSP supported by Group Policy and ADMX-backed policies in Policy CSP +- [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +- [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) -## ADMX-backed policies +> [!NOTE] +> Not all Policies in Policy CSP supported by Group Policy are ADMX-backed. For more details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) -- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +## Policies in Policy CSP supported by HoloLens devices +- [Policies in Policy CSP supported by HoloLens 2](policy-csps-supported-by-hololens2.md) +- [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +- [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +## Policies in Policy CSP supported by Windows 10 IoT +- [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +- [Policies in Policy CSP supported by Windows 10 IoT Core](policy-csps-supported-by-iot-core.md) -## Policies supported by GP +## Policies in Policy CSP supported by Microsoft Surface Hub +- [Policies in Policy CSP supported by Microsoft Surface Hub](policy-csps-supported-by-surface-hub.md) -- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) -- [ApplicationDefaults/EnableAppUriHandlers](./policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) -- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) -- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) -- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) -- [ApplicationManagement/MSIAllowUserControlOverInstall](./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) -- [ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges](./policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) -- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) -- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) -- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [BITS/BandwidthThrottlingEndTime](./policy-csp-bits.md#bits-bandwidththrottlingendtime) -- [BITS/BandwidthThrottlingStartTime](./policy-csp-bits.md#bits-bandwidththrottlingstarttime) -- [BITS/BandwidthThrottlingTransferRate](./policy-csp-bits.md#bits-bandwidththrottlingtransferrate) -- [BITS/CostedNetworkBehaviorBackgroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) -- [BITS/CostedNetworkBehaviorForegroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) -- [BITS/JobInactivityTimeout](./policy-csp-bits.md#bits-jobinactivitytimeout) -- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) -- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) -- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) -- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) -- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) -- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) -- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) -- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) -- [Browser/AllowFullScreenMode](./policy-csp-browser.md#browser-allowfullscreenmode) -- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) -- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) -- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) -- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) -- [Browser/AllowPrelaunch](./policy-csp-browser.md#browser-allowprelaunch) -- [Browser/AllowPrinting](./policy-csp-browser.md#browser-allowprinting) -- [Browser/AllowSavingHistory](./policy-csp-browser.md#browser-allowsavinghistory) -- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) -- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSideloadingOfExtensions](./policy-csp-browser.md#browser-allowsideloadingofextensions) -- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) -- [Browser/AllowTabPreloading](./policy-csp-browser.md#browser-allowtabpreloading) -- [Browser/AllowWebContentOnNewTabPage](./policy-csp-browser.md#browser-allowwebcontentonnewtabpage) -- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) -- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) -- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) -- [Browser/ConfigureFavoritesBar](./policy-csp-browser.md#browser-configurefavoritesbar) -- [Browser/ConfigureHomeButton](./policy-csp-browser.md#browser-configurehomebutton) -- [Browser/ConfigureKioskMode](./policy-csp-browser.md#browser-configurekioskmode) -- [Browser/ConfigureKioskResetAfterIdleTimeout](./policy-csp-browser.md#browser-configurekioskresetafteridletimeout) -- [Browser/ConfigureOpenMicrosoftEdgeWith](./policy-csp-browser.md#browser-configureopenmicrosoftedgewith) -- [Browser/ConfigureTelemetryForMicrosoft365Analytics](./policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) -- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) -- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) -- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) -- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) -- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) -- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) -- [Browser/PreventCertErrorOverrides](./policy-csp-browser.md#browser-preventcerterroroverrides) -- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) -- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) -- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) -- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) -- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) -- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) -- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) -- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) -- [Browser/SetHomeButtonURL](./policy-csp-browser.md#browser-sethomebuttonurl) -- [Browser/SetNewTabPageURL](./policy-csp-browser.md#browser-setnewtabpageurl) -- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) -- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) -- [Browser/UnlockHomeButton](./policy-csp-browser.md#browser-unlockhomebutton) -- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) -- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) -- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) -- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) -- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) -- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) -- [Connectivity/AllowPhonePCLinking](./policy-csp-connectivity.md#connectivity-allowphonepclinking) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) -- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) -- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) -- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) -- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) -- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) -- [Defender/CheckForSignaturesBeforeRunningScan](./policy-csp-defender.md#defender-checkforsignaturesbeforerunningscan) -- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) -- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) -- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) -- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) -- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) -- [Defender/DisableCatchupFullScan](./policy-csp-defender.md#defender-disablecatchupfullscan) -- [Defender/DisableCatchupQuickScan](./policy-csp-defender.md#defender-disablecatchupquickscan) -- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) -- [Defender/EnableLowCPUPriority](./policy-csp-defender.md#defender-enablelowcpupriority) -- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) -- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) -- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) -- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) -- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) -- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) -- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) -- [Defender/SignatureUpdateFallbackOrder](./policy-csp-defender.md#defender-signatureupdatefallbackorder) -- [Defender/SignatureUpdateFileSharesSources](./policy-csp-defender.md#defender-signatureupdatefilesharessources) -- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) - [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) -- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) -- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) -- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) -- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) -- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) -- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) -- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) -- [DmaGuard/DeviceEnumerationPolicy](./policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) -- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [Experience/AllowClipboardHistory](./policy-csp-experience.md#experience-allowclipboardhistory) -- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) -- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) -- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) -- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) -- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) -- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) -- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) -- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) -- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) -- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) -- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) -- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) -- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) -- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) -- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) -- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [LanmanWorkstation/EnableInsecureGuestLogons](./policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) -- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) -- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) -- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) -- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) -- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) -- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) -- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) -- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) -- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) -- [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-amountofidletimerequiredbeforesuspendingsession) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) -- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowlocalsystemtousecomputeridentityforntlm) -- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) -- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) -- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) -- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) -- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) -- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) -- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) -- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) -- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) -- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) -- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) -- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) -- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) -- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) -- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) -- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) -- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) -- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) -- [Notifications/DisallowCloudNotification](./policy-csp-notifications.md#notifications-disallowcloudnotification) -- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) -- [Notifications/DisallowTileNotification](./policy-csp-notifications.md#notifications-disallowtilenotification) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) -- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/SelectLidCloseActionOnBattery](./policy-csp-power.md#power-selectlidcloseactiononbattery) -- [Power/SelectLidCloseActionPluggedIn](./policy-csp-power.md#power-selectlidcloseactionpluggedin) -- [Power/SelectPowerButtonActionOnBattery](./policy-csp-power.md#power-selectpowerbuttonactiononbattery) -- [Power/SelectPowerButtonActionPluggedIn](./policy-csp-power.md#power-selectpowerbuttonactionpluggedin) -- [Power/SelectSleepButtonActionOnBattery](./policy-csp-power.md#power-selectsleepbuttonactiononbattery) -- [Power/SelectSleepButtonActionPluggedIn](./policy-csp-power.md#power-selectsleepbuttonactionpluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Power/TurnOffHybridSleepOnBattery](./policy-csp-power.md#power-turnoffhybridsleeponbattery) -- [Power/TurnOffHybridSleepPluggedIn](./policy-csp-power.md#power-turnoffhybridsleeppluggedin) -- [Power/UnattendedSleepTimeoutOnBattery](./policy-csp-power.md#power-unattendedsleeptimeoutonbattery) -- [Power/UnattendedSleepTimeoutPluggedIn](./policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) -- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) -- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) -- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) -- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) -- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) -- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) -- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) -- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) -- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) -- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) -- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) -- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) -- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) -- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) -- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) -- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) -- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) -- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) -- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) -- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) -- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) -- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) -- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) -- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) -- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) -- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) -- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) -- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) -- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) -- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) -- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) -- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) -- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) -- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) -- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) -- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) -- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) -- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) -- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) -- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) -- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) -- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) -- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) -- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) -- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) -- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) -- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) -- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) -- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) -- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) -- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) -- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) -- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) -- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) -- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) -- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) -- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) -- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) -- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) -- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) -- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) -- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) -- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) -- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) -- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) -- [Search/AllowCortanaInAAD](./policy-csp-search.md#search-allowcortanainaad) -- [Search/AllowFindMyFiles](./policy-csp-search.md#search-allowfindmyfiles) -- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) -- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) -- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) -- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) -- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) -- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) -- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) -- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) -- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) -- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) -- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) -- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) -- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) -- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) -- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) -- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) -- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) -- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) -- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) -- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) -- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) -- [Start/StartLayout](./policy-csp-start.md#start-startlayout) -- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) -- [System/AllowCommercialDataPipeline](./policy-csp-system.md#system-allowcommercialdatapipeline) -- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata) -- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) -- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) -- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint) -- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) -- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) -- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete) -- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer) -- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) -- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) -- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) -- [System/TurnOffFileHistory](./policy-csp-system.md#system-turnofffilehistory) -- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) -- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) -- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) -- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) -- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) -- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) -- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) -- [TextInput/AllowLinguisticDataCollection](./policy-csp-textinput.md#textinput-allowlinguisticdatacollection) -- [Troubleshooting/AllowRecommendations](./policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) -- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) -- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) -- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) -- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) -- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) -- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) -- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) -- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) -- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](./policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) -- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) -- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) -- [Update/AutomaticMaintenanceWakeUp](./policy-csp-update.md#update-automaticmaintenancewakeup) -- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) -- [Update/ConfigureDeadlineForFeatureUpdates](./policy-csp-update.md#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](./policy-csp-update.md#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](./policy-csp-update.md#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](./policy-csp-update.md#update-configuredeadlinenoautoreboot) -- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) -- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) -- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) -- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) -- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) -- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) -- [Update/EngagedRestartDeadlineForFeatureUpdates](./policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) -- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) -- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) -- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) -- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) -- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) -- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) -- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) -- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) -- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) -- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) -- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) -- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) -- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) -- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) -- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) -- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) -- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) -- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) -- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) -- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) -- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) -- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) -- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) -- [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) -- [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) -- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) -- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) -- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) -- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) -- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) -- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) -- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) -- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) -- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) -- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) -- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) -- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) -- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) -- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) -- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) -- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) -- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) -- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) -- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) -- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) -- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) -- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) -- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) -- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) -- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) -- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) -- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) -- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) -- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) -- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) -- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) -- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) -- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) -- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) -- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) -- [WindowsDefenderSecurityCenter/DisableClearTpmButton](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) -- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) -- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) -- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) -- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) -- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) -- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) -- [WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) -- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) -- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) -- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) -- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) -- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) -- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) -- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) -- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) -- [WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) -- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) -- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) -- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) -- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) -- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) -- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnableFirstLogonAnimation](./policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) -- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) -- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) - -## Policies supported by HoloLens 2 - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](#authentication-preferredaadtenantdomainname) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [Experience/AllowCortana](#experience-allowcortana) -- [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment) -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [Privacy/LetAppsAccessAccountInfo](#privacy-letappsaccessaccountinfo) -- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [Privacy/LetAppsAccessBackgroundSpatialPerception](#privacy-letappsaccessbackgroundspatialperception) -- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) -- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) -- [Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessLocation](#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessMicrophone](#privacy-letappsaccessmicrophone) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) -- [System/AllowCommercialDataPipeline](#system-allowcommercialdatapipeline) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/AllowTelemetry](#system-allowtelemetry) -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/BranchReadinessLevel](#update-branchreadinesslevel) -- [Update/DeferFeatureUpdatesPeriodInDays](#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](#update-deferqualityupdatesperiodindays) -- [Update/ManagePreviewBuilds](#update-managepreviewbuilds) -- [Update/PauseFeatureUpdates](#update-pausefeatureupdates) -- [Update/PauseQualityUpdates](#update-pausequalityupdates) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - - - -## Policies supported by HoloLens (1st gen) Commercial Suite - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](#authentication-preferredaadtenantdomainname) -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [Experience/AllowCortana](#experience-allowcortana) -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - - - -## Policies supported by HoloLens (1st gen) Development Edition - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Browser/AllowCookies](#browser-allowcookies) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [Experience/AllowCortana](#experience-allowcortana) -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) -- [System/AllowTelemetry](#system-allowtelemetry) -- [System/AllowLocation](#system-allowlocation) -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - - - -## Policies supported by Microsoft Surface Hub - -- [Camera/AllowCamera](#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) -- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites) -- [Defender/AllowArchiveScanning](#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](#defender-allowioavprotection) -- [Defender/AllowIntrusionPreventionSystem](#defender-allowintrusionpreventionsystem) -- [Defender/AllowOnAccessProtection](#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](#defender-allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](#defender-allowscriptscanning) -- [Defender/AllowUserUIAccess](#defender-allowuseruiaccess) -- [Defender/AvgCPULoadFactor](#defender-avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](#defender-daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](#defender-excludedextensions) -- [Defender/ExcludedPaths](#defender-excludedpaths) -- [Defender/ExcludedProcesses](#defender-excludedprocesses) -- [Defender/PUAProtection](#defender-puaprotection) -- [Defender/RealTimeScanDirection](#defender-realtimescandirection) -- [Defender/ScanParameter](#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](#defender-schedulescanday) -- [Defender/ScheduleScanTime](#defender-schedulescantime) -- [Defender/SignatureUpdateInterval](#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](#defender-threatseveritydefaultaction) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](#desktop-preventuserredirectionofprofilefolders) -- [TextInput/AllowIMELogging](#textinput-allowimelogging) -- [TextInput/AllowIMENetworkAccess](#textinput-allowimenetworkaccess) -- [TextInput/AllowInputPanel](#textinput-allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](#textinput-allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](#textinput-allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](#textinput-allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](#textinput-allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](#textinput-allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](#textinput-excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](#textinput-excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](#textinput-excludejapaneseimeexceptshiftjis) -- [WiFi/AllowWiFiHotSpotReporting](#wifi-allowwifihotspotreporting) - - - -## Policies supported by Windows 10 IoT Core - -- [Camera/AllowCamera](#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) -- [CredentialProviders/AllowPINLogon](#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](#credentialproviders-blockpicturepassword) -- [DataProtection/AllowDirectMemoryAccess](#dataprotection-allowdirectmemoryaccess) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](#internetexplorer-disablecompatview) -- [InternetExplorer/DisableGeolocation](#internetexplorer-disablegeolocation) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) -- [Privacy/LetAppsActivateWithVoice](#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](#privacy-letappsactivatewithvoiceabovelock) -- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) -- [Wifi/WLANScanMode](#wifi-wlanscanmode) - - - -## Policies supported by Windows 10 IoT Enterprise - -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](#internetexplorer-disablecompatview) -- [InternetExplorer/DisableFeedsBackgroundSync](#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableGeolocation](#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableWebAddressAutoComplete](#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/NewTabDefaultPage](#internetexplorer-newtabdefaultpage) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) -- [Privacy/LetAppsActivateWithVoice](#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](#privacy-letappsactivatewithvoiceabovelock) -- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) - - - - -## Policies that can be set using Exchange Active Sync (EAS) - -- [Browser/AllowBrowser](#browser-allowbrowser) -- [Camera/AllowCamera](#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowCellularDataRoaming](#connectivity-allowcellulardataroaming) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [DeviceLock/PreventLockScreenSlideShow](#devicelock-preventlockscreenslideshow) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/TelemetryProxy](#system-telemetryproxy) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) - - -## Examples - -Set the minimum password length to 4 characters. - -```xml - - - - $CmdID$ - - - ./Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordLength - - - int - - 4 - - - - - -``` - -Do not allow NFC. - -```xml - - - - $CmdID$ - - - ./Vendor/MSFT/Policy/Config/Connectivity/AllowNFC - - - int - - 0 - - - - - -``` +## Policies in Policy CSP that can be set using Exchange ActiveSync (EAS) +- [Policies in Policy CSP that can be set using Exchange ActiveSync (EAS)](policy-csps-that-can-be-set-using-eas.md) ## Related topics diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index b5cb013a88..23c1bb8142 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,12 +1,13 @@ --- title: Policy CSP - AboveLock -description: Policy CSP - AboveLock +description: Learn the various AboveLock Policy configuration service provider (CSP) for Windows editions of Home, Pro, Business, and more. ms.author: dansimp +ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -21,9 +22,6 @@ manager: dansimp ## AboveLock policies
          -
          - AboveLock/AllowActionCenterNotifications -
          AboveLock/AllowCortanaAboveLock
          @@ -35,60 +33,6 @@ manager: dansimp
          - -**AboveLock/AllowActionCenterNotifications** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Specifies whether to allow Action Center notifications above the device lock screen. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 - Not allowed. -- 1 (default) - Allowed. - - - - -
          **AboveLock/AllowCortanaAboveLock** @@ -96,26 +40,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -154,26 +106,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -199,12 +159,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 871c434dca..4367ed3ed6 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Accounts -description: Policy CSP - Accounts +description: Learn about the Policy configuration service provider (CSP). This articles describes account policies. ms.author: dansimp +ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -30,7 +31,7 @@ manager: dansimp
          Accounts/AllowMicrosoftAccountSignInAssistant
          -
          +

          @@ -41,26 +42,42 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          Mobilecheck mark
          Mobile Enterprisecheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -96,26 +113,42 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          Mobilecheck mark
          Mobile Enterprisecheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -148,26 +181,42 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          Mobilecheck mark2
          Mobile Enterprisecheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -183,6 +232,9 @@ Added in Windows 10, version 1703. Allows IT Admins the ability to disable the " > [!NOTE] > If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). +> [!NOTE] +> If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to “step-up” from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app. + The following list shows the supported values: @@ -192,36 +244,18 @@ The following list shows the supported values: - -
          - - - - -## Accounts policies supported by HoloLens 2 - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) - - - -## Accounts policies supported by HoloLens (1st gen) Commercial Suite - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) - - - -## Accounts policies supported by HoloLens (1st gen) Development Edition - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 09639791f8..d760021b1e 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -1,12 +1,13 @@ --- title: Policy CSP - ActiveXControls -description: Policy CSP - ActiveXControls +description: Learn about various Policy configuration service provider (CSP) - ActiveXControls settings, including SyncML, for Windows 10. ms.author: dansimp +ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -65,7 +74,7 @@ manager: dansimp -This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL. +This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved ActiveX Install sites specified by host URL. If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL. @@ -92,12 +101,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md new file mode 100644 index 0000000000..38d15714d4 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -0,0 +1,119 @@ +--- +title: Policy CSP - ADMX_ActiveXInstallService +description: Policy CSP - ADMX_ActiveXInstallService +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ActiveXInstallService +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_ActiveXInstallService policies + +
          +
          + ADMX_ActiveXInstallService/AxISURLZonePolicies +
          +
          + + +
          + + +**ADMX_ActiveXInstallService/AxISURLZonePolicies** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the installation of ActiveX controls for sites in Trusted zone. + +If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting. + +If you disable or do not configure this policy setting, ActiveX controls prompt the user before installation. + +If the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore. + +> [!NOTE] +> This policy setting applies to all sites in Trusted zones. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Establish ActiveX installation policy for sites in Trusted zones* +- GP name: *AxISURLZonePolicies* +- GP path: *Windows Components\ActiveX Installer Service* +- GP ADMX file name: *ActiveXInstallService.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md new file mode 100644 index 0000000000..36128621e3 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -0,0 +1,954 @@ +--- +title: Policy CSP - ADMX_AddRemovePrograms +description: Policy CSP - ADMX_AddRemovePrograms +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AddRemovePrograms + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## Policy CSP - ADMX_AddRemovePrograms + +
          +
          + ADMX_AddRemovePrograms/DefaultCategory +
          +
          + ADMX_AddRemovePrograms/NoAddFromCDorFloppy +
          +
          + ADMX_AddRemovePrograms/NoAddFromInternet +
          +
          + ADMX_AddRemovePrograms/NoAddFromNetwork +
          +
          + ADMX_AddRemovePrograms/NoAddPage +
          +
          + ADMX_AddRemovePrograms/NoAddRemovePrograms +
          +
          + ADMX_AddRemovePrograms/NoChooseProgramsPage +
          +
          + ADMX_AddRemovePrograms/NoRemovePage +
          +
          + ADMX_AddRemovePrograms/NoServices +
          +
          + ADMX_AddRemovePrograms/NoSupportInfo +
          +
          + ADMX_AddRemovePrograms/NoWindowsSetupPage +
          +
          + + +
          + + +**ADMX_AddRemovePrograms/DefaultCategory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. The policy setting specifies the category of programs that appears when users open the "Add New Programs" page. If you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. You can use the Category box on the "Add New Programs" page to display programs in other categories. + +To use this setting, type the name of a category in the Category box for this setting. You must enter a category that is already defined in Add or Remove Programs. To define a category, use Software Installation. + +If you disable this setting or do not configure it, all programs (Category: All) are displayed when the "Add New Programs" page opens. You can use this setting to direct users to the programs they are most likely to need. + +> [!NOTE] +> This setting is ignored if either the "Remove Add or Remove Programs" setting or the "Hide Add New Programs page" setting is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify default category for Add New Programs* +- GP name: *DefaultCategory* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoAddFromCDorFloppy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media. + +If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. This setting does not prevent users from using other tools and methods to add or remove program components. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. Also, if the "Prevent removable media source for any install" setting (located in User Configuration\Administrative Templates\Windows Components\Windows Installer) is enabled, users cannot add programs from removable media, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add a program from CD-ROM or floppy disk" option* +- GP name: *NoAddFromCDorFloppy* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoAddFromInternet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update. + +If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. This setting does not prevent users from using other tools and methods to connect to Windows Update. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add programs from Microsoft" option* +- GP name: *NoAddFromInternet* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoAddFromNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from viewing or installing published programs. This setting removes the "Add programs from your network" section from the Add New Programs page. The "Add programs from your network" section lists published programs and provides an easy way to install them. Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files. + +If you enable this setting, users cannot tell which programs have been published by the system administrator, and they cannot use Add or Remove Programs to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu. + +If you disable this setting or do not configure it, "Add programs from your network" is available to all users. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add programs from your network" option* +- GP name: *NoAddFromNetwork* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoAddPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Add New Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Add New Programs button lets users install programs published or assigned by a system administrator. + +If you disable this setting or do not configure it, the Add New Programs button is available to all users. This setting does not prevent users from using other tools and methods to install programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Add New Programs page* +- GP name: *NoAddPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoAddRemovePrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from using Add or Remove Programs. This setting removes Add or Remove Programs from Control Panel and removes the Add or Remove Programs item from menus. Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs. + +If you disable this setting or do not configure it, Add or Remove Programs is available to all users. When enabled, this setting takes precedence over the other settings in this folder. This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Add or Remove Programs* +- GP name: *NoAddRemovePrograms* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoChooseProgramsPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Set Program Access and Defaults button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. + +If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. This setting does not prevent the Set Program Access and Defaults icon from appearing on the Start menu. See the "Remove Set Program Access and Defaults from Start menu" setting. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Set Program Access and Defaults page* +- GP name: *NoChooseProgramsPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoRemovePage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Change or Remove Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs. + +If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. This setting does not prevent users from using other tools and methods to delete or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Change or Remove Programs page* +- GP name: *NoRemovePage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from using Add or Remove Programs to configure installed services. This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools. + +If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. If you enable this setting, "Set up services" never appears. This setting does not prevent users from using other methods to configure services. + +> [!NOTE] +> When "Set up services" does not appear, clicking the Add/Remove Windows Components button starts the Windows Component Wizard immediately. Because the only remaining option on the Add/Remove Windows Components page starts the wizard, that option is selected automatically, and the page is bypassed. To remove "Set up services" and prevent the Windows Component Wizard from starting, enable the "Hide Add/Remove Windows Components page" setting. If the "Hide Add/Remove Windows Components page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Go directly to Components Wizard* +- GP name: *NoServices* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoSupportInfo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes links to the Support Info dialog box from programs on the Change or Remove Programs page. Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page. + +If you disable this setting or do not configure it, the Support Info hyperlink appears. + +> [!NOTE] +> Not all programs provide a support information hyperlink. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Support Information* +- GP name: *NoSupportInfo* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
          + + +**ADMX_AddRemovePrograms/NoWindowsSetupPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files. + +If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Add/Remove Windows Components page* +- GP name: *NoWindowsSetupPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md new file mode 100644 index 0000000000..ef0f985661 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -0,0 +1,744 @@ +--- +title: Policy CSP - ADMX_AppCompat +description: Policy CSP - ADMX_AppCompat +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 08/20/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AppCompat + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## Policy CSP - ADMX_AppCompat + +
          +
          + ADMX_AppCompat/AppCompatPrevent16BitMach + +
          +
          + ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage + +
          +
          + ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry + +
          +
          + ADMX_AppCompat/AppCompatTurnOffSwitchBack + +
          +
          + ADMX_AppCompat/AppCompatTurnOffEngine + +
          +
          + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1 + +
          +
          + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2 + +
          +
          + ADMX_AppCompat/AppCompatTurnOffUserActionRecord + +
          +
          + ADMX_AppCompat/AppCompatTurnOffProgramInventory + +
          +
          + + +
          + + +**ADMX_AppCompat/AppCompatPrevent16BitMach** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether to prevent the MS-DOS subsystem (**ntvdm.exe**) from running on this computer. This setting affects the launching of 16-bit applications in the operating system. + +You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, **ntvdm.exe** must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased. + +If the status is set to Enabled, the MS-DOS subsystem is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run. + +If the status is set to Disabled, the MS-DOS subsystem runs for all users on this computer. + +If the status is set to Not Configured, the OS falls back on a local policy set by the registry DWORD value **HKLM\System\CurrentControlSet\Control\WOW\DisallowedPolicyDefault**. If that value is non-0, this prevents all 16-bit applications from running. If that value is 0, 16-bit applications are allowed to run. If that value is also not present, on Windows 10 and above, the OS will launch the 16-bit application support control panel to allow an elevated administrator to make the decision; on Windows 7 and down-level, the OS will allow 16-bit applications to run. + +> [!NOTE] +> This setting appears only in Computer Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to 16-bit applications* +- GP name: *AppCompatPrevent16BitMach* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the visibility of the Program Compatibility property page shell extension. This shell extension is visible on the property context-menu of any program shortcut or executable file. + +The compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications. + +Enabling this policy setting removes the property page from the context-menus, but does not affect previous compatibility settings applied to application using this interface. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Program Compatibility Property Page* +- GP name: *AppCompatRemoveProgramCompatPropPage* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. The policy setting controls the state of the Application Telemetry engine in the system. + +Application Telemetry is a mechanism that tracks anonymous usage of specific Windows system components by applications. + +Turning Application Telemetry off by selecting "enable" will stop the collection of usage data. + +If the customer Experience Improvement program is turned off, Application Telemetry will be turned off regardless of how this policy is set. + +Disabling telemetry will take effect on any newly launched applications. To ensure that telemetry collection has stopped for all applications, please reboot your machine. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Application Telemetry* +- GP name: *AppCompatTurnOffApplicationImpactTelemetry* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatTurnOffSwitchBack** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. The policy setting controls the state of the Switchback compatibility engine in the system. + +Switchback is a mechanism that provides generic compatibility mitigations to older applications by providing older behavior to old applications and new behavior to new applications. + +Switchback is on by default. + +If you enable this policy setting, Switchback will be turned off. Turning Switchback off may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they are using. + +If you disable or do not configure this policy setting, the Switchback will be turned on. + +Reboot the system after changing the setting to ensure that your system accurately reflects those changes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off SwitchBack Compatibility Engine* +- GP name: *AppCompatTurnOffSwitchBack* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatTurnOffEngine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of the application compatibility engine in the system. + +The engine is part of the loader and looks through a compatibility database every time an application is started on the system. If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a know problem. + +Turning off the application compatibility engine will boost system performance. However, this will degrade the compatibility of many popular legacy applications, and will not block known incompatible applications from installing. For example, this may result in a blue screen if an old anti-virus application is installed. + +The Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations will not be applied to applications and their installers and these applications may fail to install or run properly. + +This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential. + +> [!NOTE] +> Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, reboot to ensure that your system accurately reflects those changes. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Application Compatibility Engine* +- GP name: *AppCompatTurnOffEngine* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\Administrative Templates\Windows Components\Application Compatibility. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Program Compatibility Assistant* +- GP name: *AppCompatTurnOffProgramCompatibilityAssistant_1* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of the Program Compatibility Assistant (PCA). The PCA monitors applications run by the user. When a potential compatibility issue with an application is detected, the PCA will prompt the user with recommended solutions. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. + +If you enable this policy setting, the PCA will be turned off. The user will not be presented with solutions to known compatibility issues when running applications. Turning off the PCA can be useful for system administrators who require better performance and are already aware of application compatibility issues. + +If you disable or do not configure this policy setting, the PCA will be turned on. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. + +> [!NOTE] +> The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Program Compatibility Assistant* +- GP name: *AppCompatTurnOffProgramCompatibilityAssistant_2* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatTurnOffUserActionRecord** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of Steps Recorder. + +Steps Recorder keeps a record of steps taken by the user. The data generated by Steps Recorder can be used in feedback systems such as Windows Error Reporting to help developers understand and fix problems. The data includes user actions such as keyboard input and mouse input, user interface data, and screenshots. Steps Recorder includes an option to turn on and off data collection. + +If you enable this policy setting, Steps Recorder will be disabled. + +If you disable or do not configure this policy setting, Steps Recorder will be enabled. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Steps Recorder* +- GP name: *AppCompatTurnOffUserActionRecord* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
          + + +**ADMX_AppCompat/AppCompatTurnOffProgramInventory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the state of the Inventory Collector. + +The Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft. This information is used to help diagnose compatibility problems. + +If you enable this policy setting, the Inventory Collector will be turned off and data will not be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled. + +If you disable or do not configure this policy setting, the Inventory Collector will be turned on. + +> [!NOTE] +> This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Inventory Collector* +- GP name: *AppCompatTurnOffProgramInventory* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md new file mode 100644 index 0000000000..44f5d6b6f7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -0,0 +1,120 @@ +--- +title: Policy CSP - ADMX_AppxPackageManager +description: Policy CSP - ADMX_AppxPackageManager +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AppxPackageManager +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_AppxPackageManager policies + +
          +
          + ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles +
          +
          + + +
          + + +**ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. + +Special profiles are the following user profiles, where changes are discarded after the user signs off: + +- Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies +- Mandatory user profiles and super-mandatory profiles, which are created by an administrator +- Temporary user profiles, which are created when an error prevents the correct profile from loading +- User profiles for the Guest account and members of the Guests group + +If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile. + +If you disable or do not configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow deployment operations in special profiles* +- GP name: *AllowDeploymentInSpecialProfiles* +- GP path: *Windows Components\App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md new file mode 100644 index 0000000000..8dcf16d88f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -0,0 +1,338 @@ +--- +title: Policy CSP - ADMX_AppXRuntime +description: Policy CSP - ADMX_AppXRuntime +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AppXRuntime +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_AppXRuntime policies + +
          +
          + ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules +
          +
          + ADMX_AppXRuntime/AppxRuntimeBlockFileElevation +
          +
          + ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT +
          +
          + ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation +
          +
          + + +
          + + +**ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer. + +If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use. + +If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on dynamic Content URI Rules for Windows store apps* +- GP name: *AppxRuntimeApplicationContentUriRules* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
          + + +**ADMX_AppXRuntime/AppxRuntimeBlockFileElevation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type. + +If you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps. + +If you disable or do not configure this policy setting, Windows Store apps can open files in the default desktop app for a file type. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block launching desktop apps associated with a file.* +- GP name: *AppxRuntimeBlockFileElevation* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
          + + +**ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched. + +If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected. + +If you disable or do not configure this policy setting, all Universal Windows apps can be launched. + +> [!WARNING] +> This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block launching Universal Windows apps with Windows Runtime API access from hosted content.* +- GP name: *AppxRuntimeBlockHostedAppAccessWinRT* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
          + + +**ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app. + +If you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps. + +If you disable or do not configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme. + +> [!NOTE] +> Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block launching desktop apps associated with a URI scheme* +- GP name: *AppxRuntimeBlockProtocolElevation* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md new file mode 100644 index 0000000000..e43001ae9c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -0,0 +1,422 @@ +--- +title: Policy CSP - ADMX_AttachmentManager +description: Policy CSP - ADMX_AttachmentManager +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AttachmentManager +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_AttachmentManager policies + +
          +
          + ADMX_AttachmentManager/AM_EstimateFileHandlerRisk +
          +
          + ADMX_AttachmentManager/AM_SetFileRiskLevel +
          +
          + ADMX_AttachmentManager/AM_SetHighRiskInclusion +
          +
          + ADMX_AttachmentManager/AM_SetLowRiskInclusion +
          +
          + ADMX_AttachmentManager/AM_SetModRiskInclusion +
          +
          + + +
          + + +**ADMX_AttachmentManager/AM_EstimateFileHandlerRisk** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments. + +Preferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but don't trust .txt files. + +Preferring the file type instructs Windows to use the file type data over the file handler data. For example, trust .txt files, regardless of the file handler. Using both the file handler and type data is the most restrictive option. Windows chooses the more restrictive recommendation which will cause users to see more trust prompts than choosing the other options. + +If you enable this policy setting, you can choose the order in which Windows processes risk assessment data. + +If you disable this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type. + +If you do not configure this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Trust logic for file attachments* +- GP name: *AM_EstimateFileHandlerRisk* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
          + + +**ADMX_AttachmentManager/AM_SetFileRiskLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments. + +High Risk: If the attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. + +Moderate Risk: If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. + +Low Risk: If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. + +If you enable this policy setting, you can specify the default risk level for file types. + +If you disable this policy setting, Windows sets the default risk level to moderate. + +If you do not configure this policy setting, Windows sets the default risk level to moderate. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default risk level for file attachments* +- GP name: *AM_SetFileRiskLevel* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
          + + +**ADMX_AttachmentManager/AM_SetHighRiskInclusion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of high-risk file types. If the file attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. This inclusion list takes precedence over the medium-risk and low-risk inclusion lists (where an extension is listed in more than one inclusion list). + +If you enable this policy setting, you can create a custom list of high-risk file types. + +If you disable this policy setting, Windows uses its built-in list of file types that pose a high risk. + +If you do not configure this policy setting, Windows uses its built-in list of high-risk file types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Inclusion list for high risk file types* +- GP name: *AM_SetHighRiskInclusion* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
          + + +**ADMX_AttachmentManager/AM_SetLowRiskInclusion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list). + +If you enable this policy setting, you can specify file types that pose a low risk. + +If you disable this policy setting, Windows uses its default trust logic. + +If you do not configure this policy setting, Windows uses its default trust logic. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Inclusion list for low file types* +- GP name: *AM_SetLowRiskInclusion* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
          + + +**ADMX_AttachmentManager/AM_SetModRiskInclusion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list). + +If you enable this policy setting, you can specify file types which pose a moderate risk. + +If you disable this policy setting, Windows uses its default trust logic. + +If you do not configure this policy setting, Windows uses its default trust logic. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Inclusion list for moderate risk file types* +- GP name: *AM_SetModRiskInclusion* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md new file mode 100644 index 0000000000..1aa77b30da --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -0,0 +1,119 @@ +--- +title: Policy CSP - ADMX_AuditSettings +description: Policy CSP - ADMX_AuditSettings +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AuditSettings +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_AuditSettings policies + +
          +
          + ADMX_AuditSettings/IncludeCmdLine +
          +
          + + +
          + + +**ADMX_AuditSettings/IncludeCmdLine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. + +If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. + +If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. + +Default is Not configured. + +> [!NOTE] +> When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information, such as passwords or user data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Include command line in process creation events* +- GP name: *IncludeCmdLine* +- GP path: *System/Audit Process Creation* +- GP ADMX file name: *AuditSettings.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md new file mode 100644 index 0000000000..b5f4b7b748 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -0,0 +1,1101 @@ +--- +title: Policy CSP - ADMX_Bits +description: Policy CSP - ADMX_Bits +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/20/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Bits +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Bits policies + +
          +
          + ADMX_Bits/BITS_DisableBranchCache +
          +
          + ADMX_Bits/BITS_DisablePeercachingClient +
          +
          + ADMX_Bits/BITS_DisablePeercachingServer +
          +
          + ADMX_Bits/BITS_EnablePeercaching +
          +
          + ADMX_Bits/BITS_MaxBandwidthServedForPeers +
          +
          + ADMX_Bits/BITS_MaxBandwidthV2_Maintenance +
          +
          + ADMX_Bits/BITS_MaxBandwidthV2_Work +
          +
          + ADMX_Bits/BITS_MaxCacheSize +
          +
          + ADMX_Bits/BITS_MaxContentAge +
          +
          + ADMX_Bits/BITS_MaxDownloadTime +
          +
          + ADMX_Bits/BITS_MaxFilesPerJob +
          +
          + ADMX_Bits/BITS_MaxJobsPerMachine +
          +
          + ADMX_Bits/BITS_MaxJobsPerUser +
          +
          + ADMX_Bits/BITS_MaxRangesPerFile +
          +
          + + +
          + + +**ADMX_Bits/BITS_DisableBranchCache** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default. + +If you enable this policy setting, the BITS client does not use Windows Branch Cache. + +If you disable or do not configure this policy setting, the BITS client uses Windows Branch Cache. + +> [!NOTE] +> This policy setting does not affect the use of Windows Branch Cache by applications other than BITS. This policy setting does not apply to BITS transfers over SMB. This setting has no effect if the computer's administrative settings for Windows Branch Cache disable its use entirely. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow the BITS client to use Windows Branch Cache* +- GP name: *BITS_DisableBranchCache* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_DisablePeercachingClient** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computer will act as a BITS peer caching client. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). + +If you enable this policy setting, the computer will no longer use the BITS peer caching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers. + +If you disable or do not configure this policy setting, the computer attempts to download peer-enabled BITS jobs from peer computers before reverting to the origin server. + +> [!NOTE] +> This policy setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow the computer to act as a BITS Peercaching client* +- GP name: *BITS_DisablePeercachingClient* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_DisablePeercachingServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computer will act as a BITS peer caching server. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). + +If you enable this policy setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers. + +If you disable or do not configure this policy setting, the computer will offer downloaded and cached files to its peers. + +> [!NOTE] +> This setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow the computer to act as a BITS Peercaching server* +- GP name: *BITS_DisablePeercachingServer* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
          + + +**ADMX_Bits/BITS_EnablePeercaching** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines if the Background Intelligent Transfer Service (BITS) peer caching feature is enabled on a specific computer. By default, the files in a BITS job are downloaded only from the origin server specified by the job's owner. + +If BITS peer caching is enabled, BITS caches downloaded files and makes them available to other BITS peers. When transferring a download job, BITS first requests the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS downloads them from the origin server. + +If you enable this policy setting, BITS downloads files from peers, caches the files, and responds to content requests from peers. Using the "Do not allow the computer to act as a BITS peer caching server" and "Do not allow the computer to act as a BITS peer caching client" policy settings, it is possible to control BITS peer caching functionality at a more detailed level. However, it should be noted that the "Allow BITS peer caching" policy setting must be enabled for the other two policy settings to have any effect. + +If you disable or do not configure this policy setting, the BITS peer caching feature will be disabled, and BITS will download files directly from the origin server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow BITS Peercaching* +- GP name: *BITS_EnablePeercaching* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
          + + +**ADMX_Bits/BITS_MaxBandwidthServedForPeers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting does not affect transfers from the origin server). + +To prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30 percent of the bandwidth of the slowest active network interface. For example, if a computer has both a 100 Mbps network card and a 56 Kbps modem, and both are active, BITS will use a maximum of 30 percent of 56 Kbps. + +You can change the default behavior of BITS, and specify a fixed maximum bandwidth that BITS will use for peer caching. + +If you enable this policy setting, you can enter a value in bits per second (bps) between 1048576 and 4294967200 to use as the maximum network bandwidth used for peer caching. + +If you disable this policy setting or do not configure it, the default value of 30 percent of the slowest active network interface will be used. + +> [!NOTE] +> This setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum network bandwidth used for Peercaching* +- GP name: *BITS_MaxBandwidthServedForPeers* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_MaxBandwidthV2_Maintenance** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the maintenance days and hours. Maintenance schedules further limit the network bandwidth that is used for background transfers. + +If you enable this policy setting, you can define a separate set of network bandwidth limits and set up a schedule for the maintenance period. + +You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule. + +If you disable or do not configure this policy setting, the limits defined for work or non-work schedules will be used. + +> [!NOTE] +> The bandwidth limits that are set for the maintenance period supersede any limits defined for work and other schedules. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers* +- GP name: *BITS_MaxBandwidthV2_Maintenance* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
          + + +**ADMX_Bits/BITS_MaxBandwidthV2_Work** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and non-work days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours. + +If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and non-work hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low. + +You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for non-work hours. + +If you disable or do not configure this policy setting, BITS uses all available unused bandwidth for background job transfers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers* +- GP name: *BITS_MaxBandwidthV2_Work* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
          + + +**ADMX_Bits/BITS_MaxCacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the maximum amount of disk space that can be used for the BITS peer cache, as a percentage of the total system disk size. BITS will add files to the peer cache and make those files available to peers until the cache content reaches the specified cache size. By default, BITS will use 1 percent of the total system disk for the peercache. + +If you enable this policy setting, you can enter the percentage of disk space to be used for the BITS peer cache. You can enter a value between 1 percent and 80 percent. + +If you disable or do not configure this policy setting, the default size of the BITS peer cache is 1 percent of the total system disk size. + +> [!NOTE] +> This policy setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the BITS Peercache size* +- GP name: *BITS_MaxCacheSize* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_MaxContentAge** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the maximum age of files in the Background Intelligent Transfer Service (BITS) peer cache. In order to make the most efficient use of disk space, by default BITS removes any files in the peer cache that have not been accessed in the past 90 days. + +If you enable this policy setting, you can specify in days the maximum age of files in the cache. You can enter a value between 1 and 120 days. + +If you disable or do not configure this policy setting, files that have not been accessed for the past 90 days will be removed from the peer cache. + +> [!NOTE] +> This policy setting has no effect if the "Allow BITS Peercaching" policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the age of files in the BITS Peercache* +- GP name: *BITS_MaxContentAge* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_MaxDownloadTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the amount of time that Background Intelligent Transfer Service (BITS) will take to download the files in a BITS job. + +The time limit applies only to the time that BITS is actively downloading files. When the cumulative download time exceeds this limit, the job is placed in the error state. + +By default BITS uses a maximum download time of 90 days (7,776,000 seconds). + +If you enable this policy setting, you can set the maximum job download time to a specified number of seconds. + +If you disable or do not configure this policy setting, the default value of 90 days (7,776,000 seconds) will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum BITS job download time* +- GP name: *BITS_MaxDownloadTime* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_MaxFilesPerJob** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain. + +If you enable this policy setting, BITS will limit the maximum number of files a job can contain to the specified number. + +If you disable or do not configure this policy setting, BITS will use the default value of 200 for the maximum number of files a job can contain. + +> [!NOTE] +> BITS Jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of files allowed in a BITS job* +- GP name: *BITS_MaxFilesPerJob* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_MaxJobsPerMachine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of BITS jobs that can be created for all users of the computer. By default, BITS limits the total number of jobs that can be created on the computer to 300 jobs. You can use this policy setting to raise or lower the maximum number of user BITS jobs. + +If you enable this policy setting, BITS will limit the maximum number of BITS jobs to the specified number. + +If you disable or do not configure this policy setting, BITS will use the default BITS job limit of 300 jobs. + +> [!NOTE] +> BITS jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of BITS jobs for this computer* +- GP name: *BITS_MaxJobsPerMachine* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_MaxJobsPerUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of BITS jobs that can be created by a user. By default, BITS limits the total number of jobs that can be created by a user to 60 jobs. You can use this setting to raise or lower the maximum number of BITS jobs a user can create. + +If you enable this policy setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number. + +If you disable or do not configure this policy setting, BITS will use the default user BITS job limit of 300 jobs. + +> [!NOTE] +> This limit must be lower than the setting specified in the "Maximum number of BITS jobs for this computer" policy setting, or 300 if the "Maximum number of BITS jobs for this computer" policy setting is not configured. BITS jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of BITS jobs for each user* +- GP name: *BITS_MaxJobsPerUser* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + + +**ADMX_Bits/BITS_MaxRangesPerFile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are limited to 500 ranges per file. You can use this setting to raise or lower the maximum number ranges per file. + +If you enable this policy setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number. + +If you disable or do not configure this policy setting, BITS will limit ranges to 500 ranges per file. + +> [!NOTE] +> BITS Jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of ranges that can be added to the file in a BITS job* +- GP name: *BITS_MaxRangesPerFile* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md new file mode 100644 index 0000000000..649079a937 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -0,0 +1,203 @@ +--- +title: Policy CSP - ADMX_CipherSuiteOrder +description: Policy CSP - ADMX_CipherSuiteOrder +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CipherSuiteOrder + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_CipherSuiteOrder policies + +
          +
          + ADMX_CipherSuiteOrder/SSLCipherSuiteOrder +
          +
          + ADMX_CipherSuiteOrder/SSLCurveOrder +
          +
          + + +
          + + +**ADMX_CipherSuiteOrder/SSLCipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the cipher suites used by the Secure Socket Layer (SSL). + +If you enable this policy setting, SSL cipher suites are prioritized in the order specified. + +If you disable or do not configure this policy setting, default cipher suite order is used. + +For information about supported cipher suites, see [Cipher Suites in TLS/SSL (Schannel SSP)](https://go.microsoft.com/fwlink/?LinkId=517265). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SSL Cipher Suite Order* +- GP name: *SSLCipherSuiteOrder* +- GP path: *Network/SSL Configuration Settings* +- GP ADMX file name: *CipherSuiteOrder.admx* + + + +
          + +
          + + +**ADMX_CipherSuiteOrder/SSLCurveOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the priority order of ECC curves used with ECDHE cipher suites. + +If you enable this policy setting, ECC curves are prioritized in the order specified. Enter one curve name per line. + +If you disable or do not configure this policy setting, the default ECC curve order is used. + +The default curve order is as follows: + +- curve25519 +- NistP256 +- NistP384 + +To see all the curves supported on the system, enter the following command: + +``` cmd +CertUtil.exe -DisplayEccCurve +``` + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *ECC Curve Order* +- GP name: *SSLCurveOrder* +- GP path: *Network/SSL Configuration Settings* +- GP ADMX file name: *CipherSuiteOrder.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md new file mode 100644 index 0000000000..1da39a32a3 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -0,0 +1,197 @@ +--- +title: Policy CSP - ADMX_COM +description: Policy CSP - ADMX_COM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_COM + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_COM policies + +
          +
          + ADMX_COM/AppMgmt_COM_SearchForCLSID_1 +
          +
          + ADMX_COM/AppMgmt_COM_SearchForCLSID_2 +
          +
          + + +
          + + +**ADMX_COM/AppMgmt_COM_SearchForCLSID_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. + +Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. + +If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. + +If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Download missing COM components* +- GP name: *AppMgmt_COM_SearchForCLSID_1* +- GP path: *System* +- GP ADMX file name: *COM.admx* + + + +
          + +
          + + +**ADMX_COM/AppMgmt_COM_SearchForCLSID_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. + +Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. + +If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. + +If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Download missing COM components* +- GP name: *AppMgmt_COM_SearchForCLSID_2* +- GP path: *System* +- GP ADMX file name: *COM.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md new file mode 100644 index 0000000000..8ae99cefe3 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -0,0 +1,362 @@ +--- +title: Policy CSP - ADMX_ControlPanel +description: Policy CSP - ADMX_ControlPanel +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/05/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ControlPanel +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_ControlPanel policies + +
          +
          + ADMX_ControlPanel/DisallowCpls +
          +
          + ADMX_ControlPanel/ForceClassicControlPanel +
          +
          + ADMX_ControlPanel/NoControlPanel +
          +
          + ADMX_ControlPanel/RestrictCpls +
          +
          + + +
          + + +**ADMX_ControlPanel/DisallowCpls** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. + +If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. + +To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization. + +> [!NOTE] +> For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name should be entered, for example timedate.cpl or inetcpl.cpl. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered, for example @systemcpl.dll,-1 for System, or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names can be found in MSDN by searching "Control Panel items". + +If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored. + +> [!NOTE] +> The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. Note: To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide specified Control Panel items* +- GP name: *DisallowCpls* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
          + + +**ADMX_ControlPanel/ForceClassicControlPanel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the default Control Panel view, whether by category or icons. + +If this policy setting is enabled, the Control Panel opens to the icon view. + +If this policy setting is disabled, the Control Panel opens to the category view. + +If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session. + +> [!NOTE] +> Icon size is dependent upon what the user has set it to in the previous session. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always open All Control Panel Items when opening Control Panel* +- GP name: *ForceClassicControlPanel* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
          + + +**ADMX_ControlPanel/NoControlPanel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Disables all Control Panel programs and the PC settings app. + +This setting prevents Control.exe and SystemSettings.exe, the program files for Control Panel and PC settings, from starting. As a result, users cannot start Control Panel or PC settings, or run any of their items. + +This setting removes Control Panel from: + +- The Start screen +- File Explorer + +This setting removes PC settings from: + +- The Start screen +- Settings charm +- Account picture +- Search results + +If users try to select a Control Panel item from the Properties item on a context menu, a message appears explaining that a setting prevents the action. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to Control Panel and PC settings* +- GP name: *NoControlPanel* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
          + + +**ADMX_ControlPanel/RestrictCpls** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls which Control Panel items such as Mouse, System, or Personalization, are displayed on the Control Panel window and the Start screen. The only items displayed in Control Panel are those you specify in this setting. This setting affects the Start screen and Control Panel, as well as other ways to access Control Panel items such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. + +To display a Control Panel item, enable this policy setting and click Show to access the list of allowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization. + +> [!NOTE] +> For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name, for example timedate.cpl or inetcpl.cpl, should be entered. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered. For example, enter @systemcpl.dll,-1 for System or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names of Control Panel items can be found in MSDN by searching "Control Panel items". + +If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored. + +> [!NOTE] +> The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. +> +> To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show only specified Control Panel items* +- GP name: *RestrictCpls* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md new file mode 100644 index 0000000000..48dc02d6db --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -0,0 +1,1825 @@ +--- +title: Policy CSP - ADMX_ControlPanelDisplay +description: Policy CSP - ADMX_ControlPanelDisplay +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/05/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ControlPanelDisplay +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_ControlPanelDisplay policies + +
          +
          + ADMX_ControlPanelDisplay/CPL_Display_Disable +
          +
          + ADMX_ControlPanelDisplay/CPL_Display_HideSettings +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle +
          +
          + ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground +
          +
          + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Display_Disable** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Disables the Display Control Panel. + +If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. + +Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu & Taskbar) settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable the Display Control Panel* +- GP name: *CPL_Display_Disable* +- GP path: *Control Panel\Display* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Display_HideSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Settings tab from Display in Control Panel. + +This setting prevents users from using Control Panel to add, configure, or change the display settings on the computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Settings tab* +- GP name: *CPL_Display_HideSettings* +- GP path: *Control Panel\Display* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting forces the theme color scheme to be the default color scheme. + +If you enable this setting, a user cannot change the color scheme of the current desktop theme. + +If you disable or do not configure this setting, a user may change the color scheme of the current desktop theme. + +For Windows 7 and later, use the "Prevent changing color and appearance" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing color scheme* +- GP name: *CPL_Personalization_DisableColorSchemeChoice* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting disables the theme gallery in the Personalization Control Panel. + +If you enable this setting, users cannot change or save a theme. Elements of a theme such as the desktop background, color, sounds, and screen saver can still be changed (unless policies are set to turn them off). + +If you disable or do not configure this setting, there is no effect. + +> [!NOTE] +> If you enable this setting but do not specify a theme using the "load a specific theme" setting, the theme defaults to whatever the user previously set or the system default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing theme* +- GP name: *CPL_Personalization_DisableThemeChange* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users or applications from changing the visual style of the windows and buttons displayed on their screens. + +When enabled on Windows XP, this setting disables the "Windows and buttons" drop-down list on the Appearance tab in Display Properties. + +When enabled on Windows XP and later systems, this setting prevents users and applications from changing the visual style through the command line. Also, a user may not apply a different visual style when changing themes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing visual style for windows and buttons* +- GP name: *CPL_Personalization_DisableVisualStyle* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Enables desktop screen savers. + +If you disable this setting, screen savers do not run. Also, this setting disables the Screen Saver section of the Screen Saver dialog in the Personalization or Display Control Panel. As a result, users cannot change the screen saver options. + +If you do not configure it, this setting has no effect on the system. + +If you enable it, a screen saver runs, provided the following two conditions hold: First, a valid screen saver on the client is specified through the "Screen Saver executable name" setting or through Control Panel on the client computer. Second, the screen saver timeout is set to a nonzero value through the setting or Control Panel. + +Also, see the "Prevent changing Screen Saver" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable screen saver* +- GP name: *CPL_Personalization_EnableScreenSaver* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows you to force a specific default lock screen and logon image by entering the path (location) of the image file. The same image will be used for both the lock and logon screens. + +This setting lets you specify the default lock screen and logon image shown when no user is signed in, and also sets the specified image as the default for all users (it replaces the inbox default image). + +To use this setting, type the fully qualified path and name of the file that stores the default lock screen and logon image. You can type a local path, such as C:\Windows\Web\Screen\img104.jpg or a UNC path, such as `\\Server\Share\Corp.jpg`. + +This can be used in conjunction with the "Prevent changing lock screen and logon image" setting to always force the specified lock screen and logon image to be shown. + +Note: This setting only applies to Enterprise, Education, and Server SKUs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific default lock screen and logon image* +- GP name: *CPL_Personalization_ForceDefaultLockScreen* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the size of the font in the windows and buttons displayed on their screens. + +If this setting is enabled, the "Font size" drop-down list on the Appearance tab in Display Properties is disabled. + +If you disable or do not configure this setting, a user may change the font size using the "Font size" drop-down list on the Appearance tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit selection of visual style font size* +- GP name: *CPL_Personalization_LockFontSize* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the background image shown when the machine is locked or when on the logon screen. + +By default, users can change the background image shown when the machine is locked or displaying the logon screen. + +If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing lock screen and logon image* +- GP name: *CPL_Personalization_NoChangingLockScreen* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the look of their start menu background, such as its color or accent. + +By default, users can change the look of their start menu background, such as its color or accent. + +If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them. + +If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy. + +If the "Force a specific Start background" policy is also set on a supported version of Windows, then that background takes precedence over this policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing start menu background* +- GP name: *CPL_Personalization_NoChangingStartMenuBackground* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Disables the Color (or Window Color) page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature is not available. + +This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows. + +If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel. + +For systems prior to Windows Vista, this setting hides the Appearance and Themes tabs in the in Display in Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing color and appearance* +- GP name: *CPL_Personalization_NoColorAppearanceUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adding or changing the background design of the desktop. + +By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop. + +If you enable this setting, none of the Desktop Background settings can be changed by the user. + +To specify wallpaper for a group, use the "Desktop Wallpaper" setting. + +Note: You must also enable the "Desktop Wallpaper" setting to prevent users from changing the desktop wallpaper. Refer to KB article: Q327998 for more information. + +Also, see the "Allow only bitmapped wallpaper" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing desktop background* +- GP name: *CPL_Personalization_NoDesktopBackgroundUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the desktop icons. + +By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons. + +If you enable this setting, none of the desktop icons can be changed by the user. + +For systems prior to Windows Vista, this setting also hides the Desktop tab in the Display Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing desktop icons* +- GP name: *CPL_Personalization_NoDesktopIconsUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the lock screen appears for users. + +If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC. + +If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display the lock screen* +- GP name: *CPL_Personalization_NoLockScreen* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the mouse pointers. + +By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers. + +If you enable this setting, none of the mouse pointer scheme settings can be changed by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing mouse pointers* +- GP name: *CPL_Personalization_NoMousePointersUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel. + +This setting prevents users from using Control Panel to add, configure, or change the screen saver on the computer. It does not prevent a screen saver from running. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing screen saver* +- GP name: *CPL_Personalization_NoScreenSaverUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the sound scheme. + +By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme. + +If you enable this setting, none of the Sound Scheme settings can be changed by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing sounds* +- GP name: *CPL_Personalization_NoSoundSchemeUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB. + +By default, users can change the background and accent colors. + +If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific background and accent color* +- GP name: *CPL_Personalization_PersonalColors* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether screen savers used on the computer are password protected. + +If you enable this setting, all screen savers are password protected. If you disable this setting, password protection cannot be set on any screen saver. + +This setting also disables the "Password protected" checkbox on the Screen Saver dialog in the Personalization or Display Control Panel, preventing users from changing the password protection setting. + +If you do not configure this setting, users can choose whether or not to set password protection on each screen saver. + +To ensure that a computer will be password protected, enable the "Enable Screen Saver" setting and specify a timeout via the "Screen Saver timeout" setting. + +> [!NOTE] +> To remove the Screen Saver dialog, use the "Prevent changing Screen Saver" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Password protect the screen saver* +- GP name: *CPL_Personalization_ScreenSaverIsSecure* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Specifies how much user idle time must elapse before the screen saver is launched. + +When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started. + +This setting has no effect under any of the following circumstances: + +- The setting is disabled or not configured. + +- The wait time is set to zero. + +- The "Enable Screen Saver" setting is disabled. + +- Neither the "Screen saver executable name" setting nor the Screen Saver dialog of the client computer's Personalization or Display Control Panel specifies a valid existing screen saver program on the client. + +When not configured, whatever wait time is set on the client through the Screen Saver dialog in the Personalization or Display Control Panel is used. The default is 15 minutes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Screen saver timeout* +- GP name: *CPL_Personalization_ScreenSaverTimeOut* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the screen saver for the user's desktop. + +If you enable this setting, the system displays the specified screen saver on the user's desktop. Also, this setting disables the drop-down list of screen savers in the Screen Saver dialog in the Personalization or Display Control Panel, which prevents users from changing the screen saver. + +If you disable this setting or do not configure it, users can select any screen saver. + +If you enable this setting, type the name of the file that contains the screen saver, including the .scr file name extension. If the screen saver file is not in the %Systemroot%\System32 directory, type the fully qualified path to the file. + +If the specified screen saver is not installed on a computer to which this setting applies, the setting is ignored. + +> [!NOTE] +> This setting can be superseded by the "Enable Screen Saver" setting. If the "Enable Screen Saver" setting is disabled, this setting is ignored, and screen savers do not run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force specific screen saver* +- GP name: *CPL_Personalization_SetScreenSaver* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Specifies which theme file is applied to the computer the first time a user logs on. + +If you enable this setting, the theme that you specify will be applied when a new user logs on for the first time. This policy does not prevent the user from changing the theme or any of the theme elements such as the desktop background, color, sounds, or screen saver after the first logon. + +If you disable or do not configure this setting, the default theme will be applied at the first logon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Load a specific theme* +- GP name: *CPL_Personalization_SetTheme* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows you to force a specific visual style file by entering the path (location) of the visual style file. + +This can be a local computer visual style (aero.msstyles), or a file located on a remote server using a UNC path (\\Server\Share\aero.msstyles). + +If you enable this setting, the visual style file that you specify will be used. Also, a user may not apply a different visual style when changing themes. + +If you disable or do not configure this setting, the users can select the visual style that they want to use by changing themes (if the Personalization Control Panel is available). + +> [!NOTE] +> If this setting is enabled and the file is not available at user logon, the default visual style is loaded. +> +> When running Windows XP, you can select the Luna visual style by typing %windir%\resources\Themes\Luna\Luna.msstyles. +> +> To select the Windows Classic visual style, leave the box blank beside "Path to Visual Style:" and enable this setting. When running Windows 8 or Windows RT, you cannot apply the Windows Classic visual style. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific visual style file or force Windows Classic* +- GP name: *CPL_Personalization_SetVisualStyle* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + + +**ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Forces the Start screen to use one of the available backgrounds, 1 through 20, and prevents the user from changing it. + +If this setting is set to zero or not configured, then Start uses the default background, and users can change it. + +If this setting is set to a nonzero value, then Start uses the specified background, and users cannot change it. If the specified background is not supported, the default background is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific Start background* +- GP name: *CPL_Personalization_StartBackground* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md new file mode 100644 index 0000000000..21bf8792f1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -0,0 +1,117 @@ +--- +title: Policy CSP - ADMX_Cpls +description: Policy CSP - ADMX_Cpls +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Cpls +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Cpls policies + +
          +
          + ADMX_Cpls/UseDefaultTile +
          +
          + + +
          + + +**ADMX_Cpls/UseDefaultTile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo. + +> [!NOTE] +> The default account picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\user.jpg. The default guest picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\guest.jpg. If the default pictures do not exist, an empty frame is displayed. + +If you enable this policy setting, the default user account picture will display for all users on the system with no customization allowed. + +If you disable or do not configure this policy setting, users will be able to customize their account pictures. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Apply the default account picture to all users* +- GP name: *UseDefaultTile* +- GP path: *Control Panel/User Accounts* +- GP ADMX file name: *Cpls.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md new file mode 100644 index 0000000000..1dcc21ec35 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -0,0 +1,269 @@ +--- +title: Policy CSP - ADMX_CredentialProviders +description: Policy CSP - ADMX_CredentialProviders +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/11/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CredentialProviders +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_CredentialProviders policies + +
          +
          + ADMX_CredentialProviders/AllowDomainDelayLock +
          +
          + ADMX_CredentialProviders/DefaultCredentialProvider +
          +
          + ADMX_CredentialProviders/ExcludedCredentialProviders +
          +
          + + +
          + + +**ADMX_CredentialProviders/AllowDomainDelayLock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether a user can change the time before a password is required when a Connected Standby device screen turns off. + +If you enable this policy setting, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose. + +If you disable this policy setting, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off. + +If you don't configure this policy setting on a domain-joined device, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off. + +If you don't configure this policy setting on a workgroup device, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to select when a password is required when resuming from connected standby* +- GP name: *AllowDomainDelayLock* +- GP path: *System\Logon* +- GP ADMX file name: *CredentialProviders.admx* + + + +
          + + +**ADMX_CredentialProviders/DefaultCredentialProvider** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to assign a specified credential provider as the default credential provider. + +If you enable this policy setting, the specified credential provider is selected on other user tile. + +If you disable or do not configure this policy setting, the system picks the default credential provider on other user tile. + +> [!NOTE] +> A list of registered credential providers and their GUIDs can be found in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Assign a default credential provider* +- GP name: *DefaultCredentialProvider* +- GP path: *System\Logon* +- GP ADMX file name: *CredentialProviders.admx* + + + +
          + + + +**ADMX_CredentialProviders/ExcludedCredentialProviders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to exclude the specified credential providers from use during authentication. + +> [!NOTE] +> Credential providers are used to process and validate user credentials during logon or when authentication is required. Windows Vista provides two default credential providers: Password and Smart Card. An administrator can install additional credential providers for different sets of credentials (for example, to support biometric authentication). + +If you enable this policy, an administrator can specify the CLSIDs of the credential providers to exclude from the set of installed credential providers available for authentication purposes. + +If you disable or do not configure this policy, all installed and otherwise enabled credential providers are available for authentication purposes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Exclude credential providers* +- GP name: *ExcludedCredentialProviders* +- GP path: *System\Logon* +- GP ADMX file name: *CredentialProviders.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md new file mode 100644 index 0000000000..4b830deeb7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -0,0 +1,969 @@ +--- +title: Policy CSP - ADMX_CredSsp +description: Policy CSP - ADMX_CredSsp +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CredSsp +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_CredSsp policies + +
          +
          + ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly +
          +
          + ADMX_CredSsp/AllowDefaultCredentials +
          +
          + ADMX_CredSsp/AllowEncryptionOracle +
          +
          + ADMX_CredSsp/AllowFreshCredentials +
          +
          + ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly +
          +
          + ADMX_CredSsp/AllowSavedCredentials +
          +
          + ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly +
          +
          + ADMX_CredSsp/DenyDefaultCredentials +
          +
          + ADMX_CredSsp/DenyFreshCredentials +
          +
          + ADMX_CredSsp/DenySavedCredentials +
          +
          + ADMX_CredSsp/RestrictedRemoteAdministration +
          +
          + + +
          + + +**ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). + +If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating default credentials with NTLM-only server authentication* +- GP name: *AllowDefCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/AllowDefaultCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). + +The policy becomes effective the next time the user signs on to a computer running Windows. + +If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. + +FWlink for KB: +https://go.microsoft.com/fwlink/?LinkId=301508 + +> [!NOTE] +> The "Allow delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating default credentials* +- GP name: *AllowDefaultCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/AllowEncryptionOracle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection). + +Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability. + +If you enable this policy setting, CredSSP version support will be selected based on the following options: + +- Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. + + > [!NOTE] + > This setting should not be deployed until all remote hosts support the newest version. + +- Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. + +- Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. + +For more information about the vulnerability and servicing requirements for protection, see https://go.microsoft.com/fwlink/?linkid=866660 + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Encryption Oracle Remediation* +- GP name: *AllowEncryptionOracle* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/AllowFreshCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating fresh credentials* +- GP name: *AllowFreshCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating fresh credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating fresh credentials with NTLM-only server authentication* +- GP name: *AllowFreshCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/AllowSavedCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of saved credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating saved credentials* +- GP name: *AllowSavedCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine. + +If you disable this policy setting, delegation of saved credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating saved credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating saved credentials with NTLM-only server authentication* +- GP name: *AllowSavedCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/DenyDefaultCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating default credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating default credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating default credentials* +- GP name: *DenyDefaultCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/DenyFreshCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating fresh credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating fresh credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating fresh credentials* +- GP name: *DenyFreshCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/DenySavedCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating saved credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating saved credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating saved credentials* +- GP name: *DenySavedCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + + +**ADMX_CredSsp/RestrictedRemoteAdministration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. When running in Restricted Admin or Remote Credential Guard mode, participating apps do not expose signed in or supplied credentials to a remote host. Restricted Admin limits access to resources located on other servers or networks from the remote host because credentials are not delegated. Remote Credential Guard does not limit access to resources because it redirects all requests back to the client device. + +Participating apps: +Remote Desktop Client + +If you enable this policy setting, the following options are supported: + +- Restrict credential delegation: Participating applications must use Restricted Admin or Remote Credential Guard to connect to remote hosts. +- Require Remote Credential Guard: Participating applications must use Remote Credential Guard to connect to remote hosts. +- Require Restricted Admin: Participating applications must use Restricted Admin to connect to remote hosts. + +If you disable or do not configure this policy setting, Restricted Admin and Remote Credential Guard mode are not enforced and participating apps can delegate credentials to remote devices. + +> [!NOTE] +> To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\Administrative Templates\System\Credentials Delegation). +> +> On Windows 8.1 and Windows Server 2012 R2, enabling this policy will enforce Restricted Administration mode, regardless of the mode chosen. These versions do not support Remote Credential Guard. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict delegation of credentials to remote servers* +- GP name: *RestrictedRemoteAdministration* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md new file mode 100644 index 0000000000..9247d038a8 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -0,0 +1,185 @@ +--- +title: Policy CSP - ADMX_CredUI +description: Policy CSP - ADMX_CredUI +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CredUI +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_CredUI policies + +
          +
          + ADMX_CredUI/EnableSecureCredentialPrompting +
          +
          + ADMX_CredUI/NoLocalPasswordResetQuestions +
          +
          + + +
          + + +**ADMX_CredUI/EnableSecureCredentialPrompting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials. + +> [!NOTE] +> This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled. + +If you enable this policy setting, users will be required to enter Windows credentials on the Secure Desktop by means of the trusted path mechanism. + +If you disable or do not configure this policy setting, users will enter Windows credentials within the user’s desktop session, potentially allowing malicious code access to the user’s Windows credentials. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require trusted path for credential entry* +- GP name: *EnableSecureCredentialPrompting* +- GP path: *Windows Components\Credential User Interface* +- GP ADMX file name: *CredUI.admx* + + + +
          + + +**ADMX_CredUI/NoLocalPasswordResetQuestions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you turn this policy setting on, local users won’t be able to set up and use security questions to reset their passwords. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent the use of security questions for local accounts* +- GP name: *NoLocalPasswordResetQuestions* +- GP path: *Windows Components\Credential User Interface* +- GP ADMX file name: *CredUI.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md new file mode 100644 index 0000000000..9ecc74d2e9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -0,0 +1,339 @@ +--- +title: Policy CSP - ADMX_CtrlAltDel +description: Policy CSP - ADMX_CtrlAltDel +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CtrlAltDel +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_CtrlAltDel policies + +
          +
          + ADMX_CtrlAltDel/DisableChangePassword +
          +
          + ADMX_CtrlAltDel/DisableLockComputer +
          +
          + ADMX_CtrlAltDel/DisableTaskMgr +
          +
          + ADMX_CtrlAltDel/NoLogoff +
          +
          + + +
          + + +**ADMX_CtrlAltDel/DisableChangePassword** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from changing their Windows password on demand. + +If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del. + +However, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Change Password* +- GP name: *DisableChangePassword* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + + +
          + + +**ADMX_CtrlAltDel/DisableLockComputer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from locking the system. + +While locked, the desktop is hidden and the system cannot be used. Only the user who locked the system or the system administrator can unlock it. + +If you enable this policy setting, users cannot lock the computer from the keyboard using Ctrl+Alt+Del. + +If you disable or do not configure this policy setting, users will be able to lock the computer from the keyboard using Ctrl+Alt+Del. + +> [!TIP] +> To lock a computer without configuring a setting, press Ctrl+Alt+Delete, and then click Lock this computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Lock Computer* +- GP name: *DisableLockWorkstation* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + +
          + + +**ADMX_CtrlAltDel/DisableTaskMgr** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from starting Task Manager. + +Task Manager (**taskmgr.exe**) lets users start and stop programs, monitor the performance of their computers, view and monitor all programs running on their computers, including system services, find the executable names of programs, and change the priority of the process in which programs run. + +If you enable this policy setting, users will not be able to access Task Manager. If users try to start Task Manager, a message appears explaining that a policy prevents the action. + +If you disable or do not configure this policy setting, users can access Task Manager to start and stop programs, monitor the performance of their computers, view and monitor all programs running on their computers, including system services, find the executable names of programs, and change the priority of the process in which programs run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Task Manager* +- GP name: *DisableTaskMgr* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + +
          + + +**ADMX_CtrlAltDel/NoLogoff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables or removes all menu items and buttons that log the user off the system. + +If you enable this policy setting, users will not see the Log off menu item when they press Ctrl+Alt+Del. This will prevent them from logging off unless they restart or shutdown the computer, or clicking Log off from the Start menu. + +Also, see the 'Remove Logoff on the Start Menu' policy setting. + +If you disable or do not configure this policy setting, users can see and select the Log off menu item when they press Ctrl+Alt+Del. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Logoff* +- GP name: *NoLogoff* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md new file mode 100644 index 0000000000..06baf9787a --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -0,0 +1,114 @@ +--- +title: Policy CSP - ADMX_DataCollection +description: Policy CSP - ADMX_DataCollection +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DataCollection +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_DataCollection policies + +
          +
          + ADMX_DataCollection/CommercialIdPolicy +
          +
          + + +
          + + +**ADMX_DataCollection/CommercialIdPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. + +If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. + +If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its telemetry data with your organization. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the Commercial ID* +- GP name: *CommercialIdPolicy* +- GP path: *Windows Components\Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md new file mode 100644 index 0000000000..3cabf5f777 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -0,0 +1,2183 @@ +--- +title: Policy CSP - ADMX_Desktop +description: Policy CSP - ADMX_Desktop +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Desktop +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Desktop policies + +
          +
          + ADMX_Desktop/AD_EnableFilter +
          +
          + ADMX_Desktop/AD_HideDirectoryFolder +
          +
          + ADMX_Desktop/AD_QueryLimit +
          +
          + ADMX_Desktop/ForceActiveDesktopOn +
          +
          + ADMX_Desktop/NoActiveDesktop +
          +
          + ADMX_Desktop/NoActiveDesktopChanges +
          +
          + ADMX_Desktop/NoDesktop +
          +
          + ADMX_Desktop/NoDesktopCleanupWizard +
          +
          + ADMX_Desktop/NoInternetIcon +
          +
          + ADMX_Desktop/NoMyComputerIcon +
          +
          + ADMX_Desktop/NoMyDocumentsIcon +
          +
          + ADMX_Desktop/NoNetHood +
          +
          + ADMX_Desktop/NoPropertiesMyComputer +
          +
          + ADMX_Desktop/NoPropertiesMyDocuments +
          +
          + ADMX_Desktop/NoRecentDocsNetHood +
          +
          + ADMX_Desktop/NoRecycleBinIcon +
          +
          + ADMX_Desktop/NoRecycleBinProperties +
          +
          + ADMX_Desktop/NoSaveSettings +
          +
          + ADMX_Desktop/NoWindowMinimizingShortcuts +
          +
          + ADMX_Desktop/Wallpaper +
          +
          + ADMX_Desktop/sz_ATC_DisableAdd +
          +
          + ADMX_Desktop/sz_ATC_DisableClose +
          +
          + ADMX_Desktop/sz_ATC_DisableDel +
          +
          + ADMX_Desktop/sz_ATC_DisableEdit +
          +
          + ADMX_Desktop/sz_ATC_NoComponents +
          +
          + ADMX_Desktop/sz_AdminComponents_Title +
          +
          + ADMX_Desktop/sz_DB_DragDropClose +
          +
          + ADMX_Desktop/sz_DB_Moving +
          +
          + ADMX_Desktop/sz_DWP_NoHTMLPaper +
          +
          + + +
          + + +**ADMX_Desktop/AD_EnableFilter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results. + +If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it. + +If you disable this setting or do not configure it, the filter bar does not appear, but users can display it by selecting "Filter" on the "View" menu. + +To see the filter bar, open Network Locations, click Entire Network, and then click Directory. Right-click the name of a Windows domain, and click Find. Type the name of an object in the directory, such as "Administrator." If the filter bar does not appear above the resulting display, on the View menu, click Filter. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable filter in Find dialog box* +- GP name: *AD_EnableFilter* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/AD_HideDirectoryFolder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Hides the Active Directory folder in Network Locations. + +The Active Directory folder displays Active Directory objects in a browse window. + +If you enable this setting, the Active Directory folder does not appear in the Network Locations folder. + +If you disable this setting or do not configure it, the Active Directory folder appears in the Network Locations folder. + +This setting is designed to let users search Active Directory but not tempt them to casually browse Active Directory. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Active Directory folder* +- GP name: *AD_HideDirectoryFolder* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/AD_QueryLimit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory. This setting affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users and Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. + +If you enable this setting, you can use the "Number of objects returned" box to limit returns from an Active Directory search. + +If you disable this setting or do not configure it, the system displays up to 10,000 objects. This consumes approximately 2 MB of memory or disk space. + +This setting is designed to protect the network and the domain controller from the effect of expansive searches. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maximum size of Active Directory searches* +- GP name: *AD_QueryLimit* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/ForceActiveDesktopOn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Enables Active Desktop and prevents users from disabling it. + +This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. + +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. + +> [!NOTE] +> If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Active Desktop* +- GP name: *ForceActiveDesktopOn* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoActiveDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Disables Active Desktop and prevents users from enabling it. + +This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. + +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. + +> [!NOTE] +> If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Active Desktop* +- GP name: *NoActiveDesktop* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoActiveDesktopChanges** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration. + +This is a comprehensive setting that locks down the configuration you establish by using other policies in this folder. This setting removes the Web tab from Display in Control Panel. As a result, users cannot enable or disable Active Desktop. If Active Desktop is already enabled, users cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit changes* +- GP name: *NoActiveDesktopChanges* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Computer, and Network Locations. + +Removing icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent. + +Also, see "Items displayed in Places Bar" in User Configuration\Administrative Templates\Windows Components\Common Open File Dialog to remove the Desktop icon from the Places Bar. This will help prevent users from saving data to the Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide and disable all items on the desktop* +- GP name: *NoDesktop* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoDesktopCleanupWizard** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from using the Desktop Cleanup Wizard. + +If you enable this setting, the Desktop Cleanup wizard does not automatically run on a users workstation every 60 days. The user will also not be able to access the Desktop Cleanup Wizard. + +If you disable this setting or do not configure it, the default behavior of the Desktop Clean Wizard running every 60 days occurs. + +> [!NOTE] +> When this setting is not enabled, users can run the Desktop Cleanup Wizard, or have it run automatically every 60 days from Display, by clicking the Desktop tab and then clicking the Customize Desktop button. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the Desktop Cleanup Wizard* +- GP name: *NoDesktopCleanupWizard* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoInternetIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar. + +This setting does not prevent the user from starting Internet Explorer by using other methods. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Internet Explorer icon on desktop* +- GP name: *NoInternetIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoMyComputerIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all Explorer windows, and it hides Computer in the Explorer folder tree pane. If the user navigates into Computer via the "Up" button while this setting is enabled, they view an empty Computer folder. This setting allows administrators to restrict their users from seeing Computer in the shell namespace, allowing them to present their users with a simpler desktop environment. + +If you enable this setting, Computer is hidden on the desktop, the new Start menu, the Explorer folder tree pane, and the Explorer Web views. If the user manages to navigate to Computer, the folder will be empty. + +If you disable this setting, Computer is displayed as usual, appearing as normal on the desktop, Start menu, folder tree pane, and Web views, unless restricted by another setting. + +If you do not configure this setting, the default is to display Computer as usual. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Computer icon. Hiding Computer and its contents does not hide the contents of the child folders of Computer. For example, if the users navigate into one of their hard drives, they see all of their folders and files there, even if this setting is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Computer icon on the desktop* +- GP name: *NoMyComputerIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoMyDocumentsIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the My Documents icon. + +This setting removes the My Documents icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. + +This setting does not prevent the user from using other methods to gain access to the contents of the My Documents folder. + +This setting does not remove the My Documents icon from the Start menu. To do so, use the "Remove My Documents icon from Start Menu" setting. + +> [!NOTE] +> To make changes to this setting effective, you must log off from and log back on to Windows 2000 Professional. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove My Documents icon on the desktop* +- GP name: *NoMyDocumentsIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoNetHood** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Network Locations icon from the desktop. + +This setting only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Network Places icon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Network Locations icon on desktop* +- GP name: *NoNetHood* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoPropertiesMyComputer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting hides Properties on the context menu for Computer. + +If you enable this setting, the Properties option will not be present when the user right-clicks My Computer or clicks Computer and then goes to the File menu. Likewise, Alt-Enter does nothing when Computer is selected. + +If you disable or do not configure this setting, the Properties option is displayed as usual. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Computer icon context menu* +- GP name: *NoPropertiesMyComputer* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoPropertiesMyDocuments** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting hides the Properties menu command on the shortcut menu for the My Documents icon. + +If you enable this policy setting, the Properties menu command will not be displayed when the user does any of the following: + +- Right-clicks the My Documents icon. +- Clicks the My Documents icon, and then opens the File menu. +- Clicks the My Documents icon, and then presses ALT+ENTER. + +If you disable or do not configure this policy setting, the Properties menu command is displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Documents icon context menu* +- GP name: *NoPropertiesMyDocuments* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoRecentDocsNetHood** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Remote shared folders are not added to Network Locations whenever you open a document in the shared folder. + +If you disable this setting or do not configure it, when you open a document in a remote shared folder, the system adds a connection to the shared folder to Network Locations. + +If you enable this setting, shared folders are not added to Network Locations automatically when you open a document in the shared folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not add shares of recently opened documents to Network Locations* +- GP name: *NoRecentDocsNetHood* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoRecycleBinIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the Recycle Bin icon. + +This setting removes the Recycle Bin icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. + +This setting does not prevent the user from using other methods to gain access to the contents of the Recycle Bin folder. + +> [!NOTE] +> To make changes to this setting effective, you must log off and then log back on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Recycle Bin icon from desktop* +- GP name: *NoRecycleBinIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoRecycleBinProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Properties option from the Recycle Bin context menu. + +If you enable this setting, the Properties option will not be present when the user right-clicks on Recycle Bin or opens Recycle Bin and then clicks File. Likewise, Alt-Enter does nothing when Recycle Bin is selected. + +If you disable or do not configure this setting, the Properties option is displayed as usual. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Recycle Bin context menu* +- GP name: *NoRecycleBinProperties* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoSaveSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from saving certain changes to the desktop. + +If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Don't save settings at exit* +- GP name: *NoSaveSettings* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/NoWindowMinimizingShortcuts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents windows from being minimized or restored when the active window is shaken back and forth with the mouse. + +If you enable this policy, application windows will not be minimized or restored when the active window is shaken back and forth with the mouse. + +If you disable or do not configure this policy, this window minimizing and restoring gesture will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Aero Shake window minimizing mouse gesture* +- GP name: *NoWindowMinimizingShortcuts* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/Wallpaper** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the desktop background ("wallpaper") displayed on all users' desktops. + +This setting lets you specify the wallpaper on users' desktops and prevents users from changing the image or its presentation. The wallpaper you specify can be stored in a bitmap (*.bmp) or JPEG (*.jpg) file. + +To use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification. + +If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice. + +Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel. + +> [!NOTE] +> This setting does not apply to remote desktop server sessions. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Desktop Wallpaper* +- GP name: *Wallpaper* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_ATC_DisableAdd** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adding Web content to their Active Desktop. + +This setting removes the "New" button from Web tab in Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. This setting does not remove existing Web content from their Active Desktop, or prevent users from removing existing Web content. + +Also, see the "Disable all items" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adding items* +- GP name: *sz_ATC_DisableAdd* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_ATC_DisableClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from removing Web content from their Active Desktop. + +In Active Desktop, you can add items to the desktop but close them so they are not displayed. + +If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel. + +> [!NOTE] +> This setting does not prevent users from deleting items from their Active Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit closing items* +- GP name: *sz_ATC_DisableClose* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_ATC_DisableDel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from deleting Web content from their Active Desktop. + +This setting removes the Delete button from the Web tab in Display in Control Panel. As a result, users can temporarily remove, but not delete, Web content from their Active Desktop. + +This setting does not prevent users from adding Web content to their Active Desktop. + +Also, see the "Prohibit closing items" and "Disable all items" settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit deleting items* +- GP name: *sz_ATC_DisableDel* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_ATC_DisableEdit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the properties of Web content items on their Active Desktop. + +This setting disables the Properties button on the Web tab in Display in Control Panel. Also, it removes the Properties item from the menu for each item on the Active Desktop. As a result, users cannot change the properties of an item, such as its synchronization schedule, password, or display characteristics. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit editing items* +- GP name: *sz_ATC_DisableEdit* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_ATC_NoComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes Active Desktop content and prevents users from adding Active Desktop content. + +This setting removes all Active Desktop items from the desktop. It also removes the Web tab from Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. + +> [!NOTE] +> This setting does not disable Active Desktop. Users can still use image formats, such as JPEG and GIF, for their desktop wallpaper. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable all items* +- GP name: *sz_ATC_NoComponents* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_AdminComponents_Title** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Adds and deletes specified Web content items. + +You can use the "Add" box in this setting to add particular Web-based items or shortcuts to users' desktops. Users can close or delete the items (if settings allow), but the items are added again each time the setting is refreshed. + +You can also use this setting to delete particular Web-based items from users' desktops. Users can add the item again (if settings allow), but the item is deleted each time the setting is refreshed. + +> [!NOTE] +> Removing an item from the "Add" list for this setting is not the same as deleting it. Items that are removed from the "Add" list are not removed from the desktop. They are simply not added again. + +> [!NOTE] +> For this setting to take affect, you must log off and log on to the system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add/Delete items* +- GP name: *sz_AdminComponents_Title* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_DB_DragDropClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from manipulating desktop toolbars. + +If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. + +> [!NOTE] +> If users have added or removed toolbars, this setting prevents them from restoring the default configuration. + +> [!TIP] +> To view the toolbars that can be added to the desktop, right-click a docked toolbar (such as the taskbar beside the Start button), and point to "Toolbars." + +Also, see the "Prohibit adjusting desktop toolbars" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent adding, dragging, dropping and closing the Taskbar's toolbars* +- GP name: *sz_DB_DragDropClose* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_DB_Moving** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars. + +This setting does not prevent users from adding or removing toolbars on the desktop. + +> [!NOTE] +> If users have adjusted their toolbars, this setting prevents them from restoring the default configuration. + +Also, see the "Prevent adding, dragging, dropping and closing the Taskbar's toolbars" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adjusting desktop toolbars* +- GP name: *sz_DB_Moving* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + + +**ADMX_Desktop/sz_DWP_NoHTMLPaper** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, through the Browse button on the Desktop tab, the wallpaper does not load. Files that are autoconverted to a .bmp format, such as JPEG, GIF, and PNG, can be set as Wallpaper by right-clicking the image and selecting "Set as Wallpaper". + +Also, see the "Desktop Wallpaper" and the "Prevent changing wallpaper" (in User Configuration\Administrative Templates\Control Panel\Display) settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only bitmapped wallpaper* +- GP name: *sz_DWP_NoHTMLPaper* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md new file mode 100644 index 0000000000..5f9d502f36 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -0,0 +1,619 @@ +--- +title: Policy CSP - ADMX_DeviceInstallation +description: Policy CSP - ADMX_DeviceInstallation +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DeviceInstallation +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_DeviceInstallation policies + +
          +
          + ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall +
          +
          + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText +
          +
          + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText +
          +
          + ADMX_DeviceInstallation/DeviceInstall_InstallTimeout +
          +
          + ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime +
          +
          + ADMX_DeviceInstallation/DeviceInstall_Removable_Deny +
          +
          + ADMX_DeviceInstallation/DeviceInstall_SystemRestore +
          +
          + ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser +
          +
          + + +
          + + +**ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings. + +If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow administrators to override Device Installation Restriction policies* +- GP name: *DeviceInstall_AllowAdminInstall* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + + +**ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation. + +If you enable this policy setting, Windows displays the text you type in the Detail Text box when a policy setting prevents device installation. + +If you disable or do not configure this policy setting, Windows displays a default message when a policy setting prevents device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display a custom message when installation is prevented by a policy setting* +- GP name: *DeviceInstall_DeniedPolicy_DetailText* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + + +**ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation. + +If you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of a notification when a policy setting prevents device installation. + +If you disable or do not configure this policy setting, Windows displays a default title in a notification when a policy setting prevents device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display a custom message title when device installation is prevented by a policy setting* +- GP name: *DeviceInstall_DeniedPolicy_SimpleText* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + + +**ADMX_DeviceInstallation/DeviceInstall_InstallTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. + +If you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation. + +If you disable or do not configure this policy setting, Windows waits 240 seconds for a device installation task to complete before terminating the installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure device installation time-out* +- GP name: *DeviceInstall_InstallTimeout* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + + +**ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies. + +If you enable this policy setting, set the amount of seconds you want the system to wait until a reboot. + +If you disable or do not configure this policy setting, the system does not force a reboot. + +Note: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Time (in seconds) to force reboot when required for policy changes to take effect* +- GP name: *DeviceInstall_Policy_RebootTime* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + + +**ADMX_DeviceInstallation/DeviceInstall_Removable_Deny** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device. + +If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, Windows can install and update device drivers for removable devices as allowed or prevented by other policy settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent installation of removable devices* +- GP name: *DeviceInstall_Removable_Deny* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + + +**ADMX_DeviceInstallation/DeviceInstall_SystemRestore** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity. + +If you enable this policy setting, Windows does not create a system restore point when one would normally be created. + +If you disable or do not configure this policy setting, Windows creates a system restore point as it normally would. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point* +- GP name: *DeviceInstall_SystemRestore* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + + +**ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users group may install on the system. + +If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store. + +If you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new device drivers on the system. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow non-administrators to install drivers for these device setup classes* +- GP name: *DriverInstall_Classes_AllowUser* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md new file mode 100644 index 0000000000..77264647f1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -0,0 +1,188 @@ +--- +title: Policy CSP - ADMX_DeviceSetup +description: Policy CSP - ADMX_DeviceSetup +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DeviceSetup +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_DeviceSetup policies + +
          +
          + ADMX_DeviceSetup/DeviceInstall_BalloonTips +
          +
          + ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration +
          +
          + + +
          + + +**ADMX_DeviceSetup/DeviceInstall_BalloonTips** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off "Found New Hardware" balloons during device installation. + +If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed. + +If you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver for the device suppresses the balloons. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off "Found New Hardware" balloons during device installation* +- GP name: *DeviceInstall_BalloonTips* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
          + + +**ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the order in which Windows searches source locations for device drivers. + +If you enable this policy setting, you can select whether Windows searches for drivers on Windows Update unconditionally, only if necessary, or not at all. + +Note that searching always implies that Windows will attempt to search Windows Update exactly one time. With this setting, Windows will not continually search for updates. This setting is used to ensure that the best software will be found for the device, even if the network is temporarily available. If the setting for searching only if needed is specified, then Windows will search for a driver only if a driver is not locally available on the system. + +If you disable or do not configure this policy setting, members of the Administrators group can determine the priority order in which Windows searches source locations for device drivers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify search order for device driver source locations* +- GP name: *DriverSearchPlaces_SearchOrderConfiguration* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md new file mode 100644 index 0000000000..43d6152747 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -0,0 +1,190 @@ +--- +title: Policy CSP - ADMX_DigitalLocker +description: Policy CSP - ADMX_DigitalLocker +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/31/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DigitalLocker +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_DigitalLocker policies + +
          +
          + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1 +
          +
          + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2 +
          +
          + + +
          + + +**ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether Digital Locker can run. + +Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker. + +If you enable this setting, Digital Locker will not run. + +If you disable or do not configure this setting, Digital Locker can be run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow Digital Locker to run* +- GP name: *Digitalx_DiableApplication_TitleText_1* +- GP path: *Windows Components/Digital Locker* +- GP ADMX file name: *DigitalLocker.admx* + + + +
          + + +**ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether Digital Locker can run. + +Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker. + +If you enable this setting, Digital Locker will not run. + +If you disable or do not configure this setting, Digital Locker can be run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow Digital Locker to run* +- GP name: *Digitalx_DiableApplication_TitleText_2* +- GP path: *Windows Components/Digital Locker* +- GP ADMX file name: *DigitalLocker.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md new file mode 100644 index 0000000000..79b48babf1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -0,0 +1,1725 @@ +--- +title: Policy CSP - ADMX_DnsClient +description: Policy CSP - ADMX_DnsClient +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DnsClient + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_DnsClient policies + +
          +
          + ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries +
          +
          + ADMX_DnsClient/DNS_AppendToMultiLabelName +
          +
          + ADMX_DnsClient/DNS_Domain +
          +
          + ADMX_DnsClient/DNS_DomainNameDevolutionLevel +
          +
          + ADMX_DnsClient/DNS_IdnEncoding +
          +
          + ADMX_DnsClient/DNS_IdnMapping +
          +
          + ADMX_DnsClient/DNS_NameServer +
          +
          + ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns +
          +
          + ADMX_DnsClient/DNS_PrimaryDnsSuffix +
          +
          + ADMX_DnsClient/DNS_RegisterAdapterName +
          +
          + ADMX_DnsClient/DNS_RegisterReverseLookup +
          +
          + ADMX_DnsClient/DNS_RegistrationEnabled +
          +
          + ADMX_DnsClient/DNS_RegistrationOverwritesInConflict +
          +
          + ADMX_DnsClient/DNS_RegistrationRefreshInterval +
          +
          + ADMX_DnsClient/DNS_RegistrationTtl +
          +
          + ADMX_DnsClient/DNS_SearchList +
          +
          + ADMX_DnsClient/DNS_SmartMultiHomedNameResolution +
          +
          + ADMX_DnsClient/DNS_SmartProtocolReorder +
          +
          + ADMX_DnsClient/DNS_UpdateSecurityLevel +
          +
          + ADMX_DnsClient/DNS_UpdateTopLevelDomainZones +
          +
          + ADMX_DnsClient/DNS_UseDomainNameDevolution +
          +
          + ADMX_DnsClient/Turn_Off_Multicast +
          +
          + + +
          + + +**ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualified domain names. + +If you enable this policy setting, NetBT queries will be issued for multi-label and fully qualified domain names, such as "www.example.com" in addition to single-label names. + +If you disable this policy setting, or if you do not configure this policy setting, NetBT queries will only be issued for single-label names, such as "example" and not for multi-label and fully qualified domain names. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow NetBT queries for fully qualified domain names* +- GP name: *DNS_AllowFQDNNetBiosQueries* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + +
          + + +**ADMX_DnsClient/DNS_AppendToMultiLabelName** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. + +A name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp" is an unqualified multi-label name. The name "server.corp.contoso.com." is an example of a fully qualified name because it contains a terminating dot. + +For example, if attaching suffixes is allowed, an unqualified multi-label name query for "server.corp" will be queried by the DNS client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS suffixes. These suffixes can be derived from a combination of the local DNS client's primary domain suffix, a connection-specific domain suffix, and a DNS suffix search list. + +If attaching suffixes is allowed, and a DNS client with a primary domain suffix of "contoso.com" performs a query for "server.corp" the DNS client will send a query for "server.corp" first, and then a query for "server.corp.contoso.com." second if the first query fails. + +If you enable this policy setting, suffixes are allowed to be appended to an unqualified multi-label name if the original name query fails. + +If you disable this policy setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails. + +If you do not configure this policy setting, computers will use their local DNS client settings to determine the query behavior for unqualified multi-label names. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow DNS suffix appending to unqualified multi-label name queries* +- GP name: *DNS_AppendToMultiLabelName* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_Domain** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP. To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix. + +If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied connection specific DNS suffix, if configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Connection-specific DNS suffix* +- GP name: *DNS_Domain* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_DomainNameDevolutionLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process. + +With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. + +The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box. + +Devolution is not enabled if a global suffix search list is configured using Group Policy. + +If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries: + +- The primary DNS suffix, as specified on the Computer Name tab of the System control panel. +- Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection. + +For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. + +If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. + +For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using this policy setting. The default devolution level is two. + +If you enable this policy setting and DNS devolution is also enabled, DNS clients use the DNS devolution level that you specify. + +If you disable this policy setting or do not configure it, DNS clients use the default devolution level of two provided that DNS devolution is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix devolution level* +- GP name: *DNS_DomainNameDevolutionLevel* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_IdnEncoding** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured. + +If this policy setting is enabled, IDNs are not converted to Punycode. + +If this policy setting is disabled, or if this policy setting is not configured, IDNs are converted to Punycode when the computer is on non-domain networks with no WINS servers configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off IDN encoding* +- GP name: *DNS_IdnEncoding* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_IdnMapping** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to the Nameprep form, a canonical Unicode representation of the string. + +If this policy setting is enabled, IDNs are converted to the Nameprep form. + +If this policy setting is disabled, or if this policy setting is not configured, IDNs are not converted to the Nameprep form. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IDN mapping* +- GP name: *DNS_IdnMapping* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_NameServer** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. + +To use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address. + +If you enable this policy setting, the list of DNS servers is applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied list of DNS servers, if configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DNS servers* +- GP name: *DNS_NameServer* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that responses from link local name resolution protocols received over a network interface that is higher in the binding order are preferred over DNS responses from network interfaces lower in the binding order. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). + +If you enable this policy setting, responses from link local protocols will be preferred over DNS responses if the local responses are from a network with a higher binding order. + +If you disable this policy setting, or if you do not configure this policy setting, then DNS responses from networks lower in the binding order will be preferred over responses from link local protocols received from networks higher in the binding order. + +> [!NOTE] +> This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prefer link local responses over DNS when received over a network with higher precedence* +- GP name: *DNS_PreferLocalResponsesOverLowerOrderDns* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + + +
          + + +**ADMX_DnsClient/DNS_PrimaryDnsSuffix** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution. + +To use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com. + +> [!IMPORTANT] +> In order for changes to this policy setting to be applied on computers that receive it, you must restart Windows. + +If you enable this policy setting, it supersedes the primary DNS suffix configured in the DNS Suffix and NetBIOS Computer Name dialog box using the System control panel. + +You can use this policy setting to prevent users, including local administrators, from changing the primary DNS suffix. + +If you disable this policy setting, or if you do not configure this policy setting, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix* +- GP name: *DNS_PrimaryDnsSuffix* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_RegisterAdapterName** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. + +By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com. + +If you enable this policy setting, a computer will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by computers that receive this policy setting. + +For example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, a computer will register A and PTR resource records for mycomputer.VPNconnection and mycomputer.microsoft.com when this policy setting is enabled. + +Important: This policy setting is ignored on a DNS client computer if dynamic DNS registration is disabled. + +If you disable this policy setting, or if you do not configure this policy setting, a DNS client computer will not register any A and PTR resource records using a connection-specific DNS suffix. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Register DNS records with connection-specific DNS suffix* +- GP name: *DNS_RegisterAdapterName* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_RegisterReverseLookup** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if DNS client computers will register PTR resource records. + +By default, DNS clients configured to perform dynamic DNS registration will attempt to register PTR resource record only if they successfully registered the corresponding A resource record. + +If you enable this policy setting, registration of PTR records will be determined by the option that you choose under Register PTR records. + +To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: + +- Do not register: Computers will not attempt to register PTR resource records +- Register: Computers will attempt to register PTR resource records even if registration of the corresponding A records was not successful. +- Register only if A record registration succeeds: Computers will attempt to register PTR resource records only if registration of the corresponding A records was successful. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Register PTR records* +- GP name: *DNS_RegisterReverseLookup* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_RegistrationEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if DNS dynamic update is enabled. Computers configured for DNS dynamic update automatically register and update their DNS resource records with a DNS server. + +If you enable this policy setting, or you do not configure this policy setting, computers will attempt to use dynamic DNS registration on all network connections that have connection-specific dynamic DNS registration enabled. For a dynamic DNS registration to be enabled on a network connection, the connection-specific configuration must allow dynamic DNS registration, and this policy setting must not be disabled. + +If you disable this policy setting, computers may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Dynamic update* +- GP name: *DNS_RegistrationEnabled* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_RegistrationOverwritesInConflict** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether dynamic updates should overwrite existing resource records that contain conflicting IP addresses. + +This policy setting is designed for computers that register address (A) resource records in DNS zones that do not use Secure Dynamic Updates. Secure Dynamic Update preserves ownership of resource records and does not allow a DNS client to overwrite records that are registered by other computers. + +During dynamic update of resource records in a zone that does not use Secure Dynamic Updates, an A resource record might exist that associates the client's host name with an IP address different than the one currently in use by the client. By default, the DNS client attempts to replace the existing A resource record with an A resource record that has the client's current IP address. + +If you enable this policy setting or if you do not configure this policy setting, DNS clients maintain their default behavior and will attempt to replace conflicting A resource records during dynamic update. + +If you disable this policy setting, existing A resource records that contain conflicting IP addresses will not be replaced during a dynamic update, and an error will be recorded in Event Viewer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Replace addresses in conflicts* +- GP name: *DNS_RegistrationOverwritesInConflict* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_RegistrationRefreshInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the interval used by DNS clients to refresh registration of A and PTR resource. This policy setting only applies to computers performing dynamic DNS updates. + +Computers configured to perform dynamic DNS registration of A and PTR resource records periodically reregister their records with DNS servers, even if the record has not changed. This reregistration is required to indicate to DNS servers that records are current and should not be automatically removed (scavenged) when a DNS server is configured to delete stale records. + +> [!WARNING] +> If record scavenging is enabled on the zone, the value of this policy setting should never be longer than the value of the DNS zone refresh interval. Configuring the registration refresh interval to be longer than the refresh interval of the DNS zone might result in the undesired deletion of A and PTR resource records. + +To specify the registration refresh interval, click Enabled and then enter a value of 1800 or greater. The value that you specify is the number of seconds to use for the registration refresh interval. For example, 1800 seconds is 30 minutes. + +If you enable this policy setting, registration refresh interval that you specify will be applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied setting. By default, client computers configured with a static IP address attempt to update their DNS resource records once every 24 hours and DHCP clients will attempt to update their DNS resource records when a DHCP lease is granted or renewed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Registration refresh interval* +- GP name: *DNS_RegistrationRefreshInterval* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_RegistrationTtl** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the value of the time to live (TTL) field in A and PTR resource records that are registered by computers to which this policy setting is applied. + +To specify the TTL, click Enabled and then enter a value in seconds (for example, 900 is 15 minutes). + +If you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *TTL value for A and PTR records* +- GP name: *DNS_RegistrationTtl* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_SearchList** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the DNS suffixes to attach to an unqualified single-label name before submission of a DNS query for that name. + +An unqualified single-label name contains no dots. The name "example" is a single-label name. This is different from a fully qualified domain name such as "example.microsoft.com." + +Client computers that receive this policy setting will attach one or more suffixes to DNS queries for a single-label name. For example, a DNS query for the single-label name "example" will be modified to "example.microsoft.com" before sending the query to a DNS server if this policy setting is enabled with a suffix of "microsoft.com." + +To use this policy setting, click Enabled, and then enter a string value representing the DNS suffixes that should be appended to single-label names. You must specify at least one suffix. Use a comma-delimited string, such as "microsoft.com,serverua.microsoft.com,office.microsoft.com" to specify multiple suffixes. + +If you enable this policy setting, one DNS suffix is attached at a time for each query. If a query is unsuccessful, a new DNS suffix is added in place of the failed suffix, and this new query is submitted. The values are used in the order they appear in the string, starting with the leftmost value and proceeding to the right until a query is successful or all suffixes are tried. + +If you disable this policy setting, or if you do not configure this policy setting, the primary DNS suffix and network connection-specific DNS suffixes are appended to the unqualified queries. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DNS suffix search list* +- GP name: *DNS_SearchList* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_SmartMultiHomedNameResolution** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that a multi-homed DNS client should optimize name resolution across networks. The setting improves performance by issuing parallel DNS, link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT) queries across all networks. In the event that multiple positive responses are received, the network binding order is used to determine which response to accept. + +If you enable this policy setting, the DNS client will not perform any optimizations. DNS queries will be issued across all networks first. LLMNR queries will be issued if the DNS queries fail, followed by NetBT queries if LLMNR queries fail. + +If you disable this policy setting, or if you do not configure this policy setting, name resolution will be optimized when issuing DNS, LLMNR and NetBT queries. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off smart multi-homed name resolution* +- GP name: *DNS_SmartMultiHomedNameResolution* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_SmartProtocolReorder** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that the DNS client should prefer responses from link local name resolution protocols on non-domain networks over DNS responses when issuing queries for flat names. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). + +If you enable this policy setting, the DNS client will prefer DNS responses, followed by LLMNR, followed by NetBT for all networks. + +If you disable this policy setting, or if you do not configure this policy setting, the DNS client will prefer link local responses for flat name queries on non-domain networks. + +> [!NOTE] +> This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off smart protocol reordering* +- GP name: *DNS_SmartProtocolReorder* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_UpdateSecurityLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the security level for dynamic DNS updates. + +To use this policy setting, click Enabled and then select one of the following values: + +- Unsecure followed by secure - computers send secure dynamic updates only when nonsecure dynamic updates are refused. +- Only unsecure - computers send only nonsecure dynamic updates. +- Only secure - computers send only secure dynamic updates. + +If you enable this policy setting, computers that attempt to send dynamic DNS updates will use the security level that you specify in this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use local settings. By default, DNS clients attempt to use unsecured dynamic update first. If an unsecured update is refused, clients try to use secure update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Update security level* +- GP name: *DNS_UpdateSecurityLevel* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_UpdateTopLevelDomainZones** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if computers may send dynamic updates to zones with a single label name. These zones are also known as top-level domain zones, for example: "com." + +By default, a DNS client that is configured to perform dynamic DNS update will update the DNS zone that is authoritative for its DNS resource records unless the authoritative zone is a top-level domain or root zone. + +If you enable this policy setting, computers send dynamic updates to any zone that is authoritative for the resource records that the computer needs to update, except the root zone. + +If you disable this policy setting, or if you do not configure this policy setting, computers do not send dynamic updates to the root zone or top-level domain zones that are authoritative for the resource records that the computer needs to update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Update top level domain zones* +- GP name: *DNS_UpdateTopLevelDomainZones* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/DNS_UseDomainNameDevolution** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies if the DNS client performs primary DNS suffix devolution during the name resolution process. + +With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. + +The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box. + +Devolution is not enabled if a global suffix search list is configured using Group Policy. + +If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries: + +The primary DNS suffix, as specified on the Computer Name tab of the System control panel. + +Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection. + +For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. + +If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. + +For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using the primary DNS suffix devolution level policy setting. The default devolution level is two. + +If you enable this policy setting, or if you do not configure this policy setting, DNS clients attempt to resolve single-label names using concatenations of the single-label name to be resolved and the devolved primary DNS suffix. + +If you disable this policy setting, DNS clients do not attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved primary DNS suffix. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix devolution* +- GP name: *DNS_UseDomainNameDevolution* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
          + + +**ADMX_DnsClient/Turn_Off_Multicast** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies that link local multicast name resolution (LLMNR) is disabled on client computers. + +LLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution is not possible. + +If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer. + +If you disable this policy setting, or you do not configure this policy setting, LLMNR will be enabled on all available network adapters. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off multicast name resolution* +- GP name: *Turn_Off_Multicast* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-dwm.md b/windows/client-management/mdm/policy-csp-admx-dwm.md new file mode 100644 index 0000000000..ff5b9de5cc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-dwm.md @@ -0,0 +1,491 @@ +--- +title: Policy CSP - ADMX_DWM +description: Policy CSP - ADMX_DWM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/31/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DWM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_DWM policies + +
          +
          + ADMX_DWM/DwmDefaultColorizationColor_1 +
          +
          + ADMX_DWM/DwmDefaultColorizationColor_2 +
          +
          + ADMX_DWM/DwmDisallowAnimations_1 +
          +
          + ADMX_DWM/DwmDisallowAnimations_2 +
          +
          + ADMX_DWM/DwmDisallowColorizationColorChanges_1 +
          +
          + ADMX_DWM/DwmDisallowColorizationColorChanges_2 +
          +
          + + +
          + + +**ADMX_DWM/DwmDefaultColorizationColor_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the default color for window frames when the user does not specify a color. + +If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not specify a color. + +If you disable or do not configure this policy setting, the default internal color is used, if the user does not specify a color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Prevent color changes of window frames" setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify a default color* +- GP name: *DwmDefaultColorizationColor_1* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + + +
          + + +**ADMX_DWM/DwmDefaultColorizationColor_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the default color for window frames when the user does not specify a color. + +If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not specify a color. + +If you disable or do not configure this policy setting, the default internal color is used, if the user does not specify a color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Prevent color changes of window frames" setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify a default color* +- GP name: *DwmDefaultColorizationColor_2* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + +
          + + +**ADMX_DWM/DwmDisallowAnimations_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows. + +If you enable this policy setting, window animations are turned off. + +If you disable or do not configure this policy setting, window animations are turned on. + +Changing this policy setting requires a logoff for it to be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow window animations* +- GP name: *DwmDisallowAnimations_1* +- GP path: *Windows Components/Desktop Window Manager* +- GP ADMX file name: *DWM.admx* + + + +
          + + +**ADMX_DWM/DwmDisallowAnimations_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows. + +If you enable this policy setting, window animations are turned off. + +If you disable or do not configure this policy setting, window animations are turned on. + +Changing this policy setting requires a logoff for it to be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow window animations* +- GP name: *DwmDisallowAnimations_2* +- GP path: *Windows Components/Desktop Window Manager* +- GP ADMX file name: *DWM.admx* + + + +
          + + +**ADMX_DWM/DwmDisallowColorizationColorChanges_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the ability to change the color of window frames. + +If you enable this policy setting, you prevent users from changing the default window frame color. + +If you disable or do not configure this policy setting, you allow users to change the default window frame color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Specify a default color for window frames" policy setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow color changes* +- GP name: *DwmDisallowColorizationColorChanges_1* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + +
          + + +**ADMX_DWM/DwmDisallowColorizationColorChanges_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the ability to change the color of window frames. + +If you enable this policy setting, you prevent users from changing the default window frame color. + +If you disable or do not configure this policy setting, you allow users to change the default window frame color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Specify a default color for window frames" policy setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow color changes* +- GP name: *DwmDisallowColorizationColorChanges_2* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md new file mode 100644 index 0000000000..433116e5de --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -0,0 +1,971 @@ +--- +title: Policy CSP - ADMX_EAIME +description: Policy CSP - ADMX_EAIME +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EAIME +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_EAIME policies + +
          +
          + ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList +
          +
          + ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion +
          +
          + ADMX_EAIME/L_TurnOffCustomDictionary +
          +
          + ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput +
          +
          + ADMX_EAIME/L_TurnOffInternetSearchIntegration +
          +
          + ADMX_EAIME/L_TurnOffOpenExtendedDictionary +
          +
          + ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile +
          +
          + ADMX_EAIME/L_TurnOnCloudCandidate +
          +
          + ADMX_EAIME/L_TurnOnCloudCandidateCHS +
          +
          + ADMX_EAIME/L_TurnOnLexiconUpdate +
          +
          + ADMX_EAIME/L_TurnOnLiveStickers +
          +
          + ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport +
          +
          + + +
          + + +**ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to include the Non-Publishing Standard Glyph in the candidate list when Publishing Standard Glyph for the word exists. + +If you enable this policy setting, Non-Publishing Standard Glyph is not included in the candidate list when Publishing Standard Glyph for the word exists. + +If you disable or do not configure this policy setting, both Publishing Standard Glyph and Non-Publishing Standard Glyph are included in the candidate list. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not include Non-Publishing Standard Glyph in the candidate list* +- GP name: *L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to restrict character code range of conversion by setting character filter. + +If you enable this policy setting, then only the character code ranges specified by this policy setting are used for conversion of IME. You can specify multiple ranges by setting a value combined with a bitwise OR of following values: + +- 0x0001 // JIS208 area +- 0x0002 // NEC special char code +- 0x0004 // NEC selected IBM extended code +- 0x0008 // IBM extended code +- 0x0010 // Half width katakana code +- 0x0100 // EUDC(GAIJI) +- 0x0200 // S-JIS unmapped area +- 0x0400 // Unicode char +- 0x0800 // surrogate char +- 0x1000 // IVS char +- 0xFFFF // no definition. + +If you disable or do not configure this policy setting, no range of characters are filtered by default. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict character code range of conversion* +- GP name: *L_RestrictCharacterCodeRangeOfConversion* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOffCustomDictionary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off the ability to use a custom dictionary. + +If you enable this policy setting, you cannot add, edit, and delete words in the custom dictionary either with GUI tools or APIs. A word registered in the custom dictionary before enabling this policy setting can continue to be used for conversion. + +If you disable or do not configure this policy setting, the custom dictionary can be used by default. + +For Japanese Microsoft IME, [Clear auto-tuning information] works, even if this policy setting is enabled, and it clears self-tuned words from the custom dictionary. + +This policy setting is applied to Japanese Microsoft IME. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off custom dictionary* +- GP name: *L_TurnOffCustomDictionary* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off history-based predictive input. + +If you enable this policy setting, history-based predictive input is turned off. + +If you disable or do not configure this policy setting, history-based predictive input is on by default. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off history-based predictive input* +- GP name: *L_TurnOffHistorybasedPredictiveInput* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOffInternetSearchIntegration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Internet search integration. + +Search integration includes both using Search Provider (Japanese Microsoft IME) and performing Bing search from predictive input for Japanese Microsoft IME. + +If you enable this policy setting, you cannot use search integration. + +If you disable or do not configure this policy setting, the search integration function can be used by default. + +This policy setting applies to Japanese Microsoft IME. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet search integration* +- GP name: *L_TurnOffInternetSearchIntegration* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOffOpenExtendedDictionary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Open Extended Dictionary. + +If you enable this policy setting, Open Extended Dictionary is turned off. You cannot add a new Open Extended Dictionary. + +For Japanese Microsoft IME, an Open Extended Dictionary that is added before enabling this policy setting is not used for conversion. + +If you disable or do not configure this policy setting, Open Extended Dictionary can be added and used by default. + +This policy setting is applied to Japanese Microsoft IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Open Extended Dictionary* +- GP name: *L_TurnOffOpenExtendedDictionary* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off saving the auto-tuning result to file. + +If you enable this policy setting, the auto-tuning data is not saved to file. + +If you disable or do not configure this policy setting, auto-tuning data is saved to file by default. + +This policy setting applies to Japanese Microsoft IME only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off saving auto-tuning data to file* +- GP name: *L_TurnOffSavingAutoTuningDataToFile* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOnCloudCandidate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature. + +This Policy setting applies to Microsoft CHS Pinyin IME and JPN IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on cloud candidate* +- GP name: *L_TurnOnCloudCandidate* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOnCloudCandidateCHS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on cloud candidate for CHS* +- GP name: *L_TurnOnCloudCandidateCHS* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOnLexiconUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the lexicon update feature, which downloads hot and popular words lexicon to local PC. + +If you enable this policy setting, the functionality associated with this feature is turned on, hot and popular words lexicon can be downloaded to local PC, the user is able to turn it on or off in settings. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned on by default, and the user can turn on and turn off the lexicon update feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on lexicon update* +- GP name: *L_TurnOnLexiconUpdate* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOnLiveStickers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the live sticker feature, which uses an online service to provide stickers online. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the live stickers, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the live sticker feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Live Sticker* +- GP name: *L_TurnOnLiveStickers* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + + +**ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on logging of misconversion for the misconversion report. + +If you enable this policy setting, misconversion logging is turned on. + +If you disable or do not configure this policy setting, misconversion logging is turned off. + +This policy setting applies to Japanese Microsoft IME and Traditional Chinese IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on misconversion logging for misconversion report* +- GP name: *L_TurnOnMisconversionLoggingForMisconversionReport* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md new file mode 100644 index 0000000000..ec7948b584 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md @@ -0,0 +1,116 @@ +--- +title: Policy CSP - ADMX_EncryptFilesonMove +description: Policy CSP - ADMX_EncryptFilesonMove +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EncryptFilesonMove +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_EncryptFilesonMove policies + +
          +
          + ADMX_EncryptFilesonMove/NoEncryptOnMove +
          +
          + + +
          + + +**ADMX_EncryptFilesonMove/NoEncryptOnMove** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents File Explorer from encrypting files that are moved to an encrypted folder. + +If you enable this policy setting, File Explorer will not automatically encrypt files that are moved to an encrypted folder. + +If you disable or do not configure this policy setting, File Explorer automatically encrypts files that are moved to an encrypted folder. + +This setting applies only to files moved within a volume. When files are moved to other volumes, or if you create a new file in an encrypted folder, File Explorer encrypts those files automatically. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not automatically encrypt files moved to encrypted folders* +- GP name: *NoEncryptOnMove* +- GP path: *System* +- GP ADMX file name: *EncryptFilesonMove.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md new file mode 100644 index 0000000000..4e1cf740ae --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -0,0 +1,476 @@ +--- +title: Policy CSP - ADMX_EnhancedStorage +description: Policy CSP - ADMX_EnhancedStorage +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EnhancedStorage +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_EnhancedStorage policies + +
          +
          + ADMX_EnhancedStorage/ApprovedEnStorDevices +
          +
          + ADMX_EnhancedStorage/ApprovedSilos +
          +
          + ADMX_EnhancedStorage/DisablePasswordAuthentication +
          +
          + ADMX_EnhancedStorage/DisallowLegacyDiskDevices +
          +
          + ADMX_EnhancedStorage/LockDeviceOnMachineLock +
          +
          + ADMX_EnhancedStorage/RootHubConnectedEnStorDevices +
          +
          + + +
          + + +**ADMX_EnhancedStorage/ApprovedEnStorDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure a list of Enhanced Storage devices by manufacturer and product ID that are usable on your computer. + +If you enable this policy setting, only Enhanced Storage devices that contain a manufacturer and product ID specified in this policy are usable on your computer. + +If you disable or do not configure this policy setting, all Enhanced Storage devices are usable on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure list of Enhanced Storage devices usable on your computer* +- GP name: *ApprovedEnStorDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
          + + +**ADMX_EnhancedStorage/ApprovedSilos** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to create a list of IEEE 1667 silos, compliant with the Institute of Electrical and Electronics Engineers, Inc. (IEEE) 1667 specification, that are usable on your computer. + +If you enable this policy setting, only IEEE 1667 silos that match a silo type identifier specified in this policy are usable on your computer. + +If you disable or do not configure this policy setting, all IEEE 1667 silos on Enhanced Storage devices are usable on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure list of IEEE 1667 silos usable on your computer* +- GP name: *ApprovedSilos* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
          + + +**ADMX_EnhancedStorage/DisablePasswordAuthentication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not a password can be used to unlock an Enhanced Storage device. + +If you enable this policy setting, a password cannot be used to unlock an Enhanced Storage device. + +If you disable or do not configure this policy setting, a password can be used to unlock an Enhanced Storage device. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow password authentication of Enhanced Storage devices* +- GP name: *DisablePasswordAuthentication* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
          + + +**ADMX_EnhancedStorage/DisallowLegacyDiskDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not non-Enhanced Storage removable devices are allowed on your computer. + +If you enable this policy setting, non-Enhanced Storage removable devices are not allowed on your computer. + +If you disable or do not configure this policy setting, non-Enhanced Storage removable devices are allowed on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow non-Enhanced Storage removable devices* +- GP name: *DisallowLegacyDiskDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
          + + +**ADMX_EnhancedStorage/LockDeviceOnMachineLock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting locks Enhanced Storage devices when the computer is locked. + +This policy setting is supported in Windows Server SKUs only. + +If you enable this policy setting, the Enhanced Storage device remains locked when the computer is locked. + +If you disable or do not configure this policy setting, the Enhanced Storage device state is not changed when the computer is locked. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lock Enhanced Storage when the computer is locked* +- GP name: *LockDeviceOnMachineLock* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
          + + +**ADMX_EnhancedStorage/RootHubConnectedEnStorDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not only USB root hub connected Enhanced Storage devices are allowed. Allowing only root hub connected Enhanced Storage devices minimizes the risk of an unauthorized USB device reading data on an Enhanced Storage device. + +If you enable this policy setting, only USB root hub connected Enhanced Storage devices are allowed. + +If you disable or do not configure this policy setting, USB Enhanced Storage devices connected to both USB root hubs and non-root hubs will be allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only USB root hub connected Enhanced Storage devices* +- GP name: *RootHubConnectedEnStorDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md new file mode 100644 index 0000000000..a220ae0692 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -0,0 +1,2202 @@ +--- +title: Policy CSP - ADMX_ErrorReporting +description: Policy CSP - ADMX_ErrorReporting +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ErrorReporting +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_ErrorReporting policies + +
          +
          + ADMX_ErrorReporting/PCH_AllOrNoneDef +
          +
          + ADMX_ErrorReporting/PCH_AllOrNoneEx +
          +
          + ADMX_ErrorReporting/PCH_AllOrNoneInc +
          +
          + ADMX_ErrorReporting/PCH_ConfigureReport +
          +
          + ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults +
          +
          + ADMX_ErrorReporting/WerArchive_1 +
          +
          + ADMX_ErrorReporting/WerArchive_2 +
          +
          + ADMX_ErrorReporting/WerAutoApproveOSDumps_1 +
          +
          + ADMX_ErrorReporting/WerAutoApproveOSDumps_2 +
          +
          + ADMX_ErrorReporting/WerBypassDataThrottling_1 +
          +
          + ADMX_ErrorReporting/WerBypassDataThrottling_2 +
          +
          + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1 +
          +
          + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2 +
          +
          + ADMX_ErrorReporting/WerBypassPowerThrottling_1 +
          +
          + ADMX_ErrorReporting/WerBypassPowerThrottling_2 +
          +
          + ADMX_ErrorReporting/WerCER +
          +
          + ADMX_ErrorReporting/WerConsentCustomize_1 +
          +
          + ADMX_ErrorReporting/WerConsentOverride_1 +
          +
          + ADMX_ErrorReporting/WerConsentOverride_2 +
          +
          + ADMX_ErrorReporting/WerDefaultConsent_1 +
          +
          + ADMX_ErrorReporting/WerDefaultConsent_2 +
          +
          + ADMX_ErrorReporting/WerDisable_1 +
          +
          + ADMX_ErrorReporting/WerExlusion_1 +
          +
          + ADMX_ErrorReporting/WerExlusion_2 +
          +
          + ADMX_ErrorReporting/WerNoLogging_1 +
          +
          + ADMX_ErrorReporting/WerNoLogging_2 +
          +
          + ADMX_ErrorReporting/WerNoSecondLevelData_1 +
          +
          + ADMX_ErrorReporting/WerQueue_1 +
          +
          + ADMX_ErrorReporting/WerQueue_2 +
          +
          + + +
          + + +**ADMX_ErrorReporting/PCH_AllOrNoneDef** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether errors in general applications are included in reports when Windows Error Reporting is enabled. + +If you enable this policy setting, you can instruct Windows Error Reporting in the Default pull-down menu to report either all application errors (the default setting), or no application errors. + +If the Report all errors in Microsoft applications check box is filled, all errors in Microsoft applications are reported, regardless of the setting in the Default pull-down menu. When the Report all errors in Windows check box is filled, all errors in Windows applications are reported, regardless of the setting in the Default dropdown list. The Windows applications category is a subset of Microsoft applications. + +If you disable or do not configure this policy setting, users can enable or disable Windows Error Reporting in Control Panel. The default setting in Control Panel is Upload all applications. + +This policy setting is ignored if the Configure Error Reporting policy setting is disabled or not configured. + +For related information, see the Configure Error Reporting and Report Operating System Errors policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default application reporting settings* +- GP name: *PCH_AllOrNoneDef* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/PCH_AllOrNoneEx** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors. + +If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. If an application is listed both in the List of applications to always report errors for policy setting, and in the exclusion list in this policy setting, the application is excluded from error reporting. You can also use the exclusion list in this policy setting to exclude specific Microsoft applications or parts of Windows if the check boxes for these categories are filled in the Default application reporting settings policy setting. + +If you disable or do not configure this policy setting, the Default application reporting settings policy setting takes precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to never report errors for* +- GP name: *PCH_AllOrNoneEx* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/PCH_AllOrNoneInc** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies applications for which Windows Error Reporting should always report errors. + +To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors. + +If you enable this policy setting, you can create a list of applications that are always included in error reporting. To add applications to the list, click Show under the Report errors for applications on this list setting, and edit the list of application file names in the Show Contents dialog box. The file names must include the .exe file name extension (for example, notepad.exe). Errors that are generated by applications on this list are always reported, even if the Default dropdown in the Default application reporting policy setting is set to report no application errors. + +If the Report all errors in Microsoft applications or Report all errors in Windows components check boxes in the Default Application Reporting policy setting are filled, Windows Error Reporting reports errors as if all applications in these categories were added to the list in this policy setting. (Note: The Microsoft applications category includes the Windows components category.) + +If you disable this policy setting or do not configure it, the Default application reporting settings policy setting takes precedence. + +Also see the "Default Application Reporting" and "Application Exclusion List" policies. + +This setting will be ignored if the 'Configure Error Reporting' setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to always report errors for* +- GP name: *PCH_AllOrNoneInc* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/PCH_ConfigureReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures how errors are reported to Microsoft, and what information is sent when Windows Error Reporting is enabled. + +This policy setting does not enable or disable Windows Error Reporting. To turn Windows Error Reporting on or off, see the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings. + +> [!IMPORTANT] +> If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting. + +If you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel). If you enable this policy setting, you can configure the following settings in the policy setting: + +- "Do not display links to any Microsoft ‘More information’ websites": Select this option if you do not want error dialog boxes to display links to Microsoft websites. + +- "Do not collect additional files": Select this option if you do not want additional files to be collected and included in error reports. + +- "Do not collect additional computer data": Select this if you do not want additional information about the computer to be collected and included in error reports. + +- "Force queue mode for application errors": Select this option if you do not want users to report errors. When this option is selected, errors are stored in a queue directory, and the next administrator to log on to the computer can send the error reports to Microsoft. + +- "Corporate file path": Type a UNC path to enable Corporate Error Reporting. All errors are stored at the specified location instead of being sent directly to Microsoft, and the next administrator to log onto the computer can send the error reports to Microsoft. + +- "Replace instances of the word ‘Microsoft’ with": You can specify text with which to customize your error report dialog boxes. The word ""Microsoft"" is replaced with the specified text. + +If you do not configure this policy setting, users can change Windows Error Reporting settings in Control Panel. By default, these settings are Enable Reporting on computers that are running Windows XP, and Report to Queue on computers that are running Windows Server 2003. + +If you disable this policy setting, configuration settings in the policy setting are left blank. + +See related policy settings Display Error Notification (same folder as this policy setting), and Turn off Windows Error Reporting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Error Reporting* +- GP name: *PCH_ConfigureReport* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether errors in the operating system are included Windows Error Reporting is enabled. + +If you enable this policy setting, Windows Error Reporting includes operating system errors. + +If you disable this policy setting, operating system errors are not included in error reports. + +If you do not configure this policy setting, users can change this setting in Control Panel. By default, Windows Error Reporting settings in Control Panel are set to upload operating system errors. + +See also the Configure Error Reporting policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Report operating system errors* +- GP name: *PCH_ReportOperatingSystemFaults* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerArchive_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the behavior of the Windows Error Reporting archive. + +If you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted. + +If you disable or do not configure this policy setting, no Windows Error Reporting information is stored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Archive* +- GP name: *WerArchive_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerArchive_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the behavior of the Windows Error Reporting archive. + +If you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted. + +If you disable or do not configure this policy setting, no Windows Error Reporting information is stored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Archive* +- GP name: *WerArchive_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerAutoApproveOSDumps_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps. + +If you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user. + +If you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP name: *WerAutoApproveOSDumps_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerAutoApproveOSDumps_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps. + +If you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user. + +If you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP name: *WerAutoApproveOSDumps_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerBypassDataThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server. + +If you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report. + +If you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not throttle additional data* +- GP name: *WerBypassDataThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerBypassDataThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server. + +If you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report. + +If you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not throttle additional data* +- GP name: *WerBypassDataThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network. + +If you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted. + +If you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send data when on connected to a restricted/costed network* +- GP name: *WerBypassNetworkCostThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network. + +If you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted. + +If you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send data when on connected to a restricted/costed network* +- GP name: *WerBypassNetworkCostThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerBypassPowerThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source. + +If you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally. + +If you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send additional data when on battery power* +- GP name: *WerBypassPowerThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerBypassPowerThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source. + +If you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally. + +If you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send additional data when on battery power* +- GP name: *WerBypassPowerThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerCER** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a corporate server to which Windows Error Reporting sends reports (if you do not want to send error reports to Microsoft). + +If you enable this policy setting, you can specify the name or IP address of an error report destination server on your organization’s network. You can also select Connect using SSL to transmit error reports over a Secure Sockets Layer (SSL) connection, and specify a port number on the destination server for transmission. + +If you disable or do not configure this policy setting, Windows Error Reporting sends error reports to Microsoft. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Corporate Windows Error Reporting* +- GP name: *WerCER* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerConsentCustomize_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the consent behavior of Windows Error Reporting for specific event types. + +If you enable this policy setting, you can add specific event types to a list by clicking Show, and typing event types in the Value Name column of the Show Contents dialog box. Event types are those for generic, non-fatal errors: crash, no response, and kernel fault errors. For each specified event type, you can set a consent level of 0, 1, 2, 3, or 4. + +- 0 (Disable): Windows Error Reporting sends no data to Microsoft for this event type. + +- 1 (Always ask before sending data): Windows prompts the user for consent to send reports. + +- 2 (Send parameters): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, and Windows prompts the user for consent to send any additional data requested by Microsoft. + +- 3 (Send parameters and safe additional data): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, as well as data which Windows has determined (within a high probability) does not contain personally identifiable data, and prompts the user for consent to send any additional data requested by Microsoft. + +- 4 (Send all data): Any data requested by Microsoft is sent automatically. + +If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Customize consent settings* +- GP name: *WerConsentCustomize_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerConsentOverride_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings. + +If you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting. + +If you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore custom consent settings* +- GP name: *WerConsentOverride_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerConsentOverride_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings. + +If you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting. + +If you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore custom consent settings* +- GP name: *WerConsentOverride_2* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerDefaultConsent_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the default consent behavior of Windows Error Reporting. + +If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting: + +- Always ask before sending data: Windows prompts users for consent to send reports. + +- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft. + +- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft. + +- Send all data: any error reporting data requested by Microsoft is sent automatically. + +If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Default consent* +- GP name: *WerDefaultConsent_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerDefaultConsent_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the default consent behavior of Windows Error Reporting. + +If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting: + +- Always ask before sending data: Windows prompts users for consent to send reports. + +- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft. + +- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft. + +- Send all data: any error reporting data requested by Microsoft is sent automatically. + +If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Default consent* +- GP name: *WerDefaultConsent_2* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerDisable_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails. + +If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel. + +If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Windows Error Reporting* +- GP name: *WerDisable_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerExlusion_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. + +If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to be excluded* +- GP name: *WerExlusion_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerExlusion_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. + +If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to be excluded* +- GP name: *WerExlusion_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerNoLogging_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log. + +If you enable this policy setting, Windows Error Reporting events are not recorded in the system event log. + +If you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable logging* +- GP name: *WerNoLogging_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerNoLogging_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log. + +If you enable this policy setting, Windows Error Reporting events are not recorded in the system event log. + +If you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable logging* +- GP name: *WerNoLogging_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerNoSecondLevelData_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically. + +If you enable this policy setting, any additional data requests from Microsoft in response to a Windows Error Reporting report are automatically declined, without notification to the user. + +If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not send additional data* +- GP name: *WerNoSecondLevelData_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerQueue_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Windows Error Reporting report queue. + +If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. + +The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder. + +If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Queue* +- GP name: *WerQueue_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + + +**ADMX_ErrorReporting/WerQueue_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Windows Error Reporting report queue. + +If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. If Queuing behavior is set to Always queue for administrator, reports are queued until an administrator is prompted to send them, or until the administrator sends them by using the Solutions to Problems page in Control Panel. + +The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder. + +If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Queue* +- GP name: *WerQueue_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md new file mode 100644 index 0000000000..e47d548237 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -0,0 +1,200 @@ +--- +title: Policy CSP - ADMX_EventForwarding +description: Policy CSP - ADMX_EventForwarding +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EventForwarding + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_EventForwarding policies + +
          +
          + ADMX_EventForwarding/ForwarderResourceUsage +
          +
          + ADMX_EventForwarding/SubscriptionManager +
          +
          + + +
          + + +**ADMX_EventForwarding/ForwarderResourceUsage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector. + +If you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments. + +If you disable or do not configure this policy setting, forwarder resource usage is not specified. + +This setting applies across all subscriptions for the forwarder (source computer). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure forwarder resource usage* +- GP name: *ForwarderResourceUsage* +- GP path: *Windows Components/Event Forwarding* +- GP ADMX file name: *EventForwarding.admx* + + + +
          + +
          + + +**ADMX_EventForwarding/SubscriptionManager** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a target Subscription Manager. + +If you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics. + +Use the following syntax when using the HTTPS protocol: + +``` syntax + +Server=https://:5986/wsman/SubscriptionManager/WEC,Refresh=,IssuerCA=. +``` + +When using the HTTP protocol, use port 5985. + +If you disable or do not configure this policy setting, the Event Collector computer will not be specified. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure target Subscription Manager* +- GP name: *SubscriptionManager* +- GP path: *Windows Components/Event Forwarding* +- GP ADMX file name: *EventForwarding.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md new file mode 100644 index 0000000000..97b2384e47 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -0,0 +1,1588 @@ +--- +title: Policy CSP - ADMX_EventLog +description: Policy CSP - ADMX_EventLog +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EventLog +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_EventLog policies + +
          +
          + ADMX_EventLog/Channel_LogEnabled +
          +
          + ADMX_EventLog/Channel_LogFilePath_1 +
          +
          + ADMX_EventLog/Channel_LogFilePath_2 +
          +
          + ADMX_EventLog/Channel_LogFilePath_3 +
          +
          + ADMX_EventLog/Channel_LogFilePath_4 +
          +
          + ADMX_EventLog/Channel_LogMaxSize_3 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_1 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_2 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_3 +
          +
          + ADMX_EventLog/Channel_Log_AutoBackup_4 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_1 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_2 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_3 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_4 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_5 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_6 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_7 +
          +
          + ADMX_EventLog/Channel_Log_FileLogAccess_8 +
          +
          + ADMX_EventLog/Channel_Log_Retention_2 +
          +
          + ADMX_EventLog/Channel_Log_Retention_3 +
          +
          + ADMX_EventLog/Channel_Log_Retention_4 +
          +
          + + +
          + + +**ADMX_EventLog/Channel_LogEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns on logging. + +If you enable or do not configure this policy setting, then events can be written to this log. + +If the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on logging* +- GP name: *Channel_LogEnabled* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_LogFilePath_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_LogFilePath_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_LogFilePath_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_LogFilePath_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on logging* +- GP name: *Channel_LogFilePath_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_LogMaxSize_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the maximum size of the log file in kilobytes. + +If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments. + +If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum log file size (KB)* +- GP name: *Channel_LogMaxSize_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_AutoBackup_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_AutoBackup_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_AutoBackup_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_AutoBackup_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log. + +If you disable or do not configure this policy setting, only system software and administrators can read or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only users whose security descriptor matches the configured value can access the log. + +If you disable or do not configure this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_5** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable this policy setting, all authenticated users and system services can write, read, or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_5* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_6** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. + +If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log. + +If you disable this policy setting, only system software and administrators can read or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_6* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_7** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable this policy setting, all authenticated users and system services can write, read, or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_7* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_FileLogAccess_8** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only users whose security descriptor matches the configured value can access the log. + +If you disable this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_8* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_Retention_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_Retention_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
          + + +**ADMX_EventLog/Channel_Log_Retention_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md new file mode 100644 index 0000000000..37b6b9a826 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md @@ -0,0 +1,117 @@ +--- +title: Policy CSP - ADMX_FileServerVSSProvider +description: Policy CSP - ADMX_FileServerVSSProvider +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_FileServerVSSProvider +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_FileServerVSSProvider policies + +
          +
          + ADMX_FileServerVSSProvider/Pol_EncryptProtocol +
          +
          + + +
          + + +**ADMX_FileServerVSSProvider/Pol_EncryptProtocol** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether the RPC protocol messages used by VSS for SMB2 File Shares feature is enabled. + +VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. + +By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. + +> [!NOTE] +> To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.* +- GP name: *Pol_EncryptProtocol* +- GP path: *System/File Share Shadow Copy Provider* +- GP ADMX file name: *FileServerVSSProvider.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md new file mode 100644 index 0000000000..fbdc148b37 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -0,0 +1,588 @@ +--- +title: Policy CSP - ADMX_FileSys +description: Policy CSP - ADMX_FileSys +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_FileSys +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_FileSys policies + +
          +
          + ADMX_FileSys/DisableCompression +
          +
          + ADMX_FileSys/DisableDeleteNotification +
          +
          + ADMX_FileSys/DisableEncryption +
          +
          + ADMX_FileSys/EnablePagefileEncryption +
          +
          + ADMX_FileSys/LongPathsEnabled +
          +
          + ADMX_FileSys/ShortNameCreationSettings +
          +
          + ADMX_FileSys/SymlinkEvaluation +
          +
          + ADMX_FileSys/TxfDeprecatedFunctionality +
          +
          + + +
          + + +**ADMX_FileSys/DisableCompression** + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Compression can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of compressed files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow compression on all NTFS volumes* +- GP name: *DisableCompression* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
          + + +**ADMX_FileSys/DisableDeleteNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Delete notification is a feature that notifies the underlying storage device of clusters that are freed due to a file delete operation. + +A value of 0, the default, will enable delete notifications for all volumes. + +A value of 1 will disable delete notifications for all volumes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable delete notifications on all volumes* +- GP name: *DisableDeleteNotification* +- GP path: *System/Filesystem* +- GP ADMX file name: *FileSys.admx* + + + +
          + + +**ADMX_FileSys/DisableEncryption** + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Encryption can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of encrypted files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow encryption on all NTFS volumes* +- GP name: *DisableEncryption* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
          + + +**ADMX_FileSys/EnablePagefileEncryption** + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Encrypting the page file prevents malicious users from reading data that has been paged to disk, but also adds processing overhead for filesystem operations. Enabling this setting will cause the page files to be encrypted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable NTFS pagefile encryption* +- GP name: *EnablePagefileEncryption* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
          + + +**ADMX_FileSys/LongPathsEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Enabling Win32 long paths will allow manifested win32 applications and Windows Store applications to access paths beyond the normal 260 character limit per node on file systems that support it. Enabling this setting will cause the long paths to be accessible within the process. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Win32 long paths* +- GP name: *LongPathsEnabled* +- GP path: *System/Filesystem* +- GP ADMX file name: *FileSys.admx* + + + +
          + + +**ADMX_FileSys/ShortNameCreationSettings** + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting provides control over whether or not short names are generated during file creation. Some applications require short names for compatibility, but short names have a negative performance impact on the system. + +If you enable short names on all volumes then short names will always be generated. If you disable them on all volumes then they will never be generated. If you set short name creation to be configurable on a per volume basis then an on-disk flag will determine whether or not short names are created on a given volume. If you disable short name creation on all data volumes then short names will only be generated for files created on the system volume. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Short name creation options* +- GP name: *ShortNameCreationSettings* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
          + + +**ADMX_FileSys/SymlinkEvaluation** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links: + +- Local Link to a Local Target +- Local Link to a Remote Target +- Remote Link to Remote Target +- Remote Link to Local Target + +For more information, refer to the Windows Help section. + +> [!NOTE] +> If this policy is disabled or not configured, local administrators may select the types of symbolic links to be evaluated. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Selectively allow the evaluation of a symbolic link* +- GP name: *SymlinkEvaluation* +- GP path: *System/Filesystem* +- GP ADMX file name: *FileSys.admx* + + + +
          + + +**ADMX_FileSys/TxfDeprecatedFunctionality** + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. TXF deprecated features included savepoints, secondary RM, miniversion and roll forward. Enable it if you want to use the APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable / disable TXF deprecated features* +- GP name: *TxfDeprecatedFunctionality* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md new file mode 100644 index 0000000000..845c514983 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -0,0 +1,570 @@ +--- +title: Policy CSP - ADMX_FolderRedirection +description: Policy CSP - ADMX_FolderRedirection +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_FolderRedirection +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_FolderRedirection policies + +
          +
          + ADMX_FolderRedirection/DisableFRAdminPin +
          +
          + ADMX_FolderRedirection/DisableFRAdminPinByFolder +
          +
          + ADMX_FolderRedirection/FolderRedirectionEnableCacheRename +
          +
          + ADMX_FolderRedirection/LocalizeXPRelativePaths_1 +
          +
          + ADMX_FolderRedirection/LocalizeXPRelativePaths_2 +
          +
          + ADMX_FolderRedirection/PrimaryComputer_FR_1 +
          +
          + ADMX_FolderRedirection/PrimaryComputer_FR_2 +
          +
          + + +
          + + +**ADMX_FolderRedirection/DisableFRAdminPin** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to control whether all redirected shell folders, such as Contacts, Documents, Desktop, Favorites, Music, Pictures, Videos, Start Menu, and AppData\Roaming, are available offline by default. + +If you enable this policy setting, users must manually select the files they wish to make available offline. + +If you disable or do not configure this policy setting, redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. + +> [!NOTE] +> This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface. +> +> Do not enable this policy setting if users will need access to their redirected files if the network or server holding the redirected files becomes unavailable. +> +> If one or more valid folder GUIDs are specified in the policy setting "Do not automatically make specific redirected folders available offline", that setting will override the configured value of "Do not automatically make all redirected folders available offline". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not automatically make all redirected folders available offline* +- GP name: *DisableFRAdminPin* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
          + + +**ADMX_FolderRedirection/DisableFRAdminPinByFolder** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to control whether individual redirected shell folders are available offline by default. + +For the folders affected by this setting, users must manually select the files they wish to make available offline. + +If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. + +> [!NOTE] +> This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface. +> +> The configuration of this policy for any folder will override the configured value of "Do not automatically make all redirected folders available offline". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not automatically make specific redirected folders available offline* +- GP name: *DisableFRAdminPinByFolder* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
          + + +**ADMX_FolderRedirection/FolderRedirectionEnableCacheRename** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether the contents of redirected folders is copied from the old location to the new location or simply renamed in the Offline Files cache when a folder is redirected to a new location. + +If you enable this policy setting, when the path to a redirected folder is changed from one network location to another and Folder Redirection is configured to move the content to the new location, instead of copying the content to the new location, the cached content is renamed in the local cache and not copied to the new location. To use this policy setting, you must move or restore the server content to the new network location using a method that preserves the state of the files, including their timestamps, before updating the Folder Redirection location. + +If you disable or do not configure this policy setting, when the path to a redirected folder is changed and Folder Redirection is configured to move the content to the new location, Windows copies the contents of the local cache to the new network location, then deleted the content from the old network location. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable optimized move of contents in Offline Files cache on Folder Redirection server path change* +- GP name: *FolderRedirectionEnableCacheRename* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
          + + +**ADMX_FolderRedirection/LocalizeXPRelativePaths_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively. + +If you enable this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +If you disable or not configure this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +> [!NOTE] +> This policy is valid only on Windows Vista, Windows 7, Windows 8, and Windows Server 2012 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use localized subfolder names when redirecting Start Menu and My Documents* +- GP name: *LocalizeXPRelativePaths_1* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
          + + +**ADMX_FolderRedirection/LocalizeXPRelativePaths_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively. + +If you enable this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +If you disable or not configure this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +> [!NOTE] +> This policy is valid only on Windows Vista, Windows 7, Windows 8, and Windows Server 2012 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use localized subfolder names when redirecting Start Menu and My Documents* +- GP name: *LocalizeXPRelativePaths_2* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
          + + +**ADMX_FolderRedirection/PrimaryComputer_FR_1** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether folders are redirected on a user's primary computers only. This policy setting is useful to improve logon performance and to increase security for user data on computers where the user might not want to download private data, such as on a meeting room computer or on a computer in a remote office. + +To designate a user's primary computers, an administrator must use management software or a script to add primary computer attributes to the user's account in Active Directory Domain Services (AD DS). This policy setting also requires the Windows Server 2012 version of the Active Directory schema to function. + +If you enable this policy setting and the user has redirected folders, such as the Documents and Pictures folders, the folders are redirected on the user's primary computer only. + +If you disable or do not configure this policy setting and the user has redirected folders, the folders are redirected on every computer that the user logs on to. + +> [!NOTE] +> If you enable this policy setting in Computer Configuration and User Configuration, the Computer Configuration policy setting takes precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Redirect folders on primary computers only* +- GP name: *PrimaryComputer_FR_1* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
          + + +**ADMX_FolderRedirection/PrimaryComputer_FR_2** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether folders are redirected on a user's primary computers only. This policy setting is useful to improve logon performance and to increase security for user data on computers where the user might not want to download private data, such as on a meeting room computer or on a computer in a remote office. + +To designate a user's primary computers, an administrator must use management software or a script to add primary computer attributes to the user's account in Active Directory Domain Services (AD DS). This policy setting also requires the Windows Server 2012 version of the Active Directory schema to function. + +If you enable this policy setting and the user has redirected folders, such as the Documents and Pictures folders, the folders are redirected on the user's primary computer only. + +If you disable or do not configure this policy setting and the user has redirected folders, the folders are redirected on every computer that the user logs on to. + +> [!NOTE] +> If you enable this policy setting in Computer Configuration and User Configuration, the Computer Configuration policy setting takes precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Redirect folders on primary computers only* +- GP name: *PrimaryComputer_FR_2* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md new file mode 100644 index 0000000000..d705d091a0 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -0,0 +1,355 @@ +--- +title: Policy CSP - ADMX_Help +description: Policy CSP - ADMX_Help +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/03/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Help +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Help policies + +
          +
          + ADMX_Help/DisableHHDEP +
          +
          + ADMX_Help/HelpQualifiedRootDir_Comp +
          +
          + ADMX_Help/RestrictRunFromHelp +
          +
          + ADMX_Help/RestrictRunFromHelp_Comp +
          +
          + + +
          + + +**ADMX_Help/DisableHHDEP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to exclude HTML Help Executable from being monitored by software-enforced Data Execution Prevention. + +Data Execution Prevention (DEP) is designed to block malicious code that takes advantage of exception-handling mechanisms in Windows by monitoring your programs to make sure that they use system memory safely. + +If you enable this policy setting, DEP for HTML Help Executable is turned off. This will allow certain legacy ActiveX controls to function without DEP shutting down HTML Help Executable. + +If you disable or do not configure this policy setting, DEP is turned on for HTML Help Executable. This provides an additional security benefit, but HTML Help stops if DEP detects system memory abnormalities. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Data Execution Prevention for HTML Help Executible* +- GP name: *DisableHHDEP* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
          + + +**ADMX_Help/HelpQualifiedRootDir_Comp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting. + +If you enable this policy setting, the commands function only for .chm files in the specified folders and their subfolders. + +To restrict the commands to one or more folders, enable the policy setting and enter the desired folders in the text box on the Settings tab of the Policy Properties dialog box. Use a semicolon to separate folders. For example, to restrict the commands to only .chm files in the %windir%\help folder and D:\somefolder, add the following string to the edit box: "%windir%\help;D:\somefolder". + +> [!NOTE] +> An environment variable may be used, (for example, %windir%), as long as it is defined on the system. For example, %programfiles% is not defined on some early versions of Windows. + +The "Shortcut" command is used to add a link to a Help topic, and runs executables that are external to the Help file. The "WinHelp" command is used to add a link to a Help topic, and runs a WinHLP32.exe Help (.hlp) file. + +To disallow the "Shortcut" and "WinHelp" commands on the entire local system, enable the policy setting and leave the text box on the Settings tab of the Policy Properties dialog box blank. + +If you disable or do not configure this policy setting, these commands are fully functional for all Help files. + +> [!NOTE] +> Only folders on the local computer can be specified in this policy setting. You cannot use this policy setting to enable the "Shortcut" and "WinHelp" commands for .chm files that are stored on mapped drives or accessed using UNC paths. + +For additional options, see the "Restrict these programs from being launched from Help" policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict potentially unsafe HTML Help functions to specified folders* +- GP name: *HelpQualifiedRootDir_Comp* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
          + + +**ADMX_Help/RestrictRunFromHelp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to restrict programs from being run from online Help. + +If you enable this policy setting, you can prevent specified programs from being run from Help. When you enable this policy setting, enter the file names names of the programs you want to restrict, separated by commas. + +If you disable or do not configure this policy setting, users can run all applications from online Help. + +> [!NOTE] +> You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. +> +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict these programs from being launched from Help* +- GP name: *RestrictRunFromHelp* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
          + + +**ADMX_Help/RestrictRunFromHelp_Comp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to restrict programs from being run from online Help. + +If you enable this policy setting, you can prevent specified programs from being run from Help. When you enable this policy setting, enter the file names names of the programs you want to restrict, separated by commas. + +If you disable or do not configure this policy setting, users can run all applications from online Help. + +> [!NOTE] +> You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. +> +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict these programs from being launched from Help* +- GP name: *RestrictRunFromHelp_Comp* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md new file mode 100644 index 0000000000..10d08651fc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md @@ -0,0 +1,331 @@ +--- +title: Policy CSP - ADMX_HelpAndSupport +description: Policy CSP - ADMX_HelpAndSupport +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/03/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_HelpAndSupport +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_HelpAndSupport policies + +
          +
          + ADMX_HelpAndSupport/ActiveHelp +
          +
          + ADMX_HelpAndSupport/HPExplicitFeedback +
          +
          + ADMX_HelpAndSupport/HPImplicitFeedback +
          +
          + ADMX_HelpAndSupport/HPOnlineAssistance +
          +
          + + +
          + + +**ADMX_HelpAndSupport/ActiveHelp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links. + +If you enable this policy setting, active content links are not rendered. The text is displayed, but there are no clickable links for these elements. + +If you disable or do not configure this policy setting, the default behavior applies (Help viewer renders trusted assistance content with active elements). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Active Help* +- GP name: *ActiveHelp* +- GP path: *Windows Components/Online Assistance* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
          + + +**ADMX_HelpAndSupport/HPExplicitFeedback** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether users can provide ratings for Help content. + +If you enable this policy setting, ratings controls are not added to Help content. + +If you disable or do not configure this policy setting, ratings controls are added to Help topics. + +Users can use the control to provide feedback on the quality and usefulness of the Help and Support content. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help Ratings* +- GP name: *HPExplicitFeedback* +- GP path: *System/Internet Communication Management/Internet Communication settings* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
          + + +**ADMX_HelpAndSupport/HPImplicitFeedback** + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether users can participate in the Help Experience Improvement program. The Help Experience Improvement program collects information about how customers use Windows Help so that Microsoft can improve it. + +If you enable this policy setting, users cannot participate in the Help Experience Improvement program. + +If you disable or do not configure this policy setting, users can turn on the Help Experience Improvement program feature from the Help and Support settings page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help Experience Improvement Program* +- GP name: *HPImplicitFeedback* +- GP path: *System/Internet Communication Management/Internet Communication settings* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
          + + +**ADMX_HelpAndSupport/HPOnlineAssistance** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether users can search and view content from Windows Online in Help and Support. Windows Online provides the most up-to-date Help content for Windows. + +If you enable this policy setting, users are prevented from accessing online assistance content from Windows Online. + +If you disable or do not configure this policy setting, users can access online assistance if they have a connection to the Internet and have not disabled Windows Online from the Help and Support Options page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Online* +- GP name: *HPOnlineAssistance* +- GP path: *System/Internet Communication Management/Internet Communication settings* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md new file mode 100644 index 0000000000..4a63715208 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -0,0 +1,517 @@ +--- +title: Policy CSP - ADMX_kdc +description: Policy CSP - ADMX_kdc +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_kdc +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_kdc policies + +
          +
          + ADMX_kdc/CbacAndArmor +
          +
          + ADMX_kdc/ForestSearch +
          +
          + ADMX_kdc/PKINITFreshness +
          +
          + ADMX_kdc/RequestCompoundId +
          +
          + ADMX_kdc/TicketSizeThreshold +
          +
          + ADMX_kdc/emitlili +
          +
          + + +
          + + +**ADMX_kdc/CbacAndArmor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure a domain controller to support claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication. + +If you enable this policy setting, client computers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware will use this feature for Kerberos authentication messages. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. + +If you disable or do not configure this policy setting, the domain controller does not support claims, compound authentication or armoring. + +If you configure the "Not supported" option, the domain controller does not support claims, compound authentication or armoring which is the default behavior for domain controllers running Windows Server 2008 R2 or earlier operating systems. + +> [!NOTE] +> For the following options of this KDC policy to be effective, the Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must be enabled on supported systems. If the Kerberos policy setting is not enabled, Kerberos authentication messages will not use these features. + +If you configure "Supported", the domain controller supports claims, compound authentication and Kerberos armoring. The domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring. + +**Domain functional level requirements** + +For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the "Supported" option is selected. + +When the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and: + +- If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST). +- If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages. + +> [!WARNING] +> When "Fail unarmored authentication requests" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller. + +To ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the "Supported" option is enabled). + +Impact on domain controller performance when this policy setting is enabled: + +- Secure Kerberos domain capability discovery is required resulting in additional message exchanges. +- Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size. +- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *KDC support for claims, compound authentication and Kerberos armoring* +- GP name: *CbacAndArmor* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
          + + +**ADMX_kdc/ForestSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs). + +If you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a global catalog or name suffix hints. If a match is found, the KDC will return a referral ticket to the client for the appropriate domain. + +If you disable or do not configure this policy setting, the KDC will not search the listed forests to resolve the SPN. If the KDC is unable to resolve the SPN because the name is not found, NTLM authentication might be used. + +To ensure consistent behavior, this policy setting must be supported and set identically on all domain controllers in the domain. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use forest search order* +- GP name: *ForestSearch* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
          + + +**ADMX_kdc/PKINITFreshness** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Support for PKInit Freshness Extension requires Windows Server 2016 domain functional level (DFL). If the domain controller’s domain is not at Windows Server 2016 DFL or higher this policy will not be applied. + +This policy setting allows you to configure a domain controller (DC) to support the PKInit Freshness Extension. + +If you enable this policy setting, the following options are supported: + +Supported: PKInit Freshness Extension is supported on request. Kerberos clients successfully authenticating with the PKInit Freshness Extension will get the fresh public key identity SID. + +Required: PKInit Freshness Extension is required for successful authentication. Kerberos clients which do not support the PKInit Freshness Extension will always fail when using public key credentials. + +If you disable or not configure this policy setting, then the DC will never offer the PKInit Freshness Extension and accept valid authentication requests without checking for freshness. Users will never receive the fresh public key identity SID. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *KDC support for PKInit Freshness Extension* +- GP name: *PKINITFreshness* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
          + + +**ADMX_kdc/RequestCompoundId** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure a domain controller to request compound authentication. + +> [!NOTE] +> For a domain controller to request compound authentication, the policy "KDC support for claims, compound authentication, and Kerberos armoring" must be configured and enabled. + +If you enable this policy setting, domain controllers will request compound authentication. The returned service ticket will contain compound authentication only when the account is explicitly configured. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. + +If you disable or do not configure this policy setting, domain controllers will return service tickets that contain compound authentication any time the client sends a compound authentication request regardless of the account configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Request compound authentication* +- GP name: *RequestCompoundId* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
          + + +**ADMX_kdc/TicketSizeThreshold** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure at what size Kerberos tickets will trigger the warning event issued during Kerberos authentication. The ticket size warnings are logged in the System log. + +If you enable this policy setting, you can set the threshold limit for Kerberos ticket which trigger the warning events. If set too high, then authentication failures might be occurring even though warning events are not being logged. If set too low, then there will be too many ticket warnings in the log to be useful for analysis. This value should be set to the same value as the Kerberos policy "Set maximum Kerberos SSPI context token buffer size" or the smallest MaxTokenSize used in your environment if you are not configuring using Group Policy. + +If you disable or do not configure this policy setting, the threshold value defaults to 12,000 bytes, which is the default Kerberos MaxTokenSize for Windows 7, Windows Server 2008 R2 and prior versions. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Warning for large Kerberos tickets* +- GP name: *TicketSizeThreshold* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
          + + +**ADMX_kdc/emitlili** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether the domain controller provides information about previous logons to client computers. + +If you enable this policy setting, the domain controller provides the information message about previous logons. + +For Windows Logon to leverage this feature, the "Display information about previous logons during user logon" policy setting located in the Windows Logon Options node under Windows Components also needs to be enabled. + +If you disable or do not configure this policy setting, the domain controller does not provide information about previous logons unless the "Display information about previous logons during user logon" policy setting is enabled. + +> [!NOTE] +> Information about previous logons is provided only if the domain functional level is Windows Server 2008. In domains with a domain functional level of Windows Server 2003, Windows 2000 native, or Windows 2000 mixed, domain controllers cannot provide information about previous logons, and enabling this policy setting does not affect anything. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Provide information about previous logons to client computers* +- GP name: *emitlili* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md new file mode 100644 index 0000000000..594a97bf72 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -0,0 +1,641 @@ +--- +title: Policy CSP - ADMX_Kerberos +description: Policy CSP - ADMX_Kerberos +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Kerberos +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Kerberos policies + +
          +
          + ADMX_Kerberos/AlwaysSendCompoundId +
          +
          + ADMX_Kerberos/DevicePKInitEnabled +
          +
          + ADMX_Kerberos/HostToRealm +
          +
          + ADMX_Kerberos/KdcProxyDisableServerRevocationCheck +
          +
          + ADMX_Kerberos/KdcProxyServer +
          +
          + ADMX_Kerberos/MitRealms +
          +
          + ADMX_Kerberos/ServerAcceptsCompound +
          +
          + ADMX_Kerberos/StrictTarget +
          +
          + + +
          + + +**ADMX_Kerberos/AlwaysSendCompoundId** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether a device always sends a compound authentication request when the resource domain requests compound identity. + +> [!NOTE] +> For a domain controller to request compound authentication, the policies "KDC support for claims, compound authentication, and Kerberos armoring" and "Request compound authentication" must be configured and enabled in the resource account domain. + +If you enable this policy setting and the resource domain requests compound authentication, devices that support compound authentication always send a compound authentication request. + +If you disable or do not configure this policy setting and the resource domain requests compound authentication, devices will send a non-compounded authentication request first then a compound authentication request when the service requests compound authentication. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always send compound authentication first* +- GP name: *AlwaysSendCompoundId* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + + +**ADMX_Kerberos/DevicePKInitEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts. + +This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain. + +If you enable this policy setting, the device's credentials will be selected based on the following options: + +- Automatic: Device will attempt to authenticate using its certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted. +- Force: Device will always authenticate using its certificate. If a DC cannot be found which support computer account authentication using certificates then authentication will fail. + +If you disable this policy setting, certificates will never be used. + +If you do not configure this policy setting, Automatic will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support device authentication using certificate* +- GP name: *DevicePKInitEnabled* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + + +**ADMX_Kerberos/HostToRealm** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm. + +If you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted. + +If you do not configure this policy setting, the system uses the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define host name-to-Kerberos realm mappings* +- GP name: *HostToRealm* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + + +**ADMX_Kerberos/KdcProxyDisableServerRevocationCheck** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server. + +If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections. +Warning: When revocation check is ignored, the server represented by the certificate is not guaranteed valid. + +If you disable or do not configure this policy setting, the Kerberos client enforces the revocation check for the SSL certificate. The connection to the KDC proxy server is not established if the revocation check fails. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable revocation checking for the SSL certificate of KDC proxy servers* +- GP name: *KdcProxyDisableServerRevocationCheck* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + + +**ADMX_Kerberos/KdcProxyServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the Kerberos client's mapping to KDC proxy servers for domains based on their DNS suffix names. + +If you enable this policy setting, the Kerberos client will use the KDC proxy server for a domain when a domain controller cannot be located based on the configured mappings. To map a KDC proxy server to a domain, enable the policy setting, click Show, and then map the KDC proxy server name(s) to the DNS name for the domain using the syntax described in the options pane. In the Show Contents dialog box in the Value Name column, type a DNS suffix name. In the Value column, type the list of proxy servers using the appropriate syntax format. To view the list of mappings, enable the policy setting and then click the Show button. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable or do not configure this policy setting, the Kerberos client does not have KDC proxy servers settings defined by Group Policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify KDC proxy servers for Kerberos clients* +- GP name: *KdcProxyServer* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + + +**ADMX_Kerberos/MitRealms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting. + +If you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted. + +If you do not configure this policy setting, the system uses the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define interoperable Kerberos V5 realm settings* +- GP name: *MitRealms* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + + +**ADMX_Kerberos/ServerAcceptsCompound** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls configuring the device's Active Directory account for compound authentication. + +Support for providing compound authentication which is used for access control will require enough domain controllers in the resource account domains to support the requests. The Domain Administrator must configure the policy "Support Dynamic Access Control and Kerberos armoring" on all the domain controllers to support this policy. + +If you enable this policy setting, the device's Active Directory account will be configured for compound authentication by the following options: + +- Never: Compound authentication is never provided for this computer account. +- Automatic: Compound authentication is provided for this computer account when one or more applications are configured for Dynamic Access Control. +- Always: Compound authentication is always provided for this computer account. + +If you disable this policy setting, Never will be used. + +If you do not configure this policy setting, Automatic will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support compound authentication* +- GP name: *ServerAcceptsCompound* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + + +**ADMX_Kerberos/StrictTarget** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure this server so that Kerberos can decrypt a ticket that contains this system-generated SPN. When an application attempts to make a remote procedure call (RPC) to this server with a NULL value for the service principal name (SPN), computers running Windows 7 or later attempt to use Kerberos by generating an SPN. + +If you enable this policy setting, only services running as LocalSystem or NetworkService are allowed to accept these connections. Services running as identities different from LocalSystem or NetworkService might fail to authenticate. + +If you disable or do not configure this policy setting, any service is allowed to accept incoming connections by using this system-generated SPN. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require strict target SPN match on remote procedure calls* +- GP name: *StrictTarget* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md new file mode 100644 index 0000000000..ddaddd01f1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md @@ -0,0 +1,381 @@ +--- +title: Policy CSP - ADMX_LanmanServer +description: Policy CSP - ADMX_LanmanServer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_LanmanServer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_LanmanServer policies + +
          +
          + ADMX_LanmanServer/Pol_CipherSuiteOrder +
          +
          + ADMX_LanmanServer/Pol_HashPublication +
          +
          + ADMX_LanmanServer/Pol_HashSupportVersion +
          +
          + ADMX_LanmanServer/Pol_HonorCipherSuiteOrder +
          +
          + + +
          + + +**ADMX_LanmanServer/Pol_CipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the cipher suites used by the SMB server. + +If you enable this policy setting, cipher suites are prioritized in the order specified. + +If you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used. + +SMB 3.11 cipher suites: + +- AES_128_GCM +- AES_128_CCM + +SMB 3.0 and 3.02 cipher suites: + +- AES_128_CCM + +**How to modify this setting:** + +Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use. + +> [!NOTE] +> When configuring this security setting, changes will not take effect until you restart Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Cipher suite order* +- GP name: *Pol_CipherSuiteOrder* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
          + + + +
          + + +**ADMX_LanmanServer/Pol_HashPublication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether a hash generation service generates hashes, also called content information, for data that is stored in shared folders. This policy setting must be applied to server computers that have the File Services role and both the File Server and the BranchCache for Network Files role services installed. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, hash publication settings are not applied to file servers. In the circumstance where file servers are domain members but you do not want to enable BranchCache on all file servers, you can specify Not Configured for this domain Group Policy setting, and then configure local machine policy to enable BranchCache on individual file servers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual servers where you want to enable BranchCache. +- Enabled. With this selection, hash publication is turned on for all file servers where Group Policy is applied. For example, if Hash Publication for BranchCache is enabled in domain Group Policy, hash publication is turned on for all domain member file servers to which the policy is applied. The file servers are then able to create content information for all content that is stored in BranchCache-enabled file shares. +- Disabled. With this selection, hash publication is turned off for all file servers where Group Policy is applied. + +In circumstances where this policy setting is enabled, you can also select the following configuration options: + +- Allow hash publication for all shared folders. With this option, BranchCache generates content information for all content in all shares on the file server. +- Allow hash publication only for shared folders on which BranchCache is enabled. With this option, content information is generated only for shared folders on which BranchCache is enabled. If you use this setting, you must enable BranchCache for individual shares in Share and Storage Management on the file server. +- Disallow hash publication on all shared folders. With this option, BranchCache does not generate content information for any shares on the computer and does not send content information to client computers that request content. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hash Publication for BranchCache* +- GP name: *Pol_HashPublication* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
          + + + +
          + + +**ADMX_LanmanServer/Pol_HashSupportVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the BranchCache hash generation service supports version 1 (V1) hashes, version 2 (V2) hashes, or both V1 and V2 hashes. Hashes, also called content information, are created based on the data in shared folders where BranchCache is enabled. + +If you specify only one version that is supported, content information for that version is the only type that is generated by BranchCache, and it is the only type of content information that can be retrieved by client computers. For example, if you enable support for V1 hashes, BranchCache generates only V1 hashes and client computers can retrieve only V1 hashes. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting. In this circumstance, which is the default, both V1 and V2 hash generation and retrieval are supported. +- Enabled. With this selection, the policy setting is applied and the hash version(s) that are specified in "Hash version supported" are generated and retrieved. +- Disabled. With this selection, both V1 and V2 hash generation and retrieval are supported. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +Hash version supported: + +- To support V1 content information only, configure "Hash version supported" with the value of 1. +- To support V2 content information only, configure "Hash version supported" with the value of 2. +- To support both V1 and V2 content information, configure "Hash version supported" with the value of 3. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hash Version support for BranchCache* +- GP name: *Pol_HashSupportVersion* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
          + + +**ADMX_LanmanServer/Pol_HonorCipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how the SMB server selects a cipher suite when negotiating a new connection with an SMB client. + +If you enable this policy setting, the SMB server will select the cipher suite it most prefers from the list of client-supported cipher suites, ignoring the client's preferences. + +If you disable or do not configure this policy setting, the SMB server will select the cipher suite the client most prefers from the list of server-supported cipher suites. + +> [!NOTE] +> When configuring this security setting, changes will not take effect until you restart Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Honor cipher suite order* +- GP name: *Pol_HonorCipherSuiteOrder* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md new file mode 100644 index 0000000000..d4f25831ab --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md @@ -0,0 +1,190 @@ +--- +title: Policy CSP - ADMX_LinkLayerTopologyDiscovery +description: Policy CSP - ADMX_LinkLayerTopologyDiscovery +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/04/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_LinkLayerTopologyDiscovery +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_LinkLayerTopologyDiscovery policies + +
          +
          + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO +
          +
          + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr +
          +
          + + +
          + + +**ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting changes the operational behavior of the Mapper I/O network protocol driver. + +LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Service requests such as bandwidth estimation and network health analysis. + +If you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow LLTDIO to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead. + +If you disable or do not configure this policy setting, the default behavior of LLTDIO will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Mapper I/O (LLTDIO) driver* +- GP name: *LLTD_EnableLLTDIO* +- GP path: *Network/Link-Layer Topology Discovery* +- GP ADMX file name: *LinkLayerTopologyDiscovery.admx* + + + +
          + + +**ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting changes the operational behavior of the Responder network protocol driver. + +The Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis. + +If you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow the Responder to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead. + +If you disable or do not configure this policy setting, the default behavior for the Responder will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Responder (RSPNDR) driver* +- GP name: *LLTD_EnableRspndr* +- GP path: *Network/Link-Layer Topology Discovery* +- GP ADMX file name: *LinkLayerTopologyDiscovery.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md new file mode 100644 index 0000000000..5862dadff7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -0,0 +1,6852 @@ +--- +title: Policy CSP - ADMX_MicrosoftDefenderAntivirus +description: Policy CSP - ADMX_MicrosoftDefenderAntivirus +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MicrosoftDefenderAntivirus +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_MicrosoftDefenderAntivirus policies + +
          +
          + ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction +
          +
          + ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions +
          +
          + ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths +
          +
          + ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications +
          +
          + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders +
          +
          + ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation +
          +
          + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement +
          +
          + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid +
          +
          + ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition +
          +
          + ADMX_MicrosoftDefenderAntivirus/ProxyBypass +
          +
          + ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl +
          +
          + ADMX_MicrosoftDefenderAntivirus/ProxyServer +
          +
          + ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay +
          +
          + ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring +
          +
          + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection +
          +
          + ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents +
          +
          + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval +
          +
          + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup +
          +
          + ADMX_MicrosoftDefenderAntivirus/SpynetReporting +
          +
          + ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting +
          +
          + ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification +
          +
          + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown +
          +
          + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Microsoft Defender Antivirus. + +If you enable this policy setting, Microsoft Defender Antivirus does not run, and will not scan computers for malware or other potentially unwanted software. + +If you disable this policy setting, Microsoft Defender Antivirus will run regardless of any other installed antivirus product. + +If you do not configure this policy setting, Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program, Windows automatically disables Microsoft Defender Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers for malware and other potentially unwanted software. + +Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Microsoft Defender Antivirus* +- GP name: *DisableAntiSpywareDefender* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off. + +Disabled (Default): +Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance. + +Enabled: +Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios. + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Auto Exclusions* +- GP name: *DisableAutoExclusions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. + +Enabled – The Block at First Sight setting is turned on. +Disabled – The Block at First Sight setting is turned off. + +This feature requires these Group Policy settings to be set as follows: + +- MAPS -> The “Join Microsoft MAPS” must be enabled or the “Block at First Sight” feature will not function. +- MAPS -> The “Send file samples when further analysis is required” should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the “Block at First Sight” feature will not function. +- Real-time Protection -> The “Scan all downloaded files and attachments” policy must be enabled or the “Block at First Sight” feature will not function. +- Real-time Protection -> Do not enable the “Turn off real-time protection” policy or the “Block at First Sight” feature will not function. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the 'Block at First Sight' feature* +- GP name: *DisableBlockAtFirstSeen* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not complex list settings configured by a local administrator are merged with Group Policy settings. This setting applies to lists such as threats and Exclusions. + +If you enable or do not configure this setting, unique items defined in Group Policy and in preference settings configured by the local administrator will be merged into the resulting effective policy. In the case of conflicts, Group policy Settings will override preference settings. + +If you disable this setting, only items defined by Group Policy will be used in the resulting effective policy. Group Policy settings will override preference settings configured by the local administrator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local administrator merge behavior for lists* +- GP name: *DisableLocalAdminMerge* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off real-time protection prompts for known malware detection. + +Microsoft Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. + +If you enable this policy setting, Microsoft Defender Antivirus will not prompt users to take actions on malware detections. + +If you disable or do not configure this policy setting, Microsoft Defender Antivirus will prompt users to take actions on malware detections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off real-time protection* +- GP name: *DisableRealtimeMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether Microsoft Defender Antivirus automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action, user-defined action, and the signature-defined action. + +If you enable this policy setting, Microsoft Defender Antivirus does not automatically take action on the detected threats, but prompts users to choose from the actions available for each threat. + +If you disable or do not configure this policy setting, Microsoft Defender Antivirus automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off routine remediation* +- GP name: *DisableRoutinelyTakingAction* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Extension Exclusions* +- GP name: *Exclusions_Extensions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. + +As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Path Exclusions* +- GP name: *Exclusions_Paths* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Process Exclusions* +- GP name: *Exclusions_Processes* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Exclude files and paths from Attack Surface Reduction (ASR) rules. + +Enabled: +Specify the folders or files and resources that should be excluded from ASR rules in the Options section. +Enter each rule on a new line as a name-value pair: + +- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder +- Value column: Enter "0" for each item + +Disabled: +No exclusions will be applied to the ASR rules. + +Not configured: +Same as Disabled. + +You can configure ASR rules in the Configure Attack Surface Reduction rules GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Exclude files and paths from Attack Surface Reduction Rules* +- GP name: *ExploitGuard_ASR_ASROnlyExclusions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Set the state for each Attack Surface Reduction (ASR) rule. + +After enabling this setting, you can set each rule to the following in the Options section: + +- Block: the rule will be applied +- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) +- Off: the rule will not be applied + +Enabled: +Specify the state for each ASR rule under the Options section for this setting. +Enter each rule on a new line as a name-value pair: + +- Name column: Enter a valid ASR rule ID +- Value column: Enter the status ID that relates to state you want to specify for the associated rule + +The following status IDs are permitted under the value column: +- 1 (Block) +- 0 (Off) +- 2 (Audit) + +Example: +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2 + +Disabled: +No ASR rules will be configured. + +Not configured: +Same as Disabled. + +You can exclude folders or files in the "Exclude files and paths from Attack Surface Reduction Rules" GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Attack Surface Reduction rules* +- GP name: *ExploitGuard_ASR_Rules* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Add additional applications that should be considered "trusted" by controlled folder access. + +These applications are allowed to modify or delete files in controlled folder access folders. + +Microsoft Defender Antivirus automatically determines which applications should be trusted. You can configure this setting to add additional applications. + +Enabled: +Specify additional allowed applications in the Options section.. + +Disabled: +No additional applications will be added to the trusted list. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Default system folders are automatically guarded, but you can add folders in the configure protected folders GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure allowed applications* +- GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Specify additional folders that should be guarded by the Controlled folder access feature. + +Files in these folders cannot be modified or deleted by untrusted applications. + +Default system folders are automatically protected. You can configure this setting to add additional folders. +The list of default system folders that are protected is shown in Windows Security. + +Enabled: +Specify additional folders that should be protected in the Options section. + +Disabled: +No additional folders will be protected. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure protected folders* +- GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Enable or disable file hash computation feature. + +Enabled: +When this feature is enabled Microsoft Defender will compute hash value for files it scans. + +Disabled: +File hash value is not computed + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable file hash computation feature* +- GP name: *MpEngine_EnableFileHashComputation* +- GP path: *Windows Components\Microsoft Defender Antivirus\MpEngine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system is not vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocol are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection will have no impact on network performance. + +If you enable or do not configure this setting, definition retirement will be enabled. + +If you disable this setting, definition retirement will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on definition retirement* +- GP name: *Nis_Consumers_IPS_DisableSignatureRetirement* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines additional definition sets to enable for network traffic inspection. Definition set GUIDs should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a definition set GUID. As an example, the definition set GUID to enable test security intelligence is defined as: “{b54b6ac9-a737-498e-9120-6616ad3bf590}”. The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify additional definition sets for network traffic inspection* +- GP name: *Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure protocol recognition for network protection against exploits of known vulnerabilities. + +If you enable or do not configure this setting, protocol recognition will be enabled. + +If you disable this setting, protocol recognition will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on protocol recognition* +- GP name: *Nis_DisableProtocolRecognition* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ProxyBypass** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy, if defined, will prevent antimalware from using the configured proxy server when communicating with the specified IP addresses. The address value should be entered as a valid URL. + +If you enable this setting, the proxy server will be bypassed for the specified addresses. + +If you disable or do not configure this setting, the proxy server will not be bypassed for the specified addresses. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define addresses to bypass proxy server* +- GP name: *ProxyBypass* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the URL of a proxy .pac file that should be used when the client attempts to connect the network for security intelligence updates and MAPS reporting. If the proxy auto-config fails or if there is no proxy auto-config specified, the client will fall back to the alternative options (in order): + +1. Proxy server (if specified) +2. Proxy .pac URL (if specified) +3. None +4. Internet Explorer proxy settings +5. Autodetect + +If you enable this setting, the proxy setting will be set to use the specified proxy .pac according to the order specified above. + +If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define proxy auto-config (.pac) for connecting to the network* +- GP name: *ProxyPacUrl* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ProxyServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the named proxy that should be used when the client attempts to connect to the network for security intelligence updates and MAPS reporting. If the named proxy fails or if there is no proxy specified, the client will fall back to the alternative options (in order): + +1. Proxy server (if specified) +2. Proxy .pac URL (if specified) +3. None +4. Internet Explorer proxy settings +5. Autodetect + +If you enable this setting, the proxy will be set to the specified URL according to the order specified above. The URL should be proceeded with either http:// or https://. + +If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define proxy server for connecting to the network* +- GP name: *ProxyServer* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the number of days items should be kept in the Quarantine folder before being removed. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for the removal of items from Quarantine folder* +- GP name: *Quarantine_LocalSettingOverridePurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Quarantine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the number of days items should be kept in the Quarantine folder before being removed. + +If you enable this setting, items will be removed from the Quarantine folder after the number of days specified. + +If you disable or do not configure this setting, items will be kept in the quarantine folder indefinitely and will not be automatically removed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure removal of items from Quarantine folder* +- GP name: *Quarantine_PurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Quarantine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled security intelligence update start time. This setting is used to distribute the resource impact of scanning. For example, it could be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time. + +If you enable or do not configure this setting, scheduled tasks will begin at a random time within an interval of 30 minutes before and after the specified start time. + +If you disable this setting, scheduled tasks will begin at the specified start time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Randomize scheduled task times* +- GP name: *RandomizeScheduleTaskTimes* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure behavior monitoring. + +If you enable or do not configure this setting, behavior monitoring will be enabled. + +If you disable this setting, behavior monitoring will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on behavior monitoring* +- GP name: *RealtimeProtection_DisableBehaviorMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for all downloaded files and attachments. + +If you enable or do not configure this setting, scanning for all downloaded files and attachments will be enabled. + +If you disable this setting, scanning for all downloaded files and attachments will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan all downloaded files and attachments* +- GP name: *RealtimeProtection_DisableIOAVProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure monitoring for file and program activity. + +If you enable or do not configure this setting, monitoring for file and program activity will be enabled. + +If you disable this setting, monitoring for file and program activity will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Monitor file and program activity on your computer* +- GP name: *RealtimeProtection_DisableOnAccessProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether raw volume write notifications are sent to behavior monitoring. + +If you enable or do not configure this setting, raw write notifications will be enabled. + +If you disable this setting, raw write notifications be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on raw volume write notifications* +- GP name: *RealtimeProtection_DisableRawWriteNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. + +If you enable or do not configure this setting, a process scan will be initiated when real-time protection is turned on. + +If you disable this setting, a process scan will not be initiated when real-time protection is turned on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on process scanning whenever real-time protection is enabled* +- GP name: *RealtimeProtection_DisableScanOnRealtimeEnable* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the maximum size (in kilobytes) of downloaded files and attachments that will be scanned. + +If you enable this setting, downloaded files and attachments smaller than the size specified will be scanned. + +If you disable or do not configure this setting, a default size will be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the maximum size of downloaded files and attachments to be scanned* +- GP name: *RealtimeProtection_IOAVMaxSize* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for turn on behavior monitoring* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scanning all downloaded files and attachments* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableIOAVProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for monitoring file and program activity on your computer* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override to turn on real-time protection* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for monitoring for incoming and outgoing file activity* +- GP name: *RealtimeProtection_LocalSettingOverrideRealtimeScanDirection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the time to run a scheduled full scan to complete remediation. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for the time of day to run a scheduled full scan to complete remediation* +- GP name: *Remediation_LocalSettingOverrideScan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to perform a scheduled full scan in order to complete remediation. The scan can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never (default) + +If you enable this setting, a scheduled full scan to complete remediation will run at the frequency specified. + +If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to run a scheduled full scan to complete remediation* +- GP name: *Remediation_Scan_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a scheduled full scan in order to complete remediation. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a scheduled full scan to complete remediation will run at the time of day specified. + +If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time of day to run a scheduled full scan to complete remediation* +- GP name: *Remediation_Scan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "additional action" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections requiring additional action* +- GP name: *Reporting_AdditionalActionTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the “critically failed” state to moves to either the “additional action” state or the “cleared” state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in critically failed state* +- GP name: *Reporting_CriticalFailureTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Use this policy setting to specify if you want Microsoft Defender Antivirus enhanced notifications to display on clients. + +If you disable or do not configure this setting, Microsoft Defender Antivirus enhanced notifications will display on clients. + +If you enable this setting, Microsoft Defender Antivirus enhanced notifications will not display on clients. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off enhanced notifications* +- GP name: *Reporting_DisableEnhancedNotifications* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + +**ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not Watson events are sent. + +If you enable or do not configure this setting, Watson events will be sent. + +If you disable this setting, Watson events will not be sent. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Watson events* +- GP name: *Reporting_DisablegenericrePorts* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "non-critically failed" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in non-critical failed state* +- GP name: *Reporting_NonCriticalTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + +**ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "completed" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in recently remediated state* +- GP name: *Reporting_RecentlyCleanedTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy configures Windows software trace preprocessor (WPP Software Tracing) components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Windows software trace preprocessor components* +- GP name: *Reporting_WppTracingComponents* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy allows you to configure tracing levels for Windows software trace preprocessor (WPP Software Tracing). + +Tracing levels are defined as: + +- 1 - Error +- 2 - Warning +- 3 - Info +- 4 - Debug + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure WPP tracing level* +- GP name: *Reporting_WppTracingLevel* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether or not end users can pause a scan in progress. + +If you enable or do not configure this setting, a new context menu will be added to the task tray icon to allow the user to pause a scan. + +If you disable this setting, users will not be able to pause scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to pause scan* +- GP name: *Scan_AllowPause* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. The default directory depth level is 0. + +If you enable this setting, archive files will be scanned to the directory depth level specified. + +If you disable or do not configure this setting, archive files will be scanned to the default directory depth level. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum depth to scan archive files* +- GP name: *Scan_ArchiveMaxDepth* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that will be scanned. The value represents file size in kilobytes (KB). The default value is 0 and represents no limit to archive size for scanning. + +If you enable this setting, archive files less than or equal to the size specified will be scanned. + +If you disable or do not configure this setting, archive files will be scanned according to the default value. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum size of archive files to be scanned* +- GP name: *Scan_ArchiveMaxSize* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. + +If you enable or do not configure this setting, archive files will be scanned. + +If you disable this setting, archive files will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan archive files* +- GP name: *Scan_DisableArchiveScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac). + +If you enable this setting, e-mail scanning will be enabled. + +If you disable or do not configure this setting, e-mail scanning will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on e-mail scanning* +- GP name: *Scan_DisableEmailScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure heuristics. Suspicious detections will be suppressed right before reporting to the engine client. Turning off heuristics will reduce the capability to flag new threats. It is recommended that you do not turn off heuristics. + +If you enable or do not configure this setting, heuristics will be enabled. + +If you disable this setting, heuristics will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on heuristics* +- GP name: *Scan_DisableHeuristics* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for packed executables. It is recommended that this type of scanning remain enabled. + +If you enable or do not configure this setting, packed executables will be scanned. + +If you disable this setting, packed executables will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan packed executables* +- GP name: *Scan_DisablePackedExeScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan. + +If you enable this setting, removable drives will be scanned during any type of scan. + +If you disable or do not configure this setting, removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan removable drives* +- GP name: *Scan_DisableRemovableDriveScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure reparse point scanning. If you allow reparse points to be scanned, there is a possible risk of recursion. However, the engine supports following reparse points to a maximum depth so at worst scanning could be slowed. Reparse point scanning is disabled by default and this is the recommended state for this functionality. + +If you enable this setting, reparse point scanning will be enabled. + +If you disable or do not configure this setting, reparse point scanning will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on reparse point scanning* +- GP name: *Scan_DisableReparsePointScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to create a system restore point on the computer on a daily basis prior to cleaning. + +If you enable this setting, a system restore point will be created. + +If you disable or do not configure this setting, a system restore point will not be created. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Create a system restore point* +- GP name: *Scan_DisableRestorePoint* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning mapped network drives. + +If you enable this setting, mapped network drives will be scanned. + +If you disable or do not configure this setting, mapped network drives will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run full scan on mapped network drives* +- GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. + +If you enable this setting, network files will be scanned. + +If you disable or do not configure this setting, network files will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan network files* +- GP name: *Scan_DisableScanningNetworkFiles* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of maximum percentage of CPU utilization during scan. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for maximum percentage of CPU utilization* +- GP name: *Scan_LocalSettingOverrideAvgCPULoadFactor* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the scan type to use during a scheduled scan. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for the scan type to use for a scheduled scan* +- GP name: *Scan_LocalSettingOverrideScanParameters* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled scan day. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for schedule scan day* +- GP name: *Scan_LocalSettingOverrideScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled quick scan time. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scheduled quick scan time* +- GP name: *Scan_LocalSettingOverrideScheduleQuickScantime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled scan time. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scheduled scan time* +- GP name: *Scan_LocalSettingOverrideScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable low CPU priority for scheduled scans. + +If you enable this setting, low CPU priority will be used during scheduled scans. + +If you disable or do not configure this setting, not changes will be made to CPU priority for scheduled scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure low CPU priority for scheduled scans* +- GP name: *Scan_LowCpuPriority* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of consecutive scheduled scans that can be missed after which a catch-up scan will be forced. By default, the value of this setting is 2 consecutive scheduled scans. + +If you enable this setting, a catch-up scan will occur after the specified number consecutive missed scheduled scans. + +If you disable or do not configure this setting, a catch-up scan will occur after the 2 consecutive missed scheduled scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days after which a catch-up scan is forced* +- GP name: *Scan_MissedScheduledScanCountBeforeCatchup* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and will not be automatically removed. By default, the value is set to 30 days. + +If you enable this setting, items will be removed from the scan history folder after the number of days specified. + +If you disable or do not configure this setting, items will be kept in the scan history folder for the default number of days. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on removal of items from scan history folder* +- GP name: *Scan_PurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify an interval at which to perform a quick scan. The time value is represented as the number of hours between quick scans. Valid values range from 1 (every hour) to 24 (once per day). If set to zero, interval quick scans will not occur. By default, this setting is set to 0. + +If you enable this setting, a quick scan will run at the interval specified. + +If you disable or do not configure this setting, a quick scan will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the interval to run quick scans per day* +- GP name: *Scan_QuickScanInterval* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scheduled scans to start only when your computer is on but not in use. + +If you enable or do not configure this setting, scheduled scans will only run when the computer is on but not in use. + +If you disable this setting, scheduled scans will run at the scheduled time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Start the scheduled scan only when computer is on but not in use* +- GP name: *Scan_ScanOnlyIfIdle* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never (default) + +If you enable this setting, a scheduled scan will run at the frequency specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to run a scheduled scan* +- GP name: *Scan_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a scheduled scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a scheduled scan will run at the time of day specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time of day to run a scheduled scan* +- GP name: *Scan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not the antimalware service remains running when antivirus and antispyware security intelligence is disabled. It is recommended that this setting remain disabled. + +If you enable this setting, the antimalware service will always remain running even if both antivirus and antispyware security intelligence is disabled. + +If you disable or do not configure this setting, the antimalware service will be stopped when both antivirus and antispyware security intelligence is disabled. If the computer is restarted, the service will be started if it is set to Automatic startup. After the service has started, there will be a check to see if antivirus and antispyware security intelligence is enabled. If at least one is enabled, the service will remain running. If both are disabled, the service will be stopped. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to remain running always* +- GP name: *ServiceKeepAlive* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days that must pass before spyware security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. + +If you enable this setting, spyware security intelligence will be considered out of date after the number of days specified have passed without an update. + +If you disable or do not configure this setting, spyware security intelligence will be considered out of date after the default number of days have passed without an update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days before spyware security intelligence is considered out of date* +- GP name: *SignatureUpdate_ASSignatureDue* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days that must pass before virus security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. + +If you enable this setting, virus security intelligence will be considered out of date after the number of days specified have passed without an update. + +If you disable or do not configure this setting, virus security intelligence will be considered out of date after the default number of days have passed without an update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days before virus security intelligence is considered out of date* +- GP name: *SignatureUpdate_AVSignatureDue* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure UNC file share sources for downloading security intelligence updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources. For example: "{\\\unc1 | \\\unc2 }". The list is empty by default. + +If you enable this setting, the specified sources will be contacted for security intelligence updates. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, the list will remain empty by default and no sources will be contacted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define file shares for downloading security intelligence updates* +- GP name: *SignatureUpdate_DefinitionUpdateFileSharesSources* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the automatic scan which starts after a security intelligence update has occurred. + +If you enable or do not configure this setting, a scan will start following a security intelligence update. + +If you disable this setting, a scan will not start following a security intelligence update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on scan after security intelligence update* +- GP name: *SignatureUpdate_DisableScanOnUpdate* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure security intelligence updates when the computer is running on battery power. + +If you enable or do not configure this setting, security intelligence updates will occur as usual regardless of power state. + +If you disable this setting, security intelligence updates will be turned off while the computer is running on battery power. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow security intelligence updates when running on battery power* +- GP name: *SignatureUpdate_DisableScheduledSignatureUpdateonBattery* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure security intelligence updates on startup when there is no antimalware engine present. + +If you enable or do not configure this setting, security intelligence updates will be initiated on startup when there is no antimalware engine present. + +If you disable this setting, security intelligence updates will not be initiated on startup when there is no antimalware engine present. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Initiate security intelligence update on startup* +- GP name: *SignatureUpdate_DisableUpdateOnStartupWithoutEngine* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: “InternalDefinitionUpdateServer”, “MicrosoftUpdateServer”, “MMPC”, and “FileShares”. + +For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } + +If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, security intelligence update sources will be contacted in a default order. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the order of sources for downloading security intelligence updates* +- GP name: *SignatureUpdate_FallbackOrder* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable download of security intelligence updates from Microsoft Update even if the Automatic Updates default server is configured to another download source such as Windows Update. + +If you enable this setting, security intelligence updates will be downloaded from Microsoft Update. + +If you disable or do not configure this setting, security intelligence updates will be downloaded from the configured download source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow security intelligence updates from Microsoft Update* +- GP name: *SignatureUpdate_ForceUpdateFromMU* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable real-time security intelligence updates in response to reports sent to Microsoft MAPS. If the service reports a file as an unknown and Microsoft MAPS finds that the latest security intelligence update has security intelligence for a threat involving that file, the service will receive all of the latest security intelligence for that threat immediately. You must have configured your computer to join Microsoft MAPS for this functionality to work. + +If you enable or do not configure this setting, real-time security intelligence updates will be enabled. + +If you disable this setting, real-time security intelligence updates will disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow real-time security intelligence updates based on reports to Microsoft MAPS* +- GP name: *SignatureUpdate_RealtimeSignatureDelivery* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to check for security intelligence updates. The check can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day (default) +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never + +If you enable this setting, the check for security intelligence updates will occur at the frequency specified. + +If you disable or do not configure this setting, the check for security intelligence updates will occur at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to check for security intelligence updates* +- GP name: *SignatureUpdate_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. + +If you enable this setting, the check for security intelligence updates will occur at the time of day specified. + +If you disable or do not configure this setting, the check for security intelligence updates will occur at the default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time to check for security intelligence updates* +- GP name: *SignatureUpdate_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the security intelligence location for VDI-configured computers. + +If you disable or do not configure this setting, security intelligence will be referred from the default local source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define security intelligence location for VDI clients.* +- GP name: *SignatureUpdate_SharedSignaturesLocation* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the antimalware service to receive notifications to disable individual security intelligence in response to reports it sends to Microsoft MAPS. Microsoft MAPS uses these notifications to disable security intelligence that are causing false positive reports. You must have configured your computer to join Microsoft MAPS for this functionality to work. + +If you enable this setting or do not configure, the antimalware service will receive notifications to disable security intelligence. + +If you disable this setting, the antimalware service will not receive notifications to disable security intelligence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow notifications to disable security intelligence based reports to Microsoft MAPS* +- GP name: *SignatureUpdate_SignatureDisableNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days after which a catch-up security intelligence update will be required. By default, the value of this setting is 1 day. + +If you enable this setting, a catch-up security intelligence update will occur after the specified number of days. + +If you disable or do not configure this setting, a catch-up security intelligence update will be required after the default number of days. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days after which a catch-up security intelligence update is required* +- GP name: *SignatureUpdate_SignatureUpdateCatchupInterval* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur immediately after service startup. + +If you enable this setting, a check for new security intelligence will occur after service startup. + +If you disable this setting or do not configure this setting, a check for new security intelligence will not occur after service startup. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Check for the latest virus and spyware security intelligence on startup* +- GP name: *SignatureUpdate_UpdateOnStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/SpynetReporting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. + +You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new security intelligence and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you. + +Possible options are: + +- (0x0) Disabled (default) +- (0x1) Basic membership +- (0x2) Advanced membership + +Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful. + +Advanced membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer. + +If you enable this setting, you will join Microsoft MAPS with the membership specified. + +If you disable or do not configure this setting, you will not join Microsoft MAPS. + +In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Join Microsoft MAPS* +- GP name: *SpynetReporting* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for reporting to Microsoft MAPS* +- GP name: *Spynet_LocalSettingOverrideSpynetReporting* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken. + +Valid remediation action values are: + +- 2 = Quarantine +- 3 = Remove +- 6 = Ignore + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify threats upon which default action should not be taken when detected* +- GP name: *Threats_ThreatIdDefaultAction* +- GP path: *Windows Components\Microsoft Defender Antivirus\Threats* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not to display additional text to clients when they need to perform an action. The text displayed is a custom administrator-defined string. For example, the phone number to call the company help desk. The client interface will only display a maximum of 1024 characters. Longer strings will be truncated before display. + +If you enable this setting, the additional text specified will be displayed. + +If you disable or do not configure this setting, there will be no additional text displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display additional text to clients when they need to perform an action* +- GP name: *UX_Configuration_CustomDefaultActionToastString* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Use this policy setting to specify if you want Microsoft Defender Antivirus notifications to display on clients. + +If you disable or do not configure this setting, Microsoft Defender Antivirus notifications will display on clients. + +If you enable this setting, Microsoft Defender Antivirus notifications will not display on clients. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Suppress all notifications* +- GP name: *UX_Configuration_Notification_Suppress* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows user to suppress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode). + +If you enable this setting AM UI won't show reboot notifications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Suppresses reboot notifications* +- GP name: *UX_Configuration_SuppressRebootNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not to display AM UI to the users. + +If you enable this setting AM UI won't be available to users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable headless UI mode* +- GP name: *UX_Configuration_UILockdown* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md new file mode 100644 index 0000000000..a86907a534 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -0,0 +1,445 @@ +--- +title: Policy CSP - ADMX_MMC +description: Policy CSP - ADMX_MMC +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/03/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MMC +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_MMC policies + +
          +
          + ADMX_MMC/MMC_ActiveXControl +
          +
          + ADMX_MMC/MMC_ExtendView +
          +
          + ADMX_MMC/MMC_LinkToWeb +
          +
          + ADMX_MMC/MMC_Restrict_Author +
          +
          + ADMX_MMC/MMC_Restrict_To_Permitted_Snapins +
          +
          + + +
          + + +**ADMX_MMC/MMC_ActiveXControl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits use of this snap-in. + +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. + +To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. + +To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *ActiveX Control* +- GP name: *MMC_ActiveXControl* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMC.admx* + + + +
          + + +**ADMX_MMC/MMC_ExtendView** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits use of this snap-in. + +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. + +To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. + +To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Extended View (Web View)* +- GP name: *MMC_ExtendView* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMC.admx* + + + +
          + + +**ADMX_MMC/MMC_LinkToWeb** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits use of this snap-in. + +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. + +To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. + +To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Link to Web Address* +- GP name: *MMC_LinkToWeb* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMC.admx* + + + +
          + + +**ADMX_MMC/MMC_Restrict_Author** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from entering author mode. + +This setting prevents users from opening the Microsoft Management Console (MMC) in author mode, explicitly opening console files in author mode, and opening any console files that open in author mode by default. + +As a result, users cannot create console files or add or remove snap-ins. Also, because they cannot open author-mode console files, they cannot use the tools that the files contain. + +This setting permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server family or Windows Server 2003 family. However, users cannot open a blank MMC console window on the Start menu. (To open the MMC, click Start, click Run, and type mmc.) Users also cannot open a blank MMC console window from a command prompt. + +If you disable this setting or do not configure it, users can enter author mode and open author-mode console files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict the user from entering author mode* +- GP name: *MMC_Restrict_Author* +- GP path: *Windows Components\Microsoft Management Console* +- GP ADMX file name: *MMC.admx* + + + +
          + + +**ADMX_MMC/MMC_Restrict_To_Permitted_Snapins** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets you selectively permit or prohibit the use of Microsoft Management Console (MMC) snap-ins. + +- If you enable this setting, all snap-ins are prohibited, except those that you explicitly permit. Use this setting if you plan to prohibit use of most snap-ins. + +To explicitly permit a snap-in, open the Restricted/Permitted snap-ins setting folder and enable the settings representing the snap-in you want to permit. If a snap-in setting in the folder is disabled or not configured, the snap-in is prohibited. + +- If you disable this setting or do not configure it, all snap-ins are permitted, except those that you explicitly prohibit. Use this setting if you plan to permit use of most snap-ins. + +To explicitly prohibit a snap-in, open the Restricted/Permitted snap-ins setting folder and then disable the settings representing the snap-ins you want to prohibit. If a snap-in setting in the folder is enabled or not configured, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!NOTE] +> If you enable this setting, and you do not enable any settings in the Restricted/Permitted snap-ins folder, users cannot use any MMC snap-ins. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict users to the explicitly permitted list of snap-ins* +- GP name: *MMC_Restrict_To_Permitted_Snapins* +- GP path: *Windows Components\Microsoft Management Console* +- GP ADMX file name: *MMC.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md new file mode 100644 index 0000000000..cdd93c1d97 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -0,0 +1,8450 @@ +--- +title: Policy CSP - ADMX_MMCSnapins +description: Policy CSP - ADMX_MMCSnapins +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MMCSnapins +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_MMCSnapins policies + +
          +
          + ADMX_MMCSnapins/MMC_ADMComputers_1 +
          +
          + ADMX_MMCSnapins/MMC_ADMComputers_2 +
          +
          + ADMX_MMCSnapins/MMC_ADMUsers_1 +
          +
          + ADMX_MMCSnapins/MMC_ADMUsers_2 +
          +
          + ADMX_MMCSnapins/MMC_ADSI +
          +
          + ADMX_MMCSnapins/MMC_ActiveDirDomTrusts +
          +
          + ADMX_MMCSnapins/MMC_ActiveDirSitesServices +
          +
          + ADMX_MMCSnapins/MMC_ActiveDirUsersComp +
          +
          + ADMX_MMCSnapins/MMC_AppleTalkRouting +
          +
          + ADMX_MMCSnapins/MMC_AuthMan +
          +
          + ADMX_MMCSnapins/MMC_CertAuth +
          +
          + ADMX_MMCSnapins/MMC_CertAuthPolSet +
          +
          + ADMX_MMCSnapins/MMC_Certs +
          +
          + ADMX_MMCSnapins/MMC_CertsTemplate +
          +
          + ADMX_MMCSnapins/MMC_ComponentServices +
          +
          + ADMX_MMCSnapins/MMC_ComputerManagement +
          +
          + ADMX_MMCSnapins/MMC_ConnectionSharingNAT +
          +
          + ADMX_MMCSnapins/MMC_DCOMCFG +
          +
          + ADMX_MMCSnapins/MMC_DFS +
          +
          + ADMX_MMCSnapins/MMC_DHCPRelayMgmt +
          +
          + ADMX_MMCSnapins/MMC_DeviceManager_1 +
          +
          + ADMX_MMCSnapins/MMC_DeviceManager_2 +
          +
          + ADMX_MMCSnapins/MMC_DiskDefrag +
          +
          + ADMX_MMCSnapins/MMC_DiskMgmt +
          +
          + ADMX_MMCSnapins/MMC_EnterprisePKI +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_1 +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_2 +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_3 +
          +
          + ADMX_MMCSnapins/MMC_EventViewer_4 +
          +
          + ADMX_MMCSnapins/MMC_FAXService +
          +
          + ADMX_MMCSnapins/MMC_FailoverClusters +
          +
          + ADMX_MMCSnapins/MMC_FolderRedirection_1 +
          +
          + ADMX_MMCSnapins/MMC_FolderRedirection_2 +
          +
          + ADMX_MMCSnapins/MMC_FrontPageExt +
          +
          + ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn +
          +
          + ADMX_MMCSnapins/MMC_GroupPolicySnapIn +
          +
          + ADMX_MMCSnapins/MMC_GroupPolicyTab +
          +
          + ADMX_MMCSnapins/MMC_HRA +
          +
          + ADMX_MMCSnapins/MMC_IAS +
          +
          + ADMX_MMCSnapins/MMC_IASLogging +
          +
          + ADMX_MMCSnapins/MMC_IEMaintenance_1 +
          +
          + ADMX_MMCSnapins/MMC_IEMaintenance_2 +
          +
          + ADMX_MMCSnapins/MMC_IGMPRouting +
          +
          + ADMX_MMCSnapins/MMC_IIS +
          +
          + ADMX_MMCSnapins/MMC_IPRouting +
          +
          + ADMX_MMCSnapins/MMC_IPSecManage_GP +
          +
          + ADMX_MMCSnapins/MMC_IPXRIPRouting +
          +
          + ADMX_MMCSnapins/MMC_IPXRouting +
          +
          + ADMX_MMCSnapins/MMC_IPXSAPRouting +
          +
          + ADMX_MMCSnapins/MMC_IndexingService +
          +
          + ADMX_MMCSnapins/MMC_IpSecManage +
          +
          + ADMX_MMCSnapins/MMC_IpSecMonitor +
          +
          + ADMX_MMCSnapins/MMC_LocalUsersGroups +
          +
          + ADMX_MMCSnapins/MMC_LogicalMappedDrives +
          +
          + ADMX_MMCSnapins/MMC_NPSUI +
          +
          + ADMX_MMCSnapins/MMC_NapSnap +
          +
          + ADMX_MMCSnapins/MMC_NapSnap_GP +
          +
          + ADMX_MMCSnapins/MMC_Net_Framework +
          +
          + ADMX_MMCSnapins/MMC_OCSP +
          +
          + ADMX_MMCSnapins/MMC_OSPFRouting +
          +
          + ADMX_MMCSnapins/MMC_PerfLogsAlerts +
          +
          + ADMX_MMCSnapins/MMC_PublicKey +
          +
          + ADMX_MMCSnapins/MMC_QoSAdmission +
          +
          + ADMX_MMCSnapins/MMC_RAS_DialinUser +
          +
          + ADMX_MMCSnapins/MMC_RIPRouting +
          +
          + ADMX_MMCSnapins/MMC_RIS +
          +
          + ADMX_MMCSnapins/MMC_RRA +
          +
          + ADMX_MMCSnapins/MMC_RSM +
          +
          + ADMX_MMCSnapins/MMC_RemStore +
          +
          + ADMX_MMCSnapins/MMC_RemoteAccess +
          +
          + ADMX_MMCSnapins/MMC_RemoteDesktop +
          +
          + ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn +
          +
          + ADMX_MMCSnapins/MMC_Routing +
          +
          + ADMX_MMCSnapins/MMC_SCA +
          +
          + ADMX_MMCSnapins/MMC_SMTPProtocol +
          +
          + ADMX_MMCSnapins/MMC_SNMP +
          +
          + ADMX_MMCSnapins/MMC_ScriptsMachine_1 +
          +
          + ADMX_MMCSnapins/MMC_ScriptsMachine_2 +
          +
          + ADMX_MMCSnapins/MMC_ScriptsUser_1 +
          +
          + ADMX_MMCSnapins/MMC_ScriptsUser_2 +
          +
          + ADMX_MMCSnapins/MMC_SecuritySettings_1 +
          +
          + ADMX_MMCSnapins/MMC_SecuritySettings_2 +
          +
          + ADMX_MMCSnapins/MMC_SecurityTemplates +
          +
          + ADMX_MMCSnapins/MMC_SendConsoleMessage +
          +
          + ADMX_MMCSnapins/MMC_ServerManager +
          +
          + ADMX_MMCSnapins/MMC_ServiceDependencies +
          +
          + ADMX_MMCSnapins/MMC_Services +
          +
          + ADMX_MMCSnapins/MMC_SharedFolders +
          +
          + ADMX_MMCSnapins/MMC_SharedFolders_Ext +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1 +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2 +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1 +
          +
          + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2 +
          +
          + ADMX_MMCSnapins/MMC_SysInfo +
          +
          + ADMX_MMCSnapins/MMC_SysProp +
          +
          + ADMX_MMCSnapins/MMC_TPMManagement +
          +
          + ADMX_MMCSnapins/MMC_Telephony +
          +
          + ADMX_MMCSnapins/MMC_TerminalServices +
          +
          + ADMX_MMCSnapins/MMC_WMI +
          +
          + ADMX_MMCSnapins/MMC_WindowsFirewall +
          +
          + ADMX_MMCSnapins/MMC_WindowsFirewall_GP +
          +
          + ADMX_MMCSnapins/MMC_WiredNetworkPolicy +
          +
          + ADMX_MMCSnapins/MMC_WirelessMon +
          +
          + ADMX_MMCSnapins/MMC_WirelessNetworkPolicy +
          +
          + + +
          + + +**ADMX_MMCSnapins/MMC_ADMComputers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Computers)* +- GP name: *MMC_ADMComputers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + +
          + + +**ADMX_MMCSnapins/MMC_ADMComputers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Computers)* +- GP name: *MMC_ADMComputers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ADMUsers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Users)* +- GP name: *MMC_ADMUsers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ADMUsers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Users)* +- GP name: *MMC_ADMUsers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ADSI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *ADSI Edit* +- GP name: *MMC_ADSI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ActiveDirDomTrusts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable.For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Active Directory Domains and Trusts* +- GP name: *MMC_ActiveDirDomTrusts* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ActiveDirSitesServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable.For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Active Directory Sites and Services* +- GP name: *MMC_ActiveDirSitesServices* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ActiveDirUsersComp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Active Directory Users and Computers* +- GP name: *MMC_ActiveDirUsersComp* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_AppleTalkRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *AppleTalk Routing* +- GP name: *MMC_AppleTalkRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_AuthMan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Authorization Manager* +- GP name: *MMC_AuthMan* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_CertAuth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certification Authority* +- GP name: *MMC_CertAuth* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_CertAuthPolSet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certification Authority Policy Settings* +- GP name: *MMC_CertAuthPolSet* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_Certs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certificates* +- GP name: *MMC_Certs* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_CertsTemplate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certificate Templates* +- GP name: *MMC_CertsTemplate* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ComponentServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Component Services* +- GP name: *MMC_ComponentServices* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ComputerManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Computer Management* +- GP name: *MMC_ComputerManagement* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ConnectionSharingNAT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Connection Sharing (NAT)* +- GP name: *MMC_ConnectionSharingNAT* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_DCOMCFG** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DCOM Configuration Extension* +- GP name: *MMC_DCOMCFG* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_DFS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Distributed File System* +- GP name: *MMC_DFS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_DHCPRelayMgmt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DHCP Relay Management* +- GP name: *MMC_DHCPRelayMgmt* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_DeviceManager_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Device Manager* +- GP name: *MMC_DeviceManager_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_DeviceManager_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Device Manager* +- GP name: *MMC_DeviceManager_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_DiskDefrag** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disk Defragmenter* +- GP name: *MMC_DiskDefrag* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_DiskMgmt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disk Management* +- GP name: *MMC_DiskMgmt* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_EnterprisePKI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enterprise PKI* +- GP name: *MMC_EnterprisePKI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_EventViewer_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer* +- GP name: *MMC_EventViewer_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_EventViewer_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer (Windows Vista)* +- GP name: *MMC_EventViewer_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_EventViewer_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer* +- GP name: *MMC_EventViewer_3* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_EventViewer_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer (Windows Vista)* +- GP name: *MMC_EventViewer_4* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + + +
          + + +**ADMX_MMCSnapins/MMC_EventViewer_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer (Windows Vista)* +- GP name: *MMC_EventViewer_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_FAXService** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *FAX Service* +- GP name: *MMC_FAXService* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_FailoverClusters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Failover Clusters Manager* +- GP name: *MMC_FailoverClusters* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_FolderRedirection_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Folder Redirection* +- GP name: *MMC_FolderRedirection_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_FolderRedirection_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Folder Redirection* +- GP name: *MMC_FolderRedirection_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_FrontPageExt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *FrontPage Server Extensions* +- GP name: *MMC_FrontPageExt* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Group Policy Management* +- GP name: *MMC_GroupPolicyManagementSnapIn* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_GroupPolicySnapIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Group Policy Object Editor* +- GP name: *MMC_GroupPolicySnapIn* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_GroupPolicyTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. + +If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this tab is displayed. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users will not have access to the Group Policy tab. + +To explicitly permit use of the Group Policy tab, enable this setting. If this setting is not configured (or disabled), the Group Policy tab is inaccessible. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users will have access to the Group Policy tab. + +To explicitly prohibit use of the Group Policy tab, disable this setting. If this setting is not configured (or enabled), the Group Policy tab is accessible. + +When the Group Policy tab is inaccessible, it does not appear in the site, domain, or organizational unit property sheets. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Group Policy tab for Active Directory Tools* +- GP name: *MMC_GroupPolicyTab* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_HRA** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Health Registration Authority (HRA)* +- GP name: *MMC_HRA* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IAS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Authentication Service (IAS)* +- GP name: *MMC_IAS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IASLogging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IAS Logging* +- GP name: *MMC_IASLogging* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IEMaintenance_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer Maintenance* +- GP name: *MMC_IEMaintenance_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IEMaintenance_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer Maintenance* +- GP name: *MMC_IEMaintenance_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IGMPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IGMP Routing* +- GP name: *MMC_IGMPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IIS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Information Services* +- GP name: *MMC_IIS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Routing* +- GP name: *MMC_IPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IPSecManage_GP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Security Policy Management* +- GP name: *MMC_IPSecManage_GP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IPXRIPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPX RIP Routing* +- GP name: *MMC_IPXRIPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IPXRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPX Routing* +- GP name: *MMC_IPXRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IPXSAPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPX SAP Routing* +- GP name: *MMC_IPXSAPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IndexingService** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Indexing Service* +- GP name: *MMC_IndexingService* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IpSecManage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Security Policy Management* +- GP name: *MMC_IpSecManage* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_IpSecMonitor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Security Monitor* +- GP name: *MMC_IpSecMonitor* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_LocalUsersGroups** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Local Users and Groups* +- GP name: *MMC_LocalUsersGroups* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_LogicalMappedDrives** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Logical and Mapped Drives* +- GP name: *MMC_LogicalMappedDrives* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_NPSUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Network Policy Server (NPS)* +- GP name: *MMC_NPSUI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_NapSnap** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *NAP Client Configuration* +- GP name: *MMC_NapSnap* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_NapSnap_GP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *NAP Client Configuration* +- GP name: *MMC_NapSnap_GP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_Net_Framework** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *.Net Framework Configuration* +- GP name: *MMC_Net_Framework* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_OCSP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Online Responder* +- GP name: *MMC_OCSP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_OSPFRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *OSPF Routing* +- GP name: *MMC_OSPFRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_PerfLogsAlerts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Performance Logs and Alerts* +- GP name: *MMC_PerfLogsAlerts* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_PublicKey** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Public Key Policies* +- GP name: *MMC_PublicKey* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_QoSAdmission** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *QoS Admission Control* +- GP name: *MMC_QoSAdmission* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RAS_DialinUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *RAS Dialin - User Node* +- GP name: *MMC_RAS_DialinUser* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RIPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *RIP Routing* +- GP name: *MMC_RIPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RIS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Installation Services* +- GP name: *MMC_RIS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RRA** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Routing and Remote Access* +- GP name: *MMC_RRA* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RSM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Storage Management* +- GP name: *MMC_RSM* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RemStore** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Storage* +- GP name: *MMC_RemStore* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RemoteAccess** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Access* +- GP name: *MMC_RemoteAccess* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_RemoteDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Desktops* +- GP name: *MMC_RemoteDesktop* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Resultant Set of Policy snap-in* +- GP name: *MMC_ResultantSetOfPolicySnapIn* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_Routing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Routing* +- GP name: *MMC_Routing* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SCA** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Configuration and Analysis* +- GP name: *MMC_SCA* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SMTPProtocol** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SMTP Protocol* +- GP name: *MMC_SMTPProtocol* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SNMP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SNMP* +- GP name: *MMC_SNMP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ScriptsMachine_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Startup/Shutdown)* +- GP name: *MMC_ScriptsMachine_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ScriptsMachine_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Startup/Shutdown)* +- GP name: *MMC_ScriptsMachine_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ScriptsUser_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Logon/Logoff)* +- GP name: *MMC_ScriptsUser_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ScriptsUser_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Logon/Logoff)* +- GP name: *MMC_ScriptsUser_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SecuritySettings_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Settings* +- GP name: *MMC_SecuritySettings_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SecuritySettings_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Settings* +- GP name: *MMC_SecuritySettings_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SecurityTemplates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Templates* +- GP name: *MMC_SecurityTemplates* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SendConsoleMessage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send Console Message* +- GP name: *MMC_SendConsoleMessage* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ServerManager** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Server Manager* +- GP name: *MMC_ServerManager* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_ServiceDependencies** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Service Dependencies* +- GP name: *MMC_ServiceDependencies* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_Services** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Services* +- GP name: *MMC_Services* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SharedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Shared Folders* +- GP name: *MMC_SharedFolders* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SharedFolders_Ext** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Shared Folders Ext* +- GP name: *MMC_SharedFolders_Ext* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Computers)* +- GP name: *MMC_SoftwareInstalationComputers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Computers)* +- GP name: *MMC_SoftwareInstalationComputers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Users)* +- GP name: *MMC_SoftwareInstallationUsers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Users)* +- GP name: *MMC_SoftwareInstallationUsers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SysInfo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *System Information* +- GP name: *MMC_SysInfo* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_SysProp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *System Properties* +- GP name: *MMC_SysProp* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_TPMManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *TPM Management* +- GP name: *MMC_TPMManagement* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_Telephony** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Telephony* +- GP name: *MMC_Telephony* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_TerminalServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Desktop Services Configuration* +- GP name: *MMC_TerminalServices* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_WMI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WMI Control* +- GP name: *MMC_WMI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_WindowsFirewall** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Windows Firewall with Advanced Security* +- GP name: *MMC_WindowsFirewall* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_WindowsFirewall_GP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Windows Firewall with Advanced Security* +- GP name: *MMC_WindowsFirewall_GP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_WiredNetworkPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Wired Network (IEEE 802.3) Policies* +- GP name: *MMC_WiredNetworkPolicy* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_WirelessMon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Wireless Monitor* +- GP name: *MMC_WirelessMon* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
          + + +**ADMX_MMCSnapins/MMC_WirelessNetworkPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Wireless Network (IEEE 802.11) Policies* +- GP name: *MMC_WirelessNetworkPolicy* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md new file mode 100644 index 0000000000..e8c35ac22e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -0,0 +1,116 @@ +--- +title: Policy CSP - ADMX_MSAPolicy +description: Policy CSP - ADMX_MSAPolicy +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MSAPolicy +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_MSAPolicy policies + +
          +
          + ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine +
          +
          + + +
          + + +**ADMX_MSAPolicy/MicrosoftAccount_DisableUserAuth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether users can provide Microsoft accounts for authentication for applications or services. If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication. + +This applies both to existing users of a device and new users who may be added. However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires. + +It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present. If this setting is disabled or not configured, applications and services can use Microsoft accounts for authentication. + +By default, this setting is Disabled. This setting does not affect whether users can sign in to devices by using Microsoft accounts, or the ability for users to provide Microsoft accounts via the browser for authentication with web-based applications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block all consumer Microsoft account user authentication* +- GP name: *MicrosoftAccount_DisableUserAuth* +- GP path: *Windows Components\Microsoft account* +- GP ADMX file name: *MSAPolicy.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md new file mode 100644 index 0000000000..840af17067 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -0,0 +1,626 @@ +--- +title: Policy CSP - ADMX_nca +description: Policy CSP - ADMX_nca +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_nca +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_nca policies + +
          +
          + ADMX_nca/CorporateResources +
          +
          + ADMX_nca/CustomCommands +
          +
          + ADMX_nca/DTEs +
          +
          + ADMX_nca/FriendlyName +
          +
          + ADMX_nca/LocalNamesOn +
          +
          + ADMX_nca/PassiveMode +
          +
          + ADMX_nca/ShowUI +
          +
          + ADMX_nca/SupportEmail +
          +
          + + +
          + + +**ADMX_nca/CorporateResources** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies resources on your intranet that are normally accessible to DirectAccess clients. Each entry is a string that identifies the type of resource and the location of the resource. + +Each string can be one of the following types: + +- A DNS name or IPv6 address that NCA pings. The syntax is “PING:” followed by a fully qualified domain name (FQDN) that resolves to an IPv6 address, or an IPv6 address. Examples: PING:myserver.corp.contoso.com or PING:2002:836b:1::1. + +> [!NOTE] +> We recommend that you use FQDNs instead of IPv6 addresses wherever possible. + +> [!IMPORTANT] +> At least one of the entries must be a PING: resource. +> - A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is “HTTP:” followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP:http://myserver.corp.contoso.com/ or HTTP:http://2002:836b:1::1/. +> - A Universal Naming Convention (UNC) path to a file that NCA checks for existence. The contents of the file do not matter. The syntax is “FILE:” followed by a UNC path. The ComputerName portion of the UNC path must resolve to an IPv6 address or contain an IPv6 address. Examples: FILE:\\myserver\myshare\test.txt or FILE:\\2002:836b:1::1\myshare\test.txt. + +You must configure this setting to have complete NCA functionality. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Corporate Resources* +- GP name: *CorporateResources* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + + +**ADMX_nca/CustomCommands** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies commands configured by the administrator for custom logging. These commands will run in addition to default log commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Commands* +- GP name: *CustomCommands* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + + +**ADMX_nca/DTEs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the IPv6 addresses of the endpoints of the Internet Protocol security (IPsec) tunnels that enable DirectAccess. NCA attempts to access the resources that are specified in the Corporate Resources setting through these configured tunnel endpoints. + +By default, NCA uses the same DirectAccess server that the DirectAccess client computer connection is using. In default configurations of DirectAccess, there are typically two IPsec tunnel endpoints: one for the infrastructure tunnel and one for the intranet tunnel. You should configure one endpoint for each tunnel. + +Each entry consists of the text PING: followed by the IPv6 address of an IPsec tunnel endpoint. Example: PING:2002:836b:1::836b:1. + +You must configure this setting to have complete NCA functionality. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPsec Tunnel Endpoints* +- GP name: *DTEs* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + + +**ADMX_nca/FriendlyName** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the string that appears for DirectAccess connectivity when the user clicks the Networking notification area icon. For example, you can specify “Contoso Intranet Access” for the DirectAccess clients of the Contoso Corporation. + +If this setting is not configured, the string that appears for DirectAccess connectivity is “Corporate Connection”. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Friendly Name* +- GP name: *FriendlyName* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + + +**ADMX_nca/LocalNamesOn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the user has Connect and Disconnect options for the DirectAccess entry when the user clicks the Networking notification area icon. + +If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the Name Resolution Policy Table (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. Note that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names. + +The ability to disconnect allows users to specify single-label, unqualified names (such as “PRINTSVR”) for local resources when connected to a different intranet and for temporary access to intranet resources when network location detection has not correctly determined that the DirectAccess client computer is connected to its own intranet. + +To restore the DirectAccess rules to the NRPT and resume normal DirectAccess functionality, the user clicks Connect. + +> [!NOTE] +> If the DirectAccess client computer is on the intranet and has correctly determined its network location, the Disconnect option has no effect because the rules for DirectAccess are already removed from the NRPT. + +If this setting is not configured, users do not have Connect or Disconnect options. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prefer Local Names Allowed* +- GP name: *LocalNamesOn* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + + +**ADMX_nca/PassiveMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether NCA service runs in Passive Mode or not. + +Set this to Disabled to keep NCA probing actively all the time. If this setting is not configured, NCA probing is in active mode by default. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DirectAccess Passive Mode* +- GP name: *PassiveMode* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + + +**ADMX_nca/ShowUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether an entry for DirectAccess connectivity appears when the user clicks the Networking notification area icon. + +Set this to Disabled to prevent user confusion when you are just using DirectAccess to remotely manage DirectAccess client computers from your intranet and not providing seamless intranet access. + +If this setting is not configured, the entry for DirectAccess connectivity appears. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *User Interface* +- GP name: *ShowUI* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + + +**ADMX_nca/SupportEmail** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the e-mail address to be used when sending the log files that are generated by NCA to the network administrator. + +When the user sends the log files to the Administrator, NCA uses the default e-mail client to open a new message with the support email address in the To: field of the message, then attaches the generated log files as a .html file. The user can review the message and add additional information before sending the message. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support Email Address* +- GP name: *SupportEmail* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md new file mode 100644 index 0000000000..3e575f3fdf --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -0,0 +1,521 @@ +--- +title: Policy CSP - ADMX_NCSI +description: Policy CSP - ADMX_NCSI +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_NCSI +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_NCSI policies + +
          +
          + ADMX_NCSI/NCSI_CorpDnsProbeContent +
          +
          + ADMX_NCSI/NCSI_CorpDnsProbeHost +
          +
          + ADMX_NCSI/NCSI_CorpSitePrefixes +
          +
          + ADMX_NCSI/NCSI_CorpWebProbeUrl +
          +
          + ADMX_NCSI/NCSI_DomainLocationDeterminationUrl +
          +
          + ADMX_NCSI/NCSI_GlobalDns +
          +
          + ADMX_NCSI/NCSI_PassivePolling +
          +
          + + +
          + + +**ADMX_NCSI/NCSI_CorpDnsProbeContent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables you to specify the expected address of the host name used for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate DNS probe host address* +- GP name: *NCSI_CorpDnsProbeContent* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
          + + +**ADMX_NCSI/NCSI_CorpDnsProbeHost** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables you to specify the host name of a computer known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate DNS probe host name* +- GP name: *NCSI_CorpDnsProbeHost* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
          + + +**ADMX_NCSI/NCSI_CorpSitePrefixes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables you to specify the list of IPv6 corporate site prefixes to monitor for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate site prefix list* +- GP name: *NCSI_CorpSitePrefixes* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
          + + +**ADMX_NCSI/NCSI_CorpWebProbeUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate Website probe URL* +- GP name: *NCSI_CorpWebProbeUrl* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
          + + +
          + + +**ADMX_NCSI/NCSI_DomainLocationDeterminationUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables you to specify the HTTPS URL of the corporate website that clients use to determine the current domain location (i.e. whether the computer is inside or outside the corporate network). Reachability of the URL destination indicates that the client location is inside corporate network; otherwise it is outside the network. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify domain location determination URL* +- GP name: *NCSI_DomainLocationDeterminationUrl* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
          + + +**ADMX_NCSI/NCSI_GlobalDns** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. If you enable this setting, NCSI will allow the DNS lookups to happen on any interface. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify global DNS* +- GP name: *NCSI_GlobalDns* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
          + + +**ADMX_NCSI/NCSI_PassivePolling** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This Policy setting enables you to specify passive polling behavior. NCSI polls various measurements throughout the network stack on a frequent interval to determine if network connectivity has been lost. Use the options to control the passive polling behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify passive polling* +- GP name: *NCSI_PassivePolling* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md new file mode 100644 index 0000000000..782b57ba8c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -0,0 +1,2768 @@ +--- +title: Policy CSP - ADMX_Netlogon +description: Policy CSP - ADMX_Netlogon +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/15/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Netlogon +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Netlogon policies + +
          +
          + ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior +
          +
          + ADMX_Netlogon/Netlogon_AddressTypeReturned +
          +
          + ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch +
          +
          + ADMX_Netlogon/Netlogon_AllowNT4Crypto +
          +
          + ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain +
          +
          + ADMX_Netlogon/Netlogon_AutoSiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery +
          +
          + ADMX_Netlogon/Netlogon_AvoidPdcOnWan +
          +
          + ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod +
          +
          + ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod +
          +
          + ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime +
          +
          + ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod +
          +
          + ADMX_Netlogon/Netlogon_DebugFlag +
          +
          + ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords +
          +
          + ADMX_Netlogon/Netlogon_DnsRefreshInterval +
          +
          + ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames +
          +
          + ADMX_Netlogon/Netlogon_DnsTtl +
          +
          + ADMX_Netlogon/Netlogon_ExpectedDialupDelay +
          +
          + ADMX_Netlogon/Netlogon_ForceRediscoveryInterval +
          +
          + ADMX_Netlogon/Netlogon_GcSiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages +
          +
          + ADMX_Netlogon/Netlogon_LdapSrvPriority +
          +
          + ADMX_Netlogon/Netlogon_LdapSrvWeight +
          +
          + ADMX_Netlogon/Netlogon_MaximumLogFileSize +
          +
          + ADMX_Netlogon/Netlogon_NdncSiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_NegativeCachePeriod +
          +
          + ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode +
          +
          + ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod +
          +
          + ADMX_Netlogon/Netlogon_PingUrgencyMode +
          +
          + ADMX_Netlogon/Netlogon_ScavengeInterval +
          +
          + ADMX_Netlogon/Netlogon_SiteCoverage +
          +
          + ADMX_Netlogon/Netlogon_SiteName +
          +
          + ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode +
          +
          + ADMX_Netlogon/Netlogon_TryNextClosestSite +
          +
          + ADMX_Netlogon/Netlogon_UseDynamicDns +
          +
          + + +
          + + +**ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures how a domain controller (DC) behaves when responding to a client whose IP address does not map to any configured site. + +Domain controllers use the client IP address during a DC locator ping request to compute which Active Directory site the client belongs to. If no site mapping can be computed, the DC may do an address lookup on the client network name to discover other IP addresses which may then be used to compute a matching site for the client. + +The allowable values for this setting result in the following behaviors: + +- 0 - DCs will never perform address lookups. +- 1 - DCs will perform an exhaustive address lookup to discover additional client IP addresses. +- 2 - DCs will perform a fast, DNS-only address lookup to discover additional client IP addresses. + +To specify this behavior in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 2. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify address lookup behavior for DC locator ping* +- GP name: *Netlogon_AddressLookupOnPingBehavior* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + + +**ADMX_Netlogon/Netlogon_AddressTypeReturned** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the type of IP address that is returned for a domain controller. The DC Locator APIs return the IP address of the DC with the other parts of information. Before the support of IPv6, the returned DC IP address was IPv4. But with the support of IPv6, the DC Locator APIs can return IPv6 DC address. The returned IPv6 DC address may not be correctly handled by some of the existing applications. So this policy is provided to support such scenarios. + +By default, DC Locator APIs can return IPv4/IPv6 DC address. But if some applications are broken due to the returned IPv6 DC address, this policy can be used to disable the default behavior and enforce to return only IPv4 DC address. Once applications are fixed, this policy can be used to enable the default behavior. + +If you enable this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator. + +If you disable this policy setting, DC Locator APIs will ONLY return IPv4 DC address if any. So if the domain controller supports both IPv4 and IPv6 addresses, DC Locator APIs will return IPv4 address. But if the domain controller supports only IPv6 address, then DC Locator APIs will fail. + +If you do not configure this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Return domain controller address type* +- GP name: *Netlogon_AddressTypeReturned* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the computers to which this setting is applied attempts DNS name resolution of single-label domain names, by appending different registered DNS suffixes, and uses NetBIOS name resolution only if DNS name resolution fails. This policy, including the specified default behavior, is not used if the AllowSingleLabelDnsDomain policy setting is enabled. + +By default, when no setting is specified for this policy, the behavior is the same as explicitly enabling this policy, unless the AllowSingleLabelDnsDomain policy setting is enabled. + +If you enable this policy setting, when the AllowSingleLabelDnsDomain policy is not enabled, computers to which this policy is applied, will locate a domain controller hosting an Active Directory domain specified with a single-label name, by appending different registered DNS suffixes to perform DNS name resolution. The single-label name is not used without appending DNS suffixes unless the computer is joined to a domain that has a single-label DNS name in the Active Directory forest. NetBIOS name resolution is performed on the single-label name only, in the event that DNS resolution fails. + +If you disable this policy setting, when the AllowSingleLabelDnsDomain policy is not enabled, computers to which this policy is applied, will only use NetBIOS name resolution to attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name. The computers will not attempt DNS name resolution in this case, unless the computer is searching for a domain with a single label DNS name to which this computer is joined, in the Active Directory forest. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use DNS name resolution when a single-label domain name is used, by appending different registered DNS suffixes, if the AllowSingleLabelDnsDomain setting is not enabled.* +- GP name: *Netlogon_AllowDnsSuffixSearch* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_AllowNT4Crypto** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether the Net Logon service will allow the use of older cryptography algorithms that are used in Windows NT 4.0. The cryptography algorithms used in Windows NT 4.0 and earlier are not as secure as newer algorithms used in Windows 2000 or later, including this version of Windows. + +By default, Net Logon will not allow the older cryptography algorithms to be used and will not include them in the negotiation of cryptography algorithms. Therefore, computers running Windows NT 4.0 will not be able to establish a connection to this domain controller. + +If you enable this policy setting, Net Logon will allow the negotiation and use of older cryptography algorithms compatible with Windows NT 4.0. However, using the older algorithms represents a potential security risk. + +If you disable this policy setting, Net Logon will not allow the negotiation and use of older cryptography algorithms. + +If you do not configure this policy setting, Net Logon will not allow the negotiation and use of older cryptography algorithms. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow cryptography algorithms compatible with Windows NT 4.0* +- GP name: *Netlogon_AllowNT4Crypto* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names. + +By default, the behavior specified in the AllowDnsSuffixSearch is used. If the AllowDnsSuffixSearch policy is disabled, then NetBIOS name resolution is used exclusively, to locate a domain controller hosting an Active Directory domain specified with a single-label name. + +If you enable this policy setting, computers to which this policy is applied will attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name using DNS name resolution. + +If you disable this policy setting, computers to which this setting is applied will use the AllowDnsSuffixSearch policy, if it is not disabled or perform NetBIOS name resolution otherwise, to attempt to locate a domain controller that hosts an Active Directory domain specified with a single-label name. the computers will not the DNS name resolution in this case, unless the computer is searching for a domain with a single label DNS name that exists in the Active Directory forest to which this computer is joined. + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC* +- GP name: *Netlogon_AllowSingleLabelDnsDomain* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_AutoSiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether domain controllers (DC) will dynamically register DC Locator site-specific SRV records for the closest sites where no DC for the same domain exists (or no Global Catalog for the same forest exists). These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. + +If you enable this policy setting, the DCs to which this setting is applied dynamically register DC Locator site-specific DNS SRV records for the closest sites where no DC for the same domain, or no Global Catalog for the same forest, exists. + +If you disable this policy setting, the DCs will not register site-specific DC Locator DNS SRV records for any other sites but their own. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use automated site coverage by the DC Locator DNS SRV Records* +- GP name: *Netlogon_AutoSiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to control the domain controller (DC) location algorithm. By default, the DC location algorithm prefers DNS-based discovery if the DNS domain name is known. If DNS-based discovery fails and the NetBIOS domain name is known, the algorithm then uses NetBIOS-based discovery as a fallback mechanism. + +NetBIOS-based discovery uses a WINS server and mailslot messages but does not use site information. Hence it does not ensure that clients will discover the closest DC. It also allows a hub-site client to discover a branch-site DC even if the branch-site DC only registers site-specific DNS records (as recommended). For these reasons, NetBIOS-based discovery is not recommended. + +> [!NOTE] +> This policy setting does not affect NetBIOS-based discovery for DC location if only the NetBIOS domain name is known. + +If you enable or do not configure this policy setting, the DC location algorithm does not use NetBIOS-based discovery as a fallback mechanism when DNS-based discovery fails. This is the default behavior. + +If you disable this policy setting, the DC location algorithm can use NetBIOS-based discovery as a fallback mechanism when DNS based discovery fails. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not use NetBIOS-based discovery for domain controller location when DNS-based discovery fails* +- GP name: *Netlogon_AvoidFallbackNetbiosDiscovery* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_AvoidPdcOnWan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines whether a domain controller (DC) should attempt to verify the password provided by a client with the PDC emulator if the DC failed to validate the password. + +Contacting the PDC emulator is useful in case the client’s password was recently changed and did not propagate to the DC yet. Users may want to disable this feature if the PDC emulator is located over a slow WAN connection. + +If you enable this policy setting, the DCs to which this policy setting applies will attempt to verify a password with the PDC emulator if the DC fails to validate the password. + +If you disable this policy setting, the DCs will not attempt to verify any passwords with the PDC emulator. + +If you do not configure this policy setting, it is not applied to any DCs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Contact PDC on logon failure* +- GP name: *Netlogon_AvoidPdcOnWan* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the amount of time (in seconds) to wait before the first retry for applications that perform periodic searches for domain controllers (DC) that are unable to find a DC. + +The default value for this setting is 10 minutes (10*60). + +The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0. + +This setting is relevant only to those callers of DsGetDcName that have specified the DS_BACKGROUND_ONLY flag. + +If the value of this setting is less than the value specified in the NegativeCachePeriod subkey, the value in the NegativeCachePeriod subkey is used. + +> [!WARNING] +> If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value set in this setting is very small and the DC is not available, the traffic caused by periodic DC discoveries may be excessive. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use initial DC discovery retry setting for background callers* +- GP name: *Netlogon_BackgroundRetryInitialPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the maximum retry interval allowed when applications performing periodic searches for Domain Controllers (DCs) are unable to find a DC. + +For example, the retry intervals may be set at 10 minutes, then 20 minutes and then 40 minutes, but when the interval reaches the value set in this setting, that value becomes the retry interval for all subsequent retries until the value set in Final DC Discovery Retry Setting is reached. + +The default value for this setting is 60 minutes (60*60). + +The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0. + +If the value for this setting is smaller than the value specified for the Initial DC Discovery Retry Setting, the Initial DC Discovery Retry Setting is used. + +> [!WARNING] +> If the value for this setting is too large, a client may take very long periods to try to find a DC. + +If the value for this setting is too small and the DC is not available, the frequent retries may produce excessive network traffic. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use maximum DC discovery retry interval setting for background callers* +- GP name: *Netlogon_BackgroundRetryMaximumPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines when retries are no longer allowed for applications that perform periodic searches for domain controllers (DC) are unable to find a DC. For example, retires may be set to occur according to the Use maximum DC discovery retry interval policy setting, but when the value set in this policy setting is reached, no more retries occur. If a value for this policy setting is smaller than the value in the Use maximum DC discovery retry interval policy setting, the value for Use maximum DC discovery retry interval policy setting is used. + +The default value for this setting is to not quit retrying (0). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0. + +> [!WARNING] +> If the value for this setting is too small, a client will stop trying to find a DC too soon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use final DC discovery retry setting for background callers* +- GP name: *Netlogon_BackgroundRetryQuitTime* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines when a successful DC cache entry is refreshed. This policy setting is applied to caller programs that periodically attempt to locate DCs, and it is applied before returning the DC information to the caller program. The default value for this setting is infinite (4294967200). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value is treated as infinity. The minimum value for this setting is to always refresh (0). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use positive periodic DC cache refresh for background callers* +- GP name: *Netlogon_BackgroundSuccessfulRefreshPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_DebugFlag** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the level of debug output for the Net Logon service. + +The Net Logon service outputs debug information to the log file netlogon.log in the directory %windir%\debug. By default, no debug information is logged. + +If you enable this policy setting and specify a non-zero value, debug information will be logged to the file. Higher values result in more verbose logging; the value of 536936447 is commonly used as an optimal setting. + +If you specify zero for this policy setting, the default behavior occurs as described above. + +If you disable this policy setting or do not configure it, the default behavior occurs as described above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify log file debug output level* +- GP name: *Netlogon_DebugFlag* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines which DC Locator DNS records are not registered by the Net Logon service. + +If you enable this policy setting, select Enabled and specify a list of space-delimited mnemonics (instructions) for the DC Locator DNS records that will not be registered by the DCs to which this setting is applied. + +Select the mnemonics from the following table: + +|Mnemonic|Type|DNS Record| +|--------|---------|-----------| +|LdapIpAddress|A|``| +|Ldap|SRV|_ldap._tcp.``| +|LdapAtSite|SRV|_ldap._tcp.``._sites.``| +|Pdc|SRV|_ldap._tcp.pdc._msdcs.``| +|Gc|SRV|_ldap._tcp.gc._msdcs.``| +|GcAtSite|SRV|_ldap._tcp.``._sites.gc._msdcs.``| +|DcByGuid|SRV|_ldap._tcp.``.domains._msdcs.``| +|GcIpAddress|A|gc._msdcs.``| +|DsaCname|CNAME|``._msdcs.``| +|Kdc|SRV|_kerberos._tcp.dc._msdcs.``| +|KdcAtSite|SRV|_kerberos._tcp.``._sites.dc._msdcs.| +|KdcAtSite|SRV|_kerberos._tcp.``._sites.dc._msdcs.``| +|Dc|SRV|_ldap._tcp.dc._msdcs.``| +|DcAtSite|SRV|_ldap._tcp.``._sites.dc._msdcs.``| +|Rfc1510Kdc|SRV|_kerberos._tcp.``| +|Rfc1510KdcAtSite|SRV|_kerberos._tcp.``._sites.``| +|GenericGc|SRV|_gc._tcp.``| +|GenericGcAtSite|SRV|_gc._tcp.``._sites.``| +|Rfc1510UdpKdc|SRV|_kerberos._udp.``| +|Rfc1510Kpwd|SRV|_kpasswd._tcp.``| +|Rfc1510UdpKpwd|SRV|_kpasswd._udp.``| + +If you disable this policy setting, DCs configured to perform dynamic registration of DC Locator DNS records register all DC Locator DNS resource records. + +If you do not configure this policy setting, DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify DC Locator DNS records not registered by the DCs* +- GP name: *Netlogon_DnsAvoidRegisterRecords* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_DnsRefreshInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the Refresh Interval of the DC Locator DNS resource records for DCs to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used by the DC Locator algorithm to locate the DC. This setting may be applied only to DCs using dynamic update. + +DCs configured to perform dynamic registration of the DC Locator DNS resource records periodically reregister their records with DNS servers, even if their records’ data has not changed. If authoritative DNS servers are configured to perform scavenging of the stale records, this reregistration is required to instruct the DNS servers configured to automatically remove (scavenge) stale records that these records are current and should be preserved in the database. + +> [!WARNING] +> If the DNS resource records are registered in zones with scavenging enabled, the value of this setting should never be longer than the Refresh Interval configured for these zones. Setting the Refresh Interval of the DC Locator DNS records to longer than the Refresh Interval of the DNS zones may result in the undesired deletion of DNS resource records. + +To specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes). + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify Refresh Interval of the DC Locator DNS records* +- GP name: *Netlogon_DnsRefreshInterval* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures whether the domain controllers to which this setting is applied will lowercase their DNS host name when registering SRV records. + +If enabled, domain controllers will lowercase their DNS host name when registering domain controller SRV records. A best-effort attempt will be made to delete any previously registered SRV records that contain mixed-case DNS host names. For more information and potential manual cleanup procedures, see the link below. + +If disabled, domain controllers will use their configured DNS host name as-is when registering domain controller SRV records. + +If not configured, domain controllers will default to using their local configuration. + +The default local configuration is enabled. + +A reboot is not required for changes to this setting to take effect. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use lowercase DNS host names when registering domain controller SRV records* +- GP name: *Netlogon_DnsSrvRecordUseLowerCaseHostNames* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_DnsTtl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the value for the Time-To-Live (TTL) field in SRV resource records that are registered by the Net Logon service. These DNS records are dynamically registered, and they are used to locate the domain controller (DC). + +To specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value "900" is 15 minutes). + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set TTL in the DC Locator DNS Records* +- GP name: *Netlogon_DnsTtl* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_ExpectedDialupDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the additional time for the computer to wait for the domain controller’s (DC) response when logging on to the network. + +To specify the expected dial-up delay at logon, click Enabled, and then enter the desired value in seconds (for example, the value "60" is 1 minute). + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify expected dial-up delay on logon* +- GP name: *Netlogon_ExpectedDialupDelay* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_ForceRediscoveryInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the interval for when a Force Rediscovery is carried out by DC Locator. + +The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domain. When DC Locator finds a domain controller, it caches domain controllers to improve the efficiency of the location algorithm. As long as the cached domain controller meets the requirements and is running, DC Locator will continue to return it. If a new domain controller is introduced, existing clients will only discover it when a Force Rediscovery is carried out by DC Locator. To adapt to changes in network conditions DC Locator will by default carry out a Force Rediscovery according to a specific time interval and maintain efficient load-balancing of clients across all available domain controllers in all domains or forests. The default time interval for Force Rediscovery by DC Locator is 12 hours. Force Rediscovery can also be triggered if a call to DC Locator uses the DS_FORCE_REDISCOVERY flag. Rediscovery resets the timer on the cached domain controller entries. + +If you enable this policy setting, DC Locator on the machine will carry out Force Rediscovery periodically according to the configured time interval. The minimum time interval is 3600 seconds (1 hour) to avoid excessive network traffic from rediscovery. The maximum allowed time interval is 4294967200 seconds, while any value greater than 4294967 seconds (~49 days) will be treated as infinity. + +If you disable this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval. + +If you do not configure this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval, unless the local machine setting in the registry is a different value. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force Rediscovery Interval* +- GP name: *Netlogon_ForceRediscoveryInterval* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_GcSiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the sites for which the global catalogs (GC) should register site-specific GC locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the GC resides, and records registered by a GC configured to register GC Locator DNS SRV records for those sites without a GC that are closest to it. + +The GC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the GC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. A GC is a domain controller that contains a partial replica of every domain in Active Directory. + +To specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format. + +If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify sites covered by the GC Locator DNS SRV Records* +- GP name: *Netlogon_GcSiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to control the processing of incoming mailslot messages by a local domain controller (DC). + +> [!NOTE] +> To locate a remote DC based on its NetBIOS (single-label) domain name, DC Locator first gets the list of DCs from a WINS server that is configured in its local client settings. DC Locator then sends a mailslot message to each remote DC to get more information. DC location succeeds only if a remote DC responds to the mailslot message. + +This policy setting is recommended to reduce the attack surface on a DC, and can be used in an environment without WINS, in an IPv6-only environment, and whenever DC location based on a NetBIOS domain name is not required. This policy setting does not affect DC location based on DNS names. + +If you enable this policy setting, this DC does not process incoming mailslot messages that are used for NetBIOS domain name based DC location. + +If you disable or do not configure this policy setting, this DC processes incoming mailslot messages. This is the default behavior of DC Locator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names* +- GP name: *Netlogon_IgnoreIncomingMailslotMessages* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_LdapSrvPriority** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the Priority field in the SRV resource records registered by domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used to locate the DC. + +The Priority field in the SRV record sets the preference for target hosts (specified in the SRV record’s Target field). DNS clients that query for SRV resource records attempt to contact the first reachable host with the lowest priority number listed. + +To specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is from 0 to 65535. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Priority in the DC Locator DNS SRV records* +- GP name: *Netlogon_LdapSrvPriority* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_LdapSrvWeight** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the Weight field in the SRV resource records registered by the domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. + +The Weight field in the SRV record can be used in addition to the Priority value to provide a load-balancing mechanism where multiple servers are specified in the SRV records Target field and are all set to the same priority. The probability with which the DNS client randomly selects the target host to be contacted is proportional to the Weight field value in the SRV record. + +To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 65535. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Weight in the DC Locator DNS SRV records* +- GP name: *Netlogon_LdapSrvWeight* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_MaximumLogFileSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled. + +By default, the maximum size of the log file is 20MB. If you enable this policy setting, the maximum size of the log file is set to the specified size. Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified. + +If you disable or do not configure this policy setting, the default behavior occurs as indicated above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify maximum log file size* +- GP name: *Netlogon_MaximumLogFileSize* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_NdncSiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the sites for which the domain controllers (DC) that host the application directory partition should register the site-specific, application directory partition-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. + +The application directory partition DC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the application directory partition-specific DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. + +To specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify sites covered by the application directory partition DC Locator DNS SRV records* +- GP name: *Netlogon_NdncSiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_NegativeCachePeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the amount of time (in seconds) the DC locator remembers that a domain controller (DC) could not be found in a domain. When a subsequent attempt to locate the DC occurs within the time set in this setting, DC Discovery immediately fails, without attempting to find the DC. + +The default value for this setting is 45 seconds. The maximum value for this setting is 7 days (7*24*60*60). The minimum value for this setting is 0. + +> [!WARNING] +> If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value for this setting is too small, clients will attempt to find DCs even when none are available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify negative DC Discovery cache setting* +- GP name: *Netlogon_NegativeCachePeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether or not the Netlogon share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications. + +If you enable this policy setting, the Netlogon share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission. + +If you disable or do not configure this policy setting, the Netlogon share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission. + +By default, the Netlogon share will grant shared read access to files on the share when exclusive access is requested. + +> [!NOTE] +> The Netlogon share is a share created by the Net Logon service for use by client machines in the domain. The default behavior of the Netlogon share ensures that no application with only read permission to files on the Netlogon share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Netlogon share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Netlogon share on the domain will be decreased. + +If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Netlogon share compatibility* +- GP name: *Netlogon_NetlogonShareCompatibilityMode* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines when a successful DC cache entry is refreshed. This policy setting is applied to caller programs that do not periodically attempt to locate DCs, and it is applied before the returning the DC information to the caller program. This policy setting is relevant to only those callers of DsGetDcName that have not specified the DS_BACKGROUND_ONLY flag. + +The default value for this setting is 30 minutes (1800). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value will be treated as infinity. The minimum value for this setting is to always refresh (0). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify positive periodic DC Cache refresh for non-background callers* +- GP name: *Netlogon_NonBackgroundSuccessfulRefreshPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_PingUrgencyMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures whether the computers to which this setting is applied are more aggressive when trying to locate a domain controller (DC). + +When an environment has a large number of DCs running both old and new operating systems, the default DC locator discovery behavior may be insufficient to find DCs running a newer operating system. This policy setting can be enabled to configure DC locator to be more aggressive about trying to locate a DC in such an environment, by pinging DCs at a higher frequency. Enabling this setting may result in additional network traffic and increased load on DCs. You should disable this setting once all DCs are running the same OS version. + +The allowable values for this setting result in the following behaviors: + +- 1 - Computers will ping DCs at the normal frequency. +- 2 - Computers will ping DCs at the higher frequency. + +To specify this behavior, click Enabled and then enter a value. The range of values is from 1 to 2. + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use urgent mode when pinging domain controllers* +- GP name: *Netlogon_PingUrgencyMode* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_ScavengeInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the interval at which Netlogon performs the following scavenging operations: + +- Checks if a password on a secure channel needs to be modified, and modifies it if necessary. + +- On the domain controllers (DC), discovers a DC that has not been discovered. + +- On the PDC, attempts to add the ``[1B] NetBIOS name if it hasn’t already been successfully added. + +None of these operations are critical. 15 minutes is optimal in all but extreme cases. For instance, if a DC is separated from a trusted domain by an expensive (e.g., ISDN) line, this parameter might be adjusted upward to avoid frequent automatic discovery of DCs in a trusted domain. + +To enable the setting, click Enabled, and then specify the interval in seconds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set scavenge interval* +- GP name: *Netlogon_ScavengeInterval* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_SiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the sites for which the domain controllers (DC) register the site-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. + +The DC Locator DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. + +To specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify sites covered by the DC Locator DNS SRV records* +- GP name: *Netlogon_SiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_SiteName** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the Active Directory site to which computers belong. + +An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. + +To specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory. + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify site name* +- GP name: *Netlogon_SiteName* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether or not the SYSVOL share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications. + +When this setting is enabled, the SYSVOL share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission. + +When this setting is disabled or not configured, the SYSVOL share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission. + +By default, the SYSVOL share will grant shared read access to files on the share when exclusive access is requested. + +> [!NOTE] +> The SYSVOL share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the SYSVOL share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the SYSVOL share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the SYSVOL share on the domain will be decreased. + +If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set SYSVOL share compatibility* +- GP name: *Netlogon_SysvolShareCompatibilityMode* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_TryNextClosestSite** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables DC Locator to attempt to locate a DC in the nearest site based on the site link cost if a DC in same the site is not found. In scenarios with multiple sites, failing over to the try next closest site during DC Location streamlines network traffic more effectively. + +The DC Locator service is used by clients to find domain controllers for their Active Directory domain. The default behavior for DC Locator is to find a DC in the same site. If none are found in the same site, a DC in another site, which might be several site-hops away, could be returned by DC Locator. Site proximity between two sites is determined by the total site-link cost between them. A site is closer if it has a lower site link cost than another site with a higher site link cost. + +If you enable this policy setting, Try Next Closest Site DC Location will be turned on for the computer. + +If you disable this policy setting, Try Next Closest Site DC Location will not be used by default for the computer. However, if a DC Locator call is made using the DS_TRY_NEXTCLOSEST_SITE flag explicitly, the Try Next Closest Site behavior is honored. + +If you do not configure this policy setting, Try Next Closest Site DC Location will not be used by default for the machine. If the DS_TRY_NEXTCLOSEST_SITE flag is used explicitly, the Next Closest Site behavior will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Try Next Closest Site* +- GP name: *Netlogon_TryNextClosestSite* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +
          + + +**ADMX_Netlogon/Netlogon_UseDynamicDns** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines if dynamic registration of the domain controller (DC) locator DNS resource records is enabled. These DNS records are dynamically registered by the Net Logon service and are used by the Locator algorithm to locate the DC. + +If you enable this policy setting, DCs to which this setting is applied dynamically register DC Locator DNS resource records through dynamic DNS update-enabled network connections. + +If you disable this policy setting, DCs will not register DC Locator DNS resource records. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify dynamic registration of the DC Locator DNS Records* +- GP name: *Netlogon_UseDynamicDns* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md new file mode 100644 index 0000000000..b2d54403e7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -0,0 +1,2199 @@ +--- +title: Policy CSP - ADMX_NetworkConnections +description: Policy CSP - ADMX_NetworkConnections +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_NetworkConnections + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_NetworkConnections policies + +
          +
          + ADMX_NetworkConnections/NC_AddRemoveComponents +
          +
          + ADMX_NetworkConnections/NC_AdvancedSettings +
          +
          + ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig +
          +
          + ADMX_NetworkConnections/NC_ChangeBindState +
          +
          + ADMX_NetworkConnections/NC_DeleteAllUserConnection +
          +
          + ADMX_NetworkConnections/NC_DeleteConnection +
          +
          + ADMX_NetworkConnections/NC_DialupPrefs +
          +
          + ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon +
          +
          + ADMX_NetworkConnections/NC_EnableAdminProhibits +
          +
          + ADMX_NetworkConnections/NC_ForceTunneling +
          +
          + ADMX_NetworkConnections/NC_IpStateChecking +
          +
          + ADMX_NetworkConnections/NC_LanChangeProperties +
          +
          + ADMX_NetworkConnections/NC_LanConnect +
          +
          + ADMX_NetworkConnections/NC_LanProperties +
          +
          + ADMX_NetworkConnections/NC_NewConnectionWizard +
          +
          + ADMX_NetworkConnections/NC_PersonalFirewallConfig +
          +
          + ADMX_NetworkConnections/NC_RasAllUserProperties +
          +
          + ADMX_NetworkConnections/NC_RasChangeProperties +
          +
          + ADMX_NetworkConnections/NC_RasConnect +
          +
          + ADMX_NetworkConnections/NC_RasMyProperties +
          +
          + ADMX_NetworkConnections/NC_RenameAllUserRasConnection +
          +
          + ADMX_NetworkConnections/NC_RenameConnection +
          +
          + ADMX_NetworkConnections/NC_RenameLanConnection +
          +
          + ADMX_NetworkConnections/NC_RenameMyRasConnection +
          +
          + ADMX_NetworkConnections/NC_ShowSharedAccessUI +
          +
          + ADMX_NetworkConnections/NC_Statistics +
          +
          + ADMX_NetworkConnections/NC_StdDomainUserSetLocation +
          +
          + + +
          + + +**ADMX_NetworkConnections/NC_AddRemoveComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether administrators can add and remove network components for a LAN or remote access connection. This setting has no effect on nonadministrators. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Install and Uninstall buttons for components of connections are disabled, and administrators are not permitted to access network components in the Windows Components Wizard. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Install and Uninstall buttons for components of connections in the Network Connections folder are enabled. Also, administrators can gain access to network components in the Windows Components Wizard. + +The Install button opens the dialog boxes used to add network components. Clicking the Uninstall button removes the selected component in the components list (above the button). + +The Install and Uninstall buttons appear in the properties dialog box for connections. These buttons are on the General tab for LAN connections and on the Networking tab for remote access connections. + +> [!NOTE] +> When the "Prohibit access to properties of a LAN connection", "Ability to change properties of an all user remote access connection", or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the connection properties dialog box, the Install and Uninstall buttons for connections are blocked. +> +> Nonadministrators are already prohibited from adding and removing connection components, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adding and removing components for a LAN or remote access connection* +- GP name: *NC_AddRemoveComponents* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_AdvancedSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the Advanced Settings item on the Advanced menu in Network Connections is enabled for administrators. + +The Advanced Settings item lets users view and change bindings and view and change the order in which the computer accesses connections, network providers, and print providers. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Advanced Settings item is disabled for administrators. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Advanced Settings item is enabled for administrators. + +> [!NOTE] +> Nonadministrators are already prohibited from accessing the Advanced Settings dialog box, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to the Advanced Settings item on the Advanced menu* +- GP name: *NC_AdvancedSettings* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can configure advanced TCP/IP settings. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Advanced button on the Internet Protocol (TCP/IP) Properties dialog box is disabled for all users (including administrators). As a result, users cannot open the Advanced TCP/IP Settings Properties page and modify IP settings, such as DNS and WINS server information. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting, the Advanced button is enabled, and all users can open the Advanced TCP/IP Setting dialog box. + +This setting is superseded by settings that prohibit access to properties of connections or connection components. When these policies are set to deny access to the connection properties dialog box or Properties button for connection components, users cannot gain access to the Advanced button for TCP/IP configuration. + +Changing this setting from Enabled to Not Configured does not enable the Advanced button until the user logs off. + +> [!NOTE] +> Nonadministrators (excluding Network Configuration Operators) do not have permission to access TCP/IP advanced configuration for a LAN connection, regardless of this setting. + +> [!TIP] +> To open the Advanced TCP/IP Setting dialog box, in the Network Connections folder, right-click a connection icon, and click Properties. For remote access connections, click the Networking tab. In the "Components checked are used by this connection" box, click Internet Protocol (TCP/IP), click the Properties button, and then click the Advanced button. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit TCP/IP advanced configuration* +- GP name: *NC_AllowAdvancedTCPIPConfig* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_ChangeBindState** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting Determines whether administrators can enable and disable the components used by LAN connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the check boxes for enabling and disabling components are disabled. As a result, administrators cannot enable or disable the components that a connection uses. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Properties dialog box for a connection includes a check box beside the name of each component that the connection uses. Selecting the check box enables the component, and clearing the check box disables the component. + +> [!NOTE] +> When the "Prohibit access to properties of a LAN connection" setting is enabled, users are blocked from accessing the check boxes for enabling and disabling the components of a LAN connection. +> +> Nonadministrators are already prohibited from enabling or disabling components for a LAN connection, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit Enabling/Disabling components of a LAN connection* +- GP name: *NC_ChangeBindState* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_DeleteAllUserConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can delete all user remote access connections. + +To create an all-user remote access connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option. + +If you enable this setting, all users can delete shared remote access connections. In addition, if your file system is NTFS, users need to have Write access to Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk to delete a shared remote access connection. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), users (including administrators) cannot delete all-user remote access connections. (By default, users can still delete their private connections, but you can change the default by using the "Prohibit deletion of remote access connections" setting.) + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you do not configure this setting, only Administrators and Network Configuration Operators can delete all user remote access connections. + +When enabled, the "Prohibit deletion of remote access connections" setting takes precedence over this setting. Users (including administrators) cannot delete any remote access connections, and this setting is ignored. + +> [!NOTE] +> LAN connections are created and deleted automatically by the system when a LAN adapter is installed or removed. You cannot use the Network Connections folder to create or delete a LAN connection. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to delete all user remote access connections* +- GP name: *NC_DeleteAllUserConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_DeleteConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can delete remote access connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), users (including administrators) cannot delete any remote access connections. This setting also disables the Delete option on the context menu for a remote access connection and on the File menu in the Network Connections folder. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, all users can delete their private remote access connections. Private connections are those that are available only to one user. (By default, only Administrators and Network Configuration Operators can delete connections available to all users, but you can change the default by using the "Ability to delete all user remote access connections" setting.) + +When enabled, this setting takes precedence over the "Ability to delete all user remote access connections" setting. Users cannot delete any remote access connections, and the "Ability to delete all user remote access connections" setting is ignored. + +> [!NOTE] +> LAN connections are created and deleted automatically when a LAN adapter is installed or removed. You cannot use the Network Connections folder to create or delete a LAN connection. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit deletion of remote access connections* +- GP name: *NC_DeleteConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_DialupPrefs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the Remote Access Preferences item on the Advanced menu in Network Connections folder is enabled. + +The Remote Access Preferences item lets users create and change connections before logon and configure automatic dialing and callback features. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Remote Access Preferences item is disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Remote Access Preferences item is enabled for all users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to the Remote Access Preferences item on the Advanced menu* +- GP name: *NC_DialupPrefs* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether or not the "local access only" network icon will be shown. + +When enabled, the icon for Internet access will be shown in the system tray even when a user is connected to a network with local access only. + +If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not show the "local access only" network icon* +- GP name: *NC_DoNotShowLocalOnlyIcon* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_EnableAdminProhibits** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether settings that existed in Windows 2000 Server family will apply to Administrators. + +The set of Network Connections group settings that existed in Windows 2000 Professional also exists in Windows XP Professional. In Windows 2000 Professional, all of these settings had the ability to prohibit the use of certain features from Administrators. + +By default, Network Connections group settings in Windows XP Professional do not have the ability to prohibit the use of features from Administrators. + +If you enable this setting, the Windows XP settings that existed in Windows 2000 Professional will have the ability to prohibit Administrators from using certain features. These settings are "Ability to rename LAN connections or remote access connections available to all users", "Prohibit access to properties of components of a LAN connection", "Prohibit access to properties of components of a remote access connection", "Ability to access TCP/IP advanced configuration", "Prohibit access to the Advanced Settings Item on the Advanced Menu", "Prohibit adding and removing components for a LAN or remote access connection", "Prohibit access to properties of a LAN connection", "Prohibit Enabling/Disabling components of a LAN connection", "Ability to change properties of an all user remote access connection", "Prohibit changing properties of a private remote access connection", "Prohibit deletion of remote access connections", "Ability to delete all user remote access connections", "Prohibit connecting and disconnecting a remote access connection", "Ability to Enable/Disable a LAN connection", "Prohibit access to the New Connection Wizard", "Prohibit renaming private remote access connections", "Prohibit access to the Remote Access Preferences item on the Advanced menu", "Prohibit viewing of status for an active connection". When this setting is enabled, settings that exist in both Windows 2000 Professional and Windows XP Professional behave the same for administrators. + +If you disable this setting or do not configure it, Windows XP settings that existed in Windows 2000 will not apply to administrators. + +> [!NOTE] +> This setting is intended to be used in a situation in which the Group Policy object that these settings are being applied to contains both Windows 2000 Professional and Windows XP Professional computers, and identical Network Connections policy behavior is required between all Windows 2000 Professional and Windows XP Professional computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows 2000 Network Connections settings for Administrators* +- GP name: *NC_EnableAdminProhibits* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_ForceTunneling** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether a remote client computer routes Internet traffic through the internal network or whether the client accesses the Internet directly. + +When a remote client computer connects to an internal network using DirectAccess, it can access the Internet in two ways: through the secure tunnel that DirectAccess establishes between the computer and the internal network, or directly through the local default gateway. + +If you enable this policy setting, all traffic between a remote client computer running DirectAccess and the Internet is routed through the internal network. + +If you disable this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network. + +If you do not configure this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Route all traffic through the internal network* +- GP name: *NC_ForceTunneling* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_IpStateChecking** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether notifications are shown to the user when a DHCP-configured connection is unable to retrieve an IP address from a DHCP server. This is often signified by the assignment of an automatic private IP address"(i.e. an IP address in the range 169.254.*.*). This indicates that a DHCP server could not be reached or the DHCP server was reached but unable to respond to the request with a valid IP address. By default, a notification is displayed providing the user with information on how the problem can be resolved. + +If you enable this policy setting, this condition will not be reported as an error to the user. + +If you disable or do not configure this policy setting, a DHCP-configured connection that has not been assigned an IP address will be reported via a notification, providing the user with information as to how the problem can be resolved. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off notifications when a connection has only limited or no connectivity* +- GP name: *NC_IpStateChecking* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_LanChangeProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Administrators and Network Configuration Operators can change the properties of components used by a LAN connection. + +This setting determines whether the Properties button for components of a LAN connection is enabled. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties button is disabled for Administrators. Network Configuration Operators are prohibited from accessing connection components, regardless of the "Enable Network Connections settings for Administrators" setting. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting does not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Properties button is enabled for administrators and Network Configuration Operators. + +The Local Area Connection Properties dialog box includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list. + +> [!NOTE] +> Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled. +> +> When the "Prohibit access to properties of a LAN connection" setting is enabled, users are blocked from accessing the Properties button for LAN connection components. +> +> Network Configuration Operators only have permission to change TCP/IP properties. Properties for all other components are unavailable to these users. +> +> Nonadministrators are already prohibited from accessing properties of components for a LAN connection, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to properties of components of a LAN connection* +- GP name: *NC_LanChangeProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_LanConnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can enable/disable LAN connections. + +If you enable this setting, the Enable and Disable options for LAN connections are available to users (including nonadministrators). Users can enable/disable a LAN connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), double-clicking the icon has no effect, and the Enable and Disable menu items are disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you do not configure this setting, only Administrators and Network Configuration Operators can enable/disable LAN connections. + +> [!NOTE] +> Administrators can still enable/disable LAN connections from Device Manager when this setting is disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to Enable/Disable a LAN connection* +- GP name: *NC_LanConnect* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_LanProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can change the properties of a LAN connection. + +This setting determines whether the Properties menu item is enabled, and thus, whether the Local Area Connection Properties dialog box is available to users. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled for all users, and users cannot open the Local Area Connection Properties dialog box. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, a Properties menu item appears when users right-click the icon representing a LAN connection. Also, when users select the connection, Properties is enabled on the File menu. + +> [!NOTE] +> This setting takes precedence over settings that manipulate the availability of features inside the Local Area Connection Properties dialog box. If this setting is enabled, nothing within the properties dialog box for a LAN connection is available to users. +> +> Nonadministrators have the right to view the properties dialog box for a connection but not to make changes, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to properties of a LAN connection* +- GP name: *NC_LanProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_NewConnectionWizard** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can use the New Connection Wizard, which creates new network connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Make New Connection icon does not appear in the Start Menu on in the Network Connections folder. As a result, users (including administrators) cannot start the New Connection Wizard. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Make New Connection icon appears in the Start menu and in the Network Connections folder for all users. Clicking the Make New Connection icon starts the New Connection Wizard. + +> [!NOTE] +> Changing this setting from Enabled to Not Configured does not restore the Make New Connection icon until the user logs off or on. When other changes to this setting are applied, the icon does not appear or disappear in the Network Connections folder until the folder is refreshed. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to the New Connection Wizard* +- GP name: *NC_NewConnectionWizard* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_PersonalFirewallConfig** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits use of Internet Connection Firewall on your DNS domain network. + +Determines whether users can enable the Internet Connection Firewall feature on a connection, and if the Internet Connection Firewall service can run on a computer. + +> [!IMPORTANT] +> This setting is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply. + +The Internet Connection Firewall is a stateful packet filter for home and small office users to protect them from Internet network security threats. + +If you enable this setting, Internet Connection Firewall cannot be enabled or configured by users (including administrators), and the Internet Connection Firewall service cannot run on the computer. The option to enable the Internet Connection Firewall through the Advanced tab is removed. In addition, the Internet Connection Firewall is not enabled for remote access connections created through the Make New Connection Wizard. The Network Setup Wizard is disabled. + +If you enable the "Windows Firewall: Protect all network connections" policy setting, the "Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting has no effect on computers that are running Windows Firewall, which replaces Internet Connection Firewall when you install Windows XP Service Pack 2. + +If you disable this setting or do not configure it, the Internet Connection Firewall is disabled when a LAN Connection or VPN connection is created, but users can use the Advanced tab in the connection properties to enable it. The Internet Connection Firewall is enabled by default on the connection for which Internet Connection Sharing is enabled. In addition, remote access connections created through the Make New Connection Wizard have the Internet Connection Firewall enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit use of Internet Connection Firewall on your DNS domain network* +- GP name: *NC_PersonalFirewallConfig* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RasAllUserProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether a user can view and change the properties of remote access connections that are available to all users of the computer. + +To create an all-user remote access connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option. + +This setting determines whether the Properties menu item is enabled, and thus, whether the Remote Access Connection Properties dialog box is available to users. + +If you enable this setting, a Properties menu item appears when any user right-clicks the icon for a remote access connection. Also, when any user selects the connection, Properties appears on the File menu. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled, and users (including administrators) cannot open the remote access connection properties dialog box. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you do not configure this setting, only Administrators and Network Configuration Operators can change properties of all-user remote access connections. + +> [!NOTE] +> This setting takes precedence over settings that manipulate the availability of features inside the Remote Access Connection Properties dialog box. If this setting is disabled, nothing within the properties dialog box for a remote access connection will be available to users. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to change properties of an all user remote access connection* +- GP name: *NC_RasAllUserProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RasChangeProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can view and change the properties of components used by a private or all-user remote access connection. + +This setting determines whether the Properties button for components used by a private or all-user remote access connection is enabled. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties button is disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting does not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Properties button is enabled for all users. + +The Networking tab of the Remote Access Connection Properties dialog box includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list. + +> [NOTE] +> Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled. +> +> When the "Ability to change properties of an all user remote access connection" or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the Remote Access Connection Properties dialog box, the Properties button for remote access connection components is blocked. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to properties of components of a remote access connection* +- GP name: *NC_RasChangeProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RasConnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can connect and disconnect remote access connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), double-clicking the icon has no effect, and the Connect and Disconnect menu items are disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Connect and Disconnect options for remote access connections are available to all users. Users can connect or disconnect a remote access connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit connecting and disconnecting a remote access connection* +- GP name: *NC_RasConnect* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RasMyProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can view and change the properties of their private remote access connections. + +Private connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the New Connection Wizard, click the "Only for myself" option. + +This setting determines whether the Properties menu item is enabled, and thus, whether the Remote Access Connection Properties dialog box for a private connection is available to users. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled, and no users (including administrators) can open the Remote Access Connection Properties dialog box for a private connection. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, a Properties menu item appears when any user right-clicks the icon representing a private remote access connection. Also, when any user selects the connection, Properties appears on the File menu. + +> [!NOTE] +> This setting takes precedence over settings that manipulate the availability of features in the Remote Access Connection Properties dialog box. If this setting is enabled, nothing within the properties dialog box for a remote access connection will be available to users. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit changing properties of a private remote access connection* +- GP name: *NC_RasMyProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RenameAllUserRasConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether nonadministrators can rename all-user remote access connections. + +To create an all-user connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option. + +If you enable this setting, the Rename option is enabled for all-user remote access connections. Any user can rename all-user connections by clicking an icon representing the connection or by using the File menu. + +If you disable this setting, the Rename option is disabled for nonadministrators only. + +If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections. + +> [!NOTE] +> This setting does not apply to Administrators. + +When the "Ability to rename LAN connections or remote access connections available to all users" setting is configured (set to either Enabled or Disabled), this setting does not apply. + +This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to rename all user remote access connections* +- GP name: *NC_RenameAllUserRasConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RenameConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting Determines whether users can rename LAN or all user remote access connections. + +If you enable this setting, the Rename option is enabled for all users. Users can rename connections by clicking the icon representing a connection or by using the File menu. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Rename option for LAN and all user remote access connections is disabled for all users (including Administrators and Network Configuration Operators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If this setting is not configured, only Administrators and Network Configuration Operators have the right to rename LAN or all user remote access connections. + +> [!NOTE] +> When configured, this setting always takes precedence over the "Ability to rename LAN connections" and "Ability to rename all user remote access connections" settings. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to rename remote access connections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to rename LAN connections or remote access connections available to all users* +- GP name: *NC_RenameConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RenameLanConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether nonadministrators can rename a LAN connection. + +If you enable this setting, the Rename option is enabled for LAN connections. Nonadministrators can rename LAN connections by clicking an icon representing the connection or by using the File menu. + +If you disable this setting, the Rename option is disabled for nonadministrators only. + +If you do not configure this setting, only Administrators and Network Configuration Operators can rename LAN connections + +> [!NOTE] +> This setting does not apply to Administrators. + +When the "Ability to rename LAN connections or remote access connections available to all users" setting is configured (set to either enabled or disabled), this setting does not apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to rename LAN connections* +- GP name: *NC_RenameLanConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_RenameMyRasConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can rename their private remote access connections. + +Private connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the New Connection Wizard, click the "Only for myself" option. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Rename option is disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Rename option is enabled for all users' private remote access connections. Users can rename their private connection by clicking an icon representing the connection or by using the File menu. + +> [!NOTE] +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit renaming private remote access connections* +- GP name: *NC_RenameMyRasConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_ShowSharedAccessUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connection and if the ICS service can run on the computer. + +ICS lets administrators configure their system as an Internet gateway for a small network and provides network services, such as name resolution and addressing through DHCP, to the local private network. + +If you enable this setting, ICS cannot be enabled or configured by administrators, and the ICS service cannot run on the computer. The Advanced tab in the Properties dialog box for a LAN or remote access connection is removed. The Internet Connection Sharing page is removed from the New Connection Wizard. The Network Setup Wizard is disabled. + +If you disable this setting or do not configure it and have two or more connections, administrators can enable ICS. The Advanced tab in the properties dialog box for a LAN or remote access connection is available. In addition, the user is presented with the option to enable Internet Connection Sharing in the Network Setup Wizard and Make New Connection Wizard. (The Network Setup Wizard is available only in Windows XP Professional.) + +By default, ICS is disabled when you create a remote access connection, but administrators can use the Advanced tab to enable it. When running the New Connection Wizard or Network Setup Wizard, administrators can choose to enable ICS. + +> [!NOTE] +> Internet Connection Sharing is only available when two or more network connections are present. + +When the "Prohibit access to properties of a LAN connection," "Ability to change properties of an all user remote access connection," or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the Connection Properties dialog box, the Advanced tab for the connection is blocked. + +Nonadministrators are already prohibited from configuring Internet Connection Sharing, regardless of this setting. + +Disabling this setting does not prevent Wireless Hosted Networking from using the ICS service for DHCP services. To prevent the ICS service from running, on the Network Permissions tab in the network's policy properties, select the "Don't use hosted networks" check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit use of Internet Connection Sharing on your DNS domain network* +- GP name: *NC_ShowSharedAccessUI* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_Statistics** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can view the status for an active connection. + +Connection status is available from the connection status taskbar icon or from the Status dialog box. The Status dialog box displays information about the connection and its activity. It also provides buttons to disconnect and to configure the properties of the connection. + +If you enable this setting, the connection status taskbar icon and Status dialog box are not available to users (including administrators). The Status option is disabled in the context menu for the connection and on the File menu in the Network Connections folder. Users cannot choose to show the connection icon in the taskbar from the Connection Properties dialog box. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the connection status taskbar icon and Status dialog box are available to all users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit viewing of status for an active connection* +- GP name: *NC_Statistics* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + + +**ADMX_NetworkConnections/NC_StdDomainUserSetLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether to require domain users to elevate when setting a network's location. + +If you enable this policy setting, domain users must elevate when setting a network's location. + +If you disable or do not configure this policy setting, domain users can set a network's location without elevating. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require domain users to elevate when setting a network's location* +- GP name: *NC_StdDomainUserSetLocation* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md new file mode 100644 index 0000000000..abd5e758fc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -0,0 +1,3704 @@ +--- +title: Policy CSP - ADMX_OfflineFiles +description: Policy CSP - ADMX_OfflineFiles +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_OfflineFiles +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_OfflineFiles policies + +
          +
          + ADMX_OfflineFiles/Pol_AlwaysPinSubFolders +
          +
          + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1 +
          +
          + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2 +
          +
          + ADMX_OfflineFiles/Pol_BackgroundSyncSettings +
          +
          + ADMX_OfflineFiles/Pol_CacheSize +
          +
          + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1 +
          +
          + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2 +
          +
          + ADMX_OfflineFiles/Pol_DefCacheSize +
          +
          + ADMX_OfflineFiles/Pol_Enabled +
          +
          + ADMX_OfflineFiles/Pol_EncryptOfflineFiles +
          +
          + ADMX_OfflineFiles/Pol_EventLoggingLevel_1 +
          +
          + ADMX_OfflineFiles/Pol_EventLoggingLevel_2 +
          +
          + ADMX_OfflineFiles/Pol_ExclusionListSettings +
          +
          + ADMX_OfflineFiles/Pol_ExtExclusionList +
          +
          + ADMX_OfflineFiles/Pol_GoOfflineAction_1 +
          +
          + ADMX_OfflineFiles/Pol_GoOfflineAction_2 +
          +
          + ADMX_OfflineFiles/Pol_NoCacheViewer_1 +
          +
          + ADMX_OfflineFiles/Pol_NoCacheViewer_2 +
          +
          + ADMX_OfflineFiles/Pol_NoConfigCache_1 +
          +
          + ADMX_OfflineFiles/Pol_NoConfigCache_2 +
          +
          + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1 +
          +
          + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2 +
          +
          + ADMX_OfflineFiles/Pol_NoPinFiles_1 +
          +
          + ADMX_OfflineFiles/Pol_NoPinFiles_2 +
          +
          + ADMX_OfflineFiles/Pol_NoReminders_1 +
          +
          + ADMX_OfflineFiles/Pol_NoReminders_2 +
          +
          + ADMX_OfflineFiles/Pol_OnlineCachingSettings +
          +
          + ADMX_OfflineFiles/Pol_PurgeAtLogoff +
          +
          + ADMX_OfflineFiles/Pol_QuickAdimPin +
          +
          + ADMX_OfflineFiles/Pol_ReminderFreq_1 +
          +
          + ADMX_OfflineFiles/Pol_ReminderFreq_2 +
          +
          + ADMX_OfflineFiles/Pol_ReminderInitTimeout_1 +
          +
          + ADMX_OfflineFiles/Pol_ReminderInitTimeout_2 +
          +
          + ADMX_OfflineFiles/Pol_ReminderTimeout_1 +
          +
          + ADMX_OfflineFiles/Pol_ReminderTimeout_2 +
          +
          + ADMX_OfflineFiles/Pol_SlowLinkSettings +
          +
          + ADMX_OfflineFiles/Pol_SlowLinkSpeed +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogoff_1 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogoff_2 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogon_1 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtLogon_2 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtSuspend_1 +
          +
          + ADMX_OfflineFiles/Pol_SyncAtSuspend_2 +
          +
          + ADMX_OfflineFiles/Pol_SyncOnCostedNetwork +
          +
          + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1 +
          +
          + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2 +
          +
          + + +
          + + +**ADMX_OfflineFiles/Pol_AlwaysPinSubFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting makes subfolders available offline whenever their parent folder is made available offline. + +This setting automatically extends the "make available offline" setting to all new and existing subfolders of a folder. Users do not have the option of excluding subfolders. + +If you enable this setting, when you make a folder available offline, all folders within that folder are also made available offline. Also, new folders that you create within a folder that is available offline are made available offline when the parent folder is synchronized. + +If you disable this setting or do not configure it, the system asks users whether they want subfolders to be made available offline when they make a parent folder available offline. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Subfolders always available offline* +- GP name: *Pol_AlwaysPinSubFolders* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lists network files and folders that are always available for offline use. This ensures that the specified files and folders are available offline to users of the computer. + +If you enable this policy setting, the files you enter are always available offline to users of the computer. To specify a file or folder, click Show. In the Show Contents dialog box in the Value Name column, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files or folders made always available offline (including those inherited from lower precedence GPOs) is deleted and no files or folders are made available for offline use by Group Policy (though users can still specify their own files and folders for offline use). + +If you do not configure this policy setting, no files or folders are made available for offline use by Group Policy. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings will be combined and all specified files will be available for offline use. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify administratively assigned Offline Files* +- GP name: *Pol_AssignedOfflineFiles_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lists network files and folders that are always available for offline use. This ensures that the specified files and folders are available offline to users of the computer. + +If you enable this policy setting, the files you enter are always available offline to users of the computer. To specify a file or folder, click Show. In the Show Contents dialog box in the Value Name column, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files or folders made always available offline (including those inherited from lower precedence GPOs) is deleted and no files or folders are made available for offline use by Group Policy (though users can still specify their own files and folders for offline use). + +If you do not configure this policy setting, no files or folders are made available for offline use by Group Policy. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings will be combined and all specified files will be available for offline use. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify administratively assigned Offline Files* +- GP name: *Pol_AssignedOfflineFiles_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_BackgroundSyncSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls when background synchronization occurs while operating in slow-link mode, and applies to any user who logs onto the specified machine while this policy is in effect. To control slow-link mode, use the "Configure slow-link mode" policy setting. + +If you enable this policy setting, you can control when Windows synchronizes in the background while operating in slow-link mode. Use the 'Sync Interval' and 'Sync Variance' values to override the default sync interval and variance settings. Use 'Blockout Start Time' and 'Blockout Duration' to set a period of time where background sync is disabled. Use the 'Maximum Allowed Time Without A Sync' value to ensure that all network folders on the machine are synchronized with the server on a regular basis. + +You can also configure Background Sync for network shares that are in user selected Work Offline mode. This mode is in effect when a user selects the Work Offline button for a specific share. When selected, all configured settings will apply to shares in user selected Work Offline mode as well. + +If you disable or do not configure this policy setting, Windows performs a background sync of offline folders in the slow-link mode at a default interval with the start of the sync varying between 0 and 60 additional minutes. In Windows 7 and Windows Server 2008 R2, the default sync interval is 360 minutes. In Windows 8 and Windows Server 2012, the default sync interval is 120 minutes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Background Sync* +- GP name: *Pol_BackgroundSyncSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_CacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting limits the amount of disk space that can be used to store offline files. This includes the space used by automatically cached files and files that are specifically made available offline. Files can be automatically cached if the user accesses a file on an automatic caching network share. + +This setting also disables the ability to adjust, through the Offline Files control panel applet, the disk space limits on the Offline Files cache. This prevents users from trying to change the option while a policy setting controls it. + +If you enable this policy setting, you can specify the disk space limit (in megabytes) for offline files and also specify how much of that disk space can be used by automatically cached files. + +If you disable this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located. The limit for automatically cached files is 100 percent of the total disk space limit. + +If you do not configure this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located. The limit for automatically cached files is 100 percent of the total disk space limit. However, the users can change these values using the Offline Files control applet. + +If you enable this setting and specify a total size limit greater than the size of the drive hosting the Offline Files cache, and that drive is the system drive, the total size limit is automatically adjusted downward to 75 percent of the size of the drive. If the cache is located on a drive other than the system drive, the limit is automatically adjusted downward to 100 percent of the size of the drive. + +If you enable this setting and specify a total size limit less than the amount of space currently used by the Offline Files cache, the total size limit is automatically adjusted upward to the amount of space currently used by offline files. The cache is then considered full. + +If you enable this setting and specify an auto-cached space limit greater than the total size limit, the auto-cached limit is automatically adjusted downward to equal the total size limit. + +This setting replaces the Default Cache Size setting used by pre-Windows Vista systems. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit disk space used by Offline Files* +- GP name: *Pol_CacheSize* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_CustomGoOfflineActions_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_CustomGoOfflineActions_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_DefCacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Limits the percentage of the computer's disk space that can be used to store automatically cached offline files. + +This setting also disables the "Amount of disk space to use for temporary offline files" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +Automatic caching can be set on any network share. When a user opens a file on the share, the system automatically stores a copy of the file on the user's computer. + +This setting does not limit the disk space available for files that user's make available offline manually. + +If you enable this setting, you can specify an automatic-cache disk space limit. + +If you disable this setting, the system limits the space that automatically cached files occupy to 10 percent of the space on the system drive. + +If you do not configure this setting, disk space for automatically cached files is limited to 10 percent of the system drive by default, but users can change it. + +> [!TIP] +> To change the amount of disk space used for automatic caching without specifying a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then use the slider bar associated with the "Amount of disk space to use for temporary offline files" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default cache size* +- GP name: *Pol_DefCacheSize* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_Enabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185.This policy setting determines whether the Offline Files feature is enabled. Offline Files saves a copy of network files on the user's computer for use when the computer is not connected to the network. + +If you enable this policy setting, Offline Files is enabled and users cannot disable it. + +If you disable this policy setting, Offline Files is disabled and users cannot enable it. + +If you do not configure this policy setting, Offline Files is enabled on Windows client computers, and disabled on computers running Windows Server, unless changed by the user. + +> [!NOTE] +> Changes to this policy setting do not take effect until the affected computer is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow or Disallow use of the Offline Files feature* +- GP name: *Pol_Enabled* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_EncryptOfflineFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are encrypted. + +Offline files are locally cached copies of files from a network share. Encrypting this cache reduces the likelihood that a user could access files from the Offline Files cache without proper permissions. + +If you enable this policy setting, all files in the Offline Files cache are encrypted. This includes existing files as well as files added later. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot unencrypt Offline Files through the user interface. + +If you disable this policy setting, all files in the Offline Files cache are unencrypted. This includes existing files as well as files added later, even if the files were stored using NTFS encryption or BitLocker Drive Encryption while on the server. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot encrypt Offline Files through the user interface. + +If you do not configure this policy setting, encryption of the Offline Files cache is controlled by the user through the user interface. The current cache state is retained, and if the cache is only partially encrypted, the operation completes so that it is fully encrypted. The cache does not return to the unencrypted state. The user must be an administrator on the local computer to encrypt or decrypt the Offline Files cache. + +> [!NOTE] +> By default, this cache is protected on NTFS partitions by ACLs. + +This setting is applied at user logon. If this setting is changed after user logon then user logoff and logon is required for this setting to take effect. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Encrypt the Offline Files cache* +- GP name: *Pol_EncryptOfflineFiles* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_EventLoggingLevel_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines which events the Offline Files feature records in the event log. + +Offline Files records events in the Application log in Event Viewer when it detects errors. By default, Offline Files records an event only when the offline files storage cache is corrupted. However, you can use this setting to specify additional events you want Offline Files to record. + +To use this setting, in the "Enter" box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels. + +- "0" records an error when the offline storage cache is corrupted. + +- "1" also records an event when the server hosting the offline file is disconnected from the network. + +- "2" also records events when the local computer is connected and disconnected from the network. + +- "3" also records an event when the server hosting the offline file is reconnected to the network. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event logging level* +- GP name: *Pol_EventLoggingLevel_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_EventLoggingLevel_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines which events the Offline Files feature records in the event log. + +Offline Files records events in the Application log in Event Viewer when it detects errors. By default, Offline Files records an event only when the offline files storage cache is corrupted. However, you can use this setting to specify additional events you want Offline Files to record. + +To use this setting, in the "Enter" box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels. + +- "0" records an error when the offline storage cache is corrupted. + +- "1" also records an event when the server hosting the offline file is disconnected from the network. + +- "2" also records events when the local computer is connected and disconnected from the network. + +- "3" also records an event when the server hosting the offline file is reconnected to the network. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event logging level* +- GP name: *Pol_EventLoggingLevel_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ExclusionListSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables administrators to block certain file types from being created in the folders that have been made available offline. + +If you enable this policy setting, a user will be unable to create files with the specified file extensions in any of the folders that have been made available offline. + +If you disable or do not configure this policy setting, a user can create a file of any type in the folders that have been made available offline. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable file screens* +- GP name: *Pol_ExclusionListSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ExtExclusionList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Lists types of files that cannot be used offline. + +This setting lets you exclude certain types of files from automatic and manual caching for offline use. The system does not cache files of the type specified in this setting even when they reside on a network share configured for automatic caching. Also, if users try to make a file of this type available offline, the operation will fail and the following message will be displayed in the Synchronization Manager progress dialog box: "Files of this type cannot be made available offline." + +This setting is designed to protect files that cannot be separated, such as database components. + +To use this setting, type the file name extension in the "Extensions" box. To type more than one extension, separate the extensions with a semicolon (;). + +> [!NOTE] +> To make changes to this setting effective, you must log off and log on again. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Files not cached* +- GP name: *Pol_ExtExclusionList* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_GoOfflineAction_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_GoOfflineAction_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_GoOfflineAction_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_GoOfflineAction_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoCacheViewer_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the Offline Files folder. + +This setting disables the "View Files" button on the Offline Files tab. As a result, users cannot use the Offline Files folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location. + +This setting does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as Windows Explorer, to view their offline files. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To view the Offline Files Folder, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click "View Files." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent use of Offline Files folder* +- GP name: *Pol_NoCacheViewer_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoCacheViewer_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting disables the Offline Files folder. + +This setting disables the "View Files" button on the Offline Files tab. As a result, users cannot use the Offline Files folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location. + +This setting does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as Windows Explorer, to view their offline files. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To view the Offline Files Folder, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click "View Files." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent use of Offline Files folder* +- GP name: *Pol_NoCacheViewer_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoConfigCache_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from enabling, disabling, or changing the configuration of Offline Files. + +This setting removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the Settings button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box. + +This is a comprehensive setting that locks down the configuration you establish by using other settings in this folder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> This setting provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this setting. You do not have to disable any other settings in this folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit user configuration of Offline Files* +- GP name: *Pol_NoConfigCache_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoConfigCache_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from enabling, disabling, or changing the configuration of Offline Files. + +This setting removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the Settings button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box. + +This is a comprehensive setting that locks down the configuration you establish by using other settings in this folder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> This setting provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this setting. You do not have to disable any other settings in this folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit user configuration of Offline Files* +- GP name: *Pol_NoConfigCache_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from making network files and folders available offline. + +If you enable this policy setting, users cannot designate files to be saved on their computer for offline use. However, Windows will still cache local copies of files that reside on network shares designated for automatic caching. + +If you disable or do not configure this policy setting, users can manually specify files and folders that they want to make available offline. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" command* +- GP name: *Pol_NoMakeAvailableOffline_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from making network files and folders available offline. + +If you enable this policy setting, users cannot designate files to be saved on their computer for offline use. However, Windows will still cache local copies of files that reside on network shares designated for automatic caching. + +If you disable or do not configure this policy setting, users can manually specify files and folders that they want to make available offline. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" command* +- GP name: *Pol_NoMakeAvailableOffline_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoPinFiles_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage a list of files and folders for which you want to block the "Make Available Offline" command. + +If you enable this policy setting, the "Make Available Offline" command is not available for the files and folders that you list. To specify these files and folders, click Show. In the Show Contents dialog box, in the Value Name column box, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files and folders is deleted, including any lists inherited from lower precedence GPOs, and the "Make Available Offline" command is displayed for all files and folders. + +If you do not configure this policy setting, the "Make Available Offline" command is available for all files and folders. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings are combined, and the "Make Available Offline" command is unavailable for all specified files and folders. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. +> - This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching." It only affects the display of the "Make Available Offline" command in File Explorer. +> - If the "Remove 'Make Available Offline' command" policy setting is enabled, this setting has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" for these files and folders* +- GP name: *Pol_NoPinFiles_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoPinFiles_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage a list of files and folders for which you want to block the "Make Available Offline" command. + +If you enable this policy setting, the "Make Available Offline" command is not available for the files and folders that you list. To specify these files and folders, click Show. In the Show Contents dialog box, in the Value Name column box, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files and folders is deleted, including any lists inherited from lower precedence GPOs, and the "Make Available Offline" command is displayed for all files and folders. + +If you do not configure this policy setting, the "Make Available Offline" command is available for all files and folders. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings are combined, and the "Make Available Offline" command is unavailable for all specified files and folders. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. +> - This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching." It only affects the display of the "Make Available Offline" command in File Explorer. +> - If the "Remove 'Make Available Offline' command" policy setting is enabled, this setting has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" for these files and folders* +- GP name: *Pol_NoPinFiles_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoReminders_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Hides or displays reminder balloons, and prevents users from changing the setting. + +Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. + +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. + +If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. + +If this setting is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting. + +To prevent users from changing the setting while a setting is in effect, the system disables the "Enable reminders" option on the Offline Files tab + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To display or hide reminder balloons without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Enable reminders" check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off reminder balloons* +- GP name: *Pol_NoReminders_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_NoReminders_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Hides or displays reminder balloons, and prevents users from changing the setting. + +Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. + +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. + +If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. + +If this setting is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting. + +To prevent users from changing the setting while a setting is in effect, the system disables the "Enable reminders" option on the Offline Files tab + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To display or hide reminder balloons without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Enable reminders" check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off reminder balloons* +- GP name: *Pol_NoReminders_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_OnlineCachingSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether files read from file shares over a slow network are transparently cached in the Offline Files cache for future reads. When a user tries to access a file that has been transparently cached, Windows reads from the cached copy after verifying its integrity. This improves end-user response times and decreases bandwidth consumption over WAN links. + +The cached files are temporary and are not available to the user when offline. The cached files are not kept in sync with the version on the server, and the most current version from the server is always available for subsequent reads. + +This policy setting is triggered by the configured round trip network latency value. We recommend using this policy setting when the network connection to the server is slow. For example, you can configure a value of 60 ms as the round trip latency of the network above which files should be transparently cached in the Offline Files cache. If the round trip latency of the network is less than 60ms, reads to remote files will not be cached. + +If you enable this policy setting, transparent caching is enabled and configurable. + +If you disable or do not configure this policy setting, remote files will be not be transparently cached on client computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Transparent Caching* +- GP name: *Pol_OnlineCachingSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_AlwaysPinSubFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting makes subfolders available offline whenever their parent folder is made available offline. + +This setting automatically extends the "make available offline" setting to all new and existing subfolders of a folder. Users do not have the option of excluding subfolders. + +If you enable this setting, when you make a folder available offline, all folders within that folder are also made available offline. Also, new folders that you create within a folder that is available offline are made available offline when the parent folder is synchronized. + +If you disable this setting or do not configure it, the system asks users whether they want subfolders to be made available offline when they make a parent folder available offline. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Subfolders always available offline* +- GP name: *Pol_AlwaysPinSubFolders* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_PurgeAtLogoff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting deletes local copies of the user's offline files when the user logs off. + +This setting specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files. + +If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use. + +> [!CAUTION] +> Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *At logoff, delete local copy of user’s offline files* +- GP name: *Pol_PurgeAtLogoff* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_QuickAdimPin** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to turn on economical application of administratively assigned Offline Files. + +If you enable or do not configure this policy setting, only new files and folders in administratively assigned folders are synchronized at logon. Files and folders that are already available offline are skipped and are synchronized later. + +If you disable this policy setting, all administratively assigned folders are synchronized at logon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on economical application of administratively assigned Offline Files* +- GP name: *Pol_QuickAdimPin* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ReminderFreq_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how often reminder balloon updates appear. + +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To set reminder balloon frequency without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Display reminder balloons every ... minutes" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon frequency* +- GP name: *Pol_ReminderFreq_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ReminderFreq_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how often reminder balloon updates appear. + +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To set reminder balloon frequency without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Display reminder balloons every ... minutes" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon frequency* +- GP name: *Pol_ReminderFreq_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ReminderInitTimeout_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how long the first reminder balloon for a network status change is displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the first reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Initial reminder balloon lifetime* +- GP name: *Pol_ReminderInitTimeout_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ReminderInitTimeout_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how long the first reminder balloon for a network status change is displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the first reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Initial reminder balloon lifetime* +- GP name: *Pol_ReminderInitTimeout_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ReminderTimeout_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how long updated reminder balloons are displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the update reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon lifetime* +- GP name: *Pol_ReminderTimeout_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_ReminderTimeout_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how long updated reminder balloons are displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the update reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon lifetime* +- GP name: *Pol_ReminderTimeout_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SlowLinkSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the network latency and throughput thresholds that will cause a client computers to transition files and folders that are already available offline to the slow-link mode so that the user's access to this data is not degraded due to network slowness. When Offline Files is operating in the slow-link mode, all network file requests are satisfied from the Offline Files cache. This is similar to a user working offline. + +If you enable this policy setting, Offline Files uses the slow-link mode if the network throughput between the client and the server is below (slower than) the Throughput threshold parameter, or if the round-trip network latency is above (slower than) the Latency threshold parameter. + +You can configure the slow-link mode by specifying threshold values for Throughput (in bits per second) and/or Latency (in milliseconds) for specific UNC paths. We recommend that you always specify a value for Latency, since the round-trip network latency detection is faster. You can use wildcard characters (*) for specifying UNC paths. If you do not specify a Latency or Throughput value, computers running Windows Vista or Windows Server 2008 will not use the slow-link mode. + +If you do not configure this policy setting, computers running Windows Vista or Windows Server 2008 will not transition a shared folder to the slow-link mode. Computers running Windows 7 or Windows Server 2008 R2 will use the default latency value of 80 milliseconds when transitioning a folder to the slow-link mode. Computers running Windows 8 or Windows Server 2012 will use the default latency value of 35 milliseconds when transitioning a folder to the slow-link mode. To avoid extra charges on cell phone or broadband plans, it may be necessary to configure the latency threshold to be lower than the round-trip network latency. + +In Windows Vista or Windows Server 2008, once transitioned to slow-link mode, users will continue to operate in slow-link mode until the user clicks the Work Online button on the toolbar in Windows Explorer. Data will only be synchronized to the server if the user manually initiates synchronization by using Sync Center. + +In Windows 7, Windows Server 2008 R2, Windows 8 or Windows Server 2012, when operating in slow-link mode Offline Files synchronizes the user's files in the background at regular intervals, or as configured by the "Configure Background Sync" policy. While in slow-link mode, Windows periodically checks the connection to the folder and brings the folder back online if network speeds improve. + +In Windows 8 or Windows Server 2012, set the Latency threshold to 1ms to keep users always working offline in slow-link mode. + +If you disable this policy setting, computers will not use the slow-link mode. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure slow-link mode* +- GP name: *Pol_SlowLinkSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SlowLinkSpeed** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the threshold value at which Offline Files considers a network connection to be "slow". Any network speed below this value is considered to be slow. + +When a connection is considered slow, Offline Files automatically adjust its behavior to avoid excessive synchronization traffic and will not automatically reconnect to a server when the presence of a server is detected. + +If you enable this setting, you can configure the threshold value that will be used to determine a slow network connection. + +If this setting is disabled or not configured, the default threshold value of 64,000 bps is used to determine if a network connection is considered to be slow. + +> [!NOTE] +> Use the following formula when entering the slow link value: [ bps / 100]. For example, if you want to set a threshold value of 128,000 bps, enter a value of 1280. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Slow link speed* +- GP name: *Pol_SlowLinkSpeed* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SyncAtLogoff_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are fully synchronized when users log off. + +This setting also disables the "Synchronize all offline files before logging off" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current. + +If you disable this setting, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current. + +If you do not configure this setting, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without changing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging off" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files before logging off* +- GP name: *Pol_SyncAtLogoff_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SyncAtLogoff_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are fully synchronized when users log off. + +This setting also disables the "Synchronize all offline files before logging off" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current. + +If you disable this setting, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current. + +If you do not configure this setting, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without changing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging off" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files before logging off* +- GP name: *Pol_SyncAtLogoff_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SyncAtLogon_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are fully synchronized when users log on. + +This setting also disables the "Synchronize all offline files before logging on" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized at logon. Full synchronization ensures that offline files are complete and current. Enabling this setting automatically enables logon synchronization in Synchronization Manager. + +If this setting is disabled and Synchronization Manager is configured for logon synchronization, the system performs only a quick synchronization. Quick synchronization ensures that files are complete but does not ensure that they are current. + +If you do not configure this setting and Synchronization Manager is configured for logon synchronization, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without setting a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging on" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files when logging on* +- GP name: *Pol_SyncAtLogon_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + +
          + + +**ADMX_OfflineFiles/Pol_SyncAtLogon_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are fully synchronized when users log on. + +This setting also disables the "Synchronize all offline files before logging on" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized at logon. Full synchronization ensures that offline files are complete and current. Enabling this setting automatically enables logon synchronization in Synchronization Manager. + +If this setting is disabled and Synchronization Manager is configured for logon synchronization, the system performs only a quick synchronization. Quick synchronization ensures that files are complete but does not ensure that they are current. + +If you do not configure this setting and Synchronization Manager is configured for logon synchronization, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without setting a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging on" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files when logging on* +- GP name: *Pol_SyncAtLogon_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SyncAtSuspend_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are synchronized before a computer is suspended. + +If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. + +If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. + +> [!NOTE] +> If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize offline files before suspend* +- GP name: *Pol_SyncAtSuspend_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SyncAtSuspend_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are synchronized before a computer is suspended. + +If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. + +If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. + +> [!NOTE] +> If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize offline files before suspend* +- GP name: *Pol_SyncAtSuspend_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_SyncOnCostedNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether offline files are synchronized in the background when it could result in extra charges on cell phone or broadband plans. + +If you enable this setting, synchronization can occur in the background when the user's network is roaming, near, or over the plan's data limit. This may result in extra charges on cell phone or broadband plans. + +If this setting is disabled or not configured, synchronization will not run in the background on network folders when the user's network is roaming, near, or over the plan's data limit. The network folder must also be in "slow-link" mode, as specified by the "Configure slow-link mode" policy to avoid network usage. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable file synchronization on costed networks* +- GP name: *Pol_SyncOnCostedNetwork* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the "Work offline" command from Explorer, preventing users from manually changing whether Offline Files is in online mode or offline mode. + +If you enable this policy setting, the "Work offline" command is not displayed in File Explorer. + +If you disable or do not configure this policy setting, the "Work offline" command is displayed in File Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Work offline" command* +- GP name: *Pol_WorkOfflineDisabled_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + + +**ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting removes the "Work offline" command from Explorer, preventing users from manually changing whether Offline Files is in online mode or offline mode. + +If you enable this policy setting, the "Work offline" command is not displayed in File Explorer. + +If you disable or do not configure this policy setting, the "Work offline" command is displayed in File Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Work offline" command* +- GP name: *Pol_WorkOfflineDisabled_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md new file mode 100644 index 0000000000..426fcbe069 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -0,0 +1,805 @@ +--- +title: Policy CSP - ADMX_PeerToPeerCaching +description: Policy CSP - ADMX_PeerToPeerCaching +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_PeerToPeerCaching +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_PeerToPeerCaching policies + +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers +
          +
          + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB +
          +
          + ADMX_PeerToPeerCaching/SetCachePercent +
          +
          + ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge +
          +
          + ADMX_PeerToPeerCaching/SetDowngrading +
          +
          + +
          + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether BranchCache is enabled on client computers to which this policy is applied. In addition to this policy setting, you must specify whether the client computers are hosted cache mode or distributed cache mode clients. To do so, configure one of the following the policy settings: + +- Set BranchCache Distributed Cache mode +- Set BranchCache Hosted Cache mode +- Configure Hosted Cache Servers + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache. +- Enabled. With this selection, BranchCache is turned on for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache is turned off for all client computers where the policy is applied. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on BranchCache* +- GP name: *EnableWindowsBranchCache* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether BranchCache distributed cache mode is enabled on client computers to which this policy is applied. In addition to this policy, you must use the policy "Turn on BranchCache" to enable BranchCache on client computers. + +In distributed cache mode, client computers download content from BranchCache-enabled main office content servers, cache the content locally, and serve the content to other BranchCache distributed cache mode clients in the branch office. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache. +- Enabled. With this selection, BranchCache distributed cache mode is enabled for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache distributed cache mode is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache distributed cache mode is turned off for all client computers where the policy is applied. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set BranchCache Distributed Cache mode* +- GP name: *EnableWindowsBranchCache_Distributed* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether BranchCache hosted cache mode is enabled on client computers to which this policy is applied. In addition to this policy, you must use the policy "Turn on BranchCache" to enable BranchCache on client computers. + +When a client computer is configured as a hosted cache mode client, it is able to download cached content from a hosted cache server that is located at the branch office. In addition, when the hosted cache client obtains content from a content server, the client can upload the content to the hosted cache server for access by other hosted cache clients at the branch office. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache. +- Enabled. With this selection, BranchCache hosted cache mode is enabled for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache hosted cache mode is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache hosted cache mode is turned off for all client computers where the policy is applied. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Type the name of the hosted cache server. Specifies the computer name of the hosted cache server. Because the hosted cache server name is also specified in the certificate enrolled to the hosted cache server, the name that you enter here must match the name of the hosted cache server that is specified in the server certificate. + +Hosted cache clients must trust the server certificate that is issued to the hosted cache server. Ensure that the issuing CA certificate is installed in the Trusted Root Certification Authorities certificate store on all hosted cache client computers. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set BranchCache Hosted Cache mode* +- GP name: *EnableWindowsBranchCache_Hosted* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies. + +If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy. + +When this policy setting is applied, the client computer performs or does not perform automatic hosted cache server discovery under the following circumstances: + +If no other BranchCache mode-based policy settings are applied, the client computer performs automatic hosted cache server discovery. If one or more hosted cache servers is found, the client computer self-configures for hosted cache mode. + +If the policy setting "Set BranchCache Distributed Cache Mode" is applied in addition to this policy, the client computer performs automatic hosted cache server discovery. If one or more hosted cache servers are found, the client computer self-configures for hosted cache mode only. + +If the policy setting "Set BranchCache Hosted Cache Mode" is applied, the client computer does not perform automatic hosted cache discovery. This is also true in cases where the policy setting "Configure Hosted Cache Servers" is applied. + +This policy setting can only be applied to client computers that are running at least Windows 8. This policy has no effect on computers that are running Windows 7 or Windows Vista. + +If you disable, or do not configure this setting, a client will not attempt to discover hosted cache servers by service connection point. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting, and client computers do not perform hosted cache server discovery. +- Enabled. With this selection, the policy setting is applied to client computers, which perform automatic hosted cache server discovery and which are configured as hosted cache mode clients. +- Disabled. With this selection, this policy is not applied to client computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Automatic Hosted Cache Discovery by Service Connection Point* +- GP name: *EnableWindowsBranchCache_HostedCacheDiscovery* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether client computers are configured to use hosted cache mode and provides the computer name of the hosted cache servers that are available to the client computers. Hosted cache mode enables client computers in branch offices to retrieve content from one or more hosted cache servers that are installed in the same office location. You can use this setting to automatically configure client computers that are configured for hosted cache mode with the computer names of the hosted cache servers in the branch office. + +If you enable this policy setting and specify valid computer names of hosted cache servers, hosted cache mode is enabled for all client computers to which the policy setting is applied. For this policy setting to take effect, you must also enable the "Turn on BranchCache" policy setting. + +This policy setting can only be applied to client computers that are running at least Windows 8. This policy has no effect on computers that are running Windows 7 or Windows Vista. Client computers to which this policy setting is applied, in addition to the "Set BranchCache Hosted Cache mode" policy setting, use the hosted cache servers that are specified in this policy setting and do not use the hosted cache server that is configured in the policy setting "Set BranchCache Hosted Cache Mode." + +If you do not configure this policy setting, or if you disable this policy setting, client computers that are configured with hosted cache mode still function correctly. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting. +- Enabled. With this selection, the policy setting is applied to client computers, which are configured as hosted cache mode clients that use the hosted cache servers that you specify in "Hosted cache servers." +- Disabled. With this selection, this policy is not applied to client computers. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Hosted cache servers. To add hosted cache server computer names to this policy setting, click Enabled, and then click Show. The Show Contents dialog box opens. Click Value, and then type the computer names of the hosted cache servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Hosted Cache Servers* +- GP name: *EnableWindowsBranchCache_HostedMultipleServers* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting is used only when you have deployed one or more BranchCache-enabled file servers at your main office. This policy setting specifies when client computers in branch offices start caching content from file servers based on the network latency - or delay - that occurs when the clients download content from the main office over a Wide Area Network (WAN) link. When you configure a value for this setting, which is the maximum round trip network latency allowed before caching begins, clients do not cache content until the network latency reaches the specified value; when network latency is greater than the value, clients begin caching content after they receive it from the file servers. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache latency settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache latency setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache latency settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the latency setting that you use on individual client computers. +- Enabled. With this selection, the BranchCache maximum round trip latency setting is enabled for all client computers where the policy is applied. For example, if Configure BranchCache for network files is enabled in domain Group Policy, the BranchCache latency setting that you specify in the policy is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache client computers use the default latency setting of 80 milliseconds. + +In circumstances where this policy setting is enabled, you can also select and configure the following option: + +- Type the maximum round trip network latency (milliseconds) after which caching begins. Specifies the amount of time, in milliseconds, after which BranchCache client computers begin to cache content locally. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure BranchCache for network files* +- GP name: *EnableWindowsBranchCache_SMB* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/SetCachePercent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the default percentage of total disk space that is allocated for the BranchCache disk cache on client computers. + +If you enable this policy setting, you can configure the percentage of total disk space to allocate for the cache. + +If you disable or do not configure this policy setting, the cache is set to 5 percent of the total disk space on the client computer. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache client computer cache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache client computer cache setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache client computer cache settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the client computer cache setting that you use on individual client computers. +- Enabled. With this selection, the BranchCache client computer cache setting is enabled for all client computers where the policy is applied. For example, if Set percentage of disk space used for client computer cache is enabled in domain Group Policy, the BranchCache client computer cache setting that you specify in the policy is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache client computers use the default client computer cache setting of five percent of the total disk space on the client computer. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Specify the percentage of total disk space allocated for the cache. Specifies an integer that is the percentage of total client computer disk space to use for the BranchCache client computer cache. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set percentage of disk space used for client computer cache* +- GP name: *SetCachePercent* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the default age in days for which segments are valid in the BranchCache data cache on client computers. + +If you enable this policy setting, you can configure the age for segments in the data cache. + +If you disable or do not configure this policy setting, the age is set to 28 days. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache client computer cache age settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache client computer cache age setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache client computer cache age settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the client computer cache age setting that you use on individual client computers. +- Enabled. With this selection, the BranchCache client computer cache age setting is enabled for all client computers where the policy is applied. For example, if this policy setting is enabled in domain Group Policy, the BranchCache client computer cache age that you specify in the policy is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache client computers use the default client computer cache age setting of 28 days on the client computer. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Specify the age in days for which segments in the data cache are valid. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set age for segments in the data cache* +- GP name: *SetDataCacheEntryMaxAge* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + + +**ADMX_PeerToPeerCaching/SetDowngrading** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether BranchCache-capable client computers operate in a downgraded mode in order to maintain compatibility with previous versions of BranchCache. If client computers do not use the same BranchCache version, cache efficiency might be reduced because client computers that are using different versions of BranchCache might store cache data in incompatible formats. + +If you enable this policy setting, all clients use the version of BranchCache that you specify in "Select from the following versions." + +If you do not configure this setting, all clients will use the version of BranchCache that matches their operating system. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, this policy setting is not applied to client computers, and the clients run the version of BranchCache that is included with their operating system. +- Enabled. With this selection, this policy setting is applied to client computers based on the value of the option setting "Select from the following versions" that you specify. +- Disabled. With this selection, this policy setting is not applied to client computers, and the clients run the version of BranchCache that is included with their operating system. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +Select from the following versions + +- Windows Vista with BITS 4.0 installed, Windows 7, or Windows Server 2008 R2. If you select this version, later versions of Windows run the version of BranchCache that is included in these operating systems rather than later versions of BranchCache. +- Windows 8. If you select this version, Windows 8 will run the version of BranchCache that is included in the operating system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Client BranchCache Version Support* +- GP name: *SetDowngrading* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md new file mode 100644 index 0000000000..f02fb046cc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md @@ -0,0 +1,362 @@ +--- +title: Policy CSP - ADMX_PerformanceDiagnostics +description: Policy CSP - ADMX_PerformanceDiagnostics +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_PerformanceDiagnostics +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_PerformanceDiagnostics policies + +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1 +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2 +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3 +
          +
          + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4 +
          +
          + + +
          + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the execution level for Windows Boot Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Boot Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Boot Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Boot Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Boot Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_1* +- GP path: *System\Troubleshooting and Diagnostics\Windows Boot Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
          + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Determines the execution level for Windows Standby/Resume Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Standby/Resume Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Standby/Resume Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Standby/Resume Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Standby/Resume Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_2* +- GP path: *System\Troubleshooting and Diagnostics\Windows System Responsiveness Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
          + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the execution level for Windows Shutdown Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Shutdown Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Shutdown Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Shutdown Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Shutdown Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_3* +- GP path: *System\Troubleshooting and Diagnostics\Windows Shutdown Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
          + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Determines the execution level for Windows Standby/Resume Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Standby/Resume Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Standby/Resume Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Standby/Resume Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Standby/Resume Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_4* +- GP path: *System\Troubleshooting and Diagnostics\Windows Standby/Resume Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md new file mode 100644 index 0000000000..7113d20ba1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md @@ -0,0 +1,351 @@ +--- +title: Policy CSP - ADMX_PowerShellExecutionPolicy +description: Policy CSP - ADMX_PowerShellExecutionPolicy +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_PowerShellExecutionPolicy +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_PowerShellExecutionPolicy policies + +
          +
          + ADMX_PowerShellExecutionPolicy/EnableModuleLogging +
          +
          + ADMX_PowerShellExecutionPolicy/EnableScripts +
          +
          + ADMX_PowerShellExecutionPolicy/EnableTranscripting +
          +
          + ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath +
          +
          + + +
          + + +**ADMX_PowerShellExecutionPolicy/EnableModuleLogging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on logging for Windows PowerShell modules. + +If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the Windows PowerShell log in Event Viewer. Enabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to True. + +If you disable this policy setting, logging of execution events is disabled for all Windows PowerShell modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False. If this policy setting is not configured, the LogPipelineExecutionDetails property of a module or snap-in determines whether the execution events of a module or snap-in are logged. By default, the LogPipelineExecutionDetails property of all modules and snap-ins is set to False. + +To add modules and snap-ins to the policy setting list, click Show, and then type the module names in the list. The modules and snap-ins in the list must be installed on the computer. + +> [!NOTE] +> This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Module Logging* +- GP name: *EnableModuleLogging* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
          + + +**ADMX_PowerShellExecutionPolicy/EnableScripts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you configure the script execution policy, controlling which scripts are allowed to run. + +If you enable this policy setting, the scripts selected in the drop-down list are allowed to run. The "Allow only signed scripts" policy setting allows scripts to execute only if they are signed by a trusted publisher. + +The "Allow local scripts and remote signed scripts" policy setting allows any local scripts to run; scripts that originate from the Internet must be signed by a trusted publisher. The "Allow all scripts" policy setting allows all scripts to run. + +If you disable this policy setting, no scripts are allowed to run. + +> [!NOTE] +> This policy setting exists under both "Computer Configuration" and "User Configuration" in the Local Group Policy Editor. The "Computer Configuration" has precedence over "User Configuration." If you disable or do not configure this policy setting, it reverts to a per-machine preference setting; the default if that is not configured is "No scripts allowed." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Script Execution* +- GP name: *EnableScripts* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
          + + +**ADMX_PowerShellExecutionPolicy/EnableTranscripting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts. + +If you enable this policy setting, Windows PowerShell will enable transcripting for Windows PowerShell, the Windows PowerShell ISE, and any other applications that leverage the Windows PowerShell engine. By default, Windows PowerShell will record transcript output to each users' My Documents directory, with a file name that includes 'PowerShell_transcript', along with the computer name and time started. Enabling this policy is equivalent to calling the Start-Transcript cmdlet on each Windows PowerShell session. + +If you disable this policy setting, transcripting of PowerShell-based applications is disabled by default, although transcripting can still be enabled through the Start-Transcript cmdlet. + +If you use the OutputDirectory setting to enable transcript logging to a shared location, be sure to limit access to that directory to prevent users from viewing the transcripts of other users or computers. + +> [!NOTE] +> This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on PowerShell Transcription* +- GP name: *EnableTranscripting* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
          + + +**ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to set the default value of the SourcePath parameter on the Update-Help cmdlet. + +If you enable this policy setting, the Update-Help cmdlet will use the specified value as the default value for the SourcePath parameter. This default value can be overridden by specifying a different value with the SourcePath parameter on the Update-Help cmdlet. + +If this policy setting is disabled or not configured, this policy setting does not set a default value for the SourcePath parameter of the Update-Help cmdlet. + +> [!NOTE] +> This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the default source path for Update-Help* +- GP name: *EnableUpdateHelpDefaultSourcePath* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md new file mode 100644 index 0000000000..97697da52b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -0,0 +1,568 @@ +--- +title: Policy CSP - ADMX_Programs +description: Policy CSP - ADMX_Programs +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Programs +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Programs policies + +
          +
          + ADMX_Programs/NoDefaultPrograms +
          +
          + ADMX_Programs/NoGetPrograms +
          +
          + ADMX_Programs/NoInstalledUpdates +
          +
          + ADMX_Programs/NoProgramsAndFeatures +
          +
          + ADMX_Programs/NoProgramsCPL +
          +
          + ADMX_Programs/NoWindowsFeatures +
          +
          + ADMX_Programs/NoWindowsMarketplace +
          +
          + + +
          + + +**ADMX_Programs/NoDefaultPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting removes the Set Program Access and Defaults page from the Programs Control Panel. As a result, users cannot view or change the associated page. + +The Set Program Access and Computer Defaults page allows administrators to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as specify the programs that are accessible from the Start menu, desktop, and other locations. + +If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users. + +This setting does not prevent users from using other tools and methods to change program access or defaults. + +This setting does not prevent the Default Programs icon from appearing on the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Set Program Access and Computer Defaults" page* +- GP name: *NoDefaultPrograms* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
          + + +**ADMX_Programs/NoGetPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from viewing or installing published programs from the network. + +This setting prevents users from accessing the "Get Programs" page from the Programs Control Panel in Category View, Programs and Features in Classic View and the "Install a program from the network" task. The "Get Programs" page lists published programs and provides an easy way to install them. + +Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users of their availability, to recommend their use, or to enable users to install them without having to search for installation files. + +If this setting is enabled, users cannot view the programs that have been published by the system administrator, and they cannot use the "Get Programs" page to install published programs. Enabling this feature does not prevent users from installing programs by using other methods. Users will still be able to view and installed assigned (partially installed) programs that are offered on the desktop or on the Start menu. + +If this setting is disabled or is not configured, the "Install a program from the network" task to the "Get Programs" page will be available to all users. + +> [!NOTE] +> If the "Hide Programs Control Panel" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Get Programs" page* +- GP name: *NoGetPrograms* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
          + + +**ADMX_Programs/NoInstalledUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing "Installed Updates" page from the "View installed updates" task. + +"Installed Updates" allows users to view and uninstall updates currently installed on the computer. The updates are often downloaded directly from Windows Update or from various program publishers. + +If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users. + +This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Installed Updates" page* +- GP name: *NoInstalledUpdates* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
          + + +**ADMX_Programs/NoProgramsAndFeatures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are currently installed on the computer. + +If this setting is disabled or not configured, "Programs and Features" will be available to all users. + +This setting does not prevent users from using other tools and methods to view or uninstall programs. It also does not prevent users from linking to related Programs Control Panel Features including Windows Features, Get Programs, or Windows Marketplace. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Programs and Features" page* +- GP name: *NoProgramsAndFeatures* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
          + + +**ADMX_Programs/NoProgramsCPL** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View. + +The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to the user by the system administrator also appear in the Programs Control Panel. + +If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users. + +When enabled, this setting takes precedence over the other settings in this folder. + +This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Programs Control Panel* +- GP name: *NoProgramsCPL* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
          + + +**ADMX_Programs/NoWindowsFeatures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. As a result, users cannot view, enable, or disable various Windows features and services. + +If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users. + +This setting does not prevent users from using other tools and methods to configure services or enable or disable program components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Windows Features"* +- GP name: *NoWindowsFeatures* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
          + + +**ADMX_Programs/NoWindowsMarketplace** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from access the "Get new programs from Windows Marketplace" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. + +Windows Marketplace allows users to purchase and/or download various programs to their computer for installation. + +Enabling this feature does not prevent users from navigating to Windows Marketplace using other methods. + +If this feature is disabled or is not configured, the "Get new programs from Windows Marketplace" task link will be available to all users. + +> [!NOTE] +> If the "Hide Programs control Panel" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Windows Marketplace"* +- GP name: *NoWindowsMarketplace* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-reliability.md b/windows/client-management/mdm/policy-csp-admx-reliability.md new file mode 100644 index 0000000000..e466f85f86 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-reliability.md @@ -0,0 +1,361 @@ +--- +title: Policy CSP - ADMX_Reliability +description: Policy CSP - ADMX_Reliability +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Reliability +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Reliability policies + +
          +
          + ADMX_Reliability/EE_EnablePersistentTimeStamp +
          +
          + ADMX_Reliability/PCH_ReportShutdownEvents +
          +
          + ADMX_Reliability/ShutdownEventTrackerStateFile +
          +
          + ADMX_Reliability/ShutdownReason +
          +
          + + +
          + + +**ADMX_Reliability/EE_EnablePersistentTimeStamp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows the system to detect the time of unexpected shutdowns by writing the current time to disk on a schedule controlled by the Timestamp Interval. + +If you enable this policy setting, you are able to specify how often the Persistent System Timestamp is refreshed and subsequently written to the disk. You can specify the Timestamp Interval in seconds. + +If you disable this policy setting, the Persistent System Timestamp is turned off and the timing of unexpected shutdowns is not recorded. + +If you do not configure this policy setting, the Persistent System Timestamp is refreshed according the default, which is every 60 seconds beginning with Windows Server 2003. + +> [!NOTE] +> This feature might interfere with power configuration settings that turn off hard disks after a period of inactivity. These power settings may be accessed in the Power Options Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Persistent Time Stamp* +- GP name: *EE_EnablePersistentTimeStamp* +- GP path: *System* +- GP ADMX file name: *Reliability.admx* + + + +
          + +
          + + +**ADMX_Reliability/PCH_ReportShutdownEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls whether or not unplanned shutdown events can be reported when error reporting is enabled. + +If you enable this policy setting, error reporting includes unplanned shutdown events. + +If you disable this policy setting, unplanned shutdown events are not included in error reporting. + +If you do not configure this policy setting, users can adjust this setting using the control panel, which is set to "Upload unplanned shutdown events" by default. + +Also see the "Configure Error Reporting" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Report unplanned shutdown events* +- GP name: *PCH_ReportShutdownEvents* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *Reliability.admx* + + + +
          + +
          + + +**ADMX_Reliability/ShutdownEventTrackerStateFile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines when the Shutdown Event Tracker System State Data feature is activated. + +The system state data file contains information about the basic system state as well as the state of all running processes. + +If you enable this policy setting, the System State Data feature is activated when the user indicates that the shutdown or restart is unplanned. + +If you disable this policy setting, the System State Data feature is never activated. + +If you do not configure this policy setting, the default behavior for the System State Data feature occurs. + +> [!NOTE] +> By default, the System State Data feature is always enabled on Windows Server 2003. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Activate Shutdown Event Tracker System State Data feature* +- GP name: *ShutdownEventTrackerStateFile* +- GP path: *System* +- GP ADMX file name: *Reliability.admx* + + + +
          + +
          + + +**ADMX_Reliability/ShutdownReason** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. The Shutdown Event Tracker can be displayed when you shut down a workstation or server. This is an extra set of questions that is displayed when you invoke a shutdown to collect information related to why you are shutting down the computer. + +If you enable this setting and choose "Always" from the drop-down menu list, the Shutdown Event Tracker is displayed when the computer shuts down. + +If you enable this policy setting and choose "Server Only" from the drop-down menu list, the Shutdown Event Tracker is displayed when you shut down a computer running Windows Server. (See "Supported on" for supported versions.) + +If you enable this policy setting and choose "Workstation Only" from the drop-down menu list, the Shutdown Event Tracker is displayed when you shut down a computer running a client version of Windows. (See "Supported on" for supported versions.) + +If you disable this policy setting, the Shutdown Event Tracker is not displayed when you shut down the computer. + +If you do not configure this policy setting, the default behavior for the Shutdown Event Tracker occurs. + +> [!NOTE] +> By default, the Shutdown Event Tracker is only displayed on computers running Windows Server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display Shutdown Event Tracker* +- GP name: *ShutdownReason* +- GP path: *System* +- GP ADMX file name: *Reliability.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-scripts.md b/windows/client-management/mdm/policy-csp-admx-scripts.md new file mode 100644 index 0000000000..7f655514ef --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-scripts.md @@ -0,0 +1,985 @@ +--- +title: Policy CSP - ADMX_Scripts +description: Policy CSP - ADMX_Scripts +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Scripts +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Scripts policies + +
          +
          + ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled +
          +
          + ADMX_Scripts/MaxGPOScriptWaitPolicy +
          +
          + ADMX_Scripts/Run_Computer_PS_Scripts_First +
          +
          + ADMX_Scripts/Run_Legacy_Logon_Script_Hidden +
          +
          + ADMX_Scripts/Run_Logoff_Script_Visible +
          +
          + ADMX_Scripts/Run_Logon_Script_Sync_1 +
          +
          + ADMX_Scripts/Run_Logon_Script_Sync_2 +
          +
          + ADMX_Scripts/Run_Logon_Script_Visible +
          +
          + ADMX_Scripts/Run_Shutdown_Script_Visible +
          +
          + ADMX_Scripts/Run_Startup_Script_Sync +
          +
          + ADMX_Scripts/Run_Startup_Script_Visible +
          +
          + ADMX_Scripts/Run_User_PS_Scripts_First +
          +
          + + +
          + + +**ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows user logon scripts to run when the logon cross-forest, DNS suffixes are not configured, and NetBIOS or WINS is disabled. This policy setting affects all user accounts interactively logging on to the computer. + +If you enable this policy setting, user logon scripts run if NetBIOS or WINS is disabled during cross-forest logons without the DNS suffixes being configured. + +If you disable or do not configure this policy setting, user account cross-forest, interactive logging cannot run logon scripts if NetBIOS or WINS is disabled, and the DNS suffixes are not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow logon scripts when NetBIOS or WINS is disabled* +- GP name: *Allow_Logon_Script_NetbiosDisabled* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/MaxGPOScriptWaitPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines how long the system waits for scripts applied by Group Policy to run. + +This setting limits the total time allowed for all logon, logoff, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event. + +If you enable this setting, then, in the Seconds box, you can type a number from 1 to 32,000 for the number of seconds you want the system to wait for the set of scripts to finish. To direct the system to wait until the scripts have finished, no matter how long they take, type 0. + +This interval is particularly important when other system tasks must wait while the scripts complete. By default, each startup script must complete before the next one runs. Also, you can use the "Run logon scripts synchronously" setting to direct the system to wait for the logon scripts to complete before loading the desktop. + +An excessively long interval can delay the system and inconvenience users. However, if the interval is too short, prerequisite tasks might not be done, and the system can appear to be ready prematurely. + +If you disable or do not configure this setting the system lets the combined set of scripts run for up to 600 seconds (10 minutes). This is the default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify maximum wait time for Group Policy scripts* +- GP name: *MaxGPOScriptWaitPolicy* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Computer_PS_Scripts_First** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether Windows PowerShell scripts are run before non-Windows PowerShell scripts during computer startup and shutdown. By default, Windows PowerShell scripts run after non-Windows PowerShell scripts. + +If you enable this policy setting, within each applicable Group Policy Object (GPO), Windows PowerShell scripts are run before non-Windows PowerShell scripts during computer startup and shutdown. + +For example, assume the following scenario: + +There are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. + +GPO B and GPO C include the following computer startup scripts: + +GPO B: B.cmd, B.ps1 +GPO C: C.cmd, C.ps1 + +Assume also that there are two computers, DesktopIT and DesktopSales. +For DesktopIT, GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for DesktopIT: + +Within GPO B: B.ps1, B.cmd +Within GPO C: C.ps1, C.cmd + +For DesktopSales, GPOs B and C are applied, but not GPO A. Therefore, the scripts for GPOs B and C run in the following order for DesktopSales: + +Within GPO B: B.cmd, B.ps1 +Within GPO C: C.cmd, C.ps1 + +> [!NOTE] +> This policy setting determines the order in which computer startup and shutdown scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO: +> - Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown)\Startup +> - Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown)\Shutdown + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run Windows PowerShell scripts first at computer startup, shutdown* +- GP name: *Run_Computer_PS_Scripts_First* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Legacy_Logon_Script_Hidden** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting hides the instructions in logon scripts written for Windows NT 4.0 and earlier. + +Logon scripts are batch files of instructions that run when the user logs on. By default, Windows 2000 displays the instructions in logon scripts written for Windows NT 4.0 and earlier in a command window as they run, although it does not display logon scripts written for Windows 2000. + +If you enable this setting, Windows 2000 does not display logon scripts written for Windows NT 4.0 and earlier. + +If you disable or do not configure this policy setting, Windows 2000 displays login scripts written for Windows NT 4.0 and earlier. + +Also, see the "Run Logon Scripts Visible" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run legacy logon scripts hidden* +- GP name: *Run_Legacy_Logon_Script_Hidden* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Logoff_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting displays the instructions in logoff scripts as they run. + +Logoff scripts are batch files of instructions that run when the user logs off. By default, the system does not display the instructions in the logoff script. + +If you enable this policy setting, the system displays each instruction in the logoff script as it runs. The instructions appear in a command window. This policy setting is designed for advanced users. + +If you disable or do not configure this policy setting, the instructions are suppressed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in logoff scripts as they run* +- GP name: *Run_Logoff_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Logon_Script_Sync_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting directs the system to wait for logon scripts to finish running before it starts the File Explorer interface program and creates the desktop. + +If you enable this policy setting, File Explorer does not start until the logon scripts have finished running. This policy setting ensures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop. + +If you disable or do not configure this policy setting, the logon scripts and File Explorer are not synchronized and can run simultaneously. + +This policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the policy setting set in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run logon scripts synchronously* +- GP name: *Run_Logon_Script_Sync_1* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Logon_Script_Sync_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting directs the system to wait for logon scripts to finish running before it starts the File Explorer interface program and creates the desktop. + +If you enable this policy setting, File Explorer does not start until the logon scripts have finished running. This policy setting ensures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop. + +If you disable or do not configure this policy setting, the logon scripts and File Explorer are not synchronized and can run simultaneously. + +This policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the policy setting set in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run logon scripts synchronously* +- GP name: *Run_Logon_Script_Sync_2* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Logon_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting displays the instructions in logon scripts as they run. + +Logon scripts are batch files of instructions that run when the user logs on. By default, the system does not display the instructions in logon scripts. + +If you enable this policy setting, the system displays each instruction in the logon script as it runs. The instructions appear in a command window. This policy setting is designed for advanced users. + +If you disable or do not configure this policy setting, the instructions are suppressed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in logon scripts as they run* +- GP name: *Run_Logon_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Shutdown_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting displays the instructions in shutdown scripts as they run. + +Shutdown scripts are batch files of instructions that run when the user restarts the system or shuts it down. By default, the system does not display the instructions in the shutdown script. + +If you enable this policy setting, the system displays each instruction in the shutdown script as it runs. The instructions appear in a command window. + +If you disable or do not configure this policy setting, the instructions are suppressed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in shutdown scripts as they run* +- GP name: *Run_Shutdown_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Startup_Script_Sync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets the system run startup scripts simultaneously. + +Startup scripts are batch files that run before the user is invited to log on. By default, the system waits for each startup script to complete before it runs the next startup script. + +If you enable this policy setting, the system does not coordinate the running of startup scripts. As a result, startup scripts can run simultaneously. + +If you disable or do not configure this policy setting, a startup cannot run until the previous script is complete. + +> [!NOTE] +> Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether the "Run startup scripts visible" policy setting is enabled or not. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run startup scripts asynchronously* +- GP name: *Run_Startup_Script_Sync* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_Startup_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting displays the instructions in startup scripts as they run. + +Startup scripts are batch files of instructions that run before the user is invited to log on. By default, the system does not display the instructions in the startup script. + +If you enable this policy setting, the system displays each instruction in the startup script as it runs. Instructions appear in a command window. This policy setting is designed for advanced users. + +If you disable or do not configure this policy setting, the instructions are suppressed. + +> [!NOTE] +> Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether this policy setting is enabled or not. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in startup scripts as they run* +- GP name: *Run_Startup_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + + +**ADMX_Scripts/Run_User_PS_Scripts_First** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether Windows PowerShell scripts are run before non-Windows PowerShell scripts during user logon and logoff. By default, Windows PowerShell scripts run after non-Windows PowerShell scripts. + +If you enable this policy setting, within each applicable Group Policy Object (GPO), PowerShell scripts are run before non-PowerShell scripts during user logon and logoff. + +For example, assume the following scenario: + +There are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. + +GPO B and GPO C include the following user logon scripts: + +GPO B: B.cmd, B.ps1 +GPO C: C.cmd, C.ps1 + +Assume also that there are two users, Qin Hong and Tamara Johnston. +For Qin, GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for Qin: + +Within GPO B: B.ps1, B.cmd +Within GPO C: C.ps1, C.cmd + +For Tamara, GPOs B and C are applied, but not GPO A. Therefore, the scripts for GPOs B and C run in the following order for Tamara: + +Within GPO B: B.cmd, B.ps1 +Within GPO C: C.cmd, C.ps1 + +> [!NOTE] +> This policy setting determines the order in which user logon and logoff scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO: +> - User Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logon +> - User Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logoff + +This policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the setting set in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run Windows PowerShell scripts first at user logon, logoff* +- GP name: *Run_User_PS_Scripts_First* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sdiageng.md b/windows/client-management/mdm/policy-csp-admx-sdiageng.md new file mode 100644 index 0000000000..ce4096ecc5 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sdiageng.md @@ -0,0 +1,260 @@ +--- +title: Policy CSP - ADMX_sdiageng +description: Policy CSP - ADMX_sdiageng +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_sdiageng +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_sdiageng policies + +
          +
          + ADMX_sdiageng/BetterWhenConnected +
          +
          + ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy +
          +
          + ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy +
          +
          + + +
          + + +**ADMX_sdiageng/BetterWhenConnected** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows users who are connected to the Internet to access and search troubleshooting content that is hosted on Microsoft content servers. Users can access online troubleshooting content from within the Troubleshooting Control Panel UI by clicking "Yes" when they are prompted by a message that states, "Do you want the most up-to-date troubleshooting content?" + +If you enable or do not configure this policy setting, users who are connected to the Internet can access and search troubleshooting content that is hosted on Microsoft content servers from within the Troubleshooting Control Panel user interface. + +If you disable this policy setting, users can only access and search troubleshooting content that is available locally on their computers, even if they are connected to the Internet. They are prevented from connecting to the Microsoft servers that host the Windows Online Troubleshooting Service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)* +- GP name: *BetterWhenConnected* +- GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* +- GP ADMX file name: *sdiageng.admx* + + + +
          + + +**ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows users to access and run the troubleshooting tools that are available in the Troubleshooting Control Panel and to run the troubleshooting wizard to troubleshoot problems on their computers. + +If you enable or do not configure this policy setting, users can access and run the troubleshooting tools from the Troubleshooting Control Panel. + +If you disable this policy setting, users cannot access or run the troubleshooting tools from the Control Panel. + +Note that this setting also controls a user's ability to launch standalone troubleshooting packs such as those found in .diagcab files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access and run Troubleshooting Wizards* +- GP name: *ScriptedDiagnosticsExecutionPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* +- GP ADMX file name: *sdiageng.admx* + + + +
          + + +**ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether scripted diagnostics will execute diagnostic packages that are signed by untrusted publishers. + +If you enable this policy setting, the scripted diagnostics execution engine validates the signer of any diagnostic package and runs only those signed by trusted publishers. + +If you disable or do not configure this policy setting, the scripted diagnostics execution engine runs all digitally signed packages. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Security Policy for Scripted Diagnostics* +- GP name: *ScriptedDiagnosticsSecurityPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* +- GP ADMX file name: *sdiageng.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-securitycenter.md b/windows/client-management/mdm/policy-csp-admx-securitycenter.md new file mode 100644 index 0000000000..3f963a77cb --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-securitycenter.md @@ -0,0 +1,126 @@ +--- +title: Policy CSP - ADMX_Securitycenter +description: Policy CSP - ADMX_Securitycenter +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Securitycenter +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Securitycenter policies + +
          +
          + ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain +
          +
          + + +
          + + +**ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory domain. When Security Center is turned on, it monitors essential security settings and notifies the user when the computer might be at risk. The Security Center Control Panel category view also contains a status section, where the user can get recommendations to help increase the computer's security. When Security Center is not enabled on the domain, neither the notifications nor the Security Center status section are displayed. + +Note that Security Center can only be turned off for computers that are joined to a Windows domain. When a computer is not joined to a Windows domain, the policy setting will have no effect. + +If you do not configure this policy setting, the Security Center is turned off for domain members. + +If you enable this policy setting, Security Center is turned on for all users. + +If you disable this policy setting, Security Center is turned off for domain members. + +**Windows XP SP2** + +In Windows XP SP2, the essential security settings that are monitored by Security Center include firewall, antivirus, and Automatic Updates. Note that Security Center might not be available following a change to this policy setting until after the computer is restarted for Windows XP SP2 computers. + +**Windows Vista** + +In Windows Vista, this policy setting monitors essential security settings to include firewall, antivirus, antispyware, Internet security settings, User Account Control, and Automatic Updates. Windows Vista computers do not require a reboot for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Security Center (Domain PCs only)* +- GP name: *SecurityCenter_SecurityCenterInDomain* +- GP path: *Windows Components\Security Center* +- GP ADMX file name: *Securitycenter.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sensors.md b/windows/client-management/mdm/policy-csp-admx-sensors.md new file mode 100644 index 0000000000..00ff56dafe --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sensors.md @@ -0,0 +1,401 @@ +--- +title: Policy CSP - ADMX_Sensors +description: Policy CSP - ADMX_Sensors +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/22/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Sensors +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Sensors policies + +
          +
          + ADMX_Sensors/DisableLocationScripting_1 +
          +
          + ADMX_Sensors/DisableLocationScripting_2 +
          +
          + ADMX_Sensors/DisableLocation_1 +
          +
          + ADMX_Sensors/DisableSensors_1 +
          +
          + ADMX_Sensors/DisableSensors_2 +
          +
          + + +
          + + +**ADMX_Sensors/DisableLocationScripting_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off scripting for the location feature. + +If you enable this policy setting, scripts for the location feature will not run. + +If you disable or do not configure this policy setting, all location scripts will run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off location scripting* +- GP name: *DisableLocationScripting_1* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
          + + +**ADMX_Sensors/DisableLocationScripting_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off scripting for the location feature. + +If you enable this policy setting, scripts for the location feature will not run. + +If you disable or do not configure this policy setting, all location scripts will run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off location scripting* +- GP name: *DisableLocationScripting_2* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
          + + +**ADMX_Sensors/DisableLocation_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the location feature for this computer. + +If you enable this policy setting, the location feature is turned off, and all programs on this computer are prevented from using location information from the location feature. + +If you disable or do not configure this policy setting, all programs on this computer will not be prevented from using location information from the location feature. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off location* +- GP name: *DisableLocation_1* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
          + + +**ADMX_Sensors/DisableSensors_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the sensor feature for this computer. + +If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature. + +If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off sensors* +- GP name: *DisableSensors_1* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
          + + +**ADMX_Sensors/DisableSensors_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the sensor feature for this computer. + +If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature. + +If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off sensors* +- GP name: *DisableSensors_2* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-servicing.md b/windows/client-management/mdm/policy-csp-admx-servicing.md new file mode 100644 index 0000000000..c18852e5ea --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-servicing.md @@ -0,0 +1,116 @@ +--- +title: Policy CSP - ADMX_Servicing +description: Policy CSP - ADMX_Servicing +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Servicing +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Servicing policies + +
          +
          + ADMX_Servicing/Servicing +
          +
          + + +
          + + +**ADMX_Servicing/Servicing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. + +If you enable this policy setting and specify the new location, the files in that location will be used to repair operating system corruption and for enabling optional features that have had their payload files removed. You must enter the fully qualified path to the new location in the ""Alternate source file path"" text box. Multiple locations can be specified when each path is separated by a semicolon. + +The network location can be either a folder, or a WIM file. If it is a WIM file, the location should be specified by prefixing the path with “wim:” and include the index of the image to use in the WIM file. For example “wim:\\server\share\install.wim:3”. + +If you disable or do not configure this policy setting, or if the required files cannot be found at the locations specified in this policy setting, the files will be downloaded from Windows Update, if that is allowed by the policy settings for the computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify settings for optional component installation and component repair* +- GP name: *Servicing* +- GP path: *System* +- GP ADMX file name: *Servicing.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md new file mode 100644 index 0000000000..42b649433b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -0,0 +1,706 @@ +--- +title: Policy CSP - ADMX_SettingSync +description: Policy CSP - ADMX_SettingSync +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SettingSync +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_SettingSync policies + +
          +
          + ADMX_SettingSync/DisableAppSyncSettingSync +
          +
          + ADMX_SettingSync/DisableApplicationSettingSync +
          +
          + ADMX_SettingSync/DisableCredentialsSettingSync +
          +
          + ADMX_SettingSync/DisableDesktopThemeSettingSync +
          +
          + ADMX_SettingSync/DisablePersonalizationSettingSync +
          +
          + ADMX_SettingSync/DisableSettingSync +
          +
          + ADMX_SettingSync/DisableStartLayoutSettingSync +
          +
          + ADMX_SettingSync/DisableSyncOnPaidNetwork +
          +
          + ADMX_SettingSync/DisableWindowsSettingSync +
          +
          + + +
          + + +**ADMX_SettingSync/DisableAppSyncSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "AppSync" group from syncing to and from this PC. This turns off and disables the "AppSync" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "AppSync" group will not be synced. + +Use the option "Allow users to turn app syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "AppSync" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync Apps* +- GP name: *DisableAppSyncSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisableApplicationSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "app settings" group from syncing to and from this PC. This turns off and disables the "app settings" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "app settings" group will not be synced. + +Use the option "Allow users to turn app settings syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "app settings" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync app settings* +- GP name: *DisableApplicationSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisableCredentialsSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "passwords" group from syncing to and from this PC. This turns off and disables the "passwords" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "passwords" group will not be synced. + +Use the option "Allow users to turn passwords syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "passwords" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync passwords* +- GP name: *DisableCredentialsSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisableDesktopThemeSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "desktop personalization" group from syncing to and from this PC. This turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "desktop personalization" group will not be synced. + +Use the option "Allow users to turn desktop personalization syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "desktop personalization" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync desktop personalization* +- GP name: *DisableDesktopThemeSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisablePersonalizationSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "personalize" group from syncing to and from this PC. This turns off and disables the "personalize" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "personalize" group will not be synced. + +Use the option "Allow users to turn personalize syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "personalize" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync personalize* +- GP name: *DisablePersonalizationSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisableSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings. + +If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. + +Use the option "Allow users to turn syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, "sync your settings" is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync* +- GP name: *DisableSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisableStartLayoutSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "Start layout" group from syncing to and from this PC. This turns off and disables the "Start layout" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "Start layout" group will not be synced. + +Use the option "Allow users to turn start syncing on" so that syncing is turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "Start layout" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync start settings* +- GP name: *DisableStartLayoutSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisableSyncOnPaidNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings. + +If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. + +If you do not set or disable this setting, syncing on metered connections is configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync on metered connections* +- GP name: *DisableSyncOnPaidNetwork* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + + +**ADMX_SettingSync/DisableWindowsSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "Other Windows settings" group from syncing to and from this PC. This turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "Other Windows settings" group will not be synced. + +Use the option "Allow users to turn other Windows settings syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "Other Windows settings" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync other Windows settings* +- GP name: *DisableWindowsSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md new file mode 100644 index 0000000000..7b7f7b195c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -0,0 +1,192 @@ +--- +title: Policy CSP - ADMX_SharedFolders +description: Policy CSP - ADMX_SharedFolders +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SharedFolders +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_SharedFolders policies + +
          +
          + ADMX_SharedFolders/PublishDfsRoots +
          +
          + ADMX_SharedFolders/PublishSharedFolders +
          +
          + +
          + + +**ADMX_SharedFolders/PublishDfsRoots** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether the user can publish DFS roots in Active Directory Domain Services (AD DS). + +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS . + +If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. + +> [!NOTE] +> The default is to allow shared folders to be published when this setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow DFS roots to be published* +- GP name: *PublishDfsRoots* +- GP path: *Shared Folders* +- GP ADMX file name: *SharedFolders.admx* + + + + +
          + + +**ADMX_SharedFolders/PublishSharedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether the user can publish shared folders in Active Directory Domain Services (AD DS). + +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS. + +If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled. + +> [!NOTE] +> The default is to allow shared folders to be published when this setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow shared folders to be published* +- GP name: *PublishSharedFolders* +- GP path: *Shared Folders* +- GP ADMX file name: *SharedFolders.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md new file mode 100644 index 0000000000..a293d2b013 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -0,0 +1,113 @@ +--- +title: Policy CSP - ADMX_Sharing +description: Policy CSP - ADMX_Sharing +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Sharing +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Sharing policies + +
          +
          + ADMX_Sharing/NoInplaceSharing +
          +
          + +
          + + +**ADMX_Sharing/NoInplaceSharing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile. + +If you enable this policy setting, users cannot share files within their profile using the sharing wizard. Also, the sharing wizard cannot create a share at %root%\users and can only be used to create SMB shares on folders. + +If you disable or don't configure this policy setting, users can share files out of their user profile after an administrator has opted in the computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from sharing files within their profile.* +- GP name: *NoInplaceSharing* +- GP path: *Windows Components\Network Sharing* +- GP ADMX file name: *Sharing.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md new file mode 100644 index 0000000000..e8df85ad6d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -0,0 +1,348 @@ +--- +title: Policy CSP - ADMX_ShellCommandPromptRegEditTools +description: Policy CSP - ADMX_ShellCommandPromptRegEditTools +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ShellCommandPromptRegEditTools +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_ShellCommandPromptRegEditTools policies + +
          +
          + ADMX_ShellCommandPromptRegEditTools/DisableCMD +
          +
          + ADMX_ShellCommandPromptRegEditTools/DisableRegedit +
          +
          + ADMX_ShellCommandPromptRegEditTools/DisallowApps +
          +
          + ADMX_ShellCommandPromptRegEditTools/RestrictApps +
          +
          + + +
          + + +**ADMX_ShellCommandPromptRegEditTools/DisableCMD** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from running the interactive command prompt, Cmd.exe. This policy setting also determines whether batch files (.cmd and .bat) can run on the computer. + +If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action. + +If you disable this policy setting or do not configure it, users can run Cmd.exe and batch files normally. + +> [!NOTE] +> Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Remote Desktop Services. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to the command prompt* +- GP name: *DisableCMD* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
          + + +**ADMX_ShellCommandPromptRegEditTools/DisableRegedit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Disables the Windows registry editor Regedit.exe. + +If you enable this policy setting and the user tries to start Regedit.exe, a message appears explaining that a policy setting prevents the action. + +If you disable this policy setting or do not configure it, users can run Regedit.exe normally. + +To prevent users from using other administrative tools, use the "Run only specified Windows applications" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to registry editing tools* +- GP name: *DisableRegedit* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + + +
          + + +**ADMX_ShellCommandPromptRegEditTools/DisallowApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents Windows from running the programs you specify in this policy setting. + +If you enable this policy setting, users cannot run programs that you add to the list of disallowed applications. + +If you disable this policy setting or do not configure it, users can run any programs. + +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. + +> [!NOTE] +> Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +> To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Don't run specified Windows applications* +- GP name: *DisallowApps* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
          + + +**ADMX_ShellCommandPromptRegEditTools/RestrictApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Limits the Windows programs that users have permission to run on the computer. + +If you enable this policy setting, users can only run programs that you add to the list of allowed applications. + +If you disable this policy setting or do not configure it, users can run all applications. + +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. + +> [!NOTE] +> Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +> To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run only specified Windows applications* +- GP name: *RestrictApps* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md new file mode 100644 index 0000000000..76452c2119 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -0,0 +1,1229 @@ +--- +title: Policy CSP - ADMX_Smartcard +description: Policy CSP - ADMX_Smartcard +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Smartcard +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Smartcard policies + +
          +
          + ADMX_Smartcard/AllowCertificatesWithNoEKU +
          +
          + ADMX_Smartcard/AllowIntegratedUnblock +
          +
          + ADMX_Smartcard/AllowSignatureOnlyKeys +
          +
          + ADMX_Smartcard/AllowTimeInvalidCertificates +
          +
          + ADMX_Smartcard/CertPropEnabledString +
          +
          + ADMX_Smartcard/CertPropRootCleanupString +
          +
          + ADMX_Smartcard/CertPropRootEnabledString +
          +
          + ADMX_Smartcard/DisallowPlaintextPin +
          +
          + ADMX_Smartcard/EnumerateECCCerts +
          +
          + ADMX_Smartcard/FilterDuplicateCerts +
          +
          + ADMX_Smartcard/ForceReadingAllCertificates +
          +
          + ADMX_Smartcard/IntegratedUnblockPromptString +
          +
          + ADMX_Smartcard/ReverseSubject +
          +
          + ADMX_Smartcard/SCPnPEnabled +
          +
          + ADMX_Smartcard/SCPnPNotification +
          +
          + ADMX_Smartcard/X509HintsNeeded +
          +
          + + +
          + + +**ADMX_Smartcard/AllowCertificatesWithNoEKU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon. + +In versions of Windows prior to Windows Vista, smart card certificates that are used for logon require an enhanced key usage (EKU) extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. + +If you enable this policy setting, certificates with the following attributes can also be used to log on with a smart card: + +- Certificates with no EKU +- Certificates with an All Purpose EKU +- Certificates with a Client Authentication EKU + +If you disable or do not configure this policy setting, only certificates that contain the smart card logon object identifier can be used to log on with a smart card. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow certificates with no extended key usage certificate attribute* +- GP name: *AllowCertificatesWithNoEKU* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/AllowIntegratedUnblock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets you determine whether the integrated unblock feature will be available in the logon User Interface (UI). + +In order to use the integrated unblock feature your smart card must support this feature. Please check with your hardware manufacturer to see if your smart card supports this feature. + +If you enable this policy setting, the integrated unblock feature will be available. + +If you disable or do not configure this policy setting then the integrated unblock feature will not be available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Integrated Unblock screen to be displayed at the time of logon* +- GP name: *AllowIntegratedUnblock* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/AllowSignatureOnlyKeys** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets you allow signature key-based certificates to be enumerated and available for logon. + +If you enable this policy setting then any certificates available on the smart card with a signature only key will be listed on the logon screen. + +If you disable or do not configure this policy setting, any available smart card signature key-based certificates will not be listed on the logon screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow signature keys valid for Logon* +- GP name: *AllowSignatureOnlyKeys* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/AllowTimeInvalidCertificates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting permits those certificates to be displayed for logon that are either expired or not yet valid. + +Under previous versions of Microsoft Windows, certificates were required to contain a valid time and not be expired. The certificate must still be accepted by the domain controller in order to be used. This setting only controls the displaying of the certificate on the client machine. + +If you enable this policy setting certificates will be listed on the logon screen regardless of whether they have an invalid time or their time validity has expired. + +If you disable or do not configure this policy setting, certificates which are expired or not yet valid will not be listed on the logon screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow time invalid certificates* +- GP name: *AllowTimeInvalidCertificates* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/CertPropEnabledString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted. + +If you enable or do not configure this policy setting then certificate propagation will occur when you insert your smart card. + +If you disable this policy setting, certificate propagation will not occur and the certificates will not be made available to applications such as Outlook. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on certificate propagation from smart card* +- GP name: *CertPropEnabledString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/CertPropRootCleanupString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the cleanup behavior of root certificates. If you enable this policy setting then root certificate cleanup will occur according to the option selected. If you disable or do not configure this setting then root certificate cleanup will occur on logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure root certificate clean up* +- GP name: *CertPropRootCleanupString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/CertPropRootEnabledString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted. + +If you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card. + +> [!NOTE] +> For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card. + +If you disable this policy setting then root certificates will not be propagated from the smart card. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on root certificate propagation from smart card* +- GP name: *CertPropRootEnabledString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/DisallowPlaintextPin** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents plaintext PINs from being returned by Credential Manager. + +If you enable this policy setting, Credential Manager does not return a plaintext PIN. + +If you disable or do not configure this policy setting, plaintext PINs can be returned by Credential Manager. + +> [!NOTE] +> Enabling this policy setting could prevent certain smart cards from working on Windows. Please consult your smart card manufacturer to find out whether you will be affected by this policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent plaintext PINs from being returned by Credential Manager* +- GP name: *DisallowPlaintextPin* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/EnumerateECCCerts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to log on to a domain. + +If you enable this policy setting, ECC certificates on a smart card can be used to log on to a domain. + +If you disable or do not configure this policy setting, ECC certificates on a smart card cannot be used to log on to a domain. + +> [!NOTE] +> This policy setting only affects a user's ability to log on to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting. +> If you use an ECDSA key to log on, you must also have an associated ECDH key to permit logons when you are not connected to the network. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow ECC certificates to be used for logon and authentication* +- GP name: *EnumerateECCCerts* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/FilterDuplicateCerts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets you configure if all your valid logon certificates are displayed. + +During the certificate renewal period, a user can have multiple valid logon certificates issued from the same certificate template. This can cause confusion as to which certificate to select for logon. The common case for this behavior is when a certificate is renewed and the old one has not yet expired. Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (determined by their UPN). + +If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the certificate with the expiration time furthest in the future will be shown. + +> [!NOTE] +> This setting will be applied after the following policy: "Allow time invalid certificates" + +If you enable or do not configure this policy setting, filtering will take place. + +If you disable this policy setting, no filtering will take place. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Filter duplicate logon certificates* +- GP name: *FilterDuplicateCerts* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/ForceReadingAllCertificates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the reading of all certificates from the smart card for logon. + +During logon Windows will by default only read the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This setting forces Windows to read all the certificates from the card. This can introduce a significant performance decrease in certain situations. Please contact your smart card vendor to determine if your smart card and associated CSP supports the required behavior. + +If you enable this setting, then Windows will attempt to read all certificates from the smart card regardless of the feature set of the CSP. + +If you disable or do not configure this setting, Windows will only attempt to read the default certificate from those cards that do not support retrieval of all certificates in a single call. Certificates other than the default will not be available for logon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force the reading of all certificates from the smart card* +- GP name: *ForceReadingAllCertificates* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/IntegratedUnblockPromptString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the displayed message when a smart card is blocked. + +If you enable this policy setting, the specified message will be displayed to the user when the smart card is blocked. + +> [!NOTE] +> The following policy setting must be enabled: Allow Integrated Unblock screen to be displayed at the time of logon. + +If you disable or do not configure this policy setting, the default message will be displayed to the user when the smart card is blocked, if the integrated unblock feature is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display string when smart card is blocked* +- GP name: *IntegratedUnblockPromptString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/ReverseSubject** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets you reverse the subject name from how it is stored in the certificate when displaying it during logon. + +By default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another. For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of user1@example.com then "User1" will be displayed along with "user1@example.com." If the UPN is not present then the entire subject name will be displayed. This setting controls the appearance of that subject name and might need to be adjusted per organization. + +If you enable this policy setting or do not configure this setting, then the subject name will be reversed. + +If you disable, the subject name will be displayed as it appears in the certificate. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reverse the subject name stored in a certificate when displaying* +- GP name: *ReverseSubject* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/SCPnPEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to control whether Smart Card Plug and Play is enabled. + +If you enable or do not configure this policy setting, Smart Card Plug and Play will be enabled and the system will attempt to install a Smart Card device driver when a card is inserted in a Smart Card Reader for the first time. + +If you disable this policy setting, Smart Card Plug and Play will be disabled and a device driver will not be installed when a card is inserted in a Smart Card Reader. + +> [!NOTE] +> This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Smart Card Plug and Play service* +- GP name: *SCPnPEnabled* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/SCPnPNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to control whether a confirmation message is displayed when a smart card device driver is installed. + +If you enable or do not configure this policy setting, a confirmation message will be displayed when a smart card device driver is installed. + +If you disable this policy setting, a confirmation message will not be displayed when a smart card device driver is installed. + +> [!NOTE] +> This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Notify user of successful smart card driver installation* +- GP name: *SCPnPNotification* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + + +**ADMX_Smartcard/X509HintsNeeded** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting lets you determine whether an optional field will be displayed during logon and elevation that allows a user to enter his or her user name or user name and domain, thereby associating a certificate with that user. + +If you enable this policy setting then an optional field that allows a user to enter their user name or user name and domain will be displayed. + +If you disable or do not configure this policy setting, an optional field that allows users to enter their user name or user name and domain will not be displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow user name hint* +- GP name: *X509HintsNeeded* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-snmp.md b/windows/client-management/mdm/policy-csp-admx-snmp.md new file mode 100644 index 0000000000..2a83f8346c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-snmp.md @@ -0,0 +1,290 @@ +--- +title: Policy CSP - ADMX_Snmp +description: Policy CSP - ADMX_Snmp +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/24/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Snmp +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Snmp policies + +
          +
          + ADMX_Snmp/SNMP_Communities +
          +
          + ADMX_Snmp/SNMP_PermittedManagers +
          +
          + ADMX_Snmp/SNMP_Traps_Public +
          +
          + + +
          + + +**ADMX_Snmp/SNMP_Communities** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures a list of the communities defined to the Simple Network Management Protocol (SNMP) service. + +SNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events. + +A valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network. + +If you enable this policy setting, the SNMP agent only accepts requests from management systems within the communities it recognizes, and only SNMP Read operation is allowed for the community. + +If you disable or do not configure this policy setting, the SNMP service takes the Valid Communities configured on the local computer instead. + +Best practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control. + +> [!NOTE] +> - It is good practice to use a cryptic community name. +> - This policy setting has no effect if the SNMP agent is not installed on the client computer. + +Also, see the other two SNMP settings: "Specify permitted managers" and "Specify trap configuration". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify communities* +- GP name: *SNMP_Communities* +- GP path: *Network\SNMP* +- GP ADMX file name: *Snmp.admx* + + + +
          + + +**ADMX_Snmp/SNMP_PermittedManagers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent running on the client computer. + +Simple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events. + +The manager is located on the host computer on the network. The manager's role is to poll the agents for certain requested information. + +If you enable this policy setting, the SNMP agent only accepts requests from the list of permitted managers that you configure using this setting. + +If you disable or do not configure this policy setting, SNMP service takes the permitted managers configured on the local computer instead. + +Best practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\PermittedManagers key to allow only the local admin group full control. + +> [!NOTE] +> This policy setting has no effect if the SNMP agent is not installed on the client computer. + +Also, see the other two SNMP policy settings: "Specify trap configuration" and "Specify Community Name". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify permitted managers* +- GP name: *SNMP_PermittedManagers* +- GP path: *Network\SNMP* +- GP ADMX file name: *Snmp.admx* + + + +
          + + +**ADMX_Snmp/SNMP_Traps_Public** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows trap configuration for the Simple Network Management Protocol (SNMP) agent. + +Simple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events. + +This policy setting allows you to configure the name of the hosts that receive trap messages for the community sent by the SNMP service. A trap message is an alert or significant event that allows the SNMP agent to notify management systems asynchronously. + +If you enable this policy setting, the SNMP service sends trap messages to the hosts within the "public" community. + +If you disable or do not configure this policy setting, the SNMP service takes the trap configuration configured on the local computer instead. + +> [!NOTE] +> This setting has no effect if the SNMP agent is not installed on the client computer. + +Also, see the other two SNMP settings: "Specify permitted managers" and "Specify Community Name". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify traps for public community* +- GP name: *SNMP_Traps_Public* +- GP path: *Network\SNMP* +- GP ADMX file name: *Snmp.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md new file mode 100644 index 0000000000..09955c429e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -0,0 +1,5010 @@ +--- +title: Policy CSP - ADMX_StartMenu +description: Policy CSP - ADMX_StartMenu +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/20/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_StartMenu +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_StartMenu policies + +
          +
          + ADMX_StartMenu/AddSearchInternetLinkInStartMenu +
          +
          + ADMX_StartMenu/ClearRecentDocsOnExit +
          +
          + ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu +
          +
          + ADMX_StartMenu/ClearTilesOnExit +
          +
          + ADMX_StartMenu/DesktopAppsFirstInAppsView +
          +
          + ADMX_StartMenu/DisableGlobalSearchOnAppsView +
          +
          + ADMX_StartMenu/ForceStartMenuLogOff +
          +
          + ADMX_StartMenu/GoToDesktopOnSignIn +
          +
          + ADMX_StartMenu/GreyMSIAds +
          +
          + ADMX_StartMenu/HidePowerOptions +
          +
          + ADMX_StartMenu/Intellimenus +
          +
          + ADMX_StartMenu/LockTaskbar +
          +
          + ADMX_StartMenu/MemCheckBoxInRunDlg +
          +
          + ADMX_StartMenu/NoAutoTrayNotify +
          +
          + ADMX_StartMenu/NoBalloonTip +
          +
          + ADMX_StartMenu/NoChangeStartMenu +
          +
          + ADMX_StartMenu/NoClose +
          +
          + ADMX_StartMenu/NoCommonGroups +
          +
          + ADMX_StartMenu/NoFavoritesMenu +
          +
          + ADMX_StartMenu/NoFind +
          +
          + ADMX_StartMenu/NoGamesFolderOnStartMenu +
          +
          + ADMX_StartMenu/NoHelp +
          +
          + ADMX_StartMenu/NoInstrumentation +
          +
          + ADMX_StartMenu/NoMoreProgramsList +
          +
          + ADMX_StartMenu/NoNetAndDialupConnect +
          +
          + ADMX_StartMenu/NoPinnedPrograms +
          +
          + ADMX_StartMenu/NoRecentDocsMenu +
          +
          + ADMX_StartMenu/NoResolveSearch +
          +
          + ADMX_StartMenu/NoResolveTrack +
          +
          + ADMX_StartMenu/NoRun +
          +
          + ADMX_StartMenu/NoSMConfigurePrograms +
          +
          + ADMX_StartMenu/NoSMMyDocuments +
          +
          + ADMX_StartMenu/NoSMMyMusic +
          +
          + ADMX_StartMenu/NoSMMyNetworkPlaces +
          +
          + ADMX_StartMenu/NoSMMyPictures +
          +
          + ADMX_StartMenu/NoSearchCommInStartMenu +
          +
          + ADMX_StartMenu/NoSearchComputerLinkInStartMenu +
          +
          + ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu +
          +
          + ADMX_StartMenu/NoSearchFilesInStartMenu +
          +
          + ADMX_StartMenu/NoSearchInternetInStartMenu +
          +
          + ADMX_StartMenu/NoSearchProgramsInStartMenu +
          +
          + ADMX_StartMenu/NoSetFolders +
          +
          + ADMX_StartMenu/NoSetTaskbar +
          +
          + ADMX_StartMenu/NoStartMenuDownload +
          +
          + ADMX_StartMenu/NoStartMenuHomegroup +
          +
          + ADMX_StartMenu/NoStartMenuRecordedTV +
          +
          + ADMX_StartMenu/NoStartMenuSubFolders +
          +
          + ADMX_StartMenu/NoStartMenuVideos +
          +
          + ADMX_StartMenu/NoStartPage +
          +
          + ADMX_StartMenu/NoTaskBarClock +
          +
          + ADMX_StartMenu/NoTaskGrouping +
          +
          + ADMX_StartMenu/NoToolbarsOnTaskbar +
          +
          + ADMX_StartMenu/NoTrayContextMenu +
          +
          + ADMX_StartMenu/NoTrayItemsDisplay +
          +
          + ADMX_StartMenu/NoUninstallFromStart +
          +
          + ADMX_StartMenu/NoUserFolderOnStartMenu +
          +
          + ADMX_StartMenu/NoUserNameOnStartMenu +
          +
          + ADMX_StartMenu/NoWindowsUpdate +
          +
          + ADMX_StartMenu/PowerButtonAction +
          +
          + ADMX_StartMenu/QuickLaunchEnabled +
          +
          + ADMX_StartMenu/RemoveUnDockPCButton +
          +
          + ADMX_StartMenu/ShowAppsViewOnStart +
          +
          + ADMX_StartMenu/ShowRunAsDifferentUserInStart +
          +
          + ADMX_StartMenu/ShowRunInStartMenu +
          +
          + ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey +
          +
          + ADMX_StartMenu/StartMenuLogOff +
          +
          + ADMX_StartMenu/StartPinAppsWhenInstalled +
          +
          + + +
          + + +**ADMX_StartMenu/AddSearchInternetLinkInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, a "Search the Internet" link is shown when the user performs a search in the start menu search box. This button launches the default browser with the search terms. + +If you disable this policy, there will not be a "Search the Internet" link when the user performs a search in the start menu search box. + +If you do not configure this policy (default), there will not be a "Search the Internet" link on the start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Search Internet link to Start Menu* +- GP name: *AddSearchInternetLinkInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ClearRecentDocsOnExit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Clear history of recently opened documents on exit. + +If you enable this setting, the system deletes shortcuts to recently used document files when the user logs off. As a result, the Recent Items menu on the Start menu is always empty when the user logs on. In addition, recently and frequently used items in the Jump Lists off of programs in the Start Menu and Taskbar will be cleared when the user logs off. + +If you disable or do not configure this setting, the system retains document shortcuts, and when a user logs on, the Recent Items menu and the Jump Lists appear just as it did when the user logged off. + +> [!NOTE] +> The system saves document shortcuts in the user profile in the System-drive\Users\User-name\Recent folder. + +Also, see the "Remove Recent Items menu from Start Menu" and "Do not keep history of recently opened documents" policies in this folder. The system only uses this setting when neither of these related settings are selected. + +This setting does not clear the list of recent files that Windows programs display at the bottom of the File menu. See the "Do not keep history of recently opened documents" setting. + +This policy setting also does not hide document shortcuts displayed in the Open dialog box. See the "Hide the dropdown list of recent files" setting. + +This policy also does not clear items that the user may have pinned to the Jump Lists, or Tasks that the application has provided for their menu. See the "Do not allow pinning items in Jump Lists" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Clear history of recently opened documents on exit* +- GP name: *ClearRecentDocsOnExit* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting, the recent programs list in the start menu will be blank for each new user. + +If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Clear the recent programs list for new users* +- GP name: *ClearRecentProgForNewUserInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ClearTilesOnExit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the system deletes tile notifications when the user logs on. As a result, the Tiles in the start view will always show their default content when the user logs on. In addition, any cached versions of these notifications will be cleared when the user logs on. + +If you disable or do not configure this setting, the system retains notifications, and when a user logs on, the tiles appear just as they did when the user logged off, including the history of previous notifications for each tile. + +This setting does not prevent new notifications from appearing. See the "Turn off Application Notifications" setting to prevent new notifications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Clear tile notifications during log on* +- GP name: *ClearTilesOnExit* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/DesktopAppsFirstInAppsView** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows desktop apps to be listed first in the Apps view in Start. + +If you enable this policy setting, desktop apps would be listed first when the apps are sorted by category in the Apps view. The other sorting options would continue to be available and the user could choose to change their default sorting options. + +If you disable or don't configure this policy setting, the desktop apps won't be listed first when the apps are sorted by category, and the user can configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List desktop apps first in the Apps view* +- GP name: *DesktopAppsFirstInAppsView* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/DisableGlobalSearchOnAppsView** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the user from searching apps, files, settings (and the web if enabled) when the user searches from the Apps view. + +This policy setting is only applied when the Apps view is set as the default view for Start. + +If you enable this policy setting, searching from the Apps view will only search the list of installed apps. + +If you disable or don’t configure this policy setting, the user can configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Search just apps from the Apps view* +- GP name: *DisableGlobalSearchOnAppsView* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ForceStartMenuLogOff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy only applies to the classic version of the start menu and does not affect the new style start menu. + +Adds the "Log Off ``" item to the Start menu and prevents users from removing it. + +If you enable this setting, the Log Off `` item appears in the Start menu. This setting also removes the Display Logoff item from Start Menu Options. As a result, users cannot remove the Log Off `` item from the Start Menu. + +If you disable this setting or do not configure it, users can use the Display Logoff item to add and remove the Log Off item. + +This setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press Ctrl+Alt+Del. + +Note: To add or remove the Log Off item on a computer, click Start, click Settings, click Taskbar and Start Menu, click the Start Menu Options tab, and then, in the Start Menu Settings box, click Display Logoff. + +Also, see "Remove Logoff" in User Configuration\Administrative Templates\System\Logon/Logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Logoff to the Start Menu* +- GP name: *ForceStartMenuLogOff* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/GoToDesktopOnSignIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to go to the desktop instead of the Start screen when they sign in. + +If you enable this policy setting, users will always go to the desktop when they sign in. + +If you disable this policy setting, users will always go to the Start screen when they sign in. + +If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Go to the desktop instead of Start when signing in* +- GP name: *GoToDesktopOnSignIn* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/GreyMSIAds** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Displays Start menu shortcuts to partially installed programs in gray text. + +This setting makes it easier for users to distinguish between programs that are fully installed and those that are only partially installed. + +Partially installed programs include those that a system administrator assigns using Windows Installer and those that users have configured for full installation upon first use. + +If you disable this setting or do not configure it, all Start menu shortcuts appear as black text. + +> [!NOTE] +> Enabling this setting can make the Start menu slow to open. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Gray unavailable Windows Installer programs Start Menu shortcuts* +- GP name: *GreyMSIAds* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/HidePowerOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from performing the following commands from the Windows security screen, the logon screen, and the Start menu: Shut Down, Restart, Sleep, and Hibernate. This policy setting does not prevent users from running Windows-based programs that perform these functions. + +If you enable this policy setting, the shutdown, restart, sleep, and hibernate commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE, and from the logon screen. + +If you disable or do not configure this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are available on the Start menu. The Power button on the Windows Security and logon screens is also available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* +- GP name: *HidePowerOptions* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/Intellimenus** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Disables personalized menus. + +Windows personalizes long menus by moving recently used items to the top of the menu and hiding items that have not been used recently. Users can display the hidden items by clicking an arrow to extend the menu. + +If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect. + +> [!NOTE] +> Personalized menus require user tracking. If you enable the "Turn off user tracking" setting, the system disables user tracking and personalized menus and ignores this setting. + +To Turn off personalized menus without specifying a setting, click Start, click Settings, click Taskbar and Start Menu, and then, on the General tab, clear the "Use Personalized Menus" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off personalized menus* +- GP name: *Intellimenus* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/LockTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the taskbar, which is used to switch between running applications. + +The taskbar includes the Start button, list of currently running tasks, and the notification area. By default, the taskbar is located at the bottom of the screen, but it can be dragged to any side of the screen. When it is locked, it cannot be moved or resized. + +If you enable this setting, it prevents the user from moving or resizing the taskbar. While the taskbar is locked, auto-hide and other taskbar options are still available in Taskbar properties. + +If you disable this setting or do not configure it, the user can configure the taskbar position. + +> [!NOTE] +> Enabling this setting also locks the QuickLaunch bar and any other toolbars that the user has on their taskbar. The toolbar's position is locked, and the user cannot show and hide various toolbars using the taskbar context menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lock the Taskbar* +- GP name: *LockTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/MemCheckBoxInRunDlg** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets users run a 16-bit program in a dedicated (not shared) Virtual DOS Machine (VDM) process. + +All DOS and 16-bit programs run on Windows 2000 Professional and Windows XP Professional in the Windows Virtual DOS Machine program. VDM simulates a 16-bit environment, complete with the DLLs required by 16-bit programs. By default, all 16-bit programs run as threads in a single, shared VDM process. As such, they share the memory space allocated to the VDM process and cannot run simultaneously. + +Enabling this setting adds a check box to the Run dialog box, giving users the option of running a 16-bit program in its own dedicated NTVDM process. The additional check box is enabled only when a user enters a 16-bit program in the Run dialog box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add "Run in Separate Memory Space" check box to Run dialog box* +- GP name: *MemCheckBoxInRunDlg* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoAutoTrayNotify** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the notification area, also called the "system tray." + +The notification area is located in the task bar, generally at the bottom of the screen, and it includes the clock and current notifications. This setting determines whether the items are always expanded or always collapsed. By default, notifications are collapsed. The notification cleanup << icon can be referred to as the "notification chevron." + +If you enable this setting, the system notification area expands to show all of the notifications that use this area. + +If you disable this setting, the system notification area will always collapse notifications. + +If you do not configure it, the user can choose if they want notifications collapsed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off notification area cleanup* +- GP name: *NoAutoTrayNotify* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoBalloonTip** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Hides pop-up text on the Start menu and in the notification area. + +When you hold the cursor over an item on the Start menu or in the notification area, the system displays pop-up text providing additional information about the object. + +If you enable this setting, some of this pop-up text is not displayed. The pop-up text affected by this setting includes "Click here to begin" on the Start button, "Where have all my programs gone" on the Start menu, and "Where have my icons gone" in the notification area. + +If you disable this setting or do not configure it, all pop-up text is displayed on the Start menu and in the notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Balloon Tips on Start Menu items* +- GP name: *NoBalloonTip* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoChangeStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from changing their Start screen layout. + +If you enable this setting, you will prevent a user from selecting an app, resizing a tile, pinning/unpinning a tile or a secondary tile, entering the customize mode and rearranging tiles within Start and Apps. + +If you disable or do not configure this setting, you will allow a user to select an app, resize a tile, pin/unpin a tile or a secondary tile, enter the customize mode and rearrange tiles within Start and Apps. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from customizing their Start Screen* +- GP name: *NoChangeStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from performing the following commands from the Start menu or Windows Security screen: Shut Down, Restart, Sleep, and Hibernate. This policy setting does not prevent users from running Windows-based programs that perform these functions. + +If you enable this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE. + +If you disable or do not configure this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are available on the Start menu. The Power button on the Windows Security screen is also available. + +> [!NOTE] +> Third-party programs certified as compatible with Microsoft Windows Vista, Windows XP SP2, Windows XP SP1, Windows XP, or Windows 2000 Professional are required to support this policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* +- GP name: *NoClose* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoCommonGroups** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes items in the All Users profile from the Programs menu on the Start menu. + +By default, the Programs menu contains items from the All Users profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu. + +To see the Program menu items in the All Users profile, on the system drive, go to ProgramData\Microsoft\Windows\Start Menu\Programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove common program groups from Start Menu* +- GP name: *NoCommonGroups* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoFavoritesMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adding the Favorites menu to the Start menu or classic Start menu. + +If you enable this setting, the Display Favorites item does not appear in the Advanced Start menu options box. + +If you disable or do not configure this setting, the Display Favorite item is available. + +> [!NOTE] +> The Favorities menu does not appear on the Start menu by default. To display the Favorites menu, right-click Start, click Properties, and then click Customize. If you are using Start menu, click the Advanced tab, and then, under Start menu items, click the Favorites menu. If you are using the classic Start menu, click Display Favorites under Advanced Start menu options. +> +> The items that appear in the Favorites menu when you install Windows are preconfigured by the system to appeal to most users. However, users can add and remove items from this menu, and system administrators can create a customized Favorites menu for a user group. +> +> This setting only affects the Start menu. The Favorites item still appears in File Explorer and in Internet Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Favorites menu from Start Menu* +- GP name: *NoFavoritesMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoFind** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Search link from the Start menu, and disables some File Explorer search elements. Note that this does not remove the search box from the new style Start menu. + +If you enable this policy setting, the Search item is removed from the Start menu and from the context menu that appears when you right-click the Start menu. Also, the system does not respond when users press the Application key (the key with the Windows logo)+ F. + +Note: Enabling this policy setting also prevents the user from using the F3 key. + +In File Explorer, the Search item still appears on the Standard buttons toolbar, but the system does not respond when the user presses Ctrl+F. Also, Search does not appear in the context menu when you right-click an icon representing a drive or a folder. + +This policy setting affects the specified user interface elements only. It does not affect Internet Explorer and does not prevent the user from using other methods to search. + +If you disable or do not configure this policy setting, the Search link is available from the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Search link from Start Menu* +- GP name: *NoFind* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoGamesFolderOnStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu will not show a link to the Games folder. + +If you disable or do not configure this policy, the start menu will show a link to the Games folder, unless the user chooses to remove it in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Games link from Start Menu* +- GP name: *NoGamesFolderOnStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoHelp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Help command from the Start menu. + +If you enable this policy setting, the Help command is removed from the Start menu. + +If you disable or do not configure this policy setting, the Help command is available from the Start menu. + +This policy setting only affects the Start menu. It does not remove the Help menu from File Explorer and does not prevent users from running Help. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Help menu from Start Menu* +- GP name: *NoHelp* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoInstrumentation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off user tracking. + +If you enable this policy setting, the system does not track the programs that the user runs, and does not display frequently used programs in the Start Menu. + +If you disable or do not configure this policy setting, the system tracks the programs that the user runs. The system uses this information to customize Windows features, such as showing frequently used programs in the Start Menu. + +Also, see these related policy settings: "Remove frequent programs liist from the Start Menu" and "Turn off personalized menus". + +This policy setting does not prevent users from pinning programs to the Start Menu or Taskbar. See the "Remove pinned programs list from the Start Menu" and "Do not allow pinning programs to the Taskbar" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off user tracking* +- GP name: *NoInstrumentation* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoMoreProgramsList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu. + +Selecting "Collapse" will not display the app list next to the pinned tiles in Start. An "All apps" button will be displayed on Start to open the all apps list. This is equivalent to setting the "Show app list in Start" in Settings to Off. + +Selecting "Collapse and disable setting" will do the same as the collapse option and disable the "Show app list in Start menu" in Settings, so users cannot turn it to On. + +Selecting "Remove and disable setting" will remove the all apps list from Start and disable the "Show app list in Start menu" in Settings, so users cannot turn it to On. Select this option for compatibility with earlier versions of Windows. + +If you disable or do not configure this setting, the all apps list will be visible by default, and the user can change "Show app list in Start" in Settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove All Programs list from the Start menu* +- GP name: *NoMoreProgramsList* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoNetAndDialupConnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove Network Connections from the Start Menu. + +If you enable this policy setting, users are prevented from running Network Connections. + +Enabling this policy setting prevents the Network Connections folder from opening. This policy setting also removes Network Connections from Settings on the Start menu. + +Network Connections still appears in Control Panel and in File Explorer, but if users try to start it, a message appears explaining that a setting prevents the action. + +If you disable or do not configure this policy setting, Network Connections is available from the Start Menu. + +Also, see the "Disable programs on Settings menu" and "Disable Control Panel" policy settings and the policy settings in the Network Connections folder (Computer Configuration and User Configuration\Administrative Templates\Network\Network Connections). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Network Connections from Start Menu* +- GP name: *NoNetAndDialupConnect* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoPinnedPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the "Pinned Programs" list is removed from the Start menu. Users cannot pin programs to the Start menu. + +In Windows XP and Windows Vista, the Internet and email checkboxes are removed from the 'Customize Start Menu' dialog. + +If you disable this setting or do not configure it, the "Pinned Programs" list remains on the Start menu. Users can pin and unpin programs in the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove pinned programs list from the Start Menu* +- GP name: *NoPinnedPrograms* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoRecentDocsMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Recent Items menu from the Start menu. Removes the Documents menu from the classic Start menu. + +The Recent Items menu contains links to the non-program files that users have most recently opened. It appears so that users can easily reopen their documents. + +If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on. + +If you later disable the setting, so that the Recent Items menu appears in the Start Menu, the document shortcuts saved before the setting was enabled and while it was in effect appear in the Recent Items menu. + +When the setting is disabled, the Recent Items menu appears in the Start Menu, and users cannot remove it. + +If the setting is not configured, users can turn the Recent Items menu on and off. + +> [!NOTE] +> This setting does not prevent Windows programs from displaying shortcuts to recently opened documents. See the "Do not keep history of recently opened documents" setting. + +This setting also does not hide document shortcuts displayed in the Open dialog box. See the "Hide the dropdown list of recent files" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Recent Items menu from Start Menu* +- GP name: *NoRecentDocsMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoResolveSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the system from conducting a comprehensive search of the target drive to resolve a shortcut. + +If you enable this policy setting, the system does not conduct the final drive search. It just displays a message explaining that the file is not found. + +If you disable or do not configure this policy setting, by default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file. + +> [!NOTE] +> This policy setting only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability. + +Also, see the "Do not track Shell shortcuts during roaming" and the "Do not use the tracking-based method when resolving shell shortcuts" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not use the search-based method when resolving shell shortcuts* +- GP name: *NoResolveSearch* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoResolveTrack** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the system from using NTFS tracking features to resolve a shortcut. + +If you enable this policy setting, the system does not try to locate the file by using its file ID. It skips this step and begins a comprehensive search of the drive specified in the target path. + +If you disable or do not configure this policy setting, by default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file. + +> [!NOTE] +> This policy setting only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability. + +Also, see the "Do not track Shell shortcuts during roaming" and the "Do not use the search-based method when resolving shell shortcuts" policy settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not use the tracking-based method when resolving shell shortcuts* +- GP name: *NoResolveTrack* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoRun** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Allows you to remove the Run command from the Start menu, Internet Explorer, and Task Manager. + +If you enable this setting, the following changes occur: + +1. The Run command is removed from the Start menu. + +2. The New Task (Run) command is removed from Task Manager. + +3. The user will be blocked from entering the following into the Internet Explorer Address Bar: + + - A UNC path: `\\\` + + - Accessing local drives: e.g., C: + + - Accessing local folders: e.g., `\` + +Also, users with extended keyboards will no longer be able to display the Run dialog box by pressing the Application key (the key with the Windows logo) + R. + +If you disable or do not configure this setting, users will be able to access the Run command in the Start menu and in Task Manager and use the Internet Explorer Address Bar. + +> [!NOTE] +> This setting affects the specified interface only. It does not prevent users from using other methods to run programs. +> +> It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Run menu from Start Menu* +- GP name: *NoRun* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSMConfigurePrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Default Programs link from the Start menu. + +If you enable this policy setting, the Default Programs link is removed from the Start menu. + +Clicking the Default Programs link from the Start menu opens the Default Programs control panel and provides administrators the ability to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. + +If you disable or do not configure this policy setting, the Default Programs link is available from the Start menu. + +> [!NOTE] +> This policy setting does not prevent the Set Default Programs for This Computer option from appearing in the Default Programs control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Default Programs link from the Start menu.* +- GP name: *NoSMConfigurePrograms* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSMMyDocuments** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Documents icon from the Start menu and its submenus. + +If you enable this policy setting, the Documents icon is removed from the Start menu and its submenus. Enabling this policy setting only removes the icon. It does not prevent the user from using other methods to gain access to the contents of the Documents folder. + +> [!NOTE] +> To make changes to this policy setting effective, you must log off and then log on. + +If you disable or do not configure this policy setting, he Documents icon is available from the Start menu. + +Also, see the "Remove Documents icon on the desktop" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Documents icon from Start Menu* +- GP name: *NoSMMyDocuments* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSMMyMusic** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Music icon from Start Menu. + +If you enable this policy setting, the Music icon is no longer available from Start Menu. + +If you disable or do not configure this policy setting, the Music icon is available from Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Music icon from Start Menu* +- GP name: *NoSMMyMusic* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSMMyNetworkPlaces** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build.This policy setting allows you to remove the Network icon from Start Menu. + +If you enable this policy setting, the Network icon is no longer available from Start Menu. + +If you disable or do not configure this policy setting, the Network icon is available from Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Network icon from Start Menu* +- GP name: *NoSMMyNetworkPlaces* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSMMyPictures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Pictures icon from Start Menu. + +If you enable this policy setting, the Pictures icon is no longer available from Start Menu. + +If you disable or do not configure this policy setting, the Pictures icon is available from Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Pictures icon from Start Menu* +- GP name: *NoSMMyPictures* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSearchCommInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu search box will not search for communications. + +If you disable or do not configure this policy, the start menu will search for communications, unless the user chooses not to in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search communications* +- GP name: *NoSearchCommInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSearchComputerLinkInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, the "See all results" link will not be shown when the user performs a search in the start menu search box. + +If you disable or do not configure this policy, the "See all results" link will be shown when the user performs a search in the start menu search box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Search Computer link* +- GP name: *NoSearchComputerLinkInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. + +If you disable or do not configure this policy, a "See more results" link will be shown when the user performs a search in the start menu search box. If a 3rd party protocol handler is installed, a "Search Everywhere" link will be shown instead of the "See more results" link. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove See More Results / Search Everywhere link* +- GP name: *NoSearchEverywhereLinkInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSearchFilesInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting the Start menu search box will not search for files. + +If you disable or do not configure this policy setting, the Start menu will search for files, unless the user chooses not to do so directly in Control Panel. If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search for files* +- GP name: *NoSearchFilesInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSearchInternetInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu search box will not search for internet history or favorites. + +If you disable or do not configure this policy, the start menu will search for for internet history or favorites, unless the user chooses not to in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search Internet* +- GP name: *NoSearchInternetInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSearchProgramsInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting the Start menu search box will not search for programs or Control Panel items. + +If you disable or do not configure this policy setting, the Start menu search box will search for programs and Control Panel items, unless the user chooses not to do so directly in Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search programs and Control Panel items* +- GP name: *NoSearchProgramsInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSetFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove programs on Settings menu. + +If you enable this policy setting, the Control Panel, Printers, and Network and Connection folders are removed from Settings on the Start menu, and from Computer and File Explorer. It also prevents the programs represented by these folders (such as Control.exe) from running. + +However, users can still start Control Panel items by using other methods, such as right-clicking the desktop to start Display or right-clicking Computer to start System. + +If you disable or do not configure this policy setting, the Control Panel, Printers, and Network and Connection folders from Settings are available on the Start menu, and from Computer and File Explorer. + +Also, see the "Disable Control Panel," "Disable Display in Control Panel," and "Remove Network Connections from Start Menu" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove programs on Settings menu* +- GP name: *NoSetFolders* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoSetTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent changes to Taskbar and Start Menu Settings. + +If you enable this policy setting, The user will be prevented from opening the Taskbar Properties dialog box. + +If the user right-clicks the taskbar and then clicks Properties, a message appears explaining that a setting prevents the action. + +If you disable or do not configure this policy setting, the Taskbar and Start Menu items are available from Settings on the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changes to Taskbar and Start Menu Settings* +- GP name: *NoSetTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoStartMenuDownload** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Downloads link from the Start Menu. + +If you enable this policy setting, the Start Menu does not show a link to the Downloads folder. + +If you disable or do not configure this policy setting, the Downloads link is available from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Downloads link from Start Menu* +- GP name: *NoStartMenuDownload* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoStartMenuHomegroup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the Start menu will not show a link to Homegroup. It also removes the homegroup item from the Start Menu options. As a result, users cannot add the homegroup link to the Start Menu. + +If you disable or do not configure this policy, users can use the Start Menu options to add or remove the homegroup link from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Homegroup link from Start Menu* +- GP name: *NoStartMenuHomegroup* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoStartMenuRecordedTV** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Recorded TV link from the Start Menu. + +If you enable this policy setting, the Start Menu does not show a link to the Recorded TV library. + +If you disable or do not configure this policy setting, the Recorded TV link is available from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Recorded TV link from Start Menu* +- GP name: *NoStartMenuRecordedTV* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoStartMenuSubFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Hides all folders on the user-specific (top) section of the Start menu. Other items appear, but folders are hidden. + +This setting is designed for use with redirected folders. Redirected folders appear on the main (bottom) section of the Start menu. However, the original, user-specific version of the folder still appears on the top section of the Start menu. Because the appearance of two folders with the same name might confuse users, you can use this setting to hide user-specific folders. + +Note that this setting hides all user-specific folders, not just those associated with redirected folders. + +If you enable this setting, no folders appear on the top section of the Start menu. If users add folders to the Start Menu directory in their user profiles, the folders appear in the directory but not on the Start menu. + +If you disable this setting or do not configured it, Windows 2000 Professional and Windows XP Professional display folders on both sections of the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove user's folders from the Start Menu* +- GP name: *NoStartMenuSubFolders* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoStartMenuVideos** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Videos link from the Start Menu. + +If you enable this policy setting, the Start Menu does not show a link to the Videos library. + +If you disable or do not configure this policy setting, the Videos link is available from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Videos link from Start Menu* +- GP name: *NoStartMenuVideos* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoStartPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the presentation of the Start menu. + +The classic Start menu in Windows 2000 Professional allows users to begin common tasks, while the new Start menu consolidates common items onto one menu. When the classic Start menu is used, the following icons are placed on the desktop: Documents, Pictures, Music, Computer, and Network. The new Start menu starts them directly. + +If you enable this setting, the Start menu displays the classic Start menu in the Windows 2000 style and displays the standard desktop icons. + +If you disable this setting, the Start menu only displays in the new style, meaning the desktop icons are now on the Start page. + +If you do not configure this setting, the default is the new style, and the user can change the view. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force classic Start Menu* +- GP name: *NoStartPage* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoTaskBarClock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents the clock in the system notification area from being displayed. + +If you enable this setting, the clock will not be displayed in the system notification area. + +If you disable or do not configure this setting, the default behavior of the clock appearing in the notification area will occur. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Clock from the system notification area* +- GP name: *NoTaskBarClock* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoTaskGrouping** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the taskbar buttons used to switch between running programs. + +Taskbar grouping consolidates similar applications when there is no room on the taskbar. It kicks in when the user's taskbar is full. + +If you enable this setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled. + +If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent grouping of taskbar items* +- GP name: *NoTaskGrouping* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoToolbarsOnTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the taskbar. + +The taskbar includes the Start button, buttons for currently running tasks, custom toolbars, the notification area, and the system clock. Toolbars include Quick Launch, Address, Links, Desktop, and other custom toolbars created by the user or by an application. + +If this setting is enabled, the taskbar does not display any custom toolbars, and the user cannot add any custom toolbars to the taskbar. Moreover, the "Toolbars" menu command and submenu are removed from the context menu. The taskbar displays only the Start button, taskbar buttons, the notification area, and the system clock. + +If this setting is disabled or is not configured, the taskbar displays all toolbars. Users can add or remove custom toolbars, and the "Toolbars" command appears in the context menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display any custom toolbars in the taskbar* +- GP name: *NoToolbarsOnTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoTrayContextMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove access to the context menus for the taskbar. + +If you enable this policy setting, the menus that appear when you right-click the taskbar and items on the taskbar are hidden, such as the Start button, the clock, and the taskbar buttons. + +If you disable or do not configure this policy setting, the context menus for the taskbar are available. + +This policy setting does not prevent users from using other methods to issue the commands that appear on these menus. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove access to the context menus for the taskbar* +- GP name: *NoTrayContextMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoTrayItemsDisplay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the notification area (previously called the "system tray") on the taskbar. + +The notification area is located at the far right end of the task bar and includes the icons for current notifications and the system clock. + +If this setting is enabled, the user’s entire notification area, including the notification icons, is hidden. The taskbar displays only the Start button, taskbar buttons, custom toolbars (if any), and the system clock. + +If this setting is disabled or is not configured, the notification area is shown in the user's taskbar. + +> [!NOTE] +> Enabling this setting overrides the "Turn off notification area cleanup" setting, because if the notification area is hidden, there is no need to clean up the icons. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the notification area* +- GP name: *NoTrayItemsDisplay* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoUninstallFromStart** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, users cannot uninstall apps from Start. + +If you disable this setting or do not configure it, users can access the uninstall command from Start. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from uninstalling applications from Start* +- GP name: *NoUninstallFromStart* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoUserFolderOnStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu will not show a link to the user's storage folder. + +If you disable or do not configure this policy, the start menu will display a link, unless the user chooses to remove it in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove user folder link from Start Menu* +- GP name: *NoUserFolderOnStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoUserNameOnStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the user name label from the Start Menu in Windows XP and Windows Server 2003. + +If you enable this policy setting, the user name label is removed from the Start Menu in Windows XP and Windows Server 2003. + +To remove the user name folder on Windows Vista, set the "Remove user folder link from Start Menu" policy setting. + +If you disable or do not configure this policy setting, the user name label appears on the Start Menu in Windows XP and Windows Server 2003. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove user name from Start Menu* +- GP name: *NoUserNameOnStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/NoWindowsUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove links and access to Windows Update. + +If you enable this policy setting, users are prevented from connecting to the Windows Update Web site. + +Enabling this policy setting blocks user access to the Windows Update Web site at https://windowsupdate.microsoft.com. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. + +Windows Update, the online extension of Windows, offers software updates to keep a user’s system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download. + +If you disable or do not configure this policy setting, the Windows Update hyperlink is available from the Start menu and from the Tools menu in Internet Explorer. + +Also, see the "Hide the "Add programs from Microsoft" option" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove links and access to Windows Update* +- GP name: *NoWindowsUpdate* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/PowerButtonAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Set the default action of the power button on the Start menu. + +If you enable this setting, the Start Menu will set the power button to the chosen action, and not let the user change this action. + +If you set the button to either Sleep or Hibernate, and that state is not supported on a computer, then the button will fall back to Shut Down. + +If you disable or do not configure this setting, the Start Menu power button will be set to Shut Down by default, and the user can change this setting to another action. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Change Start Menu power button* +- GP name: *PowerButtonAction* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/QuickLaunchEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the QuickLaunch bar is displayed in the Taskbar. + +If you enable this policy setting, the QuickLaunch bar will be visible and cannot be turned off. + +If you disable this policy setting, the QuickLaunch bar will be hidden and cannot be turned on. + +If you do not configure this policy setting, then users will be able to turn the QuickLaunch bar on and off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show QuickLaunch on Taskbar* +- GP name: *QuickLaunchEnabled* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/RemoveUnDockPCButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the "Undock PC" button is removed from the simple Start Menu, and your PC cannot be undocked. + +If you disable this setting or do not configure it, the "Undock PC" button remains on the simple Start menu, and your PC can be undocked. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the "Undock PC" button from the Start Menu* +- GP name: *RemoveUnDockPCButton* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ShowAppsViewOnStart** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the Apps view to be opened by default when the user goes to Start. + +If you enable this policy setting, the Apps view will appear whenever the user goes to Start. Users will still be able to switch between the Apps view and the Start screen. + +If you disable or don’t configure this policy setting, the Start screen will appear by default whenever the user goes to Start, and the user will be able to switch between the Apps view and the Start screen. Also, the user will be able to configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show the Apps view automatically when the user goes to Start* +- GP name: *ShowAppsViewOnStart* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ShowRunAsDifferentUserInStart** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting shows or hides the "Run as different user" command on the Start application bar. + +If you enable this setting, users can access the "Run as different user" command from Start for applications which support this functionality. + +If you disable this setting or do not configure it, users cannot access the "Run as different user" command from Start for any applications. + +> [!NOTE] +> This setting does not prevent users from using other methods, such as the shift right-click menu on application's jumplists in the taskbar to issue the "Run as different user" command. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show "Run as different user" command on Start* +- GP name: *ShowRunAsDifferentUserInStart* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ShowRunInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the Run command is added to the Start menu. + +If you disable or do not configure this setting, the Run command is not visible on the Start menu by default, but it can be added from the Taskbar and Start menu properties. + +If the Remove Run link from Start Menu policy is set, the Add the Run command to the Start menu policy has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add the Run command to the Start Menu* +- GP name: *ShowRunInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the Start screen to appear on the display the user is using when they press the Windows logo key. This setting only applies to users who are using multiple displays. + +If you enable this policy setting, the Start screen will appear on the display the user is using when they press the Windows logo key. + +If you disable or don't configure this policy setting, the Start screen will always appear on the main display when the user presses the Windows logo key. Users will still be able to open Start on other displays by pressing the Start button on that display. Also, the user will be able to configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show Start on the display the user is using when they press the Windows logo key* +- GP name: *ShowStartOnDisplayWithForegroundOnWinKey* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/StartMenuLogOff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to removes the "Log Off ``" item from the Start menu and prevents users from restoring it. + +If you enable this policy setting, the Log Off `` item does not appear in the Start menu. This policy setting also removes the Display Logoff item from Start Menu Options. As a result, users cannot restore the Log Off `` item to the Start Menu. + +If you disable or do not configure this policy setting, users can use the Display Logoff item to add and remove the Log Off item. + +This policy setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press Ctrl+Alt+Del, and it does not prevent users from using other methods to log off. + +Tip: To add or remove the Log Off item on a computer, click Start, click Settings, click Taskbar and Start Menu, click the Start Menu Options tab and, in the Start Menu Settings box, click Display Logoff. + +See also: "Remove Logoff" policy setting in User Configuration\Administrative Templates\System\Logon/Logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Logoff on the Start Menu* +- GP name: *StartMenuLogOff* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + + +**ADMX_StartMenu/StartPinAppsWhenInstalled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows pinning apps to Start by default, when they are included by AppID on the list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pin Apps to Start when installed* +- GP name: *StartPinAppsWhenInstalled* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md new file mode 100644 index 0000000000..8e49043225 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -0,0 +1,120 @@ +--- +title: Policy CSP - ADMX_SystemRestore +description: Policy CSP - ADMX_SystemRestore +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SystemRestore +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_SystemRestore policies + +
          +
          + ADMX_SystemRestore/SR_DisableConfig +
          +
          + + +
          + + +**ADMX_SystemRestore/SR_DisableConfig** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Allows you to disable System Restore configuration through System Protection. + +This policy setting allows you to turn off System Restore configuration through System Protection. + +System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this policy setting depends on the "Turn off System Restore" policy setting. + +If you enable this policy setting, the option to configure System Restore through System Protection is disabled. + +If you disable or do not configure this policy setting, users can change the System Restore settings through System Protection. + +Also, see the "Turn off System Restore" policy setting. If the "Turn off System Restore" policy setting is enabled, the "Turn off System Restore configuration" policy setting is overwritten. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Configuration* +- GP name: *SR_DisableConfig* +- GP path: *System\System Restore* +- GP ADMX file name: *SystemRestore.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md new file mode 100644 index 0000000000..d7177153a7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -0,0 +1,1663 @@ +--- +title: Policy CSP - ADMX_Taskbar +description: Policy CSP - ADMX_Taskbar +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Taskbar +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Taskbar policies + +
          +
          + ADMX_Taskbar/DisableNotificationCenter +
          +
          + ADMX_Taskbar/EnableLegacyBalloonNotifications +
          +
          + ADMX_Taskbar/HideSCAHealth +
          +
          + ADMX_Taskbar/HideSCANetwork +
          +
          + ADMX_Taskbar/HideSCAPower +
          +
          + ADMX_Taskbar/HideSCAVolume +
          +
          + ADMX_Taskbar/NoBalloonFeatureAdvertisements +
          +
          + ADMX_Taskbar/NoPinningStoreToTaskbar +
          +
          + ADMX_Taskbar/NoPinningToDestinations +
          +
          + ADMX_Taskbar/NoPinningToTaskbar +
          +
          + ADMX_Taskbar/NoRemoteDestinations +
          +
          + ADMX_Taskbar/NoSystraySystemPromotion +
          +
          + ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar +
          +
          + ADMX_Taskbar/TaskbarLockAll +
          +
          + ADMX_Taskbar/TaskbarNoAddRemoveToolbar +
          +
          + ADMX_Taskbar/TaskbarNoDragToolbar +
          +
          + ADMX_Taskbar/TaskbarNoMultimon +
          +
          + ADMX_Taskbar/TaskbarNoNotification +
          +
          + ADMX_Taskbar/TaskbarNoPinnedList +
          +
          + ADMX_Taskbar/TaskbarNoRedock +
          +
          + ADMX_Taskbar/TaskbarNoResize +
          +
          + ADMX_Taskbar/TaskbarNoThumbnail +
          +
          + + +
          + + +**ADMX_Taskbar/DisableNotificationCenter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes Notifications and Action Center from the notification area on the taskbar. + +The notification area is located at the far right end of the taskbar and includes icons for current notifications and the system clock. + +If this setting is enabled, Notifications and Action Center is not displayed in the notification area. The user will be able to read notifications when they appear, but they won’t be able to review any notifications they miss. + +If you disable or do not configure this policy setting, Notification and Security and Maintenance will be displayed on the taskbar. + +A reboot is required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Notifications and Action Center* +- GP name: *DisableNotificationCenter* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/EnableLegacyBalloonNotifications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy disables the functionality that converts balloons to toast notifications. + +If you enable this policy setting, system and application notifications will render as balloons instead of toast notifications. + +Enable this policy setting if a specific app or system component that uses balloon notifications has compatibility issues with toast notifications. + +If you disable or don’t configure this policy setting, all notifications will appear as toast notifications. + +A reboot is required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable showing balloon notifications as toasts.* +- GP name: *EnableLegacyBalloonNotifications* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/HideSCAHealth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove Security and Maintenance from the system control area. + +If you enable this policy setting, the Security and Maintenance icon is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the Security and Maintenance icon is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the Security and Maintenance icon* +- GP name: *HideSCAHealth* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/HideSCANetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the networking icon from the system control area. + +If you enable this policy setting, the networking icon is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the networking icon is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the networking icon* +- GP name: *HideSCANetwork* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/HideSCAPower** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the battery meter from the system control area. + +If you enable this policy setting, the battery meter is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the battery meter is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the battery meter* +- GP name: *HideSCAPower* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/HideSCAVolume** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the volume control icon from the system control area. + +If you enable this policy setting, the volume control icon is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the volume control icon is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the volume control icon* +- GP name: *HideSCAVolume* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/NoBalloonFeatureAdvertisements** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off feature advertisement balloon notifications. + +If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown. + +If you disable do not configure this policy setting, feature advertisement balloons are shown. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off feature advertisement balloon notifications* +- GP name: *NoBalloonFeatureAdvertisements* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/NoPinningStoreToTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control pinning the Store app to the Taskbar. + +If you enable this policy setting, users cannot pin the Store app to the Taskbar. If the Store app is already pinned to the Taskbar, it will be removed from the Taskbar on next login. + +If you disable or do not configure this policy setting, users can pin the Store app to the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow pinning Store app to the Taskbar* +- GP name: *NoPinningStoreToTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/NoPinningToDestinations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control pinning items in Jump Lists. + +If you enable this policy setting, users cannot pin files, folders, websites, or other items to their Jump Lists in the Start Menu and Taskbar. Users also cannot unpin existing items pinned to their Jump Lists. Existing items already pinned to their Jump Lists will continue to show. + +If you disable or do not configure this policy setting, users can pin files, folders, websites, and other items to a program's Jump List so that the items is always present in this menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow pinning items in Jump Lists* +- GP name: *NoPinningToDestinations* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + + +**ADMX_Taskbar/NoPinningToTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control pinning programs to the Taskbar. + +If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. + +If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow pinning programs to the Taskbar* +- GP name: *NoPinningToTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/NoRemoteDestinations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control displaying or tracking items in Jump Lists from remote locations. + +The Start Menu and Taskbar display Jump Lists off of programs. These menus include files, folders, websites and other relevant items for that program. This helps users more easily reopen their most important documents and other tasks. + +If you enable this policy setting, the Start Menu and Taskbar only track the files that the user opens locally on this computer. Files that the user opens over the network from remote computers are not tracked or shown in the Jump Lists. Use this setting to reduce network traffic, particularly over slow network connections. + +If you disable or do not configure this policy setting, all files that the user opens appear in the menus, including files located remotely on another computer. Note: This setting does not prevent Windows from displaying remote files that the user has explicitly pinned to the Jump Lists. See the "Do not allow pinning items in Jump Lists" policy setting. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display or track items in Jump Lists from remote locations* +- GP name: *NoRemoteDestinations* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/NoSystraySystemPromotion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off automatic promotion of notification icons to the taskbar. + +If you enable this policy setting, newly added notification icons are not temporarily promoted to the Taskbar. Users can still configure icons to be shown or hidden in the Notification Control Panel. + +If you disable or do not configure this policy setting, newly added notification icons are temporarily promoted to the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic promotion of notification icons to the taskbar* +- GP name: *NoSystraySystemPromotion* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to see Windows Store apps on the taskbar. + +If you enable this policy setting, users will see Windows Store apps on the taskbar. + +If you disable this policy setting, users won’t see Windows Store apps on the taskbar. + +If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show Windows Store apps on the taskbar* +- GP name: *ShowWindowsStoreAppsOnTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarLockAll** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to lock all taskbar settings. + +If you enable this policy setting, the user cannot access the taskbar control panel. The user is also unable to resize, move or rearrange toolbars on their taskbar. + +If you disable or do not configure this policy setting, the user will be able to set any taskbar setting that is not prevented by another policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lock all taskbar settings* +- GP name: *TaskbarLockAll* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoAddRemoveToolbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from adding or removing toolbars. + +If you enable this policy setting, the user is not allowed to add or remove any toolbars to the taskbar. Applications are not able to add toolbars either. + +If you disable or do not configure this policy setting, the users and applications are able to add toolbars to the taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from adding or removing toolbars* +- GP name: *TaskbarNoAddRemoveToolbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoDragToolbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from rearranging toolbars. + +If you enable this policy setting, users are not able to drag or drop toolbars to the taskbar. + +If you disable or do not configure this policy setting, users are able to rearrange the toolbars on the taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from rearranging toolbars* +- GP name: *TaskbarNoDragToolbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoMultimon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent taskbars from being displayed on more than one monitor. + +If you enable this policy setting, users are not able to show taskbars on more than one display. The multiple display section is not enabled in the taskbar properties dialog. + +If you disable or do not configure this policy setting, users can show taskbars on more than one display. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow taskbars on more than one display* +- GP name: *TaskbarNoMultimon* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off all notification balloons. + +If you enable this policy setting, no notification balloons are shown to the user. + +If you disable or do not configure this policy setting, notification balloons are shown to the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off all balloon notifications* +- GP name: *TaskbarNoNotification* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoPinnedList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove pinned programs from the taskbar. + +If you enable this policy setting, pinned programs are prevented from being shown on the Taskbar. Users cannot pin programs to the Taskbar. + +If you disable or do not configure this policy setting, users can pin programs so that the program shortcuts stay on the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove pinned programs from the Taskbar* +- GP name: *TaskbarNoPinnedList* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoRedock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from moving taskbar to another screen dock location. + +If you enable this policy setting, users are not able to drag their taskbar to another area of the monitor(s). + +If you disable or do not configure this policy setting, users are able to drag their taskbar to another area of the monitor unless prevented by another policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from moving taskbar to another screen dock location* +- GP name: *TaskbarNoRedock* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoResize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from resizing the taskbar. + +If you enable this policy setting, users are not be able to resize their taskbar. + +If you disable or do not configure this policy setting, users are able to resize their taskbar unless prevented by another setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from resizing the taskbar* +- GP name: *TaskbarNoResize* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +
          + + +**ADMX_Taskbar/TaskbarNoThumbnail** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off taskbar thumbnails. + +If you enable this policy setting, the taskbar thumbnails are not displayed and the system uses standard text for the tooltips. + +If you disable or do not configure this policy setting, the taskbar thumbnails are displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off taskbar thumbnails* +- GP name: *TaskbarNoThumbnail* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md new file mode 100644 index 0000000000..b43d4d2011 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -0,0 +1,1011 @@ +--- +title: Policy CSP - ADMX_tcpip +description: Policy CSP - ADMX_tcpip +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_tcpip +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_tcpip policies + +
          +
          + ADMX_tcpip/6to4_Router_Name +
          +
          + ADMX_tcpip/6to4_Router_Name_Resolution_Interval +
          +
          + ADMX_tcpip/6to4_State +
          +
          + ADMX_tcpip/IPHTTPS_ClientState +
          +
          + ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State +
          +
          + ADMX_tcpip/ISATAP_Router_Name +
          +
          + ADMX_tcpip/ISATAP_State +
          +
          + ADMX_tcpip/Teredo_Client_Port +
          +
          + ADMX_tcpip/Teredo_Default_Qualified +
          +
          + ADMX_tcpip/Teredo_Refresh_Rate +
          +
          + ADMX_tcpip/Teredo_Server_Name +
          +
          + ADMX_tcpip/Teredo_State +
          +
          + ADMX_tcpip/Windows_Scaling_Heuristics_State +
          +
          + + +
          + + +**ADMX_tcpip/6to4_Router_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify a 6to4 relay name for a 6to4 host. A 6to4 relay is used as a default gateway for IPv6 network traffic sent by the 6to4 host. The 6to4 relay name setting has no effect if 6to4 connectivity is not available on the host. + +If you enable this policy setting, you can specify a relay name for a 6to4 host. + +If you disable or do not configure this policy setting, the local host setting is used, and you cannot specify a relay name for a 6to4 host. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set 6to4 Relay Name* +- GP name: *6to4_Router_Name* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/6to4_Router_Name_Resolution_Interval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify the interval at which the relay name is resolved. The 6to4 relay name resolution interval setting has no effect if 6to4 connectivity is not available on the host. + +If you enable this policy setting, you can specify the value for the duration at which the relay name is resolved periodically. + +If you disable or do not configure this policy setting, the local host setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set 6to4 Relay Name Resolution Interval* +- GP name: *6to4_Router_Name_Resolution_Interval* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/6to4_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure 6to4, an address assignment and router-to-router automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 sites and hosts across the IPv4 Internet. 6to4 uses the global address prefix: 2002:WWXX:YYZZ::/48 in which the letters are a hexadecimal representation of the global IPv4 address (w.x.y.z) assigned to a site. + +If you disable or do not configure this policy setting, the local host setting is used. + +If you enable this policy setting, you can configure 6to4 with one of the following settings: + +Policy Default State: 6to4 is turned off and connectivity with 6to4 will not be available. + +Policy Enabled State: If a global IPv4 address is present, the host will have a 6to4 interface. If no global IPv4 address is present, the host will not have a 6to4 interface. + +Policy Disabled State: 6to4 is turned off and connectivity with 6to4 will not be available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set 6to4 State* +- GP name: *6to4_State* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/IPHTTPS_ClientState** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure IP-HTTPS, a tunneling technology that uses the HTTPS protocol to provide IP connectivity to a remote network. + +If you disable or do not configure this policy setting, the local host settings are used. + +If you enable this policy setting, you can specify an IP-HTTPS server URL. You will be able to configure IP-HTTPS with one of the following settings: + +Policy Default State: The IP-HTTPS interface is used when there are no other connectivity options. + +Policy Enabled State: The IP-HTTPS interface is always present, even if the host has other connectivity options. + +Policy Disabled State: No IP-HTTPS interfaces are present on the host. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set IP-HTTPS State* +- GP name: *IPHTTPS_ClientState* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure IP Stateless Autoconfiguration Limits. + +If you enable or do not configure this policy setting, IP Stateless Autoconfiguration Limits will be enabled and system will limit the number of autoconfigured addresses and routes. + +If you disable this policy setting, IP Stateless Autoconfiguration Limits will be disabled and system will not limit the number of autoconfigured addresses and routes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set IP Stateless Autoconfiguration Limits State* +- GP name: *IP_Stateless_Autoconfiguration_Limits_State* +- GP path: *Network\TCPIP Settings\Parameters* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/ISATAP_Router_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify a router name or Internet Protocol version 4 (IPv4) address for an ISATAP router. + +If you enable this policy setting, you can specify a router name or IPv4 address for an ISATAP router. If you enter an IPv4 address of the ISATAP router in the text box, DNS services are not required. + +If you disable or do not configure this policy setting, the local host setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set ISATAP Router Name* +- GP name: *ISATAP_Router_Name* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/ISATAP_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), an address-to-router and host-to-host, host-to-router and router-to-host automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 hosts across an IPv4 intranet. + +If you disable or do not configure this policy setting, the local host setting is used. + +If you enable this policy setting, you can configure ISATAP with one of the following settings: + +Policy Default State: No ISATAP interfaces are present on the host. + +Policy Enabled State: If the ISATAP name is resolved successfully, the host will have ISATAP configured with a link-local address and an address for each prefix received from the ISATAP router through stateless address auto-configuration. If the ISATAP name is not resolved successfully, the host will have an ISATAP interface configured with a link-local address. + +Policy Disabled State: No ISATAP interfaces are present on the host. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set ISATAP State* +- GP name: *ISATAP_State* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/Teredo_Client_Port** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to select the UDP port the Teredo client will use to send packets. If you leave the default of 0, the operating system will select a port (recommended). If you select a UDP port that is already in use by a system, the Teredo client will fail to initialize. + +If you enable this policy setting, you can customize a UDP port for the Teredo client. + +If you disable or do not configure this policy setting, the local host setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Client Port* +- GP name: *Teredo_Client_Port* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/Teredo_Default_Qualified** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state. + +If you disable or do not configure this policy setting, the local host setting is used. + +This policy setting contains only one state: + +Policy Enabled State: If Default Qualified is enabled, Teredo will attempt qualification immediately and remain qualified if the qualification process succeeds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Default Qualified* +- GP name: *Teredo_Default_Qualified* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/Teredo_Refresh_Rate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure the Teredo refresh rate. + +> [!NOTE] +> On a periodic basis (by default, every 30 seconds), Teredo clients send a single Router Solicitation packet to the Teredo server. The Teredo server sends a Router Advertisement Packet in response. This periodic packet refreshes the IP address and UDP port mapping in the translation table of the Teredo client's NAT device. + +If you enable this policy setting, you can specify the refresh rate. If you choose a refresh rate longer than the port mapping in the Teredo client's NAT device, Teredo might stop working or connectivity might be intermittent. + +If you disable or do not configure this policy setting, the refresh rate is configured using the local settings on the computer. The default refresh rate is 30 seconds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Refresh Rate* +- GP name: *Teredo_Refresh_Rate* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/Teredo_Server_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify the name of the Teredo server. This server name will be used on the Teredo client computer where this policy setting is applied. + +If you enable this policy setting, you can specify a Teredo server name that applies to a Teredo client. + +If you disable or do not configure this policy setting, the local settings on the computer are used to determine the Teredo server name. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Server Name* +- GP name: *Teredo_Server_Name* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/Teredo_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure Teredo, an address assignment and automatic tunneling technology that provides unicast IPv6 connectivity across the IPv4 Internet. + +If you disable or do not configure this policy setting, the local host settings are used. + +If you enable this policy setting, you can configure Teredo with one of the following settings: + +Default: The default state is "Client." + +Disabled: No Teredo interfaces are present on the host. + +Client: The Teredo interface is present only when the host is not on a network that includes a domain controller. + +Enterprise Client: The Teredo interface is always present, even if the host is on a network that includes a domain controller. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo State* +- GP name: *Teredo_State* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
          + + +**ADMX_tcpip/Windows_Scaling_Heuristics_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure Window Scaling Heuristics. Window Scaling Heuristics is an algorithm to identify connectivity and throughput problems caused by many Firewalls and other middle boxes that don't interpret Window Scaling option correctly. + +If you do not configure this policy setting, the local host settings are used. + +If you enable this policy setting, Window Scaling Heuristics will be enabled and system will try to identify connectivity and throughput problems and take appropriate measures. + +If you disable this policy setting, Window Scaling Heuristics will be disabled and system will not try to identify connectivity and throughput problems caused by Firewalls or other middle boxes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Window Scaling Heuristics State* +- GP name: *Windows_Scaling_Heuristics_State* +- GP path: *Network\TCPIP Settings\Parameters* +- GP ADMX file name: *tcpip.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-thumbnails.md b/windows/client-management/mdm/policy-csp-admx-thumbnails.md new file mode 100644 index 0000000000..69fd52c66e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-thumbnails.md @@ -0,0 +1,264 @@ +--- +title: Policy CSP - ADMX_Thumbnails +description: Policy CSP - ADMX_Thumbnails +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/25/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Thumbnails +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_Thumbnails policies + +
          +
          + ADMX_Thumbnails/DisableThumbnails +
          +
          + ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders +
          +
          + ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders +
          +
          + +
          + + +**ADMX_Thumbnails/DisableThumbnails** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure how File Explorer displays thumbnail images or icons on the local computer. + +File Explorer displays thumbnail images by default. + +If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images. + +If you disable or do not configure this policy setting, File Explorer displays only thumbnail images. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the display of thumbnails and only display icons.* +- GP name: *DisableThumbnails* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Thumbnails.admx* + + + +
          + + +**ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure how File Explorer displays thumbnail images or icons on network folders. + +File Explorer displays thumbnail images on network folders by default. + +If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images on network folders. + +If you disable or do not configure this policy setting, File Explorer displays only thumbnail images on network folders. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the display of thumbnails and only display icons on network folders* +- GP name: *DisableThumbnailsOnNetworkFolders* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Thumbnails.admx* + + + +
          + + +**ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Turns off the caching of thumbnails in hidden thumbs.db files. + +This policy setting allows you to configure File Explorer to cache thumbnails of items residing in network folders in hidden thumbs.db files. + +If you enable this policy setting, File Explorer does not create, read from, or write to thumbs.db files. + +If you disable or do not configure this policy setting, File Explorer creates, reads from, and writes to thumbs.db files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the caching of thumbnails in hidden thumbs.db files* +- GP name: *DisableThumbsDBOnNetworkFolders* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Thumbnails.admx* + + + +
          + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md new file mode 100644 index 0000000000..aeec40aa7f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -0,0 +1,803 @@ +--- +title: Policy CSP - ADMX_TPM +description: Policy CSP - ADMX_TPM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/25/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_TPM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_TPM policies + +
          +
          + ADMX_TPM/BlockedCommandsList_Name +
          +
          + ADMX_TPM/ClearTPMIfNotReady_Name +
          +
          + ADMX_TPM/IgnoreDefaultList_Name +
          +
          + ADMX_TPM/IgnoreLocalList_Name +
          +
          + ADMX_TPM/OSManagedAuth_Name +
          +
          + ADMX_TPM/OptIntoDSHA_Name +
          +
          + ADMX_TPM/StandardUserAuthorizationFailureDuration_Name +
          +
          + ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name +
          +
          + ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name +
          +
          + ADMX_TPM/UseLegacyDAP_Name +
          +
          + + +
          + + +**ADMX_TPM/BlockedCommandsList_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Windows. + +If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is TPM_OwnerReadInternalPub, and command number 170 is TPM_FieldUpgrade. To find the command number associated with each TPM command with TPM 1.2, run "tpm.msc" and navigate to the "Command Management" section. + +If you disable or do not configure this policy setting, only those TPM commands specified through the default or local lists may be blocked by Windows. The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See related policy settings to enforce or ignore the default and local lists of blocked TPM commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the list of blocked TPM commands* +- GP name: *BlockedCommandsList_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/ClearTPMIfNotReady_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the system to prompt the user to clear the TPM if the TPM is detected to be in any state other than Ready. This policy will take effect only if the system’s TPM is in a state other than Ready, including if the TPM is “Ready, with reduced functionality”. The prompt to clear the TPM will start occurring after the next reboot, upon user login only if the logged in user is part of the Administrators group for the system. The prompt can be dismissed, but will reappear after every reboot and login until the policy is disabled or until the TPM is in a Ready state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the system to clear the TPM if it is not in a ready state.* +- GP name: *ClearTPMIfNotReady_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/IgnoreDefaultList_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands. + +If you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list. + +The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See the related policy setting to configure the Group Policy list of blocked TPM commands. + +If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to commands in the Group Policy and local lists of blocked TPM commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore the default list of blocked TPM commands* +- GP name: *IgnoreDefaultList_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/IgnoreLocalList_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands. + +If you enable this policy setting, Windows will ignore the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list. + +The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. The default list of blocked TPM commands is pre-configured by Windows. See the related policy setting to configure the Group Policy list of blocked TPM commands. + +If you disable or do not configure this policy setting, Windows will block the TPM commands found in the local list, in addition to commands in the Group Policy and default lists of blocked TPM commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore the local list of blocked TPM commands* +- GP name: *IgnoreLocalList_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/OSManagedAuth_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information stored locally, the operating system and TPM-based applications can perform certain TPM actions which require TPM owner authorization without requiring the user to enter the TPM owner password. + +You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none. + +If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. + +Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios which do not depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPM anti-hammering logic can be used. + +Choose the operating system managed TPM authentication setting of "Delegated" to store only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM anti-hammering logic. + +Choose the operating system managed TPM authentication setting of "None" for compatibility with previous operating systems and applications or for use with scenarios that require TPM owner authorization not be stored locally. Using this setting might cause issues with some TPM-based applications. + +> [!NOTE] +> If the operating system managed TPM authentication setting is changed from "Full" to "Delegated", the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the level of TPM owner authorization information available to the operating system* +- GP name: *OSManagedAuth_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/OptIntoDSHA_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This group policy enables Device Health Attestation reporting (DHA-report) on supported devices. It enables supported devices to send Device Health Attestation related information (device boot logs, PCR values, TPM certificate, etc.) to Device Health Attestation Service (DHA-Service) every time a device starts. Device Health Attestation Service validates the security state and health of the devices, and makes the findings accessible to enterprise administrators via a cloud based reporting portal. This policy is independent of DHA reports that are initiated by device manageability solutions (like MDM or SCCM), and will not interfere with their workflows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Device Health Attestation Monitoring and Reporting* +- GP name: *OptIntoDSHA_Name* +- GP path: *System\Device Health Attestation Service* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/StandardUserAuthorizationFailureDuration_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. If the number of TPM commands with an authorization failure within the duration equals a threshold, a standard user is prevented from sending commands requiring authorization to the TPM. + +This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + +An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than this duration are ignored. + +For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + +The Standard User Lockout Threshold Individual value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. + +The Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. + +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + +An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. + +If this value is not configured, a default value of 480 minutes (8 hours) is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Standard User Lockout Duration* +- GP name: *StandardUserAuthorizationFailureDuration_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). If the number of authorization failures for the user within the duration for Standard User Lockout Duration equals this value, the standard user is prevented from sending commands to the Trusted Platform Module (TPM) that require authorization. + +This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + +An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + +For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + +This value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. + +The Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. + +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + +An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. + +If this value is not configured, a default value of 4 is used. + +A value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Standard User Individual Lockout Threshold* +- GP name: *StandardUserAuthorizationFailureIndividualThreshold_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration for Standard User Lockout Duration equals this value, all standard users are prevented from sending commands to the Trusted Platform Module (TPM) that require authorization. + +This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + +An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + +For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + +The Standard User Individual Lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. + +This value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. + +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + +An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. + +If this value is not configured, a default value of 9 is used. + +A value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Standard User Total Lockout Threshold* +- GP name: *StandardUserAuthorizationFailureTotalThreshold_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + + +**ADMX_TPM/UseLegacyDAP_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below. Setting this policy will take effect only if a) the TPM was originally prepared using a version of Windows after Windows 10 Version 1607 and b) the System has a TPM 2.0. Note that enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only way for the disabled setting of this policy to take effect on a system where it was once enabled is to a) disable it from group policy and b)clear the TPM on the system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.* +- GP name: *UseLegacyDAP_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md new file mode 100644 index 0000000000..d967a2db8e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -0,0 +1,9476 @@ +--- +title: Policy CSP - ADMX_UserExperienceVirtualization +description: Policy CSP - ADMX_UserExperienceVirtualization +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/30/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_UserExperienceVirtualization +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_UserExperienceVirtualization policies + +
          +
          + ADMX_UserExperienceVirtualization/Calculator +
          +
          + ADMX_UserExperienceVirtualization/ConfigureSyncMethod +
          +
          + ADMX_UserExperienceVirtualization/ConfigureVdi +
          +
          + ADMX_UserExperienceVirtualization/ContactITDescription +
          +
          + ADMX_UserExperienceVirtualization/ContactITUrl +
          +
          + ADMX_UserExperienceVirtualization/DisableWin8Sync +
          +
          + ADMX_UserExperienceVirtualization/DisableWindowsOSSettings +
          +
          + ADMX_UserExperienceVirtualization/EnableUEV +
          +
          + ADMX_UserExperienceVirtualization/Finance +
          +
          + ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled +
          +
          + ADMX_UserExperienceVirtualization/Games +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer8 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer9 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer10 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorer11 +
          +
          + ADMX_UserExperienceVirtualization/InternetExplorerCommon +
          +
          + ADMX_UserExperienceVirtualization/Maps +
          +
          + ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013 +
          +
          + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016 +
          +
          + ADMX_UserExperienceVirtualization/Music +
          +
          + ADMX_UserExperienceVirtualization/News +
          +
          + ADMX_UserExperienceVirtualization/Notepad +
          +
          + ADMX_UserExperienceVirtualization/Reader +
          +
          + ADMX_UserExperienceVirtualization/RepositoryTimeout +
          +
          + ADMX_UserExperienceVirtualization/SettingsStoragePath +
          +
          + ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath +
          +
          + ADMX_UserExperienceVirtualization/Sports +
          +
          + ADMX_UserExperienceVirtualization/SyncEnabled +
          +
          + ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork +
          +
          + ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming +
          +
          + ADMX_UserExperienceVirtualization/SyncProviderPingEnabled +
          +
          + ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps +
          +
          + ADMX_UserExperienceVirtualization/Travel +
          +
          + ADMX_UserExperienceVirtualization/TrayIconEnabled +
          +
          + ADMX_UserExperienceVirtualization/Video +
          +
          + ADMX_UserExperienceVirtualization/Weather +
          +
          + ADMX_UserExperienceVirtualization/Wordpad +
          +
          + + +
          + + +**ADMX_UserExperienceVirtualization/Calculator** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings of Calculator. + +By default, the user settings of Calculator synchronize between computers. Use the policy setting to prevent the user settings of Calculator from synchronization between computers. + +If you enable this policy setting, the Calculator user settings continue to synchronize. + +If you disable this policy setting, Calculator user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Calculator* +- GP name: *Calculator* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/ConfigureSyncMethod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the sync provider used by User Experience Virtualization (UE-V) to sync settings between users’ computers. + +With Sync Method set to ”SyncProvider,” the UE-V Agent uses a built-in sync provider to keep user settings synchronized between the computer and the settings storage location. This is the default value. You can disable the sync provider on computers that never go offline and are always connected to the settings storage location. + +When SyncMethod is set to “None,” the UE-V Agent uses no sync provider. Settings are written directly to the settings storage location rather than being cached to sync later. + +Set SyncMethod to “External” when an external synchronization engine is being deployed for settings sync. This could use OneDrive, Work Folders, SharePoint or any other engine that uses a local folder to synchronize data between users’ computers. In this mode, UE-V writes settings data to the local folder specified in the settings storage path. + +These settings are then synchronized to other computers by an external synchronization engine. UE-V has no control over this synchronization. It only reads and writes the settings data when the normal UE-V triggers take place. +With notifications enabled, UE-V users receive a message when the settings sync is delayed. The notification delay policy setting defines the delay before a notification appears. + +If you disable this policy setting, the sync provider is used to synchronize settings between computers and the settings storage location. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Sync Method* +- GP name: *ConfigureSyncMethod* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/ConfigureVdi** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of User Experience Virtualization (UE-V) rollback information for computers running in a non-persistent, pooled VDI environment. + +UE-V settings rollback data and checkpoints are normally stored only on the local computer. With this policy setting enabled, the rollback information is copied to the settings storage location when the user logs off or shuts down their VDI session. + +Enable this setting to register a VDI-specific settings location template and restore data on computers in pooled VDI environments that reset to a clean state on logout. With this policy enabled you can roll settings back to the state when UE-V was installed or to “last-known-good” configurations. Only enable this policy setting on computers running in a non-persistent VDI environment. The VDI Collection Name defines the name of the virtual desktop collection containing the virtual computers. + +If you enable this policy setting, the UE-V rollback state is copied to the settings storage location on logout and restored on login. + +If you disable this policy setting, no UE-V rollback state is copied to the settings storage location. + +If you do not configure this policy, no UE-V rollback state is copied to the settings storage location. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *VDI Configuration* +- GP name: *ConfigureVdi* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/ContactITDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center. + +If you enable this policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL. + +If you disable this policy setting, the Company Settings Center does not display an IT Contact link. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Contact IT Link Text* +- GP name: *ContactITDescription* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/ContactITUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies the URL for the Contact IT link in the Company Settings Center. + +If you enable this policy setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol such as http or mailto. + +If you disable this policy setting, the Company Settings Center does not display an IT Contact link. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Contact IT URL* +- GP name: *ContactITUrl* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/DisableWin8Sync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings for Windows apps. + +By default, the UE-V Agent synchronizes settings for Windows apps between the computer and the settings storage location. + +If you enable this policy setting, the UE-V Agent will not synchronize settings for Windows apps. + +If you disable this policy setting, the UE-V Agent will synchronize settings for Windows apps. + +If you do not configure this policy setting, any defined values are deleted. + +> [!NOTE] +> If the user connects their Microsoft account for their computer then the UE-V Agent will not synchronize Windows apps. The Windows apps will default to whatever settings are configured in the Sync your settings configuration in Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not synchronize Windows Apps* +- GP name: *DisableWin8Sync* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/DisableWindowsOSSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of Windows settings between computers. Certain Windows settings will synchronize between computers by default. These settings include Windows themes, Windows desktop settings, Ease of Access settings, and network printers. Use this policy setting to specify which Windows settings synchronize between computers. You can also use these settings to enable synchronization of users' sign-in information for certain apps, networks, and certificates. + +If you enable this policy setting, only the selected Windows settings synchronize. Unselected Windows settings are excluded from settings synchronization. + +If you disable this policy setting, all Windows Settings are excluded from the settings synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize Windows settings* +- GP name: *DisableWindowsOSSettings* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/EnableUEV** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. + +Reboot is needed for enable to take effect. With Auto-register inbox templates enabled, the UE-V inbox templates such as Office 2016 will be automatically registered when the UE-V Service is enabled. If this option is changed, it will only take effect when UE-V service is re-enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable UEV* +- GP name: *EnableUEV* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Finance** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Finance app. By default, the user settings of Finance sync between computers. Use the policy setting to prevent the user settings of Finance from synchronizing between computers. + +If you enable this policy setting, Finance user settings continue to sync. + +If you disable this policy setting, Finance user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Finance* +- GP name: *Finance* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables a notification in the system tray that appears when the User Experience Virtualization (UE-V) Agent runs for the first time. By default, a notification informs users that Company Settings Center, the user-facing name for the UE-V Agent, now helps to synchronize settings between their work computers. + +With this setting enabled, the notification appears the first time that the UE-V Agent runs. + +With this setting disabled, no notification appears. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *First Use Notification* +- GP name: *FirstUseNotificationEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Games** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Games app. By default, the user settings of Games sync between computers. Use the policy setting to prevent the user settings of Games from synchronizing between computers. + +If you enable this policy setting, Games user settings continue to sync. + +If you disable this policy setting, Games user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Games* +- GP name: *Games* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/InternetExplorer8** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Internet Explorer 8. + +By default, the user settings of Internet Explorer 8 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 8 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 8 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 8 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 8* +- GP name: *InternetExplorer8* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/InternetExplorer9** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Internet Explorer 9. By default, the user settings of Internet Explorer 9 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 9 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 9 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 9 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 9* +- GP name: *InternetExplorer9* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/InternetExplorer10** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings of Internet Explorer 10. By default, the user settings of Internet Explorer 10 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 10 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 10 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 10 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 10* +- GP name: *InternetExplorer10* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/InternetExplorer11** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings of Internet Explorer 11. By default, the user settings of Internet Explorer 11 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 11 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 11 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 11 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 11* +- GP name: *InternetExplorer11* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/InternetExplorerCommon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings which are common between the versions of Internet Explorer. +By default, the user settings which are common between the versions of Internet Explorer synchronize between computers. Use the policy setting to prevent the user settings of Internet Explorer from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the versions of Internet Explorer continue to synchronize. + +If you disable this policy setting, the user settings which are common between the versions of Internet Explorer are excluded from settings synchronization. If any version of the Internet Explorer settings are enabled this policy setting should not be disabled. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer Common Settings* +- GP name: *InternetExplorerCommon* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + + + +**ADMX_UserExperienceVirtualization/Maps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Maps app. By default, the user settings of Maps sync between computers. Use the policy setting to prevent the user settings of Maps from synchronizing between computers. + +If you enable this policy setting, Maps user settings continue to sync. + +If you disable this policy setting, Maps user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maps* +- GP name: *Maps* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure the UE-V Agent to write a warning event to the event log when a settings package file size reaches a defined threshold. By default the UE-V Agent does not report information about package file size. + +If you enable this policy setting, specify the threshold file size in bytes. When the settings package file exceeds this threshold the UE-V Agent will write a warning event to the event log. + +If you disable or do not configure this policy setting, no event is written to the event log to report settings package size. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Settings package size warning threshold* +- GP name: *MaxPackageSizeInBytes* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Access 2010. By default, the user settings of Microsoft Access 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Access 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Access 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Access 2010* +- GP name: *MicrosoftOffice2010Access* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2010 applications. By default, the user settings which are common between the Microsoft Office Suite 2010 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2010 applications from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications continue to synchronize. + +If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2010 applications are enabled, this policy setting should not be disabled + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2010 Common Settings* +- GP name: *MicrosoftOffice2010Common* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Excel 2010. By default, the user settings of Microsoft Excel 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Excel 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Excel 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Excel 2010* +- GP name: *MicrosoftOffice2010Excel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft InfoPath 2010. By default, the user settings of Microsoft InfoPath 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft InfoPath 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft InfoPath 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft InfoPath 2010* +- GP name: *MicrosoftOffice2010InfoPath* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Lync 2010. By default, the user settings of Microsoft Lync 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Lync 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Lync 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Lync 2010* +- GP name: *MicrosoftOffice2010Lync* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft OneNote 2010. By default, the user settings of Microsoft OneNote 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft OneNote 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft OneNote 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneNote 2010* +- GP name: *MicrosoftOffice2010OneNote* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Outlook 2010. By default, the user settings of Microsoft Outlook 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Outlook 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Outlook 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Outlook 2010* +- GP name: *MicrosoftOffice2010Outlook* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2010. By default, the user settings of Microsoft PowerPoint 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft PowerPoint 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft PowerPoint 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft PowerPoint 2010* +- GP name: *MicrosoftOffice2010PowerPoint* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Project 2010. By default, the user settings of Microsoft Project 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Project 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Project 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Project 2010* +- GP name: *MicrosoftOffice2010Project* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Publisher 2010. By default, the user settings of Microsoft Publisher 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Publisher 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Publisher 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Publisher 2010* +- GP name: *MicrosoftOffice2010Publisher* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2010. By default, the user settings of Microsoft SharePoint Designer 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft SharePoint Designer 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft SharePoint Designer 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft SharePoint Designer 2010* +- GP name: *MicrosoftOffice2010SharePointDesigner* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft SharePoint Workspace 2010. By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Workspace 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft SharePoint Workspace 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft SharePoint Workspace 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft SharePoint Workspace 2010* +- GP name: *MicrosoftOffice2010SharePointWorkspace* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Visio 2010. By default, the user settings of Microsoft Visio 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Visio 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Visio 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Visio 2010* +- GP name: *MicrosoftOffice2010Visio* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Word 2010. By default, the user settings of Microsoft Word 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Word 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Word 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Word 2010* +- GP name: *MicrosoftOffice2010Word* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Access 2013. By default, the user settings of Microsoft Access 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Access 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Access 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Access 2013* +- GP name: *MicrosoftOffice2013Access* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Access 2013. Microsoft Access 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Access 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Access 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Access 2013 backup only* +- GP name: *MicrosoftOffice2013AccessBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. By default, the user settings which are common between the Microsoft Office Suite 2013 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize. + +If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2013 applications are enabled, this policy setting should not be disabled. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2013 Common Settings* +- GP name: *MicrosoftOffice2013Common* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2013 applications. +Microsoft Office Suite 2013 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2013 applications. + +If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will continue to be backed up. + +If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Common 2013 backup only* +- GP name: *MicrosoftOffice2013CommonBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Excel 2013. + +By default, the user settings of Microsoft Excel 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Excel 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Excel 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Excel 2013* +- GP name: *MicrosoftOffice2013Excel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Excel 2013. Microsoft Excel 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Excel 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Excel 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Excel 2013 backup only* +- GP name: *MicrosoftOffice2013ExcelBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft InfoPath 2013. By default, the user settings of Microsoft InfoPath 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft InfoPath 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft InfoPath 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft InfoPath 2013* +- GP name: *MicrosoftOffice2013InfoPath* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft InfoPath 2013. Microsoft InfoPath 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft InfoPath 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft InfoPath 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft InfoPath 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *InfoPath 2013 backup only* +- GP name: *MicrosoftOffice2013InfoPathBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Lync 2013. By default, the user settings of Microsoft Lync 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Lync 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Lync 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Lync 2013* +- GP name: *MicrosoftOffice2013Lync* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Lync 2013. Microsoft Lync 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Lync 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Lync 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lync 2013 backup only* +- GP name: *MicrosoftOffice2013LyncBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for OneDrive for Business 2013. By default, the user settings of OneDrive for Business 2013 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2013 from synchronization between computers. + +If you enable this policy setting, OneDrive for Business 2013 user settings continue to synchronize. + +If you disable this policy setting, OneDrive for Business 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneDrive for Business 2013* +- GP name: *MicrosoftOffice2013OneDriveForBusiness* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft OneNote 2013. By default, the user settings of Microsoft OneNote 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft OneNote 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft OneNote 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneNote 2013* +- GP name: *MicrosoftOffice2013OneNote* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft OneNote 2013. Microsoft OneNote 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft OneNote 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft OneNote 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *OneNote 2013 backup only* +- GP name: *MicrosoftOffice2013OneNoteBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Outlook 2013. By default, the user settings of Microsoft Outlook 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Outlook 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Outlook 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Outlook 2013* +- GP name: *MicrosoftOffice2013Outlook* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Outlook 2013. Microsoft Outlook 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Outlook 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Outlook 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Outlook 2013 backup only* +- GP name: *MicrosoftOffice2013OutlookBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2013. By default, the user settings of Microsoft PowerPoint 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft PowerPoint 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft PowerPoint 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft PowerPoint 2013* +- GP name: *MicrosoftOffice2013PowerPoint* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2013. Microsoft PowerPoint 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft PowerPoint 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft PowerPoint 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *PowerPoint 2013 backup only* +- GP name: *MicrosoftOffice2013PowerPointBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Project 2013. By default, the user settings of Microsoft Project 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Project 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Project 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Project 2013* +- GP name: *MicrosoftOffice2013Project* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Project 2013. Microsoft Project 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Project 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Project 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Project 2013 backup only* +- GP name: *MicrosoftOffice2013ProjectBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Publisher 2013. By default, the user settings of Microsoft Publisher 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Publisher 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Publisher 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Publisher 2013* +- GP name: *MicrosoftOffice2013Publisher* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Publisher 2013. Microsoft Publisher 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Publisher 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Publisher 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Publisher 2013 backup only* +- GP name: *MicrosoftOffice2013PublisherBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2013. By default, the user settings of Microsoft SharePoint Designer 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft SharePoint Designer 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft SharePoint Designer 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft SharePoint Designer 2013* +- GP name: *MicrosoftOffice2013SharePointDesigner* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft SharePoint Designer 2013. Microsoft SharePoint Designer 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft SharePoint Designer 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SharePoint Designer 2013 backup only* +- GP name: *MicrosoftOffice2013SharePointDesignerBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 2013 Upload Center. By default, the user settings of Microsoft Office 2013 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2013 Upload Center from synchronization between computers. + +If you enable this policy setting, Microsoft Office 2013 Upload Center user settings continue to synchronize. + +If you disable this policy setting, Microsoft Office 2013 Upload Center user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2013 Upload Center* +- GP name: *MicrosoftOffice2013UploadCenter* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Visio 2013. By default, the user settings of Microsoft Visio 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Visio 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Visio 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Visio 2013* +- GP name: *MicrosoftOffice2013Visio* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Visio 2013. Microsoft Visio 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Visio 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Visio 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Visio 2013 backup only* +- GP name: *MicrosoftOffice2013VisioBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Word 2013. By default, the user settings of Microsoft Word 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Word 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Word 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Word 2013* +- GP name: *MicrosoftOffice2013Word* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Word 2013. Microsoft Word 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Word 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Word 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Word 2013 backup only* +- GP name: *MicrosoftOffice2013WordBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Access 2016. By default, the user settings of Microsoft Access 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Access 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Access 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Access 2016* +- GP name: *MicrosoftOffice2016Access* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Access 2016. Microsoft Access 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Access 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Access 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Access 2016 backup only* +- GP name: *MicrosoftOffice2016AccessBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. By default, the user settings which are common between the Microsoft Office Suite 2016 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize. + +If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2016 applications are enabled, this policy setting should not be disabled. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2016 Common Settings* +- GP name: *MicrosoftOffice2016Common* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2016 applications. +Microsoft Office Suite 2016 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2016 applications. + +If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will continue to be backed up. + +If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Common 2016 backup only* +- GP name: *MicrosoftOffice2016CommonBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Excel 2016. By default, the user settings of Microsoft Excel 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Excel 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Excel 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Excel 2016* +- GP name: *MicrosoftOffice2016Excel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Excel 2016. Microsoft Excel 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Excel 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Excel 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Excel 2016 backup only* +- GP name: *MicrosoftOffice2016ExcelBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Lync 2016. By default, the user settings of Microsoft Lync 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Lync 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Lync 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Lync 2016* +- GP name: *MicrosoftOffice2016Lync* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Lync 2016. Microsoft Lync 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Lync 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Lync 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lync 2016 backup only* +- GP name: *MicrosoftOffice2016LyncBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for OneDrive for Business 2016. By default, the user settings of OneDrive for Business 2016 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2016 from synchronization between computers. + +If you enable this policy setting, OneDrive for Business 2016 user settings continue to synchronize. + +If you disable this policy setting, OneDrive for Business 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneDrive for Business 2016* +- GP name: *MicrosoftOffice2016OneDriveForBusiness* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft OneNote 2016. By default, the user settings of Microsoft OneNote 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft OneNote 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft OneNote 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneNote 2016* +- GP name: *MicrosoftOffice2016OneNote* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft OneNote 2016. Microsoft OneNote 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft OneNote 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft OneNote 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *OneNote 2016 backup only* +- GP name: *MicrosoftOffice2016OneNoteBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Outlook 2016. By default, the user settings of Microsoft Outlook 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Outlook 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Outlook 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Outlook 2016* +- GP name: *MicrosoftOffice2016Outlook* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Outlook 2016. Microsoft Outlook 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Outlook 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Outlook 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Outlook 2016 backup only* +- GP name: *MicrosoftOffice2016OutlookBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2016. By default, the user settings of Microsoft PowerPoint 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft PowerPoint 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft PowerPoint 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft PowerPoint 2016* +- GP name: *MicrosoftOffice2016PowerPoint* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2016. Microsoft PowerPoint 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft PowerPoint 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft PowerPoint 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *PowerPoint 2016 backup only* +- GP name: *MicrosoftOffice2016PowerPointBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Project 2016. +By default, the user settings of Microsoft Project 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Project 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Project 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Project 2016* +- GP name: *MicrosoftOffice2016Project* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Project 2016. Microsoft Project 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Project 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Project 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Project 2016 backup only* +- GP name: *MicrosoftOffice2016ProjectBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Publisher 2016. By default, the user settings of Microsoft Publisher 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Publisher 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Publisher 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Publisher 2016* +- GP name: *MicrosoftOffice2016Publisher* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Publisher 2016. Microsoft Publisher 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Publisher 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Publisher 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Publisher 2016 backup only* +- GP name: *MicrosoftOffice2016PublisherBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 2016 Upload Center. By default, the user settings of Microsoft Office 2016 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2016 Upload Center from synchronization between computers. + +If you enable this policy setting, Microsoft Office 2016 Upload Center user settings continue to synchronize. + +If you disable this policy setting, Microsoft Office 2016 Upload Center user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2016 Upload Center* +- GP name: *MicrosoftOffice2016UploadCenter* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Visio 2016. By default, the user settings of Microsoft Visio 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Visio 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Visio 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Visio 2016* +- GP name: *MicrosoftOffice2016Visio* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Visio 2016. Microsoft Visio 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Visio 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Visio 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Visio 2016 backup only* +- GP name: *MicrosoftOffice2016VisioBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Word 2016. By default, the user settings of Microsoft Word 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Word 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Word 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Word 2016* +- GP name: *MicrosoftOffice2016Word* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the backup of certain user settings for Microsoft Word 2016. Microsoft Word 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Word 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Word 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Word 2016 backup only* +- GP name: *MicrosoftOffice2016WordBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Access 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Access 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Access 2013* +- GP name: *MicrosoftOffice365Access2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Access 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Access 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Access 2016* +- GP name: *MicrosoftOffice365Access2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2013 applications will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers with UE-V. + +If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize with UE-V. + +If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Common 2013* +- GP name: *MicrosoftOffice365Common2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2016 applications will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers with UE-V. + +If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize with UE-V. + +If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Common 2016* +- GP name: *MicrosoftOffice365Common2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Excel 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Excel 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Excel 2013* +- GP name: *MicrosoftOffice365Excel2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Excel 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Excel 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Excel 2016* +- GP name: *MicrosoftOffice365Excel2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 InfoPath 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 InfoPath 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 InfoPath 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 InfoPath 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 InfoPath 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 InfoPath 2013* +- GP name: *MicrosoftOffice365InfoPath2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Lync 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Lync 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Lync 2013* +- GP name: *MicrosoftOffice365Lync2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Lync 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Lync 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Lync 2016* +- GP name: *MicrosoftOffice365Lync2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 OneNote 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 OneNote 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 OneNote 2013* +- GP name: *MicrosoftOffice365OneNote2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 OneNote 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 OneNote 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 OneNote 2016* +- GP name: *MicrosoftOffice365OneNote2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Outlook 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Outlook 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Outlook 2013* +- GP name: *MicrosoftOffice365Outlook2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Outlook 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Outlook 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Outlook 2016* +- GP name: *MicrosoftOffice365Outlook2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 PowerPoint 2013* +- GP name: *MicrosoftOffice365PowerPoint2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 PowerPoint 2016* +- GP name: *MicrosoftOffice365PowerPoint2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Project 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Project 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Project 2013* +- GP name: *MicrosoftOffice365Project2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Project 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Project 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Project 2016* +- GP name: *MicrosoftOffice365Project2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Publisher 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Publisher 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Publisher 2013* +- GP name: *MicrosoftOffice365Publisher2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Publisher 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Publisher 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Publisher 2016* +- GP name: *MicrosoftOffice365Publisher2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 SharePoint Designer 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 SharePoint Designer 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 SharePoint Designer 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 SharePoint Designer 2013* +- GP name: *MicrosoftOffice365SharePointDesigner2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Visio 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Visio 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Visio 2013* +- GP name: *MicrosoftOffice365Visio2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Visio 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Visio 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Visio 2016* +- GP name: *MicrosoftOffice365Visio2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Word 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Word 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Word 2013* +- GP name: *MicrosoftOffice365Word2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Word 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Word 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Word 2016* +- GP name: *MicrosoftOffice365Word2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Music** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Music app. By default, the user settings of Music sync between computers. Use the policy setting to prevent the user settings of Music from synchronizing between computers. + +If you enable this policy setting, Music user settings continue to sync. + +If you disable this policy setting, Music user settings are excluded from the synchronizing settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Music* +- GP name: *Music* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/News** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the News app. By default, the user settings of News sync between computers. Use the policy setting to prevent the user settings of News from synchronizing between computers. + +If you enable this policy setting, News user settings continue to sync. + +If you disable this policy setting, News user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *News* +- GP name: *News* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Notepad** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings of Notepad. By default, the user settings of Notepad synchronize between computers. Use the policy setting to prevent the user settings of Notepad from synchronization between computers. + +If you enable this policy setting, the Notepad user settings continue to synchronize. + +If you disable this policy setting, Notepad user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Notepad* +- GP name: *Notepad* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Reader** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Reader app. By default, the user settings of Reader sync between computers. Use the policy setting to prevent the user settings of Reader from synchronizing between computers. + +If you enable this policy setting, Reader user settings continue to sync. + +If you disable this policy setting, Reader user settings are excluded from the synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reader* +- GP name: *Reader* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/RepositoryTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the number of milliseconds that the computer waits when retrieving user settings from the settings storage location. You can use this setting to override the default value of 2000 milliseconds. + +If you enable this policy setting, set the number of milliseconds that the system waits to retrieve settings. + +If you disable or do not configure this policy setting, the default value of 2000 milliseconds is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronization timeout* +- GP name: *RepositoryTimeout* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/SettingsStoragePath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures where the settings package files that contain user settings are stored. + +If you enable this policy setting, the user settings are stored in the specified location. + +If you disable or do not configure this policy setting, the user settings are stored in the user’s home directory if configured for your environment. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Settings storage path* +- GP name: *SettingsStoragePath* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures where custom settings location templates are stored and if the catalog will be used to replace the default Microsoft templates installed with the UE-V Agent. + +If you enable this policy setting, the UE-V Agent checks the specified location once each day and updates its synchronization behavior based on the templates in this location. Settings location templates added or updated since the last check are registered by the UE-V Agent. The UE-V Agent deregisters templates that were removed from this location. + +If you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they will be ignored. + +If you specify a UNC path and check the option to replace the default Microsoft templates, all of the default Microsoft templates installed by the UE-V Agent will be deleted from the computer and only the templates located in the settings template catalog will be used. + +If you disable this policy setting, the UE-V Agent will not use the custom settings location templates. If you disable this policy setting after it has been enabled, the UE-V Agent will not restore the default Microsoft templates. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Settings template catalog path* +- GP name: *SettingsTemplateCatalogPath* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Sports** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Sports app. By default, the user settings of Sports sync between computers. Use the policy setting to prevent the user settings of Sports from synchronizing between computers. + +If you enable this policy setting, Sports user settings continue to sync. + +If you disable this policy setting, Sports user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sports* +- GP name: *Sports* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/SyncEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to enable or disable User Experience Virtualization (UE-V). Only applies to Windows 10 or earlier. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use User Experience Virtualization (UE-V)* +- GP name: *SyncEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + +**ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings over metered connections. By default, the UE-V Agent does not synchronize settings over a metered connection. + +With this setting enabled, the UE-V Agent synchronizes settings over a metered connection. + +With this setting disabled, the UE-V Agent does not synchronize settings over a metered connection. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sync settings over metered connections* +- GP name: *SyncOverMeteredNetwork* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings over metered connections outside of the home provider network, for example when connected via a roaming connection. By default, the UE-V Agent does not synchronize settings over a metered connection that is roaming. + +With this setting enabled, the UE-V Agent synchronizes settings over a metered connection that is roaming. + +With this setting disabled, the UE-V Agent will not synchronize settings over a metered connection that is roaming. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sync settings over metered connections even when roaming* +- GP name: *SyncOverMeteredNetworkWhenRoaming* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/SyncProviderPingEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to configure the User Experience Virtualization (UE-V) sync provider to ping the settings storage path before attempting to sync settings. If the ping is successful then the sync provider attempts to synchronize the settings packages. If the ping is unsuccessful then the sync provider doesn’t attempt the synchronization. + +If you enable this policy setting, the sync provider pings the settings storage location before synchronizing settings packages. + +If you disable this policy setting, the sync provider doesn’t ping the settings storage location before synchronizing settings packages. + +If you do not configure this policy, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ping the settings storage location before sync* +- GP name: *SyncProviderPingEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting defines the default settings sync behavior of the User Experience Virtualization (UE-V) Agent for Windows apps that are not explicitly listed in Windows App List. By default, the UE-V Agent only synchronizes settings of those Windows apps included in the Windows App List. + +With this setting enabled, the settings of all Windows apps not expressly disable in the Windows App List are synchronized. + +With this setting disabled, only the settings of the Windows apps set to synchronize in the Windows App List are synchronized. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sync Unlisted Windows Apps* +- GP name: *SyncUnlistedWindows8Apps* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Travel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Travel app. By default, the user settings of Travel sync between computers. Use the policy setting to prevent the user settings of Travel from synchronizing between computers. + +If you enable this policy setting, Travel user settings continue to sync. + +If you disable this policy setting, Travel user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Travel* +- GP name: *Travel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/TrayIconEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting enables the User Experience Virtualization (UE-V) tray icon. By default, an icon appears in the system tray that displays notifications for UE-V. This icon also provides a link to the UE-V Agent application, Company Settings Center. Users can open the Company Settings Center by right-clicking the icon and selecting Open or by double-clicking the icon. When this group policy setting is enabled, the UE-V tray icon is visible, the UE-V notifications display, and the Company Settings Center is accessible from the tray icon. + +With this setting disabled, the tray icon does not appear in the system tray, UE-V never displays notifications, and the user cannot access Company Settings Center from the system tray. The Company Settings Center remains accessible through the Control Panel and the Start menu or Start screen. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tray Icon* +- GP name: *TrayIconEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Video** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Video app. By default, the user settings of Video sync between computers. Use the policy setting to prevent the user settings of Video from synchronizing between computers. + +If you enable this policy setting, Video user settings continue to sync. + +If you disable this policy setting, Video user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Video* +- GP name: *Video* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + + +**ADMX_UserExperienceVirtualization/Weather** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings for the Weather app. By default, the user settings of Weather sync between computers. Use the policy setting to prevent the user settings of Weather from synchronizing between computers. + +If you enable this policy setting, Weather user settings continue to sync. + +If you disable this policy setting, Weather user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Weather* +- GP name: *Weather* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          + +**ADMX_UserExperienceVirtualization/Wordpad** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the synchronization of user settings of WordPad. By default, the user settings of WordPad synchronize between computers. Use the policy setting to prevent the user settings of WordPad from synchronization between computers. + +If you enable this policy setting, the WordPad user settings continue to synchronize. + +If you disable this policy setting, WordPad user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WordPad* +- GP name: *Wordpad* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
          +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md new file mode 100644 index 0000000000..3f00b44db1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -0,0 +1,655 @@ +--- +title: Policy CSP - ADMX_UserProfiles +description: Policy CSP - ADMX_UserProfiles +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/11/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_UserProfiles +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_UserProfiles policies + +
          +
          + ADMX_UserProfiles/CleanupProfiles +
          +
          + ADMX_UserProfiles/DontForceUnloadHive +
          +
          + ADMX_UserProfiles/LeaveAppMgmtData +
          +
          + ADMX_UserProfiles/LimitSize +
          +
          + ADMX_UserProfiles/ProfileErrorAction +
          +
          + ADMX_UserProfiles/SlowLinkTimeOut +
          +
          + ADMX_UserProfiles/USER_HOME +
          +
          + ADMX_UserProfiles/UserInfoAccessAction +
          +
          + + +
          + + +**ADMX_UserProfiles/CleanupProfiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. Note: One day is interpreted as 24 hours after a specific user profile was accessed. + +If you enable this policy setting, the User Profile Service will automatically delete on the next system restart all user profiles on the computer that have not been used within the specified number of days. + +If you disable or do not configure this policy setting, User Profile Service will not automatically delete any profiles on the next system restart. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Delete user profiles older than a specified number of days on system restart* +- GP name: *CleanupProfiles* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
          + + +**ADMX_UserProfiles/DontForceUnloadHive** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows forcefully unloads the user's registry at logoff, even if there are open handles to the per-user registry keys. + +Note: This policy setting should only be used for cases where you may be running into application compatibility issues due to this specific Windows behavior. It is not recommended to enable this policy by default as it may prevent users from getting an updated version of their roaming user profile. + +If you enable this policy setting, Windows will not forcefully unload the users registry at logoff, but will unload the registry when all open handles to the per-user registry keys are closed. + +If you disable or do not configure this policy setting, Windows will always unload the users registry at logoff, even if there are any open handles to the per-user registry keys at user logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not forcefully unload the users registry at user logoff* +- GP name: *DontForceUnloadHive* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
          + + +**ADMX_UserProfiles/LeaveAppMgmtData** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the system retains a roaming user's Windows Installer and Group Policy based software installation data on their profile deletion. + +By default Windows deletes all information related to a roaming user (which includes the user's settings, data, Windows Installer related data, and the like) when their profile is deleted. As a result, the next time a roaming user whose profile was previously deleted on that client logs on, they will need to reinstall all apps published via policy at logon increasing logon time. You can use this policy setting to change this behavior. + +If you enable this policy setting, Windows will not delete Windows Installer or Group Policy software installation data for roaming users when profiles are deleted from the machine. This will improve the performance of Group Policy based Software Installation during user logon when a user profile is deleted and that user subsequently logs on to the machine. + +If you disable or do not configure this policy setting, Windows will delete the entire profile for roaming users, including the Windows Installer and Group Policy software installation data when those profiles are deleted. + +> [!NOTE] +> If this policy setting is enabled for a machine, local administrator action is required to remove the Windows Installer or Group Policy software installation data stored in the registry and file system of roaming users' profiles on the machine. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Leave Windows Installer and Group Policy Software Installation Data* +- GP name: *LeaveAppMgmtData* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
          + + +**ADMX_UserProfiles/LimitSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting sets the maximum size of each user profile and determines the system's response when a user profile reaches the maximum size. This policy setting affects both local and roaming profiles. + +If you disable this policy setting or do not configure it, the system does not limit the size of user profiles. + +If you enable this policy setting, you can: + +- Set a maximum permitted user profile size. +- Determine whether the registry files are included in the calculation of the profile size. +- Determine whether users are notified when the profile exceeds the permitted maximum size. +- Specify a customized message notifying users of the oversized profile. +- Determine how often the customized message is displayed. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, Windows will not allow users to log off until the profile size has been reduced to within the allowable limit. In Microsoft Windows Vista, Windows will not block users from logging off. Instead, if the user has a roaming user profile, Windows will not synchronize the user's profile with the roaming profile server if the maximum profile size limit specified here is exceeded. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit profile size* +- GP name: *LimitSize* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
          + + +**ADMX_UserProfiles/ProfileErrorAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting will automatically log off a user when Windows cannot load their profile. + +If Windows cannot access the user profile folder or the profile contains errors that prevent it from loading, Windows logs on the user with a temporary profile. This policy setting allows the administrator to disable this behavior, preventing Windows from logging on the user with a temporary profile. + +If you enable this policy setting, Windows will not log on a user with a temporary profile. Windows logs the user off if their profile cannot be loaded. + +If you disable this policy setting or do not configure it, Windows logs on the user with a temporary profile when Windows cannot load their user profile. + +Also, see the "Delete cached copies of roaming profiles" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not log users on with temporary profiles* +- GP name: *ProfileErrorAction* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
          + + +**ADMX_UserProfiles/SlowLinkTimeOut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines a slow connection for roaming user profiles and establishes thresholds for two tests of network speed. + +To determine the network performance characteristics, a connection is made to the file share storing the user's profile and 64 kilobytes of data is transferred. From that connection and data transfer, the network's latency and connection speed are determined. + +This policy setting and related policy settings in this folder together define the system's response when roaming user profiles are slow to load. + +If you enable this policy setting, you can change how long Windows waits for a response from the server before considering the connection to be slow. + +If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond.Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections.Important: If the "Do not detect slow network connections" policy setting is enabled, this policy setting is ignored. Also, if the "Delete cached copies of roaming profiles" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control slow network connection timeout for user profiles* +- GP name: *SlowLinkTimeOut* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
          + + +**ADMX_UserProfiles/USER_HOME** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the location and root (file share or local path) of a user's home folder for a logon session. + +If you enable this policy setting, the user's home folder is configured to the specified local or network location, creating a new folder for each user name. + +To use this policy setting, in the Location list, choose the location for the home folder. If you choose “On the network,” enter the path to a file share in the Path box (for example, \\\\ComputerName\ShareName), and then choose the drive letter to assign to the file share. If you choose “On the local computer,” enter a local path (for example, C:\HomeFolder) in the Path box. + +Do not specify environment variables or ellipses in the path. Also, do not specify a placeholder for the user name because the user name will be appended at logon. + +> [!NOTE] +> The Drive letter box is ignored if you choose “On the local computer” from the Location list. If you choose “On the local computer” and enter a file share, the user's home folder will be placed in the network location without mapping the file share to a drive letter. + +If you disable or do not configure this policy setting, the user's home folder is configured as specified in the user's Active Directory Domain Services account. + +If the "Set Remote Desktop Services User Home Directory" policy setting is enabled, the “Set user home folder” policy setting has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set user home folder* +- GP name: *USER_HOME* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
          + + +**ADMX_UserProfiles/UserInfoAccessAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from managing the ability to allow apps to access the user name, account picture, and domain information. + +If you enable this policy setting, sharing of user name, picture and domain information may be controlled by setting one of the following options: + +- "Always on" - users will not be able to change this setting and the user's name and account picture will be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will also be able to retrieve the user's UPN, SIP/URI, and DNS. + +- "Always off" - users will not be able to change this setting and the user's name and account picture will not be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will not be able to retrieve the user's UPN, SIP/URI, and DNS. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources. + +If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *User management of sharing user name, account picture, and domain information with apps (not desktop apps)* +- GP name: *UserInfoAccessAction* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md new file mode 100644 index 0000000000..a9b6715a43 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -0,0 +1,429 @@ +--- +title: Policy CSP - ADMX_W32Time +description: Policy CSP - ADMX_W32Time +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/28/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_W32Time +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_W32Time policies + +
          +
          + ADMX_W32Time/W32TIME_POLICY_CONFIG +
          +
          + ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT +
          +
          + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT +
          +
          + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER +
          +
          + + +
          + + +**ADMX_W32Time/W32TIME_POLICY_CONFIG** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs. + +If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values. + +For more details on individual parameters, combinations of parameter values as well as definitions of flags, see https://go.microsoft.com/fwlink/?linkid=847809. + +**FrequencyCorrectRate** +This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause more frequent corrections. Default: 4 (scalar). + +**HoldPeriod** +This parameter indicates how many consistent time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. Default: 5 + +**LargePhaseOffset** +If a time sample differs from the client computer's local clock by more than LargePhaseOffset, the local clock is deemed to have drifted considerably, or in other words, spiked. Default: 50,000,000 100-nanosecond units (ns) or 5 seconds. + +**MaxAllowedPhaseOffset** +If a response is received that has a time variation that is larger than this parameter value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds. + +**MaxNegPhaseCorrection** +If a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. + +**MaxPosPhaseCorrection** +If a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. + +**PhaseCorrectRate** +This parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar). + +**PollAdjustFactor** +This parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). + +**SpikeWatchPeriod** +This parameter specifies the amount of time that samples with time offset larger than LargePhaseOffset are received before these samples are accepted as accurate. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. + +**UpdateInterval** +This parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, or 1 second. + +General parameters: + +**AnnounceFlags** +This parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal + +**EventLogFlags** +This parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. + +**LocalClockDispersion** +This parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. + +**MaxPollInterval** +This parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, or 1024 seconds. (Should not be set higher than 15.) + +**MinPollInterval** +This parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, or 64 seconds. + +**ClockHoldoverPeriod** +This parameter indicates the maximum number of seconds a system clock can nominally hold its accuracy without synchronizing with a time source. If this period of time passes without W32time obtaining new samples from any of its input providers, W32time initiates a rediscovery of time sources. Default: 7800 seconds. + +**RequireSecureTimeSyncRequests** +This parameter controls whether or not the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean. + +**UtilizeSslTimeData** +This parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 (enabled) Boolean + +**ClockAdjustmentAuditLimit** +This parameter specifies the smallest local clock adjustments that may be logged to the W32time service event log on the target machine. Default: 800 Parts per million (PPM). + +RODC parameters: + +**ChainEntryTimeout** +This parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. + +**ChainMaxEntries** +This parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. + +**ChainMaxHostEntries** +This parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. + +**ChainDisable** +This parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. + +**ChainLoggingRate** +This parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Global Configuration Settings* +- GP name: *W32TIME_POLICY_CONFIG* +- GP path: *System\Windows Time Service* +- GP ADMX file name: *W32Time.admx* + + + +
          + + +**ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies a set of parameters for controlling the Windows NTP Client. + +If you enable this policy setting, you can specify the following parameters for the Windows NTP Client. + +If you disable or do not configure this policy setting, the Windows NTP Client uses the defaults of each of the following parameters. + +**NtpServer** +The Domain Name System (DNS) name or IP address of an NTP time source. This value is in the form of ""dnsName,flags"" where ""flags"" is a hexadecimal bitmask of the flags for that host. For more information, see the NTP Client Group Policy Settings Associated with Windows Time section of the Windows Time Service Group Policy Settings. The default value is ""time.windows.com,0x09"". + +**Type** +This value controls the authentication that W32time uses. The default value is NT5DS. + +**CrossSiteSyncFlags** +This value, expressed as a bitmask, controls how W32time chooses time sources outside its own site. The possible values are 0, 1, and 2. Setting this value to 0 (None) indicates that the time client should not attempt to synchronize time outside its site. Setting this value to 1 (PdcOnly) indicates that only the computers that function as primary domain controller (PDC) emulator operations masters in other domains can be used as synchronization partners when the client has to synchronize time with a partner outside its own site. Setting a value of 2 (All) indicates that any synchronization partner can be used. This value is ignored if the NT5DS value is not set. The default value is 2 decimal (0x02 hexadecimal). + +**ResolvePeerBackoffMinutes** +This value, expressed in minutes, controls how long W32time waits before it attempts to resolve a DNS name when a previous attempt failed. The default value is 15 minutes. + +**ResolvePeerBackoffMaxTimes** +This value controls how many times W32time attempts to resolve a DNS name before the discovery process is restarted. Each time DNS name resolution fails, the amount of time to wait before the next attempt will be twice the previous amount. The default value is seven attempts. + +**SpecialPollInterval** +This NTP client value, expressed in seconds, controls how often a manually configured time source is polled when the time source is configured to use a special polling interval. If the SpecialInterval flag is enabled on the NTPServer setting, the client uses the value that is set as the SpecialPollInterval, instead of a variable interval between MinPollInterval and MaxPollInterval values, to determine how frequently to poll the time source. SpecialPollInterval must be in the range of [MinPollInterval, MaxPollInterval], else the nearest value of the range is picked. Default: 1024 seconds. + +**EventLogFlags** +This value is a bitmask that controls events that may be logged to the System log in Event Viewer. Setting this value to 0x1 indicates that W32time will create an event whenever a time jump is detected. Setting this value to 0x2 indicates that W32time will create an event whenever a time source change is made. Because it is a bitmask value, setting 0x3 (the addition of 0x1 and 0x2) indicates that both time jumps and time source changes will be logged. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Windows NTP Client* +- GP name: *W32TIME_POLICY_CONFIGURE_NTPCLIENT* +- GP path: *System\Windows Time Service\Time Providers* +- GP ADMX file name: *W32Time.admx* + + + +
          + + +**ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether the Windows NTP Client is enabled. + +Enabling the Windows NTP Client allows your computer to synchronize its computer clock with other NTP servers. You might want to disable this service if you decide to use a third-party time provider. + +If you enable this policy setting, you can set the local computer clock to synchronize time with NTP servers. + +If you disable or do not configure this policy setting, the local computer clock does not synchronize time with NTP servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows NTP Client* +- GP name: *W32TIME_POLICY_ENABLE_NTPCLIENT* +- GP path: *System\Windows Time Service\Time Providers* +- GP ADMX file name: *W32Time.admx* + + + +
          + + +**ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify whether the Windows NTP Server is enabled. + +If you enable this policy setting for the Windows NTP Server, your computer can service NTP requests from other computers. + +If you disable or do not configure this policy setting, your computer cannot service NTP requests from other computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows NTP Server* +- GP name: *W32TIME_POLICY_ENABLE_NTPSERVER* +- GP path: *System\Windows Time Service\Time Providers* +- GP ADMX file name: *W32Time.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md new file mode 100644 index 0000000000..0590f12265 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -0,0 +1,272 @@ +--- +title: Policy CSP - ADMX_WCM +description: Policy CSP - ADMX_WCM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/22/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WCM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WCM policies + +
          +
          + ADMX_WCM/WCM_DisablePowerManagement +
          +
          + ADMX_WCM/WCM_EnableSoftDisconnect +
          +
          + ADMX_WCM/WCM_MinimizeConnections +
          +
          + + +
          + + +**ADMX_WCM/WCM_DisablePowerManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that power management is disabled when the machine enters connected standby mode. + +If this policy setting is enabled, Windows Connection Manager does not manage adapter radios to reduce power consumption when the machine enters connected standby mode. + +If this policy setting is not configured or is disabled, power management is enabled when the machine enters connected standby mode. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable power management in connected standby mode* +- GP name: *WCM_DisablePowerManagement* +- GP path: *Network\Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + + +
          + + +**ADMX_WCM/WCM_EnableSoftDisconnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows will soft-disconnect a computer from a network. + +If this policy setting is enabled or not configured, Windows will soft-disconnect a computer from a network when it determines that the computer should no longer be connected to a network. + +If this policy setting is disabled, Windows will disconnect a computer from a network immediately when it determines that the computer should no longer be connected to a network. + +When soft disconnect is enabled: + +- When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted. +- Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection. +- When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they’re not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network. + +This policy setting depends on other group policy settings. For example, if 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is disabled, Windows will not disconnect from any networks. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows to soft-disconnect a computer from a network* +- GP name: *WCM_EnableSoftDisconnect* +- GP path: *Network\Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + + +
          + + +**ADMX_WCM/WCM_MinimizeConnections** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines if a computer can have multiple connections to the internet or to a Windows domain. If multiple connections are allowed, it then determines how network traffic will be routed. + +If this policy setting is set to 0, a computer can have simultaneous connections to the internet, to a Windows domain, or to both. Internet traffic can be routed over any connection - including a cellular connection and any metered network. This was previously the Disabled state for this policy setting. This option was first available in Windows 8. + +If this policy setting is set to 1, any new automatic internet connection is blocked when the computer has at least one active internet connection to a preferred type of network. Here's the order of preference (from most preferred to least preferred): Ethernet, WLAN, then cellular. Ethernet is always preferred when connected. Users can still manually connect to any network. This was previously the Enabled state for this policy setting. This option was first available in Windows 8. + +If this policy setting is set to 2, the behavior is similar to 1. However, if a cellular data connection is available, it will always stay connected for services that require a cellular connection. When the user is connected to a WLAN or Ethernet connection, no internet traffic will be routed over the cellular connection. This option was first available in Windows 10 (Version 1703). + +If this policy setting is set to 3, the behavior is similar to 2. However, if there's an Ethernet connection, Windows won't allow users to connect to a WLAN manually. A WLAN can only be connected (automatically or manually) when there's no Ethernet connection. + +This policy setting is related to the "Enable Windows to soft-disconnect a computer from a network" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Minimize the number of simultaneous connections to the Internet or a Windows Domain* +- GP name: *WCM_MinimizeConnections* +- GP path: *Network\Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-wincal.md b/windows/client-management/mdm/policy-csp-admx-wincal.md new file mode 100644 index 0000000000..bceaf394ed --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wincal.md @@ -0,0 +1,192 @@ +--- +title: Policy CSP - ADMX_WinCal +description: Policy CSP - ADMX_WinCal +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/28/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WinCal +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WinCal policies + +
          +
          + ADMX_WinCal/TurnOffWinCal_1 +
          +
          + ADMX_WinCal/TurnOffWinCal_2 +
          +
          + + +
          + + +**ADMX_WinCal/TurnOffWinCal_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars. + +If you enable this setting, Windows Calendar will be turned off. + +If you disable or do not configure this setting, Windows Calendar will be turned on. + +The default is for Windows Calendar to be turned on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Calendar* +- GP name: *TurnOffWinCal_1* +- GP path: *Windows Components\Windows Calendar* +- GP ADMX file name: *WinCal.admx* + + + +
          + +
          + + +**ADMX_WinCal/TurnOffWinCal_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars. + +If you enable this setting, Windows Calendar will be turned off. + +If you disable or do not configure this setting, Windows Calendar will be turned on. + +The default is for Windows Calendar to be turned on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Calendar* +- GP name: *TurnOffWinCal_2* +- GP path: *Windows Components\Windows Calendar* +- GP ADMX file name: *WinCal.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md b/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md new file mode 100644 index 0000000000..8b06f92864 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md @@ -0,0 +1,115 @@ +--- +title: Policy CSP - ADMX_WindowsAnytimeUpgrade +description: Policy CSP - ADMX_WindowsAnytimeUpgrade +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/29/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsAnytimeUpgrade +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WindowsAnytimeUpgrade policies + +
          +
          + ADMX_WindowsAnytimeUpgrade/Disabled +
          +
          + + +
          + + +**ADMX_WindowsAnytimeUpgrade/Disabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. By default, Add features to Windows 10 is available for all administrators. + +If you enable this policy setting, the wizard will not run. + +If you disable this policy setting or set it to Not Configured, the wizard will run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent the wizard from running.* +- GP name: *Disabled* +- GP path: *Windows Components\Add features to Windows 10* +- GP ADMX file name: *WindowsAnytimeUpgrade.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md new file mode 100644 index 0000000000..80b7d947fa --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md @@ -0,0 +1,264 @@ +--- +title: Policy CSP - ADMX_WindowsConnectNow +description: Policy CSP - ADMX_WindowsConnectNow +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/28/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsConnectNow +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WindowsConnectNow policies + +
          +
          + ADMX_WindowsConnectNow/WCN_DisableWcnUi_1 +
          +
          + ADMX_WindowsConnectNow/WCN_DisableWcnUi_2 +
          +
          + ADMX_WindowsConnectNow/WCN_EnableRegistrar +
          +
          + + +
          + + +**ADMX_WindowsConnectNow/WCN_DisableWcnUi_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prohibits access to Windows Connect Now (WCN) wizards. + +If you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including "Set up a wireless router or access point" and "Add a wireless device" are disabled. + +If you disable or do not configure this policy setting, users can access the wizard tasks, including "Set up a wireless router or access point" and "Add a wireless device." The default for this policy setting allows users to access all WCN wizards. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access of the Windows Connect Now wizards* +- GP name: *WCN_DisableWcnUi_1* +- GP path: *Network\Windows Connect Now* +- GP ADMX file name: *WindowsConnectNow.admx* + + + +
          + + +**ADMX_WindowsConnectNow/WCN_DisableWcnUi_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prohibits access to Windows Connect Now (WCN) wizards. + +If you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including "Set up a wireless router or access point" and "Add a wireless device" are disabled. + +If you disable or do not configure this policy setting, users can access the wizard tasks, including "Set up a wireless router or access point" and "Add a wireless device." The default for this policy setting allows users to access all WCN wizards. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access of the Windows Connect Now wizards* +- GP name: *WCN_DisableWcnUi_2* +- GP path: *Network\Windows Connect Now* +- GP ADMX file name: *WindowsConnectNow.admx* + + + +
          + + +**ADMX_WindowsConnectNow/WCN_EnableRegistrar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows the configuration of wireless settings using Windows Connect Now (WCN). The WCN Registrar enables the discovery and configuration of devices over Ethernet (UPnP), over In-band 802.11 WLAN, through the Windows Portable Device API (WPD), and via USB Flash drives. + +Additional options are available to allow discovery and configuration over a specific medium. + +If you enable this policy setting, additional choices are available to turn off the operations over a specific medium. + +If you disable this policy setting, operations are disabled over all media. + +If you do not configure this policy setting, operations are enabled over all media. + +The default for this policy setting allows operations over all media. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configuration of wireless settings using Windows Connect Now* +- GP name: *WCN_EnableRegistrar* +- GP path: *Network\Windows Connect Now* +- GP ADMX file name: *WindowsConnectNow.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md new file mode 100644 index 0000000000..c293e80086 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -0,0 +1,5367 @@ +--- +title: Policy CSP - ADMX_WindowsExplorer +description: Policy CSP - ADMX_WindowsExplorer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/29/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsExplorer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + + +## ADMX_WindowsExplorer policies + +
          +
          + ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS +
          +
          + ADMX_WindowsExplorer/ClassicShell +
          +
          + ADMX_WindowsExplorer/ConfirmFileDelete +
          +
          + ADMX_WindowsExplorer/DefaultLibrariesLocation +
          +
          + ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage +
          +
          + ADMX_WindowsExplorer/DisableIndexedLibraryExperience +
          +
          + ADMX_WindowsExplorer/DisableKnownFolders +
          +
          + ADMX_WindowsExplorer/DisableSearchBoxSuggestions +
          +
          + ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath +
          +
          + ADMX_WindowsExplorer/EnableSmartScreen +
          +
          + ADMX_WindowsExplorer/EnforceShellExtensionSecurity +
          +
          + ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized +
          +
          + ADMX_WindowsExplorer/HideContentViewModeSnippets +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted +
          +
          + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown +
          +
          + ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo +
          +
          + ADMX_WindowsExplorer/MaxRecentDocs +
          +
          + ADMX_WindowsExplorer/NoBackButton +
          +
          + ADMX_WindowsExplorer/NoCDBurning +
          +
          + ADMX_WindowsExplorer/NoCacheThumbNailPictures +
          +
          + ADMX_WindowsExplorer/NoChangeAnimation +
          +
          + ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators +
          +
          + ADMX_WindowsExplorer/NoDFSTab +
          +
          + ADMX_WindowsExplorer/NoDrives +
          +
          + ADMX_WindowsExplorer/NoEntireNetwork +
          +
          + ADMX_WindowsExplorer/NoFileMRU +
          +
          + ADMX_WindowsExplorer/NoFileMenu +
          +
          + ADMX_WindowsExplorer/NoFolderOptions +
          +
          + ADMX_WindowsExplorer/NoHardwareTab +
          +
          + ADMX_WindowsExplorer/NoManageMyComputerVerb +
          +
          + ADMX_WindowsExplorer/NoMyComputerSharedDocuments +
          +
          + ADMX_WindowsExplorer/NoNetConnectDisconnect +
          +
          + ADMX_WindowsExplorer/NoNewAppAlert +
          +
          + ADMX_WindowsExplorer/NoPlacesBar +
          +
          + ADMX_WindowsExplorer/NoRecycleFiles +
          +
          + ADMX_WindowsExplorer/NoRunAsInstallPrompt +
          +
          + ADMX_WindowsExplorer/NoSearchInternetTryHarderButton +
          +
          + ADMX_WindowsExplorer/NoSecurityTab +
          +
          + ADMX_WindowsExplorer/NoShellSearchButton +
          +
          + ADMX_WindowsExplorer/NoStrCmpLogical +
          +
          + ADMX_WindowsExplorer/NoViewContextMenu +
          +
          + ADMX_WindowsExplorer/NoViewOnDrive +
          +
          + ADMX_WindowsExplorer/NoWindowsHotKeys +
          +
          + ADMX_WindowsExplorer/NoWorkgroupContents +
          +
          + ADMX_WindowsExplorer/PlacesBar +
          +
          + ADMX_WindowsExplorer/PromptRunasInstallNetPath +
          +
          + ADMX_WindowsExplorer/RecycleBinSize +
          +
          + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1 +
          +
          + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2 +
          +
          + ADMX_WindowsExplorer/ShowHibernateOption +
          +
          + ADMX_WindowsExplorer/ShowSleepOption +
          +
          + ADMX_WindowsExplorer/TryHarderPinnedLibrary +
          +
          + ADMX_WindowsExplorer/TryHarderPinnedOpenSearch +
          +
          + + +
          + + +**ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent data loss when you change the target location for Folder Redirection, and the new and old targets point to the same network share, but have different network paths. + +If you enable this policy setting, Folder Redirection creates a temporary file in the old location in order to verify that new and old locations point to the same network share. If both new and old locations point to the same share, the target path is updated and files are not copied or deleted. The temporary file is deleted. + +If you disable or do not configure this policy setting, Folder Redirection does not create a temporary file and functions as if both new and old locations point to different shares when their network paths are different. + +> [!NOTE] +> If the paths point to different network shares, this policy setting is not required. If the paths point to the same network share, any data contained in the redirected folders is deleted if this policy setting is not enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Verify old and new Folder Redirection targets point to the same share before redirecting* +- GP name: *CheckSameSourceAndTargetForFRAndDFS* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
          + + +**ADMX_WindowsExplorer/ClassicShell** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows an administrator to revert specific Windows Shell behavior to classic Shell behavior. + +If you enable this setting, users cannot configure their system to open items by single-clicking (such as in Mouse in Control Panel). As a result, the user interface looks and operates like the interface for Windows NT 4.0, and users cannot restore the new features. + +Enabling this policy will also turn off the preview pane and set the folder options for File Explorer to Use classic folders view and disable the users ability to change these options. + +If you disable or not configure this policy, the default File Explorer behavior is applied to the user. + +> [!NOTE] +> In operating systems earlier than Windows Vista, enabling this policy will also disable the Active Desktop and Web view. This setting will also take precedence over the "Enable Active Desktop" setting. If both policies are enabled, Active Desktop is disabled. Also, see the "Disable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop and the "Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon" setting in User Configuration\Administrative Templates\Windows Components\File Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Classic Shell* +- GP name: *ClassicShell* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/ConfirmFileDelete** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Allows you to have File Explorer display a confirmation dialog whenever a file is deleted or moved to the Recycle Bin. + +If you enable this setting, a confirmation dialog is displayed when a file is deleted or moved to the Recycle Bin by the user. + +If you disable or do not configure this setting, the default behavior of not displaying a confirmation dialog occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display confirmation dialog when deleting files* +- GP name: *ConfirmFileDelete* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/DefaultLibrariesLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify a location where all default Library definition files for users/machines reside. + +If you enable this policy setting, administrators can specify a path where all default Library definition files for users reside. The user will not be allowed to make changes to these Libraries from the UI. On every logon, the policy settings are verified and Libraries for the user are updated or changed according to the path defined. + +If you disable or do not configure this policy setting, no changes are made to the location of the default Library definition files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Location where all default Library definition files for users/machines reside.* +- GP name: *DefaultLibrariesLocation* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Changes the behavior of IShellFolder::BindToObject for IID_IPropertySetStorage to not bind directly to the IPropertySetStorage implementation, and to include the intermediate layers provided by the Property System. + +This behavior is consistent with Windows Vista's behavior in this scenario. + +This disables access to user-defined properties, and properties stored in NTFS secondary streams. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable binding directly to IPropertySetStorage without intermediate layers.* +- GP name: *DisableBindDirectlyToPropertySetStorage* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/DisableIndexedLibraryExperience** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Windows Libraries features that need indexed file metadata to function properly. + +If you enable this policy, some Windows Libraries features will be turned off to better handle included folders that have been redirected to non-indexed network locations. + +Setting this policy will: + +- Disable all Arrangement views except for "By Folder" +- Disable all Search filter suggestions other than "Date Modified" and "Size" +- Disable view of file content snippets in Content mode when search results are returned +- Disable ability to stack in the Context menu and Column headers +- Exclude Libraries from the scope of Start search This policy will not enable users to add unsupported locations to Libraries + +If you enable this policy, Windows Libraries features that rely on indexed file data will be disabled. + +If you disable or do not configure this policy, all default Windows Libraries features will be enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Libraries features that rely on indexed file data* +- GP name: *DisableIndexedLibraryExperience* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
          + + +**ADMX_WindowsExplorer/DisableKnownFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify a list of known folders that should be disabled. + +Disabling a known folder will prevent the underlying file or directory from being created via the known folder API. If the folder exists before the policy is applied, the folder must be manually deleted since the policy only blocks the creation of the folder. + +You can specify a known folder using its known folder id or using its canonical name. For example, the Sample Videos known folder can be disabled by specifying {440fcffd-a92b-4739-ae1a-d4a54907c53f} or SampleVideos. + +> [!NOTE] +> Disabling a known folder can introduce application compatibility issues in applications that depend on the existence of the known folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Known Folders* +- GP name: *DisableKnownFolders* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/DisableSearchBoxSuggestions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Disables suggesting recent queries for the Search Box and prevents entries into the Search Box from being stored in the registry for future references. + +File Explorer shows suggestion pop-ups as users type into the Search Box. + +These suggestions are based on their past entries into the Search Box. + +> [!NOTE] +> If you enable this policy, File Explorer will not show suggestion pop-ups as users type into the Search Box, and it will not store Search Box entries into the registry for future references. If the user types a property, values that match this property will be shown but no data will be saved in the registry or re-shown on subsequent uses of the search box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off display of recent search entries in the File Explorer search box* +- GP name: *DisableSearchBoxSuggestions* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
          + + +**ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether remote paths can be used for file shortcut (.lnk file) icons. + +If you enable this policy setting, file shortcut icons are allowed to be obtained from remote paths. + +If you disable or do not configure this policy setting, file shortcut icons that use remote paths are prevented from being displayed. + +> [!NOTE] +> Allowing the use of remote paths in file shortcut icons can expose users’ computers to security risks. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow the use of remote paths in file shortcut icons* +- GP name: *EnableShellShortcutIconRemotePath* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
          + + +**ADMX_WindowsExplorer/EnableSmartScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that do not appear to be suspicious. + +Some information is sent to Microsoft about files and programs run on PCs with this feature enabled. + +If you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options: + +- Warn and prevent bypass +- Warn + +If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs will not present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app. If you enable this policy with the "Warn" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app. + +If you disable this policy, SmartScreen will be turned off for all users. Users will not be warned if they try to run suspicious apps from the Internet. + +If you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Windows Defender SmartScreen* +- GP name: *EnableSmartScreen* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/EnforceShellExtensionSecurity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This setting is designed to ensure that shell extensions can operate on a per-user basis. + +If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine. A shell extension only runs if there is an entry in at least one of the following locations in registry. + +For shell extensions that have been approved by the administrator and are available to all users of the computer, there must be an entry at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved. + +For shell extensions to run on a per-user basis, there must be an entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only per user or approved shell extensions* +- GP name: *EnforceShellExtensionSecurity* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify whether the ribbon appears minimized or in full when new File Explorer windows are opened. + +If you enable this policy setting, you can set how the ribbon appears the first time users open File Explorer and whenever they open new windows. + +If you disable or do not configure this policy setting, users can choose how the ribbon appears when they open new windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Start File Explorer with ribbon minimized* +- GP name: *ExplorerRibbonStartsMinimized* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/HideContentViewModeSnippets** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off the display of snippets in Content view mode. + +If you enable this policy setting, File Explorer will not display snippets in Content view mode. + +If you disable or do not configure this policy setting, File Explorer shows snippets in Content view mode by default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the display of snippets in Content view mode* +- GP name: *HideContentViewModeSnippets* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Internet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_InternetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Intranet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_IntranetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_LocalMachine* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_LocalMachineLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Restricted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_RestrictedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Trusted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_TrustedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Internet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_InternetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Intranet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_IntranetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_LocalMachine* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_LocalMachineLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Restricted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_RestrictedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Trusted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_TrustedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows traces shortcuts back to their sources when it cannot find the target on the user's system. + +Shortcut files typically include an absolute path to the original target file as well as the relative path to the current target file. When the system cannot find the file in the current target path, then, by default, it searches for the target in the original path. If the shortcut has been copied to a different computer, the original path might lead to a network computer, including external resources, such as an Internet server. + +If you enable this policy setting, Windows only searches the current target path. It does not search for the original path even when it cannot find the target file in the current target path. + +If you disable or do not configure this policy setting, Windows searches for the original path when it cannot find the target file in the current target path. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not track Shell shortcuts during roaming* +- GP name: *LinkResolveIgnoreLinkInfo* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/MaxRecentDocs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to set the maximum number of shortcuts the system can display in the Recent Items menu on the Start menu. The Recent Items menu contains shortcuts to the nonprogram files the user has most recently opened. + +If you enable this policy setting, the system displays the number of shortcuts specified by the policy setting. + +If you disable or do not configure this policy setting, by default, the system displays shortcuts to the 10 most recently opened documents. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maximum number of recent documents* +- GP name: *MaxRecentDocs* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoBackButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Hide the Back button in the Open dialog box. This policy setting lets you remove new features added in Microsoft Windows 2000 Professional, so the Open dialog box appears as it did in Windows NT 4.0 and earlier. This policy setting affects only programs that use the standard Open dialog box provided to developers of Windows programs. + +If you enable this policy setting, the Back button is removed from the standard Open dialog box. + +If you disable or do not configure this policy setting, the Back button is displayed for any standard Open dialog box. To see an example of the standard Open dialog box, start Notepad and, on the File menu, click Open. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. Also, third-party applications with Windows 2000 or later certification to are required to adhere to this policy setting. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the common dialog back button* +- GP name: *NoBackButton* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoCDBurning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove CD Burning features. File Explorer allows you to create and modify re-writable CDs if you have a CD writer connected to your PC. + +If you enable this policy setting, all features in the File Explorer that allow you to use your CD writer are removed. + +If you disable or do not configure this policy setting, users are able to use the File Explorer CD burning features. + +> [!NOTE] +> This policy setting does not prevent users from using third-party applications to create or modify CDs using a CD writer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove CD Burning features* +- GP name: *NoCDBurning* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoCacheThumbNailPictures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off caching of thumbnail pictures. + +If you enable this policy setting, thumbnail views are not cached. + +If you disable or do not configure this policy setting, thumbnail views are cached. + +> [!NOTE] +> For shared corporate workstations or computers where security is a top concern, you should enable this policy setting to turn off the thumbnail view cache, because the thumbnail cache can be read by everyone. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off caching of thumbnail pictures* +- GP name: *NoCacheThumbNailPictures* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoChangeAnimation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from enabling or disabling minor animations in the operating system for the movement of windows, menus, and lists. + +If you enable this policy setting, the "Use transition effects for menus and tooltips" option in Display in Control Panel is disabled, and cannot be toggled by users. + +Effects, such as animation, are designed to enhance the user's experience but might be confusing or distracting to some users. + +If you disable or do not configure this policy setting, users are allowed to turn on or off these minor system animations using the "Use transition effects for menus and tooltips" option in Display in Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove UI to change menu animation setting* +- GP name: *NoChangeAnimation* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Disables the "Hide keyboard navigation indicators until I use the ALT key" option in Display in Control Panel. When this Display Properties option is selected, the underlining that indicates a keyboard shortcut character (hot key) does not appear on menus until you press ALT. + +Effects, such as transitory underlines, are designed to enhance the user's experience but might be confusing or distracting to some users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove UI to change keyboard navigation indicator setting* +- GP name: *NoChangeKeyboardNavigationIndicators* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoDFSTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the DFS tab from File Explorer. + +If you enable this policy setting, the DFS (Distributed File System) tab is removed from File Explorer and from other programs that use the File Explorer browser, such as My Computer. As a result, users cannot use this tab to view or change the properties of the DFS shares available from their computer. This policy setting does not prevent users from using other methods to configure DFS. + +If you disable or do not configure this policy setting, the DFS tab is available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove DFS tab* +- GP name: *NoDFSTab* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoDrives** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to hide these specified drives in My Computer. + +This policy setting allows you to remove the icons representing selected hard drives from My Computer and File Explorer. Also, the drive letters representing the selected drives do not appear in the standard Open dialog box. + +If you enable this policy setting, select a drive or combination of drives in the drop-down list. + +> [!NOTE] +> This policy setting removes the drive icons. Users can still gain access to drive contents by using other methods, such as by typing the path to a directory on the drive in the Map Network Drive dialog box, in the Run dialog box, or in a command window. Also, this policy setting does not prevent users from using programs to access these drives or their contents. And, it does not prevent users from using the Disk Management snap-in to view and change drive characteristics. + +If you disable or do not configure this policy setting, all drives are displayed, or select the "Do not restrict drives" option in the drop-down list. Also, see the "Prevent access to drives from My Computer" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide these specified drives in My Computer* +- GP name: *NoDrives* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoEntireNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes all computers outside of the user's workgroup or local domain from lists of network resources in File Explorer and Network Locations. + +If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option. + +This setting does not prevent users from viewing or connecting to computers in their workgroup or domain. It also does not prevent users from connecting to remote computers by other commonly used methods, such as by typing the share name in the Run dialog box or the Map Network Drive dialog box. + +To remove computers in the user's workgroup or domain from lists of network resources, use the "No Computers Near Me in Network Locations" setting. + +> [!NOTE] +> It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *No Entire Network in Network Locations* +- GP name: *NoEntireNetwork* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoFileMRU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the list of most recently used files from the Open dialog box. + +If you disable this setting or do not configure it, the "File name" field includes a drop-down list of recently used files. If you enable this setting, the "File name" field is a simple text box. Users must browse directories to find a file or type a file name in the text box. + +This setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs. + +To see an example of the standard Open dialog box, start WordPad and, on the File menu, click Open. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the dropdown list of recent files* +- GP name: *NoFileMRU* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoFileMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the File menu from My Computer and File Explorer. + +This setting does not prevent users from using other methods to perform tasks available on the File menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove File menu from File Explorer* +- GP name: *NoFileMenu* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoFolderOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from accessing Folder Options through the View tab on the ribbon in File Explorer. + +Folder Options allows users to change the way files and folders open, what appears in the navigation pane, and other advanced view settings. + +If you enable this policy setting, users will receive an error message if they tap or click the Options button or choose the Change folder and search options command, and they will not be able to open Folder Options. + +If you disable or do not configure this policy setting, users can open Folder Options from the View tab on the ribbon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon* +- GP name: *NoFolderOptions* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoHardwareTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Hardware tab. This setting removes the Hardware tab from Mouse, Keyboard, and Sounds and Audio Devices in Control Panel. It also removes the Hardware tab from the Properties dialog box for all local drives, including hard drives, floppy disk drives, and CD-ROM drives. As a result, users cannot use the Hardware tab to view or change the device list or device properties, or use the Troubleshoot button to resolve problems with the device. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Hardware tab* +- GP name: *NoHardwareTab* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoManageMyComputerVerb** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Manage item from the File Explorer context menu. This context menu appears when you right-click File Explorer or My Computer. + +The Manage item opens Computer Management (Compmgmt.msc), a console tool that includes many of the primary Windows 2000 administrative tools, such as Event Viewer, Device Manager, and Disk Management. You must be an administrator to use many of the features of these tools. + +This setting does not remove the Computer Management item from the Start menu (Start, Programs, Administrative Tools, Computer Management), nor does it prevent users from using other methods to start Computer Management. + +> [!TIP] +> To hide all context menus, use the "Remove File Explorer's default context menu" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hides the Manage item on the File Explorer context menu* +- GP name: *NoManageMyComputerVerb* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoMyComputerSharedDocuments** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Shared Documents folder from My Computer. When a Windows client is in a workgroup, a Shared Documents icon appears in the File Explorer Web view under "Other Places" and also under "Files Stored on This Computer" in My Computer. Using this policy setting, you can choose not to have these items displayed. + +If you enable this policy setting, the Shared Documents folder is not displayed in the Web view or in My Computer. + +If you disable or do not configure this policy setting, the Shared Documents folder is displayed in Web view and also in My Computer when the client is part of a workgroup. + +> [!NOTE] +> The ability to remove the Shared Documents folder via Group Policy is only available on Windows XP Professional. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Shared Documents from My Computer* +- GP name: *NoMyComputerSharedDocuments* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoNetConnectDisconnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from using File Explorer or Network Locations to map or disconnect network drives. + +If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons. + +This setting does not prevent users from connecting to another computer by typing the name of a shared folder in the Run dialog box. + +> [!NOTE] +> This setting was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab states incorrectly that this setting prevents users from connecting and disconnecting drives. +> +> It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Map Network Drive" and "Disconnect Network Drive"* +- GP name: *NoNetConnectDisconnect* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoNewAppAlert** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy removes the end-user notification for new application associations. These associations are based on file types (e.g. *.txt) or protocols (e.g. http:). + +If this group policy is enabled, no notifications will be shown. If the group policy is not configured or disabled, notifications will be shown to the end user if a new application has been installed that can handle the file type or protocol association that was invoked. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not show the 'new application installed' notification* +- GP name: *NoNewAppAlert* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoPlacesBar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the shortcut bar from the Open dialog box. This setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs. + +To see an example of the standard Open dialog box, start WordPad and, on the File menu, click Open. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the common dialog places bar* +- GP name: *NoPlacesBar* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoRecycleFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. When a file or folder is deleted in File Explorer, a copy of the file or folder is placed in the Recycle Bin. Using this setting, you can change this behavior. + +If you enable this setting, files and folders that are deleted using File Explorer will not be placed in the Recycle Bin and will therefore be permanently deleted. + +If you disable or do not configure this setting, files and folders deleted using File Explorer will be placed in the Recycle Bin. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not move deleted files to the Recycle Bin* +- GP name: *NoRecycleFiles* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoRunAsInstallPrompt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from submitting alternate logon credentials to install a program. + +This setting suppresses the "Install Program As Other User" dialog box for local and network installations. This dialog box, which prompts the current user for the user name and password of an administrator, appears when users who are not administrators try to install programs locally on their computers. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. + +Many programs can be installed only by an administrator. If you enable this setting and a user does not have sufficient permissions to install a program, the installation continues with the current user's logon credentials. As a result, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly. + +If you disable this setting or do not configure it, the "Install Program As Other User" dialog box appears whenever users install programs locally on the computer. + +By default, users are not prompted for alternate logon credentials when installing programs from a network share. If enabled, this setting overrides the "Request credentials for network installations" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not request alternate credentials* +- GP name: *NoRunAsInstallPrompt* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoSearchInternetTryHarderButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, the "Internet" "Search again" link will not be shown when the user performs a search in the Explorer window. + +If you disable this policy, there will be an "Internet" "Search again" link when the user performs a search in the Explorer window. This button launches a search in the default browser with the search terms. + +If you do not configure this policy (default), there will be an "Internet" link when the user performs a search in the Explorer window. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the Search the Internet "Search again" link* +- GP name: *NoSearchInternetTryHarderButton* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoSecurityTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Security tab from File Explorer. + +If you enable this setting, users opening the Properties dialog box for all file system objects, including folders, files, shortcuts, and drives, will not be able to access the Security tab. As a result, users will be able to neither change the security settings nor view a list of all users that have access to the resource in question. + +If you disable or do not configure this setting, users will be able to access the security tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Security tab* +- GP name: *NoSecurityTab* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoShellSearchButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Search button from the File Explorer toolbar. If you enable this policy setting, the Search button is removed from the Standard Buttons toolbar that appears in File Explorer and other programs that use the File Explorer window, such as My Computer and Network Locations. Enabling this policy setting does not remove the Search button or affect any search features of Internet browser windows, such as the Internet Explorer window. + +If you disable or do not configure this policy setting, the Search button is available from the File Explorer toolbar. + +This policy setting does not affect the Search items on the File Explorer context menu or on the Start menu. To remove Search from the Start menu, use the "Remove Search menu from Start menu" policy setting (in User Configuration\Administrative Templates\Start Menu and Taskbar). To hide all context menus, use the "Remove File Explorer's default context menu" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Search button from File Explorer* +- GP name: *NoShellSearchButton* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoStrCmpLogical** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order. + +If you enable this policy setting, File Explorer will sort file names by each digit in a file name (for example, 111 < 22 < 3). + +If you disable or do not configure this policy setting, File Explorer will sort file names by increasing number value (for example, 3 < 22 < 111). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off numerical sorting in File Explorer* +- GP name: *NoStrCmpLogical* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoViewContextMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear when you right-click an item. + +If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove File Explorer's default context menu* +- GP name: *NoViewContextMenu* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoViewOnDrive** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from using My Computer to gain access to the content of selected drives. + +If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. + +To use this setting, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this setting or select the "Do not restrict drives" option from the drop-down list. + +> [!NOTE] +> The icons representing the specified drives still appear in My Computer, but if users double-click the icons, a message appears explaining that a setting prevents the action. +> +> Also, this setting does not prevent users from using programs to access local and network drives. And, it does not prevent them from using the Disk Management snap-in to view and change drive characteristics. Also, see the "Hide these specified drives in My Computer" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to drives from My Computer* +- GP name: *NoViewOnDrive* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoWindowsHotKeys** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Turn off Windows Key hotkeys. Keyboards with a Windows key provide users with shortcuts to common shell features. For example, pressing the keyboard sequence Windows+R opens the Run dialog box; pressing Windows+E starts File Explorer. + +By using this setting, you can disable these Windows Key hotkeys. + +If you enable this setting, the Windows Key hotkeys are unavailable. + +If you disable or do not configure this setting, the Windows Key hotkeys are available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Key hotkeys* +- GP name: *NoWindowsHotKeys* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/NoWorkgroupContents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove computers in the user's workgroup and domain from lists of network resources in File Explorer and Network Locations. + +If you enable this policy setting, the system removes the "Computers Near Me" option and the icons representing nearby computers from Network Locations. This policy setting also removes these icons from the Map Network Drive browser. + +If you disable or do not configure this policy setting, computers in the user's workgroup and domain appear in lists of network resources in File Explorer and Network Locations. + +This policy setting does not prevent users from connecting to computers in their workgroup or domain by other commonly used methods, such as typing the share name in the Run dialog box or the Map Network Drive dialog box. + +To remove network computers from lists of network resources, use the "No Entire Network in Network Locations" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *No Computers Near Me in Network Locations* +- GP name: *NoWorkgroupContents* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/PlacesBar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Configures the list of items displayed in the Places Bar in the Windows File/Open dialog. If enable this setting you can specify from 1 to 5 items to be displayed in the Places Bar. + +The valid items you may display in the Places Bar are: + +1. Shortcuts to a local folders -- (example: `C:\Windows`) +2. Shortcuts to remote folders -- (`\\server\share`) +3. FTP folders +4. web folders +5. Common Shell folders. + +The list of Common Shell Folders that may be specified: + +Desktop, Recent Places, Documents, Pictures, Music, Recently Changed, Attachments and Saved Searches. + +If you disable or do not configure this setting the default list of items will be displayed in the Places Bar. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Items displayed in Places Bar* +- GP name: *PlacesBar* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/PromptRunasInstallNetPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Prompts users for alternate logon credentials during network-based installations. + +This setting displays the "Install Program As Other User" dialog box even when a program is being installed from files on a network computer across a local area network connection. + +If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media. + +The "Install Program as Other User" dialog box prompts the current user for the user name and password of an administrator. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. + +If the dialog box does not appear, the installation proceeds with the current user's permissions. If these permissions are not sufficient, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly. + +> [!NOTE] +> If it is enabled, the "Do not request alternate credentials" setting takes precedence over this setting. When that setting is enabled, users are not prompted for alternate logon credentials on any installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Request credentials for network installations* +- GP name: *PromptRunasInstallNetPath* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/RecycleBinSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Limits the percentage of a volume's disk space that can be used to store deleted files. + +If you enable this setting, the user has a maximum amount of disk space that may be used for the Recycle Bin on their workstation. + +If you disable or do not configure this setting, users can change the total amount of disk space used by the Recycle Bin. + +> [!NOTE] +> This setting is applied to all volumes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maximum allowed Recycle Bin size* +- GP name: *RecycleBinSize* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows. + +If you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files. + +If you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + +If you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off shell protocol protected mode* +- GP name: *ShellProtocolProtectedModeTitle_1* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows. + +If you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files. + +If you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + +If you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off shell protocol protected mode* +- GP name: *ShellProtocolProtectedModeTitle_2* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/ShowHibernateOption** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Shows or hides hibernate from the power options menu. + +If you enable this policy setting, the hibernate option will be shown in the Power Options menu (as long as it is supported by the machine's hardware). + +If you disable this policy setting, the hibernate option will never be shown in the Power Options menu. + +If you do not configure this policy setting, users will be able to choose whether they want hibernate to show through the Power Options Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show hibernate in the power options menu* +- GP name: *ShowHibernateOption* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/ShowSleepOption** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Shows or hides sleep from the power options menu. + +If you enable this policy setting, the sleep option will be shown in the Power Options menu (as long as it is supported by the machine's hardware). + +If you disable this policy setting, the sleep option will never be shown in the Power Options menu. + +If you do not configure this policy setting, users will be able to choose whether they want sleep to show through the Power Options Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show sleep in the power options menu* +- GP name: *ShowSleepOption* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/TryHarderPinnedLibrary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows up to five Libraries or Search Connectors to be pinned to the "Search again" links and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. To add a Library or Search Connector link, specify the path of the .Library-ms or .searchConnector-ms file in the "Location" text box (for example, "C:\sampleLibrary.Library-ms" for the Documents library, or "C:\sampleSearchConnector.searchConnector-ms" for a Search Connector). The pinned link will only work if this path is valid and the location contains the specified .Library-ms or .searchConnector-ms file. + +You can add up to five additional links to the "Search again" links at the bottom of results returned in File Explorer after a search is executed. These links will be shared between Internet search sites and Search Connectors/Libraries. Search Connector/Library links take precedence over Internet search links. + +The first several links will also be pinned to the Start menu. A total of four links can be included on the Start menu. The "See more results" link will be pinned first by default, unless it is disabled via Group Policy. The "Search the Internet" link is pinned second, if it is pinned via Group Policy (though this link is disabled by default). If a custom Internet search link is pinned using the "Custom Internet search provider" Group Policy, this link will be pinned third on the Start menu. The remaining link(s) will be shared between pinned Search Connectors/Libraries and pinned Internet/intranet search links. Search Connector/Library links take precedence over Internet/intranet search links. + +If you enable this policy setting, the specified Libraries or Search Connectors will appear in the "Search again" links and the Start menu links. + +If you disable or do not configure this policy setting, no Libraries or Search Connectors will appear in the "Search again" links or the Start menu links. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pin Libraries or Search Connectors to the "Search again" links and the Start menu* +- GP name: *TryHarderPinnedLibrary* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + + +**ADMX_WindowsExplorer/TryHarderPinnedOpenSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to add Internet or intranet sites to the "Search again" links located at the bottom of search results in File Explorer and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. The Internet search site will be searched with the text in the search box. To add an Internet search site, specify the URL of the search site in OpenSearch format with {searchTerms} for the query string (for example, http://www.example.com/results.aspx?q={searchTerms}). + +You can add up to five additional links to the "Search again" links at the bottom of results returned in File Explorer after a search is executed. These links will be shared between Internet search sites and Search Connectors/Libraries. Search Connector/Library links take precedence over Internet search links. + +The first several links will also be pinned to the Start menu. A total of four links can be pinned on the Start menu. The "See more results" link will be pinned first by default, unless it is disabled via Group Policy. The "Search the Internet" link is pinned second, if it is pinned via Group Policy (though this link is disabled by default). If a custom Internet search link is pinned using the "Custom Internet search provider" Group Policy, this link will be pinned third on the Start menu. The remaining link(s) will be shared between pinned Internet/intranet links and pinned Search Connectors/Libraries. Search Connector/Library links take precedence over Internet/intranet search links. + +If you enable this policy setting, the specified Internet sites will appear in the "Search again" links and the Start menu links. + +If you disable or do not configure this policy setting, no custom Internet search sites will be added to the "Search again" links or the Start menu links. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pin Internet search sites to the "Search again" links and the Start menu* +- GP name: *TryHarderPinnedOpenSearch* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md new file mode 100644 index 0000000000..d9845c8533 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md @@ -0,0 +1,116 @@ +--- +title: Policy CSP - ADMX_WindowsMediaDRM +description: Policy CSP - ADMX_WindowsMediaDRM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsMediaDRM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WindowsMediaDRM policies + +
          +
          + ADMX_WindowsMediaDRM/DisableOnline +
          +
          + + +
          + + +**ADMX_WindowsMediaDRM/DisableOnline** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet). + +When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades. + +When this policy is enabled, programs are not able to acquire licenses for secure content, upgrade Windows Media DRM security components, or restore backed up content licenses. Secure content that is already licensed to the local computer will continue to play. Users are also able to protect music that they copy from a CD and play this protected content on their computer, since the license is generated locally in this scenario. + +When this policy is either disabled or not configured, Windows Media DRM functions normally and will connect to the Internet (or intranet) to acquire licenses, download security upgrades, and perform license restoration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Windows Media DRM Internet Access* +- GP name: *DisableOnline* +- GP path: *Windows Components\Windows Media Digital Rights Management* +- GP ADMX file name: *WindowsMediaDRM.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md new file mode 100644 index 0000000000..69a27c1fef --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md @@ -0,0 +1,1614 @@ +--- +title: Policy CSP - ADMX_WindowsMediaPlayer +description: Policy CSP - ADMX_WindowsMediaPlayer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsMediaPlayer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WindowsMediaPlayer policies + +
          +
          + ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings +
          +
          + ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings +
          +
          + ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings +
          +
          + ADMX_WindowsMediaPlayer/DisableAutoUpdate +
          +
          + ADMX_WindowsMediaPlayer/DisableNetworkSettings +
          +
          + ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration +
          +
          + ADMX_WindowsMediaPlayer/DoNotShowAnchor +
          +
          + ADMX_WindowsMediaPlayer/DontUseFrameInterpolation +
          +
          + ADMX_WindowsMediaPlayer/EnableScreenSaver +
          +
          + ADMX_WindowsMediaPlayer/HidePrivacyTab +
          +
          + ADMX_WindowsMediaPlayer/HideSecurityTab +
          +
          + ADMX_WindowsMediaPlayer/NetworkBuffering +
          +
          + ADMX_WindowsMediaPlayer/PolicyCodecUpdate +
          +
          + ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval +
          +
          + ADMX_WindowsMediaPlayer/PreventLibrarySharing +
          +
          + ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval +
          +
          + ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut +
          +
          + ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval +
          +
          + ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut +
          +
          + ADMX_WindowsMediaPlayer/SkinLockDown +
          +
          + ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols +
          +
          + + +
          + + +**ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify the HTTP proxy settings for Windows Media Player. + +If you enable this policy setting, select one of the following proxy types: + +- Autodetect: the proxy settings are automatically detected. +- Custom: unique proxy settings are used. +- Use browser proxy settings: browser's proxy settings are used. + +If the Custom proxy type is selected, the rest of the options on the Setting tab must be specified because no default settings are used for the proxy. The options are ignored if Autodetect or Browser is selected. + +The Configure button on the Network tab in the Player is not available for the HTTP protocol and the proxy cannot be configured. If the "Hide network tab" policy setting is also enabled, the entire Network tab is hidden. + +This policy is ignored if the "Streaming media protocols" policy setting is enabled and HTTP is not selected. + +If you disable this policy setting, the HTTP proxy server cannot be used and the user cannot configure the HTTP proxy. + +If you do not configure this policy setting, users can configure the HTTP proxy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure HTTP Proxy* +- GP name: *ConfigureHTTPProxySettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify the MMS proxy settings for Windows Media Player. + +If you enable this policy setting, select one of the following proxy types: + +- Autodetect: the proxy settings are automatically detected. +- Custom: unique proxy settings are used. + +If the Custom proxy type is selected, the rest of the options on the Setting tab must be specified; otherwise, the default settings are used. The options are ignored if Autodetect is selected. + +The Configure button on the Network tab in the Player is not available and the protocol cannot be configured. If the "Hide network tab" policy setting is also enabled, the entire Network tab is hidden. + +This policy setting is ignored if the "Streaming media protocols" policy setting is enabled and Multicast is not selected. + +If you disable this policy setting, the MMS proxy server cannot be used and users cannot configure the MMS proxy settings. + +If you do not configure this policy setting, users can configure the MMS proxy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure MMS Proxy* +- GP name: *ConfigureMMSProxySettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify the RTSP proxy settings for Windows Media Player. + +If you enable this policy setting, select one of the following proxy types: + +- Autodetect: the proxy settings are automatically detected. +- Custom: unique proxy settings are used. + +If the Custom proxy type is selected, the rest of the options on the Setting tab must be specified; otherwise, the default settings are used. The options are ignored if Autodetect is selected. + +The Configure button on the Network tab in the Player is not available and the protocol cannot be configured. If the "Hide network tab" policy setting is also enabled, the entire Network tab is hidden. + +If you disable this policy setting, the RTSP proxy server cannot be used and users cannot change the RTSP proxy settings. + +If you do not configure this policy setting, users can configure the RTSP proxy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure RTSP Proxy* +- GP name: *ConfigureRTSPProxySettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/DisableAutoUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to turn off do not show first use dialog boxes. + +If you enable this policy setting, the Privacy Options and Installation Options dialog boxes are prevented from being displayed the first time a user starts Windows Media Player. + +This policy setting prevents the dialog boxes which allow users to select privacy, file types, and other desktop options from being displayed when the Player is first started. Some of the options can be configured by using other Windows Media Player group policies. + +If you disable or do not configure this policy setting, the dialog boxes are displayed when the user starts the Player for the first time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Automatic Updates* +- GP name: *DisableAutoUpdate* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/DisableNetworkSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to hide the Network tab. + +If you enable this policy setting, the Network tab in Windows Media Player is hidden. The default network settings are used unless the user has previously defined network settings for the Player. + +If you disable or do not configure this policy setting, the Network tab appears and users can use it to configure network settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Network Tab* +- GP name: *DisableNetworkSettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent the anchor window from being displayed when Windows Media Player is in skin mode. + +If you enable this policy setting, the anchor window is hidden when the Player is in skin mode. In addition, the option on the Player tab in the Player that enables users to choose whether the anchor window displays is not available. + +If you disable or do not configure this policy setting, users can show or hide the anchor window when the Player is in skin mode by using the Player tab in the Player. + +If you do not configure this policy setting, and the "Set and lock skin" policy setting is enabled, some options in the anchor window are not available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do Not Show First Use Dialog Boxes* +- GP name: *DisableSetupFirstUseConfiguration* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/DoNotShowAnchor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents the anchor window from being displayed when Windows Media Player is in skin mode. + +This policy hides the anchor window when the Player is in skin mode. In addition, the option on the Player tab in the Player that enables users to choose whether the anchor window displays is not available. + +When this policy is not configured or disabled, users can show or hide the anchor window when the Player is in skin mode by using the Player tab in the Player. + +When this policy is not configured and the Set and Lock Skin policy is enabled, some options in the anchor window are not available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do Not Show Anchor* +- GP name: *DoNotShowAnchor* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/DontUseFrameInterpolation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent video smoothing from occurring. + +If you enable this policy setting, video smoothing is prevented, which can improve video playback on computers with limited resources. In addition, the Use Video Smoothing check box in the Video Acceleration Settings dialog box in the Player is cleared and is not available. + +If you disable this policy setting, video smoothing occurs if necessary, and the Use Video Smoothing check box is selected and is not available. + +If you do not configure this policy setting, video smoothing occurs if necessary. Users can change the setting for the Use Video Smoothing check box. + +Video smoothing is available only on the Windows XP Home Edition and Windows XP Professional operating systems. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Video Smoothing* +- GP name: *DontUseFrameInterpolation* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/EnableScreenSaver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows a screen saver to interrupt playback. + +If you enable this policy setting, a screen saver is displayed during playback of digital media according to the options selected on the Screen Saver tab in the Display Properties dialog box in Control Panel. The Allow screen saver during playback check box on the Player tab in the Player is selected and is not available. + +If you disable this policy setting, a screen saver does not interrupt playback even if users have selected a screen saver. The Allow screen saver during playback check box is cleared and is not available. + +If you do not configure this policy setting, users can change the setting for the Allow screen saver during playback check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Screen Saver* +- GP name: *EnableScreenSaver* +- GP path: *Windows Components\Windows Media Player\Playback* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/HidePrivacyTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to hide the Privacy tab in Windows Media Player. + +If you enable this policy setting, the "Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet" check box on the Media Library tab is available, even though the Privacy tab is hidden, unless the "Prevent music file media information retrieval" policy setting is enabled. + +The default privacy settings are used for the options on the Privacy tab unless the user changed the settings previously. + +If you disable or do not configure this policy setting, the Privacy tab is not hidden, and users can configure any privacy settings not configured by other polices. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Automatic Updates* +- GP name: *HidePrivacyTab* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/HideSecurityTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to hide the Security tab in Windows Media Player. + +If you enable this policy setting, the default security settings for the options on the Security tab are used unless the user changed the settings previously. Users can still change security and zone settings by using Internet Explorer unless these settings have been hidden or disabled by Internet Explorer policies. + +If you disable or do not configure this policy setting, users can configure the security settings on the Security tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Security Tab* +- GP name: *HideSecurityTab* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/NetworkBuffering** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify whether network buffering uses the default or a specified number of seconds. + +If you enable this policy setting, select one of the following options to specify the number of seconds streaming media is buffered before it is played. + +- Custom: the number of seconds, up to 60, that streaming media is buffered. +- Default: default network buffering is used and the number of seconds that is specified is ignored. + +The "Use default buffering" and "Buffer" options on the Performance tab in the Player are not available. + +If you disable or do not configure this policy setting, users can change the buffering options on the Performance tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Network Buffering* +- GP name: *NetworkBuffering* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/PolicyCodecUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent Windows Media Player from downloading codecs. + +If you enable this policy setting, the Player is prevented from automatically downloading codecs to your computer. In addition, the Download codecs automatically check box on the Player tab in the Player is not available. + +If you disable this policy setting, codecs are automatically downloaded and the Download codecs automatically check box is not available. + +If you do not configure this policy setting, users can change the setting for the Download codecs automatically check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Codec Download* +- GP name: *PolicyCodecUpdate* +- GP path: *Windows Components\Windows Media Player\Playback* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent media information for CDs and DVDs from being retrieved from the Internet. + +If you enable this policy setting, the Player is prevented from automatically obtaining media information from the Internet for CDs and DVDs played by users. In addition, the Retrieve media information for CDs and DVDs from the Internet check box on the Privacy Options tab in the first use dialog box and on the Privacy tab in the Player are not selected and are not available. + +If you disable or do not configure this policy setting, users can change the setting of the Retrieve media information for CDs and DVDs from the Internet check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent CD and DVD Media Information Retrieval* +- GP name: *PreventCDDVDMetadataRetrieval* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/PreventLibrarySharing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent media sharing from Windows Media Player. + +If you enable this policy setting, any user on this computer is prevented from sharing digital media content from Windows Media Player with other computers and devices that are on the same network. Media sharing is disabled from Windows Media Player or from programs that depend on the Player's media sharing feature. + +If you disable or do not configure this policy setting, anyone using Windows Media Player can turn media sharing on or off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Media Sharing* +- GP name: *PreventLibrarySharing* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent media information for music files from being retrieved from the Internet. + +If you enable this policy setting, the Player is prevented from automatically obtaining media information for music files such as Windows Media Audio (WMA) and MP3 files from the Internet. In addition, the Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box in the first use dialog box and on the Privacy and Media Library tabs in the Player are not selected and are not available. + +If you disable or do not configure this policy setting, users can change the setting of the Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Music File Media Information Retrieval* +- GP name: *PreventMusicFileMetadataRetrieval* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent a shortcut for the Player from being added to the Quick Launch bar. + +If you enable this policy setting, the user cannot add the shortcut for the Player to the Quick Launch bar. + +If you disable or do not configure this policy setting, the user can choose whether to add the shortcut for the Player to the Quick Launch bar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Quick Launch Toolbar Shortcut Creation* +- GP name: *PreventQuickLaunchShortcut* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent radio station presets from being retrieved from the Internet. + +If you enable this policy setting, the Player is prevented from automatically retrieving radio station presets from the Internet and displaying them in Media Library. In addition, presets that exist before the policy is configured are not be updated, and presets a user adds are not be displayed. + +If you disable or do not configure this policy setting, the Player automatically retrieves radio station presets from the Internet. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *PPrevent Radio Station Preset Retrieval* +- GP name: *PreventRadioPresetsRetrieval* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to prevent a shortcut icon for the Player from being added to the user's desktop. + +If you enable this policy setting, users cannot add the Player shortcut icon to their desktops. + +If you disable or do not configure this policy setting, users can choose whether to add the Player shortcut icon to their desktops. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Desktop Shortcut Creation* +- GP name: *PreventWMPDeskTopShortcut* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/SkinLockDown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to set and lock Windows Media Player in skin mode, using a specified skin. + +If you enable this policy setting, the Player displays only in skin mode using the skin specified in the Skin box on the Setting tab. + +You must use the complete file name for the skin (for example, skin_name.wmz), and the skin must be installed in the %programfiles%\Windows Media Player\Skins Folder on a user's computer. If the skin is not installed on a user's computer, or if the Skin box is blank, the Player opens by using the Corporate skin. The only way to specify the Corporate skin is to leave the Skin box blank. + +A user has access only to the Player features that are available with the specified skin. Users cannot switch the Player to full mode and cannot choose a different skin. + +If you disable or do not configure this policy setting, users can display the Player in full or skin mode and have access to all available features of the Player. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set and Lock Skin* +- GP name: *SkinLockDown* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + + +**ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting allows you to specify that Windows Media Player can attempt to use selected protocols when receiving streaming media from a server running Windows Media Services. + +If you enable this policy setting, the protocols that are selected on the Network tab of the Player are used to receive a stream initiated through an MMS or RTSP URL from a Windows Media server. If the RSTP/UDP check box is selected, a user can specify UDP ports in the Use ports check box. If the user does not specify UDP ports, the Player uses default ports when using the UDP protocol. This policy setting also specifies that multicast streams can be received if the "Allow the Player to receive multicast streams" check box on the Network tab is selected. + +If you enable this policy setting, the administrator must also specify the protocols that are available to users on the Network tab. If the administrator does not specify any protocols, the Player cannot access an MMS or RTSP URL from a Windows Media server. If the "Hide network tab" policy setting is enabled, the entire Network tab is hidden. + +If you do not configure this policy setting, users can select the protocols to use on the Network tab. + +If you disable this policy setting, the Protocols for MMS URLs and Multicast streams areas of the Network tab are not available and the Player cannot receive an MMS or RTSP stream from a Windows Media server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Streaming Media Protocols* +- GP name: *WindowsStreamingMediaProtocols* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md new file mode 100644 index 0000000000..7be8a731e7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -0,0 +1,409 @@ +--- +title: Policy CSP - ADMX_WindowsStore +description: Policy CSP - ADMX_WindowsStore +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsStore +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WindowsStore policies + +
          +
          + ADMX_WindowsStore/DisableAutoDownloadWin8 +
          +
          + ADMX_WindowsStore/DisableOSUpgrade_1 +
          +
          + ADMX_WindowsStore/DisableOSUpgrade_2 +
          +
          + ADMX_WindowsStore/RemoveWindowsStore_1 +
          +
          + ADMX_WindowsStore/RemoveWindowsStore_2 +
          +
          + + +
          + + +**ADMX_WindowsStore/DisableAutoDownloadWin8** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables or disables the automatic download of app updates on PCs running Windows 8. + +If you enable this setting, the automatic download of app updates is turned off. If you disable this setting, the automatic download of app updates is turned on. + +If you don't configure this setting, the automatic download of app updates is determined by a registry setting that the user can change using Settings in the Windows Store. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Automatic Download of updates on Win8 machines* +- GP name: *DisableAutoDownloadWin8* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
          + +
          + + +**ADMX_WindowsStore/DisableOSUpgrade_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables or disables the Store offer to update to the latest version of Windows. + +If you enable this setting, the Store application will not offer updates to the latest version of Windows. + +If you disable or do not configure this setting the Store application will offer updates to the latest version of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the offer to update to the latest version of Windows* +- GP name: *DisableOSUpgrade_1* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
          + +
          + + +**ADMX_WindowsStore/DisableOSUpgrade_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables or disables the Store offer to update to the latest version of Windows. + +If you enable this setting, the Store application will not offer updates to the latest version of Windows. + +If you disable or do not configure this setting the Store application will offer updates to the latest version of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the offer to update to the latest version of Windows* +- GP name: *DisableOSUpgrade_2* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
          + +
          + + +**ADMX_WindowsStore/RemoveWindowsStore_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies or allows access to the Store application. + +If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. + +If you disable or don't configure this setting, access to the Store application is allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Store application* +- GP name: *RemoveWindowsStore_1* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
          + +
          + + +**ADMX_WindowsStore/RemoveWindowsStore_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies or allows access to the Store application. + +If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. + +If you disable or don't configure this setting, access to the Store application is allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Store application* +- GP name: *RemoveWindowsStore_2* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-wininit.md b/windows/client-management/mdm/policy-csp-admx-wininit.md new file mode 100644 index 0000000000..dbbecca9d5 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wininit.md @@ -0,0 +1,258 @@ +--- +title: Policy CSP - ADMX_WinInit +description: Policy CSP - ADMX_WinInit +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/29/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WinInit +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WinInit policies + +
          +
          + ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription +
          +
          + ADMX_WinInit/Hiberboot +
          +
          + ADMX_WinInit/ShutdownTimeoutHungSessionsDescription +
          +
          + + +
          + + +**ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in order to shutdown this system from a remote Windows XP or Windows Server 2003 system. + +If you enable this policy setting, the system does not create the named pipe remote shutdown interface. + +If you disable or do not configure this policy setting, the system creates the named pipe remote shutdown interface. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off legacy remote shutdown interface* +- GP name: *DisableNamedPipeShutdownPolicyDescription* +- GP path: *Windows Components\Shutdown Options* +- GP ADMX file name: *WinInit.admx* + + + +
          + + +**ADMX_WinInit/Hiberboot** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting controls the use of fast startup. + +If you enable this policy setting, the system requires hibernate to be enabled. + +If you disable or do not configure this policy setting, the local setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require use of fast startup* +- GP name: *Hiberboot* +- GP path: *System\Shutdown* +- GP ADMX file name: *WinInit.admx* + + + +
          + + +**ADMX_WinInit/ShutdownTimeoutHungSessionsDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10 Insider Preview Build 20185. This policy setting configures the number of minutes the system waits for the hung logon sessions before proceeding with the system shutdown. + +If you enable this policy setting, the system waits for the hung logon sessions for the number of minutes specified. + +If you disable or do not configure this policy setting, the default timeout value is 3 minutes for workstations and 15 minutes for servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Timeout for hung logon sessions during shutdown* +- GP name: *ShutdownTimeoutHungSessionsDescription* +- GP path: *Windows Components\Shutdown Options* +- GP ADMX file name: *WinInit.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md new file mode 100644 index 0000000000..26187fd26d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -0,0 +1,493 @@ +--- +title: Policy CSP - ADMX_WinLogon +description: Policy CSP - ADMX_WinLogon +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WinLogon +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WinLogon policies + +
          +
          + ADMX_WinLogon/CustomShell +
          +
          + ADMX_WinLogon/DisplayLastLogonInfoDescription +
          +
          + ADMX_WinLogon/LogonHoursNotificationPolicyDescription +
          +
          + ADMX_WinLogon/LogonHoursPolicyDescription +
          +
          + ADMX_WinLogon/ReportCachedLogonPolicyDescription +
          +
          + ADMX_WinLogon/SoftwareSASGeneration +
          +
          + + +
          + + +**ADMX_WinLogon/CustomShell** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. Specifies an alternate user interface. The Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface. + +If you enable this setting, the system starts the interface you specify instead of Explorer.exe. To use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file. + +If you disable this setting or do not configure it, the setting is ignored and the system displays the Explorer interface. + +> [!TIP] +> To find the folders indicated by the Path environment variable, click System Properties in Control Panel, click the Advanced tab, click the Environment Variables button, and then, in the System variables box, click Path. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom User Interface* +- GP name: *CustomShell* +- GP path: *System* +- GP ADMX file name: *WinLogon.admx* + + + +
          + + +**ADMX_WinLogon/DisplayLastLogonInfoDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not the system displays information about previous logons and logon failures to the user. + +For local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last successful logon by that user, the date and time of the last unsuccessful logon attempted with that user name, and the number of unsuccessful logons since the last successful logon by that user. This message must be acknowledged by the user before the user is presented with the Microsoft Windows desktop. + +For domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows could not retrieve the information and the user will not be able to log on. Therefore, you should not enable this policy setting if the domain is not at the Windows Server 2008 domain functional level. + +If you disable or do not configure this setting, messages about the previous logon or logon failures are not displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display information about previous logons during user logon* +- GP name: *DisplayLastLogonInfoDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
          + + + +**ADMX_WinLogon/LogonHoursNotificationPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the logged on user should be notified when his logon hours are about to expire. By default, a user is notified before logon hours expire, if actions have been set to occur when the logon hours expire. + +If you enable this setting, warnings are not displayed to the user before the logon hours expire. + +If you disable or do not configure this setting, users receive warnings before the logon hours expire, if actions have been set to occur when the logon hours expire. + +> [!NOTE] +> If you configure this setting, you might want to examine and appropriately configure the “Set action to take when logon hours expire” setting. If “Set action to take when logon hours expire” is disabled or not configured, the “Remove logon hours expiration warnings” setting will have no effect, and users receive no warnings about logon hour expiration + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove logon hours expiration warnings* +- GP name: *LogonHoursNotificationPolicyDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
          + + +**ADMX_WinLogon/LogonHoursPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls which action will be taken when the logon hours expire for the logged on user. The actions include lock the workstation, disconnect the user, or log the user off completely. + +If you choose to lock or disconnect a session, the user cannot unlock the session or reconnect except during permitted logon hours. + +If you choose to log off a user, the user cannot log on again except during permitted logon hours. If you choose to log off a user, the user might lose unsaved data. If you enable this setting, the system will perform the action you specify when the user’s logon hours expire. + +If you disable or do not configure this setting, the system takes no action when the user’s logon hours expire. The user can continue the existing session, but cannot log on to a new session. + +> [!NOTE] +> If you configure this setting, you might want to examine and appropriately configure the “Remove logon hours expiration warnings” setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set action to take when logon hours expire* +- GP name: *LogonHoursPolicyDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
          + + +**ADMX_WinLogon/ReportCachedLogonPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information. + +If enabled, a notification popup will be displayed to the user when the user logs on with cached credentials. + +If disabled or not configured, no popup will be displayed to the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Report when logon server was not available during user logon* +- GP name: *ReportCachedLogonPolicyDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
          + + +**ADMX_WinLogon/SoftwareSASGeneration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not software can simulate the Secure Attention Sequence (SAS). + +If you enable this policy setting, you have one of four options: + +- If you set this policy setting to "None," user mode software cannot simulate the SAS. +- If you set this policy setting to "Services," services can simulate the SAS. +- If you set this policy setting to "Ease of Access applications," Ease of Access applications can simulate the SAS. +- If you set this policy setting to "Services and Ease of Access applications," both services and Ease of Access applications can simulate the SAS. + +If you disable or do not configure this setting, only Ease of Access applications running on the secure desktop can simulate the SAS. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable or enable software Secure Attention Sequence* +- GP name: *SoftwareSASGeneration* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-wlansvc.md b/windows/client-management/mdm/policy-csp-admx-wlansvc.md new file mode 100644 index 0000000000..0ca862b038 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wlansvc.md @@ -0,0 +1,260 @@ +--- +title: Policy CSP - ADMX_wlansvc +description: Policy CSP - ADMX_wlansvc +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/27/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_wlansvc +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_wlansvc policies + +
          +
          + ADMX_wlansvc/SetCost +
          +
          + ADMX_wlansvc/SetPINEnforced +
          +
          + ADMX_wlansvc/SetPINPreferred +
          +
          + + +
          + + +**ADMX_wlansvc/SetCost** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the cost of Wireless LAN (WLAN) connections on the local machine. + +If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all WLAN connections on the local machine: + +- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints. +- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit. +- Variable: This connection is costed on a per byte basis. If this policy setting is disabled or is not configured, the cost of Wireless LAN connections is Unrestricted by default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Cost* +- GP name: *IncludeCmdLine* +- GP path: *Network\WLAN Service\WLAN Media Cost* +- GP ADMX file name: *wlansvc.admx* + + + +
          + + +**ADMX_wlansvc/SetPINEnforced** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy applies to Wireless Display connections. This policy means that the use of a PIN for pairing to Wireless Display devices is required rather than optional. + +Conversely it means that Push Button is NOT allowed. + +If this policy setting is disabled or is not configured, by default Push Button pairing is allowed (but not necessarily preferred). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require PIN pairing* +- GP name: *SetPINEnforced* +- GP path: *Network\Wireless Display* +- GP ADMX file name: *wlansvc.admx* + + + +
          + + +**ADMX_wlansvc/SetPINPreferred** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy applies to Wireless Display connections. This policy changes the preference order of the pairing methods. + +When enabled, it makes the connections to prefer a PIN for pairing to Wireless Display devices over the Push Button pairing method. + +If this policy setting is disabled or is not configured, by default Push Button pairing is preferred (if allowed by other policies). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prefer PIN pairing* +- GP name: *SetPINPreferred* +- GP path: *Network\Wireless Display* +- GP ADMX file name: *wlansvc.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md new file mode 100644 index 0000000000..863f094564 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -0,0 +1,489 @@ +--- +title: Policy CSP - ADMX_WPN +description: Policy CSP - ADMX_WPN +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WPN +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## ADMX_WPN policies + +
          +
          + ADMX_WPN/NoCallsDuringQuietHours +
          +
          + ADMX_WPN/NoLockScreenToastNotification +
          +
          + ADMX_WPN/NoQuietHours +
          +
          + ADMX_WPN/NoToastNotification +
          +
          + ADMX_WPN/QuietHoursDailyBeginMinute +
          +
          + ADMX_WPN/QuietHoursDailyEndMinute +
          +
          + + +
          + + +**ADMX_WPN/NoCallsDuringQuietHours** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting blocks voice and video calls during Quiet Hours. + +If you enable this policy setting, voice and video calls will be blocked during the designated Quiet Hours time window each day, and users will not be able to customize any other Quiet Hours settings. + +If you disable this policy setting, voice and video calls will be allowed during Quiet Hours, and users will not be able to customize this or any other Quiet Hours settings. + +If you do not configure this policy setting, voice and video calls will be allowed during Quiet Hours by default. Administrators and users will be able to modify this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off calls during Quiet Hours* +- GP name: *NoCallsDuringQuietHours* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
          + + +**ADMX_WPN/NoLockScreenToastNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off toast notifications on the lock screen. + +If you enable this policy setting, applications will not be able to raise toast notifications on the lock screen. + +If you disable or do not configure this policy setting, toast notifications on the lock screen are enabled and can be turned off by the administrator or user. + +No reboots or service restarts are required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off toast notifications on the lock screen* +- GP name: *NoLockScreenToastNotification* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
          + + +**ADMX_WPN/NoQuietHours** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Quiet Hours functionality. + +If you enable this policy setting, toast notifications will not be suppressed and some background tasks will not be deferred during the designated Quiet Hours time window each day. + +If you disable this policy setting, toast notifications will be suppressed and some background task deferred during the designated Quiet Hours time window. Users will not be able to change this or any other Quiet Hours settings. + +If you do not configure this policy setting, Quiet Hours are enabled by default but can be turned off or by the administrator or user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Quiet Hours* +- GP name: *NoQuietHours* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
          + + +**ADMX_WPN/NoToastNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off toast notifications for applications. + +If you enable this policy setting, applications will not be able to raise toast notifications. + +Note that this policy does not affect taskbar notification balloons. + +Note that Windows system features are not affected by this policy. You must enable/disable system features individually to stop their ability to raise toast notifications. + +If you disable or do not configure this policy setting, toast notifications are enabled and can be turned off by the administrator or user. + +No reboots or service restarts are required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off toast notifications* +- GP name: *NoToastNotification* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
          + + +**ADMX_WPN/QuietHoursDailyBeginMinute** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the number of minutes after midnight (local time) that Quiet Hours is to begin each day. + +If you enable this policy setting, the specified time will be used, and users will not be able to customize any Quiet Hours settings. + +If you disable this policy setting, a default value will be used, and users will not be able to change it or any other Quiet Hours setting. + +If you do not configure this policy setting, a default value will be used, which administrators and users will be able to modify. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the time Quiet Hours begins each day* +- GP name: *QuietHoursDailyBeginMinute* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
          + + +**ADMX_WPN/QuietHoursDailyEndMinute** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcross mark
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the number of minutes after midnight (local time) that Quiet Hours is to end each day. + +If you enable this policy setting, the specified time will be used, and users will not be able to customize any Quiet Hours settings. + +If you disable this policy setting, a default value will be used, and users will not be able to change it or any other Quiet Hours setting. + +If you do not configure this policy setting, a default value will be used, which administrators and users will be able to modify. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the time Quiet Hours ends each day* +- GP name: *QuietHoursDailyEndMinute* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 7bbea44531..eb4a7086d1 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -1,12 +1,13 @@ --- title: Policy CSP - ApplicationDefaults -description: Policy CSP - ApplicationDefaults +description: Learn about various Policy configuration service provider (CSP) - ApplicationDefaults, including SyncML, for Windows 10. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - ApplicationDefaults +
          @@ -37,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -145,26 +155,34 @@ Here is the SyncMl example: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -199,12 +217,16 @@ This setting supports a range of values between 0 and 1.
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 9feb66be2d..1f128f9b64 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,22 +1,19 @@ --- title: Policy CSP - ApplicationManagement -description: Policy CSP - ApplicationManagement +description: Learn about various Policy configuration service provider (CSP) - ApplicationManagement, including SyncML, for Windows 10. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 02/11/2020 ms.reviewer: manager: dansimp --- # Policy CSP - ApplicationManagement -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - -
          @@ -38,11 +35,8 @@ manager: dansimp
          ApplicationManagement/AllowSharedUserAppData
          -
          - ApplicationManagement/AllowStore -
          -
          - ApplicationManagement/ApplicationRestrictions +
          + ApplicationManagement/BlockNonAdminUserInstall
          ApplicationManagement/DisableStoreOriginatedApps @@ -79,26 +73,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -140,26 +142,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -201,26 +211,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -262,26 +280,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -325,26 +351,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -380,31 +414,40 @@ Most restricted value: 0
          -**ApplicationManagement/AllowStore** +**ApplicationManagement/BlockNonAdminUserInstall** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
          Procross mark
          Businesscheck mark8
          Enterprisecheck mark8
          Educationcheck mark8
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -415,83 +458,34 @@ Most restricted value: 0 -Specifies whether app store is allowed at the device. +Added in Windows 10, version 2004. -Most restricted value is 0. +Manages non-administrator users' ability to install Windows app packages. + +If you enable this policy, non-administrators will be unable to initiate installation of Windows app packages. Administrators who wish to install an app will need to do so from an Administrator context (for example, an Administrator PowerShell window). All users will still be able to install Windows app packages via the Microsoft Store, if permitted by other policies. + +If you disable or do not configure this policy, all users will be able to initiate installation of Windows app packages. + +ADMX Info: +- GP English name: *Prevent non-admin users from installing packaged Windows apps* +- GP name: *BlockNonAdminUserInstall* +- GP path: *Windows Components/App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - +The following list shows the supported values: +- 0 (default) - Disabled. All users will be able to initiate installation of Windows app packages. +- 1 - Enabled. Non-administrator users will not be able to initiate installation of Windows app packages. - + -
          + + - -**ApplicationManagement/ApplicationRestrictions** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead. - -  -An XML blob that specifies the application restrictions company want to put to the device. It could be an app allow list, app disallow list, allowed publisher IDs, and so on. For a list of Windows apps and product IDs, see [inbox apps](applocker-csp.md#inboxappsandcomponents). For more information about the XML, see the [ApplicationRestrictions XSD](applicationrestrictions-xsd.md). - -> [!NOTE] -> When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps. -> -> Here's additional guidance for the upgrade process: -> -> - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents). -> - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher if you are using it. -> - In the SyncML, you must use lowercase product ID. -> - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error. -> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents). - - -An application that is running may not be immediately terminated. - -Value type is chr. - -Value evaluation rule - The information for PolicyManager is opaque. There is no most restricted value evaluation. Whenever there is a change to the value, the device parses the node value and enforces specified policies. - - +
          @@ -502,26 +496,34 @@ Value evaluation rule - The information for PolicyManager is opaque. There is no - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark1check mark1cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -560,26 +562,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -623,26 +633,34 @@ For this policy to work, the Windows apps need to declare in their manifest that - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4cross markcheck mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscross mark
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -686,26 +704,34 @@ This setting supports a range of values between 0 and 1. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4cross markcheck mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscross mark
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -750,26 +776,34 @@ This setting supports a range of values between 0 and 1. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcheck markcheck markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -812,26 +846,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -872,26 +914,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -932,26 +982,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark5check mark5Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1040,41 +1098,17 @@ XSD: - - - - -## ApplicationManagement policies supported by HoloLens 2 - -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - - - - -## ApplicationManagement policies supported by HoloLens (ist gen) Commercial Suite - -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - - - -## ApplicationManagement policies supported by HoloLens (1st gen) Development Edition - -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 6f998bebf9..2a224f8bfe 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -1,12 +1,13 @@ --- title: Policy CSP - AppRuntime -description: Policy CSP - AppRuntime +description: Learn how the Policy CSP - AppRuntime setting controls whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - AppRuntime +
          @@ -34,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -89,12 +99,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 7ecd3a228b..63cdb4036d 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1,12 +1,13 @@ --- title: Policy CSP - AppVirtualization -description: Policy CSP - AppVirtualization +description: Learn how the Policy CSP - AppVirtualization setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/08/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -116,26 +117,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -174,26 +183,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -232,26 +249,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -290,26 +315,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -348,26 +381,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -406,26 +447,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -474,26 +523,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -532,26 +589,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -590,26 +655,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -648,26 +721,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -706,26 +787,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -764,26 +853,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -822,26 +919,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -898,26 +1003,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -974,26 +1087,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1050,26 +1171,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1126,26 +1255,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1202,26 +1339,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1260,26 +1405,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1318,26 +1471,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1376,26 +1537,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1434,26 +1603,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1492,26 +1669,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1550,26 +1735,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1608,26 +1801,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1666,26 +1867,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1724,26 +1933,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1782,26 +1999,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1812,7 +2037,7 @@ ADMX Info: -Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components. +Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc.). Only processes whose full path matches one of these items can use virtual components. > [!TIP] @@ -1833,12 +2058,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index f5630e76f5..e808f11e13 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,12 +1,13 @@ --- title: Policy CSP - AttachmentManager -description: Policy CSP - AttachmentManager +description: Manage Windows marks file attachments with information about their zone of origin, such as restricted, internet, intranet, local. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -41,26 +42,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -105,26 +114,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -169,26 +186,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -226,12 +251,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md new file mode 100644 index 0000000000..7d0997f275 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -0,0 +1,4807 @@ +--- +title: Policy CSP - Audit +description: Learn how the Policy CSP - Audit setting causes an audit event to be generated when an account can't log on to a computer because the account is locked out. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +--- + +# Policy CSP - Audit + +
          + + +## Audit policies + +
          +
          + Audit/AccountLogonLogoff_AuditAccountLockout +
          +
          + Audit/AccountLogonLogoff_AuditGroupMembership +
          +
          + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
          +
          + Audit/AccountLogonLogoff_AuditIPsecMainMode +
          +
          + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
          +
          + Audit/AccountLogonLogoff_AuditLogoff +
          +
          + Audit/AccountLogonLogoff_AuditLogon +
          +
          + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
          +
          + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
          +
          + Audit/AccountLogonLogoff_AuditSpecialLogon +
          +
          + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
          +
          + Audit/AccountLogon_AuditCredentialValidation +
          +
          + Audit/AccountLogon_AuditKerberosAuthenticationService +
          +
          + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
          +
          + Audit/AccountLogon_AuditOtherAccountLogonEvents +
          +
          + Audit/AccountManagement_AuditApplicationGroupManagement +
          +
          + Audit/AccountManagement_AuditComputerAccountManagement +
          +
          + Audit/AccountManagement_AuditDistributionGroupManagement +
          +
          + Audit/AccountManagement_AuditOtherAccountManagementEvents +
          +
          + Audit/AccountManagement_AuditSecurityGroupManagement +
          +
          + Audit/AccountManagement_AuditUserAccountManagement +
          +
          + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
          +
          + Audit/DSAccess_AuditDirectoryServiceAccess +
          +
          + Audit/DSAccess_AuditDirectoryServiceChanges +
          +
          + Audit/DSAccess_AuditDirectoryServiceReplication +
          +
          + Audit/DetailedTracking_AuditDPAPIActivity +
          +
          + Audit/DetailedTracking_AuditPNPActivity +
          +
          + Audit/DetailedTracking_AuditProcessCreation +
          +
          + Audit/DetailedTracking_AuditProcessTermination +
          +
          + Audit/DetailedTracking_AuditRPCEvents +
          +
          + Audit/DetailedTracking_AuditTokenRightAdjusted +
          +
          + Audit/ObjectAccess_AuditApplicationGenerated +
          +
          + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
          +
          + Audit/ObjectAccess_AuditCertificationServices +
          +
          + Audit/ObjectAccess_AuditDetailedFileShare +
          +
          + Audit/ObjectAccess_AuditFileShare +
          +
          + Audit/ObjectAccess_AuditFileSystem +
          +
          + Audit/ObjectAccess_AuditFilteringPlatformConnection +
          +
          + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
          +
          + Audit/ObjectAccess_AuditHandleManipulation +
          +
          + Audit/ObjectAccess_AuditKernelObject +
          +
          + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
          +
          + Audit/ObjectAccess_AuditRegistry +
          +
          + Audit/ObjectAccess_AuditRemovableStorage +
          +
          + Audit/ObjectAccess_AuditSAM +
          +
          + Audit/PolicyChange_AuditAuthenticationPolicyChange +
          +
          + Audit/PolicyChange_AuditAuthorizationPolicyChange +
          +
          + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
          +
          + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
          +
          + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
          +
          + Audit/PolicyChange_AuditPolicyChange +
          +
          + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
          +
          + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
          +
          + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
          +
          + Audit/System_AuditIPsecDriver +
          +
          + Audit/System_AuditOtherSystemEvents +
          +
          + Audit/System_AuditSecurityStateChange +
          +
          + Audit/System_AuditSecuritySystemExtension +
          +
          + Audit/System_AuditSystemIntegrity +
          +
          + + +
          + + +**Audit/AccountLogonLogoff_AuditAccountLockout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + +Volume: Low. + + + +GP Info: +- GP English name: *Audit Account Lockout* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditGroupMembership** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Group Membership* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditIPsecExtendedMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + +Volume: High. + + + +GP Info: +- GP English name: *Audit IPsec Extended Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditIPsecMainMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Main Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditIPsecQuickMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Quick Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditLogoff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Logoff* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditLogon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +The following events are included: +- Successful logon attempts. +- Failed logon attempts. +- Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. +- Security identifiers (SIDs) were filtered and not allowed to log on. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditNetworkPolicyServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + +Volume: Medium or High on NPS and IAS server. No volume on other computers. + + +GP Info: +- GP English name: *Audit Network Policy Server* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +- Terminal Services session disconnections. +- New Terminal Services sessions. +- Locking and unlocking a workstation. +- Invoking a screen saver. +- Dismissal of a screen saver. +- Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. +- Access to a wireless network granted to a user or computer account. +- Access to a wired 802.1x network granted to a user or computer account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Logon Logoff Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditSpecialLogon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: +- The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-special-logon). + +Volume: Low. + + +GP Info: +- GP English name: *Audit Special Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogonLogoff_AuditUserDeviceClaims** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit User Device Claims* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogon_AuditCredentialValidation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + +Volume: High on domain controllers. + + +GP Info: +- GP English name: *Audit Credential Validation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogon_AuditKerberosAuthenticationService** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + +Volume: High on Kerberos Key Distribution Center servers. + + +GP Info: +- GP English name: *Audit Kerberos Authentication Service* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogon_AuditKerberosServiceTicketOperations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Kerberos Service Ticket Operations* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountLogon_AuditOtherAccountLogonEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + +GP Info: +- GP English name: *Audit Other Account Logon Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountManagement_AuditApplicationGroupManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to application groups, such as the following: +- Application group is created, changed, or deleted. +- Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Application Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountManagement_AuditComputerAccountManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Computer Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountManagement_AuditDistributionGroupManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +- Distribution group is created, changed, or deleted. +- Member is added or removed from a distribution group. +- Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +> [!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Distribution Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountManagement_AuditOtherAccountManagementEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +- The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. +- The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. +- Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. + +> [!Note] +> The security audit event is logged when the policy setting is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Account Management Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountManagement_AuditSecurityGroupManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to security groups, such as the following: +- Security group is created, changed, or deleted. +- Member is added or removed from a security group. +- Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/AccountManagement_AuditUserAccountManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes to user accounts. +Events include the following: +- A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. +- A user account’s password is set or changed. +- A security identifier (SID) is added to the SID History of a user account. +- The Directory Services Restore Mode password is configured. +- Permissions on administrative user accounts are changed. +- Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a user account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit User Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/DSAccess_AuditDetailedDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + +Volume: High. + + + +GP Info: +- GP English name: *Audit Detailed Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/DSAccess_AuditDirectoryServiceAccess** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + +Volume: High on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Access* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/DSAccess_AuditDirectoryServiceChanges** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +> [!Note] +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + +Volume: High on domain controllers only. + + +GP Info: +- GP English name: *Audit Directory Service Changes* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/DSAccess_AuditDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + +>[!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Medium on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/DetailedTracking_AuditDPAPIActivity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + +Volume: Low. + + +GP Info: +- GP English name: *Audit DPAPI Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/DetailedTracking_AuditPNPActivity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + +Volume: Low. + + +GP Info: +- GP English name: *Audit PNP Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/DetailedTracking_AuditProcessCreation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Creation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/DetailedTracking_AuditProcessTermination** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Termination* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/DetailedTracking_AuditRPCEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + +Volume: High on RPC servers. + + +GP Info: +- GP English name: *Audit RPC Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/DetailedTracking_AuditTokenRightAdjusted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by adjusting the privileges of a token. + +Volume: High. + + +GP Info: +- GP English name: *Audit Token Right Adjusted* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditApplicationGenerated** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: +- Creation of an application client context. +- Deletion of an application client context. +- Initialization of an application client context. +- Other application operations using the Windows Auditing APIs. + +Volume: Depends on the applications that are generating them. + + +GP Info: +- GP English name: *Audit Application Generated* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditCentralAccessPolicyStaging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2. Failure audits when configured records access attempts when: + - The current central access policy does not grant access but the proposed policy grants access. + - A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + +GP Info: +- GP English name: *Audit Central Access Policy Staging* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditCertificationServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + +- AD CS startup/shutdown/backup/restore. +- Changes to the certificate revocation list (CRL). +- New certificate requests. +- Issuing of a certificate. +- Revocation of a certificate. +- Changes to the Certificate Manager settings for AD CS. +- Changes in the configuration of AD CS. +- Changes to a Certificate Services template. +- Importing of a certificate. +- Publishing of a certification authority certificate is to Active Directory Domain Services. +- Changes to the security permissions for AD CS. +- Archival of a key. +- Importing of a key. +- Retrieval of a key. +- Starting of Online Certificate Status Protocol (OCSP) Responder Service. +- Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + +Volume: Medium or Low on computers running Active Directory Certificate Services. + + +GP Info: +- GP English name: *Audit Certification Services* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditDetailedFileShare** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit Detailed File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditFileShare** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditFileSystem** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +> [!Note] +> You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + +Volume: Depends on how the file system SACLs are configured. + + +GP Info: +- GP English name: *Audit File System* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditFilteringPlatformConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +The following events are included: +- The Windows Firewall Service blocks an application from accepting incoming connections on the network. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits a bind to a local port. +- The WFP blocks a bind to a local port. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits an application or service to listen on a port for incoming connections. +- The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. + +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + +Volume: High. + + +GP Info: +- GP English name: *Audit Filtering Platform Connection* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditFilteringPlatformPacketDrop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + +Volume: High. + + + +GP Info: +- GP English name: *Audit Filtering Platform Packet Drop* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditHandleManipulation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +> [!Note] +> Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + +Volume: Depends on how SACLs are configured. + + +GP Info: +- GP English name: *Audit Handle Manipulation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditKernelObject** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which includes mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +> [!Note] +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + +Volume: High if auditing access of global system objects is enabled. + + +GP Info: +- GP English name: *Audit Kernel Object* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditOtherObjectAccessEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: +- Job created. +- Job deleted. +- Job enabled. +- Job disabled. +- Job updated. + +For COM+ objects, the following are audited: +- Catalog object added. +- Catalog object updated. +- Catalog object deleted. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Object Access Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditRegistry** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +> [!Note] +> You can set a SACL on a registry object using the Permissions dialog box. + +Volume: Depends on how registry SACLs are configured. + + +GP Info: +- GP English name: *Audit Registry* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditRemovableStorage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + +GP Info: +- GP English name: *Audit Removable Storage* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/ObjectAccess_AuditSAM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: +- SAM_ALIAS -- A local group. +- SAM_GROUP -- A group that is not a local group. +- SAM_USER – A user account. +- SAM_DOMAIN – A domain. +- SAM_SERVER – A computer account. + +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. + +> [!Note] +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. + +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). + + + +GP Info: +- GP English name: *Audit SAM* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/PolicyChange_AuditAuthenticationPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +- Creation of forest and domain trusts. +- Modification of forest and domain trusts. +- Removal of forest and domain trusts. +- Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. +- Granting of any of the following user rights to a user or group: + - Access This Computer From the Network. + - Allow Logon Locally. + - Allow Logon Through Terminal Services. + - Logon as a Batch Job. + - Logon a Service. +- Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +> [!Note] +> The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authentication Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/PolicyChange_AuditAuthorizationPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +- Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Changes in the Encrypted File System (EFS) policy. +- Changes to the Resource attributes of an object. +- Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authorization Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/PolicyChange_AuditFilteringPlatformPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +- IPsec services status. +- Changes to IPsec policy settings. +- Changes to Windows Firewall policy settings. +- Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Filtering Platform Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Events include the following: +- Reporting of active policies when Windows Firewall service starts. +- Changes to Windows Firewall rules. +- Changes to Windows Firewall exception list. +- Changes to Windows Firewall settings. +- Rules ignored or not applied by Windows Firewall Service. +- Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + +Volume: Low. + + +GP Info: +- GP English name: *Audit MPSSVC Rule Level Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/PolicyChange_AuditOtherPolicyChangeEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +- Trusted Platform Module (TPM) configuration changes. +- Kernel-mode cryptographic self tests. +- Cryptographic provider operations. +- Cryptographic context operations or modifications. +- Applied Central Access Policies (CAPs) changes. +- Boot Configuration Data (BCD) modifications. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Policy Change Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/PolicyChange_AuditPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes in the security audit policy settings, such as the following: +- Settings permissions and audit settings on the Audit Policy object. +- Changes to the system audit policy. +- Registration of security event sources. +- De-registration of security event sources. +- Changes to the per-user audit settings. +- Changes to the value of CrashOnAuditFail. +- Changes to the system access control list on a file system or registry object. +- Changes to the Special Groups list. + +> [!Note] +> System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: +- Access Credential Manager as a trusted caller. +- Access this computer from the network. +- Add workstations to domain. +- Adjust memory quotas for a process. +- Allow log on locally. +- Allow log on through Terminal Services. +- Bypass traverse checking. +- Change the system time. +- Create a pagefile. +- Create global objects. +- Create permanent shared objects. +- Create symbolic links. +- Deny access this computer from the network. +- Deny log on as a batch job. +- Deny log on as a service. +- Deny log on locally. +- Deny log on through Terminal Services. +- Force shutdown from a remote system. +- Increase a process working set. +- Increase scheduling priority. +- Lock pages in memory. +- Log on as a batch job. +- Log on as a service. +- Modify an object label. +- Perform volume maintenance tasks. +- Profile single process. +- Profile system performance. +- Remove computer from docking station. +- Shut down the system. +- Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + +Volume: Very High. + + +GP Info: +- GP English name: *Audit Non Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Not used. + + + +GP Info: +- GP English name: *Audit Other Privilege Use Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/PrivilegeUse_AuditSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +- A privileged service is called. +- One of the following privileges are called: + - Act as part of the operating system. + - Back up files and directories. + - Create a token object. + - Debug programs. + - Enable computer and user accounts to be trusted for delegation. + - Generate security audits. + - Impersonate a client after authentication. + - Load and unload device drivers. + - Manage auditing and security log. + - Modify firmware environment values. + - Replace a process-level token. + - Restore files and directories. + - Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + +Volume: High. + + +GP Info: +- GP English name: *Audit Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
          + + +**Audit/System_AuditIPsecDriver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +- Startup and shutdown of the IPsec services. +- Network packets dropped due to integrity check failure. +- Network packets dropped due to replay check failure. +- Network packets dropped due to being in plaintext. +- Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. +- Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + +Volume: Low. + + +GP Info: +- GP English name: *Audit IPsec Driver* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/System_AuditOtherSystemEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit any of the following events: +- Startup and shutdown of the Windows Firewall service and driver. +- Security policy processing by the Windows Firewall Service. +- Cryptography key file and migration operations. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other System Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
          + + +**Audit/System_AuditSecurityStateChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +- Startup and shutdown of the computer. +- Change of system time. +- Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security State Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/System_AuditSecuritySystemExtension** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events related to security system extensions or services, such as the following: +- A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. +- A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. + +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + +Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers. + + +GP Info: +- GP English name: *Audit Security System Extension* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
          + + +**Audit/System_AuditSystemIntegrity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +- Events that could not be written to the event log because of a problem with the auditing system. +- A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. +- The detection of a Remote Procedure Call (RPC) that compromises system integrity. +- The detection of a hash value of an executable file that is not valid as determined by Code Integrity. +- Cryptographic operations that compromise system integrity. + +Volume: Low. + + +GP Info: +- GP English name: *Audit System Integrity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 6ce830a730..51f56ffbbb 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Authentication -description: Policy CSP - Authentication +description: The Policy CSP - Authentication setting allows the Azure AD tenant administrators to enable self service password reset feature on the Windows sign in screen. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - Authentication +
          @@ -55,26 +57,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -105,26 +115,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -155,26 +173,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -207,26 +233,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -241,7 +275,7 @@ Preview release in Windows 10, version 1709. Supported in the next release. Spe Value type is integer. -Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs. +Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password every time they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs. @@ -261,26 +295,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -323,26 +365,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -364,7 +414,7 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex Value type is integer. Supported values: - 0 - (default) The feature defaults to the existing SKU and device capabilities. -- 1 - Enabled. Auto connect new non-admin AZure AD accounts to pre-configured candidate local accounts +- 1 - Enabled. Auto connect new non-admin Azure AD accounts to pre-configured candidate local accounts - 2 - Disabled. Do not auto connect new non-admin Azure AD accounts to pre-configured local accounts @@ -387,26 +437,34 @@ Value type is integer. Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -451,26 +509,34 @@ Value type is integer. Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -499,37 +565,18 @@ Value type is string. - - - - -## Authentication policies supported by HoloLens 2 - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](#authentication-preferredaadtenantdomainname) - - - -## Authentication policies supported by HoloLens (1st gen) Commercial Suite - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](#authentication-preferredaadtenantdomainname) - - - -## Authentication policies supported by HoloLens (1st gen) Development Edition - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) - - - -
          +
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 0845e952f8..15b769497e 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Autoplay -description: Policy CSP - Autoplay +description: Learn how the Policy CSP - Autoplay setting disallows AutoPlay for MTP devices like cameras or phones. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -41,26 +42,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -104,26 +113,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -176,26 +193,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -242,12 +267,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 85d8f6acdc..2f4c7acf11 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Bitlocker -description: Policy CSP - Bitlocker +description: Use the Policy configuration service provider (CSP) - Bitlocker to manage encryption of PCs and devices. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/22/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -15,6 +16,9 @@ manager: dansimp +> [!NOTE] +> To manage encryption of PCs and devices, use [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). +
          @@ -35,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -68,7 +80,7 @@ manager: dansimp Specifies the BitLocker Drive Encryption method and cipher strength. > [!NOTE] -> XTS-AES 128-bit and XTS-AES 256-bit values are only supported on Windows 10 for desktop. +> XTS-AES 128-bit and XTS-AES 256-bit values are supported only on Windows 10 for desktop. @@ -83,17 +95,16 @@ The following list shows the supported values:
          -> [!NOTE] -> To manage encryption of PCs and devices, use [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) +Footnotes: -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index 32fe01163f..2bcc10ea45 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -1,28 +1,26 @@ --- title: Policy CSP - BITS -description: Policy CSP - BITS +description: Use StartTime, EndTime and Transfer rate together to define the BITS bandwidth-throttling schedule and transfer rate. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/29/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - BITS -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The following bandwidth policies are used together to define the bandwidth-throttling schedule and transfer rate. - BITS/BandwidthThrottlingEndTime - BITS/BandwidthThrottlingStartTime - BITS/BandwidthThrottlingTransferRate -If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT defined, but BITS/BandwidthThrottlingTransferRate IS defined, then default values will be used for StartTime and EndTime (8am and 5pm respectively). The time policies are based on the 24-hour clock. +If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT defined, but BITS/BandwidthThrottlingTransferRate IS defined, then default values will be used for StartTime and EndTime (8 AM and 5 PM respectively). The time policies are based on the 24-hour clock.
          @@ -59,26 +57,34 @@ If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -91,7 +97,7 @@ If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT This policy specifies the bandwidth throttling **end time** that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. -Value type is integer. Default value is 17 (5 pm). +Value type is integer. Default value is 17 (5 PM). Supported value range: 0 - 23 @@ -101,7 +107,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -134,26 +140,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -176,7 +190,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -209,26 +223,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -251,7 +273,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -284,26 +306,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -354,26 +384,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -424,26 +462,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -494,14 +540,16 @@ Supported values range: 0 - 999
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 2475975ca6..6426fba5e8 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -1,20 +1,19 @@ --- title: Policy CSP - Bluetooth -description: Policy CSP - Bluetooth +description: Learn how the Policy CSP - Bluetooth setting specifies whether the device can send out Bluetooth advertisements. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 02/12/2020 ms.reviewer: manager: dansimp --- # Policy CSP - Bluetooth - -
          @@ -39,6 +38,9 @@ manager: dansimp
          Bluetooth/ServicesAllowedList
          +
          + Bluetooth/SetMinimumEncryptionKeySize +
          @@ -50,26 +52,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -104,26 +114,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -158,26 +176,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -208,26 +234,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -258,26 +292,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -305,26 +347,34 @@ If this policy is not set or it is deleted, the default local radio name is used - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -342,33 +392,85 @@ The default value is an empty string. For more information, see [ServicesAllowed +
          + + +**Bluetooth/SetMinimumEncryptionKeySize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark8
          Businesscheck mark8
          Enterprisecheck mark8
          Educationcheck mark8
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 2004. There are multiple levels of encryption strength when pairing Bluetooth devices. This policy helps prevent weaker devices cryptographically being used in high security environments. + + + +The following list shows the supported values: +- 0 (default) - All Bluetooth traffic is allowed. +- N - A number from 1 through 16 representing the bytes that must be used in the encryption process. Currently, 16 is the largest allowed value for N and 16 bytes is the largest key size that Bluetooth supports. If you want to enforce Windows to always use Bluetooth encryption, ignoring the precise encryption key strength, use 1 as the value for N. + +For more information on allowed key sizes, refer to Bluetooth Core Specification v5.1. + + + + + + + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## Bluetooth policies supported by HoloLens 2 - -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) - - - -## Bluetooth policies supported by HoloLens (1st gen) Commercial Suite - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) - - - -## Bluetooth policies supported by HoloLens (1st gen) Development Edition - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) - - -
          - +
          ## ServicesAllowedList usage guide @@ -483,12 +585,3 @@ Disabling file transfer shall have the following effects - Fsquirt shall display error message informing user of policy preventing file transfer - 3rd-party apps shall not be permitted to send or receive files using MSFT Bluetooth API -
          -Footnotes: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 6553368bef..d2c9190e0b 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -1,19 +1,21 @@ --- title: Policy CSP - Browser -description: Policy CSP - Browser +description: Learn how to use the Policy CSP - Browser settings so you can configure Microsoft Edge browser, version 45 and earlier. ms.topic: article ms.prod: w10 ms.technology: windows author: dansimp ms.author: dansimp -ms.date: 05/01/2019 +ms.date: 09/27/2019 ms.reviewer: manager: dansimp +ms.localizationpriority: medium --- # Policy CSP - Browser -
          +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). ## Browser policies @@ -25,9 +27,6 @@ manager: dansimp
          Browser/AllowAutofill
          -
          - Browser/AllowBrowser -
          Browser/AllowConfigurationUpdateForBooksLibrary
          @@ -130,9 +129,6 @@ manager: dansimp
          Browser/EnterpriseSiteListServiceUrl
          -
          - Browser/FirstRunURL -
          Browser/HomePages
          @@ -157,7 +153,10 @@ manager: dansimp
          Browser/PreventSmartScreenPromptOverrideForFiles
          -
          +
          + Browser/PreventTurningOffRequiredExtensions +
          +
          Browser/PreventUsingLocalHostIPAddressForWebRTC
          @@ -198,26 +197,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -261,26 +268,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -319,96 +334,47 @@ To verify AllowAutofill is set to 0 (not allowed): 1. Open Microsoft Edge. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Save form entries** is greyed out. +4. Verify the setting **Save form entries** is grayed out.
          - -**Browser/AllowBrowser** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead. - -The device allows Microsoft Edge on Windows 10 Mobile by default. With this policy, you can disable the Microsoft Edge tile, and when clicking the tile, a message opens indicating that the administrator disabled Internet browsing. - - - - - -Supported values: - -- 0 – Prevented/not allowed. -- 1 (default) – Allowed. - -Most restricted value: 0 - - - -
          - **Browser/AllowConfigurationUpdateForBooksLibrary** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -427,10 +393,10 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow configuration updates for the Books Library* -- GP name: *AllowConfigurationUpdateForBooksLibrary* -- GP path: *Windows Components/Microsoft Edge* -- GP ADMX file name: *MicrosoftEdge.admx* +- GP English name: *Allow configuration updates for the Books Library* +- GP name: *AllowConfigurationUpdateForBooksLibrary* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* @@ -450,26 +416,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -521,26 +495,34 @@ To verify AllowCookies is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -584,26 +566,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -641,7 +631,7 @@ To verify AllowDoNotTrack is set to 0 (not allowed): 1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Send Do Not Track requests** is greyed out. +4. Verify the setting **Send Do Not Track requests** is grayed out. @@ -654,26 +644,34 @@ To verify AllowDoNotTrack is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -715,26 +713,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -776,26 +782,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -840,26 +854,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -909,26 +931,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -970,26 +1000,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1035,26 +1073,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1105,26 +1151,34 @@ To verify AllowPasswordManager is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1175,26 +1229,34 @@ To verify AllowPopups is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1245,26 +1307,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1314,26 +1384,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1383,26 +1461,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1450,26 +1536,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1512,26 +1606,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1581,26 +1683,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1637,7 +1747,7 @@ Most restricted value: 1 To verify AllowSmartScreen is set to 0 (not allowed): 1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. -2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled. +2. Verify that the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled. @@ -1650,26 +1760,34 @@ To verify AllowSmartScreen is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1718,26 +1836,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1786,26 +1912,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1850,26 +1984,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1922,26 +2064,34 @@ To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1975,7 +2125,7 @@ ADMX Info: Supported values: - 0 (default) – Prevented/not allowed. Microsoft Edge uses the search engine specified in App settings.

          If you enabled this policy and now want to disable it, disabling removes all previously configured search engines. -- 1 – Allowed. Add up to five additional search engines and set any one of them as the default.

          For each search engine added you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/). +- 1 – Allowed. Add up to five additional search engines and set any one of them as the default.

          For each search engine added you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery). Most restricted value: 0 @@ -1989,26 +2139,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +


          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2058,26 +2216,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2131,26 +2297,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2207,26 +2381,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2278,26 +2460,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2359,26 +2549,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2429,26 +2627,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2470,8 +2676,6 @@ Most restricted value: 0 > [!IMPORTANT] > This setting can be used only with domain-joined or MDM-enrolled devices. For more information, see the [Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy). -Most restricted value: 0 - ADMX Info: @@ -2484,8 +2688,8 @@ ADMX Info: Supported values: -- 0 – Lock down Start pages configured in either the ConfigureOpenEdgeWith policy and HomePages policy. -- 1 (default) – Unlocked. Users can make changes to all configured start pages.

          When you enable this policy and define a set of URLs in the HomePages policy, Microsoft Edge uses the URLs defined in the ConfigureOpenEdgeWith policy. +- 0 (default) – Lock down Start pages configured in either the ConfigureOpenEdgeWith policy and HomePages policy. +- 1 – Unlocked. Users can make changes to all configured start pages.

          When you enable this policy and define a set of URLs in the HomePages policy, Microsoft Edge uses the URLs defined in the ConfigureOpenEdgeWith policy. Most restricted value: 0 @@ -2499,26 +2703,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +


          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2560,26 +2772,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2627,26 +2847,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2666,79 +2894,40 @@ Supported values:
          - -**Browser/FirstRunURL** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Enter a URL in string format for the site you want to load when Microsoft Edge for Windows 10 Mobile opens for the first time, for example, contoso.com. - - - - -
          - **Browser/HomePages** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2796,26 +2985,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2859,26 +3056,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2920,26 +3125,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2987,26 +3200,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3049,26 +3270,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3111,26 +3340,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3171,26 +3408,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3232,26 +3477,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3299,26 +3552,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3362,26 +3623,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3422,7 +3691,6 @@ ADMX Info: - GP ADMX file name: *MicrosoftEdge.admx* -
          @@ -3433,26 +3701,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3499,26 +3775,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3553,7 +3837,7 @@ ADMX Info: Supported values: -- Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [AllowSearchEngineCustomization](https://review.docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser?branch=microsoft-edge-preview#browser-allowsearchenginecustomization) policy, users cannot make changes. +- Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [AllowSearchEngineCustomization](#browser-allowsearchenginecustomization) policy, users cannot make changes. - 0 - Microsoft Edge removes the policy-set search engine and uses the Microsoft Edge specified engine for the market. - 1 - Microsoft Edge uses the policy-set search engine specified in the OpenSearch XML file. Users cannot change the default search engine.

          Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.

          If you want users to use the default Microsoft Edge settings for each market, set the string to **EDGEDEFAULT**.

          If you want users to use Microsoft Bing as the default search engine, then set the string to **EDGEBING**. @@ -3569,26 +3853,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +


          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3636,26 +3928,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3702,26 +4002,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3767,26 +4075,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3842,26 +4158,34 @@ To verify that favorites are in synchronized between Internet Explorer and Micro - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3909,26 +4233,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3961,51 +4293,17 @@ Supported values: Most restricted value: 0 - - - - -## Browser policies supported by HoloLens 2 - -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) - - - -## Browser policies supported by HoloLens (1st gen) Commercial Suite - -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) - - - -## Browser policies supported by HoloLens (1st gen) Development Edition - -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 0852d91632..93e5c5d6cf 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Camera -description: Policy CSP - Camera +description: Learn how to use the Policy CSP - Camera setting so that you can configure it to disable or enable the camera. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -88,30 +97,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## Camera policies that can be set using Exchange Active Sync (EAS) - -- [Camera/AllowCamera](#camera-allowcamera) - - - -## Camera policies supported by IoT Core - -- [Camera/AllowCamera](#camera-allowcamera) - - - -## Camera policies supported by Microsoft Surface Hub - -- [Camera/AllowCamera](#camera-allowcamera) - - diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index ff738aa2e1..ccd0ab26c1 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Cellular -description: Policy CSP - Cellular +description: Learn how to use the Policy CSP - Cellular setting so you can specify whether Windows apps can access cellular data. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/08/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -47,26 +48,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -119,26 +128,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -171,26 +188,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -223,26 +248,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -275,26 +308,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -329,30 +370,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## Cellular policies that can be set using Exchange Active Sync (EAS) - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - - -## Cellular policies supported by IoT Core - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - - -## Cellular policies supported by Microsoft Surface Hub - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index d86d214339..503ee130bc 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Connectivity -description: Policy CSP - Connectivity +description: Learn how to use the Policy CSP - Connectivity setting to allow the user to enable Bluetooth or restrict access. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -33,9 +34,6 @@ manager: dansimp
          Connectivity/AllowConnectedDevices
          -
          - Connectivity/AllowNFC -
          Connectivity/AllowPhonePCLinking
          @@ -77,26 +75,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -120,7 +126,7 @@ Most restricted value is 0. The following list shows the supported values: -- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be greyed out and the user will not be able to turn Bluetooth on. +- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be grayed out and the user will not be able to turn Bluetooth on. - 1 – Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. - 2 (default) – Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. @@ -135,26 +141,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -186,26 +200,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -257,26 +279,34 @@ To validate on mobile devices, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -304,88 +334,40 @@ The following list shows the supported values:
          - -**Connectivity/AllowNFC** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Allows or disallows near field communication (NFC) on the device. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Do not allow NFC capabilities. -- 1 (default) – Allow NFC capabilities. - - - - -
          - **Connectivity/AllowPhonePCLinking** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -418,7 +400,7 @@ This setting supports a range of values between 0 and 1. Validation: -If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be greyed out and clicking it will not launch the window for a user to enter their phone number. +If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be grayed out and clicking it will not launch the window for a user to enter their phone number. Device that has previously opt-in to MMX will also stop showing on the device list. @@ -433,26 +415,34 @@ Device that has previously opt-in to MMX will also stop showing on the device li - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecross mark
          Educationcross mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -464,8 +454,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li > [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - +> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging. @@ -491,26 +480,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -543,26 +540,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -595,26 +600,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -663,26 +676,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -729,26 +750,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -795,26 +824,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -848,26 +885,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -908,26 +953,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -942,7 +995,7 @@ Determines whether a user can install and configure the Network Bridge. Important: This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply. -The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder. +The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segments together. This connection appears in the Network Connections folder. If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. @@ -963,37 +1016,18 @@ ADMX Info: - - - - -## Connectivity policies supported by HoloLens 2 - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) - - - -## Connectivity policies supported by HoloLens (1st gen) Commercial Suite - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) - - - -## Connectivity policies supported by HoloLens (1st gen) Development Edition - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index c9d03ef5de..2cde160250 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -1,12 +1,13 @@ --- title: Policy CSP - ControlPolicyConflict -description: Policy CSP - ControlPolicyConflict +description: Use the Policy CSP - ControlPolicyConflict setting to control which policy is used whenever both the MDM policy and its equivalent Group Policy are set on the device. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - ControlPolicyConflict +
          @@ -34,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -90,8 +100,8 @@ The [Policy DDF](policy-ddf-file.md) contains the following tags to identify the - \ - \ -For the list MDM-GP mapping list, see [Policies supported by GP -](policy-configuration-service-provider.md#policies-supported-by-gp). +For the list MDM-GP mapping list, see [Policies in Policy CSP supported by Group Policy +](policy-csps-supported-by-group-policy.md). The MDM Diagnostic report shows the applied configurations states of a device including policies, certificates, configuration sources, and resource information. The report includes a list of blocked GP settings because MDM equivalent is configured, if any. To get the diagnostic report, go to **Settings** > **Accounts** > **Access work or school** > and then click the desired work or school account. Scroll to the bottom of the page to **Advanced Diagnostic Report** and then click **Create Report**. @@ -106,12 +116,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 1e3b1dd91e..89e4817ce7 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -1,12 +1,13 @@ --- title: Policy CSP - CredentialProviders -description: Policy CSP - CredentialProviders +description: Learn how to use the policy CSP for credential provider so you can control whether a domain user can sign in using a convenience PIN. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -41,26 +42,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -107,26 +116,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -171,26 +188,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -216,19 +241,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## CredentialProviders policies supported by IoT Core - -- [CredentialProviders/AllowPINLogon](#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](#credentialproviders-blockpicturepassword) - - diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 80a987c29b..71447f45ab 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -1,12 +1,13 @@ --- title: Policy CSP - CredentialsDelegation -description: Policy CSP - CredentialsDelegation +description: Learn how to use the Policy CSP - CredentialsDelegation setting so that remote host can allow delegation of non-exportable credentials. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - CredentialsDelegation +
          @@ -34,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -91,12 +101,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 723426a323..5ccf34a12e 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -1,12 +1,13 @@ --- title: Policy CSP - CredentialsUI -description: Policy CSP - CredentialsUI +description: Learn how to use the Policy CSP - CredentialsUI setting to configure the display of the password reveal button in password entry user experiences. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -38,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -105,26 +114,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -160,12 +177,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index 4aaf66a50c..b141d4387b 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Cryptography -description: Policy CSP - Cryptography +description: Learn how to use the Policy CSP - Cryptography setting to allow or disallow the Federal Information Processing Standard (FIPS) policy. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/19/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -27,7 +28,7 @@ manager: dansimp
          Cryptography/TLSCipherSuites
          - +
          @@ -38,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -71,7 +80,6 @@ manager: dansimp Allows or disallows the Federal Information Processing Standard (FIPS) policy. - ADMX Info: - GP English name: *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing* @@ -100,26 +108,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -133,7 +149,6 @@ The following list shows the supported values: Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. - @@ -147,22 +162,18 @@ Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is - - - -## Cryptography policies supported by Microsoft Surface Hub - -- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index cfa533aef2..9da8c6ce2c 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -1,12 +1,13 @@ --- title: Policy CSP - DataProtection -description: Policy CSP - DataProtection +description: Use the Policy CSP - DataProtection setting to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 01/26/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -38,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -90,26 +99,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -133,18 +150,16 @@ Setting used by Windows 8.1 Selective Wipe.
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## DataProtection policies supported by IoT Core - -- [DataProtection/AllowDirectMemoryAccess](#dataprotection-allowdirectmemoryaccess) - - diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 1268e6243c..cb540b3415 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -1,12 +1,13 @@ --- title: Policy CSP - DataUsage -description: Policy CSP - DataUsage +description: Learn how to use the Policy CSP - DataUsage setting to configure the cost of 4G connections on the local machine. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/13/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,11 +36,12 @@ manager: dansimp **DataUsage/SetCost3G** +
          + This policy is deprecated in Windows 10, version 1809. -
          @@ -50,26 +52,34 @@ This policy is deprecated in Windows 10, version 1809. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -111,12 +121,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index f796a9ae53..dcea40a888 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,20 +1,19 @@ --- title: Policy CSP - Defender -description: Policy CSP - Defender +description: Learn how to use the Policy CSP - Defender setting so you can allow or disallow scanning of archives. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 01/26/2019 +ms.localizationpriority: medium +ms.date: 01/08/2020 ms.reviewer: manager: dansimp --- # Policy CSP - Defender -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
          @@ -157,26 +156,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -198,15 +205,15 @@ Allows or disallows scanning of archives. ADMX Info: - GP English name: *Scan archive files* - GP name: *Scan_DisableArchiveScanning* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning on archived files. +- 1 (default) – Allowed. Scans the archive files. @@ -219,26 +226,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -260,15 +275,15 @@ Allows or disallows Windows Defender Behavior Monitoring functionality. ADMX Info: - GP English name: *Turn on behavior monitoring* - GP name: *RealtimeProtection_DisableBehaviorMonitoring* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off behavior monitoring. +- 1 (default) – Allowed. Turns on real-time behavior monitoring. @@ -281,26 +296,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -323,15 +346,15 @@ ADMX Info: - GP English name: *Join Microsoft MAPS* - GP name: *SpynetReporting* - GP element: *SpynetReporting* -- GP path: *Windows Components/Windows Defender Antivirus/MAPS* +- GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off the Microsoft Active Protection Service. +- 1 (default) – Allowed. Turns on the Microsoft Active Protection Service. @@ -344,26 +367,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -385,15 +416,15 @@ Allows or disallows scanning of email. ADMX Info: - GP English name: *Turn on e-mail scanning* - GP name: *Scan_DisableEmailScanning* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 (default) – Not allowed. -- 1 – Allowed. +- 0 (default) – Not allowed. Turns off email scanning. +- 1 – Allowed. Turns on email scanning. @@ -406,26 +437,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -447,15 +486,15 @@ Allows or disallows a full scan of mapped network drives. ADMX Info: - GP English name: *Run full scan on mapped network drives* - GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 (default) – Not allowed. -- 1 – Allowed. +- 0 (default) – Not allowed. Disables scanning on mapped network drives. +- 1 – Allowed. Scans mapped network drives. @@ -468,26 +507,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -502,22 +549,22 @@ The following list shows the supported values: > This policy is only enforced in Windows 10 for desktop. -Allows or disallows a full scan of removable drives. +Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned. ADMX Info: - GP English name: *Scan removable drives* - GP name: *Scan_DisableRemovableDriveScanning* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning on removable drives. +- 1 (default) – Allowed. Scans removable drives. @@ -530,26 +577,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -571,7 +626,7 @@ Allows or disallows Windows Defender IOAVP Protection functionality. ADMX Info: - GP English name: *Scan all downloaded files and attachments* - GP name: *RealtimeProtection_DisableIOAVProtection* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -592,26 +647,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -646,26 +709,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -687,7 +758,7 @@ Allows or disallows Windows Defender On Access Protection functionality. ADMX Info: - GP English name: *Monitor file and program activity on your computer* - GP name: *RealtimeProtection_DisableOnAccessProtection* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -708,26 +779,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -749,15 +828,15 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. ADMX Info: - GP English name: *Turn off real-time protection* - GP name: *DisableRealtimeMonitoring* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off the real-time monitoring service. +- 1 (default) – Allowed. Turns on and runs the real-time monitoring service. @@ -770,26 +849,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -811,15 +898,15 @@ Allows or disallows a scanning of network files. ADMX Info: - GP English name: *Scan network files* - GP name: *Scan_DisableScanningNetworkFiles* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning of network files. +- 1 (default) – Allowed. Scans network files. @@ -832,26 +919,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -886,26 +981,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -927,15 +1030,15 @@ Allows or disallows user access to the Windows Defender UI. If disallowed, all W ADMX Info: - GP English name: *Enable headless UI mode* - GP name: *UX_Configuration_UILockdown* -- GP path: *Windows Components/Windows Defender Antivirus/Client Interface* +- GP path: *Windows Components/Microsoft Defender Antivirus/Client Interface* - GP ADMX file name: *WindowsDefender.admx* The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Prevents users from accessing UI. +- 1 (default) – Allowed. Lets users access UI. @@ -948,26 +1051,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -992,7 +1103,7 @@ ADMX Info: - GP English name: *Exclude files and paths from Attack Surface Reduction Rules* - GP name: *ExploitGuard_ASR_ASROnlyExclusions* - GP element: *ExploitGuard_ASR_ASROnlyExclusions* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* - GP ADMX file name: *WindowsDefender.admx* @@ -1006,26 +1117,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1052,7 +1171,7 @@ ADMX Info: - GP English name: *Configure Attack Surface Reduction rules* - GP name: *ExploitGuard_ASR_Rules* - GP element: *ExploitGuard_ASR_Rules* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* - GP ADMX file name: *WindowsDefender.admx* @@ -1066,26 +1185,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1111,7 +1238,7 @@ ADMX Info: - GP English name: *Specify the maximum percentage of CPU utilization during a scan* - GP name: *Scan_AvgCPULoadFactor* - GP element: *Scan_AvgCPULoadFactor* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1129,26 +1256,34 @@ Valid values: 0–100 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1158,7 +1293,6 @@ Valid values: 0–100
          - This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. @@ -1181,7 +1315,7 @@ ADMX Info: - GP English name: *Check for the latest virus and spyware definitions before running a scheduled scan* - GP name: *CheckForSignaturesBeforeRunningScan* - GP element: *CheckForSignaturesBeforeRunningScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1204,26 +1338,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1238,11 +1380,11 @@ ADMX Info: > This policy is only enforced in Windows 10 for desktop. -Added in Windows 10, version 1709. This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. +Added in Windows 10, version 1709. This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. -If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. +If this setting is on, Microsoft Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. -For more information about specific values that are supported, see the Windows Defender Antivirus documentation site. +For more information about specific values that are supported, see the Microsoft Defender Antivirus documentation site. > [!NOTE] > This feature requires the "Join Microsoft MAPS" setting enabled in order to function. @@ -1253,7 +1395,7 @@ ADMX Info: - GP English name: *Select cloud protection level* - GP name: *MpEngine_MpCloudBlockLevel* - GP element: *MpCloudBlockLevel* -- GP path: *Windows Components/Windows Defender Antivirus/MpEngine* +- GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* - GP ADMX file name: *WindowsDefender.admx* @@ -1276,26 +1418,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1309,7 +1459,7 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -Added in Windows 10, version 1709. This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. +Added in Windows 10, version 1709. This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. @@ -1324,7 +1474,7 @@ ADMX Info: - GP English name: *Configure extended cloud check* - GP name: *MpEngine_MpBafsExtendedTimeout* - GP element: *MpBafsExtendedTimeout* -- GP path: *Windows Components/Windows Defender Antivirus/MpEngine* +- GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* - GP ADMX file name: *WindowsDefender.admx* @@ -1338,26 +1488,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1371,7 +1529,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersAllowedApplications and changed to ControlledFolderAccessAllowedApplications. -Added in Windows 10, version 1709. This policy setting allows user-specified applications to the controlled folder access feature. Adding an allowed application means the controlled folder access feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Windows Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator. +Added in Windows 10, version 1709. This policy setting allows user-specified applications to the controlled folder access feature. Adding an allowed application means the controlled folder access feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Microsoft Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator. @@ -1379,7 +1537,7 @@ ADMX Info: - GP English name: *Configure allowed applications* - GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* - GP element: *ExploitGuard_ControlledFolderAccess_AllowedApplications* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* - GP ADMX file name: *WindowsDefender.admx* @@ -1393,26 +1551,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1434,7 +1600,7 @@ ADMX Info: - GP English name: *Configure protected folders* - GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* - GP element: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* - GP ADMX file name: *WindowsDefender.admx* @@ -1448,26 +1614,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1493,7 +1667,7 @@ ADMX Info: - GP English name: *Configure removal of items from Quarantine folder* - GP name: *Quarantine_PurgeItemsAfterDelay* - GP element: *Quarantine_PurgeItemsAfterDelay* -- GP path: *Windows Components/Windows Defender Antivirus/Quarantine* +- GP path: *Windows Components/Microsoft Defender Antivirus/Quarantine* - GP ADMX file name: *WindowsDefender.admx* @@ -1511,26 +1685,34 @@ Valid values: 0–90 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1543,14 +1725,14 @@ Valid values: 0–90 This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. -If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. +If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned off. Supported values: -- 0 - Disabled -- 1 - Enabled (default) +- 1 - Disabled (default) +- 0 - Enabled OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan @@ -1560,7 +1742,7 @@ ADMX Info: - GP English name: *Turn on catch-up full scan* - GP name: *Scan_DisableCatchupFullScan* - GP element: *Scan_DisableCatchupFullScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1583,26 +1765,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1621,8 +1811,8 @@ If you disable or do not configure this setting, catch-up scans for scheduled qu Supported values: -- 0 - Disabled -- 1 - Enabled (default) +- 1 - Disabled (default) +- 0 - Enabled OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan @@ -1632,7 +1822,7 @@ ADMX Info: - GP English name: *Turn on catch-up quick scan* - GP name: *Scan_DisableCatchupQuickScan* - GP element: *Scan_DisableCatchupQuickScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1655,26 +1845,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1696,7 +1894,7 @@ ADMX Info: - GP English name: *Configure Controlled folder access* - GP name: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* - GP element: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* - GP ADMX file name: *WindowsDefender.admx* @@ -1718,26 +1916,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1765,7 +1971,7 @@ ADMX Info: - GP English name: *Configure low CPU priority for scheduled scans* - GP name: *Scan_LowCpuPriority* - GP element: *Scan_LowCpuPriority* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1788,26 +1994,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1821,7 +2035,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off in Windows Defender Exploit Guard. Network protection is a feature of Windows Defender Exploit Guard that protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. +Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit. If you enable this policy with the ""Block"" option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. @@ -1835,7 +2049,7 @@ ADMX Info: - GP English name: *Prevent users and apps from accessing dangerous websites* - GP name: *ExploitGuard_EnableNetworkProtection* - GP element: *ExploitGuard_EnableNetworkProtection* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Network Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Network Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -1857,26 +2071,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1899,7 +2121,7 @@ ADMX Info: - GP English name: *Path Exclusions* - GP name: *Exclusions_Paths* - GP element: *Exclusions_PathsList* -- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* - GP ADMX file name: *WindowsDefender.admx* @@ -1913,26 +2135,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1955,7 +2185,7 @@ ADMX Info: - GP English name: *Extension Exclusions* - GP name: *Exclusions_Extensions* - GP element: *Exclusions_ExtensionsList* -- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* - GP ADMX file name: *WindowsDefender.admx* @@ -1969,26 +2199,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2017,7 +2255,7 @@ ADMX Info: - GP English name: *Process Exclusions* - GP name: *Exclusions_Processes* - GP element: *Exclusions_ProcessesList* -- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* - GP ADMX file name: *WindowsDefender.admx* @@ -2031,26 +2269,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2067,6 +2313,9 @@ ADMX Info: Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer. +> [!NOTE] +> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices. For more information about PUA, see [Detect and block potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). + The following list shows the supported values: @@ -2086,26 +2335,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2131,7 +2388,7 @@ ADMX Info: - GP English name: *Configure monitoring for incoming and outgoing file and program activity* - GP name: *RealtimeProtection_RealtimeScanDirection* - GP element: *RealtimeProtection_RealtimeScanDirection* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2153,26 +2410,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2195,7 +2460,7 @@ ADMX Info: - GP English name: *Specify the scan type to use for a scheduled scan* - GP name: *Scan_ScanParameters* - GP element: *Scan_ScanParameters* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2216,26 +2481,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2267,7 +2540,7 @@ ADMX Info: - GP English name: *Specify the time for a daily quick scan* - GP name: *Scan_ScheduleQuickScantime* - GP element: *Scan_ScheduleQuickScantime* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2285,26 +2558,34 @@ Valid values: 0–1380 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2330,22 +2611,22 @@ ADMX Info: - GP English name: *Specify the day of the week to run a scheduled scan* - GP name: *Scan_ScheduleDay* - GP element: *Scan_ScheduleDay* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* -The following list shows the supported values: +The following list shows the supported values: -- 0 (default) – Every day -- 1 – Monday -- 2 – Tuesday -- 3 – Wednesday -- 4 – Thursday -- 5 – Friday -- 6 – Saturday -- 7 – Sunday -- 8 – No scheduled scan +- 0 (default) – Every day +- 1 – Sunday +- 2 – Monday +- 3 – Tuesday +- 4 – Wednesday +- 5 – Thursday +- 6 – Friday +- 7 – Saturday +- 8 – No scheduled scan @@ -2358,26 +2639,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2409,7 +2698,7 @@ ADMX Info: - GP English name: *Specify the time of day to run a scheduled scan* - GP name: *Scan_ScheduleTime* - GP element: *Scan_ScheduleTime* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2427,26 +2716,34 @@ Valid values: 0–1380. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2480,7 +2777,7 @@ ADMX Info: - GP English name: *Define the order of sources for downloading definition updates* - GP name: *SignatureUpdate_FallbackOrder* - GP element: *SignatureUpdate_FallbackOrder* -- GP path: *Windows Components/Windows Defender Antivirus/Signature Updates* +- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* - GP ADMX file name: *WindowsDefender.admx* @@ -2503,26 +2800,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2551,7 +2856,7 @@ ADMX Info: - GP English name: *Define file shares for downloading definition updates* - GP name: *SignatureUpdate_DefinitionUpdateFileSharesSources* - GP element: *SignatureUpdate_DefinitionUpdateFileSharesSources* -- GP path: *Windows Components/Windows Defender Antivirus/Signature Updates* +- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* - GP ADMX file name: *WindowsDefender.admx* @@ -2574,26 +2879,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2623,7 +2936,7 @@ ADMX Info: - GP English name: *Specify the interval to check for definition updates* - GP name: *SignatureUpdate_SignatureUpdateInterval* - GP element: *SignatureUpdate_SignatureUpdateInterval* -- GP path: *Windows Components/Windows Defender Antivirus/Signature Updates* +- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* - GP ADMX file name: *WindowsDefender.admx* @@ -2641,26 +2954,34 @@ Valid values: 0–24. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2683,7 +3004,7 @@ ADMX Info: - GP English name: *Send file samples when further analysis is required* - GP name: *SubmitSamplesConsent* - GP element: *SubmitSamplesConsent* -- GP path: *Windows Components/Windows Defender Antivirus/MAPS* +- GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* - GP ADMX file name: *WindowsDefender.admx* @@ -2706,26 +3027,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2742,7 +3071,7 @@ The following list shows the supported values: Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take. -This value is a list of threat severity level IDs and corresponding actions, separated by a| using the format "*threat level*=*action*|*threat level*=*action*". For example "1=6|2=2|4=10|5=3 +This value is a list of threat severity level IDs and corresponding actions, separated by a | using the format "*threat level*=*action*|*threat level*=*action*". For example, "1=6|2=2|4=10|5=3". The following list shows the supported values for threat severity levels: @@ -2753,12 +3082,12 @@ The following list shows the supported values for threat severity levels: The following list shows the supported values for possible actions: -- 1 – Clean -- 2 – Quarantine -- 3 – Remove -- 6 – Allow -- 8 – User defined -- 10 – Block +- 1 – Clean. Service tries to recover files and try to disinfect. +- 2 – Quarantine. Moves files to quarantine. +- 3 – Remove. Removes files from system. +- 6 – Allow. Allows file/does none of the above actions. +- 8 – User defined. Requires user to make a decision on which action to take. +- 10 – Block. Blocks file execution. @@ -2766,53 +3095,23 @@ ADMX Info: - GP English name: *Specify threat alert levels at which default action should not be taken when detected* - GP name: *Threats_ThreatSeverityDefaultAction* - GP element: *Threats_ThreatSeverityDefaultActionList* -- GP path: *Windows Components/Windows Defender Antivirus/Threats* +- GP path: *Windows Components/Microsoft Defender Antivirus/Threats* - GP ADMX file name: *WindowsDefender.admx*
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## Defender policies supported by Microsoft Surface Hub - -- [Defender/AllowArchiveScanning](#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](#defender-allowioavprotection) -- [Defender/AllowIntrusionPreventionSystem](#defender-allowintrusionpreventionsystem) -- [Defender/AllowOnAccessProtection](#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](#defender-allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](#defender-allowscriptscanning) -- [Defender/AllowUserUIAccess](#defender-allowuseruiaccess) -- [Defender/AvgCPULoadFactor](#defender-avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](#defender-daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](#defender-excludedextensions) -- [Defender/ExcludedPaths](#defender-excludedpaths) -- [Defender/ExcludedProcesses](#defender-excludedprocesses) -- [Defender/PUAProtection](#defender-puaprotection) -- [Defender/RealTimeScanDirection](#defender-realtimescandirection) -- [Defender/ScanParameter](#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](#defender-schedulescanday) -- [Defender/ScheduleScanTime](#defender-schedulescantime) -- [Defender/SignatureUpdateInterval](#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](#defender-threatseveritydefaultaction) - - diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 66ac43c7f6..1031aada9c 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1,12 +1,13 @@ --- title: Policy CSP - DeliveryOptimization -description: Policy CSP - DeliveryOptimization +description: Learn how to use the Policy CSP - DeliveryOptimization setting to configure one or more Microsoft Connected Cache servers to be used by Delivery Optimization. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 06/09/2020 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - DeliveryOptimization +
          @@ -30,10 +32,10 @@ manager: dansimp DeliveryOptimization/DOCacheHost
          - DeliveryOptimization/DODelayBackgroundDownloadFromHttp + DeliveryOptimization/DOCacheHostSource
          - DeliveryOptimization/DODelayForegroundDownloadFromHttp + DeliveryOptimization/DODelayBackgroundDownloadFromHttp
          DeliveryOptimization/DODelayCacheServerFallbackBackground @@ -41,6 +43,9 @@ manager: dansimp
          DeliveryOptimization/DODelayCacheServerFallbackForeground
          +
          + DeliveryOptimization/DODelayForegroundDownloadFromHttp +
          DeliveryOptimization/DODownloadMode
          @@ -50,6 +55,9 @@ manager: dansimp
          DeliveryOptimization/DOGroupIdSource
          +
          + DeliveryOptimization/DOMaxBackgroundDownloadBandwidth +
          DeliveryOptimization/DOMaxCacheAge
          @@ -59,6 +67,9 @@ manager: dansimp
          DeliveryOptimization/DOMaxDownloadBandwidth
          +
          + DeliveryOptimization/DOMaxForegroundDownloadBandwidth +
          DeliveryOptimization/DOMaxUploadBandwidth
          @@ -112,26 +123,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -170,26 +189,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -233,26 +260,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -263,12 +298,15 @@ The following list shows the supported values: -[Reserved for future use] + +This policy allows you to configure one or more Microsoft Connected Cache servers to be used by Delivery Optimization. + +One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas. ADMX Info: -- GP English name: *[Reserved for future use] Cache Server Hostname* +- GP English name: *Cache Server Hostname* - GP name: *CacheHost* - GP element: *CacheHost* - GP path: *Windows Components/Delivery Optimization* @@ -288,32 +326,120 @@ ADMX Info:
          + +**DeliveryOptimization/DOCacheHostSource** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark8
          Businesscheck mark8
          Enterprisecheck mark8
          Educationcheck mark8
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + + +This policy allows you to configure one or more Delivery Optimization in Network Cache servers through a custom DHCP Option. One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas. + + + +ADMX Info: +- GP English name: *Cache Server Hostname Source* +- GP name: *CacheHostSource* +- GP element: *CacheHostSource* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + +The following are the supported values: +- 1 = DHCP Option ID. +- 2 = DHCP Option ID Force. + +When DHCP Option ID (1) is set, the client will query DHCP Option ID 235 and use the returned FQDN or IP value as Cache Server Hostname value. This policy will be overridden when the [Cache Server Hostname](#deliveryoptimization-docachehost) policy has been set. + +When DHCP Option ID Force (2) is set, the client will query DHCP Option ID 235 and use the returned FQDN or IP value as Cache Server Hostname value, and will override the Cache Server Hostname policy if it has been set. + +> [!Note] +> If the DHCP Option ID is formatted incorrectly, the client will fall back to the [Cache Server Hostname](#deliveryoptimization-docachehost) policy value if that value has been set. + + + + + + + + + + +
          + **DeliveryOptimization/DODelayBackgroundDownloadFromHttp** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -342,32 +468,184 @@ ADMX Info:
          + +**DeliveryOptimization/DODelayCacheServerFallbackBackground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for a background content download. + +> [!NOTE] +> The [DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. + + + +ADMX Info: +- GP English name: *Delay Background download Cache Server fallback (in seconds)* +- GP name: *DelayCacheServerFallbackBackground* +- GP element: *DelayCacheServerFallbackBackground* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + +This policy is specified in seconds. +Supported values: 0 - one month (in seconds) + + + + + + + + + +
          + + +**DeliveryOptimization/DODelayCacheServerFallbackForeground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for foreground content download. + +> [!NOTE] +> The [DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. + + + +ADMX Info: +- GP English name: *Delay Foreground download Cache Server fallback (in seconds)* +- GP name: *DelayCacheServerFallbackForeground* +- GP element: *DelayCacheServerFallbackForeground* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + +This policy is specified in seconds. +Supported values: 0 - one month (in seconds) + + + + + + + +
          + **DeliveryOptimization/DODelayForegroundDownloadFromHttp** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -408,170 +686,40 @@ The following list shows the supported values as number of seconds:
          - -**DeliveryOptimization/DODelayCacheServerFallbackBackground** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark6check mark6check mark6check mark6
          - - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - - -Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for a background content download. - -> [!NOTE] -> The [DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. - - - - -ADMX Info: -- GP English name: *Delay Background download Cache Server fallback (in seconds)* -- GP name: *DelayCacheServerFallbackBackground* -- GP element: *DelayCacheServerFallbackBackground* -- GP path: *Windows Components/Delivery Optimization* -- GP ADMX file name: *DeliveryOptimization.admx* - - - - -This policy is specified in seconds. -Supported values: 0 - one month (in seconds) - - - - - - - - - - -
          - - - -**DeliveryOptimization/DODelayCacheServerFallbackForeground** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark6check mark6check mark6check mark6
          - - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - - -Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for foreground content download. - -> [!NOTE] -> The [DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. - - - - -ADMX Info: -- GP English name: *Delay Foreground download Cache Server fallback (in seconds)* -- GP name: *DelayCacheServerFallbackForeground* -- GP element: *DelayCacheServerFallbackForeground* -- GP path: *Windows Components/Delivery Optimization* -- GP ADMX file name: *DeliveryOptimization.admx* - - - -This policy is specified in seconds. -Supported values: 0 - one month (in seconds) - - - - - - - - -
          - **DeliveryOptimization/DODownloadMode** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -606,8 +754,7 @@ The following list shows the supported values: - 2 – HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if it exists) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. - 3 – HTTP blended with Internet peering. - 99 - Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services. Added in Windows 10, version 1607. -- 100 - Bypass mode. Do not use Delivery Optimization and use BITS instead. Added in Windows 10, version 1607. - +- 100 - Bypass mode. Do not use Delivery Optimization and use BITS instead. Added in Windows 10, version 1607. Note that this value is deprecated and will be removed in a future release. @@ -619,26 +766,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -678,26 +833,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -708,7 +871,7 @@ ADMX Info: -Added in Windows 10, version 1803. Set this policy to restrict peer selection to a specific source. Options available are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix +Added in Windows 10, version 1803. Set this policy to restrict peer selection to a specific source. Available options are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix, 5 = AAD. When set, the Group ID will be assigned automatically from the selected source. @@ -718,6 +881,8 @@ The options set in this policy only apply to Group (2) download mode. If Group ( For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. +Starting with Windows 10, version 1903, you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this, set the value of DOGroupIdSource to 5. + ADMX Info: @@ -735,38 +900,109 @@ The following list shows the supported values: - 2 - Authenticated domain SID - 3 - DHCP user option - 4 - DNS suffix +- 5 - AAD
          + +**DeliveryOptimization/DOMaxBackgroundDownloadBandwidth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark8
          Businesscheck mark8
          Enterprisecheck mark8
          Educationcheck mark8
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +This policy specifies the maximum background download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. + +The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. + + + +ADMX Info: +- GP English name: *Maximum Background Download Bandwidth (in KB/s)* +- GP name: *MaxBackgroundDownloadBandwidth* +- GP element: *MaxBackgroundDownloadBandwidth* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + + +
          + **DeliveryOptimization/DOMaxCacheAge** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -805,26 +1041,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -860,29 +1104,60 @@ ADMX Info: **DeliveryOptimization/DOMaxDownloadBandwidth** + + + + +
          + + +
          + + + +This policy is deprecated. Use [DOMaxForegroundDownloadBandwidth](#deliveryoptimization-domaxforegrounddownloadbandwidth) and [DOMaxBackgroundDownloadBandwidth](#deliveryoptimization-domaxbackgrounddownloadbandwidth) policies instead. + + + + + + +
          + + +**DeliveryOptimization/DOMaxForegroundDownloadBandwidth** + - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark8
          Businesscheck mark8
          Enterprisecheck mark8
          Educationcheck mark8
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -893,20 +1168,16 @@ ADMX Info: -> [!NOTE] -> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. - - -Added in Windows 10, version 1607. Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. +This policy specifies the maximum foreground download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ADMX Info: -- GP English name: *Maximum Download Bandwidth (in KB/s)* -- GP name: *MaxDownloadBandwidth* -- GP element: *MaxDownloadBandwidth* +- GP English name: *Maximum Foreground Download Bandwidth (in KB/s)* +- GP name: *MaxForegroundDownloadBandwidth* +- GP element: *MaxForegroundDownloadBandwidth* - GP path: *Windows Components/Delivery Optimization* - GP ADMX file name: *DeliveryOptimization.admx* @@ -919,55 +1190,16 @@ ADMX Info: **DeliveryOptimization/DOMaxUploadBandwidth** - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcross markcross mark
          - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          -> [!NOTE] -> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. - -Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization. - -The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). +This policy is deprecated because it only applies to uploads to Internet peers (only allowed when DownloadMode is set to 3) which is not used in commercial deployments. There is no alternate policy to use. -ADMX Info: -- GP English name: *Max Upload Bandwidth (in KB/s)* -- GP name: *MaxUploadBandwidth* -- GP element: *MaxUploadBandwidth* -- GP path: *Windows Components/Delivery Optimization* -- GP ADMX file name: *DeliveryOptimization.admx* - @@ -979,26 +1211,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1037,26 +1277,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1094,26 +1342,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1155,26 +1411,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1213,26 +1477,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1271,26 +1543,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1329,26 +1609,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1389,26 +1677,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1440,15 +1736,8 @@ ADMX Info: **DeliveryOptimization/DOPercentageMaxDownloadBandwidth** - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
          - This policy is deprecated. Use [DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) and [DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) policies instead. @@ -1463,26 +1752,34 @@ This policy is deprecated. Use [DOPercentageMaxForegroundBandwidth](#deliveryopt - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1517,26 +1814,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1578,26 +1883,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1644,26 +1957,34 @@ This policy allows an IT Admin to define the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1701,108 +2022,18 @@ This policy allows an IT Admin to define the following: - - - - - - - - - - - -## DeliveryOptimization policies supported by IoT Core - -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) - - - -## DeliveryOptimization policies supported by IoT Enterprise - -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) - - - - -## DeliveryOptimization policies supported by Microsoft Surface Hub - -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index ebe8a9efb2..dfbed26745 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Desktop -description: Policy CSP - Desktop +description: Learn how to use the Policy CSP - Desktop setting to prevent users from changing the path to their profile folders. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/08/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcross markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -90,18 +99,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## Desktop policies supported by Microsoft Surface Hub - -- [Desktop/PreventUserRedirectionOfProfileFolders](#desktop-preventuserredirectionofprofilefolders) - - diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 44a9b306d9..2eae3ea3be 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,21 +1,19 @@ --- title: Policy CSP - DeviceGuard -description: Policy CSP - DeviceGuard +description: Learn how to use the Policy CSP - DeviceGuard setting to allow the IT admin to configure the launch of System Guard. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/20/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - DeviceGuard -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
          @@ -46,26 +44,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark5check mark5Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -84,7 +90,7 @@ Secure Launch configuration: - 1 - Enables Secure Launch if supported by hardware - 2 - Disables Secure Launch. -For more information about System Guard, see [Introducing Windows Defender System Guard runtime attestation](https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/) and [How hardware-based containers help protect Windows 10](https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows). +For more information about System Guard, see [Introducing Windows Defender System Guard runtime attestation](https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/) and [How a hardware-based root of trust helps protect Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows). @@ -115,26 +121,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark3check mark3cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -173,26 +187,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark3check mark3cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -233,26 +255,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark3check mark3cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -285,14 +315,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index c945a7c66c..60d4832fae 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -1,12 +1,13 @@ --- -title: Policy CSP - TimeLanguageSettings -description: Policy CSP - TimeLanguageSettings +title: Policy CSP - DeviceHealthMonitoring +description: Learn how the Policy CSP - DeviceHealthMonitoring setting is used as an opt-in health monitoring connection between the device and Microsoft. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/14/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - DeviceHealthMonitoring +
          @@ -40,26 +42,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcheck mark6check mark6check mark6Homecross mark
          Procross mark
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -96,26 +106,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcheck mark6check mark6check mark6Homecross mark
          Procross mark
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -151,26 +169,34 @@ IT Pros do not need to set this policy. Instead, Microsoft Intune is expected to - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcheck mark6check mark6check mark6Homecross mark
          Procross mark
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -199,31 +225,16 @@ In most cases, an IT Pro does not need to define this policy. Instead, it is exp
          +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## DeviceHealthMonitoring policies supported by IoT Core - -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) - - - -## DeviceHealthMonitoring policies supported by IoT Enterprise - -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) - - -
          -Footnotes: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 1ff5f4fa3a..24c7b04cbf 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -2,12 +2,14 @@ title: Policy CSP - DeviceInstallation ms.reviewer: manager: dansimp -description: Policy CSP - DeviceInstallation +description: Use the Policy CSP - DeviceInstallation setting to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. ms.author: dansimp +ms.date: 09/27/2019 ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman +ms.localizationpriority: medium --- # Policy CSP - DeviceInstallation @@ -22,6 +24,9 @@ author: manikadhiman
          DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
          +
          + DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs +
          DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
          @@ -34,6 +39,9 @@ author: manikadhiman
          DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
          +
          + DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs +
          DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
          @@ -48,26 +56,34 @@ author: manikadhiman - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -96,8 +112,7 @@ Peripherals can be specified by their [hardware identity](https://docs.microsoft > > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: @@ -111,13 +126,6 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example allows Windows to install compatible devices with a device ID of USB\Composite or USB\Class_FF. To configure multiple classes, use `` as a delimiter. @@ -140,7 +148,7 @@ To enable this policy, use the following SyncML. This example allows Windows to ``` -To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: ```txt >>> [Device Installation Restrictions Policy Check] @@ -148,6 +156,118 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + + + + + +
          + + +**DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, version 1809. This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. + +If you enable this policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. + +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow installation of devices that match any of these device instance IDs* +- GP name: *DeviceInstall_Instance_IDs_Allow* +- GP path: *System/Device Installation/Device Installation Restrictions* +- GP ADMX file name: *deviceinstallation.admx* + + + + + + +To enable this policy, use the following SyncML. + +``` xml + + + + $CmdID$ + + + ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs + + + string + + + + + + +``` +To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +``` txt +>>> [Device Installation Restrictions Policy Check] +>>> Section start 2018/11/15 12:26:41.659 +<<< Section end 2018/11/15 12:26:41.751 +<<< [Exit status: SUCCESS] +``` + + + + +
          @@ -157,26 +277,34 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -203,12 +331,11 @@ Peripherals can be specified by their [hardware identity](https://docs.microsoft > [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: @@ -222,13 +349,6 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example allows Windows to install: - Floppy Disks, ClassGUID = {4d36e980-e325-11ce-bfc1-08002be10318} @@ -257,7 +377,7 @@ Enclose the class GUID within curly brackets {}. To configure multiple classes, ``` -To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: ```txt @@ -266,6 +386,11 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + + + +
          @@ -275,26 +400,34 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -311,8 +444,6 @@ If you enable this policy setting, Windows does not retrieve device metadata for If you disable or do not configure this policy setting, the setting in the Device Installation Settings dialog box controls whether Windows retrieves device metadata from the Internet. - - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -340,8 +471,6 @@ ADMX Info: - -
          @@ -350,26 +479,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -386,7 +523,6 @@ If you enable this policy setting, Windows is prevented from installing or updat If you disable or do not configure this policy setting, Windows is allowed to install or update the device driver for any device that is not described by the "Prevent installation of devices that match any of these device IDs," "Prevent installation of devices for these device classes," or "Prevent installation of removable devices" policy setting. - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -407,13 +543,6 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example prevents Windows from installing devices that are not specifically described by any other policy setting. @@ -448,7 +577,11 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i You can also block installation by using a custom profile in Intune. ![Custom profile](images/custom-profile-prevent-other-devices.png) + + + +
          @@ -458,26 +591,34 @@ You can also block installation by using a custom profile in Intune. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -512,9 +653,10 @@ ADMX Info: - GP ADMX file name: *deviceinstallation.admx* - - + + +
          To enable this policy, use the following SyncML. This example prevents Windows from installing compatible devices with a device ID of USB\Composite or USB\Class_FF. To configure multiple classes, use &#xF000; as a delimiter. To apply the policy to matching device classes that are already installed, set DeviceInstall_IDs_Deny_Retroactive to true. @@ -552,7 +694,140 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile blocks installation and usage of USB devices with hardware IDs "USB\Composite" and "USB\Class_FF", and applies to USB devices with matching hardware IDs that are already installed. ![Custom profile](images/custom-profile-prevent-device-ids.png) + + + + + +
          + + +**DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Added in Windows 10, version 1903. Also available in Windows 10, version 1809. This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. + +If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. + +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent installation of devices that match any of these device instance IDs* +- GP name: *DeviceInstall_Instance_IDs_Deny* +- GP path: *System/Device Installation/Device Installation Restrictions* +- GP ADMX file name: *deviceinstallation.admx* + + + + + + +To enable this policy, use the following SyncML. This example prevents Windows from installing compatible devices with device instance IDs of USB\VID_1F75 and USB\VID_0781. To configure multiple classes, use `` as a delimiter. + +``` xml + + + + $CmdID$ + + + ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs + + + string + + + + + + +``` +To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: + +``` txt +>>> [Device Installation Restrictions Policy Check] +>>> Section start 2018/11/15 12:26:41.659 +<<< Section end 2018/11/15 12:26:41.751 +<<< [Exit status: SUCCESS] +``` + +You can also block installation and usage of prohibited peripherals by using a custom profile in Intune. + +For example, this custom profile prevents installation of devices with matching device instance IDs. + +![Custom profile](images/custom-profile-prevent-device-instance-ids.png) + +To prevent installation of devices with matching device instance IDs by using custom profile in Intune: +1. Locate the device instance ID. +2. Replace `&` in the device instance IDs with `&`. +For example: +Replace +```USBSTOR\DISK&VEN_SAMSUNG&PROD_FLASH_DRIVE&REV_1100\0376319020002347&0``` +with +```USBSTOR\DISK&VEN_SAMSUNG&PROD_FLASH_DRIVE&REV_1100\0376319020002347&0``` + > [!Note] + > Do not use spaces in the value. +3. Replace the device instance IDs with `&` into the sample SyncML. Add the SyncML into the Intune custom device configuration profile. + + + + + + + +
          **DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses** @@ -560,26 +835,34 @@ For example, this custom profile blocks installation and usage of USB devices wi - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -614,9 +897,10 @@ ADMX Info: - GP ADMX file name: *deviceinstallation.admx* - -
          + + + To enable this policy, use the following SyncML. This example prevents Windows from installing: - Floppy Disks, ClassGUID = {4d36e980-e325-11ce-bfc1-08002be10318} @@ -653,15 +937,23 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + -Footnote: + + +
          -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 1682e10bd8..f68a71f820 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,12 +1,13 @@ --- title: Policy CSP - DeviceLock -description: Policy CSP - DeviceLock +description: Learn how to use the Policy CSP - DeviceLock setting to specify whether the user must input a PIN or password when the device resumes from an idle state. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -24,9 +25,6 @@ manager: dansimp
          DeviceLock/AllowIdleReturnWithoutPassword
          -
          - DeviceLock/AllowScreenTimeoutWhileLockedUserConfig -
          DeviceLock/AllowSimpleDevicePassword
          @@ -45,18 +43,12 @@ manager: dansimp
          DeviceLock/EnforceLockScreenAndLogonImage
          -
          - DeviceLock/EnforceLockScreenProvider -
          DeviceLock/MaxDevicePasswordFailedAttempts
          DeviceLock/MaxInactivityTimeDeviceLock
          -
          - DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay -
          DeviceLock/MinDevicePasswordComplexCharacters
          @@ -72,10 +64,7 @@ manager: dansimp
          DeviceLock/PreventLockScreenSlideShow
          -
          - DeviceLock/ScreenTimeoutWhileLocked -
          - +
          @@ -86,26 +75,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecross mark
          Educationcross mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -117,13 +114,12 @@ manager: dansimp > [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. +> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. - Specifies whether the user must input a PIN or password when the device resumes from an idle state. > [!NOTE] -> This policy must be wrapped in an Atomic command. +> This policy must be wrapped in an Atomic command. @@ -137,92 +133,40 @@ The following list shows the supported values:
          - -**DeviceLock/AllowScreenTimeoutWhileLockedUserConfig** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          check markcheck markcheck markcheck markcheck markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. - -> [!NOTE] -> This policy must be wrapped in an Atomic command. - -> [!IMPORTANT] -> If this policy is set to 1 (Allowed), the value set by **DeviceLock/ScreenTimeOutWhileLocked** is ignored. To ensure enterprise control over the screen timeout, set this policy to 0 (Not allowed) and use **DeviceLock/ScreenTimeOutWhileLocked** to set the screen timeout period. - - - -The following list shows the supported values: - -- 0 (default) – Not allowed. -- 1 – Allowed. - - - - -
          - **DeviceLock/AllowSimpleDevicePassword** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -260,26 +204,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -323,26 +275,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -414,26 +374,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -473,26 +441,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -532,26 +508,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1cross markcross markHomecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -575,81 +559,40 @@ Value type is a string, which is the full image filepath and filename.
          - -**DeviceLock/EnforceLockScreenProvider** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck mark1check mark1
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider. - -> [!NOTE] -> This policy is only enforced in Windows 10 for mobile devices. - - -Value type is a string, which is the AppID. - - - - -
          - **DeviceLock/MaxDevicePasswordFailedAttempts** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -696,26 +639,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -750,85 +701,40 @@ The following list shows the supported values:
          - -**DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck mark2check mark2
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display. - -> [!NOTE] -> This policy must be wrapped in an Atomic command. - - - -The following list shows the supported values: - -- An integer X where 0 <= X <= 999. -- 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined." - - - - -
          - **DeviceLock/MinDevicePasswordComplexCharacters** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -923,26 +829,34 @@ For additional information about this policy, see [Exchange ActiveSync Policy En - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -975,6 +889,29 @@ The following list shows the supported values: - The default value is 4 for mobile devices and desktop devices. + +The following example shows how to set the minimum password length to 4 characters. + +```xml + + + + $CmdID$ + + + ./Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordLength + + + int + + 4 + + + + + +``` +
          @@ -985,26 +922,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1038,26 +983,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1100,26 +1053,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1156,112 +1117,16 @@ ADMX Info:
          - -**DeviceLock/ScreenTimeoutWhileLocked** +Footnotes: - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Allows an enterprise to set the duration in seconds for the screen timeout while on the lock screen of Windows 10 Mobile devices. - -Minimum supported value is 10. - -Maximum supported value is 1800. - -The default value is 10. - -Most restricted value is 0. - - - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## DeviceLock policies supported by HoloLens 2 - -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) - - - - -## DeviceLock policies supported by HoloLens (1st gen) Commercial Suite - -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) - - - -## DeviceLock policies supported by HoloLens (1st gen) Development Edition - -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) - - - -
          - -Footnotes: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index e6bdb26828..82dbb630ae 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Display -description: Policy CSP - Display +description: Learn how to use the Policy CSP - Display setting to disable Per-Process System DPI for a semicolon-separated list of applications. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/08/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - Display +
          @@ -46,26 +48,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -98,26 +108,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -170,26 +188,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -222,26 +248,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -289,26 +323,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -349,12 +391,16 @@ To validate on Desktop, do the following:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 84edbd082b..0d8f6b40f8 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -1,21 +1,19 @@ --- title: Policy CSP - DmaGuard -description: Policy CSP - DmaGuard +description: Learn how to use the Policy CSP - DmaGuard setting to provide additional security against external DMA capable devices. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 12/17/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - DmaGuard -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
          @@ -37,26 +35,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -67,7 +73,7 @@ manager: dansimp -This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with DMA Remapping/device memory isolation and sandboxing. +This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with [DMA Remapping](https://docs.microsoft.com/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers)/device memory isolation and sandboxing. Device memory sandboxing allows the OS to leverage the I/O Memory Management Unit (IOMMU) of a device to block unallowed I/O, or memory access, by the peripheral. In other words, the OS assigns a certain memory range to the peripheral. If the peripheral attempts to read/write to memory outside of the assigned range, the OS blocks it. @@ -105,14 +111,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 75f755f4fb..18cce493eb 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Education -description: Policy CSP - Education +description: Learn how to use the Policy CSP - Education setting to control graphing functionality in the Windows Calculator app. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,13 +15,15 @@ manager: dansimp # Policy CSP - Education -
          ## Education policies
          +
          + Education/AllowGraphingCalculator +
          Education/DefaultPrinterName
          @@ -33,6 +36,69 @@ manager: dansimp
          +
          + + +**Education/AllowGraphingCalculator** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecheck mark8
          Procheck mark8
          Businesscheck mark8
          Enterprisecheck mark8
          Educationcheck mark8
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Added in Windows 10, version 2004. This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, you will be able to access graphing functionality. + + +ADMX Info: +- GP English name: *Allow Graphing Calculator* +- GP name: *AllowGraphingCalculator* +- GP path: *Windows Components/Calculator* +- GP ADMX file name: *Programs.admx* + + + +The following list shows the supported values: +- 0 - Disabled +- 1 (default) - Enabled + + +
          @@ -41,26 +107,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -86,26 +160,34 @@ The policy value is expected to be the name (network host name) of an installed - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -144,26 +226,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -176,18 +266,22 @@ The following list shows the supported values: Added in Windows 10, version 1709. Allows IT Admins to automatically provision printers based on their names (network host names). -The policy value is expected to be a `````` seperated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer. +The policy value is expected to be a `````` separated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer.
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 606cfc2ceb..e9d1cb8436 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -1,12 +1,13 @@ --- title: Policy CSP - EnterpriseCloudPrint -description: Policy CSP - EnterpriseCloudPrint +description: Use the Policy CSP - EnterpriseCloudPrint setting to define the maximum number of printers that should be queried from a discovery end point. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -50,26 +51,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -97,26 +106,34 @@ The default value is an empty string. Otherwise, the value should contain the UR - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -144,26 +161,34 @@ The default value is an empty string. Otherwise, the value should contain a GUID - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -191,26 +216,34 @@ The default value is an empty string. Otherwise, the value should contain a URL. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -238,26 +271,34 @@ The default value is an empty string. Otherwise, the value should contain the UR - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -285,26 +326,34 @@ For Windows Mobile, the default value is 20. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -325,12 +374,16 @@ The default value is an empty string. Otherwise, the value should contain a URL.
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index d498c385d6..b4f27cc7c0 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -1,12 +1,13 @@ --- title: Policy CSP - ErrorReporting -description: Policy CSP - ErrorReporting +description: Learn how to use the Policy CSP - ErrorReporting setting to determine the consent behavior of Windows Error Reporting for specific event types. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -47,26 +48,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -119,26 +128,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -181,26 +198,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -247,26 +272,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -309,26 +342,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -364,12 +405,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index a12bf88937..d86bd44edc 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -1,12 +1,13 @@ --- title: Policy CSP - EventLogService -description: Policy CSP - EventLogService +description: Learn how to use the Policy CSP - EventLogService settting to control Event Log behavior when the log file reaches its maximum size. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -44,26 +45,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -108,26 +117,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -170,26 +187,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -232,26 +257,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -287,12 +320,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 7e61e7696e..8550d25403 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1,30 +1,30 @@ --- title: Policy CSP - Experience -description: Policy CSP - Experience +description: Learn how to use the Policy CSP - Experience setting to allow history of clipboard items to be stored in memory. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 11/02/2020 ms.reviewer: manager: dansimp --- # Policy CSP - Experience + +
          -## Experience policies +## Experience policies
          Experience/AllowClipboardHistory
          -
          - Experience/AllowCopyPaste -
          Experience/AllowCortana
          @@ -37,15 +37,9 @@ manager: dansimp
          Experience/AllowManualMDMUnenrollment
          -
          - Experience/AllowSIMErrorDialogPromptWhenNoSIM -
          Experience/AllowSaveAsOfOfficeFiles
          -
          - Experience/AllowScreenCapture -
          Experience/AllowSharingOfOfficeFiles
          @@ -55,15 +49,9 @@ manager: dansimp
          Experience/AllowTailoredExperiencesWithDiagnosticData
          -
          - Experience/AllowTaskSwitcher -
          Experience/AllowThirdPartySuggestionsInWindowsSpotlight
          -
          - Experience/AllowVoiceRecording -
          Experience/AllowWindowsConsumerFeatures
          @@ -85,6 +73,9 @@ manager: dansimp
          Experience/ConfigureWindowsSpotlightOnLockScreen
          +
          + Experience/DisableCloudOptimizedContent +
          Experience/DoNotShowFeedbackNotifications
          @@ -103,31 +94,39 @@ manager: dansimp
          -**Experience/AllowClipboardHistory** +**Experience/AllowClipboardHistory** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -146,7 +145,7 @@ Value type is integer. Supported values: -ADMX Info: +ADMX Info: - GP English name: *Allow Clipboard History* - GP name: *AllowClipboardHistory* - GP path: *System/OS Policies* @@ -174,86 +173,39 @@ ADMX Info:
          -**Experience/AllowCopyPaste** +**Experience/AllowCortana** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
          - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Specifies whether copy and paste is allowed. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
          - - -**Experience/AllowCortana** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck markcheck markcheck markcheck markcheck markcheck mark
          - - [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -270,7 +222,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Allow Cortana* - GP name: *AllowCortana* - GP path: *Windows Components/Search* @@ -289,31 +241,39 @@ The following list shows the supported values:
          -**Experience/AllowDeviceDiscovery** +**Experience/AllowDeviceDiscovery** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -326,7 +286,7 @@ The following list shows the supported values: Allows users to turn on/off device discovery UX. -When set to 0 , the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on. +When set to 0, the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on. Most restricted value is 0. @@ -343,31 +303,39 @@ The following list shows the supported values:
          -**Experience/AllowFindMyDevice** +**Experience/AllowFindMyDevice** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2cross markcheck mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscross mark
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -386,7 +354,7 @@ When Find My Device is off, the device and its location are not registered and t -ADMX Info: +ADMX Info: - GP English name: *Turn On/Off Find My Device* - GP name: *FindMy_AllowFindMyDeviceConfig* - GP path: *Windows Components/Find My Device* @@ -405,31 +373,39 @@ The following list shows the supported values:
          -**Experience/AllowManualMDMUnenrollment** +**Experience/AllowManualMDMUnenrollment** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -440,7 +416,7 @@ The following list shows the supported values: -Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), then disabling the MDM unenrollment has no effect. +Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g., auto-enrolled), then disabling the MDM unenrollment has no effect. > [!NOTE] > The MDM server can always remotely delete the account. @@ -461,71 +437,10 @@ The following list shows the supported values:
          -**Experience/AllowSIMErrorDialogPromptWhenNoSIM** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device +**Experience/AllowSaveAsOfOfficeFiles**
          - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether to display dialog prompt when no SIM card is detected. - - - -The following list shows the supported values: - -- 0 – SIM card dialog prompt is not displayed. -- 1 (default) – SIM card dialog prompt is displayed. - - - - -
          - - -**Experience/AllowSaveAsOfOfficeFiles** - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - This policy is deprecated. @@ -535,73 +450,8 @@ This policy is deprecated.
          -**Experience/AllowScreenCapture** +**Experience/AllowSharingOfOfficeFiles** - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether screen capture is allowed. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
          - - -**Experience/AllowSharingOfOfficeFiles** - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - This policy is deprecated. @@ -611,31 +461,39 @@ This policy is deprecated.
          -**Experience/AllowSyncMySettings** +**Experience/AllowSyncMySettings** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -652,7 +510,7 @@ Allows or disallows all Windows sync settings on the device. For information abo The following list shows the supported values: -- 0 – Sync settings is not allowed. +- 0 – Sync settings are not allowed. - 1 (default) – Sync settings allowed. @@ -661,31 +519,39 @@ The following list shows the supported values:
          -**Experience/AllowTailoredExperiencesWithDiagnosticData** +**Experience/AllowTailoredExperiencesWithDiagnosticData** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2cross markcheck mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscross mark
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -703,13 +569,14 @@ Added in Windows 10, version 1703. This policy allows you to prevent Windows fro Diagnostic data can include browser, app and feature usage, depending on the "Diagnostic and usage data" setting value. -> **Note** This setting does not control Cortana cutomized experiences because there are separate policies to configure it. +> [!NOTE] +> This setting does not control Cortana cutomized experiences because there are separate policies to configure it. Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Do not use diagnostic data for tailored experiences* - GP name: *DisableTailoredExperiencesWithDiagnosticData* - GP path: *Windows Components/Cloud Content* @@ -728,85 +595,39 @@ The following list shows the supported values:
          -**Experience/AllowTaskSwitcher** +**Experience/AllowThirdPartySuggestionsInWindowsSpotlight** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
          - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Allows or disallows task switching on the device. - - - -The following list shows the supported values: - -- 0 – Task switching not allowed. -- 1 (default) – Task switching allowed. - - - - -
          - - -**Experience/AllowThirdPartySuggestionsInWindowsSpotlight** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark1check mark1check mark1check mark1cross markcross mark
          - - [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -825,7 +646,7 @@ Specifies whether to allow app and content suggestions from third-party software -ADMX Info: +ADMX Info: - GP English name: *Do not suggest third-party content in Windows spotlight* - GP name: *DisableThirdPartySuggestions* - GP path: *Windows Components/Cloud Content* @@ -844,87 +665,39 @@ The following list shows the supported values:
          -**Experience/AllowVoiceRecording** +**Experience/AllowWindowsConsumerFeatures** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
          - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether voice recording is allowed for apps. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
          - - -**Experience/AllowWindowsConsumerFeatures** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcheck markcheck markcross markcross mark
          - - [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -946,7 +719,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off Microsoft consumer experiences* - GP name: *DisableWindowsConsumerFeatures* - GP path: *Windows Components/Cloud Content* @@ -965,31 +738,39 @@ The following list shows the supported values:
          -**Experience/AllowWindowsSpotlight** +**Experience/AllowWindowsSpotlight** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark1check mark1cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1010,7 +791,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off all Windows spotlight features* - GP name: *DisableWindowsSpotlightFeatures* - GP path: *Windows Components/Cloud Content* @@ -1029,31 +810,39 @@ The following list shows the supported values:
          -**Experience/AllowWindowsSpotlightOnActionCenter** +**Experience/AllowWindowsSpotlightOnActionCenter** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark2check mark2cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1073,7 +862,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off Windows Spotlight on Action Center* - GP name: *DisableWindowsSpotlightOnActionCenter* - GP path: *Windows Components/Cloud Content* @@ -1092,31 +881,39 @@ The following list shows the supported values:
          -**Experience/AllowWindowsSpotlightOnSettings** +**Experience/AllowWindowsSpotlightOnSettings** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark4check mark4Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1127,7 +924,7 @@ The following list shows the supported values: -Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive. +Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make their experience productive. - User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app. - User Setting is changeable on a per user basis. @@ -1135,7 +932,7 @@ Added in Windows 10, version 1803. This policy allows IT admins to turn off Sugg -ADMX Info: +ADMX Info: - GP English name: *Turn off Windows Spotlight on Settings* - GP name: *DisableWindowsSpotlightOnSettings* - GP path: *Windows Components/Cloud Content* @@ -1154,31 +951,39 @@ The following list shows the supported values:
          -**Experience/AllowWindowsSpotlightWindowsWelcomeExperience** +**Experience/AllowWindowsSpotlightWindowsWelcomeExperience** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark2check mark2cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1199,7 +1004,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off the Windows Welcome Experience* - GP name: *DisableWindowsSpotlightWindowsWelcomeExperience* - GP path: *Windows Components/Cloud Content* @@ -1218,31 +1023,39 @@ The following list shows the supported values:
          -**Experience/AllowWindowsTips** +**Experience/AllowWindowsTips** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1257,7 +1070,7 @@ Enables or disables Windows Tips / soft landing. -ADMX Info: +ADMX Info: - GP English name: *Do not show Windows tips* - GP name: *DisableSoftLanding* - GP path: *Windows Components/Cloud Content* @@ -1276,31 +1089,39 @@ The following list shows the supported values:
          -**Experience/ConfigureWindowsSpotlightOnLockScreen** +**Experience/ConfigureWindowsSpotlightOnLockScreen** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark1check mark1cross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1319,7 +1140,7 @@ Allows IT admins to specify whether spotlight should be used on the user's lock -ADMX Info: +ADMX Info: - GP English name: *Configure Windows spotlight on lock screen* - GP name: *ConfigureWindowsSpotlight* - GP path: *Windows Components/Cloud Content* @@ -1336,34 +1157,110 @@ The following list shows the supported values: -
          - -**Experience/DoNotShowFeedbackNotifications** +**Experience/DisableCloudOptimizedContent** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark9
          Procheck mark9
          Businesscheck mark9
          Enterprisecheck mark9
          Educationcheck mark9
          +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +This policy setting lets you turn off cloud optimized content in all Windows experiences. + +If you enable this policy setting, Windows experiences that use the cloud optimized content client component will present the default fallback content. + +If you disable or do not configure this policy setting, Windows experiences will be able to use cloud optimized content. + + + +ADMX Info: +- GP English name: *Turn off cloud optimized content* +- GP name: *DisableCloudOptimizedContent* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + + +The following list shows the supported values: + +- 0 (default) – Disabled. +- 1 – Enabled. + + + + +
          + + +**Experience/DoNotShowFeedbackNotifications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          + + +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1382,7 +1279,7 @@ If you disable or do not configure this policy setting, users can control how of -ADMX Info: +ADMX Info: - GP English name: *Do not show feedback notifications* - GP name: *DoNotShowFeedbackNotifications* - GP path: *Data Collection and Preview Builds* @@ -1401,31 +1298,39 @@ The following list shows the supported values:
          -**Experience/DoNotSyncBrowserSettings** +**Experience/DoNotSyncBrowserSettings** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark5check mark5Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1443,7 +1348,7 @@ Related policy: -ADMX Info: +ADMX Info: - GP English name: *Do not sync browser settings* - GP name: *DisableWebBrowserSettingSync* - GP path: *Windows Components/Sync your settings* @@ -1453,7 +1358,7 @@ ADMX Info: Supported values: -- 0 (default) - Allowed/turned on. The "browser" group syncs automatically between user’s devices and lets users to make changes. +- 0 (default) - Allowed/turned on. The "browser" group synchronizes automatically between users' devices and lets users make changes. - 2 - Prevented/turned off. The "browser" group does not use the _Sync your Settings_ option. @@ -1487,31 +1392,39 @@ _**Turn syncing off by default but don’t disable**_
          -**Experience/PreventUsersFromTurningOnBrowserSyncing** +**Experience/PreventUsersFromTurningOnBrowserSyncing** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcheck mark5check mark5Homecross mark
          Procross mark
          Businesscross mark
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1530,7 +1443,7 @@ Related policy: -ADMX Info: +ADMX Info: - GP English name: *Prevent users from turning on browser syncing* - GP name: *PreventUsersFromTurningOnBrowserSyncing* - GP path: *Windows Components/Sync your settings* @@ -1579,26 +1492,34 @@ Validation procedure: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcheck mark6check mark6check mark6Homecross mark
          Procross mark
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1639,35 +1560,19 @@ Supported values: - - - - -## Experience policies supported by HoloLens 2 - -- [Experience/AllowCortana](#experience-allowcortana) -- [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment) - - - -## Experience policies supported by HoloLens (1st gen) Commercial Suite - -- [Experience/AllowCortana](#experience-allowcortana) - - - -## Experience policies supported by HoloLens (1st gen) Development Edition - -- [Experience/AllowCortana](#experience-allowcortana) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. + + + diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 8e0abebf9d..92829f957e 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -1,12 +1,13 @@ --- title: Policy CSP - ExploitGuard -description: Policy CSP - ExploitGuard +description: Use the Policy CSP - ExploitGuard setting to push out the desired system configuration and application mitigation options to all the devices in the organization. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -65,7 +74,7 @@ manager: dansimp -Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml). +Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Enable Exploit Protection on Devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml). The system settings require a reboot; the application settings do not require a reboot. @@ -109,12 +118,16 @@ Here is an example:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index f2666b4442..58b2bf5175 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -1,12 +1,13 @@ --- title: Policy CSP - FileExplorer -description: Policy CSP - FileExplorer +description: Use the Policy CSP - FileExplorer setting so you can allow certain legacy plug-in applications to function without terminating Explorer. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - FileExplorer +
          @@ -37,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -95,26 +105,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -146,12 +164,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index 750f00f237..f62143e2a6 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Games -description: Policy CSP - Games +description: Learn to use the Policy CSP - Games setting so that you can specify whether advanced gaming services can be used. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -78,12 +87,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 12cb543539..dea9168e36 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Handwriting -description: Policy CSP - Handwriting +description: Use the Policy CSP - Handwriting setting to allow an enterprise to configure the default mode for the handwriting panel. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/09/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3cross markcheck mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscross mark
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -92,12 +101,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index c39e01b943..c63c654abe 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -1,12 +1,13 @@ --- title: Policy CSP - InternetExplorer -description: Policy CSP - InternetExplorer +description: Use the Policy CSP - InternetExplorer setting to add a specific list of search providers to the user's default list of search providers. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - InternetExplorer +
          @@ -790,26 +792,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -853,26 +863,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -916,26 +934,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -985,26 +1011,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1049,26 +1083,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1112,26 +1154,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1179,26 +1229,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1244,26 +1302,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6cross markcross markHomecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1320,26 +1386,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1383,26 +1457,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1446,26 +1528,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1510,26 +1600,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1573,26 +1671,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1638,26 +1744,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1707,26 +1821,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1776,26 +1898,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1845,26 +1975,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1914,26 +2052,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1983,26 +2129,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2052,26 +2206,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2121,26 +2283,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2184,26 +2354,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2230,7 +2408,7 @@ If you disable or do not configure this policy, users may choose their own site- > [!NOTE] > This policy is a list that contains the site and index value. -The list is a set of pairs of strings. Each string is seperated by F000. Each pair of strings is stored as a registry name and value. The registry name is the site and the value is an index. The index has to be sequential. See an example below. +The list is a set of pairs of strings. Each string is separated by F000. Each pair of strings is stored as a registry name and value. The registry name is the site and the value is an index. The index has to be sequential. See an example below. > [!TIP] @@ -2270,7 +2448,7 @@ ADMX Info: Value and index pairs in the SyncML example: - http://adfs.contoso.org 1 -- http://microsoft.com 2 +- https://microsoft.com 2 @@ -2283,26 +2461,34 @@ Value and index pairs in the SyncML example: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2348,26 +2534,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2413,26 +2607,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2482,26 +2684,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2551,26 +2761,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2620,26 +2838,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2685,26 +2911,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2750,26 +2984,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2817,26 +3059,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6cross markcross markHomecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2891,26 +3141,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2956,26 +3214,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2987,11 +3253,11 @@ ADMX Info: -This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious. +This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen prevents the user from browsing to or downloading from sites that are known to host malicious content. Windows Defender SmartScreen also prevents the execution of files that are known to be malicious. -If you enable this policy setting, SmartScreen Filter warnings block the user. +If you enable this policy setting, Windows Defender SmartScreen warnings block the user. -If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. +If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings. > [!TIP] @@ -3019,26 +3285,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3050,11 +3324,11 @@ ADMX Info: -This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the Internet. +This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen warns the user about executable files that Internet Explorer users do not commonly download from the Internet. -If you enable this policy setting, SmartScreen Filter warnings block the user. +If you enable this policy setting, Windows Defender SmartScreen warnings block the user. -If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. +If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings. > [!TIP] @@ -3082,26 +3356,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6cross markcross markHomecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3156,26 +3438,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3219,26 +3509,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3282,26 +3580,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3347,26 +3653,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3414,26 +3728,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3477,26 +3799,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3542,26 +3872,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6cross markcross markHomecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3616,26 +3954,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3683,26 +4029,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3750,26 +4104,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6cross markcross markHomecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3826,26 +4188,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3888,26 +4258,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3951,26 +4329,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4018,26 +4404,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4085,26 +4479,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4148,26 +4550,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4211,26 +4621,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4276,26 +4694,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4339,26 +4765,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4403,26 +4837,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6cross markcross markHomecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4479,26 +4921,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4546,26 +4996,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4614,26 +5072,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4682,26 +5148,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4747,26 +5221,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4816,26 +5298,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4881,26 +5371,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4946,26 +5444,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5011,26 +5517,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5076,26 +5590,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5139,26 +5661,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5206,26 +5736,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5271,26 +5809,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5336,26 +5882,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5401,26 +5955,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5466,26 +6028,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5531,26 +6101,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5594,26 +6172,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5657,26 +6243,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5722,26 +6316,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5787,26 +6389,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5852,26 +6462,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5883,13 +6501,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -5919,26 +6537,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5982,26 +6608,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6047,26 +6681,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6114,26 +6756,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6179,26 +6829,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6244,26 +6902,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6309,26 +6975,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6372,26 +7046,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6439,26 +7121,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6506,26 +7196,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6571,26 +7269,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6636,26 +7342,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6701,26 +7415,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6768,26 +7490,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Business
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + @@ -6801,26 +7531,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6872,26 +7610,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6937,26 +7683,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7010,26 +7764,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7043,11 +7805,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -7075,26 +7837,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7140,26 +7910,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7205,26 +7983,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7270,26 +8056,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7335,26 +8129,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7400,26 +8202,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7463,26 +8273,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7528,26 +8346,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7593,26 +8419,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7658,26 +8492,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7723,26 +8565,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7754,13 +8604,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -7790,26 +8640,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7855,26 +8713,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7920,26 +8786,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7987,26 +8861,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8058,26 +8940,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8091,11 +8981,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -8123,26 +9013,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8188,26 +9086,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8253,26 +9159,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8316,26 +9230,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8381,26 +9303,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8446,26 +9376,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8511,26 +9449,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8576,26 +9522,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8607,13 +9561,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -8643,26 +9597,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8708,26 +9670,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8773,26 +9743,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8840,26 +9818,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8911,26 +9897,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8944,11 +9938,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -8976,26 +9970,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9041,26 +10043,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9106,26 +10116,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9169,26 +10187,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9234,26 +10260,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9299,26 +10333,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9364,26 +10406,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9429,26 +10479,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9460,13 +10518,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -9496,26 +10554,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9561,26 +10627,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9628,26 +10702,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9699,26 +10781,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9732,11 +10822,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -9764,26 +10854,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9835,26 +10933,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9900,26 +11006,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9965,26 +11079,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10028,26 +11150,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10093,26 +11223,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10158,26 +11296,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10223,26 +11369,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10288,26 +11442,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10319,13 +11481,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -10355,26 +11517,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10420,26 +11590,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10487,26 +11665,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10520,11 +11706,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -10552,26 +11738,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10617,26 +11811,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10682,26 +11884,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10745,26 +11955,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10810,26 +12028,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10875,26 +12101,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10940,26 +12174,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11005,26 +12247,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11036,13 +12286,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -11072,26 +12322,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11137,26 +12395,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11204,26 +12470,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11275,26 +12549,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11308,11 +12590,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -11340,26 +12622,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11405,26 +12695,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11470,26 +12768,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11533,26 +12839,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11598,26 +12912,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11663,26 +12985,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11728,26 +13058,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11793,26 +13131,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11824,13 +13170,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -11860,26 +13206,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11925,26 +13279,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11992,26 +13354,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12063,26 +13433,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12128,26 +13506,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12193,26 +13579,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12258,26 +13652,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12321,26 +13723,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12386,26 +13796,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12451,26 +13869,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12516,26 +13942,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12581,26 +14015,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12612,13 +14054,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -12648,26 +14090,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12713,26 +14163,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12780,26 +14238,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12851,26 +14317,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12884,11 +14358,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -12916,26 +14390,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12981,26 +14463,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13046,26 +14536,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6cross markcross markHomecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13123,26 +14621,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13188,26 +14694,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13219,11 +14733,11 @@ ADMX Info: -This policy setting prevents the user from managing SmartScreen Filter, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. +This policy setting prevents the user from managing Windows Defender SmartScreen, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. -If you enable this policy setting, the user is not prompted to turn on SmartScreen Filter. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user. +If you enable this policy setting, the user is not prompted to turn on Windows Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user. -If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience. +If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on Windows Defender SmartScreen during the first-run experience. > [!TIP] @@ -13251,26 +14765,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13314,26 +14836,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13379,26 +14909,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13444,26 +14982,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13509,26 +15055,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13574,26 +15128,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13639,26 +15201,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13704,26 +15274,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13769,26 +15347,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13832,26 +15418,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13897,26 +15491,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13964,26 +15566,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14029,26 +15639,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14094,26 +15712,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14159,26 +15785,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14224,26 +15858,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14289,26 +15931,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14354,26 +16004,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14419,26 +16077,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14482,26 +16148,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14545,26 +16219,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14610,26 +16292,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14675,26 +16365,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14740,26 +16438,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14771,13 +16477,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -14807,26 +16513,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14870,26 +16584,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14935,26 +16657,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15002,26 +16732,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15067,26 +16805,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15132,26 +16878,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15197,26 +16951,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15260,26 +17022,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15327,26 +17097,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15394,26 +17172,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15459,26 +17245,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15524,26 +17318,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15591,26 +17393,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15662,26 +17472,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15727,26 +17545,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15800,26 +17626,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15865,26 +17699,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15932,26 +17774,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15997,26 +17847,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16064,26 +17922,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16131,26 +17997,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16196,26 +18070,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16261,26 +18143,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16326,26 +18216,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16391,26 +18289,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16454,26 +18360,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16520,26 +18434,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16583,26 +18505,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16648,26 +18578,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16713,26 +18651,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16776,26 +18722,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16841,26 +18795,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16906,26 +18868,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16971,26 +18941,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -17036,26 +19014,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -17067,13 +19053,13 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. @@ -17103,26 +19089,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -17168,26 +19162,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -17233,26 +19235,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -17300,26 +19310,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -17371,26 +19389,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -17404,11 +19430,11 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] @@ -17427,45 +19453,18 @@ ADMX Info: - - - - - - - - - - - - -## InternetExplorer policies supported by IoT Core - -- [InternetExplorer/DisableActiveXVersionListAutoDownload](#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](#internetexplorer-disablecompatview) -- [InternetExplorer/DisableGeolocation](#internetexplorer-disablegeolocation) - - - -## InternetExplorer policies supported by IoT Enterprise - -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](#internetexplorer-disablecompatview) -- [InternetExplorer/DisableFeedsBackgroundSync](#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableGeolocation](#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableWebAddressAutoComplete](#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/NewTabDefaultPage](#internetexplorer-newtabdefaultpage) - - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 2df8f06e1a..b5331fa661 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -1,21 +1,19 @@ --- title: Policy CSP - Kerberos -description: Policy CSP - Kerberos +description: Define the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs). ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/08/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Kerberos -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
          @@ -52,26 +50,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -114,26 +120,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -175,26 +189,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -241,26 +263,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -303,26 +333,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -369,26 +407,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -416,14 +462,16 @@ Devices joined to Azure Active Directory in a hybrid environment need to interac
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 99fb4e9a1b..be0176ca9b 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -1,12 +1,13 @@ --- title: Policy CSP - KioskBrowser -description: Policy CSP - KioskBrowser +description: Use the Policy CSP - KioskBrowser setting to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -15,7 +16,7 @@ manager: dansimp -These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user’s browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_). +These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user's browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_).
          @@ -56,26 +57,34 @@ These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Mic - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -102,26 +111,34 @@ Added in Windows 10, version 1803. List of exceptions to the blocked website URL - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -148,26 +165,34 @@ Added in Windows 10, version 1803. List of blocked website URLs (with wildcard s - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -194,26 +219,34 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -224,7 +257,7 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to -Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk broswser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. +Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk browser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. @@ -237,26 +270,34 @@ Shows the Kiosk Browser's end session button. When the policy is enabled, the Ki - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -283,26 +324,34 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -329,26 +378,34 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation but - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -370,12 +427,16 @@ The value is an int 1-1440 that specifies the amount of minutes the session is i
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index d185745718..bb03f10884 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -1,12 +1,13 @@ --- title: Policy CSP - LanmanWorkstation -description: Policy CSP - LanmanWorkstation +description: Use the Policy CSP - LanmanWorkstation setting to determine if the SMB client will allow insecure guest logons to an SMB server. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - LanmanWorkstation +
          @@ -34,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -88,12 +98,16 @@ This setting supports a range of values between 0 and 1.
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 4c7c69815e..bfef6090cc 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Licensing -description: Policy CSP - Licensing +description: Use the Policy CSP - Licensing setting to enable or disable Windows license reactivation on managed devices. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -38,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -96,26 +105,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -147,12 +164,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index ec391230a3..8b0191b9c6 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,21 +1,19 @@ --- title: Policy CSP - LocalPoliciesSecurityOptions -description: Policy CSP - LocalPoliciesSecurityOptions +description: These settings prevents users from adding new Microsoft accounts on a specific computer using LocalPoliciesSecurityOptions. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/26/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - LocalPoliciesSecurityOptions -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
          @@ -47,15 +45,6 @@ manager: dansimp
          LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
          -
          - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways -
          -
          - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible -
          -
          - LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges -
          LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
          @@ -80,18 +69,12 @@ manager: dansimp
          LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
          -
          - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways -
          LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
          LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
          -
          - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession -
          LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
          @@ -140,18 +123,12 @@ manager: dansimp
          LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
          -
          - LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon -
          LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
          LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
          -
          - LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems -
          LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
          @@ -187,32 +164,43 @@ manager: dansimp
          +> [!NOTE] +> To find data formats (and other policy-related details), see [Policy DDF file](https://docs.microsoft.com/windows/client-management/mdm/policy-ddf-file). + **LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -257,26 +245,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -326,26 +322,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -381,26 +385,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -436,26 +448,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -492,26 +512,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -548,26 +576,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -606,26 +642,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -655,231 +699,40 @@ GP Info:
          - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark4check mark4check mark4check mark4cross markcross mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - - -> [!WARNING] -> Starting in the version 1809 of Windows, this policy is deprecated. - -Domain member: Digitally encrypt or sign secure channel data (always) - -This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies: - -Domain member: Digitally encrypt secure channel data (when possible) -Domain member: Digitally sign secure channel data (when possible) - -Default: Enabled. - -Notes: - -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt or sign secure channel data (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
          - - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark4check mark4check mark4check mark4cross markcross mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - - -> [!WARNING] -> Starting in the version 1809 of Windows, this policy is deprecated. - -Domain member: Digitally encrypt secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption. - -Default: Enabled. - -Important - -There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted. - -Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt secure channel data (when possible)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
          - - -**LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark4check mark4check mark4check mark4cross markcross mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - - -> [!WARNING] -> Starting in the version 1809 of Windows, this policy is deprecated. - -Domain member: Disable machine account password changes - -Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. - -Default: Disabled. - -Notes - -This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions. -This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. - - - -GP Info: -- GP English name: *Domain member: Disable machine account password changes* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
          - **LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -919,26 +772,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -983,26 +844,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1048,26 +917,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1114,26 +991,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1175,26 +1060,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1232,26 +1125,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1287,26 +1188,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1351,109 +1260,40 @@ GP Info:
          - -**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark5check mark5check mark5check mark5
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - -GP Info: -- GP English name: *Microsoft network client: Digitally sign communications (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - - - - - - -
          - **LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1502,26 +1342,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1557,26 +1405,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1627,26 +1483,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1707,26 +1571,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1779,26 +1651,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1844,26 +1724,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1899,26 +1787,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1954,26 +1850,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2009,26 +1913,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2039,21 +1951,11 @@ GP Info: -Network security: Allow Local System to use computer identity for NTLM +Network security: Allow Local System to use computer identity for NTLM. -This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. +When services connect to devices that are running versions of the Windows operating system earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will authenticate anonymously. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity. -If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. - -If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. - -By default, this policy is enabled on Windows 7 and above. - -By default, this policy is disabled on Windows Vista. - -This policy is supported on at least Windows Vista or Windows Server 2008. - -Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. +When a service connects with the device identity, signing and encryption are supported to provide data protection. (When a service connects anonymously, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors. Anonymous authentication uses a NULL session, which is a session with a server in which no user authentication is performed; and therefore, anonymous access is allowed.) @@ -2063,14 +1965,11 @@ GP Info: +Valid values: +- 0 - Disabled +- 1 - Enabled (Allow Local System to use computer identity for NTLM.) - - - - - -
          @@ -2081,26 +1980,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2141,26 +2048,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2201,26 +2116,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2276,26 +2199,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2306,18 +2237,18 @@ GP Info: -Network security: Minimum session security for NTLM SSP based (including secure RPC) clients +Network security: Minimum session security for NTLM SSP based (including secure RPC) clients. -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: +This security setting allows a client device to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. +- Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. +- Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption. @@ -2326,15 +2257,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
          @@ -2345,26 +2267,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2405,26 +2335,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2452,6 +2390,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
          @@ -2462,26 +2409,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2513,6 +2468,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
          @@ -2523,26 +2487,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2574,6 +2546,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
          @@ -2584,26 +2565,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2635,55 +2624,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - -
          - - -**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon** - -> [!Warning] -> Starting with Windows 10 version 1803, this policy is deprecated. - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark3check mark3check mark3check mark3cross markcross mark
          - - - -Recovery console: Allow automatic administrative logon - -This security setting determines if the password for the Administrator account must be given before access to the system is granted. If this option is enabled, the Recovery Console does not require you to provide a password, and it automatically logs on to the system. - -Default: This policy is not defined and automatic administrative logon is not allowed. - -Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - -Valid values: -- 0 - disabled -- 1 - enabled (allow automatic administrative logon) + + + + + +
          @@ -2694,26 +2643,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2760,26 +2717,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2811,81 +2776,40 @@ GP Info:
          - -**LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcheck mark4check mark4check mark4check mark4cross markcross mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -System objects: Require case insensitivity for non-Windows subsystems - -This security setting determines whether case insensitivity is enforced for all subsystems. The Win32 subsystem is case insensitive. However, the kernel supports case sensitivity for other subsystems, such as POSIX. - -If this setting is enabled, case insensitivity is enforced for all directory objects, symbolic links, and IO objects, including file objects. Disabling this setting does not allow the Win32 subsystem to become case sensitive. - -Default: Enabled. - - - - -
          - **LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2931,26 +2855,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2998,26 +2930,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3058,26 +2998,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3115,26 +3063,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3172,26 +3128,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3235,26 +3199,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3293,26 +3265,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3350,26 +3330,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3407,26 +3395,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3460,14 +3456,15 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md new file mode 100644 index 0000000000..38ef9aa0b9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -0,0 +1,232 @@ +--- +title: Policy CSP - LocalUsersAndGroups +description: Policy CSP - LocalUsersAndGroups +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - LocalUsersAndGroups + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## LocalUsersAndGroups policies + +
          +
          + LocalUsersAndGroups/Configure +
          +
          + + +
          + + +**LocalUsersAndGroups/Configure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark9
          Businesscheck mark9
          Enterprisecheck mark9
          Educationcheck mark9
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +Available in Windows 10, version 20H2. This policy setting allows IT admins to add, remove, or replace members of local groups on a managed device. + +> [!NOTE] +> The [RestrictedGroups/ConfigureGroupMembership](./policy-csp-restrictedgroups.md#restrictedgroups-configuregroupmembership) policy setting also allows you to configure members (users or AAD groups) to a Windows 10 local group. However, it allows only for a full replace of the existing groups with the new members and does not allow selective add or remove. +> +> Starting from Windows 10, version 20H2, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. Applying both the policies to the same device is unsupported and may yield unpredictable results. + +Here's an example of the policy definition XML for group configuration: + +```xml + + + + + + + +``` + +where: + +- ``: Specifies the name or SID of the local group to configure. If you specify a SID, the [LookupAccountSid](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API is used to translate the SID to a valid group name. If you specify a name, the [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API is used to lookup the group and validate the name. If name/SID lookup fails, the group is skipped and the next group in the XML file is processed. If there are multiple errors, the last error is returned at the end of the policy processing. +- ``: Specifies the action to take on the local group, which can be Update and Restrict, represented by U and R: + - Update. This action must be used to keep the current group membership intact and add or remove members of the specific group. + - Restrict. This action must be used to replace current membership with the newly specified groups. This action provides the same functionality as the [RestrictedGroups/ConfigureGroupMembership](./policy-csp-restrictedgroups.md#restrictedgroups-configuregroupmembership) policy setting. +- ``: Specifies the SID or name of the member to configure. +- ``: Specifies the SID or name of the member to remove from the specified group. + + > [!NOTE] + > When specifying member names of domain accounts, use fully qualified account names where possible (for example, domain_name\user_name) instead of isolated names (for example, group_name). This way, you can avoid getting ambiguous results when users or groups with the same name exist in multiple domains and locally. See [LookupAccountNameA function](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea#remarks) for more information. + +See [Use custom settings for Windows 10 devices in Intune](https://docs.microsoft.com/mem/intune/configuration/custom-settings-windows-10) for information on how to create custom profiles. + +> [!IMPORTANT] +> - `` and `` can use an Azure AD SID or the user's name. For adding or removing Azure AD groups using this policy, you must use the group's SID. Azure AD group SIDs can be obtained using [Graph](https://docs.microsoft.com/graph/api/resources/group?view=graph-rest-1.0#json-representation) API for Groups. The SID is present in the `securityIdentifier` attribute. +> - When specifying a SID in the `` or ``, member SIDs are added without attempting to resolve them. Therefore, be very careful when specifying a SID to ensure it is correct. +> - `` is not valid for the R (Restrict) action and will be ignored if present. +> - The list in the XML is processed in the given order except for the R actions, which get processed last to ensure they win. It also means that if a group is present multiple times with different add/remove values, all of them will be processed in the order they are present. + + + + + + +**Examples** + +Example 1: Update action for adding and removing group members. + +The following example shows how you can update a local group (**Backup Operators**)—add a domain group as a member using its name (**Contoso\ITAdmins**), add the built-in Administrators group using its [well known SID](https://docs.microsoft.com/windows/win32/secauthz/well-known-sids), add a AAD group by its SID (**S-1-12-1-111111111-22222222222-3333333333-4444444444**), and remove a local account (**Guest**). + +```xml + + + + + + + + + +``` + +Example 2: Restrict action for replacing the group membership. + +The following example shows how you can restrict a local group (**Backup Operators**)—replace its membership with the built-in Administrators group using its [well known SID](https://docs.microsoft.com/windows/win32/secauthz/well-known-sids) and add a local account (**Guest**). + +```xml + + + + + + + +``` + + + + + +
          + +## FAQs + +This section provides answers to some common questions you might have about the LocalUsersAndGroups policy CSP. + +### What happens if I accidentally remove the built-in Administrator SID from the Administrators group? + +Removing the built-in Administrator account from the built-in Administrators group is blocked at SAM/OS level for security reasons. Attempting to do so will result in failure with the following error: + +| Error Code | Symbolic Name | Error Description | Header | +|----------|----------|----------|----------| +| 0x55b (Hex)
          1371 (Dec) |ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.| winerror.h | + +When configuring the built-in Administrators group with the R (Restrict) action, specify the built-in Administrator account SID/Name in `` to avoid this error. + +### Can I add a member that already exists? + +Yes, you can add a member that is already a member of a group. This will result in no changes to the group and no error. + +### Can I remove a member if it isn't a member of the group? + +Yes, you can remove a member even if it isn't a member of the group. This will result in no changes to the group and no error. + +### How can I add a domain group as a member to a local group? + +To add a domain group as a member to a local group, specify the domain group in `` of the local group. Use fully qualified account names (for example, domain_name\group_name) instead of isolated names (for example, group_name) for the best results. See [LookupAccountNameA function](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea#remarks) for more information. + +### Can I apply more than one LocalUserAndGroups policy/XML to the same device? + +No, this is not allowed. Attempting to do so will result in a conflict in Intune. + +### What happens if I specify a group name that doesn't exist? + +Invalid group names or SIDs will be skipped. Valid parts of the policy will apply, and error will be returned at the end of the processing. This behavior aligns with the on-prem AD GPP (Group Policy Preferences) LocalUsersAndGroups policy. Similarly, invalid member names will be skipped, and error will be returned at the end to notify that not all settings were applied successfully. + +### What happens if I specify R and U in the same XML? + +If you specify both R and U in the same XML, the R (Restrict) action takes precedence over U (Update). Therefore, if a group appears twice in the XML, once with U and again with R, the R action wins. + +### How do I check the result of a policy that is applied on the client device? + +After a policy is applied on the client device, you can investigate the event log to review the result: + +1. Open Event Viewer (**eventvwr.exe**). +2. Navigate to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise- +Diagnostics-Provider** > **Admin**. +3. Search for the `LocalUsersAndGroups` string to review the relevant details. + +### How can I troubleshoot Name/SID lookup APIs? + +To troubleshoot Name/SID lookup APIs: + +1. Enable **lsp.log** on the client device by running the following commands: + + ```cmd + Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgInfoLevel -Value 0x800 -Type dword -Force + + Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgTraceOptions -Value 0x1 -Type dword -Force + ``` + + The **lsp.log** file (**C:\windows\debug\lsp.log**) will be displayed. This log file tracks the SID-Name resolution. + +2. Turn the logging off by running the following command: + + ```cmd + Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgInfoLevel -Value 0x0 -Type dword -Force + ``` + + +Footnotes: + +- 9 - Available in Windows 10, version 20H2. + + diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index 0f90b19790..bc065532ed 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -1,12 +1,13 @@ --- title: Policy CSP - LockDown -description: Policy CSP - LockDown +description: Use the Policy CSP - LockDown setting to allow the user to invoke any system user interface by swiping in from any screen edge using touch. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -65,7 +74,7 @@ manager: dansimp -Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. +Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. @@ -88,12 +97,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index 1028e204b8..34c246f134 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Maps -description: Policy CSP - Maps +description: Use the Policy CSP - Maps setting to allow the download and update of map data over metered connections. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -38,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -91,26 +100,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -145,12 +162,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index b2efd6a840..43fe8e0e47 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Messaging -description: Policy CSP - Messaging +description: Enable, and disable, text message back up and restore as well as Messaging Everywhere by using the Policy CSP for messaging. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/09/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -21,71 +22,12 @@ manager: dansimp ## Messaging policies
          -
          - Messaging/AllowMMS -
          Messaging/AllowMessageSync
          -
          - Messaging/AllowRCS -
          -
          - - -**Messaging/AllowMMS** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck mark2check mark2
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Added in Windows 10, version 1703. Enables or disables the MMS send/receive functionality on the device. For enterprises, this policy can be used to disable MMS on devices as part of the auditing or management requirement. - - - -The following list shows the supported values: - -- 0 - Disabled. -- 1 (default) - Enabled. - - - -
          @@ -94,26 +36,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1cross markcheck mark1check mark1check mark1check mark1Homecross mark
          Procheck mark1
          Businesscross mark
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -146,64 +96,16 @@ The following list shows the supported values:
          - -**Messaging/AllowRCS** +Footnotes: - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck mark2check mark2
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Added in Windows 10, version 1703. Enables or disables the RCS send/receive functionality on the device. For enterprises, this policy can be used to disable RCS on devices as part of the auditing or management requirement. - - - -The following list shows the supported values: - -- 0 - Disabled. -- 1 (default) - Enabled. - - - -
          - -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md new file mode 100644 index 0000000000..9b9c05d03d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -0,0 +1,314 @@ +--- +title: Policy CSP - MixedReality +description: Policy CSP - MixedReality +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/06/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - MixedReality +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
          + + +## MixedReality policies + +
          +
          + MixedReality/AADGroupMembershipCacheValidityInDays +
          +
          + MixedReality/BrightnessButtonDisabled +
          +
          + MixedReality/FallbackDiagnostics +
          +
          + MixedReality/MicrophoneDisabled +
          +
          + MixedReality/VolumeButtonDisabled +
          +
          + + +
          + + +**MixedReality/AADGroupMembershipCacheValidityInDays** + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          HoloLens (1st gen) Development Editioncross mark
          HoloLens (1st gen) Commercial Suitecross mark
          HoloLens 2check mark9
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +This policy setting controls for how many days Azure AD group membership cache is allowed to be used for Assigned Access configurations targeting Azure AD groups for signed in user. Once this policy setting is set only then cache is used otherwise not. In order for this policy setting to take effect, user must sign out and sign in with Internet available at least once before the cache can be used for subsequent "disconnected" sessions. + + + + + + + +Supported values are 0-60. The default value is 0 (day) and maximum value is 60 (days). + + + +
          + + +**MixedReality/BrightnessButtonDisabled** + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          HoloLens (1st gen) Development Editioncross mark
          HoloLens (1st gen) Commercial Suitecross mark
          HoloLens 2check mark9
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +This policy setting controls if pressing the brightness button changes the brightness or not. It only impacts brightness on HoloLens and not the functionality of the button when it is used with other buttons as combination for other purposes. + + + + + + + +The following list shows the supported values: + +- 0 - False (Default) +- 1 - True + + + +
          + + +**MixedReality/FallbackDiagnostics** + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          HoloLens (1st gen) Development Editioncross mark
          HoloLens (1st gen) Commercial Suitecross mark
          HoloLens 2check mark9
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +This policy setting controls when and if diagnostic logs can be collected using specific button combination on HoloLens. + + + + + + + +The following list shows the supported values: + +- 0 - Disabled +- 1 - Enabled for device owners +- 2 - Enabled for all (Default) + + + +
          + + +**MixedReality/MicrophoneDisabled** + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          HoloLens (1st gen) Development Editioncross mark
          HoloLens (1st gen) Commercial Suitecross mark
          HoloLens 2check mark9
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +This policy setting controls whether microphone on HoloLens 2 is disabled or not. + + + + + + + +The following list shows the supported values: + +- 0 - False (Default) +- 1 - True + + + +
          + + +**MixedReality/VolumeButtonDisabled** + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          HoloLens (1st gen) Development Editioncross mark
          HoloLens (1st gen) Commercial Suitecross mark
          HoloLens 2check mark9
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
          + + + +This policy setting controls if pressing the volume button changes the volume or not. It only impacts volume on HoloLens and not the functionality of the button when it is used with other buttons as combination for other purposes. + + + + + + + +The following list shows the supported values: + +- 0 - False (Default) +- 1 - True + + + +
          + +Footnotes: + +- 9 - Available in Windows 10, version 20H2. + + + diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 4e53332f72..d464f4c063 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -1,12 +1,13 @@ --- title: Policy CSP - MSSecurityGuide -description: Policy CSP - MSSecurityGuide +description: Learn how Policy CSP - MSSecurityGuide, an ADMX-backed policy, requires a special SyncML format to enable or disable. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - MSSecurityGuide +
          @@ -49,26 +51,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -104,26 +114,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -159,26 +177,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -214,26 +240,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -269,26 +303,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -324,26 +366,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -372,12 +422,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 722b58c97c..d4a5030052 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,12 +1,13 @@ --- title: Policy CSP - MSSLegacy -description: Policy CSP - MSSLegacy +description: Learn how Policy CSP - MSSLegacy, an ADMX-backed policy, requires a special SyncML format to enable or disable. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - MSSLegacy +
          @@ -43,26 +45,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -98,26 +108,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -153,26 +171,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -208,26 +234,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -256,12 +290,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md new file mode 100644 index 0000000000..fd1e3372e8 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -0,0 +1,131 @@ +--- +title: Policy CSP - Multitasking +description: Policy CSP - Multitasking +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/30/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - Multitasking + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
          + + +## Multitasking policies + +
          +
          + Multitasking/BrowserAltTabBlowout +
          +
          + + +
          + + +**Multitasking/BrowserAltTabBlowout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          Windows EditionSupported?
          Homecross mark
          Procheck mark9
          Businesscheck mark9
          Enterprisecheck mark9
          Educationcheck mark9
          + + +
          + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + + +> [!Warning] +> This policy is currently in preview mode only and will be supported in future releases. It may be used for testing purposes, but should not be used in a production environment at this time. + +This policy controls the inclusion of Edge tabs into Alt+Tab. + +Enabling this policy restricts the number of Edge tabs that are allowed to appear in the Alt+Tab switcher. Alt+Tab can be configured to show all open Edge tabs, only the 5 most recent tabs, only the 3 most recent tabs, or no tabs. Setting the policy to no tabs configures the Alt+Tab switcher to show app windows only, which is the classic Alt+Tab behavior. + +This policy only applies to the Alt+Tab switcher. When the policy is not enabled, the feature respects the user's setting in the Settings app. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the inclusion of Edge tabs into Alt-Tab* +- GP name: *BrowserAltTabBlowout* +- GP path: *Windows Components/Multitasking* +- GP ADMX file name: *Multitasking.admx* + + + + +The following list shows the supported values: + +- 1 - Open windows and all tabs in Edge. +- 2 - Open windows and 5 most recent tabs in Edge. +- 3 - Open windows and 3 most recent tabs in Edge. +- 4 - Open windows only. + + + + +
          + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. + + + diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 9404b184fc..95d9af4a93 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -1,12 +1,13 @@ --- title: Policy CSP - NetworkIsolation -description: Policy CSP - NetworkIsolation +description: Learn how Policy CSP - NetworkIsolation contains a list of Enterprise resource domains hosted in the cloud that need to be protected. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -56,26 +57,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -108,26 +117,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -173,26 +190,34 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -203,7 +228,7 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff -Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. +Integer value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. @@ -224,26 +249,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -276,26 +309,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -329,26 +370,34 @@ Here are the steps to create canonical domain names: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -381,26 +430,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -411,7 +468,7 @@ ADMX Info: -Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. +Integer value that tells the client to accept the configured list of proxies and not try to detect other work proxies. @@ -432,26 +489,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -477,12 +542,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 1624dfe21f..fb3651acb0 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Notifications -description: Policy CSP - Notifications +description: Block applications from using the network to send tile, badge, toast, and raw notifications for Policy CSP - Notifications. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -41,26 +42,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -114,26 +123,34 @@ Validation: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -176,26 +193,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -237,12 +262,16 @@ Validation:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 643ff5cea3..d17cdbe1bc 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Power -description: Policy CSP - Power +description: Learn how the Policy CSP - Power setting manages whether or not Windows is allowed to use standby states when putting the computer in a sleep state. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - Power +
          @@ -50,7 +52,7 @@ manager: dansimp
          Power/RequirePasswordWhenComputerWakesPluggedIn
          -
          +
          Power/SelectLidCloseActionOnBattery
          @@ -97,26 +99,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -159,26 +169,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -221,26 +239,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -285,26 +311,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -349,26 +383,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -387,7 +429,6 @@ If you enable this policy setting, you must specify a percentage value that indi If you disable or do not configure this policy setting, users control this setting. - ADMX Info: - GP English name: *Energy Saver Battery Threshold (on battery)* @@ -416,26 +457,34 @@ Supported values: 0-100. The default is 70. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -453,7 +502,6 @@ If you enable this policy setting, you must provide a percentage value that indi If you disable or do not configure this policy setting, users control this setting. - ADMX Info: - GP English name: *Energy Saver Battery Threshold (plugged in)* @@ -482,26 +530,34 @@ Supported values: 0-100. The default is 70. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -546,26 +602,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -610,26 +674,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -672,26 +744,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -734,26 +814,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -771,7 +859,6 @@ If you enable this policy setting, you must select the desired action. If you disable this policy setting or do not configure it, users can see and change this setting. - ADMX Info: - GP English name: *Select the lid switch action (on battery)* @@ -806,26 +893,34 @@ The following are the supported lid close switch actions (on battery): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -843,7 +938,6 @@ If you enable this policy setting, you must select the desired action. If you disable this policy setting or do not configure it, users can see and change this setting. - ADMX Info: - GP English name: *Select the lid switch action (plugged in)* @@ -878,26 +972,34 @@ The following are the supported lid close switch actions (plugged in): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -915,7 +1017,6 @@ If you enable this policy setting, you must select the desired action. If you disable this policy setting or do not configure it, users can see and change this setting. - ADMX Info: - GP English name: *Select the Power button action (on battery)* @@ -950,26 +1051,34 @@ The following are the supported Power button actions (on battery): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -987,7 +1096,6 @@ If you enable this policy setting, you must select the desired action. If you disable this policy setting or do not configure it, users can see and change this setting. - ADMX Info: - GP English name: *Select the Power button action (plugged in)* @@ -1022,26 +1130,34 @@ The following are the supported Power button actions (plugged in): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1059,7 +1175,6 @@ If you enable this policy setting, you must select the desired action. If you disable this policy setting or do not configure it, users can see and change this setting. - ADMX Info: - GP English name: *Select the Sleep button action (on battery)* @@ -1094,26 +1209,34 @@ The following are the supported Sleep button actions (on battery): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1131,7 +1254,6 @@ If you enable this policy setting, you must select the desired action. If you disable this policy setting or do not configure it, users can see and change this setting. - ADMX Info: - GP English name: *Select the Sleep button action (plugged in)* @@ -1166,26 +1288,34 @@ The following are the supported Sleep button actions (plugged in): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1230,26 +1360,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1294,26 +1432,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1331,7 +1477,6 @@ If you set this policy setting to 0, a hiberfile is not generated when the syste If you set this policy setting to 1 or do not configure this policy setting, users control this setting. - ADMX Info: - GP English name: *Turn off hybrid sleep (on battery)* @@ -1363,26 +1508,34 @@ The following are the supported values for Hybrid sleep (on battery): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1400,7 +1553,6 @@ If you set this policy setting to 0, a hiberfile is not generated when the syste If you set this policy setting to 1 or do not configure this policy setting, users control this setting. - ADMX Info: - GP English name: *Turn off hybrid sleep (plugged in)* @@ -1432,26 +1584,34 @@ The following are the supported values for Hybrid sleep (plugged in): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1468,10 +1628,9 @@ If you enable this policy setting, you must provide a value, in seconds, indicat If you disable or do not configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. - ADMX Info: - GP English name: *Specify the unattended sleep timeout (on battery)* @@ -1501,26 +1660,34 @@ Default value for unattended sleep timeout (on battery): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1537,10 +1704,9 @@ If you enable this policy setting, you must provide a value, in seconds, indicat If you disable or do not configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. - ADMX Info: - GP English name: *Specify the unattended sleep timeout (plugged in)* @@ -1561,15 +1727,18 @@ Default value for unattended sleep timeout (plugged in): - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 16470df06b..e93f27025d 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Printers -description: Policy CSP - Printers +description: Use this policy setting to control the client Point and Print behavior, including security prompts for Windows Vista computers. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -41,26 +42,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -106,7 +115,6 @@ ADMX Info: - GP ADMX file name: *Printing.admx* - Example ``` @@ -129,26 +137,34 @@ Data type: String Value: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -204,26 +220,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -261,12 +285,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 65dea5a83d..ca873b0393 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1,18 +1,21 @@ --- title: Policy CSP - Privacy -description: Policy CSP - Privacy +description: Learn how the Policy CSP - Privacy setting allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/09/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Privacy + +
          @@ -300,26 +303,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3check mark3check mark3Homecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -356,26 +367,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -416,26 +435,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -476,26 +503,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -537,26 +572,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -604,26 +647,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3check mark3check mark3Homecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -662,26 +713,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -725,26 +784,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -777,26 +844,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -829,26 +904,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -881,26 +964,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecross mark
          Educationcross mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -921,13 +1012,12 @@ Value type is integer. -ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_Enum -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx - +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -948,26 +1038,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecross mark
          Educationcross mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -988,13 +1086,12 @@ Value type is chr. -ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx - +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1010,26 +1107,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecross mark
          Educationcross mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1040,7 +1145,7 @@ ADMX Info: -Added in Windows 10, version 1903. +Added in Windows 10, version 1903. > [!NOTE] > Currently, this policy is supported only in HoloLens 2. @@ -1050,12 +1155,13 @@ Value type is chr. -ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + @@ -1064,36 +1170,40 @@ ADMX Info:
          - - -
          - **Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcross markcross markcross markcross markcross markHomecross mark
          Procross mark
          Businesscross mark
          Enterprisecross mark
          Educationcross mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1115,12 +1225,13 @@ Value type is chr. -ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + @@ -1135,26 +1246,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1198,26 +1317,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1250,26 +1377,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1302,26 +1437,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1354,26 +1497,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1417,26 +1568,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1469,26 +1628,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1521,26 +1688,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1573,26 +1748,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1636,26 +1819,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1688,26 +1879,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1740,26 +1939,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1792,26 +1999,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1855,26 +2070,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1907,26 +2130,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1959,26 +2190,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2011,26 +2250,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2074,26 +2321,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2126,26 +2381,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2178,26 +2441,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2230,26 +2501,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2273,26 +2552,34 @@ This policy setting specifies whether Windows apps can access the eye tracker. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2316,26 +2603,34 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2359,26 +2654,34 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2402,26 +2705,34 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2465,26 +2776,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2517,26 +2836,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2569,26 +2896,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2621,26 +2956,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2684,26 +3027,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2736,26 +3087,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2788,26 +3147,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2840,26 +3207,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2903,26 +3278,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2955,26 +3338,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3007,26 +3398,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3059,26 +3458,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3122,26 +3529,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3174,26 +3589,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3226,26 +3649,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3278,26 +3709,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3341,26 +3780,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3393,26 +3840,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3445,26 +3900,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3497,26 +3960,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3560,26 +4031,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3612,26 +4091,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3664,26 +4151,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3716,26 +4211,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3779,26 +4282,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3831,26 +4342,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3883,26 +4402,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3935,26 +4462,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3987,26 +4522,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4039,26 +4582,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4091,26 +4642,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4143,26 +4702,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4206,26 +4773,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4258,26 +4833,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4310,26 +4893,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4362,26 +4953,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          checkmark mark6checkmark mark6check mark6check mark6check mark6Homecheck mark6
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4397,11 +4996,11 @@ Specifies if Windows apps can be activated by voice. ADMX Info: -- GP English name: *Allow voice activation* -- GP name: *LetAppsActivateWithVoice* -- GP element: *LetAppsActivateWithVoice_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* +- GP English name: *Allow voice activation* +- GP name: *LetAppsActivateWithVoice* +- GP element: *LetAppsActivateWithVoice_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -4417,31 +5016,39 @@ The following list shows the supported values:
          -**Privacy/LetAppsActivateWithVoiceAboveLock** +**Privacy/LetAppsActivateWithVoiceAboveLock** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark6check mark6check mark6check mark6check mark6Homecheck mark6
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4457,11 +5064,11 @@ Specifies if Windows apps can be activated by voice while the screen is locked. ADMX Info: -- GP English name: *Allow voice activation above locked screen* -- GP name: *LetAppsActivateWithVoiceAboveLock* -- GP element: *LetAppsActivateWithVoiceAboveLock_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* +- GP English name: *Allow voice activation above locked screen* +- GP name: *LetAppsActivateWithVoiceAboveLock* +- GP element: *LetAppsActivateWithVoiceAboveLock_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -4482,26 +5089,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4545,26 +5160,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4597,26 +5220,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4649,26 +5280,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4701,26 +5340,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4766,26 +5413,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4818,26 +5473,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4870,26 +5533,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4922,26 +5593,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4985,26 +5664,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5037,26 +5724,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5089,26 +5784,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5141,26 +5844,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3check mark3check mark3check mark3Homecheck mark3
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5199,26 +5910,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark5check mark5check mark5check mark5check mark5Homecheck mark5
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5241,56 +5960,18 @@ ADMX Info: - - - - -## Privacy policies supported by HoloLens 2 - -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [LetAppsAccessAccountInfo](#privacy-letappsaccessaccountinfo) -- [LetAppsAccessAccountInfo_ForceAllowTheseApps](#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [LetAppsAccessAccountInfo_ForceDenyTheseApps](#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [LetAppsAccessBackgroundSpatialPerception](#privacy-letappsaccessbackgroundspatialperception) -- [LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) -- [LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) -- [LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessLocation](#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessMicrophone](#privacy-letappsaccessmicrophone) - - - -## Privacy policies supported by HoloLens (1st gen) Commercial Suite - -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) - - - -## Privacy policies supported by HoloLens (1st gen) Development Edition - -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) - - -## Privacy policies supported by Windows 10 IoT Core -- [Privacy/LetAppsActivateWithVoice](#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](#privacy-letappsactivatewithvoiceabovelock) - - - -## Privacy policies supported by Windows 10 IoT Enterprise -- [Privacy/LetAppsActivateWithVoice](#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](#privacy-letappsactivatewithvoiceabovelock) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 338d517c12..340bef38c2 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -1,12 +1,13 @@ --- title: Policy CSP - RemoteAssistance -description: Policy CSP - RemoteAssistance +description: Learn how the Policy CSP - RemoteAssistance setting allows you to specify a custom message to display. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -44,26 +45,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -112,26 +121,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -176,26 +193,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -248,26 +273,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -336,12 +369,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index c9c9ba51bf..a33ad83d33 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,12 +1,13 @@ --- title: Policy CSP - RemoteDesktopServices -description: Policy CSP - RemoteDesktopServices +description: Learn how the Policy CSP - RemoteDesktopServices setting allows you to configure remote access to computers by using Remote Desktop Services. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -50,26 +51,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -118,26 +127,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -190,26 +207,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -256,26 +281,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -318,26 +351,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -386,26 +427,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -447,12 +496,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index f176045650..fae950baec 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -1,12 +1,13 @@ --- title: Policy CSP - RemoteManagement -description: Policy CSP - RemoteManagement +description: Learn how the Policy CSP - RemoteManagement setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -77,26 +78,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -139,26 +148,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -201,26 +218,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -263,26 +288,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -325,26 +358,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -400,26 +441,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -462,26 +511,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -524,26 +581,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -586,26 +651,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -648,26 +721,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -710,26 +791,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -774,26 +863,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -842,26 +939,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -904,26 +1009,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -970,26 +1083,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1029,12 +1150,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index ade921ae21..493027a454 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -1,12 +1,13 @@ --- title: Policy CSP - RemoteProcedureCall -description: Policy CSP - RemoteProcedureCall +description: The Policy CSP - RemoteProcedureCall setting controls whether RPC clients authenticate when the call they are making contains authentication information. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -38,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -104,26 +113,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -171,12 +188,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 21cfd117d2..ac6201611a 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -1,12 +1,13 @@ --- title: Policy CSP - RemoteShell -description: Policy CSP - RemoteShell +description: Learn details about the Policy CSP - RemoteShell setting so that you can configure access to remote shells. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -53,26 +54,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -115,26 +124,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -179,26 +196,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -243,26 +268,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -307,26 +340,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -369,26 +410,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -401,7 +450,7 @@ ADMX Info: This policy setting configures the maximum number of concurrent shells any user can remotely open on the same system. -Any number from 0 to 0x7FFFFFFF cand be set, where 0 means unlimited number of shells. +Any number from 0 to 0x7FFFFFFF can be set, where 0 means unlimited number of shells. If you enable this policy setting, the user cannot open new remote shells if the count exceeds the specified limit. @@ -433,26 +482,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -484,12 +541,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 2ee10fa612..4b9506c5c9 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -1,18 +1,22 @@ --- title: Policy CSP - RestrictedGroups -description: Policy CSP - RestrictedGroups +description: Learn how the Policy CSP - RestrictedGroups setting allows an administrator to define the members that are part of a security-sensitive (restricted) group. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/15/2018 +ms.localizationpriority: medium +ms.date: 04/07/2020 ms.reviewer: manager: dansimp --- # Policy CSP - RestrictedGroups +> [!IMPORTANT] +> Starting from Windows 10, version 20H2, it is recommended to use the [LocalUsersandGroups](policy-csp-localusersandgroups.md) policy instead of the RestrictedGroups policy to configure members (users or AAD groups) to a Windows 10 local group. Applying both the policies to the same device is unsupported and may yield unpredictable results. +
          @@ -34,32 +38,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -70,11 +76,18 @@ Footnote: -This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. +This security setting allows an administrator to define the members that are part of a security-sensitive (restricted) group. When a Restricted Groups policy is enforced, any current member of a restricted group that is not on the Members list is removed, except for the built-in administrator in the built-in Administrators group. Any user on the Members list who is not currently a member of the restricted group is added. An empty Members list means that the restricted group has no members. The membership configuration is based on SIDS, therefore renaming these built-in groups does not affect retention of this special membership. -Caution: If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. +For example, you can create a Restricted Groups policy to allow only specified users, Alice and John, to be members of the Backup Operators group. When this policy is refreshed, only Alice and John will remain as members of the Backup Operators group and all other members will be removed. -Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. +> [!CAUTION] +> Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: +> +> | Error Code | Symbolic Name | Error Description | Header | +> |----------|----------|----------|----------| +> | 0x55b (Hex)
          1371 (Dec) |ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.| winerror.h | + +Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of zero members when applying the policy implies clearing the access group and should be used with caution. ```xml @@ -117,30 +130,56 @@ Starting in Windows 10, version 1809, you can use this schema for retrieval and -Here is an example: +Here's an example: ``` - - - - + + + - - - + + + ``` +where: +- `` contains the local group SID or group name to configure. If a SID is specified here, the policy uses the [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. +- `` contains the members to add to the group in ``. A member can be specified as a name or as a SID. For best results, use a SID for ``. The member SID can be a user account or a group in AD, Azure AD, or on the local machine. If a name is specified here, the policy will try to get the corresponding SID using the [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. Name can be used for a user account or a group in AD or on the local machine. Membership is configured using the [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. +- In this example, `Group1` and `Group2` are local groups on the device being configured, and `Group3` is a domain group. + +> [!NOTE] +> Currently, the RestrictedGroups/ConfigureGroupMembership policy does not have a MemberOf functionality. However, you can add a domain group as a member to a local group by using the member portion, as shown in the previous example. +### Policy timeline + +The behavior of this policy setting differs in different Windows 10 versions. For Windows 10, version 1809 through version 1909, you can use name in `` and SID in ``. For Windows 10, version 2004, you can use name or SID for both the elements, as described in this topic. + +The following table describes how this policy setting behaves in different Windows 10 versions: + +| Windows 10 version | Policy behavior | +| ------------------ | --------------- | +|Windows 10, version 1803 | Added this policy setting.
          XML accepts group and member only by name.
          Supports configuring the administrators group using the group name.
          Expects member name to be in the account name format. | +| Windows 10, version 1809
          Windows 10, version 1903
          Windows 10, version 1909 | Supports configuring any local group.
          `` accepts only name.
          `` accepts a name or an SID.
          This is useful when you want to ensure a certain local group always has a well-known SID as member. | +| Windows 10, version 2004 | Behaves as described in this topic.
          Accepts name or SID for group and members and translates as appropriate. | + +
          -Take note: -* You should include the local administrator while modifying the administrators group to prevent accidental loss of access -* Include the entire UPN after AzureAD +Footnotes: +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index f551f810e3..5fe588c782 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Search -description: Policy CSP - Search +description: Learn how the Policy CSP - Search setting allows search and Cortana to search cloud sources like OneDrive and SharePoint. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - Search +
          @@ -62,9 +64,6 @@ manager: dansimp
          Search/PreventRemoteQueries
          -
          - Search/SafeSearchPermissions -
          @@ -76,26 +75,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -135,26 +142,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -193,26 +208,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -249,7 +272,6 @@ The following list shows the supported values: -
          @@ -258,26 +280,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -322,26 +352,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -379,15 +417,6 @@ The following list shows the supported values: **Search/AllowStoringImagesFromVisionSearch** - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - This policy has been deprecated. @@ -402,26 +431,34 @@ This policy has been deprecated. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -463,26 +500,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -506,26 +551,34 @@ Allow Windows indexer. Value type is integer. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -567,26 +620,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -625,26 +686,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -687,26 +756,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -750,26 +827,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -812,26 +897,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -864,88 +957,16 @@ The following list shows the supported values:
          - -**Search/SafeSearchPermissions** +Footnotes: - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. Desktop users should use Search/DoNotUseWebResults. - - -Specifies what level of safe search (filtering adult content) is required. - - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Strict, highest filtering against adult content. -- 1 (default) – Moderate filtering against adult content (valid search results will not be filtered). - - - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## Search policies supported by HoloLens 2 - -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - - - -## Search policies supported by HoloLens (1st gen) Commercial Suite - -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - - - -## Search policies supported by HoloLens (1st gen) Development Edition - -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - - -
          - -Footnotes: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 22bddbe478..7c7feb1aeb 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -1,21 +1,19 @@ --- title: Policy CSP - Security -description: Policy CSP - Security +description: Learn how the Policy CSP - Security setting can specify whether to allow the runtime configuration agent to install provisioning packages. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Security -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
          @@ -29,15 +27,9 @@ manager: dansimp
          Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices
          -
          - Security/AllowManualRootCertificateInstallation -
          Security/AllowRemoveProvisioningPackage
          -
          - Security/AntiTheftMode -
          Security/ClearTPMIfNotReady
          @@ -70,26 +62,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -120,26 +120,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Business
          Enterprisecheck mark
          Educationcheck mark
          +
          + > [!NOTE] > This policy has been deprecated in Windows 10, version 1607 @@ -164,88 +172,40 @@ The following list shows the supported values:
          - -**Security/AllowManualRootCertificateInstallation** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether the user is allowed to manually install root and intermediate CA certificates. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
          - **Security/AllowRemoveProvisioningPackage** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -270,86 +230,40 @@ The following list shows the supported values:
          - -**Security/AntiTheftMode** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck markcheck mark
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -  -Allows or disallow Anti Theft Mode on the device. - - - -The following list shows the supported values: - -- 0 – Don't allow Anti Theft Mode. -- 1 (default) – Anti Theft Mode will follow the default device configuration (region-dependent). - - - - -
          - **Security/ClearTPMIfNotReady** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark3check mark3check mark3check mark3cross markcross markHome
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -391,26 +305,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -445,26 +367,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -501,26 +431,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -582,26 +520,34 @@ If the MDM policy is set to "NoRequireAuthentication" (2) - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -638,26 +584,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -688,26 +642,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -741,34 +703,18 @@ The following list shows the supported values: - - - - -## Security policies supported by HoloLens 2 - -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - - - -## Security policies supported by HoloLens (1st gen) Commercial Suite - -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - - - -## Security policies supported by HoloLens (1st gen) Development Edition - -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 9ce3ab68b9..8f43acb2ab 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -1,17 +1,19 @@ --- title: Policy CSP - ServiceControlManager -description: Policy CSP - ServiceControlManager -ms.author: Heidi.Lohr +description: Learn how the Policy CSP - ServiceControlManager setting enables process mitigation options on svchost.exe processes. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: Heidilohr -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 --- # Policy CSP - ServiceControlManager +
          @@ -23,6 +25,7 @@ ms.date: 05/21/2019 +
          @@ -31,26 +34,34 @@ ms.date: 05/21/2019 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcross markcheck mark6check mark6check mark6Homecross mark
          Procross mark
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -67,6 +78,9 @@ If you enable this policy setting, built-in system services hosted in svchost.ex This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, as well as a policy disallowing dynamically-generated code. +> [!IMPORTANT] +> Enabling this policy could cause compatibility issues with third-party software that uses svchost.exe processes (for example, third-party antivirus software). + If you disable or do not configure this policy setting, the stricter security settings will not be applied. @@ -97,16 +111,17 @@ Supported values: - - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index e2a1e35daf..1e16989ede 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Settings -description: Policy CSP - Settings +description: Learn how to use the Policy CSP - Settings setting so that you can allow the user to change Auto Play settings. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -30,9 +31,6 @@ manager: dansimp
          Settings/AllowDateTime
          -
          - Settings/AllowEditDeviceName -
          Settings/AllowLanguage
          @@ -74,26 +72,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -131,26 +137,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -181,26 +195,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -225,82 +247,40 @@ The following list shows the supported values:
          - -**Settings/AllowEditDeviceName** - - - - - - - - - - - - - - - - - - - - - -
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcross markcross markcross markcheck mark1check mark1
          - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
          - - - -Allows editing of the device name. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
          - **Settings/AllowLanguage** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -335,26 +315,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check markcheck mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -389,26 +377,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -443,26 +439,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -497,26 +501,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -551,26 +563,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -601,26 +621,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -655,26 +683,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -705,26 +741,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -765,32 +809,40 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * Device > * User +> * Device
          @@ -835,43 +887,23 @@ ADMX Info: To validate on Desktop, do the following: -1. Open System Settings and verfiy that the About page is visible and accessible. +1. Open System Settings and verify that the About page is visible and accessible. 2. Configure the policy with the following string: "hide:about". 3. Open System Settings again and verify that the About page is no longer accessible. - - - - -## Settings policies supported by HoloLens 2 - -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) - - - -## Settings policies supported by HoloLens (1st gen) Commercial Suite - -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) - - - -## Settings policies supported by HoloLens (1st gen) Development Edition - -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 333716f687..2cdf136faf 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -1,12 +1,13 @@ --- title: Policy CSP - SmartScreen -description: Policy CSP - SmartScreen +description: Use the Policy CSP - SmartScreen setting to allow IT Admins to control whether users are allowed to install apps from places other than the Store. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -41,26 +42,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -74,7 +83,7 @@ manager: dansimp Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. > [!Note] -> This policy will block installation only while the device is online. To block offline installation too, **SmartScreen/PreventOverrideForFilesInShell** and **SmartScreen/EnableSmartScreenInShell** policies should also be enabled. +> This policy will block installation only while the device is online. To block offline installation too, **SmartScreen/PreventOverrideForFilesInShell** and **SmartScreen/EnableSmartScreenInShell** policies should also be enabled.

          This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet. @@ -102,26 +111,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +


          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -160,26 +177,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -212,12 +237,16 @@ The following list shows the supported values:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 0f385479cb..39cd9db038 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Speech -description: Policy CSP - Speech +description: Learn how the Policy CSP - Speech setting specifies whether the device will receive updates to the speech recognition and speech synthesis models. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -35,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
          Procheck mark1
          Businesscheck mark1
          Enterprisecheck mark1
          Educationcheck mark1
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -84,34 +93,18 @@ The following list shows the supported values: - - - - -## Speech policies supported by HoloLens 2 - -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) - - - -## Speech policies supported by HoloLens (1st gen) Commercial Suite - -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) - - - -## Speech policies supported by HoloLens (1st gen) Development Edition - -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) - -
          Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 05e37d1dc9..0b6888322b 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1,21 +1,19 @@ --- title: Policy CSP - Start -description: Policy CSP - Start +description: Use the Policy CSP - Start setting to control the visibility of the Documents shortcut on the Start menu. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Start -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
          @@ -124,26 +122,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -175,26 +181,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -226,26 +240,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -277,26 +299,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -328,26 +358,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -379,26 +417,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -430,26 +476,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -481,26 +535,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -532,26 +594,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -583,26 +653,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -634,26 +712,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -668,13 +754,6 @@ The following list shows the supported values: Enabling this policy prevents context menus from being invoked in the Start Menu. - -The following list shows the supported values: - -- 0 (default) – False (Do not disable). -- 1 - True (disable). - - ADMX Info: - GP English name: *Disable context menus in the Start Menu* @@ -684,6 +763,10 @@ ADMX Info: +The following list shows the supported values: + +- 0 (default) – False (Do not disable). +- 1 - True (disable). @@ -702,26 +785,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -760,26 +851,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -826,26 +925,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -883,30 +990,39 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] +> * User > * Device
          @@ -947,26 +1063,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1008,26 +1132,34 @@ To validate on Laptop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1065,26 +1197,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1100,13 +1240,6 @@ Added in Windows 10, version 1709. Enabling this policy removes the people icon Value type is integer. - -The following list shows the supported values: - -- 0 (default) – False (do not hide). -- 1 - True (hide). - - ADMX Info: - GP English name: *Remove the People Bar from the taskbar* @@ -1115,6 +1248,13 @@ ADMX Info: - GP ADMX file name: *StartMenu.admx* + +The following list shows the supported values: + +- 0 (default) – False (do not hide). +- 1 - True (hide). + +
          @@ -1125,26 +1265,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1185,26 +1333,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1218,7 +1374,7 @@ To validate on Desktop, do the following: > [!NOTE] > This policy requires reboot to take effect. -Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently opened items in the jumplists from appearing. +Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently opened items in the jump lists from appearing. @@ -1233,13 +1389,13 @@ To validate on Desktop, do the following: 1. Enable "Show recently opened items in Jump Lists on Start of the taskbar" in Settings. 2. Pin Photos to the taskbar, and open some images in the photos app. -3. Right click the pinned photos app and verify that a jumplist of recently opened items pops up. +3. Right click the pinned photos app and verify that a jump list of recently opened items pops up. 4. Toggle "Show recently opened items in Jump Lists on Start of the taskbar" in Settings to clear jump lists. 5. Enable policy. 6. Restart explorer.exe 7. Check that Settings toggle is grayed out. 8. Repeat Step 2. -9. Right Click pinned photos app and verify that there is no jumplist of recent items. +9. Right Click pinned photos app and verify that there is no jump list of recent items. @@ -1252,26 +1408,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1324,26 +1488,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1381,26 +1553,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1438,26 +1618,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1495,26 +1683,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1552,26 +1748,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1609,26 +1813,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1670,26 +1882,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1738,26 +1958,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1798,26 +2026,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1856,14 +2092,16 @@ ADMX Info:
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 02d36e60d9..52f43753a2 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -1,20 +1,19 @@ --- title: Policy CSP - Storage -description: Policy CSP - Storage +description: Learn to use the Policy CSP - Storage settings to automatically clean some of the user’s files to free up disk space. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 01/14/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Storage -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
          @@ -61,26 +60,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -121,28 +128,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark6check mark6check mark6check mark6Home
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          - - +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -188,26 +201,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark6check mark6check mark6check mark6Home
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -256,26 +277,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark6check mark6check mark6check mark6Home
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -318,33 +347,40 @@ ADMX Info:
          - **Storage/ConfigStorageSenseDownloadsCleanupThreshold** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark6check mark6check mark6check mark6Home
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -393,26 +429,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark6check mark6check mark6check mark6Home
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -467,26 +511,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark6check mark6check mark6check mark6Home
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -535,26 +587,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -597,26 +657,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -627,7 +695,10 @@ ADMX Info: -If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. Note: To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." +If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!Note] +> To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." Supported values: - 0 - Disable @@ -647,25 +718,27 @@ ADMX Info: +Example for setting the device custom OMA-URI setting to enable this policy: +To deny write access to removable storage within Intune’s custom profile, set OMA-URI to ```.\[device|user]\vendor\msft\policy\[config|result]\Storage/RemovableDiskDenyWriteAccess```, Data type to Integer, and Value to 1. +See [Use custom settings for Windows 10 devices in Intune](https://docs.microsoft.com/intune/custom-settings-windows-10) for information on how to create custom profiles. - - -
          -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 65f8aca2b1..6012a60ed9 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1,12 +1,13 @@ --- title: Policy CSP - System -description: Policy CSP - System +description: Learn policy settings that determine whether users can access the Insider build controls in the advanced options for Windows Update. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 10/14/2020 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - System +
          @@ -100,26 +102,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -164,26 +174,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark6check mark6check mark6check mark6Homecross mark
          Procheck mark6
          Businesscheck mark6
          Enterprisecheck mark6
          Educationcheck mark6
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -194,16 +212,13 @@ The following list shows the supported values: -> [!NOTE] -> This policy setting applies only to the Windows operating system and apps included with Windows, it does not apply to third-party apps or services running on Windows 10. +This policy setting opts the device into the Windows enterprise data pipeline. -This policy setting opts the device into the Windows enterprise data pipeline. +If you enable this setting, data collected from the device will be opted into the Windows enterprise data pipeline. -If you enable this setting, data collected from the device is opted into the Windows enterprise data pipeline. +If you disable or don't configure this setting, all data from the device will be collected and processed in accordance with our policies for the Windows standard data pipeline. -If you disable or do not configure this setting, all data from the device is collected and processed in accordance with the policies for the Windows standard data pipeline. - -Configuring this setting does not change the telemetry collection level or the ability of the user to change the level. +Configuring this setting does not change the telemetry collection level or the ability of the user to change the level. This setting only applies to the Windows operating system and apps included with Windows, not third-party apps or services running on Windows 10. @@ -218,8 +233,8 @@ ADMX Info: The following list shows the supported values: -- 0 (default) - Do not use the Windows Commercial Data Pipeline -- 1 - Use the Windows Commercial Data Pipeline +- 0 (default) - Disabled. +- 1 - Enabled. @@ -238,26 +253,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -281,6 +304,10 @@ ADMX Info: +The following list shows the supported values: + +- 0 (default) – Disabled. +- 1 – Allowed. @@ -299,26 +326,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -351,26 +386,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -395,7 +438,7 @@ The following list shows the supported values: - 0 – Disabled. - 1 (default) – Permits Microsoft to configure device settings only. -- 2 – Allows Microsoft to conduct full experimentations. +- 2 – Allows Microsoft to conduct full experimentation. @@ -408,26 +451,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -438,7 +489,7 @@ The following list shows the supported values: -Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts. +Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally installed fonts. This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled). @@ -459,7 +510,7 @@ ADMX Info: The following list shows the supported values: -- 0 - false - No traffic to fs.microsoft.com and only locally-installed fonts are available. +- 0 - false - No traffic to fs.microsoft.com and only locally installed fonts are available. - 1 - true (default) - There may be network traffic to fs.microsoft.com and downloadable fonts are available to apps that support them. @@ -479,26 +530,34 @@ To verify if System/AllowFontProviders is set to true: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -532,13 +591,12 @@ ADMX Info: The following list shows the supported values: -- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. +- 0 – Force Location Off. All Location Privacy settings are toggled off and grayed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. - 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off. -- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed. +- 2 – Force Location On. All Location Privacy settings are toggled on and grayed out. Users cannot change the settings and all consent permissions will be automatically suppressed. -
          @@ -547,26 +605,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -599,26 +665,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -630,14 +704,11 @@ The following list shows the supported values: -Allow the device to send diagnostic and usage telemetry data, such as Watson. +Allows the device to send diagnostic and usage telemetry data, such as Watson. For more information about diagnostic data, including what is and what is not collected by Windows, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization). -The following tables describe the supported values: - -Windows 8.1 Values: - +The following list shows the supported values for Windows 8.1: - 0 - Not allowed. - 1 – Allowed, except for Secondary Data Requests. - 2 (default) – Allowed. @@ -665,13 +736,12 @@ Windows 8.1 Values: --> -Windows 10 Values: - -- 0 – Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. - Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. -- 1 – Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level. -- 2 – Enhanced. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the Basic and the Security levels. -- 3 – Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels. +In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft. The following list shows the supported values for Windows 10: +- 0 – (**Security**) Sends information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Microsoft Defender. + **Note:** This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), Hololens 2, and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. +- 1 – (**Basic**) Sends the same data as a value of 0, plus additional basic device info, including quality-related data, app compatibility, and app usage data. +- 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows, Windows Server, System Center, and apps are used, how they perform, and advanced reliability data. +- 3 – (**Full**) Sends the same data as a value of 2, plus all data necessary to identify and fix problems with devices. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -763,47 +841,51 @@ Specifies whether to allow the user to factory reset the device by using control Most restricted value is 0. - > [!TIP] > This policy is also applicable to Windows 10 and not exclusive to phone. -> -> The following list shows the supported values: -> orted values: - + + +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed to reset to factory default settings. -
          - **System/BootStartDriverInitialization** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -852,26 +934,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -918,26 +1008,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -962,6 +1060,11 @@ ADMX Info: - GP ADMX file name: *DataCollection.admx* + +The following list shows the supported values: +- 0 (default) - Enable telemetry change notifications +- 1 - Disable telemetry change notifications +
          @@ -972,26 +1075,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark4check mark4check mark4check mark4Homecross mark
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1006,10 +1117,10 @@ This policy setting determines whether people can change their own telemetry lev If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them. -If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings. +If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings. -Note: -Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. +> [!Note] +> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's acceptable level of data disclosure. @@ -1021,6 +1132,11 @@ ADMX Info: - GP ADMX file name: *DataCollection.admx* + +The following list shows the supported values: +- 0 (default) - Enable Telemetry opt-in Settings +- 1 - Disable Telemetry opt-in Settings +
          @@ -1031,26 +1147,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1094,26 +1218,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark5check mark5check mark5check mark5Homecross mark
          Procheck mark5
          Businesscheck mark5
          Enterprisecheck mark5
          Educationcheck mark5
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1157,26 +1289,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1209,26 +1349,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
          Procheck mark2
          Businesscheck mark2
          Enterprisecheck mark2
          Educationcheck mark2
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1283,26 +1431,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
          Procheck mark
          Businesscheck mark
          Enterprisecheck mark
          Educationcheck mark
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1351,26 +1507,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          check mark4check mark4check mark4check mark4check mark4Homecheck mark4
          Procheck mark4
          Businesscheck mark4
          Enterprisecheck mark4
          Educationcheck mark4
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1401,26 +1565,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
          cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
          Procheck mark3
          Businesscheck mark3
          Enterprisecheck mark3
          Educationcheck mark3
          +
          + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1434,7 +1606,7 @@ The following list shows the supported values: This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. -To enable this behavior you must complete two steps: +To enable this behavior, you must complete two steps:
          • Enable this policy setting
          • Set Allow Telemetry to level 2 (Enhanced)
          • @@ -1466,26 +1638,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1520,26 +1700,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1578,39 +1766,17 @@ The following list shows the supported values: - - - - -## System policies supported by HoloLens 2 - -- [System/AllowCommercialDataPipeline](#system-allowcommercialdatapipeline) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/AllowTelemetry](#system-allowtelemetry) - - - -## System policies supported by HoloLens (1st gen) Commercial Suite - -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) - - - -## System policies supported by HoloLens (1st gen) Development Edition - -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) - -
            Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 1b98e5a487..a7f98a6c0c 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,12 +1,13 @@ --- title: Policy CSP - SystemServices -description: Policy CSP - SystemServices +description: Learn how to use the Policy CSP - SystemServices setting to determine whether the service's start type is Automatic(2), Manual(3), Disabled(4). ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - SystemServices +
            @@ -49,26 +51,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -98,26 +108,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -147,26 +165,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -196,26 +222,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -245,26 +279,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -294,26 +336,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -336,12 +386,16 @@ GP Info:
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 1553b89d93..ce84398393 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -1,21 +1,19 @@ --- title: Policy CSP - TaskManager -description: Policy CSP - TaskManager +description: Learn how to use the Policy CSP - TaskManager setting to determine whether non-administrators can use Task Manager to end tasks. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/05/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - TaskManager -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
            @@ -37,26 +35,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5cross markcheck mark5check mark5Homecross mark
            Procheck mark5
            Businesscross mark
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -89,14 +95,16 @@ When the policy is set to 0 - users CANNOT execute 'End task' on processes in Ta
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index ca2b448d50..ab6ec4d46c 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -1,12 +1,13 @@ --- title: Policy CSP - TaskScheduler -description: Policy CSP - TaskScheduler +description: Learn how to use the Policy CSP - TaskScheduler setting to determine whether the specific task is enabled (1) or disabled (0). ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - TaskScheduler +
            @@ -34,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -70,12 +80,15 @@ Added in Windows 10, version 1803. This setting determines whether the specific
            -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +Footnotes: +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index ce3e59ecc4..99360d692b 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,20 +1,19 @@ --- title: Policy CSP - TextInput -description: Policy CSP - TextInput +description: The Policy CSP - TextInput setting allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/09/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - TextInput -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
            @@ -59,6 +58,15 @@ manager: dansimp
            TextInput/AllowLinguisticDataCollection
            +
            + TextInput/ConfigureJapaneseIMEVersion +
            +
            + TextInput/ConfigureSimplifiedChineseIMEVersion +
            +
            + TextInput/ConfigureTraditionalChineseIMEVersion +
            TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
            @@ -103,6 +111,8 @@ manager: dansimp **TextInput/AllowHardwareKeyboardTextSuggestions** +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -126,26 +136,34 @@ Added in Windows 10, version 1803. Placeholder only. Do not use in production e - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -182,26 +200,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -236,26 +262,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -292,26 +326,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -349,26 +391,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -405,26 +455,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -461,26 +519,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -517,26 +583,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -577,6 +651,8 @@ To validate that text prediction is disabled on Windows 10 for desktop, do the f **TextInput/AllowKoreanExtendedHanja** +
            + This policy has been deprecated. @@ -591,26 +667,34 @@ This policy has been deprecated. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -655,26 +739,33 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -705,32 +796,229 @@ This setting supports a range of values between 0 and 1.
            + +**TextInput/ConfigureJapaneseIMEVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark8
            Businesscheck mark8
            Enterprisecheck mark8
            Educationcheck mark8
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +> [!NOTE] +> - The policy is only enforced in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in Windows 10, version 2004. Allows IT admins to configure Microsoft Japanese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Japanese IME version to use. The previous version of Microsoft Japanese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is always selected. + + + + +
            + + +**TextInput/ConfigureSimplifiedChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark8
            Businesscheck mark8
            Enterprisecheck mark8
            Educationcheck mark8
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +> [!NOTE] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in Windows 10, version 2004. Allows IT admins to configure Microsoft Simplified Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The previous version of Microsoft Simplified Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is always selected. + + + + +
            + + +**TextInput/ConfigureTraditionalChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark8
            Businesscheck mark8
            Enterprisecheck mark8
            Educationcheck mark8
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +> [!NOTE] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in Windows 10, version 2004. Allows IT admins to configure Microsoft Traditional Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The previous version of Microsoft Traditional Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is always selected. + + + + +
            + **TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -767,26 +1055,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -821,26 +1117,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -875,26 +1179,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -929,26 +1241,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -980,26 +1300,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1031,26 +1359,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1082,26 +1418,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1133,26 +1477,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1184,26 +1536,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1235,26 +1595,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1286,26 +1654,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1330,30 +1706,16 @@ The following list shows the supported values:
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - -## TextInput policies supported by Microsoft Surface Hub - -- [TextInput/AllowIMELogging](#textinput-allowimelogging) -- [TextInput/AllowIMENetworkAccess](#textinput-allowimenetworkaccess) -- [TextInput/AllowInputPanel](#textinput-allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](#textinput-allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](#textinput-allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](#textinput-allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](#textinput-allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](#textinput-allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](#textinput-excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](#textinput-excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](#textinput-excludejapaneseimeexceptshiftjis) - - diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index 5feefe04ae..8ef9349148 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,12 +1,13 @@ --- title: Policy CSP - TimeLanguageSettings -description: Policy CSP - TimeLanguageSettings +description: Learn to use the Policy CSP - TimeLanguageSettings setting to specify the time zone to be applied to the device. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/15/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,71 +15,19 @@ manager: dansimp # Policy CSP - TimeLanguageSettings +
            ## TimeLanguageSettings policies
            -
            - TimeLanguageSettings/AllowSet24HourClock -
            TimeLanguageSettings/ConfigureTimeZone
            -
            - - -**TimeLanguageSettings/AllowSet24HourClock** - - - - - - - - - - - - - - - - - - - - - -
            HomeProBusinessEnterpriseEducationMobileMobile Enterprise
            cross markcross markcross markcross markcross markcheck mark2check mark2
            - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
            - - - -Allows for the configuration of the default clock setting to be the 24 hour format. If set to 0 (zero), the device uses the default clock as prescribed by the current locale setting. - - - -The following list shows the supported values: - -- 0 (default) – Current locale setting. -- 1 – Set 24 hour clock. - - - -
            @@ -87,26 +36,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -130,16 +87,18 @@ Specifies the time zone to be applied to the device. This is the standard Window - - -
            Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index ec68e060bc..c7862d0866 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -1,17 +1,19 @@ --- title: Policy CSP - Troubleshooting -description: Policy CSP - Troubleshooting -ms.author: maricia +description: The Policy CSP - Troubleshooting setting allows IT admins to configure how to apply recommended troubleshooting for known problems on the devices in their domains. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 --- # Policy CSP - Troubleshooting +
            @@ -32,26 +34,34 @@ ms.date: 05/21/2019 - - - - - - - + + + + + + + + + + + + + + + - -
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            Home cross mark
            Pro check mark6
            Business check mark6
            Enterprise check mark6
            Education check mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -65,7 +75,14 @@ ms.date: 05/21/2019 This policy setting allows IT admins to configure how to apply recommended troubleshooting for known problems on the devices in their domains or IT environments. + +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* +- GP name: *TroubleshootingAllowRecommendations* +- GP path: *Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + This is a numeric policy setting with merge algorithm (lowest value is the most secure) that uses the most restrictive settings for complex manageability scenarios. @@ -112,14 +129,6 @@ By default, this policy is not configured and the SKU based defaults are used fo - -ADMX Info:
            - GP English name: Troubleshooting: Allow users to access recommended troubleshooting for known problems -- GP name: TroubleshootingAllowRecommendations -- GP path: Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool -- GP ADMX file name: MSDT.admx - - - @@ -127,15 +136,18 @@ ADMX Info:
            - GP English name: Troubleshooting: Allow users to access r - -
            Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index b0de2a2be1..df70a21a7c 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Update -description: Policy CSP - Update +description: The Policy CSP - Update allows the IT admin, when used with Update/ActiveHoursStart, to manage a range of active hours where update reboots aren't scheduled. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 11/03/2020 ms.reviewer: manager: dansimp --- @@ -95,6 +96,9 @@ manager: dansimp
            Update/DisableDualScan
            +
            + Update/DisableWUfBSafeguards +
            Update/EngagedRestartDeadline
            @@ -191,6 +195,12 @@ manager: dansimp
            Update/SetEDURestart
            +
            + Update/SetProxyBehaviorForUpdateDetection +
            +
            + Update/TargetReleaseVersion +
            Update/UpdateNotificationLevel
            @@ -202,10 +212,6 @@ manager: dansimp -
            - -> [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
            @@ -215,26 +221,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -274,26 +288,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -330,26 +352,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -389,26 +419,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -423,11 +461,6 @@ Enables the IT admin to manage automatic update behavior to scan, download, and Supported operations are Get and Replace. - -> [!IMPORTANT] -> This option should be used only for systems under regulatory compliance, as you will not get security updates as well. - - If the policy is not configured, end-users get the default behavior (Auto install and restart). @@ -450,6 +483,11 @@ The following list shows the supported values: - 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. - 5 – Turn off automatic updates. + +> [!IMPORTANT] +> This option should be used only for systems under regulatory compliance, as you will not get security updates as well. + + @@ -461,26 +499,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -523,26 +569,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -582,26 +636,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -636,26 +698,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -701,26 +771,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -769,26 +847,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5check mark5check mark5check mark5Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -837,26 +923,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -895,26 +989,34 @@ Supported values are 15, 30, 60, 120, and 240 (minutes). - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -954,26 +1056,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -993,7 +1103,6 @@ If you enable this policy setting, Automatic Maintenance attempts to set OS wake If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel applies. - ADMX Info: - GP English name: *Automatic Maintenance WakeUp Policy* @@ -1004,8 +1113,8 @@ ADMX Info: Supported values: -- true - Enable -- false - Disable (Default) +- 0 - Disable (Default) +- 1 - Enable @@ -1023,26 +1132,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1072,7 +1189,7 @@ The following list shows the supported values: - 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) - 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) - 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). -- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903) +- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) @@ -1085,26 +1202,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1115,16 +1240,9 @@ The following list shows the supported values: -Added in Windows 10, version 1903. Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. - - -Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. - -Default value is 7. - - ADMX Info: - GP English name: *Specify deadlines for automatic updates and restarts* @@ -1134,7 +1252,11 @@ ADMX Info: - GP ADMX file name: *WindowsUpdate.admx* + +Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. +Default value is 7. + @@ -1151,26 +1273,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1181,9 +1311,9 @@ ADMX Info: -Added in Windows 10, version 1903. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. - +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. + ADMX Info: - GP English name: *Specify deadlines for automatic updates and restarts* @@ -1214,26 +1344,34 @@ Default value is 7. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1244,9 +1382,10 @@ Default value is 7. -Added in Windows 10, version 1903. Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies. - +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies. + + ADMX Info: - GP English name: *Specify deadlines for automatic updates and restarts* @@ -1277,26 +1416,34 @@ Default value is 2. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1307,11 +1454,11 @@ Default value is 2. -Added in Windows 10, version 1903. If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart. + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart. When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline. - ADMX Info: - GP English name: *Specify deadlines for automatic updates and restarts* @@ -1342,26 +1489,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1379,75 +1534,40 @@ Added in Windows 10, version 1803. Enable IT admin to configure feature update u
            - -**Update/ConfigureFeatureUpdateUninstallPeriod** - - - - - - - - - - - - - - - - - - - - - -
            HomeProBusinessEnterpriseEducationMobileMobile Enterprise
            cross markcheck mark4check mark4check mark4check mark4cross markcross mark
            - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
            - - - -Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. - - - - -
            - **Update/DeferFeatureUpdatesPeriodInDays** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1487,26 +1607,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1541,26 +1669,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1684,26 +1820,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1746,26 +1890,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1776,7 +1928,7 @@ ADMX Info: -Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours. +Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should only be enabled when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update. @@ -1798,26 +1950,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1856,32 +2016,119 @@ The following list shows the supported values:
            + +**Update/DisableWUfBSafeguards** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +Available in Windows Update for Business (WUfB) devices running Windows 10, version 1809 and above and installed with October 2020 security update. This policy setting specifies that a WUfB device should skip safeguards. + +Safeguard holds prevent a device with a known compatibility issue from being offered a new OS version. The offering will proceed once a fix is issued and is verified on a held device. The aim of safeguards is to protect the device and user from a failed or poor upgrade experience. + +The safeguard holds protection is provided by default to all the devices trying to update to a new Windows 10 Feature Update version via Windows Update. + +IT admins can, if necessary, opt devices out of safeguard protections using this policy setting or via the “Disable safeguards for Feature Updates” Group Policy. + +> [!NOTE] +> Opting out of the safeguards can put devices at risk from known performance issues. We recommend opting out only in an IT environment for validation purposes. Further, you can leverage the Windows Insider Program for Business Release Preview Channel in order to validate the upcoming Windows 10 Feature Update version without the safeguards being applied. +> +> The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. +> +> Disabling safeguards does not guarantee your device will be able to successfully update. The update may still fail on the device and will likely result in a bad experience post upgrade as you are bypassing the protection given by Microsoft pertaining to known issues. + + + +ADMX Info: +- GP English name: *Disable safeguards for Feature Updates* +- GP name: *DisableWUfBSafeguards* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + + +The following list shows the supported values: + +- 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. +- 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards. + + + + +
            + **Update/EngagedRestartDeadline** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1932,26 +2179,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5check mark5check mark5check mark5Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1997,26 +2252,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2060,26 +2323,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5check mark5check mark5check mark5Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2123,26 +2394,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2186,26 +2465,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5check mark5check mark5check mark5Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2249,26 +2536,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2310,26 +2605,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2372,26 +2675,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2418,13 +2729,11 @@ The following list shows the supported values: To validate this policy: -1. Enable the policy ensure the device is on a cellular network. +1. Enable the policy and ensure the device is on a cellular network. 2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: - - `regd delete HKEY_USERS\S-1-5-21-2702878673-795188819-444038987-2781\software\microsoft\windows\currentversion\windowsupdate /v LastAutoAppUpdateSearchSuccessTime /f` - - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\Automatic App Update"""" /I""` - -3. Verify that any downloads that are above the download size limit will complete without being paused. + ```TShell + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + ``` @@ -2437,26 +2746,34 @@ To validate this policy: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2472,11 +2789,6 @@ Added in Windows 10, version 1703. Specifies whether to ignore the MO download > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. - - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""` - -3. Verify that any downloads that are above the download size limit will complete without being paused. - The following list shows the supported values: @@ -2489,7 +2801,10 @@ The following list shows the supported values: To validate this policy: 1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell: +2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: + ```TShell + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + ``` @@ -2502,26 +2817,34 @@ To validate this policy: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3cross markcheck mark2Homecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2562,26 +2885,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2628,26 +2959,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2661,7 +3000,7 @@ The following list shows the supported values: Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. -Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. +Added in Windows 10, version 1607. Allows IT Admins to pause feature updates for up to 35 days. We recomment that you use the *Update/PauseFeatureUpdatesStartTime* policy if you are running Windows 10, version 1703 or later. @@ -2677,7 +3016,7 @@ ADMX Info: The following list shows the supported values: - 0 (default) – Feature Updates are not paused. -- 1 – Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner. +- 1 – Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner. @@ -2690,26 +3029,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2720,7 +3067,7 @@ The following list shows the supported values: -Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates. +Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date. Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. @@ -2744,26 +3091,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2774,7 +3129,7 @@ ADMX Info: -Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. +Added in Windows 10, version 1607. Allows IT Admins to pause quality updates. For those running Windows 10, version 1703 or later, we recommend that you use *Update/PauseQualityUpdatesStartTime* instead. @@ -2803,26 +3158,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2833,7 +3196,7 @@ The following list shows the supported values: -Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates. +Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. @@ -2854,15 +3217,6 @@ ADMX Info: **Update/PhoneUpdateRestrictions** - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
            - - This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupdateapproval) instead. @@ -2877,26 +3231,34 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2938,26 +3300,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2969,7 +3339,7 @@ The following list shows the supported values: > [!NOTE] -> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. +> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. @@ -2994,26 +3364,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3052,26 +3430,34 @@ Supported values are 15, 30, or 60 (minutes). - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3114,26 +3500,34 @@ Supported values are 2, 4, 8, 12, or 24 (hours). - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3183,26 +3577,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3239,26 +3641,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3295,26 +3705,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3351,26 +3769,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3407,26 +3833,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3463,26 +3897,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3527,26 +3969,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3586,26 +4036,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5check mark5check mark5check mark5Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3637,26 +4095,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5check mark5check mark5check mark5Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3688,26 +4154,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3742,32 +4216,41 @@ The following list shows the supported values:
            + -**Update/UpdateNotificationLevel** +**Update/SetProxyBehaviorForUpdateDetection** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark5check mark5check mark5check mark5Homecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3778,7 +4261,146 @@ The following list shows the supported values: -Display options for update notifications. This policy allows you to define what Windows Update notifications users see. This policy doesn’t control how and when updates are downloaded and installed. +Available in Windows 10, version 1607 and later. By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP based intranet server despite the vulnerabilities it presents. + +This policy setting does not impact those customers who have, per Microsoft recommendation, secured their WSUS server with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. That said, if a proxy is required, we recommend configuring a system proxy to ensure the highest level of security. + + + +ADMX Info: +- GP English name: *Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service* +- GP name: *Select the proxy behavior* +- GP element: *Select the proxy behavior* +- GP path: *Windows Components/Windows Update/Specify intranet Microsoft update service location* +- GP ADMX file name: *WindowsUpdate.admx* + + + +The following list shows the supported values: + +- 0 (default) - Allow system proxy only for HTTP scans. +- 1 - Allow user proxy to be used as a fallback if detection using system proxy fails. +> [!NOTE] +> Configuring this policy setting to 1 exposes your environment to potential security risk and makes scans unsecure. + + + + +
            + + +**Update/TargetReleaseVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +Available in Windows 10, version 1803 and later. Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](https://docs.microsoft.com/windows/release-information/). + + +ADMX Info: +- GP English name: *Select the target Feature Update version* +- GP name: *TargetReleaseVersion* +- GP element: *TargetReleaseVersionId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Value type is a string containing Windows 10 version number. For example, 1809, 1903. + + + + + + + + + +
            + + +**Update/UpdateNotificationLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +Display options for update notifications. This policy allows you to define what Windows Update notifications users see. This policy doesn't control how and when updates are downloaded and installed. Options: @@ -3787,7 +4409,7 @@ Options: - 2 – Turn off all notifications, including restart warnings > [!IMPORTANT] -> If you choose not to get update notifications and also define other Group policies so that devices aren’t automatically getting updates, neither you nor device users will be aware of critical security, quality, or feature updates, and your devices may be at risk. +> If you choose not to get update notifications and also define other Group policies so that devices aren't automatically getting updates, neither you nor device users will be aware of critical security, quality, or feature updates, and your devices may be at risk. @@ -3817,26 +4439,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3848,7 +4478,7 @@ ADMX Info: > [!IMPORTANT] -> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enteprise and IoT Mobile. +> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enterprise and IoT Mobile. Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet. @@ -3901,26 +4531,34 @@ Example - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3955,76 +4593,17 @@ ADMX Info: - - - - -## Update policies supported by HoloLens 2 - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/BranchReadinessLevel](#update-branchreadinesslevel) -- [Update/DeferFeatureUpdatesPeriodInDays](#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](#update-deferqualityupdatesperiodindays) -- [Update/ManagePreviewBuilds](#update-managepreviewbuilds) -- [Update/PauseFeatureUpdates](#update-pausefeatureupdates) -- [Update/PauseQualityUpdates](#update-pausequalityupdates) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - - -## Update policies supported by HoloLens (1st gen) Commercial Suite - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - - -## Update policies supported by HoloLens (1st gen) Development Edition - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - - -## Update policies supported by IoT Core - -- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) - - - -## Update policies supported by IoT Enterprise - -- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) - -
            +
            Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index bf7b2a8067..b1a0a67245 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,12 +1,13 @@ --- title: Policy CSP - UserRights -description: Policy CSP - UserRights +description: Learn how user rights are assigned for user accounts or groups, and how the name of the policy defines the user right in question. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 10/31/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,11 +15,14 @@ manager: dansimp # Policy CSP - UserRights +
            -User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. Here is a list for reference, [Well-Known SID Structures](https://msdn.microsoft.com/library/cc980032.aspx). Even though strings are supported for well-known accounts and groups, it is better to use SIDs because strings are localized for different languages. Some user rights allow things like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork. +User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. For reference, see [Well-Known SID Structures](https://msdn.microsoft.com/library/cc980032.aspx). -Here is an example syncml for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. +Even though strings are supported for well-known accounts and groups, it is better to use SIDs, because strings are localized for different languages. Some user rights allow things like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork. + +Here is an example for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. ```xml @@ -44,44 +48,58 @@ Here is an example syncml for setting the user right BackupFilesAndDirectories f Here are examples of data fields. The encoded 0xF000 is the standard delimiter/separator. -- Grant an user right to Administrators group via SID: - ``` +- Grant a user right to Administrators group via SID: + ```xml *S-1-5-32-544 ``` -- Grant an user right to multiple groups (Administrators, Authenticated Users) via SID - ``` - *S-1-5-32-544*S-1-5-11 +- Grant a user right to multiple groups (Administrators, Authenticated Users) via SID: + ```xml + *S-1-5-32-544*S-1-5-11 ``` -- Grant an user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings - ``` - *S-1-5-32-544Authenticated Users +- Grant a user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings: + ```xml + *S-1-5-32-544Authenticated Users ``` -- Grant an user right to multiple groups (Authenticated Users, Administrators) via strings - ``` - Authenticated UsersAdministrators +- Grant a user right to multiple groups (Authenticated Users, Administrators) via strings: + ```xml + Authenticated UsersAdministrators ``` -- Empty input indicates that there are no users configured to have that user right - ``` +- Empty input indicates that there are no users configured to have that user right: + ```xml ``` + If you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag (``) to wrap the data fields. You can specify one or more user groups within the CDATA tag by using 0xF000 as the delimiter/separator. -> [!Note] +> [!NOTE] > `` is the entity encoding of 0xF000. For example, the following syntax grants user rights to Authenticated Users and Replicator user groups: -``` + +```xml ``` +For example, the following syntax grants user rights to two specific Azure Active Directory (AAD) users from Contoso, user1 and user2: + +```xml + +``` + +For example, the following syntax grants user rights to a specific user or group, by using the Security Identifier (SID) of the account or group: + +```xml + +``` +
            -## UserRights policies +## UserRights policies
            @@ -177,31 +195,39 @@ For example, the following syntax grants user rights to Authenticated Users and
            -**UserRights/AccessCredentialManagerAsTrustedCaller** +**UserRights/AccessCredentialManagerAsTrustedCaller** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -216,8 +242,8 @@ This user right is used by Credential Manager during Backup/Restore. No accounts -GP Info: -- GP English name: *Access Credential Manager ase a trusted caller* +GP Info: +- GP English name: *Access Credential Manager as a trusted caller* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -226,31 +252,39 @@ GP Info:
            -**UserRights/AccessFromNetwork** +**UserRights/AccessFromNetwork** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -261,11 +295,13 @@ GP Info: -This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. +This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right. +> [!NOTE] +> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. -GP Info: +GP Info: - GP English name: *Access this computer from the network* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -275,31 +311,39 @@ GP Info:
            -**UserRights/ActAsPartOfTheOperatingSystem** +**UserRights/ActAsPartOfTheOperatingSystem** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -310,11 +354,13 @@ GP Info: -This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. +This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Act as part of the operating system* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -324,31 +370,39 @@ GP Info:
            -**UserRights/AllowLocalLogOn** +**UserRights/AllowLocalLogOn** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -359,11 +413,13 @@ GP Info: -This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. +This user right determines which users can log on to the computer. +> [!NOTE] +> Modifying this setting might affect compatibility with clients, services, and applications. For compatibility information about this setting, see [Allow log on locally](https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. -GP Info: +GP Info: - GP English name: *Allow log on locally* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -373,31 +429,39 @@ GP Info:
            -**UserRights/BackupFilesAndDirectories** +**UserRights/BackupFilesAndDirectories** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -408,11 +472,13 @@ GP Info: -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system: Traverse Folder/Execute File, Read. +> [!CAUTION] +> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Back up files and directories* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -422,31 +488,39 @@ GP Info:
            -**UserRights/ChangeSystemTime** +**UserRights/ChangeSystemTime** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -461,7 +535,7 @@ This user right determines which users and groups can change the time and date o -GP Info: +GP Info: - GP English name: *Change the system time* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -471,31 +545,39 @@ GP Info:
            -**UserRights/CreateGlobalObjects** +**UserRights/CreateGlobalObjects** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -506,11 +588,13 @@ GP Info: -This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users. +This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Create global objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -520,31 +604,39 @@ GP Info:
            -**UserRights/CreatePageFile** +**UserRights/CreatePageFile** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -555,11 +647,11 @@ GP Info: -This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users +This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users. -GP Info: +GP Info: - GP English name: *Create a pagefile* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -569,31 +661,39 @@ GP Info:
            -**UserRights/CreatePermanentSharedObjects** +**UserRights/CreatePermanentSharedObjects** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -608,7 +708,7 @@ This user right determines which accounts can be used by processes to create a d -GP Info: +GP Info: - GP English name: *Create permanent shared objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -618,31 +718,39 @@ GP Info:
            -**UserRights/CreateSymbolicLinks** +**UserRights/CreateSymbolicLinks** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -653,11 +761,15 @@ GP Info: -This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. +This user right determines if the user can create a symbolic link from the computer he is logged on to. +> [!CAUTION] +> This privilege should be given to trusted users only. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. +> [!NOTE] +> This setting can be used in conjunction with a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. -GP Info: +GP Info: - GP English name: *Create symbolic links* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -667,31 +779,39 @@ GP Info:
            -**UserRights/CreateToken** +**UserRights/CreateToken** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -702,11 +822,13 @@ GP Info: -This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. +This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. +> [!CAUTION] +> Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. -GP Info: +GP Info: - GP English name: *Create a token object* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -716,31 +838,39 @@ GP Info:
            -**UserRights/DebugPrograms** +**UserRights/DebugPrograms** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -751,11 +881,13 @@ GP Info: -This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. +This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Debug programs* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -765,31 +897,39 @@ GP Info:
            -**UserRights/DenyAccessFromNetwork** +**UserRights/DenyAccessFromNetwork** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -804,7 +944,7 @@ This user right determines which users are prevented from accessing a computer o -GP Info: +GP Info: - GP English name: *Deny access to this computer from the network* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -814,31 +954,39 @@ GP Info:
            -**UserRights/DenyLocalLogOn** +**UserRights/DenyLocalLogOn** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -849,11 +997,13 @@ GP Info: -This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. +This security setting determines which service accounts are prevented from registering a process as a service. +> [!NOTE] +> This security setting does not apply to the System, Local Service, or Network Service accounts. -GP Info: +GP Info: - GP English name: *Deny log on as a service* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -863,31 +1013,39 @@ GP Info:
            -**UserRights/DenyRemoteDesktopServicesLogOn** +**UserRights/DenyRemoteDesktopServicesLogOn** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -898,11 +1056,11 @@ GP Info: -This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. +This user right determines which users and groups are prohibited from logging on as Remote Desktop Services clients. -GP Info: +GP Info: - GP English name: *Deny log on through Remote Desktop Services* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -912,31 +1070,39 @@ GP Info:
            -**UserRights/EnableDelegation** +**UserRights/EnableDelegation** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -947,11 +1113,13 @@ GP Info: -This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. +This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. +> [!CAUTION] +> Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. -GP Info: +GP Info: - GP English name: *Enable computer and user accounts to be trusted for delegation* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -961,31 +1129,39 @@ GP Info:
            -**UserRights/GenerateSecurityAudits** +**UserRights/GenerateSecurityAudits** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1000,7 +1176,7 @@ This user right determines which accounts can be used by a process to add entrie -GP Info: +GP Info: - GP English name: *Generate security audits* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1010,31 +1186,39 @@ GP Info:
            -**UserRights/ImpersonateClient** +**UserRights/ImpersonateClient** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1045,15 +1229,21 @@ GP Info: -Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. +Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. +> [!NOTE] +> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. -Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. +Because of these factors, users do not usually need this user right. +> [!WARNING] +> If you enable this setting, programs that previously had the Impersonate privilege might lose it, and they might not run. -GP Info: +GP Info: - GP English name: *Impersonate a client after authentication* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1063,31 +1253,39 @@ GP Info:
            -**UserRights/IncreaseSchedulingPriority** +**UserRights/IncreaseSchedulingPriority** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1102,41 +1300,54 @@ This user right determines which accounts can use a process with Write Property -GP Info: +GP Info: - GP English name: *Increase scheduling priority* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* +> [!WARNING] +> If you remove **Window Manager\Window Manager Group** from the **Increase scheduling priority** user right, certain applications and computers do not function correctly. In particular, the INK workspace does not function correctly on unified memory architecture (UMA) laptop and desktop computers that run Windows 10, version 1903 (or later) and that use the Intel GFX driver. +> +> On affected computers, the display blinks when users draw on INK workspaces such as those that are used by Microsoft Edge, Microsoft PowerPoint, or Microsoft OneNote. The blinking occurs because the inking-related processes repeatedly try to use the Real-Time priority, but are denied permission. +
            -**UserRights/LoadUnloadDeviceDrivers** +**UserRights/LoadUnloadDeviceDrivers** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1147,11 +1358,13 @@ GP Info: -This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. +This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. +> [!CAUTION] +> Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. -GP Info: +GP Info: - GP English name: *Load and unload device drivers* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1161,31 +1374,39 @@ GP Info:
            -**UserRights/LockMemory** +**UserRights/LockMemory** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1196,11 +1417,11 @@ GP Info: -This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). +This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege might significantly affect system performance by decreasing the amount of available random access memory (RAM). -GP Info: +GP Info: - GP English name: *Lock pages in memory* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1210,31 +1431,39 @@ GP Info:
            -**UserRights/ManageAuditingAndSecurityLog** +**UserRights/ManageAuditingAndSecurityLog** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1245,11 +1474,11 @@ GP Info: -This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. +This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege also can view and clear the security log. -GP Info: +GP Info: - GP English name: *Manage auditing and security log* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1259,31 +1488,39 @@ GP Info:
            -**UserRights/ManageVolume** +**UserRights/ManageVolume** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1298,7 +1535,7 @@ This user right determines which users and groups can run maintenance tasks on a -GP Info: +GP Info: - GP English name: *Perform volume maintenance tasks* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1308,31 +1545,39 @@ GP Info:
            -**UserRights/ModifyFirmwareEnvironment** +**UserRights/ModifyFirmwareEnvironment** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1343,11 +1588,13 @@ GP Info: -This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. +This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should be modified only by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows. +> [!NOTE] +> This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. -GP Info: +GP Info: - GP English name: *Modify firmware environment values* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1357,31 +1604,39 @@ GP Info:
            -**UserRights/ModifyObjectLabel** +**UserRights/ModifyObjectLabel** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1396,7 +1651,7 @@ This user right determines which user accounts can modify the integrity label of -GP Info: +GP Info: - GP English name: *Modify an object label* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1406,31 +1661,39 @@ GP Info:
            -**UserRights/ProfileSingleProcess** +**UserRights/ProfileSingleProcess** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1445,7 +1708,7 @@ This user right determines which users can use performance monitoring tools to m -GP Info: +GP Info: - GP English name: *Profile single process* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1455,31 +1718,39 @@ GP Info:
            -**UserRights/RemoteShutdown** +**UserRights/RemoteShutdown** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1494,7 +1765,7 @@ This user right determines which users are allowed to shut down a computer from -GP Info: +GP Info: - GP English name: *Force shutdown from a remote system* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1504,31 +1775,39 @@ GP Info:
            -**UserRights/RestoreFilesAndDirectories** +**UserRights/RestoreFilesAndDirectories** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1539,11 +1818,13 @@ GP Info: -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and it determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system: Traverse Folder/Execute File, Write. +> [!CAUTION] +> Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Restore files and directories* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1553,31 +1834,39 @@ GP Info:
            -**UserRights/TakeOwnership** +**UserRights/TakeOwnership** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1588,11 +1877,13 @@ GP Info: -This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. +This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. +> [!CAUTION] +> Assigning this user right can be a security risk. Since owners of objects have full control of them, assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Take ownership of files or other objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1600,12 +1891,14 @@ GP Info:
            -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +Footnotes: +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 9bc832c1ff..db63da7a5a 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,12 +1,13 @@ --- title: Policy CSP - Wifi -description: Policy CSP - Wifi +description: Learn how the Policy CSP - Wifi setting allows or disallows the device to automatically connect to Wi-Fi hotspots. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/01/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -50,6 +51,8 @@ manager: dansimp **WiFi/AllowWiFiHotSpotReporting** +
            + This policy has been deprecated. @@ -64,26 +67,34 @@ This policy has been deprecated. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -124,26 +135,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -184,26 +203,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1check markcheck markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -239,26 +266,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1check markcheck markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -291,26 +326,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -341,26 +384,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -381,56 +432,18 @@ Supported operations are Add, Delete, Get, and Replace. - - - - -## Wifi policies that can be set using Exchange Active Sync (EAS) - -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) - - - -## Wifi policies supported by HoloLens 2 - -- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - - -## Wifi policies supported by HoloLens (1st gen) Commercial Suite - -- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - - -## Wifi policies supported by HoloLens (1st gen) Development Edition - -- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - - -## Wifi policies supported by IoT Core - -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) -- [Wifi/WLANScanMode](#wifi-wlanscanmode) - - - -## Wifi policies supported by Microsoft Surface Hub - -- [WiFi/AllowWiFiHotSpotReporting](#wifi-allowwifihotspotreporting) - -
            Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 6824a34e5c..4f89b78bcf 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,12 +1,13 @@ --- title: Policy CSP - WindowsConnectionManager -description: Policy CSP - WindowsConnectionManager +description: The Policy CSP - WindowsConnectionManager setting prevents computers from connecting to a domain based network and a non-domain based network simultaneously. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - WindowsConnectionManager +
            @@ -34,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -97,12 +107,16 @@ ADMX Info:
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index cc8580325d..a4cd3536f0 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1,21 +1,19 @@ --- title: Policy CSP - WindowsDefenderSecurityCenter -description: Policy CSP - WindowsDefenderSecurityCenter +description: Learn how to use the Policy CSP - WindowsDefenderSecurityCenter setting to display the Account protection area in Windows Defender Security Center. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/09/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # Policy CSP - WindowsDefenderSecurityCenter -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
            @@ -100,26 +98,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -154,26 +160,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -212,26 +226,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -272,26 +294,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark5check mark5check mark5check mark5check mark5Homecheck mark5
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -346,26 +376,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -391,7 +429,7 @@ ADMX Info: Valid values: - 0 - (Disable) The users can see the display of the Device security area in Windows Defender Security Center. -- 1 - (Enable) The users cannot see the display of the Device secuirty area in Windows Defender Security Center. +- 1 - (Enable) The users cannot see the display of the Device security area in Windows Defender Security Center. @@ -404,26 +442,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -467,26 +513,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -527,26 +581,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -587,26 +649,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -647,26 +717,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -707,26 +785,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark5check mark5check mark5check mark5check mark5Homecheck mark5
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -781,26 +867,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -841,26 +935,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -901,26 +1003,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -955,26 +1065,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1015,26 +1133,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1075,26 +1201,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1133,26 +1267,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1191,26 +1333,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
            Procheck mark4
            Businesscheck mark4
            Enterprisecheck mark4
            Educationcheck mark4
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1249,26 +1399,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark5check mark5check mark5check mark5check mark5Homecheck mark5
            Procheck mark5
            Businesscheck mark5
            Enterprisecheck mark5
            Educationcheck mark5
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1325,26 +1483,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1379,26 +1545,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1426,14 +1600,16 @@ ADMX Info:
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index ca2a0c7b72..e60269d795 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -1,12 +1,13 @@ --- title: Policy CSP - WindowsInkWorkspace -description: Policy CSP - WindowsInkWorkspace +description: Learn to use the Policy CSP - WindowsInkWorkspace setting to specify whether to allow the user to access the ink workspace. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -38,26 +39,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -96,26 +105,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -149,12 +166,16 @@ Value type is int. The following list shows the supported values:
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index dd40314d62..c7ccb54106 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,12 +1,13 @@ --- title: Policy CSP - WindowsLogon -description: Policy CSP - WindowsLogon +description: Use the Policy CSP - WindowsLogon setting to control whether a device automatically signs in and locks the last interactive user after the system restarts. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - WindowsLogon +
            @@ -43,6 +45,7 @@ manager: dansimp
            +
            @@ -51,26 +54,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark6check mark6check mark6check mark6check mark6Homecheck mark6
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -128,26 +139,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            check mark6check mark6check mark6check mark6check mark6Homecheck mark6
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -205,26 +224,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -267,26 +294,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -354,26 +389,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark6check mark6check mark6check mark6Homecross mark
            Procheck mark6
            Businesscheck mark6
            Enterprisecheck mark6
            Educationcheck mark6
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -396,7 +439,6 @@ If you do not configure this policy setting, the user who completes the initial > The first sign-in animation is not displayed on Server, so this policy has no effect. - ADMX Info: - GP English name: *Show first sign-in animation* @@ -426,26 +468,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -488,26 +538,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -544,16 +602,18 @@ To validate on Desktop, do the following: - - -
            Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 9e2d0223b5..b60def1361 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -1,12 +1,13 @@ --- title: Policy CSP - WindowsPowerShell -description: Policy CSP - WindowsPowerShell +description: Use the Policy CSP - WindowsPowerShell setting to enable logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/16/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -14,6 +15,7 @@ manager: dansimp # Policy CSP - WindowsPowerShell +
            @@ -34,26 +36,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
            Procheck mark
            Businesscheck mark
            Enterprisecheck mark
            Educationcheck mark
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -94,12 +104,16 @@ ADMX Info:
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md new file mode 100644 index 0000000000..77c69597e9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -0,0 +1,561 @@ +--- +title: Policy CSP - WindowsSandbox +description: Policy CSP - WindowsSandbox +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/14/2020 +--- + +# Policy CSP - WindowsSandbox + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
            + + +## WindowsSandbox policies + +
            +
            + WindowsSandbox/AllowAudioInput +
            +
            + WindowsSandbox/AllowClipboardRedirection +
            +
            + WindowsSandbox/AllowNetworking +
            +
            + WindowsSandbox/AllowPrinterRedirection +
            +
            + WindowsSandbox/AllowVGPU +
            +
            + WindowsSandbox/AllowVideoInput +
            +
            + + +
            + + +**WindowsSandbox/AllowAudioInput** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark
            Businesscross mark
            Enterprisecheck mark
            Educationcheck mark
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +This policy setting allows the IT admin to enable or disable audio input to the Sandbox. + +> [!NOTE] +> There may be security implications of exposing host audio input to the container. + +If this policy is not configured, end-users get the default behavior (audio input enabled). + +If audio input is disabled, a user will not be able to enable audio input from their own configuration file. + +If audio input is enabled, a user will be able to disable audio input from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow audio input in Windows Sandbox* +- GP name: *AllowAudioInput* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + +
            + + + +**WindowsSandbox/AllowClipboardRedirection** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark
            Businesscross mark
            Enterprisecheck mark
            Educationcheck mark
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +This policy setting allows the IT admin to enable or disable sharing of the host clipboard with the sandbox. + +If this policy is not configured, end-users get the default behavior (clipboard redirection enabled. + +If clipboard sharing is disabled, a user will not be able to enable clipboard sharing from their own configuration file. + +If clipboard sharing is enabled, a user will be able to disable clipboard sharing from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow clipboard sharing with Windows Sandbox* +- GP name: *AllowClipboardRedirection* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + + +
            + + +**WindowsSandbox/AllowNetworking** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark
            Businesscross mark
            Enterprisecheck mark
            Educationcheck mark
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +This policy setting allows the IT admin to enable or disable networking in Windows Sandbox. Disabling network access can decrease the attack surface exposed by the Sandbox. Enabling networking can expose untrusted applications to the internal network. + +If this policy is not configured, end-users get the default behavior (networking enabled). + +If networking is disabled, a user will not be able to enable networking from their own configuration file. + +If networking is enabled, a user will be able to disable networking from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow networking in Windows Sandbox* +- GP name: *AllowNetworking* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + +
            + + +**WindowsSandbox/AllowPrinterRedirection** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark
            Businesscross mark
            Enterprisecheck mark
            Educationcheck mark
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +This policy setting allows the IT admin to enable or disable printer sharing from the host into the Sandbox. + +If this policy is not configured, end-users get the default behavior (printer sharing disabled). + +If printer sharing is disabled, a user will not be able to enable printer sharing from their own configuration file. + +If printer sharing is enabled, a user will be able to disable printer sharing from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow printer sharing with Windows Sandbox* +- GP name: *AllowPrinterRedirection* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + +
            + + +**WindowsSandbox/AllowVGPU** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark
            Businesscross mark
            Enterprisecheck mark
            Educationcheck mark
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +This policy setting allows the IT admin to enable or disable virtualized GPU for Windows Sandbox. + +> [!NOTE] +> Enabling virtualized GPU can potentially increase the attack surface of Windows Sandbox. + +If this policy is not configured, end-users get the default behavior (vGPU is disabled). + +If vGPU is disabled, a user will not be able to enable vGPU support from their own configuration file. + +If vGPU is enabled, a user will be able to disable vGPU support from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow vGPU sharing for Windows Sandbox* +- GP name: *AllowVGPU* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 (default) - Disabled +- 1 - Enabled + + + + + + + + + + +
            + + +**WindowsSandbox/AllowVideoInput** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            Windows EditionSupported?
            Homecross mark
            Procheck mark
            Businesscross mark
            Enterprisecheck mark
            Educationcheck mark
            + + +
            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
            + + + +This policy setting allows the IT admin to enable or disable video input to the Sandbox. + +> [!NOTE] +> There may be security implications of exposing host video input to the container. + +If this policy is not configured, users get the default behavior (video input disabled). + +If video input is disabled, users will not be able to enable video input from their own configuration file. + +If video input is enabled, users will be able to disable video input from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: +- GP English Name: *Allow video input in Windows Sandbox* +- GP name: *AllowVideoInput* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 (default) - Disabled +- 1 - Enabled + + + + + + + + + + +
            + + diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 1ba5d5ec2d..3aff9aac6c 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -1,12 +1,13 @@ --- title: Policy CSP - WirelessDisplay -description: Policy CSP - WirelessDisplay +description: Use the Policy CSP - WirelessDisplay setting to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/09/2018 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- @@ -56,26 +57,34 @@ manager: dansimp - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -106,26 +115,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
            Procheck mark3
            Businesscheck mark3
            Enterprisecheck mark3
            Educationcheck mark3
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -156,26 +173,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -206,26 +231,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -256,26 +289,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -318,26 +359,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -368,26 +417,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
            Procheck mark2
            Businesscheck mark2
            Enterprisecheck mark2
            Educationcheck mark2
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -418,26 +475,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
            Procheck mark1
            Businesscheck mark1
            Enterprisecheck mark1
            Educationcheck mark1
            +
            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -473,12 +538,16 @@ The following list shows the supported values:
            -Footnote: +Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 86b57361ab..0ed48a5776 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -1,6 +1,6 @@ --- title: Policy DDF file -description: Policy DDF file +description: Learn about the OMA DM device description framework (DDF) for the Policy configuration service provider. ms.assetid: D90791B5-A772-4AF8-B058-5D566865AF8D ms.reviewer: manager: dansimp @@ -9,7 +9,8 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.localizationpriority: medium +ms.date: 10/28/2020 --- # Policy DDF file @@ -19,10 +20,12 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy* You can view various Policy DDF files by clicking the following links: -- [View the Policy DDF file for Windows 10, version 1903](http://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml) -- [View the Policy DDF file for Windows 10, version 1809](http://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml) +- [View the Policy DDF file for Windows 10, version 20H2](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_20H2.xml) +- [View the Policy DDF file for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_2004.xml) +- [View the Policy DDF file for Windows 10, version 1903](https://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml) +- [View the Policy DDF file for Windows 10, version 1809](https://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml) - [View the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) -- [View the Policy DDF file for Windows 10, version 1803 release C](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) +- [View the Policy DDF file for Windows 10, version 1803 release C](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) - [View the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml) - [View the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml) - [View the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml) @@ -30,7 +33,7 @@ You can view various Policy DDF files by clicking the following links: You can download DDF files for various CSPs from [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the DDF for Windows 10, version 1903. +The XML below is the DDF for Windows 10, version 20H2. ```xml @@ -56,7 +59,7 @@ The XML below is the DDF for Windows 10, version 1903. - com.microsoft/9.0/MDM/Policy + com.microsoft/10.0/MDM/Policy @@ -1645,7 +1648,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -1656,11 +1659,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -2118,6 +2121,30 @@ Related policy: + + AllowGraphingCalculator + + + + + + + + This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. + + + + + + + + + + + text/plain + + + DefaultPrinterName @@ -8687,6 +8714,52 @@ Related policy: + + Multitasking + + + + + + + + + + + + + + + + + + + + + BrowserAltTabBlowout + + + + + + + + Configures the inclusion of Edge tabs into Alt-Tab. + + + + + + + + + + + text/plain + + + + Notifications @@ -11022,7 +11095,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -11033,11 +11106,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -11540,6 +11613,33 @@ Related policy: + + AllowGraphingCalculator + + + + + 1 + This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. + + + + + + + + + + + text/plain + + + Programs.admx + Programs~AT~WindowsComponents~Calculator + AllowGraphingCalculator + LowestValueMostSecure + + DefaultPrinterName @@ -18866,6 +18966,55 @@ Related policy: + + Multitasking + + + + + + + + + + + + + + + + + + + BrowserAltTabBlowout + + + + + 1 + Configures the inclusion of Edge tabs into Alt-Tab. + + + + + + + + + + + text/plain + + + phone + multitasking.admx + AltTabFilterDropdown + multitasking~AT~WindowsComponents~MULTITASKING + MultiTaskingAltTabFilter + LastWrite + + + Notifications @@ -19508,7 +19657,7 @@ Related policy: - com.microsoft/9.0/MDM/Policy + com.microsoft/10.0/MDM/Policy @@ -19577,6 +19726,99 @@ Related policy: + + Properties + + + + + + + Properties of Win32 App ADMX Ingestion + + + + + + + + + + + + + + + * + + + + + + + Setting Type of Win32 App. Policy Or Preference + + + + + + + + + + + + + + + * + + + + + + + Unique ID of ADMX file + + + + + + + + + + + + + + + Version + + + + + + + + Version of ADMX file + + + + + + + + + + + + + + + + + * @@ -19606,6 +19848,7 @@ Related policy: + Unique ID of ADMX file @@ -20164,6 +20407,30 @@ Related policy: + + BlockNonAdminUserInstall + + + + + + + + + + + + + + + + + + + text/plain + + + DisableStoreOriginatedApps @@ -21097,6 +21364,1785 @@ Related policy: + + Audit + + + + + + + + + + + + + + + + + + + + + AccountLogon_AuditCredentialValidation + + + + + + + + This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditKerberosAuthenticationService + + + + + + + + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditKerberosServiceTicketOperations + + + + + + + + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditOtherAccountLogonEvents + + + + + + + + This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditAccountLockout + + + + + + + + This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditGroupMembership + + + + + + + + This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecExtendedMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecMainMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecQuickMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditLogoff + + + + + + + + This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditLogon + + + + + + + + This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditNetworkPolicyServer + + + + + + + + This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditOtherLogonLogoffEvents + + + + + + + + This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditSpecialLogon + + + + + + + + This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditUserDeviceClaims + + + + + + + + This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditApplicationGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditComputerAccountManagement + + + + + + + + This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditDistributionGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditOtherAccountManagementEvents + + + + + + + + This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditSecurityGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditUserAccountManagement + + + + + + + + This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditDPAPIActivity + + + + + + + + This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditPNPActivity + + + + + + + + This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditProcessCreation + + + + + + + + This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditProcessTermination + + + + + + + + This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditRPCEvents + + + + + + + + This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditTokenRightAdjusted + + + + + + + + This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDetailedDirectoryServiceReplication + + + + + + + + This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceAccess + + + + + + + + This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceChanges + + + + + + + + This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceReplication + + + + + + + + This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditApplicationGenerated + + + + + + + + This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditCentralAccessPolicyStaging + + + + + + + + This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditCertificationServices + + + + + + + + This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditDetailedFileShare + + + + + + + + This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFileShare + + + + + + + + This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFileSystem + + + + + + + + This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFilteringPlatformConnection + + + + + + + + This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFilteringPlatformPacketDrop + + + + + + + + This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditHandleManipulation + + + + + + + + This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditKernelObject + + + + + + + + This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditOtherObjectAccessEvents + + + + + + + + This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditRegistry + + + + + + + + This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditRemovableStorage + + + + + + + + This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditSAM + + + + + + + + This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditAuthenticationPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditAuthorizationPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditFilteringPlatformPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditMPSSVCRuleLevelPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditOtherPolicyChangeEvents + + + + + + + + This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditPolicyChange + + + + + + + + This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditNonSensitivePrivilegeUse + + + + + + + + This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditOtherPrivilegeUseEvents + + + + + + + + Not used. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditSensitivePrivilegeUse + + + + + + + + This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + text/plain + + + + + System_AuditIPsecDriver + + + + + + + + This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + text/plain + + + + + System_AuditOtherSystemEvents + + + + + + + + This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + text/plain + + + + + System_AuditSecurityStateChange + + + + + + + + This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + text/plain + + + + + System_AuditSecuritySystemExtension + + + + + + + + This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + text/plain + + + + + System_AuditSystemIntegrity + + + + + + + + This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + text/plain + + + + Authentication @@ -21758,6 +23804,30 @@ Related policy: + + SetMinimumEncryptionKeySize + + + + + + + + + + + + + + + + + + + text/plain + + + Browser @@ -23020,7 +25090,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -23031,11 +25101,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -25493,6 +27563,30 @@ Related policy: + + DOCacheHostSource + + + + + + + + + + + + + + + + + + + text/plain + + + DODelayBackgroundDownloadFromHttp @@ -25661,6 +27755,30 @@ Related policy: + + DOMaxBackgroundDownloadBandwidth + + + + + + + + + + + + + + + + + + + text/plain + + + DOMaxCacheAge @@ -25710,31 +27828,7 @@ Related policy: - DOMaxDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMaxUploadBandwidth + DOMaxForegroundDownloadBandwidth @@ -25949,30 +28043,6 @@ Related policy: - - DOPercentageMaxDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - DOPercentageMaxForegroundBandwidth @@ -26327,6 +28397,30 @@ Related policy: + + AllowInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + + + text/plain + + + AllowInstallationOfMatchingDeviceSetupClasses @@ -26423,6 +28517,30 @@ Related policy: + + PreventInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + + + text/plain + + + PreventInstallationOfMatchingDeviceSetupClasses @@ -27735,6 +29853,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableCloudOptimizedContent + + + + + + + + This policy controls Windows experiences that use the cloud optimized content client component. If you enable this policy, they will present only default content. If you disable or do not configure this policy, they will be able to use cloud provided content. + + + + + + + + + + + text/plain + + + DoNotShowFeedbackNotifications @@ -27887,6 +30029,124 @@ If you do not configure this policy setting, users will be able to choose whethe + + FactoryComposer + + + + + + + + + + + + + + + + + + + + + BackgroundImagePath + + + + + + + + + + + + + + + + + + + text/plain + + + + + OEMVersion + + + + + + + + + + + + + + + + + + + text/plain + + + + + UserToSignIn + + + + + + + + + + + + + + + + + + + text/plain + + + + + UWPLaunchOnBoot + + + + + + + + + + + + + + + + + + + text/plain + + + + FileExplorer @@ -28766,30 +31026,6 @@ If you do not configure this policy setting, users will be able to choose whethe - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - - - text/plain - - - DisableAdobeFlash @@ -36237,6 +38473,60 @@ The options are: + + LocalUsersAndGroups + + + + + + + + + + + + + + + + + + + + + Configure + + + + + + + + This Setting allows an administrator to manage local groups on a Device. + Possible settings: + 1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. + When using Update, existing group members that are not specified in the policy remain untouched. + 2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. + When using Replace, existing group membership is replaced by the list of members specified in + the add member section. This option works in the same way as a Restricted Group and any group + members that are not specified in the policy are removed. + Caution: If the same group is configured with both Replace and Update, then Replace will win. + + + + + + + + + + + text/plain + + + + LockDown @@ -36447,6 +38737,148 @@ The options are: + + MixedReality + + + + + + + + + + + + + + + + + + + + + AADGroupMembershipCacheValidityInDays + + + + + + + + + + + + + + + + + + + text/plain + + + + + BrightnessButtonDisabled + + + + + + + + + + + + + + + + + + + text/plain + + + + + FallbackDiagnostics + + + + + + + + + + + + + + + + + + + text/plain + + + + + MicrophoneDisabled + + + + + + + + + + + + + + + + + + + text/plain + + + + + VolumeButtonDisabled + + + + + + + + + + + + + + + + + + + text/plain + + + + MSSecurityGuide @@ -37960,6 +40392,102 @@ If the user has configured a slide show to run on the lock screen when the machi + + LetAppsAccessBackgroundSpatialPerception + + + + + + + + This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + LetAppsAccessCalendar @@ -44047,6 +46575,90 @@ If you disable or do not configure this policy setting, File History can be acti + + ConfigureJapaneseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. +1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. +2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. + + + + + + + + + + + text/plain + + + + + ConfigureSimplifiedChineseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. +1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. +2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. + + + + + + + + + + + text/plain + + + + + ConfigureTraditionalChineseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. +1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. +2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. + + + + + + + + + + + text/plain + + + EnableTouchKeyboardAutoInvokeInDesktopMode @@ -45088,6 +47700,30 @@ If you disable or do not configure this policy setting, the wake setting as spec + + DisableWUfBSafeguards + + + + + + + + + + + + + + + + + + + text/plain + + + EngagedRestartDeadline @@ -45856,6 +48492,54 @@ If you disable or do not configure this policy setting, the wake setting as spec + + SetProxyBehaviorForUpdateDetection + + + + + + + + + + + + + + + + + + + text/plain + + + + + TargetReleaseVersion + + + + + + + + + + + + + + + + + + + text/plain + + + UpdateNotificationLevel @@ -48509,6 +51193,33 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi LastWrite + + BlockNonAdminUserInstall + + + + + 0 + + + + + + + + + + + + text/plain + + + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + BlockNonAdminUserInstall + LowestValueMostSecure + + DisableStoreOriginatedApps @@ -49576,6 +52287,1960 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi + + Audit + + + + + + + + + + + + + + + + + + + AccountLogon_AuditCredentialValidation + + + + + 0 + This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Credential Validation + LastWrite + + + + AccountLogon_AuditKerberosAuthenticationService + + + + + 0 + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Kerberos Authentication Service + LastWrite + + + + AccountLogon_AuditKerberosServiceTicketOperations + + + + + 0 + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Kerberos Service Ticket Operations + LastWrite + + + + AccountLogon_AuditOtherAccountLogonEvents + + + + + 0 + This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Other Account Logon Events + LastWrite + + + + AccountLogonLogoff_AuditAccountLockout + + + + + 1 + This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Account Lockout + LastWrite + + + + AccountLogonLogoff_AuditGroupMembership + + + + + 0 + This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Group Membership + LastWrite + + + + AccountLogonLogoff_AuditIPsecExtendedMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Extended Mode + LastWrite + + + + AccountLogonLogoff_AuditIPsecMainMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Main Mode + LastWrite + + + + AccountLogonLogoff_AuditIPsecQuickMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Quick Mode + LastWrite + + + + AccountLogonLogoff_AuditLogoff + + + + + 1 + This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Logoff + LastWrite + + + + AccountLogonLogoff_AuditLogon + + + + + 1 + This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Logon + LastWrite + + + + AccountLogonLogoff_AuditNetworkPolicyServer + + + + + 3 + This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Network Policy Server + LastWrite + + + + AccountLogonLogoff_AuditOtherLogonLogoffEvents + + + + + 0 + This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Other Logon Logoff Events + LastWrite + + + + AccountLogonLogoff_AuditSpecialLogon + + + + + 1 + This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Special Logon + LastWrite + + + + AccountLogonLogoff_AuditUserDeviceClaims + + + + + 0 + This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit User Device Claims + LastWrite + + + + AccountManagement_AuditApplicationGroupManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Application Group Management + LastWrite + + + + AccountManagement_AuditComputerAccountManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Computer Account Management + LastWrite + + + + AccountManagement_AuditDistributionGroupManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Distributio Group Management + LastWrite + + + + AccountManagement_AuditOtherAccountManagementEvents + + + + + 0 + This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Other Account Management Events + LastWrite + + + + AccountManagement_AuditSecurityGroupManagement + + + + + 1 + This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Security Group Management + LastWrite + + + + AccountManagement_AuditUserAccountManagement + + + + + 1 + This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit User Account Management + LastWrite + + + + DetailedTracking_AuditDPAPIActivity + + + + + 0 + This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit DPAPI Activity + LastWrite + + + + DetailedTracking_AuditPNPActivity + + + + + 0 + This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit PNP Activity + LastWrite + + + + DetailedTracking_AuditProcessCreation + + + + + 0 + This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Process Creation + LastWrite + + + + DetailedTracking_AuditProcessTermination + + + + + 0 + This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Process Termination + LastWrite + + + + DetailedTracking_AuditRPCEvents + + + + + 0 + This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit RPC Events + LastWrite + + + + DetailedTracking_AuditTokenRightAdjusted + + + + + 0 + This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Token Right Adjusted + LastWrite + + + + DSAccess_AuditDetailedDirectoryServiceReplication + + + + + 0 + This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Detailed Directory Service Replication + LastWrite + + + + DSAccess_AuditDirectoryServiceAccess + + + + + 0 + This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Access + LastWrite + + + + DSAccess_AuditDirectoryServiceChanges + + + + + 0 + This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Changes + LastWrite + + + + DSAccess_AuditDirectoryServiceReplication + + + + + 0 + This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Replication + LastWrite + + + + ObjectAccess_AuditApplicationGenerated + + + + + 0 + This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Application Generated + LastWrite + + + + ObjectAccess_AuditCentralAccessPolicyStaging + + + + + 0 + This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Central Access Policy Staging + LastWrite + + + + ObjectAccess_AuditCertificationServices + + + + + 0 + This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Certification Services + LastWrite + + + + ObjectAccess_AuditDetailedFileShare + + + + + 0 + This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Detailed File Share + LastWrite + + + + ObjectAccess_AuditFileShare + + + + + 0 + This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit File Share + LastWrite + + + + ObjectAccess_AuditFileSystem + + + + + 0 + This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit File System + LastWrite + + + + ObjectAccess_AuditFilteringPlatformConnection + + + + + 0 + This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Filtering Platform Connection + LastWrite + + + + ObjectAccess_AuditFilteringPlatformPacketDrop + + + + + 0 + This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Filtering Platform Packet Drop + LastWrite + + + + ObjectAccess_AuditHandleManipulation + + + + + 0 + This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Handle Manipulation + LastWrite + + + + ObjectAccess_AuditKernelObject + + + + + 0 + This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Kernel Object + LastWrite + + + + ObjectAccess_AuditOtherObjectAccessEvents + + + + + 0 + This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Other Object Access Events + LastWrite + + + + ObjectAccess_AuditRegistry + + + + + 0 + This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Registry + LastWrite + + + + ObjectAccess_AuditRemovableStorage + + + + + 0 + This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Removable Storage + LastWrite + + + + ObjectAccess_AuditSAM + + + + + 0 + This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit SAM + LastWrite + + + + PolicyChange_AuditAuthenticationPolicyChange + + + + + 1 + This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Authentication Policy Change + LastWrite + + + + PolicyChange_AuditAuthorizationPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Authorization Policy Change + LastWrite + + + + PolicyChange_AuditFilteringPlatformPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Filtering Platform Policy Change + LastWrite + + + + PolicyChange_AuditMPSSVCRuleLevelPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit MPSSVC Rule Level Policy Change + LastWrite + + + + PolicyChange_AuditOtherPolicyChangeEvents + + + + + 0 + This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Other Policy Change Events + LastWrite + + + + PolicyChange_AuditPolicyChange + + + + + 1 + This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Policy Change + LastWrite + + + + PrivilegeUse_AuditNonSensitivePrivilegeUse + + + + + 0 + This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Non Sensitive Privilege Use + LastWrite + + + + PrivilegeUse_AuditOtherPrivilegeUseEvents + + + + + 0 + Not used. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Other Privilege Use Events + LastWrite + + + + PrivilegeUse_AuditSensitivePrivilegeUse + + + + + 0 + This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Sensitive Privilege Use + LastWrite + + + + System_AuditIPsecDriver + + + + + 0 + This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit IPsec Driver + LastWrite + + + + System_AuditOtherSystemEvents + + + + + 3 + This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Other System Events + LastWrite + + + + System_AuditSecurityStateChange + + + + + 1 + This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Security State Change + LastWrite + + + + System_AuditSecuritySystemExtension + + + + + 0 + This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Security System Extension + LastWrite + + + + System_AuditSystemIntegrity + + + + + 3 + This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit System Integrity + LastWrite + + + Authentication @@ -50263,6 +54928,30 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi LastWrite + + SetMinimumEncryptionKeySize + + + + + 0 + + + + + + + + + + + + text/plain + + + LastWrite + + Browser @@ -51674,7 +56363,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -51685,11 +56374,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -54423,6 +59112,34 @@ Related policy: LastWrite + + DOCacheHostSource + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + CacheHostSource + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + CacheHostSource + LastWrite + + DODelayBackgroundDownloadFromHttp @@ -54618,6 +59335,34 @@ Related policy: LastWrite + + DOMaxBackgroundDownloadBandwidth + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + MaxBackgroundDownloadBandwidth + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MaxBackgroundDownloadBandwidth + LastWrite + + DOMaxCacheAge @@ -54675,7 +59420,7 @@ Related policy: - DOMaxDownloadBandwidth + DOMaxForegroundDownloadBandwidth @@ -54696,37 +59441,9 @@ Related policy: DeliveryOptimization.admx - MaxDownloadBandwidth + MaxForegroundDownloadBandwidth DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxDownloadBandwidth - LastWrite - - - - DOMaxUploadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MaxUploadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxUploadBandwidth + MaxForegroundDownloadBandwidth LastWrite @@ -54953,35 +59670,6 @@ Related policy: LastWrite - - DOPercentageMaxDownloadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - DeliveryOptimization.admx - PercentageMaxDownloadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - PercentageMaxDownloadBandwidth - LastWrite - - DOPercentageMaxForegroundBandwidth @@ -55428,6 +60116,33 @@ Related policy: LastWrite + + AllowInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + text/plain + + phone + deviceinstallation.admx + DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category + DeviceInstall_Instance_IDs_Allow + LastWrite + + AllowInstallationOfMatchingDeviceSetupClasses @@ -55536,6 +60251,33 @@ Related policy: LastWrite + + PreventInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + text/plain + + phone + deviceinstallation.admx + DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category + DeviceInstall_Instance_IDs_Deny + LastWrite + + PreventInstallationOfMatchingDeviceSetupClasses @@ -56920,6 +61662,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LowestValueMostSecure + + DisableCloudOptimizedContent + + + + + 0 + This policy controls Windows experiences that use the cloud optimized content client component. If you enable this policy, they will present only default content. If you disable or do not configure this policy, they will be able to use cloud provided content. + + + + + + + + + + + text/plain + + + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableCloudOptimizedContent + HighestValueMostSecure + + DoNotShowFeedbackNotifications @@ -57086,6 +61855,118 @@ If you do not configure this policy setting, users will be able to choose whethe + + FactoryComposer + + + + + + + + + + + + + + + + + + + BackgroundImagePath + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + + OEMVersion + + + + + unset; partners can set via settings customization! + + + + + + + + + + + + text/plain + + LastWrite + + + + UserToSignIn + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + + UWPLaunchOnBoot + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + FileExplorer @@ -58054,33 +62935,6 @@ If you do not configure this policy setting, users will be able to choose whethe LastWrite - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VersionListAutomaticDownloadDisable - LastWrite - - DisableAdobeFlash @@ -66348,6 +71202,116 @@ The options are: + + LocalUsersAndGroups + + + + + + + + + + + + + + + + + + + Configure + + + + + + This Setting allows an administrator to manage local groups on a Device. + Possible settings: + 1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. + When using Update, existing group members that are not specified in the policy remain untouched. + 2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. + When using Replace, existing group membership is replaced by the list of members specified in + the add member section. This option works in the same way as a Restricted Group and any group + members that are not specified in the policy are removed. + Caution: If the same group is configured with both Replace and Update, then Replace will win. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + + + + + + + + + Group Configuration Action + + + + + + + + Group Member to Add + + + + + + + + Group Member to Remove + + + + + + + + Group property to configure + + + + + + + + + + + + + + + + Local Group Configuration + + + + + + + + + LockDown @@ -66564,6 +71528,146 @@ The options are: + + MixedReality + + + + + + + + + + + + + + + + + + + AADGroupMembershipCacheValidityInDays + + + + + 0 + + + + + + + + + + + + text/plain + + + LastWrite + + + + BrightnessButtonDisabled + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + FallbackDiagnostics + + + + + 2 + + + + + + + + + + + + text/plain + + + LastWrite + + + + MicrophoneDisabled + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + VolumeButtonDisabled + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + MSSecurityGuide @@ -68231,6 +73335,102 @@ If the user has configured a slide show to run on the lock screen when the machi ; + + LetAppsAccessBackgroundSpatialPerception + + + + + 0 + This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + LetAppsAccessCalendar @@ -74950,6 +80150,99 @@ If you disable or do not configure this policy setting, File History can be acti LowestValueMostSecure + + ConfigureJapaneseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. +1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. +2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureJapaneseImeVersion + LowestValueMostSecure + + + + ConfigureSimplifiedChineseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. +1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. +2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureSimplifiedChineseImeVersion + LowestValueMostSecure + + + + ConfigureTraditionalChineseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. +1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. +2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureTraditionalChineseImeVersion + LowestValueMostSecure + + EnableTouchKeyboardAutoInvokeInDesktopMode @@ -76081,6 +81374,30 @@ If you disable or do not configure this policy setting, the wake setting as spec LastWrite + + DisableWUfBSafeguards + + + + + 0 + + + + + + + + + + + + text/plain + + + LastWrite + + EngagedRestartDeadline @@ -76955,6 +82272,61 @@ If you disable or do not configure this policy setting, the wake setting as spec LastWrite + + SetProxyBehaviorForUpdateDetection + + + + + 0 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + SetProxyBehaviorForUpdateDetection + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + CorpWuURL + LastWrite + + + + TargetReleaseVersion + + + + + + + + + + + + + + + + + text/plain + + WindowsUpdate.admx + TargetReleaseVersionId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + TargetReleaseVersion + LastWrite + + UpdateNotificationLevel diff --git a/windows/client-management/mdm/policymanager-csp.md b/windows/client-management/mdm/policymanager-csp.md index ad4bb24be7..656e292b4e 100644 --- a/windows/client-management/mdm/policymanager-csp.md +++ b/windows/client-management/mdm/policymanager-csp.md @@ -1,6 +1,6 @@ --- title: PolicyManager CSP -description: PolicyManager CSP +description: Learn how PolicyManager CSP is deprecated. For Windows 10 devices you should use Policy CSP, which replaces PolicyManager CSP. ms.assetid: 048427b1-6024-4660-8660-bd91c583f7f9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md index cced09bc2b..c1d9034fe8 100644 --- a/windows/client-management/mdm/proxy-csp.md +++ b/windows/client-management/mdm/proxy-csp.md @@ -1,6 +1,6 @@ --- title: PROXY CSP -description: PROXY CSP +description: Learn how the PROXY configuration service provider (CSP) is used to configure proxy connections. ms.assetid: 9904d44c-4a1e-4ae7-a6c7-5dba06cb16ce ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 5e0bc0b2d9..48baff3fe8 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -1,6 +1,6 @@ --- title: PXLOGICAL configuration service provider -description: PXLOGICAL configuration service provider +description: The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques. ms.assetid: b5fc84d4-aa32-4edd-95f1-a6a9c0feb459 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index 9711b4b2a4..d906bca3da 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -1,6 +1,6 @@ --- title: Reboot CSP -description: Reboot CSP +description: Learn how the Reboot configuration service provider (CSP) is used to configure reboot settings. ms.assetid: 4E3F1225-BBAD-40F5-A1AB-FF221B6BAF48 ms.reviewer: manager: dansimp @@ -38,28 +38,24 @@ The following diagram shows the Reboot configuration service provider management

            The supported operation is Get.

            **Schedule/Single** -

            This node will execute a reboot at a scheduled date and time. Setting a null (empty) date will delete the existing schedule. The date and time value is ISO8601, and both the date and time are required.
            +

            This node will execute a reboot at a scheduled date and time. The date and time value is **ISO 8601**, and both the date and time are required.
            Example to configure: 2018-10-25T18:00:00

            +Setting a null (empty) date will delete the existing schedule. In accordance with the ISO 8601 format, the date and time representation needs to be 0000-00-00T00:00:00. +

            The supported operations are Get, Add, Replace, and Delete.

            +

            The supported data type is "String".

            + **Schedule/DailyRecurrent**

            This node will execute a reboot each day at a scheduled time starting at the configured starting time and date. Setting a null (empty) date will delete the existing schedule. The date and time value is ISO8601, and both the date and time are required. The CSP will return the date time in the following format: 2018-06-29T10:00:00+01:00.
            Example to configure: 2018-10-25T18:00:00

            The supported operations are Get, Add, Replace, and Delete.

            +

            The supported data type is "String".

            + ## Related topics [Configuration service provider reference](configuration-service-provider-reference.md) - - - - - - - - - - diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md index ae536fae17..3beb6993e3 100644 --- a/windows/client-management/mdm/reclaim-seat-from-user.md +++ b/windows/client-management/mdm/reclaim-seat-from-user.md @@ -1,6 +1,6 @@ --- title: Reclaim seat from user -description: The Reclaim seat from user operation returns reclaimed seats for a user in the Micosoft Store for Business. +description: The Reclaim seat from user operation returns reclaimed seats for a user in the Microsoft Store for Business. ms.assetid: E2C3C899-D0AD-469A-A319-31A420472A4C ms.reviewer: manager: dansimp @@ -9,12 +9,12 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/18/2017 +ms.date: 05/05/2020 --- # Reclaim seat from user -The **Reclaim seat from user** operation returns reclaimed seats for a user in the Micosoft Store for Business. +The **Reclaim seat from user** operation returns reclaimed seats for a user in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index 0f8b376074..be9c8a5339 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -1,6 +1,6 @@ --- title: Register your free Azure Active Directory subscription -description: If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. +description: Paid subscribers to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, have a free subscription to Azure AD. ms.assetid: 97DCD303-BB11-4AFF-84FE-B7F14CDF64F7 ms.reviewer: manager: dansimp @@ -21,7 +21,7 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent   ## Register your free Azure Active Directory subscription -1. Sign in to the Office 365 portal at using your organization's account. +1. Sign in to the Microsoft 365 admin center at using your organization's account. ![register azuread](images/azure-ad-add-tenant10.png) @@ -29,21 +29,11 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent ![register azuread](images/azure-ad-add-tenant11.png) -3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. +3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal. - ![register azuread](images/azure-ad-add-tenant12.png) + ![Azure-AD-updated](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) -4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - ![register azuread](images/azure-ad-add-tenant13.png) - -5. It may take a few minutes to process the request. - - ![register azuread](images/azure-ad-add-tenant14.png) - -6. You will see a welcome page when the process completes. - - ![register azuread](images/azure-ad-add-tenant15.png)   diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md index 61d34774a7..4978cc70e0 100644 --- a/windows/client-management/mdm/registry-csp.md +++ b/windows/client-management/mdm/registry-csp.md @@ -1,6 +1,6 @@ --- title: Registry CSP -description: Registry CSP +description: In this article, learn how to use the Registry configuration service provider (CSP) to update registry settings. ms.assetid: 2307e3fd-7b61-4f00-94e1-a639571f2c9d ms.reviewer: manager: dansimp @@ -17,7 +17,8 @@ ms.date: 06/26/2017 The Registry configuration service provider is used to update registry settings. However, if there is configuration service provider that is specific to the settings that need to be updated, use the specific configuration service provider. -> **Note**   The Registry CSP is only supported in Windows 10 Mobile for OEM configuration. Do not use this CSP for enterprise remote management. +> [!NOTE] +> The Registry CSP is only supported in Windows 10 Mobile for OEM configuration. Do not use this CSP for enterprise remote management. For Windows 10 Mobile only, this configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_OEM capabilities to be accessed from a network configuration application.   @@ -32,13 +33,12 @@ For OMA Client Provisioning, the follows notes apply: - This documentation describes the default characteristics. Additional characteristics may be added. -- Because the **Registry** configuration service provider uses the backslash (\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\). +- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\). The default security role maps to each subnode unless specific permission is granted to the subnode. The security role for subnodes is implementation specific, and can be changed by OEMs and mobile operators. ## Microsoft Custom Elements - The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning. @@ -75,11 +75,10 @@ The following table shows the Microsoft custom elements that this configuration
              - Use these elements to build standard OMA Client Provisioning configuration XML. For information about specific elements, see MSPROV DTD elements. -## Supported Data Types +## Supported Data Types The following table shows the data types this configuration service provider supports. diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md index 164f8d4a66..6b6bc9c191 100644 --- a/windows/client-management/mdm/registry-ddf-file.md +++ b/windows/client-management/mdm/registry-ddf-file.md @@ -1,6 +1,6 @@ --- title: Registry DDF file -description: Registry DDF file +description: Learn about the OMA DM device description framework (DDF) for the Registry configuration service provider (CSP). ms.assetid: 29b5cc07-f349-4567-8a77-387d816a9d15 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md index 3ea4ca8ee0..57368cb103 100644 --- a/windows/client-management/mdm/remotelock-csp.md +++ b/windows/client-management/mdm/remotelock-csp.md @@ -1,6 +1,6 @@ --- title: RemoteLock CSP -description: RemoteLock CSP +description: Learn how RemoteLock CSP supports the ability to lock a device that has a PIN set on the device or reset the PIN on a device that may or may not have a PIN set. ms.assetid: c7889331-5aa3-4efe-9a7e-20d3f433659b ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotelock-ddf-file.md b/windows/client-management/mdm/remotelock-ddf-file.md index 2408353c86..d740994fc1 100644 --- a/windows/client-management/mdm/remotelock-ddf-file.md +++ b/windows/client-management/mdm/remotelock-ddf-file.md @@ -1,6 +1,6 @@ --- title: RemoteLock DDF file -description: RemoteLock DDF file +description: Learn about the OMA DM device description framework (DDF) for the RemoteLock configuration service provider (CSP). ms.assetid: A301AE26-1BF1-4328-99AB-1ABBA4960797 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md index 726df442f0..999d8b629e 100644 --- a/windows/client-management/mdm/remotering-csp.md +++ b/windows/client-management/mdm/remotering-csp.md @@ -1,6 +1,6 @@ --- title: RemoteRing CSP -description: RemoteRing CSP +description: The RemoteRing CSP can be used to remotely trigger a device to produce an audible ringing sound regardless of the volume that's set on the device. ms.assetid: 70015243-c07f-46cb-a0f9-4b4ad13a5609 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index bdf604d6d8..efd8cdac2b 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -1,6 +1,6 @@ --- title: RemoteWipe CSP -description: RemoteWipe CSP +description: Learn how the RemoteWipe configuration service provider (CSP) can be used by mobile operators DM server or enterprise management server to remotely wipe a device. ms.assetid: 6e89bd37-7680-4940-8a67-11ed062ffb70 ms.reviewer: manager: dansimp @@ -48,16 +48,16 @@ Supported operation is Exec. Added in Windows 10, version 1709. Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command. **AutomaticRedeployment** -Added in Windows 10, next major update. Node for the Autopilot Reset operation. +Added in Windows 10, version 1809. Node for the Autopilot Reset operation. **AutomaticRedeployment/doAutomaticRedeployment** -Added in Windows 10, next major update. Exec on this node triggers Autopilot Reset operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard. +Added in Windows 10, version 1809. Exec on this node triggers Autopilot Reset operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard. **AutomaticRedeployment/LastError** -Added in Windows 10, next major update. Error value, if any, associated with Autopilot Reset operation (typically an HRESULT). +Added in Windows 10, version 1809. Error value, if any, associated with Autopilot Reset operation (typically an HRESULT). **AutomaticRedeployment/Status** -Added in Windows 10, next major update. Status value indicating current state of an Autopilot Reset operation. +Added in Windows 10, version 1809. Status value indicating current state of an Autopilot Reset operation. Supported values: diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 12a8de389a..36a83bee33 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -1,6 +1,6 @@ --- title: RemoteWipe DDF file -description: RemoteWipe DDF file +description: Learn about the OMA DM device description framework (DDF) for the RemoteWipe configuration service provider. ms.assetid: 10ec4fb7-f911-4d0c-9a8f-e96bf5faea0c ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md index 41ad075f64..5b16192077 100644 --- a/windows/client-management/mdm/reporting-ddf-file.md +++ b/windows/client-management/mdm/reporting-ddf-file.md @@ -1,6 +1,6 @@ --- title: Reporting DDF file -description: This topic shows the OMA DM device description framework (DDF) for the Reporting configuration service provider. This CSP was added in Windows 10, version 1511. Support for desktop security auditing was added for the desktop in Windows 10, version 1607. +description: View the OMA DM device description framework (DDF) for the Reporting configuration service provider. ms.assetid: 7A5B79DB-9571-4F7C-ABED-D79CD08C1E35 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md index efafe7ae2f..ad6dd045e3 100644 --- a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md +++ b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md @@ -1,6 +1,6 @@ --- title: REST API reference for Microsoft Store for Business -description: REST API reference for Microsoft Store for Business +description: Learn how the REST API reference for Microsoft Store for Business includes available operations and data structures. MS-HAID: - 'p\_phdevicemgmt.business\_store\_portal\_management\_rest\_api\_reference' - 'p\_phDeviceMgmt.rest\_api\_reference\_windows\_store\_for\_Business' diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 453649322c..1c5b7912aa 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -1,6 +1,6 @@ --- title: RootCATrustedCertificates CSP -description: RootCATrustedCertificates CSP +description: Learn how the RootCATrustedCertificates configuration service provider (CSP) enables the enterprise to set the Root Certificate Authority (CA) certificates. ms.assetid: F2F25DEB-9DB3-40FB-BC3C-B816CE470D61 ms.reviewer: manager: dansimp @@ -23,7 +23,9 @@ The RootCATrustedCertificates configuration service provider enables the enterpr   The following image shows the RootCATrustedCertificates configuration service provider in tree format. -![roocacertificate](images/provisioning-csp-rootcacertificate.png) +Detailed specification of the principal root nodes: + +![rootcacertificate](images/provisioning-csp-rootcacertificate.png) **Device or User** For device certificates, use **./Device/Vendor/MSFT** path and for user certificates use **./User/Vendor/MSFT** path. @@ -37,7 +39,6 @@ Defines the certificate store that contains root, or self-signed certificates, i > [!Note] > The **./User/** configuration is not supported for **RootCATrustedCertificates/Root/**. -  **RootCATrustedCertificates/CA** Node for CA certificates. @@ -48,42 +49,30 @@ Node for trusted publisher certificates. Node for trusted people certificates. **RootCATrustedCertificates/UntrustedCertificates** -Addeded in Windows 10, version 1803. Node for certificates that are not trusted. IT admin can use this node to immediately flag certificates that have been compromised and no longer usable. +Added in Windows 10, version 1803. Node for certificates that are not trusted. IT admin can use this node to immediately flag certificates that have been compromised and no longer usable. **_CertHash_** -Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value. +Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value. This node is common for all the principal root nodes. The supported operations are Get and Delete. -The supported operations are Get and Delete. +The following nodes are all common to the **_CertHash_** node: **/EncodedCertificate** -Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. - -The supported operations are Add, Get, and Replace. +Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. The supported operations are Add, Get, and Replace. **/IssuedBy** -Returns the name of the certificate issuer. This is equivalent to the **Issuer** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the name of the certificate issuer. This is equivalent to the **Issuer** member in the CERT\_INFO data structure. The only supported operation is Get. **/IssuedTo** -Returns the name of the certificate subject. This is equivalent to the **Subject** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the name of the certificate subject. This is equivalent to the **Subject** member in the CERT\_INFO data structure. The only supported operation is Get. **/ValidFrom** -Returns the starting date of the certificate's validity. This is equivalent to the **NotBefore** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the starting date of the certificate's validity. This is equivalent to the **NotBefore** member in the CERT\_INFO data structure. The only supported operation is Get. **/ValidTo** -Returns the expiration date of the certificate. This is equivalent to the **NotAfter** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the expiration date of the certificate. This is equivalent to the **NotAfter** member in the CERT\_INFO data structure. The only supported operation is Get. **/TemplateName** -Returns the certificate template name. - -The only supported operation is Get. +Returns the certificate template name. The only supported operation is Get. ## Related topics diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index a80fb75af6..166dfc0d43 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1,6 +1,6 @@ --- title: RootCATrustedCertificates DDF file -description: RootCATrustedCertificates DDF file +description: Learn about the OMA DM device description framework (DDF) for the RootCACertificates configuration service provider (CSP). ms.assetid: 06D8787B-D3E1-4D4B-8A21-8045A8F85C1C ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 7d972a5a96..6585261229 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -1,6 +1,6 @@ --- title: SecureAssessment CSP -description: SecureAssessment CSP +description: Learn how the SecureAssessment configuration service provider (CSP) is used to provide configuration information for the secure assessment browser. ms.assetid: 6808BE4B-961E-4638-BF15-FD7841D1C00A ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index f294bbb8a3..383470060b 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,6 +1,6 @@ --- title: SecureAssessment DDF file -description: This topic shows the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML ms.assetid: 68D17F2A-FAEA-4608-8727-DBEC1D7BE48A ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 9b8b3ce65d..9e203d4d39 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -1,6 +1,6 @@ --- title: SecurityPolicy CSP -description: SecurityPolicy CSP +description: The SecurityPolicy CSP is used to configure security policy settings for WAP push, OMA DM, Service Indication (SI), Service Loading (SL), and MMS. ms.assetid: 6014f8fe-f91b-49f3-a357-bdf625545bc9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md index 50b8b73b30..032469c901 100644 --- a/windows/client-management/mdm/server-requirements-windows-mdm.md +++ b/windows/client-management/mdm/server-requirements-windows-mdm.md @@ -1,6 +1,6 @@ --- title: Server requirements for using OMA DM to manage Windows devices -description: Server requirements for using OMA DM to manage Windows devices +description: Learn about the general server requirements for using OMA DM to manage Windows devices, including the supported versions of OMA DM. MS-HAID: - 'p\_phDeviceMgmt.server\_requirements\_for\_oma\_dm' - 'p\_phDeviceMgmt.server\_requirements\_windows\_mdm' diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index eaae458518..cf00680823 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -1,6 +1,6 @@ --- title: SharedPC CSP -description: SharedPC CSP +description: Learn how the SharedPC configuration service provider is used to configure settings for Shared PC usage. ms.assetid: 31273166-1A1E-4F96-B176-CB42ECB80957 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index b9ea9c1767..61e26ea7a0 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -1,6 +1,6 @@ --- title: SharedPC DDF file -description: SharedPC DDF file +description: Learn how the OMA DM device description framework (DDF) for the SharedPC configuration service provider (CSP). ms.assetid: 70234197-07D4-478E-97BB-F6C651C0B970 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md index 6ed19c97e1..3cb5d8920c 100644 --- a/windows/client-management/mdm/storage-csp.md +++ b/windows/client-management/mdm/storage-csp.md @@ -1,6 +1,6 @@ --- title: Storage CSP -description: Storage CSP +description: Learn how the Storage enterprise configuration service provider (CSP) is used to configure the storage card settings. ms.assetid: b19bdb54-53ed-42ce-a5a1-269379013f57 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md index ee4f4c5e68..17340fbf2d 100644 --- a/windows/client-management/mdm/storage-ddf-file.md +++ b/windows/client-management/mdm/storage-ddf-file.md @@ -1,6 +1,6 @@ --- title: Storage DDF file -description: Storage DDF file +description: Learn about the OMA DM device description framework (DDF) for the Storage configuration service provider (CSP). ms.assetid: 247062A3-4DFB-4B14-A3D1-68D02C27703C ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md index 0e0293bca8..2b482383bd 100644 --- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md @@ -1,6 +1,6 @@ --- title: Structure of OMA DM provisioning files -description: Structure of OMA DM provisioning files +description: Learn about the structure of OMA DM provisioning files, for example how each message is composed of a header, specified by the SyncHdr element, and a message body. ms.assetid: 7bd3ef57-c76c-459b-b63f-c5a333ddc2bc ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index 09ea7f32d0..45e335fdf9 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -1,6 +1,6 @@ --- title: SUPL CSP -description: SUPL CSP +description: Learn how the SUPL configuration service provider (CSP) is used to configure the location client. ms.assetid: afad0120-1126-4fc5-8e7a-64b9f2a5eae1 ms.reviewer: manager: dansimp @@ -9,15 +9,12 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/20/2018 +ms.date: 09/12/2019 --- # SUPL CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -The SUPL configuration service provider is used to configure the location client, as shown in the following table. +The SUPL configuration service provider is used to configure the location client, as shown in the following table: @@ -51,7 +48,7 @@ The SUPL configuration service provider is used to configure the location client
          • MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches.

          • @@ -68,7 +65,7 @@ The following diagram shows the SUPL configuration service provider management o   -![supl csp (dm,cp)](images/provisioning-csp-supl-dmandcp.png) +![SUPL csp (dm,cp)](images/provisioning-csp-supl-dmandcp.png) @@ -86,7 +83,10 @@ If this value is not specified, the device infers the H-SLP address from the IMS For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. **Version** -Optional. Determines the version of the SUPL protocol to use. For SUPL 1.0, set this value to `1`. For SUPL 2.0, set this value to `2`. The default is 1. +Optional. Determines the major version of the SUPL protocol to use. For SUPL 1.0.0, set this value to 1. For SUPL 2.0.0, set this value to 2. The default is 1. Refer to FullVersion to define the minor version and the service indicator. + +**FullVersion** +Added in Windows 10, version 2004. Optional. Determines the full version (X.Y.Z where X, Y, and Z are the major version, the minor version, and the service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. **MCCMNCPairs** Required. List all of the MCC and MNC pairs owned by the mobile operator. This list is used to verify that the UICC matches the network and SUPL can be used. When the UICC and network do not match, the device uses the default location service and does not use SUPL. @@ -295,7 +295,7 @@ Optional. Specifies the positioning method that the SUPL client will use for mob - + @@ -582,18 +582,6 @@ The following table shows the Microsoft custom elements that this configuration
              -
            • Address of the server—a mobile positioning center for non-trusted mode.

            • +
            • Address of the server — a mobile positioning center for non-trusted mode.

            • The positioning method used by the MPC for non-trusted mode.

            0

            None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.

            None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.

            1

              - ## Related topics - -[Configuration service provider reference](configuration-service-provider-reference.md) - -  - -  - - - - - - +[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index bf899e6c8e..2c1db8dd46 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -9,19 +9,16 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/20/2018 +ms.date: 06/03/2020 --- # SUPL DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -This topic shows the OMA DM device description framework (DDF) for the **SUPL** configuration service provider. +This topic shows the OMA DM device description framework (DDF) for the **SUPL** configuration service provider (CSP). Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is the DDF for the current version for this CSP. ```xml @@ -47,7 +44,7 @@ The XML below is for Windows 10, version 1809. - com.microsoft/1.1/MDM/SUPL + com.microsoft/1.2/MDM/SUPL
            @@ -159,7 +156,7 @@ The XML below is for Windows 10, version 1809. 1 - Optional. Determines the version of the SUPL protocol to use. For SUPL 1.0, set this value to 1. For SUPL 2.0, set this value to 2. The default is 1. + Optional. Determines the major version of the SUPL protocol to use. For SUPL 1.0.0, set this value to 1. For SUPL 2.0.0, set this value to 2. The default is 1. Refer to FullVersion to define the minor version and the service indicator. @@ -174,6 +171,29 @@ The XML below is for Windows 10, version 1809. + + FullVersion + + + + + + 1.0.0 + Optional. Determines the full version (X.Y.Z where X, Y, and Z are the major version, the minor version, and the service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. + + + + + + + + + + + text/plain + + + MCCMNCPairs diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index fcb23c170c..2b8f5d0334 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -161,7 +161,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format ErrorContext value -Stage where error occured +Stage where error occurred Description and suggestions @@ -239,7 +239,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

            The data type is boolean. Supported operation is Get and Replace. **InBoxApps/Welcome/CurrentBackgroundPath** -

            Background image for the welcome screen. To set this, specify a https URL to a PNG file (only PNGs are supported for security reasons). +

            Background image for the welcome screen. To set this, specify an https URL to a PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image.

            The data type is string. Supported operation is Get and Replace. @@ -333,7 +333,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format 0 -Never timeout +Never time out 1 1 minute @@ -385,7 +385,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format 0 -Never timeout +Never time out 1 1 minute (default) @@ -437,7 +437,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format 0 -Never timeout +Never time out 1 1 minute @@ -474,6 +474,16 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

            The data type is integer. Supported operation is Get and Replace. +**Properties/SleepMode** +

            Added in Windows 10, version 20H2. Specifies the type of sleep mode for the Surface Hub. + +

            Valid values: + +- 0 - Connected Standby (default) +- 1 - Hibernate + +

            The data type is integer. Supported operation is Get and Replace. + **Properties/AllowSessionResume**

            Added in Windows 10, version 1703. Specifies whether to allow the ability to resume a session when the session times out. diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md index 041b690a01..b064d57b68 100644 --- a/windows/client-management/mdm/tenantlockdown-ddf.md +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -1,6 +1,6 @@ --- title: TenantLockdown DDF file -description: XML file containing the device description framework +description: XML file containing the device description framework for the TenantLockdown configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index 36f46f9df1..f97ea96a00 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -1,6 +1,6 @@ --- title: TPMPolicy CSP -description: TPMPolicy CSP +description: The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero exhaust configuration on a Windows device for TPM software components. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md index fcdb101ad2..fd463047e0 100644 --- a/windows/client-management/mdm/tpmpolicy-ddf-file.md +++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md @@ -1,6 +1,6 @@ --- title: TPMPolicy DDF file -description: TPMPolicy DDF file +description: Learn about the OMA DM device description framework (DDF) for the TPMPolicy configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md index ff3e25edce..c26f13353d 100644 --- a/windows/client-management/mdm/uefi-csp.md +++ b/windows/client-management/mdm/uefi-csp.md @@ -20,7 +20,7 @@ The UEFI configuration service provider (CSP) interfaces to UEFI's Device Firmwa > The UEFI CSP version published in Windows 10, version 1803 is replaced with this one (version 1809). > [!NOTE] -> The production UEFI CSP is present in 1809, but it depends upon the Device Firmware Configuration Interface (DFCI) and UEFI firmware to comply with this interface. The specification for this interface and compatible firmware is not yet available. +> The production UEFI CSP is present in 1809, but it depends upon the [Device Firmware Configuration Interface (DFCI) and UEFI firmware](https://microsoft.github.io/mu/dyn/mu_plus/DfciPkg/Docs/Dfci_Feature/) to comply with this interface. The following diagram shows the UEFI CSP in tree format. @@ -70,7 +70,7 @@ Apply a permissions information package to UEFI. Input is the signed package in Value type is Base64. Supported operation is Replace. **Permissions/Result** -Retrieves the binary result package of the previous Permissions/Apply operation. This binary package contains XML describing the action taken for each individual permission. +Retrieves the binary result package of the previous Permissions/Apply operation. This binary package contains XML describing the action taken for each individual permission. Supported operation is Get. @@ -109,17 +109,17 @@ Supported operation is Get. Node for settings permission operations. Alternate endpoint for sending a second permission package without an OS restart. **Permissions2/Apply** -Apply a permissions information package to UEFI. Input is the signed package in base64 encoded format. Alternate location for sending two permissions information packages in the same session. +Apply a permissions information package to UEFI. Input is the signed package in base64 encoded format. Alternate location for sending two permissions information packages in the same session. Value type is Base64. Supported operation is Replace. **Permissions2/Result** -Retrieves the binary result package from the previous Permissions2/Apply operation. This binary package contains XML describing the action taken for each individual permission. +Retrieves the binary result package from the previous Permissions2/Apply operation. This binary package contains XML describing the action taken for each individual permission. Supported operation is Get. **Settings2** -Nodefor device settings operations. Alternate endpoint for sending a second settings package without an OS restart. +Node for device settings operations. Alternate endpoint for sending a second settings package without an OS restart. **Settings2/Apply** Apply a settings information package to UEFI. Input is the signed package in base64 encoded format. Alternate location for sending two settings information packages in the same session. @@ -130,3 +130,8 @@ Value type is Base64. Supported operation is Replace. Retrieves the binary result package of previous Settings2/Apply operation. This binary package contains XML describing the action taken for each individual setting. Supported operation is Get. + + +## Related topics + +[UEFI DDF file](./uefi-ddf.md) diff --git a/windows/client-management/mdm/uefi-ddf.md b/windows/client-management/mdm/uefi-ddf.md index 808685d36d..1432ef811a 100644 --- a/windows/client-management/mdm/uefi-ddf.md +++ b/windows/client-management/mdm/uefi-ddf.md @@ -1,6 +1,6 @@ --- title: UEFI DDF file -description: UEFI DDF file +description: Learn about the OMA DM device description framework (DDF) for the Uefi configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 33001ff094..14cd5810b2 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/02/2018 +ms.date: 03/23/2020 ms.reviewer: manager: dansimp --- @@ -28,7 +28,7 @@ Depending on the specific category of the settings that they control (OS or appl In a domain controller/Group Policy ecosystem, Group Policies are automatically added to the registry of the client computer or user profile by the Administrative Templates Client Side Extension (CSE) whenever the client computer processes a Group Policy. Conversely, in an MDM-managed client, ADMX files are leveraged to define policies independent of Group Policies. Therefore, in an MDM-managed client, a Group Policy infrastructure, including the Group Policy Service (gpsvc.exe), is not required. -An ADMX file can either be shipped with Windows (located at `%SystemRoot%\policydefinitions`) or it can be ingested to a device through the Policy CSP URI (`./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`). Inbox ADMX files are processed into MDM policies at OS-build time. ADMX files that are ingested are processed into MDM policies post-OS shipment through the Policy CSP. Because the Policy CSP does not rely upon any aspect of the Group Policy client stack, including the PC’s Group Policy Service (GPSvc), the policy handlers that are ingested to the device are able to react to policies that are set by the MDM. +An ADMX file can either be shipped with Windows (located at `%SystemRoot%\policydefinitions`) or it can be ingested to a device through the Policy CSP URI (`./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`). Inbox ADMX files are processed into MDM policies at OS-build time. ADMX files that are ingested are processed into MDM policies post-OS shipment through the Policy CSP. Because the Policy CSP does not rely upon any aspect of the Group Policy client stack, including the PC's Group Policy Service (GPSvc), the policy handlers that are ingested to the device are able to react to policies that are set by the MDM. Windows maps the name and category path of a Group Policy to a MDM policy area and policy name by parsing the associated ADMX file, finding the specified Group Policy, and storing the definition (metadata) in the MDM Policy CSP client store. When the MDM policy is referenced by a SyncML command and the Policy CSP URI, `.\[device|user]\vendor\msft\policy\[config|result]\\`, this metadata is referenced and determines which registry keys are set or removed. For a list of ADMX-backed policies supported by MDM, see [Policy CSP - ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#admx-backed-policies). @@ -37,22 +37,22 @@ Windows maps the name and category path of a Group Policy to a MDM policy area a ## ADMX files and the Group Policy Editor -To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrator must use a UI, such as the Group Policy Editor (gpedit.msc), to gather the necessary data. The MDM ISV console UI determines how to gather the needed Group Policy data from the IT administrator. ADMX-backed Group Policies are organized in a hierarchy and can have a scope of machine, user, or both. The Group Policy example in the next section uses a machine-wide Group Policy named “Publishing Server 2 Settings.” When this Group Policy is selected, its available states are **Not Configured**, **Enabled**, and **Disabled**. +To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrator must use a UI, such as the Group Policy Editor (gpedit.msc), to gather the necessary data. The MDM ISV console UI determines how to gather the needed Group Policy data from the IT administrator. ADMX-backed Group Policies are organized in a hierarchy and can have a scope of machine, user, or both. The Group Policy example in the next section uses a machine-wide Group Policy named "Publishing Server 2 Settings." When this Group Policy is selected, its available states are **Not Configured**, **Enabled**, and **Disabled**. -The ADMX file that the MDM ISV uses to determine what UI to display to the IT administrator is the same ADMX file that the client uses for the policy definition. The ADMX file is processed either by the OS at build time or set by the client at OS runtime. In either case, the client and the MDM ISV must be synchronized with the ADMX policy definitions. Each ADMX file corresponds to a Group Policy category and typically contains several policy definitions, each of which represents a single Group Policy. For example, the policy definition for the “Publishing Server 2 Settings” is contained in the appv.admx file, which holds the policy definitions for the Microsoft Application Virtualization (App-V) Group Policy category. +The ADMX file that the MDM ISV uses to determine what UI to display to the IT administrator is the same ADMX file that the client uses for the policy definition. The ADMX file is processed either by the OS at build time or set by the client at OS runtime. In either case, the client and the MDM ISV must be synchronized with the ADMX policy definitions. Each ADMX file corresponds to a Group Policy category and typically contains several policy definitions, each of which represents a single Group Policy. For example, the policy definition for the "Publishing Server 2 Settings" is contained in the appv.admx file, which holds the policy definitions for the Microsoft Application Virtualization (App-V) Group Policy category. Group Policy option button setting: - If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur: - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. - - The MDM client stack receives this data, which causes the Policy CSP to update the device’s registry per the ADMX-backed policy definition. + - The MDM client stack receives this data, which causes the Policy CSP to update the device's registry per the ADMX-backed policy definition. - If **Disabled** is selected and you click **Apply**, the following events occur: - The MDM ISV server sets up a Replace SyncML command with a payload set to ``. - - The MDM client stack receives this command, which causes the Policy CSP to either delete the device’s registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition. + - The MDM client stack receives this command, which causes the Policy CSP to either delete the device's registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition. - If **Not Configured** is selected and you click **Apply**, the following events occur: - MDM ISV server sets up a Delete SyncML command. - - The MDM client stack receives this command, which causes the Policy CSP to delete the device’s registry settings per the ADMX-backed policy definition. + - The MDM client stack receives this command, which causes the Policy CSP to delete the device's registry settings per the ADMX-backed policy definition. The following diagram shows the main display for the Group Policy Editor. @@ -62,7 +62,7 @@ The following diagram shows the settings for the "Publishing Server 2 Settings" ![Group Policy publisher server 2 settings](images/group-policy-publisher-server-2-settings.png) -Note that most Group Policies are a simple Boolean type. For a Boolean Group Policy, if you select **Enabled**, the options panel contains no data input fields and the payload of the SyncML is simply ``. However, if there are data input fields in the options panel, the MDM server must supply this data. The following *Enabling a Group Policy* example illustrates this complexity. In this example, 10 name-value pairs are described by `` tags in the payload, which correspond to the 10 data input fields in the Group Policy Editor options panel for the "Publishing Server 2 Settings" Group Policy. The ADMX file, which defines the Group Policies, is consumed by the MDM server, similarly to how the Group Policy Editor consumes it. The Group Policy Editor displays a UI to receive the complete Group Policy instance data, which the MDM server’s IT administrator console must also do. For every `` element and id attribute in the ADMX policy definition, there must be a corresponding `` element and id attribute in the payload. The ADMX file drives the policy definition and is required by the MDM server via the SyncML protocol. +Note that most Group Policies are a simple Boolean type. For a Boolean Group Policy, if you select **Enabled**, the options panel contains no data input fields and the payload of the SyncML is simply ``. However, if there are data input fields in the options panel, the MDM server must supply this data. The following *Enabling a Group Policy* example illustrates this complexity. In this example, 10 name-value pairs are described by `` tags in the payload, which correspond to the 10 data input fields in the Group Policy Editor options panel for the "Publishing Server 2 Settings" Group Policy. The ADMX file, which defines the Group Policies, is consumed by the MDM server, similarly to how the Group Policy Editor consumes it. The Group Policy Editor displays a UI to receive the complete Group Policy instance data, which the MDM server's IT administrator console must also do. For every `` element and id attribute in the ADMX policy definition, there must be a corresponding `` element and id attribute in the payload. The ADMX file drives the policy definition and is required by the MDM server via the SyncML protocol. > [!IMPORTANT] > Any data entry field that is displayed in the Group Policy page of the Group Policy Editor must be supplied in the encoded XML of the SyncML payload. The SyncML data payload is equivalent to the user-supplied Group Policy data through GPEdit.msc. @@ -171,7 +171,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2 - + ]]> @@ -249,10 +249,10 @@ Note that the data payload of the SyncML needs to be encoded so that it does not . . . - - - - + + + + . . . @@ -260,7 +260,7 @@ Note that the data payload of the SyncML needs to be encoded so that it does not The **LocURI** for the above GP policy is: -`.\Device\Vendor\MSFT\Policy\Config\AppVirtualization\PublishingAllowServer2` +`./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2` To construct SyncML for your area/policy using the samples below, you need to update the **data id** and the **value** in the `` section of the SyncML. The items prefixed with an '&' character are the escape characters needed and can be retained as shown. @@ -275,7 +275,7 @@ The `text` element simply corresponds to a string and correspondingly to an edit - + ``` @@ -310,14 +310,14 @@ The `multiText` element simply corresponds to a REG_MULTISZ registry string and ```XML - - - - - + explainText="$(string.Virtualization_JITVAllowList_Help)" presentation="$(presentation.Virtualization_JITVAllowList)" + key="SOFTWARE\Policies\Microsoft\AppV\Client\Virtualization" + valueName="ProcessesUsingVirtualComponents"> + + + + + ``` @@ -337,7 +337,7 @@ The `multiText` element simply corresponds to a REG_MULTISZ registry string and ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/VirtualComponentsAllowList - + ]]> @@ -352,7 +352,7 @@ The `list` element simply corresponds to a hive of REG_SZ registry strings and c > [!NOTE] > It is expected that each string in the SyncML is to be separated by the Unicode character 0xF000 (encoded version: ``). -Variations of the `list` element are dictated by attributes. These attributes are ignored by the Policy Manager runtime. It is expected that the MDM server manages the name/value pairs. See below for a simple writeup of Group Policy List. +Variations of the `list` element are dictated by attributes. These attributes are ignored by the Policy Manager runtime. It is expected that the MDM server manages the name/value pairs. See below for a simple write up of Group Policy List. **ADMX file: inetres.admx** @@ -361,7 +361,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar - + ``` @@ -381,7 +381,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ./User/Vendor/MSFT/Policy/Config/InternetExplorer/DisableSecondaryHomePageChange - + ]]> @@ -413,7 +413,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ./Device/Vendor/MSFT/Policy/Config/InternetExplorer/DisableUpdateCheck - + ]]> @@ -425,32 +425,32 @@ Variations of the `list` element are dictated by attributes. These attributes ar ```XML - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + ``` @@ -467,8 +467,8 @@ Variations of the `list` element are dictated by attributes. These attributes ar ./Device/Vendor/MSFT/Policy/Config/BitLocker/EncryptionMethodByDriveType - - + + ]]> @@ -482,13 +482,13 @@ Variations of the `list` element are dictated by attributes. These attributes ar ```XML - - - - - + + + + + ``` @@ -504,8 +504,8 @@ Variations of the `list` element are dictated by attributes. These attributes ar ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/StreamingAllowReestablishmentInterval - - + + ]]> @@ -518,25 +518,25 @@ Variations of the `list` element are dictated by attributes. These attributes ar ```XML - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + ``` @@ -557,8 +557,8 @@ Variations of the `list` element are dictated by attributes. These attributes ar ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses - - + + ]]> diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index f9ff52da32..ae0b5e11c1 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -1,6 +1,6 @@ --- title: UnifiedWriteFilter CSP -description: The UnifiedWriteFilter (UWF) configuration service provider enables the IT administrator to remotely manage the UWF to help protect physical storage media including any writable storage type. +description: The UnifiedWriteFilter (UWF) configuration service provider allows you to remotely manage the UWF. Understand how it helps protect physical storage media. ms.assetid: F4716AC6-0AA5-4A67-AECE-E0F200BA95EB ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index bacfd4f923..183c89df6d 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -1,6 +1,6 @@ --- title: Update CSP -description: Update CSP +description: Learn how the Update configuration service provider (CSP) enables IT administrators to manage and control the rollout of new updates. ms.assetid: F1627B57-0749-47F6-A066-677FDD3D7359 ms.reviewer: manager: dansimp @@ -16,6 +16,9 @@ ms.date: 02/23/2018 The Update configuration service provider enables IT administrators to manage and control the rollout of new updates. +> [!Note] +> The Update CSP functionality of 'AprrovedUpdates' is not recommended for managing desktop devices. To manage updates to desktop devices from Windows Update, see the [Policy CSP - Updates](policy-csp-update.md) documentation for the recommended policies. + The following diagram shows the Update configuration service provider in tree format. ![update csp diagram](images/provisioning-csp-update.png) diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index 731adeeb60..44f580cb4f 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -1,6 +1,6 @@ --- title: Update DDF file -description: Update DDF file +description: Learn about the OMA DM device description framework (DDF) for the Update configuration service provider (CSP). ms.assetid: E236E468-88F3-402A-BA7A-834ED38DD388 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md index 300711d733..5bdd2eaf0f 100644 --- a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -50,17 +50,17 @@ New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{Pare Get-CimInstance -Namespace $namespaceName -ClassName $className # Query instances with matching properties -Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" +Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" # Modify existing instance -$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" $obj.WLANScanMode=500 Set-CimInstance -CimInstance $obj # Delete existing instance try { - $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" + $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" Remove-CimInstance -CimInstance $obj } catch [Exception] @@ -113,9 +113,9 @@ $session = New-CimSession # Create a new instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $newInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $newInstance.CimInstanceProperties.Add($property) $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("AllowEAPCertSSO", 1, "Sint32", "Property") $newInstance.CimInstanceProperties.Add($property) @@ -138,9 +138,9 @@ $session.EnumerateInstances($namespaceName, $className, $options) # with matching properties ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -155,9 +155,9 @@ catch [Exception] # Modify existing instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -174,9 +174,9 @@ catch [Exception] # Delete existing instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -209,7 +209,7 @@ $params.Add($param) try { - $instance = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT' and InstanceID='WindowsLicensing'" + $instance = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT' and InstanceID='WindowsLicensing'" $session.InvokeMethod($namespaceName, $instance, $methodName, $params) } catch [Exception] diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 7b8f154145..60702d4f69 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -1,6 +1,6 @@ --- title: VPN CSP -description: VPN CSP +description: Learn how the VPN configuration service provider (CSP) allows the mobile device management (MDM) server to configure the VPN profile of the device. ms.assetid: 05ca946a-1c0b-4e11-8d7e-854e14740707 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index b3e8aef28c..889a2f8f25 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -1,6 +1,6 @@ --- title: VPN DDF file -description: VPN DDF file +description: Learn about the OMA DM device description framework (DDF) for the VPN configuration service provider (CSP). ms.assetid: 728FCD9C-0B8E-413B-B54A-CD72C9F2B9EE ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index fa5597ecf6..0325decbfc 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -1,15 +1,15 @@ --- title: VPNv2 CSP -description: VPNv2 CSP +description: Learn how the VPNv2 configuration service provider (CSP) allows the mobile device management (MDM) server to configure the VPN profile of the device. ms.assetid: 51ADA62E-1EE5-4F15-B2AD-52867F5B2AD2 -ms.reviewer: +ms.reviewer: pesmith manager: dansimp ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 11/01/2017 +ms.date: 10/30/2020 --- # VPNv2 CSP @@ -19,19 +19,19 @@ The VPNv2 configuration service provider allows the mobile device management (MD Here are the requirements for this CSP: -- VPN configuration commands must be wrapped in an Atomic block in SyncML. -- For best results, configure your VPN certificates first before pushing down VPN profiles to devices. If you are using Windows Information Protection (WIP) (formerly known as Enterprise Data Protection), then you should configure VPN first before you configure WIP policies. -- Instead of changing individual properties, follow these steps to make any changes: +- VPN configuration commands must be wrapped in an Atomic block in SyncML. +- For best results, configure your VPN certificates first before pushing down VPN profiles to devices. If you are using Windows Information Protection (WIP) (formerly known as Enterprise Data Protection), then you should configure VPN first before you configure WIP policies. +- Instead of changing individual properties, follow these steps to make any changes: - - Send a Delete command for the ProfileName to delete the entire profile. - - Send the entire profile again with new values wrapped in an Atomic block. + - Send a Delete command for the ProfileName to delete the entire profile. + - Send the entire profile again with new values wrapped in an Atomic block. In certain conditions you can change some properties directly, but we do not recommend it. The XSDs for all EAP methods are shipped in the box and can be found at the following locations: -- C:\\Windows\\schemas\\EAPHost -- C:\\Windows\\schemas\\EAPMethods +- `C:\\Windows\\schemas\\EAPHost` +- `C:\\Windows\\schemas\\EAPMethods` The following diagram shows the VPNv2 configuration service provider in tree format. @@ -45,13 +45,14 @@ Unique alpha numeric identifier for the profile. The profile name must not inclu Supported operations include Get, Add, and Delete. -> **Note**  If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard. +> [!NOTE] +> If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard. **VPNv2/**ProfileName**/AppTriggerList** Optional node. List of applications set to trigger the VPN. If any of these apps are launched and the VPN profile is currently the active profile, this VPN profile will be triggered to connect. **VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId -A sequential integer identifier which allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you should not skip numbers. +A sequential integer identifier that allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you should not skip numbers. Supported operations include Get, Add, Replace, and Delete. @@ -64,8 +65,8 @@ App identity, which is either an app’s package family name or file path. The t **VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId**/App/Type** Returns the type of **App/Id**. This value can be either of the following: -- PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. -- FilePath - When this is returned, the App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. +- PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. +- FilePath - When this is returned, the App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. Value type is chr. Supported operation is Get. @@ -99,8 +100,8 @@ Value type is int. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/RouteList/**routeRowId**/ExclusionRoute** Added in Windows 10, version 1607. A boolean value that specifies if the route being added should point to the VPN Interface or the Physical Interface as the Gateway. Valid values: -- False (default) - This route will direct traffic over the VPN -- True - This route will direct traffic over the physical interface. +- False (default) - This route will direct traffic over the VPN +- True - This route will direct traffic over the physical interface. Supported operations include Get, Add, Replace, and Delete. @@ -117,30 +118,29 @@ Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DomainName** Used to indicate the namespace to which the policy applies. When a Name query is issued, the DNS client compares the name in the query to all of the namespaces under DomainNameInformationList to find a match. This parameter can be one of the following types: -- FQDN - Fully qualified domain name -- Suffix - A domain suffix that will be appended to the shortname query for DNS resolution. To specify a suffix, prepend a **.** to the DNS suffix. +- FQDN - Fully qualified domain name +- Suffix - A domain suffix that will be appended to the shortname query for DNS resolution. To specify a suffix, prepend a **.** to the DNS suffix. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DomainNameType** Returns the namespace type. This value can be one of the following: -- FQDN - If the DomainName was not prepended with a **.** and applies only to the fully qualified domain name (FQDN) of a specified host. -- Suffix - If the DomainName was prepended with a **.** and applies to the specified namespace, all records in that namespace, and all subdomains. +- FQDN - If the DomainName was not prepended with a **.** and applies only to the fully qualified domain name (FQDN) of a specified host. +- Suffix - If the DomainName was prepended with a **.** and applies to the specified namespace, all records in that namespace, and all subdomains. Value type is chr. Supported operation is Get. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DnsServers** -List of comma separated DNS Server IP addresses to use for the namespace. +List of comma-separated DNS Server IP addresses to use for the namespace. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/WebProxyServers** Optional. Web Proxy Server IP address if you are redirecting traffic through your intranet. -> **Note**  Currently only one web proxy server is supported. - - +> [!NOTE] +> Currently only one web proxy server is supported. Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -166,9 +166,8 @@ Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList** An optional node that specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. -> **Note**  Once a TrafficFilterList is added, all traffic are blocked other than the ones matching the rules. - - +> [!NOTE] +> Once a TrafficFilterList is added, all traffic are blocked other than the ones matching the rules. When adding multiple rules, each rule operates based on an OR with the other rules. Within each rule, each property operates based on an AND with each other. @@ -183,9 +182,9 @@ App identity for the app-based traffic filter. The value for this node can be one of the following: -- PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. -- FilePath - This App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. -- SYSTEM – This value enables Kernel Drivers to send traffic through VPN (for example, PING or SMB). +- PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. +- FilePath - This App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. +- SYSTEM – This value enables Kernel Drivers to send traffic through VPN (for example, PING or SMB). Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -203,43 +202,51 @@ Numeric value from 0-255 representing the IP protocol to allow. For example, TCP Value type is int. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/LocalPortRanges** -A list of comma separated values specifying local port ranges to allow. For example, `100-120, 200, 300-320`. +A list of comma-separated values specifying local port ranges to allow. For example, `100-120, 200, 300-320`. -> **Note**  Ports are only valid when the protocol is set to TCP=6 or UDP=17. - - +> [!NOTE] +> Ports are only valid when the protocol is set to TCP=6 or UDP=17. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RemotePortRanges** -A list of comma separated values specifying remote port ranges to allow. For example, `100-120, 200, 300-320`. +A list of comma-separated values specifying remote port ranges to allow. For example, `100-120, 200, 300-320`. -> **Note**  Ports are only valid when the protocol is set to TCP=6 or UDP=17. - - +> [!NOTE] +> Ports are only valid when the protocol is set to TCP=6 or UDP=17. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/LocalAddressRanges** -A list of comma separated values specifying local IP address ranges to allow. +A list of comma-separated values specifying local IP address ranges to allow. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RemoteAddressRanges** -A list of comma separated values specifying remote IP address ranges to allow. +A list of comma-separated values specifying remote IP address ranges to allow. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RoutingPolicyType** Specifies the routing policy if an App or Claims type is used in the traffic filter. The scope of this property is for this traffic filter rule alone. The value can be one of the following: -- SplitTunnel - For this traffic filter rule, only the traffic meant for the VPN interface (as determined by the networking stack) goes over the interface. Internet traffic can continue to go over the other interfaces. -- ForceTunnel - For this traffic rule all IP traffic must go through the VPN Interface only. +- SplitTunnel - For this traffic filter rule, only the traffic meant for the VPN interface (as determined by the networking stack) goes over the interface. Internet traffic can continue to go over the other interfaces. +- ForceTunnel - For this traffic rule all IP traffic must go through the VPN Interface only. This is only applicable for App ID based Traffic Filter rules. Value type is chr. Supported operations include Get, Add, Replace, and Delete. +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/Direction** +Added in Windows 10, version 2004. Specifies the traffic direction to apply this policy to. Default is Outbound. The value can be one of the following: + +- Outbound - The rule applies to all outbound traffic +- Inbound - The rule applies to all inbound traffic + +If no inbound filter is provided, then by default all unsolicited inbound traffic will be blocked. + +Value type is chr. Supported operations include Get, Add, Replace, and Delete. + **VPNv2/**ProfileName**/EdpModeId** Enterprise ID, which is required for connecting this VPN profile with an WIP policy. When this is set, the networking stack looks for this Enterprise ID in the app token to determine if the traffic is allowed to go over the VPN. If the profile is active, it also automatically triggers the VPN to connect. We recommend having only one such profile per device. @@ -255,21 +262,22 @@ Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/AlwaysOn** An optional flag to enable Always On mode. This will automatically connect the VPN at sign-in and will stay connected until the user manually disconnects. -> **Note**  Always On only works for the active profile. The first profile provisioned that can be auto triggered will automatically be set as active. +> [!NOTE] +> Always On only works for the active profile. The first profile provisioned that can be auto triggered will automatically be set as active. Preserving user Always On preference Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList. Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference. -Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config +Key: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config` Value: AutoTriggerDisabledProfilesList Type: REG_MULTI_SZ Valid values: -- False (default) - Always On is turned off. -- True - Always On is turned on. +- False (default) - Always On is turned off. +- True - Always On is turned on. Value type is bool. Supported operations include Get, Add, Replace, and Delete. @@ -278,15 +286,15 @@ Lockdown profile. Valid values: -- False (default) - this is not a LockDown profile. -- True - this is a LockDown profile. +- False (default) - this is not a LockDown profile. +- True - this is a LockDown profile. When the LockDown profile is turned on, it does the following things: -- First, it automatically becomes an "always on" profile. -- Second, it can never be disconnected. -- Third, if the profile is not connected, then the user has no network. -- Fourth, no other profiles may be connected or modified. +- First, it automatically becomes an "always on" profile. +- Second, it can never be disconnected. +- Third, if the profile is not connected, then the user has no network. +- Fourth, no other profiles may be connected or modified. A Lockdown profile must be deleted before you can add, remove, or connect other profiles. @@ -297,14 +305,14 @@ Device tunnel profile. Valid values: -- False (default) - this is not a device tunnel profile. -- True - this is a device tunnel profile. +- False (default) - this is not a device tunnel profile. +- True - this is a device tunnel profile. When the DeviceTunnel profile is turned on, it does the following things: -- First, it automatically becomes an "always on" profile. -- Second, it does not require the presence or logging in of any user to the machine in order for it to connect. -- Third, no other device tunnel profile maybe be present on the same machine. +- First, it automatically becomes an "always on" profile. +- Second, it does not require the presence or logging in of any user to the machine in order for it to connect. +- Third, no other device tunnel profile maybe be present on the same machine. A device tunnel profile must be deleted before another device tunnel profile can be added, removed, or connected. @@ -315,11 +323,11 @@ Allows registration of the connection's address in DNS. Valid values: -- False = Do not register the connection's address in DNS (default). -- True = Register the connection's addresses in DNS. +- False = Do not register the connection's address in DNS (default). +- True = Register the connection's addresses in DNS. **VPNv2/**ProfileName**/DnsSuffix** -Optional. Specifies one or more comma separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList. +Optional. Specifies one or more comma-separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList. Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -337,7 +345,10 @@ Added in Windows 10, version 1607. The XML schema for provisioning all the fiel Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/Proxy** -A collection of configuration objects to enable a post-connect proxy support for VPN. The proxy defined for this profile is applied when this profile is active and connected. +A collection of configuration objects to enable a post-connect proxy support for VPN Force Tunnel connections. The proxy defined for this profile is applied when this profile is active and connected. + +> [!NOTE] +> VPN proxy settings are used only on Force Tunnel connections. On Split Tunnel connections, the general proxy settings are used. **VPNv2/**ProfileName**/Proxy/Manual** Optional node containing the manual server settings. @@ -428,29 +439,30 @@ Required for native profiles. Public or routable IP address or DNS name for the The name can be a server name plus a friendly name separated with a semi-colon. For example, server2.example.com;server2FriendlyName. When you get the value, the return will include both the server name and the friendly name; if no friendly name had been supplied it will default to the server name. -You can make a list of server by making a list of server names (with optional friendly names) seperated by commas. For example, server1.example.com,server2.example.com. +You can make a list of server by making a list of server names (with optional friendly names) separated by commas. For example, server1.example.com,server2.example.com. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/NativeProfile/RoutingPolicyType** Optional for native profiles. Type of routing policy. This value can be one of the following: -- SplitTunnel - Traffic can go over any interface as determined by the networking stack. -- ForceTunnel - All IP traffic must go over the VPN interface. +- SplitTunnel - Traffic can go over any interface as determined by the networking stack. +- ForceTunnel - All IP traffic must go over the VPN interface. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/NativeProfile/NativeProtocolType** Required for native profiles. Type of tunneling protocol used. This value can be one of the following: -- PPTP -- L2TP -- IKEv2 -- Automatic +- PPTP +- L2TP +- IKEv2 +- Automatic Value type is chr. Supported operations include Get, Add, Replace, and Delete. -> **Note** The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt protocols in following order: IKEv2, PPTP and then L2TP. This order is not customizable. +> [!NOTE] +> The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt protocols in following order: SSTP, IKEv2, PPTP and then L2TP. This order is not customizable. **VPNv2/**ProfileName**/NativeProfile/Authentication** Required node for native profile. It contains authentication information for the native VPN profile. @@ -502,12 +514,12 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- MD596 -- SHA196 -- SHA256128 -- GCMAES128 -- GCMAES192 -- GCMAES256 +- MD596 +- SHA196 +- SHA256128 +- GCMAES128 +- GCMAES192 +- GCMAES256 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -516,14 +528,14 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- DES -- DES3 -- AES128 -- AES192 -- AES256 -- GCMAES128 -- GCMAES192 -- GCMAES256 +- DES +- DES3 +- AES128 +- AES192 +- AES256 +- GCMAES128 +- GCMAES192 +- GCMAES256 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -532,13 +544,13 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- DES -- DES3 -- AES128 -- AES192 -- AES256 -- AES\_GCM_128 -- AES\_GCM_256 +- DES +- DES3 +- AES128 +- AES192 +- AES256 +- AES\_GCM_128 +- AES\_GCM_256 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -547,10 +559,10 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- MD5 -- SHA196 -- SHA256 -- SHA384 +- MD5 +- SHA196 +- SHA256 +- SHA384 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -559,12 +571,12 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- Group1 -- Group2 -- Group14 -- ECP256 -- ECP384 -- Group24 +- Group1 +- Group2 +- Group14 +- ECP256 +- ECP384 +- Group24 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -573,13 +585,13 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- PFS1 -- PFS2 -- PFS2048 -- ECP256 -- ECP384 -- PFSMM -- PFS24 +- PFS1 +- PFS2 +- PFS2048 +- ECP256 +- ECP384 +- PFSMM +- PFS24 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -1308,8 +1320,7 @@ Servers ``` -## Related topics - +## See also [Configuration service provider reference](configuration-service-provider-reference.md) @@ -1321,4 +1332,3 @@ Servers - diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index aa531d9602..ea97295698 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -2,14 +2,14 @@ title: VPNv2 DDF file description: This topic shows the OMA DM device description framework (DDF) for the VPNv2 configuration service provider. ms.assetid: 4E2F36B7-D2EE-4F48-AD1A-6BDE7E72CC94 -ms.reviewer: +ms.reviewer: pesmith manager: dansimp ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 12/05/2017 +ms.date: 10/30/2020 --- # VPNv2 DDF file @@ -19,7 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **VPNv2** Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1709. +The XML below is for Windows 10, version 2004. ```xml @@ -32,7 +32,7 @@ The XML below is for Windows 10, version 1709. 1.2 VPNv2 - ./Device/Vendor/MSFT + ./Vendor/MSFT @@ -830,6 +830,33 @@ The XML below is for Windows 10, version 1709. + + Direction + + + + + + + + + Outbound - The traffic filter allows traffic to reach destinations matching this rule. This is the default. + Inbound - The traffic filter allows traffic coming from external locations matching this rule. + + + + + + + + + + + + text/plain + + + @@ -1625,6 +1652,76 @@ The XML below is for Windows 10, version 1709. + + WebAuth + + + + + + Nodes under WebAuth can be used to enable WebToken based authentication for 3rd Party Plugin VPN Profiles. + + + + + + + + + + + + + + + Enabled + + + + + + + + Enables the WebToken based authentication flow. + + + + + + + + + + + text/plain + + + + + ClientId + + + + + + + + The client ID to specify when communicating with the Web Account provider in retrieving the token. + + + + + + + + + + + text/plain + + + + NativeProfile @@ -2225,6 +2322,33 @@ The XML below is for Windows 10, version 1709. + + PlumbIKEv2TSAsRoutes + + + + + + + + + True: Plumb traffic selectors as routes onto VPN interface + False: Do not plumb traffic selectors as routes + + + + + + + + + + + + text/plain + + + @@ -3718,6 +3842,76 @@ The XML below is for Windows 10, version 1709. + + WebAuth + + + + + + Nodes under WebAuth can be used to enable WebToken based authentication for 3rd Party Plugin VPN Profiles. + + + + + + + + + + + + + + + Enabled + + + + + + + + Enables the WebToken based authentication flow. + + + + + + + + + + + text/plain + + + + + ClientId + + + + + + + + The client ID to specify when communicating with the Web Account provider in retrieving the token. + + + + + + + + + + + text/plain + + + + NativeProfile @@ -4318,6 +4512,33 @@ The XML below is for Windows 10, version 1709. + + PlumbIKEv2TSAsRoutes + + + + + + + + + True: Plumb traffic selectors as routes onto VPN interface + False: Do not plumb traffic selectors as routes + + + + + + + + + + + + text/plain + + + diff --git a/windows/client-management/mdm/vpnv2-profile-xsd.md b/windows/client-management/mdm/vpnv2-profile-xsd.md index fbb8abae88..c0e32c95b7 100644 --- a/windows/client-management/mdm/vpnv2-profile-xsd.md +++ b/windows/client-management/mdm/vpnv2-profile-xsd.md @@ -1,32 +1,31 @@ --- title: ProfileXML XSD -description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. +description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. ms.assetid: 2F32E14B-F9B9-4760-AE94-E57F1D4DFDB3 -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 02/05/2018 +ms.date: 07/14/2020 --- # ProfileXML XSD - -Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. +Here's the XSD for the ProfileXML node in the VPNv2 CSP and VpnManagementAgent::AddProfileFromXmlAsync for Windows 10 and some profile examples. ## XSD for the VPN profile - ```xml - + + @@ -36,6 +35,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + @@ -51,15 +51,15 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - + - - - - + + + + @@ -89,7 +89,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - + @@ -109,13 +109,20 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + - + + + + + + + @@ -123,6 +130,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + @@ -134,6 +142,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + @@ -148,33 +157,37 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - - + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - + - + + + @@ -186,17 +199,79 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro ## Native profile example +```xml + + corp.contoso.com + true + false + corp.contoso.com + contoso.com -``` - - - testServer.VPN.com - IKEv2 - - Eap - Eap - - + + Helloworld.Com + + HelloServer + + + + + true + + true + This is my Eku + This is my issuer hash + + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + C:\windows\system32\ping.exe + + + + + hrsite.corporate.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + true + + + .corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + ForceTunnel + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + testServer.VPN.com + SplitTunnel + IKEv2 + true + + Eap + + 25 @@ -261,178 +336,110 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - - - SplitTunnel - true - - - -

            192.168.0.0
            - 24 - - -
            10.10.0.0
            - 16 -
            - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - - - - C:\windows\system32\ping.exe - - - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - 6 - 10,20-50,100-200 - 20-50,100-200,300 - 30.30.0.0/16,10.10.10.10-20.20.20.20 - ForceTunnel - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - 3.3.3.3/32,1.1.1.1-2.2.2.2 - - - - - hrsite.corporate.contoso.com - 1.2.3.4,5.6.7.8 - 5.5.5.5 - true - - - .corp.contoso.com - 10.10.10.10,20.20.20.20 - 100.100.100.100 - - - corp.contoso.com - true - false - corp.contoso.com - contoso.com - - - HelloServer - - Helloworld.Com - - - - true - - true - This is my Eku - This is my issuer hash - - - + + + + + +
            192.168.0.0
            + 24 +
            + +
            10.10.0.0
            + 16 +
            + ``` ## Plug-in profile example - ```xml - - testserver1.contoso.com;testserver2.contoso..com - JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy - true - - -
            192.168.0.0
            - 24 -
            - -
            10.10.0.0
            - 16 -
            - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - 6 - 10,20-50,100-200 - 20-50,100-200,300 - 30.30.0.0/16,10.10.10.10-20.20.20.20 - - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - 3.3.3.3/32,1.1.1.1-2.2.2.2 - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - O:SYG:SYD:(A;;CC;;;AU) - - - - corp.contoso.com - 1.2.3.4,5.6.7.8 - 5.5.5.5 - false - - - corp.contoso.com - 10.10.10.10,20.20.20.20 - 100.100.100.100 - - - true - false - false - false - corp.contoso.com - contoso.com,test.corp.contoso.com - - - HelloServer - - Helloworld.Com - - - - - - - - - -
            -``` + + true + false + corp.contoso.com + contoso.com,test.corp.contoso.com + false + false -  + + Helloworld.Com + + HelloServer + -  + + + + + + + true + + + + testserver1.contoso.com;testserver2.contoso..com + true + JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + + + corp.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + false + + + corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + O:SYG:SYD:(A;;CC;;;AU) + + + +
            192.168.0.0
            + 24 +
            + +
            10.10.0.0
            + 16 +
            + +``` \ No newline at end of file diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index e4c93ad525..51a1739756 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -1,6 +1,6 @@ --- title: w4 APPLICATION CSP -description: w4 APPLICATION CSP +description: Use an APPLICATION configuration service provider (CSP) that has an APPID of w4 to configure Multimedia Messaging Service (MMS). ms.assetid: ef42b82a-1f04-49e4-8a48-bd4e439fc43a ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index eff35b4fd4..20f21f79bc 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -1,6 +1,6 @@ --- title: w7 APPLICATION CSP -description: w7 APPLICATION CSP +description: Learn that the APPLICATION configuration service provider (CSP) that has an APPID of w7 is used for bootstrapping a device with an OMA DM account. ms.assetid: 10f8aa16-5c89-455d-adcd-d7fb45d4e768 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 79992abc08..174c633ba4 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,6 +1,6 @@ --- title: WiFi CSP -description: WiFi CSP +description: The WiFi configuration service provider (CSP) provides the functionality to add or delete Wi-Fi networks on a Windows device. ms.assetid: f927cb5f-9555-4029-838b-03fb68937f06 ms.reviewer: manager: dansimp @@ -102,7 +102,7 @@ Added in Windows 10, version 1607. Optional. When set to true it enables Web Pr Value type is bool. **WiFiCost** -Added in Windows 10, version 1809. Optional. This policy sets the cost of WLAN connection for the Wi-Fi profile. Default behaviour: Unrestricted. +Added in Windows 10, version 1809. Optional. This policy sets the cost of WLAN connection for the Wi-Fi profile. Default behavior: Unrestricted. Supported values: diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index 2c51e50a62..8dff039754 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -1,6 +1,6 @@ --- title: WiFi DDF file -description: WiFi DDF file +description: Learn about the OMA DM device description framework (DDF) for the WiFi configuration service provider (CSP). ms.assetid: 00DE1DA7-23DE-4871-B3F0-28EB29A62D61 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md index cb2908dda2..3d2584ee4e 100644 --- a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/26/2017 +ms.date: 03/23/2020 ms.reviewer: manager: dansimp --- @@ -25,7 +25,13 @@ manager: dansimp ## Overview -Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. +Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. + +NOTE: Starting from the following Windows 10 version Replace command is supported +- Windows 10, version 1903 with KB4512941 and KB4517211 installed +- Windows 10, version 1809 with KB4512534 and KB installed +- Windows 10, version 1803 with KB4512509 and KB installed +- Windows 10, version 1709 with KB4516071 and KB installed When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations: @@ -48,6 +54,8 @@ When the ADMX policies are imported, the registry keys to which each policy is w - software\microsoft\exchange\ - software\policies\microsoft\vba\security\ - software\microsoft\onedrive +- software\Microsoft\Edge +- Software\Microsoft\EdgeUpdate\ > [!Warning] > Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. @@ -213,7 +221,8 @@ The following example shows an ADMX file in SyncML format: ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/ContosoCompanyApp/Policy/AppAdmxFile01 - + + @@ -342,7 +351,8 @@ The following example shows an ADMX file in SyncML format: - + ]]> + @@ -431,7 +441,7 @@ The following examples describe how to set an ADMX-ingested app policy. ./Device/Vendor/MSFT/Policy/Config/ContosoCompanyApp~ Policy~ParentCategoryArea~Category1/L_PolicyConfigurationMode - + ]]> @@ -465,7 +475,7 @@ The following examples describe how to set an ADMX-ingested app policy. ./Device/Vendor/MSFT/Policy/Config/ContosoCompanyApp~ Policy~ParentCategoryArea~Category1/L_PolicyConfigurationMode - + ]]> diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index abcbb92914..f6b422ce6d 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -1,6 +1,6 @@ --- title: Win32AppInventory CSP -description: Win32AppInventory CSP +description: Learn how the Win32AppInventory configuration service provider (CSP) is used to provide an inventory of installed applications on a device. ms.assetid: C0DEDD51-4EAD-4F8E-AEE2-CBE9658BCA22 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 8757e65d3b..1f20685d75 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -1,6 +1,6 @@ --- title: Win32AppInventory DDF file -description: Win32AppInventory DDF file +description: Learn about the OMA DM device description framework (DDF) for the Win32AppInventory configuration service provider (CSP). ms.assetid: F6BCC10B-BFE4-40AB-AEEE-34679A4E15B0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index 2570e65b3d..be248b783d 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -1,6 +1,6 @@ --- -title: Win32CompatibilityAppraiser CSP -description: +title: Win32CompatibilityAppraiser CSP +description: Learn how the Win32CompatibilityAppraiser configuration service provider enables the IT admin to query the current status of the Appraiser and UTC telementry health. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md index e86a9edcc0..ce4b0b3bf3 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md @@ -1,6 +1,6 @@ --- title: Win32CompatibilityAppraiser DDF file -description: XML file containing the device description framework +description: XML file containing the device description framework for the Win32CompatibilityAppraiser configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md index 75f0d91a1b..a8be6bba9c 100644 --- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md +++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md @@ -1,6 +1,6 @@ --- title: Enterprise settings, policies, and app management -description: The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. +description: The DM client manages the interaction between a device and a server. Learn more about the client-server management workflow. MS-HAID: - 'p\_phdevicemgmt.enterprise\_settings\_\_policies\_\_and\_app\_management' - 'p\_phDeviceMgmt.windows\_mdm\_enterprise\_settings' diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index 2508fa2863..c68424cd04 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -1,6 +1,6 @@ --- title: WindowsAdvancedThreatProtection CSP -description: WindowsAdvancedThreatProtection CSP +description: The Windows Defender Advanced Threat Protection (WDATP) CSP allows IT Admins to onboard, determine configuration and health status, and offboard endpoints for WDATP. ms.assetid: 6C3054CA-9890-4C08-9DB6-FBEEB74699A8 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index 583ea67e75..5877c32e22 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -1,6 +1,6 @@ --- title: WindowsAdvancedThreatProtection DDF file -description: WindowsAdvancedThreatProtection DDF file +description: Learn how the OMA DM device description framework (DDF) for the WindowsAdvancedThreatProtection configuration service provider (CSP). ms.assetid: 0C62A790-4351-48AF-89FD-7D46C42D13E0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 7831cfbce6..377215d1a7 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -1,22 +1,19 @@ --- title: WindowsDefenderApplicationGuard CSP -description: WindowsDefenderApplicationGuard CSP +description: Configure the settings in Microsoft Defender Application Guard by using the WindowsDefenderApplicationGuard configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/10/2018 +ms.date: 07/07/2020 ms.reviewer: manager: dansimp --- # WindowsDefenderApplicationGuard CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Windows Defender Application Guard. This CSP was added in Windows 10, version 1709. +The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Microsoft Defender Application Guard. This CSP was added in Windows 10, version 1709. The following diagram shows the WindowsDefenderApplicationGuard configuration service provider in tree format. @@ -29,129 +26,277 @@ Root node. Supported operation is Get. Interior node. Supported operation is Get. **Settings/AllowWindowsDefenderApplicationGuard** -Turn on Windows Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete. +Turn on Microsoft Defender Application Guard in Enterprise Mode. -- 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. -- 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +The following list shows the supported values: +- 0 - Disable Microsoft Defender Application Guard +- 1 - Enable Microsoft Defender Application Guard for Microsoft Edge ONLY +- 2 - Enable Microsoft Defender Application Guard for isolated Windows environments ONLY +- 3 - Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments **Settings/ClipboardFileType** -Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete. +Determines the type of content that can be copied from the host to Application Guard environment and vice versa. -- 0 - Disables content copying. +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: - 1 - Allow text copying. - 2 - Allow image copying. - 3 - Allow text and image copying. -**Settings/ClipboardSettings** -This policy setting allows you to decide how the clipboard behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete + +ADMX Info: +- GP English name: *Configure Microsoft Defender Application Guard clipboard settings* +- GP name: *AppHVSIClipboardFileType* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + +**Settings/ClipboardSettings** +This policy setting allows you to decide how the clipboard behaves while in Application Guard. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: - 0 (default) - Completely turns Off the clipboard functionality for the Application Guard. -- 1 - Turns On clipboard operation from an isolated session to the host -- 2 - Turns On clipboard operation from the host to an isolated session -- 3 - Turns On clipboard operation in both the directions +- 1 - Turns On clipboard operation from an isolated session to the host. +- 2 - Turns On clipboard operation from the host to an isolated session. +- 3 - Turns On clipboard operation in both the directions. > [!IMPORTANT] > Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended. + +ADMX Info: +- GP English name: *Configure Microsoft Defender Application Guard clipboard settings* +- GP name: *AppHVSIClipboardSettings* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + **Settings/PrintingSettings** -This policy setting allows you to decide how the print functionality behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - -- 0 - Disables all print functionality (default) -- 1 - Enables only XPS printing -- 2 - Enables only PDF printing -- 3 - Enables both PDF and XPS printing -- 4 - Enables only local printing -- 5 - Enables both local and XPS printing - 6 - Enables both local and PDF printing -- 7 - Enables local, PDF, and XPS printing -- 8 - Enables only network printing -- 9 - Enables both network and XPS printing -- 10 - Enables both network and PDF printing -- 11 - Enables network, PDF, and XPS printing -- 12 - Enables both network and local printing -- 13 - Enables network, local, and XPS printing -- 14 - Enables network, local, and PDF printing -- 15 - Enables all printing - -**Settings/BlockNonEnterpriseContent** -This policy setting allows you to decide whether websites can load non-enterprise content in Microsoft Edge and Internet Explorer. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - -- 0 (default) - Non-enterprise content embedded in enterprise sites is allowed to open outside of the Windows Defender Application Guard container, directly in Internet Explorer and Microsoft Edge.. -- 1 - Non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Windows Defender Application Guard. - -**Settings/AllowPersistence** -This policy setting allows you to decide whether data should persist across different sessions in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - -- 0 - Application Guard discards user-downloaded files and other items (such as, cookies, Favorites, and so on) during machine restart or user log-off. -- 1 - Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions. - -**Settings/AllowVirtualGPU** -Added in Windows 10, version 1803. This policy setting allows you to determine whether Application Guard can use the virtual GPU to process graphics. Supported operations are Add, Get, Replace, and Delete. Value type is integer. - -- 0 (default) - Cannot access the vGPU and uses the CPU to support rendering graphics. When the policy is not configured, it is the same as disabled (0). -- 1 - Turns on the functionality to access the vGPU offloading graphics rendering from the CPU. This can create a faster experience when working with graphics intense websites or watching video within the container. - -**Settings/SaveFilesToHost** -Added in Windows 10, version 1803. This policy setting allows you to determine whether users can elect to download files from Edge in the container and persist files them from container to the host operating system. Supported operations are Add, Get, Replace, and Delete. Value type is integer. - -- 0 (default) - The user cannot download files from Edge in the container to the host file system. When the policy is not configured, it is the same as disabled (0). -- 1 - Turns on the functionality to allow users to download files from Edge in the container to the host file system. - -**Settings/FileTrustCriteria** -Placeholder for future use. Do not use in production code. - -**Settings/FileTrustOriginRemovableMedia** -Placeholder for future use. Do not use in production code. - -**Settings/FileTrustOriginNetworkShare** -Placeholder for future use. Do not use in production code. - -**Settings/FileTrustOriginMarkOfTheWeb** -Placeholder for future use. Do not use in production code. - -**Settings/CertificateThumbprints** -Added in Windows 10, version 1809. This policy setting allows certain Root Certificates to be shared with the Windows Defender Application Guard container. - -Value type is string. Supported operations are Add, Get, Replace, and Delete. - -If you enable this setting, certificates with a thumbprint matching the ones specified will be transferred into the container. You can specify multiple certificates using a comma to separate the thumbprints for each certificate you want to transfer. - -Example: b4e72779a8a362c860c36a6461f31e3aa7e58c14,1b1d49f06d2a697a544a1059bd59a7b058cda924 - -If you disable or don’t configure this setting, certificates are not shared with the Windows Defender Application Guard container. - -**Settings/AllowCameraMicrophoneRedirection** -Added in Windows 10, version 1809. The policy allows you to determine whether applications inside Windows Defender Application Guard can access the device’s camera and microphone when these settings are enabled on the user’s device. +This policy setting allows you to decide how the print functionality behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. -If you enable this policy, applications inside Windows Defender Application Guard will be able to access the camera and microphone on the user’s device. +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. -If you disable or don't configure this policy, applications inside Windows Defender Application Guard will be unable to access the camera and microphone on the user’s device. +The following list shows the supported values: +- 0 (default) - Disables all print functionality. +- 1 - Enables only XPS printing. +- 2 - Enables only PDF printing. +- 3 - Enables both PDF and XPS printing. +- 4 - Enables only local printing. +- 5 - Enables both local and XPS printing. +- 6 - Enables both local and PDF printing. +- 7 - Enables local, PDF, and XPS printing. +- 8 - Enables only network printing. +- 9 - Enables both network and XPS printing. +- 10 - Enables both network and PDF printing. +- 11 - Enables network, PDF, and XPS printing. +- 12 - Enables both network and local printing. +- 13 - Enables network, local, and XPS printing. +- 14 - Enables network, local, and PDF printing. +- 15 - Enables all printing. + + +ADMX Info: +- GP English name: *Configure Microsoft Defender Application Guard print settings* +- GP name: *AppHVSIPrintingSettings* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/BlockNonEnterpriseContent** +This policy setting allows you to decide whether websites can load non-enterprise content in Microsoft Edge and Internet Explorer. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 (default) - Non-enterprise content embedded in enterprise sites is allowed to open outside of the Microsoft Defender Application Guard container, directly in Internet Explorer and Microsoft Edge. +- 1 - Non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Microsoft Defender Application Guard. + +> [!NOTE] +> This policy setting is no longer supported in the new Microsoft Edge browser. The policy will be deprecated and removed in a future release. + + +ADMX Info: +- GP English name: *Prevent enterprise websites from loading non-enterprise content in Microsoft Edge and Internet Explorer* +- GP name: *BlockNonEnterpriseContent* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/AllowPersistence** +This policy setting allows you to decide whether data should persist across different sessions in Application Guard. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 - Application Guard discards user-downloaded files and other items (such as, cookies, Favorites, and so on) during machine restart or user log-off. +- 1 - Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions. + + +ADMX Info: +- GP English name: *Allow data persistence for Microsoft Defender Application Guard* +- GP name: *AllowPersistence* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/AllowVirtualGPU** +Added in Windows 10, version 1803. This policy setting allows you to determine whether Application Guard can use the virtual Graphics Processing Unit (GPU) to process graphics. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +If you enable this setting, Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If you enable this setting without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. + +The following list shows the supported values: +- 0 (default) - Cannot access the vGPU and uses the CPU to support rendering graphics. When the policy is not configured, it is the same as disabled (0). +- 1 - Turns on the functionality to access the vGPU offloading graphics rendering from the CPU. This can create a faster experience when working with graphics intense websites or watching video within the container. + +> [!WARNING] +> Enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device. + + +ADMX Info: +- GP English name: *Allow hardware-accelerated rendering for Microsoft Defender Application Guard* +- GP name: *AllowVirtualGPU* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/SaveFilesToHost** +Added in Windows 10, version 1803. This policy setting allows you to determine whether users can elect to download files from Edge in the container and persist files them from container to the host operating system. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 (default) - The user cannot download files from Edge in the container to the host file system. When the policy is not configured, it is the same as disabled (0). +- 1 - Turns on the functionality to allow users to download files from Edge in the container to the host file system. + + +ADMX Info: +- GP English name: *Allow files to download and save to the host operating system from Microsoft Defender Application Guard* +- GP name: *SaveFilesToHost* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/CertificateThumbprints** +Added in Windows 10, version 1809. This policy setting allows certain device level Root Certificates to be shared with the Microsoft Defender Application Guard container. + +Value type is string. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +If you enable this setting, certificates with a thumbprint matching the ones specified will be transferred into the container. Multiple certificates can be specified by using a comma to separate the thumbprints for each certificate you want to transfer. + +Here's an example: +b4e72779a8a362c860c36a6461f31e3aa7e58c14,1b1d49f06d2a697a544a1059bd59a7b058cda924 + +If you disable or don’t configure this setting, certificates are not shared with the Microsoft Defender Application Guard container. + + +ADMX Info: +- GP English name: *Allow Microsoft Defender Application Guard to use Root Certificate Authorities from the user's device* +- GP name: *CertificateThumbprints* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/AllowCameraMicrophoneRedirection** +Added in Windows 10, version 1809. This policy setting allows you to determine whether applications inside Microsoft Defender Application Guard can access the device’s camera and microphone when these settings are enabled on the user’s device. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +If you enable this policy setting, applications inside Microsoft Defender Application Guard will be able to access the camera and microphone on the user’s device. + +If you disable or don't configure this policy setting, applications inside Microsoft Defender Application Guard will be unable to access the camera and microphone on the user’s device. + +The following list shows the supported values: +- 0 (default) - Microsoft Defender Application Guard cannot access the device’s camera and microphone. When the policy is not configured, it is the same as disabled (0). +- 1 - Turns on the functionality to allow Microsoft Defender Application Guard to access the device’s camera and microphone. > [!IMPORTANT] -> If you turn on this policy, a compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge. To prevent unauthorized access, we recommend that camera and microphone privacy settings be turned off on the user's device when they are not needed. +> If you turn on this policy setting, a compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge. To prevent unauthorized access, we recommend that camera and microphone privacy settings be turned off on the user's device when they are not needed. + + +ADMX Info: +- GP English name: *Allow camera and microphone access in Microsoft Defender Application Guard* +- GP name: *AllowCameraMicrophoneRedirection* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + **Status** -Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. Value type is integer. Supported operation is Get. +Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. -- Bit 0 - Set to 1 when WDAG is enabled into enterprise manage mode -- Bit 1 - Set to 1 when the client machine is Hyper-V capable -- Bit 2 - Set to 1 when the client machine has a valid OS license and SKU -- Bit 3 - Set to 1 when WDAG installed on the client machine -- Bit 4 - Set to 1 when required Network Isolation Policies are configured -- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements +Value type is integer. Supported operation is Get. + +- Bit 0 - Set to 1 when Application Guard is enabled into enterprise manage mode. +- Bit 1 - Set to 1 when the client machine is Hyper-V capable. +- Bit 2 - Set to 1 when the client machine has a valid OS license and SKU. +- Bit 3 - Set to 1 when Application Guard installed on the client machine. +- Bit 4 - Set to 1 when required Network Isolation Policies are configured. +- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements. +- Bit 6 - Set to 1 when system reboot is required. + +**PlatformStatus** +Returns bitmask that indicates status of Application Guard platform installation and prerequisites on the device. + +Value type is integer. Supported operation is Get. + +- Bit 0 - Set to 1 when Application Guard is enabled into enterprise manage mode. +- Bit 1 - Set to 1 when the client machine is Hyper-V capable. +- Bit 2 - Reserved for Microsoft. +- Bit 3 - Set to 1 when Application Guard is installed on the client machine. +- Bit 4 - Reserved for Microsoft. +- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements. **InstallWindowsDefenderApplicationGuard** -Initiates remote installation of Application Guard feature. Supported operations are Get and Execute. +Initiates remote installation of Application Guard feature. -- Install - Will initiate feature install -- Uninstall - Will initiate feature uninstall +Supported operations are Get and Execute. + +The following list shows the supported values: +- Install - Will initiate feature install. +- Uninstall - Will initiate feature uninstall. **Audit** -Interior node. Supported operation is Get +Interior node. Supported operation is Get. **Audit/AuditApplicationGuard** -This policy setting allows you to decide whether auditing events can be collected from Application Guard. Value type in integer. Supported operations are Add, Get, Replace, and Delete. +This policy setting allows you to decide whether auditing events can be collected from Application Guard. -- 0 (default) - - Audit event logs aren't collected for Application Guard. -- 1 - Application Guard inherits its auditing policies from Microsoft Edge and starts to audit system events specifically for Application Guard. +Value type in integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 (default) - Audit event logs aren't collected for Application Guard. +- 1 - Application Guard inherits its auditing policies from system and starts to audit security events for Application Guard container. + + +ADMX Info: +- GP English name: *Allow auditing events in Microsoft Defender Application Guard* +- GP name: *AuditApplicationGuard* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index 6b319f1404..847d9d69c8 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -1,6 +1,6 @@ --- title: WindowsDefenderApplicationGuard DDF file -description: WindowsDefenderApplicationGuard DDF file +description: learn about the OMA DM device description framework (DDF) for the WindowsDefenderApplicationGuard DDF file configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index 58a5040b72..b46f76e935 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -1,6 +1,6 @@ --- title: WindowsLicensing CSP -description: WindowsLicensing CSP +description: Learn how the WindowsLicensing configuration service provider (CSP) is designed for licensing related management scenarios. ms.assetid: E6BC6B0D-1F16-48A5-9AC4-76D69A7EDDA6 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index c5037971d9..7b8cb3437e 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -1,6 +1,6 @@ --- title: WindowsLicensing DDF file -description: WindowsLicensing DDF file +description: Learn about the OMA DM device description framework (DDF) for the WindowsLicensing configuration service provider (CSP). ms.assetid: 2A24C922-A167-4CEE-8F74-08E7453800D2 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md index a42d7ec535..c4710fae63 100644 --- a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md +++ b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md @@ -1,6 +1,6 @@ --- title: WindowsSecurityAuditing DDF file -description: This topic shows the OMA DM device description framework (DDF) for the WindowsSecurityAuditing configuration service provider. This CSP was added in Windows 10, version 1511. +description: View the OMA DM device description framework (DDF) for the WindowsSecurityAuditing configuration service provider. ms.assetid: B1F9A5FA-185B-48C6-A7F4-0F0F23B971F0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index c5727c4674..d4f5426134 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -1,6 +1,6 @@ --- title: WiredNetwork CSP -description: The WiredNetwork configuration service provider (CSP) is used by the enterprise to configure wired Internet on devices that do not have GP to enable them to access corporate Internet over ethernet. +description: The WiredNetwork configuration service provider (CSP) is used by the enterprise to configure wired Internet on devices that do not have GP. Learn how it works. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -34,3 +34,23 @@ Supported operations are Add, Get, Replace, and Delete. Value type is string. Optional. Enable block period (minutes), used to specify the duration for which automatic authentication attempts will be blocked from occurring after a failed authentication attempt. Supported operations are Add, Get, Replace, and Delete. Value type is integer. + +The following example shows how to add a wired network profile: +```xml + + + + 1 + + + ./Device/Vendor/MSFT/WiredNetwork/LanXML + + + chr + + falsetrue2500025falsetruefalse26falsefalsefalsetruefalsetrue + + + + +``` diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index b6fb182eae..206aa9dbc0 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -1,6 +1,6 @@ --- title: WMI providers supported in Windows 10 -description: WMI providers supported in Windows 10 +description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). MS-HAID: - 'p\_phdevicemgmt.wmi\_providers\_supported\_in\_windows\_10\_technical\_preview' - 'p\_phDeviceMgmt.wmi\_providers\_supported\_in\_windows' @@ -296,21 +296,13 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro [**Win32\_UninterruptiblePowerSupply**](https://msdn.microsoft.com/library/windows/hardware/aa394503) | [**Win32\_USBController**](https://msdn.microsoft.com/library/windows/hardware/aa394504) | [**Win32\_UTCTime**](https://msdn.microsoft.com/library/windows/hardware/aa394510) | ![cross mark](images/checkmark.png) -[**Win32\_VideoController**](https://msdn.microsoft.com/library/windows/hardware/aa394505) | +[**Win32\_VideoController**](https://docs.microsoft.com/windows/win32/cimwin32prov/win32-videocontroller) | **Win32\_WindowsUpdateAgentVersion** | ## Related topics - [Configuration service provider reference](configuration-service-provider-reference.md) - - - - -10/10/2016 - - - - +## Related Links +[CIM Video Controller](https://docs.microsoft.com/windows/win32/cimwin32prov/cim-videocontroller) diff --git a/windows/client-management/media/image1.png b/windows/client-management/media/image1.png new file mode 100644 index 0000000000..1f6394616a Binary files /dev/null and b/windows/client-management/media/image1.png differ diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 2c02926ece..239c1f1379 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -1,11 +1,11 @@ --- title: New policies for Windows 10 (Windows 10) -description: Windows 10 includes the following new policies for management. +description: Learn how Windows 10 includes new policies for management, like Group Policy settings for the Windows system and components. ms.assetid: 1F24ABD8-A57A-45EA-BA54-2DA2238C573D ms.reviewer: manager: dansimp ms.author: dansimp -keywords: ["MDM", "Group Policy"] +keywords: ["MDM", "Group Policy", "GP"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -21,9 +21,265 @@ ms.topic: reference **Applies to** - Windows 10 -- Windows 10 Mobile -Windows 10 includes the following new policies for management. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://www.microsoft.com/download/details.aspx?id=56121). +As of September 2020 This page will no longer be updated. To find the Group Polices that ship in each version of Windows, refer to the Group Policy Settings Reference Spreadsheet. You can always locate the most recent version of the Spreadsheet by searching the Internet for "Windows Version + Group Policy Settings Reference". + +For example, searching for "Windows 2004" + "Group Policy Settings Reference Spreadsheet" in a web browser will return to you the link to download the Group Policy Settings Reference Spreadsheet for Windows 2004. + +The latest [group policy reference for Windows 10 version 2004 is available here](https://www.microsoft.com/download/101451). + +## New Group Policy settings in Windows 10, version 1903 + +The following Group Policy settings were added in Windows 10, version 1903: + +**System** + +- System\Service Control Manager Settings\Security Settings\Enable svchost.exe mitigation options +- System\Storage Sense\Allow Storage Sense +- System\Storage Sense\Allow Storage Sense Temporary Files cleanup +- System\Storage Sense\Configure Storage Sense +- System\Storage Sense\Configure Storage Sense Cloud content dehydration threshold +- System\Storage Sense\Configure Storage Sense Recycle Bin cleanup threshold +- System\Storage Sense\Configure Storage Sense Downloads cleanup threshold +- System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool\Troubleshooting:Allow users to access recommended troubleshooting for known problems + + +**Windows Components** + +- Windows Components\App Privacy\Let Windows apps activate with voice +- Windows Components\App Privacy\Let Windows apps activate with voice while the system is locked +- Windows Components\Data Collection and Preview Builds\Allow commercial data pipeline +- Windows Components\Data Collection and Preview Builds\Configure collection of browsing data for Desktop Analytics +- Windows Components\Data Collection and Preview Builds\Configure diagnostic data upload endpoint for Desktop Analytics +- Windows Components\Delivery Optimization\Delay background download Cache Server fallback (in seconds) +- Windows Components\Delivery Optimization\Delay Foreground download Cache Server fallback (in seconds) +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use WDDM graphics display driver for Remote Desktop Connections +- Windows Components\Windows Logon Options\Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot + +## New Group Policy settings in Windows 10, version 1809 + +The following Group Policy settings were added in Windows 10, version 1809: + +**Start Menu and Taskbar** + +- Start Menu and Taskbar\Force Start to be either full screen size or menu size +- Start Menu and Taskbar\Remove "Recently added" list from Start Menu +- Start Menu and Taskbar\Remove All Programs list from the Start menu +- Start Menu and Taskbar\Remove frequent programs list from the Start Menu + +**System** + +- System\Group Policy\Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services +- System\Group Policy\Configure Applications preference extension policy processing +- System\Group Policy\Configure Data Sources preference extension policy processing +- System\Group Policy\Configure Devices preference extension policy processing +- System\Group Policy\Configure Drive Maps preference extension policy processing +- System\Group Policy\Configure Environment preference extension policy processing +- System\Group Policy\Configure Files preference extension policy processing +- System\Group Policy\Configure Folder Options preference extension policy processing +- System\Group Policy\Configure Folders preference extension policy processing +- System\Group Policy\Configure Ini Files preference extension policy processing +- System\Group Policy\Configure Internet Settings preference extension policy processing +- System\Group Policy\Configure Local Users and Groups preference extension policy processing +- System\Group Policy\Configure Network Options preference extension policy processing +- System\Group Policy\Configure Network Shares preference extension policy processing +- System\Group Policy\Configure Power Options preference extension policy processing +- System\Group Policy\Configure Printers preference extension policy processing +- System\Group Policy\Configure Regional Options preference extension policy processing +- System\Group Policy\Configure Registry preference extension policy processing +- System\Group Policy\Configure Scheduled Tasks preference extension policy processing +- System\Group Policy\Configure Services preference extension policy processing +- System\Group Policy\Configure Shortcuts preference extension policy processing +- System\Group Policy\Configure Start Menu preference extension policy processing +- System\Group Policy\Logging and tracing\Configure Applications preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Data Sources preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Devices preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Drive Maps preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Environment preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Files preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Folder Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Folders preference logging and tracing +- System\Group Policy\Logging and tracing\Configure INI Files preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Internet Settings preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Local Users and Groups preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Network Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Network Shares preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Power Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Printers preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Regional Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Registry preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Scheduled Tasks preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Services preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Shortcuts preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Start Menu preference logging and tracing +- System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection +- System\OS Policies\Allow Clipboard History +- System\OS Policies\Allow Clipboard synchronization across devices + +**Windows Components** + +- Windows Components\Data Collection and Preview Builds\Configure Microsoft 365 Update Readiness upload endpoint +- Windows Components\Data Collection and Preview Builds\Disable deleting diagnostic data +- Windows Components\Data Collection and Preview Builds\Disable diagnostic data viewer +- Windows Components\Delivery Optimization\[Reserved for future use] Cache Server Hostname +- Windows Components\Location and Sensors\Windows Location Provider\Turn off Windows Location Provider +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\DFS Management +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\File Server Resource Manager +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Share and Storage Management +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Storage Manager for SANs +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\DFS Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Disk Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\File Server Resource Manager Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Share and Storage Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Storage Manager for SANS Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Management Editor +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Starter GPO Editor +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Application snap-ins +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Applications preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Computers) +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Users) +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Data Sources preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Devices preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Drive Maps preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Environment preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Files preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folder Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folders preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Ini Files preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Internet Settings preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Local Users and Groups preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Shares preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Power Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Preferences tab +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Printers preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Regional Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Registry preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Scheduled Tasks preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Services preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Shortcuts preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Start Menu preference extension +- Windows Components\OOBE\Don't launch privacy settings experience on user logon +- Windows Components\OOBE\Don't launch privacy settings experience on user logon +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Do not use Remote Desktop Session Host server IP address when virtual IP address is not available +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Select the network adapter to be used for Remote Desktop IP Virtualization +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn off Windows Installer RDS Compatibility +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn on Remote Desktop IP Virtualization +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow remote start of unlisted programs +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Turn off Fair Share CPU Scheduling +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Allow time zone redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow Clipboard redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker\Use RD Connection Broker load balancing +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Allow desktop composition for remote desktop sessions +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Always show desktop on connection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Do not allow font smoothing +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Remove remote desktop wallpaper +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions +- Windows Components\Microsoft Defender Antivirus\Configure detection for potentially unwanted applications +- Windows Components\Microsoft Defender Antivirus\Scan\Configure low CPU priority for scheduled scans +- Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard +- Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard +- Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user’s device +- Windows Components\Windows Defender Application Guard\Configure additional sources for untrusted files in Windows Defender Application Guard +- Windows Components\Windows Hello for Business\Use Windows Hello for Business certificates as smart card certificates +- Windows Components\Windows Media Player\Do Not Show First Use Dialog Boxes +- Windows Components\Windows Media Player\Prevent Automatic Updates +- Windows Components\Windows Media Player\Prevent CD and DVD Media Information Retrieval +- Windows Components\Windows Media Player\Prevent Desktop Shortcut Creation +- Windows Components\Windows Media Player\Prevent Media Sharing +- Windows Components\Windows Media Player\Prevent Music File Media Information Retrieval +- Windows Components\Windows Media Player\Prevent Quick Launch Toolbar Shortcut Creation +- Windows Components\Windows Media Player\Prevent Radio Station Preset Retrieval +- Windows Components\Windows Media Player\Prevent Video Smoothing +- Windows Components\Windows Media Player\Networking\Configure HTTP Proxy +- Windows Components\Windows Media Player\Networking\Configure MMS Proxy +- Windows Components\Windows Media Player\Networking\Configure Network Buffering +- Windows Components\Windows Media Player\Networking\Configure RTSP Proxy +- Windows Components\Windows Media Player\Networking\Hide Network Tab +- Windows Components\Windows Media Player\Networking\Streaming Media Protocols +- Windows Components\Windows Media Player\Playback\Allow Screen Saver +- Windows Components\Windows Media Player\Playback\Prevent Codec Download +- Windows Components\Windows Media Player\User Interface\Do Not Show Anchor +- Windows Components\Windows Media Player\User Interface\Hide Privacy Tab +- Windows Components\Windows Media Player\User Interface\Hide Security Tab +- Windows Components\Windows Media Player\User Interface\Set and Lock Skin +- Windows Components\Windows Security\Account protection\Hide the Account protection area +- Windows Components\Windows Security\App and browser protection\Hide the App and browser protection area +- Windows Components\Windows Security\App and browser protection\Prevent users from modifying settings +- Windows Components\Windows Security\Device performance and health\Hide the Device performance and health area +- Windows Components\Windows Security\Device security\Disable the Clear TPM button +- Windows Components\Windows Security\Device security\Hide the Device security area +- Windows Components\Windows Security\Device security\Hide the Secure boot area +- Windows Components\Windows Security\Device security\Hide the Security processor (TPM) troubleshooter page +- Windows Components\Windows Security\Device security\Hide the TPM Firmware Update recommendation +- Windows Components\Windows Security\Enterprise Customization\Configure customized contact information +- Windows Components\Windows Security\Enterprise Customization\Configure customized notifications +- Windows Components\Windows Security\Enterprise Customization\Specify contact company name +- Windows Components\Windows Security\Enterprise Customization\Specify contact email address or Email ID +- Windows Components\Windows Security\Enterprise Customization\Specify contact phone number or Skype ID +- Windows Components\Windows Security\Enterprise Customization\Specify contact website +- Windows Components\Windows Security\Family options\Hide the Family options area +- Windows Components\Windows Security\Firewall and network protection\Hide the Firewall and network protection area +- Windows Components\Windows Security\Notifications\Hide all notifications +- Windows Components\Windows Security\Notifications\Hide non-critical notifications +- Windows Components\Windows Security\Systray\Hide Windows Security Systray +- Windows Components\Windows Security\Virus and threat protection\Hide the Ransomware data recovery area +- Windows Components\Windows Security\Virus and threat protection\Hide the Virus and threat protection area +- Windows Components\Windows Update\Display options for update notifications +- Windows Components\Windows Update\Remove access to "Pause updates" feature + +**Control Panel** + +- Control Panel\Settings Page Visibility +- Control Panel\Regional and Language Options\Allow users to enable online speech recognition services + +**Network** + +- Network\Windows Connection Manager\Enable Windows to soft-disconnect a computer from a network + + +## New Group Policy settings in Windows 10, version 1803 + +The following Group Policy settings were added in Windows 10, version 1803: + +**System** + +- System\Credentials Delegation\Encryption Oracle Remediation +- System\Group Policy\Phone-PC linking on this device +- System\OS Policies\Allow upload of User Activities + +**Windows Components** + +- Windows Components\App Privacy\Let Windows apps access an eye tracker device +- Windows Components\Cloud Content\Turn off Windows Spotlight on Settings +- Windows Components\Data Collection and Preview Builds\Allow device name to be sent in Windows diagnostic data +- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface +- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications +- Windows Components\Delivery Optimization\Maximum Background Download Bandwidth (percentage) +- Windows Components\Delivery Optimization\Maximum Foreground Download Bandwidth (percentage) +- Windows Components\Delivery Optimization\Select the source of Group IDs +- Windows Components\Delivery Optimization\Delay background download from http (in secs) +- Windows Components\Delivery Optimization\Delay Foreground download from http (in secs) +- Windows Components\Delivery Optimization\Select a method to restrict Peer Selection +- Windows Components\Delivery Optimization\Set Business Hours to Limit Background Download Bandwidth +- Windows Components\Delivery Optimization\Set Business Hours to Limit Foreground Download Bandwidth +- Windows Components\IME\Turn on Live Sticker +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow video capture redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use hardware graphics adapters for all Remote Desktop Services sessions +- Windows Components\Search\Allow Cortana Page in OOBE on an AAD account +- Windows Components\Store\Disable all apps from Microsoft Store +- Windows Components\Text Input\Allow Uninstallation of Language Features +- Windows Components\Text Input\Improve inking and typing recognition +- Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard +- Windows Components\Windows Defender Security Center\Account protection\Hide the Account protection area +- Windows Components\Windows Defender Security Center\Device security\Hide the Device security area +- Windows Components\Windows Defender Security Center\Device security\Hide the Security processor (TPM) troubleshooter page +- Windows Components\Windows Defender Security Center\Device security\Hide the Secure boot area +- Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Ransomware data recovery area + ## New Group Policy settings in Windows 10, version 1709 @@ -65,12 +321,12 @@ The following Group Policy settings were added in Windows 10, version 1709: - Windows Components\Search\Allow Cloud Search - Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard - Windows Components\Windows Defender Application Guard\Allow auditing events in Windows Defender Application Guard -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Network Protection\Prevent users and apps from accessing dangerous websites -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure Controlled folder access -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction rules -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Exclude files and paths from Attack Surface Reduction Rules -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure allowed applications -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure protected folders +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Network Protection\Prevent users and apps from accessing dangerous websites +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure Controlled folder access +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction rules +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Exclude files and paths from Attack Surface Reduction Rules +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure allowed applications +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure protected folders - Windows Components\Windows Defender Exploit Guard\Exploit Protection\Use a common set of exploit protection settings - Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Virus and threat protection area - Windows Components\Windows Defender Security Center\Firewall and network protection\Hide the Firewall and network protection area @@ -205,9 +461,9 @@ The following Group Policy settings were added in Windows 10, version 1703: - Windows Components\Smart Card\Turn on certificate propagation from smart card - Windows Components\Tablet PC\Pen UX Behaviors\Prevent flicks - Windows Components\BitLocker Drive Encryption\Choose drive encryption method and cipher strength (Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10 [Version 1507]) -- Windows Components\Windows Defender Antivirus\Real-time Protection\Turn on behavior monitoring -- Windows Components\Windows Defender Antivirus\Signature Updates\Define file shares for downloading definition updates -- Windows Components\Windows Defender Antivirus\Signature Updates\Turn on scan after signature update +- Windows Components\Microsoft Defender Antivirus\Real-time Protection\Turn on behavior monitoring +- Windows Components\Microsoft Defender Antivirus\Signature Updates\Define file shares for downloading definition updates +- Windows Components\Microsoft Defender Antivirus\Signature Updates\Turn on scan after signature update - Windows Components\File Explorer\Display confirmation dialog when deleting files - Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone\Allow OpenSearch queries in File Explorer - Windows Components\Windows Update\Remove access to use all Windows Update features @@ -270,5 +526,3 @@ No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId= - - diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md new file mode 100644 index 0000000000..6a50151342 --- /dev/null +++ b/windows/client-management/quick-assist.md @@ -0,0 +1,121 @@ +--- +title: Use Quick Assist to help users +description: How IT Pros can use Quick Assist to help users +ms.prod: w10 +ms.sitesec: library +ms.topic: article +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +--- + +# Use Quick Assist to help users + +Quick Assist is a Windows 10 application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user’s device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. + +## Before you begin + +All that's required to use Quick Assist is suitable network and internet connectivity. No particular roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn’t have to authenticate. + +### Authentication + +The helper can authenticate when they sign in by using a Microsoft Account (MSA) or Azure Active Directory. Local Active Directory authentication is not supported at this time. + +### Network considerations + +Quick Assist communicates over port 443 (https) and connects to the Remote Assistance Service at `https://remoteassistance.support.services.microsoft.com` by using the Remote Desktop Protocol (RDP). The traffic is encrypted with TLS 1.2. + +Both the helper and sharer must be able to reach these endpoints over port 443: + +| Domain/Name | Description | +|-----------------------------------|-------------------------------------------------------| +| \*.support.services.microsoft.com | Primary endpoint used for Quick Assist application | +| \*.resources.lync.com | Required for the Skype framework used by Quick Assist | +| \*.infra.lync.com | Required for the Skype framework used by Quick Assist | +| \*.latest-swx.cdn.skype.com | Required for the Skype framework used by Quick Assist | +| \*.login.microsoftonline.com | Required for logging in to the application (MSA) | +| \*.channelwebsdks.azureedge.net | Used for chat services within Quick Assist | +| \*.aria.microsoft.com | Used for accessibility features within the app | +| \*.api.support.microsoft.com | API access for Quick Assist | +| \*.vortex.data.microsoft.com | Used for diagnostic data | +| \*.channelservices.microsoft.com | Required for chat services within Quick Assist | + +## How it works + +1. Both the helper and the sharer start Quick Assist. + +2. The helper selects **Assist another person**. Quick Assist on the helper's side contacts the Remote Assistance Service to obtain a session code. An RCC chat session is established and the helper's Quick Assist instance joins it. The helper then provides the code to the sharer. + +3. After the sharer enters the code in their Quick Assist app, Quick Assist uses that code to contact the Remote Assistance Service and join that specific session. The sharer's Quick Assist instance joins the RCC chat session. + +4. The helper is prompted to select **View Only** or **Full Control**. + +5. The sharer is prompted to confirm allowing the helper to share their desktop with the helper. + +6. Quick Assist starts RDP control and connects to the RDP Relay service. + +7. RDP shares the video to the helper over https (port 443) through the RDP relay service to the helper's RDP control. Input is shared from the helper to the sharer through the RDP relay service. + +:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established"::: + +### Data and privacy + +Microsoft logs a small amount of session data to monitor the health of the Quick Assist system. This data includes the following information: + +- Start and end time of the session + +- Errors arising from Quick Assist itself, such as unexpected disconnections + +- Features used inside the app such as view only, annotation, and session pause + +No logs are created on either the helper’s or sharer’s device. Microsoft cannot access a session or view any actions or keystrokes that occur in the session. + +The sharer sees only an abbreviated version of the helper’s name (first name, last initial) and no other information about them. Microsoft does not store any data about either the sharer or the helper for longer than three days. + +In some scenarios, the helper does require the sharer to respond to application permission prompts (User Account Control), but otherwise the helper has the same permissions as the sharer on the device. + +## Working with Quick Assist + +Either the support staff or a user can start a Quick Assist session. + + +1. Support staff (“helper”) starts Quick Assist in any of a few ways: + + - Type *Quick Assist* in the search box and press ENTER. + - From the Start menu, select **Windows Accessories**, and then select **Quick Assist**. + - Type CTRL+Windows+Q + +2. In the **Give assistance** section, helper selects **Assist another person**. The helper might be asked to choose their account or sign in. Quick Assist generates a time-limited security code. + +3. Helper shares the security code with the user over the phone or with a messaging system. + +4. Quick Assist opens on the sharer’s device. The user enters the provided code in the **Code from assistant** box, and then selects **Share screen**. + +5. The helper receives a dialog offering the opportunity to take full control of the device or just view its screen. After choosing, the helper selects **Continue**. + +6. The sharer receives a dialog asking for permission to show their screen or allow access. The sharer gives permission by selecting the **Allow** button. + +## If Quick Assist is missing + +If for some reason a user doesn't have Quick Assist on their system or it's not working properly, they might need to uninstall and reinstall it. + +### Uninstall Quick Assist + +1. Start the Settings app, and then select **Apps**. +2. Select **Optional features**. +3. In the **Installed features** search bar, type *Quick Assist*. +4. Select **Microsoft Quick Assist**, and then select **Uninstall**. + +### Reinstall Quick Assist + +1. Start the Settings app, and then select **Apps**. +2. Select **Optional features**. +3. Select **Add a feature**. +4. In the new dialog that opens, in the **Add an optional feature** search bar, type *Quick Assist*. +5. Select the check box for **Microsoft Quick Assist**, and then select **Install**. +6. Restart the device. + +## Next steps + +If you have any problems, questions, or suggestions for Quick Assist, contact us by using the [Feedback Hub app](https://www.microsoft.com/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0&rtc=1#activetab=pivot:overviewtab). diff --git a/windows/client-management/system-failure-recovery-options.md b/windows/client-management/system-failure-recovery-options.md new file mode 100644 index 0000000000..4f7a2555e1 --- /dev/null +++ b/windows/client-management/system-failure-recovery-options.md @@ -0,0 +1,205 @@ +--- +title: Configure system failure and recovery options in Windows +description: Learn how to configure the actions that Windows takes when a system error occurs and what the recovery options are. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/22/2019 +ms.reviewer: dcscontentpm +manager: dansimp +--- + +# Configure system failure and recovery options in Windows + +This article describes how to configure the actions that Windows takes when a system error (also referred to as a bug check, system crash, fatal system error, or Stop error) occurs. You can configure the following actions: + +- Write an event to the System log. + +- Alert administrators (if you have set up administrative alerts). + +- Put system memory into a file that advanced users can use for debugging. + +- Automatically restart the computer. + +>[!Note] +> You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure. + +## Configuring system failure and recovery options + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +The options are available in the **Startup and Recovery** dialog box. You can also use the following methods: + +- Modify the values under the following registry subkey: + + **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl** + +- To modify the option on your local computer, use the command line utility (Wmic.exe) to access Windows Management Instrumentation (WMI). + +Follow these steps to view the options in **Startup and Recovery**. (The registry value and Wmic commands are also listed for each option.) + +1. In Control Panel, select **System and Security > System**. + +2. Select **Advanced system settings**, select the **Advanced** tab, and select **Settings** in the **Startup and Recovery** area. + +### Under "System failure" + +Select the check boxes for the actions that you want Windows to perform when a system error occurs. + +#### Write an event to the System log + +This option specifies that event information is recorded in the System log. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set WriteToSystemLog = False + ``` + +- Set the **LogEvent** DWORD value to **0**. + +#### Send an administrative alert + +The option specifies that administrators are notified of the system error if you configured administrative alerts. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set SendAdminAlert = False + ``` + +- Set the **SendAlert** DWORD value to **0**. + +#### Automatically restart + +The option specifies that Windows automatically restarts your computer. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set AutoReboot = False + ``` + +- Set the **AutoReboot** DWORD value to **0**. + +### Under "Write debugging information" + +Select one of the following type of information that you want Windows to record in a memory dump file if the computer stops unexpectedly: + +#### (none) + +The option does not record any information in a memory dump file. + +To specify that you do not want Windows to record information in a memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 0 + ``` +- Set the **CrashDumpEnabled** DWORD value to **0**. + +#### Small Memory Dump + +The option records the smallest amount of information to help identify the problem. This option requires a paging file of at least 2 megabytes (MB) on the boot volume of your computer, and specifies that Windows will create a new file each time the system stops unexpectedly. A history of these files is stored in the folder that is listed under Small Dump Directory (%SystemRoot%\Minidump). In Windows XP and Windows Server 2003, the small memory dump file is used together with the Windows Error Reporting feature. + +To specify that you want to use a small memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 3 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **3**. + +To specify that you want to use a folder as your Small Dump Directory, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set MiniDumpDirectory = + ``` + +- Set the **MinidumpDir** Expandable String Value to \. + +#### Kernel Memory Dump + +The option records only kernel memory. This option stores more information than a small memory dump file, but it takes less time to complete than a complete memory dump file. The file is stored in %SystemRoot%\Memory.dmp by default, and any previous kernel or complete memory dump files are overwritten if the **Overwrite any existing file** check box is selected. If you set this option, you must have a sufficiently large paging file on the boot volume. The required size depends on the amount of RAM in your computer However, the maximum amount of space that must be available for a kernel memory dump on a 32-bit system is 2 GB plus 16 MB. On a 64-bit system, the maximum amount of space that must be available for a kernel memory dump is the size of the RAM plus 128 MB. The following table provides guidelines for the size of the paging file: + +|RAM size |Paging file should be no smaller than| +|-------|-----------------| +|256 MB–1,373 MB |1.5 times the RAM size| +|1,374 MB or greater |32-bit system: 2 GB plus 16 MB
            64-bit system: size of the RAM plus 128 MB| + +To specify that you want to use a kernel memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 2 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **2**. + +To specify that you want to use a file as your memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugFilePath = + ``` + +- Set the **DumpFile** Expandable String Value to \. + +To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set OverwriteExistingDebugFile = 0 + ``` + +- Set the **Overwrite** DWORD value to **0**. + +#### Complete Memory Dump + +The option records the contents of system memory when the computer stops unexpectedly. This option is not available on computers that have 2 or more GB of RAM. If you select this option, you must have a paging file on the boot volume that is sufficient to hold all the physical RAM plus 1 MB. The file is stored as specified in %SystemRoot%\Memory.dmp by default. + +The extra megabyte is required for a complete memory dump file because Windows writes a header in addition to dumping the memory contents. The header contains a crash dump signature and specifies the values of some kernel variables. The header information does not require a full megabyte of space, but Windows sizes your paging file in increments of megabytes. + +To specify that you want to use a complete memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 1 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **1**. + +To specify that you want to use a file as your memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugFilePath = + ``` + +- Set the DumpFile Expandable String Value to \. + +To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set OverwriteExistingDebugFile = 0 + ``` + +- Set the **Overwrite** DWORD value to **0**. + +>[!Note] +>If you contact Microsoft Support about a Stop error, you might be asked for the memory dump file that is generated by the Write Debugging Information option. + +To view system failure and recovery settings for your local computer, type **wmic recoveros** at a command prompt, and then press Enter. To view system failure and recovery settings for a remote computer on your local area network, type **wmic /node: recoveros** at a command prompt, and then press Enter. + +>[!Note] +>To successfully use these Wmic.exe command line examples, you must be logged on by using a user account that has administrative rights on the computer. If you are not logged on by using a user account that has administrative rights on the computer, use the **/user:user_name** and **/password:password** switches. + +### Tips + +- To take advantage of the dump file feature, your paging file must be on the boot volume. If you have moved the paging file to another volume, you must move it back to the boot volume before you use this feature. + +- If you set the Kernel Memory Dump or the Complete Memory Dump option, and you select the **Overwrite any existing file** check box, Windows always writes to the same file name. To save individual dump files, click to clear the **Overwrite any existing file** check box, and then change the file name after each Stop error. + +- You can save some memory if you click to clear the **Write an event to the system log** and **Send an administrative alert** check boxes. The memory that you save depends on the computer, but these features typically require about 60 to 70 KB. + +## References + +[Varieties of Kernel-Mode Dump Files](https://docs.microsoft.com/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md new file mode 100644 index 0000000000..b774919abf --- /dev/null +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -0,0 +1,121 @@ +--- +title: Advanced troubleshooting for Event ID 41 - "The system has rebooted without cleanly shutting down first" +description: Describes the circumstances that cause a computer to generate Event ID 41, and provides guidance for troubleshooting the issue +author: Teresa-Motiv +ms.author: v-tea +ms.date: 12/27/2019 +ms.prod: w10 +ms.topic: article +ms.custom: +- CI 111437 +- CSSTroubleshooting +audience: ITPro +ms.localizationpriority: medium +keywords: event id 41, reboot, restart, stop error, bug check code +manager: kaushika + +--- + +# Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first" + +> **Home users** +> This article is intended for use by support agents and IT professionals. If you're looking for more information about blue screen error messages, please visit [Troubleshoot blue screen errors](https://support.microsoft.com/help/14238/windows-10-troubleshoot-blue-screen-errors). + +The preferred way to shut down Windows is to select **Start**, and then select an option to turn off or shut down the computer. When you use this standard method, the operating system closes all files and notifies the running services and applications so that they can write any unsaved data to disk and flush any active caches. + +If your computer shuts down unexpectedly, Windows logs Event ID 41 the next time that the computer starts. The event text resembles the following: + +> Event ID: 41 +> Description: The system has rebooted without cleanly shutting down first. + +This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown might be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down. During the [kernel phase](advanced-troubleshooting-boot-problems.md#kernel-phase) of the next Windows startup, Windows checks for these codes and includes any existing codes in the event data of Event ID 41. + +> EventData +> BugcheckCode 159 +> BugcheckParameter1 0x3 +> BugcheckParameter2 0xfffffa80029c5060 +> BugcheckParameter3 0xfffff8000403d518 +> BugcheckParameter4 0xfffffa800208c010 +> SleepInProgress false +> PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010) + +## How to use Event ID 41 when you troubleshoot an unexpected shutdown or restart + +By itself, Event ID 41 might not contain sufficient information to explicitly define what occurred. Typically, you have to also consider what was occurring at the time of the unexpected shutdown (for example, the power supply failed). Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances: + +- [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code +- [Scenario 2](#scen2): The computer restarts because you pressed and held the power button +- [Scenario 3](#scen3): The computer is unresponsive or randomly restarts, and Event ID 41 is not logged or the Event ID 41 entry lists error code values of zero + +### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code + +When a computer shuts down or restarts because of a Stop error, Windows includes the Stop error data in Event ID 41 as part of the additional event data. This information includes the Stop error code (also called a bug check code), as shown in the following example: + +> EventData +> BugcheckCode 159 +> BugcheckParameter1 0x3 +> BugcheckParameter2 0xfffffa80029c5060 +> BugcheckParameter3 0xfffff8000403d518 +> BugcheckParameter4 0xfffffa800208c010 + +> [!NOTE] +> Event ID 41 includes the bug check code in decimal format. Most documentation that describes bug check codes refers to the codes as hexadecimal values instead of decimal values. To convert decimal to hexadecimal, follow these steps: +> +> 1. Select **Start**, type **calc** in the **Search** box, and then select **Calculator**. +> 1. In the **Calculator** window, select **View** > **Programmer**. +> 1. On the left side of calculator, verify that **Dec** is highlighted. +> 1. Use the keyboard to enter the decimal value of the bug check code. +> 1. On the left side of the calculator, select **Hex**. +> The value that the calculator displays is now the hexadecimal code. +> +> When you convert a bug check code to hexadecimal format, verify that the “0x” designation is followed by eight digits (that is, the part of the code after the “x” includes enough zeros to fill out eight digits). For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. In the case of the example event data in this article, "159" converts to 0x0000009f. + +After you identify the hexadecimal value, use the following references to continue troubleshooting: + +- [Advanced troubleshooting for Stop error or blue screen error issue](troubleshoot-stop-errors.md). +- [Bug Check Code Reference](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2). This page lists links to documentation for different bug check codes. +- [How to Debug Kernel Mode Blue Screen Crashes (for beginners)](https://blogs.technet.microsoft.com/askcore/2008/10/31/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners/). + +### Scenario 2: The computer restarts because you pressed and held the power button + +Because this method of restarting the computer interferes with the Windows shutdown operation, we recommend that you use this method only if you have no alternative. For example, you might have to use this approach if your computer is not responding. When you restart the computer by pressing and holding the power button, the computer logs an Event ID 41 that includes a non-zero value for the **PowerButtonTimestamp** entry. + +For help when troubleshooting an unresponsive computer, see [Windows Help](https://support.microsoft.com/hub/4338813/windows-help?os=windows-10). Consider searching for assistance by using keywords such as "hang," "responding," or "blank screen." + +### Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is not recorded or the Event ID 41 entry or lists error code values of zero + +This scenario includes the following circumstances: + +- You shut off power to an unresponsive computer, and then you restart the computer. + To verify that a computer is unresponsive, press the CAPS LOCK key on the keyboard. If the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer might be completely unresponsive (also known as a *hard hang*). +- The computer restarts, but it does not generate Event ID 41. +- The computer restarts and generates Event ID 41, but the **BugcheckCode** and **PowerButtonTimestamp** values are zero. + +In such cases, something prevents Windows from generating error codes or from writing error codes to disk. Something might block write access to the disk (as in the case of an unresponsive computer) or the computer might shut down too quickly to write the error codes or even detect an error. + +The information in Event ID 41 provides some indication of where to start checking for problems: + +- **Event ID 41 is not recorded or the bug check code is zero**. This behavior might indicate a power supply problem. If the power to a computer is interrupted, the computer might shut down without generating a Stop error. If it does generate a Stop error, it might not finish writing the error codes to disk. The next time the computer starts, it might not log Event ID 41. Or, if it does, the bug check code is zero. Conditions such as the following might be the cause: + - In the case of a portable computer, the battery was removed or completely drained. + - In the case of a desktop computer, the computer was unplugged or experienced a power outage. + - The power supply is underpowered or faulty. + +- **The PowerButtonTimestamp value is zero**. This behavior might occur if you disconnected the power to a computer that was not responding to input. Conditions such as the following might be the cause: + - A Windows process blocked write access to the disk, and you shut down the computer by pressing and holding the power button for at least four seconds. + - You disconnected the power to an unresponsive computer. + +Typically, the symptoms described in this scenario indicate a hardware problem. To help isolate the problem, do the following: + +- **Disable overclocking**. If the computer has overclocking enabled, disable it. Verify that the issue occurs when the system runs at the correct speed. +- **Check the memory**. Use a memory checker to determine the memory health and configuration. Verify that all memory chips run at the same speed and that every chip is configured correctly in the system. +- **Check the power supply**. Verify that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently. If the computer logged Event ID 41 because the power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. +- **Check for overheating**. Examine the internal temperature of the hardware and check for any overheating components. + +If you perform these checks and still cannot isolate the problem, set the system to its default configuration and verify whether the issue still occurs. + +> [!NOTE] +> If you see a Stop error message that includes a bug check code, but Event ID 41 does not include that code, change the restart behavior for the computer. To do this, follow these steps: +> +> 1. Right-click **My Computer**, then select **Properties** > **Advanced system settings** > **Advanced**. +> 1. In the **Startup and Recovery** section, select **Settings**. +> 1. Clear the **Automatically restart** check box. diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index 27b46491dc..bdb67e2528 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -1,6 +1,6 @@ --- -title: Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device -description: Learn how to troubleshoot Stop error 7B or Inaccessible_Boot_Device +title: Advanced advice for Stop error 7B, Inaccessible_Boot_Device +description: Learn how to troubleshoot Stop error 7B or Inaccessible_Boot_Device. This error might occur after some changes are made to the computer, ms.prod: w10 ms.mktglfcycl: ms.sitesec: library @@ -15,27 +15,27 @@ manager: dansimp # Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device -This article provides steps to troubleshoot **Stop error 7B: Inaccessible_Boot_Device**. This error may occur after some changes are made to the computer, or immediately after you deploy Windows on the computer. +This article provides steps to troubleshoot **Stop error 7B: Inaccessible_Boot_Device**. This error might occur after some changes are made to the computer, or immediately after you deploy Windows on the computer. ## Causes of the Inaccessible_Boot_Device Stop error -Any one of the following factors may cause the stop error: +Any one of the following factors might cause the stop error: -* Missing, corrupted, or misbehaving filter drivers that are related to the storage stack +* Missing, corrupted, or misbehaving filter drivers that are related to the storage stack -* File system corruption +* File system corruption -* Changes to the storage controller mode or settings in the BIOS +* Changes to the storage controller mode or settings in the BIOS -* Using a different storage controller than the one that was used when Windows was installed +* Using a different storage controller than the one that was used when Windows was installed -* Moving the hard disk to a different computer that has a different controller +* Moving the hard disk to a different computer that has a different controller -* A faulty motherboard or storage controller, or faulty hardware +* A faulty motherboard or storage controller, or faulty hardware -* In unusual cases: the failure of the TrustedInstaller service to commit newly installed updates because of Component Based Store corruptions +* In unusual cases, the failure of the TrustedInstaller service to commit newly installed updates is because of component-based store corruptions -* Corrupted files in the **Boot** partition (for example, corruption in the volume that is labeled **SYSTEM** when you run the `diskpart` > `list vol` command) +* Corrupted files in the **Boot** partition (for example, corruption in the volume that's labeled **SYSTEM** when you run the `diskpart` > `list vol` command) ## Troubleshoot this error @@ -43,9 +43,9 @@ Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com 1. Start the system by using [the installation media for the installed version of Windows](https://support.microsoft.com/help/15088). -2. On the **Install Windows** screen, select **Next** > **Repair your computer** . +2. On the **Install Windows** screen, select **Next** > **Repair your computer**. -3. On the **System Recovery Options** screen, select **Next** > **Command Prompt** . +3. On the **System Recovery Options** screen, select **Next** > **Command Prompt**. ### Verify that the boot disk is connected and accessible @@ -55,7 +55,7 @@ Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com A list of the physical disks that are attached to the computer should be displayed and resemble the following display: -``` +```console Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- @@ -65,7 +65,7 @@ A list of the physical disks that are attached to the computer should be display If the computer uses a Unified Extensible Firmware Interface (UEFI) startup interface, there will be an asterisk () in the **GPT* column. -If the computer uses a basic input/output system (BIOS) interface, there will not be an asterisk in the **Dyn** column. +If the computer uses a basic input/output system (BIOS) interface, there won't be an asterisk in the **Dyn** column. #### Step 2 @@ -73,7 +73,7 @@ If the `list disk` command lists the OS disks correctly, run the `list vol` comm `list vol` generates an output that resembles the following display: -``` +```console Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- @@ -86,7 +86,7 @@ If the `list disk` command lists the OS disks correctly, run the `list vol` comm ``` >[!NOTE] ->If the disk that contains the OS is not listed in the output, you will have to engage the OEM or virtualization manufacturer. +>If the disk that contains the OS isn't listed in the output, you'll have to engage the OEM or virtualization manufacturer. ### Verify the integrity of Boot Configuration Database @@ -94,57 +94,57 @@ Check whether the Boot Configuration Database (BCD) has all the correct entries. To verify the BCD entries: -1. Examine the **Windows Boot Manager** section that has the **{bootmgr}** identifier. Make sure that the **device** and **path** entries point to the correct device and boot loader file. +1. Examine the **Windows Boot Manager** section that has the **{bootmgr}** identifier. Make sure that the **device** and **path** entries point to the correct device and boot loader file. - An example output if the computer is UEFI-based: + If the computer is UEFI-based, here's example output: - ``` + ```cmd device partition=\Device\HarddiskVolume2 path \EFI\Microsoft\Boot\bootmgfw.efi ``` - An example output if the machine is BIOS based: - ``` + If the machine is BIOS-based, here's example output: + ```cmd Device partition=C: ``` >[!NOTE] - >This output may not contain a path. + >This output might not contain a path. -2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device** , **path** , **osdevice,** and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. +2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device**, **path**, **osdevice**, and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. - >[!NOTE] - >If the computer is UEFI-based, the **bootmgr** and **winload** entires under **{default}** will contain an **.efi** extension. + > [!NOTE] + > If the computer is UEFI-based, the file path value that's specified in the **path** parameter of **{bootmgr}** and **{default}** contains an **.efi** extension. ![bcdedit](images/screenshot1.png) -If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that is named **bcdbackup** . To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup** . +If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that's named **bcdbackup**. To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup**. -After the backup is completed, run the following command to make the changes: +After the backup completes, run the following command to make the changes:
            bcdedit /set *{identifier}* option value
            -For example, if the device under {default} is wrong or missing, run the following command to set it: `bcdedit /set {default} device partition=C:` +For example, if the device under {default} is wrong or missing, run this command to set it: `bcdedit /set {default} device partition=C:` - If you want to re-create the BCD completely, or if you get a message that states that "**The boot configuration data store could not be opened. The system could not find the file specified,** " run `bootrec /rebuildbcd`. + If you want to completely re-create the BCD, or if you get a message that states that "**The boot configuration data store could not be opened. The system could not find the file specified,** " run `bootrec /rebuildbcd`. -If the BCD has the correct entries, check whether the **winload** and **bootmgr** entries exist in the correct location per the path that is specified in the **bcdedit** command. By default, **bootmgr** in the BIOS partition will be in the root of the **SYSTEM** partition. To see the file, run `Attrib -s -h -r`. +If the BCD has the correct entries, check whether the **winload** and **bootmgr** entries exist in the correct location, which is in the specified path in the **bcdedit** command. By default, **bootmgr** in the BIOS partition is in the root of the **SYSTEM** partition. To see the file, run `Attrib -s -h -r`. If the files are missing, and you want to rebuild the boot files, follow these steps: -1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, as follows: +1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, like shown here: -``` -D:\> Mkdir BootBackup -R:\> Copy *.* D:\BootBackup -``` + ```cmd + D:\> Mkdir BootBackup + R:\> Copy *.* D:\BootBackup + ``` -2. If you are using Windows 10, or if you are troubleshooting by using a Windows 10 ISO at the Windows Pre-Installation Environment command prompt, you can use the **bcdboot** command to re-create the boot files, as follows: +2. If you're using Windows 10, or if you're troubleshooting by using a Windows 10 ISO at the Windows Pre-Installation Environment command prompt, you can use the **bcdboot** command to re-create the boot files, like shown here: ```cmd Bcdboot <**OSDrive* >:\windows /s <**SYSTEMdrive* >: /f ALL ``` - For example: if we assign the `` (WinRE drive) the letter R and the `` is the letter D, this command would be the following: + For example, if we assign the `` (WinRE drive) the letter R and the `` is the letter D, the following is the command that we would use: ```cmd Bcdboot D:\windows /s R: /f ALL @@ -153,13 +153,13 @@ R:\> Copy *.* D:\BootBackup >[!NOTE] >The **ALL** part of the **bcdboot** command writes all the boot files (both UEFI and BIOS) to their respective locations. -If you do not have a Windows 10 ISO, you must format the partition and copy **bootmgr** from another working computer that has a similar Windows build. To do this, follow these steps: +If you don't have a Windows 10 ISO, format the partition and copy **bootmgr** from another working computer that has a similar Windows build. To do this, follow these steps: -1. Start **Notepad** . +1. Start **Notepad**. 2. Press Ctrl+O. -3. Navigate to the system partition (in this example, it is R). +3. Navigate to the system partition (in this example, it's R). 4. Right-click the partition, and then format it. @@ -171,7 +171,7 @@ Run the following command to verify the Windows update installation and dates: Dism /Image:: /Get-packages ``` -After you run this command, you will see the **Install pending** and **Uninstall Pending** packages: +After you run this command, you'll see the **Install pending** and **Uninstall Pending** packages: ![Dism output](images/pendingupdate.png) @@ -179,27 +179,27 @@ After you run this command, you will see the **Install pending** and **Uninstall ![Dism output](images/revertpending.png) -2. Navigate to ***OSdriveLetter* :\Windows\WinSxS** , and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. +2. Navigate to ***OSdriveLetter*:\Windows\WinSxS**, and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. -3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. +3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. 4. Select **HKEY_LOCAL_MACHINE**, and then go to **File** > **Load Hive**. -5. Navigate to **OSdriveLetter:\Windows\System32\config**, select the file that is named **COMPONENT** (with no extension), and then select **Open**. When you are prompted, enter the name **OfflineComponentHive** for the new hive +5. Navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **COMPONENT** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineComponentHive** for the new hive. ![Load Hive](images/loadhive.png) 6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. -7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. +7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. ![Unload Hive](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) -8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter* :\Windows\System32\config**, select the file that is named **SYSTEM** (with no extension), and then select **Open** . When you are prompted, enter the name **OfflineSystemHive** for the new hive. +8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **SYSTEM** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineSystemHive** for the new hive. 9. Expand **HKEY_LOCAL_MACHINE\OfflineSystemHive**, and then select the **Select** key. Check the data for the **Default** value. -10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1** , expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it is **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. +10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it's **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. 11. Expand **Control\Session Manager**. Check whether the **PendingFileRenameOperations** key exists. If it does, back up the **SessionManager** key, and then delete the **PendingFileRenameOperations** key. @@ -207,7 +207,7 @@ After you run this command, you will see the **Install pending** and **Uninstall #### Check services -1. Follow steps 1-10 in the "Troubleshooting if this issue occurs after an Windows Update installation" section. (Step 11 does not apply to this procedure.) +1. Follow steps 1-10 in the "Troubleshooting if this issue occurs after a Windows Update installation" section. (Step 11 doesn't apply to this procedure.) 2. Expand **Services**. @@ -225,9 +225,9 @@ After you run this command, you will see the **Install pending** and **Uninstall * VOLUME -If these keys exist, check each one to make sure that it has a value that is named **Start** and that it is set to **0**. If not, set the value to **0**. +If these keys exist, check each one to make sure that it has a value that's named **Start**, and that it's set to **0**. If it's not, set the value to **0**. -If any of these keys do not exist, you can try to replace the current registry hive by using the hive from **RegBack**. To do this, run the following commands: +If any of these keys don't exist, you can try to replace the current registry hive by using the hive from **RegBack**. To do this, run the following commands: ```cmd cd OSdrive:\Windows\System32\config @@ -237,7 +237,7 @@ copy OSdrive:\Windows\System32\config\RegBack\SYSTEM OSdrive:\Windows\System32\c #### Check upper and lower filter drivers -Check whether there are any non-Microsoft upper and lower filter drivers on the computer and that they do not exist on another, similar working computer. if they do exist, remove the upper and lower filter drivers: +Check whether there are any non-Microsoft upper and lower filter drivers on the computer and that they don't exist on another, similar working computer. If they do exist, remove the upper and lower filter drivers: 1. Expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001\Control**. @@ -245,8 +245,8 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the >[!NOTE] >These filters are mainly related to storage. After you expand the **Control** key in the registry, you can search for **UpperFilters** and **LowerFilters**. - - The following are some of the different registry entries in which you may find these filter drivers. These entries are located under **ControlSet** and are designated as **Default** : + + You might find these filter drivers in some of the following registry entries. These entries are under **ControlSet** and are designated as **Default**: \Control\Class\\{4D36E96A-E325-11CE-BFC1-08002BE10318} @@ -258,19 +258,19 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the ![Registry](images/controlset.png) -If an **UpperFilters** or **LowerFilters** entry is non-standard (for example, it is not a Windows default filter driver, such as PartMgr), remove the entry by double-clicking it in the right pane, and then deleting only that value. +If an **UpperFilters** or **LowerFilters** entry is non-standard (for example, it's not a Windows default filter driver, such as PartMgr), remove the entry. To remove it, double-click it in the right pane, and then delete only that value. >[!NOTE] >There could be multiple entries. -The reason that these entries may affect us is because there may be an entry in the **Services** branch that has a START type set to 0 or 1 (indicating that it is loaded at the Boot or Automatic part of the boot process). Also, either the file that is referred to is missing or corrupted, or it may be named differently than what is listed in the entry. +These entries might affect us because there might be an entry in the **Services** branch that has a START type set to 0 or 1, which means that it's loaded at the Boot or Automatic part of the boot process. Also, either the file that's referred to is missing or corrupted, or it might be named differently than what's listed in the entry. >[!NOTE] ->If there actually is a service that is set to **0** or **1** that corresponds to an **UpperFilters** or **LowerFilters** entry, setting the service to disabled in the **Services** registry (as discussed in steps 2 and 3 of the Check services section) without removing the **Filter Driver** entry causes the computer to crash and generate a 0x7b Stop error. +>If there's a service that's set to **0** or **1** that corresponds to an **UpperFilters** or **LowerFilters** entry, setting the service to disabled in the **Services** registry (as discussed in steps 2 and 3 of the Check services section) without removing the **Filter Driver** entry causes the computer to crash and generate a 0x7b Stop error. ### Running SFC and Chkdsk - If the computer still does not start, you can try to run a **chkdisk** process on the system drive, and also run System File Checker. To do this, run the following commands at a WinRE command prompt: + If the computer still doesn't start, you can try to run a **chkdisk** process on the system drive, and then also run System File Checker. To do this, run the following commands at a WinRE command prompt: * `chkdsk /f /r OsDrive:` @@ -279,4 +279,3 @@ The reason that these entries may affect us is because there may be an entry in * `sfc /scannow /offbootdir=OsDrive:\ /offwindir=OsDrive:\Windows` ![SFC scannow](images/sfc-scannow.png) - diff --git a/windows/client-management/troubleshoot-networking.md b/windows/client-management/troubleshoot-networking.md index 57398a2764..7ff85215fe 100644 --- a/windows/client-management/troubleshoot-networking.md +++ b/windows/client-management/troubleshoot-networking.md @@ -2,7 +2,7 @@ title: Advanced troubleshooting for Windows networking ms.reviewer: manager: dansimp -description: Learn how to troubleshoot networking +description: Learn about the topics that are available to help you troubleshoot common problems related to Windows networking. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md new file mode 100644 index 0000000000..fb99d5d919 --- /dev/null +++ b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md @@ -0,0 +1,46 @@ +--- +title: Stop error occurs when you update the in-box Broadcom network adapter driver +description: Describes an issue that causes a stop error when you update an in-box Broadcom driver on Windows Server 2019, version 1809. +author: Teresa-Motiv +ms.author: v-tea +ms.date: 2/3/2020 +ms.prod: w10 +ms.topic: article +ms.custom: +- CI 113175 +- CSSTroubleshooting +audience: ITPro +ms.localizationpriority: medium +keywords: +manager: kaushika +--- + +# Stop error occurs when you update the in-box Broadcom network adapter driver + +This issue affects computers that meet the following criteria: + +- The operating system is Windows Server 2019, version 1809. +- The network adapter is a Broadcom NX1 Gigabit Ethernet network adapter. +- The number of logical processors is large (for example, a computer that has more than 38 logical processors). + +On such a computer, when you update the in-box Broadcom network adapter driver to a later version or when you install the Intel chipset driver, the computer experiences a Stop error (also known as a blue screen error or bug check error). + +## Cause + +The operating system media for Windows Server 2019, version 1809, contains version 17.2 of the Broadcom NIC driver. When you upgrade this driver to a later version, the process of uninstalling the version 17.2 driver generates an error. This is a known issue. + +This issue was resolved in Windows Server 2019 version 1903. The operating system media use a later version of the Broadcom network adapter driver. + +## Workaround + +To update the Broadcom network adapter driver on an affected computer, follow these steps: + +> [!NOTE] +> This procedure describes how to use Device Manager to disable and re-enable the Broadcom network adapter. Alternatively, you can use the computer BIOS to disable and re-enable the adapter. For specific instructions, see your OEM BIOS configuration guide. + +1. Download the driver update to the affected computer. +1. Open Device Manager, and then select the Broadcom network adapter. +1. Right-click the adapter and then select **Disable device**. +1. Right-click the adapter again and then select **Update driver** > **Browse my computer for driver software**. +1. Select the update that you downloaded, and then start the update. +1. After the update finishes, right-click the adapter and then select **Enable device**. diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 0c13fc8950..0ed8e1db70 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -2,7 +2,7 @@ title: Advanced troubleshooting for Stop error or blue screen error issue ms.reviewer: manager: dansimp -description: Learn how to troubleshoot Stop error or blue screen issues. +description: Learn advanced options for troubleshooting Stop errors, also known as blue screen errors or bug check errors. ms.prod: w10 ms.mktglfcycl: ms.sitesec: library @@ -22,9 +22,9 @@ ms.author: dansimp A Stop error is displayed as a blue screen that contains the name of the faulty driver, such as any of the following example drivers: -- atikmpag.sys -- igdkmd64.sys -- nvlddmkm.sys +- `atikmpag.sys` +- `igdkmd64.sys` +- `nvlddmkm.sys` There is no simple explanation for the cause of Stop errors (also known as blue screen errors or bug check errors). Many different factors can be involved. However, various studies indicate that Stop errors usually are not caused by Microsoft Windows components. Instead, these errors are generally related to malfunctioning hardware drivers or drivers that are installed by third-party software. This includes video cards, wireless network cards, security programs, and so on. @@ -43,7 +43,9 @@ To troubleshoot Stop error messages, follow these general steps: 2. As a best practice, we recommend that you do the following: a. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system: - + - [Windows 10, version 2004](https://support.microsoft.com/help/4555932) + - [Windows 10, version 1909](https://support.microsoft.com/help/4529964) + - [Windows 10, version 1903](https://support.microsoft.com/help/4498140) - [Windows 10, version 1809](https://support.microsoft.com/help/4464619) - [Windows 10, version 1803](https://support.microsoft.com/help/4099479) - [Windows 10, version 1709](https://support.microsoft.com/help/4043454) @@ -59,9 +61,9 @@ To troubleshoot Stop error messages, follow these general steps: 3. Run the [Machine Memory Dump Collector](https://home.diagnostics.support.microsoft.com/selfhelp?knowledgebasearticlefilter=2027760&wa=wsignin1.0) Windows diagnostic package. This diagnostic tool is used to collect machine memory dump files and check for known solutions. -4. Run [Microsoft Safety Scanner](http://www.microsoft.com/security/scanner/en-us/default.aspx) or any other virus detection program that includes checks of the Master Boot Record for infections. +4. Run [Microsoft Safety Scanner](https://www.microsoft.com/security/scanner/en-us/default.aspx) or any other virus detection program that includes checks of the Master Boot Record for infections. -5. Make sure that there is sufficient free space on the hard disk. The exact requirement varies, but we recommend 10 to 15 percent free disk space. +5. Make sure that there is sufficient free space on the hard disk. The exact requirement varies, but we recommend 10–15 percent free disk space. 6. Contact the respective hardware or software vendor to update the drivers and applications in the following scenarios: @@ -90,12 +92,12 @@ To configure the system for memory dump files, follow these steps: 5. Stop and disable Automatic System Restart Services (ASR) to prevent dump files from being written. 6. If the server is virtualized, disable auto reboot after the memory dump file is created. This lets you take a snapshot of the server in-state and also if the problem recurs. -The memory dump file is saved at the following locations. +The memory dump file is saved at the following locations: | Dump file type | Location | |----------------|----------| -|(none) | %SystemRoot%\MEMORY.DMP (inactive, or greyed out) | -|Small memory dump file (256kb) | %SystemRoot%\Minidump | +|(none) | %SystemRoot%\MEMORY.DMP (inactive, or grayed out) | +|Small memory dump file (256 kb) | %SystemRoot%\Minidump | |Kernel memory dump file | %SystemRoot%\MEMORY.DMP | | Complete memory dump file | %SystemRoot%\MEMORY.DMP | | Automatic memory dump file | %SystemRoot%\MEMORY.DMP | @@ -118,7 +120,7 @@ More information on how to use Dumpchk.exe to check your dump files: ### Memory dump analysis -Finding the root cause of the crash may not be easy. Hardware problems are especially difficult to diagnose because they may cause erratic and unpredictable behavior that can manifest itself in a variety of symptoms. +Finding the root cause of the crash may not be easy. Hardware problems are especially difficult to diagnose because they may cause erratic and unpredictable behavior that can manifest itself in various symptoms. When a Stop error occurs, you should first isolate the problematic components, and then try to cause them to trigger the Stop error again. If you can replicate the problem, you can usually determine the cause. @@ -138,8 +140,8 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols 1. Verify that the computer is set up to generate a complete memory dump file when a crash occurs. See the steps [here](troubleshoot-windows-freeze.md#method-1-memory-dump) for more information. 2. Locate the memory.dmp file in your Windows directory on the computer that is crashing, and copy that file to another computer. -3. On the other computer, download the [Windows 10 SDK](https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk). -4. Start the install and choose **Debugging Tools for Windows**. This will install the WinDbg tool. +3. On the other computer, download the [Windows 10 SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk). +4. Start the install and choose **Debugging Tools for Windows**. This installs the WinDbg tool. 5. Open the WinDbg tool and set the symbol path by clicking **File** and then clicking **Symbol File Path**.
            a. If the computer is connected to the Internet, enter the [Microsoft public symbol server](https://docs.microsoft.com/windows-hardware/drivers/debugger/microsoft-public-symbols) (https://msdl.microsoft.com/download/symbols) and click **OK**. This is the recommended method.
            b. If the computer is not connected to the Internet, you must specify a local [symbol path](https://docs.microsoft.com/windows-hardware/drivers/debugger/symbol-path). @@ -149,7 +151,7 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols 8. A detailed bugcheck analysis will appear. See the example below. ![Bugcheck analysis](images/bugcheck-analysis.png) 9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL. -10. See [Using the !analyze Exension](https://docs.microsoft.com/windows-hardware/drivers/debugger/using-the--analyze-extension) for details about how to interpret the STACK_TEXT output. +10. See [Using the !analyze Extension](https://docs.microsoft.com/windows-hardware/drivers/debugger/using-the--analyze-extension) for details about how to interpret the STACK_TEXT output. There are many possible causes of a bugcheck and each case is unique. In the example provided above, the important lines that can be identified from the STACK_TEXT are 20, 21, and 22: @@ -213,7 +215,7 @@ Use the following guidelines when you use Driver Verifier: - Test any “suspicious” drivers (drivers that were recently updated or that are known to be problematic). - If you continue to experience non-analyzable crashes, try enabling verification on all third-party and unsigned drivers. -- Enable concurrent verification on groups of 10 to 20 drivers. +- Enable concurrent verification on groups of 10–20 drivers. - Additionally, if the computer cannot boot into the desktop because of Driver Verifier, you can disable the tool by starting in Safe mode. This is because the tool cannot run in Safe mode. For more information, see [Driver Verifier](https://docs.microsoft.com/windows-hardware/drivers/devtest/driver-verifier). @@ -233,13 +235,13 @@ SYSTEM_SERVICE_EXCEPTION
            Stop error code c000021a {Fatal System Error} The W NTFS_FILE_SYSTEM
            Stop error code 0x000000024 | This Stop error is commonly caused by corruption in the NTFS file system or bad blocks (sectors) on the hard disk. Corrupted drivers for hard disks (SATA or IDE) can also adversely affect the system's ability to read and write to disk. Run any hardware diagnostics that are provided by the manufacturer of the storage subsystem. Use the scan disk tool to verify that there are no file system errors. To do this, right-click the drive that you want to scan, select Properties, select Tools, and then select the Check now button.We also suggest that you update the NTFS file system driver (Ntfs.sys), and apply the latest cumulative updates for the current operating system that is experiencing the problem. KMODE_EXCEPTION_NOT_HANDLED
            Stop error code 0x0000001E | If a driver is identified in the Stop error message, disable or remove that driver. Disable or remove any drivers or services that were recently added.

            If the error occurs during the startup sequence, and the system partition is formatted by using the NTFS file system, you might be able to use Safe mode to disable the driver in Device Manager. To do this, follow these steps:

            Go to **Settings > Update & security > Recovery**. Under **Advanced startup**, select **Restart now**. After your PC restarts to the **Choose an option** screen, select **Troubleshoot > Advanced options > Startup Settings > Restart**. After the computer restarts, you'll see a list of options. Press **4** or **F4** to start the computer in Safe mode. Or, if you intend to use the Internet while in Safe mode, press **5** or **F5** for the Safe Mode with Networking option. DPC_WATCHDOG_VIOLATION
            Stop error code 0x00000133 | This Stop error code is caused by a faulty driver that does not complete its work within the allotted time frame in certain conditions. To enable us to help mitigate this error, collect the memory dump file from the system, and then use the Windows Debugger to find the faulty driver. If a driver is identified in the Stop error message, disable the driver to isolate the problem. Check with the manufacturer for driver updates. Check the system log in Event Viewer for additional error messages that might help identify the device or driver that is causing Stop error 0x133. Verify that any new hardware that is installed is compatible with the installed version of Windows. For example, you can get information about required hardware at Windows 10 Specifications. If Windows Debugger is installed, and you have access to public symbols, you can load the c:\windows\memory.dmp file into the Debugger, and then refer to [Determining the source of Bug Check 0x133 (DPC_WATCHDOG_VIOLATION) errors on Windows Server 2012](https://blogs.msdn.microsoft.com/ntdebugging/2012/12/07/determining-the-source-of-bug-check-0x133-dpc_watchdog_violation-errors-on-windows-server-2012/) to find the problematic driver from the memory dump. -USER_MODE_HEALTH_MONITOR
            Stop error code 0x0000009E | This Stop error indicates that a user-mode health check failed in a way that prevents graceful shutdown. Therefore, Windows restores critical services by restarting or enabling application failover to other servers. The Clustering Service incorporates a detection mechanism that may detect unresponsiveness in user-mode components.
            This Stop error usually occurs in a clustered environment, and the indicated faulty driver is RHS.exe.Check the event logs for any storage failures to identify the failing process.Try to update the component or process that is indicated in the event logs. You should see the following event recorded:
            Event ID: 4870
            Source: Microsoft-Windows-FailoverClustering
            Description: User mode health monitoring has detected that the system is not being responsive. The Failover cluster virtual adapter has lost contact with the Cluster Server process with a process ID ‘%1’, for ‘%2’ seconds. Recovery action will be taken. Review the Cluster logs to identify the process and investigate which items might cause the process to hang.
            For more information, see ["Why is my Failover Clustering node blue screening with a Stop 0x0000009E?"](https://blogs.technet.microsoft.com/askcore/2009/06/12/why-is-my-failover-clustering-node-blue-screening-with-a-stop-0x0000009e) Also, see the following Microsoft video [What to do if a 9E occurs](https://www.youtube.com/watch?v=vOJQEdmdSgw). +USER_MODE_HEALTH_MONITOR
            Stop error code 0x0000009E | This Stop error indicates that a user-mode health check failed in a way that prevents graceful shutdown. Therefore, Windows restores critical services by restarting or enabling application failover to other servers. The Clustering Service incorporates a detection mechanism that may detect unresponsiveness in user-mode components.
            This Stop error usually occurs in a clustered environment, and the indicated faulty driver is RHS.exe.Check the event logs for any storage failures to identify the failing process. Try to update the component or process that is indicated in the event logs. You should see the following event recorded:
            Event ID: 4870
            Source: Microsoft-Windows-FailoverClustering
            Description: User mode health monitoring has detected that the system is not being responsive. The Failover cluster virtual adapter has lost contact with the Cluster Server process with a process ID ‘%1’, for ‘%2’ seconds. Recovery action is taken. Review the Cluster logs to identify the process and investigate which items might cause the process to hang.
            For more information, see ["Why is my Failover Clustering node blue screening with a Stop 0x0000009E?"](https://blogs.technet.microsoft.com/askcore/2009/06/12/why-is-my-failover-clustering-node-blue-screening-with-a-stop-0x0000009e) Also, see the following Microsoft video [What to do if a 9E occurs](https://www.youtube.com/watch?v=vOJQEdmdSgw). ## Debugging examples ### Example 1 -This bugcheck is caused by a driver hang during upgrade, resulting in a bugcheck D1 in NDIS.sys (a Microsoft driver). The **IMAGE_NAME** will tell you the faulting driver, but since this is Microsoft driver it cannot be replaced or removed. The resolution method is to disable the network device in device manager and try the upgrade again. +This bugcheck is caused by a driver hang during upgrade, resulting in a bugcheck D1 in NDIS.sys (a Microsoft driver). The **IMAGE_NAME** tells you the faulting driver, but since this is Microsoft driver it cannot be replaced or removed. The resolution method is to disable the network device in device manager and try the upgrade again. ``` 2: kd> !analyze -v @@ -391,7 +393,7 @@ ANALYSIS_SESSION_ELAPSED_TIME: 8377 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:av_ndis!ndisqueueioworkitem FAILURE_ID_HASH: {10686423-afa1-4852-ad1b-9324ac44ac96} -FAILURE_ID_REPORT_LINK: http://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=10686423-afa1-4852-ad1b-9324ac44ac96 +FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=10686423-afa1-4852-ad1b-9324ac44ac96 Followup: ndiscore --------- ``` @@ -564,7 +566,7 @@ ANALYSIS_SESSION_ELAPSED_TIME: 162bd ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:av_r_invalid_wwanusbmp!unknown_function FAILURE_ID_HASH: {31e4d053-0758-e43a-06a7-55f69b072cb3} -FAILURE_ID_REPORT_LINK: http://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=31e4d053-0758-e43a-06a7-55f69b072cb3 +FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=31e4d053-0758-e43a-06a7-55f69b072cb3 Followup: MachineOwner --------- diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md index cff5317a5f..77e524634d 100644 --- a/windows/client-management/troubleshoot-tcpip-connectivity.md +++ b/windows/client-management/troubleshoot-tcpip-connectivity.md @@ -1,6 +1,6 @@ --- title: Troubleshoot TCP/IP connectivity -description: Learn how to troubleshoot TCP/IP connectivity. +description: Learn how to troubleshoot TCP/IP connectivity and what you should do if you come across TCP reset in a network capture. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting @@ -14,27 +14,33 @@ manager: dansimp # Troubleshoot TCP/IP connectivity -You might come across connectivity errors on the application end or timeout errors. Most common scenarios would include application connectivity to a database server, SQL timeout errors, BizTalk application timeout errors, Remote Desktop Protocol (RDP) failures, file share access failures, or general connectivity. +You might come across connectivity errors on the application end or timeout errors. The following are the most common scenarios: +- Application connectivity to a database server +- SQL timeout errors +- BizTalk application timeout errors +- Remote Desktop Protocol (RDP) failures +- File share access failures +- General connectivity -When you suspect that the issue is on the network, you collect a network trace. The network trace would then be filtered. During troubleshooting connectivity errors, you might come across TCP reset in a network capture which could indicate a network issue. +When you suspect that the issue is on the network, you collect a network trace. The network trace would then be filtered. During troubleshooting connectivity errors, you might come across TCP reset in a network capture that could indicate a network issue. -* TCP is defined as connection-oriented and reliable protocol. One of the ways in which TCP ensures this is through the handshake process. Establishing a TCP session would begin with a 3-way handshake, followed by data transfer, and then a 4-way closure. The 4-way closure where both sender and receiver agree on closing the session is termed as *graceful closure*. After the 4-way closure, the server will allow 4 minutes of time (default), during which any pending packets on the network are to be processed, this is the TIME_WAIT state. Once the TIME_WAIT state is done, all the resources allocated for this connection are released. +* TCP is defined as connection-oriented and reliable protocol. One of the ways in which TCP ensures reliability is through the handshake process. Establishing a TCP session would begin with a three-way handshake, followed by data transfer, and then a four-way closure. The four-way closure where both sender and receiver agree on closing the session is termed as *graceful closure*. After the 4-way closure, the server will allow 4 minutes of time (default), during which any pending packets on the network are to be processed, this is the TIME_WAIT state. After the TIME_WAIT state completes, all the resources allocated for this connection are released. -* TCP reset is an abrupt closure of the session which causes the resources allocated to the connection to be immediately released and all other information about the connection is erased. +* TCP reset is an abrupt closure of the session; it causes the resources allocated to the connection to be immediately released and all other information about the connection is erased. * TCP reset is identified by the RESET flag in the TCP header set to `1`. -A network trace on the source and the destination which will help you determine the flow of the traffic and see at what point the failure is observed. +A network trace on the source and the destination helps you to determine the flow of the traffic and see at what point the failure is observed. The following sections describe some of the scenarios when you will see a RESET. ## Packet drops -When one TCP peer is sending out TCP packets for which there is no response received from the other end, the TCP peer would end up re-transmitting the data and when there is no response received, it would end the session by sending an ACK RESET( meaning, application acknowledges whatever data exchanged so far, but due to packet drop closing the connection). +When one TCP peer is sending out TCP packets for which there is no response received from the other end, the TCP peer would end up retransmitting the data and when there is no response received, it would end the session by sending an ACK RESET (this means that the application acknowledges whatever data is exchanged so far, but because of packet drop, the connection is closed). The simultaneous network traces on source and destination will help you verify this behavior where on the source side you would see the packets being retransmitted and on the destination none of these packets are seen. This would mean, the network device between the source and destination is dropping the packets. -If the initial TCP handshake is failing because of packet drops then you would see that the TCP SYN packet is retransmitted only 3 times. +If the initial TCP handshake is failing because of packet drops, then you would see that the TCP SYN packet is retransmitted only three times. Source side connecting on port 445: @@ -44,7 +50,7 @@ Destination side: applying the same filter, you do not see any packets. ![Screenshot of frame summary with filter in Network Monitor](images/tcp-ts-7.png) -For the rest of the data, TCP will retransmit the packets 5 times. +For the rest of the data, TCP will retransmit the packets five times. **Source 192.168.1.62 side trace:** @@ -58,16 +64,16 @@ If you are seeing that the SYN packets are reaching the destination, but the des ## Incorrect parameter in the TCP header -You see this behavior when the packets are modified in the network by middle devices and TCP on the receiving end is unable to accept the packet, such as the sequence number being modified, or packets being re-played by middle device by changing the sequence number. Again, the simultaneous network trace on the source and destination will be able to tell you if any of the TCP headers are modified. Start by comparing the source trace and destination trace, you will be able to notice if there is a change in the packets itself or if any new packets are reaching the destination on behalf of the source. +You see this behavior when the packets are modified in the network by middle devices and TCP on the receiving end is unable to accept the packet, such as the sequence number being modified, or packets being replayed by middle device by changing the sequence number. Again, the simultaneous network trace on the source and destination will be able to tell you if any of the TCP headers are modified. Start by comparing the source trace and destination trace, you will be able to notice if there is a change in the packets itself or if any new packets are reaching the destination on behalf of the source. -In this case, you will again need help from the network team to identify any such device which is modifying packets or re-playing packets to the destination. The most common ones are RiverBed devices or WAN accelerators. +In this case, you'll again need help from the network team to identify any device that's modifying packets or replaying packets to the destination. The most common ones are RiverBed devices or WAN accelerators. ## Application side reset When you have identified that the resets are not due to retransmits or incorrect parameter or packets being modified with the help of network trace, then you have narrowed it down to application level reset. -The application resets are the ones where you see the Acknowledgement flag set to `1` along with the reset flag. This would mean that the server is acknowledging the receipt of the packet but for some reason it will not accept the connection. This is when the application that received the packet did not like something it received. +The application resets are the ones where you see the Acknowledgment flag set to `1` along with the reset flag. This would mean that the server is acknowledging the receipt of the packet but for some reason it will not accept the connection. This is when the application that received the packet did not like something it received. In the below screenshots, you see that the packets seen on the source and the destination are the same without any modification or any drops, but you see an explicit reset sent by the destination to the source. @@ -83,22 +89,22 @@ You also see an ACK+RST flag packet in a case when the TCP establishment packet ![Screenshot of packet flag](images/tcp-ts-11.png) -The application which is causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection. +The application that's causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection. >[!Note] >The above information is about resets from a TCP standpoint and not UDP. UDP is a connectionless protocol and the packets are sent unreliably. You would not see retransmission or resets when using UDP as a transport protocol. However, UDP makes use of ICMP as a error reporting protocol. When you have the UDP packet sent out on a port and the destination does not have port listed, you will see the destination sending out **ICMP Destination host unreachable: Port unreachable** message immediately after the UDP packet -```typescript +``` 10.10.10.1 10.10.10.2 UDP UDP:SrcPort=49875,DstPort=3343 10.10.10.2 10.10.10.1 ICMP ICMP:Destination Unreachable Message, Port Unreachable,10.10.10.2:3343 ``` -During the course of troubleshooting connectivity issue, you might also see in the network trace that a machine receives packets but does not respond to. In such cases, there could be a drop at the server level. You should enable firewall auditing on the machine to understand if the local firewall is dropping the packet. +During the course of troubleshooting connectivity issue, you might also see in the network trace that a machine receives packets but does not respond to. In such cases, there could be a drop at the server level. To understand whether the local firewall is dropping the packet, enable the firewall auditing on the machine. -```typescript +``` auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable ``` @@ -106,6 +112,6 @@ You can then review the Security event logs to see for a packet drop on a partic ![Screenshot of Event Properties](images/tcp-ts-12.png) -Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. Once you open this file and filter for the ID you find in the above event (2944008), you will be able to see a firewall rule name associated with this ID which is blocking the connection. +Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. After you open this file and filter for the ID that you find in the above event (2944008), you'll be able to see a firewall rule name that's associated with this ID that's blocking the connection. ![Screenshot of wfpstate.xml file](images/tcp-ts-13.png) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index 739c11d55d..ed2dc15ba1 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -16,7 +16,10 @@ manager: dansimp In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is a tool for capturing network traffic. -To get started, [download and run NM34_x64.exe](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image. +> [!NOTE] +> Network Monitor is the archived protocol analyzer and is no longer under development. **Microsoft Message Analyzer** is the replacement for Network Monitor. For more details, see [Microsoft Message Analyzer Operating Guide](https://docs.microsoft.com/message-analyzer/microsoft-message-analyzer-operating-guide). + +To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image: ![Adapters](images/nm-adapters.png) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index a33d808d2f..40c0ff98c2 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -1,6 +1,6 @@ --- title: Troubleshoot port exhaustion issues -description: Learn how to troubleshoot port exhaustion issues. +description: Learn how to troubleshoot port exhaustion issues. Port exhaustion occurs when all the ports on a machine are used. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index 7fd5ff086f..37b4dfa002 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -1,6 +1,6 @@ --- title: Troubleshoot Remote Procedure Call (RPC) errors -description: Learn how to troubleshoot Remote Procedure Call (RPC) errors +description: Learn how to troubleshoot Remote Procedure Call (RPC) errors when connecting to Windows Management Instrumentation (WMI), SQL Server, or during a remote connection. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-tcpip.md b/windows/client-management/troubleshoot-tcpip.md index b6a0283109..48a95cd4e0 100644 --- a/windows/client-management/troubleshoot-tcpip.md +++ b/windows/client-management/troubleshoot-tcpip.md @@ -1,6 +1,6 @@ --- title: Advanced troubleshooting for TCP/IP issues -description: Learn how to troubleshoot TCP/IP issues. +description: Learn how to troubleshoot common problems in a TCP/IP network environment, for example by collecting data using Network monitor. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index 664dc7700e..ee292cb2a6 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -2,7 +2,7 @@ title: Advanced troubleshooting for Windows-based computer freeze issues ms.reviewer: manager: dansimp -description: Learn how to troubleshoot computer freeze issues. +description: Learn how to troubleshoot computer freeze issues on Windows-based computers and servers. Also, you can learn how to diagnose, identify, and fix these issues. ms.prod: w10 ms.mktglfcycl: ms.sitesec: library @@ -251,7 +251,7 @@ If the physical computer is still running in a frozen state, follow these steps Pool Monitor shows you the number of allocations and outstanding bytes of allocation by type of pool and the tag that is passed into calls of ExAllocatePoolWithTag. -Learn [how to use Pool Monitor](https://support.microsoft.com/help/177415) and how to [use the data to troubleshoot pool leaks](http://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx). +Learn [how to use Memory Pool Monitor to troubleshoot kernel mode memory leaks](https://support.microsoft.com/office/how-to-use-memory-pool-monitor-poolmon-exe-to-troubleshoot-kernel-mode-memory-leaks-4f4a05c2-ef8a-fca4-3ae0-670b940af398). ### Use memory dump to collect data for the virtual machine that's running in a frozen state @@ -284,4 +284,4 @@ On Windows Server 2008, you may not have enough free disk space to generate a co Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](https://support.microsoft.com/help/969028). -For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](http://blogs.msdn.com/b/ntdebugging/archive/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump.aspx). +For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](https://blogs.msdn.com/b/ntdebugging/archive/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump.aspx). diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md index 1dcdb40a64..bd9f09bfd0 100644 --- a/windows/client-management/troubleshoot-windows-startup.md +++ b/windows/client-management/troubleshoot-windows-startup.md @@ -1,21 +1,55 @@ --- title: Advanced troubleshooting for Windows start-up issues -description: Learn how to troubleshoot Windows start-up issues. +description: Learn advanced options for how to troubleshoot common Windows start-up issues, like system crashes and freezes. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting author: dansimp ms.localizationpriority: medium ms.author: dansimp -ms.date: +ms.date: 2/3/2020 ms.reviewer: manager: dansimp --- # Advanced troubleshooting for Windows start-up issues -In these topics, you will learn how to troubleshoot common problems related to Windows start-up. +In these topics, you will learn how to troubleshoot common problems that are related to Windows startup. -- [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md) -- [Advanced troubleshooting for Stop error or blue screen error](troubleshoot-stop-errors.md) -- [Advanced troubleshooting for Windows-based computer freeze issues](troubleshoot-windows-freeze.md) +## How it works + +When Microsoft Windows experiences a condition that compromises safe system operation, the system halts. These Windows startup problems are categorized in the following groups: + +- Bug check: Also commonly known as a system crash, a kernel error, or a Stop error. + +- No boot: The system may not produce a bug check but is unable to start up into Windows. + +- Freeze: Also known as "system hang". + +## Best practices + +To understand the underlying cause of Windows startup problems, it's important that the system be configured correctly. Here are some best practices for configuration: + +### Page file settings + +- [Introduction of page file](introduction-page-file.md) + +- [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md) + +### Memory dump settings + +- [Configure system failure and recovery options in Windows](system-failure-recovery-options.md) + +- [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md) + +## Troubleshooting + +These articles will walk you through the resources you need to troubleshoot Windows startup issues: + +- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-boot-problems) + +- [Advanced troubleshooting for Stop error or blue screen error](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) + +- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze) + +- [Stop error occurs when you update the in-box Broadcom network adapter driver](troubleshoot-stop-error-on-broadcom-driver-update.md) diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index 9790bdb770..e8a8cb2a19 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -12,7 +12,7 @@ ms.sitesec: library ms.pagetype: mobile, devices, security ms.localizationpriority: medium author: dansimp -ms.date: 01/26/2019 +ms.date: ms.topic: article --- @@ -24,7 +24,7 @@ ms.topic: article This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. -Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution. +Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement, by using a comprehensive mobile device management solution. **In this article** - [Deploy](#deploy) @@ -36,8 +36,8 @@ Windows 10 supports end-to-end device lifecycle management to give companies con ## Deploy -Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which Mobile Device Management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. -Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or System Center Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). +Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which mobile device management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. +Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select the system that best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). ### Deployment scenarios @@ -47,7 +47,7 @@ The built-in MDM client is common to all editions of the Windows 10 operating s Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Microsoft Store for Business, or by using their MDM system, which can also work with the Microsoft Store for Business for public store apps. -Knowing who owns the device and what the employee will use it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. +Knowing who owns the device and what the employee uses it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. @@ -69,46 +69,47 @@ The way in which personal and corporate devices are enrolled into an MDM system - -Personal devices -Corporate devices + +Personal devices +Corporate devices -Ownership +Ownership Employee Organization Device Initialization -In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device. +In the out-of-box experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device. The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). -Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity. -Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset. +Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory (Azure AD) organizational identity. +Skipping the account setup in OOBE results in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device must be reset. Device Enrollment Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. -Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM). +Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+Azure AD+MDM). If your organization does not have Azure AD, the employee’s device is automatically enrolled into your organization’s MDM system (MSA+MDM). MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). -The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM). +The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (Azure AD+MDM). -**Recommendation:** Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (AAD+MDM) and personal devices (MSA+AAD+MDM). This requires Azure AD Premium. +Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (Azure AD+MDM) and personal devices (MSA+Azure AD+MDM). This requires Azure AD Premium. ### Identity management *Applies to: Corporate and personal devices* -Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities. +Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen determines who controls the device and influences your management capabilities. ->**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. +> [!NOTE] +> Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, and so on. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) provide access to these services. The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. @@ -133,13 +134,13 @@ The following table describes the impact of identity choice on device management Ease of enrollment -Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+AAD+MDM). -Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (AAD+MDM – requires Azure AD Premium). +Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+Azure AD+MDM). +Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (Azure AD+MDM – requires Azure AD Premium). Credential management Employees sign in to the device with Microsoft Account credentials. -Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account. +Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft Account. Employees sign in to the device with Azure AD credentials. IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. @@ -153,7 +154,7 @@ IT can block the addition of a personal identity, such as an MSA or Google Accou User settings and data roaming across multiple Windows devices User and app settings roam across all devices activated with the same personal identity through OneDrive. -If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD- joined device, this will not be the case. Microsoft is investigating Enterprise roaming for a future release. +If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD-joined device, this is not the case. Microsoft is investigating Enterprise roaming for a future release. Level of control @@ -174,24 +175,25 @@ IT can block the addition of a personal identity, such as an MSA or Google Accou ->**Note:** In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities will change in the future. +> [!NOTE] +> In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities may change in the future. ### Infrastructure choices *Applies to: Corporate and personal devices* -For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/library/mt627908.aspx). +For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD Premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/library/mt627908.aspx). **Azure Active Directory** Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. **Mobile Device Management** -Microsoft [Intune](https://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. -You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](https://technet.microsoft.com/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager. -Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. +Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Microsoft 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. +Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. ->**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. -In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx). +> [!NOTE] +> Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365. +In addition, Microsoft recently added MDM capabilities powered by Intune to Microsoft 365, called Basic Mobility and Security for Microsoft 365. Basic Mobility and Security for Microsoft 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. Basic Mobility and Security for Microsoft 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information, see [Overview of Basic Mobility and Security for Microsoft 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx). **Cloud services** On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect diagnostic and usage data. Windows 10 Mobile enables organizations to manage how devices consume these cloud services. @@ -211,19 +213,20 @@ The Microsoft Store for Business is the place where IT administrators can find, ## Configure -MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. What configuration settings you use will differ based on the deployment scenario, and corporate devices will offer IT the broadest range of control. +MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. The configuration settings you use depend on the deployment scenario, and corporate devices offer IT the broadest range of control. ->**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. +> [!NOTE] +> This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors. ### Account profile *Applies to: Corporate devices* -Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. +Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization reduces the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. - **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Microsoft Store, Xbox, or Groove. -- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts. +- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than a Microsoft Account. ### Email accounts @@ -231,7 +234,7 @@ Enforcing what accounts employees can use on a corporate device is important for Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies. -- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017(v=vs.85).aspx). +- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [Exchange ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017(v=vs.85).aspx). - **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile. ### Device Lock restrictions @@ -240,77 +243,80 @@ Email and associated calendar and contacts are the primary apps that users acces It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](https://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices. ->**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. -Companion devices must be paired with Windows 10 PC’s via Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires Pro or Enterprise edition on the Windows 10 PC being signed into. +> [!NOTE] +> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware-based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. +Companion devices must be paired with a Windows 10 PC using Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires the Pro or Enterprise edition of Windows 10. -Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply. +Most of the device lock restriction policies have been available through Exchange ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply: - **Device Password Enabled** Specifies whether users are required to use a device lock password. -- **Allow Simple Device Password** Whether users can use a simple password (e.g., 1111 or 1234). -- **Alphanumeric Device Password Required** Whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard. -- **Min Device Password Complex Characters** The number of password element types (i.e., uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. -- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.) +- **Allow Simple Device Password** Specifies whether users can use a simple password (for example, 1111 or 1234). +- **Alphanumeric Device Password Required** Specifies whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user can enter a numeric PIN on the keyboard. +- **Min Device Password Complex Characters** The number of password element types (uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. +- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history. (Users cannot reuse passwords in the history to create new passwords.) - **Min Device Password Length** The minimum number of characters required to create new passwords. - **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock. -- **Allow Idle Return Without Password** Whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. -- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.) -- **Screen Timeout While Locked** The number of minutes before the lock screen times out (this policy influences device power management). -- **Allow Screen Timeout While Locked User Configuration** Whether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting). +- **Allow Idle Return Without Password** Specifies whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. +- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped. (A value of zero disables device wipe functionality.) +- **Screen Timeout While Locked** The number of minutes before the lock screen times out. (This policy influences device power management.) +- **Allow Screen Timeout While Locked User Configuration** Specifies whether users can manually configure screen timeout while the device is on the lock screen. (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting.) Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario. -Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. +Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an Azure AD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. -You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information. +You may notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies are applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information. ### Prevent changing of settings *Applies to: Corporate devices* -Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change. +Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change, including: -- **Allow Your Account** Specifies whether users are able to change account configuration in the Your Email and Accounts panel in Settings -- **Allow VPN** Allows the user to change VPN settings -- **Allow Data Sense** Allows the user to change Data Sense settings -- **Allow Date Time** Allows the user to change data and time setting -- **Allow Edit Device Name** Allows users to change the device name -- **Allow Speech Model Update** Specifies whether the device will receive updates to the speech recognition and speech synthesis models (to improve accuracy and performance) +- **Allow Your Account** Specifies whether users are allowed to change account configuration in the **Your Email and Accounts** panel in Settings +- **Allow VPN** Specifies whether users are allowed to change VPN settings +- **Allow Data Sense** Specifies whether users are allowed to change Data Sense settings +- **Allow Date Time** Specifies whether users are allowed to change data and time setting +- **Allow Edit Device Name** Specifies whether users are allowed to change the device name +- **Allow Speech Model Update** Specifies whether the device receives updates to the speech recognition and speech synthesis models (to improve accuracy and performance) ### Hardware restrictions *Applies to: Corporate devices* -Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi Fi. You can use hardware restrictions to control the availability of these features. +Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can use hardware restrictions to control the availability of these features. -The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. +The following is a list of the MDM settings that Windows 10 Mobile supports to configure hardware restrictions: ->**Note:** Some of these hardware restrictions provide connectivity and assist in data protection. +> [!NOTE] +> Some of these hardware restrictions provide connectivity and assist in data protection. -- **Allow NFC:** Whether the NFC radio is enabled -- **Allow USB Connection:** Whether the USB connection is enabled (doesn’t affect USB charging) -- **Allow Bluetooth:** Whether users can enable and use the Bluetooth radio on their devices -- **Allow Bluetooth Advertising:** Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices -- **Allow Bluetooth Discoverable Mode:** Whether the device can discover other devices (e.g., headsets) -- **Allow Bluetooth pre-pairing** Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device +- **Allow NFC:** Specifies whether the NFC radio is enabled +- **Allow USB Connection:** Specifies whether the USB connection is enabled (doesn’t affect USB charging) +- **Allow Bluetooth:** Specifies whether users can enable and use the Bluetooth radio on their devices +- **Allow Bluetooth Advertising:** Specifies whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices +- **Allow Bluetooth Discoverable Mode:** Specifies whether the device can discover other devices (such as headsets) +- **Allow Bluetooth pre-pairing** Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device - **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect - **Set Bluetooth Local Device Name:** The local Bluetooth device name -- **Allow Camera:** Whether the camera is enabled -- **Allow Storage Card:** Whether the storage card slot is enabled -- **Allow Voice Recording:** Whether the user can use the microphone to create voice recordings -- **Allow Location:** Whether the device can use the GPS sensor or other methods to determine location so applications can use location information +- **Allow Camera:** Specifies whether the camera is enabled +- **Allow Storage Card:** Specifies whether the storage card slot is enabled +- **Allow Voice Recording:** Specifies whether the user can use the microphone to create voice recordings +- **Allow Location:** Specifies whether the device can use the GPS sensor or other methods to determine location so applications can use location information ### Certificates *Applies to: Personal and corporate devices* -Certificates help improve security by providing account authentication, Wi Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. -To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes. -Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. +Certificates help improve security by providing account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. +To install certificates manually, you can post them on Microsoft Edge website or send them directly by using email, which is ideal for testing purposes. +Using Simple Certificate Enrollment Protocol (SCEP) and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device, as long as the MDM system supports the SCEP or Personal Information Exchange (PFX). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings. -Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile). -Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. +For more detailed information about MDM certificate management, see [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile). +Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidentally. -> **Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: +> [!NOTE] +> To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: > - View a summary of all personal certificates > - View the details of individual certificates > - View the certificates used for VPN, Wi-Fi, and email authentication @@ -322,11 +328,11 @@ Use the Allow Manual Root Certificate Installation setting to prevent users from *Applies to: Corporate and personal devices* -Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. -You can create multiple Wi-Fi profiles in your MDM system. The below table lists the Windows 10 Mobile Wi Fi connection profile settings that can be configured by administrators. +Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. +You can create multiple Wi-Fi profiles in your MDM system. The Windows 10 Mobile Wi-Fi connection profile settings that can be configured by administrators include: -- **SSID** The case-sensitive name of the Wi Fi network Service Set Identifier -- **Security type** The type of security the Wi Fi network uses; can be one of the following authentication types: +- **SSID** The case-sensitive name of the Wi-Fi network Service Set Identifier +- **Security type** The type of security the Wi-Fi network uses; can be one of the following authentication types: - Open 802.11 - Shared 802.11 - WPA-Enterprise 802.11 @@ -341,19 +347,19 @@ You can create multiple Wi-Fi profiles in your MDM system. The below table lists - **Extensible Authentication Protocol Transport Layer Security (EAP-TLS)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication - **Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication - **Shared key** WPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication. -- **Proxy** The configuration of any network proxy that the Wi Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) -- **Disable Internet connectivity checks** Whether the Wi Fi connection should check for Internet connectivity +- **Proxy** The configuration of any network proxy that the Wi-Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) +- **Disable Internet connectivity checks** Whether the Wi-Fi connection should check for Internet connectivity - **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file - **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled -In addition, you can set a few device wide Wi-Fi settings. -- **Allow Auto Connect to Wi Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks -- **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings -- **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled -- **Allow Internet Sharing** Allow or disallow Internet sharing -- **WLAN Scan Mode** How actively the device scans for Wi-Fi networks +In addition, you can set the following device wide Wi-Fi settings: +- **Allow Auto Connect to Wi-Fi Sense Hotspots** Specifies whether the device automatically detects and connects to Wi-Fi networks +- **Allow Manual Wi-Fi Configuration** Specifies whether the user can manually configure Wi-Fi settings +- **Allow Wi-Fi** Specifies whether the Wi-Fi hardware is enabled +- **Allow Internet Sharing** Allows or disallows Internet sharing +- **WLAN Scan Mode** Specifies how actively the device scans for Wi-Fi networks -Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx). +For more detailed information about Wi-Fi connection profile settings, see [Wi-Fi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx). ### APN profiles @@ -361,7 +367,7 @@ Get more detailed information about Wi-Fi connection profile settings in the [Wi An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. -You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles. +You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles: - **APN name** The APN name - *IP connection type* The IP connection type; set to one of the following values: @@ -369,7 +375,7 @@ You can define and deploy APN profiles in MDM systems that configure cellular da - IPv6 only - IPv4 and IPv6 concurrently - IPv6 with IPv4 provided by 46xlat -- **LTE attached** Whether the APN should be attached as part of an LTE Attach +- **LTE attached** Specifies whether the APN should be attached as part of an LTE Attach - **APN class ID** The globally unique identifier that defines the APN class to the modem - **APN authentication type** The APN authentication type; set to one of the following values: - None @@ -380,22 +386,22 @@ You can define and deploy APN profiles in MDM systems that configure cellular da - **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type - **Password** The password for the user account specified in User name - **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile -- **Always on** Whether the connection manager will automatically attempt to connect to the APN whenever it is available +- **Always on** Specifies whether the connection manager automatically attempts to connect to the APN when it is available - **Connection enabled** Specifies whether the APN connection is enabled - **Allow user control** Allows users to connect with other APNs than the enterprise APN -- **Hide view** Whether the cellular UX will allow the user to view enterprise APNs +- **Hide view** Specifies whether the cellular UX allows the user to view enterprise APNs -Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617(v=vs.85).aspx). +For more detailed information about APN settings, see [APN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617(v=vs.85).aspx). ### Proxy *Applies to: Corporate devices* -The below lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity. +The following lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity: - **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection) -- **Bypass Local** Specifies if the proxy should be bypassed when local hosts are accessed by the device -- **Enable** Specifies if the proxy is enabled +- **Bypass Local** Specifies whether the proxy should be bypassed when local hosts are accessed by the device +- **Enable** Specifies whether the proxy is enabled - **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed - **User Name** Specifies the username used to connect to the proxy - **Password** Specifies the password used to connect to the proxy @@ -409,15 +415,15 @@ For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.micro *Applies to: Corporate and personal devices* -Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management). +Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management). You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile. To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings: - **VPN Servers** The VPN server for the VPN profile - **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values: - - Split tunnel. Only network traffic destined to the intranet goes through the VPN connection - - Force tunnel. All traffic goes through the VPN connection + - Split tunnel: Only network traffic destined to the intranet goes through the VPN connection + - Force tunnel: All traffic goes through the VPN connection - **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic - **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections) - **Machine certificate** The machine certificate used for IKEv2-based VPN connections @@ -425,24 +431,25 @@ To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such a - **L2tpPsk** The pre-shared key used for an L2TP connection - **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling ->**Note:** The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard will walk you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. +> [!NOTE] +> The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard walks you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. Microsoft Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: - **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address -- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (e.g., authentication information) that the plugin provider requires +- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (such as authentication information) that the plugin provider requires - **Microsoft Store VPN plugin family name** Specifies the Microsoft Store package family name for the Microsoft Store–based VPN plugin -In addition, you can specify per VPN Profile: +In addition, you can specify per VPN profile: -- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list will automatically trigger the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list automatically triggers the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. - **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface. - **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile. - **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. - **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List. - **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings. - **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it. -- **Remember credentials** Whether the VPN connection caches credentials. +- **Remember credentials** Specifies whether the VPN connection caches credentials. - **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi). - **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy. - **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance. @@ -453,12 +460,12 @@ In addition, you can specify per VPN Profile: - No other VPN profiles can be connected or modified. - **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require. -For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776(v=vs.85).aspx) +For more details about VPN profiles, see [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776(v=vs.85).aspx). -Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges. -- **Allow VPN** Whether users can change VPN settings -- **Allow VPN Over Cellular** Whether users can establish VPN connections over cellular networks -- **Allow VPN Over Cellular when Roaming** Whether users can establish VPN connections over cellular networks when roaming +Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges: +- **Allow VPN** Specifies whether users can change VPN settings +- **Allow VPN Over Cellular** Specifies whether users can establish VPN connections over cellular networks +- **Allow VPN Over Cellular when Roaming** Specifies whether users can establish VPN connections over cellular networks when roaming ### Storage management @@ -472,16 +479,16 @@ The SD card is uniquely paired with a device. No other devices can see the apps You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards. -Here is a list of MDM storage management settings that Windows 10 Mobile provides. +Here is a list of MDM storage management settings that Windows 10 Mobile provides: -- **Allow Storage Card** Whether the use of storage cards for data storage is allowed -- **Require Device Encryption** Whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) +- **Allow Storage Card** Specifies whether the use of storage cards for data storage is allowed +- **Require Device Encryption** Specifies whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) - **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values: - AES-Cipher Block Chaining (CBC) 128-bit - AES-CBC 256-bit - XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default) - XTS-AES-256-bit -- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Whether the device allows or disallows the FIPS algorithm policy +- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Specifies whether the device allows or disallows the FIPS algorithm policy - **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections - **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive - **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive @@ -514,11 +521,11 @@ Azure AD authenticated managers have access to Microsoft Store for Business func Microsoft Store for Business supports app distribution under two licensing models: online and offline. The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps. -Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. +Corporate device users can find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system App Catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps. -Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device. +Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it's automatically installed from the cloud. Also, apps are automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device. To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method. @@ -526,7 +533,7 @@ To install acquired Microsoft Store or LOB apps offline on a Windows 10 Mobile d Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. -Learn more about the [Microsoft Store for Business](/microsoft-store/index). +For more information, see [Microsoft Store for Business](/microsoft-store/index). ### Managing apps @@ -534,25 +541,25 @@ Learn more about the [Microsoft Store for Business](/microsoft-store/index). IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date. -Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store. +Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store. -For more details, see [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx). +For more information, see [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx). -In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM. +In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM: -- **Allow All Trusted Apps** Whether users can sideload apps on the device. -- **Allow App Store Auto Update** Whether automatic updates of apps from Microsoft Store are allowed. -- **Allow Developer Unlock** Whether developer unlock is allowed. -- **Allow Shared User App Data** Whether multiple users of the same app can share data. -- **Allow Store** Whether Microsoft Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system. +- **Allow All Trusted Apps** Specifies whether users can sideload apps on the device. +- **Allow App Store Auto Update** Specifies whether automatic updates of apps from Microsoft Store are allowed. +- **Allow Developer Unlock** Specifies whether developer unlock is allowed. +- **Allow Shared User App Data** Specifies whether multiple users of the same app can share data. +- **Allow Store** Specifies whether Microsoft Store app is allowed to run. This completely blocks the user from installing apps from the Store, but still allows app distribution through an MDM system. - **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above. - **Disable Store Originated Apps** Disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded before the policy was applied. -- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. -- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card. -- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card. -- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/library/windows/hardware/mt171093(v=vs.85).aspx) for more information). +- **Require Private Store Only** Specifies whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. +- **Restrict App Data to System Volume** Specifies whether app data is allowed only on the system drive or can be stored on an SD card. +- **Restrict App to System Volume** Specifies whether app installation is allowed only to the system drive or can be installed on an SD card. +- **Start screen layout** An XML blob used to configure the Start screen (for more information, see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/library/windows/hardware/mt171093(v=vs.85).aspx)). -Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps) +Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps). ### Data leak prevention @@ -562,7 +569,7 @@ One of the biggest challenges in protecting corporate information on mobile devi Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email. -Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default. +Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data is encrypted at all times and any attempt to copy/paste or share this information with non-corporate apps or users fails. Unenlightened apps consider all data corporate and encrypt everything by default. Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including: - Microsoft Edge @@ -582,19 +589,19 @@ The following table lists the settings that can be configured for Windows Inform - Override mode (encrypt, prompt, and audit) - Block mode (encrypt, block, and audit) - **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. -- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience. +- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user is not able to remove protection from enterprise content through the OS or app user experience. - **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured. - **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. -- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service. +- **Revoke on unenroll** Specifies whether to revoke the information protection keys when a device unenrolls from the management service. - **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long. - **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection. -- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the Start menu. +- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the **Start** menu. - **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection. -- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. -- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. +- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers is considered part of the enterprise and protected. +- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device is considered enterprise data and is protected. - **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected. ->**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it. +* Mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings (specifically Enterprise IP Range and Enterprise Network Domain Names) must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key so that others in the company can access it. For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). @@ -602,18 +609,18 @@ For more information on Windows Information Protection, see the [EnterpriseDataP *Applies to: Corporate devices* -On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks. +On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks: -- **Allow copy and paste** Whether users can copy and paste content -- **Allow Cortana** Whether users can use Cortana on the device (where available) -- **Allow device discovery** Whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) -- **Allow input personalization** Whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) -- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) -- **Allow screen capture** Whether users are allowed to capture screenshots on the device +- **Allow copy and paste** Specifies whether users can copy and paste content +- **Allow Cortana** Specifies whether users can use Cortana on the device (where available) +- **Allow device discovery** Specifies whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) +- **Allow input personalization** Specifies whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) +- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow screen capture** Specifies whether users are allowed to capture screenshots on the device - **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed -- **Allow sync my settings** Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) -- **Allow toasts notifications above lock screen** Whether users are able to view toast notification on the device lock screen -- **Allow voice recording** Whether users are allowed to perform voice recordings +- **Allow sync my settings** Specifies whether the user experience settings are synchronized between devices (works with Microsoft accounts only) +- **Allow toasts notifications above lock screen** Specifies whether users are able to view toast notification on the device lock screen +- **Allow voice recording** Specifies whether users are allowed to perform voice recordings - **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft - **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher - **Enable Offline Maps Auto Update** Disables the automatic download and update of map data @@ -627,19 +634,19 @@ You can find more details on the experience settings in Policy CSP. MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection. -The following settings for Microsoft Edge on Windows 10 Mobile can be managed. +The following settings for Microsoft Edge on Windows 10 Mobile can be managed: -- **Allow Browser** Whether users can run Microsoft Edge on the device -- **Allow Do Not Track headers** Whether Do Not Track headers are allowed -- **Allow InPrivate** Whether users can use InPrivate browsing -- **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally -- **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar -- **Allow SmartScreen** Whether SmartScreen Filter is enabled -- **Cookies** Whether cookies are allowed +- **Allow Browser** Specifies whether users can run Microsoft Edge on the device +- **Allow Do Not Track headers** Specifies whether Do Not Track headers are allowed +- **Allow InPrivate** Specifies whether users can use InPrivate browsing +- **Allow Password Manager** Specifies whether users can use Password Manager to save and manage passwords locally +- **Allow Search Suggestions in Address Bar** Specifies whether search suggestions are shown in the address bar +- **Allow Windows Defender SmartScreen** Specifies whether Windows Defender SmartScreen is enabled +- **Cookies** Specifies whether cookies are allowed - **Favorites** Configure Favorite URLs - **First Run URL** The URL to open when a user launches Microsoft Edge for the first time -- **Prevent SmartScreen Prompt Override** Whether users can override the SmartScreen warnings for URLs -- **Prevent Smart Screen Prompt Override for Files** Whether users can override the SmartScreen warnings for files +- **Prevent Windows Defender SmartScreen Prompt Override** Specifies whether users can override the Windows Defender SmartScreen warnings for URLs +- **Prevent Smart Screen Prompt Override for Files** Specifies whether users can override the Windows Defender SmartScreen warnings for files ## Manage @@ -647,7 +654,7 @@ In enterprise IT environments, the need for security and cost control must be ba ### Servicing options -**A streamlined update process** +#### A streamlined update process *Applies to: Corporate and personal devices* @@ -683,11 +690,11 @@ Microsoft has streamlined the Windows product engineering and release cycle so n -Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. +Microsoft also delivers and installs monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. -Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates. +Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process apply to both feature and quality updates. -Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary. +Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device uses Auto Scan to search for available updates. However, depending on the device’s network and power status, update methods and timing may vary. @@ -718,8 +725,8 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au - - + + @@ -734,22 +741,22 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au
            Cellular Device is only connected to a cellular network (standard data charges apply)Will skip a daily scan if scan was successfully completed in the last 5 daysWill only occur if update package is small and does not exceed the mobile operator data limit.Skips a daily scan if scan was successfully completed in the last 5 daysOnly occurs if update package is small and does not exceed the mobile operator data limit. Yes Idem
            -**Keeping track of updates releases** +#### Keeping track of updates releases *Applies to: Corporate and Personal devices* Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](https://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about. ->**Note:** -We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub +> [!NOTE] +> We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback by using the Feedback Hub. -**Windows as a Service** +#### Windows as a Service *Applies to: Corporate and Personal devices* Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure. -Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below: +Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the following chart. @@ -791,7 +798,7 @@ Update availability depends on what servicing option you choose for the device.
            -**Enterprise Edition** +#### Enterprise edition *Applies to: Corporate devices* @@ -806,11 +813,12 @@ To learn more about diagnostic, see [Configure Windows diagnostic data in your o To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required. -Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/library/windows/hardware/dn904983(v=vs.85).aspx) +For more information on updating a device to Enterprise edition, see [WindowsLicensing CSP](https://msdn.microsoft.com/library/windows/hardware/dn904983(v=vs.85).aspx). ->**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. +> [!NOTE] +> We recommend using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. -**Deferring and Approving Updates with MDM** +#### Deferring and approving updates with MDM *Applies to: Corporate devices with Enterprise edition* @@ -846,11 +854,11 @@ The following table summarizes applicable update policy settings by version of W Subscribe device to CBB, to defer Feature Updates RequireDeferUpgrade -Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). Defers feature update for minimum of 4 months after Current Branch was release. BranchReadinessLevel -Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). Defers feature update for minimum of 4 months after Current Branch was release. Defer Updates @@ -881,7 +889,7 @@ Pause Feature Updates for up to 35 days -**Managing the Update Experience** +#### Managing the update experience *Applies to: Corporate devices with Enterprise edition* @@ -893,33 +901,33 @@ This can include: - Automatically downloading and restarting devices with user notification. - Automatically downloading and restarting devices at a specified time. - Automatically downloading and restarting devices without user interaction. -- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates. +- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device does not receive any updates. -In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.). +In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, and so on) or on a specific [day of the week](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, and so on). -**Managing the source of updates with MDM** +#### Managing the source of updates with MDM *Applies to: Corporate devices with Enterprise edition* Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system. -Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). +For more information, see [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). -IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS. +IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS). -**Managing Updates with Windows Update Server** +#### Managing Updates with Windows Update Server *Applies to: Corporate devices with Enterprise edition* When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices. -Learn more about [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx) +For more information, see [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx). -**Querying the device update status** +#### Querying the device update status *Applies to: Personal and corporate devices* -In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates. +In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates: The device update status query provides an overview of: - Installed updates: A list of updates that are installed on the device. @@ -937,7 +945,7 @@ Device Health Attestation (DHA) is another line of defense that is new to Window Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN. -The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. +The first version of DHA was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, DHA capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that: - Run Windows 10 operating system (mobile phone or PC) @@ -954,26 +962,27 @@ DHA-enabled device management solutions help IT managers create a unified securi - Trigger further investigation and monitoring (route the device to a honeypot for further monitoring) - Simply alert the user or the admin to fix the issue ->**Note:** Windows Device Health Attestation Service can be used for conditional access scenarios which may be enabled by Mobile Device Management solutions (e.g.: Microsoft Intune) and other types of management systems (e.g.: SCCM) purchased separately. +> [!NOTE] +> Windows Device Health Attestation Service can be used for conditional access scenarios that may be enabled by Mobile Device Management solutions (such as Microsoft Intune) and other types of management systems (such as SCCM) purchased separately. For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide). -Thisis a lists of attributes that are supported by DHA and can trigger the corrective actions mentioned above. +This is a list of attributes that are supported by DHA and can trigger the corrective actions mentioned above: - **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK). -- **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. +- **Data Execution Prevention (DEP) enabled** Specifies whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. - **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. -- **Secure Boot enabled** Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. -- **Code integrity enabled** Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. -- **Safe mode** Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. -- **Boot debug enabled** Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. -- **OS kernel debugging enabled** Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. -- **Test signing enabled** Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. +- **Secure Boot enabled** Specifies whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. +- **Code integrity enabled** Specifies whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. +- **Safe mode** Specifies whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. +- **Boot debug enabled** Specifies whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. +- **OS kernel debugging enabled** Specifies whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. +- **Test signing enabled** Specifies whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. - **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). - **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). -- **Secure Boot Configuration Policy (SBCP) present** Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. -- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. +- **Secure Boot Configuration Policy (SBCP) present** Specifies whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. +- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published allow list. A device that complies with the allow list is more trustworthy (secure) than a device that is noncompliant. -**Example scenario** +#### Example scenario Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. @@ -989,9 +998,9 @@ Here is what occurs when a smartphone is turned on: *Applies to: Corporate devices with Enterprise edition* -Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (e.g., installed updates). +Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (such as installed updates). -The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. +The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide: - **Installed enterprise apps** List of the enterprise apps installed on the device - **Device name** The device name configured for the device @@ -1005,7 +1014,7 @@ The following list shows examples of the Windows 10 Mobile software and hardware - **Device language** Language in use on the device - **Phone number** Phone number assigned to the device - **Roaming status** Indicates whether the device has a roaming cellular connection -- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user +- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI)** Unique identifiers for the cellular connection for the phone (Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user) - **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device - **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device - **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device @@ -1022,14 +1031,15 @@ You can control the level of data that diagnostic data systems collect. To confi For more information, see [Configure Windows diagnostic data in Your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization). ->**Note:** Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. +> [!NOTE] +> Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. ### Remote assistance *Applies to: Personal and corporate devices* The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: -- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (e.g., leaving the device at a customer site). +- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (such as leaving the device at a customer site). - **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices. - **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. - **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device. @@ -1041,7 +1051,8 @@ The remote assistance features in Windows 10 Mobile help resolve issues that use These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. ->**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store. +> [!NOTE] +> Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store. ## Retire @@ -1051,19 +1062,20 @@ Device retirement is the last phase of the device lifecycle, which in today’s Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected. ->**Note:** All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. +> [!NOTE] +> All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. **Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world. If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data. -A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system. +A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data is tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles are immediately removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and is reported to the MDM system. -**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. +**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that also makes the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. **Settings for personal or corporate device retirement** -- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) -- **Allow user to reset phone** Whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults +- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (unenroll the device from the MDM system) +- **Allow user to reset phone** Specifies whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults ## Related topics diff --git a/windows/client-management/windows-10-support-solutions.md b/windows/client-management/windows-10-support-solutions.md index 7d787f544d..9274477150 100644 --- a/windows/client-management/windows-10-support-solutions.md +++ b/windows/client-management/windows-10-support-solutions.md @@ -1,99 +1,134 @@ --- -title: Top support solutions for Windows 10 -ms.reviewer: +title: Troubleshooting Windows 10 +description: Learn where to find information about troubleshooting Windows 10 issues, for example Bitlocker issues and bugcheck errors. +ms.reviewer: kaushika manager: dansimp -description: Get links to solutions for Windows 10 issues ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.author: dansimp -author: dansimp +ms.author: kaushika +author: kaushika-msft ms.localizationpriority: medium ms.topic: troubleshooting --- -# Troubleshoot Windows 10 clients +# Troubleshoot Windows 10 client -This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 clients. Additional topics will be added as they become available. +Microsoft regularly releases both updates for Windows Server. To ensure your servers can receive future updates, including security updates, it's important to keep your servers updated. Check out - [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/en-us/help/4000825/windows-10-windows-server-2016-update-history) for a complete list of released updates. -## Troubleshooting support topics +This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 in an enterprise or IT pro environment. Additional topics will be added as they become available. -- [Advanced troubleshooting for Windows networking](troubleshoot-networking.md)
            - - [Advanced troubleshooting wireless network connectivity](advanced-troubleshooting-wireless-network-connectivity.md)
            - - [Advanced troubleshooting 802.1X authentication](advanced-troubleshooting-802-authentication.md)
            - - [Data collection for troubleshooting 802.1X authentication](data-collection-for-802-authentication.md)
            - - [Advanced troubleshooting for TCP/IP](troubleshoot-tcpip.md)
            - - [Collect data using Network Monitor](troubleshoot-tcpip-netmon.md)
            - - [Troubleshoot TCP/IP connectivity](troubleshoot-tcpip-connectivity.md)
            - - [Troubleshoot port exhaustion](troubleshoot-tcpip-port-exhaust.md)
            - - [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md)
            -- [Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md)
            - - [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
            - - [Advanced troubleshooting for Windows-based computer issues](troubleshoot-windows-freeze.md)
            - - [Advanced troubleshooting for stop errors or blue screen errors](troubleshoot-stop-errors.md)
            - - [Advanced troubleshooting for stop error 7B or Inaccessible_Boot_Device](troubleshoot-inaccessible-boot-device.md)
            +## Troubleshoot 802.1x Authentication +- [Advanced Troubleshooting 802.1X Authentication](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-802-authentication) +- [Data collection for troubleshooting 802.1X authentication](https://docs.microsoft.com/windows/client-management/data-collection-for-802-authentication) -## Windows 10 update history +## Troubleshoot BitLocker +- [Guidelines for troubleshooting BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/troubleshoot-bitlocker) +- [BitLocker cannot encrypt a drive: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues) +- [Enforcing BitLocker policies by using Intune: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues) +- [BitLocker Network Unlock: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues) +- [BitLocker recovery: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues) +- [BitLocker configuration: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues) +- [BitLocker cannot encrypt a drive: known TPM issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues) +- [BitLocker and TPM: other known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues) +- [Decode Measured Boot logs to track PCR changes](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs) +- [BitLocker frequently asked questions (FAQ)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions) -Microsoft regularly releases both updates and solutions for Windows 10. To ensure your computers can receive future updates, including security updates, it's important to keep them updated. Check out the following links for a complete list of released updates: +## Troubleshoot Bugcheck and Stop errors +- [Introduction to the page file](https://docs.microsoft.com/windows/client-management/introduction-page-file) +- [How to determine the appropriate page file size for 64-bit versions of Windows](https://docs.microsoft.com/windows/client-management/determine-appropriate-page-file-size) +- [Configure system failure and recovery options in Windows](https://docs.microsoft.com/windows/client-management/system-failure-recovery-options) +- [Generate a kernel or complete crash dump](https://docs.microsoft.com/windows/client-management/generate-kernel-or-complete-crash-dump) +- [Advanced troubleshooting for Stop error or blue screen error issue](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) +- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) +- [Blue Screen Data - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/blue-screen-data) +- [Bug Check Code Reference - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2) -- [Windows 10 version 1809 update history](https://support.microsoft.com/help/4464619) -- [Windows 10 version 1803 update history](https://support.microsoft.com/help/4099479) -- [Windows 10 version 1709 update history](https://support.microsoft.com/help/4043454) -- [Windows 10 Version 1703 update history](https://support.microsoft.com/help/4018124) -- [Windows 10 Version 1607 update history](https://support.microsoft.com/help/4000825) -- [Windows 10 Version 1511 update history](https://support.microsoft.com/help/4000824) +## Troubleshoot Credential Guard +- [Windows Defender Credential Guard - Known issues (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues) + +## Troubleshoot Disks +- [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) +- [Windows and GPT FAQ](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-and-gpt-faq) + +## Troubleshoot Kiosk mode +- [Troubleshoot kiosk mode issues](https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot) + +## Troubleshoot No Boot +- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-boot-problems) + +## Troubleshoot Push Button Reset +- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-faq) +- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-validation) +- [Recovery components](https://docs.microsoft.com/windows-hardware/manufacture/desktop/recovery-strategy-for-common-customizations) + +### Troubleshoot Power Management +- [Modern Standby FAQs](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-faqs) -These are the top Microsoft Support solutions for the most common issues experienced when using Windows 10 in an enterprise or IT pro environment. The links below include links to KB articles, updates, and library articles. +## Troubleshoot Secure Boot +- [Secure Boot isn't configured correctly: troubleshooting](https://docs.microsoft.com/windows-hardware/manufacture/desktop/secure-boot-isnt-configured-correctly-troubleshooting) -## Solutions related to installing Windows Updates -- [How does Windows Update work](https://docs.microsoft.com/windows/deployment/update/how-windows-update-works) +## Troubleshoot Setup and Install +- [Deployment Troubleshooting and Log Files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files) + + +## Troubleshoot Start Menu +- [Troubleshoot Start menu errors](https://docs.microsoft.com/windows/configuration/start-layout-troubleshoot) + + +## Troubleshoot Subscription Activation +- [Deploy Windows 10 Enterprise licenses](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses) + +## Troubleshoot System Hang +- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze) + +## Troubleshoot TCP/IP Communication +- [Collect data using Network Monitor](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-netmon) +- [Troubleshoot TCP/IP connectivity](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-connectivity) +- [Troubleshoot port exhaustion issues](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-port-exhaust) +- [Troubleshoot Remote Procedure Call (RPC) errors](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-rpc-errors) + +## Troubleshoot User State Migration Toolkit (USMT) +- [Common Issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues) +- [Frequently Asked Questions](https://docs.microsoft.com/windows/deployment/usmt/usmt-faq) +- [Log Files](https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files) +- [Return Codes](https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes) + +## Troubleshoot Windows Hello for Business (WHFB) +- [Windows Hello for Business Frequently Asked Questions](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-faq) +- [Windows Hello errors during PIN creation (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation) +- [Event ID 300 - Windows Hello successfully created (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300) + + +## Troubleshoot Windows Analytics +- [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-faq-troubleshooting) + +## Troubleshoot Windows Update +- [How Windows Update works](https://docs.microsoft.com/windows/deployment/update/how-windows-update-works) - [Windows Update log files](https://docs.microsoft.com/windows/deployment/update/windows-update-logs) - [Windows Update troubleshooting](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting) - [Windows Update common errors and mitigation](https://docs.microsoft.com/windows/deployment/update/windows-update-errors) -- [Windows Update - additional resources](https://docs.microsoft.com/windows/deployment/update/windows-update-resources) +- [Windows Update - Additional resources](https://docs.microsoft.com/windows/deployment/update/windows-update-resources) +- [Get started with Windows Update](https://docs.microsoft.com/windows/deployment/update/windows-update-overview) +- [Servicing stack updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates) -## Solutions related to installing or upgrading Windows +## Troubleshoot Windows Upgrade +- [Quick fixes - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/quick-fixes) +- [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) +- [Troubleshoot Windows 10 upgrade errors - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-errors) +- [Windows error reporting - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/windows-error-reporting) +- [Upgrade error codes - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-codes) +- [Log files - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/log-files) +- [Resolution procedures - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/resolution-procedures) -- [Quick Fixes](https://docs.microsoft.com/windows/deployment/upgrade/quick-fixes) -- [Troubleshooting upgrade errors](https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-errors) -- [Resolution procedures](https://docs.microsoft.com/windows/deployment/upgrade/resolution-procedures) -- [0xc1800118 error when you push Windows 10 Version 1607 by using WSUS](https://support.microsoft.com/en-in/help/3194588/0xc1800118-error-when-you-push-windows-10-version-1607-by-using-wsus) -- [0xC1900101 error when Windows 10 upgrade fails after the second system restart](https://support.microsoft.com/en-in/help/3208485/0xc1900101-error-when-windows-10-upgrade-fails-after-the-second-system) +## Troubleshoot Windows Recovery (WinRE) +- [Windows RE troubleshooting features](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-re-troubleshooting-features) -## Solutions related to BitLocker +## Troubleshoot Wireless Connection +- [Advanced Troubleshooting Wireless Network Connectivity](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-wireless-network-connectivity) -- [BitLocker recovery guide](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan) -- [BitLocker: How to enable Network Unlock](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock) -- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker) -- [BitLocker Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings) +## Other Resources -## Solutions related to Bugchecks or Stop Errors -- [Troubleshooting Stop error problems for IT Pros](https://support.microsoft.com/help/3106831/troubleshooting-stop-error-problems-for-it-pros) -- [How to use Windows Recovery Environment (WinRE) to troubleshoot common startup issues](https://support.microsoft.com/help/4026030/how-to-use-windows-recovery-environment-winre-to-troubleshoot-common-s) -- [How to troubleshoot Windows-based computer freeze issues](https://support.microsoft.com/help/3118553/how-to-troubleshoot-windows-based-computer-freeze-issues) -- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](https://support.microsoft.com/help/4133658) - - -## Solutions related to Windows Boot issues -- [Troubleshooting Windows boot problems for IT Pros](https://support.microsoft.com/help/4343769) -- [How to use Windows Recovery Environment (WinRE) to troubleshoot common startup issues](https://support.microsoft.com/help/4026030/how-to-use-windows-recovery-environment-winre-to-troubleshoot-common-s) - - -## Solutions related to configuring or managing the Start menu -- [Manage Windows 10 Start and taskbar layout](/windows/configuration/windows-10-start-layout-options-and-policies) -- [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout) -- [Changes to Group Policy settings for Windows 10 Start](/windows/configuration/changes-to-start-policies-in-windows-10) -- [Preinstalled system applications and Start menu may not work when you upgrade to Windows 10, Version 1511](https://support.microsoft.com/help/3152599) -- [Start menu shortcuts aren't immediately accessible in Windows Server 2016](https://support.microsoft.com/help/3198613) -- [Troubleshoot problems opening the Start menu or Cortana](https://support.microsoft.com/help/12385/windows-10-troubleshoot-problems-opening-start-menu-cortana) -- [Modern apps are blocked by security software when you start the applications on Windows 10 Version 1607](https://support.microsoft.com/help/4016973/modern-apps-are-blocked-by-security-software-when-you-start-the-applic) - -## Solutions related to wireless networking and 802.1X authentication -- [Advanced Troubleshooting Wireless Network](Connectivity]https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-wireless-network-connectivity) -- [Advanced Troubleshooting 802.1x Authentication](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-802-authentication) -- [Troubleshooting Windows 802.11 Wireless Connections](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-vista/cc766215(v=ws.10)) -- [Troubleshooting Windows Secure 802.3 Wired Connections](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-vista/cc749352(v%3dws.10)) -- [Windows 10 devices can't connect to an 802.1X environment](https://support.microsoft.com/kb/3121002) +- [Troubleshooting Windows Server components](https://docs.microsoft.com/windows-server/troubleshoot/windows-server-troubleshooting) diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index c0ad05a8bd..0d01784273 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -1,21 +1,27 @@ # [Configure Windows 10](index.md) ## [Accessibility information for IT Pros](windows-10-accessibility-for-ITPros.md) ## [Configure access to Microsoft Store](stop-employees-from-using-microsoft-store.md) -## [Cortana integration in your business or enterprise](cortana-at-work/cortana-at-work-overview.md) -### [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md) -#### [Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook](cortana-at-work/cortana-at-work-scenario-1.md) -#### [Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work/cortana-at-work-scenario-2.md) -#### [Test scenario 3 - Set a reminder for a specific location using Cortana at work](cortana-at-work/cortana-at-work-scenario-3.md) -#### [Test scenario 4 - Use Cortana at work to find your upcoming meetings](cortana-at-work/cortana-at-work-scenario-4.md) -#### [Test scenario 5 - Use Cortana to send email to a co-worker](cortana-at-work/cortana-at-work-scenario-5.md) -#### [Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work/cortana-at-work-scenario-6.md) -#### [Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device](cortana-at-work/cortana-at-work-scenario-7.md) -### [Set up and test Cortana with Office 365 in your organization](cortana-at-work/cortana-at-work-o365.md) -### [Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization](cortana-at-work/cortana-at-work-crm.md) -### [Set up and test Cortana for Power BI in your organization](cortana-at-work/cortana-at-work-powerbi.md) -### [Set up and test custom voice commands in Cortana for your organization](cortana-at-work/cortana-at-work-voice-commands.md) -### [Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization](cortana-at-work/cortana-at-work-policy-settings.md) -### [Send feedback about Cortana at work back to Microsoft](cortana-at-work/cortana-at-work-feedback.md) +## [Configure Cortana in Windows 10](cortana-at-work/cortana-at-work-overview.md) +## [Set up and test Cortana in Windows 10, version 2004 and later](cortana-at-work/set-up-and-test-cortana-in-windows-10.md) +## [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md) +### [Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query](cortana-at-work/cortana-at-work-scenario-1.md) +### [Test scenario 2 - Perform a Bing search with Cortana](cortana-at-work/cortana-at-work-scenario-2.md) +### [Test scenario 3 - Set a reminder](cortana-at-work/cortana-at-work-scenario-3.md) +### [Test scenario 4 - Use Cortana to find free time on your calendar](cortana-at-work/cortana-at-work-scenario-4.md) +### [Test scenario 5 - Find out about a person](cortana-at-work/cortana-at-work-scenario-5.md) +### [Test scenario 6 - Change your language and perform a quick search with Cortana](cortana-at-work/cortana-at-work-scenario-6.md) +## [Send feedback about Cortana back to Microsoft](cortana-at-work/cortana-at-work-feedback.md) +## [Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization](cortana-at-work/cortana-at-work-o365.md) +## [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md) +### [Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query](cortana-at-work/test-scenario-1.md) +### [Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work/test-scenario-2.md) +### [Test scenario 3 - Set a reminder for a specific location using Cortana at work](cortana-at-work/test-scenario-3.md) +### [Test scenario 4 - Use Cortana at work to find your upcoming meetings](cortana-at-work/test-scenario-4.md) +### [Test scenario 5 - Use Cortana to send email to a co-worker](cortana-at-work/test-scenario-5.md) +### [Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work/test-scenario-6.md) +### [Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device](cortana-at-work/cortana-at-work-scenario-7.md) +## [Set up and test custom voice commands in Cortana for your organization](cortana-at-work/cortana-at-work-voice-commands.md) +## [Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization](cortana-at-work/cortana-at-work-policy-settings.md) ## [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) ## [Configure kiosks and digital signs on Windows desktop editions](kiosk-methods.md) ### [Prepare a device for kiosk configuration](kiosk-prepare.md) @@ -141,7 +147,7 @@ ### [Administering UE-V](ue-v/uev-administering-uev.md) #### [Manage Configurations for UE-V](ue-v/uev-manage-configurations.md) ##### [Configuring UE-V with Group Policy Objects](ue-v/uev-configuring-uev-with-group-policy-objects.md) -##### [Configuring UE-V with System Center Configuration Manager](ue-v/uev-configuring-uev-with-system-center-configuration-manager.md) +##### [Configuring UE-V with Microsoft Endpoint Configuration Manager](ue-v/uev-configuring-uev-with-system-center-configuration-manager.md) ##### [Administering UE-V with Windows PowerShell and WMI](ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md) ###### [Managing the UE-V Service and Packages with Windows PowerShell and WMI](ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md) ###### [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index cca3071cad..875beb0290 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -2,7 +2,7 @@ title: Change history for Configure Windows 10 (Windows 10) ms.reviewer: manager: dansimp -description: This topic lists changes to documentation for configuring Windows 10. +description: Learn about new and updated topics in the Configure Windows 10 documentation for Windows 10 and Windows 10 Mobile. keywords: ms.prod: w10 ms.mktglfcycl: manage @@ -12,6 +12,7 @@ ms.localizationpriority: medium author: dansimp ms.author: dansimp ms.topic: article +ms.date: 10/03/2019 --- # Change history for Configure Windows 10 @@ -118,14 +119,14 @@ The following topics were moved into the [Privacy](/windows/privacy/index) libra New or changed topic | Description --- | --- -[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | Updated endpoints. +[Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | Updated endpoints. [Configure cellular settings for tablets and PCs](provisioning-apn.md) | Added instructions for confirming that the settings were applied. ## March 2018 New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the March update. +[Windows 10, version 1709 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) | Added events and fields that were added in the March update. Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it **Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education** and reorganized the information to make the choices clearer. @@ -133,7 +134,7 @@ Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it **Set up New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the February update. +[Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) | Added events and fields that were added in the February update. [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added steps for configuring a kiosk in Microsoft Intune. [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | Updated the instructions for applying a customized Start layout using Microsoft Intune. @@ -144,9 +145,9 @@ New or changed topic | Description [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added videos demonstrating how to use Microsoft Intune and how to use provisioning packages to configure multi-app kiosks. [ConnectivityProfiles](wcd/wcd-connectivityprofiles.md) | Added settings for VPN **Native** and **Third Party** profile types. [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) | Clarified that the TopMFUApps elements in layoutmodification.xml are not supported in Windows 10, version 1709. -| [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md) | New topic | +| [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overviewd) | New topic | [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Added section for removing default apps from the taskbar. -[Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them. +[Manage Windows 10 connection endpoints](https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them. [Configure Windows Spotlight on the lock screen](windows-spotlight.md) | Added section for resolution of custom lock screen images. [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Added section for automatic sign-in after restart on unmanaged devices. @@ -155,7 +156,7 @@ New or changed topic | Description New or changed topic | Description --- | --- -|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)| Added events that were added in November. | +|[Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)| Added events that were added in November. | [Create a provisioning package with multivariant settings](provisioning-packages/provisioning-multivariant.md) | Add support for desktop to [Conditions](provisioning-packages/provisioning-multivariant.md#conditions) table. ## October 2017 @@ -170,16 +171,16 @@ The topics in this library have been updated for Windows 10, version 1709 (also - [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) - [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) -- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) -- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) - +- [Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) +- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) + ## September 2017 |New or changed topic | Description| |--- | ---| -|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)|New conceptual info about Windows 10 and the upcoming GDPR-compliance requirements.| -|[Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added that Windows Spotlight can be managed by the Experience/AllowWindowsSpotlight MDM policy. | +|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](https://docs.microsoft.com/windows/privacy/gdpr-win10-whitepaper)|New conceptual info about Windows 10 and the upcoming GDPR-compliance requirements.| +|[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Added that Windows Spotlight can be managed by the Experience/AllowWindowsSpotlight MDM policy. | @@ -194,12 +195,12 @@ The topics in this library have been updated for Windows 10, version 1709 (also | New or changed topic | Description | | --- | --- | -|[Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md)|Updated categories and included diagnostic data.| +|[Windows 10, version 1703 Diagnostic Data](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)|Updated categories and included diagnostic data.| |[Add image for secondary tiles](start-secondary-tiles.md) | Added XML example for Edge secondary tiles and **ImportEdgeAssets** | |[Customize and export Start layout](customize-and-export-start-layout.md) | Added explanation for tile behavior when the app is not installed | |[Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md) | Added that Microsoft Edge is not supported for assigned access | -|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)|Updated several Appraiser events and added Census.Speech. | -|[Manage connections from Windows operating system components to Microsoft-services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Updated Date & Time and Windows spotlight sections. | +|[Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)|Updated several Appraiser events and added Census.Speech. | +|[Manage connections from Windows operating system components to Microsoft-services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Updated Date & Time and Windows spotlight sections. | ## June 2017 @@ -214,7 +215,7 @@ The topics in this library have been updated for Windows 10, version 1709 (also | New or changed topic | Description | | --- | --- | | [Configure cellular settings for tablets and PCs](provisioning-apn.md) | New | -| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added MDM policies for privacy settings | +| [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Added MDM policies for privacy settings | ## April 2017 @@ -232,5 +233,4 @@ The topics in this library have been updated for Windows 10, version 1703 (also - [Use the Lockdown Designer app to create a Lockdown XML file](mobile-devices/mobile-lockdown-designer.md) - [Add image for secondary tiles](start-secondary-tiles.md) - [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md) -- [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) -- [Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md) +- [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) diff --git a/windows/configuration/changes-to-start-policies-in-windows-10.md b/windows/configuration/changes-to-start-policies-in-windows-10.md index 0a333370c9..fe5186f6cf 100644 --- a/windows/configuration/changes-to-start-policies-in-windows-10.md +++ b/windows/configuration/changes-to-start-policies-in-windows-10.md @@ -1,6 +1,6 @@ --- title: Changes to Group Policy settings for Windows 10 Start menu (Windows 10) -description: Windows 10 has a brand new Start experience. +description: Learn about changes to Group Policy settings for the Windows 10 Start menu. Also, learn about the new Windows 10 Start experience. ms.assetid: 612FB68A-3832-451F-AA97-E73791FEAA9F ms.reviewer: manager: dansimp diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index 037e389943..1e6ec5db4b 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -1,6 +1,6 @@ --- title: Configure Windows 10 taskbar (Windows 10) -description: Admins can pin apps to users' taskbars. +description: Administrators can pin additional apps to the taskbar and remove default pinned apps from the taskbar by adding a section to a layout modification XML file. keywords: ["taskbar layout","pin apps"] ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index 095fa77861..9e2aea142f 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -1,6 +1,6 @@ --- title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization (Windows 10) -description: How to set up Cortana to help your salespeople get proactive insights on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. +description: How to set up Cortana to give salespeople insights on important CRM activities, including sales leads, accounts, and opportunities. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -13,10 +13,6 @@ manager: dansimp --- # Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md index 8def5a04c7..d89ff3d90b 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md @@ -1,6 +1,6 @@ --- -title: Send feedback about Cortana at work back to Microsoft (Windows 10) -description: How to send feedback to Microsoft about Cortana at work. +title: Send feedback about Cortana at work back to Microsoft +description: Learn how to send feedback to Microsoft about Cortana at work so you can provide more information to help diagnose reported issues.. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -12,15 +12,14 @@ ms.reviewer: manager: dansimp --- -# Send feedback about Cortana at work back to Microsoft -**Applies to:** +# Send feedback about Cortana back to Microsoft -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +To provide feedback on an individual request or response, select the item in the conversation history and then select **Give feedback**. This opens the Feedback Hub application where you can provide more information to help diagnose reported issues. -We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems. +:::image type="content" source="../screenshot1.png" alt-text="Screenshot: Send feedback page"::: -![Cortana at work, showing how to provide feedback to Microsoft](../images/cortana-feedback.png) +To provide feedback about the application in general, go to the **Settings** menu by selecting the three dots in the top left of the application, and select **Feedback**. This opens the Feedback Hub where more information on the issue can be provided. -If you don't want to use the feedback tool in Cortana, you can add feedback through the general Windows Insider Program feedback app. For info about the feedback app, see [How to use Windows Insider Preview – Updates and feedback](https://windows.microsoft.com/en-us/windows/preview-updates-feedback-pc). +:::image type="content" source="../screenshot12.png" alt-text="Screenshot: Select Feedback to go to the Feedback Hub"::: +In order for enterprise users to provide feedback, admins must unblock the Feedback Hub in the [Azure portal](https://portal.azure.com/). Go to the **Enterprise applications section** and enable **Users can allow apps to access their data**. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md index 351942547a..d915ec9aee 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md @@ -1,6 +1,6 @@ --- -title: Set up and test Cortana with Office 365 in your organization (Windows 10) -description: How to connect Cortana to Office 365 so your employees are notified about regular meetings, unusual events, such as meetings over lunch or during a typical commute time, and about early meetings, even setting an alarm so the employee isn’t late. +title: Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization +description: Learn how to connect Cortana to Office 365 so employees are notified about regular meetings and unusual events. You can even set an alarm for early meetings. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -12,63 +12,45 @@ ms.reviewer: manager: dansimp --- -# Set up and test Cortana with Office 365 in your organization -**Applies to:** +# Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 -Cortana in Windows 10 is already great at letting your employees quickly see what the day is going to look like, do meeting prep work like researching people in LinkedIn or getting documents ready, see where and when their meetings are going to be, get a sense of travel times to and from work, and even get updates from a calendar for upcoming trips. +## What can you do with in Windows 10, versions 1909 and earlier? +Your employees can use Cortana to help manage their day and be more productive by getting quick answers to common questions, setting reminders, adding tasks to their To-Do lists, and find out where their next meeting is. -But Cortana works even harder when she connects to Office 365, helping employees to be notified about unusual events, such as meetings over lunch or during a typical commute time, and about early meetings, even setting an alarm so the employee isn’t late. +**See also:** -![Cortana at work, showing the day's schedule pulled from Office 365](../images/cortana-o365-screen.png) +[Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10). -We’re continuing to add more and more capabilities to Cortana so she can become even more helpful with your productivity-related tasks, such as emailing, scheduling, and other tasks that are important to help you be successful. +### Before you begin +There are a few things to be aware of before you start using Cortana in Windows 10, versions 1909 and earlier. ->[!NOTE] ->For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717379). +- **Azure Active Directory (Azure AD) account.** Before your employees can use Cortana in your org, they must be logged in using their Azure AD account through Cortana's notebook. They must also authorize Cortana to access Microsoft 365 on their behalf. -## Before you begin -There are a few things to be aware of before you start using Cortana with Office 365 in your organization. +- **Office 365 Trust Center.** Cortana in Windows 10, version 1909 and earlier, isn't a service governed by the [Online Services Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products). [Learn more about how Cortana in Windows 10, versions 1909 and earlier, treats your data](https://support.microsoft.com/en-us/help/4468233/cortana-and-privacy-microsoft-privacy). -- **Software requirements.** O365 integration with Cortana is available in all countries/regions where Cortana is supported for consumers today. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, it will also become available to organizations. - -- **Azure Active Directory (Azure AD) account.** Before your employees can use Cortana in your org, they must be logged in using their Azure AD account through Cortana’s notebook. They must also authorize Cortana to access Office 365 on their behalf. - -- **Office 365 Trust Center.** Cortana isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana treats your data](https://go.microsoft.com/fwlink/p/?LinkId=536419). +- Windows Information Protection (WIP). If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft Endpoint Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution. - **Troubleshooting tips.** If you run into issues, check out these [troubleshooting tips](https://go.microsoft.com/fwlink/p/?LinkId=620763). -## Turn on Cortana with Office 365 on employees’ devices -You must tell your employees to turn on Cortana before they’ll be able to use it with Office 365. +### Turn on Cortana enterprise services on employees' devices +Your employees must connect Cortana to their Microsoft 365 account to be able to use skills like email and calendar. -**To turn on local Cortana with Office 365** +#### Turn on Cortana enterprise services -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Select the **Cortana** search box in the taskbar, and then select the **Notebook** icon. -2. Click on **Connected Services**, click **Office 365**, and then click **Connect**. - - ![Cotana at work, showing how to turn on the connected services for Office 365](../images/cortana-connect-o365.png) - - The employee can also disconnect by clicking **Disconnect** from the **Office 365** screen. - -## Turn off Cortana with Office 365 -Cortana can only access data in your Office 365 org when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off in the Microsoft 365 admin center. - -**To turn off Cortana with Office 365** -1. [Sign in to Office 365](https://www.office.com/signin) using your Azure AD account. - -2. Go to the [admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). - -3. Expand **Service Settings**, and select **Cortana**. - -4. Click **Cortana** to toggle Cortana off. - - All Office 365 functionality related to Cortana is turned off in your organization and your employees are unable to use her at work. +2. Select **Manage Skills** , select **Manage accounts** , and under **Microsoft 365** select **Link**. The employee will be directed to sign into their Microsoft 365 account. +3. The employee can also disconnect by selecting **Microsoft 365**, then **Unlink**. +#### Turn off Cortana enterprise services +Cortana in Windows 10, versions 1909 and earlier can only access data in your Microsoft 365 organization when it's turned on. If you don't want Cortana to access your corporate data, you can turn it off in the Microsoft 365 admin center. +1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/) using your admin account. +2. Select the app launcher icon in the upper-left and choose **Admin**. +3. Expand **Settings** and select **Org Settings**. +4. Select **Cortana** to toggle Cortana's access to Microsoft 365 data off. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index b3077aeaf7..5d8a6999f8 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -1,8 +1,8 @@ --- -title: Cortana integration in your business or enterprise (Windows 10) +title: Configure Cortana in Windows 10 ms.reviewer: manager: dansimp -description: The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. +description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -11,53 +11,81 @@ ms.localizationpriority: medium ms.author: dansimp --- -# Cortana integration in your business or enterprise -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +# Configure Cortana in Windows 10 ## Who is Cortana? -Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work. -Cortana has powerful configuration options, specifically optimized for your business. By signing in with an Azure Active Directory (Azure AD) account, your employees can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work. -Using Azure AD also means that you can remove an employee’s profile (for example, when an employee leaves your organization) while respecting Windows Information Protection (WIP) policies and ignoring enterprise content, such as emails, calendar items, and people lists that are marked as enterprise data. +Cortana is a personal productivity assistant in Microsoft 365, helping your users achieve more with less effort and focus on what matters. The Cortana app in Windows 10 helps users quickly get information across Microsoft 365, using typed or spoken queries to connect with people, check calendars, set reminders, add tasks, and more. -![Cortana at work, showing the About me screen](../images/cortana-about-me.png) +:::image type="content" source="../screenshot1.png" alt-text="Screenshot: Cortana home page example"::: ## Where is Cortana available for use in my organization? -You can use Cortana at work in all countries/regions where Cortana is supported for consumers. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, she will also become available to enterprise customers. -Cortana is available on Windows 10, version 1703 and with limited functionality on Windows 10 Mobile, version 1703. +Your employees can use Cortana in the languages listed [here](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). However, most productivity skills are currently only enabled for English (United States), for users with mailboxes in the United States. + +The Cortana app in Windows 10, version 2004 requires the latest Microsoft Store update to support languages other than English (United States). ## Required hardware and software -Cortana requires the following hardware and software to successfully run the included scenario in your organization. -|Hardware |Description | -|---------|------------| -|Microphone |For speech interaction with Cortana. If you don't have a microphone, you can still interact with Cortana by typing in the Cortana Search Box in the taskbar. | -|Windows Phone |For location-specific reminders. You can also use a desktop device to run through this scenario, but location accuracy is usually better on phones. | -|Desktop devices |For non-phone-related scenarios. | +Cortana requires a PC running Windows 10, version 1703 or later, as well as the following software to successfully run the included scenario in your organization. +>[!NOTE] +>A microphone isn't required to use Cortana. -|Software |Minimum version | -|---------|------------| -|Client operating system |
            • **Desktop:** Windows 10, version 1703
            • **Mobile:** Windows 10 Mobile, version 1703 (with limited functionality)
            • | -|Azure Active Directory (Azure AD) |While all employees signing into Cortana need an Azure AD account; an Azure AD premium tenant isn’t required. | -|Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana, but won't turn Cortana off.

              For example:

              If you turn **Location** off, Cortana won't be able to provide location-based reminders, such as reminding you to visit the mail room when you get to work.

              If you turn **Speech** off, your employees won't be able to use “Hello Cortana” for hands free usage or voice commands to easily ask for help. | -|Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)

              If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft System Center Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| +| Software | Minimum version | +|---------|---------| +|Client operating system | Desktop:
              - Windows 10, version 2004 (recommended)

              - Windows 10, version 1703 (legacy version of Cortana)

              Mobile: Windows 10 mobile, version 1703 (legacy version of Cortana)

              For more information on the differences between Cortana in Windows 10, version 2004 and earlier versions, see [**How is my data processed by Cortana**](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview#how-is-my-data-processed-by-cortana) below. | +|Azure Active Directory (Azure AD) | While all employees signing into Cortana need an Azure AD account, an Azure AD premium tenant isn't required. | +|Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana but won't turn Cortana off. For example, if you turn **Speech** off, your employees won't be able to use the wake word ("Cortana") for hands-free activation or voice commands to easily ask for help. | ## Signing in using Azure AD -Your organization must have an Azure AD tenant and your employees’ devices must all be Azure AD-joined for Cortana to work properly. For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [What is an Azure AD directory?](https://msdn.microsoft.com/library/azure/jj573650.aspx) -## Cortana and privacy -We understand that there are some questions about Cortana and your organization’s privacy, including concerns about what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. For more details about these concerns, see the [Cortana, Search, and privacy: FAQ](https://windows.microsoft.com/windows-10/cortana-privacy-faq) topic. +Your organization must have an Azure AD tenant and your employees' devices must all be Azure AD-joined for the best Cortana experience. (Users may also sign into Cortana with a Microsoft account, but will not be able to use their enterprise email or calendar.) For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [Azure Active Directory documentation.](https://docs.microsoft.com/azure/active-directory/) -Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). +## How is my data processed by Cortana? + +Cortana's approach to integration with Microsoft 365 has changed with Windows 10, version 2004 and later. + +### Cortana in Windows 10, version 2004 and later + +Cortana enterprise services that can be accessed using Azure AD through Cortana in Windows 10, version 2004 and later, meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](https://docs.microsoft.com/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365). + +#### How does Microsoft store, retain, process, and use Customer Data in Cortana? + +The table below describes the data handling for Cortana enterprise services. + + +| Name | Description | +|---------|---------| +|**Storage** |Customer Data is stored on Microsoft servers inside the Office 365 cloud. Your data is part of your tenant. Speech audio is not retained. | +|**Stays in Geo** |Customer Data is stored on Microsoft servers inside the Office 365 cloud in Geo. Your data is part of your tenant. | +|**Retention** |Customer Data is deleted when the account is closed by the tenant administrator or when a GDPR Data Subject Rights deletion request is made. Speech audio is not retained. | +|**Processing and confidentiality** |Personnel engaged in the processing of Customer Data and personal data (i) will process such data only on instructions from Customer, and (ii) will be obligated to maintain the confidentiality and security of such data even after their engagement ends. | +|**Usage** |Microsoft uses Customer Data only to provide the services agreed upon, and for purposes that are compatible with those services. Machine learning to develop and improve models is one of those purposes. Machine learning is done inside the Office 365 cloud consistent with the Online Services Terms. Your data is not used to target advertising. | + +#### How does the wake word (Cortana) work? If I enable it, is Cortana always listening? + +>[!NOTE] +>The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. + +Cortana only begins listening for commands or queries when the wake word is detected, or the microphone button has been selected. + +First, the user must enable the wake word from within Cortana settings. Once it has been enabled, a component of Windows called the [Windows Multiple Voice Assistant platform](https://docs.microsoft.com/windows-hardware/drivers/audio/voice-activation-mva#voice-activation) will start listening for the wake word. No audio is processed by speech recognition unless two local wake word detectors and a server-side one agree with high confidence that the wake word was heard. + +The first decision is made by the Windows Multiple Voice Assistant platform leveraging hardware optionally included in the user's PC for power savings. If the wake word is detected, Windows will show a microphone icon in the system tray indicating an assistant app is listening. + +:::image type="content" source="../screenshot2.png" alt-text="Screenshot: Microphone icon in the system tray indicating an assistant app is listening"::: + +At that point, the Cortana app will receive the audio, run a second, more accurate wake word detector, and optionally send it to a Microsoft cloud service where a third wake word detector will confirm. If the service does not confirm that the activation was valid, the audio will be discarded and deleted from any further processing or server logs. On the user's PC, the Cortana app will be silently dismissed, and no query will be shown in conversation history because the query was discarded. + +If all three wake word detectors agree, the Cortana canvas will show what speech has been recognized. + +### Cortana in Windows 10, versions 1909 and earlier + +Cortana in Windows 10, versions 1909 and earlier, isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana in Windows 10, version 1909 and earlier, treats your data](https://go.microsoft.com/fwlink/p/?LinkId=536419). + +Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). ## See also + - [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818) - -- [Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10) - -- [Cortana for developers](https://go.microsoft.com/fwlink/?LinkId=717385) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md index 8c6f2186a3..1729809a44 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md @@ -1,5 +1,5 @@ --- -title: Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization (Windows 10) +title: Configure Cortana with Group Policy and MDM settings (Windows 10) description: The list of Group Policy and mobile device management (MDM) policy settings that apply to Cortana at work. ms.prod: w10 ms.mktglfcycl: manage @@ -13,34 +13,40 @@ manager: dansimp --- # Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization -**Applies to:** - -- Windows 10 -- Windows 10 Mobile >[!NOTE] ->For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=717381). - -|Group policy |MDM policy |Description | -|-------------|-----------|------------| -|Computer Configuration\Administrative Templates\Windows Components\Search\AllowCortanaAboveLock|AboveLock/AllowCortanaAboveLock|Specifies whether an employee can interact with Cortana using voice commands when the system is locked.

              **Note**
              This setting only applies to Windows 10 for desktop devices. | -|Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow users to enable online speech recognition services|Privacy/AllowInputPersonalization|Specifies whether an employee can use voice commands with Cortana in your organization.

              **In Windows 10, version 1511**
              Cortana won’t work if this setting is turned off (disabled).

              **In Windows 10, version 1607 and later**
              Cortana still works if this setting is turned off (disabled).| -|None|System/AllowLocation|Specifies whether to allow app access to the Location service.

              **In Windows 10, version 1511**
              Cortana won’t work if this setting is turned off (disabled).

              **In Windows 10, version 1607 and later**
              Cortana still works if this setting is turned off (disabled).| -|None|Accounts/AllowMicrosoftAccountConnection|Specifies whether to allow employees to sign in using a Microsoft account (MSA) from Windows apps.

              Use this setting if you only want to support Azure AD in your organization.| -|Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location|Search/AllowSearchToUseLocation|Specifies whether Cortana can use your current location during searches and for location reminders.| -|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search|Search/SafeSearchPermissions|Specifies what level of safe search (filtering adult content) is required.

              **Note**
              This setting only applies to Windows 10 Mobile. Other versions of Windows should use Don't search the web or display web results. | -|User Configuration\Administrative Templates\Windows Components\File Explorer\Turn off display of recent search entries in the File Explorer search box|None|Specifies whether the search box can suggest recent queries and prevent entries from being stored in the registry for future reference.| -|Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results|None|Specifies whether search can perform queries on the web and if the web results are displayed in search.

              **In Windows 10 Pro edition**
              This setting can’t be managed.

              **In Windows 10 Enterprise edition**
              Cortana won't work if this setting is turned off (disabled).| -|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana|Experience/AllowCortana|Specifies whether employees can use Cortana.

              **Important**
              Cortana won’t work if this setting is turned off (disabled). However, employees can still perform local searches even with Cortana turned off.| - - - - - - - - - - +>For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) topic, located in the configuration service provider reference topics. +|**Group policy** |**MDM policy** |**Description** | +|---------|---------|---------| +|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana |Experience/AllowCortana |Specifies whether employees can use Cortana.
              +> [!IMPORTANT] +> Cortana won’t work if this setting is turned off (disabled). However, on Windows 10, version 1809 and below, employees can still perform local searches even with Cortana turned off. | +|Computer Configuration\Administrative Templates\Windows Components\Search\AllowCortanaAboveLock |AboveLock/AllowCortanaAboveLock |Specifies whether an employee can interact with Cortana using voice commands when the system is locked.
              +> [!NOTE] +> Cortana in Windows 10, versions 2004 and later do not currently support Above Lock. | +|Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsActivateWithVoice |[Privacy/LetAppsActivateWithVoice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsactivatewithvoice) |Specifies whether apps (such as Cortana or other voice assistants) can activate using a wake word (e.g. “Hey Cortana”).
              +> [!NOTE] +> This setting only applies to Windows 10 versions 2004 and later. To disable wake word activation on Windows 10 versions 1909 and earlier, you will need to disable voice commands using Privacy/AllowInputPersonalization. | +|Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsAccessMicrophone |[Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmicrophone-forcedenytheseapps) | Use this to disable Cortana’s access to the microphone. To do so, specify Cortana’s Package Family Name: Microsoft.549981C3F5F10_8wekyb3d8bbwe
              +Users will still be able to type queries to Cortana. | +|Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow users to enable online speech recognition services |Privacy/AllowInputPersonalization |Specifies whether an employee can use voice commands with Cortana in your organization.
              +**In Windows 10, version 1511**
              Cortana won’t work if this setting is turned off (disabled).
              **In Windows 10, version 1607 and later**
              Non-speech aspects of Cortana will still work if this setting is turned off (disabled).
              **In Windows 10, version 2004 and later**
              Cortana will work, but voice input will be disabled. | +|None |System/AllowLocation |Specifies whether to allow app access to the Location service.
              +**In Windows 10, version 1511**
              Cortana won’t work if this setting is turned off (disabled).
              +**In Windows 10, version 1607 and later**
              +Cortana still works if this setting is turned off (disabled).
              +**In Windows 10, version 2004 and later**
              +Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later do not currently use the Location service. | +|None |Accounts/AllowMicrosoftAccountConnection |Specifies whether to allow employees to sign in using a Microsoft account (MSA) from Windows apps.
              +Disable this setting if you only want to allow users to sign in with their Azure AD account. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location |Search/AllowSearchToUseLocation |Specifies whether Cortana can use your current location during searches and for location reminders.
              +**In Windows 10, version 2004 and later**
              Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later, do not currently use the Location service. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results |Search/DoNotUseWebResults |Specifies whether search can perform queries on the web and if the web results are displayed in search.
              +**In Windows 10 Pro edition**
              This setting can’t be managed. +**In Windows 10 Enterprise edition**
              Cortana won't work if this setting is turned off (disabled). +**In Windows 10, version 2004 and later**
              This setting no longer affects Cortana. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search |Search/SafeSearchPermissions |Specifies what level of safe search (filtering adult content) is required.
              +> [!NOTE] +> This setting only applies to Windows 10 Mobile. Other versions of Windows should use Don't search the web or display web results. | \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 8ca269aefe..6bf6aaf7bd 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -13,10 +13,9 @@ manager: dansimp --- # Set up and test Cortana for Power BI in your organization -**Applies to:** -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +>[!IMPORTANT] +>Cortana for Power BI is deprecated and will not be available in future releases. This topic is provided as a reference for previous versions only. Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana “answers” using the full capabilities of Power BI Desktop. @@ -35,6 +34,7 @@ To use this walkthrough, you’ll need: - **Azure Active Directory (Azure AD)/Work or School account**. You can use the account that you created for Office 365, or you can create a new one while you’re establishing your Power BI account. If you choose to use Azure AD, you must connect your Azure AD account to your Windows account. **To connect your account to Windows** + a. Open **Windows Settings**, click **Accounts**, click **Access work or school**, and then in the **Connect to work or school** section, click **Connect**. b. Follow the instructions to add your Azure Active Directory (Azure AD) account to Windows. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md index a1dfe7d5c0..e2dfea47f8 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md @@ -1,5 +1,5 @@ --- -title: Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook (Windows 10) +title: Sign into Azure AD, enable the wake word, and try a voice query description: A test scenario walking you through signing in and managing the notebook. ms.prod: w10 ms.mktglfcycl: manage @@ -7,54 +7,28 @@ ms.sitesec: library author: dansimp ms.localizationpriority: medium ms.author: dansimp -ms.date: 10/05/2017 ms.reviewer: manager: dansimp --- -# Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook +# Test scenario 1 – Sign into Azure AD, enable the wake word, and try a voice query -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +>[!NOTE] +>The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +1. Select the **Cortana** icon in the task bar and sign in using your Azure AD account. -This scenario turns on Azure AD and let's your employee use Cortana to manage an entry in the notebook. +2. Select the "…" menu and select **Talking to Cortana**. -## Turn on Azure AD -This process helps you to sign out of a Microsoft Account and to sign into an Azure AD account. +3. Toggle **Wake word** to **On** and close Cortana. -1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, and then click **About Me**. +4. Say **Cortana, what can you do?** -2. Click your email address. + When you say **Cortana**, Cortana will open in listening mode to acknowledge the wake word. - A dialog box appears, showing the associated account info. + :::image type="content" source="../screenshot4.png" alt-text="Screenshot: Cortana listening mode"::: -3. Click your email address again, and then click **Sign out**. + Once you finish saying your query, Cortana will open with the result. - This signs out the Microsoft account, letting you continue to add and use the Azure AD account. - -4. Click the **Search** box and then the **Notebook** icon in the left rail. This will start the sign-in request. - -5. Click **Sign-In** and follow the instructions. - -6. When you’re asked to sign in, you’ll need to choose an Azure AD account, which will look like kelliecarlson@contoso.com. - - >[!IMPORTANT] - >If there’s no Azure AD account listed, you’ll need to go to **Windows Settings > Accounts > Email & app accounts**, and then click **Add a work or school account** to add it. - -## Use Cortana to manage the notebook content -This process helps you to manage the content Cortana shows in your Notebook. - -1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, scroll down and click **Weather**. - -2. In the **Weather** settings, scroll down to the **Cities your tracking** area, and then click **Add a city**. - -3. Add *Redmond, Washington*, double-click the search result, click **Add**, and then click **Save**. - - ![Cortana at work, showing the multiple Weather screens](../images/cortana-weather-multipanel.png) - -4. Click on the **Home** icon and scroll to the weather forecast for Redmond, Washington. - - ![Cortana at work, showing Redmond, WA weather](../images/cortana-redmond-weather.png) +>[!NOTE] +>If you've disabled the wake word using MDM or Group Policy, you will need to manually activate the microphone by selecting Cortana, then the mic button. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md index 70a280cb22..d4e6253873 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md @@ -1,5 +1,5 @@ --- -title: Test scenario 2 - Perform a quick search with Cortana at work (Windows 10) +title: Perform a quick search with Cortana at work (Windows 10) description: A test scenario about how to perform a quick search with Cortana at work. ms.prod: w10 ms.mktglfcycl: manage @@ -12,32 +12,15 @@ ms.reviewer: manager: dansimp --- -# Test scenario 2 - Perform a quick search with Cortana at work +# Test scenario 2 – Perform a Bing search with Cortana -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +1. Select the **Cortana** icon in the taskbar. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +2. Type **What time is it in Hyderabad?**. -This scenario helps you perform a quick search using Cortana, both by typing and through voice commands. +Cortana will respond with the information from Bing. -## Search using Cortana -This process helps you use Cortana at work to perform a quick search. +:::image type="content" source="../screenshot5.png" alt-text="Screenshot: Cortana showing current time in Hyderabad"::: -1. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. - -2. Type *Weather in New York*. - - You should see the weather in New York, New York at the top of the search results. - - ![Cortana at work, showing the weather in New York, New York](../images/cortana-newyork-weather.png) - -## Search with Cortana, by using voice commands -This process helps you to use Cortana at work and voice commands to perform a quick search. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). - -2. Say *What's the weather in Chicago?* Cortana tells you and shows you the current weather in Chicago. - - ![Cortana at work, showing the current weather in Chicago, IL](../images/cortana-chicago-weather.png) +>[!NOTE] +>This scenario requires Bing Answers to be enabled. To learn more, see [Set up and configure the Bing Answers feature](https://docs.microsoft.com/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10#set-up-and-configure-the-bing-answers-feature). \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md index e82abbd92a..5382e5665c 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md @@ -1,5 +1,5 @@ --- -title: Test scenario 3 - Set a reminder for a specific location using Cortana at work (Windows 10) +title: Set a reminder for a location with Cortana at work (Windows 10) description: A test scenario about how to set a location-based reminder using Cortana at work. ms.prod: w10 ms.mktglfcycl: manage @@ -12,77 +12,14 @@ ms.reviewer: manager: dansimp --- -# Test scenario 3 - Set a reminder for a specific location using Cortana at work +# Test scenario 3 - Set a reminder -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +This scenario helps you set up, review, and edit a reminder. For example, you can remind yourself to send someone a link to a document after a meeting. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +1. Select the **Cortana** icon in the taskbar and type **Remind me to send a link to the deck at 3:05pm** and press **Enter**. -This scenario helps you set up, review, and edit a reminder based on a location. For example, reminding yourself to grab your expense report receipts before you leave the house. +Cortana will create a reminder in Microsoft To Do and will remind you at the appropriate time. ->[!NOTE] ->You can set each reminder location individually as you create the reminders, or you can go into the **About me** screen and add both **Work** and **Home** addresses as favorites. Make sure that you use real addresses since you’ll need to go to these locations to complete your testing scenario.

              Additionally, if you’ve turned on the **Meeting & reminder cards & notifications** option (in the **Meetings & reminders** option of your Notebook), you’ll also see your pending reminders on the Cortana **Home** page. +:::image type="content" source="../screenshot6.png" alt-text="Screenshot: Cortana set a reminder"::: -## Create a reminder for a specific location -This process helps you to create a reminder based on a specific location. - -1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. - -2. Click the **+** sign, add a subject for your reminder, such as _Remember to file expense report receipts_, and then click **Place**. - - ![Cortana at work, showing the add a reminder screens](../images/cortana-add-reminder.png) - -3. Choose **Arrive** from the drop-down box, and then type a location to associate with your reminder. For example, you can use the physical address of where you work. Just make sure you can physically get to your location, so you can test the reminder. - - ![Cortana at work, showing how to add a place to the reminder screens](../images/cortana-place-reminder.png) - -4. Click **Done**. - - >[!NOTE] - >If you’ve never used this location before, you’ll be asked to add a name for it so it can be added to the **Favorites list** in Windows Maps. - -5. Choose to be reminded the **Next time you arrive at the location** or on a specific day of the week from the drop-down box. - -6. Take a picture of your receipts and store them locally on your device. - -7. Click **Add Photo**, click **Library**, browse to your picture, and then click **OK**. - - The photo is stored with the reminder. - - ![Cortana at work, showing the stored image in the reminder screens](../images/cortana-final-reminder.png) - -8. Review the reminder info, and then click **Remind**. - - The reminder is saved and ready to be triggered. - - ![Cortana at work, showing the final reminder](../images/cortana-reminder-pending.png) - -## Create a reminder for a specific location by using voice commands -This process helps you to use Cortana at work and voice commands to create a reminder for a specific location. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). - -2. Say _Remind me to grab my expense report receipts before I leave home_. - - Cortana opens a new reminder task and asks if it sounds good. - - ![Cortana at work, showing the reminder created through voice commands](../images/cortana-reminder-mic.png) - -3. Say _Yes_ so Cortana can save the reminder. - - ![Cortana at work, showing the final reminder created through voice commands](../images/cortana-reminder-pending-mic.png) - -## Edit or archive an existing reminder -This process helps you to edit or archive and existing or completed reminder. - -1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. - - ![Cortana at work, showing the list of pending reminders](../images/cortana-reminder-list.png) - -2. Click the pending reminder you want to edit. - - ![Cortana at work, showing the reminder editing screen](../images/cortana-reminder-edit.png) - -3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click **Save** to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. +:::image type="content" source="../screenshot7.png" alt-text="Screenshot: Cortana showing reminder on page"::: \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md index 3283f2d1ad..1a34778608 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md @@ -1,5 +1,5 @@ --- -title: Test scenario 4 - Use Cortana at work to find your upcoming meetings (Windows 10) +title: Use Cortana at work to find your upcoming meetings (Windows 10) description: A test scenario about how to use Cortana at work to find your upcoming meetings. ms.prod: w10 ms.mktglfcycl: manage @@ -12,42 +12,16 @@ ms.reviewer: manager: dansimp --- -# Test scenario 4 - Use Cortana at work to find your upcoming meetings +# Test scenario 4 - Use Cortana to find free time on your calendar -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +This scenario helps you find out if a time slot is free on your calendar. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. - -This scenario helps you search for both general upcoming meetings, and specific meetings, both manually and verbally. - ->[!NOTE] ->If you’ve turned on the **Meeting & reminder cards & notifications** option (in the **Meetings & reminders** option of your Notebook), you’ll also see your pending reminders on the Cortana **Home** page. - -## Find out about upcoming meetings -This process helps you find your upcoming meetings. - -1. Check to make sure your work calendar is connected and synchronized with your Azure AD account. +1. Select the **Cortana** icon in the taskbar. 2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. -3. Type _Show me my meetings for tomorrow_. - - You’ll see all your meetings scheduled for the next day. - - ![Cortana at work, showing all upcoming meetings](../images/cortana-meeting-tomorrow.png) - -## Find out about upcoming meetings by using voice commands -This process helps you to use Cortana at work and voice commands to find your upcoming meetings. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. - -2. Say _Show me what meeting I have at 3pm tomorrow_. - - >[!IMPORTANT] - >Make sure that you have a meeting scheduled for the time you specify here. - - ![Cortana at work, showing the meeting scheduled for 3pm](../images/cortana-meeting-specific-time.png) +3. Type **Am I free at 3 PM tomorrow?** +Cortana will respond with your availability for that time, as well as nearby meetings. +:::image type="content" source="../screenshot8.png" alt-text="Screenshot: Cortana showing free time on a calendar"::: \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index 7fe284c023..6312ad8983 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -1,5 +1,5 @@ --- -title: Test scenario 5 - Use Cortana to send email to a co-worker (Windows 10) +title: Use Cortana to send email to a co-worker (Windows 10) description: A test scenario about how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage @@ -12,48 +12,14 @@ ms.reviewer: manager: dansimp --- -# Test scenario 5 - Use Cortana to send email to a co-worker +# Test scenario 5 - Test scenario 5 – Find out about a person -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +Cortana can help you quickly look up information about someone or the org chart. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +1. Select the **Cortana** icon in the taskbar. -This scenario helps you to send an email to a co-worker listed in your work address book, both manually and verbally. +2. Type or select the mic and say, **Who is name of person in your organization's?** -## Send an email to a co-worker -This process helps you to send a quick message to a co-worker from the work address book. +:::image type="content" source="../screenshot9.png" alt-text="Screenshot: Cortana showing name of person in your organization"::: -1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. - -2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. - -3. Type _Send an email to <contact_name>_. - - Where _<contact_name>_ is the name of someone in your work address book. - -4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. - - ![Cortana at work, showing the email text](../images/cortana-send-email-coworker.png) - -## Send an email to a co-worker by using voice commands -This process helps you to use Cortana at work and voice commands to send a quick message to a co-worker from the work address book. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. - -2. Say _Send an email to <contact_name>_. - - Where _<contact_name>_ is the name of someone in your work address book. - -3. Add your email message by saying, _Hello this is a test email using Cortana at work._ - - The message is added and you’re asked if you want to **Send it**, **Add more**, or **Make changes**. - - ![Cortana at work, showing the email text created from verbal commands](../images/cortana-send-email-coworker-mic.png) - -4. Say _Send it_. - - The email is sent. - - ![Cortana at work, showing the sent email text](../images/cortana-complete-send-email-coworker-mic.png) +Cortana will respond with information about the person. You can select the person to see more information about them in Microsoft Search. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index f731e345d8..b2c7bdd9dd 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -1,5 +1,5 @@ --- -title: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email (Windows 10) +title: Review a reminder suggested by Cortana (Windows 10) description: A test scenario about how to use Cortana with the Suggested reminders feature. ms.prod: w10 ms.mktglfcycl: manage @@ -12,38 +12,14 @@ ms.reviewer: manager: dansimp --- -# Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email +# Test scenario 6 – Change your language and perform a quick search with Cortana -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +Cortana can help employees in regions outside the US search for quick answers like currency conversions, time zone conversions, or weather in their location. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). +1. Select the **Cortana** icon in the taskbar. -Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, _I’ll get this to you by the end of the week_ in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it. +2. Select the **…** menu, then select **Settings**, **Language**, then select **Español (España)**. You will be prompted to restart the app. ->[!NOTE] ->The Suggested reminders feature is currently only available in English (en-us). - -**To use Cortana to create Suggested reminders for you** - -1. Make sure that you've connected Cortana to Office 365. For the steps to connect, see [Set up and test Cortana with Office 365 in your organization](cortana-at-work-o365.md). - -2. Click on the **Cortana** search box in the taskbar, click the **Notebook** icon, and then click **Permissions**. - -3. Make sure the **Contacts, email, calendar, and communication history** option is turned on. - - ![Permissions options for Cortana at work](../images/cortana-communication-history-permissions.png) - -4. Click the **Notebook** icon again, click the **Suggested reminders** option, click to turn on the **All reminder suggestions cards** option, click the **Notify me when something I mentioned doing is coming up** box, and then click **Save**. - - ![Suggested reminders options for Cortana at work](../images/cortana-suggested-reminder-settings.png) - -5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, _I’ll finish this project by end of day today_. - -6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. - - If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed. - - ![Cortana Home screen with your suggested reminder showing](../images/cortana-suggested-reminder.png) +3. Once the app has restarted, type or say **Convierte 100 Euros a Dólares**. +:::image type="content" source="../screenshot10.png" alt-text="Screenshot: Cortana showing a change your language and showing search results in Spanish"::: \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md index 01f326616c..c10a722ceb 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md @@ -1,5 +1,5 @@ --- -title: Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device (Windows 10) +title: Help protect data with Cortana and WIP (Windows 10) description: An optional test scenario about how to use Cortana at work with Windows Information Protection (WIP). ms.prod: w10 ms.mktglfcycl: manage @@ -14,9 +14,6 @@ manager: dansimp # Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md index 936f8b5788..9ab3b96e22 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md @@ -13,26 +13,19 @@ manager: dansimp --- # Testing scenarios using Cortana in your business or organization -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: -- [Sign-in to Cortana using Azure AD, manage entries in the notebook, and search for content across your device, Bing, and the cloud, using Cortana](cortana-at-work-scenario-1.md) +- [Sign into Azure AD, enable the Cortana wake word, and try a voice query](cortana-at-work-scenario-1.md) -- [Perform a quick search with Cortana at work](cortana-at-work-scenario-2.md) +- [Perform a Bing search with Cortana](cortana-at-work-scenario-2.md) -- [Set a reminder and have it remind you when you’ve reached a specific location](cortana-at-work-scenario-3.md) +- [Set a reminder](cortana-at-work-scenario-3.md) -- [Search for your upcoming meetings on your work calendar](cortana-at-work-scenario-4.md) +- [Use Cortana to find free time on your calendar](cortana-at-work-scenario-4.md) -- [Send an email to a co-worker from your work email app](cortana-at-work-scenario-5.md) +- [Find out about a person](cortana-at-work-scenario-5.md) -- [Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work-scenario-6.md) +- [Change your language and perform a quick search with Cortana](cortana-at-work-scenario-6.md) -- [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md) - ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +- [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md) \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index 825037d62d..1425bcd323 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -13,15 +13,11 @@ manager: dansimp --- # Set up and test custom voice commands in Cortana for your organization -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 - -Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. >[!NOTE] ->For more info about how your developer can extend your current apps to work directly with Cortana, see [The Cortana Skills Kit](https://docs.microsoft.com/cortana/getstarted). +>This content applies to Cortana in versions 1909 and earlier, but will not be available in future releases. + +Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. ## High-level process Cortana uses a Voice Command Definition (VCD) file, aimed at an installed app, to define the actions that are to happen during certain vocal commands. A VCD file can be very simple to very complex, supporting anything from a single sound to a collection of more flexible, natural language sounds, all with the same intent. @@ -36,7 +32,7 @@ To enable voice commands in Cortana - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Activate a background app in Cortana using voice commands](https://docs.microsoft.com/cortana/voice-commands/launch-a-background-app-with-voice-commands-in-cortana). -2. **Install the VCD file on employees' devices**. You can use System Center Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. +2. **Install the VCD file on employees' devices**. You can use Microsoft Endpoint Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. ## Test scenario: Use voice commands in a Microsoft Store app While these aren't line-of-business apps, we've worked to make sure to implement a VCD file, allowing you to test how the functionality works with Cortana in your organization. diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md new file mode 100644 index 0000000000..14dfdcd3da --- /dev/null +++ b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md @@ -0,0 +1,49 @@ +--- +title: Set up and test Cortana in Windows 10, version 2004 and later +ms.reviewer: +manager: dansimp +description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: kwekua +ms.localizationpriority: medium +ms.author: dansimp +--- + +# Set up and test Cortana in Windows 10, version 2004 and later + +## Before you begin + +- If your enterprise had previously disabled Cortana for your employees using the **Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana** Group Policy or the **Experience\AllowCortana** MDM setting but want to enable it now that Cortana is part of Microsoft 365, you will need to re-enable it at least for Windows 10, version 2004 and later. +- **Cortana is regularly updated through the Microsoft Store.** Beginning with Windows 10, version 2004, Cortana is an appx preinstalled with Windows and is regularly updated through the Microsoft Store. To receive the latest updates to Cortana, you will need to [enable updates through the Microsoft Store](https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store). + +## Set up and configure the Bing Answers feature +Bing Answers provides fast, authoritative results to search queries based on search terms. When the Bing Answers feature is enabled, users will be able to ask Cortana web-related questions in the Cortana in Windows app, such as "What's the current weather?" or "Who is the president of the U.S.?," and get a response, based on public results from Bing.com. + +The above experience is powered by Microsoft Bing, and Cortana sends the user queries to Bing. The use of Microsoft Bing is governed by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) and [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). + +## Configure the Bing Answers feature + +Admins can configure the Cortana in Windows Bing Answers feature for their organizations. As the admin, use the following steps to change the setting for Bing Answers at the tenant/security group level. This setting is enabled by default, so that all users who have Cortana enabled will be able to receive Bing Answers. By default, the Bing Answer feature will be available to your users. + +Users cannot enable or disable the Bing Answer feature individually. So, if you disable this feature at the tenant/security group level, no users in your organization or specific security group will be able to use Bing Answers in Cortana in Windows. + +Sign in to the [Office Configuration Admin tool](https://config.office.com/). + +Follow the steps [here](https://docs.microsoft.com/deployoffice/overview-office-cloud-policy-service#steps-for-creating-a-policy-configuration) to create this policy configuration. Once completed, the policy will look as shown below: + +:::image type="content" source="../screenshot3.png" alt-text="Screenshot: Bing policy example"::: + +## How does Microsoft handle customer data for Bing Answers? + +When a user enters a search query (by speech or text), Cortana evaluates if the request is for any of our first-party compliant skills if enabled in a specific market, and does the following: + +1. If it is for any of the first-party compliant skills, the query is sent to that skill, and results/action are returned. + +2. If it is not for any of the first-party compliant skills, the query is sent to Bing for a search of public results from Bing.com. Because enterprise searches might be sensitive, similar to [Microsoft Search in Bing](https://docs.microsoft.com/MicrosoftSearch/security-for-search#microsoft-search-in-bing-protects-workplace-searches), Bing Answers in Cortana has implemented a set of trust measures, described below, that govern how the separate search of public results from Bing.com is handled. The Bing Answers in Cortana trust measures are consistent with the enhanced privacy and security measures described in [Microsoft Search in Bing](https://docs.microsoft.com/MicrosoftSearch/security-for-search). All Bing.com search logs that pertain to Cortana traffic are disassociated from users' workplace identity. All Cortana queries issued via a work or school account are stored separately from public, non-Cortana traffic. + +Bing Answers is enabled by default for all users. However, admins can configure and change this for specific users and user groups in their organization. + +## How the Bing Answer policy configuration is applied +Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of an AAD group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-1.md b/windows/configuration/cortana-at-work/test-scenario-1.md new file mode 100644 index 0000000000..27402c3b61 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-1.md @@ -0,0 +1,46 @@ +--- +title: Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook +description: A test scenario about how to sign in with your work or school account and use Cortana to manage the notebook. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook + +This scenario turns on Azure AD and lets your employee use Cortana to manage an entry in the notebook. + +## Sign in with your work or school account + +This process helps you to sign out of a Microsoft Account and to sign into an Azure AD account. + +1. Click on the **Cortana** icon in the taskbar, then click the profile picture in the navigation to open Cortana settings. + +2. Click your email address. + +A dialog box appears, showing the associated account info. + +3. Click **Sign out** under your email address. + +This signs out the Microsoft account, letting you continue to add your work or school account. + +4. Open Cortana again and select the **Sign in** glyph in the left rail and follow the instructions to sign in with your work or school account. + +## Use Cortana to manage the notebook content + +This process helps you to manage the content Cortana shows in your Notebook. + +1. Select the **Cortana** icon in the taskbar, click **Notebook**, select **Manage Skills.** Scroll down and click **Weather**. + +2. In the **Weather** settings, scroll down to the **Cities you're tracking** area, and then click **Add a city**. + +3. Add **Redmond, Washington**. + +> [!IMPORTANT] +> The data created as part of these scenarios will be uploaded to Microsoft's Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-2.md b/windows/configuration/cortana-at-work/test-scenario-2.md new file mode 100644 index 0000000000..caf24e5f85 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-2.md @@ -0,0 +1,38 @@ +--- +title: Test scenario 2 - Perform a quick search with Cortana at work +description: A test scenario about how to perform a quick search with Cortana at work. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 2 – Perform a quick search with Cortana at work + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you perform a quick search using Cortana, both by typing and through voice commands. + +## Search using Cortana + +1. Click on the Cortana icon in the taskbar, and then click in the Search bar. + +2. Type **Type Weather in New York**. + +You should see the weather in New York, New York at the top of the search results. +Insert screenshot + +## Search with Cortana, by using voice commands + +This process helps you to use Cortana at work and voice commands to perform a quick search. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box). + +2. Say **What's the weather in Chicago?** Cortana tells you and shows you the current weather in Chicago. +Insert screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-3.md b/windows/configuration/cortana-at-work/test-scenario-3.md new file mode 100644 index 0000000000..e348a1cee9 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-3.md @@ -0,0 +1,79 @@ +--- +title: Test scenario 3 - Set a reminder for a specific location using Cortana at work +description: A test scenario about how to set up, review, and edit a reminder based on a location. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 3 - Set a reminder for a specific location using Cortana at work + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you set up, review, and edit a reminder based on a location. For example, reminding yourself to grab your expense report receipts before you leave the house. + +>[!Note] +>You can set each reminder location individually as you create the reminders, or you can go into the About me screen and add both Work and Home addresses as favorites. Make sure that you use real addresses since you’ll need to go to these locations to complete your testing scenario. + +Additionally, if you’ve turned on the Meeting & reminder cards & notifications option (in the Meetings & reminders option of your Notebook), you’ll also see your pending reminders on the Cortana Home page. + +## Create a reminder for a specific location + +This process helps you to create a reminder based on a specific location. + +1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. + +2. Click the **+** sign, add a subject for your reminder, such as **Remember to file expense report receipts**, and then click **Place**. + +3. Choose **Arrive** from the drop-down box, and then type a location to associate with your reminder. For example, you can use the physical address of where you work. Just make sure you can physically get to your location, so you can test the reminder. + +4. Click **Done**. + +>[!Note] +>If you’ve never used this location before, you’ll be asked to add a name for it so it can be added to the Favorites list in Windows Maps. + +5. Choose to be reminded the Next time you arrive at the location or on a specific day of the week from the drop-down box. + +6. Take a picture of your receipts and store them locally on your device. + +7. Click **Add Photo**, click **Library**, browse to your picture, and then click **OK**. + +The photo is stored with the reminder. + +Insert screenshot 6 + +8. Review the reminder info, and then click **Remind**. + +The reminder is saved and ready to be triggered. +Insert screenshot + +## Create a reminder for a specific location by using voice commands + +This process helps you to use Cortana at work and voice commands to create a reminder for a specific location. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone* icon (to the right of the Search box). + +2. Say **Remind me to grab my expense report receipts before I leave home**. + +Cortana opens a new reminder task and asks if it sounds good. +insert screenshot + +3. Say **Yes** so Cortana can save the reminder. +insert screenshot + +## Edit or archive an existing reminder + +This process helps you to edit or archive and existing or completed reminder. + +1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. + +2. Click the pending reminder you want to edit. + +3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click Save to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-4.md b/windows/configuration/cortana-at-work/test-scenario-4.md new file mode 100644 index 0000000000..a0ea0e6332 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-4.md @@ -0,0 +1,52 @@ +--- +title: Use Cortana at work to find your upcoming meetings (Windows 10) +description: A test scenario about how to use Cortana at work to find your upcoming meetings. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 4 - Use Cortana at work to find your upcoming meetings + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you search for both general upcoming meetings, and specific meetings, both manually and verbally. + +>[!Note] +>If you’ve turned on the Meeting & reminder cards & notifications option (in the Meetings & reminders option of your Notebook), you’ll also see your pending reminders on the Cortana Home page. + +## Find out about upcoming meetings + +This process helps you find your upcoming meetings. + +1. Check to make sure your work calendar is connected and synchronized with your Azure AD account. + +2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. + +3. Type **Show me my meetings for tomorrow**. + +You’ll see all your meetings scheduled for the next day. + +Cortana at work, showing all upcoming meetings +screenshot + +## Find out about upcoming meetings by using voice commands + +This process helps you to use Cortana at work and voice commands to find your upcoming meetings. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box. + +2. Say **Show me what meeting I have at 3pm tomorrow**. + +>[!Important] +>Make sure that you have a meeting scheduled for the time you specify here. + +Cortana at work, showing the meeting scheduled for 3pm +screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md new file mode 100644 index 0000000000..ec1cb06e32 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-5.md @@ -0,0 +1,61 @@ +--- +title: Use Cortana to send email to a co-worker (Windows 10) +description: A test scenario about how to use Cortana at work to send email to a co-worker. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 5 - Use Cortana to send email to a co-worker + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you to send an email to a co-worker listed in your work address book, both manually and verbally. + +## Send email to a co-worker + +This process helps you to send a quick message to a co-worker from the work address book. + +1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. + +2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. + +3. Type **Send an email to **. + +Where is the name of someone in your work address book. + +4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. + +Cortana at work, showing the email text +screenshot + +## Send an email to a co-worker by using voice commands + +This process helps you to use Cortana at work and voice commands to send a quick message to a co-worker from the work address book. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box. + +2. Say **Send an email** to . + +Where is the name of someone in your work address book. + +3. Add your email message by saying, **Hello this is a test email using Cortana at work**. + +The message is added and you’re asked if you want to **Send it**, **Add more**, or **Make changes**. + +Cortana at work, showing the email text created from verbal commands +screenshot + +4. Say **Send it**. + +The email is sent. + +Cortana at work, showing the sent email text +screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-6.md b/windows/configuration/cortana-at-work/test-scenario-6.md new file mode 100644 index 0000000000..cd22204b99 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-6.md @@ -0,0 +1,48 @@ +--- +title: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email +description: A test scenario about how to use Cortana with the Suggested reminders feature. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). + +Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, I’ll get this to you by the end of the week in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it. + +>[!Important] +>The Suggested reminders feature is currently only available in English (en-us). + +## Use Cortana to create suggested reminders for you + +1. Make sure that you've connected Cortana to Office 365. For the steps to connect, see [Set up and test Cortana with Office 365 in your organization](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365). + +2. Click on the **Cortana** search box in the taskbar, click the **Notebook** icon, and then click **Permissions**. + +3. Make sure the **Contacts**, **email**, **calendar**, and **communication history** option is turned on. + +Permissions options for Cortana at work +screenshot + +4. Click the **Notebook** icon again, click the **Suggested reminders** option, click to turn on the **All reminder suggestions cards** option, click the **Notify me when something I mentioned doing is coming up** box, and then click **Save**. + +Suggested reminders options for Cortana at work +screenshot + +5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, **I’ll finish this project by end of day today**. + +6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. + +If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed. + +Cortana Home screen with your suggested reminder showing +screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md b/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md new file mode 100644 index 0000000000..01bd26ace5 --- /dev/null +++ b/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md @@ -0,0 +1,25 @@ +--- +title: Testing scenarios using Cortana in your business or organization +description: A list of suggested testing scenarios that you can use to test Cortana in your organization. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Testing scenarios using Cortana in your business or organization + +We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: + +- [Sign in with your work or school account and use Cortana to manage the notebook](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1) +- [Perform a quick search with Cortana at work](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2) +- [Set a reminder for a specific location using Cortana at work](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3) +- [Use Cortana at work to find your upcoming meetings](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4) +- [Use Cortana to send email to a co-worker](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5) +- [Review a reminder suggested by Cortana based on what you've promised in email](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6) +- [Use Cortana and Windows Information Protection (WIP) to help protect your organization's data on a device](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7) \ No newline at end of file diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index 7ac4b1ff90..ad794f7530 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -93,7 +93,7 @@ When you have the Start layout that you want your users to see, use the [Export- `Export-StartLayout –path .xml` - On a device running Windows 10, version 1809, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example: + On a device running Windows 10, version 1809 or higher, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example: ```PowerShell Export-StartLayout -UseDesktopApplicationID -Path layout.xml @@ -117,11 +117,11 @@ When you have the Start layout that you want your users to see, use the [Export- -

              <LayoutModificationTemplate Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
              +    
              <LayoutModificationTemplate Version="1" xmlns="https://schemas.microsoft.com/Start/2014/LayoutModification">
                     <DefaultLayoutOverride>
                       <StartLayoutCollection>
              -          <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">
              -            <start:Group Name="Life at a glance" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
              +          <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="https://schemas.microsoft.com/Start/2014/FullDefaultLayout">
              +            <start:Group Name="Life at a glance" xmlns:start="https://schemas.microsoft.com/Start/2014/StartLayout">
                             <start:Tile Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
                             <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI" />
                             <start:Tile Size="2x2" Column="2" Row="0" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
              @@ -191,7 +191,7 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed
               - [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md)
               - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
               - [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
              -- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
              +- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
               - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
               
               
              diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
              index 0647e4eec3..3cd4ad2b71 100644
              --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
              +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
              @@ -12,7 +12,6 @@ author: dansimp
               ms.localizationpriority: medium
               ms.author: dansimp
               ms.topic: article
              -ms.date: 11/15/2017
               ---
               
               # Customize Windows 10 Start and taskbar with Group Policy
              diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md
              index bda947c233..047006fce2 100644
              --- a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md
              +++ b/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md
              @@ -1,5 +1,5 @@
               ---
              -title: Customize Windows 10 Start and taskbar with mobile device management (MDM) (Windows 10)
              +title: Alter Windows 10 Start and taskbar via mobile device management
               description: In Windows 10, you can use a mobile device management (MDM) policy to deploy a customized Start and tasbkar layout to users.
               ms.assetid: F487850D-8950-41FB-9B06-64240127C1E4
               ms.reviewer: 
              diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
              index 56de2504c6..369f3eb6fb 100644
              --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
              +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
              @@ -12,7 +12,6 @@ author: dansimp
               ms.author: dansimp
               ms.topic: article
               ms.localizationpriority: medium
              -ms.date: 11/15/2017
               ---
               
               # Customize Windows 10 Start and taskbar with provisioning packages
              @@ -23,12 +22,12 @@ ms.date: 11/15/2017
               - Windows 10
               
               
              ->**Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
              +> **Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
               
               In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, version 1703, you can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead.
               
              ->[!IMPORTANT]
              ->If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy.
              +> [!IMPORTANT]
              +> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy.
               
               **Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions.
               
              @@ -39,15 +38,16 @@ Three features enable Start and taskbar layout control:
               
               -   The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. 
               
              -    >[!NOTE]
              -    >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet.
              +    > [!NOTE]
              +    > To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet.
               
               -    [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include  `` or create an .xml file just for the taskbar configuration.
               
               -   In Windows Configuration Designer, you use the **Policies/Start/StartLayout** setting to provide the contents of the .xml file that defines the Start and taskbar layout.
               
              -
              -## Prepare the Start layout XML file
              +
              +
              +## Prepare the Start layout XML file
               
               The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. 
               
              @@ -61,8 +61,8 @@ The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configur
               
               Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md)
               
              ->[!IMPORTANT]
              ->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
              +> [!IMPORTANT]
              +> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
               
               1.  Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
               
              @@ -76,8 +76,8 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
               
               6. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**.
               
              -   >[!TIP]
              -   >If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**.
              +   > [!TIP]
              +   > If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**.
               
               7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step.
               
              @@ -130,7 +130,6 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
               
               ## Related topics
               
              -
               - [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md)
               - [Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
               - [Customize and export Start layout](customize-and-export-start-layout.md)
              @@ -139,12 +138,3 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
               - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
               - [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
               - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
              -
              - 
              -
              - 
              -
              -
              -
              -
              -
              diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json
              index af378be469..662747f3a4 100644
              --- a/windows/configuration/docfx.json
              +++ b/windows/configuration/docfx.json
              @@ -32,18 +32,19 @@
                   "externalReference": [],
                   "globalMetadata": {
                     "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
              +      "uhfHeaderId": "MSDocsHeader-M365-IT",
                     "ms.technology": "windows",
                     "audience": "ITPro",
                     "ms.topic": "article",
              -      "feedback_system": "GitHub",
              -      "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
              -      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
              +      "feedback_system": "None",
              +      "hideEdit": true,
                     "_op_documentIdPathDepotMapping": {
                       "./": {
                         "depot_name": "MSDN.win-configuration",
                         "folder_relative_path_in_docset": "./"
                       }
              -      }
              +      },
              +      "titleSuffix": "Configure Windows"
                   },
                   "fileMetadata": {},
                   "template": [],
              diff --git a/windows/configuration/images/Shared_PC_1.jpg b/windows/configuration/images/Shared_PC_1.jpg
              new file mode 100644
              index 0000000000..7b993b00a8
              Binary files /dev/null and b/windows/configuration/images/Shared_PC_1.jpg differ
              diff --git a/windows/configuration/images/Shared_PC_2.png b/windows/configuration/images/Shared_PC_2.png
              new file mode 100644
              index 0000000000..c9d2362634
              Binary files /dev/null and b/windows/configuration/images/Shared_PC_2.png differ
              diff --git a/windows/configuration/images/Shared_PC_3.png b/windows/configuration/images/Shared_PC_3.png
              new file mode 100644
              index 0000000000..83b3a66fc8
              Binary files /dev/null and b/windows/configuration/images/Shared_PC_3.png differ
              diff --git a/windows/configuration/images/sccm-asset.PNG b/windows/configuration/images/configmgr-asset.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-asset.PNG
              rename to windows/configuration/images/configmgr-asset.PNG
              diff --git a/windows/configuration/images/sccm-client.PNG b/windows/configuration/images/configmgr-client.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-client.PNG
              rename to windows/configuration/images/configmgr-client.PNG
              diff --git a/windows/configuration/images/sccm-collection.PNG b/windows/configuration/images/configmgr-collection.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-collection.PNG
              rename to windows/configuration/images/configmgr-collection.PNG
              diff --git a/windows/configuration/images/sccm-install-os.PNG b/windows/configuration/images/configmgr-install-os.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-install-os.PNG
              rename to windows/configuration/images/configmgr-install-os.PNG
              diff --git a/windows/configuration/images/sccm-post-refresh.PNG b/windows/configuration/images/configmgr-post-refresh.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-post-refresh.PNG
              rename to windows/configuration/images/configmgr-post-refresh.PNG
              diff --git a/windows/configuration/images/sccm-pxe.PNG b/windows/configuration/images/configmgr-pxe.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-pxe.PNG
              rename to windows/configuration/images/configmgr-pxe.PNG
              diff --git a/windows/configuration/images/sccm-site.PNG b/windows/configuration/images/configmgr-site.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-site.PNG
              rename to windows/configuration/images/configmgr-site.PNG
              diff --git a/windows/configuration/images/sccm-software-cntr.PNG b/windows/configuration/images/configmgr-software-cntr.PNG
              similarity index 100%
              rename from windows/configuration/images/sccm-software-cntr.PNG
              rename to windows/configuration/images/configmgr-software-cntr.PNG
              diff --git a/windows/configuration/images/sccm-assets.PNG b/windows/configuration/images/sccm-assets.PNG
              deleted file mode 100644
              index 2cc50f5758..0000000000
              Binary files a/windows/configuration/images/sccm-assets.PNG and /dev/null differ
              diff --git a/windows/configuration/index.md b/windows/configuration/index.md
              index 6517e9e14f..6d72ff398f 100644
              --- a/windows/configuration/index.md
              +++ b/windows/configuration/index.md
              @@ -1,16 +1,16 @@
               ---
               title: Configure Windows 10 (Windows 10)
              -description: Learn about configuring Windows 10.
              +description: Apply custom accessibility configurations to devices for their users using the all the features and methods available with Windows 10.
               keywords: Windows 10, MDM, WSUS, Windows update
               ms.prod: w10
               ms.mktglfcycl: manage
               ms.sitesec: library
               ms.pagetype: security
               ms.localizationpriority: high
              -author: jdeckerms
              -ms.author: jdecker
              +manager: dansimp
              +author: dansimp
              +ms.author: dansimp
               ms.topic: article
              -ms.date: 05/11/2018
               ---
               
               # Configure Windows 10
              diff --git a/windows/configuration/kiosk-mdm-bridge.md b/windows/configuration/kiosk-mdm-bridge.md
              index b08ebebd2c..ff85a3537a 100644
              --- a/windows/configuration/kiosk-mdm-bridge.md
              +++ b/windows/configuration/kiosk-mdm-bridge.md
              @@ -1,6 +1,6 @@
               ---
               title: Use MDM Bridge WMI Provider to create a Windows 10 kiosk (Windows 10)
              -description: Environments that use Windows Management Instrumentation (WMI)can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class.
              +description: Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class.
               ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC
               ms.reviewer: 
               manager: dansimp
              @@ -22,9 +22,9 @@ ms.topic: article
               
               -   Windows 10 Pro, Enterprise, and Education
               
              -Environments that use [Windows Management Instrumentation (WMI)](https://msdn.microsoft.com/library/aa394582.aspx) can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. See [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider) for more details about using a PowerShell script to configure AssignedAccess. 
              +Environments that use [Windows Management Instrumentation (WMI)](https://msdn.microsoft.com/library/aa394582.aspx) can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. For more information about using a PowerShell script to configure AssignedAccess, see [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). 
               
              -Here’s an example to set AssignedAccess configuration:
              +Here's an example to set AssignedAccess configuration:
               
               1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx).  
               2. Run `psexec.exe -i -s cmd.exe`.
              @@ -35,7 +35,8 @@ Here’s an example to set AssignedAccess configuration:
               $nameSpaceName="root\cimv2\mdm\dmmap"
               $className="MDM_AssignedAccess"
               $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
              -$obj.Configuration = @"
              +Add-Type -AssemblyName System.Web
              +$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@"
               
               
                 
              @@ -84,7 +85,7 @@ $obj.Configuration = @"
                   
                 
               
              -"@
              +"@)
               
               Set-CimInstance -CimInstance $obj
               ```
              diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md
              index c319385e70..0ff39ff4c9 100644
              --- a/windows/configuration/kiosk-methods.md
              +++ b/windows/configuration/kiosk-methods.md
              @@ -3,7 +3,7 @@ title: Configure kiosks and digital signs on Windows desktop editions (Windows 1
               ms.reviewer: 
               manager: dansimp
               ms.author: dansimp
              -description: Learn about the methods for configuring kiosks.
              +description: In this article, learn about the methods for configuring kiosks and digital signs on Windows desktop editions.
               ms.prod: w10
               ms.mktglfcycl: manage
               ms.sitesec: library
              diff --git a/windows/configuration/kiosk-policies.md b/windows/configuration/kiosk-policies.md
              index a523b64e83..0f99ece694 100644
              --- a/windows/configuration/kiosk-policies.md
              +++ b/windows/configuration/kiosk-policies.md
              @@ -40,7 +40,6 @@ Remove access to the context menus for the task bar	| Enabled
               Clear history of recently opened documents on exit |	Enabled
               Prevent users from customizing their Start Screen |	Enabled
               Prevent users from uninstalling applications from Start |		Enabled
              -Remove All Programs list from the Start menu |		Enabled
               Remove Run menu from Start Menu	 |	Enabled
               Disable showing balloon notifications as toast |		Enabled
               Do not allow pinning items in Jump Lists |		Enabled
              diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md
              index c3491784d7..f7be8e35d2 100644
              --- a/windows/configuration/kiosk-prepare.md
              +++ b/windows/configuration/kiosk-prepare.md
              @@ -1,6 +1,6 @@
               ---
               title: Prepare a device for kiosk configuration (Windows 10)
              -description: Some tips for device settings on kiosks.
              +description: Learn how to prepare a device for kiosk configuration. Also, learn about the recommended kiosk configuration changes.
               ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC
               ms.reviewer: 
               manager: dansimp
              @@ -21,15 +21,15 @@ ms.topic: article
               
               -   Windows 10 Pro, Enterprise, and Education
               
              ->[!WARNING]
              ->For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with least privilege, such as a local standard user account.
              +> [!WARNING]
              +> For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with the least privileges, such as a local standard user account.
               >
              ->Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
              +> Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that might allow an attacker subverting the assigned access application to gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
               
              ->[!IMPORTANT]
              ->[User account control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode.
              +> [!IMPORTANT]
              +> [User account control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode.
               >
              ->Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk.
              +> Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk.
               
               ## Configuration recommendations
               
              @@ -60,24 +60,24 @@ Logs can help you [troubleshoot issues](multi-app-kiosk-troubleshoot.md) kiosk i
               
               In addition to the settings in the table, you may want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, whether from an update or power outage, you can sign in the assigned access account manually or you can configure the device to sign in to the assigned access account automatically. Make sure that Group Policy settings applied to the device do not prevent automatic sign in.
               
              ->[!NOTE]
              ->If you are using a Windows 10 and later device restriction CSP to set "Preferred Azure AD tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile.
              +> [!NOTE]
              +> If you are using a Windows 10 and later device restriction CSP to set "Preferred Azure AD tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile.
               
              ->[!TIP]
              ->If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. 
              +> [!TIP]
              +> If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. 
               
               
               **How to edit the registry to have an account sign in automatically**
               
               1. Open Registry Editor (regedit.exe).
               
              -   >[!NOTE]
              -   >If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002).
              +   > [!NOTE]
              +   > If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002).
                 
                
               2. Go to
               
              -   **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\WindowsNT\CurrentVersion\Winlogon**
              +   **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon**
               
               3. Set the values for the following keys.
               
              @@ -94,9 +94,11 @@ In addition to the settings in the table, you may want to set up **automatic log
               
               4. Close Registry Editor. The next time the computer restarts, the account will sign in automatically.
               
              ->[!TIP]
              ->You can also configure automatic sign-in [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon).
              +> [!TIP]
              +> You can also configure automatic sign-in [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon).
               
              +> [!NOTE]
              +> If you are also using [Custom Logon](https://docs.microsoft.com/windows-hardware/customize/enterprise/custom-logon) with **HideAutoLogonUI** enabled, you might experience a black screen after a password expires. We recommend that you consider [setting the password to never expire](https://docs.microsoft.com/windows-hardware/customize/enterprise/troubleshooting-custom-logon#the-device-displays-a-black-screen-when-a-password-expiration-screen-is-displayed).
               
               ## Interactions and interoperability
               
              @@ -156,7 +158,7 @@ The following table describes some features that have interoperability issues we
               
               

              Key sequences blocked by assigned access

              When in assigned access, some key combinations are blocked for assigned access users.

              -

              Alt+F4, Alt+Shift+TaB, Alt+Tab are not blocked by Assigned Access, it is recommended you use Keyboard Filter to block these key combinations.

              +

              Alt+F4, Alt+Shift+Tab, Alt+Tab are not blocked by Assigned Access, it is recommended you use Keyboard Filter to block these key combinations.

              Ctrl+Alt+Delete is the key to break out of Assigned Access. If needed, you can use Keyboard Filter to configure a different key combination to break out of assigned access by setting BreakoutKeyScanCode as described in WEKF_Settings.

              @@ -245,13 +247,13 @@ The following table describes some features that have interoperability issues we
              + - ## Testing your kiosk in a virtual machine (VM) Customers sometimes use virtual machines (VMs) to test configurations before deploying those configurations to physical devices. If you use a VM to test your single-app kiosk configuration, you need to know how to connect to the VM properly. -A single-app kiosk configuration runs an app above the lockscreen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. +A single-app kiosk configuration runs an app above the lock screen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** is not selected in the **View** menu; that means it's a basic session. @@ -259,4 +261,4 @@ When you connect to a VM configured as a single-app kiosk, you need a *basic* se To connect to a VM in a basic session, do not select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog. -![Do not select connect button, use close X in corner](images/vm-kiosk-connect.png) +![Do not select the connect button, use "close X" in the top corner](images/vm-kiosk-connect.png) diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md index 327042ee5c..43317581df 100644 --- a/windows/configuration/kiosk-shelllauncher.md +++ b/windows/configuration/kiosk-shelllauncher.md @@ -20,10 +20,7 @@ ms.topic: article **Applies to** - Windows 10 Ent, Edu ->[!WARNING] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -Using Shell Launcher, you can configure a device that runs an application as the user interface, replacing the default shell (explorer.exe). In **Shell Launcher v1**, available in Windows 10, version 1809 and earlier, you can only specify a Windows desktop application as the replacement shell. In **Shell Launcher v2**, available in the next feature update to Windows 10, you can also specify a UWP app as the replacement shell. +Using Shell Launcher, you can configure a device that runs an application as the user interface, replacing the default shell (explorer.exe). In **Shell Launcher v1**, available in Windows 10, you can only specify a Windows desktop application as the replacement shell. In **Shell Launcher v2**, available in Windows 10, version 1809 and above, you can also specify a UWP app as the replacement shell. To use **Shell Launcher v2** in version 1809, you need to install the [KB4551853](https://support.microsoft.com/help/4551853) update. >[!NOTE] >Shell Launcher controls which application the user sees as the shell after sign-in. It does not prevent the user from accessing other desktop applications and system components. diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index fec62e33fd..92c0f753d1 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -51,6 +51,7 @@ Method | Description + ## Set up a kiosk in local Settings >App type: UWP @@ -122,6 +123,7 @@ To remove assigned access, choose **Turn off assigned access and sign out of the + ## Set up a kiosk using Windows PowerShell @@ -182,6 +184,7 @@ Clear-AssignedAccess + ## Set up a kiosk using the kiosk wizard in Windows Configuration Designer >App type: UWP or Windows desktop application @@ -234,6 +237,7 @@ When you use the **Provision kiosk devices** wizard in Windows Configuration Des + ## Set up a kiosk or digital sign using Microsoft Intune or other MDM service >App type: UWP diff --git a/windows/configuration/kiosk-troubleshoot.md b/windows/configuration/kiosk-troubleshoot.md index 6a42e81700..479b7ca96e 100644 --- a/windows/configuration/kiosk-troubleshoot.md +++ b/windows/configuration/kiosk-troubleshoot.md @@ -1,6 +1,6 @@ --- title: Troubleshoot kiosk mode issues (Windows 10) -description: Tips for troubleshooting multi-app kiosk configuration. +description: Learn how to troubleshoot single-app and multi-app kiosk configurations, as well as common problems like sign-in issues. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 ms.reviewer: manager: dansimp diff --git a/windows/configuration/kiosk-validate.md b/windows/configuration/kiosk-validate.md index ea34adf834..02e0fbc422 100644 --- a/windows/configuration/kiosk-validate.md +++ b/windows/configuration/kiosk-validate.md @@ -1,6 +1,6 @@ --- title: Validate kiosk configuration (Windows 10) -description: This topic explains what to expect on a multi-app kiosk. +description: In this article, learn what to expect on a multi-app kiosk in Windows 10 Pro, Enterprise, and Education. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC ms.reviewer: manager: dansimp diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index cf28c53e4a..c0eb573c32 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -1,6 +1,6 @@ --- title: Assigned Access configuration kiosk XML reference (Windows 10) -description: XML and XSD for kiosk device configuration. +description: Learn about the assigned access configuration (kiosk) for XML and XSD for kiosk device configuration in Windows 10. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 ms.reviewer: manager: dansimp @@ -255,7 +255,7 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom ``` ## [Preview] Global Profile Sample XML -Global Profile is currently supported in Windows 10 Insider Preview (19H2, 20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user. +Global Profile is currently supported in Windows 10 Insider Preview (20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or used as mitigation when a profile cannot be determined for a user. This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in ```xml @@ -309,7 +309,7 @@ This sample demonstrates that only a global profile is used, no active user conf ``` -Below sample shows dedicated profile and global profile mixed usage, aauser would use one profile, everyone else that's non-admin will use another profile. +Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile. ```xml @@ -889,7 +889,7 @@ Schema for Windows 10 Insider Preview (19H2, 20H1 builds) ``` -To authorize a compatible configuration XML that includes elements and attributes from Windows 10, version 1809 or newer, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature which is added in Windows 10, version 1809, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10, version 1809, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +To authorize a compatible configuration XML that includes elements and attributes from Windows 10, version 1809 or newer, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the autolaunch feature that was added in Windows 10, version 1809, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10, version 1809, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. ```xml
              - Assign [group accounts to a config profile](#config-for-group-accounts)

              - Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 | -| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions)

              - [Automatically launch an app](#allowedapps) when the user signs in

              - Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809

              **Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `http://schemas.microsoft.com/AssignedAccess/201810/config`. | +| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions)

              - [Automatically launch an app](#allowedapps) when the user signs in

              - Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809

              **Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `https://schemas.microsoft.com/AssignedAccess/201810/config`. | >[!WARNING] >The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. @@ -88,8 +88,8 @@ You can start your file by pasting the following XML (or any other examples in t ```xml @@ -199,8 +199,8 @@ The following example shows how to allow user access to the Downloads folder in ```xml @@ -219,7 +219,7 @@ The following example shows how to allow user access to the Downloads folder in ``` -FileExplorerNamespaceRestriction has been extended in current Windows 10 Prerelease for finer granularity and easier use, see in the [Assigned access XML reference.](kiosk-xml.md) for full samples. The changes will allow IT Admin to configure if user can access Downloads folder, Removable drives, or no restriction at all by using certain new elements. Note that FileExplorerNamesapceRestrictions and AllowedNamespace:Downloads are available in namespace http://schemas.microsoft.com/AssignedAccess/201810/config, AllowRemovableDrives and NoRestriction are defined in a new namespace http://schemas.microsoft.com/AssignedAccess/2020/config. +FileExplorerNamespaceRestriction has been extended in current Windows 10 Prerelease for finer granularity and easier use, see in the [Assigned access XML reference.](kiosk-xml.md) for full samples. The changes will allow IT Admin to configure if user can access Downloads folder, Removable drives, or no restriction at all by using certain new elements. Note that FileExplorerNamesapceRestrictions and AllowedNamespace:Downloads are available in namespace https://schemas.microsoft.com/AssignedAccess/201810/config, AllowRemovableDrives and NoRestriction are defined in a new namespace https://schemas.microsoft.com/AssignedAccess/2020/config. * When FileExplorerNamespaceRestrictions node is not used, or used but left empty, user will not be able to access any folder in common dialog (e.g. Save As in Microsoft Edge browser). * When Downloads is mentioned in allowed namespace, user will be able to access Downloads folder. @@ -244,7 +244,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ```xml - + @@ -411,7 +411,7 @@ Group accounts are specified using ``. Nested groups are not supporte #### [Preview] Global Profile -Global profile is added in curernt Windows 10 Prerelease. There are times when IT Admin wants to everyone who logging into a specific devices are assigned access users, even there is no dedicated profile for that user, or there are times that Assigned Access could not identify a profile for the user and a fallback profile is wished to use. Global Profile is designed for these scenarios. +Global profile is added in current Windows 10 Prerelease. There are times when IT Admin wants to everyone who logging into a specific devices are assigned access users, even there is no dedicated profile for that user, or there are times that Assigned Access could not identify a profile for the user and a fallback profile is wished to use. Global Profile is designed for these scenarios. Usage is demonstrated below, by using the new xml namespace and specify GlobalProfile from that namespace. When GlobalProfile is configured, a non-admin account logs in, if this user does not have designated profile in Assigned Access, or Assigned Access fails to determine a profile for current user, global profile will be applied for the user. @@ -423,9 +423,9 @@ Note: ```xml @@ -438,7 +438,7 @@ Note: - + @@ -591,6 +591,7 @@ To create a multi-app kiosk that can run mixed reality apps, you must include th + ``` These are in addition to any mixed reality apps that you allow. diff --git a/windows/configuration/mobile-devices/provisioning-configure-mobile.md b/windows/configuration/mobile-devices/provisioning-configure-mobile.md index dabf9951dc..340219baab 100644 --- a/windows/configuration/mobile-devices/provisioning-configure-mobile.md +++ b/windows/configuration/mobile-devices/provisioning-configure-mobile.md @@ -1,6 +1,6 @@ --- -title: Use Windows Configuration Designer to configure Windows 10 Mobile devices (Windows 10) -description: +title: Configure Windows 10 Mobile devices with Configuration Designer +description: Use Windows Configuration Designer to configure Windows 10 Mobile devices keywords: phone, handheld, lockdown, customize ms.prod: w10 ms.mktglfcycl: manage @@ -17,7 +17,7 @@ manager: dansimp # Use Windows Configuration Designer to configure Windows 10 Mobile devices -Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using provisioning packages, ayou can easily specify desired configuration, settings, and information required to enroll the devices into management, and then apply that configuration to target devices in a matter of minutes. +Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using provisioning packages, you can easily specify desired configuration, settings, and information required to enroll the devices into management, and then apply that configuration to target devices in a matter of minutes. A provisioning package (.ppkg) is a container for a collection of configuration settings. Using Windows Configuration Designer, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. diff --git a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md index 4ea4c7f814..f1d9a178fc 100644 --- a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md +++ b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md @@ -1,5 +1,5 @@ --- -title: Settings and quick actions that can be locked down in Windows 10 Mobile (Windows 10) +title: Lock down settings and quick actions in Windows 10 Mobile description: This topic lists the settings and quick actions that can be locked down in Windows 10 Mobile. ms.assetid: 69E2F202-D32B-4FAC-A83D-C3051DF02185 ms.reviewer: diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index 107e1b4b1c..5fe68ff0bd 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -1,6 +1,6 @@ --- -title: Introduction to configuration service providers (CSPs) for IT pros (Windows 10) -description: Configuration service providers (CSPs) expose device configuration settings in Windows 10. +title: Configuration service providers for IT pros (Windows 10) +description: Describes how IT pros and system administrators can use configuration service providers (CSPs) to configure devices. ms.assetid: 25C1FDCA-0E10-42A1-A368-984FFDB2B7B6 ms.reviewer: manager: dansimp @@ -14,25 +14,23 @@ ms.localizationpriority: medium ms.date: 07/27/2017 --- -# Introduction to configuration service providers (CSPs) for IT pros +# Configuration service providers for IT pros **Applies to** - Windows 10 - Windows 10 Mobile -Configuration service providers (CSPs) expose device configuration settings in Windows 10. This topic is written for people who have no experience with CSPs. +This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows 10 and Windows 10 Mobile in their organizations. CSPs expose device configuration settings in Windows 10. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390). -The CSPs are documented on the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. - ->[!NOTE] ->This explanation of CSPs and CSP documentation also applies to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. +> [!NOTE] +> The information provided here about CSPs and CSP documentation also applies to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. [See what's new for CSPs in Windows 10, version 1809.](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1809) ## What is a CSP? -A CSP is an interface in the client operating system, between configuration settings specified in a provisioning document, and configuration settings on the device. CSPs are similar to Group Policy client-side extensions, in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable, and some are read-only. +In the client operating system, a CSP is the interface between configuration settings that are specified in a provisioning document and configuration settings that are on the device. CSPs are similar to Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files, or permissions. Some of these settings are configurable, and some are read-only. Starting with Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. On the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. @@ -42,15 +40,15 @@ CSPs are behind many of the management tasks and policies for Windows 10, both i ![how intune maps to csp](../images/policytocsp.png) -CSPs receive configuration policies in the XML-based SyncML format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as System Center Configuration Manager, can also target CSPs, by using a client-side WMI-to-CSP bridge. +CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. ### Synchronization Markup Language (SyncML) -The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based Synchronization Markup Language (SyncML) for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations. +The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based SyncML for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations. ### The WMI-to-CSP Bridge -The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software, such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. +The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. [Learn how to use the WMI Bridge Provider with PowerShell.](https://go.microsoft.com/fwlink/p/?LinkId=761090) @@ -60,7 +58,7 @@ Generally, enterprises rely on Group Policy or MDM to configure and manage devic In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. -Some of the topics in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md), which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. +Some of the articles in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md), which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. ### CSPs in Windows Configuration Designer @@ -74,7 +72,7 @@ Many settings in Windows Configuration Designer will display documentation for t ### CSPs in MDM -Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might simply be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). +Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](https://go.microsoft.com/fwlink/p/?LinkID=616316) to deploy settings. Intune documents [a partial list of settings](https://go.microsoft.com/fwlink/p/?LinkID=616317) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](https://go.microsoft.com/fwlink/p/?LinkId=717390) to locate that information. @@ -116,13 +114,13 @@ The documentation for most CSPs will also include an XML example. ## CSP examples -CSPs provide access to a number of settings useful to enterprises. This section introduces two CSPs that an enterprise might find particularly useful. +CSPs provide access to a number of settings useful to enterprises. This section introduces the CSPs that an enterprise might find useful. - [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) - The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. + The EnterpriseAssignedAccess CSP lets IT administrators configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. - In addition to lockscreen wallpaper, theme, time zone, and language, the EnterpriseAssignedAccess CSP includes AssignedAccessXml which can be used to lock down the device through the following settings: + In addition to lock screen wallpaper, theme, time zone, and language, the EnterpriseAssignedAccess CSP includes AssignedAccessXml that can be used to lock down the device through the following settings: - Enabling or disabling the Action Center. - Configuring the number of tile columns in the Start layout. @@ -132,27 +130,28 @@ CSPs provide access to a number of settings useful to enterprises. This section - Restricting access to the context menu. - Enabling or disabling tile manipulation. - Creating role-specific configurations. + - [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) - The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. + The Policy CSP enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. Some of the settings available in the Policy CSP include the following: - - **Accounts**, such as whether a non-Microsoft account can be added to the device - - **Application management**, such as whether only Microsoft Store apps are allowed - - **Bluetooth**, such as the services allowed to use it - - **Browser**, such as restricting InPrivate browsing - - **Connectivity**, such as whether the device can be connected to a computer by USB - - **Defender** (for desktop only), such as day and time to scan - - **Device lock**, such as the type of PIN or password required to unlock the device - - **Experience**, such as allowing Cortana - - **Security**, such as whether provisioning packages are allowed - - **Settings**, such as allowing the user to change VPN settings - - **Start**, such as applying a standard Start layout - - **System**, such as allowing the user to reset the device - - **Text input**, such as allowing the device to send anonymized user text input data samples to Microsoft - - **Update**, such as specifying whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store - - **WiFi**, such as whether to enable Internet sharing + - **Accounts**, such as whether a non-Microsoft account can be added to the device. + - **Application management**, such as whether only Microsoft Store apps are allowed. + - **Bluetooth**, such as the services allowed to use it. + - **Browser**, such as restricting InPrivate browsing. + - **Connectivity**, such as whether the device can be connected to a computer by USB. + - **Defender** (for desktop only), such as day and time to scan. + - **Device lock**, such as the type of PIN or password required to unlock the device. + - **Experience**, such as allowing Cortana. + - **Security**, such as whether provisioning packages are allowed. + - **Settings**, such as enabling the user to change VPN settings. + - **Start**, such as applying a standard Start layout. + - **System**, such as allowing the user to reset the device. + - **Text input**, such as allowing the device to send anonymized user text input data samples to Microsoft. + - **Update**, such as whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. + - **WiFi**, such as whether Internet sharing is enabled. Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index cbcb56ed0d..f82225a7fe 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -1,6 +1,6 @@ --- title: Provision PCs with apps (Windows 10) -description: Add apps to a Windows 10 provisioning package. +description: Learn how to install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. keywords: ["runtime provisioning", "provisioning package"] ms.prod: w10 ms.mktglfcycl: deploy @@ -27,7 +27,7 @@ In Windows 10, version 1703, you can install multiple Universal Windows Platform When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). >[!IMPORTANT] ->If you plan to use Intune to manage your devices, we recommend using Intune to install Office 365 ProPlus 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Office 365 ProPlus). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Office 365 ProPlus 2016 apps using Microsoft Intune.](https://docs.microsoft.com/intune/apps-add-office365) +>If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Microsoft 365 Apps for enterprise). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Microsoft 365 Apps for enterprise 2016 apps using Microsoft Intune.](https://docs.microsoft.com/intune/apps-add-office365) ## Settings for UWP apps @@ -41,6 +41,9 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate ### MSI installer +> [!NOTE] +> You can find more information about command-line options for Msiexec.exe [here](https://docs.microsoft.com/windows/win32/msi/command-line-options). + - **Command line arguments**: Optionally, append additional command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE - **Continue installations after failure**: Optionally, specify if you want to continue installing additional apps if this app fails to install diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 876859b5a0..5b464073a9 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -1,6 +1,6 @@ --- title: Create a provisioning package (Windows 10) -description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +description: Learn how to create a provisioning package for Windows 10, which lets you quickly configure a device without having to install a new image. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -21,44 +21,46 @@ manager: dansimp - Windows 10 - Windows 10 Mobile -You use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. +You can use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings, and then apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. >[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) ->[!TIP] ->We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. +> [!TIP] +> We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain. ## Start a new project 1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, + - From either the Start screen or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. or - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. + - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then select **ICD.exe**. 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: ![Configuration Designer wizards](../images/icd-create-options-1703.png) - - The wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices. Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizardS](provisioning-packages.md#configuration-designer-wizards). + - The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices: - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for HoloLens wizard](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) - [Instructions for Surface Hub wizard](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) + + Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards). - - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. *The rest of this procedure uses advanced provisioning.* + - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.) >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > > ![Switch to advanced editor](../images/icd-switch.png) -3. Enter a name for your project, and then click **Next**. +3. Enter a name for your project, and then select **Next**. -4. Select the settings you want to configure, based on the type of device, and then click **Next**. The following table describes the options. +4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options. | Windows edition | Settings available for customization | Provisioning package can apply to | @@ -71,12 +73,12 @@ You use Windows Configuration Designer to create a provisioning package (.ppkg) | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) | -5. On the **Import a provisioning package (optional)** page, you can click **Finish** to create your project, or browse to and select an existing provisioning packge to import to your project, and then click **Finish**. +5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**. >[!TIP] ->**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages you create so you don't have to reconfigure those common settings repeatedly. +>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages that you create so you don't have to reconfigure those common settings repeatedly. -After you click **Finish**, Windows Configuration Designer will open the **Available customizations** pane and you can then configure settings for the package. +6. In the **Available customizations** pane, you can now configure settings for the package. @@ -94,7 +96,7 @@ The process for configuring settings is similar for all settings. The following - +
              step one
              Expand a category.
              Expand Certificates category
              step two
              Select a setting.
              Select ClientCertificates
              step three
              Enter a value for the setting. Click Add if the button is displayed.
              Enter a name for the certificate
              step three
              Enter a value for the setting. Select Add if the button is displayed.
              Enter a name for the certificate
              step four
              Some settings, such as this example, require additional information. In Available customizations, select the value you just created, and additional settings are displayed.
              Additional settings for client certificate
              step five
              When the setting is configured, it is displayed in the Selected customizations pane.
              Selected customizations pane
              @@ -106,39 +108,39 @@ For details on each specific setting, see [Windows Provisioning settings referen ## Build package -1. After you're done configuring your customizations, click **Export** and select **Provisioning Package**. +1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. ![Export on top bar](../images/icd-export-menu.png) -2. In the **Describe the provisioning package** window, enter the following information, and then click **Next**: +2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. - - **Version (in Major.Minor format** - - Optional. You can change the default package version by specifying a new value in the **Version** field. + - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. -3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate. Both selections are optional. Click **Next** after you make your selections. +3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: - **Encrypt package** - If you select this option, an auto-generated password will be shown on the screen. - - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package. + - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. >[!NOTE] - >You should only configure provisioning package security when the package is used for device provisioning and the package has contents with sensitive security data such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. + >You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. > >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. -4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows Configuration Designer uses the project folder as the output location. +4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. -5. In the **Build the provisioning package** window, click **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +5. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - If you need to cancel the build, click Cancel. This cancels the current build process, closes the wizard, and takes you back to the Customizations Page. + If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page. -6. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +6. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -7. When you are done, click **Finish** to close the wizard and go back to the Customizations page. +7. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page. **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) @@ -148,7 +150,7 @@ For details on each specific setting, see [Windows Provisioning settings referen - Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) -- [How to bulk-enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://docs.microsoft.com/sccm/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) +- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) ## Related topics diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index f1bf1aa323..6fc7d6234f 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -1,6 +1,6 @@ --- title: Install Windows Configuration Designer (Windows 10) -description: Learn how to install and run Windows Configuration Designer. +description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index b67d2c9fa7..8ef07ace21 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -38,10 +38,10 @@ The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://develop - The tool for creating provisioning packages is renamed Windows Configuration Designer, replacing the Windows Imaging and Configuration Designer (ICD) tool. The components for creating images have been removed from Windows Configuration Designer, which now provides access to runtime settings only. - Windows Configuration Designer can still be installed from the Windows ADK. You can also install it from the Microsoft Store. - Windows Configuration Designer adds more wizards to make it easier to create provisioning packages for specific scenarios. See [What you can configure](#configuration-designer-wizards) for wizard descriptions. -- The wizard **Provision desktop devices** (previously called **Simple provisioning**) now enables joining Azure Active Directory (Azure AD) domains and also allows you to remove non-Microsoft software from Windows desktop devices during provisioning. +- The Provision desktop devices wizard (previously called Simple provisioning) now enables joining Azure Active Directory (Azure AD) domains and also allows you to remove non-Microsoft software from Windows desktop devices during provisioning. - When provisioning packages are applied to a device, a status screen indicates successful or failed provisioning. - Windows 10 includes PowerShell cmdlets that simplify scripted provisioning. Using these cmdlets, you can add provisioning packages, remove provisioning packages and generate log files to investigate provisioning errors. -- The **Provision school devices** wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. +- The Provision school devices wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. @@ -112,15 +112,15 @@ The following table provides some examples of settings that you can configure us | Start menu customization | Start menu layout, application pinning | | Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on | -\* Using a provisioning package for auto-enrollment to System Center Configuration Manager or Configuration Manager/Intune hybrid is not supported. Use the Configuration Manager console to enroll devices. +\* Using a provisioning package for auto-enrollment to Microsoft Endpoint Configuration Manager is not supported. Use the Configuration Manager console to enroll devices. For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). ## Changes to provisioning in Windows 10, version 1607 ->[!NOTE] ->This section is retained for customers using Windows 10, version 1607, on the Current Branch for Business. Some of this information is not applicable in Windows 10, version 1703. +> [!NOTE] +> This section is retained for customers using Windows 10, version 1607, on the Current Branch for Business. Some of this information is not applicable in Windows 10, version 1703. Windows ICD for Windows 10, version 1607, simplified common provisioning scenarios. @@ -130,13 +130,13 @@ Windows ICD in Windows 10, version 1607, supported the following scenarios for I * **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. - > [Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md) +[Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md) * **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use Windows ICD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. * **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows 10 Mobile devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use Windows ICD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include: - * System Center Configuration Manager and Microsoft Intune hybrid (certificate-based enrollment) + * Microsoft Intune (certificate-based enrollment) * AirWatch (password-string based enrollment) * Mobile Iron (password-string based enrollment) * Other MDMs (cert-based enrollment) @@ -146,9 +146,11 @@ Windows ICD in Windows 10, version 1607, supported the following scenarios for I ## Learn more -- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) +For more information about provisioning, watch the following videos: -- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) +- [Provisioning Windows 10 devices with new tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) + +- [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) ## Related topics diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md index ad7c341563..02c28c2b6d 100644 --- a/windows/configuration/provisioning-packages/provisioning-powershell.md +++ b/windows/configuration/provisioning-packages/provisioning-powershell.md @@ -26,7 +26,7 @@ Windows 10, version 1703, ships with Windows Provisioning PowerShell cmdlets. Th - + diff --git a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md index e8ebc96787..8e974645d5 100644 --- a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md +++ b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md @@ -1,5 +1,5 @@ --- -title: Settings changed when you uninstall a provisioning package (Windows 10) +title: Uninstall a provisioning package - reverted settings (Windows 10) description: This topic lists the settings that are reverted when you uninstall a provisioning package. ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/configuration/screenshot1.png b/windows/configuration/screenshot1.png new file mode 100644 index 0000000000..ed62740e92 Binary files /dev/null and b/windows/configuration/screenshot1.png differ diff --git a/windows/configuration/screenshot10.png b/windows/configuration/screenshot10.png new file mode 100644 index 0000000000..5cb1567235 Binary files /dev/null and b/windows/configuration/screenshot10.png differ diff --git a/windows/configuration/screenshot11.png b/windows/configuration/screenshot11.png new file mode 100644 index 0000000000..0ce852ebaa Binary files /dev/null and b/windows/configuration/screenshot11.png differ diff --git a/windows/configuration/screenshot12.png b/windows/configuration/screenshot12.png new file mode 100644 index 0000000000..cd85d80c7e Binary files /dev/null and b/windows/configuration/screenshot12.png differ diff --git a/windows/configuration/screenshot2.png b/windows/configuration/screenshot2.png new file mode 100644 index 0000000000..fb7995600e Binary files /dev/null and b/windows/configuration/screenshot2.png differ diff --git a/windows/configuration/screenshot3.png b/windows/configuration/screenshot3.png new file mode 100644 index 0000000000..07e01661c5 Binary files /dev/null and b/windows/configuration/screenshot3.png differ diff --git a/windows/configuration/screenshot4.png b/windows/configuration/screenshot4.png new file mode 100644 index 0000000000..ab1f083c71 Binary files /dev/null and b/windows/configuration/screenshot4.png differ diff --git a/windows/configuration/screenshot5.png b/windows/configuration/screenshot5.png new file mode 100644 index 0000000000..0ec6fda3a7 Binary files /dev/null and b/windows/configuration/screenshot5.png differ diff --git a/windows/configuration/screenshot6.png b/windows/configuration/screenshot6.png new file mode 100644 index 0000000000..2f3284ee77 Binary files /dev/null and b/windows/configuration/screenshot6.png differ diff --git a/windows/configuration/screenshot7.png b/windows/configuration/screenshot7.png new file mode 100644 index 0000000000..e3d80a3ac9 Binary files /dev/null and b/windows/configuration/screenshot7.png differ diff --git a/windows/configuration/screenshot8.png b/windows/configuration/screenshot8.png new file mode 100644 index 0000000000..f85eaffdff Binary files /dev/null and b/windows/configuration/screenshot8.png differ diff --git a/windows/configuration/screenshot9.png b/windows/configuration/screenshot9.png new file mode 100644 index 0000000000..f617991a63 Binary files /dev/null and b/windows/configuration/screenshot9.png differ diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 139dcce1bb..00fb65ab30 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -9,7 +9,6 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- @@ -36,7 +35,7 @@ It is intended that shared PCs are joined to an Active Directory or Azure Active When the account management service is turned on in shared PC mode, accounts are automatically deleted. Account deletion applies to Active Directory, Azure Active Directory, and local accounts that are created by the **Guest** and **Kiosk** options. Account management is performed both at sign-off time (to make sure there is enough disk space for the next user) as well as during system maintenance time periods. Shared PC mode can be configured to delete accounts immediately at sign-out or when disk space is low. In Windows 10, version 1703, an inactive option is added which deletes accounts if they haven't signed in after a specified number of days. ### Maintenance and sleep -Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not is use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods. +Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not in use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods. While shared PC mode does not configure Windows Update itself, it is strongly recommended to configure Windows Update to automatically install updates and reboot (if necessary) during maintenance hours. This will help ensure the PC is always up to date and not interrupting users with updates. @@ -58,7 +57,7 @@ Apps can take advantage of shared PC mode with the following three APIs: ### Customization -Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring shared PC mode on Windows](#configuring-shared-pc-mode-on-windows). The options are listed in the following table. +Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring Shared PC mode for Windows](#configuring-shared-pc-mode-for-windows). The options are listed in the following table. | Setting | Value | |:---|:---| @@ -80,16 +79,33 @@ Shared PC mode exposes a set of customizations to tailor the behavior to your re | Customization: SleepTimeout | Specifies all timeouts for when the PC should sleep. Enter the amount of idle time in seconds. If you don't set sleep timeout, the default of 1 hour applies. | [Policies: Authentication](wcd/wcd-policies.md#authentication) (optional related setting) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. +## Configuring Shared PC mode for Windows -## Configuring shared PC mode on Windows You can configure Windows to be in shared PC mode in a couple different ways: -- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx). Your MDM policy can contain any of the options listed in the [Customization](#customization) section. The following image shows a Microsoft Intune policy with the shared PC options added as OMA-URI settings. [Learn more about Windows 10 policy settings in Microsoft Intune.](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune) -![custom OMA-URI policy in Intune](images/oma-uri-shared-pc.png) +- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp). To setup a shared device policy for Windows 10 in Intune, complete the following steps: -- A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx), exposed in Windows Configuration Designer as **SharedPC**. + 1. Go to the [Microsoft Endpoint Manager portal](https://endpoint.microsoft.com/#home). + 2. Select **Devices** from the navigation. + 3. Under **Policy**, select **Configuration profiles**. + 4. Select **Create profile**. + 5. From the **Platform** menu, select **Windows 10 and later**. + 6. From the **Profile** menu, select **Shared multi-user device**. -![Shared PC settings in ICD](images/icd-adv-shared-pc.png) + ![custom OMA-URI policy in Intune](images/shared_pc_1.jpg) + + 7. Select **Create**. + 8. Enter a name for the policy (e.g. My Win10 Shared devices policy). You can optionally add a description should you wish to do so. + 9. Select **Next**. + 10. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. + + ![Shared PC settings in ICD](images/shared_pc_3.png) + + 11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**. + +- A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**. + + ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) - WMI bridge: Environments that use Group Policy can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the [MDM_SharedPC class](https://msdn.microsoft.com/library/windows/desktop/mt779129.aspx). For all device settings, the WMI Bridge client must be executed under local system user; for more information, see [Using PowerShell scripting with the WMI Bridge Provider](https://docs.microsoft.com/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). For example, open PowerShell as an administrator and enter the following: diff --git a/windows/configuration/setup-digital-signage.md b/windows/configuration/setup-digital-signage.md index e902d0cfe2..7741d3ba98 100644 --- a/windows/configuration/setup-digital-signage.md +++ b/windows/configuration/setup-digital-signage.md @@ -58,7 +58,7 @@ This procedure explains how to configure digital signage using Kiosk Browser on - Enter a user name and password, and toggle **Auto sign-in** to **Yes**. - Under **Configure the kiosk mode app**, enter the user name for the account that you're creating. - For **App type**, select **Universal Windows App**. - - In **Enter the AUMID for the app**, enter `Microsoft.KioskBrowser_8wekyb3d8bbwe`. + - In **Enter the AUMID for the app**, enter `Microsoft.KioskBrowser_8wekyb3d8bbwe!App`. 11. In the bottom left corner of Windows Configuration Designer, select **Switch to advanced editor**. 12. Go to **Runtime settings** > **Policies** > **KioskBrowser**. Let's assume that the URL for your digital signage content is contoso.com/menu. - In **BlockedUrlExceptions**, enter `https://www.contoso.com/menu`. diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index 2e002f5962..f373bc8c78 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -1,55 +1,52 @@ --- title: Troubleshoot Start menu errors -description: Troubleshoot common errors related to Start menu in Windows 10. +description: Learn how to troubleshoot common Start menu errors in Windows 10. For example, learn to troubleshoot errors related to deployment, crashes, and performance. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.author: dansimp author: dansimp ms.localizationpriority: medium -ms.date: 12/03/18 ms.reviewer: manager: dansimp ms.topic: troubleshooting --- -# Troubleshoot Start Menu errors +# Troubleshoot Start menu errors Start failures can be organized into these categories: - **Deployment/Install issues** - Easiest to identify but difficult to recover. This failure is consistent and usually permanent. Reset, restore from backup, or rollback to recover. - **Performance issues** - More common with older hardware, low-powered machines. Symptoms include: High CPU utilization, disk contention, memory resources. This makes Start very slow to respond. Behavior is intermittent depending on available resources. - **Crashes** - Also easy to identify. Crashes in Shell Experience Host or related can be found in System or Application event logs. This can be a code defect or related to missing or altered permissions to files or registry keys by a program or incorrect security tightening configurations. Determining permissions issues can be time consuming but a [SysInternals tool called Procmon](https://docs.microsoft.com/sysinternals/downloads/procmon) will show **Access Denied**. The other option is to get a dump of the process when it crashes and depending on comfort level, review the dump in the debugger, or have support review the data. -- **Hangs** in Shell Experience host or related. These are the hardest issues to identify as there are few events logged, but behavior is typically intermittent or recovers with a reboot. If a background application or service hangs, Start will not have resources to respond in time. Clean boot may help identify if the issue is related to additional software. Procmon is also useful in this scenario. +- **Hangs** - in Shell Experience host or related. These are the hardest issues to identify as there are few events logged, but behavior is typically intermittent or recovers with a reboot. If a background application or service hangs, Start will not have resources to respond in time. Clean boot may help identify if the issue is related to additional software. Procmon is also useful in this scenario. - **Other issues** - Customization, domain policies, deployment issues. ## Basic troubleshooting -When troubleshooting basic Start issues (and for the most part, all other Windows apps), there are a few things to check if they are not working as expected. When experiencing issues where the Start Menu or sub-component are not working, there are some quick tests to narrow down where the issue may reside. +When troubleshooting basic Start issues (and for the most part, all other Windows apps), there are a few things to check if they are not working as expected. For issues where the Start menu or subcomponent isn't working, you can do some quick tests to narrow down where the issue may reside. ### Check the OS and update version - Is the system running the latest Feature and Cumulative Monthly update? - Did the issue start immediately after an update? Ways to check: - - Powershell:[System.Environment]::OSVersion.Version + - PowerShell:[System.Environment]::OSVersion.Version - WinVer from CMD.exe - - ### Check if Start is installed - If Start fails immediately after a feature update, on thing to check is if the App package failed to install successfully. -- If Start was working and just fails intermittently, it's likely that Start is installed correctly, but the issue occurs downstream. The way to check for this is to look for output from these two PS commands: +- If Start was working and just fails intermittently, it's likely that Start is installed correctly, but the issue occurs downstream. The way to check for this problem is to look for output from these two PS commands: - `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost` - `get-AppXPackage -Name Microsoft.Windows.Cortana` ![Example of output from cmdlets](images/start-ts-1.png) - Failure messages will appear if they are not installed + Failure messages will appear if they aren't installed -- If Start is not installed the fastest resolution is to revert to a known good configuration. This can be rolling back the update, resetting the PC to defaults (where there is a choice to save to delete user data), or restoring from backup. There is no supported method to install Start Appx files. The results are often problematic and unreliable. +- If Start is not installed, then the fastest resolution is to revert to a known good configuration. This can be rolling back the update, resetting the PC to defaults (where there is a choice to save to delete user data), or restoring from backup. No method is supported to install Start Appx files. The results are often problematic and unreliable. ### Check if Start is running @@ -57,7 +54,7 @@ If either component is failing to start on boot, reviewing the event logs for er - `get-process -name shellexperiencehost` - `get-process -name searchui` -If it is installed but not running, test booting into safe mode or use MSCONFIG to eliminate 3rd party or additional drivers and applications. +If it is installed but not running, test booting into safe mode or use MSCONFIG to eliminate third-party or additional drivers and applications. ### Check whether the system a clean install or upgrade @@ -66,7 +63,6 @@ If it is installed but not running, test booting into safe mode or use MSCONFIG - If that file does not exist, the system is a clean install. - Upgrade issues can be found by running `test-path "$env:windir\panther\miglog.xml"` - ### Check if Start is registered or activated - Export the following Event log to CSV and do a keyword search in a text editor or spreadsheet: @@ -80,9 +76,9 @@ If these events are found, Start is not activated correctly. Each event will hav ### Other things to consider -When did this start? +When did the problem start? -- Top issues for Start Menu failure are triggered +- Top issues for Start menu failure are triggered - After an update - After installation of an application - After joining a domain or applying a domain policy @@ -91,7 +87,7 @@ When did this start? - Start or related component crashes or hangs - Customization failure -To narrow this down further, it's good to note: +To narrow down the problem further, it's good to note: - What is the install background? - Was this a deployment, install from media, other @@ -107,7 +103,7 @@ To narrow this down further, it's good to note: - Some Group Policies intended for Windows 7 or older have been known to cause issues with Start - Untested Start Menu customizations can cause unexpected behavior by typically not complete Start failures. -- Is this a virtualized environment? +- Is the environment virtualized? - VMware - Citrix - Other @@ -127,13 +123,13 @@ To narrow this down further, it's good to note: - Microsoft-Windows-CloudStore* -- Check for crashes that may be related to Start (explorer.exe, taskbar, etc) +- Check for crashes that may be related to Start (explorer.exe, taskbar, and so on) - Application log event 1000, 1001 - Check WER reports - C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ - C:\ProgramData\Micrt\Windowsosof\WER\ReportQueue\ -If there is a component of Start that is consistently crashing, capture a dump which can be reviewed by Microsoft Support. +If there is a component of Start that is consistently crashing, capture a dump that can be reviewed by Microsoft Support. ## Common errors and mitigation @@ -173,7 +169,8 @@ The PDC registry key is: **Type**=dword:00000001 In addition to the listed dependencies for the service, Background Tasks Infrastructure Service requires the Power Dependency Coordinator Driver to be loaded. If the PDC does not load at boot, Background Tasks Infrastructure Service will fail and affect Start Menu. -Events for both PDC and Background Tasks Infrastructure Service will be recorded in the event logs. PDC should not be disabled or deleted. BrokerInfrastructure is an automatic service. This Service is required for all these operating Systems as running to have a stable Start Menu. + +Events for both PDC and Background Tasks Infrastructure Service will be recorded in the event logs. PDC shouldn't be disabled or deleted. BrokerInfrastructure is an automatic service. This Service is required for all these operating Systems as running to have a stable Start Menu. >[!NOTE] >You cannot stop this automatic service when machine is running (C:\windows\system32\svchost.exe -k DcomLaunch -p). @@ -183,17 +180,17 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded **Cause**: There was a change in the All Apps list between Windows 10, versions 1511 and 1607. These changes mean the original Group Policy and corresponding registry key no longer apply. -**Resolution**: This issue was resolved in the June 2017 updates. Please update Windows 10, version 1607 to the latest cumulative or feature updates. +**Resolution**: This issue was resolved in the June 2017 updates. Update Windows 10, version 1607, to the latest cumulative or feature updates. >[!NOTE] >When the Group Policy is enabled, the desired behavior also needs to be selected. By default, it is set to **None**. -### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start Menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted +### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted ![Screenshots that show download icons on app tiles and missing app tiles](images/start-ts-2.png) -**Cause**: This is a known issue where the first-time logon experience is not detected and does not trigger the install of some Apps. +**Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps. **Resolution**: This issue has been fixed for Windows 10, version 1709 in [KB 4089848](https://support.microsoft.com/help/4089848) March 22, 2018—KB4089848 (OS Build 16299.334) @@ -206,17 +203,17 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded - Event ID 22 is logged when the xml is malformed, meaning the specified file simply isn’t valid xml. - When editing the xml file, it should be saved in UTF-8 format. -- Unexpected information: This occurs when possibly trying to add a tile via unexpected or undocumented method. +- Unexpected information: This occurs when possibly trying to add a tile via an unexpected or undocumented method. - **Event ID: 64** is logged when the xml is valid but has unexpected values. - For example: The following error occurred while parsing a layout xml file: The attribute 'LayoutCustomizationRestrictiontype' on the element '{http://schemas.microsoft.com/Start/2014/LayoutModification}DefaultLayoutOverride' is not defined in the DTD/Schema. XML files can and should be tested locally on a Hyper-V or other virtual machine before deployment or application by Group Policy -### Symptom: Start menu no longer works after a PC is refreshed using F12 during start up +### Symptom: Start menu no longer works after a PC is refreshed using F12 during startup -**Description**: If a user is having problems with a PC, is can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at start up. Refreshing the PC finishes, but Start Menu is not accessible. +**Description**: If a user is having problems with a PC, it can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at startup. Refreshing the PC finishes, but Start Menu is not accessible. -**Cause**: This is a known issue and has been resolved in a cumulative update released August 30th 2018. +**Cause**: This issue is known and was resolved in a cumulative update released August 30, 2018. **Resolution**: Install corrective updates; a fix is included in the [September 11, 2018-KB4457142 release](https://support.microsoft.com/help/4457142). @@ -236,7 +233,7 @@ Specifically, behaviors include - Applications (apps or icons) pinned to the start menu are missing. - Entire tile window disappears. - The start button fails to respond. -- If a new roaming user is created, the first logon appears normal, but on subsequent logons, tiles are missing. +- If a new roaming user is created, the first sign-in appears normal, but on subsequent sign-ins, tiles are missing. ![Example of a working layout](images/start-ts-3.png) @@ -265,12 +262,12 @@ After the upgrade the user pinned tiles are missing: ![Example of Start screen with previously pinned tiles missing](images/start-ts-6.png) -Additionally, users may see blank tiles if logon was attempted without network connectivity. +Additionally, users may see blank tiles if sign-in was attempted without network connectivity. ![Example of blank tiles](images/start-ts-7.png) -**Resolution**: This is fixed in [October 2017 update](https://support.microsoft.com/en-us/help/4041676). +**Resolution**: This issue was fixed in the [October 2017 update](https://support.microsoft.com/en-us/help/4041676). ### Symptom: Tiles are missing after upgrade from Windows 10, version 1607 to version 1709 for users with Roaming User Profiles (RUP) enabled and managed Start Menu layout with partial lockdown @@ -282,13 +279,13 @@ Additionally, users may see blank tiles if logon was attempted without network c ### Symptom: Start Menu issues with Tile Data Layer corruption -**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update)). +**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update).) **Resolution** There are steps you can take to fix the icons, first is to confirm that is the issue that needs to be addressed. -1. The App or Apps work fine when you click on the tiles. +1. The App or Apps work fine when you select the tiles. 2. The tiles are blank, have a generic placeholder icon, have the wrong or strange title information. -3. The app is missing, but listed as installed via Powershell and works if you launch via URI. +3. The app is missing, but listed as installed via PowerShell and works if you launch via URI. - Example: `windows-feedback://` 4. In some cases, Start can be blank, and Action Center and Cortana do not launch. @@ -305,9 +302,9 @@ Although a reboot is not required, it may help clear up any residual issues afte ### Symptoms: Start Menu and Apps cannot start after upgrade to Windows 10 version 1809 when Symantec Endpoint Protection is installed -**Description** Start Menu, Search and Apps do not start after you upgrade a Windows 7-based computer that has Symantec Endpoint Protection installed to Windows 10 version 1809. +**Description**: Start menu, Search, and Apps do not start after you upgrade a computer running Windows 7 that has Symantec Endpoint Protection installed to Windows 10 version 1809. -**Cause** This occurs because of a failure to load sysfer.dll. During upgrade, the setup process does not set the privilege group "All Application Packages" on sysfer.dll and other Symantec modules. +**Cause**: This problem occurs because of a failure to load sysfer.dll. During upgrade, the setup process does not set the privilege group "All Application Packages" on sysfer.dll and other Symantec modules. **Resolution** This issue was fixed by the Windows Cumulative Update that were released on December 5, 2018—KB4469342 (OS Build 17763.168). @@ -325,7 +322,7 @@ If you have already encountered this issue, use one of the following two options 4. Confirm that **All Application Packages** group is missing. -5. Click **Edit**, and then click **Add** to add the group. +5. Select **Edit**, and then select **Add** to add the group. 6. Test Start and other Apps. diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md index fd49af9302..2064129dc1 100644 --- a/windows/configuration/start-secondary-tiles.md +++ b/windows/configuration/start-secondary-tiles.md @@ -9,7 +9,6 @@ ms.localizationpriority: medium author: dansimp ms.author: dansimp ms.topic: article -ms.date: 06/27/2018 ms.reviewer: manager: dansimp --- @@ -76,10 +75,7 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE 3. If you’d like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references. - For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"` - - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. - - >[!TIP] - >A quick method for getting appropriately sized images for each tile size is to upload your image at [BuildMyPinnedSite](http://www.buildmypinnedsite.com/) and then download the resized tile images. + - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. 4. In Windows PowerShell, enter the following command: @@ -112,12 +108,9 @@ In Microsoft Intune, you create a device restrictions policy to apply to device >[!NOTE] >The device restrictions in Microsoft Intune include [other Start settings](https://docs.microsoft.com/intune/device-restrictions-windows-10#start) that you can also configure in your profile. - - ### Using a provisioning package - -#### Prepare the Start layout and Edge assets XML files +#### Prepare the Start layout and Edge assets XML files The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. @@ -128,7 +121,7 @@ The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce 3. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project. -#### Create a provisioning package that contains a customized Start layout +#### Create a provisioning package that contains a customized Start layout Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 643ebbc93e..a6c45ca8c1 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -1,6 +1,6 @@ --- title: Configure access to Microsoft Store (Windows 10) -description: IT Pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. +description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization. ms.assetid: 7AA60D3D-2A69-45E7-AAB0-B8AFC29C2E97 ms.reviewer: manager: dansimp @@ -23,7 +23,7 @@ ms.date: 4/16/2018 - Windows 10 - Windows 10 Mobile ->For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +>For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. @@ -32,7 +32,6 @@ IT pros can configure access to Microsoft Store for client computers in their or ## Options to configure access to Microsoft Store - You can use these tools to configure access to Microsoft Store: AppLocker or Group Policy. For Windows 10, this is only supported on Windows 10 Enterprise edition. ## Block Microsoft Store using AppLocker @@ -64,6 +63,20 @@ For more information on AppLocker, see [What is AppLocker?](/windows/device-secu 8. Optional: On **Exceptions**, specify conditions by which to exclude files from being affected by the rule. This allows you to add exceptions based on the same rule reference and rule scope as you set before. Click **Next**. +## Block Microsoft Store using configuration service provider + +Applies to: Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education + +If you have Windows 10 devices in your organization that are managed using a mobile device management (MDM) system, such as Microsoft Intune, you can block access to Microsoft Store app using the following configuration service providers (CSPs): + +- [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) +- [AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp) + +For more information, see [Configure an MDM provider](https://docs.microsoft.com/microsoft-store/configure-mdm-provider-microsoft-store-for-business). + +For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). + + ## Block Microsoft Store using Group Policy @@ -78,21 +91,21 @@ You can also use Group Policy to manage access to Microsoft Store. 1. Type gpedit in the search bar to find and start Group Policy Editor. -2. In the console tree of the snap-in, click **Computer Configuration**, click **Administrative Templates** , click **Windows Components**, and then click **Store**. +2. In the console tree of the snap-in, click **Computer Configuration**, click **Administrative Templates**, click **Windows Components**, and then click **Store**. -3. In the Setting pane, click **Turn off Store application**, and then click **Edit policy setting**. +3. In the Setting pane, click **Turn off the Store application**, and then click **Edit policy setting**. -4. On the **Turn off Store application** setting page, click **Enabled**, and then click **OK**. +4. On the **Turn off the Store application** setting page, click **Enabled**, and then click **OK**. > [!Important] -> Enabling **Turn off Store application** policy turns off app updates from Microsoft Store. +> Enabling **Turn off the Store application** policy turns off app updates from Microsoft Store. -## Block Microsoft Store using management tool +## Block Microsoft Store on Windows 10 Mobile Applies to: Windows 10 Mobile -If you have mobile devices in your organization that you upgraded from earlier versions of Windows Phone 8 to Windows 10 Mobile, existing policies created using the Windows Phone 8.1 configuration service providers (CSP) with your MDM tool will continue to work on Windows 10 Mobile. If you are starting with Windows 10 Mobile, we recommend using [AppLocker](#block-store-applocker) to manage access to Microsoft Store app. +If you have mobile devices in your organization that you upgraded from earlier versions of Windows Phone 8 to Windows 10 Mobile, existing policies created using the Windows Phone 8.1 CSPs with your MDM tool will continue to work on Windows 10 Mobile. If you are starting with Windows 10 Mobile, we recommend using [AppLocker](#block-store-applocker) to manage access to Microsoft Store app. When your MDM tool supports Microsoft Store for Business, the MDM can use these CSPs to block Microsoft Store app: diff --git a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md index 4f1ec82a51..110c062f57 100644 --- a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md @@ -1,6 +1,6 @@ --- title: Administering UE-V with Windows PowerShell and WMI -description: Administering UE-V with Windows PowerShell and WMI +description: Learn how User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks. author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/ue-v/uev-administering-uev.md b/windows/configuration/ue-v/uev-administering-uev.md index c06c6a0d85..1b5004453a 100644 --- a/windows/configuration/ue-v/uev-administering-uev.md +++ b/windows/configuration/ue-v/uev-administering-uev.md @@ -1,6 +1,6 @@ --- title: Administering UE-V -description: Administering UE-V +description: Learn how to perform administrative tasks for User Experience Virtualization (UE-V). These tasks include configuring the UE-V service and recovering lost settings. author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md index 156e4af29b..6ca0f295e0 100644 --- a/windows/configuration/ue-v/uev-application-template-schema-reference.md +++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md @@ -1,6 +1,6 @@ --- title: Application Template Schema Reference for UE-V -description: Application Template Schema Reference for UE-V +description: Learn details about the XML structure of the UE-V settings location templates and learn how to edit these files. author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- @@ -70,9 +70,9 @@ The XML declaration must specify the XML version 1.0 attribute (<?xml version **Type: String** -UE-V uses the http://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: +UE-V uses the https://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: -`` +`` ### Data types @@ -646,10 +646,10 @@ Here is the SettingsLocationTemplate.xsd file showing its elements, child elemen ```xml diff --git a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md index 05d2abc519..508ec913ff 100644 --- a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md +++ b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md @@ -1,6 +1,6 @@ --- title: Changing the Frequency of UE-V Scheduled Tasks -description: Changing the Frequency of UE-V Scheduled Tasks +description: Learn how to create a script that uses the Schtasks.exe command-line options so you can change the frequency of UE-V scheduled tasks. author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md index 913d80ac7c..169e31075f 100644 --- a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md +++ b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md @@ -1,6 +1,6 @@ --- title: Configuring UE-V with Group Policy Objects -description: Configuring UE-V with Group Policy Objects +description: In this article, learn how to configure User Experience Virtualization (UE-V) with Group Policy objects. author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md index 049e9cff9f..f4ea6d2a5f 100644 --- a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md +++ b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md @@ -1,6 +1,6 @@ --- -title: Configuring UE-V with System Center Configuration Manager -description: Configuring UE-V with System Center Configuration Manager +title: Configuring UE-V with Microsoft Endpoint Configuration Manager +description: Learn how to configure User Experience Virtualization (UE-V) with Microsoft Endpoint Configuration Manager. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -14,12 +14,12 @@ ms.topic: article --- -# Configuring UE-V with System Center Configuration Manager +# Configuring UE-V with Microsoft Endpoint Configuration Manager **Applies to** - Windows 10, version 1607 -After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of System Center Configuration Manager (2012 SP1 or later) to apply consistent configurations across sites where UE-V and Configuration Manager are installed. +After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of Microsoft Endpoint Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. ## UE-V Configuration Pack supported features @@ -228,7 +228,7 @@ To distribute a new Notepad template, you would perform these steps: ## Get the UE-V Configuration Pack -You can download the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/en-us/download/details.aspx?id=40913) from the Microsoft Download Center. +You can download the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/download/details.aspx?id=40913) from the Microsoft Download Center. diff --git a/windows/configuration/ue-v/uev-deploy-required-features.md b/windows/configuration/ue-v/uev-deploy-required-features.md index 926765cff2..04cf9543e9 100644 --- a/windows/configuration/ue-v/uev-deploy-required-features.md +++ b/windows/configuration/ue-v/uev-deploy-required-features.md @@ -1,6 +1,6 @@ --- title: Deploy required UE-V features -description: Deploy required UE-V features +description: Learn how to install and configure User Experience Virtualization (UE-V) features, for example a network share that stores and retrieves user settings. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -117,7 +117,7 @@ You can configure UE-V before, during, or after you enable the UE-V service on u Windows Server 2012 and Windows Server 2012 R2 -- [**Configuration Manager**](uev-configuring-uev-with-system-center-configuration-manager.md) The UE-V Configuration Pack lets you use the Compliance Settings feature of System Center Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. +- [**Configuration Manager**](uev-configuring-uev-with-system-center-configuration-manager.md) The UE-V Configuration Pack lets you use the Compliance Settings feature of Microsoft Endpoint Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - [**Windows PowerShell and WMI**](uev-administering-uev-with-windows-powershell-and-wmi.md) You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify the configuration of the UE-V service. diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md index edb70df39e..8e69dc7cf3 100644 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md @@ -1,6 +1,6 @@ --- title: Use UE-V with custom applications -description: Use UE-V with custom applications +description: Use User Experience Virtualization (UE-V) to create your own custom settings location templates with the UE-V template generator. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -222,7 +222,7 @@ After you create a settings location template with the UE-V template generator, You can deploy settings location templates using of these methods: -- An electronic software distribution (ESD) system such as System Center Configuration Manager +- An electronic software distribution (ESD) system such as Microsoft Endpoint Configuration Manager - Group Policy preferences diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md index d67437503a..28a035aedc 100644 --- a/windows/configuration/ue-v/uev-getting-started.md +++ b/windows/configuration/ue-v/uev-getting-started.md @@ -1,6 +1,6 @@ --- title: Get Started with UE-V -description: Get Started with UE-V +description: Use the steps in this article to deploy User Experience Virtualization (UE-V) for the first time in a test environment. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md index 9b68ba56df..f953320ab4 100644 --- a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md +++ b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md @@ -1,6 +1,6 @@ --- title: Manage Administrative Backup and Restore in UE-V -description: Manage Administrative Backup and Restore in UE-V +description: Learn how an administrator of User Experience Virtualization (UE-V) can back up and restore application and Windows settings to their original state. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -24,7 +24,7 @@ As an administrator of User Experience Virtualization (UE-V), you can restore ap ## Restore Settings in UE-V when a User Adopts a New Device -To restore settings when a user adopts a new device, you can put a settings location template in **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To backup settings for a template, use the following cmdlet in Windows PowerShell: +To restore settings when a user adopts a new device, you can put a settings location template in a **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This setup lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To back up settings for a template, use the following cmdlet in Windows PowerShell: ```powershell Set-UevTemplateProfile -ID -Profile @@ -50,7 +50,7 @@ As part of the Backup/Restore feature, UE-V added **last known good (LKG)** to t ### How to Backup/Restore Templates with UE-V -These are the key backup and restore components of UE-V: +Here are the key backup and restore components of UE-V: - Template profiles @@ -74,7 +74,7 @@ All templates are included in the roaming profile when registered unless otherwi Templates can be added to the Backup Profile with PowerShell or WMI using the Set-UevTemplateProfile cmdlet. Templates in the Backup Profile back up these settings to the Settings Storage Location in a special Device name directory. Specified settings are backed up to this location. -Templates designated BackupOnly include settings specific to that device that should not be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. +Templates designated BackupOnly include settings specific to that device that shouldn't be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. **Settings packages location within the Settings Storage Location template** @@ -90,10 +90,10 @@ Restoring a user’s device restores the currently registered Template’s setti - **Automatic restore** - If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user logs on to a new device for the first time and these criteria are met, the settings data is applied to that device. + If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user signs in to a new device for the first time and these criteria are met, the settings data is applied to that device. **Note** - Accessibility and Windows Desktop settings require the user to re-logon to Windows to be applied. + Accessibility and Windows Desktop settings require the user to sign in again to Windows to be applied. @@ -104,7 +104,7 @@ Restoring a user’s device restores the currently registered Template’s setti ## Restore Application and Windows Settings to Original State -WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V service was enabled. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user logs on to the operating system. +WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V service was enabled. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user signs in to the operating system. **To restore application settings and Windows settings with Windows PowerShell for UE-V** diff --git a/windows/configuration/ue-v/uev-manage-configurations.md b/windows/configuration/ue-v/uev-manage-configurations.md index dddea0457c..7189998439 100644 --- a/windows/configuration/ue-v/uev-manage-configurations.md +++ b/windows/configuration/ue-v/uev-manage-configurations.md @@ -1,6 +1,6 @@ --- title: Manage Configurations for UE-V -description: Manage Configurations for UE-V +description: Learn to manage the configuration of the User Experience Virtualization (UE-V) service and also learn to manage storage locations for UE-V resources. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -27,11 +27,11 @@ You can use Group Policy Objects to modify the settings that define how UE-V syn [Configuring UE-V with Group Policy Objects](uev-configuring-uev-with-group-policy-objects.md) -## Configuring UE-V with System Center Configuration Manager +## Configuring UE-V with Microsoft Endpoint Configuration Manager -You can use System Center Configuration Manager to manage the UE-V service by using the UE-V Configuration Pack. +You can use Microsoft Endpoint Configuration Manager to manage the UE-V service by using the UE-V Configuration Pack. -[Configuring UE-V with System Center Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md) +[Configuring UE-V with Microsoft Endpoint Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md) ## Administering UE-V with PowerShell and WMI diff --git a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md index 191b74f140..3fe4ab887a 100644 --- a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md @@ -1,5 +1,5 @@ --- -title: Managing the UE-V Service and Packages with Windows PowerShell and WMI +title: Manage UE-V Service and Packages with Windows PowerShell and WMI description: Managing the UE-V service and packages with Windows PowerShell and WMI author: dansimp ms.pagetype: mdop, virtualization diff --git a/windows/configuration/ue-v/uev-migrating-settings-packages.md b/windows/configuration/ue-v/uev-migrating-settings-packages.md index 4ed5adc8a9..f9658f41a1 100644 --- a/windows/configuration/ue-v/uev-migrating-settings-packages.md +++ b/windows/configuration/ue-v/uev-migrating-settings-packages.md @@ -1,6 +1,6 @@ --- title: Migrating UE-V settings packages -description: Migrating UE-V settings packages +description: Learn to relocate User Experience Virtualization (UE-V) user settings packages either when you migrate to a new server or when you perform backups. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index 7e2ed82e70..e10d20444a 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -1,6 +1,6 @@ --- title: Prepare a UE-V Deployment -description: Prepare a UE-V Deployment +description: Learn about the types of User Experience Virtualization (UE-V) deployment you can execute and what preparations you can make beforehand to be successful. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -267,9 +267,9 @@ For more information, see the [Windows Application List](uev-managing-settings-l If you are deploying UE-V to synchronize settings for custom applications, you’ll use the UE-V template generator to create custom settings location templates for those desktop applications. After you create and test a custom settings location template in a test environment, you can deploy the settings location templates to user devices. -Custom settings location templates must be deployed with an existing deployment infrastructure, such as an enterprise software distribution method, including System Center Configuration Manager, with preferences, or by configuring a UE-V settings template catalog. Templates that are deployed with Configuration Manager or Group Policy must be registered using UE-V WMI or Windows PowerShell. +Custom settings location templates must be deployed with an existing deployment infrastructure, such as an enterprise software distribution method, including Microsoft Endpoint Configuration Manager, with preferences, or by configuring a UE-V settings template catalog. Templates that are deployed with Configuration Manager or Group Policy must be registered using UE-V WMI or Windows PowerShell. -For more information about custom settings location templates, see [Deploy UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). For more information about using UE-V with Configuration Manager, see [Configuring UE-V with System Center Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md). +For more information about custom settings location templates, see [Deploy UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). For more information about using UE-V with Configuration Manager, see [Configuring UE-V with Microsoft Endpoint Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md). ### Prevent unintentional user settings configuration @@ -362,7 +362,7 @@ The UE-V service synchronizes user settings for devices that are not always conn Enable this configuration using one of these methods: -- After you enable the UE-V service, use the Settings Management feature in System Center Configuration Manager or the UE-V ADMX templates (installed with Windows 10, version 1607) to push the SyncMethod = None configuration. +- After you enable the UE-V service, use the Settings Management feature in Microsoft Endpoint Configuration Manager or the UE-V ADMX templates (installed with Windows 10, version 1607) to push the SyncMethod = None configuration. - Use Windows PowerShell or Windows Management Instrumentation (WMI) to set the SyncMethod = None configuration. diff --git a/windows/configuration/ue-v/uev-release-notes-1607.md b/windows/configuration/ue-v/uev-release-notes-1607.md index 70054cae5a..7c5805ff7d 100644 --- a/windows/configuration/ue-v/uev-release-notes-1607.md +++ b/windows/configuration/ue-v/uev-release-notes-1607.md @@ -1,6 +1,6 @@ --- title: User Experience Virtualization (UE-V) Release Notes -description: User Experience Virtualization (UE-V) Release Notes +description: Read the latest information required to successfully install and use User Experience Virtualization (UE-V) that is not included in the UE-V documentation. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -37,7 +37,7 @@ Administrators can still define which user-customized application settings can s ### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked -Version 1.0 of UE-V used Offline Files (Client Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607. +Version 1.0 of UE-V used Offline Files (Client-Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607. WORKAROUND: Remove the UE-V 1.0 sync folder from the Offline Files configuration and then upgrade to the in-box version of UE-V for Windows, version 1607 release. @@ -55,19 +55,19 @@ WORKAROUND: To resolve this problem, run the application by selecting one of the ### Unpredictable results when both Office 2010 and Office 2013 are installed on the same device -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. +When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V. -### Uninstall and re-install of Windows 8 applications reverts settings to initial state +### Uninstallation and reinstallation of Windows 8 applications reverts settings to initial state -While using UE-V settings synchronization for a Windows 8 application, if the user uninstalls the application and then reinstalls the application, the application’s settings revert to their default values. This happens because the uninstall removes the local (cached) copy of the application’s settings but does not remove the local UE-V settings package. When the application is reinstalled and launched, UE-V gather the application settings that were reset to the application defaults and then uploads the default settings to the central storage location. Other computers running the application then download the default settings. This behavior is identical to the behavior of desktop applications. +While using UE-V settings synchronization for a Windows 8 application, if the user uninstalls the application and then reinstalls the application, the application’s settings revert to their default values. This result happens because the uninstall removes the local (cached) copy of the application’s settings but does not remove the local UE-V settings package. When the application is reinstalled and launched, UE-V gathers the application settings that were reset to the application defaults and then uploads the default settings to the central storage location. Other computers running the application then download the default settings. This behavior is identical to the behavior of desktop applications. WORKAROUND: None. ### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click [here](). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. +We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click [here](). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. WORKAROUND: None @@ -85,7 +85,7 @@ WORKAROUND: Use folder redirection or some other technology to ensure that any f ### Long Settings Storage Paths could cause an error -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: +Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + "settingspackages" + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: \[boost::filesystem::copy\_file: The system cannot find the path specified\] @@ -95,7 +95,7 @@ WORKAROUND: None. ### Some operating system settings only roam between like operating system versions -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. +Operating system settings for Narrator and currency characters specific to the locale (that is, language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. WORKAROUND: None diff --git a/windows/configuration/ue-v/uev-security-considerations.md b/windows/configuration/ue-v/uev-security-considerations.md index a036b1fb3a..c45565ed5f 100644 --- a/windows/configuration/ue-v/uev-security-considerations.md +++ b/windows/configuration/ue-v/uev-security-considerations.md @@ -1,6 +1,6 @@ --- title: Security Considerations for UE-V -description: Security Considerations for UE-V +description: Learn about accounts and groups, log files, and other security-related considerations for User Experience Virtualization (UE-V). author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-sync-methods.md b/windows/configuration/ue-v/uev-sync-methods.md index ebe670eed2..02d1e1d9af 100644 --- a/windows/configuration/ue-v/uev-sync-methods.md +++ b/windows/configuration/ue-v/uev-sync-methods.md @@ -1,6 +1,6 @@ --- title: Sync Methods for UE-V -description: Sync Methods for UE-V +description: Learn how User Experience Virtualization (UE-V) service sync methods let you synchronize users’ application and Windows settings with the settings storage location. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-sync-trigger-events.md b/windows/configuration/ue-v/uev-sync-trigger-events.md index 3dc4b9727d..0db2a582f4 100644 --- a/windows/configuration/ue-v/uev-sync-trigger-events.md +++ b/windows/configuration/ue-v/uev-sync-trigger-events.md @@ -1,6 +1,6 @@ --- title: Sync Trigger Events for UE-V -description: Sync Trigger Events for UE-V +description: Learn how User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md index 3a799a5027..32ed4968bb 100644 --- a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md +++ b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md @@ -1,6 +1,6 @@ --- title: Synchronizing Microsoft Office with UE-V -description: Synchronizing Office with UE-V +description: Learn how User Experience Virtualization (UE-V) supports the synchronization of Microsoft Office application settings. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -139,7 +139,7 @@ You can deploy UE-V settings location template with the following methods: - **Registering template with Template Catalog Path**. If you use the Settings Template Catalog Path to manage templates on users’ computers, copy the Office template into the folder defined in the UE-V service. The next time the Template Auto Update (ApplySettingsCatalog.exe) scheduled task runs, the settings location template will be registered on the device. For more information, see [Deploy a settings template catalog](uev-deploy-uev-for-custom-applications.md). -- **Registering template with Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to user devices. For more information, see the guidance provided in the documentation for the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/en-us/download/details.aspx?id=40913). +- **Registering template with Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to user devices. For more information, see the guidance provided in the documentation for the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/download/details.aspx?id=40913). diff --git a/windows/configuration/ue-v/uev-technical-reference.md b/windows/configuration/ue-v/uev-technical-reference.md index 5edddf9109..8f0feaabbc 100644 --- a/windows/configuration/ue-v/uev-technical-reference.md +++ b/windows/configuration/ue-v/uev-technical-reference.md @@ -1,6 +1,6 @@ --- title: Technical Reference for UE-V -description: Technical Reference for UE-V +description: Use this technical reference to learn about the various features of User Experience Virtualization (UE-V). author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-troubleshooting.md b/windows/configuration/ue-v/uev-troubleshooting.md index 1ffb99a964..7e51868298 100644 --- a/windows/configuration/ue-v/uev-troubleshooting.md +++ b/windows/configuration/ue-v/uev-troubleshooting.md @@ -1,6 +1,6 @@ --- title: Troubleshooting UE-V -description: Troubleshooting UE-V +description: Use this technical reference to find resources for troubleshooting User Experience Virtualization (UE-V) for Windows 10. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md index bead7186c8..d726744568 100644 --- a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md +++ b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md @@ -1,6 +1,6 @@ --- title: Upgrade to UE-V for Windows 10 -description: Explains how to upgrade to the latest version of UE-V. +description: Use these few adjustments to upgrade from User Experience Virtualization (UE-V) 2.x to the latest version of UE-V. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -30,7 +30,8 @@ If you’re already using UE-V 2.x and you’re planning to upgrade user devices 5. Install the UE-V template generator if you want to synchronize application settings for custom applications. -> **Important**  You can upgrade your existing UE-V installation to Windows 10, version 1607 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10, version 1607.. +> [!IMPORTANT] +> You can upgrade your existing UE-V installation to Windows 10, version 1607 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10, version 1607. ## Upgrade user devices to Windows 10, version 1607 @@ -38,7 +39,7 @@ Performing an in-place upgrade on user devices automatically installs the UE-V s ## Verify that UE-V settings were migrated correctly -After upgrading a user device to Windows 10, version 1607, it’s important to verify that UE-V settings and template registrations were migrated correctly during the upgrade. You can verify UE-V settings using Windows Powershell or the device’s registry. +After upgrading a user device to Windows 10, version 1607, it’s important to verify that UE-V settings and template registrations were migrated correctly during the upgrade. You can verify UE-V settings using Windows PowerShell or the device’s registry. **To verify UE-V settings using Windows PowerShell** @@ -48,7 +49,8 @@ After upgrading a user device to Windows 10, version 1607, it’s important to v 3. Type **Get-UEVTemplate** and press ENTER to check that your templates are still registered. - > **Note** You’ll need to register the NotePad template again after you upgrade the device to Windows 10. + > [!NOTE] + > You’ll need to register the NotePad template again after you upgrade the device to Windows 10. **To verify UE-V settings using the device’s registry** @@ -68,7 +70,8 @@ The UE-V service is the client-side component that captures user-personalized ap With Windows 10, version 1607 and later, the UE-V service replaces the UE-V Agent and no longer requires a separate download and installation. Enable the service on user devices to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. -> **Important**  The UE-V Agent used in prior releases of UE-V is replaced with the UE service. The UE-V service included with Windows 10, version 1607 and later releases, does not include the agent user interface and is configurable through cmdlets or registry settings only. +> [!IMPORTANT] +> The UE-V Agent used in prior releases of UE-V is replaced with the UE service. The UE-V service included with Windows 10, version 1607 and later releases, does not include the agent user interface and is configurable through cmdlets or registry settings only. **To enable the UE-V service with Group Policy** diff --git a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md index d2e019723d..2d435e85ed 100644 --- a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md +++ b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md @@ -1,6 +1,6 @@ --- title: Using UE-V with Application Virtualization applications -description: Using UE-V with Application Virtualization applications +description: Learn how to use User Experience Virtualization (UE-V) with Microsoft Application Virtualization (App-V). author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -23,7 +23,6 @@ User Experience Virtualization (UE-V) supports Microsoft Application Virtualizat ## UE-V settings synchronization for App-V applications - UE-V monitors when an application opens by the program name and, optionally, by file version numbers and product version numbers, whether the application is installed locally or virtually by using App-V. When the application starts, UE-V monitors the App-V process, applies any settings that are stored in the user's settings storage path, and then enables the application to start normally. UE-V monitors App-V applications and automatically translates the relevant file and registry paths to the virtualized location as opposed to the physical location outside the App-V computing environment. **To implement settings synchronization for a virtualized application** @@ -34,28 +33,11 @@ UE-V monitors when an application opens by the program name and, optionally, by 3. Publish the template to the location of your settings template catalog or manually install the template by using the `Register-UEVTemplate` Windows PowerShell cmdlet. - **Note**   - If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**. - - + > [!NOTE] + > If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**. 4. Start the App-V package. - - - - - ## Related topics - [Administering UE-V](uev-administering-uev.md) - - - - - - - - - diff --git a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md index e44d1c33a7..09d5d2ace3 100644 --- a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md +++ b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md @@ -1,6 +1,6 @@ --- title: What's New in UE-V for Windows 10, version 1607 -description: What's New in UE-V for Windows 10, version 1607 +description: Learn about what's new in User Experience Virtualization (UE-V) for Windows 10, including new features and capabilities. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -22,7 +22,7 @@ User Experience Virtualization (UE-V) for Windows 10, version 1607, includes the ## UE-V is now a feature in Windows 10 -With Windows 10, version 1607 and later releases, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack. +With Windows 10, version 1607 and later releases, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack. The changes in UE-V for Windows 10, version 1607 impact already existing implementations of UE-V in the following ways: diff --git a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md index a2663f503d..0a5cc1a242 100644 --- a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md +++ b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md @@ -1,6 +1,6 @@ --- title: Working with Custom UE-V Templates and the UE-V Template Generator -description: Working with Custom UE-V Templates and the UE-V Template Generator +description: Create your own custom settings location templates by working with Custom User Experience Virtualization (UE-V) Templates and the UE-V Template Generator. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -98,9 +98,8 @@ Use the UE-V template generator to edit settings location templates. When the re 1. Create a local copy of the settings location template .xml file. UE-V settings location templates are .xml files that identify the locations where application store settings values. - >**Note**   - A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template. - + > [!NOTE] + > A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template. 2. Open the settings location template file with an XML editor. diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md index 6a6265ee5a..d39c37513b 100644 --- a/windows/configuration/wcd/wcd-accounts.md +++ b/windows/configuration/wcd/wcd-accounts.md @@ -45,7 +45,7 @@ Specifies the settings you can configure when joining a device to a domain, incl | --- | --- | --- | | Account | string | Account to use to join computer to domain | | AccountOU | Enter the full path for the organizational unit. For example: OU=testOU,DC=domain,DC=Domain,DC=com. | Name of organizational unit for the computer account | -| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer less than 15 digits long, or using %SERIAL% characters in the name.

              ComputerName is a string with a maximum length of 15 bytes of content:

              - ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.

              - ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.

              - ComputerName cannot use some non-standard characters, such as emoji.

              Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](https://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) | +| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer that includes fewer than 15 digits, or using %SERIAL% characters in the name.

              ComputerName is a string with a maximum length of 15 bytes of content:

              - ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.

              - ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.

              - ComputerName cannot use some non-standard characters, such as emoji.

              Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](https://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) | | DomainName | string (cannot be empty) | Specify the name of the domain that the device will join | | Password | string (cannot be empty) | Corresponds to the password of the user account that's authorized to join the computer account to the domain. | @@ -56,6 +56,6 @@ Use these settings to add local user accounts to the device. | Setting | Value | Description | | --- | --- | --- | | UserName | string (cannot be empty) | Specify a name for the local user account | -| HomeDir | string (cannot be ampty) | Specify the path of the home directory for the user | +| HomeDir | string (cannot be empty) | Specify the path of the home directory for the user | | Password | string (cannot be empty) | Specify the password for the user account | | UserGroup | string (cannot be empty) | Specify the local user group for the user | diff --git a/windows/configuration/wcd/wcd-calling.md b/windows/configuration/wcd/wcd-calling.md index 186d34e8ec..ea77470ed5 100644 --- a/windows/configuration/wcd/wcd-calling.md +++ b/windows/configuration/wcd/wcd-calling.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: dansimp -ms.localizationpriority: medium +ms.localizationpriority: medium ms.author: dansimp ms.topic: article ms.date: 04/30/2018 @@ -57,7 +57,7 @@ See [Dialer codes to launch diagnostic applications](https://docs.microsoft.com/ ## PerSimSettings -Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, select **Add**, and then configure the folowing settings. +Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, select **Add**, and then configure the following settings. ### Critical diff --git a/windows/configuration/wcd/wcd-cellcore.md b/windows/configuration/wcd/wcd-cellcore.md index b9b724b0b7..5e739a99ce 100644 --- a/windows/configuration/wcd/wcd-cellcore.md +++ b/windows/configuration/wcd/wcd-cellcore.md @@ -139,7 +139,7 @@ Select from the following: ### eSim -Configure **FwUpdate** > **AllowedAppIdList** to whitelist apps that are allowed to update the firmware. Obtain the app IDs from the card vendor. +Configure **FwUpdate** > **AllowedAppIdList** to list apps that are allowed to update the firmware. Obtain the app IDs from the card vendor. ### External diff --git a/windows/configuration/wcd/wcd-deviceupdatecenter.md b/windows/configuration/wcd/wcd-deviceupdatecenter.md index e8431b2555..0a509c9bc2 100644 --- a/windows/configuration/wcd/wcd-deviceupdatecenter.md +++ b/windows/configuration/wcd/wcd-deviceupdatecenter.md @@ -4,9 +4,10 @@ description: This section describes the DeviceUpdateCenter settings that you can ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp +manager: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-location.md b/windows/configuration/wcd/wcd-location.md index 51c9676fc7..c2585b8fec 100644 --- a/windows/configuration/wcd/wcd-location.md +++ b/windows/configuration/wcd/wcd-location.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-maps.md b/windows/configuration/wcd/wcd-maps.md index 413d267bd9..c8d1a683fb 100644 --- a/windows/configuration/wcd/wcd-maps.md +++ b/windows/configuration/wcd/wcd-maps.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- @@ -28,7 +27,7 @@ Use for settings related to Maps. ## ChinaVariantWin10 -Use **ChinaVariantWin10** to specify that the Windows device is intended to ship in China. When set to **True**, maps approved by the State Bureau of Surveying and Mapping in China are used, which are obtained from a server located in China. +Use **ChinaVariantWin10** to specify that the Windows device is intended to ship in China. When set to **True**, maps approved by the State Bureau of Surveying and Mapping in China are used. These maps are obtained from a server located in China. This customization may result in different maps, servers, or other configuration changes on the device. @@ -39,7 +38,7 @@ Use to store map data on an SD card. Map data is used by the Maps application and the map control for third-party applications. This data can be store on an SD card, which provides the advantage of saving internal memory space for user data and allows the user to download more offline map data. Microsoft recommends enabling the **UseExternalStorage** setting on devices that have less than 8 GB of user storage and an SD card slot. -You can use **UseExternalStorage** whether or not you include an SD card with preloaded map data on the phone. If set to **True**, the OS only allows the user to download offline maps when an SD card is present. If an SD card is not present, users can still view and cache maps, but they will not be able to download a region of offline maps until an SD card is inserted. +You can use **UseExternalStorage** whether or not you include an SD card with preloaded map data on the phone. If set to **True**, the OS only allows the user to download offline maps when an SD card is present. If no SD card is present, users can view and cache maps, but they can't download a region of offline maps until an SD card is inserted. If set to **False**, map data will always be stored on the internal data partition of the device. @@ -48,4 +47,4 @@ If set to **False**, map data will always be stored on the internal data partiti ## UseSmallerCache -Do not use. +Don't use this setting. diff --git a/windows/configuration/wcd/wcd-messaging.md b/windows/configuration/wcd/wcd-messaging.md index cb9a984961..f556155dc7 100644 --- a/windows/configuration/wcd/wcd-messaging.md +++ b/windows/configuration/wcd/wcd-messaging.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- @@ -82,7 +81,7 @@ SyncSender | Specify a value for SyncSender that is greater than 3 characters bu ## PerSimSettings -Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, click **Add**, and then configure the folowing settings. +Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, click **Add**, and then configure the following settings. ### AllowMmsIfDataIsOff diff --git a/windows/configuration/wcd/wcd-modemconfigurations.md b/windows/configuration/wcd/wcd-modemconfigurations.md index 7e4b830d53..2e35a4939e 100644 --- a/windows/configuration/wcd/wcd-modemconfigurations.md +++ b/windows/configuration/wcd/wcd-modemconfigurations.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/12/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-multivariant.md b/windows/configuration/wcd/wcd-multivariant.md index 1a6771f972..504a5fbd1b 100644 --- a/windows/configuration/wcd/wcd-multivariant.md +++ b/windows/configuration/wcd/wcd-multivariant.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-networkproxy.md b/windows/configuration/wcd/wcd-networkproxy.md index 6fc060772a..916599130b 100644 --- a/windows/configuration/wcd/wcd-networkproxy.md +++ b/windows/configuration/wcd/wcd-networkproxy.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-networkqospolicy.md b/windows/configuration/wcd/wcd-networkqospolicy.md index 33a0bfac6b..9a459a884b 100644 --- a/windows/configuration/wcd/wcd-networkqospolicy.md +++ b/windows/configuration/wcd/wcd-networkqospolicy.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-nfc.md b/windows/configuration/wcd/wcd-nfc.md index cede584f46..0e69a8611f 100644 --- a/windows/configuration/wcd/wcd-nfc.md +++ b/windows/configuration/wcd/wcd-nfc.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-personalization.md b/windows/configuration/wcd/wcd-personalization.md index 5368e5b446..2bd33a11a5 100644 --- a/windows/configuration/wcd/wcd-personalization.md +++ b/windows/configuration/wcd/wcd-personalization.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- @@ -28,20 +27,20 @@ Use to configure settings to personalize a PC. ## DeployDesktopImage -Deploy a jpg, jpeg or png image to the device to be used as desktop image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [DesktopImageUrl](#desktopimageurl). +Deploy a .jpg, .jpeg, or .png image to the device to be used as a desktop image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [DesktopImageUrl](#desktopimageurl). When using **DeployDesktopImage** and [DeployLockScreenImageFile](#deploylockscreenimage, the file names need to be different. ## DeployLockScreenImage -Deploy a jpg, jpeg or png image to the device to be used as lock screen image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [LockScreenImageUrl](#lockscreenimageurl). +Deploy a .jpg, .jpeg, or .png image to the device to be used as lock screen image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [LockScreenImageUrl](#lockscreenimageurl). When using [DeployDesktopImage](#deploydesktopimage) and **DeployLockScreenImageFile**, the file names need to be different. ## DesktopImageUrl -Specify a jpg, jpeg or png image to be used as desktop image. This setting can take a http or https url to a remote image to be downloaded or a file url to a local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployDesktopImage](#deploydesktopimage). +Specify a .jpg, .jpeg, or .png image to be used as desktop image. This setting can take an HTTP or HTTPS URL to a remote image to be downloaded or a file URL to a local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployDesktopImage](#deploydesktopimage). ## LockScreenImageUrl -Specify a jpg, jpeg or png image to be used as Lock Screen Image. This setting can take a http or https Url to a remote image to be downloaded or a file Url to an existing local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployLockScreenImage](#deploylockscreenimage). +Specify a .jpg, .jpeg, or .png image to be used as Lock Screen Image. This setting can take an HTTP or HTTPS URL to a remote image to be downloaded or a file URL to an existing local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployLockScreenImage](#deploylockscreenimage). diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md index 5ccfcbb449..62f3b52b5d 100644 --- a/windows/configuration/wcd/wcd-policies.md +++ b/windows/configuration/wcd/wcd-policies.md @@ -135,8 +135,8 @@ This section describes the **Policies** settings that you can configure in [prov | [PreventCertErrorOverrides](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | X | X | X | | X | | [PreventFirstRunPage](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | X | | | | | | [PreventLiveTileDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | X | X | X | | X | -| [PreventSmartScreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen Filter warnings about potentially malicious websites. | X | X | X | | X | -| [PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. | X | X | X | | X | +| [PreventSmartScreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | X | X | X | | X | +| [PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | X | X | X | | X | PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | X | | | | | | [PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | X | | | | | | [PreventUsingLocalHostIPAddressForWebRTC](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | X | X | X | | X | diff --git a/windows/configuration/wcd/wcd-privacy.md b/windows/configuration/wcd/wcd-privacy.md index 1e754ef32f..7e5e005614 100644 --- a/windows/configuration/wcd/wcd-privacy.md +++ b/windows/configuration/wcd/wcd-privacy.md @@ -4,9 +4,10 @@ description: This section describes the Privacy settings that you can configure ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp +manager: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md index 64f3ae3dc7..e435b32ee5 100644 --- a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md +++ b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md @@ -4,10 +4,11 @@ description: This section describes the StorageD3InModernStandby settings that y ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article +manager: dansimp --- # StorageD3InModernStandby (Windows Configuration Designer reference) diff --git a/windows/configuration/wcd/wcd-theme.md b/windows/configuration/wcd/wcd-theme.md index 658b518cfb..d368119a52 100644 --- a/windows/configuration/wcd/wcd-theme.md +++ b/windows/configuration/wcd/wcd-theme.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-time.md b/windows/configuration/wcd/wcd-time.md index c0ff2212ce..a453f8eabe 100644 --- a/windows/configuration/wcd/wcd-time.md +++ b/windows/configuration/wcd/wcd-time.md @@ -4,9 +4,10 @@ description: This section describes the Time settings that you can configure in ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp +manager: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-unifiedwritefilter.md b/windows/configuration/wcd/wcd-unifiedwritefilter.md index 104503cd09..2d215d1d84 100644 --- a/windows/configuration/wcd/wcd-unifiedwritefilter.md +++ b/windows/configuration/wcd/wcd-unifiedwritefilter.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-universalappinstall.md b/windows/configuration/wcd/wcd-universalappinstall.md index be0152d06b..0877cba652 100644 --- a/windows/configuration/wcd/wcd-universalappinstall.md +++ b/windows/configuration/wcd/wcd-universalappinstall.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-universalappuninstall.md b/windows/configuration/wcd/wcd-universalappuninstall.md index d31c0c0dec..b9a7329acf 100644 --- a/windows/configuration/wcd/wcd-universalappuninstall.md +++ b/windows/configuration/wcd/wcd-universalappuninstall.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/14/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-usberrorsoemoverride.md b/windows/configuration/wcd/wcd-usberrorsoemoverride.md index c2ba08ffff..92a723d0c0 100644 --- a/windows/configuration/wcd/wcd-usberrorsoemoverride.md +++ b/windows/configuration/wcd/wcd-usberrorsoemoverride.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/14/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-weakcharger.md b/windows/configuration/wcd/wcd-weakcharger.md index a20822fe41..317198f6b9 100644 --- a/windows/configuration/wcd/wcd-weakcharger.md +++ b/windows/configuration/wcd/wcd-weakcharger.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-windowshelloforbusiness.md b/windows/configuration/wcd/wcd-windowshelloforbusiness.md index e955414622..936d9d7e62 100644 --- a/windows/configuration/wcd/wcd-windowshelloforbusiness.md +++ b/windows/configuration/wcd/wcd-windowshelloforbusiness.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-windowsteamsettings.md b/windows/configuration/wcd/wcd-windowsteamsettings.md index 1f05397e01..f459457d42 100644 --- a/windows/configuration/wcd/wcd-windowsteamsettings.md +++ b/windows/configuration/wcd/wcd-windowsteamsettings.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd.md b/windows/configuration/wcd/wcd.md index 8719cd6f74..4372317664 100644 --- a/windows/configuration/wcd/wcd.md +++ b/windows/configuration/wcd/wcd.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 07/19/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index 55ae0af5f2..058df52109 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -20,7 +20,7 @@ ms.date: 06/19/2018 **Applies to** -- Windows 10 +- Windows 10, Windows Server 2016 with Desktop Experience, Windows Server 2019 with Desktop Experience > **Looking for consumer information?** [See what's on the Start menu](https://support.microsoft.com/help/17195/windows-10-see-whats-on-the-menu) @@ -132,7 +132,7 @@ If your Start layout customization is not applied as expected, open **Event View - [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md index fa8b0e3378..5fcc9f5c5c 100644 --- a/windows/configuration/windows-spotlight.md +++ b/windows/configuration/windows-spotlight.md @@ -44,7 +44,7 @@ For managed devices running Windows 10 Enterprise and Windows 10 Education, en - **Feature suggestions, fun facts, tips** - The lock screen background will occasionally suggest Windows 10 features that the user hasn't tried yet, such as **Snap assist**. + The lock screen background will occasionally make recommendations on how to enhance your productivity and enjoyment of Microsoft products including suggesting other relevant Microsoft products and services. ![fun facts](images/funfacts.png) diff --git a/windows/configure/docfx.json b/windows/configure/docfx.json index 564f47ae8b..3dcf319a94 100644 --- a/windows/configure/docfx.json +++ b/windows/configure/docfx.json @@ -30,6 +30,8 @@ "overwrite": [], "externalReference": [], "globalMetadata": { + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.windows-configure" diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md deleted file mode 100644 index cc903e11ec..0000000000 --- a/windows/deployment/TOC.md +++ /dev/null @@ -1,298 +0,0 @@ -# [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment) -## [Deploy Windows 10 with Microsoft 365](deploy-m365.md) -## [What's new in Windows 10 deployment](deploy-whats-new.md) -## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) -## [Windows Autopilot](windows-autopilot/windows-autopilot.md) - -## Subscription Activation -### [Windows 10 Subscription Activation](windows-10-subscription-activation.md) -### [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) -### [Configure VDA for Subscription Activation](vda-subscription-activation.md) -### [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) - -## Resolve upgrade errors -### [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) -### [Quick fixes](upgrade\quick-fixes.md) -### [SetupDiag](upgrade/setupdiag.md) -### [Troubleshooting upgrade errors](upgrade/troubleshoot-upgrade-errors.md) -### [Windows error reporting](upgrade/windows-error-reporting.md) -### [Upgrade error codes](upgrade/upgrade-error-codes.md) -### [Log files](upgrade/log-files.md) -### [Resolution procedures](upgrade/resolution-procedures.md) -### [Submit Windows 10 upgrade errors](upgrade/submit-errors.md) - -## Deploy Windows 10 -### [Deploying Windows 10](deploy.md) - -### [Windows Autopilot](windows-autopilot/windows-autopilot.md) -### [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) -### [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) -### [Windows 10 volume license media](windows-10-media.md) - -### [Windows 10 in S mode](s-mode.md) -#### [Switch to Windows 10 Pro/Enterprise from S mode](windows-10-pro-in-s-mode.md) - -### [Windows 10 deployment test lab](windows-10-poc.md) -#### [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) -#### [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) - -### [Plan for Windows 10 deployment](planning/index.md) -#### [Windows 10 Enterprise FAQ for IT Pros](planning/windows-10-enterprise-faq-itpro.md) -#### [Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md) -#### [Windows 10 compatibility](planning/windows-10-compatibility.md) -#### [Windows 10 infrastructure requirements](planning/windows-10-infrastructure-requirements.md) - -#### [Volume Activation [client]](volume-activation/volume-activation-windows-10.md) -##### [Plan for volume activation [client]](volume-activation/plan-for-volume-activation-client.md) -##### [Activate using Key Management Service [client]](volume-activation/activate-using-key-management-service-vamt.md) -##### [Activate using Active Directory-based activation [client]](volume-activation/activate-using-active-directory-based-activation-client.md) -##### [Activate clients running Windows 10](volume-activation/activate-windows-10-clients-vamt.md) -##### [Monitor activation [client]](volume-activation/monitor-activation-client.md) -##### [Use the Volume Activation Management Tool [client]](volume-activation/use-the-volume-activation-management-tool-client.md) -##### [Appendix: Information sent to Microsoft during activation [client]](volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md) - -#### [Application Compatibility Toolkit (ACT) Technical Reference](planning/act-technical-reference.md) -##### [SUA User's Guide](planning/sua-users-guide.md) -###### [Using the SUA Wizard](planning/using-the-sua-wizard.md) -###### [Using the SUA Tool](planning/using-the-sua-tool.md) -####### [Tabs on the SUA Tool Interface](planning/tabs-on-the-sua-tool-interface.md) -####### [Showing Messages Generated by the SUA Tool](planning/showing-messages-generated-by-the-sua-tool.md) -####### [Applying Filters to Data in the SUA Tool](planning/applying-filters-to-data-in-the-sua-tool.md) -####### [Fixing Applications by Using the SUA Tool](planning/fixing-applications-by-using-the-sua-tool.md) -##### [Compatibility Administrator User's Guide](planning/compatibility-administrator-users-guide.md) -###### [Using the Compatibility Administrator Tool](planning/using-the-compatibility-administrator-tool.md) -####### [Available Data Types and Operators in Compatibility Administrator](planning/available-data-types-and-operators-in-compatibility-administrator.md) -####### [Searching for Fixed Applications in Compatibility Administrator](planning/searching-for-fixed-applications-in-compatibility-administrator.md) -####### [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md) -####### [Creating a Custom Compatibility Fix in Compatibility Administrator](planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md) -####### [Creating a Custom Compatibility Mode in Compatibility Administrator](planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md) -####### [Creating an AppHelp Message in Compatibility Administrator](planning/creating-an-apphelp-message-in-compatibility-administrator.md) -####### [Viewing the Events Screen in Compatibility Administrator](planning/viewing-the-events-screen-in-compatibility-administrator.md) -####### [Enabling and Disabling Compatibility Fixes in Compatibility Administrator](planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md) -####### [Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md) -###### [Managing Application-Compatibility Fixes and Custom Fix Databases](planning/managing-application-compatibility-fixes-and-custom-fix-databases.md) -####### [Understanding and Using Compatibility Fixes](planning/understanding-and-using-compatibility-fixes.md) -####### [Compatibility Fix Database Management Strategies and Deployment](planning/compatibility-fix-database-management-strategies-and-deployment.md) -####### [Testing Your Application Mitigation Packages](planning/testing-your-application-mitigation-packages.md) -###### [Using the Sdbinst.exe Command-Line Tool](planning/using-the-sdbinstexe-command-line-tool.md) -##### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) - - -### [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) -#### [Get started with the Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md) -##### [Key features in MDT](deploy-windows-mdt/key-features-in-mdt.md) -##### [MDT Lite Touch components](deploy-windows-mdt/mdt-lite-touch-components.md) -##### [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) - -#### [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) -#### [Deploy a Windows 10 image using MDT](deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md) -#### [Build a distributed environment for Windows 10 deployment](deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md) -#### [Refresh a Windows 7 computer with Windows 10](deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md) -#### [Replace a Windows 7 computer with a Windows 10 computer](deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md) -#### [Perform an in-place upgrade to Windows 10 with MDT](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) -#### [Configure MDT settings](deploy-windows-mdt/configure-mdt-settings.md) -##### [Set up MDT for BitLocker](deploy-windows-mdt/set-up-mdt-for-bitlocker.md) -##### [Configure MDT deployment share rules](deploy-windows-mdt/configure-mdt-deployment-share-rules.md) -##### [Configure MDT for UserExit scripts](deploy-windows-mdt/configure-mdt-for-userexit-scripts.md) -##### [Simulate a Windows 10 deployment in a test environment](deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md) -##### [Use the MDT database to stage Windows 10 deployment information](deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md) -##### [Assign applications using roles in MDT](deploy-windows-mdt/assign-applications-using-roles-in-mdt.md) -##### [Use web services in MDT](deploy-windows-mdt/use-web-services-in-mdt.md) -##### [Use Orchestrator runbooks with MDT](deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md) - -### [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) -#### [Integrate Configuration Manager with MDT](deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) -#### [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) -#### [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md) -#### [Add a Windows 10 operating system image using Configuration Manager](deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md) -#### [Create an application to deploy with Windows 10 using Configuration Manager](deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) -#### [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) -#### [Create a task sequence with Configuration Manager and MDT](deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) -#### [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md) -#### [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md) -#### [Monitor the Windows 10 deployment with Configuration Manager](deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md) -#### [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) -#### [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) -#### [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) - -### [Windows 10 deployment tools](windows-10-deployment-tools.md) - -#### [Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) -#### [Convert MBR partition to GPT](mbr-to-gpt.md) -#### [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) -#### [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) - -#### [Deploy Windows To Go in your organization](deploy-windows-to-go.md) -##### [Windows To Go: feature overview](planning/windows-to-go-overview.md) -###### [Best practice recommendations for Windows To Go](planning/best-practice-recommendations-for-windows-to-go.md) -###### [Deployment considerations for Windows To Go](planning/deployment-considerations-for-windows-to-go.md) -###### [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) -###### [Security and data protection considerations for Windows To Go](planning/security-and-data-protection-considerations-for-windows-to-go.md) -###### [Windows To Go: frequently asked questions](planning/windows-to-go-frequently-asked-questions.md) - -#### [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) -##### [Introduction to VAMT](volume-activation/introduction-vamt.md) -##### [Active Directory-Based Activation Overview](volume-activation/active-directory-based-activation-overview.md) -##### [Install and Configure VAMT](volume-activation/install-configure-vamt.md) -###### [VAMT Requirements](volume-activation/vamt-requirements.md) -###### [Install VAMT](volume-activation/install-vamt.md) -###### [Configure Client Computers](volume-activation/configure-client-computers-vamt.md) -##### [Add and Manage Products](volume-activation/add-manage-products-vamt.md) -###### [Add and Remove Computers](volume-activation/add-remove-computers-vamt.md) -###### [Update Product Status](volume-activation/update-product-status-vamt.md) -###### [Remove Products](volume-activation/remove-products-vamt.md) -##### [Manage Product Keys](volume-activation/manage-product-keys-vamt.md) -###### [Add and Remove a Product Key](volume-activation/add-remove-product-key-vamt.md) -###### [Install a Product Key](volume-activation/install-product-key-vamt.md) -###### [Install a KMS Client Key](volume-activation/install-kms-client-key-vamt.md) -##### [Manage Activations](volume-activation/manage-activations-vamt.md) -###### [Perform Online Activation](volume-activation/online-activation-vamt.md) -###### [Perform Proxy Activation](volume-activation/proxy-activation-vamt.md) -###### [Perform KMS Activation](volume-activation/kms-activation-vamt.md) -###### [Perform Local Reactivation](volume-activation/local-reactivation-vamt.md) -###### [Activate an Active Directory Forest Online](volume-activation/activate-forest-vamt.md) -###### [Activate by Proxy an Active Directory Forest](volume-activation/activate-forest-by-proxy-vamt.md) -##### [Manage VAMT Data](volume-activation/manage-vamt-data.md) -###### [Import and Export VAMT Data](volume-activation/import-export-vamt-data.md) -###### [Use VAMT in Windows PowerShell](volume-activation/use-vamt-in-windows-powershell.md) -##### [VAMT Step-by-Step Scenarios](volume-activation/vamt-step-by-step.md) -###### [Scenario 1: Online Activation](volume-activation/scenario-online-activation-vamt.md) -###### [Scenario 2: Proxy Activation](volume-activation/scenario-proxy-activation-vamt.md) -###### [Scenario 3: KMS Client Activation](volume-activation/scenario-kms-activation-vamt.md) -##### [VAMT Known Issues](volume-activation/vamt-known-issues.md) -#### [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) -##### [User State Migration Tool (USMT) Overview Topics](usmt/usmt-topics.md) -###### [User State Migration Tool (USMT) Overview](usmt/usmt-overview.md) -###### [Getting Started with the User State Migration Tool (USMT)](usmt/getting-started-with-the-user-state-migration-tool.md) -###### [Windows Upgrade and Migration Considerations](upgrade/windows-upgrade-and-migration-considerations.md) -##### [User State Migration Tool (USMT) How-to topics](usmt/usmt-how-to.md) -###### [Exclude Files and Settings](usmt/usmt-exclude-files-and-settings.md) -###### [Extract Files from a Compressed USMT Migration Store](usmt/usmt-extract-files-from-a-compressed-migration-store.md) -###### [Include Files and Settings](usmt/usmt-include-files-and-settings.md) -###### [Migrate Application Settings](usmt/migrate-application-settings.md) -###### [Migrate EFS Files and Certificates](usmt/usmt-migrate-efs-files-and-certificates.md) -###### [Migrate User Accounts](usmt/usmt-migrate-user-accounts.md) -###### [Reroute Files and Settings](usmt/usmt-reroute-files-and-settings.md) -###### [Verify the Condition of a Compressed Migration Store](usmt/verify-the-condition-of-a-compressed-migration-store.md) -##### [User State Migration Tool (USMT) Troubleshooting](usmt/usmt-troubleshooting.md) -###### [Common Issues](usmt/usmt-common-issues.md) -###### [Frequently Asked Questions](usmt/usmt-faq.md) -###### [Log Files](usmt/usmt-log-files.md) -###### [Return Codes](usmt/usmt-return-codes.md) -###### [USMT Resources](usmt/usmt-resources.md) -##### [User State Migration Toolkit (USMT) Reference](usmt/usmt-reference.md) -###### [USMT Requirements](usmt/usmt-requirements.md) -###### [USMT Best Practices](usmt/usmt-best-practices.md) -###### [How USMT Works](usmt/usmt-how-it-works.md) -###### [Plan Your Migration](usmt/usmt-plan-your-migration.md) -####### [Common Migration Scenarios](usmt/usmt-common-migration-scenarios.md) -####### [What Does USMT Migrate?](usmt/usmt-what-does-usmt-migrate.md) -####### [Choose a Migration Store Type](usmt/usmt-choose-migration-store-type.md) -######## [Migration Store Types Overview](usmt/migration-store-types-overview.md) -######## [Estimate Migration Store Size](usmt/usmt-estimate-migration-store-size.md) -######## [Hard-Link Migration Store](usmt/usmt-hard-link-migration-store.md) -######## [Migration Store Encryption](usmt/usmt-migration-store-encryption.md) -####### [Determine What to Migrate](usmt/usmt-determine-what-to-migrate.md) -######## [Identify Users](usmt/usmt-identify-users.md) -######## [Identify Applications Settings](usmt/usmt-identify-application-settings.md) -######## [Identify Operating System Settings](usmt/usmt-identify-operating-system-settings.md) -######## [Identify File Types, Files, and Folders](usmt/usmt-identify-file-types-files-and-folders.md) -####### [Test Your Migration](usmt/usmt-test-your-migration.md) -###### [User State Migration Tool (USMT) Command-line Syntax](usmt/usmt-command-line-syntax.md) -####### [ScanState Syntax](usmt/usmt-scanstate-syntax.md) -####### [LoadState Syntax](usmt/usmt-loadstate-syntax.md) -####### [UsmtUtils Syntax](usmt/usmt-utilities.md) -###### [USMT XML Reference](usmt/usmt-xml-reference.md) -####### [Understanding Migration XML Files](usmt/understanding-migration-xml-files.md) -####### [Config.xml File](usmt/usmt-configxml-file.md) -####### [Customize USMT XML Files](usmt/usmt-customize-xml-files.md) -####### [Custom XML Examples](usmt/usmt-custom-xml-examples.md) -####### [Conflicts and Precedence](usmt/usmt-conflicts-and-precedence.md) -####### [General Conventions](usmt/usmt-general-conventions.md) -####### [XML File Requirements](usmt/xml-file-requirements.md) -####### [Recognized Environment Variables](usmt/usmt-recognized-environment-variables.md) -####### [XML Elements Library](usmt/usmt-xml-elements-library.md) -###### [Offline Migration Reference](usmt/offline-migration-reference.md) -### [Install fonts in Windows 10](windows-10-missing-fonts.md) - -## Update Windows 10 -### [Update Windows 10 in enterprise deployments](update/index.md) -### Windows as a service -#### [Windows as a service - introduction](update/windows-as-a-service.md) -#### [Quick guide to Windows as a service](update/waas-quick-start.md) -#### [Servicing stack updates](update/servicing-stack-updates.md) -#### [Overview of Windows as a service](update/waas-overview.md) -### [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) -### [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) -### [Assign devices to servicing channels for Windows 10 updates](update/waas-servicing-channels-windows-10-updates.md) -### Get started -#### [Get started with Windows Update](update/windows-update-overview.md) -#### [How Windows Update works](update/how-windows-update-works.md) -#### [Windows Update log files](update/windows-update-logs.md) -#### [How to troubleshoot Windows Update](update/windows-update-troubleshooting.md) -#### [Common Windows Update errors](update/windows-update-errors.md) -#### [Windows Update error code reference](update/windows-update-error-reference.md) -#### [Other Windows Update resources](update/windows-update-resources.md) -### Optimize delivery -#### [Optimize Windows 10 update delivery](update/waas-optimize-windows-10-updates.md) -#### [Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization.md) -#### [Set up Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization-setup.md) -#### [Delivery Optimization reference](update/waas-delivery-optimization-reference.md) -#### [Configure BranchCache for Windows 10 updates](update/waas-branchcache.md) -#### [Whitepaper: Windows Updates using forward and reverse differentials](update/PSFxWhitepaper.md) -### Best practices -#### [Best practices for feature updates on mission-critical devices](update/feature-update-mission-critical.md) -#### [Deploy feature updates during maintenance windows](update/feature-update-maintenance-window.md) -#### [Deploy feature updates for user-initiated installations](update/feature-update-user-install.md) -#### [Conclusion](update/feature-update-conclusion.md) -### [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](update/waas-mobile-updates.md) -### Use Windows Update for Business -#### [Deploy updates using Windows Update for Business](update/waas-manage-updates-wufb.md) -#### [Configure Windows Update for Business](update/waas-configure-wufb.md) -#### [Integrate Windows Update for Business with management solutions](update/waas-integrate-wufb.md) -#### [Walkthrough: use Group Policy to configure Windows Update for Business](update/waas-wufb-group-policy.md) -#### [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) -### Use Windows Server Update Services -#### [Deploy Windows 10 updates using Windows Server Update Services](update/waas-manage-updates-wsus.md) -#### [Enable FoD and language pack updates in Windows Update](update/fod-and-lang-packs.md) -### [Deploy Windows 10 updates using System Center Configuration Manager](update/waas-manage-updates-configuration-manager.md) -### [Manage device restarts after updates](update/waas-restart.md) -### [Manage additional Windows Update settings](update/waas-wu-settings.md) -### [Determine the source of Windows updates](update/windows-update-sources.md) - -## Windows Analytics -### [Windows Analytics overview](update/windows-analytics-overview.md) -### [Windows Analytics in the Azure Portal](update/windows-analytics-azure-portal.md) -### [Windows Analytics and privacy](update/windows-analytics-privacy.md) -### Upgrade Readiness -#### [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) -#### [Upgrade Readiness architecture](upgrade/upgrade-readiness-architecture.md) -#### [Upgrade Readiness requirements](upgrade/upgrade-readiness-requirements.md) -#### Get started -##### [Get started with Upgrade Readiness](upgrade/upgrade-readiness-get-started.md) -##### [Upgrade Readiness deployment script](upgrade/upgrade-readiness-deployment-script.md) -#### Use Upgrade Readiness -##### [Use Upgrade Readiness to manage Windows upgrades](upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md) -##### [Upgrade overview](upgrade/upgrade-readiness-upgrade-overview.md) -##### [Step 1: Identify apps](upgrade/upgrade-readiness-identify-apps.md) -##### [Step 2: Resolve issues](upgrade/upgrade-readiness-resolve-issues.md) -##### [Step 3: Deploy Windows](upgrade/upgrade-readiness-deploy-windows.md) -##### [Step 4: Monitor deployment](upgrade/upgrade-readiness-monitor-deployment.md) -##### [Additional insights](upgrade/upgrade-readiness-additional-insights.md) -##### [Targeting a new operating system version](upgrade/upgrade-readiness-target-new-OS.md) -### Monitor Windows Updates -#### [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) -#### [Get started with Update Compliance](update/update-compliance-get-started.md) -#### [Use Update Compliance](update/update-compliance-using.md) -##### [Need Attention! report](update/update-compliance-need-attention.md) -##### [Security Update Status report](update/update-compliance-security-update-status.md) -##### [Feature Update Status report](update/update-compliance-feature-update-status.md) -##### [Windows Defender AV Status report](update/update-compliance-wd-av-status.md) -##### [Delivery Optimization in Update Compliance](update/update-compliance-delivery-optimization.md) -##### [Update Compliance Perspectives](update/update-compliance-perspectives.md) -### Device Health -#### [Device Health overview](update/device-health-monitor.md) -#### [Get started with Device Health](update/device-health-get-started.md) -#### [Using Device Health](update/device-health-using.md) -### [Enrolling devices in Windows Analytics](update/windows-analytics-get-started.md) -### [Troubleshooting Windows Analytics and FAQ](update/windows-analytics-FAQ-troubleshooting.md) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml new file mode 100644 index 0000000000..fdc36528a1 --- /dev/null +++ b/windows/deployment/TOC.yml @@ -0,0 +1,535 @@ +- name: Deploy and update Windows 10 + href: index.yml + items: + - name: Get started + items: + - name: What's new + href: deploy-whats-new.md + - name: Windows 10 deployment scenarios + href: windows-10-deployment-scenarios.md + - name: What is Windows as a service? + href: update/waas-quick-start.md + - name: Windows update fundamentals + href: update/waas-overview.md + - name: Basics of Windows updates, channels, and tools + href: update/get-started-updates-channels-tools.md + - name: Servicing the Windows 10 operating system + href: update/waas-servicing-strategy-windows-10-updates.md + + - name: Deployment proof of concept + items: + - name: Demonstrate Autopilot deployment on a VM + href: windows-autopilot/demonstrate-deployment-on-vm.md + - name: Deploy Windows 10 with MDT and Configuration Manager + items: + - name: 'Step by step guide: Configure a test lab to deploy Windows 10' + href: windows-10-poc.md + - name: Deploy Windows 10 in a test lab using MDT + href: windows-10-poc-mdt.md + - name: Deploy Windows 10 in a test lab using Configuration Manager + href: windows-10-poc-sc-config-mgr.md + - name: Deployment process posters + href: windows-10-deployment-posters.md + + - name: Plan + items: + - name: Create a deployment plan + href: update/create-deployment-plan.md + - name: Define readiness criteria + href: update/plan-define-readiness.md + - name: Evaluate infrastructure and tools + href: update/eval-infra-tools.md + - name: Determine application readiness + href: update/plan-determine-app-readiness.md + - name: Define your servicing strategy + href: update/plan-define-strategy.md + - name: Delivery Optimization for Windows 10 updates + href: update/waas-delivery-optimization.md + items: + - name: Using a proxy with Delivery Optimization + href: update/delivery-optimization-proxy.md + - name: Best practices for feature updates on mission-critical devices + href: update/feature-update-mission-critical.md + - name: Windows 10 deployment considerations + href: planning/windows-10-deployment-considerations.md + - name: Windows 10 infrastructure requirements + href: planning/windows-10-infrastructure-requirements.md + - name: Plan for volume activation + href: volume-activation/plan-for-volume-activation-client.md + - name: Features removed or planned for replacement + items: + - name: Windows 10 features lifecycle + href: planning/features-lifecycle.md + - name: Features we're no longer developing + href: planning/windows-10-deprecated-features.md + - name: Features we removed + href: planning/windows-10-removed-features.md + + - name: Prepare + items: + - name: Prepare to deploy Windows 10 updates + href: update/prepare-deploy-windows.md + - name: Evaluate and update infrastructure + href: update/update-policies.md + - name: Update Baseline + href: update/update-baseline.md + - name: Set up Delivery Optimization for Windows 10 updates + href: update/waas-delivery-optimization-setup.md + - name: Configure BranchCache for Windows 10 updates + href: update/waas-branchcache.md + - name: Prepare your deployment tools + items: + - name: Prepare for deployment with MDT + href: deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md + - name: Prepare for deployment with Configuration Manager + href: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md + - name: Build a successful servicing strategy + items: + - name: Build deployment rings for Windows 10 updates + href: update/waas-deployment-rings-windows-10-updates.md + - name: Prepare updates using Windows Update for Business + href: update/waas-manage-updates-wufb.md + - name: Prepare updates using WSUS + href: update/waas-manage-updates-wsus.md + + - name: Deploy + items: + - name: Deploy Windows 10 + items: + - name: Deploy Windows 10 with Autopilot + href: windows-autopilot/index.yml + - name: Deploy Windows 10 with Configuration Manager + items: + - name: Deploy to a new device + href: deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md + - name: Refresh a device + href: deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md + - name: Replace a device + href: deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md + - name: In-place upgrade + href: deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md + - name: Deploy Windows 10 with MDT + items: + - name: Deploy to a new device + href: deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md + - name: Refresh a device + href: deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md + - name: Replace a device + href: deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md + - name: In-place upgrade + href: deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md + - name: Subscription Activation + items: + - name: Windows 10 Subscription Activation + href: windows-10-subscription-activation.md + - name: Windows 10 Enterprise E3 in CSP + href: windows-10-enterprise-e3-overview.md + - name: Configure VDA for Subscription Activation + href: vda-subscription-activation.md + - name: Deploy Windows 10 Enterprise licenses + href: deploy-enterprise-licenses.md + - name: Deploy Windows 10 updates + items: + - name: Assign devices to servicing channels + href: update/waas-servicing-channels-windows-10-updates.md + - name: Deploy updates with Configuration Manager + href: update/deploy-updates-configmgr.md + - name: Deploy updates with Intune + href: update/deploy-updates-intune.md + - name: Deploy updates with WSUS + href: update/waas-manage-updates-wsus.md + - name: Deploy updates with Group Policy + href: update/waas-wufb-group-policy.md + - name: Update Windows 10 media with Dynamic Update + href: update/media-dynamic-update.md + - name: Migrating and acquiring optional Windows content + href: update/optional-content.md + - name: Safeguard holds + href: update/safeguard-holds.md + - name: Manage the Windows 10 update experience + items: + - name: Manage device restarts after updates + href: update/waas-restart.md + - name: Manage additional Windows Update settings + href: update/waas-wu-settings.md + - name: Deploy feature updates during maintenance windows + href: update/feature-update-maintenance-window.md + - name: Deploy feature updates for user-initiated installations + href: update/feature-update-user-install.md + - name: Use Windows Update for Business + items: + - name: What is Windows Update for Business? + href: update/waas-manage-updates-wufb.md + - name: Configure Windows Update for Business + href: update/waas-configure-wufb.md + - name: Enforcing compliance deadlines for updates + href: update/wufb-compliancedeadlines.md + - name: Integrate Windows Update for Business with management solutions + href: update/waas-integrate-wufb.md + - name: 'Walkthrough: use Group Policy to configure Windows Update for Business' + href: update/waas-wufb-group-policy.md + - name: 'Walkthrough: use Intune to configure Windows Update for Business' + href: update/deploy-updates-intune.md + - name: Monitor Windows 10 updates + items: + - name: Monitor Delivery Optimization + href: update/waas-delivery-optimization-setup.md#monitor-delivery-optimization + - name: Monitor Windows Updates + items: + - name: Monitor Windows Updates with Update Compliance + href: update/update-compliance-monitor.md + - name: Get started + items: + - name: Get started with Update Compliance + href: update/update-compliance-get-started.md + - name: Update Compliance configuration script + href: update/update-compliance-configuration-script.md + - name: Manually configuring devices for Update Compliance + href: update/update-compliance-configuration-manual.md + - name: Update Compliance monitoring + items: + - name: Use Update Compliance + href: update/update-compliance-using.md + - name: Need attention report + href: update/update-compliance-need-attention.md + - name: Security update status report + href: update/update-compliance-security-update-status.md + - name: Feature update status report + href: update/update-compliance-feature-update-status.md + - name: Delivery Optimization in Update Compliance + href: update/update-compliance-delivery-optimization.md + - name: Data handling and privacy in Update Compliance + href: update/update-compliance-privacy.md + - name: Update Compliance schema reference + href: update/update-compliance-schema.md + items: + - name: WaaSUpdateStatus + href: update/update-compliance-schema-waasupdatestatus.md + - name: WaaSInsiderStatus + href: update/update-compliance-schema-waasinsiderstatus.md + - name: WaaSDepoymentStatus + href: update/update-compliance-schema-waasdeploymentstatus.md + - name: WUDOStatus + href: update/update-compliance-schema-wudostatus.md + - name: WUDOAggregatedStatus + href: update/update-compliance-schema-wudoaggregatedstatus.md + - name: Troubleshooting + items: + - name: Resolve upgrade errors + items: + - name: Resolve Windows 10 upgrade errors + href: upgrade/resolve-windows-10-upgrade-errors.md + - name: Quick fixes + href: upgrade/quick-fixes.md + - name: SetupDiag + href: upgrade/setupdiag.md + - name: Troubleshooting upgrade errors + href: upgrade/troubleshoot-upgrade-errors.md + - name: Windows error reporting + href: upgrade/windows-error-reporting.md + - name: Upgrade error codes + href: upgrade/upgrade-error-codes.md + - name: Log files + href: upgrade/log-files.md + - name: Resolution procedures + href: upgrade/resolution-procedures.md + - name: Submit Windows 10 upgrade errors + href: upgrade/submit-errors.md + - name: Troubleshoot Windows Update + items: + - name: How to troubleshoot Windows Update + href: update/windows-update-troubleshooting.md + - name: Opt out of safeguard holds + href: update/safeguard-opt-out.md + - name: Determine the source of Windows Updates + href: update/windows-update-sources.md + - name: Common Windows Update errors + href: update/windows-update-errors.md + - name: Windows Update error code reference + href: update/windows-update-error-reference.md + + - name: Reference + items: + - name: How does Windows Update work? + href: update/how-windows-update-works.md + - name: Deploy Windows 10 with Microsoft 365 + href: deploy-m365.md + - name: Understanding the Unified Update Platform + href: update/windows-update-overview.md + - name: Servicing stack updates + href: update/servicing-stack-updates.md + - name: Additional Windows Update settings + href: update/waas-wu-settings.md + - name: Delivery Optimization reference + href: update/waas-delivery-optimization-reference.md + - name: Windows 10 in S mode + href: s-mode.md + - name: Switch to Windows 10 Pro or Enterprise from S mode + href: windows-10-pro-in-s-mode.md + - name: Windows 10 deployment tools + items: + - name: Windows 10 deployment scenarios and tools + items: + - name: Convert MBR partition to GPT + href: mbr-to-gpt.md + - name: Configure a PXE server to load Windows PE + href: configure-a-pxe-server-to-load-windows-pe.md + - name: Windows ADK for Windows 10 scenarios for IT Pros + href: windows-adk-scenarios-for-it-pros.md + - name: Windows To Go + items: + - name: Deploy Windows To Go in your organization + href: deploy-windows-to-go.md + - name: "Windows To Go: feature overview" + href: planning/windows-to-go-overview.md + - name: Best practice recommendations for Windows To Go + href: planning/best-practice-recommendations-for-windows-to-go.md + - name: Deployment considerations for Windows To Go + href: planning/deployment-considerations-for-windows-to-go.md + - name: Prepare your organization for Windows To Go + href: planning/prepare-your-organization-for-windows-to-go.md + - name: Security and data protection considerations for Windows To Go + href: planning/security-and-data-protection-considerations-for-windows-to-go.md + - name: "Windows To Go: frequently asked questions" + href: planning/windows-to-go-frequently-asked-questions.md + + - name: Volume Activation Management Tool (VAMT) technical reference + items: + - name: VAMT technical reference + href: volume-activation/volume-activation-management-tool.md + - name: Introduction to VAMT + href: volume-activation/introduction-vamt.md + - name: Active Directory-Based Activation Overview + href: volume-activation/active-directory-based-activation-overview.md + - name: Install and Configure VAMT + href: volume-activation/install-configure-vamt.md + - name: VAMT Requirements + href: volume-activation/vamt-requirements.md + - name: Install VAMT + href: volume-activation/install-vamt.md + - name: Configure Client Computers + href: volume-activation/configure-client-computers-vamt.md + - name: Add and Manage Products + href: volume-activation/add-manage-products-vamt.md + - name: Add and Remove Computers + href: volume-activation/add-remove-computers-vamt.md + - name: Update Product Status + href: volume-activation/update-product-status-vamt.md + - name: Remove Products + href: volume-activation/remove-products-vamt.md + - name: Manage Product Keys + href: volume-activation/manage-product-keys-vamt.md + - name: Add and Remove a Product Key + href: volume-activation/add-remove-product-key-vamt.md + - name: Install a Product Key + href: volume-activation/install-product-key-vamt.md + - name: Install a KMS Client Key + href: volume-activation/install-kms-client-key-vamt.md + - name: Manage Activations + href: volume-activation/manage-activations-vamt.md + - name: Perform Online Activation + href: volume-activation/online-activation-vamt.md + - name: Perform Proxy Activation + href: volume-activation/proxy-activation-vamt.md + - name: Perform KMS Activation + href: volume-activation/kms-activation-vamt.md + - name: Perform Local Reactivation + href: volume-activation/local-reactivation-vamt.md + - name: Activate an Active Directory Forest Online + href: volume-activation/activate-forest-vamt.md + - name: Activate by Proxy an Active Directory Forest + href: volume-activation/activate-forest-by-proxy-vamt.md + - name: Manage VAMT Data + href: volume-activation/manage-vamt-data.md + - name: Import and Export VAMT Data + href: volume-activation/import-export-vamt-data.md + - name: Use VAMT in Windows PowerShell + href: volume-activation/use-vamt-in-windows-powershell.md + - name: VAMT Step-by-Step Scenarios + href: volume-activation/vamt-step-by-step.md + - name: "Scenario 1: Online Activation" + href: volume-activation/scenario-online-activation-vamt.md + - name: "Scenario 2: Proxy Activation" + href: volume-activation/scenario-proxy-activation-vamt.md + - name: "Scenario 3: KMS Client Activation" + href: volume-activation/scenario-kms-activation-vamt.md + - name: VAMT Known Issues + href: volume-activation/vamt-known-issues.md + + - name: User State Migration Tool (USMT) technical reference + items: + - name: USMT overview topics + items: + - name: USMT overview + href: usmt/usmt-overview.md + - name: Getting started with the USMT + href: usmt/getting-started-with-the-user-state-migration-tool.md + - name: Windows upgrade and migration considerations + href: upgrade/windows-upgrade-and-migration-considerations.md + - name: USMT How-to topics + items: + - name: Exclude Files and Settings + href: usmt/usmt-exclude-files-and-settings.md + - name: Extract Files from a Compressed USMT Migration Store + href: usmt/usmt-extract-files-from-a-compressed-migration-store.md + - name: Include Files and Settings + href: usmt/usmt-include-files-and-settings.md + - name: Migrate Application Settings + href: usmt/migrate-application-settings.md + - name: Migrate EFS Files and Certificates + href: usmt/usmt-migrate-efs-files-and-certificates.md + - name: Migrate User Accounts + href: usmt/usmt-migrate-user-accounts.md + - name: Reroute Files and Settings + href: usmt/usmt-reroute-files-and-settings.md + - name: Verify the Condition of a Compressed Migration Store + href: usmt/verify-the-condition-of-a-compressed-migration-store.md + - name: USMT Troubleshooting + href: usmt/usmt-troubleshooting.md + - name: Common Issues + href: usmt/usmt-common-issues.md + - name: Frequently Asked Questions + href: usmt/usmt-faq.md + - name: Log Files + href: usmt/usmt-log-files.md + - name: Return Codes + href: usmt/usmt-return-codes.md + - name: USMT Resources + href: usmt/usmt-resources.md + + - name: USMT Reference + items: + - name: USMT Requirements + href: usmt/usmt-requirements.md + - name: USMT Best Practices + href: usmt/usmt-best-practices.md + - name: How USMT Works + href: usmt/usmt-how-it-works.md + - name: Plan Your Migration + href: usmt/usmt-plan-your-migration.md + - name: Common Migration Scenarios + href: usmt/usmt-common-migration-scenarios.md + - name: What Does USMT Migrate? + href: usmt/usmt-what-does-usmt-migrate.md + - name: Choose a Migration Store Type + href: usmt/usmt-choose-migration-store-type.md + - name: Migration Store Types Overview + href: usmt/migration-store-types-overview.md + - name: Estimate Migration Store Size + href: usmt/usmt-estimate-migration-store-size.md + - name: Hard-Link Migration Store + href: usmt/usmt-hard-link-migration-store.md + - name: Migration Store Encryption + href: usmt/usmt-migration-store-encryption.md + - name: Determine What to Migrate + href: usmt/usmt-determine-what-to-migrate.md + - name: Identify users + href: usmt/usmt-identify-users.md + - name: Identify Applications Settings + href: usmt/usmt-identify-application-settings.md + - name: Identify Operating System Settings + href: usmt/usmt-identify-operating-system-settings.md + - name: Identify File Types, Files, and Folders + href: usmt/usmt-identify-file-types-files-and-folders.md + - name: Test Your Migration + href: usmt/usmt-test-your-migration.md + - name: USMT Command-line Syntax + href: usmt/usmt-command-line-syntax.md + - name: ScanState Syntax + href: usmt/usmt-scanstate-syntax.md + - name: LoadState Syntax + href: usmt/usmt-loadstate-syntax.md + - name: UsmtUtils Syntax + href: usmt/usmt-utilities.md + - name: USMT XML Reference + href: usmt/usmt-xml-reference.md + - name: Understanding Migration XML Files + href: usmt/understanding-migration-xml-files.md + - name: Config.xml File + href: usmt/usmt-configxml-file.md + - name: Customize USMT XML Files + href: usmt/usmt-customize-xml-files.md + - name: Custom XML Examples + href: usmt/usmt-custom-xml-examples.md + - name: Conflicts and Precedence + href: usmt/usmt-conflicts-and-precedence.md + - name: General Conventions + href: usmt/usmt-general-conventions.md + - name: XML File Requirements + href: usmt/xml-file-requirements.md + - name: Recognized Environment Variables + href: usmt/usmt-recognized-environment-variables.md + - name: XML Elements Library + href: usmt/usmt-xml-elements-library.md + - name: Offline Migration Reference + href: usmt/offline-migration-reference.md + + - name: Application Compatibility Toolkit (ACT) Technical Reference + items: + - name: SUA User's Guide + href: planning/sua-users-guide.md + - name: Using the SUA Wizard + href: planning/using-the-sua-wizard.md + - name: Using the SUA Tool + href: planning/using-the-sua-tool.md + - name: Tabs on the SUA Tool Interface + href: planning/tabs-on-the-sua-tool-interface.md + - name: Showing Messages Generated by the SUA Tool + href: planning/showing-messages-generated-by-the-sua-tool.md + - name: Applying Filters to Data in the SUA Tool + href: planning/applying-filters-to-data-in-the-sua-tool.md + - name: Fixing Applications by Using the SUA Tool + href: planning/fixing-applications-by-using-the-sua-tool.md + - name: Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista + href: planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md + - name: Compatibility Administrator User's Guide + href: planning/compatibility-administrator-users-guide.md + - name: Using the Compatibility Administrator Tool + href: planning/using-the-compatibility-administrator-tool.md + - name: Available Data Types and Operators in Compatibility Administrator + href: planning/available-data-types-and-operators-in-compatibility-administrator.md + - name: Searching for Fixed Applications in Compatibility Administrator + href: planning/searching-for-fixed-applications-in-compatibility-administrator.md + - name: Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator + href: planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md + - name: Creating a Custom Compatibility Fix in Compatibility Administrator + href: planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md + - name: Creating a Custom Compatibility Mode in Compatibility Administrator + href: planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md + - name: Creating an AppHelp Message in Compatibility Administrator + href: planning/creating-an-apphelp-message-in-compatibility-administrator.md + - name: Viewing the Events Screen in Compatibility Administrator + href: planning/viewing-the-events-screen-in-compatibility-administrator.md + - name: Enabling and Disabling Compatibility Fixes in Compatibility Administrator + href: planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md + - name: Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator + href: planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md + - name: Managing Application-Compatibility Fixes and Custom Fix Databases + href: planning/managing-application-compatibility-fixes-and-custom-fix-databases.md + - name: Understanding and Using Compatibility Fixes + href: planning/understanding-and-using-compatibility-fixes.md + - name: Compatibility Fix Database Management Strategies and Deployment + href: planning/compatibility-fix-database-management-strategies-and-deployment.md + - name: Testing Your Application Mitigation Packages + href: planning/testing-your-application-mitigation-packages.md + - name: Using the Sdbinst.exe Command-Line Tool + href: planning/using-the-sdbinstexe-command-line-tool.md + - name: Volume Activation + href: volume-activation/volume-activation-windows-10.md + - name: Plan for volume activation + href: volume-activation/plan-for-volume-activation-client.md + - name: Activate using Key Management Service + href: volume-activation/activate-using-key-management-service-vamt.md + - name: Activate using Active Directory-based activation + href: volume-activation/activate-using-active-directory-based-activation-client.md + - name: Activate clients running Windows 10 + href: volume-activation/activate-windows-10-clients-vamt.md + - name: Monitor activation + href: volume-activation/monitor-activation-client.md + - name: Use the Volume Activation Management Tool + href: volume-activation/use-the-volume-activation-management-tool-client.md + - name: "Appendix: Information sent to Microsoft during activation " + href: volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md + + - name: Install fonts in Windows 10 + href: windows-10-missing-fonts.md \ No newline at end of file diff --git a/windows/deployment/Windows-AutoPilot-EULA-note.md b/windows/deployment/Windows-AutoPilot-EULA-note.md index ae15ebea5c..a57384798d 100644 --- a/windows/deployment/Windows-AutoPilot-EULA-note.md +++ b/windows/deployment/Windows-AutoPilot-EULA-note.md @@ -1,24 +1,25 @@ ---- -title: Windows Autopilot EULA dismissal – important information -description: A notice about EULA dismissal through Windows Autopilot -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 08/22/2017 -ms.reviewer: -manager: laurawi -audience: itpro author: greg-lindsay -ROBOTS: noindex,nofollow -ms.topic: article ---- -# Windows Autopilot EULA dismissal – important information - ->[!IMPORTANT] ->The information below isn't the EULA. It is a notice of awareness to the administrator that's configuring to skip End User License Agreement (EULA) during the OOBE (Out-of-Box Experience). - -Using this tool allows you to configure individual installations of Windows on devices managed by your organization. You may choose to suppress or hide certain set-up screens that are normally presented to users when setting up Windows, including the EULA acceptance screen. - -By using this function, you agree that suppressing or hiding any screens that are designed to provide users with notice or acceptance of terms means that you, on behalf of your organization or the individual user as the case may be, have consented to the notices and accepted the applicable terms. This includes your agreement to the terms and conditions of the license or notice that would be presented to the user if you did not suppress or hide it using this tool. You and your users may not use the Windows software on those devices if you have not validly acquired a license for the software from Microsoft or its licensed distributors. +--- +title: Windows Autopilot EULA dismissal – important information +description: A notice about EULA dismissal through Windows Autopilot +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +ms.audience: itpro +author: greg-lindsay +ms.date: 08/22/2017 +ms.reviewer: +manager: laurawi +audience: itpro +ROBOTS: noindex,nofollow +ms.topic: article +--- +# Windows Autopilot EULA dismissal – important information + +>[!IMPORTANT] +>The information below isn't the EULA. It is a notice of awareness to the administrator that's configuring to skip End User License Agreement (EULA) during the OOBE (Out-of-Box Experience). + +Using this tool allows you to configure individual installations of Windows on devices managed by your organization. You may choose to suppress or hide certain set-up screens that are normally presented to users when setting up Windows, including the EULA acceptance screen. + +By using this function, you agree that suppressing or hiding any screens that are designed to provide users with notice or acceptance of terms means that you, on behalf of your organization or the individual user as the case may be, have consented to the notices and accepted the applicable terms. This includes your agreement to the terms and conditions of the license or notice that would be presented to the user if you did not suppress or hide it using this tool. You and your users may not use the Windows software on those devices if you have not validly acquired a license for the software from Microsoft or its licensed distributors. diff --git a/windows/deployment/add-store-apps-to-image.md b/windows/deployment/add-store-apps-to-image.md index a6b6ad9da6..4a6d000511 100644 --- a/windows/deployment/add-store-apps-to-image.md +++ b/windows/deployment/add-store-apps-to-image.md @@ -1,85 +1,86 @@ ---- -title: Add Microsoft Store for Business applications to a Windows 10 image -description: This topic describes how to add Microsoft Store for Business applications to a Windows 10 image. -keywords: upgrade, update, windows, windows 10, deploy, store, image, wim -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Add Microsoft Store for Business applications to a Windows 10 image - -**Applies to** - -- Windows 10 - -This topic describes the correct way to add Microsoft Store for Business applications to a Windows 10 image. This will enable you to deploy Windows 10 with pre-installed Microsoft Store for Business apps. - ->[!IMPORTANT] ->In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment. - -## Prerequisites - -* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) for the tools required to mount and edit Windows images. - -* Download an offline signed app package and license of the application you would like to add through [Microsoft Store for Business](/store-for-business/distribute-offline-apps#download-an-offline-licensed-app). - -* A Windows Image. For instructions on image creation, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) or [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - ->[!NOTE] -> If you'd like to add an internal LOB Microsoft Store application, please follow the instructions on **[Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10)**. - -## Adding a Store application to your image - -On a machine where your image file is accessible: -1. Open Windows PowerShell with administrator privileges. -2. Mount the image. At the Windows PowerShell prompt, type: -`Mount-WindowsImage -ImagePath c:\images\myimage.wim -Index 1 -Path C:\test` -3. Use the Add-AppxProvisionedPackage cmdlet in Windows PowerShell to preinstall the app. Use the /PackagePath option to specify the location of the Store package and /LicensePath to specify the location of the license .xml file. In Windows PowerShell, type: -`Add-AppxProvisionedPackage -Path C:\test -PackagePath C:\downloads\appxpackage -LicensePath C:\downloads\appxpackage\license.xml` - ->[!NOTE] ->Paths and file names are examples. Use your paths and file names where appropriate. -> ->Do not dismount the image, as you will return to it later. - -## Editing the Start Layout - -In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment. - -On a test machine: -1. **Install the Microsoft Store for Business application you previously added** to your image. -2. **Pin these apps to the Start screen**, by typing the name of the app, right-clicking and selecting **Pin to Start**. -3. Open Windows PowerShell with administrator privileges. -4. Use `Export-StartLayout -path .xml` where *\\* is the path and name of the xml file your will later import into your Windows Image. -5. Copy the XML file you created to a location accessible by the machine you previously used to add Store applications to your image. - -Now, on the machine where your image file is accessible: -1. Import the Start layout. At the Windows PowerShell prompt, type: -`Import-StartLayout -LayoutPath ".xml" -MountPath "C:\test\"` -2. Save changes and dismount the image. At the Windows PowerShell prompt, type: -`Dismount-WindowsImage -Path c:\test -Save` - ->[!NOTE] ->Paths and file names are examples. Use your paths and file names where appropriate. -> ->For more information on Start customization see [Windows 10 Start Layout Customization](https://blogs.technet.microsoft.com/deploymentguys/2016/03/07/windows-10-start-layout-customization/) - - -## Related topics -* [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout) -* [Export-StartLayout](https://technet.microsoft.com/itpro/powershell/windows/startlayout/export-startlayout) -* [Import-StartLayout](https://technet.microsoft.com/itpro/powershell/windows/startlayout/import-startlayout) -* [Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) -* [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) -* [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) -* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) - - +--- +title: Add Microsoft Store for Business applications to a Windows 10 image +description: This article describes the correct way to add Microsoft Store for Business applications to a Windows 10 image. +keywords: upgrade, update, windows, windows 10, deploy, store, image, wim +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.reviewer: +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Add Microsoft Store for Business applications to a Windows 10 image + +**Applies to** + +- Windows 10 + +This topic describes the correct way to add Microsoft Store for Business applications to a Windows 10 image. This will enable you to deploy Windows 10 with pre-installed Microsoft Store for Business apps. + +>[!IMPORTANT] +>In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment. + +## Prerequisites + +* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) for the tools required to mount and edit Windows images. + +* Download an offline signed app package and license of the application you would like to add through [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app). +* A Windows Image. For instructions on image creation, see [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md). + +>[!NOTE] +> If you'd like to add an internal LOB Microsoft Store application, please follow the instructions on **[Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10)**. + +## Adding a Store application to your image + +On a machine where your image file is accessible: +1. Open Windows PowerShell with administrator privileges. +2. Mount the image. At the Windows PowerShell prompt, type: +`Mount-WindowsImage -ImagePath c:\images\myimage.wim -Index 1 -Path C:\test` +3. Use the Add-AppxProvisionedPackage cmdlet in Windows PowerShell to preinstall the app. Use the /PackagePath option to specify the location of the Store package and /LicensePath to specify the location of the license .xml file. In Windows PowerShell, type: +`Add-AppxProvisionedPackage -Path C:\test -PackagePath C:\downloads\appxpackage -LicensePath C:\downloads\appxpackage\license.xml` + +>[!NOTE] +>Paths and file names are examples. Use your paths and file names where appropriate. +> +>Do not dismount the image, as you will return to it later. + +## Editing the Start Layout + +In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment. + +On a test machine: +1. **Install the Microsoft Store for Business application you previously added** to your image. +2. **Pin these apps to the Start screen**, by typing the name of the app, right-clicking and selecting **Pin to Start**. +3. Open Windows PowerShell with administrator privileges. +4. Use `Export-StartLayout -path .xml` where *\\* is the path and name of the xml file your will later import into your Windows Image. +5. Copy the XML file you created to a location accessible by the machine you previously used to add Store applications to your image. + +Now, on the machine where your image file is accessible: +1. Import the Start layout. At the Windows PowerShell prompt, type: +`Import-StartLayout -LayoutPath ".xml" -MountPath "C:\test\"` +2. Save changes and dismount the image. At the Windows PowerShell prompt, type: +`Dismount-WindowsImage -Path c:\test -Save` + +>[!NOTE] +>Paths and file names are examples. Use your paths and file names where appropriate. +> +>For more information on Start customization see [Windows 10 Start Layout Customization](https://blogs.technet.microsoft.com/deploymentguys/2016/03/07/windows-10-start-layout-customization/) + + +## Related topics +* [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout) +* [Export-StartLayout](https://technet.microsoft.com/itpro/powershell/windows/startlayout/export-startlayout) +* [Import-StartLayout](https://technet.microsoft.com/itpro/powershell/windows/startlayout/import-startlayout) +* [Sideload LOB apps in Windows 10](/windows/application-management/siddeploy-windows-cmws-10) +* [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) +* [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) +* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) + + diff --git a/windows/deployment/change-history-for-deploy-windows-10.md b/windows/deployment/change-history-for-deploy-windows-10.md deleted file mode 100644 index e6a2e1664a..0000000000 --- a/windows/deployment/change-history-for-deploy-windows-10.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: Change history for Deploy Windows 10 (Windows 10) -description: This topic lists new and updated topics in the Deploy Windows 10 documentation for Windows 10 and Windows 10 Mobile. -ms.assetid: 19C50373-6B25-4F5C-A6EF-643D36904349 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Change history for Deploy Windows 10 -This topic lists new and updated topics in the [Deploy Windows 10](https://docs.microsoft.com/windows/deployment) documentation for [Windows 10 and Windows 10 Mobile](/windows/windows-10). - -## April 2018 - -New or changed topic | Description ---- | --- -[Install VAMT](volume-activation/install-vamt.md) | Updated the instructions and link for SQL Server Express. - -## November 2017 - -New or changed topic | Description --- | --- - [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) | Added warning that you should not use **SkipMachineOOBE** or **SkipUserOOBE** in your Unattend.xml. - -## RELEASE: Windows 10, version 1709 -| New or changed topic | Description | -|----------------------|-------------| -| [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) | Updated the edition upgrade table to include all other Windows 10 editions previously not on the list and the supported upgrade methods for upgrade path. | -| [Fonts missing after upgrading to Windows 10](windows-10-missing-fonts.md)| New article about the set of fonts that have moved from being included in the default installation image to being included in Optional Features. This article includes the steps for adding these optional font features.| - -## July 2017 -| New or changed topic | Description | -|----------------------|-------------| -| The table of contents for deployment topics was reorganized. - -## June 2017 -| New or changed topic | Description | -|----------------------|-------------| -| [Overview of Windows Autopilot](windows-autopilot/windows-autopilot.md) | New | - -## April 2017 -| New or changed topic | Description | -|----------------------|-------------| -| [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) | Updated: The "refresh" and "replace" procedures were swapped in order so that it would not be necessary to save and restore VMs. Also a missing step was added to include the State migration point role. | -| [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md)| Updated with minor fixes. | -| [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md)| Updated child topics under this node to include new feature and user interface changes. | -| [Get started with Upgrade Readiness](upgrade/upgrade-readiness-get-started.md)| Added a table summarizing connection scenarios under the Enable data sharing topic. | - - -## RELEASE: Windows 10, version 1703 -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The provisioning topics have been moved to [Configure Windows 10](/windows/configuration/index). - - -## March 2017 -| New or changed topic | Description | -|----------------------|-------------| -| [What's new in Windows 10 deployment](deploy-whats-new.md) | New | -| [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) | Topic moved under [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) in the table of contents and title adjusted to clarify in-place upgrade. | -| [Upgrade to Windows 10 with System Center Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) | Topic moved under [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) in the table of contents and title adjusted to clarify in-place upgrade. | -| [Convert MBR partition to GPT](mbr-to-gpt.md) | New | - -## February 2017 -| New or changed topic | Description | -|----------------------|-------------| -| [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) | Multiple topics updated, name changed from Upgrade Analytics to Upgrade Readiness, and other content updates. | -| [USMT Requirements](usmt/usmt-requirements.md) | Updated: Vista support removed and other minor changes | -| [Get started with Upgrade Analytics](upgrade/upgrade-readiness-get-started.md) | Updated structure and content | -| [Upgrade Analytics deployment script](upgrade/upgrade-readiness-deployment-script.md) | Added as a separate page from get started | -| [Use Upgrade Analytics to manage Windows upgrades](upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md) | Updated with links to new content and information about the target OS setting | -| [Upgrade Analytics - Upgrade overview](upgrade/upgrade-readiness-upgrade-overview.md) | New | -| [Upgrade Analytics - Step 1: Identify important apps](upgrade/upgrade-readiness-identify-apps.md) | Updated topic title and content | -| [Upgrade Analytics - Step 2: Resolve app and driver issues](upgrade/upgrade-readiness-resolve-issues.md) | New | -| [Upgrade Analytics - Step 3: Deploy Windows](upgrade/upgrade-readiness-deploy-windows.md) | New | -| [Upgrade Analytics - Additional insights](upgrade/upgrade-readiness-additional-insights.md) | New | - - -## January 2017 -| New or changed topic | Description | -|----------------------|-------------| -| [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) | New | -| [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) | New | -| [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) | New | -| [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) | New (previously published in other topics) | -| [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package) | New (previously published in Hardware Dev Center on MSDN) | -| [Create a provisioning package with multivariant settings](/windows/configuration/provisioning-packages/provisioning-multivariant) | New (previously published in Hardware Dev Center on MSDN) | -| [How provisioning works in Windows 10](/windows/configuration/provisioning-packages/provisioning-how-it-works) | New (previously published in Hardware Dev Center on MSDN) | -| [Install Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) | New (previously published in Hardware Dev Center on MSDN) | -| [NFC-based device provisioning](/windows/configuration/mobile-devices/provisioning-nfc) | New (previously published in Hardware Dev Center on MSDN) | -| [Settings changed when you uninstall a provisioning package](/windows/configuration/provisioning-packages/provisioning-uninstall-package) | New (previously published in Hardware Dev Center on MSDN) | -| [Use a script to install a desktop app in provisioning packages](/windows/configuration/provisioning-packages/provisioning-script-to-install-app) | New (previously published in Hardware Dev Center on MSDN) | -| [Windows ICD command-line interface (reference)](/windows/configuration/provisioning-packages/provisioning-command-line) | New (previously published in Hardware Dev Center on MSDN) | -| [Get started with Upgrade Analytics](upgrade/upgrade-readiness-get-started.md) | Updated exit code table with suggested fixes, and added link to the Upgrade Analytics blog | -| [Provision PCs with common settings for initial deployment (simple provisioning)](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment) | Instructions for applying the provisioning package moved to [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) | -| [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates) | Instructions for applying the provisioning package moved to [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) | - - -## October 2016 -| New or changed topic | Description | -|----------------------|-------------| -| [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) | New | - -## September 2016 -| New or changed topic | Description | -|----------------------|-------------| -| [Windows 10 Enterprise E3 in CSP Overview](windows-10-enterprise-e3-overview.md) | New | -| [Get started with Upgrade Analytics](upgrade/upgrade-readiness-get-started.md) | Updated with prerequisites for site discovery | -| [Resolve application and driver issues](upgrade/upgrade-readiness-resolve-issues.md) | Updated with app status info for Ready For Windows | -| [Review site discovery](upgrade/upgrade-readiness-additional-insights.md) | New | - -## RELEASE: Windows 10, version 1607 - -The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). The following new topics have been added: - -- [Provisioning packages for Windows 10](/windows/configuration/provisioning-packages/provisioning-packages.md) -- [Provision PCs with apps and certificates for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md) -- [Provision PCs with common settings for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md) - -## August 2016 -| New or changed topic | Description | -|----------------------|-------------| -| [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) | Updated with reboot requirements | - -## July 2016 -| New or changed topic | Description | -|----------------------|-------------| -| [Manage Windows upgrades with Upgrade Analytics](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) | New | - -## June 2016 -| New or changed topic | Description | -|----------------------|-------------| -| [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) | New | -| [User State Migration Tool Technical Reference](usmt/usmt-technical-reference.md) | Updated support statement for Office 2016 | -| [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) | New | - -## May 2016 -| New or changed topic | Description | -|----------------------|-------------| -| [Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md) | New | - -## December 2015 -| New or changed topic | Description | -|----------------------|-------------| -| [Activate using Key Management Service](volume-activation/activate-using-key-management-service-vamt.md) | Updated | -| [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) | Updated | - -## November 2015 -| New or changed topic | Description | -|----------------------|-------------| -| [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) | New | - -## Related topics -- [Change history for Plan for Windows 10 deployment](/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment) -- [Change history for Access Protection](/windows/access-protection/change-history-for-access-protection) -- [Change history for Device Security](/windows/device-security/change-history-for-device-security) -- [Change history for Threat Protection](/windows/threat-protection/change-history-for-threat-protection) diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md index 784c5a13fd..fcbd35b410 100644 --- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md +++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md @@ -7,12 +7,13 @@ ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.reviewer: manager: laurawi -audience: itpro author: greg-lindsay ms.author: greglin ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Configure a PXE server to load Windows PE @@ -21,8 +22,6 @@ ms.topic: article - Windows 10 -## Summary - This walkthrough describes how to configure a PXE server to load Windows PE by booting a client computer from the network. Using the Windows PE tools and a Windows 10 image file, you can install Windows 10 from the network. ## Prerequisites @@ -72,27 +71,27 @@ All four of the roles specified above can be hosted on the same computer or each ``` net use y: \\PXE-1\TFTPRoot y: - md boot + md Boot ``` 6. Copy the PXE boot files from the mounted directory to the \boot folder. For example: ``` - copy c:\winpe_amd64\mount\windows\boot\pxe\*.* y:\boot + copy c:\winpe_amd64\mount\windows\boot\pxe\*.* y:\Boot ``` 7. Copy the boot.sdi file to the PXE/TFTP server. ``` - copy C:\winpe_amd64\media\boot\boot.sdi y:\boot + copy C:\winpe_amd64\media\boot\boot.sdi y:\Boot ``` 8. Copy the bootable Windows PE image (boot.wim) to the \boot folder. ``` - copy C:\winpe_amd64\media\sources\boot.wim y:\boot + copy C:\winpe_amd64\media\sources\boot.wim y:\Boot ``` 9. (Optional) Copy true type fonts to the \boot folder ``` - copy C:\winpe_amd64\media\Boot\Fonts y:\boot\Fonts + copy C:\winpe_amd64\media\Boot\Fonts y:\Boot\Fonts ``` ## Step 2: Configure boot settings and copy the BCD file @@ -107,7 +106,7 @@ All four of the roles specified above can be hosted on the same computer or each ``` bcdedit /store c:\BCD /create {ramdiskoptions} /d "Ramdisk options" bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdidevice boot - bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdipath \boot\boot.sdi + bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdipath \Boot\boot.sdi bcdedit /store c:\BCD /create /d "winpe boot image" /application osloader ``` The last command will return a GUID, for example: @@ -119,9 +118,9 @@ All four of the roles specified above can be hosted on the same computer or each 3. Create a new boot application entry for the Windows PE image: ``` - bcdedit /store c:\BCD /set {GUID1} device ramdisk=[boot]\boot\boot.wim,{ramdiskoptions} + bcdedit /store c:\BCD /set {GUID1} device ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} bcdedit /store c:\BCD /set {GUID1} path \windows\system32\winload.exe - bcdedit /store c:\BCD /set {GUID1} osdevice ramdisk=[boot]\boot\boot.wim,{ramdiskoptions} + bcdedit /store c:\BCD /set {GUID1} osdevice ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} bcdedit /store c:\BCD /set {GUID1} systemroot \windows bcdedit /store c:\BCD /set {GUID1} detecthal Yes bcdedit /store c:\BCD /set {GUID1} winpe Yes @@ -136,7 +135,7 @@ All four of the roles specified above can be hosted on the same computer or each 5. Copy the BCD file to your TFTP server: ``` - copy c:\BCD \\PXE-1\TFTPRoot\boot\BCD + copy c:\BCD \\PXE-1\TFTPRoot\Boot\BCD ``` Your PXE/TFTP server is now configured. You can view the BCD settings that have been configured using the command bcdedit /store <BCD file location> /enum all. See the following example. Note: Your GUID will be different than the one shown below. @@ -153,9 +152,9 @@ timeout 30 Windows Boot Loader ------------------- identifier {a4f89c62-2142-11e6-80b6-00155da04110} -device ramdisk=[boot]\boot\boot.wim,{ramdiskoptions} +device ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} description winpe boot image -osdevice ramdisk=[boot]\boot\boot.wim,{ramdiskoptions} +osdevice ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} systemroot \Windows detecthal Yes winpe Yes @@ -165,7 +164,7 @@ Setup Ramdisk Options identifier {ramdiskoptions} description ramdisk options ramdisksdidevice boot -ramdisksdipath \boot\boot.sdi +ramdisksdipath \Boot\boot.sdi ``` >[!TIP] diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 55c9e3dfac..e43658fdb5 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -1,252 +1,252 @@ ---- -title: Deploy Windows 10 Enterprise licenses -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -description: Steps to deploy Windows 10 Enterprise licenses for Windows 10 Enterprise E3 or E5 Subscription Activation, or for Windows 10 Enterprise E3 in CSP -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Deploy Windows 10 Enterprise licenses - -This topic describes how to deploy Windows 10 Enterprise E3 or E5 licenses with [Windows 10 Enterprise Subscription Activation](windows-10-subscription-activation.md) or [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) and Azure Active Directory (Azure AD). - ->[!NOTE] ->* Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later. ->* Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later. ->* Automatic, non-KMS activation requires Windows 10, version 1803 or later, on a device with a firmware-embedded activation key. - -## Firmware-embedded activation key - -To determine if the computer has a firmware-embedded activation key, type the following command at an elevated Windows PowerShell prompt - -``` -(Get-WmiObject -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKey -``` - -If the device has a firmware-embedded activation key, it will be displayed in the output. If the output is blank, the device does not have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later will have a firmware-embedded key. - -## Enabling Subscription Activation with an existing EA - -If you are an EA customer with an existing Office 365 tenant, use the following steps to enable Windows 10 Subscription licenses on your existing tenant: - -1. Work with your reseller to place an order for one $0 SKU per user. There are two SKUs available, depending on their current Windows Enterprise SA license: -2. **AAA-51069** - Win10UsrOLSActv Alng MonthlySub Addon E3 -3. **AAA-51068** - Win10UsrOLSActv Alng MonthlySub Addon E5 -4. After placing an order, the OLS admin on the agreement will receive a service activation email, indicating their subscription licenses have been provisioned on the tenant. -5. The admin can now assign subscription licenses to users. - ->Use the following process if you need to update contact information and retrigger activation in order to resend the activation email: - -1. Sign in to the [Microsoft Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). -2. Click on **Subscriptions**. -3. Click on **Online Services Agreement List**. -4. Enter your agreement number, and then click **Search**. -5. Click the **Service Name**. -6. In the **Subscription Contact** section, click the name listed under **Last Name**. -7. Update the contact information, then click **Update Contact Details**. This will trigger a new email. - -Also in this article: -- [Explore the upgrade experience](#explore-the-upgrade-experience): How to upgrade devices using the deployed licenses. -- [Troubleshoot the user experience](#troubleshoot-the-user-experience): Examples of some license activation issues that can be encountered, and how to resolve them. - -## Active Directory synchronization with Azure AD - -You probably have on-premises Active Directory Domain Services (AD DS) domains. Users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Enterprise E3 or E5 licenses to users, you need to synchronize the identities in the on-premises ADDS domain with Azure AD. - -You might ask why you need to synchronize these identities. The answer is so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Enterprise E3 or E5). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them. - -**Figure 1** illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](https://www.microsoft.com/en-us/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure. - -![Illustration of Azure Active Directory Connect](images/enterprise-e3-ad-connect.png) - -**Figure 1. On-premises AD DS integrated with Azure AD** - -For more information about integrating on-premises AD DS domains with Azure AD, see the following resources: - -- [Integrating your on-premises identities with Azure Active Directory](https://azure.microsoft.com/documentation/articles/active-directory-aadconnect/) -- [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/) - ->[!NOTE] ->If you are implementing Azure AD, and you already have an on-premises domain, you don't need to integrate with Azure AD, since your main authentication method is your internal AD. If you want to manage all your infrastructure in the cloud, you can safely configure your domain controller remotely to integrate your computers with Azure AD, but you won't be able to apply fine controls using GPO. Azure AD is best suited for the global administration of devices when you don't have any on-premises servers. - -## Preparing for deployment: reviewing requirements - -Devices must be running Windows 10 Pro, version 1703, and be Azure Active Directory joined, or hybrid domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices), later in this topic. - -## Assigning licenses to users - -Upon acquisition of Windows 10 subscription has been completed (Windows 10 Business, E3 or E5), customers will receive an email that will provide guidance on how to use Windows as an online service: - -![profile](images/al01.png) - -The following methods are available to assign licenses: - -1. When you have the required Azure AD subscription, [group-based licensing](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal) is the preferred method to assign Enterprise E3 or E5 licenses to users. -2. You can sign in to portal.office.com and manually assign licenses: - - ![portal](images/al02.png) - -3. You can assign licenses by uploading a spreadsheet. -4. A per-user [PowerShell scripted method](https://social.technet.microsoft.com/wiki/contents/articles/15905.how-to-use-powershell-to-automatically-assign-licenses-to-your-office-365-users.aspx) of assigning licenses is available. -5. Organizations can use synchronized [AD groups](https://ronnydejong.com/2015/03/04/assign-ems-licenses-based-on-local-active-directory-group-membership/) to automatically assign licenses. - -## Explore the upgrade experience - -Now that your subscription has been established and Windows 10 Enterprise E3 or E5 licenses have been assigned to users, the users are ready to upgrade their devices running Windows 10 Pro, (version 1703 or later) to Windows 10 Enterprise. What will the users experience? How will they upgrade their devices? - -### Step 1: Join Windows 10 Pro devices to Azure AD - -Users can join a Windows 10 Pro device to Azure AD the first time they start the device (during setup), or they can join a device that they already use running Windows 10 Pro, version 1703. - -**To join a device to Azure AD the first time the device is started** - -1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then click **Next**, as illustrated in **Figure 2**. - - Who owns this PC? page in Windows 10 setup - - **Figure 2. The “Who owns this PC?” page in initial Windows 10 setup** - -2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 3**. - - Choose how you'll connect - page in Windows 10 setup - - **Figure 3. The “Choose how you’ll connect” page in initial Windows 10 setup** - -3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 4**. - - Let's get you signed in - page in Windows 10 setup - - **Figure 4. The “Let’s get you signed in” page in initial Windows 10 setup** - -Now the device is Azure AD joined to the company’s subscription. - -**To join a device to Azure AD when the device already has Windows 10 Pro, version 1703 installed and set up** - ->[!IMPORTANT] ->Make sure that the user you're signing in with is **not** a BUILTIN/Administrator. That user cannot use the `+ Connect` button to join a work or school account. - -1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 5**. - - Connect to work or school configuration - - **Figure 5. Connect to work or school configuration in Settings** - -2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 6**. - - Set up a work or school account - - **Figure 6. Set up a work or school account** - -3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 7**. - - Let's get you signed in - dialog box - - **Figure 7. The “Let’s get you signed in” dialog box** - -Now the device is Azure AD joined to the company’s subscription. - -### Step 2: Pro edition activation - ->[!IMPORTANT] ->If your device is running Windows 10, version 1803 or later, this step is not needed. From Windows 10, version 1803, the device will automatically activate Windows 10 Enterprise using the firmware-embedded activation key. ->If the device is running Windows 10, version 1703 or 1709, then Windows 10 Pro must be successfully activated in **Settings > Update & Security > Activation**, as illustrated in **Figure 7a**. - - -Windows 10 Pro activated -Figure 7a - Windows 10 Pro activation in Settings - -Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled (Windows 10, versions 1703 and 1709 only). - - -### Step 3: Sign in using Azure AD account - -Once the device is joined to your Azure AD subscription, the user will sign in by using his or her Azure AD account, as illustrated in **Figure 8**. The Windows 10 Enterprise E3 or E5 license associated with the user will enable Windows 10 Enterprise edition capabilities on the device. - -Sign in, Windows 10 - -**Figure 8. Sign in by using Azure AD account** - -### Step 4: Verify that Enterprise edition is enabled - -You can verify the Windows 10 Enterprise E3 or E5 subscription in **Settings > Update & Security > Activation**, as illustrated in **Figure 9**. - - -Windows 10 activated and subscription active - -**Figure 9 - Windows 10 Enterprise subscription in Settings** - - -If there are any problems with the Windows 10 Enterprise E3 or E5 license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process. - ->[!NOTE] ->If you use slmgr /dli or /dlv commands to retrieve the activation information for the Windows 10 E3 or E5 license, the license information displayed will be the following: ->Name: Windows(R), Professional edition ->Description: Windows(R) Operating System, RETAIL channel ->Partial Product Key: 3V66T - -## Virtual Desktop Access (VDA) - -Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx). - -Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Enterprise Subscription Activation](vda-subscription-activation.md). - -## Troubleshoot the user experience - -In some instances, users may experience problems with the Windows 10 Enterprise E3 or E5 subscription. The most common problems that users may experience are as follows: - -- The existing Windows 10 Pro, version 1703 or 1709 operating system is not activated. This problem does not apply to Windows 10, version 1803 or later. - -- The Windows 10 Enterprise E3 or E5 subscription has lapsed or has been removed. - -Use the following figures to help you troubleshoot when users experience these common problems: - -- [Figure 9](#win-10-activated-subscription-active) (above) illustrates a device in a healthy state, where Windows 10 Pro is activated and the Windows 10 Enterprise subscription is active. - -- [Figure 10](#win-10-not-activated) (below) illustrates a device on which Windows 10 Pro is not activated, but the Windows 10 Enterprise subscription is active. - -- [Figure 11](#subscription-not-active) (below) illustrates a device on which Windows 10 Pro is activated, but the Windows 10 Enterprise subscription is lapsed or removed. - -- [Figure 12](#win-10-not-activated-subscription-not-active) (below) illustrates a device on which Windows 10 Pro license is not activated and the Windows 10 Enterprise subscription is lapsed or removed. - - - -Windows 10 not activated and subscription active -Figure 10 - Windows 10 Pro, version 1703 edition not activated in Settings - - - -Windows 10 activated and subscription not active -Figure 11 - Windows 10 Enterprise subscription lapsed or removed in Settings - - - -Windows 10 not activated and subscription not active -Figure 12 - Windows 10 Pro, version 1703 edition not activated and Windows 10 Enterprise subscription lapsed or removed in Settings - - -### Review requirements on devices - -Devices must be running Windows 10 Pro, version 1703, and be Azure Active Directory joined, or hybrid domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. You can use the following procedures to review whether a particular device meets requirements. - -**To determine if a device is Azure Active Directory joined:** - -1. Open a command prompt and type **dsregcmd /status**. - -2. Review the output under Device State. If the **AzureAdJoined** status is YES, the device is Azure Active Directory joined. - -**To determine the version of Windows 10:** - -- At a command prompt, type: - **winver** - - A popup window will display the Windows 10 version number and detailed OS build information. - - If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be upgraded to Windows 10 Enterprise when a user signs in, even if the user has been assigned a subscription in the CSP portal. +--- +title: Deploy Windows 10 Enterprise licenses +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +description: Steps to deploy Windows 10 Enterprise licenses for Windows 10 Enterprise E3 or E5 Subscription Activation, or for Windows 10 Enterprise E3 in CSP +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Deploy Windows 10 Enterprise licenses + +This topic describes how to deploy Windows 10 Enterprise E3 or E5 licenses with [Windows 10 Enterprise Subscription Activation](windows-10-subscription-activation.md) or [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) and Azure Active Directory (Azure AD). + +>[!NOTE] +>* Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later. +>* Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later. +>* Automatic, non-KMS activation requires Windows 10, version 1803 or later, on a device with a firmware-embedded activation key. + +>[!IMPORTANT] +>An issue has been identified where devices can lose activation status or be blocked from upgrading to Windows Enterprise if the device is not able to connect to Windows Update. A workaround is to ensure that devices do not have the REG_DWORD present HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations and set to 1. If this REG_DWORD is present, it must be set to 0.
              +>Also ensure that the Group Policy setting: Computer Configuration > Administrative Templates > Windows Components > Windows Update > "Do not connect to any Windows Update Internet locations" is set to "Disabled". + +## Firmware-embedded activation key + +To determine if the computer has a firmware-embedded activation key, type the following command at an elevated Windows PowerShell prompt + +``` +(Get-WmiObject -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKey +``` + +If the device has a firmware-embedded activation key, it will be displayed in the output. If the output is blank, the device does not have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later will have a firmware-embedded key. + +## Enabling Subscription Activation with an existing EA + +If you are an EA customer with an existing Office 365 tenant, use the following steps to enable Windows 10 Subscription licenses on your existing tenant: + +1. Work with your reseller to place an order for one $0 SKU per user. There are two SKUs available, depending on their current Windows Enterprise SA license: +2. **AAA-51069** - Win10UsrOLSActv Alng MonthlySub Addon E3 +3. **AAA-51068** - Win10UsrOLSActv Alng MonthlySub Addon E5 +4. After placing an order, the OLS admin on the agreement will receive a service activation email, indicating their subscription licenses have been provisioned on the tenant. +5. The admin can now assign subscription licenses to users. + +>Use the following process if you need to update contact information and retrigger activation in order to resend the activation email: + +1. Sign in to the [Microsoft Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). +2. Click on **Subscriptions**. +3. Click on **Online Services Agreement List**. +4. Enter your agreement number, and then click **Search**. +5. Click the **Service Name**. +6. In the **Subscription Contact** section, click the name listed under **Last Name**. +7. Update the contact information, then click **Update Contact Details**. This will trigger a new email. + +Also in this article: +- [Explore the upgrade experience](#explore-the-upgrade-experience): How to upgrade devices using the deployed licenses. +- [Troubleshoot the user experience](#troubleshoot-the-user-experience): Examples of some license activation issues that can be encountered, and how to resolve them. + +## Active Directory synchronization with Azure AD + +You probably have on-premises Active Directory Domain Services (AD DS) domains. Users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Enterprise E3 or E5 licenses to users, you need to synchronize the identities in the on-premises ADDS domain with Azure AD. + +You might ask why you need to synchronize these identities. The answer is so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Enterprise E3 or E5). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them. + +**Figure 1** illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](https://www.microsoft.com/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure. + +![Illustration of Azure Active Directory Connect](images/enterprise-e3-ad-connect.png) + +**Figure 1. On-premises AD DS integrated with Azure AD** + +For more information about integrating on-premises AD DS domains with Azure AD, see the following resources: + +- [Integrating your on-premises identities with Azure Active Directory](https://azure.microsoft.com/documentation/articles/active-directory-aadconnect/) +- [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/) + +>[!NOTE] +>If you are implementing Azure AD, and you already have an on-premises domain, you don't need to integrate with Azure AD, since your main authentication method is your internal AD. If you want to manage all your infrastructure in the cloud, you can safely configure your domain controller remotely to integrate your computers with Azure AD, but you won't be able to apply fine controls using GPO. Azure AD is best suited for the global administration of devices when you don't have any on-premises servers. + +## Preparing for deployment: reviewing requirements + +Devices must be running Windows 10 Pro, version 1703, and be Azure Active Directory joined, or hybrid domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices), later in this topic. + +## Assigning licenses to users + +Upon acquisition of Windows 10 subscription has been completed (Windows 10 Business, E3 or E5), customers will receive an email that will provide guidance on how to use Windows as an online service: + +![profile](images/al01.png) + +The following methods are available to assign licenses: + +1. When you have the required Azure AD subscription, [group-based licensing](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal) is the preferred method to assign Enterprise E3 or E5 licenses to users. +2. You can sign in to portal.office.com and manually assign licenses: + + ![portal](images/al02.png) + +3. You can assign licenses by uploading a spreadsheet. +4. A per-user [PowerShell scripted method](https://social.technet.microsoft.com/wiki/contents/articles/15905.how-to-use-powershell-to-automatically-assign-licenses-to-your-office-365-users.aspx) of assigning licenses is available. +5. Organizations can use synchronized [AD groups](https://ronnydejong.com/2015/03/04/assign-ems-licenses-based-on-local-active-directory-group-membership/) to automatically assign licenses. + +## Explore the upgrade experience + +Now that your subscription has been established and Windows 10 Enterprise E3 or E5 licenses have been assigned to users, the users are ready to upgrade their devices running Windows 10 Pro, (version 1703 or later) to Windows 10 Enterprise. What will the users experience? How will they upgrade their devices? + +### Step 1: Join Windows 10 Pro devices to Azure AD + +Users can join a Windows 10 Pro device to Azure AD the first time they start the device (during setup), or they can join a device that they already use running Windows 10 Pro, version 1703. + +**To join a device to Azure AD the first time the device is started** + +1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then click **Next**, as illustrated in **Figure 2**.
              + + Who owns this PC? page in Windows 10 setup + + **Figure 2. The “Who owns this PC?” page in initial Windows 10 setup** + +2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 3**.
              + + Choose how you'll connect - page in Windows 10 setup + + **Figure 3. The “Choose how you’ll connect” page in initial Windows 10 setup** + +3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 4**.
              + + Let's get you signed in - page in Windows 10 setup + + **Figure 4. The “Let’s get you signed in” page in initial Windows 10 setup** + +Now the device is Azure AD joined to the company’s subscription. + +**To join a device to Azure AD when the device already has Windows 10 Pro, version 1703 installed and set up** + +>[!IMPORTANT] +>Make sure that the user you're signing in with is **not** a BUILTIN/Administrator. That user cannot use the `+ Connect` button to join a work or school account. + +1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 5**.
              + + Connect to work or school configuration + + **Figure 5. Connect to work or school configuration in Settings** + +2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 6**.
              + + Set up a work or school account + + **Figure 6. Set up a work or school account** + +3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 7**.
              + + Let's get you signed in - dialog box + + **Figure 7. The “Let’s get you signed in” dialog box** + +Now the device is Azure AD joined to the company’s subscription. + +### Step 2: Pro edition activation + +>[!IMPORTANT] +>If your device is running Windows 10, version 1803 or later, this step is not needed. From Windows 10, version 1803, the device will automatically activate Windows 10 Enterprise using the firmware-embedded activation key. +>If the device is running Windows 10, version 1703 or 1709, then Windows 10 Pro must be successfully activated in **Settings > Update & Security > Activation**, as illustrated in **Figure 7a**. + + +Windows 10 Pro activated +
              Figure 7a - Windows 10 Pro activation in Settings + +Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled (Windows 10, versions 1703 and 1709 only). + + +### Step 3: Sign in using Azure AD account + +Once the device is joined to your Azure AD subscription, the user will sign in by using his or her Azure AD account, as illustrated in **Figure 8**. The Windows 10 Enterprise E3 or E5 license associated with the user will enable Windows 10 Enterprise edition capabilities on the device. + +Sign in, Windows 10 + +**Figure 8. Sign in by using Azure AD account** + +### Step 4: Verify that Enterprise edition is enabled + +You can verify the Windows 10 Enterprise E3 or E5 subscription in **Settings > Update & Security > Activation**, as illustrated in **Figure 9**. + + +Windows 10 activated and subscription active + +**Figure 9 - Windows 10 Enterprise subscription in Settings** + + +If there are any problems with the Windows 10 Enterprise E3 or E5 license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process. + +>[!NOTE] +>If you use slmgr /dli or /dlv commands to retrieve the activation information for the Windows 10 E3 or E5 license, the license information displayed will be the following: +>Name: Windows(R), Professional edition +>Description: Windows(R) Operating System, RETAIL channel +>Partial Product Key: 3V66T + +## Virtual Desktop Access (VDA) + +Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx). + +Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Enterprise Subscription Activation](vda-subscription-activation.md). + +## Troubleshoot the user experience + +In some instances, users may experience problems with the Windows 10 Enterprise E3 or E5 subscription. The most common problems that users may experience are as follows: + +- The existing Windows 10 Pro, version 1703 or 1709 operating system is not activated. This problem does not apply to Windows 10, version 1803 or later. + +- The Windows 10 Enterprise E3 or E5 subscription has lapsed or has been removed. + +Use the following figures to help you troubleshoot when users experience these common problems: + +- [Figure 9](#win-10-activated-subscription-active) (see the section above) illustrates a device in a healthy state, where Windows 10 Pro is activated and the Windows 10 Enterprise subscription is active. + +- [Figure 10](#win-10-not-activated) (below) illustrates a device on which Windows 10 Pro is not activated, but the Windows 10 Enterprise subscription is active. + + + Windows 10 not activated and subscription active +
              Figure 10 - Windows 10 Pro, version 1703 edition not activated in Settings + +- [Figure 11](#subscription-not-active) (below) illustrates a device on which Windows 10 Pro is activated, but the Windows 10 Enterprise subscription is lapsed or removed. + + + Windows 10 activated and subscription not active +
              Figure 11 - Windows 10 Enterprise subscription lapsed or removed in Settings + +- [Figure 12](#win-10-not-activated-subscription-not-active) (below) illustrates a device on which Windows 10 Pro license is not activated and the Windows 10 Enterprise subscription is lapsed or removed. + + + Windows 10 not activated and subscription not active +
              Figure 12 - Windows 10 Pro, version 1703 edition not activated and Windows 10 Enterprise subscription lapsed or removed in Settings + +### Review requirements on devices + +Devices must be running Windows 10 Pro, version 1703, and be Azure Active Directory joined, or hybrid domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. You can use the following procedures to review whether a particular device meets requirements. + +**To determine if a device is Azure Active Directory joined:** + +1. Open a command prompt and type **dsregcmd /status**. +2. Review the output under Device State. If the **AzureAdJoined** status is YES, the device is Azure Active Directory joined. + +**To determine the version of Windows 10:** + +At a command prompt, type: **winver** + +A popup window will display the Windows 10 version number and detailed OS build information. + +If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be upgraded to Windows 10 Enterprise when a user signs in, even if the user has been assigned a subscription in the CSP portal. diff --git a/windows/deployment/deploy-m365.md b/windows/deployment/deploy-m365.md index 1ec460b74e..b541debb81 100644 --- a/windows/deployment/deploy-m365.md +++ b/windows/deployment/deploy-m365.md @@ -1,78 +1,80 @@ ---- -title: Deploy Windows 10 with Microsoft 365 -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Concepts about deploying Windows 10 for M365 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -keywords: deployment, automate, tools, configure, mdt, sccm, M365 -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-modern-desktop ---- - -# Deploy Windows 10 with Microsoft 365 - -**Applies to** - -- Windows 10 - -This topic provides a brief overview of Microsoft 365 and describes how to use a free 90-day trial account to review some of the benefits of Microsoft 365. - -[Microsoft 365](https://www.microsoft.com/microsoft-365) is a new offering from Microsoft that combines [Windows 10](https://www.microsoft.com/windows/features) with [Office 365](https://products.office.com/business/explore-office-365-for-business), and [Enterprise Mobility and Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) (EMS). See the [M365 Enterprise poster](#m365-enterprise-poster) for an overview. - -For Windows 10 deployment, Microsoft 365 includes a fantastic deployment advisor that can walk you through the entire process of deploying Windows 10. The wizard supports multiple Windows 10 deployment methods, including: - -- Windows Autopilot -- In-place upgrade -- Deploying Windows 10 upgrade with Intune -- Deploying Windows 10 upgrade with System Center Configuration Manager -- Deploying a computer refresh with System Center Configuration Manager - -## Free trial account - -**If you already have a Microsoft services subscription account and access to the Microsoft 365 Admin Center** - -From the [Microsoft 365 Admin Center](https://portal.office.com), go to Billing and then Purchase services. -In the Enterprise Suites section of the service offerings, you will find Microsoft 365 E3 and Microsoft 365 E5 tiles. -There are "Start Free Trial" options available for your selection by hovering your mouse over the tiles. - -**If you do not already have a Microsoft services subscription** - -You can check out the Microsoft 365 deployment advisor and other resources for free! Just follow the steps below. - ->[!NOTE] ->If you have not run a setup guide before, you will see the **Prepare your environment** guide first. This is to make sure you have basics covered like domain verification and a method for adding users. At the end of the "Prepare your environment" guide, there will be a **Ready to continue** button that sends you to the original guide that was selected. - -1. [Obtain a free M365 trial](https://docs.microsoft.com/office365/admin/try-or-buy-microsoft-365). -2. Check out the [Microsoft 365 deployment advisor](https://portal.office.com/onboarding/Microsoft365DeploymentAdvisor#/). -3. Also check out the [Windows Analytics deployment advisor](https://portal.office.com/onboarding/WindowsAnalyticsDeploymentAdvisor#/). This advisor will walk you through deploying [Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness), [Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), and [Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor). - -That's all there is to it! - -Examples of these two deployment advisors are shown below. - -- [Microsoft 365 deployment advisor example](#microsoft-365-deployment-advisor-example) -- [Windows Analytics deployment advisor example](#windows-analytics-deployment-advisor-example) - -## Microsoft 365 deployment advisor example -![Microsoft 365 deployment advisor](images/m365da.png) - -## Windows Analytics deployment advisor example - - -## M365 Enterprise poster - -[![M365 Enterprise poster](images/m365e.png)](https://aka.ms/m365eposter) - -## Related Topics - -[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md)
              -[Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) - - - +--- +title: Deploy Windows 10 with Microsoft 365 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Learn about deploying Windows 10 with Microsoft 365 and how to use a free 90-day trial account to review some of the benefits of Microsoft 365. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +keywords: deployment, automate, tools, configure, mdt, sccm, M365 +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.topic: article +ms.collection: M365-modern-desktop +ms.custom: seo-marvel-apr2020 +--- + +# Deploy Windows 10 with Microsoft 365 + +**Applies to** + +- Windows 10 + +This topic provides a brief overview of Microsoft 365 and describes how to use a free 90-day trial account to review some of the benefits of Microsoft 365. + +[Microsoft 365](https://www.microsoft.com/microsoft-365) is a new offering from Microsoft that combines [Windows 10](https://www.microsoft.com/windows/features) with [Office 365](https://products.office.com/business/explore-office-365-for-business), and [Enterprise Mobility and Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) (EMS). See the [M365 Enterprise poster](#m365-enterprise-poster) for an overview. + +For Windows 10 deployment, Microsoft 365 includes a fantastic deployment advisor that can walk you through the entire process of deploying Windows 10. The wizard supports multiple Windows 10 deployment methods, including: + +- Windows Autopilot +- In-place upgrade +- Deploying Windows 10 upgrade with Intune +- Deploying Windows 10 upgrade with Microsoft Endpoint Configuration Manager +- Deploying a computer refresh with Microsoft Endpoint Configuration Manager + +## Free trial account + +**If you already have a Microsoft services subscription account and access to the Microsoft 365 Admin Center** + +From the [Microsoft 365 Admin Center](https://portal.office.com), go to Billing and then Purchase services. +In the Enterprise Suites section of the service offerings, you will find Microsoft 365 E3 and Microsoft 365 E5 tiles. +There are "Start Free Trial" options available for your selection by hovering your mouse over the tiles. + +**If you do not already have a Microsoft services subscription** + +You can check out the Microsoft 365 deployment advisor and other resources for free! Just follow the steps below. + +>[!NOTE] +>If you have not run a setup guide before, you will see the **Prepare your environment** guide first. This is to make sure you have basics covered like domain verification and a method for adding users. At the end of the "Prepare your environment" guide, there will be a **Ready to continue** button that sends you to the original guide that was selected. + +1. [Obtain a free M365 trial](https://docs.microsoft.com/office365/admin/try-or-buy-microsoft-365). +2. Check out the [Microsoft 365 deployment advisor](https://aka.ms/microsoft365setupguide). +3. Also check out the [Windows Analytics deployment advisor](https://aka.ms/windowsanalyticssetupguide). This advisor will walk you through deploying [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview). + +That's all there is to it! + +Examples of these two deployment advisors are shown below. + +- [Microsoft 365 deployment advisor example](#microsoft-365-deployment-advisor-example) +- [Windows Analytics deployment advisor example](#windows-analytics-deployment-advisor-example) + +## Microsoft 365 deployment advisor example +![Microsoft 365 deployment advisor](images/m365da.png) + +## Windows Analytics deployment advisor example + + +## M365 Enterprise poster + +[![M365 Enterprise poster](images/m365e.png)](https://aka.ms/m365eposter) + +## Related Topics + +[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md)
              +[Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) + + + diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index 85ffed51b0..f73558bd91 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -1,184 +1,212 @@ ---- -title: What's new in Windows 10 deployment -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Changes and new features related to Windows 10 deployment -keywords: deployment, automate, tools, configure, news -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.prod: w10 -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# What's new in Windows 10 deployment - -**Applies to** -- Windows 10 - -## In this topic - -This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization. - -- For an all-up overview of new features in Windows 10, see [What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/index). -- For a detailed list of changes to Windows 10 ITPro TechNet library content, see [Online content change history](#online-content-change-history). - -## Recent additions to this page - -[SetupDiag](#setupdiag) 1.4.1 is released.
              -The [Windows ADK for Windows 10, version 1903](https://docs.microsoft.com/windows-hardware/get-started/adk-install) is available.
              -New [Windows Autopilot](#windows-autopilot) content is available.
              -[Windows 10 Subscription Activation](#windows-10-subscription-activation) now supports Windows 10 Education. - -## The Modern Desktop Deployment Center - -The [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) has launched with tons of content to help you with large-scale deployment of Windows 10 and Office 365 ProPlus. - -## Microsoft 365 - -Microsoft 365 is a new offering from Microsoft that combines -- Windows 10 -- Office 365 -- Enterprise Mobility and Security (EMS). - -See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, which now includes a link to download a nifty [M365 Enterprise poster](deploy-m365.md#m365-enterprise-poster). - -## Windows 10 servicing and support - -- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon! -- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. -- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. -- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. -- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. -- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. -- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. -- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. - -Microsoft previously announced that we are [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Office 365 ProPlus will continue to be supported for 18 months (there is no change for these editions). These support policies are summarized in the table below. - -![Support lifecycle](images/support-cycle.png) - -## Windows 10 Enterprise upgrade - -Windows 10 version 1703 includes a Windows 10 Enterprise E3 and E5 benefit to Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA). These customers can now subscribe users to Windows 10 Enterprise E3 or E5 and activate their subscriptions on up to five devices. Virtual machines can also be activated. For more information, see [Windows 10 Enterprise Subscription Activation](windows-10-subscription-activation.md). - -Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise to their users. With Windows 10 Enterprise E3 in CSP, small and medium-sized organizations can more easily take advantage of Windows 10 Enterprise features. - -For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) - - -## Deployment solutions and tools - -### Windows Autopilot - -[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose and recover devices. - -The following Windows Autopilot features are available in Windows 10, version 1903 and later: - -- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in Windows 10, version 1903. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users. -- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. -- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. -- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. - -### Windows 10 Subscription Activation - -Windows 10 Education support has been added to Windows 10 Subscription Activation. - -With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation). - -### SetupDiag - -[SetupDiag](upgrade/setupdiag.md) is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. - -SetupDiag version 1.4.1 was released on 5/17/2019. - -### Upgrade Readiness - -The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017. - -Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. - -The development of Upgrade Readiness has been heavily influenced by input from the community the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. - -For more information about Upgrade Readiness, see the following topics: - -- [Windows Analytics blog](https://aka.ms/blog/WindowsAnalytics/) -- [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) - - -### Update Compliance - -Update Compliance helps you to keep Windows 10 devices in your organization secure and up-to-date. - -Update Compliance is a solution built using OMS Logs and Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. - -For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md). - -### Device Health - -Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by helping to identify devices crashes and the cause. Device drivers that are causing crashes are identified along with alternative drivers that might reduce the number of crashes. Windows Information Protection misconfigurations are also identified. For more information, see [Monitor the health of devices with Device Health](update/device-health-monitor.md) - -### MBR2GPT - -MBR2GPT.EXE converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. Previously, it was necessary to image, then wipe and reload a disk to change from MBR format to GPT. - -There are many benefits to converting the partition style of a disk to GPT, including the use of larger disk partitions, added data reliability, and faster boot and shutdown speeds. The GPT format also enables you to use the Unified Extensible Firmware Interface (UEFI) which replaces the Basic Input/Output System (BIOS) firmware interface. Security features of Windows 10 that require UEFI mode include: Secure Boot, Early Launch Anti-malware (ELAM) driver, Windows Trusted Boot, Measured Boot, Device Guard, Credential Guard, and BitLocker Network Unlock. - -For more information, see [MBR2GPT.EXE](mbr-to-gpt.md). - - -### Microsoft Deployment Toolkit (MDT) - -MDT build 8456 (12/19/2018) is available, including support for Windows 10, version 1809, and Windows Server 2019. - -For more information about MDT, see the [MDT resource page](https://docs.microsoft.com/sccm/mdt/). - - -### Windows Assessment and Deployment Kit (ADK) - -The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. See the following topics: - -- [What's new in ADK kits and tools](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools) -- [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) - - -## Testing and validation guidance - -### Windows 10 deployment proof of concept (PoC) - -The Windows 10 PoC guide enables you to test Windows 10 deployment in a virtual environment and become familiar with deployment tools such as MDT and Configuration Manager. The PoC guide provides step-by-step instructions for installing and using Hyper-V to create a virtual lab environment. The guide makes extensive use of Windows PowerShell to streamline each phase of the installation and setup. - -For more information, see the following guides: - -- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) -- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) -- [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) - - -## Troubleshooting guidance - -[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and will continue to be updated with new fixes. The topic provides a detailed explanation of the Windows 10 upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process. - - -## Online content change history - -The following topics provide a change history for Windows 10 ITPro TechNet library content related to deploying and using Windows 10. - -[Change history for Deploy Windows 10](change-history-for-deploy-windows-10.md) -
              [Change history for Access Protection](/windows/access-protection/change-history-for-access-protection) -
              [Change history for Device Security](/windows/device-security/change-history-for-device-security) -
              [Change history for Threat Protection](/windows/threat-protection/change-history-for-threat-protection) - - -## Related topics - -[Overview of Windows as a service](update/waas-overview.md) -
              [Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md) -
              [Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information) -
              [Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/en-us/windows/windows-10-specifications) -
              [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) -
              [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md) +--- +title: What's new in Windows 10 deployment +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Use this article to learn about new solutions and online content related to deploying Windows 10 in your organization. +keywords: deployment, automate, tools, configure, news +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.prod: w10 +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# What's new in Windows 10 deployment + +**Applies to** +- Windows 10 + +## In this topic + +This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization. + +- For an all-up overview of new features in Windows 10, see [What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/index). + +## Latest news + +[SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.
              +The [Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/adk-install) is available.
              +New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
              +VPN support is added to [Windows Autopilot](#windows-autopilot)
              +An in-place upgrade wizard is available in [Configuration Manager](#microsoft-endpoint-configuration-manager).
              +The [Windows ADK](#windows-assessment-and-deployment-kit-adk) for Windows 10, version 2004 is available.
              +The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with additional content added and more content coming soon.
              + +## The Modern Desktop Deployment Center + +The [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) has launched with tons of content to help you with large-scale deployment of Windows 10 and Microsoft 365 Apps for enterprise. + +## Microsoft 365 + +Microsoft 365 is a new offering from Microsoft that combines +- Windows 10 +- Office 365 +- Enterprise Mobility and Security (EMS). + +See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, which now includes a link to download a nifty [M365 Enterprise poster](deploy-m365.md#m365-enterprise-poster). + +## Windows 10 servicing and support + +### Delivery Optimization + +Windows PowerShell cmdlets for Delivery Optimization have been improved: + +- **Get-DeliveryOptimizationStatus** has added the **-PeerInfo** option for a real-time peak behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent). +- **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections. +- **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to assist in troubleshooting. + +Additional improvements in [Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization) include: +- Enterprise network [throttling is enhanced](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling. +- Automatic cloud-based congestion detection is available for PCs with cloud service support. +- Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon! + +The following Delivery Optimization policies are removed in the Windows 10, version 2004 release: + +- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth) + - Reason: Replaced with separate policies for foreground and background +- Max Upload Bandwidth (DOMaxUploadBandwidth) + - Reason: impacts uploads to internet peers only, which isn't used in Enterprises. +- Absolute max throttle (DOMaxDownloadBandwidth) + - Reason: separated to foreground and background + +### Windows Update for Business + +[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) enhancements in this release include: +- Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. +- Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. + +- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically log on as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. +- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. +- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. +- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. +- **Improved update notifications**: When there's an update requiring you to restart your device, you'll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. +- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. +- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. + +Microsoft previously announced that we are [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Microsoft 365 Apps for enterprise will continue to be supported for 18 months (there is no change for these editions). These support policies are summarized in the table below. + +![Support lifecycle](images/support-cycle.png) + +## Windows 10 Enterprise upgrade + +Windows 10 version 1703 includes a Windows 10 Enterprise E3 and E5 benefit to Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA). These customers can now subscribe users to Windows 10 Enterprise E3 or E5 and activate their subscriptions on up to five devices. Virtual machines can also be activated. For more information, see [Windows 10 Enterprise Subscription Activation](windows-10-subscription-activation.md). + +Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise to their users. With Windows 10 Enterprise E3 in CSP, small and medium-sized organizations can more easily take advantage of Windows 10 Enterprise features. + +For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) + +## Deployment solutions and tools + +### Windows Autopilot + +[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose and recover devices. + +With the release of Windows 10, version 2004 you can configure [Windows Autopilot user-driven](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven) Hybrid Azure Active Directory join with VPN support. This support is also backported to Windows 10, version 1909 and 1903. + +If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios will now skip the language, locale, and keyboard pages. In previous versions, this was only supported with self-deploying profiles. + +The following Windows Autopilot features are available in Windows 10, version 1903 and later: + +- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in Windows 10, version 1903. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users. +- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. +- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. +- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. +- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. + +### Microsoft Endpoint Configuration Manager + +An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364). + +### Windows 10 Subscription Activation + +Windows 10 Education support has been added to Windows 10 Subscription Activation. + +With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation). + +### SetupDiag + +[SetupDiag](upgrade/setupdiag.md) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. + +In Windows 10, version 2004, SetupDiag is now automatically installed. + +During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, Windows Setup now also installs SetupDiag.exe to this directory. If there is an issue with the upgrade, SetupDiag is automatically run to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under %SystemDrive%\Windows.Old for cleanup. + +### Upgrade Readiness + +The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017. + +Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. + +The development of Upgrade Readiness has been heavily influenced by input from the community the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. + +For more information about Upgrade Readiness, see the following topics: + +- [Windows Analytics blog](https://aka.ms/blog/WindowsAnalytics/) +- [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) + + +### Update Compliance + +Update Compliance helps you to keep Windows 10 devices in your organization secure and up-to-date. + +Update Compliance is a solution built using OMS Logs and Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. + +For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md). + +### Device Health + +Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by helping to identify devices crashes and the cause. Device drivers that are causing crashes are identified along with alternative drivers that might reduce the number of crashes. Windows Information Protection misconfigurations are also identified. For more information, see [Monitor the health of devices with Device Health](update/device-health-monitor.md) + +### MBR2GPT + +MBR2GPT.EXE converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. Previously, it was necessary to image, then wipe and reload a disk to change from MBR format to GPT. + +There are many benefits to converting the partition style of a disk to GPT, including the use of larger disk partitions, added data reliability, and faster boot and shutdown speeds. The GPT format also enables you to use the Unified Extensible Firmware Interface (UEFI) which replaces the Basic Input/Output System (BIOS) firmware interface. Security features of Windows 10 that require UEFI mode include: Secure Boot, Early Launch Anti-malware (ELAM) driver, Windows Trusted Boot, Measured Boot, Device Guard, Credential Guard, and BitLocker Network Unlock. + +For more information, see [MBR2GPT.EXE](mbr-to-gpt.md). + +### Microsoft Deployment Toolkit (MDT) + +MDT version 8456 supports Windows 10, version 2004 and earlier operating systems, including Windows Server 2019. There is currently an issue that causes MDT to incorrectly detect that UEFI is present in Windows 10, version 2004. This issue is currently under investigation. + +For the latest information about MDT, see the [MDT release notes](https://docs.microsoft.com/mem/configmgr/mdt/release-notes). + +### Windows Assessment and Deployment Kit (ADK) + +The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. + +Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install). + +For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004). + +Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). + +## Testing and validation guidance + +### Windows 10 deployment proof of concept (PoC) + +The Windows 10 PoC guide enables you to test Windows 10 deployment in a virtual environment and become familiar with deployment tools such as MDT and Configuration Manager. The PoC guide provides step-by-step instructions for installing and using Hyper-V to create a virtual lab environment. The guide makes extensive use of Windows PowerShell to streamline each phase of the installation and setup. + +For more information, see the following guides: + +- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) +- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) +- [Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md) + +## Troubleshooting guidance + +[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and will continue to be updated with new fixes. The topic provides a detailed explanation of the Windows 10 upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process. + +## Related topics + +[Overview of Windows as a service](update/waas-overview.md)
              +[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)
              +[Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information)
              +[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)
              +[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
              +[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
              diff --git a/windows/deployment/deploy-windows-cm/TOC.md b/windows/deployment/deploy-windows-cm/TOC.md new file mode 100644 index 0000000000..b26445c4ab --- /dev/null +++ b/windows/deployment/deploy-windows-cm/TOC.md @@ -0,0 +1,15 @@ +# Deploy Windows 10 with Microsoft Endpoint Configuration Manager +## Prepare for Windows 10 deployment with Configuration Manager +### [Prepare for Zero Touch Installation with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) +### [Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) +### [Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) +### [Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) +### [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) +### [Create a task sequence with Configuration Manager and MDT](create-a-task-sequence-with-configuration-manager-and-mdt.md) +### [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md) + +## Deploy Windows 10 with Configuration Manager +### [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) +### [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) +### [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) +### [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade-to-windows-10-with-configuraton-manager.md) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md new file mode 100644 index 0000000000..5d44f0af26 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md @@ -0,0 +1,71 @@ +--- +title: Add a Windows 10 operating system image using Configuration Manager +description: Operating system images are typically the production image used for deployment throughout the organization. +ms.assetid: 77f769cc-1a47-4f36-8082-201cd77b8d3b +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: image, deploy, distribute +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Add a Windows 10 operating system image using Configuration Manager + +**Applies to** + +- Windows 10 + +Operating system images are typically the production image used for deployment throughout the organization. This topic shows you how to add a Windows 10 operating system image created with Microsoft Endpoint Configuration Manager, and how to distribute the image to a distribution point. + +## Infrastructure + +For the purposes of this guide, we will use one server computer: CM01. +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. +- CM01 is running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + +An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +>[!IMPORTANT] +>The procedures in this article require a reference image. Our reference images is named **REFW10-X64-001.wim**. If you have not already created a reference image, then perform all the steps in [Create a Windows 10 reference image](../deploy-windows-mdt/create-a-windows-10-reference-image.md) on CM01, replacing MDT01 with CM01. The final result will be a reference image located in the D:\MDTBuildLab\Captures folder that you can use for the procedure below. + + ## Add a Windows 10 operating system image + + On **CM01**: + +1. Using File Explorer, in the **D:\\Sources\\OSD\\OS** folder, create a subfolder named **Windows 10 Enterprise x64 RTM**. +2. Copy the REFW10-X64-001.wim file to the **D:\\Sources\\OSD\\OS\\Windows 10 Enterprise x64 RTM** folder. + + ![figure 17](../images/ref-image.png) + + The Windows 10 image being copied to the Sources folder structure. + +3. Using the Configuration Manager Console, in the Software Library workspace, right-click **Operating System Images**, and select **Add Operating System Image**. +4. On the **Data Source** page, in the **Path:** text box, browse to \\\\CM01\\Sources$\\OSD\\OS\\Windows 10 Enterprise x64 RTM\\REFW10-X64-001.wim, select x64 next to Architecture and choose a language, then click **Next**. +5. On the **General** page, assign the name Windows 10 Enterprise x64 RTM, click **Next** twice, and then click **Close**. +6. Distribute the operating system image to the CM01 distribution point by right-clicking the **Windows 10 Enterprise x64 RTM** operating system image and then clicking **Distribute Content**. +7. In the Distribute Content Wizard, add the CM01 distribution point, click **Next** and click **Close**. +8. View the content status for the Windows 10 Enterprise x64 RTM package. Do not continue until the distribution is completed (it might take a few minutes). You also can review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for the **STATMSG: ID=2301** line. + + ![figure 18](../images/fig18-distwindows.png) + + The distributed Windows 10 Enterprise x64 RTM package. + +Next, see [Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md new file mode 100644 index 0000000000..85dcbc3828 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md @@ -0,0 +1,111 @@ +--- +title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager +description: Learn how to configure the Windows Preinstallation Environment (Windows PE) to include required network and storage drivers. +ms.assetid: 97b3ea46-28d9-407e-8c42-ded2e45e8d5c +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, task sequence +ms.prod: w10 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager + +**Applies to** + +- Windows 10 + +In this topic, you will learn how to configure the Windows Preinstallation Environment (Windows PE) to include the network drivers required to connect to the deployment share and the storage drivers required to see the local storage on machines. Even though the Windows PE boot image and the Windows 10 operating system contain many out-of-the-box drivers, it is likely you will have to add new or updated drivers to support all your hardware. In this section, you import drivers for both Windows PE and the full Windows 10 operating system. + +For the purposes of this guide, we will use one server computer: CM01. +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. CM01 is running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + + An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +## Add drivers for Windows PE + +This section will show you how to import some network and storage drivers for Windows PE. + +>[!NOTE] +>Windows PE usually has a fairly comprehensive set of drivers out of the box, assuming that you are using a recent version of the Windows ADK. This is different than the full Windows OS which will often require drivers. You shouldn't add drivers to Windows PE unless you have an issue or are missing functionality, and in these cases you should only add the driver that you need. An example of a common driver that is added is the Intel I217 driver. Adding too many drivers can cause conflicts and lead to driver bloat in the Config Mgr database. This section shows you how to add drivers, but typically you can just skip this procedure. + +This section assumes you have downloaded some drivers to the **D:\\Sources\\OSD\\DriverSources\\WinPE x64** folder on CM01. + +![Drivers](../images/cm01-drivers.png) + +Driver folder structure on CM01 + +On **CM01**: + +1. Using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, right-click the **Drivers** node and select **Import Driver**. +2. In the Import New Driver Wizard, on the **Specify a location to import driver** page, select the **Import all drivers in the following network path (UNC)** option, browse to the **\\\\CM01\\Sources$\\OSD\\DriverSources\\WinPE x64** folder and click **Next**. +3. On the **Specify the details for the imported driver** page, click **Categories**, create a category named **WinPE x64**, and then click **Next**. +4. On the **Select the packages to add the imported driver** page, click **Next**. +5. On the **Select drivers to include in the boot image** page, select the **Zero Touch WinPE x64** boot image and click **Next**. +6. In the popup window that appears, click **Yes** to automatically update the distribution point. +7. Click **Next**, wait for the image to be updated, and then click **Close**. + + ![Add drivers to Windows PE step 1](../images/fig21-add-drivers1.png)
              + ![Add drivers to Windows PE step 2](../images/fig21-add-drivers2.png)
              + ![Add drivers to Windows PE step 3](../images/fig21-add-drivers3.png)
              + ![Add drivers to Windows PE step 4](../images/fig21-add-drivers4.png) + + Add drivers to Windows PE + +## Add drivers for Windows 10 + +This section illustrates how to add drivers for Windows 10 using the HP EliteBook 8560w as an example. For the HP EliteBook 8560w, you use HP SoftPaq Download Manager to get the drivers. The HP SoftPaq Download Manager can be accessed on the [HP Support site](https://go.microsoft.com/fwlink/p/?LinkId=619545). + +For the purposes of this section, we assume that you have downloaded the Windows 10 drivers for the HP EliteBook 8560w model and copied them to the **D:\Sources$\OSD\DriverSources\Windows 10 x64\Hewlett-Packard\HP EliteBook 8560w** folder on CM01. + +![Drivers in Windows](../images/cm01-drivers-windows.png) + +Driver folder structure on CM01 + +On **CM01**: + +1. Using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, right-click the **Drivers** node and select **Import Driver**. +2. In the Import New Driver Wizard, on the **Specify a location to import driver** page, select the **Import all drivers in the following network path (UNC)** option, browse to the **\\\\CM01\\Sources$\\OSD\\DriverSources\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** folder and click **Next**. Wait a minute for driver information to be validated. +3. On the **Specify the details for the imported driver** page, click **Categories**, create a category named **Windows 10 x64 - HP EliteBook 8560w**, click **OK**, and then click **Next**. + + ![Create driver categories](../images/fig22-createcategories.png "Create driver categories") + + Create driver categories + + +4. On the **Select the packages to add the imported driver** page, click **New Package**, use the following settings for the package, and then click **Next**: + + * Name: Windows 10 x64 - HP EliteBook 8560w + * Path: \\\\CM01\\Sources$\\OSD\\DriverPackages\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w + + >[!NOTE] + >The package path does not yet exist, so you have to type it in. The wizard will create the new package using the path you specify. + +5. On the **Select drivers to include in the boot image** page, do not select anything, and click **Next** twice. After the package has been created, click **Close**. + + >[!NOTE] + >If you want to monitor the driver import process more closely, you can open the SMSProv.log file during driver import. + + ![Drivers imported and a new driver package created](../images/cm01-drivers-packages.png "Drivers imported and a new driver package created") + + Drivers imported and a new driver package created + +Next, see [Create a task sequence with Configuration Manager and MDT](create-a-task-sequence-with-configuration-manager-and-mdt.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md new file mode 100644 index 0000000000..e4d235f852 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md @@ -0,0 +1,101 @@ +--- +title: Create a custom Windows PE boot image with Configuration Manager (Windows 10) +description: Learn how to create custom Windows Preinstallation Environment (Windows PE) boot images in Microsoft Endpoint Configuration Manager. +ms.assetid: b9e96974-324d-4fa4-b0ce-33cfc49c4809 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: tool, customize, deploy, boot image +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Create a custom Windows PE boot image with Configuration Manager + +**Applies to** + +- Windows 10 + +In Microsoft Endpoint Configuration Manager, you can create custom Windows Preinstallation Environment (Windows PE) boot images that include extra components and features. This topic shows you how to create a custom Windows PE 5.0 boot image with the Microsoft Deployment Toolkit (MDT) wizard. You can also add the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 to the boot image as part of the boot image creation process. +- The boot image that is created is based on the version of ADK that is installed. + +For the purposes of this guide, we will use one server computer: CM01. +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. CM01 is running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + + An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +## Add DaRT 10 files and prepare to brand the boot image + +The steps below outline the process for adding DaRT 10 installation files to the MDT installation directory. You also copy a custom background image to be used later. These steps are optional. If you do not wish to add DaRT, skip the steps below to copy DaRT tools and later skip adding the DaRT component to the boot image. + +We assume you have downloaded [Microsoft Desktop Optimization Pack (MDOP) 2015](https://my.visualstudio.com/Downloads?q=Desktop%20Optimization%20Pack%202015) and copied the x64 version of MSDaRT100.msi to the **C:\\Setup\\DaRT 10** folder on CM01. We also assume you have created a custom background image and saved it in **C:\\Setup\\Branding** on CM01. In this section, we use a custom background image named ContosoBackground.bmp. + +On **CM01**: + +1. Install DaRT 10 (C:\\Setup\\DaRT 10\\MSDaRT100.msi) using the default settings. +2. Using File Explorer, navigate to the **C:\\Program Files\\Microsoft DaRT\\v10** folder. +3. Copy the Toolsx64.cab file to the **C:\\Program Files\\Microsoft Deployment Toolkit\\Templates\\Distribution\\Tools\\x64** folder. +4. Copy the Toolsx86.cab file to the **C:\\Program Files\\Microsoft Deployment Toolkit\\Templates\\Distribution\\Tools\\x86** folder. +5. Using File Explorer, navigate to the **C:\\Setup** folder. +6. Copy the **Branding** folder to **D:\\Sources\\OSD**. + +## Create a boot image for Configuration Manager using the MDT wizard + +By using the MDT wizard to create the boot image in Configuration Manager, you gain additional options for adding components and features to the boot image. In this section, you create a boot image for Configuration Manager using the MDT wizard. + +On **CM01**: + +1. Using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, right-click **Boot Images**, and select **Create Boot Image using MDT**. +2. On the **Package Source** page, in the **Package source folder to be created (UNC Path):** text box, type **\\\\CM01\\Sources$\\OSD\\Boot\\Zero Touch WinPE x64** and click **Next**. + + >[!NOTE] + >The Zero Touch WinPE x64 folder does not yet exist. The folder will be created later by the wizard. + +3. On the **General Settings** page, assign the name **Zero Touch WinPE x64** and click **Next**. +4. On the **Options** page, select the **x64** platform, and click **Next**. +5. On the **Components** page, in addition to the default selected **Microsoft Data Access Components (MDAC/ADO)** support, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box and click **Next**. + + ![Add the DaRT component to the Configuration Manager boot image](../images/mdt-06-fig16.png "Add the DaRT component to the Configuration Manager boot image") + + Add the DaRT component to the Configuration Manager boot image. + + >Note: Another common component to add here is Windows PowerShell to enable PowerShell support within Windows PE. + +6. On the **Customization** page, select the **Use a custom background bitmap file** check box, and in the **UNC path:** text box, browse to **\\\\CM01\\Sources$\\OSD\\Branding\\ContosoBackground.bmp** and then click **Next** twice. Wait a few minutes while the boot image is generated, and then click **Finish**. +7. Distribute the boot image to the CM01 distribution point by selecting the **Boot images** node, right-clicking the **Zero Touch WinPE x64** boot image, and selecting **Distribute Content**. +8. In the Distribute Content Wizard, add the CM01 distribution point, and complete the wizard. +9. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file. Do not continue until you can see that the boot image is distributed. Look for the line that reads **STATMSG: ID=2301**. You also can monitor Content Status in the Configuration Manager Console at **\Monitoring\Overview\Distribution Status\Content Status\Zero Touch WinPE x64**. See the following examples: + + ![Content status for the Zero Touch WinPE x64 boot image step 1](../images/fig16-contentstatus1.png)
              + ![Content status for the Zero Touch WinPE x64 boot image step 2](../images/fig16-contentstatus2.png) + + Content status for the Zero Touch WinPE x64 boot image + +10. Using the Configuration Manager Console, in the Software Library workspace, under **Boot Images**, right-click the **Zero Touch WinPE x64** boot image and select **Properties**. +11. On the **Data Source** tab, select the **Deploy this boot image from the PXE-enabled distribution point** check box, and click **OK**. +12. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for this text: **Expanding PS100009 to D:\\RemoteInstall\\SMSImages**. +13. Review the **D:\\RemoteInstall\\SMSImages** folder. You should see three folders containing boot images. Two are from the default boot images, and the third folder (PS100009) is from your new boot image with DaRT. See the examples below: + + ![PS100009 step 1](../images/ps100009-1.png)
              + ![PS100009 step 2](../images/ps100009-2.png) + +>Note: Depending on your infrastructure and the number of packages and boot images present, the Image ID might be a different number than PS100009. + +Next, see [Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md b/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md new file mode 100644 index 0000000000..7f539c965d --- /dev/null +++ b/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md @@ -0,0 +1,144 @@ +--- +title: Create a task sequence with Configuration Manager (Windows 10) +description: Create a Configuration Manager task sequence with Microsoft Deployment Toolkit (MDT) integration using the MDT wizard. +ms.assetid: 0b069bec-5be8-47c6-bf64-7a630f41ac98 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, upgrade, task sequence, install +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.pagetype: mdt +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Create a task sequence with Configuration Manager and MDT + +**Applies to** + +- Windows 10 + +In this article, you will learn how to create a Configuration Manager task sequence with Microsoft Deployment Toolkit (MDT) integration using the MDT wizard. Creating task sequences in Configuration Manager requires many more steps than creating task sequences for MDT Lite Touch installation. Luckily, the MDT wizard helps you through the process and also guides you through creating the needed packages. + +For the purposes of this guide, we will use one server computer: CM01. +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. CM01 is running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + + An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). Note: Active Directory [permissions](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md#configure-active-directory-permissions) for the **CM_JD** account are required for the task sequence to work properly. + +## Create a task sequence using the MDT Integration Wizard + +This section walks you through the process of creating a Configuration Manager task sequence for production use. + +On **CM01**: + +1. Using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and select **Create MDT Task Sequence**. +2. On the **Choose Template** page, select the **Client Task Sequence** template and click **Next**. +3. On the **General** page, assign the following settings and then click **Next**: + * Task sequence name: Windows 10 Enterprise x64 RTM + * Task sequence comments: Production image with Office 365 Pro Plus x64 +4. On the **Details** page, assign the following settings and then click **Next**: + * Join a Domain + * Domain: contoso.com + * Account: contoso\\CM\_JD + * Password: pass@word1 + * Windows Settings + * User name: Contoso + * Organization name: Contoso + * Product key: <blank> + +5. On the **Capture Settings** page, accept the default settings, and click **Next**. +6. On the **Boot Image** page, browse and select the **Zero Touch WinPE x64** boot image package. Then click **Next**. +7. On the **MDT Package** page, select **Create a new Microsoft Deployment Toolkit Files package**, and in the **Package source folder to be created (UNC Path):** text box, type **\\\\CM01\\Sources$\\OSD\\MDT\\MDT**. Then click **Next**. +8. On the **MDT Details** page, assign the name **MDT** and click **Next**. +9. On the **OS Image** page, browse and select the **Windows 10 Enterprise x64 RTM** package. Then click **Next**. +10. On the **Deployment Method** page, accept the default settings (Zero Touch installation) and click **Next**. +11. On the **Client Package** page, browse and select the **Microsoft Corporation Configuration Manager Client Package** and click **Next**. +12. On the **USMT Package** page, browse and select the **Microsoft Corporation User State Migration Tool for Windows** package and click **Next**. +13. On the **Settings Package** page, select the **Create a new settings package** option, and in the **Package source folder to be created (UNC Path):** text box, type **\\\\CM01\\Sources$\\OSD\\Settings\\Windows 10 x64 Settings** and click **Next**. +14. On the **Settings Details** page, assign the name **Windows 10 x64 Settings** and click **Next**. +15. On the **Sysprep Package** page, click **Next** twice. +16. On the **Confirmation** page, click **Finish**. + +## Edit the task sequence + +After you create the task sequence, we recommend that you configure the task sequence for an optimal deployment experience. The configurations include enabling support for Unified Extensible Firmware Interface (UEFI), dynamic organizational unit (OU) allocation, computer replace scenarios, and more. + +On **CM01**: + +1. Using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click the **Windows 10 Enterprise x64 RTM** task sequence, and click **Edit**. +2. In the **Install** group (about halfway down), select the **Set Variable for Drive Letter** action and configure the following: + * OSDPreserveDriveLetter: True + + >[!NOTE] + >If you don't change this value, your Windows installation will end up in D:\\Windows. + +3. In the **Post Install** group, select **Apply Network Settings**, and configure the **Domain OU** value to use the **Contoso / Computers / Workstations** OU (browse for values). +4. In the **Post Install** group, disable the **Auto Apply Drivers** action. (Disabling is done by selecting the action and, in the **Options** tab, selecting the **Disable this step** check box.) +5. After the disabled **Post Install / Auto Apply Drivers** action, add a new group name: **Drivers**. +6. After the **Post Install / Drivers** group, add an **Apply Driver Package** action with the following settings: + * Name: HP EliteBook 8560w + * Driver Package: Windows 10 x64 - HP EliteBook 8560w + * Options tab - Add Condition: Task Sequence Variable: Model equals HP EliteBook 8560w + + >[!NOTE] + >You also can add a Query WMI condition with the following query: SELECT \* FROM Win32\_ComputerSystem WHERE Model LIKE '%HP EliteBook 8560w%' + + ![Driver package options](../images/fig27-driverpackage.png "Driver package options") + + The driver package options + +7. In the **State Restore / Install Applications** group, select the **Install Application** action. +8. Select the **Install the following applications** radio button, and add the OSD / Adobe Reader DC - OSD Install application to the list. + + ![Add an application to the task sequence](../images/fig28-addapp.png "Add an application to the task sequence") + + Add an application to the Configuration Manager task sequence + + >[!NOTE] + >In recent versions of Configuration Manager the Request State Store and Release State Store actions described below are present by default. These actions are used for common computer replace scenarios. There is also the additional condition on the options tab: USMTOfflineMigration not equals TRUE. If these actions are not present, try updating to the Config Mgr current branch release. + +9. In the **State Restore** group, after the **Set Status 5** action, verify there is a **User State \ Request State Store** action with the following settings: + * Request state storage location to: Restore state from another computer + * If computer account fails to connect to state store, use the Network Access account: selected + * Options: Continue on error + * Options / Add Condition: + * Task Sequence Variable + * USMTLOCAL not equals True + +10. In the **State Restore** group, after the **Restore User State** action, verify there is a **Release State Store** action with the following settings: + * Options: Continue on error + * Options / Condition: + * Task Sequence Variable + * USMTLOCAL not equals True + +11. Click **OK**. + +## Organize your packages (optional) + +If desired, you can create a folder structure for packages. This is purely for organizational purposes and is useful if you need to manage a large number of packages. + +To create a folder for packages: + +On **CM01**: + +1. Using the Configuration Manager Console, in the Software Library workspace, expand **Application Management**, and then select **Packages**. +2. Right-click **Packages**, point to **Folder**, click **Create Folder** and create the OSD folder. This will create the Root \ OSD folder structure. +3. Select the **MDT**, **User State Migration Tool for Windows**, and **Windows 10 x64 Settings** packages, right-click and select **Move**. +4. In the **Move Selected Items** dialog box, select the **OSD** folder, and click **OK**. + +Next, see [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](../deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](../deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](../deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](../deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](../deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](../deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](../deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md new file mode 100644 index 0000000000..7e1c6b9819 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md @@ -0,0 +1,86 @@ +--- +title: Create an app to deploy with Windows 10 using Configuration Manager +description: Microsoft Microsoft Endpoint Configuration Manager supports deploying applications as part of the Windows 10 deployment process. +ms.assetid: 2dfb2f39-1597-4999-b4ec-b063e8a8c90c +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deployment, task sequence, custom, customize +ms.prod: w10 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Create an application to deploy with Windows 10 using Configuration Manager + + +**Applies to** + +- Windows 10 + +Microsoft Endpoint Configuration Manager supports deploying applications as part of the Windows 10 deployment process. In this section, you create an application in Microsoft Endpoint Configuration Manager that you later configure the task sequence to use. + +For the purposes of this guide, we will use one server computer: CM01. +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. CM01 is running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + +>[!NOTE] +>The [reference image](add-a-windows-10-operating-system-image-using-configuration-manager.md) used in this lab already contains some applications, such as Microsoft Office 365 Pro Plus x64. The procedure demonstrated in this article enables you to add some additional custom applications beyond those included in the reference image. + +## Example: Create the Adobe Reader application + +On **CM01**: + +1. Create the **D:\Setup** folder if it does not already exist. +1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (ex: AcroRdrDC2000620034_en_US.exe) to **D:\\Setup\\Adobe** on CM01. The filename will differ depending on the version of Acrobat Reader. +2. Extract the .exe file that you downloaded to an .msi. The source folder will differ depending on where you downloaded the file. See the following example: + + ```powershell + Set-Location C:\Users\administrator.CONTOSO\Downloads + .\AcroRdrDC2000620034_en_US.exe -sfx_o"d:\Setup\Adobe\" -sfx_ne + ``` + >Note: the extraction process will create the "Adobe" folder + +3. Using File Explorer, copy the **D:\\Setup\\Adobe** folder to the **D:\\Sources\\Software\\Adobe** folder. +4. In the Configuration Manager Console, in the Software Library workspace, expand **Application Management**. +5. Right-click **Applications**, point to **Folder** and then click **Create Folder**. Assign the name **OSD**. +6. Right-click the **OSD** folder, and click **Create Application**. +7. In the Create Application Wizard, on the **General** page, use the following settings: + + * Automatically detect information about this application from installation files + * Type: Windows Installer (\*.msi file) + * Location: \\\\CM01\\Sources$\\Software\\Adobe\\AcroRead.msi + + ![The Create Application Wizard](../images/mdt-06-fig20.png "The Create Application Wizard") + + The Create Application Wizard + +8. Click **Next**, and wait while Configuration Manager parses the MSI file. +9. On the **Import Information** page, review the information and then click **Next**. +10. On the **General Information** page, name the application Adobe Acrobat Reader DC - OSD Install, click **Next** twice, and then click **Close**. + + >[!NOTE] + >Because it is not possible to reference an application deployment type in the task sequence, you should have a single deployment type for applications deployed by the task sequence. If you are deploying applications via both the task sequence and normal application deployment, and you have multiple deployment types, you should have two applications of the same software. In this section, you add the "OSD Install" suffix to applications that are deployed via the task sequence. If using packages, you can still reference both package and program in the task sequence. + + ![Add the OSD Install suffix to the application name](../images/mdt-06-fig21.png "Add the OSD Install suffix to the application name") + + Add the "OSD Install" suffix to the application name + +11. In the **Applications** node, select the Adobe Reader - OSD Install application, and click **Properties** on the ribbon bar (this is another place to view properties, you can also right-click and select properties). +12. On the **General Information** tab, select the **Allow this application to be installed from the Install Application task sequence action without being deployed** check box, and click **OK**. + +Next, see [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md new file mode 100644 index 0000000000..bbc562e930 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -0,0 +1,102 @@ +--- +title: Deploy Windows 10 using PXE and Configuration Manager (Windows 10) +description: In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Configuration Manager deployment packages and task sequences. +ms.assetid: fb93f514-5b30-4f4b-99dc-58e6860009fa +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deployment, image, UEFI, task sequence +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Deploy Windows 10 using PXE and Configuration Manager + +**Applies to** + +- Windows 10 + +In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Configuration Manager deployment packages and task sequences. This topic will walk you through the process of deploying the Windows 10 Enterprise image to a Unified Extensible Firmware Interface (UEFI) computer named PC0001. An existing Configuration Manager infrastructure that is integrated with MDT is used for the procedures in this topic. + +This topic assumes that you have completed the following prerequisite procedures: +- [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) +- [Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) +- [Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) +- [Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) +- [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) +- [Create a task sequence with Configuration Manager and MDT](create-a-task-sequence-with-configuration-manager-and-mdt.md) +- [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md) + +For the purposes of this guide, we will use a minimum of two server computers (DC01 and CM01) and one client computer (PC0001). +- DC01 is a domain controller and DNS server for the contoso.com domain. DHCP services are also available and optionally installed on DC01 or another server. Note: DHCP services are required for the client (PC0001) to connect to the Windows Deployment Service (WDS). +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. + - CM01 is also running WDS which will be required to start PC0001 via PXE. **Note**: Ensure that only CM01 is running WDS. +- PC0001 is a client computer that is blank, or has an operating system that will be erased and replaced with Windows 10. The device must be configured to boot from the network. + +>[!NOTE] +>If desired, PC0001 can be a VM hosted on the server HV01, which is a Hyper-V host computer that we used previously to build a Windows 10 reference image. However, if PC0001 is a VM then you must ensure it has sufficient resources available to run the Configuration Manager OSD task sequence. 2GB of RAM or more is recommended. + +All servers are running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + +All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. + +>[!NOTE] +>No WDS console configuration is required for PXE to work. Everything is done with the Configuration Manager console. + +## Procedures + +1. Start the PC0001 computer. At the Pre-Boot Execution Environment (PXE) boot menu, press **Enter** to allow it to PXE boot. +2. On the **Welcome to the Task Sequence Wizard** page, type in the password **pass\@word1** and click **Next**. +3. On the **Select a task sequence to run** page, select **Windows 10 Enterprise x64 RTM** and click **Next**. +4. On the **Edit Task Sequence Variables** page, double-click the **OSDComputerName** variable, and in the **Value** field, type **PC0001** and click **OK**. Then click **Next**. +5. The operating system deployment will take several minutes to complete. +6. You can monitor the deployment on CM01 using the MDT Deployment Workbench. When you see the PC0001 entry, double-click **PC0001**, and then click **DaRT Remote Control** and review the **Remote Control** option. The task sequence will run and do the following: + + * Install the Windows 10 operating system. + * Install the Configuration Manager client and the client hotfix. + * Join the computer to the domain. + * Install the application added to the task sequence. + + >[!NOTE] + >You also can use the built-in reports to get information about ongoing deployments. For example, a task sequence report gives you a quick overview of the task sequence progress. + + ![MDT monitoring](../images/pc0001-monitor.png) + + Monitoring the deployment with MDT. + +7. When the deployment is finished you will have a domain-joined Windows 10 computer with the Adobe Reader application installed as well as the applications that were included in the reference image, such as Office 365 Pro Plus. + +Examples are provided below of various stages of deployment: + +![pc0001a](../images/pc0001a.png)
              +![pc0001b](../images/pc0001b.png)
              +![pc0001c](../images/pc0001c.png)
              +![pc0001d](../images/pc0001d.png)
              +![pc0001e](../images/pc0001e.png)
              +![pc0001f](../images/pc0001f.png)
              +![pc0001g](../images/pc0001g.png)
              +![pc0001h](../images/pc0001h.png)
              +![pc0001i](../images/pc0001i.png)
              +![pc0001j](../images/pc0001j.png)
              +![pc0001k](../images/pc0001k.png)
              +![pc0001l](../images/pc0001l.png)
              +![pc0001m](../images/pc0001m.png)
              +![pc0001n](../images/pc0001n.png) + +Next, see [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md new file mode 100644 index 0000000000..87bed1dd16 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md @@ -0,0 +1,168 @@ +--- +title: Finalize operating system configuration for Windows 10 deployment +description: This article provides a walk-through to finalize the configuration of your Windows 10 operating deployment. +ms.assetid: 38b55fa8-e717-4689-bd43-8348751d493e +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: configure, deploy, upgrade +ms.prod: w10 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Finalize the operating system configuration for Windows 10 deployment with Configuration Manager + +**Applies to** + +- Windows 10 + +This topic walks you through the steps to finalize the configuration of your Windows 10 operating deployment, which includes enabling optional MDT monitoring for Configuration Manager, logs folder settings, rules configuration, content distribution, and deployment of the previously created task sequence. + +For the purposes of this guide, we will use one server computer: CM01. +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. CM01 is running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + + An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +## Enable MDT monitoring + +This section will walk you through the process of creating the D:\\MDTProduction deployment share using the MDT Deployment Workbench to enable monitoring for Configuration Manager. + +On **CM01**: + +1. Open the Deployment Workbench, right-click **Deployment Shares** and click **New Deployment Share**. Use the following settings for the New Deployment Share Wizard: + + * Deployment share path: D:\\MDTProduction + * Share name: MDTProduction$ + * Deployment share description: MDT Production + * Options: <default settings> + +2. Right-click the **MDT Production** deployment share, and click **Properties**. On the **Monitoring** tab, select the **Enable monitoring for this deployment share** check box, and click **OK**. + + ![Enable MDT monitoring for Configuration Manager](../images/mdt-06-fig31.png) + + Enable MDT monitoring for Configuration Manager + +## Configure the Logs folder + +The D:\Logs folder was [created previously](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md?#review-the-sources-folder-structure) and SMB permissions were added. Next, we will add NTFS folder permissions for the Configuration Manager Network Access Account (CM_NAA), and enable server-side logging by modifying the CustomSettings.ini file used by the Configuration Manager task sequence. + +On **CM01**: + +1. To configure NTFS permissions using icacls.exe, type the following at an elevated Windows PowerShell prompt: + + ``` + icacls D:\Logs /grant '"CM_NAA":(OI)(CI)(M)' + ``` + +2. Using File Explorer, navigate to the **D:\\Sources\\OSD\\Settings\\Windows 10 x64 Settings** folder. +3. To enable server-side logging, edit the CustomSetting.ini file with Notepad.exe and enter the following settings: + + ``` + [Settings] + Priority=Default + Properties=OSDMigrateConfigFiles,OSDMigrateMode + + [Default] + DoCapture=NO + ComputerBackupLocation=NONE + MachineObjectOU=ou=Workstations,ou=Computers,ou=Contoso,dc=contoso,dc=com + OSDMigrateMode=Advanced + OSDMigrateAdditionalCaptureOptions=/ue:*\* /ui:CONTOSO\* + OSDMigrateConfigFiles=Miguser.xml,Migapp.xml + SLSHARE=\\CM01\Logs$ + EventService=http://CM01:9800 + ApplyGPOPack=NO + ``` + + ![Settings package during deployment](../images/fig30-settingspack.png) + + The Settings package, holding the rules and the Unattend.xml template used during deployment + +3. In the Configuration Manager console, update the distribution point for the **Windows 10 x64 Settings** package by right-clicking the **Windows 10 x64 Settings** package and selecting **Update Distribution Points**. Click **OK** in the popup dialog box. + + >[!NOTE] + >Although you have not yet added a distribution point, you still need to select Update Distribution Points. This process also updates the Configuration Manager content library with changes. + +## Distribute content to the CM01 distribution portal + +In Configuration Manager, you can distribute all packages needed by a task sequence in a single task. In this section, you distribute packages that have not yet been distributed to the CM01 distribution point. + +On **CM01**: + +1. Using the Configuration Manager console, in the Software Library workspace, expand **Operating Systems** and select **Task Sequences**. Right-click the **Windows 10 Enterprise x64 RTM** task sequence, and select **Distribute Content**. +2. In the Distribute Content Wizard, click **Next** twice then on the **Specify the content destination** page add the Distribution Point: **CM01.CONTOSO.COM**, and then complete the wizard. +3. Using the CMTrace tool, verify the distribution to the CM01 distribution point by reviewing the distmgr.log file, or use the Distribution Status / Content Status option in the Monitoring workspace. Do not continue until you see all the new packages being distributed successfully. + + ![Content status](../images/cm01-content-status1.png) + + Content status + +## Create a deployment for the task sequence + +This sections provides steps to help you create a deployment for the task sequence. + +On **CM01**: + +1. Using the Configuration Manager console, in the Software Library workspace, expand **Operating Systems** and select **Task Sequences**, right-click **Windows 10 Enterprise x64 RTM** and then click **Deploy**. +2. In the Deploy Software Wizard, on the **General** page, select the **All Unknown Computers** collection and click **Next**. +3. On the **Deployment Settings** page, use the following settings and then click **Next**: + + * Purpose: Available + * Make available to the following: Only media and PXE + + ![Configure the deployment settings](../images/mdt-06-fig33.png) + + Configure the deployment settings + +4. On the **Scheduling** page, accept the default settings and click **Next**. +5. On the **User Experience** page, accept the default settings and click **Next**. +6. On the **Alerts** page, accept the default settings and click **Next**. +7. On the **Distribution Points** page, accept the default settings, click **Next** twice, and then click **Close**. + + ![Task sequence deployed](../images/fig32-deploywiz.png) + + The Windows 10 Enterprise x64 RTM task sequence deployed to the All Unknown Computers collections available for media and PXE + +## Configure Configuration Manager to prompt for the computer name during deployment (optional) + +You can have Configuration Manager prompt you for a computer name or you can use rules to generate a computer name. For more details on how to do this, see [Configure MDT settings](../deploy-windows-mdt/configure-mdt-settings.md). + +This section provides steps to help you configure the All Unknown Computers collection to have Configuration Manager prompt for computer names. + +On **CM01**: + +1. Using the Configuration Manager console, in the Asset and Compliance workspace, select **Device Collections**, right-click **All Unknown Computers**, and click **Properties**. + +2. On the **Collection Variables** tab, create a new variable with the following settings: + + * Name: OSDComputerName + * Clear the **Do not display this value in the Configuration Manager console** check box. + +3. Click **OK**. + + >[!NOTE] + >Configuration Manager can prompt for information in many ways. Using a collection variable with an empty value is just one of them. Another option is the User-Driven Installation (UDI) wizard. + + ![Configure a collection variable](../images/mdt-06-fig35.png) + + Configure a collection variable + +Next, see [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md new file mode 100644 index 0000000000..116cb87a9e --- /dev/null +++ b/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md @@ -0,0 +1,392 @@ +--- +title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager +description: Learn how to prepare a Zero Touch Installation of Windows 10 with Configuration Manager, by integrating Configuration Manager with Microsoft Deployment Toolkit. +ms.assetid: 06e3a221-31ef-47a5-b4da-3b927cb50d08 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: install, configure, deploy, deployment +ms.prod: w10 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Prepare for Zero Touch Installation of Windows 10 with Configuration Manager + +**Applies to** + +- Windows 10 + +This topic will walk you through the Zero Touch Installation process of Windows 10 operating system deployment (OSD) using Microsoft Endpoint Configuration Manager (ConfigMgr) [integrated](#why-integrate-mdt-with-configuration-manager) with Microsoft Deployment Toolkit (MDT). + +## Prerequisites + +In this topic, you will use [components](#components-of-configuration-manager-operating-system-deployment) of an existing Configuration Manager infrastructure to prepare for Windows 10 OSD. In addition to the base setup, the following configurations should be made in the Configuration Manager environment: + +- Configuration Manager current branch + all security and critical updates are installed. + - Note: Procedures in this guide use ConfigMgr 1910. For information about the version of Windows 10 supported by ConfigMgr, see [Support for Windows 10](https://docs.microsoft.com/configmgr/core/plan-design/configs/support-for-windows-10). +- The [Active Directory Schema has been extended](https://docs.microsoft.com/configmgr/core/plan-design/network/extend-the-active-directory-schema) and System Management container created. +- Active Directory Forest Discovery and Active Directory System Discovery are [enabled](https://docs.microsoft.com/configmgr/core/servers/deploy/configure/configure-discovery-methods). +- IP range [boundaries and a boundary group](https://docs.microsoft.com/configmgr/core/servers/deploy/configure/define-site-boundaries-and-boundary-groups) for content and site assignment have been created. +- The Configuration Manager [reporting services](https://docs.microsoft.com/configmgr/core/servers/manage/configuring-reporting) point role has been added and configured. +- A file system folder structure and Configuration Manager console folder structure for packages has been created. Steps to verify or create this folder structure are [provided below](#review-the-sources-folder-structure). +- The [Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install) (including USMT) version 1903, Windows PE add-on, WSIM 1903 update, [MDT](https://www.microsoft.com/download/details.aspx?id=54259) version 8456, and DaRT 10 (part of [MDOP 2015](https://my.visualstudio.com/Downloads?q=Desktop%20Optimization%20Pack%202015)) are installed. +- The [CMTrace tool](https://docs.microsoft.com/configmgr/core/support/cmtrace) (cmtrace.exe) is installed on the distribution point. + - Note: CMTrace is automatically installed with the current branch of Configuration Manager at **Program Files\Microsoft Configuration Manager\tools\cmtrace.exe**. In previous releases of ConfigMgr it was necessary to install the [Configuration Manager Toolkit](https://www.microsoft.com/download/details.aspx?id=50012) separately to get the CMTrace tool, but this is no longer needed. Configuraton Manager version 1910 installs version 5.0.8913.1000 of the CMTrace tool. + +For the purposes of this guide, we will use three server computers: DC01, CM01 and HV01. +- DC01 is a domain controller and DNS server for the contoso.com domain. DHCP services are also available and optionally installed on DC01 or another server. +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. +- HV01 is a Hyper-V host computer that is used to build a Windows 10 reference image. This computer does not need to be a domain member. + +All servers are running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + +All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. + +### Domain credentials + +The following generic credentials are used in this guide. You should replace these credentials as they appear in each procedure with your credentials. + +**Active Directory domain name**: contoso.com
              +**Domain administrator username**: administrator
              +**Domain administrator password**: pass@word1 + +## Create the OU structure + +>[!NOTE] +>If you have already [created the OU structure](../deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md#create-the-ou-structure) that was used in the OSD guide for MDT, the same structure is used here and you can skip this section. + +On **DC01**: + +To create the OU structure, you can use the Active Directory Users and Computers console (dsa.msc), or you can use Windows PowerShell. The procedure below uses Windows PowerShell. + +To use Windows PowerShell, copy the following commands into a text file and save it as C:\Setup\Scripts\ou.ps1. Be sure that you are viewing file extensions and that you save the file with the .ps1 extension. + +```powershell +$oulist = Import-csv -Path c:\oulist.txt +ForEach($entry in $oulist){ + $ouname = $entry.ouname + $oupath = $entry.oupath + New-ADOrganizationalUnit -Name $ouname -Path $oupath -WhatIf + Write-Host -ForegroundColor Green "OU $ouname is created in the location $oupath" +} +``` + +Next, copy the following list of OU names and paths into a text file and save it as C:\Setup\Scripts\oulist.txt + +```text +OUName,OUPath +Contoso,"DC=CONTOSO,DC=COM" +Accounts,"OU=Contoso,DC=CONTOSO,DC=COM" +Computers,"OU=Contoso,DC=CONTOSO,DC=COM" +Groups,"OU=Contoso,DC=CONTOSO,DC=COM" +Admins,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Service Accounts,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Users,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Servers,"OU=Computers,OU=Contoso,DC=CONTOSO,DC=COM" +Workstations,"OU=Computers,OU=Contoso,DC=CONTOSO,DC=COM" +Security Groups,"OU=Groups,OU=Contoso,DC=CONTOSO,DC=COM" +``` + +Lastly, open an elevated Windows PowerShell prompt on DC01 and run the ou.ps1 script: + +```powershell +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force +Set-Location C:\Setup\Scripts +.\ou.ps1 +``` + +## Create the Configuration Manager service accounts + +A role-based model is used to configure permissions for the service accounts needed for operating system deployment in Configuration Manager. Perform the following steps to create the Configuration Manager **join domain** and **network access** accounts: + +On **DC01**: + +1. In the Active Directory Users and Computers console, browse to **contoso.com / Contoso / Service Accounts**. +2. Select the Service Accounts OU and create the CM\_JD account using the following settings: + + * Name: CM\_JD + * User logon name: CM\_JD + * Password: pass@word1 + * User must change password at next logon: Clear + * User cannot change password: Selected + * Password never expires: Selected + +3. Repeat the step, but for the CM\_NAA account. +4. After creating the accounts, assign the following descriptions: + + * CM\_JD: Configuration Manager Join Domain Account + * CM\_NAA: Configuration Manager Network Access Account + +## Configure Active Directory permissions + +In order for the Configuration Manager Join Domain Account (CM\_JD) to join machines into the contoso.com domain you need to configure permissions in Active Directory. These steps assume you have downloaded the sample [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copied it to C:\\Setup\\Scripts on DC01. + +On **DC01**: + +1. Sign in as contoso\administrator and enter the following at an elevated Windows PowerShell prompt: + + ``` + Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force + Set-Location C:\Setup\Scripts + .\Set-OUPermissions.ps1 -Account CM_JD -TargetOU "OU=Workstations,OU=Computers,OU=Contoso" + ``` + +2. The Set-OUPermissions.ps1 script allows the CM\_JD user account permissions to manage computer accounts in the Contoso / Computers / Workstations OU. The following is a list of the permissions being granted: + + * Scope: This object and all descendant objects + * Create Computer objects + * Delete Computer objects + * Scope: Descendant Computer objects + * Read All Properties + * Write All Properties + * Read Permissions + * Modify Permissions + * Change Password + * Reset Password + * Validated write to DNS host name + * Validated write to service principal name + +## Review the Sources folder structure + +On **CM01**: + +To support the packages you create in this article, the following folder structure should be created on the Configuration Manager primary site server (CM01): + +>[!NOTE] +>In most production environments, the packages are stored on a Distributed File System (DFS) share or a "normal" server share, but in a lab environment you can store them on the site server. + +- D:\\Sources +- D:\\Sources\\OSD +- D:\\Sources\\OSD\\Boot +- D:\\Sources\\OSD\\DriverPackages +- D:\\Sources\\OSD\\DriverSources +- D:\\Sources\\OSD\\MDT +- D:\\Sources\\OSD\\OS +- D:\\Sources\\OSD\\Settings +- D:\\Sources\\OSD\\Branding +- D:\\Sources\\Software +- D:\\Sources\\Software\\Adobe +- D:\\Sources\\Software\\Microsoft + +You can run the following commands from an elevated Windows PowerShell prompt to create this folder structure: + +>We will also create the D:\Logs folder here which will be used later to support server-side logging. + +```powershell +New-Item -ItemType Directory -Path "D:\Sources" +New-Item -ItemType Directory -Path "D:\Sources\OSD" +New-Item -ItemType Directory -Path "D:\Sources\OSD\Boot" +New-Item -ItemType Directory -Path "D:\Sources\OSD\DriverPackages" +New-Item -ItemType Directory -Path "D:\Sources\OSD\DriverSources" +New-Item -ItemType Directory -Path "D:\Sources\OSD\OS" +New-Item -ItemType Directory -Path "D:\Sources\OSD\Settings" +New-Item -ItemType Directory -Path "D:\Sources\OSD\Branding" +New-Item -ItemType Directory -Path "D:\Sources\OSD\MDT" +New-Item -ItemType Directory -Path "D:\Sources\Software" +New-Item -ItemType Directory -Path "D:\Sources\Software\Adobe" +New-Item -ItemType Directory -Path "D:\Sources\Software\Microsoft" +New-SmbShare -Name Sources$ -Path D:\Sources -FullAccess "NT AUTHORITY\INTERACTIVE", "BUILTIN\Administrators" +New-Item -ItemType Directory -Path "D:\Logs" +New-SmbShare -Name Logs$ -Path D:\Logs -ChangeAccess EVERYONE +``` + +## Integrate Configuration Manager with MDT + +To extend the Configuration Manager console with MDT wizards and templates, install MDT with the default settings and run the **Configure ConfigManager Integration** desktop app. In these steps, we assume you have already [downloaded MDT](https://www.microsoft.com/download/details.aspx?id=54259) and installed it with default settings. + +On **CM01**: + +1. Sign in as contoso\administrator. +2. Ensure the Configuration Manager Console is closed before continuing. +5. Click Start, type **Configure ConfigManager Integration**, and run the application the following settings: + + * Site Server Name: CM01.contoso.com + * Site code: PS1 + +![figure 8](../images/mdt-06-fig08.png) + +MDT integration with Configuration Manager. + +## Configure the client settings + +Most organizations want to display their name during deployment. In this section, you configure the default Configuration Manager client settings with the Contoso organization name. + +On **CM01**: + +1. Open the Configuration Manager Console, select the Administration workspace, then click **Client Settings**. +2. In the right pane, right-click **Default Client Settings** and then click **Properties**. +3. In the **Computer Agent** node, in the **Organization name displayed in Software Center** text box, type in **Contoso** and click **OK**. + +![figure 9](../images/mdt-06-fig10.png) + +Configure the organization name in client settings. + +![figure 10](../images/fig10-contosoinstall.png) + +The Contoso organization name displayed during deployment. + +## Configure the Network Access account + +Configuration Manager uses the Network Access account during the Windows 10 deployment process to access content on the distribution points. In this section, you configure the Network Access account. + +On **CM01**: + +1. Using the Configuration Manager Console, in the Administration workspace, expand **Site Configuration** and select **Sites**. +2. Right-click **PS1 - Primary Site 1**, point to **Configure Site Components**, and then select **Software Distribution**. +3. On the **Network Access Account** tab, select **Specify the account that accesses network locations** and add the *New Account* **CONTOSO\\CM\_NAA** as the Network Access account (password: pass@word1). Use the new **Verify** option to verify that the account can connect to the **\\\\DC01\\sysvol** network share. + +![figure 11](../images/mdt-06-fig12.png) + +Test the connection for the Network Access account. + +## Enable PXE on the CM01 distribution point + +Configuration Manager has many options for starting a deployment, but starting via PXE is certainly the most flexible in a large environment. In this section, you enable PXE on the CM01 distribution point. + +On **CM01**: + +1. In the Configuration Manager Console, in the Administration workspace, select **Distribution Points**. +2. Right-click the **\\\\CM01.CONTOSO.COM distribution point** and select **Properties**. +3. On the **PXE** tab, use the following settings: + + * Enable PXE support for clients + * Allow this distribution point to respond to incoming PXE requests + * Enable unknown computer + * Require a password when computers use PXE + * Password and Confirm password: pass@word1 + + ![figure 12](../images/mdt-06-fig13.png) + + Configure the CM01 distribution point for PXE. + + >[!NOTE] + >If you select **Enable a PXE responder without Windows Deployment Service**, then WDS will not be installed, or if it is already installed it will be suspended, and the **ConfigMgr PXE Responder Service** (SccmPxe) will be used instead of WDS. The ConfigMgr PXE Responder does not support multicast. For more information, see [Install and configure distribution points](https://docs.microsoft.com/configmgr/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_config-pxe). + +4. Using the CMTrace tool, review the C:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file. Look for ConfigurePXE and CcmInstallPXE lines. + + ![figure 13](../images/mdt-06-fig14.png) + + The distmgr.log displays a successful configuration of PXE on the distribution point. + +5. Verify that you have seven files in each of the folders **D:\\RemoteInstall\\SMSBoot\\x86** and **D:\\RemoteInstall\\SMSBoot\\x64**. + + ![figure 14](../images/mdt-06-fig15.png) + + The contents of the D:\\RemoteInstall\\SMSBoot\\x64 folder after you enable PXE. + + **Note**: These files are used by WDS. They are not used by the ConfigMgr PXE Responder. This article does not use the ConfigMgr PXE Responder. + +Next, see [Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md). + +## Components of Configuration Manager operating system deployment + +Operating system deployment with Configuration Manager is part of the normal software distribution infrastructure, but there are additional components. For example, operating system deployment in Configuration Manager may use the State Migration Point role, which is not used by normal application deployment in Configuration Manager. This section describes the Configuration Manager components involved with the deployment of an operating system, such as Windows 10. + +- **State migration point (SMP).** The state migration point is used to store user state migration data during computer replace scenarios. +- **Distribution point (DP).** The distribution point is used to store all packages in Configuration Manager, including the operating system deployment-related packages. +- **Software update point (SUP).** The software update point, which is normally used to deploy updates to existing machines, also can be used to update an operating system as part of the deployment process. You also can use offline servicing to update the image directly on the Configuration Manager server. +- **Reporting services point.** The reporting services point can be used to monitor the operating system deployment process. +- **Boot images.** Boot images are the Windows Preinstallation Environment (Windows PE) images Configuration Manager uses to start the deployment. +- **Operating system images.** The operating system image package contains only one file, the custom .wim image. This is typically the production deployment image. +- **Operating system installers.** The operating system installers were originally added to create reference images using Configuration Manager. Instead, we recommend that you use MDT Lite Touch to create your reference images. For more information on how to create a reference image, see [Create a Windows 10 reference image](../deploy-windows-mdt/create-a-windows-10-reference-image.md). +- **Drivers.** Like MDT Lite Touch, Configuration Manager also provides a repository (catalog) of managed device drivers. +- **Task sequences.** The task sequences in Configuration Manager look and feel pretty much like the sequences in MDT Lite Touch, and they are used for the same purpose. However, in Configuration Manager the task sequence is delivered to the clients as a policy via the Management Point (MP). MDT provides additional task sequence templates to Configuration Manager. + + **Note**  The Windows Assessment and Deployment Kit (ADK) for Windows 10 is also required to support management and deployment of Windows 10. + +## Why integrate MDT with Configuration Manager + +As noted above, MDT adds many enhancements to Configuration Manager. While these enhancements are called Zero Touch, that name does not reflect how deployment is conducted. The following sections provide a few samples of the 280 enhancements that MDT adds to Configuration Manager. + +>[!NOTE] +>MDT installation requires the following: +>- The Windows ADK for Windows 10 (installed in the previous procedure) +>- Windows PowerShell ([version 5.1](https://www.microsoft.com/download/details.aspx?id=54616) is recommended; type **$host** to check) +>- Microsoft .NET Framework + +### MDT enables dynamic deployment + +When MDT is integrated with Configuration Manager, the task sequence takes additional instructions from the MDT rules. In its most simple form, these settings are stored in a text file, the CustomSettings.ini file, but you can store the settings in Microsoft SQL Server databases, or have Microsoft Visual Basic Scripting Edition (VBScripts) or web services provide the settings used. + +The task sequence uses instructions that allow you to reduce the number of task sequences in Configuration Manager and instead store settings outside the task sequence. Here are a few examples: +- The following settings instruct the task sequence to install the HP Hotkeys package, but only if the hardware is a HP EliteBook 8570w. Note that you don't have to add the package to the task sequence. + + ``` syntax + [Settings] + Priority=Model + [HP EliteBook 8570w] + Packages001=PS100010:Install HP Hotkeys + ``` +- The following settings instruct the task sequence to put laptops and desktops in different organizational units (OUs) during deployment, assign different computer names, and finally have the task sequence install the Cisco VPN client, but only if the machine is a laptop. + + ``` syntax + [Settings] + Priority= ByLaptopType, ByDesktopType + [ByLaptopType] + Subsection=Laptop-%IsLaptop% + [ByDesktopType] + Subsection=Desktop-%IsDesktop% + [Laptop-True] + Packages001=PS100012:Install Cisco VPN Client + OSDComputerName=LT-%SerialNumber% + MachineObjectOU=ou=laptops,ou=Contoso,dc=contoso,dc=com + [Desktop-True] + OSDComputerName=DT-%SerialNumber% + MachineObjectOU=ou=desktops,ou=Contoso,dc=contoso,dc=com + ``` + +![figure 2](../images/fig2-gather.png) + +The Gather action in the task sequence is reading the rules. + +### MDT adds an operating system deployment simulation environment + +When testing a deployment, it is important to be able to quickly test any changes you make to the deployment without needing to run through an entire deployment. MDT rules can be tested very quickly, saving significant testing time in a deployment project. For more information, see [Configure MDT settings](../deploy-windows-mdt/configure-mdt-settings.md). + +![figure 3](../images/mdt-06-fig03.png) + +The folder that contains the rules, a few scripts from MDT, and a custom script (Gather.ps1). + +### MDT adds real-time monitoring + +With MDT integration, you can follow your deployments in real time, and if you have access to Microsoft Diagnostics and Recovery Toolkit (DaRT), you can even remote into Windows Preinstallation Environment (Windows PE) during deployment. The real-time monitoring data can be viewed from within the MDT Deployment Workbench, via a web browser, Windows PowerShell, the Event Viewer, or Microsoft Excel 2013. In fact, any script or app that can read an Open Data (OData) feed can read the information. + +![figure 4](../images/mdt-06-fig04.png) + +View the real-time monitoring data with PowerShell. + +### MDT adds an optional deployment wizard + +For some deployment scenarios, you may need to prompt the user for information during deployment such as the computer name, the correct organizational unit (OU) for the computer, or which applications should be installed by the task sequence. With MDT integration, you can enable the User-Driven Installation (UDI) wizard to gather the required information, and customize the wizard using the UDI Wizard Designer. + +![figure 5](../images/mdt-06-fig05.png) + +The optional UDI wizard open in the UDI Wizard Designer. + +MDT Zero Touch simply extends Configuration Manager with many useful built-in operating system deployment components. By providing well-established, supported solutions, MDT reduces the complexity of deployment in Configuration Manager. + +### Why use MDT Lite Touch to create reference images + +You can create reference images for Configuration Manager in Configuration Manager, but in general we recommend creating them in MDT Lite Touch for the following reasons: +- You can use the same image for every type of operating system deployment - Microsoft Virtual Desktop Infrastructure (VDI), Microsoft System Center Virtual Machine Manager (VMM), MDT, Configuration Manager, Windows Deployment Services (WDS), and more. +- Configuration Manager performs deployment in the LocalSystem context. This means that you cannot configure the Administrator account with all of the settings that you would like to be included in the image. MDT runs in the context of the Local Administrator, which means you can configure the look and feel of the configuration and then use the CopyProfile functionality to copy these changes to the default user during deployment. +- The Configuration Manager task sequence does not suppress user interface interaction. +- MDT Lite Touch supports a Suspend action that allows for reboots, which is useful when you need to perform a manual installation or check the reference image before it is automatically captured. +- MDT Lite Touch does not require any infrastructure and is easy to delegate. + +## Related topics + +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) diff --git a/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md new file mode 100644 index 0000000000..7ff3078c04 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -0,0 +1,149 @@ +--- +title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager +description: Learn how to use Configuration Manager and Microsoft Deployment Toolkit (MDT) to refresh a Windows 7 SP1 client with Windows 10. +ms.assetid: 57c81667-1019-4711-b3de-15ae9c5387c7 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: upgrade, install, installation, computer refresh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager + +**Applies to** + +- Windows 10 + +This topic will show you how to refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager and Microsoft Deployment Toolkit (MDT). A computer refresh is not the same as an in-place upgrade. A computer refresh involves storing user data and settings from the old installation, wiping the hard drives, installing a new OS, and then restoring the user data at the end of the installation. Also see the MDT refesh procedure: [Refresh a Windows 7 computer with Windows 10](../deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md). + +A computer refresh with Configuration Manager works the same as it does with MDT Lite Touch installation. Configuration Manager also uses the User State Migration Tool (USMT) from the Windows Assessment and Deployment Kit (Windows ADK) 10 in the background. A computer refresh with Configuration Manager has the following steps: + +1. Data and settings are backed up locally in a backup folder. +2. The partition is wiped, except for the backup folder. +3. The new operating system image is applied. +4. Other applications are installed. +5. Data and settings are restored. + +## Infrastructure + +An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +For the purposes of this article, we will use one server computer (CM01) and one client computer (PC0003). +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. +- PC0003 is a domain member client computer running Windows 7 SP1, or a later version of Windows, with the Configuration Manager client installed, that will be refreshed to Windows 10. + +>[!NOTE] +>If desired, PC0003 can be a VM hosted on the server HV01, which is a Hyper-V host computer that we used previously to build a Windows 10 reference image. However, if PC0003 is a VM then you must ensure it has sufficient resources available to run the Configuration Manager OSD task sequence. 2GB of RAM or more is recommended. + +All servers are running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + +All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. + +>[!IMPORTANT] +>This article assumes that you have [configured Active Directory permissions](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md#configure-active-directory-permissions) in the specified OU for the **CM_JD** account, and the client's Active Directory computer account is in the **Contoso > Computers > Workstations** OU. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. + +## Verify the Configuration Manager client settings + +To verify that PC003 is correctly assigned to the PS1 site: + +On **PC0003**: + +1. Open the Configuration Manager control panel (control smscfgrc). +2. On the **Site** tab, click **Configure Settings**, then click **Find Site**. +3. Verify that Configuration Manager has successfully found a site to manage this client is displayed. See the following example. + +![Found a site to manage this client](../images/pc0003a.png) + +## Create a device collection and add the PC0003 computer + +On **CM01**: + +1. Using the Configuration Manager console, in the Asset and Compliance workspace, expand **Overview**, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings: + + * General + * Name: Install Windows 10 Enterprise x64 + * Limited Collection: All Systems + * Membership rules + * Add Rule: Direct rule + * Resource Class: System Resource + * Attribute Name: Name + * Value: PC0003 + * Select Resources + * Select **PC0003** + + Use the default settings to complete the remaining wizard pages and click **Close**. + +2. Review the Install Windows 10 Enterprise x64 collection. Do not continue until you see the PC0003 machine in the collection. + + >[!NOTE] + >It may take a short while for the collection to refresh; you can view progress via the Colleval.log file. If you want to speed up the process, you can manually update membership on the Install Windows 10 Enterprise x64 collection by right-clicking the collection and selecting Update Membership. + +## Create a new deployment + +On **CM01**: + +Using the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Windows 10 Enterprise x64 RTM**, and then click **Deploy**. Use the following settings: + +- General + - Collection: Install Windows 10 Enterprise x64 +- Deployment Settings + - Purpose: Available + - Make available to the following: Configuration Manager clients, media and PXE + + >[!NOTE] + >It is not necessary to make the deployment available to media and Pre-Boot Execution Environment (PXE) for a computer refresh, but you will use the same deployment for bare-metal deployments later on and you will need it at that point. + +- Scheduling + - <default> +- User Experience + - <default> +- Alerts + - <default> +- Distribution Points + - <default> + +## Initiate a computer refresh + +Now you can start the computer refresh on PC0003. + +On **CM01**: + +1. Using the Configuration Manager console, in the Assets and Compliance workspace, click the **Install Windows 10 Enterprise x64** collection, right-click **PC0003**, point to **Client Notification**, click **Download Computer Policy**, and then click **OK** in the popup dialog box that appears. + +On **PC0003**: + +1. Open the Software Center (click Start and type **Software Center**, or click the **New software is available** balloon in the system tray), select **Operating Systems** and click the **Windows 10 Enterprise x64 RTM** deployment, then click **Install**. +2. In the **Software Center** warning dialog box, click **Install Operating System**. +3. The client computer will run the Configuration Manager task sequence, boot into Windows PE, and install the new OS and applications. See the following examples: + +![Task sequence example 1](../images/pc0003b.png)
              +![Task sequence example 2](../images/pc0003c.png)
              +![Task sequence example 3](../images/pc0003d.png)
              +![Task sequence example 4](../images/pc0003e.png)
              +![Task sequence example 5](../images/pc0003f.png)
              +![Task sequence example 6](../images/pc0003g.png)
              +![Task sequence example 7](../images/pc0003h.png)
              +![Task sequence example 8](../images/pc0003i.png)
              +![Task sequence example 9](../images/pc0003j.png)
              +![Task sequence example 10](../images/pc0003k.png) + +Next, see [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md new file mode 100644 index 0000000000..4c98f861cf --- /dev/null +++ b/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -0,0 +1,215 @@ +--- +title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager +description: In this topic, you will learn how to replacing a Windows 7 SP1 computer using Microsoft Endpoint Configuration Manager. +ms.assetid: 3c8a2d53-8f08-475f-923a-bca79ca8ac36 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: upgrade, install, installation, replace computer, setup +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager + +**Applies to** + +- Windows 10 + +In this topic, you will learn how to replace a Windows 7 SP1 computer using Microsoft Endpoint Configuration Manager. This process is similar to refreshing a computer, but since you are replacing the device, you have to run the backup job separately from the deployment of Windows 10. + +In this topic, you will create a backup-only task sequence that you run on PC0004 (the device you are replacing), deploy the PC0006 computer running Windows 10, and then restore this backup of PC0004 onto PC006. This is similar to the MDT replace process: [Replace a Windows 7 computer with a Windows 10 computer](../deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md). + +## Infrastructure + +An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +For the purposes of this article, we will use one server computer (CM01) and two client computers (PC0004, PC0006). +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. + - Important: CM01 must include the **[State migration point](https://docs.microsoft.com/configmgr/osd/get-started/manage-user-state#BKMK_StateMigrationPoint)** role for the replace task sequence used in this article to work. +- PC0004 is a domain member client computer running Windows 7 SP1, or a later version of Windows, with the Configuration Manager client installed, that will be replaced. +- PC0006 is a domain member client computer running Windows 10, with the Configuration Manager client installed, that will replace PC0004. + +>[!NOTE] +>PC0004 and PC006 can be VMs hosted on the server HV01, which is a Hyper-V host computer that we used previously to build a Windows 10 reference image. However, the VMs must have sufficient resources available to run the Configuration Manager OSD task sequence. 2GB of RAM or more is recommended. + +All servers are running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + +All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. + +>[!IMPORTANT] +>This article assumes that you have [configured Active Directory permissions](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md#configure-active-directory-permissions) in the specified OU for the **CM_JD** account, and the client's Active Directory computer account is in the **Contoso > Computers > Workstations** OU. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. + +## Create a replace task sequence + +On **CM01**: + +1. Using the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and select **Create MDT Task Sequence**. +2. On the **Choose Template** page, select the **Client Replace Task Sequence** template and click **Next**. +3. On the **General** page, assign the following settings and click **Next**: + + * Task sequence name: Replace Task Sequence + * Task sequence comments: USMT backup only + +4. On the **Boot Image** page, browse and select the **Zero Touch WinPE x64** boot image package. Then click **Next**. +5. On the **MDT Package** page, browse and select the **OSD / MDT** package. Then click **Next**. +6. On the **USMT Package** page, browse and select the **OSD / Microsoft Corporation User State Migration Tool for Windows** package. Then click **Next**. +7. On the **Settings Package** page, browse and select the **OSD / Windows 10 x64 Settings** package. Then click **Next**. +8. On the **Summary** page, review the details and then click **Next**. +9. On the **Confirmation** page, click **Finish**. + +10. Review the Replace Task Sequence. + + >[!NOTE] + >This task sequence has many fewer actions than the normal client task sequence. If it doesn't seem different, make sure you selected the **Client Replace Task Sequence** template when creating the task sequence. + +![The back-up only task sequence](../images/mdt-06-fig42.png "The back-up only task sequence") + +The backup-only task sequence (named Replace Task Sequence). + +## Associate the new device with the old computer + +This section walks you through the process of associating a new, blank device (PC0006), with an existing computer (PC0004), for the purpose of replacing PC0004 with PC0006. PC0006 can be either a physical or virtual machine. + +On **HV01** (if PC0006 is a VM) or in the PC0006 BIOS: + +1. Make a note of the MAC address for PC0006. (If PC0006 is a virtual machine, you can see the MAC Address in the virtual machine settings.) In our example, the PC0006 MAC Address is 00:15:5D:0A:6A:96. Do not attempt to PXE boot PC0006 yet. + +On **CM01**: + +2. Using the Configuration Manager console, in the Assets and Compliance workspace, right-click **Devices**, and then click **Import Computer Information**. +3. On the **Select Source** page, select **Import single computer** and click **Next**. +4. On the **Single Computer** page, use the following settings and then click **Next**: + + * Computer Name: PC0006 + * MAC Address: <the mac address that you wrote down> + * Source Computer: PC0004 + + ![Create the computer association](../images/mdt-06-fig43.png "Create the computer association") + + Creating the computer association between PC0004 and PC0006. + +5. On the **User Accounts** page, select **Capture and restore all user accounts** and click **Next**. +6. On the **Data Preview** page, click **Next**. +7. On the **Choose additional collections** page, click **Add** and then select the **Install Windows 10 Enterprise x64** collection. Now, select the checkbox next to the Install Windows 10 Enterprise x64 collection you just added, and then click **Next**. +8. On the **Summary** page, click **Next**, and then click **Close**. +9. Select the **User State Migration** node and review the computer association in the right hand pane. +10. Right-click the **PC0004/PC0006** association and click **View Recovery Information**. Note that a recovery key has been assigned already, but a user state store location has not. +11. Review the **Install Windows 10 Enterprise x64** collection. Do not continue until you see the **PC0006** computer in the collection. You might have to update membership and refresh the collection again. + +## Create a device collection and add the PC0004 computer + +On **CM01**: + +1. Using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings: + + * General + * Name: USMT Backup (Replace) + * Limited Collection: All Systems + * Membership rules: + * Add Rule: Direct rule + * Resource Class: System Resource + * Attribute Name: Name + * Value: PC0004 + * Select Resources: + * Select **PC0004** + + Use default settings for the remaining wizard pages, then click **Close**. + +2. Review the **USMT Backup (Replace)** collection. Do not continue until you see the **PC0004** computer in the collection. + +## Create a new deployment + +On **CM01**: + +Using the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Replace Task Sequence**, and then select **Deploy**. Use the following settings: + +- General + - Collection: USMT Backup (Replace) +- Deployment Settings + - Purpose: Available + - Make available to the following: Only Configuration Manager Clients +- Scheduling + - <default> +- User Experience + - <default> +- Alerts + - <default> +- Distribution Points + - <default> + +## Verify the backup + +This section assumes that you have a computer named PC0004 with the Configuration Manager client installed. + +On **PC0004**: + +1. If it is not already started, start the PC0004 computer and open the Configuration Manager control panel (control smscfgrc). +2. On the **Actions** tab, select **Machine Policy Retrieval & Evaluation Cycle**, click **Run Now**, and then click **OK** in the popup dialog box that appears. + + >[!NOTE] + >You also can use the Client Notification option in the Configuration Manager console, as shown in [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md). + +3. Open the Software Center, select the **Replace Task Sequence** deployment and then click **Install**. +4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again. +5. Allow the Replace Task Sequence to complete. The PC0004 computer will gather user data, boot into Windows PE and gather more data, then boot back to the full OS. The entire process should only take a few minutes. + +![Task sequence example](../images/pc0004b.png) + +Capturing the user state + +On **CM01**: + +6. Open the state migration point storage folder (ex: D:\Migdata) and verify that a sub-folder was created containing the USMT backup. +7. Using the Configuration Manager console, in the Assets and Compliance workspace, select the **User State Migration** node, right-click the **PC0004/PC0006** association, and select **View Recovery Information**. Note that the object now also has a user state store location. + + >[!NOTE] + >It may take a few minutes for the user state store location to be populated. + +## Deploy the new computer + +On **PC0006**: + +1. Start the PC0006 virtual machine (or physical computer), press **F12** to Pre-Boot Execution Environment (PXE) boot when prompted. Allow it to boot Windows Preinstallation Environment (Windows PE), and then complete the deployment wizard using the following settings: + + * Password: pass@word1 + * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM + +2. The setup now starts and does the following: + + * Installs the Windows 10 operating system + * Installs the Configuration Manager client + * Joins it to the domain + * Installs the applications + * Restores the PC0004 backup + +When the process is complete, you will have a new Windows 10 computer in your domain with user data and settings restored. See the following examples: + +![User data and setting restored example 1](../images/pc0006a.png)
              +![User data and setting restored example 2](../images/pc0006b.png)
              +![User data and setting restored example 3](../images/pc0006c.png)
              +![User data and setting restored example 4](../images/pc0006d.png)
              +![User data and setting restored example 5](../images/pc0006e.png)
              +![User data and setting restored example 6](../images/pc0006f.png)
              +![User data and setting restored example 7](../images/pc0006g.png)
              +![User data and setting restored example 8](../images/pc0006h.png)
              +![User data and setting restored example 9](../images/pc0006i.png) + +Next, see [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade-to-windows-10-with-configuraton-manager.md). + +## Related topics + +[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
              +[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
              +[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
              +[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
              +[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
              +[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
              +[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
              +[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
              diff --git a/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md b/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md new file mode 100644 index 0000000000..46a0b5ee09 --- /dev/null +++ b/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md @@ -0,0 +1,143 @@ +--- +title: Perform in-place upgrade to Windows 10 via Configuration Manager +description: Learn how to perform an in-place upgrade to Windows 10 by automating the process with a Microsoft Endpoint Configuration Manager task sequence. +ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Perform an in-place upgrade to Windows 10 using Configuration Manager + + +**Applies to** + +- Windows 10 + +The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Endpoint Configuration Manager task sequence to completely automate the process. + +>[!IMPORTANT] +>Beginning with Windows 10 and Windows Server 2016, Windows Defender is already installed. A management client for Windows Defender is also installed automatically if the Configuration Manager client is installed. However, previous Windows operating systems installed the System Center Endpoint Protection (SCEP) client with the Configuration Manager client. The SCEP client can block in-place upgrade to Windows 10 due to incompatibility, and must be removed from a device before performing an in-place upgrade to Windows 10. + +## Infrastructure + +An existing Configuration Manager infrastructure that is integrated with MDT is used for the following procedures. For more information about the setup for this article, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +For the purposes of this article, we will use one server computer (CM01) and one client computers (PC0004). +- CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. +- PC0004 is a domain member client computer running Windows 7 SP1, or a later version of Windows, with the Configuration Manager client installed, that will be upgraded to Windows 10. + +All servers are running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. + +All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. + +## Add an OS upgrade package + +Configuration Manager Current Branch includes a native in-place upgrade task. This task sequence differs from the MDT in-place upgrade task sequence in that it does not use a default OS image, but rather uses an [OS upgrade package](https://docs.microsoft.com/configmgr/osd/get-started/manage-operating-system-upgrade-packages). + +On **CM01**: + +1. Using the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, right-click **Operating System Upgrade Packages**, and click **Add Operating System Upgrade Package**. +2. On the **Data Source** page, under **Path**, click **Browse** and enter the UNC path to your media source. In this example, we have extracted the Windows 10 installation media to **\\\\cm01\\Sources$\\OSD\\UpgradePackages\\Windows 10**. +3. If you have multiple image indexes in the installation media, select **Extract a specific image index from install.wim...** and choose the image index you want from the dropdown menu. In this example, we have chosen **Windows 10 Enterprise**. +4. Next to **Architecture**, select **x64**, choose a language from the dropdown menu next to **Language**, and then click **Next**. +5. Next to **Name**, enter **Windows 10 x64 RTM** and then complete the wizard by clicking **Next** and **Close**. +6. Distribute the OS upgrade package to the CM01 distribution point by right-clicking the **Windows 10 x64 RTM** OS upgrade package and then clicking **Distribute Content**. +7. In the Distribute Content Wizard, add the CM01 distribution point, click **Next** and click **Close**. +8. View the content status for the Windows 10 x64 RTM upgrade package. Do not continue until the distribution is completed (it might take a few minutes). You also can review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for the **STATMSG: ID=2301** line. + +## Create an in-place upgrade task sequence + +On **CM01**: + +1. Using the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and select **Create Task Sequence**. +2. On the **Create a new task sequence** page, select **Upgrade an operating system from an upgrade package** and click **Next**. +3. Use the following settings to complete the wizard: + + * Task sequence name: Upgrade Task Sequence + * Description: In-place upgrade + * Upgrade package: Windows 10 x64 RTM + * Include software updates: Do not install any software updates + * Install applications: OSD \ Adobe Acrobat Reader DC + +4. Complete the wizard, and click **Close**. +5. Review the Upgrade Task Sequence. + +![The upgrade task sequence](../images/cm-upgrade-ts.png) + +The Configuration Manager upgrade task sequence + +## Create a device collection + +After you create the upgrade task sequence, you can create a collection to test a deployment. In this section, we assume you have the PC0004 computer running Windows 7 SP1, with the Configuration Manager client installed. + +On **CM01**: + +1. Using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings: + - General + - Name: Windows 10 x64 in-place upgrade + - Limited Collection: All Systems + - Membership rules: + - Direct rule + - Resource Class: System Resource + - Attribute Name: Name + - Value: PC0004 + - Select Resources + - Select PC0004 + +2. Review the Windows 10 x64 in-place upgrade collection. Do not continue until you see PC0004 in the collection. + +## Deploy the Windows 10 upgrade + +In this section, you create a deployment for the Windows 10 Enterprise x64 Update application. + +On **CM01**: + +1. Using the Configuration Manager console, in the Software Library workspace, right-click the **Upgrade Task Sequence** task sequence, and then click **Deploy**. +2. On the **General** page, browse and select the **Windows 10 x64 in-place upgrade** collection, and then click **Next**. +3. On the **Content** page, click **Next**. +4. On the **Deployment Settings** page, click **Next**: +5. On the **Scheduling** page, accept the default settings, and then click **Next**. +6. On the **User Experience** page, accept the default settings, and then click **Next**. +7. On the **Alerts** page, accept the default settings, and then click **Next**. +7. On the **Distribution Points** page, accept the default settings, and then click **Next**. +8. On the **Summary** page, click **Next**, and then click **Close**. + +## Start the Windows 10 upgrade + +Next, run the in-place upgrade task sequence on PC0004. + +On **PC0004**: + +1. Open the Configuration Manager control panel (control smscfgrc). +2. On the **Actions** tab, select **Machine Policy Retrieval & Evaluation Cycle**, click **Run Now**, and then click **OK** in the popup dialog box that appears. + + >[!NOTE] + >You also can use the Client Notification option in the Configuration Manager console, as shown in [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md). + +3. Open the Software Center, select the **Upgrade Task Sequence** deployment and then click **Install**. +4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again. +5. Allow the Upgrade Task Sequence to complete. The PC0004 computer will download the install.wim file, perform an in-place upgrade, and install your added applications. See the following examples: + +![Upgrade task sequence example 1](../images/pc0004-a.png)
              +![Upgrade task sequence example 2](../images/pc0004-b.png)
              +![Upgrade task sequence example 3](../images/pc0004-c.png)
              +![Upgrade task sequence example 4](../images/pc0004-d.png)
              +![Upgrade task sequence example 5](../images/pc0004-e.png)
              +![Upgrade task sequence example 6](../images/pc0004-f.png)
              +![Upgrade task sequence example 7](../images/pc0004-g.png) + +In-place upgrade with Configuration Manager + +## Related topics + +[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
              +[Configuration Manager Team blog](https://go.microsoft.com/fwlink/p/?LinkId=620109) diff --git a/windows/deployment/deploy-windows-mdt/TOC.md b/windows/deployment/deploy-windows-mdt/TOC.md new file mode 100644 index 0000000000..7f51b8ca5b --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/TOC.md @@ -0,0 +1,22 @@ +# Deploy Windows 10 with the Microsoft Deployment Toolkit (MDT) +## [Get started with MDT](get-started-with-the-microsoft-deployment-toolkit.md) + +## Deploy Windows 10 with MDT +### [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) +### [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +### [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) +### [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) +### [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) +### [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +### [Perform an in-place upgrade to Windows 10 with MDT](upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) + +## Customize MDT +### [Configure MDT settings](configure-mdt-settings.md) +### [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +### [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +### [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +### [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +### [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +### [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +### [Use web services in MDT](use-web-services-in-mdt.md) +### [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md index 944c8ac8aa..67daeba302 100644 --- a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md +++ b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md @@ -21,20 +21,24 @@ ms.topic: article **Applies to** - Windows 10 -In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of the deployment solution. With images reaching 5 GB in size or more, you can't deploy machines in a remote office over the wire. You need to replicate the content, so that the clients can do local deployments. +Perform the steps in this article to build a distributed environment for Windows 10 deployment. A distributed environment for deployment is useful when you have a segmented network, for example one that is segmented geographically into two branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of a deployment solution because images of 5 GB or more in size can present bandwidth issues when deployed over the wire. Replicating this content enables clients to do local deployments. -We will use four machines for this topic: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 standard server, and PC0006 is a blank machine to which you will deploy Windows 10. You will configure a second deployment server (MDT02) for a remote site (Stockholm) by replicating the deployment share in the original site (New York). MDT01, MDT02, and PC0006 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). +Four computers are used in this topic: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 and MDT02 are domain member computers running Windows Server 2019, and PC0006 is a blank device where we will deploy Windows 10. The second deployment server (MDT02) will be configured for a remote site (Stockholm) by replicating the deployment share on MDT01 at the original site (New York). All devices are members of the domain contoso.com for the fictitious Contoso Corporation. + +For the purposes of this article, we assume that MDT02 is prepared with the same network and storage capabilities that were specified for MDT01, except that MDT02 is located on a different subnet than MDT01. For more details on the infrastructure setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). ![figure 1](../images/mdt-10-fig01.png) -Figure 1. The machines used in this topic. +Computers used in this topic. -## Replicate deployment shares +>HV01 is also used in this topic to host the PC0006 virtual machine. + +## Replicate deployment shares Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be done in a number of different ways. The most common content replication solutions with Microsoft Deployment Toolkit (MDT) use either the Linked Deployment Shares (LDS) feature or Distributed File System Replication (DFS-R). Some organizations have used a simple robocopy script for replication of the content. -**Note**   -Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target. +> [!NOTE] +> Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target. ### Linked deployment shares in MDT @@ -42,188 +46,225 @@ LDS is a built-in feature in MDT for replicating content. However, LDS works bes ### Why DFS-R is a better option -DFS-R is not only very fast and reliable, but it also offers central monitoring, bandwidth control, and a great delta replication engine. DFS-R will work equally well whether you have 2 sites or 90. When using DFS-R for MDT, we recommend running your deployment servers on Windows Server 2008 R2 or higher. From that version on, you can configure the replication target(s) as read-only, which is exactly what you want for MDT. This way, you can have your master deployment share centralized and replicate out changes as they happen. DFS-R will quickly pick up changes at the central deployment share in MDT01 and replicate the delta changes to MDT02. +DFS-R is not only very fast and reliable, but it also offers central monitoring, bandwidth control, and a great delta replication engine. DFS-R will work equally well whether you have 2 sites or 90. When using DFS-R for MDT, we recommend running your deployment servers on Windows Server 2008 R2 or higher. From that version on, you can configure the replication targets as read-only, which is exactly what you want for MDT. This way, you can have your master deployment share centralized and replicate out changes as they happen. DFS-R will quickly pick up changes at the central deployment share in MDT01 and replicate the delta changes to MDT02. -## Set up Distributed File System Replication (DFS-R) for replication +## Set up Distributed File System Replication (DFS-R) for replication -Setting up DFS-R for replication is a quick and straightforward process. You prepare the deployment servers and then create a replication group. To complete the setup, you configure some replication settings. +Setting up DFS-R for replication is a quick and straightforward process: Prepare the deployment servers, create a replication group, then configure some replication settings. ### Prepare MDT01 for replication -1. On MDT01, using Server Manager, click **Add roles and features**. -2. On the **Select installation type** page, select **Role-based or feature-based installation**. -3. On the **Select destination server** page, select **MDT01.contoso.com** and click **Next**. -4. On the **Select server roles** page, expand **File and Storage Services (Installed)** and expand **File and iSCSI Services (Installed)**. -5. In the **Roles** list, select **DFS Replication**. In the **Add Roles and Features Wizard** dialog box, select **Add Features**, and then click **Next**. - ![figure 2](../images/mdt-10-fig02.png) +On **MDT01**: - Figure 2. Adding the DFS Replication role to MDT01. +1. Install the DFS Replication role on MDT01 by entering the following at an elevated Windows PowerShell prompt: -6. On the **Select features** page, accept the default settings, and click **Next**. -7. On the **Confirm installation selections** page, click **Install**. -8. On the **Installation progress** page, click **Close**. +```powershell +Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools +``` + +2. Wait for installation to comlete, and then verify that the installation was successful. See the following output: + +```output +PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools + +Success Restart Needed Exit Code Feature Result +------- -------------- --------- -------------- +True No Success {DFS Replication, DFS Management Tools, Fi... +``` ### Prepare MDT02 for replication -1. On MDT02, using Server Manager, click **Add roles and features**. -2. On the **Select installation type** page, select **Role-based or feature-based installation**. -3. On the **Select destination server** page, select **MDT02.contoso.com** and click **Next**. -4. On the **Select server roles** page, expand **File and Storage Services (Installed)** and expand **File and iSCSI Services (Installed)**. -5. In the **Roles** list, select **DFS Replication**. In the **Add Roles and Features Wizard** dialog box, select **Add Features**, and then click **Next**. -6. On the **Select features** page, accept the default settings, and click **Next**. -7. On the **Confirm installation selections** page, click **Install**. -8. On the **Installation progress** page, click **Close**. +On **MDT02**: + +1. Perform the same procedure on MDT02 by entering the following at an elevated Windows PowerShell prompt: + +```powershell +Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools +``` + +2. Wait for installation to comlete, and then verify that the installation was successful. See the following output: + +```output +PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools + +Success Restart Needed Exit Code Feature Result +------- -------------- --------- -------------- +True No Success {DFS Replication, DFS Management Tools, Fi... +``` ### Create the MDTProduction folder on MDT02 -1. On MDT02, using File Explorer, create the **E:\\MDTProduction** folder. -2. Share the **E:\\MDTProduction** folder as **MDTProduction$**. Use the default permissions. +On **MDT02**: - ![figure 3](../images/mdt-10-fig03.png) +1. Create and share the **D:\\MDTProduction** folder using default permissions by entering the following at an elevated command prompt: - Figure 3. Sharing the **E:\\MDTProduction folder** on MDT02. + ```powershell + mkdir d:\MDTProduction + New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction" + ``` + +2. You should see the following output: + + ```output + C:\> New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction" + + Name ScopeName Path Description + ---- --------- ---- ----------- + MDTProduction$ * D:\MDTProduction + ``` ### Configure the deployment share When you have multiple deployment servers sharing the same content, you need to configure the Bootstrap.ini file with information about which server to connect to based on where the client is located. In MDT, that can be done by using the DefaultGateway property. -1. On MDT01, using Notepad, navigate to the **E:\\MDTProduction\\Control** folder and modify the Boostrap.ini file to look like this: - ``` +On **MDT01**: + +1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the Boostrap.ini file as follows. Under [DefaultGateway] enter the IP addresses for the client's default gateway in New York and Stockholm, respectively (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (i.e. server) to use. + + ```ini [Settings] Priority=DefaultGateway, Default + [DefaultGateway] - 192.168.1.1=NewYork - 192.168.2.1=Stockholm + 10.10.10.1=NewYork + 10.10.20.1=Stockholm + [NewYork] DeployRoot=\\MDT01\MDTProduction$ + [Stockholm] DeployRoot=\\MDT02\MDTProduction$ + [Default] UserDomain=CONTOSO UserID=MDT_BA + UserPassword=pass@word1 SkipBDDWelcome=YES ``` - **Note** - The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). + >[!NOTE] + >The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). 2. Save the Bootstrap.ini file. -3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. - - ![figure 4](../images/mdt-10-fig04.png) - - Figure 4. Updating the MDT Production deployment share. - -4. Use the default settings for the Update Deployment Share Wizard. -5. After the update is complete, use the Windows Deployment Services console. In the **Boot Images** node, right-click the **MDT Production x64** boot image and select **Replace Image**. +3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. Use the default settings for the Update Deployment Share Wizard. This process will take a few minutes. +4. After the update is complete, use the Windows Deployment Services console on MDT01. In the **Boot Images** node, right-click the **MDT Production x64** boot image and select **Replace Image**. +5. Browse and select the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** boot image, and then complete Replace Boot Image Wizard using the default settings. ![figure 5](../images/mdt-10-fig05.png) - Figure 5. Replacing the updated boot image in WDS. + Replacing the updated boot image in WDS. + + >[!TIP] + >If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console. + + ## Replicate the content -6. Browse and select the **E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** boot image, and then complete Replace Boot Image Wizard using the default settings. - ## Replicate the content Once the MDT01 and MDT02 servers are prepared, you are ready to configure the actual replication. + ### Create the replication group -7. On MDT01, using DFS Management, right-click **Replication**, and select **New Replication Group**. -8. On the **Replication Group Type** page, select **Multipurpose replication group**, and click **Next**. -9. On the **Name and Domain** page, assign the **MDTProduction** name, and click **Next**. -10. On the **Replication Group Members** page, click **Add**, add **MDT01** and **MDT02**, and then click **Next**. + +6. On MDT01, using DFS Management (dfsmgmt.msc), right-click **Replication**, and click **New Replication Group**. +7. On the **Replication Group Type** page, select **Multipurpose replication group**, and click **Next**. +8. On the **Name and Domain** page, assign the **MDTProduction** name, and click **Next**. +9. On the **Replication Group Members** page, click **Add**, add **MDT01** and **MDT02**, and then click **Next**. ![figure 6](../images/mdt-10-fig06.png) - Figure 6. Adding the Replication Group Members. + Adding the Replication Group Members. -11. On the **Topology Selection** page, select the **Full mesh** option and click **Next**. -12. On the **Replication Group Schedule and Bandwidth** page, accept the default settings and click **Next**. -13. On the **Primary Member** page, select **MDT01** and click **Next**. -14. On the **Folders to Replicate** page, click **Add**, type in **E:\\MDTProduction** as the folder to replicate, click **OK**, and then click **Next**. -15. On the **Local Path of MDTProduction** on the **Other Members** page, select **MDT02**, and click **Edit**. -16. On the **Edit** page, select the **Enabled** option, type in **E:\\MDTProduction** as the local path of folder, select the **Make the selected replicated folder on this member read-only** check box, click **OK**, and then click **Next**. +10. On the **Topology Selection** page, select the **Full mesh** option and click **Next**. +11. On the **Replication Group Schedule and Bandwidth** page, accept the default settings and click **Next**. +12. On the **Primary Member** page, select **MDT01** and click **Next**. +13. On the **Folders to Replicate** page, click **Add**, enter **D:\\MDTProduction** as the folder to replicate, click **OK**, and then click **Next**. +14. On the **Local Path of MDTProduction** on the **Other Members** page, select **MDT02**, and click **Edit**. +15. On the **Edit** page, select the **Enabled** option, type in **D:\\MDTProduction** as the local path of folder, select the **Make the selected replicated folder on this member read-only** check box, click **OK**, and then click **Next**. +16. On the **Review Settings and Create Replication Group** page, click **Create**. +17. On the **Confirmation** page, click **Close**. - ![figure 7](../images/mdt-10-fig07.png) - - Figure 7. Configure the MDT02 member. - -17. On the **Review Settings and Create Replication Group** page, click **Create**. -18. On the **Confirmation** page, click **Close**. ### Configure replicated folders -19. On MDT01, using DFS Management, expand **Replication** and then select **MDTProduction**. -20. In the middle pane, right-click the **MDT01** member and select **Properties**. -21. On the **MDT01 (MDTProduction) Properties** page, configure the following and then click **OK**: + +18. On **MDT01**, using DFS Management, expand **Replication** and then select **MDTProduction**. +19. In the middle pane, right-click the **MDT01** member and click **Properties**. +20. On the **MDT01 (MDTProduction) Properties** page, configure the following and then click **OK**: 1. In the **Staging** tab, set the quota to **20480 MB**. 2. In the **Advanced** tab, set the quota to **8192 MB**. - In this scenario the size of the deployment share is known, but you might need to change the values for your environment. A good rule of thumb is to get the size of the 16 largest files and make sure they fit in the staging area. Here is a Windows PowerShell example that calculates the size of the 16 largest files in the E:\\MDTProduction deployment share: + In this scenario the size of the deployment share is known, but you might need to change the values for your environment. A good rule of thumb is to get the size of the 16 largest files and make sure they fit in the staging area. Below is a Windows PowerShell example that calculates the size of the 16 largest files in the D:\\MDTProduction deployment share: ``` powershell - (Get-ChildItem E:\MDTProduction -Recurse | Sort-Object Length -Descending | Select-Object -First 16 | Measure-Object -Property Length -Sum).Sum /1GB + (Get-ChildItem D:\MDTProduction -Recurse | Sort-Object Length -Descending | Select-Object -First 16 | Measure-Object -Property Length -Sum).Sum /1GB ``` - ![figure 8](../images/mdt-10-fig08.png) - - Figure 8. Configure the Staging settings. - -22. In the middle pane, right-click the **MDT02** member and select **Properties**. -23. On the **MDT02 (MDTProduction) Properties** page, configure the following and then click **OK**: +21. In the middle pane, right-click the **MDT02** member and select **Properties**. +22. On the **MDT02 (MDTProduction) Properties** page, configure the following and then click **OK**: 1. In the **Staging** tab, set the quota to **20480 MB**. 2. In the **Advanced** tab, set the quota to **8192 MB**. -**Note**   -It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly. - + > [!NOTE] + > It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly. + +23. Verify that MDT01 and MDT02 are members of the MDTProduction replication group, with MDT01 being primary as follows using an elevated command prompt: + +```cmd +C:\> dfsradmin membership list /rgname:MDTProduction /attr:MemName,IsPrimary +MemName IsPrimary +MDT01 Yes +MDT02 No +``` + ### Verify replication -1. On MDT02, wait until you start to see content appear in the **E:\\MDTProduction** folder. -2. Using DFS Management, expand **Replication**, right-click **MDTProduction**, and select **Create Diagnostics Report**. -3. In the Diagnostics Report Wizard, on the **Type of Diagnostics Report or Test** page, select **Health report** and click **Next**. -4. On the **Path and Name** page, accept the default settings and click **Next**. -5. On the **Members to Include** page, accept the default settings and click **Next**. -6. On the **Options** page, accept the default settings and click **Next**. -7. On the **Review Settings and Create Report** page, click **Create**. -8. Open the report in Internet Explorer, and if necessary, select the **Allow blocked content** option. + +On **MDT02**: + +1. Wait until you start to see content appear in the **D:\\MDTProduction** folder. +2. Using DFS Management, expand **Replication**, right-click **MDTProduction**, and select **Create Diagnostics Report**. +3. In the Diagnostics Report Wizard, on the **Type of Diagnostics Report or Test** page, choose **Health report** and click **Next**. +4. On the **Path and Name** page, accept the default settings and click **Next**. +5. On the **Members to Include** page, accept the default settings and click **Next**. +6. On the **Options** page, accept the default settings and click **Next**. +7. On the **Review Settings and Create Report** page, click **Create**. +8. Open the report in Internet Explorer, and if necessary, select the **Allow blocked content** option. ![figure 9](../images/mdt-10-fig09.png) -Figure 9. The DFS Replication Health Report. +The DFS Replication Health Report. -## Configure Windows Deployment Services (WDS) in a remote site +>If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**. + +## Configure Windows Deployment Services (WDS) in a remote site Like you did in the previous topic for MDT01, you need to add the MDT Production Lite Touch x64 Boot image to Windows Deployment Services on MDT02. For the following steps, we assume that WDS has already been installed on MDT02. -1. On MDT02, using the WDS console, right-click **Boot Images** and select **Add Boot Image**. -2. Browse to the E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim file and add the image with the default settings. +1. On MDT02, using the WDS console, right-click **Boot Images** and select **Add Boot Image**. +2. Browse to the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** file and add the image with the default settings. -## Deploy the Windows 10 client to the remote site +## Deploy a Windows 10 client to the remote site -Now you should have a solution ready for deploying the Windows 10 client to the remote site, Stockholm, connecting to the MDT Production deployment share replica on MDT02. +Now you should have a solution ready for deploying the Windows 10 client to the remote site: Stockholm, using the MDTProduction deployment share replica on MDT02. You can test this deployment with the following optional procedure. + +>For demonstration purposes, the following procedure uses a virtual machine (PC0006) hosted by the Hyper-V server HV01. To use the remote site server (MDT02) the VM must be assigned a default gateway that matches the one you entered in the Boostrap.ini file. 1. Create a virtual machine with the following settings: - 1. Name: PC0006 - 2. Location: C:\\VMs - 3. Generation: 2 - 4. Memory: 2048 MB - 5. Hard disk: 60 GB (dynamic disk) -2. Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The machine will now load the Windows PE boot image from the WDS server. + 1. Name: PC0006 + 2. Location: C:\\VMs + 3. Generation: 2 + 4. Memory: 2048 MB + 5. Hard disk: 60 GB (dynamic disk) + 6. Install an operating system from a network-based installation server +2. Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from the WDS server. 3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: - 1. Password: P@ssw0rd - 2. Select a task sequence to execute on this computer: - 1. Windows 10 Enterprise x64 RTM Custom Image - 2. Computer Name: PC0006 - 3. Applications: Select the Install - Adobe Reader XI - x86 application -4. The setup will now start and do the following: + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + 2. Computer Name: PC0006 + 3. Applications: Select the Install - Adobe Reader +4. Setup will now start and perform the following: 1. Install the Windows 10 Enterprise operating system. - 2. Install the added application. - 3. Update the operating system via your local Windows Server Update Services (WSUS) server. + 2. Install applications. + 3. Update the operating system using your local Windows Server Update Services (WSUS) server. + +![pc0001](../images/pc0006.png) ## Related topics -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) - -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) - -[Configure MDT settings](configure-mdt-settings.md) - - +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
              +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
              +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
              +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
              +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
              +[Configure MDT settings](configure-mdt-settings.md) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md index 3f8f818281..8741709766 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md @@ -1,6 +1,6 @@ --- title: Configure MDT deployment share rules (Windows 10) -description: In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. +description: Learn how to configure the MDT rules engine to reach out to other resources for additional information instead of storing settings directly in the rules engine. ms.assetid: b5ce2360-33cc-4b14-b291-16f75797391b ms.reviewer: manager: laurawi @@ -27,7 +27,7 @@ When using MDT, you can assign setting in three distinct ways: - You can prompt the user or technician for information. - You can have MDT generate the settings automatically. -In order illustrate these three options, let's look at some sample configurations. +In order to illustrate these three options, let's look at some sample configurations. ## Sample configurations diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md index 4f3771b9d5..0eac636a76 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md @@ -1,50 +1,46 @@ ---- -title: Configure MDT settings (Windows 10) -description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. -ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: customize, customization, deploy, features, tools -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Configure MDT settings - -One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment. -For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). - -![figure 1](../images/mdt-09-fig01.png) - -Figure 1. The machines used in this topic. - -## In this section - -- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) -- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) -- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) -- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) -- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) -- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) -- [Use web services in MDT](use-web-services-in-mdt.md) -- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) - -## Related topics - -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) - -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) - -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +--- +title: Configure MDT settings (Windows 10) +description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. +ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: customize, customization, deploy, features, tools +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Configure MDT settings + +One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment. +For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md). + +![figure 1](../images/mdt-09-fig01.png) + +The computers used in this topic. + +## In this section + +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
              +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
              +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
              +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
              +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
              +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) diff --git a/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md b/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md deleted file mode 100644 index a89f01eda9..0000000000 --- a/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: Create a task sequence with Configuration Manager and MDT (Windows 10) -description: In this topic, you will learn how to create a Microsoft System Center 2012 R2 Configuration Manager task sequence with Microsoft Deployment Toolkit (MDT) integration using the MDT wizard. -ms.assetid: 0b069bec-5be8-47c6-bf64-7a630f41ac98 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, upgrade, task sequence, install -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.pagetype: mdt -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Create a task sequence with Configuration Manager and MDT - - -**Applies to** - -- Windows 10 - -In this topic, you will learn how to create a Microsoft System Center 2012 R2 Configuration Manager task sequence with Microsoft Deployment Toolkit (MDT) integration using the MDT wizard. Creating task sequences in System Center 2012 R2 Configuration Manager requires many more steps than creating task sequences for MDT Lite Touch installation. Luckily, the MDT wizard helps you through the process and also guides you through creating the needed packages. - -For the purposes of this topic, we will use two machines: DC01 and CM01. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard, both of which are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -## Create a task sequence using the MDT Integration Wizard - - -This section walks you through the process of creating a System Center 2012 R2 Configuration Manager task sequence for production use. - -1. On CM01, using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and select **Create MDT Task Sequence**. - -2. On the **Choose Template** page, select the **Client Task Sequence** template and click **Next**. - -3. On the **General** page, assign the following settings and then click **Next**: - - * Task sequence name: Windows 10 Enterprise x64 RTM - - * Task sequence comments: Production image with Office 2013 - -4. On the **Details** page, assign the following settings and then click **Next**: - - * Join a Domain - - * Domain: contoso.com - - * Account: CONTOSO\\CM\_JD - - * Password: Passw0rd! - - * Windows Settings - - * User name: Contoso - - * Organization name: Contoso - - * Product key: <blank> - -5. On the **Capture Settings** page, accept the default settings, and click **Next**. - -6. On the **Boot Image** page, browse and select the **Zero Touch WinPE x64** boot image package. Then click **Next**. - -7. On the **MDT Package** page, select **Create a new Microsoft Deployment Toolkit Files package**, and in the **Package source folder to be created (UNC Path):** text box, type **\\\\CM01\\Sources$\\OSD\\MDT\\MDT**. Then click **Next**. - -8. On the **MDT Details** page, assign the name **MDT** and click **Next**. - -9. On the **OS Image** page, browse and select the **Windows 10 Enterprise x64 RTM** package. Then click **Next**. - -10. On the **Deployment Method** page, accept the default settings and click **Next**. - -11. On the **Client Package** page, browse and select the **OSD / Configuration Manager Client** package. Then click **Next**. - -12. On the **USMT Package** page, browse and select **the OSD / Microsoft Corporation User State Migration Tool for Windows 8 10.0.10240.16384** package. Then click **Next**. - -13. On the **Settings Package** page, select the **Create a new settings package** option, and in the **Package source folder to be created (UNC Path):** text box, type **\\\\CM01\\Sources$\\OSD\\Settings\\Windows 10 x64 Settings**. Then click **Next**. - -14. On the **Settings Details** page, assign the name **Windows 10 x64 Settings** and click **Next**. - -15. On the **Sysprep Package** page, click **Next** twice. - -16. On the **Confirmation** page, click **Finish**. - -## Edit the task sequence - - -After you create the task sequence, we recommend that you configure the task sequence for an optimal deployment experience. The configurations include enabling support for Unified Extensible Firmware Interface (UEFI), dynamic organizational unit (OU) allocation, computer replace scenarios, and more. - -1. On CM01, using the Configuration Manager Console, select **Task Sequences**, right-click **Windows 10 Enterprise x64 RTM** task sequence, and select **Edit**. - -2. In the **Install** group, select the **Set Variable for Drive Letter** action and configure the following: - - * OSDPreserveDriveLetter: True - - >[!NOTE] - >If you don't change this value, your Windows installation will end up in E:\\Windows. - -3. In the **Post Install** group, select **Apply Network Settings**, and configure the Domain OU value to use the **Contoso / Workstations** OU (browse for values). - -4. In the **Post Install** group, disable the **Auto Apply Drivers** action. (Disabling is done by selecting the action and, in the **Options** tab, selecting the **Disable this step** check box.) - -5. After the disabled **Post Install / Auto Apply Drivers** action, add a new group name: **Drivers**. - -6. After the **Post Install / Drivers** group, add an **Apply Driver Package** action with the following settings: - - * Name: HP EliteBook 8560w - - * Driver Package: Windows 10 x64 - HP EliteBook 8560w - - * Options: Task Sequence Variable: Model equals HP EliteBook 8560w - - >[!NOTE] - >You also can add a Query WMI condition with the following query: SELECT \* FROM Win32\_ComputerSystem WHERE Model LIKE '%HP EliteBook 8560w%' - - ![Driver package options](../images/fig27-driverpackage.png "Driver package options") - - *Figure 24. The driver package options* - -7. In the **State Restore / Install Applications** group, select the **Install Application** action. - -8. Select the **Install the following applications** option, and add the OSD / Adobe Reader XI - OSD Install application to the list. - - ![Add an application to the task sequence](../images/fig28-addapp.png "Add an application to the task sequence") - - *Figure 25. Add an application to the Configuration Manager task sequence* - -9. In the **State Restore** group, after the **Set Status 5** action, add a **Request State Store** action with the following settings: - - * Restore state from another computer - - * If computer account fails to connect to state store, use the Network Access account - - * Options: Continue on error - - * Options / Condition: - - * Task Sequence Variable - - * USMTLOCAL not equals True - -10. In the **State Restore** group, after the **Restore User State** action, add a **Release State Store** action with the following settings: - - * Options: Continue on error - - * Options / Condition: - - * Task Sequence Variable - - * USMTLOCAL not equals True - -11. Click **OK**. - ->[!NOTE] ->The Request State Store and Release State Store actions need to be added for common computer replace scenarios. - - - -## Move the packages - - -While creating the task sequence with the MDT wizard, a few operating system deployment packages were created. To move these packages to the OSD folder, take the following steps. - -1. On CM01, using the Configuration Manager Console, in the Software Library workspace, expand **Application Management**, and then select **Packages**. - -2. Select the **MDT** and **Windows 10 x64 Settings** packages, right-click and select **Move**. - -3. In the **Move Selected Items** dialog box, select the **OSD** folder, and click **OK**. - -## Related topics - - -[Integrate Configuration Manager with MDT](integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](../deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](../deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](../deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](../deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Deploy Windows 10 using PXE and Configuration Manager](../deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](../deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](../deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md index 8e20ab78c8..f60f34e592 100644 --- a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md +++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md @@ -19,60 +19,72 @@ ms.topic: article # Create a Windows 10 reference image **Applies to** -- Windows 10 +- Windows 10 Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this topic, you will learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT). You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this topic, you will have a Windows 10 reference image that can be used in your deployment solution. -For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, PC0001 is a Windows 10 Enterprise x64 client, and MDT01 is a Windows Server 2012 R2 standard server. HV01 is a Hyper-V host server, but HV01 could be replaced by PC0001 as long as PC0001 has enough memory and is capable of running Hyper-V. MDT01, HV01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. >[!NOTE] ->For important details about the setup for the steps outlined in this article, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). - -![figure 1](../images/mdt-08-fig01.png) +>See [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) for more information about the server, client, and network infrastructure used in this guide. -Figure 1. The machines used in this topic. +For the purposes of this topic, we will use three computers: DC01, MDT01, and HV01. + - DC01 is a domain controller for the contoso.com domain. + - MDT01 is a contoso.com domain member server. + - HV01 is a Hyper-V server that will be used to build the reference image. + + ![devices](../images/mdt-08-fig01.png) + + Computers used in this topic. ## The reference image -The reference image described in this documentation is designed primarily for deployment to physical machines. However, the reference image is created on a virtual platform, before being automatically run through the System Preparation (Sysprep) tool process and captured to a Windows Imaging (WIM) file. The reasons for creating the reference image on a virtual platform are the following: -- You reduce development time and can use snapshots to test different configurations quickly. -- You rule out hardware issues. You simply get the best possible image, and if you have a problem, it's not likely to be hardware related. -- It ensures that you won't have unwanted applications that could be installed as part of a driver install but not removed by the Sysprep process. -- It's easy to move between lab, test, and production. +The reference image described in this guide is designed primarily for deployment to physical devices. However, the reference image is typically created on a virtual platform, before being automatically run through the System Preparation (Sysprep) tool process and captured to a Windows Imaging (WIM) file. The reasons for creating the reference image on a virtual platform are the following: +- To reduce development time and can use snapshots to test different configurations quickly. +- To rule out hardware issues. You simply get the best possible image, and if you have a problem, it's not likely to be hardware related. +- To ensures that you won't have unwanted applications that could be installed as part of a driver install but not removed by the Sysprep process. +- The image is easy to move between lab, test, and production. -## Set up the MDT build lab deployment share +## Set up the MDT build lab deployment share -With Windows 10, there is no hard requirement to create reference images; however, to reduce the time needed for deployment, you may want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 10 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process. +With Windows 10, there is no hard requirement to create reference images. However, to reduce the time needed for deployment, you might want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 10 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process. ### Create the MDT build lab deployment share -- On MDT01, log on as Administrator in the CONTOSO domain using a password of P@ssw0rd. +On **MDT01**: + +- Sign in as contoso\\administrator using a password of pass@word1 (credentials from the [prepare for deployment](prepare-for-windows-deployment-with-mdt.md) topic). +- Start the MDT deployment workbench, and pin this to the taskbar for easy access. - Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. - Use the following settings for the New Deployment Share Wizard: -- Deployment share path: E:\\MDTBuildLab -- Share name: MDTBuildLab$ -- Deployment share description: MDT Build Lab -- <default> -- Verify that you can access the \\\\MDT01\\MDTBuildLab$ share. + - Deployment share path: **D:\\MDTBuildLab** + - Share name: **MDTBuildLab$** + - Deployment share description: **MDT Build Lab** +- Accept the default selections on the Options page and click **Next**. +- Review the Summary page, click **Next**, wait for the deployment share to be created, then click **Finish**. +- Verify that you can access the \\\\MDT01\\MDTBuildLab$ share. -![figure 2](../images/mdt-08-fig02.png) + ![figure 2](../images/mdt-08-fig02.png) -Figure 2. The Deployment Workbench with the MDT Build Lab deployment share created. + The Deployment Workbench with the MDT Build Lab deployment share. + +### Enable monitoring + +To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share, click **Properties**, click the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional. ### Configure permissions for the deployment share -In order to write the reference image back to the deployment share, you need to assign Modify permissions to the MDT Build Account (MDT\_BA) for the **Captures** subfolder in the **E:\\MDTBuildLab** folder -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Modify the NTFS permissions for the **E:\\MDTBuildLab\\Captures** folder by running the following command in an elevated Windows PowerShell prompt: +In order to read files in the deployment share and write the reference image back to it, you need to assign NTSF and SMB permissions to the MDT Build Account (MDT\_BA) for the **D:\\MDTBuildLab** folder - ``` - icacls E:\MDTBuildLab\Captures /grant '"MDT_BA":(OI)(CI)(M)' +On **MDT01**: + +1. Ensure you are signed in as **contoso\\administrator**. +2. Modify the NTFS permissions for the **D:\\MDTBuildLab** folder by running the following command in an elevated Windows PowerShell prompt: + + ``` powershell + icacls "D:\MDTBuildLab" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' + grant-smbshareaccess -Name MDTBuildLab$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force ``` -![figure 3](../images/mdt-08-fig03.png) - -Figure 3. Permissions configured for the MDT\_BA user. - -## Add the setup files +## Add setup files This section will show you how to populate the MDT deployment share with the Windows 10 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image. @@ -85,211 +97,205 @@ MDT supports adding both full source Windows 10 DVDs (ISOs) and custom images t ### Add Windows 10 Enterprise x64 (full source) -In these steps we assume that you have copied the content of a Windows 10 Enterprise x64 ISO to the **E:\\Downloads\\Windows 10 Enterprise x64** folder. +On **MDT01**: -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**. -3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. -4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: -5. Full set of source files -6. Source directory: E:\\Downloads\\Windows 10 Enterprise x64 -7. Destination directory name: W10EX64RTM -8. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click the added operating system name in the **Operating System** node and change the name to the following: **Windows 10 Enterprise x64 RTM Default Image** +1. Sign in as **contoso\\administrator** and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. The following example shows the files copied to the D:\\Downloads folder, but you can also choose to import the OS directly from an ISO or DVD. -![figure 4](../images/figure4-deployment-workbench.png) + ![ISO](../images/iso-data.png) -Figure 4. The imported Windows 10 operating system after renaming it. +2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**. +3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. +4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files + - Source directory: (location of your source files) + - Destination directory name: W10EX64RTM +5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. See the following example. -## Add applications + ![Default image](../images/deployment-workbench01.png) -Before you create an MDT task sequence, you need to add all of the applications and other sample scripts to the MDT Build Lab share. +>Depending on the DVD you used, there might be multiple editions available. For the purposes of this guide, we are using the Windows 10 Enterprise image, but other images will also work. -The steps in this section use a strict naming standard for your MDT applications. You add the "Install - " prefix for typical application installations that run a setup installer of some kind, and you use the "Configure - " prefix when an application configures a setting in the operating system. You also add an " - x86", " - x64", or "- x86-x64" suffix to indicate the application's architecture (some applications have installers for both architectures). Using a script naming standard is always recommended when using MDT as it helps maintain order and consistency. -By storing configuration items as MDT applications, it is easy to move these objects between various solutions, or between test and production environments. In this topic's step-by-step sections, you will add the following applications: +## Add applications -- Install - Microsoft Office 2013 Pro Plus - x86 -- Install - Microsoft Silverlight 5.0 - x64 -- Install - Microsoft Visual C++ 2005 SP1 - x86 -- Install - Microsoft Visual C++ 2005 SP1 - x64 -- Install - Microsoft Visual C++ 2008 SP1 - x86 -- Install - Microsoft Visual C++ 2008 SP1 - x64 -- Install - Microsoft Visual C++ 2010 SP1 - x86 -- Install - Microsoft Visual C++ 2010 SP1 - x64 -- Install - Microsoft Visual C++ 2012 Update 4 - x86 -- Install - Microsoft Visual C++ 2012 Update 4 - x64 +Before you create an MDT task sequence, you need to add any applications and scripts you wish to install to the MDT Build Lab share. -In these examples, we assume that you downloaded the software in this list to the E:\\Downloads folder. The first application is added using the UI, but because MDT supports Windows PowerShell, you add the other applications using Windows PowerShell. +On **MDT01**: + +First, create an MDT folder to store the Microsoft applications that will be installed: + +1. In the MDT Deployment Workbench, expand **Deployment Shares \\ MDT Build Lab \\ Applications** +2. Right-click **Applications** and then click **New Folder**. +3. Under **Folder name**, type **Microsoft**. +4. Click **Next** twice, and then click **Finish**. + +The steps in this section use a strict naming standard for your MDT applications. +- Use the "Install - " prefix for typical application installations that run a setup installer of some kind, +- Use the "Configure - " prefix when an application configures a setting in the operating system. +- You also add an " - x86", " - x64", or "- x86-x64" suffix to indicate the application's architecture (some applications have installers for both architectures). + +Using a script naming standard is always recommended when using MDT as it helps maintain order and consistency. + +By storing configuration items as MDT applications, it is easy to move these objects between various solutions, or between test and production environments. + +In example sections, you will add the following applications: + +- Install - Microsoft Office 365 Pro Plus - x64 +- Install - Microsoft Visual C++ Redistributable 2019 - x86 +- Install - Microsoft Visual C++ Redistributable 2019 - x64 + +>The 64-bit version of Microsoft Office 365 Pro Plus is recommended unless you need legacy app support. For more information, see [Choose between the 64-bit or 32-bit version of Office](https://support.office.com/article/choose-between-the-64-bit-or-32-bit-version-of-office-2dee7807-8f95-4d0c-b5fe-6c6f49b8d261) + +Download links: +- [Office Deployment Tool](https://www.microsoft.com/download/details.aspx?id=49117) +- [Microsoft Visual C++ Redistributable 2019 - x86](https://aka.ms/vs/16/release/VC_redist.x86.exe) +- [Microsoft Visual C++ Redistributable 2019 - x64](https://aka.ms/vs/16/release/VC_redist.x64.exe) + +Download all three items in this list to the D:\\Downloads folder on MDT01. + +**Note**: For the purposes of this lab, we will leave the MSVC files in the D:\\Downloads folder and the Office365 files will be extracted to a child folder. If you prefer, you can place each application in its own separate child folder and then modify the $ApplicationSourcePath below as needed (instead of just D:\\Downloads). >[!NOTE] ->All the Microsoft Visual C++ downloads can be found on [The latest supported Visual C++ downloads](https://go.microsoft.com/fwlink/p/?LinkId=619523). +>All the Microsoft Visual C++ downloads can be found on [The latest supported Visual C++ downloads](https://go.microsoft.com/fwlink/p/?LinkId=619523). Visual C++ 2015, 2017 and 2019 all share the same redistributable files. -### Create the install: Microsoft Office Professional Plus 2013 x86 +### Create configuration file: Microsoft Office 365 Professional Plus x64 -You can customize Office 2013. In the volume license versions of Office 2013, there is an Office Customization Tool you can use to customize the Office installation. In these steps we assume you have copied the Office 2013 installation files to the E:\\Downloads\\Office2013 folder. +1. After downloading the most current version of the Office Deployment tool from the Microsoft Download Center using the link provided above, run the self-extracting executable file and extract the files to **D:\\Downloads\\Office365**. The Office Deployment Tool (setup.exe) and several sample configuration.xml files will be extracted. +2. Using a text editor (such as Notepad), create an XML file in the D:\\Downloads\\Office365 directory with the installation settings for Microsoft 365 Apps for enterprise that are appropriate for your organization. The file uses an XML format, so the file you create must have an extension of .xml but the file can have any filename. -### Add the Microsoft Office Professional Plus 2013 x86 installation files + For example, you can use the following configuration.xml file, which provides these configuration settings: + - Install the 64-bit version of Microsoft 365 Apps for enterprise in English directly from the Office Content Delivery Network (CDN) on the internet. Note: 64-bit is now the default and recommended edition. + - Use the Semi-Annual Channel and get updates directly from the Office CDN on the internet. + - Perform a silent installation. You won’t see anything that shows the progress of the installation and you won’t see any error messages. -After adding the Microsoft Office Professional Plus 2013 x86 application, you then automate its setup by running the Office Customization Tool. In fact, MDT detects that you added the Office Professional Plus 2013 x86 application and creates a shortcut for doing this. -You also can customize the Office installation using a Config.xml file. But we recommend that you use the Office Customization Tool as described in the following steps, as it provides a much richer way of controlling Office 2013 settings. -1. Using the Deployment Workbench in the MDT Build Lab deployment share, expand the **Applications / Microsoft** node, and double-click **Install - Microsoft Office 2013 Pro Plus x86**. -2. In the **Office Products** tab, click **Office Customization Tool**, and click **OK** in the **Information** dialog box. + ```xml + + + + + + + + + + ``` - ![figure 5](../images/mdt-08-fig05.png) + By using these settings, any time you build the reference image you’ll be installing the most up-to-date Semi-Annual Channel version of Microsoft 365 Apps for enterprise. - Figure 5. The Install - Microsoft Office 2013 Pro Plus - x86 application properties. + >[!TIP] + >You can also use the web-based interface of the [Office Customization Tool](https://config.office.com/) to help you create your configuration.xml file. + + Also see [Configuration options for the Office Deployment Tool](https://docs.microsoft.com/deployoffice/configuration-options-for-the-office-2016-deployment-tool) and [Overview of the Office Deployment Tool](https://docs.microsoft.com/DeployOffice/overview-of-the-office-2016-deployment-tool) for more information. - >[!NOTE] - >If you don't see the Office Products tab, verify that you are using a volume license version of Office. If you are deploying Office 365, you need to download the Admin folder from Microsoft. - -3. In the Office Customization Tool dialog box, select the Create a new Setup customization file for the following product option, select the Microsoft Office Professional Plus 2013 (32-bit) product, and click OK. -4. Use the following settings to configure the Office 2013 setup to be fully unattended: - 1. Install location and organization name - - Organization name: Contoso - 2. Licensing and user interface - 1. Select Use KMS client key - 2. Select I accept the terms in the License Agreement. - 3. Select Display level: None +3. Ensure the configuration.xml file is in the D:\\Downloads\\Office365 folder. See the following example of the extracted files plus the configuration.xml file in the Downloads\\Office365 folder: - ![figure 6](../images/mdt-08-fig06.png) + ![folder](../images/office-folder.png) - Figure 6. The licensing and user interface screen in the Microsoft Office Customization Tool + Assuming you have named the file "configuration.xml" as shown above, we will use the command "**setup.exe /configure configuration.xml**" when we create the application in MDT. This will perform the installation of Microsoft 365 Apps for enterprise using the configuration settings in the configuration.xml file. Do not perform this step yet. - 3. Modify Setup properties - - Add the **SETUP\_REBOOT** property and set the value to **Never**. - 4. Modify user settings - - In the **Microsoft Office 2013** node, expand **Privacy**, select **Trust Center**, and enable the Disable Opt-in Wizard on first run setting. -5. From the **File** menu, select **Save**, and save the configuration as 0\_Office2013ProPlusx86.msp in the **E:\\MDTBuildLab\\Applications\\Install - Microsoft Office 2013 Pro Plus - x86\\Updates** folder. + >[!IMPORTANT] + >After Microsoft 365 Apps for enterprise is installed on the reference image, do NOT open any Office programs. if you open an Office program, you are prompted to sign-in, which activates the installation of Microsoft 365 Apps for enterprise. Even if you don't sign in and you close the Sign in to set up Office dialog box, a temporary product key is installed. You don't want any kind of product key for Microsoft 365 Apps for enterprise installed as part of your reference image. - >[!NOTE] - >The reason for naming the file with a 0 (zero) at the beginning is that the Updates folder also handles Microsoft Office updates, and they are installed in alphabetical order. The Office 2013 setup works best if the customization file is installed before any updates. - -6. Close the Office Customization Tool, click Yes in the dialog box, and in the **Install - Microsoft Office 2013 Pro Plus - x86 Properties** window, click **OK**. +Additional information +- Microsoft 365 Apps for enterprise is usually updated on a monthly basis with security updates and other quality updates (bug fixes), and possibly new features (depending on which update channel you’re using). That means that once you’ve deployed your reference image, Microsoft 365 Apps for enterprise will most likely need to download and install the latest updates that have been released since you created your reference image. + +- **Note**: By using installing Office Deployment Tool as part of the reference image, Microsoft 365 Apps for enterprise is installed immediately after the reference image is deployed to the user’s device, rather than including Office apps part of the reference image. This way the user will have the most up-to-date version of Microsoft 365 Apps for enterprise right away and won’t have to download any new updates (which is most likely what would happen if Microsoft 365 Apps for enterprise was installed as part of the reference image.) + - When you are creating your reference image, instead of installing Microsoft 365 Apps for enterprise directly from the Office CDN on the internet, you can install Microsoft 365 Apps for enterprise from a location on your local network, such as a file share. To do that, you would use the Office Deployment Tool in /download mode to download the installation files to that file share. Then you could use the Office Deployment Tool in /configure mode to install Microsoft 365 Apps for enterprise from that location on to your reference image. As part of that, you’ll need to point to that location in your configuration.xml file so that the Office Deployment Tool knows where to get the Microsoft 365 Apps for enterprise files. If you decide to do this, the next time you create a new reference image, you’ll want to be sure to use the Office Deployment Tool to download the most up-to-date installation files for Microsoft 365 Apps for enterprise to that location on your internal network. That way your new reference image will have a more up-to-date installation of Microsoft 365 Apps for enterprise. ### Connect to the deployment share using Windows PowerShell If you need to add many applications, you can take advantage of the PowerShell support that MDT has. To start using PowerShell against the deployment share, you must first load the MDT PowerShell snap-in and then make the deployment share a PowerShell drive (PSDrive). -1. On MDT01, log on as **CONTOSO\\Administrator**. + +On **MDT01**: + +1. Ensure you are signed in as **contoso\\Administrator**. 2. Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt: ``` powershell Import-Module "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1" - New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "E:\MDTBuildLab" + New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "D:\MDTBuildLab" ``` +>[!TIP] +>Use "Get-Command -module MicrosoftDeploymentToolkit" to see a list of available cmdlets -### Create the install: Microsoft Visual C++ 2005 SP1 x86 +### Create the install: Microsoft Office 365 Pro Plus - x64 -In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2005SP1x86. -1. On MDT01, log on as **CONTOSO\\Administrator**. +In these steps we assume that you have downloaded the Office Deployment Tool. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to D:\\Downloads\\Office365. +On **MDT01**: + +1. Ensure you are signed on as **contoso\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2005 SP1 - x86" - $CommandLine = "vcredist_x86.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2005SP1x86" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose + $ApplicationName = "Install - Office365 ProPlus - x64" + $CommandLine = "setup.exe /configure configuration.xml" + $ApplicationSourcePath = "D:\Downloads\Office365" + Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` -### Create the install: Microsoft Visual C++ 2005 SP1 x64 + Upon successful installation the following text is displayed: + ``` + VERBOSE: Performing the operation "import" on target "Application". + VERBOSE: Beginning application import + VERBOSE: Copying application source files from D:\Downloads\Office365 to D:\MDTBuildLab\Applications\Install - + Office365 ProPlus - x64 + VERBOSE: Creating new item named Install - Office365 ProPlus - x64 at DS001:\Applications\Microsoft. + + Name + ---- + Install - Office365 ProPlus - x64 + VERBOSE: Import processing finished. + ``` -In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2005SP1x64. -1. On MDT01, log on as **CONTOSO\\Administrator**. +### Create the install: Microsoft Visual C++ Redistributable 2019 - x86 + +>[!NOTE] +>We have abbreviated "Microsoft Visual C++ Redistributable" in the $ApplicationName below as "MSVC" to avoid the path name exceeding the maxiumum allowed length of 248 characters. + +In these steps we assume that you have downloaded Microsoft Visual C++ Redistributable 2019 - x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to D:\\Downloads. + +On **MDT01**: + +1. Ensure you are signed on as **contoso\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2005 SP1 - x64" - $CommandLine = "vcredist_x64.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2005SP1x64" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose + $ApplicationName = "Install - MSVC 2019 - x86" + $CommandLine = "vc_redist.x86.exe /Q" + $ApplicationSourcePath = "D:\Downloads" + Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` -### Create the install: Microsoft Visual C++ 2008 SP1 x86 + Upon successful installation the following text is displayed: + ``` + VERBOSE: Performing the operation "import" on target "Application". + VERBOSE: Beginning application import + VERBOSE: Copying application source files from D:\Downloads to D:\MDTBuildLab\Applications\Install - MSVC 2019 - x86 + VERBOSE: Creating new item named Install - MSVC 2019 - x86 at DS001:\Applications\Microsoft. + + Name + ---- + Install - MSVC 2019 - x86 + VERBOSE: Import processing finished. + ``` -In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2008SP1x86. -1. On MDT01, log on as **CONTOSO\\Administrator**. +### Create the install: Microsoft Visual C++ Redistributable 2019 - x64 + +In these steps we assume that you have downloaded Microsoft Visual C++ Redistributable 2019 - x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to D:\\Downloads. + +On **MDT01**: + +1. Ensure you are signed on as **contoso\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2008 SP1 - x86" - $CommandLine = "vcredist_x86.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2008SP1x86" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose + $ApplicationName = "Install - MSVC 2019 - x64" + $CommandLine = "vc_redist.x64.exe /Q" + $ApplicationSourcePath = "D:\Downloads" + Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` -### Create the install: Microsoft Visual C++ 2008 SP1 x64 - -In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2008SP1x64. -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: - - ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2008 SP1 - x64" - $CommandLine = "vcredist_x64.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2008SP1x64" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose - ``` - -### Create the install: Microsoft Visual C++ 2010 SP1 x86 - -In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2010SP1x86. -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: - - ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2010 SP1 - x86" - $CommandLine = "vcredist_x86.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2010SP1x86" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose - ``` - -### Create the install: Microsoft Visual C++ 2010 SP1 x64 - -In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2010SP1x64. -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: - - ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2010 SP1 - x64" - $CommandLine = "vcredist_x64.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2010SP1x64" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose - ``` - -### Create the install: Microsoft Visual C++ 2012 Update 4 x86 - -In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Update 4 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2012Ux86. -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: - - ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2012 Update 4 - x86" - $CommandLine = "vcredist_x86.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2012Ux86" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose - ``` - -### Create the install: Microsoft Visual C++ 2012 Update 4 x64 - -In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Update 4 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2012Ux64. -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: - - ``` powershell - $ApplicationName = "Install - Microsoft Visual C++ 2012 Update 4 - x64" - $CommandLine = "vcredist_x64.exe /Q" - $ApplicationSourcePath = "E:\Downloads\VC++2012Ux64" - Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName - -Verbose - ``` - -## Create the reference image task sequence +## Create the reference image task sequence In order to build and capture your Windows 10 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 10 reference image. After creating the task sequence, you configure it to enable patching against the Windows Server Update Services (WSUS) server. The Task Sequence Windows Update action supports getting updates directly from Microsoft Update, but you get more stable patching if you use a local WSUS server. WSUS also allows for an easy process of approving the patches that you are deploying. @@ -302,79 +308,72 @@ Because we use modern virtual platforms for creating our reference images, we do To create a Windows 10 reference image task sequence, the process is as follows: -1. Using the Deployment Workbench in the MDT Build Lab deployment share, right-click **Task Sequences**, and create a new folder named **Windows 10**. -2. Expand the **Task Sequences** node, right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - 1. Task sequence ID: REFW10X64-001 - 2. Task sequence name: Windows 10 Enterprise x64 RTM Default Image - 3. Task sequence comments: Reference Build - 4. Template: Standard Client Task Sequence - 5. Select OS: Windows 10 Enterprise x64 RTM Default Image - 6. Specify Product Key: Do not specify a product key at this time - 7. Full Name: Contoso - 8. Organization: Contoso - 9. Internet Explorer home page: http://www.contoso.com - 10. Admin Password: Do not specify an Administrator Password at this time +On **MDT01**: + +1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab** right-click **Task Sequences**, and create a **New Folder** named **Windows 10**. +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + 1. Task sequence ID: REFW10X64-001 + 2. Task sequence name: Windows 10 Enterprise x64 RTM Default Image + 3. Task sequence comments: Reference Build + 4. Template: Standard Client Task Sequence + 5. Select OS: Windows 10 Enterprise x64 RTM Default Image + 6. Specify Product Key: Do not specify a product key at this time + 7. Full Name: Contoso + 8. Organization: Contoso + 9. Internet Explorer home page: http://www.contoso.com + 10. Admin Password: Do not specify an Administrator Password at this time ### Edit the Windows 10 task sequence -The steps below walk you through the process of editing the Windows 10 reference image task sequence to include the actions required to update the reference image with the latest updates from WSUS, install roles and features, and utilities, and install Microsoft Office 2013. +The steps below walk you through the process of editing the Windows 10 reference image task sequence to include the actions required to update the reference image with the latest updates from WSUS, install roles and features, and utilities, and install Microsoft Office365 ProPlus x64. -1. In the Task Sequences / Windows 10 folder, right-click the Windows 10 Enterprise x64 RTM Default Image task sequence, and select Properties. -2. On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings: - 1. State Restore. Enable the Windows Update (Pre-Application Installation) action. - **Note**   - Enable an action by going to the Options tab and clearing the Disable this step check box. +On **MDT01**: + +1. In the **Task Sequences / Windows 10** folder, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence, and select **Properties**. +2. On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings: + 1. **State Restore > Windows Update (Pre-Application Installation)** action: Enable this action by clicking the **Options** tab and clearing the **Disable this step** check box. - 2. State Restore. Enable the Windows Update (Post-Application Installation) action. - 3. State Restore. Enable the Windows Update (Post-Application Installation) action. State Restore. After the **Tattoo** action, add a new **Group** action with the following setting: - - Name: Custom Tasks (Pre-Windows Update) - 4. State Restore. After Windows Update (Post-Application Installation) action, rename Custom Tasks to Custom Tasks (Post-Windows Update). - **Note**   - The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating. - - 5. State Restore / Custom Tasks (Pre-Windows Update). Add a new Install Roles and Features action with the following settings: - 1. Name: Install - Microsoft NET Framework 3.5.1 - 2. Select the operating system for which roles are to be installed: Windows 10 - 3. Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0) + 2. **State Restore > Windows Update (Post-Application Installation)** action: Also enable this action. + 3. **State Restore**: After the **Tattoo** action, add a new **Group** action (click **Add** then click **New Group**) with the following setting: + - Name: **Custom Tasks (Pre-Windows Update)** + 4. **State Restore**: After **Windows Update (Post-Application Installation)** action, rename **Custom Tasks** to **Custom Tasks (Post-Windows Update)**. + - **Note**: The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating. + 5. **State Restore > Custom Tasks (Pre-Windows Update)**: Add a new **Install Roles and Features** action with the following settings: + 1. Name: Install - Microsoft NET Framework 3.5.1 + 2. Select the operating system for which roles are to be installed: Windows 10 + 3. Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0) >[!IMPORTANT] >This is probably the most important step when creating a reference image. Many applications need the .NET Framework, and we strongly recommend having it available in the image. The one thing that makes this different from other components is that .NET Framework 3.5.1 is not included in the WIM file. It is installed from the **Sources\\SxS** folder on the media, and that makes it more difficult to add after the image has been deployed. - ![figure 7](../images/fig8-cust-tasks.png) + ![task sequence](../images/fig8-cust-tasks.png) - Figure 7. The task sequence after creating the Custom Tasks (Pre-Windows Update) group and adding the Install - Microsoft NET Framework 3.5.1 action. + The task sequence after creating the Custom Tasks (Pre-Windows Update) group and adding the Install - Microsoft NET Framework 3.5.1 action. - 6. State Restore - Custom Tasks (Pre-Windows Update). After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action with the following settings: - 1. Name: Install - Microsoft Visual C++ 2005 SP1 - x86 - 2. Install a Single Application: Install - Microsoft Visual C++ 2005 SP1 - x86-x64 - 7. Repeat the previous step (add a new **Install Application**) to add the following applications: - 1. Install - Microsoft Visual C++ 2005 SP1 - x64 - 2. Install - Microsoft Visual C++ 2008 SP1 - x86 - 3. Install - Microsoft Visual C++ 2008 SP1 - x64 - 4. Install - Microsoft Visual C++ 2010 SP1 - x86 - 5. Install - Microsoft Visual C++ 2010 SP1 - x64 - 6. Install - Microsoft Visual C++ 2012 Update 4 - x86 - 7. Install - Microsoft Visual C++ 2012 Update 4 - x64 - 8. Install - Microsoft Office 2013 Pro Plus - x86 - 8. After the Install - Microsoft Office 2013 Pro Plus - x86 action, add a new Restart computer action. -3. Click **OK**. + 6. **State Restore > Custom Tasks (Pre-Windows Update)**: After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action (selected from the **General** group) with the following settings: + 1. Name: Microsoft Visual C++ Redistributable 2019 - x86 + 2. Install a Single Application: browse to **Install - MSVC 2019 - x86** + 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Microsoft 365 Apps for enterprise as well. +3. Click **OK**. + + ![apps](../images/mdt-apps.png) ### Optional configuration: Add a suspend action The goal when creating a reference image is of course to automate everything. But sometimes you have a special configuration or application setup that is too time-consuming to automate. If you need to do some manual configuration, you can add a little-known feature called Lite Touch Installation (LTI) Suspend. If you add the LTISuspend.wsf script as a custom action in the task sequence, it will suspend the task sequence until you click the Resume Task Sequence shortcut icon on the desktop. In addition to using the LTI Suspend feature for manual configuration or installation, you can also use it simply for verifying a reference image before you allow the task sequence to continue and use Sysprep and capture the virtual machine. -![figure 8](../images/fig8-suspend.png) + ![figure 8](../images/fig8-suspend.png) -Figure 8. A task sequence with optional Suspend action (LTISuspend.wsf) added. + A task sequence with optional Suspend action (LTISuspend.wsf) added. -![figure 9](../images/fig9-resumetaskseq.png) + ![figure 9](../images/fig9-resumetaskseq.png) -Figure 9. The Windows 10 desktop with the Resume Task Sequence shortcut. + The Windows 10 desktop with the Resume Task Sequence shortcut. ### Edit the Unattend.xml file for Windows 10 Enterprise -When using MDT, you don't need to edit the Unattend.xml file very often because most configurations are taken care of by MDT. However if, for example, you want to configure Internet Explorer 11 behavior, then you can edit the Unattend.xml for this. Editing the Unattend.xml for basic Internet Explorer settings is easy, but for more advanced settings, you will want to use Internet Explorer Administration Kit (IEAK). +When using MDT, you don't need to edit the Unattend.xml file very often because most configurations are taken care of by MDT. However if, for example, you want to configure Internet Explorer behavior, then you can edit the Unattend.xml for this. Editing the Unattend.xml for basic Internet Explorer settings is easy, but for more advanced settings, you will want to use the Internet Explorer Administration Kit (IEAK). >[!WARNING] >Do not use **SkipMachineOOBE** or **SkipUserOOBE** in your Unattend.xml file. These settings are deprecated and can have unintended effects if used. @@ -384,37 +383,54 @@ When using MDT, you don't need to edit the Unattend.xml file very often because Follow these steps to configure Internet Explorer settings in Unattend.xml for the Windows 10 Enterprise x64 RTM Default Image task sequence: -1. Using the Deployment Workbench, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**. -2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start. -3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry. -4. In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values: - - DisableDevTools: true -5. Save the Unattend.xml file, and close Windows SIM. -6. On the Windows 10 Enterprise x64 RTM Default Image Properties, click **OK**. +On **MDT01**: -![figure 10](../images/fig10-unattend.png) +1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**. +2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start. -Figure 10. Windows System Image Manager with the Windows 10 Unattend.xml. + > [!IMPORTANT] + > The ADK version 1903 has a [known issue](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](https://docs.microsoft.com/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903: + > - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144. + > - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe). + > - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim). + > - After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml. -## Configure the MDT deployment share rules +3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry. +4. In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values: + - DisableDevTools: true +5. Save the Unattend.xml file, and close Windows SIM. + - Note: If errors are reported that certain display values are incorrect, you can ignore this or browse to **7oobeSystem\\amd64_Microsoft-Windows-Shell-Setup__neutral\\Display** and enter the following: ColorDepth 32, HorizontalResolution 1, RefreshRate 60, VerticalResolution 1. +6. On the Windows 10 Enterprise x64 RTM Default Image Properties, click **OK**. -Understanding rules is critical to successfully using MDT. Rules are configured using the Rules tab of the deployment share's properties. The Rules tab is essentially a shortcut to edit the CustomSettings.ini file that exists in the E:\\MDTBuildLab\\Control folder. This section discusses how to configure the MDT deployment share rules as part of your Windows 10 Enterprise deployment. + ![figure 10](../images/fig10-unattend.png) + + Windows System Image Manager with the Windows 10 Unattend.xml. + +## Configure the MDT deployment share rules + +Understanding rules is critical to successfully using MDT. Rules are configured using the **Rules** tab of the deployment share's properties. The **Rules** tab is essentially a shortcut to edit the **CustomSettings.ini** file that exists in the **D:\\MDTBuildLab\\Control** folder. This section discusses how to configure the MDT deployment share rules as part of your Windows 10 Enterprise deployment. ### MDT deployment share rules overview -In MDT, there are always two rule files: the CustomSettings.ini file and the Bootstrap.ini file. You can add almost any rule to either; however, the Bootstrap.ini file is copied from the Control folder to the boot image, so the boot image needs to be updated every time you change that file. -For that reason, add only a minimal set of rules to Bootstrap.ini, such as which deployment server and share to connect to - the DEPLOYROOT value. Put the other rules in CustomSettings.ini because that file is updated immediately when you click OK. By taking the following steps, you will configure the rules for the MDT Build Lab deployment share: -1. Using the Deployment Workbench, right-click the **MDT Build Lab deployment share** and select **Properties**. -2. Select the **Rules** tab and modify using the following information: +In MDT, there are always two rule files: the **CustomSettings.ini** file and the **Bootstrap.ini** file. You can add almost any rule to either. However, the Bootstrap.ini file is copied from the Control folder to the boot image, so the boot image needs to be updated every time you change that file. For this reason, add only a minimal set of rules to Bootstrap.ini, such as which deployment server and share to connect to - the DEPLOYROOT value. Put the other rules in CustomSettings.ini because that file is updated immediately when you click OK. + +To configure the rules for the MDT Build Lab deployment share: + +On **MDT01**: + +1. Using the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Properties**. +2. Select the **Rules** tab and replace the existing content with the following information (edit the settings as needed to match your deployment). For example, If you do not have a WSUS server in your environment, delete the **WSUSServer** line from the configuration: + ``` [Settings] Priority=Default + [Default] _SMSTSORGNAME=Contoso UserDataLocation=NONE DoCapture=YES OSInstall=Y - AdminPassword=P@ssw0rd + AdminPassword=pass@word1 TimeZoneName=Pacific Standard Time JoinWorkgroup=WORKGROUP HideShell=YES @@ -439,49 +455,46 @@ For that reason, add only a minimal set of rules to Bootstrap.ini, such as which SkipFinalSummary=YES ``` - ![figure 11](../images/mdt-08-fig14.png) - - Figure 11. The server-side rules for the MDT Build Lab deployment share. + ![figure 11](../images/mdt-rules.png) + The server-side rules for the MDT Build Lab deployment share. + 3. Click **Edit Bootstrap.ini** and modify using the following information: ``` [Settings] Priority=Default + [Default] DeployRoot=\\MDT01\MDTBuildLab$ UserDomain=CONTOSO UserID=MDT_BA - UserPassword=P@ssw0rd + UserPassword=pass@word1 + SkipBDDWelcome=YES ``` - ![figure 12](../images/mdt-08-fig15.png) - - Figure 12. The boot image rules for the MDT Build Lab deployment share. - >[!NOTE] - >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation. + >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation. Obviously if you are not using the same password (pass@word3) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini. -4. In the **Windows PE** tab, in the **Platform** drop-down list, select **x86**. -5. In the **Lite Touch Boot Image Settings** area, configure the following settings: - 1. Image description: MDT Build Lab x86 - 2. ISO file name: MDT Build Lab x86.iso -6. In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. -7. In the **Lite Touch Boot Image Settings** area, configure the following settings: - 1. Image description: MDT Build Lab x64 - 2. ISO file name: MDT Build Lab x64.iso -8. Click **OK**. +4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x86**. +5. In the **Lite Touch Boot Image Settings** area, configure the following settings: + 1. Image description: MDT Build Lab x86 + 2. ISO file name: MDT Build Lab x86.iso +6. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. +7. In the **Lite Touch Boot Image Settings** area, configure the following settings: + 1. Image description: MDT Build Lab x64 + 2. ISO file name: MDT Build Lab x64.iso +8. Click **OK**. >[!NOTE] >In MDT, the x86 boot image can deploy both x86 and x64 operating systems (except on computers based on Unified Extensible Firmware Interface). - ### Update the deployment share After the deployment share has been configured, it needs to be updated. This is the process when the Windows PE boot images are created. -1. Using the Deployment Workbench, right-click the **MDT Build Lab deployment share** and select **Update Deployment Share**. +1. In the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Update Deployment Share**. 2. Use the default options for the Update Deployment Share Wizard. >[!NOTE] @@ -500,7 +513,7 @@ The CustomSettings.ini file is normally stored on the server, in the Deployment ### The Bootstrap.ini file -The Bootstrap.ini file is available via the deployment share's Properties dialog box, or via the E:\\MDTBuildLab\\Control folder on MDT01. +The Bootstrap.ini file is available via the deployment share's Properties dialog box, or via the D:\\MDTBuildLab\\Control folder on MDT01. ``` [Settings] @@ -509,7 +522,7 @@ Priority=Default DeployRoot=\\MDT01\MDTBuildLab$ UserDomain=CONTOSO UserID=MDT_BA -UserPassword=P@ssw0rd +UserPassword=pass@word1 SkipBDDWelcome=YES ``` @@ -538,7 +551,7 @@ _SMSTSORGNAME=Contoso UserDataLocation=NONE DoCapture=YES OSInstall=Y -AdminPassword=P@ssw0rd +AdminPassword=pass@word1 TimeZoneName=Pacific Standard Time JoinWorkgroup=WORKGROUP HideShell=YES @@ -562,91 +575,105 @@ SkipRoles=YES SkipCapture=NO SkipFinalSummary=YES ``` -- **Priority.** Has the same function as in Bootstrap.ini. Priority determines the order in which different sections are read. This CustomSettings.ini has only one section, named \[Default\]. In general, if you have multiple sections that set the same value, the value from the first section (higher priority) wins. The rare exceptions are listed in the ZTIGather.xml file. -- **\_SMSTSORGNAME.** The organization name displayed in the task sequence progress bar window during deployment. -- **UserDataLocation.** Controls the settings for user state backup. You do not need to use when building and capturing a reference image. -- **DoCapture.** Configures the task sequence to run the System Preparation (Sysprep) tool and capture the image to a file when the operating system is installed. -- **OSInstall.** Must be set to Y or YES (the code actually just looks for the Y character) for the setup to proceed. -- **AdminPassword.** Sets the local Administrator account password. -- **TimeZoneName.** Establishes the time zone to use. Don't confuse this value with TimeZone, which is only for legacy operating systems (Windows 7 and Windows Server 2003). +- **Priority.** Has the same function as in Bootstrap.ini. Priority determines the order in which different sections are read. This CustomSettings.ini has only one section, named \[Default\]. In general, if you have multiple sections that set the same value, the value from the first section (higher priority) wins. The rare exceptions are listed in the ZTIGather.xml file. +- **\_SMSTSORGNAME.** The organization name displayed in the task sequence progress bar window during deployment. +- **UserDataLocation.** Controls the settings for user state backup. You do not need to use when building and capturing a reference image. +- **DoCapture.** Configures the task sequence to run the System Preparation (Sysprep) tool and capture the image to a file when the operating system is installed. +- **OSInstall.** Must be set to Y or YES (the code actually just looks for the Y character) for the setup to proceed. +- **AdminPassword.** Sets the local Administrator account password. +- **TimeZoneName.** Establishes the time zone to use. Don't confuse this value with TimeZone, which is only for legacy operating systems (Windows 7 and Windows Server 2003). - **Note**   - The easiest way to find the current time zone name on a Windows 10 machine is to run tzutil /g in a command prompt. You can also run tzutil /l to get a listing of all available time zone names. + **Note**: The easiest way to find the current time zone name on a Windows 10 machine is to run tzutil /g in a command prompt. You can also run tzutil /l to get a listing of all available time zone names. -- **JoinWorkgroup.** Configures Windows to join a workgroup. -- **HideShell.** Hides the Windows Shell during deployment. This is especially useful for Windows 10 deployments in which the deployment wizard will otherwise appear behind the tiles. -- **FinishAction.** Instructs MDT what to do when the task sequence is complete. -- **DoNotCreateExtraPartition.** Configures the task sequence not to create the extra partition for BitLocker. There is no need to do this for your reference image. -- **WSUSServer.** Specifies which Windows Server Update Services (WSUS) server (and port, if needed) to use during the deployment. Without this option MDT will use Microsoft Update directly, which will increase deployment time and limit your options of controlling which updates are applied. -- **SLSHARE.** Instructs MDT to copy the log files to a server share if something goes wrong during deployment, or when a deployment is successfully completed. -- **ApplyGPOPack.** Allows you to deploy local group policies created by Microsoft Security Compliance Manager (SCM). -- **SkipAdminPassword.** Skips the pane that asks for the Administrator password. -- **SkipProductKey.** Skips the pane that asks for the product key. -- **SkipComputerName.** Skips the Computer Name pane. -- **SkipDomainMemberShip.** Skips the Domain Membership pane. If set to Yes, you need to configure either the JoinWorkgroup value or the JoinDomain, DomainAdmin, DomainAdminDomain, and DomainAdminPassword properties. -- **SkipUserData.** Skips the pane for user state migration. -- **SkipLocaleSelection.** Skips the pane for selecting language and keyboard settings. -- **SkipTimeZone.** Skips the pane for setting the time zone. -- **SkipApplications.** Skips the Applications pane. -- **SkipBitLocker.** Skips the BitLocker pane. -- **SkipSummary.** Skips the initial Windows Deployment Wizard summary pane. -- **SkipRoles.** Skips the Install Roles and Features pane. -- **SkipCapture.** Skips the Capture pane. -- **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to click OK before the machine shuts down. +- **JoinWorkgroup.** Configures Windows to join a workgroup. +- **HideShell.** Hides the Windows Shell during deployment. This is especially useful for Windows 10 deployments in which the deployment wizard will otherwise appear behind the tiles. +- **FinishAction.** Instructs MDT what to do when the task sequence is complete. +- **DoNotCreateExtraPartition.** Configures the task sequence not to create the extra partition for BitLocker. There is no need to do this for your reference image. +- **WSUSServer.** Specifies which Windows Server Update Services (WSUS) server (and port, if needed) to use during the deployment. Without this option MDT will use Microsoft Update directly, which will increase deployment time and limit your options of controlling which updates are applied. +- **SLSHARE.** Instructs MDT to copy the log files to a server share if something goes wrong during deployment, or when a deployment is successfully completed. +- **ApplyGPOPack.** Allows you to deploy local group policies created by Microsoft Security Compliance Manager (SCM). +- **SkipAdminPassword.** Skips the pane that asks for the Administrator password. +- **SkipProductKey.** Skips the pane that asks for the product key. +- **SkipComputerName.** Skips the Computer Name pane. +- **SkipDomainMemberShip.** Skips the Domain Membership pane. If set to Yes, you need to configure either the JoinWorkgroup value or the JoinDomain, DomainAdmin, DomainAdminDomain, and DomainAdminPassword properties. +- **SkipUserData.** Skips the pane for user state migration. +- **SkipLocaleSelection.** Skips the pane for selecting language and keyboard settings. +- **SkipTimeZone.** Skips the pane for setting the time zone. +- **SkipApplications.** Skips the Applications pane. +- **SkipBitLocker.** Skips the BitLocker pane. +- **SkipSummary.** Skips the initial Windows Deployment Wizard summary pane. +- **SkipRoles.** Skips the Install Roles and Features pane. +- **SkipCapture.** Skips the Capture pane. +- **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to click OK before the machine shuts down. -## Build the Windows 10 reference image +## Build the Windows 10 reference image -Once you have created your task sequence, you are ready to create the Windows 10 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process. -This steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then execute the reference image task sequence image to create and capture the Windows 10 reference image. +As previously described, this section requires a Hyper-V host. See [Hyper-V requirements](prepare-for-windows-deployment-with-mdt.md#hyper-v-requirements) for more information. -1. Copy the E:\\MDTBuildLab\\Boot\\MDT Build Lab x86.iso on MDT01 to C:\\ISO on the Hyper-V host. +Once you have created your task sequence, you are ready to create the Windows 10 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process. - **Note**   - Remember, in MDT you can use the x86 boot image to deploy both x86 and x64 operating system images. That's why you can use the x86 boot image instead of the x64 boot image. +The steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then run the reference image task sequence image to create and capture the Windows 10 reference image. + +1. Copy D:\\MDTBuildLab\\Boot\\MDT Build Lab x86.iso on MDT01 to C:\\ISO on your Hyper-V host (HV01). + + **Note**: Remember, in MDT you can use the x86 boot image to deploy both x86 and x64 operating system images. That's why you can use the x86 boot image instead of the x64 boot image. + +On **HV01**: -2. Create a virtual machine with the following settings: - 1. Name: REFW10X64-001 - 2. Location: C:\\VMs - 3. Memory: 1024 MB - 4. Network: External (The network that is connected to the same infrastructure as MDT01 is) - 5. Hard disk: 60 GB (dynamic disk) - 6. Image file: C:\\ISO\\MDT Build Lab x86.iso -3. Take a snapshot of the REFW10X64-001 virtual machine, and name it **Clean with MDT Build Lab x86 ISO**. +2. Create a new virtual machine with the following settings: + 1. Name: REFW10X64-001 + 2. Store the virtual machine in a different location: C:\VM + 3. Generation 1 + 4. Memory: 1024 MB + 5. Network: Must be able to connect to \\MDT01\MDTBuildLab$ + 7. Hard disk: 60 GB (dynamic disk) + 8. Install OS with image file: C:\\ISO\\MDT Build Lab x86.iso +1. Before you start the VM, add a checkpoint for REFW10X64-001, and name it **Clean with MDT Build Lab x86 ISO**. - **Note**   - Taking a snapshot is useful if you need to restart the process and want to make sure you can start clean. + **Note**: Checkpoints are useful if you need to restart the process and want to make sure you can start clean. -4. Start the REFW10X64-001 virtual machine. After booting into Windows PE, complete the Windows Deployment Wizard using the following settings: - 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Default Image - 2. Specify whether to capture an image: Capture an image of this reference computer - - Location: \\\\MDT01\\MDTBuildLab$\\Captures - 3. File name: REFW10X64-001.wim +4. Start the REFW10X64-001 virtual machine and connect to it. - ![figure 13](../images/fig13-captureimage.png) + **Note**: Up to this point we have not discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW10X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share. In the current scenario this is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11. - Figure 13. The Windows Deployment Wizard for the Windows 10 reference image. + After booting into Windows PE, complete the Windows Deployment Wizard with the following settings: + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Default Image + 2. Specify whether to capture an image: Capture an image of this reference computer + - Location: \\\\MDT01\\MDTBuildLab$\\Captures + 3. File name: REFW10X64-001.wim -5. The setup now starts and does the following: - 1. Installs the Windows 10 Enterprise operating system. - 2. Installs the added applications, roles, and features. - 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. - 4. Stages Windows PE on the local disk. - 5. Runs System Preparation (Sysprep) and reboots into Windows PE. - 6. Captures the installation to a Windows Imaging (WIM) file. - 7. Turns off the virtual machine. + ![capture image](../images/captureimage.png) -After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the E:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. + The Windows Deployment Wizard for the Windows 10 reference image. + +5. The setup now starts and does the following: + 1. Installs the Windows 10 Enterprise operating system. + 2. Installs the added applications, roles, and features. + 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. + 4. Stages Windows PE on the local disk. + 5. Runs System Preparation (Sysprep) and reboots into Windows PE. + 6. Captures the installation to a Windows Imaging (WIM) file. + 7. Turns off the virtual machine. + +After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. + + ![image](../images/image-captured.png) + +## Troubleshooting + +If you [enabled monitoring](#enable-monitoring), you can check the progress of the task sequence. + + ![monitoring](../images/mdt-monitoring.png) + +If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](https://docs.microsoft.com/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$. + +After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. ## Related topics -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) - -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) - -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) - +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
              +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
              +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
              +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
              +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
              [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md index 238fd0d31e..5c8972471b 100644 --- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -21,115 +21,144 @@ ms.topic: article **Applies to** - Windows 10 -This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). You will prepare for this by creating a MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. You will then configure the deployment share, create a new task sequence, add applications, add drivers, add rules, and configure Active Directory permissions for deployment. +This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). -For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0005. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 standard server, and PC0005 is a blank machine to which you deploy Windows 10. MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. +We will prepare for this by creating an MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. We will configure Active Directory permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules. -![figure 1](../images/mdt-07-fig01.png) +For the purposes of this topic, we will use four computers: DC01, MDT01, HV01 and PC0005. -Figure 1. The machines used in this topic. +- DC01 is a domain controller +- MDT01 is a domain member server +- HV01 is a Hyper-V server +- PC0005 is a blank device to which we will deploy Windows 10 + +MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment. + + ![devices](../images/mdt-07-fig01.png) >[!NOTE] ->For important details about the setup for the steps outlined in this article, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - +>For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). -## Step 1: Configure Active Directory permissions +## Step 1: Configure Active Directory permissions + +These steps will show you how to configure an Active Directory account with the permissions required to deploy a Windows 10 machine to the domain using MDT. These steps assume you have The account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. In order for MDT to join machines into the contoso.com domain you need to create an account and configure permissions in Active Directory. + +On **DC01**: + +1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on DC01. This script configures permissions to allow the MDT_JD account to manage computer accounts in the contoso > Computers organizational unit. +2. Create the MDT_JD service account by running the following command from an elevated Windows PowerShell prompt: + + ```powershell + New-ADUser -Name MDT_JD -UserPrincipalName MDT_JD -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT join domain account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true + ``` + +3. Next, run the Set-OuPermissions script to apply permissions to the **MDT\_JD** service account, enabling it to manage computer accounts in the Contoso / Computers OU. Run the following commands from an elevated Windows PowerShell prompt: -These steps will show you how to configure an Active Directory account with the permissions required to deploy a Windows 10 machine to the domain using MDT. These steps assume you have downloaded the sample [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copied it to C:\\Setup\\Scripts on DC01. The account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. In order for MDT to join machines into the contoso.com domain you need to create an account and configure permissions in Active Directory. -1. On DC01, using Active Directory User and Computers, browse to **contoso.com / Contoso / Service Accounts**. -2. Select the **Service Accounts** organizational unit (OU) and create the MDT\_JD account using the following settings: - 1. Name: MDT\_JD - 2. User logon name: MDT\_JD - 3. Password: P@ssw0rd - 4. User must change password at next logon: Clear - 5. User cannot change password: Select - 6. Password never expires: Select -3. In an elevated Windows PowerShell prompt (run as Administrator), run the following commands and press **Enter** after each command: ```powershell Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force Set-Location C:\Setup\Scripts .\Set-OUPermissions.ps1 -Account MDT_JD -TargetOU "OU=Workstations,OU=Computers,OU=Contoso" ``` -4. The Set-OUPermissions.ps1 script allows the MDT\_JD user account permissions to manage computer accounts in the Contoso / Computers OU. Below you find a list of the permissions being granted: - 1. Scope: This object and all descendant objects - 1. Create Computer objects - 2. Delete Computer objects - 2. Scope: Descendant Computer objects - 1. Read All Properties - 2. Write All Properties - 3. Read Permissions - 4. Modify Permissions - 5. Change Password - 6. Reset Password - 7. Validated write to DNS host name - 8. Validated write to service principal name -## Step 2: Set up the MDT production deployment share +The following is a list of the permissions being granted: + a. Scope: This object and all descendant objects + b. Create Computer objects + c. Delete Computer objects + d. Scope: Descendant Computer objects + e. Read All Properties + f. Write All Properties + g. Read Permissions + h. Modify Permissions + i. Change Password + j. Reset Password + k. Validated write to DNS host name + l. Validated write to service principal name -When you are ready to deploy Windows 10 in a production environment, you will first create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. For guidance on creating a custom Windows 10 image, see -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md). +## Step 2: Set up the MDT production deployment share + +Next, create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. Perform this procedure on the MDT01 server. ### Create the MDT production deployment share +On **MDT01**: + The steps for creating the deployment share for production are the same as when you created the deployment share for creating the custom reference image: -1. On MDT01, log on as Administrator in the CONTOSO domain using a password of P@ssw0rd. -2. Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. -3. On the **Path** page, in the **Deployment share path** text box, type **E:\\MDTProduction** and click **Next**. + +1. Ensure you are signed on as: contoso\administrator. +2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. +3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. 4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. 5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. 6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. 7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. -## Step 3: Add a custom image +### Configure permissions for the production deployment share + +To read files in the deployment share, you need to assign NTFS and SMB permissions to the MDT Build Account (MDT\_BA) for the **D:\\MDTProduction** folder + +On **MDT01**: + +1. Ensure you are signed in as **contoso\\administrator**. +2. Modify the NTFS permissions for the **D:\\MDTProduction** folder by running the following command in an elevated Windows PowerShell prompt: + + ``` powershell + icacls "D:\MDTProduction" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' + grant-smbshareaccess -Name MDTProduction$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force + ``` + +## Step 3: Add a custom image The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 10. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components. ### Add the Windows 10 Enterprise x64 RTM custom image -In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image in the E:\\MDTBuildLab\\Captures folder on MDT01. +In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on MDT01. + 1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**. 2. Right-click the **Windows 10** folder and select **Import Operating System**. 3. On the **OS Type** page, select **Custom image file** and click **Next**. -4. On the **Image** page, in the **Source file** text box, browse to **E:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**. -5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **E:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**. +4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**. +5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**. 6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**. -7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to match the following: **Windows 10 Enterprise x64 RTM Custom Image**. +7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**. >[!NOTE] >The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image. -![figure 2](../images/fig2-importedos.png) +![imported OS](../images/fig2-importedos.png) -Figure 2. The imported operating system after renaming it. +## Step 4: Add an application -## Step 4: Add an application +When you configure your MDT Build Lab deployment share, you can also add applications to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the MDT Production deployment share using Adobe Reader as an example. -When you configure your MDT Build Lab deployment share, you will also add any applications to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the MDT Production deployment share using Adobe Reader as an example. +### Create the install: Adobe Reader DC -### Create the install: Adobe Reader XI x86 +On **MDT01**: -In this example, we assume that you have downloaded the Adobe Reader XI installation file (AdbeRdr11000\_eu\_ES.msi) to E:\\Setup\\Adobe Reader on MDT01. -1. Using the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node. -2. Right-click the **Applications** node, and create a new folder named **Adobe**. -3. In the **Applications** node, right-click the **Adobe** folder and select **New Application**. -4. On the **Application Type** page, select the **Application with source files** option and click **Next**. -5. On the **Details** page, in the **Application** name text box, type **Install - Adobe Reader XI - x86** and click **Next**. -6. On the **Source** page, in the **Source Directory** text box, browse to **E:\\Setup\\Adobe Reader XI** and click **Next**. -7. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader XI - x86** and click **Next**. -8. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AdbeRdr11000\_eu\_ES.msi /q**, click **Next** twice, and then click **Finish**. +1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC1902120058_en_US.exe) to **D:\\setup\\adobe** on MDT01. +2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC1902120058_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne). +3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node. +4. Right-click the **Applications** node, and create a new folder named **Adobe**. +5. In the **Applications** node, right-click the **Adobe** folder and select **New Application**. +6. On the **Application Type** page, select the **Application with source files** option and click **Next**. +7. On the **Details** page, in the **Application Name** text box, type **Install - Adobe Reader** and click *Next**. +8. On the **Source** page, in the **Source Directory** text box, browse to **D:\\setup\\adobe\\install** and click **Next**. +9. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader** and click **Next**. +10. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AcroRead.msi /q**, click **Next** twice, and then click **Finish**. -![figure 3](../images/mdt-07-fig03.png) +![acroread](../images/acroread.png) -Figure 3. The Adobe Reader application added to the Deployment Workbench. +The Adobe Reader application added to the Deployment Workbench. -## Step 5: Prepare the drivers repository +## Step 5: Prepare the drivers repository In order to deploy Windows 10 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples: - Lenovo ThinkPad T420 -- Dell Latitude E6440 +- Dell Latitude 7390 - HP EliteBook 8560w - Microsoft Surface Pro + For boot images, you need to have storage and network drivers; for the operating system, you need to have the full suite of drivers. >[!NOTE] @@ -139,23 +168,28 @@ For boot images, you need to have storage and network drivers; for the operating The key to successful management of drivers for MDT, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use. -1. On MDT01, using File Explorer, create the **E:\\Drivers** folder. -2. In the **E:\\Drivers** folder, create the following folder structure: +On **MDT01**: + +> [!IMPORTANT] +> In the steps below, it is critical that the folder names used for various computer makes and models exactly match the results of **wmic computersystem get model,manufacturer** on the target system. + +1. Using File Explorer, create the **D:\\drivers** folder. +2. In the **D:\\drivers** folder, create the following folder structure: 1. WinPE x86 2. WinPE x64 3. Windows 10 x64 3. In the new Windows 10 x64 folder, create the following folder structure: - - Dell - - Latitude E6440 - - HP + - Dell Inc + - Latitude E7450 + - Hewlett-Packard - HP EliteBook 8560w - Lenovo - - ThinkPad T420 (4178) + - ThinkStation P500 (30A6003TUS) - Microsoft Corporation - - Surface Pro 3 + - Surface Laptop ->[!NOTE] ->Even if you are not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use. +> [!NOTE] +> Even if you are not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use. ### Create the logical driver structure in MDT @@ -166,16 +200,16 @@ When you import drivers to the MDT driver repository, MDT creates a single insta 2. WinPE x64 3. Windows 10 x64 3. In the **Windows 10 x64** folder, create the following folder structure: - - Dell Inc. - - Latitude E6440 + - Dell Inc + - Latitude E7450 - Hewlett-Packard - HP EliteBook 8560w - Lenovo - - 4178 + - 30A6003TUS - Microsoft Corporation - - Surface Pro 3 + - Surface Laptop -The preceding folder names are selected because they match the actual make and model values that MDT reads from the machines during deployment. You can find out the model values for your machines via the following command in Windows PowerShell: +The preceding folder names should match the actual make and model values that MDT reads from devices during deployment. You can find out the model values for your machines by using the following command in Windows PowerShell: ``` powershell Get-WmiObject -Class:Win32_ComputerSystem @@ -188,87 +222,104 @@ wmic csproduct get name If you want a more standardized naming convention, try the ModelAliasExit.vbs script from the Deployment Guys blog post entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](https://go.microsoft.com/fwlink/p/?LinkId=619536). -![figure 4](../images/fig4-oob-drivers.png) +![drivers](../images/fig4-oob-drivers.png) -Figure 4. The Out-of-Box Drivers structure in Deployment Workbench. +The Out-of-Box Drivers structure in the Deployment Workbench. ### Create the selection profiles for boot image drivers By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles. The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice. -1. On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. + +On **MDT01**: + +1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. 2. In the New Selection Profile Wizard, create a selection profile with the following settings: 1. Selection Profile name: WinPE x86 2. Folders: Select the WinPE x86 folder in Out-of-Box Drivers. -3. Again, right-click the **Selection Profiles** node, and select **New Selection Profile**. + 3. Click **Next**, **Next** and **Finish**. +3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**. 4. In the New Selection Profile Wizard, create a selection profile with the following settings: 1. Selection Profile name: WinPE x64 2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers. + 3. Click **Next**, **Next** and **Finish**. ![figure 5](../images/fig5-selectprofile.png) -Figure 5. Creating the WinPE x64 selection profile. +Creating the WinPE x64 selection profile. ### Extract and import drivers for the x64 boot image Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image. -In these steps, we assume you have downloaded PROWinx64.exe from Intel.com and saved it to a temporary folder. -1. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. -2. Using File Explorer, create the **E:\\Drivers\\WinPE x64\\Intel PRO1000** folder. -3. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **E:\\Drivers\\WinPE x64\\Intel PRO1000** folder. -4. Using Deployment Workbench, expand the **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**. Use the following setting for the Import Drivers Wizard: - - Driver source directory: **E:\\Drivers\\WinPE x64\\Intel PRO1000** +On **MDT01**: + +1. Download **PROWinx64.exe** from Intel.com (ex: [PROWinx64.exe](https://downloadcenter.intel.com/downloads/eula/25016/Intel-Network-Adapter-Driver-for-Windows-10?httpDown=https%3A%2F%2Fdownloadmirror.intel.com%2F25016%2Feng%2FPROWinx64.exe)). +2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. + a. **Note**: Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates. +3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. +4. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. +5. In the Deployment Workbench, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**, and use the following Driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**. ### Download, extract, and import drivers -### For the ThinkPad T420 +### For the Lenovo ThinkStation P500 -For the Lenovo T420 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo T420 model has the 4178B9G model name, meaning the Machine Type is 4178. +For the ThinkStation P500 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6. -To get the updates, you download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can download the drivers from the [Lenovo website](https://go.microsoft.com/fwlink/p/?LinkId=619543). +![ThinkStation](../images/thinkstation.png) -In these steps, we assume you have downloaded and extracted the drivers using ThinkVantage Update Retriever v5.0 to the E:\\Drivers\\Lenovo\\ThinkPad T420 (4178) folder. +To get the updates, download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can also download the drivers by searching PC Support on the [Lenovo website](https://go.microsoft.com/fwlink/p/?LinkId=619543). -1. On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Lenovo** node. -2. Right-click the **4178** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - - Driver source directory: **E:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkPad T420 (4178)** +In this example, we assume you have downloaded and extracted the drivers using ThinkVantage Update Retriever to the **D:\\Drivers\\Lenovo\\ThinkStation P500 (30A6003TUS)** directory. -### For the Latitude E6440 +On **MDT01**: -For the Dell Latitude E6440 model, you use the Dell Driver CAB file, which is accessible via the [Dell TechCenter website](https://go.microsoft.com/fwlink/p/?LinkId=619544). +1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Lenovo** node. +2. Right-click the **30A6003TUS** folder and select **Import Drivers** and use the following Driver source directory to import drivers: **D:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkStation P500 (30A6003TUS)** -In these steps, we assume you have downloaded and extracted the CAB file for the Latitude E6440 model to the E:\\Drivers\\Dell\\Latitude E6440 folder. +The folder you select and all sub-folders will be checked for drivers, expanding any .cab files that are present and searching for drivers. -1. On **MDT01**, using the **Deployment Workbench**, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Dell** node. -2. Right-click the **Latitude E6440** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - - Driver source directory: **E:\\Drivers\\Windows 10 x64\\Dell\\Latitude E6440** +### For the Latitude E7450 + +For the Dell Latitude E7450 model, you use the Dell Driver CAB file, which is accessible via the [Dell TechCenter website](https://go.microsoft.com/fwlink/p/?LinkId=619544). + +In these steps, we assume you have downloaded and extracted the CAB file for the Latitude E7450 model to the **D:\\Drivers\\Dell Inc\\Latitude E7450** folder. + +On **MDT01**: + +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Dell Inc** node. +2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers: **D:\\Drivers\\Windows 10 x64\\Dell Inc\\Latitude E7450** ### For the HP EliteBook 8560w For the HP EliteBook 8560w, you use HP SoftPaq Download Manager to get the drivers. The HP SoftPaq Download Manager can be accessed on the [HP Support site](https://go.microsoft.com/fwlink/p/?LinkId=619545). -In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the E:\\Drivers\\Windows 10 x64\\HP\\HP EliteBook 8560w folder. +In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** folder. -1. On **MDT01**, using the **Deployment Workbench**, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Hewlett-Packard** node. -2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - - Driver source directory: **E:\\Drivers\\Windows 10 x64\\HP\\HP EliteBook 8560w** +On **MDT01**: -### For the Microsoft Surface Pro 3 +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Hewlett-Packard** node. +2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers** and use the following Driver source directory to import drivers: **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** -For the Microsoft Surface Pro model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Pro 3 drivers to the E:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Pro 3 folder. +### For the Microsoft Surface Laptop -1. On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Microsoft** node. -2. Right-click the **Surface Pro 3** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - - Driver source directory: **E:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Pro 3** +For the Microsoft Surface Laptop model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Laptop drivers to the **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** folder. -## Step 6: Create the deployment task sequence +On **MDT01**: -This section will show you how to create the task sequence used to deploy your production Windows 10 reference image. You will then configure the tasks sequence to enable patching via a Windows Server Update Services (WSUS) server. +1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Microsoft** node. +2. Right-click the **Surface Laptop** folder and select **Import Drivers**; and use the following Driver source directory to import drivers: **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** + +## Step 6: Create the deployment task sequence + +This section will show you how to create the task sequence used to deploy your production Windows 10 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server. ### Create a task sequence for Windows 10 Enterprise -1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. +On **MDT01**: + +1. In the Deployment Workbench, under the **MDT Production** node, right-click **Task Sequences**, and create a folder named **Windows 10**. 2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: 1. Task sequence ID: W10-X64-001 2. Task sequence name: Windows 10 Enterprise x64 RTM Custom Image @@ -278,13 +329,14 @@ This section will show you how to create the task sequence used to deploy your p 6. Specify Product Key: Do not specify a product key at this time 7. Full Name: Contoso 8. Organization: Contoso - 9. Internet Explorer home page: about:blank + 9. Internet Explorer home page: https://www.contoso.com 10. Admin Password: Do not specify an Administrator Password at this time - ### Edit the Windows 10 task sequence -3. Right-click the **Windows 10 Enterprise x64 RTM Custom Image** task sequence, and select **Properties**. -4. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings: - 1. Preinstall. After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: +### Edit the Windows 10 task sequence + +1. Continuing from the previous procedure, right-click the **Windows 10 Enterprise x64 RTM Custom Image** task sequence, and select **Properties**. +2. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings: + 1. Preinstall: After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: 1. Name: Set DriverGroup001 2. Task Sequence Variable: DriverGroup001 3. Value: Windows 10 x64\\%Make%\\%Model% @@ -297,89 +349,93 @@ This section will show you how to create the task sequence used to deploy your p 3. State Restore. Enable the **Windows Update (Pre-Application Installation)** action. 4. State Restore. Enable the **Windows Update (Post-Application Installation)** action. -5. Click **OK**. +3. Click **OK**. -![figure 6](../images/fig6-taskseq.png) +![drivergroup](../images/fig6-taskseq.png) -Figure 6. The task sequence for production deployment. +The task sequence for production deployment. -## Step 7: Configure the MDT production deployment share +## Step 7: Configure the MDT production deployment share In this section, you will learn how to configure the MDT Build Lab deployment share with the rules required to create a simple and dynamic deployment process. This includes configuring commonly used rules and an explanation of how these rules work. ### Configure the rules -1. On MDT01, using File Explorer, copy the following files from the **D:\\Setup\\Sample Files\\MDT Production\\Control** folder to **E:\\MDTProduction\\Control**. Overwrite the existing files. - 1. Bootstrap.ini - 2. CustomSettings.ini -2. Right-click the **MDT Production** deployment share and select **Properties**. -3. Select the **Rules** tab and modify using the following information: +On **MDT01**: - ``` - [Settings] - Priority=Default - [Default] - _SMSTSORGNAME=Contoso - OSInstall=YES - UserDataLocation=AUTO - TimeZoneName=Pacific Standard Time - AdminPassword=P@ssw0rd - JoinDomain=contoso.com - DomainAdmin=CONTOSO\MDT_JD - DomainAdminPassword=P@ssw0rd - MachineObjectOU=OU=Workstations,OU=Computers,OU=Contoso,DC=contoso,DC=com - SLShare=\\MDT01\Logs$ - ScanStateArgs=/ue:*\* /ui:CONTOSO\* - USMTMigFiles001=MigApp.xml - USMTMigFiles002=MigUser.xml - HideShell=YES - ApplyGPOPack=NO - WSUSServer=mdt01.contoso.com:8530 - SkipAppsOnUpgrade=NO - SkipAdminPassword=YES - SkipProductKey=YES - SkipComputerName=NO - SkipDomainMembership=YES - SkipUserData=YES - SkipLocaleSelection=YES - SkipTaskSequence=NO - SkipTimeZone=YES - SkipApplications=NO - SkipBitLocker=YES - SkipSummary=YES - SkipCapture=YES - SkipFinalSummary=NO - ``` -4. Click **Edit Bootstrap.ini** and modify using the following information: +1. Right-click the **MDT Production** deployment share and select **Properties**. +2. Select the **Rules** tab and replace the existing rules with the following information (modify the domain name, WSUS server, and administrative credentials to match your environment): - ``` - [Settings] - Priority=Default - [Default] - DeployRoot=\\MDT01\MDTProduction$ - UserDomain=CONTOSO - UserID=MDT_BA - SkipBDDWelcome=YES - ``` -5. In the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. -6. In the **General** sub tab, configure the following settings: + ``` + [Settings] + Priority=Default + + [Default] + _SMSTSORGNAME=Contoso + OSInstall=YES + UserDataLocation=AUTO + TimeZoneName=Pacific Standard Time + AdminPassword=pass@word1 + JoinDomain=contoso.com + DomainAdmin=CONTOSO\MDT_JD + DomainAdminPassword=pass@word1 + MachineObjectOU=OU=Workstations,OU=Computers,OU=Contoso,DC=contoso,DC=com + SLShare=\\MDT01\Logs$ + ScanStateArgs=/ue:*\* /ui:CONTOSO\* + USMTMigFiles001=MigApp.xml + USMTMigFiles002=MigUser.xml + HideShell=YES + ApplyGPOPack=NO + WSUSServer=mdt01.contoso.com:8530 + SkipAppsOnUpgrade=NO + SkipAdminPassword=YES + SkipProductKey=YES + SkipComputerName=NO + SkipDomainMembership=YES + SkipUserData=YES + SkipLocaleSelection=YES + SkipTaskSequence=NO + SkipTimeZone=YES + SkipApplications=NO + SkipBitLocker=YES + SkipSummary=YES + SkipCapture=YES + SkipFinalSummary=NO + ``` + +3. Click **Edit Bootstrap.ini** and modify using the following information: + +``` +[Settings] +Priority=Default + +[Default] +DeployRoot=\\MDT01\MDTProduction$ +UserDomain=CONTOSO +UserID=MDT_BA +UserPassword=pass@word1 +SkipBDDWelcome=YES +``` + +4. On the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. +5. On the **General** sub tab (still under the main Windows PE tab), configure the following settings: - In the **Lite Touch Boot Image Settings** area: 1. Image description: MDT Production x86 2. ISO file name: MDT Production x86.iso > [!NOTE] > - > Because you are going to use Pre-Boot Execution Environment (PXE) later to deploy the machines, you do not need the ISO file; however, we recommend creating ISO files because they are useful when troubleshooting deployments and for quick tests. + >Because you are going to use Pre-Boot Execution Environment (PXE) later to deploy the machines, you do not need the ISO file; however, we recommend creating ISO files because they are useful when troubleshooting deployments and for quick tests. -7. In the **Drivers and Patches** sub tab, select the **WinPE x86** selection profile and select the **Include all drivers from the selection profile** option. -8. In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. -9. In the **General** sub tab, configure the following settings: +6. On the **Drivers and Patches** sub tab, select the **WinPE x86** selection profile and select the **Include all drivers from the selection profile** option. +7. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. +8. On the **General** sub tab, configure the following settings: - In the **Lite Touch Boot Image Settings** area: 1. Image description: MDT Production x64 2. ISO file name: MDT Production x64.iso -10. In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. -11. In the **Monitoring** tab, select the **Enable monitoring for this deployment share** check box. -12. Click **OK**. +9. In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. +10. In the **Monitoring** tab, select the **Enable monitoring for this deployment share** check box. +11. Click **OK**. >[!NOTE] >It will take a while for the Deployment Workbench to create the monitoring database and web service. @@ -387,39 +443,46 @@ In this section, you will learn how to configure the MDT Build Lab deployment sh ![figure 8](../images/mdt-07-fig08.png) -Figure 7. The Windows PE tab for the x64 boot image. +The Windows PE tab for the x64 boot image. ### The rules explained -The rules for the MDT Production deployment share are somewhat different from those for the MDT Build Lab deployment share. The biggest differences are that you deploy the machines into a domain instead of a workgroup and that you do not automate the logon. +The rules for the MDT Production deployment share are somewhat different from those for the MDT Build Lab deployment share. The biggest differences are that you deploy the machines into a domain instead of a workgroup. + +> +>You can optionally remove the **UserID** and **UserPassword** entries from Bootstrap.ini so that users performing PXE boot are prompted to provide credentials with permission to connect to the deployment share. Setting **SkipBDDWelcome=NO** enables the welcome screen that displays options to run the deployment wizard, run DaRT tools (if installed), exit to a Windows PE command prompt, set the keyboard layout, or configure a static IP address. In this example we are skipping the welcome screen and providing credentials. ### The Bootstrap.ini file -This is the MDT Production Bootstrap.ini without the user credentials (except domain information): +This is the MDT Production Bootstrap.ini: ``` [Settings] Priority=Default + [Default] DeployRoot=\\MDT01\MDTProduction$ UserDomain=CONTOSO UserID=MDT_BA +UserPassword=pass@word1 SkipBDDWelcome=YES ``` + ### The CustomSettings.ini file This is the CustomSettings.ini file with the new join domain information: ``` [Settings] Priority=Default + [Default] _SMSTSORGNAME=Contoso OSInstall=Y UserDataLocation=AUTO TimeZoneName=Pacific Standard Time -AdminPassword=P@ssw0rd +AdminPassword=pass@word1 JoinDomain=contoso.com DomainAdmin=CONTOSO\MDT_JD -DomainAdminPassword=P@ssw0rd +DomainAdminPassword=pass@word1 MachineObjectOU=OU=Workstations,OU=Computers,OU=Contoso,DC=contoso,DC=com SLShare=\\MDT01\Logs$ ScanStateArgs=/ue:*\* /ui:CONTOSO\* @@ -444,7 +507,8 @@ SkipCapture=YES SkipFinalSummary=NO EventService=http://MDT01:9800 ``` -The additional properties to use in the MDT Production rules file are as follows: + +Some properties to use in the MDT Production rules file are as follows: - **JoinDomain.** The domain to join. - **DomainAdmin.** The account to use when joining the machine to the domain. - **DomainAdminDomain.** The domain for the join domain account. @@ -456,33 +520,35 @@ The additional properties to use in the MDT Production rules file are as follows ### Optional deployment share configuration -If your organization has a Microsoft Software Assurance agreement, you also can subscribe to the additional Microsoft Desktop Optimization Package (MDOP) license (at an additional cost). Included in MDOP is Microsoft Diagnostics and Recovery Toolkit (DaRT), which contains tools that can help you -troubleshoot MDT deployments, as well as troubleshoot Windows itself. +If your organization has a Microsoft Software Assurance agreement, you also can subscribe to the additional Microsoft Desktop Optimization Package (MDOP) license (at an additional cost). Included in MDOP is Microsoft Diagnostics and Recovery Toolkit (DaRT), which contains tools that can help you troubleshoot MDT deployments, as well as troubleshoot Windows itself. ### Add DaRT 10 to the boot images -If you have licensing for MDOP and DaRT, you can add DaRT to the boot images using the steps in this section. If you do not have DaRT licensing, or don't want to use it, simply skip to the next section, [Update the Deployment Share](#bkmk-update-deployment). To enable the remote connection feature in MDT, you need to do the following: -- Install DaRT 10 (part of MDOP 2015 R1). -- Copy the two tools CAB files (Toolsx86.cab and Toolsx64.cab) to the deployment share. -- Configure the deployment share to add DaRT. - In these steps, we assume that you downloaded MDOP 2015 R1 and copied DaRT 10 to the E:\\Setup\\DaRT 10 folder on MDT01. -- On MDT01, install DaRT 10 (MSDaRT10.msi) using the default settings. -- Using File Explorer, navigate to the **C:\\Program Files\\Microsoft DaRT\\v10** folder. -- Copy the Toolsx64.cab file to **E:\\MDTProduction\\Tools\\x64**. -- Copy the Toolsx86.cab file to **E:\\MDTProduction\\Tools\\x86**. -- Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**. -- In the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. -- In the **Features** sub tab, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. +If you have licensing for MDOP and DaRT, you can add DaRT to the boot images using the steps in this section. If you do not have DaRT licensing, or don't want to use it, simply skip to the next section, [Update the Deployment Share](#update-the-deployment-share). To enable the remote connection feature in MDT, you need to do the following: - ![figure 8](../images/mdt-07-fig09.png) +>DaRT 10 is part of [MDOP 2015](https://docs.microsoft.com/microsoft-desktop-optimization-pack/#how-to-get-mdop). Note: MDOP might be available as a download from your [Visual Studio subscription](https://my.visualstudio.com/Downloads). When searching, be sure to look for **Desktop Optimization Pack**. - Figure 8. Selecting the DaRT 10 feature in the deployment share. +On **MDT01**: + +1. Download MDOP 2015 and copy the DaRT 10 installer file to the D:\\Setup\\DaRT 10 folder on MDT01 (DaRT\\DaRT 10\\Installers\\\\\x64\\MSDaRT100.msi). +2. Install DaRT 10 (MSDaRT10.msi) using the default settings. + + ![DaRT](../images/dart.png) + +2. Copy the two tools CAB files from **C:\\Program Files\\Microsoft DaRT\\v10** (**Toolsx86.cab** and **Toolsx64.cab**) to the production deployment share at **D:\\MDTProduction\\Tools\\x86** and **D:\\MDTProduction\\Tools\\x64**, respectively. +3. In the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**. +4. On the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. +5. On the **Features** sub tab, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** checkbox. + + ![DaRT selection](../images/mdt-07-fig09.png) + + Selecting the DaRT 10 feature in the deployment share. 8. In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. 9. In the **Features** sub tab, in addition to the default selected feature pack, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. 10. Click **OK**. -### Update the deployment share +### Update the deployment share Like the MDT Build Lab deployment share, the MDT Production deployment share needs to be updated after it has been configured. This is the process during which the Windows PE boot images are created. 1. Right-click the **MDT Production** deployment share and select **Update Deployment Share**. @@ -490,57 +556,75 @@ Like the MDT Build Lab deployment share, the MDT Production deployment share nee >[!NOTE] >The update process will take 5 to 10 minutes. - -## Step 8: Deploy the Windows 10 client image + +## Step 8: Deploy the Windows 10 client image These steps will walk you through the process of using task sequences to deploy Windows 10 images through a fully automated process. First, you need to add the boot image to Windows Deployment Services (WDS) and then start the deployment. In contrast with deploying images from the MDT Build Lab deployment share, we recommend using the Pre-Installation Execution Environment (PXE) to start the full deployments in the datacenter, even though you technically can use an ISO/CD or USB to start the process. ### Configure Windows Deployment Services -You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. For the following steps, we assume that Windows Deployment Services has already been installed on MDT01. -1. Using the WDS console, right-click **Boot Images** and select **Add Boot Image**. -2. Browse to the E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim file and add the image with the default settings. +You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. In this procedure, we assume that WDS is already installed and initialized on MDT01 as described in the [Prepare for Windows deployment](prepare-for-windows-deployment-with-mdt.md#install-and-initialize-windows-deployment-services-wds) article. + +On **MDT01**: + +1. Open the Windows Deployment Services console, expand the **Servers** node and then expand **MDT01.contoso.com**. +2. Right-click **Boot Images** and select **Add Boot Image**. +3. Browse to the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** file and add the image with the default settings. ![figure 9](../images/mdt-07-fig10.png) -Figure 9. The boot image added to the WDS console. +The boot image added to the WDS console. ### Deploy the Windows 10 client At this point, you should have a solution ready for deploying the Windows 10 client. We recommend starting by trying a few deployments at a time until you are confident that your configuration works as expected. We find it useful to try some initial tests on virtual machines before testing on physical hardware. This helps rule out hardware issues when testing or troubleshooting. Here are the steps to deploy your Windows 10 image to a virtual machine: -1. Create a virtual machine with the following settings: - 1. Name: PC0005 - 2. Location: C:\\VMs - 3. Generation: 2 - 4. Memory: 2048 MB - 5. Hard disk: 60 GB (dynamic disk) -2. Start the PC0005 virtual machine, and press **Enter** to start the PXE boot. The machine will now load the Windows PE boot image from the WDS server. + +On **HV01**: + +1. Create a virtual machine with the following settings: + 1. Name: PC0005 + 2. Store the virtual machine in a different location: C:\VM + 3. Generation: 2 + 4. Memory: 2048 MB + 5. Network: Must be able to connect to \\MDT01\MDTProduction$ + 6. Hard disk: 60 GB (dynamic disk) + 7. Installation Options: Install an operating system from a network-based installation server +2. Start the PC0005 virtual machine, and press **Enter** to start the PXE boot. The VM will now load the Windows PE boot image from the WDS server. ![figure 10](../images/mdt-07-fig11.png) - Figure 10. The initial PXE boot process of PC0005. + The initial PXE boot process of PC0005. 3. After Windows PE has booted, complete the Windows Deployment Wizard using the following setting: - 1. Password: P@ssw0rd - 2. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image - 3. Computer Name: PC0005 - 4. Applications: Select the Install - Adobe Reader XI - x86 application. -4. The setup now starts and does the following: + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + 2. Computer Name: **PC0005** + 3. Applications: Select the **Install - Adobe Reader** checkbox. +4. Setup now begins and does the following: 1. Installs the Windows 10 Enterprise operating system. 2. Installs the added application. 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. +![pc0005](../images/pc0005-vm.png) + +### Application installation + +Following OS installation, Microsoft Office 365 Pro Plus - x64 is installed automatically. + + ![pc0005](../images/pc0005-vm-office.png) + ### Use the MDT monitoring feature -Now that you have enabled the monitoring on the MDT Production deployment share, you can follow your deployment of PC0005 via the monitoring node. +Since you have enabled the monitoring on the MDT Production deployment share, you can follow your deployment of PC0005 via the monitoring node. -1. On MDT01, using Deployment Workbench, expand the **MDT Production** deployment share folder. +On **MDT01**: + +1. In the Deployment Workbench, expand the **MDT Production** deployment share folder. 2. Select the **Monitoring** node, and wait until you see PC0005. 3. Double-click PC0005, and review the information. ![figure 11](../images/mdt-07-fig13.png) -Figure 11. The Monitoring node, showing the deployment progress of PC0005. +The Monitoring node, showing the deployment progress of PC0005. ### Use information in the Event Viewer @@ -548,11 +632,11 @@ When monitoring is enabled, MDT also writes information to the event viewer on M ![figure 12](../images/mdt-07-fig14.png) -Figure 12. The Event Viewer showing a successful deployment of PC0005. +The Event Viewer showing a successful deployment of PC0005. -## Multicast deployments +## Multicast deployments -Multicast deployment allows for image deployment with reduced network load during simultaneous deployments. Multicast is a useful operating system deployment feature in MDT deployments, however it is important to ensure that your network supports it and is designed for it. +Multicast deployment allows for image deployment with reduced network load during simultaneous deployments. Multicast is a useful operating system deployment feature in MDT deployments, however it is important to ensure that your network supports it and is designed for it. If you have a limited number of simultaneous deployments, you probably do not need to enable multicast. ### Requirements @@ -563,25 +647,30 @@ Internet Group Management Protocol (IGMP) snooping is turned on and that the net Setting up MDT for multicast is straightforward. You enable multicast on the deployment share, and MDT takes care of the rest. -1. On MDT01, right-click the **MDT Production** deployment share folder and select **Properties**. -2. In the **General** tab, select the **Enable multicast for this deployment share (requires Windows Server 2008 R2 Windows Deployment Services)** check box, and click **OK**. +On **MDT01**: + +1. In the Deployment Workbench, right-click the **MDT Production** deployment share folder and select **Properties**. +2. On the **General** tab, select the **Enable multicast for this deployment share (requires Windows Server 2008 R2 Windows Deployment Services)** check box, and click **OK**. 3. Right-click the **MDT Production** deployment share folder and select **Update Deployment Share**. 4. After updating the deployment share, use the Windows Deployment Services console to, verify that the multicast namespace was created. ![figure 13](../images/mdt-07-fig15.png) -Figure 13. The newly created multicast namespace. +The newly created multicast namespace. -## Use offline media to deploy Windows 10 +## Use offline media to deploy Windows 10 -In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 10. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - by the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment. +In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 10. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - through the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment. Offline media are useful not only when you do not have network connectivity to the deployment share, but also when you have limited connection to the deployment share and do not want to copy 5 GB of data over the wire. Offline media can still join the domain, but you save the transfer of operating system images, drivers, and applications over the wire. ### Create the offline media selection profile To filter what is being added to the media, you create a selection profile. When creating selection profiles, you quickly realize the benefits of having created a good logical folder structure in the Deployment Workbench. -1. On MDT01, using Deployment Workbench, in the **MDT Production / Advanced Configuration** node, right-click **Selection Profile**, and select **New Selection Profile**. + +On **MDT01**: + +1. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click **Selection Profiles**, and select **New Selection Profile**. 2. Use the following settings for the New Selection Profile Wizard: 1. General Settings - Selection profile name: Windows 10 Offline Media @@ -592,48 +681,58 @@ To filter what is being added to the media, you create a selection profile. When 4. Out-Of-Box Drivers / Windows 10 x64 5. Task Sequences / Windows 10 + ![offline media](../images/mdt-offline-media.png) + ### Create the offline media In these steps, you generate offline media from the MDT Production deployment share. To filter what is being added to the media, you use the previously created selection profile. -1. On MDT01, using File Explorer, create the **E:\\MDTOfflineMedia** folder. +1. On MDT01, using File Explorer, create the **D:\\MDTOfflineMedia** folder. - >[!NOTE] - >When creating offline media, you need to create the target folder first. It is crucial that you do not create a subfolder inside the deployment share folder because it will break the offline media. + >[!NOTE] + >When creating offline media, you need to create the target folder first. It is crucial that you do not create a subfolder inside the deployment share folder because it will break the offline media. -2. Using Deployment Workbench, in the **MDT Production / Advanced Configuration** node, right-click the **Media** node, and select **New Media**. +2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click the **Media** node, and select **New Media**. 3. Use the following settings for the New Media Wizard: - General Settings - 1. Media path: **E:\\MDTOfflineMedia** - 2. Selection profile: Windows 10 Offline Media + 1. Media path: **D:\\MDTOfflineMedia** + 2. Selection profile: **Windows 10 Offline Media** ### Configure the offline media Offline media has its own rules, its own Bootstrap.ini and CustomSettings.ini files. These files are stored in the Control folder of the offline media; they also can be accessed via properties of the offline media in the Deployment Workbench. -1. On MDT01, using File Explorer, copy the CustomSettings.ini file from the **E:\MDTProduction\Control** folder to **E:\\MDTOfflineMedia\\Content\\Deploy\\Control**. Overwrite the existing files. -2. Using Deployment Workbench, in the **MDT Production / Advanced Configuration / Media** node, right-click the **MEDIA001** media, and select **Properties**. +On **MDT01**: + +1. Copy the CustomSettings.ini file from the **D:\MDTProduction\Control** folder to **D:\\MDTOfflineMedia\\Content\\Deploy\\Control**. Overwrite the existing files. +2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration / Media** node, right-click the **MEDIA001** media, and select **Properties**. 3. In the **General** tab, configure the following: 1. Clear the Generate x86 boot image check box. 2. ISO file name: Windows 10 Offline Media.iso -4. Still in the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. -5. In the **General** sub tab, configure the following settings: +4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. +5. On the **General** sub tab, configure the following settings: 1. In the **Lite Touch Boot Image Settings** area: - Image description: MDT Production x64 2. In the **Windows PE Customizations** area, set the Scratch space size to 128. -6. In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. +6. On the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. 7. Click **OK**. ### Generate the offline media -You have now configured the offline media deployment share however the share has not yet been populated with the files required for deployment. Now everything is ready you populate the deployment share content folder and generate the offline media ISO. +You have now configured the offline media deployment share, however the share has not yet been populated with the files required for deployment. Now everything is ready you populate the deployment share content folder and generate the offline media ISO. -1. On MDT01, using Deployment Workbench, navigate to the **MDT Production / Advanced Configuration / Media** node. -2. Right-click the **MEDIA001** media, and select **Update Media Content**. The Update Media Content process now generates the offline media in the **E:\\MDTOfflineMedia\\Content** folder. +On **MDT01**: + +1. In the Deployment Workbench, navigate to the **MDT Production / Advanced Configuration / Media** node. +2. Right-click the **MEDIA001** media, and select **Update Media Content**. The Update Media Content process now generates the offline media in the **D:\\MDTOfflineMedia\\Content** folder. The process might require several minutes. ### Create a bootable USB stick The ISO that you got when updating the offline media item can be burned to a DVD and used directly (it will be bootable), but it is often more efficient to use USB sticks instead since they are faster and can hold more data. (A dual-layer DVD is limited to 8.5 GB.) + +>[!TIP] +>In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. This means you must split the .wim file, which can be done using DISM:
               
              Dism /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800.
               
              Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm.
               
              To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (\True\), so this must be changed and the offline media content updated. + Follow these steps to create a bootable USB stick from the offline media content: 1. On a physical machine running Windows 7 or later, insert the USB stick you want to use. @@ -643,24 +742,19 @@ Follow these steps to create a bootable USB stick from the offline media content 5. In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter). 6. In the Diskpart utility, type **active**, and then type **exit**. -## Unified Extensible Firmware Interface (UEFI)-based deployments +## Unified Extensible Firmware Interface (UEFI)-based deployments -As referenced in [Windows 10 deployment tools](https://go.microsoft.com/fwlink/p/?LinkId=619546), Unified Extensible Firmware Interface (UEFI)-based deployments are becoming more common. In fact, when you create a generation 2 virtual machine in Hyper-V, you get a UEFI-based computer. During deployment, MDT automatically detects that you have an UEFI-based machine and creates the partitions UEFI requires. You do not need to update or change your task sequences in any way to accommodate UEFI. +As referenced in [Windows 10 deployment scenarios and tools](https://go.microsoft.com/fwlink/p/?LinkId=619546), Unified Extensible Firmware Interface (UEFI)-based deployments are becoming more common. In fact, when you create a generation 2 virtual machine in Hyper-V, you get a UEFI-based computer. During deployment, MDT automatically detects that you have an UEFI-based machine and creates the partitions UEFI requires. You do not need to update or change your task sequences in any way to accommodate UEFI. ![figure 14](../images/mdt-07-fig16.png) -Figure 14. The partitions when deploying an UEFI-based machine. +The partitions when deploying an UEFI-based machine. ## Related topics -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) - -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) - -[Configure MDT settings](configure-mdt-settings.md) +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
              +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
              +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
              +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
              +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
              +[Configure MDT settings](configure-mdt-settings.md)
              diff --git a/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md deleted file mode 100644 index bc6f898741..0000000000 --- a/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Deploy Windows 10 with the Microsoft Deployment Toolkit (Windows 10) -description: This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). -ms.assetid: 837f009c-617e-4b3f-9028-2246067ee0fb -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, tools, configure, script -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.pagetype: mdt -ms.topic: article ---- - -# Deploy Windows 10 with the Microsoft Deployment Toolkit - -**Applies to** -- Windows 10 - -This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). - -The Microsoft Deployment Toolkit is a unified collection of tools, processes, and guidance for automating desktop and server deployment. In addition to reducing deployment time and standardizing desktop and server images, MDT enables you to more easily manage security and ongoing configurations. MDT builds on top of the core deployment tools in the Windows Assessment and Deployment Kit (Windows ADK) with additional guidance and features designed to reduce the complexity and time required for deployment in an enterprise environment. -MDT supports the deployment of Windows 10, as well as Windows 7, Windows 8, Windows 8.1, and Windows Server 2012 R2. It also includes support for zero-touch installation (ZTI) with Microsoft System Center 2012 R2 Configuration Manager. - -To download the latest version of MDT, visit the [MDT resource page](https://go.microsoft.com/fwlink/p/?LinkId=618117). - -## In this section - -- [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) -- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) -- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) -- [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) -- [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) -- [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) -- [Configure MDT settings](configure-mdt-settings.md) - -## Proof-of-concept environment - -For the purposes of this guide, and the topics discussed herein, we will use the following servers and client machines: DC01, MDT01, CM01, PC0001, and PC0002. - -![figure 1](../images/mdt-01-fig01.png) - -Figure 1. The servers and machines used for examples in this guide. - -DC01 is a domain controller; the other servers and client machines are members of the domain contoso.com for the fictitious Contoso Corporation. - -![figure 2](../images/mdt-01-fig02.jpg) - -Figure 2. The organizational unit (OU) structure used in this guide. - -### Server details - -- **DC01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as Active Directory Domain Controller, DNS Server, and DHCP Server in the contoso.com domain. - - Server name: DC01 - - IP Address: 192.168.1.200 - - Roles: DNS, DHCP, and Domain Controller -- **MDT01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as a member server in the contoso.com domain. - - Server name: MDT01 - - IP Address: 192.168.1.210 -- **CM01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as a member server in the contoso.com domain. - - Server name: CM01 - - IP Address: 192.168.1.214 - -### Client machine details - -- **PC0001.** A Windows 10 Enterprise x64 machine, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This machine is referenced as the admin workstation. - - Client name: PC0001 - - IP Address: DHCP -- **PC0002.** A Windows 7 SP1 Enterprise x64 machine, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This machine is referenced during the migration scenarios. - - Client name: PC0002 - - IP Address: DHCP - -## Sample files - -The information in this guide is designed to help you deploy Windows 10. In order to help you put the information you learn into practice more quickly, we recommend that you download a small set of sample files for the fictitious Contoso Corporation: -- [Gather.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619361). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment. -- [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU. -- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. - -## Related topics - -[Microsoft Deployment Toolkit downloads and resources](https://go.microsoft.com/fwlink/p/?LinkId=618117) - -[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md) - -[Windows 10 deployment tools](../windows-deployment-scenarios-and-tools.md) - -[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) - -[Deploy Windows To Go in your organization](../deploy-windows-to-go.md) - -[Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) - -[Volume Activation for Windows 10](../volume-activation/volume-activation-windows-10.md) - diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md index e7742fa773..00c0a446a3 100644 --- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md @@ -1,54 +1,171 @@ ---- -title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10) -description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), as part of a Windows operating system deployment. -ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, image, feature, install, tools -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Get started with the Microsoft Deployment Toolkit (MDT) - -**Applies to** -- Windows 10 - -This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), as part of a Windows operating system deployment. MDT is one of the most important tools available to IT professionals today. You can use it to create reference images or as a complete deployment solution. MDT also can be used to extend the operating system deployment features available in Microsoft System Center 2012 R2 Configuration Manager. - -In addition to familiarizing you with the features and options available in MDT, this topic will walk you through the process of preparing for deploying Windows 10 using MDT by configuring Active Directory, creating an organizational unit (OU) structure, creating service accounts, configuring log files and folders, and installing the tools needed to view the logs and continue with the deployment process. - -For the purposes of this topic, we will use two machines: DC01 and MDT01. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. MDT01 is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see -[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). - -![figure 1](../images/mdt-05-fig01.png) - -Figure 1. The machines used in this topic. - -## In this section - -- [Key features in MDT](key-features-in-mdt.md) -- [MDT Lite Touch components](mdt-lite-touch-components.md) -- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) - -## Related topics - -[Microsoft Deployment Toolkit downloads and documentation](https://go.microsoft.com/fwlink/p/?LinkId=618117) - -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) - -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) - -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) - -[Configure MDT settings](configure-mdt-settings.md) +--- +title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10) +description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), as part of a Windows operating system deployment. +ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, image, feature, install, tools +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Get started with MDT + +**Applies to** +- Windows 10 + +This article provides an overview of the features, components, and capabilities of the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117). When you have finished reviewing this information, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +## About MDT + +MDT is a unified collection of tools, processes, and guidance for automating desktop and server deployment. You can use it to create reference images or as a complete deployment solution. MDT is one of the most important tools available to IT professionals today. + +In addition to reducing deployment time and standardizing desktop and server images, MDT enables you to more easily manage security and ongoing configurations. MDT builds on top of the core deployment tools in the [Windows Assessment and Deployment Kit](https://docs.microsoft.com/windows-hardware/get-started/adk-install) (Windows ADK) with additional guidance and features designed to reduce the complexity and time required for deployment in an enterprise environment. + +MDT supports the deployment of Windows 10, as well as Windows 7, Windows 8.1, and Windows Server. It also includes support for zero-touch installation (ZTI) with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/). + +## Key features in MDT + +MDT has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it is considered fundamental to Windows operating system and enterprise application deployment. + +MDT has many useful features, such as: +- **Windows Client support.** Supports Windows 7, Windows 8.1, and Windows 10. +- **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. +- **Additional operating systems support.** Supports Windows Thin PC and [Windows Embedded POSReady 7](https://www.microsoft.com/en-us/download/details.aspx?id=26558), as well as Windows 8.1 Embedded Industry. +- **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1. +- **GPT support.** Supports deployment to machines that require the new GPT partition table format. This is related to UEFI. +- **Enhanced Windows PowerShell support.** Provides support for running PowerShell scripts. + + ![figure 2](../images/mdt-05-fig02.png) + + The deployment share mounted as a standard PSDrive allows for administration using PowerShell. + +- **Add local administrator accounts.** Allows you to add multiple user accounts to the local Administrators group on the target computers, either via settings or the deployment wizard. +- **Automated participation in CEIP and WER.** Provides configuration for participation in Windows Customer Experience Improvement Program (CEIP) and Windows Error Reporting (WER). +- **Deploy Windows RE.** Enables deployment of a customized Windows Recovery Environment (Windows RE) as part of the task sequence. +- **Deploy to VHD.** Provides ready-made task sequence templates for deploying Windows into a virtual hard disk (VHD) file. +- **Improved deployment wizard.** Provides additional progress information and a cleaner UI for the Lite Touch Deployment Wizard. +- **Monitoring.** Allows you to see the status of currently running deployments. +- **Apply GPO Pack.** Allows you to deploy local group policy objects created by Microsoft Security Compliance Manager (SCM). +- **Partitioning routines.** Provides improved partitioning routines to ensure that deployments work regardless of the current hard drive structure. +- **Offline BitLocker.** Provides the capability to have BitLocker enabled during the Windows Preinstallation Environment (Windows PE) phase, thus saving hours of encryption time. +- **USMT offline user-state migration.** Provides support for running the User State Migration Tool (USMT) capture offline, during the Windows PE phase of the deployment. + + ![figure 3](../images/mdt-05-fig03.png) + + The offline USMT backup in action. + +- **Install or uninstall Windows roles or features.** Enables you to select roles and features as part of the deployment wizard. MDT also supports uninstall of roles and features. +- **Microsoft System Center Orchestrator integration.** Provides the capability to use Orchestrator runbooks as part of the task sequence. +- **Support for DaRT.** Supports optional integration of the DaRT components into the boot image. +- **Support for Microsoft Office.** Provides added support for deploying Microsoft Office. +- **Support for Modern UI app package provisioning.** Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later. +- **Extensibility.** Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts. +- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](https://go.microsoft.com/fwlink/p/?LinkId=618117). + +## MDT Lite Touch components + +Many features in MDT support Lite Touch Installation (LTI) for Windows 10. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc. + +When deploying the Windows operating system using MDT, most of the administration and configuration is done through the Deployment Workbench, but you also can perform many of the tasks using Windows PowerShell. The easiest way to find out how to use PowerShell in MDT is to use the Deployment Workbench to perform an operation and at the end of that task, click View Script. That will give you the PowerShell command. + +![figure 4](../images/mdt-05-fig04.png) + +If you click **View Script** on the right side, you will get the PowerShell code that was used to perform the task. + +## Deployment shares + +A deployment share is essentially a folder on the server that is shared and contains all the setup files and scripts needed for the deployment solution. It also holds the configuration files (called rules) that are gathered when a machine is deployed. These configuration files can reach out to other sources, like a database, external script, or web server to get additional settings for the deployment. For Lite Touch deployments, it is common to have two deployment shares: one for creating the reference images and one for deployment. For Zero Touch, it is common to have only the deployment share for creating reference images because Configuration Manager deploys the image in the production environment. + +## Rules + +The rules (CustomSettings.ini and Bootstrap.ini) make up the brain of MDT. The rules control the Windows Deployment Wizard on the client and, for example, can provide the following settings to the machine being deployed: +- Computer name +- Domain to join, and organizational unit (OU) in Active Directory to hold the computer object +- Whether to enable BitLocker +- Regional settings +You can manage hundreds of settings in the rules. For more information, see the [Microsoft Deployment Toolkit resource center](https://go.microsoft.com/fwlink/p/?LinkId=618117). + +![figure 5](../images/mdt-05-fig05.png) + +Example of a MDT rule. In this example, the new computer name is being calculated based on PC- plus the first seven (Left) characters from the serial number + +## Boot images + +Boot images are the Windows Preinstallation Environment (Windows PE) images that are used to start the deployment. They can be started from a CD or DVD, an ISO file, a USB device, or over the network using a Pre-Boot Execution Environment (PXE) server. The boot images connect to the deployment +share on the server and start the deployment. + +## Operating systems + +Using the Deployment Workbench, you import the operating systems you want to deploy. You can import either the full source (like the full Windows 10 DVD/ISO) or a custom image that you have created. The full-source operating systems are primarily used to create reference images; however, they also can be used for normal deployments. + +## Applications + +Using the Deployment Workbench, you also add the applications you want to deploy. MDT supports virtually every executable Windows file type. The file can be a standard .exe file with command-line switches for an unattended install, a Microsoft Windows Installer (MSI) package, a batch file, or a VBScript. In fact, it can be just about anything that can be executed unattended. MDT also supports the new Universal Windows apps. + +## Driver repository + +You also use the Deployment Workbench to import the drivers your hardware needs into a driver repository that lives on the server, not in the image. + +## Packages + +With the Deployment Workbench, you can add any Microsoft packages that you want to use. The most commonly added packages are language packs, and the Deployment Workbench Packages node works well for those. You also can add security and other updates this way. However, we generally recommend that you use Windows Server Update Services (WSUS) for operating system updates. The rare exceptions are critical hotfixes that are not available via WSUS, packages for the boot image, or any other package that needs to be deployed before the WSUS update process starts. + +## Task sequences + +Task sequences are the heart and soul of the deployment solution. When creating a task sequence, you need to select a template. The templates are located in the Templates folder in the MDT installation directory, and they determine which default actions are present in the sequence. + +You can think of a task sequence as a list of actions that need to be executed in a certain order. Each action can also have conditions. Some examples of actions are as follows: +- **Gather.** Reads configuration settings from the deployment server. +- **Format and Partition.** Creates the partition(s) and formats them. +- **Inject Drivers.** Finds out which drivers the machine needs and downloads them from the central driver repository. +- **Apply Operating System.** Uses ImageX to apply the image. +- **Windows Update.** Connects to a WSUS server and updates the machine. + +## Task sequence templates + +MDT comes with nine default task sequence templates. You can also create your own templates. As long as you store them in the Templates folder, they will be available when you create a new task sequence. +- **Sysprep and Capture task sequence.** Used to run the System Preparation (Sysprep) tool and capture an image of a reference computer. + + **Note**: It is preferable to use a complete build and capture instead of the Sysprep and Capture task sequence. A complete build and capture can be automated, whereas Sysprep and Capture cannot. + +- **Standard Client task sequence.** The most frequently used task sequence. Used for creating reference images and for deploying clients in production. +- **Standard Client Replace task sequence.** Used to run User State Migration Tool (USMT) backup and the optional full Windows Imaging (WIM) backup action. Can also be used to do a secure wipe of a machine that is going to be decommissioned. +- **Custom task sequence.** As the name implies, a custom task sequence with only one default action (one Install Application action). +- **Standard Server task sequence.** The default task sequence for deploying operating system images to servers. The main difference between this template and the Standard Client task sequence template is that it does not contain any USMT actions because USMT is not supported on servers. +- **Lite Touch OEM task sequence.** Used to preload operating systems images on the computer hard drive. Typically used by computer original equipment manufacturers (OEMs) but some enterprise organizations also use this feature. +- **Post OS Installation task sequence.** A task sequence prepared to run actions after the operating system has been deployed. Very useful for server deployments but not often used for client deployments. +- **Deploy to VHD Client task sequence.** Similar to the Standard Client task sequence template but also creates a virtual hard disk (VHD) file on the target computer and deploys the image to the VHD file. +- **Deploy to VHD Server task sequence.** Same as the Deploy to VHD Client task sequence but for servers. +- **Standard Client Upgrade task sequence.** A simple task sequence template used to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 directly to Windows 10, automatically preserving existing data, settings, applications, and drivers. + +## Selection profiles + +Selection profiles, which are available in the Advanced Configuration node, provide a way to filter content in the Deployment Workbench. Selection profiles are used for several purposes in the Deployment Workbench and in Lite Touch deployments. For example, they can be used to: +- Control which drivers and packages are injected into the Lite Touch (and generic) boot images. +- Control which drivers are injected during the task sequence. +- Control what is included in any media that you create. +- Control what is replicated to other deployment shares. +- Filter which task sequences and applications are displayed in the Deployment Wizard. + +## Logging + +MDT uses many log files during operating system deployments. By default the logs are client side, but by configuring the deployment settings, you can have MDT store them on the server, as well. + +**Note**   +The easiest way to view log files is to use Configuration Manager Trace (CMTrace), which is included in the [System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). + +## Monitoring + +On the deployment share, you also can enable monitoring. After you enable monitoring, you will see all running deployments in the Monitor node in the Deployment Workbench. + +## See next + +[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md b/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md deleted file mode 100644 index 6ebe0fe528..0000000000 --- a/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -title: Integrate Configuration Manager with MDT (Windows 10) -description: This topic will help you understand the benefits of integrating the Microsoft Deployment Toolkit with Microsoft System Center 2012 R2 Configuration Manager SP1 when you deploy a new or updated version of the Windows operating system. -ms.assetid: 3bd1cf92-81e5-48dc-b874-0f5d9472e5a5 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.pagetype: mdt -keywords: deploy, image, customize, task sequence -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.topic: article ---- - -# Integrate Configuration Manager with MDT - -**Applies to** -- Windows 10 - -This topic will help you understand the benefits of integrating the Microsoft Deployment Toolkit with Microsoft System Center 2012 R2 Configuration Manager SP1 when you deploy a new or updated version of the Windows operating system. -MDT is a free, supported download from Microsoft that adds approximately 280 enhancements to Windows operating system deployment with System Center 2012 R2 Configuration Manager SP1. It is, therefore, recommended that you utilize MDT when deploying the Windows operating system with Configuration Manager SP1. In addition to integrating MDT with Configuration Manager, we also recommend using MDT Lite Touch to create the Windows 10 reference images used in Configuration Manager. For more information on how to create a reference image, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). - -## Why integrate MDT with Configuration Manager - -As noted above, MDT adds many enhancements to Configuration Manager. While these enhancements are called Zero Touch, that name does not reflect how deployment is conducted. The following sections provide a few samples of the 280 enhancements that MDT adds to Configuration Manager. - -> [!Note] -> Microsoft Deployment Toolkit requires you to install [Windows PowerShell 2.0 Engine](https://docs.microsoft.com/powershell/scripting/install/installing-the-windows-powershell-2.0-engine) on your server. - -### MDT enables dynamic deployment - -When MDT is integrated with Configuration Manager, the task sequence takes additional instructions from the MDT rules. In its most simple form, these settings are stored in a text file, the CustomSettings.ini file, but you can store the settings in Microsoft SQL Server databases, or have Microsoft Visual Basic Scripting Edition (VBScripts) or web services provide the settings used. - -The task sequence uses instructions that allow you to reduce the number of task sequences in Configuration Manager and instead store settings outside the task sequence. Here are a few examples: -- The following settings instruct the task sequence to install the HP Hotkeys package, but only if the hardware is a HP EliteBook 8570w. Note that you don't have to add the package to the task sequence. - - ``` syntax - [Settings] - Priority=Model - [HP EliteBook 8570w] - Packages001=PS100010:Install HP Hotkeys - ``` -- The following settings instruct the task sequence to put laptops and desktops in different organizational units (OUs) during deployment, assign different computer names, and finally have the task sequence install the Cisco VPN client, but only if the machine is a laptop. - - ``` syntax - [Settings] - Priority= ByLaptopType, ByDesktopType - [ByLaptopType] - Subsection=Laptop-%IsLaptop% - [ByDesktopType] - Subsection=Desktop-%IsDesktop% - [Laptop-True] - Packages001=PS100012:Install Cisco VPN Client - OSDComputerName=LT-%SerialNumber% - MachineObjectOU=ou=laptops,ou=Contoso,dc=contoso,dc=com - [Desktop-True] - OSDComputerName=DT-%SerialNumber% - MachineObjectOU=ou=desktops,ou=Contoso,dc=contoso,dc=com - ``` - -![figure 2](../images/fig2-gather.png) - -Figure 2. The Gather action in the task sequence is reading the rules. - -### MDT adds an operating system deployment simulation environment - -When testing a deployment, it is important to be able to quickly test any changes you make to the deployment without needing to run through an entire deployment. MDT rules can be tested very quickly, saving significant testing time in a deployment project. For more information, see [Configure MDT settings](configure-mdt-settings.md). - -![figure 3](../images/mdt-06-fig03.png) - -Figure 3. The folder that contains the rules, a few scripts from MDT, and a custom script (Gather.ps1). - -### MDT adds real-time monitoring - -With MDT integration, you can follow your deployments in real time, and if you have access to Microsoft Diagnostics and Recovery Toolkit (DaRT), you can even remote into Windows Preinstallation Environment (Windows PE) during deployment. The real-time monitoring data can be viewed from within the MDT Deployment Workbench, via a web browser, Windows PowerShell, the Event Viewer, or Microsoft Excel 2013. In fact, any script or app that can read an Open Data (OData) feed can read the information. - -![figure 4](../images/mdt-06-fig04.png) - -Figure 4. View the real-time monitoring data with PowerShell. - -### MDT adds an optional deployment wizard - -For some deployment scenarios, you may need to prompt the user for information during deployment such as the computer name, the correct organizational unit (OU) for the computer, or which applications should be installed by the task sequence. With MDT integration, you can enable the User-Driven Installation (UDI) wizard to gather the required information, and customize the wizard using the UDI Wizard Designer. - -![figure 5](../images/mdt-06-fig05.png) - -Figure 5. The optional UDI wizard open in the UDI Wizard Designer. - -MDT Zero Touch simply extends Configuration Manager with many useful built-in operating system deployment components. By providing well-established, supported solutions, MDT reduces the complexity of deployment in Configuration Manager. - -## Why use MDT Lite Touch to create reference images - -You can create reference images for Configuration Manager in Configuration Manager, but in general we recommend creating them in MDT Lite Touch for the following reasons: -- In a deployment project, it is typically much faster to create a reference image using MDT Lite Touch than Configuration Manager. -- You can use the same image for every type of operating system deployment - Microsoft Virtual Desktop Infrastructure (VDI), Microsoft System Center 2012 R2 Virtual Machine Manager (SCVMM), MDT, Configuration Manager, Windows Deployment Services (WDS), and more. -- Microsoft System Center 2012 R2 performs deployment in the LocalSystem context. This means that you cannot configure the Administrator account with all of the settings that you would like to be included in the image. MDT runs in the context of the Local Administrator, which means you can configure the look and feel of the configuration and then use the CopyProfile functionality to copy these changes to the default user during deployment. -- The Configuration Manager task sequence does not suppress user interface interaction. -- MDT Lite Touch supports a Suspend action that allows for reboots, which is useful when you need to perform a manual installation or check the reference image before it is automatically captured. -- MDT Lite Touch does not require any infrastructure and is easy to delegate. - -## Related topics - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](../deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](../deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](../deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](../deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](../deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md) - - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](../deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](../deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)  diff --git a/windows/deployment/deploy-windows-mdt/key-features-in-mdt.md b/windows/deployment/deploy-windows-mdt/key-features-in-mdt.md deleted file mode 100644 index f0fe20a593..0000000000 --- a/windows/deployment/deploy-windows-mdt/key-features-in-mdt.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Key features in MDT (Windows 10) -description: The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. -ms.assetid: 858e384f-e9db-4a93-9a8b-101a503e4868 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, feature, tools, upgrade, migrate, provisioning -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Key features in MDT - -**Applies to** -- Windows 10 - -The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it is considered fundamental to Windows operating system and enterprise application deployment. - -MDT has many useful features, the most important of which are: -- **Windows Client support.** Supports Windows 7, Windows 8, Windows 8.1, and Windows 10. -- **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. -- **Additional operating systems support.** Supports Windows Thin PC and Windows Embedded POSReady 7, as well as Windows 8.1 Embedded Industry. -- **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1. -- **GPT support.** Supports deployment to machines that require the new GUID (globally unique identifier) partition table (GPT) format. This is related to UEFI. -- **Enhanced Windows PowerShell support.** Provides support for running PowerShell scripts. - - ![figure 2](../images/mdt-05-fig02.png) - - Figure 2. The deployment share mounted as a standard PSDrive allows for administration using PowerShell. - -- **Add local administrator accounts.** Allows you to add multiple user accounts to the local Administrators group on the target computers, either via settings or the deployment wizard. -- **Automated participation in CEIP and WER.** Provides configuration for participation in Windows Customer Experience Improvement Program (CEIP) and Windows Error Reporting (WER). -- **Deploy Windows RE.** Enables deployment of a customized Windows Recovery Environment (Windows RE) as part of the task sequence. -- **Deploy to VHD.** Provides ready-made task sequence templates for deploying Windows into a virtual hard disk (VHD) file. -- **Improved deployment wizard.** Provides additional progress information and a cleaner UI for the Lite Touch Deployment Wizard. -- **Monitoring.** Allows you to see the status of currently running deployments. -- **Apply GPO Pack.** Allows you to deploy local group policy objects created by Microsoft Security Compliance Manager (SCM). -- **Partitioning routines.** Provides improved partitioning routines to ensure that deployments work regardless of the current hard drive structure. -- **Offline BitLocker.** Provides the capability to have BitLocker enabled during the Windows Preinstallation Environment (Windows PE) phase, thus saving hours of encryption time. -- **USMT offline user-state migration.** Provides support for running the User State Migration Tool (USMT) capture offline, during the Windows PE phase of the deployment. - - ![figure 3](../images/mdt-05-fig03.png) - - Figure 3. The offline USMT backup in action. - -- **Install or uninstall Windows roles or features.** Enables you to select roles and features as part of the deployment wizard. MDT also supports uninstall of roles and features. -- **Microsoft System Center 2012 Orchestrator integration.** Provides the capability to use Orchestrator runbooks as part of the task sequence. -- **Support for DaRT.** Supports optional integration of the DaRT components into the boot image. -- **Support for Office 2013.** Provides added support for deploying Microsoft Office Professional Plus 2013. -- **Support for Modern UI app package provisioning.** Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later. -- **Extensibility.** Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts. -- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](https://go.microsoft.com/fwlink/p/?LinkId=618117). - -## Related topics - -[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) - -[MDT Lite Touch components](mdt-lite-touch-components.md) -  -  diff --git a/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md b/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md deleted file mode 100644 index 15f4f07658..0000000000 --- a/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: MDT Lite Touch components (Windows 10) -description: This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) that support Lite Touch Installation (LTI) for Windows 10. -ms.assetid: 7d6fc159-e338-439e-a2e6-1778d0da9089 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, install, deployment, boot, log, monitor -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# MDT Lite Touch components - -**Applies to** -- Windows 10 - -This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) that support Lite Touch Installation (LTI) for Windows 10. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc. -When deploying the Windows operating system using MDT, most of the administration and configuration is done through the Deployment Workbench, but you also can perform many of the tasks using Windows PowerShell. The easiest way to find out how to use PowerShell in MDT is to use the Deployment Workbench to perform an operation and at the end of that task, click View Script. That will give you the PowerShell command. - -![figure 4](../images/mdt-05-fig04.png) - -Figure 4. If you click **View Script** on the right side, you will get the PowerShell code that was used to perform the task. - -## Deployment shares - -A deployment share is essentially a folder on the server that is shared and contains all the setup files and scripts needed for the deployment solution. It also holds the configuration files (called rules) that are gathered when a machine is deployed. These configuration files can reach out to other sources, like a database, external script, or web server to get additional settings for the deployment. For Lite Touch deployments, it is common to have two deployment shares: one for creating the reference images and one for deployment. For Zero Touch, it is common to have only the deployment share for creating reference images because Microsoft System Center 2012 R2 Configuration Manager deploys the image in the production environment. - -## Rules - -The rules (CustomSettings.ini and Bootstrap.ini) make up the brain of MDT. The rules control the Windows Deployment Wizard on the client and, for example, can provide the following settings to the machine being deployed: -- Computer name -- Domain to join, and organizational unit (OU) in Active Directory to hold the computer object -- Whether to enable BitLocker -- Regional settings -You can manage hundreds of settings in the rules. For more information, see the [Microsoft Deployment Toolkit resource center](https://go.microsoft.com/fwlink/p/?LinkId=618117). - -![figure 5](../images/mdt-05-fig05.png) - -Figure 5. Example of a MDT rule. In this example, the new computer name is being calculated based on PC- plus the first seven (Left) characters from the serial number - -## Boot images - -Boot images are the Windows Preinstallation Environment (Windows PE) images that are used to start the deployment. They can be started from a CD or DVD, an ISO file, a USB device, or over the network using a Pre-Boot Execution Environment (PXE) server. The boot images connect to the deployment -share on the server and start the deployment. - -## Operating systems - -Using the Deployment Workbench, you import the operating systems you want to deploy. You can import either the full source (like the full Windows 10 DVD/ISO) or a custom image that you have created. The full-source operating systems are primarily used to create reference images; however, they also can be used for normal deployments. - -## Applications - -Using the Deployment Workbench, you also add the applications you want to deploy. MDT supports virtually every executable Windows file type. The file can be a standard .exe file with command-line switches for an unattended install, a Microsoft Windows Installer (MSI) package, a batch file, or a VBScript. In fact, it can be just about anything that can be executed unattended. MDT also supports the new Universal Windows apps. - -## Driver repository - -You also use the Deployment Workbench to import the drivers your hardware needs into a driver repository that lives on the server, not in the image. - -## Packages - -With the Deployment Workbench, you can add any Microsoft packages that you want to use. The most commonly added packages are language packs, and the Deployment Workbench Packages node works well for those. You also can add security and other updates this way. However, we generally recommend that you use Windows Server Update Services (WSUS) for operating system updates. The rare exceptions are critical hotfixes that are not available via WSUS, packages for the boot image, or any other package that needs to be deployed before the WSUS update process starts. - -## Task sequences - -Task sequences are the heart and soul of the deployment solution. When creating a task sequence, you need to select a template. The templates are located in the Templates folder in the MDT installation directory, and they determine which default actions are present in the sequence. - -You can think of a task sequence as a list of actions that need to be executed in a certain order. Each action can also have conditions. Some examples of actions are as follows: -- **Gather.** Reads configuration settings from the deployment server. -- **Format and Partition.** Creates the partition(s) and formats them. -- **Inject Drivers.** Finds out which drivers the machine needs and downloads them from the central driver repository. -- **Apply Operating System.** Uses ImageX to apply the image. -- **Windows Update.** Connects to a WSUS server and updates the machine. - -## Task sequence templates - -MDT comes with nine default task sequence templates. You can also create your own templates. As long as you store them in the Templates folder, they will be available when you create a new task sequence. -- **Sysprep and Capture task sequence.** Used to run the System Preparation (Sysprep) tool and capture an image of a reference computer. - - **Note**   - It is preferable to use a complete build and capture instead of the Sysprep and Capture task sequence. A complete build and capture can be automated, whereas Sysprep and Capture cannot. - -- **Standard Client task sequence.** The most frequently used task sequence. Used for creating reference images and for deploying clients in production. -- **Standard Client Replace task sequence.** Used to run User State Migration Tool (USMT) backup and the optional full Windows Imaging (WIM) backup action. Can also be used to do a secure wipe of a machine that is going to be decommissioned. -- **Custom task sequence.** As the name implies, a custom task sequence with only one default action (one Install Application action). -- **Standard Server task sequence.** The default task sequence for deploying operating system images to servers. The main difference between this template and the Standard Client task sequence template is that it does not contain any USMT actions because USMT is not supported on servers. -- **Lite Touch OEM task sequence.** Used to preload operating systems images on the computer hard drive. Typically used by computer original equipment manufacturers (OEMs) but some enterprise organizations also use this feature. -- **Post OS Installation task sequence.** A task sequence prepared to run actions after the operating system has been deployed. Very useful for server deployments but not often used for client deployments. -- **Deploy to VHD Client task sequence.** Similar to the Standard Client task sequence template but also creates a virtual hard disk (VHD) file on the target computer and deploys the image to the VHD file. -- **Deploy to VHD Server task sequence.** Same as the Deploy to VHD Client task sequence but for servers. -- **Standard Client Upgrade task sequence.** A simple task sequence template used to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 directly to Windows 10, automatically preserving existing data, settings, applications, and drivers. - -## Selection profiles - -Selection profiles, which are available in the Advanced Configuration node, provide a way to filter content in the Deployment Workbench. Selection profiles are used for several purposes in the Deployment Workbench and in Lite Touch deployments. For example, they can be used to: -- Control which drivers and packages are injected into the Lite Touch (and generic) boot images. -- Control which drivers are injected during the task sequence. -- Control what is included in any media that you create. -- Control what is replicated to other deployment shares. -- Filter which task sequences and applications are displayed in the Deployment Wizard. - -## Logging - -MDT uses many log files during operating system deployments. By default the logs are client side, but by configuring the deployment settings, you can have MDT store them on the server, as well. - -**Note**   -The easiest way to view log files is to use Configuration Manager Trace (CMTrace), which is included in the [System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). - -## Monitoring - -On the deployment share, you also can enable monitoring. After you enable monitoring, you will see all running deployments in the Monitor node in the Deployment Workbench. - -## Related topics - -[Key features in MDT](key-features-in-mdt.md) - -[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index 2e1b06b5f4..52246fddfd 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -1,6 +1,6 @@ --- title: Prepare for deployment with MDT (Windows 10) -description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT). +description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT). ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226 ms.reviewer: manager: laurawi @@ -19,51 +19,176 @@ ms.topic: article # Prepare for deployment with MDT **Applies to** -- Windows 10 +- Windows 10 -This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT). It covers the installation of the necessary system prerequisites, the creation of shared folders and service accounts, and the configuration of security permissions in the files system and in Active Directory. +This article will walk you through the steps necessary to prepare your network and server infrastructure to deploy Windows 10 with the Microsoft Deployment Toolkit (MDT). It covers the installation of the necessary system prerequisites, the creation of shared folders and service accounts, and the configuration of security permissions in the file system and in Active Directory. -For the purposes of this topic, we will use two machines: DC01 and MDT01. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. MDT01 is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). +## Infrastructure -## System requirements +The procedures in this guide use the following names and infrastructure. -MDT requires the following components: -- Any of the following operating systems: - - Windows 7 - - Windows 8 - - Windows 8.1 - - Windows 10 - - Windows Server 2008 R2 - - Windows Server 2012 - - Windows Server 2012 R2 -- Windows Assessment and Deployment Kit (ADK) for Windows 10 -- Windows PowerShell -- Microsoft .NET Framework +### Network and servers -## Install Windows ADK for Windows 10 +For the purposes of this topic, we will use three server computers: **DC01**, **MDT01**, and **HV01**. +- All servers are running Windows Server 2019. + - You can use an earlier version of Windows Server with minor modifications to some procedures. + - Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is requried to perform the procedures in this guide. +- **DC01** is a domain controller, DHCP server, and DNS server for contoso.com, representing the fictitious Contoso Corporation. +- **MDT01** is a domain member server in contoso.com with a data (D:) drive that can store at least 200GB. MDT01 will host deployment shares and run the Windows Deployment Service. Optionally, MDT01 is also a WSUS server. + - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway. +- **HV01** is a Hyper-V host computer that is used to build a Windows 10 reference image. + - See [Hyper-V requirements](#hyper-v-requirements) below for more information about HV01. -These steps assume that you have the MDT01 member server installed and configured and that you have downloaded [Windows ADK for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526803) to the E:\\Downloads\\ADK folder. -1. On MDT01, log on as Administrator in the CONTOSO domain using a password of P@ssw0rd. -2. Start the **ADK Setup** (E:\\Downloads\\ADK\\adksetup.exe), and on the first wizard page, click **Continue**. -3. On the **Select the features you want to change** page, select the features below and complete the wizard using the default settings: - 1. Deployment Tools - 2. Windows Preinstallation Environment (Windows PE) - 3. User State Migration Tool (USMT) +### Client computers - >[!IMPORTANT] - >Starting with Windows 10, version 1809, Windows PE is released separately from the ADK. See [Download and install the Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install) for more information. +Several client computers are referenced in this guide with hostnames of PC0001 to PC0007. -## Install MDT +- **PC0001**: A computer running Windows 10 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. + - Client name: PC0001 + - IP Address: DHCP +- **PC0002**: A computer running Windows 7 SP1 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This computer is referenced during the migration scenarios. + - Client name: PC0002 + - IP Address: DHCP +- **PC0003 - PC0007**: These are other client computers similar to PC0001 and PC0002 that are used in this guide and another guide for various scenarios. The device names are incremented for clarity within each scenario. For example, PC0003 and PC0004 are running Windows 7 just like PC0002, but are used for Configuration Manager refresh and replace scenarios, respectively. -These steps assume that you have downloaded [MDT](https://go.microsoft.com/fwlink/p/?LinkId=618117 ) to the E:\\Downloads\\MDT folder on MDT01. +### Storage requirements -1. On MDT01, log on as Administrator in the CONTOSO domain using a password of P@ssw0rd. -2. Install **MDT** (E:\\Downloads\\MDT\\MicrosoftDeploymentToolkit\_x64.msi) with the default settings. +MDT01 and HV01 should have the ability to store up to 200 GB of files on a data drive (D:). If you use a computer with a single system partition (C:) you will need to adjust come procedures in this guide to specify the C: drive instead of the D: drive. -## Create the OU structure +### Hyper-V requirements -If you do not have an organizational unit (OU) structure in your Active Directory, you should create one. In this section, you create an OU structure and a service account for MDT. -1. On DC01, using Active Directory User and Computers, in the contoso.com domain level, create a top-level OU named **Contoso**. +If you do not have access to a Hyper-V server, you can install Hyper-V on a Windows 10 or Windows 8.1 computer temporarily to use for building reference images. For instructions on how to enable Hyper-V on Windows 10, see the [Verify support and install Hyper-V](https://docs.microsoft.com/windows/deployment/windows-10-poc#verify-support-and-install-hyper-v) section in the Windows 10 deployment test lab guide. This guide is a proof-of-concept guide that has detailed instructions for installing Hyper-V. + +### Network requirements + +All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. + +### Domain credentials + +The following generic credentials are used in this guide. You should replace these credentials as they appear in each procedure with your credentials. + +**Active Directory domain name**: contoso.com
              +**Domain administrator username**: administrator
              +**Domain administrator password**: pass@word1 + +### Organizational unit structure + +The following OU structure is used in this guide. Instructions are provided [below](#create-the-ou-structure) to help you create the required OUs. + +![figure 2](../images/mdt-01-fig02.jpg) + +## Install the Windows ADK + +These steps assume that you have the MDT01 member server running and configured as a domain member server. + +On **MTD01**: + +Visit the [Download and install the Windows ADK](https://go.microsoft.com/fwlink/p/?LinkId=526803) page and download the following items to the **D:\\Downloads\\ADK** folder on MDT01 (you will need to create this folder): +- [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042) +- [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2087112) +- [The Windows System Image Manager (WSIM) 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334) + +>[!TIP] +>You might need to temporarily disable IE Enhanced Security Configuration for administrators in order to download files from the Internet to the server. This setting can be disabled by using Server Manager (Local Server/Properties). + +1. On **MDT01**, ensure that you are signed in as an administrator in the CONTOSO domain. + - For the purposes of this guide, we are using a Domain Admin account of **administrator** with a password of pass@word1. You can use your own administrator username and password as long as you properly adjust all steps in this guide that use these login credentials. +2. Start the **ADK Setup** (D:\\Downloads\\ADK\\adksetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page accept the default list of features by clicking **Install**. This will install deployment tools and the USMT. Verify that the installation completes successfully before moving to the next step. +3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page click **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully before moving to the next step. +4. Extract the **WSIM 1903 update** (D:\\Downloads\ADK\\WSIM1903.zip) and then run the **UpdateWSIM.bat** file. + - You can confirm that the update is applied by viewing properties of the ImageCat.exe and ImgMgr.exe files at **C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM** and verifying that the **Details** tab displays a **File version** of **10.0.18362.144** or later. + +## Install and initialize Windows Deployment Services (WDS) + +On **MDT01**: + +1. Open an elevated Windows PowerShell prompt and enter the following command: + + ```powershell + Install-WindowsFeature -Name WDS -IncludeManagementTools + WDSUTIL /Verbose /Progress /Initialize-Server /Server:MDT01 /RemInst:"D:\RemoteInstall" + WDSUTIL /Set-Server /AnswerClients:All + ``` + +## Optional: Install Windows Server Update Services (WSUS) + +If you wish to use MDT as a WSUS server using the Windows Internal Database (WID), use the following command to install this service. Alternatively, change the WSUS server information in this guide to the WSUS server in your environment. + +To install WSUS on MDT01, enter the following at an elevated Windows PowerShell prompt: + + ```powershell + Install-WindowsFeature -Name UpdateServices, UpdateServices-WidDB, UpdateServices-Services, UpdateServices-RSAT, UpdateServices-API, UpdateServices-UI + cmd /c "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall CONTENT_DIR=C:\WSUS + ``` + +>To use the WSUS that you have installed on MDT01, you must also [configure Group Policy](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus#configure-automatic-updates-and-update-service-location) on DC01 and perform the neccessary post-installation configuration of WSUS on MDT01. + +## Install MDT + +>[!NOTE] +>MDT installation requires the following: +>- The Windows ADK for Windows 10 (installed in the previous procedure) +>- Windows PowerShell ([version 5.1](https://www.microsoft.com/download/details.aspx?id=54616) is recommended; type **$host** to check) +>- Microsoft .NET Framework + +On **MDT01**: + +1. Visit the [MDT resource page](https://go.microsoft.com/fwlink/p/?LinkId=618117) and click **Download MDT**. +2. Save the **MicrosoftDeploymentToolkit_x64.msi** file to the D:\\Downloads\\MDT folder on MDT01. + - **Note**: As of the publishing date for this guide, the current version of MDT is 8456 (6.3.8456.1000), but a later version will also work. +3. Install **MDT** (D:\\Downloads\\MDT\\MicrosoftDeploymentToolkit_x64.exe) with the default settings. + +## Create the OU structure + +Switch to **DC01** and perform the following procedures on **DC01**: + +To create the OU structure, you can use the Active Directory Users and Computers console (dsa.msc), or you can use Windows PowerShell. + +To use Windows PowerShell, copy the following commands into a text file and save it as C:\Setup\Scripts\ou.ps1. Be sure that you are viewing file extensions and that you save the file with the .ps1 extension. + +```powershell +$oulist = Import-csv -Path c:\oulist.txt +ForEach($entry in $oulist){ + $ouname = $entry.ouname + $oupath = $entry.oupath + New-ADOrganizationalUnit -Name $ouname -Path $oupath + Write-Host -ForegroundColor Green "OU $ouname is created in the location $oupath" +} +``` + +Next, copy the following list of OU names and paths into a text file and save it as C:\Setup\Scripts\oulist.txt + +```text +OUName,OUPath +Contoso,"DC=CONTOSO,DC=COM" +Accounts,"OU=Contoso,DC=CONTOSO,DC=COM" +Computers,"OU=Contoso,DC=CONTOSO,DC=COM" +Groups,"OU=Contoso,DC=CONTOSO,DC=COM" +Admins,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Service Accounts,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Users,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Servers,"OU=Computers,OU=Contoso,DC=CONTOSO,DC=COM" +Workstations,"OU=Computers,OU=Contoso,DC=CONTOSO,DC=COM" +Security Groups,"OU=Groups,OU=Contoso,DC=CONTOSO,DC=COM" +``` + +Lastly, open an elevated Windows PowerShell prompt on DC01 and run the ou.ps1 script: + +```powershell +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force +Set-Location C:\Setup\Scripts +.\ou.ps1 +``` + +This will create an OU structure as shown below. + +![OU structure](../images/mdt-05-fig07.png) + +To use the Active Directory Users and Computers console (instead of PowerShell): + +On **DC01**: + +1. Using the Active Directory Users and Computers console (dsa.msc), in the contoso.com domain level, create a top-level OU named **Contoso**. 2. In the **Contoso** OU, create the following OUs: 1. Accounts 2. Computers @@ -76,55 +201,62 @@ If you do not have an organizational unit (OU) structure in your Active Director 1. Servers 2. Workstations 5. In the **Contoso / Groups** OU, create the following OU: - - Security Groups + 1. Security Groups -![figure 6](../images/mdt-05-fig07.png) +The final result of either method is shown below. The **MDT_BA** account will be created next. -Figure 6. A sample of how the OU structure will look after all the OUs are created. +## Create the MDT service account -## Create the MDT service account +When creating a reference image, you need an account for MDT. The MDT build account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. -When creating a reference image, you need an account for MDT. The MDT Build Account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. -1. On DC01, using Active Directory User and Computers, browse to **contoso.com / Contoso / Service Accounts**. -2. Select the **Service Accounts** OU and create the **MDT\_BA** account using the following settings: - 1. Name: MDT\_BA - 2. User logon name: MDT\_BA - 3. Password: P@ssw0rd - 4. User must change password at next logon: Clear - 5. User cannot change password: Selected - 6. Password never expires: Selected +To create an MDT build account, open an elevalted Windows PowerShell prompt on DC01 and enter the following (copy and paste the entire command, taking care to notice the scroll bar at the bottom). This command will create the MDT_BA user account and set the password to "pass@word1": -## Create and share the logs folder +```powershell +New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true +``` +If you have the Active Directory Users and Computers console open you can refresh the view and see this new account in the **Contoso\Accounts\Service Accounts** OU as shown in the screenshot above. + +## Create and share the logs folder By default MDT stores the log files locally on the client. In order to capture a reference image, you will need to enable server-side logging and, to do that, you will need to have a folder in which to store the logs. For more information, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). -1. On MDT01, log on as **CONTOSO\\Administrator**. -2. Create and share the **E:\\Logs** folder by running the following commands in an elevated Windows PowerShell prompt: +On **MDT01**: - ``` powershell - New-Item -Path E:\Logs -ItemType directory - New-SmbShare -Name Logs$ -Path E:\Logs -ChangeAccess EVERYONE - icacls E:\Logs /grant '"MDT_BA":(OI)(CI)(M)' +1. Sign in as **CONTOSO\\administrator**. +2. Create and share the **D:\\Logs** folder by running the following commands in an elevated Windows PowerShell prompt: + + ```powershell + New-Item -Path D:\Logs -ItemType directory + New-SmbShare -Name Logs$ -Path D:\Logs -ChangeAccess EVERYONE + icacls D:\Logs /grant '"MDT_BA":(OI)(CI)(M)' ``` -![figure 7](../images/mdt-05-fig08.png) +See the following example: -Figure 7. The Sharing tab of the E:\\Logs folder after sharing it with PowerShell. +![Logs folder](../images/mdt-05-fig08.png) -## Use CMTrace to read log files (optional) +## Use CMTrace to read log files (optional) -The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace (CMTrace), which is available as part [of Microsoft System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). You can use Notepad, but CMTrace formatting makes the logs easier to read. +The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace ([CMTrace](https://docs.microsoft.com/sccm/core/support/cmtrace)), which is available as part of the [Microsoft System 2012 R2 Center Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). You should also download this tool. +You can use Notepad (example below): ![figure 8](../images/mdt-05-fig09.png) -Figure 8. An MDT log file opened in Notepad. +Alternatively, CMTrace formatting makes the logs much easier to read. See the same log file below, opened in CMTrace: ![figure 9](../images/mdt-05-fig10.png) +After installing the ConfigMgrTools.msi file, you can search for **cmtrace** and pin the tool to your taskbar for easy access. -Figure 9. The same log file, opened in CMTrace, is much easier to read. -## Related topics +## Next steps -[Key features in MDT](key-features-in-mdt.md) +When you have completed all the steps in this section to prepare for deployment, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). -[MDT Lite Touch components](mdt-lite-touch-components.md) +## Appendix + +**Sample files** + +The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so that you can see how some tasks can be automated with Windows PowerShell. +- [Gather.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619361). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment. +- [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU. +- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md index 6c0524658f..c0f5f7d8a1 100644 --- a/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md +++ b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md @@ -1,132 +1,120 @@ ---- -title: Refresh a Windows 7 computer with Windows 10 (Windows 10) -description: This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. -ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: reinstallation, customize, template, script, restore -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Refresh a Windows 7 computer with Windows 10 - -**Applies to** -- Windows 10 - -This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. The refresh scenario, or computer refresh, is a reinstallation of an operating system on the same machine. You can refresh the machine to the same operating system as it is currently running, or to a later version. - -For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 Standard server. PC0001 is a machine with Windows 7 Service Pack 1 (SP1) that is going to be refreshed into a Windows 10 machine, with data and settings restored. MDT01 and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). - -![The machines used in this topic](../images/mdt-04-fig01.png "The machines used in this topic") - -Figure 1. The machines used in this topic. - -## The computer refresh process - -Even though a computer will appear, to the end user, to be upgraded, a computer refresh is not, technically, an in-place upgrade. A computer refresh also involves taking care of user data and settings from the old installation and making sure to restore those at the end of the installation. -For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, to migrate user data and settings. To complete a computer refresh you will: - -1. Back up data and settings locally, in a backup folder. - -2. Wipe the partition, except for the backup folder. - -3. Apply the new operating system image. - -4. Install other applications. - -5. Restore data and settings. - -During the computer refresh, USMT uses a feature called Hard-Link Migration Store. When you use this feature, the files are simply linked in the file system, which allows for fast migration, even when there is a lot of data. - ->[!NOTE] ->In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file will contain the entire volume from the computer, and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire machine is not a supported scenario. - -### Multi-user migration - -By default, ScanState in USMT backs up all profiles on the machine, including local computer profiles. If you have a machine that has been in your environment for a while, it likely has several domain-based profiles on it, including those of former users. You can limit which profiles are backed up -by configuring command-line switches to ScanState (added as rules in MDT). - -As an example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: ScanStateArgs=/ue:\*\\\* /ui:CONTOSO\\\* - ->[!NOTE] ->You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days. - -### Support for additional settings - -In addition to the command-line switches that control which profiles to migrate, the XML templates control exactly what data is being migrated. You can control data within and outside the user profiles - -## Create a custom User State Migration Tool (USMT) template - -In this section, you learn to migrate additional data using a custom template. You configure the environment to use a custom USMT XML template that will: - -1. Back up the **C:\\Data** folder (including all files and folders). - -2. Scan the local disk for PDF documents (\*.pdf files) and restore them into the **C:\\Data\\PDF Documents** folder on the destination machine. - The custom USMT template is named MigContosoData.xml, and you can find it in the sample files for this documentation, which include: - - * [Gather script](https://go.microsoft.com/fwlink/p/?LinkId=619361) - * [Set-OUPermissions](https://go.microsoft.com/fwlink/p/?LinkId=619362) script - * [MDT Sample Web Service](https://go.microsoft.com/fwlink/p/?LinkId=619363) - -### Add the custom XML template - -In order to use the custom MigContosoData.xml USMT template, you need to copy it to the MDT Production deployment share and update the CustomSettings.ini file. In these steps, we assume you have downloaded the MigContosoData.xml file. -1. Using File Explorer, copy the MigContosoData.xml file to the **E:\\MDTProduction\\Tools\\x64\\USMT5** folder. -2. Using Notepad, edit the E:\\MDTProduction\\Control\\CustomSettings.ini file. After the USMTMigFiles002=MigUser.xml line add the following line: - - ``` syntax - USMTMigFiles003=MigContosoData.xml - ``` -3. Save the CustomSettings.ini file. - -## Refresh a Windows 7 SP1 client - -After adding the additional USMT template and configuring the CustomSettings.ini file to use it, you are now ready to refresh a Windows 7 SP1 client to Windows 10. In these steps, we assume you have a Windows 7 SP1 client named PC0001 in your environment that is ready for a refresh to Windows 10. - ->[!NOTE] ->MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property in the [MDT resource page](https://go.microsoft.com/fwlink/p/?LinkId=618117). - -### Upgrade (refresh) a Windows 7 SP1 client - -1. On PC0001, log on as **CONTOSO\\Administrator**. Start the Lite Touch Deploy Wizard by executing **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**. Complete the deployment guide using the following settings: - - * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM - * Computer name: <default> - * Specify where to save a complete computer backup: Do not back up the existing computer - >[!NOTE] - >Skip this optional full WIM backup. The USMT backup will still run. - -2. Select one or more applications to install: Install - Adobe Reader XI - x86 - -3. The setup now starts and does the following: - - * Backs up user settings and data using USMT. - * Installs the Windows 10 Enterprise x64 operating system. - * Installs the added application(s). - * Updates the operating system via your local Windows Server Update Services (WSUS) server. - * Restores user settings and data using USMT. - -![Start the computer refresh from the running Windows 7 client](../images/fig2-taskseq.png "Start the computer refresh from the running Windows 7 client") - -Figure 2. Starting the computer refresh from the running Windows 7 SP1 client. - -## Related topics - -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) - -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) - -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) - -[Configure MDT settings](configure-mdt-settings.md) +--- +title: Refresh a Windows 7 computer with Windows 10 (Windows 10) +description: This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. +ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: reinstallation, customize, template, script, restore +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Refresh a Windows 7 computer with Windows 10 + +**Applies to** +- Windows 10 + +This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the online computer refresh process. The computer refresh scenario is a reinstallation of an updated operating system on the same computer. You can also use this procedure to reinstall the same OS version. In this article, the computer refresh will be done while the computer is online. MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property on the [MDT resource page](https://go.microsoft.com/fwlink/p/?LinkId=618117). + +For the purposes of this topic, we will use three computers: DC01, MDT01, and PC0001. +- DC01 is a domain controller for the contoso.com domain. +- MDT01 is domain member server that hosts your deployment share. +- PC0001 is a domain member computer running a previous version of Windows that is going to be refreshed to a new version of Windows 10, with data and settings restored. The example used here is a computer running Windows 7 SP1. + +Both DC01 and MDT01 are running Windows Server 2019; however any supported version of Windows Server can be used. For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +![computers](../images/mdt-04-fig01.png "Computers used in this topic") + +The computers used in this topic. + +## The computer refresh process + +A computer refresh is not the same as an in-place upgrade because a computer refresh involves exporting user data and settings then wiping the device before installing a fresh OS and restoring the user's data and settings. + +For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, to migrate user data and settings. To complete a computer refresh you will: + +1. Back up data and settings locally, in a backup folder. +2. Wipe the partition, except for the backup folder. +3. Apply the new operating system image. +4. Install other applications. +5. Restore data and settings. + +During the computer refresh, USMT uses a feature called Hard-Link Migration Store. When you use this feature, the files are simply linked in the file system, which allows for fast migration, even when there is a lot of data. + +>[!NOTE] +>In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario. + +### Multi-user migration + +By default, ScanState in USMT backs up all profiles on the machine, including local computer profiles. If you have a computer that has been in your environment for a while, it likely has several domain-based profiles on it, including those of former users. You can limit which profiles are backed up by configuring command-line switches to ScanState (added as rules in MDT). + +For example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: ScanStateArgs=/ue:\*\\\* /ui:CONTOSO\\\* + +>[!NOTE] +>You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days. + +### Support for additional settings + +In addition to the command-line switches that control which profiles to migrate, [XML templates](https://docs.microsoft.com/windows/deployment/usmt/understanding-migration-xml-files) control exactly what data is being migrated. You can control data within and outside the user profiles. + +### Multicast + +Multicast is a technology designed to optimize simultaneous deployment to multiple devices. If you have a limited number of simultaneous deployments, you should disable multicast which was [configured in a previous procedure](deploy-a-windows-10-image-using-mdt.md#set-up-mdt-for-multicast) in this guide. Disabling multicast will speed up deployment for a small number of computers. You will need to update the deployment share after changing this setting. + +## Refresh a Windows 7 SP1 client + +In these section, we assume that you have already performed the prerequisite procedures in the following topics, so that you have a deployment share named **MDTProduction$** on MDT01: + +- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) + +It is also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to the latest version of Windows 10. For demonstration purposes, we will refreshing a Windows 7 SP1 PC to Windows 10, version 1909. + +### Upgrade (refresh) a Windows 7 SP1 client + +>[!IMPORTANT] +>Domain join details [specified in the deployment share rules](deploy-a-windows-10-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 7 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-10-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in Contoso > Computers > Workstations. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer. + +1. On PC0001, sign in as **contoso\\Administrator** and start the Lite Touch Deploy Wizard by opening **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**. +2. Complete the deployment guide using the following settings: + + * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + * Computer name: <default> + * Specify where to save a complete computer backup: Do not back up the existing computer + >[!NOTE] + >Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run. + * Select one or more applications to install: Install - Adobe Reader + + ![Computer refresh](../images/fig2-taskseq.png "Start the computer refresh") + +4. Setup starts and does the following: + + * Backs up user settings and data using USMT. + * Installs the Windows 10 Enterprise x64 operating system. + * Installs any added applications. + * Updates the operating system using your local Windows Server Update Services (WSUS) server. + * Restores user settings and data using USMT. + +5. You can monitor progress of the deployment using the deployment workbench on MDT01. See the following example: + + ![monitor deployment](../images/monitor-pc0001.png) + +6. After the refresh process completes, sign in to the Windows 10 computer and verify that user accounts, data and settings were migrated. + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
              +[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
              +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
              +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
              +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
              +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
              +[Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md index dee4dd39d2..84daf20005 100644 --- a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md +++ b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md @@ -1,6 +1,7 @@ --- title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) -description: A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10; however, because you are replacing a machine, you cannot store the backup on the old computer. +description: In this article, you will learn how to replace a Windows 7 device with a Windows 10 device. +ms.custom: seo-marvel-apr2020 ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a ms.reviewer: manager: laurawi @@ -21,68 +22,75 @@ ms.topic: article **Applies to** - Windows 10 -A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10; however, because you are replacing a machine, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. -For the purposes of this topic, we will use four machines: DC01, MDT01, PC0002, and PC0007. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. PC0002 is an old machine running Windows 7 SP1. It is going to be replaced by a new Windows 10 machine, PC0007. User State Migration Tool (USMT) will be used to backup and restore data and settings. MDT01, PC0002, and PC0007 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). +A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10. However, because you are replacing a device, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings. -![The machines used in this topic](../images/mdt-03-fig01.png "The machines used in this topic") +For the purposes of this topic, we will use four computers: DC01, MDT01, PC0002, and PC0007. +- DC01 is a domain controller for the contoso.com domain. +- MDT01 is domain member server that hosts your deployment share. +- PC0002 is an old computer running Windows 7 SP1 that will be replaced by PC0007. +- PC0007 is a new computer will have the Windows 10 OS installed prior to data from PC0002 being migrated. Both PC0002 and PC0007 are members of the contoso.com domain. -Figure 1. The machines used in this topic. +For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). -## Prepare for the computer replace +![The computers used in this topic](../images/mdt-03-fig01.png) -When preparing for the computer replace, you need to create a folder in which to store the backup, and a backup only task sequence that you run on the old computer. +The computers used in this topic. + +>HV01 is also used in this topic to host the PC0007 virtual machine for demonstration purposes, however typically PC0007 is a physical computer. + +## Prepare for the computer replace + + To prepare for the computer replace, you need to create a folder in which to store the backup and a backup only task sequence to run on the old computer. ### Configure the rules on the Microsoft Deployment Toolkit (MDT) Production share -1. On MDT01, using the Deployment Workbench, update the MDT Production deployment share rules. +On **MDT01**: -2. Change the **SkipUserData=YES** option to **NO**, and click **OK**. +1. Open the Deployment Workbench, under **Deployment Shares** right-click **MDT Production**, click **Properties**, and then click the **Rules** tab. +2. Change the **SkipUserData=YES** option to **NO**, and click **OK**. +3. Right-click **MDT Production** and click **Update Deployment Share**. Click **Next**, **Next**, and **Finish** to complete the Update Deployment Share Wizard with the default setttings. ### Create and share the MigData folder -1. On MDT01, log on as **CONTOSO\\Administrator**. +On **MDT01**: -2. Create and share the **E:\\MigData** folder by running the following three commands in an elevated Windows PowerShell prompt: +1. Create and share the **D:\\MigData** folder by running the following three commands in an elevated Windows PowerShell prompt: ``` powershell - New-Item -Path E:\MigData -ItemType directory - New-SmbShare ?Name MigData$ ?Path E:\MigData - -ChangeAccess EVERYONE - icacls E:\MigData /grant '"MDT_BA":(OI)(CI)(M)' + New-Item -Path D:\MigData -ItemType directory + New-SmbShare -Name MigData$ -Path D:\MigData -ChangeAccess EVERYONE + icacls D:\MigData /grant '"MDT_BA":(OI)(CI)(M)' ``` ### Create a backup only (replace) task sequence -3. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, select the **Task Sequences** node and create a new folder named **Other**. +2. In Deployment Workbench, under the **MDT Production** deployment share, select the **Task Sequences** node and create a new folder named **Other**. -4. Right-click the **Other** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: +3. Right-click the **Other** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: * Task sequence ID: REPLACE-001 * Task sequence name: Backup Only Task Sequence * Task sequence comments: Run USMT to backup user data and settings * Template: Standard Client Replace Task Sequence -5. In the **Other** folder, double-click **Backup Only Task Sequence**, and then in the **Task Sequence** tab, review the sequence. Notice that it only contains a subset of the normal client task sequence actions. +4. In the **Other** folder, double-click **Backup Only Task Sequence**, and then in the **Task Sequence** tab, review the sequence. Notice that it only contains a subset of the normal client task sequence actions. ![The Backup Only Task Sequence action list](../images/mdt-03-fig02.png "The Backup Only Task Sequence action list") - Figure 2. The Backup Only Task Sequence action list. + The Backup Only Task Sequence action list. -## Perform the computer replace +## Perform the computer replace During a computer replace, these are the high-level steps that occur: 1. On the computer you are replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Window Imaging (WIM) backup. +2. On the new computer, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored. -2. On the new machine, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored. +### Run the replace task sequence -### Execute the replace task sequence +On **PC0002**: -1. On PC0002, log on as **CONTOSO\\Administrator**. - -2. Verify that you have write access to the **\\\\MDT01\\MigData$** share. - -3. Execute **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**. - -4. Complete the Windows Deployment Wizard using the following settings: +1. Sign in as **CONTOSO\\Administrator** and verify that you have write access to the **\\\\MDT01\\MigData$** share. +2. Run **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**. +3. Complete the Windows Deployment Wizard using the following settings: 1. Select a task sequence to execute on this computer: Backup Only Task Sequence * Specify where to save your data and settings: Specify a location @@ -92,21 +100,24 @@ During a computer replace, these are the high-level steps that occur: >If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead. 2. Specify where to save a complete computer backup: Do not back up the existing computer - 3. Password: P@ssw0rd - The task sequence will now run USMT (Scanstate.exe) to capture user data and settings of the machine. + The task sequence will now run USMT (Scanstate.exe) to capture user data and settings of the computer. ![The new task sequence](../images/mdt-03-fig03.png "The new task sequence") - Figure 3. The new task sequence running the Capture User State action on PC0002. + The new task sequence running the Capture User State action on PC0002. -5. On MDT01, verify that you have an USMT.MIG compressed backup file in the **E:\\MigData\\PC0002\\USMT** folder. +4. On **MDT01**, verify that you have an USMT.MIG compressed backup file in the **D:\\MigData\\PC0002\\USMT** folder. ![The USMT backup](../images/mdt-03-fig04.png "The USMT backup") - Figure 4. The USMT backup of PC0002. + The USMT backup of PC0002. -### Deploy the PC0007 virtual machine +### Deploy the replacement computer + +To demonstrate deployment of the replacement computer, HV01 is used to host a virtual machine: PC0007. + +On **HV01**: 1. Create a virtual machine with the following settings: @@ -115,38 +126,40 @@ During a computer replace, these are the high-level steps that occur: * Generation: 2 * Memory: 2048 MB * Hard disk: 60 GB (dynamic disk) + * Install an operating system from a network-based installation server -2. Start the PC0007 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The machine will now load the Windows PE boot image from the WDS server. +2. Start the PC0007 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from MDT01 (or MDT02 if at a remote site). ![The initial PXE boot process](../images/mdt-03-fig05.png "The initial PXE boot process") - Figure 5. The initial PXE boot process of PC0005. + The initial PXE boot process of PC0007. 3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: - * Password: P@ssw0rd * Select a task sequence to execute on this computer: * Windows 10 Enterprise x64 RTM Custom Image * Computer Name: PC0007 - * Applications: Select the Install - Adobe Reader XI - x86 application. + * Move Data and Settings: Do not move user data and settings. + * User Data (Restore) > Specify a location: \\\\MDT01\\MigData$\\PC0002 + * Applications: Adobe > Install - Adobe Reader -4. The setup now starts and does the following: +4. Setup now starts and does the following: + * Partitions and formats the disk. * Installs the Windows 10 Enterprise operating system. - * Installs the added application. + * Installs the application. * Updates the operating system via your local Windows Server Update Services (WSUS) server. * Restores the USMT backup from PC0002. +You can view progress of the process by clicking the Monitoring node in the Deployment Workbrench on MDT01. + +![Monitor progress](../images/mdt-replace.png) + ## Related topics -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) - -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) - -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
              +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
              +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
              +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
              +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
              [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md index 70a3a46434..231b73680a 100644 --- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md +++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md @@ -4,7 +4,7 @@ ms.assetid: 386e6713-5c20-4d2a-a220-a38d94671a38 ms.reviewer: manager: laurawi ms.author: greglin -description: +description: Learn how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. keywords: disk, encryption, TPM, configure, secure, script ms.prod: w10 ms.mktglfcycl: deploy @@ -14,111 +14,119 @@ ms.pagetype: mdt audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-mar2020 --- # Set up MDT for BitLocker This topic will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment: -- A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you also can use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password. -- Multiple partitions on the hard drive. + +- A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you can also use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password. +- Multiple partitions on the hard drive. To configure your environment for BitLocker, you will need to do the following: -1. Configure Active Directory for BitLocker. -2. Download the various BitLocker scripts and tools. -3. Configure the operating system deployment task sequence for BitLocker. -4. Configure the rules (CustomSettings.ini) for BitLocker. +1. Configure Active Directory for BitLocker. +2. Download the various BitLocker scripts and tools. +3. Configure the operating system deployment task sequence for BitLocker. +4. Configure the rules (CustomSettings.ini) for BitLocker. + +> [!NOTE] +> Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery password in Active Directory. For additional information about this feature, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds). +If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. + +> [!NOTE] +> Backing up TPM to Active Directory was supported only on Windows 10 version 1507 and 1511. >[!NOTE] ->Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://go.microsoft.com/fwlink/p/?LinkId=619548). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. - -For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). +>Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/dd875529(v=ws.10)). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. -## Configure Active Directory for BitLocker +For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md). + +## Configure Active Directory for BitLocker To enable BitLocker to store the recovery key and TPM information in Active Directory, you need to create a Group Policy for it in Active Directory. For this section, we are running Windows Server 2012 R2, so you do not need to extend the Schema. You do, however, need to set the appropriate permissions in Active Directory. ->[!NOTE] ->Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory. - -In Windows Server 2012 R2 (as well as in Windows Server 2008 R2 and Windows Server 2012), you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information. +> [!NOTE] +> Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory. + +In Windows Server version from 2008 R2 and later, you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information. ![figure 2](../images/mdt-09-fig02.png) -Figure 2. The BitLocker Recovery information on a computer object in the contoso.com domain. +The BitLocker Recovery information on a computer object in the contoso.com domain. ### Add the BitLocker Drive Encryption Administration Utilities The BitLocker Drive Encryption Administration Utilities are added as features via Server Manager (or Windows PowerShell): -1. On DC01, log on as **CONTOSO\\Administrator**, and, using Server Manager, click **Add roles and features**. -2. On the **Before you begin** page, click **Next**. -3. On the **Select installation type** page, select **Role-based or feature-based installation**, and click **Next**. -4. On the **Select destination server** page, select **DC01.contoso.com** and click **Next**. -5. On the **Select server roles** page, click **Next**. -6. On the **Select features** page, expand **Remote Server Administration Tools**, expand **Feature Administration Tools**, select the following features, and then click **Next**: - 1. BitLocker Drive Encryption Administration Utilities - 2. BitLocker Drive Encryption Tools - 3. BitLocker Recovery Password Viewer -7. On the **Confirm installation selections** page, click **Install** and then click **Close**. +1. On DC01, log on as **CONTOSO\\Administrator**, and, using Server Manager, click **Add roles and features**. +2. On the **Before you begin** page, click **Next**. +3. On the **Select installation type** page, select **Role-based or feature-based installation**, and click **Next**. +4. On the **Select destination server** page, select **DC01.contoso.com** and click **Next**. +5. On the **Select server roles** page, click **Next**. +6. On the **Select features** page, expand **Remote Server Administration Tools**, expand **Feature Administration Tools**, select the following features, and then click **Next**: + 1. BitLocker Drive Encryption Administration Utilities + 2. BitLocker Drive Encryption Tools + 3. BitLocker Recovery Password Viewer +7. On the **Confirm installation selections** page, click **Install** and then click **Close**. ![figure 3](../images/mdt-09-fig03.png) -Figure 3. Selecting the BitLocker Drive Encryption Administration Utilities. +Selecting the BitLocker Drive Encryption Administration Utilities. ### Create the BitLocker Group Policy Following these steps, you enable the backup of BitLocker and TPM recovery information to Active Directory. You also enable the policy for the TPM validation profile. -1. On DC01, using Group Policy Management, right-click the **Contoso** organizational unit (OU), and select **Create a GPO in this domain, and Link it here**. -2. Assign the name **BitLocker Policy** to the new Group Policy. -3. Expand the **Contoso** OU, right-click the **BitLocker Policy**, and select **Edit**. Configure the following policy settings: - Computer Configuration / Policies / Administrative Templates / Windows Components / BitLocker Drive Encryption / Operating System Drives - 1. Enable the **Choose how BitLocker-protected operating system drives can be recovered** policy, and configure the following settings: - 1. Allow data recovery agent (default) - 2. Save BitLocker recovery information to Active Directory Domain Services (default) - 3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives - 2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy. - 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy. - Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services - 4. Enable the **Turn on TPM backup to Active Directory Domain Services** policy. ->[!NOTE] ->If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using. - +1. On DC01, using Group Policy Management, right-click the **Contoso** organizational unit (OU), and select **Create a GPO in this domain, and Link it here**. +2. Assign the name **BitLocker Policy** to the new Group Policy. +3. Expand the **Contoso** OU, right-click the **BitLocker Policy**, and select **Edit**. Configure the following policy settings: + Computer Configuration / Policies / Administrative Templates / Windows Components / BitLocker Drive Encryption / Operating System Drives + 1. Enable the **Choose how BitLocker-protected operating system drives can be recovered** policy, and configure the following settings: + 1. Allow data recovery agent (default) + 2. Save BitLocker recovery information to Active Directory Domain Services (default) + 3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives + 2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy. + 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy. + +> [!NOTE] +> If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using. + ### Set permissions in Active Directory for BitLocker -In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the [Add-TPMSelfWriteACE.vbs script](https://go.microsoft.com/fwlink/p/?LinkId=167133) from Microsoft to C:\\Setup\\Scripts on DC01. -1. On DC01, start an elevated PowerShell prompt (run as Administrator). -2. Configure the permissions by running the following command: +In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the [Add-TPMSelfWriteACE.vbs script](https://gallery.technet.microsoft.com/ScriptCenter/b4dee016-053e-4aa3-a278-3cebf70d1191) from Microsoft to C:\\Setup\\Scripts on DC01. - ``` syntax +1. On DC01, start an elevated PowerShell prompt (run as Administrator). +2. Configure the permissions by running the following command: + + ```dos cscript C:\Setup\Scripts\Add-TPMSelfWriteACE.vbs ``` ![figure 4](../images/mdt-09-fig04.png) -Figure 4. Running the Add-TPMSelfWriteACE.vbs script on DC01. +Running the Add-TPMSelfWriteACE.vbs script on DC01. -## Add BIOS configuration tools from Dell, HP, and Lenovo +## Add BIOS configuration tools from Dell, HP, and Lenovo If you want to automate enabling the TPM chip as part of the deployment process, you need to download the vendor tools and add them to your task sequences, either directly or in a script wrapper. ### Add tools from Dell -The Dell tools are available via the Dell Client Configuration Toolkit (CCTK). The executable file from Dell is named cctk.exe. Here is a sample command to enable TPM and set a BIOS password using the cctk.exe tool: -``` syntax -cctk.exe --tpm=on --valsetuppwd=Password1234 -``` +[Dell Comnmand | Configure](https://www.dell.com/support/article/us/en/04/sln311302/dell-command-configure) provides a Command Line Interface and a Graphical User Interface. + ### Add tools from HP The HP tools are part of HP System Software Manager. The executable file from HP is named BiosConfigUtility.exe. This utility uses a configuration file for the BIOS settings. Here is a sample command to enable TPM and set a BIOS password using the BiosConfigUtility.exe tool: -``` syntax +```dos BIOSConfigUtility.EXE /SetConfig:TPMEnable.REPSET /NewAdminPassword:Password1234 ``` + And the sample content of the TPMEnable.REPSET file: -``` syntax +```txt English Activate Embedded Security On Next Boot *Enable @@ -129,38 +137,37 @@ Allow user to reject Embedded Security Device Availability *Available ``` + ### Add tools from Lenovo The Lenovo tools are a set of VBScripts available as part of the Lenovo BIOS Setup using Windows Management Instrumentation Deployment Guide. Lenovo also provides a separate download of the scripts. Here is a sample command to enable TPM using the Lenovo tools: -``` syntax + +```dos cscript.exe SetConfig.vbs SecurityChip Active ``` -## Configure the Windows 10 task sequence to enable BitLocker -When configuring a task sequence to run any BitLocker tool, either directly or using a custom script, it is helpful if you also add some logic to detect whether the BIOS is already configured on the machine. In the following task sequence, we are using a sample script (ZTICheckforTPM.wsf) from the Deployment Guys web page to check the status on the TPM chip. You can download this script from the Deployment Guys Blog post, [Check to see if the TPM is enabled](https://go.microsoft.com/fwlink/p/?LinkId=619549). +## Configure the Windows 10 task sequence to enable BitLocker + +When configuring a task sequence to run any BitLocker tool, either directly or using a custom script, it is helpful if you also add some logic to detect whether the BIOS is already configured on the machine. In the following task sequence, we are using a sample script (ZTICheckforTPM.wsf) from the Deployment Guys web page to check the status on the TPM chip. You can download this script from the Deployment Guys Blog post, [Check to see if the TPM is enabled](https://go.microsoft.com/fwlink/p/?LinkId=619549). In the following task sequence, we added five actions: -- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script to determine if TPM is enabled. Depending on the status, the script will set the TPMEnabled and TPMActivated properties to either true or false. -- **Configure BIOS for TPM.** Runs the vendor tools (in this case, HP, Dell, and Lenovo). To ensure this action is run only when necessary, add a condition so the action is run only when the TPM chip is not already activated. Use the properties from the ZTICheckforTPM.wsf. - **Note**   - It is common for organizations to wrap these tools in scripts to get additional logging and error handling. - -- **Restart computer.** Self-explanatory, reboots the computer. -- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script one more time. -- **Enable BitLocker.** Runs the built-in action to activate BitLocker. + +- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script to determine if TPM is enabled. Depending on the status, the script will set the TPMEnabled and TPMActivated properties to either true or false. +- **Configure BIOS for TPM.** Runs the vendor tools (in this case, HP, Dell, and Lenovo). To ensure this action is run only when necessary, add a condition so the action is run only when the TPM chip is not already activated. Use the properties from the ZTICheckforTPM.wsf. + + > [!NOTE] + > It is common for organizations to wrap these tools in scripts to get additional logging and error handling. + +- **Restart computer.** Self-explanatory, reboots the computer. +- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script one more time. +- **Enable BitLocker.** Runs the built-in action to activate BitLocker. ## Related topics -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) - +[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
              +[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md)
              +[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
              +[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
              +[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)
              +[Use web services in MDT](use-web-services-in-mdt.md)
              [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md index 6278b32fe5..cb28eea313 100644 --- a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md +++ b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md @@ -18,15 +18,26 @@ ms.topic: article # Simulate a Windows 10 deployment in a test environment -This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. When working with advanced settings and rules, especially those like database calls, it is most efficient to be able to test the settings without having to run through a complete deployment. Luckily, MDT enables you to perform a simulated deployment by running the Gather process by itself. The simulation works best when you are using a domain-joined machine (client or server). In the following example, you use the PC0001 Windows 10 client. -For the purposes of this topic, you already will have either downloaded and installed the free Microsoft System Center 2012 R2 Configuration Manager Toolkit, or copied Configuration Manager Trace (CMTrace) if you have access to the System Center 2012 R2 Configuration Manager media. We also assume that you have downloaded the [sample Gather.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619361) from the TechNet gallery. +This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. When working with advanced settings and rules, especially those like database calls, it is most efficient to be able to test the settings without having to run through a complete deployment. Luckily, MDT enables you to perform a simulated deployment by running the Gather process by itself. The simulation works best when you are using a domain-joined client. -1. On PC0001, log on as **CONTOSO\\Administrator** using the password P@ssw0rd. -2. Using Computer Management, add the **CONTOSO\\MDT\_BA** user account to the local **Administrators** group. -3. Log off, and then log on to PC0001 as **CONTOSO\\MDT\_BA**. -4. Using File Explorer, create a folder named **C:\\MDT**. -5. Copy the downloaded Gather.ps1 script to the **C:\\MDT** folder. -6. From the **\\\\MDT01\\MDTProduction$\\Scripts** folder, copy the following files to **C:\\MDT**: +## Test environment + +- A Windows 10 client named **PC0001** will be used to simulate deployment. The client is joined to the contoso.com domain and has access to the Internet to required download tools and scripts. +- It is assumed that you have performed (at least) the following procedures so that you have an MDT service account and an MDT production deployment share: + - [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) + - [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + - [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) + +## Simulate deployment + +On **PC0001**: + +1. Sign as **contoso\\Administrator**. +2. Download the [sample Gather.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619361) from the TechNet gallery and copy it to a directory named **C:\MDT** on PC0001. +3. Download and install the free [Microsoft System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717) on PC0001 so that you have access to the Configuration Manager Trace (cmtrace.exe) tool. +4. Using Local Users and Groups (lusrmgr.msc), add the **contoso\\MDT\_BA** user account to the local **Administrators** group. +5. Sign off, and then sign on to PC0001 as **contoso\\MDT\_BA**. +6. Open the **\\\\MDT01\\MDTProduction$\\Scripts** folder and copy the following files to **C:\\MDT**: 1. ZTIDataAccess.vbs 2. ZTIGather.wsf 3. ZTIGather.xml @@ -35,36 +46,32 @@ For the purposes of this topic, you already will have either downloaded and inst 8. In the **C:\\MDT** folder, create a subfolder named **X64**. 9. From the **\\\\MDT01\\MDTProduction$\\Tools\\X64** folder, copy the Microsoft.BDD.Utility.dll file to **C:\\MDT\\X64**. - ![figure 6](../images/mdt-09-fig06.png) + ![files](../images/mdt-09-fig06.png) - Figure 6. The C:\\MDT folder with the files added for the simulation environment. + The C:\\MDT folder with the files added for the simulation environment. -10. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press Enter after each command: +10. Type the following at an elevated Windows PowerShell prompt: ``` powershell + Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process -Force Set-Location C:\MDT .\Gather.ps1 ``` -11. Review the ZTIGather.log in the **C:\\MININT\\SMSOSD\\OSDLOGS** folder. + When prompted, press **R** to run the gather script. + +11. Review the ZTIGather.log in the **C:\\MININT\\SMSOSD\\OSDLOGS** folder using CMTrace. **Note** Warnings or errors with regard to the Wizard.hta are expected. If the log file looks okay, you are ready to try a real deployment. + ![ztigather](../images/mdt-09-fig07.png) -![figure 7](../images/mdt-09-fig07.png) - -Figure 7. The ZTIGather.log file from PC0001, displaying some of its hardware capabilities. + The ZTIGather.log file from PC0001. ## Related topics -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) - +[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md)
              +[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
              +[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md)
              +[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
              +[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)
              +[Use web services in MDT](use-web-services-in-mdt.md)
              [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md new file mode 100644 index 0000000000..38604acbf4 --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -0,0 +1,114 @@ +--- +title: Perform an in-place upgrade to Windows 10 with MDT (Windows 10) +description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. +ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Perform an in-place upgrade to Windows 10 with MDT + +**Applies to** +- Windows 10 + +The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. + +>[!TIP] +>In-place upgrade is the preferred method to use when migrating from Windows 10 to a later release of Windows 10, and is also a preferred method for upgrading from Windows 7 or 8.1 if you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple. + +In-place upgrade differs from [computer refresh](refresh-a-windows-7-computer-with-windows-10.md) in that you cannot use a custom image to perform the in-place upgrade. In this article we will add a default Windows 10 image to the production deployment share specifically to perform an in-place upgrade. + +Three computers are used in this topic: DC01, MDT01, and PC0002. + +- DC01 is a domain controller for the contoso.com domain +- MDT01 is a domain member server +- PC0002 is a domain member computer running Windows 7 SP1, targeted for the Windows 10 upgrade + + ![computers](../images/mdt-upgrade.png) + + The computers used in this topic. + +>[!NOTE] +>For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +>If you have already completed all the steps in [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md), then you already have a production deployment share and you can skip to [Add Windows 10 Enterprise x64 (full source)](#add-windows-10-enterprise-x64-full-source). + +## Create the MDT production deployment share + +On **MDT01**: + +1. Ensure you are signed on as: contoso\administrator. +2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. +3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. +4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. +5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. +6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. +7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. + +## Add Windows 10 Enterprise x64 (full source) + +>If you have already have a Windows 10 [reference image](create-a-windows-10-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section. + +On **MDT01**: + +1. Sign in as contoso\\administrator and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. +2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. +3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. +4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files + - Source directory: (location of your source files) + - Destination directory name: W10EX64RTM +5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. + +## Create a task sequence to upgrade to Windows 10 Enterprise + +On **MDT01**: + +1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-UPG + - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade + - Template: Standard Client Upgrade Task Sequence + - Select OS: Windows 10 Enterprise x64 RTM Default Image + - Specify Product Key: Do not specify a product key at this time + - Organization: Contoso + - Admin Password: Do not specify an Administrator password at this time + +## Perform the Windows 10 upgrade + +To initiate the in-place upgrade, perform the following steps on PC0002 (the device to be upgraded). + +On **PC0002**: + +1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** +2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**. +3. Select one or more applications to install (will appear if you use custom image): Install - Adobe Reader +4. On the **Ready** tab, click **Begin** to start the task sequence. + When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. + +![upgrade1](../images/upgrademdt-fig5-winupgrade.png) + +
              + +![upgrade2](../images/mdt-upgrade-proc.png) + +
              + +![upgrade3](../images/mdt-post-upg.png) + +After the task sequence completes, the computer will be fully upgraded to Windows 10. + +## Related topics + +[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
              +[Microsoft Deployment Toolkit downloads and resources](https://go.microsoft.com/fwlink/p/?LinkId=618117) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md index 234a716425..e7cabd8fec 100644 --- a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md @@ -1,177 +1,178 @@ ---- -title: Use Orchestrator runbooks with MDT (Windows 10) -description: This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. -ms.assetid: 68302780-1f6f-4a9c-9407-b14371fdce3f -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: web services, database -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Use Orchestrator runbooks with MDT - -This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. -MDT can integrate with System Center 2012 R2 Orchestrator, which is a component that ties the Microsoft System Center products together, as well as other products from both Microsoft and third-party vendors. The difference between using Orchestrator and "normal" web services, is that with Orchestrator you have a rich drag-and-drop style interface when building the solution, and little or no coding is required. - -**Note**   -If you are licensed to use Orchestrator, we highly recommend that you start using it. To find out more about licensing options for System Center 2012 R2 and Orchestrator, visit the [System Center 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=619553) website. - -## Orchestrator terminology - -Before diving into the core details, here is a quick course in Orchestrator terminology: -- **Orchestrator Server.** This is a server that executes runbooks. -- **Runbooks.** A runbook is similar to a task sequence; it is a series of instructions based on conditions. Runbooks consist of workflow activities; an activity could be Copy File, Get User from Active Directory, or even Write to Database. -- **Orchestrator Designer.** This is where you build the runbooks. In brief, you do that by creating an empty runbook, dragging in the activities you need, and then connecting them in a workflow with conditions and subscriptions. -- **Subscriptions.** These are variables that come from an earlier activity in the runbook. So if you first execute an activity in which you type in a computer name, you can then subscribe to that value in the next activity. All these variables are accumulated during the execution of the runbook. -- **Orchestrator Console.** This is the Microsoft Silverlight-based web page you can use interactively to execute runbooks. The console listens to TCP port 81 by default. -- **Orchestrator web services.** These are the web services you use in the Microsoft Deployment Toolkit to execute runbooks during deployment. The web services listen to TCP port 82 by default. -- **Integration packs.** These provide additional workflow activities you can import to integrate with other products or solutions, like the rest of Active Directory, other System Center 2012 R2 products, or Microsoft Exchange Server, to name a few. - -**Note**   -To find and download additional integration packs, see [Integration Packs for System Center 2012 - Orchestrator](https://go.microsoft.com/fwlink/p/?LinkId=619554). - -## Create a sample runbook - -This section assumes you have Orchestrator 2012 R2 installed on a server named OR01. In this section, you create a sample runbook, which is used to log some of the MDT deployment information into a text file on OR01. - -1. On OR01, using File Explorer, create the **E:\\Logfile** folder, and grant Users modify permissions (NTFS). -2. In the **E:\\Logfile** folder, create the DeployLog.txt file. - **Note** - Make sure File Explorer is configured to show known file extensions so the file is not named DeployLog.txt.txt. - - ![figure 23](../images/mdt-09-fig23.png) - - Figure 23. The DeployLog.txt file. - -3. Using System Center 2012 R2 Orchestrator Runbook Designer, in the **Runbooks** node, create the **1.0 MDT** folder. - - ![figure 24](../images/mdt-09-fig24.png) - - Figure 24. Folder created in the Runbooks node. - -4. In the **Runbooks** node, right-click the **1.0 MDT** folder, and select **New / Runbook**. -5. On the ribbon bar, click **Check Out**. -6. Right-click the **New Runbook** label, select **Rename**, and assign the name **MDT Sample**. -7. Add (using a drag-and-drop operation) the following items from the **Activities** list to the middle pane: - 1. Runbook Control / Initialize Data - 2. Text File Management / Append Line -8. Connect **Initialize Data** to **Append Line**. - - ![figure 25](../images/mdt-09-fig25.png) - - Figure 25. Activities added and connected. - -9. Right-click the **Initialize Data** activity, and select **Properties** -10. On **the Initialize Data Properties** page, click **Add**, change **Parameter 1** to **OSDComputerName**, and then click **Finish**. - - ![figure 26](../images/mdt-09-fig26.png) - - Figure 26. The Initialize Data Properties window. - -11. Right-click the **Append Line** activity, and select **Properties**. -12. On the **Append Line Properties** page, in the **File** text box, type **E:\\Logfile\\DeployLog.txt**. -13. In the **File** encoding drop-down list, select **ASCII**. -14. In the **Append** area, right-click inside the **Text** text box and select **Expand**. - - ![figure 27](../images/mdt-09-fig27.png) - - Figure 27. Expanding the Text area. - -15. In the blank text box, right-click and select **Subscribe / Published Data**. - - ![figure 28](../images/mdt-09-fig28.png) - - Figure 28. Subscribing to data. - -16. In the **Published Data** window, select the **OSDComputerName** item, and click **OK**. -17. After the **{OSDComputerName from "Initialize Data"}** text, type in **has been deployed at** and, once again, right-click and select **Subscribe / Published Data**. -18. In the **Published Data** window, select the **Show common Published Data** check box, select the **Activity end time** item, and click **OK**. - - ![figure 29](../images/mdt-09-fig29.png) - - Figure 29. The expanded text box after all subscriptions have been added. - -19. On the **Append Line Properties** page, click **Finish**. - ## Test the demo MDT runbook - After the runbook is created, you are ready to test it. -20. On the ribbon bar, click **Runbook Tester**. -21. Click **Run**, and in the **Initialize Data Parameters** dialog box, use the following setting and then click **OK**: - - OSDComputerName: PC0010 -22. Verify that all activities are green (for additional information, see each target). -23. Close the **Runbook Tester**. -24. On the ribbon bar, click **Check In**. - -![figure 30](../images/mdt-09-fig30.png) - -Figure 30. All tests completed. - -## Use the MDT demo runbook from MDT - -1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, select the **Task Sequences** node, and create a folder named **Orchestrator**. -2. Right-click the **Orchestrator** node, and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - 1. Task sequence ID: OR001 - 2. Task sequence name: Orchestrator Sample - 3. Task sequence comments: <blank> - 4. Template: Custom Task Sequence -3. In the **Orchestrator** node, double-click the **Orchestrator Sample** task sequence, and then select the **Task Sequence** tab. -4. Remove the default **Application Install** action. -5. Add a **Gather** action and select the **Gather only local data (do not process rules)** option. -6. After the **Gather** action, add a **Set Task Sequence Variable** action with the following settings: - 1. Name: Set Task Sequence Variable - 2. Task Sequence Variable: OSDComputerName - 3. Value: %hostname% -7. After the **Set Task Sequence Variable** action, add a new **Execute Orchestrator Runbook** action with the following settings: - 1. Orchestrator Server: OR01.contoso.com - 2. Use Browse to select **1.0 MDT / MDT Sample**. -8. Click **OK**. - -![figure 31](../images/mdt-09-fig31.png) - -Figure 31. The ready-made task sequence. - -## Run the orchestrator sample task sequence - -Since this task sequence just starts a runbook, you can test this on the PC0001 client that you used for the MDT simulation environment. -**Note**   -Make sure the account you are using has permissions to run runbooks on the Orchestrator server. For more information about runbook permissions, see [Runbook Permissions](https://go.microsoft.com/fwlink/p/?LinkId=619555). - -1. On PC0001, log on as **CONTOSO\\MDT\_BA**. -2. Using an elevated command prompt (run as Administrator), type the following command: - - ``` syntax - cscript \\MDT01\MDTProduction$\Scripts\Litetouch.vbs - ``` -3. Complete the Windows Deployment Wizard using the following information: - 1. Task Sequence: Orchestrator Sample - 2. Credentials: - 1. User Name: MDT\_BA - 2. Password: P@ssw0rd - 3. Domain: CONTOSO -4. Wait until the task sequence is completed and then verify that the DeployLog.txt file in the E:\\Logfile folder on OR01 was updated. - -![figure 32](../images/mdt-09-fig32.png) - -Figure 32. The ready-made task sequence. - -## Related topics - -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Simulate a Windows10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) +--- +title: Use Orchestrator runbooks with MDT (Windows 10) +description: Learn how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. +ms.assetid: 68302780-1f6f-4a9c-9407-b14371fdce3f +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: web services, database +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Use Orchestrator runbooks with MDT + +This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. +MDT can integrate with System Center 2012 R2 Orchestrator, which is a component that ties the Microsoft System Center products together, as well as other products from both Microsoft and third-party vendors. The difference between using Orchestrator and "normal" web services, is that with Orchestrator you have a rich drag-and-drop style interface when building the solution, and little or no coding is required. + +**Note**   +If you are licensed to use Orchestrator, we highly recommend that you start using it. To find out more about licensing options for System Center 2012 R2 and Orchestrator, visit the [System Center 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=619553) website. + +## Orchestrator terminology + +Before diving into the core details, here is a quick course in Orchestrator terminology: +- **Orchestrator Server.** This is a server that executes runbooks. +- **Runbooks.** A runbook is similar to a task sequence; it is a series of instructions based on conditions. Runbooks consist of workflow activities; an activity could be Copy File, Get User from Active Directory, or even Write to Database. +- **Orchestrator Designer.** This is where you build the runbooks. In brief, you do that by creating an empty runbook, dragging in the activities you need, and then connecting them in a workflow with conditions and subscriptions. +- **Subscriptions.** These are variables that come from an earlier activity in the runbook. So if you first execute an activity in which you type in a computer name, you can then subscribe to that value in the next activity. All these variables are accumulated during the execution of the runbook. +- **Orchestrator Console.** This is the Microsoft Silverlight-based web page you can use interactively to execute runbooks. The console listens to TCP port 81 by default. +- **Orchestrator web services.** These are the web services you use in the Microsoft Deployment Toolkit to execute runbooks during deployment. The web services listen to TCP port 82 by default. +- **Integration packs.** These provide additional workflow activities you can import to integrate with other products or solutions, like the rest of Active Directory, other System Center 2012 R2 products, or Microsoft Exchange Server, to name a few. + +**Note**   +To find and download additional integration packs, see [Integration Packs for System Center 2012 - Orchestrator](https://go.microsoft.com/fwlink/p/?LinkId=619554). + +## Create a sample runbook + +This section assumes you have Orchestrator 2012 R2 installed on a server named OR01. In this section, you create a sample runbook, which is used to log some of the MDT deployment information into a text file on OR01. + +1. On OR01, using File Explorer, create the **E:\\Logfile** folder, and grant Users modify permissions (NTFS). +2. In the **E:\\Logfile** folder, create the DeployLog.txt file. + **Note** + Make sure File Explorer is configured to show known file extensions so the file is not named DeployLog.txt.txt. + + ![figure 23](../images/mdt-09-fig23.png) + + Figure 23. The DeployLog.txt file. + +3. Using System Center 2012 R2 Orchestrator Runbook Designer, in the **Runbooks** node, create the **1.0 MDT** folder. + + ![figure 24](../images/mdt-09-fig24.png) + + Figure 24. Folder created in the Runbooks node. + +4. In the **Runbooks** node, right-click the **1.0 MDT** folder, and select **New / Runbook**. +5. On the ribbon bar, click **Check Out**. +6. Right-click the **New Runbook** label, select **Rename**, and assign the name **MDT Sample**. +7. Add (using a drag-and-drop operation) the following items from the **Activities** list to the middle pane: + 1. Runbook Control / Initialize Data + 2. Text File Management / Append Line +8. Connect **Initialize Data** to **Append Line**. + + ![figure 25](../images/mdt-09-fig25.png) + + Figure 25. Activities added and connected. + +9. Right-click the **Initialize Data** activity, and select **Properties** +10. On **the Initialize Data Properties** page, click **Add**, change **Parameter 1** to **OSDComputerName**, and then click **Finish**. + + ![figure 26](../images/mdt-09-fig26.png) + + Figure 26. The Initialize Data Properties window. + +11. Right-click the **Append Line** activity, and select **Properties**. +12. On the **Append Line Properties** page, in the **File** text box, type **E:\\Logfile\\DeployLog.txt**. +13. In the **File** encoding drop-down list, select **ASCII**. +14. In the **Append** area, right-click inside the **Text** text box and select **Expand**. + + ![figure 27](../images/mdt-09-fig27.png) + + Figure 27. Expanding the Text area. + +15. In the blank text box, right-click and select **Subscribe / Published Data**. + + ![figure 28](../images/mdt-09-fig28.png) + + Figure 28. Subscribing to data. + +16. In the **Published Data** window, select the **OSDComputerName** item, and click **OK**. +17. After the **{OSDComputerName from "Initialize Data"}** text, type in **has been deployed at** and, once again, right-click and select **Subscribe / Published Data**. +18. In the **Published Data** window, select the **Show common Published Data** check box, select the **Activity end time** item, and click **OK**. + + ![figure 29](../images/mdt-09-fig29.png) + + Figure 29. The expanded text box after all subscriptions have been added. + +19. On the **Append Line Properties** page, click **Finish**. + ## Test the demo MDT runbook + After the runbook is created, you are ready to test it. +20. On the ribbon bar, click **Runbook Tester**. +21. Click **Run**, and in the **Initialize Data Parameters** dialog box, use the following setting and then click **OK**: + - OSDComputerName: PC0010 +22. Verify that all activities are green (for additional information, see each target). +23. Close the **Runbook Tester**. +24. On the ribbon bar, click **Check In**. + +![figure 30](../images/mdt-09-fig30.png) + +Figure 30. All tests completed. + +## Use the MDT demo runbook from MDT + +1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, select the **Task Sequences** node, and create a folder named **Orchestrator**. +2. Right-click the **Orchestrator** node, and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + 1. Task sequence ID: OR001 + 2. Task sequence name: Orchestrator Sample + 3. Task sequence comments: <blank> + 4. Template: Custom Task Sequence +3. In the **Orchestrator** node, double-click the **Orchestrator Sample** task sequence, and then select the **Task Sequence** tab. +4. Remove the default **Application Install** action. +5. Add a **Gather** action and select the **Gather only local data (do not process rules)** option. +6. After the **Gather** action, add a **Set Task Sequence Variable** action with the following settings: + 1. Name: Set Task Sequence Variable + 2. Task Sequence Variable: OSDComputerName + 3. Value: %hostname% +7. After the **Set Task Sequence Variable** action, add a new **Execute Orchestrator Runbook** action with the following settings: + 1. Orchestrator Server: OR01.contoso.com + 2. Use Browse to select **1.0 MDT / MDT Sample**. +8. Click **OK**. + +![figure 31](../images/mdt-09-fig31.png) + +Figure 31. The ready-made task sequence. + +## Run the orchestrator sample task sequence + +Since this task sequence just starts a runbook, you can test this on the PC0001 client that you used for the MDT simulation environment. +**Note**   +Make sure the account you are using has permissions to run runbooks on the Orchestrator server. For more information about runbook permissions, see [Runbook Permissions](https://go.microsoft.com/fwlink/p/?LinkId=619555). + +1. On PC0001, log on as **CONTOSO\\MDT\_BA**. +2. Using an elevated command prompt (run as Administrator), type the following command: + + ``` syntax + cscript \\MDT01\MDTProduction$\Scripts\Litetouch.vbs + ``` +3. Complete the Windows Deployment Wizard using the following information: + 1. Task Sequence: Orchestrator Sample + 2. Credentials: + 1. User Name: MDT\_BA + 2. Password: P@ssw0rd + 3. Domain: CONTOSO +4. Wait until the task sequence is completed and then verify that the DeployLog.txt file in the E:\\Logfile folder on OR01 was updated. + +![figure 32](../images/mdt-09-fig32.png) + +Figure 32. The ready-made task sequence. + +## Related topics + +[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) + +[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + +[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) + +[Simulate a Windows10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + +[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) + +[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) + +[Use web services in MDT](use-web-services-in-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md index 895381896b..1ca54bbdb6 100644 --- a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md +++ b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md @@ -1,96 +1,97 @@ ---- -title: Use the MDT database to stage Windows 10 deployment information (Windows 10) -description: This topic is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). -ms.assetid: 8956ab54-90ba-45d3-a384-4fdec72c4d46 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.pagetype: mdt -keywords: database, permissions, settings, configure, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Use the MDT database to stage Windows 10 deployment information - -This topic is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). You can use this process, for example, to add the client machines you want to deploy, specify their computer names and IP addresses, indicate applications to be deployed, and determine many additional settings for the machines. - -## Database prerequisites - -MDT can use either SQL Server Express or full SQL Server, but since the deployment database isn't big, even in large enterprise environments, we recommend using the free SQL Server 2012 SP1 Express database in your environment. - ->[!NOTE] ->Be sure to enable Named Pipes when configuring the SQL Server 2012 SP1 Express database. Although it is a legacy protocol, Named Pipes has proven to work well when connecting from Windows Preinstallation Environment (Windows PE) to the SQL Server database. -  -## Create the deployment database - -The MDT database is by default created and managed from the Deployment Workbench. In these steps, we assume you have installed SQL Server 2012 SP1 Express on MDT01. - ->[!NOTE] ->Since SQL Server 2012 SP1 Express runs by default on a separate instance (SQLEXPRESS), the SQL Server Browser service must be running, and the firewall configured to allow traffic to it. Port 1433 TCP and port 1434 UDP need to be opened for inbound traffic on MDT01. -  -1. On MDT01, using Deployment Workbench, expand the MDT Production deployment share, expand **Advanced Configuration**, right-click **Database**, and select **New Database**. -2. In the New DB Wizard, on the **SQL Server Details** page, enter the following settings and click **Next**: - 1. SQL Server Name: MDT01 - 2. Instance: SQLEXPRESS - 3. Port: <blank> - 4. Network Library: Named Pipes -3. On the **Database** page, select **Create a new database**; in the **Database** field, type **MDT** and click **Next**. -4. On the **SQL Share** page, in the **SQL Share** field, type **Logs$** and click **Next**. Click **Next** again and then click **Finish**. - -![figure 8](../images/mdt-09-fig08.png) - -Figure 8. The MDT database added to MDT01. - -## Configure database permissions - -After creating the database, you need to assign permissions to it. In MDT, the account you used to run the deployment is used to access the database. In this environment, the network access account is MDT\_BA. -1. On MDT01, start SQL Server Management Studio. -2. In the **Connect to Server** dialog box, in the **Server name** list, select **MDT01\\SQLEXPRESS** and click **Connect**. -3. In the **Object Explorer** pane, expand the top-level **Security** node, right-click **Logins**, and select **New Login**. - - ![figure 9](../images/mdt-09-fig09.png) - - Figure 9. The top-level Security node. - -4. On the **Login - New** page, next to the **Login** name field, click **Search**, and search for **CONTOSO\\MDT\_BA**. Then in the left pane, select **User Mapping**. Select the **MDT** database, and assign the following roles: - 1. db\_datareader - 2. public (default) -5. Click **OK**, and close SQL Server Management Studio. - -![figure 10](../images/mdt-09-fig10.png) - -Figure 10. Creating the login and settings permissions to the MDT database. - -## Create an entry in the database - -To start using the database, you add a computer entry and assign a description and computer name. Use the computer's MAC Address as the identifier. -1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration**, and expand **Database**. -2. Right-click **Computers**, select **New**, and add a computer entry with the following settings: - 1. Description: New York Site - PC00075 - 2. MacAddress: <PC00075 MAC Address in the 00:00:00:00:00:00 format> - 3. Details Tab / OSDComputerName: PC00075 - -![figure 11](../images/mdt-09-fig11.png) - -Figure 11. Adding the PC00075 computer to the database. - -## Related topics - -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) - -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) +--- +title: Use MDT database to stage Windows 10 deployment info (Windows 10) +description: Learn how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database. +ms.assetid: 8956ab54-90ba-45d3-a384-4fdec72c4d46 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.pagetype: mdt +keywords: database, permissions, settings, configure, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Use the MDT database to stage Windows 10 deployment information + +This topic is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). You can use this process, for example, to add the client machines you want to deploy, specify their computer names and IP addresses, indicate applications to be deployed, and determine many additional settings for the machines. + +## Database prerequisites + +MDT can use either SQL Server Express or full SQL Server, but since the deployment database isn't big, even in large enterprise environments, we recommend using the free SQL Server 2012 SP1 Express database in your environment. + +>[!NOTE] +>Be sure to enable Named Pipes when configuring the SQL Server 2012 SP1 Express database. Although it is a legacy protocol, Named Pipes has proven to work well when connecting from Windows Preinstallation Environment (Windows PE) to the SQL Server database. +  +## Create the deployment database + +The MDT database is by default created and managed from the Deployment Workbench. In these steps, we assume you have installed SQL Server 2012 SP1 Express on MDT01. + +>[!NOTE] +>Since SQL Server 2012 SP1 Express runs by default on a separate instance (SQLEXPRESS), the SQL Server Browser service must be running, and the firewall configured to allow traffic to it. Port 1433 TCP and port 1434 UDP need to be opened for inbound traffic on MDT01. +  +1. On MDT01, using Deployment Workbench, expand the MDT Production deployment share, expand **Advanced Configuration**, right-click **Database**, and select **New Database**. +2. In the New DB Wizard, on the **SQL Server Details** page, enter the following settings and click **Next**: + 1. SQL Server Name: MDT01 + 2. Instance: SQLEXPRESS + 3. Port: <blank> + 4. Network Library: Named Pipes +3. On the **Database** page, select **Create a new database**; in the **Database** field, type **MDT** and click **Next**. +4. On the **SQL Share** page, in the **SQL Share** field, type **Logs$** and click **Next**. Click **Next** again and then click **Finish**. + +![figure 8](../images/mdt-09-fig08.png) + +Figure 8. The MDT database added to MDT01. + +## Configure database permissions + +After creating the database, you need to assign permissions to it. In MDT, the account you used to run the deployment is used to access the database. In this environment, the network access account is MDT\_BA. +1. On MDT01, start SQL Server Management Studio. +2. In the **Connect to Server** dialog box, in the **Server name** list, select **MDT01\\SQLEXPRESS** and click **Connect**. +3. In the **Object Explorer** pane, expand the top-level **Security** node, right-click **Logins**, and select **New Login**. + + ![figure 9](../images/mdt-09-fig09.png) + + Figure 9. The top-level Security node. + +4. On the **Login - New** page, next to the **Login** name field, click **Search**, and search for **CONTOSO\\MDT\_BA**. Then in the left pane, select **User Mapping**. Select the **MDT** database, and assign the following roles: + 1. db\_datareader + 2. public (default) +5. Click **OK**, and close SQL Server Management Studio. + +![figure 10](../images/mdt-09-fig10.png) + +Figure 10. Creating the login and settings permissions to the MDT database. + +## Create an entry in the database + +To start using the database, you add a computer entry and assign a description and computer name. Use the computer's MAC Address as the identifier. +1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration**, and expand **Database**. +2. Right-click **Computers**, select **New**, and add a computer entry with the following settings: + 1. Description: New York Site - PC00075 + 2. MacAddress: <PC00075 MAC Address in the 00:00:00:00:00:00 format> + 3. Details Tab / OSDComputerName: PC00075 + +![figure 11](../images/mdt-09-fig11.png) + +Figure 11. Adding the PC00075 computer to the database. + +## Related topics + +[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) + +[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + +[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) + +[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + +[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) + +[Use web services in MDT](use-web-services-in-mdt.md) + +[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md index 4f7de42969..2d1cffeadc 100644 --- a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md +++ b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md @@ -1,6 +1,6 @@ --- title: Use web services in MDT (Windows 10) -description: In this topic, you will learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. +description: Learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. ms.assetid: 8f47535e-0551-4ccb-8f02-bb97539c6522 ms.reviewer: manager: laurawi diff --git a/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md deleted file mode 100644 index cb8f13a66b..0000000000 --- a/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Add a Windows 10 operating system image using Configuration Manager (Windows 10) -description: Operating system images are typically the production image used for deployment throughout the organization. -ms.assetid: 77f769cc-1a47-4f36-8082-201cd77b8d3b -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: image, deploy, distribute -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Add a Windows 10 operating system image using Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -Operating system images are typically the production image used for deployment throughout the organization. This topic shows you how to add a Windows 10 operating system image created with Microsoft System Center 2012 R2 Configuration Manager, and how to distribute the image to a distribution point. - -For the purposes of this topic, we will use CM01, a machine running Windows Server 2012 R2 Standard, as the distribution point. CM01 is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). Our image is named REFW10-X64-001.wim. For details on building this image, please see [Create a Windows 10 reference image](../deploy-windows-mdt/create-a-windows-10-reference-image.md). - -1. Using File Explorer, in the **E:\\Sources\\OSD\\OS** folder, create a subfolder named **Windows 10 Enterprise x64 RTM**. - -2. Copy the REFW10-X64-001.wim file to the **E:\\Sources\\OSD\\OS\\Windows 10 Enterprise x64 RTM** folder. - - ![figure 17](../images/fig17-win10image.png) - - Figure 17. The Windows 10 image copied to the Sources folder structure. - -3. Using the Configuration Manager Console, in the Software Library workspace, right-click **Operating System Images**, and select **Add Operating System Image**. - -4. On the **Data Source** page, in the **Path:** text box, browse to \\\\CM01\\Sources$\\OSD\\OS\\Windows 10 Enterprise x64 RTM\\REFW10-X64-001.wim and click **Next**. - -5. On the **General** page, assign the name Windows 10 Enterprise x64 RTM and click **Next** twice, and then click **Close**. - -6. Distribute the operating system image to the CM01 distribution point by right-clicking the Windows 10 Enterprise x64 RTM operating system image and selecting **Distribute Content**. - -7. In the Distribute Content Wizard, add the CM01 distribution point. - -8. View the content status for the Windows 10 Enterprise x64 RTM package. Do not continue until the distribution is completed. You also can review the E:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for the **STATMSG: ID=2301** line. - - ![figure 18](../images/fig18-distwindows.png) - - Figure 18. The distributed Windows 10 Enterprise x64 RTM package. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) diff --git a/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md deleted file mode 100644 index ddc3a8a1da..0000000000 --- a/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager (Windows 10) -description: In this topic, you will learn how to configure the Windows Preinstallation Environment (Windows PE) to include the network drivers required to connect to the deployment share and the storage drivers required to see the local storage on machines. -ms.assetid: 97b3ea46-28d9-407e-8c42-ded2e45e8d5c -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, task sequence -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 07/27/2017 -ms.topic: article ---- - -# Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -In this topic, you will learn how to configure the Windows Preinstallation Environment (Windows PE) to include the network drivers required to connect to the deployment share and the storage drivers required to see the local storage on machines. Even though the Windows PE boot image and the Windows 10 operating system contain many out-of-the-box drivers, it is likely you will have to add new or updated drivers to support all your hardware. In this section, you import drivers for both Windows PE and the full Windows 10 operating system. - -For the purposes of this topic, we will use CM01, a machine running Windows Server 2012 R2 Standard that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -## Add drivers for Windows PE - - -This section will show you how to import some network and storage drivers for Windows PE. This section assumes you have downloaded some drivers to the E:\\Sources\\OSD\\DriverSources\\WinPE x64 folder on CM01. - -1. On CM01, using the Configuration Manager Console, in the Software Library workspace, right-click the **Drivers** node and select **Import Driver**. - -2. In the Import New Driver Wizard, on the **Specify a location to import driver** page, below the Import all drivers in the following network path (UNC) option, browse to the **\\\\CM01\\Sources$\\OSD\\DriverSources\\WinPE x64** folder and click **Next**. - -3. On the **Specify the details for the imported driver** page, click **Categories**, create a category named **WinPE x64**, and then click **Next**. - -4. On the **Select the packages to add the imported driver** page, click **Next**. - -5. On the **Select drivers to include in the boot image** page, select the **Zero Touch WinPE x64** boot image. Also select the **Update distribution points when finished** check box, and click **Next** twice. - -![Add drivers to Windows PE](../images/fig21-add-drivers.png "Add drivers to Windows PE") - -*Figure 21. Add drivers to Windows PE* - ->[!NOTE] ->The Updating Boot Image part of the wizard will appear to hang when displaying Done. It will complete in a minute or two. - - -## Add drivers for Windows 10 - - -This section illustrates how to add drivers for Windows 10 through an example in which you want to import Windows 10 drivers for the HP EliteBook 8560w model. For the purposes of this section, we assume that you have downloaded the Windows 10 drivers for the HP EliteBook 8560w model and copied them to the E:\\Sources\\OSD\\DriverSources\\Windows 10 x64\\HP EliteBook 8560w folder on CM01. - -1. On CM01, using the Configuration Manager Console, right-click the **Drivers** folder and select **Import Driver**. - -2. In the Import New Driver Wizard, on the **Specify a location to import driver** page, below the Import all drivers in the following network path (UNC) option, browse to the **\\\\CM01\\Sources$\\OSD\\DriverSources\\Windows 10 x64\\HP EliteBook 8560w** folder and click **Next**. - -3. On the **Specify the details for the imported driver** page, click **Categories**, create a category named Windows 10 x64 - HP EliteBook 8560w, and then click **Next**. - - ![Create driver categories](../images/fig22-createcategories.png "Create driver categories") - - *Figure 22. Create driver categories* - -4. On the **Select the packages to add the imported driver** page, click **New Package**, use the following settings for the package, and then click **Next**: - - * Name: Windows 10 x64 - HP EliteBook 8560w - - * Path: \\\\CM01\\Sources$\\OSD\\DriverPackages\\Windows 10 x64\\HP EliteBook 8560w - - >[!NOTE] - >The package path does not yet exist, so you have to type it in. The wizard will create the new package in that folder. - - -5. On the **Select drivers to include in the boot image** page, do not select anything, and click **Next** twice. After the package has been created, click **Close**. - - >[!NOTE] - >If you want to monitor the driver import process more closely, you can open the SMSProv.log file during driver import. - - ![Drivers imported and a new driver package created](../images/mdt-06-fig26.png "Drivers imported and a new driver package created") - - *Figure 23. Drivers imported and a new driver package created* - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) diff --git a/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md deleted file mode 100644 index 34a005a021..0000000000 --- a/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: Create a custom Windows PE boot image with Configuration Manager (Windows 10) -description: In Microsoft System Center 2012 R2 Configuration Manager, you can create custom Windows Preinstallation Environment (Windows PE) boot images that include extra components and features. -ms.assetid: b9e96974-324d-4fa4-b0ce-33cfc49c4809 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: tool, customize, deploy, boot image -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Create a custom Windows PE boot image with Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -In Microsoft System Center 2012 R2 Configuration Manager, you can create custom Windows Preinstallation Environment (Windows PE) boot images that include extra components and features. This topic shows you how to create a custom Windows PE 5.0 boot image with the Microsoft Deployment Toolkit (MDT) wizard. You can also add the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 to the boot image as part of the boot image creation process. - -For the purposes of this topic, we will use two machines: DC01 and CM01. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. Both are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -## Add DaRT 10 files and prepare to brand the boot image - - -The steps below outline the process for adding DaRT 10 installation files to the MDT installation directory. You also copy a custom background image to be used later. We assume you have downloaded Microsoft Desktop Optimization Pack (MDOP) 2015 and copied the x64 version of MSDaRT10.msi to the C:\\Setup\\DaRT 10 folder. We also assume you have created a custom background image and saved it in C:\\Setup\\Branding on CM01. In this section, we use a custom background image named ContosoBackground.bmp. - -1. Install DaRT 10 (C:\\Setup\\DaRT 10\\MSDaRT10.msi) using the default settings. - -2. Using File Explorer, navigate to the **C:\\Program Files\\Microsoft DaRT\\v10** folder. - -3. Copy the Toolsx64.cab file to the **C:\\Program Files\\Microsoft Deployment Toolkit\\Templates\\Distribution\\Tools\\x64** folder. - -4. Copy the Toolsx86.cab file to the **C:\\Program Files\\Microsoft Deployment Toolkit\\Templates\\Distribution\\Tools\\x86** folder. - -5. Using File Explorer, navigate to the **C:\\Setup** folder. - -6. Copy the **Branding** folder to **E:\\Sources\\OSD**. - -## Create a boot image for Configuration Manager using the MDT wizard - - -By using the MDT wizard to create the boot image in Configuration Manager, you gain additional options for adding components and features to the boot image. In this section, you create a boot image for Configuration Manager using the MDT wizard. - -1. Using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, right-click **Boot Images**, and select **Create Boot Image using MDT**. - -2. On the **Package Source** page, in the **Package source folder to be created (UNC Path):** text box, type **\\\\CM01\\Sources$\\OSD\\Boot\\Zero Touch WinPE x64** and click **Next**. - - >[!NOTE] - >The Zero Touch WinPE x64 folder does not yet exist. The folder will be created later by the wizard. - -3. On the **General Settings** page, assign the name **Zero Touch WinPE x64** and click **Next**. - -4. On the **Options** page, select the **x64** platform, and click **Next**. - -5. On the **Components** page, in addition to the default selected **Microsoft Data Access Components (MDAC/ADO)** support, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. - - ![Add the DaRT component to the Configuration Manager boot image](../images/mdt-06-fig16.png "Add the DaRT component to the Configuration Manager boot image") - - Figure 15. Add the DaRT component to the Configuration Manager boot image. - -6. On the **Customization** page, select the **Use a custom background bitmap file** check box, and in the **UNC path:** text box, browse to **\\\\CM01\\Sources$\\OSD\\Branding\\ ContosoBackground.bmp**. Then click **Next** twice. - - >[!NOTE] - >It will take a few minutes to generate the boot image. - -7. Distribute the boot image to the CM01 distribution point by selecting the **Boot images** node, right-clicking the **Zero Touch WinPE x64** boot image, and selecting **Distribute Content**. - -8. In the Distribute Content Wizard, add the CM01 distribution point, and complete the wizard. - -9. Using Configuration Manager Trace, review the E:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file. Do not continue until you can see that the boot image is distributed. Look for the line that reads STATMSG: ID=2301. You also can view Content Status in the Configuration Manager Console by selecting **the Zero Touch WinPE x86** boot image. - - ![Content status for the Zero Touch WinPE x64 boot image](../images/fig16-contentstatus.png "Content status for the Zero Touch WinPE x64 boot image") - - Figure 16. Content status for the Zero Touch WinPE x64 boot image - -10. Using the Configuration Manager Console, right-click the **Zero Touch WinPE x64** boot image and select **Properties**. - -11. In the **Data Source** tab, select the **Deploy this boot image from the PXE-enabled distribution point** check box, and click **OK**. - -12. Using Configuration Manager Trace, review the E:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for this text: Expanding PS10000B to E:\\RemoteInstall\\SMSImages. - -13. Review the **E:\\RemoteInstall\\SMSImages** folder. You should see three folders containing boot images. Two are from the default boot images, and the third folder (PS10000B) is from your new boot image with DaRT. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -  - -  diff --git a/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md deleted file mode 100644 index e86096e831..0000000000 --- a/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Create an application to deploy with Windows 10 using Configuration Manager (Windows 10) -description: Microsoft System Center 2012 R2 Configuration Manager supports deploying applications as part of the Windows 10 deployment process. -ms.assetid: 2dfb2f39-1597-4999-b4ec-b063e8a8c90c -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deployment, task sequence, custom, customize -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Create an application to deploy with Windows 10 using Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -Microsoft System Center 2012 R2 Configuration Manager supports deploying applications as part of the Windows 10 deployment process. In this section, you create an application in System Center 2012 R2 Configuration Manager that you later configure the task sequence to use. - -For the purposes of this topic, we will use CM01, a machine running Windows Server 2012 R2 Standard that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - ->[!NOTE] ->Even though the new application model is fully supported to deploy via the task sequence, the most reliable way to deploy software via the task sequence is still the legacy packages, especially if you deploy many applications. - -## Example: Create the Adobe Reader XI application - - -The following steps show you how to create the Adobe Reader XI application. This section assumes that you have downloaded the MSI version of Adobe Reader XI to the C:\\Setup\\Adobe Reader XI folder on CM01. - -1. On CM01, using File Explorer, copy the **C:\\Setup\\Adobe Reader XI** folder to the **E:\\Sources\\Software\\Adobe** folder. - -2. Using the Configuration Manager Console, in the Software Library workspace, expand **Application Management**. - -3. Right-click **Applications** and select **Folder / Create Folder**. Assign the name **OSD**. - -4. Right-click the **OSD** folder, and select **Create Application**. - -5. In the Create Application Wizard, on the **General** page, use the following settings: - - * Automatically detect information about this application from installation files - - * Type: Windows Installer (\*.msi file) - - * Location: \\\\CM01\\Sources$\\Software\\Adobe\\Adobe Reader XI - - * \\AdbeRdr11000\_en\_US.msi - - ![The Create Application Wizard](../images/mdt-06-fig20.png "The Create Application Wizard") - - *Figure 19. The Create Application Wizard* - -6. Click **Next**, and wait while Configuration Manager parses the MSI file. - -7. On the **Import Information** page, review the information and then click **Next**. - -8. On the **General Information** page, name the application Adobe Reader XI - OSD Install, click **Next** twice, and then click **Close**. - - >[!NOTE] - >Because it is not possible to reference an application deployment type in the task sequence, you should have a single deployment type for applications deployed by the task sequence. If you are deploying applications via both the task sequence and normal application deployment, and you have multiple deployment types, you should have two applications of the same software. In this section, you add the "OSD Install" suffix to applications that are deployed via the task sequence. If using packages, you can still reference both package and program in the task sequence. - - ![Add the OSD Install suffix to the application name](../images/mdt-06-fig21.png "Add the OSD Install suffix to the application name") - - *Figure 20. Add the "OSD Install" suffix to the application name* - -9. In the **Applications** node, select the Adobe Reader XI - OSD Install application, and click **Properties** on the ribbon bar. - -10. In the **General Information** tab, select the **Allow this application to be installed from the Install Application task sequence action without being deployed** check box, and click **OK**. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) - - - - - - - - - diff --git a/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md deleted file mode 100644 index 71be4f7e4b..0000000000 --- a/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Deploy Windows 10 using PXE and Configuration Manager (Windows 10) -description: In this topic, you will learn how to deploy Windows 10 using Microsoft System Center 2012 R2 Configuration Manager deployment packages and task sequences. -ms.assetid: fb93f514-5b30-4f4b-99dc-58e6860009fa -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deployment, image, UEFI, task sequence -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Deploy Windows 10 using PXE and Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -In this topic, you will learn how to deploy Windows 10 using Microsoft System Center 2012 R2 Configuration Manager deployment packages and task sequences. This topic will walk you through the process of deploying the Windows 10 Enterprise image to a Unified Extensible Firmware Interface (UEFI) machine named PC0001. - -For the purposes of this topic, we will use two additional machines: DC01 and CM01. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. DC01, CM01, and PC0001 are all members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -1. Start the PC0001 machine. At the Pre-Boot Execution Environment (PXE) boot menu, press **Enter** to allow it to PXE boot. - - ![figure 31](../images/mdt-06-fig36.png) - - Figure 31. PXE booting PC0001. - -2. On the **Welcome to the Task Sequence Wizard** page, type in the password **Passw0rd!** and click **Next**. - -3. On the **Select a task sequence to run** page, select **Windows 10 Enterprise x64 RTM** and click **Next**. - -4. On the **Edit Task Sequence Variables** page, double-click the **OSDComputerName** variable, and in the **Value** field, type **PC0001** and click **OK**. Then click **Next**. - -![figure 32](../images/mdt-06-fig37.png) - -Figure 32. Typing in the computer name. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -  - -  - - - - - diff --git a/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md b/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md deleted file mode 100644 index b933315e49..0000000000 --- a/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Deploy Windows 10 with System Center 2012 R2 Configuration Manager (Windows 10) -description: If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. -ms.assetid: eacd7b7b-dde0-423d-97cd-29bde9e8b363 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deployment, custom, boot -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Deploy Windows 10 with System Center 2012 R2 Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT). - -For the purposes of this topic, we will use four machines: DC01, CM01, PC0003, and PC0004. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 standard. PC0003 and PC0004 are machines with Windows 7 SP1, on which Windows 10 will be deployed via both refresh and replace scenarios. In addition to these four ready-made machines, you could also include a few blank virtual machines to be used for bare-metal deployments. DC01, CM01, PC003, and PC0004 are all members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -![figure 1](../images/mdt-06-fig01.png) - -Figure 1. The machines used in this topic. - -## In this section - - -- [Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -- [Prepare for Zero Touch Installation of Windows with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -- [Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -- [Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -- [Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -- [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -- [Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -- [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md) - -- [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -- [Monitor the Windows 10 deployment with Configuration Manager](monitor-windows-10-deployment-with-configuration-manager.md) - -- [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -- [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -## Components of Configuration Manager operating system deployment - - -Operating system deployment with Configuration Manager is part of the normal software distribution infrastructure, but there are additional components. For example, operating system deployment in Configuration Manager may use the State Migration Point role, which is not used by normal application deployment in Configuration Manager. This section describes the Configuration Manager components involved with the deployment of an operating system, such as Windows 10. - -- **State migration point (SMP).** The state migration point is used to store user state migration data during computer replace scenarios. - -- **Distribution point (DP).** The distribution point is used to store all packages in Configuration Manager, including the operating system deployment-related packages. - -- **Software update point (SUP).** The software update point, which is normally used to deploy updates to existing machines, also can be used to update an operating system as part of the deployment process. You also can use offline servicing to update the image directly on the Configuration Manager server. - -- **Reporting services point.** The reporting services point can be used to monitor the operating system deployment process. - -- **Boot images.** Boot images are the Windows Preinstallation Environment (Windows PE) images Configuration Manager uses to start the deployment. - -- **Operating system images.** The operating system image package contains only one file, the custom .wim image. This is typically the production deployment image. - -- **Operating system installers.** The operating system installers were originally added to create reference images using Configuration Manager. Instead, we recommend that you use MDT Lite Touch to create your reference images. For more information on how to create a reference image, see [Create a Windows 10 reference image](../deploy-windows-mdt/create-a-windows-10-reference-image.md). - -- **Drivers.** Like MDT Lite Touch, Configuration Manager also provides a repository (catalog) of managed device drivers. - -- **Task sequences.** The task sequences in Configuration Manager look and feel pretty much like the sequences in MDT Lite Touch, and they are used for the same purpose. However, in Configuration Manager the task sequence is delivered to the clients as a policy via the Management Point (MP). MDT provides additional task sequence templates to Configuration Manager. - - **Note**  Configuration Manager SP1 along with the Windows Assessment and Deployment Kit (ADK) for Windows 10 are required to support management and deployment of Windows 10. - -   - -## See also - - -- [Microsoft Deployment Toolkit downloads and resources](https://go.microsoft.com/fwlink/p/?LinkId=618117) - -- [Windows deployment tools](../windows-deployment-scenarios-and-tools.md) - -- [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) - -- [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](../upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) - -- [Deploy Windows To Go in your organization](../deploy-windows-to-go.md) - -- [Sideload Windows Store apps](https://technet.microsoft.com/library/dn613831.aspx) - -- [Windows ADK for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526803) - -  - -  - - - - - diff --git a/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md deleted file mode 100644 index 097ab5c60f..0000000000 --- a/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md +++ /dev/null @@ -1,194 +0,0 @@ ---- -title: Finalize the operating system configuration for Windows 10 deployment with Configuration Manager (Windows 10) -description: This topic walks you through the steps to finalize the configuration of your Windows 10 operating deployment, which includes enablement of the optional Microsoft Deployment Toolkit (MDT) monitoring for Microsoft System Center 2012 R2 Configuration Manager, logs folder creation, rules configuration, content distribution, and deployment of the previously created task sequence. -ms.assetid: 38b55fa8-e717-4689-bd43-8348751d493e -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: configure, deploy, upgrade -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.topic: article ---- - -# Finalize the operating system configuration for Windows 10 deployment with Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -This topic walks you through the steps to finalize the configuration of your Windows 10 operating deployment, which includes enablement of the optional Microsoft Deployment Toolkit (MDT) monitoring for Microsoft System Center 2012 R2 Configuration Manager, logs folder creation, rules configuration, content distribution, and deployment of the previously created task sequence. - -For the purposes of this topic, we will use two machines: DC01 and CM01. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. Both are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -## Enable MDT monitoring - - -This section will walk you through the process of creating the E:\\MDTProduction deployment share using the MDT Deployment Workbench to enable monitoring for Configuration Manager. - -1. On CM01, using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. Use the following settings for the New Deployment Share Wizard: - - * Deployment share path: E:\\MDTProduction - - * Share name: MDTProduction$ - - * Deployment share description: MDT Production - - * Options: <default settings> - -2. Right-click the **MDT Production** deployment share, and select **Properties**. In the **Monitoring** tab, select the **Enable monitoring for this deployment share** check box, and click **OK**. - - ![Enable MDT monitoring for Configuration Manager](../images/mdt-06-fig31.png) - - *Figure 26. Enable MDT monitoring for Configuration Manager* - -## Create and share the Logs folder - - -To support additional server-side logging in Configuration Manager, you create and share the E:\\Logs folder on CM01 using Windows PowerShell. Then in the next step, you enable server-side logging by modifying the CustomSettings.ini file used by the Configuration Manager task sequence. - -1. On CM01, start an elevated Windows PowerShell prompt (run as Administrator). - -2. Type the following commands, pressing **Enter** after each one: - - ``` - New-Item -Path E:\Logs -ItemType directory - New-SmbShare -Name Logs$ -Path E:\Logs -ChangeAccess EVERYONE - icacls E:\Logs /grant '"CM_NAA":(OI)(CI)(M)' - ``` - -## Configure the rules (Windows 10 x64 Settings package) - - -This section will show you how to configure the rules (the Windows 10 x64 Settings package) to support the Contoso environment. - -1. On CM01, using File Explorer, navigate to the **E:\\Sources\\OSD\\Settings\\Windows 10 x64 Settings** folder. - -2. Using Notepad, edit the CustomSetting.ini file with the following settings: - - ``` - [Settings] - Priority=Default - Properties=OSDMigrateConfigFiles,OSDMigrateMode - [Default] - DoCapture=NO - ComputerBackupLocation=NONE - MachineObjectOU=ou=Workstations,ou=Computers,ou=Contoso,dc=contoso,dc=com - OSDMigrateMode=Advanced - OSDMigrateAdditionalCaptureOptions=/ue:*\* /ui:CONTOSO\* - OSDMigrateConfigFiles=Miguser.xml,Migapp.xml - SLSHARE=\\CM01\Logs$ - EventService=http://CM01:9800 - ApplyGPOPack=NO - ``` - - ![Settings package during deployment](../images/fig30-settingspack.png) - - *Figure 27. The Settings package, holding the rules and the Unattend.xml template used during deployment* - -3. Update the distribution point for the **Windows 10 x64 Settings** package by right-clicking the **Windows 10 x64 Settings** package and selecting **Update Distribution Points**. - - >[!NOTE] - >Although you have not yet added a distribution point, you still need to select Update Distribution Points. That process also updates the Configuration Manager 2012 content library with changes. - - - -## Distribute content to the CM01 distribution portal - - -In Configuration Manager, you can distribute all packages needed by a task sequence in a single task. In this section, you distribute packages that have not yet been distributed to the CM01 distribution point. - -1. **On CM01, using the Configuration Manager Console**, select **Task Sequences**, right-click the **Windows 10 Enterprise x64 RTM** task sequence, and select **Distribute Content.** - -2. In the Distribute Content Wizard, add the CM01 distribution point, and complete the wizard. - -3. Using Configuration Manager Trace, verify the distribution to the CM01 distribution point by reviewing the distmgr.log file, or use the Distribution Status / Content Status option in the Monitoring workspace. Do not continue until you see all the new packages being distributed successfully. - -## Create a deployment for the task sequence - - -This sections provides steps to help you create a deployment for the task sequence. - -1. On CM01, using the Configuration Manager Console, select **Task Sequences**, right-click **Windows 10 Enterprise x64 RTM**, and then select **Deploy**. - -2. On the **General** page, select the **All Unknown Computers** collection and click **Next**. - -3. On the **Deployment Settings** page, use the following settings and then click **Next**: - - * Purpose: Available - - * Make available to the following: Only media and PXE - - ![Configure the deployment settings](../images/mdt-06-fig33.png) - - *Figure 28. Configure the deployment settings* - -4. On the **Scheduling** page, accept the default settings and click **Next**. - -5. On the **User Experience** page, accept the default settings and click **Next**. - -6. On the **Alerts** page, accept the default settings and click **Next**. - -7. On the **Distribution Points** page, accept the default settings, click **Next** twice, and then click **Close**. - - ![Task sequence deployed](../images/fig32-deploywiz.png) - - *Figure 29. The Windows 10 Enterprise x64 RTM task sequence deployed to the All Unknown Computers collections available for media and PXE* - -## Configure Configuration Manager to prompt for the computer name during deployment (optional) - - -You can have Configuration Manager prompt you for a computer name or you can use rules to generate a computer name. For more details on how to do this, see [Configure MDT settings](../deploy-windows-mdt/configure-mdt-settings.md). - -This section provides steps to help you configure the All Unknown Computers collection to have Configuration Manager prompt for computer names. - -1. Using the Configuration Manager Console, in the Asset and Compliance workspace, select **Device Collections**, right-click **All Unknown Computers**, and select **Properties**. - -2. In the **Collection Variables** tab, create a new variable with the following settings: - - * Name: OSDComputerName - - * Clear the **Do not display this value in the Configuration Manager console** check box. - -3. Click **OK**. - - >[!NOTE] - >Configuration Manager can prompt for information in many ways. Using a collection variable with an empty value is just one of them. Another option is the User-Driven Installation (UDI) wizard. - - ![Configure a collection variable](../images/mdt-06-fig35.png) - - *Figure 30. Configure a collection variable* - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) - - diff --git a/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md deleted file mode 100644 index c0e59fd398..0000000000 --- a/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Monitor the Windows 10 deployment with Configuration Manager (Windows 10) -description: In this topic, you will learn how to monitor a Windows 10 deployment that was started previously using Microsoft System Center 2012 R2 Configuration Manager and the Microsoft Deployment Toolkit (MDT) Deployment Workbench. -ms.assetid: 4863c6aa-6369-4171-8e1a-b052ca195fce -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, upgrade -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Monitor the Windows 10 deployment with Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -In this topic, you will learn how to monitor a Windows 10 deployment that was started previously using Microsoft System Center 2012 R2 Configuration Manager and the Microsoft Deployment Toolkit (MDT) Deployment Workbench. You will also use the Deployment Workbench to access the computer remotely via the Microsoft Diagnostics and Recovery Toolkit (DaRT) Remote Connection feature. - -For the purposes of this topic, we will use four machines: DC01, CM01, and PC0001. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. PC0001 is a Unified Extensible Firmware Interface (UEFI) machine to which Windows 10 Enterprise has been deployed. DC01, CM01, and PC0001 are all members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -To monitor an operating system deployment conducted through System Center 2012 R2 Configuration Manager, you will use the Deployment Workbench in MDT as follows: - -1. On CM01, using the Deployment Workbench, expand **MDT Production**, and use the **Monitoring** node to view the deployment process (press **F5** to refresh). - - >[!NOTE] - >It takes a little while for the task sequence to start reporting monitor information, so if PC0001 does not appear when you press F5 the first time, wait 20 seconds and try again. - - ![PC0001 being deployed by Configuration Manager](../images/mdt-06-fig39.png) - - *Figure 33. PC0001 being deployed by Configuration Manager* - -2. When you see the PC0001 entry, double-click **PC0001**, and then click **DaRT Remote Control** and review the **Remote Control** option. - -3. The task sequence will now run and do the following: - - * Install the Windows 10 operating system. - - * Install the Configuration Manager client and the client hotfix. - - * Join the machine to the domain. - - * Install the application added to the task sequence. - - >[!NOTE] - >You also can use the built-in reports to get information about ongoing deployments. For example, a task sequence report gives you a quick overview of the task sequence progress. -   -4. If time permits, allow the deployment of PC0001 to complete. Then log in as Administrator in the CONTOSO domain and verify that Adobe Reader XI was installed. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -  - -  - - - - - diff --git a/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md deleted file mode 100644 index d7435593a7..0000000000 --- a/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md +++ /dev/null @@ -1,285 +0,0 @@ ---- -title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager (Windows 10) -description: This topic will walk you through the process of integrating Microsoft System Center 2012 R2 Configuration Manager SP1 with Microsoft Deployment Toolkit (MDT) 2013 Update 2, as well as the other preparations needed to deploying Windows 10 via Zero Touch Installation. Additional preparations include the installation of hotfixes as well as activities that speed up the Pre-Boot Execution Environment (PXE). -ms.assetid: 06e3a221-31ef-47a5-b4da-3b927cb50d08 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: install, configure, deploy, deployment -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.topic: article ---- - -# Prepare for Zero Touch Installation of Windows 10 with Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -This topic will walk you through the process of integrating Microsoft System Center 2012 R2 Configuration Manager SP1 with Microsoft Deployment Toolkit (MDT) 2013 Update 2, as well as the other preparations needed to deploying Windows 10 via Zero Touch Installation. Additional preparations include the installation of hotfixes as well as activities that speed up the Pre-Boot Execution Environment (PXE). - -## Prerequisites - - -In this topic, you will use an existing Configuration Manager server structure to prepare for operating system deployment. In addition to the base setup, the following configurations should be made in the Configuration Manager environment: - -- Active Directory Schema has been extended and System Management container created. - -- Active Directory Forest Discovery and Active Directory System Discovery have been enabled. - -- IP range boundaries and a boundary group for content and site assignment have been created. - -- The Configuration Manager reporting services point role has been added and configured - -- A file system folder structure for packages has been created. - -- A Configuration Manager console folder structure for packages has been created. - -- System Center 2012 R2 Configuration Manager SP1 and any additional Windows 10 prerequisites are installed. - -For the purposes of this topic, we will use two machines: DC01 and CM01. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. DC01 and CM01 are both members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -## Create the Configuration Manager service accounts - - -To configure permissions for the various service accounts needed for operating system deployment in Configuration Manager, you use a role-based model. To create the Configuration Manager Join Domain account as well as the Configuration Manager Network Access account, follow these steps: - -1. On DC01, using Active Directory User and Computers, browse to **contoso.com / Contoso / Service Accounts**. - -2. Select the Service Accounts OU and create the CM\_JD account using the following settings: - - * Name: CM\_JD - - * User logon name: CM\_JD - - * Password: P@ssw0rd - - * User must change password at next logon: Clear - - * User cannot change password: Select - - * Password never expires: Select - -3. Repeat the step, but for the CM\_NAA account. - -4. After creating the accounts, assign the following descriptions: - - * CM\_JD: Configuration Manager Join Domain Account - - * CM\_NAA: Configuration Manager Network Access Account - -![figure 6](../images/mdt-06-fig06.png) - -Figure 6. The Configuration Manager service accounts used for operating system deployment. - -## Configure Active Directory permissions - - -In order for the Configuration Manager Join Domain Account (CM\_JD) to join machines into the contoso.com domain you need to configure permissions in Active Directory. These steps assume you have downloaded the sample [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copied it to C:\\Setup\\Scripts on DC01. - -1. On DC01, log on as Administrator in the CONTOSO domain using the password P@ssw0rd. - -2. In an elevated Windows PowerShell prompt (run as Administrator), run the following commands, pressing **Enter** after each command: - - ``` - Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force - - Set-Location C:\Setup\Scripts - - .\Set-OUPermissions.ps1 -Account CM_JD - -TargetOU "OU=Workstations,OU=Computers,OU=Contoso" - ``` - -3. The Set-OUPermissions.ps1 script allows the CM\_JD user account permissions to manage computer accounts in the Contoso / Computers / Workstations OU. The following is a list of the permissions being granted: - - * Scope: This object and all descendant objects - - * Create Computer objects - - * Delete Computer objects - - * Scope: Descendant Computer objects - - * Read All Properties - - * Write All Properties - - * Read Permissions - - * Modify Permissions - - * Change Password - - * Reset Password - - * Validated write to DNS host name - - * Validated write to service principal name - -## Review the Sources folder structure - - -To support the packages you create in this section, the following folder structure should be created on the Configuration Manager primary site server (CM01): - ->[!NOTE] ->In most production environments, the packages are stored on a Distributed File System (DFS) share or a "normal" server share, but in a lab environment you can store them on the site server. - -- E:\\Sources - -- E:\\Sources\\OSD - -- E:\\Sources\\OSD\\Boot - -- E:\\Sources\\OSD\\DriverPackages - -- E:\\Sources\\OSD\\DriverSources - -- E:\\Sources\\OSD\\MDT - -- E:\\Sources\\OSD\\OS - -- E:\\Sources\\OSD\\Settings - -- E:\\Sources\\Software - -- E:\\Sources\\Software\\Adobe - -- E:\\Sources\\Software\\Microsoft - -![figure 7](../images/mdt-06-fig07.png) - -Figure 7. The E:\\Sources\\OSD folder structure. - -## Integrate Configuration Manager with MDT - - -To extend the Configuration Manager console with MDT wizards and templates, you install MDT in the default location and run the integration setup. In these steps, we assume you have downloaded MDT to the C:\\Setup\\MDT2013 folder on CM01. - -1. On CM01, log on as Administrator in the CONTOSO domain using the password P@ssw0rd. - -2. Make sure the Configuration Manager Console is closed before continuing. - -3. Using File Explorer, navigate to the **C:\\Setup\\MDT** folder. - -4. Run the MDT setup (MicrosoftDeploymentToolkit2013\_x64.msi), and use the default options in the setup wizard. - -5. From the Start screen, run Configure ConfigManager Integration with the following settings: - - * Site Server Name: CM01.contoso.com - - * Site code: PS1 - -![figure 8](../images/mdt-06-fig08.png) - -Figure 8. Set up the MDT integration with Configuration Manager. - -## Configure the client settings - - -Most organizations want to display their name during deployment. In this section, you configure the default Configuration Manager client settings with the Contoso organization name. - -1. On CM01, using the Configuration Manager Console, in the Administration workspace, select **Client Settings**. - -2. In the right pane, right-click **Default Client Settings**, and select **Properties**. - -3. In the **Computer Agent** node, in the **Organization name displayed in Software Center** text box, type in **Contoso** and click **OK**. - -![figure 9](../images/mdt-06-fig10.png) - -Figure 9. Configure the organization name in client settings. - -![figure 10](../images/fig10-contosoinstall.png) - -Figure 10. The Contoso organization name displayed during deployment. - -## Configure the Network Access account - - -Configuration Manager uses the Network Access account during the Windows 10 deployment process to access content on the distribution point(s). In this section, you configure the Network Access account. - -1. Using the Configuration Manager Console, in the Administration workspace, expand **Site Configuration** and select **Sites**. - -2. Right-click **PS1 - Primary Site 1**, select **Configure Site Components**, and then select **Software Distribution**. - -3. In the **Network Access Account** tab, configure the **CONTOSO\\CM\_NAA** user account (select New Account) as the Network Access account. Use the new **Verify** option to verify that the account can connect to the **\\\\DC01\\sysvol** network share. - -![figure 11](../images/mdt-06-fig12.png) - -Figure 11. Test the connection for the Network Access account. - -## Enable PXE on the CM01 distribution point - - -Configuration Manager has many options for starting a deployment, but starting via PXE is certainly the most flexible in a large environment. In this section, you enable PXE on the CM01 distribution point. - -1. In the Configuration Manager Console, in the Administration workspace, select **Distribution Points**. - -2. Right-click the **\\\\CM01.CONTOSO.COM distribution point** and select **Properties**. - -3. In the **PXE** tab, select the following settings: - - * Enable PXE support for clients - - * Allow this distribution point to respond to incoming PXE requests - - * Enable unknown computer support - - * Require a password when computers use PXE - - * Password and Confirm password: Passw0rd! - - ![figure 12](../images/mdt-06-fig13.png) - - Figure 12. Configure the CM01 distribution point for PXE. - -4. Using the Configuration Manager Trace Log Tool, review the E:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file. Look for ConfigurePXE and CcmInstallPXE lines. - - ![figure 13](../images/mdt-06-fig14.png) - - Figure 13. The distmgr.log displays a successful configuration of PXE on the distribution point. - -5. Verify that you have seven files in each of the folders **E:\\RemoteInstall\\SMSBoot\\x86** and **E:\\RemoteInstall\\SMSBoot\\x64**. - - ![figure 14](../images/mdt-06-fig15.png) - - Figure 14. The contents of the E:\\RemoteInstall\\SMSBoot\\x64 folder after you enable PXE. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) - - - - - - - - - diff --git a/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md deleted file mode 100644 index 78e75ded51..0000000000 --- a/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) -description: This topic will show you how to use a previously created task sequence to refresh a Windows 7 SP1 client with Windows 10 using Microsoft System Center 2012 R2 Configuration Manager and Microsoft Deployment Toolkit (MDT) 2013 Update 2. -ms.assetid: 57c81667-1019-4711-b3de-15ae9c5387c7 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: upgrade, install, installation, computer refresh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -This topic will show you how to use a previously created task sequence to refresh a Windows 7 SP1 client with Windows 10 using Microsoft System Center 2012 R2 Configuration Manager and Microsoft Deployment Toolkit (MDT) 2013 Update 2. When refreshing a machine to a later version, it appears as an upgrade to the end user, but technically it is not an in-place upgrade. A computer refresh also involves taking care of user data and settings from the old installation and making sure to restore those at the end of the installation. For more information, see [Refresh a Windows 7 computer with Windows 10](../deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md). - -A computer refresh with System Center 2012 R2 Configuration Manager works the same as it does with MDT Lite Touch installation. Configuration Manager also uses the User State Migration Tool (USMT) from the Windows Assessment and Deployment Kit (Windows ADK) 10 in the background. A computer refresh with Configuration Manager involves the following steps: - -1. Data and settings are backed up locally in a backup folder. - -2. The partition is wiped, except for the backup folder. - -3. The new operating system image is applied. - -4. Other applications are installed. - -5. Data and settings are restored. - -For the purposes of this topic, we will use three machines: DC01, CM01, and PC0003. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. PC0003 is a machine with Windows 7 SP1, on which Windows 10 will be deployed. DC01, CM01, and PC003 are all members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -In this topic, we assume that you have a Windows 7 SP1 client named PC0003 with the Configuration Manager client installed. - -## Create a device collection and add the PC0003 computer - - -1. On CM01, using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings: - - * General - - * Name: Install Windows 10 Enterprise x64 - - * Limited Collection: All Systems - - * Membership rules: - - * Direct rule - - * Resource Class: System Resource - - * Attribute Name: Name - - * Value: PC0003 - - * Select **Resources** - - * Select **PC0003** - -2. Review the Install Windows 10 Enterprise x64 collection. Do not continue until you see the PC0003 machine in the collection. - - >[!NOTE] - >It may take a short while for the collection to refresh; you can view progress via the Colleval.log file. If you want to speed up the process, you can manually update membership on the Install Windows 10 Enterprise x64 collection by right-clicking the collection and selecting Update Membership. - - - -## Create a new deployment - - -Using the Configuration Manager console, in the Software Library workspace, select **Task Sequences**, right-click **Windows 10 Enterprise x64 RTM**, and then select **Deploy**. Use the following settings: - -- General - - - Collection: Install Windows 10 Enterprise x64 - -- Deployment Settings - - - Purpose: Available - - - Make available to the following: Configuration Manager clients, media and PXE - - >[!NOTE] - >It is not necessary to make the deployment available to media and Pre-Boot Execution Environment (PXE) for a computer refresh, but you will use the same deployment for bare-metal deployments later on and you will need it at that point. - - - -- Scheduling - - - <default> - -- User Experience - - - <default> - -- Alerts - - - <default> - -- Distribution Points - - - <default> - -## Initiate a computer refresh - - -Now you can start the computer refresh on PC0003. - -1. Using the Configuration Manager console, in the Asset and Compliance workspace, in the Install Windows 10 Enterprise x64 collection, right-click **PC0003** and select **Client Notification / Download Computer Policy**. Click **OK**. - - >[!NOTE] - >The Client Notification feature is new in Configuration Manager. - -2. On PC0003, using the Software Center (begin using the Start screen, or click the **New software is available** balloon in the system tray), select the **Windows 10 Enterprise x64 RTM** deployment and click **INSTALL**. - -3. In the **Software Center** warning dialog box, click **INSTALL OPERATING SYSTEM**. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) diff --git a/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md deleted file mode 100644 index 45d77e1fa1..0000000000 --- a/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ /dev/null @@ -1,240 +0,0 @@ ---- -title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) -description: In this topic, you will learn how to replacing a Windows 7 SP1 computer using Microsoft System Center 2012 R2 Configuration Manager. -ms.assetid: 3c8a2d53-8f08-475f-923a-bca79ca8ac36 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: upgrade, install, installation, replace computer, setup -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager - - -**Applies to** - -- Windows 10 versions 1507, 1511 - ->[!IMPORTANT] ->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems). ->Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10). - -In this topic, you will learn how to replace a Windows 7 SP1 computer using Microsoft System Center 2012 R2 Configuration Manager. This process is similar to refreshing a computer, but since you are replacing the machine, you have to run the backup job separately from the deployment of Windows 10. - -For the purposes of this topic, we will use three machines: DC01, CM01, and PC0004. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. PC0004 is a machine with Windows 7 SP1 that will be replaced with a new machine running Windows 10. DC01, CM01, and PC0004 are all members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -In this topic, you will create a backup-only task sequence that you run on PC0004, the machine you are replacing. For more information, see [Replace a Windows 7 computer with a Windows 10 computer](../deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md). - -## Create a replace task sequence - - -1. On CM01, using the Configuration Manager Console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and select **Create MDT Task Sequence**. - -2. On the **Choose Template** page, select the **Client Replace Task Sequence** template and click **Next**. - -3. On the **General** page, assign the following settings and click **Next**: - - * Task sequence name: Replace Task Sequence - - * Task sequence comments: USMT backup only - -4. On the **Boot Image** page, browse and select the **Zero Touch WinPE x64** boot image package. Then click **Next**. - -5. On the **MDT Package** page, browse and select the **OSD / MDT** package. Then click **Next**. - -6. On the **USMT Package** page, browse and select the O**SD / Microsoft Corporation User State Migration Tool for Windows 8 10.0.10240.16384** package. Then click **Next**. - -7. On the **Settings Package** page, browse and select the **OSD / Windows 10 x64 Settings** package. Then click **Next**. - -8. On the **Summary** page, review the details and then click **Next**. - -9. On the **Confirmation** page, click **Finish**. - -10. Review the Replace Task Sequence. - >[!NOTE] - >This task sequence has many fewer actions than the normal client task sequence. If it doesn't seem different, make sure you selected the Client Replace Task Sequence template when creating the task sequence. - -![The back-up only task sequence](../images/mdt-06-fig42.png "The back-up only task sequence") - -Figure 34. The backup-only task sequence (named Replace Task Sequence). - -## Associate the new machine with the old computer - - -This section walks you through the process of associating a blank machine, PC0006, with an old machine, PC0004, for the purpose of replacing PC0004 with PC0006. PC0006 can be either a physical or virtual machine. - -1. Make a note of the PC0006 machine's MAC Address. (If PC0006 is a virtual machine, you can see the MAC Address in the virtual machine settings.) In our example, the PC0006 MAC Address is 00:15:5D:0A:6A:96. - -2. Using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Devices**, and then select **Import Computer Information**. - -3. On the **Select Source** page, select **Import single computer** and click **Next**. - -4. On the **Single Computer** page, use the following settings and then click **Next**: - - * Computer Name: PC0006 - - * MAC Address: <the mac address from step 1> - - * Source Computer: PC0004 - - ![Create the computer association](../images/mdt-06-fig43.png "Create the computer association") - - Figure 35. Creating the computer association between PC0004 and PC0006. - -5. On the **User Accounts** page, select **Capture and restore all user accounts** and click **Next**. - -6. On the **Data Preview** page, click **Next**. - -7. On the **Choose Target Collection** page, select the **Install Windows 10 Enterprise x64** collection and click **Next**. - -8. On the **Summary** page, click **Next**, and then click **Close**. - -9. Select the **User State Migration** node and review the computer association in the right pane. - -10. Right-click the **PC0004/PC0006** association and select **View Recovery Information**. Note that a recovery key has been assigned already, but a user state store location has not. - -11. Review the Install Windows 10 Enterprise x64 collection. Do not continue until you see the PC0006 machine in the collection. You might have to update and refresh the collection again. - -## Create a device collection and add the PC0004 computer - - -1. On CM01, using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings. - - * General - - * Name: USMT Backup (Replace) - - * Limited Collection: All Systems - - * Membership rules: - - * Direct rule - - * Resource Class: System Resource - - * Attribute Name: Name - - * Value: PC0004 - - * Select **Resources** - - * Select **PC0004** - -2. Review the USMT Backup (Replace) collection. Do not continue until you see the PC0004 machine in the collection. - -## Create a new deployment - - -Using the Configuration Manager console, in the Software Library workspace, select **Task Sequences**, right-click **Replace Task Sequence**, and then select **Deploy**. Use the following settings: - -- General - - - Collection: USMT Backup (Replace) - -- Deployment Settings - - - Purpose: Available - - - Make available to the following: Only Configuration Manager Clients - -- Scheduling - - - <default> - -- User Experience - - - <default> - -- Alerts - - - <default> - -- Distribution Points - - - <default> - -## Verify the backup - - -This section assumes that you have a machine named PC0004 with the Configuration Manager 2012 client installed. - -1. Start the PC0004 machine, and using the Control Panel, start the Configuration Manager applet. - -2. In the **Actions** tab, select the **Machine Policy Retrieval & Evaluation Cycle**, select **Run Now**, and click **OK**. - - >[!NOTE] - >You also can use the Client Notification option in the Configuration Manager console, as shown in [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md). - -3. Using the Software Center, select the **Replace Task Sequence** deployment and click **INSTALL**. - -4. In the **Software Center** dialog box, click **INSTALL OPERATING SYSTEM**. - -5. Allow the Replace Task Sequence to complete. It should only take about five minutes. - -6. On CM01, in the **D:\\MigData** folder, verify that a folder was created containing the USMT backup. - -7. Using the Configuration Manager console, in the Asset and Compliance workspace, select the **User State Migration** node, right-click the **PC0004/PC0006** association, and select **View Recovery Information**. Note that the object now also has a user state store location. - - >[!NOTE] - >It may take a few minutes for the user state store location to be populated. - - - -## Deploy the new computer - - -1. Start the PC0006 virtual machine, press **F12** to Pre-Boot Execution Environment (PXE) boot when prompted. Allow it to boot Windows Preinstallation Environment (Windows PE), and then complete the deployment wizard using the following settings: - - * Password: P@ssw0rd - - * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 Custom Image - -2. The setup now starts and does the following: - - * Installs the Windows 10 operating system - - * Installs the Configuration Manager client - - * Joins it to the domain - - * Installs the applications - - * Restores the PC0004 backup - -When the process is complete, you will have a new Windows 10 machine in your domain with user data and settings restored. - -## Related topics - - -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) - -[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - -[Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) - -[Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) - -[Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) - -[Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) - -[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) - -[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) - -[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) - - - - - - - - - diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md index b54532b820..90d0dc48d1 100644 --- a/windows/deployment/deploy-windows-to-go.md +++ b/windows/deployment/deploy-windows-to-go.md @@ -1,19 +1,20 @@ --- title: Deploy Windows To Go in your organization (Windows 10) -description: This topic helps you to deploy Windows To Go in your organization. +description: Learn how to deploy Windows To Go in your organization through a wizard in the user interface as well as programatically with Windows PowerShell. ms.assetid: cfe550be-ffbd-42d1-ab4d-80efae49b07f ms.reviewer: manager: laurawi ms.audience: itpro author: greg-lindsay +ms.author: greglin keywords: deployment, USB, device, BitLocker, workspace, security, data ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobility audience: itpro -author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deploy Windows To Go in your organization @@ -25,8 +26,8 @@ ms.topic: article This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. ## Deployment tips @@ -113,7 +114,7 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } - #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase. # # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData @@ -161,7 +162,7 @@ W:\Windows\System32\bcdboot W:\Windows /f ALL /s S: ``` ~~~ -5. Apply SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: +5. Apply SAN policy—OFFLINE\_INTERNAL - "4" to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: ``` @@ -291,7 +292,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i - A domain-joined computer running Windows 8 or later and is configured as a Windows To Go host computer -- A Windows To Go drive that hasn’t been booted or joined to the domain using unattend settings. +- A Windows To Go drive that hasn't been booted or joined to the domain using unattend settings. - A domain user account with rights to add computer accounts to the domain and is a member of the Administrator group on the Windows To Go host computer @@ -319,7 +320,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } - #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase. # # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData @@ -414,7 +415,7 @@ dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /ind >[!NOTE] >Depending on your DirectAccess configuration you might be asked to insert your smart card to log on to the domain. -You should now be able to access your organization’s network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises. +You should now be able to access your organization's network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises. ### Enable BitLocker protection for your Windows To Go drive @@ -467,7 +468,7 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } - #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase. # # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData @@ -576,17 +577,17 @@ The sample script creates an unattend file that streamlines the deployment proce * To run this sample script you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts. -* Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put “Domain admins” into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. +* Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put "Domain admins" into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. * The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters. #### To run the advanced deployment sample script -1. Copy entire the code sample titled “Windows To Go multiple drive provisioning sample script” into a PowerShell script (.ps1) file. +1. Copy entire the code sample titled "Windows To Go multiple drive provisioning sample script" into a PowerShell script (.ps1) file. 2. Make the modifications necessary for it to be appropriate to your deployment and save the file. -3. Configure the PowerShell execution policy. By default PowerShell’s execution policy is set to Restricted; that means that scripts won’t run until you have explicitly given them permission to. To configure PowerShell’s execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: +3. Configure the PowerShell execution policy. By default PowerShell's execution policy is set to Restricted; that means that scripts won't run until you have explicitly given them permission to. To configure PowerShell's execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: ``` Set-ExecutionPolicy RemoteSigned diff --git a/windows/deployment/deploy.md b/windows/deployment/deploy.md index 90bcabb6d6..ecf21c9ffc 100644 --- a/windows/deployment/deploy.md +++ b/windows/deployment/deploy.md @@ -1,47 +1,40 @@ ---- -title: Deploy Windows 10 (Windows 10) -description: Deploying Windows 10 for IT professionals. -ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.localizationpriority: medium -ms.date: 11/06/2018 -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Deploy Windows 10 - -Windows 10 upgrade options are discussed and information is provided about planning, testing, and managing your production deployment. Procedures are provided to help you with a new deployment of the Windows 10 operating system, or to upgrade from a previous version of Windows to Windows 10. The following sections and topics are available. - - -|Topic |Description | -|------|------------| -|[Overview of Windows Autopilot](windows-autopilot/windows-autopilot.md) |This topic provides an overview of Windows Autopilot deployment, a new zero-touch method for deploying Windows 10 in the enterprise. | -|[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This topic provides information about support for upgrading directly to Windows 10 from a previous operating system. | -|[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This topic provides information about support for upgrading from one edition of Windows 10 to another. | -|[Windows 10 volume license media](windows-10-media.md) |This topic provides information about updates to volume licensing media in the current version of Windows 10. | -|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | -|[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). | -|[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. | -|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). | -|[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) |If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or. | -|[Windows 10 deployment tools](windows-10-deployment-tools-reference.md) |Learn about available tools to deploy Windows 10, such as the Windows ADK, DISM, USMT, WDS, MDT, Windows PE and more. | -|[How to install fonts that are missing after upgrading to Windows 10](windows-10-missing-fonts.md)|Windows 10 introduced changes to the fonts that are included in the image by default. Learn how to install additional fonts from **Optional features** after you install Windows 10 or upgrade from a previous version.| - -## Related topics - -[Modern Destop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) - -  - -  - - - - - +--- +title: Deploy Windows 10 (Windows 10) +description: Learn about Windows 10 upgrade options for planning, testing, and managing your production deployment. +ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Deploy Windows 10 + +Windows 10 upgrade options are discussed and information is provided about planning, testing, and managing your production deployment. Procedures are provided to help you with a new deployment of the Windows 10 operating system, or to upgrade from a previous version of Windows to Windows 10. The following sections and topics are available. + + +|Topic |Description | +|------|------------| +|[Overview of Windows Autopilot](windows-autopilot/windows-autopilot.md) |This topic provides an overview of Windows Autopilot deployment, a new zero-touch method for deploying Windows 10 in the enterprise. | +|[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This topic provides information about support for upgrading directly to Windows 10 from a previous operating system. | +|[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This topic provides information about support for upgrading from one edition of Windows 10 to another. | +|[Windows 10 volume license media](windows-10-media.md) |This topic provides information about updates to volume licensing media in the current version of Windows 10. | +|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | +|[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md). | +|[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. | +|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). | +|[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) |If you have Microsoft Endpoint Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or. | +|[Windows 10 deployment tools](windows-10-deployment-tools-reference.md) |Learn about available tools to deploy Windows 10, such as the Windows ADK, DISM, USMT, WDS, MDT, Windows PE and more. | +|[How to install fonts that are missing after upgrading to Windows 10](windows-10-missing-fonts.md)|Windows 10 introduced changes to the fonts that are included in the image by default. Learn how to install additional fonts from **Optional features** after you install Windows 10 or upgrade from a previous version.| + +## Related topics + +[Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) \ No newline at end of file diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index cf43dc83df..bc71e70299 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -21,7 +21,9 @@ "files": [ "**/*.png", "**/*.jpg", - "**/*.gif" + "**/*.gif", + "**/*.pdf", + "**/*.vsdx" ], "exclude": [ "**/obj/**", @@ -33,6 +35,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", @@ -45,7 +48,8 @@ "depot_name": "MSDN.win-development", "folder_relative_path_in_docset": "./" } - } + }, + "titleSuffix": "Windows Deployment" }, "fileMetadata": {}, "template": [], diff --git a/windows/deployment/images/ContosoBackground.bmp b/windows/deployment/images/ContosoBackground.bmp new file mode 100644 index 0000000000..99c9e7c8eb Binary files /dev/null and b/windows/deployment/images/ContosoBackground.bmp differ diff --git a/windows/deployment/images/ContosoBackground.png b/windows/deployment/images/ContosoBackground.png new file mode 100644 index 0000000000..12a04f0e83 Binary files /dev/null and b/windows/deployment/images/ContosoBackground.png differ diff --git a/windows/deployment/images/acroread.png b/windows/deployment/images/acroread.png new file mode 100644 index 0000000000..142e7b6d74 Binary files /dev/null and b/windows/deployment/images/acroread.png differ diff --git a/windows/deployment/images/captureimage.png b/windows/deployment/images/captureimage.png new file mode 100644 index 0000000000..e9ebbf3aad Binary files /dev/null and b/windows/deployment/images/captureimage.png differ diff --git a/windows/deployment/images/cm-upgrade-ts.png b/windows/deployment/images/cm-upgrade-ts.png new file mode 100644 index 0000000000..15c6b04400 Binary files /dev/null and b/windows/deployment/images/cm-upgrade-ts.png differ diff --git a/windows/deployment/images/cm01-content-status1.png b/windows/deployment/images/cm01-content-status1.png new file mode 100644 index 0000000000..2aa9f3bce1 Binary files /dev/null and b/windows/deployment/images/cm01-content-status1.png differ diff --git a/windows/deployment/images/cm01-drivers-packages.png b/windows/deployment/images/cm01-drivers-packages.png new file mode 100644 index 0000000000..9453c20588 Binary files /dev/null and b/windows/deployment/images/cm01-drivers-packages.png differ diff --git a/windows/deployment/images/cm01-drivers-windows.png b/windows/deployment/images/cm01-drivers-windows.png new file mode 100644 index 0000000000..16a6c031c7 Binary files /dev/null and b/windows/deployment/images/cm01-drivers-windows.png differ diff --git a/windows/deployment/images/cm01-drivers.png b/windows/deployment/images/cm01-drivers.png new file mode 100644 index 0000000000..57de49530b Binary files /dev/null and b/windows/deployment/images/cm01-drivers.png differ diff --git a/windows/deployment/images/sccm-asset.PNG b/windows/deployment/images/configmgr-asset.png similarity index 100% rename from windows/deployment/images/sccm-asset.PNG rename to windows/deployment/images/configmgr-asset.png diff --git a/windows/deployment/images/configmgr-assets.PNG b/windows/deployment/images/configmgr-assets.PNG new file mode 100644 index 0000000000..ac315148c5 Binary files /dev/null and b/windows/deployment/images/configmgr-assets.PNG differ diff --git a/windows/deployment/images/configmgr-assets.png b/windows/deployment/images/configmgr-assets.png new file mode 100644 index 0000000000..ac315148c5 Binary files /dev/null and b/windows/deployment/images/configmgr-assets.png differ diff --git a/windows/deployment/images/sccm-client.PNG b/windows/deployment/images/configmgr-client.PNG similarity index 100% rename from windows/deployment/images/sccm-client.PNG rename to windows/deployment/images/configmgr-client.PNG diff --git a/windows/deployment/images/sccm-collection.PNG b/windows/deployment/images/configmgr-collection.PNG similarity index 100% rename from windows/deployment/images/sccm-collection.PNG rename to windows/deployment/images/configmgr-collection.PNG diff --git a/windows/deployment/images/sccm-install-os.PNG b/windows/deployment/images/configmgr-install-os.PNG similarity index 100% rename from windows/deployment/images/sccm-install-os.PNG rename to windows/deployment/images/configmgr-install-os.PNG diff --git a/windows/deployment/images/sccm-post-refresh.PNG b/windows/deployment/images/configmgr-post-refresh.PNG similarity index 100% rename from windows/deployment/images/sccm-post-refresh.PNG rename to windows/deployment/images/configmgr-post-refresh.PNG diff --git a/windows/deployment/images/sccm-pxe.PNG b/windows/deployment/images/configmgr-pxe.PNG similarity index 100% rename from windows/deployment/images/sccm-pxe.PNG rename to windows/deployment/images/configmgr-pxe.PNG diff --git a/windows/deployment/images/sccm-site.PNG b/windows/deployment/images/configmgr-site.PNG similarity index 100% rename from windows/deployment/images/sccm-site.PNG rename to windows/deployment/images/configmgr-site.PNG diff --git a/windows/deployment/images/sccm-software-cntr.PNG b/windows/deployment/images/configmgr-software-cntr.PNG similarity index 100% rename from windows/deployment/images/sccm-software-cntr.PNG rename to windows/deployment/images/configmgr-software-cntr.PNG diff --git a/windows/deployment/images/dart.png b/windows/deployment/images/dart.png new file mode 100644 index 0000000000..f5c099e9a0 Binary files /dev/null and b/windows/deployment/images/dart.png differ diff --git a/windows/deployment/images/dc01-cm01-pc0001.png b/windows/deployment/images/dc01-cm01-pc0001.png new file mode 100644 index 0000000000..f6adafdf15 Binary files /dev/null and b/windows/deployment/images/dc01-cm01-pc0001.png differ diff --git a/windows/deployment/images/deployment-workbench01.png b/windows/deployment/images/deployment-workbench01.png new file mode 100644 index 0000000000..c68ee25db1 Binary files /dev/null and b/windows/deployment/images/deployment-workbench01.png differ diff --git a/windows/deployment/images/downloads.png b/windows/deployment/images/downloads.png new file mode 100644 index 0000000000..36c45c4a88 Binary files /dev/null and b/windows/deployment/images/downloads.png differ diff --git a/windows/deployment/images/fig10-unattend.png b/windows/deployment/images/fig10-unattend.png index a9d2bc16df..54f0b0f86f 100644 Binary files a/windows/deployment/images/fig10-unattend.png and b/windows/deployment/images/fig10-unattend.png differ diff --git a/windows/deployment/images/fig16-contentstatus.png b/windows/deployment/images/fig16-contentstatus.png index 5ea8ba275a..f48490b97d 100644 Binary files a/windows/deployment/images/fig16-contentstatus.png and b/windows/deployment/images/fig16-contentstatus.png differ diff --git a/windows/deployment/images/fig16-contentstatus1.png b/windows/deployment/images/fig16-contentstatus1.png new file mode 100644 index 0000000000..32c6023e7c Binary files /dev/null and b/windows/deployment/images/fig16-contentstatus1.png differ diff --git a/windows/deployment/images/fig16-contentstatus2.png b/windows/deployment/images/fig16-contentstatus2.png new file mode 100644 index 0000000000..d28385f4ae Binary files /dev/null and b/windows/deployment/images/fig16-contentstatus2.png differ diff --git a/windows/deployment/images/fig18-distwindows.png b/windows/deployment/images/fig18-distwindows.png index d8525ddd3e..07ff1b74c6 100644 Binary files a/windows/deployment/images/fig18-distwindows.png and b/windows/deployment/images/fig18-distwindows.png differ diff --git a/windows/deployment/images/fig2-importedos.png b/windows/deployment/images/fig2-importedos.png index ed72d2ef4d..90cf910c24 100644 Binary files a/windows/deployment/images/fig2-importedos.png and b/windows/deployment/images/fig2-importedos.png differ diff --git a/windows/deployment/images/fig2-taskseq.png b/windows/deployment/images/fig2-taskseq.png index 1da70bd6e7..bdd81ddbde 100644 Binary files a/windows/deployment/images/fig2-taskseq.png and b/windows/deployment/images/fig2-taskseq.png differ diff --git a/windows/deployment/images/fig21-add-drivers1.png b/windows/deployment/images/fig21-add-drivers1.png new file mode 100644 index 0000000000..79b797a7d3 Binary files /dev/null and b/windows/deployment/images/fig21-add-drivers1.png differ diff --git a/windows/deployment/images/fig21-add-drivers2.png b/windows/deployment/images/fig21-add-drivers2.png new file mode 100644 index 0000000000..2f18c5b660 Binary files /dev/null and b/windows/deployment/images/fig21-add-drivers2.png differ diff --git a/windows/deployment/images/fig21-add-drivers3.png b/windows/deployment/images/fig21-add-drivers3.png new file mode 100644 index 0000000000..45f97d0835 Binary files /dev/null and b/windows/deployment/images/fig21-add-drivers3.png differ diff --git a/windows/deployment/images/fig21-add-drivers4.png b/windows/deployment/images/fig21-add-drivers4.png new file mode 100644 index 0000000000..a6613d8718 Binary files /dev/null and b/windows/deployment/images/fig21-add-drivers4.png differ diff --git a/windows/deployment/images/fig22-createcategories.png b/windows/deployment/images/fig22-createcategories.png index 8912ad974f..664ffb2777 100644 Binary files a/windows/deployment/images/fig22-createcategories.png and b/windows/deployment/images/fig22-createcategories.png differ diff --git a/windows/deployment/images/fig27-driverpackage.png b/windows/deployment/images/fig27-driverpackage.png index c2f66669be..cfb17d05ba 100644 Binary files a/windows/deployment/images/fig27-driverpackage.png and b/windows/deployment/images/fig27-driverpackage.png differ diff --git a/windows/deployment/images/fig28-addapp.png b/windows/deployment/images/fig28-addapp.png index a7ba6b3709..34f6f44519 100644 Binary files a/windows/deployment/images/fig28-addapp.png and b/windows/deployment/images/fig28-addapp.png differ diff --git a/windows/deployment/images/fig30-settingspack.png b/windows/deployment/images/fig30-settingspack.png index 3479184140..4dd820aadf 100644 Binary files a/windows/deployment/images/fig30-settingspack.png and b/windows/deployment/images/fig30-settingspack.png differ diff --git a/windows/deployment/images/fig32-deploywiz.png b/windows/deployment/images/fig32-deploywiz.png index a1387b19d8..ad5052af7d 100644 Binary files a/windows/deployment/images/fig32-deploywiz.png and b/windows/deployment/images/fig32-deploywiz.png differ diff --git a/windows/deployment/images/fig4-oob-drivers.png b/windows/deployment/images/fig4-oob-drivers.png index b1f6924665..14d93fb278 100644 Binary files a/windows/deployment/images/fig4-oob-drivers.png and b/windows/deployment/images/fig4-oob-drivers.png differ diff --git a/windows/deployment/images/fig8-cust-tasks.png b/windows/deployment/images/fig8-cust-tasks.png index 378215ee2b..3ab40d730a 100644 Binary files a/windows/deployment/images/fig8-cust-tasks.png and b/windows/deployment/images/fig8-cust-tasks.png differ diff --git a/windows/deployment/images/image-captured.png b/windows/deployment/images/image-captured.png new file mode 100644 index 0000000000..69c5d5ef15 Binary files /dev/null and b/windows/deployment/images/image-captured.png differ diff --git a/windows/deployment/images/iso-data.png b/windows/deployment/images/iso-data.png new file mode 100644 index 0000000000..f188046b7f Binary files /dev/null and b/windows/deployment/images/iso-data.png differ diff --git a/windows/deployment/images/mbr2gpt-volume.PNG b/windows/deployment/images/mbr2gpt-volume.png similarity index 100% rename from windows/deployment/images/mbr2gpt-volume.PNG rename to windows/deployment/images/mbr2gpt-volume.png diff --git a/windows/deployment/images/mdt-03-fig02.png b/windows/deployment/images/mdt-03-fig02.png index d0fd979449..934be09dc1 100644 Binary files a/windows/deployment/images/mdt-03-fig02.png and b/windows/deployment/images/mdt-03-fig02.png differ diff --git a/windows/deployment/images/mdt-03-fig03.png b/windows/deployment/images/mdt-03-fig03.png index ba1de39aa0..a387923d80 100644 Binary files a/windows/deployment/images/mdt-03-fig03.png and b/windows/deployment/images/mdt-03-fig03.png differ diff --git a/windows/deployment/images/mdt-03-fig04.png b/windows/deployment/images/mdt-03-fig04.png index 26600a2036..437531d2f6 100644 Binary files a/windows/deployment/images/mdt-03-fig04.png and b/windows/deployment/images/mdt-03-fig04.png differ diff --git a/windows/deployment/images/mdt-03-fig05.png b/windows/deployment/images/mdt-03-fig05.png index 9c44837022..a7b8d6ca2e 100644 Binary files a/windows/deployment/images/mdt-03-fig05.png and b/windows/deployment/images/mdt-03-fig05.png differ diff --git a/windows/deployment/images/mdt-06-fig06.png b/windows/deployment/images/mdt-06-fig06.png index 324c8960c1..69e2b89c1e 100644 Binary files a/windows/deployment/images/mdt-06-fig06.png and b/windows/deployment/images/mdt-06-fig06.png differ diff --git a/windows/deployment/images/mdt-06-fig08.png b/windows/deployment/images/mdt-06-fig08.png index 33cb90327a..25c8a0a445 100644 Binary files a/windows/deployment/images/mdt-06-fig08.png and b/windows/deployment/images/mdt-06-fig08.png differ diff --git a/windows/deployment/images/mdt-06-fig10.png b/windows/deployment/images/mdt-06-fig10.png index 1d92505b96..85b448ba87 100644 Binary files a/windows/deployment/images/mdt-06-fig10.png and b/windows/deployment/images/mdt-06-fig10.png differ diff --git a/windows/deployment/images/mdt-06-fig12.png b/windows/deployment/images/mdt-06-fig12.png index f33eca6174..a427be3f1d 100644 Binary files a/windows/deployment/images/mdt-06-fig12.png and b/windows/deployment/images/mdt-06-fig12.png differ diff --git a/windows/deployment/images/mdt-06-fig13.png b/windows/deployment/images/mdt-06-fig13.png index ab578f69fe..a9f020b0da 100644 Binary files a/windows/deployment/images/mdt-06-fig13.png and b/windows/deployment/images/mdt-06-fig13.png differ diff --git a/windows/deployment/images/mdt-06-fig14.png b/windows/deployment/images/mdt-06-fig14.png index 13158231fd..1d06c9c7e2 100644 Binary files a/windows/deployment/images/mdt-06-fig14.png and b/windows/deployment/images/mdt-06-fig14.png differ diff --git a/windows/deployment/images/mdt-06-fig15.png b/windows/deployment/images/mdt-06-fig15.png index 2f1a0eba18..ffa5890a84 100644 Binary files a/windows/deployment/images/mdt-06-fig15.png and b/windows/deployment/images/mdt-06-fig15.png differ diff --git a/windows/deployment/images/mdt-06-fig16.png b/windows/deployment/images/mdt-06-fig16.png index 40cb46adbd..f448782602 100644 Binary files a/windows/deployment/images/mdt-06-fig16.png and b/windows/deployment/images/mdt-06-fig16.png differ diff --git a/windows/deployment/images/mdt-06-fig20.png b/windows/deployment/images/mdt-06-fig20.png index 475fad7597..890c421227 100644 Binary files a/windows/deployment/images/mdt-06-fig20.png and b/windows/deployment/images/mdt-06-fig20.png differ diff --git a/windows/deployment/images/mdt-06-fig21.png b/windows/deployment/images/mdt-06-fig21.png index 7cbd1d20bc..07b168ab89 100644 Binary files a/windows/deployment/images/mdt-06-fig21.png and b/windows/deployment/images/mdt-06-fig21.png differ diff --git a/windows/deployment/images/mdt-06-fig31.png b/windows/deployment/images/mdt-06-fig31.png index 5e98d623b1..306f4a7980 100644 Binary files a/windows/deployment/images/mdt-06-fig31.png and b/windows/deployment/images/mdt-06-fig31.png differ diff --git a/windows/deployment/images/mdt-06-fig33.png b/windows/deployment/images/mdt-06-fig33.png index 18ae4c82dd..1529426830 100644 Binary files a/windows/deployment/images/mdt-06-fig33.png and b/windows/deployment/images/mdt-06-fig33.png differ diff --git a/windows/deployment/images/mdt-06-fig42.png b/windows/deployment/images/mdt-06-fig42.png index 12b0e6817a..e9cfe36083 100644 Binary files a/windows/deployment/images/mdt-06-fig42.png and b/windows/deployment/images/mdt-06-fig42.png differ diff --git a/windows/deployment/images/mdt-06-fig43.png b/windows/deployment/images/mdt-06-fig43.png index 015edd21e3..c9a2c88306 100644 Binary files a/windows/deployment/images/mdt-06-fig43.png and b/windows/deployment/images/mdt-06-fig43.png differ diff --git a/windows/deployment/images/mdt-07-fig01.png b/windows/deployment/images/mdt-07-fig01.png index b2ccfec334..90635678e8 100644 Binary files a/windows/deployment/images/mdt-07-fig01.png and b/windows/deployment/images/mdt-07-fig01.png differ diff --git a/windows/deployment/images/mdt-07-fig08.png b/windows/deployment/images/mdt-07-fig08.png index 66e2969916..2cbfc47271 100644 Binary files a/windows/deployment/images/mdt-07-fig08.png and b/windows/deployment/images/mdt-07-fig08.png differ diff --git a/windows/deployment/images/mdt-07-fig09.png b/windows/deployment/images/mdt-07-fig09.png index ce320427ee..245b59072d 100644 Binary files a/windows/deployment/images/mdt-07-fig09.png and b/windows/deployment/images/mdt-07-fig09.png differ diff --git a/windows/deployment/images/mdt-07-fig10.png b/windows/deployment/images/mdt-07-fig10.png index 7aff3c2d76..2c61e0eb3d 100644 Binary files a/windows/deployment/images/mdt-07-fig10.png and b/windows/deployment/images/mdt-07-fig10.png differ diff --git a/windows/deployment/images/mdt-07-fig11.png b/windows/deployment/images/mdt-07-fig11.png index 905f8bd572..ce70374271 100644 Binary files a/windows/deployment/images/mdt-07-fig11.png and b/windows/deployment/images/mdt-07-fig11.png differ diff --git a/windows/deployment/images/mdt-07-fig13.png b/windows/deployment/images/mdt-07-fig13.png index 849949a2f2..dae9bd23b8 100644 Binary files a/windows/deployment/images/mdt-07-fig13.png and b/windows/deployment/images/mdt-07-fig13.png differ diff --git a/windows/deployment/images/mdt-07-fig14.png b/windows/deployment/images/mdt-07-fig14.png index cfe7843eeb..788e609cf6 100644 Binary files a/windows/deployment/images/mdt-07-fig14.png and b/windows/deployment/images/mdt-07-fig14.png differ diff --git a/windows/deployment/images/mdt-07-fig16.png b/windows/deployment/images/mdt-07-fig16.png index 80e0925a40..995eaa51c7 100644 Binary files a/windows/deployment/images/mdt-07-fig16.png and b/windows/deployment/images/mdt-07-fig16.png differ diff --git a/windows/deployment/images/mdt-08-fig01.png b/windows/deployment/images/mdt-08-fig01.png index 7f795c42d4..7e9e650633 100644 Binary files a/windows/deployment/images/mdt-08-fig01.png and b/windows/deployment/images/mdt-08-fig01.png differ diff --git a/windows/deployment/images/mdt-08-fig02.png b/windows/deployment/images/mdt-08-fig02.png index 50c97d8d0c..7a0a4a1bbb 100644 Binary files a/windows/deployment/images/mdt-08-fig02.png and b/windows/deployment/images/mdt-08-fig02.png differ diff --git a/windows/deployment/images/mdt-08-fig14.png b/windows/deployment/images/mdt-08-fig14.png index 21b358d1f8..4e5626280a 100644 Binary files a/windows/deployment/images/mdt-08-fig14.png and b/windows/deployment/images/mdt-08-fig14.png differ diff --git a/windows/deployment/images/mdt-09-fig07.png b/windows/deployment/images/mdt-09-fig07.png index 431f212f80..a2a9093ff0 100644 Binary files a/windows/deployment/images/mdt-09-fig07.png and b/windows/deployment/images/mdt-09-fig07.png differ diff --git a/windows/deployment/images/mdt-10-fig05.png b/windows/deployment/images/mdt-10-fig05.png index 64c0c4a6ee..8625f2972b 100644 Binary files a/windows/deployment/images/mdt-10-fig05.png and b/windows/deployment/images/mdt-10-fig05.png differ diff --git a/windows/deployment/images/mdt-10-fig09.png b/windows/deployment/images/mdt-10-fig09.png index ccdd05f34e..bb5010a93d 100644 Binary files a/windows/deployment/images/mdt-10-fig09.png and b/windows/deployment/images/mdt-10-fig09.png differ diff --git a/windows/deployment/images/mdt-apps.png b/windows/deployment/images/mdt-apps.png new file mode 100644 index 0000000000..72ee2268f2 Binary files /dev/null and b/windows/deployment/images/mdt-apps.png differ diff --git a/windows/deployment/images/mdt-monitoring.png b/windows/deployment/images/mdt-monitoring.png new file mode 100644 index 0000000000..c49732223a Binary files /dev/null and b/windows/deployment/images/mdt-monitoring.png differ diff --git a/windows/deployment/images/mdt-offline-media.png b/windows/deployment/images/mdt-offline-media.png new file mode 100644 index 0000000000..d81ea4e0d8 Binary files /dev/null and b/windows/deployment/images/mdt-offline-media.png differ diff --git a/windows/deployment/images/mdt-post-upg.png b/windows/deployment/images/mdt-post-upg.png new file mode 100644 index 0000000000..f41d2ff32b Binary files /dev/null and b/windows/deployment/images/mdt-post-upg.png differ diff --git a/windows/deployment/images/mdt-replace.png b/windows/deployment/images/mdt-replace.png new file mode 100644 index 0000000000..d731037d38 Binary files /dev/null and b/windows/deployment/images/mdt-replace.png differ diff --git a/windows/deployment/images/mdt-rules.png b/windows/deployment/images/mdt-rules.png new file mode 100644 index 0000000000..b01c519635 Binary files /dev/null and b/windows/deployment/images/mdt-rules.png differ diff --git a/windows/deployment/images/mdt-upgrade-proc.png b/windows/deployment/images/mdt-upgrade-proc.png new file mode 100644 index 0000000000..07a968aed0 Binary files /dev/null and b/windows/deployment/images/mdt-upgrade-proc.png differ diff --git a/windows/deployment/images/mdt-upgrade.png b/windows/deployment/images/mdt-upgrade.png new file mode 100644 index 0000000000..c794526ad5 Binary files /dev/null and b/windows/deployment/images/mdt-upgrade.png differ diff --git a/windows/deployment/images/mdt.png b/windows/deployment/images/mdt.png new file mode 100644 index 0000000000..76a00ee065 Binary files /dev/null and b/windows/deployment/images/mdt.png differ diff --git a/windows/deployment/images/monitor-pc0001.PNG b/windows/deployment/images/monitor-pc0001.PNG new file mode 100644 index 0000000000..072b9cb58c Binary files /dev/null and b/windows/deployment/images/monitor-pc0001.PNG differ diff --git a/windows/deployment/images/office-folder.png b/windows/deployment/images/office-folder.png new file mode 100644 index 0000000000..722cc4d664 Binary files /dev/null and b/windows/deployment/images/office-folder.png differ diff --git a/windows/deployment/images/pc0001-monitor.png b/windows/deployment/images/pc0001-monitor.png new file mode 100644 index 0000000000..7ba8e198bf Binary files /dev/null and b/windows/deployment/images/pc0001-monitor.png differ diff --git a/windows/deployment/images/pc0001.png b/windows/deployment/images/pc0001.png new file mode 100644 index 0000000000..839cd3de54 Binary files /dev/null and b/windows/deployment/images/pc0001.png differ diff --git a/windows/deployment/images/pc0001a.png b/windows/deployment/images/pc0001a.png new file mode 100644 index 0000000000..0f2be5a865 Binary files /dev/null and b/windows/deployment/images/pc0001a.png differ diff --git a/windows/deployment/images/pc0001b.png b/windows/deployment/images/pc0001b.png new file mode 100644 index 0000000000..456f6071a9 Binary files /dev/null and b/windows/deployment/images/pc0001b.png differ diff --git a/windows/deployment/images/pc0001c.png b/windows/deployment/images/pc0001c.png new file mode 100644 index 0000000000..d093e58d0a Binary files /dev/null and b/windows/deployment/images/pc0001c.png differ diff --git a/windows/deployment/images/pc0001d.png b/windows/deployment/images/pc0001d.png new file mode 100644 index 0000000000..14f14a2e91 Binary files /dev/null and b/windows/deployment/images/pc0001d.png differ diff --git a/windows/deployment/images/pc0001e.png b/windows/deployment/images/pc0001e.png new file mode 100644 index 0000000000..41264f2c63 Binary files /dev/null and b/windows/deployment/images/pc0001e.png differ diff --git a/windows/deployment/images/pc0001f.png b/windows/deployment/images/pc0001f.png new file mode 100644 index 0000000000..8261c40953 Binary files /dev/null and b/windows/deployment/images/pc0001f.png differ diff --git a/windows/deployment/images/pc0001g.png b/windows/deployment/images/pc0001g.png new file mode 100644 index 0000000000..5fd7f8a4a7 Binary files /dev/null and b/windows/deployment/images/pc0001g.png differ diff --git a/windows/deployment/images/pc0001h.png b/windows/deployment/images/pc0001h.png new file mode 100644 index 0000000000..65bead5840 Binary files /dev/null and b/windows/deployment/images/pc0001h.png differ diff --git a/windows/deployment/images/pc0001i.png b/windows/deployment/images/pc0001i.png new file mode 100644 index 0000000000..76247a04df Binary files /dev/null and b/windows/deployment/images/pc0001i.png differ diff --git a/windows/deployment/images/pc0001j.png b/windows/deployment/images/pc0001j.png new file mode 100644 index 0000000000..01d8fe22b7 Binary files /dev/null and b/windows/deployment/images/pc0001j.png differ diff --git a/windows/deployment/images/pc0001k.png b/windows/deployment/images/pc0001k.png new file mode 100644 index 0000000000..1f591d5164 Binary files /dev/null and b/windows/deployment/images/pc0001k.png differ diff --git a/windows/deployment/images/pc0001l.png b/windows/deployment/images/pc0001l.png new file mode 100644 index 0000000000..a2d491cef7 Binary files /dev/null and b/windows/deployment/images/pc0001l.png differ diff --git a/windows/deployment/images/pc0001m.png b/windows/deployment/images/pc0001m.png new file mode 100644 index 0000000000..d9e07b5d8a Binary files /dev/null and b/windows/deployment/images/pc0001m.png differ diff --git a/windows/deployment/images/pc0001n.png b/windows/deployment/images/pc0001n.png new file mode 100644 index 0000000000..10819a15d9 Binary files /dev/null and b/windows/deployment/images/pc0001n.png differ diff --git a/windows/deployment/images/pc0003a.png b/windows/deployment/images/pc0003a.png new file mode 100644 index 0000000000..31d8d4068c Binary files /dev/null and b/windows/deployment/images/pc0003a.png differ diff --git a/windows/deployment/images/pc0003b.png b/windows/deployment/images/pc0003b.png new file mode 100644 index 0000000000..8df2b066e6 Binary files /dev/null and b/windows/deployment/images/pc0003b.png differ diff --git a/windows/deployment/images/pc0003c.png b/windows/deployment/images/pc0003c.png new file mode 100644 index 0000000000..69db9cc567 Binary files /dev/null and b/windows/deployment/images/pc0003c.png differ diff --git a/windows/deployment/images/pc0003d.png b/windows/deployment/images/pc0003d.png new file mode 100644 index 0000000000..d36e293f74 Binary files /dev/null and b/windows/deployment/images/pc0003d.png differ diff --git a/windows/deployment/images/pc0003e.png b/windows/deployment/images/pc0003e.png new file mode 100644 index 0000000000..09be89ba61 Binary files /dev/null and b/windows/deployment/images/pc0003e.png differ diff --git a/windows/deployment/images/pc0003f.png b/windows/deployment/images/pc0003f.png new file mode 100644 index 0000000000..6f48f797df Binary files /dev/null and b/windows/deployment/images/pc0003f.png differ diff --git a/windows/deployment/images/pc0003g.png b/windows/deployment/images/pc0003g.png new file mode 100644 index 0000000000..a5a935de32 Binary files /dev/null and b/windows/deployment/images/pc0003g.png differ diff --git a/windows/deployment/images/pc0003h.png b/windows/deployment/images/pc0003h.png new file mode 100644 index 0000000000..9e15738b48 Binary files /dev/null and b/windows/deployment/images/pc0003h.png differ diff --git a/windows/deployment/images/pc0003i.png b/windows/deployment/images/pc0003i.png new file mode 100644 index 0000000000..7c7b194399 Binary files /dev/null and b/windows/deployment/images/pc0003i.png differ diff --git a/windows/deployment/images/pc0003j.png b/windows/deployment/images/pc0003j.png new file mode 100644 index 0000000000..b446bff1c2 Binary files /dev/null and b/windows/deployment/images/pc0003j.png differ diff --git a/windows/deployment/images/pc0003k.png b/windows/deployment/images/pc0003k.png new file mode 100644 index 0000000000..ceead7b05b Binary files /dev/null and b/windows/deployment/images/pc0003k.png differ diff --git a/windows/deployment/images/pc0004-a.png b/windows/deployment/images/pc0004-a.png new file mode 100644 index 0000000000..afe954d28f Binary files /dev/null and b/windows/deployment/images/pc0004-a.png differ diff --git a/windows/deployment/images/pc0004-b.png b/windows/deployment/images/pc0004-b.png new file mode 100644 index 0000000000..caad109ace Binary files /dev/null and b/windows/deployment/images/pc0004-b.png differ diff --git a/windows/deployment/images/pc0004-c.png b/windows/deployment/images/pc0004-c.png new file mode 100644 index 0000000000..21490d55a3 Binary files /dev/null and b/windows/deployment/images/pc0004-c.png differ diff --git a/windows/deployment/images/pc0004-d.png b/windows/deployment/images/pc0004-d.png new file mode 100644 index 0000000000..db10b4ccdc Binary files /dev/null and b/windows/deployment/images/pc0004-d.png differ diff --git a/windows/deployment/images/pc0004-e.png b/windows/deployment/images/pc0004-e.png new file mode 100644 index 0000000000..d6472a4209 Binary files /dev/null and b/windows/deployment/images/pc0004-e.png differ diff --git a/windows/deployment/images/pc0004-f.png b/windows/deployment/images/pc0004-f.png new file mode 100644 index 0000000000..7752a700e0 Binary files /dev/null and b/windows/deployment/images/pc0004-f.png differ diff --git a/windows/deployment/images/pc0004-g.png b/windows/deployment/images/pc0004-g.png new file mode 100644 index 0000000000..93b4812149 Binary files /dev/null and b/windows/deployment/images/pc0004-g.png differ diff --git a/windows/deployment/images/pc0004b.png b/windows/deployment/images/pc0004b.png new file mode 100644 index 0000000000..f1fb129bbe Binary files /dev/null and b/windows/deployment/images/pc0004b.png differ diff --git a/windows/deployment/images/pc0005-vm-office.png b/windows/deployment/images/pc0005-vm-office.png new file mode 100644 index 0000000000..bb8e96f5af Binary files /dev/null and b/windows/deployment/images/pc0005-vm-office.png differ diff --git a/windows/deployment/images/pc0005-vm.png b/windows/deployment/images/pc0005-vm.png new file mode 100644 index 0000000000..4b2af635c4 Binary files /dev/null and b/windows/deployment/images/pc0005-vm.png differ diff --git a/windows/deployment/images/pc0006.png b/windows/deployment/images/pc0006.png new file mode 100644 index 0000000000..6162982966 Binary files /dev/null and b/windows/deployment/images/pc0006.png differ diff --git a/windows/deployment/images/pc0006a.png b/windows/deployment/images/pc0006a.png new file mode 100644 index 0000000000..399f99885f Binary files /dev/null and b/windows/deployment/images/pc0006a.png differ diff --git a/windows/deployment/images/pc0006b.png b/windows/deployment/images/pc0006b.png new file mode 100644 index 0000000000..bef284d211 Binary files /dev/null and b/windows/deployment/images/pc0006b.png differ diff --git a/windows/deployment/images/pc0006c.png b/windows/deployment/images/pc0006c.png new file mode 100644 index 0000000000..1e8f075262 Binary files /dev/null and b/windows/deployment/images/pc0006c.png differ diff --git a/windows/deployment/images/pc0006d.png b/windows/deployment/images/pc0006d.png new file mode 100644 index 0000000000..dca5a58c2a Binary files /dev/null and b/windows/deployment/images/pc0006d.png differ diff --git a/windows/deployment/images/pc0006e.png b/windows/deployment/images/pc0006e.png new file mode 100644 index 0000000000..3b3ef3be99 Binary files /dev/null and b/windows/deployment/images/pc0006e.png differ diff --git a/windows/deployment/images/pc0006f.png b/windows/deployment/images/pc0006f.png new file mode 100644 index 0000000000..8da05473b3 Binary files /dev/null and b/windows/deployment/images/pc0006f.png differ diff --git a/windows/deployment/images/pc0006g.png b/windows/deployment/images/pc0006g.png new file mode 100644 index 0000000000..0cc69e2626 Binary files /dev/null and b/windows/deployment/images/pc0006g.png differ diff --git a/windows/deployment/images/pc0006h.png b/windows/deployment/images/pc0006h.png new file mode 100644 index 0000000000..3ae86b01ed Binary files /dev/null and b/windows/deployment/images/pc0006h.png differ diff --git a/windows/deployment/images/pc0006i.png b/windows/deployment/images/pc0006i.png new file mode 100644 index 0000000000..42c8e2adfa Binary files /dev/null and b/windows/deployment/images/pc0006i.png differ diff --git a/windows/deployment/images/ps100009-1.png b/windows/deployment/images/ps100009-1.png new file mode 100644 index 0000000000..6bd970c352 Binary files /dev/null and b/windows/deployment/images/ps100009-1.png differ diff --git a/windows/deployment/images/ps100009-2.png b/windows/deployment/images/ps100009-2.png new file mode 100644 index 0000000000..e960ad91d4 Binary files /dev/null and b/windows/deployment/images/ps100009-2.png differ diff --git a/windows/deployment/images/ref-image.png b/windows/deployment/images/ref-image.png new file mode 100644 index 0000000000..773a21e150 Binary files /dev/null and b/windows/deployment/images/ref-image.png differ diff --git a/windows/deployment/images/sa-mfa1.png b/windows/deployment/images/sa-mfa1.png new file mode 100644 index 0000000000..045e5a7794 Binary files /dev/null and b/windows/deployment/images/sa-mfa1.png differ diff --git a/windows/deployment/images/sa-mfa2.png b/windows/deployment/images/sa-mfa2.png new file mode 100644 index 0000000000..1964a7b263 Binary files /dev/null and b/windows/deployment/images/sa-mfa2.png differ diff --git a/windows/deployment/images/sa-mfa3.png b/windows/deployment/images/sa-mfa3.png new file mode 100644 index 0000000000..8987eac97b Binary files /dev/null and b/windows/deployment/images/sa-mfa3.png differ diff --git a/windows/deployment/images/sccm-assets.PNG b/windows/deployment/images/sccm-assets.PNG deleted file mode 100644 index 264606c2ab..0000000000 Binary files a/windows/deployment/images/sccm-assets.PNG and /dev/null differ diff --git a/windows/deployment/images/sigverif.png b/windows/deployment/images/sigverif.png new file mode 100644 index 0000000000..0ed0c2fd0c Binary files /dev/null and b/windows/deployment/images/sigverif.png differ diff --git a/windows/deployment/images/thinkstation.png b/windows/deployment/images/thinkstation.png new file mode 100644 index 0000000000..7a144ec5b3 Binary files /dev/null and b/windows/deployment/images/thinkstation.png differ diff --git a/windows/deployment/images/upgrademdt-fig1-machines.png b/windows/deployment/images/upgrademdt-fig1-machines.png deleted file mode 100644 index ef553b6595..0000000000 Binary files a/windows/deployment/images/upgrademdt-fig1-machines.png and /dev/null differ diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 9530728934..dbd960b4a7 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -1,106 +1,100 @@ -### YamlMime:YamlDocument +### YamlMime:Landing + +title: Windows 10 deployment resources and documentation # < 60 chars +summary: Learn about deploying and keeping Windows 10 up to date. # < 160 chars -documentType: LandingData -title: Deploy and update Windows 10 metadata: - document_id: - title: Deploy and update Windows 10 - description: Deploying and updating Windows 10 for IT professionals. - keywords: deploy, update, Windows, service, Microsoft365, e5, e3 - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: elizapo - ms.date: 02/09/2018 - ms.topic: article - ms.devlang: na + title: Windows 10 deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about deploying Windows 10 and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. + services: windows-10 + ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. + ms.subservice: subservice + ms.topic: landing-page # Required + ms.collection: windows-10 + author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. + ms.author: greglin #Required; microsoft alias of author; optional team alias. + ms.date: 08/05/2020 #Required; mm/dd/yyyy format. + localization_priority: medium + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new -sections: -- items: - - type: markdown - text: Learn about deployment of Windows 10 for IT professionals. This includes deploying the operating system, upgrading to it from previous versions and updating Windows 10. -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - href: windows-10-deployment-scenarios - html:

              Understand the different ways that Windows 10 can be deployed

              - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg" - title: Windows 10 deployment scenarios - - href: update - html:

              Update Windows 10 in the enterprise

              - image: - src: https://docs.microsoft.com/media/common/i_upgrade.svg - title: Windows as a service - - href: update/windows-analytics-overview - html:

              Windows Analytics provides deep insights into your Windows 10 environment.

              - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: Windows Analytics -- title: -- items: - - type: markdown - text: " -
              -
              CmdletUse this cmdlet toSyntax
              Add-ProvisioningPackage Apply a provisioning packageAdd-ProvisioningPackage [-Path] <string> [-ForceInstall] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Add-ProvisioningPackage Apply a provisioning packageAdd-ProvisioningPackage [-Path] <string> [-ForceInstall] [-LogsFolder <string>] [-QuietInstall] [-WprpFile <string>] [<CommonParameters>]
              Remove-ProvisioningPackageRemove a provisioning package Remove-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Remove-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Get-ProvisioningPackage Get information about an installed provisioning package Get-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Get-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Export-ProvisioningPackage Extract the contents of a provisioning package Export-ProvisioningPackage -PackageId <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              Export-ProvisioningPackage -Path <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
              - - - - - - -
              [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) Check out the new Modern Deskop Deployment Center and discover content to help you with your Windows 10 and Office 365 ProPlus deployments.
              [What's new in Windows 10 deployment](deploy-whats-new.md) See this topic for a summary of new features and some recent changes related to deploying Windows 10 in your organization.
              [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task.
              [Windows Autopilot](windows-autopilot/windows-autopilot.md) Windows Autopilot enables an IT department to pre-configure new devices and repurpose existing devices with a simple process that requires little to no infrastructure.
              [Windows 10 Subscription Activation](windows-10-subscription-activation.md) Windows 10 Enterprise has traditionally been sold as on premises software, however, with Windows 10 version 1703 (also known as the Creator’s Update), both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as true online services via subscription. You can move from Windows 10 Pro to Windows 10 Enterprise with no keys and no reboots. If you are using a Cloud Service Providers (CSP) see the related topic: [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md).
              [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade.
              - " -- title: Deploy Windows 10 -- items: - - type: markdown - text: " - Windows 10 upgrade options are discussed and information is provided about planning, testing, and managing your production deployment. -
               
              - - - - - - - - - - - -
              TopicDescription
              [Overview of Windows Autopilot](windows-autopilot/windows-autopilot.md) Windows Autopilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices.
              [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) This topic provides information about support for upgrading directly to Windows 10 from a previous operating system.
              [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) This topic provides information about support for upgrading from one edition of Windows 10 to another.
              [Windows 10 volume license media](windows-10-media.md) This topic provides information about media available in the Microsoft Volume Licensing Service Center.
              [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
              [Windows 10 deployment test lab](windows-10-poc.md) This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md).
              [Plan for Windows 10 deployment](planning/index.md) This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning.
              [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT).
              [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or.
              [Windows 10 deployment tools](windows-10-deployment-tools-reference.md) Learn about available tools to deploy Windows 10, such as the Windows ADK, DISM, USMT, WDS, MDT, Windows PE and more.
              - " -- title: Update Windows 10 -- items: - - type: markdown - text: " - Information is provided about keeping Windows 10 up-to-date. -
               
              - - - - - - - - - - - - - - - -
              TopicDescription
              [Quick guide to Windows as a service](update/waas-quick-start.md) Provides a brief summary of the key points for the new servicing model for Windows 10.
              [Overview of Windows as a service](update/waas-overview.md) Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools.
              [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) Explains the decisions you need to make in your servicing strategy.
              [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates.
              [Assign devices to servicing branches for Windows 10 updates](update/waas-servicing-branches-windows-10-updates.md) Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider.
              [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization.
              [Optimize update delivery for Windows 10 updates](update/waas-optimize-windows-10-updates.md) Explains the benefits of using Delivery Optimization or BranchCache for update distribution.
              [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](update/waas-mobile-updates.md) Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile.
              [Deploy updates using Windows Update for Business](update/waas-manage-updates-wufb.md) Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune.
              [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](update/waas-manage-updates-wsus.md) Explains how to use WSUS to manage Windows 10 updates.
              [Deploy Windows 10 updates using System Center Configuration Manager](update/waas-manage-updates-configuration-manager.md) Explains how to use Configuration Manager to manage Windows 10 updates.
              [Manage device restarts after updates](update/waas-restart.md) Explains how to manage update related device restarts.
              [Manage additional Windows Update settings](update/waas-wu-settings.md) Provides details about settings available to control and configure Windows Update.
              [Windows Insider Program for Business](update/waas-windows-insider-for-business.md) Explains how the Windows Insider Program for Business works and how to become an insider.
              - " -- title: Additional topics -- items: - - type: markdown - text: " -
              - [Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md) This topic describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile. - -  " +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Plan + linkLists: + - linkListType: overview + links: + - text: Create a deployment plan + url: update/create-deployment-plan.md + - text: Define readiness criteria + url: update/plan-define-readiness.md + - text: Evaluate infrastructure and tools + url: update/eval-infra-tools.md + - text: Define your servicing strategy + url: update/plan-define-strategy.md + + # Card (optional) + - title: Prepare + linkLists: + - linkListType: how-to-guide + links: + - text: Prepare to deploy Windows 10 updates + url: update/prepare-deploy-windows.md + - text: Prepare updates using Windows Update for Business + url: update/waas-manage-updates-wufb.md + - text: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager + url: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md + + # Card (optional) + - title: Deploy + linkLists: + - linkListType: deploy + links: + - text: Deploy Windows 10 with Autopilot + url: https://docs.microsoft.com/mem/autopilot + - text: Assign devices to servicing channels + url: update/waas-servicing-channels-windows-10-updates.md + - text: Deploy Windows updates with Configuration Manager + url: update/deploy-updates-configmgr.md + + # Card + - title: Overview + linkLists: + - linkListType: overview + links: + - text: What's new in Windows deployment + url: windows-10-deployment-scenarios.md + - text: Windows 10 deployment scenarios + url: windows-10-deployment-scenarios.md + - text: Basics of Windows updates, channels, and tools + url: update/get-started-updates-channels-tools.md + - text: Overview of Windows Autopilot + url: https://docs.microsoft.com/mem/autopilot/windows-autopilot + + # Card + - title: Support remote work + linkLists: + - linkListType: concept + links: + - text: Deploy Windows 10 for a remote world + url: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/deploying-a-new-version-of-windows-10-in-a-remote-world/ba-p/1419846 + - text: Empower remote workers with Microsoft 365 + url: https://docs.microsoft.com/microsoft-365/solutions/empower-people-to-work-remotely + - text: Top 12 tasks for security teams to support working from home + url: https://docs.microsoft.com/microsoft-365/security/top-security-tasks-for-remote-work + - text: Support your remote workforce + url: https://docs.microsoft.com/microsoftteams/faq-support-remote-workforce + + # Card (optional) + - title: Microsoft Learn + linkLists: + - linkListType: learn + links: + - text: Plan to deploy updates for Windows 10 and Microsoft 365 Apps + url: https://docs.microsoft.com/learn/modules/windows-plan + - text: Prepare to deploy updates for Windows 10 and Microsoft 365 Apps + url: https://docs.microsoft.com/learn/modules/windows-prepare/ + - text: Deploy updates for Windows 10 and Microsoft 365 Apps + url: https://docs.microsoft.com/learn/modules/windows-deploy diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 7f2c14085a..c5312c0bd7 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -1,456 +1,460 @@ ---- -title: MBR2GPT -description: How to use the MBR2GPT tool to convert MBR partitions to GPT -keywords: deploy, troubleshoot, windows, 10, upgrade, partition, mbr, gpt -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.date: 02/13/2018 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# MBR2GPT.EXE - -**Applies to** -- Windows 10 - -## Summary - -**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option. - ->MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later. ->The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version. - -See the following video for a detailed description and demonstration of MBR2GPT. - - - -You can use MBR2GPT to: - -- Convert any attached MBR-formatted system disk to the GPT partition format. You cannot use the tool to convert non-system disks from MBR to GPT. -- Convert an MBR disk with BitLocker-encrypted volumes as long as protection has been suspended. To resume BitLocker after conversion, you will need to delete the existing protectors and recreate them. -- Convert operating system disks that have earlier versions of Windows 10 installed, such as versions 1507, 1511, and 1607. However, you must run the tool while booted into Windows 10 version 1703 or later, and perform an offline conversion. -- Convert an operating system disk from MBR to GPT using Configuration Manager or MDT provided that your task sequence uses Windows PE version 1703 or later. - -Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 are not officially supported. The recommended method to convert these disks is to upgrade the operating system to Windows 10 first, then perform the MBR to GPT conversion. - ->[!IMPORTANT] ->After the disk has been converted to GPT partition style, the firmware must be reconfigured to boot in UEFI mode.
              Make sure that your device supports UEFI before attempting to convert the disk. - -## Disk Prerequisites - -Before any change to the disk is made, MBR2GPT validates the layout and geometry of the selected disk to ensure that: -- The disk is currently using MBR -- There is enough space not occupied by partitions to store the primary and secondary GPTs: - - 16KB + 2 sectors at the front of the disk - - 16KB + 1 sector at the end of the disk -- There are at most 3 primary partitions in the MBR partition table -- One of the partitions is set as active and is the system partition -- The disk does not have any extended/logical partition -- The BCD store on the system partition contains a default OS entry pointing to an OS partition -- The volume IDs can be retrieved for each volume which has a drive letter assigned -- All partitions on the disk are of MBR types recognized by Windows or has a mapping specified using the /map command-line option - -If any of these checks fails, the conversion will not proceed and an error will be returned. - -## Syntax - - -
              MBR2GPT /validate|convert [/disk:<diskNumber>] [/logs:<logDirectory>] [/map:<source>=<destination>] [/allowFullOS] -
              - -### Options - -| Option | Description | -|----|-------------| -|/validate| Instructs MBR2GPT.exe to perform only the disk validation steps and report whether the disk is eligible for conversion. | -|/convert| Instructs MBR2GPT.exe to perform the disk validation and to proceed with the conversion if all validation tests pass. | -|/disk:\| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as that used by the diskpart.exe tool **SELECT DISK SYSTEM** command.| -|/logs:\| Specifies the directory where MBR2GPT.exe logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it will not be automatically created or overwritten.| -|/map:\=\| Specifies additional partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexidecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. | -|/allowFullOS| By default, MBR2GPT.exe is blocked unless it is run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
              **Note**: Since the existing MBR system partition is in use while running the full Windows environment, it cannot be reused. In this case, a new ESP is created by shrinking the OS partition.| - -## Examples - -### Validation example - -In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location, **%windir%**. - -``` -X:\>mbr2gpt /validate /disk:0 -MBR2GPT: Attempting to validate disk 0 -MBR2GPT: Retrieving layout of disk -MBR2GPT: Validating layout, disk sector size is: 512 -MBR2GPT: Validation completed successfully -``` - -### Conversion example - -In the following example: - -1. Using DiskPart, the current disk partition layout is displayed prior to conversion - three partitions are present on the MBR disk (disk 0): a system reserved partition, a Windows partition, and a recovery partition. A DVD-ROM is also present as volume 0. -2. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](https://msdn.microsoft.com/library/windows/desktop/aa363990.aspx) is **07** corresponding to the installable file system (IFS) type. -2. The MBR2GPT tool is used to convert disk 0. -3. The DiskPart tool displays that disk 0 is now using the GPT format. -4. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). -5. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](https://msdn.microsoft.com/library/windows/desktop/aa365449.aspx) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. - ->As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly. - -``` -X:\>DiskPart - -Microsoft DiskPart version 10.0.15048.0 - -Copyright (C) Microsoft Corporation. -On computer: MININT-K71F13N - -DISKPART> list volume - - Volume ### Ltr Label Fs Type Size Status Info - ---------- --- ----------- ----- ---------- ------- --------- -------- - Volume 0 F CENA_X64FRE UDF DVD-ROM 4027 MB Healthy - Volume 1 C System Rese NTFS Partition 499 MB Healthy - Volume 2 D Windows NTFS Partition 58 GB Healthy - Volume 3 E Recovery NTFS Partition 612 MB Healthy Hidden - -DISKPART> select volume 2 - -Volume 2 is the selected volume. - -DISKPART> list partition - - Partition ### Type Size Offset - ------------- ---------------- ------- ------- - Partition 1 Primary 499 MB 1024 KB -* Partition 2 Primary 58 GB 500 MB - Partition 3 Recovery 612 MB 59 GB - -DISKPART> detail partition - -Partition 2 -Type : 07 -Hidden: No -Active: No -Offset in Bytes: 524288000 - - Volume ### Ltr Label Fs Type Size Status Info - ---------- --- ----------- ----- ---------- ------- --------- -------- -* Volume 2 D Windows NTFS Partition 58 GB Healthy - -DISKPART> exit - -Leaving DiskPart... - -X:\>mbr2gpt /convert /disk:0 - -MBR2GPT will now attempt to convert disk 0. -If conversion is successful the disk can only be booted in GPT mode. -These changes cannot be undone! - -MBR2GPT: Attempting to convert disk 0 -MBR2GPT: Retrieving layout of disk -MBR2GPT: Validating layout, disk sector size is: 512 bytes -MBR2GPT: Trying to shrink the system partition -MBR2GPT: Trying to shrink the OS partition -MBR2GPT: Creating the EFI system partition -MBR2GPT: Installing the new boot files -MBR2GPT: Performing the layout conversion -MBR2GPT: Migrating default boot entry -MBR2GPT: Adding recovery boot entry -MBR2GPT: Fixing drive letter mapping -MBR2GPT: Conversion completed successfully -MBR2GPT: Before the new system can boot properly you need to switch the firmware to boot to UEFI mode! - -X:\>DiskPart - -Microsoft DiskPart version 10.0.15048.0 - -Copyright (C) Microsoft Corporation. -On computer: MININT-K71F13N - -DISKPART> list disk - - Disk ### Status Size Free Dyn Gpt - -------- ------------- ------- ------- --- --- - Disk 0 Online 60 GB 0 B * - -DISKPART> select disk 0 - -Disk 0 is now the selected disk. - -DISKPART> list volume - - Volume ### Ltr Label Fs Type Size Status Info - ---------- --- ----------- ----- ---------- ------- --------- -------- - Volume 0 F CENA_X64FRE UDF DVD-ROM 4027 MB Healthy - Volume 1 D Windows NTFS Partition 58 GB Healthy - Volume 2 C System Rese NTFS Partition 499 MB Healthy Hidden - Volume 3 FAT32 Partition 100 MB Healthy Hidden - Volume 4 E Recovery NTFS Partition 612 MB Healthy Hidden - -DISKPART> select volume 1 - -Volume 1 is the selected volume. - -DISKPART> list partition - - Partition ### Type Size Offset - ------------- ---------------- ------- ------- - Partition 1 Recovery 499 MB 1024 KB -* Partition 2 Primary 58 GB 500 MB - Partition 4 System 100 MB 59 GB - Partition 3 Recovery 612 MB 59 GB - -DISKPART> detail partition - -Partition 2 -Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 -Hidden : No -Required: No -Attrib : 0000000000000000 -Offset in Bytes: 524288000 - - Volume ### Ltr Label Fs Type Size Status Info - ---------- --- ----------- ----- ---------- ------- --------- -------- -* Volume 1 D Windows NTFS Partition 58 GB Healthy -``` - -## Specifications - -### Disk conversion workflow - -The following steps illustrate high-level phases of the MBR-to-GPT conversion process: - -1. Disk validation is performed. -2. The disk is repartitioned to create an EFI system partition (ESP) if one does not already exist. -3. UEFI boot files are installed to the ESP. -4. GPT metatdata and layout information is applied. -5. The boot configuration data (BCD) store is updated. -6. Drive letter assignments are restored. - -### Creating an EFI system partition - -For Windows to remain bootable after the conversion, an EFI system partition (ESP) must be in place. MBR2GPT creates the ESP using the following rules: - -1. The existing MBR system partition is reused if it meets these requirements:
              - a. It is not also the OS or Windows Recovery Environment partition.
              - b. It is at least 100MB (or 260MB for 4K sector size disks) in size.
              - c. It is less than or equal to 1GB in size. This is a safety precaution to ensure it is not a data partition.
              - d. The conversion is not being performed from the full OS. In this case, the existing MBR system partition is in use and cannot be repurposed. -2. If the existing MBR system partition cannot be reused, a new ESP is created by shrinking the OS partition. This new partition has a size of 100MB (or 260MB for 4K sector size disks) and is formatted FAT32. - -If the existing MBR system partition is not reused for the ESP, it is no longer used by the boot process after the conversion. Other partitions are not modified. - ->[!IMPORTANT] ->If the existing MBR system partition is not reused for the ESP, it might be assigned a drive letter. If you do not wish to use this small partition, you must manually hide the drive letter. - -### Partition type mapping and partition attributes - -Since GPT partitions use a different set of type IDs than MBR partitions, each partition on the converted disk must be assigned a new type ID. The partition type mapping follows these rules: - -1. The ESP is always set to partition type PARTITION_SYSTEM_GUID (c12a7328-f81f-11d2-ba4b-00a0c93ec93b). -2. If an MBR partition is of a type that matches one of the entries specified in the /map switch, the specified GPT partition type ID is used. -3. If the MBR partition is of type 0x27, the partition is converted to a GPT partition of type PARTITION_MSFT_RECOVERY_GUID (de94bba4-06d1-4d40-a16a-bfd50179d6ac). -4. All other MBR partitions recognized by Windows are converted to GPT partitions of type PARTITION_BASIC_DATA_GUID (ebd0a0a2-b9e5-4433-87c0-68b6b72699c7). - -In addition to applying the correct partition types, partitions of type PARTITION_MSFT_RECOVERY_GUID also have the following GPT attributes set: -- GPT_ATTRIBUTE_PLATFORM_REQUIRED (0x0000000000000001) -- GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER (0x8000000000000000) - -For more information about partition types, see: -- [GPT partition types](https://msdn.microsoft.com/library/windows/desktop/aa365449.aspx) -- [MBR partition types](https://msdn.microsoft.com/library/windows/desktop/aa363990.aspx) - - -### Persisting drive letter assignments - -The conversion tool will attempt to remap all drive letter assignment information contained in the registry that correspond to the volumes of the converted disk. If a drive letter assignment cannot be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. **Important**: this code runs after the layout conversion has taken place, so the operation cannot be undone at this stage. - -The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It will then iterate through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry do the following: - -1. Check if the unique ID corresponds to any of the unique IDs for any of the volumes that are part of the converted disk. -2. If found, set the value to be the new unique ID, obtained after the layout conversion. -3. If the new unique ID cannot be set and the value name starts with \DosDevices, issue a console and log warning about the need for manual intervention in properly restoring the drive letter assignment. - -## Troubleshooting - -The tool will display status information in its output. Both validation and conversion are clear if any errors are encountered. For example, if one or more partitions do not translate properly, this is displayed and the conversion not performed. To view more detail about any errors that are encountered, see the associated [log files](#logs). - -### Logs - -Four log files are created by the MBR2GPT tool: - -- diagerr.xml -- diagwrn.xml -- setupact.log -- setuperr.log - -These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. Note: The setupact*.log files are different than the Windows Setup files that are found in the %Windir%\Panther directory. - -The default location for all these log files in Windows PE is **%windir%**. - -### Interactive help - -To view a list of options available when using the tool, type **mbr2gpt /?** - -The following text is displayed: - -``` - -C:\> mbr2gpt /? - -Converts a disk from MBR to GPT partitioning without modifying or deleting data on the disk. - -MBR2GPT.exe /validate|convert [/disk:] [/logs:] [/map:=] [/allowFullOS] - -Where: - - /validate - - Validates that the selected disk can be converted - without performing the actual conversion. - - /convert - - Validates that the selected disk can be converted - and performs the actual conversion. - - /disk: - - Specifies the disk number of the disk to be processed. - If not specified, the system disk is processed. - - /logs: - - Specifies the directory for logging. By default logs - are created in the %windir% directory. - - /map:= - - Specifies the GPT partition type to be used for a - given MBR partition type not recognized by Windows. - Multiple /map switches are allowed. - - /allowFullOS - - Allows the tool to be used from the full Windows - environment. By default, this tool can only be used - from the Windows Preinstallation Environment. -``` - -### Return codes - -MBR2GPT has the following associated return codes: - -| Return code | Description | -|----|-------------| -|0| Conversion completed successfully.| -|1| Conversion was canceled by the user.| -|2| Conversion failed due to an internal error.| -|3| Conversion failed due to an initialization error.| -|4| Conversion failed due to invalid command-line parameters. | -|5| Conversion failed due to error reading the geometry and layout of the selected disk.| -|6| Conversion failed because one or more volumes on the disk is encrypted.| -|7| Conversion failed because the geometry and layout of the selected disk do not meet requirements.| -|8| Conversion failed due to error while creating the EFI system partition.| -|9| Conversion failed due to error installing boot files.| -|10| Conversion failed due to error while applying GPT layout.| -|100| Conversion to GPT layout succeeded, but some boot configuration data entries could not be restored.| - - -### Determining the partition type - -You can type the following command at a Windows PowerShell prompt to display the disk number and partition type. Example output is also shown: - - -``` -PS C:\> Get-Disk | ft -Auto - -Number Friendly Name Serial Number HealthStatus OperationalStatus Total Size Partition Style ------- ------------- ------------- ------------ ----------------- ---------- --------------- -0 MTFDDAK256MAM-1K1 13050928F47C Healthy Online 238.47 GB MBR -1 ST1000DM003-1ER162 Z4Y3GD8F Healthy Online 931.51 GB GPT -``` - -You can also view the partition type of a disk by opening the Disk Management tool, right-clicking the disk number, clicking **Properties**, and then clicking the **Volumes** tab. See the following example: - -![Volumes](images/mbr2gpt-volume.PNG) - - -If Windows PowerShell and Disk Management are not available, such as when you are using Windows PE, you can determine the partition type at a command prompt with the DiskPart tool. To determine the partition style from a command line, type **diskpart** and then type **list disk**. See the following example: - -``` -X:\>DiskPart - -Microsoft DiskPart version 10.0.15048.0 - -Copyright (C) Microsoft Corporation. -On computer: MININT-K71F13N - -DISKPART> list disk - - Disk ### Status Size Free Dyn Gpt - -------- ------------- ------- ------- --- --- - Disk 0 Online 238 GB 0 B - Disk 1 Online 931 GB 0 B * -``` - -In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is formatted using GPT. - - -## Known issue - -### MBR2GPT.exe cannot run in Windows PE - -When you start a Windows 10, version 1903-based computer in the Windows Preinstallation Environment (Windows PE), you encounter the following issues: - -**Issue 1** When you run the MBR2GPT.exe command, the process exits without converting the drive. - -**Issue 2** When you manually run the MBR2GPT.exe command in a Command Prompt window, there is no output from the tool. - -**Issue 3** When MBR2GPT.exe runs inside an imaging process such as a System Center Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. - -#### Cause - -This issue occurs because in Windows 10, version 1903 and later versions, MBR2GPT.exe requires access to the ReAgent.dll file. However, this dll file and its associated libraries are currently not included in the Windows PE boot image for Windows 10, version 1903 and later. - -#### Workaround - -To fix this issue, mount the Windows PE image (WIM), copy the missing file from the [Windows 10, version 1903 Assessment and Development Kit (ADK)](https://go.microsoft.com/fwlink/?linkid=2086042) source, and then commit the changes to the WIM. To do this, follow these steps: - -1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image). - -2. Copy the ReAgent files and the ReAgent localization files from the Window 10, version 1903 ADK source folder to the mounted WIM. - - For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window: - - **Command 1:** - ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" - ``` - This command copies three files: - - * ReAgent.admx - * ReAgent.dll - * ReAgent.xml - - **Command 2:** - ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" - ``` - This command copies two files: - * ReAgent.adml - * ReAgent.dll.mui - - > [!NOTE] - > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. - -3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). - - -## Related topics - -[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +--- +title: MBR2GPT +description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. +keywords: deploy, troubleshoot, windows, 10, upgrade, partition, mbr, gpt +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.date: 02/13/2018 +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.localizationpriority: medium +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# MBR2GPT.EXE + +**Applies to** +- Windows 10 + +**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option. + +>MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later. +>The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version. + +See the following video for a detailed description and demonstration of MBR2GPT. + + + +You can use MBR2GPT to: + +- Convert any attached MBR-formatted system disk to the GPT partition format. You cannot use the tool to convert non-system disks from MBR to GPT. +- Convert an MBR disk with BitLocker-encrypted volumes as long as protection has been suspended. To resume BitLocker after conversion, you will need to delete the existing protectors and recreate them. +- Convert operating system disks that have earlier versions of Windows 10 installed, such as versions 1507, 1511, and 1607. However, you must run the tool while booted into Windows 10 version 1703 or later, and perform an offline conversion. +- Convert an operating system disk from MBR to GPT using Configuration Manager or MDT provided that your task sequence uses Windows PE version 1703 or later. + +Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 are not officially supported. The recommended method to convert these disks is to upgrade the operating system to Windows 10 first, then perform the MBR to GPT conversion. + +>[!IMPORTANT] +>After the disk has been converted to GPT partition style, the firmware must be reconfigured to boot in UEFI mode.
              Make sure that your device supports UEFI before attempting to convert the disk. + +## Disk Prerequisites + +Before any change to the disk is made, MBR2GPT validates the layout and geometry of the selected disk to ensure that: +- The disk is currently using MBR +- There is enough space not occupied by partitions to store the primary and secondary GPTs: + - 16KB + 2 sectors at the front of the disk + - 16KB + 1 sector at the end of the disk +- There are at most 3 primary partitions in the MBR partition table +- One of the partitions is set as active and is the system partition +- The disk does not have any extended/logical partition +- The BCD store on the system partition contains a default OS entry pointing to an OS partition +- The volume IDs can be retrieved for each volume which has a drive letter assigned +- All partitions on the disk are of MBR types recognized by Windows or has a mapping specified using the /map command-line option + +If any of these checks fails, the conversion will not proceed and an error will be returned. + +## Syntax + + +
              MBR2GPT /validate|convert [/disk:<diskNumber>] [/logs:<logDirectory>] [/map:<source>=<destination>] [/allowFullOS] +
              + +### Options + +| Option | Description | +|----|-------------| +|/validate| Instructs MBR2GPT.exe to perform only the disk validation steps and report whether the disk is eligible for conversion. | +|/convert| Instructs MBR2GPT.exe to perform the disk validation and to proceed with the conversion if all validation tests pass. | +|/disk:\| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as that used by the diskpart.exe tool **SELECT DISK SYSTEM** command.| +|/logs:\| Specifies the directory where MBR2GPT.exe logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it will not be automatically created or overwritten.| +|/map:\=\| Specifies additional partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexadecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. | +|/allowFullOS| By default, MBR2GPT.exe is blocked unless it is run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
              **Note**: Since the existing MBR system partition is in use while running the full Windows environment, it cannot be reused. In this case, a new ESP is created by shrinking the OS partition.| + +## Examples + +### Validation example + +In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location, **%windir%**. + +``` +X:\>mbr2gpt /validate /disk:0 +MBR2GPT: Attempting to validate disk 0 +MBR2GPT: Retrieving layout of disk +MBR2GPT: Validating layout, disk sector size is: 512 +MBR2GPT: Validation completed successfully +``` + +### Conversion example + +In the following example: + +1. Using DiskPart, the current disk partition layout is displayed prior to conversion - three partitions are present on the MBR disk (disk 0): a system reserved partition, a Windows partition, and a recovery partition. A DVD-ROM is also present as volume 0. +2. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](https://msdn.microsoft.com/library/windows/desktop/aa363990.aspx) is **07** corresponding to the installable file system (IFS) type. +2. The MBR2GPT tool is used to convert disk 0. +3. The DiskPart tool displays that disk 0 is now using the GPT format. +4. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). +5. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](https://msdn.microsoft.com/library/windows/desktop/aa365449.aspx) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. + +>As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly. + +``` +X:\>DiskPart + +Microsoft DiskPart version 10.0.15048.0 + +Copyright (C) Microsoft Corporation. +On computer: MININT-K71F13N + +DISKPART> list volume + + Volume ### Ltr Label Fs Type Size Status Info + ---------- --- ----------- ----- ---------- ------- --------- -------- + Volume 0 F CENA_X64FRE UDF DVD-ROM 4027 MB Healthy + Volume 1 C System Rese NTFS Partition 499 MB Healthy + Volume 2 D Windows NTFS Partition 58 GB Healthy + Volume 3 E Recovery NTFS Partition 612 MB Healthy Hidden + +DISKPART> select volume 2 + +Volume 2 is the selected volume. + +DISKPART> list partition + + Partition ### Type Size Offset + ------------- ---------------- ------- ------- + Partition 1 Primary 499 MB 1024 KB +* Partition 2 Primary 58 GB 500 MB + Partition 3 Recovery 612 MB 59 GB + +DISKPART> detail partition + +Partition 2 +Type : 07 +Hidden: No +Active: No +Offset in Bytes: 524288000 + + Volume ### Ltr Label Fs Type Size Status Info + ---------- --- ----------- ----- ---------- ------- --------- -------- +* Volume 2 D Windows NTFS Partition 58 GB Healthy + +DISKPART> exit + +Leaving DiskPart... + +X:\>mbr2gpt /convert /disk:0 + +MBR2GPT will now attempt to convert disk 0. +If conversion is successful the disk can only be booted in GPT mode. +These changes cannot be undone! + +MBR2GPT: Attempting to convert disk 0 +MBR2GPT: Retrieving layout of disk +MBR2GPT: Validating layout, disk sector size is: 512 bytes +MBR2GPT: Trying to shrink the system partition +MBR2GPT: Trying to shrink the OS partition +MBR2GPT: Creating the EFI system partition +MBR2GPT: Installing the new boot files +MBR2GPT: Performing the layout conversion +MBR2GPT: Migrating default boot entry +MBR2GPT: Adding recovery boot entry +MBR2GPT: Fixing drive letter mapping +MBR2GPT: Conversion completed successfully +MBR2GPT: Before the new system can boot properly you need to switch the firmware to boot to UEFI mode! + +X:\>DiskPart + +Microsoft DiskPart version 10.0.15048.0 + +Copyright (C) Microsoft Corporation. +On computer: MININT-K71F13N + +DISKPART> list disk + + Disk ### Status Size Free Dyn Gpt + -------- ------------- ------- ------- --- --- + Disk 0 Online 60 GB 0 B * + +DISKPART> select disk 0 + +Disk 0 is now the selected disk. + +DISKPART> list volume + + Volume ### Ltr Label Fs Type Size Status Info + ---------- --- ----------- ----- ---------- ------- --------- -------- + Volume 0 F CENA_X64FRE UDF DVD-ROM 4027 MB Healthy + Volume 1 D Windows NTFS Partition 58 GB Healthy + Volume 2 C System Rese NTFS Partition 499 MB Healthy Hidden + Volume 3 FAT32 Partition 100 MB Healthy Hidden + Volume 4 E Recovery NTFS Partition 612 MB Healthy Hidden + +DISKPART> select volume 1 + +Volume 1 is the selected volume. + +DISKPART> list partition + + Partition ### Type Size Offset + ------------- ---------------- ------- ------- + Partition 1 Recovery 499 MB 1024 KB +* Partition 2 Primary 58 GB 500 MB + Partition 4 System 100 MB 59 GB + Partition 3 Recovery 612 MB 59 GB + +DISKPART> detail partition + +Partition 2 +Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 +Hidden : No +Required: No +Attrib : 0000000000000000 +Offset in Bytes: 524288000 + + Volume ### Ltr Label Fs Type Size Status Info + ---------- --- ----------- ----- ---------- ------- --------- -------- +* Volume 1 D Windows NTFS Partition 58 GB Healthy +``` + +## Specifications + +### Disk conversion workflow + +The following steps illustrate high-level phases of the MBR-to-GPT conversion process: + +1. Disk validation is performed. +2. The disk is repartitioned to create an EFI system partition (ESP) if one does not already exist. +3. UEFI boot files are installed to the ESP. +4. GPT metadata and layout information is applied. +5. The boot configuration data (BCD) store is updated. +6. Drive letter assignments are restored. + +### Creating an EFI system partition + +For Windows to remain bootable after the conversion, an EFI system partition (ESP) must be in place. MBR2GPT creates the ESP using the following rules: + +1. The existing MBR system partition is reused if it meets these requirements:
              + a. It is not also the OS or Windows Recovery Environment partition.
              + b. It is at least 100MB (or 260MB for 4K sector size disks) in size.
              + c. It is less than or equal to 1GB in size. This is a safety precaution to ensure it is not a data partition.
              + d. The conversion is not being performed from the full OS. In this case, the existing MBR system partition is in use and cannot be repurposed. +2. If the existing MBR system partition cannot be reused, a new ESP is created by shrinking the OS partition. This new partition has a size of 100MB (or 260MB for 4K sector size disks) and is formatted FAT32. + +If the existing MBR system partition is not reused for the ESP, it is no longer used by the boot process after the conversion. Other partitions are not modified. + +>[!IMPORTANT] +>If the existing MBR system partition is not reused for the ESP, it might be assigned a drive letter. If you do not wish to use this small partition, you must manually hide the drive letter. + +### Partition type mapping and partition attributes + +Since GPT partitions use a different set of type IDs than MBR partitions, each partition on the converted disk must be assigned a new type ID. The partition type mapping follows these rules: + +1. The ESP is always set to partition type PARTITION_SYSTEM_GUID (c12a7328-f81f-11d2-ba4b-00a0c93ec93b). +2. If an MBR partition is of a type that matches one of the entries specified in the /map switch, the specified GPT partition type ID is used. +3. If the MBR partition is of type 0x27, the partition is converted to a GPT partition of type PARTITION_MSFT_RECOVERY_GUID (de94bba4-06d1-4d40-a16a-bfd50179d6ac). +4. All other MBR partitions recognized by Windows are converted to GPT partitions of type PARTITION_BASIC_DATA_GUID (ebd0a0a2-b9e5-4433-87c0-68b6b72699c7). + +In addition to applying the correct partition types, partitions of type PARTITION_MSFT_RECOVERY_GUID also have the following GPT attributes set: +- GPT_ATTRIBUTE_PLATFORM_REQUIRED (0x0000000000000001) +- GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER (0x8000000000000000) + +For more information about partition types, see: +- [GPT partition types](https://msdn.microsoft.com/library/windows/desktop/aa365449.aspx) +- [MBR partition types](https://msdn.microsoft.com/library/windows/desktop/aa363990.aspx) + + +### Persisting drive letter assignments + +The conversion tool will attempt to remap all drive letter assignment information contained in the registry that correspond to the volumes of the converted disk. If a drive letter assignment cannot be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. **Important**: this code runs after the layout conversion has taken place, so the operation cannot be undone at this stage. + +The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It will then iterate through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry do the following: + +1. Check if the unique ID corresponds to any of the unique IDs for any of the volumes that are part of the converted disk. +2. If found, set the value to be the new unique ID, obtained after the layout conversion. +3. If the new unique ID cannot be set and the value name starts with \DosDevices, issue a console and log warning about the need for manual intervention in properly restoring the drive letter assignment. + +## Troubleshooting + +The tool will display status information in its output. Both validation and conversion are clear if any errors are encountered. For example, if one or more partitions do not translate properly, this is displayed and the conversion not performed. To view more detail about any errors that are encountered, see the associated [log files](#logs). + +### Logs + +Four log files are created by the MBR2GPT tool: + +- diagerr.xml +- diagwrn.xml +- setupact.log +- setuperr.log + +These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. Note: The setupact*.log files are different than the Windows Setup files that are found in the %Windir%\Panther directory. + +The default location for all these log files in Windows PE is **%windir%**. + +### Interactive help + +To view a list of options available when using the tool, type **mbr2gpt /?** + +The following text is displayed: + +``` + +C:\> mbr2gpt /? + +Converts a disk from MBR to GPT partitioning without modifying or deleting data on the disk. + +MBR2GPT.exe /validate|convert [/disk:] [/logs:] [/map:=] [/allowFullOS] + +Where: + + /validate + - Validates that the selected disk can be converted + without performing the actual conversion. + + /convert + - Validates that the selected disk can be converted + and performs the actual conversion. + + /disk: + - Specifies the disk number of the disk to be processed. + If not specified, the system disk is processed. + + /logs: + - Specifies the directory for logging. By default logs + are created in the %windir% directory. + + /map:= + - Specifies the GPT partition type to be used for a + given MBR partition type not recognized by Windows. + Multiple /map switches are allowed. + + /allowFullOS + - Allows the tool to be used from the full Windows + environment. By default, this tool can only be used + from the Windows Preinstallation Environment. +``` + +### Return codes + +MBR2GPT has the following associated return codes: + +| Return code | Description | +|----|-------------| +|0| Conversion completed successfully.| +|1| Conversion was canceled by the user.| +|2| Conversion failed due to an internal error.| +|3| Conversion failed due to an initialization error.| +|4| Conversion failed due to invalid command-line parameters. | +|5| Conversion failed due to error reading the geometry and layout of the selected disk.| +|6| Conversion failed because one or more volumes on the disk is encrypted.| +|7| Conversion failed because the geometry and layout of the selected disk do not meet requirements.| +|8| Conversion failed due to error while creating the EFI system partition.| +|9| Conversion failed due to error installing boot files.| +|10| Conversion failed due to error while applying GPT layout.| +|100| Conversion to GPT layout succeeded, but some boot configuration data entries could not be restored.| + + +### Determining the partition type + +You can type the following command at a Windows PowerShell prompt to display the disk number and partition type. Example output is also shown: + + +``` +PS C:\> Get-Disk | ft -Auto + +Number Friendly Name Serial Number HealthStatus OperationalStatus Total Size Partition Style +------ ------------- ------------- ------------ ----------------- ---------- --------------- +0 MTFDDAK256MAM-1K1 13050928F47C Healthy Online 238.47 GB MBR +1 ST1000DM003-1ER162 Z4Y3GD8F Healthy Online 931.51 GB GPT +``` + +You can also view the partition type of a disk by opening the Disk Management tool, right-clicking the disk number, clicking **Properties**, and then clicking the **Volumes** tab. See the following example: + +![Volumes](images/mbr2gpt-volume.png) + + +If Windows PowerShell and Disk Management are not available, such as when you are using Windows PE, you can determine the partition type at a command prompt with the DiskPart tool. To determine the partition style from a command line, type **diskpart** and then type **list disk**. See the following example: + +``` +X:\>DiskPart + +Microsoft DiskPart version 10.0.15048.0 + +Copyright (C) Microsoft Corporation. +On computer: MININT-K71F13N + +DISKPART> list disk + + Disk ### Status Size Free Dyn Gpt + -------- ------------- ------- ------- --- --- + Disk 0 Online 238 GB 0 B + Disk 1 Online 931 GB 0 B * +``` + +In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is formatted using GPT. + + +## Known issue + +### MBR2GPT.exe cannot run in Windows PE + +When you start a Windows 10, version 1903-based computer in the Windows Preinstallation Environment (Windows PE), you encounter the following issues: + +**Issue 1** When you run the MBR2GPT.exe command, the process exits without converting the drive. + +**Issue 2** When you manually run the MBR2GPT.exe command in a Command Prompt window, there is no output from the tool. + +**Issue 3** When MBR2GPT.exe runs inside an imaging process such as a Microsoft Endpoint Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. + +#### Cause + +This issue occurs because in Windows 10, version 1903 and later versions, MBR2GPT.exe requires access to the ReAgent.dll file. However, this dll file and its associated libraries are currently not included in the Windows PE boot image for Windows 10, version 1903 and later. + +#### Workaround + +To fix this issue, mount the Windows PE image (WIM), copy the missing file from the [Windows 10, version 1903 Assessment and Development Kit (ADK)](https://go.microsoft.com/fwlink/?linkid=2086042) source, and then commit the changes to the WIM. To do this, follow these steps: + +1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image). + +2. Copy the ReAgent files and the ReAgent localization files from the Window 10, version 1903 ADK source folder to the mounted WIM. + + For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window: + + > [!NOTE] + > You can access the ReAgent files if you have installed the User State Migration Tool (USMT) as a feature while installing Windows Assessment and Deployment Kit. + + **Command 1:** + ```cmd + copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" + ``` + This command copies three files: + + * ReAgent.admx + * ReAgent.dll + * ReAgent.xml + + **Command 2:** + ```cmd + copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" + ``` + This command copies two files: + * ReAgent.adml + * ReAgent.dll.mui + + > [!NOTE] + > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. + +3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). + + +## Related topics + +[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
              [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) diff --git a/windows/deployment/media/Windows10AutopilotFlowchart.pdf b/windows/deployment/media/Windows10AutopilotFlowchart.pdf new file mode 100644 index 0000000000..5ab6f1c52e Binary files /dev/null and b/windows/deployment/media/Windows10AutopilotFlowchart.pdf differ diff --git a/windows/deployment/media/Windows10Autopilotflowchart.vsdx b/windows/deployment/media/Windows10Autopilotflowchart.vsdx new file mode 100644 index 0000000000..ef702ab66b Binary files /dev/null and b/windows/deployment/media/Windows10Autopilotflowchart.vsdx differ diff --git a/windows/deployment/media/Windows10DeploymentConfigManager.pdf b/windows/deployment/media/Windows10DeploymentConfigManager.pdf new file mode 100644 index 0000000000..3a4c5f022e Binary files /dev/null and b/windows/deployment/media/Windows10DeploymentConfigManager.pdf differ diff --git a/windows/deployment/media/Windows10DeploymentConfigManager.vsdx b/windows/deployment/media/Windows10DeploymentConfigManager.vsdx new file mode 100644 index 0000000000..8b2db358ff Binary files /dev/null and b/windows/deployment/media/Windows10DeploymentConfigManager.vsdx differ diff --git a/windows/deployment/media/windows10-autopilot-flowchart.png b/windows/deployment/media/windows10-autopilot-flowchart.png new file mode 100644 index 0000000000..878c9d483d Binary files /dev/null and b/windows/deployment/media/windows10-autopilot-flowchart.png differ diff --git a/windows/deployment/media/windows10-deployment-config-manager.png b/windows/deployment/media/windows10-deployment-config-manager.png new file mode 100644 index 0000000000..509e041741 Binary files /dev/null and b/windows/deployment/media/windows10-deployment-config-manager.png differ diff --git a/windows/deployment/planning/TOC.md b/windows/deployment/planning/TOC.md deleted file mode 100644 index c9dd77d2d6..0000000000 --- a/windows/deployment/planning/TOC.md +++ /dev/null @@ -1,40 +0,0 @@ -# [Plan for Windows 10 deployment](index.md) -## [Windows 10 Enterprise FAQ for IT Pros](windows-10-enterprise-faq-itpro.md) -## [Windows 10 deployment considerations](windows-10-deployment-considerations.md) -## [Windows 10 compatibility](windows-10-compatibility.md) -## [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) - -## Features removed or planned for replacement -### [Windows 10 features lifecycle](features-lifecycle.md) -### [Windows 10, version 1903](windows-10-1903-removed-features.md) -### [Windows 10, version 1809](windows-10-1809-removed-features.md) -### [Windows 10, version 1803](windows-10-1803-removed-features.md) -### [Windows 10, version 1709](windows-10-1709-removed-features.md) -### [Windows 10, version 1703](windows-10-1703-removed-features.md) - -## Application Compatibility Toolkit (ACT) -### [Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) -### [SUA User's Guide](sua-users-guide.md) -#### [Using the SUA Wizard](using-the-sua-wizard.md) -#### [Using the SUA Tool](using-the-sua-tool.md) -##### [Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md) -##### [Showing Messages Generated by the SUA Tool](showing-messages-generated-by-the-sua-tool.md) -##### [Applying Filters to Data in the SUA Tool](applying-filters-to-data-in-the-sua-tool.md) -##### [Fixing Applications by Using the SUA Tool](fixing-applications-by-using-the-sua-tool.md) -### [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) -#### [Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) -##### [Available Data Types and Operators in Compatibility Administrator](available-data-types-and-operators-in-compatibility-administrator.md) -##### [Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md) -##### [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md) -##### [Creating a Custom Compatibility Fix in Compatibility Administrator](creating-a-custom-compatibility-fix-in-compatibility-administrator.md) -##### [Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md) -##### [Creating an AppHelp Message in Compatibility Administrator](creating-an-apphelp-message-in-compatibility-administrator.md) -##### [Viewing the Events Screen in Compatibility Administrator](viewing-the-events-screen-in-compatibility-administrator.md) -##### [Enabling and Disabling Compatibility Fixes in Compatibility Administrator](enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md) -##### [Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md) -#### [Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) -##### [Understanding and Using Compatibility Fixes](understanding-and-using-compatibility-fixes.md) -##### [Compatibility Fix Database Management Strategies and Deployment](compatibility-fix-database-management-strategies-and-deployment.md) -##### [Testing Your Application Mitigation Packages](testing-your-application-mitigation-packages.md) -#### [Using the Sdbinst.exe Command-Line Tool](using-the-sdbinstexe-command-line-tool.md) -### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) diff --git a/windows/deployment/planning/act-technical-reference.md b/windows/deployment/planning/act-technical-reference.md index b40be1932a..abb5e94fdb 100644 --- a/windows/deployment/planning/act-technical-reference.md +++ b/windows/deployment/planning/act-technical-reference.md @@ -1,48 +1,49 @@ ---- -title: Application Compatibility Toolkit (ACT) Technical Reference (Windows 10) -description: The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. -ms.assetid: d90d38b2-2718-4481-90eb-4480719627ba -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Application Compatibility Toolkit (ACT) Technical Reference - - -**Applies to** -- Windows 10, version 1607 - ->[!IMPORTANT] ->We've replaced the majority of functionality included in the Application Compatibility Toolkit (ACT) with [Windows Analytics](../update/windows-analytics-overview.md), a solution in the Microsoft Operations Management Suite. Windows Analytics gives enterprises the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. - -Microsoft developed Windows Analytics in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Windows Analytics was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10. - -With Windows diagnostic data enabled, Windows Analytics collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. - -Use Windows Analytics to get: -- A visual workflow that guides you from pilot to production -- Detailed computer and application inventory -- Powerful computer level search and drill-downs -- Guidance and insights into application and driver compatibility issues, with suggested fixes -- Data driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools, including System Center Configuration Manager - -The Windows Analytics workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. - -At the same time, we've kept the Standard User Analyzer tool, which helps you test your apps and to monitor API calls for potential compatibility issues, and the Compatibility Administrator, which helps you to resolve potential compatibility issues. - -## In this section - -|Topic |Description | -|------|------------| -|[Standard User Analyzer (SUA) User's Guide](sua-users-guide.md) |The Standard User Analyzer (SUA) helps you test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. | -|[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) |The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. | -|[Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) |You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions. | +--- +title: Application Compatibility Toolkit (ACT) Technical Reference (Windows 10) +description: The Microsoft Application Compatibility Toolkit (ACT) helps you see if the apps and devices in your org are compatible with different versions of Windows. +ms.assetid: d90d38b2-2718-4481-90eb-4480719627ba +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Application Compatibility Toolkit (ACT) Technical Reference + + +**Applies to** +- Windows 10, version 1607 + +>[!IMPORTANT] +>We've replaced the majority of functionality included in the Application Compatibility Toolkit (ACT) with [Windows Analytics](../update/windows-analytics-overview.md), a solution in the Microsoft Operations Management Suite. Windows Analytics gives enterprises the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. + +Microsoft developed Windows Analytics in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Windows Analytics was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10. + +With Windows diagnostic data enabled, Windows Analytics collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. + +Use Windows Analytics to get: +- A visual workflow that guides you from pilot to production +- Detailed computer and application inventory +- Powerful computer level search and drill-downs +- Guidance and insights into application and driver compatibility issues, with suggested fixes +- Data driven application rationalization tools +- Application usage information, allowing targeted validation; workflow to track validation progress and decisions +- Data export to commonly used software deployment tools, including Microsoft Endpoint Configuration Manager + +The Windows Analytics workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. + +At the same time, we've kept the Standard User Analyzer tool, which helps you test your apps and to monitor API calls for potential compatibility issues, and the Compatibility Administrator, which helps you to resolve potential compatibility issues. + +## In this section + +|Topic |Description | +|------|------------| +|[Standard User Analyzer (SUA) User's Guide](sua-users-guide.md) |The Standard User Analyzer (SUA) helps you test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. | +|[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) |The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. | +|[Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) |You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions. | diff --git a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md index 5222062842..5edd92497e 100644 --- a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md +++ b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md @@ -1,100 +1,101 @@ ---- -title: Applying Filters to Data in the SUA Tool (Windows 10) -description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply filters to the issues that the tool has found so that you can view only the information that interests you. -ms.assetid: 48c39919-3501-405d-bcf5-d2784cbb011f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Applying Filters to Data in the SUA Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -On the user interface for the Standard User Analyzer (SUA) tool, you can apply filters to the issues that the tool has found so that you can view only the information that interests you. - -**To apply filters to data in the SUA tool** - -1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). - -2. After you finish testing, in the SUA tool, click a tab that shows issues that the SUA tool has found. All tabs except the **App Info** tab can show issues. - -3. On the **Options** menu, click a command that corresponds to the filter that you want to apply. The following table describes the commands. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Options menu commandDescription

              Filter Noise

              Filters noise from the issues.

              -

              This command is selected by default.

              Load Noise Filter File

              Opens the Open Noise Filter File dialog box, in which you can load an existing noise filter (.xml) file.

              Export Noise Filter File

              Opens the Save Noise Filter File dialog box, in which you can save filter settings as a noise filter (.xml) file.

              Only Display Records with Application Name in StackTrace

              Filters out records that do not have the application name in the stack trace.

              -

              However, because the SUA tool captures only the first 32 stack frames, this command can also filter out real issues with the application where the call stack is deeper than 32 frames.

              Show More Details in StackTrace

              Shows additional stack frames that are related to the SUA tool, but not related to the diagnosed application.

              Warn Before Deleting AppVerifier Logs

              Displays a warning message before the SUA tool deletes all of the existing SUA-related log files on the computer.

              -

              This command is selected by default.

              Logging

              Provides the following logging-related options:

              -
                -
              • Show or hide log errors.

              • -
              • Show or hide log warnings.

              • -
              • Show or hide log information.

              • -
              -

              To maintain a manageable file size, we recommend that you do not select the option to show informational messages.

              - -   - -  - -  - - - - - +--- +title: Applying Filters to Data in the SUA Tool (Windows 10) +description: Learn how to apply filters to results from the Standard User Analyzer (SUA) tool while testing your application. +ms.assetid: 48c39919-3501-405d-bcf5-d2784cbb011f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Applying Filters to Data in the SUA Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +On the user interface for the Standard User Analyzer (SUA) tool, you can apply filters to the issues that the tool has found so that you can view only the information that interests you. + +**To apply filters to data in the SUA tool** + +1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). + +2. After you finish testing, in the SUA tool, click a tab that shows issues that the SUA tool has found. All tabs except the **App Info** tab can show issues. + +3. On the **Options** menu, click a command that corresponds to the filter that you want to apply. The following table describes the commands. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Options menu commandDescription

              Filter Noise

              Filters noise from the issues.

              +

              This command is selected by default.

              Load Noise Filter File

              Opens the Open Noise Filter File dialog box, in which you can load an existing noise filter (.xml) file.

              Export Noise Filter File

              Opens the Save Noise Filter File dialog box, in which you can save filter settings as a noise filter (.xml) file.

              Only Display Records with Application Name in StackTrace

              Filters out records that do not have the application name in the stack trace.

              +

              However, because the SUA tool captures only the first 32 stack frames, this command can also filter out real issues with the application where the call stack is deeper than 32 frames.

              Show More Details in StackTrace

              Shows additional stack frames that are related to the SUA tool, but not related to the diagnosed application.

              Warn Before Deleting AppVerifier Logs

              Displays a warning message before the SUA tool deletes all of the existing SUA-related log files on the computer.

              +

              This command is selected by default.

              Logging

              Provides the following logging-related options:

              +
                +
              • Show or hide log errors.

              • +
              • Show or hide log warnings.

              • +
              • Show or hide log information.

              • +
              +

              To maintain a manageable file size, we recommend that you do not select the option to show informational messages.

              + +   + +  + +  + + + + + diff --git a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md index a202b57844..f128528a5e 100644 --- a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md +++ b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md @@ -1,238 +1,239 @@ ---- -title: Available Data Types and Operators in Compatibility Administrator (Windows 10) -description: The Compatibility Administrator tool provides a way to query your custom-compatibility databases. -ms.assetid: 67d9c03e-ab9d-4fda-8a55-8c5b90266d3b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Available Data Types and Operators in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Compatibility Administrator tool provides a way to query your custom-compatibility databases. - -## Available Data Types - - -Customized-compatibility databases in Compatibility Administrator contain the following data types. - -- **Integer**. A numerical value with no fractional part. All integers are unsigned because none of the attributes can have a negative value. - -- **String**. A series of alphanumeric characters manipulated as a group. - -- **Boolean**. A value of True or False. - -## Available Attributes - - -The following table shows the attributes you can use for querying your customized-compatibility databases in Compatibility Administrator. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              AttributeDescriptionData type

              APP_NAME

              Name of the application.

              String

              DATABASE_GUID

              Unique ID for your compatibility database.

              String

              DATABASE_INSTALLED

              Specifies if you have installed the database.

              Boolean

              DATABASE_NAME

              Descriptive name of your database.

              String

              DATABASE_PATH

              Location of the database on your computer.

              String

              FIX_COUNT

              Number of compatibility fixes applied to a specific application.

              Integer

              FIX_NAME

              Name of your compatibility fix.

              String

              MATCH_COUNT

              Number of matching files for a specific, fixed application.

              Integer

              MATCHFILE_NAME

              Name of a matching file used to identify a specific, fixed application.

              String

              MODE_COUNT

              Number of compatibility modes applied to a specific, fixed application.

              Integer

              MODE_NAME

              Name of your compatibility mode.

              String

              PROGRAM_APPHELPTYPE

              Type of AppHelp message applied to an entry. The value can be 1 or 2, where 1 enables the program to run and 2 blocks the program.

              Integer

              PROGRAM_DISABLED

              Specifies if you disabled the compatibility fix for an application. If True, Compatibility Administrator does not apply the fixes to the application.

              Boolean

              PROGRAM_GUID

              Unique ID for an application.

              String

              PROGRAM_NAME

              Name of the application that you are fixing.

              String

              - - - -## Available Operators - - -The following table shows the operators that you can use for querying your customized-compatibility databases in the Compatibility Administrator. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              SymbolDescriptionData typePrecedence

              >

              Greater than

              Integer or string

              1

              >=

              Greater than or equal to

              Integer or string

              1

              <

              Less than

              Integer or string

              1

              <=

              Less than or equal to

              Integer or string

              1

              <>

              Not equal to

              Integer or string

              1

              =

              Equal to

              Integer, string, or Boolean

              1

              HAS

              A special SQL operator used to check if the left-hand operand contains a substring specified by the right-hand operand.

              Left-hand operand. MATCHFILE_NAME, MODE_NAME, FIX_NAME

              -
              -Note

              Only the HAS operator can be applied to the MATCHFILE_NAME, MODE_NAME, and FIX_NAME attributes.

              -
              -
              - -
              -

              Right-hand operand. String

              1

              OR

              Logical OR operator

              Boolean

              2

              AND

              Logical AND operator

              Boolean

              2

              - - - -## Related topics -[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) - - - - - - - - - +--- +title: Available Data Types and Operators in Compatibility Administrator (Windows 10) +description: The Compatibility Administrator tool provides a way to query your custom-compatibility databases. +ms.assetid: 67d9c03e-ab9d-4fda-8a55-8c5b90266d3b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Available Data Types and Operators in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The Compatibility Administrator tool provides a way to query your custom-compatibility databases. + +## Available Data Types + + +Customized-compatibility databases in Compatibility Administrator contain the following data types. + +- **Integer**. A numerical value with no fractional part. All integers are unsigned because none of the attributes can have a negative value. + +- **String**. A series of alphanumeric characters manipulated as a group. + +- **Boolean**. A value of True or False. + +## Available Attributes + + +The following table shows the attributes you can use for querying your customized-compatibility databases in Compatibility Administrator. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              AttributeDescriptionData type

              APP_NAME

              Name of the application.

              String

              DATABASE_GUID

              Unique ID for your compatibility database.

              String

              DATABASE_INSTALLED

              Specifies if you have installed the database.

              Boolean

              DATABASE_NAME

              Descriptive name of your database.

              String

              DATABASE_PATH

              Location of the database on your computer.

              String

              FIX_COUNT

              Number of compatibility fixes applied to a specific application.

              Integer

              FIX_NAME

              Name of your compatibility fix.

              String

              MATCH_COUNT

              Number of matching files for a specific, fixed application.

              Integer

              MATCHFILE_NAME

              Name of a matching file used to identify a specific, fixed application.

              String

              MODE_COUNT

              Number of compatibility modes applied to a specific, fixed application.

              Integer

              MODE_NAME

              Name of your compatibility mode.

              String

              PROGRAM_APPHELPTYPE

              Type of AppHelp message applied to an entry. The value can be 1 or 2, where 1 enables the program to run and 2 blocks the program.

              Integer

              PROGRAM_DISABLED

              Specifies if you disabled the compatibility fix for an application. If True, Compatibility Administrator does not apply the fixes to the application.

              Boolean

              PROGRAM_GUID

              Unique ID for an application.

              String

              PROGRAM_NAME

              Name of the application that you are fixing.

              String

              + + + +## Available Operators + + +The following table shows the operators that you can use for querying your customized-compatibility databases in the Compatibility Administrator. + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              SymbolDescriptionData typePrecedence

              >

              Greater than

              Integer or string

              1

              >=

              Greater than or equal to

              Integer or string

              1

              <

              Less than

              Integer or string

              1

              <=

              Less than or equal to

              Integer or string

              1

              <>

              Not equal to

              Integer or string

              1

              =

              Equal to

              Integer, string, or Boolean

              1

              HAS

              A special SQL operator used to check if the left-hand operand contains a substring specified by the right-hand operand.

              Left-hand operand. MATCHFILE_NAME, MODE_NAME, FIX_NAME

              +
              +Note

              Only the HAS operator can be applied to the MATCHFILE_NAME, MODE_NAME, and FIX_NAME attributes.

              +
              +
              + +
              +

              Right-hand operand. String

              1

              OR

              Logical OR operator

              Boolean

              2

              AND

              Logical AND operator

              Boolean

              2

              + + + +## Related topics +[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) + + + + + + + + + diff --git a/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md b/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md index 0652569347..36a7463bcc 100644 --- a/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md +++ b/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md @@ -1,54 +1,55 @@ ---- -title: Best practice recommendations for Windows To Go (Windows 10) -description: Best practice recommendations for Windows To Go -ms.assetid: 05e6e0ab-94ed-4c0c-a195-0abd006f0a86 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: best practices, USB, device, boot -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: mobility -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Best practice recommendations for Windows To Go - - -**Applies to** - -- Windows 10 - ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. - -The following are the best practice recommendations for using Windows To Go: - -- Always shut down Windows and wait for shutdown to complete before removing the Windows To Go drive. -- Do not insert the Windows To Go drive into a running computer. -- Do not boot the Windows To Go drive from a USB hub. Always insert the Windows To Go drive directly into a port on the computer. -- If available, use a USB 3.0 port with Windows To Go. -- Do not install non-Microsoft core USB drivers on Windows To Go. -- Suspend BitLocker on Windows host computers before changing the BIOS settings to boot from USB and then resume BitLocker protection. - -Additionally, we recommend that when you plan your deployment you should also plan a standard operating procedure for answering questions about which USB drives can be used for Windows To Go and how to enable booting from USB to assist your IT department or help desk in supporting users and work groups that want to use Windows To Go. It may be very helpful for your organization to work with your hardware vendors to create an IT standard for USB drives for use with Windows To Go, so that if groups within your organization want to purchase drives they can quickly determine which ones they should obtain. - -## More information - - -[Windows To Go: feature overview](windows-to-go-overview.md)
              -[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
              -[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
              -[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
              -[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md)
              - -  - -  - - - - - +--- +title: Best practice recommendations for Windows To Go (Windows 10) +description: Learn about best practice recommendations for using Windows To Go, like using a USB 3.0 port with Windows to Go if it's available. +ms.assetid: 05e6e0ab-94ed-4c0c-a195-0abd006f0a86 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: best practices, USB, device, boot +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: mobility +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Best practice recommendations for Windows To Go + + +**Applies to** + +- Windows 10 + +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. + +The following are the best practice recommendations for using Windows To Go: + +- Always shut down Windows and wait for shutdown to complete before removing the Windows To Go drive. +- Do not insert the Windows To Go drive into a running computer. +- Do not boot the Windows To Go drive from a USB hub. Always insert the Windows To Go drive directly into a port on the computer. +- If available, use a USB 3.0 port with Windows To Go. +- Do not install non-Microsoft core USB drivers on Windows To Go. +- Suspend BitLocker on Windows host computers before changing the BIOS settings to boot from USB and then resume BitLocker protection. + +Additionally, we recommend that when you plan your deployment you should also plan a standard operating procedure for answering questions about which USB drives can be used for Windows To Go and how to enable booting from USB to assist your IT department or help desk in supporting users and work groups that want to use Windows To Go. It may be very helpful for your organization to work with your hardware vendors to create an IT standard for USB drives for use with Windows To Go, so that if groups within your organization want to purchase drives they can quickly determine which ones they should obtain. + +## More information + + +[Windows To Go: feature overview](windows-to-go-overview.md)
              +[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
              +[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
              +[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
              +[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md)
              + +  + +  + + + + + diff --git a/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment.md b/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment.md deleted file mode 100644 index afb65c8724..0000000000 --- a/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Change history for Plan for Windows 10 deployment (Windows 10) -description: This topic lists new and updated topics in the Plan for Windows 10 deployment documentation for Windows 10 and Windows 10 Mobile. -ms.assetid: 70D9F4F8-F2A4-4FB4-9459-5B2BE7BCAC66 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 07/19/2017 -ms.topic: article ---- - -# Change history for Plan for Windows 10 deployment - - -This topic lists new and updated topics in the [Plan for Windows 10 deployment](index.md) documentation for [Windows 10 and Windows 10 Mobile](/windows/windows-10). - - -## RELEASE: Windows 10, version 1703 - -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following is a new topic: -- [Windows 10 Enterprise - FAQ for IT Professionals](windows-10-enterprise-faq-itpro.md) - -## January 2017 - -| New or changed topic | Description | -|----------------------|-------------| -| [Windows 10 Infrastructure Requirements](windows-10-infrastructure-requirements.md) | Added link for Windows Server 2008 R2 and Windows 7 activation and a link to Windows Server 2016 Volume Activation Tips | - -## September 2016 - -| New or changed topic | Description | -| --- | --- | -| Windows 10 servicing overview | New content replaced this topic; see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview) | -| Windows Update for Business

              Setup and deployment of Windows Update for Business

              Integration of Windows Update for Business with management solutions | New content replaced these topics; see [Manage updates using Windows Update for Business](https://technet.microsoft.com/itpro/windows/manage/waas-manage-updates-wufb) | - - -## RELEASE: Windows 10, version 1607 - -The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). - - -## July 2016 - - -| New or changed topic | Description | -|--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| -|[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) (multiple topics) |Redirected deprecated content to the [Upgrade Analytics](../upgrade/manage-windows-upgrades-with-upgrade-readiness.md) content. Only Standard User Analyzer and Compatibility Administrator continue to be supported.| -| [Windows 10 servicing overview](../update/waas-overview.md) | Content on this page was summarized. Detailed content about servicing branches was moved to the [Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) page. | - - -## May 2016 - - -| New or changed topic | Description | -|--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| -| [Deploy Windows 10 in a school](/education/windows/deploy-windows-10-in-a-school) | New| - -## December 2015 - - -| New or changed topic | Description | -|--------------------------------------------------------------------------------------------------------------------------------------------------|-------------| -| [Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) (multiple topics) | New | - - -## November 2015 - - -| New or changed topic | Description | -|--------------------------------------------------------------------------------------------------|-------------| -| [Chromebook migration guide](/education/windows/chromebook-migration-guide) | New | -| [Windows Update for Business](../update/waas-manage-updates-wufb.md) (multiple topics) | New | -| [Windows To Go: feature overview](windows-to-go-overview.md) (multiple topics) | Updated | - - - -## Related topics - - -[Change history for What's new in Windows 10](/windows/whats-new/change-history-for-what-s-new-in-windows-10) - -[Change history for Deploy Windows 10](../change-history-for-deploy-windows-10.md) - - - - - - - - - - diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md index d19359cc40..30dcd0de23 100644 --- a/windows/deployment/planning/compatibility-administrator-users-guide.md +++ b/windows/deployment/planning/compatibility-administrator-users-guide.md @@ -1,85 +1,72 @@ ---- -title: Compatibility Administrator User's Guide (Windows 10) -ms.assetid: 0ce05f66-9009-4739-a789-60f3ce380e76 -ms.reviewer: -manager: laurawi -ms.author: greglin -description: -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Compatibility Administrator User's Guide - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. Compatibility Administrator provides the following: - -- Compatibility fixes, compatibility modes, and AppHelp messages that you can use to resolve specific compatibility issues. - -- Tools for creating customized compatibility fixes, compatibility modes, AppHelp messages, and compatibility databases. - -- A query tool that you can use to search for installed compatibility fixes on your local computers. - -The following flowchart shows the steps for using the Compatibility Administrator tool to create your compatibility fixes, compatibility modes, and AppHelp messages. - -![act compatibility admin flowchart](images/dep-win8-l-act-compatadminflowchart.jpg) - -**Important**   -Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications. - - - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - -
              TopicDescription

              Using the Compatibility Administrator Tool

              This section provides information about using the Compatibility Administrator tool.

              Managing Application-Compatibility Fixes and Custom Fix Databases

              This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases.

              Using the Sdbinst.exe Command-Line Tool

              You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations.

              - - - - - - - - - - - +--- +title: Compatibility Administrator User's Guide (Windows 10) +ms.assetid: 0ce05f66-9009-4739-a789-60f3ce380e76 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows. +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-mar2020 +--- + +# Compatibility Administrator User's Guide + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. Compatibility Administrator provides the following: + +- Compatibility fixes, compatibility modes, and AppHelp messages that you can use to resolve specific compatibility issues. + +- Tools for creating customized compatibility fixes, compatibility modes, AppHelp messages, and compatibility databases. + +- A query tool that you can use to search for installed compatibility fixes on your local computers. + +The following flowchart shows the steps for using the Compatibility Administrator tool to create your compatibility fixes, compatibility modes, and AppHelp messages. + +![act compatibility admin flowchart](images/dep-win8-l-act-compatadminflowchart.jpg) + +> [!IMPORTANT] +> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications. + +## In this section + + ++++ + + + + + + + + + + + + + + + + + + + + +
              TopicDescription

              Using the Compatibility Administrator Tool

              This section provides information about using the Compatibility Administrator tool.

              Managing Application-Compatibility Fixes and Custom Fix Databases

              This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases.

              Using the Sdbinst.exe Command-Line Tool

              You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations.

              diff --git a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md index c7052c8a15..18f52b5803 100644 --- a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md +++ b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md @@ -4,7 +4,7 @@ ms.assetid: fdfbf02f-c4c4-4739-a400-782204fd3c6c ms.reviewer: manager: laurawi ms.author: greglin -description: +description: Learn about deploying your compatibility fixes as part of an application-installation package or through a centralized compatibility-fix database. ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: appcompat @@ -13,6 +13,7 @@ audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article +ms.custom: seo-marvel-mar2020 --- # Compatibility Fix Database Management Strategies and Deployment @@ -88,7 +89,7 @@ This approach tends to work best for organizations that have a well-developed de ### Merging Centralized Compatibility-Fix Databases -If you decide to use the centralized compatibility-fix database deployment strategy, you can merge any of your individual compatibility-fix databases. This enables you to create a single custom compatibility-fix database that can be used to search for and determine whether Windows® should apply a fix to a specific executable (.exe) file. We recommend merging your databases based on the following process. +If you decide to use the centralized compatibility-fix database deployment strategy, you can merge any of your individual compatibility-fix databases. This enables you to create a single custom compatibility-fix database that can be used to search for and determine whether Windows® should apply a fix to a specific executable (.exe) file. We recommend merging your databases based on the following process. **To merge your custom-compatibility databases** @@ -102,8 +103,8 @@ If you decide to use the centralized compatibility-fix database deployment strat 5. The team that manages the centralized database opens Custom DB1 and uses the Compatibility Administrator to include the new compatibility fixes that were included in Custom DB2. - **Note** - Custom DB1 contains a unique GUID that makes updating the database easier. For example, if you install a new version of the custom compatibility-fix database that uses the same GUID as the previous version, the computer will automatically uninstall the old version. + > [!NOTE] + > Custom DB1 contains a unique GUID that makes updating the database easier. For example, if you install a new version of the custom compatibility-fix database that uses the same GUID as the previous version, the computer will automatically uninstall the old version. @@ -113,7 +114,7 @@ If you decide to use the centralized compatibility-fix database deployment strat Deploying your custom compatibility-fix database into your organization requires you to perform the following actions: -1. Store your custom compatibility-fix database (.sdb file) in a location that is accessible to all of your organization’s computers. +1. Store your custom compatibility-fix database (.sdb file) in a location that is accessible to all of your organization's computers. 2. Use the Sdbinst.exe command-line tool to install the custom compatibility-fix database locally. @@ -123,23 +124,17 @@ In order to meet the two requirements above, we recommend that you use one of th You can package your .sdb file and a custom deployment script into an .msi file, and then deploy the .msi file into your organization. - **Important** - You must ensure that you mark your custom script so that it does not impersonate the calling user. For example, if you use Microsoft® Visual Basic® Scripting Edition (VBScript), the custom action type would be: + > [!IMPORTANT] + > You must ensure that you mark your custom script so that it does not impersonate the calling user. For example, if you use Microsoft® Visual Basic® Scripting Edition (VBScript), the custom action type would be: + >`msidbCustomActionTypeVBScript + msidbCustomActionTypeInScript + msidbCustomActionTypeNoImpersonate = 0x0006 + 0x0400 + 0x0800 = 0x0C06 = 3078 decimal)` - -~~~ -``` -msidbCustomActionTypeVBScript + msidbCustomActionTypeInScript + msidbCustomActionTypeNoImpersonate = 0x0006 + 0x0400 + 0x0800 = 0x0C06 = 3078 decimal) -``` -~~~ - - **Using a network share and a custom script** You can store your .sdb file on your network share and then call to a script that resides on your specified computers. -**Important** -You must ensure that you call the script at a time when it will receive elevated rights. For example, you should call the script by using computer startup scripts instead of a user logon script. You must also ensure that the installation of the custom compatibility-fix database occurs with Administrator rights. +> [!IMPORTANT] +> You must ensure that you call the script at a time when it will receive elevated rights. For example, you should call the script by using computer startup scripts instead of a user logon script. You must also ensure that the installation of the custom compatibility-fix database occurs with Administrator rights. diff --git a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md index 2ea1929b51..504dc52a3c 100644 --- a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md +++ b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md @@ -1,972 +1,974 @@ ---- -title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista (Windows 10) -description: You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions. -ms.assetid: cd51c824-557f-462a-83bb-54b0771b7dff -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions. - -**Important** -The Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator. You must use the 32-bit version for 32-bit applications and the 64-bit version to work for 64-bit applications. You will receive an error message if you try to use the wrong version. - -If you start the Compatibility Administrator as an Administrator (with elevated privileges), all repaired applications can run successfully; however, virtualization and redirection might not occur as expected. To verify that a compatibility fix addresses an issue, you must test the repaired application by running it under the destination user account. - - - -## Compatibility Fixes - - -The following table lists the known compatibility fixes for all Windows operating systems that have been released from Windows Vista through Windows 10. The fixes are listed in alphabetical order. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              FixFix Description

              8And16BitAggregateBlts

              Applications that are mitigated by 8/16-bit mitigation can exhibit performance issues. This layer aggregates all the blt operations and improves performance.

              8And16BitDXMaxWinMode

              Applications that use DX8/9 and are mitigated by the 8/16-bit mitigation are run in a maximized windowed mode. This layer mitigates applications that exhibit graphical corruption in full screen mode.

              8And16BitGDIRedraw

              This fix repairs applications that use GDI and that work in 8-bit color mode. The application is forced to repaint its window on RealizePalette.

              AccelGdipFlush

              This fix increases the speed of GdipFlush, which has perf issues in DWM.

              AoaMp4Converter

              This fix resolves a display issue for the AoA Mp4 Converter.

              BIOSRead

              This problem is indicated when an application cannot access the Device\PhysicalMemory object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.

              -

              The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the \Device\Physical memory information..

              BlockRunasInteractiveUser

              This problem occurs when InstallShield creates installers and uninstallers that fail to complete and that generate error messages or warnings.

              -

              The fix blocks InstallShield from setting the value of RunAs registry keys to InteractiveUser Because InteractiveUser no longer has Administrator rights.

              -
              -Note

              For more detailed information about this application fix, see Using the BlockRunAsInteractiveUser Fix.

              -
              -
              - -

              ChangeFolderPathToXPStyle

              This fix is required when an application cannot return shell folder paths when it uses the SHGetFolder API.

              -

              The fix intercepts the SHGetFolder path request to the common appdata file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.

              ClearLastErrorStatusonIntializeCriticalSection

              This fix is indicated when an application fails to start.

              -

              The fix modifies the InitializeCriticalSection function call so that it checks the NTSTATUS error code, and then sets the last error to ERROR_SUCCESS.

              CopyHKCUSettingsFromOtherUsers

              This problem occurs when an application's installer must run in elevated mode and depends on the HKCU settings that are provided for other users.

              -

              The fix scans the existing user profiles and tries to copy the specified keys into the HKEY_CURRENT_USER registry area.

              -

              You can control this fix further by entering the relevant registry keys as parameters that are separated by the ^ Symbol; for example: Software\MyCompany\Key1^Software\MyCompany\Key2.

              -
              -Note

              For more detailed information about this application fix, see Using the CopyHKCUSettingsFromOtherUsers Fix.

              -
              -
              - -

              CorrectCreateBrushIndirectHatch

              The problem is indicated by an access violation error message that displays and when the application fails when you select or crop an image.

              -

              The fix corrects the brush style hatch value, which is passed to the CreateBrushIndirect() function and enables the information to be correctly interpreted.

              CorrectFilePaths

              The problem is indicated when an application tries to write files to the hard disk and is denied access or receives a file not found or path not found error message.

              -

              The fix modifies the file path names to point to a new location on the hard disk.

              -
              -Note

              For more detailed information about the CorrectFilePaths application fix, see Using the CorrectFilePaths Fix. We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.

              -
              -
              - -

              CorrectFilePathsUninstall

              This problem occurs when an uninstalled application leaves behind files, directories, and links.

              -

              The fix corrects the file paths that are used by the uninstallation process of an application.

              -
              -Note

              For more detailed information about this fix, see Using the CorrectFilePathsUninstall Fix. We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.

              -
              -
              - -

              CorrectShellExecuteHWND

              This problem occurs when you start an executable (.exe) and a taskbar item blinks instead of an elevation prompt being opened, or when the application does not provide a valid HWND value when it calls the ShellExecute(Ex) function.

              -

              The fix intercepts the ShellExecute(Ex) calls, and then inspects the HWND value. If the value is invalid, this fix enables the call to use the currently active HWND value.

              -
              -Note

              For more detailed information about the CorrectShellExecuteHWND application fix, see Using the CorrectShellExecuteHWND Fix.

              -
              -
              - -

              CustomNCRender

              This fix instructs DWM to not render the non-client area, thereby forcing the application to do its own NC rendering. This often gives windows an XP look.

              DelayApplyFlag

              This fix applies a KERNEL, USER, or PROCESS flag if the specified DLL is loaded.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              DLL_Name;Flag_Type;Hexidecimal_Value

              -

              Where the DLL_Name is the name of the specific DLL, including the file extension. Flag_Type is KERNEL, USER, or PROCESS, and a Hexidecimal_Value, starting with 0x and up to 64-bits long.

              -
              -Note

              The PROCESS flag type can have a 32-bit length only. You can separate multiple entries with a backslash ().

              -
              -
              - -

              DeprecatedServiceShim

              The problem is indicated when an application tries to install a service that has a dependency on a deprecated service. An error message displays.

              -

              The fix intercepts the CreateService function calls and removes the deprecated dependency service from the lpDependencies parameter.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              Deprecated_Service\App_Service/Deprecated_Service2 \App_Service2

              -

              Where Deprecated_Service is the name of the service that has been deprecated and App_Service is the name of the specific application service that is to be modified; for example, NtLmSsp\WMI.

              -
              -Note

              If you do not provide an App_Service name, the deprecated service will be removed from all newly created services.

              -
              -
              - -
              -
              -Note

              You can separate multiple entries with a forward slash (/).

              -
              -
              - -

              DirectXVersionLie

              This problem occurs when an application fails because it does not find the correct version number for DirectX®.

              -

              The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              MAJORVERSION.MINORVERSION.LETTER

              -

              For example, 9.0.c.

              DetectorDWM8And16Bit

              This fix offeres mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8 .

              Disable8And16BitD3D

              This fix improves performance of 8/16-bit color applications that render using D3D and do not mix directdraw.

              Disable8And16BitModes

              This fix disables 8/16-bit color mitigation and enumeration of 8/16-bit color modes.

              DisableDWM

              The problem occurs when some objects are not drawn or object artifacts remain on the screen in an application.

              -

              The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.

              -
              -Note

              For more detailed information about this application fix, see Using the DisableDWM Fix.

              -
              -
              - -

              DisableFadeAnimations

              The problem is indicated when an application fade animations, buttons, or other controls do not function properly.

              -

              The fix disables the fade animations functionality for unsupported applications.

              DisableThemeMenus

              The problem is indicated by an application that behaves unpredictably when it tries to detect and use the correct Windows settings.

              -

              The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.

              DisableWindowsDefender

              The fix disables Windows Defender for security applications that do not work with Windows Defender.

              DWM8And16BitMitigation

              The fix offers mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8.

              DXGICompat

              The fix allows application-specific compatibility instructions to be passed to the DirectX engine.

              DXMaximizedWindowedMode

              Applications that use DX8/9 are run in a maximized windowed mode. This is required for applications that use GDI/DirectDraw in addition to Direct3D.

              ElevateCreateProcess

              The problem is indicated when installations, de-installations, or updates fail because the host process calls the CreateProcess function and it returns an ERROR_ELEVATION_REQUIRED error message.

              -

              The fix handles the error code and attempts to recall the CreateProcess function together with requested elevation. If the fixed application already has a UAC manifest, the error code will be returned unchanged.

              -
              -Note

              For more detailed information about this application fix, see Using the ElevateCreateProcess Fix.

              -
              -
              - -

              EmulateOldPathIsUNC

              The problem occurs when an application fails because of an incorrect UNC path.

              -

              The fix changes the PathIsUNC function to return a value of True for UNC paths in Windows.

              EmulateGetDiskFreeSpace

              The problem is indicated when an application fails to install or to run, and it generates an error message that there is not enough free disk space to install or use the application, even though there is enough free disk space to meet the application requirements.

              -

              The fix determines the amount of free space, so that if the amount of free space is larger than 2 GB, the compatibility fix returns a value of 2 GB, but if the amount of free space is smaller than 2 GB, the compatibility fix returns the actual free space amount.

              -
              -Note

              For more detailed information about this application fix, see Using the EmulateGetDiskFreeSpace Fix.

              -
              -
              - -

              EmulateSorting

              The problem occurs when an application experiences search functionality issues.

              -

              The fix forces applications that use the CompareStringW/LCMapString sorting table to use an older version of the table.

              -
              -Note

              For more detailed information about this e application fix, see Using the EmulateSorting Fix.

              -
              -
              - -

              EmulateSortingWindows61

              The fix emulates the sorting order of Windows 7 and Windows Server 2008 R2 for various APIs.

              EnableRestarts

              The problem is indicated when an application and computer appear to hang because processes cannot end to allow the computer to complete its restart processes.

              -

              The fix enables the computer to restart and finish the installation process by verifying and enabling that the SeShutdownPrivilege service privilege exists.

              -
              -Note

              For more detailed information about this application fix, see Using the EnableRestarts Fix.

              -
              -
              - -

              ExtraAddRefDesktopFolder

              The problem occurs when an application invokes the Release() method too many times and causes an object to be prematurely destroyed.

              -

              The fix counteracts the application's tries to obtain the shell desktop folder by invoking the AddRef() method on the Desktop folder, which is returned by the SHGetDesktopFolder function.

              FailObsoleteShellAPIs

              The problem occurs when an application fails because it generated deprecated API calls.

              -

              The fix either fully implements the obsolete functions or implements the obsolete functions with stubs that fail.

              -
              -Note

              You can type FailAll=1 at the command prompt to suppress the function implementation and force all functions to fail.

              -
              -
              - -

              FailRemoveDirectory

              The problem occurs when an application uninstallation process does not remove all of the application files and folders.

              -

              This fix fails calls to RemoveDirectory() when called with a path matching the one specified in the shim command-line. Only a single path is supported. The path can contain environment variables, but must be an exact path – no partial paths are supported.

              -

              The fix can resolve an issue where an application expects RemoveDirectory() to delete a folder immediately even though a handle is open to it.

              FakeLunaTheme

              The problem occurs when a theme application does not properly display: the colors are washed out or the user interface is not detailed.

              -

              The fix intercepts the GetCurrentThemeName API and returns the value for the Windows XP default theme, (Luna).

              -
              -Note

              For more detailed information about the FakeLunaTheme application fix, see Using the FakeLunaTheme Fix.

              -
              -
              - -

              FlushFile

              This problem is indicated when a file is updated and changes do not immediately appear on the hard disk. Applications cannot see the file changes.

              -

              The fix enables the WriteFile function to call to the FlushFileBuffers APIs, which flush the file cache onto the hard disk.

              FontMigration

              The fix replaces an application-requested font with a better font selection, to avoid text truncation.

              ForceAdminAccess

              The problem occurs when an application fails to function during an explicit administrator check.

              -

              The fix allows the user to temporarily imitate being a part of the Administrators group by returning a value of True during the administrator check.

              -
              -Note

              For more detailed information about this application fix, see Using the ForceAdminAccess Fix.

              -
              -
              - -

              ForceInvalidateOnClose

              The fix invalidates any windows that exist under a closing or hiding window for applications that rely on the invalidation messages.

              ForceLoadMirrorDrvMitigation

              The fix loads the Windows 8 mirror driver mitigation for applications where the mitigation is not automatically applied.

              FreestyleBMX

              The fix resolves an application race condition that is related to window message order.

              GetDriveTypeWHook

              The application presents unusual behavior during installation; for example, the setup program states that it cannot install to a user-specified location.

              -

              The fix changes GetDriveType() so that only the root information appears for the file path. This is required when an application passes an incomplete or badly-formed file path when it tries to retrieve the drive type on which the file path exists.

              GlobalMemoryStatusLie

              The problem is indicated by a Computer memory full error message that displays when you start an application.

              -

              The fix modifies the memory status structure, so that it reports a swap file that is 400 MB, regardless of the true swap file size.

              HandleBadPtr

              The problem is indicated by an access violation error message that displays because an API is performing pointer validation before it uses a parameter.

              -

              The fix supports using lpBuffer validation from the InternetSetOptionA and InternetSetOptionW functions to perform the additional parameter validation.

              HandleMarkedContentNotIndexed

              The problem is indicated by an application that fails when it changes an attribute on a file or directory.

              -

              The fix intercepts any API calls that return file attributes and directories that are invoked from the %TEMP% directory, and resets the FILE_ATTRIBUTE_NOT_CONTENT_INDEXED attribute to its original state.

              HeapClearAllocation

              The problem is indicated when the allocation process shuts down unexpectedly.

              -

              The fix uses zeros to clear out the heap allocation for an application.

              IgnoreAltTab

              The problem occurs when an application fails to function when special key combinations are used.

              -

              The fix intercepts the RegisterRawInputDevices API and prevents the delivery of the WM_INPUT messages. This delivery failure forces the included hooks to be ignored and forces DInput to use Windows-specific hooks.

              -
              -Note

              For more detailed information about this application fix, see Using the IgnoreAltTab Fix.

              -
              -
              - -

              IgnoreChromeSandbox

              The fix allows Google Chrome to run on systems that have ntdll loaded above 4GB.

              IgnoreDirectoryJunction

              The problem is indicated by a read or access violation error message that displays when an application tries to find or open files.

              -

              The fix links the FindNextFileW, FindNextFileA, FindFirstFileExW, FindFirstFileExA, FindFirstFileW and FindFirstFileA APIs to prevent them from returning directory junctions.

              -
              -Note

              Symbolic links appear starting in Windows Vista.

              -
              -
              - -

              IgnoreException

              The problem is indicated when an application stops functioning immediately after it starts, or the application starts with only a cursor appearing on the screen.

              -

              The fix enables the application to ignore specified exceptions. By default, this fix ignores privileged-mode exceptions; however, it can be configured to ignore any exception.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              Exception1;Exception2

              -

              Where Exception1 and Exception2 are specific exceptions to be ignored. For example: ACCESS_VIOLATION_READ:1;ACCESS_VIOLATION_WRITE:1.

              -
              -Important

              You should use this compatibility fix only if you are certain that it is acceptable to ignore the exception. You might experience additional compatibility issues if you choose to incorrectly ignore an exception.

              -
              -
              - -
              -
              -Note

              For more detailed information about this application fix, see Using the IgnoreException Fix.

              -
              -
              - -

              IgnoreFloatingPointRoundingControl

              This fix enables an application to ignore the rounding control request and to behave as expected in previous versions of the application.

              -

              Before floating point SSE2 support in the C runtime library, the rounding control request was being ignored which would use round to nearest option by default. This shim ignores the rounding control request to support applications relying on old behavior.

              IgnoreFontQuality

              The problem occurs when application text appears to be distorted.

              -

              The fix enables color-keyed fonts to properly work with anti-aliasing.

              IgnoreMessageBox

              The problem is indicated by a message box that displays with debugging or extraneous content when the application runs on an unexpected operating system.

              -

              The fix intercepts the MessageBox* APIs and inspects them for specific message text. If matching text is found, the application continues without showing the message box.

              -
              -Note

              For more detailed information about this application fix, see Using the IgnoreMessageBox Fix.

              -
              -
              - -

              IgnoreMSOXMLMF

              The problem is indicated by an error message that states that the operating system cannot locate the MSVCR80D.DLL file.

              -

              The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system any time that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.

              IgnoreSetROP2

              The fix ignores read-modify-write operations on the desktop to avoid performance issues.

              InstallComponent

              The fix prompts the user to install.Net 3.5 or .Net 2.0 because .Net is not included with Windows 8.

              LoadLibraryRedirect

              The fix forces an application to load system versions of libraries instead of loading redistributable versions that shipped with the application.

              LocalMappedObject

              The problem occurs when an application unsuccessfully tries to create an object in the Global namespace.

              -

              The fix intercepts the function call to create the object and replaces the word Global with Local.

              -
              -Note

              For more detailed information about this application fix, see Using the LocalMappedObject Fix.

              -
              -
              - -

              MakeShortcutRunas

              The problem is indicated when an application fails to uninstall because of access-related errors.

              -

              The fix locates any RunDLL.exe-based uninstallers and forces them to run with different credentials during the application installation. After it applies this fix, the installer will create a shortcut that specifies a matching string to run during the application installation, thereby enabling the uninstallation to occur later.

              -
              -Note

              For more detailed information about this application fix, see Using the MakeShortcutRunas Fix

              -
              -
              - -

              ManageLinks

              The fix intercepts common APIs that are going to a directory or to an executable (.exe) file, and then converts any symbolic or directory junctions before passing it back to the original APIs.

              MirrorDriverWithComposition

              The fix allows mirror drivers to work properly with acceptable performance with desktop composition.

              MoveToCopyFileShim

              The problem occurs when an application experiences security access issues during setup.

              -

              The fix forces the CopyFile APIs to run instead of the MoveFile APIs. CopyFile APIs avoid moving the security descriptor, which enables the application files to get the default descriptor of the destination folder and prevents the security access issue.

              OpenDirectoryAcl

              The problem is indicated by an error message that states that you do not have the appropriate permissions to access the application.

              -

              The fix reduces the security privilege levels on a specified set of files and folders.

              -
              -Note

              For more detailed information about this application fix, see Using the OpenDirectoryACL Fix.

              -
              -
              - -

              PopCapGamesForceResPerf

              The fix resolves the performance issues in PopCap games like Bejeweled2. The performance issues are visible in certain low-end cards at certain resolutions where the 1024x768 buffer is scaled to fit the display resolution.

              PreInstallDriver

              The fix preinstalls drivers for applications that would otherwise try to install or start drivers during the initial start process.

              PreInstallSmarteSECURE

              The fix preinstalls computer-wide CLSIDs for applications that use SmartSECURE copy protection, which would otherwise try to install the CLSIDs during the initial start process.

              ProcessPerfData

              The problem is indicated by an Unhandled Exception error message because the application tried to read the process performance data registry value to determine if another instance of the application is running.

              -

              The fix handles the failure case by passing a fake process performance data registry key, so that the application perceives that it is the only instance running.

              -
              -Note

              This issue seems to occur most frequently with .NET applications.

              -
              -
              - -

              PromoteDAM

              The fix registers an application for power state change notifications.

              PropagateProcessHistory

              The problem occurs when an application incorrectly fails to apply an application fix.

              -

              The fix sets the _PROCESS_HISTORY environment variable so that child processes can look in the parent directory for matching information while searching for application fixes.

              ProtectedAdminCheck

              The problem occurs when an application fails to run because of incorrect Protected Administrator permissions.

              -

              The fix addresses the issues that occur when applications use non-standard Administrator checks, thereby generating false positives for user accounts that are being run as Protected Administrators. In this case, the associated SID exists, but it is set as deny-only.

              RedirectCRTTempFile

              The fix intercepts failing CRT calls that try to create a temporary file at the root of the volume, thereby redirecting the calls to a temporary file in the user's temporary directory.

              RedirectHKCUKeys

              The problem occurs when an application cannot be accessed because of User Account Control (UAC) restrictions.

              -

              The fix duplicates any newly created HKCU keys to other users' HKCU accounts. This fix is generic for UAC restrictions, whereby the HKCU keys are required, but are unavailable to an application at runtime.

              RedirectMP3Codec

              This problem occurs when you cannot play MP3 files.

              -

              The fix intercepts the CoCreateInstance call for the missing filter and then redirects it to a supported version.

              RedirectShortcut

              The problem occurs when an application cannot be accessed by its shortcut, or application shortcuts are not removed during the application uninstallation process.

              -

              The fix redirects all of the shortcuts created during the application setup to appear according to a specified path.

              -
                -
              • Start Menu shortcuts: Appear in the \ProgramData\Microsoft\Windows\Start Menu directory for all users.

              • -
              • Desktop or Quick Launch shortcuts:You must manually place the shortcuts on the individual user's desktop or Quick Launch bar.

              • -
              -

              This issue occurs because of UAC restrictions: specifically, when an application setup runs by using elevated privileges and stores the shortcuts according to the elevated user's context. In this situation, a restricted user cannot access the shortcuts.

              -

              You cannot apply this fix to an .exe file that includes a manifest and provides a runlevel.

              RelaunchElevated

              The problem occurs when installers, uninstallers, or updaters fail when they are started from a host application.

              -

              The fix enables a child .exe file to run with elevated privileges when it is difficult to determine the parent process with either the ElevateCreateProcess fix or by marking the .exe files to RunAsAdmin.

              -
              -Note

              For more detailed information about this application fix, see Using the RelaunchElevated Fix.

              -
              -
              - -

              RetryOpenSCManagerWithReadAccess

              The problem occurs when an application tries to open the Service Control Manager (SCM) and receives an Access Denied error message.

              -

              The fix retries the call and requests a more restricted set of rights that include the following:

              -

              RetryOpenServiceWithReadAccess

              The problem occurs when an Unable to open service due to your application using the OpenService() API to test for the existence of a particular service error message displays.

              -

              The fix retries the OpenService() API call and verifies that the user has Administrator rights, is not a Protected Administrator, and by using read-only access. Applications can test for the existence of a service by calling the OpenService() API but some applications ask for all access when making this check. This fix retries the call but only asking for read-only access. The user needs to be an administrator for this to work

              -
              -Note

              For more detailed information about this application fix, see Using the RetryOpenServiceWithReadAccess Fix.

              -
              -
              - -

              RunAsAdmin

              The problem occurs when an application fails to function by using the Standard User or Protected Administrator account.

              -

              The fix enables the application to run by using elevated privileges. The fix is the equivalent of specifying requireAdministrator in an application manifest.

              -
              -Note

              For more detailed information about this application fix, see Using the RunAsAdmin Fix.

              -
              -
              - -

              RunAsHighest

              The problem occurs when administrators cannot view the read/write version of an application that presents a read-only view to standard users.

              -

              The fix enables the application to run by using the highest available permissions. This is the equivalent of specifying highestAvailable in an application manifest.

              -
              -Note

              For more detailed information about this application fix, see Using the RunAsHighest Fix.

              -
              -
              - -

              RunAsInvoker

              The problem occurs when an application is not detected as requiring elevation.

              -

              The fix enables the application to run by using the privileges that are associated with the creation process, without requiring elevation. This is the equivalent of specifying asInvoker in an application manifest.

              -
              -Note

              For more detailed information about this application fix, see Using the RunAsInvoker Fix.

              -
              -
              - -

              SecuROM7

              The fix repairs applications by using SecuROM7 for copy protection.

              SessionShim

              The fix intercepts API calls from applications that are trying to interact with services that are running in another session, by using the terminal service name prefix (Global or Local) as the parameter.

              -

              At the command prompt, you can supply a list of objects to modify, separating the values by a double backslash (). Or, you can choose not to include any parameters, so that all of the objects are modified.

              -
              -Important

              Users cannot log in as Session 0 (Global Session) in Windows Vista and later. Therefore, applications that require access to Session 0 automatically fail.

              -
              -
              - -
              -
              -Note

              For more detailed information about this application fix, see Using the SessionShim Fix.

              -
              -
              - -

              SetProtocolHandler

              The fix registers an application as a protocol handler.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              Client;Protocol;App

              -

              Where the Client is the name of the email protocol, Protocol is mailto, and App is the name of the application.

              -
              -Note

              Only the mail client and the mailto protocol are supported. You can separate multiple clients by using a backslash ().

              -
              -
              - -

              SetupCommitFileQueueIgnoreWow

              The problem occurs when a 32-bit setup program fails to install because it requires 64-bit drivers.

              -

              The fix disables the Wow64 file system that is used by the 64-bit editions of Windows, to prevent 32-bit applications from accessing 64-bit file systems during the application setup.

              SharePointDesigner2007

              The fix resolves an application bug that severely slows the application when it runs in DWM.

              ShimViaEAT

              The problem occurs when an application fails, even after applying acompatibility fix that is known to fix an issue. Applications that use unicows.dll or copy protection often present this issue.

              -

              The fix applies the specified compatibility fixes by modifying the export table and by nullifying the use of module inclusion and exclusion.

              -
              -Note

              For more information about this application fix, see Using the ShimViaEAT Fix.

              -
              -
              - -

              ShowWindowIE

              The problem occurs when a web application experiences navigation and display issues because of the tabbing feature.

              -

              The fix intercepts the ShowWindow API call to address the issues that can occur when a web application determines that it is in a child window. This fix calls the real ShowWindow API on the top-level parent window.

              SierraWirelessHideCDROM

              The fix repairs the Sierra Wireless Driver installation, thereby preventing bugcheck.

              Sonique2

              The application uses an invalid window style, which breaks in DWM. This fix replaces the window style with a valid value.

              SpecificInstaller

              The problem occurs when an application installation file fails to be picked up by the GenericInstaller function.

              -

              The fix flags the application as being an installer file (for example, setup.exe), and then prompts for elevation.

              -
              -Note

              For more detailed information about this application fix, see Using the SpecificInstaller Fix.

              -
              -
              - -

              SpecificNonInstaller

              The problem occurs when an application that is not an installer (and has sufficient privileges) generates a false positive from the GenericInstaller function.

              -

              The fix flags the application to exclude it from detection by the GenericInstaller function.

              -
              -Note

              For more detailed information about this application fix, see Using the SpecificNonInstaller Fix.

              -
              -
              - -

              SystemMetricsLie

              The fix replaces SystemMetrics values and SystemParametersInfo values with the values of previous Windows versions.

              TextArt

              The application receives different mouse coordinates with DWM ON versus DWM OFF, which causes the application to hang. This fix resolves the issue.

              TrimDisplayDeviceNames

              The fix trims the names of the display devices that are returned by the EnumDisplayDevices API.

              UIPICompatLogging

              The fix enables the logging of Windows messages from Internet Explorer and other processes.

              UIPIEnableCustomMsgs

              The problem occurs when an application does not properly communicate with other processes because customized Windows messages are not delivered.

              -

              The fix enables customized Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the RegisterWindowMessage function, followed by the ChangeWindowMessageFilter function in the code.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              MessageString1 MessageString2

              -

              Where MessageString1 and MessageString2 reflect the message strings that can pass.

              -
              -Note

              Multiple message strings must be separated by spaces. For more detailed information about this application fix, see Using the UIPIEnableCustomMsgs Fix.

              -
              -
              - -

              UIPIEnableStandardMsgs

              The problem occurs when an application does not communicate properly with other processes because standard Windows messages are not delivered.

              -

              The fix enables standard Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the ChangeWindowMessageFilter function in the code.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              1055 1056 1069

              -

              Where 1055 reflects the first message ID, 1056 reflects the second message ID, and 1069 reflects the third message ID that can pass.

              -
              -Note

              Multiple messages can be separated by spaces. For more detailed information about this application fix, see Using the UIPIEnableStandardMsgs Fix [act].

              -
              -
              - -

              VirtualizeDeleteFileLayer

              The fix virtualizes DeleteFile operations for applications that try to delete protected files.

              VirtualizeDesktopPainting

              This fix improves the performance of a number of operations on the Desktop DC while using DWM.

              VirtualRegistry

              The problem is indicated when a Component failed to be located error message displays when an application is started.

              -

              The fix enables the registry functions to allow for virtualization, redirection, expansion values, version spoofing, the simulation of performance data counters, and so on.

              -

              For more detailed information about this application fix, see Using the VirtualRegistry Fix.

              VirtualizeDeleteFile

              The problem occurs when several error messages display and the application cannot delete files.

              -

              The fix makes the application's DeleteFile function call a virtual call in an effort to remedy the UAC and file virtualization issues that were introduced with Windows Vista. This fix also links other file APIs (for example, GetFileAttributes) to ensure that the virtualization of the file is deleted.

              -
              -Note

              For more detailed information about this application fix, see Using the VirtualizeDeleteFile Fix.

              -
              -
              - -

              VirtualizeHKCRLite

              The problem occurs when an application fails to register COM components at runtime.

              -

              The fix redirects the HKCR write calls (HKLM) to the HKCU hive for a per-user COM registration. This operates much like the VirtualRegistry fix when you use the VirtualizeHKCR parameter; however, VirtualizeHKCRLite provides better performance.

              -

              HKCR is a virtual merge of the HKCU\Software\Classes and HKLM\Software\Classes directories. The use of HKCU is preferred if an application is not elevated and is ignored if the application is elevated.

              -

              You typically will use this compatibility fix in conjunction with the VirtualizeRegisterTypeLib fix.

              -

              For more detailed information about this application fix, see Using the VirtualizeHKCRLite Fix.

              VirtualizeRegisterTypeLib

              The fix, when it is used with the VirtualizeHKCRLite fix, ensures that the type library and the COM class registration happen simultaneously. This functions much like the RegistryTypeLib fix when the RegisterTypeLibForUser parameter is used.

              -
              -Note

              For more detailed information about this application fix, see Using the VirtualizeRegisterTypelib Fix.

              -
              -
              - -

              WaveOutIgnoreBadFormat

              This problem is indicated by an error message that states: Unable to initialize sound device from your audio driver; the application then closes.

              -

              The fix enables the application to ignore the format error and continue to function properly.

              WerDisableReportException

              The fix turns off the silent reporting of exceptions to the Windows Error Reporting tool, including those that are reported by Object Linking and Embedding-Database (OLE DB). The fix intercepts the RtlReportException API and returns a STATUS_NOT_SUPPORTED error message.

              Win7RTM/Win8RTM

              The layer provides the application with Windows 7/Windows 8 compatibility mode.

              WinxxRTMVersionLie

              The problem occurs when an application fails because it does not find the correct version number for the required Windows operating system.

              -

              All version lie compatibility fixes address the issue whereby an application fails to function because it is checking for, but not finding, a specific version of the operating system. The version lie fix returns the appropriate operating system version information. For example, the VistaRTMVersionLie returns the Windows Vista version information to the application, regardless of the actual operating system version that is running on the computer.

              Wing32SystoSys32

              The problem is indicated by an error message that states that the WinG library was not properly installed.

              -

              The fix detects whether the WinG32 library exists in the correct directory. If the library is located in the wrong location, this fix copies the information (typically during the runtime of the application) into the %WINDIR% \system32 directory.

              -
              -Important

              The application must have Administrator privileges for this fix to work.

              -
              -
              - -

              WinSrv08R2RTM

              WinXPSP2VersionLie

              The problem occurs when an application experiences issues because of a VB runtime DLL.

              -

              The fix forces the application to follow these steps:

              -
                -
              1. Open the Compatibility Administrator, and then select None for Operating System Mode.

              2. -
              3. On the Compatibility Fixes page, click WinXPSP2VersionLie, and then click Parameters.

                -

                The Options for <fix_name> dialog box appears.

              4. -
              5. Type vbrun60.dll into the Module Name box, click Include, and then click Add.

              6. -
              7. Save the custom database.

                -
                -Note

                For more information about the WinXPSP2VersionLie application fix, see Using the WinXPSP2VersionLie Fix.

                -
                -
                - -
              8. -

              WRPDllRegister

              The application fails when it tries to register a COM component that is released together with Windows Vista and later.

              -

              The fix skips the processes of registering and unregistering WRP-protected COM components when calling the DLLRegisterServer and DLLUnregisterServer functions.

              -

              You can control this fix further by typing the following command at the command prompt:

              -

              Component1.dll;Component2.dll

              -

              Where Component1.dll and Component2.dll reflect the components to be skipped.

              -
              -Note

              For more detailed information about this application fix, see Using the WRPDllRegister Fix.

              -
              -
              - -

              WRPMitigation

              The problem is indicated when an access denied error message displays when the application tries to access a protected operating system resource by using more than read-only access.

              -

              The fix emulates the successful authentication and modification of file and registry APIs, so that the application can continue.

              -
              -Note

              For more detailed information about WRPMitigation, see Using the WRPMitigation Fix.

              -
              -
              - -

              WRPRegDeleteKey

              The problem is indicated by an access denied error message that displays when the application tries to delete a registry key.

              -

              The fix verifies whether the registry key is WRP-protected. If the key is protected, this fix emulates the deletion process.

              XPAfxIsValidAddress

              The fix emulates the behavior of Windows XP for MFC42!AfxIsValidAddress.

              - - - -## Compatibility Modes - - -The following table lists the known compatibility modes. - - ----- - - - - - - - - - - - - - - - - - - - -
              Compatibility Mode NameDescriptionIncluded Compatibility Fixes

              WinSrv03

              Emulates the Windows Server 2003 operating system.

                -
              • Win2k3RTMVersionLie

              • -
              • VirtualRegistry

              • -
              • ElevateCreateProcess

              • -
              • EmulateSorting

              • -
              • FailObsoleteShellAPIs

              • -
              • LoadLibraryCWD

              • -
              • HandleBadPtr

              • -
              • GlobalMemoryStatus2GB

              • -
              • RedirectMP3Codec

              • -
              • EnableLegacyExceptionHandlinginOLE

              • -
              • NoGhost

              • -
              • HardwareAudioMixer

              • -

              WinSrv03Sp1

              Emulates the Windows Server 2003 with Service Pack 1 (SP1) operating system.

                -
              • Win2K3SP1VersionLie

              • -
              • VirtualRegistry

              • -
              • ElevateCreateProcess

              • -
              • EmulateSorting

              • -
              • FailObsoleteShellAPIs

              • -
              • LoadLibraryCWD

              • -
              • HandleBadPtr

              • -
              • EnableLegacyExceptionHandlinginOLE

              • -
              • RedirectMP3Codec

              • -
              • HardwareAudioMixer

              • -
              +--- +title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, & Windows Vista +description: Find compatibility fixes for all Windows operating systems that have been released from Windows Vista through Windows 10. +ms.assetid: cd51c824-557f-462a-83bb-54b0771b7dff +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions. + +> [!IMPORTANT] +> The Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator. You must use the 32-bit version for 32-bit applications and the 64-bit version to work for 64-bit applications. You will receive an error message if you try to use the wrong version. + +If you start the Compatibility Administrator as an Administrator (with elevated privileges), all repaired applications can run successfully; however, virtualization and redirection might not occur as expected. To verify that a compatibility fix addresses an issue, you must test the repaired application by running it under the destination user account. + + + +## Compatibility Fixes + + +The following table lists the known compatibility fixes for all Windows operating systems that have been released from Windows Vista through Windows 10. The fixes are listed in alphabetical order. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              FixFix Description

              8And16BitAggregateBlts

              Applications that are mitigated by 8/16-bit mitigation can exhibit performance issues. This layer aggregates all the blt operations and improves performance.

              8And16BitDXMaxWinMode

              Applications that use DX8/9 and are mitigated by the 8/16-bit mitigation are run in a maximized windowed mode. This layer mitigates applications that exhibit graphical corruption in full screen mode.

              8And16BitGDIRedraw

              This fix repairs applications that use GDI and that work in 8-bit color mode. The application is forced to repaint its window on RealizePalette.

              AccelGdipFlush

              This fix increases the speed of GdipFlush, which has perf issues in DWM.

              AoaMp4Converter

              This fix resolves a display issue for the AoA Mp4 Converter.

              BIOSRead

              This problem is indicated when an application cannot access the Device\PhysicalMemory object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.

              +

              The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the \Device\Physical memory information..

              BlockRunasInteractiveUser

              This problem occurs when InstallShield creates installers and uninstallers that fail to complete and that generate error messages or warnings.

              +

              The fix blocks InstallShield from setting the value of RunAs registry keys to InteractiveUser Because InteractiveUser no longer has Administrator rights.

              +
              +Note

              For more detailed information about this application fix, see Using the BlockRunAsInteractiveUser Fix.

              +
              +
              + +

              ChangeFolderPathToXPStyle

              This fix is required when an application cannot return shell folder paths when it uses the SHGetFolder API.

              +

              The fix intercepts the SHGetFolder path request to the common appdata file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.

              ClearLastErrorStatusonIntializeCriticalSection

              This fix is indicated when an application fails to start.

              +

              The fix modifies the InitializeCriticalSection function call so that it checks the NTSTATUS error code, and then sets the last error to ERROR_SUCCESS.

              CopyHKCUSettingsFromOtherUsers

              This problem occurs when an application's installer must run in elevated mode and depends on the HKCU settings that are provided for other users.

              +

              The fix scans the existing user profiles and tries to copy the specified keys into the HKEY_CURRENT_USER registry area.

              +

              You can control this fix further by entering the relevant registry keys as parameters that are separated by the ^ Symbol; for example: Software\MyCompany\Key1^Software\MyCompany\Key2.

              +
              +Note

              For more detailed information about this application fix, see Using the CopyHKCUSettingsFromOtherUsers Fix.

              +
              +
              + +

              CorrectCreateBrushIndirectHatch

              The problem is indicated by an access violation error message that displays and when the application fails when you select or crop an image.

              +

              The fix corrects the brush style hatch value, which is passed to the CreateBrushIndirect() function and enables the information to be correctly interpreted.

              CorrectFilePaths

              The problem is indicated when an application tries to write files to the hard disk and is denied access or receives a file not found or path not found error message.

              +

              The fix modifies the file path names to point to a new location on the hard disk.

              +
              +Note

              For more detailed information about the CorrectFilePaths application fix, see Using the CorrectFilePaths Fix. We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.

              +
              +
              + +

              CorrectFilePathsUninstall

              This problem occurs when an uninstalled application leaves behind files, directories, and links.

              +

              The fix corrects the file paths that are used by the uninstallation process of an application.

              +
              +Note

              For more detailed information about this fix, see Using the CorrectFilePathsUninstall Fix. We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.

              +
              +
              + +

              CorrectShellExecuteHWND

              This problem occurs when you start an executable (.exe) and a taskbar item blinks instead of an elevation prompt being opened, or when the application does not provide a valid HWND value when it calls the ShellExecute(Ex) function.

              +

              The fix intercepts the ShellExecute(Ex) calls, and then inspects the HWND value. If the value is invalid, this fix enables the call to use the currently active HWND value.

              +
              +Note

              For more detailed information about the CorrectShellExecuteHWND application fix, see Using the CorrectShellExecuteHWND Fix.

              +
              +
              + +

              CustomNCRender

              This fix instructs DWM to not render the non-client area, thereby forcing the application to do its own NC rendering. This often gives windows an XP look.

              DelayApplyFlag

              This fix applies a KERNEL, USER, or PROCESS flag if the specified DLL is loaded.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              DLL_Name;Flag_Type;Hexidecimal_Value

              +

              Where the DLL_Name is the name of the specific DLL, including the file extension. Flag_Type is KERNEL, USER, or PROCESS, and a Hexidecimal_Value, starting with 0x and up to 64-bits long.

              +
              +Note

              The PROCESS flag type can have a 32-bit length only. You can separate multiple entries with a backslash ().

              +
              +
              + +

              DeprecatedServiceShim

              The problem is indicated when an application tries to install a service that has a dependency on a deprecated service. An error message displays.

              +

              The fix intercepts the CreateService function calls and removes the deprecated dependency service from the lpDependencies parameter.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              Deprecated_Service\App_Service/Deprecated_Service2 \App_Service2

              +

              Where Deprecated_Service is the name of the service that has been deprecated and App_Service is the name of the specific application service that is to be modified; for example, NtLmSsp\WMI.

              +
              +Note

              If you do not provide an App_Service name, the deprecated service will be removed from all newly created services.

              +
              +
              + +
              +
              +Note

              You can separate multiple entries with a forward slash (/).

              +
              +
              + +

              DirectXVersionLie

              This problem occurs when an application fails because it does not find the correct version number for DirectX®.

              +

              The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              MAJORVERSION.MINORVERSION.LETTER

              +

              For example, 9.0.c.

              DetectorDWM8And16Bit

              This fix offeres mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8 .

              Disable8And16BitD3D

              This fix improves performance of 8/16-bit color applications that render using D3D and do not mix directdraw.

              Disable8And16BitModes

              This fix disables 8/16-bit color mitigation and enumeration of 8/16-bit color modes.

              DisableDWM

              The problem occurs when some objects are not drawn or object artifacts remain on the screen in an application.

              +

              The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.

              +
              +Note

              For more detailed information about this application fix, see Using the DisableDWM Fix.

              +
              +
              + +

              DisableFadeAnimations

              The problem is indicated when an application fade animations, buttons, or other controls do not function properly.

              +

              The fix disables the fade animations functionality for unsupported applications.

              DisableThemeMenus

              The problem is indicated by an application that behaves unpredictably when it tries to detect and use the correct Windows settings.

              +

              The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.

              DisableWindowsDefender

              The fix disables Windows Defender for security applications that do not work with Windows Defender.

              DWM8And16BitMitigation

              The fix offers mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8.

              DXGICompat

              The fix allows application-specific compatibility instructions to be passed to the DirectX engine.

              DXMaximizedWindowedMode

              Applications that use DX8/9 are run in a maximized windowed mode. This is required for applications that use GDI/DirectDraw in addition to Direct3D.

              ElevateCreateProcess

              The problem is indicated when installations, de-installations, or updates fail because the host process calls the CreateProcess function and it returns an ERROR_ELEVATION_REQUIRED error message.

              +

              The fix handles the error code and attempts to recall the CreateProcess function together with requested elevation. If the fixed application already has a UAC manifest, the error code will be returned unchanged.

              +
              +Note

              For more detailed information about this application fix, see Using the ElevateCreateProcess Fix.

              +
              +
              + +

              EmulateOldPathIsUNC

              The problem occurs when an application fails because of an incorrect UNC path.

              +

              The fix changes the PathIsUNC function to return a value of True for UNC paths in Windows.

              EmulateGetDiskFreeSpace

              The problem is indicated when an application fails to install or to run, and it generates an error message that there is not enough free disk space to install or use the application, even though there is enough free disk space to meet the application requirements.

              +

              The fix determines the amount of free space, so that if the amount of free space is larger than 2 GB, the compatibility fix returns a value of 2 GB, but if the amount of free space is smaller than 2 GB, the compatibility fix returns the actual free space amount.

              +
              +Note

              For more detailed information about this application fix, see Using the EmulateGetDiskFreeSpace Fix.

              +
              +
              + +

              EmulateSorting

              The problem occurs when an application experiences search functionality issues.

              +

              The fix forces applications that use the CompareStringW/LCMapString sorting table to use an older version of the table.

              +
              +Note

              For more detailed information about this e application fix, see Using the EmulateSorting Fix.

              +
              +
              + +

              EmulateSortingWindows61

              The fix emulates the sorting order of Windows 7 and Windows Server 2008 R2 for various APIs.

              EnableRestarts

              The problem is indicated when an application and computer appear to hang because processes cannot end to allow the computer to complete its restart processes.

              +

              The fix enables the computer to restart and finish the installation process by verifying and enabling that the SeShutdownPrivilege service privilege exists.

              +
              +Note

              For more detailed information about this application fix, see Using the EnableRestarts Fix.

              +
              +
              + +

              ExtraAddRefDesktopFolder

              The problem occurs when an application invokes the Release() method too many times and causes an object to be prematurely destroyed.

              +

              The fix counteracts the application's tries to obtain the shell desktop folder by invoking the AddRef() method on the Desktop folder, which is returned by the SHGetDesktopFolder function.

              FailObsoleteShellAPIs

              The problem occurs when an application fails because it generated deprecated API calls.

              +

              The fix either fully implements the obsolete functions or implements the obsolete functions with stubs that fail.

              +
              +Note

              You can type FailAll=1 at the command prompt to suppress the function implementation and force all functions to fail.

              +
              +
              + +

              FailRemoveDirectory

              The problem occurs when an application uninstallation process does not remove all of the application files and folders.

              +

              This fix fails calls to RemoveDirectory() when called with a path matching the one specified in the shim command-line. Only a single path is supported. The path can contain environment variables, but must be an exact path – no partial paths are supported.

              +

              The fix can resolve an issue where an application expects RemoveDirectory() to delete a folder immediately even though a handle is open to it.

              FakeLunaTheme

              The problem occurs when a theme application does not properly display: the colors are washed out or the user interface is not detailed.

              +

              The fix intercepts the GetCurrentThemeName API and returns the value for the Windows XP default theme, (Luna).

              +
              +Note

              For more detailed information about the FakeLunaTheme application fix, see Using the FakeLunaTheme Fix.

              +
              +
              + +

              FlushFile

              This problem is indicated when a file is updated and changes do not immediately appear on the hard disk. Applications cannot see the file changes.

              +

              The fix enables the WriteFile function to call to the FlushFileBuffers APIs, which flush the file cache onto the hard disk.

              FontMigration

              The fix replaces an application-requested font with a better font selection, to avoid text truncation.

              ForceAdminAccess

              The problem occurs when an application fails to function during an explicit administrator check.

              +

              The fix allows the user to temporarily imitate being a part of the Administrators group by returning a value of True during the administrator check.

              +
              +Note

              For more detailed information about this application fix, see Using the ForceAdminAccess Fix.

              +
              +
              + +

              ForceInvalidateOnClose

              The fix invalidates any windows that exist under a closing or hiding window for applications that rely on the invalidation messages.

              ForceLoadMirrorDrvMitigation

              The fix loads the Windows 8 mirror driver mitigation for applications where the mitigation is not automatically applied.

              FreestyleBMX

              The fix resolves an application race condition that is related to window message order.

              GetDriveTypeWHook

              The application presents unusual behavior during installation; for example, the setup program states that it cannot install to a user-specified location.

              +

              The fix changes GetDriveType() so that only the root information appears for the file path. This is required when an application passes an incomplete or badly-formed file path when it tries to retrieve the drive type on which the file path exists.

              GlobalMemoryStatusLie

              The problem is indicated by a Computer memory full error message that displays when you start an application.

              +

              The fix modifies the memory status structure, so that it reports a swap file that is 400 MB, regardless of the true swap file size.

              HandleBadPtr

              The problem is indicated by an access violation error message that displays because an API is performing pointer validation before it uses a parameter.

              +

              The fix supports using lpBuffer validation from the InternetSetOptionA and InternetSetOptionW functions to perform the additional parameter validation.

              HandleMarkedContentNotIndexed

              The problem is indicated by an application that fails when it changes an attribute on a file or directory.

              +

              The fix intercepts any API calls that return file attributes and directories that are invoked from the %TEMP% directory, and resets the FILE_ATTRIBUTE_NOT_CONTENT_INDEXED attribute to its original state.

              HeapClearAllocation

              The problem is indicated when the allocation process shuts down unexpectedly.

              +

              The fix uses zeros to clear out the heap allocation for an application.

              IgnoreAltTab

              The problem occurs when an application fails to function when special key combinations are used.

              +

              The fix intercepts the RegisterRawInputDevices API and prevents the delivery of the WM_INPUT messages. This delivery failure forces the included hooks to be ignored and forces DInput to use Windows-specific hooks.

              +
              +Note

              For more detailed information about this application fix, see Using the IgnoreAltTab Fix.

              +
              +
              + +

              IgnoreChromeSandbox

              The fix allows Google Chrome to run on systems that have ntdll loaded above 4GB.

              IgnoreDirectoryJunction

              The problem is indicated by a read or access violation error message that displays when an application tries to find or open files.

              +

              The fix links the FindNextFileW, FindNextFileA, FindFirstFileExW, FindFirstFileExA, FindFirstFileW and FindFirstFileA APIs to prevent them from returning directory junctions.

              +
              +Note

              Symbolic links appear starting in Windows Vista.

              +
              +
              + +

              IgnoreException

              The problem is indicated when an application stops functioning immediately after it starts, or the application starts with only a cursor appearing on the screen.

              +

              The fix enables the application to ignore specified exceptions. By default, this fix ignores privileged-mode exceptions; however, it can be configured to ignore any exception.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              Exception1;Exception2

              +

              Where Exception1 and Exception2 are specific exceptions to be ignored. For example: ACCESS_VIOLATION_READ:1;ACCESS_VIOLATION_WRITE:1.

              +
              +Important

              You should use this compatibility fix only if you are certain that it is acceptable to ignore the exception. You might experience additional compatibility issues if you choose to incorrectly ignore an exception.

              +
              +
              + +
              +
              +Note

              For more detailed information about this application fix, see Using the IgnoreException Fix.

              +
              +
              + +

              IgnoreFloatingPointRoundingControl

              This fix enables an application to ignore the rounding control request and to behave as expected in previous versions of the application.

              +

              Before floating point SSE2 support in the C runtime library, the rounding control request was being ignored which would use round to nearest option by default. This shim ignores the rounding control request to support applications relying on old behavior.

              IgnoreFontQuality

              The problem occurs when application text appears to be distorted.

              +

              The fix enables color-keyed fonts to properly work with anti-aliasing.

              IgnoreMessageBox

              The problem is indicated by a message box that displays with debugging or extraneous content when the application runs on an unexpected operating system.

              +

              The fix intercepts the MessageBox* APIs and inspects them for specific message text. If matching text is found, the application continues without showing the message box.

              +
              +Note

              For more detailed information about this application fix, see Using the IgnoreMessageBox Fix.

              +
              +
              + +

              IgnoreMSOXMLMF

              The problem is indicated by an error message that states that the operating system cannot locate the MSVCR80D.DLL file.

              +

              The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system any time that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.

              IgnoreSetROP2

              The fix ignores read-modify-write operations on the desktop to avoid performance issues.

              InstallComponent

              The fix prompts the user to install.Net 3.5 or .Net 2.0 because .Net is not included with Windows 8.

              LoadLibraryRedirect

              The fix forces an application to load system versions of libraries instead of loading redistributable versions that shipped with the application.

              LocalMappedObject

              The problem occurs when an application unsuccessfully tries to create an object in the Global namespace.

              +

              The fix intercepts the function call to create the object and replaces the word Global with Local.

              +
              +Note

              For more detailed information about this application fix, see Using the LocalMappedObject Fix.

              +
              +
              + +

              MakeShortcutRunas

              The problem is indicated when an application fails to uninstall because of access-related errors.

              +

              The fix locates any RunDLL.exe-based uninstallers and forces them to run with different credentials during the application installation. After it applies this fix, the installer will create a shortcut that specifies a matching string to run during the application installation, thereby enabling the uninstallation to occur later.

              +
              +Note

              For more detailed information about this application fix, see Using the MakeShortcutRunas Fix

              +
              +
              + +

              ManageLinks

              The fix intercepts common APIs that are going to a directory or to an executable (.exe) file, and then converts any symbolic or directory junctions before passing it back to the original APIs.

              MirrorDriverWithComposition

              The fix allows mirror drivers to work properly with acceptable performance with desktop composition.

              MoveToCopyFileShim

              The problem occurs when an application experiences security access issues during setup.

              +

              The fix forces the CopyFile APIs to run instead of the MoveFile APIs. CopyFile APIs avoid moving the security descriptor, which enables the application files to get the default descriptor of the destination folder and prevents the security access issue.

              OpenDirectoryAcl

              The problem is indicated by an error message that states that you do not have the appropriate permissions to access the application.

              +

              The fix reduces the security privilege levels on a specified set of files and folders.

              +
              +Note

              For more detailed information about this application fix, see Using the OpenDirectoryACL Fix.

              +
              +
              + +

              PopCapGamesForceResPerf

              The fix resolves the performance issues in PopCap games like Bejeweled2. The performance issues are visible in certain low-end cards at certain resolutions where the 1024x768 buffer is scaled to fit the display resolution.

              PreInstallDriver

              The fix preinstalls drivers for applications that would otherwise try to install or start drivers during the initial start process.

              PreInstallSmarteSECURE

              The fix preinstalls computer-wide CLSIDs for applications that use SmartSECURE copy protection, which would otherwise try to install the CLSIDs during the initial start process.

              ProcessPerfData

              The problem is indicated by an Unhandled Exception error message because the application tried to read the process performance data registry value to determine if another instance of the application is running.

              +

              The fix handles the failure case by passing a fake process performance data registry key, so that the application perceives that it is the only instance running.

              +
              +Note

              This issue seems to occur most frequently with .NET applications.

              +
              +
              + +

              PromoteDAM

              The fix registers an application for power state change notifications.

              PropagateProcessHistory

              The problem occurs when an application incorrectly fails to apply an application fix.

              +

              The fix sets the _PROCESS_HISTORY environment variable so that child processes can look in the parent directory for matching information while searching for application fixes.

              ProtectedAdminCheck

              The problem occurs when an application fails to run because of incorrect Protected Administrator permissions.

              +

              The fix addresses the issues that occur when applications use non-standard Administrator checks, thereby generating false positives for user accounts that are being run as Protected Administrators. In this case, the associated SID exists, but it is set as deny-only.

              RedirectCRTTempFile

              The fix intercepts failing CRT calls that try to create a temporary file at the root of the volume, thereby redirecting the calls to a temporary file in the user's temporary directory.

              RedirectHKCUKeys

              The problem occurs when an application cannot be accessed because of User Account Control (UAC) restrictions.

              +

              The fix duplicates any newly created HKCU keys to other users' HKCU accounts. This fix is generic for UAC restrictions, whereby the HKCU keys are required, but are unavailable to an application at runtime.

              RedirectMP3Codec

              This problem occurs when you cannot play MP3 files.

              +

              The fix intercepts the CoCreateInstance call for the missing filter and then redirects it to a supported version.

              RedirectShortcut

              The problem occurs when an application cannot be accessed by its shortcut, or application shortcuts are not removed during the application uninstallation process.

              +

              The fix redirects all of the shortcuts created during the application setup to appear according to a specified path.

              +
                +
              • Start Menu shortcuts: Appear in the \ProgramData\Microsoft\Windows\Start Menu directory for all users.

              • +
              • Desktop or Quick Launch shortcuts:You must manually place the shortcuts on the individual user's desktop or Quick Launch bar.

              • +
              +

              This issue occurs because of UAC restrictions: specifically, when an application setup runs by using elevated privileges and stores the shortcuts according to the elevated user's context. In this situation, a restricted user cannot access the shortcuts.

              +

              You cannot apply this fix to an .exe file that includes a manifest and provides a runlevel.

              RelaunchElevated

              The problem occurs when installers, uninstallers, or updaters fail when they are started from a host application.

              +

              The fix enables a child .exe file to run with elevated privileges when it is difficult to determine the parent process with either the ElevateCreateProcess fix or by marking the .exe files to RunAsAdmin.

              +
              +Note

              For more detailed information about this application fix, see Using the RelaunchElevated Fix.

              +
              +
              + +

              RetryOpenSCManagerWithReadAccess

              The problem occurs when an application tries to open the Service Control Manager (SCM) and receives an Access Denied error message.

              +

              The fix retries the call and requests a more restricted set of rights that include the following:

              +

              RetryOpenServiceWithReadAccess

              The problem occurs when an Unable to open service due to your application using the OpenService() API to test for the existence of a particular service error message displays.

              +

              The fix retries the OpenService() API call and verifies that the user has Administrator rights, is not a Protected Administrator, and by using read-only access. Applications can test for the existence of a service by calling the OpenService() API but some applications ask for all access when making this check. This fix retries the call but only asking for read-only access. The user needs to be an administrator for this to work

              +
              +Note

              For more detailed information about this application fix, see Using the RetryOpenServiceWithReadAccess Fix.

              +
              +
              + +

              RunAsAdmin

              The problem occurs when an application fails to function by using the Standard User or Protected Administrator account.

              +

              The fix enables the application to run by using elevated privileges. The fix is the equivalent of specifying requireAdministrator in an application manifest.

              +
              +Note

              For more detailed information about this application fix, see Using the RunAsAdmin Fix.

              +
              +
              + +

              RunAsHighest

              The problem occurs when administrators cannot view the read/write version of an application that presents a read-only view to standard users.

              +

              The fix enables the application to run by using the highest available permissions. This is the equivalent of specifying highestAvailable in an application manifest.

              +
              +Note

              For more detailed information about this application fix, see Using the RunAsHighest Fix.

              +
              +
              + +

              RunAsInvoker

              The problem occurs when an application is not detected as requiring elevation.

              +

              The fix enables the application to run by using the privileges that are associated with the creation process, without requiring elevation. This is the equivalent of specifying asInvoker in an application manifest.

              +
              +Note

              For more detailed information about this application fix, see Using the RunAsInvoker Fix.

              +
              +
              + +

              SecuROM7

              The fix repairs applications by using SecuROM7 for copy protection.

              SessionShim

              The fix intercepts API calls from applications that are trying to interact with services that are running in another session, by using the terminal service name prefix (Global or Local) as the parameter.

              +

              At the command prompt, you can supply a list of objects to modify, separating the values by a double backslash (). Or, you can choose not to include any parameters, so that all of the objects are modified.

              +
              +Important

              Users cannot log in as Session 0 (Global Session) in Windows Vista and later. Therefore, applications that require access to Session 0 automatically fail.

              +
              +
              + +
              +
              +Note

              For more detailed information about this application fix, see Using the SessionShim Fix.

              +
              +
              + +

              SetProtocolHandler

              The fix registers an application as a protocol handler.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              Client;Protocol;App

              +

              Where the Client is the name of the email protocol, Protocol is mailto, and App is the name of the application.

              +
              +Note

              Only the mail client and the mailto protocol are supported. You can separate multiple clients by using a backslash ().

              +
              +
              + +

              SetupCommitFileQueueIgnoreWow

              The problem occurs when a 32-bit setup program fails to install because it requires 64-bit drivers.

              +

              The fix disables the Wow64 file system that is used by the 64-bit editions of Windows, to prevent 32-bit applications from accessing 64-bit file systems during the application setup.

              SharePointDesigner2007

              The fix resolves an application bug that severely slows the application when it runs in DWM.

              ShimViaEAT

              The problem occurs when an application fails, even after applying acompatibility fix that is known to fix an issue. Applications that use unicows.dll or copy protection often present this issue.

              +

              The fix applies the specified compatibility fixes by modifying the export table and by nullifying the use of module inclusion and exclusion.

              +
              +Note

              For more information about this application fix, see Using the ShimViaEAT Fix.

              +
              +
              + +

              ShowWindowIE

              The problem occurs when a web application experiences navigation and display issues because of the tabbing feature.

              +

              The fix intercepts the ShowWindow API call to address the issues that can occur when a web application determines that it is in a child window. This fix calls the real ShowWindow API on the top-level parent window.

              SierraWirelessHideCDROM

              The fix repairs the Sierra Wireless Driver installation, thereby preventing bugcheck.

              Sonique2

              The application uses an invalid window style, which breaks in DWM. This fix replaces the window style with a valid value.

              SpecificInstaller

              The problem occurs when an application installation file fails to be picked up by the GenericInstaller function.

              +

              The fix flags the application as being an installer file (for example, setup.exe), and then prompts for elevation.

              +
              +Note

              For more detailed information about this application fix, see Using the SpecificInstaller Fix.

              +
              +
              + +

              SpecificNonInstaller

              The problem occurs when an application that is not an installer (and has sufficient privileges) generates a false positive from the GenericInstaller function.

              +

              The fix flags the application to exclude it from detection by the GenericInstaller function.

              +
              +Note

              For more detailed information about this application fix, see Using the SpecificNonInstaller Fix.

              +
              +
              + +

              SystemMetricsLie

              The fix replaces SystemMetrics values and SystemParametersInfo values with the values of previous Windows versions.

              TextArt

              The application receives different mouse coordinates with DWM ON versus DWM OFF, which causes the application to hang. This fix resolves the issue.

              TrimDisplayDeviceNames

              The fix trims the names of the display devices that are returned by the EnumDisplayDevices API.

              UIPICompatLogging

              The fix enables the logging of Windows messages from Internet Explorer and other processes.

              UIPIEnableCustomMsgs

              The problem occurs when an application does not properly communicate with other processes because customized Windows messages are not delivered.

              +

              The fix enables customized Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the RegisterWindowMessage function, followed by the ChangeWindowMessageFilter function in the code.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              MessageString1 MessageString2

              +

              Where MessageString1 and MessageString2 reflect the message strings that can pass.

              +
              +Note

              Multiple message strings must be separated by spaces. For more detailed information about this application fix, see Using the UIPIEnableCustomMsgs Fix.

              +
              +
              + +

              UIPIEnableStandardMsgs

              The problem occurs when an application does not communicate properly with other processes because standard Windows messages are not delivered.

              +

              The fix enables standard Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the ChangeWindowMessageFilter function in the code.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              1055 1056 1069

              +

              Where 1055 reflects the first message ID, 1056 reflects the second message ID, and 1069 reflects the third message ID that can pass.

              +
              +Note

              Multiple messages can be separated by spaces. For more detailed information about this application fix, see Using the UIPIEnableStandardMsgs Fix [act].

              +
              +
              + +

              VirtualizeDeleteFileLayer

              The fix virtualizes DeleteFile operations for applications that try to delete protected files.

              VirtualizeDesktopPainting

              This fix improves the performance of a number of operations on the Desktop DC while using DWM.

              VirtualRegistry

              The problem is indicated when a Component failed to be located error message displays when an application is started.

              +

              The fix enables the registry functions to allow for virtualization, redirection, expansion values, version spoofing, the simulation of performance data counters, and so on.

              +

              For more detailed information about this application fix, see Using the VirtualRegistry Fix.

              VirtualizeDeleteFile

              The problem occurs when several error messages display and the application cannot delete files.

              +

              The fix makes the application's DeleteFile function call a virtual call in an effort to remedy the UAC and file virtualization issues that were introduced with Windows Vista. This fix also links other file APIs (for example, GetFileAttributes) to ensure that the virtualization of the file is deleted.

              +
              +Note

              For more detailed information about this application fix, see Using the VirtualizeDeleteFile Fix.

              +
              +
              + +

              VirtualizeHKCRLite

              The problem occurs when an application fails to register COM components at runtime.

              +

              The fix redirects the HKCR write calls (HKLM) to the HKCU hive for a per-user COM registration. This operates much like the VirtualRegistry fix when you use the VirtualizeHKCR parameter; however, VirtualizeHKCRLite provides better performance.

              +

              HKCR is a virtual merge of the HKCU\Software\Classes and HKLM\Software\Classes directories. The use of HKCU is preferred if an application is not elevated and is ignored if the application is elevated.

              +

              You typically will use this compatibility fix in conjunction with the VirtualizeRegisterTypeLib fix.

              +

              For more detailed information about this application fix, see Using the VirtualizeHKCRLite Fix.

              VirtualizeRegisterTypeLib

              The fix, when it is used with the VirtualizeHKCRLite fix, ensures that the type library and the COM class registration happen simultaneously. This functions much like the RegistryTypeLib fix when the RegisterTypeLibForUser parameter is used.

              +
              +Note

              For more detailed information about this application fix, see Using the VirtualizeRegisterTypelib Fix.

              +
              +
              + +

              WaveOutIgnoreBadFormat

              This problem is indicated by an error message that states: Unable to initialize sound device from your audio driver; the application then closes.

              +

              The fix enables the application to ignore the format error and continue to function properly.

              WerDisableReportException

              The fix turns off the silent reporting of exceptions to the Windows Error Reporting tool, including those that are reported by Object Linking and Embedding-Database (OLE DB). The fix intercepts the RtlReportException API and returns a STATUS_NOT_SUPPORTED error message.

              Win7RTM/Win8RTM

              The layer provides the application with Windows 7/Windows 8 compatibility mode.

              WinxxRTMVersionLie

              The problem occurs when an application fails because it does not find the correct version number for the required Windows operating system.

              +

              All version lie compatibility fixes address the issue whereby an application fails to function because it is checking for, but not finding, a specific version of the operating system. The version lie fix returns the appropriate operating system version information. For example, the VistaRTMVersionLie returns the Windows Vista version information to the application, regardless of the actual operating system version that is running on the computer.

              Wing32SystoSys32

              The problem is indicated by an error message that states that the WinG library was not properly installed.

              +

              The fix detects whether the WinG32 library exists in the correct directory. If the library is located in the wrong location, this fix copies the information (typically during the runtime of the application) into the %WINDIR% \system32 directory.

              +
              +Important

              The application must have Administrator privileges for this fix to work.

              +
              +
              + +

              WinSrv08R2RTM

              WinXPSP2VersionLie

              The problem occurs when an application experiences issues because of a VB runtime DLL.

              +

              The fix forces the application to follow these steps:

              +
                +
              1. Open the Compatibility Administrator, and then select None for Operating System Mode.

              2. +
              3. On the Compatibility Fixes page, click WinXPSP2VersionLie, and then click Parameters.

                +

                The Options for <fix_name> dialog box appears.

              4. +
              5. Type vbrun60.dll into the Module Name box, click Include, and then click Add.

              6. +
              7. Save the custom database.

                +
                +Note

                For more information about the WinXPSP2VersionLie application fix, see Using the WinXPSP2VersionLie Fix.

                +
                +
                + +
              8. +

              WRPDllRegister

              The application fails when it tries to register a COM component that is released together with Windows Vista and later.

              +

              The fix skips the processes of registering and unregistering WRP-protected COM components when calling the DLLRegisterServer and DLLUnregisterServer functions.

              +

              You can control this fix further by typing the following command at the command prompt:

              +

              Component1.dll;Component2.dll

              +

              Where Component1.dll and Component2.dll reflect the components to be skipped.

              +
              +Note

              For more detailed information about this application fix, see Using the WRPDllRegister Fix.

              +
              +
              + +

              WRPMitigation

              The problem is indicated when an access denied error message displays when the application tries to access a protected operating system resource by using more than read-only access.

              +

              The fix emulates the successful authentication and modification of file and registry APIs, so that the application can continue.

              +
              +Note

              For more detailed information about WRPMitigation, see Using the WRPMitigation Fix.

              +
              +
              + +

              WRPRegDeleteKey

              The problem is indicated by an access denied error message that displays when the application tries to delete a registry key.

              +

              The fix verifies whether the registry key is WRP-protected. If the key is protected, this fix emulates the deletion process.

              XPAfxIsValidAddress

              The fix emulates the behavior of Windows XP for MFC42!AfxIsValidAddress.

              + + + +## Compatibility Modes + + +The following table lists the known compatibility modes. + + +++++ + + + + + + + + + + + + + + + + + + + +
              Compatibility Mode NameDescriptionIncluded Compatibility Fixes

              WinSrv03

              Emulates the Windows Server 2003 operating system.

                +
              • Win2k3RTMVersionLie

              • +
              • VirtualRegistry

              • +
              • ElevateCreateProcess

              • +
              • EmulateSorting

              • +
              • FailObsoleteShellAPIs

              • +
              • LoadLibraryCWD

              • +
              • HandleBadPtr

              • +
              • GlobalMemoryStatus2GB

              • +
              • RedirectMP3Codec

              • +
              • EnableLegacyExceptionHandlinginOLE

              • +
              • NoGhost

              • +
              • HardwareAudioMixer

              • +

              WinSrv03Sp1

              Emulates the Windows Server 2003 with Service Pack 1 (SP1) operating system.

                +
              • Win2K3SP1VersionLie

              • +
              • VirtualRegistry

              • +
              • ElevateCreateProcess

              • +
              • EmulateSorting

              • +
              • FailObsoleteShellAPIs

              • +
              • LoadLibraryCWD

              • +
              • HandleBadPtr

              • +
              • EnableLegacyExceptionHandlinginOLE

              • +
              • RedirectMP3Codec

              • +
              • HardwareAudioMixer

              • +
              diff --git a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index 0be29f8a0c..9a86786070 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -1,86 +1,67 @@ ---- -title: Creating a Custom Compatibility Fix in Compatibility Administrator (Windows 10) -description: The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. -ms.assetid: e4f2853a-0e46-49c5-afd7-0ed12f1fe0c2 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Creating a Custom Compatibility Fix in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Compatibility Administrator tool uses the term *fix* to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages. - -**Important**   -Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications. - - - -## What is a Compatibility Fix? - - -A compatibility fix, previously known as a shim, is a small piece of code that intercepts API calls from applications. The fix transforms the API calls so that the current version of the operating system supports the application in the same way as previous versions of the operating system. This can mean anything from disabling a new feature in the current version of the operating system to emulating a particular behavior of an older version of the Windows API. - -## Searching for Existing Compatibility Fixes - - -The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility fix, you can search for an existing application and then copy and paste the known fixes into your customized database. - -**Important**   -Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. - - - -**To search for an existing application** - -1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. - -2. Click the application name to view the preloaded compatibility fixes, compatibility modes, or AppHelp messages. - -## Creating a New Compatibility Fix - - -If you are unable to find a preloaded compatibility fix for your application, you can create a new one for use by your customized database. - -**To create a new compatibility fix** - -1. In the left-side pane of Compatibility Administrator underneath the **Custom Databases** heading, right-click the name of the database to which you want to apply the compatibility fix, click **Create New**, and then click **Application Fix**. - -2. Type the name of the application to which the compatibility fix applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**. - -3. Select the operating system for which your compatibility fix applies, click any applicable compatibility modes to apply to your compatibility fix, and then click **Next**. - -4. Select any additional compatibility fixes to apply to your compatibility fix, and then click **Next**. - -5. Select any additional criteria to use to match your applications to the AppHelp message, and then click **Finish**. - - By default, Compatibility Administrator selects the basic matching criteria for your application. As a best practice, use a limited set of matching information to represent your application, because it reduces the size of the database. However, make sure you have enough information to correctly identify your application. - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - - +--- +title: Creating a Custom Compatibility Fix in Compatibility Administrator (Windows 10) +description: The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. +ms.assetid: e4f2853a-0e46-49c5-afd7-0ed12f1fe0c2 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Creating a Custom Compatibility Fix in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The Compatibility Administrator tool uses the term *fix* to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages. + +> [!IMPORTANT] +> Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications. + +## What is a Compatibility Fix? + +A compatibility fix, previously known as a shim, is a small piece of code that intercepts API calls from applications. The fix transforms the API calls so that the current version of the operating system supports the application in the same way as previous versions of the operating system. This can mean anything from disabling a new feature in the current version of the operating system to emulating a particular behavior of an older version of the Windows API. + +## Searching for Existing Compatibility Fixes + +The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility fix, you can search for an existing application and then copy and paste the known fixes into your customized database. + +> [!IMPORTANT] +> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. + +**To search for an existing application** + +1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. +2. Click the application name to view the preloaded compatibility fixes, compatibility modes, or AppHelp messages. + +## Creating a New Compatibility Fix + + +If you are unable to find a preloaded compatibility fix for your application, you can create a new one for use by your customized database. + +**To create a new compatibility fix** + +1. In the left-side pane of Compatibility Administrator underneath the **Custom Databases** heading, right-click the name of the database to which you want to apply the compatibility fix, click **Create New**, and then click **Application Fix**. +2. Type the name of the application to which the compatibility fix applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**. +3. Select the operating system for which your compatibility fix applies, click any applicable compatibility modes to apply to your compatibility fix, and then click **Next**. +4. Select any additional compatibility fixes to apply to your compatibility fix, and then click **Next**. +5. Select any additional criteria to use to match your applications to the AppHelp message, and then click **Finish**. + + By default, Compatibility Administrator selects the basic matching criteria for your application. As a best practice, use a limited set of matching information to represent your application, because it reduces the size of the database. However, make sure you have enough information to correctly identify your application. + +## Related topics + +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md index f1f6931c75..bb66b25095 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md @@ -1,93 +1,89 @@ ---- -title: Creating a Custom Compatibility Mode in Compatibility Administrator (Windows 10) -description: Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. -ms.assetid: 661a1c0d-267f-4a79-8445-62a9a98d09b0 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Creating a Custom Compatibility Mode in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -Windows® provides several *compatibility modes*, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases. - -## What Is a Compatibility Mode? - - -A compatibility mode is a group of compatibility fixes. A compatibility fix, previously known as a shim, is a small piece of code that intercepts API calls from applications. The fix transforms the API calls so that the current version of the operating system supports the application in the same way as previous versions of the operating system. This can be anything from disabling a new feature in Windows to emulating a particular behavior of an older version of the Windows API. - -## Searching for Existing Compatibility Modes - - -The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility mode, you can search for an existing application and then copy and paste the known fixes into your custom database. - -**Important** -Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. - - - -**To search for an existing application** - -1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. - -2. Click the application name to view the preloaded compatibility modes, compatibility fixes, or AppHelp messages. - -## Creating a New Compatibility Mode - - -If you are unable to find a preloaded compatibility mode for your application, you can create a new one for use by your custom database. - -**Important** -A compatibility mode includes a set of compatibility fixes and must be deployed as a group. Therefore, you should include only fixes that you intend to deploy together to the database. - - - -**To create a new compatibility mode** - -1. In the left-side pane of Compatibility Administrator, underneath the **Custom Databases** heading, right-click the name of the database to which you will apply the compatibility mode, click **Create New**, and then click **Compatibility Mode**. - -2. Type the name of your custom-compatibility mode into the **Name of the compatibility mode** text box. - -3. Select each of the available compatibility fixes to include in your custom-compatibility mode and then click **>**. - - **Important** - If you are unsure which compatibility fixes to add, you can click **Copy Mode**. The **Select Compatibility Mode** dialog box appears and enables you to select from the preloaded compatibility modes. After you select a compatibility mode and click **OK**, any compatibility fixes that are included in the preloaded compatibility mode will be automatically added to your custom-compatibility mode. - - - -~~~ -If you have any compatibility fixes that require additional parameters, you can select the fix, and then click **Parameters**. The **Options for <Compatibility\_Fix\_Name>** dialog box appears, enabling you to update the parameter fields. -~~~ - -4. After you are done selecting the compatibility fixes to include, click **OK**. - - The compatibility mode is added to your custom database. - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - - +--- +title: Create a Custom Compatibility Mode (Windows 10) +description: Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. +ms.assetid: 661a1c0d-267f-4a79-8445-62a9a98d09b0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Creating a Custom Compatibility Mode in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +Windows® provides several *compatibility modes*, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases. + +## What Is a Compatibility Mode? + + +A compatibility mode is a group of compatibility fixes. A compatibility fix, previously known as a shim, is a small piece of code that intercepts API calls from applications. The fix transforms the API calls so that the current version of the operating system supports the application in the same way as previous versions of the operating system. This can be anything from disabling a new feature in Windows to emulating a particular behavior of an older version of the Windows API. + +## Searching for Existing Compatibility Modes + + +The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility mode, you can search for an existing application and then copy and paste the known fixes into your custom database. + +> [!IMPORTANT] +> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. + + + +**To search for an existing application** + +1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. + +2. Click the application name to view the preloaded compatibility modes, compatibility fixes, or AppHelp messages. + +## Creating a New Compatibility Mode + + +If you are unable to find a preloaded compatibility mode for your application, you can create a new one for use by your custom database. + +> [!IMPORTANT] +> A compatibility mode includes a set of compatibility fixes and must be deployed as a group. Therefore, you should include only fixes that you intend to deploy together to the database. + + + +**To create a new compatibility mode** + +1. In the left-side pane of Compatibility Administrator, underneath the **Custom Databases** heading, right-click the name of the database to which you will apply the compatibility mode, click **Create New**, and then click **Compatibility Mode**. + +2. Type the name of your custom-compatibility mode into the **Name of the compatibility mode** text box. + +3. Select each of the available compatibility fixes to include in your custom-compatibility mode and then click **>**. + + > [!IMPORTANT] + > If you are unsure which compatibility fixes to add, you can click **Copy Mode**. The **Select Compatibility Mode** dialog box appears and enables you to select from the preloaded compatibility modes. After you select a compatibility mode and click **OK**, any compatibility fixes that are included in the preloaded compatibility mode will be automatically added to your custom-compatibility mode. + > If you have any compatibility fixes that require additional parameters, you can select the fix, and then click **Parameters**. The **Options for <Compatibility\_Fix\_Name>** dialog box appears, enabling you to update the parameter fields. + +4. After you are done selecting the compatibility fixes to include, click **OK**. + + The compatibility mode is added to your custom database. + +## Related topics +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) + + + + + + + + + diff --git a/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md b/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md index 14270c5d3c..c35e379797 100644 --- a/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md @@ -1,97 +1,98 @@ ---- -title: Creating an AppHelp Message in Compatibility Administrator (Windows 10) -description: The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system. -ms.assetid: 5c6e89f5-1942-4aa4-8439-ccf0ecd02848 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Creating an AppHelp Message in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system. - -## Blocking Versus Non-Blocking AppHelp Messages - - -A blocking AppHelp message prevents the application from starting and displays a message to the user. You can define a specific URL where the user can download an updated driver or other fix to resolve the issue. When using a blocking AppHelp message, you must also define the file-matching information to identify the version of the application and enable the corrected version to continue. - -A non-blocking AppHelp message does not prevent the application from starting, but provides a message to the user including information such as security issues, updates to the application, or changes to the location of network resources. - -## Searching for Existing Compatibility Fixes - - -The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new AppHelp message, you can search for an existing application and then copy and paste the known fixes into your custom database. - -**Important**   -Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. - - - -**To search for an existing application** - -1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. - -2. Click the application name to view the preloaded AppHelp messages, compatibility fixes, and compatibility modes. - -## Creating a New AppHelp Message - - -If you are unable to find a preloaded AppHelp message for your application, you can create a new one for use by your custom database. - -**To create a new AppHelp message** - -1. In the left-side pane of Compatibility Administrator, below the **Custom Databases** heading, right-click the name of the database to which you will apply the AppHelp message, click **Create New**, and then click **AppHelp Message**. - -2. Type the name of the application to which this AppHelp message applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**. - - The wizard shows the known **Matching Information**, which is used for program identification. - -3. Select any additional criteria to use to match your applications to the AppHelp message, and then click **Next**. - - By default, Compatibility Administrator selects the basic matching criteria for your application. - - The wizard shows the **Enter Message Type** options. - -4. Click one of the following options: - - - **Display a message and allow this program to run**. This is a non-blocking message, which means that you can alert the user that there might be a problem, but the application is not prevented from starting. - - - **Display a message and do not allow this program to run**. This is a blocking message, which means that the application will not start. Instead, this message points the user to a location that provides more information about fixing the issue. - -5. Click **Next**. - - The wizard then shows the **Enter Message Information** fields. - -6. Type the website URL and the message text to appear when the user starts the application, and then click **Finish**. - -## Issues with AppHelp Messages and Computers Running Windows 2000 - - -The following issues might occur with computers running Windows 2000: - -- You might be unable to create a custom AppHelp message. - -- The AppHelp message text used for system database entries might not appear. - -- Copying an AppHelp entry for a system database or a custom-compatibility fix from a system database might cause Compatibility Administrator to hide the descriptive text. - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) +--- +title: Create AppHelp Message in Compatibility Administrator (Windows 10) +description: Create an AppHelp text message with Compatibility Administrator; a message that appears upon starting an app with major issues on the Windows® operating system. +ms.assetid: 5c6e89f5-1942-4aa4-8439-ccf0ecd02848 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Creating an AppHelp Message in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system. + +## Blocking Versus Non-Blocking AppHelp Messages + + +A blocking AppHelp message prevents the application from starting and displays a message to the user. You can define a specific URL where the user can download an updated driver or other fix to resolve the issue. When using a blocking AppHelp message, you must also define the file-matching information to identify the version of the application and enable the corrected version to continue. + +A non-blocking AppHelp message does not prevent the application from starting, but provides a message to the user including information such as security issues, updates to the application, or changes to the location of network resources. + +## Searching for Existing Compatibility Fixes + + +The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new AppHelp message, you can search for an existing application and then copy and paste the known fixes into your custom database. + +> [!IMPORTANT] +> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. + + + +**To search for an existing application** + +1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. + +2. Click the application name to view the preloaded AppHelp messages, compatibility fixes, and compatibility modes. + +## Creating a New AppHelp Message + + +If you are unable to find a preloaded AppHelp message for your application, you can create a new one for use by your custom database. + +**To create a new AppHelp message** + +1. In the left-side pane of Compatibility Administrator, below the **Custom Databases** heading, right-click the name of the database to which you will apply the AppHelp message, click **Create New**, and then click **AppHelp Message**. + +2. Type the name of the application to which this AppHelp message applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**. + + The wizard shows the known **Matching Information**, which is used for program identification. + +3. Select any additional criteria to use to match your applications to the AppHelp message, and then click **Next**. + + By default, Compatibility Administrator selects the basic matching criteria for your application. + + The wizard shows the **Enter Message Type** options. + +4. Click one of the following options: + + - **Display a message and allow this program to run**. This is a non-blocking message, which means that you can alert the user that there might be a problem, but the application is not prevented from starting. + + - **Display a message and do not allow this program to run**. This is a blocking message, which means that the application will not start. Instead, this message points the user to a location that provides more information about fixing the issue. + +5. Click **Next**. + + The wizard then shows the **Enter Message Information** fields. + +6. Type the website URL and the message text to appear when the user starts the application, and then click **Finish**. + +## Issues with AppHelp Messages and Computers Running Windows 2000 + + +The following issues might occur with computers running Windows 2000: + +- You might be unable to create a custom AppHelp message. + +- The AppHelp message text used for system database entries might not appear. + +- Copying an AppHelp entry for a system database or a custom-compatibility fix from a system database might cause Compatibility Administrator to hide the descriptive text. + +## Related topics +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md index decac6d28e..1c9e4706d1 100644 --- a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md +++ b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md @@ -1,340 +1,305 @@ ---- -title: Deployment considerations for Windows To Go (Windows 10) -description: Deployment considerations for Windows To Go -ms.assetid: dcfc5d96-b96b-44cd-ab65-416b5611c65e -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, mobile, device, USB, boot, image, workspace, driver -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: mobility -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Deployment considerations for Windows To Go - - -**Applies to** - -- Windows 10 - ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. - -From the start, Windows To Go was designed to minimize differences between the user experience of working on a laptop and Windows To Go booted from a USB drive. Given that Windows To Go was designed as an enterprise solution, extra consideration was given to the deployment workflows that enterprises already have in place. Additionally, there has been a focus on minimizing the number of differences in deployment between Windows To Go workspaces and laptop PCs. - -**Note**   -Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process. - - - -The following sections discuss the boot experience, deployment methods, and tools that you can use with Windows To Go. - -- [Initial boot experiences](#wtg-initboot) - -- [Image deployment and drive provisioning considerations](#wtg-imagedep) - -- [Application installation and domain join](#wtg-appinstall) - -- [Management of Windows To Go using Group Policy](#bkmk-wtggp) - -- [Supporting booting from USB](#wtg-bootusb) - -- [Updating firmware](#stg-firmware) - -- [Configure Windows To Go startup options](#wtg-startup) - -- [Change firmware settings](#wtg-changefirmware) - -## Initial boot experiences - - -The following diagrams illustrate the two different methods you could use to provide Windows To Go drives to your users. The experiences differ depending on whether the user will be booting the device initially on-premises or off-premises: - -![initial boot on-premises](images/wtg-first-boot-work.gif) - -When a Windows To Go workspace is first used at the workplace, the Windows To Go workspace can be joined to the domain through the normal procedures that occur when a new computer is introduced. It obtains a lease, applicable policies are applied and set, and user account tokens are placed appropriately. BitLocker protection can be applied and the BitLocker recovery key automatically stored in Active Directory Domain Services. The user can access network resources to install software and get access to data sources. When the workspace is subsequently booted at a different location either on or off premises, the configuration required for it to connect back to the work network using either DirectAccess or a virtual private network connection can be configured. It is not necessary to configure the workspace for offline domain join. DirectAccess can make connecting to organizational resources easier, but is not required. - -![initial boot off-premises](images/wtg-first-boot-home.gif) - -When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee’s home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. - -**Tip**   -Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076). - - - -DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](https://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. - -### Image deployment and drive provisioning considerations - -The Image Deployment process can be accomplished either by a centralized IT process for your organization or by individual users creating their own Windows To Go workspaces. You must have local Administrator access and access to a Windows 10 Enterprise or Windows 10 Education image to create a Windows To Go workspace, or you must be using System Center Configuration Manager 2012 Service Pack 1 or later to distribute Windows To Go workspaces to users. The image deployment process takes a blank USB drive and a Windows 10 Enterprise image (WIM) and turns it into a Windows To Go drive. - -![windows to go image deployment](images/wtg-image-deployment.gif) - -The simplest way to provision a Windows To Go drive is to use the Windows To Go Creator. After a single Windows To Go workspace has been created, it can be duplicated as many times as necessary using widely available USB duplicator products as long as the device has not been booted. After the Windows To Go drive is initialized, it should not be duplicated. Alternatively, Windows To Go Workspace Creator can be run multiple times to create multiple Windows To Go drives. - -**Tip**   -When you create your Windows To Go image use sysprep /generalize, just as you do when you deploy Windows 10 to a standard PC. In fact, if appropriate, use the same image for both deployments. - - - -**Driver considerations** - -Windows includes most of the drivers that you will need to support a wide variety of host computers. However, you will occasionally need to download drivers from Windows Update to take advantage of the full functionality of a device. If you are using Windows To Go on a set of known host computers, you can add any additional drivers to the image used on Windows To Go to make Windows To Go drives more quickly usable by your employees. Especially ensure that network drivers are available so that the user can connect to Windows Update to get additional drivers if necessary. - -Wi-Fi network adapter drivers are one of the most important drivers to make sure that you include in your standard image so that users can easily connect to the internet for any additional updates. IT administrators that are attempting to build Windows 10 images for use with Windows To Go should consider adding additional Wi-Fi drivers to their image to ensure that their users have the best chance of still having basic network connectivity when roaming between systems. - -The following list of commonly used Wi-Fi network adapters that are not supported by the default drivers provided with Windows 10 is provided to help you ascertain whether or not you need to add drivers to your image. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

              Vendor name

              Product description

              HWID

              Windows Update availability

              Broadcom

              802.11abgn Wireless SDIO adapter

              sd\vid_02d0&pid_4330&fn_1

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00d6106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00f5106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00ef106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00f4106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_010e106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00e4106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_433114e4&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_010f106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Marvell

              Yukon 88E8001/8003/8010 PCI Gigabit Ethernet

              pci\ven_11ab&dev_4320&subsys_811a1043

              32-bit driver

              -

              64-bit driver

              Marvell

              Libertas 802.11b/g Wireless

              pci\ven_11ab&dev_1faa&subsys_6b001385&rev_03

              32-bit driver

              -

              64-bit driver

              Qualcomm

              Atheros AR6004 Wireless LAN Adapter

              sd\vid_0271&pid_0401

              32-bit driver

              -

              64-bit driver not available

              Qualcomm

              Atheros AR5BWB222 Wireless Network Adapter

              pci\ven_168c&dev_0034&subsys_20031a56

              32-bit driver

              -

              64-bit driver not available

              Qualcomm

              Atheros AR5BWB222 Wireless Network Adapter

              pci\ven_168c&dev_0034&subsys_020a1028&rev_01

              Contact the system OEM or Qualcom for driver availability.

              Qualcomm

              Atheros AR5005G Wireless Network Adapter

              pci\ven_168c&dev_001a&subsys_04181468&rev_01

              32-bit driver

              -

              64-bit driver

              Ralink

              Wireless-G PCI Adapter

              pci\ven_1814&dev_0301&subsys_00551737&rev_00

              32-bit driver

              -

              64-bit driver

              Ralink

              Turbo Wireless LAN Card

              pci\ven_1814&dev_0301&subsys_25611814&rev_00

              32-bit driver

              -

              64-bit driver

              Ralink

              Wireless LAN Card V1

              pci\ven_1814&dev_0302&subsys_3a711186&rev_00

              32-bit driver

              -

              64-bit driver

              Ralink

              D-Link AirPlus G DWL-G510 Wireless PCI Adapter(rev.C)

              pci\ven_1814&dev_0302&subsys_3c091186&rev_00

              32-bit driver

              -

              64-bit driver

              - - - -IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=619079). - -### Application installation and domain join - -Unless you are using a customized Windows image that includes unattended installation settings, the initial Windows To Go workspace will not be domain joined and will not contain applications. This is exactly like a new installation of Windows on a desktop or laptop computer. When planning your deployment, you should develop methods to join Windows to Go drives to the domain and install the standard applications that users in your organization require. These methods probably will be similar to the ones used for setting up desktop and laptop computers with domain privileges and applications - -### Management of Windows To Go using Group Policy - -In general, management of Windows To Go workspaces is same as that for desktop and laptop computers. There are Windows To Go specific Group Policy settings that should be considered as part of Windows To Go deployment. Windows To Go Group Policy settings are located at `\\Computer Configuration\Administrative Templates\Windows Components\Portable Operating System\` in the Local Group Policy Editor. - -The use of the Store on Windows To Go workspaces that are running Windows 8 can also be controlled by Group Policy. This policy setting is located at `\\Computer Configuration\Administrative Templates\Windows Components\Store\` in the Local Group Policy Editor. The policy settings have specific implications for Windows To Go that you should be aware of when planning your deployment: - -**Settings for workspaces** - -- **Allow hibernate (S4) when started from a Windows To Go workspace** - - This policy setting specifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace. By default, hibernation is disabled when using Windows To Go workspace, so enabling this setting explicitly turns this ability back on. When a computer enters hibernation, the contents of memory are written to disk. When the disk is resumed, it is important that the hardware attached to the system, as well as the disk itself, are unchanged. This is inherently incompatible with roaming between PC hosts. Hibernation should only be used when the Windows To Go workspace is not being used to roam between host PCs. - - **Important**   - For the host-PC to resume correctly when hibernation is enabled the Windows To Go workspace must continue to use the same USB port. - - - -- **Disallow standby sleep states (S1-S3) when starting from a Windows To Go workspace** - - This policy setting specifies whether the PC can use standby sleep states (S1–S3) when started from a Windows To Go workspace. The Sleep state also presents a unique challenge to Windows To Go users. When a computer goes to sleep, it appears as if it is shut down. It could be very easy for a user to think that a Windows To Go workspace in sleep mode was actually shut down and they could remove the Windows To Go drive and take it home. Removing the Windows To Go drive in this scenario is equivalent to an unclean shutdown which may result in the loss of unsaved user data or the corruption on the drive. Moreover, if the user now boots the drive on another PC and brings it back to the first PC which still happens to be in the sleep state, it will lead to an arbitrary crash and eventually corruption of the drive and result in the workspace becoming unusable. If you enable this policy setting, the Windows To Go workspace cannot use the standby states to cause the PC to enter sleep mode. If you disable or do not configure this policy setting, the Windows To Go workspace can place the PC in sleep mode. - -**Settings for host PCs** - -- **Windows To Go Default Startup Options** - - This policy setting controls whether the host computer will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the **Windows To Go Startup Options** settings dialog. If you enable this policy setting, booting to Windows To Go when a USB device is connected will be enabled and users will not be able to make changes using the **Windows To Go Startup Options** settings dialog. If you disable this policy setting, booting to Windows To Go when a USB device is connected will not be enabled unless a user configures the option manually in the firmware. If you do not configure this policy setting, users who are members of the local Administrators group can enable or disable booting from USB using the **Windows To Go Startup Options** settings dialog. - - **Important**   - Enabling this policy setting will cause PCs running Windows to attempt to boot from any USB device that is inserted into the PC before it is started. - - - -## Supporting booting from USB - - -The biggest hurdle for a user wanting to use Windows To Go is configuring their computer to boot from USB. This is traditionally done by entering the firmware and configuring the appropriate boot order options. To ease the process of making the firmware modifications required for Windows To Go, Windows includes a feature named **Windows To Go Startup Options** that allows a user to configure their computer to boot from USB from within Windows—without ever entering their firmware, as long as their firmware supports booting from USB. - -**Note**   -Enabling a system to always boot from USB first has implications that you should consider. For example, a USB device that includes malware could be booted inadvertently to compromise the system, or multiple USB drives could be plugged in to cause a boot conflict. For this reason, the Windows To Go startup options are disabled by default. In addition, administrator privileges are required to configure Windows To Go startup options. - - - -If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). - -### Roaming between different firmware types - -Windows supports two types of PC firmware: Unified Extensible Firmware Interface (UEFI), which is the new standard, and legacy BIOS firmware, which was used in most PCs shipping with Windows 7 or earlier version of Windows. Each firmware type has completely different Windows boot components that are incompatible with each other. Beyond the different boot components, Windows supports different partition styles and layout requirements for each type of firmware as shown in the following diagrams. - -![bios layout](images/wtg-mbr-bios.gif)![uefi layout](images/wtg-gpt-uefi.gif) - -This presented a unique challenge for Windows To Go because the firmware type is not easily determined by end-users—a UEFI computer looks just like a legacy BIOS computer and Windows To Go must boot on both types of firmware. - -To enable booting Windows To Go on both types of firmware, a new disk layout is provided for Windows 8 or later that contains both sets of boot components on a FAT32 system partition and a new command-line option was added to bcdboot.exe to support this configuration. The **/f** option is used with the **bcdboot /s** command to specify the firmware type of the target system partition by appending either **UEFI**, **BIOS** or **ALL**. When creating Windows To Go drives manually you must use the **ALL** parameter to provide the Windows To Go drive the ability to boot on both types of firmware. For example, on volume H: (your Windows To Go USB drive letter), you would use the command **bcdboot C:\\windows /s H: /f ALL**. The following diagram illustrates the disk layout that results from that command: - -![firmware roaming disk layout](images/wtg-mbr-firmware-roaming.gif) - -This is the only supported disk configuration for Windows To Go. With this disk configuration, a single Windows To Go drive can be booted on computers with UEFI and legacy BIOS firmware. - -### Configure Windows To Go startup options - -Windows To Go Startup Options is a setting available on Windows 10-based PCs that enables the computer to be booted from a USB without manually changing the firmware settings of the PC. To configure Windows To Go Startup Options you must have administrative rights on the computer and the **Windows To Go Default Startup Options** Group Policy setting must not be configured. - -**To configure Windows To Go startup options** - -1. On the Start screen, type, type **Windows To Go Startup Options**, click **Settings** and then press Enter. - - ![windows to go startup options](images/wtg-startup-options.gif) - -2. Select **Yes** to enable the startup options. - - **Tip**   - If your computer is part of a domain, the Group Policy setting can be used to enable the startup options instead of the dialog. - - - -3. Click **Save Changes**. If the User Account Control dialog box is displayed, confirm that the action it displays is what you want, and then click **Yes**. - -### Change firmware settings - -If you choose to not use the Windows To Go startup options or are using a PC running Windows 7 as your host computer you will need to manually configure the firmware settings. The process used to accomplish this will depend on the firmware type and manufacturer. If your host computer is protected by BitLocker and running Windows 7 you should suspend BitLocker before making the change to the firmware settings. After the firmware settings have been successfully reconfigured, resume BitLocker protection. If you do not suspend BitLocker first, BitLocker will assume that the computer has been tampered with and will boot into BitLocker recovery mode. - -## Related topics - - -[Windows To Go: feature overview](windows-to-go-overview.md) - -[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) - -[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) - -[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) - - - - - - - - - +--- +title: Deployment considerations for Windows To Go (Windows 10) +description: Learn about deployment considerations for Windows To Go, such as the boot experience, deployment methods, and tools that you can use with Windows To Go. +ms.assetid: dcfc5d96-b96b-44cd-ab65-416b5611c65e +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, mobile, device, USB, boot, image, workspace, driver +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: mobility +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Deployment considerations for Windows To Go + + +**Applies to** + +- Windows 10 + +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. + +From the start, Windows To Go was designed to minimize differences between the user experience of working on a laptop and Windows To Go booted from a USB drive. Given that Windows To Go was designed as an enterprise solution, extra consideration was given to the deployment workflows that enterprises already have in place. Additionally, there has been a focus on minimizing the number of differences in deployment between Windows To Go workspaces and laptop PCs. + +> [!NOTE] +> Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process. + +The following sections discuss the boot experience, deployment methods, and tools that you can use with Windows To Go. + +- [Initial boot experiences](#wtg-initboot) +- [Image deployment and drive provisioning considerations](#wtg-imagedep) +- [Application installation and domain join](#wtg-appinstall) +- [Management of Windows To Go using Group Policy](#bkmk-wtggp) +- [Supporting booting from USB](#wtg-bootusb) +- [Updating firmware](#stg-firmware) +- [Configure Windows To Go startup options](#wtg-startup) +- [Change firmware settings](#wtg-changefirmware) + +## Initial boot experiences + +The following diagrams illustrate the two different methods you could use to provide Windows To Go drives to your users. The experiences differ depending on whether the user will be booting the device initially on-premises or off-premises: + +![initial boot on-premises](images/wtg-first-boot-work.gif) + +When a Windows To Go workspace is first used at the workplace, the Windows To Go workspace can be joined to the domain through the normal procedures that occur when a new computer is introduced. It obtains a lease, applicable policies are applied and set, and user account tokens are placed appropriately. BitLocker protection can be applied and the BitLocker recovery key automatically stored in Active Directory Domain Services. The user can access network resources to install software and get access to data sources. When the workspace is subsequently booted at a different location either on or off premises, the configuration required for it to connect back to the work network using either DirectAccess or a virtual private network connection can be configured. It is not necessary to configure the workspace for offline domain join. DirectAccess can make connecting to organizational resources easier, but is not required. + +![initial boot off-premises](images/wtg-first-boot-home.gif) + +When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee's home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. + +> [!TIP] +> Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076). + +DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](https://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. + +### Image deployment and drive provisioning considerations + +The Image Deployment process can be accomplished either by a centralized IT process for your organization or by individual users creating their own Windows To Go workspaces. You must have local Administrator access and access to a Windows 10 Enterprise or Windows 10 Education image to create a Windows To Go workspace, or you must be using System Center 2012 Configuration Manager Service Pack 1 or later to distribute Windows To Go workspaces to users. The image deployment process takes a blank USB drive and a Windows 10 Enterprise image (WIM) and turns it into a Windows To Go drive. + +![windows to go image deployment](images/wtg-image-deployment.gif) + +The simplest way to provision a Windows To Go drive is to use the Windows To Go Creator. After a single Windows To Go workspace has been created, it can be duplicated as many times as necessary using widely available USB duplicator products as long as the device has not been booted. After the Windows To Go drive is initialized, it should not be duplicated. Alternatively, Windows To Go Workspace Creator can be run multiple times to create multiple Windows To Go drives. + +> [!TIP] +> When you create your Windows To Go image use sysprep /generalize, just as you do when you deploy Windows 10 to a standard PC. In fact, if appropriate, use the same image for both deployments. + +**Driver considerations** + +Windows includes most of the drivers that you will need to support a wide variety of host computers. However, you will occasionally need to download drivers from Windows Update to take advantage of the full functionality of a device. If you are using Windows To Go on a set of known host computers, you can add any additional drivers to the image used on Windows To Go to make Windows To Go drives more quickly usable by your employees. Especially ensure that network drivers are available so that the user can connect to Windows Update to get additional drivers if necessary. + +Wi-Fi network adapter drivers are one of the most important drivers to make sure that you include in your standard image so that users can easily connect to the internet for any additional updates. IT administrators that are attempting to build Windows 10 images for use with Windows To Go should consider adding additional Wi-Fi drivers to their image to ensure that their users have the best chance of still having basic network connectivity when roaming between systems. + +The following list of commonly used Wi-Fi network adapters that are not supported by the default drivers provided with Windows 10 is provided to help you ascertain whether or not you need to add drivers to your image. + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

              Vendor name

              Product description

              HWID

              Windows Update availability

              Broadcom

              802.11abgn Wireless SDIO adapter

              sd\vid_02d0&pid_4330&fn_1

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00d6106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00f5106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00ef106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00f4106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_010e106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_00e4106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_433114e4&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Broadcom

              802.11n Network Adapter

              pci\ven_14e4&dev_4331&subsys_010f106b&rev_02

              Contact the system OEM or Broadcom for driver availability.

              Marvell

              Yukon 88E8001/8003/8010 PCI Gigabit Ethernet

              pci\ven_11ab&dev_4320&subsys_811a1043

              32-bit driver

              +

              64-bit driver

              Marvell

              Libertas 802.11b/g Wireless

              pci\ven_11ab&dev_1faa&subsys_6b001385&rev_03

              32-bit driver

              +

              64-bit driver

              Qualcomm

              Atheros AR6004 Wireless LAN Adapter

              sd\vid_0271&pid_0401

              32-bit driver

              +

              64-bit driver not available

              Qualcomm

              Atheros AR5BWB222 Wireless Network Adapter

              pci\ven_168c&dev_0034&subsys_20031a56

              32-bit driver

              +

              64-bit driver not available

              Qualcomm

              Atheros AR5BWB222 Wireless Network Adapter

              pci\ven_168c&dev_0034&subsys_020a1028&rev_01

              Contact the system OEM or Qualcom for driver availability.

              Qualcomm

              Atheros AR5005G Wireless Network Adapter

              pci\ven_168c&dev_001a&subsys_04181468&rev_01

              32-bit driver

              +

              64-bit driver

              Ralink

              Wireless-G PCI Adapter

              pci\ven_1814&dev_0301&subsys_00551737&rev_00

              32-bit driver

              +

              64-bit driver

              Ralink

              Turbo Wireless LAN Card

              pci\ven_1814&dev_0301&subsys_25611814&rev_00

              32-bit driver

              +

              64-bit driver

              Ralink

              Wireless LAN Card V1

              pci\ven_1814&dev_0302&subsys_3a711186&rev_00

              32-bit driver

              +

              64-bit driver

              Ralink

              D-Link AirPlus G DWL-G510 Wireless PCI Adapter(rev.C)

              pci\ven_1814&dev_0302&subsys_3c091186&rev_00

              32-bit driver

              +

              64-bit driver

              + +IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=619079). + +### Application installation and domain join + +Unless you are using a customized Windows image that includes unattended installation settings, the initial Windows To Go workspace will not be domain joined and will not contain applications. This is exactly like a new installation of Windows on a desktop or laptop computer. When planning your deployment, you should develop methods to join Windows to Go drives to the domain and install the standard applications that users in your organization require. These methods probably will be similar to the ones used for setting up desktop and laptop computers with domain privileges and applications + +### Management of Windows To Go using Group Policy + +In general, management of Windows To Go workspaces is same as that for desktop and laptop computers. There are Windows To Go specific Group Policy settings that should be considered as part of Windows To Go deployment. Windows To Go Group Policy settings are located at `\\Computer Configuration\Administrative Templates\Windows Components\Portable Operating System\` in the Local Group Policy Editor. + +The use of the Store on Windows To Go workspaces that are running Windows 8 can also be controlled by Group Policy. This policy setting is located at `\\Computer Configuration\Administrative Templates\Windows Components\Store\` in the Local Group Policy Editor. The policy settings have specific implications for Windows To Go that you should be aware of when planning your deployment: + +**Settings for workspaces** + +- **Allow hibernate (S4) when started from a Windows To Go workspace** + + This policy setting specifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace. By default, hibernation is disabled when using Windows To Go workspace, so enabling this setting explicitly turns this ability back on. When a computer enters hibernation, the contents of memory are written to disk. When the disk is resumed, it is important that the hardware attached to the system, as well as the disk itself, are unchanged. This is inherently incompatible with roaming between PC hosts. Hibernation should only be used when the Windows To Go workspace is not being used to roam between host PCs. + + > [!IMPORTANT] + > For the host-PC to resume correctly when hibernation is enabled the Windows To Go workspace must continue to use the same USB port. + +- **Disallow standby sleep states (S1-S3) when starting from a Windows To Go workspace** + + This policy setting specifies whether the PC can use standby sleep states (S1–S3) when started from a Windows To Go workspace. The Sleep state also presents a unique challenge to Windows To Go users. When a computer goes to sleep, it appears as if it is shut down. It could be very easy for a user to think that a Windows To Go workspace in sleep mode was actually shut down and they could remove the Windows To Go drive and take it home. Removing the Windows To Go drive in this scenario is equivalent to an unclean shutdown which may result in the loss of unsaved user data or the corruption on the drive. Moreover, if the user now boots the drive on another PC and brings it back to the first PC which still happens to be in the sleep state, it will lead to an arbitrary crash and eventually corruption of the drive and result in the workspace becoming unusable. If you enable this policy setting, the Windows To Go workspace cannot use the standby states to cause the PC to enter sleep mode. If you disable or do not configure this policy setting, the Windows To Go workspace can place the PC in sleep mode. + +**Settings for host PCs** + +- **Windows To Go Default Startup Options** + + This policy setting controls whether the host computer will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the **Windows To Go Startup Options** settings dialog. If you enable this policy setting, booting to Windows To Go when a USB device is connected will be enabled and users will not be able to make changes using the **Windows To Go Startup Options** settings dialog. If you disable this policy setting, booting to Windows To Go when a USB device is connected will not be enabled unless a user configures the option manually in the firmware. If you do not configure this policy setting, users who are members of the local Administrators group can enable or disable booting from USB using the **Windows To Go Startup Options** settings dialog. + + > [!IMPORTANT] + > Enabling this policy setting will cause PCs running Windows to attempt to boot from any USB device that is inserted into the PC before it is started. + +## Supporting booting from USB + +The biggest hurdle for a user wanting to use Windows To Go is configuring their computer to boot from USB. This is traditionally done by entering the firmware and configuring the appropriate boot order options. To ease the process of making the firmware modifications required for Windows To Go, Windows includes a feature named **Windows To Go Startup Options** that allows a user to configure their computer to boot from USB from within Windows—without ever entering their firmware, as long as their firmware supports booting from USB. + +> [!NOTE] +> Enabling a system to always boot from USB first has implications that you should consider. For example, a USB device that includes malware could be booted inadvertently to compromise the system, or multiple USB drives could be plugged in to cause a boot conflict. For this reason, the Windows To Go startup options are disabled by default. In addition, administrator privileges are required to configure Windows To Go startup options. + +If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). + +### Roaming between different firmware types + +Windows supports two types of PC firmware: Unified Extensible Firmware Interface (UEFI), which is the new standard, and legacy BIOS firmware, which was used in most PCs shipping with Windows 7 or earlier version of Windows. Each firmware type has completely different Windows boot components that are incompatible with each other. Beyond the different boot components, Windows supports different partition styles and layout requirements for each type of firmware as shown in the following diagrams. + +![bios layout](images/wtg-mbr-bios.gif)![uefi layout](images/wtg-gpt-uefi.gif) + +This presented a unique challenge for Windows To Go because the firmware type is not easily determined by end-users—a UEFI computer looks just like a legacy BIOS computer and Windows To Go must boot on both types of firmware. + +To enable booting Windows To Go on both types of firmware, a new disk layout is provided for Windows 8 or later that contains both sets of boot components on a FAT32 system partition and a new command-line option was added to bcdboot.exe to support this configuration. The **/f** option is used with the **bcdboot /s** command to specify the firmware type of the target system partition by appending either **UEFI**, **BIOS** or **ALL**. When creating Windows To Go drives manually you must use the **ALL** parameter to provide the Windows To Go drive the ability to boot on both types of firmware. For example, on volume H: (your Windows To Go USB drive letter), you would use the command **bcdboot C:\\windows /s H: /f ALL**. The following diagram illustrates the disk layout that results from that command: + +![firmware roaming disk layout](images/wtg-mbr-firmware-roaming.gif) + +This is the only supported disk configuration for Windows To Go. With this disk configuration, a single Windows To Go drive can be booted on computers with UEFI and legacy BIOS firmware. + +### Configure Windows To Go startup options + +Windows To Go Startup Options is a setting available on Windows 10-based PCs that enables the computer to be booted from a USB without manually changing the firmware settings of the PC. To configure Windows To Go Startup Options you must have administrative rights on the computer and the **Windows To Go Default Startup Options** Group Policy setting must not be configured. + +**To configure Windows To Go startup options** + +1. On the Start screen, type, type **Windows To Go Startup Options**, click **Settings** and then press Enter. + + ![windows to go startup options](images/wtg-startup-options.gif) + +2. Select **Yes** to enable the startup options. + + > [!TIP] + > If your computer is part of a domain, the Group Policy setting can be used to enable the startup options instead of the dialog. + + +3. Click **Save Changes**. If the User Account Control dialog box is displayed, confirm that the action it displays is what you want, and then click **Yes**. + +### Change firmware settings + +If you choose to not use the Windows To Go startup options or are using a PC running Windows 7 as your host computer you will need to manually configure the firmware settings. The process used to accomplish this will depend on the firmware type and manufacturer. If your host computer is protected by BitLocker and running Windows 7 you should suspend BitLocker before making the change to the firmware settings. After the firmware settings have been successfully reconfigured, resume BitLocker protection. If you do not suspend BitLocker first, BitLocker will assume that the computer has been tampered with and will boot into BitLocker recovery mode. + +## Related topics + +[Windows To Go: feature overview](windows-to-go-overview.md)
              +[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
              +[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
              +[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) diff --git a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md index efa2cac236..6b42e09fe7 100644 --- a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md +++ b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md @@ -1,68 +1,69 @@ ---- -title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator (Windows 10) -description: You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes. -ms.assetid: 6bd4a7c5-0ed9-4a35-948c-c438aa4d6cb6 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Enabling and Disabling Compatibility Fixes in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes. - -## Disabling Compatibility Fixes - - -Customized compatibility databases can become quite complex as you add your fixes for the multiple applications found in your organization. Over time, you may find you need to disable a particular fix in your customized database. For example, if a software vendor releases a fix for an issue addressed in one of your compatibility fixes, you must validate that the vendor's fix is correct and that it resolves your issue. To do this, you must temporarily disable the compatibility fix and then test your application. - -**Important**   -Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications. - - - -**To disable a compatibility fix within a database** - -1. In the left-sde pane of Compatibility Administrator, expand the custom database that includes the compatibility fix that you want to disable, and then select the specific compatibility fix. - - The compatibility fix details appear in the right-hand pane. - -2. On the **Database** menu, click **Disable Entry**. - - **Important**   - When you disable an entry, it will remain disabled even if you do not save the database file. - - - -## Enabling Compatibility Fixes - - -You can enable your disabled compatibility fixes at any time. - -**To enable a compatibility fix within a database** - -1. In the left-side pane of Compatibility Administrator, expand the custom database that includes the compatibility fix that you want to enable, and then select the specific compatibility fix. - - The compatibility fix details appear in the right-side pane. - -2. On the **Database** menu, click **Enable Entry**. - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) +--- +title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator +description: You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes. +ms.assetid: 6bd4a7c5-0ed9-4a35-948c-c438aa4d6cb6 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Enabling and Disabling Compatibility Fixes in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes. + +## Disabling Compatibility Fixes + +Customized compatibility databases can become quite complex as you add your fixes for the multiple applications found in your organization. Over time, you may find you need to disable a particular fix in your customized database. For example, if a software vendor releases a fix for an issue addressed in one of your compatibility fixes, you must validate that the vendor's fix is correct and that it resolves your issue. To do this, you must temporarily disable the compatibility fix and then test your application. + +>[!IMPORTANT] +>Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications. + + + +**To disable a compatibility fix within a database** + +1. In the left-sde pane of Compatibility Administrator, expand the custom database that includes the compatibility fix that you want to disable, and then select the specific compatibility fix. + + The compatibility fix details appear in the right-hand pane. + +2. On the **Database** menu, click **Disable Entry**. + + **Important**   + When you disable an entry, it will remain disabled even if you do not save the database file. + + + +## Enabling Compatibility Fixes + + +You can enable your disabled compatibility fixes at any time. + +**To enable a compatibility fix within a database** + +1. In the left-side pane of Compatibility Administrator, expand the custom database that includes the compatibility fix that you want to enable, and then select the specific compatibility fix. + + The compatibility fix details appear in the right-side pane. + +2. On the **Database** menu, click **Enable Entry**. + +## Related topics + +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/planning/features-lifecycle.md b/windows/deployment/planning/features-lifecycle.md index 1e0d36aca0..9469d47cb7 100644 --- a/windows/deployment/planning/features-lifecycle.md +++ b/windows/deployment/planning/features-lifecycle.md @@ -1,39 +1,45 @@ ---- -title: Windows 10 features lifecycle -description: Learn about the lifecycle of Windows 10 features -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -manager: laurawi -ms.author: greglin -ms.topic: article ---- -# Windows 10 features lifecycle - -- Applies to: Windows 10 - -Each release of Windows 10 contains many new and improved features. Occasionally we also remove features and functionality, usually because there is a better option. - -## Features removed or planned for replacement - -See the following for details about feature support for each release of Windows 10. - -[Windows 10, version 1903](windows-10-1903-removed-features.md)
              -[Windows 10, version 1809](windows-10-1809-removed-features.md)
              -[Windows 10, version 1803](windows-10-1803-removed-features.md)
              -[Windows 10, version 1709](windows-10-1709-removed-features.md)
              -[Windows 10, version 1703](windows-10-1703-removed-features.md) - -Also see: [Windows 10 release information](https://docs.microsoft.com/windows/release-information/) - -## Terminology - -The following terms can be used to describe the status that might be assigned to a feature during its lifecycle. - -- **Deprecation**: The stage of the product lifecycle when a feature or functionality is no longer in active development and may be removed in future releases of a product or online service. -- **End of support**: The stage of the product lifecycle when support and servicing are no longer available for a product. -- **Retirement**: The stage of the product lifecycle when an online service is shut down so that it is no longer available for use. -- **Remove or retire a feature**: The stage of the product lifecycle when a feature or functionality is removed from an online service after it has been deprecated. -- **Replace a feature**: The stage of the product lifecycle when a feature or functionality in an online service is replaced with a different feature or functionality. +--- +title: Windows 10 features lifecycle +description: Learn about the lifecycle of Windows 10 features, as well as features that are no longer developed, removed features, and terminology assigned to a feature. +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +manager: laurawi +ms.author: greglin +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- +# Windows 10 features lifecycle + +- Applies to: Windows 10 + +Each release of Windows 10 contains many new and improved features. Occasionally we also remove features and functionality, usually because there is a better option. + +## Features no longer being developed + +The following topic lists features that are no longer being developed. These features might be removed in a future release. + +[Windows 10 features we're no longer developing](windows-10-deprecated-features.md) + +## Features removed + +The following topic has details about features that have been removed from Windows 10. + +[Windows 10 features we removed](windows-10-removed-features.md) + +## Terminology + +The following terms can be used to describe the status that might be assigned to a feature during its lifecycle. + +- **Deprecation**: The stage of the product lifecycle when a feature or functionality is no longer in active development and may be removed in future releases of a product or online service. +- **End of support**: The stage of the product lifecycle when support and servicing are no longer available for a product. +- **Retirement**: The stage of the product lifecycle when an service is shut down so that it is no longer available for use. +- **Remove or retire a feature**: The stage of the product lifecycle when a feature or functionality is removed from a service after it has been deprecated. +- **Replace a feature**: The stage of the product lifecycle when a feature or functionality in a service is replaced with a different feature or functionality. + +## Also see + +[Windows 10 release information](https://docs.microsoft.com/windows/release-information/) diff --git a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md index 98986e0bfd..ea3a21ed29 100644 --- a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md +++ b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md @@ -1,76 +1,77 @@ ---- -title: Fixing Applications by Using the SUA Tool (Windows 10) -description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. -ms.assetid: 7f5947b1-977b-4d7e-bb52-fbe8e76f6b8b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Fixing Applications by Using the SUA Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. - -**To fix an application by using the SUA tool** - -1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). - -2. After you finish testing, open the SUA tool. - -3. On the **Mitigation** menu, click the command that corresponds to the action that you want to take. The following table describes the commands. - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Mitigation menu commandDescription

              Apply Mitigations

              Opens the Mitigate AppCompat Issues dialog box, in which you can select the fixes that you intend to apply to the application.

              Undo Mitigations

              Removes the application fixes that you just applied.

              -

              This option is available only after you apply an application fix and before you close the SUA tool. Alternatively, you can manually remove application fixes by using Programs and Features in Control Panel.

              Export Mitigations as Windows Installer file

              Exports your application fixes as a Windows® Installer (.msi) file, which can then be deployed to other computers that are running the application.

              - -   - -  - -  - - - - - +--- +title: Fixing Applications by Using the SUA Tool (Windows 10) +description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. +ms.assetid: 7f5947b1-977b-4d7e-bb52-fbe8e76f6b8b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Fixing Applications by Using the SUA Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. + +**To fix an application by using the SUA tool** + +1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). + +2. After you finish testing, open the SUA tool. + +3. On the **Mitigation** menu, click the command that corresponds to the action that you want to take. The following table describes the commands. + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Mitigation menu commandDescription

              Apply Mitigations

              Opens the Mitigate AppCompat Issues dialog box, in which you can select the fixes that you intend to apply to the application.

              Undo Mitigations

              Removes the application fixes that you just applied.

              +

              This option is available only after you apply an application fix and before you close the SUA tool. Alternatively, you can manually remove application fixes by using Programs and Features in Control Panel.

              Export Mitigations as Windows Installer file

              Exports your application fixes as a Windows® Installer (.msi) file, which can then be deployed to other computers that are running the application.

              + +   + +  + +  + + + + + diff --git a/windows/deployment/planning/index.md b/windows/deployment/planning/index.md index e0816f65f8..76f55d16c6 100644 --- a/windows/deployment/planning/index.md +++ b/windows/deployment/planning/index.md @@ -1,14 +1,14 @@ --- title: Plan for Windows 10 deployment (Windows 10) -description: Windows 10 provides new deployment capabilities, scenarios, and tools by building on technologies introduced in Windows 7, and Windows 8.1, while at the same time introducing new Windows as a service concepts to keep the operating system up to date. +description: Find resources for your Windows 10 deployment. Windows 10 provides new deployment capabilities and tools, and introduces new ways to keep the OS up to date. ms.assetid: 002F9B79-B50F-40C5-A7A5-0B4770E6EC15 keywords: deploy, upgrade, update, configure ms.prod: w10 +manager: laurawi ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: TrudyHa -ms.date: 07/27/2017 +author: greg-lindsay ms.topic: article --- @@ -27,9 +27,9 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildi ## Related topics - [Windows 10 servicing options for updates and upgrades](../update/index.md) -- [Deploy Windows 10 with MDT 2013 Update 1](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) -- [Deploy Windows 10 with Configuration Manager and MDT 2013 Update 1](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) -- [Upgrade to Windows 10 with MDT 2013 Update 1](../upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) +- [Deploy Windows 10 with MDT](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) +- [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) +- [Upgrade to Windows 10 with MDT](../deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) - [Upgrade to Windows 10 with Configuration Manager](../upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) - [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=733911)   diff --git a/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md b/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md index 6159fe34e5..e066e2b214 100644 --- a/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md +++ b/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md @@ -1,67 +1,68 @@ ---- -title: Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator (Windows 10) -description: The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. -ms.assetid: 659c9d62-5f32-433d-94aa-12141c01368f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers. - -By default, the Windows® operating system installs a System Application Fix database for use with the Compatibility Administrator. This database can be updated through Windows Update, and is stored in the %WINDIR% \\AppPatch directory. Your custom databases are automatically stored in the %WINDIR% \\AppPatch\\Custom directory and are installed by using the Sdbinst.exe tool provided with the Compatibility Administrator. - -**Important**   -Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications. - -In addition, you must deploy your databases to your organization’s computers before the included fixes will have any effect on the application issue. For more information about deploying your database, see [Using the Sdbinst.exe Command-Line Tool](using-the-sdbinstexe-command-line-tool.md). - - - -## Installing a Custom Database - - -Installing your custom-compatibility database enables you to fix issues with your installed applications. - -**To install a custom database** - -1. In the left-side pane of Compatibility Administrator, click the custom database to install to your local computers. - -2. On the **File** menu, click **Install**. - - The Compatibility Administrator installs the database, which appears in the **Installed Databases** list. - - The relationship between your database file and an included application occurs in the registry. Every time you start an application, the operating system checks the registry for compatibility-fix information and, if found, retrieves the information from your customized database file. - -## Uninstalling a Custom Database - - -When a custom database is no longer necessary, either because the applications are no longer used or because the vendor has provided a fix that resolves the compatibility issues, you can uninstall the custom database. - -**To uninstall a custom database** - -1. In the **Installed Databases** list, which appears in the left-side pane of Compatibility Administrator, click the database to uninstall from your local computers. - -2. On the **File** menu, click **Uninstall**. - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) +--- +title: Install/Uninstall Custom Databases (Windows 10) +description: The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. +ms.assetid: 659c9d62-5f32-433d-94aa-12141c01368f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers. + +By default, the Windows® operating system installs a System Application Fix database for use with the Compatibility Administrator. This database can be updated through Windows Update, and is stored in the %WINDIR% \\AppPatch directory. Your custom databases are automatically stored in the %WINDIR% \\AppPatch\\Custom directory and are installed by using the Sdbinst.exe tool provided with the Compatibility Administrator. + +> [!IMPORTANT] +> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications. + +In addition, you must deploy your databases to your organization’s computers before the included fixes will have any effect on the application issue. For more information about deploying your database, see [Using the Sdbinst.exe Command-Line Tool](using-the-sdbinstexe-command-line-tool.md). + + + +## Installing a Custom Database + + +Installing your custom-compatibility database enables you to fix issues with your installed applications. + +**To install a custom database** + +1. In the left-side pane of Compatibility Administrator, click the custom database to install to your local computers. + +2. On the **File** menu, click **Install**. + + The Compatibility Administrator installs the database, which appears in the **Installed Databases** list. + + The relationship between your database file and an included application occurs in the registry. Every time you start an application, the operating system checks the registry for compatibility-fix information and, if found, retrieves the information from your customized database file. + +## Uninstalling a Custom Database + + +When a custom database is no longer necessary, either because the applications are no longer used or because the vendor has provided a fix that resolves the compatibility issues, you can uninstall the custom database. + +**To uninstall a custom database** + +1. In the **Installed Databases** list, which appears in the left-side pane of Compatibility Administrator, click the database to uninstall from your local computers. + +2. On the **File** menu, click **Uninstall**. + +## Related topics +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md index 47e9283fef..3aac6db8f1 100644 --- a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md +++ b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md @@ -1,66 +1,67 @@ ---- -title: Managing Application-Compatibility Fixes and Custom Fix Databases (Windows 10) -description: This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases. -ms.assetid: 9c2e9396-908e-4a36-ad67-2e40452ce017 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Managing Application-Compatibility Fixes and Custom Fix Databases - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - -
              TopicDescription

              Understanding and Using Compatibility Fixes

              As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application.

              Compatibility Fix Database Management Strategies and Deployment

              After you determine that you will use compatibility fixes in your application-compatibility mitigation strategy, you must define a strategy to manage your custom compatibility-fix database. Typically, you can use one of two approaches:

              Testing Your Application Mitigation Packages

              This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues.

              - - - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - -[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) +--- +title: Managing Application-Compatibility Fixes and Custom Fix Databases (Windows 10) +description: Learn why you should use compatibility fixes, and how to deploy and manage custom-compatibility fix databases. +ms.assetid: 9c2e9396-908e-4a36-ad67-2e40452ce017 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Managing Application-Compatibility Fixes and Custom Fix Databases + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases. + +## In this section + + + ++++ + + + + + + + + + + + + + + + + + + + + +
              TopicDescription

              Understanding and Using Compatibility Fixes

              As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application.

              Compatibility Fix Database Management Strategies and Deployment

              After you determine that you will use compatibility fixes in your application-compatibility mitigation strategy, you must define a strategy to manage your custom compatibility-fix database. Typically, you can use one of two approaches:

              Testing Your Application Mitigation Packages

              This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues.

              + + + +## Related topics +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) + +[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) diff --git a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md index 6dca43c7ac..8ab327afb4 100644 --- a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md +++ b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md @@ -1,131 +1,133 @@ ---- -title: Prepare your organization for Windows To Go (Windows 10) -description: Prepare your organization for Windows To Go -ms.assetid: f3f3c160-90ad-40a8-aeba-2aedee18f7ff -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: ["mobile, device, USB, deploy"] -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: mobility -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Prepare your organization for Windows To Go - - -**Applies to** - -- Windows 10 - ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. - -The following information is provided to help you plan and design a new deployment of a Windows To Go in your production environment. It provides answers to the “what”, “why”, and “when” questions an IT professional might have when planning to deploy Windows To Go. - -## What is Windows To Go? - - -Windows To Go is a feature of Windows 10 Enterprise and Windows 10 Education that enables users to boot Windows from a USB-connected external drive. Windows To Go drives can use the same image that enterprises use for their desktops and laptops, and can be managed the same way. Offering a new mobility option, a Windows To Go workspace is not intended to replace desktops or laptops, or supplant other mobility offerings. - -Enterprise customers utilizing Volume Activation Windows licensing will be able to deploy USB drives provisioned with Windows To Go workspace. These drives will be bootable on multiple compatible host computers. Compatible host computers are computers that are: - -- USB boot capable -- Have USB boot enabled in the firmware -- Meet Windows 7 minimum system requirements -- Have compatible processor architectures (for example, x86 or AMD64) as the image used to create the Windows To Go workspace. ARM is not a supported processor for Windows To Go. -- Have firmware architecture that is compatible with the architecture of the image used for the Windows To Go workspace - -Booting a Windows To Go workspace requires no specific software on the host computer. PCs certified for Windows 7 and later can host Windows To Go. - -The following topics will familiarize you with how you can use a Windows To Go workspace and give you an overview of some of the things you should consider in your design. - -## Usage scenarios - - -The following scenarios are examples of situations in which Windows To Go workspaces provide a solution for an IT implementer: - -- **Continuance of operations (COO).** In this scenario, selected employees receive a USB drive with a Windows To Go workspace, which includes all of the applications that the employees use at work. The employees can keep the device at home, in a briefcase, or wherever they want to store it until needed. When the users boot their home computer from the USB drive, it will create a corporate desktop experience so that they can quickly start working. On the very first boot, the employee sees that Windows is installing devices; after that one time, the Windows To Go drive boots like a normal computer. If they have enterprise network access, employees can use a virtual private network (VPN) connection or DirectAccess to access corporate resources. If the enterprise network is available, the Windows To Go workspace will automatically be updated using your standard client management processes. - -- **Contractors and temporary workers.** In this situation, an enterprise IT pro or manager would distribute the Windows To Go drive directly to the worker where they can be assisted with any necessary additional user education needs or address any possible compatibility issues. While the worker is on assignment, they can boot their computer exclusively from the Windows To Go drive and run all applications in that environment until the end of the assignment when the device is returned. No installation of software is required on the worker’s personal computer. - -- **Managed free seating.** The employee is issued a Windows To Go drive that is then used with the host computer assigned to that employee for a given session (this could be a vehicle, workspace, or standalone laptop). When the employee leaves the session, the next time they return they use the same USB flash drive but use a different host computer. - -- **Work from home.** In this situation, the Windows To Go drive can be provisioned for employees using various methods including System Center Configuration Manager or other deployment tools and then distributed to employees. The employee is instructed to boot the Windows To Go drive initially at work, which caches the employee’s credentials on the Windows To Go workspace and allows the initial data synchronization between the enterprise network and the Windows To Go workspace. The user can then bring the Windows To Go drive home where it can be used with their home computer, with or without enterprise network connectivity. - -- **Travel lightly.** In this situation you have employees who are moving from site to site, but who always will have access to a compatible host computer on site. Using Windows To Go workspaces allows them to travel without the need to pack their PC. - -**Note**   -If the employee wants to work offline for the majority of the time, but still maintain the ability to use the drive on the enterprise network, they should be informed of how often the Windows To Go workspace needs to be connected to the enterprise network. Doing so will ensure that the drive retains its access privileges and the workspace’s computer object is not potentially deleted from Active Directory Domain Services (AD DS). - - - -## Infrastructure considerations - - -Because Windows To Go requires no additional software and minimal configuration, the same tools used to deploy images to other PCs can be used by an enterprise to install Windows To Go on a large group of USB devices. Moreover, because Windows To Go is compatible with connectivity and synchronization solutions already in use—such as Remote Desktop, DirectAccess and Folder Redirection—no additional infrastructure or management is necessary for this deployment. A Windows To Go image can be created on a USB drive that is identical to the hard drive inside a desktop. However, you may wish to consider making some modifications to your infrastructure to help make management of Windows To Go drives easier and to be able to identify them as a distinct device group. - -## Activation considerations - - -Windows To Go uses volume activation. You can use either Active Directory-based activation or KMS activation with Windows To Go. The Windows To Go workspace counts as another installation when assessing compliance with application licensing agreements. - -Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Office 365 ProPlus, Office 365 ProPlus subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Office 365 ProPlus or Office 365 Enterprise SKUs containing Office 365 ProPlus via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). - -You should investigate other software manufacturer’s licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. - -**Note**   -Using Multiple Activation Key (MAK) activation is not a supported activation method for Windows To Go as each different PC-host would require separate activation. MAK activation should not be used for activating Windows, Office, or any other application on a Windows To Go drive. - - - -See [Plan for Volume Activation](https://go.microsoft.com/fwlink/p/?LinkId=618923) for more information about these activation methods and how they can be used in your organization. - -## Organizational unit structure and use of Group Policy Objects - - -You may find it beneficial to create additional Active Directory organizational unit (OU) structures to support your Windows To Go deployment; one for host computer accounts and one for Windows To Go workspace computer accounts. Creating an organizational unit for host computers allows you to enable the Windows To Go Startup Options using Group Policy for only the computers that will be used as Windows To Go hosts. Setting this policy helps to prevent computers from being accidentally configured to automatically boot from USB devices and allows closer monitoring and control of those computers which have the ability to boot from a USB device. The organizational unit for Windows To Go workspaces allows you to apply specific policy controls to them, such as the ability to use the Store application, power state controls, and line-of-business application installation. - -If you are deploying Windows To Go workspaces for a scenario in which they are not going to be roaming, but are instead being used on the same host computer, such as with temporary or contract employees, you might wish to enable hibernation or the Windows Store. - -For more information about Group Policy settings that can be used with Windows To Go, see [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) - -## Computer account management - - -If you configure Windows To Go drives for scenarios where drives may remain unused for extended period of time such as use in continuance of operations scenarios, the AD DS computer account objects that correspond to Windows To Go drives have the potential to become stale and be pruned during maintenance operations. To address this issue, you should either have users log on regularly according to a schedule or modify any maintenance scripts to not clean up computer accounts in the Windows To Go device organizational unit. - -## User account and data management - - -People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user’s profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). - -Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace. - -## Remote connectivity - - -If you want Windows To Go to be able to connect back to organizational resources when it is being used off-premises a remote connectivity solution must be enabled. Windows Server 2012 DirectAccess can be used as can a virtual private network (VPN) solution. For more information about configuring a remote access solution, see the [Remote Access (DirectAccess, Routing and Remote Access) Overview](https://go.microsoft.com/fwlink/p/?LinkId=618925). - -## Related topics - - -[Windows To Go: feature overview](windows-to-go-overview.md) - -[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) - -[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) - -[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) - - - - - - - - - +--- +title: Prepare your organization for Windows To Go (Windows 10) +description: Though Windows To Go is no longer being developed, you can find info here about the the “what”, “why”, and “when” of deployment. +ms.assetid: f3f3c160-90ad-40a8-aeba-2aedee18f7ff +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: ["mobile, device, USB, deploy"] +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: mobility +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Prepare your organization for Windows To Go + + +**Applies to** + +- Windows 10 + +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. + +The following information is provided to help you plan and design a new deployment of a Windows To Go in your production environment. It provides answers to the "what", "why", and "when" questions an IT professional might have when planning to deploy Windows To Go. + +## What is Windows To Go? + + +Windows To Go is a feature of Windows 10 Enterprise and Windows 10 Education that enables users to boot Windows from a USB-connected external drive. Windows To Go drives can use the same image that enterprises use for their desktops and laptops, and can be managed the same way. Offering a new mobility option, a Windows To Go workspace is not intended to replace desktops or laptops, or supplant other mobility offerings. + +Enterprise customers utilizing Volume Activation Windows licensing will be able to deploy USB drives provisioned with Windows To Go workspace. These drives will be bootable on multiple compatible host computers. Compatible host computers are computers that are: + +- USB boot capable +- Have USB boot enabled in the firmware +- Meet Windows 7 minimum system requirements +- Have compatible processor architectures (for example, x86 or AMD64) as the image used to create the Windows To Go workspace. ARM is not a supported processor for Windows To Go. +- Have firmware architecture that is compatible with the architecture of the image used for the Windows To Go workspace + +Booting a Windows To Go workspace requires no specific software on the host computer. PCs certified for Windows 7 and later can host Windows To Go. + +The following topics will familiarize you with how you can use a Windows To Go workspace and give you an overview of some of the things you should consider in your design. + +## Usage scenarios + + +The following scenarios are examples of situations in which Windows To Go workspaces provide a solution for an IT implementer: + +- **Continuance of operations (COO).** In this scenario, selected employees receive a USB drive with a Windows To Go workspace, which includes all of the applications that the employees use at work. The employees can keep the device at home, in a briefcase, or wherever they want to store it until needed. When the users boot their home computer from the USB drive, it will create a corporate desktop experience so that they can quickly start working. On the very first boot, the employee sees that Windows is installing devices; after that one time, the Windows To Go drive boots like a normal computer. If they have enterprise network access, employees can use a virtual private network (VPN) connection or DirectAccess to access corporate resources. If the enterprise network is available, the Windows To Go workspace will automatically be updated using your standard client management processes. + +- **Contractors and temporary workers.** In this situation, an enterprise IT pro or manager would distribute the Windows To Go drive directly to the worker where they can be assisted with any necessary additional user education needs or address any possible compatibility issues. While the worker is on assignment, they can boot their computer exclusively from the Windows To Go drive and run all applications in that environment until the end of the assignment when the device is returned. No installation of software is required on the worker's personal computer. + +- **Managed free seating.** The employee is issued a Windows To Go drive that is then used with the host computer assigned to that employee for a given session (this could be a vehicle, workspace, or standalone laptop). When the employee leaves the session, the next time they return they use the same USB flash drive but use a different host computer. + +- **Work from home.** In this situation, the Windows To Go drive can be provisioned for employees using various methods including Microsoft Endpoint Configuration Manager or other deployment tools and then distributed to employees. The employee is instructed to boot the Windows To Go drive initially at work, which caches the employee's credentials on the Windows To Go workspace and allows the initial data synchronization between the enterprise network and the Windows To Go workspace. The user can then bring the Windows To Go drive home where it can be used with their home computer, with or without enterprise network connectivity. + +- **Travel lightly.** In this situation you have employees who are moving from site to site, but who always will have access to a compatible host computer on site. Using Windows To Go workspaces allows them to travel without the need to pack their PC. + +> [!NOTE] +> If the employee wants to work offline for the majority of the time, but still maintain the ability to use the drive on the enterprise network, they should be informed of how often the Windows To Go workspace needs to be connected to the enterprise network. Doing so will ensure that the drive retains its access privileges and the workspace's computer object is not potentially deleted from Active Directory Domain Services (AD DS). + + + +## Infrastructure considerations + + +Because Windows To Go requires no additional software and minimal configuration, the same tools used to deploy images to other PCs can be used by an enterprise to install Windows To Go on a large group of USB devices. Moreover, because Windows To Go is compatible with connectivity and synchronization solutions already in use—such as Remote Desktop, DirectAccess and Folder Redirection—no additional infrastructure or management is necessary for this deployment. A Windows To Go image can be created on a USB drive that is identical to the hard drive inside a desktop. However, you may wish to consider making some modifications to your infrastructure to help make management of Windows To Go drives easier and to be able to identify them as a distinct device group. + +## Activation considerations + + +Windows To Go uses volume activation. You can use either Active Directory-based activation or KMS activation with Windows To Go. The Windows To Go workspace counts as another installation when assessing compliance with application licensing agreements. + +Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Microsoft 365 Apps for enterprise, Microsoft 365 Apps for enterprise subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Microsoft 365 Apps for enterprise or Office 365 Enterprise SKUs containing Microsoft 365 Apps for enterprise via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). + +You should investigate other software manufacturer's licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. + +> [!NOTE] +> Using Multiple Activation Key (MAK) activation is not a supported activation method for Windows To Go as each different PC-host would require separate activation. MAK activation should not be used for activating Windows, Office, or any other application on a Windows To Go drive. + + + +See [Plan for Volume Activation](https://go.microsoft.com/fwlink/p/?LinkId=618923) for more information about these activation methods and how they can be used in your organization. + +## Organizational unit structure and use of Group Policy Objects + + +You may find it beneficial to create additional Active Directory organizational unit (OU) structures to support your Windows To Go deployment; one for host computer accounts and one for Windows To Go workspace computer accounts. Creating an organizational unit for host computers allows you to enable the Windows To Go Startup Options using Group Policy for only the computers that will be used as Windows To Go hosts. Setting this policy helps to prevent computers from being accidentally configured to automatically boot from USB devices and allows closer monitoring and control of those computers which have the ability to boot from a USB device. The organizational unit for Windows To Go workspaces allows you to apply specific policy controls to them, such as the ability to use the Store application, power state controls, and line-of-business application installation. + +If you are deploying Windows To Go workspaces for a scenario in which they are not going to be roaming, but are instead being used on the same host computer, such as with temporary or contract employees, you might wish to enable hibernation or the Windows Store. + +For more information about Group Policy settings that can be used with Windows To Go, see [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) + +## Computer account management + + +If you configure Windows To Go drives for scenarios where drives may remain unused for extended period of time such as use in continuance of operations scenarios, the AD DS computer account objects that correspond to Windows To Go drives have the potential to become stale and be pruned during maintenance operations. To address this issue, you should either have users log on regularly according to a schedule or modify any maintenance scripts to not clean up computer accounts in the Windows To Go device organizational unit. + +## User account and data management + + +People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user's profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). + +Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace. + +## Remote connectivity + + +If you want Windows To Go to be able to connect back to organizational resources when it is being used off-premises a remote connectivity solution must be enabled. Windows Server 2012 DirectAccess can be used as can a virtual private network (VPN) solution. For more information about configuring a remote access solution, see the [Remote Access (DirectAccess, Routing and Remote Access) Overview](https://go.microsoft.com/fwlink/p/?LinkId=618925). + +## Related topics + + +[Windows To Go: feature overview](windows-to-go-overview.md) + +[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) + +[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) + +[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) + + + + + + + + + diff --git a/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md index 66a530280c..f0e3ef4473 100644 --- a/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md @@ -1,79 +1,79 @@ ---- -title: Searching for Fixed Applications in Compatibility Administrator (Windows 10) -description: With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. -ms.assetid: 1051a2dc-0362-43a4-8ae8-07dae39b1cb8 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Searching for Fixed Applications in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application. - -The **Query Compatibility Databases** tool provides additional search options. For more information, see [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md). - -## Searching for Previously Applied Compatibility Fixes - - -**Important**   -You must perform your search with the correct version of the Compatibility Administrator tool. If you are searching for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. If you are searching for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. - - - -**To search for previous fixes** - -1. On the Compatibility Administrator toolbar, click **Search**. - -2. Click **Browse** to locate the directory location to search for .exe files. - -3. Select at least one check box from **Entries with Compatibility Fixes**, **Entries with Compatibility Modes**, or **Entries with AppHelp**. - -4. Click **Find Now**. - - The query runs, returning your results in the lower pane. - -## Viewing Your Query Results - - -Your query results display the affected files, the application location, the application name, the type of compatibility fix, and the custom database that provided the fix. - -## Exporting Your Query Results - - -You can export your search results to a text (.txt) file for later review or archival. - -**To export your search results** - -1. In the **Search for Fixes** dialog box, click **Export**. - -2. Browse to the location where you want to store your search result file, and then click **Save**. - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - - +--- +title: Searching for Fixed Applications in Compatibility Administrator (Windows 10) +description: Compatibility Administrator can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. +ms.assetid: 1051a2dc-0362-43a4-8ae8-07dae39b1cb8 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Searching for Fixed Applications in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application. + +The **Query Compatibility Databases** tool provides additional search options. For more information, see [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md). + +## Searching for Previously Applied Compatibility Fixes + +> [!IMPORTANT] +> You must perform your search with the correct version of the Compatibility Administrator tool. If you are searching for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. If you are searching for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. + + + +**To search for previous fixes** + +1. On the Compatibility Administrator toolbar, click **Search**. + +2. Click **Browse** to locate the directory location to search for .exe files. + +3. Select at least one check box from **Entries with Compatibility Fixes**, **Entries with Compatibility Modes**, or **Entries with AppHelp**. + +4. Click **Find Now**. + + The query runs, returning your results in the lower pane. + +## Viewing Your Query Results + + +Your query results display the affected files, the application location, the application name, the type of compatibility fix, and the custom database that provided the fix. + +## Exporting Your Query Results + + +You can export your search results to a text (.txt) file for later review or archival. + +**To export your search results** + +1. In the **Search for Fixes** dialog box, click **Export**. + +2. Browse to the location where you want to store your search result file, and then click **Save**. + +## Related topics +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) + + + + + + + + + diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index 08b12d19fc..6135a8daf8 100644 --- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -1,183 +1,149 @@ ---- -title: Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator (Windows 10) -description: You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature. -ms.assetid: dd213b55-c71c-407a-ad49-33db54f82f22 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature. - -For information about the Search feature, see [Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md). However, the Query tool provides more detailed search criteria, including tabs that enable you to search the program properties, the compatibility fix properties, and the fix description. You can perform a search by using SQL SELECT and WHERE clauses, in addition to searching specific types of databases. - -**Important**   -You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. - - - -## Querying by Using the Program Properties Tab - - -You can use the **Program Properties** tab of the Query tool to search for any compatibility fix, compatibility mode, or AppHelp for a specific application. - -**To query by using the Program Properties tab** - -1. On the Compatibility Administrator toolbar, click **Query**. - -2. In the **Look in** drop-down list, select the appropriate database type to search. - -3. Type the location of the application you are searching for into the **Search for the Application** field. - - This name should be the same as the name in the **Applications** area (left pane) of Compatibility Administrator. - -4. Type the application executable (.exe) file name into the **Search for the File** box. If you leave this box blank, the percent (%) sign appears as a wildcard to search for any file. - - You must designate the executable name that was given when the compatibility fix was added to the database. - -5. Optionally, select the check box for one of the following types of compatibility fix: - - - **Compatibility Modes** - - - **Compatibility Fixes** - - - **Application Helps** - - **Important**   - If you do not select any of the check boxes, the search will look for all types of compatibility fixes. Do not select multiple check boxes because only applications that match all of the requirements will appear. - - - -6. Click **Find Now**. - - The query runs and the results of the query are displayed in the lower pane. - -## Querying by Using the Fix Properties Tab - - -You can use the **Fix Properties** tab of the Query tool to search for any application affected by a specific compatibility fix or a compatibility mode. For example, you can search for any application affected by the ProfilesSetup compatibility mode. - -**To query by using the Fix Properties tab** - -1. On the Compatibility Administrator toolbar, click **Query**. - -2. Click the **Fix Properties** tab. - -3. In the **Look in** drop-down list, select the appropriate database type to search. - -4. Type the name of the compatibility fix or compatibility mode into the **Search for programs fixed using** field. - - **Note**   - You can use the percent (%) symbol as a wildcard in your fix-properties query, as a substitute for any string of zero or more characters. - - - -5. Select the check box for either **Search in Compatibility Fixes** or **Search in Compatibility Modes**. - - **Important**   - Your text must match the type of compatibility fix or mode for which you are performing the query. For example, entering the name of a compatibility fix and selecting the compatibility mode check box will not return any results. Additionally, if you select both check boxes, the query will search for the fix by compatibility mode and compatibility fix. Only applications that match both requirements appear. - - - -6. Click **Find Now**. - - The query runs and the results of the query are displayed in the lower pane. - -## Querying by Using the Fix Description Tab - - -You can use the **Fix Description** tab of the Query tool to add parameters that enable you to search your compatibility databases by application title or solution description text. - -**To query by using the Fix Description tab** - -1. On the Compatibility Administrator toolbar, click **Query**. - -2. Click the **Fix Description** tab. - -3. In the **Look in** drop-down list, select the appropriate database type to search. - -4. Type your search keywords into the box **Words to look for**. Use commas to separate multiple keywords. - - **Important**   - You cannot use wildcards as part of the Fix Description search query because the default behavior is to search for any entry that meets your search criteria. - - - -5. Refine your search by selecting **Match any word** or **Match all words** from the drop-down list. - -6. Click **Find Now**. - - The query runs and the results of the query are displayed in the lower pane. - -## Querying by Using the Fix Description Tab - - -You can use the **Fix Description** tab of the Query tool to add additional SQL Server SELECT and WHERE clauses to your search criteria. - -**To query by using the Advanced tab** - -1. On the Compatibility Administrator toolbar, click **Query**. - -2. Click the **Advanced** tab. - -3. In the **Look in** drop-down list, select the appropriate database type to search. - -4. Select the appropriate SELECT clause for your search from the **Select clauses** box. For example, **APP\_NAME**. - - The **APP\_NAME** clause appears in the **SELECT** field. You can add as many additional clauses as you require. They will appear as columns in your search results. - -5. Select the appropriate WHERE clause for your search from the **Where clauses** box. For example, **DATABASE\_NAME**. - - The **DATABASE\_NAME =** clause appears in the **WHERE** box. - -6. Type the appropriate clause criteria after the equal (=) sign in the **WHERE** box. For example, **DATABASE\_NAME = "Custom\_Database"**. - - You must surround your clause criteria text with quotation marks (") for the clause to function properly. - -7. Click **Find Now**. - - The query runs and the results of the query are displayed in the lower pane. - -## Exporting Your Search Results - - -You can export any of your search results into a tab-delimited text (.txt) file for later review or for archival purposes. - -**To export your results** - -1. After you have completed your search by using the Query tool, click **Export**. - - The **Save results to a file** dialog box appears. - -2. Browse to the location where you intend to store the search results file, and then click **Save**. - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - - +--- +title: Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator (Windows 10) +description: You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature. +ms.assetid: dd213b55-c71c-407a-ad49-33db54f82f22 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature. + +For information about the Search feature, see [Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md). However, the Query tool provides more detailed search criteria, including tabs that enable you to search the program properties, the compatibility fix properties, and the fix description. You can perform a search by using SQL SELECT and WHERE clauses, in addition to searching specific types of databases. + +> [!IMPORTANT] +> You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. + +## Querying by Using the Program Properties Tab + +You can use the **Program Properties** tab of the Query tool to search for any compatibility fix, compatibility mode, or AppHelp for a specific application. + +**To query by using the Program Properties tab** + +1. On the Compatibility Administrator toolbar, click **Query**. +2. In the **Look in** drop-down list, select the appropriate database type to search. +3. Type the location of the application you are searching for into the **Search for the Application** field. + + This name should be the same as the name in the **Applications** area (left pane) of Compatibility Administrator. + +4. Type the application executable (.exe) file name into the **Search for the File** box. If you leave this box blank, the percent (%) sign appears as a wildcard to search for any file. + + You must designate the executable name that was given when the compatibility fix was added to the database. + +5. Optionally, select the check box for one of the following types of compatibility fix: + + - **Compatibility Modes** + - **Compatibility Fixes** + - **Application Helps** + + > [!IMPORTANT] + > If you do not select any of the check boxes, the search will look for all types of compatibility fixes. Do not select multiple check boxes because only applications that match all of the requirements will appear. + +6. Click **Find Now**. + + The query runs and the results of the query are displayed in the lower pane. + +## Querying by Using the Fix Properties Tab + + +You can use the **Fix Properties** tab of the Query tool to search for any application affected by a specific compatibility fix or a compatibility mode. For example, you can search for any application affected by the ProfilesSetup compatibility mode. + +**To query by using the Fix Properties tab** + +1. On the Compatibility Administrator toolbar, click **Query**. +2. Click the **Fix Properties** tab. +3. In the **Look in** drop-down list, select the appropriate database type to search. +4. Type the name of the compatibility fix or compatibility mode into the **Search for programs fixed using** field. + + >[!NOTE] + >You can use the percent (%) symbol as a wildcard in your fix-properties query, as a substitute for any string of zero or more characters + +5. Select the check box for either **Search in Compatibility Fixes** or **Search in Compatibility Modes**. + + >[!IMPORTANT] + >Your text must match the type of compatibility fix or mode for which you are performing the query. For example, entering the name of a compatibility fix and selecting the compatibility mode check box will not return any results. Additionally, if you select both check boxes, the query will search for the fix by compatibility mode and compatibility fix. Only applications that match both requirements appear. + +6. Click **Find Now**. + + The query runs and the results of the query are displayed in the lower pane. + +## Querying by Using the Fix Description Tab + +You can use the **Fix Description** tab of the Query tool to add parameters that enable you to search your compatibility databases by application title or solution description text. + +**To query by using the Fix Description tab** + +1. On the Compatibility Administrator toolbar, click **Query**. +2. Click the **Fix Description** tab. +3. In the **Look in** drop-down list, select the appropriate database type to search. +4. Type your search keywords into the box **Words to look for**. Use commas to separate multiple keywords. + + >[!IMPORTANT] + >You cannot use wildcards as part of the Fix Description search query because the default behavior is to search for any entry that meets your search criteria. + +5. Refine your search by selecting **Match any word** or **Match all words** from the drop-down list. +6. Click **Find Now**. + + The query runs and the results of the query are displayed in the lower pane. + +## Querying by Using the Fix Description Tab + + +You can use the **Fix Description** tab of the Query tool to add additional SQL Server SELECT and WHERE clauses to your search criteria. + +**To query by using the Advanced tab** + +1. On the Compatibility Administrator toolbar, click **Query**. +2. Click the **Advanced** tab. +3. In the **Look in** drop-down list, select the appropriate database type to search. +4. Select the appropriate SELECT clause for your search from the **Select clauses** box. For example, **APP\_NAME**. + + The **APP\_NAME** clause appears in the **SELECT** field. You can add as many additional clauses as you require. They will appear as columns in your search results. + +5. Select the appropriate WHERE clause for your search from the **Where clauses** box. For example, **DATABASE\_NAME**. + + The **DATABASE\_NAME =** clause appears in the **WHERE** box. + +6. Type the appropriate clause criteria after the equal (=) sign in the **WHERE** box. For example, **DATABASE\_NAME = "Custom\_Database"**. + + You must surround your clause criteria text with quotation marks (") for the clause to function properly. + +7. Click **Find Now**. + + The query runs and the results of the query are displayed in the lower pane. + +## Exporting Your Search Results + + +You can export any of your search results into a tab-delimited text (.txt) file for later review or for archival purposes. + +**To export your results** + +1. After you have completed your search by using the Query tool, click **Export**. + + The **Save results to a file** dialog box appears. + +2. Browse to the location where you intend to store the search results file, and then click **Save**. + +## Related topics + +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file diff --git a/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md b/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md index 7eeaf18a3f..952f743607 100644 --- a/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md +++ b/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md @@ -1,86 +1,87 @@ ---- -title: Security and data protection considerations for Windows To Go (Windows 10) -description: One of the most important requirements to consider when you plan your Windows To Go deployment is to ensure that the data, content, and resources you work with in the Windows To Go workspace is protected and secure. -ms.assetid: 5f27339f-6761-44f4-8c29-9a25cf8e75fe -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: mobile, device, USB, secure, BitLocker -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: mobility, security -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Security and data protection considerations for Windows To Go - - -**Applies to** - -- Windows 10 - ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. - -One of the most important requirements to consider when you plan your Windows To Go deployment is to ensure that the data, content, and resources you work with in the Windows To Go workspace is protected and secure. - -## Backup and restore - - -As long as you are not saving data on the Windows To Go drive, there is no need for a backup and restore solution for Windows To Go. If you are saving data on the drive and are not using folder redirection and offline files, you should back up all of your data to a network location, such as cloud storage or a network share after each work session. Review the new and improved features described in [Supporting Information Workers with Reliable File Services and Storage](https://go.microsoft.com/fwlink/p/?LinkId=619102) for different solutions you could implement. - -If the USB drive fails for any reason, the standard process to restore the drive to working condition is to reformat and re-provision the drive with Windows To Go, so all data and customization on the drive will be lost. This is another reason why using roaming user profiles, folder redirection and offline files with Windows To Go is strongly recommended. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). - -## BitLocker - - -We recommend that you use BitLocker with your Windows To Go drives to protect the drive from being compromised if the drive is lost or stolen. When BitLocker is enabled, the user must provide a password to unlock the drive and boot the Windows To Go workspace, this helps prevent unauthorized users from booting the drive and using it to gain access to your network resources and confidential data. Because Windows To Go drives are meant to be roamed between computers, the Trusted Platform Module (TPM) cannot be used by BitLocker to protect the drive. Instead, you will be specifying a password that BitLocker will use for disk encryption and decryption. By default, this password must be eight characters in length and can enforce more strict requirements depending on the password complexity requirements defined by your organizations domain controller. - -You can enable BitLocker while using the Windows To Go Creator wizard as part of the drive provisioning process before first use; or it can be enabled afterward by the user from within the Windows To Go workspace. - -**Tip**   -If the Windows To Go Creator wizard is not able to enable BitLocker, see [Why can't I enable BitLocker from Windows To Go Creator?](windows-to-go-frequently-asked-questions.md#wtg-faq-blfail) - - - -If you are using a host computer running Windows 7 that has BitLocker enabled, you should suspend BitLocker before changing the BIOS settings to boot from USB and then resume BitLocker protection. If BitLocker is not suspended first, the next time the computer is started it will boot into recovery mode. - -## Disk discovery and data leakage - - -We recommend that you use the **NoDefaultDriveLetter** attribute when provisioning the USB drive to help prevent accidental data leakage. **NoDefaultDriveLetter** will prevent the host operating system from assigning a drive letter if a user inserts it into a running computer. This means the drive will not appear in Windows Explorer and an AutoPlay prompt will not be displayed to the user. This reduces the likelihood that an end-user will access the offline Windows To Go disk directly from another computer. If you use the Windows To Go Creator to provision a workspace, this attribute will automatically be set for you. - -To prevent accidental data leakage between Windows To Go and the host system Windows 8 has a new SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. The default configuration for Windows To Go has this policy enabled. It is strongly recommended you do not change this policy to allow mounting of internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. - -For more information, see [How to Configure Storage Area Network (SAN) Policy in Windows PE](https://go.microsoft.com/fwlink/p/?LinkId=619103). - -## Security certifications for Windows To Go - - -Windows to Go is a core capability of Windows when it is deployed on the drive and is configured following the guidance for the applicable security certification. Solutions built using Windows To Go can be submitted for additional certifications by the solution provider that cover the solution provider’s specific hardware environment. For more details about Windows security certifications, see the following topics. - -- [Windows Platform Common Criteria Certification](https://go.microsoft.com/fwlink/p/?LinkId=619104) - -- [FIPS 140 Evaluation](https://go.microsoft.com/fwlink/p/?LinkId=619107) - -## Related topics - - -[Windows To Go: feature overview](windows-to-go-overview.md) - -[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) - -[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) - -[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) - - - - - - - - - +--- +title: Security and data protection considerations for Windows To Go (Windows 10) +description: Ensure that the data, content, and resources you work with in the Windows To Go workspace are protected and secure. +ms.assetid: 5f27339f-6761-44f4-8c29-9a25cf8e75fe +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: mobile, device, USB, secure, BitLocker +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: mobility, security +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Security and data protection considerations for Windows To Go + + +**Applies to** + +- Windows 10 + +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. + +One of the most important requirements to consider when you plan your Windows To Go deployment is to ensure that the data, content, and resources you work with in the Windows To Go workspace is protected and secure. + +## Backup and restore + + +As long as you are not saving data on the Windows To Go drive, there is no need for a backup and restore solution for Windows To Go. If you are saving data on the drive and are not using folder redirection and offline files, you should back up all of your data to a network location, such as cloud storage or a network share after each work session. Review the new and improved features described in [Supporting Information Workers with Reliable File Services and Storage](https://go.microsoft.com/fwlink/p/?LinkId=619102) for different solutions you could implement. + +If the USB drive fails for any reason, the standard process to restore the drive to working condition is to reformat and re-provision the drive with Windows To Go, so all data and customization on the drive will be lost. This is another reason why using roaming user profiles, folder redirection and offline files with Windows To Go is strongly recommended. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). + +## BitLocker + + +We recommend that you use BitLocker with your Windows To Go drives to protect the drive from being compromised if the drive is lost or stolen. When BitLocker is enabled, the user must provide a password to unlock the drive and boot the Windows To Go workspace, this helps prevent unauthorized users from booting the drive and using it to gain access to your network resources and confidential data. Because Windows To Go drives are meant to be roamed between computers, the Trusted Platform Module (TPM) cannot be used by BitLocker to protect the drive. Instead, you will be specifying a password that BitLocker will use for disk encryption and decryption. By default, this password must be eight characters in length and can enforce more strict requirements depending on the password complexity requirements defined by your organizations domain controller. + +You can enable BitLocker while using the Windows To Go Creator wizard as part of the drive provisioning process before first use; or it can be enabled afterward by the user from within the Windows To Go workspace. + +**Tip**   +If the Windows To Go Creator wizard is not able to enable BitLocker, see [Why can't I enable BitLocker from Windows To Go Creator?](windows-to-go-frequently-asked-questions.md#wtg-faq-blfail) + + + +If you are using a host computer running Windows 7 that has BitLocker enabled, you should suspend BitLocker before changing the BIOS settings to boot from USB and then resume BitLocker protection. If BitLocker is not suspended first, the next time the computer is started it will boot into recovery mode. + +## Disk discovery and data leakage + + +We recommend that you use the **NoDefaultDriveLetter** attribute when provisioning the USB drive to help prevent accidental data leakage. **NoDefaultDriveLetter** will prevent the host operating system from assigning a drive letter if a user inserts it into a running computer. This means the drive will not appear in Windows Explorer and an AutoPlay prompt will not be displayed to the user. This reduces the likelihood that an end-user will access the offline Windows To Go disk directly from another computer. If you use the Windows To Go Creator to provision a workspace, this attribute will automatically be set for you. + +To prevent accidental data leakage between Windows To Go and the host system Windows 8 has a new SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. The default configuration for Windows To Go has this policy enabled. It is strongly recommended you do not change this policy to allow mounting of internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 operating system, mounting the drive will lead to loss of hibernation state and, therefore, user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. + +For more information, see [How to Configure Storage Area Network (SAN) Policy in Windows PE](https://go.microsoft.com/fwlink/p/?LinkId=619103). + +## Security certifications for Windows To Go + + +Windows to Go is a core capability of Windows when it is deployed on the drive and is configured following the guidance for the applicable security certification. Solutions built using Windows To Go can be submitted for additional certifications by the solution provider that cover the solution provider’s specific hardware environment. For more details about Windows security certifications, see the following topics. + +- [Windows Platform Common Criteria Certification](https://go.microsoft.com/fwlink/p/?LinkId=619104) + +- [FIPS 140 Evaluation](https://go.microsoft.com/fwlink/p/?LinkId=619107) + +## Related topics + + +[Windows To Go: feature overview](windows-to-go-overview.md) + +[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) + +[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) + +[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) + + + + + + + + + diff --git a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md index 08db3b24d6..d4b510cd08 100644 --- a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md +++ b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md @@ -1,80 +1,81 @@ ---- -title: Showing Messages Generated by the SUA Tool (Windows 10) -description: On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. -ms.assetid: 767eb7f2-d6c4-414c-a7b3-a997337d904a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Showing Messages Generated by the SUA Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. - -**To show the messages that the SUA tool has generated** - -1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). - -2. After you finish testing, in the SUA tool, click the **App Info** tab. - -3. On the **View** menu, click the command that corresponds to the messages that you want to see. The following table describes the commands. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              View menu commandDescription

              Error Messages

              When this command is selected, the user interface shows error messages that the SUA tool has generated. Error messages are highlighted in pink.

              -

              This command is selected by default.

              Warning Messages

              When this command is selected, the user interface shows warning messages that the SUA tool has generated. Warning messages are highlighted in yellow.

              Information Messages

              When this command is selected, the user interface shows informational messages that the SUA tool has generated. Informational messages are highlighted in green.

              Detailed Information

              When this command is selected, the user interface shows information that the SUA tool has generated, such as debug, stack trace, stop code, and severity information.

              - -   - -  - -  - - - - - +--- +title: Showing Messages Generated by the SUA Tool (Windows 10) +description: On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. +ms.assetid: 767eb7f2-d6c4-414c-a7b3-a997337d904a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Showing Messages Generated by the SUA Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. + +**To show the messages that the SUA tool has generated** + +1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). + +2. After you finish testing, in the SUA tool, click the **App Info** tab. + +3. On the **View** menu, click the command that corresponds to the messages that you want to see. The following table describes the commands. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              View menu commandDescription

              Error Messages

              When this command is selected, the user interface shows error messages that the SUA tool has generated. Error messages are highlighted in pink.

              +

              This command is selected by default.

              Warning Messages

              When this command is selected, the user interface shows warning messages that the SUA tool has generated. Warning messages are highlighted in yellow.

              Information Messages

              When this command is selected, the user interface shows informational messages that the SUA tool has generated. Informational messages are highlighted in green.

              Detailed Information

              When this command is selected, the user interface shows information that the SUA tool has generated, such as debug, stack trace, stop code, and severity information.

              + +   + +  + +  + + + + + diff --git a/windows/deployment/planning/sua-users-guide.md b/windows/deployment/planning/sua-users-guide.md index e0adb30d1a..2d34aa8326 100644 --- a/windows/deployment/planning/sua-users-guide.md +++ b/windows/deployment/planning/sua-users-guide.md @@ -1,69 +1,70 @@ ---- -title: SUA User's Guide (Windows 10) -description: You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. -ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# SUA User's Guide - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. - -You can use SUA in either of the following ways: - -- **Standard User Analyzer Wizard.** A wizard that guides you through a step-by-step process to locate and fix issues, without options for additional analysis. - -- **Standard User Analyzer Tool.** A full-function tool in which you can perform in-depth analysis and fix issues. - -## In this section - - - ---- - - - - - - - - - - - - - - - - -
              TopicDescription

              Using the SUA Wizard

              The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions.

              Using the SUA Tool

              By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.

              - - - - - - - - +--- +title: SUA User's Guide (Windows 10) +description: Learn how to use Standard User Analyzer (SUA). SUA can test your apps and monitor API calls to detect compatibility issues related to the Windows User Account Control (UAC) feature. +ms.custom: seo-marvel-apr2020 +ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# SUA User's Guide + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. + +You can use SUA in either of the following ways: + +- **Standard User Analyzer Wizard.** A wizard that guides you through a step-by-step process to locate and fix issues, without options for additional analysis. + +- **Standard User Analyzer Tool.** A full-function tool in which you can perform in-depth analysis and fix issues. + +## In this section + + + ++++ + + + + + + + + + + + + + + + + +
              TopicDescription

              Using the SUA Wizard

              The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions.

              Using the SUA Tool

              By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.

              + + + + + + + diff --git a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md index d58bf1d2ce..d3c279c3eb 100644 --- a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md +++ b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md @@ -1,105 +1,106 @@ ---- -title: Tabs on the SUA Tool Interface (Windows 10) -description: The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. -ms.assetid: 0d705321-1d85-4217-bf2c-0ca231ca303b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Tabs on the SUA Tool Interface - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. - -The following table provides a description of each tab on the user interface for the SUA tool. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Tab nameDescription

              App Info

              Provides the following information for the selected application:

              -
                -
              • Debugging information

              • -
              • Error, warning, and informational messages (if they are enabled)

              • -
              • Options for running the application

              • -

              File

              Provides information about access to the file system.

              -

              For example, this tab might show an attempt to write to a file that only administrators can typically access.

              Registry

              Provides information about access to the system registry.

              -

              For example, this tab might show an attempt to write to a registry key that only administrators can typically access.

              INI

              Provides information about WriteProfile API issues.

              -

              For example, in the Calculator tool (Calc.exe) in Windows® XP, when you change the view from Standard to Scientific, Calc.exe calls the WriteProfile API to write to the Windows\Win.ini file. The Win.ini file is writable only for administrators.

              Token

              Provides information about access-token checking.

              -

              For example, this tab might show an explicit check for the Builtin\Administrators security identifier (SID) in the user's access token. This operation may not work for a standard user.

              Privilege

              Provides information about permissions.

              -

              For example, this tab might show an attempt to explicitly enable permissions that do not work for a standard user.

              Name Space

              Provides information about creation of system objects.

              -

              For example, this tab might show an attempt to create a new system object, such as an event or a memory map, in a restricted namespace. Applications that attempt this kind of operation do not function for a standard user.

              Other Objects

              Provides information related to applications accessing objects other than files and registry keys.

              Process

              Provides information about process elevation.

              -

              For example, this tab might show the use of the CreateProcess API to open an executable (.exe) file that, in turn, requires process elevation that will not function for a standard user.

              - -  - -  - -  - - - - - +--- +title: Tabs on the SUA Tool Interface (Windows 10) +description: The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. +ms.assetid: 0d705321-1d85-4217-bf2c-0ca231ca303b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Tabs on the SUA Tool Interface + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. + +The following table provides a description of each tab on the user interface for the SUA tool. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Tab nameDescription

              App Info

              Provides the following information for the selected application:

              +
                +
              • Debugging information

              • +
              • Error, warning, and informational messages (if they are enabled)

              • +
              • Options for running the application

              • +

              File

              Provides information about access to the file system.

              +

              For example, this tab might show an attempt to write to a file that only administrators can typically access.

              Registry

              Provides information about access to the system registry.

              +

              For example, this tab might show an attempt to write to a registry key that only administrators can typically access.

              INI

              Provides information about WriteProfile API issues.

              +

              For example, in the Calculator tool (Calc.exe) in Windows® XP, when you change the view from Standard to Scientific, Calc.exe calls the WriteProfile API to write to the Windows\Win.ini file. The Win.ini file is writable only for administrators.

              Token

              Provides information about access-token checking.

              +

              For example, this tab might show an explicit check for the Builtin\Administrators security identifier (SID) in the user's access token. This operation may not work for a standard user.

              Privilege

              Provides information about permissions.

              +

              For example, this tab might show an attempt to explicitly enable permissions that do not work for a standard user.

              Name Space

              Provides information about creation of system objects.

              +

              For example, this tab might show an attempt to create a new system object, such as an event or a memory map, in a restricted namespace. Applications that attempt this kind of operation do not function for a standard user.

              Other Objects

              Provides information related to applications accessing objects other than files and registry keys.

              Process

              Provides information about process elevation.

              +

              For example, this tab might show the use of the CreateProcess API to open an executable (.exe) file that, in turn, requires process elevation that will not function for a standard user.

              + +  + +  + +  + + + + + diff --git a/windows/deployment/planning/testing-your-application-mitigation-packages.md b/windows/deployment/planning/testing-your-application-mitigation-packages.md index 180b884748..c3c759c319 100644 --- a/windows/deployment/planning/testing-your-application-mitigation-packages.md +++ b/windows/deployment/planning/testing-your-application-mitigation-packages.md @@ -1,92 +1,93 @@ ---- -title: Testing Your Application Mitigation Packages (Windows 10) -description: This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues. -ms.assetid: ae946f27-d377-4db9-b179-e8875d454ccf -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Testing Your Application Mitigation Packages - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues. - -## Testing Your Application Mitigation Packages - - -Testing your application mitigation package strategies is an iterative process, whereby the mitigation strategies that prove unsuccessful will need to be revised and retested. The testing process includes a series of tests in the test environment and one or more pilot deployments in the production environment. - -**To test your mitigation strategies** - -1. Perform the following steps for each of the applications for which you have developed mitigations. - - 1. Test the mitigation strategy in your test environment. - - 2. If the mitigation strategy is unsuccessful, revise the mitigation strategy and perform step 1 again. - - At the end of this step, you will have successfully tested all of your mitigation strategies in your test environment and can move to your pilot deployment environment. - -2. Perform the following steps in the pilot deployments for each of the applications for which you have developed mitigations. - - 1. Test the mitigation strategy in your pilot deployment. - - 2. If the mitigation strategy is unsuccessful, revise the mitigation strategy and perform Step 2 again. - - At the end of this step, you will have successfully tested all of your mitigation strategies in your pilot environment. - -## Reporting the Compatibility Mitigation Status to Stakeholders - - -After testing your application mitigation package, you must communicate your status to the appropriate stakeholders before deployment begins. We recommend that you perform this communication by using the following status ratings. - -- **Resolved application compatibility issues**. This status indicates that the application compatibility issues are resolved and that these applications represent no risk to your environment. - -- **Unresolved application compatibility issues**. This status indicates that there are unresolved issues for the specifically defined applications. Because these applications are a risk to your environment, more discussion is required before you can resolve the compatibility issues. - -- **Changes to user experience**. This status indicates that the fix will change the user experience for the defined applications, possibly requiring your staff to receive further training. More investigation is required before you can resolve the compatibility issues. - -- **Changes in help desk procedures and processes**. This status indicates that the fix will require changes to your help desk's procedures and processes, possibly requiring your support staff to receive further training. More investigation is required before you can resolve the compatibility issues. - -## Resolving Outstanding Compatibility Issues - - -At this point, you probably cannot resolve any unresolved application compatibility issues by automated mitigation methods or by modifying the application. Resolve any outstanding application compatibility issues by using one of the following methods. - -- Apply specific compatibility modes, or run the program as an Administrator, by using the Compatibility Administrator tool. - - **Note**   - For more information about using Compatibility Administrator to apply compatibility fixes and compatibility modes, see [Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md). - - - -- Run the application in a virtual environment. - - Run the application in a version of Windows supported by the application in a virtualized environment. This method ensures application compatibility, because the application is running on a supported operating system. - -- Resolve application compatibility by using non-Microsoft tools. - - If the application was developed in an environment other than Microsoft Visual Studio®, you must use non-Microsoft debugging and analysis tools to help resolve the remaining application compatibility issues. - -- Outsource the application compatibility mitigation. - - If your developers have insufficient resources to resolve the application compatibility issues, outsource the mitigation effort to another organization within your company. - -## Related topics -[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) +--- +title: Testing Your Application Mitigation Packages (Windows 10) +description: Learn how to test your application-mitigation packages, including how to report your information and how to resolve any outstanding issues. +ms.assetid: ae946f27-d377-4db9-b179-e8875d454ccf +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Testing Your Application Mitigation Packages + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues. + +## Testing Your Application Mitigation Packages + + +Testing your application mitigation package strategies is an iterative process, whereby the mitigation strategies that prove unsuccessful will need to be revised and retested. The testing process includes a series of tests in the test environment and one or more pilot deployments in the production environment. + +**To test your mitigation strategies** + +1. Perform the following steps for each of the applications for which you have developed mitigations. + + 1. Test the mitigation strategy in your test environment. + + 2. If the mitigation strategy is unsuccessful, revise the mitigation strategy and perform step 1 again. + + At the end of this step, you will have successfully tested all of your mitigation strategies in your test environment and can move to your pilot deployment environment. + +2. Perform the following steps in the pilot deployments for each of the applications for which you have developed mitigations. + + 1. Test the mitigation strategy in your pilot deployment. + + 2. If the mitigation strategy is unsuccessful, revise the mitigation strategy and perform Step 2 again. + + At the end of this step, you will have successfully tested all of your mitigation strategies in your pilot environment. + +## Reporting the Compatibility Mitigation Status to Stakeholders + + +After testing your application mitigation package, you must communicate your status to the appropriate stakeholders before deployment begins. We recommend that you perform this communication by using the following status ratings. + +- **Resolved application compatibility issues**. This status indicates that the application compatibility issues are resolved and that these applications represent no risk to your environment. + +- **Unresolved application compatibility issues**. This status indicates that there are unresolved issues for the specifically defined applications. Because these applications are a risk to your environment, more discussion is required before you can resolve the compatibility issues. + +- **Changes to user experience**. This status indicates that the fix will change the user experience for the defined applications, possibly requiring your staff to receive further training. More investigation is required before you can resolve the compatibility issues. + +- **Changes in help desk procedures and processes**. This status indicates that the fix will require changes to your help desk's procedures and processes, possibly requiring your support staff to receive further training. More investigation is required before you can resolve the compatibility issues. + +## Resolving Outstanding Compatibility Issues + + +At this point, you probably cannot resolve any unresolved application compatibility issues by automated mitigation methods or by modifying the application. Resolve any outstanding application compatibility issues by using one of the following methods. + +- Apply specific compatibility modes, or run the program as an Administrator, by using the Compatibility Administrator tool. + + > [!NOTE] + > For more information about using Compatibility Administrator to apply compatibility fixes and compatibility modes, see [Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md). + + + +- Run the application in a virtual environment. + + Run the application in a version of Windows supported by the application in a virtualized environment. This method ensures application compatibility, because the application is running on a supported operating system. + +- Resolve application compatibility by using non-Microsoft tools. + + If the application was developed in an environment other than Microsoft Visual Studio®, you must use non-Microsoft debugging and analysis tools to help resolve the remaining application compatibility issues. + +- Outsource the application compatibility mitigation. + + If your developers have insufficient resources to resolve the application compatibility issues, outsource the mitigation effort to another organization within your company. + +## Related topics +[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) diff --git a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md index 42f2b0f0dc..fe43dd8983 100644 --- a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md +++ b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md @@ -1,101 +1,94 @@ ---- -title: Understanding and Using Compatibility Fixes (Windows 10) -description: As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. -ms.assetid: 84bf663d-3e0b-4168-99d6-a26e054821b7 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Understanding and Using Compatibility Fixes - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application. - -## How the Compatibility Fix Infrastructure Works - - -The Compatibility Fix infrastructure uses the linking ability of APIs to redirect an application from Windows code directly to alternative code that implements the compatibility fix. - -The Windows Portable Executable File Format includes headers that contain the data directories that are used to provide a layer of indirection between the application and the linked file. API calls to the external binary files take place through the Import Address Table (IAT), which then directly calls the Windows operating system, as shown in the following figure. - -![act app calls operating system through iat](images/dep-win8-l-act-appcallosthroughiat.jpg) - -Specifically, the process modifies the address of the affected Windows function in the IAT to point to the compatibility fix code, as shown in the following figure. - -![act app redirect with compatibility fix](images/dep-win8-l-act-appredirectwithcompatfix.jpg) - -**Note**   -For statically linked DLLs, the code redirection occurs as the application loads. You can also fix dynamically linked DLLs by hooking into the GetProcAddress API. - - - -## Design Implications of the Compatibility Fix Infrastructure - - -There are important considerations to keep in mind when determining your application fix strategy, due to certain characteristics of the Compatibility Fix infrastructure. - -- The compatibility fix is not part of the Windows operating system (as shown in the previous figure). Therefore, the same security restrictions apply to the compatibility fix as apply to the application code, which means that you cannot use compatibility fixes to bypass any of the security mechanisms of the operating system. Therefore, compatibility fixes do not increase your security exposure, nor do you need to lower your security settings to accommodate compatibility fixes. - -- The Compatibility Fix infrastructure injects additional code into the application before it calls the operating system. This means that any remedy that can be accomplished by a compatibility fix can also be addressed by fixing the application code. - -- The compatibility fixes run as user-mode code inside of a user-mode application process. This means that you cannot use a compatibility fix to fix kernel-mode code issues. For example, you cannot use a compatibility fix to resolve device-driver issues. - - **Note**   - Some antivirus, firewall, and anti-spyware code runs in kernel mode. - - - -## Determining When to Use a Compatibility Fix - - -The decision to use compatibility fixes to remedy your compatibility issues may involve more than just technical issues. The following scenarios reflect other common reasons for using a compatibility fix. - -### Scenario 1 - -**The compatibility issue exists on an application which is no longer supported by the vendor.** - -As in many companies, you may run applications for which the vendor has ended support. In this situation, you cannot have the vendor make the fix, nor can you access the source code to modify the issue yourself. However, it is possible that the use of a compatibility fix might resolve the compatibility issue. - -### Scenario 2 - -**The compatibility issue exists on an internally created application.** - -While it is preferable to fix the application code to resolve the issue, this is not always possible. Your internal team might not be able to fix all of the issues prior to the deployment of the new operating system. Instead, they might choose to employ a compatibility fix anywhere that it is possible. They can then fix the code only for issues that cannot be resolved in this manner. Through this method, your team can modify the application as time permits, without delaying the deployment of the new operating system into your environment. - -### Scenario 3 - -**The compatibility issue exists on an application for which a compatible version is to be released in the near future, or an application that is not critical to the organization, regardless of its version.** - -In the situation where an application is either unimportant to your organization, or for which a newer, compatible version is to be released shortly, you can use a compatibility fix as a temporary solution. This means that you can continue to use the application without delaying the deployment of a new operating system, with the intention of updating your configuration as soon as the new version is released. - -## Determining Which Version of an Application to Fix - - -You can apply a compatibility fix to a particular version of an application, either by using the "up to or including" clause or by selecting that specific version. This means that the next version of the application will not have the compatibility fix automatically applied. This is important, because it allows you to continue to use your application, but it also encourages the vendor to fix the application. - -## Support for Compatibility Fixes - - -Compatibility fixes are shipped as part of the Windows operating system and are updated by using Windows Update. Therefore, they receive the same level of support as Windows itself. - -You can apply the compatibility fixes to any of your applications. However, Microsoft does not provide the tools to use the Compatibility Fix infrastructure to create your own custom fixes. - -## Related topics -[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) +--- +title: Understanding and Using Compatibility Fixes (Windows 10) +description: As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. +ms.assetid: 84bf663d-3e0b-4168-99d6-a26e054821b7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Understanding and Using Compatibility Fixes + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application. + +## How the Compatibility Fix Infrastructure Works + +The Compatibility Fix infrastructure uses the linking ability of APIs to redirect an application from Windows code directly to alternative code that implements the compatibility fix. + +The Windows Portable Executable File Format includes headers that contain the data directories that are used to provide a layer of indirection between the application and the linked file. API calls to the external binary files take place through the Import Address Table (IAT), which then directly calls the Windows operating system, as shown in the following figure. + +![act app calls operating system through iat](images/dep-win8-l-act-appcallosthroughiat.jpg) + +Specifically, the process modifies the address of the affected Windows function in the IAT to point to the compatibility fix code, as shown in the following figure. + +![act app redirect with compatibility fix](images/dep-win8-l-act-appredirectwithcompatfix.jpg) + +>[!NOTE] +>For statically linked DLLs, the code redirection occurs as the application loads. You can also fix dynamically linked DLLs by hooking into the GetProcAddress API. + + + +## Design Implications of the Compatibility Fix Infrastructure + +There are important considerations to keep in mind when determining your application fix strategy, due to certain characteristics of the Compatibility Fix infrastructure. + +- The compatibility fix is not part of the Windows operating system (as shown in the previous figure). Therefore, the same security restrictions apply to the compatibility fix as apply to the application code, which means that you cannot use compatibility fixes to bypass any of the security mechanisms of the operating system. Therefore, compatibility fixes do not increase your security exposure, nor do you need to lower your security settings to accommodate compatibility fixes. + +- The Compatibility Fix infrastructure injects additional code into the application before it calls the operating system. This means that any remedy that can be accomplished by a compatibility fix can also be addressed by fixing the application code. + +- The compatibility fixes run as user-mode code inside of a user-mode application process. This means that you cannot use a compatibility fix to fix kernel-mode code issues. For example, you cannot use a compatibility fix to resolve device-driver issues. + + > [!NOTE] + > Some antivirus, firewall, and anti-spyware code runs in kernel mode. + +## Determining When to Use a Compatibility Fix + +The decision to use compatibility fixes to remedy your compatibility issues may involve more than just technical issues. The following scenarios reflect other common reasons for using a compatibility fix. + +### Scenario 1 + +**The compatibility issue exists on an application which is no longer supported by the vendor.** + +As in many companies, you may run applications for which the vendor has ended support. In this situation, you cannot have the vendor make the fix, nor can you access the source code to modify the issue yourself. However, it is possible that the use of a compatibility fix might resolve the compatibility issue. + +### Scenario 2 + +**The compatibility issue exists on an internally created application.** + +While it is preferable to fix the application code to resolve the issue, this is not always possible. Your internal team might not be able to fix all of the issues prior to the deployment of the new operating system. Instead, they might choose to employ a compatibility fix anywhere that it is possible. They can then fix the code only for issues that cannot be resolved in this manner. Through this method, your team can modify the application as time permits, without delaying the deployment of the new operating system into your environment. + +### Scenario 3 + +**The compatibility issue exists on an application for which a compatible version is to be released in the near future, or an application that is not critical to the organization, regardless of its version.** + +In the situation where an application is either unimportant to your organization, or for which a newer, compatible version is to be released shortly, you can use a compatibility fix as a temporary solution. This means that you can continue to use the application without delaying the deployment of a new operating system, with the intention of updating your configuration as soon as the new version is released. + +## Determining Which Version of an Application to Fix + +You can apply a compatibility fix to a particular version of an application, either by using the "up to or including" clause or by selecting that specific version. This means that the next version of the application will not have the compatibility fix automatically applied. This is important, because it allows you to continue to use your application, but it also encourages the vendor to fix the application. + +## Support for Compatibility Fixes + +Compatibility fixes are shipped as part of the Windows operating system and are updated by using Windows Update. Therefore, they receive the same level of support as Windows itself. + +You can apply the compatibility fixes to any of your applications. However, Microsoft does not provide the tools to use the Compatibility Fix infrastructure to create your own custom fixes. + +## Related topics + +[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) diff --git a/windows/deployment/planning/using-the-compatibility-administrator-tool.md b/windows/deployment/planning/using-the-compatibility-administrator-tool.md index b38891eae2..cb84beaa58 100644 --- a/windows/deployment/planning/using-the-compatibility-administrator-tool.md +++ b/windows/deployment/planning/using-the-compatibility-administrator-tool.md @@ -1,94 +1,95 @@ ---- -title: Using the Compatibility Administrator Tool (Windows 10) -description: This section provides information about using the Compatibility Administrator tool. -ms.assetid: 57271e47-b9b9-4018-a0b5-7115a533166d -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Using the Compatibility Administrator Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about using the Compatibility Administrator tool. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              TopicDescription

              Available Data Types and Operators in Compatibility Administrator

              The Compatibility Administrator tool provides a way to query your custom-compatibility databases.

              Searching for Fixed Applications in Compatibility Administrator

              With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.

              Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator

              You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.

              Creating a Custom Compatibility Fix in Compatibility Administrator

              The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.

              Creating a Custom Compatibility Mode in Compatibility Administrator

              Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.

              Creating an AppHelp Message in Compatibility Administrator

              The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.

              Viewing the Events Screen in Compatibility Administrator

              The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.

              Enabling and Disabling Compatibility Fixes in Compatibility Administrator

              You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.

              Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator

              The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.

              - - - - - - - - - - - +--- +title: Using the Compatibility Administrator Tool (Windows 10) +description: This section provides information about using the Compatibility Administrator tool. +ms.assetid: 57271e47-b9b9-4018-a0b5-7115a533166d +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Using the Compatibility Administrator Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +This section provides information about using the Compatibility Administrator tool. + +## In this section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              TopicDescription

              Available Data Types and Operators in Compatibility Administrator

              The Compatibility Administrator tool provides a way to query your custom-compatibility databases.

              Searching for Fixed Applications in Compatibility Administrator

              With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.

              Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator

              You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.

              Creating a Custom Compatibility Fix in Compatibility Administrator

              The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.

              Creating a Custom Compatibility Mode in Compatibility Administrator

              Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.

              Creating an AppHelp Message in Compatibility Administrator

              The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.

              Viewing the Events Screen in Compatibility Administrator

              The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.

              Enabling and Disabling Compatibility Fixes in Compatibility Administrator

              You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.

              Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator

              The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.

              + + + + + + + + + + + diff --git a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md index eb092034f3..649a832f90 100644 --- a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md +++ b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md @@ -1,113 +1,114 @@ ---- -title: Using the Sdbinst.exe Command-Line Tool (Windows 10) -description: You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. -ms.assetid: c1945425-3f8d-4de8-9d2d-59f801f07034 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Using the Sdbinst.exe Command-Line Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2016 -- Windows Server 2012 -- Windows Server 2008 R2 - -You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations. - -After you deploy and store the customized databases on each of your local computers, you must register the database files. Until you register the database files, the operating system is unable to identify the available compatibility fixes when starting an application. - -## Command-Line Options for Deploying Customized Database Files - -Sample output from the command `Sdbinst.exe /?` in an elevated CMD window: - -``` -Microsoft Windows [Version 10.0.14393] -(c) 2016 Microsoft Corporation. All rights reserved. - -C:\Windows\system32>Sdbinst.exe /? -Usage: Sdbinst.exe [-?] [-q] [-u] [-g] [-p] [-n[:WIN32|WIN64]] myfile.sdb | {guid} | "name" - - -? - print this help text. - -p - Allow SDBs containing patches. - -q - Quiet mode: prompts are auto-accepted. - -u - Uninstall. - -g {guid} - GUID of file (uninstall only). - -n "name" - Internal name of file (uninstall only). - -C:\Windows\system32>_ -``` - -The command-line options use the following conventions: - -Sdbinst.exe \[-?\] \[-p\] \[-q\] \[-u\] \[-g\] \[-u filepath\] \[-g *GUID*\] \[-n *"name"*\] - -The following table describes the available command-line options. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              OptionDescription

              -?

              Displays the Help for the Sdbinst.exe tool.

              -

              For example,

              -

              sdbinst.exe -?

              -p

              Allows SDBs installation with Patches

              -

              For example,

              -

              sdbinst.exe -p C:\Windows\AppPatch\Myapp.sdb

              -q

              Performs a silent installation with no visible window, status, or warning information. Fatal errors appear only in Event Viewer (Eventvwr.exe).

              -

              For example,

              -

              sdbinst.exe -q

              -u filepath

              Performs an uninstallation of the specified database.

              -

              For example,

              -

              sdbinst.exe -u C:\example.sdb

              -g GUID

              Specifies the customized database to uninstall by a globally unique identifier (GUID).

              -

              For example,

              -

              sdbinst.exe -g 6586cd8f-edc9-4ea8-ad94-afabea7f62e3

              -n "name"

              Specifies the customized database to uninstall by file name.

              -

              For example,

              -

              sdbinst.exe -n "My_Database"

              - -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) +--- +title: Using the Sdbinst.exe Command-Line Tool (Windows 10) +description: Learn how to deploy customized database (.sdb) files using the Sdbinst.exe Command-Line Tool. Review a list of command line options. +ms.assetid: c1945425-3f8d-4de8-9d2d-59f801f07034 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Using the Sdbinst.exe Command-Line Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2016 +- Windows Server 2012 +- Windows Server 2008 R2 + +You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations. + +After you deploy and store the customized databases on each of your local computers, you must register the database files. Until you register the database files, the operating system is unable to identify the available compatibility fixes when starting an application. + +## Command-Line Options for Deploying Customized Database Files + +Sample output from the command `Sdbinst.exe /?` in an elevated CMD window: + +``` +Microsoft Windows [Version 10.0.14393] +(c) 2016 Microsoft Corporation. All rights reserved. + +C:\Windows\system32>Sdbinst.exe /? +Usage: Sdbinst.exe [-?] [-q] [-u] [-g] [-p] [-n[:WIN32|WIN64]] myfile.sdb | {guid} | "name" + + -? - print this help text. + -p - Allow SDBs containing patches. + -q - Quiet mode: prompts are auto-accepted. + -u - Uninstall. + -g {guid} - GUID of file (uninstall only). + -n "name" - Internal name of file (uninstall only). + +C:\Windows\system32>_ +``` + +The command-line options use the following conventions: + +Sdbinst.exe \[-?\] \[-p\] \[-q\] \[-u\] \[-g\] \[-u filepath\] \[-g *GUID*\] \[-n *"name"*\] + +The following table describes the available command-line options. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              OptionDescription

              -?

              Displays the Help for the Sdbinst.exe tool.

              +

              For example,

              +

              sdbinst.exe -?

              -p

              Allows SDBs installation with Patches

              +

              For example,

              +

              sdbinst.exe -p C:\Windows\AppPatch\Myapp.sdb

              -q

              Performs a silent installation with no visible window, status, or warning information. Fatal errors appear only in Event Viewer (Eventvwr.exe).

              +

              For example,

              +

              sdbinst.exe -q

              -u filepath

              Performs an uninstallation of the specified database.

              +

              For example,

              +

              sdbinst.exe -u C:\example.sdb

              -g GUID

              Specifies the customized database to uninstall by a globally unique identifier (GUID).

              +

              For example,

              +

              sdbinst.exe -g 6586cd8f-edc9-4ea8-ad94-afabea7f62e3

              -n "name"

              Specifies the customized database to uninstall by file name.

              +

              For example,

              +

              sdbinst.exe -n "My_Database"

              + +## Related topics +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/planning/using-the-sua-tool.md b/windows/deployment/planning/using-the-sua-tool.md index 008d9e50a5..e1293703ac 100644 --- a/windows/deployment/planning/using-the-sua-tool.md +++ b/windows/deployment/planning/using-the-sua-tool.md @@ -1,92 +1,93 @@ ---- -title: Using the SUA Tool (Windows 10) -description: By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature. -ms.assetid: ebe52061-3816-47f7-a865-07bc5f405f03 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Using the SUA Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature. - -The SUA Wizard also addresses UAC-related issues. In contrast to the SUA tool, the SUA Wizard guides you through the process step by step, without the in-depth analysis of the SUA tool. For information about the SUA Wizard, see [Using the SUA Wizard](using-the-sua-wizard.md). - -In the SUA tool, you can turn virtualization on and off. When you turn virtualization off, the tested application may function more like the way it does in earlier versions of Windows®. - -In the SUA tool, you can choose to run the application as **Administrator** or as **Standard User**. Depending on your selection, you may locate different types of UAC-related issues. - -## Testing an Application by Using the SUA Tool - - -Before you can use the SUA tool, you must install Application Verifier. You must also install the Microsoft® .NET Framework 3.5 or later. - -The following flowchart shows the process of using the SUA tool. - -![act sua flowchart](images/dep-win8-l-act-suaflowchart.jpg) - -**To collect UAC-related issues by using the SUA tool** - -1. Close any open instance of the SUA tool or SUA Wizard on your computer. - - If there is an existing SUA instance on the computer, the SUA tool opens in log viewer mode instead of normal mode. In log viewer mode, you cannot start applications, which prevents you from collecting UAC issues. - -2. Run the Standard User Analyzer. - -3. In the **Target Application** box, browse to the executable file for the application that you want to analyze, and then double-click to select it. - -4. Clear the **Elevate** check box, and then click **Launch**. - - If a **Permission denied** dialog box appears, click **OK**. The application starts, despite the warning. - -5. Exercise the aspects of the application for which you want to gather information about UAC issues. - -6. Exit the application. - -7. Review the information from the various tabs in the SUA tool. For information about each tab, see [Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md). - -**To review and apply the recommended mitigations** - -1. In the SUA tool, on the **Mitigation** menu, click **Apply Mitigations**. - -2. Review the recommended compatibility fixes. - -3. Click **Apply**. - - The SUA tool generates a custom compatibility-fix database and automatically applies it to the local computer, so that you can test the fixes to see whether they worked. - -## Related topics -[Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md) - -[Showing Messages Generated by the SUA Tool](showing-messages-generated-by-the-sua-tool.md) - -[Applying Filters to Data in the SUA Tool](applying-filters-to-data-in-the-sua-tool.md) - -[Fixing Applications by Using the SUA Tool](fixing-applications-by-using-the-sua-tool.md) - -  - -  - - - - - +--- +title: Using the SUA Tool (Windows 10) +description: The Standard User Analyzer (SUA) tool can test applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature. +ms.assetid: ebe52061-3816-47f7-a865-07bc5f405f03 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Using the SUA Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature. + +The SUA Wizard also addresses UAC-related issues. In contrast to the SUA tool, the SUA Wizard guides you through the process step by step, without the in-depth analysis of the SUA tool. For information about the SUA Wizard, see [Using the SUA Wizard](using-the-sua-wizard.md). + +In the SUA tool, you can turn virtualization on and off. When you turn virtualization off, the tested application may function more like the way it does in earlier versions of Windows®. + +In the SUA tool, you can choose to run the application as **Administrator** or as **Standard User**. Depending on your selection, you may locate different types of UAC-related issues. + +## Testing an Application by Using the SUA Tool + + +Before you can use the SUA tool, you must install Application Verifier. You must also install the Microsoft® .NET Framework 3.5 or later. + +The following flowchart shows the process of using the SUA tool. + +![act sua flowchart](images/dep-win8-l-act-suaflowchart.jpg) + +**To collect UAC-related issues by using the SUA tool** + +1. Close any open instance of the SUA tool or SUA Wizard on your computer. + + If there is an existing SUA instance on the computer, the SUA tool opens in log viewer mode instead of normal mode. In log viewer mode, you cannot start applications, which prevents you from collecting UAC issues. + +2. Run the Standard User Analyzer. + +3. In the **Target Application** box, browse to the executable file for the application that you want to analyze, and then double-click to select it. + +4. Clear the **Elevate** check box, and then click **Launch**. + + If a **Permission denied** dialog box appears, click **OK**. The application starts, despite the warning. + +5. Exercise the aspects of the application for which you want to gather information about UAC issues. + +6. Exit the application. + +7. Review the information from the various tabs in the SUA tool. For information about each tab, see [Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md). + +**To review and apply the recommended mitigations** + +1. In the SUA tool, on the **Mitigation** menu, click **Apply Mitigations**. + +2. Review the recommended compatibility fixes. + +3. Click **Apply**. + + The SUA tool generates a custom compatibility-fix database and automatically applies it to the local computer, so that you can test the fixes to see whether they worked. + +## Related topics +[Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md) + +[Showing Messages Generated by the SUA Tool](showing-messages-generated-by-the-sua-tool.md) + +[Applying Filters to Data in the SUA Tool](applying-filters-to-data-in-the-sua-tool.md) + +[Fixing Applications by Using the SUA Tool](fixing-applications-by-using-the-sua-tool.md) + +  + +  + + + + + diff --git a/windows/deployment/planning/using-the-sua-wizard.md b/windows/deployment/planning/using-the-sua-wizard.md index 4070f56802..786d9d2fcf 100644 --- a/windows/deployment/planning/using-the-sua-wizard.md +++ b/windows/deployment/planning/using-the-sua-wizard.md @@ -1,90 +1,91 @@ ---- -title: Using the SUA Wizard (Windows 10) -description: The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions. -ms.assetid: 29d07074-3de7-4ace-9a54-678af7255d6c -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Using the SUA Wizard - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions. - -For information about the SUA tool, see [Using the SUA Tool](using-the-sua-tool.md). - -## Testing an Application by Using the SUA Wizard - - -You must install Application Verifier before you can use the SUA Wizard. If Application Verifier is not installed on the computer that is running the SUA Wizard, the SUA Wizard notifies you. You must also install the Microsoft® .NET Framework 3.5 or later before you can use the SUA Wizard. - -The following flowchart shows the process of using the SUA Wizard. - -![act sua wizard flowchart](images/dep-win8-l-act-suawizardflowchart.jpg) - -**To test an application by using the SUA Wizard** - -1. On the computer where the SUA Wizard is installed, log on by using a non-administrator account. - -2. Run the Standard User Analyzer Wizard. - -3. Click **Browse for Application**, browse to the folder that contains the application that you want to test, and then double-click the executable file for the application. - -4. Click **Launch**. - - If you are prompted, elevate your permissions. The SUA Wizard may require elevation of permissions to correctly diagnose the application. - - If a **Permission denied** dialog box appears, click **OK**. The application starts, despite the warning. - -5. In the application, exercise the functionality that you want to test. - -6. After you finish testing, exit the application. - - The SUA Wizard displays a message that asks whether the application ran without any issues. - -7. Click **No**. - - The SUA Wizard shows a list of potential remedies that you might use to fix the application. - -8. Select the fixes that you want to apply, and then click **Launch**. - - The application appears again, with the fixes applied. - -9. Test the application again, and after you finish testing, exit the application. - - The SUA Wizard displays a message that asks whether the application ran without any issues. - -10. If the application ran correctly, click **Yes**. - - The SUA Wizard closes the issue as resolved on the local computer. - - If the remedies do not fix the issue with the application, click **No** again, and the wizard may offer additional remedies. If the additional remedies do not fix the issue, the wizard informs you that there are no more remedies available. For information about how to run the SUA tool for additional investigation, see [Using the SUA Tool](using-the-sua-tool.md). - -## Related topics -[SUA User's Guide](sua-users-guide.md) - -  - -  - - - - - +--- +title: Using the SUA Wizard (Windows 10) +description: The Standard User Analyzer (SUA) Wizard, although it does not offer deep analysis, works much like the SUA tool to test for User Account Control (UAC) issues. +ms.assetid: 29d07074-3de7-4ace-9a54-678af7255d6c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Using the SUA Wizard + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions. + +For information about the SUA tool, see [Using the SUA Tool](using-the-sua-tool.md). + +## Testing an Application by Using the SUA Wizard + + +You must install Application Verifier before you can use the SUA Wizard. If Application Verifier is not installed on the computer that is running the SUA Wizard, the SUA Wizard notifies you. You must also install the Microsoft® .NET Framework 3.5 or later before you can use the SUA Wizard. + +The following flowchart shows the process of using the SUA Wizard. + +![act sua wizard flowchart](images/dep-win8-l-act-suawizardflowchart.jpg) + +**To test an application by using the SUA Wizard** + +1. On the computer where the SUA Wizard is installed, log on by using a non-administrator account. + +2. Run the Standard User Analyzer Wizard. + +3. Click **Browse for Application**, browse to the folder that contains the application that you want to test, and then double-click the executable file for the application. + +4. Click **Launch**. + + If you are prompted, elevate your permissions. The SUA Wizard may require elevation of permissions to correctly diagnose the application. + + If a **Permission denied** dialog box appears, click **OK**. The application starts, despite the warning. + +5. In the application, exercise the functionality that you want to test. + +6. After you finish testing, exit the application. + + The SUA Wizard displays a message that asks whether the application ran without any issues. + +7. Click **No**. + + The SUA Wizard shows a list of potential remedies that you might use to fix the application. + +8. Select the fixes that you want to apply, and then click **Launch**. + + The application appears again, with the fixes applied. + +9. Test the application again, and after you finish testing, exit the application. + + The SUA Wizard displays a message that asks whether the application ran without any issues. + +10. If the application ran correctly, click **Yes**. + + The SUA Wizard closes the issue as resolved on the local computer. + + If the remedies do not fix the issue with the application, click **No** again, and the wizard may offer additional remedies. If the additional remedies do not fix the issue, the wizard informs you that there are no more remedies available. For information about how to run the SUA tool for additional investigation, see [Using the SUA Tool](using-the-sua-tool.md). + +## Related topics +[SUA User's Guide](sua-users-guide.md) + +  + +  + + + + + diff --git a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md index f5419526ab..67a11cd90f 100644 --- a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md +++ b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md @@ -1,59 +1,49 @@ ---- -title: Viewing the Events Screen in Compatibility Administrator (Windows 10) -description: The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities. -ms.assetid: f2b2ada4-1b7b-4558-989d-5b52b40454b3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Viewing the Events Screen in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The **Events** screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities. - -**Important**   -The **Events** screen only records your activities when the screen is open. If you perform an action before opening the **Events** screen, the action will not appear in the list. - - - -**To open the Events screen** - -- On the **View** menu, click **Events**. - -## Handling Multiple Copies of Compatibility Fixes - - -Compatibility Administrator enables you to copy your compatibility fixes from one database to another, which can become confusing after adding multiple fixes, compatibility modes, and databases. For example, you can copy a fix called MyFix from Database 1 to Database 2. However, if there is already a fix called MyFix in Database 2, Compatibility Administrator renames the fix as MyFix (1) to avoid duplicate names. - -If you open the **Events** screen and then perform the copy operation, you can see a description of the action, along with the time stamp, which enables you to view your fix information without confusion. - -## Related topics -[Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md) - -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - - +--- +title: Viewing the Events Screen in Compatibility Administrator (Windows 10) +description: You can use the Events screen to record and view activities in the Compatibility Administrator tool. +ms.assetid: f2b2ada4-1b7b-4558-989d-5b52b40454b3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Viewing the Events Screen in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The **Events** screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities. + +>[!IMPORTANT] +>The **Events** screen only records your activities when the screen is open. If you perform an action before opening the **Events** screen, the action will not appear in the list. + + + +**To open the Events screen** + +- On the **View** menu, click **Events**. + +## Handling Multiple Copies of Compatibility Fixes + + +Compatibility Administrator enables you to copy your compatibility fixes from one database to another, which can become confusing after adding multiple fixes, compatibility modes, and databases. For example, you can copy a fix called MyFix from Database 1 to Database 2. However, if there is already a fix called MyFix in Database 2, Compatibility Administrator renames the fix as MyFix (1) to avoid duplicate names. + +If you open the **Events** screen and then perform the copy operation, you can see a description of the action, along with the time stamp, which enables you to view your fix information without confusion. + +## Related topics +[Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md)
              +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/planning/windows-10-1703-removed-features.md b/windows/deployment/planning/windows-10-1703-removed-features.md deleted file mode 100644 index 0d09296845..0000000000 --- a/windows/deployment/planning/windows-10-1703-removed-features.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Windows 10, version 1703 removed features -description: Learn about features that were removed in Windows 10, version 1703 -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -author: lizap -ms.date: 10/09/2017 -ms.topic: article ---- -# Features that are removed or deprecated in Windows 10, version 1703 - -> Applies to: Windows 10, version 1703 - -The following features and functionalities in the Windows 10 Creators Update edition (Windows 10, version 1703) have either been removed from the product in the current release (*Removed*) or are not in active development and are planned for potential removal in subsequent releases. - -This list is intended for IT professionals who are updating operating systems in a commercial environment. The plan and list are subject to change and may not include every deprecated feature or functionality. For more details about a listed feature or functionality and its replacement, see the documentation for that feature. - -| Feature | Removed | Not actively developed | -|------------|---------|------------| -|Apndatabase.xml is being replaced by the COSA database. Therefore, some constructs will no longer function. This includes Hardware ID, incoming SMS messaging rules in mobile apps, a list of privileged apps in mobile apps, autoconnect order, APN parser, and CDMAProvider ID. | | X | -|Apps Corner| | X | -|By default, Flash autorun in Edge is turned off. Use the Click-to-Run (C2R) option instead. (This setting can be changed by the user.)| X | | -|Interactive Service Detection Service| X | | -|Microsoft Paint for languages that are not on the [full localization list](https://www.microsoft.com/windows/windows-10-specifications#Windows-10-localization)| | | -|NPN support in TLS (superseded by ALPN)| X | | -|Reading List | | X | -|Tile Data Layer | | X | -|TLS DHE_DSS ciphers DisabledByDefault| | X | -|Windows Information Protection "AllowUserDecryption" policy | X | | -|WSUS for Windows Mobile, updates are being transitioned to the new Unified Update Platform (UUP) | X | | -|TCPChimney | | X | -|IPsec task offload| | X | diff --git a/windows/deployment/planning/windows-10-1709-removed-features.md b/windows/deployment/planning/windows-10-1709-removed-features.md deleted file mode 100644 index 6126b5272f..0000000000 --- a/windows/deployment/planning/windows-10-1709-removed-features.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Windows 10, version 1709 removed features -description: Learn about features that will be removed in Windows 10, version 1709 -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -manager: laurawi -ms.topic: article ---- -# Features that are removed or deprecated in Windows 10, version 1709 - -> Applies to: Windows 10, version 1709 - -The following features and functionalities in the Windows 10, version 1709 are either removed from the product in the current release (*Removed*) or are not in active development and might be removed in future releases. - -This list is intended to help customers consider these removals and deprecations for their own planning. The list is subject to change and may not include every deprecated feature or functionality. - -For more information about a listed feature or functionality and its replacement, see the documentation for that feature. You can also follow the provided links in this table to see additional resources.  - -| Feature | Removed | Not actively developed | -|----------|---------|------------| -|**3D Builder app**
              No longer installed by default. Consider using Print 3D and Paint 3D in its place. However, 3D Builder is still available for download from the Windows Store. | X | | -|**Apndatabase.xml**
              For more information about the replacement database, see the following Hardware Dev Center articles:
              [MO Process to update COSA](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission)
              [COSA FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) | X | | -|**Enhanced Mitigation Experience Toolkit (EMET)**
              Use will be blocked. Consider using the [Exploit Protection](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/#fMH3bUDAb5HEstZ5.97) feature of Windows Defender Exploit Guard as a replacement.| X | | -|**IIS 6 Management Compatibility**
              We recommend that users use alternative scripting tools and a newer management console. | | X | -|**IIS Digest Authentication**
              We recommend that users use alternative authentication methods.| | X | -|**Microsoft Paint**
              Will be available through the Windows Store. Functionality integrated into Paint 3D.| | X | -|**Outlook Express**
              Removing this non-functional legacy code.| X | | -|**Reader app**
              Functionality to be integrated into Microsoft Edge.| X | | -|**Reading List**
              Functionality to be integrated into Microsoft Edge.| X | | -|**Resilient File System (ReFS)**
              Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability.
              (added: August 17, 2017)| | X | -|**RSA/AES Encryption for IIS**
              We recommend that users use CNG encryption provider.| | X | -|**Screen saver functionality in Themes**
              Disabled in Themes (classified as **Removed** in this table). Screen saver functionality in Group Policies, Control Panel, and Sysprep continues to be functional. Lockscreen features and policies are preferred. | X | X | -|**Sync your settings**
              Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for Enterprise State Roaming and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work.
              (updated: August 17, 2017) | | X | -|**Syskey.exe**
              Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see the following Knowledge Base article: [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window)| X | | -|**System Image Backup (SIB) Solution**
              We recommend that users use full-disk backup solutions from other vendors.| | X | -|**TCP Offload Engine**
              Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| X || -|**Tile Data Layer**
              To be replaced by the Tile Store.| X || -|**TLS RC4 Ciphers**
              To be disabled by default. For more information, see the following Windows IT Center topic: [TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server)|| X| -|**Trusted Platform Module (TPM) Owner Password Management**
              This legacy code to be removed.|| X | -|**Trusted Platform Module (TPM): TPM.msc and TPM Remote Management**
              To be replaced by a new user interface in a future release.| | X | -|**Trusted Platform Module (TPM) Remote Management**
              This legacy code to be removed in a future release.|| X | -|**Windows Hello for Business deployment that uses System Center Configuration Manager**
              Windows Server 2016 Active Directory Federation Services – Registration Authority (ADFS RA) deployment is simpler and provides a better user experience and a more deterministic certificate enrollment experience.|| X | -|**Windows PowerShell 2.0**
              Applications and components should be migrated to PowerShell 5.0+.| | X | diff --git a/windows/deployment/planning/windows-10-1803-removed-features.md b/windows/deployment/planning/windows-10-1803-removed-features.md deleted file mode 100644 index 651e7aa5a8..0000000000 --- a/windows/deployment/planning/windows-10-1803-removed-features.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Windows 10, version 1803 - Features that have been removed -description: Learn about features that will be removed or deprecated in Windows 10, version 1803, or a future release -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.author: greglin -ms.date: 08/16/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Features removed or planned for replacement starting with Windows 10, version 1803 - -> Applies to: Windows 10, version 1803 - -Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Here are the details about the features and functionalities that we removed in Windows 10, version 1803 (also called Windows 10 April 2018 Update). - -> [!TIP] -> - You can get early access to Windows 10 builds by joining the [Windows Insider program](https://insider.windows.com) - this is a great way to test feature changes. -> - Have questions about other releases? Check out the information for [Windows 10, version 1703](windows-10-creators-update-deprecation.md), and [Windows 10, version 1709](windows-10-fall-creators-deprecation.md). - -**The list is subject to change and might not include every affected feature or functionality.** - -## Features we removed in this release - -We've removed the following features and functionalities from the installed product image in Windows 10, version 1803. Applications or code that depend on these features won't function in this release unless you use an alternate method. - -|Feature |Instead you can use...| -|-----------|-------------------- -|Groove Music Pass|[We ended the Groove streaming music service and music track sales through the Microsoft Store in 2017](https://support.microsoft.com/help/4046109/groove-music-and-spotify-faq). The Groove app is being updated to reflect this change. You can still use Groove Music to play the music on your PC or to stream music from OneDrive. You can use Spotify or other music services to stream music on Windows 10, or to buy music to own.| -|People - Suggestions will no longer include unsaved contacts for non-Microsoft accounts|Manually save the contact details for people you send mail to or get mail from.| -|Language control in the Control Panel| Use the Settings app to change your language settings.| -|HomeGroup|We are removing [HomeGroup](https://support.microsoft.com/help/17145) but not your ability to share printers, files, and folders.

              When you update to Windows 10, version 1803, you won't see HomeGroup in File Explorer, the Control Panel, or Troubleshoot (**Settings > Update & Security > Troubleshoot**). Any printers, files, and folders that you shared using HomeGroup **will continue to be shared**.

              Instead of using HomeGroup, you can now share printers, files and folders by using features that are built into Windows 10:
              - [Share your network printer](https://www.bing.com/search?q=share+printer+windows+10)
              - [Share files in File Explorer](https://support.microsoft.com/help/4027674/windows-10-share-files-in-file-explorer) | -|**Connect to suggested open hotspots** option in Wi-Fi settings |We previously [disabled the **Connect to suggested open hotspots** option](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) and are now removing it from the Wi-Fi settings page. You can manually connect to free wireless hotspots with **Network & Internet** settings, from the taskbar or Control Panel, or by using Wi-Fi Settings (for mobile devices).| -|XPS Viewer|We're changing the way you get XPS Viewer. In Windows 10, version 1709 and earlier versions, the app is included in the installation image. If you have XPS Viewer and you update to Windows 10, version 1803, there's no action required. You'll still have XPS Viewer.

              However, if you install Windows 10, version 1803, on a new device (or as a clean installation), you may need to [install XPS Viewer from **Apps and Features** in the Settings app](https://docs.microsoft.com/windows/application-management/add-apps-and-features) or through [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you had XPS Viewer in Windows 10, version 1709, but manually removed it before updating, you'll need to manually reinstall it.| - - -## Features we’re no longer developing - -We are no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources. - -If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -|Feature |Instead you can use...| -|-----------|---------------------| -|[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| -|[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| -|Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.| -|Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.| -|Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.| -|IPv4/6 Transition Technologies (6to4, ISATAP, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| -|[Layered Service Providers](https://msdn.microsoft.com/library/windows/desktop/bb513664)|Layered Service Providers have been deprecated since Windows 8 and Windows Server 2012. Use the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510) instead. When you upgrade from an older version of Windows, any layered service providers you're using aren't migrated; you'll need to re-install them after upgrading.| -|Business Scanning, also called Distributed Scan Management (DSM) **(Added 05/03/2018)**|The [Scan Management functionality](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759124(v=ws.11)) was introduced in Windows 7 and enabled secure scanning and the management of scanners in an enterprise. We're no longer investing in this feature, and there are no devices available that support it.| diff --git a/windows/deployment/planning/windows-10-1809-removed-features.md b/windows/deployment/planning/windows-10-1809-removed-features.md deleted file mode 100644 index a538532b77..0000000000 --- a/windows/deployment/planning/windows-10-1809-removed-features.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Windows 10, version 1809 - Features that have been removed -description: Learn about features that will be removed or deprecated in Windows 10, version 1809, or a future release -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.author: greglin -ms.date: 11/16/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Features removed or planned for replacement starting with Windows 10, version 1809 - -> Applies to: Windows 10, version 1809 - -Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Here are the details about the features and functionalities that we removed in Windows 10, version 1809. - -> [!TIP] -> - You can get early access to Windows 10 builds by joining the [Windows Insider program](https://insider.windows.com) - this is a great way to test feature changes. -> - Have questions about other releases? Check out the information for [Windows 10, version 1803](windows-10-1803-removed-features.md), [Windows 10, version 1709](windows-10-fall-creators-deprecation.md), and [Windows 10, version 1703](windows-10-creators-update-deprecation.md). - -**The list is subject to change and might not include every affected feature or functionality.** - -## Features we removed in this release - -We're removing the following features and functionalities from the installed product image in Windows 10, version 1809. Applications or code that depend on these features won't function in this release unless you use an alternate method. - -|Feature |Instead you can use...| -|-----------|-------------------- -|Business Scanning, also called Distributed Scan Management (DSM)|We're removing this secure scanning and scanner management capability - there are no devices that support this feature.| -|[FontSmoothing setting](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-visualeffects-fontsmoothing) in unattend.xml|The FontSmoothing setting let you specify the font antialiasing strategy to use across the system. We've changed Windows 10 to use [ClearType](https://docs.microsoft.com/typography/cleartype/) by default, so we're removing this setting as it is no longer necessary. If you include this setting in the unattend.xml file, it'll be ignored.| -|Hologram app|We've replaced the Hologram app with the [Mixed Reality Viewer](https://support.microsoft.com/help/4041156/windows-10-mixed-reality-help). If you would like to create 3D word art, you can still do that in Paint 3D and view your art in VR or Hololens with the Mixed Reality Viewer.| -|limpet.exe|We're releasing the limpet.exe tool, used to access TPM for Azure connectivity, as open source.| -|Phone Companion|When you update to Windows 10, version 1809, the Phone Companion app will be removed from your PC. Use the **Phone** page in the Settings app to sync your mobile phone with your PC. It includes all the Phone Companion features.| -|Future updates through [Windows Embedded Developer Update](https://docs.microsoft.com/previous-versions/windows/embedded/ff770079\(v=winembedded.60\)) for Windows Embedded Standard 7-SP1 (WES7-SP1) and Windows Embedded Standard 8 (WES8)|We’re no longer publishing new updates to the WEDU server. Instead, you may secure any new updates from the [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/Home.aspx). [Learn how](https://techcommunity.microsoft.com/t5/Windows-Embedded/Change-to-the-Windows-Embedded-Developer-Update/ba-p/285704) to get updates from the catalog.| - -## Features we’re no longer developing - -We're no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources. - -If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -|Feature |Instead you can use...| -|-----------|---------------------| -|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because third party partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| -|OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| -|Snipping Tool|The Snipping Tool is an application included in Windows 10 that is used to capture screenshots, either the full screen or a smaller, custom "snip" of the screen. In Windows 10, version 1809, we're [introducing a new universal app, Snip & Sketch](https://blogs.windows.com/windowsexperience/2018/05/03/announcing-windows-10-insider-preview-build-17661/#8xbvP8vMO0lF20AM.97), that provides the same screen snipping abilities, as well as additional features. You can launch Snip & Sketch directly and start a snip from there, or just press WIN + Shift + S. Snip & Sketch can also be launched from the “Screen snip” button in the Action Center. We're no longer developing the Snipping Tool as a separate app but are instead consolidating its functionality into Snip & Sketch.| - - diff --git a/windows/deployment/planning/windows-10-1903-removed-features.md b/windows/deployment/planning/windows-10-1903-removed-features.md deleted file mode 100644 index 2c73c4bc18..0000000000 --- a/windows/deployment/planning/windows-10-1903-removed-features.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Windows 10, version 1903 - Features that have been removed -description: Learn about features that will be removed or deprecated in Windows 10, version 1903, or a future release -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -manager: laurawi -ms.author: greglin -ms.topic: article ---- -# Features removed or planned for replacement starting with Windows 10, version 1903 - -> Applies to: Windows 10, version 1903 - -Each version of Windows 10 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that we removed in Windows 10, version 1903. **The list below is subject to change and might not include every affected feature or functionality.** - -**Note**: Join the [Windows Insider program](https://insider.windows.com) to get early access to new Windows 10 builds and test these changes yourself. - -## Features we removed or will remove soon - -The following features and functionalities are removed from the installed product image for Windows 10, version 1903, or are planned for removal in an upcoming release. Applications or code that depend on these features won't function in this release unless you use another method. - - -| Feature | Details | -|---------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| XDDM-based remote display driver | Starting with this release the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information on implementing remote indirect display driver ISVs can reach out to [rdsdev@microsoft.com](mailto:rdsdev@microsoft.com). | -| Desktop messaging app doesn't offer messages sync | The messaging app on Desktop has a sync feature that can be used to sync SMS text messages received from Windows Mobile and keep a copy of them on the Desktop. The sync feature has been removed from all devices. Due to this change, you will only be able to access messages from the device that received the message. | - -## Features we’re no longer developing - -We're no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources. - -If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -|Feature |Details| -|-----------|---------------------| -| Taskbar settings roaming| Roaming of taskbar settings is no longer being developed and we plan to disable this capability in a future release| -|Wi-Fi WEP and TKIP|In this release a warning message will appear when connecting to Wi-Fi networks secured with WEP or TKIP, which are not as secure as those using WPA2 or WPA3. In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | -|Windows To Go|Windows To Go is no longer being developed.

              The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.| -|Print 3D app|Going forward, 3D Builder is the recommended 3D printing app. To 3D print objects on new Windows devices, customers must first install 3D Builder from the Store.| - diff --git a/windows/deployment/planning/windows-10-compatibility.md b/windows/deployment/planning/windows-10-compatibility.md index 464e7e03de..965ad4dad7 100644 --- a/windows/deployment/planning/windows-10-compatibility.md +++ b/windows/deployment/planning/windows-10-compatibility.md @@ -1,60 +1,61 @@ ---- -title: Windows 10 compatibility (Windows 10) -description: Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. -ms.assetid: 829BE5B5-330A-4702-807A-8908B4FC94E8 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, upgrade, update, appcompat -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 compatibility - - -**Applies to** - -- Windows 10 - -Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. - -For full system requirements, see [Windows 10 specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. - -Existing desktop (Win32) application compatibility is also expected to be strong, with most existing applications working without any changes. Some applications that interface with Windows at a low level, those that use undocumented APIs, or those that do not follow recommended coding practices could experience issues. - -Existing Windows Store (WinRT) apps created for Windows 8 and Windows 8.1 should also continue to work, because compatibility can be validated against all the apps that have been submitted to the Windows Store. - -For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](https://go.microsoft.com/fwlink/p/?LinkId=734031) - -## Recommended application testing process - - -Historically, organizations have performed extensive, and often exhaustive, testing of the applications they use before deployment of a new Windows version, service pack, or any other significant update. With Windows 10, organizations are encouraged to leverage more optimized testing processes, which reflects the higher levels of compatibility that are expected. At a high level: - -- Identify mission-critical applications and websites, those that are absolutely essential to the organization’s operations. Focus testing efforts on this subset of applications, early in the Windows development cycle (for example, with Windows Insider Program builds) to identify potential issues. Report any issues you encounter with the Windows Feedback tool, so that these issues can be addressed prior to the next Windows release. - -- For less critical applications, leverage an “internal flighting” or pilot-based approach, by deploying new Windows upgrades to groups of machines, growing gradually in size and potential impact, to verify compatibility with hardware and software. Reactively address issues before you expand the pilot to more machines. - -## Related topics - - -[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) - -[Windows 10 deployment considerations](windows-10-deployment-considerations.md) - -[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) - -  - -  - - - - - +--- +title: Windows 10 compatibility (Windows 10) +description: Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. +ms.assetid: 829BE5B5-330A-4702-807A-8908B4FC94E8 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, upgrade, update, appcompat +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 compatibility + + +**Applies to** + +- Windows 10 + +Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. + +For full system requirements, see [Windows 10 specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. + +Existing desktop (Win32) application compatibility is also expected to be strong, with most existing applications working without any changes. Some applications that interface with Windows at a low level, those that use undocumented APIs, or those that do not follow recommended coding practices could experience issues. + +Existing Windows Store (WinRT) apps created for Windows 8 and Windows 8.1 should also continue to work, because compatibility can be validated against all the apps that have been submitted to the Windows Store. + +For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](https://go.microsoft.com/fwlink/p/?LinkId=734031) + +## Recommended application testing process + + +Historically, organizations have performed extensive, and often exhaustive, testing of the applications they use before deployment of a new Windows version, service pack, or any other significant update. With Windows 10, organizations are encouraged to leverage more optimized testing processes, which reflects the higher levels of compatibility that are expected. At a high level: + +- Identify mission-critical applications and websites, those that are absolutely essential to the organization’s operations. Focus testing efforts on this subset of applications, early in the Windows development cycle (for example, with Windows Insider Program builds) to identify potential issues. Report any issues you encounter with the Windows Feedback tool, so that these issues can be addressed prior to the next Windows release. + +- For less critical applications, leverage an “internal flighting” or pilot-based approach, by deploying new Windows upgrades to groups of machines, growing gradually in size and potential impact, to verify compatibility with hardware and software. Reactively address issues before you expand the pilot to more machines. + +## Related topics + + +[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) + +[Windows 10 deployment considerations](windows-10-deployment-considerations.md) + +[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) + +  + +  + + + + + diff --git a/windows/deployment/planning/windows-10-deployment-considerations.md b/windows/deployment/planning/windows-10-deployment-considerations.md index a1156b67f9..acf11aa0ee 100644 --- a/windows/deployment/planning/windows-10-deployment-considerations.md +++ b/windows/deployment/planning/windows-10-deployment-considerations.md @@ -1,144 +1,132 @@ ---- -title: Windows 10 deployment considerations (Windows 10) -description: There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. -ms.assetid: A8DD6B37-1E11-4CD6-B588-92C2404219FE -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, upgrade, update, in-place -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: plan -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 deployment considerations - - -**Applies to** - -- Windows 10 - -There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. - -For many years, organizations have deployed new versions of Windows using a “wipe and load” deployment process. At a high level, this process captures existing data and settings from the existing device, deploys a new custom-built Windows image to a PC, injects hardware drivers, reinstalls applications, and finally restores the data and settings. With Windows 10, this process is still fully supported, and for some deployment scenarios is still necessary. - -Windows 10 also introduces two additional scenarios that organizations should consider: - -- **In-place upgrade**, which provides a simple, automated process that leverages the Windows setup process to automatically upgrade from an earlier version of Windows. This process automatically migrates existing data, settings, drivers, and applications. - -- **Dynamic provisioning**, which enables organizations to configure new Windows 10 devices for organization use without having to deploy a new custom organization image to the device. - - Both of these scenarios eliminate the image creation process altogether, which can greatly simplify the deployment process. - - So how do you choose? At a high level: - - ---- - - - - - - - - - - - - - - - - - - - - -
              Consider ...For these scenarios
              In-place upgrade
                -
              • When you want to keep all (or at least most) existing applications

              • -
              • When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations)

              • -
              • To migrate from Windows 10 to a later Windows 10 release

              • -
              Traditional wipe-and-load
                -
              • When you upgrade significant numbers of applications along with the new Windows OS

              • -
              • When you make significant device or operating system configuration changes

              • -
              • When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs

              • -
              • When you migrate from Windows Vista or other previous operating system versions

              • -
              Dynamic provisioning
                -
              • For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required

              • -
              • When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps

              • -
              - -  - -## Migration from previous Windows versions - - -For existing PCs running Windows 7 or Windows 8.1, in-place upgrade is the recommended method for Windows 10 deployment and should be used whenever possible. Although wipe-and-load (OS refresh) deployments are still fully supported (and necessary in some scenarios, as mentioned previously), in-place upgrade is simpler and faster, and enables a faster Windows 10 deployment overall. - -Note that the original Windows 8 release is only supported until January 2016. Organizations that do not think they can complete a full Windows 10 migration by that date should deploy Windows 8.1 now and consider Windows 10 after Windows 8 has been removed from the environment. - -For existing Windows PCs running Windows Vista, you can perform wipe-and-load (OS refresh) deployments when you use compatible hardware. - -Note that to take advantage of the limited-time free upgrade offer for PCs running Windows 7, Windows 8, or Windows 8.1, you must leverage an in-place upgrade, either from Windows Update or by using the upgrade media available from the [Windows 10 software download page](https://go.microsoft.com/fwlink/p/?LinkId=625073) to acquire a new Windows 10 license from the Windows Store. For more information, refer to the [Windows 10 FAQ](https://go.microsoft.com/fwlink/p/?LinkId=625074). - -For organizations with Software Assurance for Windows, both in-place upgrade or wipe-and-load can be leveraged (with in-place upgrade being the preferred method, as previously discussed). - -For organizations that do not take advantage of the free upgrade offer and are not enrolled in Software Assurance for Windows, Windows 10 upgrade licenses are available for purchase through existing Volume License (VL) agreements. - -## Setup of new computers - - -For new computers acquired with Windows 10 preinstalled, you can leverage dynamic provisioning scenarios to transform the device from its initial state into a fully-configured organization PC. There are two primary dynamic provisioning scenarios you can use: - -- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](https://go.microsoft.com/fwlink/p/?LinkId=625075). - -- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=625076). - -In either of these scenarios, you can make a variety of configuration changes to the PC: - -- Transform the edition (SKU) of Windows 10 that is in use. - -- Apply configuration and settings to the device (for example, security settings, device restrictions, policies, Wi-Fi and VPN profiles, certificates, and so on). - -- Install apps, language packs, and updates. - -- Enroll the device in a management solution (applicable for IT admin-driven scenarios, configuring the device just enough to allow the management tool to take over configuration and ongoing management). - -## Stay up to date - - -For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will periodically be deployed, approximately two to three times per year. You can deploy these upgrades by using a variety of methods: - -- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet. - -- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they are approved (deploying like an update). Note that this will require updates to WSUS, which are only available for Windows Server 2012 and Windows Server 2012 R2, not previous versions. - -- System Center Configuration Manager task sequences (with Configuration Manager 2012, 2012 R2, and later versions). - -- System Center Configuration Manager vNext software update capabilities (deploying like an update). - -Note that these upgrades (which are installed differently than monthly updates) will leverage an in-place upgrade process. Unlike updates, which are relatively small, these upgrades will include a full operating system image (around 3 GB for 64-bit operating systems), which requires time (1-2 hours) and disk space (approximately 10 GB) to complete. Ensure that the deployment method you use can support the required network bandwidth and/or disk space requirements. - -Over time, this upgrade process will be optimized to reduce the overall time and network bandwidth consumed. - -## Related topics - - -[Windows 10 compatibility](windows-10-compatibility.md) - -[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) - -  - -  - - - - - +--- +title: Windows 10 deployment considerations (Windows 10) +description: There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. +ms.assetid: A8DD6B37-1E11-4CD6-B588-92C2404219FE +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, upgrade, update, in-place +ms.prod: w10 +ms.localizationpriority: medium +ms.mktglfcycl: plan +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 deployment considerations + + +**Applies to** + +- Windows 10 + +There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. + +For many years, organizations have deployed new versions of Windows using a “wipe and load” deployment process. At a high level, this process captures existing data and settings from the existing device, deploys a new custom-built Windows image to a PC, injects hardware drivers, reinstalls applications, and finally restores the data and settings. With Windows 10, this process is still fully supported, and for some deployment scenarios is still necessary. + +Windows 10 also introduces two additional scenarios that organizations should consider: + +- **In-place upgrade**, which provides a simple, automated process that leverages the Windows setup process to automatically upgrade from an earlier version of Windows. This process automatically migrates existing data, settings, drivers, and applications. + +- **Dynamic provisioning**, which enables organizations to configure new Windows 10 devices for organization use without having to deploy a new custom organization image to the device. + + Both of these scenarios eliminate the image creation process altogether, which can greatly simplify the deployment process. + + So how do you choose? At a high level: + + ++++ + + + + + + + + + + + + + + + + + + + + +
              Consider ...For these scenarios
              In-place upgrade
                +
              • When you want to keep all (or at least most) existing applications

              • +
              • When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations)

              • +
              • To migrate from Windows 10 to a later Windows 10 release

              • +
              Traditional wipe-and-load
                +
              • When you upgrade significant numbers of applications along with the new Windows OS

              • +
              • When you make significant device or operating system configuration changes

              • +
              • When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs

              • +
              • When you migrate from Windows Vista or other previous operating system versions

              • +
              Dynamic provisioning
                +
              • For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required

              • +
              • When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps

              • +
              + +  +## Migration from previous Windows versions + +For existing PCs running Windows 7 or Windows 8.1, in-place upgrade is the recommended method for Windows 10 deployment and should be used whenever possible. Although wipe-and-load (OS refresh) deployments are still fully supported (and necessary in some scenarios, as mentioned previously), in-place upgrade is simpler and faster, and enables a faster Windows 10 deployment overall. + +The original Windows 8 release was only supported until January 2016. For devices running Windows 8.0, you can update to Windows 8.1 and then upgrade to Windows 10. + +For PCs running operating systems older than Windows 7, you can perform wipe-and-load (OS refresh) deployments when you use compatible hardware. + +For organizations with Software Assurance for Windows, both in-place upgrade or wipe-and-load can be leveraged (with in-place upgrade being the preferred method, as previously discussed). + +For organizations that did not take advantage of the free upgrade offer and are not enrolled in Software Assurance for Windows, Windows 10 upgrade licenses are available for purchase through existing Volume License (VL) agreements. + +## Setting up new computers + +For new computers acquired with Windows 10 preinstalled, you can leverage dynamic provisioning scenarios to transform the device from its initial state into a fully-configured organization PC. There are two primary dynamic provisioning scenarios you can use: + +- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](https://go.microsoft.com/fwlink/p/?LinkId=625075). + +- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=625076). + +In either of these scenarios, you can make a variety of configuration changes to the PC: + +- Transform the edition (SKU) of Windows 10 that is in use. +- Apply configuration and settings to the device (for example, security settings, device restrictions, policies, Wi-Fi and VPN profiles, certificates, and so on). +- Install apps, language packs, and updates. +- Enroll the device in a management solution (applicable for IT admin-driven scenarios, configuring the device just enough to allow the management tool to take over configuration and ongoing management). + +## Stay up to date + +For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will be deployed two times per year. You can deploy these upgrades by using a variety of methods: + +- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet. +- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they are approved (deploying like an update). +- Configuration Manager task sequences. +- Configuration Manager software update capabilities (deploying like an update). + +These upgrades (which are installed differently than monthly updates) leverage an in-place upgrade process. Unlike updates, which are relatively small, these upgrades will include a full operating system image (around 3 GB for 64-bit operating systems), which requires time (1-2 hours) and disk space (approximately 10 GB) to complete. Ensure that the deployment method you use can support the required network bandwidth and/or disk space requirements. + +The upgrade process is also optimized to reduce the overall time and network bandwidth consumed. + +## Related topics + + +[Windows 10 compatibility](windows-10-compatibility.md)
              +[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) + +  + +  + + + + + diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md new file mode 100644 index 0000000000..fa4f088b49 --- /dev/null +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -0,0 +1,69 @@ +--- +title: Windows 10 features we’re no longer developing +description: Review the list of features that are no longer being developed in Windows 10 +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.topic: article +--- +# Windows 10 features we’re no longer developing + +> Applies to: Windows 10 + +Each version of Windows 10 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that are no longer being developed in Windows 10. For information about features that have been removed, see [Features we removed](windows-10-removed-features.md). + +The features described below are no longer being actively developed, and might be removed in a future update. Some features have been replaced with other features or functionality and some are now available from other sources. + +**The following list is subject to change and might not include every affected feature or functionality.** + +> [!NOTE] +> If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). + +|Feature | Details and mitigation | Announced in version | +| ----------- | --------------------- | ---- | +| Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | +| Companion Device Framework | The [Companion Device Framework](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | +| Dynamic Disks | The [Dynamic Disks](https://docs.microsoft.com/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](https://docs.microsoft.com/windows-server/storage/storage-spaces/overview) in a future release.| 2004 | +| Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 | +| My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 | +| Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user.
               
              The recommended replacement for PSR is [Azure App Service](https://docs.microsoft.com/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web. | 1909 | +| XDDM-based remote display driver | Starting with this release, the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information about implementing a remote indirect display driver, ISVs can reach out to [rdsdev@microsoft.com](mailto:rdsdev@microsoft.com). | 1903 | +| Taskbar settings roaming | Roaming of taskbar settings is no longer being developed and we plan to remove this capability in a future release. | 1903 | +| Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 | +| Windows To Go | Windows To Go is no longer being developed.

              The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.| 1903 | +| Print 3D app | Going forward, 3D Builder is the recommended 3D printing app. To 3D print objects on new Windows devices, customers must first install 3D Builder from the Store.| 1903 | +|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because non-Microsoft partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 | +|OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| 1809 | +|Snipping Tool|The Snipping Tool is an application included in Windows 10 that is used to capture screenshots, either the full screen or a smaller, custom "snip" of the screen. In Windows 10, version 1809, we're [introducing a new universal app, Snip & Sketch](https://blogs.windows.com/windowsexperience/2018/05/03/announcing-windows-10-insider-preview-build-17661/#8xbvP8vMO0lF20AM.97), that provides the same screen snipping abilities, as well as additional features. You can launch Snip & Sketch directly and start a snip from there, or just press WIN + Shift + S. Snip & Sketch can also be launched from the “Screen snip” button in the Action Center. We're no longer developing the Snipping Tool as a separate app but are instead consolidating its functionality into Snip & Sketch.| 1809 | +|[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| 1803 | +|[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| 1803 | +|Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.| 1803 | +|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. For more information, see [Developer guide for creating service metadata](https://docs.microsoft.com/windows-hardware/drivers/mobilebroadband/developer-guide-for-creating-service-metadata) | 1803 | +|Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.| 1803 | +|Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.| 1803 | +|IPv4/6 Transition Technologies (6to4, ISATAP, Teredo, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), Teredo has been disabled since Windows 10, version 1803, and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| 1803 | +|[Layered Service Providers](https://msdn.microsoft.com/library/windows/desktop/bb513664)|Layered Service Providers has not been developed since Windows 8 and Windows Server 2012. Use the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510) instead. When you upgrade from an older version of Windows, any layered service providers you're using aren't migrated; you'll need to re-install them after upgrading.| 1803 | +|Business Scanning| This feature is also called Distributed Scan Management (DSM) **(Added 05/03/2018)**
               
              The [Scan Management functionality](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759124(v=ws.11)) was introduced in Windows 7 and enabled secure scanning and the management of scanners in an enterprise. We're no longer investing in this feature, and there are no devices available that support it.| 1803 | +|IIS 6 Management Compatibility* | We recommend that users use alternative scripting tools and a newer management console. | 1709 | +|IIS Digest Authentication | We recommend that users use alternative authentication methods.| 1709 | +|RSA/AES Encryption for IIS | We recommend that users use CNG encryption provider. | 1709 | +|Screen saver functionality in Themes | Disabled in Themes. Screen saver functionality in Group Policies, Control Panel, and Sysprep continues to be functional. Lock screen features and policies are preferred. | 1709 | +|Sync your settings (updated: August 17, 2017) | Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for Enterprise State Roaming and all other users. The **Sync your settings** options and the Enterprise State Roaming feature will continue to work. | 1709 | +|System Image Backup (SIB) Solution | We recommend that users use full-disk backup solutions from other vendors. | 1709 | +|TLS RC4 Ciphers |To be disabled by default. For more information, see the following Windows IT Center topic: [TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server)| 1709 | +|Trusted Platform Module (TPM) Owner Password Management |This functionality within TPM.msc will be migrated to a new user interface.| 1709 | +|Trusted Platform Module (TPM): TPM.msc and TPM Remote Management | To be replaced by a new user interface in a future release. | 1709 | +|Trusted Platform Module (TPM) Remote Management |This functionality within TPM.msc will be migrated to a new user interface. | 1709 | +|Windows Hello for Business deployment that uses Microsoft Endpoint Configuration Manager |Windows Server 2016 Active Directory Federation Services – Registration Authority (ADFS RA) deployment is simpler and provides a better user experience and a more deterministic certificate enrollment experience. | 1709 | +|Windows PowerShell 2.0 | Applications and components should be migrated to PowerShell 5.0+. | 1709 | +|Apndatabase.xml | Apndatabase.xml is being replaced by the COSA database. Therefore, some constructs will no longer function. This includes Hardware ID, incoming SMS messaging rules in mobile apps, a list of privileged apps in mobile apps, autoconnect order, APN parser, and CDMAProvider ID. | 1703 | +|Tile Data Layer | The [Tile Data Layer](https://docs.microsoft.com/windows/configuration/start-layout-troubleshoot#symptom-start-menu-issues-with-tile-data-layer-corruption) database stopped development in Windows 10, version 1703. | 1703 | +|TLS DHE_DSS ciphers DisabledByDefault| [TLS RC4 Ciphers](https://docs.microsoft.com/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server) will be disabled by default in this release. | 1703 | +|TCPChimney | TCP Chimney Offload is no longer being developed. See [Performance Tuning Network Adapters](https://docs.microsoft.com/windows-server/networking/technologies/network-subsystem/net-sub-performance-tuning-nics). | 1703 | +|IPsec Task Offload| [IPsec Task Offload](https://docs.microsoft.com/windows-hardware/drivers/network/task-offload) versions 1 and 2 are no longer being developed and should not be used. | 1703 | +|wusa.exe /uninstall /kb:####### /quiet|The wusa usage to quietly uninstall an update has been deprecated. The uninstall command with /quiet switch fails with event ID 8 in the Setup event log. Uninstalling updates quietly could be a security risk because malicious software could quietly uninstall an update in the background without user intervention.|1507
              Applies to Windows Server 2016 and Windows Server 2019 as well.| diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md index 2900db198c..546b8de3af 100644 --- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md +++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md @@ -1,134 +1,134 @@ ---- -title: Windows 10 Enterprise FAQ for IT pros (Windows 10) -description: Get answers to common questions around compatibility, installation, and support for Windows 10 Enterprise. -keywords: Windows 10 Enterprise, download, system requirements, drivers, appcompat, manage updates, Windows as a service, servicing channels, deployment tools -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 08/18/2017 -ms.reviewer: -manager: laurawi -ms.author: greglin -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 Enterprise: FAQ for IT professionals - -Get answers to common questions around compatibility, installation, and support for Windows 10 Enterprise. - -## Download and requirements - -### Where can I download Windows 10 Enterprise? - -If you have Windows volume licenses with Software Assurance, or if you have purchased licenses for Windows 10 Enterprise volume licenses, you can download 32-bit and 64-bit versions of Windows 10 Enterprise from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). If you do not have current Software Assurance for Windows and would like to purchase volume licenses for Windows 10 Enterprise, contact your preferred Microsoft Reseller or see [How to purchase through Volume Licensing](https://www.microsoft.com/en-us/Licensing/how-to-buy/how-to-buy.aspx). - -### What are the system requirements? - -For details, see [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752). - -### What are the hardware requirements for Windows 10? - -Most computers that are compatible with Windows 8.1 will be compatible with Windows 10. You may need to install updated drivers in Windows 10 for your devices to properly function. See [Windows 10 specifications](https://www.microsoft.com/windows/windows-10-specifications) for more information. - -### Can I evaluate Windows 10 Enterprise? - -Yes, a 90-day evaluation of Windows 10 Enterprise is available through the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise). The evaluation is available in Chinese (Simplified), Chinese (Traditional), French, German, Italian, Japanese, Korean, Portuguese (Brazil), and Spanish (Spain, International Sort). We highly recommend that organizations make use of the Windows 10 Enterprise 90-day Evaluation to try out deployment and management scenarios, test compatibility with hardware and applications, and to get hands on experience with Windows 10 Enterprise features. - -## Drivers and compatibility - -### Where can I find drivers for my devices for Windows 10 Enterprise? - -For many devices, drivers will be automatically installed in Windows 10 and there will be no need for additional action. -- For some devices, Windows 10 may be unable to install drivers that are required for operation. If your device drivers are not automatically installed, visit the manufacturer’s support website for your device to download and manually install the drivers. If Windows 10 drivers are not available, the most up-to-date drivers for Windows 8.1 will often work in Windows 10. -- For some devices, the manufacturer may provide more up-to-date drivers or drivers that enable additional functionality than the drivers installed by Windows 10. Always follow the recommendations of the device manufacturer for optimal performance and stability. -- Some computer manufacturers provide packs of drivers for easy implementation in management and deployment solutions like the Microsoft Deployment Toolkit (MDT) or Microsoft System Center Configuration Manager. These driver packs contain all of the drivers needed for each device and can greatly simplify the process of deploying Windows to a new make or model of computer. Driver packs for some common manufacturers include: - - [HP driver pack](http://www8.hp.com/us/en/ads/clientmanagement/drivers-pack.html) - - [Dell driver packs for enterprise client OS deployment](http://en.community.dell.com/techcenter/enterprise-client/w/wiki/2065.dell-command-deploy-driver-packs-for-enterprise-client-os-deployment) - - [Lenovo Configuration Manager and MDT package index](https://support.lenovo.com/us/en/documents/ht074984) - - [Panasonic Driver Pack for Enterprise](http://pc-dl.panasonic.co.jp/itn/drivers/driver_packages.html) - -### Where can I find out if an application or device is compatible with Windows 10? - -Many existing Win32 and Win64 applications already run reliably on Windows 10 without any changes. You can also expect strong compatibility and support for Web apps and devices. The [Ready for Windows](https://www.readyforwindows.com/) website lists software solutions that are supported and in use for Windows 10. You can find additional guidance to help with application compatibility at [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793) on the Windows IT Center. - -### Is there an easy way to assess if my organization’s devices are ready to upgrade to Windows 10? - -[Windows Analytics Upgrade Readiness](https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics) (formerly known as Upgrade Analytics) provides powerful insights and recommendations about the computers, applications, and drivers in your organization, at no extra cost and without additional infrastructure requirements. This new service guides you through your upgrade and feature update projects using a workflow based on Microsoft recommended practices. Up-to-date inventory data allows you to balance cost and risk in your upgrade projects. You can find additional product information at [Windows Analytics](https://www.microsoft.com/en-us/WindowsForBusiness/Windows-Analytics). - -## Administration and deployment - -### Which deployment tools support Windows 10? - -Updated versions of Microsoft deployment tools, including MDT, Configuration Manager, and the Windows Assessment and Deployment Kit (Windows ADK) have been released to support Windows 10. -- [MDT](https://www.microsoft.com/mdt) is Microsoft’s recommended collection of tools, processes, and guidance for automating desktop and server deployment. -- Configuration Manager simplifies the deployment and management of Windows 10. If you are not currently using Configuration Manager, you can download a free 180-day trial of [System Center Configuration Manager and Endpoint Protection (current branch)](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) from the TechNet Evaluation Center. -- The [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#winADK) has tools that allow you to customize Windows images for large-scale deployment, and test system quality and performance. You can download the latest version of the Windows ADK for Windows 10 from the Hardware Dev Center. - -### Can I upgrade computers from Windows 7 or Windows 8.1 without deploying a new image? - -Computers running Windows 7 or Windows 8.1 can be upgraded directly to Windows 10 through the in-place upgrade process without a need to reimage the device using MDT and/or Configuration Manager. For more information, see [Upgrade to Windows 10 with System Center Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager) or [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit). - -### Can I upgrade from Windows 7 Enterprise or Windows 8.1 Enterprise to Windows 10 Enterprise for free? - -If you have Windows 7 Enterprise or Windows 8.1 Enterprise and current Windows 10 Enterprise E3 or E5 subscription, you are entitled to the upgrade to Windows 10 Enterprise through the rights of Software Assurance. You can find your product keys and installation media at the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). - -For devices that are licensed under a volume license agreement for Windows that does not include Software Assurance, new licenses will be required to upgrade these devices to Windows 10. - -## Managing updates - -### What is Windows as a service? - -The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. For more information, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). - -### How is servicing different with Windows as a service? - -Traditional Windows servicing has included several release types: major revisions (e.g., the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10, there are two release types: feature updates that add new functionality two to three times per year, and quality updates that provide security and reliability fixes at least once a month. - -### What are the servicing channels? - -To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how aggressively their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers two servicing channels for Windows 10: Semi-Annual Channel, and Long-Term Servicing Channel (LTSC). For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). For more information on each channel, see [servicing channels](/windows/deployment/update/waas-overview#servicing-channels). - -### What tools can I use to manage Windows as a service updates? - -There are many tools are available. You can choose from these: -- Windows Update -- Windows Update for Business -- Windows Server Update Services -- System Center Configuration Manager - -For more information on pros and cons for these tools, see [Servicing Tools](/windows/deployment/update/waas-overview#servicing-tools). - -## User experience - -### Where can I find information about new features and changes in Windows 10 Enterprise? - -For an overview of the new enterprise features in Windows 10 Enterprise, see [What's new in Windows 10](https://technet.microsoft.com/itpro/windows/whats-new/index) and [What's new in Windows 10, version 1703](/windows/whats-new/whats-new-windows-10-version-1703) in the Docs library. - -Another place to track the latest information about new features of interest to IT professionals is the [Windows for IT Pros blog](https://blogs.technet.microsoft.com/windowsitpro/). Here you’ll find announcements of new features, information on updates to the Windows servicing model, and details about the latest resources to help you more easily deploy and manage Windows 10. - -To find out which version of Windows 10 is right for your organization, you can also [compare Windows editions](https://www.microsoft.com/WindowsForBusiness/Compare). - -### How will people in my organization adjust to using Windows 10 Enterprise after upgrading from Windows 7 or Windows 8.1? - -Windows 10 combines the best aspects of the user experience from Windows 8.1 and Windows 7 to make using Windows simple and straightforward. Users of Windows 7 will find the Start menu in the same location as they always have. In the same place, users of Windows 8.1 will find the live tiles from their Start screen, accessible by the Start button in the same way as they were accessed in Windows 8.1. To help you make the transition a seamless one, download the [Windows 10 Adoption Planning Kit](https://info.microsoft.com/Windows10AdoptionPlanningKit) and see our [end user readiness](https://technet.microsoft.com/windows/dn621092) resources. - -### How does Windows 10 help people work with applications and data across a variety of devices? - -The desktop experience in Windows 10 has been improved to provide a better experience for people that use a traditional mouse and keyboard. Key changes include: -- Start menu is a launching point for access to apps. -- Universal apps now open in windows instead of full screen. -- [Multitasking is improved with adjustable Snap](http://blogs.windows.com/bloggingwindows/2015/06/04/arrange-your-windows-in-a-snap/), which allows you to have more than two windows side-by-side on the same screen and to customize how those windows are arranged. -- Tablet Mode to simplify using Windows with a finger or pen by using touch input. - -## Help and support - -### Where can I ask a question about Windows 10? - -Use the following resources for additional information about Windows 10. -- If you are an IT professional or if you have a question about administering, managing, or deploying Windows 10 in your organization or business, visit the [Windows 10 IT Professional forums](https://social.technet.microsoft.com/forums/home?category=windows10itpro) on TechNet. -- If you are an end user or if you have a question about using Windows 10, visit the [Windows 10 forums on Microsoft Community](https://answers.microsoft.com/windows/forum/windows_10). -- If you are a developer or if you have a question about making apps for Windows 10, visit the [Windows Desktop Development forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsdesktopdev) or [Windows and Windows phone apps forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsapps) on MSDN. -- If you have a question about Internet Explorer, visit the [Internet Explorer forums](https://social.technet.microsoft.com/forums/ie/en-us/home) on TechNet. +--- +title: Windows 10 Enterprise FAQ for IT pros (Windows 10) +description: Get answers to common questions around compatibility, installation, and support for Windows 10 Enterprise. +keywords: Windows 10 Enterprise, download, system requirements, drivers, appcompat, manage updates, Windows as a service, servicing channels, deployment tools +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +author: greg-lindsay +ms.date: 08/18/2017 +ms.reviewer: +manager: laurawi +ms.author: greglin +audience: itpro +ms.topic: article +--- + +# Windows 10 Enterprise: FAQ for IT professionals + +Get answers to common questions around compatibility, installation, and support for Windows 10 Enterprise. + +## Download and requirements + +### Where can I download Windows 10 Enterprise? + +If you have Windows volume licenses with Software Assurance, or if you have purchased licenses for Windows 10 Enterprise volume licenses, you can download 32-bit and 64-bit versions of Windows 10 Enterprise from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). If you do not have current Software Assurance for Windows and would like to purchase volume licenses for Windows 10 Enterprise, contact your preferred Microsoft Reseller or see [How to purchase through Volume Licensing](https://www.microsoft.com/Licensing/how-to-buy/how-to-buy.aspx). + +### What are the system requirements? + +For details, see [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752). + +### What are the hardware requirements for Windows 10? + +Most computers that are compatible with Windows 8.1 will be compatible with Windows 10. You may need to install updated drivers in Windows 10 for your devices to properly function. See [Windows 10 specifications](https://www.microsoft.com/windows/windows-10-specifications) for more information. + +### Can I evaluate Windows 10 Enterprise? + +Yes, a 90-day evaluation of Windows 10 Enterprise is available through the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). The evaluation is available in Chinese (Simplified), Chinese (Traditional), French, German, Italian, Japanese, Korean, Portuguese (Brazil), and Spanish (Spain, International Sort). We highly recommend that organizations make use of the Windows 10 Enterprise 90-day Evaluation to try out deployment and management scenarios, test compatibility with hardware and applications, and to get hands on experience with Windows 10 Enterprise features. + +## Drivers and compatibility + +### Where can I find drivers for my devices for Windows 10 Enterprise? + +For many devices, drivers will be automatically installed in Windows 10 and there will be no need for additional action. +- For some devices, Windows 10 may be unable to install drivers that are required for operation. If your device drivers are not automatically installed, visit the manufacturer’s support website for your device to download and manually install the drivers. If Windows 10 drivers are not available, the most up-to-date drivers for Windows 8.1 will often work in Windows 10. +- For some devices, the manufacturer may provide more up-to-date drivers or drivers that enable additional functionality than the drivers installed by Windows 10. Always follow the recommendations of the device manufacturer for optimal performance and stability. +- Some computer manufacturers provide packs of drivers for easy implementation in management and deployment solutions like the Microsoft Deployment Toolkit (MDT) or Microsoft Endpoint Configuration Manager. These driver packs contain all of the drivers needed for each device and can greatly simplify the process of deploying Windows to a new make or model of computer. Driver packs for some common manufacturers include: + - [HP driver pack](http://www8.hp.com/us/en/ads/clientmanagement/drivers-pack.html) + - [Dell driver packs for enterprise client OS deployment](http://en.community.dell.com/techcenter/enterprise-client/w/wiki/2065.dell-command-deploy-driver-packs-for-enterprise-client-os-deployment) + - [Lenovo Configuration Manager and MDT package index](https://support.lenovo.com/us/en/documents/ht074984) + - [Panasonic Driver Pack for Enterprise](http://pc-dl.panasonic.co.jp/itn/drivers/driver_packages.html) + +### Where can I find out if an application or device is compatible with Windows 10? + +Many existing Win32 and Win64 applications already run reliably on Windows 10 without any changes. You can also expect strong compatibility and support for Web apps and devices. The [Ready for Windows](https://www.readyforwindows.com/) website lists software solutions that are supported and in use for Windows 10. You can find additional guidance to help with application compatibility at [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793) on the Windows IT Center. + +### Is there an easy way to assess if my organization’s devices are ready to upgrade to Windows 10? + +[Windows Analytics Upgrade Readiness](https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics) (formerly known as Upgrade Analytics) provides powerful insights and recommendations about the computers, applications, and drivers in your organization, at no extra cost and without additional infrastructure requirements. This new service guides you through your upgrade and feature update projects using a workflow based on Microsoft recommended practices. Up-to-date inventory data allows you to balance cost and risk in your upgrade projects. You can find additional product information at [Windows Analytics](https://www.microsoft.com/WindowsForBusiness/Windows-Analytics). + +## Administration and deployment + +### Which deployment tools support Windows 10? + +Updated versions of Microsoft deployment tools, including MDT, Configuration Manager, and the Windows Assessment and Deployment Kit (Windows ADK) have been released to support Windows 10. +- [MDT](https://www.microsoft.com/mdt) is Microsoft’s recommended collection of tools, processes, and guidance for automating desktop and server deployment. +- Configuration Manager simplifies the deployment and management of Windows 10. If you are not currently using Configuration Manager, you can download a free 180-day trial of [Microsoft Endpoint Configuration Manager and Endpoint Protection (current branch)](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) from the TechNet Evaluation Center. +- The [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#winADK) has tools that allow you to customize Windows images for large-scale deployment, and test system quality and performance. You can download the latest version of the Windows ADK for Windows 10 from the Hardware Dev Center. + +### Can I upgrade computers from Windows 7 or Windows 8.1 without deploying a new image? + +Computers running Windows 7 or Windows 8.1 can be upgraded directly to Windows 10 through the in-place upgrade process without a need to reimage the device using MDT and/or Configuration Manager. For more information, see [Upgrade to Windows 10 with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager) or [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit). + +### Can I upgrade from Windows 7 Enterprise or Windows 8.1 Enterprise to Windows 10 Enterprise for free? + +If you have Windows 7 Enterprise or Windows 8.1 Enterprise and current Windows 10 Enterprise E3 or E5 subscription, you are entitled to the upgrade to Windows 10 Enterprise through the rights of Software Assurance. You can find your product keys and installation media at the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). + +For devices that are licensed under a volume license agreement for Windows that does not include Software Assurance, new licenses will be required to upgrade these devices to Windows 10. + +## Managing updates + +### What is Windows as a service? + +The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. For more information, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). + +### How is servicing different with Windows as a service? + +Traditional Windows servicing has included several release types: major revisions (e.g., the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10, there are two release types: feature updates that add new functionality two to three times per year, and quality updates that provide security and reliability fixes at least once a month. + +### What are the servicing channels? + +To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how aggressively their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers two servicing channels for Windows 10: Semi-Annual Channel, and Long-Term Servicing Channel (LTSC). For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). For more information on each channel, see [servicing channels](/windows/deployment/update/waas-overview#servicing-channels). + +### What tools can I use to manage Windows as a service updates? + +There are many tools are available. You can choose from these: +- Windows Update +- Windows Update for Business +- Windows Server Update Services +- Microsoft Endpoint Configuration Manager + +For more information on pros and cons for these tools, see [Servicing Tools](/windows/deployment/update/waas-overview#servicing-tools). + +## User experience + +### Where can I find information about new features and changes in Windows 10 Enterprise? + +For an overview of the new enterprise features in Windows 10 Enterprise, see [What's new in Windows 10](https://technet.microsoft.com/itpro/windows/whats-new/index) and [What's new in Windows 10, version 1703](/windows/whats-new/whats-new-windows-10-version-1703) in the Docs library. + +Another place to track the latest information about new features of interest to IT professionals is the [Windows for IT Pros blog](https://blogs.technet.microsoft.com/windowsitpro/). Here you’ll find announcements of new features, information on updates to the Windows servicing model, and details about the latest resources to help you more easily deploy and manage Windows 10. + +To find out which version of Windows 10 is right for your organization, you can also [compare Windows editions](https://www.microsoft.com/WindowsForBusiness/Compare). + +### How will people in my organization adjust to using Windows 10 Enterprise after upgrading from Windows 7 or Windows 8.1? + +Windows 10 combines the best aspects of the user experience from Windows 8.1 and Windows 7 to make using Windows simple and straightforward. Users of Windows 7 will find the Start menu in the same location as they always have. In the same place, users of Windows 8.1 will find the live tiles from their Start screen, accessible by the Start button in the same way as they were accessed in Windows 8.1. To help you make the transition a seamless one, download the [Windows 10 Adoption Planning Kit](https://info.microsoft.com/Windows10AdoptionPlanningKit) and see our [end user readiness](https://technet.microsoft.com/windows/dn621092) resources. + +### How does Windows 10 help people work with applications and data across a variety of devices? + +The desktop experience in Windows 10 has been improved to provide a better experience for people that use a traditional mouse and keyboard. Key changes include: +- Start menu is a launching point for access to apps. +- Universal apps now open in windows instead of full screen. +- [Multitasking is improved with adjustable Snap](http://blogs.windows.com/bloggingwindows/2015/06/04/arrange-your-windows-in-a-snap/), which allows you to have more than two windows side-by-side on the same screen and to customize how those windows are arranged. +- Tablet Mode to simplify using Windows with a finger or pen by using touch input. + +## Help and support + +### Where can I ask a question about Windows 10? + +Use the following resources for additional information about Windows 10. +- If you are an IT professional or if you have a question about administering, managing, or deploying Windows 10 in your organization or business, visit the [Windows 10 IT Professional forums](https://social.technet.microsoft.com/forums/home?category=windows10itpro) on TechNet. +- If you are an end user or if you have a question about using Windows 10, visit the [Windows 10 forums on Microsoft Community](https://answers.microsoft.com/windows/forum/windows_10). +- If you are a developer or if you have a question about making apps for Windows 10, visit the [Windows Desktop Development forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsdesktopdev) or [Windows and Windows phone apps forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsapps) on MSDN. +- If you have a question about Internet Explorer, visit the [Internet Explorer forums](https://social.technet.microsoft.com/forums/ie/en-us/home) on TechNet. diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md deleted file mode 100644 index bec34fa0f2..0000000000 --- a/windows/deployment/planning/windows-10-fall-creators-removed-features.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: Windows 10 Fall Creators Update - Features removed or planned for removal -description: Which features were removed in Windows 10 Fall Creators Update (version 1709)? Which features are we thinking of removing in the future? -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 10/09/2017 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.topic: article ---- -# Features removed or planned for replacement starting with Windows 10 Fall Creators Update (version 1709) - -> Applies to: Windows 10, version 1709 - -Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Read on for details about the features and functionalities that we removed in Windows 10 Fall Creators Update (version 1709). This list also includes information about features and functionality that we're considering removing in a future release of Windows 10. This list is intended to make you aware of current and future changes and inform your planning. **The list is subject to change and might not include every affected feature or functionality.** - -## Features removed from Windows 10 Fall Creators Update -We've removed the following features and functionalities from the installed product image in Windows 10, version 1709. Applications, code, or usage that depend on these features won't function in this release unless you employ an alternate method. - -### 3D Builder -No longer installed by default, [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) is still available for download from the Microsoft Store. You can also consider using Print 3D and Paint 3D in its place. - -### APN database (Apndatabase.xml) -Replaced by the Country and Operator Settings Asset (COSA) database. For more information, see the following Hardware Dev Center articles: -- [Planning your COSA/APN database submission](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission) -- [COSA – FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) - -### Enhanced Mitigation Experience Toolkit (EMET) -Removed from the image, and you're blocked from using it. Consider using the [Exploit Protection feature of Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) as a replacement. See the [Announcing Windows 10 Insider Preview Build 16232 for PC + Build 15228 for Mobile](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/) for details. - -### Outlook Express -Removed this non-functional code. - -### Reader app -Integrated the Reader functionality into Microsoft Edge. - -### Reading list -Integrated the Reading list functionality into Microsoft Edge. - -### Resilient File System (ReFS) -We changed the way that ReFS works, based on the edition of Windows 10 you have. We didn't **remove** ReFS, but how you can use ReFS depends on your edition. - -If you have Windows 10 Enterprise or Windows 10 Pro for Workstations: You can create, read, and write volumes. - -If you have any other edition of Windows 10: You can read and write volumes, but you can't create volumes. If you need to create volumes, upgrade to the Enterprise or Pro for Workstations edition. - -### Syskey.exe -Removed this security feature. Instead, we recommend using [BitLocker](/device-security/bitlocker/bitlocker-overview). For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). - -### TCP Offload Engine -Removed this code. The TCP Offload Engine functionality is now available in the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) - -### TPM Owner Password Management -Removed this code. - -## Features being considered for replacement starting after Windows Fall Creators Update -We are considering removing the following features and functionalities from the installed product image, starting with releases after Windows 10, version 1709. Eventually, we might completely remove them and replace them with other features or functionality (or, in some instances, make them available from different sources). These features and functionalities are *still available* in this release, but **you should begin planning now to either use alternate methods or to replace any applications, code, or usage that depend on these features.** - -If you have feedback to share about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -### IIS 6 Management Compatibility -We're considering replacing the following specific DISM features: - -- IIS 6 Metabase Compatibility (Web-Metabase) -- IIS 6 Management Console (Web-Lgcy-Mgmt-Console) -- IIS 6 Scripting Tools (Web-Lgcy-Scripting) -- IIS 6 WMI Compatibility (Web-WMI) - -Instead of IIS 6 Metabase Compatibility (which acts as an emulation layer between IIS 6-based metabase scripts and the file-based configuration used by IIS 7 or newer versions) you should start migrating management scripts to target IIS file-based configuration directly, by using tools such as the Microsoft.Web.Administration namespace. - -You should also start migration from IIS 6.0 or earlier versions, and move to the [latest version of IIS](/iis/get-started/whats-new-in-iis-10/new-features-introduced-in-iis-10). - -### IIS Digest Authentication -We're considering removing the IIS Digest Authentication method. Instead, you should start using other authentication methods, such as [Client Certificate Mapping](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) or [Windows Authentication](/iis/configuration/system.webServer/security/authentication/windowsAuthentication/). - -### Microsoft Paint -We're considering removing MS Paint from the basic installed product image - that means it won't be installed by default. **You'll still be able to get the app separately from the [Microsoft Store](https://www.microsoft.com/store/b/home) for free.** Alternately, you can get [Paint 3D](https://www.microsoft.com/store/p/paint-3d/9nblggh5fv99) and [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) from the Microsoft Store today; both of these offer the same functionality as Microsoft Paint, plus additional features. - -### RSA/AES Encryption for IIS -We're considering removing RSA/AES encryption because the superior [Cryptography API: Next Generation (CNG)](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx) method is already available. - -### Sync your settings -We're considering making changes to the back-end storage that will affect the sync process: [Enterprise State Roaming](/azure/active-directory/active-directory-windows-enterprise-state-roaming-overview) and all other users will use a single cloud storage system. Both the "Sync your settings" options and the Enterprise State Roaming feature will continue to work. diff --git a/windows/deployment/planning/windows-10-infrastructure-requirements.md b/windows/deployment/planning/windows-10-infrastructure-requirements.md index 36c030bdcf..7ca82acf70 100644 --- a/windows/deployment/planning/windows-10-infrastructure-requirements.md +++ b/windows/deployment/planning/windows-10-infrastructure-requirements.md @@ -1,133 +1,111 @@ ---- -title: Windows 10 infrastructure requirements (Windows 10) -description: There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. -ms.assetid: B0FA27D9-A206-4E35-9AE6-74E70748BE64 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, upgrade, update, hardware -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 infrastructure requirements - - -**Applies to** - -- Windows 10 - -There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. - -## High-level requirements - - -For initial Windows 10 deployments, as well as subsequent Windows 10 upgrades, ensure that sufficient disk space is available for distribution of the Windows 10 installation files (about 3 GB for Windows 10 x64 images, slightly smaller for x86). Also, be sure to take into account the network impact of moving these large images to each PC; you may need to leverage local server storage. - -For persistent VDI environments, carefully consider the I/O impact from upgrading large numbers of PCs in a short period of time. Ensure that upgrades are performed in smaller numbers, or during off-peak time periods. (For pooled VDI environments, a better approach is to replace the base image with a new version.) - -## Deployment tools - - -A new version of the Assessment and Deployment Toolkit (ADK) has been released to support Windows 10. This new version, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=526740), is required for Windows 10; you should not use earlier versions of the ADK to deploy Windows 10. It also supports the deployment of Windows 7, Windows 8, and Windows 8.1. - -Significant enhancements in the ADK for Windows 10 include new runtime provisioning capabilities, which leverage the Windows Imaging and Configuration Designer (Windows ICD), as well as updated versions of existing deployment tools (DISM, USMT, Windows PE, and more). - -Microsoft Deployment Toolkit 2013 Update 1, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=625079), has also been updated to support Windows 10 and the new ADK; older versions do not support Windows 10. New in this release is task sequence support for Windows 10 in-place upgrades. - -For System Center Configuration Manager, Windows 10 support is offered with various releases: - -| Release | Windows 10 management? | Windows 10 deployment? | -|---------------------------------------------|------------------------|------------------------------------------------| -| System Center Configuration Manager 2007 | Yes, with a hotfix | No | -| System Center Configuration Manager 2012 | Yes, with SP2 and CU1 | Yes, with SP2, CU1, and the ADK for Windows 10 | -| System Center Configuration Manager 2012 R2 | Yes, with SP1 and CU1 | Yes, with SP1, CU1, and the ADK for Windows 10 | - - ->Note: Configuration Manager 2012 supports Windows 10 version 1507 (build 10.0.10240) and 1511 (build 10.0.10586) for the lifecycle of these builds. Future releases of Windows 10 CB/CBB are not supported With Configuration Manager 2012, and will require System Center Configuration Manager current branch for supported management. -  - -For more details about System Center Configuration Manager support for Windows 10, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). - -## Management tools - - -In addition to System Center Configuration Manager, Windows 10 also leverages other tools for management. For Windows Server and Active Directory, existing supported versions are fully supported for Windows 10. New Group Policy templates will be needed to configure new settings available in Windows 10; these templates are available in the Windows 10 media images, and are available as a separate download [here](https://go.microsoft.com/fwlink/p/?LinkId=625081). See [Group Policy settings reference](https://go.microsoft.com/fwlink/p/?LinkId=625082) for a list of the new and modified policy settings. If you are using a central policy store, follow the steps outlined [here](https://go.microsoft.com/fwlink/p/?LinkId=625083) to update the ADMX files stored in that central store. - -No new Active Directory schema updates or specific functional levels are currently required for core Windows 10 product functionality, although subsequent upgrades could require these to support new features. - -Microsoft Desktop Optimization Pack (MDOP) has been updated to support Windows 10. The minimum versions required to support Windows 10 are as follows: - -| Product | Required version | -|----------------------------------------------------------|--------------------------| -| Advanced Group Policy Management (AGPM) | AGPM 4.0 Service Pack 3 | -| Application Virtualization (App-V) | App-V 5.1 | -| Diagnostics and Recovery Toolkit (DaRT) | DaRT 10 | -| Microsoft BitLocker Administration and Monitoring (MBAM) | MBAM 2.5 SP1 (2.5 is OK) | -| User Experience Virtualization (UE-V) | UE-V 2.1 SP1 | - -  - -For more information, see the [MDOP TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=625090). - -For devices you manage with mobile device management (MDM) solutions such as Microsoft Intune, existing capabilities (provided initially in Windows 8.1) are fully supported in Windows 10; new Windows 10 MDM settings and capabilities will require updates to the MDM services. See [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=625084) for more information. - -Windows Server Update Services (WSUS) requires some additional configuration to receive updates for Windows 10. Use the Windows Server Update Services admin tool and follow these instructions: - -1. Select the **Options** node, and then click **Products and Classifications**. - -2. In the **Products** tree, select the **Windows 10** and **Windows 10 LTSB** products and any other Windows 10-related items that you want. Click **OK**. - -3. From the **Synchronizations** node, right-click and choose **Synchronize Now**. - -![figure 1](images/fig4-wsuslist.png) - -Figure 1. WSUS product list with Windows 10 choices - -Because Windows 10 updates are cumulative in nature, each month’s new update will supersede the previous month's. Consider leveraging “express installation” packages to reduce the size of the payload that needs to be sent to each PC each month; see [Express installation files](https://go.microsoft.com/fwlink/p/?LinkId=625086) for more information. (Note that this will increase the amount of disk storage needed by WSUS, and impacts all operating systems being managed with WSUS.) - -## Activation - - -Windows 10 volume license editions of Windows 10 will continue to support all existing activation methods (KMS, MAK, and AD-based activation). An update will be required for existing KMS servers: - -| Product | Required update | -|----------------------------------------|---------------------------------------------------------------------------------------------| -| Windows 10 | None | -| Windows Server 2012 R2 and Windows 8.1 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | -| Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | -| Windows Server 2008 R2 and Windows 7 | [https://support.microsoft.com/kb/3079821](https://support.microsoft.com/kb/3079821) | - -  - -Also see: [Windows Server 2016 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2016/10/19/windows-server-2016-volume-activation-tips/) - -Additionally, new product keys will be needed for all types of volume license activation (KMS, MAK, and AD-based Activation); these keys are available on the Volume Licensing Service Center (VLSC) for customers with rights to the Windows 10 operating system. To find the needed keys: - -- Sign into the [Volume Licensing Service Center (VLSC)](https://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. - -- For KMS keys, click **Licenses** and then select **Relationship Summary**. Click the appropriate active license ID, and then select **Product Keys** near the right side of the page. For KMS running on Windows Server, find the **Windows Srv 2012R2 DataCtr/Std KMS for Windows 10** product key; for KMS running on client operating systems, find the **Windows 10** product key. - -- For MAK keys, click **Downloads and Keys**, and then filter the list by using **Windows 10** as a product. Click the **Key** link next to an appropriate list entry (for example, **Windows 10 Enterprise** or **Windows 10 Enterprise LTSB**) to view the available MAK keys. (You can also find keys for KMS running on Windows 10 in this list. These keys will not work on Windows servers running KMS.) - -Note that Windows 10 Enterprise and Windows 10 Enterprise LTSB installations use different MAK keys. But you can use the same KMS server or Active Directory-based activation environment for both; the KMS keys obtained from the Volume Licensing Service Center will work with both. - -## Related topics - - -[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) -
              [Windows 10 deployment considerations](windows-10-deployment-considerations.md) -
              [Windows 10 compatibility](windows-10-compatibility.md) - -  - -  - - - - - +--- +title: Windows 10 infrastructure requirements (Windows 10) +description: Review the specific infrastructure requirements to deploy and manage Windows 10, prior to significant Windows 10 deployments within your organization. +ms.assetid: B0FA27D9-A206-4E35-9AE6-74E70748BE64 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, upgrade, update, hardware +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 infrastructure requirements + + +**Applies to** + +- Windows 10 + +There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. + +## High-level requirements + +For initial Windows 10 deployments, as well as subsequent Windows 10 upgrades, ensure that sufficient disk space is available for distribution of the Windows 10 installation files (about 3 GB for Windows 10 x64 images, slightly smaller for x86). Also, be sure to take into account the network impact of moving these large images to each PC; you may need to leverage local server storage. + +For persistent VDI environments, carefully consider the I/O impact from upgrading large numbers of PCs in a short period of time. Ensure that upgrades are performed in smaller numbers, or during off-peak time periods. (For pooled VDI environments, a better approach is to replace the base image with a new version.) + +## Deployment tools + +The latest version of the Windows Assessment and Deployment Toolkit (ADK) is available for download [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install). + +Significant enhancements in the ADK for Windows 10 include new runtime provisioning capabilities, which leverage the Windows Imaging and Configuration Designer (Windows ICD), as well as updated versions of existing deployment tools (DISM, USMT, Windows PE, and more). + +The latest version of the Microsoft Deployment Toolkit (MDT) is available for download [here](https://docs.microsoft.com/mem/configmgr/mdt/release-notes). + +For Configuration Manager, Windows 10 version specific support is offered with [various releases](https://docs.microsoft.com/mem/configmgr/core/plan-design/configs/support-for-windows-10). + +For more details about Microsoft Endpoint Configuration Manager support for Windows 10, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +## Management tools + +In addition to Microsoft Endpoint Configuration Manager, Windows 10 also leverages other tools for management. For Windows Server and Active Directory, existing supported versions are fully supported for Windows 10. New Group Policy templates will be needed to configure new settings available in Windows 10; these templates are available in the Windows 10 media images, and are available as a separate download [here](https://go.microsoft.com/fwlink/p/?LinkId=625081). See [Group Policy settings reference](https://go.microsoft.com/fwlink/p/?LinkId=625082) for a list of the new and modified policy settings. If you are using a central policy store, follow the steps outlined [here](https://go.microsoft.com/fwlink/p/?LinkId=625083) to update the ADMX files stored in that central store. + +No new Active Directory schema updates or specific functional levels are currently required for core Windows 10 product functionality, although subsequent upgrades could require these to support new features. + +Microsoft Desktop Optimization Pack (MDOP) has been updated to support Windows 10. The minimum versions required to support Windows 10 are as follows: + +| Product | Required version | +|----------------------------------------------------------|--------------------------| +| Advanced Group Policy Management (AGPM) | AGPM 4.0 Service Pack 3 | +| Application Virtualization (App-V) | App-V 5.1 | +| Diagnostics and Recovery Toolkit (DaRT) | DaRT 10 | +| Microsoft BitLocker Administration and Monitoring (MBAM) | MBAM 2.5 SP1 (2.5 is OK) | +| User Experience Virtualization (UE-V) | UE-V 2.1 SP1 | + +For more information, see the [MDOP TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=625090). + +For devices you manage with mobile device management (MDM) solutions such as Microsoft Intune, existing capabilities (provided initially in Windows 8.1) are fully supported in Windows 10; new Windows 10 MDM settings and capabilities will require updates to the MDM services. See [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=625084) for more information. + +Windows Server Update Services (WSUS) requires some additional configuration to receive updates for Windows 10. Use the Windows Server Update Services admin tool and follow these instructions: + +1. Select the **Options** node, and then click **Products and Classifications**. +2. In the **Products** tree, select the **Windows 10** and **Windows 10 LTSB** products and any other Windows 10-related items that you want. Click **OK**. +3. From the **Synchronizations** node, right-click and choose **Synchronize Now**. + +![figure 1](images/fig4-wsuslist.png) + +WSUS product list with Windows 10 choices + +Because Windows 10 updates are cumulative in nature, each month’s new update will supersede the previous month's. Consider leveraging “express installation” packages to reduce the size of the payload that needs to be sent to each PC each month; see [Express installation files](https://go.microsoft.com/fwlink/p/?LinkId=625086) for more information. (Note that this will increase the amount of disk storage needed by WSUS, and impacts all operating systems being managed with WSUS.) + +## Activation + +Windows 10 volume license editions of Windows 10 will continue to support all existing activation methods (KMS, MAK, and AD-based activation). An update will be required for existing KMS servers: + +| Product | Required update | +|----------------------------------------|---------------------------------------------------------------------------------------------| +| Windows 10 | None | +| Windows Server 2012 R2 and Windows 8.1 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | +| Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | +| Windows Server 2008 R2 and Windows 7 | [https://support.microsoft.com/kb/3079821](https://support.microsoft.com/kb/3079821) | + +Also see: [Windows Server 2016 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2016/10/19/windows-server-2016-volume-activation-tips/) + +Additionally, new product keys will be needed for all types of volume license activation (KMS, MAK, and AD-based Activation); these keys are available on the Volume Licensing Service Center (VLSC) for customers with rights to the Windows 10 operating system. To find the needed keys: + +- Sign into the [Volume Licensing Service Center (VLSC)](https://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. +- For KMS keys, click **Licenses** and then select **Relationship Summary**. Click the appropriate active license ID, and then select **Product Keys** near the right side of the page. For KMS running on Windows Server, find the **Windows Srv 2012R2 DataCtr/Std KMS for Windows 10** product key; for KMS running on client operating systems, find the **Windows 10** product key. +- For MAK keys, click **Downloads and Keys**, and then filter the list by using **Windows 10** as a product. Click the **Key** link next to an appropriate list entry (for example, **Windows 10 Enterprise** or **Windows 10 Enterprise LTSB**) to view the available MAK keys. (You can also find keys for KMS running on Windows 10 in this list. These keys will not work on Windows servers running KMS.) + +Note that Windows 10 Enterprise and Windows 10 Enterprise LTSC installations use different MAK keys. But you can use the same KMS server or Active Directory-based activation environment for both; the KMS keys obtained from the Volume Licensing Service Center will work with both. + +## Related topics + +[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md)
              +[Windows 10 deployment considerations](windows-10-deployment-considerations.md)
              +[Windows 10 compatibility](windows-10-compatibility.md)
              + +  + +  + + + + + diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md new file mode 100644 index 0000000000..edeeaeec27 --- /dev/null +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -0,0 +1,69 @@ +--- +title: Windows 10 - Features that have been removed +description: In this article, learn about the features and functionality that have been removed or replaced in Windows 10. +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Features and functionality removed in Windows 10 + +> Applies to: Windows 10 + +Each version of Windows 10 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that we removed in Windows 10. **The list below is subject to change and might not include every affected feature or functionality.** + +For information about features that might be removed in a future release, see [Windows 10 features we’re no longer developing](windows-10-deprecated-features.md). + +> [!NOTE] +> Join the [Windows Insider program](https://insider.windows.com) to get early access to new Windows 10 builds and test these changes yourself. + +The following features and functionalities have been removed from the installed product image for Windows 10. Applications or code that depend on these features won't function in the release when it was removed, or in later releases. + +|Feature | Details and mitigation | Removed in version | +| ----------- | --------------------- | ------ | +|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. Metadata for the MBAE service is removed. | 20H2 | +| Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 | +| Rinna and Japanese Address suggestion | The Rinna and Japanese Address suggestion service for Microsoft Japanese Input Method Editor (IME) ended on August 13th, 2020. For more information, see [Rinna and Japanese Address suggestion will no longer be offered](https://support.microsoft.com/help/4576767/windows-10-rinna-and-japanese-address-suggestion) | 2004 | +| Cortana | Cortana has been updated and enhanced in the Windows 10 May 2020 Update. With [these changes](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-2004#cortana), some previously available consumer skills such as music, connected home, and other non-Microsoft skills are no longer available. | 2004 | +| Windows To Go | Windows To Go was announced as deprecated in Windows 10, version 1903 and is removed in this release. | 2004 | +| Mobile Plans and Messaging apps | Both apps are still supported, but are now distributed in a different way. OEMs can now include these apps in Windows images for cellular enabled devices. The apps are removed for non-cellular devices.| 2004 | +| PNRP APIs| ​The Peer Name Resolution Protocol (PNRP) cloud service was removed in Windows 10, version 1809. We are planning to complete the removal process by removing the corresponding APIs. | 1909 | +| Taskbar settings roaming | Roaming of taskbar settings is removed in this release. This feature was announced as no longer being developed in Windows 10, version 1903. | 1909 | +| Desktop messaging app doesn't offer messages sync | The messaging app on Desktop has a sync feature that can be used to sync SMS text messages received from Windows Mobile and keep a copy of them on the Desktop. The sync feature has been removed from all devices. Due to this change, you will only be able to access messages from the device that received the message. | 1903 | +|Business Scanning, also called Distributed Scan Management (DSM)|We're removing this secure scanning and scanner management capability - there are no devices that support this feature.| 1809 | +|[FontSmoothing setting](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-visualeffects-fontsmoothing) in unattend.xml|The FontSmoothing setting let you specify the font antialiasing strategy to use across the system. We've changed Windows 10 to use [ClearType](https://docs.microsoft.com/typography/cleartype/) by default, so we're removing this setting as it is no longer necessary. If you include this setting in the unattend.xml file, it'll be ignored.| 1809 | +|Hologram app|We've replaced the Hologram app with the [Mixed Reality Viewer](https://support.microsoft.com/help/4041156/windows-10-mixed-reality-help). If you would like to create 3D word art, you can still do that in Paint 3D and view your art in VR or Hololens with the Mixed Reality Viewer.| 1809 | +|limpet.exe|We're releasing the limpet.exe tool, used to access TPM for Azure connectivity, as open source.| 1809 | +|Phone Companion|When you update to Windows 10, version 1809, the Phone Companion app will be removed from your PC. Use the **Phone** page in the Settings app to sync your mobile phone with your PC. It includes all the Phone Companion features.| 1809 | +|Future updates through [Windows Embedded Developer Update](https://docs.microsoft.com/previous-versions/windows/embedded/ff770079\(v=winembedded.60\)) for Windows Embedded Standard 7-SP1 (WES7-SP1) and Windows Embedded Standard 8 (WES8)|We’re no longer publishing new updates to the WEDU server. Instead, you may secure any new updates from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). [Learn how](https://techcommunity.microsoft.com/t5/Windows-Embedded/Change-to-the-Windows-Embedded-Developer-Update/ba-p/285704) to get updates from the catalog.| 1809 | +|Groove Music Pass|[We ended the Groove streaming music service and music track sales through the Microsoft Store in 2017](https://support.microsoft.com/help/4046109/groove-music-and-spotify-faq). The Groove app is being updated to reflect this change. You can still use Groove Music to play the music on your PC. You can use Spotify or other music services to stream music on Windows 10, or to buy music to own.| 1803 | +|People - Suggestions will no longer include unsaved contacts for non-Microsoft accounts|Manually save the contact details for people you send mail to or get mail from.| 1803 | +|Language control in the Control Panel| Use the Settings app to change your language settings.| 1803 | +|HomeGroup|We are removing [HomeGroup](https://support.microsoft.com/help/17145) but not your ability to share printers, files, and folders.

              When you update to Windows 10, version 1803, you won't see HomeGroup in File Explorer, the Control Panel, or Troubleshoot (**Settings > Update & Security > Troubleshoot**). Any printers, files, and folders that you shared using HomeGroup **will continue to be shared**.

              Instead of using HomeGroup, you can now share printers, files and folders by using features that are built into Windows 10:
              - [Share your network printer](https://www.bing.com/search?q=share+printer+windows+10)
              - [Share files in File Explorer](https://support.microsoft.com/help/4027674/windows-10-share-files-in-file-explorer) | 1803 | +|**Connect to suggested open hotspots** option in Wi-Fi settings |We previously [disabled the **Connect to suggested open hotspots** option](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) and are now removing it from the Wi-Fi settings page. You can manually connect to free wireless hotspots with **Network & Internet** settings, from the taskbar or Control Panel, or by using Wi-Fi Settings (for mobile devices).| 1803 | +|XPS Viewer|We're changing the way you get XPS Viewer. In Windows 10, version 1709 and earlier versions, the app is included in the installation image. If you have XPS Viewer and you update to Windows 10, version 1803, there's no action required. You'll still have XPS Viewer.

              However, if you install Windows 10, version 1803, on a new device (or as a clean installation), you may need to [install XPS Viewer from **Apps and Features** in the Settings app](https://docs.microsoft.com/windows/application-management/add-apps-and-features) or through [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you had XPS Viewer in Windows 10, version 1709, but manually removed it before updating, you'll need to manually reinstall it.| 1803 | +|3D Builder app | No longer installed by default. Consider using Print 3D and Paint 3D in its place. However, 3D Builder is still available for download from the Windows Store.| 1709 | +|Apndatabase.xml | For more information about the replacement database, see the following Hardware Dev Center articles:
              [MO Process to update COSA](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission)
              [COSA FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) | 1709 | +|Enhanced Mitigation Experience Toolkit (EMET) |Use of this feature will be blocked. Consider using [Exploit Protection](https://blogs.windows.com/windowsexperience/2017/06/28/) as a replacement. | 1709 | +|Outlook Express | This legacy application will be removed due to lack of functionality. | 1709 | +|Reader app | Functionality to be integrated into Microsoft Edge. | 1709 | +|Reading List | Functionality to be integrated into Microsoft Edge. | 1709 | +|Screen saver functionality in Themes | This functionality is disabled in Themes, and classified as **Removed** in this table. Screen saver functionality in Group Policies, Control Panel, and Sysprep continues to be functional. Lock screen features and policies are preferred. | 1709 | +|Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). | 1709 | +|TCP Offload Engine | Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| 1709 | +|Tile Data Layer |To be replaced by the Tile Store.| 1709 | +|Resilient File System (ReFS) (added: August 17, 2017)| Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability. | 1709 | +|Apps Corner| This Windows 10 mobile application is removed in the version 1703 release. | 1703 | +|By default, Flash autorun in Edge is turned off. | Use the Click-to-Run (C2R) option instead. (This setting can be changed by the user.) | 1703 | +|Interactive Service Detection Service| See [Interactive Services](https://docs.microsoft.com/windows/win32/services/interactive-services?redirectedfrom=MSDN) for guidance on how to keep software up to date. | 1703 | +|Microsoft Paint | This application will not be available for languages that are not on the [full localization list](https://www.microsoft.com/windows/windows-10-specifications#Windows-10-localization). | 1703 | +|NPN support in TLS | This feature is superseded by Application-Layer Protocol Negotiation (ALPN). | 1703 | +|Windows Information Protection "AllowUserDecryption" policy | Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported. | 1703 | +|WSUS for Windows Mobile | Updates are being transitioned to the new Unified Update Platform (UUP) | 1703 | diff --git a/windows/deployment/planning/windows-to-go-frequently-asked-questions.md b/windows/deployment/planning/windows-to-go-frequently-asked-questions.md index c48af35d6e..f0c41844f7 100644 --- a/windows/deployment/planning/windows-to-go-frequently-asked-questions.md +++ b/windows/deployment/planning/windows-to-go-frequently-asked-questions.md @@ -1,462 +1,463 @@ ---- -title: Windows To Go frequently asked questions (Windows 10) -description: Windows To Go frequently asked questions -ms.assetid: bfdfb824-4a19-4401-b369-22c5e6ca9d6e -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: FAQ, mobile, device, USB -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: mobility -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows To Go: frequently asked questions - - -**Applies to** - -- Windows 10 - ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. - -The following list identifies some commonly asked questions about Windows To Go. - -- [What is Windows To Go?](#wtg-faq-whatis) - -- [Does Windows To Go rely on virtualization?](#wtg-faq-virt) - -- [Who should use Windows To Go?](#wtg-faq-who) - -- [How can Windows To Go be deployed in an organization?](#wtg-faq-deploy) - -- [Is Windows To Go supported on both USB 2.0 and USB 3.0 drives?](#wtg-faq-usbvs) - -- [Is Windows To Go supported on USB 2.0 and USB 3.0 ports?](#wtg-faq-usbports) - -- [How do I identify a USB 3.0 port?](#wtg-faq-usb3port) - -- [Does Windows To Go run faster on a USB 3.0 port?](#wtg-faq-usb3speed) - -- [Can the user self-provision Windows To Go?](#wtg-faq-selfpro) - -- [How can Windows To Go be managed in an organization?](#wtg-faq-mng) - -- [How do I make my computer boot from USB?](#wtf-faq-startup) - -- [Why isn’t my computer booting from USB?](#wtg-faq-noboot) - -- [What happens if I remove my Windows To Go drive while it is running?](#wtg-faq-surprise) - -- [Can I use BitLocker to protect my Windows To Go drive?](#wtg-faq-bitlocker) - -- [Why can’t I enable BitLocker from Windows To Go Creator?](#wtg-faq-blfail) - -- [What power states does Windows To Go support?](#wtg-faq-power) - -- [Why is hibernation disabled in Windows To Go?](#wtg-faq-hibernate) - -- [Does Windows To Go support crash dump analysis?](#wtg-faq-crashdump) - -- [Do “Windows To Go Startup Options” work with dual boot computers?](#wtg-faq-dualboot) - -- [I plugged my Windows To Go drive into a running computer and I can’t see the partitions on the drive. Why not?](#wtg-faq-diskpart) - -- [I’m booted into Windows To Go, but I can’t browse to the internal hard drive of the host computer. Why not?](#wtg-faq-san4) - -- [Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition?](#wtg-faq-fatmbr) - -- [Is Windows To Go secure if I use it on an untrusted machine?](#wtg-faq-malhost) - -- [Does Windows To Go work with ARM processors?](#wtg-faq-arm) - -- [Can I synchronize data from Windows To Go with my other computer?](#wtg-faq-datasync) - -- [What size USB Flash Drive do I need to make a Windows To Go drive?](#wtg-faq-usbsz) - -- [Do I need to activate Windows To Go every time I roam?](#wtg-faq-roamact) - -- [Can I use all Windows features on Windows To Go?](#wtg-faq-features) - -- [Can I use all my applications on Windows To Go?](#wtg-faq-approam) - -- [Does Windows To Go work slower than standard Windows?](#wtg-faq-slow) - -- [If I lose my Windows To Go drive, will my data be safe?](#wtg-faq-safeloss) - -- [Can I boot Windows To Go on a Mac?](#wtg-faq-mac) - -- [Are there any APIs that allow applications to identify a Windows To Go workspace?](#wtg-faq-api) - -- [How is Windows To Go licensed?](#wtg-faq-lic) - -- [Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive?](#wtg-faq-recovery) - -- [Why won’t Windows To Go work on a computer running Windows XP or Windows Vista?](#wtg-faq-oldos) - -- [Why does the operating system on the host computer matter?](#wtg-faq-oldos2) - -- [My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?](#wtg-faq-blreckey) - -- [I decided to stop using a drive for Windows To Go and reformatted it – why doesn’t it have a drive letter assigned and how can I fix it?](#wtg-faq-reformat) - -- [Why do I keep on getting the message “Installing devices…” when I boot Windows To Go?](#bkmk-roamconflict) - -- [How do I upgrade the operating system on my Windows To Go drive?](#bkmk-upgradewtg) - -## What is Windows To Go? - - -Windows To Go is a feature for users of Windows 10 Enterprise and Windows 10 Education that enables users to boot a full version of Windows from external USB drives on host PCs. - -## Does Windows To Go rely on virtualization? - - -No. Windows To Go is a native instance of Windows 10 that runs from a USB device. It is just like a laptop hard drive with Windows 8 that has been put into a USB enclosure. - -## Who should use Windows To Go? - - -Windows To Go was designed for enterprise usage and targets scenarios such as continuance of operations, contractors, managed free seating, traveling workers, and work from home. - -## How can Windows To Go be deployed in an organization? - - -Windows To Go can be deployed using standard Windows deployment tools like Diskpart and DISM. The prerequisites for deploying Windows To Go are: - -- A Windows To Go recommended USB drive to provision; See the list of currently available USB drives at [Hardware considerations for Windows To Go](windows-to-go-overview.md#wtg-hardware) - -- A Windows 10 Enterprise or Windows 10 Education image - -- A Windows 10 Enterprise, Windows 10 Education or Windows 10 Professional host PC that can be used to provision new USB keys - -You can use a Windows PowerShell script to target several drives and scale your deployment for a large number of Windows To Go drives. You can also use a USB duplicator to duplicate a Windows To Go drive after it has been provisioned if you are creating a large number of drives. See the [Windows To Go Step by Step](https://go.microsoft.com/fwlink/p/?LinkId=618950) article on the TechNet wiki for a walkthrough of the drive creation process. - -## Is Windows To Go supported on both USB 2.0 and USB 3.0 drives? - - -No. Windows To Go is supported on USB 3.0 drives that are certified for Windows To Go. - -## Is Windows To Go supported on USB 2.0 and USB 3.0 ports? - - -Yes. Windows To Go is fully supported on either USB 2.0 ports or USB 3.0 ports on PCs certified for Windows 7 or later. - -## How do I identify a USB 3.0 port? - - -USB 3.0 ports are usually marked blue or carry a SS marking on the side. - -## Does Windows To Go run faster on a USB 3.0 port? - - -Yes. Because USB 3.0 offers significantly faster speeds than USB 2.0, a Windows To Go drive running on a USB 3.0 port will operate considerably faster. This speed increase applies to both drive provisioning and when the drive is being used as a workspace. - -## Can the user self-provision Windows To Go? - - -Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise, Windows 10 Education and Windows 10 Professional. Additionally, System Center 2012 Configuration Manager SP1 and later releases includes support for user self-provisioning of Windows To Go drives. Configuration Manager can be downloaded for evaluation from the [Microsoft TechNet Evaluation Center](https://go.microsoft.com/fwlink/p/?LinkID=618746). - -## How can Windows To Go be managed in an organization? - - -Windows To Go can be deployed and managed like a traditional desktop PC using standard Windows enterprise software distribution tools like System Center Configuration Manager. Computer and user settings for Windows To Go workspaces can be managed using Group Policy setting also in the same manner that you manage Group Policy settings for other PCs in your organization. Windows To Go workspaces can be configured to connect to the organizational resources remotely using DirectAccess or a virtual private network connection so that they can connect securely to your network. - -## How do I make my computer boot from USB? - - -For host computers running Windows 10 - -- Using Cortana, search for **Windows To Go startup options**, and then press Enter. -- In the **Windows To Go Startup Options** dialog box, select **Yes**, and then click **Save Changes** to configure the computer to boot from USB. - -For host computers running Windows 8 or Windows 8.1: - -Press **Windows logo key+W** and then search for **Windows To Go startup options** and then press Enter. - -In the **Windows To Go Startup Options** dialog box select **Yes** and then click **Save Changes** to configure the computer to boot from USB. - -**Note**   -Your IT department can use Group Policy to configure Windows To Go Startup Options in your organization. - - - -If the host computer is running an earlier version of the Windows operating system need to configure the computer to boot from USB manually. - -To do this, early during boot time (usually when you see the manufacturer’s logo), enter your firmware/BIOS setup. (This method to enter firmware/BIOS setup differs with different computer manufacturers, but is usually entered by pressing one of the function keys, such as F12, F2, F1, Esc, and so forth. You should check the manufacturer’s site to be sure if you do not know which key to use to enter firmware setup.) - -After you have entered firmware setup, make sure that boot from USB is enabled. Then change the boot order to boot from USB drives first. - -Alternatively, if your computer supports it, you can try to use the one-time boot menu (often F12), to select USB boot on a per-boot basis. - -For more detailed instructions, see the wiki article, [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). - -**Warning**   -Configuring a computer to boot from USB will cause your computer to attempt to boot from any bootable USB device connected to your computer. This potentially includes malicious devices. Users should be informed of this risk and instructed to not have any bootable USB storage devices plugged in to their computers except for their Windows To Go drive. - - - -## Why isn’t my computer booting from USB? - - -Computers certified for Windows 7 and later are required to have support for USB boot. Check to see if any of the following items apply to your situation: - -1. Ensure that your computer has the latest BIOS installed and the BIOS is configured to boot from a USB device. - -2. Ensure that the Windows To Go drive is connected directly to a USB port on the computer. Many computers don’t support booting from a device connected to a USB 3 PCI add-on card or external USB hubs. - -3. If the computer is not booting from a USB 3.0 port, try to boot from a USB 2.0 port. - -If none of these items enable the computer to boot from USB, contact the hardware manufacturer for additional support. - -## What happens if I remove my Windows To Go drive while it is running? - - -If the Windows To Go drive is removed, the computer will freeze and the user will have 60 seconds to reinsert the Windows To Go drive. If the Windows To Go drive is reinserted into the same port it was removed from, Windows will resume at the point where the drive was removed. If the USB drive is not reinserted, or is reinserted into a different port, the host computer will turn off after 60 seconds. - -**Warning**   -You should never remove your Windows To Go drive when your workspace is running. The computer freeze is a safety measure to help mitigate the risk of accidental removal. Removing the Windows To Go drive without shutting down the Windows To Go workspace could result in corruption of the Windows To Go drive. - - - -## Can I use BitLocker to protect my Windows To Go drive? - - -Yes. In Windows 8 and later, BitLocker has added support for using a password to protect operating system drives. This means that you can use a password to secure your Windows To Go workspace and you will be prompted to enter this password every time you use the Windows To Go workspace. - -## Why can’t I enable BitLocker from Windows To Go Creator? - - -Several different Group Policies control the use of BitLocker on your organizations computers. These policies are located in the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** folder of the local Group Policy editor. The folder contains three sub-folders for fixed, operating system and removable data drive types. - -When you are using Windows To Go Creator, the Windows To Go drive is considered a removable data drive by BitLocker. Review the following setting to see if these settings apply in your situation: - -1. **Control use of BitLocker on removable drives** - - If this setting is disabled BitLocker cannot be used with removable drives, so the Windows To Go Creator wizard will fail if it attempts to enable BitLocker on the Windows To Go drive. - -2. **Configure use of smart cards on removable data drives** - - If this setting is enabled and the option **Require use of smart cards on removable data drives** is also selected the creator wizard might fail if you have not already signed on using your smart card credentials before starting the Windows To Go Creator wizard. - -3. **Configure use of passwords for removable data drives** - - If this setting is enabled and the **Require password complexity option** is selected the computer must be able to connect to the domain controller to verify that the password specified meets the password complexity requirements. If the connection is not available, the Windows To Go Creator wizard will fail to enable BitLocker. - -Additionally, the Windows To Go Creator will disable the BitLocker option if the drive does not have any volumes. In this situation, you should initialize the drive and create a volume using the Disk Management console before provisioning the drive with Windows To Go. - -## What power states does Windows To Go support? - - -Windows To Go supports all power states except the hibernate class of power states, which include hybrid boot, hybrid sleep, and hibernate. This default behavior can be modified by using Group Policy settings to enable hibernation of the Windows To Go workspace. - -## Why is hibernation disabled in Windows To Go? - - -When a Windows To Go workspace is hibernated, it will only successfully resume on the exact same hardware. Therefore, if a Windows To Go workspace is hibernated on one computer and roamed to another, the hibernation state (and therefore user state) will be lost. To prevent this from happening, the default settings for a Windows To Go workspace disable hibernation. If you are confident that you will only attempt to resume on the same computer, you can enable hibernation using the Windows To Go Group Policy setting, **Allow hibernate (S4) when started from a Windows To Go workspace** that is located at **\\\\Computer Configuration\\Administrative Templates\\Windows Components\\Portable Operating System\\** in the Local Group Policy Editor (gpedit.msc). - -## Does Windows To Go support crash dump analysis? - - -Yes. Windows 8 and later support crash dump stack analysis for both USB 2.0 and 3.0. - -## Do “Windows To Go Startup Options” work with dual boot computers? - - -Yes, if both operating systems are running the Windows 8 operating system. Enabling “Windows To Go Startup Options” should cause the computer to boot from the Windows To Go workspace when the drive is plugged in before the computer is turned on. - -If you have configured a dual boot computer with a Windows operating system and another operating system it might work occasionally and fail occasionally. Using this configuration is unsupported. - -## I plugged my Windows To Go drive into a running computer and I can’t see the partitions on the drive. Why not? - - -Windows To Go Creator and the recommended deployment steps for Windows To Go set the NO\_DEFAULT\_DRIVE\_LETTER flag on the Windows To Go drive. This flag prevents Windows from automatically assigning drive letters to the partitions on the Windows To Go drive. That’s why you can’t see the partitions on the drive when you plug your Windows To Go drive into a running computer. This helps prevent accidental data leakage between the Windows To Go drive and the host computer. If you really need to access the files on the Windows To Go drive from a running computer, you can use diskmgmt.msc or diskpart to assign a drive letter. - -**Warning**   -It is strongly recommended that you do not plug your Windows To Go drive into a running computer. If the computer is compromised, your Windows To Go workspace can also be compromised. - - - -## I’m booted into Windows To Go, but I can’t browse to the internal hard drive of the host computer. Why not? - - -Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That’s why you can’t see the internal hard drives of the host computer when you are booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive. - -**Warning**   -It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. - - - -## Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition? - - -This is done to allow Windows To Go to boot from UEFI and legacy systems. - -## Is Windows To Go secure if I use it on an untrusted computer? - - -While you are more secure than if you use a completely untrusted operating system, you are still vulnerable to attacks from the firmware or anything that runs before Windows To Go starts. If you plug your Windows To Go drive into a running untrusted computer, your Windows To Go drive can be compromised because any malicious software that might be active on the computer can access the drive. - -## Does Windows To Go work with ARM processors? - - -No. Windows RT is a specialized version of Windows designed for ARM processors. Windows To Go is currently only supported on PCs with x86 or x64-based processors. - -## Can I synchronize data from Windows To Go with my other computer? - - -To get your data across all your computers, we recommend using folder redirection and client side caching to store copies of your data on a server while giving you offline access to the files you need. - -## What size USB flash drive do I need to make a Windows To Go drive? - - -The size constraints are the same as full Windows. To ensure that you have enough space for Windows, your data, and your applications, we recommend USB drives that are a minimum of 20 GB in size. - -## Do I need to activate Windows To Go every time I roam? - - -No, Windows To Go requires volume activation; either using the [Key Management Service](https://go.microsoft.com/fwlink/p/?LinkId=619051) (KMS) server in your organization or using [Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=619053) based volume activation. The Windows To Go workspace will not need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or a through remote connection using DirectAccess or a virtual private network connection), once activated the machine will not need to be activated again until the activation validity interval has passed. In a KMS configuration the activation validity interval is 180 days. - -## Can I use all Windows features on Windows To Go? - - -Yes, with some minor exceptions, you can use all Windows features with your Windows To Go workspace. The only currently unsupported features are using the Windows Recovery Environment and PC Reset & Refresh. - -## Can I use all my applications on Windows To Go? - - -Yes. Because your Windows To Go workspace is a full Windows 10 environment, all applications that work with Windows 10 should work in your Windows To Go workspace. However, any applications that use hardware binding (usually for licensing and/or digital rights management reasons) may not run when you roam your Windows To Go drive between different host computers, and you may have to use those applications on the same host computer every time. - -## Does Windows To Go work slower than standard Windows? - - -If you are using a USB 3.0 port and a Windows To Go certified device, there should be no perceivable difference between standard Windows and Windows To Go. However, if you are booting from a USB 2.0 port, you may notice some slowdown since USB 2.0 transfer speeds are slower than SATA speeds. - -## If I lose my Windows To Go drive, will my data be safe? - - -Yes! If you enable BitLocker on your Windows To Go drive, all your data will be encrypted and protected and a malicious user will not be able to access your data without your password. If you don’t enable BitLocker, your data will be vulnerable if you lose your Windows To Go drive. - -## Can I boot Windows To Go on a Mac? - - -We are committed to give customers a consistent and quality Windows 10 experience with Windows To Go. Windows To Go supports host devices certified for use with Windows 7 or later. Because Mac computers are not certified for use with Windows 7 or later, using Windows To Go is not supported on a Mac. - -## Are there any APIs that allow applications to identify a Windows To Go workspace? - - -Yes. You can use a combination of identifiers to determine if the currently running operating system is a Windows To Go workspace. First, check if the **PortableOperatingSystem** property is true. When that value is true it means that the operating system was booted from an external USB device. - -Next, check if the **OperatingSystemSKU** property is equal to **4** (for Windows 10 Enterprise) or **121** (for Windows 10 Education). The combination of those two properties represents a Windows To Go workspace environment. - -For more information, see the MSDN article on the [Win32\_OperatingSystem class](https://go.microsoft.com/fwlink/p/?LinkId=619059). - -## How is Windows To Go licensed? - - -Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. - -## Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive? - - -No, use of Windows Recovery Environment is not supported on Windows To Go. It is recommended that you implement user state virtualization technologies like Folder Redirection to centralize and back up user data in the data center. If any corruption occurs on a Windows To Go drive, you should re-provision the workspace. - -## Why won’t Windows To Go work on a computer running Windows XP or Windows Vista? - - -Actually it might. If you have purchased a computer certified for Windows 7 or later and then installed an older operating system, Windows To Go will boot and run as expected as long as you have configured the firmware to boot from USB. However, if the computer was certified for Windows XP or Windows Vista, it might not meet the hardware requirements for Windows To Go to run. Typically computers certified for Windows Vista and earlier operating systems have less memory, less processing power, reduced video rendering, and slower USB ports. - -## Why does the operating system on the host computer matter? - - -It doesn’t other than to help visually identify if the PC has compatible hardware. For a PC to be certified for Windows 7 or later it had to support booting from USB. If a computer cannot boot from USB there is no way that it can be used with Windows To Go. The Windows To Go workspace is a full Windows 10 environment, so all of the hardware requirements of Windows 10 with respect to processing speed, memory usage, and graphics rendering need to be supported to be assured that it will work as expected. - -## My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go? - - -The default BitLocker protection profile in Windows 7 monitors the host computer for changes to the boot order as part of protecting the computer from tampering. When you change the boot order of the host computer to enable it to boot from the Windows To Go drive, the BitLocker system measurements will reflect that change and boot into recovery mode so that the computer can be inspected if necessary. - -You can reset the BitLocker system measurements to incorporate the new boot order using the following steps: - -1. Log on to the host computer using an account with administrator privileges. - -2. Click **Start**, click **Control Panel**, click **System and Security**, and then click **BitLocker Drive Encryption**. - -3. Click **Suspend Protection** for the operating system drive. - - A message is displayed, informing you that your data will not be protected while BitLocker is suspended and asking if you want to suspend BitLocker Drive Encryption. Click **Yes** to continue and suspend BitLocker on the drive. - -4. Restart the computer and enter the firmware settings to reset the boot order to boot from USB first. For more information on changing the boot order in the BIOS, see [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) on the TechNet wiki. - -5. Restart the computer again and then log on to the host computer using an account with administrator privileges. (Neither your Windows To Go drive nor any other USB drive should be inserted.) - -6. Click **Start**, click **Control Panel**, click **System and Security**, and then click **BitLocker Drive Encryption**. - -7. Click **Resume Protection** to re-enable BitLocker protection. - -The host computer will now be able to be booted from a USB drive without triggering recovery mode. - -**Note**   -The default BitLocker protection profile in Windows 8 or later does not monitor the boot order. - - - -## I decided to stop using a drive for Windows To Go and reformatted it – why doesn’t it have a drive letter assigned and how can I fix it? - - -Reformatting the drive erases the data on the drive, but doesn’t reconfigure the volume attributes. When a drive is provisioned for use as a Windows To Go drive the NODEFAULTDRIVELETTER attribute is set on the volume. To remove this attribute, use the following steps: - -1. Open a command prompt with full administrator permissions. - - **Note**   - If your user account is a member of the Administrators group, but is not the Administrator account itself, then, by default, the programs that you run only have standard user permissions unless you explicitly choose to elevate them. - - - -2. Start the [diskpart](https://go.microsoft.com/fwlink/p/?LinkId=619070) command interpreter, by typing `diskpart` at the command prompt. - -3. Use the `select disk` command to identify the drive. If you do not know the drive number, use the `list` command to display the list of disks available. - -4. After selecting the disk, run the `clean` command to remove all data, formatting, and initialization information from the drive. - -## Why do I keep on getting the message “Installing devices…” when I boot Windows To Go? - - -One of the challenges involved in moving the Windows To Go drive between PCs while seamlessly booting Windows with access to all of their applications and data is that for Windows to be fully functional, specific drivers need to be installed for the hardware in each machine that runs Windows. Windows 8 or later has a process called respecialize which will identify new drivers that need to be loaded for the new PC and disable drivers which are not present on the new configuration. In general this feature is reliable and efficient when roaming between PCs of widely varying hardware configurations. - -In certain cases, third party drivers for different hardware models or versions can reuse device ID’s, driver file names, registry keys (or any other operating system constructs which do not support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID’s, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver. - -This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message “Installing devices…” displaying every time that a Windows to Go drive is roamed between two PCs which require conflicting drivers. - -## How do I upgrade the operating system on my Windows To Go drive? - - -There is no support in Windows for upgrading a Windows To Go drive. Deployed Windows To Go drives with older versions of Windows will need to be re-imaged with a new version of Windows in order to transition to the new operating system version. - -## Additional resources - - -- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) - -- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) - -- [Windows To Go: feature overview](windows-to-go-overview.md) - -- [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) - -- [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) - -- [Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) - - - - - - - - - +--- +title: Windows To Go frequently asked questions (Windows 10) +description: Though Windows To Go is no longer being developed, these frequently asked questions (FAQ) can provide answers about the feature. +ms.assetid: bfdfb824-4a19-4401-b369-22c5e6ca9d6e +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: FAQ, mobile, device, USB +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: mobility +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows To Go: frequently asked questions + + +**Applies to** + +- Windows 10 + +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. + +The following list identifies some commonly asked questions about Windows To Go. + +- [What is Windows To Go?](#wtg-faq-whatis) + +- [Does Windows To Go rely on virtualization?](#wtg-faq-virt) + +- [Who should use Windows To Go?](#wtg-faq-who) + +- [How can Windows To Go be deployed in an organization?](#wtg-faq-deploy) + +- [Is Windows To Go supported on both USB 2.0 and USB 3.0 drives?](#wtg-faq-usbvs) + +- [Is Windows To Go supported on USB 2.0 and USB 3.0 ports?](#wtg-faq-usbports) + +- [How do I identify a USB 3.0 port?](#wtg-faq-usb3port) + +- [Does Windows To Go run faster on a USB 3.0 port?](#wtg-faq-usb3speed) + +- [Can the user self-provision Windows To Go?](#wtg-faq-selfpro) + +- [How can Windows To Go be managed in an organization?](#wtg-faq-mng) + +- [How do I make my computer boot from USB?](#wtf-faq-startup) + +- [Why isn't my computer booting from USB?](#wtg-faq-noboot) + +- [What happens if I remove my Windows To Go drive while it is running?](#wtg-faq-surprise) + +- [Can I use BitLocker to protect my Windows To Go drive?](#wtg-faq-bitlocker) + +- [Why can't I enable BitLocker from Windows To Go Creator?](#wtg-faq-blfail) + +- [What power states does Windows To Go support?](#wtg-faq-power) + +- [Why is hibernation disabled in Windows To Go?](#wtg-faq-hibernate) + +- [Does Windows To Go support crash dump analysis?](#wtg-faq-crashdump) + +- [Do "Windows To Go Startup Options" work with dual boot computers?](#wtg-faq-dualboot) + +- [I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not?](#wtg-faq-diskpart) + +- [I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not?](#wtg-faq-san4) + +- [Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition?](#wtg-faq-fatmbr) + +- [Is Windows To Go secure if I use it on an untrusted machine?](#wtg-faq-malhost) + +- [Does Windows To Go work with ARM processors?](#wtg-faq-arm) + +- [Can I synchronize data from Windows To Go with my other computer?](#wtg-faq-datasync) + +- [What size USB Flash Drive do I need to make a Windows To Go drive?](#wtg-faq-usbsz) + +- [Do I need to activate Windows To Go every time I roam?](#wtg-faq-roamact) + +- [Can I use all Windows features on Windows To Go?](#wtg-faq-features) + +- [Can I use all my applications on Windows To Go?](#wtg-faq-approam) + +- [Does Windows To Go work slower than standard Windows?](#wtg-faq-slow) + +- [If I lose my Windows To Go drive, will my data be safe?](#wtg-faq-safeloss) + +- [Can I boot Windows To Go on a Mac?](#wtg-faq-mac) + +- [Are there any APIs that allow applications to identify a Windows To Go workspace?](#wtg-faq-api) + +- [How is Windows To Go licensed?](#wtg-faq-lic) + +- [Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive?](#wtg-faq-recovery) + +- [Why won't Windows To Go work on a computer running Windows XP or Windows Vista?](#wtg-faq-oldos) + +- [Why does the operating system on the host computer matter?](#wtg-faq-oldos2) + +- [My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?](#wtg-faq-blreckey) + +- [I decided to stop using a drive for Windows To Go and reformatted it – why doesn't it have a drive letter assigned and how can I fix it?](#wtg-faq-reformat) + +- [Why do I keep on getting the message "Installing devices…" when I boot Windows To Go?](#bkmk-roamconflict) + +- [How do I upgrade the operating system on my Windows To Go drive?](#bkmk-upgradewtg) + +## What is Windows To Go? + + +Windows To Go is a feature for users of Windows 10 Enterprise and Windows 10 Education that enables users to boot a full version of Windows from external USB drives on host PCs. + +## Does Windows To Go rely on virtualization? + + +No. Windows To Go is a native instance of Windows 10 that runs from a USB device. It is just like a laptop hard drive with Windows 8 that has been put into a USB enclosure. + +## Who should use Windows To Go? + + +Windows To Go was designed for enterprise usage and targets scenarios such as continuance of operations, contractors, managed free seating, traveling workers, and work from home. + +## How can Windows To Go be deployed in an organization? + + +Windows To Go can be deployed using standard Windows deployment tools like Diskpart and DISM. The prerequisites for deploying Windows To Go are: + +- A Windows To Go recommended USB drive to provision; See the list of currently available USB drives at [Hardware considerations for Windows To Go](windows-to-go-overview.md#wtg-hardware) + +- A Windows 10 Enterprise or Windows 10 Education image + +- A Windows 10 Enterprise, Windows 10 Education or Windows 10 Professional host PC that can be used to provision new USB keys + +You can use a Windows PowerShell script to target several drives and scale your deployment for a large number of Windows To Go drives. You can also use a USB duplicator to duplicate a Windows To Go drive after it has been provisioned if you are creating a large number of drives. See the [Windows To Go Step by Step](https://go.microsoft.com/fwlink/p/?LinkId=618950) article on the TechNet wiki for a walkthrough of the drive creation process. + +## Is Windows To Go supported on both USB 2.0 and USB 3.0 drives? + + +No. Windows To Go is supported on USB 3.0 drives that are certified for Windows To Go. + +## Is Windows To Go supported on USB 2.0 and USB 3.0 ports? + + +Yes. Windows To Go is fully supported on either USB 2.0 ports or USB 3.0 ports on PCs certified for Windows 7 or later. + +## How do I identify a USB 3.0 port? + + +USB 3.0 ports are usually marked blue or carry a SS marking on the side. + +## Does Windows To Go run faster on a USB 3.0 port? + + +Yes. Because USB 3.0 offers significantly faster speeds than USB 2.0, a Windows To Go drive running on a USB 3.0 port will operate considerably faster. This speed increase applies to both drive provisioning and when the drive is being used as a workspace. + +## Can the user self-provision Windows To Go? + + +Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise, Windows 10 Education and Windows 10 Professional. Additionally, System Center 2012 Configuration Manager SP1 and later releases includes support for user self-provisioning of Windows To Go drives. Configuration Manager can be downloaded for evaluation from the [Microsoft TechNet Evaluation Center](https://go.microsoft.com/fwlink/p/?LinkID=618746). + +## How can Windows To Go be managed in an organization? + + +Windows To Go can be deployed and managed like a traditional desktop PC using standard Windows enterprise software distribution tools like Microsoft Endpoint Configuration Manager. Computer and user settings for Windows To Go workspaces can be managed using Group Policy setting also in the same manner that you manage Group Policy settings for other PCs in your organization. Windows To Go workspaces can be configured to connect to the organizational resources remotely using DirectAccess or a virtual private network connection so that they can connect securely to your network. + +## How do I make my computer boot from USB? + + +For host computers running Windows 10 + +- Using Cortana, search for **Windows To Go startup options**, and then press Enter. +- In the **Windows To Go Startup Options** dialog box, select **Yes**, and then click **Save Changes** to configure the computer to boot from USB. + +For host computers running Windows 8 or Windows 8.1: + +Press **Windows logo key+W** and then search for **Windows To Go startup options** and then press Enter. + +In the **Windows To Go Startup Options** dialog box select **Yes** and then click **Save Changes** to configure the computer to boot from USB. + +> [!NOTE] +> Your IT department can use Group Policy to configure Windows To Go Startup Options in your organization. + + + +If the host computer is running an earlier version of the Windows operating system need to configure the computer to boot from USB manually. + +To do this, early during boot time (usually when you see the manufacturer's logo), enter your firmware/BIOS setup. (This method to enter firmware/BIOS setup differs with different computer manufacturers, but is usually entered by pressing one of the function keys, such as F12, F2, F1, Esc, and so forth. You should check the manufacturer's site to be sure if you do not know which key to use to enter firmware setup.) + +After you have entered firmware setup, make sure that boot from USB is enabled. Then change the boot order to boot from USB drives first. + +Alternatively, if your computer supports it, you can try to use the one-time boot menu (often F12), to select USB boot on a per-boot basis. + +For more detailed instructions, see the wiki article, [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). + +**Warning**   +Configuring a computer to boot from USB will cause your computer to attempt to boot from any bootable USB device connected to your computer. This potentially includes malicious devices. Users should be informed of this risk and instructed to not have any bootable USB storage devices plugged in to their computers except for their Windows To Go drive. + + + +## Why isn't my computer booting from USB? + + +Computers certified for Windows 7 and later are required to have support for USB boot. Check to see if any of the following items apply to your situation: + +1. Ensure that your computer has the latest BIOS installed and the BIOS is configured to boot from a USB device. + +2. Ensure that the Windows To Go drive is connected directly to a USB port on the computer. Many computers don't support booting from a device connected to a USB 3 PCI add-on card or external USB hubs. + +3. If the computer is not booting from a USB 3.0 port, try to boot from a USB 2.0 port. + +If none of these items enable the computer to boot from USB, contact the hardware manufacturer for additional support. + +## What happens if I remove my Windows To Go drive while it is running? + + +If the Windows To Go drive is removed, the computer will freeze and the user will have 60 seconds to reinsert the Windows To Go drive. If the Windows To Go drive is reinserted into the same port it was removed from, Windows will resume at the point where the drive was removed. If the USB drive is not reinserted, or is reinserted into a different port, the host computer will turn off after 60 seconds. + +**Warning**   +You should never remove your Windows To Go drive when your workspace is running. The computer freeze is a safety measure to help mitigate the risk of accidental removal. Removing the Windows To Go drive without shutting down the Windows To Go workspace could result in corruption of the Windows To Go drive. + + + +## Can I use BitLocker to protect my Windows To Go drive? + + +Yes. In Windows 8 and later, BitLocker has added support for using a password to protect operating system drives. This means that you can use a password to secure your Windows To Go workspace and you will be prompted to enter this password every time you use the Windows To Go workspace. + +## Why can't I enable BitLocker from Windows To Go Creator? + + +Several different Group Policies control the use of BitLocker on your organizations computers. These policies are located in the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** folder of the local Group Policy editor. The folder contains three sub-folders for fixed, operating system and removable data drive types. + +When you are using Windows To Go Creator, the Windows To Go drive is considered a removable data drive by BitLocker. Review the following setting to see if these settings apply in your situation: + +1. **Control use of BitLocker on removable drives** + + If this setting is disabled BitLocker cannot be used with removable drives, so the Windows To Go Creator wizard will fail if it attempts to enable BitLocker on the Windows To Go drive. + +2. **Configure use of smart cards on removable data drives** + + If this setting is enabled and the option **Require use of smart cards on removable data drives** is also selected the creator wizard might fail if you have not already signed on using your smart card credentials before starting the Windows To Go Creator wizard. + +3. **Configure use of passwords for removable data drives** + + If this setting is enabled and the **Require password complexity option** is selected the computer must be able to connect to the domain controller to verify that the password specified meets the password complexity requirements. If the connection is not available, the Windows To Go Creator wizard will fail to enable BitLocker. + +Additionally, the Windows To Go Creator will disable the BitLocker option if the drive does not have any volumes. In this situation, you should initialize the drive and create a volume using the Disk Management console before provisioning the drive with Windows To Go. + +## What power states does Windows To Go support? + + +Windows To Go supports all power states except the hibernate class of power states, which include hybrid boot, hybrid sleep, and hibernate. This default behavior can be modified by using Group Policy settings to enable hibernation of the Windows To Go workspace. + +## Why is hibernation disabled in Windows To Go? + + +When a Windows To Go workspace is hibernated, it will only successfully resume on the exact same hardware. Therefore, if a Windows To Go workspace is hibernated on one computer and roamed to another, the hibernation state (and therefore user state) will be lost. To prevent this from happening, the default settings for a Windows To Go workspace disable hibernation. If you are confident that you will only attempt to resume on the same computer, you can enable hibernation using the Windows To Go Group Policy setting, **Allow hibernate (S4) when started from a Windows To Go workspace** that is located at **\\\\Computer Configuration\\Administrative Templates\\Windows Components\\Portable Operating System\\** in the Local Group Policy Editor (gpedit.msc). + +## Does Windows To Go support crash dump analysis? + + +Yes. Windows 8 and later support crash dump stack analysis for both USB 2.0 and 3.0. + +## Do "Windows To Go Startup Options" work with dual boot computers? + + +Yes, if both operating systems are running the Windows 8 operating system. Enabling "Windows To Go Startup Options" should cause the computer to boot from the Windows To Go workspace when the drive is plugged in before the computer is turned on. + +If you have configured a dual boot computer with a Windows operating system and another operating system it might work occasionally and fail occasionally. Using this configuration is unsupported. + +## I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not? + + +Windows To Go Creator and the recommended deployment steps for Windows To Go set the NO\_DEFAULT\_DRIVE\_LETTER flag on the Windows To Go drive. This flag prevents Windows from automatically assigning drive letters to the partitions on the Windows To Go drive. That's why you can't see the partitions on the drive when you plug your Windows To Go drive into a running computer. This helps prevent accidental data leakage between the Windows To Go drive and the host computer. If you really need to access the files on the Windows To Go drive from a running computer, you can use diskmgmt.msc or diskpart to assign a drive letter. + +**Warning**   +It is strongly recommended that you do not plug your Windows To Go drive into a running computer. If the computer is compromised, your Windows To Go workspace can also be compromised. + + + +## I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not? + + +Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That's why you can't see the internal hard drives of the host computer when you are booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive. + +**Warning**   +It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. + + + +## Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition? + + +This is done to allow Windows To Go to boot from UEFI and legacy systems. + +## Is Windows To Go secure if I use it on an untrusted computer? + + +While you are more secure than if you use a completely untrusted operating system, you are still vulnerable to attacks from the firmware or anything that runs before Windows To Go starts. If you plug your Windows To Go drive into a running untrusted computer, your Windows To Go drive can be compromised because any malicious software that might be active on the computer can access the drive. + +## Does Windows To Go work with ARM processors? + + +No. Windows RT is a specialized version of Windows designed for ARM processors. Windows To Go is currently only supported on PCs with x86 or x64-based processors. + +## Can I synchronize data from Windows To Go with my other computer? + + +To get your data across all your computers, we recommend using folder redirection and client side caching to store copies of your data on a server while giving you offline access to the files you need. + +## What size USB flash drive do I need to make a Windows To Go drive? + + +The size constraints are the same as full Windows. To ensure that you have enough space for Windows, your data, and your applications, we recommend USB drives that are a minimum of 20 GB in size. + +## Do I need to activate Windows To Go every time I roam? + + +No, Windows To Go requires volume activation; either using the [Key Management Service](https://go.microsoft.com/fwlink/p/?LinkId=619051) (KMS) server in your organization or using [Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=619053) based volume activation. The Windows To Go workspace will not need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or a through remote connection using DirectAccess or a virtual private network connection), once activated the machine will not need to be activated again until the activation validity interval has passed. In a KMS configuration the activation validity interval is 180 days. + +## Can I use all Windows features on Windows To Go? + + +Yes, with some minor exceptions, you can use all Windows features with your Windows To Go workspace. The only currently unsupported features are using the Windows Recovery Environment and PC Reset & Refresh. + +## Can I use all my applications on Windows To Go? + + +Yes. Because your Windows To Go workspace is a full Windows 10 environment, all applications that work with Windows 10 should work in your Windows To Go workspace. However, any applications that use hardware binding (usually for licensing and/or digital rights management reasons) may not run when you roam your Windows To Go drive between different host computers, and you may have to use those applications on the same host computer every time. + +## Does Windows To Go work slower than standard Windows? + + +If you are using a USB 3.0 port and a Windows To Go certified device, there should be no perceivable difference between standard Windows and Windows To Go. However, if you are booting from a USB 2.0 port, you may notice some slowdown since USB 2.0 transfer speeds are slower than SATA speeds. + +## If I lose my Windows To Go drive, will my data be safe? + + +Yes! If you enable BitLocker on your Windows To Go drive, all your data will be encrypted and protected and a malicious user will not be able to access your data without your password. If you don't enable BitLocker, your data will be vulnerable if you lose your Windows To Go drive. + +## Can I boot Windows To Go on a Mac? + + +We are committed to give customers a consistent and quality Windows 10 experience with Windows To Go. Windows To Go supports host devices certified for use with Windows 7 or later. Because Mac computers are not certified for use with Windows 7 or later, using Windows To Go is not supported on a Mac. + +## Are there any APIs that allow applications to identify a Windows To Go workspace? + + +Yes. You can use a combination of identifiers to determine if the currently running operating system is a Windows To Go workspace. First, check if the **PortableOperatingSystem** property is true. When that value is true it means that the operating system was booted from an external USB device. + +Next, check if the **OperatingSystemSKU** property is equal to **4** (for Windows 10 Enterprise) or **121** (for Windows 10 Education). The combination of those two properties represents a Windows To Go workspace environment. + +For more information, see the MSDN article on the [Win32\_OperatingSystem class](https://go.microsoft.com/fwlink/p/?LinkId=619059). + +## How is Windows To Go licensed? + + +Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. + +## Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive? + + +No, use of Windows Recovery Environment is not supported on Windows To Go. It is recommended that you implement user state virtualization technologies like Folder Redirection to centralize and back up user data in the data center. If any corruption occurs on a Windows To Go drive, you should re-provision the workspace. + +## Why won't Windows To Go work on a computer running Windows XP or Windows Vista? + + +Actually it might. If you have purchased a computer certified for Windows 7 or later and then installed an older operating system, Windows To Go will boot and run as expected as long as you have configured the firmware to boot from USB. However, if the computer was certified for Windows XP or Windows Vista, it might not meet the hardware requirements for Windows To Go to run. Typically computers certified for Windows Vista and earlier operating systems have less memory, less processing power, reduced video rendering, and slower USB ports. + +## Why does the operating system on the host computer matter? + + +It doesn't other than to help visually identify if the PC has compatible hardware. For a PC to be certified for Windows 7 or later it had to support booting from USB. If a computer cannot boot from USB there is no way that it can be used with Windows To Go. The Windows To Go workspace is a full Windows 10 environment, so all of the hardware requirements of Windows 10 with respect to processing speed, memory usage, and graphics rendering need to be supported to be assured that it will work as expected. + +## My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go? + + +The default BitLocker protection profile in Windows 7 monitors the host computer for changes to the boot order as part of protecting the computer from tampering. When you change the boot order of the host computer to enable it to boot from the Windows To Go drive, the BitLocker system measurements will reflect that change and boot into recovery mode so that the computer can be inspected if necessary. + +You can reset the BitLocker system measurements to incorporate the new boot order using the following steps: + +1. Log on to the host computer using an account with administrator privileges. + +2. Click **Start**, click **Control Panel**, click **System and Security**, and then click **BitLocker Drive Encryption**. + +3. Click **Suspend Protection** for the operating system drive. + + A message is displayed, informing you that your data will not be protected while BitLocker is suspended and asking if you want to suspend BitLocker Drive Encryption. Click **Yes** to continue and suspend BitLocker on the drive. + +4. Restart the computer and enter the firmware settings to reset the boot order to boot from USB first. For more information on changing the boot order in the BIOS, see [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) on the TechNet wiki. + +5. Restart the computer again and then log on to the host computer using an account with administrator privileges. (Neither your Windows To Go drive nor any other USB drive should be inserted.) + +6. Click **Start**, click **Control Panel**, click **System and Security**, and then click **BitLocker Drive Encryption**. + +7. Click **Resume Protection** to re-enable BitLocker protection. + +The host computer will now be able to be booted from a USB drive without triggering recovery mode. + +> [!NOTE] +> The default BitLocker protection profile in Windows 8 or later does not monitor the boot order. + + + +## I decided to stop using a drive for Windows To Go and reformatted it – why doesn't it have a drive letter assigned and how can I fix it? + + +Reformatting the drive erases the data on the drive, but doesn't reconfigure the volume attributes. When a drive is provisioned for use as a Windows To Go drive the NODEFAULTDRIVELETTER attribute is set on the volume. To remove this attribute, use the following steps: + +1. Open a command prompt with full administrator permissions. + + > [!NOTE] + > If your user account is a member of the Administrators group, but is not the Administrator account itself, then, by default, the programs that you run only have standard user permissions unless you explicitly choose to elevate them. + + + +2. Start the [diskpart](https://go.microsoft.com/fwlink/p/?LinkId=619070) command interpreter, by typing `diskpart` at the command prompt. + +3. Use the `select disk` command to identify the drive. If you do not know the drive number, use the `list` command to display the list of disks available. + +4. After selecting the disk, run the `clean` command to remove all data, formatting, and initialization information from the drive. + +## Why do I keep on getting the message "Installing devices…" when I boot Windows To Go? + + +One of the challenges involved in moving the Windows To Go drive between PCs while seamlessly booting Windows with access to all of their applications and data is that for Windows to be fully functional, specific drivers need to be installed for the hardware in each machine that runs Windows. Windows 8 or later has a process called respecialize which will identify new drivers that need to be loaded for the new PC and disable drivers which are not present on the new configuration. In general this feature is reliable and efficient when roaming between PCs of widely varying hardware configurations. + +In certain cases, third party drivers for different hardware models or versions can reuse device ID's, driver file names, registry keys (or any other operating system constructs which do not support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID's, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver. + +This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message "Installing devices…" displaying every time that a Windows to Go drive is roamed between two PCs which require conflicting drivers. + +## How do I upgrade the operating system on my Windows To Go drive? + + +There is no support in Windows for upgrading a Windows To Go drive. Deployed Windows To Go drives with older versions of Windows will need to be re-imaged with a new version of Windows in order to transition to the new operating system version. + +## Additional resources + + +- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) + +- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) + +- [Windows To Go: feature overview](windows-to-go-overview.md) + +- [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) + +- [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) + +- [Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) + + + + + + + + + diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index 3ed1e2e88c..c978295e6e 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -1,284 +1,239 @@ ---- -title: Windows To Go feature overview (Windows 10) -description: Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. -ms.assetid: 9df82b03-acba-442c-801d-56db241f8d42 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: workspace, mobile, installation, image, USB, device, image, edu -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: mobility, edu -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows To Go: feature overview - - -**Applies to** - -- Windows 10 - ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. - -Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. - -PCs that meet the Windows 7 or later [certification requirements](https://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: - -- [Differences between Windows To Go and a typical installation of Windows](#bkmk-wtgdif) -- [Roaming with Windows To Go](#bkmk-wtgroam) -- [Prepare for Windows To Go](#wtg-prep-intro) -- [Hardware considerations for Windows To Go](#wtg-hardware) - -**Note**   -Windows To Go is not supported on Windows RT. - - - -## Differences between Windows To Go and a typical installation of Windows - - -Windows To Go workspace operates just like any other installation of Windows with a few exceptions. These exceptions are: - -- **Internal disks are offline.** To ensure data isn’t accidentally disclosed, internal hard disks on the host computer are offline by default when booted into a Windows To Go workspace. Similarly if a Windows To Go drive is inserted into a running system, the Windows To Go drive will not be listed in Windows Explorer. - -- **Trusted Platform Module (TPM) is not used.** When using BitLocker Drive Encryption a pre-operating system boot password will be used for security rather than the TPM since the TPM is tied to a specific computer and Windows To Go drives will move between computers. - -- **Hibernate is disabled by default.** To ensure that the Windows To Go workspace is able to move between computers easily, hibernation is disabled by default. Hibernation can be re-enabled by using Group Policy settings. - -- **Windows Recovery Environment is not available.** In the rare case that you need to recover your Windows To Go drive, you should re-image it with a fresh image of Windows. - -- **Refreshing or resetting a Windows To Go workspace is not supported.** Resetting to the manufacturer’s standard for the computer doesn’t apply when running a Windows To Go workspace, so the feature was disabled. - -- **Upgrading a Windows To Go workspace is not supported.** Older Windows 8 or Windows 8.1 Windows To Go workspaces cannot be upgraded to Windows 10 workspaces, nor can Windows 10 Windows To Go workspaces be upgraded to future versions of Windows 10. For new versions, the workspace needs to be re-imaged with a fresh image of Windows. - -## Roaming with Windows To Go - - -Windows To Go drives can be booted on multiple computers. When a Windows To Go workspace is first booted on a host computer it will detect all hardware on the computer and install any needed drivers. When the Windows To Go workspace is subsequently booted on that host computer it will be able to identify the host computer and load the correct set of drivers automatically. - -The applications that you want to use from the Windows To Go workspace should be tested to make sure they also support roaming. Some applications bind to the computer hardware which will cause difficulties if the workspace is being used with multiple host computers. - -## Prepare for Windows To Go - - -Enterprises install Windows on a large group of computers either by using configuration management software (such as System Center Configuration Manager), or by using standard Windows deployment tools such as DiskPart and the Deployment Image Servicing and Management (DISM) tool. - -These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) to review deployment tools available. - -**Important**   -Make sure you use the versions of the deployment tools provided for the version of Windows you are deploying. There have been many enhancements made to support Windows To Go. Using versions of the deployment tools released for earlier versions of Windows to provision a Windows To Go drive is not supported. - - - -As you decide what to include in your Windows To Go image, be sure to consider the following questions: - -Are there any drivers that you need to inject into the image? - -How will data be stored and synchronized to appropriate locations from the USB device? - -Are there any applications that are incompatible with Windows To Go roaming that should not be included in the image? - -What should be the architecture of the image - 32bit/64bit? - -What remote connectivity solution should be supported in the image if Windows To Go is used outside the corporate network? - -For more information about designing and planning your Windows To Go deployment, see [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md). - -## Hardware considerations for Windows To Go - - -**For USB drives** - -The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following: - -- Windows To Go certified USB drives are built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. - -- Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later. - -- Windows To Go certified USB drives are built to last. Certified USB drives are backed with manufacturer warranties and should continue operating under normal usage. Refer to the manufacturer websites for warranty details. - -As of the date of publication, the following are the USB drives currently certified for use as Windows To Go drives: - -**Warning**   -Using a USB drive that has not been certified is not supported - - - -- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://go.microsoft.com/fwlink/p/?LinkId=618714)) - -- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://go.microsoft.com/fwlink/p/?LinkId=618717)) - -- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://go.microsoft.com/fwlink/p/?LinkId=618718)) - -- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) - -- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - We recommend that you run the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Portable Workplace. - -- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - **Important**   - You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). - - - -- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - **Tip**   - This device contains an embedded smart card. - - - -- Super Talent Express RC4 for Windows To Go - - -and- - - Super Talent Express RC8 for Windows To Go - - ([http://www.supertalent.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618721)) - -- Western Digital My Passport Enterprise ([http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722)) - - We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go.  For more information about the WD Compass utility please refer to [http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722) - -**For host computers** - -When assessing the use of a PC as a host for a Windows To Go workspace you should consider the following criteria: - -- Hardware that has been certified for use with Windows 7or later operating systems will work well with Windows To Go. - -- Running a Windows To Go workspace from a computer that is running Windows RT is not a supported scenario. - -- Running a Windows To Go workspace on a Mac computer is not a supported scenario. - -The following table details the characteristics that the host computer must have to be used with Windows To Go: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              ItemRequirement

              Boot process

              Capable of USB boot

              Firmware

              USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you are unsure of the ability of your PC to boot from USB)

              Processor architecture

              Must support the image on the Windows To Go drive

              External USB Hubs

              Not supported; connect the Windows To Go drive directly to the host machine

              Processor

              1 Ghz or faster

              RAM

              2 GB or greater

              Graphics

              DirectX 9 graphics device with WDDM 1.2 or greater driver

              USB port

              USB 2.0 port or greater

              - - - -**Checking for architectural compatibility between the host PC and the Windows To Go drive** - -In addition to the USB boot support in the BIOS, the Windows 10 image on your Windows To Go drive must be compatible with the processor architecture and the firmware of the host PC as shown in the table below. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Host PC Firmware TypeHost PC Processor ArchitectureCompatible Windows To Go Image Architecture

              Legacy BIOS

              32-bit

              32-bit only

              Legacy BIOS

              64-bit

              32-bit and 64-bit

              UEFI BIOS

              32-bit

              32-bit only

              UEFI BIOS

              64-bit

              64-bit only

              - - - -## Additional resources - - -- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) - -- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) - -- [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) - -## Related topics - - -- [Deploy Windows To Go in your organization](https://go.microsoft.com/fwlink/p/?LinkId=619975) - -- [Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) - -- [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) - -- [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) - -- [Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) - -- [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) - - - - - - - - - +--- +title: Windows To Go feature overview (Windows 10) +description: Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that lets you create a workspace that can be booted from a USB-connected drive. +ms.assetid: 9df82b03-acba-442c-801d-56db241f8d42 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: workspace, mobile, installation, image, USB, device, image, edu +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: mobility, edu +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows To Go: feature overview + + +**Applies to** + +- Windows 10 + +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. + +Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. + +PCs that meet the Windows 7 or later [certification requirements](https://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: + +- [Differences between Windows To Go and a typical installation of Windows](#bkmk-wtgdif) +- [Roaming with Windows To Go](#bkmk-wtgroam) +- [Prepare for Windows To Go](#wtg-prep-intro) +- [Hardware considerations for Windows To Go](#wtg-hardware) + +> [!NOTE] +> Windows To Go is not supported on Windows RT. + +## Differences between Windows To Go and a typical installation of Windows + +Windows To Go workspace operates just like any other installation of Windows with a few exceptions. These exceptions are: + +- **Internal disks are offline.** To ensure data isn’t accidentally disclosed, internal hard disks on the host computer are offline by default when booted into a Windows To Go workspace. Similarly if a Windows To Go drive is inserted into a running system, the Windows To Go drive will not be listed in Windows Explorer. +- **Trusted Platform Module (TPM) is not used.** When using BitLocker Drive Encryption a pre-operating system boot password will be used for security rather than the TPM since the TPM is tied to a specific computer and Windows To Go drives will move between computers. +- **Hibernate is disabled by default.** To ensure that the Windows To Go workspace is able to move between computers easily, hibernation is disabled by default. Hibernation can be re-enabled by using Group Policy settings. +- **Windows Recovery Environment is not available.** In the rare case that you need to recover your Windows To Go drive, you should re-image it with a fresh image of Windows. +- **Refreshing or resetting a Windows To Go workspace is not supported.** Resetting to the manufacturer’s standard for the computer doesn’t apply when running a Windows To Go workspace, so the feature was disabled. +- **Upgrading a Windows To Go workspace is not supported.** Older Windows 8 or Windows 8.1 Windows To Go workspaces cannot be upgraded to Windows 10 workspaces, nor can Windows 10 Windows To Go workspaces be upgraded to future versions of Windows 10. For new versions, the workspace needs to be re-imaged with a fresh image of Windows. + +## Roaming with Windows To Go + +Windows To Go drives can be booted on multiple computers. When a Windows To Go workspace is first booted on a host computer it will detect all hardware on the computer and install any needed drivers. When the Windows To Go workspace is subsequently booted on that host computer it will be able to identify the host computer and load the correct set of drivers automatically. + +The applications that you want to use from the Windows To Go workspace should be tested to make sure they also support roaming. Some applications bind to the computer hardware which will cause difficulties if the workspace is being used with multiple host computers. + +## Prepare for Windows To Go + +Enterprises install Windows on a large group of computers either by using configuration management software (such as Microsoft Endpoint Configuration Manager), or by using standard Windows deployment tools such as DiskPart and the Deployment Image Servicing and Management (DISM) tool. + +These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) to review deployment tools available. + +> [!IMPORTANT] +> Make sure you use the versions of the deployment tools provided for the version of Windows you are deploying. There have been many enhancements made to support Windows To Go. Using versions of the deployment tools released for earlier versions of Windows to provision a Windows To Go drive is not supported. + +As you decide what to include in your Windows To Go image, be sure to consider the following questions: + +Are there any drivers that you need to inject into the image? + +How will data be stored and synchronized to appropriate locations from the USB device? + +Are there any applications that are incompatible with Windows To Go roaming that should not be included in the image? + +What should be the architecture of the image - 32bit/64bit? + +What remote connectivity solution should be supported in the image if Windows To Go is used outside the corporate network? + +For more information about designing and planning your Windows To Go deployment, see [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md). + +## Hardware considerations for Windows To Go + +**For USB drives** + +The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following: + +- Windows To Go certified USB drives are built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. +- Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later. +- Windows To Go certified USB drives are built to last. Certified USB drives are backed with manufacturer warranties and should continue operating under normal usage. Refer to the manufacturer websites for warranty details. + +As of the date of publication, the following are the USB drives currently certified for use as Windows To Go drives: + +> [!WARNING] +> Using a USB drive that has not been certified is not supported. + +- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://www.kingston.com/support/technical/products?model=dtws)) +- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://www.kingston.com/support/technical/products?model=dtws)) +- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://www.kingston.com/support/technical/products?model=dtws)) +- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) +- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) + + We recommend that you run the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Portable Workplace. + +- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) + + > [!IMPORTANT] + > You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). + + +- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) + + > [!TIP] + > This device contains an embedded smart card. + + + +- Super Talent Express RC4 for Windows To Go + + -and- + + Super Talent Express RC8 for Windows To Go + + ([http://www.supertalent.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618721)) + +- Western Digital My Passport Enterprise ([http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722)) + + We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go.  For more information about the WD Compass utility please refer to [http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722) + +**For host computers** + +When assessing the use of a PC as a host for a Windows To Go workspace you should consider the following criteria: + +- Hardware that has been certified for use with Windows 7 or later operating systems will work well with Windows To Go. +- Running a Windows To Go workspace from a computer that is running Windows RT is not a supported scenario. +- Running a Windows To Go workspace on a Mac computer is not a supported scenario. + +The following table details the characteristics that the host computer must have to be used with Windows To Go: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              ItemRequirement

              Boot process

              Capable of USB boot

              Firmware

              USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you are unsure of the ability of your PC to boot from USB)

              Processor architecture

              Must support the image on the Windows To Go drive

              External USB Hubs

              Not supported; connect the Windows To Go drive directly to the host machine

              Processor

              1 Ghz or faster

              RAM

              2 GB or greater

              Graphics

              DirectX 9 graphics device with WDDM 1.2 or greater driver

              USB port

              USB 2.0 port or greater

              + +**Checking for architectural compatibility between the host PC and the Windows To Go drive** + +In addition to the USB boot support in the BIOS, the Windows 10 image on your Windows To Go drive must be compatible with the processor architecture and the firmware of the host PC as shown in the table below. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Host PC Firmware TypeHost PC Processor ArchitectureCompatible Windows To Go Image Architecture

              Legacy BIOS

              32-bit

              32-bit only

              Legacy BIOS

              64-bit

              32-bit and 64-bit

              UEFI BIOS

              32-bit

              32-bit only

              UEFI BIOS

              64-bit

              64-bit only

              + +## Additional resources + +- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) +- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) +- [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) + +## Related topics + +[Deploy Windows To Go in your organization](https://go.microsoft.com/fwlink/p/?LinkId=619975)
              +[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md)
              +[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
              +[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
              +[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
              +[Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) diff --git a/windows/deployment/s-mode.md b/windows/deployment/s-mode.md index 530c47ce6f..ea76222dde 100644 --- a/windows/deployment/s-mode.md +++ b/windows/deployment/s-mode.md @@ -1,57 +1,61 @@ ---- -title: Windows 10 Pro in S mode -description: Overview of Windows 10 Pro/Enterprise in S mode. What is S mode for Enterprise customers? -keywords: Windows 10 S, S mode, Windows S mode, Windows 10 S mode, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Enterprise in S mode, Windows 10 Pro/Enterprise in S mode -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.prod: w10 -ms.sitesec: library -ms.pagetype: deploy -ms.date: 12/05/2018 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 in S mode - What is it? -S mode is an evolution of the S SKU introduced with Windows 10 April 2018 Update. It's a configuration that's available on all Windows Editions when enabled at the time of manufacturing. The edition of Windows can be upgrade at any time as shown below. However, the switch from S mode is a onetime switch and can only be undone by a wipe and reload of the OS. - -![Configuration and features of S mode](images/smodeconfig.png) - -## S mode key features -**Microsoft-verified security** - -With Windows 10 in S mode, you’ll find your favorite applications, such as Office, Evernote, and Spotify in the Microsoft Store where they’re Microsoft-verified for security. You can also feel secure when you’re online. Microsoft Edge, your default browser, gives you protection against phishing and socially engineered malware. - -**Performance that lasts** - -Start-ups are quick, and S mode is built to keep them that way. With Microsoft Edge as your browser, your online experience is fast and secure. Plus, you’ll enjoy a smooth, responsive experience, whether you’re streaming HD video, opening apps, or being productive on the go. - -**Choice and flexibility** - -Save your files to your favorite cloud, like OneDrive or Dropbox, and access them from any device you choose. Browse the Microsoft Store for thousands of apps, and if you don’t find exactly what you want, you can easily [switch out of S mode](https://docs.microsoft.com/windows/deployment/windows-10-pro-in-s-mode) to Windows 10 Home, Pro, or Enterprise editions at any time and search the web for more choices, as shown below. - -![Switching out of S mode flow chart](images/s-mode-flow-chart.png) - - -## Deployment - -Windows 10 in S mode is built for [modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management) which means using [Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot). Windows Autopilot lets you deploy the device directly to a user without IT having to touch the physical device. Instead of manually deploying a custom image, Windows Autopilot will start with a generic PC that can only be used to join the company domain; policies are then deployed automatically through mobile device management to customize the device to the user and the desired environment. Devices are shipped in S mode; you can either keep them in S mode or use Windows Autopilot to switch the device out of S mode during the first run process or later using mobile device management, if desired. - -## Keep line of business apps functioning with Desktop Bridge - -Worried about your line of business apps not working in S mode? [Desktop Bridge](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-root) enables you to convert your line of business apps to a packaged app with UWP manifest. After testing and validating you can distribute the app through the Microsoft Store, making it ideal for Windows 10 in S mode. - -## Repackage Win32 apps into the MSIX format - -The [MSIX Packaging Tool](https://docs.microsoft.com/windows/application-management/msix-app-packaging-tool), available from the Microsoft Store, enables you to repackage existing Win32 applications to the MSIX format. You can run your desktop installers through this tool interactively and obtain an MSIX package that you can install on your device and upload to the Microsoft Store. This is another way to get your apps ready to run on Windows 10 in S mode. - - -## Related links - -- [Consumer applications for S mode](https://www.microsoft.com/en-us/windows/s-mode) -- [S mode devices](https://www.microsoft.com/en-us/windows/view-all-devices) -- [Windows Defender Application Control deployment guide](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) -- [Windows Defender Advanced Threat Protection](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) +--- +title: Windows 10 Pro in S mode +description: Overview of Windows 10 Pro/Enterprise in S mode. What is S mode for Enterprise customers? +keywords: Windows 10 S, S mode, Windows S mode, Windows 10 S mode, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Enterprise in S mode, Windows 10 Pro/Enterprise in S mode +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.prod: w10 +ms.sitesec: library +ms.pagetype: deploy +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.author: greglin +audience: itpro +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows 10 in S mode - What is it? + +S mode is an evolution of the S SKU introduced with Windows 10 April 2018 Update. It's a configuration that's available on all Windows Editions when enabled at the time of manufacturing. The edition of Windows can be upgrade at any time as shown below. However, the switch from S mode is a onetime switch and can only be undone by a wipe and reload of the OS. + +![Configuration and features of S mode](images/smodeconfig.png) + +## S mode key features + +**Microsoft-verified security** + +With Windows 10 in S mode, you’ll find your favorite applications, such as Office, Evernote, and Spotify in the Microsoft Store where they’re Microsoft-verified for security. You can also feel secure when you’re online. Microsoft Edge, your default browser, gives you protection against phishing and socially engineered malware. + +**Performance that lasts** + +Start-ups are quick, and S mode is built to keep them that way. With Microsoft Edge as your browser, your online experience is fast and secure. Plus, you’ll enjoy a smooth, responsive experience, whether you’re streaming HD video, opening apps, or being productive on the go. + +**Choice and flexibility** + +Save your files to your favorite cloud, like OneDrive or Dropbox, and access them from any device you choose. Browse the Microsoft Store for thousands of apps, and if you don’t find exactly what you want, you can easily [switch out of S mode](https://docs.microsoft.com/windows/deployment/windows-10-pro-in-s-mode) to Windows 10 Home, Pro, or Enterprise editions at any time and search the web for more choices, as shown below. + +![Switching out of S mode flow chart](images/s-mode-flow-chart.png) + + +## Deployment + +Windows 10 in S mode is built for [modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management) which means using [Windows Autopilot](windows-autopilot/windows-autopilot.md). Windows Autopilot lets you deploy the device directly to a user without IT having to touch the physical device. Instead of manually deploying a custom image, Windows Autopilot will start with a generic PC that can only be used to join the company domain; policies are then deployed automatically through mobile device management to customize the device to the user and the desired environment. Devices are shipped in S mode; you can either keep them in S mode or use Windows Autopilot to switch the device out of S mode during the first run process or later using mobile device management, if desired. + +## Keep line of business apps functioning with Desktop Bridge + +Worried about your line of business apps not working in S mode? [Desktop Bridge](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-root) enables you to convert your line of business apps to a packaged app with UWP manifest. After testing and validating you can distribute the app through the Microsoft Store, making it ideal for Windows 10 in S mode. + +## Repackage Win32 apps into the MSIX format + +The [MSIX Packaging Tool](https://docs.microsoft.com/windows/application-management/msix-app-packaging-tool), available from the Microsoft Store, enables you to repackage existing Win32 applications to the MSIX format. You can run your desktop installers through this tool interactively and obtain an MSIX package that you can install on your device and upload to the Microsoft Store. This is another way to get your apps ready to run on Windows 10 in S mode. + + +## Related links + +- [Consumer applications for S mode](https://www.microsoft.com/windows/s-mode) +- [S mode devices](https://www.microsoft.com/en-us/windows/view-all-devices) +- [Windows Defender Application Control deployment guide](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) +- [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) diff --git a/windows/deployment/update/PSFxWhitepaper.md b/windows/deployment/update/PSFxWhitepaper.md index dc4e379e29..4a6d9ab0f1 100644 --- a/windows/deployment/update/PSFxWhitepaper.md +++ b/windows/deployment/update/PSFxWhitepaper.md @@ -1,206 +1,113 @@ ---- -title: Windows Updates using forward and reverse differentials -description: A technique to produce compact software updates optimized for any origin and destination revision pair -keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 10/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Windows Updates using forward and reverse differentials - - -Windows 10 monthly quality updates are cumulative, containing all previously -released fixes to ensure consistency and simplicity. For an operating system -platform like Windows 10, which stays in support for multiple years, the size of -monthly quality updates can quickly grow large, thus directly impacting network -bandwidth consumption. - -Today, this problem is addressed by using express downloads, where differential -downloads for every changed file in the update are generated based on selected -historical revisions plus the base version. In this paper, we introduce a new -technique to build compact software update packages that are applicable to any -revision of the base version, and then describe how Windows 10 quality updates -uses this technique. - -## General Terms - -The following general terms apply throughout this document: - -- *Base version*: A major software release with significant changes, such as - Windows 10, version 1809 (Windows 10 Build 17763.1) - -- *Revision*: Minor releases in between the major version releases, such as - KB4464330 (Windows 10 Build 17763.55) - -- *Baseless Patch Storage Files (Baseless PSF)*: Patch storage files that - contain full binaries or files - -## Introduction - -In this paper, we introduce a new technique that can produce compact software -updates optimized for any origin/destination revision pair. It does this by -calculating forward the differential of a changed file from the base version and -its reverse differential back to the base version. Both forward and reverse -differentials are then packaged as an update and distributed to the endpoints -running the software to be updated. The update package contents can be symbolized as follows: - -![Symbolic representation of update package contents. a box containing two expressions: delta sub zero transform to sub N, followed delta sub N transform to sub zero](images/PSF1.png) - -The endpoints that have the base version of the file (V0) hydrate the target -revision (VN) by applying a simple transformation: - -![Equation: V sub zero + delta sub zero transform to sub N = V sub n](images/PSF2.png) - -The endpoints that have revision N of the file (VN), hydrate the target revision -(VR) by applying the following set of transformations: - -![Equation 1: V sub n + delta sub n transform to 0 = V sun 0; Equation 2: V sub zero + delta sub 0 transform to R = V sub R](images/PSF3.png) - -The endpoints retain the reverse differentials for the software revision they -are on, so that it can be used for hydrating and applying next revision update. - -By using a common baseline, this technique produces a single update package with -numerous advantages: - -- Compact in size - -- Applicable to all baselines - -- Simple to build - -- Efficient to install - -- Redistributable - -Historically, download sizes of Windows 10 quality updates (Windows 10, version -1803 and older supported versions of Windows 10) are optimized by using express -download. Express download is optimized such that updating Windows 10 systems -will download the minimum number of bytes. This is achieved by generating -differentials for every updated file based on selected historical base revisions -of the same file + its base or RTM version. - -For example, if the October monthly quality update has updated Notepad.exe, -differentials for Notepad.exe file changes from September to October, August to -October, July to October, June to October, and from the original feature release -to October are generated. All these differentials are stored in a Patch Storage -File (PSF, also referred to as “express download files”) and hosted or cached on -Windows Update or other update management or distribution servers (for example, -Windows Server Update Services (WSUS), System Center Configuration Manager, or a -non-Microsoft update management or distribution server that supports express -updates). A device leveraging express updates uses network protocol to determine -optimal differentials, then downloads only what is needed from the update -distribution endpoints. - -The flipside of express download is that the size of PSF files can be very large -depending on the number of historical baselines against which differentials were -calculated. Downloading and caching large PSF files to on-premises or remote -update distribution servers is problematic for most organizations, hence they -are unable to leverage express updates to keep their fleet of devices running -Windows 10 up to date. Secondly, due to the complexity of generating -differentials and size of the express files that need to be cached on update -distribution servers, it is only feasible to generate express download files for -the most common baselines, thus express updates are only applicable to selected -baselines. Finally, calculation of optimal differentials is expensive in terms -of system memory utilization, especially for low-cost systems, impacting their -ability to download and apply an update seamlessly. - -In the following sections, we describe how Windows 10 quality updates will -leverage this technique based on forward and reverse differentials for newer -releases of Windows 10 and Windows Server to overcome the challenges with -express downloads. - -## High-level Design - -### Update packaging - -Windows 10 quality update packages will contain forward differentials from -quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM -(∆N→RTM) for each file that has changed since RTM. By using the RTM version as -the baseline, we ensure that all devices will have an identical payload. Update -package metadata, content manifests, and forward and reverse differentials will -be packaged into a cabinet file (.cab). This .cab file, and the applicability -logic, will also be wrapped in Microsoft Standalone Update (.msu) format. - -There can be cases where new files are added to the system during servicing. -These files will not have RTM baselines, thus forward and reverse differentials -cannot be used. In these scenarios, null differentials will be used to handle -servicing. Null differentials are the slightly compressed and optimized version -of the full binaries. Update packages can have either -forward or reverse differentials, or null differential of any given binary in -them. The following image symbolizes the content of a Windows 10 quality update installer: - -![Outer box labeled .msu containing two sub-boxes: 1) Applicability Logic, 2) box labeled .cab containg four sub-boxes: 1) update metadata, 2) content manifests, 3) delta sub RTM transform to sub N (file 1, file2, etc.), and 4) delta sub N transform to RTM (file 1, file 2, etc.)](images/PSF4.png) - -### Hydration and installation - -Once the usual applicability checks are performed on the update package and are -determined to be applicable, the Windows component servicing infrastructure will -hydrate the full files during pre-installation and then proceed with the usual -installation process. - -Below is a high-level sequence of activities that the component servicing -infrastructure will run in a transaction to complete installation of the update: - -- Identify all files that are required to install the update. - -- Hydrate each of necessary files using current version (VN) of the file, - reverse differential (VN--->RTM) of the file back to quality update RTM/base - version and forward differential (VRTM--->R) from feature update RTM/base - version to the target version. Also, use null differential hydration to - hydrate null compressed files. - -- Stage the hydrated files (full file), forward differentials (under ‘f’ - folder) and reverse differentials (under ‘r’ folder) or null compressed - files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder). - -- Resolve any dependencies and install components. - -- Clean up older state (VN-1); the previous state VN is retained for - uninstallation and restoration or repair. - -### **Resilient Hydration** - -To ensure resiliency against component store corruption or missing files that -could occur due to susceptibility of certain types of hardware to file system -corruption, a corruption repair service has been traditionally used to recover -the component store automatically (“automatic corruption repair”) or on demand -(“manual corruption repair”) using an online or local repair source. This -service will continue to offer the ability to repair and recover content for -hydration and successfully install an update, if needed. - -When corruption is detected during update operations, automatic corruption -repair will start as usual and use the Baseless Patch Storage File published to -Windows Update for each update to fix corrupted manifests, binary differentials, -or hydrated or full files. Baseless patch storage files will contain reverse and -forward differentials and full files for each updated component. Integrity of -the repair files will be hash verified. - -Corruption repair will use the component manifest to detect missing files and -get hashes for corruption detection. During update installation, new registry -flags for each differential staged on the machine will be set. When automatic -corruption repair runs, it will scan hydrated files using the manifest and -differential files using the flags. If the differential cannot be found or -verified, it will be added to the list of corruptions to repair. - -### Lazy automatic corruption repair - -“Lazy automatic corruption repair” runs during update operations to detect -corrupted binaries and differentials. While applying an update, if hydration of -any file fails, "lazy" automatic corruption repair automatically starts, -identifies the corrupted binary or differential file, and then adds it to the -corruption list. Later, the update operation continues as far as it can go, so -that "lazy" automatic corruption repair can collect as many corrupted files to fix -as possible. At the end of the hydration section, the update fails, and -automatic corruption repair starts. Automatic corruption repair runs as usual -and at the end of its operation, adds the corruption list generated by "lazy" -automatic corruption repair on top of the new list to repair. Automatic -corruption repair then repairs the files on the corruption list and installation -of the update will succeed on the next attempt. +--- +title: Windows Updates using forward and reverse differentials +description: A technique to produce compact software updates optimized for any origin and destination revision pair +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows Updates using forward and reverse differentials + +Windows 10 monthly quality updates are cumulative, containing all previously +released fixes to ensure consistency and simplicity. For an operating system +platform like Windows 10, which stays in support for multiple years, the size of +monthly quality updates can quickly grow large, thus directly impacting network +bandwidth consumption. + +Today, this problem is addressed by using express downloads, where differential +downloads for every changed file in the update are generated based on selected +historical revisions plus the base version. In this paper, we introduce a new +technique to build compact software update packages that are applicable to any +revision of the base version, and then describe how Windows 10 quality updates +uses this technique. + +## General Terms + +The following general terms apply throughout this document: + +- *Base version*: A major software release with significant changes, such as Windows 10, version 1809 (Windows 10 Build 17763.1) +- *Revision*: Minor releases in between the major version releases, such as KB4464330 (Windows 10 Build 17763.55) +- *Baseless Patch Storage Files (Baseless PSF)*: Patch storage files that contain full binaries or files + +In this paper, we introduce a new technique that can produce compact software +updates optimized for any origin/destination revision pair. It does this by +calculating forward the differential of a changed file from the base version and +its reverse differential back to the base version. Both forward and reverse +differentials are then packaged as an update and distributed to the endpoints +running the software to be updated. The update package contents can be symbolized as follows: + +![Symbolic representation of update package contents. A box containing two expressions: delta sub zero transform to sub N, followed delta sub N transform to sub zero](images/PSF1.png) + +The endpoints that have the base version of the file (V0) hydrate the target +revision (VN) by applying a simple transformation: + +![Equation: V sub zero + delta sub zero transform to sub N = V sub n](images/PSF2.png) + +The endpoints that have revision N of the file (VN), hydrate the target revision +(VR) by applying the following set of transformations: + +![Equation 1: V sub n + delta sub n transform to 0 = V sun 0; Equation 2: V sub zero + delta sub 0 transform to R = V sub R](images/PSF3.png) + +The endpoints retain the reverse differentials for the software revision they +are on, so that it can be used for hydrating and applying next revision update. + +By using a common baseline, this technique produces a single update package with +numerous advantages: + +- Compact in size +- Applicable to all baselines +- Simple to build +- Efficient to install +- Redistributable + +Historically, download sizes of Windows 10 quality updates (Windows 10, version 1803 and older supported versions of Windows 10) are optimized by using express download. Express download is optimized such that updating Windows 10 systems will download the minimum number of bytes. This is achieved by generating differentials for every updated file based on selected historical base revisions of the same file + its base or RTM version. + +For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as “express download files”) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device leveraging express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints. + +The flip side of express download is that the size of PSF files can be very large depending on the number of historical baselines against which differentials were calculated. Downloading and caching large PSF files to on-premises or remote update distribution servers is problematic for most organizations, hence they are unable to leverage express updates to keep their fleet of devices running Windows 10 up to date. Secondly, due to the complexity of generating differentials and size of the express files that need to be cached on update distribution servers, it is only feasible to generate express download files for the most common baselines, thus express updates are only applicable to selected baselines. Finally, calculation of optimal differentials is expensive in terms of system memory utilization, especially for low-cost systems, impacting their ability to download and apply an update seamlessly. + +In the following sections, we describe how Windows 10 quality updates will leverage this technique based on forward and reverse differentials for newer releases of Windows 10 and Windows Server to overcome the challenges with express downloads. + +## High-level Design + +### Update packaging + +Windows 10 quality update packages will contain forward differentials from quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM (∆N→RTM) for each file that has changed since RTM. By using the RTM version as the baseline, we ensure that all devices will have an identical payload. Update package metadata, content manifests, and forward and reverse differentials will be packaged into a cabinet file (.cab). This .cab file, and the applicability logic, will also be wrapped in Microsoft Standalone Update (.msu) format. + +There can be cases where new files are added to the system during servicing. These files will not have RTM baselines, thus forward and reverse differentials cannot be used. In these scenarios, null differentials will be used to handle servicing. Null differentials are the slightly compressed and optimized version of the full binaries. Update packages can have either forward or reverse differentials, or null differential of any given binary in them. The following image symbolizes the content of a Windows 10 quality update installer: + +![Outer box labeled .msu containing two sub-boxes: 1) Applicability Logic, 2) box labeled .cab containing four sub-boxes: 1) update metadata, 2) content manifests, 3) delta sub RTM transform to sub N (file 1, file2, etc.), and 4) delta sub N transform to RTM (file 1, file 2, etc.)](images/PSF4.png) + +### Hydration and installation + +Once the usual applicability checks are performed on the update package and are determined to be applicable, the Windows component servicing infrastructure will hydrate the full files during pre-installation and then proceed with the usual installation process. + +Below is a high-level sequence of activities that the component servicing infrastructure will run in a transaction to complete installation of the update: + +- Identify all files that are required to install the update. +- Hydrate each of necessary files using current version (VN) of the file, reverse differential (VN--->RTM) of the file back to quality update RTM/base version and forward differential (VRTM--->R) from feature update RTM/base version to the target version. Also, use null differential hydration to hydrate null compressed files. +- Stage the hydrated files (full file), forward differentials (under ‘f’ folder) and reverse differentials (under ‘r’ folder) or null compressed files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder). +- Resolve any dependencies and install components. +- Clean up older state (VN-1); the previous state VN is retained for uninstallation and restoration or repair. + +### **Resilient Hydration** + +To ensure resiliency against component store corruption or missing files that could occur due to susceptibility of certain types of hardware to file system corruption, a corruption repair service has been traditionally used to recover the component store automatically (“automatic corruption repair”) or on demand (“manual corruption repair”) using an online or local repair source. This service will continue to offer the ability to repair and recover content for +hydration and successfully install an update, if needed. + +When corruption is detected during update operations, automatic corruption repair will start as usual and use the Baseless Patch Storage File published to Windows Update for each update to fix corrupted manifests, binary differentials, or hydrated or full files. Baseless patch storage files will contain reverse and forward differentials and full files for each updated component. Integrity of the repair files will be hash verified. + +Corruption repair will use the component manifest to detect missing files and get hashes for corruption detection. During update installation, new registry flags for each differential staged on the machine will be set. When automatic corruption repair runs, it will scan hydrated files using the manifest and differential files using the flags. If the differential cannot be found or verified, it will be added to the list of corruptions to repair. + +### Lazy automatic corruption repair + +“Lazy automatic corruption repair” runs during update operations to detect corrupted binaries and differentials. While applying an update, if hydration of any file fails, "lazy" automatic corruption repair automatically starts, identifies the corrupted binary or differential file, and then adds it to the corruption list. Later, the update operation continues as far as it can go, so that "lazy" automatic corruption repair can collect as many corrupted files to fix as possible. At the end of the hydration section, the update fails, and automatic corruption repair starts. Automatic corruption repair runs as usual and at the end of its operation, adds the corruption list generated by "lazy" automatic corruption repair on top of the new list to repair. Automatic corruption repair then repairs the files on the corruption list and installation of the update will succeed on the next attempt. diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md index 20ecac8ae7..4a1087d274 100644 --- a/windows/deployment/update/WIP4Biz-intro.md +++ b/windows/deployment/update/WIP4Biz-intro.md @@ -1,74 +1,68 @@ ---- -title: Introduction to the Windows Insider Program for Business -description: Introduction to the Windows Insider Program for Business and why IT Pros should join it -keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 03/01/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Introduction to the Windows Insider Program for Business - - -**Applies to** - -- Windows 10 - -> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the Semi-Annual Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available. - -The Windows Insider Program for Business gives you the opportunity to: - -* Get early access to Windows Insider Preview Builds. -* Provide feedback to Microsoft in real time by using the Feedback Hub app. -* Sign in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. -* Register your Azure Active Directory domain in the program, allowing you to cover all users within your organization with just one registration. -* Starting with Windows 10, version 1709, enable, disable, defer, and pause the installation of preview builds through policies. -* Track feedback provided through the Feedback Hub App across your organization. - -Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App. - -The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. - - -[![Illustration showing the Windows Insider PreviewFast Ring for exploration, the Slow Ring for validation, the Semi-Annual Channel Targeted ring for Pilot deployment, and the Semi-Annual Channel for broad deployment](images/WIP4Biz_deployment.png)](images/WIP4Biz_deployment.png)
              -Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. - - -## Explore new Windows 10 features in Insider Previews -Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration: - -|Objective |Feature exploration| -|---------|---------| -|Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.| -|Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. | -|Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices)
              - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications
              - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. | -|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.
              - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)
              - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) | - -## Validate Insider Preview builds -Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: - -- Get a head start on your Windows validation process -- Identify issues sooner to accelerate your Windows deployment -- Engage Microsoft earlier for help with potential compatibility issues -- Deploy Windows 10 Semi-Annual releases faster and more confidently -- Maximize the 18-month support Window that comes with each Semi-Annual release. - - - -|Objective |Feature exploration| -|---------|---------| -|Release channel |**Slow Ring:** Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production devices by skilled users.| -|Users | Application and infrastructure validation: In addition to Insiders who might have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample.| -|Tasks | Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. | -|Feedback | Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. | -|Guidance | Application and infrastructure validation:
              - [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps)
              - [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/windows/deployment/update/device-health-monitor)
              - [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793)| - +--- +title: Introduction to the Windows Insider Program for Business +description: In this article, you'll learn about the Windows Insider Program for Business and why IT Pros should join. +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight +ms.custom: seo-marvel-apr2020 +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.audience: itpro +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Introduction to the Windows Insider Program for Business + +**Applies to** + +- Windows 10 + +> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the Semi-Annual Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available. + +The Windows Insider Program for Business gives you the opportunity to: + +* Get early access to Windows Insider Preview Builds. +* Provide feedback to Microsoft in real time by using the Feedback Hub app. +* Sign in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. +* Register your Azure Active Directory domain in the program, allowing you to cover all users within your organization with just one registration. +* Starting with Windows 10, version 1709, enable, disable, defer, and pause the installation of preview builds through policies. +* Track feedback provided through the Feedback Hub App across your organization. + +Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App. + +The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. + +[![Illustration showing the Windows Insider PreviewFast Ring for exploration, the Slow Ring for validation, the Semi-Annual Channel Targeted ring for Pilot deployment, and the Semi-Annual Channel for broad deployment](images/WIP4Biz_deployment.png)](images/WIP4Biz_deployment.png)
              +Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. + +## Explore new Windows 10 features in Insider Previews +Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration: + +|Objective |Feature exploration| +|---------|---------| +|Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.| +|Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. | +|Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices)
              - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications
              - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. | +|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.
              - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)
              - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/how-to-feedback/) | + +## Validate Insider Preview builds +Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: + +- Get a head start on your Windows validation process +- Identify issues sooner to accelerate your Windows deployment +- Engage Microsoft earlier for help with potential compatibility issues +- Deploy Windows 10 Semi-Annual releases faster and more confidently +- Maximize the 18-month support Window that comes with each Semi-Annual release. + +|Objective |Feature exploration| +|---------|---------| +|Release channel |**Slow Ring:** Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production devices by skilled users.| +|Users | Application and infrastructure validation: In addition to Insiders who might have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample.| +|Tasks | Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. | +|Feedback | Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. | +|Guidance | Application and infrastructure validation:
              - [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps)
              - [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/windows/deployment/update/device-health-monitor)
              - [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793)| \ No newline at end of file diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md index 135d1670a5..fc8013e00c 100644 --- a/windows/deployment/update/change-history-for-update-windows-10.md +++ b/windows/deployment/update/change-history-for-update-windows-10.md @@ -1,52 +1,51 @@ ---- -title: Change history for Update Windows 10 (Windows 10) -description: This topic lists new and updated topics in the Update Windows 10 documentation for Windows 10 and Windows 10 Mobile. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.author: greglin -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Change history for Update Windows 10 - -This topic lists new and updated topics in the [Update Windows 10](index.md) documentation for [Deploy and Update Windows 10](https://docs.microsoft.com/windows/deployment). - ->If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history). - -## September 2018 - -| New or changed topic | Description | -| --- | --- | -| [Get started with Windows Update](windows-update-overview.md) | New | - - -## RELEASE: Windows 10, version 1709 - -The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). - -## September 2017 - -| New or changed topic | Description | -| --- | --- | -| [Olympia Corp](olympia/olympia-enrollment-guidelines.md) | New | - -## July 2017 - -All topics were updated to reflect the new [naming changes](waas-overview.md#naming-changes). - -## May 2017 - -| New or changed topic | Description | -| --- | --- | -| [Manage additional Windows Update settings](waas-wu-settings.md) | New | - -## RELEASE: Windows 10, version 1703 - -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added: -* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started) -* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-register) +--- +title: Change history for Update Windows 10 (Windows 10) +description: This topic lists new and updated topics in the Update Windows 10 documentation for Windows 10 and Windows 10 Mobile. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Change history for Update Windows 10 + +This topic lists new and updated topics in the [Update Windows 10](index.md) documentation for [Deploy and Update Windows 10](https://docs.microsoft.com/windows/deployment). + +>If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history). + +## September 2018 + +| New or changed topic | Description | +| --- | --- | +| [Get started with Windows Update](windows-update-overview.md) | New | + + +## RELEASE: Windows 10, version 1709 + +The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). + +## September 2017 + +| New or changed topic | Description | +| --- | --- | +| [Olympia Corp](olympia/olympia-enrollment-guidelines.md) | New | + +## July 2017 + +All topics were updated to reflect the new [naming changes](waas-overview.md#naming-changes). + +## May 2017 + +| New or changed topic | Description | +| --- | --- | +| [Manage additional Windows Update settings](waas-wu-settings.md) | New | + +## RELEASE: Windows 10, version 1703 + +The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added: +* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started) +* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-register) diff --git a/windows/deployment/update/create-deployment-plan.md b/windows/deployment/update/create-deployment-plan.md new file mode 100644 index 0000000000..a1ce6bbe19 --- /dev/null +++ b/windows/deployment/update/create-deployment-plan.md @@ -0,0 +1,138 @@ +--- +title: Create a deployment plan +description: Devise the number of deployment rings you need and how you want to populate them +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.collection: m365initiative-coredeploy +manager: laurawi +ms.topic: article +--- + +# Create a deployment plan + +A "service management" mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once you use this process for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity. + +When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method to separate devices into a deployment timeline. + +At the highest level, each “ring” comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur. + +A common ring structure uses three deployment groups: + +- Preview: Planning and development +- Limited: Pilot and validation +- Broad: Wide deployment + +> [!NOTE] +> Organizations often use different names for their “rings," for example: +> - First > Fast > Broad +> - Canaries > Early Adopters > Users +> - Preview > Broad > Critical + + +## How many rings should I have? + +There are no definite rules for exactly how many rings to have for your deployments. As mentioned previously, you might want to ensure zero downtime for mission-critical devices by putting them in their own ring. If you have a large organization, you might want to consider assigning devices to rings based on geographic location or the size of rings so that helpdesk resources are more available. Consider the needs of your business and introduce rings that make sense for your organization. + +## Advancing between rings + +There are basically two strategies for moving deployments from one ring to the next. One is service-based, the other project based. + +- "Red button" (service based): Assumes that content is good until proven bad. Content flows until an issue is discovered, at which point the IT administrator presses the “red button” to stop further distribution. +- Green button (project based): Assumes that content is bad until proven good. Once all validation has passed, the IT administrator presses the “green button” to push the content to the next ring. + +When it comes to deployments, having manual steps in the process usually impedes update velocity. A "red button" strategy is better when that is your goal. + +## Preview ring + +The purpose of the Preview ring is to evaluate the new features of the update. It's *not* for broad parts of the organization but is limited to the people who are responsible for knowing what is coming next, generally IT administrators. Ultimately, this phase is the time the design and planning work happens so that when the public update is shipped, you can have greater confidence in the update. + +> [!NOTE] +> Being part of the [Windows Insider Program](https://insider.windows.com/for-business/) gives you early access to Windows releases so that you can use Insider Preview builds in your Preview ring to validate your apps and infrastructure, preparing you for public Windows releases. + + +### Who goes in the Preview ring? + +The Preview ring users are the most tech savvy and resilient people, who will not lose productivity if something goes wrong. In general, these users are IT pros, and perhaps a few people in the business organization. + +During your plan and prepare phases, you should focus on the following activities: + +- Work with Windows Insider Preview builds. +- Identify the features and functionality your organization can or wants to use. +- Establish who will use the features and how they will benefit. +- Understand why you are putting out the update. +- Plan for usage feedback. + +Remember, you are working with pre-release software in the Preview ring and you will be evaluating features and testing the update for a targeted release. + +> [!IMPORTANT] +> If you are using Windows Insider (pre-release) releases for your preview ring and you are using WSUS or Windows Update for Business, be sure to set the following policies to allow for Preview builds: +> - **Manage Preview Builds: 2 - Enable preview builds** +> • Under **Branch Readiness Level**, select **When Preview Builds and Feature Updates are Received: 4--Windows Insider Program Slow** + +## Limited ring + +The purpose of the Limited ring is to validate the update on representative devices across the network. During this period, data, and feedback are generated to enable the decision to move forward to broader deployment. Desktop +Analytics can help with defining a good Limited ring of representative devices and assist in monitoring the deployment. + +### Who goes in the Limited ring? + +The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented, and it's important that the people selected for this ring are using their devices regularly in order to generate the data you will need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don’t have the applications or device drivers that are truly a representative sample of your network. + + +During your pilot and validate phases, you should focus on the following activities: + +- Deploy new innovations. +- Assess and act if issues are encountered. +- Move forward unless blocked. + +When you deploy to the Limited ring, you’ll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring, because your Limited ring represents your organization across the board, and when you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly. + +## Broad deployment + +Once the devices in the Limited ring have had a sufficient stabilization period, it’s time for broad deployment across the network. + +### Who goes in the Broad deployment ring? + +In most businesses, the Broad ring includes the rest of your organization. Because of the work in the previous ring to vet stability and minimize disruption (with diagnostic data to support your decision) broad deployment can occur relatively quickly. + +> [!NOTE] +> In some instances, you might hold back on mission critical devices (such as medical devices) until deployment in the Broad ring is complete. Get best practices and recommendations for deploying Windows 10 feature +> updates to mission critical devices. + +During the broad deployment phase, you should focus on the following activities: + +- Deploy to all devices in the organization. +- Work through any final unusual issues that were not detected in your Limited ring. + + +## Ring deployment planning + +Previously, we have provided methods for analyzing your deployments, but these have been standalone tools to assess, manage and execute deployments. In other words, you would generate an analysis, make a deployment strategy, and then move to your console for implementation, repeating these steps for each deployment. We have combined many of these tasks, and more, into a single interface with Desktop Analytics. + + +[Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) is a cloud-based service and a key tool in [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/configmgr/core/understand/microsoft-endpoint-manager-faq). Using artificial intelligence and machine learning, Desktop Analytics is a powerful tool to give you insights and intelligence to +make informed decisions about the readiness of your Windows devices. + +In Windows 10 deployments, we have seen compatibility issues on < 0.5% of apps when using Desktop Analytics. Using Desktop Analytics with Microsoft Endpoint Manager can help you assess app compatibility with the latest +feature update and create groups that represent the broadest number of hardware and software configurations on the smallest set of devices across your organization. In addition, Desktop Analytics can provide you with a device and software inventory and identify issues, giving you data that equate to actionable decisions. + +> [!IMPORTANT] +> Desktop Analytics does not support preview (Windows Insider) builds; use Configuration Manager to deploy to your Preview ring. As noted previously, the Preview ring is a small group of devices represents your ecosystem very well in terms of app, driver, and hardware diversity. + +### Deployment plan options + +There are two ways to implement a ring deployment plan, depending on how you manage your devices: + +- If you are using Configuration Manager: Desktop Analytics provides end-to-end deployment plan integration so that you can also kick off phased deployments within a ring. Learn more about [deployment plans in Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/about-deployment-plans). +- If you are using Microsoft Intune, see [Create deployment plans directly in Intune](https://docs.microsoft.com/mem/intune/fundamentals/planning-guide). + +For more about Desktop Analytics, see these articles: + +- [How to set up Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/set-up) +- [Tutorial: Deploy Windows 10 to Pilot](https://docs.microsoft.com/mem/configmgr/desktop-analytics/tutorial-windows10) +- [Desktop Analytics documentation](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) +- [Intune deployment planning, design, and implementation guide](https://docs.microsoft.com/mem/intune/fundamentals/planning-guide) + diff --git a/windows/deployment/update/delivery-optimization-proxy.md b/windows/deployment/update/delivery-optimization-proxy.md new file mode 100644 index 0000000000..21e355ea15 --- /dev/null +++ b/windows/deployment/update/delivery-optimization-proxy.md @@ -0,0 +1,79 @@ +--- +title: Using a proxy with Delivery Optimization +manager: laurawi +description: Settings to use with various proxy configurations to allow Delivery Optimization to work +keywords: updates, downloads, network, bandwidth +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Using a proxy with Delivery Optimization + +**Applies to**: Windows 10 + +When Delivery Optimization downloads content from HTTP sources, it uses the automatic proxy discovery capability of WinHttp to streamline and maximize the support for complex proxy configurations as it makes range requests from the content server. It does this by setting the **WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY** flag in all HTTP calls. + +Delivery Optimization provides a token to WinHttp that corresponds to the user that is signed in currently. In turn, WinHttp automatically authenticates the user against the proxy server set either in Internet Explorer or in the **Proxy Settings** menu in Windows. + +For downloads that use Delivery Optimization to successfully use the proxy, you should set the proxy via Windows **Proxy Settings** or the Internet Explorer proxy settings. + +Setting the Internet Explorer proxy to apply device-wide will ensure that the device can access the proxy server even when no user is signed in. In this case, the proxy is accessed with the “NetworkService” context if proxy authentication is required. + +> [!NOTE] +> We don't recommend that you use `netsh winhttp set proxy ProxyServerName:PortNumber`. Using this offers no auto-detection of the proxy, no support for an explicit PAC URL, and no authentication to the proxy. This setting is ignored by WinHTTP for requests that use auto-discovery (if an interactive user token is used). + +If a user is signed in, the system uses the Internet Explorer proxy. + +If no user is signed in, even if both the Internet Explorer proxy and netsh configuration are set, the netsh configuration will take precedence over the Internet Explorer proxy. This can result in download failures. For example, you might receive HTTP_E_STATUS_PROXY_AUTH_REQ or HTTP_E_STATUS_DENIED errors. + +You can still use netsh to import the proxy setting from Internet Explorer (`netsh winhttp import proxy source=ie `) if your proxy configuration is a static *proxyServerName:Port*. However, the same limitations mentioned previously apply. + +### Summary of settings behavior + +These tables summarize the behavior for various combinations of settings: + +With an interactive user signed in: + +|Named proxy set by using: |Delivery Optimization successfully uses proxy | +|---------|---------| +|Internet Explorer proxy, current user | Yes | +|Internet Explorer proxy, device-wide | Yes | +|netsh proxy | No | +|Both Internet Explorer proxy (current user) *and* netsh proxy | Yes, Internet Explorer proxy is used | +|Both Internet Explorer proxy (device-wide) *and* netsh proxy | Yes, Internet Explorer proxy is used | + +With NetworkService (if unable to obtain a user token from a signed-in user): + +|Named proxy set by using: |Delivery Optimization successfully uses proxy | +|---------|---------| +|Internet Explorer proxy, current user | No | +|Internet Explorer proxy, device-wide | Yes | +|netsh proxy | Yes | +|Both Internet Explorer proxy (current user) *and* netsh proxy | Yes, netsh proxy is used | +|Both Internet Explorer proxy (device-wide) *and* netsh proxy | Yes, netsh proxy is used | + +## Setting a device-wide Internet Explorer proxy + +You can set a device-wide proxy that will apply to all users including an interactive user, LocalSystem, and NetworkService by using the [Network Proxy CSP](https://docs.microsoft.com/windows/client-management/mdm/networkproxy-csp). + +Or, if you use Group Policy, you can apply proxy settings to all users of the same device by enabling the **Computer Configuration\ Administrative Templates\ Windows Components\ Internet Explorer\ Make proxy settings per-machine (rather than per-user)** policy. + +This policy is meant to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user, so if you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer. If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings. + +## Using a proxy with Microsoft Connected Cache + +Starting with Windows 10, version 2004, you can use Connected Cache behind a proxy. In older versions, when you set Delivery Optimization to download from Connected Cache, it will bypass the proxy and try to connect directly to the Connected Cache server. This can cause failure to download. + +However, you can set the Connected Cache server to use an unauthenticated proxy. For more information, see [Microsoft Connected Cache in Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache#prerequisites-and-limitations). + + ## Related articles + +- [How can I configure Proxy AutoConfigURL Setting using Group Policy Preference (GPP)?](https://docs.microsoft.com/archive/blogs/askie/how-can-i-configure-proxy-autoconfigurl-setting-using-group-policy-preference-gpp) +- [How to use GPP Registry to uncheck automatically detect settings? ](https://docs.microsoft.com/archive/blogs/askie/how-to-use-gpp-registry-to-uncheck-automatically-detect-settings) +- [How to configure a proxy server URL and Port using GPP Registry?](https://docs.microsoft.com/archive/blogs/askie/how-to-configure-a-proxy-server-url-and-port-using-gpp-registry) diff --git a/windows/deployment/update/deploy-updates-configmgr.md b/windows/deployment/update/deploy-updates-configmgr.md new file mode 100644 index 0000000000..202b4531b9 --- /dev/null +++ b/windows/deployment/update/deploy-updates-configmgr.md @@ -0,0 +1,20 @@ +--- +title: Deploy Windows 10 updates with Configuration Manager (Windows 10) +description: Deploy Windows 10 updates with Configuration Manager +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Deploy Windows 10 updates with Configuration Manager + +**Applies to** + +- Windows 10 + +See the Microsoft Endpoint Configuration Manager [documentation](https://docs.microsoft.com/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) for details about using Configuration Manager to deploy and manage Windows 10 updates. \ No newline at end of file diff --git a/windows/deployment/update/deploy-updates-intune.md b/windows/deployment/update/deploy-updates-intune.md new file mode 100644 index 0000000000..8737d452c6 --- /dev/null +++ b/windows/deployment/update/deploy-updates-intune.md @@ -0,0 +1,20 @@ +--- +title: Deploy updates with Intune +description: Deploy Windows 10 updates with Intune +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Deploy Windows 10 updates with Intune + +**Applies to** + +- Windows 10 + +See the Microsoft Intune [documentation](https://docs.microsoft.com/mem/intune/protect/windows-update-for-business-configure#windows-10-feature-updates) for details about using Intune to deploy and manage Windows 10 updates. \ No newline at end of file diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md deleted file mode 100644 index eb1b10ab08..0000000000 --- a/windows/deployment/update/device-health-get-started.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Get started with Device Health -description: Configure Device Health in Azure Monitor to monitor health (such as crashes and sign-in failures) for your Windows 10 devices. -keywords: Device Health, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers, azure -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.date: 10/29/2018 -ms.reviewer: -manager: laurawi -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Get started with Device Health - -This topic explains the steps necessary to configure your environment for Windows Analytics Device Health. - -- [Get started with Device Health](#get-started-with-device-health) - - [Add the Device Health solution to your Azure subscription](#add-the-device-health-solution-to-your-azure-subscription) - - [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics) - - [Use Device Health to monitor device crashes, app crashes, sign-in failures, and more](#use-device-health-to-monitor-device-crashes-app-crashes-sign-in-failures-and-more) - - [Related topics](#related-topics) - - - -## Add the Device Health solution to your Azure subscription - -Device Health is offered as a *solution* which you link to a new or existing [Azure Monitor](https://azure.microsoft.com/services/monitor/) *workspace* within your Azure *subscription*. To configure this, follows these steps: - -1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. - - >[!NOTE] - > Device Health is included at no additional cost with Windows 10 [education and enterprise licensing](https://docs.microsoft.com/windows/deployment/update/device-health-monitor#device-health-licensing). An Azure subscription is required for managing and using Device Health, but no Azure charges are expected to accrue to the subscription as a result of using Device Health. - -2. In the Azure portal select **Create a resource**, search for "Device Health", and then select **Create** on the **Device Health** solution. - ![Azure portal page highlighting + Create a resource and with Device Health selected](images/CreateSolution-Part1-Marketplace.png) - - ![Azure portal showing Device Health fly-in and Create button highlighted(images/CreateSolution-Part2-Create.png)](images/CreateSolution-Part2-Create.png) -3. Choose an existing workspace or create a new workspace to host the Device Health solution. - ![Azure portal showing Azure Monitor workspace fly-in](images/CreateSolution-Part3-Workspace.png) - - If you are using other Windows Analytics solutions (Upgrade Readiness or Update Compliance) you should add Device Health to the same workspace. - - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: - - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. - - For the resource group setting select **Create new** and use the same name you chose for your new workspace. - - For the location setting, choose the Azure region where you would prefer the data to be stored. - - For the pricing tier select **per GB**. -4. Now that you have selected a workspace, you can go back to the Device Health blade and select **Create**. - ![Azure portal showing workspace selected and with Create button highlighted](images/CreateSolution-Part4-WorkspaceSelected.png) -5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.DeviceHealth' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear. - ![Azure portal all services page with Azure Monitor found and selected as favorite](images/CreateSolution-Part5-GoToResource.png) - - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Device Health solution. - - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour. - -## Enroll devices in Windows Analytics - -Once you've added Device Health to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Device Health there are two key steps for enrollment: -1. Deploy your CommercialID (from Device Health Settings page) to your Windows 10 devices (typically using Group Policy or similar) -2. Ensure the Windows Diagnostic Data setting on devices is set to Enhanced or Full (typically using Group Policy or similar). Note that the [Limit Enhanced](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) policy can substantially reduce the amount of diagnostic data shared with Microsoft while still allowing Device Health to function. -For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - -After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it may take 48-72 hours for the first data to appear in the solution. Until then, the Device Health tile will show "Performing Assessment." - -## Use Device Health to monitor device crashes, app crashes, sign-in failures, and more - -Once your devices are enrolled and data is flowing, you can move on to [Using Device Health](device-health-using.md). - ->[!NOTE] ->You can remove the Device Health solution from your workspace if you no longer want to monitor your organization’s devices. Windows diagnostic data will continue to be shared with Microsoft as normal as per the diagnostic data sharing settings on the devices. - -## Related topics - -[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)
              -For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics) diff --git a/windows/deployment/update/device-health-monitor.md b/windows/deployment/update/device-health-monitor.md deleted file mode 100644 index 027f6cd65b..0000000000 --- a/windows/deployment/update/device-health-monitor.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Monitor the health of devices with Device Health -ms.reviewer: -manager: laurawi -description: You can use Device Health in Azure Portal to monitor the frequency and causes of crashes and misbehaving apps on devices in your network. -keywords: oms, operations management suite, wdav, health, log analytics -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.localizationpriority: medium -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-analytics -ms.topic: article ---- - -# Monitor the health of devices with Device Health - -## Introduction - -Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by providing IT with reports on some common problems the end users might experience so they can be proactively remediated, thus saving support calls and improving end-user productivity. - -Like Upgrade Readiness and Update Compliance, Device Health is a solution built in Azure Portal, a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This release is free for customers to try and will not incur charges on your Azure Portal workspace for its use. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) . - -Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health from the Azure Portal solution gallery and add it to your Azure Portal workspace. Device Health requires enhanced diagnostic data, so you might need to implement this policy if you've not already done so. - - -Device Health provides the following: - -- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced -- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes -- Notification of Windows Information Protection misconfigurations that send prompts to end users -- No need for new complex customized infrastructure, thanks to cloud-connected access using Windows 10 diagnostic data - -See the following topics in this guide for detailed information about configuring and using the Device Health solution: - -- [Get started with Device Health](device-health-get-started.md): How to add Device Health to your environment. -- [Using Device Health](device-health-using.md): How to begin using Device Health. - -An overview of the processes used by the Device Health solution is provided below. - -## Device Health licensing - -Use of Windows Analytics Device Health requires one of the following licenses: - -- Windows 10 Enterprise or Windows 10 Education per-device with active Software Assurance -- Windows 10 Enterprise E3 or E5 per-device or per-user subscription (including Microsoft 365 F1, E3, or E5) -- Windows 10 Education A3 or A5 (including Microsoft 365 Education A3 or A5) -- Windows VDA E3 or E5 per-device or per-user subscription - - -You don't have to install Windows 10 Enterprise on a per-device basis--you just need enough of the above licenses for the number of devices using Device Health. - - -## Device Health architecture - -The Device Health architecture and data flow is summarized by the following five-step process: - - - -**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
              -**(2)** Diagnostic data is analyzed by the Microsoft Telemetry Service.
              -**(3)** Diagnostic data is pushed from the Microsoft Telemetry Service to your Azure Portal workspace.
              -**(4)** Diagnostic data is available in the Device Health solution.
              -**(5)** You are now able to proactively monitor Device Health issues in your environment.
              - -These steps are illustrated in following diagram: - - [![](images/analytics-architecture.png)](images/analytics-architecture.png) - ->[!NOTE] ->This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - - - -  -## Related topics - -[Get started with Device Health](device-health-get-started.md) - -[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md) - -For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics) diff --git a/windows/deployment/update/device-health-using.md b/windows/deployment/update/device-health-using.md deleted file mode 100644 index 72d8385c62..0000000000 --- a/windows/deployment/update/device-health-using.md +++ /dev/null @@ -1,315 +0,0 @@ ---- -title: Using Device Health -ms.reviewer: -manager: laurawi -description: Explains how to begin usihg Device Health. -ms.prod: w10 -ms.mktglfcycl: deploy -keywords: oms, operations management suite, wdav, health, log analytics -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Using Device Health - -This section describes how to use Device Health to monitor devices deployed on your network and troubleshoot the causes if they crash. - - -Device Health provides IT Pros with reports on some common problems that users might experience so that they can be proactively remediated. This decreases support calls and improves productivity. - -Device Health provides the following benefits: - -- Identification of devices that crash frequently and therefore might need to be rebuilt or replaced -- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes -- Notification of Windows Information Protection misconfigurations that send prompts to end users - - ->[!NOTE] ->Information is refreshed daily so that health status can be monitored. Changes will be displayed about 24-48 hours after their occurrence, so you always have a recent snapshot of your devices. - -In Azure Portal, the aspects of a solution's dashboard are usually divided into blades. Blades are a slice of information, typically with a summarization tile and an enumeration of the items that makes up that data. All data is presented through queries. Perspectives are also possible, wherein a given query has a unique view designed to display custom data. The terminology of blades, tiles, and perspectives will be used in the sections that follow. - - -## Device Reliability - -- [Frequently crashing devices](#frequently-crashing-devices) -- [Driver-induced OS crashes](#driver-induced-crashes) - - - -### Frequently Crashing Devices - -This middle blade in Device Reliability displays the devices that have crashed the most often in the last week. This can help you identify unhealthy devices that might need to be rebuilt or replaced. - -See the following example: - - -![The blade in the middle summarizes devices that crash most often](images/dev-health-main-tile-sterile.png) - -Clicking the header of the Frequently Crashing Devices blade opens a reliability perspective view, where you can filter data (by using filters in the left pane), see trends, and compare to commercial averages: - -![Reliability perspective](images/device-reliability2-sterile.png) - -"Commercial averages" here refers to data collected from deployments with a mix of operating system versions and device models that is similar to yours. If your crash rate is higher, there are opportunities for improvement, for example by moving to newer driver versions. - -Notice the filters in the left pane; they allow you to filter the crash rate shown to a particular operating system version, device model, or other parameter. - ->[!NOTE] ->Use caution when interpreting results filtered by model or operating system version. This is very useful for troubleshooting, but might not be accurate for *comparisons* because the crashes displayed could be of different types. The overall goal for working with crash data is to ensure that most devices have the same driver versions and that the version has a low crash rate. - ->[!TIP] ->Once you've applied a filter (for example setting OSVERSION=1607) you will see the query in the text box change to append the filter (for example, with “(OSVERSION=1607)”). To undo the filter, remove that part of the query in the text box and click the search button to the right of the text box to run the adjusted query.” - - -If you click through a particular device from the view blade or from the Device Reliability perspective, it will take you to the Crash History perspective for that device. - -![Device detail and history](images/device-crash-history2-sterile.png) - -This displays device records sorted by date and crash details by failure ID, also sorted by date. In this view are a number of useful items: - -- Crash history records by date, aggregated by Failure ID. The Failure ID is an internal number that is used to group crashes that are related to each other. Eventually over time, you can use the Failure ID to provide additional info. If a crash was caused by driver, some driver fields will also be populated. - -- StopCode: this is hex value that would be displayed on a bluescreen if you were looking directly at the affected device. - -- Count: the number times that particular Failure ID has occurred on that specific device *on that date*. - - - - -### Driver-induced crashes - -This blade (on the right) displays drivers that have caused the most devices to crash in the last two weeks. If your crash rate is high, you can reduce the overall operating system crashes in your deployment by upgrading those drivers with a high crash rate. - - -![The blade on the right summarizes devices that crash most often](images/dev-health-main-tile-sterile.png) - -Clicking a listed driver on the Driver-Induced OS Crashes blade opens a driver perspective view, which shows the details for the responsible driver, trends and commercial averages for that driver, and alternative versions of the driver. - -![Driver detail and history](images/driver-detail-1-sterile.png) -![Driver detail and history scrolldown](images/driver-detail-2-sterile.png) - -The driver version table can help you determine whether deploying a newer version of the driver might help you reduce the crash rate. In the example shown above, the most commonly installed driver version (19.15.1.5) has a crash rate of about one-half of one percent--this is low, so this driver is probably fine. However, driver version 19.40.0.3 has a crash rate of almost 20%. If that driver had been widely deployed, updating it would substantially reduce the overal number of crashes in your organization. - - -## App Reliability - -The App Reliability report shows you useful data on app usage and behavior so that you can identify apps that are misbehaving and then take steps to resolve the problem. - -### App reliability events - -The default view includes the **Devices with events** count, which shows the number of devices in your organization that have logged a reliability event for a given app over the last 14 days. A "reliability event" occurs when an app either exits unexpectedly or stops responding. The table also includes a **Devices with Usage** count. This enables you to see how widely used the app was over the same period to put the Devices with Events count into perspective. - -![Main App Reliability view](images/app-reliability-main.png) - -When you click a particular app, the detailed **App reliability** view opens. The first element in the view is the App Information summary: - -![App reliability view with columns for app name, publisher, devices with usage, devices with events, percentage of devices with events logged for that app, and percentage of devices with events as a "commercial average"](images/app-reliability-app-detail.png) - -This table contains: - -- App name -- Publisher -- Devices with usage: the number of unique devices that logged any usage of the app -- Devices with events: the number of unique devices that logged any reliability event for the app -- % with events: the ratio of "devices with events" to "devices with usage" -- % with events (commercial average): the ratio of "devices with events" to "devices with usage" in data collected from deployments with a mix of operating system versions and device models that is similar to yours. This can help you decide if a given app is having problems specifically in your environment or more generally in many environments. - -#### Trend section -Following the App Information summary is the trend section: - -![Trend view](images/app-reliability-trend-view.png) - -With these trend graphs you can more easily detect if an issue is growing, shrinking, or steady. The trend graph on the left shows the number of devices that logged any reliability event for the app. The trend graph on the right shows the ratio of "devices with events" to "devices with usage." - -Each graph displays two lines: - -- Trailing window: in this line, each day’s value reflects reliability events that occurred in the 14 days leading up to that day. This is useful for gauging the long-term trend with reduced volatility due to weekends and small populations. -- Single day: Each day’s value reflects reliability events that occurred in a single day. This is useful if an issue is quickly emerging (or being resolved). - -#### App and OS versions table -The next element in the view is the App and OS versions table: - - -![App/OS version view](images/app-reliability-app-OS-version.png) - -This table breaks out the metrics by combinations of App and OS version. This enables you to identify patterns in that might indicate devices needing an update or configuration change. - -For example, if the table shows that a later version of an app is more reliable than an earlier version in your environment, then prioritizing deployment of the later version is likely the best path forward. If you are already running the latest version of the app, but reliability events are increasing, then you might need to do some troubleshooting, or seek support from Microsoft or the app vendor. - -By default the table is limited to the most-used version combinations in your environment. To see all version combinations click anywhere in the table. - - -#### Reliability event history table - -The next element in the view is the reliability event history table: - -![event history view](images/app-reliability-event-history.png) - -This table shows the most detailed information. Although Device Health is not a debugging tool, the details available in this table can help with troubleshooting by providing the specific devices, versions, and dates of the reliability events. - -This view also includes the **Diagnostic Signature** column. This value can be helpful when you are working with product support or troubleshooting on your own. The value (also known as Failure ID or Failure Name) is the same identifier used to summarize crash statistics for Microsoft and partner developers. - -The Diagnostic Signature value contains the type of reliability event, error code, DLL name, and function name involved. You can use this information to narrow the scope of troubleshooting. For example, a value like *APPLICATION_HANG_ThreadHang_Contoso-Add-In.dll!GetRegistryValue()* implies that the app stopped responding when Contoso-Add-In was trying to read a registry value. In this case you might prioritize updating or disabling the add-in, or using Process Monitor to identify the registry value it was trying to read, which could lead to a resolution through antivirus exclusions, fixing missing keys, or similar remedies. - - -By default the table is limited to a few recent rows. To see all rows click anywhere in the table. - - -### FAQs and limitations - -#### Why does a particular app not appear in the views? -When we allow reliability events from all processes, the list of apps fills with noisy processes which don't feel like meaningful end-user apps (for example, taskhost.exe or odd-test-thing.exe). In order to draw focus to the apps which matter most to users, App Reliability uses a series of filters to limit what appears in the list. The filter criteria include the following: - -- Filter out background processes which have no detected user interaction. -- Filter out operating system processes which, despite having user interaction, do not feel like apps (for example, Logonui.exe, Winlogon.exe). **Known limitation:** Some processes which may feel like apps are not currently detected as such (and are therefore filtered out as OS processes). These include Explorer.exe, Iexplore.exe, Microsoftedge.exe, and several others. -- Remove apps which are not widely used in your environment. **Known limitation:** This might result in an app that you consider important being filtered out when that app is not among the 30 most widely used in your environment. - - -We welcome your suggestions and feedback on this filtering process at the [Device Health Tech Community](https://aka.ms/community/DeviceHealth). - -#### Why are there multiple names and entries for the same app? -For example, you might see *Skype for Business*, *‘skype for business’*, and *Lync* listed separately, but you only use *Skype for Business*. Or you might see *MyApp Pro* and *MyApp Professional* listed separately, even though they feel like the same thing. - -Apps have many elements of metadata which describe them. These include an Add/Remove programs title (“Contoso Suite 12”), executable file names (“ContosoCRM.exe”), executable display name (“Contoso CRM”), and others. App publishers (and in some cases app re-packagers) set these values. For the most part we leave the data as set by the publisher which can lead to some report splitting. In certain cases we apply transformations to reduce splitting, for example we (by design) convert many values to lower case so that incoming data such as "Contoso CRM" and "CONTOSO CRM" become the same app name for reporting. - - - -#### Clicking an app in the App Reliability Events blade sometimes results a List view of records instead of the App Reliability view -To work around this, click the **App Reliability** tab above the results to see the expected view. - -![Click app reliability tab](images/app-reliability-tab.png) - - -#### Clicking "See all…" from the App Reliability Events blade followed by clicking an app from the expanded list results in raw records instead of the App Reliability view -To work around this, replace all of the text in the Log Search query box with the following: - -*DHAppReliability | where AppFileDisplayName == "\"* - -For example: - -*DHAppReliability | where AppFileDisplayName == "Microsoft Outlook"* - - - -## Login Health - -Login Health provides reports on Windows login attempts in your environment, including metrics on the login methods being used (such as Windows Hello, face recognition, fingerprint recognition, PIN, or password), the rates and patterns of login success and failure, and the specific reasons logins have failed. - -The Login Health blades appear in the Device Health dashboard: - - -![Main Login health view](images/login-health.png) - -### Login Errors -The **Login errors** blade displays data on the frequency and type of errors, with statistics on specific errors. They are generally categorized into user-generated (caused by bad input) or non-user-generated (might need IT intervention) errors. Click any individual error to see all instances of the error's occurence for the specified time period. - -### Login Metrics by Type -The **Login metrics by type** blade shows the success rate for your devices, as well as the success rate for other environments with a mix of operating system versions and device models similar to yours (the **Commercial average success rate**). - -In the table (by type) you can gauge how broadly each login type is attempted, the number of devices that prefer the type (most used), and the success rate. If migration from passwords to an alternative such as Hello: PIN is going well, you would see high usage and high success rates for the new type. - -Click any of the login types to see detailed login health data for that type: - -![Login type detail](images/login-health-detail.png) - -This view shows trends over time of usage, preferred credentials, and success rate along with the most frequent errors and frequently failing devices for that login type. - -Click a specific login error in this view to see a list of all instances for that error and login type within the specified time range: - -![Login error detail](images/login-health-detail-failure.png) - -Included in this view are device attributes and error attributes such as the following: - -- LogonStatus/LogonSubStatus: Status code for the login attempt -- SignInFailureReason: Known failure reasons evaluated from status or sub-status -- SuggestedSignInRemediation: Suggested remediation that was presented to the user at the time of error - -The filters in the left pane allow you to filter errors to a particular operating system, device model, or other parameters. Alternatively, clicking the most frequently failing models from the Login Health perspective will take you to a list of error instances filtered to the login type and specified device model within the specified time range. - ->[!NOTE] -> Windows Hello: Face authentication errors are not currently included in the login health reports. - - - - -## Windows Information Protection - - -Windows Information Protection (WIP) helps protect work data from accidental sharing. Users might be disrupted if WIP rules are not aligned with real work behavior. WIP App Learning shows which apps on which computers are attempting to cross policy boundaries. - -For details about deploying WIP policies, see [Protect your enterprise data using Windows Information Protection (WIP)](https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). - -Once you have WIP policies in place, by using the WIP section of Device Health, you can: - -- Reduce disruptive prompts by adding rules to allow data sharing from approved apps. -- Tune WIP rules, for example by confirming that certain apps are allowed or disallowed by current policy. - - -![Main Windows Information Protection view](images/WIPNEWMAIN-sterile.png) - - -Clicking through the **APP LEARNING** tile shows details of app statistics that you can use to explore each incident and update app policies by using AppLocker or WIP AppIDs. - -![WIP details view](images/WIPNEW1-chart-selected-sterile.png) - -In this chart view, you can click a particular app listing, which will open additional details on the app in question, including details you need to adjust your Windows Information Protection Policy: - -![WIP details view for a specific app](images/WIPappID-sterile.png) - -Here you can copy the WipAppid and use that for adjusting the WIP policy. - -## Data model and built-in extensibility - -All of the views and blades display slices of the most useful data by using pre-formed queries. You have access to the full set of data collected by Device Health, which means you can construct your own queries to expose any data that is of interest to you. For documentation on working with log searches, see [Find data using log searches](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-searches). This topic section provides information about the data types being populated specifically by Device Health. - -### Example queries - -You can run these queries from the Azure Portal **Log Search** interface (available at several points in the Device Health interface) by just typing them in. There are few details to be aware of: - -- After running a query, make sure to set the date range (which appears upper left after running initial query) to "7 days" to ensure you get data back. -- If you see the search tutorial dialog appearing frequently, it's likely because you are have read-only access to the Azure Portal workspace. Ask a workspace administrator to grant you "contributor" permissions (which is required for the "completed tutorial" state to persist). -- If you use the search filters in the left pane, you might notice there is no control to undo a filter selection. To undo a selection, delete the (FilterName="FilterValue") element that is appended to the search query and then click the search button again. For example, after you run a base query of *Type = DHOSReliability KernelModeCrashCount > 0*, a number of filter options appear on the left. If you then filter on **Manufacturer** (for example, by setting *Manufacturer="Microsoft Corporation"* and then clicking **Apply**), the query will change to *Type = DHOSReliability KernelModeCrashCount > 0 (Manufacturer="Microsoft Corporation")*. Delete *(Manufacturer="Microsoft Corporation")* and then click the **search** button again to re-run the query without that filter. - -### Device reliability query examples - -| Data | Query | -|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Total devices | Type = DHOSReliability \| measure countdistinct(ComputerID) by Type | -| Number of devices that have crashed in the last three weeks | Type = DHOSReliability KernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by Type | -| Compare the percentage of your devices that have not crashed with the percentage of similar devices outside your organization ("similar" here means other commercial devices with the same mix of device models, operating system versions and update levels). | Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices by Type \| Display Table | -| As above, but sorted by device manufacturer | Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by Manufacturer \| sort NumberDevices desc \| Display Table | -| As above, but sorted by model | Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by ModelFamily\| sort NumberDevices desc \| Display Table | -| As above, but sorted by operating system version | Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by OSVersion \| sort NumberDevices desc \| Display Table | -| Crash rate trending in my organization compared to the commercial average. Each interval shows percentage of devices that crashed at least once in the trailing two weeks | Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices by TimeGenerated \| Display LineChart | -| Table of devices that have crashed the most in the last two weeks | Type = DHOSReliability KernelModeCrashCount > 0 \| Dedup ComputerID \| select Computer, KernelModeCrashCount \| sort TimeGenerated desc, KernelModeCrashCount desc \| Display Table | -| Detailed crash records, most recent first | Type = DHOSCrashData \| sort TimeGenerated desc, Computer asc \| display Table | -| Number of devices that crashed due to drivers | Type = DHDriverReliability DriverKernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by Type | -| Table of drivers that have caused the most devices to crash | Type = DHDriverReliability DriverKernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by DriverName \| Display Table | -| Trend of devices crashed by driver by day | \* Type=DHOSCrashData DriverName!="ntkrnlmp.exe" DriverName IN {Type=DHOSCrashData \| measure count() by DriverName | -| Crashes for different versions of a given driver (replace netwtw04.sys with the driver you want from the previous list). This lets you get an idea of which *versions* of a given driver work best with your devices | Type = DHDriverReliability DriverName="netwtw04.sys" \| Dedup ComputerID \| sort TimeGenerated desc \| measure countdistinct(ComputerID) as InstallCount, sum(map(DriverKernelModeCrashCount,1,10000, 1)) as DevicesCrashed by DriverVersion \| Display Table | -| Top crashes by FailureID | Type =DHOSCrashData \| measure count() by KernelModeCrashFailureId \| Display Table | - -### Windows Information Protection (WIP) App Learning query examples - -| Data | Query | -|------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------| -| Apps encountering policy boundaries on the most computers (click on an app in the results to see details including computer names) | Type=DHWipAppLearning \| measure countdistinct(ComputerID) as ComputerCount by AppName | -| Trend of App Learning activity for a given app. Useful for tracking activity before and after a rule change | Type=DHWipAppLearning AppName="MICROSOFT.SKYPEAPP" | - -### Exporting data and configuring alerts - -Azure Portal enables you to export data to other tools. To do this, in any view that shows **Log Search** just click the **Export** button. Similarly, clicking the **Alert** button will enable you to run a query automaticlaly on a schedule and receive email alerts for particular query results that you set. If you have a PowerBI account, then you will also see a **PowerBI** button that enables you to run a query on a schedule and have the results automatically saved as a PowerBI data set. - - - - -## Related topics - -[Get started with Device Health](device-health-get-started.md)
              - -For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics) diff --git a/windows/deployment/update/eval-infra-tools.md b/windows/deployment/update/eval-infra-tools.md new file mode 100644 index 0000000000..ce3c85e030 --- /dev/null +++ b/windows/deployment/update/eval-infra-tools.md @@ -0,0 +1,69 @@ +--- +title: Evaluate infrastructure and tools +manager: laurawi +description: Steps to make sure your infrastructure is ready to deploy updates +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Evaluate infrastructure and tools + +Before you deploy an update, it's best to assess your deployment infrastructure (that is, tools such as Configuration Manager, Microsoft Intune, or similar) and current configurations (such as security baselines, administrative templates, and policies that affect updates). Then, set some criteria to define your operational readiness. + +## Infrastructure + +Do your deployment tools need updates? + +- If you use Configuration Manager, is it on the Current Branch with the latest release installed. Being on this branch ensures that it supports the next Windows 10 feature update. Configuration Manager releases are supported for 18 months. +- Using a cloud-based management tool like Microsoft Intune reduces support challenges, since no related products need to be updated. +- If you use a non-Microsoft tool, check with its product support to make sure you're using the current version and that it supports the next Windows 10 feature update. + +Rely on your experiences and data from previous deployments to help you judge how long infrastructure changes take and identify any problems you've encountered while doing so. + +## Device settings + +Make sure your security baseline, administrative templates, and policies have the right settings to support your devices once the new Windows 10 update is installed. + +### Security baseline + +Keep security baselines current to help ensure that your environment is secure and that new security feature in the coming Windows 10 update are set properly. + +- **Microsoft security baselines**: You should implement security baselines from Microsoft. They are included in the [Security Compliance Toolkit](https://www.microsoft.com/download/details.aspx?id=55319), along with tools for managing them. +- **Industry- or region-specific baselines**: Your specific industry or region might have particular baselines that you must follow per regulations. Ensure that any new baselines support the version of Windows 10 you are about to deploy. + +### Configuration updates + +There are a number of Windows policies (set by Group Policy, Intune, or other methods) that affect when Windows updates are installed, deferral, end-user experience, and many other aspects. Check these policies to make sure they are set appropriately. + +- **Windows 10 Administrative templates**: Each Windows 10 feature update has a supporting Administrative template (.admx) file. Group Policy tools use Administrative template files to populate policy settings in the user interface. The templates are available in the Download Center, for example, this one for [Windows 10, version 1909](https://www.microsoft.com/download/100591). +- **Policies for update compliance and end-user experience**: A number of settings affect when a device installs updates, whether and for how long a user can defer an update, restart behavior after installation, and many other aspects of update behavior. It's especially important to look for existing policies that are out of date or could conflict with new ones. + + +## Define operational readiness criteria + +When you’ve deployed an update, you’ll need to make sure the update isn’t introducing new operational issues. And you’ll also ensure that if incidents arise, the needed documentation and processes are available. Work with your operations and support team to define acceptable trends and what documents or processes require updating: + +- **Call trend**: Define what percentage increase in calls relating to Windows 10 feature updates are acceptable or can be supported. +- **Incident trend**: Define what percentage of increase in calls asking for support relating to Windows 10 feature updates are acceptable or can be supported. +- **Support documentation**: Review supporting documentation that requires an update to support new infrastructure tooling or configuration as part of the Windows 10 feature update. +- **Process changes:** Define and update any processes that will change as a result of the Windows 10 feature update. + +Your operations and support staff can help you determine if the appropriate information is being tracked at the moment. If it isn't, work out how to get this information so you can gain the right insight. + +## Tasks + +Finally, you can begin to carry out the work needed to ensure your infrastructure and configuration can support the update. To help you keep track, you can classify the work into the following overarching tasks: + +- **Review infrastructure requirements**: Go over the details of requirements to support the update, and ensure they’ve all been defined. +- **Validate infrastructure against requirements**: Compare your infrastructure against the requirements that have been identified for the update. +- **Define infrastructure update plan**: Detail how your infrastructure must change to support the update. +- **Review current support volume**: Understand the current support volume to understand how much of an effect the update has when it’s been deployed. +- **Identify gaps that require attention**: Identify issues that will need to be addressed to successfully deploy the update. For example, will your infrastructure engineer have to research how a new feature that comes with the update might affect the infrastructure? +- **Define operational update plan**: Detail how your operational services and processes must change to support the update. diff --git a/windows/deployment/update/feature-update-conclusion.md b/windows/deployment/update/feature-update-conclusion.md index 7cd119e52b..d8206d5491 100644 --- a/windows/deployment/update/feature-update-conclusion.md +++ b/windows/deployment/update/feature-update-conclusion.md @@ -1,24 +1,25 @@ ---- -title: Best practices for feature updates - conclusion -description: Final thoughts about how to deploy feature updates -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/09/2018 -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Conclusion - -**Applies to**: Windows 10 - -Mission critical devices that need to be online 24x7 pose unique challenges for the IT Pro looking to stay current with the latest Windows 10 feature update. Because these devices are online continually, providing mission critical services, with only a small window of time available to apply feature updates, specific procedures are required to effectively keep these devices current, with as little downtime as possible. - -Whether you have defined servicing windows at your disposal where feature updates can be installed automatically, or you require user initiated installs by a technician, this whitepaper provides guidelines for either approach. Improvements are continually being made to Windows 10 setup to reduce device offline time for feature updates. This whitepaper will be updated as enhancements become available to improve the overall servicing approach and experience. - +--- +title: Best practices for feature updates - conclusion +description: This article includes final thoughts about how to deploy and stay up-to-date with Windows 10 feature updates. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Conclusion + +**Applies to**: Windows 10 + +Mission critical devices that need to be online 24x7 pose unique challenges for the IT Pro looking to stay current with the latest Windows 10 feature update. Because these devices are online continually, providing mission critical services, with only a small window of time available to apply feature updates, specific procedures are required to effectively keep these devices current, with as little downtime as possible. + +Whether you have defined servicing windows at your disposal where feature updates can be installed automatically, or you require user initiated installs by a technician, this whitepaper provides guidelines for either approach. Improvements are continually being made to Windows 10 setup to reduce device offline time for feature updates. This whitepaper will be updated as enhancements become available to improve the overall servicing approach and experience. + diff --git a/windows/deployment/update/feature-update-maintenance-window.md b/windows/deployment/update/feature-update-maintenance-window.md index 0fbe54bae5..c586284056 100644 --- a/windows/deployment/update/feature-update-maintenance-window.md +++ b/windows/deployment/update/feature-update-maintenance-window.md @@ -1,261 +1,261 @@ ---- -title: Best practices - deploy feature updates during maintenance windows -description: Learn how to deploy feature updates during a maintenance window -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/09/2018 -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Deploy feature updates during maintenance windows - -**Applies to**: Windows 10 - -Use the following information to deploy feature updates during a maintenance window. - -## Get ready to deploy feature updates - -### Step 1: Configure maintenance windows - -1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**. -2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s). -3. On the **Home** tab, in the **Properties** group, choose **Properties**. -4. In the **Maintenance Windows** tab of the `` Properties dialog box, choose the New icon. -5. Complete the `` Schedule dialog. -6. Select from the Apply this schedule to drop-down list. -7. Choose **OK** and then close the **\ Properties** dialog box. - -### Step 2: Review computer restart device settings - -If you’re not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration. - -For example, by default, 90 minutes will be honored before the system is rebooted after the feature update install. If users will not be impacted by the user logoff or restart, there is no need to wait a full 90 minutes before rebooting the computer. If a delay and notification is needed, ensure that the maintenance window takes this into account along with the total time needed to install the feature update. - ->[!NOTE] -> The following settings must be shorter in duration than the shortest maintenance window applied to the computer. ->- **Display a temporary notification to the user that indicates the interval before the user is logged off or the computer restarts (minutes).** ->- **Display a dialog box that the user cannot close, which displays the countdown interval before the user is logged off or the computer restarts (minutes).** - -### Step 3: Enable Peer Cache - -Use **Peer Cache** to help manage deployment of content to clients in remote locations. Peer Cache is a built-in Configuration Manager solution that enables clients to share content with other clients directly from their local cache. - -[Enable Configuration Manager client in full OS to share content](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update). - -### Step 4: Override the default Windows setup priority (Windows 10, version 1709 and later) - -If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. - -%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini - -``` -[SetupConfig] -Priority=Normal -``` - -You can use the new [Run Scripts](https://docs.microsoft.com/sccm/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices. - -``` -#Parameters -Param( - [string] $PriorityValue = "Normal" - ) - -#Variable for ini file path -$iniFilePath = "$env:SystemDrive\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini" - -#Variables for SetupConfig -$iniSetupConfigSlogan = "[SetupConfig]" -$iniSetupConfigKeyValuePair =@{"Priority"=$PriorityValue;} - -#Init SetupConfig content -$iniSetupConfigContent = @" -$iniSetupConfigSlogan -"@ - -#Build SetupConfig content with settings -foreach ($k in $iniSetupConfigKeyValuePair.Keys) -{ - $val = $iniSetupConfigKeyValuePair[$k] - - $iniSetupConfigContent = $iniSetupConfigContent.Insert($iniSetupConfigContent.Length, "`r`n$k=$val") -} - -#Write content to file -New-Item $iniFilePath -ItemType File -Value $iniSetupConfigContent -Force - -Disclaimer -Sample scripts are not supported under any Microsoft standard support program or service. The sample scripts is -provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without -limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk -arising out of the use or performance of the sample script and documentation remains with you. In no event shall -Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable -for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, -loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script -or documentation, even if Microsoft has been advised of the possibility of such damages. -``` - ->[!NOTE] ->If you elect not to override the default setup priority, you will need to increase the [maximum run time](https://docs.microsoft.com/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. - -## Manually deploy feature updates - -The following sections provide the steps to manually deploy a feature update. - -### Step 1: Specify search criteria for feature updates -There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying feature updates is to identify the feature updates that you want to deploy. - -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. -3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: - - In the search text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. - - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, Required is greater than or equal to 1, and Language equals English. - -4. Save the search for future use. - -### Step 2: Download the content for the feature update(s) -Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. - -1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. -2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select Download. - - The **Download Software Updates Wizard** opens. -3. On the **Deployment Package** page, configure the following settings: - **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings: - - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. - - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. - - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. - - >[!NOTE] - >The deployment package source location that you specify cannot be used by another software deployment package. - - >[!IMPORTANT] - >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. - - >[!IMPORTANT] - >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. - - Click **Next**. -4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). - - >[!NOTE] - >The Distribution Points page is available only when you create a new software update deployment package. -5. On the **Distribution Settings** page, specify the following settings: - - - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority. - - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). - - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options: - - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. - - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. - - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. - - For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). - Click **Next**. -6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: - - - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting. - - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access. - - >[!NOTE] - >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. - - Click **Next**. -7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. -8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. -9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close. - -#### To monitor content status -1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. -2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. -3. Select the feature update package that you previously identified to download the feature updates. -4. On the **Home** tab, in the Content group, click **View Status**. - -### Step 3: Deploy the feature update(s) -After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). - -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. -3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. - - The **Deploy Software Updates Wizard** opens. -4. On the General page, configure the following settings: - - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\** - - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default. - - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct. - - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time. - - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment. -5. On the Deployment Settings page, configure the following settings: - - - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline. - - >[!IMPORTANT] - > After you create the software update deployment, you cannot later change the type of deployment. - - >[!NOTE] - >A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured. - - - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when Type of deployment is set to Required. - - >[!WARNING] - >Before you can use this option, computers and networks must be configured for Wake On LAN. - - - **Detail level**: Specify the level of detail for the state messages that are reported by client computers. -6. On the Scheduling page, configure the following settings: - - - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console. - - >[!NOTE] - >When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time. - - - **Software available time**: Select **As soon as possible** to specify when the software updates will be available to clients: - - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation. - - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment. - - >[!NOTE] - >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. - - - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. Set the date and time value to correspond with your defined maintenance window for the target collection. Allow sufficient time for clients to download the content in advance of the deadline. Adjust accordingly if clients in your environment will need additional download time. E.g., slow or unreliable network links. - - >[!NOTE] - >The actual installation deadline time is the specific time that you configure plus a random amount of time up to 2 hours. This reduces the potential impact of all client computers in the destination collection installing the software updates in the deployment at the same time. Configure the Computer Agent client setting, Disable deadline randomization to disable the installation randomization delay for the required software updates to allow a greater chance for the installation to start and complete within your defined maintenance window. For more information, see [Computer Agent](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#computer-agent). -7. On the User Experience page, configure the following settings: - - **User notifications**: Specify whether to display notification of the software updates in Software Center on the client computer at the configured **Software available time** and whether to display user notifications on the client computers. When **Type of deployment** is set to **Available** on the Deployment Settings page, you cannot select **Hide in Software Center and all notifications**. - - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. For more information about maintenance windows, see [How to use maintenance windows](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows). - - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation. - - >[!IMPORTANT] - >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. - - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device. - - >[!NOTE] - >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. - - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window. -8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. - - >[!NOTE] - >You can review recent software updates alerts from the Software Updates node in the Software Library workspace. -9. On the Download Settings page, configure the following settings: - - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location. - - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point. - - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). - - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content. - - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection. - - >[!NOTE] - >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). -10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. -11. Click **Next** to deploy the feature update(s). - -### Step 4: Monitor the deployment status -After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: - -1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. -2. Click the software update group or software update for which you want to monitor the deployment status. -3. On the **Home** tab, in the **Deployment** group, click **View Status**. +--- +title: Best practices - deploy feature updates during maintenance windows +description: Learn how to configure maintenance windows and how to deploy feature updates during a maintenance window. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Deploy feature updates during maintenance windows + +**Applies to**: Windows 10 + +Use the following information to deploy feature updates during a maintenance window. + +## Get ready to deploy feature updates + +### Step 1: Configure maintenance windows + +1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**. +2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s). +3. On the **Home** tab, in the **Properties** group, choose **Properties**. +4. In the **Maintenance Windows** tab of the `` Properties dialog box, choose the New icon. +5. Complete the `` Schedule dialog. +6. Select from the Apply this schedule to drop-down list. +7. Choose **OK** and then close the **\ Properties** dialog box. + +### Step 2: Review computer restart device settings + +If you're not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration. + +For example, by default, 90 minutes will be honored before the system is rebooted after the feature update install. If users will not be impacted by the user logoff or restart, there is no need to wait a full 90 minutes before rebooting the computer. If a delay and notification is needed, ensure that the maintenance window takes this into account along with the total time needed to install the feature update. + +>[!NOTE] +> The following settings must be shorter in duration than the shortest maintenance window applied to the computer. +>- **Display a temporary notification to the user that indicates the interval before the user is logged off or the computer restarts (minutes).** +>- **Display a dialog box that the user cannot close, which displays the countdown interval before the user is logged off or the computer restarts (minutes).** + +### Step 3: Enable Peer Cache + +Use **Peer Cache** to help manage deployment of content to clients in remote locations. Peer Cache is a built-in Configuration Manager solution that enables clients to share content with other clients directly from their local cache. + +[Enable Configuration Manager client in full OS to share content](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update). + +### Step 4: Override the default Windows setup priority (Windows 10, version 1709 and later) + +If you're deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. + +%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini + +``` +[SetupConfig] +Priority=Normal +``` + +You can use the new [Run Scripts](https://docs.microsoft.com/sccm/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices. + +``` +#Parameters +Param( + [string] $PriorityValue = "Normal" + ) + +#Variable for ini file path +$iniFilePath = "$env:SystemDrive\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini" + +#Variables for SetupConfig +$iniSetupConfigSlogan = "[SetupConfig]" +$iniSetupConfigKeyValuePair =@{"Priority"=$PriorityValue;} + +#Init SetupConfig content +$iniSetupConfigContent = @" +$iniSetupConfigSlogan +"@ + +#Build SetupConfig content with settings +foreach ($k in $iniSetupConfigKeyValuePair.Keys) +{ + $val = $iniSetupConfigKeyValuePair[$k] + + $iniSetupConfigContent = $iniSetupConfigContent.Insert($iniSetupConfigContent.Length, "`r`n$k=$val") +} + +#Write content to file +New-Item $iniFilePath -ItemType File -Value $iniSetupConfigContent -Force + +Disclaimer +Sample scripts are not supported under any Microsoft standard support program or service. The sample scripts is +provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without +limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk +arising out of the use or performance of the sample script and documentation remains with you. In no event shall +Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable +for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, +loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script +or documentation, even if Microsoft has been advised of the possibility of such damages. +``` + +>[!NOTE] +>If you elect not to override the default setup priority, you will need to increase the [maximum run time](https://docs.microsoft.com/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. + +## Manually deploy feature updates + +The following sections provide the steps to manually deploy a feature update. + +### Step 1: Specify search criteria for feature updates +There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying feature updates is to identify the feature updates that you want to deploy. + +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. +3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: + - In the search text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. + - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, Required is greater than or equal to 1, and Language equals English. + +4. Save the search for future use. + +### Step 2: Download the content for the feature update(s) +Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. + +1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. +2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select Download. + + The **Download Software Updates Wizard** opens. +3. On the **Deployment Package** page, configure the following settings: + **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings: + - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. + - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. + - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. + + >[!NOTE] + >The deployment package source location that you specify cannot be used by another software deployment package. + + >[!IMPORTANT] + >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. + + >[!IMPORTANT] + >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. + + Click **Next**. +4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). + + >[!NOTE] + >The Distribution Points page is available only when you create a new software update deployment package. +5. On the **Distribution Settings** page, specify the following settings: + + - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority. + - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). + - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options: + - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. + - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. + - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. + + For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). + Click **Next**. +6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: + + - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting. + - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access. + + >[!NOTE] + >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. + + Click **Next**. +7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. +8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. +9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close. + +#### To monitor content status +1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. +2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. +3. Select the feature update package that you previously identified to download the feature updates. +4. On the **Home** tab, in the Content group, click **View Status**. + +### Step 3: Deploy the feature update(s) +After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). + +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. +3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. + + The **Deploy Software Updates Wizard** opens. +4. On the General page, configure the following settings: + - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\** + - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default. + - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct. + - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time. + - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment. +5. On the Deployment Settings page, configure the following settings: + + - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline. + + >[!IMPORTANT] + > After you create the software update deployment, you cannot later change the type of deployment. + + >[!NOTE] + >A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured. + + - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when Type of deployment is set to Required. + + >[!WARNING] + >Before you can use this option, computers and networks must be configured for Wake On LAN. + + - **Detail level**: Specify the level of detail for the state messages that are reported by client computers. +6. On the Scheduling page, configure the following settings: + + - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console. + + >[!NOTE] + >When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time. + + - **Software available time**: Select **As soon as possible** to specify when the software updates will be available to clients: + - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation. + - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment. + + >[!NOTE] + >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. + + - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. Set the date and time value to correspond with your defined maintenance window for the target collection. Allow sufficient time for clients to download the content in advance of the deadline. Adjust accordingly if clients in your environment will need additional download time. E.g., slow or unreliable network links. + + >[!NOTE] + >The actual installation deadline time is the specific time that you configure plus a random amount of time up to 2 hours. This reduces the potential impact of all client computers in the destination collection installing the software updates in the deployment at the same time. Configure the Computer Agent client setting, Disable deadline randomization to disable the installation randomization delay for the required software updates to allow a greater chance for the installation to start and complete within your defined maintenance window. For more information, see [Computer Agent](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#computer-agent). +7. On the User Experience page, configure the following settings: + - **User notifications**: Specify whether to display notification of the software updates in Software Center on the client computer at the configured **Software available time** and whether to display user notifications on the client computers. When **Type of deployment** is set to **Available** on the Deployment Settings page, you cannot select **Hide in Software Center and all notifications**. + - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. For more information about maintenance windows, see [How to use maintenance windows](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows). + - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation. + + >[!IMPORTANT] + >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. + - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device. + + >[!NOTE] + >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. + - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window. +8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. + + >[!NOTE] + >You can review recent software updates alerts from the Software Updates node in the Software Library workspace. +9. On the Download Settings page, configure the following settings: + - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location. + - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point. + - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). + - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content. + - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection. + + >[!NOTE] + >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). +10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. +11. Click **Next** to deploy the feature update(s). + +### Step 4: Monitor the deployment status +After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: + +1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. +2. Click the software update group or software update for which you want to monitor the deployment status. +3. On the **Home** tab, in the **Deployment** group, click **View Status**. diff --git a/windows/deployment/update/feature-update-mission-critical.md b/windows/deployment/update/feature-update-mission-critical.md index 61469bed82..c44569853e 100644 --- a/windows/deployment/update/feature-update-mission-critical.md +++ b/windows/deployment/update/feature-update-mission-critical.md @@ -1,43 +1,44 @@ ---- -title: Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices -description: Learn how to deploy feature updates to your mission critical devices -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/10/2018 -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices - -**Applies to**: Windows 10 - -Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren’t the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the System Center Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. - -For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, please see [Using Windows 10 servicing plans to deploy Windows 10 feature updates](waas-manage-updates-configuration-manager.md#use-windows-10-servicing-plans-to-deploy-windows-10-feature-updates). - -Devices and shared workstations that are online and available 24 hours a day, 7 days a week, can be serviced via one of two primary methods: - -- **Service during maintenance windows** – Devices that have established maintenance windows will need to have feature updates scheduled to fit within these windows. -- **Service only when manually initiated** – Devices that need physical verification of the availability to update will need to have updates manually initiated by a technician. - -You can use Configuration Manager to deploy feature updates to Windows 10 devices in two ways. The first option is to use the software updates feature. The second option is to use a task sequence to deploy feature updates. There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: - -- **Upgrade to the next LTSC release.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. -- **Additional required tasks.** When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments. -- **Language pack installs.** When deploying a feature update requires the installation of additional language packs, you can use task sequences to orchestrate the installation. Software updates do not have the ability to natively install language packs. - -If you need to leverage a task sequence to deploy feature updates, please see [Using a task sequence to deploy Windows 10 updates](waas-manage-updates-configuration-manager.md#use-a-task-sequence-to-deploy-windows-10-updates) for more information. If you find that your requirement for a task sequence is based solely on the need to run additional tasks preformed pre-install or pre-commit, please see the new [run custom actions](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) functionality first introduced with Windows 10, version 1803. You may be able to leverage this functionality with the software updates deployment method. - -Use the following information: - - -- [Deploy feature updates during maintenance windows](feature-update-maintenance-window.md) -- [Deploy feature updates for user-initiated installations](feature-update-user-install.md) -- [Conclusion](feature-update-conclusion.md) +--- +title: Best practices and recommendations for deploying Windows 10 Feature updates to mission-critical devices +description: Learn how to use the Microsoft Endpoint Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices + +**Applies to**: Windows 10 + +Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren't the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the Microsoft Endpoint Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. + +For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, see [Manage Windows as a service using Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service). + +Devices and shared workstations that are online and available 24 hours a day, 7 days a week, can be serviced via one of two primary methods: + +- **Service during maintenance windows** – Devices that have established maintenance windows will need to have feature updates scheduled to fit within these windows. +- **Service only when manually initiated** – Devices that need physical verification of the availability to update will need to have updates manually initiated by a technician. + +You can use Configuration Manager to deploy feature updates to Windows 10 devices in two ways. The first option is to use the software updates feature. The second option is to use a task sequence to deploy feature updates. There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: + +- **Upgrade to the next LTSC release.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. +- **Additional required tasks.** When deploying a feature update requires additional steps (for example, suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments. +- **Language pack installations.** When deploying a feature update requires the installation of additional language packs, you can use task sequences to orchestrate the installation. Software updates do not have the ability to natively install language packs. + +If you need to use a task sequence to deploy feature updates, see [Manage Windows as a service using Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service) for more information. If you find that your requirement for a task sequence is based solely on the need to run additional tasks performed pre-install or pre-commit, see the new [run custom actions](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) functionality first introduced with Windows 10, version 1803. You might find this option useful in deploying software updates. + +Use the following information: + + +- [Deploy feature updates during maintenance windows](feature-update-maintenance-window.md) +- [Deploy feature updates for user-initiated installations](feature-update-user-install.md) +- [Conclusion](feature-update-conclusion.md) diff --git a/windows/deployment/update/feature-update-user-install.md b/windows/deployment/update/feature-update-user-install.md index 8b7e286eab..70dcc6a516 100644 --- a/windows/deployment/update/feature-update-user-install.md +++ b/windows/deployment/update/feature-update-user-install.md @@ -1,18 +1,18 @@ --- title: Best practices - deploy feature updates for user-initiated installations -description: Learn how to manually deploy feature updates +description: Learn recommendations and best practices for manually deploying a feature update for a user-initiated installation. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library audience: itpro -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greglin +ms.author: jaimeo ms.date: 07/10/2018 ms.reviewer: manager: laurawi ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deploy feature updates for user-initiated installations (during a fixed service window) @@ -30,7 +30,7 @@ Use **Peer Cache** to help manage deployment of content to clients in remote loc ### Step 2: Override the default Windows setup priority (Windows 10, version 1709 and later) -If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. +If you're deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. %systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index 9d1e2e68e3..98579c7905 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -1,26 +1,31 @@ --- -title: Windows 10 - How to make FoD and language packs available when you're using WSUS/SCCM -description: Learn how to make FoD and language packs available when you're using WSUS/SCCM +title: Make FoD and language packs available for WSUS/Configuration Manager +description: Learn how to make FoD and language packs available when you're using WSUS/Configuration Manager. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library ms.pagetype: article -ms.author: greglin -audience: itpro author: greg-lindsay +ms.author: jaimeo +audience: itpro +author: jaimeo ms.localizationpriority: medium ms.date: 03/13/2019 ms.reviewer: manager: laurawi ms.topic: article +ms.custom: seo-marvel-apr2020 --- -# How to make Features on Demand and language packs available when you're using WSUS/SCCM +# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager > Applies to: Windows 10 -As of Windows 10 version 1709, you cannot use Windows Server Update Services (WSUS) to host [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FOD) and language packs for Windows 10 clients locally. Instead, you can enforce a Group Policy setting that tells the clients to pull them directly from Windows Update. You can also host FOD and language packs on a network share, but starting with Windows 10 version 1809, FOD and language packs can only be installed from Windows Update. - -For Windows domain environments running WSUS or SCCM, change the **Specify settings for optional component installation and component repair** policy to enable downloading FOD and language packs from Windows Update. This setting is located in `Computer Configuration\Administrative Templates\System` in the Group Policy Editor. +As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS. -Changing this policy does not affect how other updates are distributed. They continue to come from WSUS or SCCM as you have scheduled them. +The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions. + +In Windows 10 version 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired. + +In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. + +For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](https://docs.microsoft.com/windows/client-management/). diff --git a/windows/deployment/update/get-started-updates-channels-tools.md b/windows/deployment/update/get-started-updates-channels-tools.md new file mode 100644 index 0000000000..93b16449ff --- /dev/null +++ b/windows/deployment/update/get-started-updates-channels-tools.md @@ -0,0 +1,106 @@ +--- +title: Windows 10 updates, channels, and tools +description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Windows 10 updates, channels, and tools + +## How Windows updates work + +There are four phases to the Windows update process: + +- **Scan:** A device checks the Microsoft Update server, Windows Update service, or your Windows Server Update Services (WSUS) endpoint at random intervals to see if any updates have been added since the last time updates were searched, and then evaluates whether the update is appropriate by checking the policies that have been set up by the +administrator. This process is invisible to the user. +- **Download:** Once the device determines that an update is available, it begins downloading the update. The download process is also invisible to the user. With feature updates, download happens in multiple +sequential phases. +- **Install:** After the update is downloaded, depending on the device’s Windows Update settings, the update is installed on the system. +- **Commit and restart:** Once installed, the device usually (but not always) must be restarted in order to complete the installation and begin using the update. Before that happens, a device is still running the previous +version of the software. + +## Types of updates + +We include information here about a number of different update types you'll hear about, but the two overarching types which you have the most direct control over are *feature updates* and *quality updates*. + +- **Feature updates:** Released twice per year, during the first half and second half of each calendar year. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage. +- **Quality updates:** Quality updates deliver both security and non-security fixes to Windows 10. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously. +- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md). +- **Driver updates**: These are updates to drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not. +- **Microsoft product updates:** These are updates for other Microsoft products, such as Office. You can enable or disable Microsoft updates by using policies controlled by various servicing tools. + + + +## Servicing channels + +Windows 10 offers three servicing channels, each of which offers you a different level of flexibility with how and when updates are delivered to devices. Using the different servicing channels allows you to deploy Windows 10 "as a service" which conceives of deployment as a continual process of updates which roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. + +The first step of controlling when and how devices install updates is assigning them to the appropriate servicing channel. You can assign devices to a particular channel with any of several tools, including Microsoft Endpoint Configuration Manager, Windows Server Update Services (WSUS), and Group Policy settings applied by any of several means. By dividing devices into different populations ("deployment groups" or "rings") you can use servicing channel assignment, followed by other management features such as update deferral policies, to create a phased deployment of any update that allows you to start with a limited pilot deployment for testing before moving to a broad deployment throughout your organization. + + +### Semi-annual Channel + +In the Semi-annual Channel, feature updates are available as soon as Microsoft releases them, twice per year. As long as a device isn't set to defer feature updates, any device using the Semi-annual Channel will install a feature update as soon as it's released. If you use Windows Update for Business, the Semi-annual Channel provides three months of additional total deployment time before being required to update to the next release. + +> [!NOTE] +> All releases of Windows 10 have **18 months of servicing for all editions**--these updates provide security and feature updates for the release. However, fall releases of the **Enterprise and Education editions** will have an **additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release**. This extended servicing window applies to Enterprise and Education editions starting with Windows 10, version 1607. + +### Windows Insider Program for Business + +Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are actually three options within the Windows Insider Program for Business channel: + +- Windows Insider Fast +- Windows Insider Slow +- Windows Insider Release Preview + +We recommend that you use the Windows Insider Release Preview channel for validation activities. + + +### Long-term Servicing Channel + +The **Long Term Servicing Channel** is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATMs. Devices on this channel receive new feature releases every two to three years. LTSB releases service a special LTSB edition of Windows 10 and are only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). + +The Semi-Annual Channel is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition. + + +| Windows 10 edition | Semi-Annual Channel | Insider Program | Long-Term Servicing Channel | +| --- | --- | --- | --- | +| Home | ![yes](images/checkmark.png)|![no](images/crossmark.png) | ![no](images/crossmark.png)| +| Pro | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| +| Enterprise | ![yes](images/checkmark.png) |![yes](images/checkmark.png) | ![no](images/crossmark.png)| +| Enterprise LTSB | ![no](images/crossmark.png) |![no](images/crossmark.png) | ![yes](images/checkmark.png)| +| Pro Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| +| Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| + +## Servicing tools + +### Tools for on-premises update delivery + +Windows Server Update Services (WSUS): you set up a WSUS server, which downloads updates in bulk from Microsoft. Your individual devices then connect to your server to install their updates from there. + +You can set up, control, and manage the server and update process with a number of tools: + +- A standalone Windows Server Update Services server operated directly +- [Configuration Manager](deploy-updates-configmgr.md) +- Non-Microsoft tools + +For more information, see [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). + +### Tools for cloud-based update delivery + +Your individual devices connect to Microsoft endpoints directly to get the updates. The details of this process (how often devices download updates of various kinds, from which channels, deferrals, and details of the users' experience of installation) are set on devices either with Group Policy or MDM policies, which you can control with any of a number of tools: + +- [Group Policy Management Console](waas-wufb-group-policy.md) (Gpmc.msc) +- [Microsoft Intune](waas-wufb-intune.md) +- Non-Microsoft MDM tools + +### Hybrid scenarios + +It is also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery. diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md index 0cce8e0389..44bbae9ebf 100644 --- a/windows/deployment/update/how-windows-update-works.md +++ b/windows/deployment/update/how-windows-update-works.md @@ -1,146 +1,146 @@ ---- -title: How Windows Update works -description: Learn how Windows Update works, including architecture and troubleshooting -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# How does Windows Update work? - ->Applies to: Windows 10 - -The Windows Update workflow has four core areas of functionality: - -### Scan - -1. Orchestrator schedules the scan. -2. Orchestrator verifies admin approvals and policies for download. - - -### Download -1. Orchestrator initiates downloads. -2. Windows Update downloads manifest files and provides them to the arbiter. -3. The arbiter evaluates the manifest and tells the Windows Update client to download files. -4. Windows Update client downloads files in a temporary folder. -5. The arbiter stages the downloaded files. - - -### Install -1. Orchestrator initates the installation. -2. The arbiter calls the installer to install the package. - - -### Commit -1. Orchestrator initiates a restart. -2. The arbiter finalizes before the restart. - - -## How updating works -During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does this automatically, according to your settings, and in a silent manner that doesn’t disrupt your computer usage. - -## Scanning updates -![Windows Update scanning step](images/update-scan-step.png) - -The Windows Update Orchestrator on your PC checks the Microsoft Update server or your WSUS endpoint for new updates at random intervals. The randomization ensures that the Windows Update server isn't overloaded with requests all at the same time. The Update Orchestrator searches only for updates that have been added since the last time updates were searched, allowing it to find updates quickly and efficiently. - -When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your computer using guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies. - -Make sure you're familiar with the following terminology related to Windows Update scan: - -|Term|Definition| -|----|----------| -|Update|We use this term to mean a lot of different things, but in this context it's the actual patch or change.| -|Bundle update|An update that contains 1-N child updates; doesn't contain payload itself.| -|Child update|Leaf update that's bundled by another update; contains payload.| -|Detectoid update|A special 'update' that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.| -|Category update|A special 'detectoid' that has always true IsInstalled rule. Used for grouping updates and for client to filter updates. | -|Full scan|Scan with empty datastore.| -|Delta scan|Scan with updates from previous scan already cached in datastore.| -|Online scan|Scan that hits network and goes against server on cloud. | -|Offline scan|Scan that doesn't hit network and goes against local datastore. Only useful if online scan has been performed before. | -|CatScan|Category scan where caller can specify a categoryId to get updates published under the categoryId.| -|AppCatScan|Category scan where caller can specify an AppCategoryId to get apps published under the appCategoryId.| -|Software sync|Part of the scan that looks at software updates only (OS and apps).| -|Driver sync|Part of the scan that looks at Driver updates only. This is run after Software sync and is optional.| -|ProductSync|Attributes based sync, where client provides a list of device, product and caller attributes ahead of time to allow service to evaluate applicability in the cloud. | - -### How Windows Update scanning works - -Windows Update takes the following sets of actions when it runs a scan. - -#### Starts the scan for updates -When users start scanning in Windows Update through the Settings panel, the following occurs: - -- The scan first generates a “ComApi” message. The caller (Windows Defender Antivirus) tells the WU engine to scan for updates. -- "Agent" messages: queueing the scan, then actually starting the work: - - Updates are identified by the different IDs ("Id = 10", "Id = 11") and from the different thread ID numbers. - - Windows Update uses the thread ID filtering to concentrate on one particular task. - - ![Windows Update scan log 1](images/update-scan-log-1.png) - -#### Identifies service IDs - -- Service IDs indicate which update source is being scanned. - Note The next screen shot shows Microsoft Update and the Flighting service. - -- The Windows Update engine treats every service as a separate entity, even though multiple services may contain the same updates. - ![Windows Update scan log 2](images/update-scan-log-2.png) -- Common service IDs - - >[!IMPORTANT] - >ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to, it's totally controlled by the SLS responses. - -|Service|ServiceId| -|-------|---------| -|Unspecified / Default|WU, MU or WSUS
              00000000-0000-0000-0000-000000000000 | -|WU|9482F4B4-E343-43B6-B170-9A65BC822C77| -|MU|7971f918-a847-4430-9279-4a52d1efe18d| -|Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289| -|OS Flighting|8B24B027-1DEE-BABB-9A95-3517DFB9C552| -|WSUS or SCCM|Via ServerSelection::ssManagedServer
              3DA21691-E39D-4da6-8A4B-B43877BCB1B7 | -|Offline scan service|Via IUpdateServiceManager::AddScanPackageService| - -#### Finds network faults -Common update failure is caused due to network issues. To find the root of the issue: - -- Look for "ProtocolTalker" messages to see client-server sync network traffic. -- "SOAP faults" can be either client- or server-side issues; read the message. -- The WU client uses SLS (Service Locator Service) to discover the configurations and endpoints of Microsoft network update sources – WU, MU, Flighting. - - >[!NOTE] - >Warning messages for SLS can be ignored if the search is against WSUS/SCCM. - -- On sites that only use WSUS/SCCM, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS/SCCM, since it’s locally configured. - ![Windows Update scan log 3](images/update-scan-log-3.png) - -## Downloading updates -![Windows Update download step](images/update-download-step.png) - -Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does this in the background without interrupting your normal use of the computer. - -To ensure that your other downloads aren’t affected or slowed down because updates are downloading, Windows Update uses the Delivery Optimization (DO) technology which downloads updates and reduces bandwidth consumption. - -For more information see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). - -## Installing updates -![Windows Update install step](images/update-install-step.png) - -When an update is applicable, the "Arbiter" and metadata are downloaded. Depending on your Windows Update settings, when downloading is complete, the Arbiter will gather details from the device, and compare that with the downloaded metadata to create an "action list". - -The action list describes all the files needed from WU, and what the install agent (such as CBS or Setup) should do with them. The action list is provided to the install agent along with the payload to begin the installation. - -## Committing Updates -![Windows Update commit step](images/update-commit-step.png) - -When the option to automatically install updates is configured, the Windows Update Orchestrator, in most cases, automatically restarts the PC for you after installing the updates. This is necessary because your PC may be insecure, or not fully updated, until a restart is completed. You can use Group Policy settings, mobile device management (MDM), or the registry (not recommended) to configure when devices will restart after a Windows 10 update is installed. - -For more information see [Manage device restarts after updates](waas-restart.md). +--- +title: How Windows Update works +description: In this article, learn about the process Windows Update uses to download and install updates on a Windows 10 devices. +ms.prod: w10 +ms.mktglfcycl: +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# How does Windows Update work? + +> Applies to: Windows 10 + +The Windows Update workflow has four core areas of functionality: + +### Scan + +1. Orchestrator schedules the scan. +2. Orchestrator verifies admin approvals and policies for download. + + +### Download +1. Orchestrator starts downloads. +2. Windows Update downloads manifest files and provides them to the arbiter. +3. The arbiter evaluates the manifest and tells the Windows Update client to download files. +4. Windows Update client downloads files in a temporary folder. +5. The arbiter stages the downloaded files. + + +### Install +1. Orchestrator starts the installation. +2. The arbiter calls the installer to install the package. + + +### Commit +1. Orchestrator starts a restart. +2. The arbiter finalizes before the restart. + + +## How updating works +During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does these actions automatically, according to your settings, and silently so that doesn't disrupt your computer usage. + +## Scanning updates +![Windows Update scanning step](images/update-scan-step.png) + +The Windows Update Orchestrator on your PC checks the Microsoft Update server or your WSUS endpoint for new updates at random intervals. The randomization ensures that the Windows Update server isn't overloaded with requests all at the same time. The Update Orchestrator searches only for updates that have been added since the last time updates were searched, allowing it to find updates quickly and efficiently. + +When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your device. It uses guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies. + +Make sure you're familiar with the following terminology related to Windows Update scan: + +|Term|Definition| +|----|----------| +|Update|We use this term to mean several different things, but in this context it's the actual updated code or change.| +|Bundle update|An update that contains 1-N child updates; doesn't contain payload itself.| +|Child update|Leaf update that's bundled by another update; contains payload.| +|Detector update|A special "update" that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.| +|Category update|A special "detectoid" that has an **IsInstalled** rule that is always true. Used for grouping updates and to allow the device to filter updates. | +|Full scan|Scan with empty datastore.| +|Delta scan|Scan with updates from previous scan already cached in datastore.| +|Online scan|Scan that uses the network and to check an update server. | +|Offline scan|Scan that doesn't use the network and instead checks the local datastore. Only useful if online scan has been performed before. | +|CatScan|Category scan where caller can specify a **categoryId** to get updates published under that **categoryId**.| +|AppCatScan|Category scan where caller can specify an **AppCategoryId** to get apps published under that **appCategoryId**.| +|Software sync|Part of the scan that only checks for software updates (both the apps and the operating system).| +|Driver sync|Part of the scan that checks driver updates only. This sync is optional and runs after the software sync.| +|ProductSync|A sync based on attributes, in which the client provides a list of device, product, and caller attributes ahead of time to allow service to check applicability in the cloud. | + +### How Windows Update scanning works + +Windows Update does the following actions when it runs a scan. + +#### Starts the scan for updates +When users start scanning in Windows Update through the Settings panel, the following occurs: + +- The scan first generates a “ComApi” message. The caller (Microsoft Defender Antivirus) tells the Windows Update engine to scan for updates. +- "Agent" messages: queueing the scan, then actually starting the work: + - Updates are identified by the different IDs ("ID = 10", "ID = 11") and from the different thread ID numbers. + - Windows Update uses the thread ID filtering to concentrate on one particular task. + + ![Windows Update scan log 1](images/update-scan-log-1.png) + +#### Identifies service IDs + +- Service IDs indicate which update source is being scanned. + +- The Windows Update engine treats every service as a separate entity, even though multiple services may contain the same updates. + ![Windows Update scan log 2](images/update-scan-log-2.png) +- Common service IDs + + > [!IMPORTANT] + > ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to. It's totally controlled by responses from the Service Locator Service. + +|Service|ServiceId| +|-------|---------| +|Unspecified / Default|WU, MU, or WSUS
              00000000-0000-0000-0000-000000000000 | +|Windows Update|9482F4B4-E343-43B6-B170-9A65BC822C77| +|Microsoft Update|7971f918-a847-4430-9279-4a52d1efe18d| +|Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289| +|OS Flighting|8B24B027-1DEE-BABB-9A95-3517DFB9C552| +|WSUS or Configuration Manager|Via ServerSelection::ssManagedServer
              3DA21691-E39D-4da6-8A4B-B43877BCB1B7 | +|Offline scan service|Via IUpdateServiceManager::AddScanPackageService| + +#### Finds network faults +Common update failure is caused due to network issues. To find the root of the issue: + +- Look for "ProtocolTalker" messages to see client-server sync network traffic. +- "SOAP faults" can be either client- or server-side issues; read the message. +- The Windows Update client uses the Service Locator Service to discover the configurations and endpoints of Microsoft network update sources: Windows update, Microsoft Update, or Flighting. + + > [!NOTE] + > If the search is against WSUS or Configuration Manager, you can ignore warning messages for the Service Locator Service. + +- On sites that only use WSUS or Configuration Manager, the Service Locator Service might be blocked at the firewall. In this case the request will fail, and though the service can’t scan against Windows Update or Microsoft Update, it can still scan against WSUS or Configuration Manager, since it’s locally configured. + ![Windows Update scan log 3](images/update-scan-log-3.png) + +## Downloading updates +![Windows Update download step](images/update-download-step.png) + +Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does operation in the background without interrupting your normal use of the device. + +To ensure that your other downloads aren't affected or slowed down because updates are downloading, Windows Update uses Delivery Optimization, which downloads updates and reduces bandwidth consumption. + +For more information, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). + +## Installing updates +![Windows Update install step](images/update-install-step.png) + +When an update is applicable, the "Arbiter" and metadata are downloaded. Depending on your Windows Update settings, when downloading is complete, the Arbiter will gather details from the device, and compare that with the downloaded metadata to create an "action list". + +The action list describes all the files needed from Windows Update, and what the installation agent (such as CBS or Setup) should do with them. The action list is provided to the installation agent along with the payload to begin the installation. + +## Committing Updates +![Windows Update commit step](images/update-commit-step.png) + +When the option to automatically install updates is configured, the Windows Update Orchestrator, in most cases, automatically restarts the device for you after installing the updates. It has to restart the device because it might be insecure, or not fully updated, until it restarts. You can use Group Policy settings, mobile device management (MDM), or the registry (not recommended) to configure when devices will restart after a Windows 10 update is installed. + +For more information, see [Manage device restarts after updates](waas-restart.md). diff --git a/windows/deployment/update/images/DO-absolute-bandwidth.png b/windows/deployment/update/images/DO-absolute-bandwidth.png new file mode 100644 index 0000000000..a13d5393e6 Binary files /dev/null and b/windows/deployment/update/images/DO-absolute-bandwidth.png differ diff --git a/windows/deployment/update/images/UC-vid-crop.jpg b/windows/deployment/update/images/UC-vid-crop.jpg deleted file mode 100644 index 47e74febbc..0000000000 Binary files a/windows/deployment/update/images/UC-vid-crop.jpg and /dev/null differ diff --git a/windows/deployment/update/images/UC_00_marketplace_search.PNG b/windows/deployment/update/images/UC_00_marketplace_search.PNG deleted file mode 100644 index dcdf25d38a..0000000000 Binary files a/windows/deployment/update/images/UC_00_marketplace_search.PNG and /dev/null differ diff --git a/windows/deployment/update/images/UC_01_marketplace_create.PNG b/windows/deployment/update/images/UC_01_marketplace_create.PNG deleted file mode 100644 index 4b34311112..0000000000 Binary files a/windows/deployment/update/images/UC_01_marketplace_create.PNG and /dev/null differ diff --git a/windows/deployment/update/images/UC_02_workspace_create.PNG b/windows/deployment/update/images/UC_02_workspace_create.PNG deleted file mode 100644 index ed3eeeebbb..0000000000 Binary files a/windows/deployment/update/images/UC_02_workspace_create.PNG and /dev/null differ diff --git a/windows/deployment/update/images/UC_03_workspace_select.PNG b/windows/deployment/update/images/UC_03_workspace_select.PNG deleted file mode 100644 index d00864b861..0000000000 Binary files a/windows/deployment/update/images/UC_03_workspace_select.PNG and /dev/null differ diff --git a/windows/deployment/update/images/UC_04_resourcegrp_deployment_successful.PNG b/windows/deployment/update/images/UC_04_resourcegrp_deployment_successful.PNG deleted file mode 100644 index 3ea9f57531..0000000000 Binary files a/windows/deployment/update/images/UC_04_resourcegrp_deployment_successful.PNG and /dev/null differ diff --git a/windows/deployment/update/images/UC_workspace_WDAV_status.PNG b/windows/deployment/update/images/UC_workspace_WDAV_status.PNG deleted file mode 100644 index 40dcaef949..0000000000 Binary files a/windows/deployment/update/images/UC_workspace_WDAV_status.PNG and /dev/null differ diff --git a/windows/deployment/update/images/UC_workspace_safeguard_queries.png b/windows/deployment/update/images/UC_workspace_safeguard_queries.png new file mode 100644 index 0000000000..36bb54260b Binary files /dev/null and b/windows/deployment/update/images/UC_workspace_safeguard_queries.png differ diff --git a/windows/deployment/update/images/annual-calendar.png b/windows/deployment/update/images/annual-calendar.png new file mode 100644 index 0000000000..ae785484ef Binary files /dev/null and b/windows/deployment/update/images/annual-calendar.png differ diff --git a/windows/deployment/update/images/rapid-calendar.png b/windows/deployment/update/images/rapid-calendar.png new file mode 100644 index 0000000000..b088cbbf5b Binary files /dev/null and b/windows/deployment/update/images/rapid-calendar.png differ diff --git a/windows/deployment/update/images/safeguard-hold-notification.png b/windows/deployment/update/images/safeguard-hold-notification.png new file mode 100644 index 0000000000..68714d08dc Binary files /dev/null and b/windows/deployment/update/images/safeguard-hold-notification.png differ diff --git a/windows/deployment/update/images/uc-01-wdav.png b/windows/deployment/update/images/uc-01-wdav.png deleted file mode 100644 index c0ef37ebc6..0000000000 Binary files a/windows/deployment/update/images/uc-01-wdav.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-01.png b/windows/deployment/update/images/uc-01.png deleted file mode 100644 index 7f4df9f6d7..0000000000 Binary files a/windows/deployment/update/images/uc-01.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-02.png b/windows/deployment/update/images/uc-02.png deleted file mode 100644 index 8317f051c3..0000000000 Binary files a/windows/deployment/update/images/uc-02.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-02a.png b/windows/deployment/update/images/uc-02a.png deleted file mode 100644 index d12544e3a0..0000000000 Binary files a/windows/deployment/update/images/uc-02a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-03.png b/windows/deployment/update/images/uc-03.png deleted file mode 100644 index 58494c4128..0000000000 Binary files a/windows/deployment/update/images/uc-03.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-03a.png b/windows/deployment/update/images/uc-03a.png deleted file mode 100644 index 39412fc8f3..0000000000 Binary files a/windows/deployment/update/images/uc-03a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-04.png b/windows/deployment/update/images/uc-04.png deleted file mode 100644 index ef9a37d379..0000000000 Binary files a/windows/deployment/update/images/uc-04.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-04a.png b/windows/deployment/update/images/uc-04a.png deleted file mode 100644 index 537d4bbe72..0000000000 Binary files a/windows/deployment/update/images/uc-04a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-05.png b/windows/deployment/update/images/uc-05.png deleted file mode 100644 index 21c8e9f9e0..0000000000 Binary files a/windows/deployment/update/images/uc-05.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-05a.png b/windows/deployment/update/images/uc-05a.png deleted file mode 100644 index 2271181622..0000000000 Binary files a/windows/deployment/update/images/uc-05a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-06.png b/windows/deployment/update/images/uc-06.png deleted file mode 100644 index 03a559800b..0000000000 Binary files a/windows/deployment/update/images/uc-06.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-06a.png b/windows/deployment/update/images/uc-06a.png deleted file mode 100644 index 15df1cfea0..0000000000 Binary files a/windows/deployment/update/images/uc-06a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-07.png b/windows/deployment/update/images/uc-07.png deleted file mode 100644 index de1ae35e82..0000000000 Binary files a/windows/deployment/update/images/uc-07.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-07a.png b/windows/deployment/update/images/uc-07a.png deleted file mode 100644 index c0f2d9fd73..0000000000 Binary files a/windows/deployment/update/images/uc-07a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-08.png b/windows/deployment/update/images/uc-08.png deleted file mode 100644 index 877fcd64c0..0000000000 Binary files a/windows/deployment/update/images/uc-08.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-08a.png b/windows/deployment/update/images/uc-08a.png deleted file mode 100644 index 89da287d3d..0000000000 Binary files a/windows/deployment/update/images/uc-08a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-09.png b/windows/deployment/update/images/uc-09.png deleted file mode 100644 index 37d7114f19..0000000000 Binary files a/windows/deployment/update/images/uc-09.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-09a.png b/windows/deployment/update/images/uc-09a.png deleted file mode 100644 index f6b6ec5b60..0000000000 Binary files a/windows/deployment/update/images/uc-09a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-10.png b/windows/deployment/update/images/uc-10.png deleted file mode 100644 index ea065590b9..0000000000 Binary files a/windows/deployment/update/images/uc-10.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-10a.png b/windows/deployment/update/images/uc-10a.png deleted file mode 100644 index 1c6b8b01dc..0000000000 Binary files a/windows/deployment/update/images/uc-10a.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-11.png b/windows/deployment/update/images/uc-11.png deleted file mode 100644 index 8b4fc568ea..0000000000 Binary files a/windows/deployment/update/images/uc-11.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-12.png b/windows/deployment/update/images/uc-12.png deleted file mode 100644 index 4198684c99..0000000000 Binary files a/windows/deployment/update/images/uc-12.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-13.png b/windows/deployment/update/images/uc-13.png deleted file mode 100644 index 117f9b9fd8..0000000000 Binary files a/windows/deployment/update/images/uc-13.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-14.png b/windows/deployment/update/images/uc-14.png deleted file mode 100644 index 66047984e7..0000000000 Binary files a/windows/deployment/update/images/uc-14.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-15.png b/windows/deployment/update/images/uc-15.png deleted file mode 100644 index c241cd9117..0000000000 Binary files a/windows/deployment/update/images/uc-15.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-16.png b/windows/deployment/update/images/uc-16.png deleted file mode 100644 index e7aff4d4ed..0000000000 Binary files a/windows/deployment/update/images/uc-16.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-17.png b/windows/deployment/update/images/uc-17.png deleted file mode 100644 index cb8e42ca5e..0000000000 Binary files a/windows/deployment/update/images/uc-17.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-18.png b/windows/deployment/update/images/uc-18.png deleted file mode 100644 index 5eff59adc9..0000000000 Binary files a/windows/deployment/update/images/uc-18.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-19.png b/windows/deployment/update/images/uc-19.png deleted file mode 100644 index 791900eafc..0000000000 Binary files a/windows/deployment/update/images/uc-19.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-20.png b/windows/deployment/update/images/uc-20.png deleted file mode 100644 index 7dbb027b9f..0000000000 Binary files a/windows/deployment/update/images/uc-20.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-21.png b/windows/deployment/update/images/uc-21.png deleted file mode 100644 index 418db41fe4..0000000000 Binary files a/windows/deployment/update/images/uc-21.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-22.png b/windows/deployment/update/images/uc-22.png deleted file mode 100644 index 2ca5c47a61..0000000000 Binary files a/windows/deployment/update/images/uc-22.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-23.png b/windows/deployment/update/images/uc-23.png deleted file mode 100644 index 58b82db82d..0000000000 Binary files a/windows/deployment/update/images/uc-23.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-24.png b/windows/deployment/update/images/uc-24.png deleted file mode 100644 index 00bc61e3e1..0000000000 Binary files a/windows/deployment/update/images/uc-24.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-25.png b/windows/deployment/update/images/uc-25.png deleted file mode 100644 index 4e0f0bdb03..0000000000 Binary files a/windows/deployment/update/images/uc-25.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-DO-status.png b/windows/deployment/update/images/uc-DO-status.png deleted file mode 100644 index d4b47be324..0000000000 Binary files a/windows/deployment/update/images/uc-DO-status.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-emptyworkspacetile.PNG b/windows/deployment/update/images/uc-emptyworkspacetile.PNG deleted file mode 100644 index 24c37d4279..0000000000 Binary files a/windows/deployment/update/images/uc-emptyworkspacetile.PNG and /dev/null differ diff --git a/windows/deployment/update/images/uc-featureupdatestatus.PNG b/windows/deployment/update/images/uc-featureupdatestatus.PNG deleted file mode 100644 index ae6a38502f..0000000000 Binary files a/windows/deployment/update/images/uc-featureupdatestatus.PNG and /dev/null differ diff --git a/windows/deployment/update/images/uc-filledworkspacetile.PNG b/windows/deployment/update/images/uc-filledworkspacetile.PNG deleted file mode 100644 index 7293578b1a..0000000000 Binary files a/windows/deployment/update/images/uc-filledworkspacetile.PNG and /dev/null differ diff --git a/windows/deployment/update/images/uc-filledworkspaceview.PNG b/windows/deployment/update/images/uc-filledworkspaceview.PNG deleted file mode 100644 index 8d99e52e02..0000000000 Binary files a/windows/deployment/update/images/uc-filledworkspaceview.PNG and /dev/null differ diff --git a/windows/deployment/update/images/uc-needattentionoverview.PNG b/windows/deployment/update/images/uc-needattentionoverview.PNG deleted file mode 100644 index 50b6d04699..0000000000 Binary files a/windows/deployment/update/images/uc-needattentionoverview.PNG and /dev/null differ diff --git a/windows/deployment/update/images/uc-overviewblade.PNG b/windows/deployment/update/images/uc-overviewblade.PNG deleted file mode 100644 index dca364daf6..0000000000 Binary files a/windows/deployment/update/images/uc-overviewblade.PNG and /dev/null differ diff --git a/windows/deployment/update/images/uc-perspectiveupdatedeploymentstatus.png b/windows/deployment/update/images/uc-perspectiveupdatedeploymentstatus.png deleted file mode 100644 index f52087a4a7..0000000000 Binary files a/windows/deployment/update/images/uc-perspectiveupdatedeploymentstatus.png and /dev/null differ diff --git a/windows/deployment/update/images/uc-securityupdatestatus.PNG b/windows/deployment/update/images/uc-securityupdatestatus.PNG deleted file mode 100644 index 75e9d10fd8..0000000000 Binary files a/windows/deployment/update/images/uc-securityupdatestatus.PNG and /dev/null differ diff --git a/windows/deployment/update/images/uc-windowsdefenderavstatus.PNG b/windows/deployment/update/images/uc-windowsdefenderavstatus.PNG deleted file mode 100644 index e3f6990348..0000000000 Binary files a/windows/deployment/update/images/uc-windowsdefenderavstatus.PNG and /dev/null differ diff --git a/windows/deployment/update/images/update-catalog.png b/windows/deployment/update/images/update-catalog.png new file mode 100644 index 0000000000..e199b3a23a Binary files /dev/null and b/windows/deployment/update/images/update-catalog.png differ diff --git a/windows/deployment/update/images/wufb-pastdeadline-restart-warning.png b/windows/deployment/update/images/wufb-pastdeadline-restart-warning.png new file mode 100644 index 0000000000..984afea6ed Binary files /dev/null and b/windows/deployment/update/images/wufb-pastdeadline-restart-warning.png differ diff --git a/windows/deployment/update/images/wufb-pastdeadline-restartnow.png b/windows/deployment/update/images/wufb-pastdeadline-restartnow.png new file mode 100644 index 0000000000..c1fe8c04a6 Binary files /dev/null and b/windows/deployment/update/images/wufb-pastdeadline-restartnow.png differ diff --git a/windows/deployment/update/images/wufb-restart-imminent-warning.png b/windows/deployment/update/images/wufb-restart-imminent-warning.png new file mode 100644 index 0000000000..5fc96b5cb4 Binary files /dev/null and b/windows/deployment/update/images/wufb-restart-imminent-warning.png differ diff --git a/windows/deployment/update/images/wufb-update-deadline-warning.png b/windows/deployment/update/images/wufb-update-deadline-warning.png new file mode 100644 index 0000000000..9a3158583a Binary files /dev/null and b/windows/deployment/update/images/wufb-update-deadline-warning.png differ diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index a13003c55f..6c8417f572 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -3,11 +3,10 @@ title: Update Windows 10 in enterprise deployments (Windows 10) description: Windows as a service provides an all-new way to think about building, deploying, and servicing Windows 10. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: Jaimeo +author: jaimeo +manager: laurawi ms.localizationpriority: high ms.author: jaimeo -ms.date: 04/06/2018 ms.topic: article --- @@ -36,18 +35,18 @@ Windows as a service provides a new way to think about building, deploying, and | [Overview of Windows as a service](waas-overview.md) | Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools. | | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. | | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates. | -| [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Explains how to assign devices to the Semi-Annual Channel for feature and quality updates, and how to enroll devices in Windows Insider. | -| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization. | +| [Assign devices to servicing branches for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates) | Explains how to assign devices to the Semi-Annual Channel for feature and quality updates, and how to enroll devices in Windows Insider. | +| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Update Compliance to monitor and manage Windows Updates on devices in your organization. | | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | | [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. | | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. | | [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. | -| [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | +| [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | | [Manage device restarts after updates](waas-restart.md) | Explains how to manage update related device restarts. | | [Manage additional Windows Update settings](waas-wu-settings.md) | Provides details about settings available to control and configure Windows Update | | [Windows Insider Program for Business](waas-windows-insider-for-business.md) | Explains how the Windows Insider Program for Business works and how to become an insider. | >[!TIP] ->Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as System Center Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. ->With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). Additionally, Windows 10 clients can move from any supported version of Windows 10 (i.e. Version 1511) to the latest version directly (i.e 1709). +>Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as Microsoft Endpoint Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. +>With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). Additionally, Windows 10 clients can move from any supported version of Windows 10 (i.e. Version 1511) to the latest version directly (i.e 1709). diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md new file mode 100644 index 0000000000..ea81420b8b --- /dev/null +++ b/windows/deployment/update/media-dynamic-update.md @@ -0,0 +1,456 @@ +--- +title: Update Windows 10 media with Dynamic Update +description: Learn how to deploy feature updates to your mission critical devices +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: SteveDiAcetis +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Update Windows 10 media with Dynamic Update + +**Applies to**: Windows 10 + +This topic explains how to acquire and apply Dynamic Update packages to existing Windows 10 images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process. + +Volume-licensed media is available for each release of Windows 10 in the Volume Licensing Service Center (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. You can use Dynamic Update to ensure that Windows 10 devices have the latest feature update packages as part of an in-place upgrade while preserving language pack and Features on Demand (FODs) that might have been previously installed. Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process. + +## Dynamic Update + +Whenever installation of a feature update starts (whether from media or an environment connected to Windows Update), *Dynamic Update* is one of the first steps. Windows 10 Setup contacts a Microsoft endpoint to fetch Dynamic Update packages, and then applies those updates to your operating system installation media. The update packages includes the following kinds of updates: + +- Updates to Setup.exe binaries or other files that Setup uses for feature updates +- Updates for the "safe operating system" (SafeOS) that is used for the Windows recovery environment +- Updates to the servicing stack necessary to complete the feature update (see [Servicing stack updates](servicing-stack-updates.md) for more information) +- The latest cumulative (quality) update +- Updates to applicable drivers already published by manufacturers specifically intended for Dynamic Update + +Dynamic Update preserves language pack and Features on Demand packages by reacquiring them. + +Devices must be able to connect to the internet to obtain Dynamic Updates. In some environments, it's not an option to obtain Dynamic Updates. You can still do a media-based feature update by acquiring Dynamic Update packages and applying it to the image prior to starting Setup on the device. + +## Acquire Dynamic Update packages + +You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). At that site, use the search bar in the upper right to find the Dynamic Update packages for a particular release. For example, you could enter *1809 Dynamic Update x64*, which would return results like this: + +![Table with columns labeled Title, Products, Classification, Last Updated, Version, and Size and four rows listing various dynamic updates and associated KB articles](images/update-catalog.png) + +The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in **bold** the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results. + +|To find this Dynamic Update packages, search for or check the results here--> |Title |Product |Description (select the **Title** link to see **Details**) | +|---------|---------|---------|---------| +|Safe OS Dynamic Update | 2019-08 Dynamic Update... | Windows 10 Dynamic Update,Windows **Safe OS Dynamic Update** | ComponentUpdate: | +|Setup Dynamic Update | 2019-08 Dynamic Update... | Windows 10 Dynamic Update | **SetupUpdate** | +|Latest cumulative update | 2019-08 **Cumulative Update for Windows 10** | Windows 10 | Install this update to resolve issues in Windows... | +|Servicing stack Dynamic Update | 2019-09 **Servicing Stack Update for Windows 10** | Windows 10... | Install this update to resolve issues in Windows... | + +If you want to customize the image with additional languages or Features on Demand, download supplemental media ISO files from the [Volume Licensing Service Center](https://www.microsoft.com/licensing/servicecenter/default.aspx). For example, since Dynamic Update will be disabled for your devices, and if users require specific Features on Demand, you can preinstall these into the image. + +## Update Windows 10 installation media + +Properly updating the installation media involves a large number of actions operating on several different targets (image files). Some actions are repeated on different targets. The target images files include: + +- Windows Preinstallation Environment (WinPE): a small operating system used to install, deploy, and repair Windows operating systems +- Windows Recovery Environment (WinRE): repairs common causes of unbootable operating systems. WinRE is based on WinPE and can be customized with additional drivers, languages, optional packages, and other troubleshooting or diagnostic tools. +- Windows operating system: one or more editions of Windows 10 stored in \sources\install.wim +- Windows installation media: the complete collection of files and folders in the Windows 10 installation media. For example, \sources folder, \boot folder, Setup.exe, and so on. + +This table shows the correct sequence for applying the various tasks to the files. For example, the full sequence starts with adding the servicing stack update to WinRE (1) and concludes with adding the Dynamic Update for Setup to the new media (26). + +|Task |WinRE (winre.wim) |WinPE (boot.wim) |Operating system (install.wim) | New media | +|---------|---------|---------|---------|------| +|Add servicing stack Dynamic Update | 1 | 9 | 18 | +|Add language pack | 2 | 10 | 19 | +|Add localized optional packages | 3 | 11 | | +|Add font support | 4 | 12 | | +|Add text-to-speech | 5 | 13 | | +|Update Lang.ini | | 14 | | +|Add Features on Demand | | | 20 | +|Add Safe OS Dynamic Update | 6 | | | +|Add Setup Dynamic Update | | | | 26 +|Add latest cumulative update | | 15 | 21 | +|Clean up the image | 7 | 16 | 22 | +|Add Optional Components | | | 23 | +|Add .NET and .NET cumulative updates | | | 24 | +|Export image | 8 | 17 | 25 | + +### Multiple Windows editions + +The main operating system file (install.wim) contains multiple editions of Windows 10. It’s possible that only an update for a given edition is required to deploy it, based on the index. Or, it might be that all editions need an update. Further, ensure that languages are installed before Features on Demand, and the latest cumulative update is always applied last. + +### Additional languages and features + +You don't have to add more languages and features to the image to accomplish the updates, but it's an opportunity to customize the image with more languages, Optional Components, and Features on Demand beyond what is in your starting image. To do this, it's important to make these changes in the correct order: first apply servicing stack updates, followed by language additions, then by feature additions, and finally the latest cumulative update. The provided sample script installs a second language (in this case Japanese (ja-JP)). Since this language is backed by an lp.cab, there's no need to add a Language Experience Pack. Japanese is added to both the main operating system and to the recovery environment to allow the user to see the recovery screens in Japanese. This includes adding localized versions of the packages currently installed in the recovery image. + +Optional Components, along with the .NET feature, can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid this. One option is to skip the image cleanup step, though that will result in a larger install.wim. Another option is to install the .NET and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you will have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month). + +## Windows PowerShell scripts to apply Dynamic Updates to an existing image + +These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages are stored locally in this folder structure: + +|Folder |Description | +|---------|---------| +|C:\mediaRefresh | Parent folder that contains the PowerShell script | +|C:\mediaRefresh\oldMedia | Folder that contains the original media that will be refreshed. For example, contains Setup.exe, and \sources folder. | +|C:\mediaRefresh\newMedia | Folder that will contain the updated media. It is copied from \oldMedia, then used as the target for all update and cleanup operations. | + +### Get started + +The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there is a script error and it's necessary to start over from a known state. Also, it will provide a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they are not read-only. + +```powershell +#Requires -RunAsAdministrator + +function Get-TS { return "{0:HH:mm:ss}" -f [DateTime]::Now } + +Write-Output "$(Get-TS): Starting media refresh" + +# Declare language for showcasing adding optional localized components +$LANG = "ja-jp" +$LANG_FONT_CAPABILITY = "jpan" + +# Declare media for FOD and LPs +$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" +$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso" + +# Declare Dynamic Update packages +$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu" +$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu" +$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab" +$SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\SafeOS_DU.cab" +$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu" + +# Declare folders for mounted images and temp files +$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia" +$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia" +$WORKING_PATH = "C:\mediaRefresh\temp" +$MAIN_OS_MOUNT = "C:\mediaRefresh\temp\MainOSMount" +$WINRE_MOUNT = "C:\mediaRefresh\temp\WinREMount" +$WINPE_MOUNT = "C:\mediaRefresh\temp\WinPEMount" + +# Mount the language pack ISO +Write-Output "$(Get-TS): Mounting LP ISO" +$LP_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter + +# Declare language related cabs +$WINPE_OC_PATH = "$LP_ISO_DRIVE_LETTER`:\Windows Preinstallation Environment\x64\WinPE_OCs" +$WINPE_OC_LANG_PATH = "$WINPE_OC_PATH\$LANG" +$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -Name +$WINPE_OC_LP_PATH = "$WINPE_OC_LANG_PATH\lp.cab" +$WINPE_FONT_SUPPORT_PATH = "$WINPE_OC_PATH\WinPE-FontSupport-$LANG.cab" +$WINPE_SPEECH_TTS_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS.cab" +$WINPE_SPEECH_TTS_LANG_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS-$LANG.cab" +$OS_LP_PATH = "$LP_ISO_DRIVE_LETTER`:\x64\langpacks\Microsoft-Windows-Client-Language-Pack_x64_$LANG.cab" + +# Mount the Features on Demand ISO +Write-Output "$(Get-TS): Mounting FOD ISO" +$FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter +$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\" + +# Create folders for mounting images and storing temporary files +New-Item -ItemType directory -Path $WORKING_PATH -ErrorAction Stop | Out-Null +New-Item -ItemType directory -Path $MAIN_OS_MOUNT -ErrorAction stop | Out-Null +New-Item -ItemType directory -Path $WINRE_MOUNT -ErrorAction stop | Out-Null +New-Item -ItemType directory -Path $WINPE_MOUNT -ErrorAction stop | Out-Null + +# Keep the original media, make a copy of it for the new, updated media. +Write-Output "$(Get-TS): Copying original media to new media path" +Copy-Item -Path $MEDIA_OLD_PATH"\*" -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null +Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContainer -and $_.IsReadOnly } | ForEach-Object { $_.IsReadOnly = $false } +``` + +### Update WinRE + +The script assumes that only a single edition is being updated, indicated by Index = 1 (Windows 10 Education Edition). Then the script mounts the image, saves Winre.wim to the working folder, and mounts it. It then applies servicing stack Dynamic Update, since its components are used for updating other components. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. + +It finishes by cleaning and exporting the image to reduce the image size. + +> [!NOTE] +> Skip adding the latest cumulative update to Winre.wim because it contains unnecessary components in the recovery environment. The components that are updated and applicable are contained in the safe operating system Dynamic Update package. This also helps to keep the image small. + +```powershell +# Mount the main operating system, used throughout the script +Write-Output "$(Get-TS): Mounting main OS" +Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null + +# +# update Windows Recovery Environment (WinRE) +# +Copy-Item -Path $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Destination $WORKING_PATH"\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null +Write-Output "$(Get-TS): Mounting WinRE" +Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim" -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null + +# Add servicing stack update +Write-Output "$(Get-TS): Adding package $SSU_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null + +# +# Optional: Add the language to recovery environment +# +# Install lp.cab cab +Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null + +# Install language cabs for each optional package installed +$WINRE_INSTALLED_OC = Get-WindowsPackage -Path $WINRE_MOUNT +Foreach ($PACKAGE in $WINRE_INSTALLED_OC) { + + if ( ($PACKAGE.PackageState -eq "Installed") ` + -and ($PACKAGE.PackageName.startsWith("WinPE-")) ` + -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { + + $INDEX = $PACKAGE.PackageName.IndexOf("-Package") + if ($INDEX -ge 0) { + $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" + if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { + $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null + } + } + } +} + +# Add font support for the new language +if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null +} + +# Add TTS support for the new language +if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { + if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { + + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null + + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null + } +} + +# Add Safe OS +Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null + +# Perform image cleanup +Write-Output "$(Get-TS): Performing image cleanup on WinRE" +DISM /image:$WINRE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null + +# Dismount +Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null + +# Export +Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim" +Export-WindowsImage -SourceImagePath $WORKING_PATH"\winre.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\winre2.wim" -ErrorAction stop | Out-Null +Move-Item -Path $WORKING_PATH"\winre2.wim" -Destination $WORKING_PATH"\winre.wim" -Force -ErrorAction stop | Out-Null +``` + +### Update WinPE + +This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, add font support and text to speech (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. Finally, it cleans and exports Boot.wim, and copies it back to the new media. + +```powershell +# +# update Windows Preinstallation Environment (WinPE) +# + +# Get the list of images contained within WinPE +$WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" + +Foreach ($IMAGE in $WINPE_IMAGES) { + + # update WinPE + Write-Output "$(Get-TS): Mounting WinPE" + Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null + + # Add SSU + Write-Output "$(Get-TS): Adding package $SSU_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null + + # Install lp.cab cab + Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null + + # Install language cabs for each optional package installed + $WINPE_INSTALLED_OC = Get-WindowsPackage -Path $WINPE_MOUNT + Foreach ($PACKAGE in $WINPE_INSTALLED_OC) { + + if ( ($PACKAGE.PackageState -eq "Installed") ` + -and ($PACKAGE.PackageName.startsWith("WinPE-")) ` + -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { + + $INDEX = $PACKAGE.PackageName.IndexOf("-Package") + if ($INDEX -ge 0) { + + $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" + if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { + $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null + } + } + } + } + + # Add font support for the new language + if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null + } + + # Add TTS support for the new language + if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { + if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { + + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null + + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null + } + } + + # Generates a new Lang.ini file which is used to define the language packs inside the image + if ( (Test-Path -Path $WINPE_MOUNT"\sources\lang.ini") ) { + Write-Output "$(Get-TS): Updating lang.ini" + DISM /image:$WINPE_MOUNT /Gen-LangINI /distribution:$WINPE_MOUNT | Out-Null + } + + # Add latest cumulative update + Write-Output "$(Get-TS): Adding package $LCU_PATH" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null + + # Perform image cleanup + Write-Output "$(Get-TS): Performing image cleanup on WinPE" + DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null + + # Dismount + Dismount-WindowsImage -Path $WINPE_MOUNT -Save -ErrorAction stop | Out-Null + + #Export WinPE + Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim" + Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null + +} + +Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH"\sources\boot.wim" -Force -ErrorAction stop | Out-Null +``` + +### Update the main operating system + +For this next phase, there is no need to mount the main operating system, since it was already mounted in the previous scripts. This script starts by applying the servicing stack Dynamic Update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it leverages `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). + +Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .NET), this is the time to apply those. The script then proceeds with applying the latest cumulative update. Finally, the script cleans and exports the image. + +You can install Optional Components, along with the .NET feature, offline, but that will require the device to be restarted. This is why the script installs .NET and Optional Components after cleanup and before export. + +```powershell +# +# update Main OS +# + +# Add servicing stack update +Write-Output "$(Get-TS): Adding package $SSU_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null + +# Optional: Add language to main OS +Write-Output "$(Get-TS): Adding package $OS_LP_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null + +# Optional: Add a Features on Demand to the image +Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0" +Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.Basic~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.OCR~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.Handwriting~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.TextToSpeech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +Write-Output "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0" +Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +# Note: If I wanted to enable additional Features on Demand, I'd add these here. + +# Add latest cumulative update +Write-Output "$(Get-TS): Adding package $LCU_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null + +# Copy our updated recovery image from earlier into the main OS +# Note: If I were updating more than 1 edition, I'd want to copy the same recovery image file +# into each edition to enable single instancing +Copy-Item -Path $WORKING_PATH"\winre.wim" -Destination $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null + +# Perform image cleanup +Write-Output "$(Get-TS): Performing image cleanup on main OS" +DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null + +# +# Note: If I wanted to enable additional Optional Components, I'd add these here. +# In addition, we'll add .NET 3.5 here as well. Both .NET and Optional Components might require +# the image to be booted, and thus if we tried to cleanup after installation, it would fail. +# + +Write-Output "$(Get-TS): Adding NetFX3~~~~" +Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null + +# Add .NET Cumulative Update +Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH" +Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorAction stop | Out-Null + +# Dismount +Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Save -ErrorAction stop | Out-Null + +# Export +Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim" +Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\install.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\install2.wim" -ErrorAction stop | Out-Null +Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null +``` + +### Update remaining media files + +This part of the script updates the Setup files. It simply copies the individual files in the Setup Dynamic Update package to the new media. This step brings an updated Setup.exe as needed, along with the latest compatibility database, and replacement component manifests. + +```powershell +# +# update remaining files on media +# + +# Add Setup DU by copy the files from the package into the newMedia +Write-Output "$(Get-TS): Adding package $SETUP_DU_PATH" +cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PATH"\sources" | Out-Null +``` + +### Finish up + +As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs. + +```powershell +# +# Perform final cleanup +# + +# Remove our working folder +Remove-Item -Path $WORKING_PATH -Recurse -Force -ErrorAction stop | Out-Null + +# Dismount ISO images +Write-Output "$(Get-TS): Dismounting ISO images" +Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Out-Null +Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null + +Write-Output "$(Get-TS): Media refresh completed!" +``` diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index 4f38f8583c..8997b5e4f9 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -1,131 +1,137 @@ ---- -title: Olympia Corp enrollment guidelines -description: Olympia Corp enrollment guidelines -ms.author: greglin -ms.topic: article -ms.prod: w10 -ms.technology: windows -audience: itpro author: greg-lindsay -ms.reviewer: -manager: laurawi -keywords: insider, trial, enterprise, lab, corporation, test ---- - -# Olympia Corp - -## What is Windows Insider Lab for Enterprise and Olympia Corp? - -Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release enterprise privacy and security features. To get the complete experience of these enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features. - -As an Olympia user, you will have an opportunity to: - -- Use various enterprise features like Windows Information Protection (WIP), Advanced Threat Protection (ATP), windows Defender Application Guard (WDAG), and Application Virtualization (APP-V). -- Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness. -- Validate and test pre-release software in your environment. -- Provide feedback. -- Interact with engineering team members through a variety of communication channels. - ->[!Note] ->Enterprise features might have reduced or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the enterprise features at any time without notice. - -For more information about Olympia Corp, see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ). - -To request an Olympia Corp account, fill out the survey at [https://aka.ms/RegisterOlympia](https://aka.ms/RegisterOlympia). - -## Enrollment guidelines - -Welcome to Olympia Corp. Here are the steps needed to enroll. - -As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Enterprise from Windows 10 Pro. This upgrade is optional. Since certain features such as Windows Defender Application Guard are only available on Windows 10 Enterprise, we recommend you to upgrade. - -Choose one of the following two enrollment options: - -- To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympia) account. - -- If you are running Windows 10 Pro, we recommend that you upgrade to Windows 10 Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account. - - - -### Set up an Azure Active Directory-REGISTERED Windows 10 device - -This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information. - -1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). - - ![Settings -> Accounts](images/1-1.png) - -2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**. - -3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. - - ![Set up a work or school account](images/1-3.png) - -4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. - - > [!NOTE] - > Passwords should contain 8-16 characters, including at least one special character or number. - - ![Update your password](images/1-4.png) - -5. Read the **Terms and Conditions**. Click **Accept** to participate in the program. - -6. If this is the first time you are logging in, fill in the additional information to help you retrieve your account details. - -7. Create a PIN for signing into your Olympia corporate account. - -8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**. - - > [!NOTE] - > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness). - -9. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**. - - - -### Set up Azure Active Directory-JOINED Windows 10 device - -- This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. - -1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). - - ![Settings -> Accounts](images/1-1.png) - -2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**. - -3. Click **Connect**, then click **Join this device to Azure Active Directory**. - - ![Update your password](images/2-3.png) - -4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. - - ![Set up a work or school account](images/2-4.png) - -5. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. - - > [!NOTE] - > Passwords should contain 8-16 characters, including at least one special character or number. - - ![Update your password](images/2-5.png) - -6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. - -7. If this is the first time you are signing in, fill in the additional information to help you retrieve your account details. - -8. Create a PIN for signing into your Olympia corporate account. - -9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. - -10. Restart your device. - -11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your device will upgrade to Windows 10 Enterprise. - -12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**. - - > [!NOTE] - > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness). - -13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**. - ->[!NOTE] -> Your Windows 10 Enterprise license will not be renewed if your device is not connected to Olympia. - +--- +title: Olympia Corp enrollment guidelines +description: Learn about the Olympia Corp enrollment and setting up an Azure Active Directory-REGISTERED Windows 10 device or an Azure Active Directory-JOINED Windows 10 device. +ms.author: jaimeo +ms.topic: article +ms.prod: w10 +ms.technology: windows +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.reviewer: +manager: laurawi +keywords: insider, trial, enterprise, lab, corporation, test +ms.custom: seo-marvel-apr2020 +--- + +# Olympia Corp + +## What is Windows Insider Lab for Enterprise and Olympia Corp? + +Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release enterprise privacy and security features. To get the complete experience of these enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features. + +As an Olympia user, you will have an opportunity to: + +- Use various enterprise features like Windows Information Protection (WIP), Microsoft Defender for Office 365, Windows Defender Application Guard (WDAG), and Application Virtualization (APP-V). +- Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness. +- Validate and test pre-release software in your environment. +- Provide feedback. +- Interact with engineering team members through a variety of communication channels. + +>[!Note] +>Enterprise features might have reduced or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the enterprise features at any time without notice. + +For more information about Olympia Corp, see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ). + +To request an Olympia Corp account, fill out the survey at [https://aka.ms/RegisterOlympia](https://aka.ms/RegisterOlympia). + +## Enrollment guidelines + +Welcome to Olympia Corp. Here are the steps needed to enroll. + +As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Enterprise from Windows 10 Pro. This upgrade is optional. Since certain features such as Windows Defender Application Guard are only available on Windows 10 Enterprise, we recommend you to upgrade. + +Choose one of the following two enrollment options: + +- To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympia) account. + +- If you are running Windows 10 Pro, we recommend that you upgrade to Windows 10 Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account. + + + +### Set up an Azure Active Directory-REGISTERED Windows 10 device + +This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information. + +1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). + + ![Settings -> Accounts](images/1-1.png) + +2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**. + +3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. + + ![Entering account information when setting up a work or school account](images/1-3.png) + +4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. + + > [!NOTE] + > Passwords should contain 8-16 characters, including at least one special character or number. + + ![Update your password](images/1-4.png) + +5. Read the **Terms and Conditions**. Click **Accept** to participate in the program. + +6. If this is the first time you are logging in, fill in the additional information to help you retrieve your account details. + +7. Create a PIN for signing into your Olympia corporate account. + +8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**. + + > [!NOTE] + > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness). + +9. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**. + + + +### Set up Azure Active Directory-JOINED Windows 10 device + +- This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. + + > [!NOTE] + > Make sure that you save your Pro license key before upgrading to the Enterprise edition. If the device gets disconnected from Olympia, you can use the Pro key to reactivate the license manually in the unlikely event that the license fails to downgrade back to Pro automatically. To reactivate manually, see [Upgrade by manually entering a product key](https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades#upgrade-by-manually-entering-a-product-key). + +1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). + + ![Settings -> Accounts](images/1-1.png) + +2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**. + +3. Click **Connect**, then click **Join this device to Azure Active Directory**. + + ![Joining device to Azure AD]](images/2-3.png) + +4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. + + ![Set up a work or school account](images/2-4.png) + +5. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. + + > [!NOTE] + > Passwords should contain 8-16 characters, including at least one special character or number. + + ![Entering temporary password](images/2-5.png) + +6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. + +7. If this is the first time you are signing in, fill in the additional information to help you retrieve your account details. + +8. Create a PIN for signing into your Olympia corporate account. + +9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. + +10. Restart your device. + +11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your device will upgrade to Windows 10 Enterprise. + +12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**. + + > [!NOTE] + > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness). + +13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**. + +>[!NOTE] +> Your Windows 10 Enterprise license will not be renewed if your device is not connected to Olympia. + diff --git a/windows/deployment/update/optional-content.md b/windows/deployment/update/optional-content.md new file mode 100644 index 0000000000..607c9114e4 --- /dev/null +++ b/windows/deployment/update/optional-content.md @@ -0,0 +1,859 @@ +--- +title: Migrating and acquiring optional Windows content +description: Keep language resources and Features on Demand during operating system updates +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Migrating and acquiring optional Windows content during updates + +This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term. + +When you update the operating system, it’s critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows 10 setup using a local Windows image or WIM file (a “media-based” or “task-sequence-based” update). Others do in-place updates using an approved Windows 10 feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a "servicing-based” update). + +Neither approach contains the full set of Windows optional features that a user’s device might need, so those features are not migrated to the new operating system. Further, those features are not available in Configuration Manager or WSUS for on-premises acquisition after a feature update + +## What is optional content? + +Optional content includes the following items: + +- General Features on Demand also referred to as FODs (for example, Windows Mixed Reality) +- Language-based and regional FODs (for example, Language.Basic~~~ja-jp~0.0.1.0) +- Local Experience Packs + +Optional content isn’t included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it’s released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This provides more space for user’s data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network. + +## Why is acquiring optional content challenging? + +The challenges surrounding optional content typically fall into two groups: + +### Incomplete operating system updates + +The first challenge is related to content migration during a feature update. When Windows Setup performs an in-place update, the new operating is written to the user’s disk alongside the old version. This is a temporary folder, where a second clean operating system is installed and prepared for the user to "move into." When this happens, Windows Setup enumerates optional content installed already in the current version and plans to install the new version of this content in the new operating system. + +Windows Setup needs access to the optional content to do this. Since optional content is not in the Windows image by default, Windows Setup must look elsewhere to get the Windows packages, stage them, and then install them in the new operating system. When the content can’t be found, the result is an update that is missing features on the device, a frustrated end user, and likely a help desk call. This pain point is sometimes referred to "failure to migrate optional content during update." For media-based updates, Windows will automatically try again once the new operating system boots. We call this “latent acquisition.” + +### User-initiated feature acquisition failure + +The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows 10, either by using a clean installation or an in-place update. The user visits Settings, and attempts to install a second language, additional language experience features, or other optional content. Again, since these features are not in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can’t be found, users are frustrated and another help desk call could result. This pain point is sometimes referred to as "failure to acquire optional content.” + +## Options for acquiring optional content + +Most commercial organizations understand the pain points outlined above, and discussions typically start with them asking what plans are available to address these challenges. The following table includes multiple options for consideration, depending on how you are currently deploying Windows 10. In this table, + +- Migration means it supports optional content migration during an update. +- Acquisition means it supports optional content acquisition (that is, initiated by the user). +- Media means it's applicable with media-based deployments. +- Servicing means applicable with servicing-based deployments. + + +|Method |Migration |Acquisition |Media | Servicing | +|---------|---------|---------|---------|--------------| +|Option 1: Use Windows Update | Yes | Yes | No | Yes | +|Option 2: Enable Dynamic Update | Yes | No | Yes |Yes | +|Option 3: Customize the Windows image before deployment | Yes | No | Yes |No | +|Option 4: Install language features during deployment | Partial | No | Yes | No | +|Option 5: Install optional content after deployment | Yes | No |Yes | Yes | +|Option 6: Configure alternative source for Features on Demand | No | Partial | Yes | Yes | + + + +### Option 1: Use Windows Update + +Windows Update for Business solves the optional content problem. Optional content is published and available for acquisition by Windows Setup from a nearby Microsoft content delivery network and acquired using the Unified Update Platform. Optional content migration and acquisition scenarios "just work" when the device is connected to an update service that uses the Unified Update Platform, such as Windows Update or Windows Update for Business. If for some reason a language pack fails to install during the update, the update will automatically roll back. + +Starting with Windows 10, version 1709, we introduced the [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/). The Unified Update Platform is an improvement in the underlying Windows update technology that results in smaller download sizes and a more efficient protocol for checking for updates, acquiring and installing the packages needed, and getting current in one update step. The technology is "unified" because it brings together the update stack for Windows 10, Windows Server, and other products, such as HoloLens. The Unified Update Platform is not currently integrated with WSUS. + +You should consider moving to Windows Update for Business. Not only will the optional content scenario work seamlessly (as it does for consumer devices today), but you also get the full benefits of smaller download sizes also known as Express Updates. Further, devices that use devices are immune to the challenge of upgrading a Windows 10 device where the operating system installation language is inadvertently changed to a new language. Otherwise, any future media-based feature updates can fail when the installation media has a different installation language. See [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/upgrading-windows-10-devices-with-installation-media-different/ba-p/746126) for more details, as well as our [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) on this topic. + +### Option 2: Enable Dynamic Update + +If you’re not ready to move to Windows Update, another option is to enable Dynamic Update during a feature update. As soon as a Windows 10 feature update starts, whether via a media-based update or a WSUS-based feature update, Dynamic Update is one of the first steps invoked. Windows 10 Setup connects to an internet-facing URL hosted by Microsoft to fetch Dynamic Update content, and then applies those updates to the operating system installation media. The content acquired includes the following: + +- Setup updates: Fixes to Setup.exe binaries or any files that Setup uses for feature updates. +- Safe OS updates: Fixes for the "safe OS" that are used to update Windows recovery environment (WinRE). +- Servicing stack updates: Fixes that are necessary to address the Windows 10 servicing stack issue and thus required to complete the feature update. +- Latest cumulative update: Installs the latest cumulative quality update. +- Driver updates: Latest version of applicable drivers that have already been published by manufacturers into Windows Update and meant specifically for Dynamic Update. + +In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device is not connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows 10 Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this with setupconfig.ini. See [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. + +Starting in Windows 10, version 2004, Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will go through an additional reboot for the latest cumulative update since it was not available during the feature update. + +One additional consideration when using Dynamic Update is the impact to your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Windows 10, version 2004 setup now downloads Dynamic Update content using Delivery Optimization when available. + For devices that aren’t connected to the internet, a subset of the Dynamic Update content is available by using WSUS and the Microsoft catalog. + +### Option 3: Customize the Windows Image before deployment + + For many organizations, the deployment workflow involves a Configuration Manager task sequence that performs a media-based update. Some customers either don’t have internet connectivity, or the connectivity is poor and so they can’t enable Dynamic Update. In these cases, we recommend installing optional content prior to deployment. This is sometimes referred to as customizing the installation media. + +You can customize the Windows image in these ways: + +- Applying a cumulative (quality) update +- Applying updates to the servicing stack +- Applying updates to Setup.exe binaries or other files that Setup uses for feature updates +- Applying updates for the "safe operating system" (SafeOS) that is used for the Windows recovery environment +- Adding or removing languages +- Adding or removing Features on Demand + +The benefit of this option is that the Windows image can include those additional languages, language experience features, and other Features on Demand through one-time updates to the image. Then you can use them in an existing task sequence or custom deployment where Setup.exe is involved. The downside of this approach is that it requires some preparation of the image in advance, including scripting with DISM to install the additional packages. It also means the image is the same for all devices that consume it and might contain more features than some users need. For more information on customizing your media, see [Updating Windows 10 media with Dynamic Update packages](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/updating-windows-10-media-with-dynamic-update-packages/ba-p/982477) and our [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073). Also like Option 2, you still have a solution for migration of optional content, but not supporting user-initiated optional content acquisition. Also, there is a variation of this option in which media is updated *on the device* just before installation. This allows for device-specific image customization based on what's currently installed. + + +### Option 4: Install language features during deployment + +A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows 10 Setup option [/InstallLangPacks](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using setupconfig.ini. See [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. + +When Setup runs, it will inject these packages into the new operating system during installation. This means it can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages cannot be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, as well as the architecture-specific Language Pack .cabs from the LPLIP ISO. Also, starting with Windows 10, version 1903, the behavior changed. In Windows 10, version 1809 and earlier, failure to install the packages wasn’t a fatal error. Starting with Windows 10, version 1903, we treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don’t migrate FOD and languages (unless Dynamic Update is enabled). + +This approach has some interesting benefits. The original Windows image doesn’t need to be modified, possibly saving time and scripting. For some commercial customers, this is implemented as their primary pain point has to do with language support immediately after the update. + +### Option 5: Install optional content after deployment + +This option is like Option 3 in that you customize the operating system image with additional optional content after it’s deployed. IT pros can extend the behavior of Windows Setup by running their own custom action scripts during and after a feature update. See [Run custom actions during feature update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) for details. With this approach, you can create a device-specific migration of optional content by capturing the optional content that is installed in the operating system, and then saving this list to install the same optional content in the new operating system. Like Option 4, you would internally host a network share that contains the source of the optional content packages. Then, during the execution of Setup on the device, capture the list of installed optional content from the source operating system and save. Later, after Setup completes, you use the list to install the optional content, which leaves the user’s device without loss of functionality. + +### Option 6: Configure an alternative source for optional content + +Several of the options address ways to address optional content migration issues during an in-place update. To address the second pain point of easily acquiring optional content in the user-initiated case, you can configure each device by using the Specify settings for optional component installation and component repair Group Policy. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. This approach has the disadvantage of additional content to be hosted within your network (additional to the operating system image you might be still deploying to some clients) but has the advantage of acquiring content within your network. Some reminders about this policy: + +- The file path to the alternate source must be a fully qualified path; multiple locations can be separated by a semicolon. +- This setting does not support installing language packs from Alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired. +- If this setting is not configured or disabled, files will be downloaded from the default Windows Update location, for example Windows Update for Business or WSUS). + +See [Configure a Windows Repair Source](https://docs.microsoft.com/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) for more information. + + +## Learn more + +For more information about the Unified Update Platform and the approaches outlined in this article, see the following resources: + +- [/InstallLangPacks](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) +- [/DynamicUpdate](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) +- [Configure a Windows Repair Source](https://docs.microsoft.com/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) +- [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073) +- [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) +- [Run custom actions during feature update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) +- [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/) +- [Updating Windows 10 media with Dynamic Update packages](media-dynamic-update.md) +- [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) + + +## Sample scripts + +Options 3 and 5 involve the most scripting. Sample scripts for Option 3 already exist, so we’ll look at sample scripts for [Option 5](#option-5-install-optional-content-after-deployment): Install Optional Content after Deployment. + +### Creating an optional content repository + +To get started, we’ll build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We’ll configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository. + + + +```powershell +# Declare media for FOD and LPs +$LP_ISO_PATH = "C:\_IMAGE\2004_ISO\CLIENTLANGPACKDVD_OEM_MULTI.iso" +$FOD_ISO_PATH = "C:\_IMAGE\2004_ISO\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" + +# Declare folders +$WORKING_PATH = "C:\_IMAGE\BuildRepo" +$MEDIA_PATH = "C:\_IMAGE\2004_SETUP" + +$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount" +$REPO_PATH = $WORKING_PATH + "\Repo" + +# Create folders for mounting image optional content repository +if (Test-Path $MAIN_OS_MOUNT) { + Remove-Item -Path $MAIN_OS_MOUNT -Force -Recurse -ErrorAction stop| Out-Null +} + +if (Test-Path $REPO_PATH) { + Remove-Item -Path $REPO_PATH -Force -Recurse -ErrorAction stop| Out-Null +} + +New-Item -ItemType Directory -Force -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null +New-Item -ItemType Directory -Force -Path $REPO_PATH -ErrorAction stop| Out-Null + +# Mount the main OS, I'll use this throughout the script +Write-Host "Mounting main OS" +Mount-WindowsImage -ImagePath $MEDIA_PATH"\sources\install.wim" -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null + +# Mount the LP ISO +Write-Host "Mounting LP ISO" +$LP_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter + +# Declare language related cabs +$OS_LP_PATH = $LP_ISO_DRIVE_LETTER + ":\x64\langpacks\" + "*.cab" + +# Mount the FOD ISO +Write-Host "Mounting FOD ISO" +$FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter +$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\" + +# Export the FODs from the ISO that we are interested in +Write-Host "Exporting FODs to Repo" +DISM /image:$MAIN_OS_MOUNT /export-source /source:$FOD_PATH /target:$REPO_PATH ` + /capabilityname:Accessibility.Braille~~~~0.0.1.0 ` + /capabilityname:App.StepsRecorder~~~~0.0.1.0 ` + /capabilityname:App.WirelessDisplay.Connect~~~~0.0.1.0 ` + /capabilityname:Browser.InternetExplorer~~~~0.0.11.0 ` + /capabilityname:DirectX.Configuration.Database~~~~0.0.1.0 ` + /capabilityname:Language.Basic~~~af-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~ar-sa~0.0.1.0 ` + /capabilityname:Language.Basic~~~as-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~az-latn-az~0.0.1.0 ` + /capabilityname:Language.Basic~~~ba-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~be-by~0.0.1.0 ` + /capabilityname:Language.Basic~~~bg-bg~0.0.1.0 ` + /capabilityname:Language.Basic~~~bn-bd~0.0.1.0 ` + /capabilityname:Language.Basic~~~bn-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~bs-latn-ba~0.0.1.0 ` + /capabilityname:Language.Basic~~~ca-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.Basic~~~cy-gb~0.0.1.0 ` + /capabilityname:Language.Basic~~~da-dk~0.0.1.0 ` + /capabilityname:Language.Basic~~~de-ch~0.0.1.0 ` + /capabilityname:Language.Basic~~~de-de~0.0.1.0 ` + /capabilityname:Language.Basic~~~el-gr~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-au~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-ca~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-gb~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-us~0.0.1.0 ` + /capabilityname:Language.Basic~~~es-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~es-mx~0.0.1.0 ` + /capabilityname:Language.Basic~~~es-us~0.0.1.0 ` + /capabilityname:Language.Basic~~~et-ee~0.0.1.0 ` + /capabilityname:Language.Basic~~~eu-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~fa-ir~0.0.1.0 ` + /capabilityname:Language.Basic~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.Basic~~~fil-ph~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-be~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-ch~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.Basic~~~ga-ie~0.0.1.0 ` + /capabilityname:Language.Basic~~~gd-gb~0.0.1.0 ` + /capabilityname:Language.Basic~~~gl-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~gu-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~ha-latn-ng~0.0.1.0 ` + /capabilityname:Language.Basic~~~haw-us~0.0.1.0 ` + /capabilityname:Language.Basic~~~he-il~0.0.1.0 ` + /capabilityname:Language.Basic~~~hi-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.Basic~~~hu-hu~0.0.1.0 ` + /capabilityname:Language.Basic~~~hy-am~0.0.1.0 ` + /capabilityname:Language.Basic~~~id-id~0.0.1.0 ` + /capabilityname:Language.Basic~~~ig-ng~0.0.1.0 ` + /capabilityname:Language.Basic~~~is-is~0.0.1.0 ` + /capabilityname:Language.Basic~~~it-it~0.0.1.0 ` + /capabilityname:Language.Basic~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.Basic~~~ka-ge~0.0.1.0 ` + /capabilityname:Language.Basic~~~kk-kz~0.0.1.0 ` + /capabilityname:Language.Basic~~~kl-gl~0.0.1.0 ` + /capabilityname:Language.Basic~~~kn-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~kok-deva-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.Basic~~~ky-kg~0.0.1.0 ` + /capabilityname:Language.Basic~~~lb-lu~0.0.1.0 ` + /capabilityname:Language.Basic~~~lt-lt~0.0.1.0 ` + /capabilityname:Language.Basic~~~lv-lv~0.0.1.0 ` + /capabilityname:Language.Basic~~~mi-nz~0.0.1.0 ` + /capabilityname:Language.Basic~~~mk-mk~0.0.1.0 ` + /capabilityname:Language.Basic~~~ml-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~mn-mn~0.0.1.0 ` + /capabilityname:Language.Basic~~~mr-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~ms-bn~0.0.1.0 ` + /capabilityname:Language.Basic~~~ms-my~0.0.1.0 ` + /capabilityname:Language.Basic~~~mt-mt~0.0.1.0 ` + /capabilityname:Language.Basic~~~nb-no~0.0.1.0 ` + /capabilityname:Language.Basic~~~ne-np~0.0.1.0 ` + /capabilityname:Language.Basic~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.Basic~~~nn-no~0.0.1.0 ` + /capabilityname:Language.Basic~~~nso-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~or-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~pa-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.Basic~~~ps-af~0.0.1.0 ` + /capabilityname:Language.Basic~~~pt-br~0.0.1.0 ` + /capabilityname:Language.Basic~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.Basic~~~rm-ch~0.0.1.0 ` + /capabilityname:Language.Basic~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.Basic~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~rw-rw~0.0.1.0 ` + /capabilityname:Language.Basic~~~sah-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~si-lk~0.0.1.0 ` + /capabilityname:Language.Basic~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.Basic~~~sl-si~0.0.1.0 ` + /capabilityname:Language.Basic~~~sq-al~0.0.1.0 ` + /capabilityname:Language.Basic~~~sr-cyrl-rs~0.0.1.0 ` + /capabilityname:Language.Basic~~~sr-latn-rs~0.0.1.0 ` + /capabilityname:Language.Basic~~~sv-se~0.0.1.0 ` + /capabilityname:Language.Basic~~~sw-ke~0.0.1.0 ` + /capabilityname:Language.Basic~~~ta-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~te-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~tg-cyrl-tj~0.0.1.0 ` + /capabilityname:Language.Basic~~~th-th~0.0.1.0 ` + /capabilityname:Language.Basic~~~tk-tm~0.0.1.0 ` + /capabilityname:Language.Basic~~~tn-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.Basic~~~tt-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~ug-cn~0.0.1.0 ` + /capabilityname:Language.Basic~~~uk-ua~0.0.1.0 ` + /capabilityname:Language.Basic~~~ur-pk~0.0.1.0 ` + /capabilityname:Language.Basic~~~uz-latn-uz~0.0.1.0 ` + /capabilityname:Language.Basic~~~vi-vn~0.0.1.0 ` + /capabilityname:Language.Basic~~~wo-sn~0.0.1.0 ` + /capabilityname:Language.Basic~~~xh-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~yo-ng~0.0.1.0 ` + /capabilityname:Language.Basic~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.Basic~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.Basic~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.Basic~~~zu-za~0.0.1.0 ` + /capabilityname:Language.Fonts.Arab~~~und-Arab~0.0.1.0 ` + /capabilityname:Language.Fonts.Beng~~~und-Beng~0.0.1.0 ` + /capabilityname:Language.Fonts.Cans~~~und-Cans~0.0.1.0 ` + /capabilityname:Language.Fonts.Cher~~~und-Cher~0.0.1.0 ` + /capabilityname:Language.Fonts.Deva~~~und-Deva~0.0.1.0 ` + /capabilityname:Language.Fonts.Ethi~~~und-Ethi~0.0.1.0 ` + /capabilityname:Language.Fonts.Gujr~~~und-Gujr~0.0.1.0 ` + /capabilityname:Language.Fonts.Guru~~~und-Guru~0.0.1.0 ` + /capabilityname:Language.Fonts.Hans~~~und-Hans~0.0.1.0 ` + /capabilityname:Language.Fonts.Hant~~~und-Hant~0.0.1.0 ` + /capabilityname:Language.Fonts.Hebr~~~und-Hebr~0.0.1.0 ` + /capabilityname:Language.Fonts.Jpan~~~und-Jpan~0.0.1.0 ` + /capabilityname:Language.Fonts.Khmr~~~und-Khmr~0.0.1.0 ` + /capabilityname:Language.Fonts.Knda~~~und-Knda~0.0.1.0 ` + /capabilityname:Language.Fonts.Kore~~~und-Kore~0.0.1.0 ` + /capabilityname:Language.Fonts.Laoo~~~und-Laoo~0.0.1.0 ` + /capabilityname:Language.Fonts.Mlym~~~und-Mlym~0.0.1.0 ` + /capabilityname:Language.Fonts.Orya~~~und-Orya~0.0.1.0 ` + /capabilityname:Language.Fonts.PanEuropeanSupplementalFonts~~~0.0.1.0 ` + /capabilityname:Language.Fonts.Sinh~~~und-Sinh~0.0.1.0 ` + /capabilityname:Language.Fonts.Syrc~~~und-Syrc~0.0.1.0 ` + /capabilityname:Language.Fonts.Taml~~~und-Taml~0.0.1.0 ` + /capabilityname:Language.Fonts.Telu~~~und-Telu~0.0.1.0 ` + /capabilityname:Language.Fonts.Thai~~~und-Thai~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~af-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~bs-latn-ba~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ca-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~cy-gb~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~da-dk~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~de-de~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~el-gr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~en-gb~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~en-us~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~es-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~es-mx~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~eu-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ga-ie~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~gd-gb~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~gl-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~hi-in~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~id-id~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~it-it~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~lb-lu~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~mi-nz~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ms-bn~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ms-my~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nb-no~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nn-no~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nso-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~pt-br~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~rm-ch~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~rw-rw~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sl-si~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sq-al~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sr-cyrl-rs~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sr-latn-rs~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sv-se~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sw-ke~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~tn-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~wo-sn~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~xh-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zu-za~0.0.1.0 ` + /capabilityname:Language.LocaleData~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.OCR~~~ar-sa~0.0.1.0 ` + /capabilityname:Language.OCR~~~bg-bg~0.0.1.0 ` + /capabilityname:Language.OCR~~~bs-latn-ba~0.0.1.0 ` + /capabilityname:Language.OCR~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.OCR~~~da-dk~0.0.1.0 ` + /capabilityname:Language.OCR~~~de-de~0.0.1.0 ` + /capabilityname:Language.OCR~~~el-gr~0.0.1.0 ` + /capabilityname:Language.OCR~~~en-gb~0.0.1.0 ` + /capabilityname:Language.OCR~~~en-us~0.0.1.0 ` + /capabilityname:Language.OCR~~~es-es~0.0.1.0 ` + /capabilityname:Language.OCR~~~es-mx~0.0.1.0 ` + /capabilityname:Language.OCR~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.OCR~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.OCR~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.OCR~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.OCR~~~hu-hu~0.0.1.0 ` + /capabilityname:Language.OCR~~~it-it~0.0.1.0 ` + /capabilityname:Language.OCR~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.OCR~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.OCR~~~nb-no~0.0.1.0 ` + /capabilityname:Language.OCR~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.OCR~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.OCR~~~pt-br~0.0.1.0 ` + /capabilityname:Language.OCR~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.OCR~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.OCR~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.OCR~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.OCR~~~sl-si~0.0.1.0 ` + /capabilityname:Language.OCR~~~sr-cyrl-rs~0.0.1.0 ` + /capabilityname:Language.OCR~~~sr-latn-rs~0.0.1.0 ` + /capabilityname:Language.OCR~~~sv-se~0.0.1.0 ` + /capabilityname:Language.OCR~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.OCR~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.OCR~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.OCR~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.Speech~~~da-dk~0.0.1.0 ` + /capabilityname:Language.Speech~~~de-de~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-au~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-ca~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-gb~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-in~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-us~0.0.1.0 ` + /capabilityname:Language.Speech~~~es-es~0.0.1.0 ` + /capabilityname:Language.Speech~~~es-mx~0.0.1.0 ` + /capabilityname:Language.Speech~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.Speech~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.Speech~~~it-it~0.0.1.0 ` + /capabilityname:Language.Speech~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.Speech~~~pt-br~0.0.1.0 ` + /capabilityname:Language.Speech~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.Speech~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.Speech~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ar-eg~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ar-sa~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~bg-bg~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ca-es~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~da-dk~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~de-at~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~de-ch~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~de-de~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~el-gr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-au~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-ca~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-gb~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-ie~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-in~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-us~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~es-es~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~es-mx~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fr-ch~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~he-il~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~hi-in~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~hu-hu~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~id-id~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~it-it~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ms-my~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~nb-no~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~nl-be~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~pt-br~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~sl-si~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~sv-se~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ta-in~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~th-th~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~vi-vn~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~zh-tw~0.0.1.0 ` + /capabilityname:MathRecognizer~~~~0.0.1.0 ` + /capabilityname:Microsoft.Onecore.StorageManagement~~~~0.0.1.0 ` + /capabilityname:Microsoft.WebDriver~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.MSPaint~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.Notepad~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.StorageManagement~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.WordPad~~~~0.0.1.0 ` + /capabilityname:Msix.PackagingTool.Driver~~~~0.0.1.0 ` + /capabilityname:NetFX3~~ ` + /capabilityname:Network.Irda~~~~0.0.1.0 ` + /capabilityname:OneCoreUAP.OneSync~~~~0.0.1.0 ` + /capabilityname:OpenSSH.Client~~~~0.0.1.0 ` + /capabilityname:OpenSSH.Server~~~~0.0.1.0 ` + /capabilityname:Print.EnterpriseCloudPrint~~~~0.0.1.0 ` + /capabilityname:Print.Fax.Scan~~~~0.0.1.0 ` + /capabilityname:Print.Management.Console~~~~0.0.1.0 ` + /capabilityname:Print.MopriaCloudService~~~~0.0.1.0 ` + /capabilityname:RasCMAK.Client~~~~0.0.1.0 ` + /capabilityname:RIP.Listener~~~~0.0.1.0 ` + /capabilityname:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.CertificateServices.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.DHCP.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.Dns.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.FileServices.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.IPAM.Client.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.LLDP.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.NetworkController.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.NetworkLoadBalancing.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.RemoteAccess.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.RemoteDesktop.Services.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.ServerManager.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.Shielded.VM.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.StorageMigrationService.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.StorageReplica.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.SystemInsights.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.VolumeActivation.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.WSUS.Tools~~~~0.0.1.0 ` + /capabilityname:ServerCore.AppCompatibility~~~~0.0.1.0 ` + /capabilityname:SNMP.Client~~~~0.0.1.0 ` + /capabilityname:Tools.DeveloperMode.Core~~~~0.0.1.0 ` + /capabilityname:Tools.Graphics.DirectX~~~~0.0.1.0 ` + /capabilityname:Windows.Client.ShellComponents~~~~0.0.1.0 ` + /capabilityname:Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0 ` + /capabilityname:WMI-SNMP-Provider.Client~~~~0.0.1.0 ` + /capabilityname:XPS.Viewer~~~~0.0.1.0 + + # This one is large, lets skip for now + #/capabilityname:Analog.Holographic.Desktop~~~~0.0.1.0 ` + + +# Copy language caps to the repo +Copy-Item -Path $OS_LP_PATH -Destination $REPO_PATH -Force -ErrorAction stop | Out-Null + +# Dismount OS image +Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Discard -ErrorAction ignore | Out-Null + +# Dismount ISO images +Write-Host "Dismounting ISO images" +Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction ignore | Out-Null +Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction ignore | Out-Null + +``` + +### Saving optional content in the source operating system + +To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This will limit the files to copy. + + +```powershell +$OUTPUT_PATH = "C:\TEMP\" +$LOG_PATH = $OUTPUT_PATH + "log.txt" +$OUTPUT_PATH = "C:\TEMP\" +$LOG_PATH = $OUTPUT_PATH + "log.txt" +$LANG_PATH = $OUTPUT_PATH + "sourceLang.txt" +$CAP_PATH = $OUTPUT_PATH + "sourceCapability.txt" +$OSVERSION_PATH = $OUTPUT_PATH + "sourceVersion.txt" +$REPO_PATH = "Z:\Repo\" +$LOCAL_REPO_PATH = $OUTPUT_PATH + "Local_Repo\" + +Function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) } + +Function Log +{ + param ( + [Parameter(Mandatory=$True)] + [string]$MESSAGE + ) + + $M = "$(Get-TS): PreInstall: $MESSAGE" + Write-Host $M + Add-Content -Path $LOG_PATH -Value $M + + } + +Function IsLangFile +{ + param ( + [Parameter(Mandatory=$True)] + [string]$PATH + ) + + if (($PATH -match '[-_~]ar[-_~]') -or ($PATH -match '[-_~]bg[-_~]') -or ($PATH -match '[-_~]cs[-_~]') -or ` + ($PATH -match '[-_~]da[-_~]') -or ($PATH -match '[-_~]de[-_~]') -or ($PATH -match '[-_~]el[-_~]') -or ` + ($PATH -match '[-_~]en[-_~]') -or ($PATH -match '[-_~]es[-_~]') -or ($PATH -match '[-_~]et[-_~]') -or ` + ($PATH -match '[-_~]fi[-_~]') -or ($PATH -match '[-_~]fr[-_~]') -or ($PATH -match '[-_~]he[-_~]') -or ` + ($PATH -match '[-_~]hr[-_~]') -or ($PATH -match '[-_~]hu[-_~]') -or ($PATH -match '[-_~]it[-_~]') -or ` + ($PATH -match '[-_~]ja[-_~]') -or ($PATH -match '[-_~]ko[-_~]') -or ($PATH -match '[-_~]lt[-_~]') -or ` + ($PATH -match '[-_~]lv[-_~]') -or ($PATH -match '[-_~]nb[-_~]') -or ($PATH -match '[-_~]nl[-_~]') -or ` + ($PATH -match '[-_~]pl[-_~]') -or ($PATH -match '[-_~]pt[-_~]') -or ($PATH -match '[-_~]ro[-_~]') -or ` + ($PATH -match '[-_~]ru[-_~]') -or ($PATH -match '[-_~]sk[-_~]') -or ($PATH -match '[-_~]sl[-_~]') -or ` + ($PATH -match '[-_~]sv[-_~]') -or ($PATH -match '[-_~]th[-_~]') -or ($PATH -match '[-_~]tr[-_~]') -or ` + ($PATH -match '[-_~]uk[-_~]') -or ($PATH -match '[-_~]zh[-_~]') -or ($PATH -match '[-_~]sr[-_~]')) { + return $True + } + else { + return $False + } + } + +# Remove the log +Remove-Item -Path $LOG_PATH -Force -ErrorAction ignore | Out-Null +Log "Starting" + +# Remove state files, keep repo if it exists +Remove-Item -Path $LANG_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $CAP_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $OSVERSION_PATH -Force -ErrorAction ignore | Out-Null + +# Get OS version, to use later for detecting compat scans versus OS installation +$OSINFO = Get-CimInstance Win32_OperatingSystem +Log "OS Version: $($OSINFO.Version)" +Add-Content -Path $OSVERSION_PATH -Value $OSINFO.Version + +# Get installed languages from international settings +$INTL = DISM.exe /Online /Get-Intl /English + +# Save only output lines with installed languages +$LANGUAGES = $INTL | Select-String -SimpleMatch 'Installed language(s)' + +# Replace with null so we have a simple list of language codes +$LANGUAGES = $LANGUAGES | ForEach-Object {$_.Line.Replace("Installed language(s): ","")} + +# Save System Language, save only output line with default system language +$SYSLANG = $INTL | Select-String -SimpleMatch 'Default system UI language' + +# Replace with null so we have the language code +$SYSLANG = $SYSLANG | ForEach-Object {$_.Line.Replace("Default system UI language : ","")} + +# Save these languages +Log "Default system UI language on source OS: $($SYSLANG)" +ForEach ($ITEM in $LANGUAGES) { + Log "Installed language on source OS: $($ITEM)" + Add-Content -Path $LANG_PATH -Value $ITEM +} + +# Get and save installed packages, we'll use this for debugging +$PACKAGES = Get-WindowsPackage -Online +ForEach ($ITEM in $PACKAGES) { + if($ITEM.PackageState -eq "Installed") { + Log "Package $($ITEM.PackageName) is installed" + } +} + +# Get and save capabilities +$CAPABILITIES = Get-WindowsCapability -Online +ForEach ($ITEM in $CAPABILITIES) { + if($ITEM.State -eq "Installed") { + Log "Capability $($ITEM.Name) is installed" + Add-Content -Path $CAP_PATH -Value $ITEM.Name + } +} + +# Copy a subset of the Repo files locally, all neutral files and the languages needed +$REPO_FILES = Get-ChildItem $REPO_PATH -file -Recurse +ForEach ($FILE in $REPO_FILES) { + $PATH = ($FILE.DirectoryName + "\") -Replace [Regex]::Escape($REPO_PATH), $LOCAL_REPO_PATH + If (!(Test-Path $Path)) { + New-Item -ItemType Directory -Path $PATH -Force | Out-Null + } + If ((IsLangFile $FILE.Name)) { + + # Only copy those files where we need the primary languages from the source OS + ForEach ($ITEM in $LANGUAGES) { + if ($FILE.Name -match $Item) { + + If (!(Test-Path (Join-Path $Path $File.Name))) { + Copy-Item $FILE.FullName -Destination $PATH -Force + Log "Copied file $($FILE.FullName) to local repository" + } + else { + Log "File $($FILE.Name) already exists in local repository" + } + } + } + } Else { + + # Copy all 'neutral files' and those language specific that are not in the core 38 + If (!(Test-Path (Join-Path $Path $File.Name))) { + Copy-Item $FILE.FullName -Destination $PATH -Force + Log "Copied file $($FILE.FullName) to local repository" + } + else { + Log "File $($FILE.Name) already exists in local repository" + } + } +} + +Log ("Exiting") + +``` + +### Adding optional content in the target operating system + +After setup has completed successfully, we use success.cmd to retrieve the optional content state from the source operating system and install in the new operating system only if that’s missing. Then, apply the latest monthly update as a final step. + + +```powershell +$OUTPUT_PATH = "C:\TEMP\" +$LOG_PATH = $OUTPUT_PATH + "log.txt" +$LANG_PATH = $OUTPUT_PATH + "sourceLang.txt" +$CAP_PATH = $OUTPUT_PATH + "sourceCapability.txt" +$OSVERSION_PATH = $OUTPUT_PATH + "sourceVersion.txt" +$LOCAL_REPO_PATH = $OUTPUT_PATH + "Local_Repo\" +$LCU_PATH = $OUTPUT_PATH + "Windows10.0-KB4565503-x64_PSFX.cab" +$PENDING = $false + +Function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) } + +Function Log +{ + param ( + [Parameter(Mandatory=$True)] + [string]$MESSAGE + ) + + $M = "$(Get-TS): PostInstall: $MESSAGE" + Write-Host $M + Add-Content -Path $LOG_PATH -Value $M + + } + +Log "Starting" + +# Get OS version +$OSINFO = Get-CimInstance Win32_OperatingSystem +Log "OS Version: $($OSINFO.Version)" + +# Check for source OS state, just to be sure +if (!(Test-Path $LANG_PATH) -or !(Test-Path $CAP_PATH) -or !(Test-Path $OSVERSION_PATH) ) { + Log "Source OS state is missing." +} + +# If this script is executing and the OS version hasn't changed, let's exit out. +else { + + # Retrive OS version from source OS + $SOURCE_OSVERSION = Get-Content -Path $OSVERSION_PATH + if ($OSINFO.Version -eq $SOURCE_OSVERSION) { + Log "OS Version hasn't changed." + } + + else { + + # Retrive language list from source OS + $SOURCE_LANGUAGES = Get-Content -Path $LANG_PATH + + # Get installed languages from International Settings + $INTL = DISM.exe /Online /Get-Intl /English + + # Save System Language, save only output line with default system language + $SYS_LANG = $INTL | Select-String -SimpleMatch 'Default system UI language' + + # Replace with null so we have the language code + $SYS_LANG = $SYS_LANG | ForEach-Object {$_.Line.Replace("Default system UI language : ","")} + + # Get and save installed packages, we'll use this for debugging + $PACKAGES = Get-WindowsPackage -Online + ForEach ($ITEM in $PACKAGES) { + if($ITEM.PackageState -eq "Installed") { + Log "Package $($ITEM.PackageName) is installed" + } + } + + # Loop through source OS languages, and install if missing on target OS + ForEach ($SOURCE_ITEM in $SOURCE_LANGUAGES) { + if ($SOURCE_ITEM -ne $SYS_LANG) { + + # add missing languages except the system language + Log "Adding language Microsoft-Windows-Client-Language-Pack_x64_$($SOURCE_ITEM).cab" + try { + Add-WindowsPackage -Online -PackagePath "$($LOCAL_REPO_PATH)\Microsoft-Windows-Client-Language-Pack_x64_$($SOURCE_ITEM).cab" -ErrorAction stop | Out-Null + } + catch { + Log $_.Exception.Message + } + } + } + + # Retrieve capabilities from source OS and target OS + $SOURCE_CAPABILITIES = Get-Content -Path $CAP_PATH + $CAPABILITIES = Get-WindowsCapability -Online + + # Loop through source OS capabilities, and install if missing on target OS + ForEach ($SOURCE_ITEM in $SOURCE_CAPABILITIES) { + $INSTALLED = $false + ForEach ($ITEM in $CAPABILITIES) { + if ($ITEM.Name -eq $($SOURCE_ITEM)) { + if ($ITEM.State -eq "Installed") { + $INSTALLED = $true + break + } + } + } + + # Add if not already installed + if (!($INSTALLED)) { + Log "Adding capability $SOURCE_ITEM" + try { + Add-WindowsCapability -Online -Name $SOURCE_ITEM -Source $LOCAL_REPO_PATH -ErrorAction stop | Out-Null + } + catch { + Log $_.Exception.Message + } + } + else { + Log "Capability $SOURCE_ITEM is already installed" + } + } + + # Add LCU, this is required after adding FODs and languages + Log ("Adding LCU") + Add-WindowsPackage -Online -PackagePath $LCU_PATH -NoRestart + + # Get packages, we'll use this for debugging and to see if we need to restart to install + $PACKAGES = Get-WindowsPackage -Online + ForEach ($ITEM in $PACKAGES) { + Log "Package $($ITEM.PackageName) is $($ITEM.PackageState)" + if ($ITEM.PackageState -eq "InstallPending") { + $PENDING = $true + } + } + } +} + +# Remove local repository and state files +Remove-Item -Path $LANG_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $CAP_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $OSVERSION_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $LOCAL_REPO_PATH -Force -Recurse -ErrorAction ignore | Out-Null + +# Restarting the computer to let setup process to exit cleanly +if ($PENDING) { + Log ("Install pending packages exists, restarting in 10 seconds") + Start-Process -FilePath cmd -ArgumentList "/C shutdown /r /t 10 /f" +} + +Log ("Exiting") +``` \ No newline at end of file diff --git a/windows/deployment/update/plan-define-readiness.md b/windows/deployment/update/plan-define-readiness.md new file mode 100644 index 0000000000..2e371a0df1 --- /dev/null +++ b/windows/deployment/update/plan-define-readiness.md @@ -0,0 +1,113 @@ +--- +title: Define readiness criteria +manager: laurawi +description: Identify important roles and figure out how to classify apps +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Define readiness criteria + +## Figure out roles and personnel + +Planning and managing a deployment involves a variety of distinct activities and roles best suited to each. As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment. + +### Process manager + +The process manager leads the update deployment process and has the authority to push the process forward--or halt it if necessary. They also have responsibilities in organizing these activities: + + +|Compatibility workstream |Deployment |Capability and modernization | +|---------|---------|---------| +|[Assigning application priority](#set-criteria-for-rating-apps) | Reviewing infrastructure requirements | Determining infrastructure changes | +|Application assessment | Validating infrastructure against requirements | Determining configuration changes | +|Device assessment | Creating infrastructure update plan | Create capability proposal | + +It's the process manager's role to collect reports on remediation efforts, escalate failures, and to decide whether your environment is ready for pilot deployment and then broad deployment. + + +This table sketches out one view of the other roles, with their responsibilities, relevant skills, and the deployment phases where they are needed: + + +|Role |Responsibilities |Skills |Active phases | +|---------|---------|---------|---------| +|Process manager | Manages the process end to end; ensures inputs and outputs are captures; ensures that activities progress | IT Service Management | Plan, prepare, pilot deployment, broad deployment | +|Application owner | Define application test plan; assign user acceptance testers; certify the application | Knowledge of critical and important applications | Plan, prepare, pilot deployment | +|Application developer | Ensure apps are developed to stay compatible with current Windows versions | Application development; application remediation | Plan, prepare | +|End-user computing | Typically a group including infrastructure engineers or deployment engineers who ensure upgrade tools are compatible with Windows | Bare-metal deployment; infrastructure management; application delivery; update management | Plan, prepare, pilot deployment, broad deployment | +|Operations | Ensure that support is available for current Windows version. Provide post-deployment support, including user communication and rollbacks. | Platform security | Prepare, pilot deployment, broad deployment | +|Security | Review and approve the security baseline and tools | Platform security | Prepare, pilot deployment | +|Stakeholders | Represent groups affected by updates, for example, heads of finance, end-user services, or change management | Key decision maker for a business unit or department | Plan, pilot deployment, broad deployment | + + + + + + +## Set criteria for rating apps + +Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren’t critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This process will help you understand how best to deploy updates and how to resolve any issues that could arise. + +In the Prepare phase, you'll apply the criteria you define now to every app in your organization. + +Here's a suggested classification scheme: + + +|Classification |Definition| +|---------|---------| +|Critical | The most vital applications that handle core business activities and processes. If these applications were not available, the business, or a business unit, couldn't function at all. | +|Important | Applications that individual staff members need to support their productivity. Downtime here would affect individual users, but would only have a minimal impact on the business. | +|Not important | There is no impact on the business if these apps are not available for a while. | + +Once you have classified your applications, you should agree what each classification means to the organization in terms of priority and severity. This activity will help ensure that you can triage problems with the right level of urgency. You should assign each app a time-based priority. + +Here's an example priority rating system; the specifics could vary for your organization: + + +|Priority |Definition | +|---------|---------| +|1 | Any issues or risks identified must be investigated and resolved as soon as possible. | +|2 | Start investigating risks and issues within two business days and fix them *during* the current deployment cycle. | +|3 | Start investigating risks and issues within 10 business days. You don’t have to fix them all within the current deployment cycle. However, all issues must be fixed by the end of the next deployment cycle. | +|4 | Start investigating risks and issues within 20 business days. You can fix them in the current or any future development cycle. | + +Related to priority, but distinct, is the concept of severity. You should define a severity ranking as well, based on how you feel a problem with an app should affect the deployment cycle. + +Here's an example: + + +|Severity |Effect | +|---------|---------| +|1 | Work stoppage or loss of revenue | +|2 | Productivity loss for a business unit | +|3 | Productivity loss for individual users | +|4 | Minimal impact on users | + +## Example: a large financial corporation + +Using the suggested scheme, a financial corporation might classify their apps like this: + + +|App |Classification | +|---------|---------| +|Credit processing app | Critical | +|Frontline customer service app | Critical | +|PDF viewer | Important | +|Image-processing app | Not important | + +Further, they might combine this classification with severity and priority rankings like this: + + +|Classification |Severity |Priority |Response | +|---------|---------|---------|---------| +|Critical | 1 or 2 | 1 or 2 | For 1, stop deployment until resolved; for 2, stop deployment for affected devices or users only. | +|Important | 3 or 4 | 3 or 4 | For 3, continue deployment, even for affected devices, as long as there is workaround guidance. | +|Not important | 4 | 4 | Continue deployment for all devices. | + diff --git a/windows/deployment/update/plan-define-strategy.md b/windows/deployment/update/plan-define-strategy.md new file mode 100644 index 0000000000..fc033d13bd --- /dev/null +++ b/windows/deployment/update/plan-define-strategy.md @@ -0,0 +1,51 @@ +--- +title: Define update strategy +description: Two examples of a calendar-based approach to consistent update installation +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, tools +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Define update strategy with a calendar + +Traditionally, organizations treated the deployment of operating system updates (especially feature updates) as a discrete project that had a beginning, a middle, and an end. A release was "built" (usually in the form of an image) and then distributed to users and their devices. + +Today, more organizations are treating deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows 10 release cycles, update mechanisms, and relevant tools to support this model. Feature updates are released twice per year, around March and September. All releases of Windows 10 have 18 months of servicing for all editions. Fall releases of the Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. + +Though we encourage you to deploy every available release and maintain a fast cadence for some portion of your environment, we also recognize that you might have a large number of devices, and a need for little or no disruption, and so you might choose to update annually. The 18/30 month lifecycle cadence lets you allow some portion of your environment to move faster while a majority can move less quickly. + +## Calendar approaches +You can use a calendar approach for either a faster twice-per-year cadence or an annual cadence. Depending on company size, installing Windows 10 feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they will stop receiving the monthly security updates. + +### Annual +Here's a calendar showing an example schedule that applies one Windows 10 feature update per calendar year, aligned with Microsoft Endpoint Configuration Manager and Microsoft 365 Apps release cycles: + +[ ![Calendar showing an annual update cadence](images/annual-calendar.png) ](images/annual-calendar.png#lightbox) + +This approach provides approximately 12 months of use from each feature update before the next update is due to be installed. By aligning to the Windows 10, version H2 feature update, each release will be serviced for 30 months from the time of availability, giving you more flexibility when applying future feature updates. + +This cadence might be most suitable for you if any of these conditions apply: + +- You are just starting your journey with the Windows 10 servicing process. If you are unfamiliar with new processes that support Windows 10 servicing, moving from a project happening once every three to five years to a twice-a-year feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost. + +- You want to wait and see how successful other companies are at adopting a Windows 10 feature update. + +- You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows 10 serviced in case business priorities change. Aligning to the Windows 10 feature update released in the second half of each calendar year, you get additional servicing for Windows 10 (30 months of servicing compared to 18 months). + +### Rapid +This calendar shows an example schedule that installs each feature update as it is released, twice per year: + +[ ![Update calendar showing a faster update cadence](images/rapid-calendar.png) ](images/rapid-calendar.png#lightbox) + +This cadence might be best for you if these conditions apply: + +- You have a strong appetite for change. +- You want to continuously update supporting infrastructure and unlock new scenarios. +- Your organization has a large population of information workers that can use the latest features and functionality in Windows 10 and Office. +- You have experience with feature updates for Windows 10. diff --git a/windows/deployment/update/plan-determine-app-readiness.md b/windows/deployment/update/plan-determine-app-readiness.md new file mode 100644 index 0000000000..82ecea00a3 --- /dev/null +++ b/windows/deployment/update/plan-determine-app-readiness.md @@ -0,0 +1,75 @@ +--- +title: Determine application readiness +manager: laurawi +description: How to test your apps to know which need attention prior to deploying an update +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: m365initiative-coredeploy +ms.author: jaimeo +author: jaimeo +--- + +# Determine application readiness + +Before you deploy a Windows 10 update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps] with respect to their criticality in your organization. + +## Validation methods + +You can choose from a variety of methods to validate apps. Exactly which ones to use will depend on the specifics of your environment. + + +|Validation method |Description | +|---------|---------| +|Full regression | A full quality assurance probing. Staff who know the application well and can validate its core functionality should do this. | +|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they’re validating. | +|Automated testing | Software performs tests automatically. The software will let you know whether the tests have passed or failed, and will provide detailed reporting for you automatically. | +|Test in pilot | You pre-select users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. | +|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren’t handled by enterprise application distribution. | + +Combining the various validation methods with the app classifications you've previously established might look like this: + + +|Validation method |Critical apps |Important apps |Not important apps | +|---------|---------|---------|---------| +|Full regression | x | | | +|Smoke testing | | x | | +|Automated testing | x | x | x | +|Test in pilot | x | x | x | + + +### Identify users + +Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you'll have to choose which users are best suited for validation testing. Some factors to consider include: + +- **Location**: If users are in different physical locations, can you support them and get validation feedback from the region they're in? +- **Application knowledge**: Do the users have appropriate knowledge of how the app is supposed to work? +- **Technical ability**: Do the users have enough technical competence to provide useful feedback from various test scenarios? + +You could seek volunteers who enjoy working with new features and include them in the pilot deployment. You might want to avoid using core users like department heads or project managers. Current application owners, operations personnel, and developers can help you identify the most appropriate pilot users. + +### Identify and set up devices for validation + +In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection will include devices representing all of the hardware models in your environment. + +There is more than one way to choose devices for app validation: + +- **Existing pilot devices**: You might already have a list of devices that you regularly use for testing updates as part of release cycles. +- **Manual selection**: Some internal groups like operations will have expertise to help choose devices manually based on specifications, usage, or records of past support problems. +- **Data-driven analysis**: With appropriate tools, you can use diagnostic data from devices to inform your choices. + + +### Desktop Analytics + +Desktop Analytics can make all of the tasks discussed in this article significantly easier: + +- Creating and maintaining an application and device inventory +- Assign owners to applications for testing +- Automatically apply your app classifications (critical, important, not important) +- Automatically identify application compatibility risks and provide recommendations for reducing those risks + +For more information, see [What is Desktop Analytics?](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md new file mode 100644 index 0000000000..19c0a83aa5 --- /dev/null +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -0,0 +1,187 @@ +--- +title: Prepare to deploy Windows +description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Prepare to deploy Windows + +Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows 10. The planning phase will have left you with these useful items: + +- A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md) +- A plan for [testing and validating](plan-determine-app-readiness.md) apps +- An assessment of your [deployment infrastructure](eval-infra-tools.md) and definitions for operational readiness +- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use + +Now you're ready to actually start making changes in your environment to get ready to deploy. + +## Prepare infrastructure and environment + +- Deploy site server updates for Configuration Manager. +- Update non-Microsoft security tools like security agents or servers. +- Update non-Microsoft management tools like data loss prevention agents. + +Your infrastructure probably includes many different components and tools. You’ll need to ensure your environment isn’t affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps: + +1. Review all of the infrastructure changes that you’ve identified in your plan. It’s important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on. + +2. Validate your changes. You’ll validate the changes for your infrastructure’s components and tools, to help you understand how your changes could affect your production environment. + +3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure. + + +You should also look at your organization’s environment’s configuration and outline how you’ll implement any necessary changes previously identified in the plan phase to support the update. Consider what you’ll need to do for the various settings and policies that currently underpin the environment. For example: + +- Implement new draft security guidance. New versions of Windows can include new features that improve your environment’s security. Your security teams will want to make appropriate changes to security-related configurations. + +- Update security baselines. Security teams understand the relevant security baselines and will have to work to make sure all baselines fit into whatever guidance they have to adhere to. + +However, your configuration will consist of many different settings and policies. It’s important to only apply changes where they are necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that will slow down the update process. You want to ensure your environment isn’t affected adversely because of changes you make. For example: + +1. Review new security settings. Your security team will review the new security settings to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment. + +2. Review security baselines for changes. Security teams will also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant. + +3. Implement and validate security settings and baseline changes. Your security teams will then implement all of the security settings and baselines, having addressed any potential outstanding issues. + + +## Prepare applications and devices + +You've previously decided on which validation methods you want to use to validate apps in the upcoming pilot deployment phase. Now is a good time to make sure that individual devices are ready and able to install the next update without difficulty. + +### Ensure updates are available + +Enable update services on devices. Ensure that every device is running all the services Windows Update relies on. Sometimes users or even malware can disable the services Windows Update requires to work correctly. Make sure the following services are running: + +- Background Intelligent Transfer Service +- Background Tasks Infrastructure Service +- BranchCache (if you use this feature for update deployment) +- ConfigMgr Task Sequence Agent (if you use Configuration Manager to deploy updates) +- Cryptographic Services +- DCOM Server Process Launcher +- Device Install +- Delivery Optimization +- Device Setup Manager +- License Manager +- Microsoft Account Sign-in Assistant +- Microsoft Software Shadow Copy Provider +- Remote Procedure Call (RPC) +- Remote Procedure Call (RPC) Locator +- RPC Endpoint Mapper +- Service Control Manager +- Task Scheduler +- Token Broker +- Update Orchestrator Service +- Volume Shadow Copy Service +- Windows Automatic Update Service +- Windows Backup +- Windows Defender Firewall +- Windows Management Instrumentation +- Windows Management Service +- Windows Module Installer +- Windows Push Notification +- Windows Security Center Service +- Windows Time Service +- Windows Update +- Windows Update Medic Service + +You can check these services manually by using Services.msc, or by using PowerShell scripts, Desktop Analytics, or other methods. + +### Network configuration + +Ensure that devices can reach necessary Windows Update endpoints through the firewall. For example, for Windows 10, version 2004, the following protocols must be able to reach these respective endpoints: + + +|Protocol |Endpoint URL | +|---------|---------| +|TLS 1.2 | `*.prod.do.dsp.mp.microsoft.com` | +|HTTP | `emdl.ws.microsoft.com` | +|HTTP | `*.dl.delivery.mp.microsoft.com` | +|HTTP | `*.windowsupdate.com` | +|HTTPS | `*.delivery.mp.microsoft.com` | +|TLS 1.2 | `*.update.microsoft.com` | +|TLS 1.2 | `tsfe.trafficshaping.dsp.mp.microsoft.com` | + +> [!NOTE] +> Be sure not to use HTTPS for those endpoints that specify HTTP, and vice versa. The connection will fail. + +The specific endpoints can vary between Windows 10 versions. See, for example, [Windows 10 2004 Enterprise connection endpoints](https://docs.microsoft.com/windows/privacy/manage-windows-2004-endpoints). Similar articles for other Windows 10 versions are available in the table of contents nearby. + + +### Optimize download bandwidth +Set up [Delivery Optimization](waas-delivery-optimization.md) for peer network sharing or Microsoft Connected Cache. + +### Address unhealthy devices + +In the course of surveying your device population, either with Desktop Analytics or by some other means, you might find devices that have systemic problems that could interfere with update installation. Now is the time to fix those problems. + +- **Low disk space:** Quality updates require a minimum of 2 GB to successfully install. Feature updates require between 8 GB and 15 GB depending upon the configuration. On Windows 10, version 1903 and later you can proactively use the "reserved storage" feature (for wipe and loads, rebuilds, and new builds) to avoid running out of disk space. If you find a group of devices that don't have enough disk space, you can often resolve the problem by cleaning up log files and asking users to clean up data if necessary. A good place to start is to delete the following files: + + - C:\Windows\temp + - C:\Windows\cbstemp (though this file might be necessary to investigate update failures) + - C:\Windows\WindowsUpdate.log (though this file might be necessary to investigate update failures) + - C:\Windows.Old (these files should automatically clean up after 10 days or might ask the device user for permission to clean up sooner when constrained for disk space) + +You can also create and run scripts to perform additional cleanup actions on devices, with administrative rights, or use Group Policy settings. + +- Clean up the Windows Store Cache by running C:\Windows\sytem32\wsreset.exe. + +- Optimize the WinSxS folder on the client machine by using **Dism.exe /online /Cleanup-Image /StartComponentCleanup**. + +- Compact the operating system by running **Compact.exe /CompactOS:always**. + +- Remove Windows Features on Demand that the user doesn't need. See [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) for more guidance. + +- Move Windows Known Folders to OneDrive. See [Use Group Policy to control OneDrive sync settings](https://docs.microsoft.com/onedrive/use-group-policy) for more information. + +- Clean up the Software Distribution folder. Try deploying these commands as a batch file to run on devices to reset the download state of Windows Updates: + + ```console + net stop wuauserv + net stop cryptSvc + net stop bits + net stop msiserver + ren C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution.old + net start wuauserv + net start cryptSvc + net start bits + net start msiserver + ``` + +- **Application and driver updates:** Out-of-date app or driver software can prevent devices from updating successfully. Desktop Analytics will help you identify drivers and applications that need attention. You can also check for known issues in order to take any appropriate action. Deploy any updates from the vendor(s) for any problematic application or driver versions to resolve issues. + +- **Corruption:** In rare circumstances, a device that has repeated installation errors might be corrupted in a way that prevents the system from applying a new update. You might have to repair the Component-Based Store from another source. You can fix the problem with the [System File Checker](https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system). + + +## Prepare capability + +In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You'll need to complete these higher-level tasks to gain those new capabilities: + +- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions will come with new policies that you use to update ADMX templates. + +- Validate new changes to understand how they affect the wider environment. + +- Remediate any potential problems that have been identified through validation. + +## Prepare users + +Users often feel like they are forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning. + +You can employ a variety of measures to achieve this goal, for example: + +- Send overview email about the update and how it will be deployed to the entire organization. +- Send personalized emails to users about the update with specific details. +- Set an opt-out deadline for employees that need to remain on the current version for a bit longer, due to a business need. +- Provide the ability to voluntarily update at users’ convenience. +- Inform users of a mandatory installation date when the update will be installed on all devices. + + diff --git a/windows/deployment/update/safeguard-holds.md b/windows/deployment/update/safeguard-holds.md new file mode 100644 index 0000000000..003834c35c --- /dev/null +++ b/windows/deployment/update/safeguard-holds.md @@ -0,0 +1,44 @@ +--- +title: Safeguard holds +description: What are safeguard holds, how can you tell if one is in effect, and what to do about it +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +--- + +# Safeguard holds + +Microsoft uses quality and compatibility data to identify issues that might cause a Windows 10 feature update to fail or roll back. When we find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available. + +Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows 10. + +The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices. + +Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments. + + +## Am I affected by a safeguard hold? + +IT admins can use [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) to monitor various update health metrics for devices in their organization, including ones affected by a safeguard hold that prevents them from updating to a newer operating system version. + +Queries identify Safeguard IDs for each affected device, giving IT admins a detailed view into the various protections extended to devices. Safeguard IDs for publicly discussed known issues are also included in the [Windows release health](https://aka.ms/windowsreleasehealth) dashboard, where you can easily find information related to publicly available safeguards. + +On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message: + + +![Feature update message reading "The Windows 10 May 2020 Update is on its way. Once it's ready for your device, you'll see the update available on this page](images/safeguard-hold-notification.png) + +If you see this message, it means one or more holds affect your device. When the issue is fixed and the update is safe to install, we’ll release the hold and the update can resume safely. + +## What can I do? + +We recommend that you do not attempt to manually update until issues have been resolved and holds released. + +> [!CAUTION] +> Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out. + +With that in mind, IT admins who stay informed with [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) and the [Windows release health](https://aka.ms/windowsreleasehealth) dashboard can choose to temporarily [opt-out of the protection of all safeguard holds](safeguard-opt-out.md) and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, the protection of safeguard holds is reinstated automatically. diff --git a/windows/deployment/update/safeguard-opt-out.md b/windows/deployment/update/safeguard-opt-out.md new file mode 100644 index 0000000000..a6ad9a0b05 --- /dev/null +++ b/windows/deployment/update/safeguard-opt-out.md @@ -0,0 +1,32 @@ +--- +title: Opt out of safeguard holds +description: Steps to install an update even it if has a safeguard hold applied +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +--- + +# Opt out of safeguard holds + +Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows 10 feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see [Safeguard holds](safeguard-holds.md). + +## How can I opt out of safeguard holds? + +IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update. + +> [!CAUTION] +> Opting out of a safeguard hold can put devices at risk from known performance issues. + +We recommend opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows 10 feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business. + +Disabling safeguards does not guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you are bypassing the protection against known issues. + +> [!NOTE] +> After a device installs a new Windows 10 version, the **Disable safeguards for Feature Updates** Group Policy will revert to “not configured” even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. + + + diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 1f23ccbc44..e2b6404d14 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -1,56 +1,60 @@ ---- -title: Servicing stack updates (Windows 10) -description: Servicing stack updates improve the code that installs the other updates. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 11/29/2018 -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Servicing stack updates - - -**Applies to** - -- Windows 10, Windows 8.1, Windows 8, Windows 7 - -## What is a servicing stack update? -Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. - -## Why should servicing stack updates be installed and kept up to date? - -Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. - -## When are they released? - -Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical." - ->[!NOTE] ->You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). - -## What's the difference between a servicing stack update and a cumulative update? - -Both Windows 10 and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates. - -Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update. - - -## Is there any special guidance? - -Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update. - -Typically, the improvements are reliability and performance improvements that do not require any specific special guidance. If there is any significant impact, it will be present in the release notes. - -## Installation notes - -* Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system. -* Installing servicing stack update does not require restarting the device, so installation should not be disruptive. -* Servicing stack update releases are specific to the operating system version (build number), much like quality updates. -* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). +--- +title: Servicing stack updates (Windows 10) +description: In this article, learn how servicing stack updates improve the code that installs the other updates. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Servicing stack updates + + +**Applies to** + +- Windows 10, Windows 8.1, Windows 8, Windows 7 + +## What is a servicing stack update? +Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. + +## Why should servicing stack updates be installed and kept up to date? + +Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. + +For information about some changes to servicing stack updates, see [Simplifing Deployment of Servicing Stack Updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039) on the Windows IT Pro blog. + +## When are they released? + +Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical." + +>[!NOTE] +>You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). + +## What's the difference between a servicing stack update and a cumulative update? + +Both Windows 10 and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates. + +Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update. + + +## Is there any special guidance? + +Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update. + +Typically, the improvements are reliability and performance improvements that do not require any specific special guidance. If there is any significant impact, it will be present in the release notes. + +## Installation notes + +* Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system. +* Installing servicing stack update does not require restarting the device, so installation should not be disruptive. +* Servicing stack update releases are specific to the operating system version (build number), much like quality updates. +* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). +* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine. diff --git a/windows/deployment/update/update-baseline.md b/windows/deployment/update/update-baseline.md new file mode 100644 index 0000000000..4438c95e54 --- /dev/null +++ b/windows/deployment/update/update-baseline.md @@ -0,0 +1,47 @@ +--- +title: Update Baseline +description: Use an update baseline to optimize user experience and meet monthly update goals +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, tools, group policy +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +--- + +# Update Baseline + +**Applies to:** Windows 10 + +With the large number of different policies offered for Windows 10, Update Baseline provides a clear list of recommended Windows Update policy settings for IT administrators who want the best user experience while also meeting their monthly update compliance goals. See [Policies included in the Update Baseline](#policies-included-in-the-update-baseline) for the full list of policy configurations. + +## Why is Update Baseline needed? + +Update Baseline is an industry-tested solution that improves update adoption rates while also maintaining a high-quality user experience. Whether you are just starting out, or you have been configuring policies for years, Update Baseline can help get you to a known good state with an excellent user experience. Applying the baseline is especially helpful for organizations that have many years of policy configurations to clear out lingering misconfigurations. + +## You can use Update Baseline to: + +- Ensure that user and device configuration settings are compliant with the baseline. +- Set configuration settings. You can use Group Policy to configure a device with the setting values specified in the baseline. + +Update Baseline doesn't affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices and when. + +## Policies included in the Update Baseline + +The Update Baseline configures settings in these Group Policy areas: + +- System/Power Management +- Windows Components/Delivery Optimization +- Windows Components/Windows Update + +For the complete detailed list of all settings and their values, see the MSFT Windows Update.htm file in the [Update Baseline toolkit](https://www.microsoft.com/download/details.aspx?id=101056) at the Download Center + +## How do I get started? + +The Update Baseline toolkit makes it easy by providing a single command for IT Admins to load the baseline settings into Group Policy Management Console. You can get the [Update Baseline toolkit](https://www.microsoft.com/download/details.aspx?id=101056) from the Download Center. + +Today, the Update Baseline toolkit is currently only available for use with Group Policy. + + diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md new file mode 100644 index 0000000000..b96d2edfd6 --- /dev/null +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -0,0 +1,92 @@ +--- +title: Manually configuring devices for Update Compliance +ms.reviewer: +manager: laurawi +description: Manually configuring devices for Update Compliance +keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.localizationpriority: medium +ms.collection: M365-analytics +ms.topic: article +--- + +# Manually Configuring Devices for Update Compliance + +There are a number of requirements to consider when manually configuring devices for Update Compliance. These can potentially change with newer versions of Windows 10. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) will be updated when any configuration requirements change so only a redeployment of the script will be required. + +The requirements are separated into different categories: + +1. Ensuring the [**required policies**](#required-policies) for Update Compliance are correctly configured. +2. Devices in every network topography must send data to the [**required endpoints**](#required-endpoints) for Update Compliance. For example, devices in both main and satellite offices, which might have different network configurations must be able to reach the endpoints. +3. Ensure [**Required Windows services**](#required-services) are running or are scheduled to run. It is recommended all Microsoft and Windows services are set to their out-of-box defaults to ensure proper functionality. +4. [**Run a full Census sync**](#run-a-full-census-sync) on new devices to ensure that all necessary data points are collected. + +## Required policies + +> [!NOTE] +> Windows 10 MDM and Group Policies are backed by registry keys. It is not recommended you set these registry keys directly for configuration as it can lead to unexpected behavior, so the exact registry key locations are not provided, though they are referenced for troubleshooting configuration issues with the [Update Compliance Configuration Script](update-compliance-configuration-script.md). + +Update Compliance has a number of policies that must be appropriately configured in order for devices to be processed by Microsoft and visible in Update Compliance. They are enumerated below, separated by whether the policies will be configured via [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) or Group Policy. For both tables: + +- **Policy** corresponds to the location and name of the policy. +- **Value** Indicates what value the policy must be set to. Update Compliance requires *at least* Basic (or Required) diagnostic data, but can function off Enhanced or Full (or Optional). +- **Function** details why the policy is required and what function it serves for Update Compliance. It will also detail a minimum version the policy is required, if any. + +### Mobile Device Management policies + +Each MDM Policy links to its documentation in the CSP hierarchy, providing its exact location in the hierarchy and more details. + +| Policy | Value | Function | +|---------------------------|-|------------------------------------------------------------| +|**Provider/*ProviderID*/**[**CommercialID**](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp#provider-providerid-commercialid) |[Your CommercialID](update-compliance-get-started.md#get-your-commercialid) |Identifies the device as belonging to your organization. | +|**System/**[**AllowTelemetry**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | 1- Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the following policy. | +|**System/**[**ConfigureTelemetryOptInSettingsUx**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) | 1 - Disable Telemetry opt-in Settings | (in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy or the effective diagnostic data level on devices might not be sufficient. | +|**System/**[**AllowDeviceNameInDiagnosticData**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) | 1 - Allowed | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or set to 0 (Disabled), Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | + +> [!NOTE] +> If you use Microsoft Intune, set the **ProviderID** to *MS DM Server*. If you use another MDM product, check with its vendor. See also [DMClient CSP](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp). + +### Group Policies + +All Group Policies that need to be configured for Update Compliance are under **Computer Configuration>Administrative Templates>Windows Components\Data Collection and Preview Builds**. All of these policies must be in the *Enabled* state and set to the defined *Value* below. + +| Policy | Value | Function | +|---------------------------|-|-----------------------------------------------------------| +|**Configure the Commercial ID** |[Your CommercialID](update-compliance-get-started.md#get-your-commercialid) | Identifies the device as belonging to your organization. | +|**Allow Telemetry** | 1 - Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. See the following policy for more information. | +|**Configure telemetry opt-in setting user interface** | 1 - Disable diagnostic data opt-in Settings |(in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy, otherwise the effective diagnostic data level on devices might not be sufficient. | +|**Allow device name to be sent in Windows diagnostic data** | 1 - Enabled | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or Disabled, Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | + +## Required endpoints + +To enable data sharing between devices, your network, and Microsoft's Diagnostic Data Service, configure your proxy to allow devices to contact the below endpoints. + +| **Endpoint** | **Function** | +|---------------------------------------------------------|-----------| +| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. Census.exe must run on a regular cadence and contact this endpoint in order to receive the majority of [WaaSUpdateStatus](update-compliance-schema-waasupdatestatus.md) information for Update Compliance. | +| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | +| `https://settings-win.data.microsoft.com` | Required for Windows Update functionality. | +| `http://adl.windows.com` | Required for Windows Update functionality. | +| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER), used to provide more advanced error reporting if certain Feature Update deployment failures occur. | +| `https://oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors in the event of certain crashes. | +| `https://login.live.com` | This endpoint facilitates MSA access and is required to create the primary identifier we use for devices. Without this service, devices will not be visible in the solution. The Microsoft Account Sign-in Assistant service must also be running (wlidsvc). | + +## Required services + +Many Windows and Microsoft services are required to ensure that not only the device can function, but Update Compliance can see device data. It is recommended that you allow all default services from the out-of-box experience to remain running. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) checks whether the majority of these services are running or are allowed to run automatically. + + +## Run a full Census sync + +Census is a service that runs on a regular schedule on Windows devices. A number of key device attributes, like what operating system edition is installed on the device, are included in the Census payload. However, to save network load and system resources, data that tends to be more static (like edition) is sent approximately once per week rather than on every daily run. Because of this behavior, these attributes can take longer to appear in Update Compliance unless you start a full Census sync. The Update Compliance Configuration Script will do a full sync. + +A full Census sync adds a new registry value to Census's path. When this registry value is added, Census's configuration is overridden to force a full sync. For Census to work normally, this registry value should be enabled, Census should be started manually, and then the registry value should be disabled. Follow these steps: + +1. For every device you are manually configuring for Update Compliance, add or modify the registry key located at **HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Census** to include a new **DWORD value** named **FullSync** and set to **1**. +2. Run Devicecensus.exe with administrator privileges on every device. Devicecensus.exe is in the System32 folder. No additional run parameters are required. +3. After Devicecensus.exe has run, the **FullSync** registry value can be removed or set to **0**. diff --git a/windows/deployment/update/update-compliance-configuration-script.md b/windows/deployment/update/update-compliance-configuration-script.md new file mode 100644 index 0000000000..f5f19921c9 --- /dev/null +++ b/windows/deployment/update/update-compliance-configuration-script.md @@ -0,0 +1,107 @@ +--- +title: Update Compliance Configuration Script +ms.reviewer: +manager: laurawi +description: Downloading and using the Update Compliance Configuration Script +keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.localizationpriority: medium +ms.collection: M365-analytics +ms.topic: article +--- + +# Configuring devices through the Update Compliance Configuration Script + +The Update Compliance Configuration Script is the recommended method of configuring devices to send data to Microsoft for use with Update Compliance. The script configures device policies via Group Policy, ensures that required services are running, and more. + +> [!NOTE] +> The Update Compliance configuration script does not offer options to configure Delivery Optimization. You have to do that separately. + + +You can download the script from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=101086). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting. + +## How the script is organized + +The script is organized into two folders **Pilot** and **Deployment**. Both folders have the same key files: `ConfigScript.ps1` and `RunConfig.bat`. You configure `RunConfig.bat` according to the directions in the .bat itself, which will then execute `ConfigScript.ps1` with the parameters entered to RunConfig.bat. + +- The **Pilot** folder and its contents are intended to be used on an initial set of single devices in specific environments (main office & satellite office, for example) for testing and troubleshooting prior to broader deployment. This script is configured to collect and output detailed logs for every device it runs on. +- The **Deployment** folder is intended to be deployed across an entire device population in a specific environment once devices in that environment have been validated with the Pilot script. + +## How to use the script + +### Piloting and Troubleshooting + +> [!IMPORTANT] +> If you encounter an issue with Update Compliance, the first step should be to run the script in Pilot mode on a device you are encountering issues with, and save these Logs for reference with Support. + +> [!IMPORTANT] +> The script must be run in the System context. To do this, use the PsExec tool included in the file. For more about PsExec, see [PsExec](https://docs.microsoft.com/sysinternals/downloads/psexec). + + +When using the script in the context of troubleshooting, use `Pilot`. Enter `RunConfig.bat`, and configure it as follows: + +1. Configure `logPath` to a path where the script will have write access and a place you can easily access. This specifies the output of the log files generated when the script is in Verbose mode. +2. Configure `commercialIDValue` to your CommercialID. To get your CommercialID, see [Getting your CommercialID](update-compliance-get-started.md#get-your-commercialid). +3. Run the script. The script must be run in System context. +4. Examine the Logs output for any issues. If there were issues: + - Compare Logs output with the required settings covered in [Manually Configuring Devices for Update Compliance](update-compliance-configuration-manual.md). + - Examine the script errors and refer to the [script error reference](#script-error-reference) on how to interpret the codes. + - Make the necessary corrections and run the script again. +5. When you no longer have issues, proceed to using the script for more broad deployment with the `Deployment` folder. + + +### Broad deployment + +After verifying on a set of devices in a specific environment that everything is configured correctly, you can proceed to broad deployment. + +1. Configure `commercialIDValue` in `RunConfig.bat` to [your CommercialID](update-compliance-get-started.md#get-your-commercialid). +2. Use a management tool like Configuration Manager or Intune to broadly deploy the script to your entire target population. + +## Script Error Reference + +|Error |Description | +|-|-------------------| +| 27 | Not system account. | +| 37 | Unexpected exception when collecting logs| +| 1 | General unexpected error| +| 6 | Invalid CommercialID| +| 48 | CommercialID is not a GUID| +| 8 | Couldn't create registry key path to setup CommercialID| +| 9 | Couldn't write CommercialID at registry key path| +| 53 | There are conflicting CommercialID values.| +| 11 | Unexpected result when setting up CommercialID.| +| 62 | AllowTelemetry registry key is not of the correct type `REG_DWORD`| +| 63 | AllowTelemetry is not set to the appropriate value and it could not be set by the script.| +| 64 | AllowTelemetry is not of the correct type `REG_DWORD`.| +| 99 | Device is not Windows 10.| +| 40 | Unexpected exception when checking and setting telemetry.| +| 12 | CheckVortexConnectivity failed, check Log output for more information.| +| 12 | Unexpected failure when running CheckVortexConnectivity.| +| 66 | Failed to verify UTC connectivity and recent uploads.| +| 67 | Unexpected failure when verifying UTC CSP connectivity of the WMI Bridge.| +| 41 | Unable to impersonate logged-on user.| +| 42 | Unexpected exception when attempting to impersonate logged-on user.| +| 43 | Unexpected exception when attempting to impersonate logged-on user.| +| 16 | Reboot is pending on device, restart device and restart script.| +| 17 | Unexpected exception in CheckRebootRequired.| +| 44 | Error when running CheckDiagTrack service.| +| 45 | DiagTrack.dll not found.| +| 50 | DiagTrack service not running.| +| 54 | Microsoft Account Sign In Assistant (MSA) Service disabled.| +| 55 | Failed to create new registry path for `SetDeviceNameOptIn` of the PowerShell script.| +| 56 | Failed to create property for `SetDeviceNameOptIn` of the PowerShell script at registry path.| +| 57 | Failed to update value for `SetDeviceNameOptIn` of the PowerShell script.| +| 58 | Unexpected exception in `SetDeviceNameOptIn` of the PowerShell script.| +| 59 | Failed to delete `LastPersistedEventTimeOrFirstBoot` property at registry path when attempting to clean up OneSettings.| +| 60 | Failed to delete registry key when attempting to clean up OneSettings.| +| 61 | Unexpected exception when attempting to clean up OneSettings.| +| 52 | Could not find Census.exe| +| 51 | Unexpected exception when attempting to run Census.exe| +| 34 | Unexpected exception when attempting to check Proxy settings.| +| 30 | Unable to disable Enterprise Auth Proxy. This registry value must be 0 for UTC to operate in an authenticated proxy environment.| +| 35 | Unexpected exception when checking User Proxy.| diff --git a/windows/deployment/update/update-compliance-delivery-optimization.md b/windows/deployment/update/update-compliance-delivery-optimization.md index a637aea0a8..b56a569d4c 100644 --- a/windows/deployment/update/update-compliance-delivery-optimization.md +++ b/windows/deployment/update/update-compliance-delivery-optimization.md @@ -2,10 +2,9 @@ title: Delivery Optimization in Update Compliance (Windows 10) ms.reviewer: manager: laurawi -description: new Delivery Optimization data displayed in Update Compliance +description: Learn how the Update Compliance solution provides you with information about your Delivery Optimization configuration. ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy audience: itpro author: jaimeo @@ -14,17 +13,12 @@ keywords: oms, operations management suite, optimization, downloads, updates, lo ms.localizationpriority: medium ms.collection: M365-analytics ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Delivery Optimization in Update Compliance -The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days. - ![DO status](images/UC_workspace_DO_status.png) - -> [!IMPORTANT] -> There is a known issue with the way device configuration is displayed for Delivery Optimization. Some devices running Windows 10, versions 1809 or 1903 report the Delivery Optimization DownloadMode configuration value as the sequential value in the list of possible configurations rather than the actual configured value. For example, a device that is configured as HTTP + Group (2), will be shown as HTTP + Internet (3) in Update Compliance. -> ->**This issue is now fixed by installing the 2019-07 cumulative update appropriate for the device.** +The Update Compliance solution provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days. ## Delivery Optimization Status @@ -34,11 +28,9 @@ The Delivery Optimization Status section includes three blades: - The **Content Distribution (%)** blade shows the percentage of bandwidth savings for each category - The **Content Distribution (GB)** blade shows the total amount of data seen from each content type broken down by the download source (peers vs non-peers). - - ## Device Configuration blade -Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md) for recommendations for different scenarios or [Delivery Optimization reference](waas-delivery-optimization-reference.md#download-mode) for complete details of this setting. +Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md). ## Content Distribution (%) blade The first of two blades showing information on content breakdown, this blade shows a ring chart summarizing **Bandwidth Savings %**, which is the percentage of data received from peer sources out of the total data downloaded (for any device that used peer-to-peer distribution). @@ -50,6 +42,5 @@ The table breaks down the number of bytes from each download source into specifi The download sources that could be included are: - LAN Bytes: Bytes downloaded from LAN Peers which are other devices on the same local network -- Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the “Group” download mode is used) +- Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the "Group" download mode is used) - HTTP Bytes: Non-peer bytes. The HTTP download source can be Microsoft Servers, Windows Update Servers, a WSUS server or an SCCM Distribution Point for Express Updates. - diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md index 8d6fa2501e..12924ab50f 100644 --- a/windows/deployment/update/update-compliance-feature-update-status.md +++ b/windows/deployment/update/update-compliance-feature-update-status.md @@ -1,49 +1,53 @@ ---- -title: Update Compliance - Feature Update Status report -ms.reviewer: -manager: laurawi -description: an overview of the Feature Update Status report -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-analytics -ms.topic: article ---- - -# Feature Update Status - -![The Feature Update Status report](images/UC_workspace_FU_status.png) - -The Feature Update Status section provides information about the status of [feature updates](waas-quick-start.md#definitions) across all devices. This section tile in the [Overview Blade](update-compliance-using.md#overview-blade) gives a percentage of devices that are on the latest applicable feature update; [Servicing Channel](waas-overview.md#servicing-channels) is considered in determining applicability. Within this section are two blades; one providing a holistic view of feature updates, the other containing three **Deployment Status** tiles, each charged with tracking the deployment for a different [Servicing Channel](waas-overview.md#servicing-channels). - -## Overall Feature Update Status - -The Overall Feature Update Status blade breaks down how many devices are up-to-date or not, with a special callout for how many devices are running a build that is not supported (for a full list of feature updates, check out the [Windows 10 Release Information](https://technet.microsoft.com/windows/release-info.aspx) page). The table beneath the visualization breaks devices down by Servicing Channel and operating system version, then defining whether this combination is *up-to-date*, *not up-to-date* or *out of support*. Finally, the table provides a count of devices that fall into this category. - -## Deployment Status by Servicing Channel - -To effectively track deployment, **Deployment Status Blades** are divided into each Servicing Channel chosen for the device. This is because Deployment for each channel will happen at different periods in time and feature updates are targeted separately for each channel. Within each Deployment Status tile, devices are aggregated on their feature update distribution, and the columns list the states each device is in. - -Refer to the following list for what each state means: -* **Installed** devices are devices that have completed installation for the given update. -* When a device is counted as **In Progress**, it has begun the feature update installation. -* Devices that are **scheduled next 7 days** are all devices that were deferred from installing the Feature update using [Windows Update for Business Settings](waas-manage-updates-wufb.md) and are set to begin installation in the next 7 days. -* Devices that have failed the given feature update installation are counted as **Update failed**. -* If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. Devices not using Windows Update are the most likely devices to fall into this category. - -## Compatibility holds - -Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *compatibility hold* is generated to delay the device’s upgrade and safeguard the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all compatibility holds on the Windows 10 release information page for any given release. - -To learn how compatibility holds are reflected in the experience, see [Update compliance perspectives](update-compliance-perspectives.md#deployment-status). - -### Opting out of compatibility hold - -Microsoft will release a device from a compatibility hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired. To opt out, set the registry key **HKLM\Software\Microsoft\Windows NT\CurrentVersion\502505fe-762c-4e80-911e-0c3fa4c63fb0** to a name of **DataRequireGatedScanForFeatureUpdates** and a value of **0**. - - -Setting this registry key to **0** will force the device to opt out from *all* compatibility holds. Any other value, or deleting the key, will resume compatibility protection on the device. - +--- +title: Update Compliance - Feature Update Status report +ms.reviewer: +manager: laurawi +description: Learn how the Feature Update Status report provides information about the status of feature updates across all devices. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Feature Update Status + +[ ![The Feature Update Status report](images/UC_workspace_FU_status.png) ](images/UC_workspace_FU_status.png#lightbox) + +The Feature Update Status section provides information about the status of [feature updates](waas-quick-start.md#definitions) across all devices. This section tile in the [Overview Blade](update-compliance-using.md#overview-blade) gives a percentage of devices that are on the latest applicable feature update; [Servicing Channel](waas-overview.md#servicing-channels) is considered in determining applicability. Within this section are two blades; one providing a holistic view of feature updates, the other containing three **Deployment Status** tiles, each charged with tracking the deployment for a different [Servicing Channel](waas-overview.md#servicing-channels). + +## Overall Feature Update Status + +The Overall Feature Update Status blade breaks down how many devices are up-to-date or not, with a special callout for how many devices are running a build that is not supported (for a full list of feature updates, check out the [Windows 10 Release Information](https://technet.microsoft.com/windows/release-info.aspx) page). The table beneath the visualization breaks devices down by Servicing Channel and operating system version, then defining whether this combination is *up-to-date*, *not up-to-date* or *out of support*. Finally, the table provides a count of devices that fall into this category. + +## Deployment Status by Servicing Channel + +To effectively track deployment, **Deployment Status Blades** are divided into each Servicing Channel chosen for the device. This is because Deployment for each channel will happen at different periods in time and feature updates are targeted separately for each channel. Within each Deployment Status tile, devices are aggregated on their feature update distribution, and the columns list the states each device is in. + +Refer to the following list for what each state means: +* **Installed** devices are devices that have completed installation for the given update. +* When a device is counted as **In Progress**, it has begun the feature update installation. +* Devices that are **scheduled next 7 days** are all devices that were deferred from installing the Feature update using [Windows Update for Business Settings](waas-manage-updates-wufb.md) and are set to begin installation in the next 7 days. +* Devices that have failed the given feature update installation are counted as **Update failed**. +* If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. Devices not using Windows Update are the most likely devices to fall into this category. + +## Safeguard holds + +Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows 10 release information page for any given release. + +## Queries for safeguard holds + +Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build. + +![Left pane showing Need Attention, Security update status, feature update status, and Windows Defender AV status, with Need Attention selected. Right pane shows the list of queries relevant to the Need Attention status, with "Devices with a safeguard hold" and "Target build distribution of devices with a safeguard hold" queries highlighted](images/UC_workspace_safeguard_queries.png) + +Update Compliance reporting will display the Safeguard IDs for known issues affecting a device in the **DeploymentErrorCode** column. Safeguard IDs for publicly discussed known issues are also included in the Windows Release Health dashboard, where you can easily find information related to publicly available safeguards. + +### Opt out of safeguard hold + +You can [opt out of safeguard protections](safeguard-opt-out.md) by using the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update. diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 8a005eb69d..4e77a4d513 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -1,75 +1,83 @@ ---- -title: Get started with Update Compliance (Windows 10) -ms.reviewer: -manager: laurawi -description: Configure Update Compliance in Azure Portal to see the status of updates and antimalware protection on devices in your network. -keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Get started with Update Compliance -This topic explains the steps necessary to configure your environment for Windows Analytics: Update Compliance. - -Steps are provided in sections that follow the recommended setup process: - -1. Ensure you meet the [Update Compliance prerequisites](#update-compliance-prerequisites). -2. [Add Update Compliance to your Azure subscription](#add-update-compliance-to-your-azure-subscription). -3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics). -4. [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates, Windows Defender Antivirus status, and Delivery Optimization. - -## Update Compliance prerequisites -Before you begin the process to add Update Compliance to your Azure subscription, first ensure you can meet the prerequisites: -1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc. -2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them. -3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device. -4. To show device names for versions of Windows 10 starting with 1803 in Windows Analytics you must opt in. For details about this, see the "AllowDeviceNameinTelemetry (in Windows 10)" entry in the table in the [Distributing policies at scale](windows-analytics-get-started.md#deploying-windows-analytics-at-scale) section of [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). -5. To use the Windows Defender Status, devices must be E3-licensed and have Cloud Protection enabled. E5-licensed devices will not appear here. For E5 devices, you should use [Windows Defender ATP](https://docs.microsoft.com/sccm/protect/deploy-use/windows-defender-advanced-threat-protection) instead. For more information on Windows 10 Enterprise licensing, see [Windows 10 Enterprise: FAQ for IT Professionals](https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro). - -## Add Update Compliance to your Azure subscription -Update Compliance is offered as a solution which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps: - -1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. - -> [!NOTE] -> Update Compliance is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Update Compliance, but no Azure charges are expected to accrue to the subscription as a result of using Update Compliance. - -2. In the Azure portal select **+ Create a resource**, and search for “Update Compliance". You should see it in the results below. - -![Update Compliance marketplace search results](images/UC_00_marketplace_search.png) - -3. Select **Update Compliance** and a blade will appear summarizing the solution’s offerings. At the bottom, select **Create** to begin adding the solution to Azure. - -![Update Compliance solution creation](images/UC_01_marketplace_create.png) - -4. Choose an existing workspace or create a new workspace that will be assigned to the Update Compliance solution. - - If you already have another Windows Analytics solution, you should use the same workspace. - - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: - - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. - - For the resource group setting select **Create new** and use the same name you chose for your new workspace. - - For the location setting, choose the Azure region where you would prefer the data to be stored. - - For the pricing tier select **per GB**. - -![Update Compliance workspace creation](images/UC_02_workspace_create.png) - -5. The resource group and workspace creation process could take a few minutes. After this, you are able to use that workspace for Update Compliance. Select **Create**. - -![Update Compliance workspace selection](images/UC_03_workspace_select.png) - -6. Watch for a notification in the Azure portal that your deployment has been successful. This might take a few minutes. Then, select **Go to resource**. - -![Update Compliance deployment successful](images/UC_04_resourcegrp_deployment_successful.png) - -## Enroll devices in Windows Analytics -Once you've added Update Compliance to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Update Compliance there are two key steps for enrollment: -1. Deploy your Commercial ID (from the Update Compliance Settings page) to your Windows 10 devices (typically by using Group Policy, [Mobile Device Management](https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm), [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) or similar). -2. Ensure the Windows Diagnostic Data setting on devices is set to at least Basic (typically using Group Policy or similar). For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - -After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices. +--- +title: Get started with Update Compliance +ms.reviewer: +manager: laurawi +description: Prerequisites, Azure onboarding, and configuring devices for Update Compliance +keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.localizationpriority: medium +ms.collection: M365-analytics +ms.topic: article +--- + +# Get started with Update Compliance + +This topic introduces the high-level steps required to enroll to the Update Compliance solution and configure devices to send data to it. The following steps cover the enrollment and device configuration workflow. + +1. Ensure you can [meet the requirements](#update-compliance-prerequisites) to use Update Compliance. +2. [Add Update Compliance](#add-update-compliance-to-your-azure-subscription) to your Azure subscription. +3. [Configure devices](#enroll-devices-in-update-compliance) to send data to Update Compliance. + +After adding the solution to Azure and configuring devices, there will be a waiting period of up to 72 hours before you can begin to see devices in the solution. Before or as devices appear, you can learn how to [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates and Delivery Optimization. + +## Update Compliance prerequisites + +Before you begin the process to add Update Compliance to your Azure subscription, first ensure you can meet the prerequisites: + +1. **Compatible Operating Systems and Editions**: Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance supports both the typical Windows 10 Enterprise edition, as well as [Windows 10 Enterprise multi-session](https://docs.microsoft.com/azure/virtual-desktop/windows-10-multisession-faq). Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc. +2. **Compatible Windows 10 Servicing Channels**: Update Compliance supports Windows 10 devices on the Semi-Annual Channel (SAC) and the Long-term Servicing Channel (LTSC). Update Compliance *counts* Windows Insider Preview (WIP) devices, but does not currently provide detailed deployment insights for them. +3. **Diagnostic data requirements**: Update Compliance requires devices be configured to send diagnostic data at *Required* level (previously *Basic*). To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy). +4. **Data transmission requirements**: Devices must be able to contact specific endpoints required to authenticate and send diagnostic data. These are enumerated in detail at [Configuring Devices for Update Compliance manually](update-compliance-configuration-manual.md). +5. **Showing Device Names in Update Compliance**: For Windows 10 1803+, device names will not appear in Update Compliance unless you individually opt-in devices via policy. The steps to accomplish this is outlined in [Configuring Devices for Update Compliance](update-compliance-configuration-manual.md). + +## Add Update Compliance to your Azure subscription + +Update Compliance is offered as an Azure Marketplace application which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps: + +1. Go to the [Update Compliance page in the Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/Microsoft.WaaSUpdateInsights?tab=Overview). You may need to login to your Azure subscription to access this. +2. Select **Get it now**. +3. Choose an existing or configure a new Log Analytics Workspace. While an Azure subscription is required, you will not be charged for ingestion of Update Compliance data. + - [Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/overview) customers are advised to use the same workspace for Update Compliance. + - [Azure Update Management](https://docs.microsoft.com/azure/automation/automation-update-management) customers are advised to use the same workspace for Update Compliance. +4. After your workspace is configured and selected, select **Create**. You will receive a notification when the solution has been successfully created. + +> [!NOTE] +> It is not currently supported to programmatically enroll to Update Compliance via the [Azure CLI](https://docs.microsoft.com/cli/azure) or otherwise. You must manually add Update Compliance to your Azure subscription. + +### Get your CommercialID + +A CommercialID is a globally-unique identifier assigned to a specific Log Analytics workspace. The CommercialID is copied to an MDM or Group Policy and is used to identify devices in your environment. + +To find your CommercialID within Azure: + +1. Navigate to the **Solutions** tab for your workspace, and then select the **WaaSUpdateInsights** solution. +2. From there, select the Update Compliance Settings page on the navbar. +3. Your CommercialID is available in the settings page. + +> [!IMPORTANT] +> Regenerate your CommercialID only if your original ID can no longer be used or if you want to completely reset your workspace. Regenerating your CommercialID cannot be undone and will result in you losing data for all devices that have the current CommercialID until the new CommercialID is deployed to devices. + +## Enroll devices in Update Compliance + +Once you've added Update Compliance to a workspace in your Azure subscription, you'll need to configure any devices you want to monitor. There are two ways to configure devices to use Update Compliance. + +> [!NOTE] +> After configuring devices via one of the two methods below, it can take up to 72 hours before devices are visible in the solution. Until then, Update Compliance will indicate it is still assessing devices. + +### Configure devices using the Update Compliance Configuration Script + +The recommended way to configure devices to send data to Update Compliance is using the [Update Compliance Configuration Script](update-compliance-configuration-script.md). The script configures required policies via Group Policy. The script comes with two versions: + +- Pilot is more verbose and is intended to be use on an initial set of devices and for troubleshooting. +- Deployment is intended to be deployed across the entire device population you want to monitor with Update Compliance. + +To download the script and learn what you need to configure and how to troubleshoot errors, see [Configuring Devices using the Update Compliance Configuration Script](update-compliance-configuration-script.md). + +### Configure devices manually + +It is possible to manually configure devices to send data to Update Compliance, but the recommended method of configuration is to use the [Update Compliance Configuration Script](update-compliance-configuration-script.md). To learn more about configuring devices manually, see [Manually Configuring Devices for Update Compliance](update-compliance-configuration-manual.md). diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 1ece514b2e..14008cd234 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -1,57 +1,42 @@ ---- -title: Monitor Windows Updates and Windows Defender AV with Update Compliance (Windows 10) -ms.reviewer: -manager: laurawi -description: You can use Update Compliance in Azure Portal to monitor the progress of updates and key antimalware protection features on devices in your network. -keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Monitor Windows Updates with Update Compliance - -## Introduction - -Update Compliance is a [Windows Analytics solution](windows-analytics-overview.md) that enables organizations to: - -* Monitor Windows 10 Professional, Education, and Enterprise security, quality, and feature updates. -* View a report of device and update issues related to compliance that need attention. -* See the status of Windows Defender Antivirus signatures and threats. -* Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](waas-delivery-optimization.md). - -Update Compliance is offered through the Azure portal, and is available free for devices that meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). - -Update Compliance uses Windows 10 and Windows Defender Antivirus diagnostic data for all of its reporting. It collects system data including update deployment progress, [Windows Update for Business](waas-manage-updates-wufb.md) configuration data, Windows Defender Antivirus data, and Delivery Optimization usage data, and then sends this data to a secure cloud to be stored for analysis and usage in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal). - -See the following topics in this guide for detailed information about configuring and using the Update Compliance solution: - -- [Get started with Update Compliance](update-compliance-get-started.md): How to add Update Compliance to your environment. -- [Using Update Compliance](update-compliance-using.md): How to begin using Update Compliance. - -## Update Compliance architecture - -The Update Compliance architecture and data flow is summarized by the following four-step process: - -1. User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
              -2. Diagnostic data is analyzed by the Update Compliance Data Service.
              -3. Diagnostic data is pushed from the Update Compliance Data Service to your Azure Monitor workspace.
              -4. Diagnostic data is available in the Update Compliance solution.
              - - ->[!NOTE] ->This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - - - -  -## Related topics - -[Get started with Update Compliance](update-compliance-get-started.md)
              -[Use Update Compliance to monitor Windows Updates](update-compliance-using.md) +--- +title: Monitor Windows Updates and Microsoft Defender AV with Update Compliance (Windows 10) +ms.reviewer: +manager: laurawi +description: You can use Update Compliance in Azure Portal to monitor the progress of updates and key antimalware protection features on devices in your network. +keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.localizationpriority: medium +ms.collection: M365-analytics +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Monitor Windows Updates with Update Compliance + +## Introduction + +Update Compliance enables organizations to: + +* Monitor security, quality, and feature updates for Windows 10 Professional, Education, and Enterprise editions. +* View a report of device and update issues related to compliance that need attention. +* Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](waas-delivery-optimization.md). + +Update Compliance is offered through the Azure portal, and is included as part of Windows 10 licenses listed in the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). Azure Log Analytics ingestion and retention charges are not incurred on your Azure subscription for Update Compliance data. + +Update Compliance uses Windows 10 diagnostic data for all of its reporting. It collects system data including update deployment progress, [Windows Update for Business](waas-manage-updates-wufb.md) configuration data, and Delivery Optimization usage data, and then sends this data to a customer-owned [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace to power the experience. + +See the following topics in this guide for detailed information about configuring and using the Update Compliance solution: + +- [Get started with Update Compliance](update-compliance-get-started.md) provides directions on adding Update Compliance to your Azure subscription and configuring devices to send data to Update Compliance. +- [Using Update Compliance](update-compliance-using.md) breaks down every aspect of the Update Compliance experience. + +## Related topics + +* [Get started with Update Compliance](update-compliance-get-started.md) +* [Use Update Compliance to monitor Windows Updates](update-compliance-using.md) +* [Update Compliance Schema Reference](update-compliance-schema.md) diff --git a/windows/deployment/update/update-compliance-need-attention.md b/windows/deployment/update/update-compliance-need-attention.md index be35a79469..6a441b08d7 100644 --- a/windows/deployment/update/update-compliance-need-attention.md +++ b/windows/deployment/update/update-compliance-need-attention.md @@ -1,46 +1,46 @@ ---- -title: Update Compliance - Need Attention! report -ms.reviewer: -manager: laurawi -description: an overview of the Update Compliance Need Attention! report -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-analytics -ms.topic: article ---- - -# Needs attention! -![Needs attention section](images/UC_workspace_needs_attention.png) - -The **Needs attention!** section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance. The summary tile for this section counts the number of devices that have issues, while the blades within break down the issues encountered. Finally, a [list of queries](#list-of-queries) blade in this section contains queries that provide values but do not fit within any other main section. - ->[!NOTE] ->The summary tile counts the number of devices that have issues, while the blades within the section break down the issues encountered. A single device can have more than one issue, so these numbers might not add up. - -The different issues are broken down by Device Issues and Update Issues: - -## Device Issues - -* **Missing multiple security updates:** This issue occurs when a device is behind by two or more security updates. These devices might be more vulnerable and should be investigated and updated. -* **Out of support OS Version:** This issue occurs when a device has fallen out of support due to the version of Windows 10 it is running. When a device has fallen out of support, it will no longer receive important security updates, and might be vulnerable. These devices should be updated to a supported version of Windows 10. - -## Update Issues - -* **Failed:** This issue occurs when an error halts the process of downloading and applying an update on a device. Some of these errors might be transient, but should be investigated further to be sure. -* **Cancelled**: This issue occurs when a user cancels the update process. -* **Rollback**: This issue occurs when a fatal error occurs during a feature update, and the device is rolled back to the previous version. -* **Uninstalled**: This issue occurs when a feature update is uninstalled from a device by a user or an administrator. Note that this might not be a problem if the uninstallation was intentional, but is highlighted as it might need attention. -* **Progress stalled:** This issue occurs when an update is in progress, but has not completed over a period of 10 days. - -Selecting any of the issues will take you to a [Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) view with all devices that have the given issue. - ->[!NOTE] ->This blade also has a link to the [Setup Diagnostic Tool](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag), a standalone tool you can use to obtain details about why a Windows 10 feature update was unsuccessful. - -## List of Queries - -The **List of Queries** blade is in the **Needs Attention** section of Update Compliance. This blade contains a list of queries with a description and a link to the query. These queries contain important meta-information that did not fit within any specific section or were listed to serve as a good starting point for modification into custom queries. +--- +title: Update Compliance - Need Attention! report +manager: laurawi +description: Learn how the Need attention! section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance. +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +ms.prod: w10 +--- + +# Needs attention! +![Needs attention section](images/UC_workspace_needs_attention.png) + +The **Needs attention!** section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance. The summary tile for this section counts the number of devices that have issues, while the blades within break down the issues encountered. Finally, a [list of queries](#list-of-queries) blade in this section contains queries that provide values but do not fit within any other main section. + +> [!NOTE] +> The summary tile counts the number of devices that have issues, while the blades within the section break down the issues encountered. A single device can have more than one issue, so these numbers might not add up. + +The different issues are broken down by Device Issues and Update Issues: + +## Device Issues + +* **Missing multiple security updates:** This issue occurs when a device is behind by two or more security updates. These devices might be more vulnerable and should be investigated and updated. +* **Out of support OS Version:** This issue occurs when a device has fallen out of support due to the version of Windows 10 it is running. When a device has fallen out of support, it will no longer receive important security updates, and might be vulnerable. These devices should be updated to a supported version of Windows 10. + +## Update Issues + +* **Failed:** This issue occurs when an error halts the process of downloading and applying an update on a device. Some of these errors might be transient, but should be investigated further to be sure. +* **Cancelled**: This issue occurs when a user cancels the update process. +* **Rollback**: This issue occurs when a fatal error occurs during a feature update, and the device is rolled back to the previous version. +* **Uninstalled**: This issue occurs when a feature update is uninstalled from a device by a user or an administrator. Note that this might not be a problem if the uninstallation was intentional, but is highlighted as it might need attention. +* **Progress stalled:** This issue occurs when an update is in progress, but has not completed over a period of 7 days. + +Selecting any of the issues will take you to a [Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) view with all devices that have the given issue. + +> [!NOTE] +> This blade also has a link to the [Setup Diagnostic Tool](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag), a standalone tool you can use to obtain details about why a Windows 10 feature update was unsuccessful. + +## List of Queries + +The **List of Queries** blade is in the **Needs Attention** section of Update Compliance. This blade contains a list of queries with a description and a link to the query. These queries contain important meta-information that did not fit within any specific section or were listed to serve as a good starting point for modification into custom queries. diff --git a/windows/deployment/update/update-compliance-perspectives.md b/windows/deployment/update/update-compliance-perspectives.md deleted file mode 100644 index 4af9e5897a..0000000000 --- a/windows/deployment/update/update-compliance-perspectives.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Update Compliance - Perspectives -ms.reviewer: -manager: laurawi -description: an overview of Update Compliance Perspectives -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-analytics -ms.topic: article ---- - -# Perspectives - -![Perspectives data view](images/uc-perspectiveupdatedeploymentstatus.png) - -Perspectives are elaborations on specific queries hand-crafted by developers which data views that provide deeper insight into your data. Perspectives are loaded whenever clicking into more detailed views from both the Security Update Status section and Feature Update Status section of Update Compliance. - -There is only one perspective framework; it is for **Update Deployment Status**. The same framework is utilized for both feature and quality updates. - -The first blade is the **Build Summary** blade. This blade summarizes the most important aspects of the given build being queried, listing the total number of devices, the total number of update failures for the build, and a breakdown of the different errors encountered. - -The second blade is the **Deferral Configurations** blade, breaking down Windows Update for Business deferral settings (if any). - -## Deployment status - -The third blade is the **Deployment Status** blade. This defines how many days it has been since the queried version has been released, and breaks down the various states in the update funnel each device has reported to be in. The possible states are as follows: - -| State | Description | -| --- | --- | -| Update Completed | When a device has finished the update process and is on the queried update, it will display here as Update completed. | -| In Progress | Devices that report they are “In Progress” are one of the various stages of installing an update; these stages are reported in the Detailed Deployment Status blade. | -| Deferred | When a device’s Windows Update for Business deferral policy dictates that the update is not yet applicable due to deferral, it will report as such in this blade. | -| Progress stalled | Devices that report as “Progress stalled” have been stuck at “In progress” for more than 7 days. | -| Cancelled | The update was cancelled. | -| Blocked | There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update. | -| Unknown | Devices that do not report detailed information on the status of their updates will report Unknown. This is most likely devices that do not use Windows Update for deployment. | -| Update paused | These devices have Windows Update for Business pause enabled, preventing this update from being installed. | -| Failed | A device is unable to install an update. This failure could be linked to a serious error in the update installation process or, in some cases, a [compatibility hold](update-compliance-feature-update-status.md#compatibility-holds). | - -## Detailed deployment status - -The final blade is the **Detailed Deployment Status** blade. This blade breaks down the detailed stage of deployment a device is in, beyond the generalized terms defined in Deployment Status. The following are the possible stages a device can report: - -| State | Description | -| --- | --- | -| Update deferred | When a device’s Windows Update for Business policy dictates the update is deferred. | -| Update paused | The device’s Windows Update for Business policy dictates the update is paused from being offered. | -| Update offered | The device has been offered the update, but has not begun downloading it. | -| Pre-Download tasks passed | The device has finished all necessary tasks prior to downloading the update. | -| Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) | -| Download Started | The update has begun downloading on the device. | -| Download Succeeded | The update has successfully completed downloading. | -| Pre-Install Tasks Passed | Tasks that must be completed prior to installing the update have been completed. | -| Install Started | Installation of the update has begun. | -| Reboot Required | The device has finished installing the update, and a reboot is required before the update can be completed. -| Reboot Pending | The device has a scheduled reboot to apply the update. | -| Reboot Initiated | The scheduled reboot has been initiated. | -| Update Completed/Commit | The update has successfully installed. | - ->[!NOTE] ->Interacting with any rows in the perspective view will automatically apply the given value to the query and execute it with the new parameter, narrowing the perspective to devices that satisfy that criteria. For example, clicking “Not configured (-1)” devices in Deferral Configurations will filter the query to only contain devices that do not have a deferral configuration. These filters can also be applied to queries via the filter sidebar. diff --git a/windows/deployment/update/update-compliance-privacy.md b/windows/deployment/update/update-compliance-privacy.md new file mode 100644 index 0000000000..a455261f8c --- /dev/null +++ b/windows/deployment/update/update-compliance-privacy.md @@ -0,0 +1,55 @@ +--- +title: Privacy in Update Compliance +ms.reviewer: +manager: laurawi +description: an overview of the Feature Update Status report +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +--- + +# Privacy in Update Compliance + +Update Compliance is fully committed to privacy, centering on these tenets: + +- **Transparency:** Windows 10 diagnostic data events that are required for Update Compliance's operation are fully documented (see the links for additional information) so you can review them with your company's security and compliance teams. The Diagnostic Data Viewer lets you see diagnostic data sent from a given device (see [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) for details). +- **Control:** You ultimately control the level of diagnostic data you wish to share. In Windows 10, version 1709 we added a new policy to Limit enhanced diagnostic data to the minimum required by Windows Analytics. +- **Security:** Your data is protected with strong security and encryption. +- **Trust:** Update Compliance supports the Online Services Terms. + +## Data flow for Update Compliance + +The data flow sequence is as follows: + +1. Diagnostic data is sent from devices to the Microsoft Diagnostic Data Management service, which is hosted in the US. +2. An IT Administrator creates an Azure Log Analytics workspace. They then choose the location this workspace will store data and receives a Commercial ID for that workspace. The Commercial ID is added to each device in an organization by way of Group Policy, MDM or registry key. +3. Each day Microsoft produces a "snapshot" of IT-focused insights for each workspace in the Diagnostic Data Management Service, identifying devices by Commercial ID. +4. These snapshots are copied to transient storage, used solely for Update Compliance where they are partitioned by Commercial ID. +5. The snapshots are then copied to the appropriate Azure Log Analytics workspace, where the Update Compliance experience pulls the information from to populate visuals. + +## FAQ + +### Can Update Compliance be used without a direct client connection to the Microsoft Data Management Service? + +No, the entire service is powered by Windows diagnostic data, which requires that devices have this direct connectivity. + +### Can I choose the data center location? + +Yes for Azure Log Analytics, but no for the Microsoft Data Management Service (which is hosted in the US). + +## Related topics + +See related topics for additional background information on privacy and treatment of diagnostic data: + +- [Windows 10 and the GDPR for IT Decision Makers](https://docs.microsoft.com/windows/privacy/gdpr-it-guidance) +- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization) +- [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) +- [Licensing Terms and Documentation](https://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=31) +- [Confidence in the trusted cloud](https://azure.microsoft.com/support/trust-center/) +- [Trust Center](https://www.microsoft.com/trustcenter) diff --git a/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md b/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md new file mode 100644 index 0000000000..b5fe054a3e --- /dev/null +++ b/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md @@ -0,0 +1,46 @@ +--- +title: Update Compliance Schema - WaaSDeploymentStatus +ms.reviewer: +manager: laurawi +description: WaaSDeploymentStatus schema +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +--- + +# WaaSDeploymentStatus + +WaaSDeploymentStatus records track a specific update's installation progress on a specific device. Multiple WaaSDeploymentStatus records can exist simultaneously for a given device, as each record is specific to a given update and its type. For example, a device can have both a WaaSDeploymentStatus tracking a Windows Feature Update, as well as one tracking a Windows Quality Update, at the same time. + +|Field |Type |Example |Description | +|-|-|-----|------------------------| +|**Computer** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`JohnPC-Contoso` |User or Organization-provided device name. If this appears as '#', then Device Name may not be sent through telemetry. To enable Device Name to be sent with telemetry, see [Enabling Device Name in Telemetry](https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started#allow-device-name-in-telemetry-with-group-policy). | +|**ComputerID** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`g:6755412281299915` |Microsoft Global Device Identifier. This is an internal identifier used by Microsoft. A connection to the end-user Managed Service Account (MSA) service is required for this identifier to be populated; no device data will be present in Update Compliance without this identifier. | +|**DeferralDays** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |The deferral policy for this content type or `UpdateCategory` (Windows `Feature` or `Quality`). | +|**DeploymentError** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Disk Error` |A readable string describing the error, if any. If empty, there is either no string matching the error or there is no error. | +|**DeploymentErrorCode** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`8003001E` |Microsoft internal error code for the error, if any. If empty, there is either no error or there is *no error code*, meaning that the issue raised does not correspond to an error, but some inferred issue. | +|**DeploymentStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Failed` |The high level status of installing this update on this device. Possible values are:
            • **Update completed**: Device has completed the update installation.
            • **In Progress**: Device is in one of the various stages of installing an update, detailed in `DetailedStatus`.
            • **Deferred**: A device's deferral policy is preventing the update from being offered by Windows Update.
            • **Cancelled**: The update was cancelled.
            • **Blocked**: There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update.
            • **Unknown**: Update Compliance generated WaaSDeploymentStatus records for devices as soon as it detects an update newer than the one installed on the device. Devices that have not sent any deployment data for that update will have the status `Unknown`.
            • **Update paused**: Devices are paused via Windows Update for Business Pause policies, preventing the update from being offered by Windows Update.
            • **Failed**: Device encountered a failure in the update process, preventing it from installing the update. This may result in an automatic retry in the case of Windows Update, unless the `DeploymentError` indicates the issue requires action before the update can continue.| +|**DetailedStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Reboot required` |A detailed status for the installation of this update on this device. Possible values are:
            • **Update deferred**: When a device's Windows Update for Business policy dictates the update is deferred.
            • **Update paused**: The device's Windows Update for Business policy dictates the update is paused from being offered.
            • **Update offered**: The device has been offered the update, but has not begun downloading it.
            • **Pre-Download tasks passed**: The device has finished all necessary tasks prior to downloading the update.
            • **Compatibility hold**: The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#safeguard-holds).
            • **Download started**: The update has begun downloading on the device.
            • **Download Succeeded**: The update has successfully completed downloading.
            • **Pre-Install Tasks Passed**: Tasks that must be completed prior to installing the update have been completed.
            • **Install Started**: Installation of the update has begun.
            • **Reboot Required**: The device has finished installing the update, and a reboot is required before the update can be completed.
            • **Reboot Pending**: The device has a scheduled reboot to apply the update.
            • **Reboot Initiated**: The scheduled reboot has been initiated.
            • **Commit**: Changes are being committed post-reboot. This is another step of the installation process.
            • **Update Completed**: The update has successfully installed.| +|**ExpectedInstallDate** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/28/2020, 1:00:01.318 PM`|Rather than the expected date this update will be installed, this should be interpreted as the minimum date Windows Update will make the update available for the device. This takes into account Deferrals. | +|**LastScan** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/22/2020, 1:00:01.318 PM`|The last point in time that this device sent Update Session data. | +|**OriginBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.719` |The build originally installed on the device when this Update Session began. | +|**OSBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.719` |The build currently installed on the device. | +|**OSRevisionNumber** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`719` |The revision of the OSBuild installed on the device. | +|**OSServicingBranch** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Semi-Annual` |The Servicing Branch or [Servicing Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#servicing-channels) the device is on. Dictates which Windows updates the device receives and the cadence of those updates. | +|**OSVersion** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`1909` |The version of Windows 10. This typically is of the format of the year of the version's release, following the month. In this example, `1909` corresponds to 2019-09 (September). This maps to the `Major` portion of OSBuild. | +|**PauseState** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`NotConfigured` |The on-client Windows Update for Business Pause state. Reflects whether or not a device has paused Feature Updates.
            •  **Expired**: The pause period has expired.
            •  **NotConfigured**: Pause is not configured.
            •  **Paused**: The device was last reported to be pausing this content type.
            •  **NotPaused**: The device was last reported to not have any pause on this content type. | +|**RecommendedAction** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |The recommended action to take in the event this device needs attention, if any. | +|**ReleaseName** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`KB4551762` |The KB Article corresponding to the TargetOSRevision, if any. | +|**TargetBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.720` |The target OSBuild, the update being installed or considered as part of this WaaSDeploymentStatus record. | +|**TargetOSVersion** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`1909` |The target OSVersion. | +|**TargetOSRevision** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`720` |The target OSRevisionNumber. | +|**TimeGenerated** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime) |`3/22/2020, 1:00:01.318 PM`|A DateTime corresponding to the moment Azure Monitor Logs ingested this record to your Log Analytics workspace. | +|**UpdateCategory** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Quality` |The high-level category of content type this Windows Update belongs to. Possible values are **Feature** and **Quality**. | +|**UpdateClassification** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Security` |Similar to UpdateCategory, this more specifically determines whether a Quality update is a security update or not. | +|**UpdateReleasedDate** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime) |`3/22/2020, 1:00:01.318 PM`|A DateTime corresponding to the time the update came available on Windows Update. | diff --git a/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md b/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md new file mode 100644 index 0000000000..2ddf505e62 --- /dev/null +++ b/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md @@ -0,0 +1,35 @@ +--- +title: Update Compliance Schema - WaaSInsiderStatus +ms.reviewer: +manager: laurawi +description: WaaSInsiderStatus schema +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +--- + +# WaaSInsiderStatus + +WaaSInsiderStatus records contain device-centric data and acts as the device record for devices on Windows Insider Program builds in Update Compliance. Each record provided in daily snapshots map to a single device in a single tenant. This table has data such as the current device's installed version of Windows, whether it is on the latest available updates, and whether the device needs attention. Insider devices have fewer fields than [WaaSUpdateStatus](update-compliance-schema-waasupdatestatus.md). + + +|Field |Type |Example |Description | +|--|--|---|--| +|**Computer** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`JohnPC-Contoso` |User or Organization-provided device name. If this appears as '#', then Device Name may not be sent through telemetry. To enable Device Name to be sent with telemetry, see [Enabling Device Name in Telemetry](https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started#allow-device-name-in-telemetry-with-group-policy). | +|**ComputerID** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`g:6755412281299915` |Microsoft Global Device Identifier. This is an internal identifier used by Microsoft. A connection to the end-user Managed Service Account (MSA) service is required for this identifier to be populated; no device data will be present in Update Compliance without this identifier. | +|**OSArchitecture** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`amd64` |The architecture of the Operating System. | +|**OSName** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows 10` |The name of the Operating System. This will always be Windows 10 for Update Compliance. | +|**OSVersion** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`1909` |The version of Windows 10. This typically is of the format of the year of the version's release, following the month. In this example, `1909` corresponds to 2019-09 (September). This maps to the `Major` portion of OSBuild. | +|**OSBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.720` |The currently-installed Windows 10 Build, in the format `Major`.`Revision`. `Major` corresponds to which Feature Update the device is on, whereas `Revision` corresponds to which quality update the device is on. Mappings between Feature release and Major, as well as Revision and KBs, are available at [aka.ms/win10releaseinfo](https://docs.microsoft.com/windows/release-information/). | +|**OSRevisionNumber** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`720` |An integer value for the revision number of the currently-installed Windows 10 OSBuild on the device. | +|**OSEdition** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Enterprise` |The Windows 10 Edition or SKU. | +|**OSFamily** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows.Desktop` |The Device Family of the device. Only `Windows.Desktop` is currently supported. | +|**OSServicingBranch** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Semi-Annual` |The Servicing Branch or [Servicing Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#servicing-channels) the device is on. Dictates which Windows updates the device receives and the cadence of those updates. | +|**TimeGenerated** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|3/22/`2020, 1:00:01.318 PM`|A DateTime corresponding to the moment Azure Monitor Logs ingested this record to your Log Analytics workspace. | +|**LastScan** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|3/22/`2020, 2:00:00.436 AM`|A DateTime corresponding to the last time the device sent data to Microsoft. This does not necessarily mean all data that is needed to populate all fields Update Compliance uses was sent, this is more like a "heartbeat". | diff --git a/windows/deployment/update/update-compliance-schema-waasupdatestatus.md b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md new file mode 100644 index 0000000000..0b5adb4096 --- /dev/null +++ b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md @@ -0,0 +1,46 @@ +--- +title: Update Compliance Schema - WaaSUpdateStatus +ms.reviewer: +manager: laurawi +description: WaaSUpdateStatus schema +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +--- + +# WaaSUpdateStatus + +WaaSUpdateStatus records contain device-centric data and acts as the device record for Update Compliance. Each record provided in daily snapshots map to a single device in a single tenant. This table has data such as the current device's installed version of Windows, whether it is on the latest available updates, and whether the device needs attention. + +|Field |Type |Example |Description | +|--|-|----|------------------------| +|**Computer** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`JohnPC-Contoso` |User or Organization-provided device name. If this appears as '#', then Device Name may not be sent through telemetry. To enable Device Name to be sent with telemetry, see [Enabling Device Name in Telemetry](https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started#allow-device-name-in-telemetry-with-group-policy). | +|**ComputerID** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`g:6755412281299915` |Microsoft Global Device Identifier. This is an internal identifier used by Microsoft. A connection to the end-user Managed Service Account (MSA) service is required for this identifier to be populated; no device data will be present in Update Compliance without this identifier. | +|**DownloadMode** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Simple (99)` |The device's Delivery Optimization DownloadMode. To learn about possible values, see [Delivery Optimization Reference - Download mode](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference#download-mode) | +|**FeatureDeferralDays** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |The on-client Windows Update for Business Deferral Policy days.
              - **<0**: A value below 0 indicates the policy is disabled.
              - **0**: A value of 0 indicates the policy is enabled, but the deferral period is 0 days.
              - **1+**: A value of 1 and above indicates the deferral setting, in days. | +|**FeaturePauseDays** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |*Deprecated* This provides the count of days left in a pause | +|**FeaturePauseState** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`NotConfigured` |The on-client Windows Update for Business Pause state. Reflects whether or not a device has paused Feature Updates.
            • **Expired**: The pause period has expired.
            • **NotConfigured**: Pause is not configured.
            • **Paused**: The device was last reported to be pausing this content type.
            • **NotPaused**: The device was last reported to not have any pause on this content type. | +|**QualityDeferralDays** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |The on-client Windows Update for Business Deferral Policy days.
            • **<0**: A value below 0 indicates the policy is disabled.
            • **0**: A value of 0 indicates the policy is enabled, but the deferral period is 0 days.
            • **1+**: A value of 1 and above indicates the deferral setting, in days. | +|**QualityPauseDays** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |**Deprecated**. This provides the count of days left in a pause period.| +|**QualityPauseState** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`NotConfigured` |The on-client Windows Update for Business Pause state. Reflects whether or not a device has paused Quality Updates.
            • **Expired**: The pause period has expired.
            • **NotConfigured**: Pause is not configured.
            • **Paused**: The device was last reported to be pausing this content type.
            • **NotPaused**: The device was last reported to not have any pause on this content type. | +|**NeedAttentionStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |Indicates any reason a device needs attention; if empty, there are no [Device Issues](https://docs.microsoft.com/windows/deployment/update/update-compliance-need-attention#device-issues) for this device. | +|**OSArchitecture** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`amd64` |The architecture of the Operating System. | +|**OSName** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows 10` |The name of the Operating System. This will always be Windows 10 for Update Compliance. | +|**OSVersion** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`1909` |The version of Windows 10. This typically is of the format of the year of the version's release, following the month. In this example, `1909` corresponds to 2019-09 (September). This maps to the `Major` portion of OSBuild. | +|**OSBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.720` |The currently-installed Windows 10 Build, in the format `Major`.`Revision`. `Major` corresponds to which Feature Update the device is on, whereas `Revision` corresponds to which quality update the device is on. Mappings between Feature release and Major, as well as Revision and KBs, are available at [aka.ms/win10releaseinfo](https://docs.microsoft.com/windows/release-information/). | +|**OSRevisionNumber** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`720` |An integer value for the revision number of the currently-installed Windows 10 OSBuild on the device. | +|**OSCurrentStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Current` |*Deprecated* Whether or not the device is on the latest Windows Feature Update available, as well as the latest Quality Update for that Feature Update. | +|**OSEdition** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Enterprise` |The Windows 10 Edition or SKU. | +|**OSFamily** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows.Desktop` |The Device Family of the device. Only `Windows.Desktop` is currently supported. | +|**OSFeatureUpdateStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Up-to-date` |Indicates whether or not the device is on the latest available Windows 10 Feature Update. | +|**OSQualityUpdateStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Up-to-date` |Indicates whether or not the device is on the latest available Windows 10 Quality Update (for its Feature Update). | +|**OSSecurityUpdateStatus**|[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Up-to-date` |Indicates whether or not the device is on the latest available Windows 10 Quality Update **that is classified as containing security fixes**. | +|**OSServicingBranch** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Semi-Annual` |The Servicing Branch or [Servicing Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#servicing-channels) the device is on. Dictates which Windows updates the device receives and the cadence of those updates. | +|**TimeGenerated** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/22/2020, 1:00:01.318 PM`|A DateTime corresponding to the moment Azure Monitor Logs ingested this record to your Log Analytics workspace. | +|**LastScan** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/22/2020, 2:00:00.436 AM`|A DateTime corresponding to the last time the device sent data to Microsoft. This does not necessarily mean all data that is needed to populate all fields Update Compliance uses was sent, this is more like a "heartbeat". | diff --git a/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md b/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md new file mode 100644 index 0000000000..6aa934c711 --- /dev/null +++ b/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md @@ -0,0 +1,34 @@ +--- +title: Update Compliance Schema - WUDOAggregatedStatus +ms.reviewer: +manager: laurawi +description: WUDOAggregatedStatus schema +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +--- + +# WUDOAggregatedStatus + +WUDOAggregatedStatus records provide information, across all devices, on their bandwidth utilization for a specific content type in the event they use [Delivery Optimization](https://support.microsoft.com/help/4468254/windows-update-delivery-optimization-faq), over the past 28 days. + +These fields are briefly described in this article, to learn more about Delivery Optimization in general, check out the [Delivery Optimization Reference](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference). + +|Field |Type |Example |Description | +|-|-|-|-| +|**DeviceCount** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`9999` |Total number of devices in this aggregated record. | +|**BWOptPercent28Days** |[real](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/real) |`68.72` |Bandwidth optimization (as a percentage of savings of total bandwidth otherwise incurred) as a result of using Delivery Optimization *across all devices*, computed on a rolling 28-day basis. | +|**BWOptPercent7Days** |[real](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/real) |`13.58` |Bandwidth optimization (as a percentage of savings of total bandwidth otherwise incurred) as a result of using Delivery Optimization *across all devices*, computed on a rolling 7-day basis. | +|**BytesFromCDN** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`254139` |Total number of bytes downloaded from a CDN versus a Peer. This counts against bandwidth optimization.| +|**BytesFromGroupPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`523132` |Total number of bytes downloaded from Group Peers. | +|**BytesFromIntPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`328350` |Total number of bytes downloaded from Internet Peers. | +|**BytesFromPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`43145` |Total number of bytes downloaded from peers. | +|**ContentType** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`Quality Updates` |The type of content being downloaded.| +|**DownloadMode** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`HTTP+LAN (1)` |Device's Delivery Optimization [Download Mode](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference#download-mode) configuration for this device. | +|**TimeGenerated** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`1601-01-01T00:00:00Z` |A DateTime corresponding to the moment Azure Monitor Logs ingested this record to your Log Analytics workspace.| diff --git a/windows/deployment/update/update-compliance-schema-wudostatus.md b/windows/deployment/update/update-compliance-schema-wudostatus.md new file mode 100644 index 0000000000..f3d6dc0e2a --- /dev/null +++ b/windows/deployment/update/update-compliance-schema-wudostatus.md @@ -0,0 +1,57 @@ +--- +title: Update Compliance Schema - WUDOStatus +ms.reviewer: +manager: laurawi +description: WUDOStatus schema +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +--- + +# WUDOStatus + +> [!NOTE] +> Currently all location-based fields are not working properly. This is a known issue. + +WUDOStatus records provide information, for a single device, on their bandwidth utilization for a specific content type in the event they use [Delivery Optimization](https://support.microsoft.com/help/4468254/windows-update-delivery-optimization-faq), and other information to create more detailed reports and splice on certain common characteristics. + +These fields are briefly described in this article, to learn more about Delivery Optimization in general, check out the [Delivery Optimization Reference](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference). + +|Field |Type |Example |Description | +|-|-|-|-| +|**Computer** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`JohnPC-Contoso` |User or Organization-provided device name. If this appears as '#', then Device Name may not be sent through telemetry. To enable Device Name to be sent with telemetry, see [Enabling Device Name in Telemetry](https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started#allow-device-name-in-telemetry-with-group-policy). | +|**ComputerID** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`g:6755412281299915` |Microsoft Global Device Identifier. This is an internal identifier used by Microsoft. A connection to the end-user Managed Service Account (MSA) service is required for this identifier to be populated; no device data will be present in Update Compliance without this identifier. | +|**City** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |Approximate city device was in while downloading content, based on IP Address. | +|**Country** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |Approximate country device was in while downloading content, based on IP Address. | +|**ISP** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |The Internet Service Provider estimation. | +|**BWOptPercent28Days** |[real](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/real) |`68.72` |Bandwidth optimization (as a percentage of savings of total bandwidth otherwise incurred) as a result of using Delivery Optimization *for this device*, computed on a rolling 28-day basis. | +|**BWOptPercent7Days** |[real](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/real) |`13.58` |Bandwidth optimization (as a percentage of savings of total bandwidth otherwise incurred) as a result of using Delivery Optimization *for this device*, computed on a rolling 7-day basis. | +|**BytesFromCDN** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`254139` |Total number of bytes downloaded from a CDN versus a Peer. This counts against bandwidth optimization. | +|**BytesFromGroupPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`523132` |Total number of bytes downloaded from Group Peers. | +|**BytesFromIntPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`328350` |Total number of bytes downloaded from Internet Peers. | +|**BytesFromPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`43145` |Total number of bytes downloaded from peers. | +|**ContentDownloadMode** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |Device's Delivery Optimization [Download Mode](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference#download-mode) configuration for this content. | +|**ContentType** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`Quality Updates` |The type of content being downloaded. | +|**DOStatusDescription** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |A short description of DO's status, if any. | +|**DownloadMode** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`HTTP+LAN (1)` |Device's Delivery Optimization [Download Mode](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference#download-mode) configuration for this device. | +|**DownloadModeSrc** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Default` |The source of the DownloadMode configuration. | +|**GroupID** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |The DO Group ID. | +|**NoPeersCount** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) | |The number of peers this device interacted with. | +|**OSName** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows 10` |The name of the Operating System. This will always be Windows 10 for Update Compliance. | +|**OSVersion** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`1909` |The version of Windows 10. This typically is of the format of the year of the version's release, following the month. In this example, `1909` corresponds to 2019-09 (September). This maps to the `Major` portion of OSBuild.  | +|**PeerEligibleTransfers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`0` |Total number of eligible transfers by Peers. | +|**PeeringStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`On` |The DO Peering Status | +|**PeersCannotConnectCount**|[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`0` |The number of peers this device was unable to connect to. | +|**PeersSuccessCount** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`0` |The number of peers this device successfully connected to. | +|**PeersUnknownCount** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`0` |The number of peers for which there is an unknown relation. | +|**LastScan** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`1601-01-01T00:00:00Z` |A DateTime corresponding to the last time the device sent data to Microsoft. This does not necessarily mean all data that is needed to populate all fields Update Compliance uses was sent, this is more like a "heartbeat". | +|**TimeGenerated** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`1601-01-01T00:00:00Z` |A DateTime corresponding to the moment Azure Monitor Logs ingested this record to your Log Analytics workspace. | +|**TotalTimeForDownload** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`0:00:00` |The total time it took to download the content. | +|**TotalTransfers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`0` |The total number of data transfers to download this content. | + diff --git a/windows/deployment/update/update-compliance-schema.md b/windows/deployment/update/update-compliance-schema.md new file mode 100644 index 0000000000..a42e7701f0 --- /dev/null +++ b/windows/deployment/update/update-compliance-schema.md @@ -0,0 +1,32 @@ +--- +title: Update Compliance Data Schema +ms.reviewer: +manager: laurawi +description: an overview of Update Compliance data schema +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.collection: M365-analytics +ms.topic: article +--- + +# Update Compliance Schema + +When the visualizations provided in the default experience don't fulfill your reporting needs, or if you need to troubleshoot issues with devices, it's valuable to understand the schema for Update Compliance and have a high-level understanding of the capabilities of [Azure Monitor log queries](https://docs.microsoft.com/azure/azure-monitor/log-query/query-language) to power additional dashboards, integration with external data analysis tools, automated alerting, and more. + +The table below summarizes the different tables that are part of the Update Compliance solution. To learn how to navigate Azure Monitor Logs to find this data, see [Get started with log queries in Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/log-query/get-started-queries). + +> [!NOTE] +> Data is collected daily. The TimeGenerated field shows the time data was collected. It's added by Log Analytics when data is collected. Device data from the past 28 days is collected, even if no new data has been generated since the last time. LastScan is a clearer indicator of data freshness (that is, the last time the values were updated), while TimeGenerated indicates the freshness of data within Log Analytics. + +|Table |Category |Description | +|--|--|--| +|[**WaaSUpdateStatus**](update-compliance-schema-waasupdatestatus.md) |Device record |This table houses device-centric data and acts as the device record for Update Compliance. Each record provided in daily snapshots map to a single device in a single tenant. This table has data such as the current device's installed version of Windows, whether it is on the latest available updates, and whether the device needs attention. | +|[**WaaSInsiderStatus**](update-compliance-schema-waasinsiderstatus.md) |Device record |This table houses device-centric data specifically for devices enrolled to the Windows Insider Program. Devices enrolled to the Windows Insider Program do not currently have any WaaSDeploymentStatus records, so do not have Update Session data to report on update deployment progress. | +|[**WaaSDeploymentStatus**](update-compliance-schema-waasdeploymentstatus.md) |Update Session record |This table tracks a specific update on a specific device. Multiple WaaSDeploymentStatus records can exist simultaneously for a given device, as each record is specific to a given update and its type. For example, a device can have both a WaaSDeploymentStatus tracking a Windows Feature Update, as well as one tracking a Windows Quality Update, at the same time. | +|[**WUDOStatus**](update-compliance-schema-wudostatus.md) |Delivery Optimization record |This table provides information, for a single device, on their bandwidth utilization across content types in the event they use [Delivery Optimization](https://support.microsoft.com/help/4468254/windows-update-delivery-optimization-faq). | +|[**WUDOAggregatedStatus**](update-compliance-schema-wudoaggregatedstatus.md) |Delivery Optimization record |This table aggregates all individual WUDOStatus records across the tenant and summarizes bandwidth savings across all devices enrolled to Delivery Optimization. | diff --git a/windows/deployment/update/update-compliance-security-update-status.md b/windows/deployment/update/update-compliance-security-update-status.md index d299981e93..085e47d153 100644 --- a/windows/deployment/update/update-compliance-security-update-status.md +++ b/windows/deployment/update/update-compliance-security-update-status.md @@ -2,15 +2,15 @@ title: Update Compliance - Security Update Status report ms.reviewer: manager: laurawi -description: an overview of the Security Update Status report +description: Learn how the Security Update Status section provides information about security updates across all devices. ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy author: jaimeo ms.author: jaimeo ms.collection: M365-analytics ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Security Update Status @@ -23,49 +23,4 @@ The **Overall Security Update Status** blade provides a visualization of devices The **Latest Security Update Status** and **Previous Security Update Status** tiles are stacked to form one blade. The **Latest Security Update Status** provides a visualization of the different deployment states devices are in regarding the latest update for each build (or version) of Windows 10, along with the revision of that update. The **Previous Security Update Status** blade provides the same information without the accompanying visualization. -The various deployment states reported by devices are as follows: - -## Deployment status -Deployment status summarizes detailed status into higher-level states to get a quick sense of the status the given device was last reported to be in relative to this specific update. Note that with the latency of deployment data, devices might have since moved on from the reported deployment status. - -|Deployment status |Description | -|---------|---------| -|Failed | The device encountered a failure during the update process. Note that due to latency, devices reporting this status may have since retried the update. | -|Progress stalled | he device started the update process, but no progress has been reported in the last 7 days. | -|Deferred | The device is currently deferring the update process due to Windows Update for Business policies. | -|In progress | The device has begun the updating process for this update. This status appears if the device is in any stage of the update process including and after download, but before completing the update. If no progress has been reported in the last 7 days, devices will move to **Progress stalled**.** | -|Update completed | The device has completed the update process. | -|Update paused | The device is prevented from being offered the update due to updates being paused on the device. | -|Unknown | No record is available for this device relative to this update. This is a normal status if an update has recently been released or if the device does not use Windows Update. | - - -## Detailed status -Detailed status provides a detailed stage-level representation of where in the update process the device was last reported to be in relative to this specific update. Note that with the latency of deployment data, devices might have since moved on from the reported detailed status. - - -|Detaild status |Description | -|---------|---------| -|Scheduled in next X days | The device is currently deferring the update with Windows Update for Business policies but will be offered the update within the next X days. | -|Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) | -|Update deferred | The device is currently deferring the update with Windows Update for Business policies. | -|Update paused | The device is prevented from being offered the update due to updates being paused on the device. | -|Update offered | The device has been offered the update by Windows Update but has not yet begun to download it. | -|Download started | The device has begun downloading the update. | -|Download succeeded | The device has finished downloading the update but has not yet begun installing the update. | -|Install started | The device has begun installing the update. | -|PreInstall task passed | The device has passed checks prior to beginning the rest of the installation process after a restart. | -|Reboot required | The device requires a restart to install the update, but one has not yet been scheduled. | -|Reboot pending | The device is pending a restart to install the update. | -|Reboot initiated | The device reports "Reboot initiated" just before actually restarting specifically to apply the update. | -|Commit | The device, after a restart, is committing changes relevant to the update. | -|Finalize succeeded | The device has finished final tasks after a restart to apply the update. | -|Update successful | The device has successfully applied the update. | -|Cancelled | The update was cancelled at some point in the update process. | -|Uninstalled | The update was successfully uninstalled from the device. | -|Rollback | The update failed to apply during the update process, causing the device to roll back changes and revert to the previous update. | - - - - - The rows of each tile in this section are interactive; selecting them will navigate you to the query that is representative of that row and section. diff --git a/windows/deployment/update/update-compliance-using.md b/windows/deployment/update/update-compliance-using.md index 501c1bcb57..92ae610fc5 100644 --- a/windows/deployment/update/update-compliance-using.md +++ b/windows/deployment/update/update-compliance-using.md @@ -1,94 +1,91 @@ ---- -title: Using Update Compliance (Windows 10) -ms.reviewer: -manager: laurawi -description: Explains how to begin usihg Update Compliance. -keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Use Update Compliance - -In this section you'll learn how to use Update Compliance to monitor your device's Windows updates and Windows Defender Antivirus status. To configure your environment for use with Update Compliance, refer to [Get started with Update Compliance](update-compliance-get-started.md). - - -Update Compliance: -- Provides detailed deployment data for Windows 10 security, quality, and feature updates. -- Reports when devices have issues related to updates that need attention. -- Shows Windows Defender AV status information for devices that use it and meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). -- Shows bandwidth usage and savings for devices that are configured to use [Delivery Optimization](waas-delivery-optimization.md). -- Provides all of the above data in [Log Analytics](#using-log-analytics), which affords additional querying and export capabilities. - -## The Update Compliance tile -After Update Compliance has successfully been [added to your Azure subscription](update-compliance-get-started.md#add-update-compliance-to-your-azure-subscription), you’ll see this tile: - -![Update Compliance tile no data](images/UC_tile_assessing.png) - -When the solution is added, data is not immediately available. Data will begin to be collected after data is sent up that belongs to the Commercial ID associated with the device. This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). After Microsoft has collected and processed any device data associated with your Commercial ID, the tile will be replaced with the following summary: - -![Update Compliance tile with data](images/UC_tile_filled.png) - -The summary details the total number of devices that Microsoft has received data from with your Commercial ID. It also provides the number of devices that need attention if any. Finally, it details the last point at which your Update Compliance workspace was refreshed. - -## The Update Compliance workspace - -![Update Compliance workspace view](images/UC_workspace_needs_attention.png) - -When you select this tile, you will be redirected to the Update Compliance workspace. The workspace is organized with the Overview blade providing a hub from which to navigate to different reports of your devices' data. - -### Overview blade - -![The Overview blade](images/UC_workspace_overview_blade.png) - -Update Compliance’s overview blade summarizes all the data Update Compliance provides. It functions as a hub from which you can navigate to different sections. The total number of devices detected by Update Compliance is reported in the title of this blade. What follows is a distribution for all devices as to whether they are up to date on the following items: -* Security updates: A device is up to date on quality updates whenever it has the latest applicable quality update installed. Quality updates are monthly cumulative updates that are specific to a version of Windows 10. -* Feature updates: A device is up to date on feature updates whenever it has the latest applicable feature update installed. Update Compliance considers [Servicing Channel](waas-overview.md#servicing-channels) when determining update applicability. -* AV Signature: A device is up to date on Antivirus Signature when the latest Windows Defender Signatures have been downloaded. This distribution only considers devices that are running Windows Defender Antivirus. - -The blade also provides the time at which your Update Compliance workspace was [refreshed](#update-compliance-data-latency). - -The following is a breakdown of the different sections available in Update Compliance: -* [Need Attention!](update-compliance-need-attention.md) - This section is the default section when arriving to your Update Compliance workspace. It provides a summary of the different issues devices are facing relative to Windows 10 updates. -* [Security Update Status](update-compliance-security-update-status.md) - This section lists the percentage of devices that are on the latest security update released for the version of Windows 10 it is running. Selecting this section provides blades that summarize the overall status of security updates across all devices and a summary of their deployment progress towards the latest two security updates. -* [Feature Update Status](update-compliance-feature-update-status.md) - This section lists the percentage of devices that are on the latest feature update that is applicable to a given device. Selecting this section provides blades that summarize the overall feature update status across all devices and a summary of deployment status for different versions of Windows 10 in your environment. -* [Windows Defender AV Status](update-compliance-wd-av-status.md) - This section lists the percentage of devices running Windows Defender Antivirus that are not sufficiently protected. Selecting this section provides a summary of signature and threat status across all devices that are running Windows Defender Antivirus. This section is not applicable to devices not running Windows Defender Antivirus or devices that do not meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites) to be assessed. -* [Delivery Optimization Status](update-compliance-delivery-optimization.md) - This section summarizes bandwidth savings incurred by utilizing Delivery Optimization in your environment. It provides a breakdown of Delivery Optimization configuration across devices, and summarizes bandwidth savings and utilization across multiple content types. - - -## Update Compliance data latency -Update Compliance uses Windows 10 diagnostic data as its data source. After you add Update Compliance and appropriately configure your devices, it could take 48-72 hours before they first appear. The process that follows is as follows: - -Update Compliance is refreshed every 12 hours. This means that every 12 hours all data that has been gathered over the last 12-hour interval is pushed to Log Analytics. However, the rate that each data type is sent and how long it takes to be ready for Update Compliance varies, roughly outlined below. - -| Data Type | Refresh Rate | Data Latency | -|--|--|--| -|WaaSUpdateStatus | Once per day |4 hours | -|WaaSInsiderStatus| Once per day |4 hours | -|WaaSDeploymentStatus|Every update event (Download, install, etc.)|24-36 hours | -|WDAVStatus|On signature update|24 hours | -|WDAVThreat|On threat detection|24 hours | -|WUDOAggregatedStatus|On update event, aggregated over time|24-36 hours | -|WUDOStatus|Once per day|12 hours | - -This means you should generally expect to see new data every 24-36 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours (if it misses the 36th hour refresh, it would be in the 48th, so the data will be present in the 48th hour refresh). - -## Using Log Analytics - -Update Compliance is built on the Log Analytics platform that is integrated into Operations Management Suite. All data in the workspace is the direct result of a query. Understanding the tools and features at your disposal, all integrated within Azure Portal, can deeply enhance your experience and complement Update Compliance. - -See below for a few topics related to Log Analytics: -* Learn how to effectively execute custom Log Searches by referring to Microsoft Azure’s excellent documentation on [querying data in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-searches). -* To develop your own custom data views in Operations Management Suite or [Power BI](https://powerbi.microsoft.com/); check out documentation on [analyzing data for use in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-dashboards). -* [Gain an overview of Log Analytics’ alerts](https://docs.microsoft.com/azure/log-analytics/log-analytics-alerts) and learn how to use it to always stay informed about the most critical issues you care about. - -## Related topics - -[Get started with Update Compliance](update-compliance-get-started.md) +--- +title: Using Update Compliance (Windows 10) +ms.reviewer: +manager: laurawi +description: Learn how to use Update Compliance to monitor your device's Windows updates. +keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.localizationpriority: medium +ms.collection: M365-analytics +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Use Update Compliance + +In this section you'll learn how to use Update Compliance to monitor your device's Windows updates and Microsoft Defender Antivirus status. To configure your environment for use with Update Compliance, refer to [Get started with Update Compliance](update-compliance-get-started.md). + + +Update Compliance: +- Provides detailed deployment monitoring for Windows 10 Feature and Quality updates. +- Reports when devices need attention due to issues related to update deployment. +- Shows bandwidth usage and savings for devices that are configured to use [Delivery Optimization](waas-delivery-optimization.md). +- Provides all of the above data in [Log Analytics](#using-log-analytics), which affords additional querying and export capabilities. + +## The Update Compliance tile +After Update Compliance has successfully been [added to your Azure subscription](update-compliance-get-started.md#add-update-compliance-to-your-azure-subscription), you'll see this tile: + +![Update Compliance tile no data](images/UC_tile_assessing.png) + +When the solution is added, data is not immediately available. Data will begin to be collected after data is sent up that belongs to the Commercial ID associated with the device. This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Update Compliance](update-compliance-get-started.md#enroll-devices-in-update-compliance). After Microsoft has collected and processed any device data associated with your Commercial ID, the tile will be replaced with the following summary: + +![Update Compliance tile with data](images/UC_tile_filled.png) + +The summary details the total number of devices that Microsoft has received data from with your Commercial ID. It also provides the number of devices that need attention if any. Finally, it details the last point at which your Update Compliance workspace was refreshed. + +## The Update Compliance workspace + +![Update Compliance workspace view](images/UC_workspace_needs_attention.png) + +When you select this tile, you will be redirected to the Update Compliance workspace. The workspace is organized with the Overview blade providing a hub from which to navigate to different reports of your devices' data. + +### Overview blade + +![The Overview blade](images/UC_workspace_overview_blade.png) + +Update Compliance's overview blade summarizes all the data Update Compliance provides. It functions as a hub from which you can navigate to different sections. The total number of devices detected by Update Compliance is reported in the title of this blade. What follows is a distribution for all devices as to whether they are up to date on the following items: +* Security updates: A device is up to date on quality updates whenever it has the latest applicable quality update installed. Quality updates are monthly cumulative updates that are specific to a version of Windows 10. +* Feature updates: A device is up to date on feature updates whenever it has the latest applicable feature update installed. Update Compliance considers [Servicing Channel](waas-overview.md#servicing-channels) when determining update applicability. +* AV Signature: A device is up to date on Antivirus Signature when the latest Windows Defender Signatures have been downloaded. This distribution only considers devices that are running Microsoft Defender Antivirus. + +The blade also provides the time at which your Update Compliance workspace was [refreshed](#update-compliance-data-latency). + +The following is a breakdown of the different sections available in Update Compliance: +* [Need Attention!](update-compliance-need-attention.md) - This section is the default section when arriving to your Update Compliance workspace. It provides a summary of the different issues devices are facing relative to Windows 10 updates. +* [Security Update Status](update-compliance-security-update-status.md) - This section lists the percentage of devices that are on the latest security update released for the version of Windows 10 it is running. Selecting this section provides blades that summarize the overall status of security updates across all devices and a summary of their deployment progress towards the latest two security updates. +* [Feature Update Status](update-compliance-feature-update-status.md) - This section lists the percentage of devices that are on the latest feature update that is applicable to a given device. Selecting this section provides blades that summarize the overall feature update status across all devices and a summary of deployment status for different versions of Windows 10 in your environment. +* [Delivery Optimization Status](update-compliance-delivery-optimization.md) - This section summarizes bandwidth savings incurred by utilizing Delivery Optimization in your environment. It provides a breakdown of Delivery Optimization configuration across devices, and summarizes bandwidth savings and utilization across multiple content types. + + +## Update Compliance data latency +Update Compliance uses Windows 10 diagnostic data as its data source. After you add Update Compliance and appropriately configure your devices, it could take 48-72 hours before they first appear. + +The data powering Update Compliance is refreshed every 24 hours, and refreshes with the latest data from all devices part of your organization that have been seen in the past 28 days. The entire set of data is refreshed in each daily snapshot, which means that the same data can be re-ingested even if no new data actually arrived from the device since the last snapshot. Snapshot time can be determined by the TimeGenerated field for each record, while LastScan can be used to roughly determine the freshness of each record's data. + +| Data Type | Data upload rate from device | Data Latency | +|--|--|--| +|WaaSUpdateStatus | Once per day |4 hours | +|WaaSInsiderStatus| Once per day |4 hours | +|WaaSDeploymentStatus|Every update event (Download, install, etc.)|24-36 hours | +|WUDOAggregatedStatus|On update event, aggregated over time|24-36 hours | +|WUDOStatus|Once per day|12 hours | + +This means you should generally expect to see new data device data every 24 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours. + +## Using Log Analytics + +Update Compliance is built on the Log Analytics platform that is integrated into Operations Management Suite. All data in the workspace is the direct result of a query. Understanding the tools and features at your disposal, all integrated within Azure Portal, can deeply enhance your experience and complement Update Compliance. + +See below for a few topics related to Log Analytics: +* Learn how to effectively execute custom Log Searches by referring to Microsoft Azure's excellent documentation on [querying data in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-searches). +* To develop your own custom data views in Operations Management Suite or [Power BI](https://powerbi.microsoft.com/); check out documentation on [analyzing data for use in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-dashboards). +* [Gain an overview of Log Analytics' alerts](https://docs.microsoft.com/azure/log-analytics/log-analytics-alerts) and learn how to use it to always stay informed about the most critical issues you care about. + +## Related topics + +[Get started with Update Compliance](update-compliance-get-started.md) diff --git a/windows/deployment/update/update-compliance-wd-av-status.md b/windows/deployment/update/update-compliance-wd-av-status.md deleted file mode 100644 index 35deef9366..0000000000 --- a/windows/deployment/update/update-compliance-wd-av-status.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Update Compliance - Windows Defender AV Status report -ms.reviewer: -manager: laurawi -description: an overview of the Windows Defender AV Status report -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-analytics -ms.topic: article ---- - -# Windows Defender AV Status - -![The Windows Defender AV Status report](images/UC_workspace_WDAV_status.png) - -The Windows Defender AV Status section deals with data concerning signature and threat status for devices that use Windows Defender Antivirus. The section tile in the [Overview Blade](update-compliance-using.md#overview-blade) provides the percentage of devices with insufficient protection – this percentage only considers devices using Windows Defender Antivirus. - ->[!NOTE] ->Update Compliance's Windows Defender Antivirus status is compatible with E3, B, F1, VL Professional and below licenses. Devices with an E5 license are not shown here; devices with an E5 license can be monitored using the [Windows Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection). If you'd like to learn more about Windows 10 licensing, see the [Windows 10 product licensing options](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx). - -# Windows Defender AV Status sections -The **Protection Status** blade gives a count for devices that have either out-of-date signatures or real-time protection turned off. Below, it gives a more detailed breakdown of the two issues. Selecting any of these statuses will navigate you to a Log Search view containing the query. - -The **Threat Status** blade shows, among devices that have encountered threats, how many were and were not remediated successfully. It also provides a detailed count. Selecting either of these will take you to the respective query in Log Search for further investigation. - -Here are some important terms to consider when using the Windows Defender AV Status section of Update Compliance: -* **Signature out of date** devices are devices with a signature older than 14 days. -* **No real-time protection** devices are devices that are using Windows Defender AV but have turned off real-time protection. -* **Recently disappeared** devices are devices that were previously seen by Windows Defender AV and are no longer seen in the past 7 days. -* **Remediation failed** devices are devices where Windows Defender AV failed to remediate the threat. This could be due to a number of reasons, including a full disk, network error, operation aborted, etc. Manual intervention might be needed from IT team. -* **Not assessed** devices are devices where either a non-Microsoft AV solution is used or it has been more than 7 days since the device recently disappeared. - -## Windows Defender data latency -Because of the way Windows Defender is associated with the rest of Windows device data, Defender data for new devices might take much longer to appear than other data types. This process could take up to 28 days. - -## Related topics - -- [Windows Defender Antivirus pre-requisites](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting#confirm-pre-requisites) diff --git a/windows/deployment/update/update-policies.md b/windows/deployment/update/update-policies.md new file mode 100644 index 0000000000..58e2b5e496 --- /dev/null +++ b/windows/deployment/update/update-policies.md @@ -0,0 +1,203 @@ +--- +title: Policies for update compliance, activity, and end-user experience +ms.reviewer: +manager: laurawi +description: +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: M365-modern-desktop +--- + +# Policies for update compliance, activity, and end-user experience +Keeping devices up to date is the best way to keep them working smoothly and securely. + +## Deadlines for update compliance + +You can control how strictly devices must reliably keep to your desired update schedule by using update deadline policies. Windows components adapt based on these deadlines. Also, they can make tradeoffs between user experience and velocity in order to meet your desired update deadlines. For example, they can prioritize user experience well before the +deadline approaches, and then prioritize velocity as the deadline nears, while still affording the user some control. + +### Deadlines + +Beginning with Windows 10, version 1903 and with the August 2019 security update for Windows 10, version 1709 +and late, a new policy was introduced to replace older deadline-like policies: **Specify deadlines for automatic updates and restarts**. + +The older policies started enforcing deadlines once the device reached a “restart pending” state for +an update. The new policy starts the countdown for the update installation deadline from when the +update is published plus any deferral. In addition, this policy includes a configurable grace period and the option +to opt out of automatic restarts until the deadline is reached (although we recommend always allowing automatic +restarts for maximum update velocity). + +> [!IMPORTANT] +> If you use the new **Specify deadlines for automatic updates and restarts** setting in Windows 10, +> version 1903, you must disable the [older deadline policies](wufb-compliancedeadlines.md#prior-to-windows-10-version-1709) because they could conflict. + +We recommend you set deadlines as follows: +- Quality update deadline, in days: 3 +- Feature update deadline, in days: 7 +- +Notifications are automatically presented to the user at appropriate times, and users can choose to be reminded +later, to reschedule, or to restart immediately, depending on how close the deadline is. We recommend that you +do **not** set any notification policies, because they are automatically configured with appropriate defaults. An exception is if you +have kiosks or digital signage. + +While three days for quality updates and seven days for feature updates is our recommendation, you might decide +you want more or less, depending on your organization and its requirements, and this policy is configurable down +to a minimum of two days. + + +> [!IMPORTANT] +> If the device is unable to reach the Internet, it can't determine when Microsoft +> published the update, so it won't be able to enforce the deadline. Learn more about [low activity devices](#device-activity-policies). + +### Grace periods + +You can set a period of days for Windows to find a minimally disruptive automatic restart time before the restart is enforced. This +is especially useful in cases where a user has been away for many days (for example, on vacation) so that the device will not +be forced to update immediately when the user returns. + +We recommend you set the following: + +- Grace period, in days: 2 + +Once the deadline and grace period have passed, updates are applied automatically, and a restart occurs +regardless of [active hours](#active-hours). + + +### Let Windows choose when to restart + +Windows can use user interactions to dynamically identify the least disruptive time for an +automatic restart. To take advantage of this feature, ensure **ConfigureDeadlineNoAutoReboot** is set to +**Disabled**. + +## Device activity policies + +Windows typically requires that a device is active and connected to the internet for at least six hours, with at least two +of continuous activity, in order to successfully complete a system update. The device could have other +physical circumstances that prevent successful installation of an update--for example, if a laptop is running low +on battery power, or the user has shut down the device before active hours end and the device cannot comply +with the deadline. + +You can use the settings in this section to ensure that devices are actually available to install updates during the update compliance period. + +### Active hours + +"Active hours" identify the period of time when a device is expected to be in use. Normally, restarts will occur outside of +these hours. Windows 10, version 1903 introduced "intelligent active hours," which allow the system to learn active hours based on a user’s activities, rather than you as an administrator having to make decisions for your organization or allowing the user to choose active hours that minimize the period when the system can install an update. + +> [!IMPORTANT] +> If you used the **Configure Active Hours** setting in previous versions of Windows 10, these +options must be **Disabled** in order to take advantage of intelligent active hours. + +If you do set active hours, we recommend setting the following policies to **Disabled** in order to increase update +velocity: + +- [Delay automatic reboot](waas-restart.md#delay-automatic-reboot). While it’s possible to set the system to delay restarts for users who are logged +in, this might delay an update indefinitely if a user is always either logged in or shut down. Instead, we +recommend setting the following polices to **Disabled**: + - **Turn off auto-restart during active hours** + - **No auto-restart with logged on users for scheduled automatic updates** + + - [Limit restart delays](waas-restart.md#limit-restart-delays). By using compliance deadlines, your users will receive notifications that +updates will occur, so we recommend that you set this policy to **Disabled**, to allow compliance deadlines to eliminate the user’s ability to delay a restart outside of compliance deadline settings. + +- **Do not allow users to approve updates and reboots**. Letting users approve or engage with the update process outside of the deadline policies decreases update velocity and increases risk. These policies should be set to **Disabled**: + - [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval) + - [Update/EngagedRestartDeadline](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartdeadline) + - [Update/EngagedRestartDeadlineForFeatureUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartdeadlineforfeatureupdates) + - [Update/EngagedRestartSnoozeSchedule](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartsnoozeschedule) + - [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartsnoozescheduleforfeatureupdates) + - [Update/EngagedRestartTransitionSchedule](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestarttransitionschedule) + +- [Configure automatic update](waas-wu-settings.md#configure-automatic-updates). By properly setting policies to configure automatic updates, you can increase update velocity by having clients contact a Windows Server Update Services (WSUS) server so it can manage them. We recommend that you set this policy to **Disabled**. However, if you need to provide values, ensure that you set downloads to install automatically by setting the [Group Policy](waas-manage-updates-wsus.md#configure-automatic-updates-and-update-service-location) to **4**. If you’re using Microsoft Intune, setting the value to [Reset to Default](https://docs.microsoft.com/mem/intune/protect/windows-update-settings#user-experience-settings). +- **Allow auto Windows Update to download over metered networks**. Since more and more devices primarily use cellular data and do not have wi-fi access, consider allowing users to automatically download updates from a metered network. Though the default setting does not allow download over a metered network, setting this value to **1** can increase velocity by enabling users to get updates whether they are connected to the internet or not, provided they have cellular service. + +> [!IMPORTANT] +> Older versions of Windows don't support intelligent active hours. If your device runs a version of Windows prior to Windows 10, version 1903, we recommend setting the following policies: +>- [Configure active hours](waas-restart.md#configure-active-hours). Starting with Windows 10, version 1703, you can specify a maximum active-hour range which is counted from the active hours start time. We recommend setting +this value to **10**. +>- [Schedule update installation](waas-restart.md#schedule-update-installation). In the **Configure Automatic Updates** settings, there are two ways to control a forced restart after a specified installation time. If you use **schedule update installation**, do not enable both settings because they will most likely conflict. +> - **Specify automatic maintenance time**. This setting lets you set broader maintenance windows for updates and ensures that this schedule does not conflict with active hours. We +recommend setting this value to **3** (corresponding to 3 AM). If 3:00 AM is in the middle of the work shift, pick another time that is at least a couple hours before your scheduled work time begins. +> - **Schedule the install time**. This setting allows you to schedule an installation time for a restart. We do *not* recommend you set this to **Disabled** as it could conflict with active hours. + +### Power policies + +Devices must actually be available during non-active hours in order to an update. They can't do this if power policies prevent them from waking up. In our organization, we strive to set a balance between security and eco-friendly configurations. We recommend the following settings to achieve what we feel are the appropriate tradeoffs: + +To a user, a device is either on or off, but for Windows, there are states that will allow an update to occur (active) and states that do not (inactive). Some states are considered active (sleep), but the user may think the device is off. Also, there are power statuses (plugged in/battery) that Windows checks before starting an update. + +You can override the default settings and prevent users from changing them in order to ensure that devices are available for updates during non-active hours. + +> [!NOTE] +> One way to ensure that devices can install updates when you need them to is to educate your users to keep devices plugged in during non-active hours. Even with the best policies, a device that isn't plugged in will not be updated, even in sleep mode. + +We recommend these power management settings: + +- Sleep mode (S1 or S0 Low Power Idle or [Modern Standby](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby)). When a device is in sleep mode, the system +appears to be off but if an update is available, it can wake the device up in order to take an update. The +power consumption in sleep mode is between working (system fully usable) and hibernate (S4 - lowest +power level before shutdown). When a device is not being used, the system will generally move to sleep +mode before it goes to hibernate. Issues in velocity arise when the time between sleep and hibernate is +too short and Windows does not have time to complete an update. Sleep mode is an important setting +because the system can wake the system from sleep in order to start the update process, as long as there +is enough power. + +Set the following policies to **Enable** or **Do Not Configure** in order to allow the device to use sleep mode: +- [Power/AllowStandbyStatesWhenSleepingOnBattery](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactionpluggedin) + +Set the following policies to **1 (Sleep)** so that when a user closes the lid of a device, the system goes to +sleep mode and the device has an opportunity to take an update: +- [Power/SelectLidCloseActionOnBattery](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactiononbattery) +- [Power/SelectLidCloseActionPluggedIn](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactionpluggedin) + +- **Hibernate**. When a device is hibernating, power consumption is very low and the system cannot wake up +without user intervention, like pressing the power button. If a device is in this state, it cannot be updated +unless it supports an ACPI Time and Alarm Device (TAD). That said, if a device supporting Traditional Sleep +(S3) is plugged in, and a Windows update is available, a hibernate state will be delayed until the update is complete. + +> [!NOTE] +> This does not apply to devices that support Modern Standby (S0 Low Power Idle). You can check which system sleep state (S3 or S0 Low Power Idle) a device supports by running `powercfg /a` at a command prompt. For more, see [Powercfg options](https://docs.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options#option_availablesleepstates). + +The default timeout on devices that support traditional sleep is set to three hours. We recommend that you do not reduce these policies in order to allow Windows Update the opportunity to restart the device before sending it into hibernation: + +- [Power/HibernateTimeoutOnBattery](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-hibernatetimeoutpluggedin) + +## Old or conflicting policies + +Each release of Windows 10 can introduce new policies to make the experience better for both administrators and their organizations. When we release a new client policy, we either release it purely for that release and later or we backport the policy to make it available on earlier versions. + +> [!IMPORTANT] +> If you are using Group Policy, note that we don't update the old ADMX templates and you must use the newer (1903) ADMX template in order to use the newer policy. Also, if you are +> using an MDM tool (Microsoft or non-Microsoft), you can't use the new policy until it's available in the tool interface. + +As administrators, you have set up and expect certain behaviors, so we expressly do not remove older policies since they were set up for your particular use cases. However, if you set a new policy without disabling a similar older policy, you could have conflicting behavior and updates might not perform as expected. + +> [!IMPORTANT] +> We sometimes find that administrators set devices to get both Group Policy settings and MDM settings from an MDM server such as Microsoft Intune. Policy conflicts are handled differently, depending on how they are ultimately set up: +> - Windows updates: Group Policy settings take precedence over MDM. +> - Microsoft Intune: If you set different values for the same policy on two different groups, you will +> receive an alert and neither policy will be set until the conflict is resolved. +> It is crucial that you disable conflicting policies in order for devices in your organization to take updates as +> expected. For example, if a device is not reacting to your MDM policy changes, check to see if a similar +> policy is set in Group Policy with a differing value. +> If you find that update velocity is not as high as you expect or if some devices are slower than others, it might be +> time to clear all polices and settings and specify only the recommended update policies. See the Policy and settings reference for a consolidated list of recommended polices. + +The following are policies that you might want to disable because they could decrease update velocity or there are better policies to use that might conflict: +- **Defer Feature Updates Period in Days**. For maximum update velocity, it's best to set this to **0** (no +deferral) so that the feature update can complete and monthly security updates will be offered again. Even if there is an urgent quality update that must be quickly deployed, it is best to use **Pause Feature +Updates** rather than setting a deferral policy. You can choose a longer period if you don't want to stay up to date with the latest feature update. +- **Defer Quality Updates Period in Days**. To minimize risk and maximize update velocity, the maximum time you might want to consider while evaluating the update with a different ring of devices is two to three days. +- **Pause Feature Updates Start Time**. Set to **Disabled** unless there is a known issue requiring time for a resolution. +- **Pause Quality Updates Start Time**. Set to **Disabled** unless there is a known issue requiring time for a resolution. +- **Deadline No Auto Reboot**. Default is **Disabled – Set to 0** . We recommend that devices automatically try to restart when an update is received. Windows uses user interactions to dynamically identify the least disruptive time to restart. + +There are additional policies are no longer supported or have been superseded. diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 6e8a4ba345..f85076eabc 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -1,16 +1,15 @@ --- title: Configure BranchCache for Windows 10 updates (Windows 10) -description: Use BranchCache to optimize network bandwidth during update deployment. +description: In this article, learn how to use BranchCache to optimize network bandwidth during update deployment. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/27/2017 +ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Configure BranchCache for Windows 10 updates @@ -22,7 +21,7 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and System Center Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it’s easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. +BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it's easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. - Distributed Cache mode operates like the [Delivery Optimization](waas-delivery-optimization.md) feature in Windows 10: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. @@ -35,13 +34,13 @@ For detailed information about how Distributed Cache mode and Hosted Cache mode ## Configure clients for BranchCache -Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](https://technet.microsoft.com/library/dd637820%28v=ws.10%29.aspx) in the [BranchCache Early Adopter’s Guide](https://technet.microsoft.com/library/dd637762(v=ws.10).aspx). +Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](https://technet.microsoft.com/library/dd637820%28v=ws.10%29.aspx) in the [BranchCache Early Adopter's Guide](https://technet.microsoft.com/library/dd637762(v=ws.10).aspx). In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows 10, simply set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. ## Configure servers for BranchCache -You can use WSUS and Configuration Manager with BranchCache in Distributed Cache mode. BranchCache in Distributed Cache mode is easy to configure for both WSUS and System Center Configuration Manager. +You can use WSUS and Configuration Manager with BranchCache in Distributed Cache mode. BranchCache in Distributed Cache mode is easy to configure for both WSUS and Microsoft Endpoint Configuration Manager. For a step-by-step guide to configuring BranchCache on Windows Server devices, see the [BranchCache Deployment Guide (Windows Server 2012)](https://technet.microsoft.com/library/jj572990) or [BranchCache Deployment Guide (Windows Server 2016)](https://technet.microsoft.com/windows-server-docs/networking/branchcache/deploy/branchcache-deployment-guide). diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index c6b56e8162..68b9bc63f3 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -5,7 +5,7 @@ manager: laurawi description: You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library +ms.collection: m365initiative-coredeploy audience: itpro author: jaimeo ms.localizationpriority: medium @@ -48,7 +48,7 @@ With Windows Update for Business, you can set a device to be on either Windows I **Release branch policies** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 or later:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\BranchReadinessLevel | | GPO for Windows 10, version 1511:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpgrade | @@ -73,7 +73,7 @@ For example, a device on the Semi-Annual Channel with `DeferFeatureUpdatesPeriod

              **Policy settings for deferring feature updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 later:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdates
              \Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdatesPeriodInDays | | GPO for Windows 10, version 1511:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpgradePeriod | @@ -97,11 +97,11 @@ In cases where the pause policy is first applied after the configured start date **Policy settings for pausing feature updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 10, version 1607 and later:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | **1607:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdates
              **1703 and later:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdatesStartDate | +| GPO for Windows 10, version 1607 and later:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | **1607:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdates
              **1703 and later:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdatesStartTime | | GPO for Windows 10, version 1511:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\Pause | -| MDM for Windows 10, version 1607 and later:
              ../Vendor/MSFT/Policy/Config/Update/
              **PauseFeatureUpdates** | **1607:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdates
              **1703 and later:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdatesStartDate | +| MDM for Windows 10, version 1607 and later:
              ../Vendor/MSFT/Policy/Config/Update/
              **PauseFeatureUpdates** | **1607:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdates
              **1703 and later:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdatesStartTime | | MDM for Windows 10, version 1511:
              ../Vendor/MSFT/Policy/Config/Update/
              **DeferUpgrade** | \Microsoft\PolicyManager\default\Update\Pause | You can check the date that Feature Updates were paused by checking the registry key **PausedFeatureDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. @@ -125,16 +125,16 @@ Starting with Windows 10, version 1703, using Settings to control the pause beha ## Configure when devices receive Quality Updates -Quality Updates are typically published on the first Tuesday of every month, although they can be released at any time. You can define if, and for how long, you would like to defer receiving Quality Updates following their availability. You can defer receiving these Quality Updates for a period of up to 35 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value. +Quality updates are typically published on the first Tuesday of every month, although they can be released at any time. You can define if, and for how long, you would like to defer receiving Quality updates following their availability. You can defer receiving these quality updates for a period of up to 30 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value. -You can set your system to receive updates for other Microsoft products—known as Microsoft Updates (such as Microsoft Office, Visual Studio)—along with Windows Updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft Updates will follow the same deferral and pause rules as all other Quality Updates. +You can set your system to receive updates for other Microsoft products—known as Microsoft updates (such as Microsoft Office, Visual Studio)—along with Windows updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft updates will follow the same deferral and pause rules as all other quality updates. >[!IMPORTANT] >This policy defers both Feature and Quality Updates on Windows 10 Mobile Enterprise. **Policy settings for deferring quality updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 and later:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Quality Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdates
              \Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdatesPeriodInDays | | GPO for Windows 10, version 1511:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpdatePeriod | @@ -146,7 +146,7 @@ You can set your system to receive updates for other Microsoft products—known ## Pause quality updates -You can also pause a system from receiving Quality Updates for a period of up to 35 days from when the value is set. After 35 days has passed, the pause setting will automatically expire and the device will scan Windows Update for applicable quality Updates. Following this scan, you can then pause quality Updates for the device again. +You can also pause a system from receiving quality updates for a period of up to 35 days from when the value is set. After 35 days have passed, the pause setting will automatically expire and the device will scan Windows Update for applicable quality updates. Following this scan, you can then pause quality updates for the device again. Starting with Windows 10, version 1703, when you configure a pause by using policy, you must set a start date for the pause to begin. The pause period is calculated by adding 35 days to this start date. @@ -157,7 +157,7 @@ In cases where the pause policy is first applied after the configured start date **Policy settings for pausing quality updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 and later:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Quality Updates are received** |**1607:** \Policies\Microsoft\Windows\WindowsUpdate\PauseQualityUpdates
              **1703:** \Policies\Microsoft\Windows\WindowsUpdate\PauseQualityUpdatesStartTime | | GPO for Windows 10, version 1511:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\Pause | @@ -190,7 +190,7 @@ Starting with Windows 10, version 1709, you can set policies to manage preview b The **Manage preview builds** setting gives administrators control over enabling or disabling preview build installation on a device. You can also decide to stop preview builds once the release is public. * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* * MDM: **Update/ManagePreviewBuilds** -* System Center Configuration Manager: **Enable dual scan, manage through Windows Update for Business policy** +* Microsoft Endpoint Configuration Manager: **Enable dual scan, manage through Windows Update for Business policy** >[!IMPORTANT] >This policy replaces the "Toggle user control over Insider builds" policy under that is only supported up to Windows 10, version 1703. You can find the older policy here: @@ -201,13 +201,13 @@ The policy settings to **Select when Feature Updates are received** allows you t * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* * MDM: **Update/BranchReadinessLevel** -## Exclude drivers from Quality Updates +## Exclude drivers from quality updates -Starting with Windows 10, version 1607, you can selectively opt out of receiving driver update packages as part of your normal quality update cycle. This policy will not apply to updates to drivers provided with the operating system (which will be packaged within a security or critical update) or to Feature Updates, where drivers might be dynamically installed to ensure the Feature Update process can complete. +Starting with Windows 10, version 1607, you can selectively opt out of receiving driver update packages as part of your normal quality update cycle. This policy will not apply to updates to drivers provided with the operating system (which will be packaged within a security or critical update) or to feature updates, where drivers might be dynamically installed to ensure the feature update process can complete. **Policy settings to exclude drivers** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 and later:
              Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Do not include drivers with Windows Updates** | \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | | MDM for Windows 10, version 1607 and later:
              ../Vendor/MSFT/Policy/Config/Update/
              **ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | @@ -220,13 +220,13 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| BranchReadinessLevel | REG_DWORD | 2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
              4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
              8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
              16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel
              32: systems take Feature Updates from Semi-annual Channel
              Note: Other value or absent: receive all applicable updates | +| BranchReadinessLevel | REG_DWORD | 2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
              4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
              8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
              16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-Annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-Annual Channel
              32: systems take Feature Updates from Semi-Annual Channel
              Note: Other value or absent: receive all applicable updates | | DeferQualityUpdates | REG_DWORD | 1: defer quality updates
              Other value or absent: don’t defer quality updates | | DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days | -| PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates
              Other value or absent: don’t pause quality updates | +| PauseQualityUpdatesStartTime | REG_DWORD | 1: pause quality updates
              Other value or absent: don’t pause quality updates | |DeferFeatureUpdates | REG_DWORD | 1: defer feature updates
              Other value or absent: don’t defer feature updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: defer feature updates by given days | -| PauseFeatureUpdatesStartDate | REG_DWORD |1: pause feature updates
              Other value or absent: don’t pause feature updates | +| PauseFeatureUpdatesStartTime | REG_DWORD |1: pause feature updates
              Other value or absent: don’t pause feature updates | | ExcludeWUDriversInQualityUpdate | REG_DWORD | 1: exclude Windows Update drivers
              Other value or absent: offer Windows Update drivers | @@ -234,11 +234,11 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| BranchReadinessLevel | REG_DWORD |2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
              4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
              8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
              16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel
              32: systems take Feature Updates from Semi-annual Channel
              Note: Other value or absent: receive all applicable updates | +| BranchReadinessLevel | REG_DWORD |2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
              4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
              8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
              16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-Annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-Annual Channel
              32: systems take Feature Updates from Semi-Annual Channel
              Note: Other value or absent: receive all applicable updates | | DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days | -| PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates
              Other value or absent: don’t pause quality updates | +| PauseQualityUpdatesStartTime | REG_DWORD | 1: pause quality updates
              Other value or absent: don’t pause quality updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: defer feature updates by given days | -| PauseFeatureUpdatesStartDate | REG_DWORD | 1: pause feature updates
              Other value or absent: don’t pause feature updates | +| PauseFeatureUpdatesStartTime | REG_DWORD | 1: pause feature updates
              Other value or absent: don’t pause feature updates | | ExcludeWUDriversinQualityUpdate | REG_DWORD | 1: exclude Windows Update drivers
              Other value or absent: offer Windows Update drivers | ## Update devices to newer versions @@ -273,5 +273,5 @@ When a device running a newer version sees an update available on Windows Update - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) - [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index fec88b2720..d65d59a04d 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -2,17 +2,17 @@ title: Delivery Optimization reference ms.reviewer: manager: laurawi -description: Reference of all Delivery Optimization settings and descriptions of same +description: This article provides a summary of references and descriptions for all of the Delivery Optimization settings. keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library audience: itpro -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greglin +ms.author: jaimeo ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Delivery Optimization reference @@ -23,7 +23,7 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -There are a great many details you can set in Delivery Optimization to customize it to do just what you need it to. This topic summarizes them for your reference. +There are a great many details you can set in Delivery Optimization to customize it to do just what you need it to. This topic summarizes them for your reference. If you just need an overview of Delivery Optimization, see [Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). If you need information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md). ## Delivery Optimization options @@ -47,9 +47,9 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Absolute Max Cache Size](#absolute-max-cache-size) | DOAbsoluteMaxCacheSize | 1607 | | [Modify Cache Drive](#modify-cache-drive) | DOModifyCacheDrive | 1607 | | [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size) | DOMinFileSizeToCache | 1703 | -| [Maximum Download Bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 | -| [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 | -| [Max Upload Bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 | +| [Maximum Download Bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 (removed in Windows 10, version 2004; use [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)| +| [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 (removed in Windows 10, version 2004; use [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)| +| [Max Upload Bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 (removed in Windows 10, version 2004) | | [Monthly Upload Data Cap](#monthly-upload-data-cap) | DOMonthlyUploadDataCap | 1607 | | [Minimum Background QoS](#minimum-background-qos) | DOMinBackgroundQoS | 1607 | | [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1709 | @@ -64,6 +64,10 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 | | [Delay foreground download cache server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackForeground | 1903 | | [Delay background download cache server fallback (in secs)](#delay-background-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackBackground | 1903 | +| [Cache Server Hostname](#cache-server-hostname) | DOCacheHost | 2004 | +| [Cache Server Hostname Source](#cache-server-hostname-source) | DOCacheHostSource | 2004 | +| [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxForegroundDownloadBandwidth | 2004 | +| [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxBackgroundDownloadBandwidth | 2004 | ### More detail on Delivery Optimization settings: @@ -107,10 +111,10 @@ Download mode dictates which download sources clients are allowed to use when do | --- | --- | | HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content over HTTP from the download's original source. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. | | LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. The Delivery Optimization cloud service finds other clients that connect to the Internet using the same public IP as the target client. These clients then attempts to connect to other peers on the same network by using their private subnet IP.| -| Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | +| Group (2) | When group mode is set, the group is automatically selected based on the device's Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | -|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using SCCM. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | +|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | >[!NOTE] >Group mode is a best-effort optimization and should not be relied on for an authentication of identity of devices participating in the group. @@ -119,7 +123,7 @@ Download mode dictates which download sources clients are allowed to use when do By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and Active Directory Domain Services site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or Active Directory Domain Services site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. -[//]: # (SCCM Boundary Group option; GroupID Source policy) +[//]: # (Configuration Manager boundary group option; GroupID Source policy) >[!NOTE] >To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/) @@ -132,9 +136,10 @@ Starting in Windows 10, version 1803, set this policy to restrict peer selection - 1 = AD Site - 2 = Authenticated domain SID - 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID) -- 4 = DNS Suffix +- 4 = DNS Suffix +- 5 = Starting with Windows 10, version 1903, you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. -When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-4, the policy is ignored. +When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-5, the policy is ignored. ### Minimum RAM (inclusive) allowed to use Peer Caching @@ -151,7 +156,7 @@ This setting specifies the required minimum disk size (capacity in GB) for the d ### Max Cache Age -In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). +In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to "0" which means "unlimited" to avoid peers re-downloading content. When "Unlimited" value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). ### Max Cache Size @@ -183,7 +188,7 @@ This setting specifies the maximum download bandwidth that Delivery Optimization ### Max Upload Bandwidth -This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or “unlimited” which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate. +This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or "unlimited" which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate. ### Set Business Hours to Limit Background Download Bandwidth Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. @@ -231,4 +236,33 @@ The device can download from peers while on battery regardless of this policy. >[!IMPORTANT] > By default, devices **will not upload while on battery**. To enable uploads while on battery, you need to enable this policy and set the battery value under which uploads pause. +### Cache Server Hostname +Set this policy to to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma separated, for example: myhost.somerandomhost.com,myhost2.somrandomhost.com,10.10.1.7. + + +### Cache Server Hostname Source + +This policy allows you to specify how your client(s) can discover Delivery Optimization in Network Cache servers dynamically. There are two options: +- 1 = DHCP Option 235. +- 2 = DHCP Option 235 Force. + +With either option, the client will query DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if set. + +Set this policy to designate one or more Delivery Optimization in Network Cache servers through a custom DHCP Option. Specify the custom DHCP option on your server as *text* type. You can add one or more values as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address with commas. + +> [!NOTE] +> If you format the DHCP Option ID incorrectly, the client will fall back to the Cache Server Hostname policy value if that value has been set. + +### Maximum Foreground Download Bandwidth (in KB/s) + +Specifies the maximum foreground download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. + +The default value of 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. + + +### Maximum Background Download Bandwidth (in KB/s) + +Specifies the maximum background download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. + +The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/update/waas-delivery-optimization-setup.md index f21112405f..6e19c5ba6a 100644 --- a/windows/deployment/update/waas-delivery-optimization-setup.md +++ b/windows/deployment/update/waas-delivery-optimization-setup.md @@ -1,190 +1,225 @@ ---- -title: Set up Delivery Optimization -ms.reviewer: -manager: laurawi -description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10 -keywords: oms, operations management suite, wdav, updates, downloads, log analytics -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Set up Delivery Optimization for Windows 10 updates - -**Applies to** - -- Windows 10 - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -## Recommended Delivery Optimization settings - -Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greates impact if particular situations exist in your deployment: - -- Does your topology include multiple breakouts to the internet (i.e., a "hybrid WAN") or are there only a few connections to the internet, so that all requests appear to come from a single external IP address (a "hub and spoke" topology)? -- If you use boundary groups in your topology, how many devices are present in a given group? -- What percentage of your devices are mobile? -- Do your devices have a lot of free space on their drives? -- Do you have a lab scenario with many devices on AC power? - ->[!NOTE] ->These scenarios (and the recommended settings for each) are not mutually exclusive. It's possible that your deployment might involve more than one of these scenarios, in which case you can employ the related settings in any combination as needed. In all cases, however, "download mode" is the most important one to set. - -Quick-reference table: - -| Use case | Policy | Recommended value | Reason | -| --- | --- | --- | --- | -| Hub & spoke topology | Download mode | 1 or 2 | Automatic grouping of peers to match your topology | -| Sites with > 30 devices | Minimum file size to cache | 10 MB (or 1 MB) | Leverage peers-to-peer capability in more downloads | -| Large number of mobile devices | Allow uploads on battery power | 60% | Increase # of devices that can upload while limiting battery drain | -| Labs with AC-powered devices | Content Expiration | 7 (up to 30) days | Leverage devices that can upload more for a longer period | - - -### Hybrid WAN scenario - -For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter. - - - - -To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**. - -To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DODownloadMode to 1 or 2. - -### Hub and spoke topology with boundary groups - -The default download mode setting is **1**; this means all devices breaking out to the internet using the same public IP will be considered as a single peer group. To prevent peer-to-peer activity across groups, you should set the download mode to **2**. If you have already defined Active Directory sites per hub or branch office, then you don't need to do anything else. If you're not using Active Directory sites, you should set *RestrictPeerSelectionBy* policies to restrict the activity to the subnet or set a different source for Groups by using the GroupIDSrc parameter. See [Select a method to restrict peer selection](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection). - - - -To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**. - -To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DODownloadMode** to **2**. - - -### Large number of mobile devices - -If you have a mobile workforce with a great many mobile devices, set Delivery Optimization to allow uploads on battery power, while limiting the use to prevent battery drain. A setting for **DOMinBatteryPercentageAllowedToUpload** of 60% is a good starting point, though you might want to adjust it later. - -To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Allow uploads while the device is on battery while under set Battery level** to 60. - -To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinBatteryPercentageAllowedToUpload** to 60. - -### Plentiful free space and large numbers of devices - -Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you have more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you have more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB. - -[//]: # (default of 50 aimed at consumer) - -To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices). - -To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinFileSizeToCache** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices). - -### Lab scenario - -In a lab situation, you typically have a large number of devices that are plugged in and have a lot of free disk space. By increasing the content expiration interval, you can take advantage of these devices, using them as excellent upload sources in order to upload much more content over a longer period. - -To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Max Cache Age** to **6048000** (7 days) or more (up to 30 days). - -To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DOMaxCacheAge to 7 or more (up to 30 days). - -[//]: # (material about "preferred" devices; remove MinQos/MaxCacheAge; table format?) - - -## Monitor Delivery Optimization -[//]: # (How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%) - -### Windows PowerShell cmdlets - -**Starting in Windows 10, version 1703**, you can use new PowerShell cmdlets to check the performance of Delivery Optimization. - -#### Analyze usage - -`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs. - -| Key | Value | -| --- | --- | -| File ID | A GUID that identifies the file being processed | -| Priority | Priority of the download; values are **foreground** or **background** | -| FileSize | Size of the file | -| TotalBytesDownloaded | The number of bytes from any source downloaded so far | -| PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP | -| BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) | -| BytesfromHTTP | Total number of bytes received over HTTP | -| DownloadDuration | Total download time in seconds | -| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | -| NumPeers | Indicates the total number of peers returned from the service. | -| PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. | -| ExpireOn | The target expiration date and time for the file. | -| Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). | - -`Get-DeliveryOptimizationPerfSnap` returns a list of key performance data: - -- Number of files downloaded  -- Number of files uploaded  -- Total bytes downloaded  -- Total bytes uploaded  -- Average transfer size (download); that is, the number bytes downloaded divided by the number of files  -- Average transfer size (upload); the number of bytes uploaded divided by the number of files -- Peer efficiency; same as PercentPeerCaching - -Using the `-Verbose` option returns additional information: - -- Bytes from peers (per type)  -- Bytes from CDN (the number of bytes received over HTTP) -- Average number of peer connections per download  - -Starting in Window 10, version 1903, `get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status. - -Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. - -#### Manage the Delivery Optimization cache - -**Starting in Windows 10, version 1903:** - -`set-DeliveryOptimizationStatus -ExpireOn [date time]` extends the expiration of all files in the cache. You can set the expiration immediately for all files that are in the "caching" state. For files in progress ("downloading"), the expiration is applied once the download is complete. You can set the expiration up to one year from the current date and time. - -`set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]` extends expiration for a single specific file in the cache. - -You can now "pin" files to keep them persistent in the cache. You can only do this with files that are downloaded in modes 1, 2, or 3. - -`set-DeliveryOptimizationStatus -Pin [True] -File ID [FileID]` keeps a specific file in the cache such that it won't be deleted until the expiration date and time (which you set with `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]`). The file is also excluded from the cache quota calculation. - -`set-DeliveryOptimizationStatus -Pin [False] -File ID [FileID]` "unpins" a file, so that it will be deleted when the expiration date and time are rreached. The file is included in the cache quota calculation. - -`delete-DeliveryOptimizationCache` lets you clear files from the cache and remove all persisted data related to them. You can use these options with this cmdlet: - -- `-FileID` specifies a particular file to delete. -- `-IncludePinnedFiles` deletes all files that are pinned. -- `-Force` deletes the cache with no prompts. - - -#### Work with Delivery Optimization logs - -**Starting in Windows 10, version 1803:** - -`Get-DeliveryOptimizationLog [-Path ] [-Flush]` - -If `Path` is not specified, this cmdlet reads all logs from the dosvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops dosvc before reading logs. - -Log entries are written to the PowerShell pipeline as objects. To dump logs to a text file, run `Get-DeliveryOptimizationLog | Set-Content ` or something similar. - -[//]: # (section on what to look for in logs, list of peers, connection failures) - - - -[//]: # (possibly move to Troubleshooting) - -### Monitor with Update Compliance - -The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days. - -![DO status](images/UC_workspace_DO_status.png) - -For details, see [Delivery Optimization in Update Compliance](update-compliance-delivery-optimization.md). - +--- +title: Set up Delivery Optimization +ms.reviewer: +manager: laurawi +description: In this article, learn how to set up Delivery Optimization, a new peer-to-peer distribution method in Windows 10. +keywords: oms, operations management suite, wdav, updates, downloads, log analytics +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.collection: M365-modern-desktop +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Set up Delivery Optimization for Windows 10 updates + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +## Recommended Delivery Optimization settings + +Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greatest impact if particular situations exist in your deployment. If you just need an overview of Delivery Optimization, see [Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). + +- Does your topology include multiple breakouts to the internet (i.e., a "hybrid WAN") or are there only a few connections to the internet, so that all requests appear to come from a single external IP address (a "hub and spoke" topology)? +- If you use boundary groups in your topology, how many devices are present in a given group? +- What percentage of your devices are mobile? +- Do your devices have a lot of free space on their drives? +- Do you have a lab scenario with many devices on AC power? + +>[!NOTE] +>These scenarios (and the recommended settings for each) are not mutually exclusive. It's possible that your deployment might involve more than one of these scenarios, in which case you can employ the related settings in any combination as needed. In all cases, however, "download mode" is the most important one to set. + +> [!NOTE] +> Microsoft Intune includes a profile to make it easier to set Delivery Optimization policies. For details, see [Delivery Optimization settings for Intune](https://docs.microsoft.com/mem/intune/configuration/delivery-optimization-settings). + +Quick-reference table: + +| Use case | Policy | Recommended value | Reason | +| --- | --- | --- | --- | +| Hub & spoke topology | Download mode | 1 or 2 | Automatic grouping of peers to match your topology | +| Sites with > 30 devices | Minimum file size to cache | 10 MB (or 1 MB) | Leverage peers-to-peer capability in more downloads | +| Large number of mobile devices | Allow uploads on battery power | 60% | Increase # of devices that can upload while limiting battery drain | +| Labs with AC-powered devices | Content Expiration | 7 (up to 30) days | Leverage devices that can upload more for a longer period | + + +### Hybrid WAN scenario + +For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren't aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter. + + + + +To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**. + +To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DODownloadMode to 1 or 2. + +### Hub and spoke topology with boundary groups + +The default download mode setting is **1**; this means all devices breaking out to the internet using the same public IP will be considered as a single peer group. To prevent peer-to-peer activity across groups, you should set the download mode to **2**. If you have already defined Active Directory sites per hub or branch office, then you don't need to do anything else. If you're not using Active Directory sites, you should set *RestrictPeerSelectionBy* policies to restrict the activity to the subnet or set a different source for Groups by using the GroupIDSrc parameter. See [Select a method to restrict peer selection](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection). + + + +To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**. + +To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DODownloadMode** to **2**. + +> [!NOTE] +> For more about using Delivery Optimization with Configuration Manager boundary groups, see [Delivery Optmization](https://docs.microsoft.com/mem/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management#delivery-optimization). + + +### Large number of mobile devices + +If you have a mobile workforce with a great many mobile devices, set Delivery Optimization to allow uploads on battery power, while limiting the use to prevent battery drain. A setting for **DOMinBatteryPercentageAllowedToUpload** of 60% is a good starting point, though you might want to adjust it later. + +To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Allow uploads while the device is on battery while under set Battery level** to 60. + +To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinBatteryPercentageAllowedToUpload** to 60. + +### Plentiful free space and large numbers of devices + +Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you have more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you have more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB. + +[//]: # (default of 50 aimed at consumer) + +To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices). + +To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinFileSizeToCache** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices). + +### Lab scenario + +In a lab situation, you typically have a large number of devices that are plugged in and have a lot of free disk space. By increasing the content expiration interval, you can take advantage of these devices, using them as excellent upload sources in order to upload much more content over a longer period. + +To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Max Cache Age** to **604800** (7 days) or more (up to 30 days). + +To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DOMaxCacheAge to 7 or more (up to 30 days). + +[//]: # (material about "preferred" devices; remove MinQos/MaxCacheAge; table format?) + + +## Monitor Delivery Optimization +[//]: # (How to tell if it's working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%) + +### Windows PowerShell cmdlets + +**Starting in Windows 10, version 1703**, you can use new PowerShell cmdlets to check the performance of Delivery Optimization. + +#### Analyze usage + +`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs. + +| Key | Value | +| --- | --- | +| File ID | A GUID that identifies the file being processed | +| Priority | Priority of the download; values are **foreground** or **background** | +| FileSize | Size of the file | +| TotalBytesDownloaded | The number of bytes from any source downloaded so far | +| PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP | +| BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) | +| BytesfromHTTP | Total number of bytes received over HTTP | +| DownloadDuration | Total download time in seconds | +| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | +| NumPeers | Indicates the total number of peers returned from the service. | +| PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. | +| ExpireOn | The target expiration date and time for the file. | +| Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). | + + +`Get-DeliveryOptimizationPerfSnap` returns a list of key performance data: + +- Number of files downloaded  +- Number of files uploaded  +- Total bytes downloaded  +- Total bytes uploaded  +- Average transfer size (download); that is, the number bytes downloaded divided by the number of files  +- Average transfer size (upload); the number of bytes uploaded divided by the number of files +- Peer efficiency; same as PercentPeerCaching + +Using the `-Verbose` option returns additional information: + +- Bytes from peers (per type)  +- Bytes from CDN (the number of bytes received over HTTP) +- Average number of peer connections per download  + +**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of the connected peers. + +Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. + +#### Manage the Delivery Optimization cache + +**Starting in Windows 10, version 1903:** + +`set-DeliveryOptimizationStatus -ExpireOn [date time]` extends the expiration of all files in the cache. You can set the expiration immediately for all files that are in the "caching" state. For files in progress ("downloading"), the expiration is applied once the download is complete. You can set the expiration up to one year from the current date and time. + +`set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]` extends expiration for a single specific file in the cache. + +You can now "pin" files to keep them persistent in the cache. You can only do this with files that are downloaded in modes 1, 2, or 3. + +`set-DeliveryOptimizationStatus -Pin [True] -File ID [FileID]` keeps a specific file in the cache such that it won't be deleted until the expiration date and time (which you set with `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]`). The file is also excluded from the cache quota calculation. + +`set-DeliveryOptimizationStatus -Pin [False] -File ID [FileID]` "unpins" a file, so that it will be deleted when the expiration date and time are reached. The file is included in the cache quota calculation. + +`delete-DeliveryOptimizationCache` lets you clear files from the cache and remove all persisted data related to them. You can use these options with this cmdlet: + +- `-FileID` specifies a particular file to delete. +- `-IncludePinnedFiles` deletes all files that are pinned. +- `-Force` deletes the cache with no prompts. + + +#### Work with Delivery Optimization logs + +**Starting in Windows 10, version 2004:** + +- `Enable-DeliveryOptimizationVerboseLogs` +- `Disable-DeliveryOptimizationVerboseLogs` + +- `Get-DeliveryOptimizationLogAnalysis [ETL Logfile path] [-ListConnections]` + +With no options, this cmdlet returns these data: + +- total number of files +- number of foreground files +- minimum file size for it to be cached +- number of eligible files +- number of files with peers +- number of peering files [how different from the above?] +- overall efficiency +- efficiency in the peered files + +Using the `-ListConnections` option returns these details about peers: + +- destination IP address +- peer type +- status code +- bytes sent +- bytes received +- file ID + +**Starting in Windows 10, version 1803:** + +`Get-DeliveryOptimizationLog [-Path ] [-Flush]` + +If `Path` is not specified, this cmdlet reads all logs from the dosvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops dosvc before reading logs. + +Log entries are written to the PowerShell pipeline as objects. To dump logs to a text file, run `Get-DeliveryOptimizationLog | Set-Content ` or something similar. + +[//]: # (section on what to look for in logs, list of peers, connection failures) + + + +[//]: # (possibly move to Troubleshooting) + +### Monitor with Update Compliance + +Update Compliance provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days. + +[ ![DO status](images/UC_workspace_DO_status.png) ](images/UC_workspace_DO_status.png#lightbox) + +For details, see [Delivery Optimization in Update Compliance](update-compliance-delivery-optimization.md). + diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 1f15840c95..02dd9f8971 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -1,18 +1,19 @@ --- -title: Configure Delivery Optimization for Windows 10 updates (Windows 10) -ms.reviewer: +title: Delivery Optimization for Windows 10 updates manager: laurawi -description: Delivery Optimization is a peer-to-peer distribution method in Windows 10 +description: This article provides information about Delivery Optimization, a peer-to-peer distribution method in Windows 10. keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library audience: itpro -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greglin -ms.collection: M365-modern-desktop +ms.author: jaimeo +ms.collection: +- M365-modern-desktop +- m365initiative-coredeploy ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Delivery Optimization for Windows 10 updates @@ -24,14 +25,48 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager (when installation of Express Updates is enabled). +Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or Microsoft Endpoint Configuration Manager (when installation of Express Updates is enabled). Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. +For information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md). For a comprehensive list of all Delivery Optimization settings, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). + >[!NOTE] >WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. +## New in Windows 10, version 2004 + +- Enterprise network throttling: new settings have been added in Group Policy and mobile device management (MDM) to control foreground and background throttling as absolute values (Maximum Background Download Bandwidth in (in KB/s)). These settings are also available in the Windows user interface: + + ![absolute bandwidth settings in delivery optimization interface](images/DO-absolute-bandwidth.png) + +- Activity Monitor now identifies the cache server used for as the source for Microsoft Connected Cache. For more information about using Microsoft Connected Cache with Configuration Manager, see [Microsoft Connected Cache](https://docs.microsoft.com/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache). + +- New options for [`Get-DeliveryOptimizationPerfSnap`](waas-delivery-optimization-setup.md#analyze-usage). + +- New cmdlets: + - `Enable-DeliveryOptimizationVerboseLogs` + - `Disable-DeliveryOptimizationVerboseLogs` + - `Get-DeliveryOptimizationLogAnalysis [ETL Logfile path] [-ListConnections]` + +- New policy settings: + - [DOCacheHost](waas-delivery-optimization-reference.md#cache-server-hostname) + - [DOCacheHostSource](waas-delivery-optimization-reference.md#cache-server-hostname-source) + - [DOMaxForegroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs); replaces DOPercentageMaxDownloadBandwidth + - [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) + +- Removed policy settings (if you set these policies in Windows 10, 2004, they will have no effect): + - DOMaxDownloadBandwidth; use [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) or [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) instead. + - DOPercentageMaxDownloadBandwidth; use [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) or [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) instead. + - DOMaxUploadBandwidth + +- Support for new types of downloads: + - Office installations and updates + - Xbox game pass games + - MSIX apps (HTTP downloads only) + - Edge browser installations and updates + ## Requirements The following table lists the minimum Windows 10 version that supports Delivery Optimization: @@ -41,7 +76,6 @@ The following table lists the minimum Windows 10 version that supports Delivery | Computers running Windows 10 | 1511 | | Computers running Server Core installations of Windows Server | 1709 | | IoT devices | 1803 | -| HoloLens devices | 1803 | **Types of download packages supported by Delivery Optimization** @@ -52,20 +86,20 @@ The following table lists the minimum Windows 10 version that supports Delivery | Windows Store files | 1511 | | Windows Store for Business files | 1511 | | Windows Defender definition updates | 1511 | -| Office Click-to-Run updates | 1709 | +| Microsoft 365 Apps and updates | 1709 (for more information, see [Delivery Optimization and Microsoft 365 Apps](https://docs.microsoft.com/deployoffice/delivery-optimization)) | | Win32 apps for Intune | 1709 | -| SCCM Express Updates | 1709 + Configuration Manager version 1711 | +| Xbox game pass games | 2004 | +| MSIX apps (HTTP downloads only) | 2004 | +| Configuration Manager Express Updates | 1709 + Configuration Manager version 1711 | - +> [!NOTE] +> Starting with Configuration Manager version 1910, you can use Delivery Optimization for the distribution of all Windows update content for clients running Windows 10 version 1709 or newer, not just express installation files. For more, see [Delivery Optimization starting in version 1910](https://docs.microsoft.com/mem/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#bkmk_DO-1910). +In Windows 10 Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. -By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only (specifically, all of the devices must be behind the same NAT), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. - -For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md#download-mode). +For more information, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md). ## Set up Delivery Optimization @@ -77,9 +111,9 @@ You can use Group Policy or an MDM solution like Intune to configure Delivery Op You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**. In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**. -Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) +Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile, which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) -**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. +**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. ## Reference @@ -87,7 +121,7 @@ For complete list of every possible Delivery Optimization setting, see [Delivery ## How Microsoft uses Delivery Optimization -At Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. +At Microsoft, to help ensure that ongoing deployments weren't affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study. @@ -97,9 +131,14 @@ For more details, check out the [Adopting Windows as a Service at Microsoft](htt **Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination. -**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 for TCP/IP or 3544 for NAT traversal (optionally Teredo). For client-service communication, it uses HTTP or HTTPS over port 80/443. +**Which ports does Delivery Optimization use?**: Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device, but you might need to set this port to accept inbound traffic through your firewall yourself. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data). -**What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. +If you set up Delivery Optimization to create peer groups that include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets), it will use Teredo. For this to work, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up. + +Delivery Optimization also communicates with its cloud service by using HTTP/HTTPS over port 80. + + +**What are the requirements if I use a proxy?**: For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/delivery-optimization-proxy). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update). **What hostnames should I allow through my firewall to support Delivery Optimization?**: @@ -119,6 +158,30 @@ For the payloads (optional): **How does Delivery Optimization deal with congestion on the router from peer-to-peer activity on the LAN?**: Starting in Windows 10, version 1903, Delivery Optimization uses LEDBAT to relieve such congestion. For more details see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). +**How does Delivery Optimization handle VPNs?** +Delivery Optimization attempts to identify VPNs by checking the network adapter type and details and will treat the connection as a VPN if the adapter description contains certain keywords, such as "VPN" or "secure." + +If the connection is identified as a VPN, Delivery Optimization will suspend uploads to other peers. However, you can allow uploads over a VPN by using the [Enable Peer Caching while the device connects via VPN](waas-delivery-optimization-reference.md#enable-peer-caching-while-the-device-connects-via-vpn) policy. + +If you have defined a boundary group in Configuration Manager for VPN IP ranges, you can set the DownloadMode policy to 0 for that boundary group to ensure that there will be no peer-to-peer activity over the VPN. When the device is not connected via VPN, it can still leverage peer-to-peer with the default of LAN. + +With split tunneling, make sure to allow direct access to these endpoints: + +Delivery Optimization service endpoint: +- `https://*.prod.do.dsp.mp.microsoft.com` + +Delivery Optimization metadata: +- `http://emdl.ws.microsoft.com` +- `http://*.dl.delivery.mp.microsoft.com` + +Windows Update and Microsoft Store backend services and Windows Update and Microsoft Store payloads + +- `http://*.windowsupdate.com` +- `https://*.delivery.mp.microsoft.com` +- `https://*.update.microsoft.com` +- `https://tsfe.trafficshaping.dsp.mp.microsoft.com` + +For more information about remote work if you're using Configuration Manager, see this post on the [Configuration Manager blog](https://techcommunity.microsoft.com/t5/configuration-manager-blog/managing-patch-tuesday-with-configuration-manager-in-a-remote/ba-p/1269444). ## Troubleshooting @@ -126,11 +189,12 @@ This section summarizes common problems and some solutions to try. ### If you don't see any bytes from peers -If you don’t see any bytes coming from peers the cause might be one of the following issues: +If you don't see any bytes coming from peers the cause might be one of the following issues: - Clients aren’t able to reach the Delivery Optimization cloud services. - The cloud service doesn’t see other peers on the network. - Clients aren’t able to connect to peers that are offered back from the cloud service. +- None of the computers on the network are getting updates from peers. ### Clients aren't able to reach the Delivery Optimization cloud services. @@ -138,18 +202,17 @@ If you don’t see any bytes coming from peers the cause might be one of the fol If you suspect this is the problem, try these steps: 1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. +2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. 3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. - ### The cloud service doesn't see other peers on the network. If you suspect this is the problem, try these steps: 1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. -3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. +2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and ensure that **DownloadMode** is 1 or 2 on both devices. +3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated PowerShell window on the second device. The **NumberOfPeers** field should be non-zero. 4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. @@ -161,6 +224,15 @@ If you suspect this is the problem, try a Telnet test between two devices on the 2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success. +### None of the computers on the network are getting updates from peers + +If you suspect this is the problem, check Delivery Optimization settings that could limit participation in peer caching. Check whether the following settings in assigned group policies, local group policies, are MDM policies are too restrictive: + +- Minimum RAM (inclusive) allowed to use peer caching +- Minimum disk size allowed to use peer caching +- Enable peer caching while the device connects using VPN. +- Allow uploads when the device is on battery while under the set battery level + @@ -169,7 +241,7 @@ If you suspect this is the problem, try a Telnet test between two devices on the [Windows 10, Delivery Optimization, and WSUS](https://blogs.technet.microsoft.com/mniehaus/2016/08/16/windows-10-delivery-optimization-and-wsus-take-2/) -## Related topics +## Related articles - [Update Windows 10 in the enterprise](index.md) - [Overview of Windows as a service](waas-overview.md) @@ -185,5 +257,5 @@ If you suspect this is the problem, try a Telnet test between two devices on the - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) - [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md index 30023d81bb..5888c1f3a1 100644 --- a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md +++ b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md @@ -3,7 +3,6 @@ title: Build deployment rings for Windows 10 updates (Windows 10) description: Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo @@ -57,7 +56,7 @@ As Table 1 shows, each combination of servicing channel and deployment group is | ![done](images/checklistdone.png) | Build deployment rings for Windows 10 updates (this topic) | | ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
              or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
              or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | ## Related topics diff --git a/windows/deployment/update/waas-integrate-wufb.md b/windows/deployment/update/waas-integrate-wufb.md index 1bc196ce0e..f473a704b2 100644 --- a/windows/deployment/update/waas-integrate-wufb.md +++ b/windows/deployment/update/waas-integrate-wufb.md @@ -1,14 +1,12 @@ --- -title: Integrate Windows Update for Business with management solutions (Windows 10) -description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. +title: Integrate Windows Update for Business (Windows 10) +description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/27/2017 -ms.reviewer: +ms.author: jaimeo +ms.collection: m365initiative-coredeploy manager: laurawi ms.topic: article --- @@ -22,7 +20,7 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. +You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager. ## Integrate Windows Update for Business with Windows Server Update Services @@ -70,7 +68,7 @@ For Windows 10, version 1607, devices can now be configured to receive updates f - Device is configured to defer Quality Updates using Windows Update for Business and to be managed by WSUS - Device is configured to “receive updates for other Microsoft products” along with updates to Windows (**Update/AllowMUUpdateService** = enabled) -- Admin has also placed Microsoft Update, third-paprty, and locally-published update content on the WSUS server +- Admin has also placed Microsoft Update, non-Microsoft, and locally published update content on the WSUS server In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS were not enabled. - In a non-WSUS case, these updates would be deferred just as any update to Windows would be. @@ -86,7 +84,7 @@ In this example, the deferral behavior for updates to Office and other non-Windo >[!NOTE] > Because the admin enabled **Update/AllowMUUpdateService**, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner. -## Integrate Windows Update for Business with System Center Configuration Manager +## Integrate Windows Update for Business with Microsoft Endpoint Configuration Manager For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (i.e. setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of **Unknown**. @@ -110,6 +108,6 @@ For more information, see [Integration with Windows Update for Business in Windo - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) - [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-manage-updates-configuration-manager.md b/windows/deployment/update/waas-manage-updates-configuration-manager.md deleted file mode 100644 index 5ab254f79d..0000000000 --- a/windows/deployment/update/waas-manage-updates-configuration-manager.md +++ /dev/null @@ -1,332 +0,0 @@ ---- -title: Deploy Windows 10 updates using System Center Configuration Manager (Windows 10) -description: System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: jaimeo -ms.localizationpriority: medium -ms.author: jaimeo -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Deploy Windows 10 updates using System Center Configuration Manager - - -**Applies to** - -- Windows 10 - - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. - - -System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. Unlike other servicing tools, Configuration Manager has capabilities that extend beyond servicing, such as application deployment, antivirus management, software metering, and reporting, and provides a secondary deployment method for LTSB clients. Configuration Manager can effectively control bandwidth usage and content distribution through a combination of BranchCache and distribution points. Microsoft encourages organizations currently using Configuration Manager for Windows update management to continue doing so for Windows 10 client computers. - -You can use Configuration Manager to service Windows 10 devices in two ways. The first option is to use Windows 10 Servicing Plans to deploy Windows 10 feature updates automatically based on specific criteria, similar to an Automatic Deployment Rule for software updates. The second option is to use a task sequence to deploy feature updates, along with anything else in the installation. - ->[!NOTE] ->This topic focuses on updating and upgrading Windows 10 after it has already been deployed. To use Configuration Manager to upgrade your systems from the Windows 8.1, Windows 8, or Windows 7 operating system, see [Upgrade to Windows 10 with System Center Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager). - -## Windows 10 servicing dashboard - -The Windows 10 servicing dashboard gives you a quick-reference view of your active servicing plans, compliance for servicing plan deployment, and other key information about Windows 10 servicing. For details about what each tile on the servicing dashboard represents, see [Manage Windows as a service using System Center Configuration Manager](https://technet.microsoft.com/library/mt627931.aspx). - -For the Windows 10 servicing dashboard to display information, you must adhere to the following requirements: - -- **Heartbeat discovery**. Enable heartbeat discovery for the site receiving Windows 10 servicing information. Configuration for heartbeat discovery can be found in Administration\Overview\Hierarchy Configuration\Discovery Methods. -- **Windows Server Update Service (WSUS)**. System Center Configuration Manager must have the Software update point site system role added and configured to receive updates from a WSUS 4.0 server with the hotfix KB3095113 installed. -- **Service connection point**. Add the Service connection point site system role in Online, persistent connection mode. -- **Upgrade classification**. Select **Upgrade** from the list of synchronized software update classifications. - - **To configure Upgrade classification** - - 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. - - 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. - - ![Example of UI](images/waas-sccm-fig1.png) - - 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. - -When you have met all these requirements and deployed a servicing plan to a collection, you’ll receive information on the Windows 10 servicing dashboard. - -## Create collections for deployment rings - -Regardless of the method by which you deploy Windows 10 feature updates to your environment, you must start the Windows 10 servicing process by creating collections of computers that represent your deployment rings. In this example, you create two collections: **Windows 10 – All Current Branch for Business** and **Ring 4 Broad business users**. You’ll use the **Windows 10 – All Current Branch for Business** collection for reporting and deployments that should go to all CBB clients. You’ll use the **Ring 4 Broad business users** collection as a deployment ring for the first CBB users. - ->[!NOTE] ->The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples. - -**To create collections for deployment rings** - -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. - -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. - -3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. - -4. Click **Browse** to select the limiting collection, and then click **All Systems**. - -5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. - -6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. - -7. On the **Criteria** tab, click the **New** icon. - - ![Example of UI](images/waas-sccm-fig4.png) - -8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. - -9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. - - ![Example of UI](images/waas-sccm-fig5.png) - - >[!NOTE] - >Configuration Manager discovers clients’ servicing branch and stores that value in the **OSBranch** attribute, which you will use to create collections based on servicing branch. The values in this attribute can be **0 (Current Branch)**, **1 (Current Branch for Business)**, or **2 (Long-Term Servicing Branch)**. - -10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. - - ![Example of UI](images/waas-sccm-fig6.png) - -11. Now that the **OSBranch** attribute is correct, verify the operating system version. - -12. On the **Criteria** tab, click the **New** icon again to add criteria. - -13. In the **Criterion Properties** dialog box, click **Select**. - -14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. - - ![Example of UI](images/waas-sccm-fig7.png) - -15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. - - ![Example of UI](images/waas-sccm-fig8.png) - -16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. - -17. Click **Summary**, and then click **Next**. - -18. Close the wizard. - ->[!IMPORTANT] ->Windows Insider PCs are discovered the same way as CB or CBB devices. If you have Windows Insider PCs that you use Configuration Manager to manage, then you should create a collection of those PCs and exclude them from this collection. You can create the membership for the Windows Insider collection either manually or by using a query where the operating system build doesn’t equal any of the current CB or CBB build numbers. You would have to update each periodically to include new devices or new operating system builds. - -After you have updated the membership, this new collection will contain all managed clients on the CBB servicing branch. You will use this collection as a limiting collection for future CBB-based collections and the **Ring 4 Broad broad business users** collection. Complete the following steps to create the **Ring 4 Broad business users** device collection, which you’ll use as a CBB deployment ring for servicing plans or task sequences. - -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. - -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. - -3. In the Create Device Collection Wizard, in the **name** box, type **Ring 4 Broad business users**. - -4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. - -5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. - -6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. - -7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. - -8. Select the computer that will be part of the **Ring 4 Broad business users** deployment ring, and then click **Next**. - -9. Click **Next**, and then click **Close**. - -10. In the **Create Device Collection Wizard** dialog box, click **Summary**. - -11. Click **Next**, and then click **Close**. - - -## Use Windows 10 servicing plans to deploy Windows 10 feature updates - -There are two ways to deploy Windows 10 feature updates with System Center Configuration Manager. The first is to use servicing plans, which provide an automated method to update devices consistently in their respective deployment rings, similar to Automatic Deployment Rules for software updates. - -**To configure Windows feature updates for CBB clients in the Ring 4 Broad business users deployment ring using a servicing plan** - -1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. - -2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. - -3. Name the plan **Ring 4 Broad business users Servicing Plan**, and then click **Next**. - -4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 4 Broad business users** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. - - >[!IMPORTANT] - >Microsoft added a new protection feature to Configuration Manager that prevents accidental installation of high-risk deployments such as operating system upgrades on site systems. If you select a collection (All Systems in this example) that has a site system in it, you may receive the following message. - > - >![This is a high-risk deployment](images/waas-sccm-fig9.png) - > - >For details about how to manage the settings for high-risk deployments in Configuration Manager, see [Settings to manage high-risk deployments for System Center Configuration Manager](https://technet.microsoft.com/library/mt621992.aspx). - -5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. - - Doing so deploys CBB feature updates to the broad business users deployment ring immediately after they are released to CBB. - - On the Upgrades page, you specify filters for the feature updates to which this servicing plan is applicable. For example, if you wanted this plan to be only for Windows 10 Enterprise, you could select **Title**, and then type **Enterprise**. - -6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. - -7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. - -8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. - - Doing so allows installation and restarts after the 7-day deadline on workstations only. - -9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. - - In this example, \\contoso-cm01\Sources\Windows 10 Feature Upgrades is a share on the Configuration Manager server that contains all the Windows 10 feature updates. - - ![Example of UI](images/waas-sccm-fig10.png) - -10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. - - ![Example of UI](images/waas-sccm-fig11.png) - - Select the distribution points that serve the clients to which you’re deploying this servicing plan, and then click **OK**. - -11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. - - -You have now created a servicing plan for the **Ring 4 Broad business users** deployment ring. By default, this rule is evaluated each time the software update point is synchronized, but you can modify this schedule by viewing the service plan’s properties on the **Evaluation Schedule** tab. - -![Example of UI](images/waas-sccm-fig12.png) - - -## Use a task sequence to deploy Windows 10 updates - -There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: - -- **LTSB feature updates**. With the LTSB servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. -- **Additional required tasks**. When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you must use task sequences to orchestrate the additional steps. Servicing plans do not have the ability to add steps to their deployments. - -Each time Microsoft releases a new Windows 10 build, it releases a new .iso file containing the latest build, as well. Regardless of the scenario that requires a task sequence to deploy the Windows 10 upgrade, the base process is the same. Start by creating an Operating System Upgrade Package in the Configuration Manager console: - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. - -2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. - -3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. - - In this example, the Windows 10 Enterprise 1607 installation media is deployed to \\contoso-cm01\Sources\Operating Systems\Windows 10 Enterprise\Windows 10 Enterprise - Version 1607. - - >[!NOTE] - >System Center Configuration Manager version 1606 is required to manage machines running Windows 10, version 1607. - -4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. - -5. On the **Summary** page, click **Next** to create the package. - -6. On the **Completion** page, click **Close**. - -Now that the operating system upgrade package has been created, the content in that package must be distributed to the correct distribution points so that the clients can access the content. Complete the following steps to distribute the package content to distribution points: - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. - -2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. - -3. In the Distribute Content Wizard, on the **General** page, click **Next**. - -4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. - -5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. - -6. On the **Content Destination** page, click **Next**. - -7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. - -8. On the **Completion** page, click **Close**. - -Now that the upgrade package has been created and its contents distributed, create the task sequence that will use it. Complete the following steps to create the task sequence, using the previously created deployment package: - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. - -2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. - -3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. - -4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. - -5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. - -6. Click **Next**. - -7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. - -8. On the **Install Applications** page, click **Next**. - -9. On the **Summary** page, click **Next** to create the task sequence. - -10. On the **Completion** page, click **Close**. - -With the task sequence created, you’re ready to deploy it. If you’re using this method to deploy most of your Windows 10 feature updates, you may want to create deployment rings to stage the deployment of this task sequence, with delays appropriate for the respective deployment ring. In this example, you deploy the task sequence to the **Ring 4 Broad business users collection**. - ->[!IMPORTANT] ->This process deploys a Windows 10 operating system feature update to the affected devices. If you’re testing, be sure to select the collection to which you deploy this task sequence carefully. - -**To deploy your task sequence** - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. - -2. On the Ribbon, in the **Deployment** group, click **Deploy**. - -3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. - -4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. - -5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. - -6. In the **Assignment Schedule** dialog box, click **Schedule**. - -7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. - -8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. - -9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. - -10. Use the defaults for the remaining settings. - -11. Click **Summary**, and then click **Next** to deploy the task sequence. - -12. Click **Close**. - - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
              or Deploy Windows 10 updates using System Center Configuration Manager (this topic) | - -## See also - -[Manage Windows as a service using System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/manage-windows-as-a-service) - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) -- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Manage device restarts after updates](waas-restart.md) - diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 4df1a782b7..9f7d882387 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -3,11 +3,9 @@ title: Deploy Windows 10 updates using Windows Server Update Services (Windows 1 description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greglin -ms.date: 10/16/2017 +ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article @@ -23,11 +21,10 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) >[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy or the registry. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. -WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that System Center Configuration Manager provides. + +WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that Microsoft Endpoint Configuration Manager provides. When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10. @@ -35,35 +32,23 @@ When you choose WSUS as your source for Windows updates, you use Group Policy to ## Requirements for Windows 10 servicing with WSUS -To be able to use WSUS to manage and deploy Windows 10 feature updates, you must have WSUS 4.0, which is available in the Windows Server 2012 R2 and Windows Server 2012 operating systems. In addition to WSUS 4.0, you must install the [KB3095113](https://support.microsoft.com/kb/3095113) and [KB3159706](https://support.microsoft.com/kb/3159706) patches on the WSUS server. +To be able to use WSUS to manage and deploy Windows 10 feature updates, you must use a supported WSUS version: +- WSUS 10.0.14393 (role in Windows Server 2016) +- WSUS 10.0.17763 (role in Windows Server 2019) +- WSUS 6.2 and 6.3 (role in Windows Server 2012 and Windows Server 2012 R2) +- KB 3095113 and KB 3159706 (or an equivalent update) must be installed on WSUS 6.2 and 6.3. + +> [!IMPORTANT] +> Both [KB 3095113](https://support.microsoft.com/kb/3095113) and [KB 3159706](https://support.microsoft.com/kb/3159706) are included in the **Security Monthly Quality Rollup** starting in July 2017. This means you might not see KB 3095113 and KB 3159706 as installed updates since they might have been installed with a rollup. However, if you need either of these updates, we recommend installing a **Security Monthly Quality Rollup** released after **October 2017** since they contain an additional WSUS update to decrease memory utilization on WSUS's clientwebservice. +>If you have synced either of these updates prior to the security monthly quality rollup, you can experience problems. To recover from this, see [How to Delete Upgrades in WSUS](https://blogs.technet.microsoft.com/wsus/2016/01/29/how-to-delete-upgrades-in-wsus/). + ## WSUS scalability To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](https://technet.microsoft.com/library/cc720448%28v=ws.10%29.aspx). -## Express Installation Files -With Windows 10, quality updates will be larger than traditional Windows Updates because they’re cumulative. To manage the bandwidth clients downloading large updates like these will need, WSUS has a feature called *Express Installation Files*. - - At a binary level, files associated with updates may not change a lot. In fact, with cumulative quality updates, most of the content will be from previous updates. Rather than downloading the entire update when only a small percentage of the payload is actually different, Express Installation Files analyze the differences between the new files associated with an update and the existing files on the client. This approach significantly reduces the amount of bandwidth used because only a fraction of the update content is actually delivered. - - **To configure WSUS to download Express Update Files** - -1. Open the WSUS Administration Console. - -2. In the navigation pane, go to *Your_Server*\\**Options**. - -3. In the **Options** section, click **Update Files and Languages**. - - ![Example of UI](images/waas-wsus-fig1.png) - -4. In the **Update Files and Languages** dialog box, select **Download express installation files**. - - ![Example of UI](images/waas-wsus-fig2.png) - - >[!NOTE] - >Because Windows 10 updates are cumulative, enabling Express Installation Files when WSUS is configured to download Windows 10 updates will significantly increase the amount of disk space that WSUS requires. Alternatively, when using Express Installation Files for previous versions of Windows, the feature’s positive effects aren’t noticeable because the updates aren’t cumulative. ## Configure automatic updates and update service location @@ -71,11 +56,11 @@ When using WSUS to manage updates on Windows client devices, start by configurin **To configure the Configure Automatic Updates and Intranet Microsoft Update Service Location Group Policy settings for your environment** -1. Open GPMC. +1. Open Group Policy Management Console (gpmc.msc). -2. Expand Forest\Domains\\*Your_Domain*. +2. Expand *Forest\Domains\\*Your_Domain**. -3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. +3. Right-click **Your_Domain**, and then select **Create a GPO in this domain, and Link it here**. ![Example of UI](images/waas-wsus-fig3.png) @@ -97,15 +82,18 @@ When using WSUS to manage updates on Windows client devices, start by configurin 9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. ![Example of UI](images/waas-wsus-fig5.png) + + >[!IMPORTANT] + > Use Regedit.exe to check that the following key is not enabled, because it can break Windows Store connectivity: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations > [!NOTE] - > ?There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). + > There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). -10. Right-click the **Specify intranet Microsoft update service location** setting, and then click **Edit**. +10. Right-click the **Specify intranet Microsoft update service location** setting, and then select **Edit**. 11. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**. -12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type http://Your_WSUS_Server_FQDN:PortNumber, and then click **OK**. +12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type http://Your_WSUS_Server_FQDN:PortNumber, and then select **OK**. >[!NOTE] >The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance. @@ -113,7 +101,7 @@ When using WSUS to manage updates on Windows client devices, start by configurin ![Example of UI](images/waas-wsus-fig6.png) >[!NOTE] - >The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. If you’re unsure which port WSUS is using for client communication, right-click the WSUS Administration site in IIS Manager, and then click **Edit Bindings**. + >The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. (The other options are 80 and 443; no other ports are supported.) As Windows clients refresh their computer policies (the default Group Policy refresh setting is 90 minutes and when a computer restarts), computers start to appear in WSUS. Now that clients are communicating with the WSUS server, create the computer groups that align with your deployment rings. @@ -139,6 +127,7 @@ You can use computer groups to target a subset of devices that have specific qua Now that the groups have been created, add the computers to the computer groups that align with the desired deployment rings. You can do this through [Group Policy](#wsus-gp) or manually by using the [WSUS Administration Console](#wsus-admin). + ## Use the WSUS Administration Console to populate deployment rings Adding computers to computer groups in the WSUS Administration Console is simple, but it could take much longer than managing membership through Group Policy, especially if you have many computers to add. Adding computers to computer groups in the WSUS Administration Console is called *server-side targeting*. @@ -205,7 +194,7 @@ Now that WSUS is ready for client-side targeting, complete the following steps t >[!TIP] >When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don’t add computers to the incorrect rings. -1. Open GPMC. +1. Open Group Policy Management Console (gpmc.msc). 2. Expand Forest\Domains\\*Your_Domain*. @@ -223,10 +212,13 @@ Now that WSUS is ready for client-side targeting, complete the following steps t 8. In the **Enable client-side targeting** dialog box, select **Enable**. -9. In the **Target group name for this computer** box, type **Ring 4 Broad Business Users**. This is the name of the deployment ring in WSUS to which these computers will be added. +9. In the **Target group name for this computer** box, type *Ring 4 Broad Business Users*. This is the name of the deployment ring in WSUS to which these computers will be added. ![Example of UI](images/waas-wsus-fig12.png) +> [!WARNING] +> The target group name must match the computer group name. + 10. Close the Group Policy Management Editor. Now you’re ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. @@ -248,7 +240,8 @@ The next time the clients in the **Ring 4 Broad Business Users** security group For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS. >[!NOTE] ->WSUS respects the client’s servicing branch. If you approve a feature update while it is still Current Branch (CB), WSUS will install the update only on PCs that are in the CB servicing branch. When Microsoft releases the build for Current Branch for Business (CBB), the PCs in the CBB servicing branch will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS. +>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for Semi-Annual Channel, the devices in the Semi-Annual Channel will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS. + **To configure an Automatic Approval rule for Windows 10 feature updates and approve them for the Ring 3 Broad IT deployment ring** @@ -277,13 +270,21 @@ For clients that should have their feature updates approved as soon as they’re 9. In the **Automatic Approvals** dialog box, click **OK**. >[!NOTE] - >WSUS does not honor any existing month/week/day deferral settings for CB or CBB. That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. + >WSUS does not honor any existing month/week/day [deferral settings](waas-configure-wufb.md#configure-when-devices-receive-feature-updates). That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. +> [!WARNING] +> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actually want--which can be a problem when the download sizes are very large. + ## Manually approve and deploy feature updates -You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates. +You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. It might be best to approve update rules manually after your pilot deployment has been updated. + +To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates. + +> [!NOTE] +> If you approve more than one feature update for a computer, an error can result with the client. Approve only one feature update per computer. **To approve and deploy feature updates manually** @@ -301,7 +302,7 @@ You can manually approve updates and set deadlines for installation within the W ![Example of UI](images/waas-wsus-fig16.png) -Now that you have the All Windows 10 Upgrades view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: +Now that you have the **All Windows 10 Upgrades** view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: 1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. @@ -336,7 +337,7 @@ Now that you have the All Windows 10 Upgrades view, complete the following steps | ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
              or Deploy Windows 10 updates using Windows Server Update Services (this topic)
              or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
              or Deploy Windows 10 updates using Windows Server Update Services (this topic)
              or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | @@ -356,5 +357,5 @@ Now that you have the All Windows 10 Upgrades view, complete the following steps - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) - [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index b80b9132c8..1a27cda457 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -1,35 +1,134 @@ --- -title: Deploy updates using Windows Update for Business (Windows 10) +title: Windows Update for Business (Windows 10) ms.reviewer: manager: laurawi -description: Windows Update for Business lets you manage when devices received updates from Windows Update. +description: Learn how Windows Update for Business lets you manage when devices receive updates from Windows Update. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.topic: article +ms.custom: seo-marvel-apr2020 --- -# Deploy updates using Windows Update for Business +# What is Windows Update for Business? **Applies to** - Windows 10 -- Windows Server 2016 -- Windows Server 2019 -Windows Update for Business is a free service that is available for Windows Pro, Enterprise, Pro for Workstation, and Education editions. + +Windows Update for Business is a free service that is available for all premium editions including Windows 10 Pro, Enterprise, Pro for Workstation, and Education editions. > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -Windows Update for Business enables IT administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Microsoft Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. +Windows Update for Business enables IT administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or Mobile Device Management (MDM) solutions such as Microsoft Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. -Specifically, Windows Update for Business allows for control over update offering and experience to allow for reliability and performance testing on a subset of systems before rolling out updates across the organization as well as a positive update experience for those within your organization. +Specifically, Windows Update for Business lets you control update offerings and experiences to allow for reliability and performance testing on a subset of devices before deploying updates across the organization. It also provides a positive update experience for people in your organization. + +## What can I do with Windows Update for Business? + +Windows Update for Business enables commercial customers to manage which Windows Updates are received when as well as the experience a device has when it receives them. + +You can control Windows Update for Business policies by using either Mobile Device Management (MDM) tools such as Microsoft Intune or Group Policy management tools such as local group policy or the Group Policy Management Console (GPMC), as well as a variety of other non-Microsoft management tools. MDMs use Configuration Service Provider (CSP) policies instead of Group Policy. Intune additionally uses Cloud Policies. Not all policies are available in all formats (CSP, Group Policy, or Cloud policy). + + +### Manage deployment of Windows Updates +By using Windows Update for Business, you can control which types of Windows Updates are offered to devices in your ecosystem, when updates are applied, and deployment to devices in your organization in waves. + +### Manage which updates are offered +Windows Update for Business enables an IT administrator to receive and manage a variety of different types of Windows Updates. + +## Types of updates managed by Windows Update for Business + +Windows Update for Business provides management policies for several types of updates to Windows 10 devices: + +- **Feature updates:** Previously referred to as "upgrades," feature updates contain not only security and quality revisions, but also significant feature additions and changes. Feature updates are released semi-annually in the fall and in the spring. +- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as updates for Microsoft Office or Visual Studio) as quality updates. These non-Windows Updates are known as "Microsoft updates" and you can set devices to receive such updates (or not) along with their Windows updates. +- **Driver updates:** Updates for non-Microsoft drivers that are relevant to your devices. Driver updates are on by default, but you can use Windows Update for Business policies to turn them off if you prefer. +- **Microsoft product updates**: Updates for other Microsoft products, such as Office. Product updates are off by default. You can turn them on by using Windows Update for Business policies. + + +## Offering +You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period. + +### Manage when updates are offered +You can defer or pause the installation of updates for a set period of time. + +#### Enroll in pre-release updates + +The branch readiness level enables administrators to specify which channel of feature updates they want to receive. Today there are branch readiness level options for both pre-release and released updates: + +- Windows Insider Fast +- Windows Insider Slow +- Windows Insider Release Preview +- Semi-Annual Channel + +Prior to Windows 10, version 1903, there are two channels for released updates: Semi-Annual Channel and Semi-Annual Channel (Targeted). Deferral days are calculated against the release date of the chosen channel. Starting with Windows 10, version 1903 there is only the one release channel: Semi-Annual Channel. All deferral days are calculated against a release’s Semi-Annual Channel release date. For exact release dates, see [Windows Release Information](https://docs.microsoft.com/windows/release-information/). You can set the branch readiness level by using the **Select when Preview Builds and Feature Updates are Received** policy. To use this policy to manage pre-release builds, first enable preview builds by using the **Manage preview Builds** policy. + +#### Defer an update + +A Windows Update for Business administrator can defer the installation of both feature and quality updates from deploying to devices within a bounded range of time from when those updates are first made available on the Windows Update service. You can use this deferral to allow time to validate deployments as they are pushed to devices. Deferrals work by allowing you to specify the number of days after an update is released before it is offered to a device. That is, if you set a feature update deferral period of 365 days, the device will not install a feature update that has been released for less than 365 days. To defer feature updates, use the **Select when Preview Builds and Feature Updates are Received** policy. + + +|Category |Maximum deferral period | +|---------|---------| +|Feature updates | 365 days | +|Quality updates | 30 days | +|Non-deferrable | none | + + + +#### Pause an update + +If you discover a problem while deploying a feature or quality update, the IT administrator can pause the update for 35 days from a specified start date to prevent other devices from installing it until the issue is mitigated. +If you pause a feature update, quality updates are still offered to devices to ensure they stay secure. The pause period for both feature and quality updates is calculated from a start date that you set. + +To pause feature updates, use the **Select when Preview Builds and Feature Updates are Received** policy and to pause quality updates use the **Select when Quality Updates are Received** policy. For more information, see [Pause feature updates](waas-configure-wufb.md#pause-feature-updates) and [Pause quality updates](waas-configure-wufb.md#pause-quality-updates). + +Built-in benefits: +When updating from Windows Update, you get the added benefits of built-in compatibility checks to prevent against a poor update experience for your device as well as a check to prevent repeated rollbacks. + +### Recommendations + +For the best experience with Windows Update, follow these guidelines: + +- Use devices for at least 6 hours per month, including at least 2 hours of continuous use. +- Keep devices regularly charged. Plugging in devices overnight enables them to automatically update outside of active hours. +- Make sure that devices have at least 10 GB of free space. +- Give devices unobstructed access to the Windows Update service. + +### Manage the end-user experience when receiving Windows Updates + +Windows Update for Business provides controls to help meet your organization’s security standards as well as provide a great end-user experience. We do this by enabling you to set automatic updates at times that work well for people in your organization and set deadlines for quality and feature updates. Because Windows Update includes built-in intelligence, it's better to use fewer controls to manage the user experience. + +#### Recommended experience settings + +Features like the smart busy check (which ensure updates don't happen when a user is signed in) and active hours help provide the best experience for end users while keeping devices more secure and up to date. Follow these steps to take advantage of these features: + +1. Automatically download, install, and restart (default if no restart policies are set up or enabled) +2. Use the default notifications +3. Set update deadlines + +##### Setting deadlines + +A compliance deadline policy (released in June 2019) enables you to set separate deadlines and grace periods for feature and quality updates. + +This policy enables you to specify the number of days from an update's publication date that it must be installed on the device. The policy also includes a configurable grace period that specifies the number of days from when the update is installed on the device until the device is forced to restart. This approach is useful in a vacation scenario as it allows, for example, users who have been away to have a bit of time before being forced to restart their devices when they return from vacation. + +#### Update Baseline +The large number of different policies offered for Windows 10 can be overwhelming. Update Baseline provides a clear list of recommended Windows update policy settings for IT administrators who want the best user experience while also meeting their update compliance goals. The Update Baseline for Windows 10 includes policy settings recommendations covering deadline configuration, restart behavior, power policies, and more. + +The Update Baseline toolkit makes it easy by providing a single command for IT Admins to apply the Update Baseline to devices. You can get the Update Baseline toolkit from the [Download Center](https://www.microsoft.com/download/details.aspx?id=101056). + +>[!NOTE] +>The Update Baseline toolkit is available only for Group Policy. Update Baseline does not affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices when. + + - ->[!NOTE] ->Microsoft has a strong commitment to providing the tools and resources that put you in control of your privacy. As a result, Microsoft doesn't collect the following data from devices located in European countries (EEA and Switzerland): ->- Windows diagnostic data from Windows 8.1 devices ->- App usage data and [Internet Explorer site discovery](../upgrade/upgrade-readiness-additional-insights.md#site-discovery) features for Windows 7 devices - - - -### Configuring endpoint access with SSL inspection -To ensure privacy and data integrity Windows checks for a Microsoft SSL certificate when communicating with the diagnostic data endpoints. Accordingly SSL interception and inspection is not possible. To use Windows Analytics services you should exclude the above endpoints from SSL inspection. - -### Configuring endpoint access with proxy server authentication -If your organization uses proxy server authentication for outbound traffic, use one or more of the following approaches to ensure that the diagnostic data is not blocked by proxy authentication: - -- **Best option: Bypass** Configure your proxy servers to **not** require proxy authentication for traffic to the diagnostic data endpoints. This is the most comprehensive solution and it works for all versions of Windows 10. -- **User proxy authentication:** Alternatively, you can configure devices to use the logged on user's context for proxy authentication. First, update the devices to Windows 10, version 1703 or later. Then, ensure that users of the devices have proxy permission to reach the diagnostic data endpoints. This requires that the devices have console users with proxy permissions, so you couldn't use this method with headless devices. -- **Device proxy authentication:** Another option--the most complex--is as follows: First, configure a system level proxy server on the devices. Then, configure these devices to use machine-account-based outbound proxy authentication. Finally, configure proxy servers to allow the machine accounts access to the diagnostic data endpoints. - -## Deploy the compatibility update and related updates - -The compatibility update scans your devices and enables application usage tracking. If you don’t already have these updates installed, you can download the applicable version from the Microsoft Update Catalog or deploy it using Windows Server Update Services (WSUS) or your software distribution solution, such as System Center Configuration Manager. - -| **Operating System** | **Updates** | -|----------------------|-----------------------------------------------------------------------------| -| Windows 10 | Windows 10 includes the compatibility update, so you will automatically have the latest compatibility update so long as you continue to keep your Windows 10 devices up to date with cumulative updates. | -| Windows 8.1 | The compatibility update is included in monthly quality updates for Windows 8.1. We recommend installing the latest [Windows Monthly Rollup](http://www.catalog.update.microsoft.com/Search.aspx?q=security%20monthly%20quality%20rollup%20for%20windows%208) before attempting to enroll devices into Windows Analytics. | -| Windows 7 SP1 | The compatibility update is included in monthly quality updates for Windows 7. We recommend installing the latest [Windows Monthly Rollup](http://www.catalog.update.microsoft.com/Search.aspx?q=security%20monthly%20quality%20rollup%20for%20windows%207) before attempting to enroll devices into Windows Analytics. | - -### Connected User Experiences and Telemetry service - -With Windows diagnostic data enabled, the Connected User Experience and Telemetry service (DiagTrack) collects system, application, and driver data. Microsoft analyzes this data, and shares it back to you through Windows Analytics. For the best experience, install these updates depending upon the operating system version. - -- For Windows 10, install the latest Windows 10 cumulative update. -- For Windows 8.1, nstall the October 2018 monthly rollup, [KB4462926](https://support.microsoft.com/help/4462926) -- For Windows 7, install the October 2018 monthly rollup, [KB4462923](https://support.microsoft.com/help/4462923) - - - ->[!IMPORTANT] ->Restart devices after you install the compatibility updates for the first time. - ->[!NOTE] ->We recommend you configure your update management tool to automatically install the latest version of these updates. There is a related optional update, [KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513), which can provide updated configuration and definitions for older compatibiltiy updates. For more information about this optional update, see . - - - -If you are planning to enable IE Site Discovery in Upgrade Readiness, you will need to install a few additional updates. - -| **Site discovery** | **Update** | -|----------------------|-----------------------------------------------------------------------------| -| [Review site discovery](../upgrade/upgrade-readiness-additional-insights.md#site-discovery) | [KB3080149](https://www.catalog.update.microsoft.com/Search.aspx?q=3080149)
              Updates the Diagnostic and Telemetry tracking service to existing devices. This update is only necessary on Windows 7 and Windows 8.1 devices.
              For more information about this update, see

              Install the latest [Windows Monthly Rollup](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. | - ->[!NOTE] -> IE site discovery is disabled on devices running Windows 7 and Windows 8.1 that are in Switzerland and EU countries. - -## Set diagnostic data levels - -You can set the diagnostic data level used by monitored devices either with the [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md) or by policy (by using Group Policy or Mobile Device Management). - -The basic functionality of Upgrade Readiness will work at the Basic diagnostic data level, you won't get usage or health data for your updated devices without enabling the Enhanced level. This means you won't get information about health regressions on updated devices. So it is best to enable the Enhanced diagnostic data level, at least on devices running Windows 10, version 1709 (or later) where the Enhanced diagnostic data setting can be paired with "limited enhanced" data level (see [Windows 10 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields)). For more information, see [Windows Analytics and privacy](https://docs.microsoft.com/windows/deployment/update/windows-analytics-privacy). - -## Enroll a few pilot devices - -You can use the Upgrade Readiness deployment script to automate and verify your deployment. We always recommend manually running this script on a few representative devices to verify things are properly configured and the device can connect to the diagnostic data endpoints. Make sure to run the pilot version of the script, which will provide extra diagnostics. - -See the [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md) topic for information about obtaining and running the script, and for a description of the error codes that can be displayed. See ["Understanding connectivity scenarios and the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/03/10/understanding-connectivity-scenarios-and-the-deployment-script/) on the Windows Analytics blog for a summary of setting the ClientProxy for the script, which will enable the script properly check for diagnostic data endpoint connectivity. - -After data is sent from devices to Microsoft, it generally takes 48-56 hours for the data to populate in Windows Analytics. The compatibility update takes several minutes to run. If the update does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Windows Analytics. For this reason, you can expect most of your devices to be populated in Windows Analytics within 1-2 days after deploying the update and configuration to user computers. As described in the Windows Analytics blog post ["You can now check on the status of your computers within hours of running the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/05/12/wheres-my-data/), you can verify that devices have successfully connected to the service within a few hours. Most of those devices should start to show up in the Windows Analytics console within a few days. - -## Deploy additional optional settings - -Certain Windows Analytics features have additional settings you can use. - -- **Update Compliance** is only compatible with Windows 10 desktop devices (workstations and laptops). To use the Windows Defender Antivirus Assessment, devices must be protected by Windows Defender AV (and not a partner antivirus application), and must have enabled cloud-delivered protection, as described in [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). See the [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting) topic for help with ensuring that the configuration is correct. - -- For devices running Windows 10, version 1607 or earlier, Windows diagnostic data must also be set to Enhanced (see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level)) in order to be compatible with Windows Defender Antivirus. See the [Windows Defender Antivirus in Windows 10 and Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) for more information about enabling, configuring, and validating Windows Defender AV. - -- **Device Health** is only compatible with Windows 10 desktop devices (workstations and laptops) and Windows Server 2016. The solution requires that at least the Enhanced level of diagnostic data is enabled on all devices that are intended to be displayed in the solution. In Windows 10, version 1709, a new policy was added to "limit enhanced telemetry to the minimum required by Windows Analytics". To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). - -- **IE site discovery** is an optional feature of Upgrade Readiness that provides an inventory of websites that are accessed by client devices using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. To enable IE site discovery, make sure the required updates are installed (per previous section) and enable IE site discovery in the deployment script batch file. - -## Deploying Windows Analytics at scale - -When you have completed a pilot deployment, you are ready to automate data collection and distribute the deployment script to the remaining devices in your organization. - -### Automate data collection - -To ensure that user computers are receiving the most up-to-date data from Microsoft, we recommend that you establish the following data sharing and analysis processes: - -- Enable automatic updates for the compatibility update and related updates. These updates include the latest application and driver issue information as we discover it during testing. -- Schedule the Upgrade Readiness deployment script to automatically run monthly. Scheduling the script ensures that full inventory is sent monthly even if devices were not connected or had low battery power at the time the system normally sends inventory. Make sure to run the production version of the script, which is lighter weight and non-interactive. The script also has a number of built-in error checks, so you can monitor the results. If you can't run the deployment script at scale, another option is to configure things centrally via Group Policy or Mobile Device Management (MDM). Although we recommend using the deployment script, both options are discussed in the sections below. - -When you run the deployment script, it initiates a full scan. The daily scheduled task to capture the changes is created when the update package is installed. For Windows 10 devices, this task is already included in the operating system. A full scan averages about 2 MB, but the scans for changes are very small. The scheduled task is named "Windows Compatibility Appraiser" and can be found in the Task Scheduler Library under Microsoft > Windows > Application Experience. Changes are invoked via the nightly scheduled task. It attempts to run around 3:00AM every day. If the system is powered off at that time, the task will run when the system is turned on. - -### Distribute the deployment script at scale - -Use a software distribution system such as System Center Configuration Manager to distribute the Upgrade Readiness deployment script at scale. For more information, see [Upgrade Readiness deployment script](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script). For information on how to deploy PowerShell scripts by using Windows Intune, see [Manage PowerShell scripts in Intune for Windows 10 devices](https://docs.microsoft.com/intune/intune-management-extension). - -### Distributing policies at scale - -There are a number of policies that can be centrally managed to control Windows Analytics device configuration. All of these policies have *preference* registry key equivalents that can be set by using the deployment script. Policy settings override preference settings if both are set. ->[!NOTE] ->You can only set the diagnostic data level to Enhanced by using policy. For example, this is necessary to use Device Health. - -These policies are defined by values under **Microsoft\Windows\DataCollection**. All are REG_DWORD policies (except CommercialId which is REG_SZ). - ->[!IMPORTANT] ->Configuring these keys independently without using the enrollment script is not recommended. There is additional validation that occurs when you use the enrollment script. - -| Policy | Value | -|-----------------------|------------------| -| CommercialId | In order for your devices to show up in Windows Analytics, they must be configured with your organization’s Commercial ID. | -| AllowTelemetry | **In Windows 10**: 1 (Basic), 2 (Enhanced) or 3 (Full) diagnostic data. Windows Analytics will work with basic diagnostic data, but more features are available when you use the Enhanced level (for example, Device Health requires Enhanced diagnostic data and Upgrade Readiness only collects app usage and site discovery data on Windows 10 devices with Enhanced diagnostic data). For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). | -| LimitEnhancedDiagnosticDataWindowsAnalytics | **In Windows 10**: Only applies when AllowTelemetry=2. Limits the Enhanced diagnostic data events sent to Microsoft to just those needed by Windows Analytics. For more information, see [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields).| -| AllowDeviceNameInTelemetry | **In Windows 10, version 1803**: A separate opt-in is required to enable devices to continue to send the device name. Allowing device names to be collected can make it easier for you to identify individual devices that report problems. Without the device name, Windows Analytics can only label devices by a GUID that it generates. | -| CommercialDataOptIn | **In Windows 7 and Windows 8**: 1 is required for Upgrade Readiness, which is the only solution that runs on Windows 7 or Windows 8. | - -You can set these values by using Group Policy (in Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds) or by using Mobile Device Management (in Provider/*Provider ID*/CommercialID). (If you are using Microsoft Intune, use `MS DM Server` as the provider ID.) For more information about deployment using MDM, see the [DMClient CSP](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp) topic in MDM documentation. - -The corresponding preference registry values are available in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** and can be configured by the deployment script. If a given setting is configured by both preference registry settings and policy, the policy values will override. However, the **IEDataOptIn** setting is different--you can only set this with the preference registry keys: - -- IEOptInLevel = 0 Internet Explorer data collection is disabled -- IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones -- IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones -- IEOptInLevel = 3 Data collection is enabled for all sites - -For more information about Internet Explorer Security Zones, see [About URL Security Zones](https://docs.microsoft.com/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537183(v=vs.85)). - -### Distribution at scale without using the deployment script - -We recommend using the deployment script to configure devices. However if this is not an option, you can still manage settings by policy as described in the previous section. However, if you don't run the deployment script, you won't benefit from its error checking, and you might have to wait a long time (possibly weeks) before devices send the initial full inventory scan. - -Note that it is possible to intiate a full inventory scan on a device by calling these commands: -- CompatTelRunner.exe -m:generaltel.dll -f:DoCensusRun -- CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun ent - -For details on how to run these and how to check results, see the deployment script. - diff --git a/windows/deployment/update/windows-analytics-overview.md b/windows/deployment/update/windows-analytics-overview.md deleted file mode 100644 index 833f2db650..0000000000 --- a/windows/deployment/update/windows-analytics-overview.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Windows Analytics -ms.reviewer: -manager: laurawi -description: Introduction and overview of Windows Analytics -keywords: Device Health, Upgrade Readiness, Update Compliance, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Windows Analytics overview - -Windows Analytics is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: - -## Device Health - -[Device Health](device-health-get-started.md) provides the following: - -- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced -- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes -- Notification of Windows Information Protection misconfigurations that send prompts to end users - - -## Update Compliance - -[Update Compliance](update-compliance-get-started.md) shows you the state of your devices with respect to the Windows updates so that you can ensure that they are on the most current updates as appropriate. In addition, Update Compliance provides the following: - -- Dedicated drill-downs for devices that might need attention -- An inventory of devices, including the version of Windows they are running and their update status -- The ability to track protection and threat status for Windows Defender Antivirus-enabled devices -- An overview of Windows Update for Business deferral configurations (Windows 10, version 1607 and later) -- Powerful built-in log analytics to create useful custom queries -- Cloud-connected access utilizing Windows 10 diagnostic data means no need for new complex, customized infrastructure - -## Upgrade Readiness - -[Upgrade Readiness](../upgrade/upgrade-readiness-get-started.md) offers a set of tools to plan and manage the upgrade process end to end, allowing you to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. Upgrade Readiness not only supports upgrade management from Windows 7 and Windows 8.1 to Windows 10, but also Windows 10 upgrades in the Windows as a service model. - -Use Upgrade Readiness to get: - -- A visual workflow that guides you from pilot to production -- Detailed computer and application inventory -- Powerful computer-level search and drill-downs -- Guidance and insights into application and driver compatibility issues, with suggested fixes -- Data-driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools, including System Center Configuration Manager - -To get started with any of these solutions, visit the links for instructions to add it to Azure Portal. - ->[!NOTE] -> For details about licensing requirements and costs associated with using Windows Analytics solutions, see [What are the requirements and costs for Windows Analytics solutions?](windows-analytics-FAQ-troubleshooting.md#what-are-the-requirements-and-costs-for-windows-analytics-solutions). diff --git a/windows/deployment/update/windows-analytics-privacy.md b/windows/deployment/update/windows-analytics-privacy.md deleted file mode 100644 index 8e7a8558db..0000000000 --- a/windows/deployment/update/windows-analytics-privacy.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Windows Analytics and privacy -ms.reviewer: -manager: laurawi -description: How Windows Analytics uses data -keywords: windows analytics, oms, privacy, data, diagnostic, operations management suite, prerequisites, requirements, updates, upgrades, log analytics, health, FAQ, problems, troubleshooting, error -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.audience: itpro author: greg-lindsay -ms.localizationpriority: high -ms.collection: M365-analytics -ms.topic: article ---- - -# Windows Analytics and privacy - -Windows Analytics is fully committed to privacy, centering on these tenets: - -- **Transparency:** We fully document the Windows Analytics diagnostic events (see the links for additional information) so you can review them with your company’s security and compliance teams. The Diagnostic Data Viewer lets you see diagnostic data sent from a given device (see [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) for details). -- **Control:** You ultimately control the level of diagnostic data you wish to share. In Windows 10, version 1709 we added a new policy to Limit enhanced diagnostic data to the minimum required by Windows Analytics -- **Security:** Your data is protected with strong security and encryption -- **Trust:** Windows Analytics supports the Microsoft Online Service Terms - -The following illustration shows how diagnostic data flows from individual devices through the Diagnostic Data Service, Azure Log Analytics storage, and to your Log Analytics workspace: - -[![Diagram illustrating flow of diagnostic data from devices](images/WA-data-flow-v1.png)](images/WA-data-flow-v1.png) - -The data flow sequence is as follows: - -1. Diagnostic data is sent from devices to the Microsoft Diagnostic Data Management service, which is hosted in the US. -2. An IT administrator creates an Azure Log Analytics workspace. The administrator chooses the location, copies the Commercial ID (which identifies that workspace), and then pushes Commercial ID to devices they want to monitor. This is the mechanism that specifies which devices appear in which workspaces. -3. Each day Microsoft produces a "snapshot" of IT-focused insights for each workspace in the Diagnostic Data Management service. -4. These snapshots are copied to transient storage which is used only by Windows Analytics (also hosted in US data centers) where they are segregated by Commercial ID. -5. The snapshots are then copied to the appropriate Azure Log Analytics workspace. -6. If the IT administrator is using the Upgrade Readiness solution, user input from the IT administrator (specifically, the target operating system release and the importance and upgrade readiness per app) is stored in the Windows Analytics Azure Storage. (Upgrade Readiness is the only Windows Analytics solution that takes such user input.) - - -See these topics for additional background information about related privacy issues: - -- [Windows 10 and the GDPR for IT Decision Makers](https://docs.microsoft.com/windows/privacy/gdpr-it-guidance) -- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization) -- [Windows 7, Windows 8, and Windows 8.1 Appraiser Telemetry Events, and Fields](https://go.microsoft.com/fwlink/?LinkID=822965) -- [Windows 10, version 1809 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809) -- [Windows 10, version 1803 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803) -- [Windows 10, version 1709 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) -- [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) -- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields) -- [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) -- [Licensing Terms and Documentation](https://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=31) -- [Learn about security and privacy at Microsoft datacenters](https://www.microsoft.com/datacenters) -- [Confidence in the trusted cloud](https://azure.microsoft.com/support/trust-center/) -- [Trust Center](https://www.microsoft.com/trustcenter) - -### Can Windows Analytics be used without a direct client connection to the Microsoft Data Management Service? -No, the entire service is powered by Windows diagnostic data, which requires that devices have this direct connectivity. - -### Can I choose the data center location? -Yes for Azure Log Analytics, but no for the Microsoft Data Management Service (which is hosted in the US). diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index ab43140802..e992f49cb7 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -1,131 +1,117 @@ ---- -title: Windows as a service -ms.prod: windows-10 -layout: LandingPage -ms.topic: landing-page -ms.manager: elizapo -audience: itpro author: greg-lindsay -ms.audience: itpro author: greg-lindsay -ms.date: 01/24/2019 -ms.reviewer: -manager: laurawi -ms.localizationpriority: high -ms.collection: M365-modern-desktop ---- -# Windows as a service - -Find the tools and resources you need to help deploy and support Windows as a service in your organization. - -## Latest news, videos, & podcasts - -Find the latest and greatest news on Windows 10 deployment and servicing. - -**Discovering the Windows 10 Update history pages** -> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY] - -Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the Windows release health dashboard for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout. - -The latest news: - - -[See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog). - -## IT pro champs corner -Written by IT pros for IT pros, sharing real world examples and scenarios for Windows 10 deployment and servicing. - - - -**NEW** Tactical considerations for creating Windows deployment rings - -**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization - -Deployment rings: The hidden [strategic] gem of Windows as a service - -Classifying Windows updates in common deployment tools - -Express updates for Windows Server 2016 re-enabled for November 2018 update - - -2019 SHA-2 Code Signing Support requirement for Windows and WSUS - -Deploying Windows 10 Feature Updates to 24/7 Mission Critical Devices - -## Discover - -Learn more about Windows as a service and its value to your organization. - - - -Overview of Windows as a service - -Quick guide to Windows as a service - -Windows Analytics overview - -What's new in Windows 10 deployment - -How Microsoft IT deploys Windows 10 - -## Plan - -Prepare to implement Windows as a service effectively using the right tools, products, and strategies. - - - -Simplified updates - -Windows 10 end user readiness - -Ready for Windows - -Manage Windows upgrades with Upgrade Readiness - -Preparing your organization for a seamless Windows 10 deployment - -## Deploy - -Secure your organization's deployment investment. - - - -Update Windows 10 in the enterprise - -Deploying as an in-place upgrade - -Configure Windows Update for Business - -Express update delivery - -Windows 10 deployment considerations - - -## Microsoft Ignite 2018 - - -Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. - -[BRK2417: What’s new in Windows Analytics: An Intro to Desktop Analytics](https://myignite.techcommunity.microsoft.com/sessions/64324#ignite-html-anchor) - -[BRK3018: Deploying Windows 10 in the enterprise using traditional and modern techniques](https://myignite.techcommunity.microsoft.com/sessions/64509#ignite-html-anchor) - -[BRK3019: Delivery Optimization deep dive: How to reduce internet bandwidth impact on your network](https://myignite.techcommunity.microsoft.com/sessions/64510#ignite-html-anchor) - -[BRK3020: Using AI to automate Windows and Office update staging with Windows Update for Business](https://myignite.techcommunity.microsoft.com/sessions/64513#ignite-html-anchor) - -[BRK3027: Deploying Windows 10: Making the update experience smooth and seamless](https://myignite.techcommunity.microsoft.com/sessions/64612#ignite-html-anchor) - -[BRK3039: Windows 10 and Microsoft Office 365 ProPlus lifecycle and servicing update](https://myignite.techcommunity.microsoft.com/sessions/66763#ignite-html-anchor) - -[BRK3211: Ask the Experts: Successfully deploying, servicing, managing Windows 10](https://myignite.techcommunity.microsoft.com/sessions/65963#ignite-html-anchor) - -[THR2234: Windows servicing and delivery fundamentals](https://myignite.techcommunity.microsoft.com/sessions/66741#ignite-html-anchor) - -[THR3006: The pros and cons of LTSC in the enterprise](https://myignite.techcommunity.microsoft.com/sessions/64512#ignite-html-anchor) +--- +title: Windows as a service +ms.prod: w10 +ms.topic: landing-page +ms.manager: laurawi +audience: itpro +itproauthor: jaimeo +author: jaimeo +description: Discover the latest news articles, videos, and podcasts about Windows as a service. Find resources for using Windows as a service within your organization. +ms.audience: itpro +ms.reviewer: +manager: laurawi +ms.localizationpriority: high +ms.collection: M365-modern-desktop +--- + +# Windows as a service + +Find the tools and resources you need to help deploy and support Windows as a service in your organization. + +## Latest news, videos, & podcasts + +Find the latest and greatest news on Windows 10 deployment and servicing. + +**Discovering the Windows 10 Update history pages** +> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY] + +Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the Windows release health dashboard for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout. + +The latest news: + + +[See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog). + +## IT pro champs corner +Written by IT pros for IT pros, sharing real world examples and scenarios for Windows 10 deployment and servicing. + + + +**NEW** Tactical considerations for creating Windows deployment rings + +**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization + +Deployment rings: The hidden [strategic] gem of Windows as a service + +Classifying Windows updates in common deployment tools + +Express updates for Windows Server 2016 re-enabled for November 2018 update + + +2019 SHA-2 Code Signing Support requirement for Windows and WSUS + +Deploying Windows 10 Feature Updates to 24/7 Mission Critical Devices + +## Discover + +Learn more about Windows as a service and its value to your organization. + + + +Overview of Windows as a service + +Quick guide to Windows as a service + + +What's new in Windows 10 deployment + +How Microsoft IT deploys Windows 10 + +## Plan + +Prepare to implement Windows as a service effectively using the right tools, products, and strategies. + + + +Simplified updates + +Windows 10 end user readiness + +Ready for Windows + +Manage Windows upgrades with Upgrade Readiness + +Preparing your organization for a seamless Windows 10 deployment + +## Deploy + +Secure your organization's deployment investment. + + + +Update Windows 10 in the enterprise + +Deploying as an in-place upgrade + +Configure Windows Update for Business + +Express update delivery + +Windows 10 deployment considerations + + +## Microsoft Ignite 2018 + + +Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. See [MyIgnite - Session catalog](https://myignite.techcommunity.microsoft.com/sessions). diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index 52969656a5..fa6a49c1a0 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -1,365 +1,368 @@ ---- -title: Windows Update error code list by component -description: Reference information for Windows Update error codes -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Windows Update error codes by component - ->Applies to: Windows 10 - - -This section lists the error codes for Microsoft Windows Update. - -## Automatic Update Errors - -| Error code | Message | Description | -|------------|-------------------------------|--------------------------------------------------------------------------------------------------------| -| 0x80243FFF | WU_E_AUCLIENT_UNEXPECTED | There was a user interface error not covered by another WU_E_AUCLIENT_\* error code. | -| 0x8024A000 | WU_E_AU_NOSERVICE | Automatic Updates was unable to service incoming requests.  | -| 0x8024A002 | WU_E_AU_NONLEGACYSERVER | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. | -| 0x8024A003 | WU_E_AU_LEGACYCLIENTDISABLED |  The old version of the Automatic Updates client was disabled. | -| 0x8024A004 | WU_E_AU_PAUSED | Automatic Updates was unable to process incoming requests because it was paused. | -| 0x8024A005 | WU_E_AU_NO_REGISTERED_SERVICE |  No unmanaged service is registered with AU. | -| 0x8024AFFF | WU_E_AU_UNEXPECTED |  An Automatic Updates error not covered by another WU_E_AU \* code. | - -## Windows Update UI errors - -| Error code | Message | Description | -|------------|-------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| -| 0x80243001 | WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION | The results of download and installation could not be read from the registry due to an unrecognized data format version. | -| 0x80243002 | WU_E_INSTALLATION_RESULTS_INVALID_DATA | The results of download and installation could not be read from the registry due to an invalid data format. | -| 0x80243003 | WU_E_INSTALLATION_RESULTS_NOT_FOUND | The results of download and installation are not available; the operation may have failed to start. | -| 0x80243004 |  WU_E_TRAYICON_FAILURE |  A failure occurred when trying to create an icon in the taskbar notification area. | -| 0x80243FFD |  WU_E_NON_UI_MODE |  Unable to show UI when in non-UI mode; WU client UI modules may not be installed.  | -| 0x80243FFE |  WU_E_WUCLTUI_UNSUPPORTED_VERSION |  Unsupported version of WU client UI exported functions.  | -| 0x80243FFF |  WU_E_AUCLIENT_UNEXPECTED |  There was a user interface error not covered by another WU_E_AUCLIENT_\* error code.  | - -## Inventory errors - -| Error code | Message | Description | -|------------|-------------------------------------------|-------------------------------------------------------------------------------| -| 0x80249001 |  WU_E_INVENTORY_PARSEFAILED |  Parsing of the rule file failed.  | -| 0x80249002 |  WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED |  Failed to get the requested inventory type from the server.  | -| 0x80249003 |  WU_E_INVENTORY_RESULT_UPLOAD_FAILED |  Failed to upload inventory result to the server.  | -| 0x80249004 |  WU_E_INVENTORY_UNEXPECTED |  There was an inventory error not covered by another error code. | -| 0x80249005 |  WU_E_INVENTORY_WMI_ERROR |  A WMI error occurred when enumerating the instances for a particular class.  | - -## Expression evaluator errors - -| Error code | Message | Description | -|-------------|--------------------------------|----------------------------------------------------------------------------------------------------------------------------------| -| 0x8024E001 |  WU_E_EE_UNKNOWN_EXPRESSION |  An expression evaluator operation could not be completed because an expression was unrecognized. | -| 0x8024E002 |  WU_E_EE_INVALID_EXPRESSION |  An expression evaluator operation could not be completed because an expression was invalid.  | -| 0x8024E003 |  WU_E_EE_MISSING_METADATA |  An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes.  | -| 0x8024E004 |  WU_E_EE_INVALID_VERSION |  An expression evaluator operation could not be completed because the version of the serialized expression data is invalid.  | -|  0x8024E005 |  WU_E_EE_NOT_INITIALIZED |  The expression evaluator could not be initialized. | -|  0x8024E006 |  WU_E_EE_INVALID_ATTRIBUTEDATA |  An expression evaluator operation could not be completed because there was an invalid attribute. | -|  0x8024E007 |  WU_E_EE_CLUSTER_ERROR |  An expression evaluator operation could not be completed because the cluster state of the computer could not be determined.  | -|  0x8024EFFF |  WU_E_EE_UNEXPECTED |  There was an expression evaluator error not covered by another WU_E_EE_\* error code.  | - -## Reporter errors - -| Error code | Message | Description | -|-------------|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------| -|  0x80247001 |  WU_E_OL_INVALID_SCANFILE |  An operation could not be completed because the scan package was invalid. | -| 0x80247002 |  WU_E_OL_NEWCLIENT_REQUIRED |  An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. | -|  0x80247FFF |  WU_E_OL_UNEXPECTED |  Search using the scan package failed.  | -|  0x8024F001 |  WU_E_REPORTER_EVENTCACHECORRUPT |  The event cache file was defective.  | -|  0x8024F002 |  WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED |  The XML in the event namespace descriptor could not be parsed. | -|  0x8024F003 |  WU_E_INVALID_EVENT |  The XML in the event namespace descriptor could not be parsed. | -|  0x8024F004 |  WU_E_SERVER_BUSY |  The server rejected an event because the server was too busy. | -|  0x8024FFFF |  WU_E_REPORTER_UNEXPECTED |  There was a reporter error not covered by another error code.  | - -## Redirector errors -The components that download the Wuredir.cab file and then parse the Wuredir.cab file generate the following errors. - -|Error code|Message|Description | -|-|-|-| -| 0x80245001| WU_E_REDIRECTOR_LOAD_XML| The redirector XML document could not be loaded into the DOM class.  | -| 0x80245002| WU_E_REDIRECTOR_S_FALSE| The redirector XML document is missing some required information. | -| 0x80245003| WU_E_REDIRECTOR_ID_SMALLER| The redirectorId in the downloaded redirector cab is less than in the cached cab.  | -| 0x80245FFF| WU_E_REDIRECTOR_UNEXPECTED| The redirector failed for reasons not covered by another WU_E_REDIRECTOR_* error code.  | - -## Protocol Talker errors -The following errors map to SOAPCLIENT_ERRORs through the Atlsoap.h file. These errors are obtained when the CClientWebService object calls the GetClientError() method. - - -| Error code | Message | Description | -|-------------|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------| -|  0x80244000 |  WU_E_PT_SOAPCLIENT_BASE |  WU_E_PT_SOAPCLIENT_\* error codes map to the SOAPCLIENT_ERROR enum of the ATL Server Library. | -| 0x80244001 |  WU_E_PT_SOAPCLIENT_INITIALIZE |  Same as SOAPCLIENT_INITIALIZE_ERROR - initialization of the SOAP client failed possibly because of an MSXML installation failure. | -|  0x80244002 |  WU_E_PT_SOAPCLIENT_OUTOFMEMORY |  Same as SOAPCLIENT_OUTOFMEMORY - SOAP client failed because it ran out of memory.  | -|  0x80244003 |  WU_E_PT_SOAPCLIENT_GENERATE |  Same as SOAPCLIENT_GENERATE_ERROR - SOAP client failed to generate the request. | -|  0x80244004 |  WU_E_PT_SOAPCLIENT_CONNECT |  Same as SOAPCLIENT_CONNECT_ERROR - SOAP client failed to connect to the server.  | -|  0x80244005 |  WU_E_PT_SOAPCLIENT_SEND |  Same as SOAPCLIENT_SEND_ERROR - SOAP client failed to send a message for reasons of WU_E_WINHTTP_\* error codes. | -|  0x80244006 |  WU_E_PT_SOAPCLIENT_SERVER |  Same as SOAPCLIENT_SERVER_ERROR - SOAP client failed because there was a server error.  | -|  0x80244007 |  WU_E_PT_SOAPCLIENT_SOAPFAULT |  Same as SOAPCLIENT_SOAPFAULT - SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | -|  0x80244008 |  WU_E_PT_SOAPCLIENT_PARSEFAULT |  Same as SOAPCLIENT_PARSEFAULT_ERROR - SOAP client failed to parse a SOAP fault. | -|  0x80244009 |  WU_E_PT_SOAPCLIENT_READ |  Same as SOAPCLIENT_READ_ERROR - SOAP client failed while reading the response from the server. | -|  0x8024400A |  WU_E_PT_SOAPCLIENT_PARSE |  Same as SOAPCLIENT_PARSE_ERROR - SOAP client failed to parse the response from the server.  | - -## Other Protocol Talker errors -The following errors map to SOAP_ERROR_CODEs from the Atlsoap.h file. These errors are obtained from the m_fault.m_soapErrCode member of the CClientWebService object when GetClientError() returns SOAPCLIENT_SOAPFAULT. - - -| Error code | Message | Description | -|-------------|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -|  0x8024400B |  WU_E_PT_SOAP_VERSION |  Same as SOAP_E_VERSION_MISMATCH - SOAP client found an unrecognizable namespace for the SOAP envelope. | -|  0x8024400C |  WU_E_PT_SOAP_MUST_UNDERSTAND |  Same as SOAP_E_MUST_UNDERSTAND - SOAP client was unable to understand a header.  | -|  0x8024400D |  WU_E_PT_SOAP_CLIENT |  Same as SOAP_E_CLIENT - SOAP client found the message was malformed; fix before resending.  | -|  0x8024400E |  WU_E_PT_SOAP_SERVER |  Same as SOAP_E_SERVER - The SOAP message could not be processed due to a server error; resend later.  | -|  0x8024400F |  WU_E_PT_WMI_ERROR |  There was an unspecified Windows Management Instrumentation (WMI) error. | -|  0x80244010 |  WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS |  The number of round trips to the server exceeded the maximum limit.  | -|  0x80244011 |  WU_E_PT_SUS_SERVER_NOT_SET |  WUServer policy value is missing in the registry.  | -|  0x80244012 |  WU_E_PT_DOUBLE_INITIALIZATION |  Initialization failed because the object was already initialized.  | -|  0x80244013 |  WU_E_PT_INVALID_COMPUTER_NAME |  The computer name could not be determined.  | -|  0x80244015 |  WU_E_PT_REFRESH_CACHE_REQUIRED |  The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | -|  0x80244016 |  WU_E_PT_HTTP_STATUS_BAD_REQUEST |  Same as HTTP status 400 - the server could not process the request due to invalid syntax.  | -|  0x80244017 |  WU_E_PT_HTTP_STATUS_DENIED |  Same as HTTP status 401 - the requested resource requires user authentication.  | -|  0x80244018 |  WU_E_PT_HTTP_STATUS_FORBIDDEN |  Same as HTTP status 403 - server understood the request but declined to fulfill it. | -|  0x80244019 |  WU_E_PT_HTTP_STATUS_NOT_FOUND |  Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier).  | -|  0x8024401A |  WU_E_PT_HTTP_STATUS_BAD_METHOD |  Same as HTTP status 405 - the HTTP method is not allowed.  | -|  0x8024401B |  WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ |  Same as HTTP status 407 - proxy authentication is required.  | -|  0x8024401C |  WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT |  Same as HTTP status 408 - the server timed out waiting for the request.  | -|  0x8024401D |  WU_E_PT_HTTP_STATUS_CONFLICT |  Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource.  | -|  0x8024401E |  WU_E_PT_HTTP_STATUS_GONE |  Same as HTTP status 410 - requested resource is no longer available at the server. | -|  0x8024401F |  WU_E_PT_HTTP_STATUS_SERVER_ERROR |  Same as HTTP status 500 - an error internal to the server prevented fulfilling the request.  | -|  0x80244020 |  WU_E_PT_HTTP_STATUS_NOT_SUPPORTED |  Same as HTTP status 500 - server does not support the functionality required to fulfill the request.  | -|  0x80244021 |  WU_E_PT_HTTP_STATUS_BAD_GATEWAY | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfil the request. | -|  0x80244022 |  WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL |  Same as HTTP status 503 - the service is temporarily overloaded.  | -|  0x80244023 |  WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT |  Same as HTTP status 503 - the request was timed out waiting for a gateway.  | -|  0x80244024 |  WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP |  Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request.  | -|  0x80244025 |  WU_E_PT_FILE_LOCATIONS_CHANGED |  Operation failed due to a changed file location; refresh internal state and resend. | -|  0x80244026 |  WU_E_PT_REGISTRATION_NOT_SUPPORTED |  Operation failed because Windows Update Agent does not support registration with a non-WSUS server.  | -|  0x80244027 |  WU_E_PT_NO_AUTH_PLUGINS_REQUESTED |  The server returned an empty authentication information list.  | -|  0x80244028 |  WU_E_PT_NO_AUTH_COOKIES_CREATED |  Windows Update Agent was unable to create any valid authentication cookies.  | -|  0x80244029 |  WU_E_PT_INVALID_CONFIG_PROP |  A configuration property value was wrong.  | -|  0x8024402A |  WU_E_PT_CONFIG_PROP_MISSING |  A configuration property value was missing.  | -|  0x8024402B |  WU_E_PT_HTTP_STATUS_NOT_MAPPED |  The HTTP request could not be completed and the reason did not correspond to any of the WU_E_PT_HTTP_\* error codes.  | -|  0x8024402C |  WU_E_PT_WINHTTP_NAME_NOT_RESOLVED |  Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved.  | -|  0x8024402F |  WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS |  External cab file processing completed with some errors. | -|  0x80244030 |  WU_E_PT_ECP_INIT_FAILED |  The external cab processor initialization did not complete.  | -|  0x80244031 |  WU_E_PT_ECP_INVALID_FILE_FORMAT |  The format of a metadata file was invalid.  | -|  0x80244032 |  WU_E_PT_ECP_INVALID_METADATA |  External cab processor found invalid metadata.  | -|  0x80244033 |  WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST |  The file digest could not be extracted from an external cab file.  | -|  0x80244034 |  WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE |  An external cab file could not be decompressed.  | -|  0x80244035 |  WU_E_PT_ECP_FILE_LOCATION_ERROR |  External cab processor was unable to get file locations.  | -|  0x80244FFF |  WU_E_PT_UNEXPECTED |  A communication error not covered by another WU_E_PT_\* error code.  | -|  0x8024502D |  WU_E_PT_SAME_REDIR_ID |  Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery.  | -|  0x8024502E |  WU_E_PT_NO_MANAGED_RECOVER |  A redirector recovery action did not complete because the server is managed.  | - -## Download Manager errors - -| Error code | Message | Description | -|-------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| -|  0x80246001 |  WU_E_DM_URLNOTAVAILABLE |  A download manager operation could not be completed because the requested file does not have a URL.  | -|  0x80246002 |  WU_E_DM_INCORRECTFILEHASH |  A download manager operation could not be completed because the file digest was not recognized.  | -|  0x80246003 |  WU_E_DM_UNKNOWNALGORITHM |  A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm.  | -|  0x80246004 |  WU_E_DM_NEEDDOWNLOADREQUEST |  An operation could not be completed because a download request is required from the download handler.  | -|  0x80246005 |  WU_E_DM_NONETWORK |  A download manager operation could not be completed because the network connection was unavailable.  | -|  0x80246006 |  WU_E_DM_WRONGBITSVERSION |  A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | -|  0x80246007 |  WU_E_DM_NOTDOWNLOADED |  The update has not been downloaded.  | -|  0x80246008 |  WU_E_DM_FAILTOCONNECTTOBITS |  A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | -|  0x80246009 | WU_E_DM_BITSTRANSFERERROR |  A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error.  | -|  0x8024600A |  WU_E_DM_DOWNLOADLOCATIONCHANGED |  A download must be restarted because the location of the source of the download has changed. | -|  0x8024600B |  WU_E_DM_CONTENTCHANGED |  A download must be restarted because the update content changed in a new revision.  | -|  0x80246FFF |  WU_E_DM_UNEXPECTED |  There was a download manager error not covered by another WU_E_DM_\* error code.  | - -## Update Handler errors - -| Error code | Message | Description | -|-------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| -|  0x80242000 |  WU_E_UH_REMOTEUNAVAILABLE | 9 A request for a remote update handler could not be completed because no remote process is available.  | -|  0x80242001 |  WU_E_UH_LOCALONLY |  A request for a remote update handler could not be completed because the handler is local only.  | -|  0x80242002 |  WU_E_UH_UNKNOWNHANDLER |  A request for an update handler could not be completed because the handler could not be recognized.  | -|  0x80242003 |  WU_E_UH_REMOTEALREADYACTIVE |  A remote update handler could not be created because one already exists.  | -|  0x80242004 |  WU_E_UH_DOESNOTSUPPORTACTION |  A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | -|  0x80242005 |  WU_E_UH_WRONGHANDLER |  An operation did not complete because the wrong handler was specified.  | -|  0x80242006 |  WU_E_UH_INVALIDMETADATA |  A handler operation could not be completed because the update contains invalid metadata.  | -|  0x80242007 |  WU_E_UH_INSTALLERHUNG |  An operation could not be completed because the installer exceeded the time limit.  | -|  0x80242008 |  WU_E_UH_OPERATIONCANCELLED |  An operation being done by the update handler was cancelled.  | -|  0x80242009 |  WU_E_UH_BADHANDLERXML |  An operation could not be completed because the handler-specific metadata is invalid.  | -| 0x8024200A |  WU_E_UH_CANREQUIREINPUT |  A request to the handler to install an update could not be completed because the update requires user input.  | -|  0x8024200B |  WU_E_UH_INSTALLERFAILURE |  The installer failed to install (uninstall) one or more updates.  | -|  0x8024200C |  WU_E_UH_FALLBACKTOSELFCONTAINED |  The update handler should download self-contained content rather than delta-compressed content for the update.  | -|  0x8024200D |  WU_E_UH_NEEDANOTHERDOWNLOAD |  The update handler did not install the update because it needs to be downloaded again.  | -|  0x8024200E |  WU_E_UH_NOTIFYFAILURE |  The update handler failed to send notification of the status of the install (uninstall) operation.  | -|  0x8024200F | WU_E_UH_INCONSISTENT_FILE_NAMES |  The file names contained in the update metadata and in the update package are inconsistent.  | -|  0x80242010 |  WU_E_UH_FALLBACKERROR |  The update handler failed to fall back to the self-contained content.  | -|  0x80242011 |  WU_E_UH_TOOMANYDOWNLOADREQUESTS |  The update handler has exceeded the maximum number of download requests.  | -|  0x80242012 |  WU_E_UH_UNEXPECTEDCBSRESPONSE |  The update handler has received an unexpected response from CBS.  | -|  0x80242013 |  WU_E_UH_BADCBSPACKAGEID |  The update metadata contains an invalid CBS package identifier.  | -|  0x80242014 |  WU_E_UH_POSTREBOOTSTILLPENDING |  The post-reboot operation for the update is still in progress.  | -|  0x80242015 |  WU_E_UH_POSTREBOOTRESULTUNKNOWN |  The result of the post-reboot operation for the update could not be determined.  | -|  0x80242016 |  WU_E_UH_POSTREBOOTUNEXPECTEDSTATE |  The state of the update after its post-reboot operation has completed is unexpected.  | -|  0x80242017 |  WU_E_UH_NEW_SERVICING_STACK_REQUIRED |  The OS servicing stack must be updated before this update is downloaded or installed.  | -|  0x80242FFF |  WU_E_UH_UNEXPECTED |  An update handler error not covered by another WU_E_UH_\* code.  | - -## Data Store errors - -| Error code | Message | Description | -|-------------|-------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -|  0x80248000 |  WU_E_DS_SHUTDOWN |  An operation failed because Windows Update Agent is shutting down.  | -|  0x80248001 |  WU_E_DS_INUSE |  An operation failed because the data store was in use. | -|  0x80248002 |  WU_E_DS_INVALID |  The current and expected states of the data store do not match. | -|  0x80248003 |  WU_E_DS_TABLEMISSING |  The data store is missing a table.  | -|  0x80248004 |  WU_E_DS_TABLEINCORRECT |  The data store contains a table with unexpected columns.  | -|  0x80248005 |  WU_E_DS_INVALIDTABLENAME |  A table could not be opened because the table is not in the data store.  | -|  0x80248006 |  WU_E_DS_BADVERSION |  The current and expected versions of the data store do not match.  | -|  0x80248007 |  WU_E_DS_NODATA |  The information requested is not in the data store.  | -|  0x80248008 |  WU_E_DS_MISSINGDATA |  The data store is missing required information or has a NULL in a table column that requires a non-null value.  | -|  0x80248009 |  WU_E_DS_MISSINGREF |  The data store is missing required information or has a reference to missing license terms file localized property or linked row. | -|  0x8024800A |  WU_E_DS_UNKNOWNHANDLER |  The update was not processed because its update handler could not be recognized.  | -|  0x8024800B |  WU_E_DS_CANTDELETE |  The update was not deleted because it is still referenced by one or more services.  | -|  0x8024800C |  WU_E_DS_LOCKTIMEOUTEXPIRED |  The data store section could not be locked within the allotted time.  | -|  0x8024800D |  WU_E_DS_NOCATEGORIES |  The category was not added because it contains no parent categories and is not a top-level category itself.  | -|  0x8024800E |  WU_E_DS_ROWEXISTS |  The row was not added because an existing row has the same primary key.  | -|  0x8024800F |  WU_E_DS_STOREFILELOCKED |  The data store could not be initialized because it was locked by another process.  | -|  0x80248010 |  WU_E_DS_CANNOTREGISTER |  The data store is not allowed to be registered with COM in the current process.  | -|  0x80248011 | WU_E_DS_UNABLETOSTART |  Could not create a data store object in another process.  | -|  0x80248013 |  WU_E_DS_DUPLICATEUPDATEID | The server sent the same update to the client with two different revision IDs.  | -|  0x80248014 | WU_E_DS_UNKNOWNSERVICE |  An operation did not complete because the service is not in the data store.  | -| 0x80248015 | WU_E_DS_SERVICEEXPIRED | An operation did not complete because the registration of the service has expired.  | -| 0x80248016 |  WU_E_DS_DECLINENOTALLOWED |  A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline.  | -| 0x80248017 |  WU_E_DS_TABLESESSIONMISMATCH |  A table was not closed because it is not associated with the session.  | -| 0x80248018 |  WU_E_DS_SESSIONLOCKMISMATCH |  A table was not closed because it is not associated with the session.  | -| 0x80248019 |  WU_E_DS_NEEDWINDOWSSERVICE |  A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service.  | -| 0x8024801A |  WU_E_DS_INVALIDOPERATION |  A request was declined because the operation is not allowed.  | -| 0x8024801B |  WU_E_DS_SCHEMAMISMATCH |  The schema of the current data store and the schema of a table in a backup XML document do not match.  | -| 0x8024801C |  WU_E_DS_RESETREQUIRED |  The data store requires a session reset; release the session and retry with a new session.  | -| 0x8024801D |  WU_E_DS_IMPERSONATED |  A data store operation did not complete because it was requested with an impersonated identity.  | -| 0x80248FFF |  WU_E_DS_UNEXPECTED |  A data store error not covered by another WU_E_DS_\* code.  | - -## Driver Util errors -The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped. - -|Error code|Message|Description -|-|-|-| -| 0x8024C001 | WU_E_DRV_PRUNED| A driver was skipped.  -| 0x8024C002 |WU_E_DRV_NOPROP_OR_LEGACY| A property for the driver could not be found. It may not conform with required specifications.  -| 0x8024C003 | WU_E_DRV_REG_MISMATCH| The registry type read for the driver does not match the expected type.  -| 0x8024C004 | WU_E_DRV_NO_METADATA| The driver update is missing metadata.  -| 0x8024C005 | WU_E_DRV_MISSING_ATTRIBUTE| The driver update is missing a required attribute.  -| 0x8024C006| WU_E_DRV_SYNC_FAILED| Driver synchronization failed.  -| 0x8024C007 | WU_E_DRV_NO_PRINTER_CONTENT| Information required for the synchronization of applicable printers is missing.  -| 0x8024CFFF | WU_E_DRV_UNEXPECTED| A driver error not covered by another WU_E_DRV_* code.  - -## Windows Update error codes - -|Error code|Message|Description -|-|-|-| -| 0x80240001 | WU_E_NO_SERVICE| Windows Update Agent was unable to provide the service.  -| 0x80240002 | WU_E_MAX_CAPACITY_REACHED | The maximum capacity of the service was exceeded.  -| 0x80240003 | WU_E_UNKNOWN_ID| An ID cannot be found.  -| 0x80240004 | WU_E_NOT_INITIALIZED| The object could not be initialized.  -| 0x80240005 | WU_E_RANGEOVERLAP |The update handler requested a byte range overlapping a previously requested range.  -| 0x80240006 | WU_E_TOOMANYRANGES| The requested number of byte ranges exceeds the maximum number (2^31 - 1).  -| 0x80240007 | WU_E_INVALIDINDEX| The index to a collection was invalid.  -| 0x80240008 | WU_E_ITEMNOTFOUND| The key for the item queried could not be found.  -| 0x80240009 | WU_E_OPERATIONINPROGRESS| Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously.  -| 0x8024000A | WU_E_COULDNOTCANCEL| Cancellation of the operation was not allowed.  -| 0x8024000B | WU_E_CALL_CANCELLED| Operation was cancelled.  -| 0x8024000C | WU_E_NOOP| No operation was required.  -| 0x8024000D | WU_E_XML_MISSINGDATA| Windows Update Agent could not find required information in the update's XML data.  -| 0x8024000E | WU_E_XML_INVALID| Windows Update Agent found invalid information in the update's XML data.  -| 0x8024000F | WU_E_CYCLE_DETECTED | Circular update relationships were detected in the metadata.  -| 0x80240010 | WU_E_TOO_DEEP_RELATION| Update relationships too deep to evaluate were evaluated.  -| 0x80240011 | WU_E_INVALID_RELATIONSHIP| An invalid update relationship was detected.  -| 0x80240012 | WU_E_REG_VALUE_INVALID| An invalid registry value was read.  -| 0x80240013 | WU_E_DUPLICATE_ITEM| Operation tried to add a duplicate item to a list.  -| 0x80240016 | WU_E_INSTALL_NOT_ALLOWED| Operation tried to install while another installation was in progress or the system was pending a mandatory restart.  -| 0x80240017 | WU_E_NOT_APPLICABLE| Operation was not performed because there are no applicable updates.  -| 0x80240018 | WU_E_NO_USERTOKEN| Operation failed because a required user token is missing.  -| 0x80240019 | WU_E_EXCLUSIVE_INSTALL_CONFLICT| An exclusive update cannot be installed with other updates at the same time.  -| 0x8024001A | WU_E_POLICY_NOT_SET | A policy value was not set.  -| 0x8024001B | WU_E_SELFUPDATE_IN_PROGRESS| The operation could not be performed because the Windows Update Agent is self-updating.  -| 0x8024001D | WU_E_INVALID_UPDATE| An update contains invalid metadata.  -| 0x8024001E | WU_E_SERVICE_STOP| Operation did not complete because the service or system was being shut down.  -| 0x8024001F | WU_E_NO_CONNECTION| Operation did not complete because the network connection was unavailable.  -| 0x80240020 | WU_E_NO_INTERACTIVE_USER| Operation did not complete because there is no logged-on interactive user.  -| 0x80240021 | WU_E_TIME_OUT| Operation did not complete because it timed out.  -| 0x80240022 | WU_E_ALL_UPDATES_FAILED| Operation failed for all the updates.  -| 0x80240023 | WU_E_EULAS_DECLINED| The license terms for all updates were declined.  -| 0x80240024 | WU_E_NO_UPDATE| There are no updates.  -| 0x80240025 | WU_E_USER_ACCESS_DISABLED| Group Policy settings prevented access to Windows Update.  -| 0x80240026 | WU_E_INVALID_UPDATE_TYPE| The type of update is invalid.  -| 0x80240027 | WU_E_URL_TOO_LONG| The URL exceeded the maximum length.  -| 0x80240028 | WU_E_UNINSTALL_NOT_ALLOWED| The update could not be uninstalled because the request did not originate from a WSUS server.  -| 0x80240029 | WU_E_INVALID_PRODUCT_LICENSE| Search may have missed some updates before there is an unlicensed application on the system.  -| 0x8024002A | WU_E_MISSING_HANDLER| A component required to detect applicable updates was missing.  -| 0x8024002B | WU_E_LEGACYSERVER| An operation did not complete because it requires a newer version of server.  -| 0x8024002C | WU_E_BIN_SOURCE_ABSENT| A delta-compressed update could not be installed because it required the source.  -| 0x8024002D | WU_E_SOURCE_ABSENT| A full-file update could not be installed because it required the source.  -| 0x8024002E | WU_E_WU_DISABLED| Access to an unmanaged server is not allowed.  -| 0x8024002F | WU_E_CALL_CANCELLED_BY_POLICY| Operation did not complete because the DisableWindowsUpdateAccess policy was set.  -| 0x80240030 | WU_E_INVALID_PROXY_SERVER| The format of the proxy list was invalid.  -| 0x80240031 | WU_E_INVALID_FILE| The file is in the wrong format.  -| 0x80240032 | WU_E_INVALID_CRITERIA| The search criteria string was invalid.  -| 0x80240033 | WU_E_EULA_UNAVAILABLE| License terms could not be downloaded.  -| 0x80240034 | WU_E_DOWNLOAD_FAILED| Update failed to download.  -| 0x80240035 | WU_E_UPDATE_NOT_PROCESSED| The update was not processed.  -| 0x80240036 | WU_E_INVALID_OPERATION| The object's current state did not allow the operation.  -| 0x80240037 | WU_E_NOT_SUPPORTED| The functionality for the operation is not supported.  -| 0x80240038 | WU_E_WINHTTP_INVALID_FILE| The downloaded file has an unexpected content type.  -| 0x80240039 | WU_E_TOO_MANY_RESYNC| Agent is asked by server to resync too many times.  -| 0x80240040 | WU_E_NO_SERVER_CORE_SUPPORT| WUA API method does not run on Server Core installation.  -| 0x80240041 | WU_E_SYSPREP_IN_PROGRESS| Service is not available while sysprep is running.  -| 0x80240042 | WU_E_UNKNOWN_SERVICE| The update service is no longer registered with AU.  -| 0x80240043 | WU_E_NO_UI_SUPPORT| There is no support for WUA UI.  -| 0x80240FFF | WU_E_UNEXPECTED| An operation failed due to reasons not covered by another error code.  - -## Windows Update success codes - -|Error code|Message|Description -|-|-|-| -| 0x00240001| WU_S_SERVICE_STOP| Windows Update Agent was stopped successfully.  -| 0x00240002 | WU_S_SELFUPDATE| Windows Update Agent updated itself.  -| 0x00240003 | WU_S_UPDATE_ERROR| Operation completed successfully but there were errors applying the updates.  -| 0x00240004 | WU_S_MARKED_FOR_DISCONNECT| A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing.  -| 0x00240005 | WU_S_REBOOT_REQUIRED| The system must be restarted to complete installation of the update.  -| 0x00240006 | WU_S_ALREADY_INSTALLED| The update to be installed is already installed on the system.  -| 0x00240007 | WU_S_ALREADY_UNINSTALLED | The update to be removed is not installed on the system.  -| 0x00240008 | WU_S_ALREADY_DOWNLOADED| The update to be downloaded has already been downloaded.  - -## Windows Installer minor errors -The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer. - -|Error code|Message|Description -|-|-|-| -| 0x80241001 |WU_E_MSI_WRONG_VERSION| Search may have missed some updates because the Windows Installer is less than version 3.1.  -| 0x80241002 | WU_E_MSI_NOT_CONFIGURED| Search may have missed some updates because the Windows Installer is not configured.  -| 0x80241003 | WU_E_MSP_DISABLED| Search may have missed some updates because policy has disabled Windows Installer patching.  -| 0x80241004 | WU_E_MSI_WRONG_APP_CONTEXT| An update could not be applied because the application is installed per-user.  -| 0x80241FFF | WU_E_MSP_UNEXPECTED| Search may have missed some updates because there was a failure of the Windows Installer.  - -## Windows Update Agent update and setup errors - -|Error code|Message|Description -|-|-|-| -| 0x8024D001 | WU_E_SETUP_INVALID_INFDATA| Windows Update Agent could not be updated because an INF file contains invalid information.  -| 0x8024D002 | WU_E_SETUP_INVALID_IDENTDATA| Windows Update Agent could not be updated because the wuident.cab file contains invalid information.  -| 0x8024D003 | WU_E_SETUP_ALREADY_INITIALIZED| Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice.  -| 0x8024D004 | WU_E_SETUP_NOT_INITIALIZED| Windows Update Agent could not be updated because setup initialization never completed successfully.  -| 0x8024D005 | WU_E_SETUP_SOURCE_VERSION_MISMATCH| Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions.  -| 0x8024D006 | WU_E_SETUP_TARGET_VERSION_GREATER| Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file.  -| 0x8024D007 | WU_E_SETUP_REGISTRATION_FAILED| Windows Update Agent could not be updated because regsvr32.exe returned an error.  -| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE| An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file.  -| 0x8024D00A | WU_E_SETUP_UNSUPPORTED_CONFIGURATION| Windows Update Agent could not be updated because the current system configuration is not supported.  -| 0x8024D00B | WU_E_SETUP_BLOCKED_CONFIGURATION| Windows Update Agent could not be updated because the system is configured to block the update.  -| 0x8024D00C | WU_E_SETUP_REBOOT_TO_FIX| Windows Update Agent could not be updated because a restart of the system is required.  -| 0x8024D00D | WU_E_SETUP_ALREADYRUNNING| Windows Update Agent setup is already running.  -| 0x8024D00E | WU_E_SETUP_REBOOTREQUIRED| Windows Update Agent setup package requires a reboot to complete installation.  -| 0x8024D00F | WU_E_SETUP_HANDLER_EXEC_FAILURE| Windows Update Agent could not be updated because the setup handler failed during execution.  -| 0x8024D010 | WU_E_SETUP_INVALID_REGISTRY_DATA| Windows Update Agent could not be updated because the registry contains invalid information.  -| 0x8024D013 | WU_E_SETUP_WRONG_SERVER_VERSION| Windows Update Agent could not be updated because the server does not contain update information for this version.  -| 0x8024DFFF | WU_E_SETUP_UNEXPECTED| Windows Update Agent could not be updated because of an error not covered by another WU_E_SETUP_* error code.  +--- +title: Windows Update error code list by component +description: Learn about reference information for Windows Update error codes, including automatic update errors, UI errors, and reporter errors. +ms.prod: w10 +ms.mktglfcycl: +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows Update error codes by component + +> Applies to: Windows 10 + + +This section lists the error codes for Microsoft Windows Update. + +## Automatic Update Errors + +| Error code | Message | Description | +|------------|---------------------------------|--------------------------------------------------------------------------------------------------------| +| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | +| 0x8024A000 | `WU_E_AU_NOSERVICE` | Automatic Updates was unable to service incoming requests. | +| 0x8024A002 | `WU_E_AU_NONLEGACYSERVER` | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. | +| 0x8024A003 | `WU_E_AU_LEGACYCLIENTDISABLED` | The old version of the Automatic Updates client was disabled. | +| 0x8024A004 | `WU_E_AU_PAUSED` | Automatic Updates was unable to process incoming requests because it was paused. | +| 0x8024A005 | `WU_E_AU_NO_REGISTERED_SERVICE` | No unmanaged service is registered with `AU`. | +| 0x8024AFFF | `WU_E_AU_UNEXPECTED` | An Automatic Updates error not covered by another `WU_E_AU*` code. | + +## Windows Update UI errors + +| Error code | Message | Description | +|------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| +| 0x80243001 | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation could not be read from the registry due to an unrecognized data format version. | +| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation could not be read from the registry due to an invalid data format. | +| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation are not available; the operation may have failed to start. | +| 0x80243004 | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. | +| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; WU client UI modules may not be installed. | +| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of WU client UI exported functions. | +| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | +| 0x8024043D | `WU_E_SERVICEPROP_NOTAVAIL` | The requested service property is not available. | + +## Inventory errors + +| Error code | Message | Description | +|------------|--------------------------------------------|-------------------------------------------------------------------------------| +| 0x80249001 | `WU_E_INVENTORY_PARSEFAILED` | Parsing of the rule file failed. | +| 0x80249002 | `WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED` | Failed to get the requested inventory type from the server. | +| 0x80249003 | `WU_E_INVENTORY_RESULT_UPLOAD_FAILED` | Failed to upload inventory result to the server. | +| 0x80249004 | `WU_E_INVENTORY_UNEXPECTED` | There was an inventory error not covered by another error code. | +| 0x80249005 | `WU_E_INVENTORY_WMI_ERROR` | A WMI error occurred when enumerating the instances for a particular class. | + +## Expression evaluator errors + +| Error code | Message | Description | +|------------|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------| +| 0x8024E001 | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation could not be completed because an expression was unrecognized. | +| 0x8024E002 | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation could not be completed because an expression was invalid. | +| 0x8024E003 | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. | +| 0x8024E004 | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. | +| 0x8024E005 | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator could not be initialized. | +| 0x8024E006 | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation could not be completed because there was an invalid attribute. | +| 0x8024E007 | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. | +| 0x8024EFFF | `WU_E_EE_UNEXPECTED` | There was an expression evaluator error not covered by another `WU_E_EE_*` error code. | + +## Reporter errors + +| Error code | Message | Description | +|------------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------| +| 0x80247001 | `WU_E_OL_INVALID_SCANFILE` | An operation could not be completed because the scan package was invalid. | +| 0x80247002 | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. | +| 0x80247FFF | `WU_E_OL_UNEXPECTED` | Search using the scan package failed. | +| 0x8024F001 | `WU_E_REPORTER_EVENTCACHECORRUPT` | The event cache file was defective. | +| 0x8024F002 | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor could not be parsed. | +| 0x8024F003 | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor could not be parsed. | +| 0x8024F004 | `WU_E_SERVER_BUSY` | The server rejected an event because the server was too busy. | +| 0x8024FFFF | `WU_E_REPORTER_UNEXPECTED` | There was a reporter error not covered by another error code. | + +## Redirector errors +The components that download the `Wuredir.cab` file and then parse the `Wuredir.cab` file generate the following errors. + +| Error code | Message | Description | +|----------- |------------------------------|------------------------------------------------------------------------------------------| +| 0x80245001 | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document could not be loaded into the DOM class. | +| 0x80245002 | `WU_E_REDIRECTOR_S_FALSE` | The redirector XML document is missing some required information. | +| 0x80245003 | `WU_E_REDIRECTOR_ID_SMALLER` | The redirectorId in the downloaded redirector cab is less than in the cached cab. | +| 0x80245FFF | `WU_E_REDIRECTOR_UNEXPECTED` | The redirector failed for reasons not covered by another `WU_E_REDIRECTOR_*` error code. | + +## Protocol Talker errors +The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. These errors are obtained when the `CClientWebService` object calls the `GetClientError()` method. + + +| Error code | Message | Description | +|------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| +| 0x80244000 | `WU_E_PT_SOAPCLIENT_BASE` | `WU_E_PT_SOAPCLIENT_*` error codes map to the `SOAPCLIENT_ERROR` enum of the ATL Server Library. | +| 0x80244001 | `WU_E_PT_SOAPCLIENT_INITIALIZE` | Same as `SOAPCLIENT_INITIALIZE_ERROR` - initialization of the `SOAP` client failed possibly because of an MSXML installation failure. | +| 0x80244002 | `WU_E_PT_SOAPCLIENT_OUTOFMEMORY` | Same as `SOAPCLIENT_OUTOFMEMORY` - `SOAP` client failed because it ran out of memory. | +| 0x80244003 | `WU_E_PT_SOAPCLIENT_GENERATE` | Same as `SOAPCLIENT_GENERATE_ERROR` - `SOAP` client failed to generate the request. | +| 0x80244004 | `WU_E_PT_SOAPCLIENT_CONNECT` | Same as `SOAPCLIENT_CONNECT_ERROR` - `SOAP` client failed to connect to the server. | +| 0x80244005 | `WU_E_PT_SOAPCLIENT_SEND` | Same as `SOAPCLIENT_SEND_ERROR` - `SOAP` client failed to send a message for reasons of `WU_E_WINHTTP_*` error codes. | +| 0x80244006 | `WU_E_PT_SOAPCLIENT_SERVER` | Same as `SOAPCLIENT_SERVER_ERROR` - `SOAP` client failed because there was a server error. | +| 0x80244007 | `WU_E_PT_SOAPCLIENT_SOAPFAULT` | Same as `SOAPCLIENT_SOAPFAULT` - `SOAP` client failed because there was a SOAP fault for reasons of `WU_E_PT_SOAP_*` error codes. | +| 0x80244008 | `WU_E_PT_SOAPCLIENT_PARSEFAULT` | Same as `SOAPCLIENT_PARSEFAULT_ERROR` - `SOAP` client failed to parse a `SOAP` fault. | +| 0x80244009 | `WU_E_PT_SOAPCLIENT_READ` | Same as `SOAPCLIENT_READ_ERROR` - `SOAP` client failed while reading the response from the server. | +| 0x8024400A | `WU_E_PT_SOAPCLIENT_PARSE` | Same as `SOAPCLIENT_PARSE_ERROR` - `SOAP` client failed to parse the response from the server. | + +## Other Protocol Talker errors +The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`. + + +| Error code | Message | Description | +|------------|----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x8024400B | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | +| 0x8024400C | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | +| 0x8024400D | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | +| 0x8024400E | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message could not be processed due to a server error; resend later. | +| 0x8024400F | `WU_E_PT_WMI_ERROR` | There was an unspecified Windows Management Instrumentation (WMI) error. | +| 0x80244010 | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. | +| 0x80244011 | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. | +| 0x80244012 | `WU_E_PT_DOUBLE_INITIALIZATION` | Initialization failed because the object was already initialized. | +| 0x80244013 | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name could not be determined. | +| 0x80244015 | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | +| 0x80244016 | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server could not process the request due to invalid syntax. | +| 0x80244017 | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | +| 0x80244018 | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | +| 0x80244019 | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | +| 0x8024401A | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method is not allowed. | +| 0x8024401B | `WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ` | Same as HTTP status 407 - proxy authentication is required. | +| 0x8024401C | `WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT` | Same as HTTP status 408 - the server timed out waiting for the request. | +| 0x8024401D | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. | +| 0x8024401E | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. | +| 0x8024401F | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | +| 0x80244020 | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | +| 0x80244021 | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfill the request. | +| 0x80244022 | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. | +| 0x80244023 | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. | +| 0x80244024 | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | +| 0x80244025 | `WU_E_PT_FILE_LOCATIONS_CHANGED` | Operation failed due to a changed file location; refresh internal state and resend. | +| 0x80244026 | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. | +| 0x80244027 | `WU_E_PT_NO_AUTH_PLUGINS_REQUESTED` | The server returned an empty authentication information list. | +| 0x80244028 | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. | +| 0x80244029 | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. | +| 0x8024402A | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. | +| 0x8024402B | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request could not be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | +| 0x8024402C | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | +| 0x8024402F | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. | +| 0x80244030 | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. | +| 0x80244031 | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. | +| 0x80244032 | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. | +| 0x80244033 | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest could not be extracted from an external cab file. | +| 0x80244034 | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file could not be decompressed. | +| 0x80244035 | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. | +| 0x80244FFF | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. | +| 0x8024502D | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | +| 0x8024502E | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action did not complete because the server is managed. | + +## Download Manager errors + +| Error code | Message | Description | +|------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80246001 | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation could not be completed because the requested file does not have a URL. | +| 0x80246002 | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation could not be completed because the file digest was not recognized. | +| 0x80246003 | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. | +| 0x80246004 | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation could not be completed because a download request is required from the download handler. | +| 0x80246005 | `WU_E_DM_NONETWORK` | A download manager operation could not be completed because the network connection was unavailable. | +| 0x80246006 | `WU_E_DM_WRONGBITSVERSION` | A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | +| 0x80246007 | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. | +| 0x80246008 | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | +| 0x80246009 | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. | +| 0x8024600A | `WU_E_DM_DOWNLOADLOCATIONCHANGED` | A download must be restarted because the location of the source of the download has changed. | +| 0x8024600B | `WU_E_DM_CONTENTCHANGED` | A download must be restarted because the update content changed in a new revision. | +| 0x80246FFF | `WU_E_DM_UNEXPECTED` | There was a download manager error not covered by another `WU_E_DM_*` error code. | + +## Update Handler errors + +| Error code | Message | Description | +|------------|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80242000 | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler could not be completed because no remote process is available. | +| 0x80242001 | `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. | +| 0x80242002 | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. | +| 0x80242003 | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. | +| 0x80242004 | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | +| 0x80242005 | `WU_E_UH_WRONGHANDLER` | An operation did not complete because the wrong handler was specified. | +| 0x80242006 | `WU_E_UH_INVALIDMETADATA` | A handler operation could not be completed because the update contains invalid metadata. | +| 0x80242007 | `WU_E_UH_INSTALLERHUNG` | An operation could not be completed because the installer exceeded the time limit. | +| 0x80242008 | `WU_E_UH_OPERATIONCANCELLED` | An operation being done by the update handler was canceled. | +| 0x80242009 | `WU_E_UH_BADHANDLERXML` | An operation could not be completed because the handler-specific metadata is invalid. | +| 0x8024200A | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update could not be completed because the update requires user input. | +| 0x8024200B | `WU_E_UH_INSTALLERFAILURE` | The installer failed to install (uninstall) one or more updates. | +| 0x8024200C | `WU_E_UH_FALLBACKTOSELFCONTAINED` | The update handler should download self-contained content rather than delta-compressed content for the update. | +| 0x8024200D | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler did not install the update because it needs to be downloaded again. | +| 0x8024200E | `WU_E_UH_NOTIFYFAILURE` | The update handler failed to send notification of the status of the install (uninstall) operation. | +| 0x8024200F | `WU_E_UH_INCONSISTENT_FILE_NAMES` | The file names contained in the update metadata and in the update package are inconsistent. | +| 0x80242010 | `WU_E_UH_FALLBACKERROR` | The update handler failed to fall back to the self-contained content. | +| 0x80242011 | `WU_E_UH_TOOMANYDOWNLOADREQUESTS` | The update handler has exceeded the maximum number of download requests. | +| 0x80242012 | `WU_E_UH_UNEXPECTEDCBSRESPONSE` | The update handler has received an unexpected response from CBS. | +| 0x80242013 | `WU_E_UH_BADCBSPACKAGEID` | The update metadata contains an invalid CBS package identifier. | +| 0x80242014 | `WU_E_UH_POSTREBOOTSTILLPENDING` | The post-reboot operation for the update is still in progress. | +| 0x80242015 | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update could not be determined. | +| 0x80242016 | `WU_E_UH_POSTREBOOTUNEXPECTEDSTATE` | The state of the update after its post-reboot operation has completed is unexpected. | +| 0x80242017 | `WU_E_UH_NEW_SERVICING_STACK_REQUIRED` | The OS servicing stack must be updated before this update is downloaded or installed. | +| 0x80242FFF | `WU_E_UH_UNEXPECTED` | An update handler error not covered by another `WU_E_UH_*` code. | + +## Data Store errors + +| Error code | Message | Description | +|------------|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80248000 | `WU_E_DS_SHUTDOWN` | An operation failed because Windows Update Agent is shutting down. | +| 0x80248001 | `WU_E_DS_INUSE` | An operation failed because the data store was in use. | +| 0x80248002 | `WU_E_DS_INVALID` | The current and expected states of the data store do not match. | +| 0x80248003 | `WU_E_DS_TABLEMISSING` | The data store is missing a table. | +| 0x80248004 | `WU_E_DS_TABLEINCORRECT` | The data store contains a table with unexpected columns. | +| 0x80248005 | `WU_E_DS_INVALIDTABLENAME` | A table could not be opened because the table is not in the data store. | +| 0x80248006 | `WU_E_DS_BADVERSION` | The current and expected versions of the data store do not match. | +| 0x80248007 | `WU_E_DS_NODATA` | The information requested is not in the data store. | +| 0x80248008 | `WU_E_DS_MISSINGDATA` | The data store is missing required information or has a NULL in a table column that requires a non-null value. | +| 0x80248009 | `WU_E_DS_MISSINGREF` | The data store is missing required information or has a reference to missing license terms file localized property or linked row. | +| 0x8024800A | `WU_E_DS_UNKNOWNHANDLER` | The update was not processed because its update handler could not be recognized. | +| 0x8024800B | `WU_E_DS_CANTDELETE` | The update was not deleted because it is still referenced by one or more services. | +| 0x8024800C | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section could not be locked within the allotted time. | +| 0x8024800D | `WU_E_DS_NOCATEGORIES` | The category was not added because it contains no parent categories and is not a top-level category itself. | +| 0x8024800E | `WU_E_DS_ROWEXISTS` | The row was not added because an existing row has the same primary key. | +| 0x8024800F | `WU_E_DS_STOREFILELOCKED` | The data store could not be initialized because it was locked by another process. | +| 0x80248010 | `WU_E_DS_CANNOTREGISTER` | The data store is not allowed to be registered with COM in the current process. | +| 0x80248011 | `WU_E_DS_UNABLETOSTART` | Could not create a data store object in another process. | +| 0x80248013 | `WU_E_DS_DUPLICATEUPDATEID` | The server sent the same update to the client with two different revision IDs. | +| 0x80248014 | `WU_E_DS_UNKNOWNSERVICE` | An operation did not complete because the service is not in the data store. | +| 0x80248015 | `WU_E_DS_SERVICEEXPIRED` | An operation did not complete because the registration of the service has expired. | +| 0x80248016 | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. | +| 0x80248017 | `WU_E_DS_TABLESESSIONMISMATCH` | A table was not closed because it is not associated with the session. | +| 0x80248018 | `WU_E_DS_SESSIONLOCKMISMATCH` | A table was not closed because it is not associated with the session. | +| 0x80248019 | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. | +| 0x8024801A | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation is not allowed. | +| 0x8024801B | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document do not match. | +| 0x8024801C | `WU_E_DS_RESETREQUIRED` | The data store requires a session reset; release the session and retry with a new session. | +| 0x8024801D | `WU_E_DS_IMPERSONATED` | A data store operation did not complete because it was requested with an impersonated identity. | +| 0x80248FFF | `WU_E_DS_UNEXPECTED` | A data store error not covered by another `WU_E_DS_*` code. | + +## Driver Util errors +The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped. + +| Error code | Message | Description | +|------------|-------------------------------|------------------------------------------------------------------------------------------------| +| 0x8024C001 | `WU_E_DRV_PRUNED` | A driver was skipped. | +| 0x8024C002 | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver could not be found. It may not conform with required specifications. | +| 0x8024C003 | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver does not match the expected type. | +| 0x8024C004 | `WU_E_DRV_NO_METADATA` | The driver update is missing metadata. | +| 0x8024C005 | `WU_E_DRV_MISSING_ATTRIBUTE` | The driver update is missing a required attribute. | +| 0x8024C006 | `WU_E_DRV_SYNC_FAILED` | Driver synchronization failed. | +| 0x8024C007 | `WU_E_DRV_NO_PRINTER_CONTENT` | Information required for the synchronization of applicable printers is missing. | +| 0x8024CFFF | `WU_E_DRV_UNEXPECTED` | A driver error not covered by another `WU_E_DRV_*` code. | + +## Windows Update error codes + +| Error code | Message | Description | +|------------|-----------------------------------|--------------------------------------------------------------| +| 0x80240001 | `WU_E_NO_SERVICE` | Windows Update Agent was unable to provide the service. +| 0x80240002 | `WU_E_MAX_CAPACITY_REACHED` | The maximum capacity of the service was exceeded. +| 0x80240003 | `WU_E_UNKNOWN_ID` | An ID cannot be found. +| 0x80240004 | `WU_E_NOT_INITIALIZED` | The object could not be initialized. +| 0x80240005 | `WU_E_RANGEOVERLAP` | The update handler requested a byte range overlapping a previously requested range. +| 0x80240006 | `WU_E_TOOMANYRANGES` | The requested number of byte ranges exceeds the maximum number (2^31 - 1). +| 0x80240007 | `WU_E_INVALIDINDEX` | The index to a collection was invalid. +| 0x80240008 | `WU_E_ITEMNOTFOUND` | The key for the item queried could not be found. +| 0x80240009 | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously. +| 0x8024000A | `WU_E_COULDNOTCANCEL` | Cancellation of the operation was not allowed. +| 0x8024000B | `WU_E_CALL_CANCELLED` | Operation was canceled. +| 0x8024000C | `WU_E_NOOP` | No operation was required. +| 0x8024000D | `WU_E_XML_MISSINGDATA` | Windows Update Agent could not find required information in the update's XML data. +| 0x8024000E | `WU_E_XML_INVALID` | Windows Update Agent found invalid information in the update's XML data. +| 0x8024000F | `WU_E_CYCLE_DETECTED` | Circular update relationships were detected in the metadata. +| 0x80240010 | `WU_E_TOO_DEEP_RELATION` | Update relationships too deep to evaluate were evaluated. +| 0x80240011 | `WU_E_INVALID_RELATIONSHIP` | An invalid update relationship was detected. +| 0x80240012 | `WU_E_REG_VALUE_INVALID` | An invalid registry value was read. +| 0x80240013 | `WU_E_DUPLICATE_ITEM` | Operation tried to add a duplicate item to a list. +| 0x80240016 | `WU_E_INSTALL_NOT_ALLOWED` | Operation tried to install while another installation was in progress or the system was pending a mandatory restart. +| 0x80240017 | `WU_E_NOT_APPLICABLE` | Operation was not performed because there are no applicable updates. +| 0x80240018 | `WU_E_NO_USERTOKEN` | Operation failed because a required user token is missing. +| 0x80240019 | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update cannot be installed with other updates at the same time. +| 0x8024001A | `WU_E_POLICY_NOT_SET` | A policy value was not set. +| 0x8024001B | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation could not be performed because the Windows Update Agent is self-updating. +| 0x8024001D | `WU_E_INVALID_UPDATE` | An update contains invalid metadata. +| 0x8024001E | `WU_E_SERVICE_STOP` | Operation did not complete because the service or system was being shut down. +| 0x8024001F | `WU_E_NO_CONNECTION` | Operation did not complete because the network connection was unavailable. +| 0x80240020 | `WU_E_NO_INTERACTIVE_USER` | Operation did not complete because there is no logged-on interactive user. +| 0x80240021 | `WU_E_TIME_OUT` | Operation did not complete because it timed out. +| 0x80240022 | `WU_E_ALL_UPDATES_FAILED` | Operation failed for all the updates. +| 0x80240023 | `WU_E_EULAS_DECLINED` | The license terms for all updates were declined. +| 0x80240024 | `WU_E_NO_UPDATE` | There are no updates. +| 0x80240025 | `WU_E_USER_ACCESS_DISABLED` | Group Policy settings prevented access to Windows Update. +| 0x80240026 | `WU_E_INVALID_UPDATE_TYPE` | The type of update is invalid. +| 0x80240027 | `WU_E_URL_TOO_LONG` | The URL exceeded the maximum length. +| 0x80240028 | `WU_E_UNINSTALL_NOT_ALLOWED` | The update could not be uninstalled because the request did not originate from a WSUS server. +| 0x80240029 | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there is an unlicensed application on the system. +| 0x8024002A | `WU_E_MISSING_HANDLER` | A component required to detect applicable updates was missing. +| 0x8024002B | `WU_E_LEGACYSERVER` | An operation did not complete because it requires a newer version of server. +| 0x8024002C | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update could not be installed because it required the source. +| 0x8024002D | `WU_E_SOURCE_ABSENT` | A full-file update could not be installed because it required the source. +| 0x8024002E | `WU_E_WU_DISABLED` | Access to an unmanaged server is not allowed. +| 0x8024002F | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation did not complete because the DisableWindowsUpdateAccess policy was set. +| 0x80240030 | `WU_E_INVALID_PROXY_SERVER` | The format of the proxy list was invalid. +| 0x80240031 | `WU_E_INVALID_FILE` | The file is in the wrong format. +| 0x80240032 | `WU_E_INVALID_CRITERIA` | The search criteria string was invalid. +| 0x80240033 | `WU_E_EULA_UNAVAILABLE` | License terms could not be downloaded. +| 0x80240034 | `WU_E_DOWNLOAD_FAILED` | Update failed to download. +| 0x80240035 | `WU_E_UPDATE_NOT_PROCESSED` | The update was not processed. +| 0x80240036 | `WU_E_INVALID_OPERATION` | The object's current state did not allow the operation. +| 0x80240037 | `WU_E_NOT_SUPPORTED` | The functionality for the operation is not supported. +| 0x80240038 | `WU_E_WINHTTP_INVALID_FILE` | The downloaded file has an unexpected content type. +| 0x80240039 | `WU_E_TOO_MANY_RESYNC` | Agent is asked by server to resync too many times. +| 0x80240040 | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method does not run on Server Core installation. +| 0x80240041 | `WU_E_SYSPREP_IN_PROGRESS` | Service is not available while sysprep is running. +| 0x80240042 | `WU_E_UNKNOWN_SERVICE` | The update service is no longer registered with `AU`. +| 0x80240043 | `WU_E_NO_UI_SUPPORT` | There is no support for `WUA UI`. +| 0x80240FFF | `WU_E_UNEXPECTED` | An operation failed due to reasons not covered by another error code. + +## Windows Update success codes + +| Error code | Message | Description | +|------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| +| 0x00240001 | `WU_S_SERVICE_STOP` | Windows Update Agent was stopped successfully. | +| 0x00240002 | `WU_S_SELFUPDATE` | Windows Update Agent updated itself. | +| 0x00240003 | `WU_S_UPDATE_ERROR` | Operation completed successfully but there were errors applying the updates. | +| 0x00240004 | `WU_S_MARKED_FOR_DISCONNECT` | A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing. | +| 0x00240005 | `WU_S_REBOOT_REQUIRED` | The system must be restarted to complete installation of the update. | +| 0x00240006 | `WU_S_ALREADY_INSTALLED` | The update to be installed is already installed on the system. | +| 0x00240007 | `WU_S_ALREADY_UNINSTALLED` | The update to be removed is not installed on the system. | +| 0x00240008 | `WU_S_ALREADY_DOWNLOADED` | The update to be downloaded has already been downloaded. | + +## Windows Installer minor errors +The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer. + +| Error code | Message | Description | +|------------|------------------------------|---------------------------------------------------------------------------------------------| +| 0x80241001 | `WU_E_MSI_WRONG_VERSION` | Search may have missed some updates because the Windows Installer is less than version 3.1. | +| 0x80241002 | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer is not configured. | +| 0x80241003 | `WU_E_MSP_DISABLED` | Search may have missed some updates because policy has disabled Windows Installer patching. | +| 0x80241004 | `WU_E_MSI_WRONG_APP_CONTEXT` | An update could not be applied because the application is installed per-user. | +| 0x80241FFF | `WU_E_MSP_UNEXPECTED` | Search may have missed some updates because there was a failure of the Windows Installer. | + +## Windows Update Agent update and setup errors + +| Error code | Message | Description | +|------------|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| +| 0x8024D001 | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent could not be updated because an INF file contains invalid information. | +| 0x8024D002 | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent could not be updated because the `wuident.cab` file contains invalid information. | +| 0x8024D003 | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. | +| 0x8024D004 | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent could not be updated because setup initialization never completed successfully. | +| 0x8024D005 | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions. | +| 0x8024D006 | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file. | +| 0x8024D007 | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent could not be updated because `regsvr32.exe` returned an error. | +| 0x8024D009 | `WU_E_SETUP_SKIP_UPDATE` | An update to the Windows Update Agent was skipped due to a directive in the `wuident.cab` file. | +| 0x8024D00A | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent could not be updated because the current system configuration is not supported. | +| 0x8024D00B | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent could not be updated because the system is configured to block the update. | +| 0x8024D00C | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent could not be updated because a restart of the system is required. | +| 0x8024D00D | `WU_E_SETUP_ALREADYRUNNING` | Windows Update Agent setup is already running. | +| 0x8024D00E | `WU_E_SETUP_REBOOTREQUIRED` | Windows Update Agent setup package requires a reboot to complete installation. | +| 0x8024D00F | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent could not be updated because the setup handler failed during execution. | +| 0x8024D010 | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent could not be updated because the registry contains invalid information. | +| 0x8024D013 | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent could not be updated because the server does not contain update information for this version. | +| 0x8024DFFF | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent could not be updated because of an error not covered by another `WU_E_SETUP_*` error code. | diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md index b39238347d..0cad11e031 100644 --- a/windows/deployment/update/windows-update-errors.md +++ b/windows/deployment/update/windows-update-errors.md @@ -1,40 +1,40 @@ ---- -title: Windows Update common errors and mitigation -description: Learn about some common issues you might experience with Windows Update -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Windows Update common errors and mitigation - ->Applies to: Windows 10 - -The following table provides information about common errors you might run into with Windows Update, as well as steps to help you mitigate them. - - -| Error Code | Message | Description | Mitigation | -|------------------------------------------|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External cab file processing completed with some errors | One of the reasons we see this issue is due to the design of a software called Lightspeed Rocket for Web filtering.
              The IP addresses of the computers you want to get updates successfully on, should be added to the exceptions list of Lightspeed | -| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename Software Redistribution Folder and attempt to download the updates again:
              Rename the following folders to \*.BAK:
              - %systemroot%\system32\catroot2

              To do this, type the following commands at a command prompt. Press ENTER after you type each command.
              - Ren %systemroot%\SoftwareDistribution\DataStore \*.bak
              - Ren %systemroot%\SoftwareDistribution\Download \*.bak
              Ren %systemroot%\system32\catroot2 \*.bak | -| 0x80070BC9 | ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. A system reboot is required to roll back changes made. | Ensure that we do not have any policies that control the start behavior for the Windows Module Installer. This service should not be hardened to any start value and should be managed by the OS. | -| 0x80200053 | BG_E_VALIDATION_FAILED | NA | Ensure that there is no Firewalls that filter downloads. The Firewall filtering may lead to invalid responses being received by the Windows Update Client.

              If the issue still persists, run the [WU reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). | -| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to Internet. To fix this issue, following these steps: make sure these URLs are not blocked:
              http://.update.microsoft.com
              https://
              .update.microsoft.com


              Additionally , you can take a network trace and see what is timing out. \ | -| 0x80072EFD
              0x80072EFE 
              0x80D02002 | TIME OUT ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs.
              Take a network monitor trace to understand better. \ | -| 0X8007000D | ERROR_INVALID_DATA | Indicates invalid data downloaded or corruption occurred. | Attempt to re-download the update and initiate installation. | -| 0x8024A10A | USO_E_SERVICE_SHUTTING_DOWN | Indicates that the WU Service is shutting down. | This may happen due to a very long period of time of inactivity, a system hang leading to the service being idle and leading to the shutdown of the service. Ensure that the system remains active and the connections remain established to complete the upgrade. | -| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. | Please login to the system to initiate the installation and allow the system to be rebooted. | -| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-reboot operation for the update is still in progress. | Some Windows Updates require the system to be restarted. Reboot the system to complete the installation of the Updates. | -| 0x80246017 | WU_E_DM_UNAUTHORIZED_LOCAL_USER | The download failed because the local user was denied authorization to download the content. | Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator). | -| 0x8024000B | WU_E_CALL_CANCELLED | Operation was cancelled. | This indicates that the operation was cancelled by the user/service. You may also encounter this error when we are unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete. | -| 0x8024000E | WU_E_XML_INVALID | Windows Update Agent found invalid information in the update's XML data. | Certain drivers contain additional metadata information in the update.xml, which could lead Orchestrator to understand it as invalid data. Ensure that you have the latest Windows Update Agent installed on the machine. | -| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file. | You may encounter this error when WSUS is not sending the Self-update to the clients.

              Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. | -| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | This issue occurs because Windows cannot renew the cookies for Windows Update.

              Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue. | - +--- +title: Windows Update common errors and mitigation +description: In this article, learn about some common issues you might experience with Windows Update, as well as steps to resolve them. +ms.prod: w10 +ms.mktglfcycl: +audience: itpro +itproauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows Update common errors and mitigation + +>Applies to: Windows 10 + +The following table provides information about common errors you might run into with Windows Update, as well as steps to help you mitigate them. + + +| Error Code | Message | Description | Mitigation | +|------------------------------------------|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External cab file processing completed with some errors | One of the reasons we see this issue is due to the design of a software called Lightspeed Rocket for Web filtering.
              Add the IP addresses of devices you want to get updates to the exceptions list of Lightspeed | +| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename Software Redistribution Folder and attempt to download the updates again:
              Rename the following folders to \*.BAK:
              - %systemroot%\system32\catroot2

              Type the following commands at a command prompt. Press ENTER after you type each command.
              - Ren %systemroot%\SoftwareDistribution\DataStore \*.bak
              - Ren %systemroot%\SoftwareDistribution\Download \*.bak
              Ren %systemroot%\system32\catroot2 \*.bak | +| 0x80070BC9 | ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. A system reboot is required to roll back changes made. | Ensure that you don't have any policies that control the start behavior for the Windows Module Installer. This service should be managed by the operating system. | +| 0x80200053 | BG_E_VALIDATION_FAILED | NA | Ensure that there are no firewalls that filter downloads. Such filtering could lead to incorrect responses being received by the Windows Update Client.

              If the issue still persists, run the [Windows Update reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). | +| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to the Internet. To fix this issue, follow these steps: make sure these URLs are not blocked:
              http://.update.microsoft.com
              https://
              .update.microsoft.com


              You can also take a network trace to check what is timing out. \ | +| 0x80072EFD
              0x80072EFE 
              0x80D02002 | TIME_OUT_ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs.
              Take a network monitor trace to understand better. \ | +| 0X8007000D | ERROR_INVALID_DATA | Indicates invalid data downloaded or corruption occurred. | Attempt to re-download the update and initiate installation. | +| 0x8024A10A | USO_E_SERVICE_SHUTTING_DOWN | Indicates that the Windows Update Service is shutting down. | This can occur after a very long period of time of inactivity, the system failing to respond leading to the service being idle and causing the service to shut down. Ensure that the system remains active and the connections remain established to complete the upgrade. | +| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. | Sign in to the device to start the installation and allow the device to restart. | +| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-restart operation for the update is still in progress. | Some Windows Updates require the device to be restarted. Restart the device to complete update installation. | +| 0x80246017 | WU_E_DM_UNAUTHORIZED_LOCAL_USER | The download failed because the local user was denied authorization to download the content. | Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator). | +| 0x8024000B | WU_E_CALL_CANCELLED | Operation was canceled. | The operation was canceled by the user or service. You might also receive this error when we are unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete. | +| 0x8024000E | WU_E_XML_INVALID | Windows Update Agent found invalid information in the update's XML data. | Certain drivers contain additional metadata information in the update.xml, which could lead Orchestrator to understand it as invalid data. Ensure that you have the latest Windows Update Agent installed on the machine. | +| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file. | You may encounter this error when WSUS is not sending the Self-update to the clients.

              Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. | +| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | This issue occurs because Windows cannot renew the cookies for Windows Update.

              Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue. | + diff --git a/windows/deployment/update/windows-update-logs.md b/windows/deployment/update/windows-update-logs.md index 7eec34d793..ed776f86d0 100644 --- a/windows/deployment/update/windows-update-logs.md +++ b/windows/deployment/update/windows-update-logs.md @@ -1,147 +1,147 @@ ---- -title: Windows Update log files -description: Learn about the Windows Update log files -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Windows Update log files - ->Applies to: Windows 10 - -The following table describes the log files created by Windows Update. - - -|Log file|Location|Description|When to Use | -|-|-|-|-| -|windowsupdate.log|C:\Windows\Logs\WindowsUpdate|Starting in Windows 8.1 and continuing in Windows 10, Windows Update client uses Event Tracing for Windows (ETW) to generate diagnostic logs.|If you receive an error message when you run Windows Update (WU), you can use the information that is included in the Windowsupdate.log log file to troubleshoot the issue.| -|UpdateSessionOrchestration.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the Update Orchestrator is responsible for sequence of downloading and installing various update types from Windows Update. And the events are logged to these etl files.|When you see that the updates are available but download is not getting triggered.
              When Updates are downloaded but installation is not triggered.
              When Updates are installed but reboot is not triggered. | -|NotificationUxBroker.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the notification toast or the banner is triggered by this NotificationUxBroker.exe . And the logs to check its working is this etl. |When you want to check whether the Notification was triggered or not for reboot or update availability etc. | -|CBS.log|%systemroot%\Logs\CBS|This logs provides insight on the update installation part in the servicing stack.|To troubleshoot the issues related to WU installation.| - -## Generating WindowsUpdate.log -To merge and convert WU trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](https://docs.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps). - ->[!NOTE] ->When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpate.log unless you run **Get-WindowsUpdateLog** again. - -### Windows Update log components -The WU engine has different component names. The following are some of the most common components that appear in the WindowsUpdate.log file: - -- AGENT- Windows Update agent -- AU - Automatic Updates is performing this task -- AUCLNT- Interaction between AU and the logged-on user -- CDM- Device Manager -- CMPRESS- Compression agent -- COMAPI- Windows Update API -- DRIVER- Device driver information -- DTASTOR- Handles database transactions -- EEHNDLER- Expression handler that's used to evaluate update applicability -- HANDLER- Manages the update installers -- MISC- General service information -- OFFLSNC- Detects available updates without network connection -- PARSER- Parses expression information -- PT- Synchronizes updates information to the local datastore -- REPORT- Collects reporting information -- SERVICE- Startup/shutdown of the Automatic Updates service -- SETUP- Installs new versions of the Windows Update client when it is available -- SHUTDWN- Install at shutdown feature -- WUREDIR- The Windows Update redirector files -- WUWEB- The Windows Update ActiveX control -- ProtocolTalker - Client-server sync -- DownloadManager - Creates and monitors payload downloads -- Handler, Setup - Installer handlers (CBS, and so on) -- EEHandler - Evaluating update applicability rules -- DataStore - Caching update data locally -- IdleTimer - Tracking active calls, stopping a service - ->[!NOTE] ->Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what’s important. - -### Windows Update log structure -The Windows update log structure is separated into four main identities: - -- Time Stamps -- Process ID and Thread ID -- Component Name -- Update Identifiers - - Update ID and Revision Number - - Revision ID - - Local ID - - Inconsistent terminology - -The WindowsUpdate.log structure is discussed in the following sections. - -#### Time stamps -The time stamp indicates the time at which the logging occurs. -- Messages are usually in chronological order, but there may be exceptions. -- A pause during a sync can indicate a network problem, even if the scan succeeds. -- A long pause near the end of a scan can indicate a supersedence chain issue. - ![Windows Update time stamps](images/update-time-log.png) - - -#### Process ID and thread ID -The Process IDs and Thread IDs are random, and they can vary from log to log and even from service session to service session within the same log. -- The first four hex digits are the process ID. -- The next four hex digits are the thread ID. -- Each component, such as the USO, WU engine, COM API callers, and WU installer handlers, has its own process ID. - ![Windows Update process and thread IDs](images/update-process-id.png) - - -#### Component name -Search for and identify the components that are associated with the IDs. Different parts of the WU engine have different component names. Some of them are as follows: - -- ProtocolTalker - Client-server sync -- DownloadManager - Creates and monitors payload downloads -- Handler, Setup - Installer handlers (CBS, etc.) -- EEHandler - Evaluating update applicability rules -- DataStore - Caching update data locally -- IdleTimer - Tracking active calls, stopping service - -![Windows Update component name](images/update-component-name.png) - - -#### Update identifiers - -##### Update ID and revision number -There are different identifiers for the same update in different contexts. It’s important to know the identifier schemes. -- Update ID: A GUID (indicated in the previous screen shot) that's assigned to a given update at publication time -- Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service -- Revision numbers are reused from one update to another (not a unique identifier). -- The update ID and revision number are often shown together as "{GUID}.revision." - ![Windows Update update identifiers](images/update-update-id.png) - - -##### Revision ID -- A Revision ID (do no confuse this with “revision number”) is a serial number that's issued when an update is initially published or revised on a given service. -- An existing update that’s revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a completely new revision ID that is not related to the previous ID. -- Revision IDs are unique on a given update source, but not across multiple sources. -- The same update revision may have completely different revision IDs on WU and WSUS. -- The same revision ID may represent different updates on WU and WSUS. - -##### Local ID -- Local ID is a serial number issued when an update is received from a service by a given WU client -- Usually seen in debug logs, especially involving the local cache for update info (Datastore) -- Different client PCs will assign different Local IDs to the same update -- You can find the local IDs that a client is using by getting the client’s %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file - -##### Inconsistent terminology -- Sometimes the logs use terms inconsistently. For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs. -- Recognize IDs by form and context: - - - GUIDs are update IDs - - Small integers that appear alongside an update ID are revision numbers - - Large integers are typically revision IDs - - Small integers (especially in Datastore) can be local IDs - ![Windows Update inconsisten terminology](images/update-inconsistent.png) - -## Windows Setup log files analysis using SetupDiag tool -SetupDiag is a diagnostic tool that can be used for analysis of logs related to installation of Windows Updates. For detailed information, see [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag). +--- +title: Windows Update log files +description: Learn about the Windows Update log files and how to merge and convert Windows Update trace files (.etl files) into a single readable WindowsUpdate.log file. +ms.prod: w10 +ms.mktglfcycl: +audience: itpro +itproauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows Update log files + +>Applies to: Windows 10 + +The following table describes the log files created by Windows Update. + + +|Log file|Location|Description|When to use | +|-|-|-|-| +|windowsupdate.log|C:\Windows\Logs\WindowsUpdate|Starting in Windows 8.1 and continuing in Windows 10, Windows Update client uses Event Tracing for Windows (ETW) to generate diagnostic logs.|If you receive an error message when you run Windows Update, you can use the information that is included in the Windowsupdate.log log file to troubleshoot the issue.| +|UpdateSessionOrchestration.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the Update Orchestrator is responsible for sequence of downloading and installing various update types from Windows Update. And the events are logged to these .etl files.|When you see that the updates are available but download is not getting triggered.
              When Updates are downloaded but installation is not triggered.
              When Updates are installed but reboot is not triggered. | +|NotificationUxBroker.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the notification toast or the banner is triggered by NotificationUxBroker.exe. |When you want to check whether the notification was triggered or not. | +|CBS.log|%systemroot%\Logs\CBS|This log provides insight on the update installation part in the servicing stack.|To troubleshoot the issues related to Windows Update installation.| + +## Generating WindowsUpdate.log +To merge and convert Windows Update trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](https://docs.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps&preserve-view=tru). + +>[!NOTE] +>When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpate.log unless you run **Get-WindowsUpdateLog** again. + +### Windows Update log components +The Windows Update engine has different component names. The following are some of the most common components that appear in the WindowsUpdate.log file: + +- AGENT- Windows Update agent +- AU - Automatic Updates is performing this task +- AUCLNT- Interaction between AU and the logged-on user +- CDM- Device Manager +- CMPRESS- Compression agent +- COMAPI- Windows Update API +- DRIVER- Device driver information +- DTASTOR- Handles database transactions +- EEHNDLER- Expression handler that's used to evaluate update applicability +- HANDLER- Manages the update installers +- MISC- General service information +- OFFLSNC- Detects available updates without network connection +- PARSER- Parses expression information +- PT- Synchronizes updates information to the local datastore +- REPORT- Collects reporting information +- SERVICE- Startup/shutdown of the Automatic Updates service +- SETUP- Installs new versions of the Windows Update client when it is available +- SHUTDWN- Install at shutdown feature +- WUREDIR- The Windows Update redirector files +- WUWEB- The Windows Update ActiveX control +- ProtocolTalker - Client-server sync +- DownloadManager - Creates and monitors payload downloads +- Handler, Setup - Installer handlers (CBS, and so on) +- EEHandler - Evaluating update applicability rules +- DataStore - Caching update data locally +- IdleTimer - Tracking active calls, stopping a service + +>[!NOTE] +>Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what's important. + +### Windows Update log structure +The Windows update log structure is separated into four main identities: + +- Time Stamps +- Process ID and Thread ID +- Component Name +- Update Identifiers + - Update ID and Revision Number + - Revision ID + - Local ID + - Inconsistent terminology + +The WindowsUpdate.log structure is discussed in the following sections. + +#### Time stamps +The time stamp indicates the time at which the logging occurs. +- Messages are usually in chronological order, but there may be exceptions. +- A pause during a sync can indicate a network problem, even if the scan succeeds. +- A long pause near the end of a scan can indicate a supersedence chain issue. + ![Windows Update time stamps](images/update-time-log.png) + + +#### Process ID and thread ID +The Process IDs and Thread IDs are random, and they can vary from log to log and even from service session to service session within the same log. +- The first four hex digits are the process ID. +- The next four hex digits are the thread ID. +- Each component, such as the USO, Windows Update engine, COM API callers, and Windows Update installer handlers, has its own process ID. + ![Windows Update process and thread IDs](images/update-process-id.png) + + +#### Component name +Search for and identify the components that are associated with the IDs. Different parts of the Windows Update engine have different component names. Some of them are as follows: + +- ProtocolTalker - Client-server sync +- DownloadManager - Creates and monitors payload downloads +- Handler, Setup - Installer handlers (CBS, etc.) +- EEHandler - Evaluating update applicability rules +- DataStore - Caching update data locally +- IdleTimer - Tracking active calls, stopping service + +![Windows Update component name](images/update-component-name.png) + + +#### Update identifiers + +##### Update ID and revision number +There are different identifiers for the same update in different contexts. It's important to know the identifier schemes. +- Update ID: A GUID (indicated in the previous screenshot) that's assigned to a given update at publication time +- Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service +- Revision numbers are reused from one update to another (not a unique identifier). +- The update ID and revision number are often shown together as "{GUID}.revision." + ![Windows Update update identifiers](images/update-update-id.png) + + +##### Revision ID +- A Revision ID (don't confuse this value with "revision number") is a serial number that's issued when an update is initially published or revised on a given service. +- An existing update that's revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a new revision ID that is not related to the previous ID. +- Revision IDs are unique on a given update source, but not across multiple sources. +- The same update revision might have different revision IDs on Windows Update and WSUS. +- The same revision ID might represent different updates on Windows Update and WSUS. + +##### Local ID +- Local ID is a serial number issued when an update is received from a service by a given Windows Update client +- Typically seen in debug logs, especially involving the local cache for update info (Datastore) +- Different client PCs will assign different Local IDs to the same update +- You can find the local IDs that a client is using by getting the client's %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file + +##### Inconsistent terminology +- Sometimes the logs use terms inconsistently. For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs. +- Recognize IDs by form and context: + + - GUIDs are update IDs + - Small integers that appear alongside an update ID are revision numbers + - Large integers are typically revision IDs + - Small integers (especially in Datastore) can be local IDs + ![Windows Update inconsisten terminology](images/update-inconsistent.png) + +## Windows Setup log files analysis using SetupDiag tool +SetupDiag is a diagnostic tool that can be used for analysis of logs related to installation of Windows Updates. For detailed information, see [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag). diff --git a/windows/deployment/update/windows-update-overview.md b/windows/deployment/update/windows-update-overview.md index 3eda438f80..9706a55a92 100644 --- a/windows/deployment/update/windows-update-overview.md +++ b/windows/deployment/update/windows-update-overview.md @@ -1,57 +1,58 @@ ---- -title: Get started with Windows Update -description: Learn how Windows Update works, including architecture and troubleshooting -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Get started with Windows Update - ->Applies to: Windows 10 - -With the release of Windows 10, we moved the update model to the Unified Update Platform. Unified Update Platform (UUP) is a single publishing, hosting, scan and download model for all types of OS updates, desktop and mobile for all Windows-based operating systems, for everything from monthly quality updates to new feature updates. - -Ues the following information to get started with Windows Update: - -- Understand the UUP architecture -- Understand [how Windows Update works](how-windows-update-works.md) -- Find [Windows Update log files](windows-update-logs.md) -- Learn how to [troubleshoot Windows Update](windows-update-troubleshooting.md) -- Review [common Windows Update errors](windows-update-errors.md) and check out the [error code reference](windows-update-error-reference.md) -- Review [other resources](windows-update-resources.md) to help you use Windows Update - -## Unified Update Platform (UUP) architecture -To understand the changes to the Windows Update architecture that UUP introduces let's start with some new key terms. - -![Windows Update terminology](images/update-terminology.png) - -- **Update UI** – The user interface to initiate Windows Update check and history. Available under **Settings --> Update & Security --> Windows Update**. -- **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update. - - Update types- - - OS Feature updates - - OS Security updates - - Device drivers - - Defender definition updates - - >[!NOTE] - > Other types of updates, like Office desktop updates, are installed if the user opts into Microsoft Update. - > - >Store apps aren't installed by USO, today they are separate. - -- **WU Client/ UpdateAgent** - The component running on your PC. It's essentially a DLL that is downloaded to the device when an update is applicable. It surfaces the APIs needed to perform an update, including those needed to generate a list of payloads to download, as well as starts stage and commit operations. It provides a unified interface that abstracts away the underlying update technologies from the caller. -- **WU Arbiter handle**- Code that is included in the UpdateAgent binary. The arbiter gathers information about the device, and uses the CompDB(s) to output an action list. It is responsible for determining the final "composition state" of your device, and which payloads (like ESDs or packages) are needed to get your device up to date. -- **Deployment Arbiter**- A deployment manager that calls different installers. For example, CBS. - -Additional components include the following- - -- **CompDB** – A generic term to refer to the XML describing information about target build composition, available diff packages, and conditional rules. -- **Action List** – The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages. +--- +title: Get started with Windows Update +description: An overview of learning resources for Windows Update, including documents on architecture, log files, and common errors. +ms.prod: w10 +ms.mktglfcycl: +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.audience: itpro +ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Get started with Windows Update + +>Applies to: Windows 10 + +With the release of Windows 10, we moved the update model to the Unified Update Platform. Unified Update Platform (UUP) is a single publishing, hosting, scan and download model for all types of OS updates, desktop and mobile for all Windows-based operating systems, for everything from monthly quality updates to new feature updates. + +Use the following information to get started with Windows Update: + +- Understand the UUP architecture +- Understand [how Windows Update works](how-windows-update-works.md) +- Find [Windows Update log files](windows-update-logs.md) +- Learn how to [troubleshoot Windows Update](windows-update-troubleshooting.md) +- Review [common Windows Update errors](windows-update-errors.md) and check out the [error code reference](windows-update-error-reference.md) +- Review [other resources](windows-update-resources.md) to help you use Windows Update +- Review [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/bg-p/Windows10Blog) section of Microsoft Blogs. + +## Unified Update Platform (UUP) architecture +To understand the changes to the Windows Update architecture that UUP introduces let's start with some new key terms. + +![Windows Update terminology](images/update-terminology.png) + +- **Update UI** – The user interface to initiate Windows Update check and history. Available under **Settings --> Update & Security --> Windows Update**. +- **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update. + + Update types- + - OS Feature updates + - OS Security updates + - Device drivers + - Defender definition updates + + >[!NOTE] + > Other types of updates, like Office desktop updates, are installed if the user opts into Microsoft Update. + > + >Store apps aren't installed by USO, today they are separate. + +- **WU Client/ UpdateAgent** - The component running on your PC. It's essentially a DLL that is downloaded to the device when an update is applicable. It surfaces the APIs needed to perform an update, including those needed to generate a list of payloads to download, as well as starts stage and commit operations. It provides a unified interface that abstracts away the underlying update technologies from the caller. +- **WU Arbiter handle**- Code that is included in the UpdateAgent binary. The arbiter gathers information about the device, and uses the CompDB(s) to output an action list. It is responsible for determining the final "composition state" of your device, and which payloads (like ESDs or packages) are needed to get your device up to date. +- **Deployment Arbiter**- A deployment manager that calls different installers. For example, CBS. + +Additional components include the following- + +- **CompDB** – A generic term to refer to the XML describing information about target build composition, available diff packages, and conditional rules. +- **Action List** – The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages. diff --git a/windows/deployment/update/windows-update-resources.md b/windows/deployment/update/windows-update-resources.md index c98b9d29d0..49b83d23f1 100644 --- a/windows/deployment/update/windows-update-resources.md +++ b/windows/deployment/update/windows-update-resources.md @@ -1,126 +1,134 @@ ---- -title: Windows Update - Additional resources -description: Additional resources for Windows Update -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Windows Update - additional resources - ->Applies to: Windows 10 - -The following resources provide additional information about using Windows Update. - -## WSUS Troubleshooting - -[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/) - -[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/) - -[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/) - -[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/) - - -## How do I reset Windows Update components? - -[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-WindowsUpdateps1-e0c5eb78) will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Windows Server 2012 R2. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update, in addition to BITS related data. - - -[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc) allow reset the Windows Update Agent resolving issues with Windows Update. - - -## Reset Windows Update components manually -1. Open a Windows command prompt. To open a command prompt, click **Start > Run**. Copy and paste (or type) the following command and then press ENTER: - ``` - cmd - ``` -2. Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - ``` - net stop bits - net stop wuauserv - ``` -3. Delete the qmgr\*.dat files. To do this, type the following command at a command prompt, and then press ENTER: - ``` - Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" - ``` -4. If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above. - 1. Rename the following folders to *.BAK: - - %systemroot%\SoftwareDistribution\DataStore - - %systemroot%\SoftwareDistribution\Download - - %systemroot%\system32\catroot2 - - To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - Ren %systemroot%\SoftwareDistribution\DataStore *.bak - - Ren %systemroot%\SoftwareDistribution\Download *.bak - - Ren %systemroot%\system32\catroot2 *.bak - 2. Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) - - sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) -5. Type the following command at a command prompt, and then press ENTER: - ``` - cd /d %windir%\system32 - ``` -6. Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - regsvr32.exe atl.dll - - regsvr32.exe urlmon.dll - - regsvr32.exe mshtml.dll - - regsvr32.exe shdocvw.dll - - regsvr32.exe browseui.dll - - regsvr32.exe jscript.dll - - regsvr32.exe vbscript.dll - - regsvr32.exe scrrun.dll - - regsvr32.exe msxml.dll - - regsvr32.exe msxml3.dll - - regsvr32.exe msxml6.dll - - regsvr32.exe actxprxy.dll - - regsvr32.exe softpub.dll - - regsvr32.exe wintrust.dll - - regsvr32.exe dssenh.dll - - regsvr32.exe rsaenh.dll - - regsvr32.exe gpkcsp.dll - - regsvr32.exe sccbase.dll - - regsvr32.exe slbcsp.dll - - regsvr32.exe cryptdlg.dll - - regsvr32.exe oleaut32.dll - - regsvr32.exe ole32.dll - - regsvr32.exe shell32.dll - - regsvr32.exe initpki.dll - - regsvr32.exe wuapi.dll - - regsvr32.exe wuaueng.dll - - regsvr32.exe wuaueng1.dll - - regsvr32.exe wucltui.dll - - regsvr32.exe wups.dll - - regsvr32.exe wups2.dll - - regsvr32.exe wuweb.dll - - regsvr32.exe qmgr.dll - - regsvr32.exe qmgrprxy.dll - - regsvr32.exe wucltux.dll - - regsvr32.exe muweb.dll - - regsvr32.exe wuwebv.dll -7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER: - ``` - netsh winsock reset - ``` -8. If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER: - ``` - proxycfg.exe -d - ``` -9. Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - ``` - net start bits - - net start wuauserv - ``` -10. If you are running Windows Vista or Windows Server 2008, clear the BITS queue. To do this, type the following command at a command prompt, and then press ENTER: - ``` - bitsadmin.exe /reset /allusers - ``` +--- +title: Windows Update - Additional resources +description: In this article, learn details about to troubleshooting WSUS and resetting Windows Update components manually. +ms.prod: w10 +ms.mktglfcycl: +audience: itpro +ms.localizationpriority: medium +ms.audience: itpro +ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +ms.author: jaimeo +author: jaimeo +--- + +# Windows Update - additional resources + +> Applies to: Windows 10 + +The following resources provide additional information about using Windows Update. + +## WSUS Troubleshooting + +[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/) + +[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/) + +[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/) + +[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/) + +## How do I reset Windows Update components? + +[Reset Windows Update Client settings script](https://gallery.technet.microsoft.com/scriptcenter/Reset-WindowsUpdateps1-e0c5eb78) will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Windows Server 2012 R2. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update, in addition to BITS related data. + +[Reset Windows Update Agent script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc) allows you to reset the Windows Update Agent, resolving issues with Windows Update. + +## Reset Windows Update components manually + +1. Open a Windows command prompt. To open a command prompt, click **Start > Run**. Copy and paste (or type) the following command and then press ENTER: + ``` console + cmd + ``` +2. Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` console + net stop bits + net stop wuauserv + ``` +3. Delete the qmgr\*.dat files. To do this, type the following command at a command prompt, and then press ENTER: + ``` console + Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" + ``` +4. If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above. + 1. Rename the following folders to *.BAK: + ``` console + %systemroot%\SoftwareDistribution\DataStore + %systemroot%\SoftwareDistribution\Download + %systemroot%\system32\catroot2 + ``` + To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` console + Ren %systemroot%\SoftwareDistribution\DataStore *.bak + Ren %systemroot%\SoftwareDistribution\Download *.bak + Ren %systemroot%\system32\catroot2 *.bak + ``` + 2. Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` console + sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) + sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) + ``` +5. Type the following command at a command prompt, and then press ENTER: + ``` console + cd /d %windir%\system32 + ``` +6. Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + + ``` console + regsvr32.exe atl.dll + regsvr32.exe urlmon.dll + regsvr32.exe mshtml.dll + regsvr32.exe shdocvw.dll + regsvr32.exe browseui.dll + regsvr32.exe jscript.dll + regsvr32.exe vbscript.dll + regsvr32.exe scrrun.dll + regsvr32.exe msxml.dll + regsvr32.exe msxml3.dll + regsvr32.exe msxml6.dll + regsvr32.exe actxprxy.dll + regsvr32.exe softpub.dll + regsvr32.exe wintrust.dll + regsvr32.exe dssenh.dll + regsvr32.exe rsaenh.dll + regsvr32.exe gpkcsp.dll + regsvr32.exe sccbase.dll + regsvr32.exe slbcsp.dll + regsvr32.exe cryptdlg.dll + regsvr32.exe oleaut32.dll + regsvr32.exe ole32.dll + regsvr32.exe shell32.dll + regsvr32.exe initpki.dll + regsvr32.exe wuapi.dll + regsvr32.exe wuaueng.dll + regsvr32.exe wuaueng1.dll + regsvr32.exe wucltui.dll + regsvr32.exe wups.dll + regsvr32.exe wups2.dll + regsvr32.exe wuweb.dll + regsvr32.exe qmgr.dll + regsvr32.exe qmgrprxy.dll + regsvr32.exe wucltux.dll + regsvr32.exe muweb.dll + regsvr32.exe wuwebv.dll + ``` + +7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER: + ``` console + netsh winsock reset + ``` +8. If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER: + ``` console + proxycfg.exe -d + ``` +9. Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` console + net start bits + + net start wuauserv + ``` +10. If you are running Windows Vista or Windows Server 2008, clear the BITS queue. To do this, type the following command at a command prompt, and then press ENTER: + ``` console + bitsadmin.exe /reset /allusers + ``` diff --git a/windows/deployment/update/windows-update-troubleshooting.md b/windows/deployment/update/windows-update-troubleshooting.md index ac0087fb59..92db02e305 100644 --- a/windows/deployment/update/windows-update-troubleshooting.md +++ b/windows/deployment/update/windows-update-troubleshooting.md @@ -1,217 +1,246 @@ ---- -title: Windows Update troubleshooting -description: Learn how to troubleshoot Windows Update -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Windows Update troubleshooting - ->Applies to: Windows 10 - -If you run into problems when using Windows Update, start with the following steps: - -1. Run the built-in Windows Update troubleshooter to fix common issues. Navigate to **Settings > Update & Security > Troubleshoot > Windows Update**. -2. Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on SSU. -3. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system: - - - [Windows 10, version 1809 and Windows Server 2019](https://support.microsoft.com/help/4464619/windows-10-update-history) - - [Windows 10, version 1803](https://support.microsoft.com/help/4099479/windows-10-update-history) - - [Windows 10, version 1709](https://support.microsoft.com/help/4043454) - - [Windows 10, version 1703](https://support.microsoft.com/help/4018124) - - [Windows 10 and Windows Server 2016](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) - - [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470/windows-8-1-windows-server-2012-r2-update-history) - - [Windows Server 2012](https://support.microsoft.com/help/4009471/windows-server-2012-update-history) - - [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/4009469/windows-7-sp1-windows-server-2008-r2-sp1-update-history) - -Advanced users can also refer to the [log](windows-update-logs.md) generated by Windows Update for further investigation. - -You might encounter the following scenarios when using Windows Update. - -## Why am I offered an older update/upgrade? -The update that is offered to a device depends on several factors. Some of the most common attributes include the following: - -- OS Build -- OS Branch -- OS Locale -- OS Architecture -- Device update management configuration - -If the update you're offered isn't the most current available, it might be because your device is being managed by a WSUS server, and you're being offered the updates available on that server. It's also possible, if your device is part of a Windows as a Service deployment ring, that your admin is intentionally slowing the rollout of updates. Since the WaaS rollout is slow and measured to begin with, all devices will not receive the update on the same day. - -## My machine is frozen at scan. Why? -The Settings UI is talking to the Update Orchestrator service which in turn is talking to Windows Update service. If these services stop unexpectedly then you might see this behavior. In such cases, do the following: -1. Close the Settings app and reopen it. -2. Launch Services.msc and check if the following services are running: - - Update State Orchestrator - - Windows Update - -## Feature updates are not being offered while other updates are -On computers running [Windows 10 1709 or higher](#BKMK_DCAT) configured to update from Windows Update (usually WUfB scenario) servicing and definition updates are being installed successfully, but feature updates are never offered. - -Checking the WindowsUpdate.log reveals the following error: -``` -YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * START * Finding updates CallerId = Update;taskhostw Id = 25 -YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Online = Yes; Interactive = No; AllowCachedResults = No; Ignore download priority = No -YYYY/MM/DD HH:mm:ss:SSS PID TID Agent ServiceID = {855E8A7C-ECB4-4CA3-B045-1DFA50104289} Third party service -YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Search Scope = {Current User} -YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Caller SID for Applicability: S-1-12-1-2933642503-1247987907-1399130510-4207851353 -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Got 855E8A7C-ECB4-4CA3-B045-1DFA50104289 redir Client/Server URL: https://fe3.delivery.mp.microsoft.com/ClientWebService/client.asmx"" -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Token Requested with 0 category IDs. -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc GetUserTickets: No user tickets found. Returning WU_E_NO_USERTOKEN. -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570] -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570] -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetDeviceTickets -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::AddTickets:1092] -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [CUpdateEndpointProvider::GenerateSecurityTokenWithAuthTickets:1587] -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentTokenFromServer -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentToken -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] EP:Call to GetEndpointToken -YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Failed to obtain service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 plugin Client/Server auth token of type 0x00000001 -YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Method failed [CAgentProtocolTalkerContext::DetermineServiceEndpoint:377] -YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Initialization failed for Protocol Talker Context -YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Exit code = 0x80070426 -YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * END * Finding updates CallerId = Update;taskhostw Id = 25 -``` - -The 0x80070426 error code translates to: -``` -ERROR_SERVICE_NOT_ACTIVE - # The service has not been started. -``` - -Microsoft Account Sign In Assistant (MSA or wlidsvc) is the service in question. The DCAT Flighting service (ServiceId: 855E8A7C-ECB4-4CA3-B045-1DFA50104289) relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and the search for feature updates never completes successfully. - -In order to solve this issue, we need to reset the MSA service to the default StartType of manual. - -## Issues related to HTTP/Proxy -Windows Update uses WinHttp with Partial Range requests (RFC 7233) to download updates and applications from Windows Update servers or on-premises WSUS servers. Because of this proxy servers configured on the network must support HTTP RANGE requests. If a proxy was configured in Internet Explorer (User level) but not in WinHTTP (System level), connections to Windows Update will fail. - -To fix this issue, configure a proxy in WinHTTP by using the following netsh command: - -``` -netsh winhttp set proxy ProxyServerName:PortNumber -``` - ->[!NOTE] -> You can also import the proxy settings from Internet Explorer by using the following command: netsh winhttp import proxy source=ie - -If downloads through a proxy server fail with a 0x80d05001 DO_E_HTTP_BLOCKSIZE_MISMATCH error, or if you notice high CPU usage while updates are downloading, check the proxy configuration to permit HTTP RANGE requests to run. - -You may choose to apply a rule to permit HTTP RANGE requests for the following URLs: - -*.download.windowsupdate.com -*.dl.delivery.mp.microsoft.com -*.emdl.ws.microsoft.com - -If you cannot permit RANGE requests, keep in mind that this means you are downloading more content than needed in updates (as delta patching will not work). - - -## The update is not applicable to your computer -The most common reasons for this error are described in the following table: - -|Cause|Explanation|Resolution| -|-----|-----------|----------| -|Update is superseded|As updates for a component are released, the updated component will supersede an older component that is already on the system. When this occurs, the previous update is marked as superseded. If the update that you're trying to install already has a newer version of the payload on your system, you may encounter this error message.|Check that the package that you are installing contains newer versions of the binaries. Or, check that the package is superseded by another new package. | -|Update is already installed|If the update that you're trying to install was previously installed, for example, by another update that carried the same payload, you may encounter this error message.|Verify that the package that you are trying to install was not previously installed.| -|Wrong update for architecture|Updates are published by CPU architecture. If the update that you're trying to install does not match the architecture for your CPU, you may encounter this error message. |Verify that the package that you're trying to install matches the Windows version that you are using. The Windows version information can be found in the "Applies To" section of the article for each update. For example, Windows Server 2012-only updates cannot be installed on Windows Server 2012 R2-based computers.
              Also, verify that the package that you are installing matches the processor architecture of the Windows version that you are using. For example, an x86-based update cannot be installed on x64-based installations of Windows. | -|Missing prerequisite update|Some updates require a prerequisite update before they can be applied to a system. If you are missing a prerequisite update, you may encounter this error message. For example, KB 2919355 must be installed on Windows 8.1 and Windows Server 2012 R2 computers before many of the updates that were released after April 2014 can be installed.|Check the related articles about the package in the Microsoft Knowledge Base (KB) to make sure that you have the prerequisite updates installed. For example, if you encounter the error message on Windows 8.1 or Windows Server 2012 R2, you may have to install the April 2014 update 2919355 as a prerequisite and one or more pre-requisite servicing updates (KB 2919442 and KB 3173424).
              Note: To determine if these prerequisite updates are installed, run the following PowerShell command:
              get-hotfix KB3173424,KB2919355,KB2919442
              If the updates are installed, the command will return the installed date in the "InstalledOn" section of the output. - -## Issues related to firewall configuration -Error that may be seen in the WU logs: -``` -DownloadManager Error 0x800706d9 occurred while downloading update; notifying dependent calls. -``` -Or -``` -[DownloadManager] BITS job {A4AC06DD-D6E6-4420-8720-7407734FDAF2} hit a transient error, updateId = {D053C08A-6250-4C43-A111-56C5198FE142}.200 , error = 0x800706D9 -``` -Or -``` -DownloadManager [0]12F4.1FE8::09/29/2017-13:45:08.530 [agent]DO job {C6E2F6DC-5B78-4608-B6F1-0678C23614BD} hit a transient error, updateId = 5537BD35-BB74-40B2-A8C3-B696D3C97CBA.201 , error = 0x80D0000A -``` - -Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information, see [I need to disable Windows Firewall](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc766337(v=ws.10)). - -## Issues arising from configuration of conflicting policies -Windows Update provides a wide range configuration policies to control the behavior of WU service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting polices may lead to unexpected behaviors. - -See [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information. - - -## Updates aren't downloading from the intranet endpoint (WSUS/SCCM) -Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps: -1. Start Windows PowerShell as an administrator -2. Run \$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager". -3. Run \$MUSM.Services. - -Check the output for the Name and OffersWindowsUPdates parameters, which you can interpret according to this table. - -|Output|Interpretation| -|-|-| -|- Name: Microsoft Update
              -OffersWindowsUpdates: True| - The update source is Microsoft Update, which means that updates for other Microsoft products besides the operating system could also be delivered.
              - Indicates that the client is configured to receive updates for all Microsoft Products (Office, etc.) | -|- Name: DCat Flighting Prod
              - OffersWindowsUpdates: True |- Starting with Windows 10 1709, feature updates are always delivered through the DCAT service.
              - Indicates that the client is configured to receive feature updates from Windows Update. | -|- Name: Windows Store (DCat Prod)
              - OffersWindowsUpdates: False |-The update source is Insider Updates for Store Apps.
              - Indicates that the client will not receive or is not configured to receive these updates.| -|- Name: Windows Server Update Service
              - OffersWindowsUpdates: True |- The source is a Windows Server Updates Services server.
              - The client is configured to receive updates from WSUS. | -|- Name: Windows Update
              - OffersWindowsUpdates: True|- The source is Windows Update.
              - The client is configured to receive updates from Windows Update Online.| - -## You have a bad setup in the environment -If we look at the GPO being set through registry, the system is configured to use WSUS to download updates: - -``` -HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] -"UseWUServer"=dword:00000001 ===================================> it says use WSUS server. -``` - -From the WU logs: -``` -2018-08-06 09:33:31:085 480 1118 Agent ** START ** Agent: Finding updates [CallerId = OperationalInsight Id = 49] -2018-08-06 09:33:31:085 480 1118 Agent ********* -2018-08-06 09:33:31:085 480 1118 Agent * Include potentially superseded updates -2018-08-06 09:33:31:085 480 1118 Agent * Online = No; Ignore download priority = No -2018-08-06 09:33:31:085 480 1118 Agent * Criteria = "IsHidden = 0 AND DeploymentAction=*" -2018-08-06 09:33:31:085 480 1118 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service -2018-08-06 09:33:31:085 480 1118 Agent * Search Scope = {Machine} -2018-08-06 09:33:32:554 480 1118 Agent * Found 83 updates and 83 categories in search; evaluated appl. rules of 517 out of 1473 deployed entities -2018-08-06 09:33:32:554 480 1118 Agent ********* -2018-08-06 09:33:32:554 480 1118 Agent ** END ** Agent: Finding updates [CallerId = OperationalInsight Id = 49] -``` - -In the above log snippet, we see that the Criteria = "IsHidden = 0 AND DeploymentAction=*". "*" means there is nothing specified from the server. So, the scan happens but there is no direction to download or install to the agent. So it just scans the update and provides the results. - -Now if you look at the below logs, the Automatic update runs the scan and finds no update approved for it. So it reports there are 0 updates to install or download. This is due to bad setup or configuration in the environment. The WSUS side should approve the patches for WU so that it fetches the updates and installs it on the specified time according to the policy. Since this scenario doesn't include SCCM, there's no way to install unapproved updates. And that is the problem you are facing. You expect that the scan should be done by the operational insight agent and automatically trigger download and install but that won’t happen here. - -``` -2018-08-06 10:58:45:992 480 5d8 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57] -2018-08-06 10:58:45:992 480 5d8 Agent ********* -2018-08-06 10:58:45:992 480 5d8 Agent * Online = Yes; Ignore download priority = No -2018-08-06 10:58:45:992 480 5d8 Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1" - -2018-08-06 10:58:46:617 480 5d8 PT + SyncUpdates round trips: 2 -2018-08-06 10:58:47:383 480 5d8 Agent * Found 0 updates and 83 categories in search; evaluated appl. rules of 617 out of 1473 deployed entities -2018-08-06 10:58:47:383 480 5d8 Agent Reporting status event with 0 installable, 83 installed, 0 installed pending, 0 failed and 0 downloaded updates -2018-08-06 10:58:47:383 480 5d8 Agent ********* -2018-08-06 10:58:47:383 480 5d8 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57] -``` - -## High bandwidth usage on Windows 10 by Windows Update -Users may see that Windows 10 is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that may consume bandwidth expand beyond Windows Update components. - -The following group policies can help mitigate this: - -- Blocking access to Windows Update servers: [Policy Turn off access to all Windows Update features](http://gpsearch.azurewebsites.net/#4728) (Set to enabled) -- Driver search: [Policy Specify search order for device driver source locations](http://gpsearch.azurewebsites.net/#183) (Set to "Do not search Windows Update") -- Windows Store automatic update: [Policy Turn off Automatic Download and Install of updates](http://gpsearch.azurewebsites.net/#10876) (Set to enabled) - -Other components that reach out to the internet: - -- Windows Spotlight: [Policy Configure Windows spotlight on lock screen](http://gpsearch.azurewebsites.net/#13362) (Set to disabled) -- Consumer experiences: [Policy Turn off Microsoft consumer experiences](http://gpsearch.azurewebsites.net/#13329) (Set to enabled) -- Background traffic from Windows apps: [Policy Let Windows apps run in the background](http://gpsearch.azurewebsites.net/#13571) +--- +title: Windows Update troubleshooting +description: Learn about troubleshooting Windows Update, issues related to HTTP/Proxy, and why some features are offered and others aren't. +ms.prod: w10 +ms.mktglfcycl: +audience: itpro +itproauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows Update troubleshooting + +>Applies to: Windows 10 + +If you run into problems when using Windows Update, start with the following steps: + +1. Run the built-in Windows Update troubleshooter to fix common issues. Navigate to **Settings > Update & Security > Troubleshoot > Windows Update**. + +2. Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on servicing stack updates. + +3. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system: + + - [Windows 10, version 2004 and Windows Server, version 2004](https://support.microsoft.com/help/4555932) + - [Windows 10, version 1909 and Windows Server, version 1909](https://support.microsoft.com/help/4529964) + - [Windows 10, version 1903 and Windows Server, version 1903](https://support.microsoft.com/help/4498140) + - [Windows 10, version 1809 and Windows Server 2019](https://support.microsoft.com/help/4464619/windows-10-update-history) + - [Windows 10, version 1803](https://support.microsoft.com/help/4099479/windows-10-update-history) + - [Windows 10, version 1709](https://support.microsoft.com/help/4043454) + - [Windows 10, version 1703](https://support.microsoft.com/help/4018124) + - [Windows 10 and Windows Server 2016](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) + - [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470/windows-8-1-windows-server-2012-r2-update-history) + - [Windows Server 2012](https://support.microsoft.com/help/4009471/windows-server-2012-update-history) + - [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/4009469/windows-7-sp1-windows-server-2008-r2-sp1-update-history) + +Advanced users can also refer to the [log](windows-update-logs.md) generated by Windows Update for further investigation. + +You might encounter the following scenarios when using Windows Update. + +## Why am I offered an older update? +The update that is offered to a device depends on several factors. The following are some of the most common attributes: + +- OS Build +- OS Branch +- OS Locale +- OS Architecture +- Device update management configuration + +If the update you're offered isn't the most current available, it might be because your device is being managed by a WSUS server, and you're being offered the updates available on that server. It's also possible, if your device is part of a deployment group, that your admin is intentionally slowing the rollout of updates. Since the deployment is slow and measured to begin with, all devices will not receive the update on the same day. + +## My device is frozen at scan. Why? +The Settings UI communicates with the Update Orchestrator service that in turn communicates with to Windows Update service. If these services stop unexpectedly, then you might see this behavior. In such cases, follow these steps: + +1. Close the Settings app and reopen it. + +2. Start Services.msc and check if the following services are running: + + - Update State Orchestrator + - Windows Update + +## Feature updates are not being offered while other updates are +Devices running Windows 10, version 1709 through Windows 10, version 1803 that are [configured to update from Windows Update](#BKMK_DCAT) (including Windows Update for Business) are able to install servicing and definition updates but are never offered feature updates. + +Checking the WindowsUpdate.log reveals the following error: +```console +YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * START * Finding updates CallerId = Update;taskhostw Id = 25 +YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Online = Yes; Interactive = No; AllowCachedResults = No; Ignore download priority = No +YYYY/MM/DD HH:mm:ss:SSS PID TID Agent ServiceID = {855E8A7C-ECB4-4CA3-B045-1DFA50104289} Third party service +YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Search Scope = {Current User} +YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Caller SID for Applicability: S-1-12-1-2933642503-1247987907-1399130510-4207851353 +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Got 855E8A7C-ECB4-4CA3-B045-1DFA50104289 redir Client/Server URL: https://fe3.delivery.mp.microsoft.com/ClientWebService/client.asmx"" +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Token Requested with 0 category IDs. +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc GetUserTickets: No user tickets found. Returning WU_E_NO_USERTOKEN. +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570] +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570] +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetDeviceTickets +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::AddTickets:1092] +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [CUpdateEndpointProvider::GenerateSecurityTokenWithAuthTickets:1587] +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentTokenFromServer +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentToken +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] EP:Call to GetEndpointToken +YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Failed to obtain service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 plugin Client/Server auth token of type 0x00000001 +YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Method failed [CAgentProtocolTalkerContext::DetermineServiceEndpoint:377] +YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Initialization failed for Protocol Talker Context +YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Exit code = 0x80070426 +YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * END * Finding updates CallerId = Update;taskhostw Id = 25 +``` + +The 0x80070426 error code translates to: +```console +ERROR_SERVICE_NOT_ACTIVE - # The service has not been started. +``` + +Microsoft Account Sign In Assistant (MSA or wlidsvc) is the service in question. The DCAT Flighting service (ServiceId: 855E8A7C-ECB4-4CA3-B045-1DFA50104289) relies on MSA to get the global device ID for the device. Without the MSA service running, the global device ID won't be generated and sent by the client and the search for feature updates never completes successfully. + +To resolve this issue, reset the MSA service to the default StartType of "manual." + +## Issues related to HTTP/Proxy +Windows Update uses WinHttp with Partial Range requests (RFC 7233) to download updates and applications from Windows Update servers or on-premises WSUS servers. Therefore proxy servers on the network must support HTTP RANGE requests. If a proxy was configured in Internet Explorer (User level) but not in WinHTTP (System level), connections to Windows Update will fail. + +To fix this issue, configure a proxy in WinHTTP by using the following netsh command: + +```console +netsh winhttp set proxy ProxyServerName:PortNumber +``` + +>[!NOTE] +> You can also import the proxy settings from Internet Explorer by using the following command: netsh winhttp import proxy source=ie + +If downloads through a proxy server fail with a 0x80d05001 DO_E_HTTP_BLOCKSIZE_MISMATCH error, or if you notice high CPU usage while updates are downloading, check the proxy configuration to permit HTTP RANGE requests to run. + +You might choose to apply a rule to permit HTTP RANGE requests for the following URLs: + +`*.download.windowsupdate.com` +`*.dl.delivery.mp.microsoft.com` +`*.delivery.mp.microsoft.com` + +If you can't allow RANGE requests, you'll be downloading more content than needed in updates (as delta patching will not work). + + +## The update is not applicable to your computer +The most common reasons for this error are described in the following table: + +|Cause|Explanation|Resolution| +|-----|-----------|----------| +|Update is superseded|As updates for a component are released, the updated component will supersede an older component that is already on the system. When this occurs, the previous update is marked as superseded. If the update that you're trying to install already has a newer version of the payload on your system, you might receive this error message.|Check that the package that you are installing contains newer versions of the binaries. Or, check that the package is superseded by another new package. | +|Update is already installed|If the update that you're trying to install was previously installed, for example, by another update that carried the same payload, you may encounter this error message.|Verify that the package that you are trying to install was not previously installed.| +|Wrong update for architecture|Updates are published by CPU architecture. If the update that you're trying to install does not match the architecture for your CPU, you may encounter this error message. |Verify that the package that you're trying to install matches the Windows version that you are using. The Windows version information can be found in the "Applies To" section of the article for each update. For example, Windows Server 2012-only updates cannot be installed on Windows Server 2012 R2-based computers.
              Also, verify that the package that you are installing matches the processor architecture of the Windows version that you are using. For example, an x86-based update cannot be installed on x64-based installations of Windows. | +|Missing prerequisite update|Some updates require a prerequisite update before they can be applied to a system. If you are missing a prerequisite update, you may encounter this error message. For example, KB 2919355 must be installed on Windows 8.1 and Windows Server 2012 R2 computers before many of the updates that were released after April 2014 can be installed.|Check the related articles about the package in the Microsoft Knowledge Base (KB) to make sure that you have the prerequisite updates installed. For example, if you encounter the error message on Windows 8.1 or Windows Server 2012 R2, you may have to install the April 2014 update 2919355 as a prerequisite and one or more pre-requisite servicing updates (KB 2919442 and KB 3173424).
              To determine if these prerequisite updates are installed, run the following PowerShell command:
              `get-hotfix KB3173424,KB2919355, KB2919442`.
              If the updates are installed, the command will return the installed date in the `InstalledOn` section of the output. + +## Issues related to firewall configuration +Error that you might see in Windows Update logs: +```console +DownloadManager Error 0x800706d9 occurred while downloading update; notifying dependent calls. +``` +Or +```console +[DownloadManager] BITS job {A4AC06DD-D6E6-4420-8720-7407734FDAF2} hit a transient error, updateId = {D053C08A-6250-4C43-A111-56C5198FE142}.200 , error = 0x800706D9 +``` +Or +```console +DownloadManager [0]12F4.1FE8::09/29/2017-13:45:08.530 [agent]DO job {C6E2F6DC-5B78-4608-B6F1-0678C23614BD} hit a transient error, updateId = 5537BD35-BB74-40B2-A8C3-B696D3C97CBA.201 , error = 0x80D0000A +``` + +Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information, see [I need to disable Windows Firewall](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc766337(v=ws.10)). + +## Issues arising from configuration of conflicting policies +Windows Update provides a wide range configuration policy to control the behavior of the Windows Update service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting policies may lead to unexpected behaviors. + +For more information, see [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information. + +## Device cannot access update files + +Ensure that devices can reach necessary Windows Update endpoints through the firewall. For example, for Windows 10, version 2004, the following protocols must be able to reach these respective endpoints: + + +|Protocol |Endpoint URL | +|---------|---------| +|TLS 1.2 | `*.prod.do.dsp.mp.microsoft.com` | +|HTTP | `emdl.ws.microsoft.com` | +|HTTP | `*.dl.delivery.mp.microsoft.com` | +|HTTP | `*.windowsupdate.com` | +|HTTPS | `*.delivery.mp.microsoft.com` | +|TLS 1.2 | `*.update.microsoft.com` | +|TLS 1.2 | `tsfe.trafficshaping.dsp.mp.microsoft.com` | + +> [!NOTE] +> Be sure not to use HTTPS for those endpoints that specify HTTP, and vice versa. The connection will fail. + +The specific endpoints can vary between Windows 10 versions. See, for example, [Windows 10 2004 Enterprise connection endpoints](https://docs.microsoft.com/windows/privacy/manage-windows-2004-endpoints). Similar articles for other Windows 10 versions are available in the table of contents nearby. + + +## Updates aren't downloading from the intranet endpoint (WSUS or Configuration Manager) +Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps: + +1. Start Windows PowerShell as an administrator. +2. Run \$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager". +3. Run \$MUSM.Services. + +Check the output for the Name and OffersWindowsUPdates parameters, which you can interpret according to this table. + +|Output|Meaning| +|-|-| +|- Name: Microsoft Update
              -OffersWindowsUpdates: True| - The update source is Microsoft Update, which means that updates for other Microsoft products besides the operating system could also be delivered.
              - Indicates that the client is configured to receive updates for all Microsoft Products (Office, etc.) | +|- Name: DCat Flighting Prod
              - OffersWindowsUpdates: True |- Starting with Windows 10 1709, feature updates are always delivered through the DCAT service.
              - Indicates that the client is configured to receive feature updates from Windows Update. | +|- Name: Windows Store (DCat Prod)
              - OffersWindowsUpdates: False |-The update source is Insider Updates for Store Apps.
              - Indicates that the client will not receive or is not configured to receive these updates.| +|- Name: Windows Server Update Service
              - OffersWindowsUpdates: True |- The source is a Windows Server Updates Services server.
              - The client is configured to receive updates from WSUS. | +|- Name: Windows Update
              - OffersWindowsUpdates: True|- The source is Windows Update.
              - The client is configured to receive updates from Windows Update Online.| + +## You have a bad setup in the environment +In this example, per the Group Policy set through registry, the system is configured to use WSUS to download updates (note the second line): + +```console +HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] +"UseWUServer"=dword:00000001 +``` + +From Windows Update logs: +```console +2018-08-06 09:33:31:085 480 1118 Agent ** START ** Agent: Finding updates [CallerId = OperationalInsight Id = 49] +2018-08-06 09:33:31:085 480 1118 Agent ********* +2018-08-06 09:33:31:085 480 1118 Agent * Include potentially superseded updates +2018-08-06 09:33:31:085 480 1118 Agent * Online = No; Ignore download priority = No +2018-08-06 09:33:31:085 480 1118 Agent * Criteria = "IsHidden = 0 AND DeploymentAction=*" +2018-08-06 09:33:31:085 480 1118 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service +2018-08-06 09:33:31:085 480 1118 Agent * Search Scope = {Machine} +2018-08-06 09:33:32:554 480 1118 Agent * Found 83 updates and 83 categories in search; evaluated appl. rules of 517 out of 1473 deployed entities +2018-08-06 09:33:32:554 480 1118 Agent ********* +2018-08-06 09:33:32:554 480 1118 Agent ** END ** Agent: Finding updates [CallerId = OperationalInsight Id = 49] +``` + +In the above log snippet, we see that the `Criteria = "IsHidden = 0 AND DeploymentAction=*"`. "*" means there is nothing specified from the server. So, the scan happens but there is no direction to download or install to the agent. So it just scans the update and provides the results. + +As shown in the following logs, automatic update runs the scan and finds no update approved for it. So it reports there are no updates to install or download. This is due to an incorrect configuration. The WSUS side should approve the updates for Windows Update so that it fetches the updates and installs them at the specified time according to the policy. Since this scenario doesn't include Configuration Manager, there's no way to install unapproved updates. You're expecting the operational insight agent to do the scan and automatically trigger the download and installation but that won’t happen with this configuration. + +```console +2018-08-06 10:58:45:992 480 5d8 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57] +2018-08-06 10:58:45:992 480 5d8 Agent ********* +2018-08-06 10:58:45:992 480 5d8 Agent * Online = Yes; Ignore download priority = No +2018-08-06 10:58:45:992 480 5d8 Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1" + +2018-08-06 10:58:46:617 480 5d8 PT + SyncUpdates round trips: 2 +2018-08-06 10:58:47:383 480 5d8 Agent * Found 0 updates and 83 categories in search; evaluated appl. rules of 617 out of 1473 deployed entities +2018-08-06 10:58:47:383 480 5d8 Agent Reporting status event with 0 installable, 83 installed, 0 installed pending, 0 failed and 0 downloaded updates +2018-08-06 10:58:47:383 480 5d8 Agent ********* +2018-08-06 10:58:47:383 480 5d8 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57] +``` + +## High bandwidth usage on Windows 10 by Windows Update +Users might see that Windows 10 is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that might consume bandwidth expand beyond Windows Update components. + +The following group policies can help mitigate this situation: + +- Blocking access to Windows Update servers: [Policy Turn off access to all Windows Update features](https://gpsearch.azurewebsites.net/#4728) (Set to enabled) +- Driver search: [Policy Specify search order for device driver source locations](https://gpsearch.azurewebsites.net/#183) (Set to "Do not search Windows Update") +- Windows Store automatic update: [Policy Turn off Automatic Download and Install of updates](https://gpsearch.azurewebsites.net/#10876) (Set to enabled) + +Other components that connect to the internet: + +- Windows Spotlight: [Policy Configure Windows spotlight on lock screen](https://gpsearch.azurewebsites.net/#13362) (Set to disabled) +- Consumer experiences: [Policy Turn off Microsoft consumer experiences](https://gpsearch.azurewebsites.net/#13329) (Set to enabled) +- Background traffic from Windows apps: [Policy Let Windows apps run in the background](https://gpsearch.azurewebsites.net/#13571) diff --git a/windows/deployment/update/wufb-autoupdate.md b/windows/deployment/update/wufb-autoupdate.md index 9bdabe44ba..0fc1330492 100644 --- a/windows/deployment/update/wufb-autoupdate.md +++ b/windows/deployment/update/wufb-autoupdate.md @@ -1,37 +1,37 @@ ---- -title: Setting up Automatic Update in Windows Update for Business (Windows 10) -description: Learn how to get started using Windows Update for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 06/20/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Set up Automatic Update in Windows Update for Business with group policies - ->Applies to: Windows 10 - -Use the Automatic Update group policies to manage the interaction between Windows Update and clients. - -Automatic Update governs the "behind the scenes" download and installation processes. It's important to keep in mind the device limitation in your environment as the download and install process can consume processing power. The below section outlines the ideal configuration for devices with the least amount of user experience degradation. - -|Policy|Description | -|-|-| -|Configure Automatic Updates|Governs the installation activity that happens in the background. This allows you to configure the installation to happen during the [maintenance window](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows). Also, you can specify an installation time where the device will also try to install the latest packages. You can also pick a certain day and or week.| -|Automatic Update Detection Frequency|Lets you set the scan frequency the device will use to connect to Windows Update to see if there is any available content. Default is 22 hours, but you can increase or decrease the frequency. Keep in mind a desktop computer may need to scan less frequently than laptops, which can have intermittent internet connection.| -|Specify Intranet Microsoft Update Service Location|Used for Windows Server Update Services or System Center Configuration Manager users who want to install custom packages that are not offered through Windows Update.| -|Do not connect to any Windows Update Internet locations
              Required for Dual Scan|Prevents access to Windows Update.| - -## Suggested configuration - -|Policy|Location|Suggested configuration| -|-|-|-| -|Configure Automatic Updates| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates| **Attention**: If you are using this policy, don't set it/configure it to get the default behavior. If you have set this policy, delete the reg key. This ensures the device uses the default behavior. Note that this is not the same as the default setting within the policy.

              **Default behavior**: Download and installation happen automatically. The device will then be in a pending reboot state.

              **Pro tip**: You can configure the scan frequency to be more frequent with the policy below.| -|Automatic Update Detection Frequency|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Automatic Updates detection frequency|State: Enabled
              **Check for updates on the following interval (hours)**: 22| -|Do not connect to any Windows Update Internet locations (Required for Dual Scan) | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not connect to any Windows Update Internet locations |State: Disabled | +--- +title: Setting up Automatic Update in Windows Update for Business (Windows 10) +description: In this article, learn how to configure Automatic Update in Windows Update for Business with group policies. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.audience: itpro +ms.date: 06/20/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Set up Automatic Update in Windows Update for Business with group policies + +>Applies to: Windows 10 + +Use the Automatic Update group policies to manage the interaction between Windows Update and clients. + +Automatic Update governs the "behind the scenes" download and installation processes. It's important to keep in mind the device limitation in your environment as the download and install process can consume processing power. The below section outlines the ideal configuration for devices with the least amount of user experience degradation. + +|Policy|Description | +|-|-| +|Configure Automatic Updates|Governs the installation activity that happens in the background. This allows you to configure the installation to happen during the [maintenance window](https://docs.microsoft.com/configmgr/core/clients/manage/collections/use-maintenance-windows). Also, you can specify an installation time where the device will also try to install the latest packages. You can also pick a certain day and or week.| +|Automatic Update Detection Frequency|Lets you set the scan frequency the device will use to connect to Windows Update to see if there is any available content. Default is 22 hours, but you can increase or decrease the frequency. Keep in mind a desktop computer may need to scan less frequently than laptops, which can have intermittent internet connection.| +|Specify Intranet Microsoft Update Service Location|Used for Windows Server Update Services or Microsoft Endpoint Configuration Manager users who want to install custom packages that are not offered through Windows Update.| +|Do not connect to any Windows Update Internet locations
              Required for Dual Scan|Prevents access to Windows Update.| + +## Suggested configuration + +|Policy|Location|Suggested configuration| +|-|-|-| +|Configure Automatic Updates| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates| **Attention**: If you are using this policy, don't set it/configure it to get the default behavior. If you have set this policy, delete the reg key. This ensures the device uses the default behavior. Note that this is not the same as the default setting within the policy.

              **Default behavior**: Download and installation happen automatically. The device will then be in a pending reboot state.

              **Pro tip**: You can configure the scan frequency to be more frequent with the policy below.| +|Automatic Update Detection Frequency|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Automatic Updates detection frequency|State: Enabled
              **Check for updates on the following interval (hours)**: 22| +|Do not connect to any Windows Update Internet locations (Required for Dual Scan) | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not connect to any Windows Update Internet locations |State: Disabled | diff --git a/windows/deployment/update/wufb-basics.md b/windows/deployment/update/wufb-basics.md index e1e9419e08..041169807e 100644 --- a/windows/deployment/update/wufb-basics.md +++ b/windows/deployment/update/wufb-basics.md @@ -1,29 +1,30 @@ ---- -title: Configure the Basic group policy for Windows Update for Business -description: Learn how to get started using the Basic GPO in Windows Update for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 06/20/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Configure the Basic group policy for Windows Update for Business - -For Windows Update for Business configurations to work, devices need to be configured with minimum [diagnostic data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) level of "Basic." Additionally, compliance reporting for configured devices is obtained using [Update Compliance in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). To view your data in Update Compliance [diagnostics data must be enabled](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#set-diagnostic-data-levels) and the devices must be configured with a commercial ID, a unique GUID created for an enterprise at the time of onboarding to the Windows Analytics solution. - -|Policy name|Description | -|-|-| -|Allow Telemetry|Enables Microsoft to run diagnostics on your device and troubleshoot.| -|Configure Commercial ID|This policy allows you to join the device to an entity.| - -## Suggested configuration - -|Policy|Location|Suggested configuration| -|-|-|-| -|Allow Telemetry |GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry |State: Enabled
              **Option**: 1-Basic| -|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled
              **Commercial ID**: The GUID created for you at the time of onboarding to Windows Analytics| +--- +title: Configure the Basic group policy for Windows Update for Business +description: In this article, you will learn how to configure the basic group policy for Windows Update for Business. +ms.custom: seo-marvel-apr2020 +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# Configure the Basic group policy for Windows Update for Business + +For Windows Update for Business configurations to work, devices need to be configured with minimum [diagnostic data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) level of "Basic." Additionally, compliance reporting for configured devices is obtained using [Monitor Windows Update with Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). To view your data in Update Compliance [diagnostics data must be enabled](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#set-diagnostic-data-levels) and the devices must be configured with a commercial ID, a unique GUID created for an enterprise at the time of onboarding. + +|Policy name|Description | +|-|-| +|Allow Telemetry|Enables Microsoft to run diagnostics on your device and troubleshoot.| +|Configure Commercial ID|This policy allows you to join the device to an entity.| + +## Suggested configuration + +|Policy|Location|Suggested configuration| +|-|-|-| +|Allow Telemetry |GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry |State: Enabled
              **Option**: 1-Basic| +|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled
              **Commercial ID**: The GUID created for you at the time of onboarding| diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index bb088093c1..1fb426d25f 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -1,100 +1,168 @@ ---- -title: Enforce compliance deadlines with policies in Windows Update for Business (Windows 10) -description: Learn how to enforce compliance deadlines using Windows Update for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 06/20/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Enforcing compliance deadlines for updates - ->Applies to: Windows 10 - -Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce patch compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer revisions. We offer two compliance flows that you can choose from: - -- [Deadline only](#deadline-only) -- [Deadline with user engagement](#deadline-with-user-engagement) - -## Deadline Only - -This flow only enforces the deadline where the device will attempt to silently restart outside of active hours before the deadline is reached. Once the deadline is reached the user is prompted with either a confirmation button or a restart now option. - -### End User Experience - -Once the device is in the pending restart state, it will attempt to restart the device during non-active hours. This is known as the auto-restart period, and by default it does not require user interaction to reboot the device. - ->[!NOTE] ->Deadlines are enforced from pending restart state (for example, when the device has completed the installation and download from Windows Update). - -### Policy overview - -|Policy|Description | -|-|-| -|Specify deadline before auto-restart for update installation|Governs the update experience once the device has entered pending reboot state. It specifies a deadline, in days, to enforce compliance (such as imminent install).| -|Configure Auto-restart warning notification schedule for updates|Configures the reminder notification and the warning notification for a scheduled install. The user can dismiss a reminder, but not the warning.| - -### Suggested Configuration - -|Policy|Location|3 Day Compliance|5 Day Compliance|7 Day Compliance | -|-|-|-|-|-| -|Specify deadline before auto-restart for update installation| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadline before auto-restart for update installation |State: Enabled
              **Specify the number of days before pending restart will automatically be executed outside of active hours**: 2|State: Enabled
              **Specify the number of days before pending restart will automatically be executed outside of active hours**: 3|State: Enabled
              **Specify the number of days before pending restart will automatically be executed outside of active hours**: 4 - -### Controlling notification experience for deadline - -|Policy| Location|Suggested Configuration | -|-|-|-| -|Configure Auto-restart warning notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure auto-restart warning notifications schedule for updates |State: Enabled
              **Reminder** (hours): 2
              **Warning** (minutes): 60 | - -### Notification experience for deadline - -Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) - -Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) - -## Deadline with user engagement - -This flow provides the end user with prompts to select a time to restart the device before the deadline is reached. If the device is unable to restart at the time specified by the user or the time selected is outside the deadline, the device will restart the next time it is active. - -### End user experience - -Before the deadline the device will be in two states: auto-restart period and engaged-restart period. During the auto-restart period the device will silently try to restart outside of active hours. If the device can't find an idle moment to restart, then the device will go into engaged-restart. The end user, at this point, can select a time that they would like the device to try to restart. Both phases happen before the deadline; once that deadline has passed then the device will restart at the next available time. - -### Policy overview - -|Policy| Description | -|-|-| -|Specify engaged restart transition and notification schedule for updates|Governs how the user will be impacted by the pending reboot. Transition days, first starts out in Auto-Restart where the device will find an idle moment to reboot the device. After 2 days engaged restart will commence and the user will be able to choose a time| -|Configure Auto-restart required notification for updates|Governs the notifications during the Auto-Restart period. During Active hours, the user will be notified that the device is trying to reboot. They will have the option to confirm or dismiss the notification| - -### Suggested configuration - -|Policy| Location| 3 Day Compliance| 5 Day Compliance| 7 Day Compliance | -|-|-|-|-|-| -|Specify engaged restart transition and notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Engaged restart transition and notification schedule for updates|State: Enabled
              **Transition** (Days): 2
              **Snooze** (Days): 2
              **Deadline** (Days): 3|State: Enabled
              **Transition** (Days): 2
              **Snooze** (Days): 2
              **Deadline** (Days): 4|State: Enabled
              **Transition** (Days): 2
              **Snooze** (Days): 2
              **Deadline** (Days): 5| - -### Controlling notification experience for engaged deadline - -|Policy| Location |Suggested Configuration -|-|-|-| -|Configure Auto-restart required notification for updates |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Auto-restart required notification for updates|State: Enabled
              **Method**: 2- User| - -### Notification experience for engaged deadlines -Notification users get for quality update engaged deadline: -![The notification users get for an impending engaged quality update deadline](images/wufb-quality-engaged-notification.png) - -Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) - -Notification users get for a feature update engaged deadline: -![The notification users get for an impending feature update engaged deadline](images/wufb-feature-update-engaged-notification.png) - -Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline](images/wufb-feature-update-deadline-notification.png) +--- +title: Enforce compliance deadlines with policies in Windows Update for Business (Windows 10) +description: This article contains information on how to enforce compliance deadlines using Windows Update for Business. +ms.custom: seo-marvel-apr2020 +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# Enforcing compliance deadlines for updates + +> Applies to: Windows 10 + +Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce update compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer versions. + +The compliance options have changed for devices on Windows 10, version 1709 and above: + +- [For Windows 10, version 1709 and above](#for-windows-10-version-1709-and-above) +- [Prior to Windows 10, version 1709](#prior-to-windows-10-version-1709) + +## For Windows 10, version 1709 and above + +With a current version of Windows 10, it's best to use the new policy introduced in June 2019 to Windows 10, version 1709 and above: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as four separate settings: + +- Update/ConfigureDeadlineForFeatureUpdates +- Update/ConfigureDeadlineForQualityUpdates +- Update/ConfigureDeadlineGracePeriod +- Update/ConfigureDeadlineNoAutoReboot + +This policy starts the countdown for the update installation deadline from when the update is published, instead of starting with the "restart pending" state as the older policies did. + +The policy also includes a configurable grace period to allow, for example, users who have been away to have extra time before being forced to restart their devices. + +Further, the policy includes the option to opt out of automatic restarts until the deadline is reached by presenting the "engaged restart experience" until the deadline has actually expired. At this point the device will automatically schedule a restart regardless of active hours. + +### Policy setting overview + +|Policy|Description | +|-|-| +| (Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | Similar to the older "Specify deadline before auto-restart for update installation," but starts the deadline countdown from when the update was published. Also introduces a configurable grace period and the option to opt out of automatic restarts until the deadline is reached. | + +### Suggested configurations + +|Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days| +|-|-|-|-|-| +|(Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 7 | 2 | + +When **Specify deadlines for automatic updates and restarts** is set (Windows 10, version 1709 and above): + + - **While restart is pending, before the deadline occurs:** + + - For the first few days, the user receives a toast notification + + - After this period, the user receives this dialog: + + ![The notification users get for an impending restart prior to deadline](images/wufb-update-deadline-warning.png) + + - If the user scheduled a restart, or if an auto restart is scheduled, 15 minutes before the scheduled time the user is receives this notification that the restart is about to occur: + + ![The notification users get for an impending restart 15 minutes prior to restart](images/wufb-restart-imminent-warning.png) + + - **If the restart is still pending after the deadline passes:** + + - Within 12 hours before the deadline passes, the user receives this notification that the deadline is approaching: + + ![The notification users get for an approaching restart deadline](images/wufb-pastdeadline-restart-warning.png) + + - Once the deadline has passed, the user is forced to restart to keep their devices in compliance and receives this notification: + + ![The notification users get for an imminent restart after the deadline](images/wufb-pastdeadline-restartnow.png) + + +## Prior to Windows 10, version 1709 + +Two compliance flows are available: + +- [Deadline only](#deadline-only) +- [Deadline with user engagement](#deadline-with-user-engagement) + +### Deadline only + +This flow only enforces the deadline where the device will attempt to silently restart outside of active hours before the deadline is reached. Once the deadline is reached the user is prompted with either a confirmation button or a restart now option. + +#### End-user experience + +Once the device is in the pending restart state, it will attempt to restart the device during non-active hours. This is known as the auto-restart period, and by default it does not require user interaction to restart the device. + +> [!NOTE] +> Deadlines are enforced from pending restart state (for example, when the device has completed the installation and download from Windows Update). + +#### Policy overview + +|Policy|Description | +|-|-| +|Specify deadline before auto-restart for update installation|Governs the update experience once the device has entered pending restart state. It specifies a deadline, in days, to enforce compliance (such as imminent installation).| +|Configure Auto-restart warning notification schedule for updates|Configures the reminder notification and the warning notification for a scheduled installation. The user can dismiss a reminder, but not the warning.| + +#### Suggested configuration + +|Policy|Location|3-day compliance|5-day compliance|7-day compliance| +|-|-|-|-|-| +|Specify deadline before auto-restart for update installation| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadline before auto-restart for update installation |State: Enabled
              **Specify the number of days before pending restart will automatically be executed outside of active hours:** 2| State: Enabled
              **Specify the number of days before pending restart will automatically be executed outside of active hours:** 3 | State: Enabled
              **Specify the number of days before pending restart will automatically be executed outside of active hours:** 4| + +#### Controlling notification experience for deadline + +|Policy| Location|Suggested Configuration | +|-|-|-| +|Configure Auto-restart warning notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure auto-restart warning notifications schedule for updates |State: Enabled
              **Reminder** (hours): 2
              **Warning** (minutes): 60 | + +#### Notification experience for deadline + +Notification users get for a quality update deadline: + +![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) + +Notification users get for a feature update deadline: + +![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) + +### Deadline with user engagement + +This flow provides the end user with prompts to select a time to restart the device before the deadline is reached. If the device is unable to restart at the time specified by the user or the time selected is outside the deadline, the device will restart the next time it is active. + +#### End-user experience + +Before the deadline the device will be in two states: auto-restart period and engaged-restart period. During the auto-restart period the device will silently try to restart outside of active hours. If the device can't find an idle moment to restart, then the device will go into engaged-restart. The end user, at this point, can select a time that they would like the device to try to restart. Both phases happen before the deadline; once that deadline has passed then the device will restart at the next available time. + +#### Policy overview + +|Policy| Description | +|-|-| +|Specify engaged restart transition and notification schedule for updates|Governs how the user will be impacted by the pending restart. Transition days, first starts out in Auto-Restart where the device will find an idle moment to restart the device. After 2 days engaged restart will commence and the user will be able to choose a time| +|Configure Auto-restart required notification for updates|Governs the notifications during the Auto-Restart period. During Active hours, the user will be notified that the device is trying to restart. They will have the option to confirm or dismiss the notification| + +#### Suggested configuration + +|Policy| Location| 3-day compliance| 5-day compliance| 7-day compliance | +|-|-|-|-|-| +|Specify engaged restart transition and notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Engaged restart transition and notification schedule for updates|State: Enabled
              **Transition** (Days): 2
              **Snooze** (Days): 2
              **Deadline** (Days): 3|State: Enabled
              **Transition** (Days): 2
              **Snooze** (Days): 2
              **Deadline** (Days): 4|State: Enabled
              **Transition** (Days): 2
              **Snooze** (Days): 2
              **Deadline** (Days): 5| + +#### Controlling notification experience for engaged deadline + +|Policy| Location |Suggested Configuration +|-|-|-| +|Configure Auto-restart required notification for updates |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Auto-restart required notification for updates|State: Enabled
              **Method**: 2- User| + +#### Notification experience for engaged deadlines + +Notification users get for quality update engaged deadline: + +![The notification users get for an impending engaged quality update deadline example](images/wufb-quality-engaged-notification.png) + +Notification users get for a quality update deadline: + +![The notification users get for an impending quality update deadline example](images/wufb-quality-notification.png) + +Notification users get for a feature update engaged deadline: + +![The notification users get for an impending feature update engaged deadline example](images/wufb-feature-update-engaged-notification.png) + +Notification users get for a feature update deadline: + +![The notification users get for an impending feature update deadline example](images/wufb-feature-update-deadline-notification.png) + diff --git a/windows/deployment/update/wufb-managedrivers.md b/windows/deployment/update/wufb-managedrivers.md index a43179a6a8..56f956aae8 100644 --- a/windows/deployment/update/wufb-managedrivers.md +++ b/windows/deployment/update/wufb-managedrivers.md @@ -1,68 +1,68 @@ ---- -title: Managing drivers, dual-managed environments, and Delivery Optimization with group policies in Windows Update for Business -description: Learn how to manage drivers, dual managed environments, and bandwidth (Delivery Optimization) with GPOs in Windows Update for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 06/21/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Managing drivers, dual-managed environments, and Delivery Optimization with group policies - ->Applies to: Windows 10 - -Use the following group policy information to manage drivers, to manage environments using both Windows Update for Business and Windows Server Update Services, and to manage the bandwidth required for updates with Delivery Optimization. - -## Managing drivers -Windows Update for Business provides the ability to manage drivers from the Windows Update service. By default, drivers will be offered to your Windows Update-connected devices. Our guidance here is to continue to receive drivers from Windows Update. Alternatively, you can enable the following policy to stop receiving drivers from Windows Update. - -### Policy overview - -|Policy| Description | -|-|-| -|Do not include drivers with Windows Update |When enabled prevents Windows Update from offering drivers.| - -### Suggested configuration - -|Policy| Location|Suggested configuration | -|-|-|-| -|Do not include drivers with Windows Update |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates|State: Disabled | - -## Dual-managed environment - -You can use an on-premises catalog, like WSUS, to deploy 3rd Party patches and use Windows Update to deploy feature and quality updates. We provide capabilities to deploy content from both Windows Update Service and from WSUS. In addition to the policies for managing drivers, apply the following configurations to your environment. - -|Policy| Description | -|-|-| -|Specify Intranet Microsoft Update Service Location| Used for WSUS/System Center Configuration Manager customers who want to install custom packages that are not offered through Windows Update.| - -### Suggested configuration - -|Policy| Location|Suggested configuration | -|-|-|-| -|Specify Intranet Microsoft Update Service Location|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Intranet Microsoft update service location|State: Enabled
              **Set the Intranet Update service for detecting updates**:
              **Set the Intranet statistics server**:
              **Set the alternate download server**: | - -## Download Optimization - Managing your bandwidth - -[Delivery Optimization](waas-delivery-optimization.md) is Windows 10's built-in downloader and peer-caching technology that can benefit CSE for network bandwidth reduction of Windows 10 servicing updates. Windows 10 clients can source content from other devices on their local network that have already downloaded the same updates in addition to downloading these updates from Microsoft. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfil peer-to-peer requests. To configure devices for delivery optimization, ensure the following configurations are set. - -|Policy| Description | -|-|-| -|Download Mode| 2=HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2| -|Minimum Peer Caching Content File Size (in MB)|Specifies the minimum content file size in MB enabled to use peer caching.
              Choose a size that meets your environment's constraints.| -|Allow uploads while the device is on battery while under set battery level (percentage)|Specify a battery level from 1-100, where the device will pause uploads once the battery level drops below that percentage. | -|Max Cache Age (in seconds)|Maximum number of seconds to keep data in cache.| - -### Suggested configuration - -|Policy| Location| Suggested configuration | -|-|-|-| -|Download Mode|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Download Mode|State: Enabled
              **Download Mode**: Group (2)| -|Minimum Peer Caching Content File Size (in MB)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Minimum Peer Caching Content File Size (in MB)|State: Enabled
              **Minimum Peer caching content file size (in MB)**: 10 MB| -|Allow uploads while the device is on battery while under set battery level (percentage)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Allow uploads while the device is on battery while under set battery level (percentage)|State: Enabled
              **Minimum battery level (Percentage)**: 60| -|Max Cache Age (in seconds)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Max Cache Age (in seconds)|State: Enabled
              **Max Cache Age (in seconds)**: 604800 ~ 7 days| +--- +title: Managing drivers, dual-managed environments, and Delivery Optimization with group policies in Windows Update for Business +description: Learn how to manage drivers, dual managed environments, and bandwidth (Delivery Optimization) with GPOs in Windows Update for Business. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.date: 06/21/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# Managing drivers, dual-managed environments, and Delivery Optimization with group policies + +>Applies to: Windows 10 + +Use the following group policy information to manage drivers, to manage environments using both Windows Update for Business and Windows Server Update Services, and to manage the bandwidth required for updates with Delivery Optimization. + +## Managing drivers +Windows Update for Business provides the ability to manage drivers from the Windows Update service. By default, drivers will be offered to your Windows Update-connected devices. Our guidance here is to continue to receive drivers from Windows Update. Alternatively, you can enable the following policy to stop receiving drivers from Windows Update. + +### Policy overview + +|Policy| Description | +|-|-| +|Do not include drivers with Windows Update |When enabled prevents Windows Update from offering drivers.| + +### Suggested configuration + +|Policy| Location|Suggested configuration | +|-|-|-| +|Do not include drivers with Windows Update |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates|State: Disabled | + +## Dual-managed environment + +You can use an on-premises catalog, like WSUS, to deploy 3rd Party patches and use Windows Update to deploy feature and quality updates. We provide capabilities to deploy content from both Windows Update Service and from WSUS. In addition to the policies for managing drivers, apply the following configurations to your environment. + +|Policy| Description | +|-|-| +|Specify Intranet Microsoft Update Service Location| Used for WSUS/Microsoft Endpoint Configuration Manager customers who want to install custom packages that are not offered through Windows Update.| + +### Suggested configuration + +|Policy| Location|Suggested configuration | +|-|-|-| +|Specify Intranet Microsoft Update Service Location|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Intranet Microsoft update service location|State: Enabled
              **Set the Intranet Update service for detecting updates**:
              **Set the Intranet statistics server**:
              **Set the alternate download server**: | + +## Download Optimization - Managing your bandwidth + +[Delivery Optimization](waas-delivery-optimization.md) is Windows 10's built-in downloader and peer-caching technology that can benefit CSE for network bandwidth reduction of Windows 10 servicing updates. Windows 10 clients can source content from other devices on their local network that have already downloaded the same updates in addition to downloading these updates from Microsoft. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfil peer-to-peer requests. To configure devices for delivery optimization, ensure the following configurations are set. + +|Policy| Description | +|-|-| +|Download Mode| 2=HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2| +|Minimum Peer Caching Content File Size (in MB)|Specifies the minimum content file size in MB enabled to use peer caching.
              Choose a size that meets your environment's constraints.| +|Allow uploads while the device is on battery while under set battery level (percentage)|Specify a battery level from 1-100, where the device will pause uploads once the battery level drops below that percentage. | +|Max Cache Age (in seconds)|Maximum number of seconds to keep data in cache.| + +### Suggested configuration + +|Policy| Location| Suggested configuration | +|-|-|-| +|Download Mode|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Download Mode|State: Enabled
              **Download Mode**: Group (2)| +|Minimum Peer Caching Content File Size (in MB)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Minimum Peer Caching Content File Size (in MB)|State: Enabled
              **Minimum Peer caching content file size (in MB)**: 10 MB| +|Allow uploads while the device is on battery while under set battery level (percentage)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Allow uploads while the device is on battery while under set battery level (percentage)|State: Enabled
              **Minimum battery level (Percentage)**: 60| +|Max Cache Age (in seconds)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Max Cache Age (in seconds)|State: Enabled
              **Max Cache Age (in seconds)**: 604800 ~ 7 days| diff --git a/windows/deployment/update/wufb-manageupdate.md b/windows/deployment/update/wufb-manageupdate.md index 6ba3572c05..93a5ab27b7 100644 --- a/windows/deployment/update/wufb-manageupdate.md +++ b/windows/deployment/update/wufb-manageupdate.md @@ -1,59 +1,59 @@ ---- -title: Managing feature and quality updates with policies in Windows Update for Business (Windows 10) -description: Learn how to get started using Windows Update for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 06/20/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Manage feature and quality updates with group policies - ->Applies to: Windows 10 - -Windows Update for Business allows users to control when devices should receive a feature or quality update from Windows Update. Depending on the size of your organization you may want to do a wave deployment of updates. The first step in this process is to determine which Branch Readiness Level you want your organization on. For more information on which level is right for your organization review [Overview of Windows as a service](waas-overview.md). - -The following policies let you configure when you want a device to see a feature and or quality update from Windows Update. - -## Policy overview - -|Policy name| Description | -|-|-| -|Select when Quality Updates are received|Configures when the device should receive quality update. In this policy you can also select a date to pause receiving Quality Updates until. | -|Select when Preview Builds & feature Updates are received|Configures when the device should receive a feature update. You can also configure your branch readiness level. This policy also provides the ability to "pause" updates until a certain point. | -|Do not allow update deferral policies to cause scans against Windows Update|When enabled will not allow the deferral policies to cause scans against Windows Update.| - -## Suggested configuration for a non-wave deployment - -If you don't need a wave deployment and have a small set of devices to manage, we recommend the following configuration: - -|Policy| Location|Suggested configuration | -|-|-|-| -|Select when Quality Updates are received | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled
              **Defer receiving it for this many days**: 0
              **Pause Quality Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a quality update until the time passes| -|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled
              **Select Windows Readiness Level**: SAC
              **Defer receiving for this many days**: 0-365
              **Pause Feature Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a feature update until the time passes| -|Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled| - -## Suggested configuration for a wave deployment -![Graphic showing a deployment divided into rings for a wave deployment](images/wufb-wave-deployment.png) - -## Early validation and testing -Depending on your organizational size and requirements you might be able to test feature updates earlier to identify if there are impacts to Line of Business applications. Our recommendation is to enroll a set of devices that are a good representation of your device ecosystem (for example, devices with accounting software or engineering software). Learn more about [different deployment rings](https://insider.windows.com/how-to-pc/#working-with-rings). - -|Policy|Location|Suggested configuration | -|-|-|-| -|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled
              **Select Windows Readiness Level**: WIP Fast or WIP slow
              **Defer receiving for this many days**: 0
              **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes.| -|Select when Quality Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled
              **Defer receiving it for this many days**: 0
              **Pause Quality Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a quality update until the time passes| - -## Wave deployment for feature updates - -If you want to deploy feature updates in waves we suggest using the following configuration. For the deferral days we recommend staging them out in 1-month increments. Manage your risk by placing critical devices later in the wave (deferrals > 30 or 60 days) while placing your low risk devices earlier in the wave (deferrals < 30 days). Using deferrals days is a great method to manage your wave deployment. Using this in combination with our suggested early validation will help you prepare your environment for the latest updates from Windows. - -|Policy|Location|Suggested configuration | -|-|-|-| -|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled
              **Select Windows Readiness Level**: SAC
              **Defer receiving for this many days**: 0, 30, 60, 90, 120
              **Pause Feature Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a feature update until the time passes +--- +title: Managing feature and quality updates with policies in Windows Update for Business (Windows 10) +description: Learn how to manage feature and quality updates using group policies in Windows Update for Business. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.audience: itpro +ms.date: 06/20/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Manage feature and quality updates with group policies + +>Applies to: Windows 10 + +Windows Update for Business allows users to control when devices should receive a feature or quality update from Windows Update. Depending on the size of your organization you may want to do a wave deployment of updates. The first step in this process is to determine which Branch Readiness Level you want your organization on. For more information on which level is right for your organization review [Overview of Windows as a service](waas-overview.md). + +The following policies let you configure when you want a device to see a feature and or quality update from Windows Update. + +## Policy overview + +|Policy name| Description | +|-|-| +|Select when Quality Updates are received|Configures when the device should receive quality update. In this policy you can also select a date to pause receiving Quality Updates until. | +|Select when Preview Builds & feature Updates are received|Configures when the device should receive a feature update. You can also configure your branch readiness level. This policy also provides the ability to "pause" updates until a certain point. | +|Do not allow update deferral policies to cause scans against Windows Update|When enabled will not allow the deferral policies to cause scans against Windows Update.| + +## Suggested configuration for a non-wave deployment + +If you don't need a wave deployment and have a small set of devices to manage, we recommend the following configuration: + +|Policy| Location|Suggested configuration | +|-|-|-| +|Select when Quality Updates are received | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled
              **Defer receiving it for this many days**: 0
              **Pause Quality Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a quality update until the time passes| +|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled
              **Select Windows Readiness Level**: SAC
              **Defer receiving for this many days**: 0-365
              **Pause Feature Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a feature update until the time passes| +|Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled| + +## Suggested configuration for a wave deployment +![Graphic showing a deployment divided into rings for a wave deployment](images/wufb-wave-deployment.png) + +## Early validation and testing +Depending on your organizational size and requirements you might be able to test feature updates earlier to identify if there are impacts to Line of Business applications. Our recommendation is to enroll a set of devices that are a good representation of your device ecosystem (for example, devices with accounting software or engineering software). Learn more about [different deployment rings](https://insider.windows.com/how-to-pc/#working-with-rings). + +|Policy|Location|Suggested configuration | +|-|-|-| +|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled
              **Select Windows Readiness Level**: WIP Fast or WIP slow
              **Defer receiving for this many days**: 0
              **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes.| +|Select when Quality Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled
              **Defer receiving it for this many days**: 0
              **Pause Quality Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a quality update until the time passes| + +## Wave deployment for feature updates + +If you want to deploy feature updates in waves we suggest using the following configuration. For the deferral days we recommend staging them out in 1-month increments. Manage your risk by placing critical devices later in the wave (deferrals > 30 or 60 days) while placing your low risk devices earlier in the wave (deferrals < 30 days). Using deferrals days is a great method to manage your wave deployment. Using this in combination with our suggested early validation will help you prepare your environment for the latest updates from Windows. + +|Policy|Location|Suggested configuration | +|-|-|-| +|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled
              **Select Windows Readiness Level**: SAC
              **Defer receiving for this many days**: 0, 30, 60, 90, 120
              **Pause Feature Updates**: Blank
              *Note: use this functionality to prevent the device from receiving a feature update until the time passes diff --git a/windows/deployment/update/wufb-onboard.md b/windows/deployment/update/wufb-onboard.md index 98d62be2fa..78f9b0cf84 100644 --- a/windows/deployment/update/wufb-onboard.md +++ b/windows/deployment/update/wufb-onboard.md @@ -1,47 +1,47 @@ ---- -title: Onboarding to Windows Update for Business (Windows 10) -description: Learn how to get started using Windows Update for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Onboarding to Windows Update for Business in Windows 10 - ->Applies to: Windows 10 - -Windows Update for Business is a tool that enables IT pros and power users to manage content they want to receive from Windows Update Service. Windows Update for Business can control the following: - -- Interaction between the client and Windows Update service -- End user notification for pending updates -- Compliance deadlines for feature or quality updates -- Configure wave deployment for feature or quality updates bandwidth optimization - -We also provide additional functionality to manage your environment when risk or issues arise such as applications being blocked: - -- Uninstall latest feature or quality update -- Pause for a duration of time - -Use the following information to set up your environment using Windows Update for Business policies: - -- [Supported SKUs](#supported-editions) -- [Windows Update for Business basics](wufb-basics.md) -- [Setting up automatic update](wufb-autoupdate.md) -- [Managing feature and quality updates](wufb-manageupdate.md) -- [Enforcing compliance deadlines](wufb-compliancedeadlines.md) -- [Managing drivers, environments with both Windows Update for Business and WSUS, and Download Optmization](wufb-managedrivers.md) - -## Supported editions - -Windows Update for Business is supported on the following editions of Windows 10: - -- Windows 10 Education -- Windows 10 Enterprise -- Windows 10 Pro -- Windows 10 S (for Windows 10, version 1709 and earlier) +--- +title: Onboarding to Windows Update for Business (Windows 10) +description: Get started using Windows Update for Business, a tool that enables IT pros and power users to manage content they want to receive from Windows Update. +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Onboarding to Windows Update for Business in Windows 10 + +>Applies to: Windows 10 + +Windows Update for Business is a tool that enables IT pros and power users to manage content they want to receive from Windows Update Service. Windows Update for Business can control the following: + +- Interaction between the client and Windows Update service +- End user notification for pending updates +- Compliance deadlines for feature or quality updates +- Configure wave deployment for feature or quality updates bandwidth optimization + +We also provide additional functionality to manage your environment when risk or issues arise such as applications being blocked: + +- Uninstall latest feature or quality update +- Pause for a duration of time + +Use the following information to set up your environment using Windows Update for Business policies: + +- [Supported SKUs](#supported-editions) +- [Windows Update for Business basics](wufb-basics.md) +- [Setting up automatic update](wufb-autoupdate.md) +- [Managing feature and quality updates](wufb-manageupdate.md) +- [Enforcing compliance deadlines](wufb-compliancedeadlines.md) +- [Managing drivers, environments with both Windows Update for Business and WSUS, and Download Optmization](wufb-managedrivers.md) + +## Supported editions + +Windows Update for Business is supported on the following editions of Windows 10: + +- Windows 10 Education +- Windows 10 Enterprise +- Windows 10 Pro +- Windows 10 S (for Windows 10, version 1709 and earlier) diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index 0216aec2c1..1968dd1929 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -1,15 +1,17 @@ --- -title: Log files - Windows IT Pro +title: Log files and resolving upgrade errors ms.reviewer: manager: laurawi ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +description: Learn how to interpret and analyze the log files that are generated during the Windows 10 upgrade process. keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.custom: seo-marvel-apr2020 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -26,14 +28,15 @@ ms.topic: article Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code. -Note: Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files. +>[!NOTE] +>Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files. The following table describes some log files and how to use them for troubleshooting purposes:

              - + @@ -50,7 +53,7 @@ setupapi.dev.log
              Event logs (*.evtx)
              Log filePhase: LocationDescriptionWhen to use
              Log filePhase: LocationDescriptionWhen to use
              setupact.logDown-Level:
              $Windows.~BT\Sources\Panther
              Contains information about setup actions during the downlevel phase. All down-level failures and starting point for rollback investigations.
              This is the most important log for diagnosing setup issues.
              OOBE:
              $Windows.~BT\Sources\Panther\UnattendGC
              $Windows.~BT\Sources\RollbackAdditional logs collected during rollback. -Setupmem.dmp: If OS bugchecks during upgrade, setup will attempt to extract a mini-dump.
              +Setupmem.dmp: If OS bug checks during upgrade, setup will attempt to extract a mini-dump.
              Setupapi: Device install issues - 0x30018
              Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.
              @@ -78,7 +81,7 @@ See the following example: ## Analyze log files ->The following instructions are meant for IT professionals. Also see the [Upgrade error codes](upgrade-error-codes.md) section in this guide to familiarize yourself with [result codes](upgrade-error-codes.md#result-codes) and [extend codes](upgrade-error-codes.md#extend-codes). +The following instructions are meant for IT professionals. Also see the [Upgrade error codes](upgrade-error-codes.md) section in this guide to familiarize yourself with [result codes](upgrade-error-codes.md#result-codes) and [extend codes](upgrade-error-codes.md#extend-codes).
              To analyze Windows Setup log files: @@ -109,7 +112,7 @@ See the following example: For example, assume that the error code for an error is 0x8007042B - 0x2000D. Searching for "8007042B" reveals the following content from the setuperr.log file: ->Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN." +Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN."
              setuperr.log content: @@ -159,6 +162,93 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f 27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
            • +
              setupapi.dev.log content: + +
              +>>>  [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
              +>>>  Section start 2019/09/26 20:13:01.623
              +      cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
              +     ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
              +     ndv: Install flags: 0x00000000
              +     ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
              +     ndv:      Search options: 0x00000081
              +     ndv:      Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
              +     dvi:      {Build Driver List} 20:13:01.643
              +     dvi:           Searching for hardware ID(s):
              +     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
              +     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
              +     dvi:                pci\ven_8086&dev_8c4f&cc_060100
              +     dvi:                pci\ven_8086&dev_8c4f&cc_0601
              +     dvi:           Searching for compatible ID(s):
              +     dvi:                pci\ven_8086&dev_8c4f&rev_04
              +     dvi:                pci\ven_8086&dev_8c4f
              +     dvi:                pci\ven_8086&cc_060100
              +     dvi:                pci\ven_8086&cc_0601
              +     dvi:                pci\ven_8086
              +     dvi:                pci\cc_060100
              +     dvi:                pci\cc_0601
              +     sig:           {_VERIFY_FILE_SIGNATURE} 20:13:01.667
              +     sig:                Key      = lynxpointsystem.inf
              +     sig:                FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
              +     sig:                Catalog  = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
              +     sig:                Success: File is signed in catalog.
              +     sig:           {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
              +     dvi:           Created Driver Node:
              +     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
              +     dvi:                InfName      - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
              +     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
              +     dvi:                Section      - Needs_ISAPNP_DRV
              +     dvi:                Rank         - 0x00ff2001
              +     dvi:                Signer Score - WHQL
              +     dvi:                DrvDate      - 04/04/2016
              +     dvi:                Version      - 10.1.1.18
              +     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.699
              +     ndv:      Searching currently installed INF
              +     dvi:      {Build Driver List} 20:13:01.699
              +     dvi:           Searching for hardware ID(s):
              +     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
              +     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
              +     dvi:                pci\ven_8086&dev_8c4f&cc_060100
              +     dvi:                pci\ven_8086&dev_8c4f&cc_0601
              +     dvi:           Searching for compatible ID(s):
              +     dvi:                pci\ven_8086&dev_8c4f&rev_04
              +     dvi:                pci\ven_8086&dev_8c4f
              +     dvi:                pci\ven_8086&cc_060100
              +     dvi:                pci\ven_8086&cc_0601
              +     dvi:                pci\ven_8086
              +     dvi:                pci\cc_060100
              +     dvi:                pci\cc_0601
              +     dvi:           Created Driver Node:
              +     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
              +     dvi:                InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
              +     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
              +     dvi:                Section      - Needs_ISAPNP_DRV
              +     dvi:                Rank         - 0x00ff2001
              +     dvi:                Signer Score - WHQL
              +     dvi:                DrvDate      - 10/03/2016
              +     dvi:                Version      - 10.1.1.38
              +     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.731
              +     dvi:      {DIF_SELECTBESTCOMPATDRV} 20:13:01.731
              +     dvi:           Default installer: Enter 20:13:01.735
              +     dvi:                {Select Best Driver}
              +     dvi:                     Class GUID of device changed to: {4d36e97d-e325-11ce-bfc1-08002be10318}.
              +     dvi:                     Selected Driver:
              +     dvi:                          Description - Intel(R) QM87 LPC Controller - 8C4F
              +     dvi:                          InfFile     - c:\windows\system32\driverstore\filerepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
              +     dvi:                          Section     - Needs_ISAPNP_DRV
              +     dvi:                {Select Best Driver - exit(0x00000000)}
              +     dvi:           Default installer: Exit
              +     dvi:      {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 20:13:01.743
              +     ndv:      Currently Installed Driver:
              +     ndv:           Inf Name       - oem1.inf
              +     ndv:           Driver Date    - 10/03/2016
              +     ndv:           Driver Version - 10.1.1.38
              +     ndv: {Update Device Driver - exit(00000103)}
              +!    ndv: No better matching drivers found for device 'PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8'.
              +!    ndv: No devices were updated.
              +<<<  Section end 2019/09/26 20:13:01.759
              +<<<  [Exit status: FAILURE(0xC1900101)]
              +

              This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. @@ -166,6 +256,6 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
              [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md b/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md deleted file mode 100644 index 078074ba23..0000000000 --- a/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Manage Windows upgrades with Upgrade Readiness (Windows 10) -description: Provides an overview of the process of managing Windows upgrades with Upgrade Readiness. -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.topic: article ---- - -# Manage Windows upgrades with Upgrade Readiness - -Upgrading to new operating systems has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points. - -With the release of Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. Windows Upgrade Readiness not only supports upgrade management from Windows 7, Windows 8.1 to Windows 10, but also Windows 10 upgrades in the [Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview) model. - -Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10. - -With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. - -Use Upgrade Readiness to get: - -- A visual workflow that guides you from pilot to production -- Detailed computer and application inventory -- Powerful computer level search and drill-downs -- Guidance and insights into application and driver compatibility issues, with suggested fixes -- Data driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools, including System Center Configuration Manager - -The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. - -**Important** For system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see: - -- [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization) -- [Manage connections from Windows operating system components to Microsoft services](/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services) -- [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) - -## **Related topics** - -[Upgrade Readiness architecture](upgrade-readiness-architecture.md)
              -[Upgrade Readiness requirements](upgrade-readiness-requirements.md)
              -[Upgrade Readiness release notes](upgrade-readiness-requirements.md#important-information-about-this-release)
              -[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
              -[Use Upgrade Readiness to manage Windows upgrades](use-upgrade-readiness-to-manage-windows-upgrades.md) diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index 305917b360..bf49c56323 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -1,239 +1,314 @@ ---- -title: Quick fixes - Windows IT Pro -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Quick fixes - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 100 level topic (basic).
              ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - -The following list of fixes can resolve many Windows upgrade problems. You should try these steps before contacting Microsoft support, or attempting a more advanced analysis of a Windows upgrade failure. Also review information at [Windows 10 help](https://support.microsoft.com/products/windows?os=windows-10). - -The Microsoft Virtual Agent provided by [Microsoft Support](https://support.microsoft.com/contactus/) can help you to analyze and correct some Windows upgrade errors. **To talk to a person about your issue**, start the Virtual Agent (click **Get started**) and enter "Talk to a person" two times. - ->You might also wish to try a new tool available from Microsoft that helps to diagnose many Windows upgrade errors. For more information and to download this tool, see [SetupDiag](setupdiag.md). The topic is more advanced (300 level) because several advanced options are available for using the tool. However, you can now just download and then double-click the tool to run it. By default when you click Save, the tool is saved in your **Downloads** folder. Double-click the tool in the folder and wait until it finishes running (it might take a few minutes), then double-click the **SetupDiagResults.log** file and open it using Notepad to see the results of the analysis. - -## List of fixes - -
                -
              1. Remove nonessential external hardware, such as docks and USB devices. More information.
              2. -
              3. Check the system drive for errors and attempt repairs. More information.
              4. -
              5. Run the Windows Update troubleshooter. More information.
              6. -
              7. Attempt to restore and repair system files. More information.
              8. -
              9. Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. More information.
              10. -
              11. Temporarily uninstall non-Microsoft antivirus software. - More information.
              12. - -
              13. Uninstall all nonessential software. More information.
              14. -
              15. Update firmware and drivers. More information
              16. -
              17. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. More information.
              18. -
              19. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. More information.
              20. -
              - -## Step by step instructions - -### Remove external hardware - -If the computer is portable and it is currently in a docking station, [undock the computer](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754084(v=ws.11)). - -Unplug nonessential external hardware devices from the computer, such as: -- Headphones -- Joysticks -- Printers -- Plotters -- Projectors -- Scanners -- Speakers -- USB flash drives -- Portable hard drives -- Portable CD/DVD/Blu-ray drives -- Microphones -- Media card readers -- Cameras/Webcams -- Smart phones -- Secondary monitors, keyboards, mice - -For more information about disconnecting external devices, see [Safely remove hardware in Windows 10](https://support.microsoft.com/help/4051300/windows-10-safely-remove-hardware) - -### Repair the system drive - -The system drive is the drive that contains the [system partition](https://docs.microsoft.com/windows-hardware/manufacture/desktop/hard-drives-and-partitions#span-idpartitionsspanspan-idpartitionsspanspan-idpartitionsspanpartitions). This is usually the **C:** drive. - -To check and repair errors on the system drive: - -1. Click **Start**. -2. Type **command**. -3. Right-click **Command Prompt** and then left-click **Run as administrator**. -4. If you are prompted by UAC, click **Yes**. -5. Type **chkdsk /F** and press ENTER. -6. When you are prompted to schedule a check the next time the system restarts, type **Y**. -7. See the following example - - ``` - C:\WINDOWS\system32>chkdsk /F - The type of the file system is NTFS. - Cannot lock current drive. - - Chkdsk cannot run because the volume is in use by another - process. Would you like to schedule this volume to be - checked the next time the system restarts? (Y/N) Y - - This volume will be checked the next time the system restarts. - ``` - -8. Restart the computer. The computer will pause before loading Windows and perform a repair of your hard drive. - -### Windows Update Troubleshooter - -The Windows Update troubleshooter tool will automatically analyze and fix problems with Windows Update, such as a corrupted download. It will also tell you if there is a pending reboot that is preventing Windows from updating. - -For Windows 7 and 8.1, the tool is [here](https://aka.ms/diag_wu). - -For Windows 10, the tool is [here](https://aka.ms/wudiag). - -To run the tool, click the appropriate link above. Your web browser will prompt you to save or open the file. Select **open** and the tool will automatically start. The tool will walk you through analyzing and fixing some common problems. - -You can also download the Windows Update Troubleshooter by starting the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/), typing **update Windows**, selecting the version of Windows you are running, and then answering **Yes** when asked "Do you need help troubleshooting Windows Update?" - -If any errors are displayed in the Windows Update Troubleshooter, use the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) to ask about these errors. The Virtual Agent will perform a search and provide a list of helpful links. - -### Repair system files - -This fix is also described in detail at [answers.microsoft.com](https://answers.microsoft.com/en-us/windows/forum/windows_10-update/system-file-check-sfc-scan-and-repair-system-files/bc609315-da1f-4775-812c-695b60477a93). - -To check and repair system files: - -1. Click **Start**. -2. Type **command**. -3. Right-click **Command Prompt** and then left-click **Run as administrator**. -4. If you are prompted by UAC, click **Yes**. -5. Type **sfc /scannow** and press ENTER. See the following example: - - ``` - C:\>sfc /scannow - - Beginning system scan. This process will take some time. - - Beginning verification phase of system scan. - Verification 100% complete. - - Windows Resource Protection did not find any integrity violations. - ``` -6. If you are running Windows 8.1 or later, type **DISM.exe /Online /Cleanup-image /Restorehealth** and press ENTER (the DISM command options are not available for Windows 7). See the following example: - - ``` - C:\>DISM.exe /Online /Cleanup-image /Restorehealth - - Deployment Image Servicing and Management tool - Version: 10.0.16299.15 - - Image Version: 10.0.16299.309 - - [==========================100.0%==========================] The restore operation completed successfully. - The operation completed successfully. - - ``` - >It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image). - - -### Update Windows - -You should ensure that all important updates are installed before attempting to upgrade. This includes updates to hardware drivers on your computer. - -The Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) can walk you through the process of making sure that Windows is updated. - -Start the [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) and then type "update windows." - -Answer questions that the agent asks, and follow instructions to ensure that Windows is up to date. You can also run the [Windows Update Troubleshooter](#windows-update-troubleshooter) described above. - -Click **Start**, click power options, and then restart the computer. - -### Uninstall non-Microsoft antivirus software - -Use Windows Defender for protection during the upgrade. - -Verify compatibility information, and if desired re-install antivirus applications after the upgrade. If you plan to re-install the application after upgrading, be sure that you have the installation media and all required activation information before removing the program. - -To remove the application, go to **Control Panel\Programs\Programs and Features** and click the antivirus application, then click Uninstall. Choose **Yes** when you are asked to confirm program removal. - -For more information, see [Windows 7 - How to properly uninstall programs](https://support.microsoft.com/help/2601726) or [Repair or remove programs in Windows 10](https://support.microsoft.com/help/4028054/windows-repair-or-remove-programs-in-windows-10). - -### Uninstall non-essential software - -Outdated applications can cause problems with a Windows upgrade. Removing old or non-essential applications from the computer can therefore help. - -If you plan to reinstall the application later, be sure that you have the installation media and all required activation information before removing it. - -To remove programs, use the same steps as are provided [above](#uninstall-non-microsoft-antivirus-software) for uninstalling non-Microsoft antivirus software, but instead of removing the antivirus application repeat the steps for all your non-essential, unused, or out-of-date software. - -### Update firmware and drivers - -Updating firmware (such as the BIOS) and installing hardware drivers is a somewhat advanced task. Do not attempt to update BIOS if you aren't familiar with BIOS settings or are not sure how to restore the previous BIOS version if there are problems. Most BIOS updates are provided as a "flash" update. Your manufacturer might provide a tool to perform the update, or you might be required to enter the BIOS and update it manually. Be sure to save your working BIOS settings, since some updates can reset your configuration and make the computer fail to boot if (for example) a RAID configuration is changed. - -Most BIOS and other hardware updates can be obtained from a website maintained by your computer manufacturer. For example, Microsoft Surface device drivers can be obtained at: [Download the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -To obtain the proper firmware drivers, search for the most updated driver version provided by your computer manufacturer. Install these updates and reboot the computer after installation. Request assistance from the manufacturer if you have any questions. - -### Ensure that "Download and install updates" is selected - -When you begin a Windows Update, the setup process will ask you to **Get important updates**. Answer **Yes** if the computer you are updating is connected to the Internet. See the following example: - -![Get important updates](../images/update.jpg) - -### Verify disk space - -You can see a list of requirements for Windows 10 at [Windows 10 Specifications & System Requirements](https://www.microsoft.com/windows/windows-10-specifications). One of the requirements is that enough hard drive space be available for the installation to take place. At least 16 GB of free space must be available on the system drive to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. - -To view how much hard drive space is available on your computer, open [File Explorer](https://support.microsoft.com/help/4026617/windows-windows-explorer-has-a-new-name). In Windows 7, this was called Windows Explorer. - -In File Explorer, click on **Computer** or **This PC** on the left, then look under **Hard Disk Drives** or under **Devices and drives**. If there are multiple drives listed, the system drive is the drive that includes a Microsoft Windows logo above the drive icon. - -The amount of space available on the system drive will be displayed under the drive. See the following example: - -![System drive](../images/drive.png) - -In the previous example, there is 703 GB of available free space on the system drive (C:). - -To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example: - -![Disk cleanup](../images/cleanup.png) - -For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space). - -When you run Disk Cleanup and enable the option to Clean up system files, you can remove previous Windows installations which can free a large amount of space. You should only do this if you do not plan to restore the old OS version. - -### Open an elevated command prompt - ->It is no longer necessary to open an elevated command prompt to run the [SetupDiag](setupdiag.md) tool. However, this is still the optimal way to run the tool. - -To launch an elevated command prompt, press the Windows key on your keyboard, type **cmd**, press Ctrl+Shift+Enter, and then Alt+C to confirm the elevation prompt. Screenshots and other steps to open an administrator (aka elevated) command prompt are [here](https://answers.microsoft.com/en-us/windows/forum/windows_7-security/command-prompt-admin-windows-7/6a188166-5e23-461f-b468-f325688ec8c7). - -Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings-winpc/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23). - -If this is too complicated for you, then use File Explorer to create a new folder under C: with a short name such as "new" then copy or move the programs you want to run (like SetupDiag) to this folder using File Explorer. When you open an elevated command prompt, change to this directory by typing "cd c:\new" and now you can run the programs in that folder. - -If you downloaded the SetupDiag.exe program to your computer, then copied it to the folder C:\new, and you opened an elevated command prompt then typed cd c:\new to change to this directory, you can just type setupdiag and press ENTER to run the program. This program will analyze the files on your computer to see why a Windows Upgrade failed and if the reason was a common one, it will report this reason. It will not fix the problem for you but knowing why the upgrade failed enables you to take steps to fix the problem. - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Quick fixes - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Learn how to quickly resolve many problems, which may come up during a Windows 10 upgrade. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.custom: seo-marvel-apr2020 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Quick fixes + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 100 level topic (basic).
              +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + +The following list of fixes can resolve many Windows upgrade problems. You should try these steps before contacting Microsoft support, or attempting a more advanced analysis of a Windows upgrade failure. Also review information at [Windows 10 help](https://support.microsoft.com/products/windows?os=windows-10). + +The Microsoft Virtual Agent provided by [Microsoft Support](https://support.microsoft.com/contactus/) can help you to analyze and correct some Windows upgrade errors. **To talk to a person about your issue**, start the Virtual Agent (click **Get started**) and enter "Talk to a person" two times. + +> [!TIP] +> You might also wish to try a new tool available from Microsoft that helps to diagnose many Windows upgrade errors. For more information and to download this tool, see [SetupDiag](setupdiag.md). The topic is more advanced (300 level) because several advanced options are available for using the tool. However, you can now just download and then double-click the tool to run it. By default when you click Save, the tool is saved in your **Downloads** folder. Double-click the tool in the folder and wait until it finishes running (it might take a few minutes), then double-click the **SetupDiagResults.log** file and open it using Notepad to see the results of the analysis. + +## List of fixes + +
                +
              1. Remove nonessential external hardware, such as docks and USB devices. More information.
              2. +
              3. Check the system drive for errors and attempt repairs. More information.
              4. +
              5. Run the Windows Update troubleshooter. More information.
              6. +
              7. Attempt to restore and repair system files. More information.
              8. +
              9. Check for unsigned drivers and update or repair them. More information.
              10. +
              11. Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. More information.
              12. +
              13. Temporarily uninstall non-Microsoft antivirus software. + More information.
              14. + +
              15. Uninstall all nonessential software. More information.
              16. +
              17. Update firmware and drivers. More information
              18. +
              19. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. More information.
              20. +
              21. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. More information.
              22. +
              + +## Step by step instructions + +### Remove external hardware + +If the computer is portable and it is currently in a docking station, [undock the computer](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754084(v=ws.11)). + +Unplug nonessential external hardware devices from the computer, such as: +- Headphones +- Joysticks +- Printers +- Plotters +- Projectors +- Scanners +- Speakers +- USB flash drives +- Portable hard drives +- Portable CD/DVD/Blu-ray drives +- Microphones +- Media card readers +- Cameras/Webcams +- Smart phones +- Secondary monitors, keyboards, mice + +For more information about disconnecting external devices, see [Safely remove hardware in Windows 10](https://support.microsoft.com/help/4051300/windows-10-safely-remove-hardware) + +### Repair the system drive + +The system drive is the drive that contains the [system partition](https://docs.microsoft.com/windows-hardware/manufacture/desktop/hard-drives-and-partitions#span-idpartitionsspanspan-idpartitionsspanspan-idpartitionsspanpartitions). This is usually the **C:** drive. + +To check and repair errors on the system drive: + +1. Click **Start**. +2. Type **command**. +3. Right-click **Command Prompt** and then left-click **Run as administrator**. +4. If you are prompted by UAC, click **Yes**. +5. Type **chkdsk /F** and press ENTER. +6. When you are prompted to schedule a check the next time the system restarts, type **Y**. +7. See the following example + + ``` + C:\WINDOWS\system32>chkdsk /F + The type of the file system is NTFS. + Cannot lock current drive. + + Chkdsk cannot run because the volume is in use by another + process. Would you like to schedule this volume to be + checked the next time the system restarts? (Y/N) Y + + This volume will be checked the next time the system restarts. + ``` + +8. Restart the computer. The computer will pause before loading Windows and perform a repair of your hard drive. + +### Windows Update Troubleshooter + +The Windows Update troubleshooter tool will automatically analyze and fix problems with Windows Update, such as a corrupted download. It will also tell you if there is a pending reboot that is preventing Windows from updating. + +For Windows 7 and 8.1, the tool is [here](https://aka.ms/diag_wu). + +For Windows 10, the tool is [here](https://aka.ms/wudiag). + +To run the tool, click the appropriate link above. Your web browser will prompt you to save or open the file. Select **open** and the tool will automatically start. The tool will walk you through analyzing and fixing some common problems. + +You can also download the Windows Update Troubleshooter by starting the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/), typing **update Windows**, selecting the version of Windows you are running, and then answering **Yes** when asked "Do you need help troubleshooting Windows Update?" + +If any errors are displayed in the Windows Update Troubleshooter, use the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) to ask about these errors. The Virtual Agent will perform a search and provide a list of helpful links. + +### Repair system files + +This fix is also described in detail at [answers.microsoft.com](https://answers.microsoft.com/en-us/windows/forum/windows_10-update/system-file-check-sfc-scan-and-repair-system-files/bc609315-da1f-4775-812c-695b60477a93). + +To check and repair system files: + +1. Click **Start**. +2. Type **command**. +3. Right-click **Command Prompt** and then left-click **Run as administrator**. +4. If you are prompted by UAC, click **Yes**. +5. Type **sfc /scannow** and press ENTER. See the following example: + + ``` + C:\>sfc /scannow + + Beginning system scan. This process will take some time. + + Beginning verification phase of system scan. + Verification 100% complete. + + Windows Resource Protection did not find any integrity violations. + ``` +6. If you are running Windows 8.1 or later, type **DISM.exe /Online /Cleanup-image /Restorehealth** and press ENTER (the DISM command options are not available for Windows 7). See the following example: + + ``` + C:\>DISM.exe /Online /Cleanup-image /Restorehealth + + Deployment Image Servicing and Management tool + Version: 10.0.16299.15 + + Image Version: 10.0.16299.309 + + [==========================100.0%==========================] The restore operation completed successfully. + The operation completed successfully. + + ``` + > [!NOTE] + > It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image) and [Use the System File Checker tool](https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system). + + +### Repair unsigned drivers + +[Drivers](https://docs.microsoft.com/windows-hardware/drivers/gettingstarted/what-is-a-driver-) are files ending in *.dll or *.sys that are used to communicate with hardware components. Because drivers are so important, they are cryptographically signed to ensure they are genuine. Drivers with a *.sys extension that are not properly signed frequently block the upgrade process. Drivers might not be properly signed if you: +- Disabled driver signature verification (highly not recommended). +- A catalog file used to sign a driver is corrupt or missing. + + Catalog files (files with a *.cat extension) are used to sign drivers. If a catalog file is corrupt or missing, the driver will appear to be unsigned, even though it should be signed. To restore the catalog file, reinstall the driver or copy the catalog file from another device. You might need to analyze another device to determine the catalog file that is associated with the unsigned driver. All drivers should be signed to ensure the upgrade process works. + +To check your system for unsigned drivers: + +1. Click **Start**. +2. Type **command**. +3. Right-click **Command Prompt** and then left-click **Run as administrator**. +4. If you are prompted by UAC, click **Yes**. +5. Type **sigverif** and press ENTER. +6. The File Signature Verification tool will open. Click **Start**. + + ![File Signature Verification](../images/sigverif.png) + +7. After the scanning process is complete, if you see **Your files have been scanned and verified as digitally signed** then you have no unsigned drivers. Otherwise, you will see **The following files have not been digitally signed** and a list will be provided with name, location, and version of all unsigned drivers. +8. To view and save a log file, click **Advanced**, and then click **View Log**. Save the log file if desired. +9. Locate drivers in the log file that are unsigned, write down the location and file names. Also write down the catalog that is associated to the driver if it is provided. If the name of a catalog file is not provided you might need to analyze another device that has the same driver with sigverif and sigcheck (described below). +10. The next step is to check that the driver reported as unsigned by sigverif.exe has a problem. In some cases, sigverif.exe might not be successful at locating the catalog file used to sign a driver, even though the catalog file exists. To perform a detailed driver check, download [sigcheck.zip](https://download.sysinternals.com/files/Sigcheck.zip) and extract the tool to a directory on your computer, for example: **C:\sigcheck**. + + [Sigcheck](https://docs.microsoft.com/sysinternals/downloads/sigcheck) is a tool that you can download and use to review digital signature details of a file. To use sigcheck: + +11. In the command window, use the **cd** command to switch to the directory where you extracted sigcheck, for example **cd c:\sigcheck**. +12. Using the list of unsigned drivers and their associated paths that you obtained from the File Signature Verification tool, run sigcheck to obtain details about the driver, including the catalog file used for signing. Type **sigcheck64 -i \** and press ENTER (or sigcheck -i for a 32 bit OS). See the following example: + ``` + C:\Sigcheck>sigcheck64.exe -i c:\windows\system32\drivers\afd.sys + + Sigcheck v2.80 - File version and signature viewer + Copyright (C) 2004-2020 Mark Russinovich + Sysinternals - www.sysinternals.com + + c:\windows\system32\drivers\afd.sys: + Verified: Signed + Signing date: 6:18 PM 11/29/2017 + Signing date: 6:18 PM 11/29/2017 + Catalog: C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_163_for_KB4054518~31bf3856ad364e35~x86~~6.1.1.2.cat + Signers: + Microsoft Windows + Cert Status: This certificate or one of the certificates in the certificate chain is not time valid. + Valid Usage: NT5 Crypto, Code Signing + Cert Issuer: Microsoft Windows Verification PCA + Serial Number: 33 00 00 00 4B 76 63 2D 24 A2 39 9A 8B 00 01 00 00 00 4B + Thumbprint: B8037C46D0DB7A8CEE502407469B0EE3234D3365 + Algorithm: sha1RSA + Valid from: 11:46 AM 3/1/2017 + Valid to: 11:46 AM 5/9/2018 + (output truncated) + ``` + In the example above, the afd.sys driver is properly signed by the catalog file Package_163_for_KB4054518~31bf3856ad364e35~x86~~6.1.1.2.cat. + + +13. Optionally, you can generate a list of drivers using driverquery.exe, which is included with Windows. To save a list of signed and unsigned drivers with driverquery, type **driverquery /si > c:\drivers.txt** and press ENTER. See the following example: + + ```cmd + C:\>Driverquery /si + + DeviceName InfName IsSigned Manufacturer + ============================== ============= ======== ========================= + Microsoft ISATAP Adapter nettun.inf TRUE Microsoft + Generic volume shadow copy volsnap.inf TRUE Microsoft + Generic volume volume.inf TRUE Microsoft + (truncated) + ``` + For more information about using driverquery, see [Two Minute Drill: DriverQuery.exe](https://techcommunity.microsoft.com/t5/ask-the-performance-team/two-minute-drill-driverquery-exe/ba-p/374977) and [driverquery](https://docs.microsoft.com/windows-server/administration/windows-commands/driverquery). + +### Update Windows + +You should ensure that all important updates are installed before attempting to upgrade. This includes updates to hardware drivers on your computer. + +The Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) can walk you through the process of making sure that Windows is updated. + +Start the [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) and then type "update windows." + +Answer questions that the agent asks, and follow instructions to ensure that Windows is up to date. You can also run the [Windows Update Troubleshooter](#windows-update-troubleshooter) described above. + +Click **Start**, click power options, and then restart the computer. + +### Uninstall non-Microsoft antivirus software + +Use Windows Defender for protection during the upgrade. + +Verify compatibility information, and if desired re-install antivirus applications after the upgrade. If you plan to re-install the application after upgrading, be sure that you have the installation media and all required activation information before removing the program. + +To remove the application, go to **Control Panel\Programs\Programs and Features** and click the antivirus application, then click Uninstall. Choose **Yes** when you are asked to confirm program removal. + +For more information, see [Windows 7 - How to properly uninstall programs](https://support.microsoft.com/help/2601726) or [Repair or remove programs in Windows 10](https://support.microsoft.com/help/4028054/windows-repair-or-remove-programs-in-windows-10). + +### Uninstall non-essential software + +Outdated applications can cause problems with a Windows upgrade. Removing old or non-essential applications from the computer can therefore help. + +If you plan to reinstall the application later, be sure that you have the installation media and all required activation information before removing it. + +To remove programs, use the same steps as are provided [above](#uninstall-non-microsoft-antivirus-software) for uninstalling non-Microsoft antivirus software, but instead of removing the antivirus application repeat the steps for all your non-essential, unused, or out-of-date software. + +### Update firmware and drivers + +Updating firmware (such as the BIOS) and installing hardware drivers is a somewhat advanced task. Do not attempt to update BIOS if you aren't familiar with BIOS settings or are not sure how to restore the previous BIOS version if there are problems. Most BIOS updates are provided as a "flash" update. Your manufacturer might provide a tool to perform the update, or you might be required to enter the BIOS and update it manually. Be sure to save your working BIOS settings, since some updates can reset your configuration and make the computer fail to boot if (for example) a RAID configuration is changed. + +Most BIOS and other hardware updates can be obtained from a website maintained by your computer manufacturer. For example, Microsoft Surface device drivers can be obtained at: [Download the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). + +To obtain the proper firmware drivers, search for the most updated driver version provided by your computer manufacturer. Install these updates and reboot the computer after installation. Request assistance from the manufacturer if you have any questions. + +### Ensure that "Download and install updates" is selected + +When you begin a Windows Update, the setup process will ask you to **Get important updates**. Answer **Yes** if the computer you are updating is connected to the Internet. See the following example: + +![Get important updates](../images/update.jpg) + +### Verify disk space + +You can see a list of requirements for Windows 10 at [Windows 10 Specifications & System Requirements](https://www.microsoft.com/windows/windows-10-specifications). One of the requirements is that enough hard drive space be available for the installation to take place. At least 16 GB of free space must be available on the system drive to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. + +To view how much hard drive space is available on your computer, open [File Explorer](https://support.microsoft.com/help/4026617/windows-windows-explorer-has-a-new-name). In Windows 7, this was called Windows Explorer. + +In File Explorer, click on **Computer** or **This PC** on the left, then look under **Hard Disk Drives** or under **Devices and drives**. If there are multiple drives listed, the system drive is the drive that includes a Microsoft Windows logo above the drive icon. + +The amount of space available on the system drive will be displayed under the drive. See the following example: + +![System drive](../images/drive.png) + +In the previous example, there is 703 GB of available free space on the system drive (C:). + +To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example: + +![Disk cleanup](../images/cleanup.png) + +For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space). + +When you run Disk Cleanup and enable the option to Clean up system files, you can remove previous Windows installations which can free a large amount of space. You should only do this if you do not plan to restore the old OS version. + +### Open an elevated command prompt + +> [!TIP] +> It is no longer necessary to open an elevated command prompt to run the [SetupDiag](setupdiag.md) tool. However, this is still the optimal way to run the tool. + +To launch an elevated command prompt, press the Windows key on your keyboard, type **cmd**, press Ctrl+Shift+Enter, and then Alt+C to confirm the elevation prompt. Screenshots and other steps to open an administrator (aka elevated) command prompt are [here](https://answers.microsoft.com/en-us/windows/forum/windows_7-security/command-prompt-admin-windows-7/6a188166-5e23-461f-b468-f325688ec8c7). + +Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/windows/forum/windows_10-other_settings-winpc/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23). + +If this is too complicated for you, then use File Explorer to create a new folder under C: with a short name such as "new" then copy or move the programs you want to run (like SetupDiag) to this folder using File Explorer. When you open an elevated command prompt, change to this directory by typing "cd c:\new" and now you can run the programs in that folder. + +If you downloaded the SetupDiag.exe program to your computer, then copied it to the folder C:\new, and you opened an elevated command prompt then typed cd c:\new to change to this directory, you can just type setupdiag and press ENTER to run the program. This program will analyze the files on your computer to see why a Windows Upgrade failed and if the reason was a common one, it will report this reason. It will not fix the problem for you but knowing why the upgrade failed enables you to take steps to fix the problem. + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
              [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 34e22a7ab7..1d75d19367 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -3,13 +3,14 @@ title: Resolution procedures - Windows IT Pro ms.reviewer: manager: laurawi ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +description: Discover general troubleshooting procedures for dealing with 0xC1900101, the generic rollback code thrown when something goes wrong during a Windows 10 upgrade. keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -17,482 +18,63 @@ ms.topic: article # Resolution procedures **Applies to** -- Windows 10 +- Windows 10 ->[!NOTE] ->This is a 200 level topic (moderate).
              ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. +> [!NOTE] +> This is a 200 level topic (moderate). +> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. +This topic provides some common causes and solutions that are associated with specific upgrade error codes. If a Windows 10 upgrade fails, you can write down the error code that is displayed, or find the error code in the Windows [Event Log](windows-error-reporting.md) or in the Windows Setup [log files](log-files.md) (ex: **setuperr.log**) and review the cause and solutions provided here. You should also try running the free [SetupDiag](setupdiag.md) tool provided by Microsoft, which can automatically find the reason for an upgrade failure. ## 0xC1900101 -A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as:
              +A frequently observed [result code](upgrade-error-codes.md#result-codes) is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as: - The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp, - Event logs: $Windows.~bt\Sources\Rollback\*.evtx - The device install log: $Windows.~bt\Sources\Rollback\setupapi\setupapi.dev.log -The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). To resolve a rollback due to driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/kb/929135) before initiating the upgrade process. +The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). -
              See the following general troubleshooting procedures associated with a result code of 0xC1900101: +To resolve a rollback that was caused by driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/kb/929135) before initiating the upgrade process. Also check to be sure that your drivers are properly signed. For more information, see [Remove unsigned drivers](quick-fixes.md#repair-unsigned-drivers). +See the following general troubleshooting procedures associated with a result code of 0xC1900101:

              - - +Result codes that start with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              +| Code | Mitigation | Cause | +| :--- | :--- | :--- | +| 0xC1900101 - 0x20004 | Uninstall antivirus applications.
              Remove all unused SATA devices.
              Remove all unused devices and drivers.
              Update drivers and BIOS. | Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation.
              This is generally caused by out-of-date drivers. | +| 0xC1900101 - 0x2000c | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
              Contact your hardware vendor to obtain updated device drivers.
              Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | Windows Setup encountered an unspecified error during Wim apply in the WinPE phase.
              This is generally caused by out-of-date drivers | +| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated.
              Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers.
              For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](https://support.microsoft.com/en-us/help/927521/windows-vista-windows-7-windows-server-2008-r2-windows-8-1-and-windows).
              Update or uninstall the problem drivers. | A driver has caused an illegal operation.
              Windows was not able to migrate the driver, resulting in a rollback of the operating system.
              This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. | +| 0xC1900101 - 0x30018 | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
              Contact your hardware vendor to obtain updated device drivers.
              Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | A device driver has stopped responding to setup.exe during the upgrade process. | +| 0xC1900101 - 0x3000D | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
              Update or uninstall the display driver. | Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation.
              This can occur due to a problem with a display driver. | +| 0xC1900101 - 0x4000D | Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors.
              Review the rollback log and determine the stop code.
              The rollback log is located in the $Windows.~BT\Sources\Rollback folder. An example analysis is shown below. This example is not representative of all cases:
               
              Info SP Crash 0x0000007E detected
              Info SP Module name :
              Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005
              Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A
              Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728
              Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40
              Info SP Cannot recover the system.
              Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.
               
              Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
               
              1. Make sure you have enough disk space.
              2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
              3. Try changing video adapters.
              4. Check with your hardware vendor for any BIOS updates.
              5. Disable BIOS memory options such as caching or shadowing. | A rollback occurred due to a driver configuration issue.
              Installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
              This can occur because of incompatible drivers. | +| 0xC1900101 - 0x40017 | Clean boot into Windows, and then attempt the upgrade to Windows 10. For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135).
               
              Ensure that you select the option to "Download and install updates (recommended)." Also be sure to [remove unsigned drivers](quick-fixes.md#repair-unsigned-drivers).
               
              Computers that run Citrix VDA
              You may see this message after you upgrade a computer from Windows 10, version 1511 to Windows 10, version 1607. After the second system restart, the system generates this error and then rolls back to the previous version. This problem has also been observed in upgrades to Windows 8.1 and Windows 8.
               
              This problem occurs because the computer has Citrix Virtual Delivery Agent (VDA) installed. Citrix VDA installs device drivers and a file system filter driver (CtxMcsWbc). This Citrix filter driver prevents the upgrade from writing changes to the disk, so the upgrade cannot complete and the system rolls back.
               
              **Resolution**
               
              To resolve this problem, install [Cumulative update for Windows 10 Version 1607 and Windows Server 2016: November 8, 2016](https://support.microsoft.com/help/3200970/cumulative-update-for-windows-10-version-1607-and-windows-server-2016).
               
              You can work around this problem in two ways:
               
              **Workaround 1**
               
              1. Use the VDA setup application (VDAWorkstationSetup_7.11) to uninstall Citrix VDA.
              2. Run the Windows upgrade again.
              3. Reinstall Citrix VDA.
               
              **Workaround 2**
               
              If you cannot uninstall Citrix VDA, follow these steps to work around this problem:
               
              1. In Registry Editor, go to the following subkey:
              **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\CtxMcsWbc**
              2. Change the value of the **Start** entry from **0** to **4**. This change disables the Citrix MCS cache service.
              3. Go to the following subkey:
              **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}**
              4. Delete the **CtxMcsWbc** entry.
              5. Restart the computer, and then try the upgrade again.
               
              **Non-Microsoft information disclaimer**
              The non-Microsoft products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. | Windows 10 upgrade failed after the second reboot.
              This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. | - -
              Code -
              0xC1900101 - 0x20004 -
              +## 0x800xxxxx -
              -
              Cause -
              Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation -
              This is generally caused by out-of-date drivers. -
              -
              - - -
              Mitigation -
              Uninstall antivirus applications. -
              Remove all unused SATA devices. -
              Remove all unused devices and drivers. -
              Update drivers and BIOS. -
              -
              - - -
              Code -
              0xC1900101 - 0x2000c -
              - -
              -
              Cause -
              Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. -
              This is generally caused by out-of-date drivers. -
              -
              - - -
              Mitigation -
              Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
              Contact your hardware vendor to obtain updated device drivers. -
              Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. -
              -
              - - -
              Code -
              0xC1900101 - 0x20017 - -
              - -
              -
              Cause -
              A driver has caused an illegal operation. -
              Windows was not able to migrate the driver, resulting in a rollback of the operating system. -
              This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. -
              -
              - - -
              Mitigation -
              -Ensure that all that drivers are updated.
              -Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. -
              For more information, see Understanding Failures and Log Files. -
              Update or uninstall the problem drivers. -
              -
              - - -
              Code -
              0xC1900101 - 0x30018 -
              - -
              -
              Cause -
              A device driver has stopped responding to setup.exe during the upgrade process. -
              -
              - - -
              Mitigation -
              -Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
              Contact your hardware vendor to obtain updated device drivers. -
              Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. -
              -
              - - -
              Code -
              0xC1900101 - 0x3000D -
              - -
              -
              Cause -
              Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. -
              This can occur due to a problem with a display driver. - -
              -
              - - -
              Mitigation -
              -Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
              Update or uninstall the display driver. -
              -
              - - -
              Code -
              0xC1900101 - 0x4000D -
              - -
              -
              Cause -
              A rollback occurred due to a driver configuration issue. -
              Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. - -
              This can occur due to incompatible drivers. - -
              -
              - - -
              Mitigation -
              -
              Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. -
              Review the rollback log and determine the stop code. -
              The rollback log is located in the C:$Windows.~BT\Sources\Panther folder. An example analysis is shown below. This example is not representative of all cases: -
              Info SP Crash 0x0000007E detected -
              Info SP Module name : -
              Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005 -
              Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A -
              Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728 -
              Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40 -
              Info SP Cannot recover the system. -
              Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows. - - -
              Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
              - -1. Make sure you have enough disk space.
              -2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
              -3. Try changing video adapters.
              -4. Check with your hardware vendor for any BIOS updates.
              -5. Disable BIOS memory options such as caching or shadowing. -

              -
              -
              - - -
              Code -
              0xC1900101 - 0x40017 -
              - -
              -
              Cause -
              Windows 10 upgrade failed after the second reboot. -
              This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. -
              -
              - - -
              Mitigation -
              Clean boot into Windows, and then attempt the upgrade to Windows 10.
              - -For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135). - -

              Ensure you select the option to "Download and install updates (recommended)." -
              -
              - -

              0x800xxxxx

              - -
              Result codes starting with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. - -
              See the following general troubleshooting procedures associated with a result code of 0x800xxxxx:
              - -
              - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - - -
              Code -
              - -80040005 - 0x20007 - -
              - -
              -
              Cause -
              - -An unspecified error occurred with a driver during the SafeOS phase. - -
              -
              - - -
              Mitigation -
              - -This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. - -
              -
              - - -
              Code -
              - -0x80073BC3 - 0x20009
              -0x8007002 - 0x20009
              -0x80073B92 - 0x20009 - -
              - -
              -
              Cause -
              - -The requested system device cannot be found, there is a sharing violation, or there are multiple devices matching the identification criteria. - -
              -
              - - -
              Mitigation -
              - -These errors occur during partition analysis and validation, and can be caused by the presence of multiple system partitions. For example, if you installed a new system drive but left the previous system drive connected, this can cause a conflict. To resolve the errors, disconnect or temporarily disable drives that contain the unused system partition. You can reconnect the drive after the upgrade has completed. Alternatively, you can delete the unused system partition. - -
              -
              - - -
              Code -
              - -800704B8 - 0x3001A - -
              - -
              -
              Cause -
              - -An extended error has occurred during the first boot phase. - -
              -
              - - -
              Mitigation -
              - -Disable or uninstall non-Microsoft antivirus applications, disconnect all unnecessary devices, and perform a [clean boot](https://support.microsoft.com/kb/929135). - -
              -
              - - -
              Code -
              - -8007042B - 0x4000D - -
              - -
              -
              Cause -
              - -The installation failed during the second boot phase while attempting the MIGRATE_DATA operation. -
              This issue can occur due to file system, application, or driver issues. - -
              -
              - - -
              Mitigation -
              - -[Analyze log files](log-files.md#analyze-log-files) in order to determine the file, application, or driver that is not able to be migrated. Disconnect, update, remove, or replace the device or object. - -
              -
              - - -
              Code -
              - -8007001F - 0x3000D - -
              - -
              -
              Cause -
              - -The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DATA operation. - -
              -
              - - -
              Mitigation -
              - -[Analyze log files](log-files.md#analyze-log-files) in order to determine the files or registry entries that are blocking data migration. - -This error can be due to a problem with user profiles. It can occur due to corrupt registry entries under **HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList** or invalid files in the **\\Users** directory. - -Note: If a previous upgrade did not complete, invalid profiles might exist in the **Windows.old\\Users** directory. - -To repair this error, ensure that deleted accounts are not still present in the Windows registry and that files under the \\Users directory are valid. Delete the invalid files or user profiles that are causing this error. The specific files and profiles that are causing the error will be recorded in the Windows setup log files. - -
              -
              - - -
              Code -
              - -8007001F - 0x4000D - -
              - -
              -
              Cause -
              - -General failure, a device attached to the system is not functioning. - -
              -
              - - -
              Mitigation -
              - -[Analyze log files](log-files.md#analyze-log-files) in order to determine the device that is not functioning properly. Disconnect, update, or replace the device. - -
              -
              - - -
              Code -
              - -8007042B - 0x4001E - -
              - -
              -
              Cause -
              - -The installation failed during the second boot phase while attempting the PRE_OOBE operation. - -
              -
              - - -
              Mitigation -
              - -This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. - -
              -
              +See the following general troubleshooting procedures associated with a result code of 0x800xxxxx: +| Code | Mitigation | Cause | +| :--- | :--- | :--- | +| 80040005 - 0x20007 | This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. | An unspecified error occurred with a driver during the SafeOS phase. | +| 0x80073BC3 - 0x20009
              0x80070002 - 0x20009
              0x80073B92 - 0x20009 | These errors occur during partition analysis and validation, and can be caused by the presence of multiple system partitions. For example, if you installed a new system drive but left the previous system drive connected, this can cause a conflict. To resolve the errors, disconnect or temporarily disable drives that contain the unused system partition. You can reconnect the drive after the upgrade has completed. Alternatively, you can delete the unused system partition. | The requested system device cannot be found, there is a sharing violation, or there are multiple devices matching the identification criteria. | +| 800704B8 - 0x3001A | Disable or uninstall non-Microsoft antivirus applications, disconnect all unnecessary devices, and perform a [clean boot](https://support.microsoft.com/kb/929135). | An extended error has occurred during the first boot phase. | +| 8007042B - 0x4000D | [Analyze log files](log-files.md#analyze-log-files) in order to determine the file, application, or driver that is not able to be migrated. Disconnect, update, remove, or replace the device or object. | The installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
              This issue can occur due to file system, application, or driver issues. | +| 8007001F - 0x3000D | [Analyze log files](log-files.md#analyze-log-files) in order to determine the files or registry entries that are blocking data migration.
               
              This error can be due to a problem with user profiles. It can occur due to corrupt registry entries under **HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList** or invalid files in the **\\Users** directory.
               
              **Note**: If a previous upgrade did not complete, invalid profiles might exist in the **Windows.old\\Users** directory.
               
              To repair this error, ensure that deleted accounts are not still present in the Windows registry and that files under the \\Users directory are valid. Delete the invalid files or user profiles that are causing this error. The specific files and profiles that are causing the error will be recorded in the Windows setup log files.| The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DATA operation. | +| 8007001F - 0x4000D | [Analyze log files](log-files.md#analyze-log-files) in order to determine the device that is not functioning properly. Disconnect, update, or replace the device. | General failure, a device attached to the system is not functioning. | +| 8007042B - 0x4001E | This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. | The installation failed during the second boot phase while attempting the PRE_OOBE operation. | ## Other result codes - +
              - + + @@ -504,10 +86,9 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m - + - @@ -524,22 +105,22 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m - - @@ -567,34 +148,29 @@ Download and run the media creation tool. See Disk cleanup in Windows 10. + - - + - - + - + + +Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/).
              Error code -Cause -Mitigation +Error codeCauseMitigation
              0xC1900200 Setup.exe has detected that the machine does not meet the minimum system requirements.Ensure the system you are trying to upgrade meets the minimum system requirements.
              See Windows 10 specifications for information.
              Ensure the system you are trying to upgrade meets the minimum system requirements.
              See Windows 10 specifications for information.
              0x80090011 A device driver error occurred during user data migration.
              0x80190001 An unexpected error was encountered while attempting to download files required for upgrade.To resolve this issue, download and run the media creation tool. See Download windows 10. +To resolve this issue, download and run the media creation tool. See Download windows 10.
              0x80246007 The update was not downloaded successfully. Attempt other methods of upgrading the operating system.
              -Download and run the media creation tool. See Download windows 10. +Download and run the media creation tool. See Download windows 10.
              Attempt to upgrade using .ISO or USB.
              -Note: Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the Volume Licensing Service Center. +Note
              Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the Volume Licensing Service Center.
              0x80244018 Your machine is connected through a proxy server.Make sure Automatically Detect Settings is selected in internet options. (Control Panel > Internet Options > Connections > LAN Settings). +Make sure Automatically Detect Settings is selected in internet options. (Control Panel > Internet Options > Connections > LAN Settings).
              Restart the device and run setup again. If restarting the device does not resolve the issue, then use the Disk Cleanup utility and clean up the temporary files as well as the System files. For more information, see Disk cleanup in Windows 10.
              0xC1900209 The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications. Incompatible software is blocking the upgrade process. Uninstall the application and try the upgrade again. See Windows 10 Pre-Upgrade Validation using SETUP.EXE for more information. - -
              You can also download the [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526740) and install Application Compatibility Tools. +
              You can also download the Windows Assessment and Deployment Kit (ADK) for Windows 10 and install Application Compatibility Tools.
              0x8007002 This error is specific to upgrades using System Center Configuration Manager 2012 R2 SP1 CU3 (5.00.8238.1403)This error is specific to upgrades using System Center 2012 Configuration Manager R2 SP1 CU3 (5.00.8238.1403) Analyze the SMSTS.log and verify that the upgrade is failing on "Apply Operating system" Phase: Error 80072efe DownloadFileWithRanges() failed. 80072efe. ApplyOperatingSystem (0x0760) -
              The error 80072efe means that the connection with the server was terminated abnormally. -
              To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN.
              0x80240FFF Occurs when update synchronization fails. It can occur when you are using Windows Server Update Services on its own or when it is integrated with System Center Configuration Manager. If you enable update synchronization before you install hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update. You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following: - +Occurs when update synchronization fails. It can occur when you are using Windows Server Update Services on its own or when it is integrated with Microsoft Endpoint Configuration Manager. If you enable update synchronization before you install hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update. You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following:
              1. Disable the Upgrades classification.
              2. Install hotfix 3095113.
              3. @@ -602,21 +178,20 @@ Download and run the media creation tool. See How to delete upgrades in WSUS.

                +For detailed information on how to run these steps check out How to delete upgrades in WSUS.

              0x8007007EOccurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downloaded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with System Center Configuration Manager.Occurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downloaded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with Microsoft Endpoint Configuration Manager. Use the following steps to repair Windows Server Update Services. You must run these steps on each WSUS server that synched metadata before you installed the hotfix. -
              1. Stop the Windows Update service. Sign in as a user with administrative privileges, and then do the following:
                1. Open Administrative Tools from the Control Panel.
                2. Double-click Services.
                3. -
                4. Find the Windows Update service, right-click it, and then click Stop. If prompted, enter your credentials.
                5. +
                6. Find the Windows Update service, right-click it, and then select Stop. If prompted, enter your credentials.
              2. Delete all files and folders under c:\Windows\SoftwareDistribution\DataStore.
              3. @@ -629,9 +204,9 @@ Download and run the media creation tool. See Error Codes
              CauseMitigation
              Error CodesCauseMitigation
              0x80070003- 0x20007 This is a failure during SafeOS phase driver installation. @@ -640,7 +215,7 @@ Download and run the media creation tool. See Windows 10 Specifications and verify the computer meets minimum requirements. +See Windows 10 Specifications and verify the computer meets minimum requirements. -
              Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/).
              0x80070004 - 0x3000D This is a problem with data migration during the first boot phase. There are multiple possible causes. @@ -679,7 +254,8 @@ Alternatively, re-create installation media the [Media Creation Tool](https://ww These errors indicate the computer does not have enough free space available to install the upgrade. To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to free up drive space before proceeding with the upgrade. -
              Note: If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby. +> [!NOTE] +> If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby.
              @@ -698,12 +274,12 @@ Also see the following sequential list of modern setup (mosetup) error codes wit | 0XC1900105 | MOSETUP_E_TEST_MODE | The installation process is being used in a test environment. | | 0XC1900106 | MOSETUP_E_TERMINATE_PROCESS | The installation process was terminated. | | 0XC1900107 | MOSETUP_E_CLEANUP_PENDING | A cleanup operation from a previous installation attempt is still pending. A system reboot is required. | -| 0XC1900108 | MOSETUP_E_REPORTING | An error has occured and the result value must be consolidated for telemetry purposes. | +| 0XC1900108 | MOSETUP_E_REPORTING | An error has occurred and the result value must be consolidated for telemetry purposes. | | 0XC1900109 | MOSETUP_E_COMPAT_TERMINATE | The installation process was terminated during the actionable compatibility phase. | -| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command line argument. | +| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command-line argument. | | 0XC190010b | MOSETUP_E_INSTALL_IMAGE_NOT_FOUND | The installation image was not found. | | 0XC190010c | MOSETUP_E_AUTOMATION_INVALID | The provided automation information was invalid. | -| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command line argument. | +| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command-line argument. | | 0XC190010e | MOSETUP_E_EULA_ACCEPT_REQUIRED | The installation process requires that the user accept the license agreement. | | 0XC1900110 | MOSETUP_E_EULA_CANCEL | The user has chosen to cancel for license agreement. | | 0XC1900111 | MOSETUP_E_ADVERTISE_CANCEL | The user has chosen to cancel for advertisement. | @@ -713,8 +289,8 @@ Also see the following sequential list of modern setup (mosetup) error codes wit | 0XC190011f | MOSETUP_E_PROCESS_CRASHED | The installation process crashed. | | 0XC1900120 | MOSETUP_E_EULA_TIMEOUT | The user has not accepted Eula within the required time limit. | | 0XC1900121 | MOSETUP_E_ADVERTISE_TIMEOUT | The user has not accepted Advertisement within the required time limit. | -| 0XC1900122 | MOSETUP_E_DOWNLOADDISKSPACE_TIMEOUT | The download diskspace issues were not resolved within the required time limit. | -| 0XC1900123 | MOSETUP_E_INSTALLDISKSPACE_TIMEOUT | The install diskspace issues were not resolved within the required time limit. | +| 0XC1900122 | MOSETUP_E_DOWNLOADDISKSPACE_TIMEOUT | The download disk space issues were not resolved within the required time limit. | +| 0XC1900123 | MOSETUP_E_INSTALLDISKSPACE_TIMEOUT | The install disk space issues were not resolved within the required time limit. | | 0XC1900124 | MOSETUP_E_COMPAT_SYSREQ_TIMEOUT | The minimum requirements compatibility issues were not resolved within the required time limit. | | 0XC1900125 | MOSETUP_E_COMPAT_DOWNLOADREQ_TIMEOUT | The compatibility issues for download were not resolved within the required time limit. | | 0XC1900126 | MOSETUP_E_GATHER_OS_STATE_SIGNATURE | The GatherOsState executable has invalid signature. | @@ -743,9 +319,9 @@ Also see the following sequential list of modern setup (mosetup) error codes wit | 0XC1900209 | MOSETUP_E_COMPAT_INSTALLREQ_CANCEL | The user has chosen to cancel because the system does not pass the compat scan to install the update. | | 0XC190020a | MOSETUP_E_COMPAT_RECOVERYREQ_BLOCK | The system does not pass the minimum requirements to recover Windows. | | 0XC190020b | MOSETUP_E_COMPAT_RECOVERYREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to recover Windows. | -| 0XC190020c | MOSETUP_E_DOWNLOADDISKSPACE_BLOCK | The system does not pass the diskspace requirements to download the payload. | +| 0XC190020c | MOSETUP_E_DOWNLOADDISKSPACE_BLOCK | The system does not pass the disk space requirements to download the payload. | | 0XC190020d | MOSETUP_E_DOWNLOADDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to download. | -| 0XC190020e | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The system does not pass the diskspace requirements to install the payload. | +| 0XC190020e | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The system does not pass the disk space requirements to install the payload. | | 0XC190020f | MOSETUP_E_INSTALLDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to install. | | 0XC1900210 | MOSETUP_E_COMPAT_SCANONLY | The user has used the setup.exe command line to do scanonly, not to install the OS. | | 0XC1900211 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_BLOCK | The system does not pass the disk space requirements to download and unpack media. | @@ -764,8 +340,8 @@ Also see the following sequential list of modern setup (mosetup) error codes wit ## Related topics -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +- [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +- [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +- [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +- [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/home?category=Windows10ITPro) +- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index af24d3c075..9cef992dea 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -1,64 +1,65 @@ ---- -title: Resolve Windows 10 upgrade errors - Windows IT Pro -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Resolve Windows 10 upgrade errors : Technical information for IT Pros - -**Applies to** -- Windows 10 - ->[!IMPORTANT] ->This article contains technical instructions for IT administrators. If you are not an IT administrator, try some of the [quick fixes](quick-fixes.md) described in this article then contact [Microsoft Support](https://support.microsoft.com/contactus/) starting with the Virtual Agent. To talk to a person about your issue, click **Get started** to interact with the Virtual Agent, then enter "Talk to a person" two times. The Virtual Agent can also help you to resolve many Windows upgrade issues. Also see: [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/help/10587/windows-10-get-help-with-upgrade-installation-errors) and [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md). - -This article contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. - -The article was originally one page, but has been divided into sub-topics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. - -The following four levels are assigned: - -Level 100: Basic
              -Level 200: Moderate
              -Level 300: Moderate advanced
              -Level 400: Advanced
              - -## In this guide - -See the following topics in this article: - -- [Quick fixes](quick-fixes.md): \Level 100\ Steps you can take to eliminate many Windows upgrade errors.
              -- [SetupDiag](setupdiag.md): \Level 300\ SetupDiag is a new tool to help you isolate the root cause of an upgrade failure. -- [Troubleshooting upgrade errors](troubleshoot-upgrade-errors.md): \Level 300\ General advice and techniques for troubleshooting Windows 10 upgrade errors, and an explanation of phases used during the upgrade process.
              -- [Windows Error Reporting](windows-error-reporting.md): \Level 300\ How to use Event Viewer to review details about a Windows 10 upgrade. -- [Upgrade error codes](upgrade-error-codes.md): \Level 400\ The components of an error code are explained. - - [Result codes](upgrade-error-codes.md#result-codes): Information about result codes. - - [Extend codes](upgrade-error-codes.md#extend-codes): Information about extend codes. -- [Log files](log-files.md): \Level 400\ A list and description of log files useful for troubleshooting. - - [Log entry structure](log-files.md#log-entry-structure): The format of a log entry is described. - - [Analyze log files](log-files.md#analyze-log-files): General procedures for log file analysis, and an example. -- [Resolution procedures](resolution-procedures.md): \Level 200\ Causes and mitigation procedures associated with specific error codes. - - [0xC1900101](resolution-procedures.md#0xc1900101): Information about the 0xC1900101 result code. - - [0x800xxxxx](resolution-procedures.md#0x800xxxxx): Information about result codes that start with 0x800. - - [Other result codes](resolution-procedures.md#other-result-codes): Additional causes and mitigation procedures are provided for some result codes. - - [Other error codes](resolution-procedures.md#other-error-codes): Additional causes and mitigation procedures are provided for some error codes. -- [Submit Windows 10 upgrade errors](submit-errors.md): \Level 100\ Submit upgrade errors to Microsoft for analysis. - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) -
              +--- +title: Resolve Windows 10 upgrade errors - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Resolve Windows 10 upgrade errors : Technical information for IT Pros + +**Applies to** +- Windows 10 + +>[!IMPORTANT] +>This article contains technical instructions for IT administrators. If you are not an IT administrator, try some of the [quick fixes](quick-fixes.md) described in this article then contact [Microsoft Support](https://support.microsoft.com/contactus/) starting with the Virtual Agent. To talk to a person about your issue, click **Get started** to interact with the Virtual Agent, then enter "Talk to a person" two times. The Virtual Agent can also help you to resolve many Windows upgrade issues. Also see: [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/help/10587/windows-10-get-help-with-upgrade-installation-errors) and [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md). + +This article contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. + +The article was originally one page, but has been divided into sub-topics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. + +The following four levels are assigned: + +Level 100: Basic
              +Level 200: Moderate
              +Level 300: Moderate advanced
              +Level 400: Advanced
              + +## In this guide + +See the following topics in this article: + +- [Quick fixes](quick-fixes.md): \Level 100\ Steps you can take to eliminate many Windows upgrade errors.
              +- [SetupDiag](setupdiag.md): \Level 300\ SetupDiag is a new tool to help you isolate the root cause of an upgrade failure. +- [Troubleshooting upgrade errors](troubleshoot-upgrade-errors.md): \Level 300\ General advice and techniques for troubleshooting Windows 10 upgrade errors, and an explanation of phases used during the upgrade process.
              +- [Windows Error Reporting](windows-error-reporting.md): \Level 300\ How to use Event Viewer to review details about a Windows 10 upgrade. +- [Upgrade error codes](upgrade-error-codes.md): \Level 400\ The components of an error code are explained. + - [Result codes](upgrade-error-codes.md#result-codes): Information about result codes. + - [Extend codes](upgrade-error-codes.md#extend-codes): Information about extend codes. +- [Log files](log-files.md): \Level 400\ A list and description of log files useful for troubleshooting. + - [Log entry structure](log-files.md#log-entry-structure): The format of a log entry is described. + - [Analyze log files](log-files.md#analyze-log-files): General procedures for log file analysis, and an example. +- [Resolution procedures](resolution-procedures.md): \Level 200\ Causes and mitigation procedures associated with specific error codes. + - [0xC1900101](resolution-procedures.md#0xc1900101): Information about the 0xC1900101 result code. + - [0x800xxxxx](resolution-procedures.md#0x800xxxxx): Information about result codes that start with 0x800. + - [Other result codes](resolution-procedures.md#other-result-codes): Additional causes and mitigation procedures are provided for some result codes. + - [Other error codes](resolution-procedures.md#other-error-codes): Additional causes and mitigation procedures are provided for some error codes. +- [Submit Windows 10 upgrade errors](submit-errors.md): \Level 100\ Submit upgrade errors to Microsoft for analysis. + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
              [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +
              diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 355c0da246..6abb0eac36 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -3,8 +3,9 @@ title: SetupDiag ms.reviewer: manager: laurawi ms.author: greglin -description: How to use the SetupDiag tool to diagnose Windows Setup errors +description: SetupDiag works by examining Windows Setup log files. This article shows how to use the SetupDiag tool to diagnose Windows Setup errors. keywords: deploy, troubleshoot, windows, 10, upgrade, update, setup, diagnose +ms.custom: seo-marvel-apr2020 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -28,23 +29,43 @@ ms.topic: article ## About SetupDiag -Current version of SetupDiag: 1.5.0.0 +Current downloadable version of SetupDiag: 1.6.0.42 +>Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode. +## SetupDiag in Windows 10, version 2004 and later + +With the release of Windows 10, version 2004, SetupDiag is included with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files#windows-setup-scenario). + +During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, **setupdiag.exe** is also installed to this directory. If there is an issue with the upgrade, SetupDiag will automatically run to determine the cause of the failure. + +When run by Windows Setup, the following [parameters](#parameters) are used: + +- /ZipLogs:False +- /Format:xml +- /Output:%windir%\logs\SetupDiag\SetupDiagResults.xml +- /RegPath:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupDiag\Results + +The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**. + +If the upgrade process proceeds normally, the **Sources** directory including **setupdiag.exe** is moved under **%SystemDrive%\Windows.Old** for cleanup. If the **Windows.old** directory is deleted later, **setupdiag.exe** will also be removed. + +## Using SetupDiag + To quickly use SetupDiag on your current computer: 1. Verify that your system meets the [requirements](#requirements) described below. If needed, install the [.NET framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137). 2. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). 3. If your web browser asks what to do with the file, choose **Save**. By default, the file will be saved to your **Downloads** folder. You can also save it to a different location if desired by using **Save As**. -4. When SetupDiag has finished downloading, open the folder where you downloaded the file. As mentioned above, by default this is your **Downloads** folder which is displayed in File Explorer under **Quick access** in the left navigation pane. +4. When SetupDiag has finished downloading, open the folder where you downloaded the file. By default, this is your **Downloads** folder, which is displayed in File Explorer under **Quick access** in the left navigation pane. 5. Double-click the **SetupDiag** file to run it. Click **Yes** if you are asked to approve running the program. - Double-clicking the file to run it will automatically close the command window when SetupDiag has completed its analysis. If you wish to keep this window open instead, and review the messages that you see, run the program by typing **SetupDiag** at the command prompt instead of double-clicking it. You will need to change directories to the location of SetupDiag to run it this way. 6. A command window will open while SetupDiag diagnoses your computer. Wait for this to finish. 7. When SetupDiag finishes, two files will be created in the same folder where you double-clicked SetupDiag. One is a configuration file, the other is a log file. 8. Use Notepad to open the log file: **SetupDiagResults.log**. -9. Review the information that is displayed. If a rule was matched this can tell you why the computer failed to upgrade, and potentially how to fix the problem. See the [Text log sample](#text-log-sample) below. +9. Review the information that is displayed. If a rule was matched, this can tell you why the computer failed to upgrade, and potentially how to fix the problem. See the [Text log sample](#text-log-sample) below. For instructions on how to run the tool in offline mode and with more advanced options, see the [Parameters](#parameters) and [Examples](#examples) sections below. @@ -72,6 +93,8 @@ The [Release notes](#release-notes) section at the bottom of this topic has info | /Verbose |
              • This optional parameter will output much more data to a log file. By default, SetupDiag will only produce a log file entry for serious errors. Using **/Verbose** will cause SetupDiag to always produce an additional log file with debugging details. These details can be useful when reporting a problem with SetupDiag.
              | | /NoTel |
              • This optional parameter tells SetupDiag.exe not to send diagnostic telemetry to Microsoft.
              | | /AddReg |
              • This optional parameter instructs SetupDiag.exe to add failure information to the registry in offline mode. By default, SetupDiag will add failure information to the registry in online mode only. Registry data is added to the following location on the system where SetupDiag is run: **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**.
              | +| /RegPath |
              • This optional parameter instructs SetupDiag.exe to add failure information to the registry using the specified path. If this parameter is not specified the default path is **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**. +
              | Note: The **/Mode** parameter is deprecated in version 1.4.0.0 of SetupDiag. - In previous versions, this command was used with the LogsPath parameter to specify that SetupDiag should run in an offline manner to analyze a set of log files that were captured from a different computer. In version 1.4.0.0 when you specify /LogsPath then SetupDiag will automatically run in offline mode, therefore the /Mode parameter is not needed. @@ -102,7 +125,7 @@ The following example specifies that SetupDiag is to run in offline mode, and to SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:D:\Temp\Logs\LogSet1 ``` -The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the resuts to the directory specified by the /Output parameter. +The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the results to the directory specified by the /Output parameter. ``` SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery @@ -147,7 +170,6 @@ SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /LogsPath:D:\Dump ## Known issues 1. Some rules can take a long time to process if the log files involved are large. -2. If the failing computer is opted into the Insider program and getting regular pre-release updates, or an update is already pending on the computer when SetupDiag is run, it can encounter problems trying to open these log files. This will likely cause a failure to determine a root cause. In this case, try gathering the log files and running SetupDiag in offline mode. ## Sample output @@ -157,7 +179,7 @@ The following is an example where SetupDiag is run in offline mode. ``` D:\SetupDiag>SetupDiag.exe /output:c:\setupdiag\result.xml /logspath:D:\Tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e /format:xml -SetupDiag v1.5.0.0 +SetupDiag v1.6.0.0 Copyright (c) Microsoft Corporation. All rights reserved. Searching for setup logs... @@ -190,7 +212,7 @@ Logs ZipFile created at: c:\setupdiag\Logs_14.zip ## Rules -When searching log files, SetupDiag uses a set of rules to match known issues. These rules are contained in the rules.xml file which is extracted when SetupDiag is run. The rules.xml file might be updated as new versions of SetupDiag are made available. See [Release notes](#release-notes) for more information. +When searching log files, SetupDiag uses a set of rules to match known issues. These rules are contained in the rules.xml file which is extracted when SetupDiag is run. The rules.xml file might be updated as new versions of SetupDiag are made available. See the [release notes](#release-notes) section for more information. Each rule name and its associated unique rule identifier are listed with a description of the known upgrade-blocking issue. In the rule descriptions, the term "down-level" refers to the first phase of the upgrade process, which runs under the starting OS. @@ -211,7 +233,7 @@ Each rule name and its associated unique rule identifier are listed with a descr 8. CompatBlockedApplicationAutoUninstall – BEBA5BC6-6150-413E-8ACE-5E1EC8D34DD5 - This rule indicates there is an application that needs to be uninstalled before setup can continue. 9. CompatBlockedApplicationDismissable - EA52620B-E6A0-4BBC-882E-0686605736D9 - - When running setup in /quiet mode, there are dismissible application messages that turn into blocks unless the command line also specifies “/compat /ignore warning”. This rule indicates setup was executed in /quiet mode but there is an application dismissible block message that have prevented setup from continuing. + - When running setup in /quiet mode, there are dismissible application messages that turn into blocks unless the command line also specifies “/compat ignorewarning”. This rule indicates setup was executed in /quiet mode but there is an application dismissible block message that have prevented setup from continuing. 10. CompatBlockedApplicationManualUninstall - 9E912E5F-25A5-4FC0-BEC1-CA0EA5432FF4 - This rule indicates that an application without an Add/Remove Programs entry, is present on the system and blocking setup from continuing. This typically requires manual removal of the files associated with this application to continue. 11. HardblockDeviceOrDriver - ED3AEFA1-F3E2-4F33-8A21-184ADF215B1B @@ -318,6 +340,19 @@ Each rule name and its associated unique rule identifier are listed with a descr ## Release notes +08/08/2019 - SetupDiag v1.6.0.42 is released with 60 rules, as a standalone tool available from the Download Center. + - Log detection performance is improved. What used to take up to a minute should take around 10 seconds or less. + - Added Setup Operation and Setup Phase information to both the results log and the registry information. + - This is the last Operation and Phase that Setup was in when the failure occurred. + - Added detailed Setup Operation and Setup Phase information (and timing) to output log when /verbose is specified. + - Note, if the issue found is a compat block, no Setup Operation or Phase info exists yet and therefore won’t be available. + - Added more info to the Registry output. + - Detailed ‘FailureData’ info where available. Example: “AppName = MyBlockedApplication” or “DiskSpace = 6603” (in MB) + - “Key = Value” data specific to the failure found. + - Added ‘UpgradeStartTime’, ‘UpgradeEndTime’ and ‘UpgradeElapsedTime’ + - Added ‘SetupDiagVersion’, ‘DateTime’ (to indicate when SetupDiag was executed on the system), ‘TargetOSVersion’, ‘HostOSVersion’ and more… + + 06/19/2019 - SetupDiag v1.5.0.0 is released with 60 rules, as a standalone tool available from the Download Center. - All date and time outputs are updated to localized format per user request. - Added setup Operation and Phase information to /verbose log. @@ -335,7 +370,7 @@ Each rule name and its associated unique rule identifier are listed with a descr - For an example, see [Sample registry key](#sample-registry-key). 05/17/2019 - SetupDiag v1.4.1.0 is released with 53 rules, as a standalone tool available from the Download Center. -- This release adds the ability to find and diagnose reset and recovery failures (Push Button Reset). +- This release dds the ability to find and diagnose reset and recovery failures (Push Button Reset). 12/18/2018 - SetupDiag v1.4.0.0 is released with 53 rules, as a standalone tool available from the Download Center. - This release includes major improvements in rule processing performance: ~3x faster rule processing performance! @@ -362,7 +397,7 @@ Each rule name and its associated unique rule identifier are listed with a descr - Telemetry is refactored to only send the rule name and GUID (or “NoRuleMatched” if no rule is matched) and the Setup360 ReportId. This change assures data privacy during rule processing. 05/02/2018 - SetupDiag v1.10 is released with 34 rules, as a standalone tool available from the Download Center. -- A performance enhancment has been added to result in faster rule processing. +- A performance enhancement has been added to result in faster rule processing. - Rules output now includes links to support articles, if applicable. - SetupDiag now provides the path and name of files that it is processing. - You can now run SetupDiag by simply clicking on it and then examining the output log file. @@ -408,7 +443,7 @@ Refer to https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-cod ```xml - 1.5.0.0 + 1.6.0.0 FindSPFatalError A4028172-1B09-48F8-AD3B-86CDD7D55852 @@ -459,7 +494,7 @@ Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" f ``` { - "Version":"1.5.0.0", + "Version":"1.6.0.0", "ProfileName":"FindSPFatalError", "ProfileGuid":"A4028172-1B09-48F8-AD3B-86CDD7D55852", "SystemInfo":{ @@ -518,7 +553,7 @@ Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" f ## Sample registry key -![Addreg](./../images/addreg.png) +![Example of Addreg](./../images/addreg.png) ## Related topics diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 6f6bde4fba..4703c12558 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -1,76 +1,77 @@ ---- -title: Submit Windows 10 upgrade errors using Feedback Hub -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Submit Windows 10 upgrade errors for diagnosis using feedback hub -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, feedback -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Submit Windows 10 upgrade errors using Feedback Hub - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 100 level topic (basic).
              ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - -## In this topic - -This topic describes how to submit problems with a Windows 10 upgrade to Microsoft using the Windows 10 Feedback Hub. - -## About the Feedback Hub - -The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/en-us/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). - -The Feedback Hub requires Windows 10 or Windows 10 mobile. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. - -## Submit feedback - -To submit feedback about a failed Windows 10 upgrade, click the following link: [Feedback Hub](feedback-hub://?referrer=resolveUpgradeErrorsPage&tabid=2&contextid=81&newFeedback=true&feedbackType=2&topic=submit-errors.md)  - -The Feedback Hub will open. - -- Under **Tell us about it**, and then under **Summarize your issue**, type **Upgrade failing**. -- Under **Give us more detail**, provide additional information about the failed upgrade, such as: - - When did the failure occur? - - Were there any reboots? - - How many times did the system reboot? - - How did the upgrade fail? - - Were any error codes visible? - - Did the computer fail to a blue screen? - - Did the computer automatically roll back or did it hang, requiring you to power cycle it before it rolled back? -- Additional details - - What type of security software is installed? - - Is the computer up to date with latest drivers and firmware? - - Are there any external devices connected? -- If you used the link above, the category and subcategory will be automatically selected. If it is not selected, choose **Install and Update** and **Windows Installation**. - -You can attach a screenshot or file if desired. This is optional, but can be extremely helpful when diagnosing your upgrade issue. The location of these files is described here: [Windows Setup log files and event logs](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs). - -Click **Submit** to send your feedback. - -See the following example: - -![feedback example](../images/feedback.png) - -After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. - -## Link to your feedback - -After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. - -![share](../images/share.jpg) - -## Related topics - -[Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx) - +--- +title: Submit Windows 10 upgrade errors using Feedback Hub +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Download the Feedback Hub app, and then submit Windows 10 upgrade errors for diagnosis using feedback hub. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, feedback +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Submit Windows 10 upgrade errors using Feedback Hub + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 100 level topic (basic).
              +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + +## In this topic + +This topic describes how to submit problems with a Windows 10 upgrade to Microsoft using the Windows 10 Feedback Hub. + +## About the Feedback Hub + +The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). + +The Feedback Hub requires Windows 10 or Windows 10 mobile. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. + +## Submit feedback + +To submit feedback about a failed Windows 10 upgrade, click the following link: [Feedback Hub](feedback-hub://?referrer=resolveUpgradeErrorsPage&tabid=2&contextid=81&newFeedback=true&feedbackType=2&topic=submit-errors.md)  + +The Feedback Hub will open. + +- Under **Tell us about it**, and then under **Summarize your issue**, type **Upgrade failing**. +- Under **Give us more detail**, provide additional information about the failed upgrade, such as: + - When did the failure occur? + - Were there any reboots? + - How many times did the system reboot? + - How did the upgrade fail? + - Were any error codes visible? + - Did the computer fail to a blue screen? + - Did the computer automatically roll back or did it hang, requiring you to power cycle it before it rolled back? +- Additional details + - What type of security software is installed? + - Is the computer up to date with latest drivers and firmware? + - Are there any external devices connected? +- If you used the link above, the category and subcategory will be automatically selected. If it is not selected, choose **Install and Update** and **Windows Installation**. + +You can attach a screenshot or file if desired. This is optional, but can be extremely helpful when diagnosing your upgrade issue. The location of these files is described here: [Windows Setup log files and event logs](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs). + +Click **Submit** to send your feedback. + +See the following example: + +![feedback example](../images/feedback.png) + +After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. + +## Link to your feedback + +After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. + +![share](../images/share.jpg) + +## Related topics + +[Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx) + diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index b252ff670a..cd9734bcfa 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -1,97 +1,98 @@ ---- -title: Troubleshoot Windows 10 upgrade errors - Windows IT Pro -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Troubleshooting upgrade errors - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 300 level topic (moderately advanced).
              ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - -If a Windows 10 upgrade is not successful, it can be very helpful to understand *when* an error occurred in the upgrade process. - -Briefly, the upgrade process consists of four phases: **Downlevel**, **SafeOS**, **First boot**, and **Second boot**. The computer will reboot once between each phase. Note: Progress is tracked in the registry during the upgrade process using the following key: **HKLM\System\Setup\mosetup\volatile\SetupProgress**. This key is volatile and only present during the upgrade process; it contains a binary value in the range 0-100. - -These phases are explained in greater detail [below](#the-windows-10-upgrade-process). First, let's summarize the actions performed during each phase because this affects the type of errors that can be encountered. - -1. **Downlevel phase**: Because this phase runs on the source OS, upgrade errors are not typically seen. If you do encounter an error, ensure the source OS is stable. Also ensure the Windows setup source and the destination drive are accessible. - -2. **SafeOS phase**: Errors most commonly occur during this phase due to hardware issues, firmware issues, or non-microsoft disk encryption software. - - Since the computer is booted into Windows PE during the SafeOS phase, a useful troubleshooting technique is to boot into [Windows PE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/winpe-intro) using installation media. You can use the [media creation tool](https://www.microsoft.com/software-download/windows10) to create bootable media, or you can use tools such as the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), and then boot your device from this media to test for hardware and firmware compatibility issues. - - >[!TIP] - >If you attempt to use the media creation tool with a USB drive and this fails with error 0x80004005 - 0xa001a, this is because the USB drive is using GPT partition style. The tool requires that you use MBR partition style. You can use the DISKPART command to convert the USB drive from GPT to MBR. For more information, see [Change a GUID Partition Table Disk into a Master Boot Record Disk](https://go.microsoft.com/fwlink/?LinkId=207050). - - **Do not proceed with the Windows 10 installation after booting from this media**. This method can only be used to perform a clean install which will not migrate any of your apps and settings, and you will be required re-enter your Windows 10 license information. - - If the computer does not successfully boot into Windows PE using the media that you created, this is likely due to a hardware or firmware issue. Check with your hardware manufacturer and apply any recommended BIOS and firmware updates. If you are still unable to boot to installation media after applying updates, disconnect or replace legacy hardware. - - If the computer successfully boots into Windows PE, but you are not able to browse the system drive on the computer, it is possible that non-Microsoft disk encryption software is blocking your ability to perform a Windows 10 upgrade. Update or temporarily remove the disk encryption. - -3. **First boot phase**: Boot failures in this phase are relatively rare, and almost exclusively caused by device drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, then retry the upgrade. - -4. **Second boot phase**: In this phase, the system is running under the target OS with new drivers. Boot failures are most commonly due to anti-virus software or filter drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, temporarily uninstall anti-virus software, then retry the upgrade. - -If the general troubleshooting techniques described above or the [quick fixes](quick-fixes.md) detailed below do not resolve your issue, you can attempt to analyze [log files](log-files.md) and interpret [upgrade error codes](upgrade-error-codes.md). You can also [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md) so that Microsoft can diagnose your issue. - -## The Windows 10 upgrade process - -The **Windows Setup** application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. - -When performing an operating system upgrade, Windows Setup uses phases described below. A reboot occurs between each of the phases. After the first reboot, the user interface will remain the same until the upgrade is completed. Percent progress is displayed and will advance as you move through each phase, reaching 100% at the end of the second boot phase. - -1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered. - - ![downlevel phase](../images/downlevel.png) - -2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017. - - ![safeOS phase](../images/safeos.png) - -3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D. - - ![first boot phase](../images/firstboot.png) - -4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. - - At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. - - ![second boot phase](../images/secondboot.png) - - ![second boot phase](../images/secondboot2.png) - - ![second boot phase](../images/secondboot3.png) - -5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. - -**Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): - -![Upgrade process](../images/upgrade-process.png) - -DU = Driver/device updates.
              -OOBE = Out of box experience.
              -WIM = Windows image (Microsoft) - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Troubleshoot Windows 10 upgrade errors - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Understanding the Windows 10 upgrade process can help you troubleshoot errors when something goes wrong. Find out more with this guide. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Troubleshooting upgrade errors + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 300 level topic (moderately advanced).
              +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + +If a Windows 10 upgrade is not successful, it can be very helpful to understand *when* an error occurred in the upgrade process. + +Briefly, the upgrade process consists of four phases that are controlled by [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-technical-reference): **Downlevel**, **SafeOS**, **First boot**, and **Second boot**. The computer will reboot once between each phase. Note: Progress is tracked in the registry during the upgrade process using the following key: **HKLM\System\Setup\mosetup\volatile\SetupProgress**. This key is volatile and only present during the upgrade process; it contains a binary value in the range 0-100. + +These phases are explained in greater detail [below](#the-windows-10-upgrade-process). First, let's summarize the actions performed during each phase because this affects the type of errors that can be encountered. + +1. **Downlevel phase**: Because this phase runs on the source OS, upgrade errors are not typically seen. If you do encounter an error, ensure the source OS is stable. Also ensure the Windows setup source and the destination drive are accessible. + +2. **SafeOS phase**: Errors most commonly occur during this phase due to hardware issues, firmware issues, or non-microsoft disk encryption software. + + Since the computer is booted into Windows PE during the SafeOS phase, a useful troubleshooting technique is to boot into [Windows PE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/winpe-intro) using installation media. You can use the [media creation tool](https://www.microsoft.com/software-download/windows10) to create bootable media, or you can use tools such as the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), and then boot your device from this media to test for hardware and firmware compatibility issues. + + >[!TIP] + >If you attempt to use the media creation tool with a USB drive and this fails with error 0x80004005 - 0xa001a, this is because the USB drive is using GPT partition style. The tool requires that you use MBR partition style. You can use the DISKPART command to convert the USB drive from GPT to MBR. For more information, see [Change a GUID Partition Table Disk into a Master Boot Record Disk](https://go.microsoft.com/fwlink/?LinkId=207050). + + **Do not proceed with the Windows 10 installation after booting from this media**. This method can only be used to perform a clean install which will not migrate any of your apps and settings, and you will be required re-enter your Windows 10 license information. + + If the computer does not successfully boot into Windows PE using the media that you created, this is likely due to a hardware or firmware issue. Check with your hardware manufacturer and apply any recommended BIOS and firmware updates. If you are still unable to boot to installation media after applying updates, disconnect or replace legacy hardware. + + If the computer successfully boots into Windows PE, but you are not able to browse the system drive on the computer, it is possible that non-Microsoft disk encryption software is blocking your ability to perform a Windows 10 upgrade. Update or temporarily remove the disk encryption. + +3. **First boot phase**: Boot failures in this phase are relatively rare, and almost exclusively caused by device drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, then retry the upgrade. + +4. **Second boot phase**: In this phase, the system is running under the target OS with new drivers. Boot failures are most commonly due to anti-virus software or filter drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, temporarily uninstall anti-virus software, then retry the upgrade. + +If the general troubleshooting techniques described above or the [quick fixes](quick-fixes.md) detailed below do not resolve your issue, you can attempt to analyze [log files](log-files.md) and interpret [upgrade error codes](upgrade-error-codes.md). You can also [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md) so that Microsoft can diagnose your issue. + +## The Windows 10 upgrade process + +The **Windows Setup** application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. + +When performing an operating system upgrade, Windows Setup uses phases described below. A reboot occurs between each of the phases. After the first reboot, the user interface will remain the same until the upgrade is completed. Percent progress is displayed and will advance as you move through each phase, reaching 100% at the end of the second boot phase. + +1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered. + + ![downlevel phase](../images/downlevel.png) + +2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017. + + ![safeOS phase](../images/safeos.png) + +3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D. + + ![first boot phase](../images/firstboot.png) + +4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. + + At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. + + ![second boot phase](../images/secondboot.png) + + ![second boot phase](../images/secondboot2.png) + + ![second boot phase](../images/secondboot3.png) + +5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. + +**Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): + +![Upgrade process](../images/upgrade-process.png) + +DU = Driver/device updates.
              +OOBE = Out of box experience.
              +WIM = Windows image (Microsoft) + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
              [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications) +
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/upgrade-error-codes.md b/windows/deployment/upgrade/upgrade-error-codes.md index f06c6fb87b..9f3b61be3a 100644 --- a/windows/deployment/upgrade/upgrade-error-codes.md +++ b/windows/deployment/upgrade/upgrade-error-codes.md @@ -1,159 +1,161 @@ ---- -title: Upgrade error codes - Windows IT Pro -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Upgrade error codes - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 400 level topic (advanced).
              ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - - -If the upgrade process is not successful, Windows Setup will return two codes: - -1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error. -2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred. - ->For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**. - -Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/kb/3159635) then only a result code might be returned. - ->[!TIP] ->If you are unable to locate the result and extend error codes, you can attempt to find these codes using Event Viewer. For more information, see [Windows Error Reporting](windows-error-reporting.md). - -## Result codes - ->A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
              To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. - -The following set of result codes are associated with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings: - -| Result code | Message | Description | -| --- | --- | --- | -| 0xC1900210 | MOSETUP_E_COMPAT_SCANONLY | Setup did not find any compat issue | -| 0xC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | Setup found an actionable compat issue, such as an incompatible app | -| 0xC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The migration choice selected is not available (ex: Enterprise to Home) | -| 0xC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The computer is not eligible for Windows 10 | -| 0xC190020E | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The computer does not have enough free space to install | - -A list of modern setup (mosetup) errors with descriptions in the range is available in the [Resolution procedures](resolution-procedures.md#modern-setup-errors) topic in this article. - -Other result codes can be matched to the specific type of error encountered. To match a result code to an error: - -1. Identify the error code type as either Win32 or NTSTATUS using the first hexadecimal digit: -
              **8** = Win32 error code (ex: 0x**8**0070070) -
              **C** = NTSTATUS value (ex: 0x**C**1900107) -2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits are the actual error code type as defined in the [HRESULT](https://msdn.microsoft.com/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/library/cc231200.aspx) structure. Other digits in the code identify things such as the device type that produced the error. -3. Based on the type of error code determined in the first step (Win32 or NTSTATUS), match the 4 digits derived from the second step to either a Win32 error code or NTSTATUS value using the following links: - - [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) - - [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) - -Examples: -- 0x80070070 - - Based on the "8" this is a Win32 error code - - The last four digits are 0070, so look up 0x00000070 in the [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) table - - The error is: **ERROR_DISK_FULL** -- 0xC1900107 - - Based on the "C" this is an NTSTATUS error code - - The last four digits are 0107, so look up 0x00000107 in the [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) table - - The error is: **STATUS_SOME_NOT_MAPPED** - -Some result codes are self-explanatory, whereas others are more generic and require further analysis. In the examples shown above, ERROR_DISK_FULL indicates that the hard drive is full and additional room is needed to complete Windows upgrade. The message STATUS_SOME_NOT_MAPPED is more ambiguous, and means that an action is pending. In this case, the action pending is often the cleanup operation from a previous installation attempt, which can be resolved with a system reboot. - -## Extend codes - ->**Important**: Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update. - -Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation: - -1. Use the first digit to identify the phase (ex: 0x4000D = 4). -2. Use the last two digits to identify the operation (ex: 0x4000D = 0D). -3. Match the phase and operation to values in the tables provided below. - -The following tables provide the corresponding phase and operation for values of an extend code: - -
              - - - -
              Extend code: phase
              HexPhase -
              0SP_EXECUTION_UNKNOWN -
              1SP_EXECUTION_DOWNLEVEL -
              2SP_EXECUTION_SAFE_OS -
              3SP_EXECUTION_FIRST_BOOT -
              4SP_EXECUTION_OOBE_BOOT -
              5SP_EXECUTION_UNINSTALL -
              - - - - - - - -
              Extend code: operation
              - -
              HexOperation -
              0SP_EXECUTION_OP_UNKNOWN -
              1SP_EXECUTION_OP_COPY_PAYLOAD -
              2SP_EXECUTION_OP_DOWNLOAD_UPDATES -
              3SP_EXECUTION_OP_INSTALL_UPDATES -
              4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT -
              5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE -
              6SP_EXECUTION_OP_REPLICATE_OC -
              7SP_EXECUTION_OP_INSTALL_DRVIERS -
              8SP_EXECUTION_OP_PREPARE_SAFE_OS -
              9SP_EXECUTION_OP_PREPARE_ROLLBACK -
              ASP_EXECUTION_OP_PREPARE_FIRST_BOOT -
              BSP_EXECUTION_OP_PREPARE_OOBE_BOOT -
              CSP_EXECUTION_OP_APPLY_IMAGE -
              DSP_EXECUTION_OP_MIGRATE_DATA -
              ESP_EXECUTION_OP_SET_PRODUCT_KEY -
              FSP_EXECUTION_OP_ADD_UNATTEND -
              -
              - -
              HexOperation -
              10SP_EXECUTION_OP_ADD_DRIVER -
              11SP_EXECUTION_OP_ENABLE_FEATURE -
              12SP_EXECUTION_OP_DISABLE_FEATURE -
              13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS -
              14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS -
              15SP_EXECUTION_OP_CREATE_FILE -
              16SP_EXECUTION_OP_CREATE_REGISTRY -
              17SP_EXECUTION_OP_BOOT -
              18SP_EXECUTION_OP_SYSPREP -
              19SP_EXECUTION_OP_OOBE -
              1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT -
              1BSP_EXECUTION_OP_END_FIRST_BOOT -
              1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT -
              1DSP_EXECUTION_OP_END_OOBE_BOOT -
              1ESP_EXECUTION_OP_PRE_OOBE -
              1FSP_EXECUTION_OP_POST_OOBE -
              20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE -
              -
              - -For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**). - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Upgrade error codes - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Understand the error codes that may come up if something goes wrong during the Windows 10 upgrade process. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Upgrade error codes + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 400 level topic (advanced).
              +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + + +If the upgrade process is not successful, Windows Setup will return two codes: + +1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error. +2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred. + +For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**. + +Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/kb/3159635) then only a result code might be returned. + +>[!TIP] +>If you are unable to locate the result and extend error codes, you can attempt to find these codes using Event Viewer. For more information, see [Windows Error Reporting](windows-error-reporting.md). + +## Result codes + +A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
              To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. + +The following set of result codes are associated with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings: + +| Result code | Message | Description | +| --- | --- | --- | +| 0xC1900210 | MOSETUP_E_COMPAT_SCANONLY | Setup did not find any compat issue | +| 0xC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | Setup found an actionable compat issue, such as an incompatible app | +| 0xC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The migration choice selected is not available (ex: Enterprise to Home) | +| 0xC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The computer is not eligible for Windows 10 | +| 0xC190020E | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The computer does not have enough free space to install | + +A list of modern setup (mosetup) errors with descriptions in the range is available in the [Resolution procedures](resolution-procedures.md#modern-setup-errors) topic in this article. + +Other result codes can be matched to the specific type of error encountered. To match a result code to an error: + +1. Identify the error code type as either Win32 or NTSTATUS using the first hexadecimal digit: +
              **8** = Win32 error code (ex: 0x**8**0070070) +
              **C** = NTSTATUS value (ex: 0x**C**1900107) +2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits are the actual error code type as defined in the [HRESULT](https://msdn.microsoft.com/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/library/cc231200.aspx) structure. Other digits in the code identify things such as the device type that produced the error. +3. Based on the type of error code determined in the first step (Win32 or NTSTATUS), match the 4 digits derived from the second step to either a Win32 error code or NTSTATUS value using the following links: + - [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) + - [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) + +Examples: +- 0x80070070 + - Based on the "8" this is a Win32 error code + - The last four digits are 0070, so look up 0x00000070 in the [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) table + - The error is: **ERROR_DISK_FULL** +- 0xC1900107 + - Based on the "C" this is an NTSTATUS error code + - The last four digits are 0107, so look up 0x00000107 in the [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) table + - The error is: **STATUS_SOME_NOT_MAPPED** + +Some result codes are self-explanatory, whereas others are more generic and require further analysis. In the examples shown above, ERROR_DISK_FULL indicates that the hard drive is full and additional room is needed to complete Windows upgrade. The message STATUS_SOME_NOT_MAPPED is more ambiguous, and means that an action is pending. In this case, the action pending is often the cleanup operation from a previous installation attempt, which can be resolved with a system reboot. + +## Extend codes + +>[!IMPORTANT] +>Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update. + +Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation: + +1. Use the first digit to identify the phase (ex: 0x4000D = 4). +2. Use the last two digits to identify the operation (ex: 0x4000D = 0D). +3. Match the phase and operation to values in the tables provided below. + +The following tables provide the corresponding phase and operation for values of an extend code: + +
              + + + +
              Extend code: phase
              HexPhase +
              0SP_EXECUTION_UNKNOWN +
              1SP_EXECUTION_DOWNLEVEL +
              2SP_EXECUTION_SAFE_OS +
              3SP_EXECUTION_FIRST_BOOT +
              4SP_EXECUTION_OOBE_BOOT +
              5SP_EXECUTION_UNINSTALL +
              + + + + + + + +
              Extend code: operation
              + +
              HexOperation +
              0SP_EXECUTION_OP_UNKNOWN +
              1SP_EXECUTION_OP_COPY_PAYLOAD +
              2SP_EXECUTION_OP_DOWNLOAD_UPDATES +
              3SP_EXECUTION_OP_INSTALL_UPDATES +
              4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT +
              5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE +
              6SP_EXECUTION_OP_REPLICATE_OC +
              7SP_EXECUTION_OP_INSTALL_DRVIERS +
              8SP_EXECUTION_OP_PREPARE_SAFE_OS +
              9SP_EXECUTION_OP_PREPARE_ROLLBACK +
              ASP_EXECUTION_OP_PREPARE_FIRST_BOOT +
              BSP_EXECUTION_OP_PREPARE_OOBE_BOOT +
              CSP_EXECUTION_OP_APPLY_IMAGE +
              DSP_EXECUTION_OP_MIGRATE_DATA +
              ESP_EXECUTION_OP_SET_PRODUCT_KEY +
              FSP_EXECUTION_OP_ADD_UNATTEND +
              +
              + +
              HexOperation +
              10SP_EXECUTION_OP_ADD_DRIVER +
              11SP_EXECUTION_OP_ENABLE_FEATURE +
              12SP_EXECUTION_OP_DISABLE_FEATURE +
              13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS +
              14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS +
              15SP_EXECUTION_OP_CREATE_FILE +
              16SP_EXECUTION_OP_CREATE_REGISTRY +
              17SP_EXECUTION_OP_BOOT +
              18SP_EXECUTION_OP_SYSPREP +
              19SP_EXECUTION_OP_OOBE +
              1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT +
              1BSP_EXECUTION_OP_END_FIRST_BOOT +
              1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT +
              1DSP_EXECUTION_OP_END_OOBE_BOOT +
              1ESP_EXECUTION_OP_PRE_OOBE +
              1FSP_EXECUTION_OP_POST_OOBE +
              20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE +
              +
              + +For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**). + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
              [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications) +
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md deleted file mode 100644 index c6c73aa23e..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Upgrade Readiness - Additional insights -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Explains additional features of Upgrade Readiness. -ms.prod: w10 -audience: itpro -author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Additional insights - -This topic provides information on additional features that are available in Upgrade Readiness to provide insights into your environment. These include: - -- [Site discovery](#site-discovery): An inventory of web sites that are accessed by client computers running Windows 7, Windows 8.1, or Windows 10 using Internet Explorer. -- [Office add-ins](#office-add-ins): A list of the Microsoft Office add-ins that are installed on client computers. - -## Site discovery - -The IE site discovery feature in Upgrade Readiness provides an inventory of web sites that are accessed by client computers using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. Site discovery does not include sites that are accessed using other Web browsers, such as Microsoft Edge. Site inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data. - -> [!NOTE] -> Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. The data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees. -> -> IE site discovery is disabled on devices running Windows 7 and Windows 8.1 that are in Switzerland and EU countries. - -In order to use site discovery, a separate opt-in is required; see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started). - -### Review most active sites - -This blade indicates the most visited sites by computers in your environment. Review this list to determine which web applications and sites are used most frequently. The number of visits is based on the total number of views, and not by the number of unique devices accessing a page. - -For each site, the fully qualified domain name will be listed. You can sort the data by domain name or by URL. - -![Most active sites](../images/upgrade-analytics-most-active-sites.png) - -Click the name of any site in the list to drill down into more details about the visits, including the time of each visit and the computer name. - -![Site domain detail](../images/upgrade-analytics-site-domain-detail.png) - -### Review document modes in use - -This blade provides information about which document modes are used in the sites that are visited in your environment. Document modes are used to provide compatibility with older versions of Internet Explorer. Sites that use older technologies may require additional testing and are less likely to be compatible with Microsoft Edge. Counts are based on total page views and not the number of unique devices. For more information about document modes, see [Deprecated document modes](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/deprecated-document-modes). - -![Site activity by document mode](../images/upgrade-analytics-site-activity-by-doc-mode.png) - -### Run browser-related queries - -You can run predefined queries to capture more info, such as sites that have Enterprise Mode enabled, or the number of unique computers that have visited a site. For example, this query returns the most used ActiveX controls. You can modify and save the predefined queries. - -![](../images/upgrade-analytics-query-activex-name.png) - -## Office add-ins - -Office add-ins provides a list of the Microsoft Office add-ins in your environment, and enumerates the computers that have these add-ins installed. This information should not affect the upgrade decision workflow, but can be helpful to an administrator. - -## Related topics - -[Manage Windows upgrades with Upgrade Readiness](manage-windows-upgrades-with-upgrade-readiness.md) diff --git a/windows/deployment/upgrade/upgrade-readiness-architecture.md b/windows/deployment/upgrade/upgrade-readiness-architecture.md deleted file mode 100644 index e5d5a0d480..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-architecture.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Upgrade Readiness architecture (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Describes Upgrade Readiness architecture. -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness architecture - -Microsoft analyzes system, application, and driver diagnostic data to help you determine when computers are upgrade-ready, allowing you to simplify and accelerate Windows upgrades in your organization. The diagram below illustrates how Upgrade Readiness components work together in a typical installation. - - - -![Upgrade Readiness architecture](../images/ur-arch-diagram.png) - -After you enable Windows diagnostic data on user computers and install the compatibility update KB (1), user computers send computer, application and driver diagnostic data to a secure Microsoft data center through the Microsoft Data Management Service (2). After you configure Upgrade Readiness, diagnostic data is analyzed by the Upgrade Readiness Service (3) and pushed to your workspace (4). You can then use the Upgrade Readiness solution (5) to plan and manage Windows upgrades. - -For more information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see: - -[Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
              -[Manage connections from Windows operating system components to Microsoft services](/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services)
              -[Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965)
              - -## **Related topics** - -[Upgrade Readiness requirements](upgrade-readiness-requirements.md)
              -[Upgrade Readiness release notes](upgrade-readiness-requirements.md#important-information-about-this-release)
              -[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
              diff --git a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md deleted file mode 100644 index 0bbda9f3df..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Upgrade Readiness data sharing -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Connectivity scenarios for data sharing with Upgrade Readiness -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness data sharing - -To enable data sharing with the Upgrade Readiness solution, double-check the endpoints list in [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md#enable-data-sharing) to be sure they are whitelisted. - -## Connectivity to the Internet - -There are several different methods your organization can use to connect to the Internet, and these methods can affect how authentication is performed by the deployment script. - -### Direct connection to the Internet - -This scenario is very simple since there is no proxy involved. If you are using a network firewall which is blocking outgoing traffic, please keep in mind that even though we provide DNS names for the endpoints needed to communicate to the Microsoft diagnostic data backend, We therefore do not recommend to attempt to whitelist endpoints on your firewall based on IP-addresses. - -In order to use the direct connection scenario, set the parameter **ClientProxy=Direct** in **runconfig.bat**. - -### Connection through the WinHTTP proxy - -This is the first and most simple proxy scenario. The WinHTTP stack was designed for use in services and does not support proxy autodetection, PAC scripts or authentication. - -In order to set the WinHTTP proxy system-wide on your computers, you need to -- Use the command netsh winhttp set proxy \:\ -- Set ClientProxy=System in runconfig.bat - -The WinHTTP scenario is most appropriate for customers who use a single proxy. If you have more advanced proxy requirements, refer to Scenario 3. - -If you want to learn more about proxy considerations on Windows, see [Understanding Web Proxy Configuration](https://blogs.msdn.microsoft.com/ieinternals/2013/10/11/understanding-web-proxy-configuration/). - -### Logged-in user’s Internet connection - -In order to accommodate complex proxy scenarios, we also support using the currently logged-in user’s internet connection. This scenario supports PAC scripts, proxy autodetection and authentication. Essentially, if the logged in user can reach the Windows diagnostic data endpoints, the diagnostic data client can send data. If runconfig.bat runs while no user is logged in, diagnostic data events get written into a buffer which gets flushed when a user logs in. - -In order to enable this scenario, you need: -- A current quality update Rollup for Windows 7, 8.1 or Windows 10 Version 1511. Updates shipped after October 2016 have the needed code -- Set the reg key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\DisableEnterpriseAuthProxy to 0. If the value does not exist, create a new DWORD, name it DisableEnterpriseAuthProxy and set the value to 0. The deployment script will check this is configured correctly. -- Set ClientProxy=User in bat. - -> [!IMPORTANT] -> Using **Logged-in user's internet connection** with **DisableEnterpriseAuthProxy = 0** scenario is incompatible with ATP where the required value of that attribute is 1.(Read more here)[] - - - - - diff --git a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md b/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md deleted file mode 100644 index b097017757..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Upgrade Readiness - Get a list of computers that are upgrade ready (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Describes how to get a list of computers that are ready to be upgraded in Upgrade Readiness. -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 3: Deploy Windows - -All of your work up to now involved reviewing and resolving application and driver issues. Along the way, as you’ve resolved issues and decided which applications and drivers are ready to upgrade, you’ve been building a list of computers that are upgrade ready. -The blades in the **Deploy** section are: - -- [Deploy eligible computers](#deploy-eligible-computers) -- [Deploy computers by group](#computer-groups) - ->Computers that are listed in this step are assigned an **UpgradeDecision** value, and the total count of computers in each upgrade decision category is displayed. Additionally, computers are assigned an **UpgradeAssessment** value. This value is displayed by drilling down into a specific upgrade decision category. For information about upgrade assessment values, see [Upgrade assessment](#upgrade-assessment). - -## Deploy eligible computers - -In this blade, computers grouped by upgrade decision are listed. The upgrade decision on the machines is a calculated value based on the upgrade decision status for the apps and drivers installed on the computer. This value cannot be modified directly. The upgrade decision is calculated in the following ways: -- **Review in progress**: At least one app or driver installed on the computer is marked **Review in progress**. -- **Ready to upgrade**: All apps and drivers installed on the computer are marked as **Ready to Upgrade**. -- **Won’t upgrade**: At least one app or driver installed on the computer is marked as **Won’t upgrade**, or a system requirement is not met. - - - -![Deploy eligible computers](../images/ua-cg-16.png) - -Select **Export computers** for more details, including computer name, manufacturer and model, and Windows edition currently running on the computer. Sort or further query the data and then select **Export** to generate and save a comma-separated value (csv) list of upgrade-ready computers. - ->**Important**
              When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time. - -## Computer groups - -Computer groups allow you to segment your environment by creating device groups based on log search results, or by importing groups from Active Directory, WSUS or System Center Configuration Manager. Computer groups are an OMS feature. For more information, see [Computer groups in OMS](https://blogs.technet.microsoft.com/msoms/2016/04/04/computer-groups-in-oms/). - -Query based computer groups are recommended in the initial release of this feature. A feature known as **Configuration Manager Upgrade Readiness Connector** is anticipated in a future release that will enable synchronization of **ConfigMgr Collections** with computer groups in OMS. - -### Getting started with Computer Groups - -When you sign in to OMS, you will see a new blade entitled **Computer Groups**. See the following example: - -![Computer groups](../images/ua-cg-01.png) - -To create a computer group, open **Log Search** and create a query based on **Type=UAComputer**, for example: - -``` -Type=UAComputer Manufacturer=DELL -``` - -![Computer groups](../images/ua-cg-02.png) - -When you are satisfied that the query is returning the intended results, add the following text to your search: - -``` -| measure count() by Computer -``` - -This will ensure every computer only shows up once. Then, save your group by clicking **Save** and **Yes**. See the following example: - -![Computer groups](../images/ua-cg-03.png) - -Your new computer group will now be available in Upgrade Readiness. See the following example: - -![Computer groups](../images/ua-cg-04.png) - -### Using Computer Groups - -When you drill into a computer group, you will see that computers are categorized by **UpgradeDecision**. For computers with the status **Review in progress** or **Won’t upgrade** you can drill down to view issues that cause a computer to be in each category, or you can simply display a list of the computers in the category. For computers that are designated **Ready to upgrade**, you can go directly to the list of computers that are ready. - -![Computer groups](../images/ua-cg-05.png) - -Viewing a list of computers in a certain status is self-explanatory, Let’s look at what happens when you click the details link on **Review in progress**: - -![Computer groups](../images/ua-cg-06.png) - -Next, select if you want to see application issues (**UAApp**) or driver issues (**UADriver**). See the following example of selecting **UAApp**: - -![Computer groups](../images/ua-cg-07.png) - -A list of apps that require review so that Dell Computers are ready for upgrade to Windows 10 is displayed. - -### Upgrade assessment - -Upgrade assessment and guidance details are explained in the following table. - -| Upgrade assessment | Action required before or after upgrade pilot? | Issue | What it means | Guidance | -|-----------------------|------------------------------------------------|----------|-----------------|---------------| -| No known issues | No | None | Computers will upgrade seamlessly.
              | OK to use as-is in pilot. | -| OK to pilot, fixed during upgrade | No, for awareness only | Application or driver will not migrate to new OS | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | OK to use as-is in pilot. | -| OK to pilot with new driver from Windows Update | Yes | Driver will not migrate to new OS | The currently installed version of a driver won’t migrate to the new operating system; however, a newer, compatible version is available from Windows Update. | Although a compatible version of the driver is installed during upgrade, a newer version is available from Windows Update.

              If the computer automatically receives updates from Windows Update, no action is required. Otherwise, replace the new in-box driver with the Windows Update version after upgrading.

              | - -Select **Export computers** to view pilot-ready computers organized by operating system. After you select the computers you want to use in a pilot, click Export to generate and save a comma-separated value (csv) file. - ->**Important**> When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time. diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md deleted file mode 100644 index 8ad77cca4e..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ /dev/null @@ -1,191 +0,0 @@ ---- -title: Upgrade Readiness deployment script (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Deployment script for Upgrade Readiness. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness deployment script - -To automate the steps provided in [Get started with Upgrade Readiness](upgrade-readiness-get-started.md), and to troubleshoot data sharing issues, you can run the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft. - ->[!IMPORTANT] ->Upgrade Readiness was previously called Upgrade Analytics. References to Upgrade Analytics in any scripts or online content pertain to the Upgrade Readiness solution. - ->[!IMPORTANT] ->The latest version of the Upgrade Readiness Script is **2.4.4 - 10.10.2018** - -For detailed information about using the Upgrade Readiness (also known as upgrade analytics) deployment script, see the [Upgrade Analytics blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/New-version-of-the-Upgrade-Analytics-Deployment-Script-available/ba-p/187164?advanced=false&collapse_discussion=true&q=new%20version%20of%20the%20upgrade%20analytics%20deployment%20script%20available&search_type=thread). - -> The following guidance applies to version **2.4.4 - 10.10.2018** of the Upgrade Readiness deployment script. If you are using an older version, download the latest from the [Download Center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409). - -The Upgrade Readiness deployment script does the following: - -1. Sets commercial ID key + CommercialDataOptIn + RequestAllAppraiserVersions keys. -2. Verifies that user computers can send data to Microsoft. -3. Checks whether the computer has a pending restart.   -4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14348 or later is required, but version 10.0.14913 or later is recommended). -5. If enabled, turns on verbose mode for troubleshooting. -6. Initiates the collection of the diagnostic data that Microsoft needs to assess your organization’s upgrade readiness. -7. If enabled, displays the script’s progress in a cmd window, providing you immediate visibility into issues (success or fail for each step) and/or writes to log file. - -## Running the script - ->There should be no performance impact caused by the script. The script is a light wrapper of Windows in-box components that undergo performance testing and optimization to avoid any performance impact. However, typically the script is scheduled to be run outside of working hours. -> ->Do not run the script at each sign-on. It is recommended to run the script once every 30 days. -> ->The length of time the script takes to run on each system depends on the number of apps and drivers, and the type of hardware. Anti-virus software scanning simultaneously can increase the script run time, but the script should require no longer than 10 minutes to run, and typically the time is much shorter. If the script is observed running for an extended period of time, please run the Pilot script, and collect logs to share with Microsoft. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. - -To run the Upgrade Readiness deployment script: - -1. Download the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract the .zip file. Inside, there are two folders: **Pilot** and **Deployment**. The **Pilot** folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The **Deployment** folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. - -2. Edit the following parameters in RunConfig.bat: - - 1. Provide a storage location for log information. You can store log information on a remote file share or a local directory. If the script is blocked from creating the log file for the given path, it creates the log files in the drive with the Windows directory. Example: %SystemDrive%\\UADiagnostics - - 2. Input your commercial ID key. To find your commercial ID, first navigate to the **Solutions** tab for your workspace, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID: - - 3. By default, the script sends log information to both the console and the log file. To change the default behavior, use one of the following options: - - > *logMode = 0 log to console only* - > - > *logMode = 1 log to file and console* - > - > *logMode = 2 log to file only* - -3. To enable Internet Explorer data collection, set AllowIEData to IEDataOptIn. By default, AllowIEData is set to Disable. Then use one of the following options to determine what Internet Explorer data can be collected: - - > *IEOptInLevel = 0 Internet Explorer data collection is disabled* - > - > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* - > - > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* - > - > *IEOptInLevel = 3 Data collection is enabled for all sites* - -4. The deployment script is configured to collect and send diagnostic and debugging data to Microsoft. If you wish to disable sending diagnostic and debugging data to Microsoft, set **AppInsightsOptIn = false**. By default, **AppInsightsOptIn** is set to **true**. - - The data that is sent is the same data that is collected in the text log file that captures the events and error codes while running the script. This file is named in the following format: **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. - - This data gives us the ability to determine the status of your machines and to help troubleshoot issues. If you choose to opt-in to and send this data to Microsoft, you must also allow https traffic to be sent to the following wildcard endpoints: - - \*vortex\*.data.microsoft.com
              - \*settings\*.data.microsoft.com - -5. The deployment script configures insider builds to continue to send the device name to the diagnostic data management service and the analytics portal. If you do not want to have insider builds send the device name sent to analytics and be available in the analytics portal, set **DeviceNAmeOptIn = false**. By default it is true, which preserves the behavior on previous versions of Windows. This setting only applies to insider builds. Note that the device name is also sent to AppInsights, so to ensure the device name is not sent to either place you would need to also set **AppInsightsOptIn = false**. - -6. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. - -## Exit codes - -The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. - -| Exit code | Suggested fix | -|-----------|--------------| -| 0 - Success | N/A | -| 1 - Unexpected error occurred while executing the script. | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966) from the download center and try again. | -| 2 - Error when logging to console. $logMode = 0. (console only) | Try changing the $logMode value to **1** and try again. $logMode value 1 logs to both console and file. | -| 3 - Error when logging to console and file. $logMode = 1. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 4 - Error when logging to file. $logMode = 2. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 5 - Error when logging to console and file. $logMode = unknown. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 6 - The commercialID parameter is set to unknown. | Modify the runConfig.bat file to set the CommercialID value. The value for parameter in the runconfig.bat file should match the Commercial ID key for your workspace. See [Generate your Commercial ID key](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#generate-your-commercial-id-key) for instructions on generating a Commercial ID key for your workspace. | -| 8 - Failure to create registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection**. The Commercial Id property is set at the following registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | -| 9 - The script failed to write Commercial Id to registry. -Error creating or updating registry key: **CommercialId** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | -| 10 - Error when writing **CommercialDataOptIn** to the registry at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the deployment script is running in a context that has access to the registry key. | -| 11 - Function **SetupCommercialId** failed with an unexpected exception. The **SetupCommercialId** function updates the Commercial Id at the registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the configuration script has access to this location. | -| 12 - Can’t connect to Microsoft - Vortex. Check your network/proxy settings. | **Http Get** on the end points did not return a success exit code. For Windows 10, connectivity is verified by connecting to https://v10.vortex-win.data.microsoft.com/health/keepalive. For previous operating systems, connectivity is verified by connecting to https://vortex-win.data.microsoft.com/health/keepalive. If there is an error verifying connectivity, this will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) | -| 13 - Can’t connect to Microsoft - setting. | An error occurred connecting to https://settings.data.microsoft.com/qos. This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#enable-data-sharing). Verify that the required endpoints are whitelisted correctly. See Whitelist select endpoints for more details. | -| 14 - Can’t connect to Microsoft - compatexchange. An error occurred connecting to [CompatibilityExchangeService.svc](https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc). | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). | -| 15 - Function CheckVortexConnectivity failed with an unexpected exception. | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). Check the logs for the exception message and the HResult. | -| 16 - The computer requires a reboot before running the script. | Restart the device to complete the installation of the compatibility update and related updates. Reboot the computer before running the Upgrade Readiness deployment script. | -| 17 - Function **CheckRebootRequired** failed with an unexpected exception. | Restart the device to complete installation of the compatibility update and related updates. Check the logs for the exception message and the HResult. | -|18 - Appraiser KBs not installed or **appraiser.dll** not found. | Either the Appraiser-related updates are not installed, or the **appraiser.dll** file was not found. For more information, see appraiser diagnostic data events and fields information in the [Data collection](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#data-collection-and-privacy) and privacy topic. | -| 19 - Function **CheckAppraiserKB**, which checks the compatibility update KBs, failed with unexpected exception. | Check the logs for the Exception message and HResult. The script will not run further if this error is not fixed. | -| 20 - An error occurred when creating or updating the registry key **RequestAllAppraiserVersions** at **HKLM:\SOFTWARE\Microsoft\WindowsNT \CurrentVersion\AppCompatFlags\Appraiser** | The registry key is required for data collection to work correctly. Verify that the script is running in a context that has access to the registry key. | -| 21 - Function **SetRequestAllAppraiserVersions** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 22 - **RunAppraiser** failed with unexpected exception. | Check the logs for the exception message and HResult. Check the **%windir%\System32** directory for the file **CompatTelRunner.exe**. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization's Group Policy to verify it does not remove this file. | -| 23 - Error finding system variable **%WINDIR%**. | Verify that this environment variable is configured on the computer. | -| 24 - The script failed when writing **IEDataOptIn** to the registry. An error occurred when creating registry key **IEOptInLevel** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | This is a required registry key for IE data collection to work correctly. Verify that the deployment script in running in a context that has access to the registry key. Check the logs for the exception message and HResult. | -| 25 - The function **SetIEDataOptIn** failed with unexpected exception. | Check the logs for the exception message and HResult. | -| 27 - The script is not running under **System** account. | The Upgrade Readiness configuration script must be run as **System**. | -| 28 - Could not create log file at the specified **logPath**. | Make sure the deployment script has access to the location specified in the **logPath** parameter. | -| 29 - Connectivity check failed for proxy authentication. | Install cumulative updates on the device and enable the **DisableEnterpriseAuthProxy** authentication proxy setting. The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [Authentication proxy support added in new version (12.28.16) of the Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?linkid=838688). | -| 30 - Connectivity check failed. Registry key property **DisableEnterpriseAuthProxy** is not enabled. | The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). | -| 31 - There is more than one instance of the Upgrade Readiness data collector running at the same time on this computer. Use Task Manager to check if **CompatTelRunner.exe** is running, and wait until it has completed to rerun the script. The Upgrade Readiness task is scheduled by default to run daily at 0300. | -| 32 - Appraiser version on the machine is outdated. | The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1. | -| 33 - **CompatTelRunner.exe** exited with an exit code | **CompatTelRunner.exe** runs the appraise task on the device. If it fails, it will provide a specific exit code. The script will return exit code 33 when **CompatTelRunner.exe** itself exits with an exit code. Check the logs for more details. Also see the **Note** following this table for additional steps to follow. | -| 34 - Function **CheckProxySettings** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 35 - Function **CheckAuthProxy** failed with an unexpected exception. Check the logs for the exception message and HResult. | -| 36 - Function **CheckAppraiserEndPointsConnectivity** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 37 - **Diagnose_internal.cmd** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 38 - Function **Get-SqmID** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 39 - For Windows 10: AllowTelemetry property is not set to 1 or higher at registry key path **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection** or **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | For Windows 10 devices, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will return an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). | -| 40 - Function **CheckTelemetryOptIn** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 41 - The script failed to impersonate the currently logged on user. | The script mimics the UTC client to collect upgrade readiness data. When auth proxy is set, the UTC client impersonates the user that is logged on. The script also tries to mimic this, but the process failed. | -| 42 - Function **StartImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 43 - Function **EndImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 44 - Diagtrack.dll version is old, so Auth Proxy will not work. | Update the device using Windows Update or Windows Server Update Services. | -| 45 - Diagtrack.dll was not found. | Update the device using Windows Update or Windows Server Update Services. | -| 48 - **CommercialID** mentioned in RunConfig.bat should be a GUID. | Copy the commercial ID from your workspace. To find your commercial ID, first navigate to the Solutions tab for your workspace in Azure Portal, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID.| -| 50 - Diagtrack Service is not running. | The Diagtrack service is required to send data to Microsoft. Enable and run the "Connected User Experiences and Telemetry" service. | -| 51 - RunCensus failed with an unexpected exception. | RunCensus explitly runs the process used to collect device information. The method failed with an unexpected exception. The most common cause is incorrect setup of diagnostic data. Check the ExceptionHResult and ExceptionMessage for more details. | -| 52 - DeviceCensus.exe not found on a Windows 10 machine. | On computers running Windows 10, the process devicecensus.exe should be present in the \system32 directory. Error code 52 is returned if the process was not found. Ensure that it exists at the specified location. | -| 53 - There is a different CommercialID present at the GPO path: **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection**. This will take precedence over the CommercialID provided in the script. | Provide the correct CommercialID at the GPO location. | -| 54 - Microsoft Account Sign In Assistant Service is Disabled. | This service is required for devices running Windows 10. The diagnostic data client relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). | -| 55 - SetDeviceNameOptIn function failed to create registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | The function SetDeviceNameOptIn sets the registry key value which determines whether to send the device name in diagnostic data. The function tries to create the registry key path if it does not already exist. Verify that the account has the correct permissions to change or add registry keys. | -| 56 - SetDeviceNameOptIn function failed to create property AllowDeviceNameInTelemetry at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys.| -| 57 - SetDeviceNameOptIn function failed to update AllowDeviceNameInTelemetry property to value 1 at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys. | -| 58 - SetDeviceNameOptIn function failed with unexpected exception | The function SetDeviceNameOptIn failed with an unexpected exception. | -| 59 - CleanupOneSettings failed to delete LastPersistedEventTimeOrFirstBoot property at registry key path: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Diagtrack** |The CleanupOneSettings function clears some of the cached values needed by the Appraiser which is the data collector on the monitored device. This helps in the download of the most recent for accurate running of the data collector. Verify that the account has the correct permissions to change or add registry keys. | -| 60 - CleanupOneSettings failed to delete registry key: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ Diagnostics\Diagtrack\SettingsRequests** | Verify that the account has the correct permissions to change or add registry keys. | -| 61 - CleanupOneSettings failed with an exception | CleanupOneSettings failed with an unexpected exception. | -| 62 - AllowTelemetry property value at registry key path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** is not of type REG_DWORD. It should be of type REG_DWORD. | Ensure that the **AllowTelemetry** property at path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** is a REG_DWORD. | -| 63 - Diagnostic data is disabled for the device | If AllowTelemetry equals **0**, devices cannot send diagnostic data. To resolve this, set the **AllowTelemetry** value at **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection**. | -| 64 - AllowTelemetry property value at registry key path **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is not of type REG_DWORD. It should be of type REG_DWORD. | Ensure that the **AllowTelemetry** property at **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is a REG_DWORD. | -| 65 - Diagnostic data is disabled for the device | If AllowTelemetry equals **0**, devices cannot send diagnostic data. To resolve this, set the **AllowTelemetry** value at **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection**. | -| 66 - All recent data uploads for the Universal Telemetry Client failed. | Review the UtcConnectionReport in WMI in the namespace **root\cimv2\mdm\dmmap** under the **MDM_Win32CompatibilityAppraiser_UniversalTelemetryClient01** class. Only SYSTEM has access to this class. Use [PSExec](https://docs.microsoft.com/sysinternals/downloads/psexec) to execute your WMI utility as SYSTEM. | -| 67 - CheckUtcCsp failed with an exception | There was an error reading the WIM/CIM class **MDM_Win32CompatibilityAppraiser_UniversalTelemetryClient01** in the namespace **root\cimv2\mdm\dmmap**. Review system for WMI errors. | - - - - - - -> [!NOTE] -> **Additional steps to follow if you receive exit code 33** -> -> Check the exit code for any of these messages: -> -> - CompatTelRunner.exe exited with last error code: 0x800703F1 -> - CompatTelRunner.exe exited with last error code: 0x80070005 -> - CompatTelRunner.exe exited with last error code: 0x80080005 ->  -> -> If the exit code includes any of those messages, then run these commands from an elevated command prompt: -> -> 1. Net stop diagtrack -> 2. Net stop pcasvc -> 3. Net stop dps -> 4. Del %windir%\appcompat\programs\amcache.hve -> 5. reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v AmiHivePermissionsCorrect /f -> 6. reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v LogFlags /t REG_DWORD /d 4 /f -> 7. Net start diagtrack -> 8. Net start pcasvc -> 9. Net start dps -> -> Then run the Enterprise Config script (RunConfig.bat) again. -> -> If the script still fails, then contact support@microsoft.com and share the log files from the RunConfig.bat script. These log files are stored on the drive that is specified in the RunConfig.bat file. By default this is set to **%SystemDrive%\UADiagnostics**. The log file is named with the format **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. There will be some additional logs generated under your **\\Windows\Temp** directory with the names similar to **AslLog_....txt**. You should send those logs as well. - diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md deleted file mode 100644 index 47a7fc7fe2..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Get started with Upgrade Readiness (Windows 10) -ms.reviewer: -manager: laurawi -description: Explains how to get started with Upgrade Readiness. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.localizationpriority: medium -ms.topic: article -ms.collection: M365-analytics ---- - -# Get started with Upgrade Readiness - ->[!IMPORTANT] ->**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition). - -This topic explains how to obtain and configure Upgrade Readiness for your organization. - -You can use Upgrade Readiness to plan and manage your upgrade project end-to-end. Upgrade Readiness works by establishing communications between computers in your organization and Microsoft. Upgrade Readiness collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft. - -Before you begin, consider reviewing the following helpful information:
              - - [Upgrade Readiness requirements](upgrade-readiness-requirements.md): Provides detailed requirements to use Upgrade Readiness.
              - - [Upgrade Readiness blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/bg-p/WindowsAnalyticsBlog): Contains announcements of new features and provides helpful tips for using Upgrade Readiness. - ->If you are using System Center Configuration Manager, also check out information about how to integrate Upgrade Readiness with Configuration Manager: [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics). - -When you are ready to begin using Upgrade Readiness, perform the following steps: - -1. Review [data collection and privacy](#data-collection-and-privacy) information. -2. [Add the Upgrade Readiness solution to your Azure subsctiption](#add-the-upgrade-readiness-solution-to-your-azure-subscription). -3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics). -4. [Use Upgrade Readiness to manage Windows Upgrades](#use-upgrade-readiness-to-manage-windows-upgrades) once your devices are enrolled. - -## Data collection and privacy - -To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information. - -## Add the Upgrade Readiness solution to your Azure subscription - -Upgrade Readiness is offered as a *solution* which you link to a new or existing [Azure Log Analytics](https://azure.microsoft.com/services/log-analytics/) *workspace* within your Azure *subscription*. To configure this, follows these steps: - -1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. - - >[!NOTE] - > Upgrade Readiness is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Upgrade Readiness, but no Azure charges are expected to accrue to the subscription as a result of using Upgrade Readiness. - -2. In the Azure portal select **Create a resource**, search for "Upgrade Readiness", and then select **Create** on the **Upgrade Readiness** solution. - ![Azure portal page highlighting + Create a resource and with Upgrade Readiness selected](../images/UR-Azureportal1.png) - - ![Azure portal showing Upgrade Readiness fly-in and Create button highlighted(images/CreateSolution-Part2-Create.png)](../images/UR-Azureportal2.png) -3. Choose an existing workspace or create a new workspace to host the Upgrade Readiness solution. - ![Azure portal showing Log Analytics workspace fly-in](../images/UR-Azureportal3.png) - - If you are using other Windows Analytics solutions (Device Health or Update Compliance) you should add Upgrade Readiness to the same workspace. - - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: - - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. - - For the resource group setting select **Create new** and use the same name you chose for your new workspace. - - For the location setting, choose the Azure region where you would prefer the data to be stored. - - For the pricing tier select **per GB**. -4. Now that you have selected a workspace, you can go back to the Upgrade Readiness blade and select **Create**. - ![Azure portal showing workspace selected and with Create button highlighted](../images/UR-Azureportal4.png) -5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.CompatibilityAssessmentOMS' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear. - ![Azure portal all services page with Log Analytics found and selected as favorite](../images/CreateSolution-Part5-GoToResource.png) - - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Upgrade Readiness solution. - - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour. - -## Enroll devices in Windows Analytics - - -Once you've added Upgrade Readiness to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started). - - - -## Use Upgrade Readiness to manage Windows Upgrades - -Now that your devices are enrolled, you can move on to [Use Upgrade Readiness to manage Windows Upgrades](https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades). diff --git a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md b/windows/deployment/upgrade/upgrade-readiness-identify-apps.md deleted file mode 100644 index 4c4477de3c..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Upgrade Readiness - Identify important apps (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Describes how to prepare your environment so that you can use Upgrade Readiness to manage Windows upgrades. -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 1: Identify important apps - -This is the first step of the Upgrade Readiness workflow. In this step, applications are listed and grouped by importance level. Setting the importance level enables you to prioritize applications for upgrade. - - - -![Prioritize applications](../images/upgrade-analytics-prioritize.png) - -Select **Assign importance** to change an application’s importance level. By default, applications are marked **Not reviewed** or **Low install count** until you assign a different importance level to them. - -To change an application’s importance level: - -1. Select **Not reviewed** or **Low install count** on the **Prioritize applications** blade to view the list of applications with that importance level. -2. Select the applications you want to change to a specific importance level and then select the appropriate option from the **Select importance level** list. -3. Click **Save** when finished. - -Importance levels include: - -| Importance level | When to use it | Recommendation | -|--------------------|------------------|------------------| -| Low install count | We give you a head start by identifying applications that are installed on 2% or less of your total computer inventory. \[Number of computers application is installed on/total number of computers in your inventory.\]

              Low install count applications are automatically marked as **Ready to upgrade** in the **UpgradeDecision** column unless they have issues that need attention.
              | Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates. For example, payroll apps or tax accounting apps tend to be installed on a relatively small number of machines but are still considered business critical applications.

              | -| Not reviewed | Applications that are installed on more than 2% of your total computer inventory are marked not reviewed until you set their importance level.

              | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. | -| Business critical | By default, no applications are marked as business critical because only you can make that determination. If you know that an application is critical to your organization’s functioning, mark it **Business critical**.

              | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this business critical application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
              | -| Important | By default, no applications are marked as important because only you can make that determination. If the application is important but not critical to your organization’s functioning, mark it **Important**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this important application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
              | -| Ignore | By default, no applications are marked as ignore because only you can make that determination. If the application is not important to your organization’s functioning, such as user-installed applications and games, you may not want to spend time and money validating that these applications will migrate successfully. Mark these applications **Ignore**.
              | Set the application’s importance level to **Ignore** to let other team members know that it can be left as-is with no further investigation or testing. If you set the importance level to ignore, and this is an app that you are not planning on testing or validating, consider changing the upgrade decision to **Ready to upgrade**. By marking these apps ready to upgrade, you are indicating that you are comfortable upgrading with the app remaining in its current state.

              | -| Review in progress | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns.
              | As you learn more about the application’s importance to your organization’s functioning, change the importance level to **Business critical**, **Important**, or **Ignore**.

              Until you’ve determined that priority applications will migrate successfully, leave the upgrade decision status as **Review in progress**.
              | - diff --git a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md b/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md deleted file mode 100644 index 1aee2eb281..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Monitor deployment with Upgrade Readiness -ms.reviewer: -manager: laurawi -description: Describes how to use Upgrade Readiness to monitor the deployment after Windows upgrades. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.localizationpriority: medium -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.author: greglin -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 4: Monitor - -Now that you have started deploying an update with Upgrade Readiness, you can use it to monitor important elements. - -![Upgrade Readiness dialog showing "STEP 4: Monitor" and blades for "Update progress," "Driver issues," and "User feedback"](../images/UR-monitor-main.png) - - -## Update progress - -The **Update progress** blade allows you to monitor the progress and status of your deployment. Any device that has attepted to upgrade in the last 30 days displays the **DeploymentStatus** attribute. You'll be able to see the number of computers that have successfully upgraded, failed to upgrade, are stalled, etc. - - -Selecting this blade allows you to view device-level details about the deployment. For example, select **Failed** to view the original operating system version, the target operating system version, and the reason the update failed for each of the devices that failed to upgrade. In the case of the device illustrated in the following image, an attempt was made to upgrade from Windows 10, version 1703 to 1709, but the operation timed out. - -!["Update progress" blade showing detailed information after selecting the "failed" item](../images/UR-update-progress-failed-detail.png) - - -## Driver issues - -The **Driver issues** blade allows you to see Device Manager errors for your upgraded devices. We include data for all compatibility-related device errors, such as "driver not found" and "driver not started." The blade summarizes errors by error type, but you can select a particular error type to see device-level details about which device(s) are failing and where to obtain a driver. - - -For example, by selecting error code **28 - driver not installed**, you would see that the device in the following image is missing the driver for a network controller. Upgrade Readiness also notifies that a suitable driver is available online through Windows Update. If this device is configured to automatically receive updates from Windows Update, this issue would likely resolve itself following the device's next Windows Update scan. If this device does not automatically receive updates from Windows Update, you would need to deliver the driver manually. - -!["Driver issue" blade showing detailed information after selecting a specific driver error](../images/UR-driver-issue-detail.png) - -## User feedback - -The **User Feedback** blade focuses on gathering subjective feedback from your end users. If a user submits feedback through the Feedback Hub app on a device in your workspace, we will make that feedback visible to you in this blade. The Feedback Hub app is built into Windows 10 and can be accessed by typing "Feedback Hub" in the Cortana search bar. - - -We recommend that you encourage your end users to submit any feedback they have through Feedback Hub. Not only will this feedback be sent directly to Microsoft for review, but you'll also be able to see it by using Upgrade Readiness. You should be aware that **feedback submitted through Feedback Hub will be publicly visible**, so it's best to avoid submitting feedback about internal line-of-business applications. - -When viewing user feedback in Upgrade Readiness, you'll be able to see the raw "Title" and "Feedback" text from the user's submission in Feedback Hub, as well as the number of upvotes the submission has received. (Since feedback is publicly visible, the number of upvotes is a global value and not specific to your company.) If a Microsoft engineer has responded to the submission in Feedback Hub, we'll pull in the Microsoft response for you to see as well. - -![Example user feedback item](../images/UR-example-feedback.png) - diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md deleted file mode 100644 index 3078890be7..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Upgrade Readiness requirements (Windows 10) -ms.reviewer: -manager: laurawi -description: Provides requirements for Upgrade Readiness. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.author: greglin -ms.localizationpriority: medium -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness requirements - -This article introduces concepts and steps needed to get up and running with Upgrade Readiness. We recommend that you review this list of requirements before getting started as you may need to collect information, such as account credentials, and get approval from internal IT groups, such as your network security group, before you can start using Upgrade Readiness. - -## Supported upgrade paths - -### Windows 7 and Windows 8.1 - -To perform an in-place upgrade, user computers must be running the latest version of either Windows 7 SP1 or Windows 8.1. After you enable Windows diagnostic data, Upgrade Readiness performs a full inventory of computers so that you can see which version of Windows is installed on each computer. - -The compatibility update that sends diagnostic data from user computers to Microsoft data centers works with Windows 7 SP1 and Windows 8.1 only. Upgrade Readiness cannot evaluate Windows XP or Windows Vista for upgrade eligibility. - - - -If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Windows Update or download and deploy the applicable package from the Microsoft Download Center. - -> [!NOTE] -> Upgrade Readiness is designed to best support in-place upgrades. In-place upgrades do not support migrations from BIOS to UEFI or from 32-bit to 64-bit architecture. If you need to migrate computers in these scenarios, use the wipe-and-reload method. Upgrade Readiness insights are still valuable in this scenario, however, you can ignore in-place upgrade specific guidance. - -See [Windows 10 Specifications](https://www.microsoft.com/en-US/windows/windows-10-specifications) for additional information about computer system requirements. - -### Windows 10 - -Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates. -The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com). - -While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC. - -## Operations Management Suite or Azure Log Analytics - -Upgrade Readiness is offered as a solution in Azure Portal and Azure Log Analytics, a collection of cloud-based services for managing on premises and cloud computing environments. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). - -If you’re already using Azure Portal or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace. - -If you are not using Azure Portal or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. - ->[!IMPORTANT] ->You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to Azure Portal. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in Azure Portal. You also need an Azure subscription to link to your Azure Portal workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. - -## System Center Configuration Manager integration - -Upgrade Readiness can be integrated with your installation of Configuration Manager. For more information, see [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics). - - - -## Important information about this release - -Before you get started configuring Upgrade Anatlyics, review the following tips and limitations about this release. - -**Upgrade Readiness does not support on-premises Windows deployments.** Upgrade Readiness is built as a cloud service, which allows Upgrade Readiness to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premises. - -**In-region data storage requirements.** Windows diagnostic data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in Azure Portal. Upgrade Readiness is supported in all Azure regions; however, selecting an international Azure region does not prevent diagnostic data from being sent to and processed in Microsoft's secure data centers in the US. - -### Tips - -- When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export a list with fewer items. - -- Sorting data by clicking a column heading may not sort your complete list of items. For information about how to sort data in Azure Portal, see [Sorting DocumentDB data using Order By](https://azure.microsoft.com/documentation/articles/documentdb-orderby). - -## Get started - -See [Get started with Upgrade Readiness](upgrade-readiness-get-started.md) for detailed, step-by-step instructions for configuring Upgrade Readiness and getting started on your Windows upgrade project. diff --git a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md deleted file mode 100644 index 6d2a66ecdc..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: Upgrade Readiness - Resolve application and driver issues (Windows 10) -ms.reviewer: -manager: laurawi -description: Describes how to resolve application and driver issues that can occur during an upgrade with Upgrade Readiness. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.author: greglin -ms.localizationpriority: medium -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 2: Resolve app and driver issues - -This section of the Upgrade Readiness workflow reports application and driver inventory and shows you which applications have known issues, which applications have no known issues, and which drivers have issues. We identify applications and drivers that need attention and suggest fixes when we know about them. - -## In this section - -The blades in the **Step 2: Resolve issues** section are: - -- [Review applications with known issues](#review-applications-with-known-issues) -- [Review known driver issues](#review-drivers-with-known-issues) -- [Review low-risk apps and drivers](#review-low-risk-apps-and-drivers) -- [Prioritize app and driver testing](#prioritize-app-and-driver-testing) - ->You can change an application’s upgrade decision and a driver’s upgrade decision from the blades in this section. To change an application’s or a driver’s importance level, select **User changes**. Select the item you want to change and then select the appropriate option from the **Select upgrade decision** list. - -Upgrade decisions include: - - -| Upgrade decision | When to use it | Guidance | -|--------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Not reviewed | All drivers are marked as Not reviewed by default.

              Any app that has not been marked **Low install count** will also have an upgrade decision of **Not reviewed** by default.
              | Apps you have not yet reviewed or are waiting to review later should be marked as **Not reviewed**. When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress**.

              | -| Review in progress | When you start to investigate an application or a driver to determine upgrade readiness, change its upgrade decision to **Review in progress**.

              Until you’ve determined that applications and drivers will migrate successfully or you’ve resolved blocking issues, leave the upgrade decision status as **Review in progress**.

              | Once you’ve fixed any issues and validated that the application or driver will migrate successfully, change the upgrade decision to **Ready to upgrade**.
              | -| Ready to upgrade | Mark applications and drivers **Ready to upgrade** once you’ve resolved all blocking issues and you’re confident that they will upgrade successfully, or if you’ve decided to upgrade them as-is. | Applications with no known issues and with low installation rates are marked **Ready to upgrade** by default.

              In Step 1, you might have marked some of your apps as **Ignore**. These should be marked as **Ready to upgrade**. Apps with low installation rates are marked as **Ready to upgrade** by default. Be sure to review any low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates.
              | -| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination.

              Use **Won’t upgrade** for applications and drivers that you do not work on your target operating system, or that you are unable to upgrade.
              | If, during your investigation into an application or driver, you determine that they should not or cannot be upgraded, mark them **Won’t upgrade**.

              | - -As you review applications with known issues, you can also see ISV support statements or applications using [Ready for Windows](https://www.readyforwindows.com/). - -## Review applications with known issues - -Applications with issues known to Microsoft are listed, grouped by upgrade assessment into **Attention needed** or **Fix available**. - - - -![Review applications with known issues](../images/upgrade-analytics-apps-known-issues.png) - -To change an application's upgrade decision: - -1. Select **Decide upgrade readiness** to view applications with issues. -2. In the table view, select an **UpgradeDecision** value. -3. Select **Decide upgrade readiness** to change the upgrade decision for each application. -4. Select the applications you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list. -5. Click **Save** when finished. - -IMPORTANT: Ensure that you have the most recent versions of the compatibility update and related KBs installed to get the most up-to-date compatibility information. - -For applications assessed as **Attention needed**, review the table below for details about known issues and for guidance about how to resolve them, when possible. - -| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance | -|--------------------|-----------------------------------|-----------|-----------------|------------| -| Attention needed | No | Application is removed during upgrade | Compatibility issues were detected and the application will not migrate to the new operating system.
              | No action is required for the upgrade to proceed. | -| Attention needed | Yes | Blocking upgrade | Blocking issues were detected and Upgrade Readiness is not able to remove the application during upgrade.

              The application may work on the new operating system.
              | Remove the application before upgrading, and reinstall and test on new operating system. | -| Attention needed | No | Evaluate application on new OS | The application will migrate, but issues were detected that may impact its performance on the new operating system. | No action is required for the upgrade to proceed, but be sure to test the application on the new operating system.
              | -| Attention needed | No | Does not work with new OS, but won’t block upgrade | The application is not compatible with the new operating system, but won’t block the upgrade. | No action is required for the upgrade to proceed, however, you’ll have to install a compatible version of the application on the new operating system.
              | -| Attention needed | Yes | Does not work with new OS, and will block upgrade | The application is not compatible with the new operating system and will block the upgrade. | Remove the application before upgrading.

              A compatible version of the application may be available.
              | -| Attention needed | Yes | May block upgrade, test application | Issues were detected that may interfere with the upgrade, but need to be investigated further.
              | Test the application’s behavior during upgrade. If it blocks the upgrade, remove it before upgrading and reinstall and test it on the new operating system.
              | -| Attention needed | Maybe | Multiple | Multiple issues are affecting the application. See detailed view for more information.| When you see Multiple in the query detailed view, click **Query** to see details about what issues were detected with the different versions of the application. | - -For applications assessed as **Fix available**, review the table below for details about known issues and ways to fix them that are known to Microsoft. - -| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance | -|--------------------|-----------------------------------|----------|-----------------|-------------| -| Fix available | Yes | Blocking upgrade, update application to newest version | The existing version of the application is not compatible with the new operating system and won’t migrate. A compatible version of the application is available. | Update the application before upgrading. | -| Fix available | No | Reinstall application after upgrading | The application is compatible with the new operating system, but must be reinstalled after upgrading. The application is removed during the upgrade process.
              | No action is required for the upgrade to proceed. Reinstall application on the new operating system. | -| Fix available | Yes | Blocking upgrade, but can be reinstalled after upgrading | The application is compatible with the new operating system, but won’t migrate. | Remove the application before upgrading and reinstall on the new operating system.
              | -| Fix available | Yes | Disk encryption blocking upgrade | The application’s encryption features are blocking the upgrade. | Disable the encryption feature before upgrading and enable it again after upgrading.
              | - -### ISV support for applications with Ready for Windows - -[Ready for Windows](https://www.readyforwindows.com/) lists software solutions that are supported and in use for Windows 10. This site leverages data about application adoption from commercial Windows 10 installations and helps IT managers upgrade to Windows 10 with confidence. For more information, see [Ready for Windows Frequently Asked Questions](https://developer.microsoft.com/windows/ready-for-windows/#/faq/). - -Click **Review Applications With Known Issues** to see the status of applications for Ready for Windows and corresponding guidance. For example: - -![Upgrade analytics Ready for Windows status](../images/upgrade-analytics-ready-for-windows-status.png) - -If there are known issues with an application, the specific guidance for that known issue takes precedence over the Ready for Windows guidance. - -![Upgrade analytics Ready for Windows status guidance precedence](../images/upgrade-analytics-ready-for-windows-status-guidance-precedence.png) - -If you query with RollupLevel="NamePublisher", each version of the application can have a different status for Ready for Windows. In this case, different values appear for Ready for Windows. - -![Name publisher rollup](../images/upgrade-analytics-namepub-rollup.png) - -> [!TIP] -> Within the Upgrade Readiness data model, an object of Type **UAApp** refers to a particular application installed on a specific computer. -> -> To support dynamic aggregation and summation of data the Upgrade Readiness solution "rolls up" (aggregates) data in preprocessing. Rolling up to the **Granular** level enables display of the **App** level. In Upgrade Readiness terminology, an **App** is a unique combination of: app name, app vendor, app version, and app language. Thus, at the Granular level, you can see attributes such as **total install count**, which is the number of machines with a specific **App** installed. -> -> Upgrade Readiness also has a roll up level of **NamePublisher**, This level enables you to ignore different app versions within your organization for a particular app. In other words, **NamePublisher** displays statistics about a given app, aggregated across all versions. - -The following table lists possible values for **ReadyForWindows** and what they mean. For more information, see [What does the Adoption Status mean?](https://developer.microsoft.com/en-us/windows/ready-for-windows#/faq/?scrollTo=faqStatuses) - -| Ready for Windows Status | Query rollup level | What this means | Guidance | -|-------------------|--------------------------|-----------------|----------| -|Supported version available | Granular | The software provider has declared support for one or more versions of this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10. | -| Highly adopted | Granular | This version of this application has been highly adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 100,000 commercial Windows 10 devices. | -| Adopted | Granular | This version of this application has been adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 10,000 commercial Windows 10 devices. | -| Insufficient Data | Granular | Too few commercial Windows 10 devices are sharing information about this version of this application for Microsoft to categorize its adoption. | N/A | -| Contact developer | Granular | There may be compatibility issues with this version of the application, so Microsoft recommends contacting the software provider to learn more. | Check [Ready for Windows](https://www.readyforwindows.com/) for additional information.| -|Supported version available | NamePublisher | The software provider has declared support for this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10.| -|Adoption status available | NamePublisher | A Ready for Windows adoption status is available for one or more versions of this application. Please check Ready for Windows to learn more. |Check [Ready for Windows](https://www.readyforwindows.com/) for adoption information for this application.| -| Unknown | Any | There is no Ready for Windows information available for this version of this application. Information may be available for other versions of the application at [Ready for Windows](https://www.readyforwindows.com/). | N/A | - -## Review drivers with known issues - -Drivers that won’t migrate to the new operating system are listed, grouped by availability. - -![Review drivers with known issues](../images/upgrade-analytics-drivers-known.png) - -Availability categories are explained in the table below. - -| Driver availability | Action required before or after upgrade? | What it means | Guidance | -|-----------------------|------------------------------------------|----------------|--------------| -| Available in-box | No, for awareness only | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system.
              | No action is required for the upgrade to proceed. | -| Import from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system; however, a compatible version is available from Windows Update.
              | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading.
              | -| Available in-box and from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system.

              Although a new driver is installed during upgrade, a newer version is available from Windows Update.
              | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading.
              | -| Check with vendor | Yes | The driver won’t migrate to the new operating system and we are unable to locate a compatible version.
              | Check with the independent hardware vendor (IHV) who manufactures the driver for a solution. | - -To change a driver’s upgrade decision: - -1. Select **Decide upgrade readiness** and then select the group of drivers you want to review. Select **Table** to view the list in a table. - -2. Select **User changes** to enable user input. - -3. Select the drivers you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list. - -4. Click **Save** when finished. - -## Review low-risk apps and drivers - -Applications and drivers that are meet certain criteria to be considered low risk are displayed on this blade. - -![Blade showing low-risk apps](../images/ua-step2-low-risk.png) - -The first row reports the number of your apps that have an official statement of support on Windows 10 from the software vendor, so you can be confident that they will work on your target operating system. - -The second row (**Apps that are "Highly adopted"**) shows apps that have a ReadyForWindows status of "Highly adopted". This means that they have been installed on at least 100,000 commercial Windows 10 devices, and that Microsoft has not detected significant issues with the app in diagnostic data. Since these apps are prevalent in the ecosystem at large, you can be confident that they will work in your environment as well. - -Each row of the blade uses a different criterion to filter your apps or drivers. You can view a list of applications that meet the criterion by clicking into a row of the blade. For example, if you click the row that says "Apps that are 'Highly adopted'", the result is a list of apps that have a ReadyForWindows status of "Highly adopted". From here, you can bulk-select the results, select **Ready to upgrade**, and then click **Save**. This will mark all apps meeting the "Highly adopted" criterion as "Ready to upgrade"--no further validation is required. Any applications that you have marked as *Mission critical* or *Business critical* are filtered out, as well as any app that has an issue known to Microsoft. This allows you to work with apps in bulk without having to worry about missing a critical app. - -You can customize the criteria further by using the Log Search query language. For example, if a ReadyForWindows status of "Adopted" is not sufficient by itself for you to be confident in an app's compatibility, you can add additional filters. To do this, click the row labeled **Apps that are 'Adopted'**. Then, modify the resulting query to fit your company's risk tolerance. If, for example, you prefer that an app must be "Adopted" and have fewer than 1,000 installations, then add *TotalInstalls < 1000* to the end of the Log Search query. Similarly, you can append additional criteria by using other attributes such as monthly active users or app importance. - ->[!NOTE] ->Apps that you have designated as *Mission critical* or *Business critical* are automatically **excluded** from the counts on this blade. If an app is critical, you should always validate it manually it prior to upgrading. - - At the bottom of the blade, the **OTHER APPS AND DRIVERS IN NEED OF REVIEW** section allows you to quickly access apps you have designated as **Mission critical** or **Business critical**, your remaining apps that still need to be reviewed, and your remaining drivers that need to be reviewed. - - - -## Prioritize app and driver testing - -Planning and executing an OS upgrade project can be overwhelming. When you are tasked with evaluating thousands of applications and drivers to ensure a successful upgrade, it can be difficult to decide where to start. The Upgrade Readiness solution provides valuable assistance for you, helping to determine the most important apps and drivers to unblock and enabling you yo create a proposed action plan. - -### Proposed action plan - -The Upgrade Readiness proposed action plan is an optimally ordered list of apps and drivers that are in need of review. By testing apps and drivers in the order suggested by the proposed action plan, you are able to increase your number of “Ready to upgrade” computers in an efficient manner. The action plan can be a very powerful tool during upgrade planning – but it’s most helpful when it’s used correctly. This topic explains the proposed action plan, describes how to use it, and calls out a few misconceptions and invalid use cases that you should avoid. - -The proposed action plan represents the order thath Microsoft recommends you rationalize the upgrade-readiness of your apps and drivers. By validating apps and drivers in the order proposed, you can ensure that you are testing efficiently. - -Each item in the proposed action plan represents either an application or a driver that you have not yet marked “Ready to upgrade.” - ->Since “Low install count” apps are automatically marked “Ready to upgrade”, you will not see any of these apps in the proposed action plan. - -Each item in the plan has the following attributes: - -| Attribute | Description | Example value | -|-----------------------|------------------------------------------|----------------| -| ItemRank | The location of this item in the context of the proposed action plan. For example, the item with ItemRank 7 is the 7th item in the Plan. It is crucial that the Plan is viewed in order by increasing ItemRank. Sorting the Plan in any other way invalidates the insights that the Plan provides. | 7 | -| ItemType | Whether this item is an app or driver -- possible values are: "App" and "Driver." | App | -| ItemName | The name of the app or driver that is in need of review. | Microsoft Visual C++ 2005 Redistributable (x64) | -| ItemVendor | The vendor of the app or driver. | Microsoft Corporation | -| ItemVersion | The version of the app or driver. | 12.1.0.1 | -| ItemLanguage | If this item is an application, then this field will be the language of the app. If the item is a driver, then this will say "N/A." | English | -| ItemHardwareId | If this item is a driver, then this field will be the hardware id of the driver. If the item is an app, then this will say "N/A." | N/A | -| Upgrade Decision | The upgrade decision you have provided for this app or driver. If you have not defined an upgrade decision, then you will see the default value of “Not reviewed.” | Review in progress | -| ComputersUnblocked | Assuming you have already marked all previous items in the proposed action plan “Ready to upgrade”, this represents the number of additional computers that will become “Ready to upgrade” by testing this app or driver and giving it an upgrade decision of “Ready to upgrade”. For example, if ComputersUnblocked is 200, then resolving any issues associated with the app/driver in question will make 200 new computers “Ready to upgrade.” | 200 | -| CumulativeUnblocked | The total number of computers that will become “Ready to upgrade” if you validate and mark this and all prior items in the proposed action plan “Ready to upgrade”. For example, if ItemRank is 7, and CumulativeUnblocked is 950, then fixing items 1 thru 7 in the proposed action plan will cause 950 of your computers to become “Ready to upgrade.” | 950 | -| CumulativeUnblockedPct | The percentage of your machines that will become “Ready to upgrade” if you make this and all prior items in the proposed action plan “Ready to upgrade.” | 0.24 | - -See the following example action plan items (click the image for a full-size view): - -![Proposed action plan](../images/UR-lift-report.jpg) - -
              -In this example, the 3rd item is an application: Microsoft Bing Sports, a modern app, version 4.20.951.0, published by Microsoft. By validating this app and making its UpgradeDecision “Ready to upgrade”, you can potentially make 1014 computers “Ready to upgrade” – but only after you have already validated items 1 and 2 in the list. By marking items 1, 2, and 3 “Ready to upgrade”, 14779 of your computers will become upgrade-ready. This represents 10.96% of the machines in this workspace. - -#### Using the proposed action plan - -There are several valid use cases for the proposed action plan. But it’s always important to remember that the information presented in the Plan is only accurate when sorted by increasing Item Rank! Here are three potential cases in which you could use the proposed action plan: - -1. Quickly determine how many apps and drivers you’ll need to validate in order to make x% of your computers upgrade-ready. To determine this, simply find the first item in the Plan with a CumulativeUnblockedPct greater than or equal to your desired percentage of upgrade-ready computers. The corresponding ItemRank represents the smallest number of apps and drivers that you can validate in order to reach your upgrade readiness goal. The prior items in the proposed action plan itself represent the most efficient route to reaching your goal. - -2. Use the proposed action plan to prepare a small portion of your machines for a pilot of your target Operating System. Let’s say you want to test a new Operating System by upgrading a few hundred computers. You can use the proposed action plan to determine how many apps and drivers you will need to validate before you can be confident that your pilot will be successful. - -3. If your project deadline is approaching and you only have time to validate a few more apps and drivers, you can use the proposed action plan to determine which apps and drivers you should focus on to maximize the number of computers that you can confidently upgrade. - -#### Misconceptions and things to avoid - -The most common misconceptions about the proposed action plan involve the assumption that each item in the plan is independent of those around it. The apps and drivers in the plan must be considered in the correct order to draw valid conclusions. For example, if you choose to validate items 1, 3, 4, and 5 and mark each of them “Ready to upgrade,” the proposed action plan cannot tell you how many computers will become upgrade-ready as a result of your testing. Even the non-cumulative “ComputersUnblocked” count is dependent upon all prior issues having already been resolved. - -If an item with ItemRank = 7 has a ComputersUnblocked value of 50, do not assume that 50 of your computers will become upgrade-ready if you test this item. However, if you validate items 1 through 6 in the plan, you can make an additional 50 computers upgrade-ready by validating the 7th item in the plan. diff --git a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md b/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md deleted file mode 100644 index b4cdb30a40..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Upgrade Readiness - Targeting a new operating system version -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Explains how to run Upgrade Readiness again to target a different operating system version or bulk-approve all apps from a given vendor -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Targeting a new operating system version - -After you've used Upgrade Readiness to help deploy a given version of Windows 10, you might want to use it again to help deploy a newer version of Windows 10. When you change the target operating system version (as described in [Use Upgrade Readiness to manage Windows upgrades](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version)), the app states (Importance, AppOwner, UpgradeDecision, TestPlan, and TestResult) are not reset. Follow this guidance to preserve or reset these states as needed: - -## TestResults - -If you want to preserve the TestResults from the previous operating system version testing, there is nothing you need to do. - -If you want to reset them, click any of the rows in the **Prioritize Application** blade (described in [Upgrade Readiness - Step 1: Identify important apps](upgrade-readiness-identify-apps.md)). This will take you to the **Log Search** user experience. Replace the query in that window with the following query: - -`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and TestResult <> "Not started"` - -After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **TestResult** to *Not started*. Leave all other fields as they are. - -## UpgradeDecision - -If you want to preserve the UpgradeDecision from the previous operating system version testing, there is nothing you need to do. - -If you want to reset them, keep these important points in mind: - -- Make sure to *not* reset the **Ready to upgrade** decision for the "long tail" of apps that have importance of **Ignore** or **Low install count**. Doing this will make it extremely difficult to complete the Upgrade Readiness workflow. -- Decide which decisions to reset. For example, one option is just to reset the decisions marked **Ready to upgrade** (in order to retest those), while preserving states of apps marked **Won't upgrade**. Doing this means you won't lose track of this previous marking. Or you can reset everything. - -To do this, type the following query in **Log Search**: - -`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and Importance <> "Ignore" and Importance <> "Low install count" and UpgradeDecision == "Ready to upgrade"` - ->[!NOTE] ->If you just want to reset all **UpgradeDecision** values, you can simply remove `'and UpgradeDecision == "Ready to upgrade"` from the query. - -After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **UpgradeDecision** to *Not reviewed*. Leave all other fields as they are. - - -## Bulk-approving apps from a given vendor - -You can bulk-approve all apps from a given vendor (for example, Microsoft) if there are no known compatibility issues. To do this, type the following query in **Log Search**: - -`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and AppVendor has "Microsoft" and UpgradeAssessment=="No known issues" and UpgradeDecision<>"Ready to upgrade"` - -After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit" button**, and then set the **UpgradeDecision** to *Ready to upgrade*. Leave all other fields as they are. - -## Related topics - -[Windows Analytics overview](../update/windows-analytics-overview.md) - -[Manage Windows upgrades with Upgrade Readiness](manage-windows-upgrades-with-upgrade-readiness.md) - -[Get started with Upgrade Readiness](upgrade-readiness-get-started.md) - diff --git a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md deleted file mode 100644 index 8bbc0e4a13..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Upgrade Readiness - Upgrade Overview (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Displays the total count of computers sharing data and upgraded. -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Upgrade overview - -The first blade in the Upgrade Readiness solution is the upgrade overview blade. This blade displays the total count of computers sharing data with Microsoft, and the count of computers upgraded. As you successfully upgrade computers, the count of computers upgraded increases. - -The upgrade overivew blade displays data refresh status, including the date and time of the most recent data update and whether user changes are reflected. The upgrade overview blade also displays the current target OS version. For more information about the target OS version, see [target version](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version). - -The following color-coded status changes are reflected on the upgrade overview blade: - -- The "Last updated" banner: - - No delay in processing device inventory data = "Last updated" banner is displayed in green. - - Delay processing device inventory data = "Last updated" banner is displayed in amber. -- Computers with incomplete data: - - Less than 4% = Count is displayed in green. - - 4% - 10% = Count is displayed in amber. - - Greater than 10% = Count is displayed in red. -- Computers with outdated KB: - - Less than 10% = Count is displayed in green. - - 10% - 30% = Count is displayed in amber. - - Greater than 30% = Count is displayed in red. -- User changes: - - Pending user changes = User changes count displays "Data refresh pending" in amber. - - No pending user changes = User changes count displays "Up to date" in green. -- Target version: - - If the current value matches the recommended value, the version is displayed in green. - - If the current value is an older OS version than the recommended value, but not deprecated, the version is displayed in amber. - - If the current value is a deprecated OS version, the version is displayed in red. - -Click a row to drill down and see details about individual computers. If updates are missing, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) for information on required updates. - -In the following example, there is no delay in data processing, more than 10% of computers (6k\8k) have incomplete data, more than 30% of computers (6k/8k) require an update, there are no pending user changes, and the currently selected target OS version is the same as the recommended version: - -![Upgrade overview](../images/ur-overview.png) - - - -If data processing is delayed, the "Last updated" banner will indicate the date on which data was last updated. You can continue using your workspace as normal. However, any changes or additional information that is added might not be displayed until data is refreshed. When your workspace is in this state, there is no action required; data is typically refreshed and the display will return to normal again within 24 hours. - -If there are computers with incomplete data, verify that you have installed the latest compatibilty updates. Install the updates if necessary and then run the most recent [Update Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the Microsoft download center. The updated data payload should appear in Upgrade Readiness within 48 hours of a successful run on the deployment script. - -Select **Total computers** for a list of computers and details about them, including: - -- Computer ID and computer name -- Computer manufacturer -- Computer model -- Operating system version and build -- Count of system requirement, application, and driver issues per computer -- Upgrade assessment based on analysis of computer diagnostic data -- Upgrade decision status - -Select **Total applications** for a list of applications discovered on user computers and details about them, including: - -- Application vendor -- Application version -- Count of computers the application is installed on -- Count of computers that opened the application at least once in the past 30 days -- Percentage of computers in your total computer inventory that opened the application in the past 30 days -- Issues detected, if any -- Upgrade assessment based on analysis of application data -- Rollup level diff --git a/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md b/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md deleted file mode 100644 index 82f4193c52..0000000000 --- a/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: Perform an in-place upgrade to Windows 10 using Configuration Manager (Windows 10) -description: The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. Use a System Center Configuration Manager task sequence to completely automate the process. -ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Perform an in-place upgrade to Windows 10 using Configuration Manager - - -**Applies to** - -- Windows 10 - -The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a System Center Configuration Manager task sequence to completely automate the process. - -## Proof-of-concept environment - - -For the purposes of this topic, we will use three machines: DC01, CM01, and PC0001. DC01 is a domain controller and CM01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -![figure 1](../images/upgrademdt-fig1-machines.png) - -Figure 1. The machines used in this topic. - -## Upgrade to Windows 10 with System Center 2012 R2 Configuration Manager - - -System Center 2012 R2 Configuration Manager SP1 adds support to manage and deploy Windows 10. Although it does not include built-in support to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 to Windows 10, you can build a custom task sequence to perform the necessary tasks. - -## Create the task sequence - - -To help with this process, the Configuration Manager team has published [a blog](https://go.microsoft.com/fwlink/p/?LinkId=620179) that provides a sample task sequence, as well as the [original blog that includes the instructions for setting up the task sequence](https://go.microsoft.com/fwlink/p/?LinkId=620180). To summarize, here are the tasks you need to perform: - -1. Download the [Windows10Upgrade1506.zip](https://go.microsoft.com/fwlink/p/?LinkId=620182) file that contains the sample task sequence and related scripts. Extract the contents onto a network share. -2. Copy the Windows 10 Enterprise RTM x64 media into the extracted but empty **Windows vNext Upgrade Media** folder. -3. Using the Configuration Manager Console, right-click the **Task Sequences** node, and then choose **Import Task Sequence**. Select the **Windows-vNextUpgradeExport.zip** file that you extracted in Step 1. -4. Distribute the two created packages (one contains the Windows 10 Enterprise x64 media, the other contains the related scripts) to the Configuration Manager distribution point. - -For full details and an explanation of the task sequence steps, review the full details of the two blogs that are referenced above. - -## Create a device collection - - -After you create the upgrade task sequence, you can create a collection to test a deployment. In this section, we assume you have the PC0001 machine running Windows 7 SP1, with the Configuration Manager client installed. - -1. On CM01, using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings: - - General - - - Name: Windows 10 Enterprise x64 Upgrade - - - Limited Collection: All Systems - - - Membership rules: - - - Direct rule - - - Resource Class: System Resource - - - Attribute Name: Name - - - Value: PC0001 - - - Select Resources - - - Select PC0001 - -2. Review the Windows 10 Enterprise x64 Upgrade collection. Do not continue until you see the PC0001 machine in the collection. - -## Deploy the Windows 10 upgrade - - -In this section, you create a deployment for the Windows 10 Enterprise x64 Update application. - -1. On CM01, using the Configuration Manager console, in the Software Library workspace, right-click the **Windows vNext Upgrade** task sequence, and then select **Deploy**. -2. On the **General** page, select the **Windows 10 Enterprise x64 Upgrade** collection, and then click **Next**. -3. On the **Content** page, click **Next**. -4. On the **Deployment Settings** page, select the following settings, and then click **Next**: - - Action: Install - - - Purpose: Available - -5. On the **Scheduling** page, accept the default settings, and then click **Next**. -6. On the **User Experience** page, accept the default settings, and then click **Next**. -7. On the **Alerts** page, accept the default settings, and then click **Next**. -8. On the **Summary** page, click **Next**, and then click **Close**. - -## Start the Windows 10 upgrade - - -In this section, you start the Windows 10 Upgrade task sequence on PC0001 (currently running Windows 7 SP1). - -1. On PC0001, start the **Software Center**. -2. Select the **Windows vNext Upgrade** task sequence, and then click **Install**. - -When the task sequence begins, it will automatically initiate the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. - -![figure 2](../images/upgradecfg-fig2-upgrading.png) - -Figure 2. Upgrade from Windows 7 to Windows 10 Enterprise x64 with a task sequence. - -After the task sequence finishes, the computer will be fully upgraded to Windows 10. - -## Upgrade to Windows 10 with System Center Configuration Manager Current Branch - - -With System Center Configuration Manager Current Branch, new built-in functionality makes it easier to upgrade to Windows 10. - -**Note**   -For more details about Configuration Manager Current Branch, see the [Configuration Manager Team blog](https://go.microsoft.com/fwlink/p/?LinkId=620205). An [evaluation version is currently available](https://go.microsoft.com/fwlink/p/?LinkId=620206) for you to try. The instructions below are specific to the Technical Preview 2 release and may change after the next version of Configuration Manager is released. - - - -### Create the OS upgrade package - -First, you need to create an operating system upgrade package that contains the full Windows 10 Enterprise x64 installation media. - -1. On CM01, using the Configuration Manager console, in the Software Library workspace, right-click the **Operating System Upgrade Packages** node, then select **Add Operating System Upgrade Package**. -2. On the **Data Source** page, specify the UNC path to the Windows 10 Enterprise x64 media, and then click **Next**. -3. On the **General** page, specify Windows 10 Enterprise x64 Upgrade, and then click **Next**. -4. On the **Summary** page, click **Next**, and then click **Close**. -5. Right-click the created **Windows 10 Enterprise x64 Update** package, and then select **Distribute Content**. Choose the CM01 distribution point. - -### Create the task sequence - -To create an upgrade task sequence, perform the following steps: - -1. On CM01, using the Configuration Manager console, in the Software Library workspace, right-click the **Task Sequences** node, and then select **Create Task Sequence**. -2. On the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. -3. On the **Task Sequence Information** page, specify **Windows 10 Enterprise x64 Upgrade**, and then click **Next**. -4. On the **Upgrade the Windows operating system** page, select the **Windows 10 Enterprise x64 Upgrade operating system upgrade** package, and then click **Next**. -5. Click **Next** through the remaining wizard pages, and then click **Close**. - -![figure 3](../images/upgradecfg-fig3-upgrade.png) - -Figure 3. The Configuration Manager upgrade task sequence. - -### Create a device collection - -After you create the upgrade task sequence, you can create a collection to test a deployment. In this section, we assume you have the PC0001 machine running Windows 7 SP1, with the next version of System Center Configuration Manager client installed. - -1. On CM01, using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings: - - General - - - Name: Windows 10 Enterprise x64 Upgrade - - - Limited Collection: All Systems - - - Membership rules: - - - Direct rule - - - Resource Class: System Resource - - - Attribute Name: Name - - - Value: PC0001 - - - Select Resources - - - Select PC0001 - -2. Review the Windows 10 Enterprise x64 Upgrade collection. Do not continue until you see the PC0001 machine in the collection. - -### Deploy the Windows 10 upgrade - -In this section, you create a deployment for the Windows 10 Enterprise x64 Update application. - -1. On CM01, using the Configuration Manager console, in the Software Library workspace, right-click the **Windows vNext Upgrade** task sequence, and then select **Deploy**. -2. On the **General** page, select the **Windows 10 Enterprise x64 Upgrade** collection, and then click **Next**. -3. On the **Content** page, click **Next**. -4. On the **Deployment Settings** page, select the following settings and click **Next**: - - Action: Install - - - Purpose: Available - -5. On the **Scheduling** page, accept the default settings, and then click **Next**. -6. On the **User Experience** page, accept the default settings, and then click **Next**. -7. On the **Alerts** page, accept the default settings, and then click **Next**. -8. On the **Summary** page, click **Next**, and then click **Close**. - -### Start the Windows 10 upgrade - -In this section, you start the Windows 10 Upgrade task sequence on PC0001 (currently running Windows 7 SP1). - -1. On PC0001, start the **Software Center**. -2. Select the **Windows 10 Enterprise x64 Upgrade** task sequence, and then click **Install.** - -When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. - -After the task sequence completes, the computer will be fully upgraded to Windows 10. - -## Related topics - - -[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md) - -[Configuration Manager Team blog](https://go.microsoft.com/fwlink/p/?LinkId=620109) - - - - - - - - - diff --git a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md deleted file mode 100644 index 2a7e01c1d8..0000000000 --- a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: Perform an in-place upgrade to Windows 10 with MDT (Windows 10) -description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. -ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Perform an in-place upgrade to Windows 10 with MDT - -**Applies to** -- Windows 10 - -The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Deployment Toolkit (MDT) 2013 Update 2 task sequence to completely automate the process. - -## Proof-of-concept environment - -For the purposes of this topic, we will use four machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -![fig 1](../images/upgrademdt-fig1-machines.png) - -Figure 1. The machines used in this topic. - -## Set up the upgrade task sequence - -MDT adds support for Windows 10 deployment, including a new in-place upgrade task sequence template that makes the process really simple. - -## Create the MDT production deployment share - -The steps to create the deployment share for production are the same as when you created the deployment share to create the custom reference image: - -1. On MDT01, log on as Administrator in the CONTOSO domain with a password of P@ssw0rd. -2. Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. -3. On the **Path** page, in the **Deployment share path** text box, type **E:\\MDTProduction**, and then click **Next**. -4. On the **Share** page, in the **Share name** text box, type **MDTProduction$**, and then click **Next**. -5. On the **Descriptive Name** page, in the **Deployment share** description text box, type **MDT Production**, and then click **Next**. -6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. -7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. - -## Add Windows 10 Enterprise x64 (full source) - -In these steps we assume that you have copied the content of a Windows 10 Enterprise x64 ISO to the E:\\Downloads\\Windows 10 Enterprise x64 folder. - -1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. -2. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. -3. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: - - Full set of source files - - Source directory: E:\\Downloads\\Windows 10 Enterprise x64 - - Destination directory name: W10EX64RTM -4. After you add the operating system, in the **Operating Systems / Windows 10** folder, double-click the added operating system name in the **Operating System** node and change the name to the following: **Windows 10 Enterprise x64 RTM Default Image** - -![figure 2](../images/upgrademdt-fig2-importedos.png) - -Figure 2. The imported Windows 10 operating system after you rename it. - -## Create a task sequence to upgrade to Windows 10 Enterprise - -1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. -2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: W10-X64-UPG - - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade - - Template: Standard Client Upgrade Task Sequence - - Select OS: Windows 10 Enterprise x64 RTM Default Image - - Specify Product Key: Do not specify a product key at this time - - Full Name: Contoso - - Organization: Contoso - - Internet Explorer home page: about:blank - - Admin Password: Do not specify an Administrator Password at this time - -![figure 3](../images/upgrademdt-fig3-tasksequence.png) - -Figure 3. The task sequence to upgrade to Windows 10. - -## Perform the Windows 10 upgrade - -To initiate the in-place upgrade, perform the following steps on PC0003 (currently running Windows 7 SP1). - -1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** -2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**. - - ![figure 4](../images/upgrademdt-fig4-selecttask.png) - - Figure 4. Upgrade task sequence. - -3. On the **Credentials** tab, specify the **MDT\_BA** account, P@ssw0rd password, and **CONTOSO** for the domain. (Some or all of these values can be specified in Bootstrap.ini so they are automatically populated.) -4. On the **Ready** tab, click **Begin** to start the task sequence. - When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. - -![figure 5](../images/upgrademdt-fig5-winupgrade.png) - -Figure 5. Upgrade from Windows 7 to Windows 10 Enterprise x64 with a task sequence. - -After the task sequence completes, the computer will be fully upgraded to Windows 10. - -## Related topics - -[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md) - -[Microsoft Deployment Toolkit downloads and resources](https://go.microsoft.com/fwlink/p/?LinkId=618117) - diff --git a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md index 78d70d0d25..6de193cccb 100644 --- a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md +++ b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md @@ -1,113 +1,114 @@ ---- -title: Upgrade Windows Phone 8.1 to Windows 10 Mobile in an MDM environment (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: This article describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using MDM. -keywords: upgrade, update, windows, phone, windows 10, mdm, mobile -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdm -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management (MDM) - -**Applies to** - -- Windows 10 Mobile - -## Summary - -This article describes how system administrators can upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM). - ->[!IMPORTANT] ->If you are not a system administrator, see the [Windows 10 Mobile Upgrade & Updates](https://www.microsoft.com/windows/windows-10-mobile-upgrade) page for details about updating your Windows 8.1 Mobile device to Windows 10 Mobile using the [Upgrade Advisor](https://www.microsoft.com/store/p/upgrade-advisor/9nblggh0f5g4). - -## Upgrading with MDM - -The Windows Phone 8.1 to Windows 10 Mobile upgrade uses an "opt-in" or "seeker" model. To determine if the device is eligible for an upgrade with MDM, see the [How to determine whether an upgrade is available for a device](#howto-upgrade-available) topic in this article. An eligible device must opt-in to be offered the upgrade. For consumers, the Windows 10 Mobile Upgrade Advisor app is available from the Windows Store to perform the opt-in. For Enterprises, Microsoft is offering a centralized management solution through MDM that can push a management policy to each eligible device to perform the opt-in. - -If you use a list of allowed applications (app whitelisting) with MDM, verify that system applications are whitelisted before you upgrade to Windows 10 Mobile. Also, be aware that there are [known issues](https://msdn.microsoft.com/library/windows/hardware/mt299056.aspx#whitelist) with app whitelisting that could adversely affect the device after you upgrade. - -Some enterprises might want to control the availability of the Windows 10 Mobile upgrade to their users. With the opt-in model, the enterprise can blacklist the Upgrade Advisor app to prevent their users from upgrading prematurely. For more information about how to blacklist the Upgrade Advisor app, see the [How to blacklist the Upgrade Advisor app](#howto-blacklist) section in this article. Enterprises that have blacklisted the Upgrade Advisor app can use the solution described in this article to select the upgrade timing on a per-device basis. - -## More information - -To provide enterprises with a solution that's independent of the Upgrade Advisor, a new registry key in the registry configuration service provider (CSP) is available. A special GUID key value is defined. When Microsoft Update (MU) detects the presence of the registry key value on a device, any available upgrade will be made available to the device. - -### Prerequisites - -- Windows Phone 8.1 device with an available upgrade to Windows 10 Mobile. -- Device connected to Wi-Fi or cellular network to perform scan for upgrade. -- Device is already enrolled with an MDM session. -- Device is able to receive the management policy. -- MDM is capable of pushing the management policy to devices. Minimum version numbers for some popular MDM providers that support this solution are: InTune: 5.0.5565, AirWatch: 8.2, Mobile Iron: 9.0. - -### Instructions for the MDM server - -The registry CSP is used to push the GUID value to the following registry key for which the Open Mobile Alliance (OMA) Device Management (DM) client has Read/Write access and for which the Device Update service has Read access. - -``` -[HKLM\Software\Microsoft\Provisioning\OMADM] -"EnterpriseUpgrade"="d369c9b6-2379-466d-9162-afc53361e3c2” -``` - - -The complete SyncML command for the solution is as follows. Note: The SyncML may vary, depending on your MDM solution. - -``` -SyncML xmlns="SYNCML:SYNCML1.1"> - - - 250 - - - ./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade - - - chr - - d369c9b6-2379-466d-9162-afc53361e3c2 - - - - - -``` - -The OMA DM server policy description is provided in the following table: - -|Item |Setting | -|------|------------| -| OMA-URI |./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade | -| Data Type |String | -| Value |d369c9b6-2379-466d-9162-afc53361e3c2 | - - -After the device consumes the policy, it will be able to receive an available upgrade. - -To disable the policy, delete the **OMADM** registry key or set the **EnterpriseUpgrade** string value to anything other than the GUID. - -### How to determine whether an upgrade is available for a device - -The Windows 10 Mobile Upgrade Advisor app is not designed or intended for Enterprise customers who want to automate the upgrade process. However, the Windows 10 Mobile Upgrade Advisor app is the best mechanism to determine when an upgrade is available. The app dynamically queries whether the upgrade is released for this device model and associated mobile operator (MO). - -We recommend that enterprises use a pilot device with the Windows 10 Mobile Upgrade Advisor app installed. The pilot device provides the device model and MO used by the enterprise. When you run the app on the pilot device, it will tell you that either an upgrade is available, that the device is eligible for upgrade, or that an upgrade is not available for this device. - -Note: The availability of Windows 10 Mobile as an update for existing Windows Phone 8.1 devices varies by device manufacturer, device model, country or region, mobile operator or service provider, hardware limitations, and other factors. To check for compatibility and other important installation information, see the [Windows 10 Mobile FAQ](https://support.microsoft.com/help/10599/windows-10-mobile-how-to-get) page. - -### How to blacklist the Upgrade Advisor app - -Some enterprises may want to block their users from installing the Windows 10 Mobile Upgrade Advisor app. With Windows Phone 8.1, you can allow or deny individual apps by adding specific app publishers or the app globally unique identifier (GUID) from the Window Phone Store to an allow or deny XML list. The GUID for a particular application can be found in the URL for the app in the phone store. For example, the GUID to the Windows 10 Mobile Upgrade Adviser (fbe47e4f-7769-4103-910e-dca8c43e0b07) is displayed in the following URL: - -http://windowsphone.com/s?appid=fbe47e4f-7769-4103-910e-dca8c43e0b07 - -For more information about how to do this, see [Try it out: restrict Windows Phone 8.1 apps](https://technet.microsoft.com/windows/dn771706.aspx). - -## Related topics - -[Windows 10 Mobile and mobile device management](/windows/client-management/windows-10-mobile-and-mdm) +--- +title: Upgrade Windows Phone 8.1 to Windows 10 Mobile in an MDM environment (Windows 10) +ms.reviewer: +manager: laurawi +ms.author: greglin +description: This article describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using MDM. +keywords: upgrade, update, windows, phone, windows 10, mdm, mobile +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdm +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management (MDM) + +**Applies to** + +- Windows 10 Mobile + +## Summary + +This article describes how system administrators can upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM). + +>[!IMPORTANT] +>If you are not a system administrator, see the [Windows 10 Mobile Upgrade & Updates](https://www.microsoft.com/windows/windows-10-mobile-upgrade) page for details about updating your Windows 8.1 Mobile device to Windows 10 Mobile using the [Upgrade Advisor](https://www.microsoft.com/store/p/upgrade-advisor/9nblggh0f5g4). + +## Upgrading with MDM + +The Windows Phone 8.1 to Windows 10 Mobile upgrade uses an "opt-in" or "seeker" model. To determine if the device is eligible for an upgrade with MDM, see the [How to determine whether an upgrade is available for a device](#howto-upgrade-available) topic in this article. An eligible device must opt-in to be offered the upgrade. For consumers, the Windows 10 Mobile Upgrade Advisor app is available from the Windows Store to perform the opt-in. For Enterprises, Microsoft is offering a centralized management solution through MDM that can push a management policy to each eligible device to perform the opt-in. + +If you use a list of allowed applications (app allow listing) with MDM, verify that system applications are allow-listed before you upgrade to Windows 10 Mobile. Also, be aware that there are [known issues](https://msdn.microsoft.com/library/windows/hardware/mt299056.aspx#whitelist) with app allow-lists that could adversely affect the device after you upgrade. + +Some enterprises might want to control the availability of the Windows 10 Mobile upgrade to their users. With the opt-in model, the enterprise can block the Upgrade Advisor app to prevent their users from upgrading prematurely. For more information about how to restrict the Upgrade Advisor app, see the [How to restrict the Upgrade Advisor app](#howto-restrict) section in this article. Enterprises that have restricted the Upgrade Advisor app can use the solution described in this article to select the upgrade timing on a per-device basis. + +## More information + +To provide enterprises with a solution that's independent of the Upgrade Advisor, a new registry key in the registry configuration service provider (CSP) is available. A special GUID key value is defined. When Microsoft Update (MU) detects the presence of the registry key value on a device, any available upgrade will be made available to the device. + +### Prerequisites + +- Windows Phone 8.1 device with an available upgrade to Windows 10 Mobile. +- Device connected to Wi-Fi or cellular network to perform scan for upgrade. +- Device is already enrolled with an MDM session. +- Device is able to receive the management policy. +- MDM is capable of pushing the management policy to devices. Minimum version numbers for some popular MDM providers that support this solution are: InTune: 5.0.5565, AirWatch: 8.2, Mobile Iron: 9.0. + +### Instructions for the MDM server + +The registry CSP is used to push the GUID value to the following registry key for which the Open Mobile Alliance (OMA) Device Management (DM) client has Read/Write access and for which the Device Update service has Read access. + +``` +[HKLM\Software\Microsoft\Provisioning\OMADM] +"EnterpriseUpgrade"="d369c9b6-2379-466d-9162-afc53361e3c2” +``` + + +The complete SyncML command for the solution is as follows. Note: The SyncML may vary, depending on your MDM solution. + +``` +SyncML xmlns="SYNCML:SYNCML1.1"> + + + 250 + + + ./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade + + + chr + + d369c9b6-2379-466d-9162-afc53361e3c2 + + + + + +``` + +The OMA DM server policy description is provided in the following table: + +|Item |Setting | +|------|------------| +| OMA-URI |./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade | +| Data Type |String | +| Value |d369c9b6-2379-466d-9162-afc53361e3c2 | + + +After the device consumes the policy, it will be able to receive an available upgrade. + +To disable the policy, delete the **OMADM** registry key or set the **EnterpriseUpgrade** string value to anything other than the GUID. + +### How to determine whether an upgrade is available for a device + +The Windows 10 Mobile Upgrade Advisor app is not designed or intended for Enterprise customers who want to automate the upgrade process. However, the Windows 10 Mobile Upgrade Advisor app is the best mechanism to determine when an upgrade is available. The app dynamically queries whether the upgrade is released for this device model and associated mobile operator (MO). + +We recommend that enterprises use a pilot device with the Windows 10 Mobile Upgrade Advisor app installed. The pilot device provides the device model and MO used by the enterprise. When you run the app on the pilot device, it will tell you that either an upgrade is available, that the device is eligible for upgrade, or that an upgrade is not available for this device. + +Note: The availability of Windows 10 Mobile as an update for existing Windows Phone 8.1 devices varies by device manufacturer, device model, country or region, mobile operator or service provider, hardware limitations, and other factors. To check for compatibility and other important installation information, see the [Windows 10 Mobile FAQ](https://support.microsoft.com/help/10599/windows-10-mobile-how-to-get) page. + +### How to restrict the Upgrade Advisor app + +Some enterprises may want to block their users from installing the Windows 10 Mobile Upgrade Advisor app. With Windows Phone 8.1, you can allow or deny individual apps by adding specific app publishers or the app globally unique identifier (GUID) from the Window Phone Store to an allow or deny XML list. The GUID for a particular application can be found in the URL for the app in the phone store. For example, the GUID to the Windows 10 Mobile Upgrade Adviser (fbe47e4f-7769-4103-910e-dca8c43e0b07) is displayed in the following URL: + +http://windowsphone.com/s?appid=fbe47e4f-7769-4103-910e-dca8c43e0b07 + +For more information about how to do this, see [Try it out: restrict Windows Phone 8.1 apps](https://technet.microsoft.com/windows/dn771706.aspx). + +## Related topics + +[Windows 10 Mobile and mobile device management](/windows/client-management/windows-10-mobile-and-mdm) diff --git a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md deleted file mode 100644 index 671ba50c38..0000000000 --- a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Use Upgrade Readiness to manage Windows upgrades (Windows 10) -ms.reviewer: -manager: laurawi -description: Describes how to use Upgrade Readiness to manage Windows upgrades. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.localizationpriority: medium -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.author: greglin -ms.topic: article ---- - -# Use Upgrade Readiness to manage Windows upgrades - ->[!IMPORTANT] ->>**The OMS portal has been deprecated, so you need to switch to the [Azure portal](https://portal.azure.com) now.** The two portals offer the same experience, with some key differences. Learn how to use [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md). Find out more about the [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition), or jump right in and [Get started with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started). - -You can use Upgrade Readiness to prioritize and work through application and driver issues, assign and track issue resolution status, and identify computers that are ready to upgrade. Upgrade Readiness enables you to deploy Windows with confidence, knowing that you’ve addressed potential blocking issues. - -- Based on diagnostic data from user computers, Upgrade Readiness identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness. -- Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them. - -When you are ready to begin the upgrade process, a workflow is provided to guide you through critical high-level tasks. - -![Series of blades showing Upgrade Overview, Step 1: Identify Important Apps, Prioritize Applications, Step 2: Resolve issues, and Review applications with known issues](../images/ua-cg-15.png) - -Each step in the workflow is enumerated using blue tiles. Helpful data is provided on white tiles to help you get started, to monitor your progress, and to complete each step. - ->**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are running a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Current Branch for Business (CBB). - -The following information and workflow is provided: - -- [Upgrade overview](upgrade-readiness-upgrade-overview.md): Review compatibility and usage information about computers, applications, and drivers. -- [Step 1: Identify important apps](upgrade-readiness-identify-apps.md): Assign importance levels to prioritize your applications. -- [Step 2: Resolve issues](upgrade-readiness-resolve-issues.md): Identify and resolve problems with applications. -- [Step 3: Deploy](upgrade-readiness-deploy-windows.md): Start the upgrade process. - -Also see the following topic for information about additional items that can be affected by the upgrade process: - -- [Additional insights](upgrade-readiness-additional-insights.md): Find out which MS Office add-ins are installed, and review web site activity. - -## Target version - -The target version setting is used to evaluate the number of computers that are already running the default version of Windows 10, or a later version. The target version of Windows 10 is displayed on the upgrade overview tile. See the following example: - -![Upgrade overview showing target version](../images/ur-target-version.png) - -The default target version in Upgrade Readiness is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version. - -The number displayed under **Computers upgraded** in the Upgrade Overview blade is the total number of computers that are already running the same or a later version of Windows compared to the target version. It also is used in the evaluation of apps and drivers: Known issues and guidance for the apps and drivers in Upgrade Readiness is based on the target operating system version. - -You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, Windows 10 version 1607, Windows 10 version 1703, Windows 10 version 1709 and Windows 10 version 1803. - -To change the target version setting, click on **Solutions Settings**, which appears at the top when you open you Upgrade Readiness solution: - -![Upgrade Readiness dialog showing gear labeled Solution Settings](../images/ua-cg-08.png) - ->You must be signed in to Upgrade Readiness as an administrator to view settings. - -On the **Upgrade Readiness Settings** page, choose one of the options in the drop down box and click **Save**. The changes in the target version setting are reflected in evaluations when a new snapshot is uploaded to your workspace. - -![Upgrade Readiness Settings dialog showing gear labeled Save and arrow labeled Cancel](../images/ur-settings.png) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 72345c3d54..e2806e3c0c 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -1,250 +1,251 @@ ---- -title: Windows 10 edition upgrade (Windows 10) -description: With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. -ms.assetid: A7642E90-A3E7-4A25-8044-C4E402DC462A -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mobile -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 edition upgrade - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md). Downgrading the edition of Windows is discussed in the [License expiration](#license-expiration) section on this page. - -For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](https://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf). - -The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607. - -Note: Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](https://docs.microsoft.com/sccm/compliance/deploy-use/upgrade-windows-version) in System Center Configuration Manager. - -![not supported](../images/x_blk.png) (X) = not supported
              -![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required
              -![supported, no reboot](../images/check_blu.png) (blue checkmark) = supported, no reboot required
              - - - -| Edition upgrade | Using mobile device management (MDM) | Using a provisioning package | Using a command-line tool | Using Microsoft Store for Business or PC | Entering a product key manually | Purchasing a license from the Microsoft Store | -|-----------------| ------------------------------------ | --------------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- | -| **Home > Pro** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro for Workstations** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Home > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | -| **Pro > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (1703 - PC)
              (1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (1703 - PC)
              (1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Mobile > Mobile Enterprise** | ![supported, no reboot](../images/check_blu.png) |![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | - -> [!NOTE] -> - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md) -> - Each desktop edition in the table also has an N and KN SKU. These editions have had media-related functionality removed. Devices with N or KN SKUs installed can be upgraded to corresponding N or KN SKUs using the same methods. ->
              -> - Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes) the term LTSB might still be displayed in some products. This name will change to LTSC with subsequent feature updates. - -## Upgrade using mobile device management (MDM) -- To upgrade desktop editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithProductKey** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907). - -- To upgrade mobile editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithLicense** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907). - -## Upgrade using a provisioning package -Use Windows Configuration Designer to create a provisioning package to upgrade a desktop edition or mobile edition of Windows 10. To get started, [install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). - -- To create a provisioning package for upgrading desktop editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithProductKey** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition. - -- To create a provisioning package for upgrading mobile editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithLicense** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition. - -For more info about Windows Configuration Designer, see these topics: -- [Create a provisioining package for Windows 10](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package) -- [Apply a provisioning package](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package) - - -## Upgrade using a command-line tool -You can run the changepk.exe command-line tool to upgrade devices to a supported edition of Windows 10: - -`changepk.exe /ProductKey ` - -You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v%3dws.11)). For example, the following command will upgrade to Windows 10 Enterprise. - -`Cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43` - - -## Upgrade by manually entering a product key -If you are upgrading only a few devices, you may want to enter a product key for the upgraded edition manually. - -**To manually enter a product key** - -1. From either the Start menu or the Start screen, type 'Activation' and click on the Activation shortcut. - -2. Click **Change product key**. - -3. Enter your product key. - -4. Follow the on-screen instructions. - -## Upgrade by purchasing a license from the Microsoft Store -If you do not have a product key, you can upgrade your edition of Windows 10 through the Microsoft Store. - -**To upgrade through the Microsoft Store** - -1. From either the **Start** menu or the **Start** screen, type 'Activation' and click on the Activation shortcut. - -2. Click **Go to Store**. - -3. Follow the on-screen instructions. - - **Note**
              If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/). - -## License expiration - -Volume license customers whose license has expired will need to change the edition of Windows 10 to an edition with an active license. Switching to a downgraded edition of Windows 10 is possible using the same methods that were used to perform an edition upgrade. If the downgrade path is supported, then your apps and settings can be migrated from the current edition. If a path is not supported, then a clean install is required. - -Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a different product key is not supported. You also cannot downgrade from a later version to an earlier version of the same edition (Ex: Windows 10 Pro 1709 to 1703) unless the rollback process is used. This topic does not discuss version downgrades. - -Note: If you are using [Windows 10 Enterprise Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) and a license expires, devices will automatically revert to the original edition when the grace period expires. - -### Scenario example - -Downgrading from Enterprise -- Original edition: **Professional OEM** -- Upgrade edition: **Enterprise** -- Valid downgrade paths: **Pro, Pro for Workstations, Pro Education, Education** - -You can move directly from Enterprise to any valid destination edition. In this example, downgrading to Pro for Workstations, Pro Education, or Education requires an additional activation key to supersede the firmware-embedded Pro key. In all cases, you must comply with [Microsoft License Terms](https://www.microsoft.com/useterms). If you are a volume license customer, refer to the [Microsoft Volume Licensing Reference Guide](https://www.microsoft.com/en-us/download/details.aspx?id=11091). - -### Supported Windows 10 downgrade paths - -✔ = Supported downgrade path
              - S  = Supported; Not considered a downgrade or an upgrade
              -[blank] = Not supported or not a downgrade
              - -
              - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Destination edition
                    HomeProPro for WorkstationsPro EducationEducationEnterprise LTSCEnterprise
              Starting edition
              Home
              Pro
              Pro for Workstations
              Pro Education
              EducationS
              Enterprise LTSC
              EnterpriseS
              - -> **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. -> -> **Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above. - -Some slightly more complex scenarios are not represented by the table above. For example, you can perform an upgrade from Pro to Pro for Workstation on a computer with an embedded Pro key using a Pro for Workstation license key, and then later downgrade this computer back to Pro with the firmware-embedded key. The downgrade is allowed but only because the pre-installed OS is Pro. - -## Related topics - -[Windows 10 upgrade paths](https://docs.microsoft.com/windows/deployment/upgrade/windows-10-upgrade-paths)
              -[Windows 10 volume license media](https://docs.microsoft.com/windows/deployment/windows-10-media)
              -[Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) +--- +title: Windows 10 edition upgrade (Windows 10) +description: With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. +ms.assetid: A7642E90-A3E7-4A25-8044-C4E402DC462A +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mobile +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 edition upgrade + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md). Downgrading the edition of Windows is discussed in the [License expiration](#license-expiration) section on this page. + +For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](https://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf). + +The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607. + +Note: Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](https://docs.microsoft.com/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager. + +![not supported](../images/x_blk.png) (X) = not supported
              +![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required
              +![supported, no reboot](../images/check_blu.png) (blue checkmark) = supported, no reboot required
              + + + +| Edition upgrade | Using mobile device management (MDM) | Using a provisioning package | Using a command-line tool | Using Microsoft Store for Business or PC | Entering a product key manually | Purchasing a license from the Microsoft Store | +|-----------------| ------------------------------------ | --------------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- | +| **Home > Pro** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro for Workstations** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Home > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | +| **Pro > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (1703 - PC)
              (1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
              (1703 - PC)
              (1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
              (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Mobile > Mobile Enterprise** | ![supported, no reboot](../images/check_blu.png) |![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | + +> [!NOTE] +> - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md) +> - Each desktop edition in the table also has an N and KN SKU. These editions have had media-related functionality removed. Devices with N or KN SKUs installed can be upgraded to corresponding N or KN SKUs using the same methods. +>
              +> - Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes) the term LTSB might still be displayed in some products. This name will change to LTSC with subsequent feature updates. + +## Upgrade using mobile device management (MDM) +- To upgrade desktop editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithProductKey** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907). + +- To upgrade mobile editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithLicense** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907). + +## Upgrade using a provisioning package +Use Windows Configuration Designer to create a provisioning package to upgrade a desktop edition or mobile edition of Windows 10. To get started, [install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). + +- To create a provisioning package for upgrading desktop editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithProductKey** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition. + +- To create a provisioning package for upgrading mobile editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithLicense** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition. + +For more info about Windows Configuration Designer, see these topics: +- [Create a provisioining package for Windows 10](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package) +- [Apply a provisioning package](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package) + + +## Upgrade using a command-line tool +You can run the changepk.exe command-line tool to upgrade devices to a supported edition of Windows 10: + +`changepk.exe /ProductKey ` + +You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v%3dws.11)). For example, the following command will upgrade to Windows 10 Enterprise. + +`Cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43` + + +## Upgrade by manually entering a product key +If you are upgrading only a few devices, you may want to enter a product key for the upgraded edition manually. + +**To manually enter a product key** + +1. From either the Start menu or the Start screen, type 'Activation' and click on the Activation shortcut. + +2. Click **Change product key**. + +3. Enter your product key. + +4. Follow the on-screen instructions. + +## Upgrade by purchasing a license from the Microsoft Store +If you do not have a product key, you can upgrade your edition of Windows 10 through the Microsoft Store. + +**To upgrade through the Microsoft Store** + +1. From either the **Start** menu or the **Start** screen, type 'Activation' and click on the Activation shortcut. + +2. Click **Go to Store**. + +3. Follow the on-screen instructions. + + **Note**
              If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/). + +## License expiration + +Volume license customers whose license has expired will need to change the edition of Windows 10 to an edition with an active license. Switching to a downgraded edition of Windows 10 is possible using the same methods that were used to perform an edition upgrade. If the downgrade path is supported, then your apps and settings can be migrated from the current edition. If a path is not supported, then a clean install is required. + +Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a different product key is not supported. You also cannot downgrade from a later version to an earlier version of the same edition (Ex: Windows 10 Pro 1709 to 1703) unless the rollback process is used. This topic does not discuss version downgrades. + +Note: If you are using [Windows 10 Enterprise Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) and a license expires, devices will automatically revert to the original edition when the grace period expires. + +### Scenario example + +Downgrading from Enterprise +- Original edition: **Professional OEM** +- Upgrade edition: **Enterprise** +- Valid downgrade paths: **Pro, Pro for Workstations, Pro Education, Education** + +You can move directly from Enterprise to any valid destination edition. In this example, downgrading to Pro for Workstations, Pro Education, or Education requires an additional activation key to supersede the firmware-embedded Pro key. In all cases, you must comply with [Microsoft License Terms](https://www.microsoft.com/useterms). If you are a volume license customer, refer to the [Microsoft Volume Licensing Reference Guide](https://www.microsoft.com/download/details.aspx?id=11091). + +### Supported Windows 10 downgrade paths + +✔ = Supported downgrade path
              + S  = Supported; Not considered a downgrade or an upgrade
              +[blank] = Not supported or not a downgrade
              + +
              + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Destination edition
                    HomeProPro for WorkstationsPro EducationEducationEnterprise LTSCEnterprise
              Starting edition
              Home
              Pro
              Pro for Workstations
              Pro Education
              EducationS
              Enterprise LTSC
              EnterpriseS
              + +> **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. +> +> **Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above. + +Some slightly more complex scenarios are not represented by the table above. For example, you can perform an upgrade from Pro to Pro for Workstation on a computer with an embedded Pro key using a Pro for Workstation license key, and then later downgrade this computer back to Pro with the firmware-embedded key. The downgrade is allowed but only because the pre-installed OS is Pro. + +## Related topics + +[Windows 10 upgrade paths](https://docs.microsoft.com/windows/deployment/upgrade/windows-10-upgrade-paths)
              +[Windows 10 volume license media](https://docs.microsoft.com/windows/deployment/windows-10-media)
              +[Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index c1cf90e9a0..37da456194 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -22,9 +22,11 @@ ms.topic: article ## Upgrade paths -This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). +This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. -> **Windows 10 version upgrade**: You can directly upgrade a supported version of Windows 10 to a newer version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. +If you are also migrating to a different edition of Windows, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). Methods and supported paths are described on this page to change the edition of Windows. These methods require that you input a license or product key for the new Windows edition prior to starting the upgrade process. Edition downgrade is also supported for some paths, but please note that applications and settings are not maintained when the Windows edition is downgraded. + +> **Windows 10 version upgrade**: You can directly upgrade any semi-annual channel version of Windows 10 to a newer, supported semi-annual channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. > > **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. > @@ -34,7 +36,7 @@ This topic provides a summary of available upgrade paths to Windows 10. You can > > **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355). -✔ = Full upgrade is supported including personal data, settings, and applications.
              +✔ = Full upgrade is supported including personal data, settings, and applications.
              D = Edition downgrade; personal data is maintained, applications and settings are removed.
              diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index f0f918ef4a..562773ef21 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -3,13 +3,14 @@ title: Windows error reporting - Windows IT Pro ms.reviewer: manager: laurawi ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +description: Learn how to review the events generated by Windows Error Reporting when something goes wrong during Windows 10 setup. keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -19,7 +20,7 @@ ms.topic: article **Applies to** - Windows 10 ->[!NOTE] +> [!NOTE] > This is a 300 level topic (moderately advanced). > See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. @@ -28,8 +29,8 @@ When Windows Setup fails, the result and extend code are recorded as an informat To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt: ->[!IMPORTANT] ->}The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. +> [!IMPORTANT] +> The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. ```Powershell $events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"} @@ -68,6 +69,6 @@ The event will also contain links to log files that can be used to perform a det [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md index 6062bfa905..080018fb21 100644 --- a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md +++ b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md @@ -1,79 +1,80 @@ ---- -title: Windows Upgrade and Migration Considerations (Windows 10) -description: Windows Upgrade and Migration Considerations -ms.assetid: 7f85095c-5922-45e9-b28e-91b1263c7281 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows upgrade and migration considerations -Files and application settings can be migrated to new hardware running the Windows® operating system, or they can be maintained during an operating system upgrade on the same computer. This topic summarizes the Microsoft® tools you can use to move files and settings between installations in addition to special considerations for performing an upgrade or migration. - -## Upgrade from a previous version of Windows -You can upgrade from an earlier version of Windows, which means you can install the new version of Windows and retain your applications, files, and settings as they were in your previous version of Windows. If you decide to perform a custom installation of Windows instead of an upgrade, your applications and settings will not be maintained. Your personal files, and all Windows files and directories, will be moved to a Windows.old folder. You can access your data in the Windows.old folder after Windows Setup is complete. - -## Migrate files and settings -Migration tools are available to transfer settings from one computer that is running Windows to another. These tools transfer only the program settings, not the programs themselves. - -For more information about application compatibility, see the [Application Compatibility Toolkit (ACT)](https://go.microsoft.com/fwlink/p/?LinkId=131349). - -The User State Migration Tool (USMT) 10.0 is an application intended for administrators who are performing large-scale automated deployments. For deployment to a small number of computers or for individually customized deployments, you can use Windows Easy Transfer. - -### Migrate with Windows Easy Transfer -Windows Easy Transfer is a software wizard for transferring files and settings from one computer that is running Windows to another. It helps you select what to move to your new computer, enables you to set which migration method to use, and then performs the transfer. When the transfer has completed, Windows Easy Transfer Reports shows you what was transferred and provides a list of programs you might want to install on your new computer, in addition to links to other programs you might want to download. - -With Windows Easy Transfer, files and settings can be transferred using a network share, a USB flash drive (UFD), or the Easy Transfer cable. However, you cannot use a regular universal serial bus (USB) cable to transfer files and settings with Windows Easy Transfer. An Easy Transfer cable can be purchased on the Web, from your computer manufacturer, or at an electronics store. - -> [!NOTE] -> Windows Easy Transfer [is not available in Windows 10](https://support.microsoft.com/help/4026265/windows-windows-easy-transfer-is-not-available-in-windows-10). - -### Migrate with the User State Migration Tool -You can use USMT to automate migration during large deployments of the Windows operating system. USMT uses configurable migration rule (.xml) files to control exactly which user accounts, user files, operating system settings, and application settings are migrated and how they are migrated. You can use USMT for both *side-by-side* migrations, where one piece of hardware is being replaced, or *wipe-and-load* (or *refresh*) migrations, when only the operating system is being upgraded. - -## Upgrade and migration considerations -Whether you are upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations: - -### Application compatibility -For more information about application compatibility in Windows, see [Use Upgrade Readiness to manage Windows upgrades](https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades). - -### Multilingual Windows image upgrades -When performing multilingual Windows upgrades, cross-language upgrades are not supported by USMT. If you are upgrading or migrating an operating system with multiple language packs installed, you can upgrade or migrate only to the system default user interface (UI) language. For example, if English is the default but you have a Spanish language pack installed, you can upgrade or migrate only to English. - -If you are using a single-language Windows image that matches the system default UI language of your multilingual operating system, the migration will work. However, all of the language packs will be removed, and you will have to reinstall them after the upgrade is completed. - -### Errorhandler.cmd -When upgrading from an earlier version of Windows, if you intend to use Errorhandler.cmd, you must copy this file into the %WINDIR%\\Setup\\Scripts directory on the old installation. This makes sure that if there are errors during the down-level phase of Windows Setup, the commands in Errorhandler.cmd will run. - -### Data drive ACL migration -During the configuration pass of Windows Setup, the root access control list (ACL) on drives formatted for NTFS that do not appear to have an operating system will be changed to the default Windows XP ACL format. The ACLs on these drives are changed to enable authenticated users to modify access on folders and files. - -Changing the ACLs may affect the performance of Windows Setup if the default Windows XP ACLs are applied to a partition with a large amount of data. Because of these performance concerns, you can change the following registry value to disable this feature: - -``` syntax -Key: HKLM\System\Setup -Type: REG_DWORD -Value: "DDACLSys_Disabled" = 1 -``` - -This feature is disabled if this registry key value exists and is configured to `1`. - -## Related topics -[User State Migration Tool (USMT) Overview Topics](../usmt/usmt-topics.md)
              -[Windows 10 upgrade paths](windows-10-upgrade-paths.md)
              -[Windows 10 edition upgrade](windows-10-edition-upgrades.md) - - -  - -  - - - - - +--- +title: Windows Upgrade and Migration Considerations (Windows 10) +description: Discover the Microsoft tools you can use to move files and settings between installations, as well as special considerations for performing an upgrade or migration. +ms.assetid: 7f85095c-5922-45e9-b28e-91b1263c7281 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows upgrade and migration considerations +Files and application settings can be migrated to new hardware running the Windows® operating system, or they can be maintained during an operating system upgrade on the same computer. This topic summarizes the Microsoft® tools you can use to move files and settings between installations in addition to special considerations for performing an upgrade or migration. + +## Upgrade from a previous version of Windows +You can upgrade from an earlier version of Windows, which means you can install the new version of Windows and retain your applications, files, and settings as they were in your previous version of Windows. If you decide to perform a custom installation of Windows instead of an upgrade, your applications and settings will not be maintained. Your personal files, and all Windows files and directories, will be moved to a Windows.old folder. You can access your data in the Windows.old folder after Windows Setup is complete. + +## Migrate files and settings +Migration tools are available to transfer settings from one computer that is running Windows to another. These tools transfer only the program settings, not the programs themselves. + +For more information about application compatibility, see the [Application Compatibility Toolkit (ACT)](https://go.microsoft.com/fwlink/p/?LinkId=131349). + +The User State Migration Tool (USMT) 10.0 is an application intended for administrators who are performing large-scale automated deployments. For deployment to a small number of computers or for individually customized deployments, you can use Windows Easy Transfer. + +### Migrate with Windows Easy Transfer +Windows Easy Transfer is a software wizard for transferring files and settings from one computer that is running Windows to another. It helps you select what to move to your new computer, enables you to set which migration method to use, and then performs the transfer. When the transfer has completed, Windows Easy Transfer Reports shows you what was transferred and provides a list of programs you might want to install on your new computer, in addition to links to other programs you might want to download. + +With Windows Easy Transfer, files and settings can be transferred using a network share, a USB flash drive (UFD), or the Easy Transfer cable. However, you cannot use a regular universal serial bus (USB) cable to transfer files and settings with Windows Easy Transfer. An Easy Transfer cable can be purchased on the Web, from your computer manufacturer, or at an electronics store. + +> [!NOTE] +> Windows Easy Transfer [is not available in Windows 10](https://support.microsoft.com/help/4026265/windows-windows-easy-transfer-is-not-available-in-windows-10). + +### Migrate with the User State Migration Tool +You can use USMT to automate migration during large deployments of the Windows operating system. USMT uses configurable migration rule (.xml) files to control exactly which user accounts, user files, operating system settings, and application settings are migrated and how they are migrated. You can use USMT for both *side-by-side* migrations, where one piece of hardware is being replaced, or *wipe-and-load* (or *refresh*) migrations, when only the operating system is being upgraded. + +## Upgrade and migration considerations +Whether you are upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations: + +### Application compatibility +For more information about application compatibility in Windows, see [Use Upgrade Readiness to manage Windows upgrades](https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades). + +### Multilingual Windows image upgrades +When performing multilingual Windows upgrades, cross-language upgrades are not supported by USMT. If you are upgrading or migrating an operating system with multiple language packs installed, you can upgrade or migrate only to the system default user interface (UI) language. For example, if English is the default but you have a Spanish language pack installed, you can upgrade or migrate only to English. + +If you are using a single-language Windows image that matches the system default UI language of your multilingual operating system, the migration will work. However, all of the language packs will be removed, and you will have to reinstall them after the upgrade is completed. + +### Errorhandler.cmd +When upgrading from an earlier version of Windows, if you intend to use Errorhandler.cmd, you must copy this file into the %WINDIR%\\Setup\\Scripts directory on the old installation. This makes sure that if there are errors during the down-level phase of Windows Setup, the commands in Errorhandler.cmd will run. + +### Data drive ACL migration +During the configuration pass of Windows Setup, the root access control list (ACL) on drives formatted for NTFS that do not appear to have an operating system will be changed to the default Windows XP ACL format. The ACLs on these drives are changed to enable authenticated users to modify access on folders and files. + +Changing the ACLs may affect the performance of Windows Setup if the default Windows XP ACLs are applied to a partition with a large amount of data. Because of these performance concerns, you can change the following registry value to disable this feature: + +``` syntax +Key: HKLM\System\Setup +Type: REG_DWORD +Value: "DDACLSys_Disabled" = 1 +``` + +This feature is disabled if this registry key value exists and is configured to `1`. + +## Related topics +[User State Migration Tool (USMT) Overview Topics](../usmt/usmt-topics.md)
              +[Windows 10 upgrade paths](windows-10-upgrade-paths.md)
              +[Windows 10 edition upgrade](windows-10-edition-upgrades.md) + + +  + +  + + + + + diff --git a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md index 8a830c5fd9..730dd44759 100644 --- a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md +++ b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md @@ -1,86 +1,87 @@ ---- -title: Getting Started with the User State Migration Tool (USMT) (Windows 10) -description: Getting Started with the User State Migration Tool (USMT) -ms.assetid: 506ff1d2-94b8-4460-8672-56aad963504b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Getting Started with the User State Migration Tool (USMT) -This topic outlines the general process that you should follow to migrate files and settings. - -## In this Topic -- [Step 1: Plan Your Migration](#step-1-plan-your-migration) - -- [Step 2: Collect files and settings from the source computer](#step-2-collect-files-and-settings-from-the-source-computer) - -- [Step 3: Prepare the destination computer and restore files and settings](#step-3-prepare-the-destination-computer-and-restore-files-and-settings) - -## Step 1: Plan your migration -1. [Plan Your Migration](usmt-plan-your-migration.md). Depending on whether your migration scenario is refreshing or replacing computers, you can choose an online migration or an offline migration using Windows Preinstallation Environment (WinPE) or the files in the Windows.old directory. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). - -2. [Determine What to Migrate](usmt-determine-what-to-migrate.md). Data you might consider migrating includes end-user information, applications settings, operating-system settings, files, folders, and registry keys. - -3. Determine where to store data. Depending on the size of your migration store, you can store the data remotely, locally in a hard-link migration store or on a local external storage device, or directly on the destination computer. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). - -4. Use the **/GenMigXML** command-line option to determine which files will be included in your migration, and to determine whether any modifications are necessary. For more information see [ScanState Syntax](usmt-scanstate-syntax.md) - -5. Modify copies of the Migration.xml and MigDocs.xml files and create custom .xml files, if it is required. To modify the migration behavior, such as migrating the **Documents** folder but not the **Music** folder, you can create a custom .xml file or modify the rules in the existing migration .xml files. The document finder, or **MigXmlHelper.GenerateDocPatterns** helper function, can be used to automatically find user documents on a computer without creating extensive custom migration .xml files. - - **Important**   - We recommend that you always make and modify copies of the .xml files included in User State Migration Tool (USMT) 10.0. Never modify the original .xml files. - - You can use the MigXML.xsd file to help you write and validate the .xml files. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). - -6. Create a [Config.xml File](usmt-configxml-file.md) if you want to exclude any components from the migration. To create this file, use the [ScanState Syntax](usmt-scanstate-syntax.md) option together with the other .xml files when you use the **ScanState** command. For example, the following command creates a Config.xml file by using the MigDocs and MigApp.xml files: - - `scanstate /genconfig:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scanstate.log` - -7. Review the migration state of the components listed in the Config.xml file, and specify `migrate=no` for any components that you do not want to migrate. - -## Step 2: Collect files and settings from the source computer -1. Back up the source computer. - -2. Close all applications. If some applications are running when you run the **ScanState** command, USMT might not migrate all of the specified data. For example, if Microsoft® Office Outlook® is open, USMT might not migrate PST files. - - **Note**   - USMT will fail if it cannot migrate a file or setting unless you specify the **/C** option. When you specify the **/C** option, USMT will ignore the errors, and log an error every time that it encounters a file that is being used that USMT did not migrate. You can use the **<ErrorControl>** section in the Config.xml file to specify which errors should be ignored, and which should cause the migration to fail. - -3. Run the **ScanState** command on the source computer to collect files and settings. You should specify all of the .xml files that you want the **ScanState** command to use. For example, - - `scanstate \\server\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log` - - **Note**   - If the source computer is running Windows 7, or Windows 8, you must run the **ScanState** command in **Administrator** mode. To run in **Administrator** mode, right-click **Command Prompt**, and then click **Run As Administrator**. If the source computer is running Windows XP, you must run the **ScanState** command from an account that has administrative credentials. For more information about the how the **ScanState** command processes and stores the data, see [How USMT Works](usmt-how-it-works.md). - -4. Run the **USMTUtils** command with the **/Verify** option to ensure that the store you created is not corrupted. - -## Step 3: Prepare the destination computer and restore files and settings -1. Install the operating system on the destination computer. - -2. Install all applications that were on the source computer. Although it is not always required, we recommend installing all applications on the destination computer before you restore the user state. This makes sure that migrated settings are preserved. - - **Note**   - The application version that is installed on the destination computer should be the same version as the one on the source computer. USMT does not support migrating the settings for an older version of an application to a newer version. The exception to this is Microsoft® Office, which USMT can migrate from an older version to a newer version. - -3. Close all applications. If some applications are running when you run the **LoadState** command, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files. - - **Note**   - Use **/C** to continue your migration if errors are encountered, and use the **<ErrorControl>** section in the Config.xml file to specify which errors should be ignored, and which errors should cause the migration to fail. - -4. Run the **LoadState** command on the destination computer. Specify the same set of .xml files that you specified when you used the **ScanState** command. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file by using the **LoadState** command. Then, the **LoadState** command will migrate only the files and settings that you want to migrate. For more information about the how the **LoadState** command processes and migrates data, see [How USMT Works](usmt-how-it-works.md). - - For example, the following command migrates the files and settings: - - `loadstate \\server\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log` - - **Note**   - Run the **LoadState** command in administrator mode. To do this, right-click **Command Prompt**, and then click **Run As Administrator**. - -5. Log off after you run the **LoadState** command. Some settings (for example, fonts, wallpaper, and screen saver settings) will not take effect until the next time that the user logs on. +--- +title: User State Migration Tool (USMT) - Getting Started (Windows 10) +description: Plan, collect, and prepare your source computer for migration using the User State Migration Tool (USMT). +ms.assetid: 506ff1d2-94b8-4460-8672-56aad963504b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Getting Started with the User State Migration Tool (USMT) +This topic outlines the general process that you should follow to migrate files and settings. + +## In this topic +- [Step 1: Plan Your Migration](#step-1-plan-your-migration) + +- [Step 2: Collect files and settings from the source computer](#step-2-collect-files-and-settings-from-the-source-computer) + +- [Step 3: Prepare the destination computer and restore files and settings](#step-3-prepare-the-destination-computer-and-restore-files-and-settings) + +## Step 1: Plan your migration +1. [Plan Your Migration](usmt-plan-your-migration.md). Depending on whether your migration scenario is refreshing or replacing computers, you can choose an online migration or an offline migration using Windows Preinstallation Environment (WinPE) or the files in the Windows.old directory. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). + +2. [Determine What to Migrate](usmt-determine-what-to-migrate.md). Data you might consider migrating includes end-user information, applications settings, operating-system settings, files, folders, and registry keys. + +3. Determine where to store data. Depending on the size of your migration store, you can store the data remotely, locally in a hard-link migration store or on a local external storage device, or directly on the destination computer. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). + +4. Use the **/GenMigXML** command-line option to determine which files will be included in your migration, and to determine whether any modifications are necessary. For more information see [ScanState Syntax](usmt-scanstate-syntax.md) + +5. Modify copies of the Migration.xml and MigDocs.xml files and create custom .xml files, if it is required. To modify the migration behavior, such as migrating the **Documents** folder but not the **Music** folder, you can create a custom .xml file or modify the rules in the existing migration .xml files. The document finder, or **MigXmlHelper.GenerateDocPatterns** helper function, can be used to automatically find user documents on a computer without creating extensive custom migration .xml files. + + **Important**   + We recommend that you always make and modify copies of the .xml files included in User State Migration Tool (USMT) 10.0. Never modify the original .xml files. + + You can use the MigXML.xsd file to help you write and validate the .xml files. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). + +6. Create a [Config.xml File](usmt-configxml-file.md) if you want to exclude any components from the migration. To create this file, use the [ScanState Syntax](usmt-scanstate-syntax.md) option together with the other .xml files when you use the **ScanState** command. For example, the following command creates a Config.xml file by using the MigDocs and MigApp.xml files: + + `scanstate /genconfig:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scanstate.log` + +7. Review the migration state of the components listed in the Config.xml file, and specify `migrate=no` for any components that you do not want to migrate. + +## Step 2: Collect files and settings from the source computer +1. Back up the source computer. + +2. Close all applications. If some applications are running when you run the **ScanState** command, USMT might not migrate all of the specified data. For example, if Microsoft® Office Outlook® is open, USMT might not migrate PST files. + + **Note**   + USMT will fail if it cannot migrate a file or setting unless you specify the **/C** option. When you specify the **/C** option, USMT will ignore the errors, and log an error every time that it encounters a file that is being used that USMT did not migrate. You can use the **<ErrorControl>** section in the Config.xml file to specify which errors should be ignored, and which should cause the migration to fail. + +3. Run the **ScanState** command on the source computer to collect files and settings. You should specify all of the .xml files that you want the **ScanState** command to use. For example, + + `scanstate \\server\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log` + + **Note**   + If the source computer is running Windows 7, or Windows 8, you must run the **ScanState** command in **Administrator** mode. To run in **Administrator** mode, right-click **Command Prompt**, and then click **Run As Administrator**. If the source computer is running Windows XP, you must run the **ScanState** command from an account that has administrative credentials. For more information about the how the **ScanState** command processes and stores the data, see [How USMT Works](usmt-how-it-works.md). + +4. Run the **USMTUtils** command with the **/Verify** option to ensure that the store you created is not corrupted. + +## Step 3: Prepare the destination computer and restore files and settings +1. Install the operating system on the destination computer. + +2. Install all applications that were on the source computer. Although it is not always required, we recommend installing all applications on the destination computer before you restore the user state. This makes sure that migrated settings are preserved. + + **Note**   + The application version that is installed on the destination computer should be the same version as the one on the source computer. USMT does not support migrating the settings for an older version of an application to a newer version. The exception to this is Microsoft® Office, which USMT can migrate from an older version to a newer version. + +3. Close all applications. If some applications are running when you run the **LoadState** command, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files. + + **Note**   + Use **/C** to continue your migration if errors are encountered, and use the **<ErrorControl>** section in the Config.xml file to specify which errors should be ignored, and which errors should cause the migration to fail. + +4. Run the **LoadState** command on the destination computer. Specify the same set of .xml files that you specified when you used the **ScanState** command. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file by using the **LoadState** command. Then, the **LoadState** command will migrate only the files and settings that you want to migrate. For more information about the how the **LoadState** command processes and migrates data, see [How USMT Works](usmt-how-it-works.md). + + For example, the following command migrates the files and settings: + + `loadstate \\server\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log` + + **Note**   + Run the **LoadState** command in administrator mode. To do this, right-click **Command Prompt**, and then click **Run As Administrator**. + +5. Log off after you run the **LoadState** command. Some settings (for example, fonts, wallpaper, and screen saver settings) will not take effect until the next time that the user logs on. diff --git a/windows/deployment/usmt/migrate-application-settings.md b/windows/deployment/usmt/migrate-application-settings.md index 8ca3e5b215..0a5069eff9 100644 --- a/windows/deployment/usmt/migrate-application-settings.md +++ b/windows/deployment/usmt/migrate-application-settings.md @@ -1,172 +1,173 @@ ---- -title: Migrate Application Settings (Windows 10) -description: Migrate Application Settings -ms.assetid: 28f70a83-0a3e-4a6b-968a-2b78ccd3cc07 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate Application Settings - - -You can create a custom .xml file to migrate specific line-of-business application settings or to change the default migration behavior of the User State Migration Tool (USMT) 10.0. For ScanState and LoadState to use this file, you must specify the custom .xml file on both command lines. - -This topic defines how to author a custom migration .xml file that migrates the settings of an application that is not migrated by default using MigApp.xml. You should migrate the settings after you install the application, but before the user runs the application for the first time. - -This topic does not contain information about how to migrate applications that store settings in an application-specific store, only the applications that store the information in files or in the registry. It also does not contain information about how to migrate the data that users create using the application. For example, if the application creates .doc files using a specific template, this topic does not discuss how to migrate the .doc files and templates themselves. - -## In this Topic - - -- [Before You Begin](#bkmk-beforebegin) - -- [Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer](#bkmk-step1). - -- [Step 2: Identify settings to collect and determine where each setting is stored on the computer](#bkmk-step2). - -- [Step 3: Identify how to apply the gathered settings](#bkmk-step3). - -- [Step 4: Create the migration XML component for the application](#bkmk-step4). - -- [Step 5: Test the application settings migration](#bkmk-step5). - -## Before You Begin - - -You should identify a test computer that contains the operating system of your source computers, and the application whose settings you want to migrate. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 7 on your test computer and then install the application. - -## Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer. - - -Before USMT migrates the settings, you need it to check whether the application is installed on the source computer, and that it is the correct version. If the application is not installed on the source computer, you probably do not want USMT to spend time searching for the application’s settings. More importantly, if USMT collects settings for an application that is not installed, it may migrate settings that will cause the destination computer to function incorrectly. You should also investigate whether there is more than one version of the application. This is because the new version may not store the settings in the same place, which may lead to unexpected results on the destination computer. - -There are many ways to detect if an application is installed. The best practice is to check for an application uninstall key in the registry, and then search the computer for the executable file that installed the application. It is important that you check for both of these items, because sometimes different versions of the same application share the same uninstall key. So even if the key is there, it may not correspond to the version of the application that you want. - -### Check the registry for an application uninstall key. - -When many applications are installed (especially those installed using the Microsoft® Windows® Installer technology), an application uninstall key is created under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall**. For example, when Adobe Acrobat Reader 7 is installed, it creates a key named **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall \\{AC76BA86-7AD7-1033-7B44-A70000000000}**. Therefore, if a computer contains this key, then Adobe Acrobat Reader 7 is installed on the computer. You can check for the existence of a registry key using the **DoesObjectExist** helper function. - -Usually, you can find this key by searching under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** for the name of the application, the name of the application executable file, or for the name of the company that makes the application. You can use the Registry Editor (**Regedit.exe** located in the %**SystemRoot**%) to search the registry. - -### Check the file system for the application executable file. - -You should also check the application binaries for the executable that installed the application. To do this, you will first need to determine where the application is installed and what the name of the executable is. Most applications store the installation location of the application binaries in the registry. You should search the registry for the name of the application, the name of the application executable, or for the name of the company that makes the application, until you find the registry value that contains the installation path. Once you have determined the path to the application executable, you can use the **DoesFileVersionMatch** helper function to check for the correct version of the application executable. For an example of how to do this, see the Windows Live™ Messenger section of the MigApp.xml file. - -## Step 2: Identify settings to collect and determine where each setting is stored on the computer. - - -Next, you should go through the user interface and make a list of all of the available settings. You can reduce the list if there are settings that you do not want to migrate. To determine where each setting is stored, you will need to change each setting and monitor the activity on the registry and the file system. You do not need to migrate the binary files and registry settings that are made when the application is installed. This is because you will need to reinstall the application onto the destination computer. You only need to migrate those settings that are customizable. - -### - -**How To Determine Where Each Setting is Stored** - -1. Download a file and registry monitoring tool, such as the Regmon and Filemon tools, from the [Windows Sysinternals Web site](https://go.microsoft.com/fwlink/p/?linkid=36109). - -2. Shut down as many applications as possible to limit the registry and file system activity on the computer. - -3. Filter the output of the tools so it only displays changes being made by the application. - - **Note**   - Most applications store their settings under the user profile. That is, the settings stored in the file system are under the %**UserProfile**% directory, and the settings stored in the registry are under the **HKEY\_CURRENT\_USER** hive. For these applications you can filter the output of the file and registry monitoring tools to show activity only under these locations. This will considerably reduce the amount of output that you will need to examine. - - - -4. Start the monitoring tool(s), change a setting, and look for registry and file system writes that occurred when you changed the setting. Make sure the changes you make actually take effect. For example, if you are changing a setting in Microsoft Word by selecting a check box in the **Options** dialog box, the change typically will not take effect until you close the dialog box by clicking **OK**. - -5. When the setting is changed, note the changes to the file system and registry. There may be more than one file or registry values for each setting. You should identify the minimal set of file and registry changes that are required to change this setting. This set of files and registry keys is what you will need to migrate in order to migrate the setting. - - **Note**   - Changing an application setting invariably leads to writing to registry keys. If possible, filter the output of the file and registry monitor tool to display only writes to files and registry keys/values. - - - -## Step 3: Identify how to apply the gathered settings. - - -If the version of the application on the source computer is the same as the one on the destination computer, then you do not have to modify the collected files and registry keys. By default, USMT migrates the files and registry keys from the source location to the corresponding location on the destination computer. For example, if a file was collected from the C:\\Documents and Settings\\User1\\My Documents folder and the profile directory on the destination computer is located at D:\\Users\\User1, then USMT will automatically migrate the file to D:\\Users\\User1\\My Documents. However, you may need to modify the location of some settings in the following three cases: - -### Case 1: The version of the application on the destination computer is newer than the one on the source computer. - -In this case, the newer version of the application may be able to read the settings from the source computer without modification. That is, the data collected from an older version of the application is sometimes compatible with the newer version of the application. However, you may need to modify the setting location if either of the following is true: - -- **The newer version of the application has the ability to import settings from an older version.** This mapping usually happens the first time a user runs the newer version after the settings have been migrated. Some applications do this automatically after settings are migrated; however, other applications will only do this if the application was upgraded from the older version. When the application is upgraded, a set of files and/or registry keys is installed that indicates the older version of the application was previously installed. If you perform a clean installation of the newer version (which is the case in most migrations), the computer does not contain this set of files and registry keys so the mapping does not occur. In order to trick the newer version of the application into initiating this import process, your migration script may need to create these files and/or registry keys on the destination computer. - - To identify which files and/or registry keys/values need to be created to cause the import, you should upgrade the older version of the application to the newer one and monitor the changes made to the file system and registry by using the same process described in [How To determine where each setting is stored](#bkmkdetermine). Once you know the set of files that the computer needs, you can use the <`addObjects`> element to add them to the destination computer. - -- [The newer version of the application cannot read settings from the source computer and it is also unable to import the settings into the new format.](#bkmkdetermine) In this case, you will need to create a mapping for each setting from the old locations to the new locations. To do this, determine where the newer version stores each setting using the process described in How to determine where each setting is stored. After you have created the mapping, apply the settings to the new location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. - -### Case 2: The destination computer already contains settings for the application. - -We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. If you must install the application before the migration, you should delete any existing settings using the <`destinationCleanup`> element. If for any reason you want to preserve the settings that are on the destination computer, you can use the <`merge`> element and **DestinationPriority** helper function. - -### Case 3: The application overwrites settings when it is installed. - -We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. Also, when some applications are installed, they overwrite any existing settings that are on the computer. In this scenario, if you migrated the data before you installed the application, your customized settings would be overwritten. This is common for applications that store settings in locations that are outside of the user profile (typically these are settings that apply to all users). These universal settings are sometimes overwritten when an application is installed, and they are replaced by default values. To avoid this, you must install these applications before migrating the files and settings to the destination computer. By default with USMT, data from the source computer overwrites data that already exists in the same location on the destination computer. - -## Step 4: Create the migration XML component for the application - - -After you have completed steps 1 through 3, you will need to create a custom migration .xml file that migrates the application based on the information that you now have. You can use the MigApp.xml file as a model because it contains examples of many of the concepts discussed in this topic. You can also see [Custom XML Examples](usmt-custom-xml-examples.md) for another sample .xml file. - -**Note**   -We recommend that you create a separate .xml file instead of adding your script to the **MigApp.xml** file. This is because the **MigApp.xml** file is a very large file and it will be difficult to read and edit. In addition, if you reinstall USMT for some reason, the **MigApp.xml** file will be overwritten by the default version of the file and you will lose your customized version. - - - -**Important**   -Some applications store information in the user profile that should not be migrated (for example, application installation paths, the computer name, and so on). You should make sure to exclude these files and registry keys from the migration. - - - -Your script should do the following: - -1. Check whether the application and correct version is installed by: - - - Searching for the installation uninstall key under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** using the **DoesObjectExist** helper function. - - - Checking for the correct version of the application executable file using the **DoesFileVersionMatch** helper function. - -2. If the correct version of the application is installed, then ensure that each setting is migrated to the appropriate location on the destination computer. - - - If the versions of the applications are the same on both the source and destination computers, migrate each setting using the <`include`> and <`exclude`> elements. - - - If the version of the application on the destination computer is newer than the one on the source computer, and the application cannot import the settings, your script should either 1) add the set of files that trigger the import using the <`addObjects`> element or 2) create a mapping that applies the old settings to the correct location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. - - - If you must install the application before migrating the settings, delete any settings that are already on the destination computer using the <`destinationCleanup`> element. - -For information about the .xml elements and helper functions, see [XML Elements Library](usmt-xml-elements-library.md). - -## Step 5: Test the application settings migration - - -On a test computer, install the operating system that will be installed on the destination computers. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 10 and the application. Next, run LoadState on the test computer and verify that all settings migrate. Make corrections if necessary and repeat the process until all the necessary settings are migrated correctly. - -To speed up the time it takes to collect and migrate the data, you can migrate only one user at a time, and you can exclude all other components from the migration except the application that you are testing. To specify only User1 in the migration, type: **/ue:\*\\\* /ui:user1**. For more information, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md) and User options in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. To troubleshoot a problem, check the progress log, and the ScanState and LoadState logs, which contain warnings and errors that may point to problems with the migration. - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -[Conflicts and Precedence](usmt-conflicts-and-precedence.md) - -[XML Elements Library](usmt-xml-elements-library.md) - -[Log Files](usmt-log-files.md) - - - - - - - - - +--- +title: Migrate Application Settings (Windows 10) +description: Learn how to author a custom migration .xml file that migrates the settings of an application that isn't migrated by default using MigApp.xml. +ms.assetid: 28f70a83-0a3e-4a6b-968a-2b78ccd3cc07 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate Application Settings + + +You can create a custom .xml file to migrate specific line-of-business application settings or to change the default migration behavior of the User State Migration Tool (USMT) 10.0. For ScanState and LoadState to use this file, you must specify the custom .xml file on both command lines. + +This topic defines how to author a custom migration .xml file that migrates the settings of an application that is not migrated by default using MigApp.xml. You should migrate the settings after you install the application, but before the user runs the application for the first time. + +This topic does not contain information about how to migrate applications that store settings in an application-specific store, only the applications that store the information in files or in the registry. It also does not contain information about how to migrate the data that users create using the application. For example, if the application creates .doc files using a specific template, this topic does not discuss how to migrate the .doc files and templates themselves. + +## In this Topic + + +- [Before You Begin](#bkmk-beforebegin) + +- [Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer](#bkmk-step1). + +- [Step 2: Identify settings to collect and determine where each setting is stored on the computer](#bkmk-step2). + +- [Step 3: Identify how to apply the gathered settings](#bkmk-step3). + +- [Step 4: Create the migration XML component for the application](#bkmk-step4). + +- [Step 5: Test the application settings migration](#bkmk-step5). + +## Before You Begin + + +You should identify a test computer that contains the operating system of your source computers, and the application whose settings you want to migrate. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 7 on your test computer and then install the application. + +## Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer. + + +Before USMT migrates the settings, you need it to check whether the application is installed on the source computer, and that it is the correct version. If the application is not installed on the source computer, you probably do not want USMT to spend time searching for the application’s settings. More importantly, if USMT collects settings for an application that is not installed, it may migrate settings that will cause the destination computer to function incorrectly. You should also investigate whether there is more than one version of the application. This is because the new version may not store the settings in the same place, which may lead to unexpected results on the destination computer. + +There are many ways to detect if an application is installed. The best practice is to check for an application uninstall key in the registry, and then search the computer for the executable file that installed the application. It is important that you check for both of these items, because sometimes different versions of the same application share the same uninstall key. So even if the key is there, it may not correspond to the version of the application that you want. + +### Check the registry for an application uninstall key. + +When many applications are installed (especially those installed using the Microsoft® Windows® Installer technology), an application uninstall key is created under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall**. For example, when Adobe Acrobat Reader 7 is installed, it creates a key named **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall \\{AC76BA86-7AD7-1033-7B44-A70000000000}**. Therefore, if a computer contains this key, then Adobe Acrobat Reader 7 is installed on the computer. You can check for the existence of a registry key using the **DoesObjectExist** helper function. + +Usually, you can find this key by searching under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** for the name of the application, the name of the application executable file, or for the name of the company that makes the application. You can use the Registry Editor (**Regedit.exe** located in the %**SystemRoot**%) to search the registry. + +### Check the file system for the application executable file. + +You should also check the application binaries for the executable that installed the application. To do this, you will first need to determine where the application is installed and what the name of the executable is. Most applications store the installation location of the application binaries in the registry. You should search the registry for the name of the application, the name of the application executable, or for the name of the company that makes the application, until you find the registry value that contains the installation path. Once you have determined the path to the application executable, you can use the **DoesFileVersionMatch** helper function to check for the correct version of the application executable. For an example of how to do this, see the Windows Live™ Messenger section of the MigApp.xml file. + +## Step 2: Identify settings to collect and determine where each setting is stored on the computer. + + +Next, you should go through the user interface and make a list of all of the available settings. You can reduce the list if there are settings that you do not want to migrate. To determine where each setting is stored, you will need to change each setting and monitor the activity on the registry and the file system. You do not need to migrate the binary files and registry settings that are made when the application is installed. This is because you will need to reinstall the application onto the destination computer. You only need to migrate those settings that are customizable. + +### + +**How To Determine Where Each Setting is Stored** + +1. Download a file and registry monitoring tool, such as the Regmon and Filemon tools, from the [Windows Sysinternals Web site](https://go.microsoft.com/fwlink/p/?linkid=36109). + +2. Shut down as many applications as possible to limit the registry and file system activity on the computer. + +3. Filter the output of the tools so it only displays changes being made by the application. + + **Note**   + Most applications store their settings under the user profile. That is, the settings stored in the file system are under the %**UserProfile**% directory, and the settings stored in the registry are under the **HKEY\_CURRENT\_USER** hive. For these applications you can filter the output of the file and registry monitoring tools to show activity only under these locations. This will considerably reduce the amount of output that you will need to examine. + + + +4. Start the monitoring tool(s), change a setting, and look for registry and file system writes that occurred when you changed the setting. Make sure the changes you make actually take effect. For example, if you are changing a setting in Microsoft Word by selecting a check box in the **Options** dialog box, the change typically will not take effect until you close the dialog box by clicking **OK**. + +5. When the setting is changed, note the changes to the file system and registry. There may be more than one file or registry values for each setting. You should identify the minimal set of file and registry changes that are required to change this setting. This set of files and registry keys is what you will need to migrate in order to migrate the setting. + + **Note**   + Changing an application setting invariably leads to writing to registry keys. If possible, filter the output of the file and registry monitor tool to display only writes to files and registry keys/values. + + + +## Step 3: Identify how to apply the gathered settings. + + +If the version of the application on the source computer is the same as the one on the destination computer, then you do not have to modify the collected files and registry keys. By default, USMT migrates the files and registry keys from the source location to the corresponding location on the destination computer. For example, if a file was collected from the C:\\Documents and Settings\\User1\\My Documents folder and the profile directory on the destination computer is located at D:\\Users\\User1, then USMT will automatically migrate the file to D:\\Users\\User1\\My Documents. However, you may need to modify the location of some settings in the following three cases: + +### Case 1: The version of the application on the destination computer is newer than the one on the source computer. + +In this case, the newer version of the application may be able to read the settings from the source computer without modification. That is, the data collected from an older version of the application is sometimes compatible with the newer version of the application. However, you may need to modify the setting location if either of the following is true: + +- **The newer version of the application has the ability to import settings from an older version.** This mapping usually happens the first time a user runs the newer version after the settings have been migrated. Some applications do this automatically after settings are migrated; however, other applications will only do this if the application was upgraded from the older version. When the application is upgraded, a set of files and/or registry keys is installed that indicates the older version of the application was previously installed. If you perform a clean installation of the newer version (which is the case in most migrations), the computer does not contain this set of files and registry keys so the mapping does not occur. In order to trick the newer version of the application into initiating this import process, your migration script may need to create these files and/or registry keys on the destination computer. + + To identify which files and/or registry keys/values need to be created to cause the import, you should upgrade the older version of the application to the newer one and monitor the changes made to the file system and registry by using the same process described in [How To determine where each setting is stored](#bkmkdetermine). Once you know the set of files that the computer needs, you can use the <`addObjects`> element to add them to the destination computer. + +- [The newer version of the application cannot read settings from the source computer and it is also unable to import the settings into the new format.](#bkmkdetermine) In this case, you will need to create a mapping for each setting from the old locations to the new locations. To do this, determine where the newer version stores each setting using the process described in How to determine where each setting is stored. After you have created the mapping, apply the settings to the new location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. + +### Case 2: The destination computer already contains settings for the application. + +We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. If you must install the application before the migration, you should delete any existing settings using the <`destinationCleanup`> element. If for any reason you want to preserve the settings that are on the destination computer, you can use the <`merge`> element and **DestinationPriority** helper function. + +### Case 3: The application overwrites settings when it is installed. + +We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. Also, when some applications are installed, they overwrite any existing settings that are on the computer. In this scenario, if you migrated the data before you installed the application, your customized settings would be overwritten. This is common for applications that store settings in locations that are outside of the user profile (typically these are settings that apply to all users). These universal settings are sometimes overwritten when an application is installed, and they are replaced by default values. To avoid this, you must install these applications before migrating the files and settings to the destination computer. By default with USMT, data from the source computer overwrites data that already exists in the same location on the destination computer. + +## Step 4: Create the migration XML component for the application + + +After you have completed steps 1 through 3, you will need to create a custom migration .xml file that migrates the application based on the information that you now have. You can use the MigApp.xml file as a model because it contains examples of many of the concepts discussed in this topic. You can also see [Custom XML Examples](usmt-custom-xml-examples.md) for another sample .xml file. + +**Note**   +We recommend that you create a separate .xml file instead of adding your script to the **MigApp.xml** file. This is because the **MigApp.xml** file is a very large file and it will be difficult to read and edit. In addition, if you reinstall USMT for some reason, the **MigApp.xml** file will be overwritten by the default version of the file and you will lose your customized version. + + + +**Important**   +Some applications store information in the user profile that should not be migrated (for example, application installation paths, the computer name, and so on). You should make sure to exclude these files and registry keys from the migration. + + + +Your script should do the following: + +1. Check whether the application and correct version is installed by: + + - Searching for the installation uninstall key under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** using the **DoesObjectExist** helper function. + + - Checking for the correct version of the application executable file using the **DoesFileVersionMatch** helper function. + +2. If the correct version of the application is installed, then ensure that each setting is migrated to the appropriate location on the destination computer. + + - If the versions of the applications are the same on both the source and destination computers, migrate each setting using the <`include`> and <`exclude`> elements. + + - If the version of the application on the destination computer is newer than the one on the source computer, and the application cannot import the settings, your script should either 1) add the set of files that trigger the import using the <`addObjects`> element or 2) create a mapping that applies the old settings to the correct location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. + + - If you must install the application before migrating the settings, delete any settings that are already on the destination computer using the <`destinationCleanup`> element. + +For information about the .xml elements and helper functions, see [XML Elements Library](usmt-xml-elements-library.md). + +## Step 5: Test the application settings migration + + +On a test computer, install the operating system that will be installed on the destination computers. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 10 and the application. Next, run LoadState on the test computer and verify that all settings migrate. Make corrections if necessary and repeat the process until all the necessary settings are migrated correctly. + +To speed up the time it takes to collect and migrate the data, you can migrate only one user at a time, and you can exclude all other components from the migration except the application that you are testing. To specify only User1 in the migration, type: **/ue:\*\\\* /ui:user1**. For more information, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md) and User options in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. To troubleshoot a problem, check the progress log, and the ScanState and LoadState logs, which contain warnings and errors that may point to problems with the migration. + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + +[Conflicts and Precedence](usmt-conflicts-and-precedence.md) + +[XML Elements Library](usmt-xml-elements-library.md) + +[Log Files](usmt-log-files.md) + + + + + + + + + diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md index 2d1d744fa6..84a87a0aac 100644 --- a/windows/deployment/usmt/migration-store-types-overview.md +++ b/windows/deployment/usmt/migration-store-types-overview.md @@ -1,81 +1,82 @@ ---- -title: Migration Store Types Overview (Windows 10) -description: Migration Store Types Overview -ms.assetid: 3b6ce746-76c6-43ff-8cd5-02ed0ae0cf70 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migration Store Types Overview - - -When planning your migration, you should determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers. You should also determine the space needed to create and host the migration store, whether you are using a local share, network share, or storage device. - -## In This Topic - - -[Migration Store Types](#bkmk-types) - -[Local Store vs. Remote Store](#bkmk-localvremote) - -[The /localonly Command-Line Option](#bkmk-localonly) - -## Migration Store Types - - -This section describes the three migration store types available in USMT. - -### Uncompressed (UNC) - -The uncompressed (UNC) migration store is an uncompressed directory with a mirror image of the folder hierarchy being migrated. Each directory and file retains the same access permissions that it has on the local file system. You can use Windows Explorer to view this migration store type. Settings are stored in a catalog file that also describes how to restore files on the destination computer. - -### Compressed - -The compressed migration store is a single image file that contains all files being migrated and a catalog file. This image file is often encrypted and protected with a password, and cannot be navigated with Windows Explorer. - -### Hard-Link - -A hard-link migration store functions as a map that defines how a collection of bits on the hard disk are “wired” into the file system. You use the new USMT hard-link migration store in the PC Refresh scenario only. This is because the hard-link migration store is maintained on the local computer while the old operating system is removed and the new operating system is installed. Using a hard-link migration store saves network bandwidth and minimizes the server use needed to accomplish the migration. - -You use a command-line option,**/hardlink** , to create a hard-link migration store, which functions the same as an uncompressed migration store. Files are not duplicated on the local computer when user state is captured, nor are they duplicated when user state is restored. For more information, see [Hard-Link Migration Store](usmt-hard-link-migration-store.md). - -The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. - -![migration store comparison](images/dep-win8-l-usmt-migrationcomparemigstores.gif) - -## Local Store vs. Remote Store - - -If you have enough space and you are migrating the user state back to the same computer, storing data on a local device is normally the best option to reduce server storage costs and network performance issues. You can store the data locally either on a different partition or on a removable device such as a USB flash drive (UFD). Also, depending on the imaging technology that you are using, you might be able to store the data on the partition that is being re-imaged, if the data will be protected from deletion during the process. To increase performance, store the data on high-speed drives that use a high-speed network connection. It is also good practice to ensure that the migration is the only task the server is performing. - -If there is not enough local disk space, or if you are moving the user state to another computer, then you must store the data remotely. For example, you can store it in on a shared folder, on removable media such as a UFD drive, or you can store it directly on the destination computer. For example, create and share C:\\store on the destination computer. Then run the ScanState command on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store. Then, run the **LoadState** command on the destination computer and specify **C:\\Store** as the store location. By doing this, you do not need to save the files to a server. - -**Important**   -If possible, have users store their data within their %UserProfile%\\My Documents and %UserProfile%\\Application Data folders. This will reduce the chance of USMT missing critical user data that is located in a directory that USMT is not configured to check. - - - -### The /localonly Command-Line Option - -You should use this option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify **/LocalOnly**, see [ScanState Syntax](usmt-scanstate-syntax.md). - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: Migration Store Types Overview (Windows 10) +description: Learn about the migration store types and how to determine which migration store type best suits your needs. +ms.assetid: 3b6ce746-76c6-43ff-8cd5-02ed0ae0cf70 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migration Store Types Overview + + +When planning your migration, you should determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers. You should also determine the space needed to create and host the migration store, whether you are using a local share, network share, or storage device. + +## In This Topic + + +[Migration Store Types](#bkmk-types) + +[Local Store vs. Remote Store](#bkmk-localvremote) + +[The /localonly Command-Line Option](#bkmk-localonly) + +## Migration Store Types + + +This section describes the three migration store types available in USMT. + +### Uncompressed (UNC) + +The uncompressed (UNC) migration store is an uncompressed directory with a mirror image of the folder hierarchy being migrated. Each directory and file retains the same access permissions that it has on the local file system. You can use Windows Explorer to view this migration store type. Settings are stored in a catalog file that also describes how to restore files on the destination computer. + +### Compressed + +The compressed migration store is a single image file that contains all files being migrated and a catalog file. This image file is often encrypted and protected with a password, and cannot be navigated with Windows Explorer. + +### Hard-Link + +A hard-link migration store functions as a map that defines how a collection of bits on the hard disk are “wired” into the file system. You use the new USMT hard-link migration store in the PC Refresh scenario only. This is because the hard-link migration store is maintained on the local computer while the old operating system is removed and the new operating system is installed. Using a hard-link migration store saves network bandwidth and minimizes the server use needed to accomplish the migration. + +You use a command-line option,**/hardlink** , to create a hard-link migration store, which functions the same as an uncompressed migration store. Files are not duplicated on the local computer when user state is captured, nor are they duplicated when user state is restored. For more information, see [Hard-Link Migration Store](usmt-hard-link-migration-store.md). + +The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. + +![migration store comparison](images/dep-win8-l-usmt-migrationcomparemigstores.gif) + +## Local Store vs. Remote Store + + +If you have enough space and you are migrating the user state back to the same computer, storing data on a local device is normally the best option to reduce server storage costs and network performance issues. You can store the data locally either on a different partition or on a removable device such as a USB flash drive (UFD). Also, depending on the imaging technology that you are using, you might be able to store the data on the partition that is being re-imaged, if the data will be protected from deletion during the process. To increase performance, store the data on high-speed drives that use a high-speed network connection. It is also good practice to ensure that the migration is the only task the server is performing. + +If there is not enough local disk space, or if you are moving the user state to another computer, then you must store the data remotely. For example, you can store it in on a shared folder, on removable media such as a UFD drive, or you can store it directly on the destination computer. For example, create and share C:\\store on the destination computer. Then run the ScanState command on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store. Then, run the **LoadState** command on the destination computer and specify **C:\\Store** as the store location. By doing this, you do not need to save the files to a server. + +**Important**   +If possible, have users store their data within their %UserProfile%\\My Documents and %UserProfile%\\Application Data folders. This will reduce the chance of USMT missing critical user data that is located in a directory that USMT is not configured to check. + + + +### The /localonly Command-Line Option + +You should use this option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify **/LocalOnly**, see [ScanState Syntax](usmt-scanstate-syntax.md). + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md index 2eab7ea7b8..d029f8d029 100644 --- a/windows/deployment/usmt/offline-migration-reference.md +++ b/windows/deployment/usmt/offline-migration-reference.md @@ -1,6 +1,6 @@ --- title: Offline Migration Reference (Windows 10) -description: Offline Migration Reference +description: Offline migration enables the ScanState tool to run inside a different Windows OS than the Windows OS from which ScanState is gathering files and settings. ms.assetid: f347547c-d601-4c3e-8f2d-0138edeacfda ms.reviewer: manager: laurawi @@ -17,7 +17,7 @@ ms.topic: article # Offline Migration Reference -Offline migration enables the ScanState tool to run inside a different Windows® operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios: +Offline migration enables the ScanState tool to run inside a different Windows® operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios: - **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine. @@ -31,7 +31,7 @@ When you use User State Migration Tool (USMT) 10.0 to gather and restore user s - **New recovery scenario.** In scenarios where a machine no longer restarts properly, it might be possible to gather user state with the ScanState tool from within WinPE. -## In This Topic +## In This topic - [What Will Migrate Offline?](#bkmk-whatwillmigrate) @@ -61,7 +61,7 @@ The following user data and settings migrate offline, similar to an online migra - EFS files -- Internet Explorer® Favorites +- Internet Explorer® Favorites For exceptions to what you can migrate offline, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) @@ -192,7 +192,7 @@ The following system environment variables are necessary in the scenarios outlin

              MIG_OFFLINE_PLATFORM_ARCH

              32 or 64

              -

              While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn’t function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:

              +

              While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn't function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:

              Set MIG_OFFLINE_PLATFORM_ARCH=32
              @@ -219,7 +219,7 @@ Syntax: < winDir > </ winDir > ### <path> -This element is a required child of **<winDir>** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the ScanState tool’s working directory. +This element is a required child of **<winDir>** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the ScanState tool's working directory. Syntax: <path> c:\\windows </path> @@ -235,7 +235,7 @@ Syntax: <mappings> </mappings> ### <failOnMultipleWinDir> -This element is an optional child of **<offline>**. The **<failOnMultipleWinDir>** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **<failOnMultipleWinDir>** element isn’t present, the default behavior is that the migration does not fail. +This element is an optional child of **<offline>**. The **<failOnMultipleWinDir>** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **<failOnMultipleWinDir>** element isn't present, the default behavior is that the migration does not fail. Syntax: <failOnMultipleWinDir>1</failOnMultipleWinDir> or Syntax: <failOnMultipleWinDir>0</failOnMultipleWinDir> diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md index bc484bd496..1a5ba3389e 100644 --- a/windows/deployment/usmt/understanding-migration-xml-files.md +++ b/windows/deployment/usmt/understanding-migration-xml-files.md @@ -1,6 +1,6 @@ --- title: Understanding Migration XML Files (Windows 10) -description: Understanding Migration XML Files +description: Learn how to modify the behavior of a basic User State Migration Tool (USMT) 10.0 migration by using XML files. ms.assetid: d3d1fe89-085c-4da8-9657-fd54b8bfc4b7 ms.reviewer: manager: laurawi @@ -21,7 +21,7 @@ You can modify the behavior of a basic User State Migration Tool (USMT)10.0 migr This topic provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file. The MigDocs.xml file uses the new **GenerateDocPatterns** function available in USMT to automatically find user documents on a source computer. -## In This Topic +## In This topic [Overview of the Config.xml file](#bkmk-config) @@ -435,7 +435,7 @@ In the examples below, the source computer has a .txt file called "new text docu -To exclude the new text document.txt file as well as any .txt files in “new folder”, you can do the following: +To exclude the new text document.txt file as well as any .txt files in "new folder", you can do the following: **Example 1: Exclude all .txt files in a folder** diff --git a/windows/deployment/usmt/usmt-best-practices.md b/windows/deployment/usmt/usmt-best-practices.md index 48782e0bdc..acf803b701 100644 --- a/windows/deployment/usmt/usmt-best-practices.md +++ b/windows/deployment/usmt/usmt-best-practices.md @@ -1,6 +1,7 @@ --- title: USMT Best Practices (Windows 10) -description: USMT Best Practices +description: This article discusses general and security-related best practices when using User State Migration Tool (USMT) 10.0. +ms.custom: seo-marvel-apr2020 ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2 ms.reviewer: manager: laurawi diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md index 75c4393563..6985683c08 100644 --- a/windows/deployment/usmt/usmt-choose-migration-store-type.md +++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md @@ -1,65 +1,66 @@ ---- -title: Choose a Migration Store Type (Windows 10) -description: Choose a Migration Store Type -ms.assetid: 4e163e90-9c57-490b-b849-2ed52ab6765f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Choose a Migration Store Type - - -One of the main considerations for planning your migration is to determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers, and how much space is needed to create and host the migration store, whether you are using a local share, network share, or storage device. The final consideration is ensuring that user date integrity is maintained by encrypting the migration store. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - -

              Migration Store Types Overview

              Choose the migration store type that works best for your needs and migration scenario.

              Estimate Migration Store Size

              Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.

              Hard-Link Migration Store

              Learn about hard-link migration stores and the scenarios in which they are used.

              Migration Store Encryption

              Learn about the using migration store encryption to protect user data integrity during a migration.

              - - - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - - - - - - - - - +--- +title: Choose a Migration Store Type (Windows 10) +description: Learn how to choose a migration store type and estimate the amount of disk space needed for computers in your organization. +ms.assetid: 4e163e90-9c57-490b-b849-2ed52ab6765f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Choose a Migration Store Type + + +One of the main considerations for planning your migration is to determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers, and how much space is needed to create and host the migration store, whether you are using a local share, network share, or storage device. The final consideration is ensuring that user date integrity is maintained by encrypting the migration store. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + +

              Migration Store Types Overview

              Choose the migration store type that works best for your needs and migration scenario.

              Estimate Migration Store Size

              Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.

              Hard-Link Migration Store

              Learn about hard-link migration stores and the scenarios in which they are used.

              Migration Store Encryption

              Learn about the using migration store encryption to protect user data integrity during a migration.

              + + + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md index 43d9d9c686..85adbc467d 100644 --- a/windows/deployment/usmt/usmt-command-line-syntax.md +++ b/windows/deployment/usmt/usmt-command-line-syntax.md @@ -1,54 +1,55 @@ ---- -title: User State Migration Tool (USMT) Command-line Syntax (Windows 10) -description: User State Migration Tool (USMT) Command-line Syntax -ms.assetid: f9d205c9-e824-46c7-8d8b-d7e4b52fd514 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Command-line Syntax - - -The User State Migration Tool (USMT) 10.0 migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation. - -## In This Section - - - ---- - - - - - - - - - - - - - - -

              ScanState Syntax

              Lists the command-line options for using the ScanState tool.

              LoadState Syntax

              Lists the command-line options for using the LoadState tool.

              UsmtUtils Syntax

              Lists the command-line options for using the UsmtUtils tool.

              - - - - - - - - - - - +--- +title: User State Migration Tool (USMT) Command-line Syntax (Windows 10) +description: Learn about the User State Migration Tool (USMT) command-line syntax for using the ScanState tool, LoadState tool, and UsmtUtils tool. +ms.assetid: f9d205c9-e824-46c7-8d8b-d7e4b52fd514 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Command-line Syntax + + +The User State Migration Tool (USMT) 10.0 migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation. + +## In This Section + + + ++++ + + + + + + + + + + + + + + +

              ScanState Syntax

              Lists the command-line options for using the ScanState tool.

              LoadState Syntax

              Lists the command-line options for using the LoadState tool.

              UsmtUtils Syntax

              Lists the command-line options for using the UsmtUtils tool.

              + + + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-common-issues.md b/windows/deployment/usmt/usmt-common-issues.md index 49aa08dbfe..44a264cb28 100644 --- a/windows/deployment/usmt/usmt-common-issues.md +++ b/windows/deployment/usmt/usmt-common-issues.md @@ -1,340 +1,341 @@ ---- -title: Common Issues (Windows 10) -description: Common Issues -ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.date: 09/19/2017 -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Common Issues - - -The following sections discuss common issues that you might see when you run the User State Migration Tool (USMT) 10.0 tools. USMT produces log files that describe in further detail any errors that occurred during the migration process. These logs can be used to troubleshoot migration failures. - -## In This Topic - - -[User Account Problems](#user) - -[Command-line Problems](#command) - -[XML File Problems](#xml) - -[Migration Problems](#migration) - -[Offline Migration Problems](#bkmk-offline) - -[Hard Link Migration Problems](#bkmk-hardlink) - -[USMT does not migrate the Start layout](#usmt-does-not-migrate-the-start-layout) - -## General Guidelines for Identifying Migration Problems - - -When you encounter a problem or error message during migration, you can use the following general guidelines to help determine the source of the problem: - -- Examine the ScanState, LoadState, and UsmtUtils logs to obtain the exact USMT error messages and Windows® application programming interface (API) error messages. For more information about USMT return codes and error messages, see [Return Codes](usmt-return-codes.md). For more information about Windows API error messages, type **nethelpmsg** on the command line. - - In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v**:5 option when testing your migration. This verbosity level can be adjusted in a production migration; however, reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a verbosity level higher than 5 if you want the log files output to go to a debugger. - - **Note** - Running the ScanState and LoadState tools with the **/v**:5 option creates a detailed log file. Although this option makes the log file large, the extra detail can help you determine where migration errors occurred. - - - -- Use the **/Verify** option in the UsmtUtils tool to determine whether any files in a compressed migration store are corrupted. For more information, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). - -- Use the **/Extract** option in the UsmtUtils tool to extract files from a compressed migration store. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -- Create a progress log using the **/Progress** option to monitor your migration. - -- For the source and destination computers, obtain operating system information, and versions of applications such as Internet Explorer and any other relevant programs. Then verify the exact steps that are needed to reproduce the problem. This information might help you to understand what is wrong and to reproduce the issue in your testing environment. - -- Log off after you run the LoadState tool. Some settings—for example, fonts, desktop backgrounds, and screen-saver settings—will not take effect until the next time the end user logs on. - -- Close all applications before running ScanState or LoadState tools. If some applications are running during the ScanState or LoadState process, USMT might not migrate some data. For example, if Microsoft Outlook® is open, USMT might not migrate PST files. - - **Note** - USMT will fail if it cannot migrate a file or setting unless you specify the **/c** option. When you specify the **/c** option, USMT ignores errors. However, it logs an error when it encounters a file that is in use that did not migrate. - - - -## User Account Problems - - -The following sections describe common user account problems. Expand the section to see recommended solutions. - -### I'm having problems creating local accounts on the destination computer. - -**Resolution:** For more information about creating accounts and migrating local accounts, see [Migrate User Accounts](usmt-migrate-user-accounts.md). - -### Not all of the user accounts were migrated to the destination computer. - -**Causes/Resolutions** There are two possible causes for this problem: - -When running the ScanState tool on Windows Vista, or the ScanState and LoadState tools on Windows 7, Windows 8, or Windows 10, you must run them in Administrator mode from an account with administrative credentials to ensure that all specified users are migrated. To run in Administrator mode: - -1. Click **Start**. - -2. Click **All Programs**. - -3. Click **Accessories**. - -4. Right-click **Command Prompt**. - -5. Click **Run as administrator**. - -Then specify your LoadState or ScanState command. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. - -Any user accounts on the computer that have not been used will not be migrated. For example, if you add User1 to the computer, but User1 never logs on, then USMT will not migrate the User1 account. - -### User accounts that I excluded were migrated to the destination computer. - -**Cause:** The command that you specified might have had conflicting **/ui** and **/ue** options. If a user is specified with the **/ui** option and is also specified to be excluded with either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:domain1\* /ue:domain1\user1`, then User1 will be migrated because the **/ui** option takes precedence. - -**Resolution:** For more information about how to use the **/ui** and **/ue** options together, see the examples in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. - -### I am using the /uel option, but many accounts are still being included in the migration. - -**Cause** The **/uel** option depends on the last modified date of the users' NTUser.dat file. There are scenarios in which this last modified date might not match the users' last logon date. - -**Resolution** This is a limitation of the **/uel** option. You might need to exclude these users manually with the **/ue** option. - -### The LoadState tool reports an error as return code 71 and fails to restore a user profile during a migration test. - -**Cause:** During a migration test, if you run the ScanState tool on your test computer and then delete user profiles in order to test the LoadState tool on the same computer, you may have a conflicting key present in the registry. Using the **net use** command to remove a user profile will delete folders and files associated with that profile, but will not remove the registry key. - -**Resolution:** To delete a user profile, use the **User Accounts** item in Control Panel. To correct an incomplete deletion of a user profile: - -1. Open the registry editor by typing `regedit` at an elevated command prompt. - -2. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`. - - Each user profile is stored in a System Identifier key under `ProfileList`. - -3. Delete the key for the user profile you are trying to remove. - -### Files that were not encrypted before the migration are now encrypted with the account used to run the LoadState tool. - -**Cause:** The ScanState tool was run using the **/EFS: copyraw** option to migrate encrypted files and Encrypting File System (EFS) certificates. The encryption attribute was set on a folder that was migrated, but the attribute was removed from file contents of that folder prior to migration. - -**Resolution:** Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you can run the Cipher tool at the command prompt to review and change encryption settings on files and folders. You must remove the encryption attribute from folders that contain unencrypted files or encrypt the contents of all files within an encrypted folder. - -To remove encryption from files that have already been migrated incorrectly, you must log on to the computer with the account that you used to run the LoadState tool and then remove the encryption from the affected files. - -### The LoadState tool reports an error as return code 71 and a Windows Error 2202 in the log file. - -**Cause:** The computer name was changed during an offline migration of a local user profile. - -**Resolution:** You can use the **/mu** option when you run the LoadState tool to specify a new name for the user. For example, - -``` syntax -loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore -/progress:prog.log /l:load.log /mu:fareast\user1:farwest\user1 -``` - -## Command-line Problems - - -The following sections describe common command-line problems. Expand the section to see recommended solutions. - -### I received the following error message: "Usage Error: You cannot specify a file path with any of the command-line options that exceeds 256 characters." - -**Cause:** You might receive this error message in some cases even if you do not specify a long store or file path, because the path length is calculated based on the absolute path. For example, if you run the **scanstate.exe /o store** command from C:\\Program Files\\USMT40, then each character in "`C:\Program Files\USMT40`" will be added to the length of "store" to get the length of the path. - -**Resolution:** Ensure that the total path length—the store path plus the current directory—does not exceed 256 characters. - -### I received the following error message: "USMT was unable to create the log file(s). Ensure that you have write access to the log directory." - -**Cause:** If you are running the ScanState or LoadState tools from a shared network resource, you will receive this error message if you do not specify **/l**. - -**Resolution:** To fix this issue in this scenario, specify the **/l:scan.log** or **/l:load.log** option. - -## XML File Problems - - -The following sections describe common XML file problems. Expand the section to see recommended solutions. - -### I used the /genconfig option to create a Config.xml file, but I see only a few applications and components that are in MigApp.xml. Why does Config.xml not contain all of the same applications? - -**Cause:** Config.xml will contain only operating system components, applications, and the user document sections that are in both of the .xml files and are installed on the computer when you run the **/genconfig** option. Otherwise, these applications and components will not appear in the Config.xml file. - -**Resolution:** Install all of the desired applications on the computer before running the **/genconfig** option. Then run ScanState with all of the .xml files. For example, run the following: - -`scanstate /genconfig:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:scanstate.log` - -### I am having problems with a custom .xml file that I authored, and I cannot verify that the syntax is correct. - -**Resolution:** You can load the XML schema (MigXML.xsd), included with USMT, into your XML authoring tool. For examples, see the [Visual Studio Development Center](https://go.microsoft.com/fwlink/p/?LinkId=74513). Then, load your .xml file in the authoring tool to see if there is a syntax error. In addition, see [USMT XML Reference](usmt-xml-reference.md) for more information about using the XML elements. - -### I am using a MigXML helper function, but the migration isn’t working the way I expected it to.  How do I troubleshoot this issue? - -**Cause:** Typically, this issue is caused by incorrect syntax used in a helper function. You receive a Success return code, but the files you wanted to migrate did not get collected or applied, or weren’t collected or applied in the way you expected. - -**Resolution:** You should search the ScanState or LoadState log for either the component name which contains the MigXML helper function, or the MigXML helper function title, so that you can locate the related warning in the log file. - -## Migration Problems - - -The following sections describe common migration problems. Expand the section to see recommended solutions. - -### Files that I specified to exclude are still being migrated. - -**Cause:** There might be another rule that is including the files. If there is a more specific rule or a conflicting rule, the files will be included in the migration. - -**Resolution:** For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md) and the Diagnostic Log section in [Log Files](usmt-log-files.md). - -### I specified rules to move a folder to a specific location on the destination computer, but it has not migrated correctly. - -**Cause:** There might be an error in the XML syntax. - -**Resolution:** You can use the USMT XML schema (MigXML.xsd) to write and validate migration .xml files. Also see the XML examples in the following topics: - -[Conflicts and Precedence](usmt-conflicts-and-precedence.md) - -[Exclude Files and Settings](usmt-exclude-files-and-settings.md) - -[Reroute Files and Settings](usmt-reroute-files-and-settings.md) - -[Include Files and Settings](usmt-include-files-and-settings.md) - -[Custom XML Examples](usmt-custom-xml-examples.md) - -### After LoadState completes, the new desktop background does not appear on the destination computer. - -There are three typical causes for this issue. - -**Cause \#1:**: Some settings such as fonts, desktop backgrounds, and screen-saver settings are not applied by LoadState until after the destination computer has been restarted. - -**Resolution:** To fix this issue, log off, and then log back on to see the migrated desktop background. - -**Cause \#2:** If the source computer was running Windows® XP and the desktop background was stored in the *Drive*:\\WINDOWS\\Web\\Wallpaper folder—the default folder where desktop backgrounds are stored in Windows XP—the desktop background will not be migrated. Instead, the destination computer will have the default Windows® desktop background. This will occur even if the desktop background was a custom picture that was added to the \\WINDOWS\\Web\\Wallpaper folder. However, if the end user sets a picture as the desktop background that was saved in another location, for example, My Pictures, then the desktop background will migrate. - -**Resolution:** Ensure that the desktop background images that you want to migrate are not in the \\WINDOWS\\Web\\Wallpaper folder on the source computer. - -**Cause \#3:** If ScanState was not run on Windows XP from an account with administrative credentials, some operating system settings will not migrate. For example, desktop background settings, screen-saver selections, modem options, media-player settings, and Remote Access Service (RAS) connection phone book (.pbk) files and settings will not migrate. - -**Resolution:** Run the ScanState and LoadState tools from within an account with administrative credentials. - -### I included MigApp.xml in the migration, but some PST files aren’t migrating. - -**Cause:** The MigApp.xml file migrates only the PST files that are linked to Outlook profiles. - -**Resolution:** To migrate PST files that are not linked to Outlook profiles, you must create a separate migration rule to capture these files. - -### USMT does not migrate the Start layout - -**Description:** You are using USMT to migrate profiles from one installation of Windows 10 to another installation of Windows 10 on different hardware. After migration, the user signs in on the new device and does not have the Start menu layout they had previously configured. - -**Cause:** A code change in the Start Menu with Windows 10 version 1607 and later is incompatible with this USMT function. - -**Resolution:** The following workaround is available: - -1. With the user signed in, back up the Start layout using the following Windows PowerShell command. You can specify a different path if desired: - - ``` - Export-StartLayout -Path "C:\Layout\user1.xml" - ``` -2. Migrate the user's profile with USMT. -3. Before the user signs in on the new device, import the Start layout using the following Windows PowerShell command: - - ``` - Import-StartLayout –LayoutPath "C:\Layout\user1.xml" –MountPath %systemdrive% - ``` - -This workaround changes the Default user's Start layout. The workaround does not scale to a mass migrations or multiuser devices, but it can potentially unblock some scenarios. If other users will sign on to the device you should delete layoutmodification.xml from the Default user profile. Otherwise, all users who sign on to that device will use the imported Start layout. - -## Offline Migration Problems - - -The following sections describe common offline migration problems. Expand the section to see recommended solutions. - -### Some of my system settings do not migrate in an offline migration. - -**Cause:** Some system settings, such as desktop backgrounds and network printers, are not supported in an offline migration. For more information, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -**Resolution:** In an offline migration, these system settings must be restored manually. - -### The ScanState tool fails with return code 26. - -**Cause:** A common cause of return code 26 is that a temp profile is active on the source computer. This profile maps to c:\\users\\temp. The ScanState log shows a MigStartupOfflineCaught exception that includes the message "User profile duplicate SID error". - -**Resolution:** You can reboot the computer to get rid of the temp profile or you can set MIG\_FAIL\_ON\_PROFILE\_ERROR=0 to skip the error and exclude the temp profile. - -### Include and Exclude rules for migrating user profiles do not work the same offline as they do online. - -**Cause:** When offline, the DNS server cannot be queried to resolve the user name and SID mapping. - -**Resolution:** Use a Security Identifier (SID) to include a user when running the ScanState tool. For example: - -``` syntax -Scanstate /ui:S1-5-21-124525095-708259637-1543119021* -``` - -The wild card (\*) at the end of the SID will migrate the *SID*\_Classes key as well. - -You can also use patterns for SIDs that identify generic users or groups. For example, you can use the */ue:\*-500* option to exclude the local administrator accounts. For more information about Windows SIDs, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=190277). - -### My script to wipe the disk fails after running the ScanState tool on a 64-bit system. - -**Cause:** The HKLM registry hive is not unloaded after the ScanState tool has finished running. - -**Resolution:** Reboot the computer or unload the registry hive at the command prompt after the ScanState tool has finished running. For example, at a command prompt, type: - -``` syntax -reg.exe unload hklm\$dest$software -``` - -## Hard-Link Migration Problems - - -The following sections describe common hard-link migration problems. Expand the section to see recommended solutions. - -### EFS files are not restored to the new partition. - -**Cause:** EFS files cannot be moved to a new partition with a hard link. The **/efs:hardlink** command-line option is only applicable to files migrated on the same partition. - -**Resolution:** Use the **/efs:copyraw** command-line option to copy EFS files during the migration instead of creating hard links, or manually copy the EFS files from the hard-link store. - -### The ScanState tool cannot delete a previous hard-link migration store. - -**Cause:** The migration store contains hard links to locked files. - -**Resolution:** Use the UsmtUtils tool to delete the store or change the store name. For example, at a command prompt, type: - -``` syntax -USMTutils /rd -``` - -You should also reboot the machine. - - - - - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Frequently Asked Questions](usmt-faq.md) - -[Return Codes](usmt-return-codes.md) - -[UsmtUtils Syntax](usmt-utilities.md) - - - - - - - - - +--- +title: Common Issues (Windows 10) +description: Learn about common issues that you might see when you run the User State Migration Tool (USMT) 10.0 tools. +ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.date: 09/19/2017 +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Common Issues + + +The following sections discuss common issues that you might see when you run the User State Migration Tool (USMT) 10.0 tools. USMT produces log files that describe in further detail any errors that occurred during the migration process. These logs can be used to troubleshoot migration failures. + +## In This Topic + + +[User Account Problems](#user) + +[Command-line Problems](#command) + +[XML File Problems](#xml) + +[Migration Problems](#migration) + +[Offline Migration Problems](#bkmk-offline) + +[Hard Link Migration Problems](#bkmk-hardlink) + +[USMT does not migrate the Start layout](#usmt-does-not-migrate-the-start-layout) + +## General Guidelines for Identifying Migration Problems + + +When you encounter a problem or error message during migration, you can use the following general guidelines to help determine the source of the problem: + +- Examine the ScanState, LoadState, and UsmtUtils logs to obtain the exact USMT error messages and Windows® application programming interface (API) error messages. For more information about USMT return codes and error messages, see [Return Codes](usmt-return-codes.md). For more information about Windows API error messages, type **nethelpmsg** on the command line. + + In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v**:5 option when testing your migration. This verbosity level can be adjusted in a production migration; however, reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a verbosity level higher than 5 if you want the log files output to go to a debugger. + + **Note** + Running the ScanState and LoadState tools with the **/v**:5 option creates a detailed log file. Although this option makes the log file large, the extra detail can help you determine where migration errors occurred. + + + +- Use the **/Verify** option in the UsmtUtils tool to determine whether any files in a compressed migration store are corrupted. For more information, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). + +- Use the **/Extract** option in the UsmtUtils tool to extract files from a compressed migration store. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +- Create a progress log using the **/Progress** option to monitor your migration. + +- For the source and destination computers, obtain operating system information, and versions of applications such as Internet Explorer and any other relevant programs. Then verify the exact steps that are needed to reproduce the problem. This information might help you to understand what is wrong and to reproduce the issue in your testing environment. + +- Log off after you run the LoadState tool. Some settings—for example, fonts, desktop backgrounds, and screen-saver settings—will not take effect until the next time the end user logs on. + +- Close all applications before running ScanState or LoadState tools. If some applications are running during the ScanState or LoadState process, USMT might not migrate some data. For example, if Microsoft Outlook® is open, USMT might not migrate PST files. + + **Note** + USMT will fail if it cannot migrate a file or setting unless you specify the **/c** option. When you specify the **/c** option, USMT ignores errors. However, it logs an error when it encounters a file that is in use that did not migrate. + + + +## User Account Problems + + +The following sections describe common user account problems. Expand the section to see recommended solutions. + +### I'm having problems creating local accounts on the destination computer. + +**Resolution:** For more information about creating accounts and migrating local accounts, see [Migrate User Accounts](usmt-migrate-user-accounts.md). + +### Not all of the user accounts were migrated to the destination computer. + +**Causes/Resolutions** There are two possible causes for this problem: + +When running the ScanState tool on Windows Vista, or the ScanState and LoadState tools on Windows 7, Windows 8, or Windows 10, you must run them in Administrator mode from an account with administrative credentials to ensure that all specified users are migrated. To run in Administrator mode: + +1. Click **Start**. + +2. Click **All Programs**. + +3. Click **Accessories**. + +4. Right-click **Command Prompt**. + +5. Click **Run as administrator**. + +Then specify your LoadState or ScanState command. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. + +Any user accounts on the computer that have not been used will not be migrated. For example, if you add User1 to the computer, but User1 never logs on, then USMT will not migrate the User1 account. + +### User accounts that I excluded were migrated to the destination computer. + +**Cause:** The command that you specified might have had conflicting **/ui** and **/ue** options. If a user is specified with the **/ui** option and is also specified to be excluded with either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:domain1\* /ue:domain1\user1`, then User1 will be migrated because the **/ui** option takes precedence. + +**Resolution:** For more information about how to use the **/ui** and **/ue** options together, see the examples in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. + +### I am using the /uel option, but many accounts are still being included in the migration. + +**Cause** The **/uel** option depends on the last modified date of the users' NTUser.dat file. There are scenarios in which this last modified date might not match the users' last logon date. + +**Resolution** This is a limitation of the **/uel** option. You might need to exclude these users manually with the **/ue** option. + +### The LoadState tool reports an error as return code 71 and fails to restore a user profile during a migration test. + +**Cause:** During a migration test, if you run the ScanState tool on your test computer and then delete user profiles in order to test the LoadState tool on the same computer, you may have a conflicting key present in the registry. Using the **net use** command to remove a user profile will delete folders and files associated with that profile, but will not remove the registry key. + +**Resolution:** To delete a user profile, use the **User Accounts** item in Control Panel. To correct an incomplete deletion of a user profile: + +1. Open the registry editor by typing `regedit` at an elevated command prompt. + +2. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`. + + Each user profile is stored in a System Identifier key under `ProfileList`. + +3. Delete the key for the user profile you are trying to remove. + +### Files that were not encrypted before the migration are now encrypted with the account used to run the LoadState tool. + +**Cause:** The ScanState tool was run using the **/EFS: copyraw** option to migrate encrypted files and Encrypting File System (EFS) certificates. The encryption attribute was set on a folder that was migrated, but the attribute was removed from file contents of that folder prior to migration. + +**Resolution:** Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you can run the Cipher tool at the command prompt to review and change encryption settings on files and folders. You must remove the encryption attribute from folders that contain unencrypted files or encrypt the contents of all files within an encrypted folder. + +To remove encryption from files that have already been migrated incorrectly, you must log on to the computer with the account that you used to run the LoadState tool and then remove the encryption from the affected files. + +### The LoadState tool reports an error as return code 71 and a Windows Error 2202 in the log file. + +**Cause:** The computer name was changed during an offline migration of a local user profile. + +**Resolution:** You can use the **/mu** option when you run the LoadState tool to specify a new name for the user. For example, + +``` syntax +loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore +/progress:prog.log /l:load.log /mu:fareast\user1:farwest\user1 +``` + +## Command-line Problems + + +The following sections describe common command-line problems. Expand the section to see recommended solutions. + +### I received the following error message: "Usage Error: You cannot specify a file path with any of the command-line options that exceeds 256 characters." + +**Cause:** You might receive this error message in some cases even if you do not specify a long store or file path, because the path length is calculated based on the absolute path. For example, if you run the **scanstate.exe /o store** command from C:\\Program Files\\USMT40, then each character in "`C:\Program Files\USMT40`" will be added to the length of "store" to get the length of the path. + +**Resolution:** Ensure that the total path length—the store path plus the current directory—does not exceed 256 characters. + +### I received the following error message: "USMT was unable to create the log file(s). Ensure that you have write access to the log directory." + +**Cause:** If you are running the ScanState or LoadState tools from a shared network resource, you will receive this error message if you do not specify **/l**. + +**Resolution:** To fix this issue in this scenario, specify the **/l:scan.log** or **/l:load.log** option. + +## XML File Problems + + +The following sections describe common XML file problems. Expand the section to see recommended solutions. + +### I used the /genconfig option to create a Config.xml file, but I see only a few applications and components that are in MigApp.xml. Why does Config.xml not contain all of the same applications? + +**Cause:** Config.xml will contain only operating system components, applications, and the user document sections that are in both of the .xml files and are installed on the computer when you run the **/genconfig** option. Otherwise, these applications and components will not appear in the Config.xml file. + +**Resolution:** Install all of the desired applications on the computer before running the **/genconfig** option. Then run ScanState with all of the .xml files. For example, run the following: + +`scanstate /genconfig:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:scanstate.log` + +### I am having problems with a custom .xml file that I authored, and I cannot verify that the syntax is correct. + +**Resolution:** You can load the XML schema (MigXML.xsd), included with USMT, into your XML authoring tool. For examples, see the [Visual Studio Development Center](https://go.microsoft.com/fwlink/p/?LinkId=74513). Then, load your .xml file in the authoring tool to see if there is a syntax error. In addition, see [USMT XML Reference](usmt-xml-reference.md) for more information about using the XML elements. + +### I am using a MigXML helper function, but the migration isn’t working the way I expected it to.  How do I troubleshoot this issue? + +**Cause:** Typically, this issue is caused by incorrect syntax used in a helper function. You receive a Success return code, but the files you wanted to migrate did not get collected or applied, or weren’t collected or applied in the way you expected. + +**Resolution:** You should search the ScanState or LoadState log for either the component name which contains the MigXML helper function, or the MigXML helper function title, so that you can locate the related warning in the log file. + +## Migration Problems + + +The following sections describe common migration problems. Expand the section to see recommended solutions. + +### Files that I specified to exclude are still being migrated. + +**Cause:** There might be another rule that is including the files. If there is a more specific rule or a conflicting rule, the files will be included in the migration. + +**Resolution:** For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md) and the Diagnostic Log section in [Log Files](usmt-log-files.md). + +### I specified rules to move a folder to a specific location on the destination computer, but it has not migrated correctly. + +**Cause:** There might be an error in the XML syntax. + +**Resolution:** You can use the USMT XML schema (MigXML.xsd) to write and validate migration .xml files. Also see the XML examples in the following topics: + +[Conflicts and Precedence](usmt-conflicts-and-precedence.md) + +[Exclude Files and Settings](usmt-exclude-files-and-settings.md) + +[Reroute Files and Settings](usmt-reroute-files-and-settings.md) + +[Include Files and Settings](usmt-include-files-and-settings.md) + +[Custom XML Examples](usmt-custom-xml-examples.md) + +### After LoadState completes, the new desktop background does not appear on the destination computer. + +There are three typical causes for this issue. + +**Cause \#1:**: Some settings such as fonts, desktop backgrounds, and screen-saver settings are not applied by LoadState until after the destination computer has been restarted. + +**Resolution:** To fix this issue, log off, and then log back on to see the migrated desktop background. + +**Cause \#2:** If the source computer was running Windows® XP and the desktop background was stored in the *Drive*:\\WINDOWS\\Web\\Wallpaper folder—the default folder where desktop backgrounds are stored in Windows XP—the desktop background will not be migrated. Instead, the destination computer will have the default Windows® desktop background. This will occur even if the desktop background was a custom picture that was added to the \\WINDOWS\\Web\\Wallpaper folder. However, if the end user sets a picture as the desktop background that was saved in another location, for example, My Pictures, then the desktop background will migrate. + +**Resolution:** Ensure that the desktop background images that you want to migrate are not in the \\WINDOWS\\Web\\Wallpaper folder on the source computer. + +**Cause \#3:** If ScanState was not run on Windows XP from an account with administrative credentials, some operating system settings will not migrate. For example, desktop background settings, screen-saver selections, modem options, media-player settings, and Remote Access Service (RAS) connection phone book (.pbk) files and settings will not migrate. + +**Resolution:** Run the ScanState and LoadState tools from within an account with administrative credentials. + +### I included MigApp.xml in the migration, but some PST files aren’t migrating. + +**Cause:** The MigApp.xml file migrates only the PST files that are linked to Outlook profiles. + +**Resolution:** To migrate PST files that are not linked to Outlook profiles, you must create a separate migration rule to capture these files. + +### USMT does not migrate the Start layout + +**Description:** You are using USMT to migrate profiles from one installation of Windows 10 to another installation of Windows 10 on different hardware. After migration, the user signs in on the new device and does not have the Start menu layout they had previously configured. + +**Cause:** A code change in the Start Menu with Windows 10 version 1607 and later is incompatible with this USMT function. + +**Resolution:** The following workaround is available: + +1. With the user signed in, back up the Start layout using the following Windows PowerShell command. You can specify a different path if desired: + + ``` + Export-StartLayout -Path "C:\Layout\user1.xml" + ``` +2. Migrate the user's profile with USMT. +3. Before the user signs in on the new device, import the Start layout using the following Windows PowerShell command: + + ``` + Import-StartLayout –LayoutPath "C:\Layout\user1.xml" –MountPath %systemdrive% + ``` + +This workaround changes the Default user's Start layout. The workaround does not scale to a mass migrations or multiuser devices, but it can potentially unblock some scenarios. If other users will sign on to the device you should delete layoutmodification.xml from the Default user profile. Otherwise, all users who sign on to that device will use the imported Start layout. + +## Offline Migration Problems + + +The following sections describe common offline migration problems. Expand the section to see recommended solutions. + +### Some of my system settings do not migrate in an offline migration. + +**Cause:** Some system settings, such as desktop backgrounds and network printers, are not supported in an offline migration. For more information, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + +**Resolution:** In an offline migration, these system settings must be restored manually. + +### The ScanState tool fails with return code 26. + +**Cause:** A common cause of return code 26 is that a temp profile is active on the source computer. This profile maps to c:\\users\\temp. The ScanState log shows a MigStartupOfflineCaught exception that includes the message "User profile duplicate SID error". + +**Resolution:** You can reboot the computer to get rid of the temp profile or you can set MIG\_FAIL\_ON\_PROFILE\_ERROR=0 to skip the error and exclude the temp profile. + +### Include and Exclude rules for migrating user profiles do not work the same offline as they do online. + +**Cause:** When offline, the DNS server cannot be queried to resolve the user name and SID mapping. + +**Resolution:** Use a Security Identifier (SID) to include a user when running the ScanState tool. For example: + +``` syntax +Scanstate /ui:S1-5-21-124525095-708259637-1543119021* +``` + +The wild card (\*) at the end of the SID will migrate the *SID*\_Classes key as well. + +You can also use patterns for SIDs that identify generic users or groups. For example, you can use the */ue:\*-500* option to exclude the local administrator accounts. For more information about Windows SIDs, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=190277). + +### My script to wipe the disk fails after running the ScanState tool on a 64-bit system. + +**Cause:** The HKLM registry hive is not unloaded after the ScanState tool has finished running. + +**Resolution:** Reboot the computer or unload the registry hive at the command prompt after the ScanState tool has finished running. For example, at a command prompt, type: + +``` syntax +reg.exe unload hklm\$dest$software +``` + +## Hard-Link Migration Problems + + +The following sections describe common hard-link migration problems. Expand the section to see recommended solutions. + +### EFS files are not restored to the new partition. + +**Cause:** EFS files cannot be moved to a new partition with a hard link. The **/efs:hardlink** command-line option is only applicable to files migrated on the same partition. + +**Resolution:** Use the **/efs:copyraw** command-line option to copy EFS files during the migration instead of creating hard links, or manually copy the EFS files from the hard-link store. + +### The ScanState tool cannot delete a previous hard-link migration store. + +**Cause:** The migration store contains hard links to locked files. + +**Resolution:** Use the UsmtUtils tool to delete the store or change the store name. For example, at a command prompt, type: + +``` syntax +USMTutils /rd +``` + +You should also reboot the machine. + + + + + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Frequently Asked Questions](usmt-faq.md) + +[Return Codes](usmt-return-codes.md) + +[UsmtUtils Syntax](usmt-utilities.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md index bfc3a1013c..30930ac481 100644 --- a/windows/deployment/usmt/usmt-common-migration-scenarios.md +++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md @@ -1,154 +1,155 @@ ---- -title: Common Migration Scenarios (Windows 10) -description: Common Migration Scenarios -ms.assetid: 1d8170d5-e775-4963-b7a5-b55e8987c1e4 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Common Migration Scenarios - - -You use the User State Migration Tool (USMT) 10.0 when hardware and/or operating system upgrades are planned for a large number of computers. USMT manages the migration of an end-user's digital identity by capturing the user's operating-system settings, application settings, and personal files from a source computer and reinstalling them on a destination computer after the upgrade has occurred. - -One common scenario when only the operating system, and not the hardware, is being upgraded is referred to as *PC refresh*. A second common scenario is known as *PC replacement*, where one piece of hardware is being replaced, typically by newer hardware and a newer operating system. - -## In This Topic - - -[PC Refresh](#bkmk-pcrefresh) - -[Scenario One: PC-refresh offline using Windows PE and a hard-link migration store](#bkmk-onepcrefresh) - -[Scenario Two: PC-refresh using a compressed migration store](#bkmk-twopcrefresh) - -[Scenario Three: PC-refresh using a hard-link migration store](#bkmk-threepcrefresh) - -[Scenario Four: PC-refresh using Windows.old folder and a hard-link migration store](#bkmk-fourpcrefresh) - -[PC Replacement](#bkmk-pcreplace) - -[Scenario One: Offline migration using Windows PE and an external migration store](#bkmk-onepcreplace) - -[Scenario Two: Manual network migration](#bkmk-twopcreplace) - -[Scenario Three: Managed network migration](#bkmk-threepcreplace) - -## PC-Refresh - - -The following diagram shows a PC-refresh migration, also known as a computer refresh migration. First, the administrator migrates the user state from a source computer to an intermediate store. After installing the operating system, the administrator migrates the user state back to the source computer. - -  - -![usmt pc refresh scenario](images/dep-win8-l-usmt-pcrefresh.jpg) - -  - -### Scenario One: PC-refresh offline using Windows PE and a hard-link migration store - -A company has just received funds to update the operating system on all of its computers in the accounting department to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, the update is being handled completely offline, without a network connection. An administrator uses Windows Preinstallation Environment (WinPE) and a hard-link migration store to save each user state to their respective computer. - -1. On each computer, the administrator boots the machine into WinPE and runs the ScanState command-line tool, specifying the **/hardlink /nocompress** command-line options. ScanState saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic as well as minimizing migration failures on computers with very limited space available on the hard drive. - -2. On each computer, the administrator installs the company’s standard operating environment (SOE) which includes Windows 10 and other company applications. - -3. The administrator runs the LoadState command-line tool on each computer. LoadState restores each user state back to each computer. - -### Scenario Two: PC-refresh using a compressed migration store - -A company has just received funds to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a compressed migration store to save the user states to a server. - -1. The administrator runs the ScanState command-line tool on each computer. ScanState saves each user state to a server. - -2. On each computer, the administrator installs the company's standard SOE which includes Windows 10 and other company applications. - -3. The administrator runs the LoadState command-line tool on each source computer, and LoadState restores each user state back to the computer. - -### Scenario Three: PC-refresh using a hard-link migration store - -A company has just received funds to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a hard-link migration store to save each user state to their respective computer. - -1. The administrator runs the ScanState command-line tool on each computer, specifying the **/hardlink /nocompress** command-line options. ScanState saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic as well as minimizing migration failures on computers with very limited space available on the hard drive. - -2. On each computer, the administrator installs the company's SOE which includes Windows 10 and other company applications. - -3. The administrator runs the LoadState command-line tool on each computer. LoadState restores each user state back on each computer. - -### Scenario Four: PC-refresh using Windows.old folder and a hard-link migration store - -A company has decided to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses Windows.old and a hard-link migration store to save each user state to their respective computer. - -1. The administrator clean installs Windows 10 on each computer, making sure that the Windows.old directory is created by installing Windows 10 without formatting or repartitioning and by selecting a partition that contains the previous version of Windows. - -2. On each computer, the administrator installs the company’s SOE which includes company applications. - -3. The administrator runs the ScanState and LoadState command-line tools successively on each computer while specifying the **/hardlink /nocompress** command-line options. - -## PC-Replacement - - -The following diagram shows a PC-replacement migration. First, the administrator migrates the user state from the source computer to an intermediate store. After installing the operating system on the destination computer, the administrator migrates the user state from the store to the destination computer. - -  - -![usmt pc replace scenario](images/dep-win8-l-usmt-pcreplace.jpg) - -  - -### Scenario One: Offline migration using WinPE and an external migration store - -A company is allocating 20 new computers to users in the accounting department. The users each have a source computer with their files and settings. In this scenario, migration is being handled completely offline, without a network connection. - -1. On each source computer, an administrator boots the machine into WinPE and runs ScanState to collect the user state to either a server or an external hard disk. - -2. On each new computer, the administrator installs the company's SOE which includes Windows 10 and other company applications. - -3. On each of the new computers, the administrator runs the LoadState tool, restoring each user state from the migration store to one of the new computers. - -### Scenario Two: Manual network migration - -A company receives 50 new laptops for their managers and needs to reallocate 50 older laptops to new employees. In this scenario, an administrator runs the ScanState tool from the cmd prompt on each computer to collect the user states and save them to a server in a compressed migration store. - -1. The administrator runs the ScanState tool on each of the manager’s old laptops, and saves each user state to a server. - -2. On the new laptops, the administrator installs the company's SOE, which includes Windows 10 and other company applications. - -3. The administrator runs the LoadState tool on the new laptops to migrate the managers’ user states to the appropriate computer. The new laptops are now ready for the managers to use. - -4. On the old computers, the administrator installs the company’s SOE, which includes Windows 10, Microsoft Office, and other company applications. The old computers are now ready for the new employees to use. - -### Scenario Three: Managed network migration - -A company is allocating 20 new computers to users in the accounting department. The users each have a source computer that contains their files and settings. An administrator uses a management technology such as a logon script or a batch file to run ScanState on each source computer to collect the user states and save them to a server in a compressed migration store. - -1. On each source computer, the administrator runs the ScanState tool using Microsoft System Center Configuration Manager (SCCM), Microsoft Deployment Toolkit (MDT), a logon script, a batch file, or a non-Microsoft management technology. ScanState collects the user state from each source computer and then saves it to a server. - -2. On each new computer, the administrator installs the company's SOE, which includes Windows 10 and other company applications. - -3. On each of the new computers, the administrator runs the LoadState tool using System Center Configuration Manager, a logon script, a batch file, or a non-Microsoft management technology. LoadState migrates each user state from the migration store to one of the new computers. - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - -[Choose a Migration Store Type](usmt-choose-migration-store-type.md) - -[Offline Migration Reference](offline-migration-reference.md) - -  - -  - - - - - +--- +title: Common Migration Scenarios (Windows 10) +description: See how the User State Migration Tool (USMT) 10.0 is used when planning hardware and/or operating system upgrades. +ms.assetid: 1d8170d5-e775-4963-b7a5-b55e8987c1e4 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Common Migration Scenarios + + +You use the User State Migration Tool (USMT) 10.0 when hardware and/or operating system upgrades are planned for a large number of computers. USMT manages the migration of an end-user's digital identity by capturing the user's operating-system settings, application settings, and personal files from a source computer and reinstalling them on a destination computer after the upgrade has occurred. + +One common scenario when only the operating system, and not the hardware, is being upgraded is referred to as *PC refresh*. A second common scenario is known as *PC replacement*, where one piece of hardware is being replaced, typically by newer hardware and a newer operating system. + +## In this topic + + +[PC Refresh](#bkmk-pcrefresh) + +[Scenario One: PC-refresh offline using Windows PE and a hard-link migration store](#bkmk-onepcrefresh) + +[Scenario Two: PC-refresh using a compressed migration store](#bkmk-twopcrefresh) + +[Scenario Three: PC-refresh using a hard-link migration store](#bkmk-threepcrefresh) + +[Scenario Four: PC-refresh using Windows.old folder and a hard-link migration store](#bkmk-fourpcrefresh) + +[PC Replacement](#bkmk-pcreplace) + +[Scenario One: Offline migration using Windows PE and an external migration store](#bkmk-onepcreplace) + +[Scenario Two: Manual network migration](#bkmk-twopcreplace) + +[Scenario Three: Managed network migration](#bkmk-threepcreplace) + +## PC-Refresh + + +The following diagram shows a PC-refresh migration, also known as a computer refresh migration. First, the administrator migrates the user state from a source computer to an intermediate store. After installing the operating system, the administrator migrates the user state back to the source computer. + +  + +![usmt pc refresh scenario](images/dep-win8-l-usmt-pcrefresh.jpg) + +  + +### Scenario One: PC-refresh offline using Windows PE and a hard-link migration store + +A company has just received funds to update the operating system on all of its computers in the accounting department to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, the update is being handled completely offline, without a network connection. An administrator uses Windows Preinstallation Environment (WinPE) and a hard-link migration store to save each user state to their respective computer. + +1. On each computer, the administrator boots the machine into WinPE and runs the ScanState command-line tool, specifying the **/hardlink /nocompress** command-line options. ScanState saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic as well as minimizing migration failures on computers with very limited space available on the hard drive. + +2. On each computer, the administrator installs the company's standard operating environment (SOE) which includes Windows 10 and other company applications. + +3. The administrator runs the LoadState command-line tool on each computer. LoadState restores each user state back to each computer. + +### Scenario Two: PC-refresh using a compressed migration store + +A company has just received funds to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a compressed migration store to save the user states to a server. + +1. The administrator runs the ScanState command-line tool on each computer. ScanState saves each user state to a server. + +2. On each computer, the administrator installs the company's standard SOE which includes Windows 10 and other company applications. + +3. The administrator runs the LoadState command-line tool on each source computer, and LoadState restores each user state back to the computer. + +### Scenario Three: PC-refresh using a hard-link migration store + +A company has just received funds to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a hard-link migration store to save each user state to their respective computer. + +1. The administrator runs the ScanState command-line tool on each computer, specifying the **/hardlink /nocompress** command-line options. ScanState saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic as well as minimizing migration failures on computers with very limited space available on the hard drive. + +2. On each computer, the administrator installs the company's SOE which includes Windows 10 and other company applications. + +3. The administrator runs the LoadState command-line tool on each computer. LoadState restores each user state back on each computer. + +### Scenario Four: PC-refresh using Windows.old folder and a hard-link migration store + +A company has decided to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses Windows.old and a hard-link migration store to save each user state to their respective computer. + +1. The administrator clean installs Windows 10 on each computer, making sure that the Windows.old directory is created by installing Windows 10 without formatting or repartitioning and by selecting a partition that contains the previous version of Windows. + +2. On each computer, the administrator installs the company's SOE which includes company applications. + +3. The administrator runs the ScanState and LoadState command-line tools successively on each computer while specifying the **/hardlink /nocompress** command-line options. + +## PC-Replacement + + +The following diagram shows a PC-replacement migration. First, the administrator migrates the user state from the source computer to an intermediate store. After installing the operating system on the destination computer, the administrator migrates the user state from the store to the destination computer. + +  + +![usmt pc replace scenario](images/dep-win8-l-usmt-pcreplace.jpg) + +  + +### Scenario One: Offline migration using WinPE and an external migration store + +A company is allocating 20 new computers to users in the accounting department. The users each have a source computer with their files and settings. In this scenario, migration is being handled completely offline, without a network connection. + +1. On each source computer, an administrator boots the machine into WinPE and runs ScanState to collect the user state to either a server or an external hard disk. + +2. On each new computer, the administrator installs the company's SOE which includes Windows 10 and other company applications. + +3. On each of the new computers, the administrator runs the LoadState tool, restoring each user state from the migration store to one of the new computers. + +### Scenario Two: Manual network migration + +A company receives 50 new laptops for their managers and needs to reallocate 50 older laptops to new employees. In this scenario, an administrator runs the ScanState tool from the cmd prompt on each computer to collect the user states and save them to a server in a compressed migration store. + +1. The administrator runs the ScanState tool on each of the manager's old laptops, and saves each user state to a server. + +2. On the new laptops, the administrator installs the company's SOE, which includes Windows 10 and other company applications. + +3. The administrator runs the LoadState tool on the new laptops to migrate the managers' user states to the appropriate computer. The new laptops are now ready for the managers to use. + +4. On the old computers, the administrator installs the company's SOE, which includes Windows 10, Microsoft Office, and other company applications. The old computers are now ready for the new employees to use. + +### Scenario Three: Managed network migration + +A company is allocating 20 new computers to users in the accounting department. The users each have a source computer that contains their files and settings. An administrator uses a management technology such as a logon script or a batch file to run ScanState on each source computer to collect the user states and save them to a server in a compressed migration store. + +1. On each source computer, the administrator runs the ScanState tool using Microsoft Endpoint Configuration Manager, Microsoft Deployment Toolkit (MDT), a logon script, a batch file, or a non-Microsoft management technology. ScanState collects the user state from each source computer and then saves it to a server. + +2. On each new computer, the administrator installs the company's SOE, which includes Windows 10 and other company applications. + +3. On each of the new computers, the administrator runs the LoadState tool using Microsoft Endpoint Configuration Manager, a logon script, a batch file, or a non-Microsoft management technology. LoadState migrates each user state from the migration store to one of the new computers. + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + +[Choose a Migration Store Type](usmt-choose-migration-store-type.md) + +[Offline Migration Reference](offline-migration-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md index db0aad8633..084c869c9a 100644 --- a/windows/deployment/usmt/usmt-configxml-file.md +++ b/windows/deployment/usmt/usmt-configxml-file.md @@ -1,6 +1,6 @@ --- title: Config.xml File (Windows 10) -description: Config.xml File +description: Learn how the Config.xml file is an optional User State Migration Tool (USMT) 10.0 file that you can create using the /genconfig option with the ScanState.exe tool. ms.assetid: 9dc98e76-5155-4641-bcb3-81915db538e8 ms.reviewer: manager: laurawi @@ -33,7 +33,7 @@ To exclude a component from the Config.xml file, set the **migrate** value to ** -## In This Topic +## In this topic In USMT there are new migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. The following elements and parameters are for use in the Config.xml file only. diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md index 5b40bd3e9d..fdb0e895c5 100644 --- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md +++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md @@ -1,6 +1,6 @@ --- title: Conflicts and Precedence (Windows 10) -description: Conflicts and Precedence +description: In this article, learn how User State Migration Tool (USMT) 10.0 deals with conflicts and precedence. ms.assetid: 0e2691a8-ff1e-4424-879b-4d5a2f8a113a ms.reviewer: manager: laurawi @@ -31,7 +31,7 @@ When you include, exclude, and reroute files and settings, it is important to kn - **You can use the <unconditionalExclude> element to globally exclude data.** This element excludes objects, regardless of any other <include> rules that are in the .xml files. For example, you can use the <unconditionalExclude> element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. -## In This Topic +## In this topic **General** diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md index 66f4f18511..5314d52e8e 100644 --- a/windows/deployment/usmt/usmt-custom-xml-examples.md +++ b/windows/deployment/usmt/usmt-custom-xml-examples.md @@ -1,6 +1,6 @@ --- title: Custom XML Examples (Windows 10) -description: Custom XML Examples +description: Use custom XML examples to learn how to migrate an unsupported application, migrate files and registry keys, and migrate the My Videos folder. ms.assetid: 48f441d9-6c66-43ef-91e9-7c78cde6fcc0 ms.reviewer: manager: laurawi diff --git a/windows/deployment/usmt/usmt-customize-xml-files.md b/windows/deployment/usmt/usmt-customize-xml-files.md index 9376707ccd..37708b7766 100644 --- a/windows/deployment/usmt/usmt-customize-xml-files.md +++ b/windows/deployment/usmt/usmt-customize-xml-files.md @@ -1,138 +1,139 @@ ---- -title: Customize USMT XML Files (Windows 10) -description: Customize USMT XML Files -ms.assetid: d58363c1-fd13-4f65-8b91-9986659dc93e -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Customize USMT XML Files - - -## In This Topic - - -[Overview](#bkmk-overview) - -[Migration .xml Files](#bkmk-migxml) - -[Custom .xml Files](#bkmk-customxmlfiles) - -[The Config.xml File](#bkmk-configxml) - -[Examples](#bkmk-examples) - -[Additional Information](#bkmk-addlinfo) - -## Overview - - -If you want the **ScanState** and **LoadState** tools to use any of the migration .xml files, specify these files at the command line using the **/i** option. Because the **ScanState** and **LoadState** tools need the .xml files to control the migration, specify the same set of .xml files for both the **ScanState** and **LoadState** commands. However, you do not have to specify the Config.xml file with the **/config** option, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. Then the **LoadState** command will migrate only the files and settings that you want to migrate. - -If you leave out an .xml file from the **LoadState** command, all of the data in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified with the **ScanState** command will not apply. For example, if you leave out an .xml file, and it contains a rerouting rule such as: `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files, and they will be migrated to C:\\data. - -To modify the migration, do one or more of the following. - -- **Modify the migration .xml files.** If you want to exclude a portion of a component—for example, you want to migrate C:\\ but exclude all of the .mp3 files—or if you want to move data to a new location on the destination computer, modify the .xml files. To modify these files, you must be familiar with the migration rules and syntax. If you want **ScanState** and **LoadState** to use these files, specify them at the command line when each command is entered. - -- **Create a custom .xml file.** You can also create a custom .xml file to migrate settings for another application, or to change the migration behavior to suit your needs. For **ScanState** and **LoadState** to use this file, specify them on both command lines. - -- **Create and modify a Config.xml file.** Do this if you want to exclude an entire component from the migration. For example, you can use a Config.xml file to exclude the entire My Documents folder, or exclude the settings for an application. Excluding components using a Config.xml file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. In addition, using a Config.xml file is the only way to exclude the operating system settings from being migrated. - -For more information about excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. - -## Migration .xml Files - - -This section describes the migration .xml files that are included with USMT. Each file contains migration rules that control which components are migrated and where they are migrated to on the destination computer. - -**Note**   -You can use the asterisk (\*) wildcard character in each of these files. However, you cannot use a question mark (?) as a wildcard character. - - - -- **The MigApp.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate application settings. - -- **The MigDocs.xml file.** Specify this file with both the **ScanState** and **LoadState** tools to migrate all user folders and files that are found by the **MigXmlHelper.GenerateDocPatterns** helper function. This helper function finds user data that resides on the root of any drive and in the Users directory. However, it does not find and migrate any application data, program files, or any files in the Windows directory. You can modify the MigDocs.xml file. - -- **The MigUser.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate user folders, files, and file types. You can modify the MigUser.xml file. This file does not contain rules that migrate specific user accounts. The only way to specify which user accounts to migrate is on the command line using the **ScanState** and the **LoadState** user options. - - **Note**   - Do not use the MigUser.xml and MigDocs.xml files together. For more information, see the [Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) and [USMT Best Practices](usmt-best-practices.md) topics. - - - -## Custom .xml Files - - -You can create custom .xml files to customize the migration for your unique needs. For example, you may want to create a custom file to migrate a line-of-business application or to modify the default migration behavior. If you want **ScanState** and **LoadState** to use this file, specify it with both commands. For more information, see the How to Create a Custom .xml File topic. - -## The Config.xml File - - -The Config.xml file is an optional file that you create using the **/genconfig** option with the **ScanState** command. You should create and modify this file if you want to exclude certain components from the migration. In addition, you must create and modify this file if you want to exclude any of the operating system settings from being migrated. The Config.xml file format is different from that of the migration .xml files because it does not contain any migration rules. It contains only a list of the operating system components, applications, and the user documents that can be migrated. For an example, see the [Config.xml File](usmt-configxml-file.md) topic. For this reason, excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. However, you cannot use wildcard characters in a Config.xml file. - -If you want to include all of the default components, you do not need to create the Config.xml file. Alternatively, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigDocs.xml, and MigUser.xml files, and you want to exclude only some components, you can create and modify a Config.xml file and leave the other .xml files in their original state. - -When you run the **ScanState** command with the **/genconfig** option, **ScanState** reads the other .xml files that you specify using the **/i** option to create a custom list of components that can be migrated from the computer. This file will contain only operating system components, applications, and the user document sections that are in both of the .xml files and that are installed on the computer when you run the **ScanState** command with the **/genconfig** option. Therefore, you should create this file on a source computer that contains all of the components, applications, and settings that will be present on the destination computers. This will ensure that this file contains every component that can be migrated. The components are organized into sections: <Applications>, <WindowsComponents>, and <Documents>. To choose not to migrate a component, change its entry to `migrate="no"`. - -After you create this file, you need to specify it only with the **ScanState** command using the **/Config** option for it to affect the migration. However, if you want to exclude additional data that you migrated to the store, modify the Config.xml file and specify the updated file with the **LoadState** command. For example, if you collected the My Documents folder in the store, but you decide that you do not want to migrate the My Documents folder to a destination computer, you can modify the Config.xml file to indicate `migrate="no"` before you run the **LoadState** command, and the file will not be migrated. For more information about the precedence that takes place when excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. - -In addition, note the following functionality with the Config.xml file: - -- If a parent component is removed from the migration in the Config.xml file by specifying `migrate="no"`, all of its child components will automatically be removed from the migration, even if the child component is set to `migrate="yes"`. - -- If you mistakenly have two lines of code for the same component where one line specifies `migrate="no"` and the other line specifies `migrate="yes"`, the component will be migrated. - -- In USMT there are several migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. For more information, see the [Config.xml File](usmt-configxml-file.md) topic. - -**Note**   -To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. - - - -### Examples - -- The following command creates a Config.xml file in the current directory, but it does not create a store: - - `scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:5` - -- The following command creates an encrypted store using the Config.xml file and the default migration .xml files: - - `scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:5 /encrypt /key:"mykey"` - -- The following command decrypts the store and migrates the files and settings: - - `loadstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /v:5 /decrypt /key:"mykey"` - -## Additional Information - - -- For more information about how to change the files and settings that are migrated, see the [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -- For more information about each .xml element, see the [XML Elements Library](usmt-xml-elements-library.md) topic. - -- For answers to common questions, see ".xml files" in the [Frequently Asked Questions](usmt-faq.md) topic. - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - -[USMT Resources](usmt-resources.md) - - - - - - - - - +--- +title: Customize USMT XML Files (Windows 10) +description: Learn how to customize USMT XML files. Also, learn about the migration XML files that are included with USMT. +ms.assetid: d58363c1-fd13-4f65-8b91-9986659dc93e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Customize USMT XML Files + + +## In This Topic + + +[Overview](#bkmk-overview) + +[Migration .xml Files](#bkmk-migxml) + +[Custom .xml Files](#bkmk-customxmlfiles) + +[The Config.xml File](#bkmk-configxml) + +[Examples](#bkmk-examples) + +[Additional Information](#bkmk-addlinfo) + +## Overview + + +If you want the **ScanState** and **LoadState** tools to use any of the migration .xml files, specify these files at the command line using the **/i** option. Because the **ScanState** and **LoadState** tools need the .xml files to control the migration, specify the same set of .xml files for both the **ScanState** and **LoadState** commands. However, you do not have to specify the Config.xml file with the **/config** option, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. Then the **LoadState** command will migrate only the files and settings that you want to migrate. + +If you leave out an .xml file from the **LoadState** command, all of the data in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified with the **ScanState** command will not apply. For example, if you leave out an .xml file, and it contains a rerouting rule such as: `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files, and they will be migrated to C:\\data. + +To modify the migration, do one or more of the following. + +- **Modify the migration .xml files.** If you want to exclude a portion of a component—for example, you want to migrate C:\\ but exclude all of the .mp3 files—or if you want to move data to a new location on the destination computer, modify the .xml files. To modify these files, you must be familiar with the migration rules and syntax. If you want **ScanState** and **LoadState** to use these files, specify them at the command line when each command is entered. + +- **Create a custom .xml file.** You can also create a custom .xml file to migrate settings for another application, or to change the migration behavior to suit your needs. For **ScanState** and **LoadState** to use this file, specify them on both command lines. + +- **Create and modify a Config.xml file.** Do this if you want to exclude an entire component from the migration. For example, you can use a Config.xml file to exclude the entire My Documents folder, or exclude the settings for an application. Excluding components using a Config.xml file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. In addition, using a Config.xml file is the only way to exclude the operating system settings from being migrated. + +For more information about excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. + +## Migration .xml Files + + +This section describes the migration .xml files that are included with USMT. Each file contains migration rules that control which components are migrated and where they are migrated to on the destination computer. + +**Note**   +You can use the asterisk (\*) wildcard character in each of these files. However, you cannot use a question mark (?) as a wildcard character. + + + +- **The MigApp.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate application settings. + +- **The MigDocs.xml file.** Specify this file with both the **ScanState** and **LoadState** tools to migrate all user folders and files that are found by the **MigXmlHelper.GenerateDocPatterns** helper function. This helper function finds user data that resides on the root of any drive and in the Users directory. However, it does not find and migrate any application data, program files, or any files in the Windows directory. You can modify the MigDocs.xml file. + +- **The MigUser.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate user folders, files, and file types. You can modify the MigUser.xml file. This file does not contain rules that migrate specific user accounts. The only way to specify which user accounts to migrate is on the command line using the **ScanState** and the **LoadState** user options. + + **Note**   + Do not use the MigUser.xml and MigDocs.xml files together. For more information, see the [Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) and [USMT Best Practices](usmt-best-practices.md) topics. + + + +## Custom .xml Files + + +You can create custom .xml files to customize the migration for your unique needs. For example, you may want to create a custom file to migrate a line-of-business application or to modify the default migration behavior. If you want **ScanState** and **LoadState** to use this file, specify it with both commands. For more information, see the How to Create a Custom .xml File topic. + +## The Config.xml File + + +The Config.xml file is an optional file that you create using the **/genconfig** option with the **ScanState** command. You should create and modify this file if you want to exclude certain components from the migration. In addition, you must create and modify this file if you want to exclude any of the operating system settings from being migrated. The Config.xml file format is different from that of the migration .xml files because it does not contain any migration rules. It contains only a list of the operating system components, applications, and the user documents that can be migrated. For an example, see the [Config.xml File](usmt-configxml-file.md) topic. For this reason, excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. However, you cannot use wildcard characters in a Config.xml file. + +If you want to include all of the default components, you do not need to create the Config.xml file. Alternatively, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigDocs.xml, and MigUser.xml files, and you want to exclude only some components, you can create and modify a Config.xml file and leave the other .xml files in their original state. + +When you run the **ScanState** command with the **/genconfig** option, **ScanState** reads the other .xml files that you specify using the **/i** option to create a custom list of components that can be migrated from the computer. This file will contain only operating system components, applications, and the user document sections that are in both of the .xml files and that are installed on the computer when you run the **ScanState** command with the **/genconfig** option. Therefore, you should create this file on a source computer that contains all of the components, applications, and settings that will be present on the destination computers. This will ensure that this file contains every component that can be migrated. The components are organized into sections: <Applications>, <WindowsComponents>, and <Documents>. To choose not to migrate a component, change its entry to `migrate="no"`. + +After you create this file, you need to specify it only with the **ScanState** command using the **/Config** option for it to affect the migration. However, if you want to exclude additional data that you migrated to the store, modify the Config.xml file and specify the updated file with the **LoadState** command. For example, if you collected the My Documents folder in the store, but you decide that you do not want to migrate the My Documents folder to a destination computer, you can modify the Config.xml file to indicate `migrate="no"` before you run the **LoadState** command, and the file will not be migrated. For more information about the precedence that takes place when excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. + +In addition, note the following functionality with the Config.xml file: + +- If a parent component is removed from the migration in the Config.xml file by specifying `migrate="no"`, all of its child components will automatically be removed from the migration, even if the child component is set to `migrate="yes"`. + +- If you mistakenly have two lines of code for the same component where one line specifies `migrate="no"` and the other line specifies `migrate="yes"`, the component will be migrated. + +- In USMT there are several migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. For more information, see the [Config.xml File](usmt-configxml-file.md) topic. + +**Note**   +To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. + + + +### Examples + +- The following command creates a Config.xml file in the current directory, but it does not create a store: + + `scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:5` + +- The following command creates an encrypted store using the Config.xml file and the default migration .xml files: + + `scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:5 /encrypt /key:"mykey"` + +- The following command decrypts the store and migrates the files and settings: + + `loadstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /v:5 /decrypt /key:"mykey"` + +## Additional Information + + +- For more information about how to change the files and settings that are migrated, see the [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +- For more information about each .xml element, see the [XML Elements Library](usmt-xml-elements-library.md) topic. + +- For answers to common questions, see ".xml files" in the [Frequently Asked Questions](usmt-faq.md) topic. + +## Related topics + + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + +[USMT Resources](usmt-resources.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md index cb04fac7e3..418f73f68c 100644 --- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md +++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md @@ -1,67 +1,54 @@ ---- -title: Determine What to Migrate (Windows 10) -description: Determine What to Migrate -ms.assetid: 01ae1d13-c3eb-4618-b39d-ee5d18d55761 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Determine What to Migrate - - -By default, User State Migration Tool (USMT) 10.0 migrates the items listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md), depending on the migration .xml files you specify. These default settings are often enough for a basic migration. - -However, when considering what settings to migrate, you should also consider what settings you would like the user to be able to configure, if any, and what settings you would like to standardize. Many organizations use their migration as an opportunity to create and begin enforcing a better-managed environment. Some of the settings that users can configure on unmanaged computers prior to the migration can be locked on the new, managed computers. For example, standard wallpaper, Internet Explorer security settings, and desktop configuration are some of the items you can choose to standardize. - -To reduce complexity and increase standardization, your organization should consider creating a *standard operating environment (SOE)*. An SOE is a combination of hardware and software that you distribute to all users. This means selecting a baseline for all computers, including standard hardware drivers; core operating system features; core productivity applications, especially if they are under volume licensing; and core utilities. This environment should also include a standard set of security features, as outlined in the organization’s corporate policy. Using a standard operating environment can vastly simplify the migration and reduce overall deployment challenges. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - -

              Identify Users

              Use command-line options to specify which users to migrate and how they should be migrated.

              Identify Applications Settings

              Determine which applications you want to migrate and prepare a list of application settings to be migrated.

              Identify Operating System Settings

              Use migration to create a new standard environment on each of the destination computers.

              Identify File Types, Files, and Folders

              Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.

              - - - -## Related topics - - -[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - - - - - - - - - +--- +title: Determine What to Migrate (Windows 10) +description: Determine migration settings for standard or customized for the User State Migration Tool (USMT) 10.0. +ms.assetid: 01ae1d13-c3eb-4618-b39d-ee5d18d55761 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Determine What to Migrate + +By default, User State Migration Tool (USMT) 10.0 migrates the items listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md), depending on the migration .xml files you specify. These default settings are often enough for a basic migration. + +However, when considering what settings to migrate, you should also consider what settings you would like the user to be able to configure, if any, and what settings you would like to standardize. Many organizations use their migration as an opportunity to create and begin enforcing a better-managed environment. Some of the settings that users can configure on unmanaged computers prior to the migration can be locked on the new, managed computers. For example, standard wallpaper, Internet Explorer security settings, and desktop configuration are some of the items you can choose to standardize. + +To reduce complexity and increase standardization, your organization should consider creating a *standard operating environment (SOE)*. An SOE is a combination of hardware and software that you distribute to all users. This means selecting a baseline for all computers, including standard hardware drivers; core operating system features; core productivity applications, especially if they are under volume licensing; and core utilities. This environment should also include a standard set of security features, as outlined in the organization’s corporate policy. Using a standard operating environment can vastly simplify the migration and reduce overall deployment challenges. + +## In This Section + + ++++ + + + + + + + + + + + + + + + + + + +

              Identify Users

              Use command-line options to specify which users to migrate and how they should be migrated.

              Identify Applications Settings

              Determine which applications you want to migrate and prepare a list of application settings to be migrated.

              Identify Operating System Settings

              Use migration to create a new standard environment on each of the destination computers.

              Identify File Types, Files, and Folders

              Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.

              + +## Related topics + +[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) diff --git a/windows/deployment/usmt/usmt-estimate-migration-store-size.md b/windows/deployment/usmt/usmt-estimate-migration-store-size.md index 34eeb23adc..51ea6051cb 100644 --- a/windows/deployment/usmt/usmt-estimate-migration-store-size.md +++ b/windows/deployment/usmt/usmt-estimate-migration-store-size.md @@ -1,139 +1,140 @@ ---- -title: Estimate Migration Store Size (Windows 10) -description: Estimate Migration Store Size -ms.assetid: cfb9062b-7a2a-467a-a24e-0b31ce830093 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Estimate Migration Store Size - - -The disk space requirements for a migration are dependent on the size of the migration store and the type of migration. You can estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure. You can also calculate the disk space requirements using the ScanState tool. - -## In This Topic - - -- [Hard Disk Space Requirements](#bkmk-spacereqs). Describes the disk space requirements for the migration store and other considerations on the source and destination computers. - -- [Calculate Disk Space Requirements Using the ScanState Tool](#bkmk-calcdiskspace). Describes how to use the ScanState tool to determine how big the migration store will be on a particular computer. - -- [Estimate Migration Store Size](#bkmk-estmigstoresize). Describes how to estimate the average size of migration stores for the computers in your organization, based on your infrastructure. - -## Hard Disk Space Requirements - - -- **Store.** For non-hard-link migrations, you should ensure that there is enough available disk space at the location where you will save your store to contain the data being migrated. You can save your store to another partition, an external storage device such as a USB flash drive or a server. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). - -- **Source Computer.** The source computer needs enough available space for the following: - - - [E250 megabytes (MB) minimum of hard disk space.](#bkmk-estmigstoresize) Space is needed to support the User State Migration Tool (USMT) 10.0 operations, for example, growth in the page file. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless of the size of the migration. The USMT tools will not create the migration store if 250 MB of disk space is not available. - - - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. This does not include the minimum 250 MB needed to create the migration store. The amount of temporary space required can be calculated using the ScanState tool. - - - [Hard-link migration store.](#bkmk-estmigstoresize) It is not necessary to estimate the size of a hard-link migration store. The only case where the hard-link store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. - -- [Destination computer.](#bkmk-estmigstoresize) The destination computer needs enough available space for the following: - - - [Operating system.](#bkmk-estmigstoresize) - - - [Applications.](#bkmk-estmigstoresize) - - - [Data being migrated.](#bkmk-estmigstoresize) It is important to consider that in addition to the files being migrated, registry information will also require hard disk space for storage. - - - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. The amount of temporary space required can be calculated using the ScanState tool. - -## Calculate Disk Space Requirements using the ScanState Tool - - -You can use the ScanState tool to calculate the disk space requirements for a particular compressed or uncompressed migration. It is not necessary to estimate the migration store size for a hard-link migration since this method does not create a separate migration store. The ScanState tool provides disk space requirements for the state of the computer at the time the tool is run. The state of the computer may change during day to day use so it is recommended that you use the calculations as an estimate when planning your migration. - -**To run the ScanState tool on the source computer with USMT installed,** - -1. Open a command prompt with administrator privileges. - -2. Navigate to the USMT tools. For example, type - - ``` syntax - cd /d "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\User State Migration Tool\" - ``` - - Where *<architecture>* is x86 or amd64. - -3. Run the **ScanState** tool to generate an XML report of the space requirements. At the command prompt, type - - ``` syntax - ScanState.exe /p: - ``` - - Where *<StorePath>* is a path to a directory where the migration store will be saved and *<path to a file>* is the path and filename where the XML report for space requirements will be saved. For example, - - ``` syntax - ScanState.exe c:\store /p:c:\spaceRequirements.xml - ``` - - The migration store will not be created by running this command, but `StorePath` is a required parameter. - -The ScanState tool also allows you to estimate disk space requirements based on a customized migration. For example, you might not want to migrate the My Documents folder to the destination computer. You can specify this in a configuration file when you run the ScanState tool. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). - -**Note**   -To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, the **/p** option, without specifying *<path to a file>* is still available in USMT. - - - -The space requirements report provides two elements, <**storeSize**> and <**temporarySpace**>. The <**temporarySpace**> value shows the disk space, in bytes, that USMT uses to operate during the migration—this does not include the minimum 250 MB needed to support USMT. The <**storeSize**> value shows the disk space, in bytes, required to host the migration store contents on both the source and destination computers. The following example shows a report generated using **/p:***<path to a file>*. - -```xml - - - - 11010592768 - - - 58189144 - - -``` - -Additionally, USMT performs a compliance check for a required minimum of 250 MB of available disk space and will not create a store if the compliance check fails. - -## Estimate Migration Store Size - - -Determine how much space you will need to store the migrated data. You should base your calculations on the volume of e-mail, personal documents, and system settings for each user. The best way to estimate these is to survey several computers to arrive at an average for the size of the store that you will need. - -The amount of space that is required in the store will vary, depending on the local storage strategies your organization uses. For example, one key element that determines the size of migration data sets is e-mail storage. If e-mail is stored centrally, data sets will be smaller. If e-mail is stored locally, such as offline-storage files, data sets will be larger. Mobile users will typically have larger data sets than workstation users. You should perform tests and inventory the network to determine the average data set size in your organization. - -**Note**   -You can create a space-estimate file (Usmtsize.txt), by using the legacy **/p** command-line option to estimate the size of the store. - - - -When trying to determine how much disk space you will need, consider the following issues: - -- **E-mail** : If users deal with a large volume of e-mail or keep e-mail on their local computers instead of on a mail server, the e-mail can take up as much disk space as all other user files combined. Prior to migrating user data, make sure that users who store e-mail locally synchronize their inboxes with their mail server. - -- **User documents**: Frequently, all of a user's documents fit into less than 50 MB of space, depending on the types of files involved. This estimate assumes typical office work, such as word-processing documents and spreadsheets. This estimate can vary substantially based on the types of documents that your organization uses. For example, an architectural firm that predominantly uses computer-aided design (CAD) files needs much more space than a law firm that primarily uses word-processing documents. You do not need to migrate the documents that users store on file servers through mechanisms such as Folder Redirection, as long as users will have access to these locations after the migration. - -- **User system settings** Five megabytes is usually adequate space to save the registry settings. This requirement can fluctuate, however, based on the number of applications that have been installed. It is rare, however, for the user-specific portion of the registry to exceed 5 MB. - -## Related topics - - -[Common Migration Scenarios](usmt-common-migration-scenarios.md) - - - - - - - - - +--- +title: Estimate Migration Store Size (Windows 10) +description: Estimate the disk space requirement for a migration so that you can use User State Migration Tool (USMT). +ms.assetid: cfb9062b-7a2a-467a-a24e-0b31ce830093 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Estimate Migration Store Size + + +The disk space requirements for a migration are dependent on the size of the migration store and the type of migration. You can estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure. You can also calculate the disk space requirements using the ScanState tool. + +## In This Topic + + +- [Hard Disk Space Requirements](#bkmk-spacereqs). Describes the disk space requirements for the migration store and other considerations on the source and destination computers. + +- [Calculate Disk Space Requirements Using the ScanState Tool](#bkmk-calcdiskspace). Describes how to use the ScanState tool to determine how big the migration store will be on a particular computer. + +- [Estimate Migration Store Size](#bkmk-estmigstoresize). Describes how to estimate the average size of migration stores for the computers in your organization, based on your infrastructure. + +## Hard Disk Space Requirements + + +- **Store.** For non-hard-link migrations, you should ensure that there is enough available disk space at the location where you will save your store to contain the data being migrated. You can save your store to another partition, an external storage device such as a USB flash drive or a server. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). + +- **Source Computer.** The source computer needs enough available space for the following: + + - [E250 megabytes (MB) minimum of hard disk space.](#bkmk-estmigstoresize) Space is needed to support the User State Migration Tool (USMT) 10.0 operations, for example, growth in the page file. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless of the size of the migration. The USMT tools will not create the migration store if 250 MB of disk space is not available. + + - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. This does not include the minimum 250 MB needed to create the migration store. The amount of temporary space required can be calculated using the ScanState tool. + + - [Hard-link migration store.](#bkmk-estmigstoresize) It is not necessary to estimate the size of a hard-link migration store. The only case where the hard-link store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. + +- [Destination computer.](#bkmk-estmigstoresize) The destination computer needs enough available space for the following: + + - [Operating system.](#bkmk-estmigstoresize) + + - [Applications.](#bkmk-estmigstoresize) + + - [Data being migrated.](#bkmk-estmigstoresize) It is important to consider that in addition to the files being migrated, registry information will also require hard disk space for storage. + + - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. The amount of temporary space required can be calculated using the ScanState tool. + +## Calculate Disk Space Requirements using the ScanState Tool + + +You can use the ScanState tool to calculate the disk space requirements for a particular compressed or uncompressed migration. It is not necessary to estimate the migration store size for a hard-link migration since this method does not create a separate migration store. The ScanState tool provides disk space requirements for the state of the computer at the time the tool is run. The state of the computer may change during day to day use so it is recommended that you use the calculations as an estimate when planning your migration. + +**To run the ScanState tool on the source computer with USMT installed,** + +1. Open a command prompt with administrator privileges. + +2. Navigate to the USMT tools. For example, type + + ``` syntax + cd /d "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\User State Migration Tool\" + ``` + + Where *<architecture>* is x86 or amd64. + +3. Run the **ScanState** tool to generate an XML report of the space requirements. At the command prompt, type + + ``` syntax + ScanState.exe /p: + ``` + + Where *<StorePath>* is a path to a directory where the migration store will be saved and *<path to a file>* is the path and filename where the XML report for space requirements will be saved. For example, + + ``` syntax + ScanState.exe c:\store /p:c:\spaceRequirements.xml + ``` + + The migration store will not be created by running this command, but `StorePath` is a required parameter. + +The ScanState tool also allows you to estimate disk space requirements based on a customized migration. For example, you might not want to migrate the My Documents folder to the destination computer. You can specify this in a configuration file when you run the ScanState tool. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). + +**Note**   +To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, the **/p** option, without specifying *<path to a file>* is still available in USMT. + + + +The space requirements report provides two elements, <**storeSize**> and <**temporarySpace**>. The <**temporarySpace**> value shows the disk space, in bytes, that USMT uses to operate during the migration—this does not include the minimum 250 MB needed to support USMT. The <**storeSize**> value shows the disk space, in bytes, required to host the migration store contents on both the source and destination computers. The following example shows a report generated using **/p:***<path to a file>*. + +```xml + + + + 11010592768 + + + 58189144 + + +``` + +Additionally, USMT performs a compliance check for a required minimum of 250 MB of available disk space and will not create a store if the compliance check fails. + +## Estimate Migration Store Size + + +Determine how much space you will need to store the migrated data. You should base your calculations on the volume of e-mail, personal documents, and system settings for each user. The best way to estimate these is to survey several computers to arrive at an average for the size of the store that you will need. + +The amount of space that is required in the store will vary, depending on the local storage strategies your organization uses. For example, one key element that determines the size of migration data sets is e-mail storage. If e-mail is stored centrally, data sets will be smaller. If e-mail is stored locally, such as offline-storage files, data sets will be larger. Mobile users will typically have larger data sets than workstation users. You should perform tests and inventory the network to determine the average data set size in your organization. + +**Note**   +You can create a space-estimate file (Usmtsize.txt), by using the legacy **/p** command-line option to estimate the size of the store. + + + +When trying to determine how much disk space you will need, consider the following issues: + +- **E-mail** : If users deal with a large volume of e-mail or keep e-mail on their local computers instead of on a mail server, the e-mail can take up as much disk space as all other user files combined. Prior to migrating user data, make sure that users who store e-mail locally synchronize their inboxes with their mail server. + +- **User documents**: Frequently, all of a user's documents fit into less than 50 MB of space, depending on the types of files involved. This estimate assumes typical office work, such as word-processing documents and spreadsheets. This estimate can vary substantially based on the types of documents that your organization uses. For example, an architectural firm that predominantly uses computer-aided design (CAD) files needs much more space than a law firm that primarily uses word-processing documents. You do not need to migrate the documents that users store on file servers through mechanisms such as Folder Redirection, as long as users will have access to these locations after the migration. + +- **User system settings** Five megabytes is usually adequate space to save the registry settings. This requirement can fluctuate, however, based on the number of applications that have been installed. It is rare, however, for the user-specific portion of the registry to exceed 5 MB. + +## Related topics + + +[Common Migration Scenarios](usmt-common-migration-scenarios.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-exclude-files-and-settings.md b/windows/deployment/usmt/usmt-exclude-files-and-settings.md index 21a829f394..f429351369 100644 --- a/windows/deployment/usmt/usmt-exclude-files-and-settings.md +++ b/windows/deployment/usmt/usmt-exclude-files-and-settings.md @@ -1,279 +1,280 @@ ---- -title: Exclude Files and Settings (Windows 10) -description: Exclude Files and Settings -ms.assetid: df85baf1-6e29-4995-a4bb-ba3f8f7fed0b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Exclude Files and Settings -When you specify the migration .xml files, MigApp.xml, Migdocs, and MigUser.xml, the User State Migration Tool (USMT) 10.0 migrates the settings and components listed, as discussed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) You can create a custom .xml file to further specify what to include or exclude in the migration. In addition you can create a Config.xml file to exclude an entire component from a migration. You cannot, however, exclude users by using the migration .xml files or the Config.xml file. The only way to specify which users to include and exclude is by using the User options on the command line in the ScanState tool. For more information, see [ScanState Syntax](usmt-scanstate-syntax.md). - -In this topic: - -- [Create a custom .xml file](#create-a-custom-xml-file). You can use the following elements to specify what to exclude: - - - include and exclude: You can use the <include> and <exclude> elements to exclude objects with conditions. For example, you can migrate all files located in the C:\\ drive, except any .mp3 files. It is important to remember that [Conflicts and Precedence](usmt-conflicts-and-precedence.md) apply to these elements. - - - [unconditionalExclude](#example-1-how-to-migrate-all-files-from-c-except-mp3-files): You can use the <unconditionalExclude> element to globally exclude data. This element takes precedence over all other include and exclude rules in the .xml files. Therefore, this element excludes objects regardless of any other <include> rules that are in the .xml files. For example, you can exclude all .mp3 files on the computer, or you can exclude all files from C:\\UserData. - -- [Create a Config.xml File](#create-a-config-xml-file): You can create and modify a Config.xml file to exclude an entire component from the migration. For example, you can use this file to exclude the settings for one of the default applications. In addition, creating and modifying a Config.xml file is the only way to exclude the operating-system settings that are migrated to computers running Windows. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. - -## Create a custom .xml file -We recommend that you create a custom .xml file instead of modifying the default migration .xml files. When you use a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. - -### <include> and <exclude> -The migration .xml files, MigApp.xml, MigDocs, and MigUser.xml, contain the <component> element, which typically represents a self-contained component or an application such as Microsoft® Office Outlook® and Word. To exclude the files and registry settings that are associated with these components, use the <include> and <exclude> elements. For example, you can use these elements to migrate all files and settings with pattern X except files and settings with pattern Y, where Y is more specific than X. For the syntax of these elements, see [USMT XML Reference](usmt-xml-reference.md). - -**Note**   -If you specify an <exclude> rule, always specify a corresponding <include> rule. Otherwise, if you do not specify an <include> rule, the specific files or settings will not be included. They will already be excluded from the migration. Thus, an unaccompanied <exclude> rule is unnecessary. - -- [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files) - -- [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-cdata-except-files-in-cdatatmp) - -- [Example 3: How to exclude the files in a folder but include all subfolders](#example-3-how-to-exclude-the-files-in-a-folder-but-include-all-subfolders) - -- [Example 4: How to exclude a file from a specific folder](#example-4-how-to-exclude-a-file-from-a-specific-folder) - -- [Example 5: How to exclude a file from any location](#example-5-how-to-exclude-a-file-from-any-location) - -### Example 1: How to migrate all files from C:\\ except .mp3 files -The following .xml file migrates all files located on the C: drive, except any .mp3 files. - -``` xml - - - - MP3 Files - - - - - C:\* [*] - - - - - C:\* [*.mp3] - - - - - - -``` -### Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp -The following .xml file migrates all files and subfolders in C:\\Data, except the files and subfolders in C:\\Data\\tmp. - -``` xml - - - Test component - - - - - C:\Data\* [*] - - - - - C:\Data\temp\* [*] - - - - - - -``` - -### Example 3: How to exclude the files in a folder but include all subfolders -The following .xml file migrates any subfolders in C:\\EngineeringDrafts, but excludes all files that are in C:\\EngineeringDrafts. - -``` xml - - - Component to migrate all Engineering Drafts Documents without subfolders - - - - - C:\EngineeringDrafts\* [*] - - - - - C:\EngineeringDrafts\ [*] - - - - - - -``` - -### Example 4: How to exclude a file from a specific folder -The following .xml file migrates all files and subfolders in C:\\EngineeringDrafts, except for the Sample.doc file in C:\\EngineeringDrafts. - -``` xml - - - Component to migrate all Engineering Drafts Documents except Sample.doc - - - - - C:\EngineeringDrafts\* [*] - - - - - C:\EngineeringDrafts\ [Sample.doc] - - - - - - -``` - -### Example 5: How to exclude a file from any location -To exclude a Sample.doc file from any location on the C: drive, use the <pattern> element. If multiple files exist with the same name on the C: drive, all of these files will be excluded. - -``` xml - C:\* [Sample.doc] -``` - -To exclude a Sample.doc file from any drive on the computer, use the <script> element. If multiple files exist with the same name, all of these files will be excluded. - -``` xml - -``` -#### Examples of how to use XML to exclude files, folders, and registry keys -Here are some examples of how to use XML to exclude files, folders, and registry keys. For more info, see [USMT XML Reference](usmt-xml-reference.md) - -**Example 1: How to exclude all .mp3 files**
              -The following .xml file excludes all .mp3 files from the migration: - -``` xml - - - Test - - - - - - - - - - - -``` -**Example 2: How to exclude all of the files on a specific drive**
              -The following .xml file excludes only the files located on the C: drive. - -``` xml - - - Test - - - - - c:\*[*] - - - - - - -``` -**Example 3: How to exclude registry keys**
              -The following .xml file unconditionally excludes the HKEY_CURRENT_USER registry key and all of its subkeys. - -``` xml - - - - Test - - - - - HKCU\testReg[*] - - - - - HKCU\*[*] - - - - - - -``` -**Example 4: How to Exclude `C:\Windows` and `C:\Program Files`**
              -The following .xml file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. Note that all \*.docx, \*.xls and \*.ppt files will not be migrated because the <unconditionalExclude> element takes precedence over the <include> element. - -``` xml - - - - Test - - - - - - - - - - - - C:\Program Files\* [*] -C:\Windows\* [*] - - - - - - -``` -## Create a Config XML File -You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. - -- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the <Applications> section of the Config.xml file. - -- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the <WindowsComponents> section. - -- **To exclude My Documents:** Specify `migrate="no"` for My Documents under the <Documents> section. Note that any <include> rules in the .xml files will still apply. For example, if you have a rule that includes all the .docx files in My Documents, then only the .docx files will be migrated, but the rest of the files will not. - -See [Config.xml File](usmt-configxml-file.md) for more information. - -**Note**   -To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. - -## Related topics -- [Customize USMT XML Files](usmt-customize-xml-files.md) -- [USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: Exclude Files and Settings (Windows 10) +description: In this article, learn how to exclude files and settings when creating a custom .xml file and a config.xml file. +ms.assetid: df85baf1-6e29-4995-a4bb-ba3f8f7fed0b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Exclude Files and Settings +When you specify the migration .xml files, MigApp.xml, Migdocs, and MigUser.xml, the User State Migration Tool (USMT) 10.0 migrates the settings and components listed, as discussed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) You can create a custom .xml file to further specify what to include or exclude in the migration. In addition you can create a Config.xml file to exclude an entire component from a migration. You cannot, however, exclude users by using the migration .xml files or the Config.xml file. The only way to specify which users to include and exclude is by using the User options on the command line in the ScanState tool. For more information, see [ScanState Syntax](usmt-scanstate-syntax.md). + +In this topic: + +- [Create a custom .xml file](#create-a-custom-xml-file). You can use the following elements to specify what to exclude: + + - include and exclude: You can use the <include> and <exclude> elements to exclude objects with conditions. For example, you can migrate all files located in the C:\\ drive, except any .mp3 files. It is important to remember that [Conflicts and Precedence](usmt-conflicts-and-precedence.md) apply to these elements. + + - [unconditionalExclude](#example-1-how-to-migrate-all-files-from-c-except-mp3-files): You can use the <unconditionalExclude> element to globally exclude data. This element takes precedence over all other include and exclude rules in the .xml files. Therefore, this element excludes objects regardless of any other <include> rules that are in the .xml files. For example, you can exclude all .mp3 files on the computer, or you can exclude all files from C:\\UserData. + +- [Create a Config.xml File](#create-a-config-xml-file): You can create and modify a Config.xml file to exclude an entire component from the migration. For example, you can use this file to exclude the settings for one of the default applications. In addition, creating and modifying a Config.xml file is the only way to exclude the operating-system settings that are migrated to computers running Windows. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. + +## Create a custom .xml file +We recommend that you create a custom .xml file instead of modifying the default migration .xml files. When you use a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. + +### <include> and <exclude> +The migration .xml files, MigApp.xml, MigDocs, and MigUser.xml, contain the <component> element, which typically represents a self-contained component or an application such as Microsoft® Office Outlook® and Word. To exclude the files and registry settings that are associated with these components, use the <include> and <exclude> elements. For example, you can use these elements to migrate all files and settings with pattern X except files and settings with pattern Y, where Y is more specific than X. For the syntax of these elements, see [USMT XML Reference](usmt-xml-reference.md). + +**Note**   +If you specify an <exclude> rule, always specify a corresponding <include> rule. Otherwise, if you do not specify an <include> rule, the specific files or settings will not be included. They will already be excluded from the migration. Thus, an unaccompanied <exclude> rule is unnecessary. + +- [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files) + +- [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-cdata-except-files-in-cdatatmp) + +- [Example 3: How to exclude the files in a folder but include all subfolders](#example-3-how-to-exclude-the-files-in-a-folder-but-include-all-subfolders) + +- [Example 4: How to exclude a file from a specific folder](#example-4-how-to-exclude-a-file-from-a-specific-folder) + +- [Example 5: How to exclude a file from any location](#example-5-how-to-exclude-a-file-from-any-location) + +### Example 1: How to migrate all files from C:\\ except .mp3 files +The following .xml file migrates all files located on the C: drive, except any .mp3 files. + +``` xml + + + + MP3 Files + + + + + C:\* [*] + + + + + C:\* [*.mp3] + + + + + + +``` +### Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp +The following .xml file migrates all files and subfolders in C:\\Data, except the files and subfolders in C:\\Data\\tmp. + +``` xml + + + Test component + + + + + C:\Data\* [*] + + + + + C:\Data\temp\* [*] + + + + + + +``` + +### Example 3: How to exclude the files in a folder but include all subfolders +The following .xml file migrates any subfolders in C:\\EngineeringDrafts, but excludes all files that are in C:\\EngineeringDrafts. + +``` xml + + + Component to migrate all Engineering Drafts Documents without subfolders + + + + + C:\EngineeringDrafts\* [*] + + + + + C:\EngineeringDrafts\ [*] + + + + + + +``` + +### Example 4: How to exclude a file from a specific folder +The following .xml file migrates all files and subfolders in C:\\EngineeringDrafts, except for the Sample.doc file in C:\\EngineeringDrafts. + +``` xml + + + Component to migrate all Engineering Drafts Documents except Sample.doc + + + + + C:\EngineeringDrafts\* [*] + + + + + C:\EngineeringDrafts\ [Sample.doc] + + + + + + +``` + +### Example 5: How to exclude a file from any location +To exclude a Sample.doc file from any location on the C: drive, use the <pattern> element. If multiple files exist with the same name on the C: drive, all of these files will be excluded. + +``` xml + C:\* [Sample.doc] +``` + +To exclude a Sample.doc file from any drive on the computer, use the <script> element. If multiple files exist with the same name, all of these files will be excluded. + +``` xml + +``` +#### Examples of how to use XML to exclude files, folders, and registry keys +Here are some examples of how to use XML to exclude files, folders, and registry keys. For more info, see [USMT XML Reference](usmt-xml-reference.md) + +**Example 1: How to exclude all .mp3 files**
              +The following .xml file excludes all .mp3 files from the migration: + +``` xml + + + Test + + + + + + + + + + + +``` +**Example 2: How to exclude all of the files on a specific drive**
              +The following .xml file excludes only the files located on the C: drive. + +``` xml + + + Test + + + + + c:\*[*] + + + + + + +``` +**Example 3: How to exclude registry keys**
              +The following .xml file unconditionally excludes the HKEY_CURRENT_USER registry key and all of its subkeys. + +``` xml + + + + Test + + + + + HKCU\testReg[*] + + + + + HKCU\*[*] + + + + + + +``` +**Example 4: How to Exclude `C:\Windows` and `C:\Program Files`**
              +The following .xml file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. Note that all \*.docx, \*.xls and \*.ppt files will not be migrated because the <unconditionalExclude> element takes precedence over the <include> element. + +``` xml + + + + Test + + + + + + + + + + + + C:\Program Files\* [*] +C:\Windows\* [*] + + + + + + +``` +## Create a Config XML File +You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. + +- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the <Applications> section of the Config.xml file. + +- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the <WindowsComponents> section. + +- **To exclude My Documents:** Specify `migrate="no"` for My Documents under the <Documents> section. Note that any <include> rules in the .xml files will still apply. For example, if you have a rule that includes all the .docx files in My Documents, then only the .docx files will be migrated, but the rest of the files will not. + +See [Config.xml File](usmt-configxml-file.md) for more information. + +**Note**   +To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. + +## Related topics +- [Customize USMT XML Files](usmt-customize-xml-files.md) +- [USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md index 6a97acb78b..a6d6154a83 100644 --- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md @@ -1,122 +1,123 @@ ---- -title: Extract Files from a Compressed USMT Migration Store (Windows 10) -description: Extract Files from a Compressed USMT Migration Store -ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Extract Files from a Compressed USMT Migration Store - - -When you migrate files and settings during a typical PC-refresh migration, you usually create a compressed migration store file on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, you can encrypt it by using different encryption algorithms. When you migrate the file back to the source computer after the operating system is installed, you can run the **Usmtutils** command with the **/extract** option to recover the files from the compressed migration store. You can also use the **Usmtutils** command with the **/extract** option any time you need to recover data from a migration store. - -Options used with the **/extract** option can specify: - -- The cryptographic algorithm that was used to create the migration store. - -- The encryption key or the text file that contains the encryption key. - -- Include and exclude patterns for selective data extraction. - -In addition, you can specify the file patterns that you want to extract by using the **/i** option to include file patterns or the **/e** option to exclude file patterns. When both the **/i** option and the **/e** option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the ScanState and LoadState tools. - -## In this topic - - -- [To run the USMTutils tool with the /extract option](#bkmk-extractsyntax) - -- [To extract all files from a compressed migration store](#bkmk-extractallfiles) - -- [To extract specific file types from an encrypted compressed migration store](#bkmk-extractspecificfiles) - -- [To extract all but one, or more, file types from an encrypted compressed migration store](#bkmk-excludefilepattern) - -- [To extract file types using the include pattern and the exclude pattern](#bkmk-includeexcludefiles) - -### To run the USMTutils tool with the /extract option - -To extract files from the compressed migration store onto the destination computer, use the following USMTutils syntax: - -Cd /d <USMTpath> usmtutils /extract <filePath> <destinationPath> \[/i:<includePattern>\] \[/e:<excludePattern>\] \[/l:<logfile>\] \[/decrypt\[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] \[/o\] - -Where the placeholders have the following values: - -- *<USMTpath>* is the location where you have saved the USMT files and tools. - -- *<filePath>* is the location of the migration store. - -- *<destination path>* is the location of the file where you want the **/extract** option to put the extracted migration store contents. - -- *<includePattern>* specifies the pattern for the files to include in the extraction. - -- *<excludePattern>* specifies the pattern for the files to omit from the extraction. - -- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. - -- *<logfile>* is the location and name of the log file. - -- *<keystring>* is the encryption key that was used to encrypt the migration store. - -- *<filename>* is the location and name of the text file that contains the encryption key. - -### To extract all files from a compressed migration store - -To extract everything from a compressed migration store to a file on the C:\\ drive, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore -``` - -### To extract specific file types from an encrypted compressed migration store - -To extract specific files, such as .txt and .pdf files, from an encrypted compressed migration store, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt,*.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt -``` - -In this example, the file is encrypted and the encryption key is located in a text file called encryptionKey. - -### To extract all but one, or more, file types from an encrypted compressed migration store - -To extract all files except for one file type, such as .exe files, from an encrypted compressed migration store, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtutilslog.txt -``` - -### To extract file types using the include pattern and the exclude pattern - -To extract files from a compressed migration store, and to exclude files of one type (such as .exe files) while including only specific files, use both the include pattern and the exclude pattern, as in this example: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o -``` - -In this example, if there is a myProject.exe file, it will also be extracted because the include pattern option takes precedence over the exclude pattern option. - -## Related topics - - -[UsmtUtils Syntax](usmt-utilities.md) - -[Return Codes](usmt-return-codes.md) - -[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) - -  - -  - - - - - +--- +title: Extract Files from a Compressed USMT Migration Store (Windows 10) +description: In this article, learn how to extract files from a compressed User State Migration Tool (USMT) migration store. +ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Extract Files from a Compressed USMT Migration Store + + +When you migrate files and settings during a typical PC-refresh migration, you usually create a compressed migration store file on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, you can encrypt it by using different encryption algorithms. When you migrate the file back to the source computer after the operating system is installed, you can run the **Usmtutils** command with the **/extract** option to recover the files from the compressed migration store. You can also use the **Usmtutils** command with the **/extract** option any time you need to recover data from a migration store. + +Options used with the **/extract** option can specify: + +- The cryptographic algorithm that was used to create the migration store. + +- The encryption key or the text file that contains the encryption key. + +- Include and exclude patterns for selective data extraction. + +In addition, you can specify the file patterns that you want to extract by using the **/i** option to include file patterns or the **/e** option to exclude file patterns. When both the **/i** option and the **/e** option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the ScanState and LoadState tools. + +## In this topic + + +- [To run the USMTutils tool with the /extract option](#bkmk-extractsyntax) + +- [To extract all files from a compressed migration store](#bkmk-extractallfiles) + +- [To extract specific file types from an encrypted compressed migration store](#bkmk-extractspecificfiles) + +- [To extract all but one, or more, file types from an encrypted compressed migration store](#bkmk-excludefilepattern) + +- [To extract file types using the include pattern and the exclude pattern](#bkmk-includeexcludefiles) + +### To run the USMTutils tool with the /extract option + +To extract files from the compressed migration store onto the destination computer, use the following USMTutils syntax: + +Cd /d <USMTpath> usmtutils /extract <filePath> <destinationPath> \[/i:<includePattern>\] \[/e:<excludePattern>\] \[/l:<logfile>\] \[/decrypt\[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] \[/o\] + +Where the placeholders have the following values: + +- *<USMTpath>* is the location where you have saved the USMT files and tools. + +- *<filePath>* is the location of the migration store. + +- *<destination path>* is the location of the file where you want the **/extract** option to put the extracted migration store contents. + +- *<includePattern>* specifies the pattern for the files to include in the extraction. + +- *<excludePattern>* specifies the pattern for the files to omit from the extraction. + +- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. + +- *<logfile>* is the location and name of the log file. + +- *<keystring>* is the encryption key that was used to encrypt the migration store. + +- *<filename>* is the location and name of the text file that contains the encryption key. + +### To extract all files from a compressed migration store + +To extract everything from a compressed migration store to a file on the C:\\ drive, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore +``` + +### To extract specific file types from an encrypted compressed migration store + +To extract specific files, such as .txt and .pdf files, from an encrypted compressed migration store, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt,*.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt +``` + +In this example, the file is encrypted and the encryption key is located in a text file called encryptionKey. + +### To extract all but one, or more, file types from an encrypted compressed migration store + +To extract all files except for one file type, such as .exe files, from an encrypted compressed migration store, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtutilslog.txt +``` + +### To extract file types using the include pattern and the exclude pattern + +To extract files from a compressed migration store, and to exclude files of one type (such as .exe files) while including only specific files, use both the include pattern and the exclude pattern, as in this example: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o +``` + +In this example, if there is a myProject.exe file, it will also be extracted because the include pattern option takes precedence over the exclude pattern option. + +## Related topics + + +[UsmtUtils Syntax](usmt-utilities.md) + +[Return Codes](usmt-return-codes.md) + +[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-faq.md b/windows/deployment/usmt/usmt-faq.md index 49092e9f6f..97be09803c 100644 --- a/windows/deployment/usmt/usmt-faq.md +++ b/windows/deployment/usmt/usmt-faq.md @@ -1,137 +1,138 @@ ---- -title: Frequently Asked Questions (Windows 10) -description: Frequently Asked Questions -ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Frequently Asked Questions - - -The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. - -## General - - -### How much space is needed on the destination computer? - -The destination computer needs enough available space for the following: - -- Operating system - -- Applications - -- Uncompressed store - -### Can I store the files and settings directly on the destination computer or do I need a server? - -You do not need to save the files to a server. If you are moving the user state to a new computer, you can create the store on a shared folder, on media that you can remove, such as a USB flash drive (UFD), or you can store it directly on the destination computer, as in the following steps: - -1. Create and share the directory C:\\store on the destination computer. - -2. Run the ScanState tool on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store - -3. Run the LoadState tool on the destination computer and specify C:\\store as the store location. - -### Can I migrate data between operating systems with different languages? - -No. USMT does not support migrating data between operating systems with different languages; the source computer's operating-system language must match the destination computer's operating-system language. - -### Can I change the location of the temporary directory on the destination computer? - -Yes. The environment variable USMT\_WORKING\_DIR can be changed to an alternative temporary directory. There are some offline migration scenarios where this is necessary, for example, when the USMT binaries are located on read-only Windows Preinstallation Environment (WinPE) boot media. - -### How do I install USMT? - -Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), you need to install the Windows ADK package on at least one computer in your environment. However, the USMT binaries are designed to be deployed using xcopy. This means that they are installed on a computer simply by recursively copying the USMT directory from the computer containing the Windows ADK to each client computer. - -### How do I uninstall USMT? - -If you have installed the Windows ADK on the computer, uninstalling Windows ADK will uninstall USMT. For client computers that do not have the Windows ADK installed, you can simply delete the USMT directory to uninstall USMT. - -## Files and Settings - - -### How can I exclude a folder or a certain type of file from the migration? - -You can use the **<unconditionalExclude>** element to globally exclude data from the migration. For example, you can use this element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. This element excludes objects regardless of any other <include> rules that are in the .xml files. For an example, see <unconditionalExclude> in the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. For the syntax of this element, see [XML Elements Library](usmt-xml-elements-library.md). - -### What happens to files that were located on a drive that does not exist on the destination computer? - -USMT migrates the files to the %SystemDrive% while maintaining the correct folder hierarchy. For example, if E:\\data\\File.pst is on the source computer, but the destination computer does not have an E:\\ drive, the file will be migrated to C:\\data\\File.pst, if C:\\ is the system drive. This holds true even when <locationModify> rules attempt to move data to a drive that does not exist on the destination computer. - -## USMT .xml Files - - -### Where can I get examples of USMT .xml files? - -The following topics include examples of USMT .xml files: - -- [Exclude Files and Settings](usmt-exclude-files-and-settings.md) - -- [Reroute Files and Settings](usmt-reroute-files-and-settings.md) - -- [Include Files and Settings](usmt-include-files-and-settings.md) - -- [Custom XML Examples](usmt-custom-xml-examples.md) - -### Can I use custom .xml files that were written for USMT 5.0? - -Yes. You can use custom .xml files that were written for USMT 5.0 with USMT for Windows 10. However, in order to use new USMT functionality, you must revisit your custom USMT files and refresh them to include the new command-line options and XML elements. - -### How can I validate the .xml files? - -You can use the USMT XML Schema (MigXML.xsd) to write and validate migration .xml files. - -### Why must I list the .xml files with both the ScanState and LoadState commands? - -The .xml files are not copied to the store as in previous versions of USMT. Because the ScanState and LoadState tools need the .xml files to control the migration, you must specify the same set of .xml files for the **ScanState** and **LoadState** commands. If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. **LoadState** will migrate only the files and settings that you want to migrate. - -If you exclude an .xml file from the **LoadState** command, then all of the data that is in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified for the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. - -### Which files can I modify and specify on the command line? - -You can specify the MigUser.xml and MigApp.xml files on the command line. You can modify each of these files. The migration of operating system settings is controlled by the manifests, which you cannot modify. If you want to exclude certain operating-system settings or any other components, create and modify the Config.xml file. - -### What happens if I do not specify the .xml files on the command line? - -- **ScanState** - - If you do not specify any files with the **ScanState** command, all user accounts and default operating system components are migrated. - -- **LoadState** - - If you do not specify any files with the **LoadState** command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in .xml files with the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. - -## Conflicts and Precedence - - -### What happens when there are conflicting XML rules or conflicting objects on the destination computer? - -For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md) - -[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) - -  - -  - - - - - +--- +title: Frequently Asked Questions (Windows 10) +description: Learn about frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. +ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Frequently Asked Questions + + +The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. + +## General + + +### How much space is needed on the destination computer? + +The destination computer needs enough available space for the following: + +- Operating system + +- Applications + +- Uncompressed store + +### Can I store the files and settings directly on the destination computer or do I need a server? + +You do not need to save the files to a server. If you are moving the user state to a new computer, you can create the store on a shared folder, on media that you can remove, such as a USB flash drive (UFD), or you can store it directly on the destination computer, as in the following steps: + +1. Create and share the directory C:\\store on the destination computer. + +2. Run the ScanState tool on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store + +3. Run the LoadState tool on the destination computer and specify C:\\store as the store location. + +### Can I migrate data between operating systems with different languages? + +No. USMT does not support migrating data between operating systems with different languages; the source computer's operating-system language must match the destination computer's operating-system language. + +### Can I change the location of the temporary directory on the destination computer? + +Yes. The environment variable USMT\_WORKING\_DIR can be changed to an alternative temporary directory. There are some offline migration scenarios where this is necessary, for example, when the USMT binaries are located on read-only Windows Preinstallation Environment (WinPE) boot media. + +### How do I install USMT? + +Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), you need to install the Windows ADK package on at least one computer in your environment. However, the USMT binaries are designed to be deployed using xcopy. This means that they are installed on a computer simply by recursively copying the USMT directory from the computer containing the Windows ADK to each client computer. + +### How do I uninstall USMT? + +If you have installed the Windows ADK on the computer, uninstalling Windows ADK will uninstall USMT. For client computers that do not have the Windows ADK installed, you can simply delete the USMT directory to uninstall USMT. + +## Files and Settings + + +### How can I exclude a folder or a certain type of file from the migration? + +You can use the **<unconditionalExclude>** element to globally exclude data from the migration. For example, you can use this element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. This element excludes objects regardless of any other <include> rules that are in the .xml files. For an example, see <unconditionalExclude> in the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. For the syntax of this element, see [XML Elements Library](usmt-xml-elements-library.md). + +### What happens to files that were located on a drive that does not exist on the destination computer? + +USMT migrates the files to the %SystemDrive% while maintaining the correct folder hierarchy. For example, if E:\\data\\File.pst is on the source computer, but the destination computer does not have an E:\\ drive, the file will be migrated to C:\\data\\File.pst, if C:\\ is the system drive. This holds true even when <locationModify> rules attempt to move data to a drive that does not exist on the destination computer. + +## USMT .xml Files + + +### Where can I get examples of USMT .xml files? + +The following topics include examples of USMT .xml files: + +- [Exclude Files and Settings](usmt-exclude-files-and-settings.md) + +- [Reroute Files and Settings](usmt-reroute-files-and-settings.md) + +- [Include Files and Settings](usmt-include-files-and-settings.md) + +- [Custom XML Examples](usmt-custom-xml-examples.md) + +### Can I use custom .xml files that were written for USMT 5.0? + +Yes. You can use custom .xml files that were written for USMT 5.0 with USMT for Windows 10. However, in order to use new USMT functionality, you must revisit your custom USMT files and refresh them to include the new command-line options and XML elements. + +### How can I validate the .xml files? + +You can use the USMT XML Schema (MigXML.xsd) to write and validate migration .xml files. + +### Why must I list the .xml files with both the ScanState and LoadState commands? + +The .xml files are not copied to the store as in previous versions of USMT. Because the ScanState and LoadState tools need the .xml files to control the migration, you must specify the same set of .xml files for the **ScanState** and **LoadState** commands. If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. **LoadState** will migrate only the files and settings that you want to migrate. + +If you exclude an .xml file from the **LoadState** command, then all of the data that is in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified for the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. + +### Which files can I modify and specify on the command line? + +You can specify the MigUser.xml and MigApp.xml files on the command line. You can modify each of these files. The migration of operating system settings is controlled by the manifests, which you cannot modify. If you want to exclude certain operating-system settings or any other components, create and modify the Config.xml file. + +### What happens if I do not specify the .xml files on the command line? + +- **ScanState** + + If you do not specify any files with the **ScanState** command, all user accounts and default operating system components are migrated. + +- **LoadState** + + If you do not specify any files with the **LoadState** command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in .xml files with the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. + +## Conflicts and Precedence + + +### What happens when there are conflicting XML rules or conflicting objects on the destination computer? + +For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md) + +[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md index 2bffb25cd7..49cbfc3f28 100644 --- a/windows/deployment/usmt/usmt-general-conventions.md +++ b/windows/deployment/usmt/usmt-general-conventions.md @@ -1,106 +1,107 @@ ---- -title: General Conventions (Windows 10) -description: General Conventions -ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# General Conventions - - -This topic describes the XML helper functions. - -## In This Topic - - -[General XML Guidelines](#bkmk-general) - -[Helper Functions](#bkmk-helperfunctions) - -## General XML Guidelines - - -Before you modify the .xml files, become familiar with the following guidelines: - -- **XML schema** - - You can use the User State Migration Tool (USMT) 10.0 XML schema, MigXML.xsd, to write and validate migration .xml files. - -- **Conflits** - - In general, when there are conflicts within the XML schema, the most specific pattern takes precedence. For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -- **Required elements** - - The required elements for a migration .xml file are **<migration>**, **<component>**, **<role>**, and **<rules>**. - -- **Required child elements** - - - USMT does not fail with an error if you do not specify the required child elements. However, you must specify the required child elements for the parent element to affect the migration. - - - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements do not apply. For example, if you define `` in **<namedElements>**, and you specify `` in **<component>** to refer to this element, the definition inside **<namedElements>** must have the required child elements, but the **<component>** element does not need to have the required child elements. - -- **File names with brackets** - - If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named File.txt, you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`. - -- **Using quotation marks** - - When you surround code in quotation marks, you can use either double ("") or single (') quotation marks. - -## Helper Functions - - -You can use the XML helper functions in the [XML Elements Library](usmt-xml-elements-library.md) to change migration behavior. Before you use these functions in an .xml file, note the following: - -- **All of the parameters are strings** - -- **You can leave NULL parameters blank** - - As with parameters with a default value convention, if you have a NULL parameter at the end of a list, you can leave it out. For example, the following function: - - ``` syntax - SomeFunction("My String argument",NULL,NULL) - ``` - - is equivalent to: - - ``` syntax - SomeFunction("My String argument") - ``` - -- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object** - - It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. - - For example, specify the file C:\\Windows\\Notepad.exe: **c:\\Windows\[Notepad.exe\]**. Similarly, specify the directory C:\\Windows\\System32 like this: **c:\\Windows\\System32**; note the absence of the \[\] characters. - - The registry is represented in a similar way. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key is **HKLM\\SOFTWARE\\MyKey\[\]**. - -- **You specify a location pattern in a way that is similar to how you specify an actual location** - - The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. - - For example, the pattern **c:\\Windows\\\\*** will match the \\Windows directory and all subdirectories, but it will not match any of the files in those directories. To match the files as well, you must specify **c:\\Windows\\\*\[\*\]**. - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: General Conventions (Windows 10) +description: Learn about general XML guidelines and how to use XML helper functions in the XML Elements library to change migration behavior. +ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# General Conventions + + +This topic describes the XML helper functions. + +## In This Topic + + +[General XML Guidelines](#bkmk-general) + +[Helper Functions](#bkmk-helperfunctions) + +## General XML Guidelines + + +Before you modify the .xml files, become familiar with the following guidelines: + +- **XML schema** + + You can use the User State Migration Tool (USMT) 10.0 XML schema, MigXML.xsd, to write and validate migration .xml files. + +- **Conflicts** + + In general, when there are conflicts within the XML schema, the most specific pattern takes precedence. For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +- **Required elements** + + The required elements for a migration .xml file are **<migration>**, **<component>**, **<role>**, and **<rules>**. + +- **Required child elements** + + - USMT does not fail with an error if you do not specify the required child elements. However, you must specify the required child elements for the parent element to affect the migration. + + - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements do not apply. For example, if you define `` in **<namedElements>**, and you specify `` in **<component>** to refer to this element, the definition inside **<namedElements>** must have the required child elements, but the **<component>** element does not need to have the required child elements. + +- **File names with brackets** + + If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named **file].txt**, you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`. + +- **Using quotation marks** + + When you surround code in quotation marks, you can use either double ("") or single (') quotation marks. + +## Helper Functions + + +You can use the XML helper functions in the [XML Elements Library](usmt-xml-elements-library.md) to change migration behavior. Before you use these functions in an .xml file, note the following: + +- **All of the parameters are strings** + +- **You can leave NULL parameters blank** + + As with parameters with a default value convention, if you have a NULL parameter at the end of a list, you can leave it out. For example, the following function: + + ``` syntax + SomeFunction("My String argument",NULL,NULL) + ``` + + is equivalent to: + + ``` syntax + SomeFunction("My String argument") + ``` + +- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object** + + It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. + + For example, specify the file C:\\Windows\\Notepad.exe: **c:\\Windows\[Notepad.exe\]**. Similarly, specify the directory C:\\Windows\\System32 like this: **c:\\Windows\\System32**; note the absence of the \[\] characters. + + The registry is represented in a similar way. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key is **HKLM\\SOFTWARE\\MyKey\[\]**. + +- **You specify a location pattern in a way that is similar to how you specify an actual location** + + The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. + + For example, the pattern **c:\\Windows\\\\*** will match the \\Windows directory and all subdirectories, but it will not match any of the files in those directories. To match the files as well, you must specify **c:\\Windows\\\*\[\*\]**. + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md index 4b2d8385c2..8c39400821 100644 --- a/windows/deployment/usmt/usmt-hard-link-migration-store.md +++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md @@ -1,6 +1,6 @@ --- title: Hard-Link Migration Store (Windows 10) -description: Hard-Link Migration Store +description: Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization. ms.assetid: b0598418-4607-4952-bfa3-b6e4aaa2c574 ms.reviewer: manager: laurawi @@ -19,7 +19,7 @@ ms.topic: article A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios. -## In This Topic +## In this topic [When to Use a Hard-Link Migration](#bkmk-when) @@ -75,7 +75,7 @@ A hard link can only be created for a file on the same volume. If you copy a har For more information about hard links, please see [Hard Links and Junctions](https://go.microsoft.com/fwlink/p/?LinkId=132934) -In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. +In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system. @@ -113,6 +113,9 @@ For example, a company has decided to deploy Windows 10 on all of their compute 3. An administrator runs the LoadState command-line tool on each computer. The LoadState tool restores user state back on each computer. +> [!NOTE] +> During the update of a domain-joined computer, the profiles of users whose SID cannot be resolved will not be migrated. When using a hard-link migration store, it could cause a data loss. + ## Hard-Link Migration Store Details @@ -233,4 +236,3 @@ The following XML sample specifies that files locked by an application under the - diff --git a/windows/deployment/usmt/usmt-how-it-works.md b/windows/deployment/usmt/usmt-how-it-works.md index 5c8bbb6d9b..441dccf3f7 100644 --- a/windows/deployment/usmt/usmt-how-it-works.md +++ b/windows/deployment/usmt/usmt-how-it-works.md @@ -1,150 +1,135 @@ ---- -title: How USMT Works (Windows 10) -description: How USMT Works -ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# How USMT Works - - -USMT includes two tools that migrate settings and data: ScanState and LoadState. ScanState collects information from the source computer, and LoadState applies that information to the destination computer. - -- [ScanState Process](#bkmk-ssprocess) - -- [LoadState Process](#bkmk-lsprocess) - - **Note**   - For more information about how USMT processes the rules and the XML files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - - -## The ScanState Process - - -When you run the ScanState tool on the source computer, it goes through the following process: - -1. It parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. - -2. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. - - There are three types of components: - - - Components that migrate the operating system settings - - - Components that migrate application settings - - - Components that migrate users’ files - - The ScanState tool collects information about the application settings and user data components from the .xml files that are specified on the command line. - - In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. - -3. ScanState determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, you can include and exclude users using the User Options. The public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated, and you cannot exclude these profiles from the migration. - -4. In the "Scanning" phase, ScanState does the following for each user profile selected for migration: - - 1. For each component, ScanState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. - - **Note**   - From this point on, ScanState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. ScanState processes all components in the same way. - - - - 2. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents, assuming that the user profiles are stored in the C:\\Users directory. - - 3. For each selected component, ScanState evaluates the <detects> section. If the condition in the <detects> section evaluates to false, the component is not processed any further. Otherwise, the processing of this component continues. - - 4. For each selected component, ScanState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. - - 5. ScanState creates a list of migration units that need to be migrated by processing the various subsections under this <rules> section. Each unit is collected if it is mentioned in an <include> subsection, as long as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence in the .xml files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an <UnconditionalExclude> section is not migrated. - - **Note**   - ScanState ignores some subsections such as <destinationCleanup> and <locationModify>. These sections are evaluated only on the destination computer. - - - -5. In the "Collecting" phase, ScanState creates a master list of the migration units by combining the lists that were created for each selected user profile. - -6. In the "Saving" phase, ScanState writes the migration units that were collected to the store location. - - **Note**   - ScanState does not modify the source computer in any way. - - - -## The LoadState Process - - -The LoadState process is very similar to the ScanState process. The ScanState tool collects migration units such as file, registry key, or registry values from the source computer and saves them to the store. Similarly, the LoadState tool collects migration units from the store and applies them to the destination computer. - -1. ScanState parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. - -2. LoadState collects information about the migration components that need to be migrated. - - LoadState obtains information for the application-settings components and user-data components from the migration .xml files that are specified by the LoadState command. - - In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. - -3. LoadState determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, you can include and exclude users using the User Options. The system profile, the "All users" profile in a source computer running Windows XP, or the Public profile in a source computer running Windows Vista, Windows 7, and Windows 8, is always migrated and you cannot exclude these profiles from the migration. - - - If you are migrating local user accounts and if the accounts do not already exist on the destination computer, you must use the/lac command-line option. If you do not specify the **/lac** option, any local user accounts that are not already present on the destination computer, are not migrated. - - - The **/md** and **/mu** options are processed to rename the user profile on the destination computer, if they have been included when the LoadState command was specified. - - - For each user profile selected from the store, LoadState creates a corresponding user profile on the destination computer. The destination computer does not need to be connected to the domain for domain user profiles to be created. If USMT cannot determine a domain, it attempts to apply the settings to a local account. For more information, see [Identify Users](usmt-identify-users.md). - -4. In the "Scanning" phase, LoadState does the following for each user profile: - - 1. For each component, LoadState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. - - **Note** - From this point on, LoadState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. LoadState evaluates all components in the same way. - - - - 2. Each component that is selected is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents (assuming that the user profiles are stored in the C:\\Users directory). - - **Note** - LoadState ignores the <detects> section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. - - - - 3. For each selected component, LoadState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. - - 4. LoadState creates a master list of migration units by processing the various subsections under the <rules> section. Each migration unit that is in an <include> subsection is migrated as long, as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - 5. LoadState evaluates the destination computer-specific subsections; for example, the <destinationCleanup> and <locationModify> subsections. - - 6. If the destination computer is running Windows 7 or Windows 8 then the migunits that were collected by ScanState using downlevel manifest files are processed by LoadState using the corresponding Component Manifest for Windows 7. The downlevel manifest files are not used during LoadState. - - **Important** - It is important to specify the .xml files with the LoadState command if you want LoadState to use them. Otherwise, any destination-specific rules, such as <locationModify>, in these .xml files are ignored, even if the same .xml files were provided when the ScanState command ran. - - - -5. In the "Apply" phase, LoadState writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there is not a <merge> rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, do not take effect until the next time the user logs on. For this reason, you should log off when the LoadState command actions have completed. - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - - - - - - - - - +--- +title: How USMT Works (Windows 10) +description: Learn how USMT works and how it includes two tools that migrate settings and data - ScanState and LoadState. +ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# How USMT Works + + +USMT includes two tools that migrate settings and data: ScanState and LoadState. ScanState collects information from the source computer, and LoadState applies that information to the destination computer. + +- [ScanState Process](#the-scanstate-process) +- [LoadState Process](#the-loadstate-process) + + **Note**   + For more information about how USMT processes the rules and the XML files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +## The ScanState Process + +When you run the ScanState tool on the source computer, it goes through the following process: + +1. It parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. + +2. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. + + There are three types of components: + + - Components that migrate the operating system settings + - Components that migrate application settings + - Components that migrate users’ files + + The ScanState tool collects information about the application settings and user data components from the .xml files that are specified on the command line. + + In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. + +3. ScanState determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, you can include and exclude users using the User Options. The public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated, and you cannot exclude these profiles from the migration. + +4. In the "Scanning" phase, ScanState does the following for each user profile selected for migration: + + 1. For each component, ScanState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. + + **Note**   + From this point on, ScanState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. ScanState processes all components in the same way. + + 2. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents, assuming that the user profiles are stored in the C:\\Users directory. + + 3. For each selected component, ScanState evaluates the <detects> section. If the condition in the <detects> section evaluates to false, the component is not processed any further. Otherwise, the processing of this component continues. + + 4. For each selected component, ScanState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. + + 5. ScanState creates a list of migration units that need to be migrated by processing the various subsections under this <rules> section. Each unit is collected if it is mentioned in an <include> subsection, as long as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence in the .xml files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an <UnconditionalExclude> section is not migrated. + + **Note**   + ScanState ignores some subsections such as <destinationCleanup> and <locationModify>. These sections are evaluated only on the destination computer. + +5. In the "Collecting" phase, ScanState creates a master list of the migration units by combining the lists that were created for each selected user profile. + +6. In the "Saving" phase, ScanState writes the migration units that were collected to the store location. + + **Note**   + ScanState does not modify the source computer in any way. + +## The LoadState Process + + +The LoadState process is very similar to the ScanState process. The ScanState tool collects migration units such as file, registry key, or registry values from the source computer and saves them to the store. Similarly, the LoadState tool collects migration units from the store and applies them to the destination computer. + +1. ScanState parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. + +2. LoadState collects information about the migration components that need to be migrated. + + LoadState obtains information for the application-settings components and user-data components from the migration .xml files that are specified by the LoadState command. + + In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. + +3. LoadState determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, you can include and exclude users using the User Options. The system profile, the "All users" profile in a source computer running Windows XP, or the Public profile in a source computer running Windows Vista, Windows 7, and Windows 8, is always migrated and you cannot exclude these profiles from the migration. + + - If you are migrating local user accounts and if the accounts do not already exist on the destination computer, you must use the/lac command-line option. If you do not specify the **/lac** option, any local user accounts that are not already present on the destination computer, are not migrated. + + - The **/md** and **/mu** options are processed to rename the user profile on the destination computer, if they have been included when the LoadState command was specified. + + - For each user profile selected from the store, LoadState creates a corresponding user profile on the destination computer. The destination computer does not need to be connected to the domain for domain user profiles to be created. If USMT cannot determine a domain, it attempts to apply the settings to a local account. For more information, see [Identify Users](usmt-identify-users.md). + +4. In the "Scanning" phase, LoadState does the following for each user profile: + + 1. For each component, LoadState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. + + **Note** + From this point on, LoadState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. LoadState evaluates all components in the same way. + + + + 2. Each component that is selected is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents (assuming that the user profiles are stored in the C:\\Users directory). + + **Note** + LoadState ignores the <detects> section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. + + + + 3. For each selected component, LoadState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. + + 4. LoadState creates a master list of migration units by processing the various subsections under the <rules> section. Each migration unit that is in an <include> subsection is migrated as long, as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + 5. LoadState evaluates the destination computer-specific subsections; for example, the <destinationCleanup> and <locationModify> subsections. + + 6. If the destination computer is running Windows 7 or Windows 8 then the migunits that were collected by ScanState using downlevel manifest files are processed by LoadState using the corresponding Component Manifest for Windows 7. The downlevel manifest files are not used during LoadState. + + **Important** + It is important to specify the .xml files with the LoadState command if you want LoadState to use them. Otherwise, any destination-specific rules, such as <locationModify>, in these .xml files are ignored, even if the same .xml files were provided when the ScanState command ran. + +5. In the "Apply" phase, LoadState writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there is not a <merge> rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, do not take effect until the next time the user logs on. For this reason, you should log off when the LoadState command actions have completed. + +## Related topics + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-how-to.md b/windows/deployment/usmt/usmt-how-to.md index 9fdba24603..f883284978 100644 --- a/windows/deployment/usmt/usmt-how-to.md +++ b/windows/deployment/usmt/usmt-how-to.md @@ -1,35 +1,36 @@ ---- -title: User State Migration Tool (USMT) How-to topics (Windows 10) -description: User State Migration Tool (USMT) How-to topics -ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) How-to topics -The following table lists topics that describe how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. - -## In This Section - -|Topic |Description| -|------|-----------| -|[Exclude Files and Settings](usmt-exclude-files-and-settings.md)|Create a custom .xml file to exclude files, file types, folders, or registry settings from your migration.| -|[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md)|Recover files from a compressed migration store after installing the operating system.| -|[Include Files and Settings](usmt-include-files-and-settings.md)|Create a custom .xml file to include files, file types, folders, or registry settings in your migration.| -|[Migrate Application Settings](migrate-application-settings.md)|Migrate the settings of an application that the MigApp.xml file does not include by default.| -|[Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md)|Migrate Encrypting File System (EFS) certificates by using USMT.| -|[Migrate User Accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in your migration.| -|[Reroute Files and Settings](usmt-reroute-files-and-settings.md)|Create a custom .xml file to reroute files and settings during a migration.| -|[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md)|Determine whether a compressed migration store is intact, or whether it contains corrupt files or a corrupt catalog.| - -## Related topics -- [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) -- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) +--- +title: User State Migration Tool (USMT) How-to topics (Windows 10) +description: Reference the topics in this article to learn how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. +ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) How-to topics +The following table lists topics that describe how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. + +## In This Section + +|Topic |Description| +|------|-----------| +|[Exclude Files and Settings](usmt-exclude-files-and-settings.md)|Create a custom .xml file to exclude files, file types, folders, or registry settings from your migration.| +|[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md)|Recover files from a compressed migration store after installing the operating system.| +|[Include Files and Settings](usmt-include-files-and-settings.md)|Create a custom .xml file to include files, file types, folders, or registry settings in your migration.| +|[Migrate Application Settings](migrate-application-settings.md)|Migrate the settings of an application that the MigApp.xml file does not include by default.| +|[Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md)|Migrate Encrypting File System (EFS) certificates by using USMT.| +|[Migrate User Accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in your migration.| +|[Reroute Files and Settings](usmt-reroute-files-and-settings.md)|Create a custom .xml file to reroute files and settings during a migration.| +|[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md)|Determine whether a compressed migration store is intact, or whether it contains corrupt files or a corrupt catalog.| + +## Related topics +- [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) +- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) +- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) diff --git a/windows/deployment/usmt/usmt-identify-application-settings.md b/windows/deployment/usmt/usmt-identify-application-settings.md index 2a8a430f41..47f9aef4a9 100644 --- a/windows/deployment/usmt/usmt-identify-application-settings.md +++ b/windows/deployment/usmt/usmt-identify-application-settings.md @@ -1,62 +1,63 @@ ---- -title: Identify Applications Settings (Windows 10) -description: Identify Applications Settings -ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Applications Settings - - -When planning for your migration, you should identify which applications and settings you want to migrate. For more information about how to create a custom .xml file to migrate the settings of another application, see [Customize USMT XML Files](usmt-customize-xml-files.md). - -## Applications - - -First, create and prioritize a list of applications that to be migrated. It may be helpful to review the application lists and decide which applications will be redeployed and which applications will be retired. Often, the applications are prioritized based on a combination of how widely the application is used and how complex the application is. - -Next, identify an application owner to be in charge of each application. This is necessary because the developers will not be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. - -## Application Settings - - -Next, determine and locate the application settings to be migrated. You can acquire much of the information that you need for this step when you are testing the new applications for compatibility with the new operating system. - -After completing the list of applications to be migrated, review the list and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located; for example, in the registry or in an .ini file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: - -- Is the destination version of the application newer than the source version? - -- Do these settings work with the new version? - -- Do the settings need to be moved or altered? - -- Can the first-run process force the application to appear as if it had run already? If so, does this work correctly, or does it break the application? - -After answering these questions, create a custom .xml file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. - -## Locating Where Settings Are Stored - - -See [Migrate Application Settings](migrate-application-settings.md) and follow the directions. - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -  - -  - - - - - +--- +title: Identify Applications Settings (Windows 10) +description: Identify which applications and settings you want to migrate before using the User State Migration Tool (USMT). +ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify Applications Settings + + +When planning for your migration, you should identify which applications and settings you want to migrate. For more information about how to create a custom .xml file to migrate the settings of another application, see [Customize USMT XML Files](usmt-customize-xml-files.md). + +## Applications + + +First, create and prioritize a list of applications that to be migrated. It may be helpful to review the application lists and decide which applications will be redeployed and which applications will be retired. Often, the applications are prioritized based on a combination of how widely the application is used and how complex the application is. + +Next, identify an application owner to be in charge of each application. This is necessary because the developers will not be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. + +## Application Settings + + +Next, determine and locate the application settings to be migrated. You can acquire much of the information that you need for this step when you are testing the new applications for compatibility with the new operating system. + +After completing the list of applications to be migrated, review the list and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located; for example, in the registry or in an .ini file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: + +- Is the destination version of the application newer than the source version? + +- Do these settings work with the new version? + +- Do the settings need to be moved or altered? + +- Can the first-run process force the application to appear as if it had run already? If so, does this work correctly, or does it break the application? + +After answering these questions, create a custom .xml file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. + +## Locating Where Settings Are Stored + + +See [Migrate Application Settings](migrate-application-settings.md) and follow the directions. + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md index 45cd2a17a7..e8c15402b9 100644 --- a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md +++ b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md @@ -1,51 +1,52 @@ ---- -title: Identify File Types, Files, and Folders (Windows 10) -description: Identify File Types, Files, and Folders -ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify File Types, Files, and Folders - - -When planning for your migration, if not using MigDocs.xml, you should identify the file types, files, folders, and settings that you want to migrate. First, you should determine the standard file locations on each computer, such as **My Documents.** , **C:\\Data** , and company-specified locations, such as **\\EngineeringDrafts**. Next, you should determine and locate the non-standard locations. For non-standard locations, consider the following: - -- **File types**. Consider which file types need to be included and excluded from the migration. You can create this list based on common applications used in your organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses .doc, .docx and .dotx file name extension. However, it also uses other file types, such as templates (.dot files), on a less frequent basis. - -- **Excluded locations**. Consider the locations on the computer that should be excluded from the migration (for example, %WINDIR% and Program Files). - -- **New locations**. Decide where files should be migrated to on the destination computer for example, \\My Documents, a designated folder, or a folder matching the files' name and location on the source computer. For example, you might have shared data on source machine or you might wish to clean up documents outside the user profiles on the source system. Identify any data that needs to be redirected to a new location in the apply phase. This can be accomplished with location modify rules. - -Once you have verified which files and file types that the end users work with regularly, you will need to locate them. Files may be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. - -**To find the registered file types on a computer running Windows 7 or Windows 8** - -1. Click **Start**. Open **Control Panel**, click **Control Panel Home**, and click **Programs**. - -2. Click **Default Programs**, and click **Associate a file type or protocol with a program**. - -3. On this screen, the registered file types are displayed. - -For more information about how to change the file types, files, and folders that are migrated when you specify the MigUser.xml file, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -  - -  - - - - - +--- +title: Identify File Types, Files, and Folders (Windows 10) +description: Learn how to identify the file types, files, folders, and settings that you want to migrate when you're planning your migration. +ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify File Types, Files, and Folders + + +When planning for your migration, if not using MigDocs.xml, you should identify the file types, files, folders, and settings that you want to migrate. First, you should determine the standard file locations on each computer, such as **My Documents.** , **C:\\Data** , and company-specified locations, such as **\\EngineeringDrafts**. Next, you should determine and locate the non-standard locations. For non-standard locations, consider the following: + +- **File types**. Consider which file types need to be included and excluded from the migration. You can create this list based on common applications used in your organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses .doc, .docx and .dotx file name extension. However, it also uses other file types, such as templates (.dot files), on a less frequent basis. + +- **Excluded locations**. Consider the locations on the computer that should be excluded from the migration (for example, %WINDIR% and Program Files). + +- **New locations**. Decide where files should be migrated to on the destination computer for example, \\My Documents, a designated folder, or a folder matching the files' name and location on the source computer. For example, you might have shared data on source machine or you might wish to clean up documents outside the user profiles on the source system. Identify any data that needs to be redirected to a new location in the apply phase. This can be accomplished with location modify rules. + +Once you have verified which files and file types that the end users work with regularly, you will need to locate them. Files may be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. + +**To find the registered file types on a computer running Windows 7 or Windows 8** + +1. Click **Start**. Open **Control Panel**, click **Control Panel Home**, and click **Programs**. + +2. Click **Default Programs**, and click **Associate a file type or protocol with a program**. + +3. On this screen, the registered file types are displayed. + +For more information about how to change the file types, files, and folders that are migrated when you specify the MigUser.xml file, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-identify-operating-system-settings.md b/windows/deployment/usmt/usmt-identify-operating-system-settings.md index 1cffd2aed8..8165a6d8c3 100644 --- a/windows/deployment/usmt/usmt-identify-operating-system-settings.md +++ b/windows/deployment/usmt/usmt-identify-operating-system-settings.md @@ -1,60 +1,61 @@ ---- -title: Identify Operating System Settings (Windows 10) -description: Identify Operating System Settings -ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Operating System Settings - - -When planning for your migration, you should identify which operating system settings you want to migrate and to what extent you want to create a new standard environment on each of the computers. User State Migration Tool (USMT) 10.0 enables you to migrate select settings and keep the default values for all others. The operating system settings include the following: - -- **Apperance.** - - This includes items such as wallpaper, colors, sounds, and the location of the taskbar. - -- **Action.** - - This includes items such as the key-repeat rate, whether double-clicking a folder opens it in a new window or the same window, and whether you need to single-click or double-click an item to open it. - -- **Internet.** - - These are the settings that let you connect to the Internet and control how your browser operates. This includes items such as your home page URL, favorites, bookmarks, cookies, security settings, dial-up connections, and proxy settings. - -- **Mail.** - - This includes the information that you need to connect to your mail server, your signature file, views, mail rules, local mail, and contacts. - -To help you decide which settings to migrate, you should consider any previous migration experiences as well as the results of any surveys and tests that you have conducted. You should also consider the number of help-desk calls related to operating-system settings that you have had in the past, and are able to handle in the future. Also decide how much of the new operating-system functionality you want to take advantage of. - -You should migrate any settings that users need to get their jobs done, those that make the work environment comfortable, and those that will reduce help-desk calls after the migration. Although it is easy to dismiss migrating user preferences, you should consider that users can spend a significant amount of time restoring items such as wallpaper, screen savers, and other customizable user-interface features. Most users do not remember how these settings were applied. Although these items are not critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. - -**Note**   -For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -For information about the operating-system settings that USMT migrates, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - - - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - - - - - - - - - +--- +title: Identify Operating System Settings (Windows 10) +description: Identify which system settings you want to migrate, then use the User State Migration Tool (USMT) to select settings and keep the default values for all others. +ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify Operating System Settings + + +When planning for your migration, you should identify which operating system settings you want to migrate and to what extent you want to create a new standard environment on each of the computers. User State Migration Tool (USMT) 10.0 enables you to migrate select settings and keep the default values for all others. The operating system settings include the following: + +- **Apperance.** + + This includes items such as wallpaper, colors, sounds, and the location of the taskbar. + +- **Action.** + + This includes items such as the key-repeat rate, whether double-clicking a folder opens it in a new window or the same window, and whether you need to single-click or double-click an item to open it. + +- **Internet.** + + These are the settings that let you connect to the Internet and control how your browser operates. This includes items such as your home page URL, favorites, bookmarks, cookies, security settings, dial-up connections, and proxy settings. + +- **Mail.** + + This includes the information that you need to connect to your mail server, your signature file, views, mail rules, local mail, and contacts. + +To help you decide which settings to migrate, you should consider any previous migration experiences as well as the results of any surveys and tests that you have conducted. You should also consider the number of help-desk calls related to operating-system settings that you have had in the past, and are able to handle in the future. Also decide how much of the new operating-system functionality you want to take advantage of. + +You should migrate any settings that users need to get their jobs done, those that make the work environment comfortable, and those that will reduce help-desk calls after the migration. Although it is easy to dismiss migrating user preferences, you should consider that users can spend a significant amount of time restoring items such as wallpaper, screen savers, and other customizable user-interface features. Most users do not remember how these settings were applied. Although these items are not critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. + +**Note**   +For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +For information about the operating-system settings that USMT migrates, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + + + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index 8168e90730..d86d82ae25 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -1,90 +1,66 @@ ---- -title: Identify Users (Windows 10) -description: Identify Users -ms.assetid: 957a4fe9-79fd-44a2-8c26-33e50f71f9de -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Users - - -It is important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You cannot specify users in the .xml files. For instructions on how to migrate users, see [Migrate User Accounts](usmt-migrate-user-accounts.md). - -## In This Topic - - -- [Migrating Local Accounts](#bkmk-8) - -- [Migrating Domain Accounts](#bkmk-9) - -- [Command-Line Options](#bkmk-7) - -## Migrating Local Accounts - - -Before migrating local accounts, note the following: - -- [You must explicitly specify that local accounts that are not on the destination computer should be migrated.](#bkmk-8) If you are migrating local accounts and the local account does not exist on the destination computer, you must use the/lac option when using the LoadState command. If the **/lac** option is not specified, no local user accounts will be migrated. - -- [Consider whether to enable user accounts that are new to the destination computer.](#bkmk-8) The **/lae** option enables the account that was created with the **/lac** option. However, if you create a disabled local account by using only the **/lac** option, a local administrator must enable the account on the destination computer. - -- [Be careful when specifying a password for local accounts.](#bkmk-8) If you create the local account with a blank password, anyone could log on to that account on the destination computer. If you create the local account with a password, the password is available to anyone with access to the USMT command-line tools. - - **Note** - If there are multiple users on a computer, and you specify a password with the **/lac** option, all migrated users will have the same password. - - - -## Migrating Domain Accounts - - -The source and destination computers do not need to be connected to the domain for domain user profiles to be migrated. - -## Command-Line Options - - -USMT provides several options to migrate multiple users on a single computer. The following command-line options specify which users to migrate. - -- [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. - - **Important**   - The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. - - - -- [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool. - -- [Creating local accounts.](#bkmk-8) You can create and enable local accounts using the **/lac** and **/lae** options with the LoadState command-line tool. - -- [Renaming user accounts.](#bkmk-8) You can rename user accounts using the **/mu** option. - - **Note**   - By default, if a user name is not specified in any of the command-line options, the user will be migrated. - - - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -[ScanState Syntax](usmt-scanstate-syntax.md) - -[LoadState Syntax](usmt-loadstate-syntax.md) - - - - - - - - - +--- +title: Identify Users (Windows 10) +description: Learn how to identify users you plan to migrate, as well as how to migrate local accounts and domain accounts. +ms.assetid: 957a4fe9-79fd-44a2-8c26-33e50f71f9de +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +ms.localizationpriority: medium +--- + +# Identify Users + +It is important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You cannot specify users in the .xml files. For instructions on how to migrate users, see [Migrate User Accounts](usmt-migrate-user-accounts.md). + +## In this topic + +- [Migrating Local Accounts](#bkmk-8) +- [Migrating Domain Accounts](#bkmk-9) +- [Command-Line Options](#bkmk-7) + +## Migrating Local Accounts + +Before migrating local accounts, note the following: + +- [You must explicitly specify that local accounts that are not on the destination computer should be migrated.](#bkmk-8) If you are migrating local accounts and the local account does not exist on the destination computer, you must use the **/lac** option when using the LoadState command. If the **/lac** option is not specified, no local user accounts will be migrated. + +- [Consider whether to enable user accounts that are new to the destination computer.](#bkmk-8) The **/lae** option enables the account that was created with the **/lac** option. However, if you create a disabled local account by using only the **/lac** option, a local administrator must enable the account on the destination computer. + +- [Be careful when specifying a password for local accounts.](#bkmk-8) If you create the local account with a blank password, anyone could log on to that account on the destination computer. If you create the local account with a password, the password is available to anyone with access to the USMT command-line tools. + +>[!NOTE] +>If there are multiple users on a computer, and you specify a password with the **/lac** option, all migrated users will have the same password. + +## Migrating Domain Accounts + +The source and destination computers do not need to be connected to the domain for domain user profiles to be migrated. + +## Command-Line Options + +USMT provides several options to migrate multiple users on a single computer. The following command-line options specify which users to migrate. + +- [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. + + >[!IMPORTANT] + >The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. + +- [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool. + +- [Creating local accounts.](#bkmk-8) You can create and enable local accounts using the **/lac** and **/lae** options with the LoadState command-line tool. + +- [Renaming user accounts.](#bkmk-8) You can rename user accounts using the **/mu** option. + + >[!NOTE] + >By default, if a user name is not specified in any of the command-line options, the user will be migrated. + +## Related topics + +[Determine What to Migrate](usmt-determine-what-to-migrate.md)
              +[ScanState Syntax](usmt-scanstate-syntax.md)
              +[LoadState Syntax](usmt-loadstate-syntax.md) diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md index c594b6ea7d..734c21960c 100644 --- a/windows/deployment/usmt/usmt-include-files-and-settings.md +++ b/windows/deployment/usmt/usmt-include-files-and-settings.md @@ -1,6 +1,6 @@ --- title: Include Files and Settings (Windows 10) -description: Include Files and Settings +description: Specify the migration .xml files you want, then use the User State Migration Tool (USMT) 10.0 to migrate the settings and components specified. ms.assetid: 9009c6a5-0612-4478-8742-abe5eb6cbac8 ms.reviewer: manager: laurawi diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md index ea390e9871..f421c5d9ee 100644 --- a/windows/deployment/usmt/usmt-loadstate-syntax.md +++ b/windows/deployment/usmt/usmt-loadstate-syntax.md @@ -1,6 +1,6 @@ --- title: LoadState Syntax (Windows 10) -description: LoadState Syntax +description: Learn about the syntax and usage of the command-line options available when you use the LoadState command. ms.assetid: 53d2143b-cbe9-4cfc-8506-36e9d429f6d4 ms.reviewer: manager: laurawi @@ -8,7 +8,8 @@ ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.date: 04/19/2017 ms.topic: article --- @@ -16,9 +17,9 @@ ms.topic: article # LoadState Syntax -This topic discusses the **LoadState** command syntax and options. +This topic discusses the **LoadState** command syntax and options available with it. -## In This Topic +## In this topic [Before You Begin](#before) @@ -247,7 +248,7 @@ USMT provides several command-line options that you can use to analyze problems

              /progress:[Path</em>]FileName

              Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

              For example:

              -

              loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log

              +

              loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:loadlog.log

              /c

              @@ -461,7 +462,7 @@ You can use the **/uel**, **/ue** and **/ui** options together to migrate only t **The /ui option has precedence over the /ue and /uel options.** If a user is specified to be included using the **/ui** option, and also specified to be excluded using either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the **/ui** option takes precedence over the **/ue** option. -**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user’s profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. +**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user's profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md index d9917d3495..63fcf4af6f 100644 --- a/windows/deployment/usmt/usmt-log-files.md +++ b/windows/deployment/usmt/usmt-log-files.md @@ -1,6 +1,6 @@ --- title: Log Files (Windows 10) -description: Log Files +description: Learn how to use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. ms.assetid: 28185ebd-630a-4bbd-94f4-8c48aad05649 ms.reviewer: manager: laurawi @@ -251,7 +251,7 @@ The following examples describe common scenarios in which you can use the diagno **Why is this file not migrating when I authored an "include" rule for it?** -Let’s imagine that we have the following directory structure and that we want the “data” directory to be included in the migration along with the “New Text Document.txt” file in the “New Folder.” The directory of **C:\\data** contains: +Let's imagine that we have the following directory structure and that we want the "data" directory to be included in the migration along with the "New Text Document.txt" file in the "New Folder." The directory of **C:\\data** contains: ``` 01/21/2009 10:08 PM . @@ -293,7 +293,7 @@ To migrate these files you author the following migration XML: ``` -However, upon testing the migration you notice that the “New Text Document.txt” file isn’t included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: +However, upon testing the migration you notice that the "New Text Document.txt" file isn't included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered: ``` xml @@ -312,7 +312,7 @@ However, upon testing the migration you notice that the “New Text Document.txt ``` -Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The <Perform> section details the actual files that were scheduled for gathering and the result of the gathering operation. The “New Text Document.txt” file doesn’t appear in this section, which confirms that the migration rule was not correctly authored. +Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The <Perform> section details the actual files that were scheduled for gathering and the result of the gathering operation. The "New Text Document.txt" file doesn't appear in this section, which confirms that the migration rule was not correctly authored. An analysis of the XML elements reference topic reveals that the <pattern> tag needs to be modified as follows: @@ -345,7 +345,7 @@ This diagnostic log confirms that the modified <pattern> value enables the **Why is this file migrating when I authored an exclude rule excluding it?** -In this scenario, you have the following directory structure and you want all files in the “data” directory to migrate, except for text files. The **C:\\Data** folder contains: +In this scenario, you have the following directory structure and you want all files in the "data" directory to migrate, except for text files. The **C:\\Data** folder contains: ``` Directory of C:\Data @@ -395,7 +395,7 @@ You author the following migration XML: ``` -However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: +However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered: ``` xml diff --git a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md index 706f2c6a6e..17fe9cfc7d 100644 --- a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md +++ b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md @@ -1,55 +1,56 @@ ---- -title: Migrate EFS Files and Certificates (Windows 10) -description: Migrate EFS Files and Certificates -ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate EFS Files and Certificates - - -This topic describes how to migrate Encrypting File System (EFS) certificates. For more information about the **/efs** For options, see [ScanState Syntax](usmt-scanstate-syntax.md). - -## To Migrate EFS Files and Certificates - - -Encrypting File System (EFS) certificates will be migrated automatically. However, by default, the User State Migration Tool (USMT) 10.0 fails if an encrypted file is found (unless you specify an **/efs** option). Therefore, you must specify **/efs:abort | skip | decryptcopy | copyraw | hardlink** with the ScanState command to migrate the encrypted files. Then, when you run the LoadState command on the destination computer, the encrypted file and the EFS certificate will be automatically migrated. - -**Note**   -The **/efs** options are not used with the LoadState command. - - - -Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you must ensure that all files in an encrypted folder are encrypted as well or remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute has been removed from a file but not from the parent folder, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. - -You can run the Cipher tool at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt type: - -``` syntax -Cipher /D /S: -``` - -Where *<Path>* is the full path of the topmost parent directory where the encryption attribute is set. - -## Related topics - - -[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) - - - - - - - - - +--- +title: Migrate EFS Files and Certificates (Windows 10) +description: Learn how to migrate Encrypting File System (EFS) certificates. Also, learn where to find information about how to identify file types, files, and folders. +ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate EFS Files and Certificates + + +This topic describes how to migrate Encrypting File System (EFS) certificates. For more information about the **/efs** For options, see [ScanState Syntax](usmt-scanstate-syntax.md). + +## To Migrate EFS Files and Certificates + + +Encrypting File System (EFS) certificates will be migrated automatically. However, by default, the User State Migration Tool (USMT) 10.0 fails if an encrypted file is found (unless you specify an **/efs** option). Therefore, you must specify **/efs:abort | skip | decryptcopy | copyraw | hardlink** with the ScanState command to migrate the encrypted files. Then, when you run the LoadState command on the destination computer, the encrypted file and the EFS certificate will be automatically migrated. + +**Note**   +The **/efs** options are not used with the LoadState command. + + + +Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you must ensure that all files in an encrypted folder are encrypted as well or remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute has been removed from a file but not from the parent folder, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. + +You can run the Cipher tool at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt type: + +``` syntax +Cipher /D /S: +``` + +Where *<Path>* is the full path of the topmost parent directory where the encryption attribute is set. + +## Related topics + + +[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + +[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-migrate-user-accounts.md b/windows/deployment/usmt/usmt-migrate-user-accounts.md index 663964c7eb..330d9984b5 100644 --- a/windows/deployment/usmt/usmt-migrate-user-accounts.md +++ b/windows/deployment/usmt/usmt-migrate-user-accounts.md @@ -1,96 +1,97 @@ ---- -title: Migrate User Accounts (Windows 10) -description: Migrate User Accounts -ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate User Accounts - - -By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the User options. You cannot specify users in the migration XML files or by using the Config.xml file. - -## In this Topic - - -- [To migrate all user accounts and user settings](#bkmk-migrateall) - -- [To migrate two domain accounts (User1 and User2)](#bkmk-migratetwo) - -- [To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain](#bkmk-migratemoveuserone) - -## To migrate all user accounts and user settings -Links to detailed explanations of commands are available in the Related Topics section. - -1. Log on to the source computer as an administrator, and specify the following in a **Command-Prompt** window: - - `scanstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Do one of the following: - - - If you are migrating domain accounts, specify: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` - - - If you are migrating local accounts along with domain accounts, specify: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /lac /lae` - - **Note**   - You do not have to specify the **/lae** option, which enables the account that was created with the **/lac** option. Instead, you can create a disabled local account by specifying only the **/lac** option, and then a local administrator needs to enable the account on the destination computer. - - - -## To migrate two domain accounts (User1 and User2) -Links to detailed explanations of commands are available in the Related Topics section. - -1. Log on to the source computer as an administrator, and specify: - - `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:fabrikam\user2 /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Specify the following: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` - -## To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain -Links to detailed explanations of commands are available in the Related Topics section. - -1. Log on to the source computer as an administrator, and type the following at the command-line prompt: - - `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:contoso\user2 /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Specify the following: - - `loadstate \\server\share\migration\mystore /mu:contoso\user1:fabrikam\user2 /i:migdocs.xml /i:migapp.xml` - -## Related topics - - -[Identify Users](usmt-identify-users.md) - -[ScanState Syntax](usmt-scanstate-syntax.md) - -[LoadState Syntax](usmt-loadstate-syntax.md) - - - - - - - - - +--- +title: Migrate User Accounts (Windows 10) +description: Learn how to migrate user accounts and how to specify which users to include and exclude by using the User options on the command line. +ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate User Accounts + + +By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the User options. You cannot specify users in the migration XML files or by using the Config.xml file. + +## In this Topic + + +- [To migrate all user accounts and user settings](#bkmk-migrateall) + +- [To migrate two domain accounts (User1 and User2)](#bkmk-migratetwo) + +- [To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain](#bkmk-migratemoveuserone) + +## To migrate all user accounts and user settings +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and specify the following in a **Command-Prompt** window: + + `scanstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Do one of the following: + + - If you are migrating domain accounts, specify: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` + + - If you are migrating local accounts along with domain accounts, specify: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /lac /lae` + + **Note**   + You do not have to specify the **/lae** option, which enables the account that was created with the **/lac** option. Instead, you can create a disabled local account by specifying only the **/lac** option, and then a local administrator needs to enable the account on the destination computer. + + + +## To migrate two domain accounts (User1 and User2) +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and specify: + + `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:fabrikam\user2 /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Specify the following: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` + +## To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and type the following at the command-line prompt: + + `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:contoso\user2 /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Specify the following: + + `loadstate \\server\share\migration\mystore /mu:contoso\user1:fabrikam\user2 /i:migdocs.xml /i:migapp.xml` + +## Related topics + + +[Identify Users](usmt-identify-users.md) + +[ScanState Syntax](usmt-scanstate-syntax.md) + +[LoadState Syntax](usmt-loadstate-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md index 8ef1ea7592..c10a7ba4f3 100644 --- a/windows/deployment/usmt/usmt-migration-store-encryption.md +++ b/windows/deployment/usmt/usmt-migration-store-encryption.md @@ -1,76 +1,77 @@ ---- -title: Migration Store Encryption (Windows 10) -description: Migration Store Encryption -ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migration Store Encryption - - -This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. - -## USMT Encryption Options - - -USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. - -The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration. - -The following table describes the command-line encryption options in USMT. - -
              ----- - - - - - - - - - - - - - - - - - - - -
              ComponentOptionDescription

              ScanState

              /encrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

              This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.

              LoadState

              /decrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

              This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.

              - - - -**Important**   -Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md) - - - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: Migration Store Encryption (Windows 10) +description:  Learn how the User State Migration Tool (USMT) enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES). +ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migration Store Encryption + + +This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. + +## USMT Encryption Options + + +USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. + +The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration. + +The following table describes the command-line encryption options in USMT. + + +++++ + + + + + + + + + + + + + + + + + + + +
              ComponentOptionDescription

              ScanState

              /encrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

              This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.

              LoadState

              /decrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

              This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.

              + + + +**Important**   +Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md) + + + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md index 6d80871901..f8d35246e7 100644 --- a/windows/deployment/usmt/usmt-overview.md +++ b/windows/deployment/usmt/usmt-overview.md @@ -1,60 +1,53 @@ ---- -title: User State Migration Tool (USMT) Overview (Windows 10) -description: User State Migration Tool (USMT) Overview -ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 10/16/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Overview -You can use User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. You can use USMT for both PC replacement and PC refresh migrations. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). - -USMT enables you to do the following: - -- Configure your migration according to your business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they are migrated. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). - -- Fit your customized migration into your automated deployment process by using the ScanState and LoadState tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md). - -- Perform offline migrations. You can run migrations offline by using the ScanState command in Windows Preinstallation Environment (WinPE) or you can perform migrations from previous installations of Windows contained in Windows.old directories. For more information about migration types, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md) and [Offline Migration Reference](offline-migration-reference.md). - -## Benefits -USMT provides the following benefits to businesses that are deploying Windows operating systems: - -- Safely migrates user accounts, operating system and application settings. - -- Lowers the cost of deploying Windows by preserving user state. - -- Reduces end-user downtime required to customize desktops and find missing files. - -- Reduces help-desk calls. - -- Reduces the time needed for the user to become familiar with the new operating system. - -- Increases employee satisfaction with the migration experience. - -## Limitations -USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. - -There are some scenarios in which the use of USMT is not recommended. These include: - -- Migrations that require end-user interaction. - -- Migrations that require customization on a machine-by-machine basis. - -## Related topics -- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md) - - -  - - - - - +--- +title: User State Migration Tool (USMT) Overview (Windows 10) +description: Learn about using User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. +ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 10/16/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Overview +You can use User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. You can use USMT for both PC replacement and PC refresh migrations. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). + +USMT enables you to do the following: + +- Configure your migration according to your business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they are migrated. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). + +- Fit your customized migration into your automated deployment process by using the ScanState and LoadState tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md). + +- Perform offline migrations. You can run migrations offline by using the ScanState command in Windows Preinstallation Environment (WinPE) or you can perform migrations from previous installations of Windows contained in Windows.old directories. For more information about migration types, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md) and [Offline Migration Reference](offline-migration-reference.md). + +## Benefits +USMT provides the following benefits to businesses that are deploying Windows operating systems: + +- Safely migrates user accounts, operating system and application settings. + +- Lowers the cost of deploying Windows by preserving user state. + +- Reduces end-user downtime required to customize desktops and find missing files. + +- Reduces help-desk calls. + +- Reduces the time needed for the user to become familiar with the new operating system. + +- Increases employee satisfaction with the migration experience. + +## Limitations +USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. + +There are some scenarios in which the use of USMT is not recommended. These include: + +- Migrations that require end-user interaction. + +- Migrations that require customization on a machine-by-machine basis. + +## Related topics +- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md) diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md index 1fa60664bd..7ea0c4d341 100644 --- a/windows/deployment/usmt/usmt-plan-your-migration.md +++ b/windows/deployment/usmt/usmt-plan-your-migration.md @@ -1,71 +1,72 @@ ---- -title: Plan Your Migration (Windows 10) -description: Plan Your Migration -ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Plan Your Migration - - -Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. - -In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. - -One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that you capture on the source computer may be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that you will not install on the destination system is redundant. This can also introduce instability in a newly deployed computer. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - -

              Common Migration Scenarios

              Determine whether you will perform a refresh migration or a replace migration.

              What Does USMT Migrate?

              Learn which applications, user data, and operating system components USMT migrates.

              Choose a Migration Store Type

              Choose an uncompressed, compressed, or hard-link migration store.

              Determine What to Migrate

              Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.

              Test Your Migration

              Test your migration before you deploy Windows to all users.

              - - - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: Plan Your Migration (Windows 10) +description: Learn how to your plan your migration carefully so your migration can proceed smoothly and so that you reduce the risk of migration failure. +ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Plan Your Migration + + +Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. + +In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. + +One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that you capture on the source computer may be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that you will not install on the destination system is redundant. This can also introduce instability in a newly deployed computer. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

              Common Migration Scenarios

              Determine whether you will perform a refresh migration or a replace migration.

              What Does USMT Migrate?

              Learn which applications, user data, and operating system components USMT migrates.

              Choose a Migration Store Type

              Choose an uncompressed, compressed, or hard-link migration store.

              Determine What to Migrate

              Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.

              Test Your Migration

              Test your migration before you deploy Windows to all users.

              + + + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md index d2862feb9a..dfb923bbd4 100644 --- a/windows/deployment/usmt/usmt-recognized-environment-variables.md +++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md @@ -1,470 +1,471 @@ ---- -title: Recognized Environment Variables (Windows 10) -description: Recognized Environment Variables -ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Recognized Environment Variables - - -When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use environment variables to identify folders that may be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but may not have the same name or location on any given computer. For example, the documents folder may be C:\\Users\\<Username>\\My Documents on one computer and C:\\Documents and Settings on another. You can use the asterisk (\*) wildcard character in MigUser.xml, MigApp.xml and MigDoc.xml files. However, you cannot use the asterisk (\*) wildcard characters in the Config.xml file. - -## In This Topic - - -- [Variables that are processed for the operating system and in the context of each user](#bkmk-1) - -- [Variables that are recognized only in the user context](#bkmk-2) - -## Variables that are processed for the operating system and in the context of each user - - -You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              VariableExplanation

              ALLUSERSAPPDATA

              Same as CSIDL_COMMON_APPDATA.

              ALLUSERSPROFILE

              Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.

              COMMONPROGRAMFILES

              Same as CSIDL_PROGRAM_FILES_COMMON.

              COMMONPROGRAMFILES(X86)

              Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.

              CSIDL_COMMON_ADMINTOOLS

              Version 10.0. The file-system directory that contains administrative tools for all users of the computer.

              CSIDL_COMMON_ALTSTARTUP

              The file-system directory that corresponds to the non-localized Startup program group for all users.

              CSIDL_COMMON_APPDATA

              The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.

              CSIDL_COMMON_DESKTOPDIRECTORY

              The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.

              CSIDL_COMMON_DOCUMENTS

              The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.

              CSIDL_COMMON_FAVORITES

              The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.

              CSIDL_COMMON_MUSIC

              The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.

              CSIDL_COMMON_PICTURES

              The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.

              CSIDL_COMMON_PROGRAMS

              The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

              CSIDL_COMMON_STARTMENU

              The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.

              CSIDL_COMMON_STARTUP

              The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

              CSIDL_COMMON_TEMPLATES

              The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.

              CSIDL_COMMON_VIDEO

              The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.

              CSIDL_DEFAULT_APPDATA

              Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_LOCAL_APPDATA

              Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_COOKIES

              Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_CONTACTS

              Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_DESKTOP

              Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_DOWNLOADS

              Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_FAVORITES

              Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_HISTORY

              Refers to the History folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_INTERNET_CACHE

              Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_PERSONAL

              Refers to the Personal folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYDOCUMENTS

              Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYPICTURES

              Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYMUSIC

              Refers to the My Music folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYVIDEO

              Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_RECENT

              Refers to the Recent folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_SENDTO

              Refers to the Send To folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_STARTMENU

              Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_PROGRAMS

              Refers to the Programs folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_STARTUP

              Refers to the Startup folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_TEMPLATES

              Refers to the Templates folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_QUICKLAUNCH

              Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.

              CSIDL_FONTS

              A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

              CSIDL_PROGRAM_FILESX86

              The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).

              CSIDL_PROGRAM_FILES_COMMONX86

              A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.

              CSIDL_PROGRAM_FILES

              The Program Files folder. A typical path is C:\Program Files.

              CSIDL_PROGRAM_FILES_COMMON

              A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

              CSIDL_RESOURCES

              The file-system directory that contains resource data. A typical path is C:\Windows\Resources.

              CSIDL_SYSTEM

              The Windows System folder. A typical path is C:\Windows\System32.

              CSIDL_WINDOWS

              The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

              DEFAULTUSERPROFILE

              Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].

              PROFILESFOLDER

              Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].

              PROGRAMFILES

              Same as CSIDL_PROGRAM_FILES.

              PROGRAMFILES(X86)

              Refers to the C:\Program Files (x86) folder on 64-bit systems.

              SYSTEM

              Refers to %WINDIR%\system32.

              SYSTEM16

              Refers to %WINDIR%\system.

              SYSTEM32

              Refers to %WINDIR%\system32.

              SYSTEMPROFILE

              Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].

              SYSTEMROOT

              Refers to the root of the system drive.

              WINDIR

              Refers to the Windows folder located on the system drive.

              - -  - -## Variables that are recognized only in the user context - - -You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              VariableExplanation

              APPDATA

              Same as CSIDL_APPDATA.

              CSIDL_ADMINTOOLS

              The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.

              CSIDL_ALTSTARTUP

              The file-system directory that corresponds to the user's non-localized Startup program group.

              CSIDL_APPDATA

              The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.

              CSIDL_BITBUCKET

              The virtual folder that contains the objects in the user's Recycle Bin.

              CSIDL_CDBURN_AREA

              The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.

              CSIDL_CONNECTIONS

              The virtual folder representing Network Connections that contains network and dial-up connections.

              CSIDL_CONTACTS

              This refers to the Contacts folder in %CSIDL_PROFILE%.

              CSIDL_CONTROLS

              The virtual folder that contains icons for the Control Panel items.

              CSIDL_COOKIES

              The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.

              CSIDL_DESKTOP

              The virtual folder representing the Windows desktop.

              CSIDL_DESKTOPDIRECTORY

              The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.

              CSIDL_DRIVES

              The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.

              CSIDL_FAVORITES

              The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.

              CSIDL_HISTORY

              The file-system directory that serves as a common repository for Internet history items.

              CSIDL_INTERNET

              A virtual folder for Internet Explorer.

              CSIDL_INTERNET_CACHE

              The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files

              CSIDL_LOCAL_APPDATA

              The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.

              CSIDL_MYDOCUMENTS

              The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.

              CSIDL_MYMUSIC

              The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.

              CSIDL_MYPICTURES

              The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.

              CSIDL_MYVIDEO

              The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.

              CSIDL_NETHOOD

              A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.

              CSIDL_NETWORK

              A virtual folder representing My Network Places, the root of the network namespace hierarchy.

              CSIDL_PERSONAL

              The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

              -

              A typical path is C:\Documents and Settings\username\My Documents.

              CSIDL_PLAYLISTS

              The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.

              CSIDL_PRINTERS

              The virtual folder that contains installed printers.

              CSIDL_PRINTHOOD

              The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.

              CSIDL_PROFILE

              The user's profile folder. A typical path is C:\Users\Username.

              CSIDL_PROGRAMS

              The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.

              CSIDL_RECENT

              The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.

              CSIDL_SENDTO

              The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.

              CSIDL_STARTMENU

              The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.

              CSIDL_STARTUP

              The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

              CSIDL_TEMPLATES

              The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.

              HOMEPATH

              Same as the standard environment variable.

              TEMP

              The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

              TMP

              The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

              USERPROFILE

              Same as CSIDL_PROFILE.

              USERSID

              Represents the current user-account security identifier (SID). For example,

              -

              S-1-5-21-1714567821-1326601894-715345443-1026.

              - -  - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: Recognized Environment Variables (Windows 10) +description: Learn how to use environment variables to identify folders that may be different on different computers. +ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Recognized Environment Variables + + +When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use environment variables to identify folders that may be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but may not have the same name or location on any given computer. For example, the documents folder may be C:\\Users\\<Username>\\My Documents on one computer and C:\\Documents and Settings on another. You can use the asterisk (\*) wildcard character in MigUser.xml, MigApp.xml and MigDoc.xml files. However, you cannot use the asterisk (\*) wildcard characters in the Config.xml file. + +## In This Topic + + +- [Variables that are processed for the operating system and in the context of each user](#bkmk-1) + +- [Variables that are recognized only in the user context](#bkmk-2) + +## Variables that are processed for the operating system and in the context of each user + + +You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              VariableExplanation

              ALLUSERSAPPDATA

              Same as CSIDL_COMMON_APPDATA.

              ALLUSERSPROFILE

              Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.

              COMMONPROGRAMFILES

              Same as CSIDL_PROGRAM_FILES_COMMON.

              COMMONPROGRAMFILES(X86)

              Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.

              CSIDL_COMMON_ADMINTOOLS

              Version 10.0. The file-system directory that contains administrative tools for all users of the computer.

              CSIDL_COMMON_ALTSTARTUP

              The file-system directory that corresponds to the non-localized Startup program group for all users.

              CSIDL_COMMON_APPDATA

              The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.

              CSIDL_COMMON_DESKTOPDIRECTORY

              The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.

              CSIDL_COMMON_DOCUMENTS

              The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.

              CSIDL_COMMON_FAVORITES

              The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.

              CSIDL_COMMON_MUSIC

              The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.

              CSIDL_COMMON_PICTURES

              The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.

              CSIDL_COMMON_PROGRAMS

              The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

              CSIDL_COMMON_STARTMENU

              The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.

              CSIDL_COMMON_STARTUP

              The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

              CSIDL_COMMON_TEMPLATES

              The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.

              CSIDL_COMMON_VIDEO

              The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.

              CSIDL_DEFAULT_APPDATA

              Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_LOCAL_APPDATA

              Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_COOKIES

              Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_CONTACTS

              Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_DESKTOP

              Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_DOWNLOADS

              Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_FAVORITES

              Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_HISTORY

              Refers to the History folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_INTERNET_CACHE

              Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_PERSONAL

              Refers to the Personal folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYDOCUMENTS

              Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYPICTURES

              Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYMUSIC

              Refers to the My Music folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_MYVIDEO

              Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_RECENT

              Refers to the Recent folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_SENDTO

              Refers to the Send To folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_STARTMENU

              Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_PROGRAMS

              Refers to the Programs folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_STARTUP

              Refers to the Startup folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_TEMPLATES

              Refers to the Templates folder inside %DEFAULTUSERPROFILE%.

              CSIDL_DEFAULT_QUICKLAUNCH

              Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.

              CSIDL_FONTS

              A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

              CSIDL_PROGRAM_FILESX86

              The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).

              CSIDL_PROGRAM_FILES_COMMONX86

              A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.

              CSIDL_PROGRAM_FILES

              The Program Files folder. A typical path is C:\Program Files.

              CSIDL_PROGRAM_FILES_COMMON

              A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

              CSIDL_RESOURCES

              The file-system directory that contains resource data. A typical path is C:\Windows\Resources.

              CSIDL_SYSTEM

              The Windows System folder. A typical path is C:\Windows\System32.

              CSIDL_WINDOWS

              The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

              DEFAULTUSERPROFILE

              Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].

              PROFILESFOLDER

              Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].

              PROGRAMFILES

              Same as CSIDL_PROGRAM_FILES.

              PROGRAMFILES(X86)

              Refers to the C:\Program Files (x86) folder on 64-bit systems.

              SYSTEM

              Refers to %WINDIR%\system32.

              SYSTEM16

              Refers to %WINDIR%\system.

              SYSTEM32

              Refers to %WINDIR%\system32.

              SYSTEMPROFILE

              Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].

              SYSTEMROOT

              Refers to the root of the system drive.

              WINDIR

              Refers to the Windows folder located on the system drive.

              + +  + +## Variables that are recognized only in the user context + + +You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              VariableExplanation

              APPDATA

              Same as CSIDL_APPDATA.

              CSIDL_ADMINTOOLS

              The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.

              CSIDL_ALTSTARTUP

              The file-system directory that corresponds to the user's non-localized Startup program group.

              CSIDL_APPDATA

              The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.

              CSIDL_BITBUCKET

              The virtual folder that contains the objects in the user's Recycle Bin.

              CSIDL_CDBURN_AREA

              The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.

              CSIDL_CONNECTIONS

              The virtual folder representing Network Connections that contains network and dial-up connections.

              CSIDL_CONTACTS

              This refers to the Contacts folder in %CSIDL_PROFILE%.

              CSIDL_CONTROLS

              The virtual folder that contains icons for the Control Panel items.

              CSIDL_COOKIES

              The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.

              CSIDL_DESKTOP

              The virtual folder representing the Windows desktop.

              CSIDL_DESKTOPDIRECTORY

              The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.

              CSIDL_DRIVES

              The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.

              CSIDL_FAVORITES

              The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.

              CSIDL_HISTORY

              The file-system directory that serves as a common repository for Internet history items.

              CSIDL_INTERNET

              A virtual folder for Internet Explorer.

              CSIDL_INTERNET_CACHE

              The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files

              CSIDL_LOCAL_APPDATA

              The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.

              CSIDL_MYDOCUMENTS

              The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.

              CSIDL_MYMUSIC

              The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.

              CSIDL_MYPICTURES

              The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.

              CSIDL_MYVIDEO

              The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.

              CSIDL_NETHOOD

              A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.

              CSIDL_NETWORK

              A virtual folder representing My Network Places, the root of the network namespace hierarchy.

              CSIDL_PERSONAL

              The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

              +

              A typical path is C:\Documents and Settings\username\My Documents.

              CSIDL_PLAYLISTS

              The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.

              CSIDL_PRINTERS

              The virtual folder that contains installed printers.

              CSIDL_PRINTHOOD

              The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.

              CSIDL_PROFILE

              The user's profile folder. A typical path is C:\Users\Username.

              CSIDL_PROGRAMS

              The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.

              CSIDL_RECENT

              The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.

              CSIDL_SENDTO

              The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.

              CSIDL_STARTMENU

              The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.

              CSIDL_STARTUP

              The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

              CSIDL_TEMPLATES

              The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.

              HOMEPATH

              Same as the standard environment variable.

              TEMP

              The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

              TMP

              The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

              USERPROFILE

              Same as CSIDL_PROFILE.

              USERSID

              Represents the current user-account security identifier (SID). For example,

              +

              S-1-5-21-1714567821-1326601894-715345443-1026.

              + +  + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md index c5bcd4193c..7e00f19577 100644 --- a/windows/deployment/usmt/usmt-reference.md +++ b/windows/deployment/usmt/usmt-reference.md @@ -1,77 +1,78 @@ ---- -title: User State Migration Toolkit (USMT) Reference (Windows 10) -description: User State Migration Toolkit (USMT) Reference -ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Toolkit (USMT) Reference - - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

              USMT Requirements

              Describes operating system, hardware, and software requirements, and user prerequisites.

              USMT Best Practices

              Discusses general and security-related best practices when using USMT.

              How USMT Works

              Learn about the processes behind the ScanState and LoadState tools.

              Plan Your Migration

              Choose what to migrate and the best migration scenario for your enterprise.

              User State Migration Tool (USMT) Command-line Syntax

              Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.

              USMT XML Reference

              Learn about customizing a migration with XML files.

              Offline Migration Reference

              Find requirements, best practices, and other considerations for performing a migration offline.

              - - - -## Related topics - - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - - - - - - - - - +--- +title: User State Migration Toolkit (USMT) Reference (Windows 10) +description: Use this User State Migration Toolkit (USMT) article to learn details about USMT, like operating system, hardware, and software requirements, and user prerequisites. +ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Toolkit (USMT) Reference + + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

              USMT Requirements

              Describes operating system, hardware, and software requirements, and user prerequisites.

              USMT Best Practices

              Discusses general and security-related best practices when using USMT.

              How USMT Works

              Learn about the processes behind the ScanState and LoadState tools.

              Plan Your Migration

              Choose what to migrate and the best migration scenario for your enterprise.

              User State Migration Tool (USMT) Command-line Syntax

              Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.

              USMT XML Reference

              Learn about customizing a migration with XML files.

              Offline Migration Reference

              Find requirements, best practices, and other considerations for performing a migration offline.

              + + + +## Related topics + + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md index 45af228e40..525801e93b 100644 --- a/windows/deployment/usmt/usmt-requirements.md +++ b/windows/deployment/usmt/usmt-requirements.md @@ -1,161 +1,162 @@ ---- -title: USMT Requirements (Windows 10) -description: USMT Requirements -ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 05/03/2017 -ms.topic: article ---- - -# USMT Requirements - - -## In This Topic - - -- [Supported Operating Systems](#bkmk-1) -- [Windows PE](#windows-pe) -- [Credentials](#credentials) -- [Config.xml](#configxml) -- [LoadState](#loadstate) -- [Hard Disk Requirements](#bkmk-3) -- [User Prerequisites](#bkmk-userprereqs) - -## Supported Operating Systems - - -The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. - -The following table lists the operating systems supported in USMT. - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Operating SystemsScanState (source computer)LoadState (destination computer)

              32-bit versions of Windows 7

              X

              X

              64-bit versions of Windows 7

              X

              X

              32-bit versions of Windows 8

              X

              X

              64-bit versions of Windows 8

              X

              X

              32-bit versions of Windows 10

              X

              X

              64-bit versions of Windows 10

              X

              X

              - - - -**Note**   -You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. - -USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. - -USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10. -For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564).  - -## Windows PE - -- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](https://msdn.microsoft.com/library/windows/hardware/dn938350.aspx). - -## Credentials - -- **Run as administrator** - When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. - -To open an elevated command prompt: - -1. Click **Start**. -2. Enter **cmd** in the search function. -3. Depending on the OS you are using, **cmd** or **Command Prompt** is displayed. -3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**. -4. If the current user is not already an administrator, you will be prompted to enter administrator credentials. - -**Important**
              -You must run USMT using an account with full administrative permissions, including the following privileges: - -- SeBackupPrivilege (Back up files and directories) -- SeDebugPrivilege (Debug programs) -- SeRestorePrivilege (Restore files and directories) -- SeSecurityPrivilege (Manage auditing and security log) -- SeTakeOwnership Privilege (Take ownership of files or other objects) - - -## Config.xml - -- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
              - USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). - -## LoadState - -- **Install applications before running the LoadState command.**
              - Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. - -## Hard-Disk Requirements - - -Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). - -## User Prerequisites - - -This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: - -- The navigation and hierarchy of the Windows registry. -- The files and file types that applications use. -- The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors. -- XML-authoring basics. - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md)
              -[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
              -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
              - - - - - - - - - +--- +title: USMT Requirements (Windows 10) +description: While the User State Migration Tool (USMT) doesn't have many requirements, these tips and tricks can help smooth the migration process. +ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 05/03/2017 +ms.topic: article +--- + +# USMT Requirements + + +## In This Topic + + +- [Supported Operating Systems](#bkmk-1) +- [Windows PE](#windows-pe) +- [Credentials](#credentials) +- [Config.xml](#configxml) +- [LoadState](#loadstate) +- [Hard Disk Requirements](#bkmk-3) +- [User Prerequisites](#bkmk-userprereqs) + +## Supported Operating Systems + + +The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. + +The following table lists the operating systems supported in USMT. + + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Operating SystemsScanState (source computer)LoadState (destination computer)

              32-bit versions of Windows 7

              X

              X

              64-bit versions of Windows 7

              X

              X

              32-bit versions of Windows 8

              X

              X

              64-bit versions of Windows 8

              X

              X

              32-bit versions of Windows 10

              X

              X

              64-bit versions of Windows 10

              X

              X

              + + + +**Note**   +You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. + +USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. + +USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10. +For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564).  + +## Windows PE + +- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](https://msdn.microsoft.com/library/windows/hardware/dn938350.aspx). + +## Credentials + +- **Run as administrator** + When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. + +To open an elevated command prompt: + +1. Click **Start**. +2. Enter **cmd** in the search function. +3. Depending on the OS you are using, **cmd** or **Command Prompt** is displayed. +3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**. +4. If the current user is not already an administrator, you will be prompted to enter administrator credentials. + +**Important**
              +You must run USMT using an account with full administrative permissions, including the following privileges: + +- SeBackupPrivilege (Back up files and directories) +- SeDebugPrivilege (Debug programs) +- SeRestorePrivilege (Restore files and directories) +- SeSecurityPrivilege (Manage auditing and security log) +- SeTakeOwnership Privilege (Take ownership of files or other objects) + + +## Config.xml + +- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
              + USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). + +## LoadState + +- **Install applications before running the LoadState command.**
              + Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. + +## Hard-Disk Requirements + + +Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). + +## User Prerequisites + + +This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: + +- The navigation and hierarchy of the Windows registry. +- The files and file types that applications use. +- The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors. +- XML-authoring basics. + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md)
              +[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
              +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
              + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md index 22f64e513e..facc5fef91 100644 --- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md +++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md @@ -1,6 +1,6 @@ --- title: Reroute Files and Settings (Windows 10) -description: Reroute Files and Settings +description: Learn how to create a custom .xml file and specify this file name on both the ScanState and LoadState commandlines to reroute files and settings. ms.assetid: 905e6a24-922c-4549-9732-60fa11862a6c ms.reviewer: manager: laurawi diff --git a/windows/deployment/usmt/usmt-resources.md b/windows/deployment/usmt/usmt-resources.md index eaaa49a5d4..4866b61aaf 100644 --- a/windows/deployment/usmt/usmt-resources.md +++ b/windows/deployment/usmt/usmt-resources.md @@ -1,50 +1,51 @@ ---- -title: USMT Resources (Windows 10) -description: USMT Resources -ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# USMT Resources - - -## USMT Online Resources - - -- [ADK Release Notes](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx) - -- Microsoft Visual Studio - - - You can use the User State Migration Tool (USMT) XML schema (the MigXML.xsd file) to validate the migration .xml files using an XML authoring tool such as Microsoft® Visual Studio®. - - For more information about how to use the schema with your XML authoring environment, see the environment’s documentation. - -- [Ask the Directory Services Team blog](https://go.microsoft.com/fwlink/p/?LinkId=226365) - -- Forums: - - - [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=226386) - - - [Configuration Manager Operating System Deployment](https://go.microsoft.com/fwlink/p/?LinkId=226388) - -## Related topics - - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -  - -  - - - - - +--- +title: USMT Resources (Windows 10) +description: Learn about User State Migration Tool (USMT) online resources, including Microsoft Visual Studio and forums. +ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# USMT Resources + + +## USMT Online Resources + + +- [ADK Release Notes](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx) + +- Microsoft Visual Studio + + - You can use the User State Migration Tool (USMT) XML schema (the MigXML.xsd file) to validate the migration .xml files using an XML authoring tool such as Microsoft® Visual Studio®. + + For more information about how to use the schema with your XML authoring environment, see the environment’s documentation. + +- [Ask the Directory Services Team blog](https://go.microsoft.com/fwlink/p/?LinkId=226365) + +- Forums: + + - [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=226386) + + - [Configuration Manager Operating System Deployment](https://go.microsoft.com/fwlink/p/?LinkId=226388) + +## Related topics + + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-return-codes.md b/windows/deployment/usmt/usmt-return-codes.md index c137197a5c..ba8e6da7c1 100644 --- a/windows/deployment/usmt/usmt-return-codes.md +++ b/windows/deployment/usmt/usmt-return-codes.md @@ -1,786 +1,787 @@ ---- -title: Return Codes (Windows 10) -description: Return Codes -ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Return Codes - - -This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error. - -Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). - -## In This Topic - - -[USMT Return Codes](#bkmk-returncodes) - -[USMT Error Messages](#bkmk-errormessages) - -[Troubleshooting Return Codes and Error Messages](#bkmk-tscodeserrors) - -## USMT Return Codes - - -If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. - -Return codes are grouped into the following broad categories that describe their area of error reporting: - -Success or User Cancel - -Invalid Command Lines - -Setup and Initialization - -Non-fatal Errors - -Fatal Errors - -As a best practice, we recommend that you set verbosity level to 5, **/v**:5, on the **ScanState**, **LoadState**, and **USMTUtils** command lines so that the most detailed reporting is available in the respective USMT logs. You can use a higher verbosity level if you want the log files output to go to a debugger. - -## USMT Error Messages - - -Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received. - -You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=147060). - -## Troubleshooting Return Codes and Error Messages - - -The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Return code valueReturn codeError messageTroubleshooting, mitigation, workaroundsCategory

              0

              USMT_SUCCESS

              Successful run

              Not applicable

              Success or Cancel

              1

              USMT_DISPLAY_HELP

              Command line help requested

              Not applicable

              Success or Cancel

              2

              USMT_STATUS_CANCELED

              Gather was aborted because of an EFS file

              Not applicable

              User chose to cancel (such as pressing CTRL+C)

              Not applicable

              Success or Cancel

              3

              USMT_WOULD_HAVE_FAILED

              At least one error was skipped as a result of /c

              Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.

              11

              USMT_INVALID_PARAMETERS

              /all conflicts with /ui, /ue or /uel

              Review ScanState log or LoadState log for details about command-line errors.

              /auto expects an optional parameter for the script folder

              Review ScanState log or LoadState log for details about command-line errors.

              /encrypt can't be used with /nocompress

              Review ScanState log or LoadState log for details about command-line errors.

              /encrypt requires /key or /keyfile

              Review ScanState log or LoadState log for details about command-line errors.

              /genconfig can't be used with most other options

              Review ScanState log or LoadState log for details about command-line errors.

              /genmigxml can't be used with most other options

              Review ScanState log or LoadState log for details about command-line errors.

              /hardlink requires /nocompress

              Review ScanState log or LoadState log for details about command-line errors.

              /key and /keyfile both specified

              Review ScanState log or LoadState log for details about command-line errors.

              /key or /keyfile used without enabling encryption

              Review ScanState log or LoadState log for details about command-line errors.

              /lae is only used with /lac

              Review ScanState log or LoadState log for details about command-line errors.

              /listfiles cannot be used with /p

              Review ScanState log or LoadState log for details about command-line errors.

              /offline requires a valid path to an XML file describing offline paths

              Review ScanState log or LoadState log for details about command-line errors.

              /offlinewindir requires a valid path to offline windows folder

              Review ScanState log or LoadState log for details about command-line errors.

              /offlinewinold requires a valid path to offline windows folder

              Review ScanState log or LoadState log for details about command-line errors.

              A command was already specified

              Verify that the command-line syntax is correct and that there are no duplicate commands.

              An option argument is missing

              Review ScanState log or LoadState log for details about command-line errors.

              An option is specified more than once and is ambiguous

              Review ScanState log or LoadState log for details about command-line errors.

              By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.

              Review ScanState log or LoadState log for details about command-line errors.

              Command line arguments are required. Specify /? for options.

              Review ScanState log or LoadState log for details about command-line errors.

              Command line option is not valid

              Review ScanState log or LoadState log for details about command-line errors.

              EFS parameter specified is not valid for /efs

              Review ScanState log or LoadState log for details about command-line errors.

              File argument is invalid for /genconfig

              Review ScanState log or LoadState log for details about command-line errors.

              File argument is invalid for /genmigxml

              Review ScanState log or LoadState log for details about command-line errors.

              Invalid space estimate path. Check the parameters and/or file system permissions

              Review ScanState log or LoadState log for details about command-line errors.

              List file path argument is invalid for /listfiles

              Review ScanState log or LoadState log for details about command-line errors.

              Retry argument must be an integer

              Review ScanState log or LoadState log for details about command-line errors.

              Settings store argument specified is invalid

              Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

              Specified encryption algorithm is not supported

              Review ScanState log or LoadState log for details about command-line errors.

              The /efs:hardlink requires /hardlink

              Review ScanState log or LoadState log for details about command-line errors.

              The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7

              Review ScanState log or LoadState log for details about command-line errors.

              The store parameter is required but not specified

              Review ScanState log or LoadState log for details about command-line errors.

              The source-to-target domain mapping is invalid for /md

              Review ScanState log or LoadState log for details about command-line errors.

              The source-to-target user account mapping is invalid for /mu

              Review ScanState log or LoadState log for details about command-line errors.

              Undefined or incomplete command line option

              Review ScanState log or LoadState log for details about command-line errors.

              Invalid Command Lines

              Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate

              Review ScanState log or LoadState log for details about command-line errors.

              User exclusion argument is invalid

              Review ScanState log or LoadState log for details about command-line errors.

              Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)

              Review ScanState log or LoadState log for details about command-line errors.

              Volume shadow copy feature is not supported with a hardlink store

              Review ScanState log or LoadState log for details about command-line errors.

              Wait delay argument must be an integer

              Review ScanState log or LoadState log for details about command-line errors.

              12

              USMT_ERROR_OPTION_PARAM_TOO_LARGE

              Command line arguments cannot exceed 256 characters

              Review ScanState log or LoadState log for details about command-line errors.

              Invalid Command Lines

              Specified settings store path exceeds the maximum allowed length of 256 characters

              Review ScanState log or LoadState log for details about command-line errors.

              13

              USMT_INIT_LOGFILE_FAILED

              Log path argument is invalid for /l

              When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.

              Invalid Command Lines

              14

              USMT_ERROR_USE_LAC

              Unable to create a local account because /lac was not specified

              When creating local accounts, the command-line options /lac and /lae should be used.

              Invalid Command Lines

              26

              USMT_INIT_ERROR

              Multiple Windows installations found

              Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

              Setup and Initialization

              Software malfunction or unknown exception

              Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.

              Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries

              Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.

              27

              USMT_INVALID_STORE_LOCATION

              A store path can't be used because an existing store exists; specify /o to overwrite

              Specify /o to overwrite an existing intermediate or migration store.

              Setup and Initialization

              A store path is missing or has incomplete data

              Make sure that the store path is accessible and that the proper permission levels are set.

              An error occurred during store creation

              Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

              An inappropriate device such as a floppy disk was specified for the store

              Make sure that the store path is accessible and that the proper permission levels are set.

              Invalid store path; check the store parameter and/or file system permissions

              Invalid store path; check the store parameter and/or file system permissions

              The file layout and/or file content is not recognized as a valid store

              Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

              The store path holds a store incompatible with the current USMT version

              Make sure that the store path is accessible and that the proper permission levels are set.

              The store save location is read-only or does not support a requested storage option

              Make sure that the store path is accessible and that the proper permission levels are set.

              28

              USMT_UNABLE_GET_SCRIPTFILES

              Script file is invalid for /i

              Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

              Setup and Initialization

              Unable to find a script file specified by /i

              Verify the location of your script files, and ensure that the command-line options are correct.

              29

              USMT_FAILED_MIGSTARTUP

              A minimum of 250 MB of free space is required for temporary files

              Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.

              Setup and Initialization

              Another process is preventing migration; only one migration tool can run at a time

              Check the ScanState log file for migration .xml file errors.

              Failed to start main processing, look in log for system errors or check the installation

              Check the ScanState log file for migration .xml file errors.

              Migration failed because of an XML error; look in the log for specific details

              Check the ScanState log file for migration .xml file errors.

              Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table

              Check the ScanState log file for migration .xml file errors.

              31

              USMT_UNABLE_FINDMIGUNITS

              An error occurred during the discover phase; the log should have more specific information

              Check the ScanState log file for migration .xml file errors.

              Setup and Initialization

              32

              USMT_FAILED_SETMIGRATIONTYPE

              An error occurred processing the migration system

              Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

              Setup and Initialization

              33

              USMT_UNABLE_READKEY

              Error accessing the file specified by the /keyfile parameter

              Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

              Setup and Initialization

              The encryption key must have at least one character

              Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

              34

              USMT_ERROR_INSUFFICIENT_RIGHTS

              Directory removal requires elevated privileges

              Log on as Administrator, and run with elevated privileges.

              Setup and Initialization

              No rights to create user profiles; log in as Administrator; run with elevated privileges

              Log on as Administrator, and run with elevated privileges.

              No rights to read or delete user profiles; log in as Administrator, run with elevated privileges

              Log on as Administrator, and run with elevated privileges.

              35

              USMT_UNABLE_DELETE_STORE

              A reboot is required to remove the store

              Reboot to delete any files that could not be deleted when the command was executed.

              Setup and Initialization

              A store path can't be used because it contains data that could not be overwritten

              A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.

              There was an error removing the store

              Review ScanState log or LoadState log for details about command-line errors.

              36

              USMT_ERROR_UNSUPPORTED_PLATFORM

              Compliance check failure; please check the logs for details

              Investigate whether there is an active temporary profile on the system.

              Setup and Initialization

              Use of /offline is not supported during apply

              The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).

              Use /offline to run gather on this platform

              The /offline command was not used while running in WinPE.

              37

              USMT_ERROR_NO_INVALID_KEY

              The store holds encrypted data but the correct encryption key was not provided

              Verify that you have included the correct encryption /key or /keyfile.

              Setup and Initialization

              38

              USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE

              An error occurred during store access

              Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

              Setup and Initialization

              39

              USMT_UNABLE_TO_READ_CONFIG_FILE

              Error reading Config.xml

              Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

              Setup and Initialization

              File argument is invalid for /config

              Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.

              40

              USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG

              Error writing to the progress log

              The Progress log could not be created. Verify that the location is valid and that you have write access.

              Setup and Initialization

              Progress log argument is invalid for /progress

              The Progress log could not be created. Verify that the location is valid and that you have write access.

              41

              USMT_PREFLIGHT_FILE_CREATION_FAILED

              Can't overwrite existing file

              The Progress log could not be created. Verify that the location is valid and that you have write access.

              Setup and Initialization

              Invalid space estimate path. Check the parameters and/or file system permissions

              Review ScanState log or LoadState log for details about command-line errors.

              42

              USMT_ERROR_CORRUPTED_STORE

              The store contains one or more corrupted files

              Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see Extract Files from a Compressed USMT Migration Store.

              61

              USMT_MIGRATION_STOPPED_NONFATAL

              Processing stopped due to an I/O error

              USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.

              Non-fatal Errors

              71

              USMT_INIT_OPERATING_ENVIRONMENT_FAILED

              A Windows Win32 API error occurred

              Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

              Fatal Errors

              An error occurred when attempting to initialize the diagnostic mechanisms such as the log

              Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

              Failed to record diagnostic information

              Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

              Unable to start. Make sure you are running USMT with elevated privileges

              Exit USMT and log in again with elevated privileges.

              72

              USMT_UNABLE_DOMIGRATION

              An error occurred closing the store

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              Fatal Errors

              An error occurred in the apply process

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              An error occurred in the gather process

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              Out of disk space while writing the store

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              Out of temporary disk space on the local system

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              - - - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Log Files](usmt-log-files.md) - - - - - - - - - +--- +title: Return Codes (Windows 10) +description: Learn about User State Migration Tool (USMT) 10.0 return codes and error messages. Also view a list of USMT return codes and their associated migration steps. +ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Return Codes + + +This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error. + +Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). + +## In This Topic + + +[USMT Return Codes](#bkmk-returncodes) + +[USMT Error Messages](#bkmk-errormessages) + +[Troubleshooting Return Codes and Error Messages](#bkmk-tscodeserrors) + +## USMT Return Codes + + +If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. + +Return codes are grouped into the following broad categories that describe their area of error reporting: + +Success or User Cancel + +Invalid Command Lines + +Setup and Initialization + +Non-fatal Errors + +Fatal Errors + +As a best practice, we recommend that you set verbosity level to 5, **/v**:5, on the **ScanState**, **LoadState**, and **USMTUtils** command lines so that the most detailed reporting is available in the respective USMT logs. You can use a higher verbosity level if you want the log files output to go to a debugger. + +## USMT Error Messages + + +Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received. + +You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=147060). + +## Troubleshooting Return Codes and Error Messages + + +The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Return code valueReturn codeError messageTroubleshooting, mitigation, workaroundsCategory

              0

              USMT_SUCCESS

              Successful run

              Not applicable

              Success or Cancel

              1

              USMT_DISPLAY_HELP

              Command line help requested

              Not applicable

              Success or Cancel

              2

              USMT_STATUS_CANCELED

              Gather was aborted because of an EFS file

              Not applicable

              User chose to cancel (such as pressing CTRL+C)

              Not applicable

              Success or Cancel

              3

              USMT_WOULD_HAVE_FAILED

              At least one error was skipped as a result of /c

              Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.

              11

              USMT_INVALID_PARAMETERS

              /all conflicts with /ui, /ue or /uel

              Review ScanState log or LoadState log for details about command-line errors.

              /auto expects an optional parameter for the script folder

              Review ScanState log or LoadState log for details about command-line errors.

              /encrypt can't be used with /nocompress

              Review ScanState log or LoadState log for details about command-line errors.

              /encrypt requires /key or /keyfile

              Review ScanState log or LoadState log for details about command-line errors.

              /genconfig can't be used with most other options

              Review ScanState log or LoadState log for details about command-line errors.

              /genmigxml can't be used with most other options

              Review ScanState log or LoadState log for details about command-line errors.

              /hardlink requires /nocompress

              Review ScanState log or LoadState log for details about command-line errors.

              /key and /keyfile both specified

              Review ScanState log or LoadState log for details about command-line errors.

              /key or /keyfile used without enabling encryption

              Review ScanState log or LoadState log for details about command-line errors.

              /lae is only used with /lac

              Review ScanState log or LoadState log for details about command-line errors.

              /listfiles cannot be used with /p

              Review ScanState log or LoadState log for details about command-line errors.

              /offline requires a valid path to an XML file describing offline paths

              Review ScanState log or LoadState log for details about command-line errors.

              /offlinewindir requires a valid path to offline windows folder

              Review ScanState log or LoadState log for details about command-line errors.

              /offlinewinold requires a valid path to offline windows folder

              Review ScanState log or LoadState log for details about command-line errors.

              A command was already specified

              Verify that the command-line syntax is correct and that there are no duplicate commands.

              An option argument is missing

              Review ScanState log or LoadState log for details about command-line errors.

              An option is specified more than once and is ambiguous

              Review ScanState log or LoadState log for details about command-line errors.

              By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.

              Review ScanState log or LoadState log for details about command-line errors.

              Command line arguments are required. Specify /? for options.

              Review ScanState log or LoadState log for details about command-line errors.

              Command line option is not valid

              Review ScanState log or LoadState log for details about command-line errors.

              EFS parameter specified is not valid for /efs

              Review ScanState log or LoadState log for details about command-line errors.

              File argument is invalid for /genconfig

              Review ScanState log or LoadState log for details about command-line errors.

              File argument is invalid for /genmigxml

              Review ScanState log or LoadState log for details about command-line errors.

              Invalid space estimate path. Check the parameters and/or file system permissions

              Review ScanState log or LoadState log for details about command-line errors.

              List file path argument is invalid for /listfiles

              Review ScanState log or LoadState log for details about command-line errors.

              Retry argument must be an integer

              Review ScanState log or LoadState log for details about command-line errors.

              Settings store argument specified is invalid

              Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

              Specified encryption algorithm is not supported

              Review ScanState log or LoadState log for details about command-line errors.

              The /efs:hardlink requires /hardlink

              Review ScanState log or LoadState log for details about command-line errors.

              The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7

              Review ScanState log or LoadState log for details about command-line errors.

              The store parameter is required but not specified

              Review ScanState log or LoadState log for details about command-line errors.

              The source-to-target domain mapping is invalid for /md

              Review ScanState log or LoadState log for details about command-line errors.

              The source-to-target user account mapping is invalid for /mu

              Review ScanState log or LoadState log for details about command-line errors.

              Undefined or incomplete command line option

              Review ScanState log or LoadState log for details about command-line errors.

              Invalid Command Lines

              Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate

              Review ScanState log or LoadState log for details about command-line errors.

              User exclusion argument is invalid

              Review ScanState log or LoadState log for details about command-line errors.

              Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)

              Review ScanState log or LoadState log for details about command-line errors.

              Volume shadow copy feature is not supported with a hardlink store

              Review ScanState log or LoadState log for details about command-line errors.

              Wait delay argument must be an integer

              Review ScanState log or LoadState log for details about command-line errors.

              12

              USMT_ERROR_OPTION_PARAM_TOO_LARGE

              Command line arguments cannot exceed 256 characters

              Review ScanState log or LoadState log for details about command-line errors.

              Invalid Command Lines

              Specified settings store path exceeds the maximum allowed length of 256 characters

              Review ScanState log or LoadState log for details about command-line errors.

              13

              USMT_INIT_LOGFILE_FAILED

              Log path argument is invalid for /l

              When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.

              Invalid Command Lines

              14

              USMT_ERROR_USE_LAC

              Unable to create a local account because /lac was not specified

              When creating local accounts, the command-line options /lac and /lae should be used.

              Invalid Command Lines

              26

              USMT_INIT_ERROR

              Multiple Windows installations found

              Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

              Setup and Initialization

              Software malfunction or unknown exception

              Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.

              Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries

              Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.

              27

              USMT_INVALID_STORE_LOCATION

              A store path can't be used because an existing store exists; specify /o to overwrite

              Specify /o to overwrite an existing intermediate or migration store.

              Setup and Initialization

              A store path is missing or has incomplete data

              Make sure that the store path is accessible and that the proper permission levels are set.

              An error occurred during store creation

              Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

              An inappropriate device such as a floppy disk was specified for the store

              Make sure that the store path is accessible and that the proper permission levels are set.

              Invalid store path; check the store parameter and/or file system permissions

              Invalid store path; check the store parameter and/or file system permissions

              The file layout and/or file content is not recognized as a valid store

              Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

              The store path holds a store incompatible with the current USMT version

              Make sure that the store path is accessible and that the proper permission levels are set.

              The store save location is read-only or does not support a requested storage option

              Make sure that the store path is accessible and that the proper permission levels are set.

              28

              USMT_UNABLE_GET_SCRIPTFILES

              Script file is invalid for /i

              Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

              Setup and Initialization

              Unable to find a script file specified by /i

              Verify the location of your script files, and ensure that the command-line options are correct.

              29

              USMT_FAILED_MIGSTARTUP

              A minimum of 250 MB of free space is required for temporary files

              Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.

              Setup and Initialization

              Another process is preventing migration; only one migration tool can run at a time

              Check the ScanState log file for migration .xml file errors.

              Failed to start main processing, look in log for system errors or check the installation

              Check the ScanState log file for migration .xml file errors.

              Migration failed because of an XML error; look in the log for specific details

              Check the ScanState log file for migration .xml file errors.

              Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table

              Check the ScanState log file for migration .xml file errors.

              31

              USMT_UNABLE_FINDMIGUNITS

              An error occurred during the discover phase; the log should have more specific information

              Check the ScanState log file for migration .xml file errors.

              Setup and Initialization

              32

              USMT_FAILED_SETMIGRATIONTYPE

              An error occurred processing the migration system

              Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

              Setup and Initialization

              33

              USMT_UNABLE_READKEY

              Error accessing the file specified by the /keyfile parameter

              Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

              Setup and Initialization

              The encryption key must have at least one character

              Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

              34

              USMT_ERROR_INSUFFICIENT_RIGHTS

              Directory removal requires elevated privileges

              Log on as Administrator, and run with elevated privileges.

              Setup and Initialization

              No rights to create user profiles; log in as Administrator; run with elevated privileges

              Log on as Administrator, and run with elevated privileges.

              No rights to read or delete user profiles; log in as Administrator, run with elevated privileges

              Log on as Administrator, and run with elevated privileges.

              35

              USMT_UNABLE_DELETE_STORE

              A reboot is required to remove the store

              Reboot to delete any files that could not be deleted when the command was executed.

              Setup and Initialization

              A store path can't be used because it contains data that could not be overwritten

              A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.

              There was an error removing the store

              Review ScanState log or LoadState log for details about command-line errors.

              36

              USMT_ERROR_UNSUPPORTED_PLATFORM

              Compliance check failure; please check the logs for details

              Investigate whether there is an active temporary profile on the system.

              Setup and Initialization

              Use of /offline is not supported during apply

              The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).

              Use /offline to run gather on this platform

              The /offline command was not used while running in WinPE.

              37

              USMT_ERROR_NO_INVALID_KEY

              The store holds encrypted data but the correct encryption key was not provided

              Verify that you have included the correct encryption /key or /keyfile.

              Setup and Initialization

              38

              USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE

              An error occurred during store access

              Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

              Setup and Initialization

              39

              USMT_UNABLE_TO_READ_CONFIG_FILE

              Error reading Config.xml

              Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

              Setup and Initialization

              File argument is invalid for /config

              Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.

              40

              USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG

              Error writing to the progress log

              The Progress log could not be created. Verify that the location is valid and that you have write access.

              Setup and Initialization

              Progress log argument is invalid for /progress

              The Progress log could not be created. Verify that the location is valid and that you have write access.

              41

              USMT_PREFLIGHT_FILE_CREATION_FAILED

              Can't overwrite existing file

              The Progress log could not be created. Verify that the location is valid and that you have write access.

              Setup and Initialization

              Invalid space estimate path. Check the parameters and/or file system permissions

              Review ScanState log or LoadState log for details about command-line errors.

              42

              USMT_ERROR_CORRUPTED_STORE

              The store contains one or more corrupted files

              Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see Extract Files from a Compressed USMT Migration Store.

              61

              USMT_MIGRATION_STOPPED_NONFATAL

              Processing stopped due to an I/O error

              USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.

              Non-fatal Errors

              71

              USMT_INIT_OPERATING_ENVIRONMENT_FAILED

              A Windows Win32 API error occurred

              Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

              Fatal Errors

              An error occurred when attempting to initialize the diagnostic mechanisms such as the log

              Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

              Failed to record diagnostic information

              Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

              Unable to start. Make sure you are running USMT with elevated privileges

              Exit USMT and log in again with elevated privileges.

              72

              USMT_UNABLE_DOMIGRATION

              An error occurred closing the store

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              Fatal Errors

              An error occurred in the apply process

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              An error occurred in the gather process

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              Out of disk space while writing the store

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              Out of temporary disk space on the local system

              Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

              + + + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Log Files](usmt-log-files.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index 83afe8628b..95c2a5e5ba 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -1,873 +1,862 @@ ---- -title: ScanState Syntax (Windows 10) -description: ScanState Syntax -ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# ScanState Syntax - - -The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. - -## In This Topic - - -[Before You Begin](#bkmk-beforeyoubegin) - -[Syntax](#bkmk-syntax) - -[Storage Options](#bkmk-storageoptions) - -[Migration Rule Options](#bkmk-migrationruleoptions) - -[Monitoring Options](#bkmk-monitoringoptions) - -[User Options](#bkmk-useroptions) - -[Encrypted File Options](#bkmk-efs) - -[Incompatible Command-Line Options](#bkmk-iclo) - -## Before You Begin - - -Before you run the **ScanState** command, note the following: - -- To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials. - -- If you encrypt the migration store, you will be required to enter an encryption key or a path to a file containing the encryption key. Be sure to make note of the key or the key file location, because this information is not kept anywhere in the migration store. You will need this information when you run the LoadState command to decrypt the migration store, or if you need to run the recovery utility. An incorrect or missing key or key file results in an error message. - -- For information about software requirements for running the **ScanState** command, see [USMT Requirements](usmt-requirements.md). - -- Unless otherwise noted, you can use each option only once when running a tool on the command line. - -- You can gather domain accounts without the source computer having domain controller access. This functionality is available without any additional configuration. - -- The [Incompatible Command-Line Options](#bkmk-iclo) table lists which options you can use together and which command-line options are incompatible. - -- The directory location where you save the migration store will be excluded from the scan. For example, if you save the migration store to the root of the D drive, the D drive and all of its subdirectories will be excluded from the scan. - -## Syntax - - -This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. - -The **ScanState** command's syntax is: - -scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\] - -For example: - -To create a Config.xml file in the current directory, use: - -`scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13` - -To create an encrypted store using the Config.xml file and the default migration .xml files, use: - -`scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:13 /encrypt /key:"mykey"` - -## Storage Options - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-Line OptionDescription

              StorePath

              Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.

              /apps

              Scans the image for apps and includes them and their associated registry settings.

              /ppkg [<FileName>]

              Exports to a specific file location.

              /o

              Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.

              /vsc

              This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.

              -

              This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.

              /hardlink

              Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.

              /encrypt [{/key:<KeyString> | /keyfile:<file>]}

              Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key in one of the following ways:

              -
                -
              • /key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.

              • -
              • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.

              • -
              -

              We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.

              -
              -Important

              You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.

              -
              -
              - -
              -

              The following example shows the ScanState command and the /key option:

              -

              scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey

              /encrypt:<EncryptionStrength>

              The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see Migration Store Encryption.

              /nocompress

              Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.

              -

              The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

              -

              For example:

              -

              scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress

              - - - -## Run the ScanState Command on an Offline Windows System - - -You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows. - -There are several benefits to running the **ScanState** command on an offline Windows image, including: - -- **Improved Performance.** - - Because WinPE is a thin operating system, there are fewer running services. In this environment, the **ScanState** command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. - -- **Simplified end to end deployment process.** - - Migrating data from Windows.old simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. - -- **Improved success of migration.** - - The migration success rate is increased because files will not be locked for editing while offline, and because WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. - -- **Ability to recover an unbootable computer.** - - It might be possible to recover and migrate data from an unbootable computer. - -## Offline Migration Options - - - ---- - - - - - - - - - - - - - - - - - - - - -
              Command-Line OptionDefinition

              /offline:"path to an offline.xml file"

              This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.

              /offlinewindir:"path to a Windows directory"

              This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.

              /offlinewinold:"Windows.old directory"

              This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

              - - - -## Migration Rule Options - - -USMT provides the following options to specify what files you want to migrate. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-Line OptionDescription

              /i:[Path]FileName

              (include)

              -

              Specifies an .xml file that contains rules that define what user, application or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the Frequently Asked Questions topic.

              /genconfig:[Path]FileName

              (Generate Config.xml)

              -

              Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.

              -

              After you create this file, you will need to make use of it with the ScanState command using the /config option.

              -

              The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

              -

              Examples:

              -
                -
              • The following example creates a Config.xml file in the current directory:

                -

                scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

              • -

              /config:[Path</em>]FileName

              Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

              -

              The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:

              -

              scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log

              -

              The following example migrates the files and settings to the destination computer using the Config.xml, MigDocs.xml, and MigApp.xml files:

              -

              loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log

              /auto:path to script files

              This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

              /genmigxml:path to a file

              This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.

              /targetwindows8

              Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command line option in the following scenarios:

              -
                -
              • To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.

              • -
              • To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.

              • -

              /targetwindows7

              Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command line option in the following scenarios:

              -
                -
              • To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.

              • -
              • To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.

              • -

              /localonly

              Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.

              -

              Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see Exclude Files and Settings.

              -

              The /localonly command-line option includes or excludes data in the migration as identified in the following table:

              - ---- - - - - - - - - - - - - - - - - - - - - -
              Drive typeBehavior with /localonly

              Removable drives such as a USB flash drive

              Excluded

              Network drives

              Excluded

              Fixed drives

              Included

              -

              - - - -## Monitoring Options - - -USMT provides several options that you can use to analyze problems that occur during migration. - -**Note** -The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-Line OptionDescription

              /listfiles:<FileName>

              You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.

              /l:[Path]FileName

              Specifies the location and name of the ScanState log.

              -

              You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.

              -

              If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:scan.log command.

              /v:<VerbosityLevel>

              (Verbosity)

              -

              Enables verbose output in the ScanState log file. The default value is 0.

              -

              You can set the VerbosityLevel to one of the following levels:

              - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              LevelExplanation

              0

              Only the default errors and warnings are enabled.

              1

              Enables verbose output.

              4

              Enables error and status output.

              5

              Enables verbose and status output.

              8

              Enables error output to a debugger.

              9

              Enables verbose output to a debugger.

              12

              Enables error and status output to a debugger.

              13

              Enables verbose, status, and debugger output.

              -

              -

              For example:

              -

              scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml

              -

              /progress:[Path</em>]FileName

              Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

              -

              For example:

              -

              scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log

              /c

              When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.

              -

              You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

              /r:<TimesToRetry>

              (Retry)

              -

              Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

              -

              While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

              /w:<SecondsBeforeRetry>

              (Wait)

              -

              Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

              /p:<pathToFile>

              When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:

              -

              Scanstate.exe C:\MigrationLocation [additional parameters]

              -

              /p:"C:\MigrationStoreSize.xml"

              -

              For more information, see Estimate Migration Store Size.

              -

              To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.

              /? or /help

              Displays Help at the command line.

              - - - -## User Options - - -By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-Line OptionDescription

              /all

              Migrates all of the users on the computer.

              -

              USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.

              /ui:<DomainName>\<UserName>

              -

              or

              -

              /ui:<ComputerName>\<LocalUserName>

              (User include)

              -

              Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

              -
              -Note

              If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

              -
              -
              - -
              -

              For example:

              -
                -

                To include only User2 from the Fabrikam domain, type:

                -

                /ue:*\* /ui:fabrikam\user2

                -

                To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:

                -

                /uel:30 /ui:fabrikam\*

                -

                In this example, a user account from the Contoso domain that was last modified 2 months ago will not be migrated.

                -
              -

              For more examples, see the descriptions of the /ue and /ui options in this table.

              /uel:<NumberOfDays>

              -

              or

              -

              /uel:<YYYY/MM/DD>

              -

              or

              -

              /uel:0

              (User exclude based on last logon)

              -

              Migrates the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

              -

              You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

              -
              -Note

              The /uel option is not valid in offline migrations.

              -
              -
              - -
              -
                -
              • /uel:0 migrates any users who are currently logged on.

              • -
              • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

              • -
              • /uel:1 migrates users whose account has been modified within the last 24 hours.

              • -
              • /uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.

              • -
              -

              For example:

              -

              scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

              /ue:<DomainName>\<UserName>

              -

              -or-

              -

              -

              /ue:<ComputerName>\<LocalUserName>

              (User exclude)

              -

              Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

              -

              For example:

              -

              scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1

              - - - -## How to Use /ui and /ue - - -The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              BehaviorCommand

              Exclude the user named User One in the Fabrikam domain.

              /ue:"fabrikam\user one"

              Exclude the user named User1 in the Fabrikam domain.

              /ue:fabrikam\user1

              Exclude the local user named User1.

              /ue:%computername%\user1

              Exclude all domain users.

              /ue:Domain\*

              Exclude all local users.

              /ue:%computername%\*

              Exclude users in all domains named User1, User2, and so on.

              /ue:*\user*

              - - - -## Using the Options Together - - -You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated. - -The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option. - -The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
              BehaviorCommand

              Include only User2 from the Fabrikam domain and exclude all other users.

              /ue:*\* /ui:fabrikam\user2

              Include only the local user named User1 and exclude all other users.

              /ue:*\* /ui:user1

              Include only the domain users from Contoso, except Contoso\User1.

              This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

              -
                -
              • On the ScanState command line, type: /ue:*\* /ui:contoso\*

              • -
              • On the LoadState command line, type: /ue:contoso\user1

              • -

              Include only local (non-domain) users.

              /ue:*\* /ui:%computername%\*

              - - - -## Encrypted File Options - - -You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior. - -For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). - -**Note** -EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files - - - -**Caution** -Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-Line OptionExplanation

              /efs:hardlink

              Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.

              /efs:abort

              Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.

              /efs:skip

              Causes the ScanState command to ignore EFS files.

              /efs:decryptcopy

              Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.

              /efs:copyraw

              Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.

              -

              For example:

              -

              ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw

              -
              -Important

              All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see Migrate EFS Files and Certificates.

              -
              -
              - -
              - - - -## Incompatible Command-Line Options - - -The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-Line Option/keyfile/nocompress/genconfig/all

              /i

              /o

              /v

              /nocompress

              X

              N/A

              /localonly

              X

              /key

              X

              X

              /encrypt

              Required*

              X

              X

              /keyfile

              N/A

              X

              /l

              /progress

              X

              /r

              X

              /w

              X

              /c

              X

              /p

              X

              N/A

              /all

              X

              /ui

              X

              X

              /ue

              X

              X

              /uel

              X

              X

              /efs:<option>

              X

              /genconfig

              N/A

              /config

              X

              <StorePath>

              X

              - - - -**Note** -You must specify either the /**key** or /**keyfile** option with the /**encrypt** option. - - - -## Related topics - - -[XML Elements Library](usmt-xml-elements-library.md) - - - - - - - - - +--- +title: ScanState Syntax (Windows 10) +description: The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. +ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# ScanState Syntax + + +The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. + +## In This Topic + + +[Before You Begin](#bkmk-beforeyoubegin) + +[Syntax](#bkmk-syntax) + +[Storage Options](#bkmk-storageoptions) + +[Migration Rule Options](#bkmk-migrationruleoptions) + +[Monitoring Options](#bkmk-monitoringoptions) + +[User Options](#bkmk-useroptions) + +[Encrypted File Options](#bkmk-efs) + +[Incompatible Command-Line Options](#bkmk-iclo) + +## Before You Begin + + +Before you run the **ScanState** command, note the following: + +- To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials. + +- If you encrypt the migration store, you will be required to enter an encryption key or a path to a file containing the encryption key. Be sure to make note of the key or the key file location, because this information is not kept anywhere in the migration store. You will need this information when you run the LoadState command to decrypt the migration store, or if you need to run the recovery utility. An incorrect or missing key or key file results in an error message. + +- For information about software requirements for running the **ScanState** command, see [USMT Requirements](usmt-requirements.md). + +- Unless otherwise noted, you can use each option only once when running a tool on the command line. + +- You can gather domain accounts without the source computer having domain controller access. This functionality is available without any additional configuration. + +- The [Incompatible Command-Line Options](#bkmk-iclo) table lists which options you can use together and which command-line options are incompatible. + +- The directory location where you save the migration store will be excluded from the scan. For example, if you save the migration store to the root of the D drive, the D drive and all of its subdirectories will be excluded from the scan. + +## Syntax + + +This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. + +The **ScanState** command's syntax is: + +> scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\] + +For example, to create a Config.xml file in the current directory, use: + +`scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13` + +To create an encrypted store using the Config.xml file and the default migration .xml files, use: + +`scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:13 /encrypt /key:"mykey"` + +## Storage Options + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-Line OptionDescription

              StorePath

              Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.

              /apps

              Scans the image for apps and includes them and their associated registry settings.

              /ppkg [<FileName>]

              Exports to a specific file location.

              /o

              Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.

              /vsc

              This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.

              +

              This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.

              /hardlink

              Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.

              /encrypt [{/key:<KeyString> | /keyfile:<file>]}

              Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key in one of the following ways:

              +
                +
              • /key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.

              • +
              • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.

              • +
              +

              We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.

              +
              +Important

              You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.

              +
              +
              + +
              +

              The following example shows the ScanState command and the /key option:

              +

              scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey

              /encrypt:<EncryptionStrength>

              The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see Migration Store Encryption.

              /nocompress

              Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.

              +

              The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

              +

              For example:

              +

              scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress

              + + + +## Run the ScanState Command on an Offline Windows System + + +You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows. + +There are several benefits to running the **ScanState** command on an offline Windows image, including: + +- **Improved Performance.** + + Because WinPE is a thin operating system, there are fewer running services. In this environment, the **ScanState** command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. + +- **Simplified end to end deployment process.** + + Migrating data from Windows.old simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. + +- **Improved success of migration.** + + The migration success rate is increased because files will not be locked for editing while offline, and because WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. + +- **Ability to recover an unbootable computer.** + + It might be possible to recover and migrate data from an unbootable computer. + +## Offline Migration Options + + + ++++ + + + + + + + + + + + + + + + + + + + + +
              Command-Line OptionDefinition

              /offline:"path to an offline.xml file"

              This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.

              /offlinewindir:"path to a Windows directory"

              This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.

              /offlinewinold:"Windows.old directory"

              This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

              + + + +## Migration Rule Options + + +USMT provides the following options to specify what files you want to migrate. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-Line OptionDescription

              /i:[Path]FileName

              (include)

              +

              Specifies an .xml file that contains rules that define what user, application or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the Frequently Asked Questions topic.

              /genconfig:[Path]FileName

              (Generate Config.xml)

              +

              Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.

              +

              After you create this file, you will need to make use of it with the ScanState command using the /config option.

              +

              The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

              +

              Examples:

              +
                +
              • The following example creates a Config.xml file in the current directory:

                +

                scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

              • +

              /config:[Path</em>]FileName

              Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

              +

              The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:

              +

              scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log

              +

              The following example migrates the files and settings to the destination computer using the Config.xml, MigDocs.xml, and MigApp.xml files:

              +

              loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log

              /auto:path to script files

              This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

              /genmigxml:path to a file

              This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.

              /targetwindows8

              Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command line option in the following scenarios:

              +
                +
              • To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.

              • +
              • To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.

              • +

              /targetwindows7

              Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command line option in the following scenarios:

              +
                +
              • To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.

              • +
              • To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.

              • +

              /localonly

              Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.

              +

              Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see Exclude Files and Settings.

              +

              The /localonly command-line option includes or excludes data in the migration as identified in the following table:

              + ++++ + + + + + + + + + + + + + + + + + + + + +
              Drive typeBehavior with /localonly

              Removable drives such as a USB flash drive

              Excluded

              Network drives

              Excluded

              Fixed drives

              Included

              +

              + + + +## Monitoring Options + + +USMT provides several options that you can use to analyze problems that occur during migration. + +> [!NOTE] +> The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option. + + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-Line OptionDescription

              /listfiles:<FileName>

              You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.

              /l:[Path]FileName

              Specifies the location and name of the ScanState log.

              +

              You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.

              +

              If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:scan.log command.

              /v:<VerbosityLevel>

              (Verbosity)

              +

              Enables verbose output in the ScanState log file. The default value is 0.

              +

              You can set the VerbosityLevel to one of the following levels:

              + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              LevelExplanation

              0

              Only the default errors and warnings are enabled.

              1

              Enables verbose output.

              4

              Enables error and status output.

              5

              Enables verbose and status output.

              8

              Enables error output to a debugger.

              9

              Enables verbose output to a debugger.

              12

              Enables error and status output to a debugger.

              13

              Enables verbose, status, and debugger output.

              +

              +

              For example:

              +

              scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml

              +

              /progress:[Path</em>]FileName

              Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

              +

              For example:

              +

              scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log

              /c

              When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.

              +

              You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

              /r:<TimesToRetry>

              (Retry)

              +

              Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

              +

              While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

              /w:<SecondsBeforeRetry>

              (Wait)

              +

              Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

              /p:<pathToFile>

              When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:

              +

              Scanstate.exe C:\MigrationLocation [additional parameters]

              +

              /p:"C:\MigrationStoreSize.xml"

              +

              For more information, see Estimate Migration Store Size.

              +

              To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.

              /? or /help

              Displays Help at the command line.

              + + + +## User Options + + +By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md). + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-Line OptionDescription

              /all

              Migrates all of the users on the computer.

              +

              USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.

              /ui:<DomainName>\<UserName>

              +

              or

              +

              /ui:<ComputerName>\<LocalUserName>

              (User include)

              +

              Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

              +
              +Note

              If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

              +
              +
              + +
              +

              For example:

              +
                +

                To include only User2 from the Fabrikam domain, type:

                +

                /ue:*\* /ui:fabrikam\user2

                +

                To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:

                +

                /uel:30 /ui:fabrikam\*

                +

                In this example, a user account from the Contoso domain that was last modified 2 months ago will not be migrated.

                +
              +

              For more examples, see the descriptions of the /ue and /ui options in this table.

              /uel:<NumberOfDays>

              +

              or

              +

              /uel:<YYYY/MM/DD>

              +

              or

              +

              /uel:0

              (User exclude based on last logon)

              +

              Migrates the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

              +

              You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

              +
              +Note

              The /uel option is not valid in offline migrations.

              +
              +
              + +
              +
                +
              • /uel:0 migrates any users who are currently logged on.

              • +
              • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

              • +
              • /uel:1 migrates users whose account has been modified within the last 24 hours.

              • +
              • /uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.

              • +
              +

              For example:

              +

              scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

              /ue:<DomainName>\<UserName>

              +

              -or-

              +

              +

              /ue:<ComputerName>\<LocalUserName>

              (User exclude)

              +

              Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

              +

              For example:

              +

              scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1

              + + + +## How to Use /ui and /ue + + +The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              BehaviorCommand

              Exclude the user named User One in the Fabrikam domain.

              /ue:"fabrikam\user one"

              Exclude the user named User1 in the Fabrikam domain.

              /ue:fabrikam\user1

              Exclude the local user named User1.

              /ue:%computername%\user1

              Exclude all domain users.

              /ue:Domain\*

              Exclude all local users.

              /ue:%computername%\*

              Exclude users in all domains named User1, User2, and so on.

              /ue:*\user*

              + + + +## Using the Options Together + + +You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated. + +The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option. + +The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
              BehaviorCommand

              Include only User2 from the Fabrikam domain and exclude all other users.

              /ue:*\* /ui:fabrikam\user2

              Include only the local user named User1 and exclude all other users.

              /ue:*\* /ui:user1

              Include only the domain users from Contoso, except Contoso\User1.

              This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

              +
                +
              • On the ScanState command line, type: /ue:*\* /ui:contoso\*

              • +
              • On the LoadState command line, type: /ue:contoso\user1

              • +

              Include only local (non-domain) users.

              /ue:*\* /ui:%computername%\*

              + + + +## Encrypted File Options + + +You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior. + +For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). + +> [!NOTE] +> EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files + + +> [!CAUTION] +> Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. + + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-Line OptionExplanation

              /efs:hardlink

              Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.

              /efs:abort

              Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.

              /efs:skip

              Causes the ScanState command to ignore EFS files.

              /efs:decryptcopy

              Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.

              /efs:copyraw

              Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.

              +

              For example:

              +

              ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw

              +
              +Important

              All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see Migrate EFS Files and Certificates.

              +
              +
              + +
              + + + +## Incompatible Command-Line Options + + +The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-Line Option/keyfile/nocompress/genconfig/all

              /i

              /o

              /v

              /nocompress

              N/A

              /localonly

              X

              /key

              X

              X

              /encrypt

              Required*

              X

              X

              /keyfile

              N/A

              X

              /l

              /progress

              X

              /r

              X

              /w

              X

              /c

              X

              /p

              X

              N/A

              /all

              X

              /ui

              X

              X

              /ue

              X

              X

              /uel

              X

              X

              /efs:<option>

              X

              /genconfig

              N/A

              /config

              X

              <StorePath>

              X

              + + +> [!NOTE] +> You must specify either the /**key** or /**keyfile** option with the /**encrypt** option. + + + +## Related topics + + +[XML Elements Library](usmt-xml-elements-library.md) + diff --git a/windows/deployment/usmt/usmt-technical-reference.md b/windows/deployment/usmt/usmt-technical-reference.md index 1ee21e76d4..3c31b7bf4b 100644 --- a/windows/deployment/usmt/usmt-technical-reference.md +++ b/windows/deployment/usmt/usmt-technical-reference.md @@ -1,59 +1,61 @@ ---- -title: User State Migration Tool (USMT) Technical Reference (Windows 10) -description: The User State Migration Tool (USMT) is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. -ms.assetid: f90bf58b-5529-4520-a9f8-b6cb4e4d3add -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Technical Reference -The User State Migration Tool (USMT) is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. - -Download the Windows ADK [from this website](https://go.microsoft.com/fwlink/p/?LinkID=526803). - -**USMT support for Microsoft Office** ->USMT in the Windows ADK for Windows 10, version 1511 (10.1.10586.0) supports migration of user settings for installations of Microsoft Office 2003, 2007, 2010, and 2013.
              ->USMT in the Windows ADK for Windows 10, version 1607 (10.1.14393.0) adds support for migration of user settings for installations of Microsoft Office 2016. - -USMT includes three command-line tools: - -- ScanState.exe
              -- LoadState.exe
              -- UsmtUtils.exe - -USMT also includes a set of three modifiable .xml files: - -- MigApp.xml
              -- MigDocs.xml
              -- MigUser.xml - -Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. - -USMT tools can be used on several versions of Windows operating systems, for more information, see [USMT Requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564). - -## In This Section -|Topic |Description| -|------|-----------| -|[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)|Describes what’s new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.| -|[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)|Includes step-by-step instructions for using USMT, as well as how-to topics for conducting tasks in USMT.| -|[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md)|Provides answers to frequently asked questions and common issues in USMT, as well as a reference for return codes used in USMT.| -|[User State Migration Toolkit (USMT) Reference](usmt-reference.md)|Includes reference information for migration planning, migration best practices, command-line syntax, using XML, and requirements for using USMT.| - -## Related topics -- [Windows Assessment and Deployment Kit](https://msdn.microsoft.com/library/windows/hardware/dn247001.aspx) - -  - -  - - - - - +--- +title: User State Migration Tool (USMT) Technical Reference (Windows 10) +description: The User State Migration Tool (USMT) provides a highly customizable user-profile migration experience for IT professionals. +ms.assetid: f90bf58b-5529-4520-a9f8-b6cb4e4d3add +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# User State Migration Tool (USMT) Technical Reference +The User State Migration Tool (USMT) is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. + +Download the Windows ADK [from this website](https://go.microsoft.com/fwlink/p/?LinkID=526803). + +**USMT support for Microsoft Office** +>USMT in the Windows ADK for Windows 10, version 1511 (10.1.10586.0) supports migration of user settings for installations of Microsoft Office 2003, 2007, 2010, and 2013.
              +>USMT in the Windows ADK for Windows 10, version 1607 (10.1.14393.0) adds support for migration of user settings for installations of Microsoft Office 2016. + +USMT includes three command-line tools: + +- ScanState.exe
              +- LoadState.exe
              +- UsmtUtils.exe + +USMT also includes a set of three modifiable .xml files: + +- MigApp.xml
              +- MigDocs.xml
              +- MigUser.xml + +Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. + +USMT tools can be used on several versions of Windows operating systems, for more information, see [USMT Requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User's Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564). + +## In this section +|Topic |Description| +|------|-----------| +|[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)|Describes what's new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.| +|[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)|Includes step-by-step instructions for using USMT, as well as how-to topics for conducting tasks in USMT.| +|[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md)|Provides answers to frequently asked questions and common issues in USMT, as well as a reference for return codes used in USMT.| +|[User State Migration Toolkit (USMT) Reference](usmt-reference.md)|Includes reference information for migration planning, migration best practices, command-line syntax, using XML, and requirements for using USMT.| + +## Related topics +- [Windows Assessment and Deployment Kit](https://msdn.microsoft.com/library/windows/hardware/dn247001.aspx) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md index 7c4185278b..b3ec645a60 100644 --- a/windows/deployment/usmt/usmt-test-your-migration.md +++ b/windows/deployment/usmt/usmt-test-your-migration.md @@ -1,53 +1,45 @@ ---- -title: Test Your Migration (Windows 10) -description: Test Your Migration -ms.assetid: 754af276-8386-4eac-8079-3d1e45964a0d -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Test Your Migration - - -Always test your migration plan in a controlled laboratory setting before you deploy it to your entire organization. In your test environment, you need at least one computer for each type of operating system from which you are migrating data. - -After you have thoroughly tested the entire migration process on a single computer running each of your source operating systems, conduct a pilot migration with a small group of users. After migrating a few typical user states to the intermediate store, note the space required and adjust your initial calculations accordingly. For details about estimating the space needed for your migration, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). You might also need to adjust the registry-setting and file-location information in your migration-rule files. If you make changes, test the migration again. Then verify that all data and settings have migrated as expected. A pilot migration also gives you an opportunity to test your space estimates for the intermediate store. - -If your test migration encounters any errors, examine the ScanState and LoadState logs to obtain the exact User State Migration Tool (USMT) 10.0 return code and associated error messages or Windows application programming interface (API) error message. For more information about USMT return codes and error messages, see [Return Codes](usmt-return-codes.md). You can also obtain more information about a Windows API error message by typing **net helpmsg** and the error message number on the command line. - -In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v**:5 option when testing your migration. This verbosity level can be adjusted in a production migration. Reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a higher verbosity level if you want the log files output to go to a debugger. - -**Note**   -Running the ScanState and LoadState tools with the **/v**:5 option creates a detailed log file. Although this option makes the log file large, it is helpful in determining where migration errors occurred. - - - -After you have determined that the pilot migration successfully migrated the specified files and settings, you are ready to add USMT to the server that is running Microsoft® System Center Configuration Manager (SCCM), or a non-Microsoft management technology. For more information, see [Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=140246). - -**Note**   -For testing purposes, you can create an uncompressed store using the **/hardlink /nocompress** option. When compression is disabled, the ScanState tool saves the files and settings to a hidden folder named "File" at *StorePath*\\USMT. You can use the uncompressed store to view what USMT has stored or to troubleshoot a problem, or you can run an antivirus utility against the files. Additionally, you can also use the **/listfiles** command-line option and the diagnostic log to list the files that were gathered and to troubleshoot problems with your migration. - - - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - -[Log Files](usmt-log-files.md) - - - - - - - - - +--- +title: Test Your Migration (Windows 10) +description: Learn about testing your migration plan in a controlled laboratory setting before you deploy it to your entire organization. +ms.assetid: 754af276-8386-4eac-8079-3d1e45964a0d +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Test Your Migration + + +Always test your migration plan in a controlled laboratory setting before you deploy it to your entire organization. In your test environment, you need at least one computer for each type of operating system from which you are migrating data. + +After you have thoroughly tested the entire migration process on a single computer running each of your source operating systems, conduct a pilot migration with a small group of users. After migrating a few typical user states to the intermediate store, note the space required and adjust your initial calculations accordingly. For details about estimating the space needed for your migration, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). You might also need to adjust the registry-setting and file-location information in your migration-rule files. If you make changes, test the migration again. Then verify that all data and settings have migrated as expected. A pilot migration also gives you an opportunity to test your space estimates for the intermediate store. + +If your test migration encounters any errors, examine the ScanState and LoadState logs to obtain the exact User State Migration Tool (USMT) 10.0 return code and associated error messages or Windows application programming interface (API) error message. For more information about USMT return codes and error messages, see [Return Codes](usmt-return-codes.md). You can also obtain more information about a Windows API error message by typing **net helpmsg** and the error message number on the command line. + +In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v**:5 option when testing your migration. This verbosity level can be adjusted in a production migration. Reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a higher verbosity level if you want the log files output to go to a debugger. + +**Note**   +Running the ScanState and LoadState tools with the **/v**:5 option creates a detailed log file. Although this option makes the log file large, it is helpful in determining where migration errors occurred. + + + +After you have determined that the pilot migration successfully migrated the specified files and settings, you are ready to add USMT to the server that is running Microsoft Endpoint Configuration Manager, or a non-Microsoft management technology. For more information, see [Manage user state in Configuration Manager](https://docs.microsoft.com/configmgr/osd/get-started/manage-user-state). + +**Note**   +For testing purposes, you can create an uncompressed store using the **/hardlink /nocompress** option. When compression is disabled, the ScanState tool saves the files and settings to a hidden folder named "File" at *StorePath*\\USMT. You can use the uncompressed store to view what USMT has stored or to troubleshoot a problem, or you can run an antivirus utility against the files. Additionally, you can also use the **/listfiles** command-line option and the diagnostic log to list the files that were gathered and to troubleshoot problems with your migration. + + + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + +[Log Files](usmt-log-files.md) diff --git a/windows/deployment/usmt/usmt-topics.md b/windows/deployment/usmt/usmt-topics.md index 69321a476c..2e73d33887 100644 --- a/windows/deployment/usmt/usmt-topics.md +++ b/windows/deployment/usmt/usmt-topics.md @@ -1,30 +1,31 @@ ---- -title: User State Migration Tool (USMT) Overview Topics (Windows 10) -description: User State Migration Tool (USMT) Overview Topics -ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Overview Topics -The User State Migration Tool (USMT) 10.0 provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: ScanState.exe, LoadState.exe, and UsmtUtils.exe. USMT also includes a set of three modifiable .xml files: MigApp.xml, MigDocs.xml, and MigUser.xml. Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. - -## In This Section - -|Topic |Description| -|------|-----------| -|[User State Migration Tool (USMT) Overview](usmt-overview.md)|Describes the benefits and limitations of using USMT.| -|[Getting Started with the User State Migration Tool (USMT)](getting-started-with-the-user-state-migration-tool.md)|Describes the general process to follow to migrate files and settings, and provides links to more information.| -|[Windows Upgrade and Migration Considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft® tools you can use to move files and settings between installations, as well as special considerations for performing an upgrade or migration.| - -## Related topics -- [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) -- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) +--- +title: User State Migration Tool (USMT) Overview Topics (Windows 10) +description: Learn about User State Migration Tool (USMT) overview topics that describe USMT as a highly customizable user-profile migration experience for IT professionals. +ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Overview Topics +The User State Migration Tool (USMT) 10.0 provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: ScanState.exe, LoadState.exe, and UsmtUtils.exe. USMT also includes a set of three modifiable .xml files: MigApp.xml, MigDocs.xml, and MigUser.xml. Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. + +## In This Section + +|Topic |Description| +|------|-----------| +|[User State Migration Tool (USMT) Overview](usmt-overview.md)|Describes the benefits and limitations of using USMT.| +|[Getting Started with the User State Migration Tool (USMT)](getting-started-with-the-user-state-migration-tool.md)|Describes the general process to follow to migrate files and settings, and provides links to more information.| +|[Windows Upgrade and Migration Considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft® tools you can use to move files and settings between installations, as well as special considerations for performing an upgrade or migration.| + +## Related topics +- [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) +- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) +- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md index 085f3892d2..1c629df5ec 100644 --- a/windows/deployment/usmt/usmt-troubleshooting.md +++ b/windows/deployment/usmt/usmt-troubleshooting.md @@ -1,73 +1,74 @@ ---- -title: User State Migration Tool (USMT) Troubleshooting (Windows 10) -description: User State Migration Tool (USMT) Troubleshooting -ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Troubleshooting - - -The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - -

              Common Issues

              Find troubleshooting solutions for common problems in USMT.

              Frequently Asked Questions

              Find answers to questions about how to use USMT.

              Log Files

              Learn how to enable logging to help you troubleshoot issues in USMT.

              Return Codes

              Learn how to use return codes to identify problems in USMT.

              USMT Resources

              Find more information and support for using USMT.

              - - - -## Related topics - - -[USMT Best Practices](usmt-best-practices.md) - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - -[User State Migration Toolkit (USMT) Reference](usmt-reference.md) - - - - - - - - - +--- +title: User State Migration Tool (USMT) Troubleshooting (Windows 10) +description: Learn about topics that address common User State Migration Tool (USMT) 10.0 issues and questions to assist in troubleshooting. +ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Troubleshooting + + +The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

              Common Issues

              Find troubleshooting solutions for common problems in USMT.

              Frequently Asked Questions

              Find answers to questions about how to use USMT.

              Log Files

              Learn how to enable logging to help you troubleshoot issues in USMT.

              Return Codes

              Learn how to use return codes to identify problems in USMT.

              USMT Resources

              Find more information and support for using USMT.

              + + + +## Related topics + + +[USMT Best Practices](usmt-best-practices.md) + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + +[User State Migration Toolkit (USMT) Reference](usmt-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md index 4e9269a29d..d87666c8b6 100644 --- a/windows/deployment/usmt/usmt-utilities.md +++ b/windows/deployment/usmt/usmt-utilities.md @@ -1,351 +1,352 @@ ---- -title: UsmtUtils Syntax (Windows 10) -description: UsmtUtils Syntax -ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# UsmtUtils Syntax - - -This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: - -- Improve your ability to determine cryptographic options for your migration. - -- Assist in removing hard-link stores that cannot otherwise be deleted due to a sharing lock. - -- Verify whether the catalog file or any of the other files in the compressed migration store have become corrupted. - -- Extract files from the compressed migration store when you migrate files and settings to the destination computer. - -## In This Topic - - -[Usmtutils.exe](#bkmk-usmtutils-exe) - -[Verify Options](#bkmk-verifyoptions) - -[Extract Options](#bkmk-extractoptions) - -## Usmtutils.exe - - -The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options. - -The syntax for UsmtUtils.exe is: - -usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-line OptionDescription

              /ec

              Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.

              /rd<storeDir>

              Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

              -

              For example:

              -

              usmtutils /rd D:\MyHardLinkStore

              /y

              Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.

              /verify

              Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

              -

              See Verify Options for syntax and options to use with /verify.

              /extract

              Recovers files from a compressed USMT migration store.

              -

              See Extract Options for syntax and options to use with /extract.

              - - - -## Verify Options - - -Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). - -The syntax for **/verify** is: - -usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-line OptionDescription

              <reportType>

              Specifies whether to report on all files, corrupted files only, or the status of the catalog.

              -
                -
              • Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.

              • -
              • all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.

              • -
              • failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.

              • -
              • Catalog. Returns only the status of the catalog file.

              • -
              /l: -

              <logfilePath>

              Specifies the location and name of the log file.

              /v:<VerbosityLevel>

              (Verbosity)

              -

              Enables verbose output in the UsmtUtils log file. The default value is 0.

              -

              You can set the VerbosityLevel to one of the following levels:

              - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              LevelExplanation

              0

              Only the default errors and warnings are enabled.

              1

              Enables verbose output.

              4

              Enables error and status output.

              5

              Enables verbose and status output.

              8

              Enables error output to a debugger.

              9

              Enables verbose output to a debugger.

              12

              Enables error and status output to a debugger.

              13

              Enables verbose, status, and debugger output.

              -

               

              /decrypt<AlgID>/:<KeyString>

              -

              or

              -

              /decrypt<AlgID>/:<“Key String”>

              -

              or

              -

              /decrypt:<AlgID>/keyfile:<FileName>

              Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:

              -
                -
              • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                -

                <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

              • -
              • /key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

              • -
              • /keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.

              • -
              -

              For more information about supported encryption algorithms, see Migration Store Encryption

              - - - -Some examples of **/verify** commands: - -- `usmtutils /verify D:\MyMigrationStore\store.mig` - -- `usmtutils /verify:catalog D:\MyMigrationStore\store.mig` - -- `usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` - -- `usmtutils /verify:failureonly D:\MyMigrationStore\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt` - -## Extract Options - - -Use the **/extract** option to recover files from a compressed USMT migration store if it will not restore normally with loadstate. For more information on how to use the **/extract** option, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -The syntax for **/extract** is: - -/extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Command-line OptionDescription

              <filePath>

              Path to the USMT migration store.

              -

              For example:

              -

              D:\MyMigrationStore\USMT\store.mig

              <destinationPath>

              Path to the folder where the tool puts the individual files.

              /i:<includePattern>

              Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

              /e:<excludePattern>

              Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

              /l:<logfilePath>

              Specifies the location and name of the log file.

              /v:<VerbosityLevel>

              (Verbosity)

              -

              Enables verbose output in the UsmtUtils log file. The default value is 0.

              -

              You can set the VerbosityLevel to one of the following levels:

              - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              LevelExplanation

              0

              Only the default errors and warnings are enabled.

              1

              Enables verbose output.

              4

              Enables error and status output.

              5

              Enables verbose and status output.

              8

              Enables error output to a debugger.

              9

              Enables verbose output to a debugger.

              12

              Enables error and status output to a debugger.

              13

              Enables verbose, status, and debugger output.

              -

               

              /decrypt<AlgID>/key:<KeyString>

              -

              or

              -

              /decrypt<AlgID>/:<“Key String”>

              -

              or

              -

              /decrypt:<AlgID>/keyfile:<FileName>

              Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:

              -
                -
              • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                -

                <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

              • -
              • /key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

              • -
              • /keyfile:<FileName> specifies a text (.txt) file that contains the encryption key

              • -
              -

              For more information about supported encryption algorithms, see Migration Store Encryption.

              /o

              Overwrites existing output files.

              - - - -Some examples of **/extract** commands: - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt, *.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtlog.txt` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o` - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - -[Return Codes](usmt-return-codes.md) - - - - - - - - - +--- +title: UsmtUtils Syntax (Windows 10) +description: Learn about the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. +ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# UsmtUtils Syntax + + +This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: + +- Improve your ability to determine cryptographic options for your migration. + +- Assist in removing hard-link stores that cannot otherwise be deleted due to a sharing lock. + +- Verify whether the catalog file or any of the other files in the compressed migration store have become corrupted. + +- Extract files from the compressed migration store when you migrate files and settings to the destination computer. + +## In This Topic + + +[Usmtutils.exe](#bkmk-usmtutils-exe) + +[Verify Options](#bkmk-verifyoptions) + +[Extract Options](#bkmk-extractoptions) + +## Usmtutils.exe + + +The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options. + +The syntax for UsmtUtils.exe is: + +usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-line OptionDescription

              /ec

              Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.

              /rd<storeDir>

              Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

              +

              For example:

              +

              usmtutils /rd D:\MyHardLinkStore

              /y

              Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.

              /verify

              Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

              +

              See Verify Options for syntax and options to use with /verify.

              /extract

              Recovers files from a compressed USMT migration store.

              +

              See Extract Options for syntax and options to use with /extract.

              + + + +## Verify Options + + +Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). + +The syntax for **/verify** is: + +usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-line OptionDescription

              <reportType>

              Specifies whether to report on all files, corrupted files only, or the status of the catalog.

              +
                +
              • Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.

              • +
              • all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.

              • +
              • failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.

              • +
              • Catalog. Returns only the status of the catalog file.

              • +
              /l: +

              <logfilePath>

              Specifies the location and name of the log file.

              /v:<VerbosityLevel>

              (Verbosity)

              +

              Enables verbose output in the UsmtUtils log file. The default value is 0.

              +

              You can set the VerbosityLevel to one of the following levels:

              + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              LevelExplanation

              0

              Only the default errors and warnings are enabled.

              1

              Enables verbose output.

              4

              Enables error and status output.

              5

              Enables verbose and status output.

              8

              Enables error output to a debugger.

              9

              Enables verbose output to a debugger.

              12

              Enables error and status output to a debugger.

              13

              Enables verbose, status, and debugger output.

              +

               

              /decrypt<AlgID>/:<KeyString>

              +

              or

              +

              /decrypt<AlgID>/:<“Key String”>

              +

              or

              +

              /decrypt:<AlgID>/keyfile:<FileName>

              Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:

              +
                +
              • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                +

                <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

              • +
              • /key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

              • +
              • /keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.

              • +
              +

              For more information about supported encryption algorithms, see Migration Store Encryption

              + + + +Some examples of **/verify** commands: + +- `usmtutils /verify D:\MyMigrationStore\store.mig` + +- `usmtutils /verify:catalog D:\MyMigrationStore\store.mig` + +- `usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` + +- `usmtutils /verify:failureonly D:\MyMigrationStore\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt` + +## Extract Options + + +Use the **/extract** option to recover files from a compressed USMT migration store if it will not restore normally with loadstate. For more information on how to use the **/extract** option, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +The syntax for **/extract** is: + +/extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Command-line OptionDescription

              <filePath>

              Path to the USMT migration store.

              +

              For example:

              +

              D:\MyMigrationStore\USMT\store.mig

              <destinationPath>

              Path to the folder where the tool puts the individual files.

              /i:<includePattern>

              Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

              /e:<excludePattern>

              Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

              /l:<logfilePath>

              Specifies the location and name of the log file.

              /v:<VerbosityLevel>

              (Verbosity)

              +

              Enables verbose output in the UsmtUtils log file. The default value is 0.

              +

              You can set the VerbosityLevel to one of the following levels:

              + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              LevelExplanation

              0

              Only the default errors and warnings are enabled.

              1

              Enables verbose output.

              4

              Enables error and status output.

              5

              Enables verbose and status output.

              8

              Enables error output to a debugger.

              9

              Enables verbose output to a debugger.

              12

              Enables error and status output to a debugger.

              13

              Enables verbose, status, and debugger output.

              +

               

              /decrypt<AlgID>/key:<KeyString>

              +

              or

              +

              /decrypt<AlgID>/:<“Key String”>

              +

              or

              +

              /decrypt:<AlgID>/keyfile:<FileName>

              Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:

              +
                +
              • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                +

                <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

              • +
              • /key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

              • +
              • /keyfile:<FileName> specifies a text (.txt) file that contains the encryption key

              • +
              +

              For more information about supported encryption algorithms, see Migration Store Encryption.

              /o

              Overwrites existing output files.

              + + + +Some examples of **/extract** commands: + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt, *.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtlog.txt` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o` + +## Related topics + + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + +[Return Codes](usmt-return-codes.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index 4fc36c33bc..2152530861 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -1,429 +1,430 @@ ---- -title: What does USMT migrate (Windows 10) -description: What does USMT migrate -ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 09/12/2017 -ms.topic: article ---- - -# What does USMT migrate? - - -## In this topic - - -- [Default migration scripts](#bkmk-defaultmigscripts) - -- [User Data](#bkmk-3) - -- [Operating-system components](#bkmk-4) - -- [Supported applications](#bkmk-2) - -- [What USMT does not migrate](#no) - -## Default migration scripts - - -The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: - -- **MigApp.XML.** Rules to migrate application settings. - -- **MigDocs.XML.** Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration .xml files. - -- **MigUser.XML.** Rules to migrate user profiles and user data. - - MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. - - The following data does not migrate with MigUser.xml: - - - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. - - - Access control lists (ACLs) for folders outside the user profile. - -## User data - - -This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs. - -- **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following: - - My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. - - >[!IMPORTANT] - >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). - -- **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8: - - - Shared Documents - - - Shared Video - - - Shared Music - - - Shared desktop files - - - Shared Pictures - - - Shared Start menu - - - Shared Favorites - -- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions: - - **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** - - **Note**   - The asterisk (\*) stands for zero or more characters. - - - -- **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration. - -**Important**   -To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. - - - -## Operating-system components - - -USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 - -The following components are migrated by default using the manifest files: - -- Accessibility settings - -- Address book - -- Command-prompt settings - -- \*Desktop wallpaper - -- EFS files - -- Favorites - -- Folder options - -- Fonts - -- Group membership. USMT migrates users’ group settings. The groups to which a user belongs can be found by right-clicking **My Computer** on the Start menu and then clicking **Manage**. When running an offline migration, the use of a **<ProfileControl>** section in the Config.xml file is required. - -- \*Windows Internet Explorer® settings - -- Microsoft® Open Database Connectivity (ODBC) settings - -- Mouse and keyboard settings - -- Network drive mapping - -- \*Network printer mapping - -- \*Offline files - -- \*Phone and modem options - -- RAS connection and phone book (.pbk) files - -- \*Regional settings - -- Remote Access - -- \*Taskbar settings - -- User personal certificates (all) - -- Windows Mail. - -- \*Windows Media Player - -- Windows Rights Management - -\* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md). - -**Important**   -This list may not be complete. There may be additional components that are migrated. - - - -**Note**   -Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. - - - -## Supported applications - - -Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers. - -**Note**   -The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. - - - -**Note**   -USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. - - - -When you specify the MigApp.xml file, USMT migrates the settings for the following applications: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              ProductVersion

              Adobe Acrobat Reader

              9

              AOL Instant Messenger

              6.8

              Adobe Creative Suite

              2

              Adobe Photoshop CS

              8, 9

              Adobe ImageReady CS

              Apple iTunes

              6, 7, 8

              Apple QuickTime Player

              5, 6, 7

              Apple Safari

              3.1.2

              Google Chrome

              beta

              Google Picasa

              3

              Google Talk

              beta

              IBM Lotus 1-2-3

              9

              IBM Lotus Notes

              6,7, 8

              IBM Lotus Organizer

              5

              IBM Lotus WordPro

              9.9

              Intuit Quicken Deluxe

              2009

              Money Plus Business

              2008

              Money Plus Home

              2008

              Mozilla Firefox

              3

              Microsoft Office

              2003, 2007, 2010

              Microsoft Office Access®

              2003, 2007, 2010

              Microsoft Office Excel®

              2003, 2007, 2010

              Microsoft Office FrontPage®

              2003, 2007, 2010

              Microsoft Office OneNote®

              2003, 2007, 2010

              Microsoft Office Outlook®

              2003, 2007, 2010

              Microsoft Office PowerPoint®

              2003, 2007, 2010

              Microsoft Office Publisher

              2003, 2007, 2010

              Microsoft Office Word

              2003, 2007, 2010

              Opera Software Opera

              9.5

              Microsoft Outlook Express

              (only mailbox file)

              Microsoft Project

              2003, 2007

              Microsoft Office Visio®

              2003, 2007

              RealPlayer Basic

              11

              Sage Peachtree

              2009

              Skype

              3.8

              Windows Live Mail

              12, 14

              Windows Live Messenger

              8.5, 14

              Windows Live MovieMaker

              14

              Windows Live Photo Gallery

              12, 14

              Windows Live Writer

              12, 14

              Windows Mail

              (Windows 7 and 8)

              Microsoft Works

              9

              Yahoo Messenger

              9

              Microsoft Zune™ Software

              3

              - - - -## What USMT does not migrate - - -The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md). - -### Application settings - -USMT does not migrate the following application settings: - -- Settings from earlier versions of an application. The versions of each application must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. USMT can migrate from an earlier version of Microsoft Office to a later version. - -- Application settings and some operating-system settings when a local account is created. For example, if you run /lac to create a local account on the destination computer, USMT will migrate the user data, but only some of the operating-system settings, such as wallpaper and screensaver settings, and no application settings will migrate. - -- Microsoft Project settings, when migrating from Office 2003 to Office 2007 system. - -- ICQ Pro settings, if ICQ Pro is installed in a different location on the destination computer. To successfully migrate the settings of ICQ Pro, you must install ICQ Pro in the same location on the destination computer as it was on the source computer. Otherwise, after you run the LoadState tool, the application will not start. You may encounter problems when: - - - You change the default installation location on 32-bit destination computers. - - - You attempt to migrate from a 32-bit computer to a 64-bit computer. This is because the ICQ Pro default installation directory is different on the two types of computers. When you install ICQ Pro on a 32-bit computer, the default location is "C:\\Program Files\\...". The ICQ Pro default installation directory on an x64-based computer, however, is “C:\\Program Files (x86)\\...”. - -### Operating-System settings - -USMT does not migrate the following operating-system settings. - -- Local printers, hardware-related settings, drivers, passwords, application binary files, synchronization files, DLL files, or other executable files. - -- Permissions for shared folders. After migration, you must manually re-share any folders that were shared on the source computer. - -- Files and settings migrating between operating systems with different languages. The operating system of the source computer must match the language of the operating system on the destination computer. - -- Customized icons for shortcuts may not migrate. - -- Taskbar settings, when the source computer is running Windows XP. - -You should also note the following: - -- You should run USMT from an account with administrative credentials. Otherwise, some data will not migrate. When running the ScanState and LoadState tools you must run the tools in Administrator mode from an account with administrative credentials. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. In addition, you must run the ScanState tool on Windows XP from an account with administrative credentials. Otherwise, some operating-system settings will not migrate. To run in Administrator mode, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. - -- You can use the /**localonly** option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify /**localonly**, see [ScanState Syntax](usmt-scanstate-syntax.md). - -### Start menu layout - -Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). - -## Related topics - - -[Plan your migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: What does USMT migrate (Windows 10) +description: Learn how User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. +ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 09/12/2017 +ms.topic: article +--- + +# What does USMT migrate? + + +## In this topic + + +- [Default migration scripts](#bkmk-defaultmigscripts) + +- [User Data](#bkmk-3) + +- [Operating-system components](#bkmk-4) + +- [Supported applications](#bkmk-2) + +- [What USMT does not migrate](#no) + +## Default migration scripts + + +The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: + +- **MigApp.XML.** Rules to migrate application settings. + +- **MigDocs.XML.** Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration .xml files. + +- **MigUser.XML.** Rules to migrate user profiles and user data. + + MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. + + The following data does not migrate with MigUser.xml: + + - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. + + - Access control lists (ACLs) for folders outside the user profile. + +## User data + + +This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs. + +- **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following: + + My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. + + >[!IMPORTANT] + >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). + +- **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8: + + - Shared Documents + + - Shared Video + + - Shared Music + + - Shared desktop files + + - Shared Pictures + + - Shared Start menu + + - Shared Favorites + +- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions: + + **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** + + **Note**   + The asterisk (\*) stands for zero or more characters. + + + +- **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration. + +**Important**   +To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. + + + +## Operating-system components + + +USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 + +The following components are migrated by default using the manifest files: + +- Accessibility settings + +- Address book + +- Command-prompt settings + +- \*Desktop wallpaper + +- EFS files + +- Favorites + +- Folder options + +- Fonts + +- Group membership. USMT migrates users’ group settings. The groups to which a user belongs can be found by right-clicking **My Computer** on the Start menu and then clicking **Manage**. When running an offline migration, the use of a **<ProfileControl>** section in the Config.xml file is required. + +- \*Windows Internet Explorer® settings + +- Microsoft® Open Database Connectivity (ODBC) settings + +- Mouse and keyboard settings + +- Network drive mapping + +- \*Network printer mapping + +- \*Offline files + +- \*Phone and modem options + +- RAS connection and phone book (.pbk) files + +- \*Regional settings + +- Remote Access + +- \*Taskbar settings + +- User personal certificates (all) + +- Windows Mail. + +- \*Windows Media Player + +- Windows Rights Management + +\* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md). + +**Important**   +This list may not be complete. There may be additional components that are migrated. + + + +**Note**   +Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. + + + +## Supported applications + + +Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers. + +**Note**   +The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. + + + +**Note**   +USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. + + + +When you specify the MigApp.xml file, USMT migrates the settings for the following applications: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              ProductVersion

              Adobe Acrobat Reader

              9

              AOL Instant Messenger

              6.8

              Adobe Creative Suite

              2

              Adobe Photoshop CS

              8, 9

              Adobe ImageReady CS

              Apple iTunes

              6, 7, 8

              Apple QuickTime Player

              5, 6, 7

              Apple Safari

              3.1.2

              Google Chrome

              beta

              Google Picasa

              3

              Google Talk

              beta

              IBM Lotus 1-2-3

              9

              IBM Lotus Notes

              6,7, 8

              IBM Lotus Organizer

              5

              IBM Lotus WordPro

              9.9

              Intuit Quicken Deluxe

              2009

              Money Plus Business

              2008

              Money Plus Home

              2008

              Mozilla Firefox

              3

              Microsoft Office

              2003, 2007, 2010

              Microsoft Office Access®

              2003, 2007, 2010

              Microsoft Office Excel®

              2003, 2007, 2010

              Microsoft Office FrontPage®

              2003, 2007, 2010

              Microsoft Office OneNote®

              2003, 2007, 2010

              Microsoft Office Outlook®

              2003, 2007, 2010

              Microsoft Office PowerPoint®

              2003, 2007, 2010

              Microsoft Office Publisher

              2003, 2007, 2010

              Microsoft Office Word

              2003, 2007, 2010

              Opera Software Opera

              9.5

              Microsoft Outlook Express

              (only mailbox file)

              Microsoft Project

              2003, 2007

              Microsoft Office Visio®

              2003, 2007

              RealPlayer Basic

              11

              Sage Peachtree

              2009

              Skype

              3.8

              Windows Live Mail

              12, 14

              Windows Live Messenger

              8.5, 14

              Windows Live MovieMaker

              14

              Windows Live Photo Gallery

              12, 14

              Windows Live Writer

              12, 14

              Windows Mail

              (Windows 7 and 8)

              Microsoft Works

              9

              Yahoo Messenger

              9

              Microsoft Zune™ Software

              3

              + + + +## What USMT does not migrate + + +The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md). + +### Application settings + +USMT does not migrate the following application settings: + +- Settings from earlier versions of an application. The versions of each application must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. USMT can migrate from an earlier version of Microsoft Office to a later version. + +- Application settings and some operating-system settings when a local account is created. For example, if you run /lac to create a local account on the destination computer, USMT will migrate the user data, but only some of the operating-system settings, such as wallpaper and screensaver settings, and no application settings will migrate. + +- Microsoft Project settings, when migrating from Office 2003 to Office 2007 system. + +- ICQ Pro settings, if ICQ Pro is installed in a different location on the destination computer. To successfully migrate the settings of ICQ Pro, you must install ICQ Pro in the same location on the destination computer as it was on the source computer. Otherwise, after you run the LoadState tool, the application will not start. You may encounter problems when: + + - You change the default installation location on 32-bit destination computers. + + - You attempt to migrate from a 32-bit computer to a 64-bit computer. This is because the ICQ Pro default installation directory is different on the two types of computers. When you install ICQ Pro on a 32-bit computer, the default location is "C:\\Program Files\\...". The ICQ Pro default installation directory on an x64-based computer, however, is “C:\\Program Files (x86)\\...”. + +### Operating-System settings + +USMT does not migrate the following operating-system settings. + +- Local printers, hardware-related settings, drivers, passwords, application binary files, synchronization files, DLL files, or other executable files. + +- Permissions for shared folders. After migration, you must manually re-share any folders that were shared on the source computer. + +- Files and settings migrating between operating systems with different languages. The operating system of the source computer must match the language of the operating system on the destination computer. + +- Customized icons for shortcuts may not migrate. + +- Taskbar settings, when the source computer is running Windows XP. + +You should also note the following: + +- You should run USMT from an account with administrative credentials. Otherwise, some data will not migrate. When running the ScanState and LoadState tools you must run the tools in Administrator mode from an account with administrative credentials. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. In addition, you must run the ScanState tool on Windows XP from an account with administrative credentials. Otherwise, some operating-system settings will not migrate. To run in Administrator mode, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. + +- You can use the /**localonly** option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify /**localonly**, see [ScanState Syntax](usmt-scanstate-syntax.md). + +### Start menu layout + +Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). + +## Related topics + + +[Plan your migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index bfbd4e2c61..2399213435 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -1,6 +1,6 @@ --- title: XML Elements Library (Windows 10) -description: XML Elements Library +description: Learn about the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). ms.assetid: f5af0f6d-c3bf-4a4c-a0ca-9db7985f954f ms.reviewer: manager: laurawi @@ -17,12 +17,10 @@ ms.topic: article # XML Elements Library -## Overview - This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. . -## In This Topic +## In this topic In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions. @@ -326,7 +324,7 @@ Syntax: ## <component> -The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. +The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. A component can be nested inside another component; that is, the <component> element can be a child of the <role> element within the <component> element in two cases: 1) when the parent <component> element is a container or 2) if the child <component> element has the same role as the parent <component> element. @@ -365,7 +363,7 @@ hidden="Yes|No">

              Yes

              You can use the following to group settings, and define the type of the component.

                -
              • System: Operating system settings. All Windows® components are defined by this type.

                +
              • System: Operating system settings. All Windows® components are defined by this type.

                When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

              • Application: Settings for an application.

              • Device: Settings for a device.

              • @@ -556,7 +554,7 @@ For example:

                OSType

                Yes

                -

                Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x”, the result will be FALSE.

                +

                Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is "9x", the result will be FALSE.

                OSVersion

                @@ -598,7 +596,7 @@ For example:

                OSType

                Yes

                -

                Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x” the result will be FALSE.

                +

                Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is "9x" the result will be FALSE.

                OSVersion

                @@ -3131,8 +3129,8 @@ This filter helper function can be used to filter the migration of files based o

                valueToCompare

                The value we are comparing. For example:

                -

                Date: “2008/05/15-2005/05/17”, “2008/05/15”

                -

                Size: A numeral with B, KB, MB, or GB at the end. “5GB”, “1KB-1MB”

                +

                Date: "2008/05/15-2005/05/17", "2008/05/15"

                +

                Size: A numeral with B, KB, MB, or GB at the end. "5GB", "1KB-1MB"

                @@ -3464,8 +3462,8 @@ Syntax:

              You can either:

                -
              1. Specify up to three <role> elements within a <component> — one “Binaries” role element, one “Settings” role element and one “Data” role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.

              2. -
              3. Specify one “Container” <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

              4. +
              5. Specify up to three <role> elements within a <component> — one "Binaries" role element, one "Settings" role element and one "Data" role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.

              6. +
              7. Specify one "Container" <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

              <component context="UserAndSystem" type="Application">
                 <displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName> 
              @@ -3846,7 +3844,7 @@ See the last component in the MigUser.xml file for an example of this element.
               ~~~
               **Example:**
               
              -If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X’s profile.
              +If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X's profile.
               
               The following is example code for this scenario. The first <rules> element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second <rules> elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second <rules> element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected.
               
              @@ -4103,12 +4101,12 @@ Syntax:
               
               

              name

              Yes

              -

              ID is a string value that is the name used to reference the environment variable. We recommend that ID start with the component’s name to avoid namespace collisions. For example, if your component’s name is MyComponent, and you want a variable that is your component’s install path, you could specify MyComponent.InstallPath.

              +

              ID is a string value that is the name used to reference the environment variable. We recommend that ID start with the component's name to avoid namespace collisions. For example, if your component's name is MyComponent, and you want a variable that is your component's install path, you could specify MyComponent.InstallPath.

              remap

              No, default = FALSE

              -

              Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable’s value are automatically moved to where the environment variable points on the destination computer.

              +

              Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable's value are automatically moved to where the environment variable points on the destination computer.

              @@ -4227,27 +4225,27 @@ The following functions are for internal USMT use only. Do not use them in an .x You can use the following version tags with various helper functions: -- “CompanyName” +- "CompanyName" -- “FileDescription” +- "FileDescription" -- “FileVersion” +- "FileVersion" -- “InternalName” +- "InternalName" -- “LegalCopyright” +- "LegalCopyright" -- “OriginalFilename” +- "OriginalFilename" -- “ProductName” +- "ProductName" -- “ProductVersion” +- "ProductVersion" The following version tags contain values that can be compared: -- “FileVersion” +- "FileVersion" -- “ProductVersion” +- "ProductVersion" ## Related topics diff --git a/windows/deployment/usmt/usmt-xml-reference.md b/windows/deployment/usmt/usmt-xml-reference.md index e69e94db8f..ec943180e6 100644 --- a/windows/deployment/usmt/usmt-xml-reference.md +++ b/windows/deployment/usmt/usmt-xml-reference.md @@ -1,78 +1,79 @@ ---- -title: USMT XML Reference (Windows 10) -description: USMT XML Reference -ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# USMT XML Reference - - -This section contains topics that you can use to work with and to customize the migration XML files. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

              Understanding Migration XML Files

              Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.

              Config.xml File

              Describes the Config.xml file and policies concerning its configuration.

              Customize USMT XML Files

              Describes how to customize USMT XML files.

              Custom XML Examples

              Gives examples of XML files for various migration scenarios.

              Conflicts and Precedence

              Describes the precedence of migration rules and how conflicts are handled.

              General Conventions

              Describes the XML helper functions.

              XML File Requirements

              Describes the requirements for custom XML files.

              Recognized Environment Variables

              Describes environment variables recognized by USMT.

              XML Elements Library

              Describes the XML elements and helper functions for authoring migration XML files to use with USMT.

              - - - - - - - - - - - +--- +title: USMT XML Reference (Windows 10) +description: Learn about working with and customizing the migration XML files using User State Migration Tool (USMT) XML Reference for Windows 10. +ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# USMT XML Reference + + +This section contains topics that you can use to work with and to customize the migration XML files. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

              Understanding Migration XML Files

              Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.

              Config.xml File

              Describes the Config.xml file and policies concerning its configuration.

              Customize USMT XML Files

              Describes how to customize USMT XML files.

              Custom XML Examples

              Gives examples of XML files for various migration scenarios.

              Conflicts and Precedence

              Describes the precedence of migration rules and how conflicts are handled.

              General Conventions

              Describes the XML helper functions.

              XML File Requirements

              Describes the requirements for custom XML files.

              Recognized Environment Variables

              Describes environment variables recognized by USMT.

              XML Elements Library

              Describes the XML elements and helper functions for authoring migration XML files to use with USMT.

              + + + + + + + + + + + diff --git a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md index 433a6a1605..48fd0b29b9 100644 --- a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md +++ b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md @@ -1,128 +1,129 @@ ---- -title: Verify the Condition of a Compressed Migration Store (Windows 10) -description: Verify the Condition of a Compressed Migration Store -ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Verify the Condition of a Compressed Migration Store - - -When you migrate files and settings during a typical PC-refresh migration, the user state is usually stored in a compressed folder on the intermediate store. This compressed folder, also called the compressed migration store, is a single image file that contains: - -- All of the files being migrated. - -- The user’s settings. - -- A catalog file that contains metadata for all files in the migration store. - -When you run the **LoadState** command to load the data from these files to the destination computer, LoadState requires a valid catalog file in order to open the migration store. You can run the **UsmtUtils** command with the **/verify** option to determine whether the compressed migration store is intact, or whether it contains corrupted files or a corrupted catalog. You should run the **/verify** option on the migration store before you overwrite the original user-state files and settings. - -When you use the **/verify** option, you can specify what type of information to report in the UsmtUtils log file. These report types are: - -- **Catalog**: Displays the status of only the catalog file. - -- **All**: Displays the status of all files, including the catalog file. - -- **Failure only**: Displays only the files that are corrupted. - -## In This Topic - - -The following sections demonstrate how to run the **UsmtUtils** command with the **/verify** option, and how to specify the information to display in the UsmtUtils log file. - -- [The UsmtUtils syntax for the /verify option](#bkmk-verifysyntax) - -- [To verify that the migration store is intact](#bkmk-verifyintactstore) - -- [To verify the status of only the catalog file](#bkmk-verifycatalog) - -- [To verify the status of all files](#bkmk-verifyallfiles) - -- [To verify the status of the files and return only the corrupted files](#bkmk-returncorrupted) - -### The UsmtUtils Syntax for the /verify Option - -To verify the condition of a compressed migration store, use the following UsmtUtils syntax: - -cd /d<USMTpath>usmtutils /verify\[:<reportType>\] <filePath> \[/l:<logfile>\] \[/decrypt \[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] - -Where the placeholders have the following values: - -- *<USMTpath>* is the location where you have saved the USMT files and tools. - -- *<reportType>* specifies whether to report on all files, corrupted files only, or the status of the catalog. - -- *<filePath>* is the location of the compressed migration store. - -- *<logfile>* is the location and name of the log file. - -- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. - -- *<keystring>* is the encryption key that was used to encrypt the migration store. - -- *<filename>* is the location and name of the text file that contains the encryption key. - -### To Verify that the Migration Store is Intact - -To verify whether the migration store is intact or whether it contains corrupted files or a corrupted catalog, type: - -``` syntax -usmtutils /verify D:\MyMigrationStore\store.mig -``` - -Because no report type is specified, UsmtUtils displays the default summary report. - -### To Verify the Status of Only the Catalog File - -To verify whether the catalog file is corrupted or intact, type: - -``` syntax -usmtutils /verify:catalog D:\MyMigrationStore\store.mig -``` - -### To Verify the Status of all Files - -To verify whether there are any corrupted files in the compressed migration store, and to specify the name and location of the log file, type: - -`usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` - -In addition to verifying the status of all files, this example decrypts the files. Because no encryption algorithm is specified, UsmtUtils uses the default 3DES cryptographic algorithm. - -### To Verify the Status of the Files and Return Only the Corrupted Files - -In this example, the log file will only list the files that became corrupted during the ScanState process. This list will include the catalog file if it is also corrupted. - -``` syntax -usmtutils /verify:failureonly D:\MyMigrationStore\USMT\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt -``` - -This example also decrypts the files by specifying the cryptographic algorithm and the location of the file that contains the encryption key. - -### Next Steps - -If the **/verify** option indicates that there are corrupted files in the migration store, you can use the **/extract** option in the UsmtUtils tool to recover data from some corrupted stores. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -## Related topics - - -[UsmtUtils Syntax](usmt-utilities.md) - -[Return Codes](usmt-return-codes.md) - -  - -  - - - - - +--- +title: Verify the Condition of a Compressed Migration Store (Windows 10) +description: Use these tips and tricks to verify the condition of a compressed migration store when using User State Migration Tool (USMT). +ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Verify the Condition of a Compressed Migration Store + + +When you migrate files and settings during a typical PC-refresh migration, the user state is usually stored in a compressed folder on the intermediate store. This compressed folder, also called the compressed migration store, is a single image file that contains: + +- All of the files being migrated. + +- The user’s settings. + +- A catalog file that contains metadata for all files in the migration store. + +When you run the **LoadState** command to load the data from these files to the destination computer, LoadState requires a valid catalog file in order to open the migration store. You can run the **UsmtUtils** command with the **/verify** option to determine whether the compressed migration store is intact, or whether it contains corrupted files or a corrupted catalog. You should run the **/verify** option on the migration store before you overwrite the original user-state files and settings. + +When you use the **/verify** option, you can specify what type of information to report in the UsmtUtils log file. These report types are: + +- **Catalog**: Displays the status of only the catalog file. + +- **All**: Displays the status of all files, including the catalog file. + +- **Failure only**: Displays only the files that are corrupted. + +## In This Topic + + +The following sections demonstrate how to run the **UsmtUtils** command with the **/verify** option, and how to specify the information to display in the UsmtUtils log file. + +- [The UsmtUtils syntax for the /verify option](#bkmk-verifysyntax) + +- [To verify that the migration store is intact](#bkmk-verifyintactstore) + +- [To verify the status of only the catalog file](#bkmk-verifycatalog) + +- [To verify the status of all files](#bkmk-verifyallfiles) + +- [To verify the status of the files and return only the corrupted files](#bkmk-returncorrupted) + +### The UsmtUtils Syntax for the /verify Option + +To verify the condition of a compressed migration store, use the following UsmtUtils syntax: + +cd /d<USMTpath>usmtutils /verify\[:<reportType>\] <filePath> \[/l:<logfile>\] \[/decrypt \[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] + +Where the placeholders have the following values: + +- *<USMTpath>* is the location where you have saved the USMT files and tools. + +- *<reportType>* specifies whether to report on all files, corrupted files only, or the status of the catalog. + +- *<filePath>* is the location of the compressed migration store. + +- *<logfile>* is the location and name of the log file. + +- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. + +- *<keystring>* is the encryption key that was used to encrypt the migration store. + +- *<filename>* is the location and name of the text file that contains the encryption key. + +### To Verify that the Migration Store is Intact + +To verify whether the migration store is intact or whether it contains corrupted files or a corrupted catalog, type: + +``` syntax +usmtutils /verify D:\MyMigrationStore\store.mig +``` + +Because no report type is specified, UsmtUtils displays the default summary report. + +### To Verify the Status of Only the Catalog File + +To verify whether the catalog file is corrupted or intact, type: + +``` syntax +usmtutils /verify:catalog D:\MyMigrationStore\store.mig +``` + +### To Verify the Status of all Files + +To verify whether there are any corrupted files in the compressed migration store, and to specify the name and location of the log file, type: + +`usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` + +In addition to verifying the status of all files, this example decrypts the files. Because no encryption algorithm is specified, UsmtUtils uses the default 3DES cryptographic algorithm. + +### To Verify the Status of the Files and Return Only the Corrupted Files + +In this example, the log file will only list the files that became corrupted during the ScanState process. This list will include the catalog file if it is also corrupted. + +``` syntax +usmtutils /verify:failureonly D:\MyMigrationStore\USMT\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt +``` + +This example also decrypts the files by specifying the cryptographic algorithm and the location of the file that contains the encryption key. + +### Next Steps + +If the **/verify** option indicates that there are corrupted files in the migration store, you can use the **/extract** option in the UsmtUtils tool to recover data from some corrupted stores. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +## Related topics + + +[UsmtUtils Syntax](usmt-utilities.md) + +[Return Codes](usmt-return-codes.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/xml-file-requirements.md b/windows/deployment/usmt/xml-file-requirements.md index aeae8b54ae..f5afeaa069 100644 --- a/windows/deployment/usmt/xml-file-requirements.md +++ b/windows/deployment/usmt/xml-file-requirements.md @@ -1,6 +1,6 @@ --- title: XML File Requirements (Windows 10) -description: XML File Requirements +description: Learn about the XML file requirements for creating custom .xml files, like the file must be in UTF-8 and have a unique migration urlid. ms.assetid: 4b567b50-c50a-4a4f-8684-151fe3f8275f ms.reviewer: manager: laurawi diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 1ed8638bcc..bc307dfc3a 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -2,15 +2,18 @@ title: Configure VDA for Windows 10 Subscription Activation ms.reviewer: manager: laurawi -ms.audience: itpro author: greg-lindsay -description: How to enable Windows 10 Enterprise E3 and E5 subscriptions for VDA +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +description: Learn how to configure virtual machines (VMs) to enable Windows 10 Subscription Activation in a Windows Virtual Desktop Access (VDA) scenario. keywords: upgrade, update, task sequence, deploy +ms.custom: seo-marvel-apr2020 ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.pagetype: mdt -audience: itpro author: greg-lindsay +audience: itpro ms.topic: article ms.collection: M365-modern-desktop --- @@ -64,28 +67,26 @@ For examples of activation issues, see [Troubleshoot the user experience](https: 4. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. 5. Click **Add**, type **Authenticated users**, and then click **OK** three times. 6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again. -7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). -8. Open Windows Configuration Designer and click **Provison desktop services**. -9. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 10. - - 1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. +7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps to use Windows Configuration Designer and inject an activation key. Otherwise, skip to step 20. +8. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). +9. Open Windows Configuration Designer and click **Provison desktop services**. +10. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. - Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step. - 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. -10. On the Set up network page, choose **Off**. -11. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. +11. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. +12. On the Set up network page, choose **Off**. +13. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. - Note: This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms). -12. On the Add applications page, add applications if desired. This step is optional. -13. On the Add certificates page, add certificates if desired. This step is optional. -14. On the Finish page, click **Create**. -15. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 16. - 1. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. - 2. Type the following at an elevated commnand prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: +14. On the Add applications page, add applications if desired. This step is optional. +15. On the Add certificates page, add certificates if desired. This step is optional. +16. On the Finish page, click **Create**. +17. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. +18. Type the following at an elevated command prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: - ``` + ```cmd Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg" ``` - 3. Right-click the mounted image in file explorer and click **Eject**. -16. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. +19. Right-click the mounted image in file explorer and click **Eject**. +20. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. ## Azure Active Directory-joined VMs diff --git a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md index 772b7e9d11..5e20b62132 100644 --- a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md @@ -1,6 +1,6 @@ --- title: Activate by Proxy an Active Directory Forest (Windows 10) -description: Activate by Proxy an Active Directory Forest +description: Learn how to use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest. ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5 ms.reviewer: manager: laurawi @@ -9,7 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.date: 04/25/2017 ms.topic: article --- @@ -18,13 +19,13 @@ ms.topic: article You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest for an isolated workgroup that does not have Internet access. ADBA enables certain volume products to inherit activation from the domain. -**Important**   -ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host key (CSVLK). To use ADBA, one or more KMS Host keys (CSVLK) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. +> [!IMPORTANT] +> ADBA is only applicable to *Generic Volume License Keys (GVLKs)* and *KMS Host key (CSVLK)*. To use ADBA, one or more KMS Host keys (CSVLK) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. In a typical proxy-activation scenario, the VAMT host computer distributes a product key to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. If you use this activation method, only the VAMT host computer needs to have Internet access. -**Note**   -For workgroups that are isolated from any larger network, you can still perform an AD forest activation. This requires installing a second instance of VAMT on a computer in the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. You can also activate by proxy a KMS Host key (CSVLK) in the core network if you do not want the host computer to connect to Microsoft over the Internet. +> [!NOTE] +> For workgroups that are isolated from any larger network, you can still perform an AD forest activation. This requires installing a second instance of VAMT on a computer in the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. You can also activate by proxy a KMS Host key (CSVLK) in the core network if you do not want the host computer to connect to Microsoft over the Internet. ## Requirements diff --git a/windows/deployment/volume-activation/activate-forest-vamt.md b/windows/deployment/volume-activation/activate-forest-vamt.md index 06362064ff..007c3a0ae3 100644 --- a/windows/deployment/volume-activation/activate-forest-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-vamt.md @@ -1,50 +1,51 @@ ---- -title: Activate an Active Directory Forest Online (Windows 10) -description: Activate an Active Directory Forest Online -ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Activate an Active Directory Forest Online - -You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain. - -**Important**   -ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. - -## Requirements - -Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: -- VAMT is installed on a host computer that has Internet access. -- VAMT has administrative permissions to the Active Directory domain. -- The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node. - -**To perform an online Active Directory forest activation** - -1. Open VAMT. -2. In the left-side pane, click the **Active Directory-Based Activation** node. -3. In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box. -4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest. -5. If required, enter a new Active Directory-Based Activation Object name - - **Important**   - If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. - -6. Click **Install Key**. -7. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. - -The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane. - -## Related topics - -- [Scenario 1: Online Activation](scenario-online-activation-vamt.md) -- [Add and Remove Computers](add-remove-computers-vamt.md) +--- +title: Activate an Active Directory Forest Online (Windows 10) +description: Use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest online. +ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Activate an Active Directory Forest Online + +You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain. + +**Important**   +ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. + +## Requirements + +Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: +- VAMT is installed on a host computer that has Internet access. +- VAMT has administrative permissions to the Active Directory domain. +- The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node. + +**To perform an online Active Directory forest activation** + +1. Open VAMT. +2. In the left-side pane, click the **Active Directory-Based Activation** node. +3. In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box. +4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest. +5. If required, enter a new Active Directory-Based Activation Object name + + **Important**   + If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. + +6. Click **Install Key**. +7. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. + +The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane. + +## Related topics + +- [Scenario 1: Online Activation](scenario-online-activation-vamt.md) +- [Add and Remove Computers](add-remove-computers-vamt.md) diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index 2ab639a904..e9c419383d 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -1,6 +1,7 @@ --- title: Activate using Active Directory-based activation (Windows 10) -description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. +description: Learn how active directory-based activation is implemented as a role service that relies on AD DS to store activation objects. +ms.custom: seo-marvel-apr2020 ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af ms.reviewer: manager: laurawi @@ -10,92 +11,111 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article --- # Activate using Active Directory-based activation -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2016 + +> Applies to +> +>- Windows 10 +>- Windows 8.1 +>- Windows 8 +>- Windows Server 2012 R2 +>- Windows Server 2012 +>- Windows Server 2016 +>- Windows Server 2019 **Looking for retail activation?** -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) -Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated by adprep.exe on a computer running Windows Server 2012 or Windows Server 2012 R2, but after the schema is updated, older domain controllers can still activate clients. -Any domain-joined computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2 with a GVLK will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention. -To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console in Windows Server 2012 R2 or the VAMT in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10. +- [Get Help Activating Microsoft Windows 7 or Windows 8.1](https://support.microsoft.com/help/15083/windows-activate-windows-7-or-8-1) +- [Get Help Activating Microsoft Windows 10](https://support.microsoft.com/help/12440/windows-10-activate) + +Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated using *adprep.exe* on a supported server OS, but after the schema is updated, older domain controllers can still activate clients. + +Any domain-joined computers running a supported operating system with a Generic Volume License Key (GVLK) will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention. + +To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console or the [Volume Activation Management Tool (VAMT)](volume-activation-management-tool.md) in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10. + The process proceeds as follows: -1. Perform one of the following tasks: - - Install the Volume Activation Services server role on a domain controller running Windows Server 2012 R2, and add a KMS host key by using the Volume Activation Tools Wizard. - - Extend the domain to the Windows Server 2012 R2 schema level, and add a KMS host key by using the VAMT. -2. Microsoft verifies the KMS host key, and an activation object is created. -3. Client computers are activated by receiving the activation object from a domain controller during startup. + +1. Perform one of the following tasks: + - Install the Volume Activation Services server role on a domain controller and add a KMS host key by using the Volume Activation Tools Wizard. + - Extend the domain to the Windows Server 2012 R2 or higher schema level, and add a KMS host key by using the VAMT. +1. Microsoft verifies the KMS host key, and an activation object is created. +1. Client computers are activated by receiving the activation object from a domain controller during startup. ![Active Directory-based activation flow](../images/volumeactivationforwindows81-10.jpg) - + **Figure 10**. The Active Directory-based activation flow - -For environments in which all computers are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment. + +For environments in which all computers are running an operating system listed under *Applies to*, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment. + If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office. -Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180day period. By default, this reactivation event occurs every seven days. -When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, when the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS. + +Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180 day period. By default, this reactivation event occurs every seven days. + +When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, and the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS. + ## Step-by-step configuration: Active Directory-based activation -**Note**   -You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings. -**To configure Active Directory-based activation on Windows Server 2012 R2, complete the following steps:** -1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller. -2. Launch Server Manager. -3. Add the Volume Activation Services role, as shown in Figure 11. + +> [!NOTE] +> You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings. + +**To configure Active Directory-based activation on Windows Server 2012 R2 or higher, complete the following steps:** + +1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller. +1. Launch Server Manager. +1. Add the Volume Activation Services role, as shown in Figure 11. ![Adding the Volume Activation Services role](../images/volumeactivationforwindows81-11.jpg) - + **Figure 11**. Adding the Volume Activation Services role - -4. Click the link to launch the Volume Activation Tools (Figure 12). + +1. Click the link to launch the Volume Activation Tools (Figure 12). ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-12.jpg) - + **Figure 12**. Launching the Volume Activation Tools - -5. Select the **Active Directory-Based Activation** option (Figure 13). + +1. Select the **Active Directory-Based Activation** option (Figure 13). ![Selecting Active Directory-Based Activation](../images/volumeactivationforwindows81-13.jpg) - + **Figure 13**. Selecting Active Directory-Based Activation - -6. Enter your KMS host key and (optionally) a display name (Figure 14). + +1. Enter your KMS host key and (optionally) a display name (Figure 14). ![Choosing how to activate your product](../images/volumeactivationforwindows81-15.jpg) - + **Figure 14**. Entering your KMS host key - -7. Activate your KMS host key by phone or online (Figure 15). + +1. Activate your KMS host key by phone or online (Figure 15). ![Entering your KMS host key](../images/volumeactivationforwindows81-14.jpg) - + **Figure 15**. Choosing how to activate your product - -8. After activating the key, click **Commit**, and then click **Close**. + +1. After activating the key, click **Commit**, and then click **Close**. ## Verifying the configuration of Active Directory-based activation To verify your Active Directory-based activation configuration, complete the following steps: -1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing. -2. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key. -3. If the computer is not joined to your domain, join it to the domain. -4. Sign in to the computer. -5. Open Windows Explorer, right-click **Computer**, and then click **Properties**. -6. Scroll down to the **Windows activation** section, and verify that this client has been activated. - **Note**
              - If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used. - +1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing. +1. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key. +1. If the computer is not joined to your domain, join it to the domain. +1. Sign in to the computer. +1. Open Windows Explorer, right-click **Computer**, and then click **Properties**. +1. Scroll down to the **Windows activation** section, and verify that this client has been activated. + + > [!NOTE] + > If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used. + ## See also -- [Volume Activation for Windows 10](volume-activation-windows-10.md) + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 01010689aa..c1068fe146 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -1,144 +1,153 @@ ---- -title: Activate using Key Management Service (Windows 10) -ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac -ms.reviewer: -manager: laurawi -ms.author: greglin -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 10/16/2017 -ms.topic: article ---- - -# Activate using Key Management Service - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: -- Host KMS on a computer running Windows 10 -- Host KMS on a computer running Windows Server 2012 R2 -- Host KMS on a computer running an earlier version of Windows - -Check out [Windows 10 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2015/09/15/windows-10-volume-activation-tips/). - -## Key Management Service in Windows 10 - -Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. -Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. -To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft’s activation services. - -**Configure KMS in Windows 10** - -1. Open an elevated command prompt. -2. Enter one of the following commands. - - To install a KMS key, type **slmgr.vbs /ipk <KmsKey>**. - - To activate online, type **slmgr.vbs /ato**. - - To activate by using the telephone, type **slui.exe 4**. -3. After activating the KMS key, restart the Software Protection Service. - -For more information, see the information for Windows 7 in [Deploy KMS Activation](https://go.microsoft.com/fwlink/p/?LinkId=717032). - -## Key Management Service in Windows Server 2012 R2 -Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Server 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. - -**Note**   -You cannot install a client KMS key into the KMS in Windows Server. - -This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden. - -**Note**   - -If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](https://go.microsoft.com/fwlink/p/?LinkId=620687). - -**Configure KMS in Windows Server 2012 R2** - -1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. -2. Launch Server Manager. -3. Add the Volume Activation Services role, as shown in Figure 4. - - ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) - - **Figure 4**. Adding the Volume Activation Services role in Server Manager\ - -4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). - - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) - - **Figure 5**. Launching the Volume Activation Tools - - 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). - This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. - - ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) - - **Figure 6**. Configuring the computer as a KMS host - -5. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). - - ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) - - **Figure 7**. Installing your KMS host key - -6. If asked to confirm replacement of an existing key, click **Yes**. -7. After the product key is installed, you must activate it. Click **Next** (Figure 8). - - ![Activating the software](../images/volumeactivationforwindows81-08.jpg) - - **Figure 8**. Activating the software - - The KMS key can be activated online or by phone. See Figure 9. - - ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) - - **Figure 9**. Choosing to activate online - -Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. - -## Verifying the configuration of Key Management Service - -You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. -**Note**   - -If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. - -To verify that KMS volume activation works, complete the following steps: - -1. On the KMS host, open the event log and confirm that DNS publishing is successful. -2. On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER.

              -The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. -3. On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr /dlv**, and then press ENTER.

              - -The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated. - -For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](https://go.microsoft.com/fwlink/p/?LinkId=733639). - -## Key Management Service in earlier versions of Windows - -If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: - -1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. -2. Request a new KMS host key from the Volume Licensing Service Center. -3. Install the new KMS host key on your KMS host. -4. Activate the new KMS host key by running the slmgr.vbs script. - -For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](https://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=626590). - -## See also -- [Volume Activation for Windows 10](volume-activation-windows-10.md) +--- +title: Activate using Key Management Service (Windows 10) +ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac +ms.reviewer: +manager: laurawi +ms.author: greglin +description: How to activate using Key Management Service in Windows 10. +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 10/16/2017 +ms.topic: article +--- + +# Activate using Key Management Service + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows 10](https://support.microsoft.com/help/12440/) +- [Get Help Activating Microsoft Windows 7 or Windows 8.1 ](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: + +- Host KMS on a computer running Windows 10 +- Host KMS on a computer running Windows Server 2012 R2 +- Host KMS on a computer running an earlier version of Windows + +Check out [Windows 10 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2015/09/15/windows-10-volume-activation-tips/). + +## Key Management Service in Windows 10 + +Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. +Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. +To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft activation services. + +### Configure KMS in Windows 10 + +To activate, use the slmgr.vbs command. Open an elevated command prompt and run one of the following commands: + +- To install the KMS key, type `slmgr.vbs /ipk `. +- To activate online, type `slmgr.vbs /ato`. +- To activate by telephone, follow these steps: + 1. Run `slmgr.vbs /dti` and confirm the installation ID. + 2. Call [Microsoft Licensing Activation Centers worldwide telephone numbers](https://www.microsoft.com/licensing/existing-customer/activation-centers) and follow the voice prompts to enter the installation ID that you obtained in step 1 on your telephone. + 3. Follow the voice prompts and write down the responded 48-digit confirmation ID for OS activation. + 4. Run `slmgr.vbs /atp \`. + +For more information, see the information for Windows 7 in [Deploy KMS Activation](https://go.microsoft.com/fwlink/p/?LinkId=717032). + +## Key Management Service in Windows Server 2012 R2 + +Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Server 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. + +> [!NOTE] +> You cannot install a client KMS key into the KMS in Windows Server. + +This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden. + +> [!NOTE] +> If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](https://go.microsoft.com/fwlink/p/?LinkId=620687). + +### Configure KMS in Windows Server 2012 R2 + +1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. +2. Launch Server Manager. +3. Add the Volume Activation Services role, as shown in Figure 4. + + ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) + + **Figure 4**. Adding the Volume Activation Services role in Server Manager + +4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). + + ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) + + **Figure 5**. Launching the Volume Activation Tools + +5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). + This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. + + ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) + + **Figure 6**. Configuring the computer as a KMS host + +6. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). + + ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) + + **Figure 7**. Installing your KMS host key + +7. If asked to confirm replacement of an existing key, click **Yes**. +8. After the product key is installed, you must activate it. Click **Next** (Figure 8). + + ![Activating the software](../images/volumeactivationforwindows81-08.jpg) + + **Figure 8**. Activating the software + + The KMS key can be activated online or by phone. See Figure 9. + + ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) + + **Figure 9**. Choosing to activate online + +Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. + +## Verifying the configuration of Key Management Service + +You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. + +> [!NOTE] +> If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. + +To verify that KMS volume activation works, complete the following steps: + +1. On the KMS host, open the event log and confirm that DNS publishing is successful. +2. On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER. + + The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. +3. On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr.vbs /dlv**, and then press ENTER. + + The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated. + +For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](https://docs.microsoft.com/windows-server/get-started/activation-slmgr-vbs-options). + +## Key Management Service in earlier versions of Windows + +If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: + +1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. +2. Request a new KMS host key from the Volume Licensing Service Center. +3. Install the new KMS host key on your KMS host. +4. Activate the new KMS host key by running the slmgr.vbs script. + +For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](https://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=626590). + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md index 0664a272c5..b88d65def4 100644 --- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md @@ -1,127 +1,128 @@ ---- -title: Activate clients running Windows 10 (Windows 10) -description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. -ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Activate clients running Windows 10 - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works. -Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer. -If activation or reactivation is required, the following sequence occurs: -1. If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals. -2. If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK. -3. The computer tries to activate against Microsoft servers if it is configured with a MAK. - -If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart. - -## How Key Management Service works - -KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP. - -### Key Management Service activation thresholds - -You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met. - -A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more. -When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met. - -In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated. - -### Activation count cache - -To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one. -However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days. -The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size. - -### Key Management Service connectivity - -KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements. - -### Key Management Service activation renewal - -KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again. - -### Publication of the Key Management Service - -The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts. - -### Client discovery of the Key Management Service - -By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it. -Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters. -If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records. -By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way. - -### Domain Name System server configuration - -The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update. -The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records. - -### Activating the first Key Management Service host - -KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers. - -### Activating subsequent Key Management Service hosts - -Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](https://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception. - -## How Multiple Activation Key works - -A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit. - -You can activate computers by using a MAK in two ways: -- **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. - - ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) - - **Figure 16**. MAK independent activation -- **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. - - ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) - - **Figure 17**. MAK proxy activation with the VAMT - -A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold. - -You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment. - -### Multiple Activation Key architecture and activation - -MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet. -In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID. - -## Activating as a standard user - -Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.” - -## See also - -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Activate clients running Windows 10 (Windows 10) +description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. +ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Activate clients running Windows 10 + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works. +Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer. +If activation or reactivation is required, the following sequence occurs: +1. If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals. +2. If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK. +3. The computer tries to activate against Microsoft servers if it is configured with a MAK. + +If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart. + +## How Key Management Service works + +KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP. + +### Key Management Service activation thresholds + +You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met. + +A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more. +When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met. + +In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated. + +### Activation count cache + +To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one. +However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days. +The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size. + +### Key Management Service connectivity + +KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements. + +### Key Management Service activation renewal + +KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again. + +### Publication of the Key Management Service + +The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts. + +### Client discovery of the Key Management Service + +By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it. +Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters. +If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records. +By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way. + +### Domain Name System server configuration + +The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update. +The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records. + +### Activating the first Key Management Service host + +KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers. + +### Activating subsequent Key Management Service hosts + +Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](https://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception. + +## How Multiple Activation Key works + +A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit. + +You can activate computers by using a MAK in two ways: +- **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. + + ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) + + **Figure 16**. MAK independent activation +- **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. + + ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) + + **Figure 17**. MAK proxy activation with the VAMT + +A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold. + +You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment. + +### Multiple Activation Key architecture and activation + +MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet. +In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID. + +## Activating as a standard user + +Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.” + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) +  +  diff --git a/windows/deployment/volume-activation/active-directory-based-activation-overview.md b/windows/deployment/volume-activation/active-directory-based-activation-overview.md index b0c4c10975..154b6e3b05 100644 --- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md +++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md @@ -1,6 +1,6 @@ --- title: Active Directory-Based Activation Overview (Windows 10) -description: Active Directory-Based Activation Overview +description: Enable your enterprise to activate its computers through a connection to their domain using Active Directory-Based Activation (ADBA). ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0 ms.reviewer: manager: laurawi @@ -9,7 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.date: 12/07/2018 ms.topic: article --- @@ -37,7 +38,7 @@ VAMT enables IT Professionals to manage and activate the ADBA object. Activation ## Related topics -- [How to Activate an Active Directory Forest Online](https://go.microsoft.com/fwlink/p/?LinkId=246565) -- [How to Proxy Activate an Active Directory Forest](https://go.microsoft.com/fwlink/p/?LinkId=246566) +- [How to Activate an Active Directory Forest Online](https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-vamt) +- [How to Proxy Activate an Active Directory Forest](https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-by-proxy-vamt)     diff --git a/windows/deployment/volume-activation/add-manage-products-vamt.md b/windows/deployment/volume-activation/add-manage-products-vamt.md index 255bda4716..fe607d6482 100644 --- a/windows/deployment/volume-activation/add-manage-products-vamt.md +++ b/windows/deployment/volume-activation/add-manage-products-vamt.md @@ -1,30 +1,31 @@ ---- -title: Add and Manage Products (Windows 10) -description: Add and Manage Products -ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Manage Products - -This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network. - -## In this Section - -|Topic |Description | -|------|------------| -|[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. | -|[Update Product Status](update-product-status-vamt.md) |Describes how to update the status of product license. | -|[Remove Products](remove-products-vamt.md) |Describes how to remove a product from the product list. | - - - +--- +title: Add and Manage Products (Windows 10) +description: Add client computers into the Volume Activation Management Tool (VAMT). After you add the computers, you can manage the products that are installed on your network. +ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Manage Products + +This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network. + +## In this Section + +|Topic |Description | +|------|------------| +|[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. | +|[Update Product Status](update-product-status-vamt.md) |Describes how to update the status of product license. | +|[Remove Products](remove-products-vamt.md) |Describes how to remove a product from the product list. | + + + diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index 0784cbb98a..4e2248db96 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -1,63 +1,64 @@ ---- -title: Add and Remove Computers (Windows 10) -description: Add and Remove Computers -ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.pagetype: activation -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Remove Computers - -You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function. - -Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md). - -## To add computers to a VAMT database - -1. Open VAMT. -2. Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box. -3. In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. - - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**, then under **Domain Filter Criteria**, in the list of domain names click the name of the domain you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search by individual computer name or IP address, click **Manually enter name or IP address**, then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. - - To search for computers in a workgroup, click **Search for computers in the workgroup**, then under **Workgroup Filter Criteria**, in the list of workgroup names click the name of the workgroup you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box provided. VAMT will validate only the LDAP query syntax, but will otherwise run the query without further checks. -4. Click **Search**. -5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. - To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. - - ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) - - **Important**   - This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. - -## To add products to VAMT - -1. In the **Products** list, select the computers that need to have their product information added to the VAMT database. -2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. -6. VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. - - **Note**   - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. - -## To remove computers from a VAMT database - -You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database. - -## Related topics - -- [Add and Manage Products](add-manage-products-vamt.md) - - +--- +title: Add and Remove Computers (Windows 10) +description: The Discover products function on the Volume Activation Management Tool (VAMT) allows you to search the Active Directory domain or a general LDAP query. +ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.pagetype: activation +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Remove Computers + +You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function. + +Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md). + +## To add computers to a VAMT database + +1. Open VAMT. +2. Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box. +3. In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. + - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**, then under **Domain Filter Criteria**, in the list of domain names click the name of the domain you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search by individual computer name or IP address, click **Manually enter name or IP address**, then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. + - To search for computers in a workgroup, click **Search for computers in the workgroup**, then under **Workgroup Filter Criteria**, in the list of workgroup names click the name of the workgroup you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box provided. VAMT will validate only the LDAP query syntax, but will otherwise run the query without further checks. +4. Click **Search**. +5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. + To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. + + ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) + + **Important**   + This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. + +## To add products to VAMT + +1. In the **Products** list, select the computers that need to have their product information added to the VAMT database. +2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. +6. VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + + **Note**   + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + +## To remove computers from a VAMT database + +You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database. + +## Related topics + +- [Add and Manage Products](add-manage-products-vamt.md) + + diff --git a/windows/deployment/volume-activation/add-remove-product-key-vamt.md b/windows/deployment/volume-activation/add-remove-product-key-vamt.md index fc7b9b051d..dc8aedf5f2 100644 --- a/windows/deployment/volume-activation/add-remove-product-key-vamt.md +++ b/windows/deployment/volume-activation/add-remove-product-key-vamt.md @@ -1,39 +1,40 @@ ---- -title: Add and Remove a Product Key (Windows 10) -description: Add and Remove a Product Key -ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Remove a Product Key - -Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database. - -## To Add a Product Key - -1. Open VAMT. -2. In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu. -3. Click **Add product keys** to open the **Add Product Keys** dialog box. -4. In the **Add Product Keys** dialog box, select from one of the following methods to add product keys: - - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**. - - To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. - - **Note**   - If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. - -## Remove a Product Key - -- To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network. - -## Related topics - -- [Manage Product Keys](manage-product-keys-vamt.md) +--- +title: Add and Remove a Product Key (Windows 10) +description: Add a product key to the Volume Activation Management Tool (VAMT) database. Also, learn how to remove the key from the database. +ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Remove a Product Key + +Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database. + +## To Add a Product Key + +1. Open VAMT. +2. In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu. +3. Click **Add product keys** to open the **Add Product Keys** dialog box. +4. In the **Add Product Keys** dialog box, select from one of the following methods to add product keys: + - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**. + - To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + + **Note**   + If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + +## Remove a Product Key + +- To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network. + +## Related topics + +- [Manage Product Keys](manage-product-keys-vamt.md) diff --git a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md index d56ff58a30..19d405b786 100644 --- a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md @@ -1,71 +1,72 @@ ---- -title: Appendix Information sent to Microsoft during activation (Windows 10) -ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 -ms.reviewer: -manager: laurawi -ms.author: greglin -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Appendix: Information sent to Microsoft during activation -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -When you activate a computer running Windows 10, the following information is sent to Microsoft: - -- The Microsoft product code (a five-digit code that identifies the Windows product you are activating) -- A channel ID or site code that identifies how the Windows product was originally obtained - - For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer. - -- The date of installation and whether the installation was successful -- Information that helps confirm that your Windows product key has not been altered -- Computer make and model -- Version information for the operating system and software -- Region and language settings -- A unique number called a *globally unique identifier*, which is assigned to your computer -- Product key (hashed) and product ID -- BIOS name, revision number, and revision date -- Volume serial number (hashed) of the hard disk drive -- The result of the activation check - - This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled: - - - The activation exploit’s identifier - - The activation exploit’s current state, such as cleaned or quarantined - - Computer manufacturer’s identification - - The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit -- The name and a hash of the contents of your computer’s startup instructions file -- If your Windows license is on a subscription basis, information about how your subscription works - -Standard computer information is also sent, but your computer’s IP address is only retained temporarily. - -## Use of information - -Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers. -For additional details, see [Windows 10 Privacy Statement](https://go.microsoft.com/fwlink/p/?LinkId=619879). - -## See also - -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Appendix Information sent to Microsoft during activation (Windows 10) +ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Appendix: Information sent to Microsoft during activation +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +When you activate a computer running Windows 10, the following information is sent to Microsoft: + +- The Microsoft product code (a five-digit code that identifies the Windows product you are activating) +- A channel ID or site code that identifies how the Windows product was originally obtained + + For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer. + +- The date of installation and whether the installation was successful +- Information that helps confirm that your Windows product key has not been altered +- Computer make and model +- Version information for the operating system and software +- Region and language settings +- A unique number called a *globally unique identifier*, which is assigned to your computer +- Product key (hashed) and product ID +- BIOS name, revision number, and revision date +- Volume serial number (hashed) of the hard disk drive +- The result of the activation check + + This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled: + + - The activation exploit’s identifier + - The activation exploit’s current state, such as cleaned or quarantined + - Computer manufacturer’s identification + - The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit +- The name and a hash of the contents of your computer’s startup instructions file +- If your Windows license is on a subscription basis, information about how your subscription works + +Standard computer information is also sent, but your computer’s IP address is only retained temporarily. + +## Use of information + +Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers. +For additional details, see [Windows 10 Privacy Statement](https://go.microsoft.com/fwlink/p/?LinkId=619879). + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) +  +  diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 9cd6a07136..952db8ab4a 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -1,94 +1,100 @@ ---- -title: Configure Client Computers (Windows 10) -description: Configure Client Computers -ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Configure Client Computers - -To enable the Volume Activation Management Tool (VAMT) to function correctly, certain configuration changes are required on all client computers: - -- An exception must be set in the client computer's firewall. -- A registry key must be created and set properly, for computers in a workgroup; otherwise, Windows® User Account Control (UAC) will not allow remote administrative operations. - -Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows. - -**Important**   -This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](https://go.microsoft.com/fwlink/p/?LinkId=182933). - -## Configuring the Windows Firewall to allow VAMT access - -Enable the VAMT to access client computers using the **Windows Firewall** Control Panel: -1. Open Control Panel and double-click **System and Security**. -2. Click **Windows Firewall**. -3. Click **Allow a program or feature through Windows Firewall**. -4. Click the **Change settings** option. -5. Select the **Windows Management Instrumentation (WMI)** checkbox. -6. Click **OK**. - - **Warning**   - By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below. - -## Configure Windows Firewall to allow VAMT access across multiple subnets - -Enable the VAMT to access client computers across multiple subnets using the **Windows Firewall with Advanced Security** Control Panel: - -![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) - -1. Open the Control Panel and double-click **Administrative Tools**. -2. Click **Windows Firewall with Advanced Security**. -3. Make your changes for each of the following three WMI items, for the applicable Network Profile (Domain, Public, Private): - - Windows Management Instrumentation (ASync-In) - - Windows Management Instrumentation (DCOM-In) - - Windows Management Instrumentation (WMI-In) - -4. In the **Windows Firewall with Advanced Security** dialog box, select **Inbound Rules** from the left-hand panel. - -5. Right-click the desired rule and select **Properties** to open the **Properties** dialog box. - - - On the **General** tab, select the **Allow the connection** checkbox. - - On the **Scope** tab, change the Remote IP Address setting from "Local Subnet" (default) to allow the specific access you need. - - On the **Advanced** tab, verify selection of all profiles that are applicable to the network (Domain or Private/Public). - -In certain scenarios, only a limited set of TCP/IP ports are allowed through a hardware firewall. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is allowed through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically-allocated ports. This is useful if, for example, the hardware firewall only allows traffic in a certain range of ports. -For more info, see [How to configure RPC dynamic port allocation to work with firewalls](https://go.microsoft.com/fwlink/p/?LinkId=182911). - -## Create a registry value for the VAMT to access workgroup-joined computer - -**Caution**   -This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](https://go.microsoft.com/fwlink/p/?LinkId=182912). - -On the client computer, create the following registry key using regedit.exe. - -1. Navigate to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system` -2. Enter the following details: - **Value Name: LocalAccountTokenFilterPolicy** - **Type: DWORD** - **Value Data: 1** - **Note**   - To discover VAMT-manageable Windows computers in workgroups, you must enable network discovery on each client. - -## Deployment options - -There are several options for organizations to configure the WMI firewall exception for computers: -- **Image.** Add the configurations to the master Windows image deployed to all clients. -- **Group Policy.** If the clients are part of a domain, then all clients can be configured using Group Policy. The Group Policy setting for the WMI firewall exception is found in GPMC.MSC at: **Computer Configuration\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Inbound Rules**. -- **Script.** Execute a script using Microsoft System Center Configuration Manager or a third-party remote script execution facility. -- **Manual.** Configure the WMI firewall exception individually on each client. -The above configurations will open an additional port through the Windows Firewall on target computers and should be performed on computers that are protected by a network firewall. In order to allow VAMT to query the up-to-date licensing status, the WMI exception must be maintained. We recommend administrators consult their network security policies and make clear decisions when creating the WMI exception. - -## Related topics - -- [Install and Configure VAMT](install-configure-vamt.md) - - +--- +title: Configure Client Computers (Windows 10) +description: Learn how to configure client computers to enable the Volume Activation Management Tool (VAMT) to function correctly. +ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc +ms.reviewer: +manager: laurawi +author: greg-lindsay +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +ms.date: 04/30/2020 +ms.topic: article +--- + +# Configure Client Computers + +To enable the Volume Activation Management Tool (VAMT) to function correctly, certain configuration changes are required on all client computers: + +- An exception must be set in the client computer's firewall. +- A registry key must be created and set properly, for computers in a workgroup; otherwise, Windows® User Account Control (UAC) will not allow remote administrative operations. + +Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows. + +> [IMPORTANT] +> This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](https://docs.microsoft.com/windows/win32/wmisdk/connecting-to-wmi-remotely-with-vbscript). + +## Configuring the Windows Firewall to allow VAMT access + +Enable the VAMT to access client computers using the **Windows Firewall** Control Panel: + +1. Open Control Panel and double-click **System and Security**. +2. Click **Windows Firewall**. +3. Click **Allow a program or feature through Windows Firewall**. +4. Click the **Change settings** option. +5. Select the **Windows Management Instrumentation (WMI)** checkbox. +6. Click **OK**. + + **Warning**   + By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below. + +## Configure Windows Firewall to allow VAMT access across multiple subnets + +Enable the VAMT to access client computers across multiple subnets using the **Windows Firewall with Advanced Security** Control Panel: + +![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) + +1. Open the Control Panel and double-click **Administrative Tools**. +2. Click **Windows Firewall with Advanced Security**. +3. Make your changes for each of the following three WMI items, for the applicable Network Profile (Domain, Public, Private): + + - Windows Management Instrumentation (ASync-In) + - Windows Management Instrumentation (DCOM-In) + - Windows Management Instrumentation (WMI-In) + +4. In the **Windows Firewall with Advanced Security** dialog box, select **Inbound Rules** from the left-hand panel. + +5. Right-click the desired rule and select **Properties** to open the **Properties** dialog box. + + - On the **General** tab, select the **Allow the connection** checkbox. + - On the **Scope** tab, change the Remote IP Address setting from "Local Subnet" (default) to allow the specific access you need. + - On the **Advanced** tab, verify selection of all profiles that are applicable to the network (Domain or Private/Public). + + In certain scenarios, only a limited set of TCP/IP ports are allowed through a hardware firewall. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is allowed through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically-allocated ports. This is useful if, for example, the hardware firewall only allows traffic in a certain range of ports. + + For more info, see [How to configure RPC dynamic port allocation to work with firewalls](https://support.microsoft.com/help/929851). + +## Create a registry value for the VAMT to access workgroup-joined computer + +> [WARNING]   +> This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](https://support.microsoft.com/help/256986). + +On the client computer, create the following registry key using regedit.exe. + +1. Navigate to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system` +2. Enter the following details: + + - **Value Name: LocalAccountTokenFilterPolicy** + - **Type: DWORD** + - **Value Data: 1** + + > [NOTE] + > To discover VAMT-manageable Windows computers in workgroups, you must enable network discovery on each client. + +## Deployment options + +There are several options for organizations to configure the WMI firewall exception for computers: + +- **Image.** Add the configurations to the master Windows image deployed to all clients. +- **Group Policy.** If the clients are part of a domain, then all clients can be configured using Group Policy. The Group Policy setting for the WMI firewall exception is found in GPMC.MSC at: **Computer Configuration\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Inbound Rules**. +- **Script.** Execute a script using Microsoft Endpoint Configuration Manager or a third-party remote script execution facility. +- **Manual.** Configure the WMI firewall exception individually on each client. + +The above configurations will open an additional port through the Windows Firewall on target computers and should be performed on computers that are protected by a network firewall. In order to allow VAMT to query the up-to-date licensing status, the WMI exception must be maintained. We recommend administrators consult their network security policies and make clear decisions when creating the WMI exception. + +## Related topics + +- [Install and Configure VAMT](install-configure-vamt.md) diff --git a/windows/deployment/volume-activation/images/vamt-known-issue-message.png b/windows/deployment/volume-activation/images/vamt-known-issue-message.png new file mode 100644 index 0000000000..5ce1a31e1f Binary files /dev/null and b/windows/deployment/volume-activation/images/vamt-known-issue-message.png differ diff --git a/windows/deployment/volume-activation/import-export-vamt-data.md b/windows/deployment/volume-activation/import-export-vamt-data.md index 5b77d96564..502813e80e 100644 --- a/windows/deployment/volume-activation/import-export-vamt-data.md +++ b/windows/deployment/volume-activation/import-export-vamt-data.md @@ -1,51 +1,52 @@ ---- -title: Import and Export VAMT Data (Windows 10) -description: Import and Export VAMT Data -ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Import and Export VAMT Data - -You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. -You can import data or export data during the following scenarios: -- Import and merge data from previous versions of VAMT. -- Export data to use to perform proxy activations. - -**Warning**   -Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported. - -## Import VAMT Data - -**To import data into VAMT** -1. Open VAMT. -2. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. -3. In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**. -4. In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully. - -## Export VAMT Data - -Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file: -1. In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products. -2. If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export. -3. In the right-side **Actions** pane on, click **Export list** to open the **Export List** dialog box. -4. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file. -5. Under **Export options**, select one of the following data-type options: - - Export products and product keys - - Export products only - - Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked. -6. If you have selected products to export, select the **Export selected product rows only** check box. -7. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. - -## Related topics - -- [Perform Proxy Activation](proxy-activation-vamt.md) +--- +title: Import and Export VAMT Data (Windows 10) +description: Learn how to use the Volume Activation Management Tool (VAMT) to import product-activation data from a .cilx or .cil file into SQL Server. +ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Import and Export VAMT Data + +You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. +You can import data or export data during the following scenarios: +- Import and merge data from previous versions of VAMT. +- Export data to use to perform proxy activations. + +**Warning**   +Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported. + +## Import VAMT Data + +**To import data into VAMT** +1. Open VAMT. +2. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. +3. In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**. +4. In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully. + +## Export VAMT Data + +Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file: +1. In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products. +2. If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export. +3. In the right-side **Actions** pane on, click **Export list** to open the **Export List** dialog box. +4. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file. +5. Under **Export options**, select one of the following data-type options: + - Export products and product keys + - Export products only + - Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked. +6. If you have selected products to export, select the **Export selected product rows only** check box. +7. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. + +## Related topics + +- [Perform Proxy Activation](proxy-activation-vamt.md) diff --git a/windows/deployment/volume-activation/install-configure-vamt.md b/windows/deployment/volume-activation/install-configure-vamt.md index dc1c9eaa35..f4cff8a4da 100644 --- a/windows/deployment/volume-activation/install-configure-vamt.md +++ b/windows/deployment/volume-activation/install-configure-vamt.md @@ -1,34 +1,35 @@ ---- -title: Install and Configure VAMT (Windows 10) -description: Install and Configure VAMT -ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install and Configure VAMT - -This section describes how to install and configure the Volume Activation Management Tool (VAMT). - -## In this Section - -|Topic |Description | -|------|------------| -|[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. | -|[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. | -|[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. | - -## Related topics - -- [Introduction to VAMT](introduction-vamt.md) -  -  +--- +title: Install and Configure VAMT (Windows 10) +description: Learn how to install and configure the Volume Activation Management Tool (VAMT), and learn where to find information about the process. +ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install and Configure VAMT + +This section describes how to install and configure the Volume Activation Management Tool (VAMT). + +## In this Section + +|Topic |Description | +|------|------------| +|[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. | +|[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. | +|[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. | + +## Related topics + +- [Introduction to VAMT](introduction-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/install-kms-client-key-vamt.md b/windows/deployment/volume-activation/install-kms-client-key-vamt.md index 3fe43074c1..c0458d4963 100644 --- a/windows/deployment/volume-activation/install-kms-client-key-vamt.md +++ b/windows/deployment/volume-activation/install-kms-client-key-vamt.md @@ -1,43 +1,44 @@ ---- -title: Install a KMS Client Key (Windows 10) -description: Install a KMS Client Key -ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install a KMS Client Key - -You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation. - -**Note**   -By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. - -**To install a KMS Client key** -1. Open VAMT. -2. In the left-side pane click **Products** to open the product list view in the center pane. -3. In the products list view in the center pane, select the products that need to have GVLKs installed. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -7. The **Install Product Key** dialog box displays the keys that are available to be installed. -8. Select the **Automatically select an AD or KMS client key** option and then click **Install Key**. - - VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the product list view in the center pane. - -## Related topics - -- [Perform KMS Activation](kms-activation-vamt.md) +--- +title: Install a KMS Client Key (Windows 10) +description: Learn to use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. +ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install a KMS Client Key + +You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation. + +**Note**   +By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. + +**To install a KMS Client key** +1. Open VAMT. +2. In the left-side pane click **Products** to open the product list view in the center pane. +3. In the products list view in the center pane, select the products that need to have GVLKs installed. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +7. The **Install Product Key** dialog box displays the keys that are available to be installed. +8. Select the **Automatically select an AD or KMS client key** option and then click **Install Key**. + + VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + +## Related topics + +- [Perform KMS Activation](kms-activation-vamt.md) diff --git a/windows/deployment/volume-activation/install-product-key-vamt.md b/windows/deployment/volume-activation/install-product-key-vamt.md index 96908f97d1..d83feb6226 100644 --- a/windows/deployment/volume-activation/install-product-key-vamt.md +++ b/windows/deployment/volume-activation/install-product-key-vamt.md @@ -1,45 +1,46 @@ ---- -title: Install a Product Key (Windows 10) -description: Install a Product Key -ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install a Product Key - -You can use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). - -**To install a Product key** -1. Open VAMT. -2. In the left-side pane, click the product that you want to install keys onto. -3. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. -6. In the products list view in the center pane, sort the list if needed and then select the products that need to have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -7. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -8. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAK based on the selected products. You can select a recommended product key or a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key you want to install, click **Install Key**. Note that only one key can be installed at a time. -9. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the product list view in the center pane. - - **Note**   - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right - Volume License Key for Windows](https://go.microsoft.com/fwlink/p/?linkid=238382). - -## Related topics - -- [Manage Product Keys](manage-product-keys-vamt.md) - - +--- +title: Install a Product Key (Windows 10) +description: Learn to use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). +ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install a Product Key + +You can use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). + +**To install a Product key** +1. Open VAMT. +2. In the left-side pane, click the product that you want to install keys onto. +3. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. +6. In the products list view in the center pane, sort the list if needed and then select the products that need to have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +7. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +8. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAK based on the selected products. You can select a recommended product key or a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key you want to install, click **Install Key**. Note that only one key can be installed at a time. +9. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + + **Note**   + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right + Volume License Key for Windows](https://go.microsoft.com/fwlink/p/?linkid=238382). + +## Related topics + +- [Manage Product Keys](manage-product-keys-vamt.md) + + diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 9a229185cc..6b18acd8ae 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -1,74 +1,80 @@ ---- -title: Install VAMT (Windows 10) -description: Install VAMT -ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 03/11/2019 -ms.topic: article ---- - -# Install VAMT - -This topic describes how to install the Volume Activation Management Tool (VAMT). - -## Install VAMT - -You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. - ->[!IMPORTANT] ->VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator.  - ->[!NOTE] ->The VAMT Microsoft Management Console snap-in ships as an x86 package. - -### Requirements - -- [Windows Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access and all updates applied -- [Windows 10, version 1809 ADK](https://go.microsoft.com/fwlink/?linkid=2026036) -- [SQL Server 2017 Express](https://www.microsoft.com/sql-server/sql-server-editions-express) - -### Install SQL Server 2017 Express - -1. Download and open the [SQL Server 2017 Express](https://www.microsoft.com/sql-server/sql-server-editions-express) package. -2. Select **Basic**. -3. Accept the license terms. -4. Enter an install location or use the default path, and then select **Install**. -5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. - ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png) - -### Install VAMT using the ADK - -1. Download and open the [Windows 10, version 1809 ADK](https://go.microsoft.com/fwlink/?linkid=2026036) package. -2. Enter an install location or use the default path, and then select **Next**. -3. Select a privacy setting, and then select **Next**. -4. Accept the license terms. -5. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. (You can select additional features to install as well.) -6. On the completion page, select **Close**. - -### Configure VAMT to connect to SQL Server 2017 Express - -1. Open **Volume Active Management Tool 3.1** from the Start menu. -2. Enter the server instance name and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example. - - ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png) - - - - -## Uninstall VAMT - -To uninstall VAMT using the **Programs and Features** Control Panel: -1. Open **Control Panel** and select **Programs and Features**. -2. Select **Assessment and Deployment Kit** from the list of installed programs and click **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. - - - - +--- +title: Install VAMT (Windows 10) +description: Learn how to install Volume Activation Management Tool (VAMT) as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. +ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 03/11/2019 +ms.topic: article +--- + +# Install VAMT + +This topic describes how to install the Volume Activation Management Tool (VAMT). + +## Install VAMT + +You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. + +>[!IMPORTANT] +>VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator.  + +>[!NOTE] +>The VAMT Microsoft Management Console snap-in ships as an x86 package. + +### Requirements + +- [Windows Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access (for the main VAMT console) and all updates applied +- [Windows 10, version 1903 ADK](https://go.microsoft.com/fwlink/?linkid=2086042) +- Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) version, the latest is recommended +- Alternatively, any supported **full** SQL instance + +### Install SQL Server Express / alternatively use any full SQL instance + +1. Download and open the [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) package. +2. Select **Basic**. +3. Accept the license terms. +4. Enter an install location or use the default path, and then select **Install**. +5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. + + ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png) + +### Install VAMT using the ADK + +1. Download and open the [Windows 10, version 1903 ADK](https://go.microsoft.com/fwlink/?linkid=2086042) package. +Reminder: There won't be new ADK release for 1909. +2. Enter an install location or use the default path, and then select **Next**. +3. Select a privacy setting, and then select **Next**. +4. Accept the license terms. +5. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. (You can select additional features to install as well.) +6. On the completion page, select **Close**. + +### Configure VAMT to connect to SQL Server Express or full SQL Server + +1. Open **Volume Active Management Tool 3.1** from the Start menu. +2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. + + ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png) + +for remote SQL Server use +servername.yourdomain.com + + + +## Uninstall VAMT + +To uninstall VAMT using the **Programs and Features** Control Panel: +1. Open **Control Panel** and select **Programs and Features**. +2. Select **Assessment and Deployment Kit** from the list of installed programs and click **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. + + + + diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md index 791d49e497..45619726e9 100644 --- a/windows/deployment/volume-activation/introduction-vamt.md +++ b/windows/deployment/volume-activation/introduction-vamt.md @@ -1,66 +1,69 @@ ---- -title: Introduction to VAMT (Windows 10) -description: Introduction to VAMT -ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Introduction to VAMT - -The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office®, and select other Microsoft products volume and retail activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in and can be installed on any computer that has one of the following Windows operating systems: Windows® 7, Windows 8, Windows 8.1, Windows 10,Windows Server 2008 R2, or Windows Server 2012. - -**Note**   -VAMT can be installed on, and can manage, physical or virtual instances. VAMT cannot detect whether or not the remote products are virtual. As long as the products can respond to Windows Management Instrumentation (WMI) calls, they will be discovered and activated. - -## In this Topic -- [Managing Multiple Activation Key (MAK) and Retail Activation](#bkmk-managingmak) -- [Managing Key Management Service (KMS) Activation](#bkmk-managingkms) -- [Enterprise Environment](#bkmk-enterpriseenvironment) -- [VAMT User Interface](#bkmk-userinterface) - -## Managing Multiple Activation Key (MAK) and Retail Activation - -You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: -- **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. -- **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. - -## Managing Key Management Service (KMS) Activation - -In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010. -VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. - -## Enterprise Environment - -VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. - -![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) - -In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. -The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. - -## VAMT User Interface - -The following screenshot shows the VAMT graphical user interface. - -![VAMT user interface](images/vamtuserinterfaceupdated.jpg) - -VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: -- **Adding and removing computers.** You can use VAMT to discover computers in the local environment. VAMT can discover computers by querying AD DS, workgroups, by individual computer name or IP address, or via a general LDAP query. -- **Discovering products.** You can use VAMT to discover Windows, Windows Server, Office, and select other products installed on the client computers. -- **Monitoring activation status.** You can collect activation information about each product, including the last 5 characters of the product key being used, the current license state (such as Licensed, Grace, Unlicensed), and the product edition information. -- **Managing product keys.** You can store multiple product keys and use VAMT to install these keys to remote client products. You can also determine the number of activations remaining for MAKs. -- **Managing activation data.** VAMT stores activation data in a SQL database. VAMT can export this data to other VAMT hosts or to an archive in XML format. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) - - +--- +title: Introduction to VAMT (Windows 10) +description: VAMT enables administrators to automate and centrally manage the Windows, Microsoft Office, and select other Microsoft products volume and retail activation process. +ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Introduction to VAMT + +The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office®, and select other Microsoft products volume and retail activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in and can be installed on any computer that has one of the following Windows operating systems: Windows® 7, Windows 8, Windows 8.1, Windows 10,Windows Server 2008 R2, or Windows Server 2012. + +> [!NOTE] +> VAMT can be installed on, and can manage, physical or virtual instances. VAMT cannot detect whether or not the remote products are virtual. As long as the products can respond to Windows Management Instrumentation (WMI) calls, they will be discovered and activated. + +## In this Topic + +- [Managing Multiple Activation Key (MAK) and Retail Activation](#bkmk-managingmak) +- [Managing Key Management Service (KMS) Activation](#bkmk-managingkms) +- [Enterprise Environment](#bkmk-enterpriseenvironment) +- [VAMT User Interface](#bkmk-userinterface) + +## Managing Multiple Activation Key (MAK) and Retail Activation + +You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: + +- **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. +- **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. + +## Managing Key Management Service (KMS) Activation + +In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010.\ +VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. + +## Enterprise Environment + +VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. + +![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) + +In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. +The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. + +## VAMT User Interface + +The following screenshot shows the VAMT graphical user interface. + +![VAMT user interface](images/vamtuserinterfaceupdated.jpg) + +VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: + +- **Adding and removing computers.** You can use VAMT to discover computers in the local environment. VAMT can discover computers by querying AD DS, workgroups, by individual computer name or IP address, or via a general LDAP query. +- **Discovering products.** You can use VAMT to discover Windows, Windows Server, Office, and select other products installed on the client computers. +- **Monitoring activation status.** You can collect activation information about each product, including the last 5 characters of the product key being used, the current license state (such as Licensed, Grace, Unlicensed), and the product edition information. +- **Managing product keys.** You can store multiple product keys and use VAMT to install these keys to remote client products. You can also determine the number of activations remaining for MAKs. +- **Managing activation data.** VAMT stores activation data in a SQL database. VAMT can export this data to other VAMT hosts or to an archive in XML format. + +## Related topics + +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) diff --git a/windows/deployment/volume-activation/kms-activation-vamt.md b/windows/deployment/volume-activation/kms-activation-vamt.md index d109d49ad1..7cd72c2a99 100644 --- a/windows/deployment/volume-activation/kms-activation-vamt.md +++ b/windows/deployment/volume-activation/kms-activation-vamt.md @@ -1,49 +1,50 @@ ---- -title: Perform KMS Activation (Windows 10) -description: Perform KMS Activation -ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform KMS Activation - -The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). You can use VAMT to activate Generic Volume Licensing Keys, or KMS client keys, on products accessible to VAMT. GVLKs are the default product keys used by the volume-license editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft Office 2010. GVLKs are already installed in volume-license editions of these products. - -## Requirements - -Before configuring KMS activation, ensure that your network and VAMT installation meet the following requirements: -- KMS host is set up and enabled. -- KMS clients can access the KMS host. -- VAMT is installed on a central computer with network access to all client computers. -- The products to be activated have been added to VAMT. For more information on adding product keys, see [Install a KMS Client Key](install-kms-client-key-vamt.md). -- VAMT has administrative permissions on all computers to be activated, and Windows Management Instrumentation (WMI) is accessible through the Windows Firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -## To configure devices for KMS activation - -**To configure devices for KMS activation** -1. Open VAMT. -2. If necessary, set up the KMS activation preferences. If you don’t need to set up the preferences, skip to step 6 in this procedure. Otherwise, continue to step 2. -3. To set up the preferences, on the menu bar click **View**, then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. -4. Under **Key Management Services host selection**, select one of the following options: - - **Find a KMS host automatically using DNS (default)**. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the Domain Name Service (DNS) to locate a KMS host and attempt activation. - - **Find a KMS host using DNS in this domain for supported products**. Enter the domain name. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the DNS in the specified domain to locate a KMS host and attempt activation. - - **Use specific KMS host**. Enter the KMS host name and KMS host port. For environments which do not use DNS for KMS host identification, VAMT sets the specified KMS host name and KMS host port on the target computer, and then instructs the computer to attempt activation with the specific KMS host. -5. Click **Apply**, and then click **OK** to close the **Volume Activation Management Tool Preferences** dialog box. -6. Select the products to be activated by selecting individual products in the product list view in the center pane. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -7. Click **Filter**. VAMT displays the filtered list in the center pane. -8. In the right-side pane, click **Activate** in the **Selected Items** menu, and then click **Volume activate**. -9. Click a credential option. Choose **Alternate credentials** only if you are activating products that require administrator credentials different from the ones you are currently using. -10. If you are supplying alternate credentials, at the prompt, type the appropriate user name and password and click **OK**. -VAMT displays the **Volume Activation** dialog box until it completes the requested action. When the process is finished, the updated activation status of each product appears in the product list view in the center pane. -  +--- +title: Perform KMS Activation (Windows 10) +description: The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). +ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform KMS Activation + +The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). You can use VAMT to activate Generic Volume Licensing Keys, or KMS client keys, on products accessible to VAMT. GVLKs are the default product keys used by the volume-license editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft Office 2010. GVLKs are already installed in volume-license editions of these products. + +## Requirements + +Before configuring KMS activation, ensure that your network and VAMT installation meet the following requirements: +- KMS host is set up and enabled. +- KMS clients can access the KMS host. +- VAMT is installed on a central computer with network access to all client computers. +- The products to be activated have been added to VAMT. For more information on adding product keys, see [Install a KMS Client Key](install-kms-client-key-vamt.md). +- VAMT has administrative permissions on all computers to be activated, and Windows Management Instrumentation (WMI) is accessible through the Windows Firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +## To configure devices for KMS activation + +**To configure devices for KMS activation** +1. Open VAMT. +2. If necessary, set up the KMS activation preferences. If you don’t need to set up the preferences, skip to step 6 in this procedure. Otherwise, continue to step 2. +3. To set up the preferences, on the menu bar click **View**, then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. +4. Under **Key Management Services host selection**, select one of the following options: + - **Find a KMS host automatically using DNS (default)**. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the Domain Name Service (DNS) to locate a KMS host and attempt activation. + - **Find a KMS host using DNS in this domain for supported products**. Enter the domain name. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the DNS in the specified domain to locate a KMS host and attempt activation. + - **Use specific KMS host**. Enter the KMS host name and KMS host port. For environments which do not use DNS for KMS host identification, VAMT sets the specified KMS host name and KMS host port on the target computer, and then instructs the computer to attempt activation with the specific KMS host. +5. Click **Apply**, and then click **OK** to close the **Volume Activation Management Tool Preferences** dialog box. +6. Select the products to be activated by selecting individual products in the product list view in the center pane. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +7. Click **Filter**. VAMT displays the filtered list in the center pane. +8. In the right-side pane, click **Activate** in the **Selected Items** menu, and then click **Volume activate**. +9. Click a credential option. Choose **Alternate credentials** only if you are activating products that require administrator credentials different from the ones you are currently using. +10. If you are supplying alternate credentials, at the prompt, type the appropriate user name and password and click **OK**. +VAMT displays the **Volume Activation** dialog box until it completes the requested action. When the process is finished, the updated activation status of each product appears in the product list view in the center pane. +  diff --git a/windows/deployment/volume-activation/local-reactivation-vamt.md b/windows/deployment/volume-activation/local-reactivation-vamt.md index 309dd5a702..727fe608a7 100644 --- a/windows/deployment/volume-activation/local-reactivation-vamt.md +++ b/windows/deployment/volume-activation/local-reactivation-vamt.md @@ -1,47 +1,48 @@ ---- -title: Perform Local Reactivation (Windows 10) -description: Perform Local Reactivation -ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Local Reactivation - -If you reinstall Windows® or Microsoft® Office 2010 on a computer that was initially activated using proxy activation (MAK, retail, or CSLVK (KMS host)), and have not made significant changes to the hardware, use this local reactivation procedure to reactivate the program on that computer. -Local reactivation relies upon data that was created during the initial proxy activation and stored in the Volume Activation Management Tool (VAMT) database. The database contains the installation ID (IID) and confirmation ID (Pending CID). Local reactivation uses this data to reapply the CID and reactivate those products. Reapplying the same CID conserves the remaining activations on the key. - -**Note**   -During the initial proxy activation, the CID is bound to a digital “fingerprint”, which is calculated from values assigned to several different hardware components in the computer. If the computer has had significant hardware changes, this fingerprint will no longer match the CID. In this case, you must obtain a new CID for the computer from Microsoft. - -## To Perform a Local Reactivation - -**To perform a local reactivation** -1. Open VAMT. Make sure that you are connected to the desired database. -2. In the left-side pane, click the product you want to reactivate to display the products list. -3. In the product list view in the center pane, select the desired products to be reactivated. You can sort the list by computer name by clicking on the **Computer Name** heading. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. In the right-side pane, click **Activate**, and then click **Apply Confirmation ID**. -7. Click a credential option. Choose **Alternate credentials** only if you are reactivating products that require administrator credentials different from the ones you are currently using. -8. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. - - VAMT displays the **Apply Confirmation ID** dialog box. - -10. If you are using a different product key than the product key used for initial activation, you must complete a new activation to obtain a new CID. -11. If you are activating a product that requires administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** check box. -12. Click **OK**. - -## Related topics - -- [Manage Activations](manage-activations-vamt.md) +--- +title: Perform Local Reactivation (Windows 10) +description: An initially activated a computer using scenarios like MAK, retail, or CSLVK (KMS host), can be reactivated with Volume Activation Management Tool (VAMT). +ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Local Reactivation + +If you reinstall Windows® or Microsoft® Office 2010 on a computer that was initially activated using proxy activation (MAK, retail, or CSLVK (KMS host)), and have not made significant changes to the hardware, use this local reactivation procedure to reactivate the program on that computer. +Local reactivation relies upon data that was created during the initial proxy activation and stored in the Volume Activation Management Tool (VAMT) database. The database contains the installation ID (IID) and confirmation ID (Pending CID). Local reactivation uses this data to reapply the CID and reactivate those products. Reapplying the same CID conserves the remaining activations on the key. + +**Note**   +During the initial proxy activation, the CID is bound to a digital “fingerprint”, which is calculated from values assigned to several different hardware components in the computer. If the computer has had significant hardware changes, this fingerprint will no longer match the CID. In this case, you must obtain a new CID for the computer from Microsoft. + +## To Perform a Local Reactivation + +**To perform a local reactivation** +1. Open VAMT. Make sure that you are connected to the desired database. +2. In the left-side pane, click the product you want to reactivate to display the products list. +3. In the product list view in the center pane, select the desired products to be reactivated. You can sort the list by computer name by clicking on the **Computer Name** heading. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. In the right-side pane, click **Activate**, and then click **Apply Confirmation ID**. +7. Click a credential option. Choose **Alternate credentials** only if you are reactivating products that require administrator credentials different from the ones you are currently using. +8. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. + + VAMT displays the **Apply Confirmation ID** dialog box. + +10. If you are using a different product key than the product key used for initial activation, you must complete a new activation to obtain a new CID. +11. If you are activating a product that requires administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** check box. +12. Click **OK**. + +## Related topics + +- [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deployment/volume-activation/manage-activations-vamt.md b/windows/deployment/volume-activation/manage-activations-vamt.md index 318cd0cb65..e1e2f2151e 100644 --- a/windows/deployment/volume-activation/manage-activations-vamt.md +++ b/windows/deployment/volume-activation/manage-activations-vamt.md @@ -1,33 +1,34 @@ ---- -title: Manage Activations (Windows 10) -description: Manage Activations -ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage Activations - -This section describes how to activate a client computer, by using a variety of activation methods. - -## In this Section - -|Topic |Description | -|------|------------| -|[Perform Online Activation](online-activation-vamt.md) |Describes how to activate a client computer over the Internet. | -|[Perform Proxy Activation](proxy-activation-vamt.md) |Describes how to perform volume activation for client products that do not have Internet access. | -|[Perform KMS Activation](kms-activation-vamt.md) |Describes how perform volume activation using the Key Management Service (KMS). | -|[Perform Local Reactivation](local-reactivation-vamt.md) |Describes how to reactivate an operating system or Office program that was reinstalled. | -|[Activate an Active Directory Forest Online](activate-forest-vamt.md) |Describes how to use Active Directory-Based Activation to online activate an Active Directory forest. | -|[Activate by Proxy an Active Directory Forest](activate-forest-by-proxy-vamt.md) |Describes how to use Active Directory-Based Activation to proxy activate an Active Directory forest that is not connected to the Internet. | - - - +--- +title: Manage Activations (Windows 10) +description: Learn how to manage activations and how to activate a client computer by using a variety of activation methods. +ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage Activations + +This section describes how to activate a client computer, by using a variety of activation methods. + +## In this Section + +|Topic |Description | +|------|------------| +|[Perform Online Activation](online-activation-vamt.md) |Describes how to activate a client computer over the Internet. | +|[Perform Proxy Activation](proxy-activation-vamt.md) |Describes how to perform volume activation for client products that do not have Internet access. | +|[Perform KMS Activation](kms-activation-vamt.md) |Describes how perform volume activation using the Key Management Service (KMS). | +|[Perform Local Reactivation](local-reactivation-vamt.md) |Describes how to reactivate an operating system or Office program that was reinstalled. | +|[Activate an Active Directory Forest Online](activate-forest-vamt.md) |Describes how to use Active Directory-Based Activation to online activate an Active Directory forest. | +|[Activate by Proxy an Active Directory Forest](activate-forest-by-proxy-vamt.md) |Describes how to use Active Directory-Based Activation to proxy activate an Active Directory forest that is not connected to the Internet. | + + + diff --git a/windows/deployment/volume-activation/manage-product-keys-vamt.md b/windows/deployment/volume-activation/manage-product-keys-vamt.md index bedd50af8f..1eb0380671 100644 --- a/windows/deployment/volume-activation/manage-product-keys-vamt.md +++ b/windows/deployment/volume-activation/manage-product-keys-vamt.md @@ -1,29 +1,30 @@ ---- -title: Manage Product Keys (Windows 10) -description: Manage Product Keys -ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage Product Keys - -This section describes how to add and remove a product key from the Volume Activation Management Tool (VAMT). After you add a product key to VAMT, you can install that product key on a product or products you select in the VAMT database. -## In this Section - -|Topic |Description | -|------|------------| -|[Add and Remove a Product Key](add-remove-product-key-vamt.md) |Describes how to add a product key to the VAMT database. | -|[Install a Product Key](install-product-key-vamt.md) |Describes how to install a product key for specific product. | -|[Install a KMS Client Key](install-kms-client-key-vamt.md) |Describes how to install a GVLK (KMS client) key. | - - - +--- +title: Manage Product Keys (Windows 10) +description: In this article, learn how to add and remove a product key from the Volume Activation Management Tool (VAMT). +ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage Product Keys + +This section describes how to add and remove a product key from the Volume Activation Management Tool (VAMT). After you add a product key to VAMT, you can install that product key on a product or products you select in the VAMT database. +## In this Section + +|Topic |Description | +|------|------------| +|[Add and Remove a Product Key](add-remove-product-key-vamt.md) |Describes how to add a product key to the VAMT database. | +|[Install a Product Key](install-product-key-vamt.md) |Describes how to install a product key for specific product. | +|[Install a KMS Client Key](install-kms-client-key-vamt.md) |Describes how to install a GVLK (KMS client) key. | + + + diff --git a/windows/deployment/volume-activation/manage-vamt-data.md b/windows/deployment/volume-activation/manage-vamt-data.md index 7d068975cd..6f2f8b2dd0 100644 --- a/windows/deployment/volume-activation/manage-vamt-data.md +++ b/windows/deployment/volume-activation/manage-vamt-data.md @@ -1,25 +1,26 @@ ---- -title: Manage VAMT Data (Windows 10) -description: Manage VAMT Data -ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage VAMT Data - -This section describes how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). - -## In this Section -|Topic |Description | -|------|------------| -|[Import and Export VAMT Data](import-export-vamt-data.md) |Describes how to import and export VAMT data. | -|[Use VAMT in Windows PowerShell](use-vamt-in-windows-powershell.md) |Describes how to access Windows PowerShell and how to import the VAMT PowerShell module. | +--- +title: Manage VAMT Data (Windows 10) +description: Learn how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). +ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage VAMT Data + +This section describes how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). + +## In this Section +|Topic |Description | +|------|------------| +|[Import and Export VAMT Data](import-export-vamt-data.md) |Describes how to import and export VAMT data. | +|[Use VAMT in Windows PowerShell](use-vamt-in-windows-powershell.md) |Describes how to access Windows PowerShell and how to import the VAMT PowerShell module. | diff --git a/windows/deployment/volume-activation/monitor-activation-client.md b/windows/deployment/volume-activation/monitor-activation-client.md index ea131b996d..143855e843 100644 --- a/windows/deployment/volume-activation/monitor-activation-client.md +++ b/windows/deployment/volume-activation/monitor-activation-client.md @@ -1,44 +1,45 @@ ---- -title: Monitor activation (Windows 10) -ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 -ms.reviewer: -manager: laurawi -ms.author: greglin -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Monitor activation - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -You can monitor the success of the activation process for a computer running Windows in several ways. The most popular methods include: -- Using the Volume Licensing Service Center website to track use of MAK keys. -- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](https://technet.microsoft.com/library/ff793433.aspx).) -- Viewing the licensing status, which is exposed through Windows Management Instrumentation (WMI); therefore, it is available to non-Microsoft or custom tools that can access WMI. (Windows PowerShell can also access WMI information.) -- Most licensing actions and events are recorded in the Event log (ex: Application Log events 12288-12290). -- Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager. -- See [Troubleshooting activation error codes](https://docs.microsoft.com/windows-server/get-started/activation-error-codes) for information about troubleshooting procedures for Multiple Activation Key (MAK) or the Key Management Service (KMS). -- The VAMT provides a single site from which to manage and monitor volume activations. This is explained in the next section. - -## See also - -[Volume Activation for Windows 10](volume-activation-windows-10.md) +--- +title: Monitor activation (Windows 10) +ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Monitor activation + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +You can monitor the success of the activation process for a computer running Windows in several ways. The most popular methods include: +- Using the Volume Licensing Service Center website to track use of MAK keys. +- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](https://technet.microsoft.com/library/ff793433.aspx).) +- Viewing the licensing status, which is exposed through Windows Management Instrumentation (WMI); therefore, it is available to non-Microsoft or custom tools that can access WMI. (Windows PowerShell can also access WMI information.) +- Most licensing actions and events are recorded in the Event log (ex: Application Log events 12288-12290). +- Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager. +- See [Troubleshooting activation error codes](https://docs.microsoft.com/windows-server/get-started/activation-error-codes) for information about troubleshooting procedures for Multiple Activation Key (MAK) or the Key Management Service (KMS). +- The VAMT provides a single site from which to manage and monitor volume activations. This is explained in the next section. + +## See also + +[Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/online-activation-vamt.md b/windows/deployment/volume-activation/online-activation-vamt.md index 45f237024f..96d0e8abdd 100644 --- a/windows/deployment/volume-activation/online-activation-vamt.md +++ b/windows/deployment/volume-activation/online-activation-vamt.md @@ -1,55 +1,56 @@ ---- -title: Perform Online Activation (Windows 10) -description: Perform Online Activation -ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Online Activation - -You can use the Volume Activation Management Tool (VAMT) to enable client products to be activated over the Internet. You can install the client products with any kind of product key that is eligible for online activation—Multiple Activation Key (MAK), retail, and Windows Key Management Services (KMS) host key. - -## Requirements - -Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: -- VAMT is installed on a central computer that has network access to all client computers. -- Both the VAMT host and client computers have Internet access. -- The products that you want to activate are added to VAMT. -- VAMT has administrative permissions on all computers that you intend to activate, and that Windows Management Instrumentation (WMI) can be accessed through the Windows firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking -**Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. - -## To Perform an Online Activation - -**To perform an online activation** -1. Open VAMT. -2. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. Select the products that you want to activate. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -6. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane and then point to **Activate**. If the **Actions** pane is not displayed, click the Show/Hide Action Pane button, which is located on the toolbar to the right of the Help button. -7. Point to **Online activate**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. -8. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the products list view in the center pane. - - **Note**   - Online activation does not enable you to save the Confirmation IDs (CIDs). As a result, you cannot perform local reactivation. - - **Note** - You can use online activation to select products that have different key types and activate the products at the same time. - -## Related topics -- [Manage Activations](manage-activations-vamt.md) +--- +title: Perform Online Activation (Windows 10) +description: Learn how to use the Volume Activation Management Tool (VAMT) to enable client products to be activated online. +ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Online Activation + +You can use the Volume Activation Management Tool (VAMT) to enable client products to be activated over the Internet. You can install the client products with any kind of product key that is eligible for online activation—Multiple Activation Key (MAK), retail, and Windows Key Management Services (KMS) host key. + +## Requirements + +Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: +- VAMT is installed on a central computer that has network access to all client computers. +- Both the VAMT host and client computers have Internet access. +- The products that you want to activate are added to VAMT. +- VAMT has administrative permissions on all computers that you intend to activate, and that Windows Management Instrumentation (WMI) can be accessed through the Windows firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking +**Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + +## To Perform an Online Activation + +**To perform an online activation** +1. Open VAMT. +2. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. Select the products that you want to activate. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +6. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane and then point to **Activate**. If the **Actions** pane is not displayed, click the Show/Hide Action Pane button, which is located on the toolbar to the right of the Help button. +7. Point to **Online activate**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. +8. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + + **Note**   + Online activation does not enable you to save the Confirmation IDs (CIDs). As a result, you cannot perform local reactivation. + + **Note** + You can use online activation to select products that have different key types and activate the products at the same time. + +## Related topics +- [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index c5c02eb7d8..6ced1398db 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -1,232 +1,232 @@ ---- -title: Plan for volume activation (Windows 10) -description: Product activation is the process of validating software with the manufacturer after it has been installed on a specific computer. -ms.assetid: f84b005b-c362-4a70-a84e-4287c0d2e4ca -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 09/27/2017 -ms.topic: article ---- - -# Plan for volume activation - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -*Product activation* is the process of validating software with the manufacturer after it has been installed on a specific computer. Activation confirms that the product is genuine—not a fraudulent copy—and that the product key or serial number is valid and has not been compromised or revoked. Activation also establishes a link or relationship between the product key and the particular installation. - -During the activation process, information about the specific installation is examined. In the case of online activations, this information is sent to a server at Microsoft. This information may include the software version, the product key, the IP address of the computer, and information about the device. The activation methods that Microsoft uses are designed to help protect user privacy, and they cannot be used to track back to the computer or user. The gathered data confirms that the software is a legally licensed copy, and this data is used for statistical analysis. Microsoft does not use this information to identify or contact the user or the organization. - ->[!NOTE] ->The IP address is used only to verify the location of the request, because some editions of Windows (such as “Starter” editions) can only be activated within certain geographical target markets. - -## Distribution channels and activation - -In general, Microsoft software is obtained through three main channels: retail, original equipment manufacturer (OEM), and volume licensing agreements. Different activations methods are available through each channel. Because organizations are free to obtain software through multiple channels (for example, buying some at retail and others through a volume licensing program) most organizations choose to use a combination of activation methods. - -### Retail activations - -The retail activation method has not changed in several versions of Windows and Windows Server. Each purchased copy comes with one unique product key (often referred to as a retail key). The user enters this key during product installation. The computer uses this retail key to complete the activation after the installation is complete. Most activations are performed online, but telephone activation is also available. -Recently, retail keys have been expanded into new distribution scenarios. Product key cards are available to activate products that have been preinstalled or downloaded. Programs such as Windows Anytime Upgrade and Get Genuine allow users to acquire legal keys separately from the software. These electronically distributed keys may come with media that contains software, they can come as a software shipment, or they may be provided on a printed card or electronic copy. Products are activated the same way with any of these retail keys. - -### Original equipment manufacturer - -Most original equipment manufacturers (OEMs) sell systems that include a standard build of the Windows operating system. The hardware vendor activates Windows by associating the operating system with the firmware (BIOS) of the computer. This occurs before the computer is sent to the customer, and no additional actions are required. -OEM activation is valid as long as the customer uses the OEM-provided image on the system. OEM activation is available only for computers that are purchased through OEM channels and have the Windows operating system preinstalled. - -### Volume licensing - -Volume licensing offers customized programs that are tailored to the size and purchasing preference of the organization. To become a volume licensing customer, the organization must set up a volume licensing agreement with Microsoft.There is a common misunderstanding about acquiring licenses for a new computer through volume licensing. There are two legal ways to acquire a full Windows client license for a new computer: -- Have the license preinstalled through the OEM. -- Purchase a fully packaged retail product. - -The licenses that are provided through volume licensing programs such as Open License, Select License, and Enterprise Agreements cover upgrades to Windows client operating systems only. An existing retail or OEM operating system license is needed for each computer running Windows 10, Windows 8.1 Pro, Windows 8 Pro, Windows 7 Professional or Ultimate, or Windows XP Professional before the upgrade rights obtained through volume licensing can be exercised. -Volume licensing is also available through certain subscription or membership programs, such as the Microsoft Partner Network and MSDN. These volume licenses may contain specific restrictions or other changes to the general terms applicable to volume licensing. - -**Note**   -Some editions of the operating system, such as Windows 10 Enterprise, and some editions of application software are available only through volume licensing agreements or subscriptions. - -## Activation models - -For a user or IT department, there are no significant choices about how to activate products that are acquired through retail or OEM channels. The OEM performs the activation at the factory, and the user or the IT department need take no activation steps. - -With a retail product, the Volume Activation Management Tool (VAMT), which is discussed later in this guide, helps you track and manage keys. For each retail activation, you can choose: -- Online activation -- Telephone activation -- VAMT proxy activation - -Telephone activation is primarily used in situations where a computer is isolated from all networks. VAMT proxy activation (with retail keys) is sometimes used when an IT department wants to centralize retail activations or when a computer with a retail version of the operating system is isolated from the Internet but connected to the LAN. For volume-licensed products, however, you must determine the best method or combination of methods to use in your environment. For Windows 10 Pro and Enterprise, you can choose from three models: -- MAKs -- KMS -- Active Directory-based activation - -**Note**   -A specialized method, Token-based activation, is available for specific situations when approved customers rely on a public key infrastructure in a completely isolated, and usually high-security, environment. For more information, contact your Microsoft Account Team or your service representative. -Token-based Activation option is available for Windows 10 Enterprise LTSB editions (Version 1507 and 1607). - -### Multiple activation key - -A Multiple Activation Key (MAK) is commonly used in small- or mid-sized organizations that have a volume licensing agreement, but they do not meet the requirements to operate a KMS or they prefer a simpler approach. A MAK also -allows permanent activation of computers that are isolated from the KMS or are part of an isolated network that does not have enough computers to use the KMS. - -To use a MAK, the computers to be activated must have a MAK installed. The MAK is used for one-time activation with the Microsoft online hosted activation services, by telephone, or by using VAMT proxy activation. -In the simplest terms, a MAK acts like a retail key, except that a MAK is valid for activating multiple computers. Each MAK can be used a specific number of times. The VAMT can assist in tracking the number of activations that have been performed with each key and how many remain. - -Organizations can download MAK and KMS keys from the [Volume Licensing Service Center](https://go.microsoft.com/fwlink/p/?LinkId=618213) website. Each MAK has a preset number of activations, which are based on a percentage of the count of licenses the organization purchases; however, you can increase the number of activations that are available with your MAK by calling Microsoft. - -### Key Management Service - -With the Key Management Service (KMS), IT pros can complete activations on their local network, eliminating the need for individual computers to connect to Microsoft for product activation. The KMS is a lightweight service that does not require a dedicated system and can easily be cohosted on a system that provides other services. - -Volume editions of Windows 10 and Windows Server 2012 R2 (in addition to volume editions of operating system editions since Windows Vista and Windows Server 2008) automatically connect to a system that hosts the KMS to request activation. No action is required from the user. - -The KMS requires a minimum number of computers (physical computers or virtual machines) in a network environment. The organization must have at least five computers to activate Windows Server 2012 R2 and at least 25 computers to activate client computers that are running Windows 10. These minimums are referred to as *activation thresholds*. - -Planning to use the KMS includes selecting the best location for the KMS host and how many KMS hosts to have. One KMS host can handle a large number of activations, but organizations will often deploy two KMS hosts to ensure availability. Only rarely would more than two KMS hosts be used. The KMS can be hosted on a client computer or on a server, and it can be run on older versions of the operating system if proper configuration steps are taken. Setting up your KMS is discussed later in this guide. - -### Active Directory-based activation - -Active Directory-based activation is the newest type of volume activation, and it was introduced in Windows 8. In many ways, Active Directory-based activation is similar to activation by using the KMS, but the activated computer does not need to maintain periodic connectivity with the KMS host. Instead, a domain-joined computer running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 queries AD DS for a volume activation object that is stored in the domain. The operating system checks the digital signatures that are contained in the activation object, and then activates the device. - -Active Directory-based activation allows enterprises to activate computers through a connection to their domain. Many companies have computers at remote or branch locations, where it is impractical to connect to a KMS, or would not reach the KMS activation threshold. Rather than use MAKs, Active Directory-based activation provides a way to activate computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 as long as the computers can contact the company’s domain. Active Directory-based activation offers the advantage of extending volume activation services everywhere you already have a domain presence. - -## Network and connectivity - -A modern business network has many nuances and interconnections. This section examines evaluating your network and the connections that are available to determine how volume activations will occur. - -### Core network - -Your core network is that part of your network that enjoys stable, high-speed, reliable connectivity to infrastructure servers. In many cases, the core network is also connected to the Internet, although that is not a requirement to use the KMS or Active Directory-based activation after the KMS server or AD DS is configured and active. Your core network likely consists of many network segments. In many organizations, the core network makes up the vast majority of the business network. - -In the core network, a centralized KMS solution is usually recommended. You can also use Active Directory-based activation, but in many organizations, KMS will still be required to activate older client computers and computers that are not joined to the domain. Some administrators prefer to run both solutions to have the most flexibility, while others prefer to choose only a KMS-based solution for simplicity. Active Directory-based activation as the only solution is workable if all of the clients in your organization are running Windows 10, Windows 8.1, or Windows 8. - -A typical core network that includes a KMS host is shown in Figure 1. - -![Typical core network](../images/volumeactivationforwindows81-01.jpg) - -**Figure 1**. Typical core network - -### Isolated networks - -In a large network, it is all but guaranteed that some segments will be isolated, either for security reasons or because of geography or connectivity issues. - -**Isolated for security** - -Sometimes called a *high-security zone*, a particular network segment may be isolated from the core network by a firewall or disconnected from other networks totally. The best solution for activating computers in an isolated network depends on the security policies in place in the organization. - -If the isolated network can access the core network by using outbound requests on TCP port 1688, and it is allowed to receive remote procedure calls (RPCs), you can perform activation by using the KMS in the core network, thereby avoiding the need to reach additional activation thresholds. - -If the isolated network participates fully in the corporate forest, and it can make typical connections to domain controllers, such as using Lightweight Directory Access Protocol (LDAP) for queries and Domain Name Service (DNS) for name resolution, this is a good opportunity to use Active Directory-based activation for Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, and Windows Server 2012 R2. - -If the isolated network cannot communicate with the core network’s KMS server, and it cannot use Active Directory-based activation, you can set up a KMS host in the isolated network. This configuration is shown in Figure 2. However, if the isolated network contains only a few computers, it will not reach the KMS activation threshold. In that case, you can activate by using MAKs. - -If the network is fully isolated, MAK-independent activation would be the recommended choice, perhaps using the telephone option. But VAMT proxy activation may also be possible. You can also use MAKs to activate new computers during setup, before they are placed in the isolated network. - -![New KMS host in an isolated network](../images/volumeactivationforwindows81-02.jpg) - -**Figure 2**. New KMS host in an isolated network - -**Branch offices and distant networks** -From mining operations to ships at sea, organizations often have a few computers that are not easily connected to the core network or the Internet. Some organizations have network segments at branch offices that are large and well-connected internally, but have a slow or unreliable WAN link to the rest of the organization. In these situations, you have several options: -- **Active Directory-based activation**. In any site where the client computers are running Windows 10, Active Directory-based activation is supported, and it can be activated by joining the domain. -- **Local KMS**. If a site has 25 or more client computers, it can activate against a local KMS server. -- **Remote (core) KMS**. If the remote site has connectivity to an existing KMS (perhaps through a virtual private network (VPN) to the core network), that KMS can be used. Using the existing KMS means that you only need to meet the activation threshold on that server. -- **MAK activation**. If the site has only a few computers and no connectivity to an existing KMS host, MAK activation is the best option. - -### Disconnected computers - -Some users may be in remote locations or may travel to many locations. This scenario is common for roaming clients, such as the computers that are used by salespeople or other users who are offsite but not at branch locations. This scenario can also apply to remote branch office locations that have no connection to the core network. You can consider this an “isolated network,” where the number of computers is one. Disconnected computers can use Active Directory-based activation, the KMS, or MAK depending on the client version and how often the computers connect to the core network. -If the computer is joined to the domain and running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 8, you can use Active Directory-based activation—directly or through a VPN—at least once every 180 days. If the computer connects to a network with a KMS host at least every 180 days, but it does not support Active Directory-based activation, you can use KMS activation. Otherwise for computers that rarely or never connect to the network, use MAK independent activation (by using the telephone or the Internet). - -### Test and development labs - -Lab environments often have large numbers of virtual machines, and physical computers and virtual machines in labs are reconfigured frequently. Therefore, first determine whether the computers in test and development labs require activation. Editions of Windows 10 that include volume licensing will operate normally, even if they cannot activate immediately. -If you have ensured that your test or development copies of the operating system are within the license agreement, you may not need to activate the lab computers if they will be rebuilt frequently. If you require that the lab computers be activated, treat the lab as an isolated network and use the methods described earlier in this guide. -In labs that have a high turnover of computers and a small number of KMS clients, you must monitor the KMS activation count. You might need to adjust the time that the KMS caches the activation requests. The default is 30 days. - -## Mapping your network to activation methods - -Now it’s time to assemble the pieces into a working solution. By evaluating your network connectivity, the numbers of computers you have at each site, and the operating system versions in use in your environment, you have collected the information you need to determine which activation methods will work best for you. You can fill-in information in Table 1 to help you make this determination. - -**Table 1**. Criteria for activation methods - -|Criterion |Activation method | -|----------|------------------| -|Number of domain-joined computers that support Active Directory-based activation (computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2) and will connect to a domain controller at least every 180 days. Computers can be mobile, semi-isolated, or located in a branch office or the core network. |Active Directory-based activation | -|Number of computers in the core network that will connect (directly or through a VPN) at least every 180 days

              Note
              The core network must meet the KMS activation threshold. |KMS (central) | -|Number of computers that do not connect to the network at least once every 180 days (or if no network meets the activation threshold) |MAM | -|Number of computers in semi-isolated networks that have connectivity to the KMS in the core network |KMS (central) | -|Number of computers in isolated networks where the KMS activation threshold is met |KMS (local) | -|Number of computers in isolated networks where the KMS activation threshold is not met |MAK | -|Number of computers in test and development labs that will not be activated |None| -|Number of computers that do not have a retail volume license |Retail (online or phone) | -|Number of computers that do not have an OEM volume license |OEM (at factory) | -|Total number of computer activations

              Note
              This total should match the total number of licensed computers in your organization. | - -## Choosing and acquiring keys - -When you know which keys you need, you must obtain them. Generally speaking, volume licensing keys are collected in two ways: -- Go to the **Product Keys** section of the [Volume Licensing Service Center](https://go.microsoft.com/fwlink/p/?LinkID=618213) for the following agreements: Open, Open Value, Select, Enterprise, and Services Provider License. -- Contact your [Microsoft Activation Center](https://go.microsoft.com/fwlink/p/?LinkId=618264). - -### KMS host keys - -A KMS host needs a key that activates, or authenticates, the KMS host with Microsoft. This key is usually referred to as the *KMS host key*, but it is formally known as a *Microsoft Customer Specific Volume License Key* (CSVLK). Most documentation and Internet references earlier than Windows 8.1 use the term KMS key, but CSVLK is becoming more common in current documentation and management tools. - -A KMS host running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 can activate both Windows Server and Windows client operating systems. A KMS host key is also needed to create the activation objects in AD DS, as described later in this guide. You will need a KMS host key for any KMS that you want to set up and if you are going to use Active Directory-based activation. - -### Generic volume licensing keys - -When you create installation media or images for client computers that will be activated by KMS or Active Directory-based activation, install a generic volume license key (GVLK) for the edition of Windows you are creating. GVLKs are also referred to as KMS client setup keys. - -Installation media from Microsoft for Enterprise editions of the Windows operating system may already contain the GVLK. One GVLK is available for each type of installation. Note that the GLVK will not activate the software against Microsoft activation servers, only against a KMS or Active Directory-based activation object. In other words, the GVLK does not work unless a valid KMS host key can be found. GVLKs are the only product keys that do not need to be kept confidential. - -Typically, you will not need to manually enter a GVLK unless a computer has been activated with a MAK or a retail key and it is being converted to a KMS activation or to Active Directory-based activation. If you need to locate the GVLK for a particular client edition, see [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx). - -### Multiple activation keys - -You will also need MAK keys with the appropriate number of activations available. You can see how many times a MAK has been used on the Volume Licensing Service Center website or in the VAMT. - -## Selecting a KMS host - -The KMS does not require a dedicated server. It can be cohosted with other services, such as AD DS domain controllers and read-only domain controllers. -KMS hosts can run on physical computers or virtual machines that are running any supported Windows operating system. A KMS host that is running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 can activate any Windows client or server operating system that supports volume activation. A KMS host that is running Windows 10 can activate only computers running Windows 10, Windows 8.1, Windows 8, Windows 7, or Windows Vista. -A single KMS host can support unlimited numbers of KMS clients, but Microsoft recommends deploying a minimum of two KMS hosts for failover purposes. However, as more clients are activated through Active Directory-based activation, the KMS and the redundancy of the KMS will become less important. Most organizations can use as few as two KMS hosts for their entire infrastructure. - -The flow of KMS activation is shown in Figure 3, and it follows this sequence: - -1. An administrator uses the VAMT console to configure a KMS host and install a KMS host key. -2. Microsoft validates the KMS host key, and the KMS host starts to listen for requests. -3. The KMS host updates resource records in DNS to allow clients to locate the KMS host. (Manually adding DNS records is required if your environment does not support DNS dynamic update protocol.) -4. A client configured with a GVLK uses DNS to locate the KMS host. -5. The client sends one packet to the KMS host. -6. The KMS host records information about the requesting client (by using a client ID). Client IDs are used to maintain the count of clients and detect when the same computer is requesting activation again. The client ID is only used to determine whether the activation thresholds are met. The IDs are not stored permanently or transmitted to Microsoft. If the KMS is restarted, the client ID collection starts again. -7. If the KMS host has a KMS host key that matches the products in the GVLK, the KMS host sends a single packet back to the client. This packet contains a count of the number of computers that have requested activation from this KMS host. -8. If the count exceeds the activation threshold for the product that is being activated, the client is activated. If the activation threshold has not yet been met, the client will try again. - -![KMS activation flow](../images/volumeactivationforwindows81-03.jpg) - -**Figure 3**. KMS activation flow - -## See also -- [Volume Activation for Windows 10](volume-activation-windows-10.md) - - +--- +title: Plan for volume activation (Windows 10) +description: Product activation is the process of validating software with the manufacturer after it has been installed on a specific computer. +ms.assetid: f84b005b-c362-4a70-a84e-4287c0d2e4ca +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Plan for volume activation + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +*Product activation* is the process of validating software with the manufacturer after it has been installed on a specific computer. Activation confirms that the product is genuine—not a fraudulent copy—and that the product key or serial number is valid and has not been compromised or revoked. Activation also establishes a link or relationship between the product key and the particular installation. + +During the activation process, information about the specific installation is examined. For online activations, this information is sent to a server at Microsoft. This information may include the software version, the product key, the IP address of the computer, and information about the device. The activation methods that Microsoft uses are designed to help protect user privacy, and they cannot be used to track back to the computer or user. The gathered data confirms that the software is a legally licensed copy, and this data is used for statistical analysis. Microsoft does not use this information to identify or contact the user or the organization. + +>[!NOTE] +>The IP address is used only to verify the location of the request, because some editions of Windows (such as “Starter” editions) can only be activated within certain geographical target markets. + +## Distribution channels and activation + +In general, Microsoft software is obtained through three main channels: retail, original equipment manufacturer (OEM), and volume licensing agreements. Different activations methods are available through each channel. Because organizations are free to obtain software through multiple channels (for example, buying some at retail and others through a volume licensing program) most organizations choose to use a combination of activation methods. + +### Retail activations + +The retail activation method has not changed in several versions of Windows and Windows Server. Each purchased copy comes with one unique product key (often referred to as a retail key). The user enters this key during product installation. The computer uses this retail key to complete the activation after the installation is complete. Most activations are performed online, but telephone activation is also available. +Recently, retail keys have been expanded into new distribution scenarios. Product key cards are available to activate products that have been preinstalled or downloaded. Programs such as Windows Anytime Upgrade and Get Genuine allow users to acquire legal keys separately from the software. These electronically distributed keys may come with media that contains software, they can come as a software shipment, or they may be provided on a printed card or electronic copy. Products are activated the same way with any of these retail keys. + +### Original equipment manufacturer + +Most original equipment manufacturers (OEMs) sell systems that include a standard build of the Windows operating system. The hardware vendor activates Windows by associating the operating system with the firmware (BIOS) of the computer. This occurs before the computer is sent to the customer, and no additional actions are required. +OEM activation is valid as long as the customer uses the OEM-provided image on the system. OEM activation is available only for computers that are purchased through OEM channels and have the Windows operating system preinstalled. + +### Volume licensing + +Volume licensing offers customized programs that are tailored to the size and purchasing preference of the organization. To become a volume licensing customer, the organization must set up a volume licensing agreement with Microsoft.There is a common misunderstanding about acquiring licenses for a new computer through volume licensing. There are two legal ways to acquire a full Windows client license for a new computer: +- Have the license preinstalled through the OEM. +- Purchase a fully packaged retail product. + +The licenses that are provided through volume licensing programs such as Open License, Select License, and Enterprise Agreements cover upgrades to Windows client operating systems only. An existing retail or OEM operating system license is needed for each computer running Windows 10, Windows 8.1 Pro, Windows 8 Pro, Windows 7 Professional or Ultimate, or Windows XP Professional before the upgrade rights obtained through volume licensing can be exercised. +Volume licensing is also available through certain subscription or membership programs, such as the Microsoft Partner Network and MSDN. These volume licenses may contain specific restrictions or other changes to the general terms applicable to volume licensing. + +**Note**   +Some editions of the operating system, such as Windows 10 Enterprise, and some editions of application software are available only through volume licensing agreements or subscriptions. + +## Activation models + +For a user or IT department, there are no significant choices about how to activate products that are acquired through retail or OEM channels. The OEM performs the activation at the factory, and the user or the IT department need take no activation steps. + +With a retail product, the Volume Activation Management Tool (VAMT), which is discussed later in this guide, helps you track and manage keys. For each retail activation, you can choose: +- Online activation +- Telephone activation +- VAMT proxy activation + +Telephone activation is primarily used in situations where a computer is isolated from all networks. VAMT proxy activation (with retail keys) is sometimes used when an IT department wants to centralize retail activations or when a computer with a retail version of the operating system is isolated from the Internet but connected to the LAN. For volume-licensed products, however, you must determine the best method or combination of methods to use in your environment. For Windows 10 Pro and Enterprise, you can choose from three models: +- MAKs +- KMS +- Active Directory-based activation + +**Note**   +Token-based activation is available for specific situations when approved customers rely on a public key infrastructure in an isolated and high-security environment. For more information, contact your Microsoft Account Team or your service representative. +Token-based Activation option is available for Windows 10 Enterprise LTSB editions (Version 1507 and 1607). + +### Multiple activation key + +A Multiple Activation Key (MAK) is commonly used in small- or mid-sized organizations that have a volume licensing agreement, but they do not meet the requirements to operate a KMS or they prefer a simpler approach. A MAK also +allows permanent activation of computers that are isolated from the KMS or are part of an isolated network that does not have enough computers to use the KMS. + +To use a MAK, the computers to be activated must have a MAK installed. The MAK is used for one-time activation with the Microsoft online hosted activation services, by telephone, or by using VAMT proxy activation. +In the simplest terms, a MAK acts like a retail key, except that a MAK is valid for activating multiple computers. Each MAK can be used a specific number of times. The VAMT can assist in tracking the number of activations that have been performed with each key and how many remain. + +Organizations can download MAK and KMS keys from the [Volume Licensing Service Center](https://go.microsoft.com/fwlink/p/?LinkId=618213) website. Each MAK has a preset number of activations, which are based on a percentage of the count of licenses the organization purchases; however, you can increase the number of activations that are available with your MAK by calling Microsoft. + +### Key Management Service + +With the Key Management Service (KMS), IT pros can complete activations on their local network, eliminating the need for individual computers to connect to Microsoft for product activation. The KMS is a lightweight service that does not require a dedicated system and can easily be cohosted on a system that provides other services. + +Volume editions of Windows 10 and Windows Server 2012 R2 (in addition to volume editions of operating system editions since Windows Vista and Windows Server 2008) automatically connect to a system that hosts the KMS to request activation. No action is required from the user. + +The KMS requires a minimum number of computers (physical computers or virtual machines) in a network environment. The organization must have at least five computers to activate Windows Server 2012 R2 and at least 25 computers to activate client computers that are running Windows 10. These minimums are referred to as *activation thresholds*. + +Planning to use the KMS includes selecting the best location for the KMS host and how many KMS hosts to have. One KMS host can handle a large number of activations, but organizations will often deploy two KMS hosts to ensure availability. Only rarely will more than two KMS hosts be used. The KMS can be hosted on a client computer or on a server, and it can be run on older versions of the operating system if proper configuration steps are taken. Setting up your KMS is discussed later in this guide. + +### Active Directory-based activation + +Active Directory-based activation is the newest type of volume activation, and it was introduced in Windows 8. In many ways, Active Directory-based activation is similar to activation by using the KMS, but the activated computer does not need to maintain periodic connectivity with the KMS host. Instead, a domain-joined computer running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 queries AD DS for a volume activation object that is stored in the domain. The operating system checks the digital signatures that are contained in the activation object, and then activates the device. + +Active Directory-based activation allows enterprises to activate computers through a connection to their domain. Many companies have computers at remote or branch locations, where it is impractical to connect to a KMS, or would not reach the KMS activation threshold. Rather than use MAKs, Active Directory-based activation provides a way to activate computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 as long as the computers can contact the company’s domain. Active Directory-based activation offers the advantage of extending volume activation services everywhere you already have a domain presence. + +## Network and connectivity + +A modern business network has many nuances and interconnections. This section examines evaluating your network and the connections that are available to determine how volume activations will occur. + +### Core network + +Your core network is that part of your network that enjoys stable, high-speed, reliable connectivity to infrastructure servers. In many cases, the core network is also connected to the Internet, although that is not a requirement to use the KMS or Active Directory-based activation after the KMS server or AD DS is configured and active. Your core network likely consists of many network segments. In many organizations, the core network makes up the vast majority of the business network. + +In the core network, a centralized KMS solution is recommended. You can also use Active Directory-based activation, but in many organizations, KMS will still be required to activate older client computers and computers that are not joined to the domain. Some administrators prefer to run both solutions to have the most flexibility, while others prefer to choose only a KMS-based solution for simplicity. Active Directory-based activation as the only solution is workable if all of the clients in your organization are running Windows 10, Windows 8.1, or Windows 8. + +A typical core network that includes a KMS host is shown in Figure 1. + +![Typical core network](../images/volumeactivationforwindows81-01.jpg) + +**Figure 1**. Typical core network + +### Isolated networks + +In a large network, it is all but guaranteed that some segments will be isolated, either for security reasons or because of geography or connectivity issues. + +**Isolated for security** + +Sometimes called a *high-security zone*, a particular network segment may be isolated from the core network by a firewall or disconnected from other networks totally. The best solution for activating computers in an isolated network depends on the security policies in place in the organization. + +If the isolated network can access the core network by using outbound requests on TCP port 1688, and it is allowed to receive remote procedure calls (RPCs), you can perform activation by using the KMS in the core network, thereby avoiding the need to reach additional activation thresholds. + +If the isolated network participates fully in the corporate forest, and it can make typical connections to domain controllers, such as using Lightweight Directory Access Protocol (LDAP) for queries and Domain Name Service (DNS) for name resolution, this is a good opportunity to use Active Directory-based activation for Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, and Windows Server 2012 R2. + +If the isolated network cannot communicate with the core network’s KMS server, and it cannot use Active Directory-based activation, you can set up a KMS host in the isolated network. This configuration is shown in Figure 2. However, if the isolated network contains only a few computers, it will not reach the KMS activation threshold. In that case, you can activate by using MAKs. + +If the network is fully isolated, MAK-independent activation would be the recommended choice, perhaps using the telephone option. But VAMT proxy activation may also be possible. You can also use MAKs to activate new computers during setup, before they are placed in the isolated network. + +![New KMS host in an isolated network](../images/volumeactivationforwindows81-02.jpg) + +**Figure 2**. New KMS host in an isolated network + +**Branch offices and distant networks** +From mining operations to ships at sea, organizations often have a few computers that are not easily connected to the core network or the Internet. Some organizations have network segments at branch offices that are large and well-connected internally, but have a slow or unreliable WAN link to the rest of the organization. In these situations, you have several options: +- **Active Directory-based activation**. In any site where the client computers are running Windows 10, Active Directory-based activation is supported, and it can be activated by joining the domain. +- **Local KMS**. If a site has 25 or more client computers, it can activate against a local KMS server. +- **Remote (core) KMS**. If the remote site has connectivity to an existing KMS (perhaps through a virtual private network (VPN) to the core network), that KMS can be used. Using the existing KMS means that you only need to meet the activation threshold on that server. +- **MAK activation**. If the site has only a few computers and no connectivity to an existing KMS host, MAK activation is the best option. + +### Disconnected computers + +Some users may be in remote locations or may travel to many locations. This scenario is common for roaming clients, such as the computers that are used by salespeople or other users who are offsite but not at branch locations. This scenario can also apply to remote branch office locations that have no connection to the core network. You can consider this an “isolated network,” where the number of computers is one. Disconnected computers can use Active Directory-based activation, the KMS, or MAK depending on the client version and how often the computers connect to the core network. +If the computer is joined to the domain and running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 8, you can use Active Directory-based activation—directly or through a VPN—at least once every 180 days. If the computer connects to a network with a KMS host at least every 180 days, but it does not support Active Directory-based activation, you can use KMS activation. Otherwise for computers that rarely or never connect to the network, use MAK independent activation (by using the telephone or the Internet). + +### Test and development labs + +Lab environments often have large numbers of virtual machines, and physical computers and virtual machines in labs are reconfigured frequently. Therefore, first determine whether the computers in test and development labs require activation. Editions of Windows 10 that include volume licensing will operate normally, even if they cannot activate immediately. +If you have ensured that your test or development copies of the operating system are within the license agreement, you may not need to activate the lab computers if they will be rebuilt frequently. If you require that the lab computers be activated, treat the lab as an isolated network and use the methods described earlier in this guide. +In labs that have a high turnover of computers and a small number of KMS clients, you must monitor the KMS activation count. You might need to adjust the time that the KMS caches the activation requests. The default is 30 days. + +## Mapping your network to activation methods + +Now it’s time to assemble the pieces into a working solution. By evaluating your network connectivity, the numbers of computers you have at each site, and the operating system versions in use in your environment, you have collected the information you need to determine which activation methods will work best for you. You can fill-in information in Table 1 to help you make this determination. + +**Table 1**. Criteria for activation methods + +|Criterion |Activation method | +|----------|------------------| +|Number of domain-joined computers that support Active Directory-based activation (computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2) and will connect to a domain controller at least every 180 days. Computers can be mobile, semi-isolated, or located in a branch office or the core network. |Active Directory-based activation | +|Number of computers in the core network that will connect (directly or through a VPN) at least every 180 days

              Note
              The core network must meet the KMS activation threshold. |KMS (central) | +|Number of computers that do not connect to the network at least once every 180 days (or if no network meets the activation threshold) | MAK | +|Number of computers in semi-isolated networks that have connectivity to the KMS in the core network |KMS (central) | +|Number of computers in isolated networks where the KMS activation threshold is met |KMS (local) | +|Number of computers in isolated networks where the KMS activation threshold is not met |MAK | +|Number of computers in test and development labs that will not be activated |None| +|Number of computers that do not have a retail volume license |Retail (online or phone) | +|Number of computers that do not have an OEM volume license |OEM (at factory) | +|Total number of computer activations

              Note
              This total should match the total number of licensed computers in your organization. | + +## Choosing and acquiring keys + +When you know which keys you need, you must obtain them. Generally speaking, volume licensing keys are collected in two ways: +- Go to the **Product Keys** section of the [Volume Licensing Service Center](https://go.microsoft.com/fwlink/p/?LinkID=618213) for the following agreements: Open, Open Value, Select, Enterprise, and Services Provider License. +- Contact your [Microsoft Activation Center](https://go.microsoft.com/fwlink/p/?LinkId=618264). + +### KMS host keys + +A KMS host needs a key that activates, or authenticates, the KMS host with Microsoft. This key is usually referred to as the *KMS host key*, but it is formally known as a *Microsoft Customer Specific Volume License Key* (CSVLK). Most documentation and Internet references earlier than Windows 8.1 use the term KMS key, but CSVLK is becoming more common in current documentation and management tools. + +A KMS host running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 can activate both Windows Server and Windows client operating systems. A KMS host key is also needed to create the activation objects in AD DS, as described later in this guide. You will need a KMS host key for any KMS that you want to set up and if you are going to use Active Directory-based activation. + +### Generic volume licensing keys + +When you create installation media or images for client computers that will be activated by KMS or Active Directory-based activation, install a generic volume license key (GVLK) for the edition of Windows you are creating. GVLKs are also referred to as KMS client setup keys. + +Installation media from Microsoft for Enterprise editions of the Windows operating system may already contain the GVLK. One GVLK is available for each type of installation. The GLVK will not activate the software against Microsoft activation servers, but rather against a KMS or Active Directory-based activation object. In other words, the GVLK does not work unless a valid KMS host key can be found. GVLKs are the only product keys that do not need to be kept confidential. + +Typically, you will not need to manually enter a GVLK unless a computer has been activated with a MAK or a retail key and it is being converted to a KMS activation or to Active Directory-based activation. If you need to locate the GVLK for a particular client edition, see [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx). + +### Multiple activation keys + +You will also need MAK keys with the appropriate number of activations available. You can see how many times a MAK has been used on the Volume Licensing Service Center website or in the VAMT. + +## Selecting a KMS host + +The KMS does not require a dedicated server. It can be cohosted with other services, such as AD DS domain controllers and read-only domain controllers. +KMS hosts can run on physical computers or virtual machines that are running any supported Windows operating system. A KMS host that is running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 can activate any Windows client or server operating system that supports volume activation. A KMS host that is running Windows 10 can activate only computers running Windows 10, Windows 8.1, Windows 8, Windows 7, or Windows Vista. +A single KMS host can support unlimited numbers of KMS clients, but Microsoft recommends deploying a minimum of two KMS hosts for failover purposes. However, as more clients are activated through Active Directory-based activation, the KMS and the redundancy of the KMS will become less important. Most organizations can use as few as two KMS hosts for their entire infrastructure. + +The flow of KMS activation is shown in Figure 3, and it follows this sequence: + +1. An administrator uses the VAMT console to configure a KMS host and install a KMS host key. +2. Microsoft validates the KMS host key, and the KMS host starts to listen for requests. +3. The KMS host updates resource records in DNS to allow clients to locate the KMS host. (Manually adding DNS records is required if your environment does not support DNS dynamic update protocol.) +4. A client configured with a GVLK uses DNS to locate the KMS host. +5. The client sends one packet to the KMS host. +6. The KMS host records information about the requesting client (by using a client ID). Client IDs are used to maintain the count of clients and detect when the same computer is requesting activation again. The client ID is only used to determine whether the activation thresholds are met. The IDs are not stored permanently or transmitted to Microsoft. If the KMS is restarted, the client ID collection starts again. +7. If the KMS host has a KMS host key that matches the products in the GVLK, the KMS host sends a single packet back to the client. This packet contains a count of the number of computers that have requested activation from this KMS host. +8. If the count exceeds the activation threshold for the product that is being activated, the client is activated. If the activation threshold has not yet been met, the client will try again. + +![KMS activation flow](../images/volumeactivationforwindows81-03.jpg) + +**Figure 3**. KMS activation flow + +## See also +- [Volume Activation for Windows 10](volume-activation-windows-10.md) + + diff --git a/windows/deployment/volume-activation/proxy-activation-vamt.md b/windows/deployment/volume-activation/proxy-activation-vamt.md index ff4ab4c6f5..4c865c2d5b 100644 --- a/windows/deployment/volume-activation/proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/proxy-activation-vamt.md @@ -1,58 +1,59 @@ ---- -title: Perform Proxy Activation (Windows 10) -description: Perform Proxy Activation -ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Proxy Activation - -You can use the Volume Activation Management Tool (VAMT) to perform activation for client computers that do not have Internet access. The client products can be installed with any type of product key that is eligible for proxy activation: Multiple activation Key (MAK), KMS Host key (CSVLK), or retail key. - -In a typical proxy-activation scenario, the VAMT host computer distributes a MAK to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. Using this activation method, only the VAMT host computer needs Internet access. - -**Note**   -For workgroups that are completely isolated from any larger network, you can still perform MAK, KMS Host key (CSVLK), or retail proxy activation. This requires installing a second instance of VAMT on a computer within the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. For more information about this scenario, see [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md). Similarly, you can proxy activate a KMS Host key (CSVLK) located in an isolated network. You can also proxy activate a KMS Host key (CSVLK) in the core network if you do not want the KMS host computer to connect to Microsoft over the Internet.  - -## Requirements - -Before performing proxy activation, ensure that your network and the VAMT installation meet the following requirements: -- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you also need to have VAMT installed on one of the computers in the workgroup. -- The products to be activated have been added to VAMT and are installed with a retail product key, a KMS Host key (CSVLK) or a MAK. If the products have not been installed with a proper product key, refer to the steps in the [Add and Remove a Product Key](add-remove-product-key-vamt.md) section for instructions on how to install a product key. -- VAMT has administrative permissions on all products to be activated and Windows Management Instrumentation (WMI) is accessible through the Windows firewall. -- For workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). -The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. - -## To Perform Proxy Activation - -**To perform proxy activation** - -1. Open VAMT. -2. If necessary, install product keys. For more information see: - - [Install a Product Key](install-product-key-vamt.md) to install retail, MAK, or KMS Host key (CSVLK). - - [Install a KMS Client Key](install-kms-client-key-vamt.md) to install GVLK (KMS client) keys. -3. In the **Products** list in the center pane, select the individual products to be activated. You can use the **Filter** function to narrow your search for products by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. In the right-side pane, click **Activate** and then click **Proxy activate** to open the **Proxy Activate** dialog box. -7. In the **Proxy Activate** dialog box click **Apply Confirmation ID, apply to selected machine(s) and activate**. -8. If you are activating products that require administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** checkbox. -9. Click **OK**. -10. VAMT displays the **Activating products** dialog box until it completes the requested action. If you selected the **Alternate Credentials** option, you will be prompted to enter the credentials. - - **Note**   - You can use proxy activation to select products that have different key types and activate the products at the same time. - - - +--- +title: Perform Proxy Activation (Windows 10) +description: Perform proxy activation by using the Volume Activation Management Tool (VAMT) to activate client computers that do not have Internet access. +ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Proxy Activation + +You can use the Volume Activation Management Tool (VAMT) to perform activation for client computers that do not have Internet access. The client products can be installed with any type of product key that is eligible for proxy activation: Multiple activation Key (MAK), KMS Host key (CSVLK), or retail key. + +In a typical proxy-activation scenario, the VAMT host computer distributes a MAK to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. Using this activation method, only the VAMT host computer needs Internet access. + +**Note**   +For workgroups that are completely isolated from any larger network, you can still perform MAK, KMS Host key (CSVLK), or retail proxy activation. This requires installing a second instance of VAMT on a computer within the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. For more information about this scenario, see [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md). Similarly, you can proxy activate a KMS Host key (CSVLK) located in an isolated network. You can also proxy activate a KMS Host key (CSVLK) in the core network if you do not want the KMS host computer to connect to Microsoft over the Internet.  + +## Requirements + +Before performing proxy activation, ensure that your network and the VAMT installation meet the following requirements: +- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you also need to have VAMT installed on one of the computers in the workgroup. +- The products to be activated have been added to VAMT and are installed with a retail product key, a KMS Host key (CSVLK) or a MAK. If the products have not been installed with a proper product key, refer to the steps in the [Add and Remove a Product Key](add-remove-product-key-vamt.md) section for instructions on how to install a product key. +- VAMT has administrative permissions on all products to be activated and Windows Management Instrumentation (WMI) is accessible through the Windows firewall. +- For workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). +The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + +## To Perform Proxy Activation + +**To perform proxy activation** + +1. Open VAMT. +2. If necessary, install product keys. For more information see: + - [Install a Product Key](install-product-key-vamt.md) to install retail, MAK, or KMS Host key (CSVLK). + - [Install a KMS Client Key](install-kms-client-key-vamt.md) to install GVLK (KMS client) keys. +3. In the **Products** list in the center pane, select the individual products to be activated. You can use the **Filter** function to narrow your search for products by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. In the right-side pane, click **Activate** and then click **Proxy activate** to open the **Proxy Activate** dialog box. +7. In the **Proxy Activate** dialog box click **Apply Confirmation ID, apply to selected machine(s) and activate**. +8. If you are activating products that require administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** checkbox. +9. Click **OK**. +10. VAMT displays the **Activating products** dialog box until it completes the requested action. If you selected the **Alternate Credentials** option, you will be prompted to enter the credentials. + + **Note**   + You can use proxy activation to select products that have different key types and activate the products at the same time. + + + diff --git a/windows/deployment/volume-activation/remove-products-vamt.md b/windows/deployment/volume-activation/remove-products-vamt.md index 65dd923d7e..ce8b8c1e39 100644 --- a/windows/deployment/volume-activation/remove-products-vamt.md +++ b/windows/deployment/volume-activation/remove-products-vamt.md @@ -1,35 +1,36 @@ ---- -title: Remove Products (Windows 10) -description: Remove Products -ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Remove Products - -To remove one or more products from the Volume Activation Management Tool (VAMT), you can delete them from the product list view in the center pane. - -**To delete one or more products** -1. Click a product node in the left-side pane. -2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. Select the products you want to delete. -6. Click **Delete** in the **Selected Items** menu in the right-side pane. -7. On the **Confirm Delete Selected Products** dialog box, click **OK**. - -## Related topics -- [Add and Manage Products](add-manage-products-vamt.md) -  -  +--- +title: Remove Products (Windows 10) +description: Learn how you must delete products from the product list view so you can remove products from the Volume Activation Management Tool (VAMT). +ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Remove Products + +To remove one or more products from the Volume Activation Management Tool (VAMT), you can delete them from the product list view in the center pane. + +**To delete one or more products** +1. Click a product node in the left-side pane. +2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. Select the products you want to delete. +6. Click **Delete** in the **Selected Items** menu in the right-side pane. +7. On the **Confirm Delete Selected Products** dialog box, click **OK**. + +## Related topics +- [Add and Manage Products](add-manage-products-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md index 34263037b3..400b2ad2e1 100644 --- a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md @@ -1,48 +1,49 @@ ---- -title: Scenario 3 KMS Client Activation (Windows 10) -description: Scenario 3 KMS Client Activation -ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Scenario 3: KMS Client Activation - -In this scenario, you use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). This can be performed on either Core Network or Isolated Lab computers. By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. You do not have to enter a key to activate a product as a GVLK, unless you are converting a MAK-activated product to a KMS activation. For more information, see [Install a KMS Client Key](install-kms-client-key-vamt.md). - -The procedure that is described below assumes the following: -- The KMS Service is enabled and available to all KMS clients. -- VAMT has been installed and computers have been added to the VAMT database. See Parts 1 through 4 in either [Scenario 1: Online Activation](scenario-online-activation-vamt.md) or [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) for more information. - -## Activate KMS Clients - -1. Open VAMT. -2. To set the KMS activation options, on the menu bar click **View**. Then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. -3. In the **Volume Activation Management Tool Preferences** dialog box, under **KMS Management Services host selection** select from the following options: - - **Find a KMS host automatically using DNS**. This is the default setting. VAMT will instruct the computer to query the Domain Name Service (DNS) to locate a KMS host and perform activation. If the client contains a registry key with a valid KMS host, that value will be used instead. - - **Find a KMS host using DNS in this domain for supported products**. Select this option if you use a specific domain, and enter the name of the domain. - - **Use specific KMS host**. Select this option for environments which do not use DNS for KMS host identification, and manually enter the KMS host name and select the KMS host port. VAMT will set the specified KMS host name and KMS host port on the target computer, and then instruct the computer to perform activation with the specific KMS host. -4. In the left-side pane, in the **Products** node, click the product that you want to activate. -5. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -6. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -7. Click **Filter**. VAMT displays the filtered list in the center pane. -8. Select the products that you want to activate. -9. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane, click **Activate**, point to **Volume activate**, and then click the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. -10. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - -The same status is shown under the **Status of Last Action** column in the products list view in the center pane. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) -  -  +--- +title: Scenario 3 KMS Client Activation (Windows 10) +description: Learn how to use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). +ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Scenario 3: KMS Client Activation + +In this scenario, you use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). This can be performed on either Core Network or Isolated Lab computers. By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. You do not have to enter a key to activate a product as a GVLK, unless you are converting a MAK-activated product to a KMS activation. For more information, see [Install a KMS Client Key](install-kms-client-key-vamt.md). + +The procedure that is described below assumes the following: +- The KMS Service is enabled and available to all KMS clients. +- VAMT has been installed and computers have been added to the VAMT database. See Parts 1 through 4 in either [Scenario 1: Online Activation](scenario-online-activation-vamt.md) or [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) for more information. + +## Activate KMS Clients + +1. Open VAMT. +2. To set the KMS activation options, on the menu bar click **View**. Then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. +3. In the **Volume Activation Management Tool Preferences** dialog box, under **KMS Management Services host selection** select from the following options: + - **Find a KMS host automatically using DNS**. This is the default setting. VAMT will instruct the computer to query the Domain Name Service (DNS) to locate a KMS host and perform activation. If the client contains a registry key with a valid KMS host, that value will be used instead. + - **Find a KMS host using DNS in this domain for supported products**. Select this option if you use a specific domain, and enter the name of the domain. + - **Use specific KMS host**. Select this option for environments which do not use DNS for KMS host identification, and manually enter the KMS host name and select the KMS host port. VAMT will set the specified KMS host name and KMS host port on the target computer, and then instruct the computer to perform activation with the specific KMS host. +4. In the left-side pane, in the **Products** node, click the product that you want to activate. +5. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +6. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +7. Click **Filter**. VAMT displays the filtered list in the center pane. +8. Select the products that you want to activate. +9. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane, click **Activate**, point to **Volume activate**, and then click the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. +10. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + +The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) +  +  diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index 865dbdf623..cf5d0b7c93 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -1,136 +1,137 @@ ---- -title: Scenario 1 Online Activation (Windows 10) -description: Scenario 1 Online Activation -ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Scenario 1: Online Activation - -In this scenario, the Volume Activation Management Tool (VAMT) is deployed in the Core Network environment. VAMT is installed on a central computer that has network access to all of the client computers. Both the VAMT host and the client computers have Internet access. The following illustration shows a diagram of an online activation scenario for Multiple Activation Keys (MAKs). You can use this scenario for online activation of the following key types: -- Multiple Activation Key (MAK) -- Windows Key Management Service (KMS) keys: - - KMS Host key (CSVLK) - - Generic Volume License Key (GVLK), or KMS client key -- Retail -The Secure Zone represents higher-security Core Network computers that have additional firewall protection. - -![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) - -## In This Topic -- [Install and start VAMT on a networked host computer](#bkmk-partone) -- [Configure the Windows Management Instrumentation firewall exception on target computers](#bkmk-parttwo) -- [Connect to VAMT database](#bkmk-partthree) -- [Discover products](#bkmk-partfour) -- [Sort and filter the list of computers](#bkmk-partfive) -- [Collect status information from the computers in the list](#bkmk-partsix) -- [Add product keys and determine the remaining activation count](#bkmk-partseven) -- [Install the product keys](#bkmk-parteight) -- [Activate the client products](#bkmk-partnine) - -## Step 1: Install and start VAMT on a networked host computer - -1. Install VAMT on the host computer. -2. Click the VAMT icon in the **Start** menu to open VAMT. - -## Step 2: Configure the Windows Management Instrumentation firewall exception on target computers - -- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - - **Note**   - To retrieve product license status, VAMT must have administrative permissions on the remote computers and WMI must be available through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -## Step 3: Connect to a VAMT database - -1. If you are not already connected to a database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database where the keys that must be activated are located. -2. Click **Connect**. -3. If you are already connected to a database, VAMT displays an inventory of the products and product keys in the center pane, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to Server** to open **the Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data](manage-vamt-data.md) - -## Step 4: Discover products - -1. In the left-side pane, in the **Products** node Products, click the product that you want to activate. -2. To open the **Discover Products** dialog box, click **Discover products** in the **Actions** menu in the right-side pane. -3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general Lightweight Directory Access Protocol (LDAP) query: - - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". - - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. - - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. -4. Click **Search**. - - When the search is complete, the products that VAMT discovers appear in the product list view in the center pane. - -## Step 5: Sort and filter the list of computers - -You can sort the list of products so that it is easier to find the computers that require product keys to be activated: -1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. -2. To sort the list further, you can click one of the column headings to sort by that column. -3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. - -## Step 6: Collect status information from the computers in the list - -To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: -- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. -- To select computers which are not listed consecutively, hold down the **Ctrl** key and select each computer for which you want to collect the status information. - **To collect status information from the selected computers** -- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box, type the appropriate user name and password and then click **OK**. -- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. - - **Note** - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. - -## Step 7: Add product keys and determine the remaining activation count - -1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. -2. In the **Add Product Key** dialog box, you can select from one of the following methods to add product keys: - - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add Key(s)**. - - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. - - The keys that you have added appear in the **Product Keys** list view in the center pane. - - **Important**   - If you are activating many products with a MAK, refresh the activation count of the MAK to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and then click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. - -## Step 8: Install the product keys - -1. In the left-side pane, click the product that you want to install keys on to. -2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and filter the list of computers](#bkmk-partfive). -3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you want to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. -6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status appears under the **Status of Last Action** column in the product list view in the center pane. - **Note**   - - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) - -## Step 9: Activate the client products - -1. Select the individual products that you want to activate in the list-view pane. -2. On the menu bar, click **Action**, point to **Activate** and point to **Online activate**. You can also right-click the selected computers(s) to display the **Action** menu, point to **Activate** and point to **Online activate**. You can also click **Activate** in the **Selected Items** menu in the right-hand pane to access the **Activate** option. -3. If you are activating product keys using your current credential, click **Current credential** and continue to step 5. If you are activating products that require an administrator credential that is different from the one you are currently using, click the **Alternate credential** option. -4. Enter your alternate user name and password and click **OK**. -5. The **Activate** option contacts the Microsoft product-activation server over the Internet and requests activation for the selected products. VAMT displays the **Activating products** dialog box until the requested actions are completed. - - **Note**   - Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. - - RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and volume editions of Office 2010 will not enter RFM. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) - - +--- +title: Scenario 1 Online Activation (Windows 10) +description: Achieve network access by deploying the Volume Activation Management Tool (VAMT) in a Core Network environment. +ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Scenario 1: Online Activation + +In this scenario, the Volume Activation Management Tool (VAMT) is deployed in the Core Network environment. VAMT is installed on a central computer that has network access to all of the client computers. Both the VAMT host and the client computers have Internet access. The following illustration shows a diagram of an online activation scenario for Multiple Activation Keys (MAKs). You can use this scenario for online activation of the following key types: +- Multiple Activation Key (MAK) +- Windows Key Management Service (KMS) keys: + - KMS Host key (CSVLK) + - Generic Volume License Key (GVLK), or KMS client key +- Retail +The Secure Zone represents higher-security Core Network computers that have additional firewall protection. + +![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) + +## In This Topic +- [Install and start VAMT on a networked host computer](#bkmk-partone) +- [Configure the Windows Management Instrumentation firewall exception on target computers](#bkmk-parttwo) +- [Connect to VAMT database](#bkmk-partthree) +- [Discover products](#bkmk-partfour) +- [Sort and filter the list of computers](#bkmk-partfive) +- [Collect status information from the computers in the list](#bkmk-partsix) +- [Add product keys and determine the remaining activation count](#bkmk-partseven) +- [Install the product keys](#bkmk-parteight) +- [Activate the client products](#bkmk-partnine) + +## Step 1: Install and start VAMT on a networked host computer + +1. Install VAMT on the host computer. +2. Click the VAMT icon in the **Start** menu to open VAMT. + +## Step 2: Configure the Windows Management Instrumentation firewall exception on target computers + +- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + + **Note**   + To retrieve product license status, VAMT must have administrative permissions on the remote computers and WMI must be available through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +## Step 3: Connect to a VAMT database + +1. If you are not already connected to a database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database where the keys that must be activated are located. +2. Click **Connect**. +3. If you are already connected to a database, VAMT displays an inventory of the products and product keys in the center pane, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to Server** to open **the Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data](manage-vamt-data.md) + +## Step 4: Discover products + +1. In the left-side pane, in the **Products** node Products, click the product that you want to activate. +2. To open the **Discover Products** dialog box, click **Discover products** in the **Actions** menu in the right-side pane. +3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general Lightweight Directory Access Protocol (LDAP) query: + - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". + - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. + - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. +4. Click **Search**. + + When the search is complete, the products that VAMT discovers appear in the product list view in the center pane. + +## Step 5: Sort and filter the list of computers + +You can sort the list of products so that it is easier to find the computers that require product keys to be activated: +1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. +2. To sort the list further, you can click one of the column headings to sort by that column. +3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. + +## Step 6: Collect status information from the computers in the list + +To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: +- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. +- To select computers which are not listed consecutively, hold down the **Ctrl** key and select each computer for which you want to collect the status information. + **To collect status information from the selected computers** +- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box, type the appropriate user name and password and then click **OK**. +- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. + + **Note** + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + +## Step 7: Add product keys and determine the remaining activation count + +1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. +2. In the **Add Product Key** dialog box, you can select from one of the following methods to add product keys: + - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add Key(s)**. + - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + + The keys that you have added appear in the **Product Keys** list view in the center pane. + + **Important**   + If you are activating many products with a MAK, refresh the activation count of the MAK to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and then click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + +## Step 8: Install the product keys + +1. In the left-side pane, click the product that you want to install keys on to. +2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and filter the list of computers](#bkmk-partfive). +3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you want to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. +6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status appears under the **Status of Last Action** column in the product list view in the center pane. + **Note**   + + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) + +## Step 9: Activate the client products + +1. Select the individual products that you want to activate in the list-view pane. +2. On the menu bar, click **Action**, point to **Activate** and point to **Online activate**. You can also right-click the selected computers(s) to display the **Action** menu, point to **Activate** and point to **Online activate**. You can also click **Activate** in the **Selected Items** menu in the right-hand pane to access the **Activate** option. +3. If you are activating product keys using your current credential, click **Current credential** and continue to step 5. If you are activating products that require an administrator credential that is different from the one you are currently using, click the **Alternate credential** option. +4. Enter your alternate user name and password and click **OK**. +5. The **Activate** option contacts the Microsoft product-activation server over the Internet and requests activation for the selected products. VAMT displays the **Activating products** dialog box until the requested actions are completed. + + **Note**   + Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. + + RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) + + diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index 3c52c27790..f46556cdae 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -1,6 +1,6 @@ --- title: Scenario 2 Proxy Activation (Windows 10) -description: Scenario 2 Proxy Activation +description: Use the Volume Activation Management Tool (VAMT) to activate products that are installed on workgroup computers in an isolated lab environment. ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a ms.reviewer: manager: laurawi diff --git a/windows/deployment/volume-activation/update-product-status-vamt.md b/windows/deployment/volume-activation/update-product-status-vamt.md index 038839adb4..1e3cd0e815 100644 --- a/windows/deployment/volume-activation/update-product-status-vamt.md +++ b/windows/deployment/volume-activation/update-product-status-vamt.md @@ -1,38 +1,39 @@ ---- -title: Update Product Status (Windows 10) -description: Update Product Status -ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Update Product Status - -After you add computers to the VAMT database, you need to use the **Update license status** function to add the products that are installed on the computers. You can also use the **Update license status** at any time to retrieve the most current license status for any products in the VAMT database. -To retrieve license status, VAMT must have administrative permissions on all selected computers and Windows Management Instrumentation (WMI) must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -**Note**   -The license-status query requires a valid computer name for each system queried. If the VAMT database contains computers that were added without Personally Identifiable Information, computer names will not be available for those computers, and the status for these computers will not be updated. - -## Update the license status of a product - -1. Open VAMT. -2. In the **Products** list, select one or more products that need to have their status updated. -3. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. -4. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. - - VAMT displays the **Collecting product information** dialog box while it collects the status of all selected products. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. - - **Note**   - If a previously discovered Microsoft Office 2010 product has been uninstalled from the remote computer, updating its licensing status will cause the entry to be deleted from the **Office** product list view, and, consequently, the total number of discovered products will be smaller. However, the Windows installation of the same computer will not be deleted and will always be shown in the **Windows** products list view. - -## Related topics -- [Add and Manage Products](add-manage-products-vamt.md) +--- +title: Update Product Status (Windows 10) +description: Learn how to use the Update license status function to add the products that are installed on the computers. +ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Update Product Status + +After you add computers to the VAMT database, you need to use the **Update license status** function to add the products that are installed on the computers. You can also use the **Update license status** at any time to retrieve the most current license status for any products in the VAMT database. +To retrieve license status, VAMT must have administrative permissions on all selected computers and Windows Management Instrumentation (WMI) must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +**Note**   +The license-status query requires a valid computer name for each system queried. If the VAMT database contains computers that were added without Personally Identifiable Information, computer names will not be available for those computers, and the status for these computers will not be updated. + +## Update the license status of a product + +1. Open VAMT. +2. In the **Products** list, select one or more products that need to have their status updated. +3. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. +4. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. + + VAMT displays the **Collecting product information** dialog box while it collects the status of all selected products. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + + **Note**   + If a previously discovered Microsoft Office 2010 product has been uninstalled from the remote computer, updating its licensing status will cause the entry to be deleted from the **Office** product list view, and, consequently, the total number of discovered products will be smaller. However, the Windows installation of the same computer will not be deleted and will always be shown in the **Windows** products list view. + +## Related topics +- [Add and Manage Products](add-manage-products-vamt.md) diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md index 39f4344b23..07047dd903 100644 --- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md +++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md @@ -1,79 +1,80 @@ ---- -title: Use the Volume Activation Management Tool (Windows 10) -description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. -ms.assetid: b11f0aee-7b60-44d1-be40-c960fc6c4c47 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Use the Volume Activation Management Tool - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. - -By using the VAMT, you can automate and centrally manage the volume, retail, and MAK activation process for Windows, Office, and select other Microsoft products. The VAMT can manage volume activation by using MAKs or KMS. It is a standard Microsoft Management Console snap-in, and it can be -installed on any computer running Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2. - -The VAMT is distributed as part of the Windows Assessment and Deployment Kit (Windows ADK), which is a free download available from Microsoft Download Center. For more information, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526740). - -In Windows Server 2012 R2, you can install the VAMT directly from Server Manager without downloading the Windows ADK by selecting the Volume Activation Services role or the Remote Server Administration Tools/Role Administration Tools/Volume Activation Tools feature. - -## Activating with the Volume Activation Management Tool - -You can use the VAMT to complete the activation process in products by using MAK and retail keys, and you can work with computers individually or in groups. The VAMT enables two activation scenarios: -- **Online activation**. Online activation enables you to activate over the Internet any products that are installed with MAK, KMS host, or retail product keys. You can activate one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. -- **Proxy activation**. This activation method enables you to perform volume activation for products that are installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS host key, or retail product key to one or more client products and collects the installation ID from each client product. The VAMT host sends the installation IDs to Microsoft on behalf of the client products and obtains the corresponding confirmation IDs. The VAMT host then installs the confirmation IDs on the client products to complete their activation. - By using this method, only the VAMT host computer requires Internet access. Proxy activation by using the VAMT is beneficial for isolated network segments and for cases where your organization has a mix of retail, MAK, and KMS-based activations. - -## Tracking products and computers with the Volume Activation Management Tool - -The VAMT provides an overview of the activation and licensing status of computers across your network, as shown in Figure 18. Several prebuilt reports are also available to help you proactively manage licensing. - -![VAMT showing the licensing status of multiple computers](../images/volumeactivationforwindows81-18.jpg) - -**Figure 18**. The VAMT showing the licensing status of multiple computers - -## Tracking key usage with the Volume Activation Management Tool - -The VAMT makes it easier to track the various keys that are issued to your organization. You can enter each key into VAMT, and then the VAMT can use those keys for online or proxy activation of clients. The tool can also describe what type of key it is and to which product group it belongs. The VAMT is the most convenient way to quickly determine how many activations remain on a MAK. Figure 19 shows an example of key types and usage. - -![VAMT showing key types and usage](../images/volumeactivationforwindows81-19.jpg) - -**Figure 19**. The VAMT showing key types and usage - -## Other Volume Activation Management Tool features - -The VAMT stores information in a Microsoft SQL Server database for performance and flexibility, and it provides a single graphical user interface for managing activations and performing other activation-related tasks, such as: -- **Adding and removing computers**. You can use the VAMT to discover computers in the local environment. The VAMT can discover computers by querying AD DS, workgroups, or individual computer names or IP addresses, or through a general LDAP query. -- **Discovering products**. You can use the VAMT to discover Windows, Windows Server, Office, and select other products that are installed on the client computers. -- **Managing activation data**. The VAMT stores activation data in a SQL Server database. The tool can export this data in XML format to other VAMT hosts or to an archive. - -For more information, see: -- [Volume Activation Management Tool (VAMT) Overview](https://go.microsoft.com/fwlink/p/?LinkId=618266) -- [VAMT Step-by-Step Scenarios](https://go.microsoft.com/fwlink/p/?LinkId=618267) - -## See also -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Use the Volume Activation Management Tool (Windows 10) +description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to track and monitor several types of product keys. +ms.assetid: b11f0aee-7b60-44d1-be40-c960fc6c4c47 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Use the Volume Activation Management Tool + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. + +By using the VAMT, you can automate and centrally manage the volume, retail, and MAK activation process for Windows, Office, and select other Microsoft products. The VAMT can manage volume activation by using MAKs or KMS. It is a standard Microsoft Management Console snap-in, and it can be +installed on any computer running Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2. + +The VAMT is distributed as part of the Windows Assessment and Deployment Kit (Windows ADK), which is a free download available from Microsoft Download Center. For more information, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526740). + +In Windows Server 2012 R2, you can install the VAMT directly from Server Manager without downloading the Windows ADK by selecting the Volume Activation Services role or the Remote Server Administration Tools/Role Administration Tools/Volume Activation Tools feature. + +## Activating with the Volume Activation Management Tool + +You can use the VAMT to complete the activation process in products by using MAK and retail keys, and you can work with computers individually or in groups. The VAMT enables two activation scenarios: +- **Online activation**. Online activation enables you to activate over the Internet any products that are installed with MAK, KMS host, or retail product keys. You can activate one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. +- **Proxy activation**. This activation method enables you to perform volume activation for products that are installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS host key, or retail product key to one or more client products and collects the installation ID from each client product. The VAMT host sends the installation IDs to Microsoft on behalf of the client products and obtains the corresponding confirmation IDs. The VAMT host then installs the confirmation IDs on the client products to complete their activation. + By using this method, only the VAMT host computer requires Internet access. Proxy activation by using the VAMT is beneficial for isolated network segments and for cases where your organization has a mix of retail, MAK, and KMS-based activations. + +## Tracking products and computers with the Volume Activation Management Tool + +The VAMT provides an overview of the activation and licensing status of computers across your network, as shown in Figure 18. Several prebuilt reports are also available to help you proactively manage licensing. + +![VAMT showing the licensing status of multiple computers](../images/volumeactivationforwindows81-18.jpg) + +**Figure 18**. The VAMT showing the licensing status of multiple computers + +## Tracking key usage with the Volume Activation Management Tool + +The VAMT makes it easier to track the various keys that are issued to your organization. You can enter each key into VAMT, and then the VAMT can use those keys for online or proxy activation of clients. The tool can also describe what type of key it is and to which product group it belongs. The VAMT is the most convenient way to quickly determine how many activations remain on a MAK. Figure 19 shows an example of key types and usage. + +![VAMT showing key types and usage](../images/volumeactivationforwindows81-19.jpg) + +**Figure 19**. The VAMT showing key types and usage + +## Other Volume Activation Management Tool features + +The VAMT stores information in a Microsoft SQL Server database for performance and flexibility, and it provides a single graphical user interface for managing activations and performing other activation-related tasks, such as: +- **Adding and removing computers**. You can use the VAMT to discover computers in the local environment. The VAMT can discover computers by querying AD DS, workgroups, or individual computer names or IP addresses, or through a general LDAP query. +- **Discovering products**. You can use the VAMT to discover Windows, Windows Server, Office, and select other products that are installed on the client computers. +- **Managing activation data**. The VAMT stores activation data in a SQL Server database. The tool can export this data in XML format to other VAMT hosts or to an archive. + +For more information, see: +- [Volume Activation Management Tool (VAMT) Overview](https://go.microsoft.com/fwlink/p/?LinkId=618266) +- [VAMT Step-by-Step Scenarios](https://go.microsoft.com/fwlink/p/?LinkId=618267) + +## See also +- [Volume Activation for Windows 10](volume-activation-windows-10.md) +  +  diff --git a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md index e54f6338f1..7389bcd273 100644 --- a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md +++ b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md @@ -1,6 +1,6 @@ --- title: Use VAMT in Windows PowerShell (Windows 10) -description: Use VAMT in Windows PowerShell +description: Learn how to use Volume Activation Management Tool (VAMT) PowerShell cmdlets to perform the same functions as the Vamt.exe command-line tool. ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 ms.reviewer: manager: laurawi @@ -18,11 +18,14 @@ ms.topic: article # Use VAMT in Windows PowerShell The Volume Activation Management Tool (VAMT) PowerShell cmdlets can be used to perform the same functions as the Vamt.exe command-line tool. + **To install PowerShell 3.0** - VAMT PowerShell cmdlets require Windows PowerShell, which is included in Windows 10, Windows 8 and Windows Server® 2012. You can download PowerShell for Windows 7 or other operating systems from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=218356). - **To install the Windows Assessment and Deployment Kit** + +**To install the Windows Assessment and Deployment Kit** - In addition to PowerShell, you must import the VAMT PowerShell module. The module is included in the VAMT 3.0 folder after you install the Windows Assessment and Deployment Kit (Windows ADK). - **To prepare the VAMT PowerShell environment** + +**To prepare the VAMT PowerShell environment** - To open PowerShell with administrative credentials, click **Start** and type “PowerShell” to locate the program. Right-click **Windows PowerShell**, and then click **Run as administrator**. To open PowerShell in Windows 7, click **Start**, click **All Programs**, click **Accessories**, click **Windows PowerShell**, right-click **Windows PowerShell**, and then click **Run as administrator**. **Important** diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index 70933d12f6..d28e648aac 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -1,25 +1,63 @@ ---- -title: VAMT Known Issues (Windows 10) -description: VAMT Known Issues -ms.assetid: 8992f1f3-830a-4ce7-a248-f3a6377ab77f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# VAMT Known Issues - -The following list contains the current known issues with the Volume Activation Management Tool (VAMT) 3.0. -- The VAMT Windows Management Infrastructure (WMI) remote operations may take longer to execute if the target computer is in a sleep or standby state. -- Recovery of Non-Genuine computers is a two-step process. VAMT can be used to install a new product key and activate the computer. However, the computer itself must visit the [Windows Genuine Advantage](https://go.microsoft.com/fwlink/p/?linkid=182914) Web site to revalidate the computer's Genuine status. Upon successfully completing this step, the computer will be restored to full functionality. For more information on recovering Non-Genuine Windows computers, go to [Windows Volume Activation](https://go.microsoft.com/fwlink/p/?linkid=184668). -- When opening a Computer Information List (.cil file) saved in a previous version of VAMT, the edition information is not shown for each product in the center pane. Users must update the product status again to obtain the edition information. -- The remaining activation count can only be retrieved for MAKs. -  -  +--- +title: VAMT known issues (Windows 10) +description: Find out the current known issues with the Volume Activation Management Tool (VAMT), versions 3.0. and 3.1. +ms.assetid: 8992f1f3-830a-4ce7-a248-f3a6377ab77f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 12/17/2019 +ms.topic: article +ms.custom: +- CI 111496 +- CSSTroubleshooting +--- + +# VAMT known issues + +The current known issues with the Volume Activation Management Tool (VAMT), versions 3.0. and 3.1, include: + +- VAMT Windows Management Infrastructure (WMI) remote operations might take longer to execute if the target computer is in a sleep or standby state. +- When you open a Computer Information List (CIL) file that was saved by using a previous version of VAMT, the edition information is not shown for each product in the center pane. You must update the product status again to obtain the edition information. +- The remaining activation count can only be retrieved for Multiple Activation Key (MAKs). + +## Workarounds for adding CSVLKs for Windows 10 activation to VAMT 3.1 + +Another known issue is that when you try to add a Windows 10 Key Management Service (KMS) Host key (CSVLK) or a Windows Server 2012 R2 for Windows 10 CSVLK into VAMT 3.1 (version 10.0.10240.0), you receive the error message shown here. + +![VAMT error message](./images/vamt-known-issue-message.png) + +This issue occurs because VAMT 3.1 does not contain the correct Pkconfig files to recognize this kind of key. To work around this issue, use one of the following methods. + +### Method 1 + +Do not add the CSVLK to the VAMT 3.1 tool. Instead, use the **slmgr.vbs /ipk \<*CSVLK*>** command to install a CSVLK on a KMS host. In this command, \<*CSVLK*> represents the specific key that you want to install. For more information about how to use the Slmgr.vbs tool, see [Slmgr.vbs options for obtaining volume activation information](https://docs.microsoft.com/windows-server/get-started/activation-slmgr-vbs-options). + +### Method 2 + +On the KMS host computer, perform the following steps: + +1. Download the hotfix from [July 2016 update rollup for Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/3172614/). + +1. In Windows Explorer, right-click **485392_intl_x64_zip** and extract the hotfix to C:\KB3058168. + +1. To extract the contents of the update, run the following command: + + ```console + expand c:\KB3058168\Windows8.1-KB3058168-x64.msu -f:* C:\KB3058168\ + ``` + +1. To extract the contents of Windows8.1-KB3058168-x64.cab, run the following command: + + ```console + expand c:\KB3058168\Windows8.1-KB3058168-x64.cab -f:pkeyconfig-csvlk.xrm-ms c:\KB3058168 + ``` + +1. In the C:\KB3058168\x86_microsoft-windows-s..nent-sku-csvlk-pack_31bf3856ad364e35_6.3.9600.17815_none_bd26b4f34d049716 folder, copy the pkeyconfig-csvlk.xrm-ms file. Paste this file into the C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\VAMT3\pkconfig folder. + +1. Restart VAMT. diff --git a/windows/deployment/volume-activation/vamt-requirements.md b/windows/deployment/volume-activation/vamt-requirements.md index 264ebca94c..2ee3dbbb3d 100644 --- a/windows/deployment/volume-activation/vamt-requirements.md +++ b/windows/deployment/volume-activation/vamt-requirements.md @@ -1,47 +1,47 @@ ---- -title: VAMT Requirements (Windows 10) -description: VAMT Requirements -ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# VAMT Requirements - -This topic includes info about the product key and system requirements for VAMT. - -## Product Key Requirements - -The Volume Activation Management Tool (VAMT) can be used to perform activations using any of the following types of product keys. - -|Product key type |Where to obtain | -|-----------------|----------------| -|

              • Multiple Activation Key (MAK)
              • Key Management Service (KMS) host key (CSVLK)
              • KMS client setup keys (GVLK)
              |Volume licensing keys can only be obtained with a signed contract from Microsoft. For more info, see the [Microsoft Volume Licensing portal](https://go.microsoft.com/fwlink/p/?LinkId=227282). | -|Retail product keys |Obtained at time of product purchase. | - -## System Requirements - -The following table lists the system requirements for the VAMT host computer. - -|Item |Minimum system requirement | -|-----|---------------------------| -|Computer and Processor |1 GHz x86 or x64 processor | -|Memory |1 GB RAM for x86 or 2 GB RAM for x64 | -|Hard Disk |16 GB available hard disk space for x86 or 20 GB for x64 | -|External Drive|Removable media (Optional) | -|Display |1024x768 or higher resolution monitor | -|Network |Connectivity to remote computers via Windows® Management Instrumentation (TCP/IP) and Microsoft® Activation Web Service on the Internet via HTTPS | -|Operating System |Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, or Windows Server 2012. | -|Additional Requirements |
              • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
              • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server® 2012, PowerShell is included in the installation. For previous versions of Windows and -Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
              • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
              | - -## Related topics -- [Install and Configure VAMT](install-configure-vamt.md) +--- +title: VAMT Requirements (Windows 10) +description: In this article, learn about the product key and system requierements for Volume Activation Management Tool (VAMT). +ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# VAMT Requirements + +This topic includes info about the product key and system requirements for VAMT. + +## Product Key Requirements + +The Volume Activation Management Tool (VAMT) can be used to perform activations using any of the following types of product keys. + +|Product key type |Where to obtain | +|-----------------|----------------| +|
              • Multiple Activation Key (MAK)
              • Key Management Service (KMS) host key (CSVLK)
              • KMS client setup keys (GVLK)
              |Volume licensing keys can only be obtained with a signed contract from Microsoft. For more info, see the [Microsoft Volume Licensing portal](https://go.microsoft.com/fwlink/p/?LinkId=227282). | +|Retail product keys |Obtained at time of product purchase. | + +## System Requirements + +The following table lists the system requirements for the VAMT host computer. + +| Item | Minimum system requirement | +| ---- | ---------------------------| +| Computer and Processor | 1 GHz x86 or x64 processor | +| Memory | 1 GB RAM for x86 or 2 GB RAM for x64 | +| Hard Disk | 16 GB available hard disk space for x86 or 20 GB for x64 | +| External Drive | Removable media (Optional) | +| Display | 1024x768 or higher resolution monitor | +| Network | Connectivity to remote computers via Windows Management Instrumentation (TCP/IP) and Microsoft Activation Web Service on the Internet via HTTPS | +| Operating System | Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, or later. | +| Additional Requirements |
              • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
              • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012, PowerShell is included in the installation. For previous versions of Windows and Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
              • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
              | + +## Related topics +- [Install and Configure VAMT](install-configure-vamt.md) diff --git a/windows/deployment/volume-activation/vamt-step-by-step.md b/windows/deployment/volume-activation/vamt-step-by-step.md index ae1576bb5f..ef45dc1c96 100644 --- a/windows/deployment/volume-activation/vamt-step-by-step.md +++ b/windows/deployment/volume-activation/vamt-step-by-step.md @@ -1,32 +1,33 @@ ---- -title: VAMT Step-by-Step Scenarios (Windows 10) -description: VAMT Step-by-Step Scenarios -ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# VAMT Step-by-Step Scenarios - -This section provides step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. VAMT supports many common scenarios; the scenarios in this section describe some of the most common to get you started. - -## In this Section - -|Topic |Description | -|------|------------| -|[Scenario 1: Online Activation](scenario-online-activation-vamt.md) |Describes how to distribute Multiple Activation Keys (MAKs) to products installed on one or more connected computers within a network, and how to instruct these products to contact Microsoft over the Internet for activation. | -|[Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) |Describes how to use two VAMT host computers — the first one with Internet access and a second computer within an isolated workgroup — as proxies to perform MAK volume activation for workgroup computers that do not have Internet access. | -|[Scenario 3: KMS Client Activation](scenario-kms-activation-vamt.md) |Describes how to use VAMT to configure client products for Key Management Service (KMS) activation. By default, volume license editions of Windows 10, Windows Vista, Windows® 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. | - -## Related topics -- [Introduction to VAMT](introduction-vamt.md) -  -  +--- +title: VAMT Step-by-Step Scenarios (Windows 10) +description: Learn step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. +ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# VAMT Step-by-Step Scenarios + +This section provides step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. VAMT supports many common scenarios; the scenarios in this section describe some of the most common to get you started. + +## In this Section + +|Topic |Description | +|------|------------| +|[Scenario 1: Online Activation](scenario-online-activation-vamt.md) |Describes how to distribute Multiple Activation Keys (MAKs) to products installed on one or more connected computers within a network, and how to instruct these products to contact Microsoft over the Internet for activation. | +|[Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) |Describes how to use two VAMT host computers — the first one with Internet access and a second computer within an isolated workgroup — as proxies to perform MAK volume activation for workgroup computers that do not have Internet access. | +|[Scenario 3: KMS Client Activation](scenario-kms-activation-vamt.md) |Describes how to use VAMT to configure client products for Key Management Service (KMS) activation. By default, volume license editions of Windows 10, Windows Vista, Windows® 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. | + +## Related topics +- [Introduction to VAMT](introduction-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md index b517ac9410..23c0a83614 100644 --- a/windows/deployment/volume-activation/volume-activation-management-tool.md +++ b/windows/deployment/volume-activation/volume-activation-management-tool.md @@ -1,43 +1,45 @@ ---- -title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) -description: The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. -ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Volume Activation Management Tool (VAMT) Technical Reference - -The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. -VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: -- Windows® 7 or above -- Windows Server 2008 R2 or above - - -**Important**   -VAMT is designed to manage volume activation for: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or obove), Microsoft Office 2010 (or above). - -VAMT is only available in an EN-US (x86) package. - -## In this Section - -|Topic |Description | -|------|------------| -|[Introduction to VAMT](introduction-vamt.md) |Provides a description of VAMT and common usages. | -|[Active Directory-Based Activation Overview](active-directory-based-activation-overview.md) |Describes Active Directory-Based Activation scenarios. | -|[Install and Configure VAMT](install-configure-vamt.md) |Describes how to install VAMT and use it to configure client computers on your network. | -|[Add and Manage Products](add-manage-products-vamt.md) |Describes how to add client computers into VAMT. | -|[Manage Product Keys](manage-product-keys-vamt.md) |Describes how to add and remove a product key from VAMT. | -|[Manage Activations](manage-activations-vamt.md) |Describes how to activate a client computer by using a variety of activation methods. | -|[Manage VAMT Data](manage-vamt-data.md) |Describes how to save, import, export, and merge a Computer Information List (CILX) file using VAMT. | -|[VAMT Step-by-Step Scenarios](vamt-step-by-step.md) |Provides step-by-step instructions for using VAMT in typical environments. | -|[VAMT Known Issues](vamt-known-issues.md) |Lists known issues in VAMT. | - +--- +title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) +description: The Volume Activation Management Tool (VAMT) enables network administrators to automate and centrally manage volume activation and retail activation. +ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Volume Activation Management Tool (VAMT) Technical Reference + +The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. +VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: +- Windows® 7 or above +- Windows Server 2008 R2 or above + + +**Important**   +VAMT is designed to manage volume activation for: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or later), Microsoft Office 2010 (or above). + +VAMT is only available in an EN-US (x86) package. + +## In this section + +|Topic |Description | +|------|------------| +|[Introduction to VAMT](introduction-vamt.md) |Provides a description of VAMT and common usages. | +|[Active Directory-Based Activation Overview](active-directory-based-activation-overview.md) |Describes Active Directory-Based Activation scenarios. | +|[Install and Configure VAMT](install-configure-vamt.md) |Describes how to install VAMT and use it to configure client computers on your network. | +|[Add and Manage Products](add-manage-products-vamt.md) |Describes how to add client computers into VAMT. | +|[Manage Product Keys](manage-product-keys-vamt.md) |Describes how to add and remove a product key from VAMT. | +|[Manage Activations](manage-activations-vamt.md) |Describes how to activate a client computer by using a variety of activation methods. | +|[Manage VAMT Data](manage-vamt-data.md) |Describes how to save, import, export, and merge a Computer Information List (CILX) file using VAMT. | +|[VAMT Step-by-Step Scenarios](vamt-step-by-step.md) |Provides step-by-step instructions for using VAMT in typical environments. | +|[VAMT Known Issues](vamt-known-issues.md) |Lists known issues in VAMT. | + diff --git a/windows/deployment/volume-activation/volume-activation-windows-10.md b/windows/deployment/volume-activation/volume-activation-windows-10.md index 0d0a77909e..a820b9e25b 100644 --- a/windows/deployment/volume-activation/volume-activation-windows-10.md +++ b/windows/deployment/volume-activation/volume-activation-windows-10.md @@ -1,6 +1,6 @@ --- -title: Volume Activation for Windows 10 (Windows 10) -description: This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. +title: Volume Activation for Windows 10 +description: Learn how to use volume activation to deploy & activate Windows 10. Includes details for orgs that have used volume activation for earlier versions of Windows. ms.assetid: 6e8cffae-7322-4fd3-882a-cde68187aef2 ms.reviewer: manager: laurawi @@ -10,7 +10,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article @@ -18,52 +19,54 @@ ms.topic: article # Volume Activation for Windows 10 -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 +> Applies to +> +>- Windows 10 +>- Windows Server 2012 R2 +>- Windows Server 2012 +>- Windows Server 2016 +>- Windows Server 2019 **Looking for volume licensing information?** -- [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://go.microsoft.com/fwlink/p/?LinkId=620104) + +- [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://go.microsoft.com/fwlink/p/?LinkId=620104) **Looking for retail activation?** -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +- [Get Help Activating Microsoft Windows](https://support.microsoft.com/help/12440/windows-10-activate) This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. -*Volume activation* is the process that Microsoft volume licensing customers use to automate and manage the activation of Windows operating systems, Microsoft Office, and other Microsoft products across large organizations. Volume licensing is available to customers who purchase software under various volume programs (such as Open and Select) and to participants in programs such as the Microsoft Partner Program and MSDN Subscriptions. + +*Volume activation* is the process that Microsoft volume licensing customers use to automate and manage the activation of Windows operating systems, Microsoft Office, and other Microsoft products across large organizations. Volume licensing is available to customers who purchase software under various volume programs (such as [Open](https://www.microsoft.com/Licensing/licensing-programs/open-license) and [Select](https://www.microsoft.com/Licensing/licensing-programs/select)) and to participants in programs such as the [Microsoft Partner Program](https://partner.microsoft.com/) and [MSDN Subscriptions](https://visualstudio.microsoft.com/msdn-platforms/). Volume activation is a configurable solution that helps automate and manage the product activation process on computers running Windows operating systems that have been licensed under a volume licensing program. Volume activation is also used with other software from Microsoft (most notably the Office suites) that are sold under volume licensing agreements and that support volume activation. -This guide provides information and step-by-step guidance to help you choose a volume activation method that suits your environment, and then to configure that solution successfully. This guide describes the volume activation features that are available in Windows 10 and Windows Server 2012 R2 and the tools that are provided in these versions of Windows and Windows Server to manage volume activation. +This guide provides information and step-by-step guidance to help you choose a volume activation method that suits your environment, and then to configure that solution successfully. This guide describes the volume activation features and the tools to manage volume activation. -Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8, Windows 7, Windows Server 2012, and Windows Server 2008 R2Windows Server 2008 R2 operating systems. This guide -discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. +Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8.1, Windows 7, Windows Server 2012, and Windows Server 2008 R2 operating systems. This guide discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. -Volume activation—and the need for activation itself—is not new, and this guide does not review all of its concepts and history. You can find additional background in the appendices of this guide. For more information, see [Volume Activation Overview](https://go.microsoft.com/fwlink/p/?LinkId=618209) in the TechNet Library. +Volume activation -and the need for activation itself- is not new, and this guide does not review all of its concepts and history. You can find additional background in the appendices of this guide. For more information, see [Volume Activation Overview](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831612(v=ws.11)). If you would like additional information about planning a volume activation deployment specifically for Windows 7 and Windows Server 2008 R2, please see the [Volume Activation Planning Guide for Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=618210). To successfully plan and implement a volume activation strategy, you must: -- Learn about and understand product activation. -- Review and evaluate the available activation types or models. -- Consider the connectivity of the clients to be activated. -- Choose the method or methods to be used with each type of client. -- Determine the types and number of product keys you will need. -- Determine the monitoring and reporting needs in your organization. -- Install and configure the tools required to support the methods selected. + +- Learn about and understand product activation. +- Review and evaluate the available activation types or models. +- Consider the connectivity of the clients to be activated. +- Choose the method or methods to be used with each type of client. +- Determine the types and number of product keys you will need. +- Determine the monitoring and reporting needs in your organization. +- Install and configure the tools required to support the methods selected. Keep in mind that the method of activation does not change an organization’s responsibility to the licensing requirements. You must ensure that all software used in your organization is properly licensed and activated in accordance with the terms of the licensing agreements in place. -**In this guide:** -- [Plan for volume activation](plan-for-volume-activation-client.md) -- [Activate using Key Management Service](activate-using-key-management-service-vamt.md) -- [Activate using Active Directory-based activation](activate-using-active-directory-based-activation-client.md) -- [Activate clients running Windows 10](activate-windows-10-clients-vamt.md) -- [Monitor activation](monitor-activation-client.md) -- [Use the Volume Activation Management Tool](use-the-volume-activation-management-tool-client.md) -- [Appendix: Information sent to Microsoft during activation](appendix-information-sent-to-microsoft-during-activation-client.md) -  +## Additional information + +- [Plan for volume activation](plan-for-volume-activation-client.md) +- [Activate using Key Management Service](activate-using-key-management-service-vamt.md) +- [Activate using Active Directory-based activation](activate-using-active-directory-based-activation-client.md) +- [Activate clients running Windows 10](activate-windows-10-clients-vamt.md) +- [Monitor activation](monitor-activation-client.md) +- [Use the Volume Activation Management Tool](use-the-volume-activation-management-tool-client.md) +- [Appendix: Information sent to Microsoft during activation](appendix-information-sent-to-microsoft-during-activation-client.md) diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md new file mode 100644 index 0000000000..99b5479318 --- /dev/null +++ b/windows/deployment/windows-10-deployment-posters.md @@ -0,0 +1,40 @@ +--- +title: Windows 10 deployment process posters +description: View and download Windows 10 deployment process flows for Microsoft Endpoint Configuration Manager and Windows Autopilot. +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.author: greglin +keywords: upgrade, in-place, configuration, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +ms.topic: article +--- + +# Windows 10 deployment process posters + +**Applies to** +- Windows 10 + +The following posters step through various options for deploying Windows 10 with Windows Autopilot or Microsoft Endpoint Configuration Manager. + +## Deploy Windows 10 with Autopilot + +The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format. + +[![Deploy Windows 10 with Autopilot](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) + +## Deploy Windows 10 with Microsoft Endpoint Configuration Manager + +The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format. + +[![Deploy Windows 10 with Configuration Manager](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) + +## See also + +[Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot)
              +[Scenarios to deploy enterprise operating systems with Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems) \ No newline at end of file diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md index 26151664de..61d5af710d 100644 --- a/windows/deployment/windows-10-deployment-scenarios.md +++ b/windows/deployment/windows-10-deployment-scenarios.md @@ -1,275 +1,275 @@ ---- -title: Windows 10 deployment scenarios (Windows 10) -description: To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. -ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -keywords: upgrade, in-place, configuration, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.date: 11/06/2018 -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 deployment scenarios - -**Applies to** -- Windows 10 - -To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the capabilities and limitations of each, is a key task. - -The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. -- Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home). -- Dynamic deployment methods enable you to configure applications and settings for specific use cases. -- Traditional deployment methods use existing tools to deploy operating system images.
                - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              CategoryScenarioDescriptionMore information
              Modern - -[Windows Autopilot](#windows-autopilot) - Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured. - -Overview of Windows Autopilot -
              - -[In-place upgrade](#in-place-upgrade) - - - Use Windows Setup to update your OS and migrate apps and settings. Rollback data is saved in Windows.old. - -Perform an in-place upgrade to Windows 10 with MDT
              Perform an in-place upgrade to Windows 10 using Configuration Manager -
              - Dynamic - - -[Subscription Activation](#windows-10-subscription-activation) - - Switch from Windows 10 Pro to Enterprise when a subscribed user signs in. - -Windows 10 Subscription Activation -
              - - [AAD / MDM](#dynamic-provisioning) - - The device is automatically joined to AAD and configured by MDM. - -Azure Active Directory integration with MDM -
              - - [Provisioning packages](#dynamic-provisioning) - - Using the Windows Imaging and Configuration Designer tool, create provisioning packages that can be applied to devices. - -Configure devices without MDM -
              - Traditional - - - [Bare metal](#new-computer) - - Deploy a new device, or wipe an existing device and deploy with a fresh image. - - Deploy a Windows 10 image using MDT
              Install a new version of Windows on a new computer with System Center Configuration Manager -
              - - [Refresh](#computer-refresh) - - Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. - - Refresh a Windows 7 computer with Windows 10
              Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager -
              - - [Replace](#computer-replace) - - Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device. - - Replace a Windows 7 computer with a Windows 10 computer
              Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager -
              - -
                - - ->[!IMPORTANT] ->The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
              ->Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS. - -## Modern deployment methods - -Modern deployment methods embrace both traditional on-prem and cloud services to deliver a simple, streamlined, cost effective deployment experience. - -### Windows Autopilot - -Windows Autopilot is a new suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. Windows Autopilot enables IT professionals to customize the Out of Box Experience (OOBE) for Windows 10 PCs and provide end users with a fully configured new Windows 10 device after just a few clicks. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Users can go through the deployment process independently, without the need consult their IT administrator. - -For more information about Windows Autopilot, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) and [Modernizing Windows deployment with Windows Autopilot](https://blogs.technet.microsoft.com/windowsitpro/2017/06/29/modernizing-windows-deployment-with-windows-autopilot/). - -### In-place upgrade - -For existing computers running Windows 7, Windows 8, or Windows 8.1, the recommended path for organizations deploying Windows 10 leverages the Windows installation program (Setup.exe) to perform an in-place upgrade, which automatically preserves all data, settings, applications, and drivers from the existing operating system version. This requires the least IT effort, because there is no need for any complex deployment infrastructure. - -Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like System Center Configuration Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. - -The in-place upgrade process is designed to be extremely reliable, with the ability to automatically roll back to the previous operating system if any issues are encountered during the deployment process, without any IT staff involvement. Rolling back manually can also be done by leveraging the automatically-created recovery information (stored in the Windows.old folder), in case any issues are encountered after the upgrade is finished. The upgrade process is also typically faster than traditional deployments, because applications do not need to be reinstalled as part of the process. - -Because existing applications are preserved through the process, the upgrade process uses the standard Windows installation media image (Install.wim); custom images are not needed and cannot be used because the upgrade process is unable to deal with conflicts between apps in the old and new operating system. (For example, Contoso Timecard 1.0 in Windows 7 and Contoso Timecard 3.0 in the Windows 10 image.) - -Scenarios that support in-place upgrade with some additional procedures include changing from BIOS to UEFI boot mode and upgrade of devices that use non-Microsoft disk encryption software. - -- **Legacy BIOS to UEFI booting**: To perform an in-place upgrade on a UEFI-capable system that currently boots using legacy BIOS, first perform the in-place upgrade to Windows 10, maintaining the legacy BIOS boot mode. Windows 10 does not require UEFI, so it will work fine to upgrade a system using legacy BIOS emulation. After the upgrade, if you wish to enable Windows 10 features that require UEFI (such as Secure Boot), you can convert the system disk to a format that supports UEFI boot using the [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) tool. Note: [UEFI specification](http://www.uefi.org/specifications) requires GPT disk layout. After the disk has been converted, you must also configure the firmware to boot in UEFI mode. - -- **Non-Microsoft disk encryption software**: While devices encrypted with BitLocker can easily be upgraded, more work is necessary for non-Microsoft disk encryption tools. Some ISVs will provide instructions on how to integrate their software into the in-place upgrade process. Check with your ISV to see if they have instructions. The following articles provide details on how to provision encryption drivers for use during Windows Setup via the ReflectDrivers setting: - - [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) - - [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) - -There are some situations where you cannot use in-place upgrade; in these situations, you can use traditional deployment (wipe-and-load) instead. Examples of these situations include: - -- Changing from Windows 7, Windows 8, or Windows 8.1 x86 to Windows 10 x64. The upgrade process cannot change from a 32-bit operating system to a 64-bit operating system, because of possible complications with installed applications and drivers. -- Windows To Go and Boot from VHD installations. The upgrade process is unable to upgrade these installations. Instead, new installations would need to be performed. -- Updating existing images. While it might be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image, this is not supported – preparing an upgraded OS for imaging (using Sysprep.exe) is not supported and will not work when it detects the upgraded OS. -- Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS; if using dual-boot or multi-boot systems with multiple operating systems (not leveraging virtual machines for the second and subsequent operating systems), additional care should be taken. - - -## Dynamic provisioning - -For new PCs, organizations have historically replaced the version of Windows included on the device with their own custom Windows image, because this was often faster and easier than leveraging the preinstalled version. But this is an added expense due to the time and effort required. With the new dynamic provisioning capabilities and tools provided with Windows 10, it is now possible to avoid this. - -The goal of dynamic provisioning is to take a new PC out of the box, turn it on, and transform it into a productive organization device, with minimal time and effort. The types of transformations that are available include: - -### Windows 10 Subscription Activation - -Windows 10 Subscription Activation is a modern deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation). - - -### Azure Active Directory (AAD) join with automatic mobile device management (MDM) enrollment - -In this scenario, the organization member just needs to provide their work or school user ID and password; the device can then be automatically joined to Azure Active Directory and enrolled in a mobile device management (MDM) solution with no additional user interaction. Once done, the MDM solution can finish configuring the device as needed. For more information, see [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm). - -### Provisioning package configuration - -Using the [Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkId=619358), IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a machine. These packages can then be deployed to new PCs through a variety of means, typically by IT professionals. For more information, see [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm). - -These scenarios can be used to enable “choose your own device” (CYOD) programs where the organization’s users can pick their own PC and not be restricted to a small list of approved or certified models (programs that are difficult to implement using traditional deployment scenarios). - -While the initial Windows 10 release includes a variety of provisioning settings and deployment mechanisms, these will continue to be enhanced and extended based on feedback from organizations. As with all Windows features, organizations can submit suggestions for additional features through the Windows Feedback app or through their Microsoft Support contacts. - -## Traditional deployment: - -New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md), and [System Center Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). - -With the release of Windows 10, all of these tools are being updated to fully support Windows 10. Although newer scenarios such as in-place upgrade and dynamic provisioning may reduce the need for traditional deployment capabilities in some organizations, these traditional methods remain important and will continue to be available to organizations that need them. - -The traditional deployment scenario can be divided into different sub-scenarios. These are explained in detail in the following sections, but the following provides a brief summary: - -- **New computer.** A bare-metal deployment of a new machine. - -- **Computer refresh.** A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup). - -- **Computer replace.** A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup). - -### New computer - -Also called a "bare metal" deployment. This scenario occurs when you have a blank machine you need to deploy, or an existing machine you want to wipe and redeploy without needing to preserve any existing data. The setup starts from a boot media, using CD, USB, ISO, or Pre-Boot Execution Environment (PXE). You can also generate a full offline media that includes all the files needed for a client deployment, allowing you to deploy without having to connect to a central deployment share. The target can be a physical computer, a virtual machine, or a Virtual Hard Disk (VHD) running on a physical computer (boot from VHD). - -The deployment process for the new machine scenario is as follows: - -1. Start the setup from boot media (CD, USB, ISO, or PXE). - -2. Wipe the hard disk clean and create new volume(s). - -3. Install the operating system image. - -4. Install other applications (as part of the task sequence). - -After taking these steps, the computer is ready for use. - -### Computer refresh - -A refresh is sometimes called wipe-and-load. The process is normally initiated in the running operating system. User data and settings are backed up and restored later as part of the deployment process. The target can be the same as for the new computer scenario. - -The deployment process for the wipe-and-load scenario is as follows: - -1. Start the setup on a running operating system. - -2. Save the user state locally. - -3. Wipe the hard disk clean (except for the folder containing the backup). - -4. Install the operating system image. - -5. Install other applications. - -6. Restore the user state. - -After taking these steps, the machine is ready for use. - -### Computer replace - -A computer replace is similar to the refresh scenario. However, since we are replacing the machine, we divide this scenario into two main tasks: backup of the old client and bare-metal deployment of the new client. As with the refresh scenario, user data and settings are backed up and restored. - -The deployment process for the replace scenario is as follows: - -1. Save the user state (data and settings) on the server through a backup job on the running operating system. - -2. Deploy the new computer as a bare-metal deployment. - - **Note**
              In some situations, you can use the replace scenario even if the target is the same machine. For example, you can use replace if you want to modify the disk layout from the master boot record (MBR) to the GUID partition table (GPT), which will allow you to take advantage of the Unified Extensible Firmware Interface (UEFI) functionality. You can also use replace if the disk needs to be repartitioned since user data needs to be transferred off the disk. - -## Related topics - -- [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) -- [Upgrade to Windows 10 with System Center Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) -- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=620230) -- [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) -- [Windows setup technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619357) -- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=619358) -- [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619359) +--- +title: Windows 10 deployment scenarios (Windows 10) +description: Understand the different ways Windows 10 operating system can be deployed in your organization. Explore several Windows 10 deployment scenarios. +ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +keywords: upgrade, in-place, configuration, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +ms.topic: article +--- + +# Windows 10 deployment scenarios + +**Applies to** +- Windows 10 + +To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the capabilities and limitations of each, is a key task. + +The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. +- Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home). + - Note: Once you have deployed Windows 10 in your organization, it is important to stay up to date by [creating a deployment plan](update/create-deployment-plan.md) for Windows 10 feature updates. +- Dynamic deployment methods enable you to configure applications and settings for specific use cases. +- Traditional deployment methods use existing tools to deploy operating system images.
                + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              CategoryScenarioDescriptionMore information
              Modern + +[Windows Autopilot](#windows-autopilot) + Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured. + +Overview of Windows Autopilot +
              + +[In-place upgrade](#in-place-upgrade) + + + Use Windows Setup to update your OS and migrate apps and settings. Rollback data is saved in Windows.old. + +Perform an in-place upgrade to Windows 10 with MDT
              Perform an in-place upgrade to Windows 10 using Configuration Manager +
              + Dynamic + + +[Subscription Activation](#windows-10-subscription-activation) + + Switch from Windows 10 Pro to Enterprise when a subscribed user signs in. + +Windows 10 Subscription Activation +
              + + [AAD / MDM](#dynamic-provisioning) + + The device is automatically joined to AAD and configured by MDM. + +Azure Active Directory integration with MDM +
              + + [Provisioning packages](#dynamic-provisioning) + + Using the Windows Imaging and Configuration Designer tool, create provisioning packages that can be applied to devices. + +Configure devices without MDM +
              + Traditional + + + [Bare metal](#new-computer) + + Deploy a new device, or wipe an existing device and deploy with a fresh image. + + Deploy a Windows 10 image using MDT
              Deploy Windows 10 using PXE and Configuration Manager +
              + + [Refresh](#computer-refresh) + + Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. + + Refresh a Windows 7 computer with Windows 10
              Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager +
              + + [Replace](#computer-replace) + + Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device. + + Replace a Windows 7 computer with a Windows 10 computer
              Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager +
              + +
                + + +>[!IMPORTANT] +>The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
              +>Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS. + +## Modern deployment methods + +Modern deployment methods embrace both traditional on-prem and cloud services to deliver a simple, streamlined, cost effective deployment experience. + +### Windows Autopilot + +Windows Autopilot is a new suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. Windows Autopilot enables IT professionals to customize the Out of Box Experience (OOBE) for Windows 10 PCs and provide end users with a fully configured new Windows 10 device after just a few clicks. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Users can go through the deployment process independently, without the need consult their IT administrator. + +For more information about Windows Autopilot, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) and [Modernizing Windows deployment with Windows Autopilot](https://blogs.technet.microsoft.com/windowsitpro/2017/06/29/modernizing-windows-deployment-with-windows-autopilot/). + +### In-place upgrade + +For existing computers running Windows 7, Windows 8, or Windows 8.1, the recommended path for organizations deploying Windows 10 leverages the Windows installation program (Setup.exe) to perform an in-place upgrade, which automatically preserves all data, settings, applications, and drivers from the existing operating system version. This requires the least IT effort, because there is no need for any complex deployment infrastructure. + +Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like Microsoft Endpoint Configuration Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. + +The in-place upgrade process is designed to be extremely reliable, with the ability to automatically roll back to the previous operating system if any issues are encountered during the deployment process, without any IT staff involvement. Rolling back manually can also be done by leveraging the automatically-created recovery information (stored in the Windows.old folder), in case any issues are encountered after the upgrade is finished. The upgrade process is also typically faster than traditional deployments, because applications do not need to be reinstalled as part of the process. + +Because existing applications are preserved through the process, the upgrade process uses the standard Windows installation media image (Install.wim); custom images are not needed and cannot be used because the upgrade process is unable to deal with conflicts between apps in the old and new operating system. (For example, Contoso Timecard 1.0 in Windows 7 and Contoso Timecard 3.0 in the Windows 10 image.) + +Scenarios that support in-place upgrade with some additional procedures include changing from BIOS to UEFI boot mode and upgrade of devices that use non-Microsoft disk encryption software. + +- **Legacy BIOS to UEFI booting**: To perform an in-place upgrade on a UEFI-capable system that currently boots using legacy BIOS, first perform the in-place upgrade to Windows 10, maintaining the legacy BIOS boot mode. Windows 10 does not require UEFI, so it will work fine to upgrade a system using legacy BIOS emulation. After the upgrade, if you wish to enable Windows 10 features that require UEFI (such as Secure Boot), you can convert the system disk to a format that supports UEFI boot using the [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) tool. Note: [UEFI specification](http://www.uefi.org/specifications) requires GPT disk layout. After the disk has been converted, you must also configure the firmware to boot in UEFI mode. + +- **Non-Microsoft disk encryption software**: While devices encrypted with BitLocker can easily be upgraded, more work is necessary for non-Microsoft disk encryption tools. Some ISVs will provide instructions on how to integrate their software into the in-place upgrade process. Check with your ISV to see if they have instructions. The following articles provide details on how to provision encryption drivers for use during Windows Setup via the ReflectDrivers setting: + - [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) + - [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) + +There are some situations where you cannot use in-place upgrade; in these situations, you can use traditional deployment (wipe-and-load) instead. Examples of these situations include: + +- Changing from Windows 7, Windows 8, or Windows 8.1 x86 to Windows 10 x64. The upgrade process cannot change from a 32-bit operating system to a 64-bit operating system, because of possible complications with installed applications and drivers. +- Windows To Go and Boot from VHD installations. The upgrade process is unable to upgrade these installations. Instead, new installations would need to be performed. +- Updating existing images. While it might be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image, this is not supported – preparing an upgraded OS for imaging (using Sysprep.exe) is not supported and will not work when it detects the upgraded OS. +- Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS; if using dual-boot or multi-boot systems with multiple operating systems (not leveraging virtual machines for the second and subsequent operating systems), additional care should be taken. + + +## Dynamic provisioning + +For new PCs, organizations have historically replaced the version of Windows included on the device with their own custom Windows image, because this was often faster and easier than leveraging the preinstalled version. But this is an added expense due to the time and effort required. With the new dynamic provisioning capabilities and tools provided with Windows 10, it is now possible to avoid this. + +The goal of dynamic provisioning is to take a new PC out of the box, turn it on, and transform it into a productive organization device, with minimal time and effort. The types of transformations that are available include: + +### Windows 10 Subscription Activation + +Windows 10 Subscription Activation is a modern deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation). + + +### Azure Active Directory (AAD) join with automatic mobile device management (MDM) enrollment + +In this scenario, the organization member just needs to provide their work or school user ID and password; the device can then be automatically joined to Azure Active Directory and enrolled in a mobile device management (MDM) solution with no additional user interaction. Once done, the MDM solution can finish configuring the device as needed. For more information, see [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm). + +### Provisioning package configuration + +Using the [Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkId=619358), IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a machine. These packages can then be deployed to new PCs through a variety of means, typically by IT professionals. For more information, see [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm). + +These scenarios can be used to enable “choose your own device” (CYOD) programs where the organization’s users can pick their own PC and not be restricted to a small list of approved or certified models (programs that are difficult to implement using traditional deployment scenarios). + +While the initial Windows 10 release includes a variety of provisioning settings and deployment mechanisms, these will continue to be enhanced and extended based on feedback from organizations. As with all Windows features, organizations can submit suggestions for additional features through the Windows Feedback app or through their Microsoft Support contacts. + +## Traditional deployment: + +New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md), and [Microsoft Endpoint Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). + +With the release of Windows 10, all of these tools are being updated to fully support Windows 10. Although newer scenarios such as in-place upgrade and dynamic provisioning may reduce the need for traditional deployment capabilities in some organizations, these traditional methods remain important and will continue to be available to organizations that need them. + +The traditional deployment scenario can be divided into different sub-scenarios. These are explained in detail in the following sections, but the following provides a brief summary: + +- **New computer.** A bare-metal deployment of a new machine. +- **Computer refresh.** A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup). +- **Computer replace.** A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup). + +### New computer + +Also called a "bare metal" deployment. This scenario occurs when you have a blank machine you need to deploy, or an existing machine you want to wipe and redeploy without needing to preserve any existing data. The setup starts from a boot media, using CD, USB, ISO, or Pre-Boot Execution Environment (PXE). You can also generate a full offline media that includes all the files needed for a client deployment, allowing you to deploy without having to connect to a central deployment share. The target can be a physical computer, a virtual machine, or a Virtual Hard Disk (VHD) running on a physical computer (boot from VHD). + +The deployment process for the new machine scenario is as follows: + +1. Start the setup from boot media (CD, USB, ISO, or PXE). + +2. Wipe the hard disk clean and create new volume(s). + +3. Install the operating system image. + +4. Install other applications (as part of the task sequence). + +After taking these steps, the computer is ready for use. + +### Computer refresh + +A refresh is sometimes called wipe-and-load. The process is normally initiated in the running operating system. User data and settings are backed up and restored later as part of the deployment process. The target can be the same as for the new computer scenario. + +The deployment process for the wipe-and-load scenario is as follows: + +1. Start the setup on a running operating system. + +2. Save the user state locally. + +3. Wipe the hard disk clean (except for the folder containing the backup). + +4. Install the operating system image. + +5. Install other applications. + +6. Restore the user state. + +After taking these steps, the machine is ready for use. + +### Computer replace + +A computer replace is similar to the refresh scenario. However, since we are replacing the machine, we divide this scenario into two main tasks: backup of the old client and bare-metal deployment of the new client. As with the refresh scenario, user data and settings are backed up and restored. + +The deployment process for the replace scenario is as follows: + +1. Save the user state (data and settings) on the server through a backup job on the running operating system. + +2. Deploy the new computer as a bare-metal deployment. + + **Note**
              In some situations, you can use the replace scenario even if the target is the same machine. For example, you can use replace if you want to modify the disk layout from the master boot record (MBR) to the GUID partition table (GPT), which will allow you to take advantage of the Unified Extensible Firmware Interface (UEFI) functionality. You can also use replace if the disk needs to be repartitioned since user data needs to be transferred off the disk. + +## Related topics + +- [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) +- [Upgrade to Windows 10 with Microsoft Endpoint Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) +- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=620230) +- [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) +- [Windows setup technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619357) +- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=619358) +- [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619359) diff --git a/windows/deployment/windows-10-deployment-tools-reference.md b/windows/deployment/windows-10-deployment-tools-reference.md index 46feb45c03..9bb72ea7bb 100644 --- a/windows/deployment/windows-10-deployment-tools-reference.md +++ b/windows/deployment/windows-10-deployment-tools-reference.md @@ -1,28 +1,30 @@ ---- -title: Windows 10 deployment tools (Windows 10) -description: Learn about the tools available to deploy Windows 10. -ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 07/12/2017 -ms.topic: article ---- - -# Windows 10 deployment tools - -Learn about the tools available to deploy Windows 10. - -|Topic |Description | -|------|------------| -|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. | -|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. | -|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | -|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | -|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | -|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | -|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | +--- +title: Windows 10 deployment tools reference +description: Learn about the tools available to deploy Windows 10, like Volume Activation Management Tool (VAMT) and User State Migration Tool (USMT). +ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +ms.date: 07/12/2017 +ms.topic: article +--- + +# Windows 10 deployment tools reference + +Learn about the tools available to deploy Windows 10. + +|Topic |Description | +|------|------------| +|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. | +|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. | +|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | +|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | +|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | +|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | +|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | diff --git a/windows/deployment/windows-10-deployment-tools.md b/windows/deployment/windows-10-deployment-tools.md index 43fe3a68c7..6a20248ebe 100644 --- a/windows/deployment/windows-10-deployment-tools.md +++ b/windows/deployment/windows-10-deployment-tools.md @@ -1,28 +1,30 @@ ---- -title: Windows 10 deployment tools (Windows 10) -description: Learn about the tools available to deploy Windows 10. -ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 10/16/2017 -ms.topic: article ---- - -# Windows 10 deployment tools - -Learn about the tools available to deploy Windows 10. - -|Topic |Description | -|------|------------| -|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. | -|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. | -|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | -|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | -|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | -|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | -|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | +--- +title: Windows 10 deployment tools +description: Learn how to use Windows 10 deployment tools to successfully deploy Windows 10 to your organization. +ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +ms.date: 10/16/2017 +ms.topic: article +--- + +# Windows 10 deployment tools + +Learn about the tools available to deploy Windows 10. + +|Topic |Description | +|------|------------| +|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. | +|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. | +|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | +|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | +|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | +|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | +|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md index 6b45127282..d362478ccc 100644 --- a/windows/deployment/windows-10-enterprise-e3-overview.md +++ b/windows/deployment/windows-10-enterprise-e3-overview.md @@ -1,258 +1,259 @@ ---- -title: Windows 10 Enterprise E3 in CSP -description: Describes Windows 10 Enterprise E3, an offering that delivers, by subscription, the features of Windows 10 Enterprise edition. -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -ms.date: 08/24/2017 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -audience: itpro author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows 10 Enterprise E3 in CSP - -Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. Windows 10 Enterprise E3 in CSP is a new offering that delivers, by subscription, exclusive features reserved for Windows 10 Enterprise edition. This offering is available through the Cloud Solution Provider (CSP) channel via the Partner Center as an online service. Windows 10 Enterprise E3 in CSP provides a flexible, per-user subscription for small- and medium-sized organizations (from one to hundreds of users). To take advantage of this offering, you must have the following: - -- Windows 10 Pro, version 1607 (Windows 10 Anniversary Update) or later, installed and activated, on the devices to be upgraded -- Azure Active Directory (Azure AD) available for identity management - -Starting with Windows 10, version 1607 (Windows 10 Anniversary Update), you can move from Windows 10 Pro to Windows 10 Enterprise more easily than ever before—no keys and no reboots. After one of your users enters the Azure AD credentials associated with a Windows 10 Enterprise E3 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise and all the appropriate Windows 10 Enterprise features are unlocked. When a subscription license expires or is transferred to another user, the Windows 10 Enterprise device seamlessly steps back down to Windows 10 Pro. - -Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 in CSP, small- and medium-sized organizations can more easily take advantage of Windows 10 Enterprise features. - -When you purchase Windows 10 Enterprise E3 via a partner, you get the following benefits: - -- **Windows 10 Enterprise edition**. Devices currently running Windows 10 Pro, version 1607 can get Windows 10 Enterprise Current Branch (CB) or Current Branch for Business (CBB). This benefit does not include Long Term Service Branch (LTSB). - -- **Support from one to hundreds of users**. Although the Windows 10 Enterprise E3 in CSP program does not have a limitation on the number of licenses an organization can have, the program is designed for small- and medium-sized organizations. - -- **Deploy on up to five devices**. For each user covered by the license, you can deploy Windows 10 Enterprise edition on up to five devices. - -- **Roll back to Windows 10 Pro at any time**. When a user’s subscription expires or is transferred to another user, the Windows 10 Enterprise device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 90 days). - -- **Monthly, per-user pricing model**. This makes Windows 10 Enterprise E3 affordable for any organization. - -- **Move licenses between users**. Licenses can be quickly and easily reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. - -How does the Windows 10 Enterprise E3 in CSP program compare with Microsoft Volume Licensing Agreements and Software Assurance? - -- [Microsoft Volume Licensing](https://www.microsoft.com/en-us/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. - -- [Software Assurance](https://www.microsoft.com/en-us/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: - - - **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits. - - - **Training**. These benefits include training vouchers, online e-learning, and a home use program. - - - **Support**. These benefits include 24x7 problem resolution support, backup capabilities for disaster recovery, System Center Global Service Monitor, and a passive secondary instance of SQL Server. - - - **Specialized**. These benefits include step-up licensing availability (which enables you to migrate software from an earlier edition to a higher-level edition) and to spread license and Software Assurance payments across three equal, annual sums. - - In addition, in Windows 10 Enterprise E3 in CSP, a partner can manage your licenses for you. With Software Assurance, you, the customer, manage your own licenses. - -In summary, the Windows 10 Enterprise E3 in CSP program is an upgrade offering that provides small- and medium-sized organizations easier, more flexible access to the benefits of Windows 10 Enterprise edition, whereas Microsoft Volume Licensing programs and Software Assurance are broader in scope and provide benefits beyond access to Windows 10 Enterprise edition. - -## Compare Windows 10 Pro and Enterprise editions - -Windows 10 Enterprise edition has a number of features that are unavailable in Windows 10 Pro. Table 1 lists the Windows 10 Enterprise features not found in Windows 10 Pro. Many of these features are security-related, whereas others enable finer-grained device management. - -*Table 1. Windows 10 Enterprise features not found in Windows 10 Pro* - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              FeatureDescription

              Credential Guard

              This feature uses virtualization-based security to help protect security secrets (for example, NTLM password hashes, Kerberos Ticket Granting Tickets) so that only privileged system software can access them. This helps prevent Pass-the-Hash or Pass-the-Ticket attacks.

              -

              Credential Guard has the following features:

              -
                -
              • Hardware-level security.  Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.

              • -
              • Virtualization-based security.  Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.

              • -
              • Improved protection against persistent threats.  Credential Guard works with other technologies (e.g., Device Guard) to help provide further protection against attacks, no matter how persistent.

              • -
              • Improved manageability.  Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.

              • -
              -

              For more information, see Protect derived domain credentials with Credential Guard.

              -

              Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)

              Device Guard

              This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.

              -

              Device Guard does the following:

              -
                -
              • Helps protect against malware

              • -
              • Helps protect the Windows system core from vulnerability and zero-day exploits

              • -
              • Allows only trusted apps to run

              • -
              -

              For more information, see Introduction to Device Guard.

              AppLocker management

              This feature helps IT pros determine which applications and files users can run on a device (also known as “whitelisting”). The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

              -

              For more information, see AppLocker.

              Application Virtualization (App-V)

              This feature makes applications available to end users without installing the applications directly on users’ devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.

              -

              For more information, see Getting Started with App-V for Windows 10.

              User Experience Virtualization (UE-V)

              With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.

              -

              UE-V provides the ability to do the following:

              -
                -
              • Specify which application and Windows settings synchronize across user devices

              • -
              • Deliver the settings anytime and anywhere users work throughout the enterprise

              • -
              • Create custom templates for your third-party or line-of-business applications

              • -
              • Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state

              • -
              -

              For more information, see User Experience Virtualization (UE-V) for Windows 10 overview.

              Managed User Experience

              This feature helps customize and lock down a Windows device’s user interface to restrict it to a specific task. For example, you can configure a device for a controlled scenario such as a kiosk or classroom device. The user experience would be automatically reset once a user signs off. You can also restrict access to services including Cortana or the Windows Store, and manage Start layout options, such as:

              -
                -
              • Removing and preventing access to the Shut Down, Restart, Sleep, and Hibernate commands

              • -
              • Removing Log Off (the User tile) from the Start menu

              • -
              • Removing frequent programs from the Start menu

              • -
              • Removing the All Programs list from the Start menu

              • -
              • Preventing users from customizing their Start screen

              • -
              • Forcing Start menu to be either full-screen size or menu size

              • -
              • Preventing changes to Taskbar and Start menu settings

              • -
              -
              - -## Deployment of Windows 10 Enterprise E3 licenses - -See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). - -## Deploy Windows 10 Enterprise features - -Now that you have Windows 10 Enterprise edition running on devices, how do you take advantage of the Enterprise edition features and capabilities? What are the next steps that need to be taken for each of the features discussed in [Table 1](#compare-windows10-pro-and-enterprise-editions)? - -The following sections provide you with the high-level tasks that need to be performed in your environment to help users take advantage of the Windows 10 Enterprise edition features. - -### Credential Guard\* - -You can implement Credential Guard on Windows 10 Enterprise devices by turning on Credential Guard on these devices. Credential Guard uses Windows 10 virtualization-based security features (Hyper-V features) that must be enabled on each device before you can turn on Credential Guard. You can turn on Credential Guard by using one of the following methods: - -- **Automated**. You can automatically turn on Credential Guard for one or more devices by using Group Policy. The Group Policy settings automatically add the virtualization-based security features and configure the Credential Guard registry settings on managed devices. - -- **Manual**. You can manually turn on Credential Guard by doing the following: - - - Add the virtualization-based security features by using Programs and Features or Deployment Image Servicing and Management (DISM). - - - Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). - - You can automate these manual steps by using a management tool such as System Center Configuration Manager. - -For more information about implementing Credential Guard, see the following resources: - -- [Protect derived domain credentials with Credential Guard](https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard) -- [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx) -- [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337) - -\* *Requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)* - -### Device Guard - -Now that the devices have Windows 10 Enterprise, you can implement Device Guard on the Windows 10 Enterprise devices by performing the following steps: - -1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal certificate authority (CA). If you choose to use an internal CA, you will need to create a code signing certificate. - -2. **Create code integrity policies from “golden” computers**. When you have identified departments or roles that use distinctive or partly distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing code integrity policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a code integrity policy and decide how to manage that policy. You can merge code integrity policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. - -3. **Audit the code integrity policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each code integrity policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. - -4. **Create a “catalog file” for unsigned line-of-business (LOB) applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. In later steps, you can merge the catalog file's signature into your code integrity policy so that applications in the catalog will be allowed by the policy. - -5. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a code integrity policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge code integrity policies from other sources also, for flexibility in how you create your final code integrity policies. - -6. **Deploy code integrity policies and catalog files**. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking code integrity policies out of audit mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and code integrity policies more broadly. - -7. **Enable desired hardware security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies. - -For more information about implementing Device Guard, see: - -- [Planning and getting started on the Device Guard deployment process](https://technet.microsoft.com/itpro/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process) -- [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide) - -### AppLocker management - -You can manage AppLocker in Windows 10 Enterprise by using Group Policy. Group Policy requires that the you have AD DS and that the Windows 10 Enterprise devices are joined to the your AD DS domain. You can create AppLocker rules by using Group Policy, and then target those rules to the appropriate devices. - -For more information about AppLocker management by using Group Policy, see [AppLocker deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-policies-deployment-guide). - -### App-V - -App-V requires an App-V server infrastructure to support App-V clients. The primary App-V components that the you must have are as follows: - -- **App-V server**. The App-V server provides App-V management, virtualized app publishing, app streaming, and reporting services. Each of these services can be run on one server or can be run individually on multiple servers. For example, you could have multiple streaming servers. App-V clients contact App-V servers to determine which apps are published to the user or device, and then run the virtualized app from the server. - -- **App-V sequencer**. The App-V sequencer is a typical client device that is used to sequence (capture) apps and prepare them for hosting from the App-V server. You install apps on the App-V sequencer, and the App-V sequencer software determines the files and registry settings that are changed during app installation. Then the sequencer captures these settings to create a virtualized app. - -- **App-V client**. The App-V client must be enabled on any client device on which apps will be run from the App-V server. These will be the Windows 10 Enterprise E3 devices. - -For more information about implementing the App-V server, App-V sequencer, and App-V client, see the following resources: - -- [Getting Started with App-V for Windows 10](https://technet.microsoft.com/itpro/windows/manage/appv-getting-started) -- [Deploying the App-V server](https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-server) -- [Deploying the App-V Sequencer and Configuring the Client](https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client) - -### UE-V -UE-V requires server- and client-side components that you you’ll need to download, activate, and install. These components include: - -- **UE-V service**. The UE-V service (when enabled on devices) monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices. - -- **Settings packages**. Settings packages created by the UE-V service store application settings and Windows settings. Settings packages are built, locally stored, and copied to the settings storage location. - -- **Settings storage location**. This location is a standard network share that your users can access. The UE-V service verifies the location and creates a hidden system folder in which to store and retrieve user settings. - -- **Settings location templates**. Settings location templates are XML files that UE-V uses to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. You can also create, edit, or validate custom settings location templates by using the UE-V template generator. Settings location templates are not required for Windows applications. - -- **Universal Windows applications list**. UE-V determines which Windows applications are enabled for settings synchronization using a managed list of applications. By default, this list includes most Windows applications. - -For more information about deploying UE-V, see the following resources: - -- [User Experience Virtualization (UE-V) for Windows 10 overview](https://technet.microsoft.com/itpro/windows/manage/uev-for-windows) -- [Get Started with UE-V](https://technet.microsoft.com/itpro/windows/manage/uev-getting-started) -- [Prepare a UE-V Deployment](https://technet.microsoft.com/itpro/windows/manage/uev-prepare-for-deployment) - -### Managed User Experience - -The Managed User Experience feature is a set of Windows 10 Enterprise edition features and corresponding settings that you can use to manage user experience. Table 2 describes the Managed User Experience settings (by category), which are only available in Windows 10 Enterprise edition. The management methods used to configure each feature depend on the feature. Some features are configured by using Group Policy, while others are configured by using Windows PowerShell, Deployment Image Servicing and Management (DISM), or other command-line tools. For the Group Policy settings, you must have AD DS with the Windows 10 Enterprise devices joined to your AD DS domain. - -*Table 2. Managed User Experience features* - -| Feature | Description | -|------------------|-----------------| -| Start layout customization | You can deploy a customized Start layout to users in a domain. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead.
              For more information on these settings, see [Customize Windows 10 Start and taskbar with Group Policy](https://technet.microsoft.com/itpro/windows/manage/customize-windows-10-start-screens-by-using-group-policy). | -| Unbranded boot | You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error from which it cannot recover.
              For more information on these settings, see [Unbranded Boot](https://msdn.microsoft.com/library/windows/hardware/mt571997(v=vs.85).aspx). | -| Custom logon | You can use the Custom Logon feature to suppress Windows 10 UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown.
              For more information on these settings, see [Custom Logon](https://msdn.microsoft.com/library/windows/hardware/mt571990(v=vs.85).aspx). | -| Shell launcher | Enables Assigned Access to run only a classic Windows app via Shell Launcher to replace the shell.
              For more information on these settings, see [Shell Launcher](https://msdn.microsoft.com/library/windows/hardware/mt571994(v=vs.85).aspx). | -| Keyboard filter | You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, users can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to control a device by locking the screen or using Task Manager to close a running application. This is not desirable on devices intended for a dedicated purpose.
              For more information on these settings, see [Keyboard Filter](https://msdn.microsoft.com/library/windows/hardware/mt587088(v=vs.85).aspx). | -| Unified write filter | You can use Unified Write Filter (UWF) on your device to help protect your physical storage media, including most standard writable storage types that are supported by Windows, such as physical hard disks, solid-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writable volume.
              For more information on these settings, see [Unified Write Filter](https://msdn.microsoft.com/library/windows/hardware/mt572001(v=vs.85).aspx). | - -## Related topics - -[Windows 10 Enterprise Subscription Activation](windows-10-subscription-activation.md) -
              [Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/) -
              [Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) -
              [Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx) +--- +title: Windows 10 Enterprise E3 in CSP +description: Describes Windows 10 Enterprise E3, an offering that delivers, by subscription, the features of Windows 10 Enterprise edition. +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +ms.date: 08/24/2017 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +audience: itpro +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Windows 10 Enterprise E3 in CSP + +Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. Windows 10 Enterprise E3 in CSP is a new offering that delivers, by subscription, exclusive features reserved for Windows 10 Enterprise edition. This offering is available through the Cloud Solution Provider (CSP) channel via the Partner Center as an online service. Windows 10 Enterprise E3 in CSP provides a flexible, per-user subscription for small- and medium-sized organizations (from one to hundreds of users). To take advantage of this offering, you must have the following: + +- Windows 10 Pro, version 1607 (Windows 10 Anniversary Update) or later, installed and activated, on the devices to be upgraded +- Azure Active Directory (Azure AD) available for identity management + +Starting with Windows 10, version 1607 (Windows 10 Anniversary Update), you can move from Windows 10 Pro to Windows 10 Enterprise more easily than ever before—no keys and no reboots. After one of your users enters the Azure AD credentials associated with a Windows 10 Enterprise E3 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise and all the appropriate Windows 10 Enterprise features are unlocked. When a subscription license expires or is transferred to another user, the Windows 10 Enterprise device seamlessly steps back down to Windows 10 Pro. + +Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 in CSP, small- and medium-sized organizations can more easily take advantage of Windows 10 Enterprise features. + +When you purchase Windows 10 Enterprise E3 via a partner, you get the following benefits: + +- **Windows 10 Enterprise edition**. Devices currently running Windows 10 Pro, version 1607 can get Windows 10 Enterprise Current Branch (CB) or Current Branch for Business (CBB). This benefit does not include Long Term Service Branch (LTSB). + +- **Support from one to hundreds of users**. Although the Windows 10 Enterprise E3 in CSP program does not have a limitation on the number of licenses an organization can have, the program is designed for small- and medium-sized organizations. + +- **Deploy on up to five devices**. For each user covered by the license, you can deploy Windows 10 Enterprise edition on up to five devices. + +- **Roll back to Windows 10 Pro at any time**. When a user’s subscription expires or is transferred to another user, the Windows 10 Enterprise device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 90 days). + +- **Monthly, per-user pricing model**. This makes Windows 10 Enterprise E3 affordable for any organization. + +- **Move licenses between users**. Licenses can be quickly and easily reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. + +How does the Windows 10 Enterprise E3 in CSP program compare with Microsoft Volume Licensing Agreements and Software Assurance? + +- [Microsoft Volume Licensing](https://www.microsoft.com/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. + +- [Software Assurance](https://www.microsoft.com/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: + + - **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits. + + - **Training**. These benefits include training vouchers, online e-learning, and a home use program. + + - **Support**. These benefits include 24x7 problem resolution support, backup capabilities for disaster recovery, System Center Global Service Monitor, and a passive secondary instance of SQL Server. + + - **Specialized**. These benefits include step-up licensing availability (which enables you to migrate software from an earlier edition to a higher-level edition) and to spread license and Software Assurance payments across three equal, annual sums. + + In addition, in Windows 10 Enterprise E3 in CSP, a partner can manage your licenses for you. With Software Assurance, you, the customer, manage your own licenses. + +In summary, the Windows 10 Enterprise E3 in CSP program is an upgrade offering that provides small- and medium-sized organizations easier, more flexible access to the benefits of Windows 10 Enterprise edition, whereas Microsoft Volume Licensing programs and Software Assurance are broader in scope and provide benefits beyond access to Windows 10 Enterprise edition. + +## Compare Windows 10 Pro and Enterprise editions + +Windows 10 Enterprise edition has a number of features that are unavailable in Windows 10 Pro. Table 1 lists the Windows 10 Enterprise features not found in Windows 10 Pro. Many of these features are security-related, whereas others enable finer-grained device management. + +*Table 1. Windows 10 Enterprise features not found in Windows 10 Pro* + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              FeatureDescription

              Credential Guard

              This feature uses virtualization-based security to help protect security secrets (for example, NTLM password hashes, Kerberos Ticket Granting Tickets) so that only privileged system software can access them. This helps prevent Pass-the-Hash or Pass-the-Ticket attacks.

              +

              Credential Guard has the following features:

              +
                +
              • Hardware-level security.  Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.

              • +
              • Virtualization-based security.  Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.

              • +
              • Improved protection against persistent threats.  Credential Guard works with other technologies (e.g., Device Guard) to help provide further protection against attacks, no matter how persistent.

              • +
              • Improved manageability.  Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.

              • +
              +

              For more information, see Protect derived domain credentials with Credential Guard.

              +

              Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)

              Device Guard

              This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.

              +

              Device Guard does the following:

              +
                +
              • Helps protect against malware

              • +
              • Helps protect the Windows system core from vulnerability and zero-day exploits

              • +
              • Allows only trusted apps to run

              • +
              +

              For more information, see Introduction to Device Guard.

              AppLocker management

              This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

              +

              For more information, see AppLocker.

              Application Virtualization (App-V)

              This feature makes applications available to end users without installing the applications directly on users’ devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.

              +

              For more information, see Getting Started with App-V for Windows 10.

              User Experience Virtualization (UE-V)

              With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.

              +

              UE-V provides the ability to do the following:

              +
                +
              • Specify which application and Windows settings synchronize across user devices

              • +
              • Deliver the settings anytime and anywhere users work throughout the enterprise

              • +
              • Create custom templates for your third-party or line-of-business applications

              • +
              • Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state

              • +
              +

              For more information, see User Experience Virtualization (UE-V) for Windows 10 overview.

              Managed User Experience

              This feature helps customize and lock down a Windows device’s user interface to restrict it to a specific task. For example, you can configure a device for a controlled scenario such as a kiosk or classroom device. The user experience would be automatically reset once a user signs off. You can also restrict access to services including Cortana or the Windows Store, and manage Start layout options, such as:

              +
                +
              • Removing and preventing access to the Shut Down, Restart, Sleep, and Hibernate commands

              • +
              • Removing Log Off (the User tile) from the Start menu

              • +
              • Removing frequent programs from the Start menu

              • +
              • Removing the All Programs list from the Start menu

              • +
              • Preventing users from customizing their Start screen

              • +
              • Forcing Start menu to be either full-screen size or menu size

              • +
              • Preventing changes to Taskbar and Start menu settings

              • +
              +
              + +## Deployment of Windows 10 Enterprise E3 licenses + +See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). + +## Deploy Windows 10 Enterprise features + +Now that you have Windows 10 Enterprise edition running on devices, how do you take advantage of the Enterprise edition features and capabilities? What are the next steps that need to be taken for each of the features discussed in [Table 1](#compare-windows10-pro-and-enterprise-editions)? + +The following sections provide you with the high-level tasks that need to be performed in your environment to help users take advantage of the Windows 10 Enterprise edition features. + +### Credential Guard\* + +You can implement Credential Guard on Windows 10 Enterprise devices by turning on Credential Guard on these devices. Credential Guard uses Windows 10 virtualization-based security features (Hyper-V features) that must be enabled on each device before you can turn on Credential Guard. You can turn on Credential Guard by using one of the following methods: + +- **Automated**. You can automatically turn on Credential Guard for one or more devices by using Group Policy. The Group Policy settings automatically add the virtualization-based security features and configure the Credential Guard registry settings on managed devices. + +- **Manual**. You can manually turn on Credential Guard by doing the following: + + - Add the virtualization-based security features by using Programs and Features or Deployment Image Servicing and Management (DISM). + + - Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). + + You can automate these manual steps by using a management tool such as Microsoft Endpoint Configuration Manager. + +For more information about implementing Credential Guard, see the following resources: + +- [Protect derived domain credentials with Credential Guard](https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard) +- [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx) +- [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337) + +\* *Requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)* + +### Device Guard + +Now that the devices have Windows 10 Enterprise, you can implement Device Guard on the Windows 10 Enterprise devices by performing the following steps: + +1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal certificate authority (CA). If you choose to use an internal CA, you will need to create a code signing certificate. + +2. **Create code integrity policies from “golden” computers**. When you have identified departments or roles that use distinctive or partly distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing code integrity policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a code integrity policy and decide how to manage that policy. You can merge code integrity policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. + +3. **Audit the code integrity policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each code integrity policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. + +4. **Create a “catalog file” for unsigned line-of-business (LOB) applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. In later steps, you can merge the catalog file's signature into your code integrity policy so that applications in the catalog will be allowed by the policy. + +5. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a code integrity policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge code integrity policies from other sources also, for flexibility in how you create your final code integrity policies. + +6. **Deploy code integrity policies and catalog files**. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking code integrity policies out of audit mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and code integrity policies more broadly. + +7. **Enable desired hardware security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies. + +For more information about implementing Device Guard, see: + +- [Planning and getting started on the Device Guard deployment process](https://technet.microsoft.com/itpro/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process) +- [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide) + +### AppLocker management + +You can manage AppLocker in Windows 10 Enterprise by using Group Policy. Group Policy requires that the you have AD DS and that the Windows 10 Enterprise devices are joined to the your AD DS domain. You can create AppLocker rules by using Group Policy, and then target those rules to the appropriate devices. + +For more information about AppLocker management by using Group Policy, see [AppLocker deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-policies-deployment-guide). + +### App-V + +App-V requires an App-V server infrastructure to support App-V clients. The primary App-V components that the you must have are as follows: + +- **App-V server**. The App-V server provides App-V management, virtualized app publishing, app streaming, and reporting services. Each of these services can be run on one server or can be run individually on multiple servers. For example, you could have multiple streaming servers. App-V clients contact App-V servers to determine which apps are published to the user or device, and then run the virtualized app from the server. + +- **App-V sequencer**. The App-V sequencer is a typical client device that is used to sequence (capture) apps and prepare them for hosting from the App-V server. You install apps on the App-V sequencer, and the App-V sequencer software determines the files and registry settings that are changed during app installation. Then the sequencer captures these settings to create a virtualized app. + +- **App-V client**. The App-V client must be enabled on any client device on which apps will be run from the App-V server. These will be the Windows 10 Enterprise E3 devices. + +For more information about implementing the App-V server, App-V sequencer, and App-V client, see the following resources: + +- [Getting Started with App-V for Windows 10](https://technet.microsoft.com/itpro/windows/manage/appv-getting-started) +- [Deploying the App-V server](https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-server) +- [Deploying the App-V Sequencer and Configuring the Client](https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client) + +### UE-V +UE-V requires server- and client-side components that you you’ll need to download, activate, and install. These components include: + +- **UE-V service**. The UE-V service (when enabled on devices) monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices. + +- **Settings packages**. Settings packages created by the UE-V service store application settings and Windows settings. Settings packages are built, locally stored, and copied to the settings storage location. + +- **Settings storage location**. This location is a standard network share that your users can access. The UE-V service verifies the location and creates a hidden system folder in which to store and retrieve user settings. + +- **Settings location templates**. Settings location templates are XML files that UE-V uses to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. You can also create, edit, or validate custom settings location templates by using the UE-V template generator. Settings location templates are not required for Windows applications. + +- **Universal Windows applications list**. UE-V determines which Windows applications are enabled for settings synchronization using a managed list of applications. By default, this list includes most Windows applications. + +For more information about deploying UE-V, see the following resources: + +- [User Experience Virtualization (UE-V) for Windows 10 overview](https://technet.microsoft.com/itpro/windows/manage/uev-for-windows) +- [Get Started with UE-V](https://technet.microsoft.com/itpro/windows/manage/uev-getting-started) +- [Prepare a UE-V Deployment](https://technet.microsoft.com/itpro/windows/manage/uev-prepare-for-deployment) + +### Managed User Experience + +The Managed User Experience feature is a set of Windows 10 Enterprise edition features and corresponding settings that you can use to manage user experience. Table 2 describes the Managed User Experience settings (by category), which are only available in Windows 10 Enterprise edition. The management methods used to configure each feature depend on the feature. Some features are configured by using Group Policy, while others are configured by using Windows PowerShell, Deployment Image Servicing and Management (DISM), or other command-line tools. For the Group Policy settings, you must have AD DS with the Windows 10 Enterprise devices joined to your AD DS domain. + +*Table 2. Managed User Experience features* + +| Feature | Description | +|------------------|-----------------| +| Start layout customization | You can deploy a customized Start layout to users in a domain. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead.
              For more information on these settings, see [Customize Windows 10 Start and taskbar with Group Policy](https://technet.microsoft.com/itpro/windows/manage/customize-windows-10-start-screens-by-using-group-policy). | +| Unbranded boot | You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error from which it cannot recover.
              For more information on these settings, see [Unbranded Boot](https://msdn.microsoft.com/library/windows/hardware/mt571997(v=vs.85).aspx). | +| Custom logon | You can use the Custom Logon feature to suppress Windows 10 UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown.
              For more information on these settings, see [Custom Logon](https://msdn.microsoft.com/library/windows/hardware/mt571990(v=vs.85).aspx). | +| Shell launcher | Enables Assigned Access to run only a classic Windows app via Shell Launcher to replace the shell.
              For more information on these settings, see [Shell Launcher](https://msdn.microsoft.com/library/windows/hardware/mt571994(v=vs.85).aspx). | +| Keyboard filter | You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, users can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to control a device by locking the screen or using Task Manager to close a running application. This is not desirable on devices intended for a dedicated purpose.
              For more information on these settings, see [Keyboard Filter](https://msdn.microsoft.com/library/windows/hardware/mt587088(v=vs.85).aspx). | +| Unified write filter | You can use Unified Write Filter (UWF) on your device to help protect your physical storage media, including most standard writable storage types that are supported by Windows, such as physical hard disks, solid-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writable volume.
              For more information on these settings, see [Unified Write Filter](https://msdn.microsoft.com/library/windows/hardware/mt572001(v=vs.85).aspx). | + +## Related topics + +[Windows 10 Enterprise Subscription Activation](windows-10-subscription-activation.md) +
              [Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/) +
              [Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) +
              [Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx) diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index 66d5049d31..38a56db227 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -1,94 +1,97 @@ ---- -title: Windows 10 volume license media -description: There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. -keywords: deploy, upgrade, update, software, media -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.date: 10/20/2017 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 volume license media - - -**Applies to** - -- Windows 10 - -With each release of Windows 10, volume license media is made available on the [Volume Licensing Service Center](https://www.microsoft.com/vlsc) (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. This topic provides a description of volume license media, and describes some of the changes that have been implemented with the current release of Windows 10. - -## Windows 10 media - -To download Windows 10 installation media from the VLSC, use the product search filter to find “Windows 10.”  A list of products will be displayed. The page then allows you to use your search results to download products, view keys, and view product and key descriptions. - -When you select a product, for example “Windows 10 Enterprise” or “Windows 10 Education”, you can then choose the specific release by clicking **Download** and choosing the **Download Method**, **Language**, and **Operating system Type** (bitness). - ->If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/windows/release-info.aspx). - -In Windows 10, version 1709 the packaging of volume licensing media and upgrade packages is different than it has been for previous releases. Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together. The following section explains this change. - -### Windows 10, version 1709 - -Windows 10, version 1709 is available starting on 10/17/2017 in all relevant distribution channels. Note: An updated [Windows ADK for Windows 10](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) is also available. - -For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images: - -![Images](images/table01.png) - -When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or System Center Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. - -For packages published to Windows Server Update Services (WSUS), you’ll also notice the change because, instead of having separate packages for each Windows edition, there will be just one package: - -
              - -| Title | Classification | Description | -| --- | --- | --- | -| Feature update to Windows 10, version 1709, \ | Upgrades | Package to upgrade Windows 10 Pro (VL), Windows 10 Enterprise, or Windows 10 Education to version 1709 | -| Windows 7 and 8.1 upgrade to Windows 10, version 1709, \ | Upgrades | Package to upgrade Windows 7 Professional (VL), Windows 7 Enterprise, Windows 8.1 Professional (VL), or Windows 8.1 Enterprise to Windows 10 1709 | - -
              - -When you approve one of these packages, it applies to all of the editions. - -This Semi-Annual Channel release of Windows 10 continues the Windows as a service methodology.  For more information about implementing Windows as a service in your organization in order to stay up to date with Windows, see [Update Windows 10 in the enterprise](https://aka.ms/waas). - - -### Language packs - -- **Windows 10 versions 1507 and 1511**: you can select **Windows 10 Enterprise Language Pack**, click **Download** and then select **English** and **64-bit** to see these downloads.  -- **Windows 10 1607 and later**: you must select **Multilanguage** from the drop-down list of languages. - -See the following example for Windows 10, version 1709: - -![Windows 10, version 1709 lang pack](images/lang-pack-1709.png) - -### Features on demand - -[Features on demand](https://blogs.technet.microsoft.com/mniehaus/2015/08/31/adding-features-including-net-3-5-to-windows-10/) can be downloaded by searching for "**Windows 10 Enterprise Features on Demand**" and then following the same download process that is described above. - -Features on demand is a method for adding features to your Windows 10 image that aren’t included in the base operating system image. - - -## Related topics - -[Microsoft Volume Licensing Service Center (VLSC) User Guide](https://www.microsoft.com/en-us/download/details.aspx?id=10585) -
              [Volume Activation for Windows 10](https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10) -
              [Plan for volume activation](https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client) -
              [VLSC downloads FAQ](https://www.microsoft.com/Licensing/servicecenter/Help/FAQDetails.aspx?id=150) -
              [Download and burn an ISO file on the volume licensing site (VLSC)](https://support.microsoft.com/help/2472143/download-and-burn-an-iso-file-on-the-volume-licensing-site-vlsc) - - -  - -  - - - - - +--- +title: Windows 10 volume license media +description: Learn about volume license media in Windows 10, and channels such as the Volume License Service Center (VLSC). +keywords: deploy, upgrade, update, software, media +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.date: 10/20/2017 +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +ms.sitesec: library +audience: itpro +ms.topic: article +--- + +# Windows 10 volume license media + + +**Applies to** + +- Windows 10 + +With each release of Windows 10, volume license media is made available on the [Volume Licensing Service Center](https://www.microsoft.com/vlsc) (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. This topic provides a description of volume license media, and describes some of the changes that have been implemented with the current release of Windows 10. + +## Windows 10 media + +To download Windows 10 installation media from the VLSC, use the product search filter to find “Windows 10.”  A list of products will be displayed. The page then allows you to use your search results to download products, view keys, and view product and key descriptions. + +When you select a product, for example “Windows 10 Enterprise” or “Windows 10 Education”, you can then choose the specific release by clicking **Download** and choosing the **Download Method**, **Language**, and **Operating system Type** (bitness). + +> [!NOTE] +> If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/windows/release-info.aspx). + +In Windows 10, version 1709 the packaging of volume licensing media and upgrade packages is different than it has been for previous releases. Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together. The following section explains this change. + +### Windows 10, version 1709 + +Windows 10, version 1709 is available starting on 10/17/2017 in all relevant distribution channels. Note: An updated [Windows ADK for Windows 10](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) is also available. + +For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images: + +![Images](images/table01.png) + +When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or Microsoft Endpoint Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. + +For packages published to Windows Server Update Services (WSUS), you’ll also notice the change because, instead of having separate packages for each Windows edition, there will be just one package: + +
              + +| Title | Classification | Description | +| --- | --- | --- | +| Feature update to Windows 10, version 1709, \ | Upgrades | Package to upgrade Windows 10 Pro (VL), Windows 10 Enterprise, or Windows 10 Education to version 1709 | +| Windows 7 and 8.1 upgrade to Windows 10, version 1709, \ | Upgrades | Package to upgrade Windows 7 Professional (VL), Windows 7 Enterprise, Windows 8.1 Professional (VL), or Windows 8.1 Enterprise to Windows 10 1709 | + +
              + +When you approve one of these packages, it applies to all of the editions. + +This Semi-Annual Channel release of Windows 10 continues the Windows as a service methodology.  For more information about implementing Windows as a service in your organization in order to stay up to date with Windows, see [Update Windows 10 in the enterprise](https://aka.ms/waas). + + +### Language packs + +- **Windows 10 versions 1507 and 1511**: you can select **Windows 10 Enterprise Language Pack**, click **Download** and then select **English** and **64-bit** to see these downloads.  +- **Windows 10 1607 and later**: you must select **Multilanguage** from the drop-down list of languages. + +See the following example for Windows 10, version 1709: + +![Windows 10, version 1709 lang pack](images/lang-pack-1709.png) + +### Features on demand + +[Features on demand](https://blogs.technet.microsoft.com/mniehaus/2015/08/31/adding-features-including-net-3-5-to-windows-10/) can be downloaded by searching for "**Windows 10 Enterprise Features on Demand**" and then following the same download process that is described above. + +Features on demand is a method for adding features to your Windows 10 image that aren’t included in the base operating system image. + + +## Related topics + +[Microsoft Volume Licensing Service Center (VLSC) User Guide](https://www.microsoft.com/download/details.aspx?id=10585) +
              [Volume Activation for Windows 10](https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10) +
              [Plan for volume activation](https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client) +
              [VLSC downloads FAQ](https://www.microsoft.com/Licensing/servicecenter/Help/FAQDetails.aspx?id=150) +
              [Download and burn an ISO file on the volume licensing site (VLSC)](https://support.microsoft.com/help/2472143/download-and-burn-an-iso-file-on-the-volume-licensing-site-vlsc) + + +  + +  + + + + + diff --git a/windows/deployment/windows-10-missing-fonts.md b/windows/deployment/windows-10-missing-fonts.md index dfa95cf6e1..7f9f5e72ad 100644 --- a/windows/deployment/windows-10-missing-fonts.md +++ b/windows/deployment/windows-10-missing-fonts.md @@ -1,103 +1,104 @@ ---- -title: How to install fonts missing after upgrading to Windows 10 -description: Some of the fonts are missing from the system after you upgrade to Windows 10. -keywords: deploy, upgrade, FoD, optional feature -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.audience: itpro author: greg-lindsay -ms.date: 10/31/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# How to install fonts that are missing after upgrading to Windows 10 - -> Applies to: Windows 10 - -When you upgrade from the Windows 7, Windows 8, or Windows 8.1 operating system to Windows 10, certain fonts are no longer available by default post-upgrade. To reduce the operating system footprint, improve performance, and optimize disk space usage, we moved many of the fonts that were previously shipped with prior versions of Windows to the optional features of Windows 10. If you install a fresh instance of Windows 10, or upgrade an older version of Windows to Windows 10, these optional features are not enabled by default. As a result, these fonts appear to be missing from the system. - -If you have documents created using the missing fonts, these documents might display differently on Windows 10. - -For example, if you have an English (or French, German, or Spanish) version of Windows 10 installed, you might notice that fonts such as the following are appear to be missing: - -- Gautami -- Meiryo -- Narkism/Batang -- BatangChe -- Dotum -- DotumChe -- Gulim -- GulimChe -- Gungsuh -- GungsuhChe - -If you want to use these fonts, you can enable the optional feature to add these back to your system. Be aware that this is a permanent change in behavior for Windows 10, and it will remain this way in future releases. - -## Installing language-associated features via language settings: - -If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app. - -For example, here are the steps to install the fonts associated with the Hebrew language: - -1. Click **Start > Settings**. -2. In Settings, click **Time & language**, and then click **Region & language**. -3. If Hebrew is not included in the list of languages, click the plus sign (**+**) to add a language. -4. Find Hebrew, and then click it to add it to your language list. - -Once you have added Hebrew to your language list, then the optional Hebrew font feature and other optional features for Hebrew language support are installed. This should only take a few minutes. - -> Note: The optional features are installed by Windows Update. This means you need to be online for the Windows Update service to work. - -## Install optional fonts manually without changing language settings: - -If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings. - -For example, here are the steps to install the fonts associated with the Hebrew language without adding the Hebrew language itself to your language preferences: - -1. Click **Start > Settings**. -2. In Settings, click **Apps**, click **Apps & features**, and then click **Manage optional features**. - -3. If you don't see **Hebrew Supplemental Fonts** in the list of installed features, click the plus sign (**+**) to add a feature. -4. Select **Hebrew Supplemental Fonts** in the list, and then click **Install**. - -> Note: The optional features are installed by Windows Update. You need to be online for the Windows Update service to work. - -## Fonts included in optional font features - -Here is a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles. - -- Arabic Script Supplemental Fonts: Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting -- Bangla Script Supplemental Fonts: Shonar Bangla, Vrinda -- Canadian Aboriginal Syllabics Supplemental Fonts: Euphemia -- Cherokee Supplemental Fonts: Plantagenet Cherokee -- Chinese (Simplified) Supplemental Fonts: DengXian, FangSong, KaiTi, SimHei -- Chinese (Traditional) Supplemental Fonts: DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU -- Devanagari Supplemental Fonts: Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah -- Ethiopic Supplemental Fonts: Nyala -- Gujarati Supplemental Fonts: Shruti -- Gurmukhi Supplemental Fonts: Raavi -- Hebrew Supplemental Fonts: Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod -- Japanese Supplemental Fonts: Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho -- Kannada Supplemental Fonts: Tunga -- Khmer Supplemental Fonts: DaunPenh, Khmer UI, MoolBoran -- Korean Supplemental Fonts: Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe -- Lao Supplemental Fonts: DokChampa, Lao UI -- Malayalam Supplemental Fonts: Karthika -- Odia Supplemental Fonts: Kalinga -- Pan-European Supplemental Fonts: Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro -- Sinhala Supplemental Fonts: Iskoola Pota -- Syriac Supplemental Fonts: Estrangelo Edessa -- Tamil Supplemental Fonts: Latha, Vijaya -- Telugu Supplemental Fonts: Gautami, Vani -- Thai Supplemental Fonts: Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC - -## Related Topics - -[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx) - -[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics) - -[Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) +--- +title: How to install fonts missing after upgrading to Windows 10 +description: Some of the fonts are missing from the system after you upgrade to Windows 10. +keywords: deploy, upgrade, FoD, optional feature +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.audience: itpro +ms.date: 10/31/2017 +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# How to install fonts that are missing after upgrading to Windows 10 + +> Applies to: Windows 10 + +When you upgrade from the Windows 7, Windows 8, or Windows 8.1 operating system to Windows 10, certain fonts are no longer available by default post-upgrade. To reduce the operating system footprint, improve performance, and optimize disk space usage, we moved many of the fonts that were previously shipped with prior versions of Windows to the optional features of Windows 10. If you install a fresh instance of Windows 10, or upgrade an older version of Windows to Windows 10, these optional features are not enabled by default. As a result, these fonts appear to be missing from the system. + +If you have documents created using the missing fonts, these documents might display differently on Windows 10. + +For example, if you have an English (or French, German, or Spanish) version of Windows 10 installed, you might notice that fonts such as the following are appear to be missing: + +- Gautami +- Meiryo +- Narkism/Batang +- BatangChe +- Dotum +- DotumChe +- Gulim +- GulimChe +- Gungsuh +- GungsuhChe + +If you want to use these fonts, you can enable the optional feature to add these back to your system. Be aware that this is a permanent change in behavior for Windows 10, and it will remain this way in future releases. + +## Installing language-associated features via language settings: + +If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app. + +For example, here are the steps to install the fonts associated with the Hebrew language: + +1. Click **Start > Settings**. +2. In Settings, click **Time & language**, and then click **Region & language**. +3. If Hebrew is not included in the list of languages, click the plus sign (**+**) to add a language. +4. Find Hebrew, and then click it to add it to your language list. + +Once you have added Hebrew to your language list, then the optional Hebrew font feature and other optional features for Hebrew language support are installed. This should only take a few minutes. + +> Note: The optional features are installed by Windows Update. This means you need to be online for the Windows Update service to work. + +## Install optional fonts manually without changing language settings: + +If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings. + +For example, here are the steps to install the fonts associated with the Hebrew language without adding the Hebrew language itself to your language preferences: + +1. Click **Start > Settings**. +2. In Settings, click **Apps**, click **Apps & features**, and then click **Manage optional features**. + +3. If you don't see **Hebrew Supplemental Fonts** in the list of installed features, click the plus sign (**+**) to add a feature. +4. Select **Hebrew Supplemental Fonts** in the list, and then click **Install**. + +> Note: The optional features are installed by Windows Update. You need to be online for the Windows Update service to work. + +## Fonts included in optional font features + +Here is a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles. + +- Arabic Script Supplemental Fonts: Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting +- Bangla Script Supplemental Fonts: Shonar Bangla, Vrinda +- Canadian Aboriginal Syllabics Supplemental Fonts: Euphemia +- Cherokee Supplemental Fonts: Plantagenet Cherokee +- Chinese (Simplified) Supplemental Fonts: DengXian, FangSong, KaiTi, SimHei +- Chinese (Traditional) Supplemental Fonts: DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU +- Devanagari Supplemental Fonts: Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah +- Ethiopic Supplemental Fonts: Nyala +- Gujarati Supplemental Fonts: Shruti +- Gurmukhi Supplemental Fonts: Raavi +- Hebrew Supplemental Fonts: Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod +- Japanese Supplemental Fonts: Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho +- Kannada Supplemental Fonts: Tunga +- Khmer Supplemental Fonts: DaunPenh, Khmer UI, MoolBoran +- Korean Supplemental Fonts: Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe +- Lao Supplemental Fonts: DokChampa, Lao UI +- Malayalam Supplemental Fonts: Karthika +- Odia Supplemental Fonts: Kalinga +- Pan-European Supplemental Fonts: Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro +- Sinhala Supplemental Fonts: Iskoola Pota +- Syriac Supplemental Fonts: Estrangelo Edessa +- Tamil Supplemental Fonts: Latha, Vijaya +- Telugu Supplemental Fonts: Gautami, Vani +- Thai Supplemental Fonts: Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC + +## Related Topics + +[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx) + +[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics) + +[Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index ddb22cbbbb..8e1f84c95e 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -1,655 +1,658 @@ ---- -title: Step by step - Deploy Windows 10 in a test lab using MDT -description: Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT) -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -keywords: deployment, automate, tools, configure, mdt -ms.localizationpriority: medium -ms.date: 10/11/2017 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -audience: itpro author: greg-lindsay -ms.topic: article ---- - - -# Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit - -**Applies to** - -- Windows 10 - -**Important**: This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide: -- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) - -Please complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide: -- [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) - -The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs): -- **DC1**: A contoso.com domain controller, DNS server, and DHCP server. -- **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network. -- **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been shadow-copied from a physical computer on your corporate network. - ->This guide uses the Hyper-V server role. If you do not complete all steps in a single session, consider using [checkpoints](https://technet.microsoft.com/library/dn818483.aspx) and [saved states](https://technet.microsoft.com/library/ee247418.aspx) to pause, resume, or restart your work. - -## In this guide - -This guide provides instructions to install and configure the Microsoft Deployment Toolkit (MDT) to deploy a Windows 10 image. - -Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. - -
              - -
              - - -
              TopicDescriptionTime - -
              About MDTA high-level overview of the Microsoft Deployment Toolkit (MDT).Informational -
              Install MDTDownload and install MDT.40 minutes -
              Create a deployment share and reference imageA reference image is created to serve as the template for deploying new images.90 minutes -
              Deploy a Windows 10 image using MDTThe reference image is deployed in the PoC environment.60 minutes -
              Refresh a computer with Windows 10Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.60 minutes -
              Replace a computer with Windows 10Back up an existing client computer, then restore this backup to a new computer.60 minutes -
              Troubleshooting logs, events, and utilitiesLog locations and troubleshooting hints.Informational -
              - -
              - -## About MDT - -MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Installation (ZTI), and User-Driven Installation (UDI) deployment methods. -- LTI is the deployment method used in the current guide, requiring only MDT and performed with a minimum amount of user interaction. -- ZTI is fully automated, requiring no user interaction and is performed using MDT and System Center Configuration Manager. After completing the steps in the current guide, see [Step by step: Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) to use the ZTI deployment method in the PoC environment. -- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and System Center Configuration Manager. - -## Install MDT - -1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt: - - ``` - $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" - Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 - Stop-Process -Name Explorer - ``` -2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/en-us/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443. - -3. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. - -3. If desired, re-enable IE Enhanced Security Configuration: - - ``` - Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 1 - Stop-Process -Name Explorer - ``` - -## Create a deployment share and reference image - -A reference image serves as the foundation for Windows 10 devices in your organization. - -1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: - - ``` - Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso - ``` -2. On SRV1, verify that the Windows Enterprise installation DVD is mounted as drive letter D. - -3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, click **Start**, type **deployment**, and then click **Deployment Workbench**. - -4. To enable quick access to the application, right-click **Deployment Workbench** on the taskbar and then click **Pin this program to the taskbar**. - -5. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. - -6. Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **C:\MDTBuildLab**
              - - Share name: **MDTBuildLab$**
              - - Deployment share description: **MDT build lab**
              - - Options: click **Next** to accept the default
              - - Summary: click **Next**
              - - Progress: settings will be applied
              - - Confirmation: click **Finish** - - -7. Expand the **Deployment Shares** node, and then expand **MDT build lab**. - -8. Right-click the **Operating Systems** node, and then click **New Folder**. Name the new folder **Windows 10**. Complete the wizard using default values and click **Finish**. - -9. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. - -10. Use the following settings for the Import Operating System Wizard: - - OS Type: **Full set of source files**
              - - Source: **D:\\**
              - - Destination: **W10Ent_x64**
              - - Summary: click **Next** - - Progress: wait for files to be copied - - Confirmation: click **Finish** - - >For purposes of this test lab, we will only add the prerequisite .NET Framework feature. Commerical applications (ex: Microsoft Office) will not be added to the deployment share. For information about adding applications, see the [Add applications](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image#sec03) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. - -11. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: **REFW10X64-001**
              - - Task sequence name: **Windows 10 Enterprise x64 Default Image**
              - - Task sequence comments: **Reference Build**
              - - Template: **Standard Client Task Sequence** - - Select OS: click **Windows 10 Enterprise Evaluation in W10Ent_x64 install.wim** - - Specify Product Key: **Do not specify a product key at this time** - - Full Name: **Contoso** - - Organization: **Contoso** - - Internet Explorer home page: **http://www.contoso.com** - - Admin Password: **Do not specify an Administrator password at this time** - - Summary: click **Next** - - Confirmation: click **Finish** - - -12. Edit the task sequence to add the Microsoft NET Framework 3.5, which is required by many applications. To edit the task sequence, double-click **Windows 10 Enterprise x64 Default Image** that was created in the previous step. - -13. Click the **Task Sequence** tab. Under **State Restore** click **Tatto** to highlight it, then click **Add** and choose **New Group**. - -14. On the Properties tab of the group that was created in the previous step, change the Name from **New Group** to **Custom Tasks (Pre-Windows Update)** and then click **Apply**. Click another location in the window to see the name change. - -15. Click the **Custom Tasks (Pre-Windows Update)** group again, click **Add**, point to **Roles**, and then click **Install Roles and Features**. - -16. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then click **Apply**. - -17. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. - - >Note: Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications. - -18. Click **OK** to complete editing the task sequence. - -19. The next step is to configure the MDT deployment share rules. To configure rules in the Deployment Workbench, right-click **MDT build lab (C:\MDTBuildLab)** and click **Properties**, and then click the **Rules** tab. - -20. Replace the default rules with the following text: - - ``` - [Settings] - Priority=Default - - [Default] - _SMSTSORGNAME=Contoso - UserDataLocation=NONE - DoCapture=YES - OSInstall=Y - AdminPassword=pass@word1 - TimeZoneName=Pacific Standard Time - OSDComputername=#Left("PC-%SerialNumber%",7)# - JoinWorkgroup=WORKGROUP - HideShell=YES - FinishAction=SHUTDOWN - DoNotCreateExtraPartition=YES - ApplyGPOPack=NO - SkipAdminPassword=YES - SkipProductKey=YES - SkipComputerName=YES - SkipDomainMembership=YES - SkipUserData=YES - SkipLocaleSelection=YES - SkipTaskSequence=NO - SkipTimeZone=YES - SkipApplications=YES - SkipBitLocker=YES - SkipSummary=YES - SkipRoles=YES - SkipCapture=NO - SkipFinalSummary=NO - ``` - -21. Click **Apply** and then click **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: - - ``` - [Settings] - Priority=Default - - [Default] - DeployRoot=\\SRV1\MDTBuildLab$ - UserDomain=CONTOSO - UserID=MDT_BA - UserPassword=pass@word1 - SkipBDDWelcome=YES - ``` - -22. Click **OK** to complete the configuration of the deployment share. - -23. Right-click **MDT build lab (C:\MDTBuildLab)** and then click **Update Deployment Share**. - -24. Accept all default values in the Update Deployment Share Wizard by clicking **Next** twice. The update process will take 5 to 10 minutes. When it has completed, click **Finish**. - -25. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. Note that in MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). - - >Hint: To copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. - -26. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: - -
              -
              -
              -    New-VM REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB
              -    Set-VMMemory REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20
              -    Set-VMDvdDrive REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso
              -    Start-VM REFW10X64-001
              -    vmconnect localhost REFW10X64-001
              -	
              -
              - - The VM will require a few minutes to prepare devices and boot from the LiteTouchPE_x86.iso file. - -27. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then click **Next**. - -28. Accept the default values on the Capture Image page, and click **Next**. Operating system installation will complete after 5 to 10 minutes, and then the VM will reboot automatically. Allow the system to boot normally (do not press a key). The process is fully automated. - - Additional system restarts will occur to complete updating and preparing the operating system. Setup will complete the following procedures: - - - Install the Windows 10 Enterprise operating system. - - Install added applications, roles, and features. - - Update the operating system using Windows Update (or WSUS if optionally specified). - - Stage Windows PE on the local disk. - - Run System Preparation (Sysprep) and reboot into Windows PE. - - Capture the installation to a Windows Imaging (WIM) file. - - Turn off the virtual machine.

              - - This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on your deployment server (SRV1). The file name is **REFW10X64-001.wim**. - -## Deploy a Windows 10 image using MDT - -This procedure will demonstrate how to deploy the reference image to the PoC environment using MDT. - -1. On SRV1, open the MDT Deployment Workbench console, right-click **Deployment Shares**, and then click **New Deployment Share**. Use the following values in the New Deployment Share Wizard: - - **Deployment share path**: C:\MDTProd - - **Share name**: MDTProd$ - - **Deployment share description**: MDT Production - - **Options**: accept the default - - -2. Click **Next**, verify the new deployment share was added successfully, then click **Finish**. - -3. In the Deployment Workbench console, expand the MDT Production deployment share, right-click **Operating Systems**, and then click **New Folder**. Name the new folder **Windows 10** and complete the wizard using default values. - -4. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. - -5. On the **OS Type** page, choose **Custom image file** and then click **Next**. - -6. On the Image page, browse to the **C:\MDTBuildLab\Captures\REFW10X64-001.wim** file created in the previous procedure, click **Open**, and then click **Next**. - -7. On the Setup page, select **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path**. - -8. Under **Setup source directory**, browse to **C:\MDTBuildLab\Operating Systems\W10Ent_x64** click **OK** and then click **Next**. - -9. On the Destination page, accept the default Destination directory name of **REFW10X64-001**, click **Next** twice, wait for the import process to complete, and then click **Finish**. - -10. In the **Operating Systems** > **Windows 10** node, double-click the operating system that was added to view its properties. Change the operating system name to **Windows 10 Enterprise x64 Custom Image** and then click **OK**. See the following example: - - ![custom image](images/image.png) - - -### Create the deployment task sequence - -1. Using the Deployment Workbench, right-click **Task Sequences** under the **MDT Production** node, click **New Folder** and create a folder with the name: **Windows 10**. - -2. Right-click the **Windows 10** folder created in the previous step, and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: W10-X64-001 - - Task sequence name: Windows 10 Enterprise x64 Custom Image - - Task sequence comments: Production Image - - Select Template: Standard Client Task Sequence - - Select OS: Windows 10 Enterprise x64 Custom Image - - Specify Product Key: Do not specify a product key at this time - - Full Name: Contoso - - Organization: Contoso - - Internet Explorer home page: http://www.contoso.com - - Admin Password: pass@word1 - -### Configure the MDT production deployment share - -1. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: - - ``` - copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\Bootstrap.ini" C:\MDTProd\Control\Bootstrap.ini -Force - copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\CustomSettings.ini" C:\MDTProd\Control\CustomSettings.ini -Force - ``` -2. In the Deployment Workbench console on SRV1, right-click the **MDT Production** deployment share and then click **Properties**. - -3. Click the **Rules** tab and replace the rules with the following text (don't click OK yet): - - ``` - [Settings] - Priority=Default - - [Default] - _SMSTSORGNAME=Contoso - OSInstall=YES - UserDataLocation=AUTO - TimeZoneName=Pacific Standard Time - OSDComputername=#Left("PC-%SerialNumber%",7)# - AdminPassword=pass@word1 - JoinDomain=contoso.com - DomainAdmin=administrator - DomainAdminDomain=CONTOSO - DomainAdminPassword=pass@word1 - ScanStateArgs=/ue:*\* /ui:CONTOSO\* - USMTMigFiles001=MigApp.xml - USMTMigFiles002=MigUser.xml - HideShell=YES - ApplyGPOPack=NO - SkipAppsOnUpgrade=NO - SkipAdminPassword=YES - SkipProductKey=YES - SkipComputerName=YES - SkipDomainMembership=YES - SkipUserData=YES - SkipLocaleSelection=YES - SkipTaskSequence=NO - SkipTimeZone=YES - SkipApplications=NO - SkipBitLocker=YES - SkipSummary=YES - SkipCapture=YES - SkipFinalSummary=NO - EventService=http://SRV1:9800 - ``` - **Note**: The contents of the Rules tab are added to c:\MDTProd\Control\CustomSettings.ini. - - >In this example a **MachineObjectOU** entry is not provided. Normally this entry describes the specific OU where new client computer objects are created in Active Directory. However, for the purposes of this test lab clients are added to the default computers OU, which requires that this parameter be unspecified. - - If desired, edit the follow line to include or exclude other users when migrating settings. Currently, the command is set to user exclude (ue) all users except for CONTOSO users specified by the user include option (ui): - - ``` - ScanStateArgs=/ue:*\* /ui:CONTOSO\* - ``` - - For example, to migrate **all** users on the computer, replace this line with the following: - - ``` - ScanStateArgs=/all - ``` - - For more information, see [ScanState Syntax](https://technet.microsoft.com/library/cc749015.aspx). - -4. Click **Edit Bootstap.ini** and replace text in the file with the following text: - - ``` - [Settings] - Priority=Default - - [Default] - DeployRoot=\\SRV1\MDTProd$ - UserDomain=CONTOSO - UserID=MDT_BA - UserPassword=pass@word1 - SkipBDDWelcome=YES - ``` -5. Click **OK** when finished. - -### Update the deployment share - -1. Right-click the **MDT Production** deployment share and then click **Update Deployment Share**. - -2. Use the default options for the Update Deployment Share Wizard. The update process requires 5 to 10 minutes to complete. - -3. Click **Finish** when the update is complete. - -### Enable deployment monitoring - -1. In the Deployment Workbench console, right-click **MDT Production** and then click **Properties**. - -2. On the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then click **OK**. - -3. Verify the monitoring service is working as expected by opening the following link on SRV1 in Internet Explorer: [http://localhost:9800/MDTMonitorEvent/](http://localhost:9800/MDTMonitorEvent/). If you do not see "**You have created a service**" at the top of the page, see [Troubleshooting MDT 2012 Monitoring](https://blogs.technet.microsoft.com/mniehaus/2012/05/10/troubleshooting-mdt-2012-monitoring/). - -4. Close Internet Explorer. - -### Configure Windows Deployment Services - -1. Initialize Windows Deployment Services (WDS) by typing the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - WDSUTIL /Verbose /Progress /Initialize-Server /Server:SRV1 /RemInst:"C:\RemoteInstall" - WDSUTIL /Set-Server /AnswerClients:All - ``` - -2. Click **Start**, type **Windows Deployment**, and then click **Windows Deployment Services**. - -3. In the Windows Deployment Services console, expand **Servers**, expand **SRV1.contoso.com**, right-click **Boot Images**, and then click **Add Boot Image**. - -4. Browse to the **C:\MDTProd\Boot\LiteTouchPE_x64.wim** file, click **Open**, click **Next**, and accept the defaults in the Add Image Wizard. Click **Finish** to complete adding a boot image. - -### Deploy the client image - -1. Before using WDS to deploy a client image, you must temporarily disable the external network adapter on SRV1. This is just an artifact of the lab environment. In a typical deployment environment WDS would not be installed on the default gateway. - - >**Note**: Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, type **Get-NetIPAddress | ft interfacealias, ipaddress** - - Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and type the following command: - - ``` - Disable-NetAdapter "Ethernet 2" -Confirm:$false - ``` - - >Wait until the disable-netadapter command completes before proceeding. - - -2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, type the following commands at an elevated Windows PowerShell prompt: - - ``` - New-VM –Name "PC2" –NewVHDPath "c:\vhd\pc2.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 - Set-VMMemory -VMName "PC2" -DynamicMemoryEnabled $true -MinimumBytes 720MB -MaximumBytes 2048MB -Buffer 20 - ``` - - >Dynamic memory is configured on the VM to conserve resources. However, this can cause memory allocation to be reduced past what is required to install an operating system. If this happens, reset the VM and begin the OS installation task sequence immediately. This ensures the VM memory allocation is not decreased too much while it is idle. - -3. Start the new VM and connect to it: - - ``` - Start-VM PC2 - vmconnect localhost PC2 - ``` -4. When prompted, hit ENTER to start the network boot process. - -5. In the Windows Deployment Wizard, choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. - -6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. This is needed so the client can use Windows Update after operating system installation is complete.To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and type the following command: - - ``` - Enable-NetAdapter "Ethernet 2" - ``` -7. On SRV1, in the Deployment Workbench console, click on **Monitoring** and view the status of installation. Right-click **Monitoring** and click **Refresh** if no data is displayed. -8. OS installation requires about 10 minutes. When the installation is complete, the system will reboot automatically, configure devices, and install updates, requiring another 10-20 minutes. When the new client computer is finished updating, click **Finish**. You will be automatically signed in to the local computer as administrator. - - ![finish](images/deploy-finish.png) - - -This completes the demonstration of how to deploy a reference image to the network. To conserve resources, turn off the PC2 VM before starting the next section. - -## Refresh a computer with Windows 10 - -This section will demonstrate how to export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings. The scenario will use PC1, a computer that was cloned from a physical device to a VM, as described in [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md). - -1. If the PC1 VM is not already running, then start and connect to it: - - ``` - Start-VM PC1 - vmconnect localhost PC1 - ``` - -2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and to perform additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - Checkpoint-VM -Name PC1 -SnapshotName BeginState - ``` - -3. Sign on to PC1 using the CONTOSO\Administrator account. - - >Specify **contoso\administrator** as the user name to ensure you do not sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share. - -4. Open an elevated command prompt on PC1 and type the following: - - ``` - cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs - ``` - - **Note**: Litetouch.vbs must be able to create the C:\MININT directory on the local computer. - -5. Choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. - -6. Choose **Do not back up the existing computer** and click **Next**. - - **Note**: The USMT will still back up the computer. - -7. Lite Touch Installation will perform the following actions: - - Back up user settings and data using USMT. - - Install the Windows 10 Enterprise X64 operating system. - - Update the operating system via Windows Update. - - Restore user settings and data using USMT. - - You can review the progress of installation on SRV1 by clicking on the **Monitoring** node in the deployment workbench. When OS installation is complete, the computer will restart, set up devices, and configure settings. - -8. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share). - -9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - Checkpoint-VM -Name PC1 -SnapshotName RefreshState - ``` - -10. Restore the PC1 VM to it's previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - Restore-VMSnapshot -VMName PC1 -Name BeginState -Confirm:$false - Start-VM PC1 - vmconnect localhost PC1 - ``` - -11. Sign in to PC1 using the contoso\administrator account. - -## Replace a computer with Windows 10 - -At a high level, the computer replace process consists of:
              -- A special replace task sequence that runs the USMT backup and an optional full Window Imaging (WIM) backup.
              -- A standard OS deployment on a new computer. At the end of the deployment, the USMT backup from the old computer is restored. - -### Create a backup-only task sequence - -1. On SRV1, in the deployment workbench console, right-click the MDT Production deployment share, click **Properties**, click the **Rules** tab, and change the line **SkipUserData=YES** to **SkipUserData=NO**. -2. Click **OK**, right-click **MDT Production**, click **Update Deployment Share** and accept the default options in the wizard to update the share. -3. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - - ``` - New-Item -Path C:\MigData -ItemType directory - New-SmbShare -Name MigData$ -Path C:\MigData -ChangeAccess EVERYONE - icacls C:\MigData /grant '"contoso\administrator":(OI)(CI)(M)' - ``` -4. On SRV1 in the deployment workbench, under **MDT Production**, right-click the **Task Sequences** node, and click **New Folder**. -5. Name the new folder **Other**, and complete the wizard using default options. -6. Right-click the **Other** folder and then click **New Task Sequence**. Use the following values in the wizard: - - **Task sequence ID**: REPLACE-001 - - **Task sequence name**: Backup Only Task Sequence - - **Task sequence comments**: Run USMT to back up user data and settings - - **Template**: Standard Client Replace Task Sequence (note: this is not the default template) -7. Accept defaults for the rest of the wizard and then click **Finish**. The replace task sequence will skip OS selection and settings. -8. Open the new task sequence that was created and review it. Note the type of capture and backup tasks that are present. Click **OK** when you are finished reviewing the task sequence. - -### Run the backup-only task sequence - -1. If you are not already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, type the following command at an elevated command prompt: - - ``` - whoami - ``` -2. To ensure a clean environment before running the backup task sequence, type the following at an elevated Windows PowerShell prompt on PC1: - - ``` - Remove-Item c:\minint -recurse - Remove-Item c:\_SMSTaskSequence -recurse - Restart-Computer - ``` -3. Sign in to PC1 using the contoso\administrator account, and then type the following at an elevated command prompt: - - ``` - cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs - ``` -4. Complete the deployment wizard using the following: - - **Task Sequence**: Backup Only Task Sequence - - **User Data**: Specify a location: **\\\\SRV1\MigData$\PC1** - - **Computer Backup**: Do not back up the existing computer. -5. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and click the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks. -6. On PC1, verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete. -7. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: - - ``` - PS C:\> dir C:\MigData\PC1\USMT - - Directory: C:\MigData\PC1\USMT - - Mode LastWriteTime Length Name - ---- ------------- ------ ---- - -a--- 9/6/2016 11:34 AM 14248685 USMT.MIG - ``` - ### Deploy PC3 - -8. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt: - - ``` - New-VM –Name "PC3" –NewVHDPath "c:\vhd\pc3.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 - Set-VMMemory -VMName "PC3" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 - ``` -9. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - Disable-NetAdapter "Ethernet 2" -Confirm:$false - ``` - - >As mentioned previously, ensure that you disable the **external** network adapter, and wait for the command to complete before proceeding. - - -10. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - Start-VM PC3 - vmconnect localhost PC3 - ``` - -11. When prompted, press ENTER for network boot. - -12. On PC3, use the following settings for the Windows Deployment Wizard: - - **Task Sequence**: Windows 10 Enterprise x64 Custom Image - - **Move Data and Settings**: Do not move user data and settings - - **User Data (Restore)**: Specify a location: **\\\\SRV1\MigData$\PC1** - -13. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1: - - ``` - Enable-NetAdapter "Ethernet 2" - ``` -14. Setup will install the Windows 10 Enterprise operating system, update via Windows Update, and restore the user settings and data from PC1. - -15. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**. - -16. Verify that settings have been migrated from PC1. This completes demonstration of the replace procedure. - -17. Shut down PC3 in preparation for the [next](windows-10-poc-sc-config-mgr.md) procedure. - -## Troubleshooting logs, events, and utilities - -Deployment logs are available on the client computer in the following locations: -- Before the image is applied: X:\MININT\SMSOSD\OSDLOGS -- After the system drive has been formatted: C:\MININT\SMSOSD\OSDLOGS -- After deployment: %WINDIR%\TEMP\DeploymentLogs - -You can review WDS events in Event Viewer at: **Applications and Services Logs > Microsoft > Windows > Deployment-Services-Diagnostics**. By default, only the **Admin** and **Operational** logs are enabled. To enable other logs, right-click the log and then click **Enable Log**. - -Tools for viewing log files, and to assist with troubleshooting are available in the [System Center 2012 R2 Configuration Manager Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=50012) - -Also see [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) for detailed troubleshooting information. - -## Related Topics - -[Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741)
              -[Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) - - - - - - - +--- +title: Step by step - Deploy Windows 10 in a test lab using MDT +description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT). +ms.custom: seo-marvel-apr2020 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +keywords: deployment, automate, tools, configure, mdt +ms.localizationpriority: medium +ms.date: 10/11/2017 +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +audience: itpro +ms.topic: article +--- + + +# Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit + +**Applies to** + +- Windows 10 + +**Important**: This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide: +- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) + +Please complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide: +- [Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md) + +The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs): +- **DC1**: A contoso.com domain controller, DNS server, and DHCP server. +- **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network. +- **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been shadow-copied from a physical computer on your corporate network. + +>This guide uses the Hyper-V server role. If you do not complete all steps in a single session, consider using [checkpoints](https://technet.microsoft.com/library/dn818483.aspx) and [saved states](https://technet.microsoft.com/library/ee247418.aspx) to pause, resume, or restart your work. + +## In this guide + +This guide provides instructions to install and configure the Microsoft Deployment Toolkit (MDT) to deploy a Windows 10 image. + +Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. + +
              + +
              + + +
              TopicDescriptionTime + +
              About MDTA high-level overview of the Microsoft Deployment Toolkit (MDT).Informational +
              Install MDTDownload and install MDT.40 minutes +
              Create a deployment share and reference imageA reference image is created to serve as the template for deploying new images.90 minutes +
              Deploy a Windows 10 image using MDTThe reference image is deployed in the PoC environment.60 minutes +
              Refresh a computer with Windows 10Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.60 minutes +
              Replace a computer with Windows 10Back up an existing client computer, then restore this backup to a new computer.60 minutes +
              Troubleshooting logs, events, and utilitiesLog locations and troubleshooting hints.Informational +
              + +
              + +## About MDT + +MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Installation (ZTI), and User-Driven Installation (UDI) deployment methods. +- LTI is the deployment method used in the current guide, requiring only MDT and performed with a minimum amount of user interaction. +- ZTI is fully automated, requiring no user interaction and is performed using MDT and Microsoft Endpoint Configuration Manager. After completing the steps in the current guide, see [Step by step: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md) to use the ZTI deployment method in the PoC environment. +- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and Microsoft Endpoint Configuration Manager. + +## Install MDT + +1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt: + + ``` + $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" + Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 + Stop-Process -Name Explorer + ``` +2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443. + +3. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. + +3. If desired, re-enable IE Enhanced Security Configuration: + + ``` + Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 1 + Stop-Process -Name Explorer + ``` + +## Create a deployment share and reference image + +A reference image serves as the foundation for Windows 10 devices in your organization. + +1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: + + ``` + Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso + ``` +2. On SRV1, verify that the Windows Enterprise installation DVD is mounted as drive letter D. + +3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, click **Start**, type **deployment**, and then click **Deployment Workbench**. + +4. To enable quick access to the application, right-click **Deployment Workbench** on the taskbar and then click **Pin this program to the taskbar**. + +5. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. + +6. Use the following settings for the New Deployment Share Wizard: + - Deployment share path: **C:\MDTBuildLab**
              + - Share name: **MDTBuildLab$**
              + - Deployment share description: **MDT build lab**
              + - Options: click **Next** to accept the default
              + - Summary: click **Next**
              + - Progress: settings will be applied
              + - Confirmation: click **Finish** + + +7. Expand the **Deployment Shares** node, and then expand **MDT build lab**. + +8. Right-click the **Operating Systems** node, and then click **New Folder**. Name the new folder **Windows 10**. Complete the wizard using default values and click **Finish**. + +9. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. + +10. Use the following settings for the Import Operating System Wizard: + - OS Type: **Full set of source files**
              + - Source: **D:\\**
              + - Destination: **W10Ent_x64**
              + - Summary: click **Next** + - Progress: wait for files to be copied + - Confirmation: click **Finish** + + >For purposes of this test lab, we will only add the prerequisite .NET Framework feature. Commerical applications (ex: Microsoft Office) will not be added to the deployment share. For information about adding applications, see the [Add applications](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image#sec03) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. + +11. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: **REFW10X64-001**
              + - Task sequence name: **Windows 10 Enterprise x64 Default Image**
              + - Task sequence comments: **Reference Build**
              + - Template: **Standard Client Task Sequence** + - Select OS: click **Windows 10 Enterprise Evaluation in W10Ent_x64 install.wim** + - Specify Product Key: **Do not specify a product key at this time** + - Full Name: **Contoso** + - Organization: **Contoso** + - Internet Explorer home page: **http://www.contoso.com** + - Admin Password: **Do not specify an Administrator password at this time** + - Summary: click **Next** + - Confirmation: click **Finish** + + +12. Edit the task sequence to add the Microsoft NET Framework 3.5, which is required by many applications. To edit the task sequence, double-click **Windows 10 Enterprise x64 Default Image** that was created in the previous step. + +13. Click the **Task Sequence** tab. Under **State Restore** click **Tatto** to highlight it, then click **Add** and choose **New Group**. + +14. On the Properties tab of the group that was created in the previous step, change the Name from **New Group** to **Custom Tasks (Pre-Windows Update)** and then click **Apply**. Click another location in the window to see the name change. + +15. Click the **Custom Tasks (Pre-Windows Update)** group again, click **Add**, point to **Roles**, and then click **Install Roles and Features**. + +16. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then click **Apply**. + +17. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. + + >Note: Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications. + +18. Click **OK** to complete editing the task sequence. + +19. The next step is to configure the MDT deployment share rules. To configure rules in the Deployment Workbench, right-click **MDT build lab (C:\MDTBuildLab)** and click **Properties**, and then click the **Rules** tab. + +20. Replace the default rules with the following text: + + ``` + [Settings] + Priority=Default + + [Default] + _SMSTSORGNAME=Contoso + UserDataLocation=NONE + DoCapture=YES + OSInstall=Y + AdminPassword=pass@word1 + TimeZoneName=Pacific Standard Time + OSDComputername=#Left("PC-%SerialNumber%",7)# + JoinWorkgroup=WORKGROUP + HideShell=YES + FinishAction=SHUTDOWN + DoNotCreateExtraPartition=YES + ApplyGPOPack=NO + SkipAdminPassword=YES + SkipProductKey=YES + SkipComputerName=YES + SkipDomainMembership=YES + SkipUserData=YES + SkipLocaleSelection=YES + SkipTaskSequence=NO + SkipTimeZone=YES + SkipApplications=YES + SkipBitLocker=YES + SkipSummary=YES + SkipRoles=YES + SkipCapture=NO + SkipFinalSummary=NO + ``` + +21. Click **Apply** and then click **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: + + ``` + [Settings] + Priority=Default + + [Default] + DeployRoot=\\SRV1\MDTBuildLab$ + UserDomain=CONTOSO + UserID=MDT_BA + UserPassword=pass@word1 + SkipBDDWelcome=YES + ``` + +22. Click **OK** to complete the configuration of the deployment share. + +23. Right-click **MDT build lab (C:\MDTBuildLab)** and then click **Update Deployment Share**. + +24. Accept all default values in the Update Deployment Share Wizard by clicking **Next** twice. The update process will take 5 to 10 minutes. When it has completed, click **Finish**. + +25. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. Note that in MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). + + >Hint: To copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. + +26. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: + +
              +
              +
              +    New-VM REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB
              +    Set-VMMemory REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20
              +    Set-VMDvdDrive REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso
              +    Start-VM REFW10X64-001
              +    vmconnect localhost REFW10X64-001
              +	
              +
              + + The VM will require a few minutes to prepare devices and boot from the LiteTouchPE_x86.iso file. + +27. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then click **Next**. + +28. Accept the default values on the Capture Image page, and click **Next**. Operating system installation will complete after 5 to 10 minutes, and then the VM will reboot automatically. Allow the system to boot normally (do not press a key). The process is fully automated. + + Additional system restarts will occur to complete updating and preparing the operating system. Setup will complete the following procedures: + + - Install the Windows 10 Enterprise operating system. + - Install added applications, roles, and features. + - Update the operating system using Windows Update (or WSUS if optionally specified). + - Stage Windows PE on the local disk. + - Run System Preparation (Sysprep) and reboot into Windows PE. + - Capture the installation to a Windows Imaging (WIM) file. + - Turn off the virtual machine.

              + + This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on your deployment server (SRV1). The file name is **REFW10X64-001.wim**. + +## Deploy a Windows 10 image using MDT + +This procedure will demonstrate how to deploy the reference image to the PoC environment using MDT. + +1. On SRV1, open the MDT Deployment Workbench console, right-click **Deployment Shares**, and then click **New Deployment Share**. Use the following values in the New Deployment Share Wizard: + - **Deployment share path**: C:\MDTProd + - **Share name**: MDTProd$ + - **Deployment share description**: MDT Production + - **Options**: accept the default + + +2. Click **Next**, verify the new deployment share was added successfully, then click **Finish**. + +3. In the Deployment Workbench console, expand the MDT Production deployment share, right-click **Operating Systems**, and then click **New Folder**. Name the new folder **Windows 10** and complete the wizard using default values. + +4. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. + +5. On the **OS Type** page, choose **Custom image file** and then click **Next**. + +6. On the Image page, browse to the **C:\MDTBuildLab\Captures\REFW10X64-001.wim** file created in the previous procedure, click **Open**, and then click **Next**. + +7. On the Setup page, select **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path**. + +8. Under **Setup source directory**, browse to **C:\MDTBuildLab\Operating Systems\W10Ent_x64** click **OK** and then click **Next**. + +9. On the Destination page, accept the default Destination directory name of **REFW10X64-001**, click **Next** twice, wait for the import process to complete, and then click **Finish**. + +10. In the **Operating Systems** > **Windows 10** node, double-click the operating system that was added to view its properties. Change the operating system name to **Windows 10 Enterprise x64 Custom Image** and then click **OK**. See the following example: + + ![custom image](images/image.png) + + +### Create the deployment task sequence + +1. Using the Deployment Workbench, right-click **Task Sequences** under the **MDT Production** node, click **New Folder** and create a folder with the name: **Windows 10**. + +2. Right-click the **Windows 10** folder created in the previous step, and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-001 + - Task sequence name: Windows 10 Enterprise x64 Custom Image + - Task sequence comments: Production Image + - Select Template: Standard Client Task Sequence + - Select OS: Windows 10 Enterprise x64 Custom Image + - Specify Product Key: Do not specify a product key at this time + - Full Name: Contoso + - Organization: Contoso + - Internet Explorer home page: http://www.contoso.com + - Admin Password: pass@word1 + +### Configure the MDT production deployment share + +1. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: + + ``` + copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\Bootstrap.ini" C:\MDTProd\Control\Bootstrap.ini -Force + copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\CustomSettings.ini" C:\MDTProd\Control\CustomSettings.ini -Force + ``` +2. In the Deployment Workbench console on SRV1, right-click the **MDT Production** deployment share and then click **Properties**. + +3. Click the **Rules** tab and replace the rules with the following text (don't click OK yet): + + ``` + [Settings] + Priority=Default + + [Default] + _SMSTSORGNAME=Contoso + OSInstall=YES + UserDataLocation=AUTO + TimeZoneName=Pacific Standard Time + OSDComputername=#Left("PC-%SerialNumber%",7)# + AdminPassword=pass@word1 + JoinDomain=contoso.com + DomainAdmin=administrator + DomainAdminDomain=CONTOSO + DomainAdminPassword=pass@word1 + ScanStateArgs=/ue:*\* /ui:CONTOSO\* + USMTMigFiles001=MigApp.xml + USMTMigFiles002=MigUser.xml + HideShell=YES + ApplyGPOPack=NO + SkipAppsOnUpgrade=NO + SkipAdminPassword=YES + SkipProductKey=YES + SkipComputerName=YES + SkipDomainMembership=YES + SkipUserData=YES + SkipLocaleSelection=YES + SkipTaskSequence=NO + SkipTimeZone=YES + SkipApplications=NO + SkipBitLocker=YES + SkipSummary=YES + SkipCapture=YES + SkipFinalSummary=NO + EventService=http://SRV1:9800 + ``` + **Note**: The contents of the Rules tab are added to c:\MDTProd\Control\CustomSettings.ini. + + >In this example a **MachineObjectOU** entry is not provided. Normally this entry describes the specific OU where new client computer objects are created in Active Directory. However, for the purposes of this test lab clients are added to the default computers OU, which requires that this parameter be unspecified. + + If desired, edit the follow line to include or exclude other users when migrating settings. Currently, the command is set to user exclude (ue) all users except for CONTOSO users specified by the user include option (ui): + + ``` + ScanStateArgs=/ue:*\* /ui:CONTOSO\* + ``` + + For example, to migrate **all** users on the computer, replace this line with the following: + + ``` + ScanStateArgs=/all + ``` + + For more information, see [ScanState Syntax](https://technet.microsoft.com/library/cc749015.aspx). + +4. Click **Edit Bootstap.ini** and replace text in the file with the following text: + + ``` + [Settings] + Priority=Default + + [Default] + DeployRoot=\\SRV1\MDTProd$ + UserDomain=CONTOSO + UserID=MDT_BA + UserPassword=pass@word1 + SkipBDDWelcome=YES + ``` +5. Click **OK** when finished. + +### Update the deployment share + +1. Right-click the **MDT Production** deployment share and then click **Update Deployment Share**. + +2. Use the default options for the Update Deployment Share Wizard. The update process requires 5 to 10 minutes to complete. + +3. Click **Finish** when the update is complete. + +### Enable deployment monitoring + +1. In the Deployment Workbench console, right-click **MDT Production** and then click **Properties**. + +2. On the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then click **OK**. + +3. Verify the monitoring service is working as expected by opening the following link on SRV1 in Internet Explorer: [http://localhost:9800/MDTMonitorEvent/](http://localhost:9800/MDTMonitorEvent/). If you do not see "**You have created a service**" at the top of the page, see [Troubleshooting MDT 2012 Monitoring](https://blogs.technet.microsoft.com/mniehaus/2012/05/10/troubleshooting-mdt-2012-monitoring/). + +4. Close Internet Explorer. + +### Configure Windows Deployment Services + +1. Initialize Windows Deployment Services (WDS) by typing the following command at an elevated Windows PowerShell prompt on SRV1: + + ``` + WDSUTIL /Verbose /Progress /Initialize-Server /Server:SRV1 /RemInst:"C:\RemoteInstall" + WDSUTIL /Set-Server /AnswerClients:All + ``` + +2. Click **Start**, type **Windows Deployment**, and then click **Windows Deployment Services**. + +3. In the Windows Deployment Services console, expand **Servers**, expand **SRV1.contoso.com**, right-click **Boot Images**, and then click **Add Boot Image**. + +4. Browse to the **C:\MDTProd\Boot\LiteTouchPE_x64.wim** file, click **Open**, click **Next**, and accept the defaults in the Add Image Wizard. Click **Finish** to complete adding a boot image. + +### Deploy the client image + +1. Before using WDS to deploy a client image, you must temporarily disable the external network adapter on SRV1. This is just an artifact of the lab environment. In a typical deployment environment WDS would not be installed on the default gateway. + + >**Note**: Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, type **Get-NetIPAddress | ft interfacealias, ipaddress** + + Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and type the following command: + + ``` + Disable-NetAdapter "Ethernet 2" -Confirm:$false + ``` + + >Wait until the disable-netadapter command completes before proceeding. + + +2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, type the following commands at an elevated Windows PowerShell prompt: + + ``` + New-VM –Name "PC2" –NewVHDPath "c:\vhd\pc2.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 + Set-VMMemory -VMName "PC2" -DynamicMemoryEnabled $true -MinimumBytes 720MB -MaximumBytes 2048MB -Buffer 20 + ``` + + >Dynamic memory is configured on the VM to conserve resources. However, this can cause memory allocation to be reduced past what is required to install an operating system. If this happens, reset the VM and begin the OS installation task sequence immediately. This ensures the VM memory allocation is not decreased too much while it is idle. + +3. Start the new VM and connect to it: + + ``` + Start-VM PC2 + vmconnect localhost PC2 + ``` +4. When prompted, hit ENTER to start the network boot process. + +5. In the Windows Deployment Wizard, choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. + +6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. This is needed so the client can use Windows Update after operating system installation is complete.To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and type the following command: + + ``` + Enable-NetAdapter "Ethernet 2" + ``` +7. On SRV1, in the Deployment Workbench console, click on **Monitoring** and view the status of installation. Right-click **Monitoring** and click **Refresh** if no data is displayed. +8. OS installation requires about 10 minutes. When the installation is complete, the system will reboot automatically, configure devices, and install updates, requiring another 10-20 minutes. When the new client computer is finished updating, click **Finish**. You will be automatically signed in to the local computer as administrator. + + ![finish](images/deploy-finish.png) + + +This completes the demonstration of how to deploy a reference image to the network. To conserve resources, turn off the PC2 VM before starting the next section. + +## Refresh a computer with Windows 10 + +This section will demonstrate how to export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings. The scenario will use PC1, a computer that was cloned from a physical device to a VM, as described in [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md). + +1. If the PC1 VM is not already running, then start and connect to it: + + ``` + Start-VM PC1 + vmconnect localhost PC1 + ``` + +2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and to perform additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: + + ``` + Checkpoint-VM -Name PC1 -SnapshotName BeginState + ``` + +3. Sign on to PC1 using the CONTOSO\Administrator account. + + >Specify **contoso\administrator** as the user name to ensure you do not sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share. + +4. Open an elevated command prompt on PC1 and type the following: + + ``` + cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs + ``` + + **Note**: For more information on tools for viewing log files and to assist with troubleshooting, see [Configuration Manager Tools](https://docs.microsoft.com/configmgr/core/support/tools). + +5. Choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. + +6. Choose **Do not back up the existing computer** and click **Next**. + + **Note**: The USMT will still back up the computer. + +7. Lite Touch Installation will perform the following actions: + - Back up user settings and data using USMT. + - Install the Windows 10 Enterprise X64 operating system. + - Update the operating system via Windows Update. + - Restore user settings and data using USMT. + + You can review the progress of installation on SRV1 by clicking on the **Monitoring** node in the deployment workbench. When OS installation is complete, the computer will restart, set up devices, and configure settings. + +8. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share). + +9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: + + ``` + Checkpoint-VM -Name PC1 -SnapshotName RefreshState + ``` + +10. Restore the PC1 VM to it's previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: + + ``` + Restore-VMSnapshot -VMName PC1 -Name BeginState -Confirm:$false + Start-VM PC1 + vmconnect localhost PC1 + ``` + +11. Sign in to PC1 using the contoso\administrator account. + +## Replace a computer with Windows 10 + +At a high level, the computer replace process consists of:
              +- A special replace task sequence that runs the USMT backup and an optional full Window Imaging (WIM) backup.
              +- A standard OS deployment on a new computer. At the end of the deployment, the USMT backup from the old computer is restored. + +### Create a backup-only task sequence + +1. On SRV1, in the deployment workbench console, right-click the MDT Production deployment share, click **Properties**, click the **Rules** tab, and change the line **SkipUserData=YES** to **SkipUserData=NO**. +2. Click **OK**, right-click **MDT Production**, click **Update Deployment Share** and accept the default options in the wizard to update the share. +3. Type the following commands at an elevated Windows PowerShell prompt on SRV1: + + ``` + New-Item -Path C:\MigData -ItemType directory + New-SmbShare -Name MigData$ -Path C:\MigData -ChangeAccess EVERYONE + icacls C:\MigData /grant '"contoso\administrator":(OI)(CI)(M)' + ``` +4. On SRV1 in the deployment workbench, under **MDT Production**, right-click the **Task Sequences** node, and click **New Folder**. +5. Name the new folder **Other**, and complete the wizard using default options. +6. Right-click the **Other** folder and then click **New Task Sequence**. Use the following values in the wizard: + - **Task sequence ID**: REPLACE-001 + - **Task sequence name**: Backup Only Task Sequence + - **Task sequence comments**: Run USMT to back up user data and settings + - **Template**: Standard Client Replace Task Sequence (note: this is not the default template) +7. Accept defaults for the rest of the wizard and then click **Finish**. The replace task sequence will skip OS selection and settings. +8. Open the new task sequence that was created and review it. Note the type of capture and backup tasks that are present. Click **OK** when you are finished reviewing the task sequence. + +### Run the backup-only task sequence + +1. If you are not already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, type the following command at an elevated command prompt: + + ``` + whoami + ``` +2. To ensure a clean environment before running the backup task sequence, type the following at an elevated Windows PowerShell prompt on PC1: + + ``` + Remove-Item c:\minint -recurse + Remove-Item c:\_SMSTaskSequence -recurse + Restart-Computer + ``` +3. Sign in to PC1 using the contoso\administrator account, and then type the following at an elevated command prompt: + + ``` + cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs + ``` +4. Complete the deployment wizard using the following: + - **Task Sequence**: Backup Only Task Sequence + - **User Data**: Specify a location: **\\\\SRV1\MigData$\PC1** + - **Computer Backup**: Do not back up the existing computer. +5. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and click the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks. +6. On PC1, verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete. +7. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: + + ``` + PS C:\> dir C:\MigData\PC1\USMT + + Directory: C:\MigData\PC1\USMT + + Mode LastWriteTime Length Name + ---- ------------- ------ ---- + -a--- 9/6/2016 11:34 AM 14248685 USMT.MIG + ``` + ### Deploy PC3 + +8. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt: + + ``` + New-VM –Name "PC3" –NewVHDPath "c:\vhd\pc3.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 + Set-VMMemory -VMName "PC3" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 + ``` +9. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1: + + ``` + Disable-NetAdapter "Ethernet 2" -Confirm:$false + ``` + + >As mentioned previously, ensure that you disable the **external** network adapter, and wait for the command to complete before proceeding. + + +10. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + + ``` + Start-VM PC3 + vmconnect localhost PC3 + ``` + +11. When prompted, press ENTER for network boot. + +12. On PC3, use the following settings for the Windows Deployment Wizard: + - **Task Sequence**: Windows 10 Enterprise x64 Custom Image + - **Move Data and Settings**: Do not move user data and settings + - **User Data (Restore)**: Specify a location: **\\\\SRV1\MigData$\PC1** + +13. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1: + + ``` + Enable-NetAdapter "Ethernet 2" + ``` +14. Setup will install the Windows 10 Enterprise operating system, update via Windows Update, and restore the user settings and data from PC1. + +15. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**. + +16. Verify that settings have been migrated from PC1. This completes demonstration of the replace procedure. + +17. Shut down PC3 in preparation for the [next](windows-10-poc-sc-config-mgr.md) procedure. + +## Troubleshooting logs, events, and utilities + +Deployment logs are available on the client computer in the following locations: +- Before the image is applied: X:\MININT\SMSOSD\OSDLOGS +- After the system drive has been formatted: C:\MININT\SMSOSD\OSDLOGS +- After deployment: %WINDIR%\TEMP\DeploymentLogs + +You can review WDS events in Event Viewer at: **Applications and Services Logs > Microsoft > Windows > Deployment-Services-Diagnostics**. By default, only the **Admin** and **Operational** logs are enabled. To enable other logs, right-click the log and then click **Enable Log**. + +Tools for viewing log files, and to assist with troubleshooting are available in the [System Center 2012 R2 Configuration Manager Toolkit](https://www.microsoft.com/download/details.aspx?id=50012) + +Also see [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) for detailed troubleshooting information. + +## Related Topics + +[Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741)
              +[Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) + + + + + + + diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index d9a32a74be..040e519e97 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -1,1081 +1,1083 @@ ---- -title: Step by step - Deploy Windows 10 using System Center Configuration Manager -description: Deploy Windows 10 in a test lab using System Center Configuration Manager -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -keywords: deployment, automate, tools, configure, sccm -ms.localizationpriority: medium -ms.date: 10/11/2017 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Deploy Windows 10 in a test lab using System Center Configuration Manager - -**Applies to** - -- Windows 10 - -**Important**: This guide leverages the proof of concept (PoC) environment, and some settings that are configured in the following guides: -- [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) -- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) - -Please complete all steps in these guides before attempting the procedures in this guide. If you wish to skip the Windows 10 deployment procedures in the MDT guide and move directly to this guide, you must at least install MDT and the Windows ADK before performing procedures in this guide. All steps in the first guide are required before attempting the procedures in this guide. - -The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs): -- **DC1**: A contoso.com domain controller, DNS server, and DHCP server. -- **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network. -- **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been cloned from a physical computer on your corporate network for testing purposes. -This guide leverages the Hyper-V server role to perform procedures. If you do not complete all steps in a single session, consider using [checkpoints](https://technet.microsoft.com/library/dn818483.aspx) and [saved states](https://technet.microsoft.com/library/ee247418.aspx) to pause, resume, or restart your work. - ->Multiple features and services are installed on SRV1 in this guide. This is not a typical installation, and is only done to set up a lab environment with a bare minimum of resources. However, if less than 4 GB of RAM is allocated to SRV1 in the Hyper-V console, some procedures will be extremely slow to complete. If resources are limited on the Hyper-V host, consider reducing RAM allocation on DC1 and PC1, and then increasing the RAM allocation on SRV1. You can adjust RAM allocation for a VM by right-clicking the VM in the Hyper-V Manager console, clicking **Settings**, clicking **Memory**, and modifying the value next to **Maximum RAM**. - -## In this guide - -This guide provides end-to-end instructions to install and configure System Center Configuration Manager, and use it to deploy a Windows 10 image. Depending on the speed of your Hyper-V host, the procedures in this guide will require 6-10 hours to complete. - -Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. - -
              - -
              - -
              TopicDescriptionTime - -
              Install prerequisitesInstall prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.60 minutes -
              Install System Center Configuration ManagerDownload System Center Configuration Manager, configure prerequisites, and install the package.45 minutes -
              Download MDOP and install DaRTDownload the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.15 minutes -
              Prepare for Zero Touch installationPrerequisite procedures to support Zero Touch installation.60 minutes -
              Create a boot image for Configuration ManagerUse the MDT wizard to create the boot image in Configuration Manager.20 minutes -
              Create a Windows 10 reference imageThis procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.0-60 minutes -
              Add a Windows 10 operating system imageAdd a Windows 10 operating system image and distribute it.10 minutes
              Create a task sequenceCreate a Configuration Manager task sequence with MDT integration using the MDT wizard15 minutes -
              Finalize the operating system configurationEnable monitoring, configure rules, and distribute content.30 minutes -
              Deploy Windows 10 using PXE and Configuration ManagerDeploy Windows 10 using Configuration Manager deployment packages and task sequences.60 minutes -
              Replace a client with Windows 10 using Configuration ManagerReplace a client computer with Windows 10 using Configuration Manager.90 minutes -
              Refresh a client with Windows 10 using Configuration ManagerUse a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT90 minutes - -
              - -
              - -## Install prerequisites -1. Before installing System Center Configuration Manager, we must install prerequisite services and features. Type the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - Install-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ - ``` - - >If the request to add features fails, retry the installation by typing the command again. - -2. Download [SQL Server 2014 SP2](https://www.microsoft.com/en-us/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. -3. When you have downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\SQLServer2014SP2-FullSlipstream-x64-ENU.iso - ``` - - This command mounts the .ISO file to drive D on SRV1. - -4. Type the following command at an elevated Windows PowerShell prompt on SRV1 to install SQL Server: - - ``` - D:\setup.exe /q /ACTION=Install /ERRORREPORTING="False" /FEATURES=SQLENGINE,RS,IS,SSMS,TOOLS,ADV_SSMS,CONN /INSTANCENAME=MSSQLSERVER /INSTANCEDIR="C:\Program Files\Microsoft SQL Server" /SQLSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /SQLSVCSTARTUPTYPE=Automatic /AGTSVCACCOUNT="NT AUTHORITY\SYSTEM" /AGTSVCSTARTUPTYPE=Automatic /RSSVCACCOUNT="NT AUTHORITY\System" /RSSVCSTARTUPTYPE=Automatic /ISSVCACCOUNT="NT AUTHORITY\System" /ISSVCSTARTUPTYPE=Disabled /ASCOLLATION="Latin1_General_CI_AS" /SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" /TCPENABLED="1" /NPENABLED="1" /IAcceptSQLServerLicenseTerms - ``` - Installation will take several minutes. When installation is complete, the following output will be displayed: - - ``` - Microsoft (R) SQL Server 2014 12.00.5000.00 - Copyright (c) Microsoft Corporation. All rights reserved. - - Microsoft (R) .NET Framework CasPol 2.0.50727.7905 - Copyright (c) Microsoft Corporation. All rights reserved. - - Success - Microsoft (R) .NET Framework CasPol 2.0.50727.7905 - Copyright (c) Microsoft Corporation. All rights reserved. - - Success - One or more affected files have operations pending. - You should restart your computer to complete this process. - PS C:\> - ``` -5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - - ``` - New-NetFirewallRule -DisplayName “SQL Server” -Direction Inbound –Protocol TCP –LocalPort 1433 -Action allow - New-NetFirewallRule -DisplayName “SQL Admin Connection” -Direction Inbound –Protocol TCP –LocalPort 1434 -Action allow - New-NetFirewallRule -DisplayName “SQL Database Management” -Direction Inbound –Protocol UDP –LocalPort 1434 -Action allow - New-NetFirewallRule -DisplayName “SQL Service Broker” -Direction Inbound –Protocol TCP –LocalPort 4022 -Action allow - New-NetFirewallRule -DisplayName “SQL Debugger/RPC” -Direction Inbound –Protocol TCP –LocalPort 135 -Action allow - ``` - -7. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. - -## Install System Center Configuration Manager - -1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt: - - ``` - $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" - Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 - Stop-Process -Name Explorer - ``` - -2. Download [System Center Configuration Manager and Endpoint Protection](https://www.microsoft.com/en-us/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. - -3. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: - - ``` - Get-Service Winmgmt - - Status Name DisplayName - ------ ---- ----------- - Running Winmgmt Windows Management Instrumentation - - Test-NetConnection -ComputerName 192.168.0.2 -Port 135 -InformationLevel Detailed - - ComputerName : 192.168.0.2 - RemoteAddress : 192.168.0.2 - RemotePort : 135 - AllNameResolutionResults : - MatchingIPsecRules : - NetworkIsolationContext : Internet - InterfaceAlias : Ethernet - SourceAddress : 192.168.0.2 - NetRoute (NextHop) : 0.0.0.0 - PingSucceeded : True - PingReplyDetails (RTT) : 0 ms - TcpTestSucceeded : True - ``` - You can also verify WMI using the WMI console by typing **wmimgmt.msc**, right-clicking **WMI Control (Local)** in the console tree, and then clicking **Properties**. - - If the WMI service is not started, attempt to start it or reboot the computer. If WMI is running but errors are present, see [WMIDiag](https://blogs.technet.microsoft.com/askperf/2015/05/12/wmidiag-2-2-is-here/) for troubleshooting information. - -4. To extend the Active Directory schema, type the following command at an elevated Windows PowerShell prompt: - - ``` - cmd /c C:\configmgr\SMSSETUP\BIN\X64\extadsch.exe - ``` - -5. Temporarily switch to the DC1 VM, and type the following command at an elevated command prompt on DC1: - - ``` - adsiedit.msc - ``` - -6. Right-click **ADSI Edit**, click **Connect to**, select **Default (Domain or server that you logged in to)** under **Computer** and then click **OK**. -7. Expand **Default naming context**>**DC=contoso,DC=com**, and then in the console tree right-click **CN=System**, point to **New**, and then click **Object**. -8. Click **container** and then click **Next**. -9. Next to **Value**, type **System Management**, click **Next**, and then click **Finish**. -10. Right-click **CN=system Management** and then click **Properties**. -11. On the **Security** tab, click **Add**, click **Object Types**, select **Computers**, and click **OK**. -12. Under **Enter the object names to select**, type **SRV1** and click **OK**. -13. The **SRV1** computer account will be highlighted, select **Allow** next to **Full control**. -14. Click **Advanced**, click **SRV1 (CONTOSO\SRV1$)** and click **Edit**. -15. Next to **Applies to**, choose **This object and all descendant objects**, and then click **OK** three times. -16. Close the ADSI Edit console and switch back to SRV1. -17. To start Configuration Manager installation, type the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - cmd /c C:\configmgr\SMSSETUP\BIN\X64\Setup.exe - ``` -18. Provide the following in the System Center Configuration Manager Setup Wizard: - - **Before You Begin**: Read the text and click *Next*. - - **Getting Started**: Choose **Install a Configuration Manager primary site** and select the **Use typical installation options for a stand-alone primary site** checkbox. - - Click **Yes** in response to the popup window. - - **Product Key**: Choose **Install the evaluation edition of this Product**. - - **Microsoft Software License Terms**: Read the terms and then select the **I accept these license terms** checkbox. - - **Prerequisite Licenses**: Review license terms and select all three checkboxes on the page. - - **Prerequisite Downloads**: Choose **Download required files** and enter **c:\windows\temp** next to **Path**. - - **Site and Installation Settings**: Site code: **PS1**, Site name: **Contoso**. - - use default settings for all other options - - **Usage Data**: Read the text and click **Next**. - - **Service Connection Point Setup**: Accept the default settings (SRV1.contoso.com is automatically added under Select a server to use). - - **Settings Summary**: Review settings and click **Next**. - - **Prerequisite Check**: No failures should be listed. Ignore any warnings and click **Begin Install**. - - >There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored in this test environment. - - Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Click **Close** when installation is complete. - -19. If desired, re-enable IE Enhanced Security Configuration at this time on SRV1: - - ``` - Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 1 - Stop-Process -Name Explorer - ``` - -## Download MDOP and install DaRT - ->[!IMPORTANT] ->This step requires an MSDN subscription or volume licence agreement. For more information, see [Ready for Windows 10: MDOP 2015 and more tools are now available](https://blogs.technet.microsoft.com/windowsitpro/2015/08/17/ready-for-windows-10-mdop-2015-and-more-tools-are-now-available/). ->If your organization qualifies and does not already have an MSDN subscription, you can obtain a [free MSDN subscription with BizSpark](https://blogs.msdn.microsoft.com/zainnab/2011/03/14/bizspark-free-msdn-subscription-for-start-up-companies/). - -1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso, 2.79 GB) to the C:\VHD directory on the Hyper-V host. - -2. Type the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1: - - ``` - Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso - ``` -3. Type the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - cmd /c "D:\DaRT\DaRT 10\Installers\en-us\x64\MSDaRT100.msi" - ``` -4. Install DaRT 10 using default settings. -5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - - ``` - Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx64.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x64" - Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx86.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x86" - ``` - -## Prepare for Zero Touch installation - -This section contains several procedures to support Zero Touch installation with System Center Configuration Manager. - -### Create a folder structure - -1. Type the following commands at a Windows PowerShell prompt on SRV1: - - ``` - New-Item -ItemType Directory -Path "C:\Sources\OSD\Boot" - New-Item -ItemType Directory -Path "C:\Sources\OSD\OS" - New-Item -ItemType Directory -Path "C:\Sources\OSD\Settings" - New-Item -ItemType Directory -Path "C:\Sources\OSD\Branding" - New-Item -ItemType Directory -Path "C:\Sources\OSD\MDT" - New-Item -ItemType Directory -Path "C:\Logs" - New-SmbShare -Name Sources$ -Path C:\Sources -ChangeAccess EVERYONE - New-SmbShare -Name Logs$ -Path C:\Logs -ChangeAccess EVERYONE - ``` - -### Enable MDT ConfigMgr integration - -1. On SRV1, click **Start**, type **configmgr**, and then click **Configure ConfigMgr Integration**. -2. Type **PS1** next to **Site code**, and then click **Next**. -3. Verify **The process completed successfully** is displayed, and then click **Finish**. - -### Configure client settings - -1. On SRV1, click **Start**, type **configuration manager**, right-click **Configuration Manager Console**, and then click **Pin to Taskbar**. -2. Click **Desktop**, and then launch the Configuration Manager console from the taskbar. -3. If the console notifies you that an update is available, click **OK**. It is not necessary to install updates to complete this lab. -4. In the console tree, open the **Administration** workspace (in the lower left corner) and click **Client Settings**. -5. In the display pane, double-click **Default Client Settings**. -6. Click **Computer Agent**, next to **Organization name displayed in Software Center** type **Contoso**, and then click **OK**. - -### Configure the network access account - -1. In the Administration workspace, expand **Site Configuration** and click **Sites**. -2. On the **Home** ribbon at the top of the console window, click **Configure Site Components** and then click **Software Distribution**. -3. On the **Network Access Account** tab, choose **Specify the account that accesses network locations**. -4. Click the yellow starburst and then click **New Account**. -5. Click **Browse** and then under **Enter the object name to select**, type **CM_NAA** and click **OK**. -6. Next to **Password** and **Confirm Password**, type pass@word1, and then click **OK** twice. - -### Configure a boundary group - -1. In the Administration workspace, expand **Hierarchy Configuration**, right-click **Boundaries** and then click **Create Boundary**. -2. Next to **Description**, type **PS1**, next to **Type** choose **Active Directory Site**, and then click **Browse**. -3. Choose **Default-First-Site-Name** and then click **OK** twice. -4. In the Administration workspace, right-click **Boundary Groups** and then click **Create Boundary Group**. -5. Next to **Name**, type **PS1 Site Assignment and Content Location**, click **Add**, select the **Default-First-Site-Name** boundary and then click **OK**. -6. On the **References** tab in the **Create Boundary Group** window select the **Use this boundary group for site assignment** checkbox. -7. Click **Add**, select the **\\\SRV1.contoso.com** checkbox, and then click **OK** twice. - -### Add the state migration point role - -1. In the Administration workspace, expand **Site Configuration**, click **Sites**, and then in on the **Home** ribbon at the top of the console click **Add Site System Roles**. -2. In the Add site System Roles Wizard, click **Next** twice and then on the Specify roles for this server page, select the **State migration point** checkbox. -3. Click **Next**, click the yellow starburst, type **C:\MigData** for the **Storage folder**, and click **OK**. -4. Click **Next**, and then verify under **Boundary groups** that **PS1 Site Assignment and Content Location** is displayed. -5. Click **Next** twice and then click **Close**. - -### Enable PXE on the distribution point - ->[!IMPORTANT] ->Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, type the following commands at an elevated Windows PowerShell prompt on SRV1: - -``` -WDSUTIL /Set-Server /AnswerClients:None -``` - -1. Determine the MAC address of the internal network adapter on SRV1. To determine this, type the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - (Get-NetAdapter "Ethernet").MacAddress - ``` - >If the internal network adapter, assigned an IP address of 192.168.0.2, is not named "Ethernet" then replace the name "Ethernet" in the previous command with the name of this network adapter. You can review the names of network adapters and the IP addresses assigned to them by typing **ipconfig**. - -2. In the System Center Configuration Manager console, in the **Administration** workspace, click **Distribution Points**. -3. In the display pane, right-click **SRV1.CONTOSO.COM** and then click **Properties**. -4. On the PXE tab, select the following settings: - - **Enable PXE support for clients**. Click **Yes** in the popup that appears. - - **Allow this distribution point to respond to incoming PXE requests** - - **Enable unknown computer support**. Click **OK** in the popup that appears. - - **Require a password when computers use PXE** - - **Password** and **Confirm password**: pass@word1 - - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. - - See the following example: - - Config Mgr PXE - -5. Click **OK**. -6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: - - ``` - cmd /c dir /b C:\RemoteInstall\SMSBoot\x64 - - abortpxe.com - bootmgfw.efi - bootmgr.exe - pxeboot.com - pxeboot.n12 - wdsmgfw.efi - wdsnbp.com - ``` - >If these files are not present in the C:\RemoteInstall directory, verify that the REMINST share is configured as C:\RemoteInstall. You can view the properties of this share by typing "net share REMINST" at a command prompt. If the share path is set to a different value, then replace C:\RemoteInstall with your REMINST share path. - >You can also type the following command at an elevated Windows PowerShell prompt to open the Configuration Manager Trace Log Tool. In the tool, click **File**, click **Open**, and then open the **distmgr.log** file. If errors are present, they will be highlighted in red: - - ``` - Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' - ``` - - The log file will updated continuously while Configuration Manager is running. Wait for Configuration Manager to repair any issues that are present, and periodically re-check that the files are present in the REMINST share location. Close the Configuration Manager Trace Log Tool when done. You will see the following line in distmgr.log that indicates the REMINST share is being populated with necessary files: - - Running: WDSUTIL.exe /Initialize-Server /REMINST:"C:\RemoteInstall" - - Once the files are present in the REMINST share location, you can close the cmtrace tool. - -### Create a branding image file - -1. If you have a bitmap (.BMP) image for suitable use as a branding image, copy it to the C:\Sources\OSD\Branding folder on SRV1. Otherwise, use the following step to copy a simple branding image. -2. Type the following command at an elevated Windows PowerShell prompt: - - ``` - copy "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" "C:\Sources\OSD\Branding\contoso.bmp" - ``` - >You can open C:\Sources\OSD\Branding\contoso.bmp in MSPaint.exe if desired to customize this image. - - -### Create a boot image for Configuration Manager - -1. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Boot Images**, and then click **Create Boot Image using MDT**. -2. On the Package Source page, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then click **Next**. - - The Zero Touch WinPE x64 folder does not yet exist. The folder will be created later. -3. On the General Settings page, type **Zero Touch WinPE x64** next to **Name**, and click **Next**. -4. On the Options page, under **Platform** choose **x64**, and click **Next**. -5. On the Components page, in addition to the default selection of **Microsoft Data Access Components (MDAC/ADO) support**, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** checkbox, and click **Next**. -6. On the Customization page, select the **Use a custom background bitmap file** checkbox, and under **UNC path**, type or browse to **\\\SRV1\Sources$\OSD\Branding\contoso.bmp**, and then click **Next** twice. It will take a few minutes to generate the boot image. -7. Click **Finish**. -8. In the console display pane, right-click the **Zero Touch WinPE x64** boot image, and then click **Distribute Content**. -9. In the Distribute Content Wizard, click **Next**, click **Add** and select **Distribution Point**, select the **SRV1.CONTOSO.COM** checkbox, click **OK**, click **Next** twice, and then click **Close**. -10. Use the CMTrace application to view the **distmgr.log** file again and verify that the boot image has been distributed. To open CMTrace, type the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' - ``` - - In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example: - - ``` - STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=924 TID=1424 GMTDATE=Tue Oct 09 22:36:30.986 2018 ISTR0="Zero Touch WinPE x64" ISTR1="PS10000A" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS10000A" SMS_DISTRIBUTION_MANAGER 10/9/2018 3:36:30 PM 1424 (0x0590) - ``` - -11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Double-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab. -12. Next, in the **Software Library** workspace, double-click **Zero Touch WinPE x64** and then click the **Data Source** tab. -13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and click **OK**. -14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example: - - ``` - cmd /c dir /s /b C:\RemoteInstall\SMSImages - - C:\RemoteInstall\SMSImages\PS100004 - C:\RemoteInstall\SMSImages\PS100005 - C:\RemoteInstall\SMSImages\PS100006 - C:\RemoteInstall\SMSImages\PS100004\boot.PS100004.wim - C:\RemoteInstall\SMSImages\PS100005\boot.PS100005.wim - C:\RemoteInstall\SMSImages\PS100006\WinPE.PS100006.wim - ``` - - >The first two images (*.wim files) are default boot images. The third is the new boot image with DaRT. - -### Create a Windows 10 reference image - -If you have already completed steps in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then you have already created a Windows 10 reference image. In this case, skip to the next procedure in this guide: [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image). If you have not yet created a Windows 10 reference image, complete the steps in this section. - -1. In [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: - - ``` - Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso - ``` -2. Verify that the Windows Enterprise installation DVD is mounted on SRV1 as drive letter D. - -3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, click **Start**, type **deployment**, and then click **Deployment Workbench**. - -4. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. - -5. Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **C:\MDTBuildLab**
              - - Share name: **MDTBuildLab$**
              - - Deployment share description: **MDT build lab**
              - - Options: click **Next** to accept the default
              - - Summary: click **Next**
              - - Progress: settings will be applied
              - - Confirmation: click **Finish** - -6. Expand the **Deployment Shares** node, and then expand **MDT build lab**. - -7. Right-click the **Operating Systems** node, and then click **New Folder**. Name the new folder **Windows 10**. Complete the wizard using default values and click **Finish**. - -7. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. - -8. Use the following settings for the Import Operating System Wizard: - - OS Type: **Full set of source files**
              - - Source: **D:\\**
              - - Destination: **W10Ent_x64**
              - - Summary: click **Next** - - Confirmation: click **Finish** - -9. For purposes of this test lab, we will not add applications, such as Microsoft Office, to the deployment share. For information about adding applications, see the [Add applications](deploy-windows-mdt/create-a-windows-10-reference-image.md#sec03) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. - -10. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node under **MDT Build Lab** and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: **REFW10X64-001**
              - - Task sequence name: **Windows 10 Enterprise x64 Default Image**
              - - Task sequence comments: **Reference Build**
              - - Template: **Standard Client Task Sequence** - - Select OS: click **Windows 10 Enterprise Evaluation in W10Ent_x64 install.wim** - - Specify Product Key: **Do not specify a product key at this time** - - Full Name: **Contoso** - - Organization: **Contoso** - - Internet Explorer home page: **http://www.contoso.com** - - Admin Password: **Do not specify an Administrator password at this time** - - Summary: click **Next** - - Confirmation: click **Finish** - -11. Edit the task sequence to add the Microsoft NET Framework 3.5, which is required by many applications. To edit the task sequence, double-click **Windows 10 Enterprise x64 Default Image** that was created in the previous step. - -12. Click the **Task Sequence** tab. Under **State Restore** click **Tatto** to highlight it, then click **Add** and choose **New Group**. A new group will be added under Tattoo. - -13. On the Properties tab of the group that was created in the previous step, change the Name from New Group to **Custom Tasks (Pre-Windows Update)** and then click **Apply**. To see the name change, click **Tattoo**, then click the new group again. - -14. Click the **Custom Tasks (Pre-Windows Update)** group again, click **Add**, point to **Roles**, and then click **Install Roles and Features**. - -15. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then click **Apply**. - -16. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. - >Note: Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications. - -17. Click **OK** to complete editing the task sequence. - -18. The next step is to configure the MDT deployment share rules. To configure rules in the Deployment Workbench, right-click MDT build lab (C:\MDTBuildLab) and click **Properties**, and then click the **Rules** tab. - -19. Replace the default rules with the following text: - - ``` - [Settings] - Priority=Default - - [Default] - _SMSTSORGNAME=Contoso - UserDataLocation=NONE - DoCapture=YES - OSInstall=Y - AdminPassword=pass@word1 - TimeZoneName=Pacific Standard TimeZoneName - OSDComputername=#Left("PC-%SerialNumber%",7)# - JoinWorkgroup=WORKGROUP - HideShell=YES - FinishAction=SHUTDOWN - DoNotCreateExtraPartition=YES - ApplyGPOPack=NO - SkipAdminPassword=YES - SkipProductKey=YES - SkipComputerName=YES - SkipDomainMembership=YES - SkipUserData=YES - SkipLocaleSelection=YES - SkipTaskSequence=NO - SkipTimeZone=YES - SkipApplications=YES - SkipBitLocker=YES - SkipSummary=YES - SkipRoles=YES - SkipCapture=NO - SkipFinalSummary=NO - ``` - -20. Click **Apply** and then click **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: - - ``` - [Settings] - Priority=Default - - [Default] - DeployRoot=\\SRV1\MDTBuildLab$ - UserDomain=CONTOSO - UserID=MDT_BA - UserPassword=pass@word1 - SkipBDDWelcome=YES - ``` - -21. Click **OK** to complete the configuration of the deployment share. - -22. Right-click **MDT build lab (C:\MDTBuildLab)** and then click **Update Deployment Share**. - -23. Accept all default values in the Update Deployment Share Wizard by clicking **Next**. The update process will take 5 to 10 minutes. When it has completed, click **Finish**. - -24. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. Note that in MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). - - >Hint: Top copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. - -25. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: - - ``` - New-VM –Name REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB - Set-VMMemory -VMName REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20 - Set-VMDvdDrive -VMName REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso - Start-VM REFW10X64-001 - vmconnect localhost REFW10X64-001 - ``` -26. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then click **Next**. - -27. Accept the default values on the Capture Image page, and click **Next**. Operating system installation will complete after 5 to 10 minutes and then the VM will reboot automatically. Allow the system to boot normally (do not press a key). The process is fully automated. - - Additional system restarts will occur to complete updating and preparing the operating system. Setup will complete the following procedures: - - - Install the Windows 10 Enterprise operating system. - - Install added applications, roles, and features. - - Update the operating system using Windows Update (or WSUS if optionally specified). - - Stage Windows PE on the local disk. - - Run System Preparation (Sysprep) and reboot into Windows PE. - - Capture the installation to a Windows Imaging (WIM) file. - - Turn off the virtual machine. - - This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is **REFW10X64-001.wim**. - -### Add a Windows 10 operating system image - -1. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - - ``` - New-Item -ItemType Directory -Path "C:\Sources\OSD\OS\Windows 10 Enterprise x64" - cmd /c copy /z "C:\MDTBuildLab\Captures\REFW10X64-001.wim" "C:\Sources\OSD\OS\Windows 10 Enterprise x64" - ``` - -2. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Operating System Images**, and then click **Add Operating System Image**. - -3. On the Data Source page, under **Path:**, type or browse to **\\\SRV1\Sources$\OSD\OS\Windows 10 Enterprise x64\REFW10X64-001.wim**, and click **Next**. - -4. On the General page, next to **Name:**, type **Windows 10 Enterprise x64**, click **Next** twice, and then click **Close**. - -5. Distribute the operating system image to the SRV1 distribution point by right-clicking the **Windows 10 Enterprise x64** operating system image and then clicking **Distribute Content**. - -6. In the Distribute Content Wizard, click **Next**, click **Add**, click **Distribution Point**, add the **SRV1.CONTOSO.COM** distribution point, click **OK**, click **Next** twice and then click **Close**. - -7. Enter **\Monitoring\Overview\Distribution Status\Content Status** on the location bar (be sure there is no space at the end of the location or you will get an error), click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. Processing of the image on the site server can take several minutes. - - >If content distribution is not successful, verify that sufficient disk space is available. - -### Create a task sequence - ->Complete this section slowly. There are a large number of similar settings from which to choose. - -1. In the Configuration Manager console, in the **Software Library** workspace expand **Operating Systems**, right-click **Task Sequences**, and then click **Create MDT Task Sequence**. - -2. On the Choose Template page, select the **Client Task Sequence** template and click **Next**. - -3. On the General page, type **Windows 10 Enterprise x64** under **Task sequence name:** and then click **Next**. - -4. On the Details page, enter the following settings: - - Join a domain: **contoso.com** - - Account: click **Set** - - User name: **contoso\CM_JD** - - Password: pass@word1 - - Confirm password: pass@word1 - - Click **OK** - - Windows Settings - - User name: **Contoso** - - Organization name: **Contoso** - - Product key: \ - - Administrator Account: **Enable the account and specify the local administrator password** - - Password: pass@word1 - - Confirm password: pass@word1 - - Click **Next** - -5. On the Capture Settings page, accept the default settings and click **Next**. - -6. On the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package, click **OK**, and then click **Next**. - -7. On the MDT Package page, select **Create a new Microsoft Deployment Toolkit Files package**, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\MDT\MDT** (MDT is repeated here, not a typo), and then click **Next**. - -8. On the MDT Details page, next to **Name:** type **MDT** and then click **Next**. - -9. On the OS Image page, browse and select the **Windows 10 Enterprise x64** package, click **OK**, and then click **Next**. - -10. On the Deployment Method page, accept the default settings for **Zero Touch Installation** and click **Next**. - -11. On the Client Package page, browse and select the **Microsoft Corporation Configuration Manager Client package**, click **OK**, and then click **Next**. - -12. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows 10.0.14393.0** package, click **OK**, and then click **Next**. - -13. On the Settings Package page, select **Create a new settings package**, and under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Settings\Windows 10 x64 Settings**, and then click **Next**. - -14. On the Settings Details page, next to **Name:**, type **Windows 10 x64 Settings**, and click **Next**. - -15. On the Sysprep Package page, click **Next** twice. - -16. On the Confirmation page, click **Finish**. - -### Edit the task sequence - -1. In the Configuration Manager console, in the **Software Library** workspace, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Edit**. - -2. Scroll down to the **Install** group and click the **Set Variable for Drive Letter** action. - -3. Change the Value under **OSDPreserveDriveLetter** from **False** to **True**, and then click **Apply**. - -4. In the **State Restore** group, click the **Set Status 5** action, click **Add** in the upper left corner, point to **User State**, and click **Request State Store**. This adds a new action immediately after **Set Status 5**. - -5. Configure the **Request State Store** action that was just added with the following settings:
              - - Request state storage location to: **Restore state from another computer**
              - - Select the **If computer account fails to connect to state store, use the Network Access account** checkbox.
              - - Options tab: Select the **Continue on error** checkbox.
              - - Add Condition: **Task Sequence Variable**:
              - - Variable: **USMTLOCAL**
              - - Condition: **not equals**
              - - Value: **True**
              - - Click **OK**.
              - - Click **Apply**
              . - -6. In the **State Restore** group, click **Restore User State**, click **Add**, point to **User State**, and click **Release State Store**. - -7. Configure the **Release State Store** action that was just added with the following settings:
              - - Options tab: Select the **Continue on error** checkbox.
              - - Add Condition: **Task Sequence Variable**:
              - - Variable: **USMTLOCAL**
              - - Condition: **not equals**
              - - Value: **True**
              - - Click **OK**.
              - - Click **OK**
              . - - -### Finalize the operating system configuration - ->If you completed all procedures in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then the MDT deployment share is already present on SRV1. In this case, skip the first four steps below and begin with step 5 to edit CustomSettings.ini. - -1. In the MDT deployment workbench on SRV1, right-click **Deployment Shares** and then click **New Deployment Share**. - -2. Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **C:\MDTProduction**
              - - Share name: **MDTProduction$**
              - - Deployment share description: **MDT Production**
              - - Options: click **Next** to accept the default
              - - Summary: click **Next**
              - - Progress: settings will be applied
              - - Confirmation: click **Finish** - -3. Right-click the **MDT Production** deployment share, and click **Properties**. - -4. Click the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then click **OK**. - -5. Type the following command at an elevated Windows PowerShell prompt on SRV1: - - ``` - notepad "C:\Sources\OSD\Settings\Windows 10 x64 Settings\CustomSettings.ini" - ``` -6. Replace the contents of the file with the following text, and then save the file: - - ``` - [Settings] - Priority=Default - Properties=OSDMigrateConfigFiles,OSDMigrateMode - - [Default] - DoCapture=NO - ComputerBackupLocation=NONE - OSDMigrateMode=Advanced - OSDMigrateAdditionalCaptureOptions=/ue:*\* /ui:CONTOSO\* - OSDMigrateConfigFiles=Miguser.xml,Migapp.xml - SLSHARE=\\SRV1\Logs$ - EventService=http://SRV1:9800 - ApplyGPOPack=NO - ``` - - >As noted previously, if you wish to migrate accounts other than those in the Contoso domain, then change the OSDMigrateAdditionalCaptureOptions option. For example, the following option will capture settings from all user accounts: - - ``` - OSDMigrateAdditionalCaptureOptions=/all - ``` - - -7. Return to the Configuration Manager console, and in the Software Library workspace, expand **Application Management**, click **Packages**, right-click **Windows 10 x64 Settings**, and then click **Update Distribution Points**. Click **OK** in the popup that appears. - -8. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Distribute Content**. - -9. In the Distribute Content Wizard, click **Next** twice, click **Add**, click **Distribution Point**, select the **SRV1.CONTOSO.COM** distribution point, click **OK**, click **Next** twice and then click **Close**. - -10. Enter **\Monitoring\Overview\Distribution Status\Content Status\Windows 10 Enterprise x64** on the location bar, double-click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. - -### Create a deployment for the task sequence - -1. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Deploy**. - -2. On the General page, next to **Collection**, click **Browse**, select the **All Unknown Computers** collection, click **OK**, and then click **Next**. - -3. On the Deployment Settings page, use the following settings:
              - - Purpose: **Available**
              - - Make available to the following: **Only media and PXE**
              - - Click **Next**.
              -4. Click **Next** five times to accept defaults on the Scheduling, User Experience, Alerts, and Distribution Points pages. - -5. Click **Close**. - -## Deploy Windows 10 using PXE and Configuration Manager - -In this first deployment scenario, we will deploy Windows 10 using PXE. This scenario creates a new computer that does not have any migrated users or settings. - -1. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - New-VM –Name "PC4" –NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 40GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 - Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 - Start-VM PC4 - vmconnect localhost PC4 - ``` - -2. Press ENTER when prompted to start the network boot service. - -3. In the Task Sequence Wizard, provide the password: pass@word1, and then click **Next**. - -4. Before you click **Next** in the Task Sequence Wizard, press the **F8** key. A command prompt will open. - -5. At the command prompt, type **explorer.exe** and review the Windows PE file structure. - -6. The smsts.log file is critical for troubleshooting any installation problems that might be encountered. Depending on the deployment phase, the smsts.log file is created in different locations: - - X:\windows\temp\SMSTSLog\smsts.log before disks are formatted. - - x:\smstslog\smsts.log after disks are formatted. - - c:\_SMSTaskSequence\Logs\Smstslog\smsts.log before the System Center Configuration Manager client is installed. - - c:\windows\ccm\logs\Smstslog\smsts.log after the System Center Configuration Manager client is installed. - - c:\windows\ccm\logs\smsts.log when the task sequence is complete. - - Note: If a reboot is pending on the client, the reboot will be blocked as long as the command window is open. - -7. In the explorer window, click **Tools** and then click **Map Network Drive**. - -8. Do not map a network drive at this time. If you need to save the smsts.log file, you can use this method to save the file to a location on SRV1. - -9. Close the Map Network Drive window, the Explorer window, and the command prompt. - -10. The **Windows 10 Enterprise x64** task sequence is selected in the Task Sequenc Wizard. Click **Next** to continue with the deployment. - -11. The task sequence will require several minutes to complete. You can monitor progress of the task sequence using the MDT Deployment Workbench under Deployment Shares > MDTProduction > Monitoring. The task sequence will: - - Install Windows 10 - - Install the Configuration Manager client and hotfix - - Join the computer to the contoso.com domain - - Install any applications that were specified in the reference image - - -12. When Windows 10 installation has completed, sign in to PC4 using the **contoso\administrator** account. - -13. Right-click **Start**, click **Run**, type **control appwiz.cpl**, press ENTER, click **Turn Windows features on or off**, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This is a feature included in the reference image. - -14. Shut down the PC4 VM. - ->Note: The following two procedures 1) Replace a client with Windows 10 and 2) Refresh a client with Windows 10 have been exchanged in their order in this guide compared to the previous version. This is to avoid having to restore Hyper-V checkpoints to have access to PC1 before the OS is upgraded. If this is your first time going through this guide, you won't notice any change, but if you have tried the guide previously then this change should make it simpler to complete. - -## Replace a client with Windows 10 using Configuration Manager - ->Before starting this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoso.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It is not required to delete the stale entries, this is only done to remove clutter. - -![contoso.com\Computers](images/poc-computers.png) - -In the replace procedure, PC1 will not be migrated to a new operating system. It is simplest to perform this procedure before performing the refresh procedure. After refreshing PC1, the operating system will be new. The next (replace) procedure does not install a new operating system on PC1 but rather performs a side-by-side migration of PC1 and another computer (PC4), to copy users and settings from PC1 to the new computer. - -### Create a replace task sequence - -1. On SRV1, in the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and then click **Create MDT Task Sequence**. - -2. On the Choose Template page, select **Client Replace Task Sequence** and click **Next**. - -3. On the General page, type the following: - - Task sequence name: **Replace Task Sequence** - - Task sequence comments: **USMT backup only** - -4. Click **Next**, and on the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package. Click **OK** and then click **Next** to continue. -5. On the MDT Package page, browse and select the **MDT** package. Click **OK** and then click **Next** to continue. -6. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows** package. Click **OK** and then click **Next** to continue. -7. On the Settings Package page, browse and select the **Windows 10 x64 Settings** package. Click **OK** and then click **Next** to continue. -8. On the Summary page, review the details and then click **Next**. -9. On the Confirmation page, click **Finish**. - ->If an error is displayed at this stage it can be caused by a corrupt MDT integration. To repair it, close the Configuration Manager console, remove MDT integration, and then restore MDT integration. - -### Deploy PC4 - -Create a VM named PC4 to receive the applications and settings from PC1. This VM represents a new computer that will replace PC1. To create this VM, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - -``` -New-VM –Name "PC4" –NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 -Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 2048MB -Buffer 20 -Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF -``` - ->Hyper-V enables us to define a static MAC address on PC4. In a real-world scenario you must determine the MAC address of the new computer. - -### Install the Configuration Manager client on PC1 - -1. Verify that the PC1 VM is running and in its original state, which was saved as a checkpoint and then restored in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md). - -2. If a PC1 checkpoint has not already been saved, then save a checkpoint by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - Checkpoint-VM -Name PC1 -SnapshotName BeginState - ``` - -3. On SRV1, in the Configuration Manager console, in the Administration workspace, expand **Hierarchy Configuration** and click on **Discovery Methods**. -4. Double-click **Active Directory System Discovery** and on the **General** tab select the **Enable Active Directory System Discovery** checkbox. -5. Click the yellow starburst, click **Browse**, select **contoso\Computers**, and then click **OK** three times. -6. When a popup dialog box asks if you want to run full discovery, click **Yes**. -7. In the Assets and Compliance workspace, click **Devices** and verify that the computer account names for SRV1 and PC1 are displayed. See the following example (GREGLIN-PC1 is the computer account name of PC1 in this example): - - ![assets](images/sccm-assets.png) - - >If you do not see the computer account for PC1, try clicking the **Refresh** button in the upper right corner of the console. - - The **Client** column indicates that the Configuration Manager client is not currently installed. This procedure will be carried out next. - -8. Sign in to PC1 using the contoso\administrator account and type the following at an elevated command prompt to remove any pre-existing client configuration, if it exists. Note: this command requires an elevated command prompt not an elevated Windows PowerShell prompt: - - ``` - sc stop ccmsetup - "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /Uninstall - ``` - >If PC1 still has Configuration Manager registry settings that were applied by Group Policy, startup scripts, or other policies in its previous domain, these might not all be removed by CCMSetup /Uninstall and can cause problems with installation or registration of the client in its new environment. It might be necessary to manually remove these settings if they are present. For more information, see [Manual removal of the SCCM client](https://blogs.technet.microsoft.com/michaelgriswold/2013/01/02/manual-removal-of-the-sccm-client/). - -9. On PC1, temporarily stop Windows Update from queuing items for download and clear all BITS jobs from the queue: - - ``` - net stop wuauserv - net stop BITS - ``` - - Verify that both services were stopped successfully, then type the following at an elevated command prompt: - - ``` - del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" - net start BITS - bitsadmin /list /allusers - ``` - - Verify that BITSAdmin displays 0 jobs. - -10. To install the Configuration Manager client as a standalone process, type the following at an elevated command prompt: - - ``` - "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /mp:SRV1.contoso.com /logon SMSSITECODE=PS1 - ``` -11. On PC1, using file explorer, open the **C:\Windows\ccmsetup** directory. During client installation, files will be downloaded here. -12. Installation progress will be captured in the file: **c:\windows\ccmsetup\logs\ccmsetup.log**. You can periodically open this file in notepad, or you can type the following command at an elevated Windows PowerShell prompt to monitor installation progress: - - ``` - Get-Content -Path c:\windows\ccmsetup\logs\ccmsetup.log -Wait - ``` - - Installation might require several minutes, and display of the log file will appear to hang while some applications are installed. This is normal. When setup is complete, verify that **CcmSetup is existing with return code 0** is displayed on the last line of the ccmsetup.log file and then press **CTRL-C** to break out of the Get-Content operation (if you are viewing the log in Windows PowerShell the last line will be wrapped). A return code of 0 indicates that installation was successful and you should now see a directory created at **C:\Windows\CCM** that contains files used in registration of the client with its site. - -13. On PC1, open the Configuration Manager control panel applet by typing the following command: - - ``` - control smscfgrc - ``` - -14. Click the **Site** tab, click **Configure Settings**, and click **Find Site**. The client will report that it has found the PS1 site. See the following example: - - ![site](images/sccm-site.png) - - If the client is not able to find the PS1 site, review any error messages that are displayed in **C:\Windows\CCM\Logs\ClientIDManagerStartup.log** and **LocationServices.log**. A common reason the site code is not located is because a previous configuration exists. For example, if a previous site code is configured at **HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode** this must be deleted or updated. - -15. On SRV1, in the Assets and Compliance workspace, click **Device Collections** and then double-click **All Desktop and Server Clients**. This node will be added under **Devices**. - -16. Click **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: - - ![client](images/sccm-client.png) - - >It might take several minutes for the client to fully register with the site and complete a client check. When it is complete you will see a green check mark over the client icon as shown above. To refresh the client, click it and then press **F5** or right-click the client and click **Refresh**. - -### Create a device collection and deployment - -1. On SRV1, in the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. - -2. Use the following settings in the **Create Device Collection Wizard**: - - General > Name: **Install Windows 10 Enterprise x64**
              - - General > Limiting collection: **All Systems**
              - - Membership Rules > Add Rule: **Direct Rule**
              - - The **Create Direct Membership Rule Wizard** opens, click **Next**
              - - Search for Resources > Resource class: **System Resource**
              - - Search for Resources > Attribute name: **Name**
              - - Search for Resources > Value: **%**
              - - Select Resources > Value: Select the computername associated with the PC1 VM
              - - Click **Next** twice and then click **Close** in both windows (Next, Next, Close, then Next, Next, Close) - -3. Double-click the Install Windows 10 Enterprise x64 device collection and verify that the PC1 computer account is displayed. - -4. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64** and then click **Deploy**. - -5. Use the following settings in the Deploy Software wizard: - - General > Collection: Click Browse and select **Install Windows 10 Enterprise x64**
              - - Deployment Settings > Purpose: **Available**
              - - Deployment Settings > Make available to the following: **Configuration Manager clients, media and PXE**
              - - Scheduling > Click **Next**
              - - User Experience > Click **Next**
              - - Alerts > Click **Next**
              - - Distribution Points > Click **Next**
              - - Summary > Click **Next**
              - - Verify that the wizard completed successfully and then click **Close** - - -### Associate PC4 with PC1 - -1. On SRV1 in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Devices** and then click **Import Computer Information**. - -2. On the Select Source page, choose **Import single computer** and click **Next**. - -3. On the Single Computer page, use the following settings: - - Computer Name: **PC4** - - MAC Address: **00:15:5D:83:26:FF** - - Source Computer: \ - -4. Click **Next**, and on the User Accounts page choose **Capture and restore specified user accounts**, then click the yellow starburst next to **User accounts to migrate**. - -5. Click **Browse** and then under Enter the object name to select type **user1** and click OK twice. - -6. Click the yellow starburst again and repeat the previous step to add the **contoso\administrator** account. - -7. Click **Next** twice, and on the Choose Target Collection page, choose **Add computers to the following collection**, click **Browse**, choose **Install Windows 10 Enterprise x64**, click **OK**, click **Next** twice, and then click **Close**. - -8. In the Assets and Compliance workspace, click **User State Migration** and review the computer association in the display pane. The source computer will be the computername of PC1 (GREGLIN-PC1 in this example), the destination computer will be **PC4**, and the migration type will be **side-by-side**. - -9. Right-click the association in the display pane and then click **Specify User Accounts**. You can add or remove user account here. Click **OK**. - -10. Right-click the association in the display pane and then click **View Recovery Information**. Note that a recovery key has been assigned, but a user state store location has not. Click **Close**. - -11. Click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. Verify that **PC4** is displayed in the collection. You might have to update and refresh the collection, or wait a few minutes, but do not proceed until PC4 is available. See the following example: - - ![collection](images/sccm-collection.png) - -### Create a device collection for PC1 - -1. On SRV1, in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. - -2. Use the following settings in the **Create Device Collection Wizard**: - - General > Name: **USMT Backup (Replace)**
              - - General > Limiting collection: **All Systems**
              - - Membership Rules > Add Rule: **Direct Rule**
              - - The **Create Direct Membership Rule Wizard** opens, click **Next**
              - - Search for Resources > Resource class: **System Resource**
              - - Search for Resources > Attribute name: **Name**
              - - Search for Resources > Value: **%**
              - - Select Resources > Value: Select the computername associated with the PC1 VM (GREGLIN-PC1 in this example).
              - - Click **Next** twice and then click **Close** in both windows. - -3. Click **Device Collections** and then double-click **USMT Backup (Replace)**. Verify that the computer name/hostname associated with PC1 is displayed in the collection. Do not proceed until this name is displayed. - -### Create a new deployment - -In the Configuration Manager console, in the Software Library workspace under Operating Systems, click **Task Sequences**, right-click **Replace Task Sequence**, click **Deploy**, and use the following settings: -- General > Collection: **USMT Backup (Replace)**
              -- Deployment Settings > Purpose: **Available**
              -- Deployment Settings > Make available to the following: **Only Configuration Manager Clients**
              -- Scheduling: Click **Next**
              -- User Experience: Click **Next**
              -- Alerts: Click **Next**
              -- Distribution Points: Click **Next**
              -- Click **Next** and then click **Close**. - -### Verify the backup - -1. On PC1, open the Configuration Manager control panel applet by typing the following command: - - ``` - control smscfgrc - ``` -2. On the **Actions** tab, click **Machine Policy Retrieval & Evaluation Cycle**, click **Run Now**, click **OK**, and then click **OK** again. This is one method that can be used to run a task sequence in addition to the Client Notification method that will be demonstrated in the computer refresh procedure. - -3. Type the following at an elevated command prompt to open the Software Center: - - ``` - C:\Windows\CCM\SCClient.exe - ``` - -4. In the Software Center , click **Available Software** and then select the **Replace Task Sequence** checkbox. See the following example: - - ![software](images/sccm-software-cntr.png) - - >If you do not see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available. - -5. Click **INSTALL SELECTED** and then click **INSTALL OPERATING SYSTEM**. -6. Allow the **Replace Task Sequence** to complete, then verify that the C:\MigData folder on SRV1 contains the USMT backup. - -### Deploy the new computer - -1. Start PC4 and press ENTER for a network boot when prompted. To start PC4, type the following commands at an elevated Windows Powershell prompt on the Hyper-V host: - - ``` - Start-VM PC4 - vmconnect localhost PC4 - ``` -2. In the **Welcome to the Task Sequence Wizard**, enter pass@word1 and click **Next**. -3. Choose the **Windows 10 Enterprise X64** image. -4. Setup will install the operating system using the Windows 10 Enterprise x64 reference image, install the configuration manager client, join PC4 to the domain, and restore users and settings from PC1. -5. Save checkpoints for all VMs if you wish to review their status at a later date. This is not required (checkpoints do take up space on the Hyper-V host). Note: the next procedure will install a new OS on PC1 update its status in Configuration Manager and in Active Directory as a Windows 10 device, so you cannot return to a previous checkpoint only on the PC1 VM without a conflict. Therefore, if you do create a checkpoint, you should do this for all VMs. - - To save a checkpoint for all VMs, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - - ``` - Checkpoint-VM -Name DC1 -SnapshotName cm-refresh - Checkpoint-VM -Name SRV1 -SnapshotName cm-refresh - Checkpoint-VM -Name PC1 -SnapshotName cm-refresh - ``` - -## Refresh a client with Windows 10 using Configuration Manager - - -### Initiate the computer refresh - -1. On SRV1, in the Assets and Compliance workspace, click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. -2. Right-click the computer account for PC1, point to **Client Notification**, click **Download Computer Policy**, and click **OK** in the popup dialog box. -3. On PC1, in the notification area, click **New software is available** and then click **Open Software Center**. -4. In the Software Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: - - ![installOS](images/sccm-install-os.png) - - The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then click **More Details**. Click the **Status** tab to see a list of tasks that have been performed. See the following example: - - ![asset](images/sccm-asset.png) - - You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. - - When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise operating system. - - ![post-refresh](images/sccm-post-refresh.png) - - - -## Related Topics - -[System Center 2012 Configuration Manager Survival Guide](https://social.technet.microsoft.com/wiki/contents/articles/7075.system-center-2012-configuration-manager-survival-guide.aspx#Step-by-Step_Guides) - - - - - - - +--- +title: Steps to deploy Windows 10 with Microsoft Endpoint Configuration Manager +description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft endpoint configuration manager. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +keywords: deployment, automate, tools, configure, sccm +ms.localizationpriority: medium +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +audience: itpro +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager + +**Applies to** + +- Windows 10 + +**Important**: This guide leverages the proof of concept (PoC) environment, and some settings that are configured in the following guides: + +- [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) +- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) + +Please complete all steps in these guides before attempting the procedures in this guide. If you wish to skip the Windows 10 deployment procedures in the MDT guide and move directly to this guide, you must at least install MDT and the Windows ADK before performing procedures in this guide. All steps in the first guide are required before attempting the procedures in this guide. + +The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs): + +- **DC1**: A contoso.com domain controller, DNS server, and DHCP server. +- **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network. +- **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been cloned from a physical computer on your corporate network for testing purposes. + +>This guide leverages the Hyper-V server role to perform procedures. If you do not complete all steps in a single session, consider using [checkpoints](https://technet.microsoft.com/library/dn818483.aspx) and [saved states](https://technet.microsoft.com/library/ee247418.aspx) to pause, resume, or restart your work. + +>Multiple features and services are installed on SRV1 in this guide. This is not a typical installation, and is only done to set up a lab environment with a bare minimum of resources. However, if less than 4 GB of RAM is allocated to SRV1 in the Hyper-V console, some procedures will be extremely slow to complete. If resources are limited on the Hyper-V host, consider reducing RAM allocation on DC1 and PC1, and then increasing the RAM allocation on SRV1. You can adjust RAM allocation for a VM by right-clicking the VM in the Hyper-V Manager console, clicking **Settings**, clicking **Memory**, and modifying the value next to **Maximum RAM**. + +## In this guide + +This guide provides end-to-end instructions to install and configure Microsoft Endpoint Configuration Manager, and use it to deploy a Windows 10 image. Depending on the speed of your Hyper-V host, the procedures in this guide will require 6-10 hours to complete. + +Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. + +|||| +|--- |--- |--- | +|Topic|Description|Time| +|[Install prerequisites](#install-prerequisites)|Install prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.|60 minutes| +|[Install Microsoft Endpoint Configuration Manager](#install-microsoft-endpoint-configuration-manager)|Download Microsoft Endpoint Configuration Manager, configure prerequisites, and install the package.|45 minutes| +|[Download MDOP and install DaRT](#download-mdop-and-install-dart)|Download the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.|15 minutes| +|[Prepare for Zero Touch installation](#prepare-for-zero-touch-installation)|Prerequisite procedures to support Zero Touch installation.|60 minutes| +|[Create a boot image for Configuration Manager](#create-a-boot-image-for-configuration-manager)|Use the MDT wizard to create the boot image in Configuration Manager.|20 minutes| +|[Create a Windows 10 reference image](#create-a-windows-10-reference-image)|This procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.|0-60 minutes| +|[Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image)|Add a Windows 10 operating system image and distribute it.|10 minutes| +|[Create a task sequence](#create-a-task-sequence)|Create a Configuration Manager task sequence with MDT integration using the MDT wizard|15 minutes| +|[Finalize the operating system configuration](#finalize-the-operating-system-configuration)|Enable monitoring, configure rules, and distribute content.|30 minutes| +|[Deploy Windows 10 using PXE and Configuration Manager](#deploy-windows-10-using-pxe-and-configuration-manager)|Deploy Windows 10 using Configuration Manager deployment packages and task sequences.|60 minutes| +|[Replace a client with Windows 10 using Configuration Manager](#replace-a-client-with-windows-10-using-configuration-manager)|Replace a client computer with Windows 10 using Configuration Manager.|90 minutes| +|[Refresh a client with Windows 10 using Configuration Manager](#refresh-a-client-with-windows-10-using-configuration-manager)|Use a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT|90 minutes| + +## Install prerequisites + +1. Before installing Microsoft Endpoint Configuration Manager, we must install prerequisite services and features. Type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + Install-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ + ``` + + >If the request to add features fails, retry the installation by typing the command again. + +2. Download [SQL Server 2014 SP2](https://www.microsoft.com/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. +3. When you have downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: + + ```powershell + Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\SQLServer2014SP2-FullSlipstream-x64-ENU.iso + ``` + + This command mounts the .ISO file to drive D on SRV1. + +4. Type the following command at an elevated Windows PowerShell prompt on SRV1 to install SQL Server: + + ```powershell + D:\setup.exe /q /ACTION=Install /ERRORREPORTING="False" /FEATURES=SQLENGINE,RS,IS,SSMS,TOOLS,ADV_SSMS,CONN /INSTANCENAME=MSSQLSERVER /INSTANCEDIR="C:\Program Files\Microsoft SQL Server" /SQLSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /SQLSVCSTARTUPTYPE=Automatic /AGTSVCACCOUNT="NT AUTHORITY\SYSTEM" /AGTSVCSTARTUPTYPE=Automatic /RSSVCACCOUNT="NT AUTHORITY\System" /RSSVCSTARTUPTYPE=Automatic /ISSVCACCOUNT="NT AUTHORITY\System" /ISSVCSTARTUPTYPE=Disabled /ASCOLLATION="Latin1_General_CI_AS" /SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" /TCPENABLED="1" /NPENABLED="1" /IAcceptSQLServerLicenseTerms + ``` + + Installation will take several minutes. When installation is complete, the following output will be displayed: + + ```dos + Microsoft (R) SQL Server 2014 12.00.5000.00 + Copyright (c) Microsoft Corporation. All rights reserved. + + Microsoft (R) .NET Framework CasPol 2.0.50727.7905 + Copyright (c) Microsoft Corporation. All rights reserved. + + Success + Microsoft (R) .NET Framework CasPol 2.0.50727.7905 + Copyright (c) Microsoft Corporation. All rights reserved. + + Success + One or more affected files have operations pending. + You should restart your computer to complete this process. + PS C:\> + ``` + +5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + New-NetFirewallRule -DisplayName "SQL Server" -Direction Inbound –Protocol TCP –LocalPort 1433 -Action allow + New-NetFirewallRule -DisplayName "SQL Admin Connection" -Direction Inbound –Protocol TCP –LocalPort 1434 -Action allow + New-NetFirewallRule -DisplayName "SQL Database Management" -Direction Inbound –Protocol UDP –LocalPort 1434 -Action allow + New-NetFirewallRule -DisplayName "SQL Service Broker" -Direction Inbound –Protocol TCP –LocalPort 4022 -Action allow + New-NetFirewallRule -DisplayName "SQL Debugger/RPC" -Direction Inbound –Protocol TCP –LocalPort 135 -Action allow + ``` + +6. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://docs.microsoft.com/windows-hardware/get-started/adk-install) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 2004. Installation might require several minutes to acquire all components. + +## Install Microsoft Endpoint Configuration Manager + +1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt: + + ```powershell + $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" + Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 0 + Stop-Process -Name Explorer + ``` + +2. Download [Microsoft Endpoint Configuration Manager and Endpoint Protection](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. + +3. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: + + ```dos + Get-Service Winmgmt + + Status Name DisplayName + ------ ---- ----------- + Running Winmgmt Windows Management Instrumentation + + Test-NetConnection -ComputerName 192.168.0.2 -Port 135 -InformationLevel Detailed + + ComputerName : 192.168.0.2 + RemoteAddress : 192.168.0.2 + RemotePort : 135 + AllNameResolutionResults : + MatchingIPsecRules : + NetworkIsolationContext : Internet + InterfaceAlias : Ethernet + SourceAddress : 192.168.0.2 + NetRoute (NextHop) : 0.0.0.0 + PingSucceeded : True + PingReplyDetails (RTT) : 0 ms + TcpTestSucceeded : True + ``` + + You can also verify WMI using the WMI console by typing **wmimgmt.msc**, right-clicking **WMI Control (Local)** in the console tree, and then clicking **Properties**. + + If the WMI service is not started, attempt to start it or reboot the computer. If WMI is running but errors are present, see [WMIDiag](https://blogs.technet.microsoft.com/askperf/2015/05/12/wmidiag-2-2-is-here/) for troubleshooting information. + +4. To extend the Active Directory schema, type the following command at an elevated Windows PowerShell prompt: + + ```powershell + cmd /c C:\configmgr\SMSSETUP\BIN\X64\extadsch.exe + ``` + +5. Temporarily switch to the DC1 VM, and type the following command at an elevated command prompt on DC1: + + ```dos + adsiedit.msc + ``` + +6. Right-click **ADSI Edit**, click **Connect to**, select **Default (Domain or server that you logged in to)** under **Computer** and then click **OK**. +7. Expand **Default naming context**>**DC=contoso,DC=com**, and then in the console tree right-click **CN=System**, point to **New**, and then click **Object**. +8. Click **container** and then click **Next**. +9. Next to **Value**, type **System Management**, click **Next**, and then click **Finish**. +10. Right-click **CN=system Management** and then click **Properties**. +11. On the **Security** tab, click **Add**, click **Object Types**, select **Computers**, and click **OK**. +12. Under **Enter the object names to select**, type **SRV1** and click **OK**. +13. The **SRV1** computer account will be highlighted, select **Allow** next to **Full control**. +14. Click **Advanced**, click **SRV1 (CONTOSO\SRV1$)** and click **Edit**. +15. Next to **Applies to**, choose **This object and all descendant objects**, and then click **OK** three times. +16. Close the ADSI Edit console and switch back to SRV1. +17. To start Configuration Manager installation, type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + cmd /c C:\configmgr\SMSSETUP\BIN\X64\Setup.exe + ``` + +18. Provide the following in the Microsoft Endpoint Configuration Manager Setup Wizard: + - **Before You Begin**: Read the text and click *Next*. + - **Getting Started**: Choose **Install a Configuration Manager primary site** and select the **Use typical installation options for a stand-alone primary site** checkbox. + - Click **Yes** in response to the popup window. + - **Product Key**: Choose **Install the evaluation edition of this Product**. + - **Microsoft Software License Terms**: Read the terms and then select the **I accept these license terms** checkbox. + - **Prerequisite Licenses**: Review license terms and select all three checkboxes on the page. + - **Prerequisite Downloads**: Choose **Download required files** and enter **c:\windows\temp** next to **Path**. + - **Site and Installation Settings**: Site code: **PS1**, Site name: **Contoso**. + - use default settings for all other options + - **Usage Data**: Read the text and click **Next**. + - **Service Connection Point Setup**: Accept the default settings (SRV1.contoso.com is automatically added under Select a server to use). + - **Settings Summary**: Review settings and click **Next**. + - **Prerequisite Check**: No failures should be listed. Ignore any warnings and click **Begin Install**. + + >There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored in this test environment. + + Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Click **Close** when installation is complete. + +19. If desired, re-enable IE Enhanced Security Configuration at this time on SRV1: + + ```powershell + Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 1 + Stop-Process -Name Explorer + ``` + +## Download MDOP and install DaRT + +> [!IMPORTANT] +> This step requires an MSDN subscription or volume licence agreement. For more information, see [Ready for Windows 10: MDOP 2015 and more tools are now available](https://blogs.technet.microsoft.com/windowsitpro/2015/08/17/ready-for-windows-10-mdop-2015-and-more-tools-are-now-available/). +> If your organization qualifies and does not already have an MSDN subscription, you can obtain a [free MSDN subscription with BizSpark](https://docs.microsoft.com/archive/blogs/zainnab/bizspark-free-msdn-subscription-for-start-up-companies/). + +1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso, 2.79 GB) to the C:\VHD directory on the Hyper-V host. + +2. Type the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1: + + ```powershell + Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso + ``` + +3. Type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + cmd /c "D:\DaRT\DaRT 10\Installers\en-us\x64\MSDaRT100.msi" + ``` + +4. Install DaRT 10 using default settings. +5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx64.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x64" + Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx86.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x86" + ``` + +## Prepare for Zero Touch installation + +This section contains several procedures to support Zero Touch installation with Microsoft Endpoint Configuration Manager. + +### Create a folder structure + +1. Type the following commands at a Windows PowerShell prompt on SRV1: + + ```powershell + New-Item -ItemType Directory -Path "C:\Sources\OSD\Boot" + New-Item -ItemType Directory -Path "C:\Sources\OSD\OS" + New-Item -ItemType Directory -Path "C:\Sources\OSD\Settings" + New-Item -ItemType Directory -Path "C:\Sources\OSD\Branding" + New-Item -ItemType Directory -Path "C:\Sources\OSD\MDT" + New-Item -ItemType Directory -Path "C:\Logs" + New-SmbShare -Name Sources$ -Path C:\Sources -ChangeAccess EVERYONE + New-SmbShare -Name Logs$ -Path C:\Logs -ChangeAccess EVERYONE + ``` + +### Enable MDT ConfigMgr integration + +1. On SRV1, click **Start**, type **configmgr**, and then click **Configure ConfigMgr Integration**. +2. Type **PS1** next to **Site code**, and then click **Next**. +3. Verify **The process completed successfully** is displayed, and then click **Finish**. + +### Configure client settings + +1. On SRV1, click **Start**, type **configuration manager**, right-click **Configuration Manager Console**, and then click **Pin to Taskbar**. +2. Click **Desktop**, and then launch the Configuration Manager console from the taskbar. +3. If the console notifies you that an update is available, click **OK**. It is not necessary to install updates to complete this lab. +4. In the console tree, open the **Administration** workspace (in the lower left corner) and click **Client Settings**. +5. In the display pane, double-click **Default Client Settings**. +6. Click **Computer Agent**, next to **Organization name displayed in Software Center** type **Contoso**, and then click **OK**. + +### Configure the network access account + +1. In the Administration workspace, expand **Site Configuration** and click **Sites**. +2. On the **Home** ribbon at the top of the console window, click **Configure Site Components** and then click **Software Distribution**. +3. On the **Network Access Account** tab, choose **Specify the account that accesses network locations**. +4. Click the yellow starburst and then click **New Account**. +5. Click **Browse** and then under **Enter the object name to select**, type **CM_NAA** and click **OK**. +6. Next to **Password** and **Confirm Password**, type **pass\@word1**, and then click **OK** twice. + +### Configure a boundary group + +1. In the Administration workspace, expand **Hierarchy Configuration**, right-click **Boundaries** and then click **Create Boundary**. +2. Next to **Description**, type **PS1**, next to **Type** choose **Active Directory Site**, and then click **Browse**. +3. Choose **Default-First-Site-Name** and then click **OK** twice. +4. In the Administration workspace, right-click **Boundary Groups** and then click **Create Boundary Group**. +5. Next to **Name**, type **PS1 Site Assignment and Content Location**, click **Add**, select the **Default-First-Site-Name** boundary and then click **OK**. +6. On the **References** tab in the **Create Boundary Group** window select the **Use this boundary group for site assignment** checkbox. +7. Click **Add**, select the **\\\SRV1.contoso.com** checkbox, and then click **OK** twice. + +### Add the state migration point role + +1. In the Administration workspace, expand **Site Configuration**, click **Sites**, and then in on the **Home** ribbon at the top of the console click **Add Site System Roles**. +2. In the Add site System Roles Wizard, click **Next** twice and then on the Specify roles for this server page, select the **State migration point** checkbox. +3. Click **Next**, click the yellow starburst, type **C:\MigData** for the **Storage folder**, and click **OK**. +4. Click **Next**, and then verify under **Boundary groups** that **PS1 Site Assignment and Content Location** is displayed. +5. Click **Next** twice and then click **Close**. + +### Enable PXE on the distribution point + +> [!IMPORTANT] +> Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, type the following commands at an elevated Windows PowerShell prompt on SRV1: + +```powershell +WDSUTIL /Set-Server /AnswerClients:None +``` + +1. Determine the MAC address of the internal network adapter on SRV1. To determine this, type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + (Get-NetAdapter "Ethernet").MacAddress + ``` + + > If the internal network adapter, assigned an IP address of 192.168.0.2, is not named "Ethernet" then replace the name "Ethernet" in the previous command with the name of this network adapter. You can review the names of network adapters and the IP addresses assigned to them by typing **ipconfig**. + +2. In the Microsoft Endpoint Configuration Manager console, in the **Administration** workspace, click **Distribution Points**. +3. In the display pane, right-click **SRV1.CONTOSO.COM** and then click **Properties**. +4. On the PXE tab, select the following settings: + - **Enable PXE support for clients**. Click **Yes** in the popup that appears. + - **Allow this distribution point to respond to incoming PXE requests** + - **Enable unknown computer support**. Click **OK** in the popup that appears. + - **Require a password when computers use PXE** + - **Password** and **Confirm password**: pass@word1 + - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. + + See the following example: + ![Config Mgr PXE](images/configmgr-pxe.png) + +5. Click **OK**. +6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: + + ```powershell + cmd /c dir /b C:\RemoteInstall\SMSBoot\x64 + + abortpxe.com + bootmgfw.efi + bootmgr.exe + pxeboot.com + pxeboot.n12 + wdsmgfw.efi + wdsnbp.com + ``` + + >If these files are not present in the C:\RemoteInstall directory, verify that the REMINST share is configured as C:\RemoteInstall. You can view the properties of this share by typing "net share REMINST" at a command prompt. If the share path is set to a different value, then replace C:\RemoteInstall with your REMINST share path. + >You can also type the following command at an elevated Windows PowerShell prompt to open the Configuration Manager Trace Log Tool. In the tool, click **File**, click **Open**, and then open the **distmgr.log** file. If errors are present, they will be highlighted in red: + + ```powershell + Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' + ``` + + The log file will updated continuously while Configuration Manager is running. Wait for Configuration Manager to repair any issues that are present, and periodically re-check that the files are present in the REMINST share location. Close the Configuration Manager Trace Log Tool when done. You will see the following line in distmgr.log that indicates the REMINST share is being populated with necessary files: + + `Running: WDSUTIL.exe /Initialize-Server /REMINST:"C:\RemoteInstall"` + + Once the files are present in the REMINST share location, you can close the cmtrace tool. + +### Create a branding image file + +1. If you have a bitmap (.BMP) image for suitable use as a branding image, copy it to the C:\Sources\OSD\Branding folder on SRV1. Otherwise, use the following step to copy a simple branding image. +2. Type the following command at an elevated Windows PowerShell prompt: + + ```powershell + Copy-Item -Path "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" -Destination "C:\Sources\OSD\Branding\contoso.bmp" + ``` + + >You can open C:\Sources\OSD\Branding\contoso.bmp in MSPaint.exe if desired to customize this image. + +### Create a boot image for Configuration Manager + +1. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Boot Images**, and then click **Create Boot Image using MDT**. +2. On the Package Source page, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then click **Next**. + - The Zero Touch WinPE x64 folder does not yet exist. The folder will be created later. +3. On the General Settings page, type **Zero Touch WinPE x64** next to **Name**, and click **Next**. +4. On the Options page, under **Platform** choose **x64**, and click **Next**. +5. On the Components page, in addition to the default selection of **Microsoft Data Access Components (MDAC/ADO) support**, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** checkbox, and click **Next**. +6. On the Customization page, select the **Use a custom background bitmap file** checkbox, and under **UNC path**, type or browse to **\\\SRV1\Sources$\OSD\Branding\contoso.bmp**, and then click **Next** twice. It will take a few minutes to generate the boot image. +7. Click **Finish**. +8. In the console display pane, right-click the **Zero Touch WinPE x64** boot image, and then click **Distribute Content**. +9. In the Distribute Content Wizard, click **Next**, click **Add** and select **Distribution Point**, select the **SRV1.CONTOSO.COM** checkbox, click **OK**, click **Next** twice, and then click **Close**. +10. Use the CMTrace application to view the **distmgr.log** file again and verify that the boot image has been distributed. To open CMTrace, type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' + ``` + + In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example: + + ```console + STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=924 TID=1424 GMTDATE=Tue Oct 09 22:36:30.986 2018 ISTR0="Zero Touch WinPE x64" ISTR1="PS10000A" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS10000A" SMS_DISTRIBUTION_MANAGER 10/9/2018 3:36:30 PM 1424 (0x0590) + ``` + +11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Double-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab. +12. Next, in the **Software Library** workspace, double-click **Zero Touch WinPE x64** and then click the **Data Source** tab. +13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and click **OK**. +14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example: + + ```console + cmd /c dir /s /b C:\RemoteInstall\SMSImages + + C:\RemoteInstall\SMSImages\PS100004 + C:\RemoteInstall\SMSImages\PS100005 + C:\RemoteInstall\SMSImages\PS100006 + C:\RemoteInstall\SMSImages\PS100004\boot.PS100004.wim + C:\RemoteInstall\SMSImages\PS100005\boot.PS100005.wim + C:\RemoteInstall\SMSImages\PS100006\WinPE.PS100006.wim + ``` + + >The first two images (*.wim files) are default boot images. The third is the new boot image with DaRT. + +### Create a Windows 10 reference image + +If you have already completed steps in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then you have already created a Windows 10 reference image. In this case, skip to the next procedure in this guide: [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image). If you have not yet created a Windows 10 reference image, complete the steps in this section. + +1. In [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: + + ```powershell + Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso + ``` + +2. Verify that the Windows Enterprise installation DVD is mounted on SRV1 as drive letter D. + +3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, click **Start**, type **deployment**, and then click **Deployment Workbench**. + +4. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. + +5. Use the following settings for the New Deployment Share Wizard: + - Deployment share path: **C:\MDTBuildLab** + - Share name: **MDTBuildLab$** + - Deployment share description: **MDT build lab** + - Options: click **Next** to accept the default + - Summary: click **Next** + - Progress: settings will be applied + - Confirmation: click **Finish** + +6. Expand the **Deployment Shares** node, and then expand **MDT build lab**. + +7. Right-click the **Operating Systems** node, and then click **New Folder**. Name the new folder **Windows 10**. Complete the wizard using default values and click **Finish**. + +7. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. + +8. Use the following settings for the Import Operating System Wizard: + - OS Type: **Full set of source files** + - Source: **D:\\** + - Destination: **W10Ent_x64** + - Summary: click **Next** + - Confirmation: click **Finish** + +9. For purposes of this test lab, we will not add applications, such as Microsoft Office, to the deployment share. For information about adding applications, see the [Add applications](deploy-windows-mdt/create-a-windows-10-reference-image.md#add-applications) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. + +10. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node under **MDT Build Lab** and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: **REFW10X64-001** + - Task sequence name: **Windows 10 Enterprise x64 Default Image** + - Task sequence comments: **Reference Build** + - Template: **Standard Client Task Sequence** + - Select OS: click **Windows 10 Enterprise Evaluation in W10Ent_x64 install.wim** + - Specify Product Key: **Do not specify a product key at this time** + - Full Name: **Contoso** + - Organization: **Contoso** + - Internet Explorer home page: **http://www.contoso.com** + - Admin Password: **Do not specify an Administrator password at this time** + - Summary: click **Next** + - Confirmation: click **Finish** + +11. Edit the task sequence to add the Microsoft NET Framework 3.5, which is required by many applications. To edit the task sequence, double-click **Windows 10 Enterprise x64 Default Image** that was created in the previous step. + +12. Click the **Task Sequence** tab. Under **State Restore** click **Tattoo** to highlight it, then click **Add** and choose **New Group**. A new group will be added under Tattoo. + +13. On the Properties tab of the group that was created in the previous step, change the Name from New Group to **Custom Tasks (Pre-Windows Update)** and then click **Apply**. To see the name change, click **Tattoo**, then click the new group again. + +14. Click the **Custom Tasks (Pre-Windows Update)** group again, click **Add**, point to **Roles**, and then click **Install Roles and Features**. + +15. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then click **Apply**. + +16. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. + >Note: Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications. + +17. Click **OK** to complete editing the task sequence. + +18. The next step is to configure the MDT deployment share rules. To configure rules in the Deployment Workbench, right-click MDT build lab (C:\MDTBuildLab) and click **Properties**, and then click the **Rules** tab. + +19. Replace the default rules with the following text: + + ```ini + [Settings] + Priority=Default + + [Default] + _SMSTSORGNAME=Contoso + UserDataLocation=NONE + DoCapture=YES + OSInstall=Y + AdminPassword=pass@word1 + TimeZoneName=Pacific Standard TimeZoneName + OSDComputername=#Left("PC-%SerialNumber%",7)# + JoinWorkgroup=WORKGROUP + HideShell=YES + FinishAction=SHUTDOWN + DoNotCreateExtraPartition=YES + ApplyGPOPack=NO + SkipAdminPassword=YES + SkipProductKey=YES + SkipComputerName=YES + SkipDomainMembership=YES + SkipUserData=YES + SkipLocaleSelection=YES + SkipTaskSequence=NO + SkipTimeZone=YES + SkipApplications=YES + SkipBitLocker=YES + SkipSummary=YES + SkipRoles=YES + SkipCapture=NO + SkipFinalSummary=NO + ``` + +20. Click **Apply** and then click **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: + + ```ini + [Settings] + Priority=Default + + [Default] + DeployRoot=\\SRV1\MDTBuildLab$ + UserDomain=CONTOSO + UserID=MDT_BA + UserPassword=pass@word1 + SkipBDDWelcome=YES + ``` + +21. Click **OK** to complete the configuration of the deployment share. + +22. Right-click **MDT build lab (C:\MDTBuildLab)** and then click **Update Deployment Share**. + +23. Accept all default values in the Update Deployment Share Wizard by clicking **Next**. The update process will take 5 to 10 minutes. When it has completed, click **Finish**. + +24. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. Note that in MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). + + >Hint: Top copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. + +25. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: + + ```powershell + New-VM –Name REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB + Set-VMMemory -VMName REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20 + Set-VMDvdDrive -VMName REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso + Start-VM REFW10X64-001 + vmconnect localhost REFW10X64-001 + ``` + +26. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then click **Next**. + +27. Accept the default values on the Capture Image page, and click **Next**. Operating system installation will complete after 5 to 10 minutes and then the VM will reboot automatically. Allow the system to boot normally (do not press a key). The process is fully automated. + + Additional system restarts will occur to complete updating and preparing the operating system. Setup will complete the following procedures: + + - Install the Windows 10 Enterprise operating system. + - Install added applications, roles, and features. + - Update the operating system using Windows Update (or WSUS if optionally specified). + - Stage Windows PE on the local disk. + - Run System Preparation (Sysprep) and reboot into Windows PE. + - Capture the installation to a Windows Imaging (WIM) file. + - Turn off the virtual machine. + + This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is **REFW10X64-001.wim**. + +### Add a Windows 10 operating system image + +1. Type the following commands at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + New-Item -ItemType Directory -Path "C:\Sources\OSD\OS\Windows 10 Enterprise x64" + cmd /c copy /z "C:\MDTBuildLab\Captures\REFW10X64-001.wim" "C:\Sources\OSD\OS\Windows 10 Enterprise x64" + ``` + +2. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Operating System Images**, and then click **Add Operating System Image**. + +3. On the Data Source page, under **Path:**, type or browse to **\\\SRV1\Sources$\OSD\OS\Windows 10 Enterprise x64\REFW10X64-001.wim**, and click **Next**. + +4. On the General page, next to **Name:**, type **Windows 10 Enterprise x64**, click **Next** twice, and then click **Close**. + +5. Distribute the operating system image to the SRV1 distribution point by right-clicking the **Windows 10 Enterprise x64** operating system image and then clicking **Distribute Content**. + +6. In the Distribute Content Wizard, click **Next**, click **Add**, click **Distribution Point**, add the **SRV1.CONTOSO.COM** distribution point, click **OK**, click **Next** twice and then click **Close**. + +7. Enter **\Monitoring\Overview\Distribution Status\Content Status** on the location bar (be sure there is no space at the end of the location or you will get an error), click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. Processing of the image on the site server can take several minutes. + + >If content distribution is not successful, verify that sufficient disk space is available. + +### Create a task sequence + +>Complete this section slowly. There are a large number of similar settings from which to choose. + +1. In the Configuration Manager console, in the **Software Library** workspace expand **Operating Systems**, right-click **Task Sequences**, and then click **Create MDT Task Sequence**. + +2. On the Choose Template page, select the **Client Task Sequence** template and click **Next**. + +3. On the General page, type **Windows 10 Enterprise x64** under **Task sequence name:** and then click **Next**. + +4. On the Details page, enter the following settings: + - Join a domain: **contoso.com** + - Account: click **Set** + - User name: **contoso\CM_JD** + - Password: **pass@word1** + - Confirm password: **pass@word1** + - Click **OK** + - Windows Settings + - User name: **Contoso** + - Organization name: **Contoso** + - Product key: \ + - Administrator Account: **Enable the account and specify the local administrator password** + - Password: **pass@word1** + - Confirm password: **pass@word1** + - Click **Next** + +5. On the Capture Settings page, accept the default settings and click **Next**. + +6. On the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package, click **OK**, and then click **Next**. + +7. On the MDT Package page, select **Create a new Microsoft Deployment Toolkit Files package**, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\MDT\MDT** (MDT is repeated here, not a typo), and then click **Next**. + +8. On the MDT Details page, next to **Name:** type **MDT** and then click **Next**. + +9. On the OS Image page, browse and select the **Windows 10 Enterprise x64** package, click **OK**, and then click **Next**. + +10. On the Deployment Method page, accept the default settings for **Zero Touch Installation** and click **Next**. + +11. On the Client Package page, browse and select the **Microsoft Corporation Configuration Manager Client package**, click **OK**, and then click **Next**. + +12. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows 10.0.14393.0** package, click **OK**, and then click **Next**. + +13. On the Settings Package page, select **Create a new settings package**, and under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Settings\Windows 10 x64 Settings**, and then click **Next**. + +14. On the Settings Details page, next to **Name:**, type **Windows 10 x64 Settings**, and click **Next**. + +15. On the Sysprep Package page, click **Next** twice. + +16. On the Confirmation page, click **Finish**. + +### Edit the task sequence + +1. In the Configuration Manager console, in the **Software Library** workspace, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Edit**. + +2. Scroll down to the **Install** group and click the **Set Variable for Drive Letter** action. + +3. Change the Value under **OSDPreserveDriveLetter** from **False** to **True**, and then click **Apply**. + +4. In the **State Restore** group, click the **Set Status 5** action, click **Add** in the upper left corner, point to **User State**, and click **Request State Store**. This adds a new action immediately after **Set Status 5**. + +5. Configure the **Request State Store** action that was just added with the following settings: + - Request state storage location to: **Restore state from another computer** + - Select the **If computer account fails to connect to state store, use the Network Access account** checkbox. + - Options tab: Select the **Continue on error** checkbox. + - Add Condition: **Task Sequence Variable**: + - Variable: **USMTLOCAL** + - Condition: **not equals** + - Value: **True** + - Click **OK** + - Click **Apply** + +6. In the **State Restore** group, click **Restore User State**, click **Add**, point to **User State**, and click **Release State Store**. + +7. Configure the **Release State Store** action that was just added with the following settings: + - Options tab: Select the **Continue on error** checkbox. + - Add Condition: **Task Sequence Variable**: + - Variable: **USMTLOCAL** + - Condition: **not equals** + - Value: **True** + - Click **OK** + - Click **OK** + +### Finalize the operating system configuration + +>If you completed all procedures in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then the MDT deployment share is already present on SRV1. In this case, skip the first four steps below and begin with step 5 to edit CustomSettings.ini. + +1. In the MDT deployment workbench on SRV1, right-click **Deployment Shares** and then click **New Deployment Share**. + +2. Use the following settings for the New Deployment Share Wizard: + - Deployment share path: **C:\MDTProduction** + - Share name: **MDTProduction$** + - Deployment share description: **MDT Production** + - Options: click **Next** to accept the default + - Summary: click **Next** + - Progress: settings will be applied + - Confirmation: click **Finish** + +3. Right-click the **MDT Production** deployment share, and click **Properties**. + +4. Click the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then click **OK**. + +5. Type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell + notepad "C:\Sources\OSD\Settings\Windows 10 x64 Settings\CustomSettings.ini" + ``` + +6. Replace the contents of the file with the following text, and then save the file: + + ```ini + [Settings] + Priority=Default + Properties=OSDMigrateConfigFiles,OSDMigrateMode + + [Default] + DoCapture=NO + ComputerBackupLocation=NONE + OSDMigrateMode=Advanced + OSDMigrateAdditionalCaptureOptions=/ue:*\* /ui:CONTOSO\* + OSDMigrateConfigFiles=Miguser.xml,Migapp.xml + SLSHARE=\\SRV1\Logs$ + EventService=http://SRV1:9800 + ApplyGPOPack=NO + ``` + + >As noted previously, if you wish to migrate accounts other than those in the Contoso domain, then change the OSDMigrateAdditionalCaptureOptions option. For example, the following option will capture settings from all user accounts: + + ```ini + OSDMigrateAdditionalCaptureOptions=/all + ``` + +7. Return to the Configuration Manager console, and in the Software Library workspace, expand **Application Management**, click **Packages**, right-click **Windows 10 x64 Settings**, and then click **Update Distribution Points**. Click **OK** in the popup that appears. + +8. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Distribute Content**. + +9. In the Distribute Content Wizard, click **Next** twice, click **Add**, click **Distribution Point**, select the **SRV1.CONTOSO.COM** distribution point, click **OK**, click **Next** twice and then click **Close**. + +10. Enter **\Monitoring\Overview\Distribution Status\Content Status\Windows 10 Enterprise x64** on the location bar, double-click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. + +### Create a deployment for the task sequence + +1. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Deploy**. + +2. On the General page, next to **Collection**, click **Browse**, select the **All Unknown Computers** collection, click **OK**, and then click **Next**. + +3. On the Deployment Settings page, use the following settings: + - Purpose: **Available** + - Make available to the following: **Only media and PXE** + - Click **Next**. +4. Click **Next** five times to accept defaults on the Scheduling, User Experience, Alerts, and Distribution Points pages. + +5. Click **Close**. + +## Deploy Windows 10 using PXE and Configuration Manager + +In this first deployment scenario, we will deploy Windows 10 using PXE. This scenario creates a new computer that does not have any migrated users or settings. + +1. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + + ```powershell + New-VM –Name "PC4" –NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 40GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 + Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 + Start-VM PC4 + vmconnect localhost PC4 + ``` + +2. Press ENTER when prompted to start the network boot service. + +3. In the Task Sequence Wizard, provide the password: **pass@word1**, and then click **Next**. + +4. Before you click **Next** in the Task Sequence Wizard, press the **F8** key. A command prompt will open. + +5. At the command prompt, type **explorer.exe** and review the Windows PE file structure. + +6. The smsts.log file is critical for troubleshooting any installation problems that might be encountered. Depending on the deployment phase, the smsts.log file is created in different locations: + - X:\Windows\temp\SMSTSLog\smsts.log before disks are formatted. + - X:\smstslog\smsts.log after disks are formatted. + - C:\\_SMSTaskSequence\Logs\Smstslog\smsts.log before the Microsoft Endpoint Configuration Manager client is installed. + - C:\Windows\ccm\logs\Smstslog\smsts.log after the Microsoft Endpoint Configuration Manager client is installed. + - C:\Windows\ccm\logs\smsts.log when the task sequence is complete. + + Note: If a reboot is pending on the client, the reboot will be blocked as long as the command window is open. + +7. In the explorer window, click **Tools** and then click **Map Network Drive**. + +8. Do not map a network drive at this time. If you need to save the smsts.log file, you can use this method to save the file to a location on SRV1. + +9. Close the Map Network Drive window, the Explorer window, and the command prompt. + +10. The **Windows 10 Enterprise x64** task sequence is selected in the Task Sequence Wizard. Click **Next** to continue with the deployment. + +11. The task sequence will require several minutes to complete. You can monitor progress of the task sequence using the MDT Deployment Workbench under Deployment Shares > MDTProduction > Monitoring. The task sequence will: + - Install Windows 10 + - Install the Configuration Manager client and hotfix + - Join the computer to the contoso.com domain + - Install any applications that were specified in the reference image + +12. When Windows 10 installation has completed, sign in to PC4 using the **contoso\administrator** account. + +13. Right-click **Start**, click **Run**, type **control appwiz.cpl**, press ENTER, click **Turn Windows features on or off**, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This is a feature included in the reference image. + +14. Shut down the PC4 VM. + +> [!NOTE] +> The following two procedures 1) Replace a client with Windows 10 and 2) Refresh a client with Windows 10 have been exchanged in their order in this guide compared to the previous version. This is to avoid having to restore Hyper-V checkpoints to have access to PC1 before the OS is upgraded. If this is your first time going through this guide, you won't notice any change, but if you have tried the guide previously then this change should make it simpler to complete. + +## Replace a client with Windows 10 using Configuration Manager + +>Before starting this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoso.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It is not required to delete the stale entries, this is only done to remove clutter. + +![contoso.com\Computers](images/poc-computers.png) + +In the replace procedure, PC1 will not be migrated to a new operating system. It is simplest to perform this procedure before performing the refresh procedure. After refreshing PC1, the operating system will be new. The next (replace) procedure does not install a new operating system on PC1 but rather performs a side-by-side migration of PC1 and another computer (PC4), to copy users and settings from PC1 to the new computer. + +### Create a replace task sequence + +1. On SRV1, in the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and then click **Create MDT Task Sequence**. + +2. On the Choose Template page, select **Client Replace Task Sequence** and click **Next**. + +3. On the General page, type the following: + - Task sequence name: **Replace Task Sequence** + - Task sequence comments: **USMT backup only** + +4. Click **Next**, and on the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package. Click **OK** and then click **Next** to continue. +5. On the MDT Package page, browse and select the **MDT** package. Click **OK** and then click **Next** to continue. +6. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows** package. Click **OK** and then click **Next** to continue. +7. On the Settings Package page, browse and select the **Windows 10 x64 Settings** package. Click **OK** and then click **Next** to continue. +8. On the Summary page, review the details and then click **Next**. +9. On the Confirmation page, click **Finish**. + +>If an error is displayed at this stage it can be caused by a corrupt MDT integration. To repair it, close the Configuration Manager console, remove MDT integration, and then restore MDT integration. + +### Deploy PC4 + +Create a VM named PC4 to receive the applications and settings from PC1. This VM represents a new computer that will replace PC1. To create this VM, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + +```powershell +New-VM –Name "PC4" –NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 +Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 2048MB -Buffer 20 +Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF +``` + +>Hyper-V enables us to define a static MAC address on PC4. In a real-world scenario you must determine the MAC address of the new computer. + +### Install the Configuration Manager client on PC1 + +1. Verify that the PC1 VM is running and in its original state, which was saved as a checkpoint and then restored in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md). + +2. If a PC1 checkpoint has not already been saved, then save a checkpoint by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + + ```powershell + Checkpoint-VM -Name PC1 -SnapshotName BeginState + ``` + +3. On SRV1, in the Configuration Manager console, in the Administration workspace, expand **Hierarchy Configuration** and click on **Discovery Methods**. +4. Double-click **Active Directory System Discovery** and on the **General** tab select the **Enable Active Directory System Discovery** checkbox. +5. Click the yellow starburst, click **Browse**, select **contoso\Computers**, and then click **OK** three times. +6. When a popup dialog box asks if you want to run full discovery, click **Yes**. +7. In the Assets and Compliance workspace, click **Devices** and verify that the computer account names for SRV1 and PC1 are displayed. See the following example (GREGLIN-PC1 is the computer account name of PC1 in this example): + + ![assets](images/configmgr-assets.png) + + >If you do not see the computer account for PC1, try clicking the **Refresh** button in the upper right corner of the console. + + The **Client** column indicates that the Configuration Manager client is not currently installed. This procedure will be carried out next. + +8. Sign in to PC1 using the contoso\administrator account and type the following at an elevated command prompt to remove any pre-existing client configuration, if it exists. Note: this command requires an elevated command prompt not an elevated Windows PowerShell prompt: + + ```dos + sc stop ccmsetup + "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /Uninstall + ``` + + >If PC1 still has Configuration Manager registry settings that were applied by Group Policy, startup scripts, or other policies in its previous domain, these might not all be removed by CCMSetup /Uninstall and can cause problems with installation or registration of the client in its new environment. It might be necessary to manually remove these settings if they are present. For more information, see [Manual removal of the Configuration Manager client](https://blogs.technet.microsoft.com/michaelgriswold/2013/01/02/manual-removal-of-the-sccm-client/). + +9. On PC1, temporarily stop Windows Update from queuing items for download and clear all BITS jobs from the queue. From an elevated command prompt, type: + + ```dos + net stop wuauserv + net stop BITS + ``` + + Verify that both services were stopped successfully, then type the following at an elevated command prompt: + + ```dos + del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" + net start BITS + bitsadmin /list /allusers + ``` + + Verify that BITSAdmin displays 0 jobs. + +10. To install the Configuration Manager client as a standalone process, type the following at an elevated command prompt: + + ```dos + "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /mp:SRV1.contoso.com /logon SMSSITECODE=PS1 + ``` + +11. On PC1, using file explorer, open the **C:\Windows\ccmsetup** directory. During client installation, files will be downloaded here. +12. Installation progress will be captured in the file: **c:\windows\ccmsetup\logs\ccmsetup.log**. You can periodically open this file in notepad, or you can type the following command at an elevated Windows PowerShell prompt to monitor installation progress: + + ```powershell + Get-Content -Path c:\windows\ccmsetup\logs\ccmsetup.log -Wait + ``` + + Installation might require several minutes, and display of the log file will appear to hang while some applications are installed. This is normal. When setup is complete, verify that **CcmSetup is existing with return code 0** is displayed on the last line of the ccmsetup.log file and then press **CTRL-C** to break out of the Get-Content operation (if you are viewing the log in Windows PowerShell the last line will be wrapped). A return code of 0 indicates that installation was successful and you should now see a directory created at **C:\Windows\CCM** that contains files used in registration of the client with its site. + +13. On PC1, open the Configuration Manager control panel applet by typing the following command from a command prompt: + + ```dos + control smscfgrc + ``` + +14. Click the **Site** tab, click **Configure Settings**, and click **Find Site**. The client will report that it has found the PS1 site. See the following example: + + ![site](images/configmgr-site.png) + + If the client is not able to find the PS1 site, review any error messages that are displayed in **C:\Windows\CCM\Logs\ClientIDManagerStartup.log** and **LocationServices.log**. A common reason the site code is not located is because a previous configuration exists. For example, if a previous site code is configured at **HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode** this must be deleted or updated. + +15. On SRV1, in the Assets and Compliance workspace, click **Device Collections** and then double-click **All Desktop and Server Clients**. This node will be added under **Devices**. + +16. Click **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: + + ![client](images/configmgr-client.png) + + >It might take several minutes for the client to fully register with the site and complete a client check. When it is complete you will see a green check mark over the client icon as shown above. To refresh the client, click it and then press **F5** or right-click the client and click **Refresh**. + +### Create a device collection and deployment + +1. On SRV1, in the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. + +2. Use the following settings in the **Create Device Collection Wizard**: + - General > Name: **Install Windows 10 Enterprise x64** + - General > Limiting collection: **All Systems** + - Membership Rules > Add Rule: **Direct Rule** + - The **Create Direct Membership Rule Wizard** opens, click **Next** + - Search for Resources > Resource class: **System Resource** + - Search for Resources > Attribute name: **Name** + - Search for Resources > Value: **%** + - Select Resources > Value: Select the computername associated with the PC1 VM + - Click **Next** twice and then click **Close** in both windows (Next, Next, Close, then Next, Next, Close) + +3. Double-click the Install Windows 10 Enterprise x64 device collection and verify that the PC1 computer account is displayed. + +4. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64** and then click **Deploy**. + +5. Use the following settings in the Deploy Software wizard: + - General > Collection: Click Browse and select **Install Windows 10 Enterprise x64** + - Deployment Settings > Purpose: **Available** + - Deployment Settings > Make available to the following: **Configuration Manager clients, media and PXE** + - Scheduling > Click **Next** + - User Experience > Click **Next** + - Alerts > Click **Next** + - Distribution Points > Click **Next** + - Summary > Click **Next** + - Verify that the wizard completed successfully and then click **Close** + +### Associate PC4 with PC1 + +1. On SRV1 in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Devices** and then click **Import Computer Information**. + +2. On the Select Source page, choose **Import single computer** and click **Next**. + +3. On the Single Computer page, use the following settings: + - Computer Name: **PC4** + - MAC Address: **00:15:5D:83:26:FF** + - Source Computer: \ + +4. Click **Next**, and on the User Accounts page choose **Capture and restore specified user accounts**, then click the yellow starburst next to **User accounts to migrate**. + +5. Click **Browse** and then under Enter the object name to select type **user1** and click OK twice. + +6. Click the yellow starburst again and repeat the previous step to add the **contoso\administrator** account. + +7. Click **Next** twice, and on the Choose Target Collection page, choose **Add computers to the following collection**, click **Browse**, choose **Install Windows 10 Enterprise x64**, click **OK**, click **Next** twice, and then click **Close**. + +8. In the Assets and Compliance workspace, click **User State Migration** and review the computer association in the display pane. The source computer will be the computername of PC1 (GREGLIN-PC1 in this example), the destination computer will be **PC4**, and the migration type will be **side-by-side**. + +9. Right-click the association in the display pane and then click **Specify User Accounts**. You can add or remove user account here. Click **OK**. + +10. Right-click the association in the display pane and then click **View Recovery Information**. Note that a recovery key has been assigned, but a user state store location has not. Click **Close**. + +11. Click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. Verify that **PC4** is displayed in the collection. You might have to update and refresh the collection, or wait a few minutes, but do not proceed until PC4 is available. See the following example: + + ![collection](images/configmgr-collection.png) + +### Create a device collection for PC1 + +1. On SRV1, in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. + +2. Use the following settings in the **Create Device Collection Wizard**: + - General > Name: **USMT Backup (Replace)** + - General > Limiting collection: **All Systems** + - Membership Rules > Add Rule: **Direct Rule** + - The **Create Direct Membership Rule Wizard** opens, click **Next** + - Search for Resources > Resource class: **System Resource** + - Search for Resources > Attribute name: **Name** + - Search for Resources > Value: **%** + - Select Resources > Value: Select the computername associated with the PC1 VM (GREGLIN-PC1 in this example). + - Click **Next** twice and then click **Close** in both windows. + +3. Click **Device Collections** and then double-click **USMT Backup (Replace)**. Verify that the computer name/hostname associated with PC1 is displayed in the collection. Do not proceed until this name is displayed. + +### Create a new deployment + +In the Configuration Manager console, in the Software Library workspace under Operating Systems, click **Task Sequences**, right-click **Replace Task Sequence**, click **Deploy**, and use the following settings: + +- General > Collection: **USMT Backup (Replace)** +- Deployment Settings > Purpose: **Available** +- Deployment Settings > Make available to the following: **Only Configuration Manager Clients** +- Scheduling: Click **Next** +- User Experience: Click **Next** +- Alerts: Click **Next** +- Distribution Points: Click **Next** +- Click **Next** and then click **Close**. + +### Verify the backup + +1. On PC1, open the Configuration Manager control panel applet by typing the following command in a command prompt: + + ```dos + control smscfgrc + ``` + +2. On the **Actions** tab, click **Machine Policy Retrieval & Evaluation Cycle**, click **Run Now**, click **OK**, and then click **OK** again. This is one method that can be used to run a task sequence in addition to the Client Notification method that will be demonstrated in the computer refresh procedure. + +3. Type the following at an elevated command prompt to open the Software Center: + + ```dos + C:\Windows\CCM\SCClient.exe + ``` + +4. In the Software Center , click **Available Software** and then select the **Replace Task Sequence** checkbox. See the following example: + + ![software](images/configmgr-software-cntr.png) + + >If you do not see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available. + +5. Click **INSTALL SELECTED** and then click **INSTALL OPERATING SYSTEM**. +6. Allow the **Replace Task Sequence** to complete, then verify that the C:\MigData folder on SRV1 contains the USMT backup. + +### Deploy the new computer + +1. Start PC4 and press ENTER for a network boot when prompted. To start PC4, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + + ```powershell + Start-VM PC4 + vmconnect localhost PC4 + ``` + +1. In the **Welcome to the Task Sequence Wizard**, enter **pass@word1** and click **Next**. +1. Choose the **Windows 10 Enterprise X64** image. +1. Setup will install the operating system using the Windows 10 Enterprise x64 reference image, install the configuration manager client, join PC4 to the domain, and restore users and settings from PC1. +1. Save checkpoints for all VMs if you wish to review their status at a later date. This is not required (checkpoints do take up space on the Hyper-V host). Note: the next procedure will install a new OS on PC1 update its status in Configuration Manager and in Active Directory as a Windows 10 device, so you cannot return to a previous checkpoint only on the PC1 VM without a conflict. Therefore, if you do create a checkpoint, you should do this for all VMs. + + To save a checkpoint for all VMs, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + + ```powershell + Checkpoint-VM -Name DC1 -SnapshotName cm-refresh + Checkpoint-VM -Name SRV1 -SnapshotName cm-refresh + Checkpoint-VM -Name PC1 -SnapshotName cm-refresh + ``` + +## Refresh a client with Windows 10 using Configuration Manager + +### Initiate the computer refresh + +1. On SRV1, in the Assets and Compliance workspace, click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. +2. Right-click the computer account for PC1, point to **Client Notification**, click **Download Computer Policy**, and click **OK** in the popup dialog box. +3. On PC1, in the notification area, click **New software is available** and then click **Open Software Center**. +4. In the Software Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: + + ![installOS](images/configmgr-install-os.png) + + The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then click **More Details**. Click the **Status** tab to see a list of tasks that have been performed. See the following example: + + ![asset](images/configmgr-asset.png) + + You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. + + When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise operating system. + + ![post-refresh](images/configmgr-post-refresh.png) + +## Related Topics + +[System Center 2012 Configuration Manager Survival Guide](https://social.technet.microsoft.com/wiki/contents/articles/7075.system-center-2012-configuration-manager-survival-guide.aspx#Step-by-Step_Guides) diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index b12b80110d..9d18365b39 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -1,1106 +1,1115 @@ ---- -title: Configure a test lab to deploy Windows 10 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -description: Concepts and procedures for deploying Windows 10 in a proof of concept lab environment. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -keywords: deployment, automate, tools, configure, mdt, sccm -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Step by step guide: Configure a test lab to deploy Windows 10 - -**Applies to** - -- Windows 10 - -This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: - -- [Step by step: Deploy Windows 10 in a test lab using MDT](windows-10-poc-mdt.md)
              -- [Step by step: Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md)
              - -The PoC deployment guides are intended to provide a demonstration of Windows 10 deployment tools and processes for IT professionals that are not familiar with these tools, and those that are interested in setting up a proof of concept environment. The instructions in this guide should not be used in a production setting, and are not meant to replace the instructions found in production deployment guidance. - -Approximately 3 hours are required to configure the PoC environment. You will need a Hyper-V capable computer running Windows 8.1 or later with at least 16GB of RAM. Detailed [requirements](#hardware-and-software-requirements) are provided below. You will also need to have a [Microsoft account](https://www.microsoft.com/account) to use for downloading evaluation software. - -Windows PowerShell commands are provided to set up the PoC environment quickly. You do not need to be an expert in Windows PowerShell to complete the steps in the guide, however you are required to customize some commands to your environment. - -> Instructions to "type" Windows PowerShell commands provided in this guide can be followed literally by typing the commands, but the preferred method is to copy and paste these commands. -> -> A Windows PowerShell window can be used to run all commands in this guide. However, when commands are specified for a command prompt, you must either type CMD at the Windows PowerShell prompt to enter the command prompt, or preface the command with "cmd /c", or if desired you can escape special characters in the command using the back-tick character (`). In most cases, the simplest thing is to type cmd and enter a command prompt, type the necessary commands, then type "exit" to return to Windows PowerShell. - -Hyper-V is installed, configured and used extensively in this guide. If you are not familiar with Hyper-V, review the [terminology](#appendix-b-terminology-used-in-this-guide) used in this guide before starting. - -## In this guide - -This guide contains instructions for three general procedures: Install Hyper-V, configure Hyper-V, and configure VMs. If you already have a computer running Hyper-V, you can use this computer and skip the first procedure. In this case, your virtual switch settings must be modified to match those used in this guide, or the steps in this guide can be modified to use your existing Hyper-V settings. - -After completing the instructions in this guide, you will have a PoC environment that enables you to test Windows 10 deployment procedures by following instructions in companion guides that are written to use the PoC environment. Links are provided to download trial versions of Windows Server 2012, Windows 10 Enterprise, and all deployment tools necessary to complete the lab. - -Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. - -
              - -
              - - - -
              TopicDescriptionTime
              Hardware and software requirementsPrerequisites to complete this guide.Informational -
              Lab setupA description and diagram of the PoC environment.Informational -
              Configure the PoC environmentParent topic for procedures.Informational -
              Verify support and install Hyper-VVerify that installation of Hyper-V is supported, and install the Hyper-V server role.10 minutes -
              Download VHD and ISO filesDownload evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.30 minutes -
              Convert PC to VMConvert a physical computer on your network to a VM hosted in Hyper-V.30 minutes -
              Resize VHDIncrease the storage capacity for one of the Windows Server VMs.5 minutes -
              Configure Hyper-VCreate virtual switches, determine available RAM for virtual machines, and add virtual machines.15 minutes -
              Configure service and user accountsStart virtual machines and configure all services and settings.60 minutes -
              Configure VMsStart virtual machines and configure all services and settings.60 minutes -
              Appendix A: Verify the configurationVerify and troubleshoot network connectivity and services in the PoC environment.30 minutes -
              Appendix B: Terminology in this guideTerms used in this guide.Informational -
              -
              - -## Hardware and software requirements - -One computer that meets the hardware and software specifications below is required to complete the guide; A second computer is recommended to validate the upgrade process. - -- **Computer 1**: the computer you will use to run Hyper-V and host virtual machines. This computer should have 16 GB or more of installed RAM and a multi-core processor. -- **Computer 2**: a client computer from your corporate network. It is shadow-copied to create a VM that can be added to the PoC environment, enabling you to test a mirror image of a computer on your network. If you do not have a computer to use for this simulation, you can download an evaluation VHD and use it to represent this computer. Subsequent guides use this computer to simulate Windows 10 replace and refresh scenarios, so the VM is required even if you cannot create this VM using computer 2. - -Harware requirements are displayed below: - -
              - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Computer 1 (required)Computer 2 (recommended)
              RoleHyper-V hostClient computer
              DescriptionThis computer will run Hyper-V, the Hyper-V management tools, and the Hyper-V Windows PowerShell module.This computer is a Windows 7 or Windows 8/8.1 client on your corporate network that will be converted to a VM to demonstrate the upgrade process.
              OSWindows 8.1/10 or Windows Server 2012/2012 R2/2016*Windows 7 or a later
              EditionEnterprise, Professional, or EducationAny
              Architecture64-bitAny
              Note: Retaining applications and settings requires that architecture (32 or 64-bit) is the same before and after the upgrade.
              RAM8 GB RAM (16 GB recommended) to test Windows 10 deployment with MDT. -
              16 GB RAM to test Windows 10 deployment with System Center Configuration Manager.
              Any
              Disk200 GB available hard disk space, any format.Any size, MBR formatted.
              CPUSLAT-Capable CPUAny
              NetworkInternet connectionAny
              - - -\*The Hyper-V server role can also be installed on a computer running Windows Server 2008 R2. However, the Windows PowerShell module for Hyper-V is not available on Windows Server 2008 R2, therefore you cannot use many of the steps provided in this guide to configure Hyper-V. To manage Hyper-V on Windows Server 2008 R2, you can use Hyper-V WMI, or you can use the Hyper-V Manager console. Providing all steps in this guide as Hyper-V WMI or as 2008 R2 Hyper-V Manager procedures is beyond the scope of the guide. -
              -
              The Hyper-V role cannot be installed on Windows 7 or earlier versions of Windows. - -
              - -## Lab setup - -The lab architecture is summarized in the following diagram: - -![PoC](images/poc.png) - -- Computer 1 is configured to host four VMs on a private, PoC network. - - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. - - Two VMs are client systems: One VM is intended to mirror a host on your corporate network (computer 2) and one VM is running Windows 10 Enterprise to demonstrate the hardware replacement scenario. - ->If you have an existing Hyper-V host, you can use this host and skip the Hyper-V installation section in this guide. - -The two Windows Server VMs can be combined into a single VM to conserve RAM and disk space if required. However, instructions in this guide assume two server systems are used. Using two servers enables Active Directory Domain Services and DHCP to be installed on a server that is not directly connected to the corporate network. This mitigates the risk of clients on the corporate network receiving DHCP leases from the PoC network (i.e. "rogue" DHCP), and limits NETBIOS service broadcasts. - -## Configure the PoC environment - ->**Hint**: Before you begin, ensure that Windows PowerShell is pinned to the taskbar for easy access. If the Hyper-V host is running Windows Server then Windows PowerShell is automatically pinned to the taskbar. To pin Windows PowerShell to the taskbar on Windows 8.1 or Windows 10: Click **Start**, type **power**, right click **Windows PowerShell**, and then click **Pin to taskbar**. After Windows PowerShell is pinned to the taskbar, you can open an elevated Windows PowerShell prompt by right-clicking the icon on the taskbar and then clicking **Run as Administrator**. - -### Procedures in this section - -[Verify support and install Hyper-V](#verify-support-and-install-hyper-v)
              -[Download VHD and ISO files](#download-vhd-and-iso-files)
              -[Convert PC to VM](#convert-pc-to-vm)
              -[Resize VHD](#resize-vhd)
              -[Configure Hyper-V](#configure-hyper-v)
              -[Configure VMs](#configure-vms)
              - -### Verify support and install Hyper-V - -Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. - -1. To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: - -
              -    C:\>systeminfo
              -
              -    ...
              -    Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
              -                               Virtualization Enabled In Firmware: Yes
              -                               Second Level Address Translation: Yes
              -                               Data Execution Prevention Available: Yes
              -    
              - - In this example, the computer supports SLAT and Hyper-V. - - If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. - - You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example: - -
              -    C:\>coreinfo -v
              -
              -    Coreinfo v3.31 - Dump information on system CPU and memory topology
              -    Copyright (C) 2008-2014 Mark Russinovich
              -    Sysinternals - www.sysinternals.com
              -
              -    Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
              -    Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
              -    Microcode signature: 0000001B
              -    HYPERVISOR      -       Hypervisor is present
              -    VMX             *       Supports Intel hardware-assisted virtualization
              -    EPT             *       Supports Intel extended page tables (SLAT)
              -    
              - - Note: A 64-bit operating system is required to run Hyper-V. - -2. The Hyper-V feature is not installed by default. To install it, open an elevated Windows PowerShell window and type the following command: - -
              Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V –All
              - - This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. This command will also install Hyper-V if it isn't already installed, so if desired you can just type the following command on Windows Server 2012 or 2016 instead of using the Enable-WindowsOptionalFeature command: - -
              Install-WindowsFeature -Name Hyper-V -IncludeManagementTools
              - - When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. After installation is complete, you can open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt. - - >Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - - ![hyper-v feature](images/hyper-v-feature.png) - - ![hyper-v](images/svr_mgr2.png) - -

              If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. - -### Download VHD and ISO files - -When you have completed installation of Hyper-V on the host computer, begin configuration of Hyper-V by downloading VHD and ISO files to the Hyper-V host. These files will be used to create the VMs used in the lab. Before you can download VHD and ISO files, you will need to register and sign in to the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter/) using your Microsoft account. - -1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory. - - **Important**: This guide assumes that VHDs are stored in the **C:\VHD** directory on the Hyper-V host. If you use a different directory to store VHDs, you must adjust steps in this guide appropriately. - - After completing registration you will be able to download the 7.47 GB Windows Server 2012 R2 evaluation VHD. An example of the download offering is shown below. - - - -
              VHD
              - -2. Download the file to the **C:\VHD** directory. When the download is complete, rename the VHD file that you downloaded to **2012R2-poc-1.vhd**. This is done to make the filename simple to recognize and type. -3. Copy the VHD to a second file also in the **C:\VHD** directory and name this VHD **2012R2-poc-2.vhd**. -4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host. - - >During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. **Note: The evaluation version of Windows 10 does not support in-place upgrade**. - -5. Rename the ISO file that you downloaded to **w10-enterprise.iso**. Again, this is done so that the filename is simple to type and recognize. After completing registration you will be able to download the 3.63 GB Windows 10 Enterprise evaluation ISO. - -After completing these steps, you will have three files in the **C:\VHD** directory: **2012R2-poc-1.vhd**, **2012R2-poc-2.vhd**, **w10-enterprise.iso**. - -The following displays the procedures described in this section, both before and after downloading files: - -

              -C:>mkdir VHD
              -C:>cd VHD
              -C:\VHD>ren 9600*.vhd 2012R2-poc-1.vhd
              -C:\VHD>copy 2012R2-poc-1.vhd 2012R2-poc-2.vhd
              -   1 file(s) copied.
              -C:\VHD ren *.iso w10-enterprise.iso
              -C:\VHD>dir /B
              -2012R2-poc-1.vhd
              -2012R2-poc-2.vhd
              -w10-enterprise.iso
              -
              - -### Convert PC to VM - ->Important: Do not attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, do not start the VM outside the PoC network. - -
              -If you do not have a PC available to convert to VM, perform the following steps to download an evaluation VM: -
              -
                -
              1. Open the Download virtual machines page. -
              2. Under Virtual machine, choose IE11 on Win7. -
              3. Under Select platform choose HyperV (Windows). -
              4. Click Download .zip. The download is 3.31 GB. -
              5. Extract the zip file. Three directories are created. -
              6. Open the Virtual Hard Disks directory and then copy IE11 - Win7.vhd to the C:\VHD directory. -
              7. Rename IE11 - Win7.vhd to w7.vhd (do not rename the file to w7.vhdx). -
              8. In step 5 of the Configure Hyper-V section, replace the VHD file name w7.vhdx with w7.vhd. -
              -
              - -If you have a PC available to convert to VM (computer 2): - -1. Sign in on computer 2 using an account with Administrator privileges. - ->Important: the account used in this step must have local administrator privileges. You can use a local computer account, or a domain account with administrative rights if domain policy allows the use of cached credentials. After converting the computer to a VM, you must be able to sign in on this VM with administrator rights while the VM is disconnected from the corporate network. - -2. [Determine the VM generation and partition type](#determine-the-vm-generation-and-partition-type) that is required. -3. Based on the VM generation and partition type, perform one of the following procedures: [Prepare a generation 1 VM](#prepare-a-generation-1-vm), [Prepare a generation 2 VM](#prepare-a-generation-2-vm), or [prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk). - -#### Determine the VM generation and partition type - -When creating a VM in Hyper-V, you must specify either generation 1 or generation 2. The following table describes requirements for these two types of VMs. - -
              - - - - - - - - - - - - - - - - - - - - -
              ArchitectureOperating systemPartition style
              Generation 132-bit or 64-bitWindows 7 or laterMBR
              Generation 264-bitWindows 8 or laterMBR or GPT
              - -
              - -If the PC is running a 32-bit OS or the OS is Windows 7, it must be converted to a generation 1 VM. Otherwise, it can be converted to a generation 2 VM. - -- To determine the OS and architecture of a PC, type **systeminfo** at a command prompt and review the output next to **OS Name** and **System Type**. -- To determine the partition style, open a Windows PowerShell prompt on the PC and type the following command: - -
              -Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
              -
              - -If the **Type** column does not indicate GPT, then the disk partition format is MBR ("Installable File System" = MBR). In the following example, the disk is GPT: - -
              -PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
              -
              -SystemName                           Caption                                 Type
              -----------                           -------                                 ----
              -USER-PC1                             Disk #0, Partition #0                   GPT: System
              -USER-PC1                             Disk #0, Partition #1                   GPT: Basic Data
              -
              - -On a computer running Windows 8 or later, you can also type **Get-Disk** at a Windows PowerShell prompt to discover the partition style. The default output of this cmdlet displays the partition style for all attached disks. Both commands are displayed below. In this example, the client computer is running Windows 8.1 and uses a GPT style partition format: - -
              -PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
              -
              -SystemName                            Caption                               Type
              -----------                            -------                               ----
              -PC-X1                                 Disk #0, Partition #0                 GPT: Unknown
              -PC-X1                                 Disk #0, Partition #1                 GPT: System
              -PC-X1                                 Disk #0, Partition #2                 GPT: Basic Data
              -PC-X1                                 Disk #0, Partition #3                 GPT: Basic Data
              -PC-X1                                 Disk #0, Partition #4                 GPT: Basic Data
              -
              -PS C:> Get-Disk
              -
              -Number Friendly Name                  OperationalStatus                     Total Size Partition Style
              ------- -------------                  -----------------                     ---------- ---------------
              -0      INTEL SSDSCMMW240A3L           Online                                223.57 GB GPT
              -
              - - - -**Choosing a VM generation** - -The following table displays the Hyper-V VM generation to choose based on the OS, architecture, and partition style. Links to procedures to create the corresponding VMs are included. - -
              - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              OSPartition styleArchitectureVM generationProcedure
              Windows 7MBR321Prepare a generation 1 VM
              641Prepare a generation 1 VM
              GPT32N/AN/A
              641Prepare a generation 1 VM from a GPT disk
              Windows 8 or laterMBR321Prepare a generation 1 VM
              641, 2Prepare a generation 1 VM
              GPT321Prepare a generation 1 VM from a GPT disk
              642Prepare a generation 2 VM
              - -
              - -Notes:
              -
                -
              • If the PC is running Windows 7, it can only be converted and hosted in Hyper-V as a generation 1 VM. This Hyper-V requirement means that if the Windows 7 PC is also using a GPT partition style, the OS disk can be shadow copied, but a new system partition must be created. In this case, see Prepare a generation 1 VM from a GPT disk. -
              • If the PC is running Windows 8 or later and uses the GPT partition style, you can capture the disk image and create a generation 2 VM. To do this, you must temporarily mount the EFI system partition which is accomplished using the mountvol command. In this case, see Prepare a generation 2 VM. -
              • If the PC is using an MBR partition style, you can convert the disk to VHD and use it to create a generation 1 VM. If you use the Disk2VHD tool described in this guide, it is not necessary to mount the MBR system partition, but it is still necessary to capture it. In this case, see Prepare a generation 1 VM. -
              - -#### Prepare a generation 1 VM - -1. Download the [Disk2vhd utility](https://technet.microsoft.com/library/ee656415.aspx), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. - - >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. - -2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. -3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). -4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example: - - ![disk2vhd](images/disk2vhd.png) - - >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. - -5. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHDX file (w7.vhdx) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: - -
              -    C:\vhd>dir /B
              -    2012R2-poc-1.vhd
              -    2012R2-poc-2.vhd
              -    w10-enterprise.iso
              -    w7.VHDX
              -    
              - -#### Prepare a generation 2 VM - -1. Download the [Disk2vhd utility](https://technet.microsoft.com/library/ee656415.aspx), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. - - >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. - -2. On the computer you wish to convert, open an elevated command prompt and type the following command: - -
              mountvol s: /s
              - - This command temporarily assigns a drive letter of S to the system volume and mounts it. If the letter S is already assigned to a different volume on the computer, then choose one that is available (ex: mountvol z: /s). - -3. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. -4. Select the checkboxes next to the **C:\\** and the **S:\\** volumes, and clear the **Use Volume Shadow Copy checkbox**. Volume shadow copy will not work if the EFI system partition is selected. - - **Important**: You must include the EFI system partition in order to create a bootable VHD. The Windows RE tools partition (shown below) is not required, but it can also be converted if desired. - -5. Specify a location to save the resulting VHD or VHDX file (F:\VHD\PC1.vhdx in the following example) and click **Create**. See the following example: - - ![disk2vhd](images/disk2vhd-gen2.png) - - >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. - -6. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHDX file (PC1.vhdx) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: - -
              -    C:\vhd>dir /B
              -    2012R2-poc-1.vhd
              -    2012R2-poc-2.vhd
              -    w10-enterprise.iso
              -    PC1.VHDX
              -    
              - -#### Prepare a generation 1 VM from a GPT disk - -1. Download the [Disk2vhd utility](https://technet.microsoft.com/library/ee656415.aspx), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. - - >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. - -2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. -3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later. -4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example: - - ![disk2vhd](images/disk2vhd4.png) - - >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. - -5. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHD file (w7.vhd) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: - -
              -    C:\vhd>dir /B
              -    2012R2-poc-1.vhd
              -    2012R2-poc-2.vhd
              -    w10-enterprise.iso
              -    w7.VHD
              -    
              - - >In its current state, the w7.VHD file is not bootable. The VHD will be used to create a bootable VM later in the [Configure Hyper-V](#configure-hyper-v) section. - -### Resize VHD - -
              -Enhanced session mode - -**Important**: Before proceeding, verify that you can take advantage of [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) when completing instructions in this guide. Enhanced session mode enables you to copy and paste the commands from the Hyper-V host to VMs, between VMs, and between RDP sessions. After copying some text, you can paste into a Windows PowerShell window by simply right-clicking. Before right-clicking, do not left click other locations as this can empty the clipboard. You can also copy and paste files directly from one computer to another by right-clicking and selecting copy on one computer, then right-clicking and selecting paste on another computer. - -To ensure that enhanced session mode is enabled on the Hyper-V host, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - -
              Set-VMhost -EnableEnhancedSessionMode $TRUE
              - ->If enhanced session mode was not previously enabled, close any existing virtual machine connections and re-open them to enable access to enhanced session mode. As mentioned previously: instructions to "type" commands provided in this guide can be typed, but the preferred method is to copy and paste these commands. Most of the commands to this point in the guide have been brief, but many commands in sections below are longer and more complex. - -
              - -The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 100GB to support installing imaging tools and storing OS images. - -1. To add available space for the partition, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - -
              -    Resize-VHD –Path c:\VHD\2012R2-poc-2.vhd –SizeBytes 100GB
              -    $x = (Mount-VHD –Path c:\VHD\2012R2-poc-2.vhd -passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
              -    Resize-Partition -DriveLetter $x -Size (Get-PartitionSupportedSize -DriveLetter $x).SizeMax
              -    
              - -2. Verify that the mounted VHD drive is resized to 100 GB, and then dismount the drive: - -
              -    Get-Volume -DriveLetter $x
              -    Dismount-VHD –Path c:\VHD\2012R2-poc-2.vhd
              - -### Configure Hyper-V - -1. Open an elevated Windows PowerShell window and type the following command to create two virtual switches named "poc-internal" and "poc-external": - - >If the Hyper-V host already has an external virtual switch bound to a physical NIC, do not attempt to add a second external virtual switch. Attempting to add a second external switch will result in an error indicating that the NIC is **already bound to the Microsoft Virtual Switch protocol.** In this case, choose one of the following options:
              -    A) Remove the existing external virtual switch, then add the poc-external switch
              -    B) Rename the existing external switch to "poc-external"
              -    C) Replace each instance of "poc-external" used in this guide with the name of your existing external virtual switch
              - If you choose B) or C), then do not run the second command below. - -
              -    New-VMSwitch -Name poc-internal -SwitchType Internal -Notes "PoC Network"
              -    New-VMSwitch -Name poc-external -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name -Notes "PoC External"
              -    
              - - **Note**: The second command above will temporarily interrupt network connectivity on the Hyper-V host. - - >Since an external virtual switch is associated to a physical network adapter on the Hyper-V host, this adapter must be specified when adding the virtual switch. The previous commands automate this by filtering for active non-virtual ethernet adapters using the Get-NetAdapter cmdlet ($_.Status -eq "Up" -and !$_.Virtual). If your Hyper-V host is dual-homed with multiple active ethernet adapters, this automation will not work, and the second command above will fail. In this case, you must edit the command used to add the "poc-external" virtual switch by inserting the appropriate NetAdapterName. The NetAdapterName value corresponds to the name of the network interface you wish to use. For example, if the network interface you use on the Hyper-V host to connect to the Internet is named "Ethernet 2" then type the following command to create an external virtual switch: New-VMSwitch -Name poc-external -NetAdapterName "Ethernet 2" -Notes "PoC External" - -2. At the elevated Windows PowerShell prompt, type the following command to determine the megabytes of RAM that are currently available on the Hyper-V host: - -
              -    (Get-VMHostNumaNode).MemoryAvailable
              -    
              - - This command will display the megabytes of RAM available for VMs. On a Hyper-V host computer with 16 GB of physical RAM installed, 10,000 MB of RAM or greater should be available if the computer is not also running other applications. On a computer with 8 GB of physical RAM installed, at least 4000 MB should be available. If the computer has less RAM available than this, try closing applications to free up more memory. - -3. Determine the available memory for VMs by dividing the available RAM by 4. For example: - -
              -    (Get-VMHostNumaNode).MemoryAvailable/4
              -    2775.5
              -    
              - - In this example, VMs can use a maximum of 2700 MB of RAM each, to run four VMs simultaneously. - -4. At the elevated Windows PowerShell prompt, type the following command to create two new VMs. Other VMs will be added later. - >**Important**: Replace the value of 2700MB for $maxRAM in the first command below with the RAM value that you calculated in the previous step. - -
              -    $maxRAM = 2700MB
              -    New-VM -Name "DC1" -VHDPath c:\vhd\2012R2-poc-1.vhd -SwitchName poc-internal
              -    Set-VMMemory -VMName "DC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              -    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName DC1
              -    New-VM -Name "SRV1" -VHDPath c:\vhd\2012R2-poc-2.vhd -SwitchName poc-internal
              -    Add-VMNetworkAdapter -VMName "SRV1" -SwitchName "poc-external"
              -    Set-VMMemory -VMName "SRV1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 80
              -    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName SRV1
              -    
              - - **Note**: The RAM values assigned to VMs in this step are not permanent, and can be easily increased or decreased later if needed to address performance issues. - -5. Using the same elevated Windows PowerShell prompt that was used in the previous step, type one of the following sets of commands, depending on the type of VM that was prepared in the [Determine VM generation](#determine-vm-generation) section, either generation 1, generation 2, or generation 1 with GPT. - - To create a generation 1 VM (using c:\vhd\w7.vhdx): - -
              -    New-VM -Name "PC1" -VHDPath c:\vhd\w7.vhdx -SwitchName poc-internal
              -    Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              -    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
              -    
              - - To create a generation 2 VM (using c:\vhd\PC1.vhdx): - -
              -    New-VM -Name "PC1" -Generation 2 -VHDPath c:\vhd\PC1.vhdx -SwitchName poc-internal
              -    Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              -    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
              -    
              - - To create a generation 1 VM from a GPT disk (using c:\vhd\w7.vhd): - - >Note: The following procedure is more complex because it includes steps to convert the OS partition from GPT to MBR format. Steps are included to create a temporary VHD and attach it to the VM, the OS image is saved to this drive, the OS drive is then reformatted to MBR, the OS image restored, and the temporary drive is removed. - - First, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to create a temporary VHD that will be used to save the OS image. Do not forget to include a pipe (|) at the end of the first five commands: - -
              -    New-VHD -Path c:\vhd\d.vhd -SizeBytes 1TB |
              -    Mount-VHD -Passthru |
              -    Get-Disk -Number {$_.DiskNumber} |
              -    Initialize-Disk -PartitionStyle MBR -PassThru |
              -    New-Partition -UseMaximumSize |
              -    Format-Volume -Confirm:$false -FileSystem NTFS -force
              -    Dismount-VHD -Path c:\vhd\d.vhd
              -    
              - - Next, create the PC1 VM with two attached VHDs, and boot to DVD ($maxram must be defined previously using the same Windows PowerShell promt): - -
              -    New-VM -Name "PC1" -VHDPath c:\vhd\w7.vhd -SwitchName poc-internal
              -    Add-VMHardDiskDrive -VMName PC1 -Path c:\vhd\d.vhd
              -    Set-VMDvdDrive -VMName PC1 -Path c:\vhd\w10-enterprise.iso
              -    Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              -    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
              -    Start-VM PC1
              -    vmconnect localhost PC1
              -    
              - - The VM will automatically boot into Windows Setup. In the PC1 window: - - 1. Click **Next**. - 2. Click **Repair your computer**. - 3. Click **Troubleshoot**. - 4. Click **Command Prompt**. - 5. Type the following command to save an image of the OS drive: - -
              -      dism /Capture-Image /ImageFile:D:\c.wim /CaptureDir:C:\ /Name:Drive-C
              -      
              - - 6. Wait for the OS image to complete saving, and then type the following commands to convert the C: drive to MBR: - -
              -      diskpart
              -      select disk 0
              -      clean
              -      convert MBR
              -      create partition primary size=100
              -      format fs=ntfs quick
              -      active
              -      create partition primary
              -      format fs=ntfs quick label=OS
              -      assign letter=c
              -      exit
              -      
              - - 7. Type the following commands to restore the OS image and boot files: - -
              -      dism /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\
              -      bcdboot c:\windows
              -      exit
              -      
              - - 8. Click **Continue** and verify the VM boots successfully (do not boot from DVD). - 9. Click **Ctrl+Alt+Del**, and then in the bottom right corner, click **Shut down**. - 10. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to remove the temporary disks and drives from PC1: - -
              -       Remove-VMHardDiskDrive -VMName PC1 -ControllerType IDE -ControllerNumber 0 -ControllerLocation 1
              -       Set-VMDvdDrive -VMName PC1 -Path $null
              -       
              - -### Configure VMs - -1. At an elevated Windows PowerShell prompt on the Hyper-V host, start the first Windows Server VM and connect to it by typing the following commands: - -
              -    Start-VM DC1
              -    vmconnect localhost DC1
              -    
              - -2. Click **Next** to accept the default settings, read the license terms and click **I accept**, provide an administrator password of pass@word1, and click **Finish**. -3. Click **Ctrl+Alt+Del** in the upper left corner of the virtual machine connection window, and then sign in to DC1 using the Administrator account. -4. Right-click **Start**, point to **Shut down or sign out**, and click **Sign out**. The VM connection will reset and a new connection dialog box will appear enabling you to choose a custom display configuration. Select a desktop size, click **Connect** and sign in again with the local Administrator account. Note: Signing in this way ensures that [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) is enabled. It is only necessary to do this the first time you sign in to a new VM. -5. If DC1 is configured as described in this guide, it will currently be assigned an APIPA address, have a randomly generated hostname, and a single network adapter named "Ethernet." Open an elevated Windows PowerShell prompt on DC1 and type or paste the following commands to provide a new hostname and configure a static IP address and gateway: - -
              -    Rename-Computer DC1
              -    New-NetIPAddress –InterfaceAlias Ethernet –IPAddress 192.168.0.1 –PrefixLength 24 -DefaultGateway 192.168.0.2
              -    Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
              -    
              - - > The default gateway at 192.168.0.2 will be configured later in this guide. - > - > Note: A list of available tasks for an app will be populated the first time you run it on the taskbar. Because these tasks aren't available until the App has been run, you will not see the **Run as Administrator** task until you have left-clicked Windows PowerShell for the first time. In this newly created VM, you will need to left-click Windows PowerShell one time, and then you can right-click and choose Run as Administrator to open an elevated Windows PowerShell prompt. - -6. Install the Active Directory Domain Services role by typing the following command at an elevated Windows PowerShell prompt: - -
              -    Install-WindowsFeature -Name AD-Domain-Services -IncludeAllSubFeature -IncludeManagementTools
              -    
              - -7. Before promoting DC1 to a Domain Controller, you must reboot so that the name change in step 3 above takes effect. To restart the computer, type the following command at an elevated Windows PowerShell prompt: - -
              -    Restart-Computer
              -    
              - -8. When DC1 has rebooted, sign in again and open an elevated Windows PowerShell prompt. Now you can promote the server to be a domain controller. The directory services restore mode password must be entered as a secure string. Type the following commands at the elevated Windows PowerShell prompt: - -
              -    $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
              -    Install-ADDSForest -DomainName contoso.com -InstallDns -SafeModeAdministratorPassword $pass -Force
              -    
              - - Ignore any warnings that are displayed. The computer will automatically reboot upon completion. - -9. When the reboot has completed, reconnect to DC1, sign in using the CONTOSO\Administrator account, open an elevated Windows PowerShell prompt, and use the following commands to add a reverse lookup zone for the PoC network, add the DHCP Server role, authorize DHCP in Active Directory, and suppress the post-DHCP-install alert: - -
              -    Add-DnsServerPrimaryZone -NetworkID "192.168.0.0/24" -ReplicationScope Forest
              -    Add-WindowsFeature -Name DHCP -IncludeManagementTools
              -    netsh dhcp add securitygroups
              -    Restart-Service DHCPServer
              -    Add-DhcpServerInDC  dc1.contoso.com  192.168.0.1
              -    Set-ItemProperty –Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 –Name ConfigurationState –Value 2
              -    
              - -10. Next, add a DHCP scope and set option values: - -
              -    Add-DhcpServerv4Scope -Name "PoC Scope" -StartRange 192.168.0.100 -EndRange 192.168.0.199 -SubnetMask 255.255.255.0 -Description "Windows 10 PoC" -State Active
              -    Set-DhcpServerv4OptionValue -ScopeId 192.168.0.0 -DnsDomain contoso.com -Router 192.168.0.2 -DnsServer 192.168.0.1,192.168.0.2 -Force
              -    
              - - >The -Force option is necessary when adding scope options to skip validation of 192.168.0.2 as a DNS server because we have not configured it yet. The scope should immediately begin issuing leases on the PoC network. The first DHCP lease that will be issued is to vEthernet interface on the Hyper-V host, which is a member of the internal network. You can verify this by using the command: Get-DhcpServerv4Lease -ScopeId 192.168.0.0. - -11. The DNS server role will also be installed on the member server, SRV1, at 192.168.0.2 so that we can forward DNS queries from DC1 to SRV1 to resolve Internet names without having to configure a forwarder outside the PoC network. Since the IP address of SRV1 already exists on DC1's network adapter, it will be automatically added during the DCPROMO process. To verify this server-level DNS forwarder on DC1, type the following command at an elevated Windows PowerShell prompt on DC1: - -
              -    Get-DnsServerForwarder
              -    
              - - The following output should be displayed: - -
              -    UseRootHint        : True
              -    Timeout(s)         : 3
              -    EnableReordering   : True
              -    IPAddress          : 192.168.0.2
              -    ReorderedIPAddress : 192.168.0.2
              -    
              - - If this output is not displayed, you can use the following command to add SRV1 as a forwarder: - -
              -    Add-DnsServerForwarder -IPAddress 192.168.0.2
              -    
              - - **Configure service and user accounts** - - Windows 10 deployment with MDT and System Center Configuration Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire. - - >To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) - - On DC1, open an elevated Windows PowerShell prompt and type the following commands: - -
              -    New-ADUser -Name User1 -UserPrincipalName user1 -Description "User account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              -    New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              -    New-ADUser -Name CM_JD -UserPrincipalName CM_JD -Description "Configuration Manager Join Domain Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              -    New-ADUser -Name CM_NAA -UserPrincipalName CM_NAA -Description "Configuration Manager Network Access Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              -    Add-ADGroupMember "Domain Admins" MDT_BA,CM_JD,CM_NAA
              -    Set-ADUser -Identity user1 -PasswordNeverExpires $true
              -    Set-ADUser -Identity administrator -PasswordNeverExpires $true
              -    Set-ADUser -Identity MDT_BA -PasswordNeverExpires $true
              -    Set-ADUser -Identity CM_JD -PasswordNeverExpires $true
              -    Set-ADUser -Identity CM_NAA -PasswordNeverExpires $true
              -    
              - -12. Minimize the DC1 VM window but **do not stop** the VM. - - Next, the client VM will be started and joined to the contoso.com domain. This is done before adding a gateway to the PoC network so that there is no danger of duplicate DNS registrations for the physical client and its cloned VM in the corporate domain. - -13. If the PC1 VM is not started yet, using an elevated Windows PowerShell prompt on the Hyper-V host, start the client VM (PC1), and connect to it: - -
              -    Start-VM PC1
              -    vmconnect localhost PC1
              -    
              - -14. Sign in to PC1 using an account that has local administrator rights. - - >PC1 will be disconnected from its current domain, so you cannot use a domain account to sign on unless these credentials are cached and the use of cached credentials is permitted by Group Policy. If cached credentials are available and permitted, you can use these credentials to sign in. Otherwise, use an existing local administrator account. - -15. After signing in, the operating system detects that it is running in a new environment. New drivers will be automatically installed, including the network adapter driver. The network adapter driver must be updated before you can proceed, so that you will be able to join the contoso.com domain. Depending on the resources allocated to PC1, installing the network adapter driver might take a few minutes. You can monitor device driver installation by clicking **Show hidden icons** in the notification area. - - ![PoC](images/installing-drivers.png) - - >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. - -16. When the new network adapter driver has completed installation, you will receive an alert to set a network location for the contoso.com network. Select **Work network** and then click **Close**. When you receive an alert that a restart is required, click **Restart Later**. - -17. Open an elevated Windows PowerShell prompt on PC1 and verify that the client VM has received a DHCP lease and can communicate with the consoto.com domain controller. - - To open Windows PowerShell on Windows 7, click **Start**, and search for "**power**." Right-click **Windows PowerShell** and then click **Pin to Taskbar** so that it is simpler to use Windows Powershell during this lab. Click **Windows PowerShell** on the taskbar, and then type **ipconfig** at the prompt to see the client's current IP address. Also type **ping dc1.contoso.com** and **nltest /dsgetdc:contoso.com** to verify that it can reach the domain controller. See the following examples of a successful network connection: - - ``` - ipconfig - - Windows IP Configuration - - Ethernet adapter Local Area Connection 3: - Connection-specific DNS Suffix . : contoso.com - Link-local IPv6 Address . . . . . : fe80::64c2:4d2a:7403:6e02%18 - Ipv4 Address. . . . . . . . . . . : 192.168.0.101 - Subnet Mask . . . . . . . . . . . : 255.255.255.0 - Default Gateway . . . . . . . . . : 192.168.0.2 - - ping dc1.contoso.com - - Pinging dc1.contoso.com [192.168.0.1] with 32 bytes of data: - Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 - Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 - Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 - Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 - - nltest /dsgetdc:contoso.com - DC: \\DC1 - Address: \\192.168.0.1 - Dom Guid: fdbd0643-d664-411b-aea0-fe343d7670a8 - Dom Name: CONTOSO - Forest Name: contoso.com - Dc Site Name: Default-First-Site-Name - Our Site Name: Default-First-Site-Name - Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_FOREST CLOSE_SITE FULL_SECRET WS 0xC000 - ``` - - >If PC1 is running Windows 7, enhanced session mode might not be available, which means that you cannot copy and paste commands from the Hyper-V host to a Windows PowerShell prompt on PC1. However, it is possible to use integration services to copy a file from the Hyper-V host to a VM. The next procedure demonstrates this. If the Copy-VMFile command fails, then type the commands below at an elevated Windows PowerShell prompt on PC1 instead of saving them to a script to run remotely. If PC1 is running Windows 8 or a later operating system, you can use enhanced session mode to copy and paste these commands instead of typing them. - -18. Minimize the PC1 window and switch to the Hyper-V host computer. Open an elevated Windows PowerShell ISE window on the Hyper-V host (right-click Windows PowerShell and then click **Run ISE as Administrator**) and type the following commands in the (upper) script editor pane: - -
              -    (Get-WmiObject Win32_ComputerSystem).UnjoinDomainOrWorkgroup($null,$null,0)
              -    $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
              -    $user = "contoso\administrator"
              -    $cred = New-Object System.Management.Automation.PSCredential($user,$pass)
              -    Add-Computer -DomainName contoso.com -Credential $cred
              -    Restart-Computer
              -    
              - - >If you do not see the script pane, click **View** and verify **Show Script Pane Top** is enabled. Click **File** and then click **New**. - - See the following example: - - ![ISE](images/ISE.png) - -19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. -20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1: - -
              -    Enable-VMIntegrationService -VMName PC1 -Name "Guest Service Interface"
              -    Copy-VMFile "PC1" –SourcePath "C:\VHD\pc1.ps1"  –DestinationPath "C:\pc1.ps1" –CreateFullPath –FileSource Host
              -    
              - - >In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. - - If the copy-vmfile command does not work and you cannot properly enable or upgrade integration services on PC1, then create the file c:\pc1.ps1 on the VM by typing the commands into this file manually. The copy-vmfile command is only used in this procedure as a demonstration of automation methods that can be used in a Hyper-V environment when enhanced session mode is not available. After typing the script file manually, be sure to save the file as a Windows PowerShell script file with the .ps1 extension and not as a text (.txt) file. - -21. On PC1, type the following commands at an elevated Windows PowerShell prompt: - -
              -    Get-Content c:\pc1.ps1 | powershell.exe -noprofile -
              -    
              - - >The commands in this script might take a few moments to complete. If an error is displayed, check that you typed the command correctly, paying close attention to spaces. PC1 is removed from its domain in this step while not connected to the corporate network so as to ensure the computer object in the corporate domain is unaffected. PC1 is also not renamed to "PC1" in system properties so that it maintains some of its mirrored identity. However, if desired you can also rename the computer. - -22. Upon completion of the script, PC1 will automatically restart. When it has restarted, sign in to the contoso.com domain using the **Switch User** option, with the **user1** account you created in step 11 of this section. - >**Important**: The settings that will be used later to migrate user data specifically select only accounts that belong to the CONTOSO domain. However, this can be changed to migrate all user accounts, or only other specified accounts. If you wish to test migration of user data and settings with accounts other than those in the CONTOSO domain, you must specify these accounts or domains when you configure the value of **ScanStateArgs** in the MDT test lab guide. This value is specifically called out when you get to that step. If you wish to only migrate CONTOSO accounts, then you can log in with the user1 account or the administrator account at this time and modify some of the files and settings for later use in migration testing. -23. Minimize the PC1 window but do not turn it off while the second Windows Server 2012 R2 VM (SRV1) is configured. This verifies that the Hyper-V host has enough resources to run all VMs simultaneously. Next, SRV1 will be started, joined to the contoso.com domain, and configured with RRAS and DNS services. -24. On the Hyper-V host computer, at an elevated Windows PowerShell prompt, type the following commands: - -
              -    Start-VM SRV1
              -    vmconnect localhost SRV1
              -    
              - -25. Accept the default settings, read license terms and accept them, provide an administrator password of pass@word1, and click **Finish**. When you are prompted about finding PCs, devices, and content on the network, click **Yes**. -26. Sign in to SRV1 using the local administrator account. In the same way that was done on DC1, sign out of SRV1 and then sign in again to enable enhanced session mode. This will enable you to copy and paste Windows PowerShell commands from the Hyper-V host to the VM. -27. Open an elevated Windows PowerShell prompt on SRV1 and type the following commands: - -
              -    Rename-Computer SRV1
              -    New-NetIPAddress –InterfaceAlias Ethernet –IPAddress 192.168.0.2 –PrefixLength 24
              -    Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
              -    Restart-Computer
              -    
              - - >[!IMPORTANT] - >Verify that you are configuring the correct interface in this step. The commands in this step assume that the poc-internal interface on SRV1 is named "Ethernet." If you are unsure how to check the interface, see step #30 below for instructions and tips on how to verify and modify the interface name. - -28. Wait for the computer to restart, sign in again, then type the following commands at an elevated Windows PowerShell prompt: - -
              -    $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
              -    $user = "contoso\administrator"
              -    $cred = New-Object System.Management.Automation.PSCredential($user,$pass)
              -    Add-Computer -DomainName contoso.com -Credential $cred
              -    Restart-Computer
              -    
              - -29. Sign in to the contoso.com domain on SRV1 using the domain administrator account (enter contoso\administrator as the user), open an elevated Windows PowerShell prompt, and type the following commands: - -
              -    Install-WindowsFeature -Name DNS -IncludeManagementTools
              -    Install-WindowsFeature -Name WDS -IncludeManagementTools
              -    Install-WindowsFeature -Name Routing -IncludeManagementTools
              -    
              - -30. Before configuring the routing service that was just installed, verify that network interfaces were added to SRV1 in the right order, resulting in an interface alias of "Ethernet" for the private interface, and an interface alias of "Ethernet 2" for the public interface. Also verify that the external interface has a valid external DHCP IP address lease. - - To view a list of interfaces, associated interface aliases, and IP addresses on SRV1, type the following Windows PowerShell command. Example output of the command is also shown below: - -
              -    Get-NetAdapter | ? status -eq ‘up’ | Get-NetIPAddress -AddressFamily IPv4 | ft IPAddress, InterfaceAlias
              -
              -    IPAddress                                                                  InterfaceAlias
              -    ---------                                                                  --------------
              -    10.137.130.118                                                             Ethernet 2
              -    192.168.0.2                                                                Ethernet
              -    
              - - In this example, the poc-internal network interface at 192.168.0.2 is associated with the "Ethernet" interface and the Internet-facing poc-external interface is associated with the "Ethernet 2" interface. If your interfaces are different, you must adjust the commands provided in the next step appropriately to configure routing services. Also note that if the "Ethernet 2" interface has an IP address in the 192.168.0.100-105 range then it likely is getting a DHCP lease from DC1 instead of your corporate network. If this is the case, you can try removing and re-adding the second network interface from the SRV1 VM through its Hyper-V settings. - - >[!TIP] - >Sometimes a computer will have hidden, disconnected interfaces that prevent you from naming a network adapter. When you attempt to rename an adapter, you will receive an error that the adapter name already exists. These disconnected devices can be viewed in device manager by clicking **View** and then clicking **Show hidden devices**. The disconnected device can then be uninstalled, enabling you to reuse the adapter name. - - -31. To configure SRV1 with routing capability for the PoC network, type or paste the following commands at an elevated Windows PowerShell prompt on SRV1: - -
              -    Install-RemoteAccess -VpnType Vpn
              -    cmd /c netsh routing ip nat install
              -    cmd /c netsh routing ip nat add interface name="Ethernet 2" mode=FULL
              -    cmd /c netsh routing ip nat add interface name="Ethernet" mode=PRIVATE
              -    cmd /c netsh routing ip nat add interface name="Internal" mode=PRIVATE
              -    
              - -32. The DNS service on SRV1 also needs to resolve hosts in the contoso.com domain. This can be accomplished with a conditional forwarder. Open an elevated Windows PowerShell prompt on SRV1 and type the following command: - -
              -    Add-DnsServerConditionalForwarderZone -Name contoso.com -MasterServers 192.168.0.1
              -    
              - -33. In most cases, this completes configuration of the PoC network. However, if your corporate network has a firewall that filters queries from local DNS servers, you will also need to configure a server-level DNS forwarder on SRV1 to resolve Internet names. To test whether or not DNS is working without this forwarder, try to reach a name on the Internet from DC1 or PC1, which are only using DNS services on the PoC network. You can test DNS with the ping command, for example: - -
              -    ping www.microsoft.com
              -    
              - - If you see "Ping request could not find host www.microsoft.com" on PC1 and DC1, but not on SRV1, then you will need to configure a server-level DNS forwarder on SRV1. To do this, open an elevated Windows PowerShell prompt on SRV1 and type the following command. - - **Note**: This command also assumes that "Ethernet 2" is the external-facing network adapter on SRV1. If the external adapter has a different name, replace "Ethernet 2" in the command below with that name: - -
              -    Add-DnsServerForwarder -IPAddress (Get-DnsClientServerAddress -InterfaceAlias "Ethernet 2").ServerAddresses
              -    
              - -34. If DNS and routing are both working correctly, you will see the following on DC1 and PC1 (the IP address might be different, but that is OK): - -
              -    PS C:\> ping www.microsoft.com
              -
              -    Pinging e2847.dspb.akamaiedge.net [23.222.146.170] with 32 bytes of data:
              -    Reply from 23.222.146.170: bytes=32 time=3ms TTL=51
              -    Reply from 23.222.146.170: bytes=32 time=2ms TTL=51
              -    Reply from 23.222.146.170: bytes=32 time=2ms TTL=51
              -    Reply from 23.222.146.170: bytes=32 time=1ms TTL=51
              -
              -    Ping statistics for 23.222.146.170:
              -        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
              -    Approximate round trip times in milli-seconds:
              -        Minimum = 1ms, Maximum = 3ms, Average = 2ms
              -    
              - -35. Verify that all three VMs can reach each other, and the Internet. See [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration) for more information. -36. Lastly, because the client computer has different hardware after copying it to a VM, its Windows activation will be invalidated and you might receive a message that you must activate Windows in 3 days. To extend this period to 30 days, type the following commands at an elevated Windows PowerShell prompt on PC1: - -
              -    runas /noprofile /env /user:administrator@contoso.com "cmd /c slmgr -rearm"
              -    Restart-Computer
              -    
              - -This completes configuration of the starting PoC environment. Additional services and tools are installed in subsequent guides. - -## Appendix A: Verify the configuration - -Use the following procedures to verify that the PoC environment is configured properly and working as expected. - -1. On DC1, open an elevated Windows PowerShell prompt and type the following commands: - -
              -    Get-Service NTDS,DNS,DHCP
              -    DCDiag -a
              -    Get-DnsServerResourceRecord -ZoneName contoso.com -RRType A
              -    Get-DnsServerForwarder
              -    Resolve-DnsName -Server dc1.contoso.com -Name www.microsoft.com
              -    Get-DhcpServerInDC
              -    Get-DhcpServerv4Statistics
              -    ipconfig /all
              -    
              - - **Get-Service** displays a status of "Running" for all three services.
              - **DCDiag** displays "passed test" for all tests.
              - **Get-DnsServerResourceRecord** displays the correct DNS address records for DC1, SRV1, and the computername of PC1. Additional address records for the zone apex (@), DomainDnsZones, and ForestDnsZones will also be registered.
              - **Get-DnsServerForwarder** displays a single forwarder of 192.168.0.2.
              - **Resolve-DnsName** displays public IP address results for www.microsoft.com.
              - **Get-DhcpServerInDC** displays 192.168.0.1, dc1.contoso.com.
              - **Get-DhcpServerv4Statistics** displays 1 scope with 2 addresses in use (these belong to PC1 and the Hyper-V host).
              - **ipconfig** displays a primary DNS suffix and suffix search list of contoso.com, IP address of 192.168.0.1, subnet mask of 255.255.255.0, default gateway of 192.168.0.2, and DNS server addresses of 192.168.0.1 and 192.168.0.2. - -2. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: - -
              -    Get-Service DNS,RemoteAccess
              -    Get-DnsServerForwarder
              -    Resolve-DnsName -Server dc1.contoso.com -Name www.microsoft.com
              -    ipconfig /all
              -    netsh int ipv4 show address
              -    
              - - **Get-Service** displays a status of "Running" for both services.
              - **Get-DnsServerForwarder** either displays no forwarders, or displays a list of forwarders you are required to use so that SRV1 can resolve Internet names.
              - **Resolve-DnsName** displays public IP address results for www.microsoft.com.
              - **ipconfig** displays a primary DNS suffix of contoso.com. The suffix search list contains contoso.com and your corporate domain. Two ethernet adapters are shown: Ethernet adapter "Ethernet" has an IP addresses of 192.168.0.2, subnet mask of 255.255.255.0, no default gateway, and DNS server addresses of 192.168.0.1 and 192.168.0.2. Ethernet adapter "Ethernet 2" has an IP address, subnet mask, and default gateway configured by DHCP on your corporate network.
              - **netsh** displays three interfaces on the computer: interface "Ethernet 2" with DHCP enabled = Yes and IP address assigned by your corporate network, interface "Ethernet" with DHCP enabled = No and IP address of 192.168.0.2, and interface "Loopback Pseudo-Interface 1" with IP address of 127.0.0.1. - -3. On PC1, open an elevated Windows PowerShell prompt and type the following commands: - -
              -    whoami
              -    hostname
              -    nslookup www.microsoft.com
              -    ping -n 1 dc1.contoso.com
              -    tracert www.microsoft.com
              -    
              - - **whoami** displays the current user context, for example in an elevated Windows PowerShell prompt, contoso\administrator is displayed.
              - **hostname** displays the name of the local computer, for example W7PC-001.
              - **nslookup** displays the DNS server used for the query, and the results of the query. For example, server dc1.contoso.com, address 192.168.0.1, Name e2847.dspb.akamaiedge.net.
              - **ping** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it cannot be resolved, "..could not find host" will be diplayed and if the target is found and also responds to ICMP, you will see "Reply from" and the IP address of the target.
              - **tracert** displays the path to reach the destination, for example srv1.contoso.com [192.168.0.2] followed by a list of hosts and IP addresses corresponding to subsequent routing nodes between the source and the destination. - - -## Appendix B: Terminology used in this guide - -

                - -

              - - -
              TermDefinition -
              GPTGUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. -
              Hyper-VHyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8. -
              Hyper-V hostThe computer where Hyper-V is installed. -
              Hyper-V ManagerThe user-interface console used to view and configure Hyper-V. -
              MBRMaster Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format. -
              Proof of concept (PoC)Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process. -
              Shadow copyA copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes. -
              Virtual machine (VM)A VM is a virtual computer with its own operating system, running on the Hyper-V host. -
              Virtual switchA virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host. -
              VM snapshotA point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken. -
              - -
              - -## Related Topics - - -[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) - - - - - - - - +--- +title: Configure a test lab to deploy Windows 10 +description: In this article, you will learn about concepts and procedures for deploying Windows 10 in a proof of concept lab environment. +ms.custom: seo-marvel-apr2020 +ms.reviewer: +manager: laurawi +ms.audience: itpro +ms.author: greglin +author: greg-lindsay +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +keywords: deployment, automate, tools, configure, mdt, sccm +ms.localizationpriority: medium +audience: itpro +ms.topic: article +--- + +# Step by step guide: Configure a test lab to deploy Windows 10 + +**Applies to** + +- Windows 10 + +This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. + +> [!NOTE] +> Microsoft also offers a pre-configured lab using an evaluation version of Configuration Manager. For more information, see [Windows and Office deployment and management lab kit](/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab). + +This lab guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: + +- [Step by step: Deploy Windows 10 in a test lab using MDT](windows-10-poc-mdt.md)
              +- [Step by step: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md)
              + +The PoC deployment guides are intended to provide a demonstration of Windows 10 deployment tools and processes for IT professionals that are not familiar with these tools, and those that are interested in setting up a proof of concept environment. The instructions in this guide should not be used in a production setting, and are not meant to replace the instructions found in production deployment guidance. + +Approximately 3 hours are required to configure the PoC environment. You will need a Hyper-V capable computer running Windows 8.1 or later with at least 16GB of RAM. Detailed [requirements](#hardware-and-software-requirements) are provided below. You will also need to have a [Microsoft account](https://www.microsoft.com/account) to use for downloading evaluation software. + +Windows PowerShell commands are provided to set up the PoC environment quickly. You do not need to be an expert in Windows PowerShell to complete the steps in the guide, however you are required to customize some commands to your environment. + +> Instructions to "type" Windows PowerShell commands provided in this guide can be followed literally by typing the commands, but the preferred method is to copy and paste these commands. +> +> A Windows PowerShell window can be used to run all commands in this guide. However, when commands are specified for a command prompt, you must either type CMD at the Windows PowerShell prompt to enter the command prompt, or preface the command with "cmd /c", or if desired you can escape special characters in the command using the back-tick character (`). In most cases, the simplest thing is to type cmd and enter a command prompt, type the necessary commands, then type "exit" to return to Windows PowerShell. + +Hyper-V is installed, configured and used extensively in this guide. If you are not familiar with Hyper-V, review the [terminology](#appendix-b-terminology-used-in-this-guide) used in this guide before starting. + +## In this guide + +This guide contains instructions for three general procedures: Install Hyper-V, configure Hyper-V, and configure VMs. If you already have a computer running Hyper-V, you can use this computer and skip the first procedure. In this case, your virtual switch settings must be modified to match those used in this guide, or the steps in this guide can be modified to use your existing Hyper-V settings. + +After completing the instructions in this guide, you will have a PoC environment that enables you to test Windows 10 deployment procedures by following instructions in companion guides that are written to use the PoC environment. Links are provided to download trial versions of Windows Server 2012, Windows 10 Enterprise, and all deployment tools necessary to complete the lab. + +Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. + +
              + +
              + + + +
              TopicDescriptionTime
              Hardware and software requirementsPrerequisites to complete this guide.Informational +
              Lab setupA description and diagram of the PoC environment.Informational +
              Configure the PoC environmentParent topic for procedures.Informational +
              Verify support and install Hyper-VVerify that installation of Hyper-V is supported, and install the Hyper-V server role.10 minutes +
              Download VHD and ISO filesDownload evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.30 minutes +
              Convert PC to VMConvert a physical computer on your network to a VM hosted in Hyper-V.30 minutes +
              Resize VHDIncrease the storage capacity for one of the Windows Server VMs.5 minutes +
              Configure Hyper-VCreate virtual switches, determine available RAM for virtual machines, and add virtual machines.15 minutes +
              Configure service and user accountsStart virtual machines and configure all services and settings.60 minutes +
              Configure VMsStart virtual machines and configure all services and settings.60 minutes +
              Appendix A: Verify the configurationVerify and troubleshoot network connectivity and services in the PoC environment.30 minutes +
              Appendix B: Terminology in this guideTerms used in this guide.Informational +
              +
              + +## Hardware and software requirements + +One computer that meets the hardware and software specifications below is required to complete the guide; A second computer is recommended to validate the upgrade process. + +- **Computer 1**: the computer you will use to run Hyper-V and host virtual machines. This computer should have 16 GB or more of installed RAM and a multi-core processor. +- **Computer 2**: a client computer from your corporate network. It is shadow-copied to create a VM that can be added to the PoC environment, enabling you to test a mirror image of a computer on your network. If you do not have a computer to use for this simulation, you can download an evaluation VHD and use it to represent this computer. Subsequent guides use this computer to simulate Windows 10 replace and refresh scenarios, so the VM is required even if you cannot create this VM using computer 2. + +Hardware requirements are displayed below: + +
              + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              Computer 1 (required)Computer 2 (recommended)
              RoleHyper-V hostClient computer
              DescriptionThis computer will run Hyper-V, the Hyper-V management tools, and the Hyper-V Windows PowerShell module.This computer is a Windows 7 or Windows 8/8.1 client on your corporate network that will be converted to a VM to demonstrate the upgrade process.
              OSWindows 8.1/10 or Windows Server 2012/2012 R2/2016*Windows 7 or a later
              EditionEnterprise, Professional, or EducationAny
              Architecture64-bitAny
              Note: Retaining applications and settings requires that architecture (32 or 64-bit) is the same before and after the upgrade.
              RAM8 GB RAM (16 GB recommended) to test Windows 10 deployment with MDT. +
              16 GB RAM to test Windows 10 deployment with Microsoft Endpoint Configuration Manager.
              Any
              Disk200 GB available hard disk space, any format.Any size, MBR formatted.
              CPUSLAT-Capable CPUAny
              NetworkInternet connectionAny
              + + +\*The Hyper-V server role can also be installed on a computer running Windows Server 2008 R2. However, the Windows PowerShell module for Hyper-V is not available on Windows Server 2008 R2, therefore you cannot use many of the steps provided in this guide to configure Hyper-V. To manage Hyper-V on Windows Server 2008 R2, you can use Hyper-V WMI, or you can use the Hyper-V Manager console. Providing all steps in this guide as Hyper-V WMI or as 2008 R2 Hyper-V Manager procedures is beyond the scope of the guide. +
              +
              The Hyper-V role cannot be installed on Windows 7 or earlier versions of Windows. + +
              + +## Lab setup + +The lab architecture is summarized in the following diagram: + +![PoC diagram](images/poc.png) + +- Computer 1 is configured to host four VMs on a private, PoC network. + - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. + - Two VMs are client systems: One VM is intended to mirror a host on your corporate network (computer 2) and one VM is running Windows 10 Enterprise to demonstrate the hardware replacement scenario. + +>If you have an existing Hyper-V host, you can use this host and skip the Hyper-V installation section in this guide. + +The two Windows Server VMs can be combined into a single VM to conserve RAM and disk space if required. However, instructions in this guide assume two server systems are used. Using two servers enables Active Directory Domain Services and DHCP to be installed on a server that is not directly connected to the corporate network. This mitigates the risk of clients on the corporate network receiving DHCP leases from the PoC network (i.e. "rogue" DHCP), and limits NETBIOS service broadcasts. + +## Configure the PoC environment + +>**Hint**: Before you begin, ensure that Windows PowerShell is pinned to the taskbar for easy access. If the Hyper-V host is running Windows Server then Windows PowerShell is automatically pinned to the taskbar. To pin Windows PowerShell to the taskbar on Windows 8.1 or Windows 10: Click **Start**, type **power**, right click **Windows PowerShell**, and then click **Pin to taskbar**. After Windows PowerShell is pinned to the taskbar, you can open an elevated Windows PowerShell prompt by right-clicking the icon on the taskbar and then clicking **Run as Administrator**. + +### Procedures in this section + +[Verify support and install Hyper-V](#verify-support-and-install-hyper-v)
              +[Download VHD and ISO files](#download-vhd-and-iso-files)
              +[Convert PC to VM](#convert-pc-to-vm)
              +[Resize VHD](#resize-vhd)
              +[Configure Hyper-V](#configure-hyper-v)
              +[Configure VMs](#configure-vms)
              + +### Verify support and install Hyper-V + +Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. + +1. To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: + +
              +    C:\>systeminfo
              +
              +    ...
              +    Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
              +                               Virtualization Enabled In Firmware: Yes
              +                               Second Level Address Translation: Yes
              +                               Data Execution Prevention Available: Yes
              +    
              + + In this example, the computer supports SLAT and Hyper-V. + + If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. + + You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example: + +
              +    C:\>coreinfo -v
              +
              +    Coreinfo v3.31 - Dump information on system CPU and memory topology
              +    Copyright (C) 2008-2014 Mark Russinovich
              +    Sysinternals - www.sysinternals.com
              +
              +    Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
              +    Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
              +    Microcode signature: 0000001B
              +    HYPERVISOR      -       Hypervisor is present
              +    VMX             *       Supports Intel hardware-assisted virtualization
              +    EPT             *       Supports Intel extended page tables (SLAT)
              +    
              + + Note: A 64-bit operating system is required to run Hyper-V. + +2. The Hyper-V feature is not installed by default. To install it, open an elevated Windows PowerShell window and type the following command: + +
              Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All
              + + This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. This command will also install Hyper-V if it isn't already installed, so if desired you can just type the following command on Windows Server 2012 or 2016 instead of using the Enable-WindowsOptionalFeature command: + +
              Install-WindowsFeature -Name Hyper-V -IncludeManagementTools
              + + When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. After installation is complete, you can open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt. + + >Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: + + ![hyper-v features](images/hyper-v-feature.png) + + ![hyper-v](images/svr_mgr2.png) + +

              If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. + +### Download VHD and ISO files + +When you have completed installation of Hyper-V on the host computer, begin configuration of Hyper-V by downloading VHD and ISO files to the Hyper-V host. These files will be used to create the VMs used in the lab. Before you can download VHD and ISO files, you will need to register and sign in to the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter/) using your Microsoft account. + +1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory. + + **Important**: This guide assumes that VHDs are stored in the **C:\VHD** directory on the Hyper-V host. If you use a different directory to store VHDs, you must adjust steps in this guide appropriately. + + After completing registration you will be able to download the 7.47 GB Windows Server 2012 R2 evaluation VHD. An example of the download offering is shown below. + + + +
              VHD
              + +2. Download the file to the **C:\VHD** directory. When the download is complete, rename the VHD file that you downloaded to **2012R2-poc-1.vhd**. This is done to make the filename simple to recognize and type. +3. Copy the VHD to a second file also in the **C:\VHD** directory and name this VHD **2012R2-poc-2.vhd**. +4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host. + + >During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. **Note: The evaluation version of Windows 10 does not support in-place upgrade**. + +5. Rename the ISO file that you downloaded to **w10-enterprise.iso**. Again, this is done so that the filename is simple to type and recognize. After completing registration you will be able to download the 3.63 GB Windows 10 Enterprise evaluation ISO. + +After completing these steps, you will have three files in the **C:\VHD** directory: **2012R2-poc-1.vhd**, **2012R2-poc-2.vhd**, **w10-enterprise.iso**. + +The following displays the procedures described in this section, both before and after downloading files: + +

              +C:>mkdir VHD
              +C:>cd VHD
              +C:\VHD>ren 9600*.vhd 2012R2-poc-1.vhd
              +C:\VHD>copy 2012R2-poc-1.vhd 2012R2-poc-2.vhd
              +   1 file(s) copied.
              +C:\VHD ren *.iso w10-enterprise.iso
              +C:\VHD>dir /B
              +2012R2-poc-1.vhd
              +2012R2-poc-2.vhd
              +w10-enterprise.iso
              +
              + +### Convert PC to VM + +>Important: Do not attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, do not start the VM outside the PoC network. + +
              +If you do not have a PC available to convert to VM, perform the following steps to download an evaluation VM: +
              +
                +
              1. Open the Download virtual machines page. +
              2. Under Virtual machine, choose IE11 on Win7. +
              3. Under Select platform choose HyperV (Windows). +
              4. Click Download .zip. The download is 3.31 GB. +
              5. Extract the zip file. Three directories are created. +
              6. Open the Virtual Hard Disks directory and then copy IE11 - Win7.vhd to the C:\VHD directory. +
              7. Rename IE11 - Win7.vhd to w7.vhd (do not rename the file to w7.vhdx). +
              8. In step 5 of the Configure Hyper-V section, replace the VHD file name w7.vhdx with w7.vhd. +
              +
              + +If you have a PC available to convert to VM (computer 2): + +1. Sign in on computer 2 using an account with Administrator privileges. + +>Important: the account used in this step must have local administrator privileges. You can use a local computer account, or a domain account with administrative rights if domain policy allows the use of cached credentials. After converting the computer to a VM, you must be able to sign in on this VM with administrator rights while the VM is disconnected from the corporate network. + +2. [Determine the VM generation and partition type](#determine-the-vm-generation-and-partition-type) that is required. +3. Based on the VM generation and partition type, perform one of the following procedures: [Prepare a generation 1 VM](#prepare-a-generation-1-vm), [Prepare a generation 2 VM](#prepare-a-generation-2-vm), or [prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk). + +#### Determine the VM generation and partition type + +When creating a VM in Hyper-V, you must specify either generation 1 or generation 2. The following table describes requirements for these two types of VMs. + +
              + + + + + + + + + + + + + + + + + + + + +
              ArchitectureOperating systemPartition style
              Generation 132-bit or 64-bitWindows 7 or laterMBR
              Generation 264-bitWindows 8 or laterMBR or GPT
              + +
              + +If the PC is running a 32-bit OS or the OS is Windows 7, it must be converted to a generation 1 VM. Otherwise, it can be converted to a generation 2 VM. + +- To determine the OS and architecture of a PC, type **systeminfo** at a command prompt and review the output next to **OS Name** and **System Type**. +- To determine the partition style, open a Windows PowerShell prompt on the PC and type the following command: + +
              +Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
              +
              + +If the **Type** column does not indicate GPT, then the disk partition format is MBR ("Installable File System" = MBR). In the following example, the disk is GPT: + +
              +PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
              +
              +SystemName                           Caption                                 Type
              +----------                           -------                                 ----
              +USER-PC1                             Disk #0, Partition #0                   GPT: System
              +USER-PC1                             Disk #0, Partition #1                   GPT: Basic Data
              +
              + +On a computer running Windows 8 or later, you can also type **Get-Disk** at a Windows PowerShell prompt to discover the partition style. The default output of this cmdlet displays the partition style for all attached disks. Both commands are displayed below. In this example, the client computer is running Windows 8.1 and uses a GPT style partition format: + +
              +PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
              +
              +SystemName                            Caption                               Type
              +----------                            -------                               ----
              +PC-X1                                 Disk #0, Partition #0                 GPT: Unknown
              +PC-X1                                 Disk #0, Partition #1                 GPT: System
              +PC-X1                                 Disk #0, Partition #2                 GPT: Basic Data
              +PC-X1                                 Disk #0, Partition #3                 GPT: Basic Data
              +PC-X1                                 Disk #0, Partition #4                 GPT: Basic Data
              +
              +PS C:> Get-Disk
              +
              +Number Friendly Name                  OperationalStatus                     Total Size Partition Style
              +------ -------------                  -----------------                     ---------- ---------------
              +0      INTEL SSDSCMMW240A3L           Online                                223.57 GB GPT
              +
              + + + +**Choosing a VM generation** + +The following table displays the Hyper-V VM generation to choose based on the OS, architecture, and partition style. Links to procedures to create the corresponding VMs are included. + +
              + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
              OSPartition styleArchitectureVM generationProcedure
              Windows 7MBR321Prepare a generation 1 VM
              641Prepare a generation 1 VM
              GPT32N/AN/A
              641Prepare a generation 1 VM from a GPT disk
              Windows 8 or laterMBR321Prepare a generation 1 VM
              641, 2Prepare a generation 1 VM
              GPT321Prepare a generation 1 VM from a GPT disk
              642Prepare a generation 2 VM
              + +
              + +Notes:
              +
                +
              • If the PC is running Windows 7, it can only be converted and hosted in Hyper-V as a generation 1 VM. This Hyper-V requirement means that if the Windows 7 PC is also using a GPT partition style, the OS disk can be shadow copied, but a new system partition must be created. In this case, see Prepare a generation 1 VM from a GPT disk. +
              • If the PC is running Windows 8 or later and uses the GPT partition style, you can capture the disk image and create a generation 2 VM. To do this, you must temporarily mount the EFI system partition which is accomplished using the mountvol command. In this case, see Prepare a generation 2 VM. +
              • If the PC is using an MBR partition style, you can convert the disk to VHD and use it to create a generation 1 VM. If you use the Disk2VHD tool described in this guide, it is not necessary to mount the MBR system partition, but it is still necessary to capture it. In this case, see Prepare a generation 1 VM. +
              + +#### Prepare a generation 1 VM + +1. Download the [Disk2vhd utility](https://technet.microsoft.com/library/ee656415.aspx), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. + + >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. + +2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. +3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). +4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example: + + ![disk2vhd 1](images/disk2vhd.png) + + >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. + +5. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHDX file (w7.vhdx) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: + +
              +    C:\vhd>dir /B
              +    2012R2-poc-1.vhd
              +    2012R2-poc-2.vhd
              +    w10-enterprise.iso
              +    w7.VHDX
              +    
              + +#### Prepare a generation 2 VM + +1. Download the [Disk2vhd utility](https://technet.microsoft.com/library/ee656415.aspx), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. + + >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. + +2. On the computer you wish to convert, open an elevated command prompt and type the following command: + +
              mountvol s: /s
              + + This command temporarily assigns a drive letter of S to the system volume and mounts it. If the letter S is already assigned to a different volume on the computer, then choose one that is available (ex: mountvol z: /s). + +3. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. +4. Select the checkboxes next to the **C:\\** and the **S:\\** volumes, and clear the **Use Volume Shadow Copy checkbox**. Volume shadow copy will not work if the EFI system partition is selected. + + **Important**: You must include the EFI system partition in order to create a bootable VHD. The Windows RE tools partition (shown below) is not required, but it can also be converted if desired. + +5. Specify a location to save the resulting VHD or VHDX file (F:\VHD\PC1.vhdx in the following example) and click **Create**. See the following example: + + ![disk2vhd 2](images/disk2vhd-gen2.png) + + >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. + +6. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHDX file (PC1.vhdx) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: + +
              +    C:\vhd>dir /B
              +    2012R2-poc-1.vhd
              +    2012R2-poc-2.vhd
              +    w10-enterprise.iso
              +    PC1.VHDX
              +    
              + +#### Prepare a generation 1 VM from a GPT disk + +1. Download the [Disk2vhd utility](https://technet.microsoft.com/library/ee656415.aspx), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. + + >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. + +2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. +3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later. +4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example: + + ![disk2vhd 3](images/disk2vhd4.png) + + >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. + +5. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHD file (w7.vhd) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: + +
              +    C:\vhd>dir /B
              +    2012R2-poc-1.vhd
              +    2012R2-poc-2.vhd
              +    w10-enterprise.iso
              +    w7.VHD
              +    
              + + >In its current state, the w7.VHD file is not bootable. The VHD will be used to create a bootable VM later in the [Configure Hyper-V](#configure-hyper-v) section. + +### Resize VHD + +
              +Enhanced session mode + +**Important**: Before proceeding, verify that you can take advantage of [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) when completing instructions in this guide. Enhanced session mode enables you to copy and paste the commands from the Hyper-V host to VMs, between VMs, and between RDP sessions. After copying some text, you can paste into a Windows PowerShell window by simply right-clicking. Before right-clicking, do not left click other locations as this can empty the clipboard. You can also copy and paste files directly from one computer to another by right-clicking and selecting copy on one computer, then right-clicking and selecting paste on another computer. + +To ensure that enhanced session mode is enabled on the Hyper-V host, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: + +
              Set-VMhost -EnableEnhancedSessionMode $TRUE
              + +>If enhanced session mode was not previously enabled, close any existing virtual machine connections and re-open them to enable access to enhanced session mode. As mentioned previously: instructions to "type" commands provided in this guide can be typed, but the preferred method is to copy and paste these commands. Most of the commands to this point in the guide have been brief, but many commands in sections below are longer and more complex. + +
              + +The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 100GB to support installing imaging tools and storing OS images. + +1. To add available space for the partition, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + +
              +    Resize-VHD -Path c:\VHD\2012R2-poc-2.vhd -SizeBytes 100GB
              +    $x = (Mount-VHD -Path c:\VHD\2012R2-poc-2.vhd -passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
              +    Resize-Partition -DriveLetter $x -Size (Get-PartitionSupportedSize -DriveLetter $x).SizeMax
              +    
              + +2. Verify that the mounted VHD drive is resized to 100 GB, and then dismount the drive: + +
              +    Get-Volume -DriveLetter $x
              +    Dismount-VHD -Path c:\VHD\2012R2-poc-2.vhd
              + +### Configure Hyper-V + +1. Open an elevated Windows PowerShell window and type the following command to create two virtual switches named "poc-internal" and "poc-external": + + >If the Hyper-V host already has an external virtual switch bound to a physical NIC, do not attempt to add a second external virtual switch. Attempting to add a second external switch will result in an error indicating that the NIC is **already bound to the Microsoft Virtual Switch protocol.** In this case, choose one of the following options:
              +    A) Remove the existing external virtual switch, then add the poc-external switch
              +    B) Rename the existing external switch to "poc-external"
              +    C) Replace each instance of "poc-external" used in this guide with the name of your existing external virtual switch
              + If you choose B) or C), then do not run the second command below. + +
              +    New-VMSwitch -Name poc-internal -SwitchType Internal -Notes "PoC Network"
              +    New-VMSwitch -Name poc-external -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name -Notes "PoC External"
              +    
              + + **Note**: The second command above will temporarily interrupt network connectivity on the Hyper-V host. + + >Since an external virtual switch is associated to a physical network adapter on the Hyper-V host, this adapter must be specified when adding the virtual switch. The previous commands automate this by filtering for active non-virtual ethernet adapters using the Get-NetAdapter cmdlet ($_.Status -eq "Up" -and !$_.Virtual). If your Hyper-V host is dual-homed with multiple active ethernet adapters, this automation will not work, and the second command above will fail. In this case, you must edit the command used to add the "poc-external" virtual switch by inserting the appropriate NetAdapterName. The NetAdapterName value corresponds to the name of the network interface you wish to use. For example, if the network interface you use on the Hyper-V host to connect to the Internet is named "Ethernet 2" then type the following command to create an external virtual switch: New-VMSwitch -Name poc-external -NetAdapterName "Ethernet 2" -Notes "PoC External" + +2. At the elevated Windows PowerShell prompt, type the following command to determine the megabytes of RAM that are currently available on the Hyper-V host: + +
              +    (Get-VMHostNumaNode).MemoryAvailable
              +    
              + + This command will display the megabytes of RAM available for VMs. On a Hyper-V host computer with 16 GB of physical RAM installed, 10,000 MB of RAM or greater should be available if the computer is not also running other applications. On a computer with 8 GB of physical RAM installed, at least 4000 MB should be available. If the computer has less RAM available than this, try closing applications to free up more memory. + +3. Determine the available memory for VMs by dividing the available RAM by 4. For example: + +
              +    (Get-VMHostNumaNode).MemoryAvailable/4
              +    2775.5
              +    
              + + In this example, VMs can use a maximum of 2700 MB of RAM each, to run four VMs simultaneously. + +4. At the elevated Windows PowerShell prompt, type the following command to create two new VMs. Other VMs will be added later. + >**Important**: Replace the value of 2700MB for $maxRAM in the first command below with the RAM value that you calculated in the previous step. + +
              +    $maxRAM = 2700MB
              +    New-VM -Name "DC1" -VHDPath c:\vhd\2012R2-poc-1.vhd -SwitchName poc-internal
              +    Set-VMMemory -VMName "DC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              +    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName DC1
              +    New-VM -Name "SRV1" -VHDPath c:\vhd\2012R2-poc-2.vhd -SwitchName poc-internal
              +    Add-VMNetworkAdapter -VMName "SRV1" -SwitchName "poc-external"
              +    Set-VMMemory -VMName "SRV1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 80
              +    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName SRV1
              +    
              + + **Note**: The RAM values assigned to VMs in this step are not permanent, and can be easily increased or decreased later if needed to address performance issues. + +5. Using the same elevated Windows PowerShell prompt that was used in the previous step, type one of the following sets of commands, depending on the type of VM that was prepared in the [Determine VM generation](#determine-vm-generation) section, either generation 1, generation 2, or generation 1 with GPT. + + To create a generation 1 VM (using c:\vhd\w7.vhdx): + +
              +    New-VM -Name "PC1" -VHDPath c:\vhd\w7.vhdx -SwitchName poc-internal
              +    Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              +    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
              +    
              + + To create a generation 2 VM (using c:\vhd\PC1.vhdx): + +
              +    New-VM -Name "PC1" -Generation 2 -VHDPath c:\vhd\PC1.vhdx -SwitchName poc-internal
              +    Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              +    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
              +    
              + + To create a generation 1 VM from a GPT disk (using c:\vhd\w7.vhd): + + >Note: The following procedure is more complex because it includes steps to convert the OS partition from GPT to MBR format. Steps are included to create a temporary VHD and attach it to the VM, the OS image is saved to this drive, the OS drive is then reformatted to MBR, the OS image restored, and the temporary drive is removed. + + First, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to create a temporary VHD that will be used to save the OS image. Do not forget to include a pipe (|) at the end of the first five commands: + +
              +    New-VHD -Path c:\vhd\d.vhd -SizeBytes 1TB |
              +    Mount-VHD -Passthru |
              +    Get-Disk -Number {$_.DiskNumber} |
              +    Initialize-Disk -PartitionStyle MBR -PassThru |
              +    New-Partition -UseMaximumSize |
              +    Format-Volume -Confirm:$false -FileSystem NTFS -force
              +    Dismount-VHD -Path c:\vhd\d.vhd
              +    
              + + Next, create the PC1 VM with two attached VHDs, and boot to DVD ($maxram must be defined previously using the same Windows PowerShell prompt): + +
              +    New-VM -Name "PC1" -VHDPath c:\vhd\w7.vhd -SwitchName poc-internal
              +    Add-VMHardDiskDrive -VMName PC1 -Path c:\vhd\d.vhd
              +    Set-VMDvdDrive -VMName PC1 -Path c:\vhd\w10-enterprise.iso
              +    Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
              +    Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
              +    Start-VM PC1
              +    vmconnect localhost PC1
              +    
              + + The VM will automatically boot into Windows Setup. In the PC1 window: + + 1. Click **Next**. + 2. Click **Repair your computer**. + 3. Click **Troubleshoot**. + 4. Click **Command Prompt**. + 5. Type the following command to save an image of the OS drive: + +
              +      dism /Capture-Image /ImageFile:D:\c.wim /CaptureDir:C:\ /Name:Drive-C
              +      
              + + 6. Wait for the OS image to complete saving, and then type the following commands to convert the C: drive to MBR: + +
              +      diskpart
              +      select disk 0
              +      clean
              +      convert MBR
              +      create partition primary size=100
              +      format fs=ntfs quick
              +      active
              +      create partition primary
              +      format fs=ntfs quick label=OS
              +      assign letter=c
              +      exit
              +      
              + + 7. Type the following commands to restore the OS image and boot files: + +
              +      dism /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\
              +      bcdboot c:\windows
              +      exit
              +      
              + + 8. Click **Continue** and verify the VM boots successfully (do not boot from DVD). + 9. Click **Ctrl+Alt+Del**, and then in the bottom right corner, click **Shut down**. + 10. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to remove the temporary disks and drives from PC1: + +
              +       Remove-VMHardDiskDrive -VMName PC1 -ControllerType IDE -ControllerNumber 0 -ControllerLocation 1
              +       Set-VMDvdDrive -VMName PC1 -Path $null
              +       
              + +### Configure VMs + +1. At an elevated Windows PowerShell prompt on the Hyper-V host, start the first Windows Server VM and connect to it by typing the following commands: + +
              +    Start-VM DC1
              +    vmconnect localhost DC1
              +    
              + +2. Click **Next** to accept the default settings, read the license terms and click **I accept**, provide an administrator password of pass@word1, and click **Finish**. +3. Click **Ctrl+Alt+Del** in the upper left corner of the virtual machine connection window, and then sign in to DC1 using the Administrator account. +4. Right-click **Start**, point to **Shut down or sign out**, and click **Sign out**. The VM connection will reset and a new connection dialog box will appear enabling you to choose a custom display configuration. Select a desktop size, click **Connect** and sign in again with the local Administrator account. Note: Signing in this way ensures that [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) is enabled. It is only necessary to do this the first time you sign in to a new VM. +5. If DC1 is configured as described in this guide, it will currently be assigned an APIPA address, have a randomly generated hostname, and a single network adapter named "Ethernet." Open an elevated Windows PowerShell prompt on DC1 and type or paste the following commands to provide a new hostname and configure a static IP address and gateway: + +
              +    Rename-Computer DC1
              +    New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.1 -PrefixLength 24 -DefaultGateway 192.168.0.2
              +    Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
              +    
              + + > The default gateway at 192.168.0.2 will be configured later in this guide. + > + > Note: A list of available tasks for an app will be populated the first time you run it on the taskbar. Because these tasks aren't available until the App has been run, you will not see the **Run as Administrator** task until you have left-clicked Windows PowerShell for the first time. In this newly created VM, you will need to left-click Windows PowerShell one time, and then you can right-click and choose Run as Administrator to open an elevated Windows PowerShell prompt. + +6. Install the Active Directory Domain Services role by typing the following command at an elevated Windows PowerShell prompt: + +
              +    Install-WindowsFeature -Name AD-Domain-Services -IncludeAllSubFeature -IncludeManagementTools
              +    
              + +7. Before promoting DC1 to a Domain Controller, you must reboot so that the name change in step 3 above takes effect. To restart the computer, type the following command at an elevated Windows PowerShell prompt: + +
              +    Restart-Computer
              +    
              + +8. When DC1 has rebooted, sign in again and open an elevated Windows PowerShell prompt. Now you can promote the server to be a domain controller. The directory services restore mode password must be entered as a secure string. Type the following commands at the elevated Windows PowerShell prompt: + +
              +    $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
              +    Install-ADDSForest -DomainName contoso.com -InstallDns -SafeModeAdministratorPassword $pass -Force
              +    
              + + Ignore any warnings that are displayed. The computer will automatically reboot upon completion. + +9. When the reboot has completed, reconnect to DC1, sign in using the CONTOSO\Administrator account, open an elevated Windows PowerShell prompt, and use the following commands to add a reverse lookup zone for the PoC network, add the DHCP Server role, authorize DHCP in Active Directory, and suppress the post-DHCP-install alert: + +
              +    Add-DnsServerPrimaryZone -NetworkID "192.168.0.0/24" -ReplicationScope Forest
              +    Add-WindowsFeature -Name DHCP -IncludeManagementTools
              +    netsh dhcp add securitygroups
              +    Restart-Service DHCPServer
              +    Add-DhcpServerInDC  dc1.contoso.com  192.168.0.1
              +    Set-ItemProperty -Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 -Name ConfigurationState -Value 2
              +    
              + +10. Next, add a DHCP scope and set option values: + +
              +    Add-DhcpServerv4Scope -Name "PoC Scope" -StartRange 192.168.0.100 -EndRange 192.168.0.199 -SubnetMask 255.255.255.0 -Description "Windows 10 PoC" -State Active
              +    Set-DhcpServerv4OptionValue -ScopeId 192.168.0.0 -DnsDomain contoso.com -Router 192.168.0.2 -DnsServer 192.168.0.1,192.168.0.2 -Force
              +    
              + + >The -Force option is necessary when adding scope options to skip validation of 192.168.0.2 as a DNS server because we have not configured it yet. The scope should immediately begin issuing leases on the PoC network. The first DHCP lease that will be issued is to vEthernet interface on the Hyper-V host, which is a member of the internal network. You can verify this by using the command: Get-DhcpServerv4Lease -ScopeId 192.168.0.0. + +11. The DNS server role will also be installed on the member server, SRV1, at 192.168.0.2 so that we can forward DNS queries from DC1 to SRV1 to resolve Internet names without having to configure a forwarder outside the PoC network. Since the IP address of SRV1 already exists on DC1's network adapter, it will be automatically added during the DCPROMO process. To verify this server-level DNS forwarder on DC1, type the following command at an elevated Windows PowerShell prompt on DC1: + +
              +    Get-DnsServerForwarder
              +    
              + + The following output should be displayed: + +
              +    UseRootHint        : True
              +    Timeout(s)         : 3
              +    EnableReordering   : True
              +    IPAddress          : 192.168.0.2
              +    ReorderedIPAddress : 192.168.0.2
              +    
              + + If this output is not displayed, you can use the following command to add SRV1 as a forwarder: + +
              +    Add-DnsServerForwarder -IPAddress 192.168.0.2
              +    
              + + **Configure service and user accounts** + + Windows 10 deployment with MDT and Microsoft Endpoint Configuration Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire. + + >To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) + + On DC1, open an elevated Windows PowerShell prompt and type the following commands: + +
              +    New-ADUser -Name User1 -UserPrincipalName user1 -Description "User account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              +    New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              +    New-ADUser -Name CM_JD -UserPrincipalName CM_JD -Description "Configuration Manager Join Domain Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              +    New-ADUser -Name CM_NAA -UserPrincipalName CM_NAA -Description "Configuration Manager Network Access Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
              +    Add-ADGroupMember "Domain Admins" MDT_BA,CM_JD,CM_NAA
              +    Set-ADUser -Identity user1 -PasswordNeverExpires $true
              +    Set-ADUser -Identity administrator -PasswordNeverExpires $true
              +    Set-ADUser -Identity MDT_BA -PasswordNeverExpires $true
              +    Set-ADUser -Identity CM_JD -PasswordNeverExpires $true
              +    Set-ADUser -Identity CM_NAA -PasswordNeverExpires $true
              +    
              + +12. Minimize the DC1 VM window but **do not stop** the VM. + + Next, the client VM will be started and joined to the contoso.com domain. This is done before adding a gateway to the PoC network so that there is no danger of duplicate DNS registrations for the physical client and its cloned VM in the corporate domain. + +13. If the PC1 VM is not started yet, using an elevated Windows PowerShell prompt on the Hyper-V host, start the client VM (PC1), and connect to it: + +
              +    Start-VM PC1
              +    vmconnect localhost PC1
              +    
              + +14. Sign in to PC1 using an account that has local administrator rights. + + >PC1 will be disconnected from its current domain, so you cannot use a domain account to sign on unless these credentials are cached and the use of cached credentials is permitted by Group Policy. If cached credentials are available and permitted, you can use these credentials to sign in. Otherwise, use an existing local administrator account. + +15. After signing in, the operating system detects that it is running in a new environment. New drivers will be automatically installed, including the network adapter driver. The network adapter driver must be updated before you can proceed, so that you will be able to join the contoso.com domain. Depending on the resources allocated to PC1, installing the network adapter driver might take a few minutes. You can monitor device driver installation by clicking **Show hidden icons** in the notification area. + + ![PoC 1](images/installing-drivers.png) + + >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. + +16. When the new network adapter driver has completed installation, you will receive an alert to set a network location for the contoso.com network. Select **Work network** and then click **Close**. When you receive an alert that a restart is required, click **Restart Later**. + +17. Open an elevated Windows PowerShell prompt on PC1 and verify that the client VM has received a DHCP lease and can communicate with the consoto.com domain controller. + + To open Windows PowerShell on Windows 7, click **Start**, and search for "**power**." Right-click **Windows PowerShell** and then click **Pin to Taskbar** so that it is simpler to use Windows PowerShell during this lab. Click **Windows PowerShell** on the taskbar, and then type **ipconfig** at the prompt to see the client's current IP address. Also type **ping dc1.contoso.com** and **nltest /dsgetdc:contoso.com** to verify that it can reach the domain controller. See the following examples of a successful network connection: + + ``` + ipconfig + + Windows IP Configuration + + Ethernet adapter Local Area Connection 3: + Connection-specific DNS Suffix . : contoso.com + Link-local IPv6 Address . . . . . : fe80::64c2:4d2a:7403:6e02%18 + Ipv4 Address. . . . . . . . . . . : 192.168.0.101 + Subnet Mask . . . . . . . . . . . : 255.255.255.0 + Default Gateway . . . . . . . . . : 192.168.0.2 + + ping dc1.contoso.com + + Pinging dc1.contoso.com [192.168.0.1] with 32 bytes of data: + Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 + Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 + Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 + Reply from 192.168.0.1: bytes=32 time<1ms TTL=128 + + nltest /dsgetdc:contoso.com + DC: \\DC1 + Address: \\192.168.0.1 + Dom Guid: fdbd0643-d664-411b-aea0-fe343d7670a8 + Dom Name: CONTOSO + Forest Name: contoso.com + Dc Site Name: Default-First-Site-Name + Our Site Name: Default-First-Site-Name + Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_FOREST CLOSE_SITE FULL_SECRET WS 0xC000 + ``` + + >If PC1 is running Windows 7, enhanced session mode might not be available, which means that you cannot copy and paste commands from the Hyper-V host to a Windows PowerShell prompt on PC1. However, it is possible to use integration services to copy a file from the Hyper-V host to a VM. The next procedure demonstrates this. If the Copy-VMFile command fails, then type the commands below at an elevated Windows PowerShell prompt on PC1 instead of saving them to a script to run remotely. If PC1 is running Windows 8 or a later operating system, you can use enhanced session mode to copy and paste these commands instead of typing them. + +18. Minimize the PC1 window and switch to the Hyper-V host computer. Open an elevated Windows PowerShell ISE window on the Hyper-V host (right-click Windows PowerShell and then click **Run ISE as Administrator**) and type the following commands in the (upper) script editor pane: + +
              +    (Get-WmiObject Win32_ComputerSystem).UnjoinDomainOrWorkgroup($null,$null,0)
              +    $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
              +    $user = "contoso\administrator"
              +    $cred = New-Object System.Management.Automation.PSCredential($user,$pass)
              +    Add-Computer -DomainName contoso.com -Credential $cred
              +    Restart-Computer
              +    
              + + >If you do not see the script pane, click **View** and verify **Show Script Pane Top** is enabled. Click **File** and then click **New**. + + See the following example: + + ![ISE 1](images/ISE.png) + +19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. +20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1: + +
              +    Enable-VMIntegrationService -VMName PC1 -Name "Guest Service Interface"
              +    Copy-VMFile "PC1" -SourcePath "C:\VHD\pc1.ps1" -DestinationPath "C:\pc1.ps1" -CreateFullPath -FileSource Host
              +    
              + + >In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. + + If the copy-vmfile command does not work and you cannot properly enable or upgrade integration services on PC1, then create the file c:\pc1.ps1 on the VM by typing the commands into this file manually. The copy-vmfile command is only used in this procedure as a demonstration of automation methods that can be used in a Hyper-V environment when enhanced session mode is not available. After typing the script file manually, be sure to save the file as a Windows PowerShell script file with the .ps1 extension and not as a text (.txt) file. + +21. On PC1, type the following commands at an elevated Windows PowerShell prompt: + +
              +    Get-Content c:\pc1.ps1 | powershell.exe -noprofile -
              +    
              + + >The commands in this script might take a few moments to complete. If an error is displayed, check that you typed the command correctly, paying close attention to spaces. PC1 is removed from its domain in this step while not connected to the corporate network so as to ensure the computer object in the corporate domain is unaffected. PC1 is also not renamed to "PC1" in system properties so that it maintains some of its mirrored identity. However, if desired you can also rename the computer. + +22. Upon completion of the script, PC1 will automatically restart. When it has restarted, sign in to the contoso.com domain using the **Switch User** option, with the **user1** account you created in step 11 of this section. + >**Important**: The settings that will be used later to migrate user data specifically select only accounts that belong to the CONTOSO domain. However, this can be changed to migrate all user accounts, or only other specified accounts. If you wish to test migration of user data and settings with accounts other than those in the CONTOSO domain, you must specify these accounts or domains when you configure the value of **ScanStateArgs** in the MDT test lab guide. This value is specifically called out when you get to that step. If you wish to only migrate CONTOSO accounts, then you can log in with the user1 account or the administrator account at this time and modify some of the files and settings for later use in migration testing. +23. Minimize the PC1 window but do not turn it off while the second Windows Server 2012 R2 VM (SRV1) is configured. This verifies that the Hyper-V host has enough resources to run all VMs simultaneously. Next, SRV1 will be started, joined to the contoso.com domain, and configured with RRAS and DNS services. +24. On the Hyper-V host computer, at an elevated Windows PowerShell prompt, type the following commands: + +
              +    Start-VM SRV1
              +    vmconnect localhost SRV1
              +    
              + +25. Accept the default settings, read license terms and accept them, provide an administrator password of pass@word1, and click **Finish**. When you are prompted about finding PCs, devices, and content on the network, click **Yes**. +26. Sign in to SRV1 using the local administrator account. In the same way that was done on DC1, sign out of SRV1 and then sign in again to enable enhanced session mode. This will enable you to copy and paste Windows PowerShell commands from the Hyper-V host to the VM. +27. Open an elevated Windows PowerShell prompt on SRV1 and type the following commands: + +
              +    Rename-Computer SRV1
              +    New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.2 -PrefixLength 24
              +    Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
              +    Restart-Computer
              +    
              + + >[!IMPORTANT] + >Verify that you are configuring the correct interface in this step. The commands in this step assume that the poc-internal interface on SRV1 is named "Ethernet." If you are unsure how to check the interface, see step #30 below for instructions and tips on how to verify and modify the interface name. + +28. Wait for the computer to restart, sign in again, then type the following commands at an elevated Windows PowerShell prompt: + +
              +    $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
              +    $user = "contoso\administrator"
              +    $cred = New-Object System.Management.Automation.PSCredential($user,$pass)
              +    Add-Computer -DomainName contoso.com -Credential $cred
              +    Restart-Computer
              +    
              + +29. Sign in to the contoso.com domain on SRV1 using the domain administrator account (enter contoso\administrator as the user), open an elevated Windows PowerShell prompt, and type the following commands: + +
              +    Install-WindowsFeature -Name DNS -IncludeManagementTools
              +    Install-WindowsFeature -Name WDS -IncludeManagementTools
              +    Install-WindowsFeature -Name Routing -IncludeManagementTools
              +    
              + +30. Before configuring the routing service that was just installed, verify that network interfaces were added to SRV1 in the right order, resulting in an interface alias of "Ethernet" for the private interface, and an interface alias of "Ethernet 2" for the public interface. Also verify that the external interface has a valid external DHCP IP address lease. + + To view a list of interfaces, associated interface aliases, and IP addresses on SRV1, type the following Windows PowerShell command. Example output of the command is also shown below: + +
              +    Get-NetAdapter | ? status -eq ‘up’ | Get-NetIPAddress -AddressFamily IPv4 | ft IPAddress, InterfaceAlias
              +
              +    IPAddress                                                                  InterfaceAlias
              +    ---------                                                                  --------------
              +    10.137.130.118                                                             Ethernet 2
              +    192.168.0.2                                                                Ethernet
              +    
              + + In this example, the poc-internal network interface at 192.168.0.2 is associated with the "Ethernet" interface and the Internet-facing poc-external interface is associated with the "Ethernet 2" interface. If your interfaces are different, you must adjust the commands provided in the next step appropriately to configure routing services. Also note that if the "Ethernet 2" interface has an IP address in the 192.168.0.100-105 range then it likely is getting a DHCP lease from DC1 instead of your corporate network. If this is the case, you can try removing and re-adding the second network interface from the SRV1 VM through its Hyper-V settings. + + >[!TIP] + >Sometimes a computer will have hidden, disconnected interfaces that prevent you from naming a network adapter. When you attempt to rename an adapter, you will receive an error that the adapter name already exists. These disconnected devices can be viewed in device manager by clicking **View** and then clicking **Show hidden devices**. The disconnected device can then be uninstalled, enabling you to reuse the adapter name. + + +31. To configure SRV1 with routing capability for the PoC network, type or paste the following commands at an elevated Windows PowerShell prompt on SRV1: + +
              +    Install-RemoteAccess -VpnType Vpn
              +    cmd /c netsh routing ip nat install
              +    cmd /c netsh routing ip nat add interface name="Ethernet 2" mode=FULL
              +    cmd /c netsh routing ip nat add interface name="Ethernet" mode=PRIVATE
              +    cmd /c netsh routing ip nat add interface name="Internal" mode=PRIVATE
              +    
              + +32. The DNS service on SRV1 also needs to resolve hosts in the `contoso.com` domain. This can be accomplished with a conditional forwarder. Open an elevated Windows PowerShell prompt on SRV1 and type the following command: + +
              +    Add-DnsServerConditionalForwarderZone -Name contoso.com -MasterServers 192.168.0.1
              +    
              + +33. In most cases, this completes configuration of the PoC network. However, if your corporate network has a firewall that filters queries from local DNS servers, you will also need to configure a server-level DNS forwarder on SRV1 to resolve Internet names. To test whether or not DNS is working without this forwarder, try to reach a name on the Internet from DC1 or PC1, which are only using DNS services on the PoC network. You can test DNS with the ping command, for example: + +
              +    ping www.microsoft.com
              +    
              + + If you see "Ping request could not find host `www.microsoft.com`" on PC1 and DC1, but not on SRV1, then you will need to configure a server-level DNS forwarder on SRV1. To do this, open an elevated Windows PowerShell prompt on SRV1 and type the following command. + + **Note**: This command also assumes that "Ethernet 2" is the external-facing network adapter on SRV1. If the external adapter has a different name, replace "Ethernet 2" in the command below with that name: + +
              +    Add-DnsServerForwarder -IPAddress (Get-DnsClientServerAddress -InterfaceAlias "Ethernet 2").ServerAddresses
              +    
              + +34. If DNS and routing are both working correctly, you will see the following on DC1 and PC1 (the IP address might be different, but that is OK): + +
              +    PS C:\> ping www.microsoft.com
              +
              +    Pinging e2847.dspb.akamaiedge.net [23.222.146.170] with 32 bytes of data:
              +    Reply from 23.222.146.170: bytes=32 time=3ms TTL=51
              +    Reply from 23.222.146.170: bytes=32 time=2ms TTL=51
              +    Reply from 23.222.146.170: bytes=32 time=2ms TTL=51
              +    Reply from 23.222.146.170: bytes=32 time=1ms TTL=51
              +
              +    Ping statistics for 23.222.146.170:
              +        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
              +    Approximate round trip times in milli-seconds:
              +        Minimum = 1ms, Maximum = 3ms, Average = 2ms
              +    
              + +35. Verify that all three VMs can reach each other, and the Internet. See [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration) for more information. +36. Lastly, because the client computer has different hardware after copying it to a VM, its Windows activation will be invalidated and you might receive a message that you must activate Windows in 3 days. To extend this period to 30 days, type the following commands at an elevated Windows PowerShell prompt on PC1: + +
              +    runas /noprofile /env /user:administrator@contoso.com "cmd /c slmgr -rearm"
              +    Restart-Computer
              +    
              + +This completes configuration of the starting PoC environment. Additional services and tools are installed in subsequent guides. + +## Appendix A: Verify the configuration + +Use the following procedures to verify that the PoC environment is configured properly and working as expected. + +1. On DC1, open an elevated Windows PowerShell prompt and type the following commands: + +
              +    Get-Service NTDS,DNS,DHCP
              +    DCDiag -a
              +    Get-DnsServerResourceRecord -ZoneName contoso.com -RRType A
              +    Get-DnsServerForwarder
              +    Resolve-DnsName -Server dc1.contoso.com -Name www.microsoft.com
              +    Get-DhcpServerInDC
              +    Get-DhcpServerv4Statistics
              +    ipconfig /all
              +    
              + + **Get-Service** displays a status of "Running" for all three services.
              + **DCDiag** displays "passed test" for all tests.
              + **Get-DnsServerResourceRecord** displays the correct DNS address records for DC1, SRV1, and the computername of PC1. Additional address records for the zone apex (@), DomainDnsZones, and ForestDnsZones will also be registered.
              + **Get-DnsServerForwarder** displays a single forwarder of 192.168.0.2.
              + **Resolve-DnsName** displays public IP address results for `www.microsoft.com`.
              + **Get-DhcpServerInDC** displays 192.168.0.1, `dc1.contoso.com`.
              + **Get-DhcpServerv4Statistics** displays 1 scope with 2 addresses in use (these belong to PC1 and the Hyper-V host).
              + **ipconfig** displays a primary DNS suffix and suffix search list of `contoso.com`, IP address of 192.168.0.1, subnet mask of 255.255.255.0, default gateway of 192.168.0.2, and DNS server addresses of 192.168.0.1 and 192.168.0.2. + +2. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: + +
              +    Get-Service DNS,RemoteAccess
              +    Get-DnsServerForwarder
              +    Resolve-DnsName -Server dc1.contoso.com -Name www.microsoft.com
              +    ipconfig /all
              +    netsh int ipv4 show address
              +    
              + + **Get-Service** displays a status of "Running" for both services.
              + **Get-DnsServerForwarder** either displays no forwarders, or displays a list of forwarders you are required to use so that SRV1 can resolve Internet names.
              + **Resolve-DnsName** displays public IP address results for `www.microsoft.com`.
              + **ipconfig** displays a primary DNS suffix of `contoso.com`. The suffix search list contains `contoso.com` and your corporate domain. Two ethernet adapters are shown: Ethernet adapter "Ethernet" has an IP addresses of 192.168.0.2, subnet mask of 255.255.255.0, no default gateway, and DNS server addresses of 192.168.0.1 and 192.168.0.2. Ethernet adapter "Ethernet 2" has an IP address, subnet mask, and default gateway configured by DHCP on your corporate network.
              + **netsh** displays three interfaces on the computer: interface "Ethernet 2" with DHCP enabled = Yes and IP address assigned by your corporate network, interface "Ethernet" with DHCP enabled = No and IP address of 192.168.0.2, and interface "Loopback Pseudo-Interface 1" with IP address of 127.0.0.1. + +3. On PC1, open an elevated Windows PowerShell prompt and type the following commands: + +
              +    whoami
              +    hostname
              +    nslookup www.microsoft.com
              +    ping -n 1 dc1.contoso.com
              +    tracert www.microsoft.com
              +    
              + + **whoami** displays the current user context, for example in an elevated Windows PowerShell prompt, contoso\administrator is displayed.
              + **hostname** displays the name of the local computer, for example W7PC-001.
              + **nslookup** displays the DNS server used for the query, and the results of the query. For example, server `dc1.contoso.com`, address 192.168.0.1, Name `e2847.dspb.akamaiedge.net`.
              + **ping** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it cannot be resolved, "..could not find host" will be displayed and if the target is found and also responds to ICMP, you will see "Reply from" and the IP address of the target.
              + **tracert** displays the path to reach the destination, for example `srv1.contoso.com` [192.168.0.2] followed by a list of hosts and IP addresses corresponding to subsequent routing nodes between the source and the destination. + + +## Appendix B: Terminology used in this guide + +

                + +

              + + +
              Term +Definition +
              GPTGUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. +
              Hyper-VHyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8. +
              Hyper-V hostThe computer where Hyper-V is installed. +
              Hyper-V ManagerThe user-interface console used to view and configure Hyper-V. +
              MBRMaster Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format. +
              Proof of concept (PoC)Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process. +
              Shadow copyA copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes. +
              Virtual machine (VM)A VM is a virtual computer with its own operating system, running on the Hyper-V host. +
              Virtual switchA virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host. +
              VM snapshotA point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken. +
              + +
              + +## Related Topics + + +[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) + + + + + + + + diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index 412dceea4f..bd8b4b1db5 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -1,90 +1,91 @@ ---- -title: Switch to Windows 10 Pro/Enterprise from S mode -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional. -keywords: Windows 10 S switch, S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.prod: w10 -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Switch to Windows 10 Pro or Enterprise from S mode - -We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. - - -A number of other transformations are possible depending on which version and edition of Windows 10 you are starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means: - - - - -| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | | | -|-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------| -| | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) | -| **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home | Not by any method | Not by any method | Not by any method | -| | | | | | -| **Windows 10, version 1803** | Pro in S mode | Pro EDU in S mode | Pro | Not by this method | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home in S mode | Not by any method | Home | Not by this method | -| | Home | Not by any method | Not by any method | Not by any method | -| | | | | | -| **Windows 10, version 1809** | Pro in S mode | Pro EDU in S mode | Pro | Pro | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home in S mode | Not by any method | Home | Home | -| | Home | Not by any method | Not by any method | Not by any method | - - -Use the following information to switch to Windows 10 Pro through the Microsoft Store. -> [!IMPORTANT] -> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. - -## Switch one device through the Microsoft Store -Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device. - -Note these differences affecting switching modes in various releases of Windows 10: - -- In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible. -- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. -- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. - - -1. Sign into the Microsoft Store using your Microsoft account. -2. Search for "S mode". -3. In the offer, select **Buy**, **Get**, or **Learn more.** - -You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro. - -## Switch one or more devices by using Microsoft Intune - -Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE - this gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. - -1. Start Microsoft Intune. -2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. -3. Follow the instructions to complete the switch. - - -## Block users from switching - -You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. -To set this, go to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. - -## S mode management with CSPs - -In addition to using Microsoft Intune or another modern device management tool to manage S mode, you can also use the [WindowsLicensing](https://docs.microsoft.com/windows/client-management/mdm/windowslicensing-csp) configuration service provider (CSP). In Windows 10, version 1809, we added S mode functionality that lets you switch devices, block devices from switching, and check the status (whether a device is in S mode). - - -## Related topics - -[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
              -[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
              -[Windows 10 Pro Education](https://docs.microsoft.com/education/windows/test-windows10s-for-edu)
              -[Introduction to Microsoft Intune in the Azure portal](https://docs.microsoft.com/intune/what-is-intune) +--- +title: Switch to Windows 10 Pro/Enterprise from S mode +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional. +keywords: Windows 10 S switch, S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.prod: w10 +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Switch to Windows 10 Pro or Enterprise from S mode + +We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. + + +A number of other transformations are possible depending on which version and edition of Windows 10 you are starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means: + + + + +| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | | | +|-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------| +| | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) | +| **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home | Not by any method | Not by any method | Not by any method | +| | | | | | +| **Windows 10, version 1803** | Pro in S mode | Pro EDU in S mode | Pro | Not by this method | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home in S mode | Not by any method | Home | Not by this method | +| | Home | Not by any method | Not by any method | Not by any method | +| | | | | | +| **Windows 10, version 1809** | Pro in S mode | Pro EDU in S mode | Pro | Pro | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home in S mode | Not by any method | Home | Home | +| | Home | Not by any method | Not by any method | Not by any method | + + +Use the following information to switch to Windows 10 Pro through the Microsoft Store. +> [!IMPORTANT] +> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. + +## Switch one device through the Microsoft Store +Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device. + +Note these differences affecting switching modes in various releases of Windows 10: + +- In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible. +- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. +- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. + + +1. Sign into the Microsoft Store using your Microsoft account. +2. Search for "S mode". +3. In the offer, select **Buy**, **Get**, or **Learn more.** + +You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro. + +## Switch one or more devices by using Microsoft Intune + +Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE - this gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. + +1. Start Microsoft Intune. +2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. +3. Follow the instructions to complete the switch. + + +## Block users from switching + +You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. +To set this, go to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. + +## S mode management with CSPs + +In addition to using Microsoft Intune or another modern device management tool to manage S mode, you can also use the [WindowsLicensing](https://docs.microsoft.com/windows/client-management/mdm/windowslicensing-csp) configuration service provider (CSP). In Windows 10, version 1809, we added S mode functionality that lets you switch devices, block devices from switching, and check the status (whether a device is in S mode). + + +## Related topics + +[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
              +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
              +[Windows 10 Pro Education](https://docs.microsoft.com/education/windows/test-windows10s-for-edu)
              +[Introduction to Microsoft Intune in the Azure portal](https://docs.microsoft.com/intune/what-is-intune) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 198a7e9aa2..84fa27310d 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -1,226 +1,246 @@ ---- -title: Windows 10 Subscription Activation -description: How to dynamically enable Windows 10 Enterprise or Educations subscriptions -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -manager: laurawi -ms.collection: M365-modern-desktop -search.appverid: -- MET150 -ms.topic: article ---- - -# Windows 10 Subscription Activation - -Starting with Windows 10, version 1703 Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to **Windows 10 Enterprise** automatically if they are subscribed to Windows 10 Enterprise E3 or E5. - -With Windows 10, version 1903 the Subscription Activation feature also supports the ability to step-up from Windows 10 Pro Education to the Enterprise grade edition for educational institutions – **Windows 10 Education**. - -The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. - -## Subscription Activation for Windows 10 Enterprise - -With Windows 10, version 1703 both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as online services via subscription. Deploying [Windows 10 Enterprise](planning/windows-10-enterprise-faq-itpro.md) in your organization can now be accomplished with no keys and no reboots. - - If you are running Windows 10, version 1703 or later: - -- Devices with a current Windows 10 Pro license can be seamlessly upgraded to Windows 10 Enterprise. -- Product key-based Windows 10 Enterprise software licenses can be transitioned to Windows 10 Enterprise subscriptions. - -Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-whatis). - -## Subscription Activation for Windows 10 Education - -Subscription Activation for Education works the same as the Enterprise version, but in order to use Subscription Activation for Education, you must have a device running Windows 10 Pro Education, version 1903 or later and an active subscription plan with a Windows 10 Enterprise license. For more information, see the [requirements](#windows-10-education-requirements) section. - -## In this article - -- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later. -- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. -- [Requirements](#requirements): Prerequisites to use the Windows 10 Subscription Activation model. -- [Benefits](#benefits): Advantages of Windows 10 subscription-based licensing. -- [How it works](#how-it-works): A summary of the subscription-based licensing option. -- [Virtual Desktop Access (VDA)](#virtual-desktop-access-vda): Enable Windows 10 Subscription Activation for VMs in the cloud. - -For information on how to deploy Windows 10 Enterprise licenses, see [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). - -## Inherited Activation - -Inherited Activation is a new feature available in Windows 10, version 1803 that allows Windows 10 virtual machines to inherit activation state from their Windows 10 host. - -When a user with Windows 10 E3/E5 or A3/A5 license assigned creates a new Windows 10 virtual machine (VM) using a Windows 10 local host, the VM inherits the activation state from a host machine independent of whether user signs on with a local account or using an Azure Active Directory (AAD) account on a VM. - -To support Inherited Activation, both the host computer and the VM must be running Windows 10, version 1803 or later. - -## The evolution of deployment - ->The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/). - -The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. - -![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) - -- **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
              -- **Windows 8.1** added support for a Windows 8.1 Pro to Windows 8.1 Enterprise in-place upgrade (considered a “repair upgrade” because the OS version was the same before and after).  This was a lot easier than wipe-and-load, but it was still time-consuming.
              -- **Windows 10, version 1507** added the ability to install a new product key using a provisioning package or using MDM to change the SKU.  This required a reboot, which would install the new OS components, and took several minutes to complete. However, it was a lot quicker than in-place upgrade.
              -- **Windows 10, version 1607** made a big leap forward. Now you can just change the product key and the SKU instantly changes from Windows 10 Pro to Windows 10 Enterprise.  In addition to provisioning packages and MDM, you can just inject a key using SLMGR.VBS (which injects the key into WMI), so it became trivial to do this using a command line.
              -- **Windows 10, version 1703** made this “step-up” from Windows 10 Pro to Windows 10 Enterprise automatic for those that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program.
              -- **Windows 10, version 1709** adds support for Windows 10 Subscription Activation, very similar to the CSP support but for large enterprises, enabling the use of Azure AD for assigning licenses to users. When those users sign in on an AD or Azure AD-joined machine, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise.
              -- **Windows 10, version 1803** updates Windows 10 Subscription Activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise. For virtual machines and hosts running Windows 10, version 1803 [Inherited Activation](#inherited-activation) is also enabled.
              -- **Windows 10, version 1903** updates Windows 10 Subscription Activation to enable step up from Windows 10 Pro Education to Windows 10 Education for those with a qualifying Windows 10 or Microsoft 365 subscription. - -## Requirements - -### Windows 10 Enterprise requirements - -For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following: - -- Windows 10 (Pro or Enterprise) version 1703 or later installed on the devices to be upgraded. -- Azure Active Directory (Azure AD) available for identity management. -- Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. - - >[!NOTE] - >An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. To resolve this issue, the user must either sign in with an Azure Active Directory account, or you must disable MFA for this user during the 30-day polling period and renewal. - -For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). - -If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) - -### Windows 10 Education requirements - -1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded. -2. A device with a Windows 10 Pro Education digital license. You can confirm this information in Settings > Update & Security> Activation. -3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. -4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. - ->If Windows 10 Pro is converted to Windows 10 Pro Education [using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition. - - -## Benefits - -With Windows 10 Enterprise or Windows 10 Education, businesses and institutions can benefit from enterprise-level security and control. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Education or Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 or A3 and E5 or A5 being available as a true online service, it is available in select channels thus allowing all organizations to take advantage of enterprise-grade Windows 10 features. To compare Windows 10 editions and review pricing, see the following: - -- [Compare Windows 10 editions](https://www.microsoft.com/en-us/windowsforbusiness/compare) -- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security-pricing) - -You can benefit by moving to Windows as an online service in the following ways: - -1. Licenses for Windows 10 Enterprise and Education are checked based on Azure Active Directory (Azure AD) credentials, so now businesses have a systematic way to assign licenses to end users and groups in their organization. -2. User logon triggers a silent edition upgrade, with no reboot required -3. Support for mobile worker/BYOD activation; transition away from on-prem KMS and MAK keys. -4. Compliance support via seat assignment. -5. Licenses can be updated to different users dynamically, enabling you to optimize your licensing investment against changing needs. - -## How it works - -The device is AAD joined from Settings > Accounts > Access work or school. - -The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. - -![Windows 10 Enterprise](images/ent.png) - -When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. - -Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, version 1903 or later can get Windows 10 Enterprise or Education Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel. - -The following figures summarize how the Subscription Activation model works: - -Before Windows 10, version 1903:
              -![1703](images/before.png) - -After Windows 10, version 1903:
              -![1903](images/after.png) - -Note: -1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). -2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). - -### Scenarios - -**Scenario #1**:  You are using Windows 10, version 1803 or above, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). - -All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and devices that are already running Windows 10 Enterprise will migrate from KMS or MAK activated Enterprise edition to Subscription activated Enterprise edition when a Subscription Activation-enabled user signs in to the device. - -**Scenario #2**:  You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). - -To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer: - -
              -cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
              - -The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate.  This key comes from [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx) in the Volume Activation guide.  It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro. - -**Scenario #3**:  Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts.  The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in. - -In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above. - -If you’re running Windows 7, it can be more work.  A wipe-and-load approach works, but it is likely to be easier to upgrade from Windows 7 Pro directly to Windows 10 Enterprise. This is a supported path, and completes the move in one step.  This method also works if you are running Windows 8.1 Pro. - -### Licenses - -The following policies apply to acquisition and renewal of licenses on devices: -- Devices that have been upgraded will attempt to renew licenses about every 30 days, and must be connected to the Internet to successfully acquire or renew a license. -- If a device is disconnected from the Internet until its current subscription expires, the operating system will revert to Windows 10 Pro or Windows 10 Pro Education. As soon as the device is connected to the Internet again, the license will automatically renew. -- Up to five devices can be upgraded for each user license. -- If a device the meets requirements and a licensed user signs in on that device, it will be upgraded. - -Licenses can be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. - -When you have the required Azure AD subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Azure AD](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal). - -### Existing Enterprise deployments - -If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. - -If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. - -If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt: - -
              -@echo off
              -FOR /F "skip=1" %%A IN ('wmic path SoftwareLicensingService get OA3xOriginalProductKey') DO  ( 
              -SET "ProductKey=%%A"
              -goto InstallKey
              -)
              -
              -:InstallKey
              -IF [%ProductKey%]==[] (
              -echo No key present
              -) ELSE (
              -echo Installing %ProductKey%
              -changepk.exe /ProductKey %ProductKey%
              -)
              -
              - -### Obtaining an Azure AD license - -Enterprise Agreement/Software Assurance (EA/SA): -- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Azure AD (ideally to groups using the new Azure AD Premium feature for group assignment). For more information, see [Enabling Subscription Activation with an existing EA](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#enabling-subscription-activation-with-an-existing-ea). -- The license administrator can assign seats to Azure AD users with the same process that is used for O365. -- New EA/SA Windows Enterprise customers can acquire both an SA subscription and an associated $0 cloud subscription. - -Microsoft Products & Services Agreements (MPSA): -- Organizations with MPSA are automatically emailed the details of the new service. They must take steps to process the instructions. -- Existing MPSA customers will receive service activation emails that allow their customer administrator to assign users to the service. -- New MPSA customers who purchase the Software Subscription Windows Enterprise E3 and E5 will be enabled for both the traditional key-based and new subscriptions activation method. - -### Deploying licenses - -See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). - -## Virtual Desktop Access (VDA) - -Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx). - -Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). - -## Related topics - -[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
              -[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
              -[Windows for business](https://www.microsoft.com/en-us/windowsforbusiness/default.aspx)
              +--- +title: Windows 10 Subscription Activation +description: In this article, you will learn how to dynamically enable Windows 10 Enterprise or Education subscriptions. +keywords: upgrade, update, task sequence, deploy +ms.custom: seo-marvel-apr2020 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +manager: laurawi +ms.collection: M365-modern-desktop +search.appverid: +- MET150 +ms.topic: article +--- + +# Windows 10 Subscription Activation + +Starting with Windows 10, version 1703 Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to **Windows 10 Enterprise** automatically if they are subscribed to Windows 10 Enterprise E3 or E5. + +With Windows 10, version 1903 the Subscription Activation feature also supports the ability to step-up from Windows 10 Pro Education to the Enterprise grade edition for educational institutions – **Windows 10 Education**. + +The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. + +## Subscription Activation for Windows 10 Enterprise + +With Windows 10, version 1703 both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as online services via subscription. Deploying [Windows 10 Enterprise](planning/windows-10-enterprise-faq-itpro.md) in your organization can now be accomplished with no keys and no reboots. + + If you are running Windows 10, version 1703 or later: + +- Devices with a current Windows 10 Pro license can be seamlessly upgraded to Windows 10 Enterprise. +- Product key-based Windows 10 Enterprise software licenses can be transitioned to Windows 10 Enterprise subscriptions. + +Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-whatis). + +## Subscription Activation for Windows 10 Education + +Subscription Activation for Education works the same as the Enterprise version, but in order to use Subscription Activation for Education, you must have a device running Windows 10 Pro Education, version 1903 or later and an active subscription plan with a Windows 10 Enterprise license. For more information, see the [requirements](#windows-10-education-requirements) section. + +## Summary + +- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later. +- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. +- [Requirements](#requirements): Prerequisites to use the Windows 10 Subscription Activation model. +- [Benefits](#benefits): Advantages of Windows 10 subscription-based licensing. +- [How it works](#how-it-works): A summary of the subscription-based licensing option. +- [Virtual Desktop Access (VDA)](#virtual-desktop-access-vda): Enable Windows 10 Subscription Activation for VMs in the cloud. + +For information on how to deploy Windows 10 Enterprise licenses, see [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). + +## Inherited Activation + +Inherited Activation is a new feature available in Windows 10, version 1803 that allows Windows 10 virtual machines to inherit activation state from their Windows 10 host. + +When a user with Windows 10 E3/E5 or A3/A5 license assigned creates a new Windows 10 virtual machine (VM) using a Windows 10 local host, the VM inherits the activation state from a host machine independent of whether user signs on with a local account or using an Azure Active Directory (AAD) account on a VM. + +To support Inherited Activation, both the host computer and the VM must be running Windows 10, version 1803 or later. + +## The evolution of deployment + +> The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/). + +The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. + +![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) + +- **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
              +- **Windows 8.1** added support for a Windows 8.1 Pro to Windows 8.1 Enterprise in-place upgrade (considered a “repair upgrade” because the OS version was the same before and after).  This was a lot easier than wipe-and-load, but it was still time-consuming.
              +- **Windows 10, version 1507** added the ability to install a new product key using a provisioning package or using MDM to change the SKU.  This required a reboot, which would install the new OS components, and took several minutes to complete. However, it was a lot quicker than in-place upgrade.
              +- **Windows 10, version 1607** made a big leap forward. Now you can just change the product key and the SKU instantly changes from Windows 10 Pro to Windows 10 Enterprise.  In addition to provisioning packages and MDM, you can just inject a key using SLMGR.VBS (which injects the key into WMI), so it became trivial to do this using a command line.
              +- **Windows 10, version 1703** made this “step-up” from Windows 10 Pro to Windows 10 Enterprise automatic for those that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program.
              +- **Windows 10, version 1709** adds support for Windows 10 Subscription Activation, very similar to the CSP support but for large enterprises, enabling the use of Azure AD for assigning licenses to users. When those users sign in on an AD or Azure AD-joined machine, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise.
              +- **Windows 10, version 1803** updates Windows 10 Subscription Activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise. For virtual machines and hosts running Windows 10, version 1803 [Inherited Activation](#inherited-activation) is also enabled.
              +- **Windows 10, version 1903** updates Windows 10 Subscription Activation to enable step up from Windows 10 Pro Education to Windows 10 Education for those with a qualifying Windows 10 or Microsoft 365 subscription. + +## Requirements + +### Windows 10 Enterprise requirements + +> [!NOTE] +> The following requirements do not apply to general Windows 10 activation on Azure. Azure activation requires a connection to Azure KMS only, and supports workgroup, Hybrid, and Azure AD-joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure Virtual Machines](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/troubleshoot-activation-problems#understanding-azure-kms-endpoints-for-windows-product-activation-of-azure-virtual-machines). + +For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following: + +- Windows 10 (Pro or Enterprise) version 1703 or later installed on the devices to be upgraded. +- Azure Active Directory (Azure AD) available for identity management. +- Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. + +For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). + +If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://www.microsoft.com/en-us/microsoft-365/blog/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) + +#### Multi-factor authentication + +An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. + +To resolve this issue: + +If the device is running Windows 10, version 1703, 1709, or 1803, the user must either sign in with an Azure AD account, or you must disable MFA for this user during the 30-day polling period and renewal. + +If the device is running Windows 10, version 1809 or later: +1. Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch. +2. When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: + +![Subscription Activation with MFA example 1](images/sa-mfa1.png)
              +![Subscription Activation with MFA example 2](images/sa-mfa2.png)
              +![Subscription Activation with MFA example 3](images/sa-mfa3.png) + +### Windows 10 Education requirements + +1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded. +2. A device with a Windows 10 Pro Education digital license. You can confirm this information in Settings > Update & Security > Activation. +3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. +4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. + +> If Windows 10 Pro is converted to Windows 10 Pro Education [using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition. + + +## Benefits + +With Windows 10 Enterprise or Windows 10 Education, businesses and institutions can benefit from enterprise-level security and control. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Education or Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 or A3 and E5 or A5 being available as a true online service, it is available in select channels thus allowing all organizations to take advantage of enterprise-grade Windows 10 features. To compare Windows 10 editions and review pricing, see the following: + +- [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare) +- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/cloud-platform/enterprise-mobility-security-pricing) + +You can benefit by moving to Windows as an online service in the following ways: + +1. Licenses for Windows 10 Enterprise and Education are checked based on Azure Active Directory (Azure AD) credentials, so now businesses have a systematic way to assign licenses to end users and groups in their organization. +2. User logon triggers a silent edition upgrade, with no reboot required +3. Support for mobile worker/BYOD activation; transition away from on-prem KMS and MAK keys. +4. Compliance support via seat assignment. +5. Licenses can be updated to different users dynamically, enabling you to optimize your licensing investment against changing needs. + +## How it works + +The device is AAD joined from Settings > Accounts > Access work or school. + +The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. + +![Windows 10 Enterprise](images/ent.png) + +When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. + +Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, version 1903 or later can get Windows 10 Enterprise or Education Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel. + +The following figures summarize how the Subscription Activation model works: + +Before Windows 10, version 1903:
              +![1703](images/before.png) + +After Windows 10, version 1903:
              +![1903](images/after.png) + +Note: +1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). +2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). + +### Scenarios + +**Scenario #1**:  You are using Windows 10, version 1803 or above, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). + +All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and devices that are already running Windows 10 Enterprise will migrate from KMS or MAK activated Enterprise edition to Subscription activated Enterprise edition when a Subscription Activation-enabled user signs in to the device. + +**Scenario #2**:  You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). + +To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer: + +
              +cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
              + +The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate.  This key comes from [Appendix A: KMS Client Setup Keys](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v=ws.11)) in the Volume Activation guide.  It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro. + +**Scenario #3**:  Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts.  The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in. + +In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above. + +If you’re running Windows 7, it can be more work.  A wipe-and-load approach works, but it is likely to be easier to upgrade from Windows 7 Pro directly to Windows 10 Enterprise. This is a supported path, and completes the move in one step.  This method also works if you are running Windows 8.1 Pro. + +### Licenses + +The following policies apply to acquisition and renewal of licenses on devices: +- Devices that have been upgraded will attempt to renew licenses about every 30 days, and must be connected to the Internet to successfully acquire or renew a license. +- If a device is disconnected from the Internet until its current subscription expires, the operating system will revert to Windows 10 Pro or Windows 10 Pro Education. As soon as the device is connected to the Internet again, the license will automatically renew. +- Up to five devices can be upgraded for each user license. +- If a device meets the requirements and a licensed user signs in on that device, it will be upgraded. + +Licenses can be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. + +When you have the required Azure AD subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Azure AD](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal). + +### Existing Enterprise deployments + +If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. + +Caution: Firmware-embedded Windows 10 activation happens automatically only when we go through OOBE(Out Of Box Experience) + +If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. + +If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt: + +
              +@echo off
              +FOR /F "skip=1" %%A IN ('wmic path SoftwareLicensingService get OA3xOriginalProductKey') DO  (
              +SET "ProductKey=%%A"
              +goto InstallKey
              +)
              +
              +:InstallKey
              +IF [%ProductKey%]==[] (
              +echo No key present
              +) ELSE (
              +echo Installing %ProductKey%
              +changepk.exe /ProductKey %ProductKey%
              +)
              +
              + +### Obtaining an Azure AD license + +Enterprise Agreement/Software Assurance (EA/SA): +- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Azure AD (ideally to groups using the new Azure AD Premium feature for group assignment). For more information, see [Enabling Subscription Activation with an existing EA](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#enabling-subscription-activation-with-an-existing-ea). +- The license administrator can assign seats to Azure AD users with the same process that is used for O365. +- New EA/SA Windows Enterprise customers can acquire both an SA subscription and an associated $0 cloud subscription. + +Microsoft Products & Services Agreements (MPSA): +- Organizations with MPSA are automatically emailed the details of the new service. They must take steps to process the instructions. +- Existing MPSA customers will receive service activation emails that allow their customer administrator to assign users to the service. +- New MPSA customers who purchase the Software Subscription Windows Enterprise E3 and E5 will be enabled for both the traditional key-based and new subscriptions activation method. + +### Deploying licenses + +See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). + +## Virtual Desktop Access (VDA) + +Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://microsoft.com/en-us/CloudandHosting/licensing_sca.aspx). + +Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). + +## Related topics + +[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
              +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
              +[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
              diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md index 861ef1b1ad..d8d6f47273 100644 --- a/windows/deployment/windows-adk-scenarios-for-it-pros.md +++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md @@ -1,97 +1,98 @@ ---- -title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) -description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. -ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 07/27/2017 -ms.topic: article ---- - -# Windows ADK for Windows 10 scenarios for IT Pros - - -The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx). - -In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](https://msdn.microsoft.com/library/windows/hardware/dn938361.aspx). - -Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center. - -### Create a Windows image using command-line tools - -[DISM](https://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images. - -Here are some things you can do with DISM: - -- [Mount an offline image](https://msdn.microsoft.com/library/windows/hardware/dn938321.aspx) -- [Add drivers to an offline image](https://msdn.microsoft.com/library/windows/hardware/dn898469.aspx) -- [Enable or disable Windows features](https://msdn.microsoft.com/library/windows/hardware/dn898567.aspx) -- [Add or remove packages](https://msdn.microsoft.com/library/windows/hardware/dn898481.aspx) -- [Add language packs](https://msdn.microsoft.com/library/windows/hardware/dn898470.aspx) -- [Add Universal Windows apps](https://msdn.microsoft.com/library/windows/hardware/dn898600.aspx) -- [Upgrade the Windows edition](https://msdn.microsoft.com/library/windows/hardware/dn898500.aspx) - -[Sysprep](https://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation. - -Here are some things you can do with Sysprep: - -- [Generalize a Windows installation](https://msdn.microsoft.com/library/windows/hardware/dn938334.aspx) -- [Customize the default user profile](https://msdn.microsoft.com/library/windows/hardware/dn898521.aspx) -- [Use answer files](https://msdn.microsoft.com/library/windows/hardware/dn938346.aspx) - -[Windows PE (WinPE)](https://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system. - -Here are ways you can create a WinPE image: - -- [Create a bootable USB drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) -- [Create a Boot CD, DVD, ISO, or VHD](https://msdn.microsoft.com/library/windows/hardware/dn938385.aspx) - -[Windows Recovery Environment (Windows RE)](https://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems. - -Here are some things you can do with Windows RE: - -- [Customize Windows RE](https://msdn.microsoft.com/library/windows/hardware/dn898523.aspx) -- [Push-button reset](https://msdn.microsoft.com/library/windows/hardware/dn938307.aspx) - -[Windows System Image Manager (Windows SIM)](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation. - -Here are some things you can do with Windows SIM: - -- [Create answer file](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) -- [Add a driver path to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915062.aspx) -- [Add a package to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915066.aspx) -- [Add a custom command to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915058.aspx) - -For a list of settings you can change, see [Unattended Windows Setup Reference](https://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center. - -### Create a Windows image using Windows ICD - -Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image. - -Here are some things you can do with Windows ICD: - -- [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107.aspx) -- [Export a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916110.aspx) -- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx) - -### IT Pro Windows deployment tools - -There are also a few tools included in the Windows ADK that are specific to IT Pros and this documentation is available on TechNet: - -- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) -- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) - -  - -  - - - - - +--- +title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) +description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. +ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +ms.date: 07/27/2017 +ms.topic: article +--- + +# Windows ADK for Windows 10 scenarios for IT Pros + + +The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx). + +In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](https://msdn.microsoft.com/library/windows/hardware/dn938361.aspx). + +Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center. + +### Create a Windows image using command-line tools + +[DISM](https://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images. + +Here are some things you can do with DISM: + +- [Mount an offline image](https://msdn.microsoft.com/library/windows/hardware/dn938321.aspx) +- [Add drivers to an offline image](https://msdn.microsoft.com/library/windows/hardware/dn898469.aspx) +- [Enable or disable Windows features](https://msdn.microsoft.com/library/windows/hardware/dn898567.aspx) +- [Add or remove packages](https://msdn.microsoft.com/library/windows/hardware/dn898481.aspx) +- [Add language packs](https://msdn.microsoft.com/library/windows/hardware/dn898470.aspx) +- [Add Universal Windows apps](https://msdn.microsoft.com/library/windows/hardware/dn898600.aspx) +- [Upgrade the Windows edition](https://msdn.microsoft.com/library/windows/hardware/dn898500.aspx) + +[Sysprep](https://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation. + +Here are some things you can do with Sysprep: + +- [Generalize a Windows installation](https://msdn.microsoft.com/library/windows/hardware/dn938334.aspx) +- [Customize the default user profile](https://msdn.microsoft.com/library/windows/hardware/dn898521.aspx) +- [Use answer files](https://msdn.microsoft.com/library/windows/hardware/dn938346.aspx) + +[Windows PE (WinPE)](https://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system. + +Here are ways you can create a WinPE image: + +- [Create a bootable USB drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) +- [Create a Boot CD, DVD, ISO, or VHD](https://msdn.microsoft.com/library/windows/hardware/dn938385.aspx) + +[Windows Recovery Environment (Windows RE)](https://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems. + +Here are some things you can do with Windows RE: + +- [Customize Windows RE](https://msdn.microsoft.com/library/windows/hardware/dn898523.aspx) +- [Push-button reset](https://msdn.microsoft.com/library/windows/hardware/dn938307.aspx) + +[Windows System Image Manager (Windows SIM)](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation. + +Here are some things you can do with Windows SIM: + +- [Create answer file](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) +- [Add a driver path to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915062.aspx) +- [Add a package to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915066.aspx) +- [Add a custom command to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915058.aspx) + +For a list of settings you can change, see [Unattended Windows Setup Reference](https://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center. + +### Create a Windows image using Windows ICD + +Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image. + +Here are some things you can do with Windows ICD: + +- [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107.aspx) +- [Export a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916110.aspx) +- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx) + +### IT Pro Windows deployment tools + +There are also a few tools included in the Windows ADK that are specific to IT Pros and this documentation is available on TechNet: + +- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) +- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/windows-autopilot/TOC.md b/windows/deployment/windows-autopilot/TOC.md index 73b9410bf7..b2e8164e4c 100644 --- a/windows/deployment/windows-autopilot/TOC.md +++ b/windows/deployment/windows-autopilot/TOC.md @@ -1,29 +1,2 @@ -# [Windows Autopilot deployment](index.md) -# [What's new](windows-autopilot-whats-new.md) -# Understanding Windows Autopilot -## [Overview](windows-autopilot.md) -## [Requirements](windows-autopilot-requirements.md) -## [Scenarios and capabilities](windows-autopilot-scenarios.md) -## [Get started](demonstrate-deployment-on-vm.md) - -# Deployment scenarios -## [User-driven mode](user-driven.md) -## [Self-deploying mode](self-deploying.md) -## [Windows Autopilot Reset](windows-autopilot-reset.md) -## [White glove](white-glove.md) -## [Support for existing devices](existing-devices.md) - -# Administering Windows Autopilot -## [Registering devices](add-devices.md) -## [Configuring device profiles](profiles.md) -## [Enrollment Status Page](enrollment-status.md) -## [BitLocker encryption](bitlocker.md) -## [Troubleshooting](troubleshooting.md) -## [Known issues](known-issues.md) - -# Support -## [FAQ](autopilot-faq.md) -## [Contacts](autopilot-support.md) -## [Registration authorization](registration-auth.md) -## [Device guidelines](autopilot-device-guidelines.md) -## [Motherboard replacement](autopilot-mbr.md) +# [Windows Autopilot deployment](index.yml) +## [Get started](demonstrate-deployment-on-vm.md) \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md deleted file mode 100644 index a8090d1812..0000000000 --- a/windows/deployment/windows-autopilot/add-devices.md +++ /dev/null @@ -1,162 +0,0 @@ ---- -title: Adding devices -ms.reviewer: -manager: laurawi -description: How to add devices to Windows Autopilot -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Adding devices to Windows Autopilot - -**Applies to** - -- Windows 10 - -Before deploying a device using Windows Autopilot, the device must be registered with the Windows Autopilot deployment service. Ideally, this would be performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually. - -## OEM registration - -When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/en-us/windowsforbusiness/windows-autopilot). - -Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization). - -## Reseller, distributor, or partner registration - -Customers may purchase devices from resellers, distributors, or other partners. As long as these resellers, distributors, and partners are part of the [Cloud Solution Partners (CSP) program](https://partner.microsoft.com/en-us/cloud-solution-provider), they too can register devices on behalf of the customer. - -As with OEMs, CSP parnters must be granted permission to register devices on behalf of an organization. This follows the process described on the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#csp-authorization). The CSP partner initiates a request to establish a relationship with the organization, with approval granted by a global administrator from the organization. Once approved, CSP partners add devices using [Partner Center](https://partner.microsoft.com/en-us/pcv/dashboard/overview), either directly through the web site or via available APIs that can automate the same tasks. - -Windows Autopilot does not require delegated administrator permissions when establishing the relationship between the CSP partner and the organization. As part of the approval process performed by the global administrator, the global administrator can choose to uncheck the "Include delegated administration permissions" checkbox. - -## Automatic registration of existing devices - -If an existing device is already running Windows 10 version 1703 or later and enrolled in an MDM service such an Intune, that MDM service can ask the device for the hardware ID (also known as a hardware hash). Once it has that, it can automatically register the device with Windows Autopilot. - -For instructions on how to do this with Microsoft Intune, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile) documentation describing the "Convert all targeted devices to Autopilot" setting. - -Also note that when using the [Windows Autopilot for existing devices](https://docs.microsoft.com/windows/deployment/windows-autopilot/existing-devices) scenario, it is not necessary to pre-register the devices with Windows Autopilot. Instead, a configuration file (AutopilotConfigurationFile.json) containing all the Windows Autopilot profile settings is used; the device can be registered with Windows Autopilot after the fact using the same "Convert all targeted devices to Autopilot" setting. - -## Manual registration - -To perform manual registration of a device, you must first capture its hardware ID (also known as a hardware hash). Once this process has completed, the resulting hardware ID can be uploaded to the Windows Autopilot service. Because this process requires booting the device into Windows 10 in order to obtain the hardware ID, this is intended primarily for testing and evaluation scenarios. - -## Device identification - -To define a device to the Windows Autopilot deployment service, a unique hardware ID for the device needs to be captured and uploaded to the service. While this step is ideally done by the hardware vendor (OEM, reseller, or distributor), automatically associating the device with an organization, it is also possible to do this through a harvesting process that collects the device from within a running Windows 10 version 1703 or later installation. - -The hardware ID, also commonly referred to as a hardware hash, contains several details about the device, including its manufacturer, model, device serial number, hard drive serial number, and many other attributes that can be used to uniquely identify that device. - -Note that the hardware hash also contains details about when it was generated, so it will change each time it is generated. When the Windows Autopilot deployment service attempts to match a device, it considers changes like that, as well as more substantial changes such as a new hard drive, and is still able to match successfully. But substantial changes to the hardware, such as a motherboard replacement, would not match, so a new hash would need to be generated and uploaded. - -### Collecting the hardware ID from existing devices using System Center Configuration Manager - -Starting with System Center Configuration Manager current branch version 1802, the hardware hashes for existing Windows 10 version 1703 and higher devices are automatically collected by Configuration Manager. See the [What’s new in version 1802](https://docs.microsoft.com/sccm/core/plan-design/changes/whats-new-in-version-1802#report-on-windows-autopilot-device-information) documentation for more details. The hash information can be extracted from Configuration Manager into a CSV file. - -### Collecting the hardware ID from existing devices using PowerShell - -The hardware ID, or hardware hash, for an existing device is available through Windows Management Instrumentation (WMI), as long as that device is running Windows 10 version 1703 or later. To help gather this information, as well as the serial number of the device (useful to see at a glance the machine to which it belongs), a PowerShell script called [Get-WindowsAutoPilotInfo.ps1 has been published to the PowerShell Gallery website](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo). - -To use this script, you can download it from the PowerShell Gallery and run it on each computer, or you can install it directly from the PowerShell Gallery. To install it directly and capture the hardware hash from the local computer, use the following commands from an elevated Windows PowerShell prompt: - -```powershell -md c:\\HWID -Set-Location c:\\HWID -Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Install-Script -Name Get-WindowsAutoPilotInfo -Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv -``` - -The commands can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the [Get-WindowsAutoPilotInfo](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information about running the script. - ->[!IMPORTANT] ->Do not connect devices to the Internet prior to capturing the hardware ID and creating an Autopilot device profile. This includes collecting the hardware ID, uploading the .CSV into MSfB or Intune, assigning the profile, and confirming the profile assignment. Connecting the device to the Internet before this process is complete will result in the device downloading a blank profile that is stored on the device until it is explicity removed. In Windows 10 version 1809, you can clear the cached profile by restarting OOBE. In previous versions, the only way to clear the stored profile is to re-install the OS, reimage the PC, or run **sysprep /generalize /oobe**.
              ->After Intune reports the profile ready to go, only then should the device be connected to the Internet. - ->[!NOTE] ->If OOBE is restarted too many times it can enter a recovery mode and fail to run the Autopilot configuration. You can identify this scenario if OOBE displays multiple configuration options on the same page, including language, region, and keyboard layout. The normal OOBE displays each of these on a separate page. The following value key tracks the count of OOBE retries:
              ->**HKCU\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UserOOBE**
              ->To ensure OOBE has not been restarted too many times, you can change this value to 1. - -## Registering devices - - - - -Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism. - -- [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot). This is the preferred mechanism for all customers. -- [Partner Center](https://msdn.microsoft.com/partner-center/autopilot). This is used by CSP partners to register devices on behalf of customers. -- [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa). This is typically used by small and medium businesses (SMBs) who manage their devices using Microsoft 365 Business. -- [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles). You might already be using MSfB to manage your apps and settings. - -A summary of each platform's capabilities is provided below. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              Platform/Portal -Register devices? -Create/Assign profile -Acceptable DeviceID -
              OEM Direct APIYES - 1000 at a time maxNOTuple or PKID
              Partner CenterYES - 1000 at a time maxYESTuple or PKID or 4K HH
              IntuneYES - 500 at a time max\*YES\*4K HH
              Microsoft Store for BusinessYES - 1000 at a time maxYES4K HH
              Microsoft Business 365YES - 1000 at a time maxYES4K HH
              - ->*Microsoft recommended platform to use - -## Summary - -When deploying new devices using Windows Autopilot, the following steps are required: - -1. [Register devices](#registering-devices). Ideally, this step is performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually. -2. [Configure device profiles](profiles.md), specifying how the device should be deployed and what user experience should be presented. -3. Boot the device. When the device is connected to a network with internet access, it will contact the Windows Autopilot deployment service to see if the device is registered, and if it is, it will download profile settings such as the [Enrollment Status page](enrollment-status.md), which are used to customize the end user experience. - -## Other configuration settings - -- [Bitlocker encryption settings](bitlocker.md): You can configure the BitLocker encryption settings to be applied before automatic encryption is started. - diff --git a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md deleted file mode 100644 index 563e086966..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Windows Autopilot device guidelines -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot device guidelines - -**Applies to** - -- Windows 10 - -## Hardware and firmware best practice guidelines for Windows Autopilot - -All devices used with Windows Autopilot should meet the [minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) for Windows 10. - -The following additional best practices ensure that devices can easily be provisioned by organizations as part of the Windows Autopilot deployment process: -- Ensure that the TPM 2.0 is enabled and in a good state (not in Reduced Functionality Mode) by default on devices intended for Windows Autopilot self-deploying mode. -- The OEM provisions unique tuple info (SmbiosSystemManufacturer, SmbiosSystemProductName, SmbiosSystemSerialNumber) or PKID + SmbiosSystemSerialNumber into the [SMBIOS fields](https://docs.microsoft.com/windows-hardware/drivers/bringup/smbios) per Microsoft specification (Manufacturer, Product Name and Serial Number stored in SMBIOS Type 1 04h, Type 1 05h and Type 1 07h). -- The OEM uploads 4K Hardware Hashes obtained using OA3 Tool RS3+ run in Audit mode on full OS to Microsoft via CBR report prior to shipping devices to an Autopilot customer or channel partner. -- As a best practice, Microsoft requires that OEM shipping drivers are published to Windows Update within 30 days of the CBR being submitted, and system firmware and driver updates are published to Windows Update within 14 days -- The OEM ensures that the PKID provisioned in the SMBIOS is passed on to the channel. - -## Software best practice guidelines for Windows Autopilot - -- The Windows Autopilot device should be preinstalled with only a Windows 10 base image plus drivers and Office 365 Pro Plus Retail (C2R). -- Unless explicitly requested by the customer, no other preinstalled software should be included. - - Per OEM Policy, Windows 10 features, including built-in apps, should not be disabled or removed. - -## Related topics - -[Windows Autopilot customer consent](registration-auth.md)
              -[Motherboard replacement scenario guidance](autopilot-mbr.md)
              diff --git a/windows/deployment/windows-autopilot/autopilot-faq.md b/windows/deployment/windows-autopilot/autopilot-faq.md deleted file mode 100644 index 01cdb3ef63..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-faq.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Windows Autopilot support -ms.reviewer: -manager: laurawi -description: Support information for Windows Autopilot -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot FAQ - -**Applies to: Windows 10** - -This topic provides OEMs, partners, administrators, and end-users with answers to some frequently asked questions about deploying Windows 10 with Windows Autopilot. - -A [glossary](#glossary) of abbreviations used in this topic is provided at the end. - - -## Microsoft Partner Center - -| Question | Answer | -| --- | --- | -| In the Partner Center, does the Tenant ID need to be provided with every device file upload? Is this needed to allow the business customer to access their devices in MSfB? | No. Providing the Tenant ID is a one-time entry in the Partner Center that can be re-used with future device uploads. | -| How does the customer or tenant know that their devices are ready to be claimed in MSfB? | After the device file upload is completed in the Partner Center, the tenant can see the devices available for Windows Autopilot setup in MSfB. The OEM would need to advise the tenant to access MSfB. Auto-notification from MSfB to the tenant is being developed. | -| How does a customer authorize an OEM or Channel Partner to register Autopilot devices on the customer’s behalf? | Before an OEM or Channel Partner can register a device for Autopilot on behalf of a customer, the customer must first give them consent. The consent process begins with the OEM or Channel Partner sending a link to the customer, which directs the customer to a consent page in Microsoft Store for Business. The steps explaining this process are [here](registration-auth.md). | -| Are there any restrictions if a business customer has registered devices in MSfB and later wants those devices to be managed by a CSP via the Partner Center? | The devices will need to be deleted in MSfB by the business customer before the CSP can upload and manage them in the Partner Center. | -| Does Windows Autopilot support removing the option to enable a local administrator account? | Windows Autopilot doesn’t support removing the local admin account. However, it does support restricting the user performing AAD domain join in OOBE to a standard account (versus admin account by default).| -| How can I test the Windows Autopilot CSV file in the Partner Center? | Only CSP Partners have access to the Partner Center portal. If you are a CSP, you can create a Sales agent user account which has access to “Devices” for testing the file. This can be done today in the Partner Center.

              Go [here](https://msdn.microsoft.com/partner-center/create-user-accounts-and-set-permissions) for more information. | -| Must I become a Cloud Solution Provider (CSP) to participate in Windows Autopilot? | Top volume OEMs do not, as they can use the OEM Direct API. All others who choose to use MPC to register devices must become CSPs in order to access MPC. | -| Do the different CSP levels have all the same capabilities when it comes to Windows Autopilot? | For purposes of Windows Autopilot, there are three different types of CSPs, each with different levels of authority an access:

              1. Direct CSP: Gets direct authorization from the customer to register devices.

              2. Indirect CSP Provider: Gets implicit permission to register devices through the relationship their CSP Reseller partner has with the customer. Indirect CSP Providers register devices through Microsoft Partner Center.

              3. Indirect CSP Reseller: Gets direct authorization from the customer to register devices. At the same time, their indirect CSP Provider partner also gets authorization, which mean that either the Indirect Provider or the Indirect Reseller can register devices for the customer. However, the Indirect CSP Reseller must register devices through the MPC UI (manually uploading CSV file), whereas the Indirect CSP Provider has the option to register devices using the MPC APIs. | - -## Manufacturing - -| Question | Answer | -| --- | --- | -| What changes need to be made in the factory OS image for customer configuration settings? |No changes are required on the factory floor to enable Windows Autopilot deployment. | -| What version of the OA3 tool meets Windows Autopilot deployment requirements? | Windows Autopilot can work with any version of the OA3 tool. We recommend using Windows 10, version 1703 and above to generate the 4K Hardware Hash. | -| At the time of placing an order, do customers need to be state whether they want it with or without Windows Autopilot options? | Yes, if they want Windows Autopilot, they will want Windows 10, version 1703 or later versions. Also, they will want to receive the CSV file or have the file upload (i.e., registration) completed on their behalf. | -| Does the OEM need to manage or collect any custom imaging files from customers and perform any image uploads to Microsoft? | No change, OEMs just send the CBRs as usual to Microsoft. No images are sent to Microsoft to enable Windows Autopilot. Windows Autopilot only customizes OOBE and allows policy configurations (disables admin account, for example). | -| Are there any customer impacts to upgrading from Windows 8 to Windows 10? | The devices must have Windows 10, version 1703 or later to enroll in Windows Autopilot deployment, otherwise no impacts. | -| Will there be any change to the existing CBR with 4k Hardware Hash? | No. | -| What new information needs to be sent from the OEM to Microsoft? | Nothing, unless the OEM opts to register the device on the customer’s behalf, in which case they would upload the device ID via a CSV file into Microsoft Partner Center, or use the OEM Direct API. | -| Is there a contract or amendment for an OEM to participate in Windows Autopilot Deployment? | No. | - -## CSV schema - -| Question | Answer | -| --- | --- | -| Can a comma be used in the CSV file? | No. | -| What error messages can a user expect to see in the Partner Center or MSfB when uploading a file? | See the “In Microsoft Store for Business” section of this guide. | -| Is there a limit to the number of devices that can be listed in the CSV file? | Yes, the CSV file can only contain 1,000 devices to apply to a single profile. If more than 1,000 devices need to be applied to a profile, the devices need to be uploaded through multiple CSV files. | -| Does Microsoft have any recommendations on how an OEM should provide the CSV file to their customers? | Microsoft recommends encrypting the CSV file when sending to the business customer to self-register their Windows Autopilot devices (either through MPC, MSfB, or Intune). | - - -## Hardware hash - -| Question | Answer | -| --- | --- | -| Must every Hardware Hash submitted by the OEM contain the SMBIOS UUID (universally unique identifier), MAC (media access control) address and unique disk serial number (if using Windows 10, version 1703 and above OEM Activation 3.0 tool)? | Yes. Since Windows Autopilot is based on the ability to uniquely identify devices applying for cloud configuration, it is critical to submit Hardware Hashes which meet the outlined requirement. | -| What is the reason for needing the SMBIOS UUID, MAC Address and Disk Serial Number in the Hardware Hash details? | For creating the Hardware Hash, these are the fields that are needed to identify a device, as parts of the device are added/removed. Since we don’t have a unique identifier for Windows devices, this is the best logic to identify a device. | -| What is difference between OA3 Hardware Hash, 4K Hardware Hash, and Windows Autopilot Hardware Hash? | None. They’re different names for the same thing. The Windows 10, 1703 version of the OA3 tool output is called the OA3 Hash, which is 4K in size, which is usable for the Windows Autopilot deployment scenario. Note: When using a non-1703 version OA3Tool, you get a different sized Hash, which may not be used for Windows Autopilot deployment. | -| What is the thought around parts replacement and/or repair for the NIC (network interface controller) and/or Disk? Will the Hardware Hash become invalid? | Yes. If you replace parts, you need to gather the new Hardware Hash, though it depends on what is replaced, and the characteristics of the parts. For example, if you replace the TPM or motherboard, it’s a new device – you MUST have new Hardware Hash. If you replace one network card, it’s probably not a new device, and the device will function with the old Hardware Hash. However, as a best practice, you should assume the old Hardware Hash is invalid and get a new Hardware Hash after any hardware changes – this is Microsoft’s strong recommendation any time you replace parts. | - -## Motherboard replacement - -| Question | Answer | -| --- | --- | -| How does Autopilot handle motherboard replacement scenarios?” | Motherboard replacement is out for scope for Autopilot. Any device that is repaired or serviced in a way that alters the ability to identify the device for Windows Autopilot must go through the normal OOBE process, and manually select the right settings or apply a custom image - as is the case today.

              To reuse the same device for Windows Autopilot after a motherboard replacement, the device would need to be de-registered from Autopilot, the motherboard replaced, a new 4K HH harvested, and then re-registered using the new 4K HH (or device ID).

              **Note**: An OEM will not be able to use the OEM Direct API to re-register the device, since the OEM Direct API only accepts a tuple or PKID. In this case, the OEM would either have to send the new 4K HH info via a CSV file to customer, and let customer reregister the device via MSfB or Intune.| - -## SMBIOS - -| Question | Answer | -| --- | --- | -| Any specific requirement to SMBIOS UUID? | It must be unique as specified in the Windows 10 hardware requirements. | -| What is the requirement on the SMBIOS table to meet the Windows Autopilot Hardware Hash need? | It must meet all the Windows 10 hardware requirements. Additional details may be found [here](https://msdn.microsoft.com/library/jj128256(v=vs.85).aspx). | -| If the SMBIOS supports UUID and Serial Number, is it enough for the OA3 tool to generate the Hardware Hash? | No. At a minimum, the following SMBIOS fields need to be populated with unique values: ProductKeyID SmbiosSystemManufacturer SmbiosSystemProductName SmbiosSystemSerialNumber SmbiosSkuNumber SmbiosSystemFamily MacAddress SmbiosUuid DiskSerialNumber TPM EkPub | - -## Technical interface - -| Question | Answer | -| --- | --- | -| What is the interface to get the MAC Address and Disk Serial Number? How does the OA tool get MAC and Disk Serial #? | Disk serial number is found from IOCTL_STORAGE_QUERY_PROPERTY with StorageDeviceProperty/PropertyStandardQuery. Network MAC address is IOCTL_NDIS_QUERY_GLOBAL_STATS from OID_802_3_PERMANENT_ADDRESS. However the exact mechanisms/”interface” for doing this operation varies depending on the exact scenario being discussed. | -| Follow up clarification: If we have 2-3 MACs on the system, how does OA Tool choose which MAC Address and Disk Serial Number on the system since there are multiple instances of each? If a platform has LAN And WLAN, which MAC is chosen? | In short, all available values are used. In detail, there may be extra specific usage rules. The System disk serial number is more important than any other disks available. Network interfaces that are removable should not be used if detected as they are removable. LAN vs WLAN should not matter, both will be used. | - -## The end user experience - -|Question|Answer| -|----|-----| -|How do I know that I received Autopilot?|You can tell that you received Windows Autopilot (as in the device received a configuration but has not yet applied it) when you skip the selection page (as seen below), and are immediately taken to a generic or customized sign-in page.| -|Windows Autopilot didn’t work, what do I do now?| Questions and actions to assist in troubleshooting: Did a screen not get skipped? Did a user end up as an admin when configured not to? Remember that AAD Admins will be local admins regardless of whether Windows Autopilot is configured to disable local admin Collection information – run licensingdiag.exe and send the .cab (Cabinet file) file that is generated to AutopilotHelp@microsoft.com. If possible, collect an ETL from WPR. Often in these cases, users are not signing into the right AAD tenant, or are creating local user accounts. For a complete list of support options, refer to [Windows Autopilot support](autopilot-support.md). | -| If an Administrator makes changes to an existing profile, will the changes take effect on devices that have that profile assigned to them that have already been deployed? |No. Windows Autopilot profiles are not resident on the device. They are downloaded during OOBE, the settings defined at the time are applied. Then, the profile is discarded on the device. If the device is re-imaged or reset, the new profile settings will take effect the next time the device goes through OOBE.| -|What is the experience if a device isn’t registered or if an IT Admin doesn’t configure Windows Autopilot prior to an end user attempting to self-deploy? |If the device isn’t registered, it will not receive the Windows Autopilot experience and the end user will go through normal OOBE. The Windows Autopilot configurations will NOT be applied until the user runs through OOBE again, after registration. If a device is started before an MDM profile is created, the device will go through standard OOBE experience. The IT Admin would then have to manually enrol that device into the MDM, after which—the next time that device is “reset”—it will go through the Windows Autopilot OOBE experience.| -|What may be a reason why I did not receive a customized sign-in screen during Autopilot? |Tenant branding must be configured in portal.azure.com to receive a customized sign-in experience.| -|What happens if a device is registered with Azure AD but does not have an Windows Autopilot profile assigned? |The regular AAD OOBE will occur since no Windows Autopilot profile was assigned to the device.| -|How can I collect logs on Autopilot?|The best way to collect logs on Windows Autopilot performance is to collect a Windows Performance Recorder (WPR) trace during OOBE. The XML file (WPRP extension) for this trace may be provided upon request.| - -## MDM - -| Question | Answer | -| --- | --- | -| Must we use Intune for our MDM? | No. No, any MDM will work with Autopilot, but others probably won’t have the same full suite of Windows Autopilot features as Intune. You’ll get the best experience from Intune. | -| Can Intune support Win32 app preinstalls? | Yes. Starting with the Windows 10 October Update (version 1809), Intune supports Win32 apps using .msi (and .msix) wrappers. | -| What is co-management? | Co-management is when you use a combination of a cloud MDM tool (Intune) and an on-premise configuration tool like System Center Configuration Manager (SCCM). You only need to use SCCM if Intune can’t support what you want to do with your profile. If you choose to co-manage using Intune + SCCM, you do it by including an SCCM agent in your Intune profile. When that profile is pushed to the device, the device will see the SCCM agent and go out to SCCM to pull down any additional profile settings. | -| Must we use System Center Configuration Manager (SCCM) for Windows Autopilot | No. Co-management (described above) is optional. | - - -## Features - -| Question | Answer | -| --- | --- | -| Self-deploying mode | A new version of Windows Autopilot where the user only turns on the device, and nothing else. It’s useful for scenarios where a standard user account isn’t needed (e.g., shared devices, or KIOSK devices). | -| Hybrid Azure Active Directory join | Allows Windows Autopilot devices to connect to an on-premise Active Directory domain controller (in addition to being Azure AD joined). | -| Windows Autopilot reset | Removes user apps and settings from a device, but maintains AAD domain join and MDM enrollment. Useful for when transferring a device from one user to another. | -| Personalization | Adds the following to the OOBE experience: A personalized welcome message can be created A username hint can be added Sign-in page text can be personalized The company’s logo can be included | -| [Autopilot for existing devices](existing-devices.md) | Offers an upgrade path to Windows Autopilot for all existing Win 7/8 devices. | - - - -## General - -|Question|Answer -|------------------|-----------------| -|If I wipe the machine and restart, will I still receive Windows Autopilot?|Yes, if the device is still registered for Windows Autopilot and is running Windows 10, version 1703 7B and above releases, it will receive the Windows Autopilot experience.| -|Can I harvest the device fingerprint on existing machines?|Yes, if the device is running Windows 10, version 1703 and above, you can harvest device fingerprints for registration. There are no plans to backport the functionality to previous releases and no way to harvest them on pre-Windows 10 Windows 10, version 1703 devices that have not been updated to Windows 10, version 1703.| -|What is Windows 10, version 1703 7B and why does it matter?| Windows 10, version 1703 7B is a Windows 10, version 1703 image bundled with cumulative updates. To receive Autopilot, clients **must** run Windows 10, version 1703 7B or later. These cumulative updates contain a critical fix for Autopilot. Consider the following:

              Windows Autopilot will not apply its profiles to the machine unless AAD credentials match the expected AAD tenant. For the Windows 10, version 1703 release, it was assumed that would be determined by the domain name, so the domain name used to register (for example contoso.com) should match the domain name used to sign in (for example user@contoso.com). But what happens if your tenant has multiple domains (for example us.contoso.com, or fr.contoso.com)? Since these domain names do not match, the device will not be configured for Autopilot. However, both domains are part of the same AAD tenant, and as such it was determined the matching scheme was not useful. This was improved upon by making use of the tenant ID. By using the tenant ID, we can determine that if the user signs into a domain with a tenant matching the one they registered with, we can safely consider this to be a match. The fix for this problem already exists in Windows 10, version 1709 and was backported into the Windows 10, version 1703 7B release.

              **Key Take-Aways**: When using pre-Windows 10, version 1703 7B clients the user’s domain **must** match the domain they registered with. This functionality is found in Windows 10 version 1709 clients using build >= 16215, and Windows 10, version 1703 clients >= 7B. | -|What is the impact of not updating to 7B?|See the detailed scenario described directly above.| -|Is Windows Autopilot supported on other SKUs, e.g. Surface Hub, HoloLens, Windows Mobile.|No, Windows Autopilot isn’t supported on other SKUs.| -|Does Windows Autopilot work after MBR or image re-installation?|Yes.| -| Can machines that have reimaged a few times go through Autopilot? What does the error message "This user is not authorized to enroll" mean? Error code 801c0003. |There are limits to the number of devices a particular AAD user can enroll in AAD, as well as the number of devices that are supported per user in Intune. (These are somewhat configurable but not “infinite.”) You’ll run into this frequently if you reuse the devices, or even if you roll back to previous virtual machine snapshots.| -|What happens if a device is registered to a malicious agent? |By design, Windows Autopilot does not apply a profile until the user signs in with the matching tenant for the configured profile via the AAD sign-in process. What occurs is illustrated below. If badguys.com registers a device owned by contoso.com, at worst, the user would be directed to sign into badguys.com. When the user enters their email/password, the sign-in information is redirected through AAD to the proper AAD authentication and the user is prompted to then sign into contoso.com. Since contoso.com does not match badguys.com as the tenant, the Windows Autopilot profile will not be applied and the regular AAD OOBE will occur.| -|Where is the Windows Autopilot data stored? |Windows Autopilot data is stored in the United States (US), not in a sovereign cloud, even when the AAD tenant is registered in a sovereign cloud. This is applicable to all Windows Autopilot data, regardless of the portal leveraged to deploy Autopilot.| -|Why is Windows Autopilot data stored in the US and not in a sovereign cloud?|It is not customer data that we store, but business data which enables Microsoft to provide a service, therefore it is okay for the data to reside in the US. Customers can stop subscribing to the service any time, and, in that event, the business data is removed by Microsoft.| -|How many ways are there to register a device for Windows Autopilot|There are six ways to register a device, depending on who is doing the registering:

              1. OEM Direct API (only available to TVOs)
              2. MPC via the MPC API (must be a CSP)
              3. MPC via manual upload of CSV file in the UI (must be a CSP)
              4. MSfB via CSV file upload
              5. Intune via CSV file upload
              6. Microsoft 365 Business portal via CSV file upload| -|How many ways are there to create a Windows Autopilot profile?|There are four ways to create & assign an Windows Autopilot profile:

              1. Through MPC (must be a CSP)
              2. Through MSfB
              3. Through Intune (or another MDM)
              4. Microsoft 365 Business portal

              Microsoft recommends creation and assignment of profiles through Intune. | -| What are some common causes of registration failures? |1. Bad or missing Hardware hash entries can lead to faulty registration attempts
              2. Hidden special characters in CSV files.

              To avoid this issue, after creating your CSV file, open it in Notepad to look for hidden characters or trailing spaces or other corruptions.| -| Is Autopilot supported on IoT devices? | Autopilot is not supported on IoT Core devices, and there are currently no plans to add this support. Autopilot is supported on Windows 10 IoT Enterprise SAC devices. Autopilot is supported on Windows 10 Enterprise LTSC 2019 and above; it is not supported on earlier versions of LTSC.| -| Is Autopilot supported in all regions/countries? | Autopilot only supports customers using public Azure. Public Azure does not include the three entities listed below:
              - Azure Germany
              - Azure China
              - Azure Government
              So, if a customer is set up in global Azure, there are no region restrictions. For example, if Contoso uses global Azure but has employees working in China, the Contoso employees working in China would be able to use Autopilot to deploy devices. If Contoso uses Azure China, the Contoso employees would not be able to use Autopilot.| - -## Glossary - -| Term | Meaning | -| --- | --- | -| CSV | Comma Separated Values (File type similar to Excel spreadsheet) | -| MPC | Microsoft Partner Center | -| MDM | Mobile Device Management | -| OEM | Original Equipment Manufacturer | -| CSP | Cloud Solution Provider | -| MSfB | Microsoft Store for Business | -| AAD | Azure Active Directory | -| 4K HH | 4K Hardware Hash | -| CBR | Computer Build Report | -| EC | Enterprise Commerce | -| DDS | Device Directory Service | -| OOBE | Out of the Box Experience | -| UUID | Universally Unique Identifier | diff --git a/windows/deployment/windows-autopilot/autopilot-mbr.md b/windows/deployment/windows-autopilot/autopilot-mbr.md deleted file mode 100644 index f103766d0d..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-mbr.md +++ /dev/null @@ -1,420 +0,0 @@ ---- -title: Windows Autopilot motherboard replacement -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment MBR scenarios -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot motherboard replacement scenario guidance - -**Applies to** - -- Windows 10 - -This document offers guidance for Windows Autopilot device repair scenarios that Microsoft partners can use in Motherboard Replacement (MBR) situations, and other servicing scenarios. - -Repairing Autopilot enrolled devices is complex, as it tries to balance OEM requirements with Windows Autopilot requirements. Specifically, OEM’s require strict uniqueness across motherboards, MAC addresses, etc., while Windows Autopilot requires strict uniqueness at the Hardware ID level for each device to enable successful registration. The Hardware ID does not always accommodate all the OEM hardware component requirements, thus these requirements are sometimes at odds, causing issues with some repair scenarios. - -**Motherboard Replacement (MBR)** - -If a motherboard replacement is needed on a Windows Autopilot device, the following process is recommended: - -1. [Deregister the device](#deregister-the-autopilot-device-from-the-autopilot-program) from Windows Autopilot -2. [Replace the motherboard](#replace-the-motherboard) -3. [Capture a new device ID (4K HH)](#capture-a-new-autopilot-device-id-4k-hh-from-the-device) -4. [Reregister the device](#reregister-the-repaired-device-using-the-new-device-id) with Windows Autopilot -5. [Reset the device](#reset-the-device) -6. [Return the device](#return-the-repaired-device-to-the-customer) - -Each of these steps is described below. - -## Deregister the Autopilot device from the Autopilot program - -Before the device arrives at the repair facility, it must be deregistered by the entity that registered it. Only the entity that registered the device can deregister it. This might be the customer IT Admin, the OEM, or the CSP partner. If the IT Admin registered the device, they likely did so via Intune (or possibly the Microsoft Store for Business). In that case, they should deregister the device from Intune (or MSfB). This is necessary because devices registered in Intune will not show up in MPC. However, if the OEM or CSP partner registered the device, they likely did so via the Microsoft Partner Center (MPC). In that case, they should deregister the device from MPC, which will also remove it from the customer IT Admin’s Intune account. Below, we describe the steps an IT Admin would go through to deregister a device from Intune, and the steps an OEM or CSP would go through to deregister a device from MPC. - -**NOTE**: When possible, an OEM or CSP should register Autopilot devices, rather than having the customer do it. This will avoid problems where OEMs or CSPs may not be able to deregister a device if, for example, a customer leasing a device goes out of business before deregistering it themselves. - -**EXCEPTION**: If a customer grants an OEM permission to register devices on their behalf via the automated consent process, then an OEM can use the API to deregister devices they didn’t register themselves (instead, the customer registered the devices). But keep in mind that this would only remove those devices from the Autopilot program, it would not disenroll them from Intune or disjoin them from AAD. The customer must do those steps, if desired, through Intune. - -### Deregister from Intune - -To deregister an Autopilot device from Intune, an IT Admin would: - -1. Sign in to their Intune account -2. Navigate to Intune > Groups > All groups -3. Remove the desired device from its group -4. Navigate to Intune > Devices > All devices -5. Select the checkbox next to the device you want to delete, then click the Delete button on the top menu -6. Navigate to Intune > Devices > Azure AD devices -7. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu -8. Navigate to Intune > Device enrollment > Windows enrollment > Devices -9. Select the checkbox next to the device you want to deregister -10. Click the extended menu icon (“…”) on the far right end of the line containing the device you want to deregister in order to expose an additional menu with the option to “unassign user” -11. Click “Unassign user” if the device was previously assigned to a user; if not, this option will be grayed-out and can be ignored -12. With the unassigned device still selected, click the Delete button along the top menu to remove this device - -**NOTE**: These steps deregister the device from Autopilot, but also unenroll the device from Intune, and disjoin the device from AAD. While it may appear that only deregistering the device from Autopilot is needed, there are certain barriers in place within Intune that necessitate all the steps above be done, which is best practice anyway in case the device gets lost or becomes unrecoverable, to eliminate the possibility of orphaned devices existing in the Autopilot database, or Intune, or AAD. If a device gets into an unrecoverable state, you can contact the appropriate [Microsoft support alias](autopilot-support.md) for assistance. - -The deregistration process will take about 15 minutes. You can accelerate the process by clicking the “Sync” button, then “Refresh” the display until the device is no longer present. - -More details on deregistering devices from Intune can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group). - -### Deregister from MPC - -To deregister an Autopilot device from the Microsoft Partner Center (MPC), a CSP would: - -1. Log into MPC -2. Navigate to Customer > Devices -3. Select the device to be deregistered and click the “Delete device” button - -![devices](images/devices.png) - -**NOTE**: Deregistering a device from Autopilot in MPC does only that; it does not also unenroll the device from the MDM (Intune), nor does it disjoin the device from AAD. Therefore, if possible, the OEM/CSP ideally should work with the customer IT Admin to have the device fully removed per the Intune steps in the previous section. - -Alternatively, an OEM partner that has integrated the OEM Direct APIs can deregister a device by calling the AutopilotDeviceRegistration API with the TenantID and TenantDomain fields left blank in the request call. - -Because the repair facility will not have access to the user’s login credentials, the repair facility will have to reimage the device as part of the repair process. This means that the customer should do three things before sending the device off for repair: -1. Copy all important data off the device. -2. Let the repair facility know which version of Windows they should reinstall after the repair. -3. If applicable, let the repair facility know which version of Office they should reinstall after the repair. - -## Replace the motherboard - -Technicians replace the motherboard (or other hardware) on the broken device. A replacement DPK is injected. - -Repair and key replacement processes vary between facilities. Sometimes repair facilities receive motherboard spare parts from OEMs that have replacement DPKs already injected, but sometimes not. Sometimes repair facilities receive fully-functional BIOS tools from OEMs, but sometimes not. This means that the quality of the data in the BIOS after a MBR varies. To ensure the repaired device will still be Autopilot-capable following its repair, the new (post-repair) BIOS should be able to successfully gather and populate the following information at a minimum: - -- DiskSerialNumber -- SmbiosSystemSerialNumber -- SmbiosSystemManufacturer -- SmbiosSystemProductName -- SmbiosUuid -- TPM EKPub -- MacAddress -- ProductKeyID -- OSType - -**NOTE**: For simplicity, and because processes vary between repair facilities, we have excluded many of the additional steps often used in a MBR, such as: -- Verify that the device is still functional -- Disable BitLocker* -- Repair the Boot Configuration Data (BCD) -- Repair and verify the network driver operation - -*BitLocker can be suspended rather than disbled if the technician has the ability to resume it after the repair. - -## Capture a new Autopilot device ID (4K HH) from the device - -Repair technicians must sign in to the repaired device to capture the new device ID. Assuming the repair technician does NOT have access to the customer’s login credentials, they will have to reimage the device in order to gain access, per the following steps: - -1. The repair technician creates a [WinPE bootable USB drive](https://docs.microsoft.com/windows-hardware/manufacture/desktop/oem-deployment-of-windows-10-for-desktop-editions#create-a-bootable-windows-pe-winpe-partition). -2. The repair technician boots the device to WinPE. -3. The repair technician [applies a new Windows image to the device](https://docs.microsoft.com/windows-hardware/manufacture/desktop/work-with-windows-images). - - **NOTE**: Ideally, the same version of Windows should be reimaged onto the device that was originally on the device, so some coordination will be required between the repair facility and customer to capture this information at the time the device arrives for repair. This might include the customer sending the repair facility a customized image (.ppk file) via a USB stick, for example. - -4. The repair technician boots the device into the new Windows image. -5. Once on the desktop, the repair technician captures the new device ID (4K HH) off the device using either the OA3 Tool or the PowerShell script, as described below. - -Those repair facilities with access to the OA3 Tool (which is part of the ADK) can use the tool to capture the 4K Hardware Hash (4K HH). - -Alternatively, the [WindowsAutoPilotInfo Powershell script](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) can be used to capture the 4K HH by following these steps: - -1. Install the script from the [PowerShell Gallery](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) or from the command line (command line installation is shown below). -2. Navigate to the script directory and run it on the device when the device is either in Full OS or Audit Mode. See the following example. - - ```powershell - md c:\HWID - Set-Location c:\HWID - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force - Install-Script -Name Get-WindowsAutopilotInfo -Force - Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv - ``` - ->If you are prompted to install the NuGet package, choose **Yes**.
              ->If, after installing the script you get an error that Get-WindowsAutopilotInfo.ps1 is not found, verify that C:\Program Files\WindowsPowerShell\Scripts is present in your PATH variable.
              ->If the Install-Script cmdlet fails, verify that you have the default PowerShell repository registered (**Get-PSRepository**) or register the default repository with **Register-PSRepository -Default -Verbose**. - -The script creates a .csv file that contains the device information, including the complete 4K HH. Save this file so that you can access it later. The service facility will use this 4K HH to reregister device as described below. Be sure to use the -OutputFile parameter when saving the file, which ensures that file formatting is correct. Do not attempt to pipe the command output to a file manually. - -**NOTE**: If the repair facility does not have the ability to run the OA3 tool or PowerShell script to capture the new 4K HH, then the CSP (or OEM) partners must do this for them. Without some entity capturing the new 4K HH, there is no way to reregister this device as an Autopilot device. - - -## Reregister the repaired device using the new device ID - -If an OEM is not able to reregister the device, then the repair facility or CSP should reregister the device using MPC, or the customer IT Admin should be advised to reregister the device via Intune (or MSfB). Both ways of reregistering a device are shown below. - -### Reregister from Intune - -To reregister an Autopilot device from Intune, an IT Admin would: -1. Sign in to Intune. -2. Navigate to Device enrollment > Windows enrollment > Devices > Import. -3. Click the **Import** button to upload a csv file containing the device ID of the device to be reregistered (the device ID was the 4K HH captured by the PowerShell script or OA3 tool described previously in this document). - -The following video provides a good overview of how to (re)register devices via MSfB.
              - -> [!VIDEO https://www.youtube.com/embed/IpLIZU_j7Z0] - -### Reregister from MPC - -To reregister an Autopilot device from MPC, an OEM or CSP would: - -1. Sign in to MPC. -2. Navigate to the Customer > Devices page and click the **Add devices** button to upload the csv file. - -![device](images/device2.png)
              -![device](images/device3.png) - -In the case of reregistering a repaired device through MPC, the uploaded csv file must contain the 4K HH for the device, and not just the PKID or Tuple (SerialNumber + OEMName + ModelName). If only the PKID or Tuple were used, the Autopilot service would be unable to find a match in the Autopilot database, since no 4K HH info was ever previously submitted for this essentially “new” device, and the upload will fail, likely returning a ZtdDeviceNotFound error. So, again, only upload the 4K HH, not the Tuple or PKID. - -**NOTE**: When including the 4K HH in the csv file, you do NOT also need to include the PKID or Tuple. Those columns may be left blank, as shown below: - -![hash](images/hh.png) - -## Reset the device - -Since the device was required to be in Full OS or Audit Mode to capture the 4K HH, the repair facility must reset the image back to a pre-OOBE state before returning it to the customer. One way this can be accomplished is by using the built-in reset feature in Windows, as follows: - -On the device, go to Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Finally, click on Reset. - -![reset](images/reset.png) - -However, it’s likely the repair facility won’t have access to Windows because they lack the user credentials to login, in which case they need to use other means to reimage the device, such as the [Deployment Image Servicing and Management tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/oem-deployment-of-windows-10-for-desktop-editions#use-a-deployment-script-to-apply-your-image). - -## Return the repaired device to the customer - -After completing the previous steps, the repaired device can now be returned to the customer, and will be auto-enrolled into the Autopilot program on first boot-up during OOBE. - -**NOTE**: If the repair facility did NOT reimage the device, they could be sending it back in a potentially broken state (e.g., there’s no way to log into the device because it’s been dissociated from the only known user account), in which case they should tell the organization that they need to fix the registration and OS themselves. - -**IMPORTANT**: A device can be “registered” for Autopilot prior to being powered-on, but the device isn’t actually “deployed” to Autopilot (i.e., enabled as an Autopilot device) until it goes through OOBE, which is why resetting the device back to a pre-OOBE state is a required step. - -## Specific repair scenarios - -This section covers the most common repair scenarios, and their impact on Autopilot enablement. - -NOTES ON TEST RESULTS: - -- Scenarios below were tested using Intune only (no other MDMs were tested). -- In most test scenarios below, the repaired and reregistered device needed to go through OOBE again for Autopilot to be enabled. -- Motherboard replacement scenarios often result in lost data, so repair centers or customers should be reminded to backup data (if possible) prior to repair. -- In the cases where a repair facility does not have the ability to write device info into the BIOS of the repaired device, new processes need to be created to successfully enable Autopilot. -- Repaired device should have the Product Key (DPK) preinjected in the BIOS before capturing the new 4K HH (device ID) - -In the following table:
              -- Supported = **Yes**: the device can be reenabled for Autopilot -- Supported = **No**: the device cannot be reenabled for Autopilot - - -
              ScenarioSupportedMicrosoft Recommendation -
              Motherboard Replacement (MBR) in generalYesThe recommended course of action for MBR scenarios is: - -1. Autopilot device is deregistered from the Autopilot program -2. The motherboard is replace -3. The device is reimaged (with BIOS info and DPK reinjected)* -4. A new Autopilot device ID (4K HH) is captured off the device -5. The repaired device is reregistered for the Autopilot program using the new device ID -6. The repaired device is reset to boot to OOBE -7. The repaired device is shipped back to the customer - -*It’s not necessary to reimage the device if the repair technician has access to the customer’s login credentials. It’s technically possible to do a successful MBR and Autopilot re-enablement without keys or certain BIOS info (e.g., serial #, model name, etc.), but doing so is only recommended for testing/educational purposes. - -
              MBR when motherboard has a TPM chip (enabled) and only one onboard network card (that also gets replaced)Yes - -1. Deregister damaged device -2. Replace motherboard -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write device info into BIOS -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
              MBR when motherboard has a TPM chip (enabled) and a second network card (or network interface) that is not replaced along with the motherboardNoThis scenario is not recommended, as it breaks the Autopilot experience, because the resulting Device ID will not be stable until after TPM attestation has completed, and even then registration may give incorrect results because of ambiguity with MAC Address resolution. -
              MBR where the NIC card, HDD, and WLAN all remain the same after the repairYes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write old device info into BIOS (same s/n, model, etc.)* -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -*Note that for this and subsequent scenarios, rewriting old device info would not include the TPM 2.0 endorsement key, as the associated private key is locked to the TPM device - -
              MBR where the NIC card remains the same, but the HDD and WLAN are replacedYes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Insert new HDD and WLAN -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
              MBR where the NIC card and WLAN remains the same, but the HDD is replacedYes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Insert new HDD -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
              MBR where only the MB is replaced (all other parts remain same) but new MB was taken from a previously used device that had NOT been Autopilot-enabled before.Yes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
              MBR where only the MB is replaced (all other parts remain same) but new MB was taken from a previously used device that HAD been Autopilot-enabled before.Yes - -1. Deregister old device from which MB will be taken -2. Deregister damaged device (that you want to repair) -3. Replace motherboard in repair device with MB from other Autopilot device (with new RDPK preinjected in BIOS) -4. Reimage device (to gain access), unless have access to customers’ login credentials -5. Write old device info into BIOS (same s/n, model, etc.) -6. Capture new 4K HH -7. Reregister repaired device -8. Reset device back to OOBE -9. Go through Autopilot OOBE (customer) -10. Autopilot successfully enabled - -NOTE: The repaired device can also be used successfully as a normal, non-Autopilot device. - -
              BIOS info excluded from MBR deviceNoRepair facility does not have BIOS tool to write device info into BIOS after MBR. - -1. Deregister damaged device -2. Replace motherboard (BIOS does NOT contain device info) -3. Reimage and write DPK into image -4. Capture new 4K HH -5. Reregister repaired device -6. Create Autopilot profile for device -7. Go through Autopilot OOBE (customer) -8. Autopilot FAILS to recognize repaired device - -
              MBR when there is no TPM chipYesThough we do not recommend enabling an Autopilot devices without a TPM chip (which is recommended for BitLocker encryption), it is possible to enable an Autopilot devices in “standard user” mode (but NOT Self-deploying mode) that does not have a TPM chip. In this case, you would: - -1. Deregister damaged device -2. Replace motherboard -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
              New DPK written into image on repaired Autopilot device with a new MBYesRepair facility replaces normal MB on damaged device. MB does not contain any DPK in the BIOS. Repair facility writes DPK into image after MBR. - -1. Deregister damaged device -2. Replace motherboard – BIOS does NOT contain DPK info -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reset or reimage device to pre-OOBE and write DPK into image -7. Reregister repaired device -8. Go through Autopilot OOBE -9. Autopilot successfully enabled - -
              New Repair Product Key (RDPK)YesUsing a MB with a new RDPK preinjected results in a successful Autopilot refurbishment scenario. - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Reimage or rest image to pre-OOBE -4. Write device info into BIOS -5. Capture new 4K HH -6. Reregister repaired device -7. Reimage or reset image to pre-OOBE -8. Go through Autopilot OOBE -9. Autopilot successfully enabled - -
              No Repair Product Key (RDPK) injectedNoThis scenario violates Microsoft policy and breaks the Windows Autopilot experience. -
              Reimage damaged Autopilot device that was not deregistered prior to repairYes, but the device will still be associated with previous tenant ID, so should only be returned to same customer - -1. Reimage damaged device -2. Write DPK into image -3. Go through Autopilot OOBE -4. Autopilot successfully enabled (to previous tenant ID) - -
              Disk replacement from a non-Autopilot device to an Autopilot deviceYes - -1. Do not deregister damaged device prior to repair -2. Replace HDD on damaged device -3. Reimage or reset image back to OOBE -4. Go through Autopilot OOBE (customer) -5. Autopilot successfully enabled (repaired device recognized as its previous self) - -
              Disk replacement from one Autopilot device to another Autopilot deviceMaybeIf the device from which the HDD is taken was itself previously deregistered from Autopilot, then that HDD can be used in a repair device. But if the HDD was never previously deregistered from Autopilot before being used in a repaired device, the newly repaired device will not have the proper Autopilot experience. - -Assuming the used HDD was previously deregistered (before being used in this repair): - -1. Deregister damaged device -2. Replace HDD on damaged device using a HDD from another deregistered Autopilot device -3. Reimage or rest the repaired device back to a pre-OOBE state -4. Go through Autopilot OOBE (customer) -5. Autopilot successfully enabled - -
              Third party network card replacement NoWhether from a non-Autopilot device to an Autopilot device, from one Autopilot device to another Autopilot device, or from an Autopilot device to a non-Autopilot device, any scenario where a 3rd party (not onboard) Network card is replaced will break the Autopilot experience, and is not recommended. -
              A device repaired more than 3 timesNoAutopilot is not supported when a device is repeatedly repaired, so that whatever parts NOT replaced become associated with too many parts that have been replaced, which would make it difficult to uniquely identify that device in the future. -
              Memory replacementYesReplacing the memory on a damaged device does not negatively affect the Autopilot experience on that device. No de/reregistration is needed. The repair technician simply needs to replace the memory. -
              GPU replacementYesReplacing the GPU(s) on a damaged device does not negatively affect the Autopilot experience on that device. No de/reregistration is needed. The repair technician simply needs to replace the GPU. -
              - ->When scavenging parts from another Autopilot device, we recommend unregistering the scavenged device from Autopilot, scavenging it, and then NEVER REGISTERING THE SCAVENGED DEVICE (AGAIN) FOR AUTOPILOT, because reusing parts this way may cause two active devices to end up with the same ID, with no possibility of distinguishing between the two. - -**NOTE**: The following parts may be replaced without compromising Autopilot enablement or requiring special additional repair steps: -- Memory (RAM or ROM) -- Power Supply -- Video Card -- Card Reader -- Sound card -- Expansion card -- Microphone -- Webcam -- Fan -- Heat sink -- CMOS battery - -Other repair scenarios not yet tested and verified include: -- Daughterboard replacement -- CPU replacement -- Wifi replacement -- Ethernet replacement - -## FAQ - -| Question | Answer | -| --- | --- | -| If we have a tool that programs product information into the BIOS after the MBR, do we still need to submit a CBR report for the device to be Autopilot-capable? | No. Not if the in-house tool writes the minimum necessary information into the BIOS that the Autopilot program looks for to identify the device, as described earlier in this document. | -| What if only some components are replaced rather than the full motherboard? | While it’s true that some limited repairs do not prevent the Autopilot algorithm from successfully matching the post-repair device with the pre-repair device, it is best to ensure 100% success by going through the MBR steps above even for devices that only needed limited repairs. | -| How does a repair technician gain access to a broken device if they don’t have the customer’s login credentials? | The technician will have to reimage the device and use their own credentials during the repair process. | - -## Related topics - -[Device guidelines](autopilot-device-guidelines.md)
              diff --git a/windows/deployment/windows-autopilot/autopilot-support.md b/windows/deployment/windows-autopilot/autopilot-support.md deleted file mode 100644 index b3e02db65f..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-support.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Windows Autopilot support -description: Support information for Windows Autopilot -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.date: 10/31/2018 -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot support information - -**Applies to: Windows 10** - -The following table displays support information for the Windows Autopilot program. - -Before contacting the resources listed below for Windows Autopilot-related issues, check the [Windows Autopilot FAQ](autopilot-faq.md). - - -| Audience | Support contact | -|---------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| OEM or Channel Partner registering devices as a CSP (via MPC) | Use the help resources available in MPC. Whether you are a named partner or a channel partner (distributor, reseller, SI, etc.), if you’re a CSP registering Autopilot devices through MPC (either manually or through the MPC API), your first-line of support should be the help resources within MPC. | -| OEM registering devices using OEM Direct API | Contact MSOEMOPS@microsoft.com. Response time depends on priority:
              Low – 120 hours
              Normal – 72 hours
              High – 24 hours
              Immediate – 4 hours | -| OEM with a PFE | Reach out to your PFE for support. | -| Partners with a Partner Technology Strategist (PTS) | If you have a PTS (whether you’re a CSP or not), you may first try working through your account’s specific Partner Technology Strategist (PTS). | -| Partners with an Ecosystem PM | If you have an Ecosystem PM (whether you’re a CSP or not), you may first try working through your account’s specific Ecosystem PM, especially for technical issues. | -| Enterprise customers | Contact your Technical Account Manager (TAM), or Account Technology Strategist (ATS), or Customer Service Support (CSS) representative. | -| End-user | Contact your IT administrator. | -| Microsoft Partner Center (MPC) users | Use the [help resources](https://partner.microsoft.com/support) available in MPC. | -| Microsoft Store for Business (MSfB) users | Use the help resources available in MSfB. | -| Intune users | From the Microsoft Azure portal, click [Help + support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview). | -| Microsoft 365 Business | Support is accessible directly through the Microsoft 365 Business portal when logged in: https://support.microsoft.com/en-us. | -| Queries relating to MDA testing | Contact MDAHelp@microsoft.com. | -| All other queries, or when unsure who to contact | Contact msoemops@microsoft.com. | - diff --git a/windows/deployment/windows-autopilot/bitlocker.md b/windows/deployment/windows-autopilot/bitlocker.md deleted file mode 100644 index 7e85f7099d..0000000000 --- a/windows/deployment/windows-autopilot/bitlocker.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Setting the BitLocker encryption algorithm for Autopilot devices -ms.reviewer: -manager: laurawi -description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows 10 devices. -keywords: Autopilot, BitLocker, encryption, 256-bit, Windows 10 -ms.prod: w10 -ms.technology: Windows -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Setting the BitLocker encryption algorithm for Autopilot devices - -**Applies to** - -- Windows 10 - -With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins. - -The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. - -To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices: - -1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. -2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. - - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. -3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. - - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. - -An example of Microsoft Intune Windows Encryption settings is shown below. - - ![BitLocker encryption settings](images/bitlocker-encryption.png) - -Note that a device which is encrypted automatically will need to be decrypted prior to changing the encyption algorithm. - -The settings are available under Device Configuration -> Profiles -> Create profile -> Platform = Windows 10 and later, Profile type = Endpoint protection -> Configure -> Windows Encryption -> BitLocker base settings, Configure encryption methods = Enable. - -Note: It is also recommended to set Windows Encryption -> Windows Settings -> Encrypt = **Require**. - -## Requirements - -Windows 10, version 1809 or later. - -## See also - -[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 294a31c04b..4753557b61 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -1,8 +1,8 @@ --- title: Demonstrate Autopilot deployment -ms.reviewer: +ms.reviewer: manager: laurawi -description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment +description: In this article, find step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment. keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade ms.prod: w10 ms.mktglfcycl: deploy @@ -13,7 +13,9 @@ author: greg-lindsay ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article -ms.custom: autopilot +ms.custom: + - autopilot + - seo-marvel-apr2020 --- @@ -21,26 +23,29 @@ ms.custom: autopilot **Applies to** -- Windows 10 +- Windows 10 To get started with Windows Autopilot, you should try it out with a virtual machine (VM) or you can use a physical device that will be wiped and then have a fresh install of Windows 10. -In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. Note: Although there are [multiple platforms](administer.md) available to enable Autopilot, this lab primarily uses Intune. +In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. ->Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. +> [!NOTE] +> Although there are [multiple platforms](add-devices.md#registering-devices) available to enable Autopilot, this lab primarily uses Intune. + +> Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. The following video provides an overview of the process:
              - + ->For a list of terms used in this guide, see the [Glossary](#glossary) section. +> For a list of terms used in this guide, see the [Glossary](#glossary) section. ## Prerequisites These are the things you'll need to complete this lab: - - +
              Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file), version 1703 or later is required. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
              Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
              +
              Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
              Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
              Hyper-V or a physical device running Windows 10The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.
              A Premium Intune accountThis guide will describe how to obtain a free 30-day trial premium account that can be used to complete the lab.
              @@ -48,6 +53,8 @@ These are the things you'll need to complete this lab: A summary of the sections and procedures in the lab is provided below. Follow each section in the order it is presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. +> If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [Capture the hardware ID](#capture-the-hardware-id) step. The VM must be running Windows 10, version 1903 or a later version. + [Verify support for Hyper-V](#verify-support-for-hyper-v)
              [Enable Hyper-V](#enable-hyper-v)
              [Create a demo VM](#create-a-demo-vm) @@ -65,7 +72,8 @@ A summary of the sections and procedures in the lab is provided below. Follow ea
                  [Autopilot registration using MSfB](#autopilot-registration-using-msfb)
              [Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile)
                  [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) -
                     [Assign the profile](#assign-the-profile) +
                     [Create a device group](#create-a-device-group) +
                     [Create the deployment profile](#create-the-deployment-profile)
                  [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb)
              [See Windows Autopilot in action](#see-windows-autopilot-in-action)
              [Remove devices from Autopilot](#remove-devices-from-autopilot) @@ -83,9 +91,9 @@ A summary of the sections and procedures in the lab is provided below. Follow ea ## Verify support for Hyper-V -If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later). +If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later). ->If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). +> If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). If you are not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) below for details on verifying that Hyper-V can be successfully installed. @@ -103,13 +111,13 @@ This command works on all operating systems that support Hyper-V, but on Windows Install-WindowsFeature -Name Hyper-V -IncludeManagementTools ``` -When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. +When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. ->Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: +> Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![hyper-v feature](../images/hyper-v-feature.png) + ![Hyper-V feature](images/hyper-v-feature.png) - ![hyper-v](../images/svr_mgr2.png) + ![Hyper-V](images/svr_mgr2.png)

              If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -119,25 +127,25 @@ To read more about Hyper-V, see [Introduction to Hyper-V on Windows 10](https:// ## Create a demo VM -Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell. +Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell. -To use Windows Powershell we just need to know two things: +To use Windows PowerShell, we just need to know two things: 1. The location of the Windows 10 ISO file. - - In the example, we assume the location is **c:\iso\win10-eval.iso**. + - In the example, we assume the location is **c:\iso\win10-eval.iso**. 2. The name of the network interface that connects to the Internet. - - In the example, we use a Windows PowerShell command to determine this automatically. + - In the example, we use a Windows PowerShell command to determine this automatically. After we have set the ISO file location and determined the name of the appropriate network interface, we can install Windows 10. ### Set ISO file location -You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). -- When asked to select a platform, choose **64 bit**. +You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). +- When asked to select a platform, choose **64 bit**. -After you download this file, the name will be extremely long (ex: 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). +After you download this file, the name will be extremely long (ex: 19042.508.200927-1902.20h2_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). -1. So that it is easier to type and remember, rename the file to **win10-eval.iso**. +1. So that it is easier to type and remember, rename the file to **win10-eval.iso**. 2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**. 3. If you wish to use a different name and location for the file, you must modify the Windows PowerShell commands below to use your custom name and directory. @@ -149,19 +157,19 @@ The Get-NetAdaper cmdlet is used below to automatically find the network adapter (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name ``` -The output of this command should be the name of the network interface you use to connect to the Internet. Verify that this is the correct interface name. If it is not the correct interface name, you'll need to edit the first command below to use your network interface name. +The output of this command should be the name of the network interface you use to connect to the Internet. Verify that this is the correct interface name. If it is not the correct interface name, you'll need to edit the first command below to use your network interface name. For example, if the command above displays Ethernet but you wish to use Ethernet2, then the first command below would be New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**. -### Use Windows PowerShell to create the demo VM +### Use Windows PowerShell to create the demo VM All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands. ->[!IMPORTANT] ->**VM switch**: a VM switch is how Hyper-V connects VMs to a network.

              If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

              If you have never created an external VM switch before, then just run the commands below. +> [!IMPORTANT] +> **VM switch**: a VM switch is how Hyper-V connects VMs to a network.

              If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

              If you have never created an external VM switch before, then just run the commands below.

              If you are not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that is used to connect to the Internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). ```powershell -New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name +New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot Start-VM -VMName WindowsAutopilot @@ -213,22 +221,25 @@ PS C:\autopilot> ### Install Windows 10 +> [!NOTE] +> The VM will be booted to gather a hardware ID, then it will be reset. The goal in the next few steps is to get to the desktop quickly so don't worry about how it is configured at this stage. The VM only needs to be connected to the Internet. + Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: - ![Windows setup](images/winsetup1.png) - ![Windows setup](images/winsetup2.png) - ![Windows setup](images/winsetup3.png) - ![Windows setup](images/winsetup4.png) - ![Windows setup](images/winsetup5.png) - ![Windows setup](images/winsetup6.png) + ![Windows setup example 1](images/winsetup1.png) + ![Windows setup example 2](images/winsetup2.png) + ![Windows setup example 3](images/winsetup3.png) + ![Windows setup example 4](images/winsetup4.png) + ![Windows setup example 5](images/winsetup5.png) + ![Windows setup example 6](images/winsetup6.png) ->After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: +After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: - ![Windows setup](images/winsetup7.png) + ![Windows setup example 7](images/winsetup7.png) Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again. - ![Windows setup](images/winsetup8.png) + ![Windows setup example 8](images/winsetup8.png) To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: @@ -240,11 +251,12 @@ Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see ## Capture the hardware ID ->NOTE: Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. +> [!NOTE] +> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you're not going to use the OA3 Tool to capture the full 4K HH for various reasons (you'd have to install the OA3 tool, your device couldn't have a volume license version of Windows, it's a more complicated process than using a PS script, etc.). Instead, you'll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. Follow these steps to run the PS script: -1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: +1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: ```powershell md c:\HWID @@ -257,18 +269,20 @@ Follow these steps to run the PS script: When you are prompted to install the NuGet package, choose **Yes**. -See the sample output below. +See the sample output below. A 'dir' command is issued at the end to show the file that was created.

               PS C:\> md c:\HWID
               
              -    Directory: C:\
              +     Directory: C:\
               
              -Mode                LastWriteTime         Length Name
              -----                -------------         ------ ----
              -d-----        3/14/2019  11:33 AM                HWID
               
              -PS C:\> Set-Location c:\HWID
              +Mode                 LastWriteTime         Length Name
              +----                 -------------         ------ ----
              +d-----        11/13/2020   3:00 PM                HWID
              +
              +
              +PS C:\Windows\system32> Set-Location c:\HWID
               PS C:\HWID> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
               PS C:\HWID> Install-Script -Name Get-WindowsAutopilotInfo -Force
               
              @@ -281,36 +295,41 @@ import the NuGet provider now?
               [Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): Y
               PS C:\HWID> $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
               PS C:\HWID> Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
              +Gathered details for device with serial number: 1804-7078-6805-7405-0796-0675-17
               PS C:\HWID> dir
               
              +
                   Directory: C:\HWID
               
              -Mode                LastWriteTime         Length Name
              -----                -------------         ------ ----
              --a----        3/14/2019  11:33 AM           8184 AutopilotHWID.csv
              +
              +Mode                 LastWriteTime         Length Name
              +----                 -------------         ------ ----
              +-a----        11/13/2020   3:01 PM           8184 AutopilotHWID.csv
              +
               
               PS C:\HWID>
               
              -Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH. +Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH. -**Note**: Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. +> [!NOTE] +> Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. ![Serial number and hardware hash](images/hwid.png) -You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). +You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. ->[!NOTE] ->When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste. +> [!NOTE] +> When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste. ## Reset the VM back to Out-Of-Box-Experience (OOBE) With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE. On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. -Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**. +Select **Remove everything** and **Just remove my files**. If you are asked **How would you like to reinstall Windows**, select Local reinstall. Finally, click on **Reset**. ![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) @@ -326,18 +345,18 @@ For this lab, you need an AAD Premium subscription. You can tell if you have a ![MDM and Intune](images/mdm-intune2.png) -If the configuration blade shown above does not appear, it’s likely that you don’t have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. +If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. -![Reset this PC final prompt](images/aad-lic1.png) +![License conversion option](images/aad-lic1.png) ## Configure company branding If you already have company branding configured in Azure Active Directory, you can skip this step. ->[!IMPORTANT] ->Make sure to sign-in with a Global Administrator account. +> [!IMPORTANT] +> Make sure to sign-in with a Global Administrator account. Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. @@ -345,8 +364,8 @@ Navigate to [Company branding in Azure Active Directory](https://portal.azure.co When you are finished, click **Save**. ->[!NOTE] ->Changes to company branding can take up to 30 minutes to apply. +> [!NOTE] +> Changes to company branding can take up to 30 minutes to apply. ## Configure Microsoft Intune auto-enrollment @@ -356,7 +375,7 @@ Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. -![MDM user scope in the Mobility blade](images/autopilot-aad-mdm.png) +![MDM user scope in the Mobility blade](images/ap-aad-mdm.png) ## Register your VM @@ -364,29 +383,29 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B ### Autopilot registration using Intune -1. In Intune in the Azure portal, choose **Device enrollment** > **Windows enrollment** > **Devices** > **Import**. +1. In the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/), choose **Devices** > **Device enrollment | Enroll devices** > **Windows enrollment** > **Windows Autopilot Deployment Program | Devices** and then on the **Windows Autopilot devices** page, choose **Import**. - ![Intune device import](images/device-import.png) + ![Intune device import](images/enroll1.png) - >[!NOTE] - >If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. + > [!NOTE] + > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. -2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank. +2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank. - ![HWID CSV](images/hwid-csv.png) + ![HWID CSV](images/enroll2.png) You should receive confirmation that the file is formatted correctly before uploading it, as shown above. -3. Click **Import** and wait until the import process completes. This can take up to 15 minutes. +3. Click **Import** and wait until the import process completes. This can take up to 15 minutes. -4. Click **Sync** to sync the device you just registered. Wait a few moments before refreshing to verify your VM or device has been added. See the following example. +4. Click **Refresh** to verify your VM or device has been added. See the following example. - ![Import HWID](images/import-vm.png) + ![Import HWID](images/enroll3.png) ### Autopilot registration using MSfB ->[!IMPORTANT] ->If you've already registered your VM (or device) using Intune, then skip this step. +> [!IMPORTANT] +> If you've already registered your VM (or device) using Intune, then skip this step. Optional: see the following video for an overview of the process. @@ -396,7 +415,7 @@ Optional: see the following video for an overview of the process. First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview) to create a new one. -Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** in the upper-right-corner of the main page. +Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** on the upper-right-corner of the main page. Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: @@ -404,12 +423,12 @@ Select **Manage** from the top menu, then click the **Windows Autopilot Deployme Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. -![Devices](images/msfb-device.png) +![Microsoft Store for Business Devices](images/msfb-device.png) ## Create and assign a Windows Autopilot deployment profile ->[!IMPORTANT] ->Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only pick one for purposes of this lab: +> [!IMPORTANT] +> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only pick one for purposes of this lab: Pick one: - [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) @@ -417,18 +436,34 @@ Pick one: ### Create a Windows Autopilot deployment profile using Intune ->[!NOTE] ->Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first: +> [!NOTE] +> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list. -![Devices](images/intune-devices.png) +![Devices](images/enroll4.png) ->The example above lists both a physical device and a VM. Your list should only include only one of these. +#### Create a device group -To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles** +The Autopilot deployment profile wizard will ask for a device group, so we must create one first. To create a device group: -![Deployment profiles](images/deployment-profiles.png) +1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Groups** > **New group**. +2. In the **Group** blade: + 1. For **Group type**, choose **Security**. + 2. Type a **Group name** and **Group description** (ex: Autopilot Lab). + 3. Azure AD roles can be assigned to the group: **No** + 4. For **Membership type**, choose **Assigned**. +3. Click **Members** and add the Autopilot VM to the group. See the following example: -Click on **Create profile**. + ![add members](images/group1.png) + +4. Click **Create**. + +#### Create the deployment profile + +To create a Windows Autopilot profile, scroll back to the left hand pane and click **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. + +![Deployment profiles](images/dp.png) + +Click on **Create profile** and then select **Windows PC**. ![Create deployment profile](images/create-profile.png) @@ -437,62 +472,39 @@ On the **Create profile** blade, use the following values: | Setting | Value | |---|---| | Name | Autopilot Lab profile | -| Description | blank | +| Description | Lab | | Convert all targeted devices to Autopilot | No | -| Deployment mode | User-driven | -| Join to Azure AD as | Azure AD joined | -Click on **Out-of-box experience (OOBE)** and configure the following settings: +Click **Next** to continue with the **Out-of-box experience (OOBE)** settings: | Setting | Value | |---|---| -| EULA | Hide | +| Deployment mode | User-driven | +| Join to Azure AD as | Azure AD joined | +| Microsoft Sofware License Terms | Hide | | Privacy Settings | Hide | | Hide change account options | Hide | | User account type | Standard | +| Allow White Glove OOBE | No | +| Language (Region) | Operating system default | +| Automatically configure keyboard | Yes | | Apply device name template | No | -See the following example: +Click **Next** to continue with the **Assignments** settings: + +| Setting | Value | +|---|---| +| Assign to | Selected groups | + +1. Click **Select groups to include**. +2. Click the **Autopilot Lab** group, and then click **Select**. +3. Click **Next** to continue and then click **Create**. See the following example: ![Deployment profile](images/profile.png) Click on **OK** and then click on **Create**. ->If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile). - -#### Assign the profile - -Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading. - -To create a Group, open the Azure Portal and select **Azure Active Directory** > **Groups** > **All groups**: - -![All groups](images/all-groups.png) - -Select New group from the Groups blade to open the new groups UI. Select the “Security” group type, name the group, and select the “Assigned” membership type: - -Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group. - -![New group](images/new-group.png) - -Now click **Create** to finish creating the new group. - -Click on **All groups** and click **Refresh** to verify that your new group has been successfully created. - -With a group created containing your device, you can now go back and assign your profile to that group. Navigate back to the Intune page in the Azure portal (one way is to type **Intune** in the top banner search bar and select **Intune** from the results). - -From Intune, select **Device enrollment** > **Windows enrollment** > **Deployment Profiles** to open the profile blade. Click on the name of the profile you previously created (Autopilot Lab profile) to open the details blade for that profile: - -![Lab profile](images/deployment-profiles2.png) - -Under **Manage**, click **Assignments**, and then with the **Include** tab highlighted, expand the **Select groups** blade and click **AP Lab Group 1** (the group will appear under **Selected members**). - -![Include group](images/include-group.png) - -Click **Select** and then click **Save**. - -![Include group](images/include-group2.png) - -It’s also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot). +> If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile). ### Create a Windows Autopilot deployment profile using MSfB @@ -512,15 +524,15 @@ To CREATE the profile: Select your device from the **Devices** list: -![MSfB create](images/msfb-create1.png) +![MSfB create step 1](images/msfb-create1.png) On the Autopilot deployment dropdown menu, select **Create new profile**: -![MSfB create](images/msfb-create2.png) +![MSfB create step 2](images/msfb-create2.png) Name the profile, choose your desired settings, and then click **Create**: -![MSfB create](images/msfb-create3.png) +![MSfB create step 3](images/msfb-create3.png) The new profile is added to the Autopilot deployment list. @@ -528,81 +540,73 @@ To ASSIGN the profile: To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: -![MSfB assign](images/msfb-assign1.png) +![MSfB assign step 1](images/msfb-assign1.png) Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: -![MSfB assign](images/msfb-assign2.png) +![MSfB assign step 2](images/msfb-assign2.png) ->[!IMPORTANT] ->The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. +> [!IMPORTANT] +> The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. ## See Windows Autopilot in action -If you shut down your VM after the last reset, it’s time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: +If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: ![Device status](images/device-status.png) Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. ->[!TIP] ->If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). +> [!TIP] +> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). - Ensure your device has an internet connection. - Turn on the device - Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). -![OOBE sign-in page](images/autopilot-oobe.jpg) +![OOBE sign-in page](images/autopilot-oobe.png) Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. -![Device enabled](images/enabled-device.png) +![Device enabled](images/devices1.png) Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. +> [!TIP] +> If you recieve a message that "Something went wrong" and it "Looks like we can't connect to the URL for your organization's MDM terms of use" then verify you have correctly [assigned licenses](https://docs.microsoft.com/mem/intune/fundamentals/licenses-assign) to the current user. + Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings. ## Remove devices from Autopilot -To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. +To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found at [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. ### Delete (deregister) Autopilot device -You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu. +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then click the Delete button along the top menu. -![Delete device](images/delete-device1.png) - -Click **X** when challenged to complete the operation: - -![Delete device](images/delete-device2.png) +![Delete device step 1](images/delete-device1.png) This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. -![Delete device](images/delete-device3.png) +The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. -The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. Note: A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. +> [!NOTE] +> A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. -To remove the device from the Autopilot program, select the device and click Delete. +To remove the device from the Autopilot program, select the device and click **Delete**. You will get a popup dialog box to confirm deletion. -![Delete device](images/delete-device4.png) - -A warning message appears reminding you to first remove the device from Intune, which we previously did. - -![Delete device](images/delete-device5.png) +![Delete device](images/delete-device2.png) At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: -![Delete device](images/delete-device6.png) - Once the device no longer appears, you are free to reuse it for other purposes. If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button: -![Delete device](images/delete-device7.png) - ## Appendix A: Verify support for Hyper-V -Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. +Starting with Windows 8, the host computer's microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: @@ -618,9 +622,9 @@ Hyper-V Requirements: VM Monitor Mode Extensions: Yes In this example, the computer supports SLAT and Hyper-V. ->If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. +> If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. -You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example: +You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [Coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example:
               C:>coreinfo -v
              @@ -637,7 +641,8 @@ VMX             *       Supports Intel hardware-assisted virtualization
               EPT             *       Supports Intel extended page tables (SLAT)
               
              -Note: A 64-bit operating system is required to run Hyper-V. +> [!NOTE] +> A 64-bit operating system is required to run Hyper-V. ## Appendix B: Adding apps to your profile @@ -645,19 +650,19 @@ Note: A 64-bit operating system is required to run Hyper-V. #### Prepare the app for Intune -Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool). After downloading the tool, gather the following three bits of information to use the tool: +Before we can pull an application into Intune to make it part of our AP profile, we need to "package" the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool: 1. The source folder for your application -2. The name of the setup executable file +2. The name of the setup executable file 3. The output folder for the new file -For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. +For the purposes of this lab, we'll use the Notepad++ tool as our Win32 app. -Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then opy the file to a known location, such as C:\Notepad++msi. +Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then copy the file to a known location, such as C:\Notepad++msi. Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: -![Add app](images/app01.png) +![Add app example](images/app01.png) After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. @@ -667,50 +672,51 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Add app](images/app02.png) +![Add app step 1](images/app02.png) Under **App Type**, select **Windows app (Win32)**: -![Add app](images/app03.png) +![Add app step 2](images/app03.png) On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: -![Add app](images/app04.png) +![Add app step 3](images/app04.png) On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: -![Add app](images/app05.png) +![Add app step 4](images/app05.png) On the **Program Configuration** blade, supply the install and uninstall commands: Install: msiexec /i "npp.7.6.3.installer.x64.msi" /q Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q -NOTE: Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool) automatically generated them when it converted the .msi file into a .intunewin file. +> [!NOTE] +> Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file. -![Add app](images/app06.png) +![Add app step 5](images/app06.png) -Simply using an install command like “notepad++.exe /S” will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn’t actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). +Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). Click **OK** to save your input and activate the **Requirements** blade. On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: -![Add app](images/app07.png) +![Add app step 6](images/app07.png) Next, configure the **Detection rules**. For our purposes, we will select manual format: -![Add app](images/app08.png) +![Add app step 7](images/app08.png) Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: -![Add app](images/app09.png) +![Add app step 8](images/app09.png) -Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. +Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. **Return codes**: For our purposes, leave the return codes at their default values: -![Add app](images/app10.png) +![Add app step 9](images/app10.png) Click **OK** to exit. @@ -720,31 +726,32 @@ Click the **Add** button to finalize and save your app package. Once the indicator message says the addition has completed. -![Add app](images/app11.png) +![Add app step 10](images/app11.png) You will be able to find your app in your app list: -![Add app](images/app12.png) +![Add app step 11](images/app12.png) #### Assign the app to your Intune profile -**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. - +> [!NOTE] +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. + In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: -![Add app](images/app13.png) +![Assign app step 1](images/app13.png) Select **Add Group** to open the **Add group** pane that is related to the app. -For our purposes, select *8Required** from the **Assignment type** dropdown menu: +For our purposes, select **Required** from the **Assignment type** dropdown menu: ->**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. +> **Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. Select **Included Groups** and assign the groups you previously created that will use this app: -![Add app](images/app14.png) +![Assign app step 2](images/app14.png) -![Add app](images/app15.png) +![Assign app step 3](images/app15.png) In the **Select groups** pane, click the **Select** button. @@ -754,11 +761,11 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. -![Add app](images/app16.png) +![Assign app step 4](images/app16.png) At this point, you have completed steps to add a Win32 app to Intune. -For more information on adding adds to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management). +For more information on adding apps to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management). ### Add Office 365 @@ -768,51 +775,52 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Add app](images/app17.png) +![Create app step 1](images/app17.png) Under **App Type**, select **Office 365 Suite > Windows 10**: -![Add app](images/app18.png) +![Create app step 2](images/app18.png) Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: -![Add app](images/app19.png) +![Create app step 3](images/app19.png) Click **OK**. -In the **App Suite Information** pane, enter a unique suite name, and a suitable description. +In the **App Suite Information** pane, enter a unique suite name, and a suitable description. ->Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. +> Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. -![Add app](images/app20.png) +![Create app step 4](images/app20.png) Click **OK**. In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: -![Add app](images/app21.png) +![Create app step 5](images/app21.png) Click **OK** and then click **Add**. #### Assign the app to your Intune profile -**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. - +> [!NOTE] +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. + In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: -![Add app](images/app22.png) +![Create app step 6](images/app22.png) Select **Add Group** to open the **Add group** pane that is related to the app. For our purposes, select **Required** from the **Assignment type** dropdown menu: ->**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. +> **Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. Select **Included Groups** and assign the groups you previously created that will use this app: -![Add app](images/app23.png) +![Create app step 7](images/app23.png) -![Add app](images/app24.png) +![Create app step 8](images/app24.png) In the **Select groups** pane, click the **Select** button. @@ -822,7 +830,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. -![Add app](images/app25.png) +![Create app step 9](images/app25.png) At this point, you have completed steps to add Office to Intune. @@ -830,7 +838,7 @@ For more information on adding Office apps to Intune, see [Assign Office 365 app If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: -![Add app](images/app26.png) +![Create app step 10](images/app26.png) ## Glossary diff --git a/windows/deployment/windows-autopilot/enrollment-status.md b/windows/deployment/windows-autopilot/enrollment-status.md deleted file mode 100644 index 6c5c118bec..0000000000 --- a/windows/deployment/windows-autopilot/enrollment-status.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Windows Autopilot Enrollment Status Page -ms.reviewer: -manager: laurawi -description: Gives an overview of the Enrollment Status Page capabilities, configuration -keywords: Autopilot Plug and Forget, Windows 10 -ms.prod: w10 -ms.technology: Windows -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot Enrollment Status Page - -**Applies to** - -- Windows 10, version 1803 and later - -The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time. - -The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see how to set up the [Enrollment Status Page in Intune](https://docs.microsoft.com/intune/windows-enrollment-status). - - ![Enrollment Status Page](images/enrollment-status-page.png) - - -## More information - -For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
              -For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
              -For more information about blocking for app installation: -- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). -- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). diff --git a/windows/deployment/windows-autopilot/existing-devices.md b/windows/deployment/windows-autopilot/existing-devices.md deleted file mode 100644 index f514184445..0000000000 --- a/windows/deployment/windows-autopilot/existing-devices.md +++ /dev/null @@ -1,315 +0,0 @@ ---- -title: Windows Autopilot for existing devices -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot for existing devices - -**Applies to: Windows 10** - -Modern desktop deployment with Windows Autopilot enables you to easily deploy the latest version of Windows 10 to your existing devices. The apps you need for work can be automatically installed. Your work profile is synchronized, so you can resume working right away. - -This topic describes how to convert Windows 7 or Windows 8.1 domain-joined computers to Windows 10 devices joined to either Azure Active Directory or Active Directory (Hybrid Azure AD Join) by using Windows Autopilot. - ->[!NOTE] ->Windows Autopilot for existing devices only supports user-driven Azure Active Directory and Hybrid Azure AD profiles. Self-deploying profiles are not supported. - -## Prerequisites - -- System Center Configuration Manager Current Branch (1806) OR System Center Configuration Manager Technical Preview (1808) -- The [Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) 1803 or later - - Note: Config Mgr 1806 or later is required to [support](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10#windows-10-adk) the Windows ADK 1809. -- Assigned Microsoft Intune Licenses -- Azure Active Directory Premium -- Windows 10 version 1809 or later imported into Config Mgr as an Operating System Image - -## Procedures - -### Configure the Enrollment Status Page (optional) - -If desired, you can set up an [enrollment status page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) for Autopilot using Intune. - -To enable and configure the enrollment and status page: - -1. Open [Intune in the Azure portal](https://aka.ms/intuneportal). -2. Access **Intune > Device enrollment > Windows enrollment** and [Set up an enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status). -3. Access **Azure Active Directory > Mobility (MDM and MAM) > Microsoft Intune** and [Configure automatic MDM enrollment](https://docs.microsoft.com/sccm/mdm/deploy-use/enroll-hybrid-windows#enable-windows-10-automatic-enrollment) and configure the MDM user scope for some or all users. - -See the following examples. - -![enrollment status page](images/esp-config.png)

              -![mdm](images/mdm-config.png) - -### Create the JSON file - ->[!TIP] ->To run the following commands on a computer running Windows Server 2012/2012 R2 or Windows 7/8.1, you must first download and install the [Windows Management Framework](https://www.microsoft.com/en-us/download/details.aspx?id=54616). - -1. On an Internet connected Windows PC or Server open an elevated Windows PowerShell command window -2. Enter the following lines to install the necessary modules - - #### Install required modules - - ```powershell - Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force - Install-Module AzureAD -Force - Install-Module WindowsAutopilotIntune -Force - ``` - -3. Enter the following lines and provide Intune administrative credentials - - In the following command, replace the example user principal name for Azure authentication (admin@M365x373186.onmicrosoft.com) with your user account. Be sure that the user account you specify has sufficient administrative rights. - - ```powershell - Connect-AutopilotIntune -user admin@M365x373186.onmicrosoft.com - ``` - The password for your account will be requested using a standard Azure AD form. Type your password and then click **Sign in**. -
              See the following example: - - ![Azure AD authentication](images/pwd.png) - - If this is the first time you’ve used the Intune Graph APIs, you’ll also be prompted to enable read and write permissions for Microsoft Intune PowerShell. To enable these permissions: - - Select **Consent on behalf or your organization** - - Click **Accept** - -4. Next, retrieve and display all the Autopilot profiles available in the specified Intune tenant in JSON format: - - #### Retrieve profiles in Autopilot for existing devices JSON format - - ```powershell - Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON - ``` - - See the following sample output: (use the horizontal scroll bar at the bottom to view long lines) -
              -    PS C:\> Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON
              -    {
              -        "CloudAssignedTenantId":  "1537de22-988c-4e93-b8a5-83890f34a69b",
              -        "CloudAssignedForcedEnrollment":  1,
              -        "Version":  2049,
              -        "Comment_File":  "Profile Autopilot Profile",
              -        "CloudAssignedAadServerData":  "{\"ZeroTouchConfig\":{\"CloudAssignedTenantUpn\":\"\",\"ForcedEnrollment\":1,\"CloudAssignedTenantDomain\":\"M365x373186.onmicrosoft.com\"}}",
              -        "CloudAssignedTenantDomain":  "M365x373186.onmicrosoft.com",
              -        "CloudAssignedDomainJoinMethod":  0,
              -        "CloudAssignedOobeConfig":  28,
              -        "ZtdCorrelationId":  "7F9E6025-1E13-45F3-BF82-A3E8C5B59EAC"
              -    }
              - - Each profile is encapsulated within braces **{ }**. In the previous example, a single profile is displayed. - - See the following table for a description of properties used in the JSON file. - - - | Property | Description | - |------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| - | Version (number, optional) | The version number that identifies the format of the JSON file. For Windows 10 1809, the version specified must be 2049. | - | CloudAssignedTenantId (guid, required) | The Azure Active Directory tenant ID that should be used. This is the GUID for the tenant, and can be found in properties of the tenant. The value should not include braces. | - | CloudAssignedTenantDomain (string, required) | The Azure Active Directory tenant name that should be used, e.g. tenant.onmicrosoft.com. | - | CloudAssignedOobeConfig (number, required) | This is a bitmap that shows which Autopilot settings were configured. Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16 | - | CloudAssignedDomainJoinMethod (number, required) | This property specifies whether the device should join Azure Active Directory or Active Directory (Hybrid Azure AD Join). Values include: Active AD Join = 0, Hybrid Azure AD Join = 1 | - | CloudAssignedForcedEnrollment (number, required) | Specifies that the device should require AAD Join and MDM enrollment.
              0 = not required, 1 = required. | - | ZtdCorrelationId (guid, required) | A unique GUID (without braces) that will be provided to Intune as part of the registration process. ZtdCorrelationId will be included in enrollment message as “OfflineAutoPilotEnrollmentCorrelator”. This attribute will be present only if the enrollment is taking place on a device registered with Zero Touch Provisioning via offline registration. | - | CloudAssignedAadServerData (encoded JSON string, required) | An embedded JSON string used for branding. It requires AAD corp branding enabled.
              Example value: "CloudAssignedAadServerData": "{\"ZeroTouchConfig\":{\"CloudAssignedTenantUpn\":\"\",\"CloudAssignedTenantDomain\":\"tenant.onmicrosoft.com\"}}" | - | CloudAssignedDeviceName (string, optional) | The name automatically assigned to the computer. This follows the naming pattern convention that can be configured in Intune as part of the Autopilot profile, or can specify an explicit name to use. | - - -5. The Autopilot profile must be saved as a JSON file in ASCII or ANSI format. Windows PowerShell defaults to Unicode format, so if you attempt to redirect output of the commands to a file, you must also specify the file format. For example, to save the file in ASCII format using Windows PowerShell, you can create a directory (ex: c:\Autopilot) and save the profile as shown below: (use the horizontal scroll bar at the bottom if needed to view the entire command string) - - ```powershell - Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON | Out-File c:\Autopilot\AutopilotConfigurationFile.json -Encoding ASCII - ``` - **IMPORTANT**: The file name must be named **AutopilotConfigurationFile.json** in addition to being encoded as ASCII/ANSI. - - If preferred, you can save the profile to a text file and edit in Notepad. In Notepad, when you choose **Save as** you must select Save as type: **All Files** and choose ANSI from the drop-down list next to **Encoding**. See the following example. - - ![Notepad JSON](images/notepad.png) - - After saving the file, move the file to a location suitable as an SCCM package source. - - >[!IMPORTANT] - >Multiple JSON profile files can be used, but each must be named **AutopilotConfigurationFile.json** in order for OOBE to follow the Autopilot experience. The file also must be encoded as ANSI.

              **Saving the file with Unicode or UTF-8 encoding or saving it with a different file name will cause Windows 10 OOBE to not follow the Autopilot experience**.
              - - -### Create a package containing the JSON file - -1. In Configuration Manager, navigate to **\Software Library\Overview\Application Management\Packages** -2. On the ribbon, click **Create Package** -3. In the **Create Package and Program Wizard** enter the following **Package** and **Program Type** details:
              - - Name: **Autopilot for existing devices config** - - Select the **This package contains source files** checkbox - - Source folder: Click **Browse** and specify a UNC path containing the AutopilotConfigurationFile.json file. - - Click **OK** and then click **Next**. - - Program Type: **Do not create a program** -4. Click **Next** twice and then click **Close**. - -**NOTE**: If you change user-driven Autopilot profile settings in Intune at a later date, you must also update the JSON file and redistribute the associated Config Mgr package. - -### Create a target collection - ->[!NOTE] ->You can also choose to reuse an existing collection - -1. Navigate to **\Assets and Compliance\Overview\Device Collections** -2. On the ribbon, click **Create** and then click **Create Device Collection** -3. In the **Create Device Collection Wizard** enter the following **General** details: - - Name: **Autopilot for existing devices collection** - - Comment: (optional) - - Limiting collection: Click **Browse** and select **All Systems** - - >[!NOTE] - >You can optionally choose to use an alternative collection for the limiting collection. The device to be upgraded must be running the ConfigMgr agent in the collection that you select. - -4. Click **Next**, then enter the following **Membership Rules** details: - - Click **Add Rule** and specify either a direct or query based collection rule to add the target test Windows 7 devices to the new collection. - - For example, if the hostname of the computer to be wiped and reloaded is PC-01 and you wish to use Name as the attribute, click **Add Rule > Direct Rule > (wizard opens) > Next** and then enter **PC-01** next to **Value**. Click **Next** and then choose **PC-01** under **Resources**. See the following examples. - - ![Named resource1](images/pc-01a.png) - ![Named resource2](images/pc-01b.png) - -5. Continue creating the device collection with the default settings: - - Use incremental updates for this collection: not selected - - Schedule a full update on this collection: default - - Click **Next** twice and then click **Close** - -### Create an Autopilot for existing devices Task Sequence - ->[!TIP] ->The next procedure requires a boot image for Windows 10 1803 or later. Review your available boot images in the Configuration Manager conole under **Software Library\Overview\Operating Systems\Boot images** and verify that the **OS Version** is 10.0.17134.1 (Windows 10 version 1803) or later. - -1. In the Configuration Manager console, navigate to **\Software Library\Overview\Operating Systems\Task Sequences** -2. On the Home ribbon, click **Create Task Sequence** -3. Select **Install an existing image package** and then click **Next** -4. In the Create Task Sequence Wizard enter the following details: - - Task sequence name: **Autopilot for existing devices** - - Boot Image: Click **Browse** and select a Windows 10 boot image (1803 or later) - - Click **Next**, and then on the Install Windows page click **Browse** and select a Windows 10 **Image package** and **Image Index**, version 1803 or later. - - Select the **Partition and format the target computer before installing the operating system** checkbox. - - Select or clear **Configure task sequence for use with Bitlocker** checkbox. This is optional. - - Product Key and Server licensing mode: Optionally enter a product key and server licencing mode. - - Randomly generate the local administrator password and disable the account on all support platforms (recommended): Optional. - - Enable the account and specify the local administrator password: Optional. - - Click **Next**, and then on the Configure Network page choose **Join a workgroup** and specify a name (ex: workgroup) next to **Workgroup**. - - >[!IMPORTANT] - >The Autopilot for existing devices task sequence will run the **Prepare Windows for capture** action which calls the System Preparation Tool (syeprep). This action will fail if the target machine is joined to a domain. - -5. Click **Next** and then click **Next** again to accept the default settings on the Install Configuration Manager page. -6. On the State Migration page, enter the following details: - - Clear the **Capture user settings and files** checkbox. - - Clear the **Capture network settings** checkbox. - - Clear the **Capture Microsoft Windows settings** checkbox. - - Click **Next**. - - >[!NOTE] - >The Autopilot for existing devices task sequence will result in an Azure Active Directory Domain (AAD) joined device. The User State Migration Toolkit (USMT) does not support AAD joined or hybrid AAD joined devices. - -7. On the Include Updates page, choose one of the three available options. This selection is optional. -8. On the Install applications page, add applications if desired. This is optional. -9. Click **Next**, confirm settings, click **Next** and then click **Close**. -10. Right click on the Autopilot for existing devices task sequence and click **Edit**. -11. In the Task Sequence Editor under the **Install Operating System** group, click the **Apply Windows Settings** action. -12. Click **Add** then click **New Group**. -13. Change the group **Name** from **New Group** to **Autopilot for existing devices config**. -14. Click **Add**, point to **General**, then click **Run Command Line**. -15. Verify that the **Run Command Line** step is nested under the **Autopilot for existing devices config** group. -16. Change the **Name** to **Apply Autopilot for existing devices config file** and paste the following into the **Command line** text box, and then click **Apply**: - ``` - cmd.exe /c xcopy AutopilotConfigurationFile.json %OSDTargetSystemDrive%\windows\provisioning\Autopilot\ /c - ``` - - **AutopilotConfigurationFile.json** must be the name of the JSON file present in the Autopilot for existing devices package created earlier. - -17. In the **Apply Autopilot for existing devices config file** step, select the **Package** checkbox and then click **Browse**. -18. Select the **Autopilot for existing devices config** package created earlier and click **OK**. An example is displayed at the end of this section. -19. Under the **Setup Operating System** group, click the **Setup Windows and Configuration Manager** task. -20. Click **Add** and then click **New Group**. -21. Change **Name** from **New Group** to **Prepare Device for Autopilot** -22. Verify that the **Prepare Device for Autopilot** group is the very last step in the task sequence. Use the **Move Down** button if necessary. -23. With the **Prepare device for Autopilot** group selected, click **Add**, point to **Images** and then click **Prepare ConfigMgr Client for Capture**. -24. Add a second step by clicking **Add**, pointing to **Images**, and clicking **Prepare Windows for Capture**. Use the following settings in this step: - - Automatically build mass storage driver list: **Not selected** - - Do not reset activation flag: **Not selected** - - Shutdown the computer after running this action: **Optional** - - ![Autopilot task sequence](images/ap-ts-1.png) - -25. Click **OK** to close the Task Sequence Editor. - -### Deploy Content to Distribution Points - -Next, ensure that all content required for the task sequence is deployed to distribution points. - -1. Right click on the **Autopilot for existing devices** task sequence and click **Distribute Content**. -2. Click **Next**, **Review the content to distribute** and then click **Next**. -3. On the Specify the content distribution page click **Add** to specify either a **Distribution Point** or **Distribution Point Group**. -4. On the a Add Distribution Points or Add Distribution Point Groups wizard specify content destinations that will allow the JSON file to be retrieved when the task sequence is run. -5. When you are finished specifying content distribution, click **Next** twice then click **Close**. - -### Deploy the OS with Autopilot Task Sequence - -1. Right click on the **Autopilot for existing devices** task sequence and then click **Deploy**. -2. In the Deploy Software Wizard enter the following **General** and **Deployment Settings** details: - - Task Sequence: **Autopilot for existing devices**. - - Collection: Click **Browse** and then select **Autopilot for existing devices collection** (or another collection you prefer). - - Click **Next** to specify **Deployment Settings**. - - Action: **Install**. - - Purpose: **Available**. You can optionally select **Required** instead of **Available**. This is not recommended during the test owing to the potential impact of inadvertent configurations. - - Make available to the following: **Only Configuration Manager Clients**. Note: Choose the option here that is relevant for the context of your test. If the target client does not have the Configuration Manager agent or Windows installed, you will need to select an option that includes PXE or Boot Media. - - Click **Next** to specify **Scheduling** details. - - Schedule when this deployment will become available: Optional - - Schedule when this deployment will expire: Optional - - Click **Next** to specify **User Experience** details. - - Show Task Sequence progress: Selected. - - Software Installation: Not selected. - - System restart (if required to complete the installation): Not selected. - - Commit changed at deadline or during a maintenance windows (requires restart): Optional. - - Allow task sequence to be run for client on the Internet: Optional - - Click **Next** to specify **Alerts** details. - - Create a deployment alert when the threshold is higher than the following: Optional. - - Click **Next** to specify **Distribution Points** details. - - Deployment options: **Download content locally when needed by the running task sequence**. - - When no local distribution point is available use a remote distribution point: Optional. - - Allow clients to use distribution points from the default site boundary group: Optional. - - Click **Next**, confirm settings, click **Next**, and then click **Close**. - -### Complete the client installation process - -1. Open the Software Center on the target Windows 7 or Windows 8.1 client computer. You can do this by clicking Start and then typing **software** in the search box, or by typing the following at a Windows PowerShell or command prompt: - - ``` - C:\Windows\CCM\SCClient.exe - ``` - -2. In the software library, select **Autopilot for existing devices** and click **Install**. See the following example: - - ![Named resource2](images/sc.png) - ![Named resource2](images/sc1.png) - -The Task Sequence will download content, reboot, format the drives and install Windows 10. The device will then proceed to be prepared for Autopilot. Once the task sequence has completed the device will boot into OOBE and provide an Autopilot experience. - -![refresh-1](images/up-1.png) -![refresh-2](images/up-2.png) -![refresh-3](images/up-3.png) - ->[!NOTE] ->If joining devices to Active Directory (Hybrid Azure AD Join), it is necessary to create a Domain Join device configuration profile that is targeted to "All Devices" (since there is no Azure Active Directory device object for the computer to do group-based targeting). See [User-driven mode for hybrid Azure Active Directory join](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven#user-driven-mode-for-hybrid-azure-active-directory-join) for more information. - -### Register the device for Windows Autopilot - -Devices provisioned through Autopilot will only receive the guided OOBE Autopilot experience on first boot. Once updated to Windows 10, the device should be registered to ensure a continued Autopilot experience in the event of PC reset. You can enable automatic registration for an assigned group using the **Convert all targeted devices to Autopilot** setting. For more information, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile). - -Also see [Adding devices to Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices). - -## Speeding up the deployment process - -To remove around 20 minutes from the deployment process, see Michael Niehaus's blog with instructions for [Speeding up Windows Autopilot for existing devices](https://blogs.technet.microsoft.com/mniehaus/2018/10/25/speeding-up-windows-autopilot-for-existing-devices/). diff --git a/windows/deployment/windows-autopilot/images/ap-aad-mdm.png b/windows/deployment/windows-autopilot/images/ap-aad-mdm.png new file mode 100644 index 0000000000..ece310f978 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/ap-aad-mdm.png differ diff --git a/windows/deployment/windows-autopilot/images/autopilot-oobe.png b/windows/deployment/windows-autopilot/images/autopilot-oobe.png new file mode 100644 index 0000000000..9cfea73377 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-oobe.png differ diff --git a/windows/deployment/windows-autopilot/images/create-profile.png b/windows/deployment/windows-autopilot/images/create-profile.png index 52f087721d..d2816e9c89 100644 Binary files a/windows/deployment/windows-autopilot/images/create-profile.png and b/windows/deployment/windows-autopilot/images/create-profile.png differ diff --git a/windows/deployment/windows-autopilot/images/csp2.png b/windows/deployment/windows-autopilot/images/csp2.png index cf095b831c..06cc80fe95 100644 Binary files a/windows/deployment/windows-autopilot/images/csp2.png and b/windows/deployment/windows-autopilot/images/csp2.png differ diff --git a/windows/deployment/windows-autopilot/images/csp3a.png b/windows/deployment/windows-autopilot/images/csp3a.png new file mode 100644 index 0000000000..3fb1291370 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/csp3a.png differ diff --git a/windows/deployment/windows-autopilot/images/csp3b.png b/windows/deployment/windows-autopilot/images/csp3b.png new file mode 100644 index 0000000000..c2034c1ebc Binary files /dev/null and b/windows/deployment/windows-autopilot/images/csp3b.png differ diff --git a/windows/deployment/windows-autopilot/images/csp4.png b/windows/deployment/windows-autopilot/images/csp4.png index 608128e5ab..ddada725b2 100644 Binary files a/windows/deployment/windows-autopilot/images/csp4.png and b/windows/deployment/windows-autopilot/images/csp4.png differ diff --git a/windows/deployment/windows-autopilot/images/delete-device1.png b/windows/deployment/windows-autopilot/images/delete-device1.png index e73f929fbd..770c8e5b02 100644 Binary files a/windows/deployment/windows-autopilot/images/delete-device1.png and b/windows/deployment/windows-autopilot/images/delete-device1.png differ diff --git a/windows/deployment/windows-autopilot/images/delete-device2.png b/windows/deployment/windows-autopilot/images/delete-device2.png index ed764ac1ed..188c72d67b 100644 Binary files a/windows/deployment/windows-autopilot/images/delete-device2.png and b/windows/deployment/windows-autopilot/images/delete-device2.png differ diff --git a/windows/deployment/windows-autopilot/images/device-status.png b/windows/deployment/windows-autopilot/images/device-status.png index 5a78973ce5..a5627040ec 100644 Binary files a/windows/deployment/windows-autopilot/images/device-status.png and b/windows/deployment/windows-autopilot/images/device-status.png differ diff --git a/windows/deployment/windows-autopilot/images/devices1.png b/windows/deployment/windows-autopilot/images/devices1.png new file mode 100644 index 0000000000..459aa19c69 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/devices1.png differ diff --git a/windows/deployment/windows-autopilot/images/dfci.png b/windows/deployment/windows-autopilot/images/dfci.png new file mode 100644 index 0000000000..6c68ed8b80 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/dfci.png differ diff --git a/windows/deployment/windows-autopilot/images/dp.png b/windows/deployment/windows-autopilot/images/dp.png new file mode 100644 index 0000000000..a133c72491 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/dp.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll1.png b/windows/deployment/windows-autopilot/images/enroll1.png new file mode 100644 index 0000000000..4bc9be72bb Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll1.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll2.png b/windows/deployment/windows-autopilot/images/enroll2.png new file mode 100644 index 0000000000..62e7344da1 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll2.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll3.png b/windows/deployment/windows-autopilot/images/enroll3.png new file mode 100644 index 0000000000..3501d5036c Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll3.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll4.png b/windows/deployment/windows-autopilot/images/enroll4.png new file mode 100644 index 0000000000..fc7215b68f Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll4.png differ diff --git a/windows/deployment/windows-autopilot/images/group1.png b/windows/deployment/windows-autopilot/images/group1.png new file mode 100644 index 0000000000..2ccc8db248 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/group1.png differ diff --git a/windows/deployment/windows-autopilot/images/hyper-v-feature.png b/windows/deployment/windows-autopilot/images/hyper-v-feature.png new file mode 100644 index 0000000000..d7293d808e Binary files /dev/null and b/windows/deployment/windows-autopilot/images/hyper-v-feature.png differ diff --git a/windows/deployment/windows-autopilot/images/profile.png b/windows/deployment/windows-autopilot/images/profile.png index 40cf26bee2..1c6c734a74 100644 Binary files a/windows/deployment/windows-autopilot/images/profile.png and b/windows/deployment/windows-autopilot/images/profile.png differ diff --git a/windows/deployment/windows-autopilot/images/svr_mgr2.png b/windows/deployment/windows-autopilot/images/svr_mgr2.png new file mode 100644 index 0000000000..dd2e6737c6 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/svr_mgr2.png differ diff --git a/windows/deployment/windows-autopilot/images/update-flow.png b/windows/deployment/windows-autopilot/images/update-flow.png new file mode 100644 index 0000000000..c90f54e96c Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update-flow.png differ diff --git a/windows/deployment/windows-autopilot/images/update1.png b/windows/deployment/windows-autopilot/images/update1.png new file mode 100644 index 0000000000..83d98a29b5 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update1.png differ diff --git a/windows/deployment/windows-autopilot/images/update2.png b/windows/deployment/windows-autopilot/images/update2.png new file mode 100644 index 0000000000..04dbcaddc1 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update2.png differ diff --git a/windows/deployment/windows-autopilot/images/update3.png b/windows/deployment/windows-autopilot/images/update3.png new file mode 100644 index 0000000000..851adb58ec Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update3.png differ diff --git a/windows/deployment/windows-autopilot/index.md b/windows/deployment/windows-autopilot/index.md deleted file mode 100644 index efeffc2e04..0000000000 --- a/windows/deployment/windows-autopilot/index.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Windows Autopilot deployment -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot deployment - -**Applies to** - -- Windows 10 - -Windows Autopilot is a zero-touch, self-service Windows deployment platform introduced with Windows 10, version 1703. The Windows Autopilot process runs immediately after powering on a new computer for the first time, enabling employees to configure new devices to be business-ready with just a few clicks. - -This guide is intended for use by an IT-specialist, system architect, or business decision maker. The guide provides information about how Windows Autopilot deployment works, including detailed requirements, deployment scenarios, and platform capabilities. The document highlights options that are available to you when planning a modern, cloud-joined Windows 10 deployment strategy. Links are provided to detailed step by step configuration procedures. - -## In this guide - - -
              What's new Windows Autopilot is always being updated with new features! Check this topic to read about the latests capabilities. -
              - -### Understanding Windows Autopilot - - -
              Overview of Windows AutopilotA review of Windows Autopilot is provided with a video walkthrough. Benefits and general requirements are discussed. -
              RequirementsDetailed software, network, licensiing, and configuration requirments are provided. -
              Scenarios and CapabilitiesA summary of Windows Autopilot deployment scenarios and capabilities. -
              Get startedInterested in trying out Autopilot? See this step-by-step walkthrough to test Windows Autopilot on a virtual machine or physical device with a free 30-day trial premium Intune account. -
              - -### Deployment scenarios - - -
              User-driven modeRequirements and validation steps for deploying a new Azure Active Directory (AAD) joined or hybrid AAD-joined Windows 10 device are provided. -
              Self-deploying modeRequirements and validation steps for deploying a new Windows 10 device with little to no user interaction are provided. -
              Windows Autopilot ResetUsing Windows Autopilot Reset, a device can be restored to its original settings, taking it back to a business-ready state. Both local and remote reset scenarios are discussed. -
              Windows Autopilot for white glove deploymentRequirements and procedures are described that enable additional policies and apps to be delivered to a Windows Autopilot device. -
              Support for existing devicesThis topic describes how Windows Autopilot can be used to convert Windows 7 or Windows 8.1 domain-joined computers to AAD-joined computers running Windows 10. -
              - -### Using Windows Autopilot - - -
              Registering devicesThe process of registering a device with the Windows Autopilot deployment service is described. -
              Configuring device profilesThe device profile settings that specifie its behavior when it is deployed are described. -
              Enrollment status pageSettings that are available on the Enrollment Status Page are described. -
              BitLocker encryption Available options for configuring BitLocker on Windows Autopilot devices are described. -
              Troubleshooting Windows AutopilotDiagnotic event information and troubleshooting procedures are provided. -
              Known issuesA list of current known issues and solutions is provided. -
              - -### Support topics - - -
              FAQFrequently asked questions on several topics are provided. -
              Support contactsSupport information is provided. -
              Registration authorizationThis article discusses how a CSP partner or OEM can obtain customer authorization to register Windows Autopilot devices. -
              Motherboard replacementInformation about how to deal with Autopilot registration and device repair issues is provided. -
              - -## Related topics - -[Windows Autopilot](https://www.microsoft.com/windowsforbusiness/windows-autopilot) diff --git a/windows/deployment/windows-autopilot/index.yml b/windows/deployment/windows-autopilot/index.yml new file mode 100644 index 0000000000..19763ed2b7 --- /dev/null +++ b/windows/deployment/windows-autopilot/index.yml @@ -0,0 +1,38 @@ +### YamlMime:Landing + +title: Windows Autopilot deployment resources and documentation # < 60 chars +summary: 'Note: Windows Autopilot documentation has moved! A few additional resources will also be available here. See the links on this page for more information.' # < 160 chars + +metadata: + title: Windows Autopilot deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about deploying Windows 10 and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. + services: windows-10 + ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. + ms.subservice: subservice + ms.topic: landing-page # Required + ms.collection: windows-10 + author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. + ms.author: greglin #Required; microsoft alias of author; optional team alias. + ms.date: 08/05/2020 #Required; mm/dd/yyyy format. + localization_priority: medium + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card + - title: Overview + linkLists: + - linkListType: overview + links: + - text: Overview of Windows Autopilot + url: https://docs.microsoft.com/mem/autopilot/windows-autopilot + + # Card + - title: Tutorials + linkLists: + - linkListType: get-started + links: + - text: Demonstrate Windows Autopilot deployment + url: demonstrate-deployment-on-vm.md \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/known-issues.md b/windows/deployment/windows-autopilot/known-issues.md deleted file mode 100644 index d1f538dd46..0000000000 --- a/windows/deployment/windows-autopilot/known-issues.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Windows Autopilot known issues -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot - known issues - -**Applies to** - -- Windows 10 - - -
              IssueMore information -
              The following known issues are resolved by installing the July 26, 2019 KB4505903 update (OS Build 18362.267): - -- Windows Autopilot white glove does not work for a non-English OS and you see a red screen that says "Success." -- Windows Autopilot reports an AUTOPILOTUPDATE error during OOBE after sysprep, reset or other variations. This typically happens if you reset the OS or used a custom sysprepped image. -- BitLocker encryption is not correctly configured. Ex: BitLocker didn’t get an expected notification after policies were applied to begin encryption. -- You are unable to install UWP apps from the Microsoft Store, causing failures during Windows Autopilot. If you are deploying Company Portal as a blocking app during Windows Autopilot ESP, you’ve probably seen this error. -- A user is not granted administrator rights in the Windows Autopilot user-driven Hybrid Azure AD join scenario. This is another non-English OS issue. -Download and install the KB4505903 update.

              See the section: How to get this update for information on specific release channels you can use to obtain the update. -
              White glove gives a red screen and the Microsoft-Windows-User Device Registration/Admin event log displays HResult error code 0x801C03F3This can happen if Azure AD can’t find an AAD device object for the device that you are trying to deploy. This will occur if you manually delete the object. To fix it, remove the device from AAD, Intune, and Autopilot, then re-register it with Autopilot, which will recreate the AAD device object.
              -
              To obtain troubleshooting logs use: Mdmdiagnosticstool.exe -area Autopilot;TPM -cab c:\autopilot.cab -
              White glove gives a red screenWhite glove is not supported on a VM. -
              Error importing Windows Autopilot devices from a .csv fileEnsure that you have not edited the .csv file in Microsoft Excel or an editor other than Notepad. Some of these editors can introduce extra characters causing the file format to be invalid. -
              Windows Autopilot for existing devices does not follow the Autopilot OOBE experience.Ensure that the JSON profile file is saved in ANSI/ASCII format, not Unicode or UTF-8. -
              Something went wrong is displayed page during OOBE.The client is likely unable to access all the required AAD/MSA-related URLs. For more information, see Networking requirements. -
              - -## Related topics - -[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
              -[Troubleshooting Windows Autopilot](troubleshooting.md) diff --git a/windows/deployment/windows-autopilot/profiles.md b/windows/deployment/windows-autopilot/profiles.md deleted file mode 100644 index 6e54f66318..0000000000 --- a/windows/deployment/windows-autopilot/profiles.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Configure Autopilot profiles -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Configure Autopilot profiles - -**Applies to** - -- Windows 10 - -For each device that has been defined to the Windows Autopilot deployment service, a profile of settings needs to be applied that specifies the exact behavior of that device when it is deployed. For detailed procedures on how to configure profile settings and register devices, see [Registering devices](add-devices.md#registering-devices). - -## Profile settings - -The following profile settings are available: - -- **Skip Cortana, OneDrive and OEM registration setup pages**. All devices registered with Autopilot will automatically skip these pages during the out-of-box experience (OOBE) process. - -- **Automatically setup for work or school**. All devices registered with Autopilot will automatically be considered work or school devices, so this question will not be asked during the OOBE process. - -- **Sign in experience with company branding**. Instead of presenting a generic Azure Active Directory sign-in page, all devices registered with Autopilot will automatically present a customized sign-in page with the organization’s name, logon, and additional help text, as configured in Azure Active Directory. See [Add company branding to your directory](https://docs.microsoft.com/azure/active-directory/customize-branding#add-company-branding-to-your-directory) to customize these settings. - -- **Skip privacy settings**. This optional Autopilot profile setting enables organizations to not ask about privacy settings during the OOBE process. This is typically desirable so that the organization can configure these settings via Intune or other management tool. - -- **Disable local admin account creation on the device**. Organizations can decide whether the user setting up the device should have administrator access once the process is complete. - -- **Skip End User License Agreement (EULA)**. Starting in Windows 10 version 1709, organizations can decide to skip the EULA page presented during the OOBE process. This means that organizations accept the EULA terms on behalf of their users. - -- **Disable Windows consumer features**. Starting in Windows 10 version 1803, organizations can disable Windows consumer features so that the device does not automatically install any additional Microsoft Store apps when the user first signs into the device. See the [MDM documentation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) for more details. - -## Related topics - -[Profile download](troubleshooting.md#profile-download) -[Registering devices](add-devices.md) diff --git a/windows/deployment/windows-autopilot/registration-auth.md b/windows/deployment/windows-autopilot/registration-auth.md deleted file mode 100644 index 9ae9105cbd..0000000000 --- a/windows/deployment/windows-autopilot/registration-auth.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Windows Autopilot customer consent -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot customer consent - -**Applies to: Windows 10** - -This article describes how a cloud service provider (CSP) partner (direct bill, indirect provider, or indirect reseller) or an OEM can get customer authorization to register Windows Autopilot devices on the customer’s behalf. - -## CSP authorization - -CSP partners can get customer authorization to register Windows Autopilot devices on the customer’s behalf per the following restrictions: - - -
              Direct CSPGets direct authorization from the customer to register devices. -
              Indirect CSP ProviderGets implicit permission to register devices through the relationship their CSP Reseller partner has with the customer. Indirect CSP Providers register devices through Microsoft Partner Center. -
              Indirect CSP ResellerGets direct authorization from the customer to register devices. At the same time, their indirect CSP Provider partner also gets authorization, which mean that either the Indirect Provider or the Indirect Reseller can register devices for the customer. However, the Indirect CSP Reseller must register devices through the MPC UI (manually uploading CSV file), whereas the Indirect CSP Provider has the option to register devices using the MPC APIs. -
              - -### Steps - -For a CSP to register Windows Autopilot devices on behalf of a customer, the customer must first grant that CSP partner permission using the following process: - -1. CSP sends link to customer requesting authorization/consent to register/manage devices on their behalf. To do so: - - CSP logs into Microsoft Partner Center - - Click **Dashboard** on the top menu - - Click **Customer** on the side menu - - Click the **Request a reseller relationship** link: - ![Request a reseller relationship](images/csp1.png) - - Select the checkbox indicating whether or not you want delegated admin rights: - ![Delegated rights](images/csp2.png) - - NOTE: Depending on your partner, they might request Delegated Admin Permissions (DAP) when requesting this consent. You should ask them to use the newer DAP-free process (shown in this document) if possible. If not, you can easily remove their DAP status either from Microsoft Store for Business or the Office 365 admin portal: https://docs.microsoft.com/partner-center/customers_revoke_admin_privileges - - Send the template above to the customer via email. -2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link in the body of the email once they receive it from the CSP, which takes them directly to the following MSfB page: - - ![Global admin](images/csp3.png) - - NOTE: A user without global admin privileges who clicks the link will see a message similar to the following: - - ![Not global admin](images/csp4.png) - -3. Customer selects the **Yes** checkbox, followed by the **Accept** button. Authorization happens instantaneously. -4. The CSP will know that this consent/authorization request has been completed because the customer will show up in the CSP’s MPC account under their **customers** list, for example: - -![Customers](images/csp5.png) - -## OEM authorization - -Each OEM has a unique link to provide to their respective customers, which the OEM can request from Microsoft via msoemops@microsoft.com. - -1. OEM emails link to their customer. -2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link once they receive it from the OEM, which takes them directly to the following MSfB page: - - ![Global admin](images/csp6.png) - - NOTE: A user without global admin privileges who clicks the link will see a message similar to the following: - - ![Not global admin](images/csp7.png) -3. Customer selects the **Yes** checkbox, followed by the **Accept** button, and they’re done. Authorization happens instantaneously. - -4. The OEM can use the Validate Device Submission Data API to verify the consent has completed. This API is discussed in the latest version of the API Whitepaper, p. 14ff [https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx](https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx). **Note**: this link is only accessible by Microsoft Device Partners. As discussed in this whitepaper, it’s a best practice recommendation for OEM partners to run the API check to confirm they’ve received customer consent before attempting to register devices, thus avoiding errors in the registration process. - -## Summary - -At this stage of the process, Microsoft is no longer involved; the consent exchange happens directly between the OEM and the customer. And, it all happens instantaneously - as quickly as buttons are clicked. - diff --git a/windows/deployment/windows-autopilot/self-deploying.md b/windows/deployment/windows-autopilot/self-deploying.md deleted file mode 100644 index 939b4ac431..0000000000 --- a/windows/deployment/windows-autopilot/self-deploying.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Windows Autopilot Self-Deploying mode -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot Self-Deploying mode - -**Applies to: Windows 10, version 1903 or later** - -Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection). - -Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned. - ->[!NOTE] ->Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join. All devices will be joined to Azure Active Directory. - -Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10. See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details. - ->[!NOTE] ->Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process). As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device. For more information see [Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) and [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md). - -![The user experience with Windows Autopilot self-deploying mode](images/self-deploy-welcome.png) - -## Requirements - -Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.) - ->[!IMPORTANT] ->If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported).. Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC. - -In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. - -## Step by step - -In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed: - -- Create an Autopilot profile for self-deploying mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.) -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. Ensure that the profile has been assigned to the device before attempting to deploy that device. -- Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete. - -## Validation - -When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed: - -- Once connected to a network, the Autopilot profile will be downloaded. -- If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available. Otherwise, manual steps are required: - - If multiple languages are preinstalled in Windows 10, the user must pick a language. - - The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. -- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. -- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). -- The device will join Azure Active Directory. -- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). -- The [enrollment status page](enrollment-status.md) will be displayed. -- Depending on the device settings deployed, the device will either: - - Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials. - - Automatically sign in as a local account, for devices configured as a kiosk or digital signage. - ->[!NOTE] ->Deploying EAS policies using self-deploying mode for kiosk deployments will cause auto-logon functionality to fail. - -In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. diff --git a/windows/deployment/windows-autopilot/troubleshooting.md b/windows/deployment/windows-autopilot/troubleshooting.md deleted file mode 100644 index 2d857f5388..0000000000 --- a/windows/deployment/windows-autopilot/troubleshooting.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Troubleshooting Windows Autopilot -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Troubleshooting Windows Autopilot - -**Applies to: Windows 10** - -Windows Autopilot is designed to simplify all parts of the Windows device lifecycle, but there are always situations where issues may arise, either due to configuration or other issues. To assist with troubleshooting efforts, review the following information. - -## Troubleshooting process - -Regardless of whether performing user-driven or self-deploying device deployments, the troubleshooting process is the mostly the same. It is useful to understand the flow for a specific device: - -- Network connection established. This can be a wireless (Wi-fi) or wired (Ethernet) connection. -- Windows Autopilot profile downloaded. Whether using a wired connection or manually establishing a wireless connection, the Windows Autopilot profile will be downloaded from the Autopilot deployment service as soon as the network connection is in place. -- User authentication. When performing a user-driven deployment, the user will enter their Azure Active Directory credentials, which will be validated. -- Azure Active Directory join. For user-driven deployments, the device will be joined to Azure AD using the specified user credentials. For self-deploying scenarios, the device will be joined without specifying any user credentials. -- Automatic MDM enrollment. As part of the Azure AD join process, the device will enroll in the MDM service configured in Azure AD (e.g. Microsoft Intune). -- Settings are applied. If the [enrollment status page](enrollment-status.md) is configured, most settings will be applied while the enrollment status page is displayed. If not configured or available, settings will be applied after the user is signed in. - -For troubleshooting, key activities to perform are: - -- Configuration. Has Azure Active Directory and Microsoft Intune (or an equivalent MDM service) been configured as specified in [Windows Autopilot configuration requirements](windows-autopilot-requirements.md)? -- Network connectivity. Can the device access the services described in [Windows Autopilot networking requirements](windows-autopilot-requirements.md)? -- Autopilot OOBE behavior. Were only the expected out-of-box experience screens displayed? Was the Azure AD credentials page customized with organization-specific details as expected? -- Azure AD join issues. Was the device able to join Azure Active Directory? -- MDM enrollment issues. Was the device able to enroll in Microsoft Intune (or an equivalent MDM service)? - -## Troubleshooting Autopilot OOBE issues - -If the expected Autopilot behavior does not occur during the out-of-box experience (OOBE), it is useful to see whether the device received an Autopilot profile and what settings that profile contained. Depending on the Windows 10 release, there are different mechanisms available to do that. - -### Windows 10 version 1803 and above - -To see details related to the Autopilot profile settings and OOBE flow, Windows 10 version 1803 and above adds event log entries. These can be viewed using Event Viewer, navigating to the log at **Application and Services Logs –> Microsoft –> Windows –> Provisioning-Diagnostics-Provider –> AutoPilot**. The following events may be recorded, depending on the scenario and profile configuration. - -| Event ID | Type | Description | -|----------|------|-------------| -| 100 | Warning | “AutoPilot policy [name] not found.” This is typically a temporary problem, while the device is waiting for an Autopilot profile to be downloaded. | -| 101 | Info | “AutoPilotGetPolicyDwordByName succeeded: policy name = [setting name]; policy value [value].” This shows Autopilot retrieving and processing numeric OOBE settings. | -| 103 | Info | “AutoPilotGetPolicyStringByName succeeded: policy name = [name]; value = [value].” This shows Autopilot retrieving and processing OOBE setting strings such as the Azure AD tenant name. | -| 109 | Info | “AutoPilotGetOobeSettingsOverride succeeded: OOBE setting [setting name]; state = [state].” This shows Autopilot retrieving and processing state-related OOBE settings. | -| 111 | Info | “AutoPilotRetrieveSettings succeeded.” This means that the settings stored in the Autopilot profile that control the OOBE behavior have been retrieved successfully. | -| 153 | Info | “AutoPilotManager reported the state changed from [original state] to [new state].” Typically this should say “ProfileState_Unknown” to “ProfileState_Available” to show that a profile was available for the device and downloaded, so the device is ready to be deployed using Autopilot. | -| 160 | Info | “AutoPilotRetrieveSettings beginning acquisition.” This shows that Autopilot is getting ready to download the needed Autopilot profile settings. | -| 161 | Info | “AutoPilotManager retrieve settings succeeded.” The Autopilot profile was successfully downloaded. | -| 163 | Info | “AutoPilotManager determined download is not required and the device is already provisioned. Clean or reset the device to change this.” This message indicates that an Autopilot profile is resident on the device; it typically would only be removed by the **Sysprep /Generalize** process. | -| 164 | Info | “AutoPilotManager determined Internet is available to attempt policy download.” | -| 171 | Error | “AutoPilotManager failed to set TPM identity confirmed. HRESULT=[error code].” This indicates an issue performing TPM attestation, needed to complete the self-deploying mode process. | -| 172 | Error | “AutoPilotManager failed to set AutoPilot profile as available. HRESULT=[error code].” This is typically related to event ID 171. | - -In addition to the event log entries, the registry and ETW trace options described below also work with Windows 10 version 1803 and above. - -### Windows 10 version 1709 and above - -On Windows 10 version 1709 and above, information about the Autopilot profile settings are stored in the registry on the device after they are received from the Autopilot deployment service. These can be found at **HKLM\SOFTWARE\Microsoft\Provisioning\Diagnostics\AutoPilot**. Available registry entries include: - -| Value | Description | -|-------|-------------| -| AadTenantId | The GUID of the Azure AD tenant the user signed into. This should match the tenant that the device was registered with; if it does not match the user will receive an error. | -| CloudAssignedTenantDomain | The Azure AD tenant the device has been registered with, e.g. “contosomn.onmicrosoft.com.” If the device is not registered with Autopilot, this value will be blank. | -| CloudAssignedTenantId | The GUID of the Azure AD tenant the device has been registered with (the GUID corresponds to the tenant domain from the CloudAssignedTenantDomain registry value). If the device isn’t registered with Autopilot, this value will be blank.| -| IsAutoPilotDisabled | If set to 1, this indicates that the device is not registered with Autopilot. This could also indicate that the Autopilot profile could not be downloaded due to network connectivity or firewall issues, or network timeouts. | -| TenantMatched | This will be set to 1 if the tenant ID of the user matches the tenant ID that the device was registered with. If this is 0, the user would be shown an error and forced to start over. | -| CloudAssignedOobeConfig | This is a bitmap that shows which Autopilot settings were configured. Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16 | - -### Windows 10 version 1703 and above - -On Windows 10 version 1703 and above, ETW tracing can be used to capture detailed information from Autopilot and related components. The resulting ETW trace files can then be viewed using the Windows Performance Analyzer or similar tools. See [the advanced troubleshooting blog](https://blogs.technet.microsoft.com/mniehaus/2017/12/13/troubleshooting-windows-autopilot-level-300400/) for more information. - -## Troubleshooting Azure AD Join issues - -The most common issue joining a device to Azure AD is related to Azure AD permissions. Ensure [the correct configuration is in place](windows-autopilot-requirements.md) to allow users to join devices to Azure AD. Errors can also happen if the user has exceeded the number of devices that they are allowed to join, as configured in Azure AD. - -Error code 801C0003 will typically be reported on an error page titled "Something went wrong". This error means that the Azure AD join failed. - -## Troubleshooting Intune enrollment issues - -See [this knowledge base article](https://support.microsoft.com/help/4089533/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for assistance with Intune enrollment issues. Common issues include incorrect or missing licenses assigned to the user or too many devices enrolled for the user. - -Error code 80180018 will typically be reported on an error page titled "Something went wrong". This error means that the MDM enrollment failed. - -If Autopilot Reset fails immediately with an error "Ran into trouble. Please sign in with an administrator account to see why and reset manually," see [Troubleshoot Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset#troubleshoot-autopilot-reset) for more help. - -## Profile download - -When an Internet-connected Windows 10 device boots up, it will attempt to connect to the Autopilot service and download an Autopilot profile. Note: It is important that a profile exists at this stage so that a blank profile is not cached locally on the PC. To remove the currently cached local profile in Windows 10 version 1803 and earlier, it is necessary to re-generalize the OS using **sysprep /generalize /oobe**, reinstall the OS, or re-image the PC. In Windows 10 version 1809 and later, you can retrieve a new profile by rebooting the PC. - -When a profile is downloaded depends on the version of Windows 10 that is running on the PC. See the following table. - -| Windows 10 version | Profile download behavior | -| --- | --- | -| 1703 and 1709 | The profile is downloaded after the OOBE network connection page. This page is not displayed when using a wired connection. In this case, the profile is downloaded just prior to the EULA screen. | -| 1803 | The profile is downloaded as soon as possible. If wired, it is downloaded at the start of OOBE. If wireless, it is downloaded after the network connection page. | -| 1809 | The profile is downloaded as soon as possible (same as 1803), and again after each reboot. | - -If you need to reboot a computer during OOBE: -- Press Shift-F10 to open a command prompt. -- Enter **shutdown /r /t 0** to restart immediately, or **shutdown /s /t 0** to shutdown immediately. - -For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options). - -## Related topics - -[Windows Autopilot - known issues](known-issues.md)
              -[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
              diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md deleted file mode 100644 index 7629dc2ba8..0000000000 --- a/windows/deployment/windows-autopilot/user-driven.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Windows Autopilot User-Driven Mode -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot user-driven mode - -Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions: - -- Unbox the device, plug it in, and turn it on. -- Choose a language, locale and keyboard. -- Connect it to a wireless or wired network with internet access. -- Specify your e-mail address and password for your organization account. - -After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. - -Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. - -## Available user-driven modes - -The following options are available for user-driven deployment: - -- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain. -- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain. - -### User-driven mode for Azure Active Directory join - -In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: - -- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. -- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. - -For each device that will be deployed using user-driven deployment, these additional steps are needed: - -- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. -- Ensure an Autopilot profile has been assigned to the device: - - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. - - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. - - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. - -Also see the [Validation](#validation) section below. - -### User-driven mode for hybrid Azure Active Directory join - -Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan). - -#### Requirements - -To perform a user-driven hybrid AAD joined deployment using Windows Autopilot: - -- A Windows Autopilot profile for user-driven mode must be created and - - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile. -- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group. -- The device must be running Windows 10, version 1809 or later. -- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user). -- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md). -- The Intune Connector for Active Directory must be installed. - - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. -- If using Proxy, WPAD Proxy settings option must be enabled and configured. - -**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default. - -#### Step by step instructions - -See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid). - -Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. - -## Validation - -When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed: - -- If multiple languages are preinstalled in Windows 10, the user must pick a language. -- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. -- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. -- Once connected to a network, the Autopilot profile will be downloaded. -- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). -- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text. -- Once correct credentials have been entered, the device will join Azure Active Directory. -- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). -- If configured, the [enrollment status page](enrollment-status.md) will be displayed. -- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided. -- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks. - -In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md deleted file mode 100644 index 75e7e3a334..0000000000 --- a/windows/deployment/windows-autopilot/white-glove.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: Windows Autopilot for white glove deployment -description: Windows Autopilot for white glove deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, pre-provisioning -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -manager: laurawi -ms.audience: itpro -author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot for white glove deployment - -**Applies to: Windows 10, version 1903** - -Windows Autopilot enables organizations to easily provision new devices - leveraging the preinstalled OEM image and drivers with a simple process that can be performed by the end user to help get their device business-ready. - - ![OEM](images/wg01.png) - -Windows Autopilot can also provide a white glove service that enables partners or IT staff to pre-provision a Windows 10 PC so that it is fully configured and business-ready. From the end user’s perspective, the Windows Autopilot user-driven experience is unchanged, but getting their device to a fully provisioned state is faster. - -With **Windows Autopilot for white glove deployment**, the provisioning process is split. The time-consuming portions are performed by IT, partners, or OEMs. The end user simply completes a few necessary settings and polices and then they can begin using their device. - - ![OEM](images/wg02.png) - -Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven [Azure AD join](user-driven-aad.md) and [Hybrid Azure AD](user-driven-hybrid.md) join scenarios. - -## Prerequisites - -In addition to [Windows Autopilot requirements](windows-autopilot-requirements.md), Windows Autopilot for white glove deployment adds the following: - -- Windows 10, version 1903 or later is required. -- An Intune subscription. -- Physical devices that support TPM 2.0 and device attestation; virtual machines are not supported. The white glove provisioning process leverages Windows Autopilot self-deploying capabilities, hence the TPM 2.0 requirements. -- Physical devices with Ethernet connectivity; Wi-fi connectivity is not supported due to the requirement to choose a language, locale, and keyboard to make that Wi-fi connection; doing that in a pre-provisioning process could prevent the user from choosing their own language, locale, and keyboard when they receive the device. - ->[!IMPORTANT] ->Because the OEM or vendor performs the white glove process, this doesn’t require access to an end-user's on-prem domain infrastructure. This is unlike a typical hybrid Azure AD-joined scenario because rebooting the device is postponed. The device is resealed prior to the time when connectivity to a domain controller is expected, and the domain network is contacted when the device is unboxed on-prem by the end-user. - -## Preparation - -Devices slated for white glove provisioning are registered for Autopilot via the normal registration process. - -To be ready to try out Windows Autopilot for white glove deployment, ensure that you can first successfully use existing Windows Autopilot user-driven scenarios: - -- User-driven Azure AD join. Devices can be deployed using Windows Autopilot and joined to an Azure Active Directory tenant. -- User-driven with Hybrid Azure AD join. Devices can be deployed using Windows Autopilot and joined to an on-premises Active Directory domain, then registered with Azure Active Directory to enable the Hybrid Azure AD join features. - -If these scenarios cannot be completed, Windows Autopilot for white glove deployment will also not succeed since it builds on top of these scenarios. - -To enable white glove deployment, an additional Autopilot profile setting must be configured by the customer or IT Admin via their Intune account, prior to beginning the white glove process in the provisioning service facility: - - ![allow white glove](images/allow-white-glove-oobe.png) - -The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. - ->[!NOTE] ->Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. - -## Scenarios - -Windows Autopilot for white glove deployment supports two distinct scenarios: -- User-driven deployments with Azure AD Join. The device will be joined to an Azure AD tenant. -- User-driven deployments with Hybrid Azure AD Join. The device will be joined to an on-premises Active Directory domain, and separately registered with Azure AD. -Each of these scenarios consists of two parts, a technician flow and a user flow. At a high level, these parts are the same for Azure AD Join and Hybrid Azure AD join; differences are primarily seen by the end user in the authentication steps. - -### Technican flow - -After the customer or IT Admin has targeted all the apps and settings they want for their devices through Intune, the white glove technician can begin the white glove process. The technician could be a member of the IT staff, a services partner, or an OEM – each organization can decide who should perform these activities. Regardless of the scenario, the process to be performed by the technician is the same: -- Boot the device (running Windows 10 Pro, Enterprise, or Education SKUs, version 1903 or later). -- From the first OOBE screen (which could be a language selection or locale selection screen), do not click **Next**. Instead, press the Windows key five times to view an additional options dialog. From that screen, choose the **Windows Autopilot provisioning** option and then click **Continue**. - - ![choice](images/choice.png) - -- On the **Windows Autopilot Configuration** screen, information will be displayed about the device: - - The Autopilot profile assigned to the device. - - The organization name for the device. - - The user assigned to the device (if there is one). - - A QR code containing a unique identifier for the device, useful to look up the device in Intune to make any configuration changes needed (e.g. assigning a user, adding the device to any additional groups needed for app or policy targeting). - - **Note**: The QR codes can be scanned using a companion app, which will also configure the device to specify who it belongs to. An [open-source sample of the companion app](https://github.com/Microsoft/WindowsAutopilotCompanion) that integrates with Intune via the Graph API has been published to GitHub by the Autopilot team. -- Validate the information displayed. If any changes are needed, make these and then click **Refresh** to re-download the updated Autopilot profile details. - - ![landing](images/landing.png) - -- Click **Provision** to begin the provisioning process. - -If the pre-provisioning process completes successfully: -- A green status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. - ![white-glove-result](images/white-glove-result.png) -- Click **Reseal** to shut the device down. At that point, the device can be shipped to the end user. - -If the pre-provisioning process fails: -- A red status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. -- Diagnostic logs can be gathered from the device, and then it can be reset to start the process over again. - -### User flow - -If the pre-provisioning process completed successfully and the device was resealed, it can be delivered to the end user to complete the normal Windows Autopilot user-driven process. They will perform a standard set of steps: - -- Power on the device. -- Select the appropriate language, locale, and keyboard layout. -- Connect to a network (if using Wi-Fi). If using Hybrid Azure AD Join, there must be connectivity to a domain controller; if using Azure AD Join, internet connectivity is required. -- On the branded sign-on screen, enter the user’s Azure Active Directory credentials. -- If using Hybrid Azure AD Join, the device will reboot; after the reboot, enter the user’s Active Directory credentials. -- Additional policies and apps will be delivered to the device, as tracked by the Enrollment Status Page (ESP). Once complete, the user will be able to access the desktop. - -## Related topics - -[White glove video](https://youtu.be/nE5XSOBV0rI) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md deleted file mode 100644 index 4fcd4811c2..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: Windows Autopilot requirements -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot requirements - -**Applies to: Windows 10** - -Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune. In order to use Windows Autopilot and leverage these capabilities, some requirements must be met. - -**Note**: For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at [Windows Autopilot](https://aka.ms/windowsautopilot). - -## Software requirements - -- Windows 10 version 1703 (semi-annual channel) or higher is required. -- The following editions are supported: - - Windows 10 Pro - - Windows 10 Pro Education - - Windows 10 Pro for Workstations - - Windows 10 Enterprise - - Windows 10 Education - - Windows 10 Enterprise 2019 LTSC - -## Networking requirements - -Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following: - -- Ensure DNS name resolution for internet DNS names -- Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP) - -In environments that have more restrictive Internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the required services. For additional details about each of these services and their specific requirements, review the following details: - -
              ServiceInformation -
              Windows Autopilot Deployment Service and Windows ActivationAfter a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service. With Windows 10 builds 18204 and above, the following URLs are used: https://ztd.dds.microsoft.com, https://cs.dds.microsoft.com.
              - -For all supported Windows 10 releases, Windows Autopilot also uses Windows Activation services. See Windows activation or validation fails with error code 0x8004FE33 for details about problems that might occur when you connect to the Internet through a proxy server. -
              Azure Active DirectoryUser credentials are validated by Azure Active Directory, and the device can also be joined to Azure Active Directory. See Office 365 IP Address and URL Web service for more information. -
              IntuneOnce authenticated, Azure Active Directory will trigger enrollment of the device into the Intune MDM service. See the following link for details about network communication requirements: Intune network configuration requirements and bandwidth. -
              Windows UpdateDuring the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates. If there are problems connecting to Windows Update, see How to solve connection problems concerning Windows Update or Microsoft Update.
              - -If Windows Update is inaccessible, the AutoPilot process will still continue but critical updates will not be available. - -
              Delivery OptimizationWhen downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the Delivery Optimization service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.
              - -If the Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer). - -
              Network Time Protocol (NTP) SyncWhen a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate. Ensure that UDP port 123 to time.windows.com is accessible. -
              Domain Name Services (DNS)To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP.  This DNS server must be able to resolve internet names. -
              Diagnostics dataStarting in Windows 10, 1903, diagnostic data collection will be enabled by default. To disable Windows Analytics and related diagnostics capabilities, see Manage enterprise diagnostic data level.
              - -If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work. -
              Network Connection Status Indicator (NCSI)Windows must be able to tell that the device is able to access the internet. For more information, see Network Connection Status Indicator (NCSI). - -www.msftconnecttest.com must be resolvable via DNS and accessible via HTTP. -
              Windows Notification Services (WNS)This service is used to enable Windows to receive notifications from apps and services. See Microsoft Store for more information.
              - -If the WNS services are not available, the Autopilot process will still continue without notifications. -
              Microsoft Store, Microsoft Store for BusinessApps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM).  App updates and additional apps may also be needed when the user first logs in. For more information, see Prerequisites for Microsoft Store for Business and Education (also includes Azure AD and Windows Notification Services).
              - -If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps. - -
              Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). -
              Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. -
              Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode -
              - -## Licensing requirements - -Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory. It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs: - -To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required: -- [Microsoft 365 Business subscriptions](https://www.microsoft.com/en-us/microsoft-365/business) -- [Microsoft 365 F1 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise/firstline) -- [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/en-us/education/buy-license/microsoft365/default.aspx) -- [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune). -- [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features. -- [Intune for Education subscriptions](https://docs.microsoft.com/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features. -- [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune) (or an alternative MDM service). - -Additionally, the following are also recommended (but not required): -- [Office 365 ProPlus](https://www.microsoft.com/en-us/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services). -- [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise. - -## Configuration requirements - -Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios. - -- Configure Azure Active Directory automatic enrollment. For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details. If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services. -- Configure Azure Active Directory custom branding. In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties). -- Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise. - -Specific scenarios will then have additional requirements. Generally, there are two specific tasks: - -- Device registration. Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios. See [Adding devices to Windows Autopilot](add-devices.md) for more details. -- Profile configuration. Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device. See [Configure Autopilot profiles](profiles.md) for details. Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information. - -See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details. - -For a walkthrough for some of these and related steps, see this video: -
               
              - - -There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications). - -## Related topics - -[Configure Autopilot deployment](configure-autopilot.md) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset.md b/windows/deployment/windows-autopilot/windows-autopilot-reset.md deleted file mode 100644 index d0424dce3f..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-reset.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Windows Autopilot Reset -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot Reset - -- Applies to: Windows 10, version 1709 and later (local reset) -- Applies to: Windows 10, version 1809 and later (remote reset) - -Windows Autopilot Reset removes personal files, apps, and settings and reapplies a device’s original settings, maintaining its identity connection to Azure AD and its management connection to Intune so that the device is once again ready for use. Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and simply. - -The Windows Autopilot Reset process automatically retains information from the existing device: - -- Set the region, language, and keyboard to the originally-configured values. -- Wi-Fi connection details. -- Provisioning packages previously applied to the device, as well as a provisioning package present on a USB drive when the reset process is initiated. -- Azure Active Directory device membership and MDM enrollment information. - -Windows Autopilot Reset will block the user from accessing the desktop until this information is restored, including re-applying any provisioning packages. For devices enrolled in an MDM service, Windows Autopilot Reset will also block until an MDM sync is completed. - ->[!NOTE] ->The Autopilot Reset does not support Hybrid Azure AD joined devices. - -## Scenarios - -Windows Autopilot Reset supports two scenarios: - -- [Local reset](#reset-devices-with-local-windows-autopilot-reset) initiated by IT personnel or other administrators from the organization. -- [Remote reset](#reset-devices-with-remote-windows-autopilot-reset) initiated remotely by IT personnel via an MDM service such as Microsoft Intune. - -Additional requirements and configuration details apply with each scenario; see the detailed links above for more information. - -## Reset devices with local Windows Autopilot Reset - -**Applies to: Windows 10, version 1709 and above** - -The Intune Service Administrator role is required to perform this task. For more information, see [Add users and grant administrative permission to Intune](https://docs.microsoft.com/intune/users-add). - -IT admins can perform a local Windows Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With a local Autopilot Reset, devices are returned to a fully configured or known IT-approved state. - -To enable local Autopilot Reset in Windows 10: - -1. [Enable the policy for the feature](#enable-local-windows-autopilot-reset) -2. [Trigger a reset for each device](#trigger-local-windows-autopilot-reset) - -### Enable local Windows Autopilot Reset - -To enable a local Windows Autopilot Reset, the **DisableAutomaticReDeploymentCredentials** policy must be configured. This policy is documented in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, local Windows Autopilot is disabled. This ensures that a local Autopilot Reset is not triggered by accident. - -You can set the policy using one of these methods: - -- MDM provider - - - When using Intune, you can create a new device configuration profile, specifying "Windows 10 or later" for the platform, "Device restrictions" for the profile type, and "General" for the settings category. The **Automatic Redeployment** setting should be set to **Allow**. Deploy this setting to all devices where a local reset should be permitted. - - If you're using an MDM provider other than Intune, check your MDM provider documentation on how to set this policy. - -- Windows Configuration Designer - - You can [use Windows Configuration Designer](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting to 0 and then create a provisioning package. - -- Set up School PCs app - - The latest release of the Set up School PCs app supports enabling local Windows Autopilot Reset. - -### Trigger local Windows Autopilot Reset - -Performing a local Windows Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it is done, the device is again ready for use. - -**To trigger a local Autopilot Reset** - -1. From the Windows device lock screen, enter the keystroke: **CTRL + ![Windows key](images/windows_glyph.png) + R**. - - ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png) - - This will open up a custom login screen for the local Autopilot Reset. The screen serves two purposes: - 1. Confirm/verify that the end user has the right to trigger Local Autopilot Reset - 2. Notify the user in case a provisioning package, created using Windows Configuration Designer, will be used as part of the process. - - ![Custom login screen for local Autopilot Reset](images/autopilot-reset-customlogin.png) - -2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger the local Autopilot Reset. - - Once the local Autopilot Reset is triggered, the reset process starts. Once provisioning is complete, the device is again ready for use. - -## Reset devices with remote Windows Autopilot Reset - -**Applies to: Windows 10, version 1809 or later** - -When performing a remote Windows Autopilot Reset, an MDM service such an Microsoft Intune can be used to initiate the reset process, avoiding the need for IT staff or other administrators to visit each machine to initiate the process. - -To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed and joined to Azure AD. This feature is not supported on devices that were enrolled using [Autopilot self deploying mode](self-deploying.md). - -### Triggering a remote Windows Autopilot Reset - -To trigger a remote Windows Autopilot Reset via Intune, follow these steps: - -- Navigate to **Devices** tab in the Intune console. -- In the **All devices** view, select the targeted reset devices and then click **More** to view device actions. -- Select **Autopilot Reset** to kick-off the reset task. - ->[!NOTE] ->The Autopilot Reset option will not be enabled in Microsoft Intune for devices not running Windows 10 build 17672 or higher. - ->[!IMPORTANT] ->The feature for Autopilot Reset will stay grayed out, **unless** you reset the device using Autopilot (either using Fresh Reset or manually sysprep the device). - -Once the reset is complete, the device is again ready for use. - - - -## Troubleshooting - -Windows Autopilot Reset requires that the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is correctly configured and enabled on the device. If it is not configured and enabled, an error such as `Error code: ERROR_NOT_SUPPORTED (0x80070032)` will be reported. - -To make sure WinRE is enabled, use the [REAgentC.exe tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command: - -``` -reagentc /enable -``` - -If Windows Autopilot Reset fails after enabling WinRE, or if you are unable to enable WinRE, please contact [Microsoft Support](https://support.microsoft.com) for assistance. diff --git a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md deleted file mode 100644 index 5ee0171987..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Windows Autopilot scenarios and capabilities -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot scenarios and capabilities - -**Applies to: Windows 10** - -## Scenarios - -Windows Autopilot includes support for a growing list of scenarios, designed to support common organization needs which can vary based on the type of organization and their progress moving to Windows 10 and [transitioning to modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management). - -The following Windows Autopilot scenarios are described in this guide: - -| Scenario | More information | -| --- | --- | -| Deploy devices that will be set up by a member of the organization and configured for that person | [Windows Autopilot user-driven mode](user-driven.md) | -| Deploy devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.| [Windows Autopilot self-deploying mode](self-deploying.md) | -| Re-deploy a device in a business-ready state.| [Windows Autopilot Reset](windows-autopilot-reset.md) | -| Pre-provision a device with up-to-date applications, policies and settings.| [White glove](white-glove.md) | -| Deploy Windows 10 on an existing Windows 7 or 8.1 device | [Windows Autopilot for existing devices](existing-devices.md) | - -## Windows Autopilot capabilities - -### Windows Autopilot is self-updating during OOBE - -Starting with the Windows 10, version 1903, Autopilot functional and critical updates will begin downloading automatically during OOBE after a device gets connected to a network and the [critical driver and Windows zero-day patch (ZDP) updates](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe) have completed. The user or IT admin cannot opt-out of these Autopilot updates; they are required for Windows Autopilot deployment to operate properly. Windows will alert the user that the device is checking for, downloading and installing the updates. - -### Cortana voiceover and speech recognition during OOBE - -In Windows 10, version 1903 and later Cortana voiceover and speech recognition during OOBE is DISABLED by default for all Windows 10 Pro, Education and Enterprise SKUs. - -If desired, you can enable Cortana voiceover and speech recognition during OOBE by creating the following registry key. This key does not exist by default. - -HKLM\Software\Microsoft\Windows\CurrentVersion\OOBE\EnableVoiceForAllEditions - -The key value is a DWORD with **0** = disabled and **1** = enabled. - -| Value | Description | -| --- | --- | -| 0 | Cortana voiceover is disabled | -| 1 | Cortana voiceover is enabled | -| No value | Device will fall back to default behavior of the edition | - -To change this key value, use WCD tool to create as PPKG as documented [here](https://docs.microsoft.com/windows/configuration/wcd/wcd-oobe#nforce). - -### Bitlocker encryption - -With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. For more information, see [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md) - -## Related topics - -[Windows Autopilot: What's new](windows-autopilot-whats-new.md) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md b/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md deleted file mode 100644 index 36ee6c06ad..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Windows Autopilot what's new -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot: What's new - -**Applies to** - -- Windows 10 - -## New in Windows 10, version 1903 - -[Windows Autopilot for white glove deployment](white-glove.md) is new in Windows 10, version 1903. See the following video: - -
              - -> [!VIDEO https://www.youtube.com/embed/nE5XSOBV0rI] - -Also new in this version of Windows: -- The Intune enrollment status page (ESP) now tracks Intune Management Extensions. -- [Cortana voiceover and speech recognition during OOBE](windows-autopilot-scenarios.md#cortana-voiceover-and-speech-recognition-during-oobe) is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. -- [Windows Autopilot is self-updating during OOBE](windows-autopilot-scenarios.md#windows-autopilot-is-self-updating-during-oobe). Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the diagnostics data level to Full on Windows 10 version 1903 and later during OOBE. - -## New in Windows 10, version 1809 - -Windows Autopilot [self-deploying mode](self-deploying.md) enables a zero touch device provisioning experience. Simply power on the device, plug it into the Ethernet, and the device is fully configured by Windows Autopilot. This self-deploying capability removes the current need to have an end user interact by pressing the “Next” button during the deployment process. - -You can utilize Windows Autopilot self-deploying mode to register the device to an AAD tenant, enroll in your organization’s MDM provider, and provision policies and applications, all with no user authentication or user interaction required. - ->[!NOTE] ->Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. - -## Related topics - -[What's new in Microsoft Intune](https://docs.microsoft.com/intune/whats-new)
              -[What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/) diff --git a/windows/deployment/windows-autopilot/windows-autopilot.md b/windows/deployment/windows-autopilot/windows-autopilot.md deleted file mode 100644 index f307fbf265..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Overview of Windows Autopilot -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Overview of Windows Autopilot - -**Applies to** - -- Windows 10 - -Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple. - -Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users. See the following diagram: - - ![Process overview](images/image1.png) - -When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used. Instead of re-imaging the device, your existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features. - -Once deployed, Windows 10 devices can be managed by tools such as Microsoft Intune, Windows Update for Business, System Center Configuration Manager, and other similar tools. Windows Autopilot can also be used to re-purpose a device by leveraging Windows Autopilot Reset to quickly prepare a device for a new user, or in break/fix scenarios to enable a device to quickly be brought back to a business-ready state. - -Windows Autopilot enables you to: -* Automatically join devices to Azure Active Directory (Azure AD) or Active Directory (via Hybrid Azure AD Join). See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. -* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription*](windows-autopilot-requirements-configuration.md)). -* Restrict the Administrator account creation. -* Create and auto-assign devices to configuration groups based on a device's profile. -* Customize OOBE content specific to the organization. - -## Windows Autopilot walkthrough - -The following video shows the process of setting up Windows Autopilot: - -
              - - - -## Benefits of Windows Autopilot - -Traditionally, IT pros spend a lot of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new approach. - -From the user's perspective, it only takes a few simple operations to make their device ready to use. - -From the IT pro's perspective, the only interaction required from the end user is to connect to a network and to verify their credentials. Everything beyond that is automated. - -## Requirements - -Windows 10 version 1703 or higher is required to use Windows Autopilot. See [Windows Autopilot requirements](windows-autopilot-requirements.md) for detailed information on software, configuration, network, and licensing requirements. - -## Related topics - -[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot)
              -[Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index 742ae20f20..91aaa460e8 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -1,17 +1,17 @@ --- -title: Windows 10 deployment tools (Windows 10) -description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. +title: Windows 10 deployment scenarios and tools +description: Learn about the tools you can use to deploy Windows 10 and related applications to your organization. Explore deployment scenarios. ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877 ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay keywords: deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library audience: itpro -author: greg-lindsay ms.topic: article --- @@ -20,18 +20,18 @@ ms.topic: article To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. -Microsoft provides many tools, services, and solutions. These tools include Windows Deployment Services (WDS), the Volume Activation Management Tool (VAMT), the User State Migration Tool (USMT), Windows System Image Manager (Windows SIM), Windows Preinstallation Environment (Windows PE), and Windows Recovery Environment (Windows RE). Keep in mind that these are just tools and not a complete solution on their own. It’s when you combine these tools with solutions like [Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) or [Microsoft System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) that you get the complete deployment solution. +Microsoft provides many tools, services, and solutions. These tools include Windows Deployment Services (WDS), the Volume Activation Management Tool (VAMT), the User State Migration Tool (USMT), Windows System Image Manager (Windows SIM), Windows Preinstallation Environment (Windows PE), and Windows Recovery Environment (Windows RE). Keep in mind that these are just tools and not a complete solution on their own. It’s when you combine these tools with solutions like [Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) or [Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) that you get the complete deployment solution. In this topic, you also learn about different types of reference images that you can build, and why reference images are beneficial for most organizations -## Windows Assessment and Deployment Kit +## Windows Assessment and Deployment Kit Windows ADK contains core assessment and deployment tools and technologies, including Deployment Image Servicing and Management (DISM), Windows Imaging and Configuration Designer (Windows ICD), Windows System Image Manager (Windows SIM), User State Migration Tool (USMT), Volume Activation Management Tool (VAMT), Windows Preinstallation Environment (Windows PE), Windows Assessment Services, Windows Performance Toolkit (WPT), Application Compatibility Toolkit (ACT), and Microsoft SQL Server 2012 Express. For more details, see [Windows ADK for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526803 ) or [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). ![figure 1](images/win-10-adk-select.png) -Figure 1. The Windows 10 ADK feature selection page. +The Windows 10 ADK feature selection page. ### Deployment Image Servicing and Management (DISM) @@ -52,7 +52,7 @@ Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All ![figure 2](images/mdt-11-fig05.png) -Figure 2. Using DISM functions in PowerShell. +Using DISM functions in PowerShell. For more information on DISM, see [DISM technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619161). @@ -68,38 +68,30 @@ Occasionally, we find that customers are wary of USMT because they believe it re USMT includes several command-line tools, the most important of which are ScanState and LoadState: - **ScanState.exe.** This performs the user-state backup. - - **LoadState.exe.** This performs the user-state restore. - - **UsmtUtils.exe.** This supplements the functionality in ScanState.exe and LoadState.exe. In addition to these tools, there are also XML templates that manage which data is migrated. You can customize the templates, or create new ones, to manage the backup process at a high level of detail. USMT uses the following terms for its templates: - **Migration templates.** The default templates in USMT. - - **Custom templates.** Custom templates that you create. - - **Config template.** An optional template, called Config.xml, which you can use to exclude or include components in a migration without modifying the other standard XML templates. ![figure 3](images/mdt-11-fig06.png) -Figure 3. A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files. +A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files. USMT supports capturing data and settings from Windows Vista and later, and restoring the data and settings to Windows 7 and later (including Windows 10 in both cases). It also supports migrating from a 32-bit operating system to a 64-bit operating system, but not the other way around. For example, you can use USMT to migrate from Windows 7 x86 to Windows 10 x64. By default USMT migrates many settings, most of which are related to the user profile but also to Control Panel configurations, file types, and more. The default templates that are used in Windows 10 deployments are MigUser.xml and MigApp.xml. These two default templates migrate the following data and settings: - Folders from each profile, including those from user profiles as well as shared and public profiles. For example, the My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites folders are migrated. - - Specific file types. USMT templates migrate the following file types: .accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*. **Note**   The OpenDocument extensions (\*.odt, \*.odp, \*.ods, etc.) that Microsoft Office applications can use are not migrated by default. - - - Operating system component settings - - Application settings These are the settings migrated by the default MigUser.xml and MigApp.xml templates. For more details on what USMT migrates, see [What does USMT migrate?](https://go.microsoft.com/fwlink/p/?LinkId=619227) For more information on the USMT overall, see the [USMT technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619228). @@ -110,7 +102,7 @@ Windows Imaging and Configuration Designer (Windows ICD) is a tool designed to a ![figure 4](images/windows-icd.png) -Figure 4. Windows Imaging and Configuration Designer. +Windows Imaging and Configuration Designer. For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkID=525483). @@ -120,7 +112,7 @@ Windows SIM is an authoring tool for Unattend.xml files. When using MDT and/or C ![figure 7](images/mdt-11-fig07.png) -Figure 5. Windows answer file opened in Windows SIM. +Windows answer file opened in Windows SIM. For more information, see [Windows System Image Manager Technical Reference]( https://go.microsoft.com/fwlink/p/?LinkId=619906). @@ -130,7 +122,7 @@ If you don’t use KMS, you can still manage your MAKs centrally with the Volume ![figure 6](images/mdt-11-fig08.png) -Figure 6. The updated Volume Activation Management Tool. +The updated Volume Activation Management Tool. VAMT also can be used to create reports, switch from MAK to KMS, manage Active Directory-based activation, and manage Office 2010 and Office 2013 volume activation. VAMT also supports PowerShell (instead of the old command-line tool). For example, if you want to get information from the VAMT database, you can type: @@ -148,7 +140,7 @@ The key thing to know about Windows PE is that, like the operating system, it ne ![figure 7](images/mdt-11-fig09.png) -Figure 7. A machine booted with the Windows ADK default Windows PE boot image. +A machine booted with the Windows ADK default Windows PE boot image. For more details on Windows PE, see [Windows PE (WinPE)](https://go.microsoft.com/fwlink/p/?LinkId=619233). @@ -159,18 +151,18 @@ Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset ![figure 8](images/mdt-11-fig10.png) -Figure 8. A Windows 10 client booted into Windows RE, showing Advanced options. +A Windows 10 client booted into Windows RE, showing Advanced options. For more information on Windows RE, see [Windows Recovery Environment](https://go.microsoft.com/fwlink/p/?LinkId=619236). -## Windows Deployment Services +## Windows Deployment Services Windows Deployment Services (WDS) has been updated and improved in several ways starting with Windows 8. Remember that the two main functions you will use are the PXE boot support and multicast. Most of the changes are related to management and increased performance. In Windows Server 2012 R2, WDS also can be used for the Network Unlock feature in BitLocker. ![figure 9](images/mdt-11-fig11.png) -Figure 9. Windows Deployment Services using multicast to deploy three machines. +Windows Deployment Services using multicast to deploy three machines. In Windows Server 2012 R2, [Windows Deployment Services](https://go.microsoft.com/fwlink/p/?LinkId=619245) can be configured for stand-alone mode or for Active Directory integration. In most scenarios, the Active Directory integration mode is the best option. WDS also has the capability to manage drivers; however, driver management through MDT and Configuration Manager is more suitable for deployment due to the flexibility offered by both solutions, so you will use them instead. In WDS, it is possible to pre-stage devices in Active Directory, but here, too, Configuration Manager has that capability built in, and MDT has the ability to use a SQL Server database for pre-staging. In most scenarios, those solutions are better than the built-in pre-staging function as they allow greater control and management. @@ -181,16 +173,14 @@ In some cases, you need to modify TFTP Maximum Block Size settings for performan Also, there are a few new features related to TFTP performance: - **Scalable buffer management.** Allows buffering an entire file instead of a fixed-size buffer for each client, enabling different sessions to read from the same shared buffer. - - **Scalable port management.** Provides the capability to service clients with shared UDP port allocation, increasing scalability. - - **Variable-size transmission window (Variable Windows Extension).** Improves TFTP performance by allowing the client and server to determine the largest workable window size. ![figure 10](images/mdt-11-fig12.png) -Figure 10. TFTP changes are now easy to perform. +TFTP changes are now easy to perform. -## Microsoft Deployment Toolkit +## Microsoft Deployment Toolkit MDT is a free deployment solution from Microsoft. It provides end-to-end guidance, best practices, and tools for planning, building, and deploying Windows operating systems. MDT builds on top of the core deployment tools in the Windows ADK by contributing guidance, reducing complexity, and adding critical features for an enterprise-ready deployment solution. @@ -204,20 +194,20 @@ Lite Touch and Zero Touch are marketing names for the two solutions that MDT sup ![figure 11](images/mdt-11-fig13.png) -Figure 11. The Deployment Workbench in, showing a task sequence. +The Deployment Workbench in, showing a task sequence. For more information on MDT, see the [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=618117) resource center. -## Microsoft Security Compliance Manager 2013 +## Microsoft Security Compliance Manager 2013 [Microsoft SCM](https://go.microsoft.com/fwlink/p/?LinkId=619246) is a free utility used to create baseline security settings for the Windows client and server environment. The baselines can be exported and then deployed via Group Policy, local policies, MDT, or Configuration Manager. The current version of Security Compliance Manager includes baselines for Windows 8.1 and several earlier versions of Windows, Windows Server, and Internet Explorer. ![figure 12](images/mdt-11-fig14.png) -Figure 12. The SCM console showing a baseline configuration for a fictional client's computer security compliance. +The SCM console showing a baseline configuration for a fictional client's computer security compliance. -## Microsoft Desktop Optimization Pack +## Microsoft Desktop Optimization Pack MDOP is a suite of technologies available to Software Assurance customers through an additional subscription. @@ -229,36 +219,33 @@ The following components are included in the MDOP suite: - **Microsoft User Experience Virtualization (UE-V).** UE-V monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - **Microsoft Advanced Group Policy Management (AGPM).** AGPM enables advanced management of Group Policy objects by providing change control, offline editing, and role-based delegation. - - **Microsoft Diagnostics and Recovery Toolset (DaRT).** DaRT provides additional tools that extend Windows RE to help you troubleshoot and repair your machines. - - **Microsoft BitLocker Administration and Monitoring (MBAM).** MBAM is an administrator interface used to manage BitLocker drive encryption. It allows you to configure your enterprise with the correct BitLocker encryption policy options, as well as monitor compliance with these policies. For more information on the benefits of an MDOP subscription, see [Microsoft Desktop Optimization Pack](https://go.microsoft.com/fwlink/p/?LinkId=619247). -## Internet Explorer Administration Kit 11 - +## Internet Explorer Administration Kit 11 There has been a version of IEAK for every version of Internet Explorer since 3.0. It gives you the capability to customize Internet Explorer as you would like. The end result of using IEAK is an Internet Explorer package that can be deployed unattended. The wizard creates one .exe file and one .msi file. ![figure 13](images/mdt-11-fig15.png) -Figure 13. The User Experience selection screen in IEAK 11. +The User Experience selection screen in IEAK 11. To download IEAK 11, see the [Internet Explorer Administration Kit (IEAK) Information and Downloads](https://go.microsoft.com/fwlink/p/?LinkId=619248) page. -## Windows Server Update Services +## Windows Server Update Services WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment. ![figure 14](images/mdt-11-fig16.png) -Figure 14. The Windows Server Update Services console. +The Windows Server Update Services console. For more information on WSUS, see the [Windows Server Update Services Overview](https://go.microsoft.com/fwlink/p/?LinkId=619249). -## Unified Extensible Firmware Interface +## Unified Extensible Firmware Interface For many years BIOS has been the industry standard for booting a PC. BIOS has served us well, but it is time to replace it with something better. **UEFI** is the replacement for BIOS, so it is important to understand the differences between BIOS and UEFI. In this section, you learn the major differences between the two and how they affect operating system deployment. @@ -268,11 +255,8 @@ For many years BIOS has been the industry standard for booting a PC. BIOS has se BIOS has been in use for approximately 30 years. Even though it clearly has proven to work, it has some limitations, including: - 16-bit code - - 1 MB address space - - Poor performance on ROM initialization - - MBR maximum bootable disk size of 2.2 TB As the replacement to BIOS, UEFI has many features that Windows can and will use. @@ -280,19 +264,12 @@ As the replacement to BIOS, UEFI has many features that Windows can and will use With UEFI, you can benefit from: - **Support for large disks.** UEFI requires a GUID Partition Table (GPT) based disk, which means a limitation of roughly 16.8 million TB in disk size and more than 100 primary disks. - - **Faster boot time.** UEFI does not use INT 13, and that improves boot time, especially when it comes to resuming from hibernate. - - **Multicast deployment.** UEFI firmware can use multicast directly when it boots up. In WDS, MDT, and Configuration Manager scenarios, you need to first boot up a normal Windows PE in unicast and then switch into multicast. With UEFI, you can run multicast from the start. - - **Compatibility with earlier BIOS.** Most of the UEFI implementations include a compatibility support module (CSM) that emulates BIOS. - - **CPU-independent architecture.** Even if BIOS can run both 32- and 64-bit versions of firmware, all firmware device drivers on BIOS systems must also be 16-bit, and this affects performance. One of the reasons is the limitation in addressable memory, which is only 64 KB with BIOS. - - **CPU-independent drivers.** On BIOS systems, PCI add-on cards must include a ROM that contains a separate driver for all supported CPU architectures. That is not needed for UEFI because UEFI has the ability to use EFI Byte Code (EBC) images, which allow for a processor-independent device driver environment. - - **Flexible pre-operating system environment.** UEFI can perform many functions for you. You just need an UEFI application, and you can perform diagnostics and automatic repairs, and call home to report errors. - - **Secure boot.** Windows 8 and later can use the UEFI firmware validation process, called secure boot, which is defined in UEFI 2.3.1. Using this process, you can ensure that UEFI launches only a verified operating system loader and that malware cannot switch the boot loader. ### Versions @@ -304,11 +281,8 @@ UEFI Version 2.3.1B is the version required for Windows 8 and later logo complia In regard to UEFI, hardware is divided into four device classes: - **Class 0 devices.** This is the UEFI definition for a BIOS, or non-UEFI, device. - - **Class 1 devices.** These devices behave like a standard BIOS machine, but they run EFI internally. They should be treated as normal BIOS-based machines. Class 1 devices use a CSM to emulate BIOS. These older devices are no longer manufactured. - - **Class 2 devices.** These devices have the capability to behave as a BIOS- or a UEFI-based machine, and the boot process or the configuration in the firmware/BIOS determines the mode. Class 2 devices use a CSM to emulate BIOS. These are the most common type of devices currently available. - - **Class 3 devices.** These are UEFI-only devices, which means you must run an operating system that supports only UEFI. Those operating systems include Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. Windows 7 is not supported on these class 3 devices. Class 3 devices do not have a CSM to emulate BIOS. ### Windows support for UEFI @@ -322,31 +296,13 @@ With UEFI 2.3.1, there are both x86 and x64 versions of UEFI. Windows 10 support There are many things that affect operating system deployment as soon as you run on UEFI/EFI-based hardware. Here are considerations to keep in mind when working with UEFI devices: - Switching from BIOS to UEFI in the hardware is easy, but you also need to reinstall the operating system because you need to switch from MBR/NTFS to GPT/FAT32 and NTFS. - - When you deploy to a Class 2 device, make sure the boot option you select matches the setting you want to have. It is common for old machines to have several boot options for BIOS but only a few for UEFI, or vice versa. - - When deploying from media, remember the media has to be FAT32 for UEFI, and FAT32 has a file-size limitation of 4GB. - - UEFI does not support cross-platform booting; therefore, you need to have the correct boot media (32- or 64-bit). For more information on UEFI, see the [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619251) overview and related resources. ## Related topics - - - -[Deploy Windows To Go](deploy-windows-to-go.md) - -[Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) - -[Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md) - - - - - - - - - +[Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10)
              +[Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md) \ No newline at end of file diff --git a/windows/docfx.json b/windows/docfx.json index 21cba6820f..b199d2a9c7 100644 --- a/windows/docfx.json +++ b/windows/docfx.json @@ -9,7 +9,7 @@ ], "resource": [ { - "files": ["**/images/**"], + "files": ["**/images/**", "**/*.pdf", "**/*.bmp"], "exclude": ["**/obj/**"] } ], @@ -17,10 +17,22 @@ "ROBOTS": "INDEX, FOLLOW", "audience": "ITPro", "breadcrumb_path": "/itpro/windows/breadcrumb/toc.json", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.windows" - } + "uhfHeaderId": "MSDocsHeader-M365-IT", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "Win.windows" + } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ], } }, "externalReference": [ diff --git a/windows/hub/TOC.md b/windows/hub/TOC.md index 1b9bb407c6..25ef07d002 100644 --- a/windows/hub/TOC.md +++ b/windows/hub/TOC.md @@ -1,4 +1,4 @@ -# [Windows 10](index.md) +# [Windows 10](index.yml) ## [What's new](/windows/whats-new) ## [Release information](/windows/release-information) ## [Deployment](/windows/deployment) diff --git a/windows/hub/docfx.json b/windows/hub/docfx.json index b850fee41f..2fad5a8fc9 100644 --- a/windows/hub/docfx.json +++ b/windows/hub/docfx.json @@ -36,6 +36,7 @@ "globalMetadata": { "audience": "ITPro", "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "ms.topic": "article", "feedback_system": "GitHub", @@ -46,7 +47,8 @@ "depot_name": "MSDN.windows-hub", "folder_relative_path_in_docset": "./" } - } + }, + "titleSuffix": "Windows 10 for IT Pros" }, "fileMetadata": {}, "template": [], diff --git a/windows/hub/index.md b/windows/hub/index.md deleted file mode 100644 index c9bfdfd89d..0000000000 --- a/windows/hub/index.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Windows 10 -description: Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10. -ms.assetid: 345A4B4E-BC1B-4F5C-9E90-58E647D11C60 -ms.prod: w10 -ms.localizationpriority: high -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.date: 07/16/2019 -ms.author: dansimp -ms.date: 09/03/2018 -ms.reviewer: dansimp -manager: dansimp ---- - -# Windows 10 - -Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10. - -  - -## Check out [what's new in Windows 10, version 1903](/windows/whats-new/whats-new-windows-10-version-1903). -
              - - - - - - - - - -
              - - Read what's new in Windows 10 -
              What's New?

              -
              - - Configure Windows 10 in your enterprise -
              Configuration

              -
              - - Windows 10 deployment -
              Deployment

              -

              - - Manage applications in your Windows 10 enterprise deployment -
              App Management
              -

              - - Windows 10 client management -
              Client Management
              -

              - - Windows 10 security -
              Security
              -
              - ->[!TIP] -> Looking for information about older versions of Windows? Check out our other [Windows libraries](/previous-versions/windows/) on docs.microsoft.com. You can also search this site to find specific information, like this [Windows 8.1 content](https://docs.microsoft.com/search/index?search=Windows+8.1&dataSource=previousVersions). - -## Get to know Windows as a Service (WaaS) - -The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. - -These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. - -- [Read more about Windows as a Service](/windows/deployment/update/waas-overview) \ No newline at end of file diff --git a/windows/hub/index.yml b/windows/hub/index.yml new file mode 100644 index 0000000000..75355791f6 --- /dev/null +++ b/windows/hub/index.yml @@ -0,0 +1,115 @@ +### YamlMime:Landing + +title: Windows 10 resources and documentation for IT Pros # < 60 chars +summary: Plan, deploy, secure, and manage devices running Windows 10. # < 160 chars + +metadata: + title: Windows 10 documentation for IT Pros # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Evaluate, plan, deploy, secure and manage devices running Windows 10. # Required; article description that is displayed in search results. < 160 chars. + services: windows-10 + ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. + ms.subservice: subservice + ms.topic: landing-page # Required + ms.collection: windows-10 + author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. + ms.author: greglin #Required; microsoft alias of author; optional team alias. + ms.date: 10/20/2020 #Required; mm/dd/yyyy format. + localization_priority: medium + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: What's new + linkLists: + - linkListType: overview + links: + - text: What's new in Windows 10, version 20H2 + url: /windows/whats-new/whats-new-windows-10-version-20H2 + - text: What's new in Windows 10, version 2004 + url: /windows/whats-new/whats-new-windows-10-version-2004 + - text: What's new in Windows 10, version 1909 + url: /windows/whats-new/whats-new-windows-10-version-1909 + - text: Windows 10 release information + url: https://docs.microsoft.com/windows/release-information/ + + # Card (optional) + - title: Configuration + linkLists: + - linkListType: how-to-guide + links: + - text: Configure Windows 10 + url: /windows/configuration/index + - text: Accessibility information for IT Pros + url: /windows/configuration/windows-10-accessibility-for-itpros + - text: Configure access to Microsoft Store + url: /windows/configuration/stop-employees-from-using-microsoft-store + - text: Set up a shared or guest PC + url: /windows/configuration/set-up-shared-or-guest-pc + + # Card (optional) + - title: Deployment + linkLists: + - linkListType: deploy + links: + - text: Deploy and update Windows 10 + url: /windows/deployment/index + - text: Windows 10 deployment scenarios + url: /windows/deployment/windows-10-deployment-scenarios + - text: Create a deployment plan + url: /windows/deployment/update/create-deployment-plan + - text: Prepare to deploy Windows 10 + url: /windows/deployment/update/prepare-deploy-windows + + + # Card + - title: App management + linkLists: + - linkListType: how-to-guide + links: + - text: Windows 10 application management + url: /windows/application-management/index + - text: Understand the different apps included in Windows 10 + url: /windows/application-management/apps-in-windows-10 + - text: Get started with App-V for Windows 10 + url: /windows/application-management/app-v/appv-getting-started + - text: Keep removed apps from returning during an update + url: /windows/application-management/remove-provisioned-apps-during-update + + # Card + - title: Client management + linkLists: + - linkListType: how-to-guide + links: + - text: Windows 10 client management + url: /windows/client-management/index + - text: Administrative tools in Windows 10 + url: /windows/client-management/administrative-tools-in-windows-10 + - text: Create mandatory user profiles + url: /windows/client-management/mandatory-user-profile + - text: New policies for Windows 10 + url: /windows/client-management/new-policies-for-windows-10 + + # Card (optional) + - title: Security and Privacy + linkLists: + - linkListType: how-to-guide + links: + - text: Windows 10 Enterprise Security + url: /windows/security/index + - text: Windows Privacy + url: /windows/privacy/index + - text: Identity and access management + url: /windows/security/identity-protection/index + - text: Threat protection + url: /windows/security/threat-protection/index + - text: Information protection + url: /windows/security/information-protection/index + - text: Required diagnostic data + url: /windows/privacy/required-windows-diagnostic-data-events-and-fields-2004 + - text: Optional diagnostic data + url: /windows/privacy/windows-diagnostic-data + - text: Changes to Windows diagnostic data collection + url: /windows/privacy/changes-to-windows-diagnostic-data-collection diff --git a/windows/hub/windows-10.yml b/windows/hub/windows-10.yml deleted file mode 100644 index e858c87806..0000000000 --- a/windows/hub/windows-10.yml +++ /dev/null @@ -1,77 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10 -metadata: - document_id: - title: Windows 10 - description: Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization. - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: medium - author: lizap - ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization. - " -- title: Explore -- items: - - type: markdown - text: " - Get started with Windows 10. Evaluate free for 90 days, and set up virtual labs to test a proof of concept.
              - -

              **Download a free 90-day evaluation**
              Try the latest features. Test your apps, hardware, and deployment strategies.
              Start evaluation

              **Get started with virtual labs**
              Try setup, deployment, and management scenarios in a virtual environment, with no additional software or setup required.
              See Windows 10 labs

              **Conduct a proof of concept**
              Download a lab environment with MDT, Configuration Manager, Windows 10, and more.
              Get deployment kit
              - " -- title: What's new -- items: - - type: markdown - text: " - Learn about the latest releases and servicing options.
              - -
              What's new in Windows 10, version 1809
              What's new in Windows 10, version 1803
              What's new in Windows 10, version 1709
              Windows 10 release information
              Windows 10 update history
              Windows 10 roadmap
              - " -- title: Frequently asked questions -- items: - - type: markdown - text: " - Get answers to common questions, or get help with a specific problem.
              - -
              Windows 10 FAQ for IT Pros
              Windows 10 forums
              Windows 10 TechCommunity
              Which edition is right for your organization?
              Infrastructure requirements
              What's Windows as a service?
              Windows 10 Mobile deployment and management guide
              - " -- title: Plan -- items: - - type: markdown - text: " - Prepare to deploy Windows 10 in your organization. Explore deployment methods, compatibility tools, and servicing options.
              - -

              **Application compatibility**
              Get best practices and tools to help you address compatibility issues prior to deployment.
              Find apps that are ready for Windows 10.
              Identify and prioritize apps with Upgrade Readiness
              Test, validate, and implement with the Web Application Compatibility Lab Kit

              **Upgrade options**
              Learn about the options available for upgrading Windows 7, Windows 8, or Windows 8.1 PCs and devices to Windows 10.
              Manage Windows upgrades with Upgrade Readiness
              Windows 10 upgrade paths
              Windows 10 edition upgrades

              **Windows as a service**
              Windows as a service provides ongoing new capabilities and updates while maintaining a high level of hardware and software compatibility.
              Explore
              - " -- title: Deploy -- items: - - type: markdown - text: " - Download recommended tools and get step-by-step guidance for in-place upgrades, dynamic provisioning, or traditional deployments.
              - -

              **In-place upgrade**
              The simplest way to upgrade PCs that are currently running WIndows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.
              Upgrade to Windows 10 with Configuration Manager
              Upgrade to Windows 10 with MDT

              **Traditional deployment**
              Some organizations may still need to opt for an image-based deployment of Windows 10.
              Deploy Windows 10 with Configuration Manager
              Deploy Windows 10 with MDT

              **Dynamic provisioning**
              With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.
              Provisioning packages for Windows 10
              Build and apply a provisioning package
              Customize Windows 10 start and the taskbar
              Windows deployment for education environments
              Set up a shared or guest PC with Windows 10
              Sideload apps in Windows 10
              - " -- title: Management and security -- items: - - type: markdown - text: " - Learn how to manage Windows 10 clients and apps, secure company data, and manage risk.
              - -

              **Manage Windows 10 updates**
              Get best practices and tools to help you manage clients and apps.
              Manage clients in Windows 10
              Manage apps and features in Windows 10

              **Security**
              Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.
              Windows 10 enterprise security
              Threat protection
              Identity protection
              Information protection
              - " -- title: Stay informed -- items: - - type: markdown - text: " - -

              **Sign up for the Windows IT Pro Insider**
              Find out about new resources and get expert tips and tricks on deployment, management, security, and more.
              Learn more

              **Follow us on Twitter**
              Keep up with the latest desktop and device trends, Windows news, and events for IT pros.
              Visit Twitter

              **Join the Windows Insider Program for Business**
              Get early access to new builds and provide feedback on the latest features and functionalities.
              Get started
              - " diff --git a/windows/keep-secure/docfx.json b/windows/keep-secure/docfx.json index 49eb6c151a..884e478dcb 100644 --- a/windows/keep-secure/docfx.json +++ b/windows/keep-secure/docfx.json @@ -30,6 +30,7 @@ "overwrite": [], "externalReference": [], "globalMetadata": { + "feedback_system": "None", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.keep-secure", diff --git a/windows/media/phase-diagrams/deployment-phases.png b/windows/media/phase-diagrams/deployment-phases.png new file mode 100644 index 0000000000..4d2a4fa946 Binary files /dev/null and b/windows/media/phase-diagrams/deployment-phases.png differ diff --git a/windows/media/phase-diagrams/migration-phases.png b/windows/media/phase-diagrams/migration-phases.png new file mode 100644 index 0000000000..d502450fba Binary files /dev/null and b/windows/media/phase-diagrams/migration-phases.png differ diff --git a/windows/media/phase-diagrams/onboard.png b/windows/media/phase-diagrams/onboard.png new file mode 100644 index 0000000000..b6a29de3bf Binary files /dev/null and b/windows/media/phase-diagrams/onboard.png differ diff --git a/windows/media/phase-diagrams/prepare.png b/windows/media/phase-diagrams/prepare.png new file mode 100644 index 0000000000..1001e41e0d Binary files /dev/null and b/windows/media/phase-diagrams/prepare.png differ diff --git a/windows/media/phase-diagrams/setup.png b/windows/media/phase-diagrams/setup.png new file mode 100644 index 0000000000..1635785046 Binary files /dev/null and b/windows/media/phase-diagrams/setup.png differ diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md index f1560f3a73..98e412e213 100644 --- a/windows/privacy/Microsoft-DiagnosticDataViewer.md +++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md @@ -21,8 +21,7 @@ ms.reviewer: **Applies to** -- Windows 10, version 1809 -- Windows 10, version 1803 +- Windows 10, version 1803 and newer - Windows Server, version 1803 - Windows Server 2019 diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md deleted file mode 100644 index e4021e6946..0000000000 --- a/windows/privacy/TOC.md +++ /dev/null @@ -1,32 +0,0 @@ -# [Privacy](index.yml) -## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md) -## [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md) -## [Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals](Windows-10-and-privacy-compliance.md) -## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md) -## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) -## Diagnostic Data Viewer -### [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md) -### [Diagnostic Data Viewer for PowerShell Overview](Microsoft-DiagnosticDataViewer.md) -## Basic level Windows diagnostic data events and fields -### [Windows 10, version 1903 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) -### [Windows 10, version 1809 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) -### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) -### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) -### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) -## Enhanced level Windows diagnostic data events and fields -### [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) -## Full level categories -### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md) -### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md) -## Manage Windows 10 connection endpoints -### [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -### [Manage connections from Windows operating system components to Microsoft services using MDM](manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md) -### [Connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) -### [Connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) -### [Connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) -### [Connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1903](windows-endpoints-1903-non-enterprise-editions.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1809](windows-endpoints-1809-non-enterprise-editions.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1803](windows-endpoints-1803-non-enterprise-editions.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1709](windows-endpoints-1709-non-enterprise-editions.md) - diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index fc00e91cc2..d3555a0e8a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -7,14 +7,14 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security localizationpriority: high -author: dansimp -ms.author: dansimp +author: brianlic-msft +ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/19/2019 -ms.reviewer: +ms.date: 09/30/2020 +ms.reviewer: --- @@ -33,8 +33,8 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - -- [Windows 10, version 1903 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -48,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -60,6 +60,7 @@ The following fields are available: - **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device. - **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device. - **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device. +- **DecisionDevicePnp_RS2** The count of DataSourceMatchingInfoBlock objects present on this machine targeting the next release of Windows - **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device. - **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device. - **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device. @@ -77,12 +78,11 @@ The following fields are available: - **SystemWim** The total number of objects of this type present on this device. - **SystemWindowsActivationStatus** The count of DecisionSystemBios objects present on this machine targeting the next release of Windows - **SystemWlan** The total number of objects of this type present on this device. -- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -92,13 +92,13 @@ The following fields are available: - **HasCitData** Indicates whether the file is present in CIT data. - **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file. - **IsAv** Is the file an anti-virus reporting EXE? -- **ResolveAttempted** This will always be an empty string when sending telemetry. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. - **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -109,7 +109,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -137,7 +137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -148,7 +148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -168,7 +168,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -179,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -190,7 +190,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd -This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date. +This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date. The following fields are available: @@ -199,7 +199,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -210,7 +210,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -221,7 +221,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd -This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. The following fields are available: @@ -230,7 +230,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -241,7 +241,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -252,7 +252,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd -This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date. The following fields are available: @@ -261,7 +261,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -272,7 +272,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -283,7 +283,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd -This event sends compatibility database information about the BIOS to help keep Windows up-to-date. +This event sends compatibility database information about the BIOS to help keep Windows up to date. The following fields are available: @@ -293,7 +293,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -304,7 +304,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -315,7 +315,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd -This event sends compatibility decision data about a file to help keep Windows up-to-date. +This event sends compatibility decision data about a file to help keep Windows up to date. The following fields are available: @@ -342,7 +342,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -353,7 +353,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -364,7 +364,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd -This event sends compatibility decision data about a PNP device to help keep Windows up to date. +This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date. The following fields are available: @@ -387,7 +387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -398,7 +398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -This event indicates that the DecisionDevicePnp object is no longer present. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -423,7 +423,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -434,7 +434,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -460,7 +460,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -471,7 +471,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -493,7 +493,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -504,7 +504,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -528,7 +528,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -539,7 +539,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -565,7 +565,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -576,7 +576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -598,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -609,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -620,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning -This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. +This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -644,7 +644,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -667,7 +667,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -678,7 +678,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -700,7 +700,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -711,7 +711,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -738,7 +738,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -749,7 +749,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -760,7 +760,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -773,7 +773,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -784,18 +784,18 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -820,7 +820,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -831,7 +831,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -842,7 +842,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -856,7 +856,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd -This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date. +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date. The following fields are available: @@ -872,7 +872,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -883,7 +883,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -905,7 +905,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -916,7 +916,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -927,7 +927,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd -This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date. The following fields are available: @@ -938,7 +938,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -949,7 +949,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -960,7 +960,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd -This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date. The following fields are available: @@ -972,7 +972,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -983,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1005,7 +1005,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1016,7 +1016,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1038,7 +1038,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1049,7 +1049,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1071,7 +1071,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1082,7 +1082,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1104,7 +1104,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1115,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1137,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1148,7 +1148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1159,7 +1159,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanAdd -This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date. +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date. The following fields are available: @@ -1174,7 +1174,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1185,7 +1185,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1196,32 +1196,32 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth -This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. +This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. The following fields are available: - **AppraiserBranch** The source branch in which the version of Appraiser that is running was built. -- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run. +- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run. - **AppraiserProcess** The name of the process that launched Appraiser. - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. -- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. - **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent. - **PCFP** An ID for the system calculated by hashing hardware identifiers. - **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. - **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. - **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. -- **RunDate** The date that the telemetry run was stated, expressed as a filetime. -- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic. +- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. - **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. -- **RunResult** The hresult of the Appraiser telemetry run. -- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run. +- **RunResult** The hresult of the Appraiser diagnostic data run. +- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. - **StoreHandleIsNotNull** Obsolete, always set to false -- **TelementrySent** Indicates if telemetry was successfully sent. -- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability. +- **TelementrySent** Indicates whether diagnostic data was successfully sent. +- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability. - **Time** The client time of the event. - **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. - **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. @@ -1248,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1259,7 +1259,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1272,7 +1272,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1282,7 +1282,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1293,19 +1293,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1329,7 +1319,7 @@ The following fields are available: ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1341,7 +1331,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1356,7 +1346,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1392,7 +1382,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1402,7 +1392,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1425,7 +1415,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1444,6 +1434,7 @@ The following fields are available: - **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store. - **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. - **OSEdition** Retrieves the version of the current OS. +- **OSInstallDateTime** Retrieves the date the OS was installed using ISO 8601 (Date part) == yyyy-mm-dd - **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc - **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). - **OSSKU** Retrieves the Friendly Name of OS Edition. @@ -1466,7 +1457,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1482,13 +1473,13 @@ The following fields are available: ### Census.Security -Provides information on several important data points about security settings. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1505,7 +1496,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1516,7 +1507,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1526,7 +1517,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1538,6 +1529,7 @@ The following fields are available: - **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display. - **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches . - **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches +- **InternalPrimaryDisplayType** Represents the type of technology used in the monitor, such as Plasma, LED, LCOS, etc. - **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine - **NumberofInternalDisplays** Retrieves the number of internal displays in a machine. - **VRAMDedicated** Retrieves the video RAM in MB. @@ -1547,7 +1539,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1560,7 +1552,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1573,7 +1565,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1712,7 @@ The following fields are available: - **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence - **op** Represents the ETW Op Code. - **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW. -- **sqmId** The Windows SQM ID. +- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier. - **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. - **tickets** An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events. @@ -1768,7 +1760,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. @@ -1778,6 +1770,47 @@ This event provides information about the results of installing optional Windows +### CbsServicingProvider.CbsQualityUpdateInstall + +This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date. + + + +### CbsServicingProvider.CbsSelectableUpdateChangeV2 + +This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date. + +The following fields are available: + +- **applicableUpdateState** Indicates the highest applicable state of the optional content. +- **buildVersion** The build version of the package being installed. +- **clientId** The name of the application requesting the optional content change. +- **downloadSource** Indicates if optional content was obtained from Windows Update or a locally accessible file. +- **downloadtimeInSeconds** Indicates if optional content was obtained from Windows Update or a locally accessible file. +- **executionID** A unique ID used to identify events associated with a single servicing operation and not reused for future operations. +- **executionSequence** A counter that tracks the number of servicing operations attempted on the device. +- **firstMergedExecutionSequence** The value of a pervious executionSequence counter that is being merged with the current operation, if applicable. +- **firstMergedID** A unique ID of a pervious servicing operation that is being merged with this operation, if applicable. +- **hrDownloadResult** The return code of the download operation. +- **hrStatusUpdate** The return code of the servicing operation. +- **identityHash** A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled. +- **initiatedOffline** Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows. +- **majorVersion** The major version of the package being installed. +- **minorVersion** The minor version of the package being installed. +- **packageArchitecture** The architecture of the package being installed. +- **packageLanguage** The language of the package being installed. +- **packageName** The name of the package being installed. +- **rebootRequired** Indicates whether a reboot is required to complete the operation. +- **revisionVersion** The revision number of the package being installed. +- **stackBuild** The build number of the servicing stack binary performing the installation. +- **stackMajorVersion** The major version number of the servicing stack binary performing the installation. +- **stackMinorVersion** The minor version number of the servicing stack binary performing the installation. +- **stackRevision** The revision number of the servicing stack binary performing the installation. +- **updateName** The name of the optional Windows Operation System feature being enabled or disabled. +- **updateStartState** A value indicating the state of the optional content before the operation started. +- **updateTargetState** A value indicating the desired state of the optional content. + + ## Content Delivery Manager events ### Microsoft.Windows.ContentDeliveryManager.ProcessCreativeEvent @@ -1826,7 +1859,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1845,7 +1878,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1864,7 +1897,7 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: @@ -2126,7 +2159,7 @@ The following fields are available: ### ChecksumDictionary -The list of values sent by each object type. +This event provides the list of values sent by each object type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2136,7 +2169,7 @@ The following fields are available: ### COMPID -This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. +This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2146,7 +2179,7 @@ The following fields are available: ### HWID -This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. +This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2156,7 +2189,7 @@ The following fields are available: ### InstallDateArpLastModified -This event indicates the date the add/remove program (ARP) entry was last modified by an update. +This event indicates the date the add/remove program (ARP) entry was last modified by an update. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2166,7 +2199,7 @@ The following fields are available: ### InstallDateFromLinkFile -This event provides the application installation date from the linked file. +This event provides the application installation date from the linked file. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2176,7 +2209,7 @@ The following fields are available: ### InstallDateMsi -The install date from the Microsoft installer (MSI) database. +This event provides the install date from the Microsoft installer (MSI) database. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2186,7 +2219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2212,7 +2245,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2224,7 +2257,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2241,7 +2274,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2270,31 +2303,31 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2305,7 +2338,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2316,7 +2349,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2340,7 +2373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2351,7 +2384,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2362,7 +2395,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2391,7 +2424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2402,7 +2435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2415,7 +2448,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2426,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2464,6 +2497,7 @@ The following fields are available: - **Manufacturer** The manufacturer of the device. - **MatchingID** The Hardware ID or Compatible ID that Windows uses to install a device instance. - **Model** Identifies the model of the device. +- **objectInstanceId** Deprecated. The Device Instance ID of the device (uniquely identifies a device in the system). Example: pci\ven_8086&dev_0085&subsys_13118086&rev_34\4&2dded11c&0&00e1 - **ParentId** The Device Instance ID of the parent of the device. - **ProblemCode** The error code currently returned by the device, if applicable. - **Provider** Identifies the device provider. @@ -2475,7 +2509,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2486,7 +2520,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2497,19 +2531,19 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2536,7 +2570,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2547,7 +2581,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2558,7 +2592,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2577,7 +2611,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2588,7 +2622,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2597,117 +2631,170 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AhaVersion** The binary version of the App Health Analyzer tool. +- **ApplicationErrors** The count of application errors from the event log. +- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit). +- **device_level** Various JRE/JAVA versions installed on a particular device. +- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type. +- **Jar** Flag to determine if an app has a Java JAR file dependency. +- **Jre** Flag to determine if an app has JRE framework dependency. +- **Jre_version** JRE versions an app has declared framework dependency for. +- **Name** Name of the application. +- **NonDPIAware** Flag to determine if an app is non-DPI aware +- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location. +- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution. +- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution. +- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility. +- **VB6** Flag to determine if an app is based on VB6 framework. +- **VB6v2** Additional flag to determine if an app is based on VB6 framework. +- **Version** Version of the application. +- **VersionCheck** Flag to determine if an app has a static dependency on OS version. +- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version. + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AllowTelemetry** Indicates the presence of the 'allowtelemetry' command line argument. +- **CommandLineArgs** Command line arguments passed when launching the App Health Analyzer executable. +- **Enhanced** Indicates the presence of the 'enhanced' command line argument. +- **StartTime** UTC date and time at which this event was sent. + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2717,18 +2804,27 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: - **IndicatorValue** The indicator value. +- **Value** Describes an operating system indicator that may be relevant for the device upgrade. + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync + +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2736,7 +2832,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2744,7 +2840,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### STACKID -This event provides the internal compatible ID for the stack. +This event provides the internal compatible ID for the stack. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2766,7 +2862,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2791,7 +2887,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. +This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2814,11 +2910,31 @@ The following fields are available: - **UptimeDeltaMS** Duration in last state in milliseconds. +## Migration events + +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFSys + +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + ## OneDrive events ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2831,7 +2947,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2843,7 +2959,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2859,7 +2975,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2872,7 +2988,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2882,7 +2998,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OfficeRegistration -This event indicates the status of the OneDrive integration with Microsoft Office. +This event indicates the status of the OneDrive integration with Microsoft Office. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2891,7 +3007,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2901,7 +3017,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.RepairResult -The event determines the result of the installation repair. +The event determines the result of the installation repair. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2910,7 +3026,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult -This event indicates the status when downloading the OneDrive setup file. +This event indicates the status when downloading the OneDrive setup file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2919,7 +3035,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2930,7 +3046,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateTierReg -This event determines status of the update tier registry values. +This event determines status of the update tier registry values. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2940,7 +3056,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2949,7 +3065,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2960,7 +3076,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2973,11 +3089,61 @@ The following fields are available: - **resetSettingsResult** The return code of the action to correct the known issue. +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Device readiness check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Download of latest cumulative update payload. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Install of latest cumulative update payload. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3152,7 +3318,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.DiskCleanUnExpectedErrorEvent -This event indicates that an unexpected error occurred during an update and provides information to help address the issue. +This event indicates that an unexpected error occurred during an update and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3166,7 +3332,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Error -This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. +This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3177,7 +3343,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.FallbackError -This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. +This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3187,7 +3353,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationNotifyUserFixIssuesInvokeUIEvent -This event occurs when the Notify User task executes and provides information about the cause of the notification. +This event occurs when the Notify User task executes and provides information about the cause of the notification. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3203,7 +3369,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId -This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. +This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3215,7 +3381,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId -This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. +This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3227,7 +3393,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed -This event tracks the health of key update (Remediation) services and whether they are enabled. +This event tracks the health of key update (Remediation) services and whether they are enabled. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3266,7 +3432,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Started -deny +This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3336,7 +3502,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. @@ -3357,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DownloadServiceProgress -This event indicates the progress of the downloader in 1% increments. +This event indicates the progress of the downloader in 1% increments. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3458,7 +3624,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3521,7 +3687,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3532,7 +3698,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3546,7 +3712,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3577,7 +3743,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3681,7 +3847,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3697,7 +3863,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3712,7 +3878,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3723,7 +3889,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3732,7 +3898,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3743,7 +3909,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3756,7 +3922,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3781,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3797,7 +3963,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3819,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3830,7 +3996,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3839,7 +4005,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3850,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3863,7 +4029,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3919,7 +4085,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -3954,7 +4120,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3979,7 +4145,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4006,19 +4172,19 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. @@ -4026,7 +4192,7 @@ This event reports the status of an action following a reboot, should one have b ### SoftwareUpdateClientTelemetry.CheckForUpdates -This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4223,7 +4389,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4245,7 +4411,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4350,7 +4516,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.SLSDiscovery -This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. +This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4366,7 +4532,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4381,13 +4547,13 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -This event identifies whether updates have been tampered with and protects against man-in-the-middle attacks. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. - **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed. -- **ExtendedStatusCode** The secondary status code of the event. +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. - **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed. - **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. - **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce @@ -4413,7 +4579,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4437,7 +4603,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4448,7 +4614,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4459,7 +4625,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4469,7 +4635,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4483,7 +4649,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4496,7 +4662,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4523,7 +4689,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4539,7 +4705,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4557,7 +4723,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4573,7 +4739,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4589,7 +4755,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4604,7 +4770,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4621,7 +4787,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4637,7 +4803,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4668,7 +4834,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4688,7 +4854,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4706,7 +4872,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4722,7 +4888,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4748,13 +4914,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4770,13 +4936,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4799,19 +4965,25 @@ The following fields are available: ### FacilitatorTelemetry.DCATDownload -This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure. +This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure. + + + +### FacilitatorTelemetry.DUDownload + +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Downlevel -This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure. +This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -4853,7 +5025,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5000,19 +5172,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. @@ -5029,7 +5201,7 @@ The following fields are available: - **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. - **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. - **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. -- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). - **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. @@ -5100,7 +5272,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5127,6 +5299,7 @@ The following fields are available: - **CategoryId** The Item Category ID. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** The result code of the last action performed before this operation. +- **IntentPFNs** Intent Product Family Name - **IsBundle** Is this a bundle? - **IsInteractive** Was this requested by a user? - **IsMandatory** Was this a mandatory update? @@ -5137,6 +5310,7 @@ The following fields are available: - **PFN** The product family name of the product being installed. - **ProductId** The identity of the package or packages being installed. - **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled. +- **UpdateId** Update ID (if this is an update) - **UserAttemptNumber** The total number of user attempts at installation before it was canceled. - **WUContentId** The Windows Update content ID. @@ -5164,6 +5338,7 @@ The following fields are available: - **BundleId** The identity of the Windows Insider build that is associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. +- **IntentPFNs** Intent Product Family Name - **IsBundle** Is this a bundle? - **IsInteractive** Was this requested by a user? - **IsMandatory** Is this a mandatory update? @@ -5203,16 +5378,20 @@ The following fields are available: - **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. - **AttemptNumber** The total number of attempts to acquire this product. +- **BundleId** The bundle ID - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** HResult code to show the result of the operation (success/failure). +- **IntentPFNs** Intent Product Family Name - **IsBundle** Is this a bundle? - **IsInteractive** Did the user initiate the installation? - **IsMandatory** Is this a mandatory update? - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this happening after a device restore? - **IsUpdate** Is this an update? +- **IsWin32** Flag indicating if this is a Win32app. - **ParentBundledId** The product's parent bundle ID. +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). - **PFN** Product Family Name of the product being installed. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The number of attempts by the system to acquire this product. @@ -5235,16 +5414,19 @@ The following fields are available: - **DownloadSize** The total size of the download. - **ExtendedHResult** Any extended HResult error codes. - **HResult** The result code of the last action performed. +- **IntentPFNs** Intent Product Family Name - **IsBundle** Is this a bundle? - **IsInteractive** Is this initiated by the user? - **IsMandatory** Is this a mandatory installation? - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this a restore of a previously acquired product? - **IsUpdate** Is this an update? +- **IsWin32** Flag indicating if this is a Win32 app (unused). - **ParentBundleId** The parent bundle ID (if it's part of a bundle). - **PFN** The Product Family Name of the app being download. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The number of attempts by the system to download. +- **UpdateId** Update ID (if this is an update) - **UserAttemptNumber** The number of attempts by the user to download. - **WUContentId** The Windows Update content ID. @@ -5280,16 +5462,19 @@ The following fields are available: - **ClientAppId** The identity of the app that initiated this operation. - **ExtendedHResult** The extended HResult error code. - **HResult** The result code of the last action performed. +- **IntentPFNs** Intent Product Family Name - **IsBundle** Is this a bundle? - **IsInteractive** Is this an interactive installation? - **IsMandatory** Is this a mandatory installation? - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this automatically restoring a previously acquired product? - **IsUpdate** Is this an update? +- **IsWin32** Flag indicating if this a Win32 app (unused). - **ParentBundleId** The product ID of the parent (if this product is part of a bundle). - **PFN** Product Family Name of the product being installed. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The total number of system attempts. +- **UpdateId** Update ID (if this is an update) - **UserAttemptNumber** The total number of user attempts. - **WUContentId** The Windows Update content ID. @@ -5319,16 +5504,19 @@ The following fields are available: - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** The result code of the last action performed. +- **IntentPFNs** The licensing identity of this package. - **IsBundle** Is this a bundle? - **IsInteractive** Is this user requested? - **IsMandatory** Is this a mandatory update? - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this restoring previously acquired content? - **IsUpdate** Is this an update? +- **IsWin32** Flag indicating if this a Win32 app (unused). - **ParentBundleId** The product ID of the parent (if this product is part of a bundle). - **PFN** The name of the package or packages requested for install. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The total number of system attempts. +- **UpdateId** Update ID (if this is an update) - **UserAttemptNumber** The total number of user attempts. - **WUContentId** The Windows Update content ID. @@ -5345,6 +5533,7 @@ The following fields are available: - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** The result code of the last action performed. +- **IntentPFNs** The licensing identity of this package. - **IsBundle** Is this a bundle? - **IsInteractive** Is this user requested? - **IsMandatory** Is this a mandatory update? @@ -5414,6 +5603,7 @@ The following fields are available: - **BundleId** The identity of the build associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. +- **IntentPFNs** The licensing identity of this package. - **IsBundle** Is this a bundle? - **IsInteractive** Is this user requested? - **IsMandatory** Is this a mandatory update? @@ -5443,6 +5633,7 @@ The following fields are available: - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** The result code of the last action performed before this operation. +- **IntentPFNs** Intent Product Family Name - **IsBundle** Is this a bundle? - **IsInteractive** Is this user requested? - **IsMandatory** Is this a mandatory update? @@ -5494,7 +5685,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5519,7 +5710,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5558,7 +5749,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5576,7 +5767,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5608,7 +5799,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5629,7 +5820,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5685,7 +5876,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5709,7 +5900,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5724,7 +5915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5739,7 +5930,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5754,7 +5945,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5769,7 +5960,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5784,7 +5975,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5799,7 +5990,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5814,7 +6005,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5829,7 +6020,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5839,7 +6030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5850,7 +6041,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -5869,7 +6060,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -5887,7 +6078,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5902,7 +6093,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -5919,7 +6110,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -5944,7 +6135,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5956,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -5968,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event is sent after a Windows update install completes. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -5984,7 +6175,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5996,7 +6187,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6005,7 +6196,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6025,7 +6216,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6037,7 +6228,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6049,7 +6240,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6065,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6078,7 +6269,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6093,7 +6284,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6103,7 +6294,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6116,7 +6307,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6152,7 +6343,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6174,7 +6365,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6183,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6201,7 +6392,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot -This event is sent when a toast notification is shown to the user about scheduling a device restart. +This event is sent when a toast notification is shown to the user about scheduling a device restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6210,7 +6401,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6230,7 +6421,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6254,21 +6445,33 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS Updates. +This event sends data specific to the FixupEditionId mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. ## Windows Update Reserve Manager events +### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. + + + ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 14db4d2683..2be76e6660 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -7,14 +7,14 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security localizationpriority: high -author: dansimp -ms.author: dansimp +author: brianlic-msft +ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/19/2019 -ms.reviewer: +ms.date: 09/30/2020 +ms.reviewer: --- @@ -33,8 +33,8 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - -- [Windows 10, version 1903 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) @@ -48,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -Invalid Signature - This event is superseded by an event that contains additional fields. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -90,7 +90,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -102,13 +102,13 @@ The following fields are available: - **HasCitData** Indicates whether the file is present in CIT data. - **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file. - **IsAv** Is the file an anti-virus reporting EXE? -- **ResolveAttempted** This will always be an empty string when sending telemetry. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. - **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -119,7 +119,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -146,7 +146,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -157,7 +157,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -179,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -190,7 +190,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -201,7 +201,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd -This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date. +This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -212,7 +212,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -223,7 +223,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -234,7 +234,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd -This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -245,7 +245,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -256,7 +256,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -267,7 +267,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd -This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -278,7 +278,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -289,7 +289,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -300,7 +300,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd -This event sends compatibility database information about the BIOS to help keep Windows up-to-date. +This event sends compatibility database information about the BIOS to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -311,7 +311,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -322,7 +322,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -333,7 +333,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd -This event sends compatibility decision data about a file to help keep Windows up-to-date. +This event sends compatibility decision data about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -347,7 +347,7 @@ The following fields are available: - **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? - **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? - **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade? -- **NeedsDismissAction** Will the file cause an action that can be dimissed? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? - **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app. - **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade? - **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app. @@ -362,7 +362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -373,7 +373,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -384,7 +384,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd -This event sends compatibility decision data about a PNP device to help keep Windows up to date. +This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -410,7 +410,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -421,7 +421,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -448,7 +448,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -459,7 +459,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -487,7 +487,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -498,7 +498,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -522,7 +522,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -533,7 +533,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +559,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -570,7 +570,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -598,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -609,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -634,7 +634,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -645,7 +645,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -670,7 +670,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -710,7 +710,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -734,7 +734,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -745,7 +745,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -774,7 +774,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -785,7 +785,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -796,7 +796,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -811,7 +811,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -822,18 +822,18 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -858,7 +858,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -869,7 +869,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -880,7 +880,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -895,7 +895,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd -This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date. +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -913,7 +913,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -924,7 +924,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -948,7 +948,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -959,7 +959,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -970,7 +970,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd -This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -983,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -994,7 +994,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1005,7 +1005,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd -This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1019,7 +1019,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1030,7 +1030,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1054,7 +1054,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1065,7 +1065,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1089,7 +1089,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1100,7 +1100,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1124,7 +1124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1135,7 +1135,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1159,7 +1159,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1170,7 +1170,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1194,7 +1194,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1205,7 +1205,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1216,7 +1216,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanAdd -This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date. +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1233,7 +1233,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1244,7 +1244,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1255,7 +1255,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth -This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. +This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. The following fields are available: @@ -1266,21 +1266,21 @@ The following fields are available: - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. -- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. - **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent. - **PCFP** An ID for the system calculated by hashing hardware identifiers. - **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. - **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. - **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. -- **RunDate** The date that the telemetry run was stated, expressed as a filetime. -- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic. +- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. - **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. -- **RunResult** The hresult of the Appraiser telemetry run. -- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run. +- **RunResult** The hresult of the Appraiser diagnostic data run. +- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. - **StoreHandleIsNotNull** Obsolete, always set to false -- **TelementrySent** Indicates if telemetry was successfully sent. -- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability. +- **TelementrySent** Indicates whether diagnostic data was successfully sent. +- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability. - **Time** The client time of the event. - **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. - **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. @@ -1307,7 +1307,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1318,7 +1318,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1331,7 +1331,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1349,7 +1349,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1360,19 +1360,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1397,7 +1387,7 @@ The following fields are available: ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1409,7 +1399,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1424,7 +1414,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1465,7 +1455,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1475,7 +1465,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1498,7 +1488,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1540,7 +1530,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1562,7 +1552,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1579,7 +1569,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1596,7 +1586,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1607,7 +1597,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1617,7 +1607,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1638,7 +1628,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1651,7 +1641,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1666,7 +1656,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1819,7 +1809,7 @@ The following fields are available: - **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence - **op** Represents the ETW Op Code. - **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW. -- **sqmId** The Windows SQM ID. +- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier. - **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. - **tickets** An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events. @@ -1867,7 +1857,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -1889,7 +1879,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -1914,6 +1904,12 @@ The following fields are available: - **pendingDecision** Indicates the cause of reboot, if applicable. +### CbsServicingProvider.CbsQualityUpdateInstall + +This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date. + + + ### CbsServicingProvider.CbsSelectableUpdateChangeV2 This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date. @@ -1953,19 +1949,19 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. @@ -2011,6 +2007,25 @@ This event is triggered when UTC determines it needs to send information about p ## DxgKernelTelemetry events +### DxgKrnlTelemetry.BddDiag + +This event records Microsoft basic display driver diagnostic information. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BiosFlags** Bitwise flags that contain graphics related firmware information on the device such as the system was booted with display or not, system was using VBIOS or UEFI GOP, and VBIOS has a valid display mode list or not. +- **CurrentMode** Information about the current display mode such as the resolution, rotation, and scaling. +- **DefaultModeReason** Numeric value indicating the reason that the Microsoft Basic Display Driver is in use. +- **DefaultModeResolution** Default resolution that Microsoft Basic Display Driver detected. +- **DefaultResolutionProvider** Numeric value indicating the source of the default resolution. +- **Flags** Bitwise flags containing Microsoft Basic Display Driver related information such as if it is running because there is no graphics driver or user PnP stopped the graphics driver, it has valid EDID or not on the connected monitor and where the EDID was from, it is running at gray scale mode or not, it is running without display or not. +- **HeadlessReason** Numeric value indicating why there is no display. +- **LogAssertionCount** Number of assertions that were encountered before this event was recorded. +- **LogErrorCount** Number of errors that were encountered before this event was recorded. +- **MonitorPowerState** Current power state of the monitor. +- **Version** Version of the schema for this event. + + ### DxgKrnlTelemetry.GPUAdapterInventoryV2 This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. @@ -2164,7 +2179,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2174,7 +2189,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2218,7 +2233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2245,7 +2260,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2255,7 +2270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2284,7 +2299,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2296,7 +2311,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2307,7 +2322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2321,7 +2336,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2332,7 +2347,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2343,7 +2358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2354,7 +2369,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2378,7 +2393,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2389,7 +2404,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2400,7 +2415,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2430,7 +2445,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2441,7 +2456,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2454,7 +2469,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2465,7 +2480,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2476,7 +2491,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd -This event represents the basic metadata about a plug and play (PNP) device and its associated driver. +This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2515,7 +2530,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2526,7 +2541,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2537,7 +2552,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2550,7 +2565,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2561,7 +2576,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2588,7 +2603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2599,7 +2614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2610,7 +2625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2630,7 +2645,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2641,7 +2656,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2650,9 +2665,56 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AhaVersion** The binary version of the App Health Analyzer tool. +- **ApplicationErrors** The count of application errors from the event log. +- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit). +- **device_level** Various JRE/JAVA versions installed on a particular device. +- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type. +- **Jar** Flag to determine if an app has a Java JAR file dependency. +- **Jre** Flag to determine if an app has JRE framework dependency. +- **Jre_version** JRE versions an app has declared framework dependency for. +- **Name** Name of the application. +- **NonDPIAware** Flag to determine if an app is non-DPI aware +- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location. +- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution. +- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution. +- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility. +- **VB6** Flag to determine if an app is based on VB6 framework. +- **VB6v2** Additional flag to determine if an app is based on VB6 framework. +- **Version** Version of the application. +- **VersionCheck** Flag to determine if an app has a static dependency on OS version. +- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version. + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AllowTelemetry** Indicates the presence of the 'allowtelemetry' command line argument. +- **CommandLineArgs** Command line arguments passed when launching the App Health Analyzer executable. +- **Enhanced** Indicates the presence of the 'enhanced' command line argument. +- **StartTime** UTC date and time at which this event was sent. + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2686,7 +2748,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2694,7 +2756,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2705,7 +2767,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -This event provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2723,7 +2785,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2734,7 +2796,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -This event includes the Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2760,7 +2822,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2771,7 +2833,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -Provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2786,7 +2848,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2794,7 +2856,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2805,7 +2867,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -This event list all installed Office products +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2820,7 +2882,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2831,13 +2893,13 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **BrowserFlags** Browser flags for Office-related products +- **BrowserFlags** Browser flags for Office-related products. - **ExchangeProviderFlags** Office Exchange provider policies - **InventoryVersion** The version of the inventory binary generating the events. - **SharedComputerLicensing** Office Shared Computer Licensing policies @@ -2845,7 +2907,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2856,7 +2918,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2887,7 +2949,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2895,7 +2957,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2906,7 +2968,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2914,7 +2976,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2925,7 +2987,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2936,7 +2998,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2951,7 +3013,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2959,7 +3021,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2967,7 +3029,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2977,7 +3039,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2988,7 +3050,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2996,7 +3058,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3016,7 +3078,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3039,11 +3101,31 @@ The following fields are available: - **UserInputTime** The amount of time the loader application spent waiting for user input. +## Migration events + +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFSys + +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + ## OneDrive events ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3056,7 +3138,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3068,7 +3150,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3084,7 +3166,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3097,7 +3179,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3107,7 +3189,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3117,7 +3199,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3128,7 +3210,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3137,7 +3219,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3148,7 +3230,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3161,11 +3243,61 @@ The following fields are available: - **resetSettingsResult** The return code of the action to correct the known issue. +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Device readiness check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Download of latest cumulative update payload. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Install of latest cumulative update payload. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3248,7 +3380,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -3385,7 +3517,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -3416,7 +3548,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3480,7 +3612,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3543,7 +3675,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3554,7 +3686,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3568,7 +3700,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3669,7 +3801,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3685,7 +3817,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3700,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -Error occurred during execution of the plugin. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3711,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3721,7 +3853,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3732,7 +3864,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3745,7 +3877,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3770,7 +3902,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3786,7 +3918,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3808,7 +3940,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3819,7 +3951,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3829,7 +3961,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3840,7 +3972,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3853,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3906,7 +4038,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -3942,7 +4074,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3967,7 +4099,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3994,7 +4126,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4012,7 +4144,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4028,7 +4160,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4043,7 +4175,7 @@ The following fields are available: ### SIHEngineTelemetry.ServiceStateChange -This event reports the status of attempts to stop or start a service as part of executing an action. +This event reports the status of attempts to stop or start a service as part of executing an action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4060,7 +4192,7 @@ The following fields are available: ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4077,7 +4209,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4160,7 +4292,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -4191,7 +4323,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -4268,7 +4400,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4290,7 +4422,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4390,7 +4522,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4405,13 +4537,13 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. - **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed. -- **ExtendedStatusCode** The secondary status code of the event. +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. - **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed. - **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. - **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce @@ -4437,7 +4569,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4461,7 +4593,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4473,7 +4605,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4484,7 +4616,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4494,7 +4626,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4508,7 +4640,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4522,7 +4654,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4549,7 +4681,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4565,7 +4697,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4583,7 +4715,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4599,7 +4731,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4615,7 +4747,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4630,7 +4762,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4647,7 +4779,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4663,7 +4795,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4695,7 +4827,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4715,7 +4847,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4731,7 +4863,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4749,7 +4881,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4765,7 +4897,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4781,7 +4913,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4807,7 +4939,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4827,7 +4959,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4843,7 +4975,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4861,7 +4993,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4878,7 +5010,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4901,7 +5033,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4948,7 +5080,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4964,7 +5096,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4980,7 +5112,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4997,7 +5129,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5013,7 +5145,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5032,19 +5164,25 @@ The following fields are available: ### FacilitatorTelemetry.DCATDownload -This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure. +This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure. + + + +### FacilitatorTelemetry.DUDownload + +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Downlevel -This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure. +This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -5086,7 +5224,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5234,19 +5372,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5274,7 +5412,7 @@ The following fields are available: - **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. - **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. - **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. -- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). - **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. @@ -5286,16 +5424,37 @@ The following fields are available: ### Microsoft.Windows.WaaSAssessment.Error -This event returns the name of the missing setting needed to determine the Operating System build age. +This event returns the name of the missing setting needed to determine the Operating System build age. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **m** The WaaS (“Workspace as a Service”—cloud-based “workspace”) Assessment Error String. +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. + + ### Microsoft.Windows.WaaSMedic.Summary -This event provides the results of the WaaSMedic diagnostic run +This event provides the results of the WaaSMedic diagnostic run. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5314,7 +5473,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.SummaryEvent -This event provides the results from the WaaSMedic engine +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5356,7 +5515,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5459,6 +5618,7 @@ The following fields are available: - **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. - **AttemptNumber** The total number of attempts to acquire this product. +- **BundleId** The bundle ID - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** HResult code to show the result of the operation (success/failure). @@ -5468,6 +5628,7 @@ The following fields are available: - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this happening after a device restore? - **IsUpdate** Is this an update? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). - **PFN** Product Family Name of the product being installed. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The number of attempts by the system to acquire this product. @@ -5748,7 +5909,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5781,7 +5942,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5829,7 +5990,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5849,7 +6010,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5886,7 +6047,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5909,7 +6070,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5925,7 +6086,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5941,7 +6102,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5968,7 +6129,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5986,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6002,7 +6163,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6017,49 +6178,49 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -6077,25 +6238,25 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot -This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6105,7 +6266,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6117,7 +6278,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6136,7 +6297,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6152,7 +6313,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6169,7 +6330,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6185,7 +6346,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6196,7 +6357,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6213,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6238,7 +6399,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6251,7 +6412,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6263,7 +6424,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event is sent after a Windows update install completes. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6280,13 +6441,13 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6295,7 +6456,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6314,7 +6475,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6326,7 +6487,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6336,7 +6497,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6350,9 +6511,20 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event indicates the data sent when the device pauses an in-progress update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6365,7 +6537,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6380,7 +6552,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6390,7 +6562,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6432,7 +6604,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6446,9 +6618,21 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event indicates that USO determined UUP needs to fall back. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6470,7 +6654,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6479,7 +6663,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6488,7 +6672,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6507,13 +6691,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6523,7 +6707,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6544,7 +6728,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6570,24 +6754,25 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. + ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index d6eb2975ad..b9030aba9a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -7,14 +7,14 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security localizationpriority: high -author: dansimp -ms.author: dansimp +author: brianlic-msft +ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/19/2019 -ms.reviewer: +ms.date: 09/30/2020 +ms.reviewer: --- @@ -33,7 +33,8 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 1903 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) - [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -123,7 +124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -135,13 +136,13 @@ The following fields are available: - **HasCitData** Indicates whether the file is present in CIT data. - **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file. - **IsAv** Is the file an antivirus reporting EXE? -- **ResolveAttempted** This will always be an empty string when sent. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. - **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -152,7 +153,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -179,7 +180,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -190,7 +191,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -212,7 +213,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -223,7 +224,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -234,7 +235,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd -This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date. +This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -245,7 +246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -256,7 +257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -267,7 +268,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd -This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -278,7 +279,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -289,7 +290,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -300,7 +301,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd -This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -311,7 +312,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -322,7 +323,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -333,7 +334,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd -This event sends compatibility database information about the BIOS to help keep Windows up-to-date. +This event sends compatibility database information about the BIOS to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -344,7 +345,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -355,7 +356,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -366,7 +367,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd -This event sends compatibility decision data about a file to help keep Windows up-to-date. +This event sends compatibility decision data about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -381,7 +382,7 @@ The following fields are available: - **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? - **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? - **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade? -- **NeedsDismissAction** Will the file cause an action that can be dimissed? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? - **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app. - **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade? - **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app. @@ -396,7 +397,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -407,7 +408,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -418,7 +419,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd -This event sends compatibility decision data about a PNP device to help keep Windows up to date. +This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -445,7 +446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -456,7 +457,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -484,7 +485,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -495,7 +496,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -523,7 +524,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -534,7 +535,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -570,7 +571,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -596,7 +597,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -607,7 +608,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +636,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -646,7 +647,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -671,7 +672,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -682,7 +683,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -707,7 +708,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -736,7 +737,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -747,7 +748,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -771,7 +772,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -782,7 +783,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -811,7 +812,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -822,7 +823,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -833,7 +834,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -848,7 +849,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -859,18 +860,18 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -895,7 +896,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -906,7 +907,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -917,7 +918,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -931,7 +932,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd -This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date. +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -949,7 +950,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -960,7 +961,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -984,7 +985,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -995,7 +996,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1006,7 +1007,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd -This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1019,7 +1020,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1030,7 +1031,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1041,7 +1042,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd -This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1055,7 +1056,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1066,7 +1067,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1090,7 +1091,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1101,7 +1102,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1125,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1160,7 +1161,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1171,7 +1172,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1195,7 +1196,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1206,7 +1207,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1230,13 +1231,13 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusEndSync -This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. +This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. The data collected with this event is used to help keep Windows up to date. ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1258,7 +1259,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanAdd -This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date. +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1275,7 +1276,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1286,7 +1287,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1297,18 +1298,18 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth -This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. +This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. The following fields are available: - **AppraiserBranch** The source branch in which the version of Appraiser that is running was built. -- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run. +- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run. - **AppraiserProcess** The name of the process that launched Appraiser. - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. -- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. - **InboxDataVersion** The original version of the data files before retrieving any newer version. - **IndicatorsWritten** Indicates if all relevant UEX indicators were successfully written or updated. @@ -1317,14 +1318,14 @@ The following fields are available: - **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. - **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. - **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. -- **RunDate** The date that the telemetry run was stated, expressed as a filetime. -- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic. +- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. - **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. -- **RunResult** The hresult of the Appraiser telemetry run. -- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run. +- **RunResult** The hresult of the Appraiser diagnostic data run. +- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. - **StoreHandleIsNotNull** Obsolete, always set to false -- **TelementrySent** Indicates if telemetry was successfully sent. -- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability. +- **TelementrySent** Indicates whether diagnostic data was successfully sent. +- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability. - **Time** The client time of the event. - **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. - **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. @@ -1351,7 +1352,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1362,7 +1363,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1375,7 +1376,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1391,9 +1392,21 @@ The following fields are available: - **IEVersion** The version of Internet Explorer that is running on the device. +### Census.Azure + +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **CloudCoreBuildEx** The Azure CloudCore build number. +- **CloudCoreSupportBuildEx** The Azure CloudCore support build number. +- **NodeID** The node identifier on the device that indicates whether the device is part of the Azure fleet. +- **PartA_PrivTags** The privacy tags associated with the event. + + ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1404,19 +1417,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1442,7 +1445,7 @@ The following fields are available: ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1454,7 +1457,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1469,7 +1472,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1510,7 +1513,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1520,7 +1523,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1543,7 +1546,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1585,7 +1588,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1629,7 +1632,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1652,7 +1655,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1670,7 +1673,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1687,7 +1690,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1698,7 +1701,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1708,7 +1711,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1729,7 +1732,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1742,7 +1745,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1786,7 +1789,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1801,7 +1804,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2018,7 +2021,7 @@ The following fields are available: ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2032,7 +2035,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -2054,7 +2057,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2105,6 +2108,43 @@ The following fields are available: - **transactionCanceled** Indicates whether the uninstall was cancelled. +### CbsServicingProvider.CbsQualityUpdateInstall + +This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date. + +The following fields are available: + +- **buildVersion** The build version number of the update package. +- **clientId** The name of the application requesting the optional content. +- **corruptionHistoryFlags** A bitmask of the types of component store corruption that have caused update failures on the device. +- **corruptionType** An enumeration listing the type of data corruption responsible for the current update failure. +- **currentStateEnd** The final state of the package after the operation has completed. +- **doqTimeSeconds** The time in seconds spent updating drivers. +- **executeTimeSeconds** The number of seconds required to execute the install. +- **failureDetails** The driver or installer that caused the update to fail. +- **failureSourceEnd** An enumeration indicating at what phase of the update a failure occurred. +- **hrStatusEnd** The return code of the install operation. +- **initiatedOffline** A true or false value indicating whether the package was installed into an offline Windows Imaging Format (WIM) file. +- **majorVersion** The major version number of the update package. +- **minorVersion** The minor version number of the update package. +- **originalState** The starting state of the package. +- **overallTimeSeconds** The time (in seconds) to perform the overall servicing operation. +- **PartA_PrivTags** The privacy tags associated with the event. +- **planTimeSeconds** The time in seconds required to plan the update operations. +- **poqTimeSeconds** The time in seconds processing file and registry operations. +- **postRebootTimeSeconds** The time (in seconds) to do startup processing for the update. +- **preRebootTimeSeconds** The time (in seconds) between execution of the installation and the reboot. +- **primitiveExecutionContext** An enumeration indicating at what phase of shutdown or startup the update was installed. +- **rebootCount** The number of reboots required to install the update. +- **rebootTimeSeconds** The time (in seconds) before startup processing begins for the update. +- **resolveTimeSeconds** The time in seconds required to resolve the packages that are part of the update. +- **revisionVersion** The revision version number of the update package. +- **rptTimeSeconds** The time in seconds spent executing installer plugins. +- **shutdownTimeSeconds** The time (in seconds) required to do shutdown processing for the update. +- **stackRevision** The revision number of the servicing stack. +- **stageTimeSeconds** The time (in seconds) required to stage all files that are part of the update. + + ### CbsServicingProvider.CbsSelectableUpdateChangeV2 This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date. @@ -2144,7 +2184,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2158,7 +2198,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Initialize -This event indicates that the Deployment 360 APIs have been initialized for use. +This event indicates that the Deployment 360 APIs have been initialized for use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2171,7 +2211,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2184,7 +2224,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2198,7 +2238,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2212,7 +2252,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2231,7 +2271,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2250,7 +2290,22 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartbeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. + +The following fields are available: + +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** The network state of the device. +- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period. +- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. + + +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: @@ -2353,7 +2408,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -This event indicates that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2366,7 +2421,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2379,7 +2434,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2392,7 +2447,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2404,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2417,7 +2472,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2429,7 +2484,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2442,7 +2497,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2455,7 +2510,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2467,7 +2522,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2480,7 +2535,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2492,7 +2547,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2505,7 +2560,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2517,7 +2572,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2530,7 +2585,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2543,7 +2598,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2555,7 +2610,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2581,7 +2636,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2606,7 +2661,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2619,7 +2674,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2632,7 +2687,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2644,7 +2699,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2658,7 +2713,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2671,7 +2726,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2684,7 +2739,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2698,7 +2753,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2711,7 +2766,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2724,7 +2779,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2738,7 +2793,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2751,7 +2806,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabAlreadyDownloaded -This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. +This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2763,7 +2818,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2777,7 +2832,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2789,7 +2844,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2802,7 +2857,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2814,7 +2869,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2828,7 +2883,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2841,7 +2896,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2854,7 +2909,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2866,7 +2921,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadyGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2879,7 +2934,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2891,7 +2946,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2904,7 +2959,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3078,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3088,7 +3143,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3130,7 +3185,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3164,7 +3219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3174,7 +3229,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3203,7 +3258,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3215,7 +3270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3226,7 +3281,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3239,7 +3294,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3250,7 +3305,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3261,7 +3316,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3272,7 +3327,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3296,7 +3351,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3307,7 +3362,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3318,7 +3373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3348,7 +3403,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3359,7 +3414,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3372,7 +3427,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3383,7 +3438,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3394,7 +3449,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd -This event represents the basic metadata about a plug and play (PNP) device and its associated driver. +This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3433,7 +3488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3444,7 +3499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3455,7 +3510,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3468,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3479,7 +3534,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3506,7 +3561,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3517,7 +3572,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3528,7 +3583,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3548,7 +3603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3559,7 +3614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3568,9 +3623,69 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AhaVersion** The binary version of the App Health Analyzer tool. +- **ApplicationErrors** The count of application errors from the event log. +- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit). +- **device_level** Various JRE/JAVA versions installed on a particular device. +- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type. +- **Jar** Flag to determine if an app has a Java JAR file dependency. +- **Jre** Flag to determine if an app has JRE framework dependency. +- **Jre_version** JRE versions an app has declared framework dependency for. +- **Name** Name of the application. +- **NonDPIAware** Flag to determine if an app is non-DPI aware +- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location. +- **ProgramId** The ID of the associated program. +- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution. +- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution. +- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility. +- **VB6** Flag to determine if an app is based on VB6 framework. +- **VB6v2** Additional flag to determine if an app is based on VB6 framework. +- **Version** Version of the application. +- **VersionCheck** Flag to determine if an app has a static dependency on OS version. +- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version. + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AllowTelemetry** Indicates the presence of the 'allowtelemetry' command line argument. +- **CommandLineArgs** Command line arguments passed when launching the App Health Analyzer executable. +- **Enhanced** Indicates the presence of the 'enhanced' command line argument. +- **StartTime** UTC date and time at which this event was sent. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3603,7 +3718,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3614,7 +3729,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3625,7 +3740,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3643,7 +3758,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3654,7 +3769,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3680,7 +3795,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3691,7 +3806,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3706,7 +3821,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3717,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3728,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3743,7 +3858,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3754,21 +3869,21 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **BrowserFlags** Browser flags for Office-related products -- **ExchangeProviderFlags** Provider policies for Office Exchange +- **BrowserFlags** Browser flags for Office-related products. +- **ExchangeProviderFlags** Provider policies for Office Exchange. - **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office shared computer licensing policies +- **SharedComputerLicensing** Office shared computer licensing policies. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3779,7 +3894,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3811,7 +3926,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3819,7 +3934,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3830,7 +3945,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3838,7 +3953,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3849,7 +3964,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3860,7 +3975,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3875,7 +3990,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3883,7 +3998,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3891,7 +4006,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3901,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3912,7 +4027,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3920,7 +4035,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3940,7 +4055,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3969,7 +4084,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event indicates an OS state change. +This event indicates an OS state change. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3994,11 +4109,296 @@ The following fields are available: - **UptimeDeltaMS** Total time (in milliseconds) added to Uptime since the last event +## Microsoft Edge events + +### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." +- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. +- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). +- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). +- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. +- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **eventType** A string representation of appPingEventEventType indicating the type of the event. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +## Migration events + +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFSys + +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + ## Miracast events ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4073,7 +4473,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4086,7 +4486,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4098,7 +4498,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4114,7 +4514,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4127,7 +4527,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4137,7 +4537,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4147,7 +4547,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4158,7 +4558,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4167,7 +4567,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4178,7 +4578,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4190,7 +4590,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentPrep -This event is used to determine whether the user needs to see the privacy consent experience or not. +This event is used to determine whether the user needs to see the privacy consent experience or not. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4200,7 +4600,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4213,7 +4613,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.wilActivity -This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. +This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4237,7 +4637,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4250,11 +4650,61 @@ The following fields are available: - **resetSettingsResult** The return code of the action to correct the known issue. +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Device readiness check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Download of latest cumulative update payload. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Install of latest cumulative update payload. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -4338,7 +4788,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -4479,7 +4929,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -4511,7 +4961,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4580,7 +5030,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4643,7 +5093,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4654,7 +5104,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4728,7 +5178,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4744,7 +5194,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4759,7 +5209,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4772,7 +5222,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4788,7 +5238,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4810,7 +5260,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4851,7 +5301,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -4887,7 +5337,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4912,7 +5362,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4937,9 +5387,45 @@ The following fields are available: ## SIH events +### SIHEngineTelemetry.EvalApplicability + +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ActionReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **AdditionalReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it. +- **IsExecutingAction** If the action is presently being executed. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** The client version that is being used. +- **StandardReasons** If an action has been assessed as inapplicable, the standard logic the prevented it. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** The Windows Update API version that is currently installed. +- **WuaucltVersion** The Windows Update client version that is currently installed. +- **WuauengVersion** The Windows Update engine version that is currently installed. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + +### SIHEngineTelemetry.ExecuteAction + +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. + + + +### SIHEngineTelemetry.PostRebootReport + +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. + + + ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4960,7 +5446,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5043,7 +5529,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5073,7 +5559,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5147,7 +5633,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5169,7 +5655,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5265,7 +5751,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5280,40 +5766,123 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. - **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. - **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed. -- **ExtendedStatusCode** The secondary status code of the event. +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. - **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed. - **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. - **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce -- **MetadataSignature** Base64 string of the signature associated with the update metadata (specified by revision id) +- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID). - **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable. - **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable. -- **RevisionId** Identifies the revision of this specific piece of content -- **RevisionNumber** Identifies the revision number of this specific piece of content +- **RevisionId** The revision ID for a specific piece of content. +- **RevisionNumber** The revision number for a specific piece of content. - **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store - **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate. -- **SHA256OfLeafCertPublicKey** Base64 encoding of hash of the Base64CertData in the FragmentSigning data of leaf certificate. +- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate. - **SHA256OfTimestampToken** An encoded string of the timestamp token. -- **SignatureAlgorithm** Hash algorithm for the metadata signature +- **SignatureAlgorithm** The hash algorithm for the metadata signature. - **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast -- **StatusCode** The status code of the event. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). - **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token. - **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed. -- **UpdateId** Identifier associated with the specific piece of content +- **UpdateId** The update ID for a specific piece of content. - **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. +## Update Assistant events + +### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId + +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ApplicabilityBlockedReason** Blocked due to an applicability issue. +- **BlockWuUpgrades** The upgrade assistant is currently blocked. +- **clientID** An identification of the current release of Update Assistant. +- **CloverTrail** This device is Clovertrail. +- **DeviceIsMdmManaged** This device is MDM managed. +- **IsNetworkAvailable** If the device network is not available. +- **IsNetworkMetered** If network is metered. +- **IsSccmManaged** This device is SCCM managed. +- **NewlyInstalledOs** OS is newly installed quiet period. +- **PausedByPolicy** Updates are paused by policy. +- **RecoveredFromRS3** Previously recovered from RS3. +- **RS1UninstallActive** Blocked due to an active RS1 uninstall. +- **RS3RollBacks** Exceeded number of allowable RS3 rollbacks. +- **triggerTaskSource** Describe which task launches this instance. +- **WsusManaged** This device is WSUS managed. +- **ZeroExhaust** This device is zero exhaust. + + +### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId + +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **clientID** An identification of the current release of Update Assistant. +- **denyReason** All the reasons why the Update Assistant was prevented from launching. Bitmask with values from UpdateAssistant.cpp eUpgradeModeReason. +- **triggerTaskSource** Describe which task launches this instance. + + +### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId + +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **calendarRun** Standard time-based triggered task. +- **clientID** An identification of the current release of Update Assistant. +- **hResult** Error code of the Update Assistant Orchestrator failure. +- **triggerTaskSource** Describe which task launches this instance. + + +### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId + +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **clientID** An identification of the current release of Update Assistant. +- **hResult** Error code of One Settings query failure. + + +### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId + +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **autoStartRunCount** The auto start run count of Update Assistant. +- **clientID** The ID of the current release of Update Assistant. +- **launchMode** Indicates the type of launch performed. +- **launchTypeReason** A bitmask of all the reasons for type of launch. +- **triggerTaskSource** Indicates which task launches this instance. + + +### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId + +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **clientID** ID of the current release of Update Assistant. +- **restoreReason** All the reasons for the restore. +- **triggerTaskSource** Indicates which task launches this instance. + + ## Update events ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5330,7 +5899,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5346,7 +5915,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5378,7 +5947,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5398,7 +5967,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5414,7 +5983,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5432,7 +6001,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5450,7 +6019,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5466,7 +6035,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5492,7 +6061,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5512,7 +6081,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5528,7 +6097,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5546,7 +6115,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5562,13 +6131,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5591,7 +6160,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5638,7 +6207,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5654,7 +6223,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5670,7 +6239,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5687,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5703,7 +6272,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5722,7 +6291,7 @@ The following fields are available: ### FacilitatorTelemetry.DCATDownload -This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure. +This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -5736,7 +6305,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5746,7 +6315,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5760,7 +6329,7 @@ The following fields are available: ### Setup360Telemetry.Downlevel -This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure. +This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -5804,7 +6373,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5968,7 +6537,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5993,7 +6562,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6012,7 +6581,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6041,7 +6610,7 @@ The following fields are available: - **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. - **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. - **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. -- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). - **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. @@ -6051,9 +6620,45 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6106,7 +6711,7 @@ The following fields are available: ### Microsoft.Windows.WER.MTT.Value -This event is used for differential privacy. +This event is used for differential privacy to help keep Windows up to date. The following fields are available: @@ -6219,6 +6824,7 @@ The following fields are available: - **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. - **AttemptNumber** The total number of attempts to acquire this product. +- **BundleId** The bundle ID - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** HResult code to show the result of the operation (success/failure). @@ -6228,6 +6834,7 @@ The following fields are available: - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this happening after a device restore? - **IsUpdate** Is this an update? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). - **PFN** Product Family Name of the product being installed. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The number of attempts by the system to acquire this product. @@ -6510,7 +7117,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6525,7 +7132,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6539,19 +7146,19 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded -This event sends basic telemetry on the success of the rollback of feature updates. +This event sends basic telemetry on the success of the rollback of feature updates. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed -This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6566,7 +7173,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable -This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6580,13 +7187,13 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted -This event indicates that the Quality Rollback process has started. +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded -This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. @@ -6594,7 +7201,7 @@ This event sends basic telemetry on the success of the rollback of the Quality/L ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6626,7 +7233,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6675,7 +7282,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6695,7 +7302,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6734,7 +7341,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6756,7 +7363,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6772,7 +7379,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6796,7 +7403,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6812,7 +7419,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6839,7 +7446,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6857,7 +7464,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6873,7 +7480,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6888,7 +7495,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6914,7 +7521,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6930,7 +7537,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6946,7 +7553,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6962,7 +7569,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6978,7 +7585,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6994,7 +7601,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7010,7 +7617,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7026,7 +7633,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7042,7 +7649,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7064,7 +7671,7 @@ This event is sent when a second reminder dialog is displayed during Enhanced En ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7083,7 +7690,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7094,7 +7701,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7107,7 +7714,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7120,7 +7727,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7130,7 +7737,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7149,7 +7756,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7169,9 +7776,22 @@ The following fields are available: - **wuDeviceid** The unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.DetectionResult + +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. + +The following fields are available: + +- **applicableUpdateIdList** A list of applicable update IDs. +- **applicableUpdateList** A list of applicable update names. +- **seekerUpdateIdList** A list of optional update IDs. +- **seekerUpdateList** A list of optional update names. +- **wuDeviceid** The Windows Update device identifier. + + ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7187,7 +7807,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7204,7 +7824,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7213,7 +7833,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7222,7 +7842,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7233,7 +7853,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Escalation -This event is sent when USO takes an Escalation action on a device. +This event is sent when USO takes an Escalation action on a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7246,7 +7866,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7263,7 +7883,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationsRefreshFailed -USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. +USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7274,7 +7894,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7290,7 +7910,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7301,7 +7921,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7318,7 +7938,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7343,7 +7963,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7356,7 +7976,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7366,9 +7986,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data to device when Oobe Update download is in progress. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An update ID. +- **updateScenarioType** A type of update scenario. +- **wuDeviceid** A device ID associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event is sent after a Windows update install completes. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -7385,7 +8018,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7397,7 +8030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7406,7 +8039,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Progress -This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. +This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7424,7 +8057,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7443,7 +8076,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7455,7 +8088,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7465,7 +8098,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7481,9 +8114,35 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable + +This event defines when an optional update is available for the device to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** The unique identifier of the Windows Insider build on this device. +- **isFeatureUpdate** Indicates whether the update is a Feature Update. +- **revisionNumber** The revision number of the update. +- **updateId** The GUID (Globally Unique Identifier) of the update. +- **wuDeviceid** The Windows Update device identifier. + + +### Microsoft.Windows.Update.Orchestrator.SeekUpdate + +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. + +The following fields are available: + +- **flightID** The ID of the Windows Insider builds on the device. +- **isFeatureUpdate** Indicates that the target of the Seek is a feature update. +- **revisionNumber** The revision number of the update. +- **updateId** The identifier of the update. +- **wuDeviceid** The Windows Update device identifier. + + ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7499,7 +8158,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7511,7 +8170,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7521,9 +8180,20 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event sends data when a device pauses an in-progress update, to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -7536,7 +8206,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -7551,7 +8221,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7561,7 +8231,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -7597,9 +8267,21 @@ The following fields are available: - **wuDeviceid** Unique ID for Device +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event sends data when UUP needs to fall back, to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7621,7 +8303,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7630,7 +8312,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7639,7 +8321,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -7658,13 +8340,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7674,7 +8356,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7695,7 +8377,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7719,7 +8401,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7741,7 +8423,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7766,37 +8448,37 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index b5c02de9bd..12bf3f543c 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -7,14 +7,14 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security localizationpriority: high -author: dansimp -ms.author: dansimp +author: brianlic-msft +ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/19/2019 -ms.reviewer: +ms.date: 09/30/2020 +ms.reviewer: --- @@ -33,7 +33,8 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 1903 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) - [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) @@ -81,7 +82,7 @@ Automatically closed activity for start/stop operations that aren't explicitly c ### Microsoft.Windows.Security.AppLockerCSP.AddParams -Parameters passed to Add function of the AppLockerCSP Node. +This event indicates the parameters passed to the Add function of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -91,13 +92,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.AddStart -Start of "Add" Operation for the AppLockerCSP Node. +This event indicates the start of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.AddStop -End of "Add" Operation for AppLockerCSP Node. +This event indicates the end of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -106,7 +107,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.CAppLockerCSP::Rollback -Result of the 'Rollback' operation in AppLockerCSP. +This event provides the result of the Rollback operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -116,7 +117,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.ClearParams -Parameters passed to the "Clear" operation for AppLockerCSP. +This event provides the parameters passed to the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -125,13 +126,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.ClearStart -Start of the "Clear" operation for the AppLockerCSP Node. +This event indicates the start of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.ClearStop -End of the "Clear" operation for the AppLockerCSP node. +This event indicates the end of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -140,7 +141,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.ConfigManagerNotificationStart -Start of the "ConfigManagerNotification" operation for AppLockerCSP. +This event indicates the start of the Configuration Manager Notification operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -149,7 +150,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.ConfigManagerNotificationStop -End of the "ConfigManagerNotification" operation for AppLockerCSP. +This event indicates the end of the Configuration Manager Notification operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -158,7 +159,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceParams -Parameters passed to the CreateNodeInstance function of the AppLockerCSP node. +This event provides the parameters that were passed to the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -169,13 +170,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStart -Start of the "CreateNodeInstance" operation for the AppLockerCSP node. +This event indicates the start of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStop -End of the "CreateNodeInstance" operation for the AppLockerCSP node +This event indicates the end of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -184,7 +185,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildParams -Parameters passed to the DeleteChild function of the AppLockerCSP node. +This event provides the parameters passed to the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -194,13 +195,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStart -Start of the "DeleteChild" operation for the AppLockerCSP node. +This event indicates the start of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStop -End of the "DeleteChild" operation for the AppLockerCSP node. +This event indicates the end of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -209,7 +210,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.EnumPolicies -Logged URI relative to %SYSTEM32%\AppLocker, if the Plugin GUID is null, or the CSP doesn't believe the old policy is present. +This event provides the logged Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker if the plug-in GUID is null or the Configuration Service Provider (CSP) doesn't believe the old policy is present. The following fields are available: @@ -218,7 +219,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesParams -Parameters passed to the GetChildNodeNames function of the AppLockerCSP node. +This event provides the parameters passed to the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -227,13 +228,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStart -Start of the "GetChildNodeNames" operation for the AppLockerCSP node. +This event indicates the start of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStop -End of the "GetChildNodeNames" operation for the AppLockerCSP node. +This event indicates the end of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -244,7 +245,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.GetLatestId -The result of 'GetLatestId' in AppLockerCSP (the latest time stamped GUID). +This event provides the latest time-stamped unique identifier in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -254,7 +255,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.HResultException -HRESULT thrown by any arbitrary function in AppLockerCSP. +This event provides the result code (HRESULT) generated by any arbitrary function in the AppLocker Configuration Service Provider (CSP). The following fields are available: @@ -266,7 +267,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.SetValueParams -Parameters passed to the SetValue function of the AppLockerCSP node. +This event provides the parameters that were passed to the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -276,7 +277,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.SetValueStart -Start of the "SetValue" operation for the AppLockerCSP node. +This event indicates the start of the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. @@ -291,7 +292,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.TryRemediateMissingPolicies -EntryPoint of fix step or policy remediation, includes URI relative to %SYSTEM32%\AppLocker that needs to be fixed. +This event provides information for fixing a policy in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. It includes Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker that needs to be fixed. The following fields are available: @@ -302,13 +303,16 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: - **DatasourceApplicationFile_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_19H1** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_21H1Setup** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers. - **DatasourceApplicationFile_RS2** An ID for the system, calculated by hashing hardware identifiers. - **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. @@ -322,6 +326,9 @@ The following fields are available: - **DatasourceDevicePnp_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_19H1** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_21H1Setup** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. - **DatasourceDevicePnp_RS2** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. @@ -335,6 +342,9 @@ The following fields are available: - **DatasourceDriverPackage_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_19H1** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_21H1Setup** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. - **DatasourceDriverPackage_RS2** The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device. - **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. @@ -348,6 +358,9 @@ The following fields are available: - **DataSourceMatchingInfoBlock_19ASetup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_21H1Setup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. - **DataSourceMatchingInfoBlock_RS2** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. @@ -361,6 +374,9 @@ The following fields are available: - **DataSourceMatchingInfoPassive_19ASetup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_21H1Setup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. - **DataSourceMatchingInfoPassive_RS2** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. @@ -374,6 +390,9 @@ The following fields are available: - **DataSourceMatchingInfoPostUpgrade_19ASetup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1Setup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. - **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. - **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. @@ -387,6 +406,9 @@ The following fields are available: - **DatasourceSystemBios_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_19H1** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_21H1Setup** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. - **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device. - **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. @@ -400,6 +422,9 @@ The following fields are available: - **DecisionApplicationFile_19ASetup** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_19H1** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_RS1** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_RS2** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. @@ -413,6 +438,9 @@ The following fields are available: - **DecisionDevicePnp_19ASetup** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_19H1** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. - **DecisionDevicePnp_RS2** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. @@ -426,6 +454,9 @@ The following fields are available: - **DecisionDriverPackage_19ASetup** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_19H1** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. - **DecisionDriverPackage_RS2** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. @@ -439,6 +470,9 @@ The following fields are available: - **DecisionMatchingInfoBlock_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. - **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device. - **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. @@ -452,6 +486,9 @@ The following fields are available: - **DecisionMatchingInfoPassive_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. - **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device. - **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. @@ -465,6 +502,9 @@ The following fields are available: - **DecisionMatchingInfoPostUpgrade_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. - **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. - **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. @@ -478,6 +518,9 @@ The following fields are available: - **DecisionMediaCenter_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMediaCenter_19H1** The count of the number of this particular object type present on this device. - **DecisionMediaCenter_19H1Setup** The total DecisionMediaCenter objects targeting the next release of Windows on this device. +- **DecisionMediaCenter_20H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. - **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device. - **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. @@ -491,6 +534,9 @@ The following fields are available: - **DecisionSystemBios_19ASetup** The total DecisionSystemBios objects targeting the next release of Windows on this device. - **DecisionSystemBios_19H1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. - **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device. - **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. @@ -502,6 +548,8 @@ The following fields are available: - **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. - **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. - **InventoryApplicationFile** The count of the number of this particular object type present on this device. - **InventoryDeviceContainer** A count of device container objects in cache. @@ -529,6 +577,9 @@ The following fields are available: - **Wmdrm_19ASetup** The count of the number of this particular object type present on this device. - **Wmdrm_19H1** The count of the number of this particular object type present on this device. - **Wmdrm_19H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. +- **Wmdrm_20H1** The count of the number of this particular object type present on this device. +- **Wmdrm_20H1Setup** The count of the number of this particular object type present on this device. +- **Wmdrm_21H1Setup** The count of the number of this particular object type present on this device. - **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. - **Wmdrm_RS2** An ID for the system, calculated by hashing hardware identifiers. - **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. @@ -543,7 +594,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -555,13 +606,13 @@ The following fields are available: - **HasCitData** Indicates whether the file is present in CIT data. - **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file. - **IsAv** Is the file an anti-virus reporting EXE? -- **ResolveAttempted** This will always be an empty string when sending telemetry. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. - **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -572,7 +623,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -604,7 +655,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -615,7 +666,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -637,7 +688,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -648,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -659,18 +710,19 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd -This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date. +This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -681,7 +733,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -692,7 +744,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd -This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -703,7 +755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -714,7 +766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -725,7 +777,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd -This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -736,7 +788,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -747,7 +799,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -758,7 +810,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd -This event sends compatibility database information about the BIOS to help keep Windows up-to-date. +This event sends compatibility database information about the BIOS to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -769,7 +821,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -780,7 +832,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -791,7 +843,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd -This event sends compatibility decision data about a file to help keep Windows up-to-date. +This event sends compatibility decision data about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -806,7 +858,7 @@ The following fields are available: - **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? - **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? - **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade? -- **NeedsDismissAction** Will the file cause an action that can be dimissed? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? - **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app. - **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade? - **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app. @@ -821,7 +873,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +884,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -843,7 +895,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd -This event sends compatibility decision data about a PNP device to help keep Windows up to date. +This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -870,7 +922,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -881,7 +933,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -910,7 +962,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -921,7 +973,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -941,15 +993,17 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. - **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks? - **DisplayGenericMessage** Will a generic message be shown for this block? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? - **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block? - **SdbBlockUpgrade** Is a matching info block blocking upgrade? - **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag? - **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag? +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -960,7 +1014,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -985,7 +1039,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -996,7 +1050,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1022,7 +1076,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1033,7 +1087,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1061,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1072,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1097,7 +1151,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1108,7 +1162,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1133,7 +1187,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1162,7 +1216,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1173,7 +1227,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1197,7 +1251,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1208,7 +1262,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1237,7 +1291,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1248,7 +1302,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1259,7 +1313,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1278,7 +1332,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1289,18 +1343,18 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1325,7 +1379,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1336,7 +1390,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1347,7 +1401,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1363,7 +1417,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd -This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date. +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1381,7 +1435,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1392,7 +1446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1416,7 +1470,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1427,7 +1481,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1438,7 +1492,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd -This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1451,7 +1505,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1462,7 +1516,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1473,7 +1527,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd -This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1487,7 +1541,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1498,7 +1552,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1522,7 +1576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1533,7 +1587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1557,7 +1611,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1568,7 +1622,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1592,7 +1646,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1603,7 +1657,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1627,7 +1681,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1638,7 +1692,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1662,7 +1716,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1673,7 +1727,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1684,7 +1738,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanAdd -This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date. +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1701,7 +1755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1712,7 +1766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1723,18 +1777,18 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth -This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. +This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. The following fields are available: - **AppraiserBranch** The source branch in which the version of Appraiser that is running was built. -- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run. +- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run. - **AppraiserProcess** The name of the process that launched Appraiser. - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. -- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. - **InboxDataVersion** The original version of the data files before retrieving any newer version. - **IndicatorsWritten** Indicates if all relevant UEX indicators were successfully written or updated. @@ -1743,18 +1797,19 @@ The following fields are available: - **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. - **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. - **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. -- **RunDate** The date that the telemetry run was stated, expressed as a filetime. -- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic. +- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. - **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. -- **RunResult** The hresult of the Appraiser telemetry run. +- **RunResult** The hresult of the Appraiser diagnostic data run. - **ScheduledUploadDay** The day scheduled for the upload. -- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run. +- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. - **StoreHandleIsNotNull** Obsolete, always set to false -- **TelementrySent** Indicates if telemetry was successfully sent. -- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability. +- **TelementrySent** Indicates whether diagnostic data was successfully sent. +- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability. - **Time** The client time of the event. - **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. - **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. +- **WhyRunSkipped** Indicates the reason or reasons that an appraiser run was skipped. ### Microsoft.Windows.Appraiser.General.WmdrmAdd @@ -1778,7 +1833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1789,7 +1844,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1798,11 +1853,68 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +## Audio endpoint events + +### MicArrayGeometry + +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **MicCoords** The location and orientation of the microphone element. See [MicCoords](#miccoords). +- **usFrequencyBandHi** The high end of the frequency range for the microphone. +- **usFrequencyBandLo** The low end of the frequency range for the microphone. +- **usMicArrayType** The type of the microphone array. +- **usNumberOfMicrophones** The number of microphones in the array. +- **usVersion** The version of the microphone array specification. +- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). +- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). +- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). +- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). + + +### MicCoords + +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **usType** The type of microphone. +- **wHorizontalAngle** The horizontal angle of the microphone (reported as radians times 10,000). +- **wVerticalAngle** The vertical angle of the microphone (reported as radians times 10,000). +- **wXCoord** The x-coordinate of the microphone. +- **wYCoord** The y-coordinate of the microphone. +- **wZCoord** The z-coordinate of the microphone. + + +### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo + +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BusEnumeratorName** The name of the bus enumerator (for example, HDAUDIO or USB). +- **ContainerId** An identifier that uniquely groups the functional devices associated with a single-function or multifunction device. +- **DeviceInstanceId** The unique identifier for this instance of the device. +- **EndpointDevnodeId** The IMMDevice identifier of the associated devnode. +- **EndpointFormFactor** The enumeration value for the form factor of the endpoint device (for example speaker, microphone, remote network device). +- **endpointID** The unique identifier for the audio endpoint. +- **endpointInstanceId** The unique identifier for the software audio endpoint. Used for joining to other audio event. +- **Flow** Indicates whether the endpoint is capture (1) or render (0). +- **HWID** The hardware identifier for the endpoint. +- **IsBluetooth** Indicates whether the device is a Bluetooth device. +- **IsSideband** Indicates whether the device is a sideband device. +- **IsUSB** Indicates whether the device is a USB device. +- **JackSubType** A unique ID representing the KS node type of the endpoint. +- **MicArrayGeometry** Describes the microphone array, including the microphone position, coordinates, type, and frequency range. See [MicArrayGeometry](#micarraygeometry). +- **persistentId** A unique ID for this endpoint which is retained across migrations. + + ## Census events ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1820,7 +1932,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1831,7 +1943,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1842,19 +1954,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1880,7 +1982,7 @@ The following fields are available: ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1892,7 +1994,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1907,7 +2009,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1950,7 +2052,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1960,7 +2062,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1983,7 +2085,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2025,7 +2127,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2071,7 +2173,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2094,7 +2196,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2112,7 +2214,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2131,7 +2233,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2143,7 +2245,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2156,7 +2258,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2177,7 +2279,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2190,7 +2292,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2236,7 +2338,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2247,11 +2349,12 @@ The following fields are available: - **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. - **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. - **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. +- **VMId** A string that identifies a virtual machine. ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2448,8 +2551,7 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. - -## Common data fields +## Common Data Fields ### Ms.Device.DeviceInventoryChange @@ -2457,18 +2559,17 @@ Describes the installation state for all hardware and software components availa The following fields are available: -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. - +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Compatibility events ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2482,7 +2583,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -2504,7 +2605,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2641,7 +2742,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2655,7 +2756,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2668,7 +2769,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2682,7 +2783,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2694,9 +2795,78 @@ The following fields are available: ## Diagnostic data events +### TelClientSynthetic.AbnormalShutdown_0 + +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **AbnormalShutdownBootId** BootId of the abnormal shutdown being reported by this event. +- **AcDcStateAtLastShutdown** Identifies if the device was on battery or plugged in. +- **BatteryLevelAtLastShutdown** The last recorded battery level. +- **BatteryPercentageAtLastShutdown** The battery percentage at the last shutdown. +- **CrashDumpEnabled** Indicates whether crash dumps are enabled. +- **CumulativeCrashCount** Cumulative count of operating system crashes since the BootId reset. +- **CurrentBootId** BootId at the time the abnormal shutdown event was being reported. +- **Firmwaredata->ResetReasonEmbeddedController** The reset reason that was supplied by the firmware. +- **Firmwaredata->ResetReasonEmbeddedControllerAdditional** Additional data related to reset reason provided by the firmware. +- **Firmwaredata->ResetReasonPch** The reset reason that was supplied by the hardware. +- **Firmwaredata->ResetReasonPchAdditional** Additional data related to the reset reason supplied by the hardware. +- **Firmwaredata->ResetReasonSupplied** Indicates whether the firmware supplied any reset reason or not. +- **FirmwareType** ID of the FirmwareType as enumerated in DimFirmwareType. +- **HardwareWatchdogTimerGeneratedLastReset** Indicates whether the hardware watchdog timer caused the last reset. +- **HardwareWatchdogTimerPresent** Indicates whether hardware watchdog timer was present or not. +- **LastBugCheckBootId** bootId of the last captured crash. +- **LastBugCheckCode** Code that indicates the type of error. +- **LastBugCheckContextFlags** Additional crash dump settings. +- **LastBugCheckOriginalDumpType** The type of crash dump the system intended to save. +- **LastBugCheckOtherSettings** Other crash dump settings. +- **LastBugCheckParameter1** The first parameter with additional info on the type of the error. +- **LastBugCheckProgress** Progress towards writing out the last crash dump. +- **LastBugCheckVersion** The version of the information struct written during the crash. +- **LastSuccessfullyShutdownBootId** BootId of the last fully successful shutdown. +- **LongPowerButtonPressDetected** Identifies if the user was pressing and holding power button. +- **OOBEInProgress** Identifies if the Out-Of-Box-Experience is running. +- **OSSetupInProgress** Identifies if the operating system setup is running. +- **PowerButtonCumulativePressCount** Indicates the number of times the power button has been pressed ("pressed" not to be confused with "released"). +- **PowerButtonCumulativeReleaseCount** Indicates the number of times the power button has been released ("released" not to be confused with "pressed"). +- **PowerButtonErrorCount** Indicates the number of times there was an error attempting to record Power Button metrics (e.g.: due to a failure to lock/update the bootstat file). +- **PowerButtonLastPressBootId** BootId of the last time the Power Button was detected to have been pressed ("pressed" not to be confused with "released"). +- **PowerButtonLastPressTime** Date/time of the last time the Power Button was pressed ("pressed" not to be confused with "released"). +- **PowerButtonLastReleaseBootId** The Boot ID of the last time the Power Button was released ("released" not to be confused with "pressed"). +- **PowerButtonLastReleaseTime** The date and time the Power Button was most recently released ("released" not to be confused with "pressed"). +- **PowerButtonPressCurrentCsPhase** Represents the phase of Connected Standby exit when the power button was pressed. +- **PowerButtonPressIsShutdownInProgress** Indicates whether a system shutdown was in progress at the last time the power button was pressed. +- **PowerButtonPressLastPowerWatchdogStage** The last stage completed when the Power Button was most recently pressed. +- **PowerButtonPressPowerWatchdogArmed** Indicates whether or not the watchdog for the monitor was active at the time of the last power button press. +- **ShutdownDeviceType** Identifies who triggered a shutdown. Is it because of battery, thermal zones, or through a Kernel API. +- **SleepCheckpoint** Provides the last checkpoint when there is a failure during a sleep transition. +- **SleepCheckpointSource** Indicates whether the source is the EFI variable or bootstat file. +- **SleepCheckpointStatus** Indicates whether the checkpoint information is valid. +- **StaleBootStatData** Identifies if the data from bootstat is stale. +- **TransitionInfoBootId** The Boot ID of the captured transition information. +- **TransitionInfoCSCount** The total number of times the system transitioned from "Connected Standby" mode to "On" when the last marker was saved. +- **TransitionInfoCSEntryReason** Indicates the reason the device last entered "Connected Standby" mode ("entered" not to be confused with "exited"). +- **TransitionInfoCSExitReason** Indicates the reason the device last exited "Connected Standby" mode ("exited" not to be confused with "entered"). +- **TransitionInfoCSInProgress** Indicates whether the system was in or entering Connected Standby mode when the last marker was saved. +- **TransitionInfoLastReferenceTimeChecksum** The checksum of TransitionInfoLastReferenceTimestamp. +- **TransitionInfoLastReferenceTimestamp** The date and time that the marker was last saved. +- **TransitionInfoLidState** Describes the state of the laptop lid. +- **TransitionInfoPowerButtonTimestamp** The most recent date and time when the Power Button was pressed (collected via a different mechanism than PowerButtonLastPressTime). +- **TransitionInfoSleepInProgress** Indicates whether the system was in or entering Sleep mode when the last marker was saved. +- **TransitionInfoSleepTranstionsToOn** The total number of times the system transitioned from Sleep mode to on, when the last marker was saved. +- **TransitionInfoSystemRunning** Indicates whether the system was running when the last marker was saved. +- **TransitionInfoSystemShutdownInProgress** Indicates whether a device shutdown was in progress when the power button was pressed. +- **TransitionInfoUserShutdownInProgress** Indicates whether a user shutdown was in progress when the power button was pressed. +- **TransitionLatestCheckpointId** Represents a unique identifier for a checkpoint during the device state transition. +- **TransitionLatestCheckpointSeqNumber** Represents the chronological sequence number of the checkpoint. +- **TransitionLatestCheckpointType** Represents the type of the checkpoint, which can be the start of a phase, end of a phase, or just informational. +- **VirtualMachineId** If the operating system is on a virtual Machine, it gives the virtual Machine ID (GUID) that can be used to correlate events on the host. + + ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2715,7 +2885,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2734,15 +2904,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -2898,7 +3068,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -Event to indicate that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2925,7 +3095,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2938,7 +3108,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2951,7 +3121,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2963,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2976,7 +3146,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2988,7 +3158,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3001,7 +3171,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3014,7 +3184,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3026,7 +3196,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3039,7 +3209,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3051,7 +3221,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3064,7 +3234,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3076,7 +3246,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3089,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3102,7 +3272,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3114,7 +3284,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3127,7 +3297,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3139,7 +3309,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3152,7 +3322,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3165,7 +3335,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3175,9 +3345,23 @@ The following fields are available: - **CV** Correlation vector. +### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run +- **ClientID** Client ID being run +- **CoordinatorVersion** Coordinator version of DTU +- **CV** Correlation vector +- **CV_new** New correlation vector +- **hResult** HRESULT of the failure + + ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3190,7 +3374,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3203,7 +3387,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3217,7 +3401,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3230,7 +3414,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3244,7 +3428,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3257,7 +3441,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3271,7 +3455,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3283,7 +3467,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3296,7 +3480,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3308,7 +3492,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3322,7 +3506,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3335,7 +3519,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3348,7 +3532,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3360,7 +3544,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3372,7 +3556,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3385,7 +3569,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3395,6 +3579,251 @@ The following fields are available: - **CV** Correlation vector. +## DISM events + +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + +### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU + +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismInstalledLCUPackageName** The name of the latest installed package. + + +### Microsoft.Windows.StartRepairCore.DISMPendingInstall + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd + +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **flightIds** The Flight IDs (identifier of the beta release) of found driver updates. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart + +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + +## Driver installation events + +### Microsoft.Windows.DriverInstall.DeviceInstall + +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ClassGuid** The unique ID for the device class. +- **ClassLowerFilters** The list of lower filter class drivers. +- **ClassUpperFilters** The list of upper filter class drivers. +- **CoInstallers** The list of coinstallers. +- **ConfigFlags** The device configuration flags. +- **DeviceConfigured** Indicates whether this device was configured through the kernel configuration. +- **DeviceInstanceId** The unique identifier of the device in the system. +- **DeviceStack** The device stack of the driver being installed. +- **DriverDate** The date of the driver. +- **DriverDescription** A description of the driver function. +- **DriverInfName** Name of the INF file (the setup information file) for the driver. +- **DriverInfSectionName** Name of the DDInstall section within the driver INF file. +- **DriverPackageId** The ID of the driver package that is staged to the driver store. +- **DriverProvider** The driver manufacturer or provider. +- **DriverUpdated** Indicates whether the driver is replacing an old driver. +- **DriverVersion** The version of the driver file. +- **EndTime** The time the installation completed. +- **Error** Provides the WIN32 error code for the installation. +- **ExtensionDrivers** List of extension drivers that complement this installation. +- **FinishInstallAction** Indicates whether the co-installer invoked the finish-install action. +- **FinishInstallUI** Indicates whether the installation process shows the user interface. +- **FirmwareDate** The firmware date that will be stored in the EFI System Resource Table (ESRT). +- **FirmwareRevision** The firmware revision that will be stored in the EFI System Resource Table (ESRT). +- **FirmwareVersion** The firmware version that will be stored in the EFI System Resource Table (ESRT). +- **FirstHardwareId** The ID in the hardware ID list that provides the most specific device description. +- **FlightIds** A list of the different Windows Insider builds on the device. +- **GenericDriver** Indicates whether the driver is a generic driver. +- **Inbox** Indicates whether the driver package is included with Windows. +- **InstallDate** The date the driver was installed. +- **LastCompatibleId** The ID in the hardware ID list that provides the least specific device description. +- **LegacyInstallReasonError** The error code for the legacy installation. +- **LowerFilters** The list of lower filter drivers. +- **MatchingDeviceId** The hardware ID or compatible ID that Windows used to install the device instance. +- **NeedReboot** Indicates whether the driver requires a reboot. +- **OriginalDriverInfName** The original name of the INF file before it was renamed. +- **ParentDeviceInstanceId** The device instance ID of the parent of the device. +- **PendedUntilReboot** Indicates whether the installation is pending until the device is rebooted. +- **Problem** Error code returned by the device after installation. +- **ProblemStatus** The status of the device after the driver installation. +- **RebootRequiredReason** DWORD (Double Word—32-bit unsigned integer) containing the reason why the device required a reboot during install. +- **SecondaryDevice** Indicates whether the device is a secondary device. +- **ServiceName** The service name of the driver. +- **SetupMode** Indicates whether the driver installation took place before the Out Of Box Experience (OOBE) was completed. +- **StartTime** The time when the installation started. +- **SubmissionId** The driver submission identifier assigned by the Windows Hardware Development Center. +- **UpperFilters** The list of upper filter drivers. + + +### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd + +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DeviceInstanceId** The unique identifier of the device in the system. +- **DriverUpdated** Indicates whether the driver was updated. +- **Error** The Win32 error code of the installation. +- **FlightId** The ID of the Windows Insider build the device received. +- **InstallDate** The date the driver was installed. +- **InstallFlags** The driver installation flags. +- **OptionalData** Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.) +- **RebootRequired** Indicates whether a reboot is required after the installation. +- **RollbackPossible** Indicates whether this driver can be rolled back. +- **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update. +- **WuUntargetedHardwareId** Indicates that the driver was installed because Windows Update performed a generic driver update for all devices of that hardware class. + + +### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart + +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DeviceInstanceId** The unique identifier of the device in the system. +- **FirstInstallDate** The first time a driver was installed on this device. +- **LastDriverDate** Date of the driver that is being replaced. +- **LastDriverInbox** Indicates whether the previous driver was included with Windows. +- **LastDriverInfName** Name of the INF file (the setup information file) of the driver being replaced. +- **LastDriverVersion** The version of the driver that is being replaced. +- **LastFirmwareDate** The date of the last firmware reported from the EFI System Resource Table (ESRT). +- **LastFirmwareRevision** The last firmware revision number reported from EFI System Resource Table (ESRT). +- **LastFirmwareVersion** The last firmware version reported from the EFI System Resource Table (ESRT). +- **LastInstallDate** The date a driver was last installed on this device. +- **LastMatchingDeviceId** The hardware ID or compatible ID that Windows last used to install the device instance. +- **LastProblem** The previous problem code that was set on the device. +- **LastProblemStatus** The previous problem code that was set on the device. +- **LastSubmissionId** The driver submission identifier of the driver that is being replaced. + + ## DxgKernelTelemetry events ### DxgKrnlTelemetry.GPUAdapterInventoryV2 @@ -3408,22 +3837,29 @@ The following fields are available: - **bootId** The system boot ID. - **BrightnessVersionViaDDI** The version of the Display Brightness Interface. - **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. +- **DDIInterfaceVersion** The device driver interface version. - **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). +- **DedicatedVideoMemo** Amount of dedicated video memory in bytes. - **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). - **DisplayAdapterLuid** The display adapter LUID. - **DriverDate** The date of the display driver. - **DriverRank** The rank of the display driver. - **DriverVersion** The display driver version. +- **DriverWorkarounds** Numeric value indicating the driver workarounds that are enabled for this device. - **DX10UMDFilePath** The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store. - **DX11UMDFilePath** The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store. +- **DX12U** File path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. - **DX12UMDFilePath** The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. - **DX9UMDFilePath** The file path to the location of the DirectX 9 Display User Mode Driver in the Driver Store. - **GPUDeviceID** The GPU device ID. - **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload. - **GPURevisionID** The GPU revision ID. - **GPUVendorID** The GPU vendor ID. +- **InterfaceFuncPointersProvided1** Number of device driver interface function pointers provided. +- **InterfaceFuncPointersProvided2** Number of device driver interface function pointers provided. - **InterfaceId** The GPU interface ID. - **IsDisplayDevice** Does the GPU have displaying capabilities? +- **IsHwSchEnabled** Boolean value indicating whether hardware scheduling is enabled. - **IsHwSchSupported** Indicates whether the adapter supports hardware scheduling. - **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device? - **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device? @@ -3560,7 +3996,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3602,7 +4038,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3655,7 +4091,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3663,9 +4099,27 @@ The following fields are available: - **devinv** The file version of the Device inventory component. +### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd + +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **CatalogSigners** Signers from catalog. Each signer starts with Chain. +- **DigestAlgorithm** The pseudonymizing (hashing) algorithm used when the file or package was signed. +- **DriverPackageStrongName** Optional. Available only if FileSigningInfo is collected on a driver package. +- **EmbeddedSigners** Embedded signers. Each signer starts with Chain. +- **FileName** The file name of the file whose signatures are listed. +- **FileType** Either exe or sys, depending on if a driver package or application executable. +- **InventoryVersion** The version of the inventory file generating the events. +- **Thumbprint** Comma separated hash of the leaf node of each signer. Semicolon is used to separate CatalogSigners from EmbeddedSigners. There will always be a trailing comma. + + ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3694,7 +4148,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3706,7 +4160,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3717,7 +4171,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3730,7 +4184,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3741,7 +4195,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3752,7 +4206,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3763,7 +4217,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3787,7 +4241,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3798,7 +4252,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3809,7 +4263,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3839,7 +4293,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3850,7 +4304,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3865,7 +4319,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3876,7 +4330,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3887,7 +4341,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd -This event represents the basic metadata about a plug and play (PNP) device and its associated driver. +This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3914,7 +4368,7 @@ The following fields are available: - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -3932,7 +4386,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3943,7 +4397,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3954,7 +4408,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3967,7 +4421,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3978,7 +4432,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4005,7 +4459,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4016,7 +4470,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4027,7 +4481,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4038,16 +4492,18 @@ The following fields are available: - **Date** The driver package date. - **Directory** The path to the driver package. - **DriverInBox** Is the driver included with the operating system? +- **FlightIds** Driver Flight IDs. - **Inf** The INF name of the driver package. - **InventoryVersion** The version of the inventory file generating the events. - **Provider** The provider for the driver package. +- **RecoveryIds** Driver recovery IDs. - **SubmissionId** The HLK submission ID for the driver package. - **Version** The version of the driver package. ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4058,7 +4514,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4085,48 +4541,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. -The following fields are available: - -- **AhaVersion** The binary version of the App Health Analyzer tool. -- **ApplicationErrors** The count of application errors from the event log. -- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit). -- **device_level** Various JRE/JAVA versions installed on a particular device. -- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type. -- **Jar** Flag to determine if an app has a Java JAR file dependency. -- **Jre** Flag to determine if an app has JRE framework dependency. -- **Jre_version** JRE versions an app has declared framework dependency for. -- **Name** Name of the application. -- **NonDPIAware** Flag to determine if an app is non-DPI aware. -- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location. -- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution. -- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution. -- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility. -- **VB6** Flag to determine if an app is based on VB6 framework. -- **VB6v2** Additional flag to determine if an app is based on VB6 framework. -- **Version** Version of the application. -- **VersionCheck** Flag to determine if an app has a static dependency on OS version. -- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version. ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **AllowTelemetry** Indicates the presence of the 'allowtelemetry' command line argument. -- **CommandLineArgs** Command line arguments passed when launching the App Health Analyzer executable. -- **Enhanced** Indicates the presence of the 'enhanced' command line argument. -- **StartTime** UTC date and time at which this event was sent. +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4159,7 +4621,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4170,7 +4632,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4181,7 +4643,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4199,7 +4661,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4210,7 +4672,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4236,7 +4698,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4247,7 +4709,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4262,7 +4724,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4273,7 +4735,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4284,7 +4746,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4299,7 +4761,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4310,21 +4772,21 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **BrowserFlags** Browser flags for Office-related products -- **ExchangeProviderFlags** Provider policies for Office Exchange +- **BrowserFlags** Browser flags for Office-related products. +- **ExchangeProviderFlags** Provider policies for Office Exchange. - **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office shared computer licensing policies +- **SharedComputerLicensing** Office shared computer licensing policies. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4335,7 +4797,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4367,7 +4829,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4378,7 +4840,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4390,7 +4852,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4401,7 +4863,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4412,7 +4874,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4423,7 +4885,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4438,7 +4900,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4446,7 +4908,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4454,7 +4916,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4465,7 +4927,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4477,7 +4939,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4485,7 +4947,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4502,10 +4964,9 @@ The following fields are available: - **BytesRead** The total number of bytes read from or read by the OS upon system startup. - **BytesWritten** The total number of bytes written to or written by the OS upon system startup. - ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4534,11 +4995,342 @@ The following fields are available: - **UserInputTime** The amount of time the loader application spent waiting for user input. +### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig + +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ClassGuid** The unique ID for the device class. +- **DeviceInstanceId** The unique ID for the device on the system. +- **DriverDate** The date of the driver. +- **DriverFlightIds** The IDs for the driver flights. +- **DriverInfName** Driver INF file name. +- **DriverProvider** The driver manufacturer or provider. +- **DriverSubmissionId** The driver submission ID assigned by the hardware developer center. +- **DriverVersion** The driver version number. +- **ExtensionDrivers** The list of extension driver INF files, extension IDs, and associated flight IDs. +- **FirstHardwareId** The ID in the hardware ID list that provides the most specific device description. +- **InboxDriver** Indicates whether the driver package is included with Windows. +- **InstallDate** Date the driver was installed. +- **LastCompatibleId** The ID in the hardware ID list that provides the least specific device description. +- **Legacy** Indicates whether the driver is a legacy driver. +- **NeedReboot** Indicates whether the driver requires a reboot. +- **SetupMode** Indicates whether the device configuration occurred during the Out Of Box Experience (OOBE). +- **StatusCode** The NTSTATUS of device configuration operation. + + +### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem + +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Count** The total number of events. +- **DeviceInstanceId** The unique identifier of the device on the system. +- **LastProblem** The previous problem that was cleared. +- **LastProblemStatus** The previous NTSTATUS value that was cleared. +- **Problem** The new problem code set on the device node. +- **ProblemStatus** The new NT_STATUS set on the device node. +- **ServiceName** The name of the driver or service attached to the device. + + +### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem + +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Count** The total number of events. +- **DeviceInstanceId** The unique identifier of the device in the system. +- **LastProblem** The previous problem code that was set on the device. +- **LastProblemStatus** The previous NTSTATUS value that was set on the device. +- **Problem** The new problem code that was set on the device. +- **ProblemStatus** The new NTSTATUS value that was set on the device. +- **ServiceName** The driver or service name that is attached to the device. + + +## Microsoft Edge events + +### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." +- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. +- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). +- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). +- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. +- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **eventType** A string representation of appPingEventEventType indicating the type of the event. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4550,7 +5342,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4561,7 +5353,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4575,7 +5367,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4649,7 +5441,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4662,7 +5454,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4674,7 +5466,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4690,7 +5482,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4703,7 +5495,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4713,7 +5505,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4723,7 +5515,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4734,7 +5526,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4743,18 +5535,46 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: +- **failedCheck** The error code returned by the operation. - **winInetError** The HResult of the operation. +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4766,7 +5586,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4780,29 +5600,110 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. - **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. - **threadId** The ID of the thread on which the activity is executing. +## Privacy notifier events + +### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted + +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cleanupTask** Indicates whether the task that launched the dialog should be cleaned up. +- **cleanupTaskResult** The return code of the attempt to clean up the task used to show the dialog. +- **deviceEvaluated** Indicates whether the device was eligible for evaluation of a known issue. +- **deviceImpacted** Indicates whether the device was impacted by a known issue. +- **modalAction** The action the user took on the dialog that was presented to them. +- **modalResult** The return code of the attempt to show a dialog to the user explaining the issue. +- **resetSettingsResult** The return code of the action to correct the known issue. + + +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **dayspendingrebootafterfu** Number of days that have elapsed since the device reached ready to reboot for a Feature Update that is still actively pending reboot. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **IsApplicable** Indicates whether the update is applicable to this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Provides information on reasons why the update is not applicable to the device. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateReadinessProcessorMaxSpeed** Processor max speed. +- **Reason** Indicates why the device did not pass the readiness check. +- **Result** Device readiness check for quality update assistant. +- **VirtualMemoryUsedByCurrentProcess** Virtual memory in use by the Quality Update Assistant process. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **DODownloadHResult** Result code from Delivery Optimization when used to download the quality update. +- **DownloadMode** Indicates how the quality update was downloaded. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **HttpsDownloadHResult** Result code when HTTPS is used to download the quality update. +- **InstallMode** Indicates which installation method was used to attempt the install of the quality update. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDeviceHasMinimumUptime** Indicates whether the device has the minimum uptime required to install a quality update. +- **Result** Download of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **DismInstallHResult** Internal result code from DISM when used to install the quality update. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **InstallMode** Indicates which installation method was used to attempt the install of the quality update. +- **KBNumber** KBNumber of the update being installed. +- **launchretrycounter** Count of the number of times the install has been retried in the event of a non-successful installation attempt. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDismErrorCode** Error code returned when DISM is used to install the quality update. +- **QualityUpdatePendingRebootAfterInstallStage** Indicates if the device is pending reboot after install is complete. +- **QualityUpdateSecondsInstallStage** Time spent installing the quality update. +- **QualityUpdateWusaErrorCode** Error code returned when WUSA is used to install the quality update. +- **Result** Install of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. +- **WusaInstallHResult** Internal result code from WUSA when used to install the quality update. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable @@ -4880,24 +5781,11 @@ The following fields are available: - **QualityUpdateSedimentTargetedTriggers** Provides information about remediations that are applicable to enable Quality Updates on the device. - **RegkeysExist** Indicates whether specified registry keys exist. - **Reload** True if SIH reload is required. -- **RemediationAutoUAAcLineStatus** Indicates the power status returned by the Automatic Update Assistant tool. -- **RemediationAutoUAAutoStartCount** Indicates the number of times the Automatic Update Assistant tool has automatically started. -- **RemediationAutoUACalendarTaskEnabled** Indicates whether an Automatic Update Assistant tool task is enabled. -- **RemediationAutoUACalendarTaskExists** Indicates whether an Automatic Update Assistant tool task exists. -- **RemediationAutoUACalendarTaskTriggerEnabledCount** Indicates the number of times an Automatic Update Assistant tool task has been triggered. -- **RemediationAutoUADaysSinceLastTaskRunTime** Indicates the last run time an Automatic Update Assistant tool task was run. -- **RemediationAutoUAGetCurrentSize** Indicates the current size of the Automatic Update Assistant tool. +- **RemediationAutoUACleanupNeeded** Automatic Update Assistant cleanup is required. - **RemediationAutoUAIsInstalled** Indicates whether the Automatic Update Assistant tool is installed. -- **RemediationAutoUALastTaskRunResult** Indicates the result from the last time the Automatic Update Assistant tool was run. -- **RemediationAutoUAMeteredNetwork** Indicates whether the Automatic Update Assistant tool is running on a metered network. -- **RemediationAutoUATaskEnabled** Indicates whether the Automatic Update Assistant tool task is enabled. -- **RemediationAutoUATaskExists** Indicates whether an Automatic Update Assistant tool task exists. +- **RemediationAutoUATaskDisabled** Indicates whether the Automatic Update Assistant tool task is disabled. +- **RemediationAutoUATaskNotExists** Indicates whether an Automatic Update Assistant tool task does not exist. - **RemediationAutoUATasksStalled** Indicates whether an Automatic Update Assistant tool task is stalled. -- **RemediationAutoUATaskTriggerEnabledCount** Indicates how many times an Automatic Update Assistant tool task was triggered. -- **RemediationAutoUAUAExitCode** Indicates any exit code provided by the Automatic Update Assistant tool. -- **RemediationAutoUAUAExitState** Indicates the exit state of the Automatic Update Assistant tool. -- **RemediationAutoUAUserLoggedIn** Indicates whether a user is logged in. -- **RemediationAutoUAUserLoggedInAdmin** Indicates whether a user is logged in as an Administrator. - **RemediationCorruptionRepairBuildNumber** The build number to use to repair corruption. - **RemediationCorruptionRepairCorruptionsDetected** Indicates whether corruption was detected. - **RemediationCorruptionRepairDetected** Indicates whether an attempt was made to repair the corruption. @@ -5010,6 +5898,7 @@ The following fields are available: - **branchReadinessLevel** Branch readiness level policy. - **cloudControlState** Value indicating whether the shell is enabled on the cloud control settings. - **CV** The Correlation Vector. +- **DateTimeDifference** The difference between the local and reference clocks. - **DiskFreeSpaceAfterSedimentPackInMB** The amount of free disk space (in megabytes) after executing the Sediment Pack. - **DiskFreeSpaceBeforeSedimentPackInMB** The amount of free disk space (in megabytes) before executing the Sediment Pack. - **DiskMbFreeAfterCleanup** The amount of free hard disk space after cleanup, measured in Megabytes. @@ -5038,6 +5927,7 @@ The following fields are available: - **QualityUpdateSedimentMatchedTriggers** The list of triggers that were matched by the Windows Quality Update remediation. - **QualityUpdateSedimentModelExecutionSeconds** The number of seconds needed to execute the Windows Quality Update remediation. - **recoveredFromTargetOS** Indicates whether the device recovered from the target operating system (OS). +- **RemediationAutoUASpaceSaved** Amount of disk space saved in MB after cleaning up AutoUA folders. - **RemediationBatteryPowerBatteryLevel** Indicates the battery level at which it is acceptable to continue operation. - **RemediationBatteryPowerExitDueToLowBattery** True when we exit due to low battery power. - **RemediationBatteryPowerOnBattery** True if we allow execution on battery. @@ -5046,8 +5936,12 @@ The following fields are available: - **RemediationComponentCleanupEstimateInMB** The amount of space (megabytes) in the WinSxS (Windows Side-by-Side) folder that is available for cleanup by the plug-in. - **RemediationConfigurationTroubleshooterIpconfigFix** TRUE if IPConfig Fix completed successfully. - **RemediationConfigurationTroubleshooterNetShFix** TRUE if network card cache reset ran successfully. +- **RemediationCorruptionIsManifestFix** Boolean indicating if the manifest was repaired. - **RemediationCorruptionRepairCorruptionsDetected** Number of corruptions detected on the device. - **RemediationCorruptionRepairCorruptionsFixed** Number of detected corruptions that were fixed on the device. +- **RemediationCorruptionRepairDownloadCompleted** Boolean indicating if the download of manifest cab was completed. +- **RemediationCorruptionRepairDownloadRequired** Boolean indicating if the download of manifest cab is required for repair. +- **RemediationCorruptionRepairMeteredNetwork** Boolean indicating if the device is on a metered network. - **RemediationCorruptionRepairPerformActionSuccessful** Indicates whether corruption repair was successful on the device. - **RemediationDiskCleanupSearchFileSizeInMB** The size of the Cleanup Search index file, measured in megabytes. - **RemediationDiskSpaceSavedByCompressionInMB** The amount of disk space (megabytes) that was compressed by the plug-in. @@ -5096,6 +5990,7 @@ The following fields are available: - **systemDriveFreeDiskSpace** Indicates the free disk space on system drive, in megabytes. - **systemUptimeInHours** Indicates the amount of time the system in hours has been on since the last boot. - **uninstallActive** TRUE if previous uninstall has occurred for current OS +- **UpdateApplicabilityFixedBitMap** Bitmap indicating which fixes were applied by the plugin. - **usoScanDaysSinceLastScan** The number of days since the last USO (Update Session Orchestrator) scan. - **usoScanInProgress** TRUE if a USO (Update Session Orchestrator) scan is in progress, to prevent multiple simultaneous scans. - **usoScanIsAllowAutoUpdateKeyPresent** TRUE if the AllowAutoUpdate registry key is set. @@ -5155,7 +6050,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5193,7 +6088,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5211,7 +6106,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5226,7 +6121,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5239,7 +6134,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5257,7 +6152,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5281,7 +6176,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5302,6 +6197,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -5322,7 +6218,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -5335,7 +6231,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5357,11 +6253,50 @@ The following fields are available: - **WUDeviceID** The unique identifier controlled by the software distribution client. +### SIHEngineTelemetry.ExecuteAction + +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event, whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **RebootRequired** Indicates if a reboot was required to complete the action. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** The SIH version. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** The Windows Update API version. +- **WuaucltVersion** The Windows Update version identifier for SIH. +- **WuauengVersion** The Windows Update engine version identifier. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + +### SIHEngineTelemetry.PostRebootReport + +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event, whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** Version of SIH Client on the device. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** Version of Windows Update DLL on the device. +- **WuaucltVersion** Version of WUAUCLT (Windows Update Auto-Update Client) on the device. +- **WuauengVersion** Version of Windows Update (Auto-Update) engine on the device. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + ## Software update events ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5446,7 +6381,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5477,7 +6412,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5511,6 +6446,7 @@ The following fields are available: - **DeviceModel** The model of the device. - **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority. - **DownloadProps** Information about the download operation properties in the form of a bitmask. +- **DownloadScenarioId** A unique ID for a given download, used to tie together Windows Update and Delivery Optimizer events. - **DownloadType** Differentiates the download type of “Self-Initiated Healing” (SIH) downloads between Metadata and Payload downloads. - **EventInstanceID** A globally unique identifier for event instance. - **EventScenario** Indicates the purpose for sending this event: whether because the software distribution just started downloading content; or whether it was cancelled, succeeded, or failed. @@ -5567,7 +6503,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5589,7 +6525,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5664,6 +6600,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. - **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. - **MsiAction** The stage of MSI installation where it failed. - **MsiProductCode** The unique identifier of the MSI installer. @@ -5693,7 +6630,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5720,6 +6657,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -5738,7 +6676,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5754,7 +6692,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5798,7 +6736,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5813,17 +6751,17 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. -- **EndpointUrl** URL of the endpoint where client obtains update metadata. Used to identify test vs staging vs production environments. +- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. - **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc. - **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. - **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed. - **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. -- **MetadataIntegrityMode** Mode of update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce +- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce - **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID). - **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable. - **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable. @@ -5834,8 +6772,8 @@ The following fields are available: - **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate. - **SHA256OfTimestampToken** An encoded string of the timestamp token. - **SignatureAlgorithm** The hash algorithm for the metadata signature. -- **SLSPrograms** A test program a machine may be opted in. Examples include "Canary" and "Insider Fast". -- **StatusCode** Result code of the event (success, cancellation, failure code HResult) +- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). - **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token. - **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed. - **UpdateId** The update ID for a specific piece of content. @@ -5854,7 +6792,6 @@ The following fields are available: - **UsageMean** The mean of hourly average CPU usage. - **UsageMedian** The median of hourly average CPU usage. - **UsageTwoHourMaxMean** The mean of the maximum of every two hour of hourly average CPU usage. -- **UsageTwoHourMedianMean** The mean of the median of every two hour of hourly average CPU usage. ### Microsoft.Windows.Srum.Sdp.NetworkUsage @@ -5868,7 +6805,6 @@ The following fields are available: - **BytesTotalMean** The mean of the hourly average bytes total. - **BytesTotalMedian** The median of the hourly average bytes total. - **BytesTotalTwoHourMaxMean** The mean of the maximum of every two hours of hourly average bytes total. -- **BytesTotalTwoHourMedianMean** The mean of the median of every two hour of hourly average bytes total. - **LinkSpeed** The adapter link speed. @@ -5876,7 +6812,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5894,7 +6830,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5910,11 +6846,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. +- **DownloadComplete** Indicates if the download is complete. - **DownloadRequests** Number of times a download was retried. - **ErrorCode** The error code returned for the current download request phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. @@ -5945,7 +6883,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5965,7 +6903,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5981,7 +6919,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5999,7 +6937,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6017,7 +6955,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6034,7 +6972,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6060,7 +6998,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6080,7 +7018,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6096,7 +7034,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6114,7 +7052,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6123,30 +7061,35 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **ErrorCode** The error code returned for the current reboot. - **FlightId** Unique ID for the flight (test instance version). +- **IsSuspendable** Indicates whether the update has the ability to be suspended and resumed at the time of reboot. When the machine is rebooted and the update is in middle of Predownload or Install and Setup.exe is running, this field is TRUE, if not its FALSE. - **ObjectId** The unique value for each Update Agent mode. +- **Reason** Indicates the HResult why the machine could not be suspended. If it is successfully suspended, the result is 0. - **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. - **Result** The HResult of the event. - **ScenarioId** The ID of the update scenario. - **SessionId** The ID of the update attempt. - **UpdateId** The ID of the update. +- **UpdateState** Indicates the state of the machine when Suspend is called. For example, Install, Download, Commit. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6160,6 +7103,7 @@ The following fields are available: - **SandboxSize** Size of the sandbox. - **ScenarioId** Indicates the update scenario. - **SessionId** Unique value for each update attempt. +- **SetupLaunchAttemptCount** Indicates the count of attempts to launch setup for the current Update Agent instance. - **SetupMode** Mode of setup to be launched. - **UpdateId** Unique ID for each Update. - **UserSession** Indicates whether install was invoked by user actions. @@ -6167,9 +7111,25 @@ The following fields are available: ## Update notification events +### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat + +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignConfigVersion** Configuration version for the current campaign. +- **CampaignID** Current campaign that is running on Update Notification Pipeline. +- **ConfigCatalogVersion** Current catalog version of Update Notification Pipeline. +- **ContentVersion** Content version for the current campaign on Update Notification Pipeline. +- **CV** Correlation vector. +- **DetectorVersion** Most recently run detector version for the current campaign on Update Notification Pipeline. +- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user. +- **PackageVersion** Current package version for Update Notification Pipeline. + + ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6183,11 +7143,28 @@ The following fields are available: - **PackageVersion** Current UNP package version. +### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed + +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignConfigVersion** Configuration version for the current campaign. +- **CampaignID** Currently campaign that's running on Update Notification Pipeline (UNP). +- **ConfigCatalogVersion** Current catalog version of UNP. +- **ContentVersion** Content version for the current campaign on UNP. +- **CV** Correlation vector. +- **DetectorVersion** Most recently run detector version for the current campaign on UNP. +- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user. +- **hresult** HRESULT of the failure. +- **PackageVersion** Current UNP package version. + + ## Upgrade events ### FacilitatorTelemetry.DCATDownload -This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure. +This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -6202,22 +7179,17 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **DownloadRequestAttributes** The attributes sent for download. - **PackageCategoriesFailed** Lists the categories of packages that failed to download. - **PackageCategoriesSkipped** Lists the categories of package downloads that were skipped. -- **ResultCode** The result of the event execution. -- **Scenario** Identifies the active Download scenario. -- **Url** The URL the download request was sent to. -- **Version** Identifies the version of Facilitator used. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6231,7 +7203,7 @@ The following fields are available: ### Setup360Telemetry.Downlevel -This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure. +This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -6275,7 +7247,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6439,7 +7411,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6464,7 +7436,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6483,7 +7455,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6512,7 +7484,7 @@ The following fields are available: - **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. - **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. - **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. -- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). - **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. @@ -6522,9 +7494,65 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.DetectionsOnlyFailed + +Failed to apply the named diagnostic. + +The following fields are available: + +- **hResult** The error code from attempting the diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + +### Microsoft.Windows.WaaSMedic.RemediationsOnlyFailed + +This event indicates that some plugins failed to complete remediation. This data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **hResult** A resulting error code. +- **versionString** The string for which plugins failed. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6573,6 +7601,18 @@ The following fields are available: - **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise - **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). +### Value + +This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. + +The following fields are available: + +- **Algorithm** The algorithm used to preserve privacy. +- **DPRange** The upper bound of the range being measured. +- **DPValue** The randomized response returned by the client. +- **Epsilon** The level of privacy to be applied. +- **HistType** The histogram type if the algorithm is a histogram algorithm. +- **PertProb** The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”. ## Windows Error Reporting MTT events @@ -6587,28 +7627,8 @@ The following fields are available: - **Value** Standard UTC emitted DP value structure See [Value](#value). -### Value - -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. - -The following fields are available: - -- **Algorithm** The algorithm used to preserve privacy. -- **DPRange** The upper bound of the range being measured. -- **DPValue** The randomized response returned by the client. -- **Epsilon** The level of privacy to be applied. -- **HistType** The histogram type if the algorithm is a histogram algorithm. -- **PertProb** The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”. - - ## Windows Store events -### Microsoft.Windows.Store.StoreActivating - -This event sends tracking data about when the Store app activation via protocol URI is in progress, to help keep Windows up to date. - - - ### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure. @@ -6697,6 +7717,7 @@ The following fields are available: - **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. - **AttemptNumber** The total number of attempts to acquire this product. +- **BundleId** The identity of the test build (flight) associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** HResult code to show the result of the operation (success/failure). @@ -6706,6 +7727,7 @@ The following fields are available: - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this happening after a device restore? - **IsUpdate** Is this an update? +- **ParentBundleId** The product identifier of the parent if this product is part of a bundle. - **PFN** Product Family Name of the product being installed. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The number of attempts by the system to acquire this product. @@ -6991,17 +8013,22 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. +This event sends data when the Windows System Kit is used to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: - **Phase** The image creation phase. Values are “Start” or “End”. +- **Result** Result of the image creation phase. Indicates if the image was created successfully. Value is integer. +- **WorkspaceArchitecture** Architecture of image created. +- **WorkspaceOsEdition** OSEdition of the image created. +- **WskImageEnvironment** Type of environment image was created for "Lab" or "Non-Lab". +- **WskSessionId** A string identifier (GUID) for the workspace. - **WskVersion** The version of the Windows System Kit being used. ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. +This event sends data when the Windows System Kit is used to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7009,29 +8036,55 @@ The following fields are available: - **CustomizationType** Indicates the type of customization (drivers or apps). - **Mode** The mode of update to image configuration files. Values are “New” or “Update”. - **Phase** The image creation phase. Values are “Start” or “End”. +- **Result** Result of the image creation phase. - **Type** The type of update to image configuration files. Values are “Apps” or “Drivers”. +- **WskSessionId** A string identifier (GUID) for the workspace. - **WskVersion** The version of the Windows System Kit being used. ### Microsoft.Windows.Kits.WSK.WskWorkspaceCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. +This event sends data when the Windows System Kit is used to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: - **Architecture** The OS architecture that the workspace will target. Values are one of: “AMD64”, “ARM64”, “x86”, or “ARM”. - **OsEdition** The Operating System Edition that the workspace will target. - **Phase** The image creation phase. Values are “Start” or “End”. +- **Result** Stage result. Values are integers. - **WorkspaceArchitecture** The operating system architecture that the workspace will target. - **WorkspaceOsEdition** The operating system edition that the workspace will target. +- **WskSessionId** A string identifier (GUID) for the workspace. - **WskVersion** The version of the Windows System Kit being used. +## Windows Update CSP events + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted + +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of WUfB connection check. + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7065,7 +8118,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7100,6 +8153,7 @@ The following fields are available: - **groupConnectionCount** The total number of connections made to peers in the same group. - **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group. - **isEncrypted** TRUE if the file is encrypted and will be decrypted after download. +- **isThrottled** Event Rate throttled (event represents aggregated data). - **isVpn** Is the device connected to a Virtual Private Network? - **jobID** Identifier for the Windows Update job. - **lanConnectionCount** The total number of connections made to peers in the same LAN. @@ -7119,7 +8173,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7139,7 +8193,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7175,7 +8229,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7197,7 +8251,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7213,7 +8267,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7237,7 +8291,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7253,7 +8307,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7280,7 +8334,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7298,7 +8352,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7314,7 +8368,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7329,7 +8383,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7355,7 +8409,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7371,7 +8425,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7387,7 +8441,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7403,7 +8457,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7419,7 +8473,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7435,7 +8489,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderToast -This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. +This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7451,7 +8505,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7469,9 +8523,18 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7480,9 +8543,19 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot + +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **isOnAC** The power source for AC or battery power. +- **scanTriggerSource** The source of a triggered scan. + + ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7494,7 +8567,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7504,9 +8577,19 @@ The following fields are available: - **wuDeviceid** Device ID. +### Microsoft.Windows.Update.Orchestrator.CommitFailed + +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code that was returned. +- **wuDeviceid** The Windows Update device GUID. + + ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7525,7 +8608,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7545,9 +8628,42 @@ The following fields are available: - **wuDeviceid** The unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.DetectionActivity + +This event returns data about detected updates, as well as the types of update (optional or recommended). This data helps keep Windows up to date. + +The following fields are available: + +- **applicableUpdateIdList** The list of update identifiers. +- **applicableUpdateList** The list of available updates. +- **durationInSeconds** The amount of time (in seconds) it took for the event to run. +- **expeditedMode** Indicates whether Expedited Mode is on. +- **networkCostPolicy** The network cost. +- **scanTriggerSource** Indicates whether the scan is Interactive or Background. +- **scenario** The result code of the event. +- **scenarioReason** The reason for the result code (scenario). +- **seekerUpdateIdList** The list of “seeker” update identifiers. +- **seekerUpdateList** The list of “seeker” updates. +- **services** The list of services that were called during update. +- **wilActivity** The activity results. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Update.Orchestrator.DetectionResult + +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. + +The following fields are available: + +- **applicableUpdateIdList** A list of applicable update IDs. +- **applicableUpdateList** A list of applicable update names. +- **seekerUpdateIdList** A list of optional update IDs. +- **seekerUpdateList** A list of optional update names. +- **wuDeviceid** The Windows Update device identifier. + + ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7563,7 +8679,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7580,7 +8696,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7589,7 +8705,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7598,7 +8714,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7609,7 +8725,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7626,7 +8742,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7636,7 +8752,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7653,7 +8769,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7670,7 +8786,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7696,7 +8812,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7710,7 +8826,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7720,9 +8836,39 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data when Oobe Update download is in progress, to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An ID associated with an update. +- **updateScenarioType** A type of USO session. +- **wuDeviceid** A device Id associated with Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.PostInstall + +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** Current battery capacity in megawatt-hours (mWh) or percentage left. +- **bundleId** The unique identifier associated with the specific content bundle. +- **bundleRevisionnumber** Identifies the revision number of the content bundle. +- **errorCode** The error code returned for the current phase. +- **eventScenario** State of update action. +- **flightID** The unique identifier for the flight (Windows Insider pre-release build) should be delivered to the device, if applicable. +- **sessionType** The Windows Update session type (Interactive or Background). +- **updateScenarioType** Identifies the type of Update session being performed. +- **wuDeviceid** The unique device identifier used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7731,7 +8877,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7750,7 +8896,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7762,7 +8908,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7774,7 +8920,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7791,9 +8937,35 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable + +This event defines when an optional update is available for the device to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** The unique identifier of the Windows Insider build on this device. +- **isFeatureUpdate** Indicates whether the update is a Feature Update. +- **revisionNumber** The revision number of the update. +- **updateId** The GUID (Globally Unique Identifier) of the update. +- **wuDeviceid** The Windows Update device identifier. + + +### Microsoft.Windows.Update.Orchestrator.SeekUpdate + +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. + +The following fields are available: + +- **flightID** The ID of the Windows Insider builds on the device. +- **isFeatureUpdate** Indicates that the target of the Seek is a feature update. +- **revisionNumber** The revision number of the update. +- **updateId** The identifier of the update. +- **wuDeviceid** The Windows Update device identifier. + + ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7803,7 +8975,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7819,7 +8991,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7831,7 +9003,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7843,7 +9015,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7853,7 +9025,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -7866,7 +9038,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -7881,7 +9053,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7891,7 +9063,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7907,7 +9079,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7929,7 +9101,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7938,7 +9110,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -7958,7 +9130,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7968,7 +9140,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7986,11 +9158,232 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that updates have been blocked requiring intervention. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the required UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the device has completed the reboot after installing expected update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8014,29 +9407,29 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **ClientId** Unique identifier for each flight. +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. - **FlightId** Unique GUID that identifies each instances of setuphost.exe. -- **InstanceId** The update scenario in which the mitigation was executed. -- **MitigationScenario** Correlation vector value generated from the latest USO scan. -- **RelatedCV** Number of reparse points that are corrupted but we failed to fix them. -- **ReparsePointsFailed** Number of reparse points that were corrupted and were fixed by this mitigation. -- **ReparsePointsFixed** Number of reparse points that are not corrupted and no action is required. -- **ReparsePointsSkipped** HResult of this operation. -- **Result** ID indicating the mitigation scenario. -- **ScenarioId** Indicates whether the scenario was supported. -- **ScenarioSupported** Unique value for each update attempt. -- **SessionId** Unique ID for each Update. -- **UpdateId** Unique ID for the Windows Update client. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ReparsePointsFailed** Number of reparse points that were corrupted but were not fixed by this mitigation. +- **ReparsePointsFixed** Number of reparse points that were corrupted and were fixed by this mitigation. +- **ReparsePointsSkipped** Number of reparse points that are not corrupted and no action is required. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **SessionId** Unique ID for the update session. +- **UpdateId** Unique ID for the Windows Update. - **WuId** Unique ID for the Windows Update client. ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8057,11 +9450,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8071,7 +9485,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8084,7 +9498,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8099,22 +9513,23 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **FallbackLogicUsed** Indicates whether fallback logic was used for initialization. - **Flags** The flags that are passed to the function to prepare the Trusted Installer for reserve initialization. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 54f9081648..1623bf2d24 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -1,6 +1,6 @@ --- -description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. -title: Windows 10, version 1903 basic diagnostic events and fields (Windows 10) +description: Use this article to learn more about what required Windows diagnostic data is gathered. +title: Windows 10, version 1909 and Windows 10, version 1903 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 ms.mktglfcycl: manage @@ -13,26 +13,32 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/23/2019 +ms.date: 09/30/2020 --- -# Windows 10, version 1903 basic level Windows diagnostic events and fields +# Windows 10, version 1909 and Windows 10, version 1903 required Windows diagnostic events and fields + + +> [!IMPORTANT] +> Windows is moving to classifying the data collected from customer’s devices as either *Required* or *Optional*. + **Applies to** +- Windows 10, version 1909 - Windows 10, version 1903 -The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. +Required diagnostic data gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. -The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. +Required diagnostic data helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -41,11 +47,13 @@ You can learn more about Windows functional and diagnostic data through these ar - [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) + + ## AppLocker events ### Microsoft.Windows.Security.AppLockerCSP.AddParams -Parameters passed to Add function of the AppLockerCSP Node. +This event indicates the parameters passed to the Add function of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -55,13 +63,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.AddStart -Start of "Add" Operation for the AppLockerCSP Node. +This event indicates the start of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.AddStop -End of "Add" Operation for AppLockerCSP Node. +This event indicates the end of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -70,7 +78,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.CAppLockerCSP::Commit -This event returns information about the “Commit” operation in AppLockerCSP. +This event returns information about the Commit operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.. The following fields are available: @@ -80,7 +88,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.CAppLockerCSP::Rollback -Result of the 'Rollback' operation in AppLockerCSP. +This event provides the result of the Rollback operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -90,7 +98,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.ClearParams -Parameters passed to the "Clear" operation for AppLockerCSP. +This event provides the parameters passed to the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -99,40 +107,22 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.ClearStart -Start of the "Clear" operation for the AppLockerCSP Node. +This event indicates the start of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.ClearStop -End of the "Clear" operation for the AppLockerCSP node. +This event indicates the end of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: - **hr** HRESULT reported at the end of the 'Clear' function. -### Microsoft.Windows.Security.AppLockerCSP.ConfigManagerNotificationStart - -Start of the "ConfigManagerNotification" operation for AppLockerCSP. - -The following fields are available: - -- **NotifyState** State sent by ConfigManager to AppLockerCSP. - - -### Microsoft.Windows.Security.AppLockerCSP.ConfigManagerNotificationStop - -End of the "ConfigManagerNotification" operation for AppLockerCSP. - -The following fields are available: - -- **hr** HRESULT returned by the ConfigManagerNotification function in AppLockerCSP. - - ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceParams -Parameters passed to the CreateNodeInstance function of the AppLockerCSP node. +This event provides the parameters that were passed to the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -143,13 +133,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStart -Start of the "CreateNodeInstance" operation for the AppLockerCSP node. +This event indicates the start of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStop -End of the "CreateNodeInstance" operation for the AppLockerCSP node +This event indicates the end of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -158,7 +148,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildParams -Parameters passed to the DeleteChild function of the AppLockerCSP node. +This event provides the parameters passed to the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -168,13 +158,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStart -Start of the "DeleteChild" operation for the AppLockerCSP node. +This event indicates the start of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStop -End of the "DeleteChild" operation for the AppLockerCSP node. +This event indicates the end of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -183,7 +173,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.EnumPolicies -Logged URI relative to %SYSTEM32%\AppLocker, if the Plugin GUID is null, or the CSP doesn't believe the old policy is present. +This event provides the logged Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker if the plug-in GUID is null or the Configuration Service Provider (CSP) doesn't believe the old policy is present. The following fields are available: @@ -192,7 +182,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesParams -Parameters passed to the GetChildNodeNames function of the AppLockerCSP node. +This event provides the parameters passed to the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -201,13 +191,13 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStart -Start of the "GetChildNodeNames" operation for the AppLockerCSP node. +This event indicates the start of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStop -End of the "GetChildNodeNames" operation for the AppLockerCSP node. +This event indicates the end of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -218,7 +208,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.GetLatestId -The result of 'GetLatestId' in AppLockerCSP (the latest time stamped GUID). +This event provides the latest time-stamped unique identifier in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -228,7 +218,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.HResultException -HRESULT thrown by any arbitrary function in AppLockerCSP. +This event provides the result code (HRESULT) generated by any arbitrary function in the AppLocker Configuration Service Provider (CSP). The following fields are available: @@ -238,26 +228,9 @@ The following fields are available: - **line** Line in the file in the OS code base in which the exception occurs. -### Microsoft.Windows.Security.AppLockerCSP.IsDependencySatisfiedStart - -Indicates the start of a call to the IsDependencySatisfied function in the Configuration Service Provider (CSP). - - - -### Microsoft.Windows.Security.AppLockerCSP.IsDependencySatisfiedStop - -Indicates the end of an IsDependencySatisfied function call in the Configuration Service Provider (CSP). - -The following fields are available: - -- **edpActive** Indicates whether enterprise data protection is active. -- **hr** HRESULT that is reported. -- **internalHr** Internal HRESULT that is reported. - - ### Microsoft.Windows.Security.AppLockerCSP.SetValueParams -Parameters passed to the SetValue function of the AppLockerCSP node. +This event provides the parameters that were passed to the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. The following fields are available: @@ -267,7 +240,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.SetValueStart -Start of the "SetValue" operation for the AppLockerCSP node. +This event indicates the start of the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. @@ -282,7 +255,7 @@ The following fields are available: ### Microsoft.Windows.Security.AppLockerCSP.TryRemediateMissingPolicies -EntryPoint of fix step or policy remediation, includes URI relative to %SYSTEM32%\AppLocker that needs to be fixed. +This event provides information for fixing a policy in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. It includes Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker that needs to be fixed. The following fields are available: @@ -293,136 +266,242 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **DatasourceApplicationFile_19A** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_19H1** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_21H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers. +- **DatasourceApplicationFile_RS2** An ID for the system, calculated by hashing hardware identifiers. +- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_RS4** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_TH1** The count of the number of this particular object type present on this device. - **DatasourceApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19A** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_19H1** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_21H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. +- **DatasourceDevicePnp_RS2** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS3Setup** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_RS4** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_TH1** The count of the number of this particular object type present on this device. - **DatasourceDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19A** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_19H1** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_21H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. +- **DatasourceDriverPackage_RS2** The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device. +- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS3Setup** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_TH1** The count of the number of this particular object type present on this device. - **DatasourceDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19A** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19ASetup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_21H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_21H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoBlock_RS2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS5Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19A** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19ASetup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_21H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_21H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoPassive_RS2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS5Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19A** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19ASetup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1Setup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. - **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS5Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19A** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_19ASetup** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_19H1** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_21H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. +- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device. +- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. +- **DatasourceSystemBios_RS3Setup** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS4Setup** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_TH1** The count of the number of this particular object type present on this device. - **DatasourceSystemBios_TH2** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19A** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19ASetup** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_19H1** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_21H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS2** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_TH1** The count of the number of this particular object type present on this device. - **DecisionApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19A** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19ASetup** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_19H1** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_21H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. +- **DecisionDevicePnp_RS2** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS3Setup** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_TH1** The count of the number of this particular object type present on this device. - **DecisionDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19A** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19ASetup** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_19H1** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_21H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. +- **DecisionDriverPackage_RS2** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS3Setup** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_TH1** The count of the number of this particular object type present on this device. - **DecisionDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19A** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_21H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. +- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device. +- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. - **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19A** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_21H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. +- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device. +- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. - **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19A** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. +- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. - **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19A** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19ASetup** The count of the number of this particular object type present on this device. - **DecisionMediaCenter_19H1** The count of the number of this particular object type present on this device. - **DecisionMediaCenter_19H1Setup** The total DecisionMediaCenter objects targeting the next release of Windows on this device. +- **DecisionMediaCenter_20H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_21H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. +- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device. +- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. - **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device. - **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_TH1** The count of the number of this particular object type present on this device. - **DecisionMediaCenter_TH2** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19A** The count of the number of this particular object type present on this device. - **DecisionSystemBios_19ASetup** The count of the number of this particular object type present on this device. - **DecisionSystemBios_19H1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_21H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. +- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device. +- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. +- **DecisionSystemBios_RS3Setup** The count of the number of this particular object type present on this device. - **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device. +- **DecisionSystemBios_RS4Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. - **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device. - **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. +- **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionTest_21H1** The count of the number of this particular object type present on this device. +- **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. - **InventoryApplicationFile** The count of the number of this particular object type present on this device. +- **InventoryDeviceContainer** A count of device container objects in cache. +- **InventoryDevicePnp** A count of device Plug and Play objects in cache. +- **InventoryDriverBinary** A count of driver binary objects in cache. +- **InventoryDriverPackage** A count of device objects in cache. - **InventoryLanguagePack** The count of the number of this particular object type present on this device. - **InventoryMediaCenter** The count of the number of this particular object type present on this device. - **InventorySystemBios** The count of the number of this particular object type present on this device. +- **InventorySystemMachine** The count of the number of this particular object type present on this device. +- **InventorySystemProcessor** The count of the number of this particular object type present on this device. +- **InventoryTest** The count of the number of this particular object type present on this device. - **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. - **PCFP** The count of the number of this particular object type present on this device. - **SystemMemory** The count of the number of this particular object type present on this device. @@ -435,19 +514,24 @@ The following fields are available: - **SystemWim** The total number of objects of this type present on this device. - **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device. - **SystemWlan** The total number of objects of this type present on this device. -- **Wmdrm_19A** The count of the number of this particular object type present on this device. -- **Wmdrm_19ASetup** The count of the number of this particular object type present on this device. - **Wmdrm_19H1** The count of the number of this particular object type present on this device. - **Wmdrm_19H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. +- **Wmdrm_20H1** The count of the number of this particular object type present on this device. +- **Wmdrm_20H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. +- **Wmdrm_21H1** The count of the number of this particular object type present on this device. +- **Wmdrm_21H1Setup** The count of the number of this particular object type present on this device. +- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS2** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. - **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device. - **Wmdrm_RS5** The count of the number of this particular object type present on this device. -- **Wmdrm_RS5Setup** The count of the number of this particular object type present on this device. +- **Wmdrm_TH1** The count of the number of this particular object type present on this device. - **Wmdrm_TH2** The count of the number of this particular object type present on this device. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -459,13 +543,13 @@ The following fields are available: - **HasCitData** Indicates whether the file is present in CIT data. - **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file. - **IsAv** Is the file an anti-virus reporting EXE? -- **ResolveAttempted** This will always be an empty string when sending telemetry. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. - **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -476,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -495,12 +579,7 @@ The following fields are available: - **ActiveNetworkConnection** Indicates whether the device is an active network device. - **AppraiserVersion** The version of the appraiser file generating the events. -- **CosDeviceRating** An enumeration that indicates if there is a driver on the target operating system. -- **CosDeviceSolution** An enumeration that indicates how a driver on the target operating system is available. -- **CosDeviceSolutionUrl** Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd . Empty string -- **CosPopulatedFromId** The expected uplevel driver matching ID based on driver coverage data. - **IsBootCritical** Indicates whether the device boot is critical. -- **UplevelInboxDriver** Indicates whether there is a driver uplevel for this device. - **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update. - **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver. - **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update. @@ -508,7 +587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -519,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -541,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -552,7 +631,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -563,18 +642,30 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd -This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date. +This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -585,7 +676,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd -This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -594,9 +685,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -607,7 +709,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd -This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -616,9 +718,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -629,7 +742,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd -This event sends compatibility database information about the BIOS to help keep Windows up-to-date. +This event sends compatibility database information about the BIOS to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -638,9 +751,20 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove + +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -651,7 +775,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd -This event sends compatibility decision data about a file to help keep Windows up-to-date. +This event sends compatibility decision data about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -666,7 +790,7 @@ The following fields are available: - **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? - **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? - **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade? -- **NeedsDismissAction** Will the file cause an action that can be dimissed? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? - **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app. - **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade? - **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app. @@ -681,7 +805,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -692,7 +816,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -703,7 +827,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd -This event sends compatibility decision data about a PNP device to help keep Windows up to date. +This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -730,7 +854,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -741,7 +865,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -763,14 +887,13 @@ The following fields are available: - **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? - **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? - **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? -- **DriverIsTroubleshooterBlocked** Indicates whether the driver package is blocked because of a troubleshooter block. - **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? - **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -781,7 +904,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -801,15 +924,28 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. - **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks? - **DisplayGenericMessage** Will a generic message be shown for this block? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? - **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block? - **SdbBlockUpgrade** Is a matching info block blocking upgrade? - **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag? - **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag? +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -834,7 +970,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -858,9 +994,20 @@ The following fields are available: - **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -886,9 +1033,20 @@ The following fields are available: - **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove + +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -911,9 +1069,9 @@ The following fields are available: - **HasBiosBlock** Does the device have a BIOS block? -### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -922,6 +1080,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionTestAdd + +This event provides diagnostic data for testing decision add events. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser binary generating the events. +- **TestDecisionDataPoint1** Test data point 1. +- **TestDecisionDataPoint2** Test data point 2. + + ### Microsoft.Windows.Appraiser.General.DecisionTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -960,7 +1142,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -989,7 +1171,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1000,7 +1182,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1024,7 +1206,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1035,7 +1217,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1064,7 +1246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1075,7 +1257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1086,7 +1268,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1099,9 +1281,9 @@ The following fields are available: - **Model** The model field from Win32_ComputerSystem. -### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync +### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1110,6 +1292,52 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync + +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. + + +### Microsoft.Windows.Appraiser.General.InventorySystemProcessorEndSync + +This event indicates that a full set of InventorySystemProcessorAdd events has been sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. + + +### Microsoft.Windows.Appraiser.General.InventorySystemProcessorStartSync + +This event indicates that a new set of InventorySystemProcessorAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryTestAdd + +This event provides diagnostic data for testing event adds. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the component sending the data. +- **TestInvDataPoint1** Test inventory data point 1. +- **TestInvDataPoint2** Test inventory data point 2. + + ### Microsoft.Windows.Appraiser.General.InventoryTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1134,7 +1362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1159,7 +1387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1170,7 +1398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1181,7 +1409,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1197,7 +1425,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd -This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date. +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1213,9 +1441,20 @@ The following fields are available: - **virtualKB** The amount of virtual memory (in KB). +### Microsoft.Windows.Appraiser.General.SystemMemoryRemove + +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1237,9 +1476,20 @@ The following fields are available: - **CompareExchange128Support** Does the CPU support CompareExchange128? +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove + +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1250,7 +1500,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd -This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1261,9 +1511,20 @@ The following fields are available: - **LahfSahfSupport** Does the CPU support LAHF/SAHF? +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove + +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1274,7 +1535,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd -This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date. +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1286,9 +1547,20 @@ The following fields are available: - **NXProcessorSupport** Does the processor support NX? +### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove + +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1310,9 +1582,20 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove + +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1334,9 +1617,20 @@ The following fields are available: - **SSE2ProcessorSupport** Does the processor support SSE2? +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove + +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1358,9 +1652,20 @@ The following fields are available: - **MaximumTouches** The maximum number of touch points supported by the device hardware. +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1382,9 +1687,20 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. +### Microsoft.Windows.Appraiser.General.SystemWimRemove + +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1406,9 +1722,20 @@ The following fields are available: - **WindowsNotActivatedDecision** Is the current operating system activated? +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove + +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1419,7 +1746,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanAdd -This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date. +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1434,9 +1761,20 @@ The following fields are available: - **WlanNativeDriver** Does the device have a non-emulated WLAN driver? +### Microsoft.Windows.Appraiser.General.SystemWlanRemove + +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1447,18 +1785,20 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth -This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. +This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. The following fields are available: - **AppraiserBranch** The source branch in which the version of Appraiser that is running was built. -- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run. +- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run. - **AppraiserProcess** The name of the process that launched Appraiser. - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **CountCustomSdbs** The number of custom Sdbs used by Appraiser. +- **CustomSdbGuids** Guids of the custom Sdbs used by Appraiser; Semicolon delimited list. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. -- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. - **InboxDataVersion** The original version of the data files before retrieving any newer version. - **IndicatorsWritten** Indicates if all relevant UEX indicators were successfully written or updated. @@ -1467,15 +1807,15 @@ The following fields are available: - **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. - **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. - **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. -- **RunDate** The date that the telemetry run was stated, expressed as a filetime. -- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic. +- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. - **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. -- **RunResult** The hresult of the Appraiser telemetry run. +- **RunResult** The hresult of the Appraiser diagnostic data run. - **ScheduledUploadDay** The day scheduled for the upload. -- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run. +- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. - **StoreHandleIsNotNull** Obsolete, always set to false -- **TelementrySent** Indicates if telemetry was successfully sent. -- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability. +- **TelementrySent** Indicates whether diagnostic data was successfully sent. +- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability. - **Time** The client time of the event. - **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. - **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. @@ -1500,9 +1840,20 @@ The following fields are available: - **WmdrmPurchased** Indicates if the system has any files with permanent licenses. +### Microsoft.Windows.Appraiser.General.WmdrmRemove + +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1515,7 +1866,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1533,7 +1884,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1547,7 +1898,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1583,7 +1934,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1601,7 +1952,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1612,7 +1963,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1623,19 +1974,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1653,6 +1994,7 @@ The following fields are available: - **IsDomainJoined** Indicates whether a machine is joined to a domain. - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. +- **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID - **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. @@ -1661,7 +2003,7 @@ The following fields are available: ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1673,7 +2015,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1689,7 +2031,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1697,10 +2039,12 @@ The following fields are available: - **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36. - **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields. - **D3DMaxFeatureLevel** Supported Direct3D version. +- **DeviceColor** Indicates a color of the device. - **DeviceForm** Indicates the form as per the device classification. - **DeviceName** The device name that is set by the user. - **DigitizerSupport** Is a digitizer supported? - **DUID** The device unique ID. +- **EnclosureKind** Windows.Devices.Enclosure.EnclosureKind enum values representing each unique enclosure posture kind. - **Gyroscope** Indicates whether the device has a gyroscope (a mechanical component that measures and maintains orientation). - **InventoryId** The device ID used for compatibility testing. - **Magnetometer** Indicates whether the device has a magnetometer (a mechanical component that works like a compass). @@ -1731,7 +2075,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1741,7 +2085,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1764,7 +2108,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1806,7 +2150,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1816,18 +2160,14 @@ The following fields are available: - **AdvertisingId** Current state of the advertising ID setting. - **AppDiagnostics** Current state of the app diagnostics setting. - **Appointments** Current state of the calendar setting. -- **AppointmentsSystem** Current state of the calendar setting. - **Bluetooth** Current state of the Bluetooth capability setting. - **BluetoothSync** Current state of the Bluetooth sync capability setting. - **BroadFileSystemAccess** Current state of the broad file system access setting. - **CellularData** Current state of the cellular data capability setting. - **Chat** Current state of the chat setting. -- **ChatSystem** Current state of the chat setting. - **Contacts** Current state of the contacts setting. -- **ContactsSystem** Current state of the Contacts setting. - **DocumentsLibrary** Current state of the documents library setting. - **Email** Current state of the email setting. -- **EmailSystem** Current state of the email setting. - **FindMyDevice** Current state of the "find my device" setting. - **GazeInput** Current state of the gaze input setting. - **HumanInterfaceDevice** Current state of the human interface device setting. @@ -1839,7 +2179,6 @@ The following fields are available: - **Microphone** Current state of the microphone setting. - **PhoneCall** Current state of the phone call setting. - **PhoneCallHistory** Current state of the call history setting. -- **PhoneCallHistorySystem** Current state of the call history setting. - **PicturesLibrary** Current state of the pictures library setting. - **Radios** Current state of the radios setting. - **SensorsCustom** Current state of the custom sensor setting. @@ -1849,7 +2188,6 @@ The following fields are available: - **USB** Current state of the USB setting. - **UserAccountInformation** Current state of the account information setting. - **UserDataTasks** Current state of the tasks setting. -- **UserDataTasksSystem** Current state of the tasks setting. - **UserNotificationListener** Current state of the notifications setting. - **VideosLibrary** Current state of the videos library setting. - **Webcam** Current state of the camera setting. @@ -1858,7 +2196,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1881,7 +2219,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1891,15 +2229,20 @@ The following fields are available: - **HVCIRunning** Hypervisor Code Integrity (HVCI) enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s functionality to force all software running in kernel mode to safely allocate memory. This field tells if HVCI is running. - **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest. - **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host. +- **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. - **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. - **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. +- **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. - **SModeState** The Windows S mode trail state. +- **SystemGuardState** Indicates the SystemGuard state. NotCapable (0), Capable (1), Enabled (2), Error (0xFF). +- **TpmReadyState** Indicates the TPM ready state. NotReady (0), ReadyForStorage (1), ReadyForAttestation (2), Error (0xFF). - **VBSState** Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation. VBS has a tri-state that can be Disabled, Enabled, or Running. +- **WdagPolicyValue** The Windows Defender Application Guard policy. ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1918,7 +2261,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1930,20 +2273,21 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **CalendarType** The calendar identifiers that are used to specify different calendars. - **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. - **DefaultBrowserProgId** The ProgramId of the current user's default browser. +- **LocaleName** Name of the current user locale given by LOCALE_SNAME via the GetLocaleInfoEx() function. - **LongDateFormat** The long date format the user has selected. - **ShortDateFormat** The short date format the user has selected. ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1964,7 +2308,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1977,7 +2321,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1987,18 +2331,14 @@ The following fields are available: - **AdvertisingId** Current state of the advertising ID setting. - **AppDiagnostics** Current state of the app diagnostics setting. - **Appointments** Current state of the calendar setting. -- **AppointmentsSystem** Current state of the calendar setting. - **Bluetooth** Current state of the Bluetooth capability setting. - **BluetoothSync** Current state of the Bluetooth sync capability setting. - **BroadFileSystemAccess** Current state of the broad file system access setting. - **CellularData** Current state of the cellular data capability setting. - **Chat** Current state of the chat setting. -- **ChatSystem** Current state of the chat setting. - **Contacts** Current state of the contacts setting. -- **ContactsSystem** Current state of the Contacts setting. - **DocumentsLibrary** Current state of the documents library setting. - **Email** Current state of the email setting. -- **EmailSystem** Current state of the email setting. - **GazeInput** Current state of the gaze input setting. - **HumanInterfaceDevice** Current state of the human interface device setting. - **InkTypeImprovement** Current state of the improve inking and typing setting. @@ -2010,7 +2350,6 @@ The following fields are available: - **Microphone** Current state of the microphone setting. - **PhoneCall** Current state of the phone call setting. - **PhoneCallHistory** Current state of the call history setting. -- **PhoneCallHistorySystem** Current state of the call history setting. - **PicturesLibrary** Current state of the pictures library setting. - **Radios** Current state of the radios setting. - **SensorsCustom** Current state of the custom sensor setting. @@ -2020,7 +2359,6 @@ The following fields are available: - **USB** Current state of the USB setting. - **UserAccountInformation** Current state of the account information setting. - **UserDataTasks** Current state of the tasks setting. -- **UserDataTasksSystem** Current state of the tasks setting. - **UserNotificationListener** Current state of the notifications setting. - **VideosLibrary** Current state of the videos library setting. - **Webcam** Current state of the camera setting. @@ -2029,7 +2367,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2038,13 +2376,16 @@ The following fields are available: - **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. - **IsVDI** Is the device using Virtual Desktop Infrastructure? - **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **IsWVDSessionHost** Indicates if this is a Windows Virtual Device session host. - **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. - **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. +- **VMId** A string that identifies a virtual machine. +- **WVDEnvironment** Represents the WVD service environment to which this session host has been joined. ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2053,6 +2394,7 @@ The following fields are available: - **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured - **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting - **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **IsHotPatchEnrolled** Represents the current state of the device in relation to enrollment in the hotpatch program. - **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? - **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? - **OSAssessmentForQualityUpdate** Is the device on the latest quality update? @@ -2069,6 +2411,7 @@ The following fields are available: - **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates. - **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades. - **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **WULCUVersion** Version of the LCU Installed on the machine. - **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. - **WUPauseState** Retrieves WU setting to determine if updates are paused. - **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). @@ -2206,6 +2549,7 @@ The following fields are available: - **providerGuid** The ETW provider ID associated with the provider name. - **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW. - **seq** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier. - **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. - **wcmp** The Windows Shell Composer ID. - **wPId** The Windows Core OS product ID. @@ -2255,7 +2599,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -2277,7 +2621,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2307,6 +2651,38 @@ The following fields are available: - **pendingDecision** Indicates the cause of reboot, if applicable. +### CbsServicingProvider.CbsLateAcquisition + +This event sends data to indicate if some Operating System packages could not be updated as part of an upgrade, to help keep Windows up to date. + +The following fields are available: + +- **Features** The list of feature packages that could not be updated. +- **RetryID** The ID identifying the retry attempt to update the listed packages. + + +### CbsServicingProvider.CbsPackageRemoval + +This event provides information about the results of uninstalling a Windows Cumulative Security Update to help keep Windows up to date. + +The following fields are available: + +- **buildVersion** The build number of the security update being uninstalled. +- **clientId** The name of the application requesting the uninstall. +- **currentStateEnd** The final state of the update after the operation. +- **failureDetails** Information about the cause of a failure, if applicable. +- **failureSourceEnd** The stage during the uninstall where the failure occurred. +- **hrStatusEnd** The overall exit code of the operation. +- **initiatedOffline** Indicates if the uninstall was initiated for a mounted Windows image. +- **majorVersion** The major version number of the security update being uninstalled. +- **minorVersion** The minor version number of the security update being uninstalled. +- **originalState** The starting state of the update before the operation. +- **pendingDecision** Indicates the cause of reboot, if applicable. +- **primitiveExecutionContext** The state during system startup when the uninstall was completed. +- **revisionVersion** The revision number of the security update being uninstalled. +- **transactionCanceled** Indicates whether the uninstall was cancelled. + + ### CbsServicingProvider.CbsQualityUpdateInstall This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date. @@ -2378,11 +2754,17 @@ The following fields are available: - **updateTargetState** A value indicating the desired state of the optional content. +### CbsServicingProvider.CbsUpdateDeferred + +This event reports the results of deferring Windows Content to keep Windows up to date. + + + ## Diagnostic data events ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2426,7 +2808,6 @@ The following fields are available: - **PowerButtonPressIsShutdownInProgress** Indicates whether a system shutdown was in progress at the last time the power button was pressed. - **PowerButtonPressLastPowerWatchdogStage** Progress while the monitor is being turned on. - **PowerButtonPressPowerWatchdogArmed** Indicates whether or not the watchdog for the monitor was active at the time of the last power button press. -- **RegKeyLastShutdownBootId** The last recorded boot ID. - **ShutdownDeviceType** Identifies who triggered a shutdown. Is it because of battery, thermal zones, or through a Kernel API. - **SleepCheckpoint** Provides the last checkpoint when there is a failure during a sleep transition. - **SleepCheckpointSource** Indicates whether the source is the EFI variable or bootstat file. @@ -2454,7 +2835,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2472,7 +2853,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2483,7 +2864,6 @@ The following fields are available: - **CanCollectOsTelemetry** True if we can collect diagnostic data telemetry, false otherwise. - **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. - **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. -- **CanPerformTraceEscalations** True if we can perform trace escalation collection, false otherwise. - **CanReportScenarios** True if we can report scenario completions, false otherwise. - **PreviousPermissions** Bitmask of previous telemetry state. - **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. @@ -2491,15 +2871,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -2527,8 +2907,6 @@ This event occurs when the DiagTrack escalation fails due to the scenario reques The following fields are available: - **FilePath** The unexpanded path in the scenario XML. -- **FilePathExpanded** The file path, with environment variables expanded. -- **FilePathExpandedScenario** The file path, with property identifiers and environment variables expanded. - **ScenarioId** The globally unique identifier (GUID) of the scenario. - **ScenarioInstanceId** The error code denoting which path failed (internal or external). @@ -2612,7 +2990,7 @@ The following fields are available: ### TelClientSynthetic.HeartBeat_DevHealthMon_5 -This event sends data (for Surface Hub devices) to monitor and ensure the correct functioning of those Surface Hub devices. This data helps ensure the device is up-to-date with the latest security and safety features. +This event sends data (for Surface Hub devices) to monitor and ensure the correct functioning of those Surface Hub devices. This data helps ensure the device is up to date with the latest security and safety features. The following fields are available: @@ -2721,11 +3099,110 @@ This event is a low latency health alert that is part of the 4Nines device healt +## Direct to update events + +### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run +- **ClientID** Client ID being run +- **CoordinatorVersion** Coordinator version of DTU +- **CV** Correlation vector +- **CV_new** New correlation vector +- **hResult** HRESULT of the failure + + +## DISM events + +### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU + +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismInstalledLCUPackageName** The name of the latest installed package. + + +### Microsoft.Windows.StartRepairCore.DISMPendingInstall + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.DISMUninstallLCU + +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd + +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **flightIds** The Flight IDs (identifier of the beta release) of found driver updates. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart + +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + ## Driver installation events ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2735,6 +3212,7 @@ The following fields are available: - **CoInstallers** The list of coinstallers. - **ConfigFlags** The device configuration flags. - **DeviceConfigured** Indicates whether this device was configured through the kernel configuration. +- **DeviceInstalled** Indicates whether the legacy install code path was used. - **DeviceInstanceId** The unique identifier of the device in the system. - **DeviceStack** The device stack of the driver being installed. - **DriverDate** The date of the driver. @@ -2759,6 +3237,7 @@ The following fields are available: - **Inbox** Indicates whether the driver package is included with Windows. - **InstallDate** The date the driver was installed. - **LastCompatibleId** The ID in the hardware ID list that provides the least specific device description. +- **LastInstallFunction** The last install function invoked in a co-installer if the install timeout was reached while a co-installer was executing. - **LegacyInstallReasonError** The error code for the legacy installation. - **LowerFilters** The list of lower filter drivers. - **MatchingDeviceId** The hardware ID or compatible ID that Windows used to install the device instance. @@ -2768,8 +3247,10 @@ The following fields are available: - **PendedUntilReboot** Indicates whether the installation is pending until the device is rebooted. - **Problem** Error code returned by the device after installation. - **ProblemStatus** The status of the device after the driver installation. +- **RebootRequiredReason** DWORD (Double Word—32-bit unsigned integer) containing the reason why the device required a reboot during install. - **SecondaryDevice** Indicates whether the device is a secondary device. - **ServiceName** The service name of the driver. +- **SessionGuid** GUID (Globally Unique IDentifier) for the update session. - **SetupMode** Indicates whether the driver installation took place before the Out Of Box Experience (OOBE) was completed. - **StartTime** The time when the installation started. - **SubmissionId** The driver submission identifier assigned by the Windows Hardware Development Center. @@ -2778,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2788,6 +3269,7 @@ The following fields are available: - **FlightId** The ID of the Windows Insider build the device received. - **InstallDate** The date the driver was installed. - **InstallFlags** The driver installation flags. +- **OptionalData** Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.) - **RebootRequired** Indicates whether a reboot is required after the installation. - **RollbackPossible** Indicates whether this driver can be rolled back. - **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update. @@ -2796,7 +3278,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2831,10 +3313,12 @@ The following fields are available: - **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. - **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). - **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). +- **Display1UMDFilePath** The file path to the location of the Display User Mode Driver in the Driver Store. - **DisplayAdapterLuid** The display adapter LUID. - **DriverDate** The date of the display driver. - **DriverRank** The rank of the display driver. - **DriverVersion** The display driver version. +- **DriverWorkarounds** Numeric value indicating the driver workarounds that are enabled for this device. - **DX10UMDFilePath** The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store. - **DX11UMDFilePath** The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store. - **DX12UMDFilePath** The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. @@ -2845,6 +3329,7 @@ The following fields are available: - **GPUVendorID** The GPU vendor ID. - **InterfaceId** The GPU interface ID. - **IsDisplayDevice** Does the GPU have displaying capabilities? +- **IsHwSchEnabled** Boolean value indicating whether hardware scheduling is enabled. - **IsHwSchSupported** Indicates whether the adapter supports hardware scheduling. - **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device? - **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device? @@ -2976,6 +3461,24 @@ The following fields are available: - **TargetAsId** The sequence number for the hanging process. +## Feature update events + +### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed + +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **failureReason** Provides data about the uninstall initialization operation failure. +- **hr** Provides the Win32 error code for the operation failure. + + +### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered + +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. + + + ## Hang Reporting events ### Microsoft.Windows.HangReporting.AppHangEvent @@ -3004,11 +3507,84 @@ The following fields are available: - **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package. +## Holographic events + +### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated + +This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **HmdState** Windows Mixed Reality Headset HMD state. +- **NewHoloShellState** Windows Mixed Reality HoloShell state. +- **PriorHoloShellState** Windows Mixed Reality state prior to entering to HoloShell. +- **SimulationEnabled** Windows Mixed Reality Simulation state. + + +### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated + +This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **IsDemoMode** Windows Mixed Reality Portal app state of demo mode. +- **IsDeviceSetupComplete** Windows Mixed Reality Portal app state of device setup completion. +- **PackageVersion** Windows Mixed Reality Portal app package version. +- **PreviousExecutionState** Windows Mixed Reality Portal app prior execution state. +- **wilActivity** Windows Mixed Reality Portal app wilActivity ID. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming + +This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + + + +### TraceLoggingOasisUsbHostApiProvider.DeviceInformation + +This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BootloaderMajorVer** Windows Mixed Reality device boot loader major version. +- **BootloaderMinorVer** Windows Mixed Reality device boot loader minor version. +- **BootloaderRevisionNumber** Windows Mixed Reality device boot loader revision number. +- **BTHFWMajorVer** Windows Mixed Reality device BTHFW major version. This event also used to count WMR device. +- **BTHFWMinorVer** Windows Mixed Reality device BTHFW minor version. This event also used to count WMR device. +- **BTHFWRevisionNumber** Windows Mixed Reality device BTHFW revision number. +- **CalibrationBlobSize** Windows Mixed Reality device calibration blob size. +- **CalibrationFwMajorVer** Windows Mixed Reality device calibration firmware major version. +- **CalibrationFwMinorVer** Windows Mixed Reality device calibration firmware minor version. +- **CalibrationFwRevNum** Windows Mixed Reality device calibration firmware revision number. +- **DeviceInfoFlags** Windows Mixed Reality device info flags. +- **DeviceName** Windows Mixed Reality device Name. This event is also used to count WMR device. +- **DeviceReleaseNumber** Windows Mixed Reality device release number. +- **FirmwareMajorVer** Windows Mixed Reality device firmware major version. +- **FirmwareMinorVer** Windows Mixed Reality device firmware minor version. +- **FirmwareRevisionNumber** Windows Mixed Reality device calibration firmware revision number. +- **FpgaFwMajorVer** Windows Mixed Reality device FPGA firmware major version. +- **FpgaFwMinorVer** Windows Mixed Reality device FPGA firmware minor version. +- **FpgaFwRevisionNumber** Windows Mixed Reality device FPGA firmware revision number. +- **FriendlyName** Windows Mixed Reality device friendly name. +- **HashedSerialNumber** Windows Mixed Reality device hashed serial number. +- **HeaderSize** Windows Mixed Reality device header size. +- **HeaderVersion** Windows Mixed Reality device header version. +- **LicenseKey** Windows Mixed Reality device header license key. +- **Make** Windows Mixed Reality device make. +- **ManufacturingDate** Windows Mixed Reality device manufacturing date. +- **Model** Windows Mixed Reality device model. +- **PresenceSensorHidVendorPage** Windows Mixed Reality device presence sensor HID vendor page. +- **PresenceSensorHidVendorUsage** Windows Mixed Reality device presence sensor HID vendor usage. +- **PresenceSensorUsbVid** Windows Mixed Reality device presence sensor USB VId. +- **ProductBoardRevision** Windows Mixed Reality device product board revision number. +- **SerialNumber** Windows Mixed Reality device serial number. + + ## Inventory events ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3049,7 +3625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3059,7 +3635,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3077,7 +3653,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3090,6 +3666,7 @@ The following fields are available: - **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. +- **MsiInstallDate** The install date recorded in the program's MSI package. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. - **MsiProductCode** A GUID that describe the MSI Product. - **Name** The name of the application. @@ -3106,7 +3683,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3118,7 +3695,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3155,7 +3732,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3168,7 +3745,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3179,7 +3756,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3190,9 +3767,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange) The following fields are available: @@ -3201,7 +3778,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3225,7 +3802,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3236,7 +3813,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3247,7 +3824,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3277,7 +3854,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3288,7 +3865,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3303,7 +3880,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3314,7 +3891,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3325,7 +3902,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd -This event represents the basic metadata about a plug and play (PNP) device and its associated driver. +This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3370,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3381,7 +3958,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3392,7 +3969,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3405,7 +3982,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3416,7 +3993,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3443,7 +4020,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3454,7 +4031,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3465,7 +4042,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3476,16 +4053,18 @@ The following fields are available: - **Date** The driver package date. - **Directory** The path to the driver package. - **DriverInBox** Is the driver included with the operating system? +- **FlightIds** Driver Flight IDs. - **Inf** The INF name of the driver package. - **InventoryVersion** The version of the inventory file generating the events. - **Provider** The provider for the driver package. +- **RecoveryIds** Driver recovery IDs. - **SubmissionId** The HLK submission ID for the driver package. - **Version** The version of the driver package. ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3496,7 +4075,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3509,17 +4088,68 @@ The following fields are available: This event collects traces of all other Core events, not used in typical customer scenarios. This event signals the beginning of the event download, and that tracing should begin. +The following fields are available: + +- **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. ### Microsoft.Windows.Inventory.Core.StopUtcJsonTrace This event collects traces of all other Core events, not used in typical customer scenarios. This event signals the end of the event download, and that tracing should end. +The following fields are available: + +- **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. + + +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration according to the DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3537,6 +4167,7 @@ The following fields are available: - **FullPath** The full path to the Microsoft Office add-in. - **InventoryVersion** The version of the inventory binary generating the events. - **LoadBehavior** Integer that describes the load behavior. +- **LoadTime** Load time for the Office add-in. - **OfficeApplication** The Microsoft Office application associated with the add-in. - **OfficeArchitecture** The architecture of the add-in. - **OfficeVersion** The Microsoft Office version for this add-in. @@ -3546,11 +4177,12 @@ The following fields are available: - **ProductVersion** The version associated with the Office add-in. - **ProgramId** The unique program identifier of the Microsoft Office add-in. - **Provider** Name of the provider for this add-in. +- **Usage** Data about usage for the add-in. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3561,7 +4193,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3572,7 +4204,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3590,7 +4222,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3601,7 +4233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3627,7 +4259,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3638,7 +4270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3653,7 +4285,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3664,7 +4296,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3675,7 +4307,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3690,7 +4322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3701,21 +4333,21 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: -- **BrowserFlags** Browser flags for Office-related products -- **ExchangeProviderFlags** Provider policies for Office Exchange +- **BrowserFlags** Browser flags for Office-related products. +- **ExchangeProviderFlags** Provider policies for Office Exchange. - **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office shared computer licensing policies +- **SharedComputerLicensing** Office shared computer licensing policies. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3726,7 +4358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3758,7 +4390,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3769,7 +4401,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3781,7 +4413,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3792,7 +4424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3803,7 +4435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3814,7 +4446,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3829,7 +4461,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3837,7 +4469,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3845,7 +4477,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3856,7 +4488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3867,7 +4499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. This data helps ensure the device is up to date. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3875,7 +4507,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3883,7 +4515,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3893,7 +4525,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.IoT.Client.CEPAL.MonitorStarted -This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. +This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. The data collected with this event is used to keep Windows performing properly. @@ -3911,7 +4543,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3931,18 +4563,18 @@ The following fields are available: - **LastShutdownSucceeded** Flag indicating whether the last shutdown was successful. - **MaxAbove4GbFreeRange** This field describes the largest memory range available above 4Gb. - **MaxBelow4GbFreeRange** This field describes the largest memory range available below 4Gb. +- **MeasuredLaunchCapable** Indicates the system is capable of booting with Dynamic Root of Trust for Measurement (DRTM) support. - **MeasuredLaunchPrepared** This field tells us if the OS launch was initiated using Measured/Secure Boot over DRTM (Dynamic Root of Trust for Measurement). - **MeasuredLaunchResume** This field tells us if Dynamic Root of Trust for Measurement (DRTM) was used when resuming from hibernation. - **MenuPolicy** Type of advanced options menu that should be shown to the user (Legacy, Standard, etc.). - **RecoveryEnabled** Indicates whether recovery is enabled. -- **SecureLaunchPrepared** This field indicates if DRTM was prepared during boot. - **TcbLaunch** Indicates whether the Trusted Computing Base was used during the boot flow. - **UserInputTime** The amount of time the loader application spent waiting for user input. ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3967,7 +4599,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3980,7 +4612,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3993,11 +4625,304 @@ The following fields are available: - **ServiceName** The driver or service name that is attached to the device. +### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown + +This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **temperature** Contains the actual temperature measurement, in tenths of degrees Kelvin, for the area that exceeded the limit. +- **thermalZone** Contains an identifier that specifies which area it was that exceeded temperature limits. + + +## Microsoft Edge events + +### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_env** The environment from which the event was logged when testing; otherwise, the field is omitted or left blank. +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_env** The environment from which the event was logged when testing; otherwise, the field is omitted or left blank. +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." +- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. +- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). +- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). +- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. +- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **eventType** A string representation of appPingEventEventType indicating the type of the event. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4009,7 +4934,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4020,7 +4945,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4034,7 +4959,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4104,11 +5029,422 @@ The following fields are available: - **WFD2Supported** Indicates if the Miracast receiver supports WFD2 protocol. +## Mixed Reality events + +### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded + +This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **ClassGuid** Windows Mixed Reality device class GUID. +- **DeviceInterfaceId** Windows Mixed Reality device interface ID. +- **DeviceName** Windows Mixed Reality device name. +- **DriverVersion** Windows Mixed Reality device driver version. +- **FirmwareVersion** Windows Mixed Reality firmware version. +- **Manufacturer** Windows Mixed Reality device manufacturer. +- **ModelName** Windows Mixed Reality device model name. +- **SerialNumber** Windows Mixed Reality device serial number. + + +## OneDrive events + +### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation + +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CurrentOneDriveVersion** The current version of OneDrive. +- **CurrentOSBuildBranch** The current branch of the operating system. +- **CurrentOSBuildNumber** The current build number of the operating system. +- **CurrentOSVersion** The current version of the operating system. +- **HResult** The HResult of the operation. +- **SourceOSBuildBranch** The source branch of the operating system. +- **SourceOSBuildNumber** The source build number of the operating system. +- **SourceOSVersion** The source version of the operating system. + + +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +## Surface events + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + +## Update health events + +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted + +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4120,7 +5456,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4132,843 +5468,86 @@ The following fields are available: - **userRegionCode** The current user's region setting -## Push Button Reset events +## Quality Update Assistant events -### Microsoft.Windows.PBR.BitLockerWipeFinished +### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends error data after the BitLocker wipe finishes if there were any issues during the wipe. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: -- **error** The error code if there were any issues during the BitLocker wipe. -- **sessionID** This is the session ID. -- **succeeded** Indicates the BitLocker wipe successful completed. -- **timestamp** Time the event occurred. +- **CV** Correlation vector. +- **dayspendingrebootafterfu** Number of days that have elapsed since the device reached ready to reboot for a Feature Update that is still actively pending reboot. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Provides information on reasons why the update is not applicable to the device. +- **Result** Applicability check for quality update assistant. -### Microsoft.Windows.PBR.BootState +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends data on the Windows Recovery Environment (WinRE) boot, which can be used to determine whether the boot was successful. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **BsdSummaryInfo** Summary of the last boot. -- **sessionID** The ID of the push-button reset session. -- **timestamp** The timestamp of the boot state. +- **CV** Correlation vector. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Indicates why the device did not pass the readiness check. +- **Result** Device readiness check for quality update assistant. -### Microsoft.Windows.PBR.ClearTPMStarted +### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic data about the recovery operation on the device to allow investigation. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **sessionID** The ID for this push-button restart session. -- **timestamp** The time when the Trusted Platform Module will be erased. +- **CV** Correlation vector. +- **DODownloadHResult** Result code from Delivery Optimization when used to download the quality update. +- **DownloadMode** Indicates how the quality update was downloaded. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **HttpsDownloadHResult** Result code when HTTPS is used to download the quality update. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDeviceHasMinimumUptime** Indicates whether the device has the minimum uptime required to install a quality update. +- **Result** Download of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. -### Microsoft.Windows.PBR.ClientInfo +### Microsoft.Windows.QualityUpdateAssistant.Install -This event indicates whether push-button reset (PBR) was initiated while the device was online or offline. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **name** Name of the user interface entry point. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The time when this event occurred. - - -### Microsoft.Windows.PBR.Completed - -This event sends data about the recovery operation on the device to allow for investigation. - -The following fields are available: - -- **sessionID** The ID of the push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.DataVolumeCount - -This event provides the number of additional data volumes that the push-button reset operation has detected. - -The following fields are available: - -- **count** The number of attached data drives. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.DiskSpaceRequired - -This event sends the peak disk usage required for the push-button reset operation. - -The following fields are available: - -- **numBytes** The number of bytes required for the reset operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.EnterAPI - -This event is sent at the beginning of each push-button reset (PRB) operation. - -The following fields are available: - -- **apiName** Name of the API command that is about to execute. -- **sessionID** The session ID. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.EnteredOOBE - -This event is sent when the push-button reset (PRB) process enters the Out Of Box Experience (OOBE). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.LeaveAPI - -This event is sent when the push-button reset operation is complete. - -The following fields are available: - -- **apiName** Name of the API command that completed. -- **errorCode** Error code if an error occurred during the API call. -- **sessionID** The ID of this push-button reset session. -- **success** Indicates whether the API call was successful. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionFinished - -This event is sent when the OEM extensibility scripts have completed. - -The following fields are available: - -- **exitCode** The exit code from OEM extensibility scripts to push-button reset. -- **param** Parameters used for the OEM extensibility script. -- **phase** Name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the OEM extensibility script executed successfully. -- **timedOut** Indicates whether the OEM extensibility script timed out. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionStarted - -This event is sent when the OEM extensibility scripts start to execute. - -The following fields are available: - -- **param** The parameters used by the OEM extensibility script. -- **phase** The name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteFinished - -This event is sent at the end of a push-button reset (PBR) operation. - -The following fields are available: - -- **error** Indicates the result code of the event. -- **index** The operation index. -- **operation** The name of the operation. -- **phase** The name of the operation phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteStarted - -This event is sent at the beginning of a push-button reset operation. - -The following fields are available: - -- **index** The index of this operation. -- **operation** The name of this operation. -- **phase** The phase of this operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. -- **weight** The weight of the operation used to distribute the change in percentage. - - -### Microsoft.Windows.PBR.OperationQueueConstructFinished - -This event is sent when construction of the operation queue for push-button reset is finished. - -The following fields are available: - -- **error** The result code for operation queue construction. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationQueueConstructStarted - -This event is sent when construction of the operation queue for push-button reset is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.PBRClearRollBackEntry - -This event is sent when the push-button reset operation clears the rollback entry. Push-button reset cannot rollback after this point. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRClearTPMFailed - -This event is sent when there was a failure while clearing the Trusted Platform Module (TPM). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionFailed - -This event is sent when the push-button reset operation fails to construct a new copy of the operating system. - -The following fields are available: - -- **HRESULT** Indicates the result code of the event. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. -- **SPErrorCode** The error code for the Setup Platform operation. -- **SPOperation** The last Setup Platform operation. -- **SPPhase** The last phase of the Setup Platform operation. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionSucceed - -This event is sent when the push-button reset operation succeeds in constructing a new copy of the operating system. - -The following fields are available: - -- **CBSPackageCount** The Component Based Servicing package count. -- **CustomizationPackageCount** The Customization package count. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRDriverInjectionFailed - -This event is sent when the driver injection fails. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFailed - -This event is sent when the push-button reset operation fails and rolls back to the previous state. - -The following fields are available: - -- **ErrorType** The result code for the push-button reset error. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFinalizeNewSystemFailed - -This event is sent when the push-button reset operation fails to finalize the new system. - -The following fields are available: - -- **HRESULT** The result error code. -- **SessionID** The ID of this push-button reset session. -- **SPErrorCode** The error code for the Setup Platform operation. -- **SPOperation** The Setup Platform operation. -- **SPPhase** The phase of the Setup Platform operation. - - -### Microsoft.Windows.PBR.PBRFinalizeNewSystemSucceed - -This event is sent when the push-button reset operation succeeds in finalizing the new system. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFinalUserSelection - -This event is sent when the user makes the final selection in the user interface. - -The following fields are available: - -- **PBREraseData** Indicates whether the option to erase data is selected. -- **PBRRecoveryStrategy** The recovery strategy for the push-button reset operation. -- **PBRRepartitionDisk** Indicates whether the user has selected the option to repartition the disk. -- **PBRVariation** Indicates the push-button reset type. -- **PBRWipeDataDrives** Indicates whether the option to wipe the data drives is selected. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFormatOSVolumeFailed - -This event is sent when the operation to format the operating system volume fails during push-button reset (PBR). - -The following fields are available: - -- **JustDeleteFiles** Indicates whether disk formatting was skipped. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFormatOSVolumeSucceed - -This event is sent when the operation to format the operating system volume succeeds during push-button reset (PBR). - -The following fields are available: - -- **JustDeleteFiles** Indicates whether disk formatting was skipped. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRInstallWinREFailed - -This event sends basic data about the recovery operation failure on the device to allow investigation. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRIOCTLErasureSucceed - -This event is sent when the erasure operation succeeds during push-button reset (PBR). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRLayoutImageFailed - -This event is sent when push-button reset fails to create a new image of Windows. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRLayoutImageSucceed - -This event is sent when push-button reset succeeds in creating a new image of Windows. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBROEM1Failed - -This event is sent when the first OEM extensibility operation is successfully completed. - -The following fields are available: - -- **HRESULT** The result error code from the OEM extensibility script. -- **Parameters** The parameters that were passed to the OEM extensibility script. -- **PBRType** The type of push-button reset. -- **ScriptName** The path to the OEM extensibility script. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBROEM2Failed - -This event is sent when the second OEM extensibility operation is successfully completed. - -The following fields are available: - -- **HRESULT** The result error code from the OEM extensibility script. -- **Parameters** The parameters that were passed to the OEM extensibility script. -- **PBRType** The type of push-button reset. -- **ScriptName** The path to the OEM extensibility script. -- **SessionID** The ID of the push-button reset session. - - -### Microsoft.Windows.PBR.PBRPostApplyFailed - -This event returns data indicating the failure of the reset/recovery process after the operating system files are restored. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRPostApplyFinished - -This event returns data indicating the completion of the reset/recovery process after the operating system files are restored. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRPostApplyStarted - -This event returns data indicating the start of the reset/recovery process after the operating system files are restored. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRPreApplyFailed - -This event returns data indicating the failure of the reset/recovery process before the operating system files are restored. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRPreApplyFinished - -This event returns data indicating the completion of the reset/recovery process before the operating system files are restored. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRPreApplyStarted - -This event returns data indicating the start of the reset/recovery process before the operating system files are restored. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReachedOOBE - -This event returns data when the PBR (Push Button Reset) process reaches the OOBE (Out of Box Experience). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReconstructionInitiated - -This event returns data when a PBR (Push Button Reset) reconstruction operation begins. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecks - -This event returns data when PBR (Push Button Reset) requirement checks begin. - -The following fields are available: - -- **DeploymentType** The type of deployment. -- **InstallType** The type of installation. -- **PBRType** The type of push-button reset. -- **SessionID** The ID for this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksFailed - -This event returns data when PBR (Push Button Reset) requirement checks fail. - -The following fields are available: - -- **DiskSpaceAvailable** The disk space available for the push-button reset. -- **DiskSpaceRequired** The disk space required for the push-button reset. -- **ErrorType** The type of error that occurred during the requirement checks phase of the push-button reset operation. -- **PBRImageVersion** The image version of the push-button reset tool. -- **PBRRecoveryStrategy** The recovery strategy for this phase of push-button reset. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **PBRType** The type of push-button reset specified by the user interface. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksPassed - -This event returns data when PBR (Push Button Reset) requirement checks are passed. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRImageType** The push-button reset image type. -- **PBRImageVersion** The version of the push-button reset image. -- **PBRRecoveryStrategy** The push-button reset recovery strategy. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRestoreLicenseFailed - -This event sends basic data about recovery operation failure on the device. This data allows investigation to help keep Windows and PBR (Push Button Reset) up to date. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRSucceed - -This event returns data when PBR (Push Button Reset) succeeds. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRUserCancelled - -This event returns data when the user cancels the PBR (Push Button Reset) from the UI (user interface). - -The following fields are available: - -- **CancelPage** The ID of the page where the user clicked Cancel. -- **PBRVariation** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRVersionsMistmatch - -This event returns data when there is a version mismatch for WinRE (Windows Recovery) and the OS. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **REVersion** The version of Windows Recovery Environment (WinRE). -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRWinREInstallationFailed - -This event returns data when the WinRE (Windows Recovery) installation fails. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PhaseFinished - -This event returns data when a phase of PBR (Push Button Reset) has completed. - -The following fields are available: - -- **error** The result code for this phase of push-button reset. -- **phase** The name of this push-button reset phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether this phase of push-button reset executed successfully. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.PhaseStarted - -This event is sent when a phase of the push-button reset (PBR) operation starts. - -The following fields are available: - -- **phase** The name of this phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.ReconstructionInfo - -This event returns data about the PBR (Push Button Reset) reconstruction. - -The following fields are available: - -- **numPackagesAbandoned** The number of packages that were abandoned during the reconstruction operation of push-button reset. -- **numPackagesFailed** The number of packages that failed during the reconstruction operation of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **slowMode** The mode of reconstruction. -- **targetVersion** The target version of the OS for the reconstruction. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ResetOptions - -This event returns data about the PBR (Push Button Reset) reset options selected by the user. - -The following fields are available: - -- **overwriteSpace** Indicates whether the option was selected to erase data during push-button reset. -- **preserveWorkplace** Indicates whether the option was selected to reserve the workplace during push-button reset. -- **scenario** The selected scenario for the push-button on reset operation. -- **sessionID** The ID of this push-button on reset session. -- **timestamp** The timestamp of this push-button on reset event. -- **wipeData** Indicates whether the option was selected to wipe additional drives during push-button reset. - - -### Microsoft.Windows.PBR.RetryQueued - -This event returns data about the retry count when PBR (Push Button Reset) is restarted due to a reboot. - -The following fields are available: - -- **attempt** The number of retry attempts that were made -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnedToOldOS - -This event returns data after PBR (Push Button Reset) has completed the rollback. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnTaskSchedulingFailed - -This event returns data when there is a failure scheduling a boot into WinRE (Windows Recovery). - -The following fields are available: - -- **errorCode** The error that occurred while scheduling the task. -- **sessionID** The ID of this push-button reset session. -- **taskName** The name of the task. -- **timestamp** The ID of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackFinished - -This event returns data when the PBR (Push Button Reset) rollback completes. - -The following fields are available: - -- **error** Any errors that occurred during rollback to the old operating system. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the rollback succeeded. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackStarted - -This event returns data when the PBR (Push Button Reset) rollback begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ScenarioNotSupported - -This event returns data when the PBR (Push Button Reset) scenario selected is not supported on the device. - -The following fields are available: - -- **errorCode** The error that occurred. -- **reason** The reason why this push-button reset scenario is not supported. -- **sessionID** The ID for this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionCreated - -This event returns data when the PRB (Push Button Reset) session is created at the beginning of the UI (user interface) process. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionResumed - -This event returns data when the PRB (Push Button Reset) session is resumed after reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionSaved - -This event returns data when the PRB (Push Button Reset) session is suspended between reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteFinished - -This event returns data when the PBR (Push Button Reset) setup finishes. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **systemState** Information about the system state of the Setup Platform operation. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteStarted - -This event returns data when the PBR (Push Button Reset) setup starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupFinalizeStarted - -This event returns data when the Finalize operation is completed by setup during PBR (Push Button Reset). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupOperationFailed - -This event returns data when a PRB (Push Button Reset) setup operation fails. - -The following fields are available: - -- **errorCode** An error that occurred during the setup phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **setupExecutionOperation** The name of the Setup Platform operation. -- **setupExecutionPhase** The phase of the setup operation that failed. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoField - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate reset options are shown to the user. - -The following fields are available: - -- **name** Name of the system information field. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. -- **value** The system information field value. - - -### Microsoft.Windows.PBR.SystemInfoListItem - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate options can be shown to the user. - -The following fields are available: - -- **index** The index number associated with the system information item. -- **name** The name of the list of system information items. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. -- **value** The value of the system information item. - - -### Microsoft.Windows.PBR.SystemInfoSenseFinished - -This event returns data when System Info Sense is finished. - -The following fields are available: - -- **error** The error code if an error occurred while querying for system information. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the query for system information was successful. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoSenseStarted - -This event returns data when System Info Sense is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset event. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.UserAcknowledgeCleanupWarning - -This event returns data when the user acknowledges the cleanup warning pop-up after PRB (Push Button Reset) is complete. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserCancel - -This event returns data when the user confirms they wish to cancel PBR (Push Button Reset) from the user interface. - -The following fields are available: - -- **pageID** The page ID for the page the user canceled. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserConfirmStart - -This event returns data when the user confirms they wish to reset their device and PBR (Push Button Reset) begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallFinished - -This event returns data when WinRE (Windows Recovery) installation is complete. - -The following fields are available: - -- **errorCode** Any error that occurred during the Windows Recovery Environment (WinRE) installation. -- **sessionID** The ID of this push-button reset session. -- **success** Indicates whether the Windows Recovery Environment (WinRE) installation successfully completed. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallStarted - -This event returns data when WinRE (Windows Recovery) installation starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. +- **CV** Correlation vector. +- **DismInstallHResult** Internal result code from DISM when used to install the quality update. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **InstallMode** Indicates which installation method was used to attempt the install of the quality update. +- **KBNumber** KBNumber of the update being installed. +- **launchretrycounter** Count of the number of times the install has been retried in the event of a non-successful installation attempt. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDismErrorCode** Error code returned when DISM is used to install the quality update. +- **QualityUpdatePendingRebootAfterInstallStage** Indicates if the device is pending reboot after install is complete. +- **QualityUpdateSecondsInstallStage** Time spent installing the quality update. +- **QualityUpdateWusaErrorCode** Error code returned when WUSA is used to install the quality update. +- **Result** Install of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. +- **WusaInstallHResult** Internal result code from WUSA when used to install the quality update. ## Sediment events ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5000,6 +5579,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -5020,12 +5600,13 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. @@ -5033,7 +5614,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5079,6 +5660,7 @@ The following fields are available: - **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. - **IsWUfBFederatedScanDisabled** Indicates if Windows Update for Business federated scan is disabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce - **MSIError** The last error that was encountered during a scan for updates. - **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6 @@ -5111,6 +5693,7 @@ The following fields are available: - **SystemBIOSMajorRelease** Major version of the BIOS. - **SystemBIOSMinorRelease** Minor version of the BIOS. - **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null. +- **TargetReleaseVersion** The value selected for the target release version policy. - **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down. - **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation. - **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. @@ -5118,7 +5701,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5149,14 +5732,14 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: - **ActiveDownloadTime** Number of seconds the update was actively being downloaded. - **AppXBlockHashFailures** Indicates the number of blocks that failed hash validation during download. - **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded. -- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client. +- **AppXDownloadScope** Indicates the scope of the download for application content. - **AppXScope** Indicates the scope of the app download. - **BiosFamily** The family of the BIOS (Basic Input Output System). - **BiosName** The name of the device BIOS. @@ -5170,8 +5753,9 @@ The following fields are available: - **BundleRepeatFailFlag** Indicates whether this particular update bundle previously failed to download. - **BundleRevisionNumber** Identifies the revision number of the content bundle. - **BytesDownloaded** Number of bytes that were downloaded for an individual piece of content (not the entire bundle). +- **CachedEngineVersion** The version of the “Self-Initiated Healing” (SIH) engine that is cached on the device, if applicable. - **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. -- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download. +- **CbsDownloadMethod** Indicates whether the download was a full- or a partial-file download. - **CbsMethod** The method used for downloading the update content related to the Component Based Servicing (CBS) technology. - **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location. - **CDNId** ID which defines which CDN the software distribution client downloaded the content from. @@ -5179,9 +5763,11 @@ The following fields are available: - **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. - **ConnectTime** Indicates the cumulative amount of time (in seconds) it took to establish the connection for all updates in an update bundle. - **CurrentMobileOperator** The mobile operator the device is currently connected to. -- **DeviceModel** What is the device model. +- **DeviceModel** The model of the device. - **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority. - **DownloadProps** Information about the download operation properties in the form of a bitmask. +- **DownloadScenarioId** A unique ID for a given download, used to tie together Windows Update and Delivery Optimizer events. +- **DownloadType** Differentiates the download type of “Self-Initiated Healing” (SIH) downloads between Metadata and Payload downloads. - **EventInstanceID** A globally unique identifier for event instance. - **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed. - **EventType** Possible values are Child, Bundle, or Driver. @@ -5199,6 +5785,7 @@ The following fields are available: - **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update - **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **NetworkCost** A flag indicating the cost of the network (congested, fixed, variable, over data limit, roaming, etc.) used for downloading the update content. - **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.) - **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered." @@ -5208,25 +5795,26 @@ The following fields are available: - **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. - **Reason** A 32-bit integer representing the reason the update is blocked from being downloaded in the background. -- **RegulationReason** The reason that the update is regulated - **RegulationResult** The result code (HResult) of the last attempt to contact the regulation web service for download regulation of update content. - **RelatedCV** The previous Correlation Vector that was used before swapping with a new one. - **RepeatFailCount** Indicates whether this specific content has previously failed. -- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download. +- **RepeatFailFlag** Indicates whether this specific content previously failed to download. - **RevisionNumber** The revision number of the specified piece of content. - **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). -- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway. -- **ShippingMobileOperator** The mobile operator that a device shipped on. +- **Setup360Phase** Identifies the active phase of the upgrade download if the current download is for an Operating System upgrade. +- **ShippingMobileOperator** The mobile operator linked to the device when the device shipped. - **SizeCalcTime** Time taken (in seconds) to calculate the total download size of the payload. - **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult). - **SystemBIOSMajorRelease** Major version of the BIOS. - **SystemBIOSMinorRelease** Minor version of the BIOS. - **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. - **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **TargetMetadataVersion** The version of the currently downloading (or most recently downloaded) package. - **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet. -- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded. +- **TimeToEstablishConnection** Time (in milliseconds) it took to establish the connection prior to beginning downloaded. - **TotalExpectedBytes** The total count of bytes that the download is expected to be. - **UpdateId** An identifier associated with the specific piece of content. +- **UpdateID** An identifier associated with the specific piece of content. - **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional. - **UsedDO** Whether the download used the delivery optimization service. - **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive. @@ -5235,7 +5823,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5257,7 +5845,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5331,6 +5919,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. - **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. - **MsiAction** The stage of MSI installation where it failed. - **MsiProductCode** The unique identifier of the MSI installer. @@ -5359,7 +5948,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5387,6 +5976,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -5405,7 +5995,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5414,7 +6004,6 @@ The following fields are available: - **CmdLineArgs** Command line arguments passed in by the caller. - **EventInstanceID** A globally unique identifier for the event instance. - **EventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.). -- **Mode** Indicates the mode that has started. - **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc.). - **StatusCode** Result code of the event (success, cancellation, failure code HResult). - **WUDeviceID** Unique device ID controlled by the software distribution client. @@ -5422,7 +6011,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5449,6 +6038,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was then a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -5467,7 +6057,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5482,17 +6072,17 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. -- **EndpointUrl** URL of the endpoint where client obtains update metadata. Used to identify test vs staging vs production environments. -- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc. +- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. +- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed. - **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. - **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed. - **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. -- **MetadataIntegrityMode** Mode of update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce +- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce - **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID). - **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable. - **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable. @@ -5503,7 +6093,7 @@ The following fields are available: - **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate. - **SHA256OfTimestampToken** An encoded string of the timestamp token. - **SignatureAlgorithm** The hash algorithm for the metadata signature. -- **SLSPrograms** A test program a machine may be opted in. Examples include "Canary" and "Insider Fast". +- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast - **StatusCode** Result code of the event (success, cancellation, failure code HResult) - **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token. - **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed. @@ -5515,13 +6105,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallCancel -This event indicates the customer has cancelled uninstallation of Windows. +This event indicates the customer has cancelled uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallError -This event sends an error code when the Windows uninstallation fails. +This event sends an error code when the Windows uninstallation fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5530,19 +6120,19 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallReboot -This event is sent to signal an upcoming reboot during uninstallation of Windows. +This event is sent to signal an upcoming reboot during uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallStart -This event indicates that the Windows uninstallation has started. +This event indicates that the Windows uninstallation has started. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallUnavailable -This event sends diagnostic data when the Windows uninstallation is not available. +This event sends diagnostic data when the Windows uninstallation is not available. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5554,13 +6144,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.HasPendingActions -This event is sent when users have actions that will block the uninstall of the latest quality update. +This event is sent when users have actions that will block the uninstall of the latest quality update. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.IndicateLCUWasUninstalled -This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. +This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5569,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.LCUUninstall -This event is sent when the latest cumulative Windows update was uninstalled on a device. +This event is sent when the latest cumulative Windows update was uninstalled on a device. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5580,7 +6170,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRBlockedByPolicy -This event is sent when a push-button reset operation is blocked by the System Administrator. +This event is sent when a push-button reset operation is blocked by the System Administrator. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5590,7 +6180,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitFailed -This event signals a failed handoff between two recovery binaries. +This event signals a failed handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5599,7 +6189,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitSucceed -This event signals successful handoff between two recovery binaries. +This event signals successful handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5608,7 +6198,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRFailedOffline -This event reports the error code when recovery fails. +This event reports the error code when recovery fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5619,7 +6209,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.EsimPresentCheck -This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). +This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5630,7 +6220,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.PBRCorruptionRepairOption -This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. +This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5642,7 +6232,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.RepairNeeded -This event provides information about whether a system reset needs repair. +This event provides information about whether a system reset needs repair. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5654,7 +6244,7 @@ The following fields are available: ### Microsoft.Windows.UEFI.ESRT -This event sends basic data during boot about the firmware loaded or recently installed on the machine. This helps to keep Windows up to date. +This event sends basic data during boot about the firmware loaded or recently installed on the machine. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -5673,7 +6263,6 @@ The following fields are available: - **LastAttemptVersion** The version of the most recent attempted firmware installation. - **LowestSupportedFirmwareVersion** The oldest (lowest) version of firmware supported. - **MaxRetryCount** The maximum number of retries, defined by the firmware class key. -- **PartA_PrivTags** The privacy tags associated with the firmware. - **RetryCount** The number of attempted installations (retries), reported by the driver software key. - **Status** The status returned to the PnP (Plug-and-Play) manager. - **UpdateAttempted** Indicates if installation of the current update has been attempted before. @@ -5683,7 +6272,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5692,6 +6281,7 @@ The following fields are available: - **ObjectId** The unique value for each Update Agent mode. - **RebootRequired** Indicates reboot is required. - **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. +- **Result** The HResult of the event. - **RevertResult** The result code returned for the Revert operation. - **ScenarioId** The ID of the update scenario. - **SessionId** The ID of the update attempt. @@ -5700,10 +6290,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **FlightId** Unique ID for each flight. - **ObjectId** Unique value for each Update Agent mode. @@ -5716,11 +6307,18 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean indicating whether a cancel was requested. +- **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. +- **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. +- **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. +- **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. +- **DownloadedSizePSFX** Cumulative size (in bytes) of downloaded PSFX content. - **DownloadRequests** Number of times a download was retried. - **ErrorCode** The error code returned for the current download request phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. @@ -5751,10 +6349,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether a cancel was requested. - **CanonicalRequestedOnError** Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE). - **ElapsedTickCount** Time taken for expand phase. - **EndFreeSpace** Free space after expand phase. @@ -5770,25 +6369,9 @@ The following fields are available: - **UpdateId** Unique ID for each update. -### Update360Telemetry.UpdateAgentFellBackToCanonical - -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. - -The following fields are available: - -- **FlightId** Unique ID for each flight. -- **ObjectId** Unique value for each Update Agent mode. -- **PackageCount** Number of packages that feel back to canonical. -- **PackageList** PackageIds which fell back to canonical. -- **RelatedCV** Correlation vector value generated from the latest USO scan. -- **ScenarioId** Indicates the update scenario. -- **SessionId** Unique value for each update attempt. -- **UpdateId** Unique ID for each update. - - ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5806,10 +6389,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean to indicate whether a cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). @@ -5824,7 +6408,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5841,7 +6425,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5867,7 +6451,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5887,7 +6471,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5903,7 +6487,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5921,7 +6505,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5930,30 +6514,35 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **ErrorCode** The error code returned for the current reboot. - **FlightId** Unique ID for the flight (test instance version). +- **IsSuspendable** Indicates whether the update has the ability to be suspended and resumed at the time of reboot. When the machine is rebooted and the update is in middle of Predownload or Install and Setup.exe is running, this field is TRUE, if not its FALSE. - **ObjectId** The unique value for each Update Agent mode. +- **Reason** Indicates the HResult why the machine could not be suspended. If it is successfully suspended, the result is 0. - **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. - **Result** The HResult of the event. - **ScenarioId** The ID of the update scenario. - **SessionId** The ID of the update attempt. - **UpdateId** The ID of the update. +- **UpdateState** Indicates the state of the machine when Suspend is called. For example, Install, Download, Commit. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5972,11 +6561,29 @@ The following fields are available: - **UserSession** Indicates whether install was invoked by user actions. +## Update notification events + +### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat + +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignConfigVersion** Configuration version for the current campaign. +- **CampaignID** Currently campaign that is running on Update Notification Pipeline (UNP). +- **ConfigCatalogVersion** Current catalog version of UNP. +- **ContentVersion** Content version for the current campaign on UNP. +- **CV** Correlation vector. +- **DetectorVersion** Most recently run detector version for the current campaign on UNP. +- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user. +- **PackageVersion** Current UNP package version. + + ## Upgrade events ### FacilitatorTelemetry.DCATDownload -This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure. +This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -5989,12 +6596,23 @@ The following fields are available: - **UpdateId** The ID of the update that was downloaded. -### FacilitatorTelemetry.InitializeDU +### FacilitatorTelemetry.DUDownload -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **PackageCategoriesFailed** Lists the categories of packages that failed to download. +- **PackageCategoriesSkipped** Lists the categories of package downloads that were skipped. + + +### FacilitatorTelemetry.InitializeDU + +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DCATUrl** The Delivery Catalog (DCAT) URL we send the request to. - **DownloadRequestAttributes** The attributes we send to DCAT. - **ResultCode** The result returned from the initiation of Facilitator with the URL/attributes. - **Scenario** Dynamic Update scenario (Image DU, or Setup DU). @@ -6004,7 +6622,7 @@ The following fields are available: ### Setup360Telemetry.Downlevel -This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure. +This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure. The following fields are available: @@ -6048,7 +6666,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6201,7 +6819,7 @@ The following fields are available: - **FlightData** Specifies a unique identifier for each group of Windows Insider builds. - **InstanceId** Retrieves a unique identifier for each instance of a setup session. -- **Operation** Facilitator's last known operation (scan, download, etc.). +- **Operation** Facilitator’s last known operation (scan, download, etc.). - **ReportId** ID for tying together events stream side. - **ResultCode** Result returned for the entire setup operation. - **Scenario** Dynamic Update scenario (Image DU, or Setup DU). @@ -6212,7 +6830,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6237,7 +6855,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6256,7 +6874,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6285,7 +6903,7 @@ The following fields are available: - **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. - **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. - **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. -- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). - **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. @@ -6295,9 +6913,35 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6348,7 +6992,7 @@ The following fields are available: ### Value -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. +This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -6375,39 +7019,28 @@ The following fields are available: ### WheaProvider.WheaErrorRecord -This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. +This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: - **creatorId** The unique identifier for the entity that created the error record. -- **CreatorId** The unique identifier for the entity that created the error record. - **errorFlags** Any flags set on the error record. -- **ErrorFlags** Any flags set on the error record. - **notifyType** The unique identifier for the notification mechanism which reported the error to the operating system. -- **NotifyType** The unique identifier for the notification mechanism which reported the error to the operating system. - **partitionId** The unique identifier for the partition on which the hardware error occurred. -- **PartitionId** The unique identifier for the partition on which the hardware error occurred. - **platformId** The unique identifier for the platform on which the hardware error occurred. -- **PlatformId** The unique identifier for the platform on which the hardware error occurred. - **record** A collection of binary data containing the full error record. -- **Record** A collection of binary data containing the full error record. - **recordId** The identifier of the error record. -- **RecordId** The identifier of the error record. - **sectionFlags** The flags for each section recorded in the error record. -- **SectionFlags** The flags for each section recorded in the error record. -- **SectionSeverity** The severity of each individual section. - **sectionTypes** The unique identifier that represents the type of sections contained in the error record. -- **SectionTypes** The unique identifier that represents the type of sections contained in the error record. - **severityCount** The severity of each individual section. - **timeStamp** The error time stamp as recorded in the error record. -- **TimeStamp** The error time stamp as recorded in the error record. ## Windows Security Center events ### Microsoft.Windows.Security.WSC.DatastoreMigratedVersion -This event provides information about the datastore migration and whether it was successful. +This event provides information about the datastore migration and whether it was successful. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -6418,7 +7051,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.GetCallerViaWdsp -This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. +This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. The data collected with this event is used to help keep Windows secure and performing properly. The following fields are available: @@ -6515,6 +7148,7 @@ The following fields are available: - **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. - **AttemptNumber** The total number of attempts to acquire this product. +- **BundleId** The bundle ID - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** HResult code to show the result of the operation (success/failure). @@ -6524,6 +7158,7 @@ The following fields are available: - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this happening after a device restore? - **IsUpdate** Is this an update? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). - **PFN** Product Family Name of the product being installed. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The number of attempts by the system to acquire this product. @@ -6822,11 +7457,87 @@ The following fields are available: - **PFamN** The name of the app that is requested for update. +## Windows Update CSP events + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed + +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** This is the device info. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable + +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Represents the device info. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted + +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed + +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure Error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Release Channel. +- **wUfBConnected** Result of Windows Update for Business connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Device in the semi-annual channel. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted + +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. + + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6860,7 +7571,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6879,6 +7590,7 @@ The following fields are available: - **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered. - **cdnIp** The IP address of the source CDN. - **cdnUrl** Url of the source Content Distribution Network (CDN). +- **congestionPrevention** Indicates a download may have been suspended to prevent network congestion. - **dataSourcesTotal** Bytes received per source type, accumulated for the whole session. - **doErrorCode** The Delivery Optimization error code that was returned. - **downlinkBps** The maximum measured available download bandwidth (in bytes per second). @@ -6895,6 +7607,7 @@ The following fields are available: - **groupConnectionCount** The total number of connections made to peers in the same group. - **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group. - **isEncrypted** TRUE if the file is encrypted and will be decrypted after download. +- **isThrottled** Event Rate throttled (event represents aggregated data). - **isVpn** Is the device connected to a Virtual Private Network? - **jobID** Identifier for the Windows Update job. - **lanConnectionCount** The total number of connections made to peers in the same LAN. @@ -6914,7 +7627,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6934,7 +7647,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6957,6 +7670,7 @@ The following fields are available: - **fileSizeCaller** Value for total file size provided by our caller. - **groupID** ID for the group. - **isEncrypted** Indicates whether the download is encrypted. +- **isThrottled** Indicates the Event Rate was throttled (event represent aggregated data). - **isVpn** Indicates whether the device is connected to a Virtual Private Network. - **jobID** The ID of the Windows Update job. - **peerID** The ID for this delivery optimization client. @@ -6970,7 +7684,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6992,7 +7706,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7006,9 +7720,125 @@ The following fields are available: ## Windows Update events +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary + +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activated** Whether the entire device manifest update is considered activated and in use. +- **analysisErrorCount** The number of driver packages that could not be analyzed because errors occurred during analysis. +- **flightId** Unique ID for each flight. +- **missingDriverCount** The number of driver packages delivered by the device manifest that are missing from the system. +- **missingUpdateCount** The number of updates in the device manifest that are missing from the system. +- **objectId** Unique value for each diagnostics session. +- **publishedCount** The number of drivers packages delivered by the device manifest that are published and available to be used on devices. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **scenarioId** Indicates the update scenario. +- **sessionId** Unique value for each update session. +- **summary** A summary string that contains basic information about driver packages that are part of the device manifest and any devices on the system that those driver packages match. +- **summaryAppendError** A Boolean indicating if there was an error appending more information to the summary string. +- **truncatedDeviceCount** The number of devices missing from the summary string because there is not enough room in the string. +- **truncatedDriverCount** The number of driver packages missing from the summary string because there is not enough room in the string. +- **unpublishedCount** How many drivers packages that were delivered by the device manifest that are still unpublished and unavailable to be used on devices. +- **updateId** The unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit + +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code returned for the current session initialization. +- **flightId** The unique identifier for each flight. +- **objectId** The unique GUID for each diagnostics session. +- **relatedCV** A correlation vector value generated from the latest USO scan. +- **result** Outcome of the initialization of the session. +- **scenarioId** Identifies the Update scenario. +- **sessionId** The unique value for each update session. +- **updateId** The unique identifier for each Update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest + +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted. +- **errorCode** The error code returned for the current session initialization. +- **flightId** The unique identifier for each flight. +- **objectId** Unique value for each Update Agent mode. +- **packageCountOptional** Number of optional packages requested. +- **packageCountRequired** Number of required packages requested. +- **packageCountTotal** Total number of packages needed. +- **packageCountTotalCanonical** Total number of canonical packages. +- **packageCountTotalDiff** Total number of diff packages. +- **packageCountTotalExpress** Total number of express packages. +- **packageSizeCanonical** Size of canonical packages in bytes. +- **packageSizeDiff** Size of diff packages in bytes. +- **packageSizeExpress** Size of express packages in bytes. +- **rangeRequestState** Represents the state of the download range request. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Result of the download request phase of update. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize + +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code returned for the current session initialization. +- **flightId** The unique identifier for each flight. +- **flightMetadata** Contains the FlightId and the build being flighted. +- **objectId** Unique value for each Update Agent mode. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios). +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall + +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code returned for the current install phase. +- **flightId** The unique identifier for each flight. +- **objectId** The unique identifier for each diagnostics session. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Outcome of the install phase of the update. +- **scenarioId** The unique identifier for the update scenario. +- **sessionId** Unique value for each update session. +- **updateId** The unique identifier for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart + +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightId** The unique identifier for each flight. +- **mode** The mode that is starting. +- **objectId** The unique value for each diagnostics session. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique identifier for each update. + + ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7034,7 +7864,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7051,7 +7881,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7068,7 +7898,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7085,7 +7915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7100,25 +7930,9 @@ The following fields are available: - **UtcTime** The time at which the reboot reminder dialog was shown (in UTC). -### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderToast - -This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. - -The following fields are available: - -- **DeviceLocalTime** The local time on the device sending the event. -- **ETag** OneSettings versioning value. -- **ExitCode** Indicates how users exited the pop-up banner. -- **RebootVersion** The version of the reboot logic. -- **UpdateId** The ID of the update that is pending restart to finish installation. -- **UpdateRevision** The revision of the update that is pending restart to finish installation. -- **UserResponseString** The option that the user chose in pop-up banner. -- **UtcTime** The time that the pop-up banner was displayed, in Coordinated Universal Time. - - ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7136,9 +7950,36 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failureCount** Number of failures. +- **failureId** Id of the failure. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast). +- **fileName** Source code file name where the error occurred. +- **function** Function where the failure occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source code file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **PartA_PrivTags** Privacy tags. +- **threadId** Identifier of the thread the error occurred on. +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7147,9 +7988,33 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours + +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursEnd** The end of the active hours window. +- **activeHoursStart** The start of the active hours window. +- **updatePhase** The current state of the update process. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel + +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** The current battery charge capacity. +- **batteryLevelThreshold** The battery capacity threshold to stop update activity. +- **updatePhase** The current state of the update process. +- **wuDeviceid** Device ID. + + ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7168,7 +8033,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7210,7 +8075,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7226,7 +8091,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7241,9 +8106,30 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.DTUEnabled + +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wuDeviceid** Device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.DTUInitiated + +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **dtuErrorCode** Return code from creating the DTU Com Server. +- **isDtuApplicable** Determination of whether DTU is applicable to the machine it is running on. +- **utilizeDtuOverWu** Whether DTU should be utilized over Windows Update. +- **wuDeviceid** Device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7260,7 +8146,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7270,7 +8156,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7287,7 +8173,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7304,7 +8190,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7330,7 +8216,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7344,7 +8230,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7356,7 +8242,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7365,7 +8251,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7384,7 +8270,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7396,7 +8282,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7408,7 +8294,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7423,9 +8309,35 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable + +This event defines when an optional update is available for the device to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** The unique identifier of the Windows Insider build on this device. +- **isFeatureUpdate** Indicates whether the update is a Feature Update. +- **revisionNumber** The revision number of the update. +- **updateId** The GUID (Globally Unique Identifier) of the update. +- **wuDeviceid** The Windows Update device identifier. + + +### Microsoft.Windows.Update.Orchestrator.SeekUpdate + +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. + +The following fields are available: + +- **flightID** The ID of the Windows Insider builds on the device. +- **isFeatureUpdate** Indicates that the target of the Seek is a feature update. +- **revisionNumber** The revision number of the update. +- **updateId** The identifier of the update. +- **wuDeviceid** The Windows Update device identifier. + + ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7435,7 +8347,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7449,9 +8361,33 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours + +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursEnd** The end of the active hours window. +- **activeHoursStart** The start of the active hours window. +- **updatePhase** The current state of the update process. +- **wuDeviceid** The device identifier. + + +### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel + +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** The current battery charge capacity. +- **batteryLevelThreshold** The battery capacity threshold to stop update activity. +- **updatePhase** The current state of the update process. +- **wuDeviceid** The device identifier. + + ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature -This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. +This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7460,9 +8396,20 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd + +This event indicates a critical error with the callback binary requested by the updater. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updaterCmdLine** The command line requested by the updater. +- **updaterId** The ID of the updater that requested the work. +- **wuDeviceid** WU device ID. + + ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7470,9 +8417,19 @@ The following fields are available: - **wuDeviceid** Unique device ID controlled by the software distribution client. +### Microsoft.Windows.Update.Orchestrator.UpdateNotApplicableForReserves + +This event reports a critical error when using update reserves for OS updates to help keep Windows up to date. + +The following fields are available: + +- **updateId** The GUID (Globally Unique Identifier) of the update. +- **wuDeviceid** The Windows Update device identifier. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -7485,7 +8442,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdaterCallbackFailed -This event is sent when an updater failed to execute the registered callback. +This event is sent when an updater failed to execute the registered callback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7497,7 +8454,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -7523,7 +8480,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7533,7 +8490,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7549,7 +8506,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7571,7 +8528,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7580,7 +8537,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -7600,7 +8557,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7620,7 +8577,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7645,35 +8602,9 @@ The following fields are available: ## Windows Update mitigation events -### Microsoft.Windows.Mitigation.AccountTraceLoggingProvider.General - -This event provides information about application properties to indicate the successful execution. - -The following fields are available: - -- **AppMode** Indicates the mode the app is being currently run around privileges. -- **ExitCode** Indicates the exit code of the app. -- **Help** Indicates if the app needs to be launched in the help mode. -- **ParseError** Indicates if there was a parse error during the execution. -- **RightsAcquired** Indicates if the right privileges were acquired for successful execution. -- **RightsWereEnabled** Indicates if the right privileges were enabled for successful execution. -- **TestMode** Indicates whether the app is being run in test mode. - - -### Microsoft.Windows.Mitigation.AccountTraceLoggingProvider.GetCount - -This event provides information about the properties of user accounts in the Administrator group. - -The following fields are available: - -- **Internal** Indicates the internal property associated with the count group. -- **LastError** The error code (if applicable) for the cause of the failure to get the count of the user account. -- **Result** The HResult error. - - ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7695,9 +8626,31 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints + +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ReparsePointsFailed** Number of reparse points that are corrupted but we failed to fix them. +- **ReparsePointsFixed** Number of reparse points that were corrupted and were fixed by this mitigation. +- **ReparsePointsSkipped** Number of reparse points that are not corrupted and no action is required. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each Update. +- **WuId** Unique ID for the Windows Update client. + + ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7718,11 +8671,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.BeginScenario -This event is sent when the Update Reserve Manager is called to begin a scenario. +This event is sent when the Update Reserve Manager is called to begin a scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7738,7 +8712,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ClearReserve -This event is sent when the Update Reserve Manager clears one of the reserves. +This event is sent when the Update Reserve Manager clears one of the reserves. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7747,15 +8721,9 @@ The following fields are available: - **ReserveId** The ID of the reserve that needs to be cleared. -### Microsoft.Windows.UpdateReserveManager.ClearSoftReserve - -This event is sent when the Update Reserve Manager clears the contents of the soft reserve. - - - ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7765,7 +8733,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.EndScenario -This event is sent when the Update Reserve Manager ends an active scenario. +This event is sent when the Update Reserve Manager ends an active scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7781,7 +8749,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7794,13 +8762,14 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeReserves -This event is sent when reserves are initialized on the device. +This event is sent when reserves are initialized on the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **FallbackInitUsed** Indicates whether fallback initialization is used. - **FinalUserFreeSpace** The amount of user free space after initialization. - **Flags** The flags used in the initialization of Update Reserve Manager. +- **FreeSpaceToLeaveInUpdateScratch** The amount of space that should be left free after using the reserves. - **HardReserveFinalSize** The final size of the hard reserve. - **HardReserveFinalUsedSpace** The used space in the hard reserve. - **HardReserveInitialSize** The size of the hard reserve after initialization. @@ -7822,7 +8791,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7837,16 +8806,17 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **FallbackLogicUsed** Indicates whether fallback logic was used for initialization. - **Flags** The flags that are passed to the function to prepare the Trusted Installer for reserve initialization. ### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy -This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. +This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7857,13 +8827,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.TurnOffReserves -This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. +This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7878,7 +8848,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md new file mode 100644 index 0000000000..218ce9d25c --- /dev/null +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -0,0 +1,91 @@ +--- +title: Changes to Windows diagnostic data collection +description: This article provides information on changes to Windows diagnostic data collection Windows 10. +keywords: privacy, diagnostic data +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +audience: ITPro +ms.author: siosulli +author: DaniHalfin +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/21/2020 +--- + +# Changes to Windows diagnostic data collection + +**Applies to** +- Windows 10, version 1903 and newer +- The next version of Windows Server + +Microsoft is committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. As part of this effort, we are moving our major products and services to a model where data sent back to Microsoft from customer devices will be classified as either **Required** or **Optional**. We believe this will provide our customers with a simpler experience – information should be easier to find, easier to understand, and easier to act upon through the tools we provide. + +This topic is meant for IT administrators and explains the changes Windows is making to align to the new data collection taxonomy. These changes are focused in two areas: + +- [Taxonomy changes](#taxonomy-changes) +- [Behavioral changes](#behaviorial-changes) + +> [!NOTE] +> You can test the behavioral changes now in Windows 10 Insider Preview build 19577 and later. + +## Summary of changes + +In Windows 10, version 1903 and newer, you will see taxonomy updates in both the **Out-of-box-experience** (OOBE) and the **Diagnostics & feedback** privacy settings page. These changes are explained in the section named **Taxonomy** changes. + +Additionally, in an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. We’re also clarifying the Security diagnostic data level to more accurately reflect its behavior by changing it to **Diagnostic data off**. All of these changes are explained in the section named **Behavioral changes**. + +## Taxonomy changes + +Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience** (OOBE) and the **Diagnostics & feedback** privacy setting pages will reflect the following changes: + +- The **Basic** diagnostic data level is being labeled as **Required**. +- The **Full** diagnostic data level is being labeled as **Optional**. + +> [!IMPORTANT] +> No action is required for the taxonomy changes, and your existing settings will be maintained as part of this update. + +## Behaviorial changes + +In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be migrated to the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see the section named, **Services that rely on Enhanced diagnostic data**, later in this topic. Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see the section named **Configure a Windows 10 device to limit crash dumps and logs**. For more information on services that rely on Enhanced diagnostic data, see **Services that rely on Enhanced diagnostic data**. + +Additionally, you will see the following policy changes in an upcoming release of Windows 10: + +| Policy type | Current policy | Renamed policy | +| --- | --- | --- | +| Group Policy | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Telemetry**
              • **0 - Security**
              • **1 - Basic**
              • **2 - Enhanced**
              • **3 - Full**
              | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**
              • **Diagnostic data off (not recommended)**
              • **Send required diagnostic data**
              • **Send optional diagnostic data**
              | +| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in settings user interface**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in settings user interface** | +| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in change notifications**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in change notifications** | + +A final set of changes includes two new policies that can help you fine-tune diagnostic data collection within your organization. These policies let you limit the amount of optional diagnostic data that’s sent back to Microsoft. + +- The **Limit dump collection** policy is a new policy that can be used to limit the types of [crash dumps](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) that can be sent back to Microsoft. If this policy is enabled, Windows Error Reporting will send only kernel mini dumps and user mode triage dumps. + - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection** + - MDM policy: System/LimitDumpCollection +- The **Limit diagnostic log collection** policy is another new policy that limits the number of diagnostic logs that are sent back to Microsoft. If this policy is enabled, diagnostic logs are not sent back to Microsoft. + - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection** + - MDM policy: System/LimitDiagnosticLogCollection + +>[!Important] +>All of the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier. + +## Configure a Windows 10 device to limit crash dumps and logs + +With the Enhanced diagnostic data level being split out into new policies, we're providing additional controls to manage what types of crash dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them: + +1. Choose to send optional diagnostic data by setting one of the following policies: + - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**. Set the policy value to **Send optional diagnostic data**. + - MDM: System/AllowTelemetry. Set the policy value to **3**. +2. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection** +3. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection** + +## Services that rely on Enhanced diagnostic data + +Customers who use services that depend on Windows diagnostic data, such as Microsoft Managed Desktop or Desktop Analytics, may be impacted by the behavioral changes when they are released. These services will be updated to address these changes and guidance will be published on how to configure them properly. + +The following provides information on the current configurations: +- [Microsoft Managed Desktop](https://aka.ms/mmd-diagnostic-data-level) +- [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index aed5ac00b0..36baec913b 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -13,442 +13,223 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/29/2019 +ms.date: 10/13/2020 --- # Configure Windows diagnostic data in your organization **Applies to** -- Windows 10 Enterprise -- Windows 10 Mobile -- Windows Server +- Windows 10 Enterprise +- Windows 10 Education +- Windows Server 2016 and newer -This article applies to Windows and Windows Server diagnostic data only. It describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers. +This article applies to Windows 10, Windows Server, Surface Hub, and HoloLens diagnostic data only. It describes the types of diagnostic data that’s sent back to Microsoft and the ways you can manage it within your organization. Microsoft uses the data to quickly identify and address issues affecting its customers. -Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. Microsoft uses diagnostic data to keep Windows secure and up to date, troubleshoot problems, and make product improvements. +>[!IMPORTANT] +>Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). -We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. +## Overview -## Overview of Windows diagnostic data +Microsoft collects Windows diagnostic data to solve problems and to keep Windows up to date, secure, and operating properly. It also helps us improve Windows and related Microsoft products and services and, for customers who have turned on the **Tailored experiences** setting, to provide more relevant tips and recommendations to enhance Microsoft and third-party products and services for the customer’s needs. -At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how. - -To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways: - -- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools. -- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions. -- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection. -- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right. -- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting. -- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers. - -In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM. - -For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization. - -## Understanding Windows diagnostic data - -Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us. - -The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts. - -### What is Windows diagnostic data? -Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways: - -- Keep Windows up to date -- Keep Windows secure, reliable, and performant -- Improve Windows – through the aggregate analysis of the use of Windows -- Personalize Windows engagement surfaces - -Here are some specific examples of Windows diagnostic data: - -- Type of hardware being used -- Applications installed and usage details -- Reliability information on device drivers - -### What is NOT diagnostic data? - -Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request. - -There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data. - -If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services). - -The following are specific examples of functional data: - -- Current location for weather -- Bing searches -- Wallpaper and desktop settings synced across multiple devices +For more information about how Windows diagnostic data is used, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy). ### Diagnostic data gives users a voice -Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits. +Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit both consumer and enterprise customers. The following sections offer real examples of these benefits. -### Improve app and driver quality +### _Improve app and driver quality_ -Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues. +Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers used on Windows. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues. -#### Real-world example of how Windows diagnostic data helps -There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls. +For example, in an earlier version of Windows 10 there was a version of a video driver that was crashing on some devices, causing the device to restart. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls. -### Improve end-user productivity +### _Improve end-user productivity_ -Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are: +Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls. - **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time. + - **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance. -- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. -**These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.** - -### Insights into your own organization - -Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well. Microsoft is in the process of developing a set of analytics customized for your internal use. The first of these, called [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). - -#### Upgrade Readiness - -Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points. - -To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis. - -With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft. - -Use Upgrade Readiness to get: - -- A visual workflow that guides you from pilot to production -- Detailed computer, driver, and application inventory -- Powerful computer level search and drill-downs -- Guidance and insights into application and driver compatibility issues with suggested fixes -- Data driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools - -The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. +- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between apps. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. ## How Microsoft handles diagnostic data -The diagnostic data is categorized into four levels: - -- [**Security**](#security-level). Information that’s required to help keep Windows and Windows Server secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. - -- [**Basic**](#basic-level). Basic device info, including: quality-related data, app compatibility, and data from the **Security** level. - -- [**Enhanced**](#enhanced-level). Additional insights, including: how Windows, Windows Server, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels. - -- [**Full**](#full-level). Includes information about the websites you browse, how you use apps and features, plus additional information about device health, device activity (sometimes referred to as usage), and enhanced error reporting. At Full, Microsoft also collects the memory state of your device when a system or app crash occurs. It includes data from the **Security**, **Basic**, and **Enhanced** levels. - -Diagnostic data levels are cumulative, meaning each subsequent level includes data collected through lower levels. For more information see the [Diagnostic data levels](#diagnostic-data-levels) section. +Use the following sections to learn more about how Microsoft handles diagnostic data. ### Data collection -Windows 10 and Windows Server includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. +Depending on the diagnostic data settings on the device, diagnostic data can be collected via the following methods: -1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. -2. Events are gathered using public operating system event logging and tracing APIs. -3. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings. -4. The Connected User Experiences and Telemetry component transmits the diagnostic data. + - Small payloads of structured information referred to as diagnostic data events, managed by the Connected User Experiences and Telemetry component. + + - Diagnostic logs for additional troubleshooting, also managed by the Connected User Experience and Telemetry component. + + - Crash reporting and crash dumps, managed by [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). -Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels. +Later in this document we provide further details about how to control what’s collected and what data can be included in these different types of diagnostic data. ### Data transmission -All diagnostic data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. - -The data transmitted at the Basic and Enhanced data diagnostic levels is quite small; typically less than 1 MB per device per day, but occasionally up to 2 MB per device per day). +All diagnostic data is encrypted using TLS and uses certificate pinning during transfer from the device to the Microsoft data management services. ### Endpoints -The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access. +The following table lists the endpoints related to how you can manage the collection and control of diagnostic data. For more information around the endpoints that are used to send data back to Microsoft, see [Manage connection endpoints for Windows 10 Enterprise, version 1903](manage-windows-1903-endpoints.md). -The following table defines the endpoints for Connected User Experiences and Telemetry component: - -Windows release | Endpoint ---- | --- -Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed| **Diagnostics data** - v10c.vortex-win.data.microsoft.com

              **Functional** - v20.vortex-win.data.microsoft.com
              **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com
              **Settings** - win.data.microsoft.com -Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data** - v10.events.data.microsoft.com

              **Functional** - v20.vortex-win.data.microsoft.com
              **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com
              **Settings** - win.data.microsoft.com -Windows 10, version 1709 or earlier | **Diagnostics data** - v10.vortex-win.data.microsoft.com

              **Functional** - v20.vortex-win.data.microsoft.com
              **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com
              **Settings** - win.data.microsoft.com - -The following table defines the endpoints for other diagnostic data services: - -| Service | Endpoint | +| Windows service | Endpoint | | - | - | -| [Windows Error Reporting](https://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com | -| | ceuswatcab01.blob.core.windows.net | -| | ceuswatcab02.blob.core.windows.net | -| | eaus2watcab01.blob.core.windows.net | -| | eaus2watcab02.blob.core.windows.net | -| | weus2watcab01.blob.core.windows.net | -| | weus2watcab02.blob.core.windows.net | -| [Online Crash Analysis](https://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com | -| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 | -| Microsoft Defender Advanced Threat Protection | https://wdcp.microsoft.com
              https://wdcpalt.microsoft.com | +|Connected User Experiences and Telemetry | v10.events.data.microsoft.com

              v10c.events.data.microsoft.com

              v10.vortex-win.data.microsoft.com | +| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com

              watson.microsoft.com

              umwatsonc.telemetry.microsoft.com

              umwatsonc.events.data.microsoft.com

              *-umwatsonc.events.data.microsoft.com

              ceuswatcab01.blob.core.windows.net

              ceuswatcab02.blob.core.windows.net

              eaus2watcab01.blob.core.windows.net

              eaus2watcab02.blob.core.windows.net

              weus2watcab01.blob.core.windows.net

              weus2watcab02.blob.core.windows.net | +|Authentication | login.live.com



              IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.| +| [Online Crash Analysis](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com

              oca.microsoft.com

              kmwatsonc.telemetry.microsoft.com

              *-kmwatsonc.telemetry.microsoft.com | +|Settings | settings-win.data.microsoft.com



              IMPORTANT: This endpoint is used to remotely configure diagnostics-related settings and data collection. For example, we use the settings endpoint to remotely block an event from being sent back to Microsoft. We do not recommend disabling this endpoint. This endpoint does not upload Windows diagnostic data | -### Data use and access +### Data access -The principle of least privileged access guides access to diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. +The principle of least privileged access guides access to Windows diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). Microsoft may share business reports with hardware manufacturers and third-party partners that include aggregated and deidentified diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. ### Retention -Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history. +Microsoft believes in and practices data minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. For more information on how long data is retained, see the section named **Our retention of personal data** in the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). -## Manage enterprise diagnostic data level +## Diagnostic data settings -### Enterprise management +There are four diagnostic data collection settings. Each setting is described in more detail in the sections that follow. -Sharing diagnostic data with Microsoft is enabled by default on Windows 10, 1903 and later. Sharing this data provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option. +- Diagnostic data off (Security) +- Required diagnostic data (Basic) +- Enhanced +- Optional diagnostic data (Full) -Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, in **Privacy** > **Diagnostics & feedback**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available. +Here’s a summary of the types of data that is included with each setting: -IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this article describes how to use group policy to configure levels and settings interface. +| | Diagnostic data off (Security) | Required (Basic) | Enhanced | Optional (Full) | +| --- | --- | --- | --- | --- | +| **Diagnostic data events** | No Windows diagnostic data sent. | Minimum data required to keep the device secure, up to date, and performing as expected. | Additional data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. | Additional data about the websites you browse, how Windows and apps are used and how they perform. This data also includes data about device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users.| +| **Crash Metadata** | N/A | Yes | Yes | Yes | +| **Crash Dumps** | N/A | No | Triage dumps only

              For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). | Full memory dumps

              For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). | +| **Diagnostic logs** | N/A | No | No | Yes | +| **Data collection** | N/A | 100% | Sampling applies | Sampling applies | -#### Manage your diagnostic data settings +### Diagnostic data off -Use the steps in this article to set and/or adjust the diagnostic data settings for Windows and Windows Server in your organization. +This setting was previously labeled as **Security**. When you configure this setting, no Windows diagnostic data is sent from your device. This is only available on Windows Server, Windows 10 Enterprise, and Windows 10 Education. If you choose this setting, devices in your organization will still be secure. -> [!IMPORTANT] -> These diagnostic data levels only apply to Windows and Windows Server components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Office 365 ProPlus](/deployoffice/privacy/overview-privacy-controls). +>[!NOTE] +> If your organization relies on Windows Update, the minimum recommended setting is **Required diagnostic data**. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. -The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server is **Enhanced**. +### Required diagnostic data -### Configure the diagnostic data level +Required diagnostic data, previously labeled as **Basic**, gathers a limited set of data that’s critical for understanding the device and its configuration. This data helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. -You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device. +This is the default setting for Windows 10 Education editions, as well as all desktop editions starting with Windows 10, version 1903. + +Required diagnostic data includes: + +- Basic device data that helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Servers in the ecosystem. Examples include: + + - Device attributes, such as camera resolution and display type + - Battery attributes, such as capacity and type + - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number + - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware + - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system + - Operating system attributes, such as Windows edition and virtualization state + - Storage attributes, such as number of drives, type, and size + +- Quality metrics that helps provide an understanding about how the Connected User Experiences and diagnostic data component is functioning, including % of uploaded events, dropped events, blocked events, and the last upload time. + +- Quality-related information that helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and app state change details, such as how much processor time and memory were used, and the total uptime for an app. + +- Compatibility data that helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems. + +- System data that helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. + +- A list of accessory device data, such as printers or external storage devices, that are connected to Windows devices and whether these devices will function after upgrading to a new version of the operating system. + +- Driver data that includes specific driver activity that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. + +- Information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses. + +### Enhanced diagnostic data + +>[!NOTE] +>We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). + +Enhanced diagnostic data includes data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. When you choose to send enhanced diagnostic data, required diagnostic data will always be included, and we collect the following additional information: + + - Operating system events that help to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. + + - Operating system app events resulting from Microsoft apps and management tools that were downloaded from the Microsoft Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. + + - Device-specific events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. + + - All crash dump types, except for heap dumps and full dumps. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). + + ### Optional diagnostic data + +Optional diagnostic data, previously labeled as **Full**, includes more detailed information about your device and its settings, capabilities, and device health. Optional diagnostic data also includes data about the websites you browse, device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users. When you choose to send optional diagnostic data, required diagnostic data will always be included, and we collect the following additional information: + + - Additional data about the device, connectivity, and configuration, beyond that collected under required diagnostic data. + + - Status and logging information about the health of operating system and other system components beyond what is collected under required diagnostic data. + + - App activity, such as which programs are launched on a device, how long they run, and how quickly they respond to input. + + - Browser activity, including browsing history and search terms, in Microsoft browsers (Microsoft Edge or Internet Explorer). + + - Enhanced error reporting, including the memory state of the device when a system or app crash occurs (which may unintentionally contain user content, such as parts of a file you were using when the problem occurred). Crash data is never used for Tailored experiences. + +>[!Note] +>Crash dumps collected in optional diagnostic data may unintentionally contain personal data, such as portions of memory from a document and a web page. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). + +## Manage enterprise diagnostic data + +Use the steps in this section to configure the diagnostic data settings for Windows and Windows Server in your organization. + +>[!IMPORTANT] +>These diagnostic data settings only apply to components, features, and apps that are considered a part of the Windows operating system. Third-party apps and other Microsoft apps, such as Microsoft Office, that customers install may also collect and send diagnostic data using their own controls. You should work with your app vendors to understand their diagnostic data policy, and how you can opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](https://docs.microsoft.com/deployoffice/privacy/overview-privacy-controls). If you would like to control Windows data collection that is not Windows diagnostic data, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). + +You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy or MDM. Use the appropriate value in the table below when you configure the management policy. -| Level | Value | +| Category | Value | | - | - | -| Security | **0** | -| Basic | **1** | -| Enhanced | **2** | -| Full | **3** | +|Diagnostic data off (Security) | 0 | +| Required (Basic) | 1 | +| Enhanced | 2 | +|Optional (Full) | 3 | - > [!NOTE] - > When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used. +>[!Note] +>When both the Computer Configuration policy and User Configuration policies are set, the more restrictive policy is used. -### Use Group Policy to set the diagnostic data level +### Use Group Policy to manage diagnostic data collection -Use a Group Policy object to set your organization’s diagnostic data level. +You can use Group Policy to set your organization’s diagnostic data setting: -1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. +1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. 2. Double-click **Allow Telemetry**. -3. In the **Options** box, select the level that you want to configure, and then click **OK**. - -### Use MDM to set the diagnostic data level - -Use the [Policy Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy. - -### Use Registry Editor to set the diagnostic data level - -Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting. - -1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection**. - -2. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**. - -3. Type **AllowTelemetry**, and then press ENTER. - -4. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.** - -5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization. - -### Additional diagnostic data controls - -There are a few more settings that you can turn off that may send diagnostic data information: - -- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](https://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](https://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/). - -- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**. - -- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716). - -- Turn off **Improve inking and typing** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. - > [!NOTE] - > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. + > If devices in your organization are running Windows 10, 1803 and newer, the user can still use Settings to set the diagnostic data setting to a more restrictive value, unless the **Configure diagnostic data opt-in settings user interface** policy is set. -## Diagnostic data levels +3. In the **Options** box, choose the setting that you want to configure, and then click **OK**. -These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server. +### Use MDM to manage diagnostic data collection -### Security level +Use [Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy. -The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions. +## Limit optional diagnostic data for Desktop Analytics -> [!NOTE] -> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. +For more information about how to limit the diagnostic data to the minimum required by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/enable-data-sharing). -Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered. +## Change privacy settings on a single server -The data gathered at this level includes: +You can also change the privacy settings on a server running either the Azure Stack HCI operating system or Windows Server. For more information, see [Change privacy settings on individual servers](https://docs.microsoft.com/azure-stack/hci/manage/change-privacy-settings). -- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). - -- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. - - > [!NOTE] - > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716). - -- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. - - > [!NOTE] - > This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender). - - Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates. - -For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity. - -No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time. - -### Basic level - -The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent. - -This is the default level for Windows 10 Education editions, as well as all desktop editions starting with Windows 10, version 1903. - -The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device. - -The data gathered at this level includes: - -- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Servers in the ecosystem. Examples include: - - - Device attributes, such as camera resolution and display type - - - Internet Explorer version - - - Battery attributes, such as capacity and type - - - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number - - - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware - - - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system - - - Operating system attributes, such as Windows edition and virtualization state - - - Storage attributes, such as number of drives, type, and size - -- **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time. - -- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app. - -- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems. - - - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage. - - - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade. - - - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. - - - **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system. - - - **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. - -- **Microsoft Store**. Provides information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses. - - -### Enhanced level - -The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. - -This level is needed to quickly identify and address Windows and Windows Server quality issues. - -The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device. - -The data gathered at this level includes: - -- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. - -- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. - -- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. - -- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps. - -If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue. - -### Full level - -The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the Basic, Enhanced, and Security levels. - -Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level. - -If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem. - -However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information: - -- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe. - -- Ability to get registry keys. - -- All crash dump types, including heap dumps and full dumps. - -> [!NOTE] -> Crash dumps collected at this diagnostic data level may unintentionally contain personal data, such as portions of memory from a documents, a web page, etc. - -## Limit Enhanced diagnostic data to the minimum required by Windows Analytics - -Windows Analytics Device Health reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. In the past, organizations sending **Enhanced** or **Full** level diagnostic data were able to participate in Device Health. However, organizations that required detailed event and field level documentation were unable to move from **Basic** to **Enhanced**. - -In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic. - -- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic. - -- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode. - ->[!NOTE] -> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump. - -### Enable limiting enhanced diagnostic data to the minimum required by Windows Analytics - -1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM. - - a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**. - - -OR- - - b. Using MDM, use the Policy CSP to set the **System/AllowTelemetry** value to **2**. - - -AND- - -2. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM. - - a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**. - - -OR- - - b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**. - -## Additional resources - -FAQs - -- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy) -- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) -- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy) -- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy) -- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) -- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq) -- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) -- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) -- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization) - -Blogs - -- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) - -Privacy Statement - -- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) - -TechNet - -- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) - -Web Pages - -- [Privacy at Microsoft](https://privacy.microsoft.com) +To manage privacy settings in your enterprise as a whole, see [Manage enterprise diagnostic data](#manage-enterprise-diagnostic-data). diff --git a/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md b/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md new file mode 100644 index 0000000000..20b56e6e79 --- /dev/null +++ b/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md @@ -0,0 +1,324 @@ +--- +title: Data processor service for Windows Enterprise public preview terms +description: Use this article to understand Windows public preview terms of service. +keywords: privacy, GDPR +ms.localizationpriority: high +ROBOTS: NOINDEX, NOFOLLOW +ms.prod: w10 +ms.topic: article +f1.keywords: +- NOCSH +ms.author: siosulli +author: DaniHalfin +manager: dansimp +audience: itpro +ms.collection: +- GDPR +- M365-security-compliance +--- + +# Data processor service for Windows Enterprise public preview terms + +**These terms (“Terms”) must be read and accepted by a tenant admin with appropriate access rights and authority. By participating in this public preview, you: (a) agree to the following Terms, and (b) represent and warrant that you have such rights and authority.** + +These Terms govern your use of the preview described below (“**Preview**”). In order to access the Preview, you must be a current Microsoft Windows customer with an Azure Active Directory (“**AAD**”) subscription. The Preview consists of features and services that are in preview, beta, or other pre-release form for use with Windows and AAD. + + 1. **Definitions**. The following terms have the following meanings: + + 1. "**Customer Data**" means all data, including all text, sound, video, or image files that are provided to Microsoft by, or on behalf of, you through your use of Windows or AAD. + + 2. "**Feedback**" means, collectively, suggestions, comments, feedback, ideas, or know-how, in any form, that you or your users provide to Microsoft about Microsoft’s business, products, or services. + + 3. "**Personal Data**" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. + + 4. "**Preview Data**" means all data, including all text, sound, video, or image files that are provided to Microsoft by, or on behalf of, you through use of the Services. + + 5. "**Subprocessor**" means other processors used by Microsoft to process Personal Data. + +2. **Scope of Services**. The Preview is for a service that enables organizations to become controllers of Windows diagnostic data on supported versions of Windows, with Microsoft operating as processor of the data (collectively, the “**_Services_**”). You will collaborate with Microsoft in order to provide Microsoft the ability to enable the Services for you. To access the Services, you will need to configure participating Windows devices; Microsoft will assist you in such configuration via documentation or other communications. + +3. **Intellectual Property**. + + 1. **License Grant**. During the term of this Preview (“**Term**”), Microsoft grants you and authorized users in your tenant for Windows a non-exclusive, non-transferable, non-sublicensable right and license to access and use the Services in accordance with these Terms. + + 2. **Use Terms**. These Terms supersede any Microsoft terms and conditions or other agreement. You acknowledge that (i) the Services may not work correctly or in the manner that a commercial service may function; Microsoft may change the Services for the final, commercial version or choose not to release a commercial version; (ii) Microsoft may not provide support for the Services; (iii) the Online Services Terms (OST), including any obligations Microsoft may have regarding Customer Data, do not apply to the Services or Preview Data; (iv) Microsoft has no obligation to hold, export, or return Preview Data, except as described in these Terms; (v) Microsoft has no liability for the deletion of Preview Data, except as described in these Terms; and (vi) you may lose access to the Services and Preview Data after the Term. + + 3. **Acceptable Use**. Neither you, nor those that access the Services through you, may: (a) use the Services: (i) in a way prohibited by law, regulation, governmental order or decree; (ii) to violate the rights of others; (iii) to try to gain unauthorized access to or disrupt any service, device, data, account or network; (iv) to spam or distribute malware; or (v) in a way that could harm the Services or impair anyone else’s use of it; or (b) reverse engineer, decompile, disassemble, or work around any technical limitations in the Services, or use the Services to create a competing product. You are responsible for responding to any third-party request regarding your use of the Services or Preview Data, such as a request to take down Preview Data under the U.S. Digital Millennium Copyright Act or other applicable laws. + + 4. **Data Collection, Use and Location**. The Microsoft Privacy Statement https://privacy.microsoft.com/privacystatement applies to the collection, use and location of Preview Data. In the event of a conflict between Privacy Statement and the terms of these Terms, the terms of these Terms will control. + +4. **Confidentiality**. The following confidentiality terms apply to the Preview: + + 1. During the Term plus 5 years, the parties will hold in strictest confidence and not use or disclose to any third party any Confidential Information of the other party. “Confidential Information” means all non-public information a party designates in writing or orally as being confidential, or which under the circumstances of disclosure ought to be treated as confidential. Confidential Information includes information relating to:

              + 1. a party’s released or unreleased software or hardware products;

              + 2. a party’s source code;

              + 3. a party’s product marketing or promotion;

              + 4. a party’s business policies or practices;

              + 5. a party’s customers or suppliers;

              + 6. information received from others that a party must treat as confidential; and

              + 7. information provided, obtained, or created by a party under these Terms, including: + * information in reports; + * the parties’ electronic or written correspondence, customer lists and customer information, regardless of source; + * Personal Data; and + * Transactional, sales, and marketing information. + + 2. A party will consult with the other if it questions what comprises Confidential Information. Confidential Information excludes information (i) known to a party before the disclosing party’s disclosure to the receiving party, (ii) information publicly available through no fault of the receiving party, (iii) received from a third party without breach of an obligation owed to the disclosing party, or (iv) independently developed by a party without reference to or use of the disclosing party’s Confidential Information. + + 3. Each party will employ security procedures to prevent disclosure of the other party’s Confidential Information to unauthorized third parties. The receiving party’s security procedures must include risk assessment and controls for:

              + 1. system access;

              + 2. system and application development and maintenance;

              + 3. change management;

              + 4. asset classification and control;

              + 5. incident response, physical and environmental security;

              + 6. disaster recovery/business continuity; and

              + 7. employee training. + +5. **Data Protection.** + + **Generally**. To the extent Microsoft is a processor of Personal Data, the General Data Protection Regulation (GDPR) Terms in Attachment 1 govern that processing and the parties also agree to the following terms: + + 1. Processing Details: The parties agree that: + * The subject-matter of the processing is limited to Personal Data within the scope of the GDPR; + * The duration of the processing shall be for the duration of your right to use the Services and until all Personal Data is deleted or returned in accordance with your instructions or these Terms; + * The nature and purpose of the processing shall be to provide the Services pursuant to these Terms; + * The types of Personal Data processed by the Services include those expressly identified in Article 4 of the GDPR to the extent included by Preview Data; and + * The categories of data subjects are your representatives and end users, such as employees, contractors, collaborators, and customers. + + 2. Data Transfers: + * Preview Data and Personal Data that Microsoft processes on your behalf may be transferred to, and stored and processed in, the United States or any other country in which Microsoft or its Subprocessors operate. You appoint Microsoft to perform any such transfer of Preview Data and Personal Data to any such country and to store and process Preview Data and Personal Data to provide the Services. + * All transfers of Preview Data and Personal Data out of the European Union, European Economic Area, United Kingdom, and Switzerland to provide the Online Services shall be governed by the Standard Contractual Clauses in Attachment 2. + * Microsoft will abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention, and other processing of Personal Data from the European Economic Area and Switzerland. All transfers of Personal Data to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR. + * In addition, Microsoft is certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and the commitments they entail. Microsoft agrees to notify you in the event that it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Privacy Shield principles. + +6. **No Support or Incident Response.** Microsoft will have no obligation under these Terms to correct any bugs, defects or errors in the Services or AAD, provide any updates, upgrades or new releases, or otherwise provide any technical support or maintenance for any Services or AAD. You will make reasonable efforts to promptly report to Microsoft any defects you find in the Services, as an aid to creating improved revisions of the Services. Microsoft will have no obligation under these Terms to provide you with incident response as part of the Services. + +7. **Term and Termination.** The term of the Preview begins when you accept these Terms and continues until: (a) either party terminates this Preview by providing the other party: (i) 2 days’ notice for any reason (or no reason), or (ii) notice of such party’s breach of these Terms and such party fails to cure within 15 days, or (b) upon the general availability of the Services. When the Term ends, you will no longer have access to the Services, and Microsoft will no longer have the rights to access Customer Data granted herein. Each party will, on request, return or destroy the other’s Confidential Information provided under the Preview. + +8. **Feedback.** Providing Feedback is voluntary. Microsoft is under no obligation to post or use any Feedback. By providing Feedback to Microsoft, you (and anyone providing Feedback through your use of the Preview) irrevocably and perpetually grant to Microsoft and its affiliates, under all of its (and their) owned or controlled intellectual property rights, a worldwide, non-exclusive, fully paid-up, royalty-free, transferable, sub-licensable right and license to make, use, reproduce, prepare derivative works based upon, distribute, publicly perform, publicly display, transmit, and otherwise commercialize the Feedback (including by combining or interfacing products, services or technologies that depend on or incorporate Feedback with other products, services or technologies of Microsoft or others), without attribution in any way and for any purpose. You warrant that (a) you will not provide Feedback that is subject to a license requiring Microsoft to license anything to third parties because Microsoft exercises any of the above rights in your Feedback; and (b) you own or otherwise control all of the rights to such Feedback and that no such Feedback is subject to any third-party rights (including any personality or publicity rights). + +9. **Representations and Warranties; Limitation of Liability.** + + 1. **By the Parties.** Each party represents and warrants to the other party that (a) it has all necessary rights, title, and authority to enter into and perform under these Terms; (b) its performance under these Terms will not breach any agreement with a third party; and (c) it will comply with any and all laws, rules, and regulations that are applicable to its performance under these Terms. + + 2. **Disclaimer.** EXCEPT AS OTHERWISE PROVIDED IN THESE TERMS AND TO THE EXTENT APPLICABLE LAW PERMITS, MICROSOFT (a) PROVIDES THE SERVICES AS-IS; (b) PROVIDES NO WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE; AND (c) DOES NOT GUARANTEE THAT THE SERVICES WILL BE AVAILABLE, UNINTERRUPTED, OR ERROR-FREE, OR THAT LOSS OF PREVIEW DATA WILL NOT OCCUR. + + 3. **Limitation of Liability.** Except as otherwise described in this Section 9, the only remedy either party has for claims relating to these Terms or participation in the Preview is to terminate these Terms or your participation in the Preview. NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY FOR ANY DAMAGES, INCLUDING DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR DAMAGES FOR LOST REVENUE, LOST PROFIT, LOST BUSINESS INFORMATION, OR BUSINESS INTERRUPTION, EVEN IF THE PARTY KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES. The limitations in this Section 9 do not apply to claims arising from any breach of confidentiality obligations under Section 4. + +10. **General.** + + 1. **Non-Exclusivity.** These Terms are nonexclusive. These Terms do not restrict either party from entering into the same or similar arrangement with any third party. + + 2. **Jurisdiction and Governing Law.** The laws of the State of Washington, excluding conflicts of law provisions, govern these Terms. If federal jurisdiction exists, then each party consents to exclusive jurisdiction and venue in the federal courts in King County, Washington. If no federal jurisdiction exists, then each party consents to exclusive jurisdiction and venue in the Superior Court of King County, Washington. + + 3. **Force Majeure.** A party will not be liable for failure to perform an obligation under these Terms to the extent that failure is due to a cause beyond that party’s reasonable control, including natural disaster, war, civil disturbance, or governmental action. + + 4. **Attorneys’ fees.** If a party employs attorneys to enforce any rights arising out of or relating to these Terms, the prevailing party will be entitled to recover its reasonable attorneys’ fees, costs, and other expenses. + + 5. **Assignment**. You may not assign these Terms or delegate any of your rights or obligations under these Terms to a third party without Microsoft’s prior written consent. + + 6. **Entire Agreement.** These Terms are the entire agreement between the parties regarding its subject matter and replaces all prior agreements, communications, and representations between the parties regarding its subject matter. + + 7. **Survival.** Sections 3.b, 4, 7 (with respect to post-termination obligations), and 8-10 will survive these Terms’ expiration or termination.

              + +

              + Attachment 1: GDPR Terms
              + +For purposes of these GDPR Terms, you and Microsoft agree that you are the controller of Personal Data and Microsoft is the processor of such data, except when you act as a processor of Personal Data, in which case Microsoft is a subprocessor. These GDPR Terms apply to the processing of Personal Data, within the scope of the GDPR, by Microsoft on your behalf. These GDPR Terms do not limit or reduce any data protection commitments Microsoft makes to you in other agreement between Microsoft and you. These GDPR Terms do not apply where Microsoft is a controller of Personal Data. + +**Relevant GDPR Obligations: Articles 28, 32, and 33** + +1. Microsoft shall not engage another processor without prior specific or your general written authorization. In the case of general written authorization, Microsoft shall inform you of any intended changes concerning the addition or replacement of other processors, thereby giving you the opportunity to object to such changes. (Article 28(2)) +2. Processing by Microsoft shall be governed by these GDPR Terms under European Union (hereafter “Union”) or Member State law and are binding on Microsoft with regard to you. The subject-matter and duration of the processing, the nature and purpose of the processing, the type of Personal Data, the categories of data subjects and your obligations and rights are set forth in the Terms above, including these GDPR Terms. In particular, Microsoft shall: + + 1. process the Personal Data only on your documented instructions, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by Union or Member State law to which Microsoft is subject; in such a case, Microsoft shall inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; + + 2. ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; + + 3. take all measures required pursuant to Article 32 of the GDPR; + + 4. respect the conditions referred to in paragraphs 1 and 3 for engaging another processor; + + 5. taking into account the nature of the processing, assist you by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR; + + 6. assist you in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Microsoft; + + 7. at your choice, delete or return all the Personal Data to you after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the Personal Data; + + 8. make available to you all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you. + + 9. immediately inform you if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. (Article 28(3)) + +3. Where Microsoft engages another processor for carrying out specific processing activities on your behalf, the same data protection obligations as set out in these GDPR Terms shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR. Where that other processor fails to fulfil its data protection obligations, Microsoft shall remain fully liable to you for the performance of that other processor's obligations. (Article 28(4)) + +4. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, you and Microsoft shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: + + 1. the pseudonymisation and encryption of Personal Data; + + 2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; + + 3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and + + 4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. (Article 32(1)) + +5. In assessing the appropriate level of security, account shall be taken of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise processed. (Article 32(2)) + +6. You and Microsoft shall take steps to ensure that any natural person acting under your authority or Microsoft’s who has access to Personal Data does not process them except on instructions from you, unless he or she is required to do so by Union or Member State law. (Article 32(4)) + +7. Microsoft shall notify you without undue delay after becoming aware of a personal data breach. (Article 33(2)). Such notification will include that information a processor must provide to a controller under Article 33(3) to the extent such information is reasonably available to Microsoft. + +

              + Attachment 2 – The Standard Contractual Clauses (Processors)
              + +In countries where regulatory approval is required for use of the Standard Contractual Clauses, the Standard Contractual Clauses cannot be relied upon under European Commission 2010/87/EU (of February 2010) to legitimize export of data from the country, unless Customer has the required regulatory approval. +Beginning May 25, 2018 and thereafter, references to various Articles from the Directive 95/46/EC in the Standard Contractual Clauses below will be treated as references to the relevant and appropriate Articles in the GDPR. +For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, Customer (as data exporter) and Microsoft Corporation (as data importer, whose signature appears below), each a “party,” together “the parties,” have agreed on the following Contractual Clauses (the “Clauses” or “Standard Contractual Clauses”) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1. + +**Clause 1: Definitions** + +1. 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; +1. 'the data exporter' means the controller who transfers the personal data; +1. 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC; +1. 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract; +1. 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established; +1. 'technical and organizational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing. + +**Clause 2: Details of the transfer** + +The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 below which forms an integral part of the Clauses. + +**Clause 3: Third-party beneficiary clause** + +1. The data subject can enforce against the data exporter this Clause, Clause 4(2) to (9), Clause 5(1) to (5), and (7) to (10), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary. +2.1.exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. +1. The data subject can enforce against the subprocessor this Clause, Clause 5(1) to (5) and (7), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses. +1. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law. + +**Clause 4: Obligations of the data exporter** + +The data exporter agrees and warrants: + +1. that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State; +1. that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses; +1. that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 below; +1. that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation; +1. that it will ensure compliance with the security measures; +1. that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC; +1. to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(2) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension; +1. to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information; +1. that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and +1. that it will ensure compliance with Clause 4(1) to (9). + +**Clause 5: Obligations of the data importer** + +The data importer agrees and warrants: + +1. to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; +1. that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; +1. that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred; +1. that it will promptly notify the data exporter about: + 1. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation, + 1. any accidental or unauthorised access, and + 1. any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so; +1. to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; +1. at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; +1. to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; +1. that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent; +1. that the processing services by the subprocessor will be carried out in accordance with Clause 11; and +1. to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter. + +**Clause 6: Liability** + +1. The parties agree that any data subject who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered. +1. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity. +The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities. +1. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses. + +**Clause 7: Mediation and jurisdiction** + +1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject: + 1. to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority; + 1. to refer the dispute to the courts in the Member State in which the data exporter is established. +1. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law. + +**Clause 8: Cooperation with supervisory authorities** + +1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law. +1. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law. +1. The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (2). + +**Clause 9: Governing Law** + +The Clauses shall be governed by the law of the Member State in which the data exporter is established. + +**Clause 10: Variation of the contract** + +The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause. + +**Clause 11: Subprocessing** + +1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement. +1. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses. +1. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established. +1. The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority. + +**Clause 12: Obligation after the termination of personal data processing services** + +1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. +1. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1. + +**Appendix 1 to the Standard Contractual Clauses** + +**Data exporter**: Customer is the data exporter. The data exporter is a user of the Services. + +**Data importer**: The data importer is MICROSOFT CORPORATION, a global producer of software and services. + +**Data subjects**: Data subjects include the data exporter’s representatives and end-users including employees, contractors, collaborators, and customers of the data exporter. Data subjects may also include individuals attempting to communicate or transfer personal information to users of the services provided by data importer. Microsoft acknowledges that, depending on Customer’s use of the Services, Customer may elect to include personal data from any of the following types of data subjects in the personal data: + +* Employees, contractors and temporary workers (current, former, prospective) of data exporter; +* Dependents of the above; +* Data exporter's collaborators/contact persons (natural persons) or employees, contractors or temporary workers of legal entity collaborators/contact persons (current, prospective, former); +* Users (e.g., customers, clients, patients, visitors, etc.) and other data subjects that are users of data exporter's services; +* Partners, stakeholders or individuals who actively collaborate, communicate or otherwise interact with employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter; +* Stakeholders or individuals who passively interact with data exporter (e.g., because they are the subject of an investigation, research or mentioned in documents or correspondence from or to the data exporter); +* Minors; or +* Professionals with professional privilege (e.g., doctors, lawyers, notaries, religious workers, etc.). + +**Categories of data**: The personal data transferred that is included in data processed by the Services. Microsoft acknowledges that, depending on Customer’s use of the Services, Customer may elect to include personal data from any of the following categories in the personal data: + +* Basic personal data (for example place of birth, street name and house number (address), postal code, city of residence, country of residence, mobile phone number, first name, last name, initials, email address, gender, date of birth), including basic personal data about family members and children; +* Authentication data (for example user name, password or PIN code, security question, audit trail); +* Contact information (for example addresses, email, phone numbers, social media identifiers; emergency contact details); +* Unique identification numbers and signatures (for example Social Security number, bank account number, passport and ID card number, driver's license number and vehicle registration data, IP addresses, employee number, student number, patient number, signature, unique identifier in tracking cookies or similar technology); +* Pseudonymous identifiers; +* Financial and insurance information (for example insurance number, bank account name and number, credit card name and number, invoice number, income, type of assurance, payment behavior, creditworthiness); +* Commercial Information (for example history of purchases, special offers, subscription information, payment history); +* Biometric Information (for example DNA, fingerprints and iris scans); +* Location data (for example, Cell ID, geo-location network data, location by start call/end of the call. Location data derived from use of wifi access points); +* Photos, video and audio; +* Internet activity (for example browsing history, search history, reading, television viewing, radio listening activities); +* Device identification (for example IMEI-number, SIM card number, MAC address); +* Profiling (for example based on observed criminal or anti-social behavior or pseudonymous profiles based on visited URLs, click streams, browsing logs, IP-addresses, domains, apps installed, or profiles based on marketing preferences); +* HR and recruitment data (for example declaration of employment status, recruitment information (such as curriculum vitae, employment history, education history details), job and position data, including worked hours, assessments and salary, work permit details, availability, terms of employment, tax details, payment details, insurance details and location and organizations); +* Education data (for example education history, current education, grades and results, highest degree achieved, learning disability); +* Citizenship and residency information (for example citizenship, naturalization status, marital status, nationality, immigration status, passport data, details of residency or work permit); +* Information processed for the performance of a task carried out in the public interest or in the exercise of an official authority; +* Special categories of data (for example racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person’s sex life or sexual orientation, or data relating to criminal convictions or offences); or +* Any other personal data identified in Article 4 of the GDPR. + +**Processing operations**: The personal data transferred will be subject to the following basic processing activities: + +1. **Duration and Object of Data Processing**. The duration of data processing shall be for the term of the Preview. The objective of the data processing is the performance of the Services. +1. **Scope and Purpose of Data Processing**. The scope and purpose of processing personal data is described in Section 5 of this agreement. The data importer operates a global network of data centers and management/support facilities, and processing may take place in any jurisdiction where data importer or its sub-processors operate such facilities. +1. **Customer Data and Personal Data Access**. For the term designated under the applicable volume licensing agreement data importer will at its election and as necessary under applicable law implementing Article 12(b) of the EU Data Protection Directive, either: (1) provide data exporter with the ability to correct, delete, or block Customer Data and personal data, or (2) make such corrections, deletions, or blockages on its behalf. +1. **Data Exporter’s Instructions**. For Online Services and Professional Services, data importer will only act upon data exporter’s instructions as conveyed by Microsoft. +1. **Preview Data and Personal Data Deletion or Return**. Upon expiration or termination of data exporter’s use of the Services, it may extract Customer Data and personal data and data importer will delete Customer Data and personal data, each in accordance with the terms of this agreement. + +**Subcontractors**: In accordance with the DPA, the data importer may hire other companies to provide limited services on data importer’s behalf, such as providing customer support. Any such subcontractors will be permitted to obtain Customer Data and personal data only to deliver the services the data importer has retained them to provide, and they are prohibited from using Customer Data and personal data for any other purpose. + +**Appendix 2 to the Standard Contractual Clauses** + +Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(4) and 5(3): + +1. **Personnel**. Data importer’s personnel will not process Preview Data or personal data without authorization. Personnel are obligated to maintain the confidentiality of any such Preview Data and personal data and this obligation continues even after their engagement ends. +2. **Data Privacy Contact**. The data privacy officer of the data importer can be reached at the following address:
              Microsoft Corporation
              Attn: Chief Privacy Officer
              1 Microsoft Way
              Redmond, WA 98052 USA +3. **Technical and Organization Measures**. The data importer has implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines intended to protect Preview Data and personal data, as defined in Attachment 1 of this agreement, against accidental loss, destruction, or alteration; unauthorized disclosure or access; or unlawful destruction as follows: The technical and organizational measures, internal controls, and information security routines set forth in Attachment 1 of this agreement are hereby incorporated into this Appendix 2 by this reference and are binding on the data importer as if they were set forth in this Appendix 2 in their entirety. diff --git a/windows/privacy/deploy-data-processor-service-windows.md b/windows/privacy/deploy-data-processor-service-windows.md new file mode 100644 index 0000000000..76db1e584d --- /dev/null +++ b/windows/privacy/deploy-data-processor-service-windows.md @@ -0,0 +1,96 @@ +--- +title: Technical Deployment of the data processor service for Windows Enterprise +description: Use this article to understand how to deploy and manage the data processor service for Windows Enterprise. +keywords: privacy, GDPR +ms.localizationpriority: high +ROBOTS: NOINDEX, NOFOLLOW +ms.prod: w10 +ms.topic: article +f1.keywords: +- NOCSH +ms.author: siosulli +author: DaniHalfin +manager: dansimp +audience: itpro +ms.collection: +- GDPR +- M365-security-compliance +--- + +# Data processor service for Windows Enterprise Overview + +>[!NOTE] +>This topic is intended for participants in the data processor service for Windows Enterprise preview program and requires acceptance of specific terms of use. To learn +more about the program and agree to the terms of use, see [https://aka.ms/WindowsEnterprisePublicPreview](https://aka.ms/WindowsEnterprisePublicPreview). + +The privacy landscape keeps evolving, and with it, we make changes to our services to meet our customers’ needs. +The data processor service for Windows Enterprise empowers you to be in control of diagnostic data from Windows devices, and act as data controllers for that data, under the definition of the European Union General Data Protection Regulation (GDPR). + +The data processor service for Windows Enterprise will serve as a foundation for other Microsoft services that use Windows diagnostic data. + +The data processor service for Windows Enterprise offering enables you to store and manage your Windows diagnostic data in the cloud, on top of an end-to-end data platform designed and built with compliance in mind, to help you meet your compliance obligations. +Your data is routed and stored inside an enterprise compliance boundary, operating under a prescriptive and focused set of compliance requirements, in accordance with industry standards. + +The data processor service for Windows Enterprise provides you with controls that help respond to delete data subject requests (DSRs) on diagnostic data, at user account closure, for a specific Azure AD User ID. Additionally, you’re able to execute an export DSR for a specific Azure AD User ID. +Should you desire so, Microsoft will accommodate a data processor service for Windows Enterprise tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for diagnostic data, but still wish to remain an Azure customer. + +>[!Note] +>Tenant account closure will lead to the deletion of all data associated with that tenant. + +## Deployment of data processor service for Windows Enterprise +Use the instructions below to easily manage the data processor service for Windows Enterprise using a single setting, through Group Policy, or an MDM solution, in Windows 10, version 1809 or Windows Server 2019 and newer. + +### Prerequisites +#### Versions supported +The data processor service for Windows Enterprise is currently supported on Windows 10, version 1809, and newer versions. + +#### Network requirements +The following endpoints need to be reachable from devices enrolled into the data processor service for Windows Enterprise: + + login.live.com + + cy2.vortex.data.microsoft.com.akadns.net + + v10.events.data.microsoft.com + + v10.vortex-win.data.microsoft.com/collect/v1 + +For additional information, see the “device authentication” and “diagnostic data” sections in the endpoint articles for each respective Windows version: + +[Windows 10, version 1809 endpoints](https://docs.microsoft.com/Windows/privacy/manage-Windows-1809-endpoints) + +[Windows 10, version 1903 endpoints](https://docs.microsoft.com/Windows/privacy/manage-Windows-1903-endpoints) + +### Deploying data processor service for Windows Enterprise +You can use either Group Policy or an MDM solution to deploy the data processor service for Windows Enterprise to your supported devices. + +In Group Policy, to enable data collection through the data processor service for Windows Enterprise, go to **Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds** and switch the **Allow commercial data pipeline** setting to **enabled**. + +If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. + +To use an MDM solution, such as [Microsoft Intune](https://docs.microsoft.com/intune/custom-settings-Windows-10), to deploy the data processor service for Windows Enterprise to your supported devices, use the following custom OMA-URI setting configuration: + +- **Name:** System/AllowCommercialDataPipeline +- **OMA-URI:** ./Vendor/MSFT/Policy/Config/System/AllowCommercialDataPipeline +- **Data type:** Integer + +Under **Value**, use **1** to enable the service. + +If you wish to disable, at any time, switch the same setting to **0** to disable. The default is **0**. + +>[!Note] +>Data collected from a device, before it was enrolled into the data processor service for Windows Enterprise, will not be moved into the enterprise compliance boundary. + +## Managing data processor service for Windows Enterprise +### Executing user-based data subject requests (DSRs) +To perform user-based DSRs, the data processor service for Windows Enterprise requires your organization to be reflected in Azure AD. + +If your environment is cloud-only and managed in Azure, or all your devices are Azure AD joined - you don’t need to take any further action. + +If your environment uses on-premises Active Directory to manage identities - Azure AD Connect synchronization is required, and your environment needs to be configured for hybrid Azure AD join. +To learn more, visit [How To: Plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) and [Azure AD Connect sync: Understand and customize synchronization](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-whatis). + +Once you have Azure AD join or hybrid Azure AD join in place, you can learn more about executing user-based DSRs, by visiting this [page](https://review.docs.microsoft.com/microsoft-365/compliance/gdpr-dsr-windows?branch=siosulli-wps&view=o365-worldwide). + +## Geo-location +Windows Diagnostic Data collected through the data processor service for Windows Enterprise is hosted in our datacenter in the United States. \ No newline at end of file diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index 6f5daf90d1..c70d65a6ce 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -21,8 +21,7 @@ ms.reviewer: **Applies to** -- Windows 10, version 1809 -- Windows 10, version 1803 +- Windows 10, version 1803 and newer ## Introduction The Diagnostic Data Viewer is a Windows app that lets you review the Windows diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft. @@ -42,10 +41,10 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn ![Location to turn on data viewing](images/ddv-data-viewing.png) ### Download the Diagnostic Data Viewer -Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. +Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. - >[!Important] - >It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2023830). +> [!Important] +> It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2094264). ### Start the Diagnostic Data Viewer You can start this app from the **Settings** panel. @@ -118,17 +117,15 @@ When you're done reviewing your diagnostic data, you should turn of data viewing ## Modifying the size of your data history By default, Diagnostic Data Viewer shows you up to 1GB or 30 days of data (whichever comes first) for Windows diagnostic data. Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first. - >[!Important] - >Note that if you have [Office diagnostic data viewing enabled](#view-office-diagnostic-data), the Office data history is fixed at 1 GB and cannot be modified. +> [!Important] +> Note that if you have [Office diagnostic data viewing enabled](#view-office-diagnostic-data), the Office data history is fixed at 1 GB and cannot be modified. **Modify the size of your data history** - To make changes to the size of your Windows diagnostic data history, visit the **app settings**, located at the bottom of the navigation menu. Data will be incrementally dropped with the oldest data points first once your chosen size or time limit is reached. +To make changes to the size of your Windows diagnostic data history, visit the **app settings**, located at the bottom of the navigation menu. Data will be incrementally dropped with the oldest data points first once your chosen size or time limit is reached. - >[!Important] - >Decreasing the maximum amount of diagnostic data viewable through the tool will remove all data history and requires a reboot of your device. Additionally, increasing the maximum amount of diagnostic data viewable by the tool may come with performance impacts to your machine. - - ![Change the size of your data history through the app settings](images/ddv-change-db-size.png) +> [!Important] +> Decreasing the maximum amount of diagnostic data viewable through the tool will remove all data history and requires a reboot of your device. Additionally, increasing the maximum amount of diagnostic data viewable by the tool may come with performance impacts to your machine. ## View additional diagnostic data in the View problem reports tool Available on Windows 1809 and higher, you can review additional Windows Error Reporting diagnostic data in the **View problem reports** page within the Diagnostic Data Viewer. @@ -152,3 +149,20 @@ The **Review problem reports** tool opens, showing you your Windows Error Report ![View problem reports tool with report statuses](images/control-panel-problem-reports-screen.png) +## Known Issues with Diagnostic Data Viewer + +### Microsoft Edge diagnostic data appearing as a blob of text + +**Applicable to:** The new Microsoft Edge (v. 79.x.x.x or higher) + +**Issue:** In some cases, diagnostic data collected and sent from the New Microsoft Edge fails to be translated by the decoder. When decoding fails, the data appears as a blob of text in the Diagnostic Data Viewer. We are working on a fix for this issue. + +**Workaround:** + +- Restart your computer and open Diagnostic Data Viewer. + +*OR* + +- Restart the *DiagTrack* service, through the Services tab in task manager, and open Diagnostic Data Viewer. + +**Background:** Some of the diagnostic data collected from the new Microsoft Edge is sent using a Protocol Buffers (protobuf) to reduce network bandwidth and to improve data transfer efficiency. Diagnostic Data Viewer has a decoding capability to translate this protobuf format into human readable text. Due to a bug, sometimes the decoder fails to translate these protobuf messages and hence some of the New Microsoft Edge diagnostic data will appear as a blob of encoded text. \ No newline at end of file diff --git a/windows/privacy/docfx.json b/windows/privacy/docfx.json index 55e655b1dc..0f24cde486 100644 --- a/windows/privacy/docfx.json +++ b/windows/privacy/docfx.json @@ -33,6 +33,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", @@ -40,11 +41,12 @@ "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "MSDN.privacy", - "folder_relative_path_in_docset": "./" - } - } + "./": { + "depot_name": "MSDN.privacy", + "folder_relative_path_in_docset": "./" + } + }, + "titleSuffix": "Windows Privacy" }, "fileMetadata": {}, "template": [], diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md index 29da582e50..4188fd5ad3 100644 --- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md +++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md @@ -1,6 +1,6 @@ --- -description: Use this article to learn more about the enhanced diagnostic data events used by Windows Analytics -title: Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics (Windows 10) +title: Enhanced diagnostic data required by Windows Analytics (Windows 10) +description: Use this article to learn more about the limit enhanced diagnostic data events policy used by Desktop Analytics keywords: privacy, diagnostic data ms.prod: w10 ms.mktglfcycl: manage @@ -18,19 +18,24 @@ ms.reviewer: --- -# Windows 10 enhanced diagnostic data events and fields used by Windows Analytics +# Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy **Applies to** - Windows 10, version 1709 and newer -Windows Analytics Device Health reports are powered by diagnostic data not included in the Basic level. This includes crash reports and certain OS diagnostic data events. Organizations sending Enhanced or Full level diagnostic data were able to participate in Device Health, but some organizations which required detailed event and field level documentation were unable to move from Basic to Enhanced. +> [!IMPORTANT] +> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported. +> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). -In Windows 10, version 1709, we introduce a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +Desktop Analytics reports are powered by diagnostic data not included in the Basic level. +In Windows 10, version 1709, we introduced a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only the events described below. The Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). + +With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data. ## KernelProcess.AppStateChangeSummary -This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Windows Analytics to gain insights into application reliability. +This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Desktop Analytics to gain insights into application reliability. The following fields are available: @@ -43,7 +48,7 @@ The following fields are available: - **GhostCount_Sum:** Total number of instances where the application stopped responding - **HandleCountAtExit_Sum:** Total handle count for a process when it exits - **HangCount_Max:** Maximum number of hangs detected -- **HangCount_Sum:** Total number of application hangs detected +- **HangCount_Sum:** Total number of application hangs that are detected - **HardFaultCountAtExit_Sum:** Total number of hard page faults detected for a process when it exits - **HeartbeatCount:** Heartbeats logged for this summary - **HeartbeatSuspendedCount:** Heartbeats logged for this summary where the process was suspended @@ -63,7 +68,7 @@ The following fields are available: - **WriteSizeInKBAtExit_Sum:** Total size of IO writes for a process when it exited ## Microsoft.Office.TelemetryEngine.IsPreLaunch -Applicable for Office UWP applications. This event is fired when an office application is initiated for the first-time post upgrade/install from the store. This is part of basic diagnostic data, used to track whether a particular session is launch session or not. +Applicable for Office UWP applications. This event is fired when an Office application is initiated for the first-time post upgrade/install from the store. It's part of basic diagnostic data. It's used to track whether a particular session is a launch session or not. - **appVersionBuild:** Third part of the version *.*.XXXXX.* - **appVersionMajor:** First part of the version X.*.*.* @@ -72,10 +77,10 @@ Applicable for Office UWP applications. This event is fired when an office appli - **SessionID:** ID of the session ## Microsoft.Office.SessionIdProvider.OfficeProcessSessionStart -This event sends basic information upon the start of a new Office session. This is used to count the number of unique sessions seen on a given device. This is used as a heartbeat event to ensure that the application is running on a device or not. In addition, it serves as a critical signal for overall application reliability. +This event sends basic information upon the start of a new Office session. It's used to count the number of unique sessions seen on a given device. The event is used as a heartbeat event to ensure that the application is running on a device. In addition, it serves as a critical signal for overall application reliability. -- **AppSessionGuid:** ID of the session which maps to the process of the application -- **processSessionId:** ID of the session which maps to the process of the application +- **AppSessionGuid:** ID of the session that maps to the process of the application +- **processSessionId:** ID of the session that maps to the process of the application ## Microsoft.Office.TelemetryEngine.SessionHandOff Applicable to Win32 Office applications. This event helps us understand whether there was a new session created to handle a user-initiated file open event. It is a critical diagnostic information that is used to derive reliability signal and ensure that the application is working as expected. @@ -84,7 +89,7 @@ Applicable to Win32 Office applications. This event helps us understand whether - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **childSessionID:** Id of the session that was created to handle the user initiated file open +- **childSessionID:** ID of the session that was created to handle the user initiated file open - **parentSessionId:** ID of the session that was already running ## Microsoft.Office.CorrelationMetadata.UTCCorrelationMetadata @@ -97,15 +102,15 @@ Collects Office metadata through UTC to compare with equivalent data collected t - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRevision:** Fourth part of the version *.*.*.XXXXX -- **audienceGroup:** Is this part of the insiders or production +- **audienceGroup:** Is this group part of the insiders or production? - **audienceId:** ID of the audience setting - **channel:** Are you part of Semi annual channel or Semi annual channel-Targeted? -- **deviceClass:** Is this a desktop or a mobile? +- **deviceClass:** Is this device a desktop device or a mobile device? - **impressionId:** What features were available to you in this session - **languageTag:** Language of the app - **officeUserID:** A unique identifier tied to the office installation on a particular device. - **osArchitecture:** Is the machine 32 bit or 64 bit? -- **osEnvironment:** Is this a win32 app or a UWP app? +- **osEnvironment:** Is this app a win32 app or a UWP app? - **osVersionString:** Version of the OS - **sessionID:** ID of the session @@ -126,7 +131,7 @@ This event is fired when the telemetry engine within an office application is re - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.FirstProcessed @@ -136,7 +141,7 @@ This event is fired when the telemetry engine within an office application has p - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.FirstRuleRequest @@ -146,7 +151,7 @@ This event is fired when the telemetry engine within an office application has r - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.Init @@ -156,18 +161,18 @@ This event is fired when the telemetry engine within an office application has b - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.Resume -This event is fired when the application resumes from sleep state. Used for understanding whether there are issues in the application life-cycle. +This event is fired when the application resumes from sleep state. Used for understanding whether there are issues in the application life cycle. - **appVersionBuild:** Third part of the version *.*.XXXXX.* - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session @@ -178,7 +183,7 @@ This event is fired when the telemetry engine within an office application fails - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.RuleRequestFailedDueToClientOffline @@ -188,7 +193,7 @@ This event is fired when the telemetry engine within an office application fails - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.ShutdownComplete @@ -199,7 +204,7 @@ This event is fired when the telemetry engine within an office application has p - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session @@ -210,7 +215,7 @@ This event is fired when the telemetry engine within an office application been - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session @@ -222,26 +227,26 @@ This event is fired when the telemetry engine within an office application has p - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session - **SuspendType:** Type of suspend ## Microsoft.Office.TelemetryEngine.SuspendStart -This event is fired when the office application suspends as per app life-cycle change. Used for understanding whether there are issues in the application life-cycle. +This event is fired when the office application suspends as per app life-cycle change. Used for understanding whether there are issues in the application life cycle. - **appVersionBuild:** Third part of the version *.*.XXXXX.* - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session - **SuspendType:** Type of suspend ## Microsoft.OSG.OSS.CredProvFramework.ReportResultStop -This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Windows Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices. +This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve sign-in reliability. Using this event with Desktop Analytics can help organizations monitor and improve sign-in success for different methods (for example, biometric) on managed devices. The following fields are available: @@ -257,11 +262,11 @@ The following fields are available: - **ReturnCode:** Output of the ReportResult function - **SessionId:** Session identifier - **Sign-in error status:** The sign-in error status -- **SubStatus:** Sign-in error sub-status +- **SubStatus:** Sign-in error substatus - **UserTag:** Count of the number of times a user has selected a provider ## Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to monitor reliability and performance of managed devices +This event denotes the transition between operating system states (On, Off, Sleep, etc.). By using this event with Desktop Analytics, organizations can monitor reliability and performance of managed devices. The following fields are available: @@ -276,10 +281,10 @@ The following fields are available: - **EnergyChangeV2Flags:** Flags for disambiguating EnergyChangeV2 context - **EventSequence:** A sequential number used to evaluate the completeness of the data - **LastStateTransition:** ID of the last operating system state transition -- **LastStateTransitionSub:** ID of the last operating system sub-state transition +- **LastStateTransitionSub:** ID of the last operating system substate transition - **StateDurationMS:** Number of milliseconds spent in the last operating system state - **StateTransition:** ID of the operating system state the system is transitioning to -- **StateTransitionSub:** ID of the operating system sub-state the system is transitioning to +- **StateTransitionSub:** ID of the operating system substate the system is transitioning to - **TotalDurationMS:** Total time (in milliseconds) spent in all states since the last boot - **TotalUptimeMS:** Total time (in milliseconds) the device was in Up or Running states since the last boot - **TransitionsToOn:** Number of transitions to the Powered On state since the last boot @@ -300,7 +305,7 @@ Sends details about any error codes detected during a failed sign-in. The following fields are available: - **ntsStatus:** The NTSTATUS error code status returned from an attempted sign-in -- **ntsSubstatus:** The NTSTATUS error code sub-status returned from an attempted sign-in +- **ntsSubstatus:** The NTSTATUS error code substatus returned from an attempted sign-in ## Microsoft.Windows.Security.Biometrics.Service.BioServiceActivityCapture Indicates that a biometric capture was compared to known templates @@ -322,7 +327,7 @@ The following field is available: - **ticksSinceBoot:** Duration of boot event (milliseconds) ## Microsoft.Windows.Shell.Desktop.LogonFramework.AllLogonTasks -This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Windows Analytics organizations can help identify logon problems on managed devices. +This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Desktop Analytics, organizations can help identify logon problems on managed devices. The following fields are available: @@ -336,7 +341,7 @@ The following fields are available: - **wilActivity:** Indicates errors in the task to help Microsoft improve reliability. ## Microsoft.Windows.Shell.Desktop.LogonFramework.LogonTask -This event describes system tasks which are part of the user logon sequence and helps Microsoft to improve reliability. +This event describes system tasks that are part of the user logon sequence and helps Microsoft to improve reliability. The following fields are available: @@ -354,12 +359,12 @@ For a device subject to Windows Information Protection policy, learning events a The following fields are available: - **actiontype:** Indicates what type of resource access the app was attempting (for example, opening a local document vs. a network resource) when it encountered a policy boundary. Useful for Windows Information Protection administrators to tune policy rules. -- **appIdType:** Based on the type of application, this indicates what type of app rule a Windows Information Protection administrator would need to create for this app. +- **appIdType:** Based on the type of application, this field indicates what type of app rule a Windows Information Protection administrator would need to create for this app. - **appname:** App that triggered the event - **status:** Indicates whether errors occurred during WIP learning events ## Win32kTraceLogging.AppInteractivitySummary -Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Windows Analytics) to understand and improve application reliability on managed devices. +Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Desktop Analytics) to understand and improve application reliability on managed devices. The following fields are available: @@ -392,11 +397,11 @@ The following fields are available: - **MonitorWidth:** Number of horizontal pixels in the application host monitor resolution - **MouseInputSec:** Total number of seconds during which there was mouse input - **NewProcessCount:** Number of new processes contributing to the aggregate -- **PartATransform_AppSessionGuidToUserSid:** Flag which influences how other parts of the event are constructed +- **PartATransform_AppSessionGuidToUserSid:** Flag that influences how other parts of the event are constructed - **PenInputSec:** Total number of seconds during which there was pen input - **SpeechRecognitionSec:** Total number of seconds of speech recognition - **SummaryRound:** Incrementing number indicating the round (batch) being summarized -- **TargetAsId:** Flag which influences how other parts of the event are constructed +- **TargetAsId:** Flag that influences how other parts of the event are constructed - **TotalUserOrDisplayActiveDurationMS:** Total time the user or the display was active (in milliseconds) - **TouchInputSec:** Total number of seconds during which there was touch input - **UserActiveDurationMS:** Total time that the user was active including all input methods @@ -410,13 +415,16 @@ The following fields are available: ## Revisions ### PartA_UserSid removed -A previous revision of this list stated that a field named PartA_UserSid was a member of the event Microsoft.Windows.LogonController.LogonAndUnlockSubmit. This was incorrect. The list has been updated to reflect that no such field is present in the event. +A previous revision of this list stated that a field named PartA_UserSid was a member of the event Microsoft.Windows.LogonController.LogonAndUnlockSubmit. This statement was incorrect. The list has been updated to reflect that no such field is present in the event. ### Office events added In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 16 events were added, describing Office app launch and availability. These events were added to improve the precision of Office data in Windows Analytics. +> [!NOTE] +> Office data will no longer be provided through this policy in Desktop Analytics. + ### CertAnalytics events removed -In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Windows Analytics. +In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Desktop Analytics. >[!NOTE] >You can use the Windows Diagnostic Data Viewer to observe and review events and their fields as described in this topic. diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md deleted file mode 100644 index 524f34b78a..0000000000 --- a/windows/privacy/gdpr-it-guidance.md +++ /dev/null @@ -1,309 +0,0 @@ ---- -title: Windows and the GDPR-Information for IT Administrators and Decision Makers -description: Use this topic to understand the relationship between users in your organization and Microsoft in the context of the GDPR (General Data Protection Regulation). -keywords: privacy, GDPR, windows, IT -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 05/11/2018 -ms.reviewer: ---- -# Windows and the GDPR: Information for IT Administrators and Decision Makers - -Applies to: -- Windows 10, version 1809 -- Windows 10, version 1803 -- Windows 10, version 1709 -- Windows 10, version 1703 -- Windows 10 Team Edition, version 1703 for Surface Hub -- Windows Server 2019 -- Windows Server 2016 -- Windows Analytics - -This topic provides IT Decision Makers with a basic understanding of the relationship between users in an organization and Microsoft in the context of the GDPR (General Data Protection Regulation). You will also learn what role an IT organization plays for that relationship. - -For more information about the GDPR, see: -* [Microsoft GDPR Overview](https://aka.ms/GDPROverview) -* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq) -* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp) -* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted) - -## GDPR fundamentals - -Here are some GDPR fundamentals: - -* On May 25, 2018, this EU data privacy law is implemented. It sets a new global bar for data privacy rights, security, and compliance. -* The GDPR is fundamentally about protecting and enabling the privacy rights of individuals – both customers and employees. -* The European law establishes strict global data privacy requirements governing how organizations manage and protect personal data while respecting individual choice – no matter where data is sent, processed, or stored. -* A request by an individual to an organization to take an action on their personal data is referred to here as a *data subject request*, or *DSR*. - -Microsoft believes data privacy is a fundamental right, and that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We also recognize that the GDPR required significant changes by organizations all over the world with regard to the discovery, management, protection, and reporting of personal data that is collected, processed, and stored within an organization. - -### What is personal data under the GDPR? - -Article 4 (1) of [the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=en) defines personal data as any information relating to an identified or identifiable person. There is no distinction between a person’s private, public, or work roles. As defined by the GDPR, personal data includes, but is not limited to: -* Name -* Email address -* Credit card numbers -* IP addresses -* Social media posts -* Location information -* Handwriting patterns -* Voice input to cloud-based speech services - -### Controller and processor under the GDPR: Who does what - -#### Definition - -The GDPR describes specific requirements for allocating responsibility for controller and processor activities related to personal data. Thus, every organization that processes personal data must determine whether it is acting as a controller or processor for a specific scenario. - -* **Controller**: GDPR Article 4 (7) defines the ‘controller’ as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. -* **Processor**: According to the GDPR Article 4 (8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. - -#### Controller scenario - -For example, when an organization is using Microsoft Windows Defender Advanced Threat Protection (ATP) to detect, investigate, and respond to advanced threats on their networks as part of their IT operations, that organization is collecting data from the user’s device – data, that might include personal data. In this scenario, the organization is the *controller* of the respective personal data, since the organization controls the purpose and means of the processing for data being collected from the devices that have Windows Defender ATP enabled. - -#### Processor scenario - -In the controller scenario described above, Microsoft is a *processor* because Microsoft provides data processing services to that controller (in the given example, an organization that subscribed to Windows Defender ATP and enabled it for the user’s device). As processor, Microsoft only processes data on behalf of the enterprise customer and does not have the right to process data beyond their instructions as specified in a written contract, such as the [Microsoft Product Terms and the Microsoft Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products.aspx). - -## GDPR relationship between a Windows 10 user and Microsoft - -For Windows 10 services, Microsoft usually is the controller (with exceptions, such as Windows Defender ATP). The following sections describe what that means for the related data. - -### Types of data exchanged with Microsoft - -Microsoft collects data from or generates data through interactions with users of Windows 10 devices. This information can contain personal data, as defined in [Article 4 (1) of the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN), that may be used to provide, support, and improve Windows 10 services. - -Microsoft discloses data collection and privacy practices in detail, for example: -* As part of the Windows 10 installation; -* In the Windows 10 privacy settings; -* Via the web-based [Microsoft Privacy dashboard](https://account.microsoft.com/privacy); and -* In the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). - -It is important to differentiate between two distinct types of data Windows services are dealing with. - -#### Windows functional data - -A user action, such as performing a Skype call, usually triggers the collection and transmission of Windows *functional data*. Some Windows components and applications connecting to Microsoft services also exchange Windows functional data to provide user functionality. - -Some other examples of Windows functional data: -* The Weather app which can use the device’s location to retrieve local weather or community news. -* Wallpaper and desktop settings that are synchronized across multiple devices. - -For more info on how IT Professionals can manage Windows functional data sent from an organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). - -#### Windows diagnostic data - -Windows diagnostic data is used to keep the operating system secure and up-to-date, troubleshoot problems, and make product improvements. The data is encrypted before being sent back to Microsoft. - -Some examples of diagnostic data include: -* The type of hardware being used, information about installed apps and usage details, and reliability data on drivers running on the device. -* For users who have turned on “Tailored experiences”, it can be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for the needs of the user. - -Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", and "Full". For a detailed discussion about these diagnostic data levels please see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To find more about what information is collected and how it is handled, see [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data). - ->[!IMPORTANT] ->Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services. - -### Windows services where Microsoft is the processor under the GDPR - -Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/windowsforbusiness/windows-atp). - ->[!NOTE] ->Both Windows Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/en-us/windowsforbusiness/compare)). - -#### Windows Analytics - -[Windows Analytics](https://www.microsoft.com/en-us/windowsforbusiness/windows-analytics) is a service that provides rich, actionable information for helping organizations to gain deep insights into the operational efficiency and health of the Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise into the Windows Analytics service. - -Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Windows Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10. - -As a result, in terms of the GDPR, the organization that has subscribed to Windows Analytics is acting as the controller, while Microsoft is the processor for Windows Analytics. ->[!NOTE] ->The IT organization must explicitly enable Windows Analytics for a device after the organization subscribes. - ->[!IMPORTANT] ->Windows Analytics does not collect Windows Diagnostic data by itself. Instead, Windows Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device. - -#### Windows Defender ATP - -[Windows Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) is cloud-based service that collects and analyzes usage data from an organization’s devices to detect security threats. Some of the data can contain personal data as defined by the GDPR. Enrolled devices transmit usage data to Microsoft datacenters, where that data is analyzed, processed, and stored. The security operations center (SOC) of the organization can view the analyzed data using the [Windows Defender ATP portal](https://securitycenter.windows.com/). - -As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP. - ->[!NOTE] ->The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes. - -#### At a glance – Windows 10 services GDPR mode of operations - -The following table lists in what GDPR mode – controller or processor – Windows 10 services are operating. - -| Service | Microsoft GDPR mode of operation | -| --- | --- | -| Windows Functional data | Controller or Processor* | -| Windows Diagnostic data | Controller | -| Windows Analytics | Processor | -| Windows Defender Advanced Threat Detection (ATP) | Processor | - -*Table 1: Windows 10 GDPR modes of operations for different Windows 10 services* - -*/*Depending on which application/feature this is referring to.* - -## Windows diagnostic data and Windows 10 - - -### Recommended Windows 10 settings - -Windows diagnostic data collection level for Windows 10 can be set by a user in Windows (*Start > Settings > Privacy > Diagnostics & feedback*) or by the IT department of an organization, using Group Policy or Mobile Device Management (MDM) techniques. - -* For Windows 10, version 1803 and version 1809, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Windows Analytics](#windows-analytics). - ->[!NOTE] ->For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). - -* For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”. - ->[!NOTE] ->For Windows 7, Microsoft recommends [configuring enterprise devices for Windows Analytics](/windows/deployment/update/windows-analytics-get-started) to facilitate upgrade planning to Windows 10. - -### Additional information for Windows Analytics - -Some Windows Analytics solutions and functionality, such as Update Compliance, works with “Basic” as minimum Windows diagnostic level. Other solutions and functionality of Windows Analytics, such as Device Health, require “Enhanced”. - -Those organizations who wish to share the smallest set of events for Windows Analytics and have set the Windows diagnostic level to “Enhanced” can use the “Limit Enhanced diagnostic data to the minimum required by Windows Analytics” setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Windows Analytics. - ->[!NOTE] ->Additional information can be found at [Windows Analytics and privacy](/windows/deployment/update/windows-analytics-privacy -). - -## Controlling Windows 10 data collection and notification about it - -Windows 10 sends diagnostic data to Microsoft services, and some of that data can contain personal data. Both the user and the IT organization have the ability to control the transmission of that data to Microsoft. - -### Adjusting privacy settings by the user - -A user has the ability to adjust additional privacy settings in Windows by navigating to *Start > Settings > Privacy*. For example, a user can control if location is enabled or disabled, whether or not to transmit feedback on inking and typing input to Microsoft for improving the personal accuracy of these services, or if Windows collects activities for syncing it with other devices. - -For a standard user in an organization, some privacy settings might be controlled by their IT department. This is done using Group Policies or Mobile Device Management (MDM) settings. If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to *Start > Settings > Privacy*. As such, the user can only change some settings, but not all. - -### Users can lower the diagnostic level - -Starting with Windows 10, version 1803, a user can change the Windows diagnostics data level for their device below to what was set by their IT department. Organizations can allow or disallow this feature by configuring the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface** or the MDM policy **ConfigureTelemetryOptInSettingsUx**. - -If an IT organization has not disabled this policy, users within the organization can change their own Windows diagnostic data collection level in *Start > Settings > Privacy > Diagnostics & feedback*. For example, if the IT organization enabled this policy and set the level to “Full”, a user can modify the Windows diagnostics data level setting to “Basic”. - -### Notification at logon - -Windows 10, version 1803, and later can provide users with a notification during their logon. If the IT organization has not disabled the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications** or the MDM policy **ConfigureTelemetryOptInChangeNotification**, Windows diagnostic data notifications can appear at logon so that the users of a device are aware of the data collection. - -This notification can also be shown when the diagnostic level for the device was changed. For instance, if the diagnostic level on the device is set to “Basic” and the IT organization changes it to “Full”, users will be notified on their next logon. - -### Diagnostic Data Viewer (DDV) - -In Windows 10, version 1803 and later, users can invoke the [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) to see what Windows diagnostic data is collected on their local device. This app lets a user review the diagnostic data collected on his device that is being sent to Microsoft. The DDV groups the information into simple categories based on how it is used by Microsoft. - -A user can turn on Windows diagnostic data viewing by going to go to *Start > Settings > Privacy > Diagnostics & feedback*. Under the ‘Diagnostic data viewer’ section, the user has to enable the ‘If data viewing is enabled, you can see your diagnostics data’ option. After DDV is installed on the device, the user can start it by clicking the ‘Diagnostic Data Viewer’ in the ‘Diagnostic data viewer’ section of *Start > Settings > Privacy > Diagnostics & feedback*. - -Also, the user can delete all Windows diagnostic data collected from the device. This is done by clicking the ‘Delete’ button in the ‘Delete diagnostic data’ section of *Start > Settings > Privacy > Diagnostics & feedback*. - -### Windows 10 personal data services configuration - -Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization. - -IT Professionals that are interested in this configuration, see [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md). - -### Windows 10 connections to Microsoft - -To find out more about the network connections that Windows components make to Microsoft as well as the privacy settings that affect data shared with either Microsoft or apps, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) and [Manage Windows 10 connection endpoints](manage-windows-endpoints.md). These articles describe how these settings can be managed by an IT Professional. - -### At-a-glance: the relationship between an IT organization and the GDPR - -Because Microsoft is a controller for data collected by Windows 10, the user can work with Microsoft to satisfy GDPR requirements. While this relationship between Microsoft and a user is evident in a consumer scenario, an IT organization can influence that relationship in an enterprise scenario. For example, the IT organization has the ability to centrally configure the Windows diagnostic data level by using Group Policy or MDM settings. - -## Windows Server - -Windows Server follows the same mechanisms as Windows 10 for handling of personal data – for example, when collecting Windows diagnostic data. - -More detailed information about Windows Server and the GDPR is available at Beginning your General Data Protection Regulation (GDPR) journey for Windows Server. - -### Windows diagnostic data and Windows Server - -The lowest diagnostic data setting level supported on Windows Server 2016 and Windows Server 2019 through management policies is “Security”. The lowest diagnostic data setting supported through the Settings UI is “Basic”. The default diagnostic data level for all Windows Server 2016 and Windows Server 2019 editions is “Enhanced”. - -IT administrators can configure the Windows Server diagnostic data settings using familiar management tools, such as Group Policy, MDM, or Windows Provisioning. IT administrators can also manually change settings using Registry Editor. Setting the Windows Server diagnostic data levels through a management policy overrides any device-level settings. - -There are two options for deleting Windows diagnostic data from a Windows Server machine: - -- If the “Desktop Experience” option was chosen during the installation of Windows Server 2019, then there are the same options available for an IT administrator that end users have with Windows 10, version 1803 and version 1809, to submit a request for deleting that device’s diagnostic data. This is done by clicking the **Delete** button in the **Delete diagnostic data** section of **Start > Settings > Privacy > Diagnostics & feedback**. -- Microsoft has provided a [PowerShell cmdlet](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata) that IT administrators can use to delete Windows diagnostic data via the command line on a machine running Windows Server 2016 or Windows Server 2019. This cmdlet provides the same functionality for deleting Windows diagnostic data as with Desktop Experience on Windows Server 2019. For more information, see [the PowerShell Gallery](https://www.powershellgallery.com/packages/WindowsDiagnosticData). - -### Backups and Windows Server - -Backups, including live backups and backups that are stored locally within an organization or in the cloud, can contain personal data. - -- Backups an organizations creates, for example by using Windows Server Backup (WSB), are under its control. For example, for exporting personal data contained in a backup, the organization needs to restore the appropriate backup sets to facilitate the respective data subject request (DSR). -- The GDPR also applies when storing backups in the cloud. For example, an organization can use Microsoft Azure Backup to backup files and folders from physical or virtual Windows Server machines (located on-premises or in Azure) to the cloud. The organization that is subscribed to this backup service also has the obligation to restore the data in order to exercise the respective DSR. - -## Windows 10 Team Edition, Version 1703 for Surface Hub - -Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. - ->[!NOTE] ->Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this. - -An IT administrator can configure privacy- related settings, such as setting the Windows diagnostic data level to Basic. Surface Hub does not support group policy for centralized management; however, IT administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, please see [Manage settings with an MDM provider](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub). - -## Further reading - -### Optional settings / features that further improve the protection of personal data - -Personal data protection is one of the goals of the GDPR. One way of improving personal data protection is to use the modern and advanced security features of Windows 10. An IT organization can learn more at [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10) and [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure). - ->[!NOTE] ->Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5). - -### Windows Security Baselines - -Microsoft has created Windows Security Baselines to efficiently configure Windows 10 and Windows Server. For more information, please visit [Windows Security Baselines](/windows/security/threat-protection/windows-security-baselines). - -### Windows Restricted Traffic Limited Functionality Baseline - -To make it easier to deploy settings that restrict connections from Windows 10 and Windows Server to Microsoft, IT Professionals can apply the Windows Restricted Traffic Limited Functionality Baseline, available [here](https://go.microsoft.com/fwlink/?linkid=828887). - ->[!IMPORTANT] ->Some of the settings of the Windows Restricted Traffic Limited Functionality Baseline will reduce the functionality and security configuration of a device in the organization and are therefore not recommended. - -### Microsoft Trust Center and Service Trust Portal - -Please visit our [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr) to obtain additional resources and to learn more about how Microsoft can help you fulfill specific GDPR requirements. There you can find lots of useful information about the GDPR, including how Microsoft is helping customers to successfully master the GDPR, a FAQ list, and a list of [resources for GDPR compliance](https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/resources). Also, please check out the [Compliance Manager](https://aka.ms/compliancemanager) of the Microsoft [Service Trust Portal (STP)](https://aka.ms/stp) and [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted). - -### Additional resources - -#### FAQs - -* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) -* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) -* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) -* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) - -#### Blogs - -* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) - -#### Privacy Statement - -* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) - -#### Other resources - -* [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/privacy/gdpr-win10-whitepaper.md b/windows/privacy/gdpr-win10-whitepaper.md deleted file mode 100644 index 3ad1a4a14e..0000000000 --- a/windows/privacy/gdpr-win10-whitepaper.md +++ /dev/null @@ -1,340 +0,0 @@ ---- -title: Beginning your General Data Protection Regulation (GDPR) journey for Windows 10 (Windows 10) -description: Use this article to understand what GDPR is and about the products Microsoft provides to help you get started towards compliance. -keywords: privacy, GDPR -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 09/25/2017 -ms.reviewer: ---- - -# Beginning your General Data Protection Regulation (GDPR) journey for Windows 10 - -This article provides info about the GDPR, including what it is, and the products Microsoft provides to help you to become compliant. - -## Introduction -On May 25, 2018, a European privacy law is due to take effect that sets a new global bar for privacy rights, security, and compliance. - -The General Data Protection Regulation, or GDPR, is fundamentally about protecting and enabling the privacy rights of individuals. The GDPR establishes strict global privacy requirements governing how you manage and protect personal data while respecting individual choice — no matter where data is sent, processed, or stored. - -Microsoft and our customers are now on a journey to achieve the privacy goals of the GDPR. At Microsoft, we believe privacy is a fundamental right, and we believe that the GDPR is an important step forward for clarifying and enabling individual privacy rights. But we also recognize that the GDPR will require significant changes by organizations all over the world. - -We have outlined our commitment to the GDPR and how we are supporting our customers within the [Get GDPR compliant with the Microsoft Cloud](https://blogs.microsoft.com/on-the-issues/2017/02/15/get-gdpr-compliant-with-the-microsoft-cloud/#hv52B68OZTwhUj2c.99) blog post by our Chief Privacy Officer [Brendon Lynch](https://blogs.microsoft.com/on-the-issues/author/brendonlynch/) and the [Earning your trust with contractual commitments to the General Data Protection Regulation](https://blogs.microsoft.com/on-the-issues/2017/04/17/earning-trust-contractual-commitments-general-data-protection-regulation/#6QbqoGWXCLavGM63.99)” blog post by [Rich Sauer](https://blogs.microsoft.com/on-the-issues/author/rsauer/) - Microsoft Corporate Vice President & Deputy General Counsel. - -Although your journey to GDPR-compliance may seem challenging, we're here to help you. For specific information about the GDPR, our commitments and how to begin your journey, please visit the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr). - -## GDPR and its implications -The GDPR is a complex regulation that may require significant changes in how you gather, use and manage personal data. Microsoft has a long history of helping our customers comply with complex regulations, and when it comes to preparing for the GDPR, we are your partner on this journey. - -The GDPR imposes rules on organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents, no matter where those businesses are located. Among the key elements of the GDPR are the following: - -- **Enhanced personal privacy rights.** Strengthened data protection for residents of EU by ensuring they have the right to access to their personal data, to correct inaccuracies in that data, to erase that data, to object to processing of their personal data, and to move it. - -- **Increased duty for protecting personal data.** Reinforced accountability of organizations that process personal data, providing increased clarity of responsibility in ensuring compliance. - -- **Mandatory personal data breach reporting.** Organizations that control personal data are required to report personal data breaches that pose a risk to the rights and freedoms of individuals to their supervisory authorities without undue delay, and, where feasible, no later than 72 hours once they become aware of the breach. - -As you might anticipate, the GDPR can have a significant impact on your business, potentially requiring you to update privacy policies, implement and strengthen data protection controls and breach notification procedures, deploy highly transparent policies, and further invest in IT and training. Microsoft Windows 10 can help you effectively and efficiently address some of these requirements. - -## Personal and sensitive data -As part of your effort to comply with the GDPR, you will need to understand how the regulation defines personal and sensitive data and how those definitions relate to data held by your organization. - -The GDPR considers personal data to be any information related to an identified or identifiable natural person. That can include both direct identification (such as, your legal name) and indirect identification (such as, specific information that makes it clear it is you the data references). The GDPR also makes clear that the concept of personal data includes online identifiers (such as, IP addresses, mobile device IDs) and location data. - -The GDPR introduces specific definitions for genetic data (such as, an individual’s gene sequence) and biometric data. Genetic data and biometric data along with other sub categories of personal data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership: data concerning health; or data concerning a person’s sex life or sexual orientation) are treated as sensitive personal data under the GDPR. Sensitive personal data is afforded enhanced protections and generally requires an individual’s explicit consent where these data are to be processed. - -### Examples of info relating to an identified or identifiable natural person (data subject) -This list provides examples of several types of info that will be regulated through GDPR. This is not an exhaustive list. - -- Name - -- Identification number (such as, SSN) - -- Location data (such as, home address) - -- Online identifier (such as, e-mail address, screen names, IP address, device IDs) - -- Pseudonymous data (such as, using a key to identify individuals) - -- Genetic data (such as, biological samples from an individual) - -- Biometric data (such as, fingerprints, facial recognition) - -## Getting started on the journey towards GDPR compliance -Given how much is involved to become GDPR-compliant, we strongly recommend that you don't wait to prepare until enforcement begins. You should review your privacy and data management practices now. We recommend that you begin your journey to GDPR compliance by focusing on four key steps: - -- **Discover.** Identify what personal data you have and where it resides. - -- **Manage.** Govern how personal data is used and accessed. - -- **Protect.** Establish security controls to prevent, detect, and respond to vulnerabilities and data breaches. - -- **Report.** Act on data requests, report data breaches, and keep required documentation. - - ![Diagram about how the 4 key GDPR steps work together](images/gdpr-steps-diagram.png) - -For each of the steps, we've outlined example tools, resources, and features in various Microsoft solutions, which can be used to help you address the requirements of that step. While this article isn't a comprehensive “how to,” we've included links for you to find out more details, and more information is available in the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr). - -## Windows 10 security and privacy -As you work to comply with the GDPR, understanding the role of your desktop and laptop client machines in creating, accessing, processing, storing and managing data that may qualify as personal and potentially sensitive data under the GDPR is important. Windows 10 provides capabilities that will help you comply with the GDPR requirements to implement appropriate technical and organizational security measures to protect personal data. - -With Windows 10, your ability to protect, detect and defend against the types of attacks that can lead to data breaches is greatly improved. Given the stringent requirements around breach notification within the GDPR, ensuring that your desktop and laptop systems are well defended will lower the risks you face that could result in costly breach analysis and notification. - -In this section, we'll talk about how Windows 10 provides capabilities that fit squarely in the **Protect** stage of your journey, including these 4 scenarios: - -- **Threat protection: Pre-breach threat resistance.** Disrupt the malware and hacking industry by moving the playing field to one where they lose the attack vectors that they depend on. - -- **Threat protection: Post-breach detection and response.** Detect, investigate, and respond to advanced threats and data breaches on your networks. - -- **Identity protection.** Next generation technology to help protect your user’s identities from abuse. - -- **Information protection.** Comprehensive data protection while meeting compliance requirements and maintaining user productivity. - -These capabilities, discussed in more detail below with references to specific GDPR requirements, are built on top of advanced device protection that maintains the integrity and security of the operating system and data. - -A key provision within the GDPR is data protection by design and by default, and helping with your ability to meet this provision are features within Windows 10 such as the Trusted Platform Module (TPM) technology designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. - -The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: - -- Generate, store, and limit the use of cryptographic keys. - -- Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. - -- Help to ensure platform integrity by taking and storing security measurements. - -Additional advanced device protection relevant to your operating without data breaches include Windows Trusted Boot to help maintain the integrity of the system by ensuring malware is unable to start before system defenses. - -### Threat protection: Pre-breach threat resistance -The GDPR requires you to implement appropriate technical and organizational security measures to protect personal data. - -Your ability to meet this requirement to implement appropriate technical security measures should reflect the threats you face in today’s increasingly hostile IT environment. Today’s security threat landscape is one of aggressive and tenacious threats. In previous years, malicious attackers mostly focused on gaining community recognition through their attacks or the thrill of temporarily taking a system offline. Since then, attacker’s motives have shifted toward making money, including holding devices and data hostage until the owner pays the demanded ransom. - -Modern attacks increasingly focus on large-scale intellectual property theft; targeted system degradation that can result in financial loss; and now even cyberterrorism that threatens the security of individuals, businesses, and national interests all over the world. These attackers are typically highly trained individuals and security experts, some of whom are in the employ of nation states that have large budgets and seemingly unlimited human resources. Threats like these require an approach that can meet this challenge. - -Not only are these threats a risk to your ability to maintain control of any personal or sensitive data you may have, but they are a material risk to your overall business as well. Consider recent data from Ponemon Institute, Verizon, and Microsoft: - -- The average cost of the type of data breach the GDPR will expect you to report is $3.5M. (Ponemon Institute). - -- 63% of these breaches involve weak or stolen passwords that the GDPR expects you to address. (2016 Data Breach Investigations Report, Verizon Enterprise). - -- Over 300,000 new malware samples are created and spread every day making your task to address data protection even more challenging. (Microsoft Malware Protection Center, Microsoft). - -As seen with recent ransomware attacks, once called the "black plague" of the Internet, attackers are going after bigger targets that can afford to pay more, with potentially catastrophic consequences. Desktops and laptops, that contain personal and sensitive data, are commonly targeted where control over data might be lost. - -In response to these threats and as a part of your mechanisms to resist these types of breaches so that you remain in compliance with the GDPR, Windows 10 provides built in technology, detailed below including the following: - -- Windows Defender Antivirus to respond to emerging threats on data. - -- Microsoft Edge to systemically disrupt phishing, malware, and hacking attacks. - -- Windows Defender Device Guard to block all unwanted applications on client machines. - -#### Responding to emerging data threats -Windows Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. In Windows 10, it uses a multi-pronged approach to improve antimalware: - -- **Cloud-delivered protection.** Helps to detect and block new malware within seconds, even if the malware has never been seen before. - -- **Rich local context.** Improves how malware is identified. Windows 10 informs Windows Defender Antivirus not only about content like files and processes, but also where the content came from, where it's been stored, and more. - -- **Extensive global sensors.** Help to keep Windows Defender Antivirus current and aware of even the newest malware. This is accomplished in two ways: by collecting the rich local context data from end points and by centrally analyzing that data. - -- **Tamper proofing.** Helps to guard Windows Defender Antivirus itself against malware attacks. For example, Windows Defender Antivirus uses Protected Processes, which prevents untrusted processes from attempting to tamper with Windows Defender Antivirus components, its registry keys, and so on. - -- **Enterprise-level features.** Give IT pros the tools and configuration options necessary to make Windows Defender Antivirus an enterprise-class antimalware solution. - -#### Systemically disrupting phishing, malware, and hacking attacks -In today’s threat landscape, your ability to provide those mechanisms should be tied to the specific data-focused attacks you face through phishing, malware and hacking due to the browser-related attacks. - -As part of Windows 10, Microsoft has brought you Microsoft Edge, our safest and most secure browser to-date. Over the past two years, we have been continuously innovating, and we’re proud of the progress we’ve made. This quality of engineering is reflected by the reduction of Common Vulnerabilities and Exposures (CVE) when comparing Microsoft Edge with Internet Explorer over the past year. Browser-related attacks on personal and sensitive data that you will need to protect under the GDPR means this innovation in Windows 10 is important. - -While no modern browser — or any complex application — is free of vulnerabilities, many of the vulnerabilities for Microsoft Edge have been responsibly reported by professional security researchers who work with the Microsoft Security Response Center (MSRC) and the Microsoft Edge team to ensure customers are protected well before any attacker might use these vulnerabilities in the wild. Even better, there is no evidence that any vulnerabilities have been exploited in the wild as zero-day attacks. - -![Graph of the Common Vulnerabilities and Exposures (CVE) in the National Vulnerability Database](images/gdpr-cve-graph.png) - -However, many businesses worldwide have come under increasing threat of targeted attacks, where attackers are crafting specialized attacks against a specific business, attempting to take control of corporate networks and data. - -#### Blocking all unwanted apps -Application Control is your best defense in a world where there are more than 300,000 new malware samples each day. As part of Windows 10, Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. - -With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Windows Defender Device Guard can use the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. - -Windows Defender Device Guard protects threats that can expose personal or sensitive data to attack, including: - -- Exposure to new malware, for which the "signature" is not yet known - -- Exposure to unsigned code (most malware is unsigned) - -- Malware that gains access to the kernel and then, from within the kernel, captures sensitive information or damages the system - -- DMA-based attacks, for example, attacks launched from a malicious device that read secrets from memory, making the enterprise more vulnerable to attack; and - -- Exposure to boot kits or to a physically present attacker at boot time. - -### Threat protection: Post-breach detection and response -The GDPR includes explicit requirements for breach notification where a personal data breach means, “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.” - -As noted in the Windows Security Center white paper, [Post Breach: Dealing with Advanced Threats](http://wincom.blob.core.windows.net/documents/Post_Breach_Dealing_with_Advanced_Threats_Whitepaper.pdf), “_Unlike pre-breach, post-breach assumes a breach has already occurred – acting as a flight recorder and Crime Scene Investigator (CSI). Post-breach provides security teams the information and toolset needed to identify, investigate, and respond to attacks that otherwise will stay undetected and below the radar._” - -#### Insightful security diagnostic data -For nearly two decades, Microsoft has been turning threats into useful intelligence that can help fortify our platform and protect customers. Today, with the immense computing advantages afforded by the cloud, we are finding new ways to use our rich analytics engines driven by threat intelligence to protect our customers. - -By applying a combination of automated and manual processes, machine learning and human experts, we can create an Intelligent Security Graph that learns from itself and evolves in real-time, reducing our collective time to detect and respond to new incidents across our products. - -![Diagram of Microsoft's Intelligent Security Graph](images/gdpr-intelligent-security-graph.png) - -The scope of Microsoft’s threat intelligence spans, literally, billions of data points: 35 billion messages scanned monthly, 1 billion customers across enterprise and consumer segments accessing 200+ cloud services, and 14 billion authentications performed daily. All this data is pulled together on your behalf by Microsoft to create the Intelligent Security Graph that can help you protect your front door dynamically to stay secure, remain productive, and meet the requirements of the GDPR. - -#### Detecting attacks and forensic investigation -Even the best endpoint defenses may be breached eventually, as cyberattacks become more sophisticated and targeted. - -Windows Defender Advanced Threat Protection (ATP) helps you detect, investigate, and respond to advanced attacks and data breaches on your networks. GDPR expects you to protect against attacks and breaches through technical security measures to ensure the ongoing confidentiality, integrity, and availability of personal data. - -Among the key benefits of ATP are the following: - -- Detecting the undetectable - sensors built deep into the operating system kernel, Windows security experts, and unique optics from over 1 billion machines and signals across all Microsoft services. - -- Built in, not bolted on - agentless with high performance and low impact, cloud-powered; easy management with no deployment. - -- Single pane of glass for Windows security - explore 6 months of rich machine timeline that unifies security events from Windows Defender ATP, Windows Defender Antivirus. - -- Power of the Microsoft graph - leverages the Microsoft Intelligence Security Graph to integrate detection and exploration with Office 365 ATP subscription, to track back and respond to attacks. - -Read more at [What’s new in the Windows Defender ATP Creators Update preview](https://blogs.microsoft.com/microsoftsecure/2017/03/13/whats-new-in-the-windows-defender-atp-creators-update-preview/). - -To provide Detection capabilities, Windows 10 improves our OS memory and kernel sensors to enable detection of attackers who are employing in-memory and kernel-level attacks – shining a light into previously dark spaces where attackers hid from conventional detection tools. We’ve already successfully leveraged this new technology against zero-days attacks on Windows. - -![Windows Defender Security Center](images/gdpr-security-center.png) - -We continue to upgrade our detections of ransomware and other advanced attacks, applying our behavioral and machine-learning detection library to counter changing attacks trends. Our historical detection capability ensures new detection rules apply to up to six months of stored data to detect attacks that previously went unnoticed. Customers can also add customized detection rules or IOCs to augment the detection dictionary. - -Customers asked us for a single pane of glass across the entire Windows security stack. Windows Defender Antivirus detections and Windows Defender Device Guard blocks are the first to surface in the Windows Defender ATP portal interleaved with Windows Defender ATP detections. The new user entity adds identity as a pivot, providing insight into actions, relationships, and alerts that span machines and allow us to track attackers moving laterally across the network. - -Our alert page now includes a new process tree visualization that aggregates multiple detections and related events into a single view that helps security teams reduce the time to resolve cases by providing the information required to understand and resolve incidents without leaving the alert page. - -Security Operations (SecOps) can hunt for evidence of attacks, such as file names or hashes, IP addresses or URLs, behaviors, machines, or users. They can do this immediately by searching the organization’s cloud inventory, across all machines – and going back up to 6 months in time – even if machines are offline, have been reimaged, or no longer exist. - -![Windows Defender Security Center - User screen](images/gdpr-security-center2.png) - -When detecting an attack, security teams can now take immediate action: isolate machines, ban files from the network, kill or quarantine running processes or files, or retrieve an investigation package from a machine to provide forensic evidence – with a click of a button. Because while detecting advanced attacks is important – shutting them down is even more so. - -![Windows Defender Security Center - Machine screen](images/gdpr-security-center3.png) - -### Identity Protection -Identify and access management is another area where the GDPR has placed special emphasis by calling for mechanisms to grant and restrict access to data subject personal data (for example, role-based access, segregation of duties). - -#### Multi-factor protection -Biometric authentication – using your face, iris, or fingerprint to unlock your devices – is much safer than traditional passwords. You– uniquely you– plus your device are the keys to your apps, data, and even websites and services – not a random assortment of letters and numbers that are easily forgotten, hacked, or written down and pinned to a bulletin board. - -Your ability to protect personal and sensitive data, that may be stored or accessed through desktop or laptops will be further enhanced by adopting advanced authentication capabilities such as Windows Hello for Business and Windows Hello companion devices. Windows Hello for Business, part of Windows 10, gives users a personal, secured experience where the device is authenticated based on their presence. Users can log in with a look or a touch, with no need for a password. - -In conjunction with Windows Hello for Business, biometric authentication uses fingerprints or facial recognition and is more secure, more personal, and more convenient. If an application supports Hello, Windows 10 enables you to authenticate applications, enterprise content, and even certain online experiences without a password being stored on your device or in a network server at all. -Windows Hello for Business works with the Companion Device Framework to enhance the user authentication experience. Using the Windows Hello Companion Device Framework, a companion device can provide a rich experience for Windows Hello even when biometrics are not available (for example, if the Windows 10 desktop lacks a camera for face authentication or fingerprint reader device). - -There are numerous ways one can use the Windows Hello Companion Device Framework to build a great Windows unlock experience with a companion device. For example, users can: - -- Work offline (for example, while traveling on a plane) - -- Attach their companion device to PC via USB, touch the button on the companion device, and automatically unlock their PC. - -- Carry a phone in their pocket that is already paired with their PC over Bluetooth. Upon hitting the spacebar on their PC, their phone receives a notification. Approve it and the PC simply unlocks. - -- Tap their companion device to an NFC reader to quickly unlock their PC. - -- Wear a fitness band that has already authenticated the wearer. Upon approaching PC, and by performing a special gesture (like clapping), the PC unlocks. - -#### Protection against attacks by isolating user credentials -As noted in the [Windows 10 Credential Theft Mitigation Guide](https://www.microsoft.com/en-us/download/confirmation.aspx?id=54095), “_the tools and techniques criminals use to carry out credential theft and reuse attacks improve, malicious attackers are finding it easier to achieve their goals. Credential theft often relies on operational practices or user credential exposure, so effective mitigations require a holistic approach that addresses people, processes, and technology. In addition, these attacks rely on the attacker stealing credentials after compromising a system to expand or persist access, so organizations must contain breaches rapidly by implementing strategies that prevent attackers from moving freely and undetected in a compromised network._” - -An important design consideration for Windows 10 was mitigating credential theft — in particular, derived credentials. Windows Defender Credential Guard provides significantly improved security against derived credential theft and reuse by implementing a significant architectural change in Windows designed to help eliminate hardware-based isolation attacks rather than simply trying to defend against them. - -When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges can't extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard, as described above, and other security strategies and architectures. - -### Information Protection -The GDPR is focused on information protection regarding data that is considered as personal or sensitive in relation to a natural person, or data subject. Device protection, protection against threats, and identity protection are all important elements of a Defense in Depth strategy surrounding a layer of information protection in your laptop and desktop systems. - -As to the protection of data, the GDPR recognizes that in assessing data security risk, consideration should be given to the risks that are presented such as accidental loss, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. It also recommends that measures taken to maintain an appropriate level of security should consider the state-of-the-art and the costs of implementation in relation to the risks among other factors. - -Windows 10 provides built in risk mitigation capabilities for today’s threat landscape. In this section, we will look at the types of technologies that will help your journey toward GDPR compliance and at the same time provide you with solid overall data protection as part of a comprehensive information protection strategy. - -![Diagram of Microsoft's comprehensive information protection strategy](images/gdpr-comp-info-protection.png) - -#### Encryption for lost or stolen devices -The GDPR calls for mechanisms that implement appropriate technical security measures to confirm the ongoing confidentiality, integrity, and availability of both personal data and processing systems. BitLocker Encryption, first introduced as part of Microsoft's Next-Generation Secure Computing Base architecture in 2004 and made available with Windows Vista, is a built-in data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. - -BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to protect user data and to ensure that a computer has not been tampered with while the system was offline. - -Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software-attack tool against it or by transferring the computer's hard disk to a different computer. BitLocker helps mitigate unauthorized data access by enhancing file and system protections. BitLocker also helps render data inaccessible when BitLocker-protected computers are decommissioned or recycled. - -Related to BitLocker are Encrypted Hard Drives, a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. Encrypted Hard Drives use the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. - -By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity. - -Some of the benefits of Encrypted Hard Drives include: - -- **Better performance.** Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate with no performance degradation. - -- **Strong security based in hardware.** Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system - -- **Ease of use.** Encryption is transparent to the user because it is on by default. There is no user interaction needed to enable encryption. Encrypted Hard Drives are easily erased using on-board encryption key; there is no need to re-encrypt data on the drive. - -- **Lower cost of ownership.** There is no need for new infrastructure to manage encryption keys, since BitLocker leverages your Active Directory Domain Services infrastructure to store recovery information. Your device operates more efficiently because processor cycles don't need to be used for the encryption process. - -#### Preventing accidental data leaks to unauthorized users -Part of the reality of your operating in a mobile-first, cloud-first world is the notion that some laptops will have multiple purposes – both business and personal. Yet that data that is considered as personal and sensitive regarding EU residents considered as “data subjects” must be protected in line with the requirements of the GDPR. - -Windows Information Protection helps people separate their work and personal data and keeps data encrypted wherever it’s stored. Your employees can safely use both work and personal data on the same device without switching applications. Windows Information Protection helps end users avoid inadvertent data leaks by sending a warning when copy/pasting information in non-corporate applications – end users can still proceed but the action will be logged centrally. - -For example, employees can’t send protected work files from a personal email account instead of their work account. They also can’t accidently post personal or sensitive data from a corporate site into a tweet. Windows Information Protection also helps ensure that they aren’t saving personal or sensitive data in a public cloud storage location. - -#### Capabilities to classify, assign permissions and share data -Windows Information Protection is designed to coexist with advanced data loss prevention (DLP) capabilities found in Office 365 ProPlus, Azure Information Protection, and Azure Rights Management. Advanced DLP prevents printing, for example, or protects work data that is emailed outside your company. - -To continuously protect your data, regardless of where it is stored, with whom it is shared, or if the device is running iOS, Android or Windows, the classification and protection needs to be built into the file itself, so this protection can travel with the data wherever it goes. Microsoft Azure Information Protection (AIP) is designed to provide this persistent data protection both on-premises and in the cloud. - -Data classification is an important part of any data governance plan. Adopting a classification scheme that applies throughout your business can be particularly helpful in responding to what the GDPR calls data subject (for example, your EU employee or customer) requests, because it enables enterprises to identify more readily and process personal data requests. - -Azure Information Protection can be used to help you classify and label your data at the time of creation or modification. Protection in the form of encryption, which the GDPR recognizes may be appropriate at times, or visual markings can then be applied to data needing protection. - -With Azure Information Protection, you can either query for data marked with a sensitivity label or intelligently identify sensitive data when a file or email is created or modified. Once identified, you can automatically classify and label the data – all based on the company’s desired policy. - -Azure Information Protection also helps your users share sensitive data in a secure manner. In the example below, information about a sensitive acquisition was encrypted and restricted to a group of people who were granted only a limited set of permissions on the information – they could modify the content but could not copy or print it. - -![Azure Information Protection screen with limitations](images/gdpr-azure-info-protection.png) - -## Related content for associated Windows 10 solutions - -- **Windows Hello for Business:** https://www.youtube.com/watch?v=WOvoXQdj-9E and https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification - -- **Windows Defender Antivirus:** https://www.youtube.com/watch?v=P1aNEy09NaI and https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10 - -- **Windows Defender Advanced Threat Protection:** https://www.youtube.com/watch?v=qxeGa3pxIwg and https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection - -- **Windows Defender Device Guard:** https://www.youtube.com/watch?v=F-pTkesjkhI and https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide - -- **Windows Defender Credential Guard:** https://www.youtube.com/watch?v=F-pTkesjkhI and https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard - -- **Windows Information Protection:** https://www.youtube.com/watch?v=wLkQOmK7-Jg and https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip - -- Windows 10 Security Guide: https://technet.microsoft.com/itpro/windows/keep-secure/windows-10-security-guide - -## Disclaimer -This article is a commentary on the GDPR, as Microsoft interprets it, as of the date of publication. We’ve spent a lot of time with GDPR and like to think we’ve been thoughtful about its intent and meaning. But the application of GDPR is highly fact-specific, and not all aspects and interpretations of GDPR are well-settled. - -As a result, this article is provided for informational purposes only and should not be relied upon as legal advice or to determine how GDPR might apply to you and your organization. We encourage you to work with a legally-qualified professional to discuss GDPR, how it applies specifically to your organization, and how best to ensure compliance. - -MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS ARTICLE. This article is provided “as-is.” Information and views expressed in this article, including URL and other Internet website references, may change without notice. - -This article does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this article for your internal, reference purposes only. - -Published September 2017
              -Version 1.0
              -© 2017 Microsoft. All rights reserved. diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml index 8d5740bc52..b9b6ce81fd 100644 --- a/windows/privacy/index.yml +++ b/windows/privacy/index.yml @@ -1,156 +1,182 @@ -### YamlMime:YamlDocument - -documentType: LandingData +### YamlMime:Hub title: Windows Privacy +summary: Get ready for General Data Protection Regulation (GDPR) by viewing and configuring Windows diagnostic data in your organization. +brand: m365 metadata: - - document_id: - title: Windows Privacy - description: Learn about how privacy is managed in Windows. - - keywords: Windows 10, Windows Server, Windows Server 2016, privacy, GDPR, compliance, endpoints - + services: windows + ms.product: windows + ms.topic: hub-page # Required + ms.collection: M365-security-compliance + author: danihalfin + ms.author: daniha + manager: dansimp + ms.date: 07/21/2020 #Required; mm/dd/yyyy format. ms.localizationpriority: high - author: danihalfin - - ms.author: daniha - - ms.date: 04/25/2018 - - ms.topic: conceptual - - audience: ITPro - - manager: dansimp - - ms.collection: M365-security-compliance - - ms.devlang: na - -sections: - -- items: - - - type: markdown - - text: Get ready for General Data Protection Regulation (GDPR) by viewing and configuring Windows diagnostic data in your organization. - -- items: - - - type: list - - style: cards - - className: cardsM - - columns: 3 - - items: - - - href: \windows\privacy\gdpr-it-guidance - - html:

              Learn about GDPR and how Microsoft helps you get started towards compliance

              - - image: - - src: https://docs.microsoft.com/media/common/i_advanced.svg - - title: Start with GDPR basics - - - href: \windows\privacy\configure-windows-diagnostic-data-in-your-organization - - html:

              Make informed decisions about how you can configure diagnostic data in your organization

              - - image: - - src: https://docs.microsoft.com/media/common/i_filter.svg - - title: Configure Windows diagnostic data - - - href: \windows\privacy\diagnostic-data-viewer-overview - - html:

              Review the Windows diagnostic data sent to Microsoft by device in your organization

              - - image: - - src: https://docs.microsoft.com/media/common/i_investigate.svg - - title: View Windows diagnostic data - -- title: Understand Windows diagnostic data in Windows 10 - +# highlightedContent section (optional) +# Maximum of 8 items +highlightedContent: +# itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new items: + # Card + - title: Windows privacy & compliance guide for IT and compliance professionals + itemType: overview + url: Windows-10-and-privacy-compliance.md + # Card + - title: Configure Windows diagnostic data + itemType: how-to-guide + url: configure-windows-diagnostic-data-in-your-organization.md + # Card + - title: View Windows diagnostic data + itemType: how-to-guide + url: diagnostic-data-viewer-overview.md - - type: paragraph +# productDirectory section (optional) +productDirectory: + title: Understand Windows diagnostic data in Windows 10 + summary: For the latest Windows 10 version, learn more about what Windows diagnostic data is collected at various diagnostics levels. + items: + # Card + - title: Required diagnostic data + # imageSrc should be square in ratio with no whitespace + imageSrc: https://docs.microsoft.com/media/common/i_extend.svg + summary: Learn more about basic Windows diagnostic data events and fields collected. + url: required-windows-diagnostic-data-events-and-fields-2004.md + # Card + - title: Optional diagnostic data + imageSrc: https://docs.microsoft.com/media/common/i_get-started.svg + summary: Get examples of the types of optional diagnostic data collected from Windows + url: windows-diagnostic-data.md + # Card + - title: Changes to Windows diagnostic data collection + imageSrc: https://docs.microsoft.com/media/common/i_build.svg + summary: See what changes Windows is making to align to the new data collection taxonomy + url: changes-to-windows-diagnostic-data-collection.md - text: 'For the latest Windows 10 version, learn more about what Windows diagnostic data is collected at various diagnostics levels.' +# conceptualContent section (optional) +# conceptualContent: +# # itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new +# title: sectiontitle # < 60 chars (optional) +# summary: sectionsummary # < 160 chars (optional) +# items: +# # Card +# - title: cardtitle1 +# links: +# - url: file1.md OR https://docs.microsoft.com/file1 +# itemType: itemType +# text: linktext1 +# - url: file2.md OR https://docs.microsoft.com/file2 +# itemType: itemType +# text: linktext2 +# - url: file3.md OR https://docs.microsoft.com/file3 +# itemType: itemType +# text: linktext3 +# # footerLink (optional) +# footerLink: +# url: filefooter.md OR https://docs.microsoft.com/filefooter +# text: See more +# # Card +# - title: cardtitle2 +# links: +# - url: file1.md OR https://docs.microsoft.com/file1 +# itemType: itemType +# text: linktext1 +# - url: file2.md OR https://docs.microsoft.com/file2 +# itemType: itemType +# text: linktext2 +# - url: file3.md OR https://docs.microsoft.com/file3 +# itemType: itemType +# text: linktext3 +# # footerLink (optional) +# footerLink: +# url: filefooter.md OR https://docs.microsoft.com/filefooter +# text: See more +# # Card +# - title: cardtitle3 +# links: +# - url: file1.md OR https://docs.microsoft.com/file1 +# itemType: itemType +# text: linktext1 +# - url: file2.md OR https://docs.microsoft.com/file2 +# itemType: itemType +# text: linktext2 +# - url: file3.md OR https://docs.microsoft.com/file3 +# itemType: itemType +# text: linktext3 +# # footerLink (optional) +# footerLink: +# url: filefooter.md OR https://docs.microsoft.com/filefooter +# text: See more - - type: list +# # tools section (optional) +# tools: +# title: sectiontitle # < 60 chars (optional) +# summary: sectionsummary # < 160 chars (optional) +# items: +# # Card +# - title: cardtitle1 +# # imageSrc should be square in ratio with no whitespace +# imageSrc: ./media/index/image1.svg OR https://docs.microsoft.com/media/logos/image1.svg +# url: file1.md +# # Card +# - title: cardtitle2 +# imageSrc: ./media/index/image2.svg OR https://docs.microsoft.com/media/logos/image2.svg +# url: file2.md +# # Card +# - title: cardtitle3 +# imageSrc: ./media/index/image3.svg OR https://docs.microsoft.com/media/logos/image3.svg +# url: file3.md - style: cards +# additionalContent section (optional) +# Card with summary style +# additionalContent: +# # Supports up to 3 sections +# sections: +# - title: sectiontitle # < 60 chars (optional) +# summary: sectionsummary # < 160 chars (optional) +# items: +# # Card +# - title: cardtitle1 +# summary: cardsummary1 +# url: file1.md OR https://docs.microsoft.com/file1 +# # Card +# - title: cardtitle2 +# summary: cardsummary2 +# url: file1.md OR https://docs.microsoft.com/file2 +# # Card +# - title: cardtitle3 +# summary: cardsummary3 +# url: file1.md OR https://docs.microsoft.com/file3 +# # footer (optional) +# footer: "footertext [linktext](https://docs.microsoft.com/footerfile)" - className: cardsM - - columns: 3 - - items: - - - href: \windows\privacy\basic-level-windows-diagnostic-events-and-fields - - html:

              Learn more about basic Windows diagnostic data events and fields collected

              - - image: - - src: https://docs.microsoft.com/media/common/i_extend.svg - - title: Basic level events and fields - - - href: \windows\privacy\enhanced-diagnostic-data-windows-analytics-events-and-fields - - html:

              Learn more about Windows diagnostic data events and fields used by Windows Analytics

              - - image: - - src: https://docs.microsoft.com/media/common/i_delivery.svg - - title: Enhanced level events and fields - - - href: \windows\privacy\windows-diagnostic-data - - html:

              Learn more about all Windows diagnostic data collected

              - - image: - - src: https://docs.microsoft.com/media/common/i_get-started.svg - - title: Full level data categories - -- items: - - - type: list - - style: cards - - className: cardsL - - items: - - - title: View and manage Windows 10 connection endpoints - - html:

              Manage Windows 10 connection endpoints

              - -

              Manage connections from Windows to Microsoft services

              - - - title: Additional resources - - html:

              Windows 10 on Trust Center

              - -

              GDPR on Microsoft 365 Compliance solutions

              - -

              Support for GDPR Accountability on Service Trust Portal

              - \ No newline at end of file +# additionalContent section (optional) +# Card with links style +additionalContent: + # Supports up to 3 sections + sections: + - items: + # Card + - title: View and manage Windows 10 connection endpoints + links: + - text: Manage Windows 10 connection endpoints + url: manage-windows-endpoints.md + - text: Manage connection endpoints for non-Enterprise editions of Windows 10 + url: windows-endpoints-2004-non-enterprise-editions.md + - text: Manage connections from Windows to Microsoft services + url: manage-connections-from-windows-operating-system-components-to-microsoft-services.md + # Card + - title: Additional resources + links: + - text: Windows 10 on Trust Center + url: https://www.microsoft.com/en-us/trustcenter/cloudservices/windows10 + - text: GDPR on Microsoft 365 Compliance solutions + url: https://docs.microsoft.com/microsoft-365/compliance/gdpr + - text: Support for GDPR Accountability on Service Trust Portal + url: https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted + # footer (optional) + # footer: "footertext [linktext](https://docs.microsoft.com/footerfile)" diff --git a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md index 8fa6e44dc7..3fde86eb4c 100644 --- a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md +++ b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md @@ -18,12 +18,12 @@ ms.reviewer: robots: noindex,nofollow --- +# Microsoft Windows diagnostic data for PowerShell license terms + MICROSOFT SOFTWARE LICENSE TERMS MICROSOFT WINDOWS DIAGNOSTIC DATA FOR POWERSHELL - - These license terms are an agreement between you and Microsoft Corporation (or one of its affiliates). They apply to the software named above and any Microsoft services or software updates (except to the extent such services or updates are accompanied by new or additional terms, in which case those different terms apply prospectively and do not alter your or Microsoft’s rights relating to pre-updated software or services). IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. 1. INSTALLATION AND USE RIGHTS. diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index e2fa73f5c7..1c68d554a4 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -6,35 +6,42 @@ keywords: privacy, manage connections to Microsoft, Windows 10 ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.localizationpriority: medium -author: medgarmedgar -ms.author: v-medgar -ms.date: 7/9/2019 +ms.localizationpriority: high +audience: ITPro +author: robsize +ms.author: dansimp +manager: robsize +ms.date: 12/1/2020 --- -# Manage connections from Windows operating system components to Microsoft services using Microsoft Intune MDM Server +# Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server **Applies to** - Windows 10 Enterprise 1903 version and newer -You can use Microsoft InTune with MDM CSPs and custom [OMA URIs](https://docs.microsoft.com/intune/custom-settings-windows-10) to minimize connections from Windows to Microsoft services, or to configure particular privacy settings. You can configure diagnostic data at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. -To ensure CSPs take priority over Group Policies in case of conflicts, use the [ControlPolicyConflict](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy. +This article describes the network connections that Windows 10 components make to Microsoft and the Mobile Device Management/Configuration Service Provider (MDM/CSP) and custom Open Mobile Alliance Uniform Resource Identifier ([OMA URI](https://docs.microsoft.com/intune/custom-settings-windows-10)) policies available to IT Professionals using Microsoft Intune to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. -You can configure diagnostic data at the Security/Basic level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. +>[!IMPORTANT] +>- The Allowed Traffic endpoints for an MDM configuration are here: [Allowed Traffic](#bkmk-mdm-allowedtraffic) +> - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign. +> - There is some traffic which is specifically required for the Microsoft Intune based management of Windows 10 devices. This traffic includes Windows Notifications Service (WNS), Automatic Root Certificates Update (ARCU), and some Windows Update related traffic. The aforementioned traffic comprises the Allowed Traffic for Microsoft Intune MDM Server to manage Windows 10 devices. +>- For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: disabling Windows Update, disabling Automatic Root Certificates Update, and disabling Windows Defender. Accordingly, we do not recommend disabling any of these features. +>- To ensure CSPs take priority over Group Policies in case of conflicts, use the [ControlPolicyConflict](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy. +>- The **Get Help** and **Give us Feedback** links in Windows may no longer work after applying some or all of the MDM/CSP settings. -Note, there is some traffic which is required (i.e. "whitelisted") for the operation of Windows and the Microsoft InTune based management. This traffic includes CRL and OCSP network traffic which will show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. Additional whitelisted traffic specifically for MDM managed devices includes Windows Notification Service related traffic as well as some specific Microsoft InTune and Windows Update related traffic. +>[!Warning] +>If a user executes the "Reset this PC" command (Settings -> Update & Security -> Recovery) with the "Remove Everything" option the >Windows Restricted Traffic Limited Functionality settings will need to be re-applied in order re-restrict the device's egress traffic. >To do this the client must be re-enrolled to the Microsoft Intune service. Egress traffic may occur during the period prior to the re->application of the Restricted Traffic Limited Functionality settings. If the user executes a "Reset this PC" with the "Keep my files" >option the Restricted Traffic Limited Functionality settings are retained on the device, and therefore the client will remain in a >Restricted Traffic configuration during and after the "Keep my files" reset, and no re-enrollment is required. -For more information on Microsoft InTune please see [Transform IT service delivery for your modern workplace](https://www.microsoft.com/en-us/enterprise-mobility-security/microsoft-intune?rtc=1) and [Microsoft Intune documentation](https://docs.microsoft.com/intune/). +For more information on Microsoft Intune please see [Transform IT service delivery for your modern workplace](https://www.microsoft.com/en-us/enterprise-mobility-security/microsoft-intune?rtc=1) and [Microsoft Intune documentation](https://docs.microsoft.com/intune/). -For detailed information about managing network connections to Microsoft services using Registries, Group Policies, or UI see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). +For detailed information about managing network connections to Microsoft services using Windows Settings, Group Policies and Registry settings see [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). + +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by sending email to **telmhelp**@**microsoft.com**. -The endpoints for the MDM “whitelisted” traffic are in the [Whitelisted Traffic](#bkmk-mdm-whitelist). - - -### Settings for Windows 10 Enterprise edition 1903 and newer +## Settings for Windows 10 Enterprise edition 1903 and newer The following table lists management options for each setting. @@ -63,7 +70,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. **Internet Explorer** The following Microsoft Internet Explorer MDM policies are available in the [Internet Explorer CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer) 1. MDM Policy: [InternetExplorer/AllowSuggestedSites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsuggestedsites). Recommends websites based on the user’s browsing activity. **Set to Disabled** - 1. MDM Policy: [InternetExplorer/PreventManagingSmartScreenFilter]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-preventmanagingsmartscreenfilter). Prevents the user from managing SmartScreen Filter, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. **Set to String** with Value: + 1. MDM Policy: [InternetExplorer/PreventManagingSmartScreenFilter]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-preventmanagingsmartscreenfilter). Prevents the user from managing Windows Defender SmartScreen, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. **Set to String** with Value: 1. **\\** 1. MDM Policy: [InternetExplorer/DisableFlipAheadFeature]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableflipaheadfeature). Determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website. **Set to Enabled** 1. MDM Policy: [InternetExplorer/DisableHomePageChange]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablehomepagechange). Determines whether users can change the default Home Page or not. **Set to String** with Value: @@ -86,7 +93,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. MDM Policy: [Browser/AllowMicrosoftCompatbilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowmicrosoftcompatibilitylist). Specify the Microsoft compatibility list in Microsoft Edge. **Set to 0 (zero)** 1. MDM Policy: [Browser/AllowPasswordManager](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager). Choose whether employees can save passwords locally on their devices. **Set to 0 (zero)** 1. MDM Policy: [Browser/AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchsuggestionsinaddressbar). Choose whether the Address Bar shows search suggestions. **Set to 0 (zero)** - 1. MDM Policy: [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Choose whether SmartScreen is turned on or off. **Set to 0 (zero)** + 1. MDM Policy: [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Choose whether Windows Defender SmartScreen is turned on or off. **Set to 0 (zero)** 1. **Network Connection Status Indicator** 1. [Connectivity/DisallowNetworkConnectivityActiveTests](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-connectivity#connectivity-disallownetworkconnectivityactivetests). Note: After you apply this policy you must restart the device for the policy setting to take effect. **Set to 1 (one)** @@ -98,7 +105,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. **OneDrive** 1. MDM Policy: [DisableOneDriveFileSync](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-disableonedrivefilesync). Allows IT Admins to prevent apps and features from working with files on OneDrive. **Set to 1 (one)** 1. Ingest the ADMX - To get the latest OneDrive ADMX file you need an up-to-date Windows 10 client. The ADMX files are located under the following path: %LocalAppData%\Microsoft\OneDrive\ there's a folder with the current OneDrive build (e.g. "18.162.0812.0001"). There is a folder named "adm" which contains the admx and adml policy definition files. - 1. MDM Policy: Prevent Network Traffic before User SignIn. **PreventNetworkTrafficPreUserSignIn**. The OMA-URI value is: ./Device/Vendor/MSFT/Policy/Config/OneDriveNGSC\~Policy\~OneDriveNGSC/PreventNetworkTrafficPreUserSignIn, **String, \** + 1. MDM Policy: Prevent Network Traffic before User SignIn. **PreventNetworkTrafficPreUserSignIn**. The OMA-URI value is: **./Device/Vendor/MSFT/Policy/Config/OneDriveNGSC\~Policy\~OneDriveNGSC/PreventNetworkTrafficPreUserSignIn**, Data type: **String**, Value: **\** 1. **Privacy settings** Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. @@ -134,23 +141,25 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. **Windows Defender** 1. [Defender/AllowCloudProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-allowcloudprotection). Disconnect from the Microsoft Antimalware Protection Service. **Set to 0 (zero)** 1. [Defender/SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent). Stop sending file samples back to Microsoft. **Set to 2 (two)** - 1. Windows Defender Smartscreen - [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Disable Windows Defender Smartscreen. **Set to 0 (zero)** - 1. Windows Defender Smartscreen EnableAppInstallControl - [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol). Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** - 1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** + 1. [Defender/EnableSmartScreenInShell](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings#mdm-settings). Turns off SmartScreen in Windows for app and file execution. **Set to 0 (zero)** + 1. Windows Defender SmartScreen - [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Disable Windows Defender SmartScreen. **Set to 0 (zero)** + 1. Windows Defender SmartScreen EnableAppInstallControl - [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol). Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** + 1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** + 1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **String**, Value: **FileShares** 1. **Windows Spotlight** - [Experience/AllowWindowsSpotlight](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight). Disable Windows Spotlight. **Set to 0 (zero)** 1. **Microsoft Store** 1. [ApplicationManagement/DisableStoreOriginatedApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-disablestoreoriginatedapps). Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded. **Set to 1 (one)** 1. [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate). Specifies whether automatic update of apps from Microsoft Store are allowed. **Set to 0 (zero)** 1. **Apps for websites** - [ApplicationDefaults/EnableAppUriHandlers](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationdefaults#applicationdefaults-enableappurihandlers). This policy setting determines whether Windows supports web-to-app linking with app URI handlers. **Set to 0 (zero)** 1. **Windows Update Delivery Optimization** - The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - 1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 100 (one hundred)** + 1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 99 (ninety-nine)** 1. **Windows Update** 1. [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). Control automatic updates. **Set to 5 (five)** - 1. Windows Update Allow Update Service - [Update/AllowUpdateService](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-allowupdateservice). Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** - 1. Windows Update Service URL - [Update/UpdateServiceUrl](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-updateserviceurl). Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with the Value: + 1. Windows Update Allow Update Service - [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice). Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** + 1. Windows Update Service URL - [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl). Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with the Value: 1. **\\$CmdID$\\\chr\text/plain\\ \./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl\\http://abcd-srv:8530\\** -### Allowed traffic ("Whitelisted traffic") for Microsoft InTune / MDM configurations +### Allowed traffic for Microsoft Intune / MDM configurations |**Allowed traffic endpoints** | | --- | @@ -159,6 +168,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt |client.wns.windows.com| |crl.microsoft.com/pki/crl/*| |ctldl.windowsupdate.com| +|*displaycatalog.mp.microsoft.com| |dm3p.wns.windows.com| |\*microsoft.com/pkiops/\*| |ocsp.digicert.com/*| diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index af50e5b96b..4c6e0b8880 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1,23 +1,23 @@ --- -title: Manage connections from Windows operating system components to Microsoft services (Windows 10) -description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. +title: Manage connections from Windows 10 operating system components to Microsoft services +description: Learn how to minimize connections from Windows to Microsoft services, and configure particular privacy settings related to these connections. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 ms.reviewer: keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.localizationpriority: medium +ms.localizationpriority: high audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp +author: linque1 +ms.author: robsize +manager: robsize ms.collection: M365-security-compliance ms.topic: article -ms.date: 05/16/2019 +ms.date: 12/1/2020 --- -# Manage connections from Windows operating system components to Microsoft services +# Manage connections from Windows 10 operating system components to Microsoft services **Applies to** @@ -25,29 +25,30 @@ ms.date: 05/16/2019 - Windows Server 2016 - Windows Server 2019 -If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +This article describes the network connections that Windows 10 components make to Microsoft and the Windows Settings, Group Policies and registry settings available to IT Professionals to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. -Learn about the network connections that Windows components make to Microsoft in addition to the privacy settings that affect the data which is shared with either Microsoft or apps and how they can be managed by an IT Pro. +Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. -If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure diagnostic data at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. +>[!IMPORTANT] +> - The downloadable Windows 10, version 1903 scripts/settings can be used on Windows 10, version 1909 devices. +> - The Allowed Traffic endpoints are listed here: [Allowed Traffic](#bkmk-allowedtraffic) +> - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign. +> - For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Windows Defender. Accordingly, we do not recommend disabling any of these features. +> - It is recommended that you restart a device after making configuration changes to it. +> - The **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. -You can configure diagnostic data at the Security/Basic level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. +> [!Warning] +> - If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. +> - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. +> - During update or upgrade of Windows, egress traffic may occur. -To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887), but **before application please ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors. This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state. -Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure you've chosen the right settings configuration for your environment before applying. -You should not extract this package to the windows\\system32 folder because it will not apply correctly. +To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) -Applying the Windows Restricted Traffic Limited Functionality Baseline is the same as applying each setting covered in this article. -It is recommended that you restart a device after making configuration changes to it. -Note that **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting **telmhelp**@**microsoft.com**. -To use Microsoft InTune cloud based device management for restricting traffic please refer to the [Manage connections from Windows operating system components to Microsoft services using MDM](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). +## Management options for each setting -We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. - -## Management options for each setting - -The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections. +The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections ### Settings for Windows 10 Enterprise edition @@ -57,18 +58,18 @@ The following table lists management options for each setting, beginning with Wi | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [9. License Manager](#bkmk-licmgr) | | | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -106,7 +107,7 @@ The following table lists management options for each setting, beginning with Wi | [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -117,12 +118,12 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -168,17 +169,17 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -216,7 +217,7 @@ See the following table for a summary of the management settings for Windows Ser | [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | -| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ## How to configure each setting @@ -230,7 +231,7 @@ For more information, see [Automatic Root Certificates Update Configuration](htt Although not recommended, you can turn off Automatic Root Certificates Update, which also prevents updates to the disallowed certificate list and the pin rules list. > [!CAUTION] -> By not automatically downloading the root certificates, the device might have not been able to connect to some websites. +> By not automatically downloading the root certificates the device may not be able to connect to some websites. For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core: @@ -260,7 +261,7 @@ On Windows Server 2016 Nano Server: - Create the registry path **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\AuthRoot** and then add a REG_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1. >[!NOTE] ->CRL and OCSP network traffic is currently whitelisted and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. +>CRL and OCSP network traffic is currently Allowed Traffic and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. ### 2. Cortana and Search @@ -276,7 +277,6 @@ Find the Cortana Group Policy objects under **Computer Configuration** > **Ad | Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results.

              **Disable** this policy to block access to location information for Cortana. | | Do not allow web search | Choose whether to search the web from Windows Desktop Search.

              **Enable** this policy to remove the option to search the Internet from Cortana. | | Don't search the web or display web results in Search| Choose whether to search the web from Cortana.

              **Enable** this policy to stop web queries and results from showing in Search. | -| Set what information is shared in Search | Control what information is shared with Bing in Search.

              If you **enable** this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. | You can also apply the Group Policies using the following registry keys: @@ -286,7 +286,7 @@ You can also apply the Group Policies using the following registry keys: | Allow search and Cortana to use location | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
              REG_DWORD: AllowSearchToUseLocation
              Value: 0 | | Do not allow web search | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
              REG_DWORD: DisableWebSearch
              Value: 1 | | Don't search the web or display web results in Search| HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
              REG_DWORD: ConnectedSearchUseWeb
              Value: 0 | -| Set what information is shared in Search | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
              REG_DWORD: ConnectedSearchPrivacy
              Value: 3 | + >[!IMPORTANT] > Using the Group Policy editor these steps are required for all supported versions of Windows 10, however they are not required for devices running Windows 10, version 1607 or Windows Server 2016. @@ -390,7 +390,7 @@ Windows Insider Preview builds only apply to Windows 10 and are not available fo > [!NOTE] -> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for zero exhaust) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**. +> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for Restricted Traffic) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**. To turn off Insider Preview builds for a released version of Windows 10: @@ -415,7 +415,7 @@ To turn off Insider Preview builds for Windows 10: ### 8. Internet Explorer > [!NOTE] ->When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/en-us/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: +>When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -423,7 +423,7 @@ To turn off Insider Preview builds for Windows 10: | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar.
              **Set Value to: Disabled**| | Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar.
              **Set Value to: Enabled**
              You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| | Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
              **Set Value to: Enabled**| -| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
              **Set Value to: Enabled** and then set **Select SmartScreen filtering mode** to **Off**.| +| Prevent managing Windows Defender SmartScreen | Choose whether employees can manage the Windows Defender SmartScreen in Internet Explorer.
              **Set Value to: Enabled** and then set **Select Windows Defender SmartScreen mode** to **Off**.| | Registry Key | Registry path | @@ -432,13 +432,13 @@ To turn off Insider Preview builds for Windows 10: | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
              REG_DWORD: AllowServicePoweredQSA
              **Set Value to: 0**| | Turn off the auto-complete feature for web addresses |HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\CurrentVersion\\Explorer\\AutoComplete
              REG_SZ: AutoSuggest
              Set Value to: **no** | | Turn off browser geolocation | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
              REG_DWORD: PolicyDisableGeolocation
              **Set Value to: 1** | -| Prevent managing SmartScreen filter | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
              REG_DWORD: EnabledV9
              **Set Value to: 0** | +| Prevent managing Windows Defender SmartScreen | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
              REG_DWORD: EnabledV9
              **Set Value to: 0** | There are more Group Policy objects that are used by Internet Explorer: | Path | Policy | Description | | - | - | - | -| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can fix website display problems that he or she may encounter while browsing.
              **Set to: Enabled** | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Turn off Compatibility View. | Choose whether an employee can fix website display problems that he or she may encounter while browsing.
              **Set to: Enabled** | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
              **Set to: Enabled** | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
              **Set to: Enabled** | | **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Allow Online Tips** | Allow Online Tips | Enables or disables the retrieval of online tips and help for the Settings app.
              **Set to: Disabled** | @@ -553,7 +553,7 @@ To disable the Microsoft Account Sign-In Assistant: ### 13. Microsoft Edge -Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682). +Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682) and [Configure Microsoft Edge policy settings on Windows](https://docs.microsoft.com/DeployEdge/configure-microsoft-edge). ### 13.1 Microsoft Edge Group Policies @@ -583,7 +583,7 @@ Alternatively, you can configure the following Registry keys as described: | Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
              REG_DWORD name: DoNotTrack
              REG_DWORD: **1** | | Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
              REG_SZ name: FormSuggest Passwords
              REG_SZ: **No** | | Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
              REG_DWORD name: ShowSearchSuggestionsGlobal
              Value: **0**| -| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
              REG_DWORD name: EnabledV9
              Value: **0** | +| Configure Windows Defender SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
              REG_DWORD name: EnabledV9
              Value: **0** | | Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
              REG_DWORD name: AllowWebContentOnNewTabPage
              Value: **0** | | Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings
              REG_SZ name: ProvisionedHomePages
              Value: **<>**| | Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
              REG_DWORD name: PreventFirstRunPage
              Value: **1**| @@ -614,6 +614,10 @@ You can turn off NCSI by doing one of the following: You can turn off the ability to download and update offline maps. +- Turn **Off** the feature in the UI by going to **Settings -> Apps -> Offline maps -> Map updates**, toggle the **Automatically update maps** switch to **Off** + + -or- + - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** -or- @@ -881,7 +885,7 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin - Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one). -To turn off **Turn on SmartScreen Filter to check web content (URLs) that Microsoft Store apps use**: +To turn off **Turn on Windows Defender SmartScreen to check web content (URLs) that Microsoft Store apps use**: - Turn off the feature in the UI. @@ -929,27 +933,26 @@ To turn off **Location for this device**: - Click the **Change** button in the UI. -or- - + - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. -or- -- Create a REG_DWORD registry setting named **LetAppsAccessLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. - - -To turn off **Location**: - -- Turn off the feature in the UI. - - -or- - -- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**. - - -or- - - Create a REG_DWORD registry setting named **DisableLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LocationAndSensors** with a value of 1 (one). +To turn off **Allow apps to access your location**: +- Turn off the feature in the UI. + + -or- + +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**. + + -or- + +- Create a REG_DWORD registry setting named **LetAppsAccessLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. + + To turn off **Location history**: - Erase the history using the **Clear** button in the UI. @@ -1073,7 +1076,7 @@ To turn off **Let apps access my name, picture, and other account info**: -or- -- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). @@ -1097,7 +1100,7 @@ To turn off **Choose apps that can access contacts**: -or- -- Create a REG_DWORD registry setting named **LetAppsAccessContacts** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessContacts** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). ### 18.9 Calendar @@ -1113,7 +1116,7 @@ To turn off **Let apps access my calendar**: -or- -- Create a REG_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). To turn off **Choose apps that can access calendar**: @@ -1260,7 +1263,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co ### 18.16 Feedback & diagnostics -In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To change how frequently **Windows should ask for my feedback**: @@ -1413,13 +1416,25 @@ To turn this off: In the **Inking & Typing** area you can configure the functionality as such: -To turn off Inking & Typing data collection (note: there is no Group Policy for this setting): +To turn off Inking & Typing data collection: -- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Inking and typing** and turn **Improve inking & typing** to **Off** +- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Improve inking and typing** and turn it to **Off** - -or- + -OR- + + **Disable** the Group Policy: **Computer Configuration > Administrative Templates > Windows Components > Text Input > Improve inking and typing recognition** + + -and- + + **Disable** the Group Policy: **User Configuration > Administrative Templates > Control Panel > Regional and Language Options > Handwriting personalization > Turn off automatic learning** + + -OR- -- Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\InputPersonalization** to a **value of 1 (one)** +- Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization** to a **value of 1 (one)** + + -and- + +- Set **RestrictImplicitInkCollection** registry REG_DWORD setting in **HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization** to a **value of 1 (one)** ### 18.22 Activity History @@ -1463,20 +1478,20 @@ To turn this Off in the UI: -OR- -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice** and set the **Select a setting** box to **Force Deny** -and- -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice while the system is locked** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice while the system is locked** box to **Force Deny** -OR- -- Create a REG_DWORD registry setting named **LetAppsActivateWithVoice** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 0 (zero)** +- Create a REG_DWORD registry setting named **LetAppsActivateWithVoice** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)** -and- -- Create a REG_DWORD registry setting named **PublishUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 0 (zero)** +- Create a REG_DWORD registry setting named **LetAppsActivateWithVoiceAboveLock** in **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppPrivacy** with a **value of 2 (two)** @@ -1535,18 +1550,17 @@ You can control if your settings are synchronized: To turn off Messaging cloud sync: -- Note: There is no Group Policy corresponding to this registry key. +> [!NOTE] +> There is no Group Policy corresponding to this registry key. - -or- - -- Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. +- Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. ### 22. Teredo You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](https://technet.microsoft.com/library/cc722030.aspx). >[!NOTE] ->If you disable Teredo, some XBOX gaming features and Windows Update Delivery Optimization will not work. +>If you disable Teredo, some XBOX gaming features and Delivery Optimization (with Group or Internet peering) will not work. - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**. @@ -1584,9 +1598,9 @@ You can disconnect from the Microsoft Antimalware Protection Service. >[!IMPORTANT] >**Required Steps BEFORE setting the Windows Defender Group Policy or RegKey on Windows 10 version 1903** >1. Ensure Windows and Windows Defender are fully up to date. ->2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to >the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make >the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link >and then scroll down to the Tamper Protection toggle to set it to **Off**. +>2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link and then scroll down to the Tamper Protection toggle to set it to **Off**. -- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS** +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS** -OR- @@ -1599,7 +1613,7 @@ You can disconnect from the Microsoft Antimalware Protection Service. You can stop sending file samples back to Microsoft. -- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Never Send**. +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Never Send**. -or- @@ -1608,11 +1622,15 @@ You can stop sending file samples back to Microsoft. You can stop downloading **Definition Updates**: -- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. +> [!NOTE] +> The Group Policy path for 1809 and earlier builds is **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Signature Updates** + + +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. -and- -- **Disable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to **Nothing**. +- **Disable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates** > **Define file shares for downloading definition updates** and set it to **Nothing**. -or- @@ -1623,11 +1641,12 @@ You can stop downloading **Definition Updates**: - **Remove** the **DefinitionUpdateFileSharesSources** reg value if it exists under **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** -You can turn off **Malicious Software Reporting Tool diagnostic data**: +You can turn off **Malicious Software Reporting Tool (MSRT) diagnostic data**: - Set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to **1**. -**Note:** There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. +> [!NOTE] +> There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. You can turn off **Enhanced Notifications** as follows: @@ -1636,16 +1655,16 @@ You can turn off **Enhanced Notifications** as follows: -or- -- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Reporting**. +- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Reporting**. -or- -- Create a new REG_SZ registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** to a value of **1**. +- Create a new REG_DWORD registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** and enter the decimal value **1**. ### 24.1 Windows Defender SmartScreen -To disable Windows Defender Smartscreen: +To disable Windows Defender SmartScreen: In Group Policy, configure: @@ -1722,15 +1741,15 @@ If you're running Windows 10, version 1607 or later, you need to: > This will only take effect if the policy is applied before the first logon. > If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, > you can **Enable** the **Do not display the lock screen** policy under **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** - + > > Alternatively, you can create a new REG_SZ registry setting named **LockScreenImage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** > with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG_DWORD registry setting named **LockScreenOverlaysDisabled** in > **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **1 (one)**. - + > > The Group Policy for the **LockScreenOverlaysDisabled** regkey is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**. --AND- + \-AND- - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips** to **Enabled** @@ -1740,7 +1759,7 @@ If you're running Windows 10, version 1607 or later, you need to: - Create a new REG_DWORD registry setting named **DisableSoftLanding** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** --AND- + \-AND- - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences** to **Enabled** @@ -1790,19 +1809,19 @@ You can turn off apps for websites, preventing customers who visit websites that - Create a new REG_DWORD registry setting named **EnableAppUriHandlers** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)**. -### 28. Windows Update Delivery Optimization +### 28. Delivery Optimization -Windows Update Delivery Optimization lets you get Windows updates and Microsoft Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. +Delivery Optimization is the downloader of Windows updates, Microsoft Store apps, Office and other content from Microsoft. Delivery Optimization can also download from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization Peer-to-Peer option turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. -By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. +By default, PCs running Windows 10 will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. Use the UI, Group Policy, or Registry Keys to set up Delivery Optimization. -In Windows 10 version 1607 and above you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Bypass** (100), as described below. +In Windows 10 version 1607 and above you can stop network traffic related to Delivery Optimization Cloud Service by setting **Download Mode** to **Simple Mode** (99), as described below. ### 28.1 Settings > Update & security -You can set up Delivery Optimization from the **Settings** UI. +You can set up Delivery Optimization Peer-to-Peer from the **Settings** UI. - Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. @@ -1818,17 +1837,23 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con | Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
              The default value is 20, which represents 20% of the disk.| | Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
              The default value is 0, which means unlimited possible bandwidth.| + +For a comprehensive list of Delivery Optimization Policies, see [Delivery Optimization Reference](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference). + ### 28.3 Delivery Optimization -- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Bypass"** to prevent traffic. +- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Simple Mode (99)"** to prevent traffic between peers as well as traffic back to the Delivery Optimization Cloud Service. -or- -- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **100 (one hundred)**. +- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **99 (Ninety-nine)**. For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). +For IT Professionals, information about Delivery Optimization is available here: [Delivery Optimization for Windows 10 updates] +(https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization). + ### 29. Windows Update You can turn off Windows Update by setting the following registry entries: @@ -1881,8 +1906,16 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre - Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the value to 0. + +### Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline + +|Allowed traffic endpoints| +| --- | +|activation-v2.sls.microsoft.com/*| +|crl.microsoft.com/pki/crl/*| +|ocsp.digicert.com/*| +|www.microsoft.com/pkiops/*| To learn more, see [Device update management](https://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](https://technet.microsoft.com/library/cc720539.aspx). - diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index ae5da4bba4..8ec7b613c3 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -1,6 +1,6 @@ --- -title: Connection endpoints for Windows 10, version 1709 -description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. +title: Connection endpoints for Windows 10 Enterprise, version 1709 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1709. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -15,11 +15,11 @@ ms.topic: article ms.date: 6/26/2018 ms.reviewer: --- -# Manage connection endpoints for Windows 10, version 1709 +# Manage connection endpoints for Windows 10 Enterprise, version 1709 **Applies to** -- Windows 10, version 1709 +- Windows 10 Enterprise, version 1709 Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: @@ -84,7 +84,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a |----------------|----------|------------| | | | star-mini.c10r.facebook.com | -The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. +The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. @@ -293,7 +293,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Office -The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -304,7 +304,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | | | *.e-msedge.net | | | | *.s-msedge.net | -The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -456,4 +456,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index 2ad044d990..9525d0fed9 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -1,6 +1,6 @@ --- title: Connection endpoints for Windows 10, version 1803 -description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1803. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -15,11 +15,11 @@ ms.topic: article ms.date: 6/26/2018 ms.reviewer: --- -# Manage connection endpoints for Windows 10, version 1803 +# Manage connection endpoints for Windows 10 Enterprise, version 1803 **Applies to** -- Windows 10, version 1803 +- Windows 10 Enterprise, version 1803 Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: @@ -85,7 +85,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a |----------------|----------|------------| | | | star-mini.c10r.facebook.com | -The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. +The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. @@ -297,7 +297,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Office -The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -309,7 +309,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | | | *.s-msedge.net | | | HTTPS | ocos-office365-s2s.msedge.net | -The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -461,4 +461,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index f574f6409d..6ff4c469cf 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -1,6 +1,6 @@ --- title: Connection endpoints for Windows 10, version 1809 -description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1809. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -15,11 +15,12 @@ ms.topic: article ms.date: 6/26/2018 ms.reviewer: --- -# Manage connection endpoints for Windows 10, version 1809 + +# Manage connection endpoints for Windows 10 Enterprise, version 1809 **Applies to** -- Windows 10, version 1809 +- Windows 10 Enterprise, version 1809 Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: @@ -30,17 +31,17 @@ Some Windows components, app, and related services transfer data to Microsoft ne - Using your location to show a weather forecast. This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. -Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it. +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it. We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. +5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. @@ -49,70 +50,70 @@ We used the following methodology to derive these network endpoints: ## Apps -The following endpoint is used to download updates to the Weather app Live Tile. +The following endpoint is used to download updates to the Weather app Live Tile. If you [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), no Live Tiles will be updated. | Source process | Protocol | Destination | -|----------------|----------|------------| -| explorer | HTTP | tile-service.weather.microsoft.com | +|:--------------:|:--------:|:------------| +| explorer | HTTP | tile-service.weather.microsoft.com | | | HTTP | blob.weather.microsoft.com | -The following endpoint is used for OneNote Live Tile. -To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for OneNote Live Tile. +To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | cdn.onenote.net/livetile/?Language=en-US | -The following endpoints are used for Twitter updates. -To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoints are used for Twitter updates. +To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | wildcard.twimg.com | | svchost.exe | | oem.twimg.com/windows/tile.xml | -The following endpoint is used for Facebook updates. -To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for Facebook updates. +To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | star-mini.c10r.facebook.com | -The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. -To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. +To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | WindowsApps\Microsoft.Windows.Photos | HTTPS | evoke-windowsservices-tas.msedge.net | -The following endpoint is used for Candy Crush Saga updates. -To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for Candy Crush Saga updates. +To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | TLS v1.2 | candycrushsoda.king.com | -The following endpoint is used for by the Microsoft Wallet app. -To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for by the Microsoft Wallet app. +To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | system32\AppHostRegistrationVerifier.exe | HTTPS | wallet.microsoft.com | -The following endpoint is used by the Groove Music app for update HTTP handler status. +The following endpoint is used by the Groove Music app for update HTTP handler status. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app. | Source process | Protocol | Destination | @@ -123,7 +124,7 @@ The following endpoints are used when using the Whiteboard app. To turn off traffic for this endpoint [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | wbd.ms | | | HTTPS | int.whiteboard.microsoft.com | | | HTTPS | whiteboard.microsoft.com | @@ -135,28 +136,28 @@ The following endpoint is used to get images that are used for Microsoft Store s If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block images that are used for Microsoft Store suggestions. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | searchui | HTTPS |store-images.s-microsoft.com | The following endpoint is used to update Cortana greetings, tips, and Live Tiles. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block updates to Cortana greetings, tips, and Live Tiles. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | backgroundtaskhost | HTTPS | www.bing.com/client | -The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments. +The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters would not be updated and the device would no longer participate in experiments. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | backgroundtaskhost | HTTPS | www.bing.com/proactive | The following endpoint is used by Cortana to report diagnostic and diagnostic data information. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and won't be able to fix them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | searchui
              backgroundtaskhost | HTTPS | www.bing.com/threshold/xls.aspx | ## Certificates @@ -164,13 +165,13 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. -These settings are critical for both Windows security and the overall security of the Internet. +These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device. | Source process | Protocol | Destination | -|----------------|----------|------------| -| svchost | HTTP | ctldl.windowsupdate.com | +|:--------------:|:--------:|:------------| +| svchost | HTTP | ctldl.windowsupdate.com | ## Device authentication @@ -178,7 +179,7 @@ The following endpoint is used to authenticate a device. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), the device will not be authenticated. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | login.live.com/ppsecure | ## Device metadata @@ -187,7 +188,7 @@ The following endpoint is used to retrieve device metadata. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-devinst), metadata will not be updated for the device. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | dmd.metaservices.microsoft.com.akadns.net | | | HTTP | dmd.metaservices.microsoft.com | @@ -197,21 +198,21 @@ The following endpoint is used by the Connected User Experiences and Telemetry c If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | | cy2.vortex.data.microsoft.com.akadns.net | The following endpoint is used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | v10.vortex-win.data.microsoft.com/collect/v1 | The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | wermgr | | watson.telemetry.microsoft.com | | | TLS v1.2 | modern.watson.data.microsoft.com.akadns.net | @@ -221,9 +222,9 @@ The following endpoints are used to download fonts on demand. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#font-streaming), you will not be able to download fonts on demand. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | | fs.microsoft.com | -| | | fs.microsoft.com/fs/windows/config.json | +| | | fs.microsoft.com/fs/windows/config.json | ## Licensing @@ -231,7 +232,7 @@ The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | licensemanager | HTTPS | licensing.mp.microsoft.com/v7.0/licenses/content | ## Location @@ -240,7 +241,7 @@ The following endpoint is used for location data. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location), apps cannot use location data. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | location-inference-westus.cloudapp.net | | | HTTPS | inference.location.live.net | @@ -250,17 +251,19 @@ The following endpoint is used to check for updates to maps that have been downl If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps), offline maps will not be updated. | Source process | Protocol | Destination | -|----------------|----------|------------| -| svchost | HTTPS | *g.akamaiedge.net | +|:--------------:|:--------:|:------------| +| svchost | HTTPS | *g.akamaiedge.net | ## Microsoft account -The following endpoints are used for Microsoft accounts to sign in. +The following endpoints are used for Microsoft accounts to sign in. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account), users cannot sign in with Microsoft accounts. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | login.msa.akadns6.net | +| | | login.live.com | +| | | account.live.com | | system32\Auth.Host.exe | HTTPS | auth.gfx.ms | | | | us.configsvc1.live.com.akadns.net | @@ -270,29 +273,29 @@ The following endpoint is used for the Windows Push Notification Services (WNS). If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | *.wns.windows.com | -The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. +The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | storecatalogrevocation.storequality.microsoft.com | -The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). +The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | img-prod-cms-rt-microsoft-com.akamaized.net | | backgroundtransferhost | HTTPS | store-images.microsoft.com | -The following endpoints are used to communicate with Microsoft Store. +The following endpoints are used to communicate with Microsoft Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | storeedgefd.dsx.mp.microsoft.com | | | HTTP \ HTTPS | pti.store.microsoft.com | ||TLS v1.2|cy2.\*.md.mp.microsoft.com.\*.| @@ -300,48 +303,48 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op ## Network Connection Status Indicator (NCSI) -Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. +Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi), NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | www.msftconnecttest.com/connecttest.txt | ## Office -The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. | Source process | Protocol | Destination | -|----------------|----------|------------| -| | | *.a-msedge.net | -| hxstr | | *.c-msedge.net | +|:--------------:|:--------:|:------------| +| | | *.a-msedge.net | +| hxstr | | *.c-msedge.net | | | | *.e-msedge.net | | | | *.s-msedge.net | | | HTTPS | ocos-office365-s2s.msedge.net | | | HTTPS | nexusrules.officeapps.live.com | | | HTTPS | officeclient.microsoft.com | -The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | system32\Auth.Host.exe | HTTPS | outlook.office365.com | The following endpoint is OfficeHub traffic used to get the metadata of Office apps. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| |Windows Apps\Microsoft.Windows.Photos|HTTPS|client-office365-tas.msedge.net| The following endpoint is used to connect the Office To-Do app to it's cloud service. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | |HTTPS|to-do.microsoft.com| ## OneDrive @@ -350,15 +353,15 @@ The following endpoint is a redirection service that’s used to automatically u If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive), anything that relies on g.live.com to get updated URL information will no longer work. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | onedrive | HTTP \ HTTPS | g.live.com/1rewlive5skydrive/ODSUProduction | The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). To turn off traffic for this endpoint, uninstall OneDrive for Business. In this case, your device will not able to get OneDrive for Business app updates. | Source process | Protocol | Destination | -|----------------|----------|------------| -| onedrive | HTTPS | oneclient.sfx.ms | +|:--------------:|:--------:|:------------| +| onedrive | HTTPS | oneclient.sfx.ms | ## Settings @@ -366,21 +369,21 @@ The following endpoint is used as a way for apps to dynamically update their con If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | dmclient | | cy2.settings.data.microsoft.com.akadns.net | The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | dmclient | HTTPS | settings.data.microsoft.com | The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as Windows Connected User Experiences and Telemetry component and Windows Insider Program use it. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | settings-win.data.microsoft.com | ## Skype @@ -388,7 +391,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| |microsoft.windowscommunicationsapps.exe | HTTPS | config.edge.skype.com | | | HTTPS | browser.pipe.aria.microsoft.com | | | | skypeecs-prod-usw-0-b.cloudapp.net | @@ -396,28 +399,28 @@ The following endpoint is used to retrieve Skype configuration values. To turn o ## Windows Defender The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. For a detailed list of Microsoft Defender Antivirus cloud service connections, see [Allow connections to the Microsoft Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus#allow-connections-to-the-microsoft-defender-antivirus-cloud-service). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | wdcp.microsoft.com | The following endpoints are used for Windows Defender definition updates. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), definitions will not be updated. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | definitionupdates.microsoft.com | |MpCmdRun.exe|HTTPS|go.microsoft.com | The following endpoints are used for Windows Defender Smartscreen reporting and notifications. -If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Smartscreen notifications will no appear. +If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Windows Defender Smartscreen notifications will no appear. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | ars.smartscreen.microsoft.com | | | HTTPS | unitedstates.smartscreen-prod.microsoft.com | -| | | smartscreen-sn3p.smartscreen.microsoft.com | +| | | smartscreen-sn3p.smartscreen.microsoft.com | ## Windows Spotlight @@ -425,7 +428,7 @@ The following endpoints are used to retrieve Windows Spotlight metadata that des If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight), Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see [Windows Spotlight](/windows/configuration/windows-spotlight). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | backgroundtaskhost | HTTPS | arc.msn.com | | backgroundtaskhost | | g.msn.com.nsatc.net | | |TLS v1.2| *.search.msn.com | @@ -438,22 +441,22 @@ The following endpoint is used for Windows Update downloads of apps and OS updat If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates), Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | *.prod.do.dsp.mp.microsoft.com | -The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. +The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTP | *.windowsupdate.com | | svchost | HTTP | *.dl.delivery.mp.microsoft.com | -The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. +The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | *.update.microsoft.com | | svchost | HTTPS | *.delivery.mp.microsoft.com | @@ -465,7 +468,7 @@ The following endpoint is used for content regulation. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | tsfe.trafficshaping.dsp.mp.microsoft.com | @@ -476,7 +479,7 @@ The following endpoint is used by the Microsoft forward link redirection service If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded. | Source process | Protocol | Destination | -|----------------|----------|------------| +|----------------|:--------:|------------| |Various|HTTPS|go.microsoft.com| ## Other Windows 10 editions @@ -494,4 +497,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network endpoints for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index 01c084966d..9aa743d944 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -1,18 +1,18 @@ --- title: Connection endpoints for Windows 10 Enterprise, version 1903 -description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1903. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro -author: danihalfin -ms.author: v-medgar -manager: sanashar +author: linque1 +ms.author: obezeajo +manager: robsize ms.collection: M365-security-compliance ms.topic: article -ms.date: 5/3/2019 +ms.date: 7/22/2020 --- # Manage connection endpoints for Windows 10 Enterprise, version 1903 @@ -50,12 +50,14 @@ The following methodology was used to derive these network endpoints: |Area|Description|Protocol|Destination| |----------------|----------|----------|------------| -|Apps|The following endpoints are used to download updates to the Weather app Live Tile. If you turn off traffic to this endpoint, no Live Tiles will be updated.|HTTP|blob.weather.microsoft.com| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoints are used to download updates to the Weather app Live Tile. If you turn off traffic to this endpoint, no Live Tiles will be updated.|HTTP|blob.weather.microsoft.com| +|||HTTP|tile-service.weather.microsoft.com |||HTTP|tile-service.weather.microsoft.com ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/livetile/?Language=en-US ||The following endpoint is used for Twitter updates. To turn off traffic for these endpoints, either uninstall Twitter or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|*.twimg.com*| ||The following endpoint is used for Candy Crush Saga updates. To turn off traffic for this endpoint, either uninstall Candy Crush Saga or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|candycrushsoda.king.com| -||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|evoke-windowsservices-tas.msedge.net| ||The following endpoint is used for by the Microsoft Wallet app. To turn off traffic for this endpoint, either uninstall the Wallet app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|wallet.microsoft.com| ||The following endpoint is used by the Groove Music app for update HTTP handler status. If you turn off traffic for this endpoint, apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app.|HTTPS|mediaredirect.microsoft.com| ||The following endpoints are used when using the Whiteboard app. To turn off traffic for this endpoint disable the Microsoft Store.|HTTPS|int.whiteboard.microsoft.com| @@ -65,8 +67,10 @@ The following methodology was used to derive these network endpoints: |Azure |The following endpoints are related to Azure. |HTTPS|wd-prod-*fe*.cloudapp.azure.com| |||HTTPS|ris-prod-atm.trafficmanager.net| |||HTTPS|validation-v2.sls.trafficmanager.net| -|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible turn off traffic to this endpoint, but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.|HTTP|ctldl.windowsupdate.com| -|Cortana and Search|The following endpoint is used to get images that are used for Microsoft Store suggestions. If you turn off traffic for this endpoint, you will block images that are used for Microsoft Store suggestions. |HTTPS|store-images.*microsoft.com| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible turn off traffic to this endpoint, but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||HTTP|ctldl.windowsupdate.com| +|Cortana and Search|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoint is used to get images that are used for Microsoft Store suggestions. If you turn off traffic for this endpoint, you will block images that are used for Microsoft Store suggestions.|HTTPS|store-images.*microsoft.com| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|HTTPS|www.bing.com/client| |||HTTPS|www.bing.com| |||HTTPS|www.bing.com/proactive| @@ -76,10 +80,12 @@ The following methodology was used to derive these network endpoints: |||HTTP|fp-vp.azureedge.net| |||HTTP|odinvzc.azureedge.net| |||HTTP|spo-ring.msedge.net| -|Device authentication| +|Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| ||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*| +|Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| ||The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.|HTTP|dmd.metaservices.microsoft.com| -|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft.|HTTP|v10.events.data.microsoft.com| +|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||HTTP|v10.events.data.microsoft.com| |||HTTPS|v10.vortex-win.data.microsoft.com/collect/v1| |||HTTP|www.microsoft.com| ||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|co4.telecommand.telemetry.microsoft.com| @@ -87,16 +93,22 @@ The following methodology was used to derive these network endpoints: |||HTTPS|cs1137.wpc.gammacdn.net| |||TLS v1.2|modern.watson.data.microsoft.com*| |||HTTPS|watson.telemetry.microsoft.com| -|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.|HTTPS|*licensing.mp.microsoft.com*| -|Location|The following endpoints are used for location data. If you turn off traffic for this endpoint, apps cannot use location data.|HTTPS|inference.location.live.net| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||HTTPS|*licensing.mp.microsoft.com*| +|Location|The following endpoints are used for location data. If you turn off traffic for this endpoint, apps cannot use location data. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location)| +|||HTTPS|inference.location.live.net| |||HTTP|location-inference-westus.cloudapp.net| -|Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|HTTPS|*g.akamaiedge.net| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|HTTPS|*g.akamaiedge.net| |||HTTP|*maps.windows.com*| -|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |HTTP|login.msa.akadns6.net| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |HTTP|login.msa.akadns6.net| |||HTTP|us.configsvc1.live.com.akadns.net| |Microsoft Edge|This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| |Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com| -|Microsoft Store|The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|HTTPS|*.wns.windows.com| +|||HTTP|www.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|HTTPS|*.wns.windows.com| ||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTP|storecatalogrevocation.storequality.microsoft.com| ||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com*| |||HTTPS|store-images.microsoft.com| @@ -106,9 +118,10 @@ The following methodology was used to derive these network endpoints: |||HTTP|storeedgefd.dsx.mp.microsoft.com| |||HTTP|markets.books.microsoft.com| |||HTTP |share.microsoft.com| -|Network Connection Status Indicator (NCSI)| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| ||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTP|www.msftconnecttest.com*| -Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.|HTTP|*.c-msedge.net| +|Office|The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTP|*.c-msedge.net| |||HTTPS|*.e-msedge.net| |||HTTPS|*.s-msedge.net| |||HTTPS|nexusrules.officeapps.live.com| @@ -120,37 +133,43 @@ Office|The following endpoints are used to connect to the Office 365 portal's sh |||HTTPS|onecollector.cloudapp.aria| |||HTTP|v10.events.data.microsoft.com/onecollector/1.0/| |||HTTPS|self.events.data.microsoft.com| -||The following endpoint is used to connect the Office To-Do app to its cloud service. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store.|HTTPS|to-do.microsoft.com -|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.|HTTP \ HTTPS|g.live.com/1rewlive5skydrive/*| +||The following endpoint is used to connect the Office To-Do app to its cloud service. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store.|HTTPS|to-do.microsoft.com| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||HTTP \ HTTPS|g.live.com/1rewlive5skydrive/*| |||HTTP|msagfx.live.com| |||HTTPS|oneclient.sfx.ms| -|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.|HTTPS|cy2.settings.data.microsoft.com.akadns.net| +|||HTTP| windows.policies.live.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||HTTPS|cy2.settings.data.microsoft.com.akadns.net| |||HTTPS|settings.data.microsoft.com| |||HTTPS|settings-win.data.microsoft.com| -|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|browser.pipe.aria.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS|browser.pipe.aria.microsoft.com| |||HTTP|config.edge.skype.com| |||HTTP|s2s.config.skype.com| |||HTTPS|skypeecs-prod-usw-0-b.cloudapp.net| -|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.|HTTPS|wdcp.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||HTTPS|wdcp.microsoft.com| |||HTTPS|definitionupdates.microsoft.com| |||HTTPS|go.microsoft.com| ||The following endpoints are used for Windows Defender Smartscreen reporting and notifications. If you turn off traffic for these endpoints, Smartscreen notifications will not appear.|HTTPS|*smartscreen.microsoft.com| |||HTTPS|smartscreen-sn3p.smartscreen.microsoft.com| |||HTTPS|unitedstates.smartscreen-prod.microsoft.com| -|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.|TLS v1.2|*.search.msn.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||TLS v1.2|*.search.msn.com| |||HTTPS|arc.msn.com| |||HTTPS|g.msn.com*| |||HTTPS|query.prod.cms.rt.microsoft.com| |||HTTPS|ris.api.iris.microsoft.com| -|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.|HTTPS|*.prod.do.dsp.mp.microsoft.com| -|||HTTP|cs9.wac.phicdn.net| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||HTTPS|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com| |||HTTP|*.windowsupdate.com| ||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com| |||HTTPS|*.update.microsoft.com| -||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS|tsfe.trafficshaping.dsp.mp.microsoft.com| - +||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|HTTPS|tsfe.trafficshaping.dsp.mp.microsoft.com| ## Other Windows 10 editions @@ -168,6 +187,6 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md new file mode 100644 index 0000000000..9721578892 --- /dev/null +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -0,0 +1,141 @@ +--- +title: Connection endpoints for Windows 10 Enterprise, version 1909 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1909. +keywords: privacy, manage connections to Microsoft, Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: obezeajo +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 7/22/2020 +--- +# Manage connection endpoints for Windows 10 Enterprise, version 1909 + +**Applies to** + +- Windows 10 Enterprise, version 1909 + +Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: + +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. + +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. + +The following methodology was used to derive these network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 1909 Enterprise connection endpoints + +|Area|Description|Protocol|Destination| +|----------------|----------|----------|------------| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| +|||HTTP|tile-service.weather.microsoft.com/en-us/livetile/preinstall| +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/*| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|evoke-windowsservices-tas.msedge.net +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||HTTP|ctldl.windowsupdate.com| +|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|HTTPS|www.bing.com*| +|||HTTPS|www.bing.com/client/config| +|||TLS v1.2|fp.msedge.net| +|Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*| +|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||HTTP|v10.events.data.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|*.telecommand.telemetry.microsoft.com| +|||TLS v1.2|watson.*.microsoft.com| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||HTTPS|*licensing.mp.microsoft.com| +|||HTTPS|licensing.mp.microsoft.com/v7.0/licenses/content| +|Location|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location)| +||The following endpoints are used for location data. If you turn off traffic for this endpoint, apps cannot use location data.|TLS v1.2|inference.location.live.net| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|HTTP|*maps.windows.com| +|| The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTP|fs.microsoft.com*| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLS v1.2|*login.live.com| +|Microsoft Edge|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge)| +||This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLS v1.2|1storecatalogrevocation.storequality.microsoft.com| +|||HTTPS|storecatalogrevocation.storequality.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|HTTPS|manage.devcenter.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|HTTPS|displaycatalog.mp.microsoft.com/*| +|||HTTPS|pti.store.microsoft.com/*| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| +||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTP/ TLS v1.2|v10.events.data.microsoft.com/onecollector/1.0/| +|||TLS v1.2|*.blob.core.windows.net| +|||HTTP|officehomeblobs.blob.core.windows.net| +||The following endpoints are used by Microsoft OfficeHub to get the metadata of Microsoft Office apps |TLS v1.2|c-ring.msedge.net| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||TLS v1.2|*g.live.com| +|||HTTPS|oneclient.sfx.ms| +|||HTTPS| logincdn.msauth.net| +|||HTTP| windows.policies.live.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLS v1.2|settings-win.data.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS|*.pipe.aria.microsoft.com| +|||HTTP/TLS v1.2|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||HTTPS/TLS v1.2|wdcp.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS/TLS v1.2|*smartscreen-prod.microsoft.com| +|||HTTPS|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||HTTPS/TLS v1.2|arc.msn.com| +|||HTTPS|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||HTTPS/TLS v1.2|*.prod.do.dsp.mp.microsoft.com| +|||HTTP|emdl.ws.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com| +|||HTTP|*.windowsupdate.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTP|*.delivery.mp.microsoft.com| +|||HTTPS/TLS v1.2|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS/TLS v1.2|tsfe.trafficshaping.dsp.mp.microsoft.com| +## Other Windows 10 editions + +To view endpoints for other versions of Windows 10 Enterprise, see: +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) + +To view endpoints for non-Enterprise Windows 10 editions, see: +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) + + +## Related links + +- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-2004-endpoints.md b/windows/privacy/manage-windows-2004-endpoints.md new file mode 100644 index 0000000000..c6f1fd140f --- /dev/null +++ b/windows/privacy/manage-windows-2004-endpoints.md @@ -0,0 +1,140 @@ +--- +title: Connection endpoints for Windows 10 Enterprise, version 2004 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 2004. +keywords: privacy, manage connections to Microsoft, Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: linque1 +ms.author: robsize +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 10/22/2020 +--- +# Manage connection endpoints for Windows 10 Enterprise, version 2004 + +**Applies to** + +- Windows 10 Enterprise, version 2004 + +Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: + +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. + +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. + +The following methodology was used to derive these network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 2004 Enterprise connection endpoints + +|Area|Description|Protocol|Destination| +|----------------|----------|----------|------------| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoints are used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|blob.weather.microsoft.com| +|||HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/* +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2|evoke-windowsservices-tas.msedge.net| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||HTTP|ctldl.windowsupdate.com| +|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2|www.bing.com*| +|Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| +||The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.|HTTPS|dmd.metaservices.microsoft.com| +|Diagnostic Data|The following endpoints are used by the Windows Diagnostic Data, Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2|v10.events.data.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|*.telecommand.telemetry.microsoft.com| +|||TLS v1.2|watson.*.microsoft.com| +|Font Streaming|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)| +||The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand. |HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||HTTPS|*licensing.mp.microsoft.com| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|TLSv1.2|*maps.windows.com| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLSv1.2|*login.live.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2/HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2|storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|HTTPS|*displaycatalog.mp.microsoft.com| +|||HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| +||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|*ow1.res.office365.com| +|||HTTPS|office.com| +|||HTTPS|blobs.officehome.msocdn.com| +|||HTTPS|self.events.data.microsoft.com| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||TLSv1.2|*g.live.com| +|||TLSv1.2|oneclient.sfx.ms| +|||HTTPS| logincdn.msauth.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2|settings-win.data.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS|*.pipe.aria.microsoft.com| +|||HTTPS|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||TLSv1.2|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||TLSv1.2|wdcp.microsoft.com| +|||HTTPS|go.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS|*smartscreen-prod.microsoft.com| +|||HTTPS|*smartscreen.microsoft.com | +|||HTTPS|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||TLSv1.2|arc.msn.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||TLSv1.2|*.prod.do.dsp.mp.microsoft.com| +|||HTTP|emdl.ws.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com| +|||HTTP|*.windowsupdate.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com| +|||TLSv1.2|*.update.microsoft.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|TLSv1.2|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||TLSv1.2|dlassets-ssl.xboxlive.com| + +## Other Windows 10 editions + +To view endpoints for other versions of Windows 10 Enterprise, see: +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) + +To view endpoints for non-Enterprise Windows 10 editions, see: +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) + + +## Related links + +- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md new file mode 100644 index 0000000000..b1c3b25c91 --- /dev/null +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -0,0 +1,7611 @@ +--- +description: Use this article to learn more about what required Windows diagnostic data is gathered. +title: Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) +keywords: privacy, telemetry +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.author: brianlic +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: article +audience: ITPro +ms.date: 09/30/2020 +--- + + +# Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields + + +> [!IMPORTANT] +> Windows is moving to classifying the data collected from customer’s devices as either *Required* or *Optional*. + + + **Applies to** + +- Windows 10, version 20H2 +- Windows 10, version 2004 + + +Required diagnostic data gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. + +Required diagnostic data helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. + +Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. + +You can learn more about Windows functional and diagnostic data through these articles: + +- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) +- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) +- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) +- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) +- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) +- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) +- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) + + + + +## Appraiser events + +### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount + +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DatasourceApplicationFile_19H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_21H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers. +- **DatasourceApplicationFile_RS2** An ID for the system, calculated by hashing hardware identifiers. +- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS4** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_TH1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_TH2** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_19H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_21H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. +- **DatasourceDevicePnp_RS2** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS4** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_TH1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_TH2** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_19H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_21H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. +- **DatasourceDriverPackage_RS2** The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device. +- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_TH1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_TH2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_21H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_21H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoBlock_RS2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_21H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_21H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoPassive_RS2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_19H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_21H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_21H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. +- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device. +- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. +- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS4Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_TH1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_TH2** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_19H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_21H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS2** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_TH1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_TH2** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_19H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_21H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. +- **DecisionDevicePnp_RS2** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_TH1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_TH2** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_19H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_21H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. +- **DecisionDriverPackage_RS2** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_TH1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_TH2** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_21H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. +- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device. +- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. +- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_21H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. +- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device. +- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. +- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. +- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. +- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_19H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_19H1Setup** The total DecisionMediaCenter objects targeting the next release of Windows on this device. +- **DecisionMediaCenter_20H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_21H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. +- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device. +- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. +- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_TH1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_TH2** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_19H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_21H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. +- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device. +- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. +- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device. +- **DecisionSystemBios_RS4Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionTest_21H1** The count of the number of this particular object type present on this device. +- **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. +- **InventoryApplicationFile** The count of the number of this particular object type present on this device. +- **InventoryLanguagePack** The count of the number of this particular object type present on this device. +- **InventoryMediaCenter** The count of the number of this particular object type present on this device. +- **InventorySystemBios** The count of the number of this particular object type present on this device. +- **InventoryTest** The count of the number of this particular object type present on this device. +- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. +- **PCFP** The count of the number of this particular object type present on this device. +- **SystemMemory** The count of the number of this particular object type present on this device. +- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device. +- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device. +- **SystemProcessorNx** The total number of objects of this type present on this device. +- **SystemProcessorPrefetchW** The total number of objects of this type present on this device. +- **SystemProcessorSse2** The total number of objects of this type present on this device. +- **SystemTouch** The count of the number of this particular object type present on this device. +- **SystemWim** The total number of objects of this type present on this device. +- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device. +- **SystemWlan** The total number of objects of this type present on this device. +- **Wmdrm_19H1** The count of the number of this particular object type present on this device. +- **Wmdrm_19H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. +- **Wmdrm_20H1** The count of the number of this particular object type present on this device. +- **Wmdrm_20H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. +- **Wmdrm_21H1** The count of the number of this particular object type present on this device. +- **Wmdrm_21H1Setup** The count of the number of this particular object type present on this device. +- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS2** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device. +- **Wmdrm_RS5** The count of the number of this particular object type present on this device. +- **Wmdrm_TH1** The count of the number of this particular object type present on this device. +- **Wmdrm_TH2** The count of the number of this particular object type present on this device. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd + +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file that is generating the events. +- **AvDisplayName** If the app is an anti-virus app, this is its display name. +- **CompatModelIndex** The compatibility prediction for this file. +- **HasCitData** Indicates whether the file is present in CIT data. +- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file. +- **IsAv** Is the file an anti-virus reporting EXE? +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. +- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove + +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync + +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd + +This event sends compatibility data for a Plug and Play device, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **ActiveNetworkConnection** Indicates whether the device is an active network device. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **IsBootCritical** Indicates whether the device boot is critical. +- **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update. +- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver. +- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove + +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync + +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd + +This event sends compatibility database data about driver packages to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove + +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync + +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd + +This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync + +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd + +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync + +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd + +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync + +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd + +This event sends compatibility database information about the BIOS to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync + +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd + +This event sends compatibility decision data about a file to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file that is generating the events. +- **BlockAlreadyInbox** The uplevel runtime block on the file already existed on the current OS. +- **BlockingApplication** Indicates whether there are any application issues that interfere with the upgrade due to the file in question. +- **DisplayGenericMessage** Will be a generic message be shown for this file? +- **DisplayGenericMessageGated** Indicates whether a generic message be shown for this file. +- **HardBlock** This file is blocked in the SDB. +- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? +- **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? +- **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? +- **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app. +- **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade? +- **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app. +- **NeedsUninstallAction** The file must be uninstalled to complete the upgrade. +- **SdbBlockUpgrade** The file is tagged as blocking upgrade in the SDB, +- **SdbBlockUpgradeCanReinstall** The file is tagged as blocking upgrade in the SDB. It can be reinstalled after upgrade. +- **SdbBlockUpgradeUntilUpdate** The file is tagged as blocking upgrade in the SDB. If the app is updated, the upgrade can proceed. +- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the SDB. It does not block upgrade. +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. +- **SoftBlock** The file is softblocked in the SDB and has a warning. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove + +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync + +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd + +This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked? +- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate? +- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked? +- **BlockingDevice** Is this PNP device blocking upgrade? +- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS? +- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device? +- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device? +- **DisplayGenericMessageGated** Indicates whether a generic message will be shown during Setup for this PNP device. +- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device? +- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update? +- **DriverAvailableUplevel** Is there a driver on Windows Update or included with the operating system for this PNP device? +- **DriverBlockOverridden** Is there is a driver block on the device that has been overridden? +- **NeedsDismissAction** Will the user would need to dismiss a warning during Setup for this device? +- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS? +- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade? +- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden? + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove + +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync + +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd + +This event sends decision data about driver package compatibility to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **DisplayGenericMessageGated** Indicates whether a generic offer block message will be shown for this driver package. +- **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? +- **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? +- **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? +- **DriverIsTroubleshooterBlocked** Indicates whether the driver package is blocked because of a troubleshooter block. +- **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? +- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove + +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync + +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd + +This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks? +- **DisplayGenericMessage** Will a generic message be shown for this block? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? +- **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block? +- **SdbBlockUpgrade** Is a matching info block blocking upgrade? +- **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag? +- **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag? +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync + +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd + +This event sends compatibility decision data about non-blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BlockingApplication** Are there any application issues that interfere with upgrade due to matching info blocks? +- **DisplayGenericMessageGated** Indicates whether a generic offer block message will be shown due to matching info blocks. +- **MigApplication** Is there a matching info block with a mig for the current mode of upgrade? + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove + +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync + +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd + +This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **NeedsInstallPostUpgradeData** Will the file have a notification after upgrade to install a replacement for the app? +- **NeedsNotifyPostUpgradeData** Should a notification be shown for this file after upgrade? +- **NeedsReinstallPostUpgradeData** Will the file have a notification after upgrade to reinstall the app? +- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync + +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd + +This event sends decision data about the presence of Windows Media Center, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center? +- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true? +- **MediaCenterIndicators** Do any indicators imply that Windows Media Center is in active use? +- **MediaCenterInUse** Is Windows Media Center actively being used? +- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition? +- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? + + +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync + +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd + +This event sends compatibility decision data about the BIOS to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the device blocked from upgrade due to a BIOS block? +- **DisplayGenericMessageGated** Indicates whether a generic offer block message will be shown for the bios. +- **HasBiosBlock** Does the device have a BIOS block? + + +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.GatedRegChange + +This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date. + +The following fields are available: + +- **NewData** The data in the registry value after the scan completed. +- **OldData** The previous data in the registry value before the scan ran. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **RegKey** The registry key name for which a result is being sent. +- **RegValue** The registry value for which a result is being sent. +- **Time** The client time of the event. + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd + +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **AvDisplayName** If the app is an antivirus app, this is its display name. +- **AvProductState** Indicates whether the antivirus program is turned on and the signatures are up to date. +- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64. +- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. +- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. +- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata. +- **CompanyName** The company name of the vendor who developed this file. +- **FileId** A hash that uniquely identifies a file. +- **FileVersion** The File version field from the file metadata under Properties -> Details. +- **HasUpgradeExe** Indicates whether the antivirus app has an upgrade.exe file. +- **IsAv** Indicates whether the file an antivirus reporting EXE. +- **LinkDate** The date and time that this file was linked on. +- **LowerCaseLongPath** The full file path to the file that was inventoried on the device. +- **Name** The name of the file that was inventoried. +- **ProductName** The Product name field from the file metadata under Properties -> Details. +- **ProductVersion** The Product version field from the file metadata under Properties -> Details. +- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it. +- **Size** The size of the file (in hexadecimal bytes). + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove + +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync + +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd + +This event sends data about the number of language packs installed on the system, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **HasLanguagePack** Indicates whether this device has 2 or more language packs. +- **LanguagePackCount** The number of language packs are installed. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove + +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync + +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd + +This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **EverLaunched** Has Windows Media Center ever been launched? +- **HasConfiguredTv** Has the user configured a TV tuner through Windows Media Center? +- **HasExtendedUserAccounts** Are any Windows Media Center Extender user accounts configured? +- **HasWatchedFolders** Are any folders configured for Windows Media Center to watch? +- **IsDefaultLauncher** Is Windows Media Center the default app for opening music or video files? +- **IsPaid** Is the user running a Windows Media Center edition that implies they paid for Windows Media Center? +- **IsSupported** Does the running OS support Windows Media Center? + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove + +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync + +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd + +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **biosDate** The release date of the BIOS in UTC format. +- **BiosDate** The release date of the BIOS in UTC format. +- **biosName** The name field from Win32_BIOS. +- **BiosName** The name field from Win32_BIOS. +- **manufacturer** The manufacturer field from Win32_ComputerSystem. +- **Manufacturer** The manufacturer field from Win32_ComputerSystem. +- **model** The model field from Win32_ComputerSystem. +- **Model** The model field from Win32_ComputerSystem. + + +### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync + +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd + +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BootCritical** Is the driver package marked as boot critical? +- **Build** The build value from the driver package. +- **CatalogFile** The name of the catalog file within the driver package. +- **Class** The device class from the driver package. +- **ClassGuid** The device class unique ID from the driver package. +- **Date** The date from the driver package. +- **Inbox** Is the driver package of a driver that is included with Windows? +- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU. +- **Provider** The provider of the driver package. +- **PublishedName** The name of the INF file after it was renamed. +- **Revision** The revision of the driver package. +- **SignatureStatus** Indicates if the driver package is signed. Unknown = 0, Unsigned = 1, Signed = 2. +- **VersionMajor** The major version of the driver package. +- **VersionMinor** The minor version of the driver package. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove + +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync + +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.RunContext + +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. + +The following fields are available: + +- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built. +- **AppraiserProcess** The name of the process that launched Appraiser. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **CensusId** A unique hardware identifier. +- **Context** Indicates what mode Appraiser is running in. Example: Setup or Telemetry. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **Subcontext** Indicates what categories of incompatibilities appraiser is scanning for. Can be N/A, Resolve, or a semicolon-delimited list that can include App, Dev, Sys, Gat, or Rescan. +- **Time** The client time of the event. + + +### Microsoft.Windows.Appraiser.General.SystemMemoryAdd + +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the device from upgrade due to memory restrictions? +- **MemoryRequirementViolated** Was a memory requirement violated? +- **pageFile** The current committed memory limit for the system or the current process, whichever is smaller (in bytes). +- **ram** The amount of memory on the device. +- **ramKB** The amount of memory (in KB). +- **virtual** The size of the user-mode portion of the virtual address space of the calling process (in bytes). +- **virtualKB** The amount of virtual memory (in KB). + + +### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync + +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd + +This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **CompareExchange128Support** Does the CPU support CompareExchange128? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync + +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd + +This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **LahfSahfSupport** Does the CPU support LAHF/SAHF? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync + +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd + +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **NXDriverResult** The result of the driver used to do a non-deterministic check for NX support. +- **NXProcessorSupport** Does the processor support NX? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync + +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd + +This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **PrefetchWSupport** Does the processor support PrefetchW? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync + +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add + +This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **SSE2ProcessorSupport** Does the processor support SSE2? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync + +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemTouchAdd + +This event sends data indicating whether the system supports touch, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **IntegratedTouchDigitizerPresent** Is there an integrated touch digitizer? +- **MaximumTouches** The maximum number of touch points supported by the device hardware. + + +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemTouchStartSync + +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWimAdd + +This event sends data indicating whether the operating system is running from a compressed Windows Imaging Format (WIM) file, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **IsWimBoot** Is the current operating system running from a compressed WIM file? +- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. + + +### Microsoft.Windows.Appraiser.General.SystemWimStartSync + +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd + +This event sends data indicating whether the current operating system is activated, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **WindowsIsLicensedApiValue** The result from the API that's used to indicate if operating system is activated. +- **WindowsNotActivatedDecision** Is the current operating system activated? + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove + +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync + +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWlanAdd + +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked because of an emulated WLAN driver? +- **HasWlanBlock** Does the emulated WLAN driver have an upgrade block? +- **WlanEmulatedDriver** Does the device have an emulated WLAN driver? +- **WlanExists** Does the device support WLAN at all? +- **WlanModulePresent** Are any WLAN modules present? +- **WlanNativeDriver** Does the device have a non-emulated WLAN driver? + + +### Microsoft.Windows.Appraiser.General.SystemWlanStartSync + +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.TelemetryRunHealth + +This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. + +The following fields are available: + +- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built. +- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run. +- **AppraiserProcess** The name of the process that launched Appraiser. +- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. +- **AuxFinal** Obsolete, always set to false. +- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **CountCustomSdbs** The number of custom Sdbs used by Appraiser. +- **CustomSdbGuids** Guids of the custom Sdbs used by Appraiser; Semicolon delimited list. +- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. +- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. +- **InboxDataVersion** The original version of the data files before retrieving any newer version. +- **IndicatorsWritten** Indicates if all relevant UEX indicators were successfully written or updated. +- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. +- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. +- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. +- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. +- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. +- **RunResult** The hresult of the Appraiser diagnostic data run. +- **ScheduledUploadDay** The day scheduled for the upload. +- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. +- **StoreHandleIsNotNull** Obsolete, always set to false +- **TelementrySent** Indicates whether diagnostic data was successfully sent. +- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability. +- **Time** The client time of the event. +- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. +- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. + + +### Microsoft.Windows.Appraiser.General.WmdrmAdd + +This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BlockingApplication** Same as NeedsDismissAction. +- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation. +- **WmdrmApiResult** Raw value of the API used to gather DRM state. +- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs. +- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased. +- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed. +- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses. +- **WmdrmPurchased** Indicates if the system has any files with permanent licenses. + + +### Microsoft.Windows.Appraiser.General.WmdrmStartSync + +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +## Audio endpoint events + +### MicArrayGeometry + +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **MicCoords** The location and orientation of the microphone element. +- **usFrequencyBandHi** The high end of the frequency range for the microphone. +- **usFrequencyBandLo** The low end of the frequency range for the microphone. +- **usMicArrayType** The type of the microphone array. +- **usNumberOfMicrophones** The number of microphones in the array. +- **usVersion** The version of the microphone array specification. +- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). +- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). +- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). +- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). + +### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo + +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BusEnumeratorName** The name of the bus enumerator (for example, HDAUDIO or USB). +- **ContainerId** An identifier that uniquely groups the functional devices associated with a single-function or multifunction device. +- **DeviceInstanceId** The unique identifier for this instance of the device. +- **EndpointDevnodeId** The IMMDevice identifier of the associated devnode. +- **endpointEffectClsid** The COM Class Identifier (CLSID) for the endpoint effect audio processing object. +- **endpointEffectModule** Module name for the endpoint effect audio processing object. +- **EndpointFormFactor** The enumeration value for the form factor of the endpoint device (for example speaker, microphone, remote network device). +- **endpointID** The unique identifier for the audio endpoint. +- **endpointInstanceId** The unique identifier for the software audio endpoint. Used for joining to other audio event. +- **Flow** Indicates whether the endpoint is capture (1) or render (0). +- **globalEffectClsid** COM Class Identifier (CLSID) for the legacy global effect audio processing object. +- **globalEffectModule** Module name for the legacy global effect audio processing object. +- **HWID** The hardware identifier for the endpoint. +- **isAudioPostureSupported** Represents whether the device supports AudioPosture. +- **IsBluetooth** Indicates whether the device is a Bluetooth device. +- **isFarField** A flag indicating whether the microphone endpoint is capable of hearing far field audio. +- **IsSideband** Indicates whether the device is a sideband device. +- **IsUSB** Indicates whether the device is a USB device. +- **JackSubType** A unique ID representing the KS node type of the endpoint. +- **localEffectClsid** The COM Class Identifier (CLSID) for the legacy local effect audio processing object. +- **localEffectModule** Module name for the legacy local effect audio processing object. +- **MicArrayGeometry** Describes the microphone array, including the microphone position, coordinates, type, and frequency range. See [MicArrayGeometry](#micarraygeometry). +- **modeEffectClsid** The COM Class Identifier (CLSID) for the mode effect audio processing object. +- **modeEffectModule** Module name for the mode effect audio processing object. +- **persistentId** A unique ID for this endpoint which is retained across migrations. +- **streamEffectClsid** The COM Class Identifier (CLSID) for the stream effect audio processing object. +- **streamEffectModule** Module name for the stream effect audio processing object. + + +## Census events + +### Census.App + +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AppraiserEnterpriseErrorCode** The error code of the last Appraiser enterprise run. +- **AppraiserErrorCode** The error code of the last Appraiser run. +- **AppraiserRunEndTimeStamp** The end time of the last Appraiser run. +- **AppraiserRunIsInProgressOrCrashed** Flag that indicates if the Appraiser run is in progress or has crashed. +- **AppraiserRunStartTimeStamp** The start time of the last Appraiser run. +- **AppraiserTaskEnabled** Whether the Appraiser task is enabled. +- **AppraiserTaskExitCode** The Appraiser task exist code. +- **AppraiserTaskLastRun** The last runtime for the Appraiser task. +- **CensusVersion** The version of Census that generated the current data for this device. + + +### Census.Azure + +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **CloudCoreBuildEx** The Azure CloudCore build number. +- **CloudCoreSupportBuildEx** The Azure CloudCore support build number. +- **NodeID** The node identifier on the device that indicates whether the device is part of the Azure fleet. + + +### Census.Battery + +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **InternalBatteryCapablities** Represents information about what the battery is capable of doing. +- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity  to estimate the battery's wear. +- **InternalBatteryCapacityDesign** Represents the theoretical capacity of the battery when new, in mWh. +- **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance. +- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. + + +### Census.Enterprise + +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **AADDeviceId** Azure Active Directory device ID. +- **AzureOSIDPresent** Represents the field used to identify an Azure machine. +- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs. +- **CDJType** Represents the type of cloud domain joined for the machine. +- **CommercialId** Represents the GUID for the commercial entity which the device is a member of.  Will be used to reflect insights back to customers. +- **ContainerType** The type of container, such as process or virtual machine hosted. +- **EnrollmentType** Defines the type of MDM enrollment on the device. +- **HashedDomain** The hashed representation of the user domain used for login. +- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false +- **IsDERequirementMet** Represents if the device can do device encryption. +- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption +- **IsEDPEnabled** Represents if Enterprise data protected on the device. +- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. +- **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device. +- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier + + +### Census.Firmware + +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FirmwareManufacturer** Represents the manufacturer of the device's firmware (BIOS). +- **FirmwareReleaseDate** Represents the date the current firmware was released. +- **FirmwareType** Represents the firmware type. The various types can be unknown, BIOS, UEFI. +- **FirmwareVersion** Represents the version of the current firmware. + + +### Census.Flighting + +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceSampleRate** The telemetry sample rate assigned to the device. +- **DriverTargetRing** Indicates if the device is participating in receiving pre-release drivers and firmware contrent. +- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device. +- **FlightIds** A list of the different Windows Insider builds on this device. +- **FlightingBranchName** The name of the Windows Insider branch currently used by the device. +- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program. +- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device. +- **SSRK** Retrieves the mobile targeting settings. + + +### Census.Hardware + +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ActiveMicCount** The number of active microphones attached to the device. +- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36. +- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields. +- **D3DMaxFeatureLevel** Supported Direct3D version. +- **DeviceForm** Indicates the form as per the device classification. +- **DeviceName** The device name that is set by the user. +- **DigitizerSupport** Is a digitizer supported? +- **EnclosureKind** Windows.Devices.Enclosure.EnclosureKind enum values representing each unique enclosure posture kind. +- **Gyroscope** Indicates whether the device has a gyroscope (a mechanical component that measures and maintains orientation). +- **InventoryId** The device ID used for compatibility testing. +- **Magnetometer** Indicates whether the device has a magnetometer (a mechanical component that works like a compass). +- **NFCProximity** Indicates whether the device supports NFC (a set of communication protocols that helps establish communication when applicable devices are brought close together.) +- **OEMDigitalMarkerFileName** The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device. +- **OEMManufacturerName** The device manufacturer name. The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date. +- **OEMModelBaseBoard** The baseboard model used by the OEM. +- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices. +- **OEMModelName** The device model name. +- **OEMModelNumber** The device model number. +- **OEMModelSKU** The device edition that is defined by the manufacturer. +- **OEMModelSystemFamily** The system family set on the device by an OEM. +- **OEMModelSystemVersion** The system model version set on the device by the OEM. +- **OEMOptionalIdentifier** A Microsoft assigned value that represents a specific OEM subsidiary. +- **OEMSerialNumber** The serial number of the device that is set by the manufacturer. +- **PhoneManufacturer** The friendly name of the phone manufacturer. +- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device. +- **SoCName** The firmware manufacturer of the device. +- **StudyID** Used to identify retail and non-retail device. +- **TelemetryLevel** The telemetry level the user has opted into, such as Basic or Enhanced. +- **TelemetryLevelLimitEnhanced** The telemetry level for Windows Analytics-based solutions. +- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user. +- **TPMManufacturerId** The ID of the TPM manufacturer. +- **TPMManufacturerVersion** The version of the TPM manufacturer. +- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0. +- **VoiceSupported** Does the device have a cellular radio capable of making voice calls? + + +### Census.Memory + +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **TotalPhysicalRAM** Represents the physical memory (in MB). +- **TotalVisibleMemory** Represents the memory that is not reserved by the system. + + +### Census.Network + +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. +- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. +- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. +- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MobileOperatorBilling** Represents the telephone company that provides services for mobile phone users. +- **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US. +- **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. +- **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. +- **NetworkAdapterGUID** The GUID of the primary network adapter. +- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. +- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. + + +### Census.OS + +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine. +- **AssignedAccessStatus** Kiosk configuration mode. +- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled. +- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy. +- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time +- **GenuineState** Retrieves the ID Value specifying the OS Genuine check. +- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update). +- **InstallLanguage** The first language installed on the user machine. +- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode. +- **IsEduData** Returns Boolean if the education data policy is enabled. +- **IsPortableOperatingSystem** Retrieves whether OS is running Windows-To-Go +- **IsSecureBootEnabled** Retrieves whether Boot chain is signed under UEFI. +- **LanguagePacks** The list of language packages installed on the device. +- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store. +- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. +- **OSEdition** Retrieves the version of the current OS. +- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc. +- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). +- **OSSKU** Retrieves the Friendly Name of OS Edition. +- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines. +- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines. +- **OSUILocale** Retrieves the locale of the UI that is currently used by the OS. +- **ProductActivationResult** Returns Boolean if the OS Activation was successful. +- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues. +- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key. +- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability. +- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy. +- **ServiceMachinePort** Retrieves the port of the KMS host used for anti-piracy. +- **ServiceProductKeyID** Retrieves the License key of the KMS +- **SharedPCMode** Returns Boolean for education devices used as shared cart +- **Signature** Retrieves if it is a signature machine sold by Microsoft store. +- **SLICStatus** Whether a SLIC table exists on the device. +- **SLICVersion** Returns OS type/version from SLIC table. + + +### Census.PrivacySettings + +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **Activity** Current state of the activity history setting. +- **ActivityHistoryCloudSync** Current state of the activity history cloud sync setting. +- **ActivityHistoryCollection** Current state of the activity history collection setting. +- **AdvertisingId** Current state of the advertising ID setting. +- **AppDiagnostics** Current state of the app diagnostics setting. +- **Appointments** Current state of the calendar setting. +- **Bluetooth** Current state of the Bluetooth capability setting. +- **BluetoothSync** Current state of the Bluetooth sync capability setting. +- **BroadFileSystemAccess** Current state of the broad file system access setting. +- **CellularData** Current state of the cellular data capability setting. +- **Chat** Current state of the chat setting. +- **Contacts** Current state of the contacts setting. +- **DocumentsLibrary** Current state of the documents library setting. +- **Email** Current state of the email setting. +- **FindMyDevice** Current state of the "find my device" setting. +- **GazeInput** Current state of the gaze input setting. +- **HumanInterfaceDevice** Current state of the human interface device setting. +- **InkTypeImprovement** Current state of the improve inking and typing setting. +- **Location** Current state of the location setting. +- **LocationHistory** Current state of the location history setting. +- **Microphone** Current state of the microphone setting. +- **PhoneCall** Current state of the phone call setting. +- **PhoneCallHistory** Current state of the call history setting. +- **PicturesLibrary** Current state of the pictures library setting. +- **Radios** Current state of the radios setting. +- **SensorsCustom** Current state of the custom sensor setting. +- **SerialCommunication** Current state of the serial communication setting. +- **Sms** Current state of the text messaging setting. +- **SpeechPersonalization** Current state of the speech services setting. +- **USB** Current state of the USB setting. +- **UserAccountInformation** Current state of the account information setting. +- **UserDataTasks** Current state of the tasks setting. +- **UserNotificationListener** Current state of the notifications setting. +- **VideosLibrary** Current state of the videos library setting. +- **Webcam** Current state of the camera setting. +- **WifiData** Current state of the Wi-Fi data setting. +- **WiFiDirect** Current state of the Wi-Fi direct setting. + + +### Census.Processor + +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **KvaShadow** This is the micro code information of the processor. +- **MMSettingOverride** Microcode setting of the processor. +- **MMSettingOverrideMask** Microcode setting override of the processor. +- **PreviousUpdateRevision** Previous microcode revision +- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. +- **ProcessorClockSpeed** Clock speed of the processor in MHz. +- **ProcessorCores** Number of logical cores in the processor. +- **ProcessorIdentifier** Processor Identifier of a manufacturer. +- **ProcessorManufacturer** Name of the processor manufacturer. +- **ProcessorModel** Name of the processor model. +- **ProcessorPhysicalCores** Number of physical cores in the processor. +- **ProcessorUpdateRevision** The microcode revision. +- **ProcessorUpdateStatus** Enum value that represents the processor microcode load status +- **SocketCount** Count of CPU sockets. +- **SpeculationControl** If the system has enabled protections needed to validate the speculation control vulnerability. + + +### Census.Security + +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AvailableSecurityProperties** This field helps to enumerate and report state on the relevant security properties for Device Guard. +- **CGRunning** Credential Guard isolates and hardens key system and user secrets against compromise, helping to minimize the impact and breadth of a Pass the Hash style attack in the event that malicious code is already running via a local or network based vector. This field tells if Credential Guard is running. +- **DGState** This field summarizes the Device Guard state. +- **HVCIRunning** Hypervisor Code Integrity (HVCI) enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s functionality to force all software running in kernel mode to safely allocate memory. This field tells if HVCI is running. +- **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest. +- **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host. +- **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. +- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. +- **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. +- **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. +- **SModeState** The Windows S mode trail state. +- **SystemGuardState** Indicates the SystemGuard state. NotCapable (0), Capable (1), Enabled (2), Error (0xFF). +- **TpmReadyState** Indicates the TPM ready state. NotReady (0), ReadyForStorage (1), ReadyForAttestation (2), Error (0xFF). +- **VBSState** Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation. VBS has a tri-state that can be Disabled, Enabled, or Running. +- **WdagPolicyValue** The Windows Defender Application Guard policy. + + +### Census.Speech + +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked. +- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities. +- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user. +- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices. +- **KeyVer** Version information for the census speech event. +- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS). +- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities. +- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities. +- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice. +- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device. +- **SpeechServicesValueSource** Indicates the deciding factor for the effective online speech recognition privacy policy settings: remote admin, local admin, or user preference. + + +### Census.Storage + +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **PrimaryDiskTotalCapacity** Retrieves the amount of disk space on the primary disk of the device in MB. +- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any). +- **StorageReservePassedPolicy** Indicates whether the Storage Reserve policy, which ensures that updates have enough disk space and customers are on the latest OS, is enabled on this device. +- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB. + + +### Census.Userdefault + +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CalendarType** The calendar identifiers that are used to specify different calendars. +- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultBrowserProgId** The ProgramId of the current user's default browser. +- **LocaleName** Name of the current user locale given by LOCALE_SNAME via the GetLocaleInfoEx() function. +- **LongDateFormat** The long date format the user has selected. +- **ShortDateFormat** The short date format the user has selected. + + +### Census.UserDisplay + +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display. +- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display. +- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display. +- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display. +- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display. +- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display. +- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches . +- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches +- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine +- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine. +- **VRAMDedicated** Retrieves the video RAM in MB. +- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card. +- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use. + + +### Census.UserNLS + +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DefaultAppLanguage** The current user Default App Language. +- **DisplayLanguage** The current user preferred Windows Display Language. +- **HomeLocation** The current user location, which is populated using GetUserGeoId() function. +- **KeyboardInputLanguages** The Keyboard input languages installed on the device. +- **SpeechInputLanguages** The Speech Input languages installed on the device. + + +### Census.UserPrivacySettings + +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **Activity** Current state of the activity history setting. +- **ActivityHistoryCloudSync** Current state of the activity history cloud sync setting. +- **ActivityHistoryCollection** Current state of the activity history collection setting. +- **AdvertisingId** Current state of the advertising ID setting. +- **AppDiagnostics** Current state of the app diagnostics setting. +- **Appointments** Current state of the calendar setting. +- **Bluetooth** Current state of the Bluetooth capability setting. +- **BluetoothSync** Current state of the Bluetooth sync capability setting. +- **BroadFileSystemAccess** Current state of the broad file system access setting. +- **CellularData** Current state of the cellular data capability setting. +- **Chat** Current state of the chat setting. +- **Contacts** Current state of the contacts setting. +- **DocumentsLibrary** Current state of the documents library setting. +- **Email** Current state of the email setting. +- **GazeInput** Current state of the gaze input setting. +- **HumanInterfaceDevice** Current state of the human interface device setting. +- **InkTypeImprovement** Current state of the improve inking and typing setting. +- **InkTypePersonalization** Current state of the inking and typing personalization setting. +- **Location** Current state of the location setting. +- **LocationHistory** Current state of the location history setting. +- **Microphone** Current state of the microphone setting. +- **PhoneCall** Current state of the phone call setting. +- **PhoneCallHistory** Current state of the call history setting. +- **PicturesLibrary** Current state of the pictures library setting. +- **Radios** Current state of the radios setting. +- **SensorsCustom** Current state of the custom sensor setting. +- **SerialCommunication** Current state of the serial communication setting. +- **Sms** Current state of the text messaging setting. +- **SpeechPersonalization** Current state of the speech services setting. +- **USB** Current state of the USB setting. +- **UserAccountInformation** Current state of the account information setting. +- **UserDataTasks** Current state of the tasks setting. +- **UserNotificationListener** Current state of the notifications setting. +- **VideosLibrary** Current state of the videos library setting. +- **Webcam** Current state of the camera setting. +- **WifiData** Current state of the Wi-Fi data setting. +- **WiFiDirect** Current state of the Wi-Fi direct setting. + + +### Census.VM + +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within. +- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor. +- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. +- **IsVDI** Is the device using Virtual Desktop Infrastructure? +- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **IsWVDSessionHost** Indicates if this is a Windows Virtual Device session host. +- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. +- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. +- **VMId** A string that identifies a virtual machine. +- **WVDEnvironment** Represents the WVD service environment to which this session host has been joined. + + +### Census.WU + +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading. +- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled). +- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured +- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting +- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **IsHotPatchEnrolled** Represents the current state of the device in relation to enrollment in the hotpatch program. +- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? +- **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? +- **OSAssessmentForQualityUpdate** Is the device on the latest quality update? +- **OSAssessmentForSecurityUpdate** Is the device on the latest security update? +- **OSAssessmentQualityOutOfDate** How many days has it been since a the last quality update was released but the device did not install it? +- **OSAssessmentReleaseInfoTime** The freshness of release information used to perform an assessment. +- **OSRollbackCount** The number of times feature updates have rolled back on the device. +- **OSRolledBack** A flag that represents when a feature update has rolled back during setup. +- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device . +- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device. +- **OSWUAutoUpdateOptionsSource** The source of auto update setting that appears in the OSWUAutoUpdateOptions field. For example: Group Policy (GP), Mobile Device Management (MDM), and Default. +- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently. +- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS). +- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates. +- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades. +- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **WULCUVersion** Version of the LCU Installed on the machine. +- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. +- **WUPauseState** Retrieves WU setting to determine if updates are paused. +- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). + + +### Census.Xbox + +This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date. + +The following fields are available: + +- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console. +- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console. +- **XboxLiveDeviceId** Retrieves the unique device ID of the console. +- **XboxLiveSandboxId** Retrieves the developer sandbox ID if the device is internal to Microsoft. + + +## Common data extensions + +### Common Data Extensions.app + +Describes the properties of the running application. This extension could be populated by a client app or a web app. + +The following fields are available: + +- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session. +- **env** The environment from which the event was logged. +- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event. +- **id** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application. +- **locale** The locale of the app. +- **name** The name of the app. +- **userId** The userID as known by the application. +- **ver** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app. + + +### Common Data Extensions.container + +Describes the properties of the container for events logged within a container. + +The following fields are available: + +- **epoch** An ID that's incremented for each SDK initialization. +- **localId** The device ID as known by the client. +- **osVer** The operating system version. +- **seq** An ID that's incremented for each event. +- **type** The container type. Examples: Process or VMHost + + +### Common Data Extensions.device + +Describes the device-related fields. + +The following fields are available: + +- **deviceClass** The device classification. For example, Desktop, Server, or Mobile. +- **localId** A locally-defined unique ID for the device. This is not the human-readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId +- **make** Device manufacturer. +- **model** Device model. + + +### Common Data Extensions.Envelope + +Represents an envelope that contains all of the common data extensions. + +The following fields are available: + +- **data** Represents the optional unique diagnostic data for a particular event schema. +- **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). +- **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). +- **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). +- **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). +- **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). +- **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). +- **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser). +- **ext_utc** Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc). +- **ext_xbl** Describes the fields related to XBOX Live. See [Common Data Extensions.xbl](#common-data-extensionsxbl). +- **iKey** Represents an ID for applications or other logical groupings of events. +- **name** Represents the uniquely qualified name for the event. +- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. +- **ver** Represents the major and minor version of the extension. + + +### Common Data Extensions.mscv + +Describes the correlation vector-related fields. + +The following fields are available: + +- **cV** Represents the Correlation Vector: A single field for tracking partial order of related events across component boundaries. + + +### Common Data Extensions.os + +Describes some properties of the operating system. + +The following fields are available: + +- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot. +- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema. +- **locale** Represents the locale of the operating system. +- **name** Represents the operating system name. +- **ver** Represents the major and minor version of the extension. + + +### Common Data Extensions.sdk + +Used by platform specific libraries to record fields that are required for a specific SDK. + +The following fields are available: + +- **epoch** An ID that is incremented for each SDK initialization. +- **installId** An ID that's created during the initialization of the SDK for the first time. +- **libVer** The SDK version. +- **seq** An ID that is incremented for each event. +- **ver** The version of the logging SDK. + + +### Common Data Extensions.user + +Describes the fields related to a user. + +The following fields are available: + +- **authId** This is an ID of the user associated with this event that is deduced from a token such as a Microsoft Account ticket or an XBOX token. +- **locale** The language and region. +- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID. + + +### Common Data Extensions.utc + +Describes the properties that could be populated by a logging library on Windows. + +The following fields are available: + +- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW. +- **bSeq** Upload buffer sequence number in the format: buffer identifier:sequence number +- **cat** Represents a bitmask of the ETW Keywords associated with the event. +- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer. +- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **eventFlags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency. +- **flags** Represents the bitmap that captures various Windows specific flags. +- **loggingBinary** The binary (executable, library, driver, etc.) that fired the event. +- **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence +- **op** Represents the ETW Op Code. +- **pgName** The short form of the provider group name associated with the event. +- **popSample** Represents the effective sample rate for this event at the time it was generated by a client. +- **providerGuid** The ETW provider ID associated with the provider name. +- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW. +- **seq** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier. +- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. +- **wcmp** The Windows Shell Composer ID. +- **wPId** The Windows Core OS product ID. +- **wsId** The Windows Core OS session ID. + + +### Common Data Extensions.xbl + +Describes the fields that are related to XBOX Live. + +The following fields are available: + +- **claims** Any additional claims whose short claim name hasn't been added to this structure. +- **did** XBOX device ID +- **dty** XBOX device type +- **dvr** The version of the operating system on the device. +- **eid** A unique ID that represents the developer entity. +- **exp** Expiration time +- **ip** The IP address of the client device. +- **nbf** Not before time +- **pid** A comma separated list of PUIDs listed as base10 numbers. +- **sbx** XBOX sandbox identifier +- **sid** The service instance ID. +- **sty** The service type. +- **tid** The XBOX Live title ID. +- **tvr** The XBOX Live title version. +- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. +- **xid** A list of base10-encoded XBOX User IDs. + +## Common data fields + +### Ms.Device.DeviceInventoryChange + +Describes the installation state for all hardware and software components available on a particular device. + +The following fields are available: + +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. + +## Component-based servicing events + +### CbsServicingProvider.CbsCapabilityEnumeration + +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. + +The following fields are available: + +- **architecture** Indicates the scan was limited to the specified architecture. +- **capabilityCount** The number of optional content packages found during the scan. +- **clientId** The name of the application requesting the optional content. +- **duration** The amount of time it took to complete the scan. +- **hrStatus** The HReturn code of the scan. +- **language** Indicates the scan was limited to the specified language. +- **majorVersion** Indicates the scan was limited to the specified major version. +- **minorVersion** Indicates the scan was limited to the specified minor version. +- **namespace** Indicates the scan was limited to packages in the specified namespace. +- **sourceFilter** A bitmask indicating the scan checked for locally available optional content. +- **stackBuild** The build number of the servicing stack. +- **stackMajorVersion** The major version number of the servicing stack. +- **stackMinorVersion** The minor version number of the servicing stack. +- **stackRevision** The revision number of the servicing stack. + + +### CbsServicingProvider.CbsCapabilitySessionFinalize + +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **capabilities** The names of the optional content packages that were installed. +- **clientId** The name of the application requesting the optional content. +- **currentID** The ID of the current install session. +- **downloadSource** The source of the download. +- **highestState** The highest final install state of the optional content. +- **hrLCUReservicingStatus** Indicates whether the optional content was updated to the latest available version. +- **hrStatus** The HReturn code of the install operation. +- **rebootCount** The number of reboots required to complete the install. +- **retryID** The session ID that will be used to retry a failed operation. +- **retryStatus** Indicates whether the install will be retried in the event of failure. +- **stackBuild** The build number of the servicing stack. +- **stackMajorVersion** The major version number of the servicing stack. +- **stackMinorVersion** The minor version number of the servicing stack. +- **stackRevision** The revision number of the servicing stack. + + +### CbsServicingProvider.CbsCapabilitySessionPended + +This event provides information about the results of installing optional Windows content that requires a reboot to keep Windows up to date. + +The following fields are available: + +- **clientId** The name of the application requesting the optional content. +- **pendingDecision** Indicates the cause of reboot, if applicable. + + +### CbsServicingProvider.CbsLateAcquisition + +This event sends data to indicate if some Operating System packages could not be updated as part of an upgrade, to help keep Windows up to date. + +The following fields are available: + +- **Features** The list of feature packages that could not be updated. +- **RetryID** The ID identifying the retry attempt to update the listed packages. + + +### CbsServicingProvider.CbsPackageRemoval + +This event provides information about the results of uninstalling a Windows Cumulative Security Update to help keep Windows up to date. + +The following fields are available: + +- **buildVersion** The build number of the security update being uninstalled. +- **clientId** The name of the application requesting the uninstall. +- **currentStateEnd** The final state of the update after the operation. +- **failureDetails** Information about the cause of a failure, if applicable. +- **failureSourceEnd** The stage during the uninstall where the failure occurred. +- **hrStatusEnd** The overall exit code of the operation. +- **initiatedOffline** Indicates if the uninstall was initiated for a mounted Windows image. +- **majorVersion** The major version number of the security update being uninstalled. +- **minorVersion** The minor version number of the security update being uninstalled. +- **originalState** The starting state of the update before the operation. +- **pendingDecision** Indicates the cause of reboot, if applicable. +- **primitiveExecutionContext** The state during system startup when the uninstall was completed. +- **revisionVersion** The revision number of the security update being uninstalled. +- **transactionCanceled** Indicates whether the uninstall was cancelled. + + +### CbsServicingProvider.CbsQualityUpdateInstall + +This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date. + +The following fields are available: + +- **buildVersion** The build version number of the update package. +- **clientId** The name of the application requesting the optional content. +- **corruptionHistoryFlags** A bitmask of the types of component store corruption that have caused update failures on the device. +- **corruptionType** An enumeration listing the type of data corruption responsible for the current update failure. +- **currentStateEnd** The final state of the package after the operation has completed. +- **doqTimeSeconds** The time in seconds spent updating drivers. +- **executeTimeSeconds** The number of seconds required to execute the install. +- **failureDetails** The driver or installer that caused the update to fail. +- **failureSourceEnd** An enumeration indicating at what phase of the update a failure occurred. +- **hrStatusEnd** The return code of the install operation. +- **initiatedOffline** A true or false value indicating whether the package was installed into an offline Windows Imaging Format (WIM) file. +- **majorVersion** The major version number of the update package. +- **minorVersion** The minor version number of the update package. +- **originalState** The starting state of the package. +- **overallTimeSeconds** The time (in seconds) to perform the overall servicing operation. +- **planTimeSeconds** The time in seconds required to plan the update operations. +- **poqTimeSeconds** The time in seconds processing file and registry operations. +- **postRebootTimeSeconds** The time (in seconds) to do startup processing for the update. +- **preRebootTimeSeconds** The time (in seconds) between execution of the installation and the reboot. +- **primitiveExecutionContext** An enumeration indicating at what phase of shutdown or startup the update was installed. +- **rebootCount** The number of reboots required to install the update. +- **rebootTimeSeconds** The time (in seconds) before startup processing begins for the update. +- **resolveTimeSeconds** The time in seconds required to resolve the packages that are part of the update. +- **revisionVersion** The revision version number of the update package. +- **rptTimeSeconds** The time in seconds spent executing installer plugins. +- **shutdownTimeSeconds** The time (in seconds) required to do shutdown processing for the update. +- **stackRevision** The revision number of the servicing stack. +- **stageTimeSeconds** The time (in seconds) required to stage all files that are part of the update. + + +### CbsServicingProvider.CbsSelectableUpdateChangeV2 + +This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date. + +The following fields are available: + +- **applicableUpdateState** Indicates the highest applicable state of the optional content. +- **buildVersion** The build version of the package being installed. +- **clientId** The name of the application requesting the optional content change. +- **downloadSource** Indicates if optional content was obtained from Windows Update or a locally accessible file. +- **downloadtimeInSeconds** Indicates if optional content was obtained from Windows Update or a locally accessible file. +- **executionID** A unique ID used to identify events associated with a single servicing operation and not reused for future operations. +- **executionSequence** A counter that tracks the number of servicing operations attempted on the device. +- **firstMergedExecutionSequence** The value of a pervious executionSequence counter that is being merged with the current operation, if applicable. +- **firstMergedID** A unique ID of a pervious servicing operation that is being merged with this operation, if applicable. +- **hrDownloadResult** The return code of the download operation. +- **hrStatusUpdate** The return code of the servicing operation. +- **identityHash** A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled. +- **initiatedOffline** Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows. +- **majorVersion** The major version of the package being installed. +- **minorVersion** The minor version of the package being installed. +- **packageArchitecture** The architecture of the package being installed. +- **packageLanguage** The language of the package being installed. +- **packageName** The name of the package being installed. +- **rebootRequired** Indicates whether a reboot is required to complete the operation. +- **revisionVersion** The revision number of the package being installed. +- **stackBuild** The build number of the servicing stack binary performing the installation. +- **stackMajorVersion** The major version number of the servicing stack binary performing the installation. +- **stackMinorVersion** The minor version number of the servicing stack binary performing the installation. +- **stackRevision** The revision number of the servicing stack binary performing the installation. +- **updateName** The name of the optional Windows Operation System feature being enabled or disabled. +- **updateStartState** A value indicating the state of the optional content before the operation started. +- **updateTargetState** A value indicating the desired state of the optional content. + + +### CbsServicingProvider.CbsUpdateDeferred + +This event reports the results of deferring Windows Content to keep Windows up to date. + + + +### Microsoft.Windows.CbsLite.CbsLiteResetBegin + +This event is fired from Update OS when re-install of the OS begins. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **cbsLiteSessionID** An ID to associate other Cbs events related to this reset session. +- **resetFlags** A flag containing the detail of which reset scenarios was executed. +- **wipeDuration** The time taken to purge the system volume and format data volume. + + +## Diagnostic data events + +### TelClientSynthetic.AbnormalShutdown_0 + +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **AbnormalShutdownBootId** BootId of the abnormal shutdown being reported by this event. +- **AbsCausedbyAutoChk** This flag is set when AutoCheck forces a device restart to indicate that the shutdown was not an abnormal shutdown. +- **AcDcStateAtLastShutdown** Identifies if the device was on battery or plugged in. +- **BatteryLevelAtLastShutdown** The last recorded battery level. +- **BatteryPercentageAtLastShutdown** The battery percentage at the last shutdown. +- **CrashDumpEnabled** Are crash dumps enabled? +- **CumulativeCrashCount** Cumulative count of operating system crashes since the BootId reset. +- **CurrentBootId** BootId at the time the abnormal shutdown event was being reported. +- **Firmwaredata->ResetReasonEmbeddedController** The reset reason that was supplied by the firmware. +- **Firmwaredata->ResetReasonEmbeddedControllerAdditional** Additional data related to reset reason provided by the firmware. +- **Firmwaredata->ResetReasonPch** The reset reason that was supplied by the hardware. +- **Firmwaredata->ResetReasonPchAdditional** Additional data related to the reset reason supplied by the hardware. +- **Firmwaredata->ResetReasonSupplied** Indicates whether the firmware supplied any reset reason or not. +- **FirmwareType** ID of the FirmwareType as enumerated in DimFirmwareType. +- **HardwareWatchdogTimerGeneratedLastReset** Indicates whether the hardware watchdog timer caused the last reset. +- **HardwareWatchdogTimerPresent** Indicates whether hardware watchdog timer was present or not. +- **InvalidBootStat** This is a sanity check flag that ensures the validity of the bootstat file. +- **LastBugCheckBootId** bootId of the last captured crash. +- **LastBugCheckCode** Code that indicates the type of error. +- **LastBugCheckContextFlags** Additional crash dump settings. +- **LastBugCheckOriginalDumpType** The type of crash dump the system intended to save. +- **LastBugCheckOtherSettings** Other crash dump settings. +- **LastBugCheckParameter1** The first parameter with additional info on the type of the error. +- **LastBugCheckProgress** Progress towards writing out the last crash dump. +- **LastBugCheckVersion** The version of the information struct written during the crash. +- **LastSuccessfullyShutdownBootId** BootId of the last fully successful shutdown. +- **LongPowerButtonPressDetected** Identifies if the user was pressing and holding power button. +- **OOBEInProgress** Identifies if OOBE is running. +- **OSSetupInProgress** Identifies if the operating system setup is running. +- **PowerButtonCumulativePressCount** How many times has the power button been pressed? +- **PowerButtonCumulativeReleaseCount** How many times has the power button been released? +- **PowerButtonErrorCount** Indicates the number of times there was an error attempting to record power button metrics. +- **PowerButtonLastPressBootId** BootId of the last time the power button was pressed. +- **PowerButtonLastPressTime** Date and time of the last time the power button was pressed. +- **PowerButtonLastReleaseBootId** BootId of the last time the power button was released. +- **PowerButtonLastReleaseTime** Date and time of the last time the power button was released. +- **PowerButtonPressCurrentCsPhase** Represents the phase of Connected Standby exit when the power button was pressed. +- **PowerButtonPressIsShutdownInProgress** Indicates whether a system shutdown was in progress at the last time the power button was pressed. +- **PowerButtonPressLastPowerWatchdogStage** Progress while the monitor is being turned on. +- **PowerButtonPressPowerWatchdogArmed** Indicates whether or not the watchdog for the monitor was active at the time of the last power button press. +- **ShutdownDeviceType** Identifies who triggered a shutdown. Is it because of battery, thermal zones, or through a Kernel API. +- **SleepCheckpoint** Provides the last checkpoint when there is a failure during a sleep transition. +- **SleepCheckpointSource** Indicates whether the source is the EFI variable or bootstat file. +- **SleepCheckpointStatus** Indicates whether the checkpoint information is valid. +- **StaleBootStatData** Identifies if the data from bootstat is stale. +- **TransitionInfoBootId** BootId of the captured transition info. +- **TransitionInfoCSCount** l number of times the system transitioned from Connected Standby mode. +- **TransitionInfoCSEntryReason** Indicates the reason the device last entered Connected Standby mode. +- **TransitionInfoCSExitReason** Indicates the reason the device last exited Connected Standby mode. +- **TransitionInfoCSInProgress** At the time the last marker was saved, the system was in or entering Connected Standby mode. +- **TransitionInfoLastReferenceTimeChecksum** The checksum of TransitionInfoLastReferenceTimestamp, +- **TransitionInfoLastReferenceTimestamp** The date and time that the marker was last saved. +- **TransitionInfoLidState** Describes the state of the laptop lid. +- **TransitionInfoPowerButtonTimestamp** The date and time of the last time the power button was pressed. +- **TransitionInfoSleepInProgress** At the time the last marker was saved, the system was in or entering sleep mode. +- **TransitionInfoSleepTranstionsToOn** Total number of times the device transitioned from sleep mode. +- **TransitionInfoSystemRunning** At the time the last marker was saved, the device was running. +- **TransitionInfoSystemShutdownInProgress** Indicates whether a device shutdown was in progress when the power button was pressed. +- **TransitionInfoUserShutdownInProgress** Indicates whether a user shutdown was in progress when the power button was pressed. +- **TransitionLatestCheckpointId** Represents a unique identifier for a checkpoint during the device state transition. +- **TransitionLatestCheckpointSeqNumber** Represents the chronological sequence number of the checkpoint. +- **TransitionLatestCheckpointType** Represents the type of the checkpoint, which can be the start of a phase, end of a phase, or just informational. +- **VirtualMachineId** If the operating system is on a virtual Machine, it gives the virtual Machine ID (GUID) that can be used to correlate events on the host. + + +### TelClientSynthetic.AuthorizationInfo_RuntimeTransition + +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CanAddMsaToMsTelemetry** True if we can add MSA PUID and CID to telemetry, false otherwise. +- **CanCollectAnyTelemetry** True if we are allowed to collect partner telemetry, false otherwise. +- **CanCollectCoreTelemetry** True if we can collect CORE/Basic telemetry, false otherwise. +- **CanCollectHeartbeats** True if we can collect heartbeat telemetry, false otherwise. +- **CanCollectOsTelemetry** True if we can collect diagnostic data telemetry, false otherwise. +- **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. +- **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. +- **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **PreviousPermissions** Bitmask of previous telemetry state. +- **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. + + +### TelClientSynthetic.AuthorizationInfo_Startup + +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CanAddMsaToMsTelemetry** True if we can add MSA PUID and CID to telemetry, false otherwise. +- **CanCollectAnyTelemetry** True if we are allowed to collect partner telemetry, false otherwise. +- **CanCollectCoreTelemetry** True if we can collect CORE/Basic telemetry, false otherwise. +- **CanCollectHeartbeats** True if we can collect heartbeat telemetry, false otherwise. +- **CanCollectOsTelemetry** True if we can collect diagnostic data telemetry, false otherwise. +- **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. +- **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. +- **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **PreviousPermissions** Bitmask of previous telemetry state. +- **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. + + +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. + +The following fields are available: + +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **LastConnectivityLossTime** Retrieves the last time the device lost free network. +- **NetworkState** The network state of the device. +- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. +- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. + + +### TelClientSynthetic.HeartBeat_5 + +This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device. + +The following fields are available: + +- **AgentConnectionErrorsCount** Number of non-timeout errors associated with the host/agent channel. +- **CensusExitCode** The last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **CompressedBytesUploaded** Number of compressed bytes uploaded. +- **ConsumerDroppedCount** Number of events dropped at consumer layer of telemetry client. +- **CriticalDataDbDroppedCount** Number of critical data sampled events dropped at the database layer. +- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling. +- **CriticalOverflowEntersCounter** Number of times critical overflow mode was entered in event DB. +- **DbCriticalDroppedCount** Total number of dropped critical events in event DB. +- **DbDroppedCount** Number of events dropped due to DB fullness. +- **DbDroppedFailureCount** Number of events dropped due to DB failures. +- **DbDroppedFullCount** Number of events dropped due to DB fullness. +- **DecodingDroppedCount** Number of events dropped due to decoding failures. +- **EnteringCriticalOverflowDroppedCounter** Number of events dropped due to critical overflow mode being initiated. +- **EtwDroppedBufferCount** Number of buffers dropped in the UTC ETW session. +- **EtwDroppedCount** Number of events dropped at ETW layer of telemetry client. +- **EventsPersistedCount** Number of events that reached the PersistEvent stage. +- **EventStoreLifetimeResetCounter** Number of times event DB was reset for the lifetime of UTC. +- **EventStoreResetCounter** Number of times event DB was reset. +- **EventStoreResetSizeSum** Total size of event DB across all resets reports in this instance. +- **EventsUploaded** Number of events uploaded. +- **Flags** Flags indicating device state such as network state, battery state, and opt-in state. +- **FullTriggerBufferDroppedCount** Number of events dropped due to trigger buffer being full. +- **HeartBeatSequenceNumber** The sequence number of this heartbeat. +- **InvalidHttpCodeCount** Number of invalid HTTP codes received from contacting Vortex. +- **LastAgentConnectionError** Last non-timeout error encountered in the host/agent channel. +- **LastEventSizeOffender** Event name of last event which exceeded max event size. +- **LastInvalidHttpCode** Last invalid HTTP code received from Vortex. +- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe. +- **MaxInUseScenarioCounter** Soft maximum number of scenarios loaded by UTC. +- **PreviousHeartBeatTime** Time of last heartbeat event (allows chaining of events). +- **PrivacyBlockedCount** The number of events blocked due to privacy settings or tags. +- **RepeatedUploadFailureDropped** Number of events lost due to repeated upload failures for a single buffer. +- **SettingsHttpAttempts** Number of attempts to contact OneSettings service. +- **SettingsHttpFailures** The number of failures from contacting the OneSettings service. +- **ThrottledDroppedCount** Number of events dropped due to throttling of noisy providers. +- **TopUploaderErrors** List of top errors received from the upload endpoint. +- **UploaderDroppedCount** Number of events dropped at the uploader layer of telemetry client. +- **UploaderErrorCount** Number of errors received from the upload endpoint. +- **VortexFailuresTimeout** The number of timeout failures received from Vortex. +- **VortexHttpAttempts** Number of attempts to contact Vortex. +- **VortexHttpFailures4xx** Number of 400-499 error codes received from Vortex. +- **VortexHttpFailures5xx** Number of 500-599 error codes received from Vortex. +- **VortexHttpResponseFailures** Number of Vortex responses that are not 2XX or 400. +- **VortexHttpResponsesWithDroppedEvents** Number of Vortex responses containing at least 1 dropped event. + + +## DISM events + +### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU + +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismInstalledLCUPackageName** The name of the latest installed package. + + +### Microsoft.Windows.StartRepairCore.DISMPendingInstall + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.DISMUninstallLCU + +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd + +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **flightIds** The Flight IDs (identifier of the beta release) of found driver updates. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart + +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + +## Driver installation events + +### Microsoft.Windows.DriverInstall.DeviceInstall + +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ClassGuid** The unique ID for the device class. +- **ClassLowerFilters** The list of lower filter class drivers. +- **ClassUpperFilters** The list of upper filter class drivers. +- **CoInstallers** The list of coinstallers. +- **ConfigFlags** The device configuration flags. +- **DeviceConfigured** Indicates whether this device was configured through the kernel configuration. +- **DeviceInstalled** Indicates whether the legacy install code path was used. +- **DeviceInstanceId** The unique identifier of the device in the system. +- **DeviceStack** The device stack of the driver being installed. +- **DriverDate** The date of the driver. +- **DriverDescription** A description of the driver function. +- **DriverInfName** Name of the INF file (the setup information file) for the driver. +- **DriverInfSectionName** Name of the DDInstall section within the driver INF file. +- **DriverPackageId** The ID of the driver package that is staged to the driver store. +- **DriverProvider** The driver manufacturer or provider. +- **DriverUpdated** Indicates whether the driver is replacing an old driver. +- **DriverVersion** The version of the driver file. +- **EndTime** The time the installation completed. +- **Error** Provides the WIN32 error code for the installation. +- **ExtensionDrivers** List of extension drivers that complement this installation. +- **FinishInstallAction** Indicates whether the co-installer invoked the finish-install action. +- **FinishInstallUI** Indicates whether the installation process shows the user interface. +- **FirmwareDate** The firmware date that will be stored in the EFI System Resource Table (ESRT). +- **FirmwareRevision** The firmware revision that will be stored in the EFI System Resource Table (ESRT). +- **FirmwareVersion** The firmware version that will be stored in the EFI System Resource Table (ESRT). +- **FirstHardwareId** The ID in the hardware ID list that provides the most specific device description. +- **FlightIds** A list of the different Windows Insider builds on the device. +- **GenericDriver** Indicates whether the driver is a generic driver. +- **Inbox** Indicates whether the driver package is included with Windows. +- **InstallDate** The date the driver was installed. +- **LastCompatibleId** The ID in the hardware ID list that provides the least specific device description. +- **LastInstallFunction** The last install function invoked in a co-installer if the install timeout was reached while a co-installer was executing. +- **LegacyInstallReasonError** The error code for the legacy installation. +- **LowerFilters** The list of lower filter drivers. +- **MatchingDeviceId** The hardware ID or compatible ID that Windows used to install the device instance. +- **NeedReboot** Indicates whether the driver requires a reboot. +- **OriginalDriverInfName** The original name of the INF file before it was renamed. +- **ParentDeviceInstanceId** The device instance ID of the parent of the device. +- **PendedUntilReboot** Indicates whether the installation is pending until the device is rebooted. +- **Problem** Error code returned by the device after installation. +- **ProblemStatus** The status of the device after the driver installation. +- **RebootRequiredReason** DWORD (Double Word—32-bit unsigned integer) containing the reason why the device required a reboot during install. +- **SecondaryDevice** Indicates whether the device is a secondary device. +- **ServiceName** The service name of the driver. +- **SessionGuid** GUID (Globally Unique IDentifier) for the update session. +- **SetupMode** Indicates whether the driver installation took place before the Out Of Box Experience (OOBE) was completed. +- **StartTime** The time when the installation started. +- **SubmissionId** The driver submission identifier assigned by the Windows Hardware Development Center. +- **UpperFilters** The list of upper filter drivers. + + +### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd + +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DeviceInstanceId** The unique identifier of the device in the system. +- **DriverUpdated** Indicates whether the driver was updated. +- **Error** The Win32 error code of the installation. +- **FlightId** The ID of the Windows Insider build the device received. +- **InstallDate** The date the driver was installed. +- **InstallFlags** The driver installation flags. +- **OptionalData** Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.) +- **RebootRequired** Indicates whether a reboot is required after the installation. +- **RollbackPossible** Indicates whether this driver can be rolled back. +- **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update. +- **WuUntargetedHardwareId** Indicates that the driver was installed because Windows Update performed a generic driver update for all devices of that hardware class. + + +### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart + +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DeviceInstanceId** The unique identifier of the device in the system. +- **FirstInstallDate** The first time a driver was installed on this device. +- **LastDriverDate** Date of the driver that is being replaced. +- **LastDriverInbox** Indicates whether the previous driver was included with Windows. +- **LastDriverInfName** Name of the INF file (the setup information file) of the driver being replaced. +- **LastDriverVersion** The version of the driver that is being replaced. +- **LastFirmwareDate** The date of the last firmware reported from the EFI System Resource Table (ESRT). +- **LastFirmwareRevision** The last firmware revision number reported from EFI System Resource Table (ESRT). +- **LastFirmwareVersion** The last firmware version reported from the EFI System Resource Table (ESRT). +- **LastInstallDate** The date a driver was last installed on this device. +- **LastMatchingDeviceId** The hardware ID or compatible ID that Windows last used to install the device instance. +- **LastProblem** The previous problem code that was set on the device. +- **LastProblemStatus** The previous problem code that was set on the device. +- **LastSubmissionId** The driver submission identifier of the driver that is being replaced. + + +## DXDiag events + +### Microsoft.Windows.DxDiag.DxDiagExeStopEvent + +This event collects information when the DirectX diagnostics provider stops. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **hResult** Numeric value indicating the result of the operation. + + +### Microsoft.Windows.DxDiag.DxDiagProviderErrorStatistics + +This event provides statistics of major error(s) occurred during data collection, when data has not been properly collected in some queries. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **AudioFailed** Number of failed queries. +- **AudioHr** Error code for the last failed query. +- **AudioTotal** Total number of queries for audio devices. +- **GpuFailed** Number of failed queries. +- **GpuHr** Error code for the last failed query. +- **GpuTotal** Total number of queries for GPUs. +- **IsDesktop** Desktop vs WCOS SKU. +- **VideoCaptureFailed** Number of failed queries. +- **VideoCaptureHr** Error code for the last failed query. +- **VideoCaptureTotal** Total number of queries for video capture devices. + + +### Microsoft.Windows.DxDiag.DxDiagProviderMinorErrors + +This event collects information when recoverable errors were encountered. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DisplayInfo** A mask with errors occurred during collection GPU information. +- **SystemInfo** A mask with errors occurred during system information collection. + + +### Microsoft.Windows.DxDiag.DxDiagProviderStart + +This event collects information when the DirectX diagnostics provider starts. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **IsISV** Boolean value indicating that the provider is being used by a non-Microsoft application. + + +## DxgKernelTelemetry events + +### DxgKrnlTelemetry.GPUAdapterInventoryV2 + +This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. + +The following fields are available: + +- **AdapterTypeValue** The numeric value indicating the type of Graphics adapter. +- **aiSeqId** The event sequence ID. +- **bootId** The system boot ID. +- **BrightnessVersionViaDDI** The version of the Display Brightness Interface. +- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. +- **DDIInterfaceVersion** The device driver interface version. +- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). +- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). +- **Display1UMDFilePath** The file path to the location of the Display User Mode Driver in the Driver Store. +- **DisplayAdapterLuid** The display adapter LUID. +- **DriverDate** The date of the display driver. +- **DriverRank** The rank of the display driver. +- **DriverVersion** The display driver version. +- **DriverWorkarounds** Numeric value indicating the driver workarounds that are enabled for this device. +- **DX10UMDFilePath** The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store. +- **DX11UMDFilePath** The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store. +- **DX12UMDFilePath** The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. +- **DX9UMDFilePath** The file path to the location of the DirectX 9 Display User Mode Driver in the Driver Store. +- **GPUDeviceID** The GPU device ID. +- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload. +- **GPURevisionID** The GPU revision ID. +- **GPUVendorID** The GPU vendor ID. +- **IddPairedRenderAdapterLuid** Identifier for the render adapter paired with this display adapter. +- **InterfaceFuncPointersProvided1** Number of device driver interface function pointers provided. +- **InterfaceFuncPointersProvided2** Number of device driver interface function pointers provided. +- **InterfaceId** The GPU interface ID. +- **IsDisplayDevice** Does the GPU have displaying capabilities? +- **IsHwSchEnabled** Boolean value indicating whether hardware scheduling is enabled. +- **IsHwSchSupported** Indicates whether the adapter supports hardware scheduling. +- **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device? +- **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device? +- **IsLDA** Is the GPU comprised of Linked Display Adapters? +- **IsMiracastSupported** Does the GPU support Miracast? +- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor? +- **IsMPOSupported** Does the GPU support Multi-Plane Overlays? +- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution? +- **IsPostAdapter** Is this GPU the POST GPU in the device? +- **IsRemovable** TRUE if the adapter supports being disabled or removed. +- **IsRenderDevice** Does the GPU have rendering capabilities? +- **IsSoftwareDevice** Is this a software implementation of the GPU? +- **KMDFilePath** The file path to the location of the Display Kernel Mode Driver in the Driver Store. +- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES? +- **NumNonVidPnTargets** Number of display targets. +- **NumVidPnSources** The number of supported display output sources. +- **NumVidPnTargets** The number of supported display output targets. +- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes). +- **SubSystemID** The subsystem ID. +- **SubVendorID** The GPU sub vendor ID. +- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY? +- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling) +- **version** The event version. +- **WDDMVersion** The Windows Display Driver Model version. + + +## Fault Reporting events + +### Microsoft.Windows.FaultReporting.AppCrashEvent + +This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes\" by a user DO NOT emit this event. + +The following fields are available: + +- **AppName** The name of the app that has crashed. +- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend. +- **AppTimeStamp** The date/time stamp of the app. +- **AppVersion** The version of the app that has crashed. +- **ExceptionCode** The exception code returned by the process that has crashed. +- **ExceptionOffset** The address where the exception had occurred. +- **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting. +- **FriendlyAppName** The description of the app that has crashed, if different from the AppName. Otherwise, the process name. +- **IsFatal** True/False to indicate whether the crash resulted in process termination. +- **ModName** Exception module name (e.g. bar.dll). +- **ModTimeStamp** The date/time stamp of the module. +- **ModVersion** The version of the module that has crashed. +- **PackageFullName** Store application identity. +- **PackageRelativeAppId** Store application identity. +- **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64. +- **ProcessCreateTime** The time of creation of the process that has crashed. +- **ProcessId** The ID of the process that has crashed. +- **ReportId** A GUID used to identify the report. This can used to track the report across Watson. +- **TargetAppId** The kernel reported AppId of the application being reported. +- **TargetAppVer** The specific version of the application being reported +- **TargetAsId** The sequence number for the hanging process. + + +## Feature update events + +### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed + +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **failureReason** Provides data about the uninstall initialization operation failure. +- **hr** Provides the Win32 error code for the operation failure. + + +### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered + +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +## Feedback events + +### Microsoft.Windows.Fundamentals.UserInitiatedFeedback.SimilarFeedbackSelection + +This event measures the usage for Similar Feedback section in Feedback Hub. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **ActivityDuration** Time it tool to make a selection. +- **HasDuplicateData** Indicates if duplicate data is available. +- **HasWorkItem** Indicates if a work item is associated. +- **IsCollection** Indicates if selection is collection. +- **IsNewFeedback** Indicates if selection is new feedback. +- **LetTeamTriage** Indicates if selection is for triage. +- **MakeBug** Indicates if selection is to create a bug. +- **MakeDuplicate** Indicates if selection is to create a duplicate bug. +- **ResultsFounds** Total results shown. +- **SearchExperiment** Experiment ID used. +- **SelectedPosition** Position of the selection. +- **SelectedScore** Search score of selection. +- **ServiceCallDuration** Time for service results. +- **Source** Method used to get results. + + +## Hang Reporting events + +### Microsoft.Windows.HangReporting.AppHangEvent + +This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on PC devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events. + +The following fields are available: + +- **AppName** The name of the app that has hung. +- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the telemetry backend. +- **AppVersion** The version of the app that has hung. +- **IsFatal** True/False based on whether the hung application caused the creation of a Fatal Hang Report. +- **PackageFullName** Store application identity. +- **PackageRelativeAppId** Store application identity. +- **ProcessArchitecture** Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64. +- **ProcessCreateTime** The time of creation of the process that has hung. +- **ProcessId** The ID of the process that has hung. +- **ReportId** A GUID used to identify the report. This can used to track the report across Watson. +- **TargetAppId** The kernel reported AppId of the application being reported. +- **TargetAppVer** The specific version of the application being reported. +- **TargetAsId** The sequence number for the hanging process. +- **TypeCode** Bitmap describing the hang type. +- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application. +- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting. +- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting. +- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package. + + +## Holographic events + +### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded + +This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **ClassGuid** Windows Mixed Reality device class GUID. +- **DeviceInterfaceId** Windows Mixed Reality device interface ID. +- **DriverVersion** Windows Mixed Reality device driver version. +- **FirmwareVersion** Windows Mixed Reality firmware version. +- **Manufacturer** Windows Mixed Reality device manufacturer. +- **ModelName** Windows Mixed Reality device model name. +- **SerialNumber** Windows Mixed Reality device serial number. + + +### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceRemoved + +This event indicates Windows Mixed Reality device state. The data collected with this event is used to keep Windows and Windows Mixed Reality performing properly. + +The following fields are available: + +- **DeviceInterfaceId** Device Interface ID. + + +### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated + +This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **HmdState** Windows Mixed Reality Headset HMD state. +- **NewHoloShellState** Windows Mixed Reality HoloShell state. +- **PriorHoloShellState** Windows Mixed Reality state prior to entering to HoloShell. +- **SimulationEnabled** Windows Mixed Reality Simulation state. + + +### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated + +This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **IsDemoMode** Windows Mixed Reality Portal app state of demo mode. +- **IsDeviceSetupComplete** Windows Mixed Reality Portal app state of device setup completion. +- **PackageVersion** Windows Mixed Reality Portal app package version. +- **PreviousExecutionState** Windows Mixed Reality Portal app prior execution state. +- **wilActivity** Windows Mixed Reality Portal app wilActivity ID. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming + +This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Shell.HolographicFirstRun.SomethingWentWrong + +This event is emitted when something went wrong error occurs. The data collected with this event is used to keep Windows and Windows Mixed Reality performing properly. + +The following fields are available: + +- **ErrorSource** Source of error, obsoleted always 0. +- **StartupContext** Start up state. +- **StatusCode** Error status code. +- **SubstatusCode** Error sub status code. + + +### TraceLoggingHoloLensSensorsProvider.OnDeviceAdd + +This event provides Windows Mixed Reality device state with new process that hosts the driver. The data collected with this event is used to keep Windows and Windows Mixed Reality performing properly. + +The following fields are available: + +- **Process** Process ID. +- **Thread** Thread ID. + + +### TraceLoggingOasisUsbHostApiProvider.DeviceInformation + +This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BootloaderMajorVer** Windows Mixed Reality device boot loader major version. +- **BootloaderMinorVer** Windows Mixed Reality device boot loader minor version. +- **BootloaderRevisionNumber** Windows Mixed Reality device boot loader revision number. +- **BTHFWMajorVer** Windows Mixed Reality device BTHFW major version. This event also used to count WMR device. +- **BTHFWMinorVer** Windows Mixed Reality device BTHFW minor version. This event also used to count WMR device. +- **BTHFWRevisionNumber** Windows Mixed Reality device BTHFW revision number. +- **CalibrationBlobSize** Windows Mixed Reality device calibration blob size. +- **CalibrationFwMajorVer** Windows Mixed Reality device calibration firmware major version. +- **CalibrationFwMinorVer** Windows Mixed Reality device calibration firmware minor version. +- **CalibrationFwRevNum** Windows Mixed Reality device calibration firmware revision number. +- **DeviceInfoFlags** Windows Mixed Reality device info flags. +- **DeviceName** Windows Mixed Reality device Name. This event is also used to count WMR device. +- **DeviceReleaseNumber** Windows Mixed Reality device release number. +- **FirmwareMajorVer** Windows Mixed Reality device firmware major version. +- **FirmwareMinorVer** Windows Mixed Reality device firmware minor version. +- **FirmwareRevisionNumber** Windows Mixed Reality device calibration firmware revision number. +- **FpgaFwMajorVer** Windows Mixed Reality device FPGA firmware major version. +- **FpgaFwMinorVer** Windows Mixed Reality device FPGA firmware minor version. +- **FpgaFwRevisionNumber** Windows Mixed Reality device FPGA firmware revision number. +- **FriendlyName** Windows Mixed Reality device friendly name. +- **HashedSerialNumber** Windows Mixed Reality device hashed serial number. +- **HeaderSize** Windows Mixed Reality device header size. +- **HeaderVersion** Windows Mixed Reality device header version. +- **LicenseKey** Windows Mixed Reality device header license key. +- **Make** Windows Mixed Reality device make. +- **ManufacturingDate** Windows Mixed Reality device manufacturing date. +- **Model** Windows Mixed Reality device model. +- **PresenceSensorHidVendorPage** Windows Mixed Reality device presence sensor HID vendor page. +- **PresenceSensorHidVendorUsage** Windows Mixed Reality device presence sensor HID vendor usage. +- **PresenceSensorUsbVid** Windows Mixed Reality device presence sensor USB VId. +- **ProductBoardRevision** Windows Mixed Reality device product board revision number. +- **SerialNumber** Windows Mixed Reality device serial number. + + +## Inventory events + +### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum + +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **Device** A count of device objects in cache. +- **DeviceCensus** A count of device census objects in cache. +- **DriverPackageExtended** A count of driverpackageextended objects in cache. +- **File** A count of file objects in cache. +- **FileSigningInfo** A count of file signing objects in cache. +- **Generic** A count of generic objects in cache. +- **HwItem** A count of hwitem objects in cache. +- **InventoryApplication** A count of application objects in cache. +- **InventoryApplicationAppV** A count of application AppV objects in cache. +- **InventoryApplicationDriver** A count of application driver objects in cache +- **InventoryApplicationFile** A count of application file objects in cache. +- **InventoryApplicationFramework** A count of application framework objects in cache +- **InventoryApplicationShortcut** A count of application shortcut objects in cache +- **InventoryDeviceContainer** A count of device container objects in cache. +- **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache. +- **InventoryDeviceMediaClass** A count of device media objects in cache. +- **InventoryDevicePnp** A count of device Plug and Play objects in cache. +- **InventoryDeviceUsbHubClass** A count of device usb objects in cache +- **InventoryDriverBinary** A count of driver binary objects in cache. +- **InventoryDriverPackage** A count of device objects in cache. +- **InventoryMiscellaneousOfficeAddIn** A count of office add-in objects in cache +- **InventoryMiscellaneousOfficeAddInUsage** A count of office add-in usage objects in cache. +- **InventoryMiscellaneousOfficeIdentifiers** A count of office identifier objects in cache +- **InventoryMiscellaneousOfficeIESettings** A count of office ie settings objects in cache +- **InventoryMiscellaneousOfficeInsights** A count of office insights objects in cache +- **InventoryMiscellaneousOfficeProducts** A count of office products objects in cache +- **InventoryMiscellaneousOfficeSettings** A count of office settings objects in cache +- **InventoryMiscellaneousOfficeVBA** A count of office vba objects in cache +- **InventoryMiscellaneousOfficeVBARuleViolations** A count of office vba rule violations objects in cache +- **InventoryMiscellaneousUUPInfo** A count of uup info objects in cache +- **Metadata** A count of metadata objects in cache. +- **Orphan** A count of orphan file objects in cache. +- **Programs** A count of program objects in cache. + + +### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions + +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **aeinv** The version of the App inventory component. +- **devinv** The file version of the Device inventory component. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd + +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **HiddenArp** Indicates whether a program hides itself from showing up in ARP. +- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics). +- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00 +- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array. +- **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. +- **InventoryVersion** The version of the inventory file generating the events. +- **Language** The language code of the program. +- **MsiInstallDate** The install date recorded in the program's MSI package. +- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. +- **MsiProductCode** A GUID that describe the MSI Product. +- **Name** The name of the application. +- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install. +- **PackageFullName** The package full name for a Store application. +- **ProgramInstanceId** A hash of the file IDs in an app. +- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field. +- **RootDirPath** The path to the root directory where the program was installed. +- **Source** How the program was installed (for example, ARP, MSI, Appx). +- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp. +- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen. +- **Version** The version number of the program. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd + +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory component +- **ProgramIds** The unique program identifier the driver is associated with + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync + +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory component. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd + +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **FileId** A hash that uniquely identifies a file. +- **Frameworks** The list of frameworks this file depends on. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync + +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove + +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync + +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd + +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Categories** A comma separated list of functional categories in which the container belongs. +- **DiscoveryMethod** The discovery method for the device container. +- **FriendlyName** The name of the device container. +- **Icon** Deprecated in RS3. The path or index to the icon file. +- **InventoryVersion** The version of the inventory file generating the events. +- **IsActive** Is the device connected, or has it been seen in the last 14 days? +- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link. +- **IsMachineContainer** Is the container the root device itself? +- **IsNetworked** Is this a networked device? +- **IsPaired** Does the device container require pairing? +- **Manufacturer** The manufacturer name for the device container. +- **ModelId** A unique model ID. +- **ModelName** The model name. +- **ModelNumber** The model number for the device container. +- **PrimaryCategory** The primary category for the device container. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove + +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync + +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd + +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Accelerometer3D** Indicates if an Accelerator3D sensor is found. +- **ActivityDetection** Indicates if an Activity Detection sensor is found. +- **AmbientLight** Indicates if an Ambient Light sensor is found. +- **Barometer** Indicates if a Barometer sensor is found. +- **Custom** Indicates if a Custom sensor is found. +- **EnergyMeter** Indicates if an Energy sensor is found. +- **FloorElevation** Indicates if a Floor Elevation sensor is found. +- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found. +- **GravityVector** Indicates if a Gravity Detector sensor is found. +- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found. +- **Humidity** Indicates if a Humidity sensor is found. +- **InventoryVersion** The version of the inventory file generating the events. +- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found. +- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found. +- **Orientation** Indicates if an Orientation sensor is found. +- **Pedometer** Indicates if a Pedometer sensor is found. +- **Proximity** Indicates if a Proximity sensor is found. +- **RelativeOrientation** Indicates if a Relative Orientation sensor is found. +- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found. +- **Temperature** Indicates if a Temperature sensor is found. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync + +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd + +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Audio.CaptureDriver** The capture driver endpoint for the audio device. +- **Audio.RenderDriver** The render driver for the audio device. +- **Audio_CaptureDriver** The Audio device capture driver endpoint. +- **Audio_RenderDriver** The Audio device render driver endpoint. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove + +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync + +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd + +This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **BusReportedDescription** The description of the device reported by the bux. +- **Class** The device setup class of the driver loaded for the device. +- **ClassGuid** The device class GUID from the driver package +- **COMPID** The device setup class guid of the driver loaded for the device. +- **ContainerId** The list of compat ids for the device. +- **Description** System-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the computer. +- **DeviceDriverFlightId** The test build (Flight) identifier of the device driver. +- **DeviceExtDriversFlightIds** The test build (Flight) identifier for all extended device drivers. +- **DeviceInterfaceClasses** The device interfaces that this device implements. +- **DeviceState** The device description. +- **DriverId** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present +- **DriverName** A unique identifier for the driver installed. +- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage +- **DriverVerDate** Name of the .sys image file (or wudfrd.sys if using user mode driver framework). +- **DriverVerVersion** The immediate parent directory name in the Directory field of InventoryDriverPackage. +- **Enumerator** The date of the driver loaded for the device. +- **ExtendedInfs** The extended INF file names. +- **FirstInstallDate** The first time this device was installed on the machine. +- **HWID** The version of the driver loaded for the device. +- **Inf** The bus that enumerated the device. +- **InstallDate** The date of the most recent installation of the device on the machine. +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InventoryVersion** List of hardware ids for the device. +- **LowerClassFilters** Lower filter class drivers IDs installed for the device +- **LowerFilters** Lower filter drivers IDs installed for the device +- **Manufacturer** INF file name (the name could be renamed by OS, such as oemXX.inf) +- **MatchingID** Device installation state. +- **Model** The version of the inventory binary generating the events. +- **ParentId** Lower filter class drivers IDs installed for the device. +- **ProblemCode** Lower filter drivers IDs installed for the device. +- **Provider** The device manufacturer. +- **Service** The device service name +- **STACKID** Represents the hardware ID or compatible ID that Windows uses to install a device instance. +- **UpperClassFilters** Upper filter drivers IDs installed for the device +- **UpperFilters** The device model. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove + +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync + +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd + +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. +- **TotalUserConnectablePorts** Total number of connectable USB ports. +- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync + +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd + +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **DriverCheckSum** The checksum of the driver file. +- **DriverCompany** The company name that developed the driver. +- **DriverInBox** Is the driver included with the operating system? +- **DriverIsKernelMode** Is it a kernel mode driver? +- **DriverName** The file name of the driver. +- **DriverPackageStrongName** The strong name of the driver package +- **DriverSigned** The strong name of the driver package +- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file. +- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000. +- **DriverVersion** The version of the driver file. +- **ImageSize** The size of the driver file. +- **Inf** The name of the INF file. +- **InventoryVersion** The version of the inventory file generating the events. +- **Product** The product name that is included in the driver file. +- **ProductVersion** The product version that is included in the driver file. +- **Service** The name of the service that is installed for the device. +- **WdfVersion** The Windows Driver Framework version. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove + +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync + +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd + +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Class** The class name for the device driver. +- **ClassGuid** The class GUID for the device driver. +- **Date** The driver package date. +- **Directory** The path to the driver package. +- **DriverInBox** Is the driver included with the operating system? +- **FlightIds** Driver Flight IDs. +- **Inf** The INF name of the driver package. +- **InventoryVersion** The version of the inventory file generating the events. +- **Provider** The provider for the driver package. +- **RecoveryIds** Driver recovery IDs. +- **SubmissionId** The HLK submission ID for the driver package. +- **Version** The version of the driver package. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove + +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync + +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes. +- **Manufacturer** Name of the DRAM manufacturer. +- **Model** Model and submodel of the memory. +- **Slot** Slot the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured and used at. +- **Type** Reports DDR, etc. as an enumeration value per DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd + +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AddinCLSID** The class identifier key for the Microsoft Office add-in. +- **AddInCLSID** The class identifier key for the Microsoft Office add-in. +- **AddInId** The identifier for the Microsoft Office add-in. +- **AddinType** The type of the Microsoft Office add-in. +- **BinFileTimestamp** The timestamp of the Office add-in. +- **BinFileVersion** The version of the Microsoft Office add-in. +- **Description** Description of the Microsoft Office add-in. +- **FileId** The file identifier of the Microsoft Office add-in. +- **FileSize** The file size of the Microsoft Office add-in. +- **FriendlyName** The friendly name for the Microsoft Office add-in. +- **FullPath** The full path to the Microsoft Office add-in. +- **InventoryVersion** The version of the inventory binary generating the events. +- **LoadBehavior** Integer that describes the load behavior. +- **LoadTime** Load time for the Office add-in. +- **OfficeApplication** The Microsoft Office application associated with the add-in. +- **OfficeArchitecture** The architecture of the add-in. +- **OfficeVersion** The Microsoft Office version for this add-in. +- **OutlookCrashingAddin** Indicates whether crashes have been found for this add-in. +- **ProductCompany** The name of the company associated with the Office add-in. +- **ProductName** The product name associated with the Microsoft Office add-in. +- **ProductVersion** The version associated with the Office add-in. +- **ProgramId** The unique program identifier of the Microsoft Office add-in. +- **Provider** Name of the provider for this add-in. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync + +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd + +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device +- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device +- **OMID** Identifier for the Office SQM Machine +- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit +- **OTenantId** Unique GUID representing the Microsoft O365 Tenant +- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000 +- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows) + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd + +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature. +- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files. +- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) +- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag +- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request +- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) +- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts +- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords +- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control +- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted +- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC) +- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL +- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior +- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows +- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd + +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OfficeApplication** The name of the Office application. +- **OfficeArchitecture** The bitness of the Office application. +- **OfficeVersion** The version of the Office application. +- **Value** The insights collected about this entity. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync + +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd + +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OC2rApps** A GUID the describes the Office Click-To-Run apps +- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus +- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word +- **OProductCodes** A GUID that describes the Office MSI products + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd + +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **BrowserFlags** Browser flags for Office-related products. +- **ExchangeProviderFlags** Provider policies for Office Exchange. +- **InventoryVersion** The version of the inventory binary generating the events. +- **SharedComputerLicensing** Office shared computer licensing policies. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd + +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Design** Count of files with design issues found. +- **Design_x64** Count of files with 64 bit design issues found. +- **DuplicateVBA** Count of files with duplicate VBA code. +- **HasVBA** Count of files with VBA code. +- **Inaccessible** Count of files that were inaccessible for scanning. +- **InventoryVersion** The version of the inventory binary generating the events. +- **Issues** Count of files with issues detected. +- **Issues_x64** Count of files with 64-bit issues detected. +- **IssuesNone** Count of files with no issues detected. +- **IssuesNone_x64** Count of files with no 64-bit issues detected. +- **Locked** Count of files that were locked, preventing scanning. +- **NoVBA** Count of files with no VBA inside. +- **Protected** Count of files that were password protected, preventing scanning. +- **RemLimited** Count of files that require limited remediation changes. +- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues. +- **RemSignificant** Count of files that require significant remediation changes. +- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues. +- **Score** Overall compatibility score calculated for scanned content. +- **Score_x64** Overall 64-bit compatibility score calculated for scanned content. +- **Total** Total number of files scanned. +- **Validation** Count of files that require additional manual validation. +- **Validation_x64** Count of files that require additional manual validation for 64-bit issues. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd + +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Count** Count of total Microsoft Office VBA rule violations +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync + +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync + +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd + +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Identifier** UUP identifier +- **LastActivatedVersion** Last activated version +- **PreviousVersion** Previous version +- **Source** UUP source +- **Version** UUP version + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.Indicators.Checksum + +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **CensusId** A unique hardware identifier. +- **ChecksumDictionary** A count of each operating system indicator. +- **PCFP** Equivalent to the InventoryId field that is found in other core events. + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd + +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **IndicatorValue** The indicator value. + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +## Kernel events + +### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig + +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ClassGuid** The unique ID for the device class. +- **DeviceInstanceId** The unique ID for the device on the system. +- **DriverDate** The date of the driver. +- **DriverFlightIds** The IDs for the driver flights. +- **DriverInfName** Driver INF file name. +- **DriverProvider** The driver manufacturer or provider. +- **DriverSubmissionId** The driver submission ID assigned by the hardware developer center. +- **DriverVersion** The driver version number. +- **ExtensionDrivers** The list of extension driver INF files, extension IDs, and associated flight IDs. +- **FirstHardwareId** The ID in the hardware ID list that provides the most specific device description. +- **InboxDriver** Indicates whether the driver package is included with Windows. +- **InstallDate** Date the driver was installed. +- **LastCompatibleId** The ID in the hardware ID list that provides the least specific device description. +- **Legacy** Indicates whether the driver is a legacy driver. +- **NeedReboot** Indicates whether the driver requires a reboot. +- **RebootRequiredReason** Provides the reason why a reboot is required. +- **SetupMode** Indicates whether the device configuration occurred during the Out Of Box Experience (OOBE). +- **StatusCode** The NTSTATUS of device configuration operation. + + +### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem + +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Count** The total number of events. +- **DeviceInstanceId** The unique identifier of the device on the system. +- **LastProblem** The previous problem that was cleared. +- **LastProblemStatus** The previous NTSTATUS value that was cleared. +- **ServiceName** The name of the driver or service attached to the device. + + +### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem + +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Count** The total number of events. +- **DeviceInstanceId** The unique identifier of the device in the system. +- **LastProblem** The previous problem code that was set on the device. +- **LastProblemStatus** The previous NTSTATUS value that was set on the device. +- **Problem** The new problem code that was set on the device. +- **ProblemStatus** The new NTSTATUS value that was set on the device. +- **ServiceName** The driver or service name that is attached to the device. + + +### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown + +This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **temperature** Contains the actual temperature measurement, in tenths of degrees Kelvin, for the area that exceeded the limit. +- **thermalZone** Contains an identifier that specifies which area it was that exceeded temperature limits. + + +### Microsoft.Windows.Kernel.Power.WinloadFatalError + +This event provides Winload fatal error information. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **errorBootId** The first boot sequence this error code was encountered since the last successful boot. +- **errorCode** The code from OslFatalErrorEx. +- **errorStatus** The status from OslFatalErrorEx. +- **otherErrorCount** The number of times other error codes have been encountered on subsequent boot attempts. +- **repeatCount** The number of times this error code has been repeated on subsequent boot attempts. + + +## Microsoft Edge events + +### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_env** The environment from which the event was logged when testing; otherwise, the field is omitted or left blank. +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." +- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. +- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). +- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). +- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. +- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **eventType** A string representation of appPingEventEventType indicating the type of the event. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +## Migration events + +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + +The following fields are available: + +- **currentSid** Indicates the user SID for which the migration is being performed. +- **knownFoldersUsr[i]** Predefined folder path locations. +- **migDiagSession->CString** The phase of the upgrade where migration occurs. (E.g.: Validate tracked content) +- **objectCount** The count for the number of objects that are being transferred. + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFSys + +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + +The following fields are available: + +- **knownFoldersSys[i]** The predefined folder path locations. +- **migDiagSession->CString** Identifies the phase of the upgrade where migration happens. +- **objectCount** The count of the number of objects that are being transferred. + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + +The following fields are available: + +- **currentSid** Indicates the user SID for which the migration is being performed. +- **knownFoldersUsr[i]** Predefined folder path locations. +- **migDiagSession->CString** The phase of the upgrade where the migration occurs. (For example, Validate tracked content.) +- **objectCount** The number of objects that are being transferred. + + +## MUI events + +### MuiResourceLoaderTraceLogging.MapAndVerifyResourceFileFailure + +This event is logged when LdrMapAndVerifyResourceFile fails for an overlay module. + +The following fields are available: + +- **Culture** Language tag. +- **DevicePath** True if file path is a device path. +- **Flags** Flags used for verification in LdrMapAndVerifyResourceFile. +- **ResourceFileName** DLL path and name. +- **Status** Failing status code. + + +### MuiResourceLoaderTraceLogging.VerifyAlternateResourceModuleWithServiceChecksumFailure + +This event logs a failure when a MUI has an incompatible service checksum. + +The following fields are available: + +- **ActualServiceChecksum** The checksum in the MUI file. +- **ExpectedServiceChecksum** The checksum in the neutral binary. +- **ResourceFileName** DLL path and name which has a failing service checksum. + + +## OneDrive events + +### Microsoft.OneDrive.Sync.Setup.APIOperation + +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **APIName** The name of the API. +- **Duration** How long the operation took. +- **IsSuccess** Was the operation successful? +- **ResultCode** The result code. +- **ScenarioName** The name of the scenario. + + +### Microsoft.OneDrive.Sync.Setup.EndExperience + +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **APIName** The name of the API. +- **HResult** HResult of the operation +- **IsSuccess** Whether the operation is successful or not +- **ScenarioName** The name of the scenario. + + +### Microsoft.OneDrive.Sync.Updater.ComponentInstallState + +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **ComponentName** The name of the dependent component. +- **isInstalled** Is the dependent component installed? + + +### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus + +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system. +- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system. + + +### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult + +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **hr** The HResult of the operation. +- **IsLoggingEnabled** Indicates whether logging is enabled for the updater. +- **UpdaterVersion** The version of the updater. + + +### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus + +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **failedCheck** The error code returned by the operation. +- **winInetError** The HResult of the operation. + + +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +## Privacy consent logging events + +### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted + +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **presentationVersion** Which display version of the privacy consent experience the user completed +- **privacyConsentState** The current state of the privacy consent experience +- **settingsVersion** Which setting version of the privacy consent experience the user completed +- **userOobeExitReason** The exit reason of the privacy consent experience + + +### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus + +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **isAdmin** whether the person who is logging in is an admin +- **isExistingUser** whether the account existed in a downlevel OS +- **isLaunching** Whether or not the privacy consent experience will be launched +- **isSilentElevation** whether the user has most restrictive UAC controls +- **privacyConsentState** whether the user has completed privacy experience +- **userRegionCode** The current user's region setting + + +## Sediment events + +### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings + +This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date. + +The following fields are available: + +- **CustomVer** The registry value for targeting. +- **IsMetered** TRUE if the machine is on a metered network. +- **LastVer** The version of the last successful run. +- **ServiceVersionMajor** The Major version information of the component. +- **ServiceVersionMinor** The Minor version information of the component. +- **Time** The system time at which the event occurred. + + +### Microsoft.Windows.Sediment.OSRSS.Error + +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **FailureType** The type of error encountered. +- **FileName** The code file in which the error occurred. +- **HResult** The failure error code. +- **LineNumber** The line number in the code file at which the error occurred. +- **ServiceVersionMajor** The Major version information of the component. +- **ServiceVersionMinor** The Minor version information of the component. +- **Time** The system time at which the event occurred. + + +## Setup events + +### Microsoft.Windows.Setup.WinSetupBoot.BootBlockStart + +This event emits the start of the windows setup boot routine during upgrade. This routine determines the state of the upgrade and handles properly moving the upgrade forward or rolling back the device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Action** It indicates phase/stage of operation. +- **Detail** It indicates details about the phase/stage of the operation. +- **Rollback** It is blank as this event triggers in success scenario only. +- **Status** It indicates details about the status for getting the disk device object during boot. + + +### Microsoft.Windows.Setup.WinSetupBoot.BootBlockStop + +This event emits the stop of the windows setup boot routine during upgrade. This routine determines the state of the upgrade and handles properly moving the upgrade forward or rolling back the device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Action** It indicates phase/stage of operation. +- **Detail** It indicates details about the phase/stage of the operation. +- **Rollback** It is blank as this event triggers in success scenario only. +- **Status** It indicates details about the status for getting the disk device object during boot. + + +### SetupPlatformTel.SetupPlatformTelActivityEvent + +This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up to date. + +The following fields are available: + +- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. +- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. +- **Value** Value associated with the corresponding event name. For example, time-related events will include the system time + + +### SetupPlatformTel.SetupPlatformTelActivityStarted + +This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. + +The following fields are available: + +- **Name** The name of the dynamic update type. Example: GDR driver + + +### SetupPlatformTel.SetupPlatformTelActivityStopped + +This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. + + + +### SetupPlatformTel.SetupPlatformTelEvent + +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. + +The following fields are available: + +- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. +- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. +- **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. + + +## Software update events + +### SoftwareUpdateClientTelemetry.CheckForUpdates + +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. + +The following fields are available: + +- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion. +- **AllowCachedResults** Indicates if the scan allowed using cached results. +- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable +- **BranchReadinessLevel** The servicing branch configured on the device. +- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated. +- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location. +- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. +- **ClientVersion** The version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. No data is currently reported in this field. Expected value for this field is 0. +- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown +- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000). +- **DeferredUpdates** Update IDs which are currently being deferred until a later time +- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered. +- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled. +- **DriverSyncPassPerformed** Were drivers scanned this time? +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **ExtendedMetadataCabUrl** Hostname that is used to download an update. +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. +- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan. +- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan. +- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days). +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days). +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **IPVersion** Indicates whether the download took place over IPv4 or IPv6 +- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. +- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBFederatedScanDisabled** Indicates if Windows Update for Business federated scan is disabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce +- **MSIError** The last error that was encountered during a scan for updates. +- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6 +- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete +- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked +- **NumberOfLoop** The number of round trips the scan required +- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan +- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan +- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down. +- **Online** Indicates if this was an online scan. +- **PausedUpdates** A list of UpdateIds which that currently being paused. +- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window. +- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window. +- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window. +- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window. +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. +- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days). +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days). +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **ScanDurationInSeconds** The number of seconds a scan took +- **ScanEnqueueTime** The number of seconds it took to initialize a scan +- **ScanProps** This is a 32-bit integer containing Boolean properties for a given Windows Update scan. The following bits are used; all remaining bits are reserved and set to zero. Bit 0 (0x1): IsInteractive - is set to 1 if the scan is requested by a user, or 0 if the scan is requested by Automatic Updates. Bit 1 (0x2): IsSeeker - is set to 1 if the Windows Update client's Seeker functionality is enabled. Seeker functionality is enabled on certain interactive scans, and results in the scans returning certain updates that are in the initial stages of release (not yet released for full adoption via Automatic Updates). +- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.). +- **ServiceUrl** The environment URL a device is configured to scan with +- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult). +- **SyncType** Describes the type of scan the event was +- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null. +- **TargetReleaseVersion** The value selected for the target release version policy. +- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down. +- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. + + +### SoftwareUpdateClientTelemetry.Commit + +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. + +The following fields are available: + +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRevisionNumber** Identifies the revision number of the content bundle +- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client +- **ClassificationId** Classification identifier of the update content. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the update deployment provider. +- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc. +- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver". +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. +- **FlightId** The specific id of the flight the device is getting +- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.) +- **RevisionNumber** Identifies the revision number of this specific piece of content +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateId** Identifier associated with the specific piece of content + + +### SoftwareUpdateClientTelemetry.Download + +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. + +The following fields are available: + +- **ActiveDownloadTime** Number of seconds the update was actively being downloaded. +- **AppXBlockHashFailures** Indicates the number of blocks that failed hash validation during download. +- **AppXScope** Indicates the scope of the app download. +- **BundleBytesDownloaded** Number of bytes downloaded for the specific content bundle. +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **BytesDownloaded** Number of bytes that were downloaded for an individual piece of content (not the entire bundle). +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **CbsMethod** The method used for downloading the update content related to the Component Based Servicing (CBS) technology. +- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location. +- **CDNId** ID which defines which CDN the software distribution client downloaded the content from. +- **ClientVersion** The version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. +- **ConnectTime** Indicates the cumulative amount of time (in seconds) it took to establish the connection for all updates in an update bundle. +- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority. +- **DownloadProps** Information about the download operation properties in the form of a bitmask. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed. +- **EventType** Possible values are Child, Bundle, or Driver. +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight. +- **FlightId** The specific ID of the flight (pre-release build) the device is getting. +- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **HostName** The hostname URL the content is downloading from. +- **IPVersion** Indicates whether the download took place over IPv4 or IPv6. +- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. +- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **NetworkCost** A flag indicating the cost of the network (congested, fixed, variable, over data limit, roaming, etc.) used for downloading the update content. +- **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered." +- **PackageFullName** The package name of the content. +- **PostDnldTime** Time taken (in seconds) to signal download completion after the last job has completed downloading payload. +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **Reason** A 32-bit integer representing the reason the update is blocked from being downloaded in the background. +- **RegulationResult** The result code (HResult) of the last attempt to contact the regulation web service for download regulation of update content. +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one. +- **RepeatFailCount** Indicates whether this specific content has previously failed. +- **RevisionNumber** The revision number of the specified piece of content. +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **SizeCalcTime** Time taken (in seconds) to calculate the total download size of the payload. +- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult). +- **TotalExpectedBytes** The total count of bytes that the download is expected to be. +- **UpdateId** An identifier associated with the specific piece of content. +- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional. +- **UsedDO** Whether the download used the delivery optimization service. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. + + +### SoftwareUpdateClientTelemetry.DownloadCheckpoint + +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client +- **ClientVersion** The version number of the software distribution client +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed +- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver" +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough +- **FileId** A hash that uniquely identifies a file +- **FileName** Name of the downloaded file +- **FlightId** The unique identifier for each flight +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **RevisionNumber** Unique revision number of Update +- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.) +- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult) +- **UpdateId** Unique Update ID +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue + + +### SoftwareUpdateClientTelemetry.DownloadHeartbeat + +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **BytesTotal** Total bytes to transfer for this content +- **BytesTransferred** Total bytes transferred for this content at the time of heartbeat +- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client +- **ClientVersion** The version number of the software distribution client +- **ConnectionStatus** Indicates the connectivity state of the device at the time of heartbeat +- **CurrentError** Last (transient) error encountered by the active download +- **DownloadFlags** Flags indicating if power state is ignored +- **DownloadState** Current state of the active download for this content (queued, suspended, or progressing) +- **EventType** Possible values are "Child", "Bundle", or "Driver" +- **FlightId** The unique identifier for each flight +- **IsNetworkMetered** Indicates whether Windows considered the current network to be ?metered" +- **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any +- **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any +- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby) +- **RelatedCV** The previous correlation vector that was used by the client, before swapping with a new one +- **ResumeCount** Number of times this active download has resumed from a suspended state +- **RevisionNumber** Identifies the revision number of this specific piece of content +- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc) +- **SuspendCount** Number of times this active download has entered a suspended state +- **SuspendReason** Last reason for why this active download entered a suspended state +- **UpdateId** Identifier associated with the specific piece of content +- **WUDeviceID** Unique device id controlled by the software distribution client + + +### SoftwareUpdateClientTelemetry.Install + +This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date. + +The following fields are available: + +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle has previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **ClassificationId** Classification identifier of the update content. +- **ClientVersion** The version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. No value is currently reported in this field. Expected value for this field is 0. +- **CSIErrorType** The stage of CBS installation where it failed. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the update deployment provider. +- **DriverPingBack** Contains information about the previous driver and system state. +- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers if a recovery is required. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed. +- **EventType** Possible values are Child, Bundle, or Driver. +- **ExtendedErrorCode** The extended error code. +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode is not specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **HandlerType** Indicates what kind of content is being installed (for example, app, driver, Windows update). +- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **InstallProps** A bitmask for future flags associated with the install operation. No value is currently reported in this field. Expected value for this field is 0. +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process. +- **IsFirmware** Indicates whether this update is a firmware update. +- **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. +- **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. +- **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. +- **MsiAction** The stage of MSI installation where it failed. +- **MsiProductCode** The unique identifier of the MSI installer. +- **PackageFullName** The package name of the content being installed. +- **ProcessName** The process name of the caller who initiated API calls, in the event that CallerApplicationName was not provided. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **RepeatFailCount** Indicates whether this specific piece of content has previously failed. +- **RevisionNumber** The revision number of this specific piece of content. +- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.). +- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult). +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **TransactionCode** The ID that represents a given MSI installation. +- **UpdateId** Unique update ID. +- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional. +- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. + + +### SoftwareUpdateClientTelemetry.Revert + +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **BundleId** Identifier associated with the specific content bundle. Should not be all zeros if the BundleId was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle has previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. +- **ClassificationId** Classification identifier of the update content. +- **ClientVersion** Version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. There is no value being reported in this field right now. Expected value for this field is 0. +- **CSIErrorType** Stage of CBS installation that failed. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the update deployment provider. +- **DriverPingBack** Contains information about the previous driver and system state. +- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers if a recovery is required. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.). +- **EventType** Event type (Child, Bundle, Release, or Driver). +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode is not specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** Indicates the build number of the flight. +- **FlightId** The specific ID of the flight the device is getting. +- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.). +- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process. +- **IsFirmware** Indicates whether an update was a firmware update. +- **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. +- **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. +- **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. +- **ProcessName** Process name of the caller who initiated API calls into the software distribution client. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **RelatedCV** The previous correlation vector that was used by the client before swapping with a new one. +- **RepeatFailCount** Indicates whether this specific piece of content has previously failed. +- **RevisionNumber** Identifies the revision number of this specific piece of content. +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **UpdateId** The identifier associated with the specific piece of content. +- **UpdateImportance** Indicates the importance of a driver, and why it received that importance level (0-Unknown, 1-Optional, 2-Important-DNF, 3-Important-Generic, 4-Important-Other, 5-Recommended). +- **UsedSystemVolume** Indicates whether the device's main system storage drive or an alternate storage drive was used. +- **WUDeviceID** Unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.TaskRun + +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. +- **ClientVersion** Version number of the software distribution client. +- **CmdLineArgs** Command line arguments passed in by the caller. +- **EventInstanceID** A globally unique identifier for the event instance. +- **EventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.). +- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc.). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **WUDeviceID** Unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.Uninstall + +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **BundleId** The identifier associated with the specific content bundle. This should not be all zeros if the bundleID was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **CallerApplicationName** Name of the application making the Windows Update request. Used to identify context of request. +- **ClassificationId** Classification identifier of the update content. +- **ClientVersion** Version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. There is no value being reported in this field right now. Expected value for this field is 0. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the Update Deployment Provider. +- **DriverPingBack** Contains information about the previous driver and system state. +- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers when a recovery is required. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of the event (a scan started, succeded, failed, etc.). +- **EventType** Indicates the event type. Possible values are "Child", "Bundle", "Release" or "Driver". +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode is not specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** Indicates the build number of the flight. +- **FlightId** The specific ID of the flight the device is getting. +- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.). +- **HardwareId** If the download was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process. +- **IsFirmware** Indicates whether an update was a firmware update. +- **IsSuccessFailurePostReboot** Indicates whether an initial success was then a failure after a reboot. +- **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. +- **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. +- **ProcessName** Process name of the caller who initiated API calls into the software distribution client. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **RelatedCV** The previous correlation vector that was used by the client before swapping with a new one. +- **RepeatFailCount** Indicates whether this specific piece of content previously failed. +- **RevisionNumber** Identifies the revision number of this specific piece of content. +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **UpdateId** Identifier associated with the specific piece of content. +- **UpdateImportance** Indicates the importance of a driver and why it received that importance level (0-Unknown, 1-Optional, 2-Important-DNF, 3-Important-Generic, 4-Important-Other, 5-Recommended). +- **UsedSystemVolume** Indicates whether the device’s main system storage drive or an alternate storage drive was used. +- **WUDeviceID** Unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.UpdateDetected + +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **NumberOfApplicableUpdates** The number of updates ultimately deemed applicable to the system after the detection process is complete. +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one. +- **ServiceGuid** An ID that represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.). +- **WUDeviceID** The unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity + +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. +- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. +- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed. +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. +- **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed. +- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. +- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce +- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID). +- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable. +- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable. +- **RevisionId** The revision ID for a specific piece of content. +- **RevisionNumber** The revision number for a specific piece of content. +- **ServiceGuid** Identifies the service to which the software distribution client is connected. Example: Windows Update or Microsoft Store +- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate. +- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate. +- **SHA256OfTimestampToken** An encoded string of the timestamp token. +- **SignatureAlgorithm** The hash algorithm for the metadata signature. +- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed. +- **UpdateId** The update ID for a specific piece of content. +- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. + + +## Surface events + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + + +## Update Assistant events + +### Microsoft.Windows.QUALauncher.Applicable + +This event sends basic information when AQUA launches and checks for any self update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **DetectedCondition** Checks if device condition was met for running remediation. +- **FileVersion** Current file version. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **IsHashMismatch** Checks if the hash of the payload matches the one specified in OneSettings. +- **IsSelfUpdateEnabledInOneSettings** Checks if self update is enabled. +- **IsSelfUpdateNeeded** Checks if self update is needed. All the conditions are satisfied. +- **PackageVersion** Current package version. +- **PluginName** Plugin name. +- **Result** Result. +- **SelfUpdatePackageVersion** Version of the updated package installed. +- **SelUpdatePackageVersion** Version of the new package. + + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **dayspendingrebootafterfu** Number of days that have elapsed since the device reached ready to reboot for a Feature Update that is still actively pending reboot. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Provides information on reasons why the update is not applicable to the device. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationFailed + +This event is raised after an executable delivered by Mitigation Service has run and failed. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. Failure data will also be used for root-cause investigation by feature teams, as signal to halt mitigation rollout and, possible follow-up action on specific devices still impacted by the problem because the mitigation failed (i.e. reoffer it to impacted devices). The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **atleastOneMitigationSucceeded** Bool flag indicating if at least one mitigation succeeded. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **countDownloadedPayload** Count instances of payload downloaded. +- **description** Description of failure. +- **devicePreference** Recommended Troubleshooting Setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionHR** HR code of the execution of the mitigation. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, eg when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **exitCode** Exit code of the execution of the mitigation. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Config state of the experiment. +- **hr** HRESULT for error code. +- **isActiveSessionPresent** If an active user session is present on the device. +- **isCriticalMitigationAvailable** If a critical mitigation is available to this device. +- **isFilteringSuccessful** If the filtering operation was successful. +- **isReApply** reApply status for the mitigation. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationRequestWithCompressionFailed** Boolean flag indicating if HTTP request with compression failed for this device. +- **mitigationServiceResultFetched** Boolean flag indicating if mitigation details were fetched from the admin service. +- **mitigationVersion** String indicating version of the mitigation. +- **oneSettingsMetadataParsed** If OneSettings metadata was parsed successfully. +- **oneSettingsSchemaVersion** Schema version used by the OneSettings parser. +- **onlyNoOptMitigationsPresent** Checks if all mitigations were no opt. +- **parsedOneSettingsFile** Indicates if OneSettings parsing was successful. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **subType** Error type. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalNumberOfApplicableMitigations** Total number of applicable mitigations. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationRejected + +This event is raised when a targeted mitigation is rejected by the device based on the device's preference, or if it has already been applied. This enables us to find out why an applicable mitigation was not executed by the device. Data from this event is used to measure the health of mitigations service stack used by engineers to solve in-market problems on internal, insider, and retail devices. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **description** String describing why a mitigation was rejected. +- **mitigationId** GUID identifier for a mitigation. +- **mitigationVersion** Version of the mitigation. +- **SessionId** GUID identifier to link events to a single session/execution of the mitigation service. +- **subType** Integer value describing the reason type of why a mitigation was rejected. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationSucceeded + +This event is raised after an executable delivered by Mitigation Service has successfully run. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **devicePreference** Recommended troubleshooting setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, for example, when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Feature state for the experiment. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationVersion** String indicating version of the mitigation. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved + +This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter that indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** A boolean that is true if the blob notification has valid content. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceSccmManaged** Device is managed by SCCM. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + +## Update events + +### Update360Telemetry.Revert + +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the Revert phase. +- **FlightId** Unique ID for the flight (test instance version). +- **ObjectId** The unique value for each Update Agent mode. +- **RebootRequired** Indicates reboot is required. +- **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. +- **RevertResult** The result code returned for the Revert operation. +- **ScenarioId** The ID of the update scenario. +- **SessionId** The ID of the update attempt. +- **UpdateId** The ID of the update. + + +### Update360Telemetry.UpdateAgentCommit + +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean that indicates whether cancel was requested. +- **ErrorCode** The error code returned for the current install phase. +- **FlightId** Unique ID for each flight. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Outcome of the install phase of the update. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentDownloadRequest + +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean indicating whether a cancel was requested. +- **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. +- **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. +- **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. +- **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. +- **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. +- **DownloadedSizePSFX** Cumulative size (in bytes) of downloaded PSFX content. +- **DownloadRequests** Number of times a download was retried. +- **ErrorCode** The error code returned for the current download request phase. +- **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. +- **FlightId** Unique ID for each flight. +- **InternalFailureResult** Indicates a non-fatal error from a plugin. +- **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). +- **PackageCategoriesSkipped** Indicates package categories that were skipped, if applicable. +- **PackageCountOptional** Number of optional packages requested. +- **PackageCountRequired** Number of required packages requested. +- **PackageCountTotal** Total number of packages needed. +- **PackageCountTotalCanonical** Total number of canonical packages. +- **PackageCountTotalDiff** Total number of diff packages. +- **PackageCountTotalExpress** Total number of express packages. +- **PackageCountTotalPSFX** The total number of PSFX packages. +- **PackageExpressType** Type of express package. +- **PackageSizeCanonical** Size of canonical packages in bytes. +- **PackageSizeDiff** Size of diff packages in bytes. +- **PackageSizeExpress** Size of express packages in bytes. +- **PackageSizePSFX** The size of PSFX packages, in bytes. +- **RangeRequestState** Indicates the range request type used. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Outcome of the download request phase of update. +- **SandboxTaggedForReserves** The sandbox for reserves. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each attempt (same value for initialize, download, install commit phases). +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentExpand + +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean that indicates whether a cancel was requested. +- **CanonicalRequestedOnError** Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE). +- **ElapsedTickCount** Time taken for expand phase. +- **EndFreeSpace** Free space after expand phase. +- **EndSandboxSize** Sandbox size after expand phase. +- **ErrorCode** The error code returned for the current install phase. +- **FlightId** Unique ID for each flight. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **StartFreeSpace** Free space before expand phase. +- **StartSandboxSize** Sandbox size after expand phase. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentInitialize + +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the current install phase. +- **FlightId** Unique ID for each flight. +- **FlightMetadata** Contains the FlightId and the build being flighted. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Outcome of the install phase of the update. +- **ScenarioId** Indicates the update scenario. +- **SessionData** String containing instructions to update agent for processing FODs and DUICs (Null for other scenarios). +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentInstall + +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean to indicate whether a cancel was requested. +- **ErrorCode** The error code returned for the current install phase. +- **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. +- **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). +- **InternalFailureResult** Indicates a non-fatal error from a plugin. +- **ObjectId** Correlation vector value generated from the latest USO scan. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** The result for the current install phase. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentMitigationResult + +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** Indicates whether the mitigation is applicable for the current update. +- **CommandCount** The number of command operations in the mitigation entry. +- **CustomCount** The number of custom operations in the mitigation entry. +- **FileCount** The number of file operations in the mitigation entry. +- **FlightId** Unique identifier for each flight. +- **Index** The mitigation index of this particular mitigation. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **Name** The friendly name of the mitigation. +- **ObjectId** Unique value for each Update Agent mode. +- **OperationIndex** The mitigation operation index (in the event of a failure). +- **OperationName** The friendly name of the mitigation operation (in the event of failure). +- **RegistryCount** The number of registry operations in the mitigation entry. +- **RelatedCV** The correlation vector value generated from the latest USO scan. +- **Result** The HResult of this operation. +- **ScenarioId** The update agent scenario ID. +- **SessionId** Unique value for each update attempt. +- **TimeDiff** The amount of time spent performing the mitigation (in 100-nanosecond increments). +- **UpdateId** Unique ID for each Update. + + +### Update360Telemetry.UpdateAgentMitigationSummary + +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** The count of mitigations that were applicable to the system and scenario. +- **Failed** The count of mitigations that failed. +- **FlightId** Unique identifier for each flight. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **ObjectId** The unique value for each Update Agent mode. +- **RelatedCV** The correlation vector value generated from the latest USO scan. +- **Result** The HResult of this operation. +- **ScenarioId** The update agent scenario ID. +- **SessionId** Unique value for each update attempt. +- **TimeDiff** The amount of time spent performing all mitigations (in 100-nanosecond increments). +- **Total** Total number of mitigations that were available. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentModeStart + +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FlightId** Unique ID for each flight. +- **Mode** Indicates the mode that has started. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. +- **Version** Version of update + + +### Update360Telemetry.UpdateAgentOneSettings + +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Count** The count of applicable OneSettings for the device. +- **FlightId** Unique ID for the flight (test instance version). +- **ObjectId** The unique value for each Update Agent mode. +- **Parameters** The set of name value pair parameters sent to OneSettings to determine if there are any applicable OneSettings. +- **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. +- **Result** The HResult of the event. +- **ScenarioId** The ID of the update scenario. +- **SessionId** The ID of the update attempt. +- **UpdateId** The ID of the update. +- **Values** The values sent back to the device, if applicable. + + +### Update360Telemetry.UpdateAgentPostRebootResult + +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the current post reboot phase. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **ObjectId** Unique value for each Update Agent mode. +- **PostRebootResult** Indicates the Hresult. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. +- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. + + +### Update360Telemetry.UpdateAgentReboot + +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the current reboot. +- **FlightId** Unique ID for the flight (test instance version). +- **IsSuspendable** Indicates whether the update has the ability to be suspended and resumed at the time of reboot. When the machine is rebooted and the update is in middle of Predownload or Install and Setup.exe is running, this field is TRUE, if not its FALSE. +- **ObjectId** The unique value for each Update Agent mode. +- **Reason** Indicates the HResult why the machine could not be suspended. If it is successfully suspended, the result is 0. +- **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. +- **Result** The HResult of the event. +- **ScenarioId** The ID of the update scenario. +- **SessionId** The ID of the update attempt. +- **UpdateId** The ID of the update. +- **UpdateState** Indicates the state of the machine when Suspend is called. For example, Install, Download, Commit. + + +### Update360Telemetry.UpdateAgentSetupBoxLaunch + +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ContainsExpressPackage** Indicates whether the download package is express. +- **FlightId** Unique ID for each flight. +- **FreeSpace** Free space on OS partition. +- **InstallCount** Number of install attempts using the same sandbox. +- **ObjectId** Unique value for each Update Agent mode. +- **Quiet** Indicates whether setup is running in quiet mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **SandboxSize** Size of the sandbox. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **SetupLaunchAttemptCount** Indicates the count of attempts to launch setup for the current Update Agent instance. +- **SetupMode** Mode of setup to be launched. +- **UpdateId** Unique ID for each Update. +- **UserSession** Indicates whether install was invoked by user actions. + + +## Update notification events + +### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat + +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignConfigVersion** Configuration version for the current campaign. +- **CampaignID** Currently campaign that is running on Update Notification Pipeline (UNP). +- **ConfigCatalogVersion** Current catalog version of UNP. +- **ContentVersion** Content version for the current campaign on UNP. +- **CV** Correlation vector. +- **DetectorVersion** Most recently run detector version for the current campaign on UNP. +- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user. +- **PackageVersion** Current UNP package version. + + +## Upgrade events + +### FacilitatorTelemetry.DCATDownload + +This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure. + +The following fields are available: + +- **DownloadSize** Download size of payload. +- **ElapsedTime** Time taken to download payload. +- **MediaFallbackUsed** Used to determine if we used Media CompDBs to figure out package requirements for the upgrade. +- **ResultCode** Result returned by the Facilitator DCAT call. +- **Scenario** Dynamic update scenario (Image DU, or Setup DU). +- **Type** Type of package that was downloaded. +- **UpdateId** The ID of the update that was downloaded. + + +### FacilitatorTelemetry.DUDownload + +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **PackageCategoriesFailed** Lists the categories of packages that failed to download. +- **PackageCategoriesSkipped** Lists the categories of package downloads that were skipped. + + +### FacilitatorTelemetry.InitializeDU + +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DownloadRequestAttributes** The attributes we send to DCAT. +- **ResultCode** The result returned from the initiation of Facilitator with the URL/attributes. +- **Scenario** Dynamic Update scenario (Image DU, or Setup DU). +- **Url** The Delivery Catalog (DCAT) URL we send the request to. +- **Version** Version of Facilitator. + + +### Setup360Telemetry.Downlevel + +This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure. + +The following fields are available: + +- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the downlevel OS. +- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** More detailed information about phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360 (for example, Predownload, Install, Finalize, Rollback). +- **Setup360Result** The result of Setup360 (HRESULT used to diagnose errors). +- **Setup360Scenario** The Setup360 flow type (for example, Boot, Media, Update, MCT). +- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). +- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** An ID that uniquely identifies a group of events. +- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId. + + +### Setup360Telemetry.Finalize + +This event sends data indicating that the device has started the phase of finalizing the upgrade, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** More detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. + + +### Setup360Telemetry.OsUninstall + +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase or action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** Windows Update client ID. + + +### Setup360Telemetry.PostRebootInstall + +This event sends data indicating that the device has invoked the post reboot install phase of the upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **TestId** A string to uniquely identify a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId. + + +### Setup360Telemetry.PreDownloadQuiet + +This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date. + +The following fields are available: + +- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId. + + +### Setup360Telemetry.PreDownloadUX + +This event sends data regarding OS Updates and Upgrades from Windows 7.X, Windows 8.X, Windows 10 and RS, to help keep Windows up-to-date and secure. Specifically, it indicates the outcome of the PredownloadUX portion of the update process. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **HostOSBuildNumber** The build number of the previous operating system. +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system). +- **InstanceId** Unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). +- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** Windows Update client ID. + + +### Setup360Telemetry.PreInstallQuiet + +This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT). +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** A string to uniquely identify a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. + + +### Setup360Telemetry.PreInstallUX + +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10, to help keep Windows up-to-date. Specifically, it indicates the outcome of the PreinstallUX portion of the update process. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** A string to uniquely identify a group of events. +- **WuId** Windows Update client ID. + + +### Setup360Telemetry.Setup360 + +This event sends data about OS deployment scenarios, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** Retrieves the upgrade ID. In the Windows Update scenario, this will be the Windows Update client ID. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FieldName** Retrieves the data point. +- **FlightData** Specifies a unique identifier for each group of Windows Insider builds. +- **InstanceId** Retrieves a unique identifier for each instance of a setup session. +- **ReportId** Retrieves the report ID. +- **ScenarioId** Retrieves the deployment scenario. +- **Value** Retrieves the value associated with the corresponding FieldName. + + +### Setup360Telemetry.Setup360DynamicUpdate + +This event helps determine whether the device received supplemental content during an operating system upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **FlightData** Specifies a unique identifier for each group of Windows Insider builds. +- **InstanceId** Retrieves a unique identifier for each instance of a setup session. +- **Operation** Facilitator's last known operation (scan, download, etc.). +- **ReportId** ID for tying together events stream side. +- **ResultCode** Result returned for the entire setup operation. +- **Scenario** Dynamic Update scenario (Image DU, or Setup DU). +- **ScenarioId** Identifies the update scenario. +- **TargetBranch** Branch of the target OS. +- **TargetBuild** Build of the target OS. + + +### Setup360Telemetry.Setup360MitigationResult + +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** TRUE if the mitigation is applicable for the current update. +- **ClientId** In the Windows Update scenario, this is the client ID passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **CommandCount** The number of command operations in the mitigation entry. +- **CustomCount** The number of custom operations in the mitigation entry. +- **FileCount** The number of file operations in the mitigation entry. +- **FlightData** The unique identifier for each flight (test release). +- **Index** The mitigation index of this particular mitigation. +- **InstanceId** The GUID (Globally Unique ID) that identifies each instance of SetupHost.EXE. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **Name** The friendly (descriptive) name of the mitigation. +- **OperationIndex** The mitigation operation index (in the event of a failure). +- **OperationName** The friendly (descriptive) name of the mitigation operation (in the event of failure). +- **RegistryCount** The number of registry operations in the mitigation entry. +- **ReportId** In the Windows Update scenario, the Update ID that is passed to Setup. In media setup, this is the GUID for the INSTALL.WIM. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **TimeDiff** The amount of time spent performing the mitigation (in 100-nanosecond increments). + + +### Setup360Telemetry.Setup360MitigationSummary + +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** The count of mitigations that were applicable to the system and scenario. +- **ClientId** The Windows Update client ID passed to Setup. +- **Failed** The count of mitigations that failed. +- **FlightData** The unique identifier for each flight (test release). +- **InstanceId** The GUID (Globally Unique ID) that identifies each instance of SetupHost.EXE. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **ReportId** In the Windows Update scenario, the Update ID that is passed to Setup. In media setup, this is the GUID for the INSTALL.WIM. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **TimeDiff** The amount of time spent performing the mitigation (in 100-nanosecond increments). +- **Total** The total number of mitigations that were available. + + +### Setup360Telemetry.Setup360OneSettings + +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** The Windows Update client ID passed to Setup. +- **Count** The count of applicable OneSettings for the device. +- **FlightData** The ID for the flight (test instance version). +- **InstanceId** The GUID (Globally-Unique ID) that identifies each instance of setuphost.exe. +- **Parameters** The set of name value pair parameters sent to OneSettings to determine if there are any applicable OneSettings. +- **ReportId** The Update ID passed to Setup. +- **Result** The HResult of the event error. +- **ScenarioId** The update scenario ID. +- **Values** Values sent back to the device, if applicable. + + +### Setup360Telemetry.UnexpectedEvent + +This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** A string to uniquely identify a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. + + +## Windows Admin Center events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. +- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. +- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installationType** Identifies if the gateway was installed as a VM extension. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **otherProperties** This is an empty string, but may be used for another purpose in the future. +- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. +- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + +## Windows as a Service diagnostic events + +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + +### Microsoft.Windows.WaaSMedic.SummaryEvent + +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **callerApplication** The name of the calling application. +- **capsuleCount** The number of Sediment Pack capsules. +- **capsuleFailureCount** The number of capsule failures. +- **detectionSummary** Result of each applicable detection that was run. +- **featureAssessmentImpact** WaaS Assessment impact for feature updates. +- **hrEngineBlockReason** Indicates the reason for stopping WaaSMedic. +- **hrEngineResult** Error code from the engine operation. +- **hrLastSandboxError** The last error sent by the WaaSMedic sandbox. +- **initSummary** Summary data of the initialization method. +- **isInteractiveMode** The user started a run of WaaSMedic. +- **isManaged** Device is managed for updates. +- **isWUConnected** Device is connected to Windows Update. +- **noMoreActions** No more applicable diagnostics. +- **pluginFailureCount** The number of plugins that have failed. +- **pluginsCount** The number of plugins. +- **qualityAssessmentImpact** WaaS Assessment impact for quality updates. +- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on. +- **usingBackupFeatureAssessment** Relying on backup feature assessment. +- **usingBackupQualityAssessment** Relying on backup quality assessment. +- **usingCachedFeatureAssessment** WaaS Medic run did not get OS build age from the network on the previous run. +- **usingCachedQualityAssessment** WaaS Medic run did not get OS revision age from the network on the previous run. +- **versionString** Version of the WaaSMedic engine. +- **waasMedicRunMode** Indicates whether this was a background regular run of the medic or whether it was triggered by a user launching Windows Update Troubleshooter. + + +## Windows Defender events + +### Microsoft.Windows.Sense.Client.PerformanceScript.OnboardingScript + +This event is triggered whenever Microsoft Defender for Endpoint onboarding script is run. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **Message** Error message. + + +## Windows Error Reporting events + +### Microsoft.Windows.WERVertical.OSCrash + +This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. + +The following fields are available: + +- **BootId** Uint32 identifying the boot number for this device. +- **BugCheckCode** Uint64 "bugcheck code" that identifies a proximate cause of the bug check. +- **BugCheckParameter1** Uint64 parameter providing additional information. +- **BugCheckParameter2** Uint64 parameter providing additional information. +- **BugCheckParameter3** Uint64 parameter providing additional information. +- **BugCheckParameter4** Uint64 parameter providing additional information. +- **DumpFileAttributes** Codes that identify the type of data contained in the dump file +- **DumpFileSize** Size of the dump file +- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise +- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). + + +## Windows Hardware Error Architecture events + +### WheaProvider.WheaDriverErrorExternal + +This event is sent when a common platform hardware error is recorded by an external WHEA error source driver. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **creatorId** A GUID that identifies the entity that created the error record. +- **errorFlags** Flags set on the error record. +- **notifyType** A GUID that identifies the notification mechanism by which an error condition is reported to the operating system. +- **partitionId** A GUID that identifies the partition on which the hardware error occurred. +- **platformId** A GUID that identifies the platform on which the hardware error occurred. +- **record** A binary blob containing the full error record. Due to the nature of common platform error records we have no way of fully parsing this blob for any given record. +- **recordId** The identifier of the error record. This identifier is unique only on the system that created the error record. +- **sectionFlags** The flags for each section recorded in the error record. +- **sectionTypes** A GUID that represents the type of sections contained in the error record. +- **severityCount** The severity of each individual section. +- **timeStamp** Error time stamp as recorded in the error record. + + +### WheaProvider.WheaDriverErrorExternalNonCritical + +This event is sent when a common platform hardware error is recorded by an external WHEA error source driver. These records are for events that can happen at high rates. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **creatorId** A GUID that identifies the entity that created the error record. +- **errorFlags** Flags set on the error record. +- **notifyType** A GUID that identifies the notification mechanism by which an error condition is reported to the operating system. +- **partitionId** A GUID that identifies the partition on which the hardware error occurred. +- **platformId** A GUID that identifies the platform on which the hardware error occurred. +- **record** A binary blob containing the full error record. Due to the nature of common platform error records we have no way of fully parsing this blob for any given record. +- **recordId** The identifier of the error record. This identifier is unique only on the system that created the error record. +- **sectionFlags** The flags for each section recorded in the error record. +- **sectionTypes** A GUID that represents the type of sections contained in the error record. +- **severityCount** The severity of each individual section. +- **timeStamp** Error time stamp as recorded in the error record. + + +### WheaProvider.WheaDriverExternalLogginLimitReached + +This event indicates that WHEA has reached the logging limit for critical events from external drivers. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **timeStamp** Time at which the logging limit was reached. + + +### WheaProvider.WheaErrorRecord + +This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **creatorId** The unique identifier for the entity that created the error record. +- **errorFlags** Any flags set on the error record. +- **notifyType** The unique identifier for the notification mechanism which reported the error to the operating system. +- **partitionId** The unique identifier for the partition on which the hardware error occurred. +- **platformId** The unique identifier for the platform on which the hardware error occurred. +- **record** A collection of binary data containing the full error record. +- **recordId** The identifier of the error record. +- **sectionFlags** The flags for each section recorded in the error record. +- **sectionTypes** The unique identifier that represents the type of sections contained in the error record. +- **severityCount** The severity of each individual section. +- **timeStamp** The error time stamp as recorded in the error record. + + +## Windows Store events + +### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation + +This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** Number of retry attempts before it was canceled. +- **BundleId** The Item Bundle ID. +- **CategoryId** The Item Category ID. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed before this operation. +- **IsBundle** Is this a bundle? +- **IsInteractive** Was this requested by a user? +- **IsMandatory** Was this a mandatory update? +- **IsRemediation** Was this a remediation install? +- **IsRestore** Is this automatically restoring a previously acquired product? +- **IsUpdate** Flag indicating if this is an update. +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The product family name of the product being installed. +- **ProductId** The identity of the package or packages being installed. +- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled. +- **UserAttemptNumber** The total number of user attempts at installation before it was canceled. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense + +This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. +- **AttemptNumber** The total number of attempts to acquire this product. +- **BundleId** The bundle ID +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** HResult code to show the result of the operation (success/failure). +- **IsBundle** Is this a bundle? +- **IsInteractive** Did the user initiate the installation? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this happening after a device restore? +- **IsUpdate** Is this an update? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). +- **PFN** Product Family Name of the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The number of attempts by the system to acquire this product. +- **UserAttemptNumber** The number of attempts by the user to acquire this product +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndDownload + +This event is sent after an app is downloaded to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. +- **AttemptNumber** Number of retry attempts before it was canceled. +- **BundleId** The identity of the Windows Insider build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **DownloadSize** The total size of the download. +- **ExtendedHResult** Any extended HResult error codes. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this initiated by the user? +- **IsMandatory** Is this a mandatory installation? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this a restore of a previously acquired product? +- **IsUpdate** Is this an update? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). +- **PFN** The Product Family Name of the app being download. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The number of attempts by the system to download. +- **UserAttemptNumber** The number of attempts by the user to download. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate + +This event is sent when an app update requires an updated Framework package and the process starts to download it. It is used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed before this operation. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndInstall + +This event is sent after a product has been installed to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **ExtendedHResult** The extended HResult error code. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this an interactive installation? +- **IsMandatory** Is this a mandatory installation? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this automatically restoring a previously acquired product? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** Product Family Name of the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates + +This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed. +- **IsApplicability** Is this request to only check if there are any applicable packages to install? +- **IsInteractive** Is this user requested? +- **IsOnline** Is the request doing an online check? + + +### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages + +This event is sent after searching for update packages to install. It is used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The name of the package or packages requested for install. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData + +This event is sent after restoring user data (if any) that needs to be restored following a product install. It is used to keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The name of the package or packages requested for install. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of system attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete + +This event is sent at the end of an app install or update to help keep Windows up-to-date and secure. + +The following fields are available: + +- **CatalogId** The name of the product catalog from which this app was chosen. +- **FailedRetry** Indicates whether the installation or update retry was successful. +- **HResult** The HResult code of the operation. +- **PFN** The Package Family Name of the app that is being installed or updated. +- **ProductId** The product ID of the app that is being updated or installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate + +This event is sent at the beginning of an app install or update to help keep Windows up-to-date and secure. + +The following fields are available: + +- **CatalogId** The name of the product catalog from which this app was chosen. +- **FulfillmentPluginId** The ID of the plugin needed to install the package type of the product. +- **PFN** The Package Family Name of the app that is being installed or updated. +- **PluginTelemetryData** Diagnostic information specific to the package-type plug-in. +- **ProductId** The product ID of the app that is being updated or installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest + +This event is sent when a product install or update is initiated, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **BundleId** The identity of the build associated with this product. +- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SkuId** Specific edition ID being installed. +- **VolumePath** The disk path of the installation. + + +### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation + +This event is sent when a product install or update is paused (either by a user or the system), to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The Product Full Name. +- **PreviousHResult** The result code of the last action performed before this operation. +- **PreviousInstallState** Previous state before the installation or update was paused. +- **ProductId** The Store Product ID for the product being installed. +- **RelatedCV** Correlation Vector of a previous performed action on this product. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation + +This event is sent when a product install or update is resumed (either by a user or the system), to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed before this operation. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **IsUserRetry** Did the user initiate the retry? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The name of the package or packages requested for install. +- **PreviousHResult** The previous HResult error code. +- **PreviousInstallState** Previous state before the installation was paused. +- **ProductId** The Store Product ID for the product being installed. +- **RelatedCV** Correlation Vector for the original install before it was resumed. +- **ResumeClientId** The ID of the app that initiated the resume operation. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest + +This event is sent when a product install or update is resumed by a user or on installation retries, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ProductId** The Store Product ID for the product being installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest + +This event is sent when searching for update packages to install, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **CatalogId** The Store Catalog ID for the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SkuId** Specfic edition of the app being updated. + + +### Microsoft.Windows.StoreAgent.Telemetry.StateTransition + +Products in the process of being fulfilled (installed or updated) are maintained in a list. This event is sent any time there is a change in a product's fulfillment status (pending, working, paused, cancelled, or complete), to help keep Windows up to date and secure. + +The following fields are available: + +- **CatalogId** The ID for the product being installed if the product is from a private catalog, such as the Enterprise catalog. +- **FulfillmentPluginId** The ID of the plugin needed to install the package type of the product. +- **HResult** The resulting HResult error/success code of this operation. +- **NewState** The current fulfillment state of this product. +- **PFN** The Package Family Name of the app that is being installed or updated. +- **PluginLastStage** The most recent product fulfillment step that the plug-in has reported (different than its state). +- **PluginTelemetryData** Diagnostic information specific to the package-type plug-in. +- **Prevstate** The previous fulfillment state of this product. +- **ProductId** Product ID of the app that is being updated or installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest + +This event occurs when an update is requested for an app, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **PFamN** The name of the app that is requested for update. + + +## Windows Update CSP events + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed + +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** This is the device info. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable + +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Represents the device info. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted + +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Device in the semi-annual channel. +- **wUfBConnected** Result of WUfB connection check. + + +## Windows Update Delivery Optimization events + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled + +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Is the download being done in the background? +- **bytesFromCacheServer** Bytes received from a cache host. +- **bytesFromCDN** The number of bytes received from a CDN source. +- **bytesFromGroupPeers** The number of bytes received from a peer in the same group. +- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group. +- **bytesFromLinkLocalPeers** The number of bytes received from local peers. +- **bytesFromLocalCache** Bytes copied over from local (on disk) cache. +- **bytesFromPeers** The number of bytes received from a peer in the same LAN. +- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event. +- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered. +- **cdnIp** The IP Address of the source CDN (Content Delivery Network). +- **cdnUrl** The URL of the source CDN (Content Delivery Network). +- **dataSourcesTotal** Bytes received per source type, accumulated for the whole session. +- **errorCode** The error code that was returned. +- **experimentId** When running a test, this is used to correlate events that are part of the same test. +- **fileID** The ID of the file being downloaded. +- **isVpn** Is the device connected to a Virtual Private Network? +- **jobID** Identifier for the Windows Update job. +- **predefinedCallerName** The name of the API Caller. +- **reasonCode** Reason the action or event occurred. +- **routeToCacheServer** The cache server setting, source, and value. +- **sessionID** The ID of the file download session. +- **updateID** The ID of the update being downloaded. + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted + +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Is the download a background download? +- **bytesFromCacheServer** Bytes received from a cache host. +- **bytesFromCDN** The number of bytes received from a CDN source. +- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group. +- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group. +- **bytesFromLinkLocalPeers** The number of bytes received from local peers. +- **bytesFromLocalCache** Bytes copied over from local (on disk) cache. +- **bytesFromPeers** The number of bytes received from a peer in the same LAN. +- **bytesRequested** The total number of bytes requested for download. +- **cacheServerConnectionCount** Number of connections made to cache hosts. +- **cdnConnectionCount** The total number of connections made to the CDN. +- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event. +- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered. +- **cdnIp** The IP address of the source CDN. +- **cdnUrl** Url of the source Content Distribution Network (CDN). +- **congestionPrevention** Indicates a download may have been suspended to prevent network congestion. +- **dataSourcesTotal** Bytes received per source type, accumulated for the whole session. +- **downlinkBps** The maximum measured available download bandwidth (in bytes per second). +- **downlinkUsageBps** The download speed (in bytes per second). +- **downloadMode** The download mode used for this file download session. +- **downloadModeReason** Reason for the download. +- **downloadModeSrc** Source of the DownloadMode setting. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **expiresAt** The time when the content will expire from the Delivery Optimization Cache. +- **fileID** The ID of the file being downloaded. +- **fileSize** The size of the file being downloaded. +- **groupConnectionCount** The total number of connections made to peers in the same group. +- **groupID** A GUID representing a custom group of devices. +- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group. +- **isEncrypted** TRUE if the file is encrypted and will be decrypted after download. +- **isThrottled** Event Rate throttled (event represents aggregated data). +- **isVpn** Is the device connected to a Virtual Private Network? +- **jobID** Identifier for the Windows Update job. +- **lanConnectionCount** The total number of connections made to peers in the same LAN. +- **linkLocalConnectionCount** The number of connections made to peers in the same Link-local network. +- **numPeers** The total number of peers used for this download. +- **numPeersLocal** The total number of local peers used for this download. +- **predefinedCallerName** The name of the API Caller. +- **restrictedUpload** Is the upload restricted? +- **routeToCacheServer** The cache server setting, source, and value. +- **sessionID** The ID of the download session. +- **totalTimeMs** Duration of the download (in seconds). +- **updateID** The ID of the update being downloaded. +- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second). +- **uplinkUsageBps** The upload speed (in bytes per second). + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadHungItself + +This event sends data describing a download that has become unexpectedly stuck to enable Delivery Optimization to understand and address problems regarding downloads. + +The following fields are available: + +- **background** Indicates if the download is happening in the background. +- **cdnIp** Indicates the IP Address of the source CDN. +- **cdnUrl** Represents the URL of the source CDN. +- **errorCode** Indicates the error code returned. +- **experimentId** Used to correlate client/services calls that are part of the same test during A/B testing. +- **fileID** Represents the ID of the file being downloaded. +- **isVpn** Indicates if the machine is connected to a Virtual Private Network. +- **jobID** Identifier for the Windows Update Job. +- **predefinedCallerName** Represents the name of the API Caller. +- **progressPercent** Indicates the percent of download completed. +- **sessionID** Indicates the ID for the file download session. +- **updateID** Represents the ID of the update being downloaded. + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused + +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Is the download a background download? +- **cdnUrl** The URL of the source CDN (Content Delivery Network). +- **errorCode** The error code that was returned. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **fileID** The ID of the file being paused. +- **isVpn** Is the device connected to a Virtual Private Network? +- **jobID** Identifier for the Windows Update job. +- **predefinedCallerName** The name of the API Caller object. +- **reasonCode** The reason for pausing the download. +- **routeToCacheServer** The cache server setting, source, and value. +- **sessionID** The ID of the download session. +- **updateID** The ID of the update being paused. + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted + +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Indicates whether the download is happening in the background. +- **bytesRequested** Number of bytes requested for the download. +- **cdnUrl** The URL of the source Content Distribution Network (CDN). +- **costFlags** A set of flags representing network cost. +- **deviceProfile** Identifies the usage or form factor (such as Desktop, Xbox, or VM). +- **diceRoll** Random number used for determining if a client will use peering. +- **doClientVersion** The version of the Delivery Optimization client. +- **downloadMode** The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100). +- **downloadModeReason** Reason for the download. +- **downloadModeSrc** Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9). +- **errorCode** The error code that was returned. +- **experimentId** ID used to correlate client/services calls that are part of the same test during A/B testing. +- **fileID** The ID of the file being downloaded. +- **filePath** The path to where the downloaded file will be written. +- **fileSize** Total file size of the file that was downloaded. +- **fileSizeCaller** Value for total file size provided by our caller. +- **groupID** ID for the group. +- **isEncrypted** Indicates whether the download is encrypted. +- **isThrottled** Indicates the Event Rate was throttled (event represent aggregated data). +- **isVpn** Indicates whether the device is connected to a Virtual Private Network. +- **jobID** The ID of the Windows Update job. +- **peerID** The ID for this delivery optimization client. +- **predefinedCallerName** Name of the API caller. +- **routeToCacheServer** Cache server setting, source, and value. +- **sessionID** The ID for the file download session. +- **setConfigs** A JSON representation of the configurations that have been set, and their sources. +- **updateID** The ID of the update being downloaded. + + +### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication + +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cdnHeaders** The HTTP headers returned by the CDN. +- **cdnIp** The IP address of the CDN. +- **cdnUrl** The URL of the CDN. +- **errorCode** The error code that was returned. +- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **fileID** The ID of the file being downloaded. +- **httpStatusCode** The HTTP status code returned by the CDN. +- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET +- **peerType** The type of peer (LAN, Group, Internet, CDN, Cache Host, etc.). +- **requestOffset** The byte offset within the file in the sent request. +- **requestSize** The size of the range requested from the CDN. +- **responseSize** The size of the range response received from the CDN. +- **sessionID** The ID of the download session. + + +### Microsoft.OSG.DU.DeliveryOptClient.JobError + +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cdnIp** The IP Address of the source CDN (Content Delivery Network). +- **doErrorCode** Error code returned for delivery optimization. +- **errorCode** The error code returned. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **fileID** The ID of the file being downloaded. +- **jobID** The Windows Update job ID. +- **predefinedCallerName** Name of the API Caller. + + +## Windows Update events + +### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted + +This event sends data collected at the beginning of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date. + +The following fields are available: + +- **MigrationMicrosoftPhases** The number of Microsoft-authored migrators scheduled to be ran by DMF for this upgrade +- **MigrationOEMPhases** The number of OEM-authored migrators scheduled to be ran by DMF for this upgrade +- **MigrationStartTime** The timestamp representing the beginning of the DMF migration +- **WuClientId** The GUID of the Windows Update client invoking DMF + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary + +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activated** Whether the entire device manifest update is considered activated and in use. +- **analysisErrorCount** The number of driver packages that could not be analyzed because errors occurred during analysis. +- **flightId** Unique ID for each flight. +- **missingDriverCount** The number of driver packages delivered by the device manifest that are missing from the system. +- **missingUpdateCount** The number of updates in the device manifest that are missing from the system. +- **objectId** Unique value for each diagnostics session. +- **publishedCount** The number of drivers packages delivered by the device manifest that are published and available to be used on devices. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **scenarioId** Indicates the update scenario. +- **sessionId** Unique value for each update session. +- **summary** A summary string that contains basic information about driver packages that are part of the device manifest and any devices on the system that those driver packages match. +- **summaryAppendError** A Boolean indicating if there was an error appending more information to the summary string. +- **truncatedDeviceCount** The number of devices missing from the summary string because there is not enough room in the string. +- **truncatedDriverCount** The number of driver packages missing from the summary string because there is not enough room in the string. +- **unpublishedCount** How many drivers packages that were delivered by the device manifest that are still unpublished and unavailable to be used on devices. +- **updateId** The unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest + +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted. +- **errorCode** The error code returned for the current session initialization. +- **flightId** The unique identifier for each flight. +- **objectId** Unique value for each Update Agent mode. +- **packageCountOptional** Number of optional packages requested. +- **packageCountRequired** Number of required packages requested. +- **packageCountTotal** Total number of packages needed. +- **packageCountTotalCanonical** Total number of canonical packages. +- **packageCountTotalDiff** Total number of diff packages. +- **packageCountTotalExpress** Total number of express packages. +- **packageSizeCanonical** Size of canonical packages in bytes. +- **packageSizeDiff** Size of diff packages in bytes. +- **packageSizeExpress** Size of express packages in bytes. +- **rangeRequestState** Represents the state of the download range request. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Result of the download request phase of update. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize + +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code returned for the current session initialization. +- **flightId** The unique identifier for each flight. +- **flightMetadata** Contains the FlightId and the build being flighted. +- **objectId** Unique value for each Update Agent mode. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios). +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall + +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code returned for the current install phase. +- **flightId** The unique identifier for each flight. +- **objectId** The unique identifier for each diagnostics session. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Outcome of the install phase of the update. +- **scenarioId** The unique identifier for the update scenario. +- **sessionId** The unique identifier for each update session. +- **updateId** The unique identifier for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart + +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightId** The unique identifier for each flight. +- **mode** The mode that is starting. +- **objectId** The unique value for each diagnostics session. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique identifier for each update. + + +### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed + +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AcceptAutoModeLimit** The maximum number of days for a device to automatically enter Auto Reboot mode. +- **AutoToAutoFailedLimit** The maximum number of days for Auto Reboot mode to fail before the RebootFailed dialog box is shown. +- **DaysSinceRebootRequired** Number of days since restart was required. +- **DeviceLocalTime** The local time on the device sending the event. +- **EngagedModeLimit** The number of days to switch between DTE dialog boxes. +- **EnterAutoModeLimit** The maximum number of days for a device to enter Auto Reboot mode. +- **ETag** OneSettings versioning value. +- **IsForcedEnabled** Indicates whether Forced Reboot mode is enabled for this device. +- **IsUltimateForcedEnabled** Indicates whether Ultimate Forced Reboot mode is enabled for this device. +- **NotificationUxState** Indicates which dialog box is shown. +- **NotificationUxStateString** Indicates which dialog box is shown. +- **RebootUxState** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced). +- **RebootUxStateString** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced). +- **RebootVersion** Version of DTE. +- **SkipToAutoModeLimit** The minimum length of time to pass in restart pending before a device can be put into auto mode. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UtcTime** The time the dialog box notification will be displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog + +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** The local time on the device sending the event. +- **EnterpriseAttributionValue** Indicates whether the Enterprise attribution is on in this dialog box. +- **ETag** OneSettings versioning value. +- **ExitCode** Indicates how users exited the dialog box. +- **RebootVersion** Version of DTE. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UserResponseString** The option that user chose on this dialog box. +- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog + +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** The local time of the device sending the event. +- **EnterpriseAttributionValue** Indicates whether the Enterprise attribution is on in this dialog box. +- **ETag** OneSettings versioning value. +- **ExitCode** Indicates how users exited the dialog box. +- **RebootVersion** Version of DTE. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UserResponseString** The option that the user chose in this dialog box. +- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog + +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** Time the dialog box was shown on the local device. +- **EnterpriseAttributionValue** Indicates whether the Enterprise attribution is on in this dialog box. +- **ETag** OneSettings versioning value. +- **ExitCode** Indicates how users exited the dialog box. +- **RebootVersion** Version of DTE. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UserResponseString** The option that user chose in this dialog box. +- **UtcTime** The time that dialog box was displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog + +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** The time at which the reboot reminder dialog was shown (based on the local device time settings). +- **EnterpriseAttributionValue** Indicates whether Enterprise attribution is on for this dialog. +- **ETag** The OneSettings versioning value. +- **ExitCode** Indicates how users exited the reboot reminder dialog box. +- **RebootVersion** The version of the DTE (Direct-to-Engaged). +- **UpdateId** The ID of the update that is waiting for reboot to finish installation. +- **UpdateRevision** The revision of the update that is waiting for reboot to finish installation. +- **UserResponseString** The option chosen by the user on the reboot dialog box. +- **UtcTime** The time at which the reboot reminder dialog was shown (in UTC). + + +### Microsoft.Windows.Update.NotificationUx.RebootScheduled + +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. + +The following fields are available: + +- **activeHoursApplicable** Indicates whether an Active Hours policy is present on the device. +- **IsEnhancedEngagedReboot** Indicates whether this is an Enhanced Engaged reboot. +- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action. +- **rebootOutsideOfActiveHours** Indicates whether a restart is scheduled outside of active hours. +- **rebootScheduledByUser** Indicates whether the restart was scheduled by user (if not, it was scheduled automatically). +- **rebootState** The current state of the restart. +- **rebootUsingSmartScheduler** Indicates whether the reboot is scheduled by smart scheduler. +- **revisionNumber** Revision number of the update that is getting installed with this restart. +- **scheduledRebootTime** Time of the scheduled restart. +- **scheduledRebootTimeInUTC** Time of the scheduled restart in Coordinated Universal Time. +- **updateId** ID of the update that is getting installed with this restart. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Update.Orchestrator.DeferRestart + +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **displayNeededReason** List of reasons for needing display. +- **eventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.). +- **filteredDeferReason** Applicable filtered reasons why reboot was postponed (such as user active, or low battery). +- **gameModeReason** Name of the executable that caused the game mode state check to start. +- **ignoredReason** List of reasons that were intentionally ignored. +- **IgnoreReasonsForRestart** List of reasons why restart was deferred. +- **revisionNumber** Update ID revision number. +- **systemNeededReason** List of reasons why system is needed. +- **updateId** Update ID. +- **updateScenarioType** Update session type. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.DetectionActivity + +This event returns data about detected updates, as well as the types of update (optional or recommended). This data helps keep Windows up to date. + +The following fields are available: + +- **applicableUpdateIdList** The list of update identifiers. +- **applicableUpdateList** The list of available updates. +- **durationInSeconds** The amount of time (in seconds) it took for the event to run. +- **expeditedMode** Indicates whether Expedited Mode is on. +- **scanTriggerSource** Indicates whether the scan is Interactive or Background. +- **scenario** The result code of the event. +- **scenarioReason** The reason for the result code (scenario). +- **seekerUpdateIdList** The list of “seeker” update identifiers. +- **seekerUpdateList** The list of “seeker” updates. +- **services** The list of services that were called during update. +- **wilActivity** The activity results. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Update.Orchestrator.DisplayNeeded + +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **displayNeededReason** Reason the display is needed. +- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours. +- **revisionNumber** Revision number of the update. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated. +- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue + + +### Microsoft.Windows.Update.Orchestrator.Download + +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. + +The following fields are available: + +- **deferReason** Reason for download not completing. +- **errorCode** An error code represented as a hexadecimal value. +- **eventScenario** End-to-end update session ID. +- **flightID** The specific ID of the Windows Insider build the device is getting. +- **interactive** Indicates whether the session is user initiated. +- **revisionNumber** Update revision number. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask + +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The Windows Update error code. +- **wuDeviceid** The Windows Update device ID. + + +### Microsoft.Windows.Update.Orchestrator.FlightInapplicable + +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** Time when this event was generated. +- **flightID** The specific ID of the Windows Insider build. +- **inapplicableReason** The reason why the update is inapplicable. +- **revisionNumber** Update revision number. +- **updateId** Unique Windows Update ID. +- **updateScenarioType** Update session type. +- **UpdateStatus** Last status of update. +- **UUPFallBackConfigured** Indicates whether UUP fallback is configured. +- **wuDeviceid** Unique Device ID. + + +### Microsoft.Windows.Update.Orchestrator.InitiatingReboot + +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** Time of the event. +- **flightID** Unique update ID +- **interactive** Indicates whether the reboot initiation stage of the update process was entered as a result of user action. +- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours. +- **revisionNumber** Revision number of the update. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.Install + +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** Current battery capacity in mWh or percentage left. +- **deferReason** Reason for install not completing. +- **errorCode** The error code reppresented by a hexadecimal value. +- **eventScenario** End-to-end update session ID. +- **flightID** The ID of the Windows Insider build the device is getting. +- **IgnoreReasonsForRestart** The reason(s) a Postpone Restart command was ignored. +- **interactive** Identifies if session is user initiated. +- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours. +- **revisionNumber** Update revision number. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.RebootFailed + +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** Current battery capacity in mWh or percentage left. +- **deferReason** Reason for install not completing. +- **EventPublishedTime** The time that the reboot failure occurred. +- **flightID** Unique update ID. +- **rebootOutsideOfActiveHours** Indicates whether a reboot was scheduled outside of active hours. +- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code. +- **revisionNumber** Update revision number. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.RefreshSettings + +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. + + + +### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask + +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. + +The following fields are available: + +- **RebootTaskNextTimeUTC** The time when the reboot task was rescheduled for. +- **RebootTaskRestoredTime** Time at which this reboot task was restored. +- **wuDeviceid** Device ID for the device on which the reboot is restored. + + +### Microsoft.Windows.Update.Orchestrator.ScanTriggered + +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **interactive** Indicates whether the scan is interactive. +- **isDTUEnabled** Indicates whether DTU (internal abbreviation for Direct Feature Update) channel is enabled on the client system. +- **isScanPastSla** Indicates whether the SLA has elapsed for scanning. +- **isScanPastTriggerSla** Indicates whether the SLA has elapsed for triggering a scan. +- **minutesOverScanSla** Indicates how many minutes the scan exceeded the scan SLA. +- **minutesOverScanTriggerSla** Indicates how many minutes the scan exceeded the scan trigger SLA. +- **scanTriggerSource** Indicates what caused the scan. +- **updateScenarioType** The update session type. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.StickUpdate + +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateId** Identifier associated with the specific piece of content. +- **wuDeviceid** Unique device ID controlled by the software distribution client. + + +### Microsoft.Windows.Update.Orchestrator.SystemNeeded + +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. + +The following fields are available: + +- **eventScenario** End-to-end update session ID. +- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours. +- **revisionNumber** Update revision number. +- **systemNeededReason** List of apps or tasks that are preventing the system from restarting. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature + +This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updaterCmdLine** The callback executable for the updater. +- **updaterId** The ID of the updater. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd + +This event indicates a critical error with the callback binary requested by the updater. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updaterCmdLine** The command line requested by the updater. +- **updaterId** The ID of the updater that requested the work. +- **wuDeviceid** WU device ID. + + +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkNonSystem + +This event ensures that only callers with system or admin privileges are allowed to schedule work through Windows Update Universal Orchestrator. The data collected with this event is used to help keep Windows product and service secure. + +The following fields are available: + +- **updaterCmdLine** Updater Command Line. +- **updaterId** Updater ID. +- **wuDeviceid** Device ID. + + +### Microsoft.Windows.Update.Orchestrator.UnstickUpdate + +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateId** Identifier associated with the specific piece of content. +- **wuDeviceid** Unique device ID controlled by the software distribution client. + + +### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState + +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AcceptAutoModeLimit** The maximum number of days for a device to automatically enter Auto Reboot mode. +- **AutoToAutoFailedLimit** The maximum number of days for Auto Reboot mode to fail before a Reboot Failed dialog will be shown. +- **DeviceLocalTime** The date and time (based on the device date/time settings) the reboot mode changed. +- **EngagedModeLimit** The number of days to switch between DTE (Direct-to-Engaged) dialogs. +- **EnterAutoModeLimit** The maximum number of days a device can enter Auto Reboot mode. +- **ETag** The Entity Tag that represents the OneSettings version. +- **IsForcedEnabled** Identifies whether Forced Reboot mode is enabled for the device. +- **IsUltimateForcedEnabled** Identifies whether Ultimate Forced Reboot mode is enabled for the device. +- **OldestUpdateLocalTime** The date and time (based on the device date/time settings) this update’s reboot began pending. +- **RebootUxState** Identifies the reboot state: Engaged, Auto, Forced, UltimateForced. +- **RebootVersion** The version of the DTE (Direct-to-Engaged). +- **SkipToAutoModeLimit** The maximum number of days to switch to start while in Auto Reboot mode. +- **UpdateId** The ID of the update that is waiting for reboot to finish installation. +- **UpdateRevision** The revision of the update that is waiting for reboot to finish installation. + + +### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded + +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **UtcTime** The Coordinated Universal Time that the restart was no longer needed. + + +### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled + +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursApplicable** Indicates whether Active Hours applies on this device. +- **IsEnhancedEngagedReboot** Indicates whether Enhanced reboot was enabled. +- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action. +- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise. +- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically. +- **rebootState** Current state of the reboot. +- **rebootUsingSmartScheduler** Indicates that the reboot is scheduled by SmartScheduler. +- **revisionNumber** Revision number of the OS. +- **scheduledRebootTime** Time scheduled for the reboot. +- **scheduledRebootTimeInUTC** Time scheduled for the reboot, in UTC. +- **updateId** Identifies which update is being scheduled. +- **wuDeviceid** The unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled + +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursApplicable** Is the restart respecting Active Hours? +- **IsEnhancedEngagedReboot** TRUE if the reboot path is Enhanced Engaged. Otherwise, FALSE. +- **rebootArgument** The arguments that are passed to the OS for the restarted. +- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours? +- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device. +- **rebootState** The state of the restart. +- **rebootUsingSmartScheduler** TRUE if the reboot should be performed by the Smart Scheduler. Otherwise, FALSE. +- **revisionNumber** The revision number of the OS being updated. +- **scheduledRebootTime** Time of the scheduled reboot +- **scheduledRebootTimeInUTC** Time of the scheduled restart, in Coordinated Universal Time. +- **updateId** The Windows Update device GUID. +- **wuDeviceid** The Windows Update device GUID. + + +### Microsoft.Windows.Update.Ux.NotifyIcon.RebootScheduled + +This event is reported when user schedules restart. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursApplicable** Indicates if active hours are applicable. +- **IsEnhancedEngagedReboot** Indicates if enhanced engaged restarts applies. +- **rebootArgument** Represents reboot argument. +- **rebootOutsideOfActiveHours** Reboot outside of active hours. +- **rebootScheduledByUser** Restart scheduled by the user. +- **rebootState** Indicates reboot state. +- **rebootUsingSmartScheduler** Reboot using Smart Scheduler. +- **revisionNumber** Represents the revision number. +- **scheduledRebootTime** Indicates scheduled reboot time. +- **scheduledRebootTimeInUTC** Indicates scheduled reboot time in UTC. +- **updateId** Represents update ID. +- **wuDeviceid** Represents device ID. + + +## Windows Update mitigation events + +### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages + +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** The client ID used by Windows Update. +- **FlightId** The ID of each Windows Insider build the device received. +- **InstanceId** A unique device ID that identifies each update instance. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **MountedImageCount** The number of mounted images. +- **MountedImageMatches** The number of mounted image matches. +- **MountedImagesFailed** The number of mounted images that could not be removed. +- **MountedImagesRemoved** The number of mounted images that were successfully removed. +- **MountedImagesSkipped** The number of mounted images that were not found. +- **RelatedCV** The correlation vector value generated from the latest USO scan. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each Windows Update. +- **WuId** Unique ID for the Windows Update client. + + +### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints + +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ReparsePointsFailed** Number of reparse points that are corrupted but we failed to fix them. +- **ReparsePointsFixed** Number of reparse points that were corrupted and were fixed by this mitigation. +- **ReparsePointsSkipped** Number of reparse points that are not corrupted and no action is required. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each Update. +- **WuId** Unique ID for the Windows Update client. + +### wilActivity + +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **callContext** The function where the failure occurred. +- **currentContextId** The ID of the current call context where the failure occurred. +- **currentContextMessage** The message of the current call context where the failure occurred. +- **currentContextName** The name of the current call context where the failure occurred. +- **failureCount** The number of failures for this failure ID. +- **failureId** The ID of the failure that occurred. +- **failureType** The type of the failure that occurred. +- **fileName** The file name where the failure occurred. +- **function** The function where the failure occurred. +- **hresult** The HResult of the overall activity. +- **lineNumber** The line number where the failure occurred. +- **message** The message of the failure that occurred. +- **module** The module where the failure occurred. +- **originatingContextId** The ID of the originating call context that resulted in the failure. +- **originatingContextMessage** The message of the originating call context that resulted in the failure. +- **originatingContextName** The name of the originating call context that resulted in the failure. +- **threadId** The ID of the thread on which the activity is executing. + +## Windows Update Reserve Manager events + +### Microsoft.Windows.UpdateReserveManager.BeginScenario + +This event is sent when the Update Reserve Manager is called to begin a scenario. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Flags** The flags that are passed to the begin scenario function. +- **HardReserveSize** The size of the hard reserve. +- **HardReserveUsedSpace** The used space in the hard reserve. +- **OwningScenarioId** The scenario ID the client that called the begin scenario function. +- **ReturnCode** The return code for the begin scenario operation. +- **ScenarioId** The scenario ID that is internal to the reserve manager. +- **SoftReserveSize** The size of the soft reserve. +- **SoftReserveUsedSpace** The amount of soft reserve space that was used. + + +### Microsoft.Windows.UpdateReserveManager.ClearReserve + +This event is sent when the Update Reserve Manager clears one of the reserves. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FinalReserveUsedSpace** The amount of used space for the reserve after it was cleared. +- **InitialReserveUsedSpace** The amount of used space for the reserve before it was cleared. +- **ReserveId** The ID of the reserve that needs to be cleared. + + +### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FinalAdjustment** Final adjustment for the hard reserve following the addition or removal of optional content. +- **InitialAdjustment** Initial intended adjustment for the hard reserve following the addition or removal of optional content. + + +### Microsoft.Windows.UpdateReserveManager.EndScenario + +This event is sent when the Update Reserve Manager ends an active scenario. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ActiveScenario** The current active scenario. +- **Flags** The flags passed to the end scenario call. +- **HardReserveSize** The size of the hard reserve when the end scenario is called. +- **HardReserveUsedSpace** The used space in the hard reserve when the end scenario is called. +- **ReturnCode** The return code of this operation. +- **ScenarioId** The ID of the internal reserve manager scenario. +- **SoftReserveSize** The size of the soft reserve when end scenario is called. +- **SoftReserveUsedSpace** The amount of the soft reserve used when end scenario is called. + + +### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError + +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FailedExpression** The failed expression that was returned. +- **FailedFile** The binary file that contained the failed function. +- **FailedFunction** The name of the function that originated the failure. +- **FailedLine** The line number of the failure. +- **ReturnCode** The return code of the function. + + +### Microsoft.Windows.UpdateReserveManager.InitializeReserves + +This event is sent when reserves are initialized on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FallbackInitUsed** Indicates whether fallback initialization is used. +- **FinalUserFreeSpace** The amount of user free space after initialization. +- **Flags** The flags used in the initialization of Update Reserve Manager. +- **FreeSpaceToLeaveInUpdateScratch** The amount of space that should be left free after using the reserves. +- **HardReserveFinalSize** The final size of the hard reserve. +- **HardReserveFinalUsedSpace** The used space in the hard reserve. +- **HardReserveInitialSize** The size of the hard reserve after initialization. +- **HardReserveInitialUsedSpace** The utilization of the hard reserve after initialization. +- **HardReserveTargetSize** The target size that was set for the hard reserve. +- **InitialUserFreeSpace** The user free space during initialization. +- **PostUpgradeFreeSpace** The free space value passed into the Update Reserve Manager to determine reserve sizing post upgrade. +- **SoftReserveFinalSize** The final size of the soft reserve. +- **SoftReserveFinalUsedSpace** The used space in the soft reserve. +- **SoftReserveInitialSize** The soft reserve size after initialization. +- **SoftReserveInitialUsedSpace** The utilization of the soft reserve after initialization. +- **SoftReserveTargetSize** The target size that was set for the soft reserve. +- **TargetUserFreeSpace** The target user free space that was passed into the reserve manager to determine reserve sizing post upgrade. +- **UpdateScratchFinalUsedSpace** The used space in the scratch reserve. +- **UpdateScratchInitialUsedSpace** The utilization of the scratch reserve after initialization. +- **UpdateScratchReserveFinalSize** The utilization of the scratch reserve after initialization. +- **UpdateScratchReserveInitialSize** The size of the scratch reserve after initialization. + + +### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager + +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** The ID of the caller application. +- **Flags** The enumerated flags used to initialize the manager. +- **FlightId** The flight ID of the content the calling client is currently operating with. +- **Offline** Indicates whether or the reserve manager is called during offline operations. +- **PolicyPassed** Indicates whether the machine is able to use reserves. +- **ReturnCode** Return code of the operation. +- **Version** The version of the Update Reserve Manager. + + +### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization + +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FallbackLogicUsed** Indicates whether fallback logic was used for initialization. +- **Flags** The flags that are passed to the function to prepare the Trusted Installer for reserve initialization. + + +### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy + +This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **PolicyChanged** Indicates whether the policy has changed. +- **PolicyFailedEnum** The reason why the policy failed. +- **PolicyPassed** Indicates whether the policy passed. + + +### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateReserveManager.TurnOffReserves + +This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Flags** Flags used in the turn off reserves function. +- **HardReserveSize** The size of the hard reserve when Turn Off is called. +- **HardReserveUsedSpace** The amount of space used by the hard reserve when Turn Off is called +- **ScratchReserveSize** The size of the scratch reserve when Turn Off is called. +- **ScratchReserveUsedSpace** The amount of space used by the scratch reserve when Turn Off is called. +- **SoftReserveSize** The size of the soft reserve when Turn Off is called. +- **SoftReserveUsedSpace** The amount of the soft reserve used when Turn Off is called. + + +### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ChangeSize** The change in the hard reserve size based on the addition or removal of optional content. +- **Disposition** The parameter for the hard reserve adjustment function. +- **Flags** The flags passed to the hard reserve adjustment function. +- **PendingHardReserveAdjustment** The final change to the hard reserve size. +- **UpdateType** Indicates whether the change is an increase or decrease in the size of the hard reserve. + + +## Winlogon events + +### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon + +This event signals the completion of the setup process. It happens only once during the first logon. + +## XDE events + +### Microsoft.Emulator.Xde.RunTime.SystemReady + +This event sends basic information on the XDE application to understand and address performance issues relating to the emulator startup. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **timeTakenMilliseconds** Time in milliseconds it took to be ready for user interaction. +- **usingSnapshot** True if using a snapshot. + + +### Microsoft.Emulator.Xde.RunTime.XdeStarted + +This event sends basic information regarding the XDE process to address problems with emulator start. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **addUserToHyperVAdmins** True if user added to Hyper-V admin group. +- **addUserToPerformanceLogUsersGroup** True if user added to performance group. +- **automateFeatures** True if automation is being used. +- **bootLanguage** Boot language for guest. +- **bootToSnapshot** True if should attempt to boot to snapshot. +- **com1PipeName** COM1 pipe name. +- **com2PipeName** COM2 pipe name. +- **diffDiskVhd** Diff disk name. +- **displayName** Display name. +- **fastShutdown** True if should try to shutdown quickly. +- **gpuDisabled** True if GPU is disabled. +- **language** Language to use for UI. +- **memSize** Memory size. +- **natDisabled** True if NAT is to be disabled. +- **noStart** True if VM shouldn't be started. +- **originalVideoResolution** Original video resolution. +- **remoteFxDisabled** Disable GPU. +- **screenDiagonalSize** Screen diagonal size. +- **sensorsEnabled** Sensors to enable in guest. +- **showName** True if display name should appear on UI. +- **showUsage** True if usage was shown. +- **silentSnapshot** True if a silent snapshot was taken. +- **silentUi** True if message boxes should be suppressed. +- **sku** The emulator sku to use +- **startedBy** The program that started the emulator. +- **version** Emulator version. +- **versionLong** Long format of emulator version. +- **vhdPath** VHD path. +- **videoResolution** Video resolution to use. +- **virtualMachineName** VM name. +- **waitForClientConnection** True if we should wait for client connection. +- **wp81NetworkStackDisabled** WP 8.1 networking stack disabled. + + + diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml new file mode 100644 index 0000000000..60bf83c118 --- /dev/null +++ b/windows/privacy/toc.yml @@ -0,0 +1,67 @@ +- name: Privacy + href: index.yml + items: + - name: "Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals" + href: windows-10-and-privacy-compliance.md + - name: Configure Windows diagnostic data in your organization + href: configure-windows-diagnostic-data-in-your-organization.md + - name: Changes to Windows diagnostic data collection + href: changes-to-windows-diagnostic-data-collection.md + - name: Diagnostic Data Viewer + items: + - name: Diagnostic Data Viewer Overview + href: diagnostic-data-viewer-overview.md + - name: Diagnostic Data Viewer for PowerShell Overview + href: Microsoft-DiagnosticDataViewer.md + - name: Required Windows diagnostic data events and fields + items: + - name: Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields + href: required-windows-diagnostic-data-events-and-fields-2004.md + - name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1903.md + - name: Windows 10, version 1809 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1809.md + - name: Windows 10, version 1803 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1803.md + - name: Windows 10, version 1709 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1709.md + - name: Windows 10, version 1703 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1703.md + - name: Optional Windows diagnostic data events and fields + items: + - name: Windows 10, version 1709 and newer optional diagnostic data + href: windows-diagnostic-data.md + - name: Windows 10, version 1703 optional diagnostic data + href: windows-diagnostic-data-1703.md + - name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy + href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md + - name: Manage Windows 10 connection endpoints + items: + - name: Manage connections from Windows operating system components to Microsoft services + href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md + - name: Manage connections from Windows operating system components to Microsoft services using MDM + href: manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md + - name: Connection endpoints for Windows 10, version 2004 + href: manage-windows-2004-endpoints.md + - name: Connection endpoints for Windows 10, version 1909 + href: manage-windows-1909-endpoints.md + - name: Connection endpoints for Windows 10, version 1903 + href: manage-windows-1903-endpoints.md + - name: Connection endpoints for Windows 10, version 1809 + href: manage-windows-1809-endpoints.md + - name: Connection endpoints for Windows 10, version 1803 + href: manage-windows-1803-endpoints.md + - name: Connection endpoints for Windows 10, version 1709 + href: manage-windows-1709-endpoints.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 2004 + href: windows-endpoints-2004-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1909 + href: windows-endpoints-1909-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1903 + href: windows-endpoints-1903-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1809 + href: windows-endpoints-1809-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1803 + href: windows-endpoints-1803-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1709 + href: windows-endpoints-1709-non-enterprise-editions.md diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 47ce5b00ee..e1011307d6 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -1,6 +1,6 @@ --- +title: Windows 10 & Privacy Compliance Guide description: This article provides information to help IT and compliance professionals understand the personal data policies as related to Windows 10. -title: Windows 10 & Privacy Compliance - A Guide for IT and Compliance Professionals keywords: privacy, GDPR, compliance ms.prod: w10 ms.mktglfcycl: manage @@ -13,164 +13,162 @@ ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 05/21/2019 +ms.date: 07/21/2020 --- # Windows 10 & Privacy Compliance:
              A Guide for IT and Compliance Professionals Applies to: -- Windows 10, version 1903 -- Windows 10, version 1809 -- Windows 10 Team Edition, version 1703 for Surface Hub -- Windows Server 2019 -- Windows Server 2016 -- Windows Analytics - -For more information about the GDPR, see: -* [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md) -* [Microsoft GDPR Overview](https://aka.ms/GDPROverview) -* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq) -* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp) -* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted) +- Windows 10 Enterprise +- Windows 10 Education +- Windows Server 2016 and newer ## Overview -At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide IT and compliance professionals with data privacy considerations for Windows 10. +>[!IMPORTANT] +>Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). -Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls and support for data subject requests, all of which are detailed in this guide. +At Microsoft, we are committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10. -This information allows IT and compliance professionals work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR). +Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. +This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR) ## 1. Windows 10 data collection transparency Transparency is an important part of the data collection process in Windows 10. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device set up. -If interested in understanding how to manage settings related to data collection skip to the next section [Windows 10 data collection management](#12-data-collection-monitoring). - - ### 1.1 Device set up experience and support for layered transparency -When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used and how to manage the setting after the device setup is complete. The user can also review the privacy statement when connected to the network during this portion of setup. A brief overview of the set up experience for privacy settings are described in [this blog](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97). +When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used, and how to manage the setting after the device setup is complete. When connected to the network during this portion of setup, the user can also review the privacy statement. A brief overview of the set up experience for privacy settings is described in [Windows Insiders get first look at new privacy screen settings layout coming to Windows 10](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97), a blog entry on Windows Blogs. The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information. > [!NOTE] -> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and newer). For the full list of settings that involve data collection, [see Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | Description | Supporting Content | Privacy Statement | | --- | --- | --- | --- | -| Diagnostic Data |

              Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

              Diagnostic data is categorized into four levels:

              • **Security**
                Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
              • **Basic**
                Basic device info, including: quality-related data, app compatibility, and data from the Security level.
              • **Enhanced**
                Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
              • **Full**
                Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
                At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

              | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

              [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -| Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | -| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | +| Diagnostic Data |

              Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.

              Diagnostic data is categorized into the following:

              • **Required diagnostic data**
                Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004).
              • **Optional diagnostic data**
                Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).

              | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

              [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Inking and typing diagnostics | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/windows-10-speech-voice-activation-inking-typing-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | +| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy) |[Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | | Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | -| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) | -| Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | -| Cortana |

              Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

              Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

              | [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

              [Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | +| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you choose to send. Tailored experiences include personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) | [Privacy statement](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) | +| Activity History/Timeline – Cloud Sync | If you want Windows Timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | +| Cortana |

              Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

              Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

              | [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

              [Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | ### 1.2 Data collection monitoring -The Diagnostic Data Viewer (DDV) is a Windows app (available in Windows 10, version 1803 or later) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft. DDV groups the information into simple categories based on how it is used by Microsoft. The [DDV Overview](diagnostic-data-viewer-overview.md) provides information on how users can get started on using this tool. +[Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) is a Microsoft Store app (available in Windows 10, version 1803 and newer) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft in real-time. DDV groups the information into simple categories that describe the data that’s being collected. An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information. ## 2. Windows 10 data collection management -Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start** > **Settings** > **Privacy**). The organization can also manage the privacy settings using group policy or mobile device management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article. +Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start > Settings > Privacy**). The organization can also manage the privacy settings using Group Policy or Mobile Device Management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article. ### 2.1 Privacy setting options for users -Once a Windows 10 device is set up, a user can manage data collection settings by going to **Start** > **Settings** > **Privacy**. IT administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to **Start** > **Settings** > **Privacy**. Meaning the user can only change settings in accordance with the policies that the administrator has applied to the device. +Once a Windows 10 device is set up, a user can manage data collection settings by navigating to **Start > Settings > Privacy**. Administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says **Some settings are hidden or managed by your organization** when they navigate to **Start > Settings > Privacy**. In this case, the user can only change settings in accordance with the policies that the administrator has applied to the device. ### 2.2 Privacy setting controls for administrators -The IT department can configure and control privacy settings across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings. +Administrators can configure and control privacy settings across their organization by using Group Policy, Mobile Device Management (MDM), or Windows registry settings. -The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set. +The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
              **Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

              MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
              **Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

              MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
              **Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

              MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
              **Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

              MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
              **Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

              MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
              Basic (Windows 10, version 1903 and later)

              Server SKUs:
              Enhanced | Security and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
              **Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

              MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop editions:
              Required diagnostic data (Windows 10, version 1903 and later)

              Server editions:
              Required diagnostic data | Security and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
              **Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

              MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | -| Tailored Experiences | Group Policy:
              **User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

              MDM: Link TBD | Off | Off | -| Advertising ID | Group Policy:
              **Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

              MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | +| Tailored Experiences | Group Policy:
              **User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

              MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | +| Advertising ID | Group Policy:
              **Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

              MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | | Activity History/Timeline – Cloud Sync | Group Policy:
              **Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

              MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | | [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#2-cortana-and-search) | Group Policy:
              **Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

              MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | ### 2.3 Guidance for configuration options -This section provides general details and links to more detailed information as well as instructions for IT administrators and compliance professional. These instructions allow IT admins and compliance pros to manage the device compliance. This information includes details about setting up a device, to configuring the device’s settings after setup is completed to minimize data collected and drive privacy related user experiences. +This section provides general details and links to more detailed information, as well as instructions for administrators and compliance professionals. These instructions allow you to manage device settings to manage the compliance objectives of your organization. This information includes details about setting up a device, configuring the device’s settings after setup is complete to minimize data collection, and driving privacy-related user experiences. -#### 2.3.1 Managing the device setup experience +#### _2.3.1 Managing the device setup experience_ -Windows deployment can be configured using several different methods, which provide an administrator with options to control: how a device is set up, what’s enabled by default, and what the user is able to change on the system after they log on. +Windows deployment can be configured using several different methods that provide an administrator with options for control, including how a device is set up, which options are enabled by default, and what the user is able to change on the device after they log on. -The [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment/) section of the Windows IT Pro Center provides an overview of the different options. +If you want the ability to fully control and apply restrictions on data being sent back to Microsoft, you can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/) as a deployment solution. Configuration Manager can be used to deploy a customized boot image using a variety of [deployment methods](https://docs.microsoft.com/mem/configmgr/osd/get-started/prepare-for-operating-system-deployment). You can further restrict any Configuration Manager-specific diagnostic data from being sent back to Microsoft by turning off this setting as outlined in the instructions [here](https://docs.microsoft.com/mem/configmgr/core/plan-design/diagnostics/frequently-asked-questions). -#### 2.3.2 Managing connections from Windows components to Microsoft services +Alternatively, your administrators can also choose to use Windows Autopilot. Autopilot lessens the overall burden of deployment while allowing administrators to fully customize the out-of-box experience. However, since Windows Autopilot is a cloud-based solution, administrators should be aware that a minimal set of device identifiers are sent back to Microsoft during initial device boot up. This device-specific information is used to identify the device so that it can receive the administrator-configured Autopilot profile and policies. -IT administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by these Windows components. +You can use the following articles to learn more about Autopilot and how to use Autopilot to deploy Windows 10: +- https://docs.microsoft.com/windows/deployment/windows-Autopilot/windows-Autopilot +- https://docs.microsoft.com/windows/deployment/windows-Autopilot/deployment-process -See [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) for more details, including the different methods available on how to configure each setting, the impact to functionality and which versions of Windows that are applicable. +#### _2.3.2 Managing connections from Windows components to Microsoft services_ -#### 2.3.3 Managing Windows 10 connections +Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components. -Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints as an additional measure of ensuring privacy compliance within their organization. +For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable. -[Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with the functionality that would be impacted. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the “Manage Windows 10 connection endpoints” section of the left-hand navigation menu. +#### _2.3.3 Managing Windows 10 connections_ -#### 2.3.4 Limited functionality baseline +Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives. -An organization may want to further minimize the amount of data shared with Microsoft or apps by managing the connections and configuring additional settings on their devices. Similar to [Security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), we have a limited functionality baseline-focused configuring settings to minimize the data shared, however this comes with some potential impact to functionality on the device. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators who don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. +[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu. -#### 2.3.5 Diagnostic data: Managing notifications for change of level at logon +#### _2.3.4 Limited functionality baseline_ -Windows 10, version 1803, and later provides users with a notification during sign in about changes to the diagnostic data level on the device so they are aware of any changes where additional data may be collected. For instance, if the diagnostic level on the device is set to Basic and an administrator changes it to Full, users will be notified when they next sign in. The IT administrator can disable these notifications by setting Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`. +An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. -#### 2.3.6 Diagnostic data: Managing end user choice for changing the setting +>[!IMPORTANT] +>We recommend that you fully test any modifications to these settings before deploying them in your organization. -Windows 10, version 1803 and later, allows users to change their diagnostic data level to a lower setting than what their IT administrator has set. For instance, if the administrator has set the diagnostic data level to Enhanced or Full, a user can change the setting to Basic by going into **Settings** > **Privacy** > **Diagnostic & feedback**. The administrator can disable the user ability to change the setting via **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`. +#### _2.3.5 Diagnostic data: Managing notifications for change of level at logon_ -#### 2.3.7 Diagnostic data: Managing device-based data delete +Starting with Windows 10, version 1803, if an administrator modifies the diagnostic data collection setting, users are notified of this change during the initial device sign in. For example, if you configure the device to send optional diagnostic data, users will be notified the next time they sign into the device. You can disable these notifications by using the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`. -Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. +#### _2.3.6 Diagnostic data: Managing end user choice for changing the setting_ + +Windows 10, version 1803 and newer allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by going into **Settings** > **Privacy** > **Diagnostics & feedback**. Administrators can restrict a user’s ability to change the setting using **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`. + +#### _2.3.7 Diagnostic data: Managing device-based data delete_ + +Windows 10, version 1809 and newer allows a user to delete diagnostic data collected from their device by using **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet. An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. ## 3. The process for exercising data subject rights -This section discusses the different methods Microsoft provides for users and IT administrators to exercise data subject rights for data collected from a Windows 10 device. +This section discusses the different methods Microsoft provides for users and administrators to exercise data subject rights for data collected from a Windows 10 device. ### 3.1 Delete -Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. +Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet. ### 3.2 View -The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from a Windows 10 device. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet. ### 3.3 Export -The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the **Export** data button in the top menu. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.4 Devices connected to a Microsoft account -If a user signs in to a Windows experience or app on their device with their Microsoft account (MSA), they can view, delete, and export data associated with their MSA on the [Privacy dashboard](https://account.microsoft.com/privacy). +If a user signs in to a Windows experience or app on their device with their Microsoft account, they can view, delete, and export data associated with their Microsoft account on the [Privacy dashboard](https://account.microsoft.com/privacy). ## 4. Cross-border data transfers -Microsoft complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States. +Microsoft complies with applicable law regarding the collection, use, and retention of personal information, including its transfer across borders Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainwherewestoreandprocessdatamodule) provides details on how we store and process personal data. @@ -179,26 +177,34 @@ Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement The following sections provide details about how privacy data is collected and managed across related Windows products. -### 5.1 Windows Server 2016 and 2019 +### 5.1 Windows Server 2016 and newer -Windows Server follows the same mechanisms as Windows 10 for handling of personal data. There are some differences regarding [diagnostic default settings for Windows Server](https://microsoft-my.sharepoint.com/personal/v-colinm_microsoft_com/Documents/WINDOWS%20PRIVACY/Windows%20diagnostic%20data%20and%20Windows%20Server). +Windows Server follows the same mechanisms as Windows 10 for handling of personal data. ### 5.2 Surface Hub -Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to an individual user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. +[Surface Hub](https://docs.microsoft.com/surface-hub/) is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. To delete the Windows diagnostic data sent to Microsoft for Surface Hub, you can use the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store -For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](gdpr-it-guidance.md#windows-10-team-edition-version-1703-for-surface-hub). +>[!IMPORTANT] +>Apps and services that run on Windows but are not considered part of Windows will manage data collection using their own controls. Please contact the publisher for further guidance on how to control the data collection and transmission of these apps and services. -### 5.3 Windows 10 Analytics +An administrator can configure privacy-related settings, such as choosing to only send required diagnostic data. Surface Hub does not support Group Policy for centralized management. However, administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, see [Manage settings with an MDM provider (Surface Hub)](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub). -[Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: Device Health, Update Compliance, and Upgrade Readiness. Windows Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function. +### 5.3 Desktop Analytics -For more details, see the [Windows Analytics overview page](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview). +[Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. Desktop Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function. +### 5.4 Microsoft Managed Desktop + +[Microsoft Managed Desktop (MMD)](https://docs.microsoft.com/microsoft-365/managed-desktop/service-description/?view=o365-worldwide) is a service that provides your users with a secure modern experience and always keeps devices up to date with the latest versions of Windows 10 Enterprise edition, Office 365 ProPlus, and Microsoft security services. ## Additional Resources -* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview) -* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/TrustCenter/Privacy/privacy-overview) +* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trust-center/privacy/gdpr-overview) +* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/trust-center/privacy) * [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro) - +* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) +* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) +* [Privacy at Microsoft](https://privacy.microsoft.com/privacy-report) +* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md) +* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/) diff --git a/windows/privacy/windows-diagnostic-data-1703.md b/windows/privacy/windows-diagnostic-data-1703.md index d398441cbc..ffa7858d15 100644 --- a/windows/privacy/windows-diagnostic-data-1703.md +++ b/windows/privacy/windows-diagnostic-data-1703.md @@ -21,7 +21,7 @@ ms.reviewer: **Applies to:** - Windows 10, version 1703 -Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md). +Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703). The data covered in this article is grouped into the following categories: @@ -42,7 +42,7 @@ Most diagnostic events contain a header of common data: | Category Name | Examples | | - | - | -| Common Data | Information that is added to most diagnostic events, if relevant and available:
              • OS name, version, build, and [locale](https://msdn.microsoft.com/library/windows/desktop/dd318716.aspx)
              • User ID -- a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic diagnostic data
              • Xbox UserID
              • Environment from which the event was logged -- Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time such the period an app is running or between boots of the OS.
              • The diagnostic event name, Event ID, [ETW](https://msdn.microsoft.com/library/windows/desktop/bb968803.aspx) opcode, version, schema signature, keywords, and flags
              • HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service.
              • Various IDs that are used to correlate and sequence related events together.
              • Device ID. This is not the user provided device name, but an ID that is unique for that device.
              • Device class -- Desktop, Server, or Mobile
              • Event collection time
              • Diagnostic level -- Basic or Full, Sample level -- for sampled data, what sample level is this device opted into
              | +| Common Data | Information that is added to most diagnostic events, if relevant and available:
              • OS name, version, build, and [locale](https://msdn.microsoft.com/library/windows/desktop/dd318716.aspx)
              • User ID - a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic diagnostic data
              • Xbox UserID
              • Environment from which the event was logged - Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time such the period an app is running or between boots of the OS.
              • The diagnostic event name, Event ID, [ETW](https://msdn.microsoft.com/library/windows/desktop/bb968803.aspx) opcode, version, schema signature, keywords, and flags
              • HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service.
              • Various IDs that are used to correlate and sequence related events together.
              • Device ID. This ID is not the user provided device name, but an ID that is unique for that device.
              • Device class - Desktop, Server, or Mobile
              • Event collection time
              • Diagnostic level - Basic or Full, Sample level - for sampled data, what sample level is this device opted into
              | ## ​Device, Connectivity, and Configuration data @@ -50,38 +50,38 @@ This type of data includes details about the device, its configuration and conne | Category Name | Examples | | - | - | -| Device properties | Information about the OS and device hardware, such as:
              • OS - version name, Edition
              • Installation type, subscription status, and genuine OS status
              • Processor architecture, speed, number of cores, manufacturer, and model
              • OEM details --manufacturer, model, and serial number
              • Device identifier and Xbox serial number
              • Firmware/BIOS -- type, manufacturer, model, and version
              • Memory -- total memory, video memory, speed, and how much memory is available after the device has reserved memory
              • Storage -- total capacity and disk type
              • Battery -- charge capacity and InstantOn support
              • Hardware chassis type, color, and form factor
              • Is this a virtual machine?
              | -| Device capabilities | Information about the specific device capabilities such as:
              • Camera -- whether the device has a front facing, a rear facing camera, or both.
              • Touch screen -- does the device include a touch screen? If so, how many hardware touch points are supported?
              • Processor capabilities -- CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2
              • Trusted Platform Module (TPM) – whether present and what version
              • Virtualization hardware -- whether an IOMMU is present, SLAT support, is virtualization enabled in the firmware
              • Voice – whether voice interaction is supported and the number of active microphones
              • Number of displays, resolutions, DPI
              • Wireless capabilities
              • OEM or platform face detection
              • OEM or platform video stabilization and quality level set
              • Advanced Camera Capture mode (HDR vs. LowLight), OEM vs. platform implementation, HDR probability, and Low Light probability
              | -| Device preferences and settings | Information about the device settings and user preferences such as:
              • User Settings – System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security
              • User-provided device name
              • Whether device is domain-joined, or cloud-domain joined (i.e. part of a company-managed network)
              • Hashed representation of the domain name
              • MDM (mobile device management) enrollment settings and status
              • BitLocker, Secure Boot, encryption settings, and status
              • Windows Update settings and status
              • Developer Unlock settings and status
              • Default app choices
              • Default browser choice
              • Default language settings for app, input, keyboard, speech, and display
              • App store update settings
              • Enterprise OrganizationID, Commercial ID
              | -| Device peripherals | Information about the device peripherals such as:
              • Peripheral name, device model, class, manufacturer and description
              • Peripheral device state, install state, and checksum
              • Driver name, package name, version, and manufacturer
              • HWID - A hardware vendor defined ID to match a device to a driver [INF file](https://msdn.microsoft.com/windows/hardware/drivers/install/hardware-ids)
              • Driver state, problem code, and checksum
              • Whether driver is kernel mode, signed, and image size
              | -| Device network info | Information about the device network configuration such as:
              • Network system capabilities
              • Local or Internet connectivity status
              • Proxy, gateway, DHCP, DNS details and addresses
              • Paid or free network
              • Wireless driver is emulated or not
              • Access point mode capable
              • Access point manufacturer, model, and MAC address
              • WDI Version
              • Name of networking driver service
              • Wi-Fi Direct details
              • Wi-Fi device hardware ID and manufacturer
              • Wi-Fi scan attempt counts and item counts
              • Mac randomization is supported/enabled or not
              • Number of spatial streams and channel frequencies supported
              • Manual or Auto Connect enabled
              • Time and result of each connection attempt
              • Airplane mode status and attempts
              • Interface description provided by the manufacturer
              • Data transfer rates
              • Cipher algorithm
              • Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO)
              • Mobile operator and service provider name
              • Available SSIDs and BSSIDs
              • IP Address type -- IPv4 or IPv6
              • Signal Quality percentage and changes
              • Hotspot presence detection and success rate
              • TCP connection performance
              • Miracast device names
              • Hashed IP address
              +| Device properties | Information about the OS and device hardware, such as:
              • OS - version name, Edition
              • Installation type, subscription status, and genuine OS status
              • Processor architecture, speed, number of cores, manufacturer, and model
              • OEM details - manufacturer, model, and serial number
              • Device identifier and Xbox serial number
              • Firmware/BIOS - type, manufacturer, model, and version
              • Memory - total memory, video memory, speed, and how much memory is available after the device has reserved memory
              • Storage - total capacity and disk type
              • Battery - charge capacity and InstantOn support
              • Hardware chassis type, color, and form factor
              • Is this machine a virtual machine?
              | +| Device capabilities | Information about the specific device capabilities such as:
              • Camera - whether the device has a front facing, a rear facing camera, or both.
              • Touch screen - does the device include a touch screen? If so, how many hardware touch points are supported?
              • Processor capabilities - CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2
              • Trusted Platform Module (TPM) – whether present and what version
              • Virtualization hardware - whether an IOMMU is present, SLAT support, is virtualization enabled in the firmware
              • Voice – whether voice interaction is supported and the number of active microphones
              • Number of displays, resolutions, DPI
              • Wireless capabilities
              • OEM or platform face detection
              • OEM or platform video stabilization and quality level set
              • Advanced Camera Capture mode (HDR vs. LowLight), OEM vs. platform implementation, HDR probability, and Low Light probability
              | +| Device preferences and settings | Information about the device settings and user preferences such as:
              • User Settings – System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security
              • User-provided device name
              • Whether device is domain-joined, or cloud-domain joined (that is, part of a company-managed network)
              • Hashed representation of the domain name
              • MDM (mobile device management) enrollment settings and status
              • BitLocker, Secure Boot, encryption settings, and status
              • Windows Update settings and status
              • Developer Unlock settings and status
              • Default app choices
              • Default browser choice
              • Default language settings for app, input, keyboard, speech, and display
              • App store update settings
              • Enterprise OrganizationID, Commercial ID
              | +| Device peripherals | Information about the device peripherals such as:
              • Peripheral name, device model, class, manufacturer, and description
              • Peripheral device state, install state, and checksum
              • Driver name, package name, version, and manufacturer
              • HWID - A hardware vendor defined ID to match a device to a driver [INF file](https://msdn.microsoft.com/windows/hardware/drivers/install/hardware-ids)
              • Driver state, problem code, and checksum
              • Whether driver is kernel mode, signed, and image size
              | +| Device network info | Information about the device network configuration such as:
              • Network system capabilities
              • Local or Internet connectivity status
              • Proxy, gateway, DHCP, DNS details, and addresses
              • Paid or free network
              • Wireless driver is emulated or not
              • Access point mode capable
              • Access point manufacturer, model, and MAC address
              • WDI Version
              • Name of networking driver service
              • Wi-Fi Direct details
              • Wi-Fi device hardware ID and manufacturer
              • Wi-Fi scan attempt counts and item counts
              • Mac randomization is supported/enabled or not
              • Number of spatial streams and channel frequencies supported
              • Manual or Auto Connect enabled
              • Time and result of each connection attempt
              • Airplane mode status and attempts
              • Interface description provided by the manufacturer
              • Data transfer rates
              • Cipher algorithm
              • Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO)
              • Mobile operator and service provider name
              • Available SSIDs and BSSIDs
              • IP Address type - IPv4 or IPv6
              • Signal Quality percentage and changes
              • Hotspot presence detection and success rate
              • TCP connection performance
              • Miracast device names
              • Hashed IP address
              ## Product and Service Usage data -This type of data includes details about the usage of the device, operating system, applications and services. +This type of data includes details about the usage of the device, operating system, applications, and services. | Category Name | Examples | | - | - | -| App usage | Information about Windows and application usage such as:
              • OS component and app feature usage
              • User navigation and interaction with app and Windows features. This could potentially include user input, such as name of a new alarm set, user menu choices, or user favorites.
              • Time of and count of app/component launches, duration of use, session GUID, and process ID
              • App time in various states – running foreground or background, sleeping, or receiving active user interaction
              • User interaction method and duration – whether and length of time user used the keyboard, mouse, pen, touch, speech, or game controller
              • Cortana launch entry point/reason
              • Notification delivery requests and status
              • Apps used to edit images and videos
              • SMS, MMS, VCard, and broadcast message usage statistics on primary or secondary line
              • Incoming and Outgoing calls and Voicemail usage statistics on primary or secondary line
              • Emergency alerts are received or displayed statistics
              • Content searches within an app
              • Reading activity -- bookmarking used, print used, layout changed
              | -| App or product state | Information about Windows and application state such as:
              • Start Menu and Taskbar pins
              • Online/Offline status
              • App launch state –- with deep-link such as Groove launched with an audio track to play, or share contract such as MMS launched to share a picture.
              • Personalization impressions delivered
              • Whether the user clicked or hovered on UI controls or hotspots
              • User feedback Like or Dislike or rating was provided
              • Caret location or position within documents and media files -- how much of a book has been read in a single session or how much of a song has been listened to.
              | +| App usage | Information about Windows and application usage such as:
              • OS component and app feature usage
              • User navigation and interaction with app and Windows features. This information could include user input, such as the name of a new alarm set, user menu choices, or user favorites.
              • Time of and count of app/component launches, duration of use, session GUID, and process ID
              • App time in various states – running foreground or background, sleeping, or receiving active user interaction
              • User interaction method and duration – whether and length of time user used the keyboard, mouse, pen, touch, speech, or game controller
              • Cortana launch entry point/reason
              • Notification delivery requests and status
              • Apps used to edit images and videos
              • SMS, MMS, VCard, and broadcast message usage statistics on primary or secondary line
              • Incoming and Outgoing calls and Voicemail usage statistics on primary or secondary line
              • Emergency alerts are received or displayed statistics
              • Content searches within an app
              • Reading activity - bookmarking used, print used, layout changed
              | +| App or product state | Information about Windows and application state such as:
              • Start Menu and Taskbar pins
              • Online/Offline status
              • App launch state –- with deep-link such as Groove launched with an audio track to play, or share contract such as MMS launched to share a picture.
              • Personalization impressions delivered
              • Whether the user clicked or hovered on UI controls or hotspots
              • User feedback Like or Dislike or rating was provided
              • Caret location or position within documents and media files - how much of a book has been read in a single session or how much of a song has been listened to.
              | | Login properties |
              • Login success or failure
              • Login sessions and state
              | ## Product and Service Performance data -This type of data includes details about the health of the device, operating system, apps and drivers. +This type of data includes details about the health of the device, operating system, apps, and drivers. | Category Name | Description and Examples | | - | - | -|Device health and crash data | Information about the device and software health such as:
              • Error codes and error messages, name and ID of the app, and process reporting the error
              • DLL library predicted to be the source of the error -- xyz.dll
              • System generated files -- app or product logs and trace files to help diagnose a crash or hang
              • System settings such as registry keys
              • User generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
              • Details and counts of abnormal shutdowns, hangs, and crashes
              • Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
              • Crash and Hang dumps
                • The recorded state of the working memory at the point of the crash.
                • Memory in use by the kernel at the point of the crash.
                • Memory in use by the application at the point of the crash.
                • All the physical memory used by Windows at the point of the crash.
                • Class and function name within the module that failed.
                | -|Device performance and reliability data | Information about the device and software performance such as:
                • User Interface interaction durations -- Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
                • Device on/off performance -- Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
                • In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction.
                • User input responsiveness – onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
                • UI and media performance and glitches/smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
                • Disk footprint -- Free disk space, out of memory conditions, and disk score.
                • Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
                • Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
                • Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness environmental response times
                • Device setup -- first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
                • Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, auto-brightness details, time device is plugged into AC vs. battery, battery state transitions
                • Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
                • Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
                | -|Movies|Information about movie consumption functionality on the device. This isn't intended to capture user viewing, listening or habits.
                • Video Width, height, color pallet, encoding (compression) type, and encryption type
                • Instructions for how to stream content for the user -- the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
                • URL for a specific two second chunk of content if there is an error
                • Full screen viewing mode details| -|Music & TV|Information about music and TV consumption on the device. This isn't intended to capture user viewing, listening or habits.
                  • Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
                  • Content type (video, audio, surround audio)
                  • Local media library collection statistics -- number of purchased tracks, number of playlists
                  • Region mismatch -- User OS Region, and Xbox Live region
                  | -|Reading|Information about reading consumption functionality on the device. This isn't intended to capture user viewing, listening or habits.
                  • App accessing content and status and options used to open a Microsoft Store book
                  • Language of the book
                  • Time spent reading content
                  • Content type and size details
                  | -|Photos App|Information about photos usage on the device. This isn't intended to capture user viewing, listening or habits.
                  • File source data -- local, SD card, network device, and OneDrive
                  • Image & video resolution, video length, file sizes types and encoding
                  • Collection view or full screen viewer use and duration of view
                | -|On-device file query | Information about local search activity on the device such as:
                • Kind of query issued and index type (ConstraintIndex, SystemIndex)
                • Number of items requested and retrieved
                • File extension of search result user interacted with
                • Launched item kind, file extension, index of origin, and the App ID of the opening app.
                • Name of process calling the indexer and time to service the query.
                • A hash of the search scope (file, Outlook, OneNote, IE history)
                • The state of the indices (fully optimized, partially optimized, being built)
                | -|Purchasing| Information about purchases made on the device such as:
                • Product ID, edition ID and product URI
                • Offer details -- price
                • Order requested date/time
                • Store client type -- web or native client
                • Purchase quantity and price
                • Payment type -- credit card type and PayPal
                | -|Entitlements | Information about entitlements on the device such as:
                • Service subscription status and errors
                • DRM and license rights details -- Groove subscription or OS volume license
                • Entitlement ID, lease ID, and package ID of the install package
                • Entitlement revocation
                • License type (trial, offline vs online) and duration
                • License usage session
                | +|Device health and crash data | Information about the device and software health such as:
                • Error codes and error messages, name and ID of the app, and process reporting the error
                • DLL library predicted to be the source of the error - xyz.dll
                • System-generated files - app or product logs and trace files to help diagnose a crash or hang
                • System settings such as registry keys
                • User-generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
                • Details and counts of abnormal shutdowns, hangs, and crashes
                • Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
                • Crash and Hang dumps
                  • The recorded state of the working memory at the point of the crash.
                  • Memory in use by the kernel at the point of the crash.
                  • Memory in use by the application at the point of the crash.
                  • All the physical memory used by Windows at the point of the crash.
                  • Class and function name within the module that failed.
                  | +|Device performance and reliability data | Information about the device and software performance such as:
                  • User Interface interaction durations - Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
                  • Device on/off performance - Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
                  • In-app responsiveness - time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction.
                  • User input responsiveness – onscreen keyboard invocation times for different languages, time to show autocomplete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
                  • UI and media performance and glitches/smoothness - video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
                  • Disk footprint - Free disk space, out of memory conditions, and disk score.
                  • Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
                  • Background task performance - download times, Windows Update scan duration, Microsoft Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
                  • Peripheral and devices - USB device connection times, time to connect to a wireless display, printing times, network availability, and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP, and so on), smart card authentication times, automatic brightness environmental response times
                  • Device setup - first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
                  • Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, autobrightness details, time device is plugged into AC vs. battery, battery state transitions
                  • Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
                  • Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
                  | +|Movies|Information about movie consumption functionality on the device. This information isn't intended to capture user viewing, listening, or habits.
                  • Video Width, height, color pallet, encoding (compression) type, and encryption type
                  • Instructions for how to stream content for the user - the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
                  • URL for a specific two-second chunk of content if there is an error
                  • Full screen viewing mode details| +|Music & TV|Information about music and TV consumption on the device. This information isn't intended to capture user viewing, listening, or habits.
                    • Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
                    • Content type (video, audio, surround audio)
                    • Local media library collection statistics - number of purchased tracks, number of playlists
                    • Region mismatch - User OS Region, and Xbox Live region
                    | +|Reading|Information about reading consumption functionality on the device. This information isn't intended to capture user viewing, listening, or habits.
                    • App accessing content and status and options used to open a Microsoft Store book
                    • Language of the book
                    • Time spent reading content
                    • Content type and size details
                    | +|Photos App|Information about photos usage on the device. This information isn't intended to capture user viewing, listening, or habits.
                    • File source data - local, SD card, network device, and OneDrive
                    • Image & video resolution, video length, file sizes types and encoding
                    • Collection view or full screen viewer use and duration of view
                  | +|On-device file query | Information about local search activity on the device such as:
                  • Type of query issued and index type (ConstraintIndex, SystemIndex)
                  • Number of items requested and retrieved
                  • File extension of search result user interacted with
                  • Launched item kind, file extension, index of origin, and the App ID of the opening app.
                  • Name of process calling the indexer and time to service the query.
                  • A hash of the search scope (file, Outlook, OneNote, IE history)
                  • The state of the indices (fully optimized, partially optimized, being built)
                  | +|Purchasing| Information about purchases made on the device such as:
                  • Product ID, edition ID, and product URI
                  • Offer details - price
                  • Order requested date/time
                  • Store client type - web or native client
                  • Purchase quantity and price
                  • Payment type - credit card type and PayPal
                  | +|Entitlements | Information about entitlements on the device such as:
                  • Service subscription status and errors
                  • DRM and license rights details - Groove subscription or OS volume license
                  • Entitlement ID, lease ID, and package ID of the install package
                  • Entitlement revocation
                  • License type (trial, offline versus online) and duration
                  • License usage session
                  | ## Software Setup and Inventory data @@ -90,7 +90,7 @@ This type of data includes software installation and update information on the d | Category Name | Data Examples | | - | - | | Installed Applications and Install History | Information about apps, drivers, update packages, or OS components installed on the device such as:
                  • App, driver, update package, or component’s Name, ID, or Package Family Name
                  • Product, SKU, availability, catalog, content, and Bundle IDs
                  • OS component, app or driver publisher, language, version and type (Win32 or UWP)
                  • Install date, method, and install directory, count of install attempts
                  • MSI package code and product code
                  • Original OS version at install time
                  • User or administrator or mandatory installation/update
                  • Installation type – clean install, repair, restore, OEM, retail, upgrade, and update
                  | -| Device update information | Information about Windows Update such as:
                  • Update Readiness analysis of device hardware, OS components, apps, and drivers (progress, status, and results)
                  • Number of applicable updates, importance, type
                  • Update download size and source -- CDN or LAN peers
                  • Delay upgrade status and configuration
                  • OS uninstall and rollback status and count
                  • Windows Update server and service URL
                  • Windows Update machine ID
                  • Windows Insider build details
                  +| Device update information | Information about Windows Update such as:
                  • Update Readiness analysis of device hardware, OS components, apps, and drivers (progress, status, and results)
                  • Number of applicable updates, importance, type
                  • Update download size and source - CDN or LAN peers
                  • Delay upgrade status and configuration
                  • OS uninstall and rollback status and count
                  • Windows Update server and service URL
                  • Windows Update machine ID
                  • Windows Insider build details
                  ## Browsing History data @@ -98,7 +98,7 @@ This type of data includes details about web browsing in the Microsoft browsers. | Category Name | Description and Examples | | - | - | -| Microsoft browser data | Information about Address bar and search box performance on the device such as:
                  • Text typed in address bar and search box
                  • Text selected for Ask Cortana search
                  • Service response time
                  • Auto-completed text if there was an auto-complete
                  • Navigation suggestions provided based on local history and favorites
                  • Browser ID
                  • URLs (which may include search terms)
                  • Page title
                  | +| Microsoft browser data | Information about Address bar and search box performance on the device such as:
                  • Text typed in address bar and search box
                  • Text selected for Ask Cortana search
                  • Service response time
                  • Autocompleted text if there was an autocomplete
                  • Navigation suggestions provided based on local history and favorites
                  • Browser ID
                  • URLs (which may include search terms)
                  • Page title
                  | ## Inking Typing and Speech Utterance data @@ -107,4 +107,4 @@ This type of data gathers details about the voice, inking, and typing input feat | Category Name | Description and Examples | | - | - | -| Voice, inking, and typing | Information about voice, inking and typing features such as:
                  • Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
                  • Pen gestures (click, double click, pan, zoom, rotate)
                  • Palm Touch x,y coordinates
                  • Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
                  • Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                  • Text input from Windows Mobile on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                  • Text of speech recognition results -- result codes and recognized text
                  • Language and model of the recognizer, System Speech language
                  • App ID using speech features
                  • Whether user is known to be a child
                  • Confidence and Success/Failure of speech recognition
                  | +| Voice, inking, and typing | Information about voice, inking, and typing features such as:
                  • Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
                  • Pen gestures (click, double-click, pan, zoom, rotate)
                  • Palm Touch x,y coordinates
                  • Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
                  • Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                  • Text input from Windows Mobile on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                  • Text of speech recognition results - result codes and recognized text
                  • Language and model of the recognizer, System Speech language
                  • App ID using speech features
                  • Whether user is known to be a child
                  • Confidence and Success/Failure of speech recognition
                  | diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index a8f66dc068..2fc94568eb 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -1,6 +1,6 @@ --- -title: Windows 10, version 1709 and newer diagnostic data for the Full level (Windows 10) -description: Use this article to learn about the types of diagnostic data that is collected at the Full level. +title: Windows 10, version 1709 and newer optional diagnostic data (Windows 10) +description: Use this article to learn about the types of optional diagnostic data that is collected. keywords: privacy,Windows 10 ms.prod: w10 ms.mktglfcycl: manage @@ -12,21 +12,23 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/15/2019 ms.reviewer: --- -# Windows 10, version 1709 and newer diagnostic data for the Full level +# Windows 10, version 1709 and newer optional diagnostic data Applies to: +- Windows 10, version 20H2 +- Windows 10, version 2004 +- Windows 10, version 1909 - Windows 10, version 1903 - Windows 10, version 1809 - Windows 10, version 1803 - Windows 10, version 1709 -Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1903 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). +Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 20H2 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). -In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. +In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology - Cloud computing - Cloud services and devices: Data flow, data categories, and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. The data covered in this article is grouped into the following types: @@ -50,21 +52,21 @@ Header data supports the use of data associated with all diagnostic events. Ther Information that is added to most diagnostic events, if relevant and available: -- Diagnostic level -- Basic or Full, Sample level -- for sampled data, what sample level is this device opted into (8.2.3.2.4 Observed Usage of the Service Capability) +- Diagnostic level - Basic or Full, Sample level - for sampled data, what sample level is this device opted into (8.2.3.2.4 Observed Usage of the Service Capability) - Operating system name, version, build, and locale (8.2.3.2.2 Telemetry data) - Event collection time (8.2.3.2.2 Telemetry data) -- User ID -- a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic - diagnostic data (8.2.5 Account data) +- User ID - a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic - diagnostic data (8.2.5 Account data) - Xbox UserID (8.2.5 Account data) -- Device ID -- This is not the user provided device name, but an ID that is unique for that device. (8.2.3.2.3 Connectivity data) -- Device class -- Desktop, Server, or Mobile (8.2.3.2.3 Connectivity data) -- Environment from which the event was logged -- Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time, such as the amount of time an app is running or between boots of the operating system (8.2.4 Cloud service provider data) +- Device ID - This ID is not the user provided device name, but an ID that is unique for that device. (8.2.3.2.3 Connectivity data) +- Device class - Desktop, Server, or Mobile (8.2.3.2.3 Connectivity data) +- Environment from which the event was logged - Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time, such as the amount of time an app is running or between boots of the operating system (8.2.4 Cloud service provider data) - Diagnostic event name, Event ID, ETW opcode, version, schema signature, keywords, and flags (8.2.4 Cloud service provider data) - HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service (8.2.4 Cloud service provider data) - Various IDs that are used to correlate and sequence related events together (8.2.4 Cloud service provider data) ## Device, Connectivity, and Configuration data -This type of data includes details about the device, its configuration and connectivity capabilities, and status. Device, Connectivity, and Configuration Data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.3 Connectivity data. +This type of data includes details about the device, its configuration and connectivity capabilities, and status. Device, Connectivity, and Configuration data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.3 Connectivity data. ### Data Use for Device, Connectivity, and Configuration data @@ -86,41 +88,41 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Data about device properties and capabilities is used to provide tips about how to use or configure the device to get the best performance and user experience. -- Data about device capabilities, such as whether the device is pen-enabled, is used to recommend (Microsoft and third-party) apps that are appropriate for the device. These may be free or paid apps. +- Data about device capabilities, such as whether the device is pen-enabled, is used to recommend (Microsoft and third-party) apps that are appropriate for the device. These apps might be free or paid.   ### Data Description for Device, Connectivity, and Configuration data type -**Device properties sub-type:** Information about the operating system and device hardware +**Device properties subtype:** Information about the operating system and device hardware - Operating system - version name, edition - Installation type, subscription status, and genuine operating system status - Processor architecture, speed, number of cores, manufacturer, and model -- OEM details --manufacturer, model, and serial number +- OEM details - manufacturer, model, and serial number - Device identifier and Xbox serial number -- Firmware/BIOS operating system -- type, manufacturer, model, and version -- Memory -- total memory, video memory, speed, and how much memory is available after the device has reserved memory -- Storage -- total capacity and disk type -- Battery -- charge capacity and InstantOn support +- Firmware/BIOS operating system - type, manufacturer, model, and version +- Memory - total memory, video memory, speed, and how much memory is available after the device has reserved memory +- Storage - total capacity and disk type +- Battery - charge capacity and InstantOn support - Hardware chassis type, color, and form factor -- Is this a virtual machine? +- Is this machine a virtual machine? -**Device capabilities sub-type:** Information about the capabilities of the device +**Device capabilities subtype:** Information about the capabilities of the device -- Camera -- whether the device has a front facing camera, a rear facing camera, or both. -- Touch screen -- Whether the device has a touch screen? If yes, how many hardware touch points are supported? -- Processor capabilities -- CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2 -- Trusted Platform Module (TPM) -- whether a TPM exists and if yes, what version -- Virtualization hardware -- whether an IOMMU exists, whether it includes SLAT support, and whether virtualization is enabled in the firmware -- Voice -- whether voice interaction is supported and the number of active microphones +- Camera - whether the device has a front facing camera, a rear facing camera, or both. +- Touch screen - Does the device have a touch screen? If yes, how many hardware touch points are supported? +- Processor capabilities - CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2 +- Trusted Platform Module (TPM) - whether a TPM exists and if yes, what version +- Virtualization hardware - whether an IOMMU exists, whether it includes SLAT support, and whether virtualization is enabled in the firmware +- Voice - whether voice interaction is supported and the number of active microphones - Number of displays, resolutions, and DPI - Wireless capabilities - OEM or platform face detection - OEM or platform video stabilization and quality-level set - Advanced Camera Capture mode (HDR versus Low Light), OEM versus platform implementation, HDR probability, and Low Light probability -**Device preferences and settings sub-type:** Information about the device settings and user preferences +**Device preferences and settings subtype:** Information about the device settings and user preferences -- User Settings -- System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security +- User Settings - System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security - User-provided device name - Whether device is domain-joined, or cloud-domain joined (for example, part of a company-managed network) - Hashed representation of the domain name @@ -134,7 +136,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - App store update settings - Enterprise OrganizationID, Commercial ID -**Device peripherals sub-type:** Information about the peripherals of the device +**Device peripherals subtype:** Information about the peripherals of the device - Peripheral name, device model, class, manufacturer, and description - Peripheral device state, install state, and checksum @@ -143,7 +145,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Driver state, problem code, and checksum - Whether driver is kernel mode, signed, and image size -**Device network info sub-type:** Information about the device network configuration +**Device network info subtype:** Information about the device network configuration - Network system capabilities - Local or Internet connectivity status @@ -168,7 +170,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO) - Mobile operator and service provider name - Available SSIDs and BSSIDs -- IP Address type -- IPv4 or IPv6 +- IP Address type - IPv4 or IPv6 - Signal Quality percentage and changes - Hotspot presence detection and success rate - TCP connection performance @@ -176,7 +178,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Hashed IP address ## Product and Service Usage data -This type of data includes details about the usage of the device, operating system, applications and services. Product and Service Usage data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.4 Observed Usage of the Service Capability. +This type of data includes details about the usage of the device, operating system, applications, and services. Product and Service Usage data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.4 Observed Usage of the Service Capability. ### Data Use for Product and Service Usage data @@ -193,16 +195,16 @@ This type of data includes details about the usage of the device, operating syst **With (optional) Tailored experiences:**
                  If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Usage data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Usage data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example: -- If data shows that a user has not used a particular feature of Windows, we may recommend that the user try that feature. -- Data about which apps are most-used on a device is used to provide recommendations for similar or complementary (Microsoft or third-party) apps. These may be free or paid apps. +- If data shows that a user has not used a particular feature of Windows, we might recommend that the user try that feature. +- Data about which apps are most-used on a device is used to provide recommendations for similar or complementary (Microsoft or third-party) apps. These apps might be free or paid. ### Data Description for Product and Service Usage data type -**App usage sub-type:** Information about Windows and application usage +**App usage subtype:** Information about Windows and application usage - Operating system component and app feature usage -- User navigation and interaction with app and Windows features. This could potentially include user input, such as name of a new alarm set, user menu choices, or user favorites +- User navigation and interaction with app and Windows features. This information could include user input, such as the name of a new alarm set, user menu choices, or user favorites - Time of and count of app and component launches, duration of use, session GUID, and process ID - App time in various states –- running in the foreground or background, sleeping, or receiving active user interaction - User interaction method and duration –- whether the user used a keyboard, mouse, pen, touch, speech, or game controller, and for how long @@ -213,9 +215,9 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Incoming and outgoing calls and voicemail usage statistics on primary or secondary lines - Emergency alerts are received or displayed statistics - Content searches within an app -- Reading activity -- bookmarked, printed, or had the layout changed +- Reading activity - bookmarked, printed, or had the layout changed -**App or product state sub-type:** Information about Windows and application state +**App or product state subtype:** Information about Windows and application state - Start Menu and Taskbar pins - Online and offline status @@ -223,18 +225,18 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Personalization impressions delivered - Whether the user clicked on, or hovered over, UI controls or hotspots - User provided feedback, such as Like, Dislike or a rating -- Caret location or position within documents and media files -- how much has been read in a book in a single session, or how much of a song has been listened to. +- Caret location or position within documents and media files - how much has been read in a book in a single session, or how much of a song has been listened to. -**Purchasing sub-type:** Information about purchases made on the device +**Purchasing subtype:** Information about purchases made on the device -- Product ID, edition ID and product URI -- Offer details -- price +- Product ID, edition ID, and product URI +- Offer details - price - Date and time an order was requested -- Microsoft Store client type -- web or native client +- Microsoft Store client type - web or native client - Purchase quantity and price -- Payment type -- credit card type and PayPal +- Payment type - credit card type and PayPal -**Login properties sub-type:** Information about logins on the device +**Login properties subtype:** Information about logins on the device - Login success or failure - Login sessions and state @@ -248,7 +250,7 @@ This type of data includes details about the health of the device, operating sys [Pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example: - Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations. -- Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening peformance. +- Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening performance. - Timing data about how quickly the facial recognition feature starts up and finishes is used to improve facial recognition performance. - Data about when an Application Window fails to appear is used to investigate issues with Application Window reliability and performance. @@ -257,21 +259,21 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Data about battery performance on a device may be used to recommend settings changes that can improve battery performance. - If data shows a device is running low on file storage, we may recommend Windows-compatible cloud storage solutions to free up space. -- If data shows the device is experiencing performance issues, we may provide recommendations for Windows apps that can help diagnose or resolve these issues. These may be free or paid apps. +- If data shows the device is experiencing performance issues, we may provide recommendations for Windows apps that can help diagnose or resolve these issues. These apps might be free or paid. **Microsoft doesn't use crash and hang dump data to [personalize](#personalize), [recommend](#recommend), [offer](#offer), or [promote](#promote) any product or service.** ### Data Description for Product and Service Performance data type -**Device health and crash data sub-type:** Information about the device and software health +**Device health and crash data subtype:** Information about the device and software health - Error codes and error messages, name and ID of the app, and process reporting the error -- DLL library predicted to be the source of the error -- for example, xyz.dll -- System generated files -- app or product logs and trace files to help diagnose a crash or hang +- DLL library predicted to be the source of the error - for example, xyz.dll +- System-generated files - app or product logs and trace files to help diagnose a crash or hang - System settings, such as registry keys -- User generated files -- files that are indicated as a potential cause for a crash or hang. For example, .doc, .ppt, .csv files +- User-generated files - files that are indicated as a potential cause for a crash or hang. For example, .doc, .ppt, .csv files - Details and counts of abnormal shutdowns, hangs, and crashes -- Crash failure data -- operating system, operating system component, driver, device, and 1st and 3rd-party app data +- Crash failure data - operating system, operating system component, driver, device, and first-party and third-party app data - Crash and hang dumps, including: - The recorded state of the working memory at the point of the crash - Memory in-use by the kernel at the point of the crash. @@ -279,43 +281,43 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - All the physical memory used by Windows at the point of the crash - Class and function name within the module that failed. -**Device performance and reliability data sub-type:** Information about the device and software performance +**Device performance and reliability data subtype:** Information about the device and software performance -- User interface interaction durations -- Start menu display times, browser tab switch times, app launch and switch times, and Cortana and Search performance and reliability -- Device on and off performance -- Device boot, shutdown, power on and off, lock and unlock times, and user authentication times (fingerprint and face recognition durations) -- In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction -- User input responsiveness -- onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score -- UI and media performance and glitches versus smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance -- Disk footprint -- Free disk space, out of memory conditions, and disk score -- Excessive resource utilization -- components impacting performance or battery life through high CPU usage during different screen and power states -- Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results -- Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness, and environmental response times -- Device setup -- first setup experience times (time to install updates, install apps, connect to network, and so on), time to recognize connected devices (printer and monitor), and time to set up a Microsoft Account -- Power and Battery life -- power draw by component (Process/CPU/GPU/Display), hours of time the screen is off, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use while the screen is off, auto-brightness details, time device is plugged into AC versus battery, and battery state transitions -- Service responsiveness -- Service URI, operation, latency, service success and error codes, and protocol -- Diagnostic heartbeat -- regular signal used to validate the health of the diagnostics system +- User interface interaction durations - Start menu display times, browser tab switch times, app launch and switch times, and Cortana and Search performance and reliability +- Device on and off performance - Device boot, shutdown, power on and off, lock and unlock times, and user authentication times (fingerprint and face recognition durations) +- In-app responsiveness - time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction +- User input responsiveness - onscreen keyboard invocation times for different languages, time to show autocomplete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score +- UI and media performance and glitches versus smoothness - video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance +- Disk footprint - Free disk space, out of memory conditions, and disk score +- Excessive resource utilization - components impacting performance or battery life through high CPU usage during different screen and power states +- Background task performance - download times, Windows Update scan duration, Microsoft Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results +- Peripheral and devices - USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness, and environmental response times +- Device setup - first setup experience times (time to install updates, install apps, connect to network, and so on), time to recognize connected devices (printer and monitor), and time to set up a Microsoft Account +- Power and Battery life - power draw by component (Process/CPU/GPU/Display), hours of time the screen is off, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use while the screen is off, autobrightness details, time device is plugged into AC versus battery, and battery state transitions +- Service responsiveness - Service URI, operation, latency, service success and error codes, and protocol +- Diagnostic heartbeat - regular signal used to validate the health of the diagnostics system -**Movies sub-type:** Information about movie consumption functionality on the device +**Movies subtype:** Information about movie consumption functionality on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. - Video Width, height, color palette, encoding (compression) type, and encryption type -- Instructions about how to stream content for the user -- the smooth streaming manifest of content file chunks that must be pieced together to stream the content based on screen resolution and bandwidth +- Instructions about how to stream content for the user - the smooth streaming manifest of content file chunks that must be pieced together to stream the content based on screen resolution and bandwidth - URL for a specific two-second chunk of content if there is an error - Full-screen viewing mode details -**Music & TV sub-type:** Information about music and TV consumption on the device +**Music & TV subtype:** Information about music and TV consumption on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. -- Service URL for song being downloaded from the music service -- collected when an error occurs to facilitate restoration of service +- Service URL for song being downloaded from the music service - collected when an error occurs to facilitate restoration of service - Content type (video, audio, or surround audio) -- Local media library collection statistics -- number of purchased tracks and number of playlists -- Region mismatch -- User's operating system region and Xbox Live region +- Local media library collection statistics - number of purchased tracks and number of playlists +- Region mismatch - User's operating system region and Xbox Live region -**Reading sub-type:** Information about reading consumption functionality on the device +**Reading subtype:** Information about reading consumption functionality on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. @@ -325,42 +327,42 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Time spent reading content - Content type and size details -**Photos app sub-type:** Information about photos usage on the device +**Photos app subtype:** Information about photos usage on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. -- File source data -- local, SD card, network device, and OneDrive +- File source data - local, SD card, network device, and OneDrive - Image and video resolution, video length, file sizes types, and encoding - Collection view or full screen viewer use and duration of view -**On-device file query sub-type:** Information about local search activity on the device +**On-device file query subtype:** Information about local search activity on the device -- Kind of query issued and index type (ConstraintIndex or SystemIndex) +- Type of query issued and index type (ConstraintIndex or SystemIndex) - Number of items requested and retrieved - File extension of search result with which the user interacted - Launched item type, file extension, index of origin, and the App ID of the opening app - Name of process calling the indexer and the amount of time to service the query - A hash of the search scope (file, Outlook, OneNote, or IE history). The state of the indices (fully optimized, partially optimized, or being built) -**Entitlements sub-type:** Information about entitlements on the device +**Entitlements subtype:** Information about entitlements on the device - Service subscription status and errors -- DRM and license rights details -- Groove subscription or operating system volume license +- DRM and license rights details - Groove subscription or operating system volume license - Entitlement ID, lease ID, and package ID of the install package - Entitlement revocation - License type (trial, offline versus online) and duration - License usage session ## Software Setup and Inventory data -This type of data includes software installation and update information on the device. Software Setup and Inventory Data is a sub-type of ISO/IEC 19944:2017 8.2.3.2.4 Observed Usage of the Service Capability. +This type of data includes software installation and update information on the device. Software Setup and Inventory Data is a subtype of ISO/IEC 19944:2017 8.2.3.2.4 Observed Usage of the Service Capability. ### Data Use for Software Setup and Inventory data **For Diagnostics:**
                  [Pseudonymized](#pseudo) Software Setup and Inventory data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example: -- Data about the specific drivers that are installed on a device is used to understand whether there are any hardware or driver compatibility issues which should block or delay a Windows update. +- Data about the specific drivers that are installed on a device is used to understand whether there are any hardware or driver compatibility issues that should block or delay a Windows update. - Data about when a download starts and finishes on a device is used to understand and address download problems. - Data about the specific Microsoft Store apps that are installed on a device is used to determine which app updates to provide to the device. - Data about the antimalware installed on a device is used to understand malware transmissions vectors. @@ -372,7 +374,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud ### Data Description for Software Setup and Inventory data type -**Installed applications and install history sub-type:** Information about apps, drivers, update packages, or operating system components installed on the device +**Installed applications and install history subtype:** Information about apps, drivers, update packages, or operating system components installed on the device - App, driver, update package, or component’s Name, ID, or Package Family Name - Product, SKU, availability, catalog, content, and Bundle IDs @@ -381,13 +383,13 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - MSI package and product code - Original operating system version at install time - User, administrator, or mandatory installation or update -- Installation type -- clean install, repair, restore, OEM, retail, upgrade, or update +- Installation type - clean install, repair, restore, OEM, retail, upgrade, or update -**Device update information sub-type:** Information about apps, drivers, update packages, or operating system components installed on the device +**Device update information subtype:** Information about apps, drivers, update packages, or operating system components installed on the device - Update Readiness analysis of device hardware, operating system components, apps, and drivers (progress, status, and results) - Number of applicable updates, importance, and type -- Update download size and source -- CDN or LAN peers +- Update download size and source - CDN or LAN peers - Delay upgrade status and configuration - Operating system uninstall and rollback status and count - Windows Update server and service URL @@ -395,7 +397,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Windows Insider build details ## Browsing History data -This type of data includes details about web browsing in the Microsoft browsers. Browsing History data is equivalent to ISO/IEC 19944:2017 8.2.3.2.8 Client side browsing history. +This type of data includes details about web browsing in the Microsoft browsers. Browsing History data is equivalent to ISO/IEC 19944:2017 8.2.3.2.8 Client-side browsing history. ### Data Use for Browsing History data @@ -411,23 +413,23 @@ This type of data includes details about web browsing in the Microsoft browsers. **With (optional) Tailored experiences:**
                  If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Browsing History data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Browsing History data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example: -- We may recommend that a user download a compatible app from the Microsoft Store if they have browsed to the related website. For example, if a user uses the Facebook website, we may recommend the Facebook app. +- We might recommend that a user download a compatible app from the Microsoft Store if they have browsed to the related website. For example, if a user uses the Facebook website, we may recommend the Facebook app. ### Data Description for Browsing History data type -**Microsoft browser data sub-type:** Information about **Address** bar and **Search** box performance on the device +**Microsoft browser data subtype:** Information about **Address** bar and **Search** box performance on the device - Text typed in **Address** bar and **Search** box - Text selected for an Ask Cortana search - Service response time -- Auto-completed text, if there was an auto-complete +- Autocompleted text, if there was an autocomplete - Navigation suggestions provided based on local history and favorites - Browser ID - URLs (may include search terms) - Page title ## Inking Typing and Speech Utterance data -This type of data gathers details about the voice, inking, and typing input features on the device. Inking, Typing and Speech Utterance data is a sub-type of ISO/IEC 19944:2017 8.2.3.2.1 End User Identifiable information. +This type of data gathers details about the voice, inking, and typing input features on the device. Inking, Typing, and Speech Utterance data is a subtype of ISO/IEC 19944:2017 8.2.3.2.1 End User Identifiable information. ### Data Use for Inking, Typing, and Speech Utterance data @@ -436,7 +438,7 @@ This type of data gathers details about the voice, inking, and typing input feat - Data about words marked as spelling mistakes and replaced with another word from the context menu is used to improve the spelling feature. - Data about alternate words shown and selected by the user after right-clicking is used to improve the word recommendation feature. -- Data about auto-corrected words that were restored back to the original word by the user is used to improve the auto-correct feature. +- Data about autocorrected words that were restored back to the original word by the user is used to improve the autocorrect feature. - Data about whether Narrator detected and recognized a touch gesture is used to improve touch gesture recognition. - Data about handwriting samples sent from the Handwriting Panel is used to help Microsoft improve handwriting recognition. @@ -446,15 +448,15 @@ This type of data gathers details about the voice, inking, and typing input feat ### Data Description for Inking, Typing, and Speech Utterance data type -**Voice, inking, and typing sub-type:** Information about voice, inking and typing features +**Voice, inking, and typing subtype:** Information about voice, inking, and typing features - Type of pen used (highlighter, ball point, or pencil), pen color, stroke height and width, and how long it is used - Pen gestures (click, double click, pan, zoom, or rotate) - Palm Touch x,y coordinates - Input latency, missed pen signals, number of frames, strokes, first frame commit time, and sample rate -- Ink strokes written, text before and after the ink insertion point, recognized text entered, input language -- processed to remove identifiers, sequencing information, and other data (such as email addresses and - numeric values), which could be used to reconstruct the original content or associate the input to the user -- Text input from Windows 10 Mobile on-screen keyboards, except from password fields and private sessions -- processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values), which could be used to reconstruct the original content or associate the input to the user -- Text of speech recognition results -- result codes and recognized text +- Ink strokes written, text before and after the ink insertion point, recognized text entered, input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and - numeric values), which could be used to reconstruct the original content or associate the input to the user +- Text input from Windows 10 Mobile on-screen keyboards, except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values), which could be used to reconstruct the original content or associate the input to the user +- Text of speech recognition results - result codes and recognized text - Language and model of the recognizer and the System Speech language - App ID using speech features - Whether user is known to be a child @@ -494,9 +496,9 @@ Use of the specified data categories give recommendations about Microsoft produc ISO/IEC 19944:2017 Reference: **9.3.5 Offer upgrades or upsell** -Implies the source of the data is Microsoft products and services, and the upgrades offered come from Microsoft products and services that are relevant to the context of the current capability. The target audience for the offer is Microsoft customers. +Implies that the source of the data is Microsoft products and services, and the upgrades offered come from Microsoft products and services that are relevant to the context of the current capability. The target audience for the offer is Microsoft customers. -Specifically, use of the specified data categories to make an offer or upsell new capability or capacity of a Microsoft product or service which is (i) contextually relevant to the product or service in which it appears; (ii) likely to result in additional future revenue for Microsoft from end user; and (iii) Microsoft receives no consideration for placement. +Specifically, use of the specified data categories to make an offer or upsell new capability or capacity of a Microsoft product or service that is (i) contextually relevant to the product or service in which it appears; (ii) likely to result in additional future revenue for Microsoft from end user; and (iii) Microsoft receives no consideration for placement. ### Promote @@ -506,7 +508,7 @@ Use of the specified data categories to promote a product or service in or on a ### Data identification qualifiers -Here are the list of data identification qualifiers and the ISO/IEC 19944:2017 reference: +Here are the data identification qualifiers and the ISO/IEC 19944:2017 reference: - **Pseudonymized Data** 8.3.3 Pseudonymized data. Microsoft usage notes are as defined. - **Anonymized Data** 8.3.5 Anonymized data. Microsoft usage notes are as defined. diff --git a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md index 2d1b7a1a36..944800a1d5 100644 --- a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md @@ -1,6 +1,6 @@ --- title: Windows 10, version 1709, connection endpoints for non-Enterprise editions -description: Explains what Windows 10 endpoints are used in non-Enterprise editions. +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1709. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -23,7 +23,7 @@ ms.reviewer: - Windows 10 Professional, version 1709 - Windows 10 Education, version 1709 -In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-endpoints.md), the following endpoints are available on other editions of Windows 10, version 1709. +In addition to the endpoints listed for [Windows 10 Enterprise](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services), the following endpoints are available on other editions of Windows 10, version 1709. We used the following methodology to derive these network endpoints: @@ -65,7 +65,7 @@ We used the following methodology to derive these network endpoints: | candycrushsoda.king.com | TLSv1.2 | Used for Candy Crush Saga updates. | | cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. | | cdn.onenote.net | HTTP | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net | HTTP | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net | HTTP | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com | HTTP | Used to retrieve Skype configuration values. | | ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. | @@ -157,7 +157,7 @@ We used the following methodology to derive these network endpoints: | candycrushsoda.king.com | HTTPS | Used for Candy Crush Saga updates. | | cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. | | cdn.onenote.net | HTTPS | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. | | ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). | @@ -167,7 +167,7 @@ We used the following methodology to derive these network endpoints: | definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. | | displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | | download.windowsupdate.com | HTTP | Enables connections to Windows Update. | -| evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office. | +| evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | @@ -255,7 +255,7 @@ We used the following methodology to derive these network endpoints: | cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. | | dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | download.windowsupdate.com | HTTP | Enables connections to Windows Update. | -| evoke-windowsservices-tas.msedge.net/ab | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office. | +| evoke-windowsservices-tas.msedge.net/ab | HTTPS | Used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | diff --git a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md index 885bdb44c7..a93b73468f 100644 --- a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md @@ -1,6 +1,6 @@ --- title: Windows 10, version 1803, connection endpoints for non-Enterprise editions -description: Explains what Windows 10 endpoints are used in non-Enterprise editions. +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1803. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -23,7 +23,7 @@ ms.reviewer: - Windows 10 Professional, version 1803 - Windows 10 Education, version 1803 -In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-endpoints.md), the following endpoints are available on other editions of Windows 10, version 1803. +In addition to the endpoints listed for [Windows 10 Enterprise](https://docs.microsoft.com/windows/privacy/manage-windows-1803-endpoints ), the following endpoints are available on other editions of Windows 10, version 1803. We used the following methodology to derive these network endpoints: @@ -47,7 +47,7 @@ We used the following methodology to derive these network endpoints: | *.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ | HTTP | Enables connections to Windows Update. | | arc.msn.com.nsatc.net | HTTPS | Used to retrieve Windows Spotlight metadata. | | arc.msn.com/v3/Delivery/Placement | HTTPS | Used to retrieve Windows Spotlight metadata. | -| client-office365-tas.msedge.net* | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net* | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com/config/* | HTTPS | Used to retrieve Skype configuration values. | | ctldl.windowsupdate.com/msdownload/update* | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cy2.displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store. | @@ -67,7 +67,7 @@ We used the following methodology to derive these network endpoints: | location-inference-westus.cloudapp.net | HTTPS | Used for location data. | | maps.windows.com/windows-app-web-link | HTTPS | Link to Maps application. | | modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. | -| ocos-office365-s2s.msedge.net* | HTTPS | Used to connect to the Office 365 portal's shared infrastructure. | +| ocos-office365-s2s.msedge.net* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure. | | ocsp.digicert.com* | HTTP | CRL and OCSP checks to the issuing certificate authorities. | | oneclient.sfx.ms* | HTTPS | Used by OneDrive for Business to download and verify app updates. | | onecollector.cloudapp.aria.akadns.net | HTTPS | Office Telemetry | @@ -129,7 +129,7 @@ We used the following methodology to derive these network endpoints: | *geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | au.download.windowsupdate.com* | HTTP | Enables connections to Windows Update. | | cdn.onenote.net/livetile/* | HTTPS | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | cloudtile.photos.microsoft.com.akadns.net | HTTPS | Photos App in MS Store | config.edge.skype.com/* | HTTPS | Used to retrieve Skype configuration values.  | | ctldl.windowsupdate.com/* | HTTP | Used to download certificates that are publicly known to be fraudulent. | @@ -149,7 +149,7 @@ We used the following methodology to derive these network endpoints: | licensing.mp.microsoft.com/* | HTTPS | Used for online activation and some app licensing. | | maps.windows.com/windows-app-web-link | HTTPS | Link to Maps application | | modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. | -| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Office 365 portal's shared infrastructure. | +| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure. | | ocsp.digicert.com* | HTTP | CRL and OCSP checks to the issuing certificate authorities. | | oneclient.sfx.ms/* | HTTPS | Used by OneDrive for Business to download and verify app updates. | | onecollector.cloudapp.aria.akadns.net | HTTPS | Office telemetry | diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md index d7ad47c4a1..aea47d78e8 100644 --- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md @@ -1,6 +1,6 @@ --- title: Windows 10, version 1809, connection endpoints for non-Enterprise editions -description: Explains what Windows 10 endpoints are used in non-Enterprise editions. +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1809. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -65,7 +65,7 @@ We used the following methodology to derive these network endpoints: |\*wns.windows.com\* | HTTPS, TLSv1.2 | Used for the Windows Push Notification Services (WNS). |\*wpc.v0cdn.net* | | Windows Telemetry related traffic |auth.gfx.ms/16.000.27934.1/OldConvergedLogin_PCore.js | | MSA related -|evoke-windowsservices-tas.msedge* | HTTPS | The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +|evoke-windowsservices-tas.msedge* | HTTPS | The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. |fe2.update.microsoft.com\* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |fe3.\*.mp.microsoft.com.\* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |fs.microsoft.com | | Font Streaming (in ENT traffic) @@ -133,7 +133,7 @@ We used the following methodology to derive these network endpoints: | *geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | au.download.windowsupdate.com\* | HTTP | Enables connections to Windows Update. | | cdn.onenote.net/livetile/* | HTTPS | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com/* | HTTPS | Used to retrieve Skype configuration values.  | | ctldl.windowsupdate.com/* | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cy2.displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store. | @@ -151,7 +151,7 @@ We used the following methodology to derive these network endpoints: | licensing.mp.microsoft.com/* | HTTPS | Used for online activation and some app licensing. | | maps.windows.com/windows-app-web-link | HTTPS | Link to Maps application | | modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. | -| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Office 365 portal's shared infrastructure. | +| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure. | | ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities. | | oneclient.sfx.ms/* | HTTPS | Used by OneDrive for Business to download and verify app updates. | | settings-win.data.microsoft.com/settings/* | HTTPS | Used as a way for apps to dynamically update their configuration. | diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md index 96f81d22ed..da43880ca5 100644 --- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md @@ -1,6 +1,6 @@ --- title: Windows 10, version 1903, connection endpoints for non-Enterprise editions -description: Explains what Windows 10 endpoints are used in non-Enterprise editions. +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1903. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -8,12 +8,13 @@ ms.sitesec: library ms.localizationpriority: high audience: ITPro author: mikeedgar -ms.author: v-medgar -manager: sanashar +ms.author: obezeajo +manager: robsize ms.collection: M365-security-compliance ms.topic: article -ms.date: 5/9/2019 +ms.date: 7/22/2020 --- + # Windows 10, version 1903, connection endpoints for non-Enterprise editions **Applies to** @@ -26,14 +27,14 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-1 The following methodology was used to derive the network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. -7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. -8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using an IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. > [!NOTE] @@ -41,234 +42,235 @@ The following methodology was used to derive the network endpoints: ## Windows 10 Family -| **Destination** | **Protocol** | **Description** | -| --- | --- | --- | -|\*.aria.microsoft.com*|HTTPS|Microsoft Office Telemetry -|\*.b.akamai*.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use -|\*.c-msedge.net|HTTP|Microsoft Office -|\*.dl.delivery.mp.microsoft.com*|HTTP|Enables connections to Windows Update -|\*.download.windowsupdate.com*|HTTP|Used to download operating system patches and updates -|\*.g.akamai*.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use -|\*.login.msa.*.net|HTTPS|Microsoft Account related -|\*.msn.com*|TLSv1.2/HTTPS|Windows Spotlight -|\*.skype.com|HTTP/HTTPS|Skype -|\*.smartscreen.microsoft.com*|HTTPS|Windows Defender Smartscreen -|\*.telecommand.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting -|*cdn.onenote.net*|HTTP|OneNote -|*displaycatalog.*mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store -|*emdl.ws.microsoft.com*|HTTP|Windows Update -|*geo-prod.do.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update -|*hwcdn.net*|HTTP|Highwinds Content Delivery Network / Windows updates -|*img-prod-cms-rt-microsoft-com*|HTTPS|Microsoft Store or Inbox MSN Apps image download -|*licensing.*mp.microsoft.com*|HTTPS|Licensing -|*maps.windows.com*|HTTPS|Related to Maps application -|*msedge.net*|HTTPS|Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps -|*nexusrules.officeapps.live.com*|HTTPS|Microsoft Office Telemetry -|*photos.microsoft.com*|HTTPS|Photos App -|*prod.do.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Used for Windows Update downloads of apps and OS updates -|*purchase.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|*settings.data.microsoft.com.akadns.net|HTTPS|Used for Windows apps to dynamically update their configuration -|*wac.phicdn.net*|HTTP|Windows Update -|*windowsupdate.com*|HTTP|Windows Update -|*wns.*windows.com*|TLSv1.2/HTTPS|Used for the Windows Push Notification Services (WNS) -|*wpc.v0cdn.net*|HTTP|Windows Telemetry -|arc.msn.com|HTTPS|Spotlight -|auth.gfx.ms*|HTTPS|MSA related -|cdn.onenote.net|HTTPS|OneNote Live Tile -|dmd.metaservices.microsoft.com*|HTTP|Device Authentication -|e-0009.e-msedge.net|HTTPS|Microsoft Office -|e10198.b.akamaiedge.net|HTTPS|Maps application -|evoke-windowsservices-tas.msedge*|HTTPS|Photos app -|fe2.update.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store -|fe3.*.mp.microsoft.com.*|TLSv1.2/HTTPS|Windows Update, Microsoft Update, and Microsoft Store services -|g.live.com*|HTTPS|OneDrive -|go.microsoft.com|HTTP|Windows Defender -|iriscoremetadataprod.blob.core.windows.net|HTTPS|Windows Telemetry -|login.live.com|HTTPS|Device Authentication -|msagfx.live.com|HTTP|OneDrive -|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|officeclient.microsoft.com|HTTPS|Microsoft Office -|oneclient.sfx.ms*|HTTPS|Used by OneDrive for Business to download and verify app updates -|onecollector.cloudapp.aria.akadns.net|HTTPS|Microsoft Office -|ow1.res.office365.com|HTTP|Microsoft Office -|pti.store.microsoft.com|HTTPS|Microsoft Store -|purchase.mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store -|query.prod.cms.rt.microsoft.com*|HTTPS|Used to retrieve Windows Spotlight metadata -|ris.api.iris.microsoft.com*|TLSv1.2/HTTPS|Used to retrieve Windows Spotlight metadata -|ris-prod-atm.trafficmanager.net|HTTPS|Azure traffic manager -|s-0001.s-msedge.net|HTTPS|Microsoft Office -|self.events.data.microsoft.com|HTTPS|Microsoft Office -|settings.data.microsoft.com*|HTTPS|Used for Windows apps to dynamically update their configuration -|settings-win.data.microsoft.com*|HTTPS|Used for Windows apps to dynamically update their configuration -|share.microsoft.com|HTTPS|Microsoft Store -|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Microsoft Store -|sls.update.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update -|slscr.update.microsoft.com*|HTTPS|Enables connections to Windows Update -|store*.dsx.mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store -|storecatalogrevocation.storequality.microsoft.com|HTTPS|Microsoft Store -|storecatalogrevocation.storequality.microsoft.com*|HTTPS|Used to revoke licenses for malicious apps on the Microsoft Store -|store-images.*microsoft.com*|HTTP|Used to get images that are used for Microsoft Store suggestions -|storesdk.dsx.mp.microsoft.com|HTTP|Microsoft Store -|tile-service.weather.microsoft.com*|HTTP|Used to download updates to the Weather app Live Tile -|time.windows.com|HTTP|Microsoft Windows Time related -|tsfe.trafficshaping.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Used for content regulation -|v10.events.data.microsoft.com|HTTPS|Diagnostic Data -|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data -|wdcp.microsoft.*|TLSv1.2, HTTPS|Used for Windows Defender when Cloud-based Protection is enabled -|wd-prod-cp-us-west-1-fe.westus.cloudapp.azure.com|HTTPS|Windows Defender -|wusofficehome.msocdn.com|HTTPS|Microsoft Office -|www.bing.com*|HTTP|Used for updates for Cortana, apps, and Live Tiles -|www.msftconnecttest.com|HTTP|Network Connection (NCSI) -|www.office.com|HTTPS|Microsoft Office +| Destination | Protocol | Description | +| ----------- | -------- | ----------- | +| \*.aria.microsoft.com\* | HTTPS | Microsoft Office Telemetry +| \*.b.akamai\*.net | HTTPS | Used to check for updates to Maps that have been downloaded for offline use +| \*.c-msedge.net | HTTP | Microsoft Office +| \*.dl.delivery.mp.microsoft.com\* | HTTP | Enables connections to Windows Update +| \*.download.windowsupdate.com\* | HTTP | Used to download operating system patches and updates +| \*.g.akamai\*.net | HTTPS | Used to check for updates to Maps that have been downloaded for offline use +| \*.login.msa.\*.net | HTTPS | Microsoft Account related +| \*.msn.com\* | TLSv1.2/HTTPS | Windows Spotlight +| \*.skype.com | HTTP/HTTPS | Skype +| \*.smartscreen.microsoft.com\* | HTTPS | Windows Defender Smartscreen +| \*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting +| \*cdn.onenote.net\* | HTTP | OneNote +| \*displaycatalog.\*mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store +| \*emdl.ws.microsoft.com\* | HTTP | Windows Update +| \*geo-prod.do.dsp.mp.microsoft.com\* | TLSv1.2/HTTPS | Enables connections to Windows Update +| \*hwcdn.net\* | HTTP | Highwinds Content Delivery Network / Windows updates +| \*img-prod-cms-rt-microsoft-com\* | HTTPS | Microsoft Store or Inbox MSN Apps image download +| \*licensing.\*mp.microsoft.com\* | HTTPS | Licensing +| \*maps.windows.com\* | HTTPS | Related to Maps application +| \*msedge.net\* | HTTPS | Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps +| \*nexusrules.officeapps.live.com\* | HTTPS | Microsoft Office Telemetry +| \*photos.microsoft.com\* | HTTPS | Photos App +| \*prod.do.dsp.mp.microsoft.com* | TLSv1.2/HTTPS | Used for Windows Update downloads of apps and OS updates +| \*purchase.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| \*settings.data.microsoft.com.akadns.net | HTTPS | Used for Windows apps to dynamically update their configuration +| \*wac.phicdn.net\* | HTTP | Windows Update +| \*windowsupdate.com\* | HTTP | Windows Update +| \*wns.\*windows.com\* | TLSv1.2/HTTPS | Used for the Windows Push Notification Services (WNS) +| \*wpc.v0cdn.net\* | HTTP | Windows Telemetry +| arc.msn.com | HTTPS | Spotlight +| auth.gfx.ms\* | HTTPS | MSA related +| cdn.onenote.net | HTTPS | OneNote Live Tile +| dmd.metaservices.microsoft.com\* | HTTP | Device Authentication +| e-0009.e-msedge.net | HTTPS | Microsoft Office +| e10198.b.akamaiedge.net | HTTPS | Maps application +| evoke-windowsservices-tas.msedge\* | HTTPS | Photos app +| fe2.update.microsoft.com\* | TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +| fe3.\*.mp.microsoft.com.\* | TLSv1.2/HTTPS | Windows Update, Microsoft Update, and Microsoft Store services +| g.live.com\* | HTTPS | OneDrive +| go.microsoft.com | HTTP | Windows Defender +| iriscoremetadataprod.blob.core.windows.net | HTTPS | Windows Telemetry +| login.live.com | HTTPS | Device Authentication +| msagfx.live.com | HTTP | OneDrive +| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| officeclient.microsoft.com | HTTPS | Microsoft Office +| oneclient.sfx.ms\* | HTTPS | Used by OneDrive for Business to download and verify app updates +| onecollector.cloudapp.aria.akadns.net | HTTPS | Microsoft Office +| ow1.res.office365.com | HTTP | Microsoft Office +| pti.store.microsoft.com | HTTPS | Microsoft Store +| purchase.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store +| query.prod.cms.rt.microsoft.com\* | HTTPS | Used to retrieve Windows Spotlight metadata +| ris.api.iris.microsoft.com\* | TLSv1.2/HTTPS | Used to retrieve Windows Spotlight metadata +| ris-prod-atm.trafficmanager.net | HTTPS | Azure traffic manager +| s-0001.s-msedge.net | HTTPS | Microsoft Office +| self.events.data.microsoft.com | HTTPS | Microsoft Office +| settings.data.microsoft.com\* | HTTPS | Used for Windows apps to dynamically update their configuration +| settings-win.data.microsoft.com\* | HTTPS | Used for Windows apps to dynamically update their configuration +| share.microsoft.com | HTTPS | Microsoft Store +| skypeecs-prod-usw-0.cloudapp.net | HTTPS | Microsoft Store +| sls.update.microsoft.com\* | TLSv1.2/HTTPS | Enables connections to Windows Update +| slscr.update.microsoft.com\* | HTTPS | Enables connections to Windows Update +| store*.dsx.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store +| storecatalogrevocation.storequality.microsoft.com | HTTPS | Microsoft Store +| storecatalogrevocation.storequality.microsoft.com\* | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store +| store-images.\*microsoft.com\* | HTTP | Used to get images that are used for Microsoft Store suggestions +| storesdk.dsx.mp.microsoft.com | HTTP | Microsoft Store +| tile-service.weather.microsoft.com\* | HTTP | Used to download updates to the Weather app Live Tile +| time.windows.com | HTTP | Microsoft Windows Time related +| tsfe.trafficshaping.dsp.mp.microsoft.com\* | TLSv1.2/HTTPS | Used for content regulation +| v10.events.data.microsoft.com | HTTPS | Diagnostic Data +| watson.telemetry.microsoft.com | HTTPS | Diagnostic Data +| wdcp.microsoft.\* | TLSv1.2, HTTPS | Used for Windows Defender when Cloud-based Protection is enabled +| wd-prod-cp-us-west-1-fe.westus.cloudapp.azure.com | HTTPS | Windows Defender +| wusofficehome.msocdn.com | HTTPS | Microsoft Office +| `www.bing.com`* | HTTP | Used for updates for Cortana, apps, and Live Tiles +| `www.msftconnecttest.com` | HTTP | Network Connection (NCSI) +| `www.office.com` | HTTPS | Microsoft Office +| adl.windows.com | HTTP | Used for compatibility database updates for Windows +| windows.policies.live.net | HTTP | OneDrive ## Windows 10 Pro -| **Destination** | **Protocol** | **Description** | -| --- | --- | --- | -|\*.cloudapp.azure.com|HTTPS|Azure -|\*.delivery.dsp.mp.microsoft.com.nsatc.net|HTTPS|Windows Update, Microsoft Update, and Microsoft Store services -|\*.displaycatalog.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*.dl.delivery.mp.microsoft.com*|HTTP|Enables connections to Windows Update -|\*.e-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.g.akamaiedge.net|HTTPS|Used to check for updates to maps that have been downloaded for offline use -|\*.s-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.windowsupdate.com*|HTTP|Enables connections to Windows Update -|\*.wns.notify.windows.com.akadns.net|HTTPS|Used for the Windows Push Notification Services (WNS) -|\*dsp.mp.microsoft.com.nsatc.net|HTTPS|Enables connections to Windows Update -|\*c-msedge.net|HTTP|Office -|a1158.g.akamai.net|HTTP|Maps application -|arc.msn.com*|HTTP / HTTPS|Used to retrieve Windows Spotlight metadata -|blob.mwh01prdstr06a.store.core.windows.net|HTTPS|Microsoft Store -|browser.pipe.aria.microsoft.com|HTTPS|Microsoft Office -|bubblewitch3mobile.king.com|HTTPS|Bubble Witch application -|candycrush.king.com|HTTPS|Candy Crush application -|cdn.onenote.net|HTTP|Microsoft OneNote -|cds.p9u4n2q3.hwcdn.net|HTTP|Highwinds Content Delivery Network traffic for Windows updates -|client.wns.windows.com|HTTPS|Winddows Notification System -|co4.telecommand.telemetry.microsoft.com.akadns.net|HTTPS|Windows Error Reporting -|config.edge.skype.com|HTTPS|Microsoft Skype -|cs11.wpc.v0cdn.net|HTTP|Windows Telemetry -|cs9.wac.phicdn.net|HTTP|Windows Update -|cy2.licensing.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|cy2.purchase.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|cy2.settings.data.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|dmd.metaservices.microsoft.com.akadns.net|HTTP|Device Authentication -|e-0009.e-msedge.net|HTTPS|Microsoft Office -|e10198.b.akamaiedge.net|HTTPS|Maps application -|fe3.update.microsoft.com|HTTPS|Windows Update -|g.live.com|HTTPS|Microsoft OneDrive -|g.msn.com.nsatc.net|HTTPS|Used to retrieve Windows Spotlight metadata -|geo-prod.do.dsp.mp.microsoft.com|HTTPS|Windows Update -|go.microsoft.com|HTTP|Windows Defender -|iecvlist.microsoft.com|HTTPS|Microsoft Edge -|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP / HTTPS|Microsoft Store -|ipv4.login.msa.akadns6.net|HTTPS|Used for Microsoft accounts to sign in -|licensing.mp.microsoft.com|HTTP|Licensing -|location-inference-westus.cloudapp.net|HTTPS|Used for location data -|login.live.com|HTTP|Device Authentication -|maps.windows.com|HTTP|Maps application -|modern.watson.data.microsoft.com.akadns.net|HTTPS|Used by Windows Error Reporting -|msagfx.live.com|HTTP|OneDrive -|nav.smartscreen.microsoft.com|HTTPS|Windows Defender -|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|oneclient.sfx.ms|HTTP|OneDrive -|pti.store.microsoft.com|HTTPS|Microsoft Store -|ris.api.iris.microsoft.com.akadns.net|HTTPS|Used to retrieve Windows Spotlight metadata -|ris-prod-atm.trafficmanager.net|HTTPS|Azure -|s2s.config.skype.com|HTTP|Microsoft Skype -|settings-win.data.microsoft.com|HTTPS|Application settings -|share.microsoft.com|HTTPS|Microsoft Store -|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Microsoft Skype -|slscr.update.microsoft.com|HTTPS|Windows Update -|storecatalogrevocation.storequality.microsoft.com|HTTPS|Microsoft Store -|store-images.microsoft.com|HTTPS|Microsoft Store -|tile-service.weather.microsoft.com/*|HTTP|Used to download updates to the Weather app Live Tile -|time.windows.com|HTTP|Windows time -|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Used for content regulation -|v10.events.data.microsoft.com*|HTTPS|Microsoft Office -|vip5.afdorigin-prod-am02.afdogw.com|HTTPS|Used to serve office 365 experimentation traffic -|watson.telemetry.microsoft.com|HTTPS|Telemetry -|wdcp.microsoft.com|HTTPS|Windows Defender -|wusofficehome.msocdn.com|HTTPS|Microsoft Office -|www.bing.com|HTTPS|Cortana and Search -|www.microsoft.com|HTTP|Diagnostic -|www.msftconnecttest.com|HTTP|Network connection -|www.office.com|HTTPS|Microsoft Office +| Destination | Protocol | Description | +| ----------- | -------- | ----------- | +| \*.cloudapp.azure.com | HTTPS | Azure +| \*.delivery.dsp.mp.microsoft.com.nsatc.net | HTTPS | Windows Update, Microsoft Update, and Microsoft Store services +| \*.displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*.dl.delivery.mp.microsoft.com\* | HTTP | Enables connections to Windows Update +| \*.e-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.g.akamaiedge.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use +| \*.s-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.windowsupdate.com\* | HTTP | Enables connections to Windows Update +| \*.wns.notify.windows.com.akadns.net | HTTPS | Used for the Windows Push Notification Services (WNS) +| \*dsp.mp.microsoft.com.nsatc.net | HTTPS | Enables connections to Windows Update +| \*c-msedge.net | HTTP | Office +| a1158.g.akamai.net | HTTP | Maps application +| arc.msn.com\* | HTTP / HTTPS | Used to retrieve Windows Spotlight metadata +| blob.mwh01prdstr06a.store.core.windows.net | HTTPS | Microsoft Store +| browser.pipe.aria.microsoft.com | HTTPS | Microsoft Office +| bubblewitch3mobile.king.com | HTTPS | Bubble Witch application +| candycrush.king.com | HTTPS | Candy Crush application +| cdn.onenote.net | HTTP | Microsoft OneNote +| cds.p9u4n2q3.hwcdn.net | HTTP | Highwinds Content Delivery Network traffic for Windows updates +| client.wns.windows.com | HTTPS | Windows Notification System +| co4.telecommand.telemetry.microsoft.com.akadns.net | HTTPS | Windows Error Reporting +| config.edge.skype.com | HTTPS | Microsoft Skype +| cs11.wpc.v0cdn.net | HTTP | Windows Telemetry +| cs9.wac.phicdn.net | HTTP | Windows Update +| cy2.licensing.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| cy2.purchase.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| cy2.settings.data.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| dmd.metaservices.microsoft.com.akadns.net | HTTP | Device Authentication +| e-0009.e-msedge.net | HTTPS | Microsoft Office +| e10198.b.akamaiedge.net | HTTPS | Maps application +| fe3.update.microsoft.com | HTTPS | Windows Update +| g.live.com | HTTPS | Microsoft OneDrive +| g.msn.com.nsatc.net | HTTPS | Used to retrieve Windows Spotlight metadata +| geo-prod.do.dsp.mp.microsoft.com | HTTPS | Windows Update +| go.microsoft.com | HTTP | Windows Defender +| iecvlist.microsoft.com | HTTPS | Microsoft Edge +| img-prod-cms-rt-microsoft-com.akamaized.net | HTTP / HTTPS | Microsoft Store +| ipv4.login.msa.akadns6.net | HTTPS | Used for Microsoft accounts to sign in +| licensing.mp.microsoft.com | HTTP | Licensing +| location-inference-westus.cloudapp.net | HTTPS | Used for location data +| login.live.com | HTTP | Device Authentication +| maps.windows.com | HTTP | Maps application +| modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting +| msagfx.live.com | HTTP | OneDrive +| nav.smartscreen.microsoft.com | HTTPS | Windows Defender +| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| oneclient.sfx.ms | HTTP | OneDrive +| pti.store.microsoft.com | HTTPS | Microsoft Store +| ris.api.iris.microsoft.com.akadns.net | HTTPS | Used to retrieve Windows Spotlight metadata +| ris-prod-atm.trafficmanager.net | HTTPS | Azure +| s2s.config.skype.com | HTTP | Microsoft Skype +| settings-win.data.microsoft.com | HTTPS | Application settings +| share.microsoft.com | HTTPS | Microsoft Store +| skypeecs-prod-usw-0.cloudapp.net | HTTPS | Microsoft Skype +| slscr.update.microsoft.com | HTTPS | Windows Update +| storecatalogrevocation.storequality.microsoft.com | HTTPS | Microsoft Store +| store-images.microsoft.com | HTTPS | Microsoft Store +| tile-service.weather.microsoft.com/\* | HTTP | Used to download updates to the Weather app Live Tile +| time.windows.com | HTTP | Windows time +| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Used for content regulation +| v10.events.data.microsoft.com\* | HTTPS | Microsoft Office +| vip5.afdorigin-prod-am02.afdogw.com | HTTPS | Used to serve office 365 experimentation traffic +| watson.telemetry.microsoft.com | HTTPS | Telemetry +| wdcp.microsoft.com | HTTPS | Windows Defender +| wusofficehome.msocdn.com | HTTPS | Microsoft Office +| `www.bing.com` | HTTPS | Cortana and Search +| `www.microsoft.com` | HTTP | Diagnostic +| `www.msftconnecttest.com` | HTTP | Network connection +| `www.office.com` | HTTPS | Microsoft Office ## Windows 10 Education -| **Destination** | **Protocol** | **Description** | -| --- | --- | --- | -|\*.b.akamaiedge.net|HTTPS|Used to check for updates to maps that have been downloaded for offline use -|\*.c-msedge.net|HTTP|Used by OfficeHub to get the metadata of Office apps -|\*.dl.delivery.mp.microsoft.com*|HTTP|Windows Update -|\*.e-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.g.akamaiedge.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use -|\*.licensing.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*.settings.data.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*.skype.com*|HTTPS|Used to retrieve Skype configuration values -|\*.smartscreen*.microsoft.com|HTTPS|Windows Defender -|\*.s-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.telecommand.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting -|\*.wac.phicdn.net|HTTP|Windows Update -|\*.windowsupdate.com*|HTTP|Windows Update -|\*.wns.windows.com|HTTPS|Windows Notifications Service -|\*.wpc.*.net|HTTP|Diagnostic Data -|\*displaycatalog.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*dsp.mp.microsoft.com|HTTPS|Windows Update -|a1158.g.akamai.net|HTTP|Maps -|a122.dscg3.akamai.net|HTTP|Maps -|a767.dscg3.akamai.net|HTTP|Maps -|au.download.windowsupdate.com*|HTTP|Windows Update -|bing.com/*|HTTPS|Used for updates for Cortana, apps, and Live Tiles -|blob.dz5prdstr01a.store.core.windows.net|HTTPS|Microsoft Store -|browser.pipe.aria.microsoft.com|HTTP|Used by OfficeHub to get the metadata of Office apps -|cdn.onenote.net/livetile/*|HTTPS|Used for OneNote Live Tile -|cds.p9u4n2q3.hwcdn.net|HTTP|Used by the Highwinds Content Delivery Network to perform Windows updates -|client-office365-tas.msedge.net/*|HTTPS|Office 365 portal and Office in a browser -|ctldl.windowsupdate.com*|HTTP|Used to download certificates that are publicly known to be fraudulent -|displaycatalog.mp.microsoft.com/*|HTTPS|Microsoft Store -|dmd.metaservices.microsoft.com*|HTTP|Device Authentication -|download.windowsupdate.com*|HTTPS|Windows Update -|emdl.ws.microsoft.com/*|HTTP|Used to download apps from the Microsoft Store -|evoke-windowsservices-tas.msedge.net|HTTPS|Photo app -|fe2.update.microsoft.com*|HTTPS|Windows Update, Microsoft Update, Microsoft Store services -|fe3.delivery.dsp.mp.microsoft.com.nsatc.net|HTTPS|Windows Update, Microsoft Update, Microsoft Store services -|fe3.delivery.mp.microsoft.com*|HTTPS|Windows Update, Microsoft Update, Microsoft Store services -|g.live.com*|HTTPS|Used by OneDrive for Business to download and verify app updates -|g.msn.com.nsatc.net|HTTPS|Used to retrieve Windows Spotlight metadata -|go.microsoft.com|HTTP|Windows Defender -|iecvlist.microsoft.com|HTTPS|Microsoft Edge browser -|ipv4.login.msa.akadns6.net|HTTPS|Used for Microsoft accounts to sign in -|licensing.mp.microsoft.com*|HTTPS|Used for online activation and some app licensing -|login.live.com|HTTPS|Device Authentication -|maps.windows.com/windows-app-web-link|HTTPS|Maps application -|modern.watson.data.microsoft.com.akadns.net|HTTPS|Used by Windows Error Reporting -|msagfx.live.com|HTTPS|OneDrive -|ocos-office365-s2s.msedge.net/*|HTTPS|Used to connect to the Office 365 portal's shared infrastructure -|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|oneclient.sfx.ms/*|HTTPS|Used by OneDrive for Business to download and verify app updates -|onecollector.cloudapp.aria.akadns.net|HTTPS|Microsoft Office -|pti.store.microsoft.com|HTTPS|Microsoft Store -|settings-win.data.microsoft.com/settings/*|HTTPS|Used as a way for apps to dynamically update their configuration -|share.microsoft.com|HTTPS|Microsoft Store -|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Skype -|sls.update.microsoft.com*|HTTPS|Windows Update -|storecatalogrevocation.storequality.microsoft.com*|HTTPS|Used to revoke licenses for malicious apps on the Microsoft Store -|tile-service.weather.microsoft.com*|HTTP|Used to download updates to the Weather app Live Tile -|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Windows Update -|v10.events.data.microsoft.com*|HTTPS|Diagnostic Data -|vip5.afdorigin-prod-ch02.afdogw.com|HTTPS|Used to serve Office 365 experimentation traffic -|watson.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting -|wdcp.microsoft.com|HTTPS|Windows Defender -|wd-prod-cp-us-east-1-fe.eastus.cloudapp.azure.com|HTTPS|Azure -|wusofficehome.msocdn.com|HTTPS|Microsoft Office -|www.bing.com|HTTPS|Cortana and Search -|www.microsoft.com|HTTP|Diagnostic Data -|www.microsoft.com/pkiops/certs/*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|www.msftconnecttest.com|HTTP|Network Connection -|www.office.com|HTTPS|Microsoft Office - +| Destination | Protocol | Description | +| ----------- | -------- | ----------- | +| \*.b.akamaiedge.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use +| \*.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps +| \*.dl.delivery.mp.microsoft.com\* | HTTP | Windows Update +| \*.e-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.g.akamaiedge.net | HTTPS | Used to check for updates to Maps that have been downloaded for offline use +| \*.licensing.md.mp.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*.settings.data.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*.skype.com\* | HTTPS | Used to retrieve Skype configuration values +| \*.smartscreen\*.microsoft.com | HTTPS | Windows Defender +| \*.s-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting +| \*.wac.phicdn.net | HTTP | Windows Update +| \*.windowsupdate.com\* | HTTP | Windows Update +| \*.wns.windows.com | HTTPS | Windows Notifications Service +| \*.wpc.\*.net | HTTP | Diagnostic Data +| \*displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*dsp.mp.microsoft.com | HTTPS | Windows Update +| a1158.g.akamai.net | HTTP | Maps +| a122.dscg3.akamai.net | HTTP | Maps +| a767.dscg3.akamai.net | HTTP | Maps +| au.download.windowsupdate.com\* | HTTP | Windows Update +| bing.com/\* | HTTPS | Used for updates for Cortana, apps, and Live Tiles +| blob.dz5prdstr01a.store.core.windows.net | HTTPS | Microsoft Store +| browser.pipe.aria.microsoft.com | HTTP | Used by OfficeHub to get the metadata of Office apps +| cdn.onenote.net/livetile/\* | HTTPS | Used for OneNote Live Tile +| cds.p9u4n2q3.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates +| client-office365-tas.msedge.net/\* | HTTPS | Microsoft 365 admin center and Office in a browser +| ctldl.windowsupdate.com\* | HTTP | Used to download certificates that are publicly known to be fraudulent +| displaycatalog.mp.microsoft.com/\* | HTTPS | Microsoft Store +| dmd.metaservices.microsoft.com\* | HTTP | Device Authentication +| download.windowsupdate.com\* | HTTPS | Windows Update +| emdl.ws.microsoft.com/\* | HTTP | Used to download apps from the Microsoft Store +| evoke-windowsservices-tas.msedge.net | HTTPS | Photo app +| fe2.update.microsoft.com\* | HTTPS | Windows Update, Microsoft Update, Microsoft Store services +| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | HTTPS | Windows Update, Microsoft Update, Microsoft Store services +| fe3.delivery.mp.microsoft.com\* | HTTPS | Windows Update, Microsoft Update, Microsoft Store services +| g.live.com\* | HTTPS | Used by OneDrive for Business to download and verify app updates +| g.msn.com.nsatc.net | HTTPS | Used to retrieve Windows Spotlight metadata +| go.microsoft.com | HTTP | Windows Defender +| iecvlist.microsoft.com | HTTPS | Microsoft Edge browser +| ipv4.login.msa.akadns6.net | HTTPS | Used for Microsoft accounts to sign in +| licensing.mp.microsoft.com\* | HTTPS | Used for online activation and some app licensing +| login.live.com | HTTPS | Device Authentication +| maps.windows.com/windows-app-web-link | HTTPS | Maps application +| modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting +| msagfx.live.com | HTTPS | OneDrive +| ocos-office365-s2s.msedge.net/\* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure +| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| oneclient.sfx.ms/\* | HTTPS | Used by OneDrive for Business to download and verify app updates +| onecollector.cloudapp.aria.akadns.net | HTTPS | Microsoft Office +| pti.store.microsoft.com | HTTPS | Microsoft Store +| settings-win.data.microsoft.com/settings/\* | HTTPS | Used as a way for apps to dynamically update their configuration +| share.microsoft.com | HTTPS | Microsoft Store +| skypeecs-prod-usw-0.cloudapp.net | HTTPS | Skype +| sls.update.microsoft.com\* | HTTPS | Windows Update +| storecatalogrevocation.storequality.microsoft.com\* | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store +| tile-service.weather.microsoft.com\* | HTTP | Used to download updates to the Weather app Live Tile +| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Windows Update +| v10.events.data.microsoft.com\* | HTTPS | Diagnostic Data +| vip5.afdorigin-prod-ch02.afdogw.com | HTTPS | Used to serve Office 365 experimentation traffic +| watson.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting +| wdcp.microsoft.com | HTTPS | Windows Defender +| wd-prod-cp-us-east-1-fe.eastus.cloudapp.azure.com | HTTPS | Azure +| wusofficehome.msocdn.com | HTTPS | Microsoft Office +| `www.bing.com` | HTTPS | Cortana and Search +| `www.microsoft.com` | HTTP | Diagnostic Data +| `www.microsoft.com/pkiops/certs/`* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| `www.msftconnecttest.com` | HTTP | Network Connection +| `www.office.com` | HTTPS | Microsoft Office diff --git a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md new file mode 100644 index 0000000000..90ab13ce23 --- /dev/null +++ b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md @@ -0,0 +1,214 @@ +--- +title: Windows 10, version 1909, connection endpoints for non-Enterprise editions +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1909. +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: obezeajo +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 08/18/2020 +--- +# Windows 10, version 1909, connection endpoints for non-Enterprise editions + + **Applies to** + +- Windows 10 Home, version 1909 +- Windows 10 Professional, version 1909 +- Windows 10 Education, version 1909 + +In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-2004-endpoints.md), the following endpoints are available on other non-Enterprise editions of Windows 10, version 1909. + +The following methodology was used to derive the network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week. If you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 Family + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|arc.msn.com|HTTP/TLS v1.2|Windows Spotlight +|api.asm.skype.com|TLS v1.2|Used to retrieve Skype configuration values +|browser.pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ctldl.windowsupdate.com/*|HTTP|Certificate Trust List +|client.wns.windows.com|HTTP|Used for the Windows Push Notification Service(WNS) +|config.edge.skype.com|HTTP/TLS v1.2|Used to retrieve Skype configuration values +|dmd.metaservices.microsoft.com|HTTP|Device metadata +|config.teams.microsoft.com|HTTPS|Used for Microsoft Teams application +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft Store +|*.tlu.dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft Store +|displaycatalog.mp.microsoft.com/*|HTTP/TLS v1.2|Used to communicate with Microsoft Store +|evoke-windowsservices-tas.msedge.net|HTTP/TLS v1.2|Used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser +|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Enables connections to Windows Update, Microsoft Update, and the online services of the Store +|fe3cr.delivery.mp.microsoft.com|HTTPS/TLS v1.2|Used to download operating system patches, updates, and apps from Microsoft Store +|go.microsoft.com|HTTP|Windows Defender and/or Microsoft forward link redirection service (FWLink) +|g.live.com|HTTP|OneDrive +|checkappexec.microsoft.com|HTTPS|Used for Windows Defender Smartscreen reporting and notifications +|emdl.ws.microsoft.com|HTTP|Windows Update +|*.prod.do.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update +|*.au.download.windowsupdate.com|HTTP|Windows Update +|download.windowsupdate.com|HTTP|Windows Update +|inference.location.live.net|TLS v1.2|Used for Location Data +|iecvlist.microsoft.com|HTTP|This endpoint is related to Microsoft Edge +|login.live.com|HTTPS/TLS v1.2|Device Authentication +|logincdn.msauth.net|HTTPS|OneDrive +|licensing.mp.microsoft.com|HTTP/TLS v1.2|Licensing +|maps.windows.com|TLS v1.2|Used to check for updates to maps that have been downloaded for offline use +|mobile.pipe.aria.microsoft.com|HTTP|Office Telemetry +|nav.smartscreen.microsoft.com|HTTP|Used for Windows Defender SmartScreen reporting and notifications +|outlook.office365.com|HTTP|Used to connect to the Microsoft 365 admin center's shared infrastructure, including Office in a browser +|ocsp.digicert.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|pti.store.microsoft.com/*|HTTP|Used to communicate with Microsoft Store +|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP|Used to communicate with Microsoft Store +|manage.devcenter.microsoft.com|HTTP/TLS v1.2|Used to get Microsoft Store analytics +|ris.api.iris.microsoft.com|HTTPS|Used to retrieve Windows Spotlight metadata that describes content +|settings-win.data.microsoft.com|HTTPS/TLS v1.2|Used for Windows apps to dynamically update their configuration +|smartscreen-prod.microsoft.com|HTTP|Used for Windows Defender SmartScreen reporting and notifications +|*.blob.core.windows.net|HTTP/TLS v1.2|Windows Telemetry +|storage.live.com|HTTP/TLS v1.2|OneDrive +|skydrivesync.policies.live.net|TLS v1.2|OneDrive +|dm2302.settings.live.net|HTTP|OneDrive +|slscr.update.microsoft.com|HTTPS/TLS V1.2|Windows Update +|tile-service.weather.microsoft.com|HTTP|Used for the Weather app +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTP|This endpoint is used for content regulation +|watson.telemetry.microsoft.com*|HTTPS/TLS v1.2|Diagnostic Data +|v10.events.data.microsoft.com/onecollector/1.0/|HTTPS|Microsoft Office +|v10.events.data.microsoft.com|HTTPS/TLS v1.2|Used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service +|www.bing.com|HTTPS/TLS v1.2|Cortana and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection Status Indicator (NCSI) +|wdcp.microsoft.com|HTTPS|Used for Windows Defender when Cloud-based Protection is enabled +|activity.windows.com|TLSV1.2|Used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows +|adl.windows.com|HTTP|Used for compatibility database updates for Windows +|spclient.wg.spotify.com|TLSV1.2|Used for Spotify Live Tile +|cs.dds.microsoft.com|TLSV1.2|Used by Device Directory Service to keep track of user-device associations and storing metadata about the devices. + +## Windows 10 Pro + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.prod.do.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update +|api.onedrive.com|HTTP|OneDrive +|smartscreen-prod.microsoft.com|HTTP|Used for Windows Defender SmartScreen reporting and notifications +|nav.smartscreen.microsoft.com|HTTPS/TLS v1.2|Windows Defender +|*.update.microsoft.com|HTTP|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|browser.pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*.wns.windows.com|TLS v1.2|Used for the Windows Push Notification Services (WNS) +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft Store +|c-ring.msedge.net|TLS v1.2|Cortana and Live Tiles +|a-ring.msedge.net|TLS v1.2|Cortana and Live Tiles +|*storecatalogrevocation.storequality.microsoft.com|HTTP/TLS v1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|HTTP/TLS v1.2|Windows Spotlight +|*.blob.core.windows.net|HTTP/TLS v1.2|Windows Telemetry +|cdn.onenote.net|HTTPS/TLS v1.2|OneNote Live Tile +|checkappexec.microsoft.com|HTTPS|Used for Windows Defender SmartScreen reporting and notifications +|config.edge.skype.com|HTTP/TLS v1.2|Used to retrieve Skype configuration values +|config.teams.microsoft.com|HTTPS|Used for Microsoft Teams application +|ctldl.windowsupdate.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|displaycatalog.mp.microsoft.com*|HTTP/TLS v1.2|Microsoft Store +|emdl.ws.microsoft.com|HTTP|Windows Update +|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|fe3cr.delivery.mp.microsoft.com|HTTPS/TLS v1.2|Windows Update +|slscr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|evoke-windowsservices-tas.msedge.net|HTTPS/TLS v1.2|Used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser +|fp.msedge.net|HTTPS/TLS v1.2|Cortana and Live Tiles +|fp-vp.azureedge.net|TLS v1.2|Cortana and Live Tiles +|g.live.com|TLS v1.2|OneDrive +|go.microsoft.com|HTTP|Windows Defender and/or Microsoft forward link redirection service (FWLink) +|iecvlist.microsoft.com|HTTP|Microsoft Edge +|inference.location.live.net|TLS v1.2|Used for Location Data +|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP|Used to communicate with Microsoft Store +|licensing.mp.microsoft.com*|HTTP/TLS v1.2|Licensing +|login.live.com|HTTPS/TLS v1.2|Device Authentication +|logincdn.msauth.net|HTTPS|Used for Microsoft accounts to sign in +|manage.devcenter.microsoft.com|HTTP/TLS v1.2|Microsoft Store analytics +|maps.windows.com|TLS v1.2|Related to Maps application +|ocsp.digicert.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|ocsp.msocsp.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|mobile.pipe.aria.microsoft.com|HTTP|Office Telemetry +|pti.store.microsoft.com/*|HTTP|Used to communicate with Microsoft Store +|ris.api.iris.microsoft.com|TLS v1.2|Windows Spotlight +|settings-win.data.microsoft.com|HTTPS/TLS v1.2|Used for Windows apps to dynamically update their configuration +|spo-ring.msedge.net|TLSv1.2|Cortana and Live Tiles +|telecommand.telemetry.microsoft.com|TLS v1.2|Used by Windows Error Reporting ||tile-service.weather.microsoft.com|HTTP|Used for the Weather app +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Used for content regulation +|v10.events.data.microsoft.com/onecollector/1.0/|HTTPS/TLS v1.2|Diagnostic Data +|v10.events.data.microsoft.com|HTTPS/TLS v1.2|Used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service +|watson.telemetry.microsoft.com*|HTTPS/TLS v1.2|Used by Windows Error Reporting +|wdcp.microsoft.com|HTTPS|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|HTTPS/TLS v1.2|Cortana and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection Status Indicator (NCSI) +|outlook.office365.com|HTTP|Microsoft Office +|storage.live.com|HTTP/TLS v1.2|OneDrive +|skydrivesync.policies.live.net|TLS v1.2|OneDrive +|windows.policies.live.net|HTTP|OneDrive +|activity.windows.com|TLSV1.2|Used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows +|adl.windows.com|HTTP|Used for compatibility database updates for Windows +|spclient.wg.spotify.com|TLSV1.2|Used for Spotify Live Tile +|cs.dds.microsoft.com|TLSV1.2|Used by Device Directory Service to keep track of user-device associations and storing metadata about the devices. + +## Windows 10 Education + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|arc.msn.com|HTTPS/TLS v1.2|Windows Spotlight +|*.dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|client.wns.windows.com|TLS v1.2|Used for the Windows Push Notification Services (WNS) +|*storecatalogrevocation.storequality.microsoft.com|TLS v1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|dmd.metaservices.microsoft.com|HTTP|Device metadata +|Inference.location.live.net|TLS v1.2|Location +|oneclient.sfx.ms|HTTPS|OneDrive +|storage.live.com|HTTP/TLS v1.2|OneDrive +|skydrivesync.policies.live.net|TLS v1.2|OneDrive +|slscr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|fe3cr.delivery.mp.microsoft.com|HTTPS/TLS v1.2|Windows Update +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update +|officehomeblobs.blob.core.windows.net|HTTP|Windows Telemetry +|displaycatalog.mp.microsoft.com/*|HTTP/TLS v1.2|Microsoft Store +|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP|Used to communicate with Microsoft Store +|config.teams.microsoft.com|HTTPS|Teams +|api.asm.skype.com|TLS v1.2|Used to retrieve Skype configuration values +|config.edge.skype.com|HTTP/TLS v1.2|Used to retrieve Skype configuration values +|logincdn.msauth.net|HTTPS|OneDrive +|iecvlist.microsoft.com|HTTP|Microsoft Edge +|download.windowsupdate.com|HTTP|Windows Update +|checkappexec.microsoft.com|HTTPS|Windows Defender +|pti.store.microsoft.com/*|HTTP|Microsoft Store +|emdl.ws.microsoft.com|HTTP|Windows Update +|evoke-windowsservices-tas.msedge.net|HTTPS/TLS v1.2|Photos app +|g.live.com|TLS v1.2|OneDrive +|go.microsoft.com|HTTP|Windows Defender +|licensing.mp.microsoft.com|HTTP/TLS v1.2|Licensing +|login.live.com|HTTPS/TLS v1.2|Device Authentication +|manage.devcenter.microsoft.com|TLS v1.2|Microsoft Store analytics +|ocsp.digicert.com|HTTP|CRL and OCSP checks to the issuing certificate authorities +|ris.api.iris.microsoft.com|TLS v1.2|Windows spotlight +|telecommand.telemetry.microsoft.com|TLS v1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTP|Used to download updates to the Weather app Live Tile +|v10.events.data.microsoft.com|HTTPS/TLS v1.2|Diagnostic Data +|V10.events.data.microsoft.com/onecollector/1.0/|HTTPS|Diagnostic Data +|Watson.telemetry.microsoft.com/telemetry.request|HTTPS|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|outlook.office365.com|HTTP|Microsoft Office +|www.bing.com|TLS v1.2|Used for updates for Cortana, apps, and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|adl.windows.com|HTTP|Used for compatibility database updates for Windows diff --git a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md new file mode 100644 index 0000000000..d0be97841e --- /dev/null +++ b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md @@ -0,0 +1,203 @@ +--- +title: Windows 10, version 2004, connection endpoints for non-Enterprise editions +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 2004. +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: linque1 +ms.author: obezeajo +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 5/11/2020 +--- +# Windows 10, version 2004, connection endpoints for non-Enterprise editions + + **Applies to** + +- Windows 10 Home, version 2004 +- Windows 10 Professional, version 2004 +- Windows 10 Education, version 2004 + +In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-2004-endpoints.md), the following endpoints are available on other non-Enterprise editions of Windows 10, version 2004. + +The following methodology was used to derive the network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week. If you capture traffic for longer you may have different results. + + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 Family + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*.prod.do.dsp.mp.microsoft.com|TLSv1.2|Windows Update +|*.smartscreen.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.smartscreen-prod.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.update.microsoft.com|TLSv1.2|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*storecatalogrevocation.storequality.microsoft.com|TLSv1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|TLSv1.2|Windows Spotlight +|cdn.onenote.net|HTTPS|OneNote +|config.edge.skype.com|HTTPS|Skype +|config.teams.microsoft.com|HTTPS|Skype +|crl.microsoft.com|HTTPS|Skype +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|da.xboxservices.com|HTTPS|Microsoft Edge +|displaycatalog.mp.microsoft.com|HTTPS|Microsoft Store +|dmd.metaservices.microsoft.com|HTTP|Device Authentication +|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app +|fs.microsoft.com|TLSv1.2|Maps application +|g.live.com|TLSv1.2|OneDrive +|go.microsoft.com|HTTPS|Windows Defender +|img-prod-cms-rt-microsoft-com|TLSv1.2|This endpoint is related to Microsoft Edge +|licensing.mp.microsoft.com|HTTPS|Licensing +|login.live.com|TLSv1.2|Device Authentication +|logincdn.msauth.net|TLSv1.2|Device Authentication +|manage.devcenter.microsoft.com|TLSv1.2|Microsoft Store analytics +|maps.windows.com|TLSv1.2|Related to Maps application +|ocsp.digicert.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ris.api.iris.microsoft.com|TLSv1.2|Windows Telemetry +|settings-win.data.microsoft.com|TLSv1.2|Used for Windows apps to dynamically update their configuration +|storesdk.dsx.mp.microsoft.com|HTTPS|Used to communicate with Microsoft Store +|telecommand.telemetry.microsoft.com|TLSv1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTPS|Used to download updates to the Weather app Live Tile +|tsfe.trafficshaping.dsp.mp.microsoft.com|TLSv1.2|Used for content regulation +|v10.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|v20.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|wdcp.microsoft.com|TLSv1.2|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|TLSv1.2|Used for updates for Cortana, apps, and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|www.office.com|HTTPS|Microsoft Office + + +## Windows 10 Pro + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*.prod.do.dsp.mp.microsoft.com|TLSv1.2|Windows Update +|*.smartscreen.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.smartscreen-prod.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.update.microsoft.com|TLSv1.2|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*.wns.windows.com|TLSv1.2|Used for the Windows Push Notification Services (WNS) +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*msn-com.akamaized.net|HTTPS|This endpoint is related to Microsoft Edge +|*ring.msedge.net|HTTPS|Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps +|*storecatalogrevocation.storequality.microsoft.com|TLSv1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|TLSv1.2|Windows Spotlight +|blobs.officehome.msocdn.com|HTTPS|OneNote +|cdn.onenote.net|HTTPS|OneNote +|checkappexec.microsoft.com|HTTPS|OneNote +|config.edge.skype.com|HTTPS|Skype +|config.teams.microsoft.com|HTTPS|Skype +|crl.microsoft.com|HTTPS|Skype +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|d2i2wahzwrm1n5.cloudfront.net|HTTPS|Microsoft Edge +|da.xboxservices.com|HTTPS|Microsoft Edge +|displaycatalog.mp.microsoft.com|HTTPS|Microsoft Store +|dlassets-ssl.xboxlive.com|HTTPS|Xbox Live +|dmd.metaservices.microsoft.com|HTTP|Device Authentication +|emdl.ws.microsoft.com|HTTP|Windows Update +|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app +|fp.msedge.net|HTTPS|Cortana and Live Tiles +|fs.microsoft.com|TLSv1.2|Maps application +|g.live.com|TLSv1.2|OneDrive +|go.microsoft.com|HTTPS|Windows Defender +|img-prod-cms-rt-microsoft-com*|TLSv1.2|This endpoint is related to Microsoft Edge +|licensing.mp.microsoft.com|HTTPS|Licensing +|login.live.com|TLSv1.2|Device Authentication +|manage.devcenter.microsoft.com|TLSv1.2|Microsoft Store analytics +|maps.windows.com|TLSv1.2|Related to Maps application +|ocsp.digicert.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ris.api.iris.microsoft.com|TLSv1.2|Windows Telemetry +|s1325.t.eloqua.com|HTTPS|Microsoft Edge +|self.events.data.microsoft.com|HTTPS|Microsoft Office +|settings-win.data.microsoft.com|TLSv1.2|Used for Windows apps to dynamically update their configuration +|store-images.*microsoft.com|HTTPS|Used to get images that are used for Microsoft Store suggestions +|storesdk.dsx.mp.microsoft.com|HTTPS|Microsoft Store +|telecommand.telemetry.microsoft.com|TLSv1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTPS|Used to download updates to the Weather app Live Tile +|time.windows.com|HTTPS|Fetch the time +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|The following endpoint is used for content regulation +|v10.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|wdcp.microsoft.com|TLSv1.2|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|TLSv1.2|Used for updates for Cortana, apps, and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|www.msn.com|HTTPS|Network Connection (NCSI) +|www.office.com|HTTPS|Microsoft Office + + +## Windows 10 Education + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*.prod.do.dsp.mp.microsoft.com|TLSv1.2|Windows Update +|*.smartscreen.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.smartscreen-prod.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.update.microsoft.com|TLSv1.2|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*.wns.windows.com|TLSv1.2|Used for the Windows Push Notification Services (WNS) +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*ring.msedge.net|HTTPS|Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps +|*storecatalogrevocation.storequality.microsoft.com|TLSv1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|TLSv1.2|Windows Spotlight +|blobs.officehome.msocdn.com|HTTPS|OneNote +|cdn.onenote.net|HTTPS|OneNote +|checkappexec.microsoft.com|HTTPS|OneNote +|config.edge.skype.com|HTTPS|Skype +|config.teams.microsoft.com|HTTPS|Skype +|crl.microsoft.com|HTTPS|Skype +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|da.xboxservices.com|HTTPS|Microsoft Edge +|dmd.metaservices.microsoft.com|HTTP|Device Authentication +|emdl.ws.microsoft.com|HTTP|Windows Update +|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app +|fp.msedge.net|HTTPS|Cortana and Live Tiles +|fs.microsoft.com|TLSv1.2|Maps application +|g.live.com|TLSv1.2|OneDrive +|go.microsoft.com|HTTPS|Windows Defender +|licensing.mp.microsoft.com|HTTPS|Licensing +|login.live.com|TLSv1.2|Device Authentication +|logincdn.msauth.net|HTTPS|Device Authentication +|manage.devcenter.microsoft.com|TLSv1.2|Microsoft Store analytics +|ocsp.digicert.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|ocsp.msocsp.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|ow1.res.office365.com|HTTPS|Microsoft Office +|pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ris.api.iris.microsoft.com|TLSv1.2|Windows Telemetry +|s1325.t.eloqua.com|HTTPS|Microsoft Edge +|settings-win.data.microsoft.com|TLSv1.2|Used for Windows apps to dynamically update their configuration +|telecommand.telemetry.microsoft.com|TLSv1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTPS|Used to download updates to the Weather app Live Tile +|v10.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|v20.events.data.microsoft.com|HTTPS|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|wdcp.microsoft.com|TLSv1.2|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|TLSv1.2|Used for updates for Cortana, apps, and Live Tiles +|www.microsoft.com|HTTP|Connected User Experiences and Telemetry, Microsoft Data Management service +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|www.office.com|HTTPS|Microsoft Office + diff --git a/windows/privacy/windows-personal-data-services-configuration.md b/windows/privacy/windows-personal-data-services-configuration.md deleted file mode 100644 index 0b5997a3eb..0000000000 --- a/windows/privacy/windows-personal-data-services-configuration.md +++ /dev/null @@ -1,408 +0,0 @@ ---- -title: Windows 10 personal data services configuration -description: An overview of Windows 10 services configuration settings that are used for personal data privacy protection relevant for regulations, such as the General Data Protection Regulation (GDPR) -keywords: privacy, GDPR, windows, IT -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 05/11/2018 -ms.reviewer: ---- -# Windows 10 personal data services configuration - -Applies to: -- Windows 10, version 1803 - -Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization. - -IT Professionals that are interested in applying these settings via group policies can find the configuration for download [here](https://go.microsoft.com/fwlink/?linkid=874149). - -## Introduction - -Microsoft collects data from or generates it through interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, support, and improve Windows 10 services. - -Many Windows 10 services are controller services. A user can manage data collection settings, for example by opening *Start > Settings > Privacy* or by visiting the [Microsoft Privacy dashboard](https://account.microsoft.com/privacy). While this relationship between Microsoft and a user is evident in a consumer type scenario, an IT organization can influence that relationship. For example, the IT department has the ability to configure the Windows diagnostic data level across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings. - -Below is a collection of settings related to the Windows 10 personal data services configuration that IT Professionals can use as guidance for influencing Windows diagnostic data collection and personal data protection. - -## Windows diagnostic data - -Windows 10 collects Windows diagnostic data—such as usage data, performance data, inking, typing, and utterance data—and sends it back to Microsoft. That data is used for keeping the operating system secure and up-to-date, to troubleshoot problems, and to make product improvements. For users who have turned on "Tailored experiences", that data can also be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. - -The following options for configuring Windows diagnostic data are relevant in this context. - -### Diagnostic level - -This setting determines the amount of Windows diagnostic data sent to Microsoft. - ->[!NOTE] ->In Windows 10, version 1709, Microsoft introduced a new feature: “Limit Enhanced diagnostic data to the minimum required by Windows Analytics”. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics). For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Allow Telemetry | ->| **Default setting** | 2 - Enhanced | ->| **Recommended** | 2 - Enhanced | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Allow Telemetry | ->| **Default setting** | 2 - Enhanced | ->| **Recommended** | 2 - Enhanced | - ->[!NOTE] ->When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used. - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | AllowTelemetry | ->| **Type** | REG_DWORD | ->| **Setting** | "00000002" | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKCU\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | AllowTelemetry | ->| **Type** | REG_DWORD | ->| **Setting** | "00000002" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | System | ->| **Policy** | AllowTelemetry (scope: device and user) | ->| **Default setting** | 2 – Enhanced | ->| **Recommended** | 2 – Allowed | - -### Diagnostic opt-in change notifications - -This setting determines whether a device shows notifications about Windows diagnostic data levels to people on first logon or when changes occur in the diagnostic configuration. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Configure telemetry opt-in change notifications | ->| **Default setting** | Enabled | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | DisableTelemetryOptInChangeNotification | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | System | ->| **Policy** | ConfigureTelemetryOptInChangeNotification | ->| **Default setting** | 0 – Enabled | ->| **Recommended** | 0 – Enabled | - -### Configure telemetry opt-in setting user interface - -This setting determines whether people can change their own Windows diagnostic data level in *Start > Settings > Privacy > Diagnostics & feedback*. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Configure telemetry opt-in setting user interface | ->| **Default setting** | Enabled | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | DisableTelemetryOptInSettingsUx | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | System | ->| **Policy** | ConfigureTelemetryOptInSettingsUx | ->| **Default setting** | 0 – Enabled | ->| **Recommended** | 0 – Enabled | - -## Policies affecting personal data protection managed by the Enterprise IT - -There are additional settings usually managed by the Enterprise IT that also affect the protection of personal data. - -The following options for configuring these policies are relevant in this context. - -### BitLocker - -The following settings determine whether fixed and removable drives are protected by the BitLocker Drive Encryption. - -#### Fixed Data Drives - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Fixed Data Drives | ->| **Policy Name** | Deny write access to fixed drives not protected by BitLocker | ->| **Default setting** | Not configured | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE | ->| **Value** | FDVDenyWriteAccess | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | BitLocker | ->| **Policy** | FixedDrivesRequireEncryption | ->| **Default setting** | Disabled | ->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#fixeddrivesrequireencryption)) | - -#### Removable Data Drives - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Removable Data Drives | ->| **Policy Name** | Deny write access to removable drives not protected by BitLocker | ->| **Default setting** | Not configured | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE | ->| **Value** | RDVDenyWriteAccess | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\FVE | ->| **Value** | RDVDenyCrossOrg | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | BitLocker | ->| **Policy** | RemovableDrivesRequireEncryption | ->| **Default setting** | Disabled | ->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#removabledrivesrequireencryption)) | - -### Privacy – AdvertisingID - -This setting determines if the advertising ID, which preventing apps from using the ID for experiences across apps, is turned off. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\System\User Profiles | ->| **Policy Name** | Turn off the advertising ID | ->| **Default setting** | Not configured | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo | ->| **Value** | DisabledByGroupPolicy | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | Privacy | ->| **Policy** | DisableAdvertisingId | ->| **Default setting** | 65535 (default) - Not configured | ->| **Recommended** | 1 – Enabled | - -### Edge - -These settings whether employees send “Do Not Track” from the Microsoft Edge web browser to websites. - ->[!NOTE] ->Please see [this Microsoft blog post](https://blogs.microsoft.com/on-the-issues/2015/04/03/an-update-on-microsofts-approach-to-do-not-track/) for more details on why the “Do Not Track” is no longer the default setting. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge | ->| **Policy Name** | Configure Do Not Track | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Microsoft Edge | ->| **Policy Name** | Configure Do Not Track | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | Browser | ->| **Policy** | AllowDoNotTrack (scope: device + user) | ->| **Default setting** | 0 (default) – Not allowed | ->| **Recommended** | 0 – Not allowed | - -### Internet Explorer - -These settings whether employees send “Do Not Track” header from the Microsoft Explorer web browser to websites. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | ->| **Policy Name** | Always send Do Not Track header | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | ->| **Policy Name** | Always send Do Not Track header | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Internet Explorer\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **Registry key** | HKCU\Software\Policies\Microsoft\Internet Explorer\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **MDM CSP** | N/A | - -## Additional resources - -### FAQs - -* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) -* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) -* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) -* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) - -### Blogs - -* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) - -### Privacy Statement - -* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) - -### Windows Privacy on docs.microsoft.com - -* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -* [Manage Windows 10 connection endpoints](manage-windows-endpoints.md) -* [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data) -* [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) - -### Other resources - -* [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/release-information/TOC.md b/windows/release-information/TOC.md deleted file mode 100644 index 41ca5d90c0..0000000000 --- a/windows/release-information/TOC.md +++ /dev/null @@ -1,36 +0,0 @@ -# [Windows 10 release information](index.md) -# [Message center](windows-message-center.yml) -# Version 1903 -## [Known issues and notifications](status-windows-10-1903.yml) -## [Resolved issues](resolved-issues-windows-10-1903.yml) -# Version 1809 and Windows Server 2019 -## [Known issues and notifications](status-windows-10-1809-and-windows-server-2019.yml) -## [Resolved issues](resolved-issues-windows-10-1809-and-windows-server-2019.yml) -# Version 1803 -## [Known issues and notifications](status-windows-10-1803.yml) -## [Resolved issues](resolved-issues-windows-10-1803.yml) -# Version 1709 -## [Known issues and notifications](status-windows-10-1709.yml) -## [Resolved issues](resolved-issues-windows-10-1709.yml) -# Version 1703 -## [Known issues and notifications](status-windows-10-1703.yml) -## [Resolved issues](resolved-issues-windows-10-1703.yml) -# Version 1607 and Windows Server 2016 -## [Known issues and notifications](status-windows-10-1607-and-windows-server-2016.yml) -## [Resolved issues](resolved-issues-windows-10-1607.yml) -# Version 1507 -## [Known issues and notifications](status-windows-10-1507.yml) -## [Resolved issues](resolved-issues-windows-10-1507.yml) -# Previous versions -## Windows 8.1 and Windows Server 2012 R2 -### [Known issues and notifications](status-windows-8.1-and-windows-server-2012-r2.yml) -### [Resolved issues](resolved-issues-windows-8.1-and-windows-server-2012-r2.yml) -## Windows Server 2012 -### [Known issues and notifications](status-windows-server-2012.yml) -### [Resolved issues](resolved-issues-windows-server-2012.yml) -## Windows 7 and Windows Server 2008 R2 -### [Known issues and notifications](status-windows-7-and-windows-server-2008-r2-sp1.yml) -### [Resolved issues](resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml) -## Windows Server 2008 SP2 -### [Known issues and notifications](status-windows-server-2008-sp2.yml) -### [Resolved issues](resolved-issues-windows-server-2008-sp2.yml) diff --git a/windows/release-information/breadcrumb/toc.yml b/windows/release-information/breadcrumb/toc.yml deleted file mode 100644 index 5c9f236497..0000000000 --- a/windows/release-information/breadcrumb/toc.yml +++ /dev/null @@ -1,11 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Windows - tocHref: /windows - topicHref: /windows/windows-10 - items: - - name: Release information - tocHref: /windows/release-information/ - topicHref: /windows/release-information/index diff --git a/windows/release-information/index.md b/windows/release-information/index.md deleted file mode 100644 index 5f7b5e22f9..0000000000 --- a/windows/release-information/index.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Windows 10 - release information -description: Learn release information for Windows 10 releases -keywords: ["Windows 10", "Windows 10 October 2018 Update"] -ms.prod: w10 -layout: LandingPage -ms.topic: landing-page -ms.mktglfcycl: deploy -ms.sitesec: library -author: lizap -ms.author: elizapo -ms.localizationpriority: high ---- -# Windows 10 release information - -Feature updates for Windows 10 are released twice a year, around March and September, via the Semi-Annual Channel. They will be serviced with monthly quality updates for 18 or 30 months from the date of the release, depending on the lifecycle policy. - -We recommend that you begin deployment of each Semi-Annual Channel release immediately as a targeted deployment to devices selected for early adoption and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. - -For information about servicing timelines, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853). - ->[!NOTE] ->Beginning with Windows 10, version 1903, this page will no longer list Semi-Annual Channel (Targeted) information for version 1903 and future feature updates. Instead, you will find a single entry for each Semi-Annual Channel release. For more information, see [this blog post](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523). - - -
                  -
                  - - -
                  - - diff --git a/windows/release-information/resolved-issues-windows-10-1507.yml b/windows/release-information/resolved-issues-windows-10-1507.yml deleted file mode 100644 index ab7065d60a..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1507.yml +++ /dev/null @@ -1,115 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1507 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1507 - description: Resolved issues in Windows 10, version 1507 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1507"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1507 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 10240.18244

                  June 11, 2019
                  KB4503291
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  OS Build 10240.18244

                  June 11, 2019
                  KB4503291
                  Resolved
                  KB4507458
                  July 09, 2019
                  10:00 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  OS Build 10240.18215

                  May 14, 2019
                  KB4499154
                  Resolved
                  KB4505051
                  May 19, 2019
                  02:00 PM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4493475
                  April 09, 2019
                  10:00 AM PT
                  Unable to access hotspots with third-party applications
                  Third-party applications may have difficulty authenticating hotspots.

                  See details >
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Resolved
                  KB4487018
                  February 12, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Resolved
                  KB4493475
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4489872
                  March 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4491101
                  February 21, 2019
                  02:00 PM PT
                  First character of Japanese era name not recognized
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4489872
                  March 12, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  OS Build 10240.18158

                  March 12, 2019
                  KB4489872
                  Resolved
                  KB4493475
                  April 09, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Resolved
                  KB4487018
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4489872
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503291) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 10240.18244

                  June 11, 2019
                  KB4503291
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4507458.

                  Back to top
                  OS Build 10240.18244

                  June 11, 2019
                  KB4503291
                  Resolved
                  KB4507458
                  Resolved:
                  July 09, 2019
                  10:00 AM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: We have released an \"optional, out-of-band\" update for Windows 10 (KB4505051) to resolve this issue. If you are affected, we recommend you apply this update by installing KB4505051 from Windows Update and then restarting your device.

                  This update will not be applied automatically. To download and install this update, go to Settings > Update & Security > Windows Update and select Check for updates. To get the standalone package for KB4505051, search for it in the Microsoft Update Catalog.
                   

                  Back to top
                  OS Build 10240.18215

                  May 14, 2019
                  KB4499154
                  Resolved
                  KB4505051
                  Resolved:
                  May 19, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Custom URI schemes may not start corresponding application
                  After installing KB4489872, Custom URI Schemes for Application Protocol handlers may not start the corresponding application for local intranet and trusted sites on Internet Explorer.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue was resolved in KB4493475.

                  Back to top
                  OS Build 10240.18158

                  March 12, 2019
                  KB4489872
                  Resolved
                  KB4493475
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                   
                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493475

                  Back to top
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4493475
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4487018, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4489872.

                  Back to top
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4489872
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  After installing KB4487018, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4491101.

                  Back to top
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4491101
                  Resolved:
                  February 21, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  First character of Japanese era name not recognized
                  After installing KB4487018, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4489872.

                  Back to top
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4489872
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4489872.

                  Back to top
                  OS Build 10240.18132

                  February 12, 2019
                  KB4487018
                  Resolved
                  KB4489872
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Unable to access hotspots with third-party applications
                  After installing KB4480962, third-party applications may have difficulty authenticating hotspots.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4487018.

                  Back to top
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Resolved
                  KB4487018
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  After installing KB4480962, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue was resolved in KB4493475.

                  Back to top
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Resolved
                  KB4493475
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, \"Unrecognized Database Format\".

                  Affected platforms:
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487018.

                  Back to top
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Resolved
                  KB4487018
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml deleted file mode 100644 index 2c0de867c7..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1607.yml +++ /dev/null @@ -1,155 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1607 and Windows Server 2016 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1607 and Windows Server 2016 - description: Resolved issues in Windows 10, version 1607 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1607"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1607 and Windows Server 2016 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  SCVMM cannot enumerate and manage logical switches deployed on the host
                  For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.

                  See details >
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Resolved
                  KB4507459
                  July 16, 2019
                  10:00 AM PT
                  Some applications may fail to run as expected on clients of AD FS 2016
                  Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016)

                  See details >
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4507459
                  July 16, 2019
                  10:00 AM PT
                  Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                  Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

                  See details >
                  OS Build 14393.2969

                  May 14, 2019
                  KB4494440
                  Resolved
                  KB4507460
                  July 09, 2019
                  10:00 AM PT
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                  See details >
                  OS Build 14393.2999

                  May 23, 2019
                  KB4499177
                  Resolved
                  KB4509475
                  June 27, 2019
                  02:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Resolved
                  KB4503294
                  June 18, 2019
                  02:00 PM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  See details >
                  OS Build 14393.2999

                  May 23, 2019
                  KB4499177
                  Resolved
                  KB4503267
                  June 11, 2019
                  10:00 AM PT
                  Issue using PXE to start a device from WDS
                  There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.

                  See details >
                  OS Build 14393.2848

                  March 12, 2019
                  KB4489882
                  Resolved
                  KB4503267
                  June 11, 2019
                  10:00 AM PT
                  Update not showing as applicable through WSUS or SCCM or when manually installed
                  Update not showing as applicable through WSUS or SCCM or when manually installed

                  See details >
                  OS Build 14393.2969

                  May 14, 2019
                  KB4494440
                  Resolved
                  KB4498947
                  May 14, 2019
                  10:00 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  OS Build 14393.2969

                  May 14, 2019
                  KB4494440
                  Resolved
                  KB4505052
                  May 19, 2019
                  02:00 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                  See details >
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4494440
                  May 14, 2019
                  10:00 AM PT
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.

                  See details >
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4494440
                  May 14, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4493470
                  April 09, 2019
                  10:00 AM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                  See details >
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Resolved
                  KB4493470
                  April 09, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup.

                  See details >
                  OS Build 14393.2879

                  March 19, 2019
                  KB4489889
                  Resolved
                  KB4493470
                  April 09, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Resolved
                  KB4493470
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4489882
                  March 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4487006
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  OS Build 14393.2759

                  January 17, 2019
                  KB4480977
                  Resolved
                  KB4487006
                  February 19, 2019
                  02:00 PM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  OS Build 14393.2848

                  March 12, 2019
                  KB4489882
                  Resolved
                  KB4493473
                  April 25, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Resolved
                  KB4487026
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4487006
                  February 19, 2019
                  02:00 PM PT
                  Issue hosting multiple terminal server sessions and a user logs off on Windows Server
                  In some cases, Windows Server will stop working and restart when hosting multiple terminal server sessions and a user logs off.

                  See details >
                  OS Build 14393.2828

                  February 19, 2019
                  KB4487006
                  Resolved
                  KB4489882
                  March 12, 2019
                  10:00 AM PT
                  Instant search in Microsoft Outlook fails on Windows Server 2016
                  Instant search in Microsoft Outlook clients fail with the error, \"Outlook cannot perform the search\" on Windows Server 2016.

                  See details >
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Resolved
                  KB4487026
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503267) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  Some applications may fail to run as expected on clients of AD FS 2016
                  Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016) after installation of KB4493473 on the server. Applications that may exhibit this behavior use an IFRAME during non-interactive authentication requests and receive X-Frame Options set to DENY.

                  Affected platforms:
                  • Server: Windows Server 2016
                  Resolution: This issue was resolved in KB4507459.

                  Back to top
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4507459
                  Resolved:
                  July 16, 2019
                  10:00 AM PT

                  Opened:
                  June 04, 2019
                  05:55 PM PT
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4499177. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4509475.

                  Back to top
                  OS Build 14393.2999

                  May 23, 2019
                  KB4499177
                  Resolved
                  KB4509475
                  Resolved:
                  June 27, 2019
                  02:00 PM PT

                  Opened:
                  June 20, 2019
                  04:46 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503294.

                  Back to top
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Resolved
                  KB4503294
                  Resolved:
                  June 18, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4503267.

                  Back to top
                  OS Build 14393.2999

                  May 23, 2019
                  KB4499177
                  Resolved
                  KB4503267
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  June 05, 2019
                  05:49 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                  Some devices with Hyper-V enabled may enter BitLocker recovery mode and receive an error, \"0xC0210000\" after installing KB4494440 and restarting.

                  Affected platforms:
                  • Client: Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2016
                  Resolution: This issue was resolved in KB4507460.

                  Back to top
                  OS Build 14393.2969

                  May 14, 2019
                  KB4494440
                  Resolved
                  KB4507460
                  Resolved:
                  July 09, 2019
                  10:00 AM PT

                  Opened:
                  May 21, 2019
                  08:50 AM PT
                  Update not showing as applicable through WSUS or SCCM or when manually installed
                  KB4494440 or later updates may not show as applicable through WSUS or SCCM to the affected platforms. When manually installing the standalone update from Microsoft Update Catalog, it may fail to install with the error, \"The update is not applicable to your computer.\"


                  Affected platforms:
                  • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2016

                  Resolution: The servicing stack update (SSU) (KB4498947) must be installed before installing the latest cumulative update (LCU). The LCU will not be reported as applicable until the SSU is installed. For more information, see Servicing stack updates.

                  Back to top
                  OS Build 14393.2969

                  May 14, 2019
                  KB4494440
                  Resolved
                  KB4498947
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 24, 2019
                  04:20 PM PT
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: We have released an \"optional, out-of-band\" update for Windows 10 (KB4505052) to resolve this issue. If you are affected, we recommend you apply this update by installing KB4505052 from Windows Update and then restarting your device.

                  This update will not be applied automatically. To download and install this update, go to Settings > Update & Security > Windows Update and select Check for updates. To get the standalone package for KB4505052, search for it in the Microsoft Update Catalog.
                   

                  Back to top
                  OS Build 14393.2969

                  May 14, 2019
                  KB4494440
                  Resolved
                  KB4505052
                  Resolved:
                  May 19, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue has been resolved.

                  Back to top
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4494440
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 10, 2019
                  10:35 AM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493473
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 
                  • Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016 
                  Resolution: This issue was resolved in KB4494440.

                  Back to top
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4494440
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Issue using PXE to start a device from WDS
                  After installing KB4489882, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue was resolved in KB4503267.

                  Back to top
                  OS Build 14393.2848

                  March 12, 2019
                  KB4489882
                  Resolved
                  KB4503267
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
                  Resolution: This issue was resolved in KB4493470.

                  Back to top
                  OS Build 14393.2879

                  March 19, 2019
                  KB4489889
                  Resolved
                  KB4493470
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 19, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  After installing KB4489882, Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4493473

                  Back to top
                  OS Build 14393.2848

                  March 12, 2019
                  KB4489882
                  Resolved
                  KB4493473
                  Resolved:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                   
                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493470

                  Back to top
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4493470
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4487026, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4489882.

                  Back to top
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4489882
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  After installing KB4487026, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4487006.

                  Back to top
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4487006
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487006.

                  Back to top
                  OS Build 14393.2791

                  February 12, 2019
                  KB4487026
                  Resolved
                  KB4487006
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Issue hosting multiple terminal server sessions and a user logs off on Windows Server
                  In some cases, Windows Server will stop working and restart when hosting multiple terminal server sessions and a user logs off. The faulting driver is win32kbase.sys.

                  Affected platforms:
                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2016
                  Resolution: This issue is resolved in KB4489882.

                  Back to top
                  OS Build 14393.2828

                  February 19, 2019
                  KB4487006
                  Resolved
                  KB4489882
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 19, 2019
                  02:00 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  After installing KB4480961, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                  • Cache size and location show zero or empty.
                  • Keyboard shortcuts may not work properly.
                  • Webpages may intermittently fail to load or render correctly.
                  • Issues with credential prompts.
                  • Issues when downloading files.
                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: This issue was resolved in KB4493470.

                  Back to top
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Resolved
                  KB4493470
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  After installing KB4480961, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue was resolved in KB4493470.

                  Back to top
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Resolved
                  KB4493470
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  After installing KB4480977, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487006.

                  Back to top
                  OS Build 14393.2759

                  January 17, 2019
                  KB4480977
                  Resolved
                  KB4487006
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 17, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                  Affected platforms:
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4487026.

                  Back to top
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Resolved
                  KB4487026
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " - -- title: November 2018 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  SCVMM cannot enumerate and manage logical switches deployed on the host
                  For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host after installing KB4467684.

                  Additionally, if you do not follow the best practices, a stop error may occur in vfpext.sys on the hosts.

                  Affected platforms:
                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2016
                  Resolution: This issue was resolved in KB4507459.

                  Back to top
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Resolved
                  KB4507459
                  Resolved:
                  July 16, 2019
                  10:00 AM PT

                  Opened:
                  November 27, 2018
                  10:00 AM PT
                  Instant search in Microsoft Outlook fails on Windows Server 2016
                  After installing KB4467684 on Windows Server 2016, instant search in Microsoft Outlook clients fail with the error, \"Outlook cannot perform the search\".

                  Affected platforms:
                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2016
                  Resolution: This issue is resolved in KB4487026.

                  Back to top
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Resolved
                  KB4487026
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  November 27, 2018
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-10-1703.yml b/windows/release-information/resolved-issues-windows-10-1703.yml deleted file mode 100644 index 3401b26fdf..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1703.yml +++ /dev/null @@ -1,125 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1703 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1703 - description: Resolved issues in Windows 10, version 1703 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1703"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1703 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 15063.1868

                  June 11, 2019
                  KB4503279
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                  Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

                  See details >
                  OS Build 15063.1805

                  May 14, 2019
                  KB4499181
                  Resolved
                  KB4507450
                  July 09, 2019
                  10:00 AM PT
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                  See details >
                  OS Build 15063.1839

                  May 28, 2019
                  KB4499162
                  Resolved
                  KB4509476
                  June 26, 2019
                  04:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  OS Build 15063.1868

                  June 11, 2019
                  KB4503279
                  Resolved
                  KB4503289
                  June 18, 2019
                  02:00 PM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  See details >
                  OS Build 15063.1839

                  May 28, 2019
                  KB4499162
                  Resolved
                  KB4503279
                  June 11, 2019
                  10:00 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  OS Build 15063.1805

                  May 14, 2019
                  KB4499181
                  Resolved
                  KB4505055
                  May 19, 2019
                  02:00 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                  See details >
                  OS Build 15063.1784

                  April 25, 2019
                  KB4493436
                  Resolved
                  KB4499181
                  May 14, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  OS Build 15063.1631

                  February 12, 2019
                  KB4487020
                  Resolved
                  KB4493474
                  April 09, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                  See details >
                  OS Build 15063.1716

                  March 19, 2019
                  KB4489888
                  Resolved
                  KB4493474
                  April 09, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Resolved
                  KB4493474
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  OS Build 15063.1659

                  February 19, 2019
                  KB4487011
                  Resolved
                  KB4489871
                  March 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  OS Build 15063.1631

                  February 12, 2019
                  KB4487020
                  Resolved
                  KB4487011
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  OS Build 15063.1596

                  January 15, 2019
                  KB4480959
                  Resolved
                  KB4487011
                  February 19, 2019
                  02:00 PM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  OS Build 15063.1689

                  March 12, 2019
                  KB4489871
                  Resolved
                  KB4493436
                  April 25, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Resolved
                  KB4487020
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  OS Build 15063.1631

                  February 12, 2019
                  KB4487020
                  Resolved
                  KB4487011
                  February 19, 2019
                  02:00 PM PT
                  Webpages become unresponsive in Microsoft Edge
                  Microsoft Edge users report difficulty browsing and loading webpages.

                  See details >
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Resolved
                  KB4487020
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503279) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 15063.1868

                  June 11, 2019
                  KB4503279
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4499162. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4509476.

                  Back to top
                  OS Build 15063.1839

                  May 28, 2019
                  KB4499162
                  Resolved
                  KB4509476
                  Resolved:
                  June 26, 2019
                  04:00 PM PT

                  Opened:
                  June 20, 2019
                  04:46 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503289.

                  Back to top
                  OS Build 15063.1868

                  June 11, 2019
                  KB4503279
                  Resolved
                  KB4503289
                  Resolved:
                  June 18, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4503279.

                  Back to top
                  OS Build 15063.1839

                  May 28, 2019
                  KB4499162
                  Resolved
                  KB4503279
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  June 05, 2019
                  05:49 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                  Some devices with Hyper-V enabled may enter BitLocker recovery mode and receive an error, \"0xC0210000\" after installing KB4499181 and restarting.

                  Affected platforms:
                  • Client: Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2016
                  Resolution: This issue was resolved in KB4507450.

                  Back to top
                  OS Build 15063.1805

                  May 14, 2019
                  KB4499181
                  Resolved
                  KB4507450
                  Resolved:
                  July 09, 2019
                  10:00 AM PT

                  Opened:
                  May 21, 2019
                  08:50 AM PT
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: We have released an \"optional, out-of-band\" update for Windows 10 (KB4505055) to resolve this issue. If you are affected, we recommend you apply this update by installing KB4505055 from Windows Update and then restarting your device.

                  This update will not be applied automatically. To download and install this update, go to Settings > Update & Security > Windows Update and select Check for updates. To get the standalone package for KB4505055, search for it in the Microsoft Update Catalog.
                   

                  Back to top
                  OS Build 15063.1805

                  May 14, 2019
                  KB4499181
                  Resolved
                  KB4505055
                  Resolved:
                  May 19, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue has been resolved.

                  Back to top
                  OS Build 15063.1784

                  April 25, 2019
                  KB4493436
                  Resolved
                  KB4499181
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 10, 2019
                  10:35 AM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
                  Resolution: This issue was resolved in KB4493474.

                  Back to top
                  OS Build 15063.1716

                  March 19, 2019
                  KB4489888
                  Resolved
                  KB4493474
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 19, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  After installing KB4489871, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4493436

                  Back to top
                  OS Build 15063.1689

                  March 12, 2019
                  KB4489871
                  Resolved
                  KB4493436
                  Resolved:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                   
                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                   
                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493474

                  Back to top
                  OS Build 15063.1631

                  February 12, 2019
                  KB4487020
                  Resolved
                  KB4493474
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4487011, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4489871.

                  Back to top
                  OS Build 15063.1659

                  February 19, 2019
                  KB4487011
                  Resolved
                  KB4489871
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 19, 2019
                  02:00 PM PT
                  Internet Explorer may fail to load images
                  After installing KB4487020, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4487011.

                  Back to top
                  OS Build 15063.1631

                  February 12, 2019
                  KB4487020
                  Resolved
                  KB4487011
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487011.

                  Back to top
                  OS Build 15063.1631

                  February 12, 2019
                  KB4487020
                  Resolved
                  KB4487011
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  MSXML6 may cause applications to stop responding
                  After installing KB4480973, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue was resolved in KB4493474.

                  Back to top
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Resolved
                  KB4493474
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  After installing KB4480959, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487011.

                  Back to top
                  OS Build 15063.1596

                  January 15, 2019
                  KB4480959
                  Resolved
                  KB4487011
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 15, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                  Affected platforms:
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487020.

                  Back to top
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Resolved
                  KB4487020
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Webpages become unresponsive in Microsoft Edge
                  After installing KB4480973, some Microsoft Edge users report that they:
                  • Cannot load web pages using a local IP address.
                  • Cannot load web pages on the Internet using a VPN connection.
                  Browsing fails or the web page may become unresponsive.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                  Resolution: This issue is resolved in KB4486996

                  Back to top
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Resolved
                  KB4487020
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml deleted file mode 100644 index d2b59916e7..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1709.yml +++ /dev/null @@ -1,135 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1709 and Windows Server, version 1709 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1709 and Windows Server, version 1709 - description: Resolved issues in Windows 10, version 1709 and Windows Server 1709 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1709"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1709 and Windows Server, version 1709 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                  See details >
                  OS Build 16299.1182

                  May 28, 2019
                  KB4499147
                  Resolved
                  KB4509477
                  June 26, 2019
                  04:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Resolved
                  KB4503281
                  June 18, 2019
                  02:00 PM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  See details >
                  OS Build 16299.1182

                  May 28, 2019
                  KB4499147
                  Resolved
                  KB4503284
                  June 11, 2019
                  10:00 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  OS Build 16299.1143

                  May 14, 2019
                  KB4498946
                  Resolved
                  KB4505062
                  May 19, 2019
                  02:00 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                  See details >
                  OS Build 16299.1127

                  April 25, 2019
                  KB4493440
                  Resolved
                  KB4499179
                  May 14, 2019
                  10:00 AM PT
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.

                  See details >
                  OS Build 16299.1127

                  April 25, 2019
                  KB4493440
                  Resolved
                  KB4499179
                  May 14, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  OS Build 16299.1029

                  March 12, 2019
                  KB4489886
                  Resolved
                  KB4493440
                  April 25, 2019
                  02:00 PM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4493441
                  April 09, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                  See details >
                  OS Build 16299.1059

                  March 19, 2019
                  KB4489890
                  Resolved
                  KB4493441
                  April 09, 2019
                  10:00 AM PT
                  MSXML6 causes applications to stop responding if an exception was thrown
                  MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Resolved
                  KB4493441
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4489886
                  March 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4487021
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  OS Build 16299.936

                  January 15, 2019
                  KB4480967
                  Resolved
                  KB4487021
                  February 19, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Resolved
                  KB4486996
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4487021
                  February 19, 2019
                  02:00 PM PT
                  Webpages become unresponsive in Microsoft Edge
                  Microsoft Edge users report difficulty browsing and loading webpages.

                  See details >
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Resolved
                  KB4486996
                  February 12, 2019
                  10:00 AM PT
                  Stop error when attempting to start SSH from WSL
                  A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.

                  See details >
                  OS Build 16299.1029

                  March 12, 2019
                  KB4489886
                  Resolved
                  KB4493441
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503284) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4499147. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4509477.

                  Back to top
                  OS Build 16299.1182

                  May 28, 2019
                  KB4499147
                  Resolved
                  KB4509477
                  Resolved:
                  June 26, 2019
                  04:00 PM PT

                  Opened:
                  June 20, 2019
                  04:46 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503281.

                  Back to top
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Resolved
                  KB4503281
                  Resolved:
                  June 18, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4503284.

                  Back to top
                  OS Build 16299.1182

                  May 28, 2019
                  KB4499147
                  Resolved
                  KB4503284
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  June 05, 2019
                  05:49 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolved: We have released an \"out-of-band\" update for Windows 10 (KB4505062) to resolve this issue.

                  • UK customers: This update will be applied automatically to resolve this issue. You may be required to restart your device again. If you are affected by this issue, Check for updates to apply the update immediately.
                  • Customers outside of the UK: This update will not be applied automatically. If you are affected by this issue, we recommend you apply this update by installing KB4505062 from Windows Update and then restarting your device.
                  To download and install this update, go to Settings > Update & Security > Windows Update and select Check for updates. To get the standalone package for KB4505062, search for it in the Microsoft Update Catalog.
                   

                  Back to top
                  OS Build 16299.1143

                  May 14, 2019
                  KB4498946
                  Resolved
                  KB4505062
                  Resolved:
                  May 19, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue has been resolved.

                  Back to top
                  OS Build 16299.1127

                  April 25, 2019
                  KB4493440
                  Resolved
                  KB4499179
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 10, 2019
                  10:35 AM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493440
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 
                  • Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016 
                  Resolution: This issue was resolved in KB4499179.

                  Back to top
                  OS Build 16299.1127

                  April 25, 2019
                  KB4493440
                  Resolved
                  KB4499179
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Custom URI schemes may not start corresponding application
                  After installing KB4489886, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4493440

                  Back to top
                  OS Build 16299.1029

                  March 12, 2019
                  KB4489886
                  Resolved
                  KB4493440
                  Resolved:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
                  Resolution: This issue is resolved in KB4493441.

                  Back to top
                  OS Build 16299.1059

                  March 19, 2019
                  KB4489890
                  Resolved
                  KB4493441
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 19, 2019
                  10:00 AM PT
                  Stop error when attempting to start SSH from WSL
                  After applying KB4489886, a stop error occurs when attempting to start the Secure Shell (SSH) client program from Windows Subsystem for Linux (WSL) with agent forwarding enabled using a command line switch (ssh –A) or a configuration setting.

                  Affected platforms:
                  • Client: Windows 10, version 1803; Windows 10, version 1709
                  • Server: Windows Server, version 1803; Windows Server, version 1709
                  Resolution: This issue is resolved in KB4493441.

                  Back to top
                  OS Build 16299.1029

                  March 12, 2019
                  KB4489886
                  Resolved
                  KB4493441
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                   
                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493441

                  Back to top
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4493441
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4486996, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4489886.

                  Back to top
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4489886
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  After installing KB4486996, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4487021.

                  Back to top
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4487021
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487021.

                  Back to top
                  OS Build 16299.967

                  February 12, 2019
                  KB4486996
                  Resolved
                  KB4487021
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  MSXML6 causes applications to stop responding if an exception was thrown
                  After installing KB4480978, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4493441.

                  Back to top
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Resolved
                  KB4493441
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  After installing KB4480967, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487021.

                  Back to top
                  OS Build 16299.936

                  January 15, 2019
                  KB4480967
                  Resolved
                  KB4487021
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 15, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format.”

                  Affected platforms:
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4486996.

                  Back to top
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Resolved
                  KB4486996
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Webpages become unresponsive in Microsoft Edge
                  After installing KB4480978, some Microsoft Edge users report that they:
                  • Cannot load web pages using a local IP address. 
                  • Cannot load web pages on the Internet using a VPN connection.  
                  Browsing fails or the web page may become unresponsive. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                  Resolution: This issue is resolved in KB4486996.

                  Back to top
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Resolved
                  KB4486996
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml deleted file mode 100644 index 24ad1254f2..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1803.yml +++ /dev/null @@ -1,143 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1803 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1803 - description: Resolved issues in Windows 10, version 1803 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1803"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1803 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                  See details >
                  OS Build 17134.799

                  May 21, 2019
                  KB4499183
                  Resolved
                  KB4509478
                  June 26, 2019
                  04:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Resolved
                  KB4503288
                  June 18, 2019
                  02:00 PM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  See details >
                  OS Build 17134.799

                  May 21, 2019
                  KB4499183
                  Resolved
                  KB4503286
                  June 11, 2019
                  10:00 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  OS Build 17134.765

                  May 14, 2019
                  KB4499167
                  Resolved
                  KB4505064
                  May 19, 2019
                  02:00 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                  See details >
                  OS Build 17134.753

                  April 25, 2019
                  KB4493437
                  Resolved
                  KB4499167
                  May 14, 2019
                  10:00 AM PT
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.

                  See details >
                  OS Build 17134.753

                  April 25, 2019
                  KB4493437
                  Resolved
                  KB4499167
                  May 14, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  OS Build 17134.590

                  February 12, 2019
                  KB4487017
                  Resolved
                  KB4493464
                  April 09, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                  See details >
                  OS Build 17134.677

                  March 19, 2019
                  KB4489894
                  Resolved
                  KB4493464
                  April 09, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Resolved
                  KB4493464
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  OS Build 17134.590

                  February 12, 2019
                  KB4487017
                  Resolved
                  KB4489868
                  March 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  OS Build 17134.590

                  February 12, 2019
                  KB4487017
                  Resolved
                  KB4487029
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  OS Build 17134.556

                  January 15, 2019
                  KB4480976
                  Resolved
                  KB4487029
                  February 19, 2019
                  02:00 PM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  OS Build 17134.648

                  March 12, 2019
                  KB4489868
                  Resolved
                  KB4493437
                  April 25, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Resolved
                  KB4487017
                  February 12, 2019
                  10:00 AM PT
                  Cannot pin a web link on the Start menu or the taskbar
                  Some users cannot pin a web link on the Start menu or the taskbar.

                  See details >
                  OS Build 17134.471

                  December 11, 2018
                  KB4471324
                  Resolved
                  KB4487029
                  February 19, 2019
                  02:00 PM PT
                  Webpages become unresponsive in Microsoft Edge
                  Microsoft Edge users report difficulty browsing and loading webpages.

                  See details >
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Resolved
                  KB4487017
                  February 12, 2019
                  10:00 AM PT
                  Stop error when attempting to start SSH from WSL
                  A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.

                  See details >
                  OS Build 17134.648

                  March 12, 2019
                  KB4489868
                  Resolved
                  KB4493464
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503286) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4499183. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4509478.

                  Back to top
                  OS Build 17134.799

                  May 21, 2019
                  KB4499183
                  Resolved
                  KB4509478
                  Resolved:
                  June 26, 2019
                  04:00 PM PT

                  Opened:
                  June 20, 2019
                  04:46 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503288.

                  Back to top
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Resolved
                  KB4503288
                  Resolved:
                  June 18, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4503286.

                  Back to top
                  OS Build 17134.799

                  May 21, 2019
                  KB4499183
                  Resolved
                  KB4503286
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  June 05, 2019
                  05:49 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolved: We have released an \"out-of-band\" update for Windows 10 (KB4505064) to resolve this issue.

                  • UK customers: This update will be applied automatically to resolve this issue. You may be required to restart your device again. If you are affected by this issue, Check for updates to apply the update immediately.
                  • Customers outside of the UK: This update will not be applied automatically. If you are affected by this issue, we recommend you apply this update by installing KB4505064 from Windows Update and then restarting your device.
                  To download and install this update, go to Settings > Update & Security > Windows Update and select Check for updates. To get the standalone package for KB4505064, search for it in the Microsoft Update Catalog.
                   

                  Back to top
                  OS Build 17134.765

                  May 14, 2019
                  KB4499167
                  Resolved
                  KB4505064
                  Resolved:
                  May 19, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue has been resolved.

                  Back to top
                  OS Build 17134.753

                  April 25, 2019
                  KB4493437
                  Resolved
                  KB4499167
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 10, 2019
                  10:35 AM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4493437
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 
                  • Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016 
                  Resolution: This issue was resolved in KB4499167.

                  Back to top
                  OS Build 17134.753

                  April 25, 2019
                  KB4493437
                  Resolved
                  KB4499167
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
                  Resolution: This issue was resolved in KB4493464

                  Back to top
                  OS Build 17134.677

                  March 19, 2019
                  KB4489894
                  Resolved
                  KB4493464
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 19, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  After installing KB4489868, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4493437

                  Back to top
                  OS Build 17134.648

                  March 12, 2019
                  KB4489868
                  Resolved
                  KB4493437
                  Resolved:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  Stop error when attempting to start SSH from WSL
                  After applying KB4489868, a stop error occurs when attempting to start the Secure Shell (SSH) client program from Windows Subsystem for Linux (WSL) with agent forwarding enabled using a command line switch (ssh -A) or a configuration setting.

                  Affected platforms:
                  • Client: Windows 10, version 1803; Windows 10, version 1709
                  • Server: Windows Server, version 1803; Windows Server, version 1709
                  Resolution: This issue was resolved in KB4493464.

                  Back to top
                  OS Build 17134.648

                  March 12, 2019
                  KB4489868
                  Resolved
                  KB4493464
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                   
                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493464

                  Back to top
                  OS Build 17134.590

                  February 12, 2019
                  KB4487017
                  Resolved
                  KB4493464
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4487017, users may received \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4489868.

                  Back to top
                  OS Build 17134.590

                  February 12, 2019
                  KB4487017
                  Resolved
                  KB4489868
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  After installing KB4487017, Internet Explorer may fail to load images with a backslash (\\) in their relative source path. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4487029

                  Back to top
                  OS Build 17134.590

                  February 12, 2019
                  KB4487017
                  Resolved
                  KB4487029
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  MSXML6 may cause applications to stop responding
                  After installing KB4480966, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue was resolved in KB4493464

                  Back to top
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Resolved
                  KB4493464
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  First character of the Japanese era name not recognized
                  After installing KB4480976, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487029

                  Back to top
                  OS Build 17134.556

                  January 15, 2019
                  KB4480976
                  Resolved
                  KB4487029
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487017.

                  Back to top
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Resolved
                  KB4487017
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Webpages become unresponsive in Microsoft Edge
                  After installing KB4480966, some Microsoft Edge users report that they: 
                  • Cannot load web pages using a local IP address. 
                  • Cannot load web pages on the Internet using a VPN connection.  
                  Browsing fails or the web page may become unresponsive. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                  Resolution: This issue is resolved in KB4487017

                  Back to top
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Resolved
                  KB4487017
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " - -- title: December 2018 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Cannot pin a web link on the Start menu or the taskbar
                  After installing KB4471324, some users cannot pin a web link on the Start menu or the taskbar. 

                  Affected platforms:
                  • Client: Windows 10, version 1803
                  • Server: Windows Server, version 1803
                  Resolution: This issue is resolved in KB4487029

                  Back to top
                  OS Build 17134.471

                  December 11, 2018
                  KB4471324
                  Resolved
                  KB4487029
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  December 11, 2018
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml deleted file mode 100644 index f2dc569ffb..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ /dev/null @@ -1,167 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1809 and Windows Server 2019 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1809 and Windows Server 2019 - description: Resolved issues in Windows 10, version 1809 or Windows Server 2019 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10 1809"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1809 and Windows Server 2019 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                  See details >
                  OS Build 17763.529

                  May 21, 2019
                  KB4497934
                  Resolved
                  KB4509479
                  June 26, 2019
                  04:00 PM PT
                  Devices with Realtek Bluetooth radios drivers may not pair or connect as expected
                  Devices with some Realtek Bluetooth radios drivers, in some circumstances, may have issues pairing or connecting to devices.

                  See details >
                  OS Build 17763.503

                  May 14, 2019
                  KB4494441
                  Resolved
                  KB4501371
                  June 18, 2019
                  02:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Resolved
                  KB4501371
                  June 18, 2019
                  02:00 PM PT
                  Printing from Microsoft Edge or other UWP apps may result in the error 0x80070007
                  Attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) apps, you may receive an error.

                  See details >
                  OS Build 17763.379

                  March 12, 2019
                  KB4489899
                  Resolved
                  KB4501371
                  June 18, 2019
                  02:00 PM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  See details >
                  OS Build 17763.529

                  May 21, 2019
                  KB4497934
                  Resolved
                  KB4503327
                  June 11, 2019
                  10:00 AM PT
                  Issue using PXE to start a device from WDS
                  Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely.

                  See details >
                  OS Build 17763.379

                  March 12, 2019
                  KB4489899
                  Resolved
                  KB4503327
                  June 11, 2019
                  10:00 AM PT
                  Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort
                  Upgrade block: Microsoft has identified issues with certain new Intel display drivers, which accidentally turn on unsupported features in Windows.

                  See details >
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  May 21, 2019
                  07:42 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  OS Build 17763.503

                  May 14, 2019
                  KB4494441
                  Resolved
                  KB4505056
                  May 19, 2019
                  02:00 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                  See details >
                  OS Build 17763.475

                  May 03, 2019
                  KB4495667
                  Resolved
                  KB4494441
                  May 14, 2019
                  10:00 AM PT
                  Windows 10, version 1809 update history may show an update installed twice
                  Some customers are reporting that KB4494441 installed twice on their device

                  See details >
                  OS Build 17763.503

                  May 14, 2019
                  KB4494441
                  Resolved
                  May 16, 2019
                  02:37 PM PT
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.

                  See details >
                  OS Build 17763.475

                  May 03, 2019
                  KB4495667
                  Resolved
                  KB4494441
                  May 14, 2019
                  10:00 AM PT
                  Latest cumulative update (KB 4495667) installs automatically
                  Reports that the optional cumulative update (KB 4495667) installs automatically.

                  See details >
                  OS Build 17763.475

                  May 03, 2019
                  KB4495667
                  Resolved
                  May 08, 2019
                  03:37 PM PT
                  System may be unresponsive after restart if ArcaBit antivirus software installed
                  After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809

                  See details >
                  OS Build 17763.437

                  April 09, 2019
                  KB4493509
                  Resolved
                  May 08, 2019
                  03:30 PM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  OS Build 17763.379

                  March 12, 2019
                  KB4489899
                  Resolved
                  KB4495667
                  May 03, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4493509
                  April 09, 2019
                  10:00 AM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                  See details >
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Resolved
                  KB4493509
                  April 09, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                  See details >
                  OS Build 17763.404

                  April 02, 2019
                  KB4490481
                  Resolved
                  KB4493509
                  April 09, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Resolved
                  KB4493509
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4489899
                  March 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4482887
                  March 01, 2019
                  10:00 AM PT
                  First character of the Japanese era name not recognized
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4482887
                  March 01, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 9 file format may randomly stop working.

                  See details >
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4482887
                  March 01, 2019
                  10:00 AM PT
                  Issues with lock screen and Microsoft Edge tabs for certain AMD Radeon video cards
                  Upgrade block: Devices utilizing AMD Radeon HD2000 or HD4000 series video cards may experience issues with the lock screen and Microsoft Edge tabs.

                  See details >
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4487044
                  February 12, 2019
                  10:00 AM PT
                  Shared albums may not sync with iCloud for Windows
                  Upgrade block: Apple has identified an incompatibility with iCloud for Windows (version 7.7.0.27) where users may experience issues updating or synching Shared Albums.

                  See details >
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4482887
                  March 01, 2019
                  10:00 AM PT
                  Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup
                  Upgrade block: Users may see an Intel Audio Display (intcdaud.sys) notification during setup for devices with certain Intel Display Audio Drivers.

                  See details >
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4482887
                  March 01, 2019
                  10:00 AM PT
                  F5 VPN clients losing network connectivity
                  Upgrade block: After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.

                  See details >
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4482887
                  March 01, 2019
                  10:00 AM PT
                  Global DNS outage affects Windows Update customers
                  Windows Update customers were recently affected by a network infrastructure event caused by an external DNS service provider's global outage.

                  See details >
                  N/A

                  Resolved
                  March 08, 2019
                  11:15 AM PT
                  Apps may stop working after selecting an audio output device other than the default
                  Users with multiple audio devices that select an audio output device different from the \"Default Audio Device\" may find certain applications stop working unexpectedly.

                  See details >
                  OS Build 17763.348

                  March 01, 2019
                  KB4482887
                  Resolved
                  KB4490481
                  April 02, 2019
                  10:00 AM PT
                  Webpages become unresponsive in Microsoft Edge
                  Microsoft Edge users report difficulty browsing and loading webpages.

                  See details >
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Resolved
                  KB4487044
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503327) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  Difficulty connecting to some iSCSI-based SANs
                  Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4497934. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4509479.

                  Back to top
                  OS Build 17763.529

                  May 21, 2019
                  KB4497934
                  Resolved
                  KB4509479
                  Resolved:
                  June 26, 2019
                  04:00 PM PT

                  Opened:
                  June 20, 2019
                  04:46 PM PT
                  Devices with Realtek Bluetooth radios drivers may not pair or connect as expected
                  In some circumstances, devices with Realtek Bluetooth radios may have issues pairing or connecting to Bluetooth devices due to a driver issue.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server 2019
                  Resolution: This issue was resolved in KB4501371.

                  Back to top
                  OS Build 17763.503

                  May 14, 2019
                  KB4494441
                  Resolved
                  KB4501371
                  Resolved:
                  June 18, 2019
                  02:00 PM PT

                  Opened:
                  June 14, 2019
                  05:45 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4501371.

                  Back to top
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Resolved
                  KB4501371
                  Resolved:
                  June 18, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  Opening Internet Explorer 11 may fail
                  Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2019; Windows Server 2016
                  Resolution: This issue was resolved in KB4503327.

                  Back to top
                  OS Build 17763.529

                  May 21, 2019
                  KB4497934
                  Resolved
                  KB4503327
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  June 05, 2019
                  05:49 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Printing from Microsoft Edge or other UWP apps may result in the error 0x80070007
                  When attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications you may receive the error, \"Your printer has experienced an unexpected configuration problem. 0x80070007e.\"
                   
                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  Resolution: This issue was resolved in KB4501371

                  Back to top
                  OS Build 17763.379

                  March 12, 2019
                  KB4489899
                  Resolved
                  KB4501371
                  Resolved:
                  June 18, 2019
                  02:00 PM PT

                  Opened:
                  May 02, 2019
                  04:47 PM PT
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolved: We have released an \"out-of-band\" update for Windows 10 (KB4505056) to resolve this issue.

                  • UK customers: This update will be applied automatically to resolve this issue. You may be required to restart your device again. If you are affected by this issue, Check for updates to apply the update immediately.
                  • Customers outside of the UK: This update will not be applied automatically. If you are affected by this issue, we recommend you apply this update by installing KB4505056 from Windows Update and then restarting your device.
                  To download and install this update, go to Settings > Update & Security > Windows Update and select Check for updates. To get the standalone package for KB4505056, search for it in the Microsoft Update Catalog.
                   

                  Back to top
                  OS Build 17763.503

                  May 14, 2019
                  KB4494441
                  Resolved
                  KB4505056
                  Resolved:
                  May 19, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue has been resolved.

                  Back to top
                  OS Build 17763.475

                  May 03, 2019
                  KB4495667
                  Resolved
                  KB4494441
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 10, 2019
                  10:35 AM PT
                  Windows 10, version 1809 update history may show an update installed twice
                  Affected platforms:
                  • Client: Windows 10, version 1809
                  Cause:
                  In certain situations, installing an update requires multiple download and restart steps. In cases where two intermediate steps of the installation complete successfully, the View your Update history page will report that installation completed successfully twice. 

                  Resolution:
                  No action is required on your part. The update installation may take longer and may require more than one restart, but will install successfully after all intermediate installation steps have completed. We are working on improving this update experience to ensure the Update history correctly reflects the installation of the latest cumulative update (LCU).

                  Back to top
                  OS Build 17763.503

                  May 14, 2019
                  KB4494441
                  Resolved
                  Resolved:
                  May 16, 2019
                  02:37 PM PT

                  Opened:
                  May 14, 2019
                  02:56 PM PT
                  Zone transfers over TCP may fail
                  Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing KB4495667
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 
                  • Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016 
                  Resolution: This issue was resolved in KB4494441.

                  Back to top
                  OS Build 17763.475

                  May 03, 2019
                  KB4495667
                  Resolved
                  KB4494441
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 14, 2019
                  01:19 PM PT
                  Latest cumulative update (KB 4495667) installs automatically
                  Due to a servicing side issue some users were offered KB4495667 (optional update) automatically and rebooted devices. This issue has been mitigated.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  Resolution:: This issue has been mitigated on the servicing side to prevent auto installing of this update. Customers do not need to take any action.

                  Back to top
                  OS Build 17763.475

                  May 03, 2019
                  KB4495667
                  Resolved
                  Resolved:
                  May 08, 2019
                  03:37 PM PT

                  Opened:
                  May 05, 2019
                  12:01 PM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  System may be unresponsive after restart if ArcaBit antivirus software installed
                  ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 (client or server).

                  Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart.

                  Affected platforms:
                  • Client: Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Workaround: ArcaBit has released an update to address this issue for affected platforms. For more information, see the ArcaBit support article.

                  Resolution: This issue has been resolved. ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809 (client or server).

                  Back to top
                  OS Build 17763.437

                  April 09, 2019
                  KB4493509
                  Resolved
                  Resolved:
                  May 08, 2019
                  03:30 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  End-user-defined characters (EUDC) may cause blue screen at startup
                  If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. This is not a common setting in non-Asian regions.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
                  Resolution: This issue was resolved in KB4493509.

                  Back to top
                  OS Build 17763.404

                  April 02, 2019
                  KB4490481
                  Resolved
                  KB4493509
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  April 02, 2019
                  10:00 AM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Issue using PXE to start a device from WDS
                  After installing KB4489899, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue was resolved in KB4503327.

                  Back to top
                  OS Build 17763.379

                  March 12, 2019
                  KB4489899
                  Resolved
                  KB4503327
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  After installing KB4489899, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Workaround: Right-click the URL link to open it in a new window or tab, or enable Protected Mode in Internet Explorer for local intranet and trusted sites
                  1. Go to Tools > Internet options > Security.
                  2. Within Select a zone to view of change security settings, select Local intranet and then select Enable Protected Mode.
                  3. Select Trusted Sites and then select Enable Protected Mode
                  4. Select OK.
                  You must restart the browser after making these changes.

                  Resolution: This issue is resolved in KB4495667.

                  Back to top
                  OS Build 17763.379

                  March 12, 2019
                  KB4489899
                  Resolved
                  KB4495667
                  Resolved:
                  May 03, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  Apps may stop working after selecting an audio output device other than the default
                  After installing KB4482887 on machines that have multiple audio devices, applications that provide advanced options for internal or external audio output devices may stop working unexpectedly. This issue occurs for users that select an audio output device different from the \"Default Audio Device\". Examples of applications that may stop working include: 
                  • Windows Media Player 
                  • Realtek HD Audio Manager 
                  • Sound Blaster Control Panel 
                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  Resolution: This issue was resolved in KB4490481

                  Back to top
                  OS Build 17763.348

                  March 01, 2019
                  KB4482887
                  Resolved
                  KB4490481
                  Resolved:
                  April 02, 2019
                  10:00 AM PT

                  Opened:
                  March 01, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                   
                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1  
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2  
                  Resolution: This issue is resolved in KB4493509.  

                  Back to top
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4493509
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4487044, users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4489899

                  Back to top
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4489899
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  After installing KB4487044, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4482887.

                  Back to top
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4482887
                  Resolved:
                  March 01, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  First character of the Japanese era name not recognized
                  After installing KB4487044, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4482887

                  Back to top
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4482887
                  Resolved:
                  March 01, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4482887.

                  Back to top
                  OS Build 17763.316

                  February 12, 2019
                  KB4487044
                  Resolved
                  KB4482887
                  Resolved:
                  March 01, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  After installing KB4480116, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to: 
                  • Cache size and location show zero or empty. 
                  • Keyboard shortcuts may not work properly. 
                  • Webpages may intermittently fail to load or render correctly. 
                  • Issues with credential prompts. 
                  • Issues when downloading files. 
                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: This issue was resolved in KB4493509

                  Back to top
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Resolved
                  KB4493509
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  After installing KB4480116, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
                   
                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue was resolved in KB4493509

                  Back to top
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Resolved
                  KB4493509
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Global DNS outage affects Windows Update customers
                  Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider's global outage. A software update to the external provider's DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored. 
                   
                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  While this was not an issue with Microsoft's services, we take any service disruption for our customers seriously. We will work with partners to better understand this so we can provide higher quality service in the future even across diverse global network providers. 
                   
                  If you are still unable to connect to Windows Update services due to this problem, please contact your local ISP or network administrator. You can also refer to our new KB4493784 for more information to determine if your network is affected, and to provide your local ISP or network administrator with additional information to assist you. 

                  Back to top
                  N/A

                  Resolved
                  Resolved:
                  March 08, 2019
                  11:15 AM PT

                  Opened:
                  January 29, 2019
                  02:00 PM PT
                  Webpages become unresponsive in Microsoft Edge
                  After installing KB4480116, some Microsoft Edge users report that they:
                  • Cannot load web pages using a local IP address. 
                  • Cannot load web pages on the Internet using a VPN connection.
                  Browsing fails or the web page may become unresponsive.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                  Resolution: This issue is resolved in KB4487020

                  Back to top
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Resolved
                  KB4487044
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " - -- title: November 2018 -- items: - - type: markdown - text: " - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort
                  Upgrade block: Microsoft has identified issues with certain new Intel display drivers. Intel inadvertently released versions of its display driver (versions 24.20.100.6344, 24.20.100.6345) to OEMs that accidentally turned on unsupported features in Windows. 
                   
                  As a result, after updating to Windows 10, version 1809, audio playback from a monitor or television connected to a PC via HDMI, USB-C, or a DisplayPort may not function correctly on devices with these drivers.
                  Note: This Intel display driver issue is different from the Intel Smart Sound Technology driver (version 09.21.00.3755) audio issue previously documented.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019 
                  Next steps: Intel has released updated drivers to OEM device manufacturers. OEMs need to make the updated driver available via Windows Update. For more information, see the Intel Customer Support article.

                  Resolution: Microsoft has removed the safeguard hold.



                  Back to top
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  Resolved:
                  May 21, 2019
                  07:42 AM PT

                  Opened:
                  November 13, 2018
                  10:00 AM PT
                  Issues with lock screen and Microsoft Edge tabs for certain AMD Radeon video cards
                  Note: AMD no longer supports Radeon HD2000 and HD4000 series graphic processor units (GPUs).
                   
                  Upgrade block: After updating to Windows 10, version 1809, Microsoft Edge tabs may stop working when a device is configured with AMD Radeon HD2000 or HD4000 series video cards. Customers may get the following error code: \"INVALID_POINTER_READ_c0000005_atidxx64.dll\". 
                   
                  Some users may also experience performance issues with the lock screen or the ShellExperienceHost. (The lock screen hosts widgets, and the ShellExperienceHost is responsible for assorted shell functionality.) 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  Resolution: This issue was resolved in KB4487044, and the block was removed.

                  Back to top
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4487044
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  November 13, 2018
                  10:00 AM PT
                  Shared albums may not sync with iCloud for Windows
                  Upgrade block: Users who attempt to install iCloud for Windows (version 7.7.0.27) will see a message displayed that this version iCloud for Windows isn't supported and the install will fail.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  To ensure a seamless experience, Microsoft is blocking devices with iCloud for Windows (version 7.7.0.27) software installed from being offered Windows 10, version 1809 until this issue has been resolved. 

                  We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool from the Microsoft software download website until this issue is resolved. 
                   
                  Resolution: Apple has released an updated version of iCloud for Windows (version 7.8.1) that resolves compatibility issues encountered when updating or synching Shared Albums after updating to Windows 10, version 1809. We recommend that you update your iCloud for Windows to version 7.8.1 when prompted before attempting to upgrade to Windows 10, version 1809. You can also manually download the latest version of iCloud for Windows by visiting https://support.apple.com/HT204283.

                  Back to top
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4482887
                  Resolved:
                  March 01, 2019
                  10:00 AM PT

                  Opened:
                  November 13, 2018
                  10:00 AM PT
                  Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup
                  Upgrade block: Microsoft and Intel have identified a compatibility issue with a range of Intel Display Audio device drivers (intcdaud.sys, versions 10.25.0.3 - 10.25.0.8) that may result in excessive processor demand and reduced battery life. As a result, the update process to the Windows 10 October 2018 Update (Windows 10, version 1809) will fail and affected devices will automatically revert to the previous working configuration. 

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  If you see a \"What needs your attention\" notification during installation of the October 2018 Update, you have one of these affected drivers on your system. On the notification, click Back to remain on your current version of Windows 10. 
                   
                  To ensure a seamless experience, we are blocking devices from being offered the October 2018 Update until updated Intel device drivers are installed on your current operating system. We recommend that you do not attempt to manually update to Windows 10, version 1809, using the Update Now button or the Media Creation Tool from the Microsoft Software Download Center until newer Intel device drivers are available with the update. You can either wait for newer drivers to be installed automatically through Windows Update or check with your computer manufacturer for the latest device driver software availability and installation procedures. For more information about this issue, see Intel's customer support guidance.
                   
                  Resolution: This issue was resolved in KB4482887 and the upgrade block removed. 

                  Back to top
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4482887
                  Resolved:
                  March 01, 2019
                  10:00 AM PT

                  Opened:
                  November 13, 2018
                  10:00 AM PT
                  F5 VPN clients losing network connectivity
                  Upgrade block: After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  Resolution: This issue was resolved in KB4482887 and the upgrade block removed. 

                  Back to top
                  OS Build 17763.134

                  November 13, 2018
                  KB4467708
                  Resolved
                  KB4482887
                  Resolved:
                  March 01, 2019
                  10:00 AM PT

                  Opened:
                  November 13, 2018
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml deleted file mode 100644 index ad7c9065b6..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ /dev/null @@ -1,89 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1903 and Windows Server, version 1903 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1903 and Windows Server, version 1903 - description: Resolved issues in Windows 10, version 1903 and Windows Server 1903 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1903"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1903 and Windows Server, version 1903 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Display brightness may not respond to adjustments
                  Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4505903
                  July 26, 2019
                  02:00 PM PT
                  RASMAN service may stop working and result in the error “0xc0000005”
                  The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

                  See details >
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Resolved
                  KB4505903
                  July 26, 2019
                  02:00 PM PT
                  Loss of functionality in Dynabook Smartphone Link app
                  After updating to Windows 10, version 1903, you may experience a loss of functionality when using the Dynabook Smartphone Link application.

                  See details >
                  OS Build 18362.116

                  May 20, 2019
                  KB4505057
                  Resolved
                  July 11, 2019
                  01:54 PM PT
                  Error attempting to update with external USB device or memory card attached
                  PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  July 11, 2019
                  01:53 PM PT
                  Audio not working with Dolby Atmos headphones and home theater
                  Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  July 11, 2019
                  01:53 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Resolved
                  KB4501375
                  June 27, 2019
                  10:00 AM PT
                  Duplicate folders and documents showing in user profile directory
                  If known folders (e.g. Desktop, Documents, or Pictures folders) are redirected, an empty folder with that same name may be created.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4497935
                  May 29, 2019
                  02:00 PM PT
                  Older versions of BattlEye anti-cheat software incompatible
                  Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  June 07, 2019
                  04:26 PM PT
                  D3D applications and games may fail to enter full-screen mode on rotated displays
                  Some Direct3D (D3D) applications and games may fail to enter full-screen mode on rotated displays.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4497935
                  May 29, 2019
                  02:00 PM PT
                  AMD RAID driver incompatibility
                  Installation process may stop when trying to install Windows 10, version 1903 update on computers that run certain versions of AMD RAID drivers.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  June 06, 2019
                  11:06 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503293) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  RASMAN service may stop working and result in the error “0xc0000005”
                  The Remote Access Connection Manager (RASMAN) service may stop working and you may receive the error “0xc0000005” on devices where the diagnostic data level is manually configured to the non-default setting of 0. You may also receive an error in the Application section of Windows Logs in Event Viewer with Event ID 1000 referencing “svchost.exe_RasMan” and “rasman.dll”.

                  This issue only occurs when a VPN profile is configured as an Always On VPN (AOVPN) connection with or without device tunnel. This does not affect manual only VPN profiles or connections.

                  Affected platforms
                  • Client: Windows 10, version 1903
                  Resolution: This issue was resolved in KB4505903.

                  Back to top
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Resolved
                  KB4505903
                  Resolved:
                  July 26, 2019
                  02:00 PM PT

                  Opened:
                  June 28, 2019
                  05:01 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4501375.

                  Back to top
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Resolved
                  KB4501375
                  Resolved:
                  June 27, 2019
                  10:00 AM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Display brightness may not respond to adjustments
                  Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

                  To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue was resolved in KB4505903 and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4505903
                  Resolved:
                  July 26, 2019
                  02:00 PM PT

                  Opened:
                  May 21, 2019
                  07:56 AM PT
                  Loss of functionality in Dynabook Smartphone Link app
                  Some users may experience a loss of functionality after updating to Windows 10, version 1903 when using the Dynabook Smartphone Link application on Windows devices. Loss of functionality may affect the display of phone numbers in the Call menu and the ability to answer phone calls on the Windows PC.

                  To safeguard your update experience, we have applied a compatibility hold on devices with Dynabook Smartphone Link from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                  Back to top
                  OS Build 18362.116

                  May 20, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  July 11, 2019
                  01:54 PM PT

                  Opened:
                  May 24, 2019
                  03:10 PM PT
                  Error attempting to update with external USB device or memory card attached
                  If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

                  Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

                  Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

                  To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  July 11, 2019
                  01:53 PM PT

                  Opened:
                  May 21, 2019
                  07:38 AM PT
                  Audio not working with Dolby Atmos headphones and home theater
                  After updating to Windows 10, version 1903, you may experience loss of audio with Dolby Atmos for home theater (free extension) or Dolby Atmos for headphones (paid extension) acquired through the Microsoft Store due to a licensing configuration error.
                   
                  This occurs due to an issue with a Microsoft Store licensing component, where license holders are not able to connect to the Dolby Access app and enable Dolby Atmos extensions.
                   
                  To safeguard your update experience, we have applied protective hold on devices from being offered Windows 10, version 1903 until this issue is resolved. This configuration error will not result in loss of access for the acquired license once the problem is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  July 11, 2019
                  01:53 PM PT

                  Opened:
                  May 21, 2019
                  07:16 AM PT
                  Duplicate folders and documents showing in user profile directory
                  If you have redirected known folders (e.g. Desktop, Documents, or Pictures folders) you may see an empty folder with the same name in your %userprofile% directories after updating to Windows 10, version 1903. This may occur if known folders were redirected when you chose to back up your content to OneDrive using the OneDrive wizard, or if you chose to back up your content during the Windows Out-of-Box-Experience (OOBE). This may also occur if you redirected your known folders manually through the Properties dialog box in File Explorer. ?This issue does not cause any user files to be deleted and a solution is in progress.

                  To safeguard your update experience, we have applied a quality hold on devices with redirected known folders from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue was resolved in KB4497935 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.
                  (Posted June 11, 2019)

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4497935
                  Resolved:
                  May 29, 2019
                  02:00 PM PT

                  Opened:
                  May 21, 2019
                  07:16 AM PT
                  Older versions of BattlEye anti-cheat software incompatible
                  Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software. When launching a game that uses an older, impacted version of BattlEye anti-cheat software on a device running Windows 10, version 1903, the device may experience a system crash.

                  To safeguard your gaming experience, we have applied a compatibility hold on devices with the impacted versions of BattlEye software used by games installed on your PC. This will prevent Windows 10, version 1903 from being offered until the incompatible version of BattlEye software is no longer installed on the device. 

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Workaround: Before updating your machine, we recommend you do one or more of the following:

                  • Verify that your game is up to date with the latest available version of BattlEye software. Some game platforms allow you to validate your game files, which can confirm that your installation is fully up to date.
                  • Restart your system and open the game again.
                  • Uninstall BattlEye using https://www.battleye.com/downloads/UninstallBE.exe, and then reopen your game.
                  • Uninstall and reinstall your game.
                  Resolution: This issue was resolved externally by BattlEye for all known impacted games. For a list of recent games that use BattlEye, go to https://www.battleye.com/. We recommend following the workaround before updating to Windows 10, version 1903, as games with incompatible versions of BattleEye may fail to open after updating Windows. If you have confirmed your game is up to date and you have any issues with opening games related to a BattlEye error, please see https://www.battleye.com/support/faq/.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  June 07, 2019
                  04:26 PM PT

                  Opened:
                  May 21, 2019
                  07:34 AM PT
                  D3D applications and games may fail to enter full-screen mode on rotated displays
                  Some Direct3D (D3D) applications and games (e.g., 3DMark) may fail to enter full-screen mode on displays where the display orientation has been changed from the default (e.g., a landscape display in portrait mode).

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  • Server: Windows Server, version 1903
                  Resolution: This issue was resolved in KB4497935

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4497935
                  Resolved:
                  May 29, 2019
                  02:00 PM PT

                  Opened:
                  May 21, 2019
                  07:05 AM PT
                  AMD RAID driver incompatibility
                  Microsoft and AMD have identified an incompatibility with AMD RAID driver versions earlier than 9.2.0.105. When you attempt to install the Windows 10, version 1903 update on a Windows 10-based computer with an affected driver version, the installation process stops and you get a message like the following:

                  AMD Ryzen™ or AMD Ryzen™ Threadripper™ configured in SATA or NVMe RAID mode.

                  “A driver is installed that causes stability problems on Windows. This driver will be disabled. Check with your software/driver provider for an updated version that runs on this version of Windows.”

                   
                  To safeguard your update experience, we have applied a compatibility hold on devices with these AMD drivers from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue has been resolved externally by AMD. To resolve this issue, you will need to download the latest AMD RAID drivers directly from AMD at https://www.amd.com/en/support/chipsets/amd-socket-tr4/x399. The drivers must be version 9.2.0.105 or later. Install the drivers on the affected computer, and then restart the installation process for the Windows 10, version 1903 feature update.
                   
                  Note The safeguard hold will remain in place on machines with the older AMD RAID drivers. We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  June 06, 2019
                  11:06 AM PT

                  Opened:
                  May 21, 2019
                  07:12 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml deleted file mode 100644 index 33a6733fd2..0000000000 --- a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml +++ /dev/null @@ -1,145 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1 -metadata: - document_id: - title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1 - description: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1 - keywords: ["Resolved issues in Windows 7", "Windows 7", "Windows Server 2008 R2 SP1"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 7 and Windows Server 2008 R2 SP1 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503292
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  IE11 may stop working when loading or interacting with Power BI reports
                  Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

                  See details >
                  May 14, 2019
                  KB4499164
                  Resolved
                  KB4503277
                  June 20, 2019
                  02:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  June 11, 2019
                  KB4503292
                  Resolved
                  KB4503277
                  June 20, 2019
                  02:00 PM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  May 14, 2019
                  KB4499164
                  Resolved
                  KB4505050
                  May 18, 2019
                  02:00 PM PT
                  System may be unresponsive after restart if ArcaBit antivirus software installed
                  Devices with ArcaBit antivirus software installed may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493472
                  Resolved
                  May 14, 2019
                  01:23 PM PT
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493472
                  Resolved
                  May 14, 2019
                  01:22 PM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Devices with Avira antivirus software installed may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493472
                  Resolved
                  May 14, 2019
                  01:21 PM PT
                  Authentication may fail for services after the Kerberos ticket expires
                  Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.

                  See details >
                  March 12, 2019
                  KB4489878
                  Resolved
                  KB4499164
                  May 14, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  February 12, 2019
                  KB4486563
                  Resolved
                  KB4493472
                  April 09, 2019
                  10:00 AM PT
                  Devices may not respond at login or Welcome screen if running certain Avast software
                  Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.

                  See details >
                  April 09, 2019
                  KB4493472
                  Resolved
                  April 25, 2019
                  02:00 PM PT
                  NETDOM.EXE fails to run
                  NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.

                  See details >
                  March 12, 2019
                  KB4489878
                  Resolved
                  KB4493472
                  April 09, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  March 12, 2019
                  KB4489878
                  Resolved
                  KB4493472
                  April 09, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  February 12, 2019
                  KB4486563
                  Resolved
                  KB4486565
                  February 19, 2019
                  02:00 PM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  February 12, 2019
                  KB4486563
                  Resolved
                  KB4486565
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  January 17, 2019
                  KB4480955
                  Resolved
                  KB4486565
                  February 19, 2019
                  02:00 PM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                  See details >
                  January 08, 2019
                  KB4480970
                  Resolved
                  KB4493472
                  April 09, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  January 08, 2019
                  KB4480970
                  Resolved
                  KB4486563
                  February 12, 2019
                  10:00 AM PT
                  Event Viewer may not show some event descriptions for network interface cards
                  The Event Viewer may not show some event descriptions for network interface cards (NIC).

                  See details >
                  October 18, 2018
                  KB4462927
                  Resolved
                  KB4489878
                  March 12, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                  See details >
                  January 08, 2019
                  KB4480970
                  Resolved
                  KB4490511
                  February 19, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503292) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503292
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  IE11 may stop working when loading or interacting with Power BI reports
                  Internet Explorer 11 may stop working when loading or interacting with Power BI reports that have line charts with markers. This issue may also occur when viewing other content that contains Scalable Vector Graphics (SVG) markers.


                  Affected platforms:
                  • Client: Windows 7 SP1; Windows 8.1
                  • Server: Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2

                  Resolution: This issue was resolved in Preview Rollup KB4503277. If you are using the Internet Explorer cumulative updates, this issue was resolved in KB4508646.

                  Back to top
                  May 14, 2019
                  KB4499164
                  Resolved
                  KB4503277
                  Resolved:
                  June 20, 2019
                  02:00 PM PT

                  Opened:
                  June 07, 2019
                  02:57 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503277. If you are using Security Only updates, see KB4508640 for resolving KB for your platform.

                  Back to top
                  June 11, 2019
                  KB4503292
                  Resolved
                  KB4503277
                  Resolved:
                  June 20, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolved: We have released an \"optional\" update for Internet Explorer 11 (KB4505050) to resolve this issue. We recommend you apply this update by installing KB4505050 from Windows Update and then restarting your device.
                  To download and install this update, see How to get an update through Windows Update. This update is also available through the Microsoft Update Catalog website.

                  Back to top
                  May 14, 2019
                  KB4499164
                  Resolved
                  KB4505050
                  Resolved:
                  May 18, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  System may be unresponsive after restart if ArcaBit antivirus software installed
                  Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472.

                  Affected platforms:
                  • Client: Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article.

                  Back to top
                  April 09, 2019
                  KB4493472
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:23 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493472.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article.

                  Back to top
                  April 09, 2019
                  KB4493472
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:22 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article.

                  Back to top
                  April 09, 2019
                  KB4493472
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:21 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  Devices may not respond at login or Welcome screen if running certain Avast software
                  Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install KB4493472 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                  Resolution: Avast has released emergency updates to address this issue. For more information and AV update schedule, see the Avast support KB article.

                  Back to top
                  April 09, 2019
                  KB4493472
                  Resolved
                  Resolved:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Authentication may fail for services after the Kerberos ticket expires
                  After installing KB4489878, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails.

                  Affected platforms: 
                  • Client: Windows 7 SP1
                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4499164.

                  Back to top
                  March 12, 2019
                  KB4489878
                  Resolved
                  KB4499164
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  NETDOM.EXE fails to run
                  After installing KB4489878, NETDOM.EXE fails to run, and the on-screen error, “The command failed to complete successfully.” appears.

                  Affected platforms: 
                  • Client: Windows 7 SP1
                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4493472.

                  Back to top
                  March 12, 2019
                  KB4489878
                  Resolved
                  KB4493472
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  After installing KB4489878, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites on Internet Explorer.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                  Resolution: This issue is resolved in KB4493472.

                  Back to top
                  March 12, 2019
                  KB4489878
                  Resolved
                  KB4493472
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                   
                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                   
                  Affected platforms:  
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493472

                  Back to top
                  February 12, 2019
                  KB4486563
                  Resolved
                  KB4493472
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4486565.

                  Back to top
                  February 12, 2019
                  KB4486563
                  Resolved
                  KB4486565
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Internet Explorer may fail to load images
                  After installing KB4486563, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                  Resolution: This issue is resolved in KB4486565.

                  Back to top
                  February 12, 2019
                  KB4486563
                  Resolved
                  KB4486565
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  First character of the Japanese era name not recognized as an abbreviation
                  After installing KB4480955, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4486565.

                  Back to top
                  January 17, 2019
                  KB4480955
                  Resolved
                  KB4486565
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 17, 2019
                  10:00 AM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  After installing KB4480970, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                  • Cache size and location show zero or empty.
                  • Keyboard shortcuts may not work properly.
                  • Webpages may intermittently fail to load or render correctly.
                  • Issues with credential prompts.
                  • Issues when downloading files.
                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4493472.

                  Back to top
                  January 08, 2019
                  KB4480970
                  Resolved
                  KB4493472
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                  Affected Platforms:
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 

                  Resolution: This issue is resolved in KB4486563.

                  Back to top
                  January 08, 2019
                  KB4480970
                  Resolved
                  KB4486563
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  After installing KB4480970, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, “Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).”

                  This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4490511.

                  Back to top
                  January 08, 2019
                  KB4480970
                  Resolved
                  KB4490511
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " - -- title: October 2018 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Event Viewer may not show some event descriptions for network interface cards
                  After installing KB4462927, the Event Viewer may not show some event descriptions for network interface cards (NICs).

                  Affected Platforms:
                  • Client: Windows 7 SP1 
                  • Server: Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4489878.

                  Back to top
                  October 18, 2018
                  KB4462927
                  Resolved
                  KB4489878
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  October 18, 2018
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml deleted file mode 100644 index 9bf1ac9d82..0000000000 --- a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml +++ /dev/null @@ -1,139 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 8.1 and Windows Server 2012 R2 -metadata: - document_id: - title: Resolved issues in Windows 8.1 and Windows Server 2012 R2 - description: Resolved issues in Windows 8.1 and Windows Server 2012 R2 - keywords: ["Resolved issues in Windows 8.1", "Windows 8.1", "Windows Server 2012 R2"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 8.1 and Windows Server 2012 R2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503276
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  IE11 may stop working when loading or interacting with Power BI reports
                  Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

                  See details >
                  May 14, 2019
                  KB4499151
                  Resolved
                  KB4503283
                  June 20, 2019
                  02:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  June 11, 2019
                  KB4503276
                  Resolved
                  KB4503283
                  June 20, 2019
                  02:00 PM PT
                  Issue using PXE to start a device from WDS
                  There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.

                  See details >
                  March 12, 2019
                  KB4489881
                  Resolved
                  KB4503276
                  June 11, 2019
                  10:00 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  May 14, 2019
                  KB4499151
                  Resolved
                  KB4505050
                  May 18, 2019
                  02:00 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                  See details >
                  April 25, 2019
                  KB4493443
                  Resolved
                  KB4499151
                  May 14, 2019
                  10:00 AM PT
                  System may be unresponsive after restart if ArcaBit antivirus software installed
                  Devices with ArcaBit antivirus software installed may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493446
                  Resolved
                  May 14, 2019
                  01:22 PM PT
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493446
                  Resolved
                  May 14, 2019
                  01:22 PM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Devices with Avira antivirus software installed may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493446
                  Resolved
                  May 14, 2019
                  01:21 PM PT
                  Internet Explorer may fail to load images
                  Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  See details >
                  February 12, 2019
                  KB4487000
                  Resolved
                  KB4487016
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  January 15, 2019
                  KB4480969
                  Resolved
                  KB4487016
                  February 19, 2019
                  02:00 PM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  February 12, 2019
                  KB4487000
                  Resolved
                  KB4493446
                  April 09, 2019
                  10:00 AM PT
                  Devices may not respond at login or Welcome screen if running certain Avast software
                  Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.

                  See details >
                  April 09, 2019
                  KB4493446
                  Resolved
                  April 25, 2019
                  02:00 PM PT
                  Devices with winsock kernel client may receive error
                  Devices with a winsock kernel client may receive D1, FC, and other errors.

                  See details >
                  March 12, 2019
                  KB4489881
                  Resolved
                  KB4489893
                  March 19, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                  See details >
                  March 12, 2019
                  KB4489881
                  Resolved
                  KB4493446
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  February 19, 2019
                  KB4487016
                  Resolved
                  KB4489881
                  March 12, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding.
                  MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4493446
                  April 09, 2019
                  10:00 AM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                  See details >
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4493446
                  April 09, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                  See details >
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4490512
                  February 19, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4487000
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503276) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503276
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  IE11 may stop working when loading or interacting with Power BI reports
                  Internet Explorer 11 may stop working when loading or interacting with Power BI reports that have line charts with markers. This issue may also occur when viewing other content that contains Scalable Vector Graphics (SVG) markers.


                  Affected platforms:
                  • Client: Windows 7 SP1; Windows 8.1
                  • Server: Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2

                  Resolution: This issue was resolved in Preview Rollup KB4503283. If you are using the Internet Explorer cumulative updates, this issue was resolved in KB4508646.

                  Back to top
                  May 14, 2019
                  KB4499151
                  Resolved
                  KB4503283
                  Resolved:
                  June 20, 2019
                  02:00 PM PT

                  Opened:
                  June 07, 2019
                  02:57 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503283. If you are using Security Only updates, see KB4508640 for resolving KB for your platform.

                  Back to top
                  June 11, 2019
                  KB4503276
                  Resolved
                  KB4503283
                  Resolved:
                  June 20, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolved: We have released an \"optional\" update for Internet Explorer 11 (KB4505050) to resolve this issue. We recommend you apply this update by installing KB4505050 from Windows Update and then restarting your device.
                  To download and install this update, see How to get an update through Windows Update. This update is also available through the Microsoft Update Catalog website.

                  Back to top
                  May 14, 2019
                  KB4499151
                  Resolved
                  KB4505050
                  Resolved:
                  May 18, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue has been resolved.

                  Back to top
                  April 25, 2019
                  KB4493443
                  Resolved
                  KB4499151
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 10, 2019
                  10:35 AM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - - - - -
                  DetailsOriginating updateStatusHistory
                  System may be unresponsive after restart if ArcaBit antivirus software installed
                  Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446.

                  Affected platforms:
                  • Client: Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article.

                  Back to top
                  April 09, 2019
                  KB4493446
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:22 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493446.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article.

                  Back to top
                  April 09, 2019
                  KB4493446
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:22 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article.

                  Back to top
                  April 09, 2019
                  KB4493446
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:21 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  Devices may not respond at login or Welcome screen if running certain Avast software
                  Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install KB4493446 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                  Resolution: Avast has released emergency updates to address this issue. For more information and AV update schedule, see the Avast support KB article.

                  Back to top
                  April 09, 2019
                  KB4493446
                  Resolved
                  Resolved:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Issue using PXE to start a device from WDS
                  After installing KB4489881, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012 
                  Resolution: This issue was resolved in KB4503276.

                  Back to top
                  March 12, 2019
                  KB4489881
                  Resolved
                  KB4503276
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  Devices with winsock kernel client may receive error
                  After installing KB4489881, devices with a winsock kernel client may receive D1, FC, and other errors. Additionally, systems that run the Skype for Business or Lync Server Edge Transport role may be affected by this issue.

                  Affected platforms: 
                  • Client: Windows 8.1 
                  • Server: Windows Server 2012 R2 
                  Resolution: This issue is resolved in KB4489893.

                  Back to top
                  March 12, 2019
                  KB4489881
                  Resolved
                  KB4489893
                  Resolved:
                  March 19, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  Custom URI schemes may not start corresponding application
                  After installing KB4489881, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                  Resolution: This issue is resolved in KB4493446.

                  Back to top
                  March 12, 2019
                  KB4489881
                  Resolved
                  KB4493446
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Internet Explorer may fail to load images
                  After installing KB4487000, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                  Resolution: This issue is resolved in KB4487016.

                  Back to top
                  February 12, 2019
                  KB4487000
                  Resolved
                  KB4487016
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color.

                  Affected platforms 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493446.

                  Back to top
                  February 12, 2019
                  KB4487000
                  Resolved
                  KB4493446
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4487016, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012 
                  Resolution: This issue is resolved in KB4489881.

                  Back to top
                  February 19, 2019
                  KB4487016
                  Resolved
                  KB4489881
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 19, 2019
                  02:00 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - - -
                  DetailsOriginating updateStatusHistory
                  First character of the Japanese era name not recognized as an abbreviation
                  After installing KB4480969, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4487016.

                  Back to top
                  January 15, 2019
                  KB4480969
                  Resolved
                  KB4487016
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 15, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding.
                  After installing KB4480963, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4493446.

                  Back to top
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4493446
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  After installing KB4480963, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                  • Cache size and location show zero or empty.
                  • Keyboard shortcuts may not work properly.
                  • Webpages may intermittently fail to load or render correctly.
                  • Issues with credential prompts.
                  • Issues when downloading files.
                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4493446.

                  Back to top
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4493446
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  After installing KB4480963, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, “Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).”

                  This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4490512.

                  Back to top
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4490512
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                  Affected platforms: 
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4487000.

                  Back to top
                  January 08, 2019
                  KB4480963
                  Resolved
                  KB4487000
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml deleted file mode 100644 index aeb08c2fd5..0000000000 --- a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml +++ /dev/null @@ -1,113 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows Server 2008 SP2 -metadata: - document_id: - title: Resolved issues in Windows Server 2008 SP2 - description: Resolved issues in Windows Server 2008 SP2 - keywords: ["Resolved issues in Windows Server 2008 SP2", "Windows Server 2008 SP2"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows Server 2008 SP2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503273
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  June 11, 2019
                  KB4503273
                  Resolved
                  KB4503271
                  June 20, 2019
                  02:00 PM PT
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493471
                  Resolved
                  May 14, 2019
                  01:21 PM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Devices with Avira antivirus software installed may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493471
                  Resolved
                  May 14, 2019
                  01:19 PM PT
                  Authentication may fail for services after the Kerberos ticket expires
                  Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.

                  See details >
                  March 12, 2019
                  KB4489880
                  Resolved
                  KB4499149
                  May 14, 2019
                  10:00 AM PT
                  NETDOM.EXE fails to run
                  NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.

                  See details >
                  March 12, 2019
                  KB4489880
                  Resolved
                  KB4493471
                  April 09, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  February 12, 2019
                  KB4487023
                  Resolved
                  KB4487022
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  January 17, 2019
                  KB4480974
                  Resolved
                  KB4489880
                  March 12, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  February 12, 2019
                  KB4487023
                  Resolved
                  KB4493471
                  April 09, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                  See details >
                  January 08, 2019
                  KB4480968
                  Resolved
                  KB4490514
                  February 19, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  January 08, 2019
                  KB4480968
                  Resolved
                  KB4487023
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503273) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503273
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503271. If you are using Security Only updates, see KB4508640 for resolving KB for your platform.

                  Back to top
                  June 11, 2019
                  KB4503273
                  Resolved
                  KB4503271
                  Resolved:
                  June 20, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493471.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article.

                  Back to top
                  April 09, 2019
                  KB4493471
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:21 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493471.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article.

                  Back to top
                  April 09, 2019
                  KB4493471
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:19 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Authentication may fail for services after the Kerberos ticket expires
                  After installing KB4489880, some customers report that authentication fails for services that require unconstrained delegation after the Kerberos ticket expires (the default is 10 hours). For example, the SQL server service fails.

                  Affected platforms: 
                  • Client: Windows 7 SP1
                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4499149.

                  Back to top
                  March 12, 2019
                  KB4489880
                  Resolved
                  KB4499149
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  NETDOM.EXE fails to run
                  After installing KB4489880, NETDOM.EXE fails to run, and the on-screen error, “The command failed to complete successfully.” appears.

                  Affected platforms: 
                  • Client: Windows 7 SP1
                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4493471.

                  Back to top
                  March 12, 2019
                  KB4489880
                  Resolved
                  KB4493471
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487022.

                  Back to top
                  February 12, 2019
                  KB4487023
                  Resolved
                  KB4487022
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color.

                  Affected platforms 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4493471.

                  Back to top
                  February 12, 2019
                  KB4487023
                  Resolved
                  KB4493471
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  First character of the Japanese era name not recognized as an abbreviation
                  After installing KB4480974, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4489880.

                  Back to top
                  January 17, 2019
                  KB4480974
                  Resolved
                  KB4489880
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  January 17, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  After installing KB4480968, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, “Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).”

                  This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4490514.

                  Back to top
                  January 08, 2019
                  KB4480968
                  Resolved
                  KB4490514
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                  Affected platforms: 
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487023.

                  Back to top
                  January 08, 2019
                  KB4480968
                  Resolved
                  KB4487023
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml deleted file mode 100644 index 532b8144c8..0000000000 --- a/windows/release-information/resolved-issues-windows-server-2012.yml +++ /dev/null @@ -1,143 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows Server 2012 -metadata: - document_id: - title: Resolved issues in Windows Server 2012 - description: Resolved issues in Windows Server 2012 - keywords: ["Resolved issues in Windows Server 2012", "Windows Server 2012"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows Server 2012 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusDate resolved
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503285
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Some devices and generation 2 Hyper-V VMs may have issues installing updates
                  Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing some updates when Secure Boot is enabled.

                  See details >
                  June 11, 2019
                  KB4503285
                  Resolved
                  KB4503295
                  June 21, 2019
                  02:00 PM PT
                  IE11 may stop working when loading or interacting with Power BI reports
                  Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

                  See details >
                  May 14, 2019
                  KB4499171
                  Resolved
                  KB4503295
                  June 21, 2019
                  02:00 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                  See details >
                  June 11, 2019
                  KB4503285
                  Resolved
                  KB4503295
                  June 20, 2019
                  02:00 PM PT
                  Issue using PXE to start a device from WDS
                  There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.

                  See details >
                  March 12, 2019
                  KB4489891
                  Resolved
                  KB4503285
                  June 11, 2019
                  10:00 AM PT
                  Unable to access some gov.uk websites
                  gov.uk websites that don’t support “HSTS” may not be accessible

                  See details >
                  May 14, 2019
                  KB4499171
                  Resolved
                  KB4505050
                  May 18, 2019
                  02:00 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                  See details >
                  April 25, 2019
                  KB4493462
                  Resolved
                  KB4499171
                  May 14, 2019
                  10:00 AM PT
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493451
                  Resolved
                  May 14, 2019
                  01:21 PM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Devices with Avira antivirus software installed may become unresponsive upon restart.

                  See details >
                  April 09, 2019
                  KB4493451
                  Resolved
                  May 14, 2019
                  01:19 PM PT
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  See details >
                  February 12, 2019
                  KB4487025
                  Resolved
                  KB4487024
                  February 19, 2019
                  02:00 PM PT
                  First character of the Japanese era name not recognized as an abbreviation
                  The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  See details >
                  January 15, 2019
                  KB4480971
                  Resolved
                  KB4487024
                  February 19, 2019
                  02:00 PM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  See details >
                  February 12, 2019
                  KB4487025
                  Resolved
                  KB4493451
                  April 09, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                  See details >
                  February 12, 2019
                  KB4487025
                  Resolved
                  KB4489891
                  March 12, 2019
                  10:00 AM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                  See details >
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4493451
                  April 09, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  See details >
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4493451
                  April 09, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                  See details >
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4490516
                  February 19, 2019
                  02:00 PM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                  See details >
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4487025
                  February 12, 2019
                  10:00 AM PT
                  Event Viewer may not show some event descriptions for network interface cards
                  The Event Viewer may not show some event descriptions for network interface cards (NIC).

                  See details >
                  September 11, 2018
                  KB4457135
                  Resolved
                  KB4489891
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503285) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503285
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Some devices and generation 2 Hyper-V VMs may have issues installing updates
                  Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing KB4503285 or later updates when Secure Boot is enabled.

                  Affected platforms:
                  • Server: Windows Server 2012
                  Resolution: This issue was resolved in KB4503295. If your device is using Security Only updates, this issue was resolved in KB4508776.

                  Back to top
                  June 11, 2019
                  KB4503285
                  Resolved
                  KB4503295
                  Resolved:
                  June 21, 2019
                  02:00 PM PT

                  Opened:
                  June 19, 2019
                  04:57 PM PT
                  IE11 may stop working when loading or interacting with Power BI reports
                  Internet Explorer 11 may stop working when loading or interacting with Power BI reports that have line charts with markers. This issue may also occur when viewing other content that contains Scalable Vector Graphics (SVG) markers.


                  Affected platforms:
                  • Client: Windows 7 SP1; Windows 8.1
                  • Server: Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2

                  Resolution: This issue was resolved in Preview Rollup KB4503295. If you are using the Internet Explorer cumulative updates, this issue was resolved in KB4508646.

                  Back to top
                  May 14, 2019
                  KB4499171
                  Resolved
                  KB4503295
                  Resolved:
                  June 21, 2019
                  02:00 PM PT

                  Opened:
                  June 07, 2019
                  02:57 PM PT
                  Event Viewer may close or you may receive an error when using Custom Views
                  When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue was resolved in KB4503295. If you are using Security Only updates, see KB4508640 for resolving KB for your platform.

                  Back to top
                  June 11, 2019
                  KB4503285
                  Resolved
                  KB4503295
                  Resolved:
                  June 20, 2019
                  02:00 PM PT

                  Opened:
                  June 12, 2019
                  11:11 AM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Unable to access some gov.uk websites
                  After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolved: We have released an \"optional\" update for Internet Explorer 11 (KB4505050) to resolve this issue. We recommend you apply this update by installing KB4505050 from Windows Update and then restarting your device.
                  To download and install this update, see How to get an update through Windows Update. This update is also available through the Microsoft Update Catalog website.

                  Back to top
                  May 14, 2019
                  KB4499171
                  Resolved
                  KB4505050
                  Resolved:
                  May 18, 2019
                  02:00 PM PT

                  Opened:
                  May 16, 2019
                  01:57 PM PT
                  Layout and cell size of Excel sheets may change when using MS UI Gothic
                  When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue has been resolved.

                  Back to top
                  April 25, 2019
                  KB4493462
                  Resolved
                  KB4499171
                  Resolved:
                  May 14, 2019
                  10:00 AM PT

                  Opened:
                  May 10, 2019
                  10:35 AM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  System unresponsive after restart if Sophos Endpoint Protection installed
                  Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493451.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article.

                  Back to top
                  April 09, 2019
                  KB4493451
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:21 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  System may be unresponsive after restart if Avira antivirus software installed
                  Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493451.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article.

                  Back to top
                  April 09, 2019
                  KB4493451
                  Resolved
                  Resolved:
                  May 14, 2019
                  01:19 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: March 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Issue using PXE to start a device from WDS
                  After installing KB4489891, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012 
                  Resolution: This issue was resolved in KB4503285.

                  Back to top
                  March 12, 2019
                  KB4489891
                  Resolved
                  KB4503285
                  Resolved:
                  June 11, 2019
                  10:00 AM PT

                  Opened:
                  March 12, 2019
                  10:00 AM PT
                  - " - -- title: February 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Applications using Microsoft Jet database and Access 95 file format stop working
                  Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487024.

                  Back to top
                  February 12, 2019
                  KB4487025
                  Resolved
                  KB4487024
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Embedded objects may display incorrectly
                  Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                  For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color.

                  Affected platforms 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                  Resolution: This issue is resolved in KB4493451.

                  Back to top
                  February 12, 2019
                  KB4487025
                  Resolved
                  KB4493451
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  Error 1309 when installing/uninstalling MSI or MSP files
                  After installing KB4487025, users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4489891.

                  Back to top
                  February 12, 2019
                  KB4487025
                  Resolved
                  KB4489891
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  February 12, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - - - -
                  DetailsOriginating updateStatusHistory
                  First character of the Japanese era name not recognized as an abbreviation
                  After installing KB4480971, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487024.

                  Back to top
                  January 15, 2019
                  KB4480971
                  Resolved
                  KB4487024
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 15, 2019
                  10:00 AM PT
                  Internet Explorer 11 authentication issue with multiple concurrent logons
                  After installing KB4480975, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                  • Cache size and location show zero or empty.
                  • Keyboard shortcuts may not work properly.
                  • Webpages may intermittently fail to load or render correctly.
                  • Issues with credential prompts.
                  • Issues when downloading files.
                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4493451.

                  Back to top
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4493451
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  MSXML6 may cause applications to stop responding
                  After installing KB4480975, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                  The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Resolution: This issue is resolved in KB4493451.

                  Back to top
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4493451
                  Resolved:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Virtual machines fail to restore
                  After installing KB4480975, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, \"Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).\"

                  This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                  Affected platforms: 
                  • Client: Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4490516.

                  Back to top
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4490516
                  Resolved:
                  February 19, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  Applications using Microsoft Jet database fail to open
                  Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, \"Unrecognized Database Format\".

                  Affected platforms: 
                  • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                  • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: This issue is resolved in KB4487025.

                  Back to top
                  January 08, 2019
                  KB4480975
                  Resolved
                  KB4487025
                  Resolved:
                  February 12, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " - -- title: September 2018 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Event Viewer may not show some event descriptions for network interface cards
                  After installing KB4457135, the Event Viewer may not show some event descriptions for network interface cards (NICs).

                  Affected Platforms:
                  • Client: Windows 7 SP1 
                  • Server: Windows Server 2012; Windows Server 2008 R2 SP1
                  Resolution: This issue is resolved in KB4489891.

                  Back to top
                  September 11, 2018
                  KB4457135
                  Resolved
                  KB4489891
                  Resolved:
                  March 12, 2019
                  10:00 AM PT

                  Opened:
                  September 11, 2018
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml deleted file mode 100644 index 010cb9d55b..0000000000 --- a/windows/release-information/status-windows-10-1507.yml +++ /dev/null @@ -1,91 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1507 -metadata: - document_id: - title: Windows 10, version 1507 - description: View announcements and review known issues and fixes for Windows 10 version 1507 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1507. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 10240.18244

                  June 11, 2019
                  KB4503291
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                  See details >
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503291) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 10240.18244

                  June 11, 2019
                  KB4503291
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following: 
                  • Perform the operation from a process that has administrator privilege. 
                  • Perform the operation from a node that doesn’t have CSV ownership. 
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 10240.18094

                  January 08, 2019
                  KB4480962
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml deleted file mode 100644 index a554e88e9e..0000000000 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ /dev/null @@ -1,132 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1607 and Windows Server 2016 -metadata: - document_id: - title: Windows 10, version 1607 and Windows Server 2016 - description: View announcements and review known issues and fixes for Windows 10 version 1607 and Windows Server 2016 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1607 and Windows Server 2016. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - - - - - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                  See details >
                  OS Build 14393.3115

                  July 16, 2019
                  KB4507459
                  Investigating
                  August 08, 2019
                  07:18 PM PT
                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                  Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

                  See details >
                  OS Build 14393.3053

                  June 18, 2019
                  KB4503294
                  Investigating
                  August 01, 2019
                  05:00 PM PT
                  Internet Explorer 11 and apps using the WebBrowser control may fail to render
                  JavaScript may fail to render as expected in Internet Explorer 11 and in apps using JavaScript or the WebBrowser control.

                  See details >
                  OS Build 14393.3085

                  July 09, 2019
                  KB4507460
                  Mitigated
                  July 26, 2019
                  04:58 PM PT
                  SCVMM cannot enumerate and manage logical switches deployed on the host
                  For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.

                  See details >
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Resolved
                  KB4507459
                  July 16, 2019
                  10:00 AM PT
                  Some applications may fail to run as expected on clients of AD FS 2016
                  Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016)

                  See details >
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4507459
                  July 16, 2019
                  10:00 AM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Mitigated
                  July 10, 2019
                  07:09 PM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                  See details >
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                  Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                  See details >
                  OS Build 14393.2608

                  November 13, 2018
                  KB4467691
                  Mitigated
                  February 19, 2019
                  10:00 AM PT
                  Cluster service may fail if the minimum password length is set to greater than 14
                  The cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the Group Policy “Minimum Password Length” is configured with greater than 14 characters.

                  See details >
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503267) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                   Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

                  Affected platforms:
                  • Server: Windows Server 2019; Windows Server 2016
                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 14393.3053

                  June 18, 2019
                  KB4503294
                  Investigating
                  Last updated:
                  August 01, 2019
                  05:00 PM PT

                  Opened:
                  August 01, 2019
                  05:00 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
                  -

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                  Next steps: At this time, we suggest that devices in an affected environment do not install KB4507459. We are working on a resolution and estimate a solution will be available in mid-August.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Back to top
                  OS Build 14393.3115

                  July 16, 2019
                  KB4507459
                  Investigating
                  Last updated:
                  August 08, 2019
                  07:18 PM PT

                  Opened:
                  July 25, 2019
                  06:10 PM PT
                  Internet Explorer 11 and apps using the WebBrowser control may fail to render
                  Internet Explorer 11 may fail to render some JavaScript after installing KB4507460. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

                  Affected platforms:
                  • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server 2016
                  Workaround: To mitigate this issue, you need to Enable Script Debugging using one of the following ways.

                  You can configure the below registry key:
                  Registry setting: HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main
                  Value: Disable Script Debugger
                  Type: REG_SZ
                  Data: no

                  Or you can Enable Script Debugging in Internet Settings. You can open Internet Setting by either typing Internet Settings into the search box on Windows or by selecting Internet Options in Internet Explorer. Once open, select Advanced then Browsing and finally, select Enable Script Debugging.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 14393.3085

                  July 09, 2019
                  KB4507460
                  Mitigated
                  Last updated:
                  July 26, 2019
                  04:58 PM PT

                  Opened:
                  July 26, 2019
                  04:58 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server:
                  1. Verify Variable Window Extension is enabled.
                  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 14393.3025

                  June 11, 2019
                  KB4503267
                  Mitigated
                  Last updated:
                  July 10, 2019
                  07:09 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Some applications may fail to run as expected on clients of AD FS 2016
                  Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016) after installation of KB4493473 on the server. Applications that may exhibit this behavior use an IFRAME during non-interactive authentication requests and receive X-Frame Options set to DENY.

                  Affected platforms:
                  • Server: Windows Server 2016
                  Resolution: This issue was resolved in KB4507459.

                  Back to top
                  OS Build 14393.2941

                  April 25, 2019
                  KB4493473
                  Resolved
                  KB4507459
                  Resolved:
                  July 16, 2019
                  10:00 AM PT

                  Opened:
                  June 04, 2019
                  05:55 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507;  Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following:
                  • Perform the operation from a process that has administrator privilege. 
                  • Perform the operation from a node that doesn’t have CSV ownership.
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 14393.2724

                  January 08, 2019
                  KB4480961
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " - -- title: November 2018 -- items: - - type: markdown - text: " - - - - -
                  DetailsOriginating updateStatusHistory
                  SCVMM cannot enumerate and manage logical switches deployed on the host
                  For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host after installing KB4467684.

                  Additionally, if you do not follow the best practices, a stop error may occur in vfpext.sys on the hosts.

                  Affected platforms:
                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2016
                  Resolution: This issue was resolved in KB4507459.

                  Back to top
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Resolved
                  KB4507459
                  Resolved:
                  July 16, 2019
                  10:00 AM PT

                  Opened:
                  November 27, 2018
                  10:00 AM PT
                  Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                  After installing KB4467691, Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                  Affected platforms:
                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2016
                  Workaround: Restart the affected machine using the Unified Extensible Firmware Interface (UEFI). Disable Secure Boot and then restart.

                  If BitLocker is enabled on your machine, you may have to go through BitLocker recovery after Secure Boot has been disabled.

                  Next steps: Lenovo and Fujitsu are aware of this issue. Please contact your OEM to ask if there is a firmware update available for your device.

                  Back to top
                  OS Build 14393.2608

                  November 13, 2018
                  KB4467691
                  Mitigated
                  Last updated:
                  February 19, 2019
                  10:00 AM PT

                  Opened:
                  November 13, 2018
                  10:00 AM PT
                  Cluster service may fail if the minimum password length is set to greater than 14
                  After installing KB4467684, the cluster service may fail to start with the error \"2245 (NERR_PasswordTooShort)\" if the Group Policy \"Minimum Password Length\" is configured with greater than 14 characters.

                  Affected platforms:
                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                  • Server: Windows Server 2016
                  Workaround: Set the domain default \"Minimum Password Length\" policy to less than or equal to 14 characters.

                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 14393.2639

                  November 27, 2018
                  KB4467684
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  November 27, 2018
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml deleted file mode 100644 index 58b6047c36..0000000000 --- a/windows/release-information/status-windows-10-1703.yml +++ /dev/null @@ -1,102 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1703 -metadata: - document_id: - title: Windows 10, version 1703 - description: View announcements and review known issues and fixes for Windows 10 version 1703 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1703. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 15063.1868

                  June 11, 2019
                  KB4503279
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                  See details >
                  OS Build 15063.1955

                  July 16, 2019
                  KB4507467
                  Investigating
                  August 08, 2019
                  07:18 PM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                  See details >
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503279) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 15063.1868

                  June 11, 2019
                  KB4503279
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
                  -

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                  Next steps: At this time, we suggest that devices in an affected environment do not install KB4507467. We are working on a resolution and estimate a solution will be available in mid-August.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Back to top
                  OS Build 15063.1955

                  July 16, 2019
                  KB4507467
                  Investigating
                  Last updated:
                  August 08, 2019
                  07:18 PM PT

                  Opened:
                  July 25, 2019
                  06:10 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following: 
                  • Perform the operation from a process that has administrator privilege. 
                  • Perform the operation from a node that doesn’t have CSV ownership. 
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 15063.1563

                  January 08, 2019
                  KB4480973
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml deleted file mode 100644 index 279e20ebd2..0000000000 --- a/windows/release-information/status-windows-10-1709.yml +++ /dev/null @@ -1,104 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1709 and Windows Server, version 1709 -metadata: - document_id: - title: Windows 10, version 1709 and Windows Server, version 1709 - description: View announcements and review known issues and fixes for Windows 10 version 1709 and Windows Server 1709 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1709 and Windows Server, version 1709. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                  See details >
                  OS Build 16299.1296

                  July 16, 2019
                  KB4507465
                  Investigating
                  August 08, 2019
                  07:18 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Mitigated
                  July 10, 2019
                  07:09 PM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                  See details >
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503284) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
                  -

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                  Next steps: At this time, we suggest that devices in an affected environment do not install KB4507465. We are working on a resolution and estimate a solution will be available in mid-August.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Back to top
                  OS Build 16299.1296

                  July 16, 2019
                  KB4507465
                  Investigating
                  Last updated:
                  August 08, 2019
                  07:18 PM PT

                  Opened:
                  July 25, 2019
                  06:10 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server:
                  1. Verify Variable Window Extension is enabled.
                  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 16299.1217

                  June 11, 2019
                  KB4503284
                  Mitigated
                  Last updated:
                  July 10, 2019
                  07:09 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following:
                  • Perform the operation from a process that has administrator privilege. 
                  • Perform the operation from a node that doesn’t have CSV ownership. 
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 16299.904

                  January 08, 2019
                  KB4480978
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml deleted file mode 100644 index ab543899da..0000000000 --- a/windows/release-information/status-windows-10-1803.yml +++ /dev/null @@ -1,119 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1803 -metadata: - document_id: - title: Windows 10, version 1803 - description: View announcements and review known issues and fixes for Windows 10 version 1803 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1803. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - -
                  Current status as of August 7, 2019:
                  -
                  Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019 for Home and Pro editions. We will begin updating devices running Windows 10, version 1803 to Windows 10, version 1903 (the May 2019 Update) starting July 16, 2019 to help ensure that these devices remain in a serviced and secure state. For more information, see the Windows 10, version 1903 section of the release information dashboard.
                  -
                  - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                  See details >
                  OS Build 17134.915

                  July 16, 2019
                  KB4507466
                  Investigating
                  August 08, 2019
                  07:18 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Mitigated
                  July 10, 2019
                  07:09 PM PT
                  Startup to a black screen after installing updates
                  Your device may startup to a black screen during the first logon after installing updates.

                  See details >
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Mitigated
                  June 14, 2019
                  04:41 PM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                  See details >
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503286) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
                  -

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                  Next steps: At this time, we suggest that devices in an affected environment do not install KB4507466. We are working on a resolution and estimate a solution will be available in mid-August.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Back to top
                  OS Build 17134.915

                  July 16, 2019
                  KB4507466
                  Investigating
                  Last updated:
                  August 08, 2019
                  07:18 PM PT

                  Opened:
                  July 25, 2019
                  06:10 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server:
                  1. Verify Variable Window Extension is enabled.
                  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Mitigated
                  Last updated:
                  July 10, 2019
                  07:09 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Startup to a black screen after installing updates
                  We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.


                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
                  • Server: Windows Server 2019
                  Workaround: To mitigate this issue, press Ctrl+Alt+Delete, then select the Power button in the lower right corner of the screen and select Restart. Your device should now restart normally.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17134.829

                  June 11, 2019
                  KB4503286
                  Mitigated
                  Last updated:
                  June 14, 2019
                  04:41 PM PT

                  Opened:
                  June 14, 2019
                  04:41 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following:
                  • Perform the operation from a process that has administrator privilege. 
                  • Perform the operation from a node that doesn’t have CSV ownership. 
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17134.523

                  January 08, 2019
                  KB4480966
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml deleted file mode 100644 index d67d705cf0..0000000000 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ /dev/null @@ -1,130 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1809 and Windows Server 2019 -metadata: - document_id: - title: Windows 10, version 1809 and Windows Server 2019 - description: View announcements and review known issues and fixes for Windows 10 version 1809 and Windows Server 2019 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1809 and Windows Server 2019. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - -
                  Current status:
                  Windows 10, version 1809 is designated for broad deployment and available for any user who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel. -
                  - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                  See details >
                  OS Build 17763.652

                  July 22, 2019
                  KB4505658
                  Investigating
                  August 08, 2019
                  07:18 PM PT
                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                  Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

                  See details >
                  OS Build 17763.55

                  October 09, 2018
                  KB4464330
                  Investigating
                  August 01, 2019
                  05:00 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Mitigated
                  July 10, 2019
                  07:09 PM PT
                  Startup to a black screen after installing updates
                  Your device may startup to a black screen during the first logon after installing updates.

                  See details >
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Mitigated
                  June 14, 2019
                  04:41 PM PT
                  Devices with some Asian language packs installed may receive an error
                  After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_F

                  See details >
                  OS Build 17763.437

                  April 09, 2019
                  KB4493509
                  Mitigated
                  May 03, 2019
                  10:59 AM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                  See details >
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Mitigated
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503327) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                   Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

                  Affected platforms:
                  • Server: Windows Server 2019; Windows Server 2016
                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17763.55

                  October 09, 2018
                  KB4464330
                  Investigating
                  Last updated:
                  August 01, 2019
                  05:00 PM PT

                  Opened:
                  August 01, 2019
                  05:00 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - - -
                  DetailsOriginating updateStatusHistory
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
                  -

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                  Next steps: At this time, we suggest that devices in an affected environment do not install KB4505658. We are working on a resolution and estimate a solution will be available in mid-August.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Back to top
                  OS Build 17763.652

                  July 22, 2019
                  KB4505658
                  Investigating
                  Last updated:
                  August 08, 2019
                  07:18 PM PT

                  Opened:
                  July 25, 2019
                  06:10 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server:
                  1. Verify Variable Window Extension is enabled.
                  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Mitigated
                  Last updated:
                  July 10, 2019
                  07:09 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Startup to a black screen after installing updates
                  We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.


                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
                  • Server: Windows Server 2019
                  Workaround: To mitigate this issue, press Ctrl+Alt+Delete, then select the Power button in the lower right corner of the screen and select Restart. Your device should now restart normally.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17763.557

                  June 11, 2019
                  KB4503327
                  Mitigated
                  Last updated:
                  June 14, 2019
                  04:41 PM PT

                  Opened:
                  June 14, 2019
                  04:41 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Devices with some Asian language packs installed may receive an error
                  After installing the April 2019 Cumulative Update (KB4493509), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

                  Affected platforms:
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                  • Server: Windows Server, version 1809; Windows Server 2019
                  Workaround:
                  1. Uninstall and reinstall any recently added language packs. For instructions, see \"Manage the input and display language settings in Windows 10\".
                  2. Click Check for Updates and install the April 2019 Cumulative Update. For instructions, see \"Update Windows 10\".
                  Note: If reinstalling the language pack does not mitigate the issue, reset your PC as follows:
                    1. Go to Settings app -> Recovery.
                    2. Click on Get Started under \"Reset this PC\" recovery option.
                    3. Select \"Keep my Files\".
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17763.437

                  April 09, 2019
                  KB4493509
                  Mitigated
                  Last updated:
                  May 03, 2019
                  10:59 AM PT

                  Opened:
                  May 02, 2019
                  04:36 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following:  
                  • Perform the operation from a process that has administrator privilege. 
                  • Perform the operation from a node that doesn’t have CSV ownership. 
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 17763.253

                  January 08, 2019
                  KB4480116
                  Mitigated
                  Last updated:
                  April 09, 2019
                  10:00 AM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml deleted file mode 100644 index 1eff433b4f..0000000000 --- a/windows/release-information/status-windows-10-1903.yml +++ /dev/null @@ -1,143 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1903 and Windows Server, version 1903 -metadata: - document_id: - title: Windows 10, version 1903 and Windows Server, version 1903 - description: View announcements and review known issues and fixes for Windows 10 version 1903 and Windows Server 1903 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues and the status of the rollout for Windows 10, version 1903 and Windows Server, version 1903. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - -
                  Current status as of July 16, 2019:
                  -
                  We are initiating the Windows 10 May 2019 Update for customers with devices that are at or nearing end of service and have not yet updated their device. Keeping these devices both supported and receiving monthly updates is critical to device security and ecosystem health. Based on the large number of devices running the April 2018 Update, that will reach the end of 18 months of service on November 12, 2019, we are starting the update process now for Home and Pro editions to help ensure adequate time for a smooth update process.

                  Our update rollout process takes into consideration the scale and complexity of the Windows 10 ecosystem, with the many hardware, software, and app configuration options users have, to provide a seamless update experience for all users. We closely monitor update feedback to allow us to prioritize those devices likely to have a good update experience and quickly put safeguards on other devices while we address known issues. Windows 10 Home and Pro edition users will have the ability to pause the update for up to 35 days so they can choose a convenient time.

                  The Windows 10 May 2019 Update is available for any user who manually selects “Check for updates” via Windows Update on a device that does not have a safeguard hold for issues already detected. If you are not offered the update, please check below for any known issues that may affect your device.

                  We recommend commercial customers running earlier versions of Windows 10 begin targeted deployments of Windows 10, version 1903 to validate that the apps, devices, and infrastructure used by their organizations work as expected with the new release and features.

                  Note Follow @WindowsUpdate to find out when new content is published to the release information dashboard.
                  -
                  - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - - - - - - - - - - - - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Issues updating when certain versions of Intel storage drivers are installed
                  Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

                  See details >
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Mitigated External
                  August 09, 2019
                  02:20 PM PT
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                  See details >
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Investigating
                  August 08, 2019
                  07:18 PM PT
                  Intermittent loss of Wi-Fi connectivity
                  Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated External
                  August 01, 2019
                  08:44 PM PT
                  Gamma ramps, color profiles, and night light settings do not apply in some cases
                  Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  August 01, 2019
                  06:27 PM PT
                  Display brightness may not respond to adjustments
                  Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4505903
                  July 26, 2019
                  02:00 PM PT
                  RASMAN service may stop working and result in the error “0xc0000005”
                  The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

                  See details >
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Resolved
                  KB4505903
                  July 26, 2019
                  02:00 PM PT
                  The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
                  Some apps or games that needs to perform graphics intensive operations may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

                  See details >
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Investigating
                  July 16, 2019
                  09:04 AM PT
                  Initiating a Remote Desktop connection may result in black screen
                  When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

                  See details >
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Investigating
                  July 12, 2019
                  04:42 PM PT
                  Loss of functionality in Dynabook Smartphone Link app
                  After updating to Windows 10, version 1903, you may experience a loss of functionality when using the Dynabook Smartphone Link application.

                  See details >
                  OS Build 18362.116

                  May 20, 2019
                  KB4505057
                  Resolved
                  July 11, 2019
                  01:54 PM PT
                  Error attempting to update with external USB device or memory card attached
                  PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  July 11, 2019
                  01:53 PM PT
                  Audio not working with Dolby Atmos headphones and home theater
                  Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  July 11, 2019
                  01:53 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Mitigated
                  July 10, 2019
                  07:09 PM PT
                  Windows Sandbox may fail to start with error code “0x80070002”
                  Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

                  See details >
                  OS Build 18362.116

                  May 20, 2019
                  KB4505057
                  Investigating
                  June 10, 2019
                  06:06 PM PT
                  Unable to discover or connect to Bluetooth devices
                  Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  May 21, 2019
                  04:48 PM PT
                  Intel Audio displays an intcdaud.sys notification
                  Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  May 21, 2019
                  04:47 PM PT
                  Cannot launch Camera app
                  Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

                  See details >
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  May 21, 2019
                  04:47 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503293) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Issues updating when certain versions of Intel storage drivers are installed
                  Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

                  To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

                  Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  • Server: Windows Server, version 1903
                  Workaround: To mitigate this issue before the resolution is released, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                  Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

                  Next Steps: We are working on a resolution and estimate a solution will be available in late August.

                  Back to top
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Mitigated External
                  Last updated:
                  August 09, 2019
                  02:20 PM PT

                  Opened:
                  July 25, 2019
                  06:10 PM PT
                  Domain connected devices that use MIT Kerberos realms will not start up
                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
                  -

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                  Next steps: At this time, we suggest that devices in an affected environment do not install KB4497935. We are working on a resolution and estimate a solution will be available in mid-August.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Back to top
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Investigating
                  Last updated:
                  August 08, 2019
                  07:18 PM PT

                  Opened:
                  July 25, 2019
                  06:10 PM PT
                  The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
                  Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.

                  To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Workaround: To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the Scan for hardware changes button in the Action menu or on the toolbar in Device Manager.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Investigating
                  Last updated:
                  July 16, 2019
                  09:04 AM PT

                  Opened:
                  July 12, 2019
                  04:20 PM PT
                  Initiating a Remote Desktop connection may result in black screen
                  When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  • Server: Windows Server, version 1903
                  Next steps: We are working on a resolution that will be made available in upcoming release.

                  Back to top
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Investigating
                  Last updated:
                  July 12, 2019
                  04:42 PM PT

                  Opened:
                  July 12, 2019
                  04:42 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server:
                  1. Verify Variable Window Extension is enabled.
                  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 18362.175

                  June 11, 2019
                  KB4503293
                  Mitigated
                  Last updated:
                  July 10, 2019
                  07:09 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  RASMAN service may stop working and result in the error “0xc0000005”
                  The Remote Access Connection Manager (RASMAN) service may stop working and you may receive the error “0xc0000005” on devices where the diagnostic data level is manually configured to the non-default setting of 0. You may also receive an error in the Application section of Windows Logs in Event Viewer with Event ID 1000 referencing “svchost.exe_RasMan” and “rasman.dll”.

                  This issue only occurs when a VPN profile is configured as an Always On VPN (AOVPN) connection with or without device tunnel. This does not affect manual only VPN profiles or connections.

                  Affected platforms
                  • Client: Windows 10, version 1903
                  Resolution: This issue was resolved in KB4505903.

                  Back to top
                  OS Build 18362.145

                  May 29, 2019
                  KB4497935
                  Resolved
                  KB4505903
                  Resolved:
                  July 26, 2019
                  02:00 PM PT

                  Opened:
                  June 28, 2019
                  05:01 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - - - - - - - - - -
                  DetailsOriginating updateStatusHistory
                  Intermittent loss of Wi-Fi connectivity
                  Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

                  To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Workaround: Before updating to Windows 10, version 1903, you will need to download and install an updated Wi-Fi driver from your device manufacturer (OEM).
                   
                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated External
                  Last updated:
                  August 01, 2019
                  08:44 PM PT

                  Opened:
                  May 21, 2019
                  07:13 AM PT
                  Gamma ramps, color profiles, and night light settings do not apply in some cases
                  Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

                  Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
                  • Connecting to (or disconnecting from) an external monitor, dock, or projector
                  • Rotating the screen
                  • Updating display drivers or making other display mode changes
                  • Closing full screen applications
                  • Applying custom color profiles
                  • Running applications that rely on custom gamma ramps
                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  Last updated:
                  August 01, 2019
                  06:27 PM PT

                  Opened:
                  May 21, 2019
                  07:28 AM PT
                  Display brightness may not respond to adjustments
                  Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

                  To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue was resolved in KB4505903 and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  KB4505903
                  Resolved:
                  July 26, 2019
                  02:00 PM PT

                  Opened:
                  May 21, 2019
                  07:56 AM PT
                  Loss of functionality in Dynabook Smartphone Link app
                  Some users may experience a loss of functionality after updating to Windows 10, version 1903 when using the Dynabook Smartphone Link application on Windows devices. Loss of functionality may affect the display of phone numbers in the Call menu and the ability to answer phone calls on the Windows PC.

                  To safeguard your update experience, we have applied a compatibility hold on devices with Dynabook Smartphone Link from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                  Back to top
                  OS Build 18362.116

                  May 20, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  July 11, 2019
                  01:54 PM PT

                  Opened:
                  May 24, 2019
                  03:10 PM PT
                  Error attempting to update with external USB device or memory card attached
                  If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

                  Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

                  Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

                  To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  July 11, 2019
                  01:53 PM PT

                  Opened:
                  May 21, 2019
                  07:38 AM PT
                  Audio not working with Dolby Atmos headphones and home theater
                  After updating to Windows 10, version 1903, you may experience loss of audio with Dolby Atmos for home theater (free extension) or Dolby Atmos for headphones (paid extension) acquired through the Microsoft Store due to a licensing configuration error.
                   
                  This occurs due to an issue with a Microsoft Store licensing component, where license holders are not able to connect to the Dolby Access app and enable Dolby Atmos extensions.
                   
                  To safeguard your update experience, we have applied protective hold on devices from being offered Windows 10, version 1903 until this issue is resolved. This configuration error will not result in loss of access for the acquired license once the problem is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Resolved
                  Resolved:
                  July 11, 2019
                  01:53 PM PT

                  Opened:
                  May 21, 2019
                  07:16 AM PT
                  Windows Sandbox may fail to start with error code “0x80070002”
                  Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 18362.116

                  May 20, 2019
                  KB4505057
                  Investigating
                  Last updated:
                  June 10, 2019
                  06:06 PM PT

                  Opened:
                  May 24, 2019
                  04:20 PM PT
                  Unable to discover or connect to Bluetooth devices
                  Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  • Server: Windows Server, version 1903
                  Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.

                  • For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.
                  • For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
                  Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

                  Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.  


                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  Last updated:
                  May 21, 2019
                  04:48 PM PT

                  Opened:
                  May 21, 2019
                  07:29 AM PT
                  Intel Audio displays an intcdaud.sys notification
                  Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
                    
                  To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809
                  Workaround:
                  On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

                  For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

                  Note We recommend you do not attempt to update your devices until newer device drivers are installed.

                  Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  Last updated:
                  May 21, 2019
                  04:47 PM PT

                  Opened:
                  May 21, 2019
                  07:22 AM PT
                  Cannot launch Camera app
                  Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

                  \"Close other apps, error code: 0XA00F4243.”


                  To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

                  Affected platforms:
                  • Client: Windows 10, version 1903
                  Workaround: To temporarily resolve this issue, perform one of the following:

                  • Unplug your camera and plug it back in.

                  or

                  • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

                  or

                  • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart
                  Note This workaround will only resolve the issue until your next system restart.

                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  OS Build 18362.116

                  May 21, 2019
                  KB4505057
                  Mitigated
                  Last updated:
                  May 21, 2019
                  04:47 PM PT

                  Opened:
                  May 21, 2019
                  07:20 AM PT
                  - " diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml deleted file mode 100644 index 88c5129963..0000000000 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ /dev/null @@ -1,101 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 7 and Windows Server 2008 R2 SP1 -metadata: - document_id: - title: Windows 7 and Windows Server 2008 R2 SP1 - description: View announcements and review known issues and fixes for Windows 7 and Windows Server 2008 R2 SP1 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 7 and Windows Server 2008 R2 SP1. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503292
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  June 11, 2019
                  KB4503292
                  Mitigated
                  July 10, 2019
                  02:59 PM PT
                  System may be unresponsive after restart with certain McAfee antivirus products
                  Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.

                  See details >
                  April 09, 2019
                  KB4493472
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503292) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503292
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503292 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server, set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.

                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  2. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  June 11, 2019
                  KB4503292
                  Mitigated
                  Last updated:
                  July 10, 2019
                  02:59 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  System may be unresponsive after restart with certain McAfee antivirus products
                  Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                  Affected platforms:
                  • Client:  Windows 8.1; Windows 7 SP1
                  • Server:  Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Workaround: Guidance for McAfee customers can be found in the following McAfee support articles: 
                  Next steps: We are presently investigating this issue with McAfee. We will provide an update once we have more information.

                  Back to top
                  April 09, 2019
                  KB4493472
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml deleted file mode 100644 index a15ed55837..0000000000 --- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml +++ /dev/null @@ -1,121 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 8.1 and Windows Server 2012 R2 -metadata: - document_id: - title: Windows 8.1 and Windows Server 2012 R2 - description: View announcements and review known issues and fixes for Windows 8.1 and Windows Server 2012 R2 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 8.1 and Windows Server 2012 R2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503276
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  June 11, 2019
                  KB4503276
                  Mitigated
                  July 10, 2019
                  07:09 PM PT
                  Japanese IME doesn't show the new Japanese Era name as a text input option
                  If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                  See details >
                  April 25, 2019
                  KB4493443
                  Mitigated
                  May 15, 2019
                  05:53 PM PT
                  System may be unresponsive after restart with certain McAfee antivirus products
                  Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.

                  See details >
                  April 09, 2019
                  KB4493446
                  Mitigated
                  April 18, 2019
                  05:00 PM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

                  See details >
                  January 08, 2019
                  KB4480963
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503276) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503276
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503276 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server:
                  1. Verify Variable Window Extension is enabled.
                  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  June 11, 2019
                  KB4503276
                  Mitigated
                  Last updated:
                  July 10, 2019
                  07:09 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Japanese IME doesn't show the new Japanese Era name as a text input option
                  If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                  Affected platforms:
                  • Client: Windows 8.1
                  • Server: Windows Server 2012 R2; Windows Server 2012
                  Workaround:
                  If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)
                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)
                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)
                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)
                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)
                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)

                  Back to top
                  April 25, 2019
                  KB4493443
                  Mitigated
                  Last updated:
                  May 15, 2019
                  05:53 PM PT

                  Opened:
                  May 15, 2019
                  05:53 PM PT
                  - " - -- title: April 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  System may be unresponsive after restart with certain McAfee antivirus products
                  Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                  Affected platforms:
                  • Client:  Windows 8.1; Windows 7 SP1
                  • Server:  Windows Server 2012 R2; Windows Server 2008 R2 SP1
                  Workaround: Guidance for McAfee customers can be found in the following McAfee support articles:  
                  Next steps: We are presently investigating this issue with McAfee. We will provide an update once we have more information. 

                  Back to top
                  April 09, 2019
                  KB4493446
                  Mitigated
                  Last updated:
                  April 18, 2019
                  05:00 PM PT

                  Opened:
                  April 09, 2019
                  10:00 AM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following:
                  • Perform the operation from a process that has administrator privilege.
                  • Perform the operation from a node that doesn’t have CSV ownership.
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  January 08, 2019
                  KB4480963
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml deleted file mode 100644 index 7e730c134a..0000000000 --- a/windows/release-information/status-windows-server-2008-sp2.yml +++ /dev/null @@ -1,91 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows Server 2008 SP2 -metadata: - document_id: - title: Windows Server 2008 SP2 - description: View announcements and review known issues and fixes for Windows Server 2008 SP2 - keywords: Windows, Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows Server 2008 SP2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503273
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  June 11, 2019
                  KB4503273
                  Mitigated
                  July 10, 2019
                  02:59 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503273) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503273
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503273 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server, set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.

                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  2. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  June 11, 2019
                  KB4503273
                  Mitigated
                  Last updated:
                  July 10, 2019
                  02:59 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml deleted file mode 100644 index ed7deea5f4..0000000000 --- a/windows/release-information/status-windows-server-2012.yml +++ /dev/null @@ -1,111 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows Server 2012 -metadata: - document_id: - title: Windows Server 2012 - description: View announcements and review known issues and fixes for Windows Server 2012 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows Server 2012. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
                  - " - -- title: Known issues -- items: - - type: markdown - text: "
                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                  - - - - - -
                  SummaryOriginating updateStatusLast updated
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                  See details >
                  June 11, 2019
                  KB4503285
                  Resolved External
                  August 09, 2019
                  04:25 PM PT
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                  See details >
                  June 11, 2019
                  KB4503285
                  Mitigated
                  July 10, 2019
                  07:09 PM PT
                  Japanese IME doesn't show the new Japanese Era name as a text input option
                  If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                  See details >
                  April 25, 2019
                  KB4493462
                  Mitigated
                  May 15, 2019
                  05:53 PM PT
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

                  See details >
                  January 08, 2019
                  KB4480975
                  Mitigated
                  April 25, 2019
                  02:00 PM PT
                  - " - -- title: Issue details -- items: - - type: markdown - text: " -
                  -
                  - " -- title: August 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503285) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                  Affected platforms:
                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                  Back to top
                  June 11, 2019
                  KB4503285
                  Resolved External
                  Last updated:
                  August 09, 2019
                  04:25 PM PT

                  Opened:
                  August 09, 2019
                  04:25 PM PT
                  - " - -- title: July 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503285 on a WDS server.

                  Affected platforms:
                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                  Workaround:
                  To mitigate this issue on an SCCM server:
                  1. Verify Variable Window Extension is enabled.
                  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                  Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                  To mitigate this issue on a WDS server without SCCM:
                  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                  Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                  Next steps: We are working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  June 11, 2019
                  KB4503285
                  Mitigated
                  Last updated:
                  July 10, 2019
                  07:09 PM PT

                  Opened:
                  July 10, 2019
                  02:51 PM PT
                  - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Japanese IME doesn't show the new Japanese Era name as a text input option
                  If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                  Affected platforms:
                  • Client: Windows 8.1
                  • Server: Windows Server 2012 R2; Windows Server 2012
                  Workaround:
                  If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)
                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)
                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)
                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)
                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)
                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)

                  Back to top
                  April 25, 2019
                  KB4493462
                  Mitigated
                  Last updated:
                  May 15, 2019
                  05:53 PM PT

                  Opened:
                  May 15, 2019
                  05:53 PM PT
                  - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
                  DetailsOriginating updateStatusHistory
                  Certain operations performed on a Cluster Shared Volume may fail
                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                  Affected platforms: 
                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                  Workaround: Do one of the following:
                  • Perform the operation from a process that has administrator privilege.
                  • Perform the operation from a node that doesn’t have CSV ownership.
                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                  Back to top
                  January 08, 2019
                  KB4480975
                  Mitigated
                  Last updated:
                  April 25, 2019
                  02:00 PM PT

                  Opened:
                  January 08, 2019
                  10:00 AM PT
                  - " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml deleted file mode 100644 index c7a8b5e2d7..0000000000 --- a/windows/release-information/windows-message-center.yml +++ /dev/null @@ -1,125 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10 message center -metadata: - document_id: - title: Windows 10 message center - description: Windows 10 message center - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: - -- items: - - type: list - style: cards - className: cardsM - columns: 2 - items: - - - href: https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update/#1P75kJB6T5OhySyo.97 - html: Get the update > - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg - title: Windows 10, version 1903 rollout begins - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064 - html: Read about the latest enhancements > - image: - src: https://docs.microsoft.com/media/common/i_whats-new.svg - title: What’s new in Windows Update for Business - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024 - html: Get an overview > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: What’s new for businesses and IT pros in Windows 10 - - href: https://docs.microsoft.com/windows/windows-10/release-information - html: Visit the Windows 10 release information page > - image: - src: https://docs.microsoft.com/media/common/i_download-monitor.svg - title: Find a list of currently supported versions and previous releases - -- title: Recent announcements -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  MessageDate
                  Advisory: Windows Kernel Information Disclosure Vulnerability (CVE-2019-1125)
                  On July 9, 2019, Microsoft released a security update for a Windows kernel information disclosure vulnerability (CVE-2019-1125). Customers who have Windows Update enabled and have applied the security updates released on July 9, 2019 are protected automatically; no further configuration is necessary. For more information, see CVE-2019-1125 | Windows Kernel Information Disclosure Vulnerability in the Microsoft Security Update Guide. (Note: we are documenting this mitigation publicly today, instead of back in July, as part of a coordinated industry disclosure effort.)
                  August 06, 2019
                  10:00 AM PT
                  Resolved August 1, 2019 16:00 PT: Microsoft Store users may encounter blank screens when clicking on certain buttons
                  Some customers running the version of the Microsoft Store app released on July 29, 2019 encountered a blank screen when selecting “Switch out of S mode,” “Get Genuine,” or some “Upgrade to [version]” OS upgrade options. This issue has now been resolved and a new version of the Microsoft Store app has been released. Users who encountered this issue will need to update the Microsoft Store app on their device. If you are still encountering an issue, please see Fix problems with apps from Microsoft Store.
                  August 01, 2019
                  02:00 PM PT
                  Status update: Windows 10, version 1903 “D” release now available
                  The optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
                  July 26, 2019
                  02:00 PM PT
                  Plan for change: Microsoft Silverlight will reach end of support on October 12, 2021
                  After this date, Silverlight will not receive any future quality or security updates. Microsoft will continue to ship updates to the Silverlight 5 Developer Runtime for supported browsers and versions (Internet Explorer 10 and Internet Explorer 11); however, please note that support for Internet Explorer 10 will end on 31 January 2020. See the Silverlight end of support FAQ for more details.
                  July 19, 2019
                  12:00 AM PT
                  Evolving Windows 10 servicing and quality
                  Find out how we plan to further optimize the delivery of the next Windows 10 feature update for devices running Windows 10, version 1903. If you're a commercial customer, please see the Windows IT Pro Blog for more details on how to plan for this new update option in your environment.
                  July 01, 2019
                  02:00 PM PT
                  Windows 10, version 1903 starting to roll out to devices running Windows 10, version 1803 and earlier
                  We are now beginning to build and train the machine learning (ML) based rollout process to update devices running Windows 10, version 1803 (the April 2018 Update) and earlier versions of Windows 10, to ensure we can continue to service these devices and provide the latest updates, security updates, and improvements.
                  June 18, 2019
                  02:00 PM PT
                  Windows 10, version 1903 available by selecting “Check for updates”
                  Windows 10, version 1903 is now available for any user who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
                  June 06, 2019
                  06:00 PM PT
                  Windows 10, version 1903 rollout begins
                  The Windows 10 May 2019 Update (Windows 10, version 1903) is available today to commercial customers via Windows Server Update Services (WSUS), Windows Update for Business, and the Volume Licensing Service Center (VLSC)—and to end users who manually select “Check for updates.” We are slowly throttling up availability while we carefully monitor data and feedback.
                  May 21, 2019
                  10:00 AM PT
                  What’s new in Windows Update for Business
                  We are enhancing and expanding the capabilities of Windows Update for Business to make the move to the cloud even easier. From simplified branch readiness options to better control over deadlines and reboots, read about the enhancements to Windows Update for Business as a part of Windows 10, version 1903.
                  May 21, 2019
                  10:00 AM PT
                  What’s new for businesses and IT pros in Windows 10
                  Explore the newest capabilities for businesses and IT in the latest feature update in the areas of intelligent security, simplified updates, flexible management, and enhanced productivity.
                  May 21, 2019
                  10:00 AM PT
                  Reminder: Install the latest SSU for a smoother update experience
                  We strongly recommend that you install the latest servicing stack update (SSU) before installing any Windows update; especially as an SSU may be a prerequisite for some updates. If you have difficulty installing Windows updates, verify that you have installed the latest SSU package for your version of Windows and then try installing the update again. Links to the latest SSU are always provided in the “How to get this update” section of each update KB article (e.g., KB4494441). For more information about SSUs, see our Servicing stack updates guidance.
                  May 14, 2019
                  10:00 AM PT
                  Take action: Update Remote Desktop Services on older versions of Windows
                  Today, we released fixes for a critical wormable, remote code execution vulnerability (CVE-2019-0708) in Remote Desktop Services—formerly known as Terminal Services. This vulnerability affects Windows 7, Windows Server 2008 R2, and earlier versions of Windows nearing end of support. It does not affect Windows 8, Windows Server 2012, or newer operating systems. While we have not observed attacks exploiting this vulnerability, affected systems should be patched with priority. Here is what you need to know:

                  -Call to action: -
                    -
                  • If you are running a supported version of Windows and have automatic updates enabled, you are automatically protected and do not need to take any action.
                  • -
                  • If you are managing updates on behalf of your organization, you should download the latest updates from the Microsoft Security Update Guide and apply them to your Windows 7, Windows Server 2008 R2, and Windows Server 2008 devices as soon as possible.
                  • -
                  -Given the potential impact to customers and their businesses, we have also released security updates for Windows XP and Windows Server 2003, even though these operating systems have reached end of support (except by custom support agreements). While we recommend that you upgrade to the current version of Windows to benefit from the latest security protections, these updates are available from the Microsoft Update Catalog only. For more information, see KB4500705. -
                  -
                  May 14, 2019
                  10:00 AM PT
                  Reminder: Windows 10 update servicing cadence
                  This month we received questions about the cadence of updates we released in April and May 2019. Here's a quick recap of our releases and servicing cadence:
                  -
                    -
                  • April 9, 2019 was the regular Update Tuesday release for all versions of Windows.
                  • -
                  • May 1, 2019 was an \"optional,\" out of band non-security update (OOB) for Windows 10, version 1809. It was released to Microsoft Catalog and WSUS, providing a critical fix for our OEM partners.
                  • -
                  • May 3, 2019 was the \"optional\" Windows 10, version 1809 \"C\" release for April. This update contained important Japanese era packages for commercial customers to preview. It was released later than expected and mistakenly targeted as \"required\" (instead of \"optional\") for consumers, which pushed the update out to customers and required a reboot. Within 24 hours of receiving customer reports, we corrected the targeting logic and mitigated the issue.
                  • -
                  - For more information about the Windows 10 update servicing cadence, please see the Window IT Pro blog.
                  -
                  May 10, 2019
                  10:00 AM PT
                  Take action: Install servicing stack update for Windows Server 2008 SP2 for SHA-2 code sign support
                  A standalone update, KB4493730, that introduce SHA-2 code sign support for the servicing stack (SSU) was released today as a security update.
                  April 19, 2019
                  10:00 AM PT
                  The benefits of Windows 10 Dynamic Update
                  Dynamic Update can help organizations and end users alike ensure that their Windows 10 devices have the latest feature update content (as part of an in-place upgrade)—and preserve precious features on demand (FODs) and language packs (LPs) that may have been previously installed.

                  - -
                  Find out which components are updated by Dynamic Update, how Dynamic Update is initiated, and how to enable or disable it.
                  April 17, 2019
                  11:26 AM PT
                  Improvements to the Windows 10 update experience are coming
                  Find out about the changes coming to the Windows update process that will improve the experience, offer users more control, and improve the quality of Windows updates.
                  April 04, 2019
                  09:00 AM PT
                  Take action: review your Windows Update for Business deferral values
                  If devices under your management are still running Windows 10 Pro or Windows 10 Pro for Workstations, version 1709, your devices will reach end of service on April 9, 2019 if you have configured both of the following Windows Update for Business policies:
                  -
                    -
                  • Branch readiness is configured as Semi-Annual Channel (SAC)
                  • -
                  • Feature update deferral is configured as 274 days or more
                  • -
                  -In order avoid this, you need to set your feature update deferral policy to 273 days or less.
                  April 03, 2019
                  05:47 PM PT
                  Find a list of currently supported versions and previous releases
                  Every Windows product has a lifecycle. The lifecycle begins when a product is released and ends when it is no longer serviced or supported. Knowing key dates in this lifecycle helps you make informed decisions about when to update, upgrade, or make other changes to your software. Check out the updated Windows 10 release information page for a list of current versions by servicing option as well as end of service dates.
                  March 28, 2019
                  02:00 PM PT
                  Windows 10, version 1809 designated for broad deployment
                  Based on the data and the feedback we’ve received from consumers, OEMs, ISVs, partners, and commercial customers, Windows 10, version 1809 has transitioned to broad deployment. With this, the Windows 10 release information page will now reflect Semi-Annual Channel (SAC) for version 1809.
                  March 28, 2019
                  10:00 AM PT
                  Reminder: Additional servicing for the Windows 10 Enterprise, Education, and IoT Enterprise, version 1607 ends April 9, 2019
                  The additional servicing for Windows 10 Enterprise, Education, and IoT Enterprise editions ends on April 9, 2019 and doesn't extend beyond this date. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

                  Devices running Windows 10 Enterprise 2016 LTSB will continue to receive updates until October 2026 per the Fixed Lifecycle Policy. Windows 10, version 1607 devices running the Intel “Clovertrail” chipset will continue to receive updates until January 2023.
                  March 12, 2019
                  10:00 AM PT
                  Reminder: Windows 10 Home, Pro, Pro for Workstations, and IoT Core, version 1709 will reach end of service on April 9, 2019
                  Windows 10, version 1709, will reach end of service on April 9, 2019 for devices running Windows 10 Home, Pro, Pro for Workstations, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

                  Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.
                  March 12, 2019
                  10:00 AM PT
                  Take action: Install standalone security updates to introduce SHA-2 code sign support for Windows 7 amd Windows Server 2008 R2
                  A standalone SHA-2 code signing support update for Windows Server 2008 R2 and Windows 7 is now available, as is a servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1 that includes the SHA-2 code signing support update.
                  March 12, 2019
                  10:00 AM PT
                  Take action: Install standalone update for WSUS 3.0 SP2 to support the delivery of SHA-2 signed updates
                  A standalone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019.
                  March 12, 2019
                  10:00 AM PT
                  Reminder: Final Delta update for Windows 10, version 1607, 1703, 1709, and 1803 will be April 9, 2019
                  March 12th and April 9th will be the last two Delta updates for Windows 10, version 1607, 1703, 1709, and 1803. Security and quality updates will continue to be available via the express and full cumulative update packages.
                  March 12, 2019
                  10:00 AM PT
                  How do we measure and improve the quality of Windows?
                  Measuring the quality of Windows is a complex undertaking that requires gathering a variety of diagnostic signals from millions of devices within the Windows ecosystem. In addition to rigorous internal testing, we rely heavily on the feedback provided through diagnostic data to detect and fix problems before we release new updates of Windows to the general population, and to monitor the impact of those updates after each release.

                  - -
                  Get insight into some of the practices we employ to measure and improve the quality of Windows.
                  March 06, 2019
                  10:23 AM PT
                  Getting to know the Windows update history pages
                  Windows update history pages offer detailed information about each Windows update: the type of update, which operating systems it affects, the improvements and fixes included, and how to get the update. See how simple it is to use this important resource to access information for Windows 10, Windows Server 2019, and earlier versions of the Windows and Windows Server operating systems.
                  February 21, 2019
                  06:37 PM PT
                  Share your feedback: Windows update history
                  We read every comment you leave on our update history pages, and are always looking to improve these pages and the monthly knowledge base (KB) articles that accompany each monthly update. Take our survey and let us know how we can improve our transparency further and make these more compelling and useful to you and your organization.
                  February 21, 2019
                  12:00 PM PT
                  Plan for change: Windows Update for Business and the retirement of SAC-T
                  Beginning with Windows 10, version 1903 (the next feature update for Windows 10), the Windows 10 release information page will no longer list SAC-T information for version 1903 and future feature updates. Instead, you will find a single entry for each new SAC release. In addition, if you are using Windows Update for Business, you will see new UI and behavior to reflect that there is only one release date for each SAC release. If you use System Center Configuration Manager, Windows Server Update Services (WSUS), or other management tools, there will now only be one feature update published to WSUS, and this will occur at the time of release. Learn how this change will affect Windows Business for Update customers.
                  February 14, 2019
                  12:00 PM PT
                  Champs corner: Classifying Windows updates in common deployment tools
                  If you utilize automated update deployment tools, such as Windows Server Update Services (WSUS) or System Center Configuration Manager, you likely use automatic rules to streamline the approval and deployment of Windows updates. Using the correct update classification is, therefore, an important component of your organization’s device update process. Explore the options available and how to approach it in a WSUS or Configuration Manager environment.
                  February 05, 2019
                  10:34 AM PT
                  Update: Delta updates for Windows 10, version 1607, 1703, 1709, and 1803 will be available until April 9, 2019
                  Based on customer feedback, we are extending Delta update publication for Windows 10 versions 1607, 1703, 1709, and 1803. We will continue to provide Delta updates via the Microsoft Update Catalog through April 9th, 2019, which will be the last delta update available.
                  February 05, 2019
                  09:00 AM PT
                  Global DNS outage affecting Windows Update customers
                  Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider’s global outage. A software update to the external provider’s DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored.

                  - -While this was not an issue with Microsoft’s services, we take any service disruption for our customers seriously. We will work with partners to better understand this so we can provide higher quality service in the future even across diverse global network providers.

                  - -If you are still unable to connect to Windows Update services due to this problem, please contact your local ISP or network administrator. You can also refer to our new KB4493784 for more information to determine if your network is affected, and to provide your local ISP or network administrator with additional information to assist you.
                  January 29, 2019
                  04:15 PM PT
                  Application compatibility in the Windows ecosystem
                  Our application ecosystem is incredibly diverse, encompassing tens of millions of applications (apps) with numerous versions, languages, architectures, services and configuration options. While our ecosystem is complex, our vision is simple. All apps on Windows devices should just work! Explore the various programs and technologies we use to improve application compatibility.
                  January 15, 2019
                  10:00 AM PT
                  Modern desktop servicing: the year in review
                  2018 was a pivotal year for the modern desktop and the servicing transformation journey we have been taking with you and your organization. In this post, John Wilcox takes a look back and recaps the progress that has been made, highlighting significant events, and provideing nsight into what 2019 has in store.
                  December 19, 2018
                  02:20 PM PT
                  Driver quality in the Windows ecosystem
                  Ensuring Windows 10 works great with all the devices and accessories our customers use is a top priority. We work closely with this broad mix of partners to test new drivers, monitor health characteristics over time, and make Windows and our ecosystem more resilient architecturally. Our goal is to ensure that all the updates and drivers we deliver to non-Insider populations are validated and at production quality (including monthly optional releases) before pushing drivers broadly to all. Explore the driver distribution chain and learn how we measure driver quality and prevent conflicts.
                  December 19, 2018
                  10:04 AM PT
                  Introducing the Modern Desktop podcast series
                  In this new podcast series, we'll explore the good, the bad, and, yes, the ugly of servicing and delivery for Windows 10 and Office 365 ProPlus. We'll talk about modern desktop management through Enterprise Mobility, security, and cloud-attached and co-managed environments. Listen to the first episode, in which we discuss monthly quality updates fpr Windows 10, the Microsoft 365 Stay Current pilot program, and interview a real customer to see how they ingest monthly updates in their organization.
                  December 18, 2018
                  01:00 PM PT
                  Measuring Delivery Optimization and its impact to your network
                  If you've familiarized yourself with the configuration options for Delivery Optimization in Windows 10, and have started to configure the settings you feel will be the best fit for your organization’s network topology, now is the time to see how well those settings are working. This article provides tips on how evaluate performance at the device level or organization level.
                  December 13, 2018
                  03:48 PM PT
                  Windows monthly security and quality updates overview
                  Today’s global cybersecurity threats are both dynamic and sophisticated, and new vulnerabilities are discovered almost every day. We focus on protecting customers from these security threats by providing security updates on a timely basis and with high quality. Find out how we deliver these critical updates on a massive scale as a key component of our ongoing Windows as a service effort.
                  December 10, 2018
                  10:00 AM PT
                  LTSC: What is it, and when should it be used?
                  With the Semi-Annual Channel, devices receive two feature updates per year, and benefit from the best performance, user experience, security, and stability. This servicing option continues to be our recommendation for managing Windows 10 updates; however, we acknowledge that certain devices and use cases (e.g. medical systems and industrial process controllers) dictate that functionality and features don’t change over time. Find out how we designed the Long-Term Servicing Channel (LTSC) with these types of use cases in mind, and what is offered through the LTSC.
                  November 29, 2018
                  07:02 PM PT
                  Plan for change: Local Experience Packs: What are they and when should you use them?
                  When we released Windows 10, version 1803, we introduced Local Experience Packs (LXPs), which are modern language packs delivered through the Microsoft Store or Microsoft Store for Business. Learn about the biggest advantage to LXPs, and the retirement of legacy language packs (lp.cab) for all Language Interface Packs (LIP).
                  November 14, 2018
                  11:10 AM PT
                  Windows 10 Quality approach for a complex ecosystem
                  While our measurements of quality show improving trends on aggregate for each successive Windows 10 release, if a single customer experiences an issue with any of our updates, we take it seriously. In this blog post, Windows CVP Mike Fortin shares an overview of how we work to continuously improve the quality of Windows and our Windows as a service approach. This blog will be the first in a series of more in-depth explanations of the work we do to deliver quality in our Windows releases.
                  November 13, 2018
                  10:00 AM PT
                  Windows 10, version 1809 rollout resumes; now available on VLSC
                  Today we are resuming the rollout of the latest Windows 10 feature update—Windows 10, version 1809—via the Software Download Center (via Update Assistant or the Media Creation Tool), Windows Server Update Services (WSUS), and Windows Update for Business. Windows 10, version 1809 is also now available on the Volume Licensing Service Center (VLSC).
                  November 13, 2018
                  10:00 AM PT
                  Express updates for Windows Server 2016 re-enabled for November 2018 update
                  Starting with the November 13, 2018 Update Tuesday release, Windows will again publish Express updates for Windows Server 2016. That means that system administrators for WSUS and System Center Configuration Manager will once again see two packages for the Windows Server 2016 update: a Full update and an Express update. Read this article for more details.
                  November 12, 2018
                  03:00 PM PT
                  Plan for change: 2019 SHA-2 code signing support requirement for Windows and WSUS
                  To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

                  Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Please make note of the dates in the migration timeline and plan accordingly.
                  November 09, 2018
                  10:00 AM PT
                  - " diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 328ee569c2..1998bdf279 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -33,7 +33,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", - "ms.technology": "windows", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.topic": "article", "manager": "dansimp", "audience": "ITPro", @@ -45,9 +45,14 @@ "depot_name": "MSDN.security", "folder_relative_path_in_docset": "./" } + }, + "titleSuffix": "Microsoft 365 Security" + }, + "fileMetadata": { + "titleSuffix":{ + "threat-protection/**/*.md": "Windows security" } }, - "fileMetadata": {}, "template": [], "dest": "security", "markdownEngineName": "markdig" diff --git a/windows/security/identity-protection/TOC.md b/windows/security/identity-protection/TOC.md index a3c24b5cf6..7f7f58c2b8 100644 --- a/windows/security/identity-protection/TOC.md +++ b/windows/security/identity-protection/TOC.md @@ -1,5 +1,7 @@ # [Identity and access management](index.md) +## [Technical support policy for lost or forgotten passwords](password-support-policy.md) + ## [Access Control Overview](access-control/access-control.md) ### [Dynamic Access Control Overview](access-control/dynamic-access-control.md) ### [Security identifiers](access-control/security-identifiers.md) @@ -22,6 +24,7 @@ ### [How Credential Guard works](credential-guard/credential-guard-how-it-works.md) ### [Credential Guard Requirements](credential-guard/credential-guard-requirements.md) ### [Manage Credential Guard](credential-guard/credential-guard-manage.md) +### [Hardware readiness tool](credential-guard/dg-readiness-tool.md) ### [Credential Guard protection limits](credential-guard/credential-guard-protection-limits.md) ### [Considerations when using Credential Guard](credential-guard/credential-guard-considerations.md) ### [Credential Guard: Additional mitigations](credential-guard/additional-mitigations.md) @@ -68,4 +71,5 @@ ### [VPN security features](vpn\vpn-security-features.md) ### [VPN profile options](vpn\vpn-profile-options.md) ### [How to configure Diffie Hellman protocol over IKEv2 VPN connections](vpn\how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md) -### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md) \ No newline at end of file +### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md) +### [Optimizing Office 365 traffic with the Windows 10 VPN client](vpn\vpn-office-365-optimization.md) diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index 36a6c863ed..8e6cf74f38 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 9b684b3be6..2ae163cea6 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -7,12 +7,12 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 04/19/2017 +ms.date: 08/23/2019 ms.reviewer: --- @@ -169,7 +169,7 @@ When Active Directory is installed on the first domain controller in the domain, ## Guest account -The Guest account is a default local account has limited access to the computer and is disabled by default. The Guest account cannot be deleted or disabled, and the account name cannot be changed. By default, the Guest account password is left blank. A blank password allows the Guest account to be accessed without requiring the user to enter a password. +The Guest account is a default local account that has limited access to the computer and is disabled by default. By default, the Guest account password is left blank. A blank password allows the Guest account to be accessed without requiring the user to enter a password. The Guest account enables occasional or one-time users, who do not have an individual account on the computer, to sign in to the local server or domain with restricted rights and permissions. The Guest account can be enabled, and the password can be set up if needed, but only by a member of the Administrator group on the domain. @@ -330,13 +330,11 @@ Windows Server Kerberos authentication is achieved by the use of a special Kerbe ### KRBTGT account maintenance considerations -A strong password is assigned to the KRBTGT account automatically. Be sure that you change the password on a regular schedule. The password for the KDC account is used to derive a secret key for encrypting and decrypting the TGT requests that are issued. The password for a domain trust account is used to derive an inter-realm key for encrypting referral tickets. - -On occasion, the KRBTGT account password requires a reset, for example, when an attempt to change the password on the KRBTGT account fails. In order to resolve this issue, you reset the KRBTGT user account password twice by using Active Directory Users and Computers. You must reset the password twice because the KRBTGT account stores only two of the most recent passwords in the password history. By resetting the password twice, you effectively clear all passwords from the password history. +A strong password is assigned to the KRBTGT and trust accounts automatically. Like any privileged service accounts, organizations should change these passwords on a regular schedule. The password for the KDC account is used to derive a secret key for encrypting and decrypting the TGT requests that are issued. The password for a domain trust account is used to derive an inter-realm key for encrypting referral tickets. Resetting the password requires you either to be a member of the Domain Admins group, or to have been delegated with the appropriate authority. In addition, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority. -After you reset the KRBTGT password, ensure that event ID 6 in the (Kerberos) Key-Distribution-Center event source is written to the System event log. +After you reset the KRBTGT password, ensure that event ID 9 in the (Kerberos) Key-Distribution-Center event source is written to the System event log. ### Security considerations @@ -472,7 +470,7 @@ Each default local account in Active Directory has a number of account settings

                  Account is trusted for delegation

                  -

                  Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

                  +

                  Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

                  Account is sensitive and cannot be delegated

                  @@ -482,7 +480,7 @@ Each default local account in Active Directory has a number of account settings

                  Use DES encryption types for this account

                  Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit and 56-bit), MPPE standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPSec) DES (40-bit), IPSec 56-bit DES, and IPSec Triple DES (3DES).

                  -Note

                  DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see Hunting down DES in order to securely deploy Kerberos.

                  +Note

                  DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see Hunting down DES in order to securely deploy Kerberos.

                  @@ -658,8 +656,8 @@ In this procedure, the workstations are dedicated to domain administrators. By s -

                  Windows Update Setting

                  -

                  Configuration

                  +

                  Windows Update Setting

                  +

                  Configuration

                  Allow Automatic Updates immediate installation

                  diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index 4981294bac..d703f10851 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -79,8 +79,8 @@ Groups are characterized by a scope that identifies the extent to which the grou - Domain Local -**Note**   -In addition to these three scopes, the default groups in the **Builtin** container have a group scope of Builtin Local. This group scope and group type cannot be changed. +> [!NOTE] +> In addition to these three scopes, the default groups in the **Builtin** container have a group scope of Builtin Local. This group scope and group type cannot be changed. @@ -111,7 +111,7 @@ The following table lists the three group scopes and more information about each

                  Accounts from any domain in the same forest

                  Global groups from any domain in the same forest

                  Other Universal groups from any domain in the same forest

                  -

                  Can be converted to Domain Local scope

                  +

                  Can be converted to Domain Local scope if the group is not a member of any other Universal groups

                  Can be converted to Global scope if the group does not contain any other Universal groups

                  On any domain in the same forest or trusting forests

                  Other Universal groups in the same forest

                  @@ -576,7 +576,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  BuiltIn Local

                  +

                  Builtin Local

                  Default container

                  @@ -620,8 +620,8 @@ Members of the Account Operators group cannot manage the Administrator user acco The Account Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -By default, this built-in group has no members, and it can create and manage users and groups in the domain, including its own membership and that of the Server Operators group. This group is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration. This group cannot be renamed, deleted, or moved. +> [!NOTE] +> By default, this built-in group has no members, and it can create and manage users and groups in the domain, including its own membership and that of the Server Operators group. This group is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration. This group cannot be renamed, deleted, or moved. @@ -645,7 +645,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  BuiltIn Local

                  +

                  Builtin Local

                  Default container

                  @@ -686,8 +686,8 @@ Members of the Administrators group have complete and unrestricted access to the The Administrators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -The Administrators group has built-in capabilities that give its members full control over the system. This group cannot be renamed, deleted, or moved. This built-in group controls access to all the domain controllers in its domain, and it can change the membership of all administrative groups. +> [!NOTE] +> The Administrators group has built-in capabilities that give its members full control over the system. This group cannot be renamed, deleted, or moved. This built-in group controls access to all the domain controllers in its domain, and it can change the membership of all administrative groups. Membership can be modified by members of the following groups: the default service Administrators, Domain Admins in the domain, or Enterprise Admins. This group has the special privilege to take ownership of any object in the directory or any resource on a domain controller. This account is considered a service administrator group because its members have full access to the domain controllers in the domain. @@ -717,7 +717,7 @@ This security group includes the following changes since Windows Server 2008:

                  Type

                  -

                  BuiltIn Local

                  +

                  Builtin Local

                  Default container

                  @@ -865,7 +865,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -987,7 +987,7 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-<domain>-517

                  +

                  S-1-5-21-<domain>-517

                  Type

                  @@ -1113,7 +1113,7 @@ This security group was introduced in Windows Vista Service Pack 1, and it h

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -1241,7 +1241,7 @@ The Device Owners group applies to versions of the Windows Server operating syst

                  Type

                  -

                  BuiltIn Local

                  +

                  Builtin Local

                  Default container

                  @@ -1345,7 +1345,7 @@ This security group has not changed since Windows Server 2008. Members of the DnsUpdateProxy group are DNS clients. They are permitted to perform dynamic updates on behalf of other clients (such as DHCP servers). A DNS server can develop stale resource records when a DHCP server is configured to dynamically register host (A) and pointer (PTR) resource records on behalf of DHCP clients by using dynamic update. Adding clients to this security group mitigates this scenario. -However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account. +However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account. This group exists only if the DNS server role is or was once installed on a domain controller in the domain. For information, see [DNS Record Ownership and the DnsUpdateProxy Group](https://technet.microsoft.com/library/dd334715.aspx). @@ -1365,7 +1365,7 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-21-<domain>-1103

                  +

                  S-1-5-21-<domain>-<variable RID>

                  Type

                  @@ -1406,7 +1406,7 @@ This security group has not changed since Windows Server 2008. ### DnsAdmins -Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. +Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. This group exists only if the DNS server role is or was once installed on a domain controller in the domain. For more information about security and DNS, see [DNSSEC in Windows Server 2012](https://technet.microsoft.com/library/dn593694(v=ws.11).aspx). @@ -1426,11 +1426,11 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-21-<domain>-1102

                  +

                  S-1-5-21-<domain>-<variable RID>

                  Type

                  -

                  Domain local

                  +

                  Builtin Local

                  Default container

                  @@ -1493,7 +1493,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Domain Global

                  +

                  Global

                  Default container

                  @@ -1552,7 +1552,7 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-<domain>-515

                  +

                  S-1-5-21-<domain>-515

                  Type

                  @@ -1613,7 +1613,7 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-<domain>-516

                  +

                  S-1-5-21-<domain>-516

                  Type

                  @@ -1674,7 +1674,7 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-<domain>-514

                  +

                  S-1-5-21-<domain>-514

                  Type

                  @@ -1737,11 +1737,11 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-<domain>-513

                  +

                  S-1-5-21-<domain>-513

                  Type

                  -

                  Domain Global

                  +

                  Global

                  Default container

                  @@ -1950,7 +1950,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Builtin local

                  +

                  Domain Local

                  Default container

                  @@ -1985,13 +1985,13 @@ This security group has not changed since Windows Server 2008. -### Group Policy Creators Owners +### Group Policy Creator Owners This group is authorized to create, edit, or delete Group Policy Objects in the domain. By default, the only member of the group is Administrator. For information about other features you can use with this security group, see [Group Policy Overview](https://technet.microsoft.com/library/hh831791.aspx). -The Group Policy Creators Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). +The Group Policy Creator Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). This security group has not changed since Windows Server 2008. @@ -2009,7 +2009,7 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-<domain>-520

                  +

                  S-1-5-21-<domain>-520

                  Type

                  @@ -2056,8 +2056,8 @@ When a member of the Guests group signs out, the entire profile is deleted. This Computer Configuration\\Administrative Templates\\System\\User Profiles -**Note**   -A Guest account is a default member of the Guests security group. People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. +> [!NOTE] +> A Guest account is a default member of the Guests security group. People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password. You can set rights and permissions for the Guest account as in any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to sign in to a domain. The Guest account is disabled by default, and we recommend that it stay disabled. @@ -2093,12 +2093,11 @@ This security group has not changed since Windows Server 2008.

                  Default members

                  -

                  Guest

                  +

                  Domain Guests

                  Guest

                  Default member of

                  -

                  Domain Guests

                  -

                  Guest

                  +

                  None

                  Protected by ADMINSDHOLDER?

                  @@ -2125,8 +2124,8 @@ This security group has not changed since Windows Server 2008. Members of the Hyper-V Administrators group have complete and unrestricted access to all the features in Hyper-V. Adding members to this group helps reduce the number of members required in the Administrators group, and further separates access. -**Note**   -Prior to Windows Server 2012, access to features in Hyper-V was controlled in part by membership in the Administrators group. +> [!NOTE] +> Prior to Windows Server 2012, access to features in Hyper-V was controlled in part by membership in the Administrators group. @@ -2150,7 +2149,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -2162,7 +2161,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

                  Default member of

                  -

                  No

                  +

                  None

                  Protected by ADMINSDHOLDER?

                  @@ -2189,7 +2188,7 @@ This security group was introduced in Windows Server 2012, and it has not chang IIS\_IUSRS is a built-in group that is used by Internet Information Services beginning with IIS 7.0. A built-in account and group are guaranteed by the operating system to always have a unique SID. IIS 7.0 replaces the IUSR\_MachineName account and the IIS\_WPG group with the IIS\_IUSRS group to ensure that the actual names that are used by the new account and group will never be localized. For example, regardless of the language of the Windows operating system that you install, the IIS account name will always be IUSR, and the group name will be IIS\_IUSRS. -For more information, see [Understanding Built-In User and Group Accounts in IIS 7](http://www.iis.net/learn/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis). +For more information, see [Understanding Built-In User and Group Accounts in IIS 7](https://docs.microsoft.com/iis/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis). This security group has not changed since Windows Server 2008. @@ -2211,7 +2210,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  BuiltIn Local

                  +

                  Builtin Local

                  Default container

                  @@ -2252,8 +2251,8 @@ Members of the Incoming Forest Trust Builders group can create incoming, one-way To make this determination, the Windows security system computes a trust path between the domain controller for the server that receives the request and a domain controller in the domain of the requesting account. A secured channel extends to other Active Directory domains through interdomain trust relationships. This secured channel is used to obtain and verify security information, including security identifiers (SIDs) for users and groups. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). @@ -2261,8 +2260,8 @@ For more information, see [How Domain and Forest Trusts Work: Domain and Forest The Incoming Forest Trust Builders group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. @@ -2286,7 +2285,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  BuiltIn local

                  +

                  Builtin Local

                  Default container

                  @@ -2359,17 +2358,15 @@ Members of the Network Configuration Operators group can have the following admi - Enter the PIN unblock key (PUK) for mobile broadband devices that support a SIM card. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). - The Network Configuration Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. - This security group has not changed since Windows Server 2008. @@ -2391,7 +2388,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  BuiltIn local

                  +

                  Builtin Local

                  Default container

                  @@ -2434,26 +2431,23 @@ Members of the Performance Log Users group can manage performance counters, logs - Can create and modify Data Collector Sets after the group is assigned the [Log on as a batch job](/windows/device-security/security-policy-settings/log-on-as-a-batch-job) user right. - **Warning**   - If you are a member of the Performance Log Users group, you must configure Data Collector Sets that you create to run under your credentials. + > [!WARNING] + > If you are a member of the Performance Log Users group, you must configure Data Collector Sets that you create to run under your credentials. - - Cannot use the Windows Kernel Trace event provider in Data Collector Sets. For members of the Performance Log Users group to initiate data logging or modify Data Collector Sets, the group must first be assigned the [Log on as a batch job](/windows/device-security/security-policy-settings/log-on-as-a-batch-job) user right. To assign this user right, use the Local Security Policy snap-in in Microsoft Management Console. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). - The Performance Log Users group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This account cannot be renamed, deleted, or moved. +> [!NOTE] +> This account cannot be renamed, deleted, or moved. - This security group has not changed since Windows Server 2008. @@ -2475,7 +2469,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -2524,13 +2518,13 @@ Specifically, members of this security group: - Cannot create or modify Data Collector Sets. - **Warning**   - You cannot configure a Data Collector Set to run as a member of the Performance Monitor Users group. + > [!WARNING] + > You cannot configure a Data Collector Set to run as a member of the Performance Monitor Users group. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). This group cannot be renamed, deleted, or moved. @@ -2556,7 +2550,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -2590,15 +2584,13 @@ This security group has not changed since Windows Server 2008. - ### Pre–Windows 2000 Compatible Access Members of the Pre–Windows 2000 Compatible Access group have Read access for all users and groups in the domain. This group is provided for backward compatibility for computers running Windows NT 4.0 and earlier. By default, the special identity group, Everyone, is a member of this group. Add users to this group only if they are running Windows NT 4.0 or earlier. -**Warning**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!WARNING] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). - The Pre–Windows 2000 Compatible Access group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). @@ -2622,7 +2614,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -2686,7 +2678,7 @@ This security group has not changed since Windows Server 2008. However, in Windo

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -2765,7 +2757,7 @@ The following table specifies the properties of the Protected Users group.

                  Type

                  -

                  Domain Global

                  +

                  Global

                  Default container

                  @@ -2826,7 +2818,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Domain local

                  +

                  Builtin Local

                  Default container

                  @@ -2883,11 +2875,11 @@ This security group was introduced in Windows Server 2012, and it has not chang

                  Well-Known SID/RID

                  -

                  S-1-5-32-<domain>-576

                  +

                  S-1-5-32-576

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -2946,7 +2938,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -3007,7 +2999,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -3042,6 +3034,78 @@ This security group was introduced in Windows Server 2012, and it has not chang +### Read-Only Domain Controllers + +This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role. + +Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality: + +- Read-only AD DS database + +- Unidirectional replication + +- Credential caching + +- Administrator role separation + +- Read-only Domain Name System (DNS) + +For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx). + +This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                  AttributeValue

                  Well-Known SID/RID

                  S-1-5-21-<domain>-521

                  Type

                  Global

                  Default container

                  CN=Users, DC=<domain>, DC=

                  Default members

                  None

                  Default member of

                  Denied RODC Password Replication Group

                  Protected by ADMINSDHOLDER?

                  Yes

                  Safe to move out of default container?

                  Yes

                  Safe to delegate management of this group to non-Service admins?

                  Default User Rights

                  See Denied RODC Password Replication Group

                  + + ### Remote Desktop Users The Remote Desktop Users group on an RD Session Host server is used to grant users and groups permissions to remotely connect to an RD Session Host server. This group cannot be renamed, deleted, or moved. It appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). @@ -3101,78 +3165,6 @@ This security group has not changed since Windows Server 2008. - - -### Read-Only Domain Controllers - -This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role. - -Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality: - -- Read-only AD DS database - -- Unidirectional replication - -- Credential caching - -- Administrator role separation - -- Read-only Domain Name System (DNS) - -For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx). - -This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  AttributeValue

                  Well-Known SID/RID

                  S-1-5-21-<domain>-521

                  Type

                  Default container

                  CN=Users, DC=<domain>, DC=

                  Default members

                  None

                  Default member of

                  Denied RODC Password Replication Group

                  Protected by ADMINSDHOLDER?

                  Yes

                  Safe to move out of default container?

                  Yes

                  Safe to delegate management of this group to non-Service admins?

                  Default User Rights

                  See Denied RODC Password Replication Group

                  @@ -3204,7 +3196,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -3243,8 +3235,8 @@ This security group was introduced in Windows Server 2012, and it has not chang Computers that are members of the Replicator group support file replication in a domain. Windows Server operating systems use the File Replication service (FRS) to replicate system policies and logon scripts stored in the System Volume (SYSVOL). Each domain controller keeps a copy of SYSVOL for network clients to access. FRS can also replicate data for the Distributed File System (DFS), synchronizing the content of each member in a replica set as defined by DFS. FRS can copy and maintain shared files and folders on multiple servers simultaneously. When changes occur, content is synchronized immediately within sites and by a schedule between sites. -**Important**   -In Windows Server 2008 R2, FRS cannot be used for replicating DFS folders or custom (non-SYSVOL) data. A Windows Server 2008 R2 domain controller can still use FRS to replicate the contents of a SYSVOL shared resource in a domain that uses FRS for replicating the SYSVOL shared resource between domain controllers. +> [!WARNING] +> In Windows Server 2008 R2, FRS cannot be used for replicating DFS folders or custom (non-SYSVOL) data. A Windows Server 2008 R2 domain controller can still use FRS to replicate the contents of a SYSVOL shared resource in a domain that uses FRS for replicating the SYSVOL shared resource between domain controllers. However, Windows Server 2008 R2 servers cannot use FRS to replicate the contents of any replica set apart from the SYSVOL shared resource. The DFS Replication service is a replacement for FRS, and it can be used to replicate the contents of a SYSVOL shared resource, DFS folders, and other custom (non-SYSVOL) data. You should migrate all non-SYSVOL FRS replica sets to DFS Replication. For more information, see: @@ -3271,7 +3263,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -3334,7 +3326,7 @@ This security group has not changed since Windows Server 2008.

                  Well-Known SID/RID

                  -

                  S-1-5-<root domain>-518

                  +

                  S-1-5-21-<root domain>-518

                  Type

                  @@ -3375,9 +3367,9 @@ This security group has not changed since Windows Server 2008. ### Server Operators -Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Memebers of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved. +Members in the Server Operators group can administer domain controllers. This group exists only on domain controllers. By default, the group has no members. Members of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved. -By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups, Administrators and Domain Admins, in the domain, and the Enterprise Admins group. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table. +By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups Administrators and Domain Admins in the domain, and the Enterprise Admins group in the forest root domain. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table. The Server Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). @@ -3401,7 +3393,7 @@ This security group has not changed since Windows Server 2008.

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -3449,7 +3441,7 @@ The Storage Replica Administrators group applies to versions of the Windows Serv | Attribute | Value | |-----------|-------| | Well-Known SID/RID | S-1-5-32-582 | -| Type | BuiltIn Local | +| Type | Builtin Local | | Default container | CN=BuiltIn, DC=<domain>, DC= | | Default members | None | | Default member of | None | @@ -3470,7 +3462,7 @@ The System Managed Accounts group applies to versions of the Windows Server oper | Attribute | Value | |-----------|-------| | Well-Known SID/RID | S-1-5-32-581 | -| Type | BuiltIn Local | +| Type | Builtin Local | | Default container | CN=BuiltIn, DC=<domain>, DC= | | Default members | Users | | Default member of | None | @@ -3489,8 +3481,8 @@ For more information about this security group, see [Terminal Services License S The Terminal Server License Servers group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. @@ -3514,7 +3506,7 @@ This security group only applies to Windows Server 2003 and Windows Server 200

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -3581,7 +3573,7 @@ This security group includes the following changes since Windows Server 2008:

                  Type

                  -

                  Builtin local

                  +

                  Builtin Local

                  Default container

                  @@ -3595,7 +3587,7 @@ This security group includes the following changes since Windows Server 2008:

                  Default member of

                  -

                  Domain Users (this membership is due to the fact that the Primary Group ID of all user accounts is Domain Users.)

                  +

                  None

                  Protected by ADMINSDHOLDER?

                  @@ -3624,11 +3616,10 @@ Members of this group have access to the computed token GroupsGlobalAndUniversal The Windows Authorization Access group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. - This security group has not changed since Windows Server 2008. @@ -3649,7 +3640,7 @@ This security group has not changed since Windows Server 2008. - + @@ -3704,8 +3695,8 @@ The WinRMRemoteWMIUsers\_ group applies to versions of the Windows Server operat In Windows Server 2012, the Access Denied Assistance functionality adds the Authenticated Users group to the local WinRMRemoteWMIUsers\_\_ group. Therefore, when the Access Denied Assistance functionality is enabled, all authenticated users who have Read permissions to the file share can view the file share permissions. -**Note**   -The WinRMRemoteWMIUsers\_ group allows running Windows PowerShell commands remotely whereas the [Remote Management Users](#bkmk-remotemanagementusers) group is generally used to allow users to manage servers by using the Server Manager console. +> [!NOTE] +> The WinRMRemoteWMIUsers\_ group allows running Windows PowerShell commands remotely whereas the [Remote Management Users](#bkmk-remotemanagementusers) group is generally used to allow users to manage servers by using the Server Manager console. diff --git a/windows/security/identity-protection/access-control/dynamic-access-control.md b/windows/security/identity-protection/access-control/dynamic-access-control.md index 73b4f343aa..3ad985610a 100644 --- a/windows/security/identity-protection/access-control/dynamic-access-control.md +++ b/windows/security/identity-protection/access-control/dynamic-access-control.md @@ -1,13 +1,13 @@ --- title: Dynamic Access Control Overview (Windows 10) -description: Dynamic Access Control Overview +description: Learn about Dynamic Access Control and its associated elements, which were introduced in Windows Server 2012 and Windows 8. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 65a665503d..56e4f2edf2 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,13 +1,13 @@ --- title: Local Accounts (Windows 10) -description: Local Accounts +description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -73,7 +73,7 @@ The Administrator account has full control of the files, directories, services, The default Administrator account cannot be deleted or locked out, but it can be renamed or disabled. -In Windows 10 and Windows Server 20016, Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group. Members of the Administrators groups can run apps with elevated permissions without using the **Run as Administrator** option. Fast User Switching is more secure than using Runas or different-user elevation. +In Windows 10 and Windows Server 2016, Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group. Members of the Administrators groups can run apps with elevated permissions without using the **Run as Administrator** option. Fast User Switching is more secure than using Runas or different-user elevation. **Account group membership** @@ -297,9 +297,9 @@ The following table shows the Group Policy and registry settings that are used t - - - + + + @@ -334,7 +334,7 @@ The following table shows the Group Policy and registry settings that are used t - + @@ -444,9 +444,9 @@ The following table shows the Group Policy settings that are used to deny networ - - - + + + diff --git a/windows/security/identity-protection/access-control/microsoft-accounts.md b/windows/security/identity-protection/access-control/microsoft-accounts.md index 0b346118ef..d1f2624bf6 100644 --- a/windows/security/identity-protection/access-control/microsoft-accounts.md +++ b/windows/security/identity-protection/access-control/microsoft-accounts.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index c1d0c47fdc..c8bdc813a2 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -289,6 +289,16 @@ Capability Security Identifiers (SIDs) are used to uniquely and immutably identi All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'. Any Capability SID added to Windows by first or third-party applications will be added to this location. +## Examples of registry keys taken from Windows 10, version 1909, 64-bit Enterprise edition +You may see the following registry keys under AllCachedCapabilities: + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock_Internal +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Enterprise +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_General +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Restricted +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Windows + All Capability SIDs are prefixed by S-1-15-3 ## See also diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index bc865d734c..111f5d902d 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/service-accounts.md b/windows/security/identity-protection/access-control/service-accounts.md index cd289738ae..7a95b60584 100644 --- a/windows/security/identity-protection/access-control/service-accounts.md +++ b/windows/security/identity-protection/access-control/service-accounts.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -114,5 +114,5 @@ The following table provides links to additional resources that are related to s | Content type | References | |---------------|-------------| | **Product evaluation** | [What's New for Managed Service Accounts](https://technet.microsoft.com/library/hh831451(v=ws.11).aspx)
                  [Getting Started with Group Managed Service Accounts](https://technet.microsoft.com/library/jj128431(v=ws.11).aspx) | -| **Deployment** | [Windows Server 2012: Group Managed Service Accounts - Ask Premier Field Engineering (PFE) Platforms - Site Home - TechNet Blogs](http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx) | +| **Deployment** | [Windows Server 2012: Group Managed Service Accounts - Ask Premier Field Engineering (PFE) Platforms - Site Home - TechNet Blogs](https://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx) | | **Related technologies** | [Security Principals](security-principals.md)
                  [What's new in Active Directory Domain Services](https://technet.microsoft.com/library/mt163897.aspx) | diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 978d72142a..b14254b22a 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -186,7 +186,7 @@ This group includes all domain controllers in an Active Directory forest. Domain All interactive, network, dial-up, and authenticated users are members of the Everyone group. This special identity group gives wide access to system resources. Whenever a user logs on to the network, the user is automatically added to the Everyone group. -On computers running Windows 2000 and earlier, the Everyone group included the Anonymous Logon group as a default member, but as of Windows Server 2003, the Everyone group contains only Authenticated Users and Guest; and it no longer includes Anonymous Logon by default (although this can be changed). +On computers running Windows 2000 and earlier, the Everyone group included the Anonymous Logon group as a default member, but as of Windows Server 2003, the Everyone group contains only Authenticated Users and Guest; and it no longer includes Anonymous Logon by default (although this can be changed, using Registry Editor, by going to the **Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa** key and setting the value of **everyoneincludesanonymous** DWORD to 1). Membership is controlled by the operating system. @@ -255,7 +255,7 @@ The Network Service account is similar to an Authenticated User account. The Net | Well-Known SID/RID | S-1-5-20 | |Object Class| Foreign Security Principal| |Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| -|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
                  [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
                  [Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege
                  [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
                  | +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
                  [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
                  [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
                  | ## NTLM Authentication diff --git a/windows/security/identity-protection/change-history-for-access-protection.md b/windows/security/identity-protection/change-history-for-access-protection.md index 5244518021..954dd6020d 100644 --- a/windows/security/identity-protection/change-history-for-access-protection.md +++ b/windows/security/identity-protection/change-history-for-access-protection.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index daccf69649..0dd5d09a40 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -1,6 +1,6 @@ --- title: Configure S/MIME for Windows 10 and Windows 10 Mobile (Windows 10) -description: In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. +description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, aka a certificate, can read them. ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05 ms.reviewer: keywords: encrypt, digital signature @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 870cc58a84..5a88c7b645 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -1,6 +1,6 @@ --- title: Additional mitigations -description: Scripts listed in this topic for obtaining the available issuance policies on the certificate authority for Windows Defender Credential Guard on Windows 10. +description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -16,15 +16,15 @@ ms.date: 08/17/2017 ms.reviewer: --- -## Additional mitigations +# Additional mitigations -Windows Defender Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust. +Windows Defender Credential Guard can provide mitigation against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Credential Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigation also must be deployed to make the domain environment more robust. -### Restricting domain users to specific domain-joined devices +## Restricting domain users to specific domain-joined devices Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on to multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on using devices that have Windows Defender Credential Guard enabled? By deploying authentication policies that restrict them to specific domain-joined devices that have been configured with Windows Defender Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used. -#### Kerberos armoring +### Kerberos armoring Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks. @@ -34,7 +34,7 @@ Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, - All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. - All the devices with Windows Defender Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. -#### Protecting domain-joined device secrets +### Protecting domain-joined device secrets Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Windows Defender Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices that authenticate using those certificates. This prevents shared secrets stolen from the device to be used with stolen user credentials to sign on as the user. @@ -46,7 +46,7 @@ Domain-joined device certificate authentication has the following requirements: - Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. - A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. -##### Deploying domain-joined device certificates +#### Deploying domain-joined device certificates To guarantee that certificates with the required issuance policy are only installed on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates. @@ -78,7 +78,7 @@ CertReq -EnrollCredGuardCert MachineAuthentication > [!NOTE] > You must restart the device after enrolling the machine authentication certificate.   -##### How a certificate issuance policy can be used for access control +#### How a certificate issuance policy can be used for access control Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/library/dd378897(v=ws.10).aspx) on TechNet. @@ -100,7 +100,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" ``` -#### Restricting user sign on +### Restricting user sign on So we now have completed the following: @@ -129,17 +129,17 @@ Authentication policies have the following requirements: > [!NOTE] > When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures. -##### Discovering authentication failures due to authentication policies +#### Discovering authentication failures due to authentication policies To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/library/dn486813(v=ws.11).aspx). -### Appendix: Scripts +## Appendix: Scripts Here is a list of scripts mentioned in this topic. -#### Get the available issuance policies on the certificate authority +### Get the available issuance policies on the certificate authority Save this script file as get-IssuancePolicy.ps1. @@ -330,7 +330,7 @@ write-host "There are no issuance policies which are not mapped to groups" > [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   -#### Link an issuance policy to a group +### Link an issuance policy to a group Save the script file as set-IssuancePolicyToGroupLink.ps1. diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index bb9bbc4a97..6d52746433 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,5 +1,5 @@ --- -title: Considerations when using Windows Defender Credential Guard (Windows 10) +title: Advice while using Windows Defender Credential Guard (Windows 10) description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard in Windows 10. ms.prod: w10 ms.mktglfcycl: explore @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 400ce3d5d2..4eaf65890c 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,6 +1,6 @@ --- title: How Windows Defender Credential Guard works -description: Using virtualization-based security, Windows Defender Credential Guard features a new component called the isolated LSA process, which stores and protects secrets, isolating them from the rest of the operating system, so that only privileged system software can access them. +description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index b9b11df607..52e6cf8f15 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -58,7 +58,7 @@ When Windows Defender Credential Guard is enabled on Windows 10, the Java GSS AP The following issue affects Cisco AnyConnect Secure Mobility Client: -- [Blue screen on Windows 10 computers running Windows Defender Device Guard and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* +- [Blue screen on Windows 10 computers running Hypervisor-Protected Code Integrity and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* *Registration required to access this article. @@ -91,16 +91,16 @@ See the following article on Citrix support for Secure Boot: Windows Defender Credential Guard is not supported by either these products, products versions, computer systems, or Windows 10 versions: - For Windows Defender Credential Guard on Windows 10 with McAfee Encryption products, see: - [Support for Windows Defender Device Guard and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009) + [Support for Hypervisor-Protected Code Integrity and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009) - For Windows Defender Credential Guard on Windows 10 with Check Point Endpoint Security Client, see: - [Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Windows Defender Device Guard features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912) + [Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Hypervisor-Protected Code Integrity features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912) - For Windows Defender Credential Guard on Windows 10 with VMWare Workstation [Windows 10 host fails when running VMWare Workstation when Windows Defender Credential Guard is enabled](https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361) - For Windows Defender Credential Guard on Windows 10 with specific versions of the Lenovo ThinkPad - [ThinkPad support for Windows Defender Device Guard and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039) + [ThinkPad support for Hypervisor-Protected Code Integrity and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039) - For Windows Defender Credential Guard on Windows 10 with Symantec Endpoint Protection [Windows 10 with Windows Defender Credential Guard and Symantec Endpoint Protection 12.1](https://www.symantec.com/connect/forums/windows-10-device-guard-credentials-guard-and-sep-121) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index a583960ecd..1d0b90717a 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -1,6 +1,6 @@ --- title: Manage Windows Defender Credential Guard (Windows 10) -description: Deploying and managing Windows Defender Credential Guard using Group Policy, the registry, or the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool. +description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,24 +8,26 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: v-tea manager: dansimp ms.collection: M365-identity-device-management ms.topic: article -ms.date: 03/01/2019 ms.reviewer: +ms.custom: +- CI 120967 +- CSSTroubleshooting --- # Manage Windows Defender Credential Guard **Applies to** -- Windows 10 +- Windows 10 Enterprise or Education SKUs - Windows Server 2016 - Windows Server 2019 ## Enable Windows Defender Credential Guard -Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Windows Defender Device Guard and Windows Defender Credential Guard [hardware readiness tool](#hardware-readiness-tool). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. +Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Credential Guard [hardware readiness tool](dg-readiness-tool.md). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines. @@ -34,20 +36,27 @@ The same set of procedures used to enable Windows Defender Credential Guard on p You can use Group Policy to enable Windows Defender Credential Guard. This will add and enable the virtualization-based security features for you if needed. 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. + 2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. + 3. In the **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. + 4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Windows Defender Credential Guard remotely, choose **Enabled without lock**. - ![Windows Defender Credential Guard Group Policy setting](images/credguard-gp.png) +5. In the **Secure Launch Configuration** box, choose **Not Configured**, **Enabled** or **Disabled**. Check [this article](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) for more details. -5. Close the Group Policy Management Console. + ![Windows Defender Credential Guard Group Policy setting](images/credguard-gp-2.png) + +6. Close the Group Policy Management Console. To enforce processing of the group policy, you can run ```gpupdate /force```. ### Enable Windows Defender Credential Guard by using Intune -1. From **Home** click **Microsoft Intune** -2. Click **Device configuration** +1. From **Home**, click **Microsoft Intune**. + +2. Click **Device configuration**. + 3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**. > [!NOTE] @@ -63,6 +72,7 @@ Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security. You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). + > [!NOTE] > If you enable Windows Defender Credential Guard by using Group Policy, the steps to enable Windows features through Control Panel or DISM are not required. Group Policy will install Windows features for you. @@ -70,36 +80,55 @@ You can do this by using either the Control Panel or the Deployment Image Servic **Add the virtualization-based security features by using Programs and Features** 1. Open the Programs and Features control panel. + 2. Click **Turn Windows feature on or off**. + 3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. + 4. Select the **Isolated User Mode** check box at the top level of the feature selection. + 5. Click **OK**. **Add the virtualization-based security features to an offline image by using DISM** 1. Open an elevated command prompt. + 2. Add the Hyper-V Hypervisor by running the following command: - ``` + + ```console dism /image: /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all ``` + 3. Add the Isolated User Mode feature by running the following command: - ``` + + ```console dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` + + > [!NOTE] + > In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required. -> [!NOTE] +> [!TIP] > You can also add these features to an online image by using either DISM or Configuration Manager. #### Enable virtualization-based security and Windows Defender Credential Guard 1. Open Registry Editor. + 2. Enable virtualization-based security: + - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. + - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. + - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. + 3. Enable Windows Defender Credential Guard: + - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. + - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it. + 4. Close Registry Editor. @@ -108,15 +137,17 @@ You can do this by using either the Control Panel or the Deployment Image Servic -### Enable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool +### Enable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool -You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). +You can also enable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). +```console +DG_Readiness_Tool.ps1 -Enable -AutoReboot ``` -DG_Readiness_Tool_v3.5.ps1 -Enable -AutoReboot -``` + > [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. ### Review Windows Defender Credential Guard performance @@ -126,20 +157,24 @@ DG_Readiness_Tool_v3.5.ps1 -Enable -AutoReboot You can view System Information to check that Windows Defender Credential Guard is running on a PC. 1. Click **Start**, type **msinfo32.exe**, and then click **System Information**. + 2. Click **System Summary**. -3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Configured**. + +3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Running**. Here's an example: ![System Information](images/credguard-msinfo32.png) -You can also check that Windows Defender Credential Guard is running by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). +You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). +```console +DG_Readiness_Tool_v3.6.ps1 -Ready ``` -DG_Readiness_Tool_v3.5.ps1 -Ready -``` + > [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSAch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. > [!NOTE] @@ -148,33 +183,62 @@ DG_Readiness_Tool_v3.5.ps1 -Ready - We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible. - You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: 0x1, 0 - - The first variable: 0x1 means Windows Defender Credential Guard is configured to run. 0x0 means it’s not configured to run. - - The second variable: 0 means it’s configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. - - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. - - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] - - **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] - You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. - - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. + + - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. + + - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0** + + - The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run. + + - The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**. + + - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. + + - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] + + - **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] + + You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. + + - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**. + + - You can use Windows PowerShell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated PowerShell window and run the following command: + + ```powershell + (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning + ``` + + This command generates the following output: + + - **0**: Windows Defender Credential Guard is disabled (not running) + + - **1**: Windows Defender Credential Guard is enabled (running) + + > [!NOTE] + > Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running. ## Disable Windows Defender Credential Guard To disable Windows Defender Credential Guard, you can use the following set of procedures or [the Device Guard and Credential Guard hardware readiness tool](#turn-off-with-hardware-readiness-tool). If Credential Guard was enabled with UEFI Lock then you must use the following procedure as the settings are persisted in EFI (firmware) variables and it will require physical presence at the machine to press a function key to accept the change. If Credential Guard was enabled without UEFI Lock then you can turn it off by using Group Policy. 1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). + 2. Delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags + 3. If you also wish to disable virtualization-based security delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures + > [!IMPORTANT] > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. 4. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands: - ``` syntax + ```console mountvol X: /s copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader @@ -186,42 +250,47 @@ To disable Windows Defender Credential Guard, you can use the following set of p ``` 5. Restart the PC. + 6. Accept the prompt to disable Windows Defender Credential Guard. + 7. Alternatively, you can disable the virtualization-based security features to turn off Windows Defender Credential Guard. -> [!NOTE] -> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit commands after turning off all virtualization-based security Group Policy and registry settings: - - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS - bcdedit /set vsmlaunchtype off + > [!NOTE] + > The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit commands after turning off all virtualization-based security Group Policy and registry settings: + > + >``` + >bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS + >bcdedit /set vsmlaunchtype off + >``` > [!NOTE] > Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. These options will be made available with future Gen 2 VMs. -For more info on virtualization-based security and Windows Defender Device Guard, see [Windows Defender Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). +For more info on virtualization-based security and HVCI, see [Enable virtualization-based protection of code integrity](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity +). -#### Disable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool +#### Disable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool -You can also disable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). +You can also disable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). -``` +```console DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot ``` -> [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. + +> [!IMPORTANT] +> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. #### Disable Windows Defender Credential Guard for a virtual machine From the host, you can disable Windows Defender Credential Guard for a virtual machine: -``` PowerShell +```powershell Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true ``` - - diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 582af34a67..0083c4e274 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -1,6 +1,6 @@ --- -title: Windows Defender Credential Guard protection limits (Windows 10) -description: Scenarios not protected by Windows Defender Credential Guard in Windows 10. +title: Windows Defender Credential Guard protection limits & mitigations (Windows 10) +description: Scenarios not protected by Windows Defender Credential Guard in Windows 10, and additional mitigations you can use. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index b3ceb19440..792587963f 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -1,6 +1,6 @@ --- title: Windows Defender Credential Guard protection limits (Windows 10) -description: Scenarios not protected by Windows Defender Credential Guard in Windows 10. +description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows 10. Learn more with this guide. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -22,9 +22,6 @@ ms.reviewer: - Windows 10 - Windows Server 2016 -Prefer video? See [Credentials protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) -in the Deep Dive into Windows Defender Credential Guard video series. - Some ways to store credentials are not protected by Windows Defender Credential Guard, including: - Software that manages credentials outside of Windows feature protection @@ -46,4 +43,6 @@ do not qualify as credentials because they cannot be presented to another comput **Deep Dive into Windows Defender Credential Guard: Related videos** -[Protecting privileged users with Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) +[Microsoft Cybersecurity Stack: Advanced Identity and Endpoint Protection: Manage Credential Guard](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/manage-credential-guard?u=3322) +> [!NOTE] +> - Note: Requires [LinkedIn Learning subscription](https://www.linkedin.com/learning/subscription/products) to view the full video diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 8c3d26bfae..2e56e0803c 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -1,6 +1,6 @@ --- title: Windows Defender Credential Guard Requirements (Windows 10) -description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security associated with available hardware and firmware options. +description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,33 +8,34 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article -ms.date: 01/12/2018 +ms.date: 09/30/2020 ms.reviewer: --- # Windows Defender Credential Guard: Requirements -**Applies to** -- Windows 10 -- Windows Server 2016 +## Applies to +- Windows 10 +- Windows Server 2016 -For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). - +For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements, which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to these requirements as [Application requirements](#application-requirements). Beyond these requirements, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). ## Hardware and software requirements To provide basic protections against OS level attempts to read Credential Manager domain credentials, NTLM and Kerberos derived credentials, Windows Defender Credential Guard uses: + - Support for Virtualization-based security (required) - Secure boot (required) -- TPM 1.2 or 2.0, either discrete or firmware (preferred - provides binding to hardware) +- Trusted Platform Module (TPM, preferred - provides binding to hardware) versions 1.2 and 2.0 are supported, either discrete or firmware - UEFI lock (preferred - prevents attacker from disabling with a simple registry key change) The Virtualization-based security requires: + - 64-bit CPU - CPU virtualization extensions plus extended page tables - Windows hypervisor (does not require Hyper-V Windows Feature to be installed) @@ -47,29 +48,32 @@ Credential Guard can protect secrets in a Hyper-V virtual machine, just as it wo - The Hyper-V host must have an IOMMU, and run at least Windows Server 2016 or Windows 10 version 1607. - The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and be running at least Windows Server 2016 or Windows 10. + - TPM is not a requirement, but we recommend that you implement TPM. -For information about other host platforms, see [Enabling Windows Server 2016 and Hyper-V virtualization based security features on other platforms](https://blogs.technet.microsoft.com/windowsserver/2016/09/29/enabling-windows-server-2016-and-hyper-v-virtualization-based-security-features-on-other-platforms/) +For information about other host platforms, see [Enabling Windows Server 2016 and Hyper-V virtualization based security features on other platforms](https://blogs.technet.microsoft.com/windowsserver/2016/09/29/enabling-windows-server-2016-and-hyper-v-virtualization-based-security-features-on-other-platforms/). -For information about Windows Defender Remote Credential Guard hardware and software requirements, see [Windows Defender Remote Credential Guard requirements](https://docs.microsoft.com/windows/access-protection/remote-credential-guard#hardware-and-software-requirements) +For information about Windows Defender Remote Credential Guard hardware and software requirements, see [Windows Defender Remote Credential Guard requirements](https://docs.microsoft.com/windows/access-protection/remote-credential-guard#hardware-and-software-requirements). ## Application requirements When Windows Defender Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatibility with the reduced functionality. ->[!WARNING] -> Enabling Windows Defender Credential Guard on domain controllers is not supported.
                  +> [!WARNING] +> Enabling Windows Defender Credential Guard on domain controllers is not supported. > The domain controller hosts authentication services which integrate with processes isolated when Windows Defender Credential Guard is enabled, causing crashes. ->[!NOTE] +> [!NOTE] > Windows Defender Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Windows Defender Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). Applications will break if they require: + - Kerberos DES encryption support - Kerberos unconstrained delegation - Extracting the Kerberos TGT - NTLMv1 Applications will prompt and expose credentials to risk if they require: + - Digest authentication - Credential delegation - MS-CHAPv2 @@ -78,9 +82,6 @@ Applications may cause performance issues when they attempt to hook the isolated Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard. -See this video: [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) - - ## Security considerations All computers that meet baseline protections for hardware, firmware, and software can use Windows Defender Credential Guard. @@ -88,52 +89,67 @@ Computers that meet additional qualifications can provide additional protections The following tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017. > [!NOTE] -> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers.
                  -> If you are an OEM, see [PC OEM requirements for Windows Defender Device Guard and Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
                  +> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers. +> +> If you are an OEM, see [PC OEM requirements for Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx). ### Baseline protections -|Baseline Protections | Description | Security benefits +|Baseline Protections|Description|Security benefits |---|---|---| -| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | -| Hardware: **CPU virtualization extensions**,
                  plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
                  One of the following virtualization extensions:
                  • VT-x (Intel) or
                  • AMD-V
                  And:
                  • Extended page tables, also called Second Level Address Translation (SLAT). | VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | -| Hardware: **Trusted Platform Module (TPM)** |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
                  [TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | -| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | -| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

                  Important:
                  Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only Windows Defender Device Guard is supported in this configuration.

                  |Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | +|Hardware: **64-bit CPU** |A 64-bit computer is required for the Windows hypervisor to provide VBS.| +|Hardware: **CPU virtualization extensions**, plus **extended page tables**|**Requirements**:
                  - These hardware features are required for VBS: One of the following virtualization extensions: - VT-x (Intel) or - AMD-V And: - Extended page tables, also called Second Level Address Translation (SLAT).|VBS provides isolation of secure kernel from normal operating system.

                  Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation.| +|Hardware: **Trusted Platform Module (TPM)**|**Requirement**:
                  - TPM 1.2 or TPM 2.0, either discrete or firmware. [TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations)|A TPM provides protection for VBS encryption keys that are stored in the firmware. TPM helps protect against attacks involving a physically present user with BIOS access.| +|Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot**|**Requirements**:
                  - See the following Windows Hardware Compatibility Program requirement: System.Fundamentals.Firmware.UEFISecureBoot|UEFI Secure Boot helps ensure that the device boots only authorized code, and can prevent boot kits and root kits from installing and persisting across reboots.| +|Firmware: **Secure firmware update process**|**Requirements**:
                  - UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: System.Fundamentals.Firmware.UEFISecureBoot.|UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed.| +|Software: Qualified **Windows operating system**|**Requirement**:
                  - Windows 10 or Windows Server 2016.|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard.| + +> [!IMPORTANT] +> Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. > [!IMPORTANT] > The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide. - ### 2015 Additional security qualifications starting with Windows 10, version 1507, and Windows Server 2016 Technical Preview 4 -| Protections for Improved Security | Description | -|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU **Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
                  • BIOS password or stronger authentication must be supported.
                  • In the BIOS configuration, BIOS authentication must be set.
                  • There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
                  • In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings. | -| Firmware: **Secure MOR, revision 2 implementation** | **Requirement**: Secure MOR, revision 2 implementation | - -
                  +|Protections for Improved Security|Description| +|---|---| +|Hardware: **IOMMU** (input/output memory management unit)|**Requirement**:
                  - VT-D or AMD Vi IOMMU

                  **Security benefits**:
                  - An IOMMU can enhance system resiliency against memory attacks. For more information, see [Advanced Configuration and Power Interface (ACPI) description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables)| +|Firmware: **Securing Boot Configuration and Management**|**Requirements**:
                  - BIOS password or stronger authentication must be supported.
                  - In the BIOS configuration, BIOS authentication must be set.
                  - There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
                  - In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.| +|Firmware: **Secure MOR, revision 2 implementation**|**Requirement**:
                  - Secure MOR, revision 2 implementation| ### 2016 Additional security qualifications starting with Windows 10, version 1607, and Windows Server 2016 > [!IMPORTANT] > The following tables list additional qualifications for improved security. Systems that meet these additional qualifications can provide more protections. -| Protections for Improved Security | Description |Security Benefits | +|Protections for Improved Security|Description|Security Benefits| |---|---|---| -| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
                  Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
                  • The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/library/windows/hardware/mt712332(v=vs.85).aspx). | Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
                  • HSTI provides additional security assurance for correctly secured silicon and platform. | -| Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update. | Helps ensure that firmware updates are fast, secure, and reliable. | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
                  • Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
                  • Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software. | • Enterprises can choose to allow proprietary EFI drivers/applications to run.
                  • Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. | - -
                  +|Firmware: **Hardware Rooted Trust Platform Secure Boot**|**Requirements**:
                  - Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby
                  - The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/library/windows/hardware/mt712332(v=vs.85).aspx).|Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
                  - HSTI provides additional security assurance for correctly secured silicon and platform.| +|Firmware: **Firmware Update through Windows Update**|**Requirements**:
                  - Firmware must support field updates through Windows Update and UEFI encapsulation update.|Helps ensure that firmware updates are fast, secure, and reliable.| +|Firmware: **Securing Boot Configuration and Management**|**Requirements**:
                  - Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
                  - Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.|- Enterprises can choose to allow proprietary EFI drivers/applications to run.
                  - Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots.| ### 2017 Additional security qualifications starting with Windows 10, version 1703 The following table lists qualifications for Windows 10, version 1703, which are in addition to all preceding qualifications. -| Protections for Improved Security | Description | Security Benefits +|Protections for Improved Security|Description|Security Benefits |---|---|---| -| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
                  • VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
                  • UEFI runtime service must meet these requirements:
                      - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
                      - PE sections need to be page-aligned in memory (not required for in non-volatile storage).
                      - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
                          - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
                          - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

                  Notes:
                  • This only applies to UEFI runtime service memory, and not UEFI boot service memory.
                  • This protection is applied by VBS on OS page tables.


                  Please also note the following:
                  • Do not use sections that are both writeable and executable
                  • Do not attempt to directly modify executable system memory
                  • Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
                  • Reduces the attack surface to VBS from system firmware. | -| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features. | • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
                  • Reduces the attack surface to VBS from system firmware.
                  • Blocks additional security attacks against SMM. | +|Firmware: **VBS enablement of No-Execute (NX) protection for UEFI runtime services**|**Requirements**:
                  - VBS will enable NX protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable. UEFI runtime service must meet these requirements:
                  - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
                  - PE sections must be page-aligned in memory (not required for in non-volatile storage).
                  - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
                  - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both.
                  - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.
                  (**SEE IMPORTANT INFORMATION AFTER THIS TABLE**)|Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
                  - Reduces the attack surface to VBS from system firmware.| +|Firmware: **Firmware support for SMM protection**|**Requirements**:
                  - The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an ACPI table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.|- Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
                  - Reduces the attack surface to VBS from system firmware.
                  - Blocks additional security attacks against SMM.| + +> [!IMPORTANT] +> +> Regarding **VBS enablement of NX protection for UEFI runtime services**: +> +> - This only applies to UEFI runtime service memory, and not UEFI boot service memory. +> +> - This protection is applied by VBS on OS page tables. +> +> Please also note the following: +> +> - Do not use sections that are both writeable and executable +> +> - Do not attempt to directly modify executable system memory +> +> - Do not use dynamic code diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index dae9193c68..b62a1d9818 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -1,6 +1,6 @@ --- title: Scripts for Certificate Issuance Policies in Windows Defender Credential Guard (Windows 10) -description: Scripts listed in this topic for obtaining the available issuance policies on the certificate authority for Windows Defender Credential Guard on Windows 10. +description: Obtain issuance policies from the certificate authority for Windows Defender Credential Guard on Windows 10. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index bdcdac0346..7f2c136802 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -1,6 +1,6 @@ --- title: Protect derived domain credentials with Windows Defender Credential Guard (Windows 10) -description: Introduced in Windows 10 Enterprise, Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. +description: Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 ms.reviewer: ms.prod: w10 @@ -10,7 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -29,13 +29,13 @@ By enabling Windows Defender Credential Guard, the following features and soluti - **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. -- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard and other security strategies and architectures. +- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate other security strategies and architectures.   ## Related topics - [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert) -- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) +- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) - [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert) - [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode) - [Protecting network passwords with Windows Defender Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard) diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md new file mode 100644 index 0000000000..e609c9469d --- /dev/null +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -0,0 +1,1380 @@ +--- +title: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool +description: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool script +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +author: SteveSyfuhs +ms.author: stsyfuhs +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +ms.reviewer: +--- + +# Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool + +```powershell +# Script to find out if a machine is Device Guard compliant. +# The script requires a driver verifier present on the system. + +param([switch]$Capable, [switch]$Ready, [switch]$Enable, [switch]$Disable, $SIPolicyPath, [switch]$AutoReboot, [switch]$DG, [switch]$CG, [switch]$HVCI, [switch]$HLK, [switch]$Clear, [switch]$ResetVerifier) + +$path = "C:\DGLogs\" +$LogFile = $path + "DeviceGuardCheckLog.txt" + +$CompatibleModules = New-Object System.Text.StringBuilder +$FailingModules = New-Object System.Text.StringBuilder +$FailingExecuteWriteCheck = New-Object System.Text.StringBuilder + +$DGVerifyCrit = New-Object System.Text.StringBuilder +$DGVerifyWarn = New-Object System.Text.StringBuilder +$DGVerifySuccess = New-Object System.Text.StringBuilder + + +$Sys32Path = "$env:windir\system32" +$DriverPath = "$env:windir\system32\drivers" + +#generated by certutil -encode +$SIPolicy_Encoded = "BQAAAA43RKLJRAZMtVH2AW5WMHbk9wcuTBkgTbfJb0SmxaI0BACNkAgAAAAAAAAA +HQAAAAIAAAAAAAAAAAAKAEAAAAAMAAAAAQorBgEEAYI3CgMGDAAAAAEKKwYBBAGC +NwoDBQwAAAABCisGAQQBgjc9BAEMAAAAAQorBgEEAYI3PQUBDAAAAAEKKwYBBAGC +NwoDFQwAAAABCisGAQQBgjdMAwEMAAAAAQorBgEEAYI3TAUBDAAAAAEKKwYBBAGC +N0wLAQEAAAAGAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AQAAAAYAAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA +BgAAAAEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAGAAAA +AQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAUAAAABAAAA +AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAABAAAAAEAAAABAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAGAAAAAQAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAYAAAABAAAAAgAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAABgAAAAEAAAADAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAEAAAAGAAAAAQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAQAAAAUAAAABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAABAAAADgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAEAAAAOAAAAAQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AQAAAA4AAAABAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA +DgAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAOAAAA +AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAA4AAAABAAAA +AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAADgAAAAEAAAADAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAOAAAAAQAAAAEAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAQAAAABAAAAAQAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAPye3j3MoJGGstO/m3OKIFDLGlVN +otyttV8/cu4XchN4AQAAAAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AQAAAAYAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA +DgAAAAEAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAHAAAA +AQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAoAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAKAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAQAAAAYAAAABAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAABAAAABwAAAAEAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAABAAAAFAAAAIMAAAAAAAAADIAAAAsAAAAAAAAAAAAAAAEAAAAAAAAA +AgAAAAAAAAADAAAAAAAAAAQAAAAAAAAABQAAAAAAAAALAAAAAAAAAAwAAAAAAAAA +DQAAAAAAAAAOAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAMAAAAAAAAAAyAAAASAAAABgAAAAAAAAAHAAAAAAAAAAgAAAAAAAAA +CQAAAAAAAAAKAAAAAAAAABMAAAAAAAAADwAAAAAAAAAQAAAAAAAAABEAAAAAAAAA +EgAAAAAAAAAUAAAAAAAAABUAAAAAAAAAGgAAAAAAAAAbAAAAAAAAABwAAAAAAAAA +FgAAAAAAAAAXAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAgAAABQAAABQAG8AbABpAGMAeQBJAG4AZgBvAAAAAAAWAAAA +SQBuAGYAbwByAG0AYQB0AGkAbwBuAAAAAAAAAAQAAABJAGQAAAAAAAMAAAAMAAAA +MAAzADEAMAAxADcAAAAAABQAAABQAG8AbABpAGMAeQBJAG4AZgBvAAAAAAAWAAAA +SQBuAGYAbwByAG0AYQB0AGkAbwBuAAAAAAAAAAgAAABOAGEAbQBlAAAAAAADAAAA +JgAAAEQAZQBmAGEAdQBsAHQAVwBpAG4AZABvAHcAcwBBAHUAZABpAHQAAAAAAAAA +AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAA +BQAAAAYAAAA=" + +$HSTITest_Encoded = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADxXZfstTz5v7U8+b+1PPm/2GH4vrc8+b+8RGq/ojz5v9hh+r63PPm/2GH9vr48+b+1PPi/qjz5v9hh+b60PPm/2GHwvrc8+b/YYfu+tDz5v1JpY2i1PPm/AAAAAAAAAABQRQAAZIYFAGt3EVgAAAAAAAAAAPAAIiALAg4AABIAAAAaAAAAAAAAkBsAAAAQAAAAAACAAQAAAAAQAAAAAgAACgAAAAoAAAAKAAAAAAAAAABwAAAABAAAxcwAAAMAYEEAAAQAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAEDkAAGQAAAB0OQAABAEAAAAAAAAAAAAAAFAAACABAAAAAAAAAAAAAABgAAAYAAAAwDUAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMAAA0AAAAAAAAAAAAAAA4DAAAEgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAMURAAAAEAAAABIAAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAB4DwAAADAAAAAQAAAAFgAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAwAUAAABAAAAAAgAAACYAAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAACABAAAAUAAAAAIAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAYAAAAAGAAAAACAAAAKgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIiVwkCFVWV0FWQVdIi+xIg+wwM/9IjUU4TIv5iX1ISI1NSIl9QEUzyYl9OEyNRUBIiUQkIDPS6AwJAACL2D1XAAeAD4WrAAAAi0VASGnYDCIAAP8V/yAAAI13CEyLw0iLyIvW/xX2IAAATIvwSIXAdQe7DgAHgOtxi104/xXWIAAARIvDi9ZIi8j/FdAgAABIi/BIhcB1B7sOAAeA6x5IjUU4TIvOTI1FQEiJRCQgSYvWSI1NSOiNCAAAi9j/FZUgAABNi8Yz0kiLyP8VlyAAAEiF9nQU/xV8IAAATIvGM9JIi8j/FX4gAAA5fUhAD5THQYk/i8NIi1wkYEiDxDBBX0FeX15dw8zMzMzMzMzMzOkzCAAAzMzMzMzMzEiJXCQYSIl0JCBXSIHscAEAAEiLBbsuAABIM8RIiYQkYAEAAA8QBRkhAACL8kiL+TPSSI1MJGBBuPQAAADzD39EJFDo6g4AAEiDZCQwAEiNTCRQg2QkQABFM8nHRCQogAAAALoAAABAx0QkIAMAAABFjUEB/xWSHwAASIvYSIP4/3RGQbkCAAAARTPAM9JIi8j/FX0fAACD+P90HkiDZCQgAEyNTCRARIvGSIvXSIvL/xVmHwAAhcB1Bv8VPB8AAEiLy/8VYx8AAEiLjCRgAQAASDPM6AsLAABMjZwkcAEAAEmLWyBJi3MoSYvjX8PMzMzMzMxIg+woM9JMi8lIhcl0Hrr///9/M8BEi8I4AXQJSP/BSYPoAXXzTYXAdSEz0rhXAAeAM8mFwEgPScp4C41RAUmLyejG/v//SIPEKMNJK9Dr4czMzMzMzMzMSIlcJAhIiXQkEFdIg+wgQYvZSYv4SIvy6Iv///+L00iLz+iN/v//SIvOSItcJDBIi3QkOEiDxCBf6Wr////MzMzMzMyJVCQQSIPsKAkRSI0Nsx8AAOhO////ugQAAABIjUwkOOhL/v//SI0NqB8AAOgz////SIPEKMPMzMzMzMxAVVNWV0FUQVVBVkFXSI1sJOFIgeyYAAAASIsF6CwAAEgzxEiJRQ9FM/ZIiVXnM9JIiU3vRIl1p0GL3kiJXbdJi8BIiUXXTYvpRIl1r0GL/kSJdfdFi+ZIiVX7RYv+SIlVA0yJdc9IhckPhBEFAABIhcAPhAgFAABNhckPhP8EAABBgzkBdBHHRaeAAAAAvwJAAIDp7QQAAEiNDQkfAADohP7//0WLfQREiX2/SWnfDCIAAP8Vtx0AAEyLw7oIAAAASIvI/xWuHQAATIvgSIXAdShIjQ3vHgAA6Er+////FUwdAAAPt/iBzwAAB4CFwA9O+EmL3umLBAAASI0N9x4AAOgi/v//RIl1s0WF/w+EiwIAAEmNXQhIiV3HSY20JAwCAABIjQ32HgAA6Pn9//+LQwiJhvT9//+FwHktPbsAAMB1EUiNDe4eAADo2f3//+kaAgAASI0N/R4AAOjI/f//g02nQOkFAgAAixtJA92DOwN0Gw+6bacIugEAAABIjY78/f//6Dv+///p4AEAAEyNhgD+//+6BAAAAEmLwEiNSwgPEAFIjYmAAAAADxEASI2AgAAAAA8QSZAPEUiQDxBBoA8RQKAPEEmwDxFIsA8QQcAPEUDADxBJ0A8RSNAPEEHgDxFA4A8QSfAPEUjwSIPqAXWuQbkAAgAASI0VgB4AAEiNDYEeAADodP3//4uLCAIAALoAEAAAQYv+TI0ES0iBwQwCAABMA8FIi85MK8ZIjYL+7/9/SIXAdBdBD7cECGaFwHQNZokBSIPBAkiD6gF13UiF0nUJSIPpAr96AAeAZkSJMUiNFSYeAABIjQ0nHgAAQbkAIAAATIvG6AH9//9MjXMEQYsOjUH/g/gDD4fDAAAA/0SN90iNFQMeAACJjvj9//9BuQQAAABIjQ34HQAATYvG6Mj8//9BiwaDfIX3AXZESI2O/P3//7oEAAAA6PH8//9Biw6D6QF0JYPpAXQag+kBdA+D+QEPhaIAAACDTacI63eDTacE63GDTacC62uDTacB62WD+AF1YIuDCAIAAEyNRa9BuQQAAACJRa9IjRWTHQAASI0NrB0AAOhP/P//RTP2RDl1r3UOD7ptpwlBjVYI6TX+//9IjYMMAgAASIlFz+sZD7ptpwlIjY78/f//ugIAAADoWfz//0Uz9otFs0iBxgwiAABIg0XHDP/AiUWzQTvHcxdIi13H6ZP9//+/BUAAgEiLXbfp5wEAAEQ5dad0DkiNDU0dAADoePv//+vji12v/xW1GgAARIvDuggAAABIi8j/FawaAABIiUW3SIvYSIXAdRZIjQ1JHQAA6ET7//+/FwAA0OmXAQAASI0NYx0AAOgu+///i0WvRI2wBgEAAEaNNHBEiXWzRYX/D4TFAAAASY1cJAhJjXUISI0N+xsAAOj++v//gXv4uwAAwHUOSI0N/hsAAOjp+v//63xEOXYEcxS6EAAAAA+6bacJSIvL6Gv7///rYosOSQPNi4EIAgAAO0WvdAe6CAAAAOvaRTPATI0MQUyNFAhEOUWvdjpMi3W3Qw+2jBAMAgAA99FDhIwIDAIAAHQID7ptpwmDCyBDioQIDAIAAEMIBDBB/8BEO0Wvcs5Ei3WzSIPGDEiBwwwiAABJg+8BD4VM////RIt9v0iLXbdFM/ZEOXWndBFIjQ0OHAAA6Dn6///pkQAAAEGL9kQ5da8PhoQAAABMi3W3TIttz0iNDYgcAADoE/r//4vGTI1Fq0G5AQAAAEiNFZgcAABCigwwSo0cKCILiE2rSI0NlBwAAOg/+v//QbkBAAAASI0VkhwAAEyLw0iNDZgcAADoI/r//4oDOEWrdBBIjQ2dHAAA6Lj5//+DTacg/8Y7da9yjuly+///v1cAB4BIjQ2sHAAA6Jf5//9BuQQAAABMjUWnSI0VphwAAEiNDa8cAADo0vn//02F5HRdTIt150iLdddNhfZ0NEQ5PnIvSI0NnBwAAOhX+f//QYvHSYvUTGnADCIAAEmLzuh0BwAASI0NmxwAAOg2+f//6wW/VwAHgESJPv8VbhgAAE2LxDPSSIvI/xVwGAAASIXbdBT/FVUYAABMi8Mz0kiLyP8VVxgAAEiLRe9IhcB0BYtNp4kIi8dIi00PSDPM6NMDAABIgcSYAAAAQV9BXkFdQVxfXltdw8zMzMzMzMxIi8RIiVgISIloEEiJcBhXQVZBV0iD7DCDYNgATYvxSYv4TI1I2EiL8kyL+UUzwDPSuaYAAAD/FWwYAACL2D0EAADAdAkPuusc6dkAAACDfCQgFHMKuwVAAIDpyAAAAItcJCD/FacXAABEi8O6CAAAAEiLyP8VnhcAAEiL6EiFwHUKuw4AB4DpmwAAAESLRCQgRTPJSIvQuaYAAAD/FQYYAACL2IXAeQYPuusc6zdIjQ2TGwAA6A74//+LVCQgSIvN6A73//9IjQ2LGwAA6Pb3//9Mi81Mi8dIi9ZJi8/ovfj//4vYSIt8JHCLdCQgSIX/dBk5N3IVTYX2dBBEi8ZIi9VJi87o8AUAAOsFu1cAB4CJN/8V9xYAAEyLxTPSSIvI/xX5FgAASItsJFiLw0iLXCRQSIt0JGBIg8QwQV9BXl/DzMzMzMzMSIlcJAhXSIPsIIP6AXU8SI0VmhcAAEiNDYsXAADoaAMAAIXAdAczwOmjAAAASI0VbBcAAEiNDV0XAADoVgMAAP8FKiUAAOmAAAAAhdJ1fDkVUyUAAHRtSIsNGiUAAOgxAgAASIsNFiUAAEiL+OgiAgAASI1Y+OsXSIsL6BQCAABIhcB0Bv8VBRcAAEiD6whIO99z5IM9DSUAAAR2FP8VJRYAAEyLxzPSSIvI/xUnFgAA6O4BAABIiQXDJAAASIkFtCQAAIMlpSQAAAC4AQAAAEiLXCQwSIPEIF/DzMzMzMzMzMzMzMzMzMzMzMzMzMzMSIlcJAhIiXQkEFdIg+wgSYv4i9pIi/GD+gF1BeijAQAATIvHi9NIi85Ii1wkMEiLdCQ4SIPEIF/pBwAAAMzMzMzMzMxMiUQkGIlUJBBIiUwkCFNWV0iB7JAAAACL+kiL8cdEJCABAAAAhdJ1EzkVDSQAAHULM9uJXCQg6d8AAACNQv+D+AF3MkyLhCTAAAAA6Hv+//+L2IlEJCDrFTPbiVwkIIu8JLgAAABIi7QksAAAAIXbD4SlAAAATIuEJMAAAACL10iLzujoAQAAi9iJRCQg6xUz24lcJCCLvCS4AAAASIu0JLAAAACD/wF1SIXbdURFM8Az0kiLzui1AQAA6xOLvCS4AAAASIu0JLAAAACLXCQgRTPAM9JIi87o7/3//+sTi7wkuAAAAEiLtCSwAAAAi1wkIIX/dAWD/wN1IEyLhCTAAAAAi9dIi87ov/3//4vYiUQkIOsGM9uJXCQgi8NIgcSQAAAAX15bw8zMzMzMzMzMzMxmZg8fhAAAAAAASDsN6SIAAHUQSMHBEGb3wf//dQHDSMHJEOmSAQAAzMzMzMzMSP8ltRQAAMzMzMzMzMzMzDPJSP8lmxQAAMzMzMzMzMxIiVwkIFVIi+xIg+wgSINlGABIuzKi3y2ZKwAASIsFiSIAAEg7ww+FjwAAAEiNTRj/FU4UAABIi0UYSIlFEP8VABQAAIvASDFFEP8V/BMAAIvASDFFEP8VIBQAAIvASMHgGEgxRRD/FRAUAACLwEiNTRBIM0UQSDPBSI1NIEiJRRD/FeUTAACLRSBIuf///////wAASMHgIEgzRSBIM0UQSCPBSLkzot8tmSsAAEg7w0gPRMFIiQXxIQAASItcJEhI99BIiQXqIQAASIPEIF3DzMzMzMzM/yXYEgAAzMzMzMzM/yXEEgAAzMzMzMzMzMxIg+wog/oBdQb/FTUTAAC4AQAAAEiDxCjDzMzMzMzMzMzMzMzMzMzMzMzMzMIAAMzMzMzMzMzMzEBTSIPsIEiL2TPJ/xWTEgAASIvL/xWCEgAA/xUUEwAASIvIugkEAMBIg8QgW0j/JfgSAADMzMzMzMzMzMzMzMzMzMzMSIlMJAhIgeyIAAAASI0NHSIAAP8VLxMAAEiLBQgjAABIiUQkSEUzwEiNVCRQSItMJEj/FSATAABIiUQkQEiDfCRAAHRCSMdEJDgAAAAASI1EJFhIiUQkMEiNRCRgSIlEJChIjQXHIQAASIlEJCBMi0wkQEyLRCRISItUJFAzyf8VyxIAAOsjSIsFOiIAAEiLAEiJBZAiAABIiwUpIgAASIPACEiJBR4iAABIiwV3IgAASIkF6CAAAEiLhCSQAAAASIkF6SEAAMcFvyAAAAkEAMDHBbkgAAABAAAAxwXDIAAAAwAAALgIAAAASGvAAEiNDbsgAABIxwQBAgAAALgIAAAASGvAAUiNDaMgAABIixUsIAAASIkUAbgIAAAASGvAAkiNDYggAABIixUZIAAASIkUAbgIAAAASGvAAEiLDf0fAABIiUwEaLgIAAAASGvAAUiLDfAfAABIiUwEaEiNDdwPAADoU/7//0iBxIgAAADDzMzMzMzMzMzMzMzMzMzMzMzMzMzM/yWUEAAAzMzMzMzM/yWQEAAAzMzMzMzM/yWMEAAAzMzMzMzMzMxIg+woTYtBOEiLykmL0egRAAAAuAEAAABIg8Qow8zMzMzMzMxAU0WLGEiL2kGD4/hMi8lB9gAETIvRdBNBi0AITWNQBPfYTAPRSGPITCPRSWPDSosUEEiLQxCLSAhIA0sI9kEDD3QMD7ZBA4Pg8EiYTAPITDPKSYvJW+kl/P//zMzMzMzMzMzMzMxmZg8fhAAAAAAA/+DMzMzMzMxAVUiD7CBIi+pIiU04SIsBixCJVSRIiU1AM8BIg8QgXcPMQFVIg+wgSIvqSIlNSEiLAYsQiVUoSIlNUDPASIPEIF3DzEBVSIPsIEiL6kiJTVhIiwGLEIlVLEiJTWAzwEiDxCBdw8xAVUiD7CBIi+pIiU1oSIsBixCJVTBIiU1wM8BIg8QgXcPMQFVIg+wgSIvqSIlNeEiLAYsQiVU0SImNgAAAADPASIPEIF3DzEBVSIPsIEiL6kiDxCBdw8wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBAAIABAAAA8EAAgAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAgAEAAAAAAAAAAAAAAAAAAAAAAAAAKDIAgAEAAAAwMgCAAQAAAFgyAIABAAAABQAAAAAAAAAANQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeD4AAAAAAABkPwAAAAAAAG4/AAAAAAAAAAAAAAAAAADOOwAAAAAAAMA7AAAAAAAAAAAAAAAAAAAQPQAAAAAAACw9AAAAAAAA6j4AAAAAAAAAAAAAAAAAAPo+AAAAAAAA2D4AAAAAAADMPgAAAAAAAAAAAAAAAAAACD8AAAAAAAAAAAAAAAAAAFI8AAAAAAAAFj8AAAAAAABGPAAAAAAAAAAAAAAAAAAA9DwAAAAAAAAAAAAAAAAAAJ48AAAAAAAAtDwAAAAAAABePQAAAAAAAEo9AAAAAAAAAAAAAAAAAACEPAAAAAAAAAAAAAAAAAAA5DwAAAAAAADKPAAAAAAAAAAAAAAAAAAAZDwAAAAAAAB0PAAAAAAAAAAAAAAAAAAAsD4AAAAAAAD6OwAAAAAAACg8AAAAAAAADjwAAAAAAAAAAAAAAAAAAHAeAIABAAAAACEAgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQAAAgEQAAkBsAAHAeAADAHgAAAAAAAC5caHN0aXRyYWNlLmxvZwAgUHJvdmlkZXJFcnJvcjoAOlByb3ZpZGVyRXJyb3IgAERldGVybWluaW5nIENvdW50LiAAAAAAAAAAAAAAAAAAICEhISBFcnJvciBidWZmZXIgZmFpbGVkIGFsbG9jYXRpb24gISEhIAAAAAAAAAAARGV0ZXJtaW5lIFNlY3VyaXR5RmVhdHVyZXNTaXplLiAAAAAAAAAAAExvb3AuLi4gAAAAAAAAAAAAAAAAAAAAACBVbnN1cHBvcnRlZCBBSVAgaWdub3JlZCAAAAAAAAAAICEhISBVRUZJIFByb3RvY29sIEVycm9yIERldGVjdGVkICEhISAAADpJRCAAAAAAIElEOgAAAAA6RVJST1IgACBFUlJPUjoAOlJPTEUgAAAgUk9MRToAAAAAAAAAAAAAOnNlY3VyaXR5RmVhdHVyZXNTaXplIAAAAAAAAAAAAAAgc2VjdXJpdHlGZWF0dXJlc1NpemU6AAAAAAAAAAAAACAhISEgRXJyb3IgZGV0ZWN0ZWQsIGJhaWxpbmcgb3V0ICEhISAAAAAAAAAAAAAAAFZlcmlmaWVkIGJ1ZmZlciBhbGxvY2F0aW9uIGZhaWxlZC4AAAAAAAAAAAAAAAAAAExvb3Bpbmcgb24gcHJvdmlkZXJzIHRvIGFjY3VtdWxhdGUgaW1wbGVtZW50ZWQgYW5kIHZlcmlmaWVkLgAAAABDb21wYXJpbmcgcmVxdWlyZWQgYnl0ZSB0byB2ZXJpZmllZC4uLgAAOlZFUklGSUVEIAAAAAAAACBWRVJJRklFRDoAAAAAAAA6UkVRVUlSRUQgAAAAAAAAIFJFUVVJUkVEOgAAAAAAAAAAAAAAAAAAISEhIHZlcmlmaWVkIGJ5dGUgZG9lcyBub3QgbWF0Y2ggcmVxdWlyZWQgISEhAAAAQ0xFQU5VUCAAAAAAAAAAADpPVkVSQUxMAAAAAAAAAABPVkVSQUxMOgAAAAAAAAAAUHJvdmlkZXIgRXJyb3JzIGNvcHkgc3RhcnQAAAAAAABQcm92aWRlciBFcnJvcnMgY29weSBlbmQAAAAAAAAAAEJMT0IgU3RhcnQ6AAAAAAA6QkxPQiBFbmQgIAAAAAAAAAAAAGt3EVgAAAAAAgAAACUAAAD4NQAA+BsAAAAAAABrdxFYAAAAAA0AAACgAQAAIDYAACAcAABSU0RT1J4Ttoijw0G4zY0uYG3g7wEAAABIc3RpVGVzdC5wZGIAAAAAR0NUTAAQAADwEAAALnRleHQkbW4AAAAA8CAAABIAAAAudGV4dCRtbiQwMAACIQAAwwAAAC50ZXh0JHgAADAAAOAAAAAucmRhdGEkYnJjAADgMAAASAEAAC5pZGF0YSQ1AAAAACgyAAAQAAAALjAwY2ZnAAA4MgAACAAAAC5DUlQkWENBAAAAAEAyAAAIAAAALkNSVCRYQ1oAAAAASDIAAAgAAAAuQ1JUJFhJQQAAAABQMgAACAAAAC5DUlQkWElaAAAAAFgyAAAYAAAALmNmZ3VhcmQAAAAAcDIAAIgDAAAucmRhdGEAAPg1AADIAQAALnJkYXRhJHp6emRiZwAAAMA3AABQAQAALnhkYXRhAAAQOQAAZAAAAC5lZGF0YQAAdDkAAPAAAAAuaWRhdGEkMgAAAABkOgAAFAAAAC5pZGF0YSQzAAAAAHg6AABIAQAALmlkYXRhJDQAAAAAwDsAALgDAAAuaWRhdGEkNgAAAAAAQAAAEAAAAC5kYXRhAAAAEEAAALAFAAAuYnNzAAAAAABQAAAgAQAALnBkYXRhAAABEwgAEzQMABNSDPAK4AhwB2AGUBkkBwASZDMAEjQyABIBLgALcAAAbCAAAGABAAABBAEABEIAAAEPBgAPZAcADzQGAA8yC3ABCAEACEIAABknCgAZARMADfAL4AnQB8AFcARgAzACUGwgAACIAAAAARgKABhkDAAYVAsAGDQKABhSFPAS4BBwGRgFABgBEgARcBBgDzAAAEYgAAAGAAAAGBwAAC0cAAAIIQAALRwAAEocAABkHAAAKiEAAGQcAACCHAAAkRwAAEwhAACRHAAApBwAALMcAABuIQAAsxwAAM8cAADpHAAAkCEAAOkcAAD5GwAA7xwAALUhAAAAAAAAAQYCAAYyAlABCgQACjQGAAoyBnAAAAAAAQAAAAENBAANNAkADTIGUAEGAgAGMgIwAQwCAAwBEQABAAAAAQIBAAIwAAAAAAAAAAAAAAAAAAAAAAAAd24RWAAAAABMOQAAAQAAAAIAAAACAAAAODkAAEA5AABIOQAAEBAAACARAABZOQAAYzkAAAAAAQBIU1RJVEVTVC5kbGwAUXVlcnlIU1RJAFF1ZXJ5SFNUSWRldGFpbHMAmDoAAAAAAAAAAAAA2jsAAAAxAACYOwAAAAAAAAAAAAA8PAAAADIAAAA7AAAAAAAAAAAAAHI9AABoMQAAgDsAAAAAAAAAAAAAkj0AAOgxAABYOwAAAAAAAAAAAACyPQAAwDEAADA7AAAAAAAAAAAAANY9AACYMQAAaDsAAAAAAAAAAAAAAD4AANAxAAAgOwAAAAAAAAAAAAAkPgAAiDEAALA6AAAAAAAAAAAAAE4+AAAYMQAAeDoAAAAAAAAAAAAAkD4AAOAwAADQOgAAAAAAAAAAAAAiPwAAODEAAPA6AAAAAAAAAAAAAEI/AABYMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4PgAAAAAAAGQ/AAAAAAAAbj8AAAAAAAAAAAAAAAAAAM47AAAAAAAAwDsAAAAAAAAAAAAAAAAAABA9AAAAAAAALD0AAAAAAADqPgAAAAAAAAAAAAAAAAAA+j4AAAAAAADYPgAAAAAAAMw+AAAAAAAAAAAAAAAAAAAIPwAAAAAAAAAAAAAAAAAAUjwAAAAAAAAWPwAAAAAAAEY8AAAAAAAAAAAAAAAAAAD0PAAAAAAAAAAAAAAAAAAAnjwAAAAAAAC0PAAAAAAAAF49AAAAAAAASj0AAAAAAAAAAAAAAAAAAIQ8AAAAAAAAAAAAAAAAAADkPAAAAAAAAMo8AAAAAAAAAAAAAAAAAABkPAAAAAAAAHQ8AAAAAAAAAAAAAAAAAACwPgAAAAAAAPo7AAAAAAAAKDwAAAAAAAAOPAAAAAAAAAAAAAAAAAAABwBfaW5pdHRlcm1fZQAGAF9pbml0dGVybQBhcGktbXMtd2luLWNvcmUtY3J0LWwyLTEtMC5kbGwAANACUnRsQ2FwdHVyZUNvbnRleHQAjQRSdGxMb29rdXBGdW5jdGlvbkVudHJ5AAC3BVJ0bFZpcnR1YWxVbndpbmQAAG50ZGxsLmRsbAAGAEhlYXBGcmVlAAAAAEdldFByb2Nlc3NIZWFwAAAEAEVuY29kZVBvaW50ZXIAAQBEZWNvZGVQb2ludGVyAAAAUXVlcnlQZXJmb3JtYW5jZUNvdW50ZXIADQBHZXRDdXJyZW50UHJvY2Vzc0lkABEAR2V0Q3VycmVudFRocmVhZElkAAAUAEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lABgAR2V0VGlja0NvdW50AAABAERpc2FibGVUaHJlYWRMaWJyYXJ5Q2FsbHMAEQBVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAAA8AU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAAwAR2V0Q3VycmVudFByb2Nlc3MATQBUZXJtaW5hdGVQcm9jZXNzAABhcGktbXMtd2luLWNvcmUtaGVhcC1sMS0yLTAuZGxsAGFwaS1tcy13aW4tY29yZS11dGlsLWwxLTEtMC5kbGwAYXBpLW1zLXdpbi1jb3JlLXByb2ZpbGUtbDEtMS0wLmRsbAAAYXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMi5kbGwAYXBpLW1zLXdpbi1jb3JlLXN5c2luZm8tbDEtMi0xLmRsbAAAYXBpLW1zLXdpbi1jb3JlLWxpYnJhcnlsb2FkZXItbDEtMi0wLmRsbAAAYXBpLW1zLXdpbi1jb3JlLWVycm9yaGFuZGxpbmctbDEtMS0xLmRsbAAAAABfX0Nfc3BlY2lmaWNfaGFuZGxlcgAAYXBpLW1zLXdpbi1jb3JlLWNydC1sMS0xLTAuZGxsAADbAU50UXVlcnlTeXN0ZW1JbmZvcm1hdGlvbgAAWQBXcml0ZUZpbGUAUwBTZXRGaWxlUG9pbnRlcgAABQBHZXRMYXN0RXJyb3IAAAUAQ3JlYXRlRmlsZUEAAABDbG9zZUhhbmRsZQACAEhlYXBBbGxvYwBhcGktbXMtd2luLWNvcmUtZmlsZS1sMS0yLTEuZGxsAGFwaS1tcy13aW4tY29yZS1oYW5kbGUtbDEtMS0wLmRsbAAzAG1lbWNweQAANwBtZW1zZXQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyot8tmSsAAM1dINJm1P//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQAAAXEQAAwDcAACwRAAAaEgAA1DcAACASAABwEgAA8DcAAHgSAAC2EgAA+DcAALwSAADyEgAACDgAAPgSAABRGQAAEDgAAFgZAACaGgAAMDgAAKAaAAB7GwAAyDgAAJAbAADNGwAA+DcAANQbAAD8HAAASDgAABAdAAAuHQAA2DgAAFQdAAAkHgAA3DgAAEQeAABdHgAA8DcAAHweAACwHgAA6DgAAMAeAAAxIAAA8DgAAGwgAACJIAAA8DcAAJAgAADrIAAA/DgAAAAhAAACIQAA+DgAAAghAAAqIQAAwDgAACohAABMIQAAwDgAAEwhAABuIQAAwDgAAG4hAACQIQAAwDgAAJAhAAC1IQAAwDgAALUhAADFIQAAwDgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAABgAAAAAoAigaKCAoIigkKAoojCiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" + +function Log($message) +{ + $message | Out-File $LogFile -Append -Force +} + +function LogAndConsole($message) +{ + Write-Host $message + Log $message +} + +function LogAndConsoleWarning($message) +{ + Write-Host $message -foregroundcolor "Yellow" + Log $message +} + +function LogAndConsoleSuccess($message) +{ + Write-Host $message -foregroundcolor "Green" + Log $message +} + +function LogAndConsoleError($message) +{ + Write-Host $message -foregroundcolor "Red" + Log $message +} + +function IsExempted([System.IO.FileInfo] $item) +{ + $cert = (Get-AuthenticodeSignature $item.FullName).SignerCertificate + if($cert.ToString().Contains("CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US")) + { + Log $item.FullName + "MS Exempted" + return 1 + } + else + { + Log $item.FullName + "Not-exempted" + Log $cert.ToString() + return 0 + } +} + +function CheckExemption($_ModName) +{ + $mod1 = Get-ChildItem $Sys32Path $_ModName + $mod2 = Get-ChildItem $DriverPath $_ModName + if($mod1) + { + Log "NonDriver module" + $mod1.FullName + return IsExempted($mod1) + } + elseif($mod2) + { + Log "Driver Module" + $mod2.FullName + return IsExempted($mod2) + } + +} + +function CheckFailedDriver($_ModName, $CIStats) +{ + Log "Module: " $_ModName.Trim() + if(CheckExemption($_ModName.Trim()) - eq 1) + { + $CompatibleModules.AppendLine("Windows Signed: " + $_ModName.Trim()) | Out-Null + return + } + $index = $CIStats.IndexOf("execute pool type count:".ToLower()) + if($index -eq -1) + { + return + } + $_tempStr = $CIStats.Substring($index) + $Result = "PASS" + $separator = "`r`n","" + $option = [System.StringSplitOptions]::RemoveEmptyEntries + $stats = $_tempStr.Split($separator,$option) + Log $stats.Count + + $FailingStat = "" + foreach( $stat in $stats) + { + $_t =$stat.Split(":") + if($_t.Count -eq 2 -and $_t[1].trim() -ne "0") + { + $Result = "FAIL" + $FailingStat = $stat + break + } + } + if($Result.Contains("PASS")) + { + $CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null + } + elseif($FailingStat.Trim().Contains("execute-write")) + { + $FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null + } + else + { + $FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null + } + Log "Result: " $Result +} + +function ListCIStats($_ModName, $str1) +{ + $i1 = $str1.IndexOf("Code Integrity Statistics:".ToLower()) + if($i1 -eq -1 ) + { + Log "String := " $str1 + Log "Warning! CI Stats are missing for " $_ModName + return + } + $temp_str1 = $str1.Substring($i1) + $CIStats = $temp_str1.Substring(0).Trim() + + CheckFailedDriver $_ModName $CIStats +} + +function ListDrivers($str) +{ + $_tempStr= $str + + $separator = "module:","" + $option = [System.StringSplitOptions]::RemoveEmptyEntries + $index1 = $_tempStr.IndexOf("MODULE:".ToLower()) + if($index1 -lt 0) + { + return + } + $_tempStr = $_tempStr.Substring($Index1) + $_SplitStr = $_tempStr.Split($separator,$option) + + + Log $_SplitStr.Count + LogAndConsole "Verifying each module please wait ... " + foreach($ModuleDetail in $_Splitstr) + { + #LogAndConsole $Module + $Index2 = $ModuleDetail.IndexOf("(") + if($Index2 -eq -1) + { + "Skipping .." + continue + } + $ModName = $ModuleDetail.Substring(0,$Index2-1) + Log "Driver: " $ModName + Log "Processing module: " $ModName + ListCIStats $ModName $ModuleDetail + } + + $DriverScanCompletedMessage = "Completed scan. List of Compatible Modules can be found at " + $LogFile + LogAndConsole $DriverScanCompletedMessage + + if($FailingModules.Length -gt 0 -or $FailingExecuteWriteCheck.Length -gt 0 ) + { + $WarningMessage = "Incompatible HVCI Kernel Driver Modules found" + if($HLK) + { + LogAndConsoleError $WarningMessage + } + else + { + LogAndConsoleWarning $WarningMessage + } + + LogAndConsoleError $FailingExecuteWriteCheck.ToString() + if($HLK) + { + LogAndConsoleError $FailingModules.ToString() + } + else + { + LogAndConsoleWarning $FailingModules.ToString() + } + if($FailingModules.Length -ne 0 -or $FailingExecuteWriteCheck.Length -ne 0 ) + { + if($HLK) + { + $DGVerifyCrit.AppendLine($WarningMessage) | Out-Null + } + else + { + $DGVerifyWarn.AppendLine($WarningMessage) | Out-Null + } + } + } + else + { + LogAndConsoleSuccess "No Incompatible Drivers found" + } +} + +function ListSummary() +{ + if($DGVerifyCrit.Length -ne 0 ) + { + LogAndConsoleError "Machine is not Device Guard / Credential Guard compatible because of the following:" + LogAndConsoleError $DGVerifyCrit.ToString() + LogAndConsoleWarning $DGVerifyWarn.ToString() + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 0 /f ' + } + if(!$CG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Capable" /t REG_DWORD /d 0 /f ' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HVCI_Capable" /t REG_DWORD /d 0 /f ' + } + + } + elseif ($DGVerifyWarn.Length -ne 0 ) + { + LogAndConsoleSuccess "Device Guard / Credential Guard can be enabled on this machine.`n" + LogAndConsoleWarning "The following additional qualifications, if present, can enhance the security of Device Guard / Credential Guard on this system:" + LogAndConsoleWarning $DGVerifyWarn.ToString() + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 1 /f ' + } + if(!$CG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Capable" /t REG_DWORD /d 1 /f ' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HVCI_Capable" /t REG_DWORD /d 1 /f ' + } + } + else + { + LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n" + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 2 /f ' + } + if(!$CG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Capable" /t REG_DWORD /d 2 /f ' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HVCI_Capable" /t REG_DWORD /d 2 /f ' + } + } +} + + +function Instantiate-Kernel32 { + try + { + Add-Type -TypeDefinition @" + using System; + using System.Diagnostics; + using System.Runtime.InteropServices; + + public static class Kernel32 + { + [DllImport("kernel32", SetLastError=true, CharSet = CharSet.Ansi)] + public static extern IntPtr LoadLibrary( + [MarshalAs(UnmanagedType.LPStr)]string lpFileName); + + [DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)] + public static extern IntPtr GetProcAddress( + IntPtr hModule, + string procName); + } + +"@ + } + catch + { + Log $_.Exception.Message + LogAndConsole "Instantiate-Kernel32 failed" + } +} + +function Instantiate-HSTI { + try + { + Add-Type -TypeDefinition @" + using System; + using System.Diagnostics; + using System.Runtime.InteropServices; + using System.Net; + + public static class HstiTest3 + { + [DllImport("hstitest.dll", CharSet = CharSet.Unicode)] + public static extern int QueryHSTIdetails( + ref HstiOverallError pHstiOverallError, + [In, Out] HstiProviderErrorDuple[] pHstiProviderErrors, + ref uint pHstiProviderErrorsCount, + byte[] hstiPlatformSecurityBlob, + ref uint pHstiPlatformSecurityBlobBytes); + + [DllImport("hstitest.dll", CharSet = CharSet.Unicode)] + public static extern int QueryHSTI(ref bool Pass); + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] + public struct HstiProviderErrorDuple + { + internal uint protocolError; + internal uint role; + internal HstiProviderErrors providerError; + [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] + internal string ID; + [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 4096)] + internal string ErrorString; + } + + [FlagsAttribute] + public enum HstiProviderErrors : int + { + None = 0x00000000, + VersionMismatch = 0x00000001, + RoleUnknown = 0x00000002, + RoleDuplicated = 0x00000004, + SecurityFeatureSizeMismatch = 0x00000008, + SizeTooSmall = 0x00000010, + VerifiedMoreThanImplemented = 0x00000020, + VerifiedNotMatchImplemented = 0x00000040 + } + + [FlagsAttribute] + public enum HstiOverallError : int + { + None = 0x00000000, + RoleTooManyPlatformReference = 0x00000001, + RoleTooManyIbv = 0x00000002, + RoleTooManyOem = 0x00000004, + RoleTooManyOdm = 0x00000008, + RoleMissingPlatformReference = 0x00000010, + VerifiedIncomplete = 0x00000020, + ProtocolErrors = 0x00000040, + BlobVersionMismatch = 0x00000080, + PlatformSecurityVersionMismatch = 0x00000100, + ProviderError = 0x00000200 + } + + } +"@ + + $LibHandle = [Kernel32]::LoadLibrary("C:\Windows\System32\hstitest.dll") + $FuncHandle = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTIdetails") + $FuncHandle2 = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTI") + + if ([System.IntPtr]::Size -eq 8) + { + #assuming 64 bit + Log "`nKernel32::LoadLibrary 64bit --> 0x$("{0:X16}" -f $LibHandle.ToInt64())" + Log "HstiTest2::QueryHSTIdetails 64bit --> 0x$("{0:X16}" -f $FuncHandle.ToInt64())" + } + else + { + return + } + $overallError = New-Object HstiTest3+HstiOverallError + $providerErrorDupleCount = New-Object int + $blobByteSize = New-Object int + $hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $null, [ref] $providerErrorDupleCount, $null, [ref] $blobByteSize) + + [byte[]]$blob = New-Object byte[] $blobByteSize + [HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount + $hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $providerErrors, [ref] $providerErrorDupleCount, $blob, [ref] $blobByteSize) + $string = $null + $blob | foreach { $string = $string + $_.ToString("X2")+"," } + + $hstiStatus = New-Object bool + $hr = [HstiTest3]::QueryHSTI([ref] $hstiStatus) + + LogAndConsole "HSTI Duple Count: $providerErrorDupleCount" + LogAndConsole "HSTI Blob size: $blobByteSize" + LogAndConsole "String: $string" + LogAndConsole "HSTIStatus: $hstiStatus" + if(($blobByteSize -gt 512) -and ($providerErrorDupleCount -gt 0) -and $hstiStatus) + { + LogAndConsoleSuccess "HSTI validation successful" + } + elseif(($providerErrorDupleCount -eq 0) -or ($blobByteSize -le 512)) + { + LogAndConsoleWarning "HSTI is absent" + $DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null + } + else + { + $ErrorMessage = "HSTI validation failed" + if($HLK) + { + LogAndConsoleError $ErrorMessage + $DGVerifyCrit.AppendLine($ErrorMessage) | Out-Null + } + else + { + LogAndConsoleWarning $ErrorMessage + $DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null + } + } + + } + catch + { + LogAndConsoleError $_.Exception.Message + LogAndConsoleError "Instantiate-HSTI failed" + } +} + + +function CheckDGRunning($_val) +{ + $DGObj = Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard + for($i=0; $i -lt $DGObj.SecurityServicesRunning.length; $i++) + { + if($DGObj.SecurityServicesRunning[$i] -eq $_val) + { + return 1 + } + + } + return 0 +} + +function CheckDGFeatures($_val) +{ + $DGObj = Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard + Log "DG_obj $DG_obj" + Log "DG_obj.AvailableSecurityProperties.length $DG_obj.AvailableSecurityProperties.length" + for($i=0; $i -lt $DGObj.AvailableSecurityProperties.length; $i++) + { + if($DGObj.AvailableSecurityProperties[$i] -eq $_val) + { + return 1 + } + + } + return 0 +} + +function PrintConfigCIDetails($_ConfigCIState) +{ + $_ConfigCIRunning = "Config-CI is enabled and running." + $_ConfigCIDisabled = "Config-CI is not running." + $_ConfigCIMode = "Not Enabled" + switch ($_ConfigCIState) + { + 0 { $_ConfigCIMode = "Not Enabled" } + 1 { $_ConfigCIMode = "Audit mode" } + 2 { $_ConfigCIMode = "Enforced mode" } + default { $_ConfigCIMode = "Not Enabled" } + } + + if($_ConfigCIState -ge 1) + { + LogAndConsoleSuccess "$_ConfigCIRunning ($_ConfigCIMode)" + } + else + { + LogAndConsoleWarning "$_ConfigCIDisabled ($_ConfigCIMode)" + } +} + +function PrintHVCIDetails($_HVCIState) +{ + $_HvciRunning = "HVCI is enabled and running." + $_HvciDisabled = "HVCI is not running." + + if($_HVCIState) + { + LogAndConsoleSuccess $_HvciRunning + } + else + { + LogAndConsoleWarning $_HvciDisabled + } +} + +function PrintCGDetails ($_CGState) +{ + $_CGRunning = "Credential-Guard is enabled and running." + $_CGDisabled = "Credential-Guard is not running." + + if($_CGState) + { + LogAndConsoleSuccess $_CGRunning + } + else + { + LogAndConsoleWarning $_CGDisabled + } +} + +if(![IO.Directory]::Exists($path)) +{ + New-Item -ItemType directory -Path $path +} +else +{ + #Do Nothing!! +} + +function IsRedstone +{ + $_osVersion = [environment]::OSVersion.Version + Log $_osVersion + #Check if build Major is Windows 10 + if($_osVersion.Major -lt 10) + { + return 0 + } + #Check if the build is post Threshold2 (1511 release) => Redstone + if($_osVersion.Build -gt 10586) + { + return 1 + } + #default return False + return 0 +} + +function ExecuteCommandAndLog($_cmd) +{ + try + { + Log "Executing: $_cmd" + $CmdOutput = Invoke-Expression $_cmd | Out-String + Log "Output: $CmdOutput" + } + catch + { + Log "Exception while exectuing $_cmd" + Log $_.Exception.Message + } + + +} + +function PrintRebootWarning +{ + LogAndConsoleWarning "Please reboot the machine, for settings to be applied." +} + +function AutoRebootHelper +{ + if($AutoReboot) + { + LogAndConsole "PC will restart in 30 seconds" + ExecuteCommandAndLog 'shutdown /r /t 30' + } + else + { + PrintRebootWarning + } + +} + +function VerifierReset +{ + $verifier_state = verifier /query | Out-String + if(!$verifier_state.ToString().Contains("No drivers are currently verified.")) + { + ExecuteCommandAndLog 'verifier.exe /reset' + } + AutoRebootHelper +} + +function PrintHardwareReq +{ + LogAndConsole "###########################################################################" + LogAndConsole "OS and Hardware requirements for enabling Device Guard and Credential Guard" + LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education and Enterprise IoT" + LogAndConsole " 2. Hardware: Recent hardware that supports virtualization extension with SLAT" + LogAndConsole "To learn more please visit: https://aka.ms/dgwhcr" + LogAndConsole "########################################################################### `n" +} + +function CheckDriverCompat +{ + $_HVCIState = CheckDGRunning(2) + if($_HVCIState) + { + LogAndConsoleWarning "HVCI is already enabled on this machine, driver compat list might not be complete." + LogAndConsoleWarning "Please disable HVCI and run the script again..." + } + $verifier_state = verifier /query | Out-String + if($verifier_state.ToString().Contains("No drivers are currently verified.")) + { + LogAndConsole "Enabling Driver verifier" + verifier.exe /flags 0x02000000 /all /log.code_integrity + + LogAndConsole "Enabling Driver Verifier and Rebooting system" + Log $verifier_state + LogAndConsole "Please re-execute this script after reboot...." + if($AutoReboot) + { + LogAndConsole "PC will restart in 30 seconds" + ExecuteCommandAndLog 'shutdown /r /t 30' + } + else + { + LogAndConsole "Please reboot manually and run the script again...." + } + exit + } + else + { + LogAndConsole "Driver verifier already enabled" + Log $verifier_state + ListDrivers($verifier_state.Trim().ToLowerInvariant()) + } +} +function IsDomainController +{ + $_isDC = 0 + $CompConfig = Get-WmiObject Win32_ComputerSystem + foreach ($ObjItem in $CompConfig) + { + $Role = $ObjItem.DomainRole + Log "Role=$Role" + Switch ($Role) + { + 0 { Log "Standalone Workstation" } + 1 { Log "Member Workstation" } + 2 { Log "Standalone Server" } + 3 { Log "Member Server" } + 4 + { + Log "Backup Domain Controller" + $_isDC=1 + break + } + 5 + { + Log "Primary Domain Controller" + $_isDC=1 + break + } + default { Log "Unknown Domain Role" } + } + } + return $_isDC +} + +function CheckOSSKU +{ + $osname = $((gwmi win32_operatingsystem).Name).ToLower() + $_SKUSupported = 0 + Log "OSNAME:$osname" + $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server") + $HLKAllowed = @("microsoft windows 10 pro") + foreach ($SKUent in $SKUarray) + { + if($osname.ToString().Contains($SKUent.ToLower())) + { + $_SKUSupported = 1 + break + } + } + + # For running HLK tests only, professional SKU's are marked as supported. + if($HLK) + { + if($osname.ToString().Contains($HLKAllowed.ToLower())) + { + $_SKUSupported = 1 + } + } + $_isDomainController = IsDomainController + if($_SKUSupported) + { + LogAndConsoleSuccess "This PC edition is Supported for DeviceGuard"; + if(($_isDomainController -eq 1) -and !$HVCI -and !$DG) + { + LogAndConsoleError "This PC is configured as a Domain Controller, Credential Guard is not supported on DC." + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleError "This PC edition is Unsupported for Device Guard" + $DGVerifyCrit.AppendLine("OS SKU unsupported") | Out-Null + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 0 /f ' + } +} + +function CheckOSArchitecture +{ + $OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower() + Log $OSArch + if($OSArch -match ("^64\-?\s?bit")) + { + LogAndConsoleSuccess "64 bit architecture" + } + elseif($OSArch -match ("^32\-?\s?bit")) + { + LogAndConsoleError "32 bit architecture" + $DGVerifyCrit.AppendLine("32 Bit OS, OS Architecture failure.") | Out-Null + } + else + { + LogAndConsoleError "Unknown architecture" + $DGVerifyCrit.AppendLine("Unknown OS, OS Architecture failure.") | Out-Null + } +} + +function CheckSecureBootState +{ + $_secureBoot = Confirm-SecureBootUEFI + Log $_secureBoot + if($_secureBoot) + { + LogAndConsoleSuccess "Secure Boot is present" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureBoot" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleError "Secure Boot is absent / not enabled." + LogAndConsoleError "If Secure Boot is supported on the system, enable Secure Boot in the BIOS and run the script again." + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureBoot" /t REG_DWORD /d 0 /f ' + $DGVerifyCrit.AppendLine("Secure boot validation failed.") | Out-Null + } +} + +function CheckVirtualization +{ + $_vmmExtension = $(gwmi -Class Win32_processor).VMMonitorModeExtensions + $_vmFirmwareExtension = $(gwmi -Class Win32_processor).VirtualizationFirmwareEnabled + $_vmHyperVPresent = (gcim -Class Win32_ComputerSystem).HypervisorPresent + Log "VMMonitorModeExtensions $_vmmExtension" + Log "VirtualizationFirmwareEnabled $_vmFirmwareExtension" + Log "HyperVisorPresent $_vmHyperVPresent" + + #success if either processor supports and enabled or if hyper-v is present + if(($_vmmExtension -and $_vmFirmwareExtension) -or $_vmHyperVPresent ) + { + LogAndConsoleSuccess "Virtualization firmware check passed" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "Virtualization" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleError "Virtualization firmware check failed." + LogAndConsoleError "If Virtualization extensions are supported on the system, enable hardware virtualization (Intel Virtualization Technology, Intel VT-x, Virtualization Extensions, or similar) in the BIOS and run the script again." + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "Virtualization" /t REG_DWORD /d 0 /f ' + $DGVerifyCrit.AppendLine("Virtualization firmware check failed.") | Out-Null + } +} + +function CheckTPM +{ + $TPMLockout = $(get-tpm).LockoutCount + + if($TPMLockout) + { + + if($TPMLockout.ToString().Contains("Not Supported for TPM 1.2")) + { + if($HLK) + { + LogAndConsoleSuccess "TPM 1.2 is present." + } + else + { + $WarningMsg = "TPM 1.2 is Present. TPM 2.0 is Preferred." + LogAndConsoleWarning $WarningMsg + $DGVerifyWarn.AppendLine($WarningMsg) | Out-Null + } + } + else + { + LogAndConsoleSuccess "TPM 2.0 is present." + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "TPM" /t REG_DWORD /d 2 /f ' + } + else + { + $WarningMsg = "TPM is absent or not ready for use" + if($HLK) + { + LogAndConsoleError $WarningMsg + $DGVerifyCrit.AppendLine($WarningMsg) | Out-Null + } + else + { + LogAndConsoleWarning $WarningMsg + $DGVerifyWarn.AppendLine($WarningMsg) | Out-Null + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "TPM" /t REG_DWORD /d 0 /f ' + } +} + +function CheckSecureMOR +{ + $isSecureMOR = CheckDGFeatures(4) + Log "isSecureMOR= $isSecureMOR " + if($isSecureMOR -eq 1) + { + LogAndConsoleSuccess "Secure MOR is available" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureMOR" /t REG_DWORD /d 2 /f ' + } + else + { + $WarningMsg = "Secure MOR is absent" + if($HLK) + { + LogAndConsoleError $WarningMsg + $DGVerifyCrit.AppendLine($WarningMsg) | Out-Null + } + else + { + LogAndConsoleWarning $WarningMsg + $DGVerifyWarn.AppendLine($WarningMsg) | Out-Null + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureMOR" /t REG_DWORD /d 0 /f ' + } +} + +function CheckNXProtection +{ + $isNXProtected = CheckDGFeatures(5) + Log "isNXProtected= $isNXProtected " + if($isNXProtected -eq 1) + { + LogAndConsoleSuccess "NX Protector is available" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "UEFINX" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleWarning "NX Protector is absent" + $DGVerifyWarn.AppendLine("NX Protector is absent") | Out-Null + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "UEFINX" /t REG_DWORD /d 0 /f ' + } +} + +function CheckSMMProtection +{ + $isSMMMitigated = CheckDGFeatures(6) + Log "isSMMMitigated= $isSMMMitigated " + if($isSMMMitigated -eq 1) + { + LogAndConsoleSuccess "SMM Mitigation is available" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SMMProtections" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleWarning "SMM Mitigation is absent" + $DGVerifyWarn.AppendLine("SMM Mitigation is absent") | Out-Null + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SMMProtections" /t REG_DWORD /d 0 /f ' + } +} + +function CheckHSTI +{ + LogAndConsole "Copying HSTITest.dll" + try + { + $HSTITest_Decoded = [System.Convert]::FromBase64String($HSTITest_Encoded) + [System.IO.File]::WriteAllBytes("$env:windir\System32\hstitest.dll",$HSTITest_Decoded) + + } + catch + { + LogAndConsole $_.Exception.Message + LogAndConsole "Copying and loading HSTITest.dll failed" + } + + Instantiate-Kernel32 + Instantiate-HSTI +} + +function PrintToolVersion +{ + LogAndConsole "" + LogAndConsole "###########################################################################" + LogAndConsole "" + LogAndConsole "Readiness Tool Version 3.7.2 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard." + LogAndConsole "" + LogAndConsole "###########################################################################" + LogAndConsole "" + +} + +PrintToolVersion + +if(!($Ready) -and !($Capable) -and !($Enable) -and !($Disable) -and !($Clear) -and !($ResetVerifier)) +{ + #Print Usage if none of the options are specified + LogAndConsoleWarning "How to read the output:" + LogAndConsoleWarning "" + LogAndConsoleWarning " 1. Red Errors: Basic things are missing that will prevent enabling and using DG/CG" + LogAndConsoleWarning " 2. Yellow Warnings: This device can be used to enable and use DG/CG, but `n additional security benefits will be absent. To learn more please go through: https://aka.ms/dgwhcr" + LogAndConsoleWarning " 3. Green Messages: This device is fully compliant with DG/CG requirements`n" + + LogAndConsoleWarning "###########################################################################" + LogAndConsoleWarning "" + LogAndConsoleWarning "Hardware requirements for enabling Device Guard and Credential Guard" + LogAndConsoleWarning " 1. Hardware: Recent hardware that supports virtualization extension with SLAT" + LogAndConsoleWarning "" + LogAndConsoleWarning "########################################################################### `n" + + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -[Capable/Ready/Enable/Disable/Clear] -[DG/CG/HVCI] -[AutoReboot] -Path" + LogAndConsoleWarning "Log file with details is found here: C:\DGLogs `n" + + LogAndConsoleWarning "To Enable DG/CG. If you have a custom SIPolicy.p7b then use the -Path parameter else the hardcoded default policy is used" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Enable OR DG_Readiness.ps1 -Enable -Path `n" + + LogAndConsoleWarning "To Enable only HVCI" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Enable -HVCI `n" + + LogAndConsoleWarning "To Enable only CG" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Enable -CG `n" + + LogAndConsoleWarning "To Verify if DG/CG is enabled" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Ready `n" + + LogAndConsoleWarning "To Disable DG/CG." + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Disable `n" + + LogAndConsoleWarning "To Verify if DG/CG is disabled" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Ready `n" + + LogAndConsoleWarning "To Verify if this device is DG/CG Capable" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Capable`n" + + LogAndConsoleWarning "To Verify if this device is HVCI Capable" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Capable -HVCI`n" + + LogAndConsoleWarning "To Auto reboot with each option" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -[Capable/Enable/Disable] -AutoReboot`n" + LogAndConsoleWarning "###########################################################################" + LogAndConsoleWarning "" + LogAndConsoleWarning "When the Readiness Tool with '-capable' is run the following RegKey values are set:" + LogAndConsoleWarning "" + LogAndConsoleWarning "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities" + LogAndConsoleWarning "CG_Capable" + LogAndConsoleWarning "DG_Capable" + LogAndConsoleWarning "HVCI_Capable" + LogAndConsoleWarning "" + LogAndConsoleWarning "Value 0 = not possible to enable DG/CG/HVCI on this device" + LogAndConsoleWarning "Value 1 = not fully compatible but has sufficient firmware/hardware/software features to enable DG/CG/HVCI" + LogAndConsoleWarning "Value 2 = fully compatible for DG/CG/HVCI" + LogAndConsoleWarning "" + LogAndConsoleWarning "########################################################################### `n" +} + +$user = [Security.Principal.WindowsIdentity]::GetCurrent(); +$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) + +if(!$TestForAdmin) +{ + LogAndConsoleError "This script requires local administrator privileges. Please execute this script as a local administrator." + exit +} + +$isRunningOnVM = (get-wmiobject win32_computersystem).model +if($isRunningOnVM.Contains("Virtual")) +{ + LogAndConsoleWarning "Running on a Virtual Machine. DG/CG is supported only if both guest VM and host machine are running with Windows 10, version 1703 or later with English localization." +} + + +<# Check the DG status if enabled or disabled, meaning if the device is ready or not #> +if($Ready) +{ + PrintHardwareReq + + $DGRunning = $(Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning + $_ConfigCIState = $(Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard).CodeIntegrityPolicyEnforcementStatus + Log "Current DGRunning = $DGRunning, ConfigCI= $_ConfigCIState" + $_HVCIState = CheckDGRunning(2) + $_CGState = CheckDGRunning(1) + + if($HVCI) + { + Log "_HVCIState: $_HVCIState" + PrintHVCIDetails $_HVCIState + } + elseif($CG) + { + Log "_CGState: $_CGState" + PrintCGDetails $_CGState + + if($_CGState) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 1 /f' + } + else + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 0 /f' + } + } + elseif($DG) + { + Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" + + PrintHVCIDetails $_HVCIState + PrintConfigCIDetails $_ConfigCIState + + if($_ConfigCIState -and $_HVCIState) + { + LogAndConsoleSuccess "HVCI, and Config-CI are enabled and running." + + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 1 /f' + } + else + { + LogAndConsoleWarning "Not all services are running." + + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 0 /f' + } + } + else + { + Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" + + PrintCGDetails $_CGState + PrintHVCIDetails $_HVCIState + PrintConfigCIDetails $_ConfigCIState + + if(($DGRunning.Length -ge 2) -and ($_CGState) -and ($_HVCIState) -and ($_ConfigCIState -ge 1)) + { + LogAndConsoleSuccess "HVCI, Credential Guard, and Config CI are enabled and running." + } + else + { + LogAndConsoleWarning "Not all services are running." + } + } +} + +<# Enable and Disable #> +if($Enable) +{ + PrintHardwareReq + + LogAndConsole "Enabling Device Guard and Credential Guard" + LogAndConsole "Setting RegKeys to enable DG/CG" + + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f' + #Only SecureBoot is required as part of RequirePlatformSecurityFeatures + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f' + + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f' + } + else + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f' + } + + if(!$HVCI -and !$DG) + { + # value is 2 for both Th2 and RS1 + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LsaCfgFlags" /t REG_DWORD /d 2 /f' + } + if(!$CG) + { + if(!$_isRedstone) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f' + } + else + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f' + } + } + + try + { + if(!$HVCI -and !$CG) + { + if(!$SIPolicyPath) + { + Log "Writing Decoded SIPolicy.p7b" + $SIPolicy_Decoded = [System.Convert]::FromBase64String($SIPolicy_Encoded) + [System.IO.File]::WriteAllBytes("$env:windir\System32\CodeIntegrity\SIPolicy.p7b",$SIPolicy_Decoded) + } + else + { + LogAndConsole "Copying user provided SIpolicy.p7b" + $CmdOutput = Copy-Item $SIPolicyPath "$env:windir\System32\CodeIntegrity\SIPolicy.p7b" | Out-String + Log $CmdOutput + } + } + } + catch + { + LogAndConsole "Writing SIPolicy.p7b file failed" + } + + LogAndConsole "Enabling Hyper-V and IOMMU" + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + LogAndConsole "OS Not Redstone, enabling IsolatedUserMode separately" + #Enable/Disable IOMMU separately + ExecuteCommandAndLog 'DISM.EXE /Online /Enable-Feature:IsolatedUserMode /NoRestart' + } + $CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Hypervisor /All /NoRestart | Out-String + if(!$CmdOutput.Contains("The operation completed successfully.")) + { + $CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Online /All /NoRestart | Out-String + } + + Log $CmdOutput + if($CmdOutput.Contains("The operation completed successfully.")) + { + LogAndConsoleSuccess "Enabling Hyper-V and IOMMU successful" + #Reg key for HLK validation of DISM.EXE step + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HyperVEnabled" /t REG_DWORD /d 1 /f' + } + else + { + LogAndConsoleWarning "Enabling Hyper-V failed please check the log file" + #Reg key for HLK validation of DISM.EXE step + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HyperVEnabled" /t REG_DWORD /d 0 /f' + } + AutoRebootHelper +} + +if($Disable) +{ + LogAndConsole "Disabling Device Guard and Credential Guard" + LogAndConsole "Deleting RegKeys to disable DG/CG" + + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f' + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f' + + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "NoLock" /f' + } + else + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /f' + } + + if(!$CG) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /f' + if($_isRedstone) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /f' + } + } + + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LsaCfgFlags" /f' + } + + if(!$HVCI -and !$CG) + { + ExecuteCommandAndLog 'del "$env:windir\System32\CodeIntegrity\SIPolicy.p7b"' + } + + if(!$HVCI -and !$DG -and !$CG) + { + LogAndConsole "Disabling Hyper-V and IOMMU" + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + LogAndConsole "OS Not Redstone, disabling IsolatedUserMode separately" + #Enable/Disable IOMMU separately + ExecuteCommandAndLog 'DISM.EXE /Online /disable-Feature /FeatureName:IsolatedUserMode /NoRestart' + } + $CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /NoRestart | Out-String + if(!$CmdOutput.Contains("The operation completed successfully.")) + { + $CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Online /NoRestart | Out-String + } + Log $CmdOutput + if($CmdOutput.Contains("The operation completed successfully.")) + { + LogAndConsoleSuccess "Disabling Hyper-V and IOMMU successful" + } + else + { + LogAndConsoleWarning "Disabling Hyper-V failed please check the log file" + } + + #set of commands to run SecConfig.efi to delete UEFI variables if were set in pre OS + #these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always + #this requires a reboot and accepting the prompt in the Pre-OS which is self explanatory in the message that is displayed in pre-OS + $FreeDrive = ls function:[s-z]: -n | ?{ !(test-path $_) } | random + Log "FreeDrive=$FreeDrive" + ExecuteCommandAndLog 'mountvol $FreeDrive /s' + $CmdOutput = Copy-Item "$env:windir\System32\SecConfig.efi" $FreeDrive\EFI\Microsoft\Boot\SecConfig.efi -Force | Out-String + LogAndConsole $CmdOutput + ExecuteCommandAndLog 'bcdedit /create "{0cb3b571-2f2e-4343-a879-d86a476d7215}" /d DGOptOut /application osloader' + ExecuteCommandAndLog 'bcdedit /set "{0cb3b571-2f2e-4343-a879-d86a476d7215}" path \EFI\Microsoft\Boot\SecConfig.efi' + ExecuteCommandAndLog 'bcdedit /set "{bootmgr}" bootsequence "{0cb3b571-2f2e-4343-a879-d86a476d7215}"' + ExecuteCommandAndLog 'bcdedit /set "{0cb3b571-2f2e-4343-a879-d86a476d7215}" loadoptions DISABLE-LSA-ISO,DISABLE-VBS' + ExecuteCommandAndLog 'bcdedit /set "{0cb3b571-2f2e-4343-a879-d86a476d7215}" device partition=$FreeDrive' + ExecuteCommandAndLog 'mountvol $FreeDrive /d' + #steps complete + + } + AutoRebootHelper +} + +if($Clear) +{ + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities" /f' + VerifierReset +} + +if($ResetVerifier) +{ + VerifierReset +} + +<# Is machine Device Guard / Cred Guard Capable and Verify #> +if($Capable) +{ + PrintHardwareReq + + LogAndConsole "Checking if the device is DG/CG Capable" + + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + LogAndConsoleWarning "Capable is currently fully supported in Redstone only.." + } + $_StepCount = 1 + if(!$CG) + { + LogAndConsole " ====================== Step $_StepCount Driver Compat ====================== " + $_StepCount++ + CheckDriverCompat + } + + LogAndConsole " ====================== Step $_StepCount Secure boot present ====================== " + $_StepCount++ + CheckSecureBootState + + if(!$HVCI -and !$DG -and !$CG) + { + #check only if sub-options are absent + LogAndConsole " ====================== Step $_StepCount MS UEFI HSTI tests ====================== " + $_StepCount++ + CheckHSTI + } + + LogAndConsole " ====================== Step $_StepCount OS Architecture ====================== " + $_StepCount++ + CheckOSArchitecture + + LogAndConsole " ====================== Step $_StepCount Supported OS SKU ====================== " + $_StepCount++ + CheckOSSKU + + LogAndConsole " ====================== Step $_StepCount Virtualization Firmware ====================== " + $_StepCount++ + CheckVirtualization + + if(!$HVCI -and !$DG) + { + LogAndConsole " ====================== Step $_StepCount TPM version ====================== " + $_StepCount++ + CheckTPM + + LogAndConsole " ====================== Step $_StepCount Secure MOR ====================== " + $_StepCount++ + CheckSecureMOR + } + + LogAndConsole " ====================== Step $_StepCount NX Protector ====================== " + $_StepCount++ + CheckNXProtection + + LogAndConsole " ====================== Step $_StepCount SMM Mitigation ====================== " + $_StepCount++ + CheckSMMProtection + + LogAndConsole " ====================== End Check ====================== " + + LogAndConsole " ====================== Summary ====================== " + ListSummary + LogAndConsole "To learn more about required hardware and software please visit: https://aka.ms/dgwhcr" +} + + +# SIG # Begin signature block +## REPLACE +# SIG # End signature block + +``` diff --git a/windows/security/identity-protection/credential-guard/images/credguard-gp-2.png b/windows/security/identity-protection/credential-guard/images/credguard-gp-2.png new file mode 100644 index 0000000000..ead9410405 Binary files /dev/null and b/windows/security/identity-protection/credential-guard/images/credguard-gp-2.png differ diff --git a/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png b/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png index d9af0e8fc4..46f838c8d2 100644 Binary files a/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png and b/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png differ diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index 6747177c1d..8a678b6ff4 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -2,16 +2,15 @@ title: Enterprise Certificate Pinning ms.mktglfcycl: manage ms.sitesec: library -description: Enterprise certificate pinning is a Windows feature for remembering, or “pinning” a root, issuing certificate authority, or end entity certificate to a given domain name. +description: Enterprise certificate pinning is a Windows feature for remembering, or “pinning” a root, issuing certificate authority, or end entity certificate to a given domain name. audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.prod: w10 ms.technology: windows -ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium ms.date: 07/27/2017 @@ -26,13 +25,16 @@ ms.reviewer: Enterprise certificate pinning is a Windows feature for remembering, or “pinning,” a root issuing certificate authority or end entity certificate to a given domain name. Enterprise certificate pinning helps reduce man-in-the-middle attacks by enabling you to protect your internal domain names from chaining to unwanted certificates or to fraudulently issued certificates. ->[!NOTE] +> [!NOTE] > External domain names, where the certificate issued to these domains is issued by a public certificate authority, are not ideal for enterprise certificate pinning. Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site’s server authentication certificate chain matches a restricted set of certificates. These restrictions are encapsulated in a Pin Rules Certificate Trust List (CTL) that is configured and deployed to Windows 10 computers. Any site certificate triggering a name mismatch causes Windows to write an event to the CAPI2 event log and prevents the user from navigating to the web site using Microsoft Edge or Internet Explorer. +> [!NOTE] +> Enterprise Certificate Pinning feature triggering doesn't cause clients other than Microsoft Edge or Internet Explorer to block the connection. + ## Deployment To deploy enterprise certificate pinning, you need to: diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 4579829e90..7cf7eeccbf 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -1,6 +1,6 @@ --- title: WebAuthn APIs -description: Enabling password-less authentication for your sites and apps +description: Learn how to use WebAuthn APIs to enable password-less authentication for your sites and apps. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index c23f167615..215c86beea 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -1,6 +1,6 @@ --- title: Multifactor Unlock -description: Multifactor Unlock +description: Learn how Windows 10 offers multifactor device unlock by extending Windows Hello with trusted signals. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, multi, factor, multifactor, multi-factor ms.prod: w10 ms.mktglfcycl: deploy @@ -23,15 +23,13 @@ ms.reviewer: **Requirements:** * Windows Hello for Business deployment (Hybrid or On-premises) -* Azure AD joined device (Cloud and Hybrid deployments) -* Hybrid Azure AD joined (Hybrid deployments) -* Domain Joined (on-premises deployments) -* Windows 10, version 1709 +* Azure AD, Hybrid Azure AD, or Domain Joined (Cloud, Hybrid, or On-Premises deployments) +* Windows 10, version 1709 or newer * Bluetooth, Bluetooth capable phone - optional Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system. -Windows 10 offers Multi-factor device unlock by extending Windows Hello with trusted signals, administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices. +Windows 10 offers Multi-factor device unlock by extending Windows Hello with trusted signals. Administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices. Which organizations can take advantage of Multi-factor unlock? Those who: * Have expressed that PINs alone do not meet their security needs. @@ -101,7 +99,7 @@ Each rule element has a **signal** element. All signal elements have a **type** | type| "wifi" (Windows 10, version 1803) #### Bluetooth -You define the bluetooth signal with additional attribute in the signal element. The bluetooth configuration does not use any other elements. You can end the signal element with short ending tag "\/>". +You define the bluetooth signal with additional attributes in the signal element. The bluetooth configuration does not use any other elements. You can end the signal element with short ending tag "\/>". |Attribute|Value|Required| |---------|-----|--------| @@ -117,7 +115,7 @@ Example: ``` -The **classofDevice** attribute defaults Phones and uses the values from the following table +The **classofDevice** attribute defaults to Phone and uses the values from the following table: |Description|Value| |:-------------|:-------:| @@ -138,7 +136,7 @@ The **rssiMin** attribute value signal indicates the strength needed for the dev RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. >[!IMPORTANT] ->Microsoft recommends using the default values for this policy settings. Measurements are relative, based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. Use the rssiMIN and rssiMaxDelta values from the XML file created by the Group Policy Management Editor or remove both attributes to use the default values. +>Microsoft recommends using the default values for this policy setting. Measurements are relative, based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. Use the rssiMIN and rssiMaxDelta values from the XML file created by the Group Policy Management Editor or remove both attributes to use the default values. #### IP Configuration You define IP configuration signals using one or more ipConfiguration elements. Each element has a string value. IpConfiguration elements do not have attributes or nested elements. @@ -198,7 +196,7 @@ The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IP 21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 ``` ##### dnsSuffix -The fully qualified domain name of your organizations internal DNS suffix where any part of the fully qualified domain name in this setting exists in the computer's primary DNS suffix. The **signal** element may contain one or more **dnsSuffix** elements.
                  +The fully qualified domain name of your organization's internal DNS suffix where any part of the fully qualified domain name in this setting exists in the computer's primary DNS suffix. The **signal** element may contain one or more **dnsSuffix** elements.
                  **Example** ``` corp.contoso.com @@ -301,7 +299,7 @@ This example configures the same as example 2 using compounding And elements. T #### Example 4 This example configures Wi-Fi as a trusted signal (Windows 10, version 1803) ``` - + contoso 12-ab-34-ff-e5-46 @@ -319,7 +317,7 @@ This example configures Wi-Fi as a trusted signal (Windows 10, version 1803) ### How to configure Multifactor Unlock policy settings -You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709. +You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -332,6 +330,7 @@ The Group Policy object contains the policy settings needed to trigger Windows H > * PIN **must** be in at least one of the groups > * Trusted signals **must** be combined with another credential provider > * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can satisfy either category, but not both. +> * The multifactor unlock feature is also supported via the Passport for Work CSP. See [Passport For Work CSP](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) for more information. 1. Start the **Group Policy Management Console** (gpmc.msc) 2. Expand the domain and select the **Group Policy Object** node in the navigation pane. diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index fb9a2e4abd..16be1aa6bc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -1,6 +1,6 @@ --- -title: Planning an adequate number of Windows Server 2019 Domain Controllers for Windows Hello for Business deployments -description: Planning an adequate number of Windows Server 2019 Domain Controllers for Windows Hello for Business deployments +title: Having enough Domain Controllers for Windows Hello for Business deployments +description: Guide for planning to have an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -16,103 +16,97 @@ localizationpriority: medium ms.date: 08/20/2018 ms.reviewer: --- -# Planning an adequate number of Windows Server 2019 Domain Controllers for Windows Hello for Business deployments +# Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments **Applies to** -- Windows 10, version 1703 or later -- Windows Server, versions 2016 and 2019 -- Hybrid or On-Premises deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows Server, versions 2016 or later +- Hybrid or On-Premises deployment +- Key trust > [!NOTE] ->There was an issue with key trust on Windows Server 2019. To fix it, refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044). +>There was an issue with key trust authentication on Windows Server 2019. To fix it, refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044). ## How many is adequate - -How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged. +How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged. - -Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 and above domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller. +Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 or later domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers and above. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller. - -Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2019) to a deployment of existing domain controllers (Windows Server 2008R2, Windows Server 2012R2 or Windows Server 2016) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario: +Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding a domain controller that supports public key mapping (in this case Windows Server 2016 or later) to a deployment of existing domain controllers which do not support public key mapping (Windows Server 2008R2, Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario: - -Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following: +Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following: ![dc-chart1](images/plan/dc-chart1.png) - -The environment changes. The first change includes DC1 upgraded to Windows Server 2019 to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following: +The environment changes. The first change includes DC1 upgraded to Windows Server 2016 or later to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following: ![dc-chart2](images/plan/dc-chart2.png) -The Windows Server 2019 domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of the password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2019 domain controller supports public key trust authentication. The Windows Server 2019 domain controller understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2019 domain controller is added, but without deploying Windows Hello for Business to any more clients? - +The Windows Server 2016 or later domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2016 and above domain controller supports public key trust authentication. The Windows Server 2016 and above domain controller still understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 or later domain controller is added, but without deploying Windows Hello for Business to any more clients? ![dc-chart3](images/plan/dc-chart3.png) -Upgrading another Windows Server 2019 domain controller distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2019, but the number of WHFB clients remains the same. +Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same. ![dc-chart4](images/plan/dc-chart4.png) -Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. +Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. ![dc-chart5](images/plan/dc-chart5.png) -You'll notice the distribution did not change. Each Windows Server 2019 domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers. +You'll notice the distribution did not change. Each Windows Server 2016 or later domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers. -There are several conclusions here: -* Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication. -* Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication. -* Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication. -* Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers -* Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication. - -The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers. +There are several conclusions here: +- Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication. +- Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication. +- Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication. +- Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers +- Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication. +The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers. ## Determining total AS Request load Each organization needs to have a baseline of the AS request load that occurs in their environment. Windows Server provides the KDC AS Requests performance counter that helps you determine this. -Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours: -* A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant -* The hour you believe initial authentication to be significant -* And a half-hour after you expect initial authentication to be significant +Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours: -For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward. +- A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant +- The hour you believe initial authentication to be significant +- And a half-hour after you expect initial authentication to be significant + +For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward. > [!NOTE] > To capture all the authentication traffic. Ensure that all computers are powered down to get the most accurate authentication information (computers and services authenticate at first power up--you need to consider this authentication in your evaluation). -Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experiencing the highest amount of authentication. - -Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiply the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent. +Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experiencing the highest amount of authentication. -Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller are to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business. +Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiply the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent. + +Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller are to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business. ## Monitoring Authentication -Using the same methods described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2019. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. It gives you a baseline for your environment to where you can form a statement such as: - +Using the same methods described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2016 or newer. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. It gives you a baseline for your environment to where you can form a statement such as: ```"Every n Windows Hello for Business clients results in x percentage of key-trust authentication."``` -Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with this information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment. +Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with this information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment. -Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2019 domain controllers. If there is only one Windows Server 2019 domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible. +Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 or newer domain controllers. If there is only one Windows Server 2016 or newer domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible. Increasing the number of domain controllers distributes the volume of authentication, but doesn't change it. Therefore, as you add more domain controllers, the burden of authentication, for which each domain controller is responsible, decreases. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on. ## Strategy + The simplest strategy you can employ is to upgrade one domain controller and monitor the single domain controller as you continue to phase in new Windows Hello for Business key-trust clients until it reaches a 70 or 80 percent threshold. -Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environment's designated capacity, you can upgrade another domain controller. +Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environment's designated capacity, you can upgrade another domain controller. -Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume. +Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume. However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically-configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. It's not the best load balancer, however, it is a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application. - diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 18314f3f58..01dffaef6d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -1,6 +1,6 @@ --- title: Windows Hello biometrics in the enterprise (Windows 10) -description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. +description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition. ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc ms.reviewer: keywords: Windows Hello, enterprise biometrics @@ -15,7 +15,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 08/19/2018 +ms.date: 03/05/2020 --- # Windows Hello biometrics in the enterprise @@ -28,34 +28,37 @@ Windows Hello is the biometric authentication feature that helps strengthen auth >[!NOTE] >When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -Because we realize your employees are going to want to use this new technology in your enterprise, we’ve been actively working with the device manufacturers to create strict design and performance recommendations that help to ensure that you can more confidently introduce Windows Hello biometrics into your organization. +Because we realize your employees are going to want to use this new technology in your enterprise, we've been actively working with the device manufacturers to create strict design and performance recommendations that help to ensure that you can more confidently introduce Windows Hello biometrics into your organization. ## How does Windows Hello work? Windows Hello lets your employees use fingerprint or facial recognition as an alternative method to unlocking a device. With Windows Hello, authentication happens when the employee provides his or her unique biometric identifier while accessing the device-specific Windows Hello credentials. -The Windows Hello authenticator works to authenticate and allow employees onto your enterprise network. Authentication doesn’t roam among devices, isn’t shared with a server, and can’t easily be extracted from a device. If multiple employees share a device, each employee will use his or her own biometric data on the device. +The Windows Hello authenticator works to authenticate and allow employees onto your enterprise network. Authentication doesn't roam among devices, isn't shared with a server, and can't easily be extracted from a device. If multiple employees share a device, each employee will use his or her own biometric data on the device. ## Why should I let my employees use Windows Hello? Windows Hello provides many benefits, including: -- It helps to strengthen your protections against credential theft. Because an attacker must have both the device and the biometric info or PIN, it’s much more difficult to gain access without the employee’s knowledge. +- It helps to strengthen your protections against credential theft. Because an attacker must have both the device and the biometric info or PIN, it's much more difficult to gain access without the employee's knowledge. -- Employees get a simple authentication method (backed up with a PIN) that’s always with them, so there’s nothing to lose. No more forgetting passwords! +- Employees get a simple authentication method (backed up with a PIN) that's always with them, so there's nothing to lose. No more forgetting passwords! - Support for Windows Hello is built into the operating system so you can add additional biometric devices and polices as part of a coordinated rollout or to individual employees or groups using Group Policy or Mobile Device Management (MDM) configurations service provider (CSP) policies.
                  For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](hello-manage-in-organization.md) topic. ## Where is Windows Hello data stored? -The biometric data used to support Windows Hello is stored on the local device only. It doesn’t roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data, it still can’t be easily converted to a form that could be recognized by the biometric sensor. +The biometric data used to support Windows Hello is stored on the local device only. It doesn't roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data from a device, it cannot be converted back into a raw biometric sample that could be recognized by the biometric sensor. + +> [!NOTE] +>Each sensor on a device will have its own biometric database file where template data is stored. Each database has a unique, randomly generated key that is encrypted to the system. The template data for the sensor will be encrypted with this per-database key using AES with CBC chaining mode. The hash is SHA256. Some fingerprint sensors have the capability to complete matching on the fingerprint sensor module instead of in the OS. These sensors will store biometric data on the fingerprint module instead of in the database file. ## Has Microsoft set any device requirements for Windows Hello? -We’ve been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: +We've been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: - **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regards to the security of the biometric algorithm. - **False Reject Rate (FRR).** Represents the instances a biometric identification solution fails to verify an authorized person correctly. Usually represented as a percentage, the sum of the True Accept Rate and False Reject Rate is 1. Can be with or without anti-spoofing or liveness detection. ### Fingerprint sensor requirements -To allow fingerprint matching, you must have devices with fingerprint sensors and software. Fingerprint sensors, or sensors that use an employee’s unique fingerprint as an alternative log on option, can be touch sensors (large area or small area) or swipe sensors. Each type of sensor has its own set of detailed requirements that must be implemented by the manufacturer, but all of the sensors must include anti-spoofing measures (required). +To allow fingerprint matching, you must have devices with fingerprint sensors and software. Fingerprint sensors, or sensors that use an employee's unique fingerprint as an alternative log on option, can be touch sensors (large area or small area) or swipe sensors. Each type of sensor has its own set of detailed requirements that must be implemented by the manufacturer, but all of the sensors must include anti-spoofing measures (required). **Acceptable performance range for small to large size touch sensors** @@ -70,7 +73,7 @@ To allow fingerprint matching, you must have devices with fingerprint sensors an - Effective, real world FRR with Anti-spoofing or liveness detection: <10% ### Facial recognition sensors -To allow facial recognition, you must have devices with integrated special infrared (IR) sensors and software. Facial recognition sensors use special cameras that see in IR light, letting them tell the difference between a photo and a living person while scanning an employee’s facial features. These sensors, like the fingerprint sensors, must also include anti-spoofing measures (required) and a way to configure them (optional). +To allow facial recognition, you must have devices with integrated special infrared (IR) sensors and software. Facial recognition sensors use special cameras that see in IR light, letting them tell the difference between a photo and a living person while scanning an employee's facial features. These sensors, like the fingerprint sensors, must also include anti-spoofing measures (required) and a way to configure them (optional). - False Accept Rate (FAR): <0.001% diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 4563787217..8e3e7d4f74 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -1,6 +1,6 @@ --- -title: Prepare and Deploy Windows Server 2016 Active Directory Federation Services (Windows Hello for Business) -description: How toPrepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business +title: Prepare & Deploy Windows AD FS certificate trust (Windows Hello for Business) +description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business, using certificate trust. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -19,10 +19,10 @@ ms.reviewer: # Prepare and Deploy Windows Server 2016 Active Directory Federation Services **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Certificate trust +- Windows 10, version 1703 or later +- On-premises deployment +- Certificate trust Windows Hello for Business works exclusively with the Active Directory Federation Service role included with Windows Server 2016 and requires an additional server update. The on-premises certificate trust deployment uses Active Directory Federation Services roles for key registration, device registration, and as a certificate registration authority. @@ -36,7 +36,23 @@ Ensure you apply the Windows Server 2016 Update to all nodes in the farm after y A new Active Directory Federation Services farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with an external networking peripherals, or with using the Network Load Balancing Role included in Windows Server. -Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. +Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. + +> [!NOTE] +>For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: +> +> 1. Launch AD FS management console. Brose to "Services > Scope Descriptions". +> 2. Right click "Scope Descriptions" and select "Add Scope Description". +> 3. Under name type "ugs" and Click Apply > OK. +> 4. Launch PowerShell as an administrator. +> 5. Get the ObjectIdentifier of the application permission with the ClientRoleIdentifier parameter equal to "38aa3b87-a06d-4817-b275-7a316988d93b": +> ```PowerShell +> (Get-AdfsApplicationPermission -ServerRoleIdentifiers 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' | ?{ $_.ClientRoleIdentifier -eq '38aa3b87-a06d-4817-b275-7a316988d93b' }).ObjectIdentifier +> ``` +> 6. Execute the command `Set-AdfsApplicationPermission -TargetIdentifier -AddScope 'ugs'`. +> 7. Restart the ADFS service. +> 8. On the client: Restart the client. User should be prompted to provision WHFB. +> 9. If the provisioning window does not pop up then need to collect NGC trace logs and further troubleshoot. ## Update Windows Server 2016 @@ -52,18 +68,21 @@ Sign-in the federation server with _local admin_ equivalent credentials. Windows Hello for Business on-premises deployments require a federation server for device registration, key registration, and authentication certificate enrollment. Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity. The AD FS role needs a server authentication certificate for the federation services, but you can use a certificate issued by your enterprise (internal) certificate authority. The server authentication certificate should have the following names included in the certificate if you are requesting an individual certificate for each node in the federation farm: -* Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS) -* Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com) + +- Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS) +- Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com) +- Subject Alternate Name: Your device registration service name, such as *enterpriseregistration.contoso.com* You configure your federation service name when you configure the AD FS role. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server **adfs** and the federation service **fs**. The FQDN of the host is adfs.corp.contoso.com and the FQDN of the federation service is fs.corp.contoso.com. You can; however, issue one certificate for all hosts in the farm. If you chose this option, then leave the subject name blank, and include all the names in the subject alternate name when creating the certificate request. All names should include the FQDN of each host in the farm and the federation service name. -It’s recommended that you mark the private key as exportable so that the same certificate can be deployed across each federation server and web application proxy within your AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm. +It’s recommended that you mark the private key as exportable so that the same certificate can be deployed across each federation server and web application proxy within your AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm. Be sure to enroll or import the certificate into the AD FS server’s computer certificate store. Also, ensure all nodes in the farm have the proper TLS server authentication certificate. ### Internal Web Server Authentication Certificate Enrollment + Sign-in the federation server with domain administrator equivalent credentials. 1. Start the Local Computer **Certificate Manager** (certlm.msc). @@ -74,17 +93,19 @@ Sign-in the federation server with domain administrator equivalent credentials. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. -9. Click **Enroll**. +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. +9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Repeat the same to add device registration service name (*enterpriseregistration.contoso.com*) as another alternative name. Click **OK** when finished. +10. Click **Enroll**. A server authentication certificate should appear in the computer’s Personal certificate store. ## Deploy the Active Directory Federation Service Role -The Active Directory Federation Service (AD FS) role provides the following services to support Windows Hello for Business on-premises deployments. -* Device registration -* Key registration -* Certificate registration authority (certificate trust deployments) +The Active Directory Federation Service (AD FS) role provides the following services to support Windows Hello for Business on-premises deployments: + +- Device registration +- Key registration +- Certificate registration authority (certificate trust deployments) >[!IMPORTANT] > Finish the entire AD FS configuration on the first server in the farm before adding the second server to the AD FS farm. Once complete, the second server receives the configuration through the shared configuration database when it is added the AD FS farm. @@ -92,6 +113,7 @@ The Active Directory Federation Service (AD FS) role provides the following serv Windows Hello for Business depends on proper device registration. For on-premises deployments, Windows Server 2016 AD FS handles device registration. Sign-in the federation server with _Enterprise Admin_ equivalent credentials. + 1. Start **Server Manager**. Click **Local Server** in the navigation pane. 2. Click **Manage** and then click **Add Roles and Features**. 3. Click **Next** on the **Before you begin** page. @@ -105,12 +127,13 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. ## Review Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the AD FS farm uses the correct database configuration. -* Confirm the AD FS farm has an adequate number of nodes and is properly load balanced for the anticipated load. -* Confirm **all** AD FS servers in the farm have the latest updates. -* Confirm all AD FS servers have a valid server authentication certificate - * The subject of the certificate is the common name (FQDN) of the host or a wildcard name. - * The alternate name of the certificate contains a wildcard or the FQDN of the federation service + +- Confirm the AD FS farm uses the correct database configuration. +- Confirm the AD FS farm has an adequate number of nodes and is properly load balanced for the anticipated load. +- Confirm **all** AD FS servers in the farm have the latest updates. +- Confirm all AD FS servers have a valid server authentication certificate. + - The subject of the certificate is the common name (FQDN) of the host or a wildcard name. + - The alternate name of the certificate contains a wildcard or the FQDN of the federation service. ## Device Registration Service Account Prerequisite @@ -125,11 +148,15 @@ Windows Server 2012 or later domain controllers support Group Managed Service Ac GMSA uses the Microsoft Key Distribution Service that is located on Windows Server 2012 or later domain controllers. Windows uses the Microsoft Key Distribution Service to protect secrets stored and used by the GMSA. Before you can create a GMSA, you must first create a root key for the service. You can skip this if your environment already uses GMSA. +>[!NOTE] +> If the [default object creation quota for security principles](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/d55ca655-109b-4175-902a-3e9d60833012) is set, you will need to change it for the Group Managed Service Account in order to be able to register new devices. + #### Create KDS Root Key Sign-in a domain controller with _Enterprise Admin_ equivalent credentials. + 1. Start an elevated Windows PowerShell console. -2. Type `Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)` +2. Type `Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)`. ### Windows Server 2008 or 2008 R2 Domain Controllers @@ -138,6 +165,7 @@ Windows Server 2008 and 2008 R2 domain controllers do not host the Microsoft Key #### Create an AD FS Service Account Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. + 1. Open **Active Directory Users and Computers**. 2. Right-click the **Users** container, Click **New**. Click **User**. 3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. @@ -193,6 +221,9 @@ Sign-in the federation server with _domain administrator_ equivalent credentials ### Add the AD FS Service account to the KeyCredential Admin group and the Windows Hello for Business Users group +> [!NOTE] +> If you have a Windows Server 2016 domain controller in your domain, you can use the **Key Admins** group instead of **KeyCredential Administrators** and skip the **Configure Permissions for Key Registration** step. + The **KeyCredential Administrators** global group provides the AD FS service with the permissions needed to perform key registration. The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. @@ -236,12 +267,12 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. Th ## Review Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you followed the correct procedures based on the domain controllers used in your deployment +* Confirm you followed the correct procedures based on the domain controllers used in your deployment. * Windows Server 2012 or Windows Server 2012 R2 * Windows Server 2008 or Windows Server 2008 R2 * Confirm you have the correct service account based on your domain controller version. * Confirm you properly installed the AD FS role on your Windows Server 2016 based on the proper sizing of your federation, the number of relying parties, and database needs. -* Confirm you used a certificate with the correct names as the server authentication certificate +* Confirm you used a certificate with the correct names as the server authentication certificate. * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: * Certificate serial number * Certificate thumbprint @@ -277,8 +308,8 @@ Sign-in a certificate authority or management workstations with _domain administ 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. 6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. ->[!NOTE] -> The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. + > [!NOTE] + > The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. @@ -311,11 +342,12 @@ Sign-in a certificate authority or management workstations with _domain administ 3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. 5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. - **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the deployment. + > [!NOTE] + > If you use different template names, you’ll need to remember and substitute these names in different portions of the deployment. 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. 10. On the **Request Handling** tab, select the **Renew with same key** check box. 11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. @@ -327,7 +359,7 @@ Sign-in a certificate authority or management workstations with _domain administ Sign-in to an **AD FS Windows Server 2016** computer with _enterprise administrator_ equivalent credentials. 1. Open an elevated command prompt. -2. Run `certutil –dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` +2. Run `certutil –dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`. >[!NOTE] >If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It’s important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. @@ -363,12 +395,15 @@ Active Directory Federation Server used for Windows Hello for Business certifica Approximately 60 days prior to enrollment agent certificate’s expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. ### Service Connection Point (SCP) in Active Directory for ADFS Device Registration Service +> [!NOTE] +> Normally this script is not needed, as enabling Device Registration via the ADFS Management console already creates the objects. You can validate the SCP using the script below. For detailed information about the Device Registration Service, see [Configuring Device Registration](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn614658(v=ws.11)?redirectedfrom=MSDN). + Now you will add the Service connection Point to ADFS device registration Service for your Active directory by running the following script: ->[!TIP] +> [!TIP] > Make sure to change the $enrollmentService and $configNC variables before running the script. -```Powershell +```powershell # Replace this with your Device Registration Service endpoint $enrollmentService = "enterpriseregistration.contoso.com" # Replace this with your Active Directory configuration naming context @@ -412,8 +447,8 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. -8. Click **Install** to start the feature installation - ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) +8. Click **Install** to start the feature installation. + ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS @@ -449,7 +484,7 @@ Sign-in the domain controller or administrative workstation with domain administ 3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. 4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. 5. In the **name** box, type the name of the federation service. In the **IP address** box, type the IP address of your federation server. Click **Add Host**. -6. Close the DNS Management console +6. Close the DNS Management console. ## Configure the Intranet Zone to include the federation service @@ -457,10 +492,10 @@ The Windows Hello provisioning presents web pages from the federation service. ### Create an Intranet Zone Group Policy -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials -1. Start the **Group Policy Management Console** (gpmc.msc) +Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials: +1. Start the **Group Policy Management Console** (gpmc.msc). 2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** +3. Right-click **Group Policy object** and select **New**. 4. Type **Intranet Zone Settings** in the name box and click **OK**. 5. In the content pane, right-click the **Intranet Zone Settings** Group Policy object and click **Edit**. 6. In the navigation pane, expand **Policies** under **Computer Configuration**. @@ -470,7 +505,7 @@ Sign-in the domain controller or administrative workstation with _Domain Admin_ ### Deploy the Intranet Zone Group Policy object -1. Start the **Group Policy Management Console** (gpmc.msc) +1. Start the **Group Policy Management Console** (gpmc.msc). 2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** 3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. @@ -482,8 +517,8 @@ Before you continue with the deployment, validate your deployment progress by re * Consider using an HSM to protect the enrollment agent certificate; however, understand the frequency and quantity of signature operations the enrollment agent server makes and understand the impact it has on overall performance. * Confirm you properly configured the Windows Hello for Business authentication certificate template—to include: * Issuance requirements of an authorized signature from a certificate request agent. - * The certificate template was properly marked as a Windows Hello for Business certificate template using certutil.exe - * The Windows Hello for Business Users group, or equivalent has the allow enroll and allow auto enroll permissions + * The certificate template was properly marked as a Windows Hello for Business certificate template using certutil.exe. + * The Windows Hello for Business Users group, or equivalent has the allow enroll permissions. * Confirm all certificate templates were properly published to the appropriate issuing certificate authorities. * Confirm the AD FS service account has the allow enroll permission for the Windows Hello Business authentication certificate template. * Confirm the AD FS certificate registration authority is properly configured using the `Get-AdfsCertificateAuthority` Windows PowerShell cmdlet. @@ -496,9 +531,14 @@ Before you continue with the deployment, validate your deployment progress by re You need to verify the AD FS service has properly enrolled for an enrollment agent certificate template. You can verify this is a variety ways, depending on if your service account is a normal user account or if the service account is a group managed service account. +> [!IMPORTANT] +> After following the previous steps, if you are unable to validate that the devices are, in fact, being registered automatically, there is a Group Policy at: +> **Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration >** "Register Domain Joined Computers As Devices". Set the policy to **Enabled** +> and the registration will happen automatically. + ### Event Logs -Use the event logs on the AD FS service to confirm the service account enrolled for an enrollment agent certificate. First, look for the AD FS event ID 443 that confirms certificate enrollment cycle has finished. Once confirmed the AD FS certificate enrollment cycle completed review the CertificateLifecycle-User event log. In this event log, look for event ID 1006, which indicates a new certificate was installed. Details of the event log should show +Use the event logs on the AD FS service to confirm the service account enrolled for an enrollment agent certificate. First, look for the AD FS event ID 443 that confirms certificate enrollment cycle has finished. Once confirmed the AD FS certificate enrollment cycle completed review the CertificateLifecycle-User event log. In this event log, look for event ID 1006, which indicates a new certificate was installed. Details of the event log should show: * The account name under which the certificate was enrolled. * The action, which should read enroll. diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md deleted file mode 100644 index 30b809ce8c..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md +++ /dev/null @@ -1,549 +0,0 @@ ---- -title: Configure or Deploy Multifactor Authentication Services (Windows Hello for Business) -description: How to Configure or Deploy Multifactor Authentication Services for Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Configure or Deploy Multifactor Authentication Services - -**Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Certificate trust - - -On-premises deployments must use an on-premises MFA Server that provides an AD FS Multifactor authentication adapter. It can be an Azure Multi-Factor Authentication Server or a third-party MFA solution. - ->[!TIP] ->Please make sure you've read [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) before proceeding any further. - -## Prerequisites - -The Azure MFA Server and User Portal servers have several prerequisites and must have connectivity to the Internet. - -### Primary MFA Server - -The Azure MFA server uses a primary and secondary replication model for its configuration database. The primary Azure MFA server hosts the writable partition of the configuration database. All secondary Azure MFA servers hosts read-only partitions of the configuration database. All production environment should deploy a minimum of two MFA Servers. - -For this documentation, the primary MFA uses the name **mf*a*** or **mfa.corp.contoso.com**. All secondary servers use the name **mfa*n*** or **mfa*n*.corp.contoso.com**, where *n* is the number of the deployed MFA server. - -The primary MFA server is also responsible for synchronizing from Active Directory. Therefore, the primary MFA server should be domain joined and fully patched. - -#### Enroll for Server Authentication - -The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. - -Sign-in the primary MFA server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. -9. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -The Azure MFA server does not require the Web Server role, however, User Portal and the optional Mobile Application server communicate with the MFA server database using the MFA Web Services SDK. The MFA Web Services SDK uses the Web Server role. - -To install the Web Server (IIS) role, please follow [Installing IIS 7 on Windows Server 2008 or Windows Server 2008 R2](https://docs.microsoft.com/iis/install/installing-iis-7/installing-iis-7-and-above-on-windows-server-2008-or-windows-server-2008-r2) or [Installing IIS 8.5 on Windows Server 2012 R2](https://docs.microsoft.com/iis/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2) depending on the host Operating System you're going to use. - -The following services are required: -* Common Parameters > Default Document. -* Common Parameters > Directory Browsing. -* Common Parameters > HTTP Errors. -* Common Parameters > Static Content. -* Health and Diagnostics > HTTP Logging. -* Performance > Static Content Compression. -* Security > Request Filtering. -* Security > Basic Authentication. -* Management Tools > IIS Management Console. -* Management Tools > IIS 6 Management Compatibility. -* Application Development > ASP.NET 4.5. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server Certificate - -The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. - -Sign in the primary MFA server with _administrator_ equivalent credentials. -1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console -2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. -3. In the **Actions** pane, click **Bindings**. -4. In the **Site Bindings** dialog, Click **Add**. -5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. -6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. - -#### Configure the Web Service’s Security - -The Azure MFA Server service runs in the security context of the Local System. The MFA User Portal gets its user and configuration information from the Azure MFA server using the MFA Web Services. Access control to the information is gated by membership to the **Phonefactor Admins** security group. You need to configure the Web Service’s security to ensure the User Portal and the Mobile Application servers can securely communicate to the Azure MFA Server. Also, all User Portal server administrators must be included in the **Phonefactor Admins** security group. - -Sign in the domain controller with _domain administrator_ equivalent credentials. - -##### Create Phonefactor Admin group - -1. Open **Active Directory Users and Computers** -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **Group**. -3. In the **New Object – Group** dialog box, type **Phonefactor Admins** in Group name. -4. Click **OK**. - -##### Add accounts to the Phonefactor Admins group - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select Users. In the content pane. Right-click the **Phonefactor Admins** security group and select **Properties**. -3. Click the **Members** tab. -4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the MFA service has enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Services Role was installed with the correct configuration (including Basic Authentication, ASP.NET 4.5, etc). -* Confirm the host has all the available updates from Windows Update. -* Confirm you bound the server authentication certificate to the IIS web site. -* Confirm you created the Phonefactor Admins group. -* Confirm you added the computer account hosting the MFA service to the Phonefactor Admins group and any user account who are responsible for administrating the MFA server or User Portal. - -### User Portal Server - -The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. User Portal Administrators may be set up and granted permission to add new users and update existing users. - -The User Portal web site uses the user database that is synchronized across the MFA Servers, which enables a design to support multiple web servers for the User Portal and those servers can support internal and external customers. While the user portal web site can be installed directly on the MFA server, it is recommended to install the User Portal on a server separate from the MFA Server to protect the MFA user database, as a layered, defense-in-depth security design. - -#### Enroll for Server Authentication - -Internal and external users use the User Portal to manage their multifactor authentication settings. To protect this communication, you need to enroll all User Portal servers with a server authentication certificate. You can use an enterprise certificate to protect communication to internal User Portal servers. - -For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. - -Sign-in the User Portal server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). -9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). -10. Click **Add**. Click **OK** when finished. -11. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -To do this, please follow the instructions mentioned in the previous [Install the Web Server Role](#install-the-web-server-role) section. However, do **not** install Security > Basic Authentication. The user portal server does not require this. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Set the IIS Server Certificate - -To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-server-certificate) section. - -#### Create WebServices SDK user account - -The User Portal and Mobile Application web services need to communicate with the configuration database hosted on the primary MFA server. These services use a user account to communicate to authenticate to the primary MFA server. You can think of the WebServices SDK account as a service account used by other servers to access the WebServices SDK on the primary MFA server. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**. -3. In the **New Object – User** dialog box, type **PFWSDK_\** in the **First name** and **User logon name** boxes, where *\* is the name of the primary MFA server running the Web Services SDK. Click **Next**. -4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account. - -#### Add the MFA SDK user account to the Phonefactor Admins group - -Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactor Admins** security group and select Properties. -3. Click the Members tab. -4. Click **Add**. Click **Object Types..** Type the PFWSDK_\ user name in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * The Webservices SDK user account - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the user portal are properly configure for load balancing and high-availability. -* Confirm the hosts of the user portal have enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Server Role was properly configured on all servers. -* Confirm all the hosts have the latest updates from Windows Update. -* Confirm you created the web service SDK domain account and the account is a member of the Phonefactor Admins group. - -## Installing Primary Azure MFA Server - -When you install Azure Multi-Factor Authentication Server, you have the following options: -1. Install Azure Multi-Factor Authentication Server locally on the same server as AD FS -2. Install the Azure Multi-Factor Authentication adapter locally on the AD FS server, and then install Multi-Factor Authentication Server on a different computer (preferred deployment for production environments) - -See [Configure Azure Multi-Factor Authentication Server to work with AD FS in Windows Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12) to view detailed installation and configuration options. - -Sign-in the federation server with _Domain Admin_ equivalent credentials and follow [To install and configure the Azure Multi-Factor Authentication server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#to-install-and-configure-the-azure-multi-factor-authentication-server) for an express setup with the configuration wizard. You can re-run the authentication wizard by selecting it from the Tools menu on the server. - ->[!IMPORTANT] ->Only follow the above mention article to install Azure MFA Server. Once it is intstalled, continue configuration using this article. - -### Configuring Company Settings - -You need to configure the MFA server with the default settings it applies to each user account when it is imported or synchronized from Active Directory. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Start the **Multi-Factor Server** application -2. Click **Company Settings**. -3. On the **General** Tab, select **Fail Authentication** from the **When internet is not accessible** list. -4. In **User defaults**, select **Phone Call** or **Text Message** - **Note:** You can use the mobile application; however, the configuration is beyond the scope of this document. Read [Getting started the MFA Server Mobile App Web Service](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice) to configure and use mobile application multi-factor authentication or the Install User Portal topic in the Multi-Factor Server help. -5. Select **Enable Global Services** if you want to allow Multi-Factor Authentications to be made to telephone numbers in rate zones that have an associated charge. -6. Clear the **User can change phone** check box to prevent users from changing their phone during the Multi-Factor Authentication call or in the User Portal. A consistent configuration is for users to change their phone numbers in Active Directory and let those changes synchronize to the multi-factor server using the Synchronization features in Directory Integration. -7. Select **Fail Authentication** from the **When user is disabled** list. Users should provision their account through the user portal. -8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. -9. Under default PIN rules, Select the User can change PIN check box to enable users to change their PIN during multi-factor authentication and through the user portal. -10. Configure the minimum length for the PIN. -11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. -12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. -13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. - -![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) - -### Configuring Email Settings and Content - -If you are deploying in a lab or proof-of-concept, then you have the option of skipping this step. In a production environment, ideally, you’ll want to setup the Azure Multifactor Authentication Server and its user portal web interface prior to sending the email. The email gives your users time to visit the user portal and configure the multi-factor settings. - -Now that you have imported or synchronized with your Azure Multi-Factor Authentication server, it is advised that you send your users an email that informs them that they have been enrolled in multi-factor authentication. - -With the Azure Multi-Factor Authentication Server there are various ways to configure your users for using multi-factor authentication. For instance, if you know the users’ phone numbers or were able to import the phone numbers into the Azure Multi-Factor Authentication Server from their company’s directory, the email will let users know that they have been configured to use Azure Multi-Factor Authentication, provide some instructions on using Azure Multi-Factor Authentication and inform the user of the phone number they will receive their authentications on. - -The content of the email will vary depending on the method of authentication that has been set for the user (e.g. phone call, SMS, mobile application). For example, if the user is required to use a PIN when they authenticate, the email will tell them what their initial PIN has been set to. Users are usually required to change their PIN during their first authentication. - -If users’ phone numbers have not been configured or imported into the Azure Multi-Factor Authentication Server, or users are pre-configured to use the mobile application for authentication, you can send them an email that lets them know that they have been configured to use Azure Multi-Factor Authentication and it will direct them to complete their account enrollment through the Azure Multi-Factor Authentication User Portal. A hyperlink will be included that the user clicks on to access the User Portal. When the user clicks on the hyperlink, their web browser will open and take them to their company’s Azure Multi-Factor Authentication User Portal. - -#### Settings - -By clicking the email icon on the left you can setup the settings for sending these emails. This is where you can enter the SMTP information of your mail server and it allows you to send a blanket wide email by adding a check to the Send mails to users check box. - -#### Content - -On the Email Content tab, you will see all of the various email templates that are available to choose from. So, depending on how you have configured your users to use multi-factor authentication, you can choose the template that best suits you. - -##### Edit the Content Settings - -The Azure MFA server does not send emails, even when configured to do so, until you configured the sender information for each email template listed in the Content tab. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. Click **Email** from the list of icons and click the **Email Content** tab. -3. Select an email template from the list of templates. Click **Edit**. -4. In the **Edit Email** dialog, in the **From** text box, type the email address of the person or group that should appear to have sent the email. - ![Edit email dialog within content settings](images/hello-mfa-content-edit-email.png) - -5. Optionally, customize other options in the email template. -6. When finished editing the template, Click **Apply**. -7. Click **Next** to move to the next email in the list. Repeat steps 4 and 6 to edit the changes. -8. Click **Close** when you are done editing the email templates. - -### Configuring Directory Integration Settings and Synchronization - -Synchronization keeps the Multi-Factor Authentication user database synchronized with the users in Active Directory or another LDAP Lightweight Directory Access Protocol directory. The process is similar to Importing Users from Active Directory, but periodically polls for Active Directory user and security group changes to process. It also provides for disabling or removing users removed from a container or security group and removing users deleted from Active Directory. - -It is important to use a different group memberships for synchronizing users from Active Directory and for enabling Windows Hello for Business. Keeping the group memberships separated enables you to synchronize users and configure MFA options without immediately deploying Windows Hello for Business to that user. This deployment approach provides the maximum flexibility, which gives users the ability to configure their settings before they provision Windows Hello for Business. To start provisioning, simply add the group used for synchronization to the Windows Hello for Business Users group (or equivalent if you use custom names). - -#### MultiFactorAuthAdSync Service - -The MultiFactorAuthAdSync service is a Windows service that performs the periodic polling of Active Directory. It is installed in a Stopped state and is started by the MultiFactorAuth service when configured to run. If you have a multi-server Multi-Factor Authentication configuration, the MultiFactorAuthAdSync may only be run on a single server. - -The MultiFactorAuthAdSync service uses the DirSync LDAP server extension provided by Microsoft to efficiently poll for changes. This DirSync control caller must have the "directory get changes" right and DS-Replication-Get-Changes extended control access right. By default, these rights are assigned to the Administrator and LocalSystem accounts on domain controllers. The MultiFactorAuthAdSync service is configured to run as LocalSystem by default. Therefore, it is simplest to run the service on a domain controller. The service can run as an account with lesser permissions if you configure it to always perform a full synchronization. This is less efficient, but requires less account privileges. - -#### Settings - -Configuring the directory synchronization between Active Directory and the Azure MFA server is easy. - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Click the **Synchronization** tab. -4. Select **Use Active Directory**. -5. Select **Include trusted domains** to have the Multi-Factor Authentication Server attempt to connect to domains trusted by the current domain, another domain in the forest, or domains involved in a forest trust. When not importing or synchronizing users from any of the trusted domains, clear the check box to improve performance. - -#### Synchronization - -The MFA server uses synchronization items to synchronize users from Active Directory to the MFA server database. Synchronization items enables you to synchronize a collection of users based security groups or Active Directory containers. - -You can configure synchronization items based on different criteria and filters. For the purpose of configuring Windows Hello for Business, you need to create a synchronization item based membership of the Windows Hello for Business user group. This ensures the same users who receive Windows Hello for Business policy settings are the same users synchronized to the MFA server (and are the same users with permission to enroll in the certificate). This significantly simplifies deployment and troubleshooting. - -See [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint) for more details. - -##### To add a synchronization item - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Select the **Synchronization** tab. -4. On the **Synchronization** tab, click **Add**. - ![Azure MFA Server - add synchronization item screen](images/hello-mfa-sync-item.png) - -5. In the **Add Synchronization Item** dialog, select **Security Groups** from the **View** list. -6. Select the group you are using for replication from the list of groups -7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. -8. Select **Add new users and Update existing users**. -9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. -10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. -11. Select **Enabled** and select **Only New Users with Phone Number** from the list. -12. Select **Send email** and select **New and Updated Users**. - -##### Configure synchronization item defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Method Defaults** tab. -2. Select the default second factor authentication method. For example, if the second factor of authentication is a text message, select **Text message**. Select if the direction of text message authentication and if the authentication should use a one-time password or one-time password and PIN (Ensure users are configured to create a PIN if the default second factor of communication requires a PIN). - -##### Configure synchronization language defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Language Defaults** tab. -2. Select the appropriate default language for these groups of users synchronized by these synchronization item. -3. If creating a new synchronization item, click **Add** to save the item. If editing an existing synchronization item, click **Apply** and then click **Close**. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint). - -### Installing the MFA Web Services SDK - -The Web Service SDK section allows the administrator to install the Multi-Factor Authentication Web Service SDK. The Web Service SDK is an IIS (Internet Information Server) web service that provides an interface for integrating the full features of the Multi-Factor Authentication Server into most any application. The Web Service SDK uses the Multi-Factor Authentication Server as the data store. - -Remember the Web Services SDK is only need on the primary Multi-Factor to easily enable other servers access to the configuration information. The prerequisites section guided you through installing and configuring the items needed for the Web Services SDK, however the installer will validate the prerequisites and make suggest any corrective action needed. - -Please follow the instructions under [Install the web service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice#install-the-web-service-sdk) to install the MFA Web Services SDK. - -## Install Secondary MFA Servers - -Additional MFA servers provided redundancy of the MFA configuration. The MFA server models uses one primary MFA server with multiple secondary servers. Servers within the same group establish communication with the primary server for that group. The primary server replicates to each of the secondary servers. You can use groups to partition the data stored on different servers, for example you can create a group for each domain, forest, or organizational unit. - -Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. - -Sign in the secondary MFA server with _domain administrator_ equivalent credentials. -1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. - **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. -2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. -3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. -4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. -5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you downloaded the latest Azure MFA Server from the Azure Portal. -* Confirm the server has Internet connectivity. -* Confirm you installed and activated the Azure MFA Server. -* Confirm your Azure MFA Server configuration meets your organization’s needs (Company Settings, Email Settings, etc). -* Confirm you created Directory Synchronization items based on your deployment to synchronize users from Active Directory to the Azure MFA server. - * For example, you have security groups representing each collection of users that represent a phase of your deployment and a corresponding synchronization item for each of those groups. - -* Confirm the Azure MFA server properly communicates with the Azure MFA cloud service by testing multifactor authentication with a newly synchronized user account. -* Confirm you installed the Web Service SDK on the primary MFA server. -* Confirm your MFA servers have adequate redundancy, should you need to promote a secondary server to the primary server. - - -## Installing the User Portal Server - -You previously configured the User Portal settings on the primary MFA server. The User Portal web application communicates to the primary MFA server using the Web Services SDK to retrieve these settings. This configuration is ideal to ensure you can scale up the User Portal application to meet the needs of your internal users. - -### Copying the User Portal Installation file - -Sign in the primary MFA server with _local administrator_ equivalent credentials. -1. Open Windows Explorer. -2. Browse to the C:\Program Files\MultiFactor Authentication Server folder. -3. Copy the **MultiFactorAuthenticationUserPortalSetup64.msi** file to a folder on the User Portal server. - -### Configure Virtual Directory name - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to the folder to which you saved the installation file from the previous step. -2. Run the **MultiFactorAuthenticationUserPortalSetup64.msi**. The installation package asks if you want to download **Visual Studio C++ Redistributable for Visual Studio 2015**. Click **Yes**. When prompted, select **Save As**. The downloaded file is missing its file extension. **Save the file with a .exe extension and install the runtime**. -3. Run the installation package again. The installer package asks about the C++ runtime again; however, this is for the X64 version (the previous prompt was for x86). Click **Yes** to download the installation package and select **Save As** so you can save the downloaded file with a .exe extension. **Install** the run time. -4. Run the User Portal installation package. On the **Select Installation Address** page, use the default settings for **Site** and **Application Pool** settings. You can modify the Virtual directory to use a name that is more fitting for the environment, such as **mfa** (This virtual directory must match the virtual directory specified in the User Portal settings). Click **Next**. -5. Click **Close**. - -### Edit MFA User Portal config file - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to C:\inetpub\wwwroot\MultiFactorAuth (or appropriate directory based on the virtual directory name) and edit the **web.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from **“** to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **web.config** file after changes have been made. - -### Create a DNS entry for the User Portal web site - -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. -1. Open the **DNS Management** console. -2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. -3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. -4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. -6. Close the **DNS Management** console. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. - -### Validating your work - -Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. - -Using a web browser, navigate to the URL provided in the *pf_up_pfwssdk_PfWsSdk* named value in the web.config file of any one of the user portal servers. The URL should be protected by a server authentication certificate and should prompt you for authentication. Authenticate to the web site using the username and password provided in the web.config file. Successful authentication and page view confirms the Web SDK configured on the primary MFA server is correctly configured and ready to work with the user portal. - -### Configuring the User Portal - -The User Portal section allows the administrator to install and configure the Multi-Factor Authentication User Portal. The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. -User Portal Administrators may be set up and granted permission to add new users and update existing users. - -#### Settings - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. - ![Azure MFA Server - User Portal settings](images/hello-mfa-user-portal-settings.png) - -3. On the Settings tab, type the URL your users use to access the User Portal. The URL should begin with https, such as `https://mfaportal.corp.contoso.com/mfa`. -The Multi-Factor Authentication Server uses this information when sending emails to users. -4. Select Allow users to log in and Allow user enrollment check boxes. -5. Select Allow users to select method. Select Phone call and select Text message (you can select Mobile application later once you have deployed the Mobile application web service). Select Automatically trigger user’s default method. -6. Select Allow users to select language. -7. Select Use security questions for fallback and select 4 from the Questions to answer list. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Deploy the user portal for the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal). - -#### Administrators - -The User Portal Settings tab allows the administrator to install and configure the User Portal. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. -3. On the Administrators tab, Click Add -4. In the Add Administrator dialog, Click Select User… to pick a user to install and manage the User Portal. Use the default permissions. -5. Click Add. - ->[!TIP] ->For more information on these settings and the behaviors they control, read the **Multi-Factor Authentication Server Help content**. - -#### Security Questions - -[Security questions](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#security-questions) for the User Portal may be customized to meet your requirements. The questions defined here will be offered as options for each of the four security questions a user is prompted to configure during their first log on to User Portal. The order of the questions is important since the first four items in the list will be used as defaults for the four security questions. - -#### Trusted IPs - -The [Trusted IPs](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#trusted-ips) tab allows you to skip Multi-Factor Authentication for User Portal log ins originating from specific IPs. For example, if users use the User Portal from the office and from home, you may decide you don't want their phones ringing for Multi-Factor Authentication while at the office. For this, you would specify the office subnet as a trusted IP entry. - -## Configure the AD FS Server to use the MFA for multifactor authentication - -You need to configure the AD FS server to use the MFA server. You do this by Installing the MFA Adapter on the primary AD FS Server. - -### Install the MFA AD FS Adapter - -Follow [Install a standalone instance of the AD FS adapter by using the Web Service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12#install-a-standalone-instance-of-the-ad-fs-adapter-by-using-the-web-service-sdk). You should follow this instructions on all AD FS servers. You can find the files needed on the MFA server. - -### Edit the MFA AD FS Adapter config file on all ADFS Servers - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to **C:\inetpub\wwwroot\MultiFactorAuth** (or appropriate directory based on the virtual directory name) and edit the **MultiFactorAuthenticationAdfsAdapter.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from “ to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **MultiFactorAuthenticationAdfsAdapter.config** file after changes have been made. - -### Edit the AD FS Adapter Windows PowerShell cmdlet - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. - -Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath ` to the end of the `Register-AdfsAuthenticationProvider` command where **\** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file. - -### Run the AD FS Adapter PowerShell cmdlet - -Sign in the primary AD FS server with local administrator equivalent credentials. - -Run **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script in PowerShell to register the adapter. The adapter is registered as **WindowsAzureMultiFactorAuthentication**. - ->[!NOTE] ->You must restart the AD FS service for the registration to take effect. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. -* Confirm you restarted the AD FS Service after completing the configuration. - -## Test Multifactor Authentication - -Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. - -1. In the **Multi-Factor Authentication** server, on the left, click **Users**. -2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. -3. Click **Test**. -4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. - -The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. - - -## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) -2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 00344d3bd5..7f7f59156a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -1,6 +1,6 @@ --- -title: Configure Windows Hello for Business Policy settings (Windows Hello for Business) -description: Configure Windows Hello for Business Policy settings for Windows Hello for Business +title: Configure Windows Hello for Business Policy settings - certificate trust +description: Configure Windows Hello for Business Policy settings for Windows Hello for Business. Certificate-based deployments need three group policy settings. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -23,12 +23,9 @@ ms.reviewer: - On-premises deployment - Certificate trust - -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. -Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. - On-premises certificate-based deployments of Windows Hello for Business needs three Group Policy settings: * Enable Windows Hello for Business * Use certificate for on-premises authentication @@ -38,7 +35,7 @@ On-premises certificate-based deployments of Windows Hello for Business needs th The Group Policy setting determines whether users are allowed, and prompted, to enroll for Windows Hello for Business. It can be configured for computers or users. -If you configure the Group Policy for computers, all users that sign-in to those computers will be allowed and prompted to enroll for Windows Hello for Business. If you configure the Group Policy for users, only those users will be allowed and prompted to enroll for Windows Hello for Business. +If you configure the Group Policy for computers, all users that sign-in to those computers will be allowed and prompted to enroll for Windows Hello for Business. If you configure the Group Policy for users, only those users will be allowed and prompted to enroll for Windows Hello for Business . ## Use certificate for on-premises authentication diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index 9a09812b07..0686de8a9a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -1,6 +1,6 @@ --- -title: Validate Active Directory prerequisites (Windows Hello for Business) -description: How to Validate Active Directory prerequisites for Windows Hello for Business +title: Update Active Directory schema for cert-trust deployment (Windows Hello for Business) +description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the certificate trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -24,9 +24,9 @@ ms.reviewer: - Certificate trust -The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the next step. +The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 or later domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 or later schema. If you already have a Windows Server 2016 or later domain controller in your forest, you can skip the **Updating the Schema** and **Create the KeyCredential Admins Security Global Group** steps. -Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. +Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 or later DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. ## Discovering schema role @@ -44,11 +44,12 @@ Windows Hello for Business uses asymmetric keys as user credentials (rather than Sign-in to the domain controller hosting the schema master operational role using enterprise administrator equivalent credentials. -1. Open an elevated command prompt. -2. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. -3. To update the schema, type ```adprep /forestprep```. -4. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema. -5. Close the Command Prompt and sign-out. +1. Mount the ISO file (or insert the DVD) containing the Windows Server 2016 or later installation media. +2. Open an elevated command prompt. +3. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. +4. To update the schema, type ```adprep /forestprep```. +5. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema. +6. Close the Command Prompt and sign-out. ## Create the KeyCredential Admins Security Global Group diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index 13beb24a52..4681b5725d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -1,6 +1,6 @@ --- -title: Validate and Deploy Multifactor Authentication Services (MFA) (Windows Hello for Business) -description: How to Validate and Deploy Multifactor Authentication Services for Windows Hello for Business +title: Validate and Deploy MFA for Windows Hello for Business with certificate trust +description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with certificate trust keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -16,36 +16,19 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Validate and Deploy Multifactor Authentication Services (MFA) +# Validate and Deploy Multi-factor Authentication (MFA) **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Certificate trust +- Windows 10, version 1703 or later +- On-premises deployment +- Certificate trust -Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. Windows Hello for Business deployments use Azure Multi-Factor Authentication (Azure MFA) services for the secondary authentication. On-Premises deployments use Azure MFA server, an on-premises implementation that do not require synchronizing Active Directory credentials to Azure Active Directory. +Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. -Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected. -* **Easy to Use** - Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks. -* **Scalable** - Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom applications. This protection is even extended to your high-volume, mission-critical scenarios. -* **Always Protected** - Azure Multi-Factor Authentication provides strong authentication using the highest industry standards. -* **Reliable** - We guarantee 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification. +For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](https://docs.microsoft.com/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) -## On-Premises Azure MFA Server - -On-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. - -### Infrastructure - -A lab or proof-of-concept environment does not need high-availability or scalability. However, a production environment needs both of these. Ensure your environment considers and incorporates these factors, as necessary. All production environments should have a minimum of two MFA servers—one primary and one secondary server. The environment should have a minimum of two User Portal Servers that are load balanced using hardware or Windows Network Load Balancing. - -Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server. - ->[!IMPORTANT] ->Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use installation instructions provided in the article. - -Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md). +Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 48fdad4ba0..3fc4c88711 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -1,6 +1,6 @@ --- -title: Validate Public Key Infrastructure (Windows Hello for Business) -description: How to Validate Public Key Infrastructure for Windows Hello for Business +title: Validate Public Key Infrastructure - certificate trust model (Windows Hello for Business) +description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a certificate trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -69,7 +69,7 @@ Sign-in to a certificate authority or management workstations with _Domain Admin 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. 5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. **Note**If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. -6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. 8. Close the console. @@ -85,8 +85,8 @@ Sign-in to a certificate authority or management workstations with _Enterprise A 3. In the **Certificate Templates Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. 4. Click the **Superseded Templates** tab. Click **Add**. 5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **Add**. -7. From the **Add Superseded Template** dialog, select the **Kerberos Authentication** certificate template and click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. Click **Add**. +7. From the **Add Superseded Template** dialog, select the **Kerberos Authentication** certificate template and click **OK**. Click **Add**. 8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. 9. Click **OK** and close the **Certificate Templates** console. @@ -104,7 +104,7 @@ Sign-in to a certificate authority or management workstations with _Domain Admin 5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. 6. On the **Request Handling** tab, select **Allow private key to be exported**. -7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. +7. On the **Subject Name** tab, select the **Supply in the request** button if it is not already selected. 8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. 9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. 10. Close the console. @@ -150,7 +150,7 @@ Domain controllers automatically request a certificate from the domain controlle 7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. 8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. 9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box. 11. Select the **Update certificates that use certificate templates** check box. 12. Click **OK**. Close the **Group Policy Management Editor**. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index d43318ad43..c8f3f83f76 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Deployment Guide - On Premises Certificate Trust Deployment -description: A guide to an On Premises, Certificate trust Windows Hello for Business deployment +description: A guide to on premises, certificate trust Windows Hello for Business deployment. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index ffee400b8c..f3f064b1d1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Deployment Guide -description: A guide to Windows Hello for Business deployment +description: Use this deployment guide to successfully deploy Windows Hello for Business in an existing environment. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -21,7 +21,6 @@ ms.reviewer: **Applies to** - Windows 10, version 1703 or later - Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair. This deployment guide is to guide you through deploying Windows Hello for Business, based on the planning decisions made using the Planning a Windows Hello for Business Deployment Guide. It provides you with the information needed to successfully deploy Windows Hello for Business in an existing environment. @@ -43,7 +42,7 @@ Do not begin your deployment until the hosting servers and infrastructure (not r ## Deployment and trust models -Windows Hello for Business has two deployment models: Hybrid and On-premises. Each deployment model has two trust models: *Key trust* or *certificate trust*. +Windows Hello for Business has three deployment models: Cloud, hybrid, and on-premises. Hybrid and on-premises deployment models have two trust models: *Key trust* and *certificate trust*. Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest. @@ -52,18 +51,22 @@ The trust model determines how you want users to authenticate to the on-premises * The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. * The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. ->[!NOTE] ->RDP does not support authentication with Windows Hello for business key trust deployments. RDP is only supported with certificate trust deployments at this time. +> [!NOTE] +> RDP does not support authentication with Windows Hello for Business key trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). -Following are the various deployment guides included in this topic: +Following are the various deployment guides and models included in this topic: - [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) - [Hybrid Azure AD Joined Certificate Trust Deployment](hello-hybrid-cert-trust.md) - [Azure AD Join Single Sign-on Deployment Guides](hello-hybrid-aadj-sso.md) - [On Premises Key Trust Deployment](hello-deployment-key-trust.md) - [On Premises Certificate Trust Deployment](hello-deployment-cert-trust.md) +> [!NOTE] +> For Windows Hello for Business hybrid [certificate trust prerequisites](hello-hybrid-cert-trust-prereqs.md#directory-synchronization) and [key trust prerequisites](hello-hybrid-key-trust-prereqs.md#directory-synchronization) deployments, you will need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. For on-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. Learn how to [deploy Multifactor Authentication Services (MFA) for key trust](hello-key-trust-validate-deploy-mfa.md) and [for certificate trust](hello-cert-trust-validate-deploy-mfa.md) deployments. ## Provisioning Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. +> [!NOTE] +> You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md index f2cdd5b988..e748408fb5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Deployment Guide - On Premises Key Deployment -description: A guide to an On Premises, Certificate trust Windows Hello for Business deployment +description: A guide to on premises, key trust Windows Hello for Business deployment. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 8eecd51ab4..b7bc415c06 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -41,190 +41,65 @@ When a user encounters an error when creating the work PIN, advise the user to t 5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](https://go.microsoft.com/fwlink/p/?LinkId=715697). If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. -

                  Type

                  Builtin local

                  Builtin Local

                  Default container

                  No.

                  Setting

                  Detailed Description

                  No.

                  Setting

                  Detailed Description

                  3

                  Registry key

                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

                  No.

                  Setting

                  Detailed Description

                  No.

                  Setting

                  Detailed Description

                  +| Hex | Cause | Mitigation | +| :--------- | :----------------------------------------------------------------- | :------------------------------------------ | +| 0x80090005 | NTE\_BAD\_DATA | Unjoin the device from Azure AD and rejoin. | +| 0x8009000F | The container or key already exists. | Unjoin the device from Azure AD and rejoin. | +| 0x80090011 | The container or key was not found. | Unjoin the device from Azure AD and rejoin. | +| 0x80090029 | TPM is not set up. | Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. | +| 0x8009002A | NTE\_NO\_MEMORY | Close programs which are taking up memory and try again. | +| 0x80090031 | NTE\_AUTHENTICATION\_IGNORED | Reboot the device. If the error occurs again after rebooting, [reset the TPM](https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650). | +| 0x80090035 | Policy requires TPM and the device does not have TPM. | Change the Windows Hello for Business policy to not require a TPM. | +| 0x80090036 | User canceled an interactive dialog. | User will be asked to try again. | +| 0x801C0003 | User is not authorized to enroll. | Check if the user has permission to perform the operation​. | +| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933). | +| 0x801C000F | Operation successful, but the device requires a reboot. | Reboot the device. | +| 0x801C0010 | The AIK certificate is not valid or trusted. | Sign out and then sign in again. | +| 0x801C0011 | The attestation statement of the transport key is invalid. | Sign out and then sign in again. | +| 0x801C0012 | Discovery request is not in a valid format. | Sign out and then sign in again. | +| 0x801C0015 | The device is required to be joined to an Active Directory domain. | ​Join the device to an Active Directory domain. | +| 0x801C0016 | The federation provider configuration is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file is not empty. | +| 0x801C0017 | ​The federation provider domain is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element is not empty. | +| 0x801C0018 | The federation provider client configuration URL is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL. | +| 0x801C03E9 | Server response message is invalid | Sign out and then sign in again. | +| 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. | +| 0x801C03EB | Server response http status is not valid | Sign out and then sign in again. | +| 0x801C03EC | Unhandled exception from server. | sign out and then sign in again. | +| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.

                  -or-

                  Token was not found in the Authorization header.

                  -or-

                  Failed to read one or more objects.

                  -or-

                  The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. +| 0x801C03EE | Attestation failed. | Sign out and then sign in again. | +| 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | +| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in AAD and the Primary SMTP address are the same in the proxy address. +| 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. | +| | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. | +| 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  HexCauseMitigation
                  0x801C044DAuthorization token does not contain device IDUnjoin the device from Azure AD and rejoin
                  0x80090036User cancelled an interactive dialogUser will be asked to try again
                  0x80090011The container or key was not foundUnjoin the device from Azure AD and rejoin
                  0x8009000FThe container or key already existsUnjoin the device from Azure AD and rejoin
                  0x8009002ANTE_NO_MEMORYClose programs which are taking up memory and try again.
                  0x80090005NTE_BAD_DATAUnjoin the device from Azure AD and rejoin
                  0x80090029TPM is not set up.Sign on with an administrator account. Click Start, type "tpm.msc", and select tpm.msc Microsoft Common Console Document. In the Actions pane, select Prepare the TPM.
                  0x80090031NTE_AUTHENTICATION_IGNOREDReboot the device. If the error occurs again after rebooting, reset the TPM or run Clear-TPM
                  0x80090035Policy requires TPM and the device does not have TPM.Change the Windows Hello for Business policy to not require a TPM.
                  0x801C0003User is not authorized to enrollCheck if the user has permission to perform the operation​.
                  0x801C000ERegistration quota reached

                  Unjoin some other device that is currently joined using the same account or increase the maximum number of devices per user.

                  0x801C000FOperation successful but the device requires a rebootReboot the device.
                  0x801C0010The AIK certificate is not valid or trustedSign out and then sign in again.
                  0x801C0011The attestation statement of the transport key is invalidSign out and then sign in again.
                  0x801C0012Discovery request is not in a valid formatSign out and then sign in again.
                  0x801C0015The device is required to be joined to an Active Directory domain​Join the device to an Active Directory domain.
                  0x801C0016The federation provider configuration is emptyGo to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file is not empty.
                  0x801C0017​The federation provider domain is emptyGo to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element is not empty.
                  0x801C0018The federation provider client configuration URL is emptyGo to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL.
                  0x801C03E9Server response message is invalidSign out and then sign in again.
                  0x801C03EAServer failed to authorize user or device.Check if the token is valid and user has permission to register Windows Hello for Business keys.
                  0x801C03EBServer response http status is not validSign out and then sign in again.
                  0x801C03ECUnhandled exception from server.sign out and then sign in again.
                  0x801C03ED

                  Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed

                  -

                  -or-

                  -

                  Token was not found in the Authorization header

                  -

                  -or-

                  -

                  Failed to read one or more objects

                  -

                  -or-

                  The request sent to the server was invalid.

                  Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin.
                  0x801C03EEAttestation failedSign out and then sign in again.
                  0x801C03EFThe AIK certificate is no longer validSign out and then sign in again.
                  ​0x801C044DUnable to obtain user tokenSign out and then sign in again. Check network and credentials.
                  0x801C044EFailed to receive user creds inputSign out and then sign in again.
                  - ## Errors with unknown mitigation + For errors listed in this table, contact Microsoft Support for assistance. -| Hex | Cause | +| Hex | Cause | |-------------|---------| -| 0x80072f0c | Unknown | -| 0x80070057 | Invalid parameter or argument is passed | -| 0x80090027 | Caller provided wrong parameter. If third-party code receives this error they must change their code. | -| 0x8009002D | NTE\_INTERNAL\_ERROR | -| 0x80090020 | NTE\_FAIL | -| 0x801C0001 | ​ADRS server response is not in valid format | -| 0x801C0002 | Server failed to authenticate the user | -| 0x801C0006 | Unhandled exception from server | -| 0x801C000C | Discovery failed | -| 0x801C001B | ​The device certificate is not found | -| 0x801C000B | Redirection is needed and redirected location is not a well known server | +| 0X80072F0C | Unknown | +| 0x80070057 | Invalid parameter or argument is passed. | +| 0x80090020 | NTE\_FAIL | +| 0x80090027 | Caller provided a wrong parameter. If third-party code receives this error, they must change their code. | +| 0x8009002D | NTE\_INTERNAL\_ERROR | +| 0x801C0001 | ​ADRS server response is not in a valid format. | +| 0x801C0002 | Server failed to authenticate the user. | +| 0x801C0006 | Unhandled exception from server. | +| 0x801C000B | Redirection is needed and redirected location is not a well known server. | +| 0x801C000C | Discovery failed. | +| 0x801C0013 | Tenant ID is not found in the token. | +| 0x801C0014 | User SID is not found in the token. | | 0x801C0019 | ​The federation provider client configuration is empty | -| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty | -| 0x801C0013 | Tenant ID is not found in the token | -| 0x801C0014 | User SID is not found in the token | -| 0x801C03F1 | There is no UPN in the token | -| 0x801C03F0 | ​There is no key registered for the user | -| 0x801C03F1 | ​There is no UPN in the token | -| ​0x801C044C | There is no core window for the current thread | - +| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty. | +| 0x801C001B | ​The device certificate is not found. | +| 0x801C03F0 | ​There is no key registered for the user. | +| 0x801C03F1 | ​There is no UPN in the token. | +| ​0x801C044C | There is no core window for the current thread. | +| 0x801c004D | DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to find the default WAM account to use to request AAD token for provisioning. Unable to enroll a device to use a PIN for login. | + ## Related topics diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md deleted file mode 100644 index d1ba25aae2..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ /dev/null @@ -1,169 +0,0 @@ ---- -title: Windows Hello for Business Frequently Asked Questions -description: Windows Hello for Business FAQ -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Windows Hello for Business Frequently Asked Questions - -**Applies to** -- Windows 10 - -## What about virtual smart cards? -Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future but not date at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends new Windows 10 deployments to use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. - -## What about convenience PIN? -Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. - -## Can I use Windows Hello for Business key trust and RDP? -RDP currently does not support key based authentication and does not support self signed certificates. RDP with Windows Hello for Business is currently only supported with certificate based deployments. - -## Can I deploy Windows Hello for Business using System Center Configuration Manager? -Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no longer be supported after November 2018. - -## How many users can enroll for Windows Hello for Business on a single Windows 10 computer? -The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. - -## How can a PIN be more secure than a password? -When using Windows Hello for Business, the PIN is not a symmetric key where is the password is a symmetric key. With passwords, there is a server that has some representation of the password. With Windows Hello for Business, the PIN is user provided entropy used to load the private key in the TPM. The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM protected key, and the TPM that generated that key to successfully have access to the private key. - -The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It is about the difference of providing entropy vs continuing the use of a symmetric key (the password). The TPM has anti-hammering features which thwart brute-force PIN attacks (an attackers continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increased the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. - -## Why is the Key Admins group missing, I have Windows Server 2016 domain controller(s)? -The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. - -## Can I use a convenience PIN with Azure AD? -It is currently possible to set a convience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises only Domain Joined users and local account users. - -## Can I use an external camera when my laptop is closed or docked? -No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. - -## What is the password-less strategy? -Watch Principal Program Manager Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less** - -[Microsoft's password-less strategy](hello-videos.md#microsofts-passwordless-strategy) - -## What is the user experience for Windows Hello for Business? -The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. - -[Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) - -## What happens when my user forgets their PIN? -If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. - -[Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) - -For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. - -## What URLs do I need to allow for a hybrid deployment? -Communicating with Azure Active Directory uses the following URLs: -- enterpriseregistration.windows.net -- login.microsoftonline.com -- login.windows.net - -If your environment uses Microsoft Intune, you need these additional URLs: -- enrollment.manage-beta.microsoft.com -- enrollment.manage.microsoft.com -- portal.manage-beta.microsoft.com -- portal.manage.microsoft.com - -## What is the difference between non-destructive and destructive PIN reset? -Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-features.md#pin-reset) from our [Windows Hello for Business Features](hello-features.md) page for more information. - -Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. - -## Which is better or more secure: Key trust or Certificate trust? -The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware backed, two-factor credential. The difference between the two trust types are: -- Required domain controllers -- Issuing end entity certificates - -The **key trust** model authenticates to Active Directory using a raw key. Windows Server 2016 domain controllers enables this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you do not need to issue certificates to your end users (domain controller certificates are still needed). -The **certificate trust** model authenticates to Active Directory using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to your end users, but you do not need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM protected private key to request a certificate from your enterprise's issuing certificate authority. - -## Do I need Windows Server 2016 domain controllers? -There are many deployment options from which to choose. Some of those options require an adequate number of Windows Server 2016 domain controllers in the site where you have deployed Windows Hello for Business. There are other deployment options that use existing Windows Server 2008 R2 or later domain controllers. Choose the deployment option that best suits your environment - -## What attributes are synchronized by Azure AD Connect with Windows Hello for Business? -Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that are sync based on scenarios. The base scenarios that include Windows Hello for Business are [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. - -## Is Windows Hello for Business multifactor authentication? -Windows Hello for Business is two-factor authentication based the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". - -## What are the biometric requirements for Windows Hello for Business? -Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. - -## Can I use both a PIN and biometrics to unlock my device? -Starting in Windows 10, version 1709, you can use multi-factor unlock to require the user to provide an additional factor to unlock the device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. Read more about [multifactor unlock](feature-multifactor-unlock.md). - -## What is the difference between Windows Hello and Windows Hello for Business? -Windows Hello represents the biometric framework provided in Windows 10. Windows Hello enables users to use biometrics to sign into their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. - -## Why can't I enroll biometrics for my local built-in Administrator? -Windows 10 does not allow the local administrator to enroll biometric gestures(face or fingerprint). - -## I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? -No. If your organization is federated or using on-line services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organization who need more time before moving to the cloud and exclusively use Active Directory. - -## Does Windows Hello for Business prevent the use of simple PINs? -Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). -So, for example: -* The PIN 1111 has a constant delta of (0,0,0), so it is not allowed -* The PIN 1234 has a constant delta of (1,1,1), so it is not allowed -* The PIN 1357 has a constant delta of (2,2,2), so it is not allowed -* The PIN 9630 has a constant delta of (7,7,7), so it is not allowed -* The PIN 1593 has a constant delta of (4,4,4), so it is not allowed -* The PIN 7036 has a constant delta of (3,3,3), so it is not allowed -* The PIN 1231 does not have a constant delta (1,1,8), so it is allowed -* The PIN 1872 does not have a constant delta (7,9,5), so it is allowed - -This prevents repeating numbers, sequential numbers, and simple patterns. -It always results in a list of 100 disallowed PINs (independent of the PIN length). -This algorithm does not apply to alphanumeric PINs. - -## How does PIN caching work with Windows Hello for Business? - -Windows Hello for Business provides a PIN caching user experience using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. - -Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. - -The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. - -## Can I disable the PIN while using Windows Hello for Business? -No. The movement away from passwords is accomplished by gradually reducing the use of the password. In the occurrence where you cannot authenticate with biometrics, you need a fall back mechanism that is not a password. The PIN is the fall back mechanism. Disabling or hiding the PIN credential provider disabled the use of biometrics. - -## How are keys protected? -Wherever possible, Windows Hello for Business takes advantage of trusted platform module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business does not require a TPM. Administrators can choose to allow key operations in software - -Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to re-authenticate to the IDP before the IDP allows him or her to re-register). - -## Can Windows Hello for Business work in air-gapped environments? -Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require Internet connectivity to achieve an air-gapped Windows Hello for Business deployment. - -## Can I use third-party authentication providers with Windows Hello for Business? -Yes, if you are federated hybrid deployment, you can use any third-party that provides an Active Directory Federation Services (AD FS) multi-factor authentication adapter. A list of third-party MFA adapters can be found [here](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods). - -## Does Windows Hello for Business work with third party federation servers? -Windows Hello for Business can work with any third-party federation servers that support the protocols used during provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration) - -| Protocol | Description | -| :---: | :--- | -| [[MS-KPP]: Key Provisioning Protocol](https://msdn.microsoft.com/library/mt739755.aspx) | Specifies the Key Provisioning Protocol, which defines a mechanism for a client to register a set of cryptographic keys on a user and device pair. | -| [[MS-OAPX]: OAuth 2.0 Protocol Extensions](https://msdn.microsoft.com/library/dn392779.aspx)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and login hints. | -| [[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for Broker Clients](https://msdn.microsoft.com/library/mt590278.aspx) | Specifies the OAuth 2.0 Protocol Extensions for Broker Clients, extensions to RFC6749 (The OAuth 2.0 Authorization Framework) that allow a broker client to obtain access tokens on behalf of calling clients. | -| [[MS-OIDCE]: OpenID Connect 1.0 Protocol Extensions](https://msdn.microsoft.com/library/mt766592.aspx) | Specifies the OpenID Connect 1.0 Protocol Extensions. These extensions define additional claims to carry information about the end user, including the user principal name, a locally unique identifier, a time for password expiration, and a URL for password change. These extensions also define additional provider meta-data that enable the discovery of the issuer of access tokens and give additional information about provider capabilities. | - -## Does Windows Hello for Business work with Mac and Linux clients? -Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third parties who are interested in moving these platforms away from passwords. Interested third parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration) - diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml new file mode 100644 index 0000000000..aae7b07f4a --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -0,0 +1,208 @@ +### YamlMime:FAQ +metadata: + title: Windows Hello for Business Frequently Asked Questions (FAQ) + description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. + keywords: identity, PIN, biometric, Hello, passport + ms.prod: w10 + ms.mktglfcycl: deploy + ms.sitesec: library + ms.pagetype: security, mobile + audience: ITPro + author: mapalko + ms.author: mapalko + manager: dansimp + ms.collection: M365-identity-device-management + ms.topic: article + localizationpriority: medium + ms.date: 08/19/2018 + ms.reviewer: + +title: Windows Hello for Business Frequently Asked Questions (FAQ) +summary: | + Applies to: Windows 10 + + +sections: + - name: Ignored + questions: + - question: What about virtual smart cards? + answer: | + Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. + + - question: What about convenience PIN? + answer: | + Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends that customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. + + - question: Can I use Windows Hello for Business key trust and RDP? + answer: | + Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. RDP with supplied credentials is currently only supported with certificate-based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). + + - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? + answer: | + Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-hello-for-business-settings). + + - question: How many users can enroll for Windows Hello for Business on a single Windows 10 computer? + answer: | + The maximum number of supported enrollments on a single Windows 10 computer is 10. This lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. + + - question: How can a PIN be more secure than a password? + answer: | + When using Windows Hello for Business, the PIN is not a symmetric key, whereas the password is a symmetric key. With passwords, there's a server that has some representation of the password. With Windows Hello for Business, the PIN is user-provided entropy used to load the private key in the Trusted Platform Module (TPM). The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM-protected key, and the TPM that generated that key in order to successfully access the private key. + + The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It's about the difference between providing entropy versus continuing the use of a symmetric key (the password). The TPM has anti-hammering features that thwart brute-force PIN attacks (an attacker's continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increase the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. + + - question: I have Windows Server 2016 domain controller(s), so why is the Key Admins group missing? + answer: | + The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. + + - question: Can I use a convenience PIN with Azure Active Directory? + answer: | + It's currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts (synchronized identities included). It's only supported for on-premises Domain Joined users and local account users. + + - question: Can I use an external camera when my laptop is closed or docked? + answer: | + No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. + + - question: Why does authentication fail immediately after provisioning hybrid key trust? + answer: | + In a hybrid deployment, a user's public key must sync from Azure AD to AD before it can be used to authenticate against a domain controller. This sync is handled by Azure AD Connect and will occur during a normal sync cycle. + + - question: What is the password-less strategy? + answer: | + Watch Principal Program Manager Karanbir Singh's **Microsoft's guide for going password-less** Ignite 2017 presentation. + + [Microsoft's password-less strategy](hello-videos.md#microsofts-passwordless-strategy) + + - question: What is the user experience for Windows Hello for Business? + answer: | + The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. + + [Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) + + - question: What happens when a user forgets their PIN? + answer: | + If the user can sign-in with a password, they can reset their PIN by selecting the "I forgot my PIN" link in Settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by selecting the "I forgot my PIN" link on the PIN credential provider. + + [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) + + For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. + + - question: What URLs do I need to allow for a hybrid deployment? + answer: | + Communicating with Azure Active Directory uses the following URLs: + - enterpriseregistration.windows.net + - login.microsoftonline.com + - login.windows.net + - account.live.com + - accountalt.azureedge.net + - secure.aadcdn.microsoftonline-p.com + + If your environment uses Microsoft Intune, you need these additional URLs: + - enrollment.manage.microsoft.com + - portal.manage.microsoft.com + + - question: What's the difference between non-destructive and destructive PIN reset? + answer: | + Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once onboarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provide a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user doesn't delete the current credential and obtain a new one. For more information, see [PIN Reset](hello-feature-pin-reset.md). + + Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. With destructive PIN reset, users that have forgotten their PIN can authenticate by using their password and then performing a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. + + - question: | + Which is better or more secure: key trust or certificate trust? + answer: | + The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: + - Required domain controllers + - Issuing end entity certificates + + The **key trust** model authenticates to Active Directory by using a raw key. Windows Server 2016 domain controllers enable this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you don't need to issue certificates to users (domain controller certificates are still needed). + + The **certificate trust** model authenticates to Active Directory by using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to users, but you don't need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM-protected private key to request a certificate from your enterprise's issuing certificate authority. + + - question: Do I need Windows Server 2016 domain controllers? + answer: | + There are many deployment options from which to choose. Some of those options require an adequate number of Windows Server 2016 domain controllers in the site where you've deployed Windows Hello for Business. There are other deployment options that use existing Windows Server 2008 R2 or later domain controllers. Choose the deployment option that best suits your environment. + + - question: What attributes are synchronized by Azure AD Connect with Windows Hello for Business? + answer: | + Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that sync based on scenarios. The base scenarios that include Windows Hello for Business are the [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. + + - question: Is Windows Hello for Business multifactor authentication? + answer: | + Windows Hello for Business is two-factor authentication based on the observed authentication factors of: something you have, something you know, and something that's part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. By using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". + + - question: What are the biometric requirements for Windows Hello for Business? + answer: | + Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. + + - question: Can I use both a PIN and biometrics to unlock my device? + answer: | + Starting in Windows 10, version 1709, you can use multi-factor unlock to require users to provide an additional factor to unlock their device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. To learn more, see [Multifactor Unlock](feature-multifactor-unlock.md). + + - question: What's the difference between Windows Hello and Windows Hello for Business? + answer: | + Windows Hello represents the biometric framework provided in Windows 10. Windows Hello lets users use biometrics to sign in to their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. + + - question: Why can't I enroll biometrics for my local, built-in administrator? + answer: | + Windows 10 does not allow the local administrator to enroll biometric gestures (face or fingerprint). + + - question: I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? + answer: | + No. If your organization is federated or using online services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organizations who need more time before moving to the cloud and exclusively use Active Directory. + + - question: Does Windows Hello for Business prevent the use of simple PINs? + answer: | + Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). + So, for example: + + - The PIN 1111 has a constant delta of (0,0,0), so it is not allowed + - The PIN 1234 has a constant delta of (1,1,1), so it is not allowed + - The PIN 1357 has a constant delta of (2,2,2), so it is not allowed + - The PIN 9630 has a constant delta of (7,7,7), so it is not allowed + - The PIN 1593 has a constant delta of (4,4,4), so it is not allowed + - The PIN 7036 has a constant delta of (3,3,3), so it is not allowed + - The PIN 1231 does not have a constant delta (1,1,8), so it is allowed + - The PIN 1872 does not have a constant delta (7,9,5), so it is allowed + + This prevents repeating numbers, sequential numbers, and simple patterns. It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm does not apply to alphanumeric PINs. + + - question: How does PIN caching work with Windows Hello for Business? + answer: | + Windows Hello for Business provides a PIN caching user experience by using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting, as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. + + Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. + + The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. + + - question: Can I disable the PIN while using Windows Hello for Business? + answer: | + No. The movement away from passwords is accomplished by gradually reducing the use of the password. In situations where you can't authenticate by using biometrics, you need a fallback mechanism that is not a password. The PIN is the fallback mechanism. Disabling or hiding the PIN credential provider will disable the use of biometrics. + + - question: How are keys protected? + answer: | + Wherever possible, Windows Hello for Business takes advantage of Trusted Platform Module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business do not require a TPM. Administrators can choose to allow key operations in software. + + Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will need to reset the PIN (which means they'll need to use MFA to re-authenticate to the IDP before the IDP allows them to re-register). + + - question: Can Windows Hello for Business work in air-gapped environments? + answer: | + Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require internet connectivity to achieve an air-gapped Windows Hello for Business deployment. + + - question: Can I use third-party authentication providers with Windows Hello for Business? + answer: | + Yes, if you're using federated hybrid deployment, you can use any third-party that provides an Active Directory Federation Services (AD FS) multi-factor authentication adapter. A list of third-party MFA adapters can be found [here](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods). + + - question: Does Windows Hello for Business work with third-party federation servers? + answer: | + Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration).

                  + + | Protocol | Description | + | :---: | :--- | + | [[MS-KPP]: Key Provisioning Protocol](https://msdn.microsoft.com/library/mt739755.aspx) | Specifies the Key Provisioning Protocol, which defines a mechanism for a client to register a set of cryptographic keys on a user and device pair. | + | [[MS-OAPX]: OAuth 2.0 Protocol Extensions](https://msdn.microsoft.com/library/dn392779.aspx)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and login hints. | + | [[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for Broker Clients](https://msdn.microsoft.com/library/mt590278.aspx) | Specifies the OAuth 2.0 Protocol Extensions for Broker Clients, extensions to RFC6749 (the OAuth 2.0 Authorization Framework) that allow a broker client to obtain access tokens on behalf of calling clients. | + | [[MS-OIDCE]: OpenID Connect 1.0 Protocol Extensions](https://msdn.microsoft.com/library/mt766592.aspx) | Specifies the OpenID Connect 1.0 Protocol Extensions. These extensions define additional claims to carry information about the user, including the user principal name, a locally unique identifier, a time for password expiration, and a URL for password change. These extensions also define additional provider meta-data that enables the discovery of the issuer of access tokens and gives additional information about provider capabilities. | + + - question: Does Windows Hello for Business work with Mac and Linux clients? + answer: | + Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md new file mode 100644 index 0000000000..470d856d45 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -0,0 +1,48 @@ +--- +title: Conditional Access +description: Ensure that only approved users can access your devices, applications, and services from anywhere by enabling single sign-on with Azure Active Directory. +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Conditional access + +**Requirements:** + +* Azure Active Directory +* Hybrid Windows Hello for Business deployment + +In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, applications, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS applications, IT professionals are faced with two opposing goals: + +* Empower the end users to be productive wherever and whenever +* Protect the corporate assets at any time + +To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. + +> [!NOTE] +> For more details about the way Windows Hello for Business interacts with Azure AD Multi-Factor Authentication and Conditional Access, see [this article](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032). + +Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md new file mode 100644 index 0000000000..028fdd4868 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -0,0 +1,90 @@ +--- +title: Dual Enrollment +description: Learn how to configure Windows Hello for Business dual enrollment. Also, learn how to configure Active Directory to support Domain Administrator enrollment. +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, dual enrollment, +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Dual Enrollment + +**Requirements** + +* Hybrid and On-premises Windows Hello for Business deployments +* Enterprise Joined or Hybrid Azure joined devices +* Windows 10, version 1709 + +> [!NOTE] +> This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. + +> [!IMPORTANT] +> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information. + +Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device. + +By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices. + +With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads. + +> [!IMPORTANT] +> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation. + +## Configure Windows Hello for Business Dual Enrollment + +In this task you will + +* Configure Active Directory to support Domain Administrator enrollment +* Configure Dual Enrollment using Group Policy + +### Configure Active Directory to support Domain Administrator enrollment + +The designed Windows Hello for Business configuration gives the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. + +Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. + +Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. + +1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
                  +```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
                  +where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
                  +```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink``` +2. To trigger security descriptor propagation, open **ldp.exe**. +3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**. +4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user. +5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**. +6. Click **Run** to start the task. +7. Close LDP. + +### Configuring Dual Enrollment using Group Policy + +You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users. +2. Edit the Group Policy object from step 1. +3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. +5. Restart computers targeted by this Group Policy object. + +The computer is ready for dual enrollment. Sign-in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign-out and sign-in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md new file mode 100644 index 0000000000..53985965fb --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -0,0 +1,70 @@ +--- +title: Dynamic lock +description: Learn how to set Dynamic lock on Windows 10 devices, by configuring group policies. This feature locks a device when a Bluetooth signal falls below a set value. +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Dynamic lock + +**Requirements:** + +* Windows 10, version 1703 + +Dynamic lock enables you to configure Windows 10 devices to automatically lock when Bluetooth paired device signal falls below the maximum Received Signal Strength Indicator (RSSI) value. This makes it more difficult for someone to gain access to your device if you step away from your PC and forget to lock it. + +You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. The name of the policy is **Configure dynamic lock factors**. + +The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: + +``` + + + +``` + +>[!IMPORTANT] +>Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. + +For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** is configurable but Phone is the only currently supported configuration. The attribute defaults to Phones sand uses the values from the following table: + +|Description|Value| +|:-------------|:-------:| +|Miscellaneous|0| +|Computer|256| +|Phone|512| +|LAN/Network Access Point|768| +|Audio/Video|1024| +|Peripheral|1280| +|Imaging|1536| +|Wearable|1792| +|Toy|2048| +|Health|2304| +|Uncategorized|7936| + +The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. + +RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md new file mode 100644 index 0000000000..e4e7af1253 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -0,0 +1,127 @@ +--- +title: Pin Reset +description: Learn how Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. +keywords: identity, PIN, Hello, passport, WHFB, hybrid, cert-trust, device, reset +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# PIN reset + +**Applies to:** + +- Windows 10, version 1709 or later + +## Hybrid Deployments + +**Requirements:** + +- Azure Active Directory +- Hybrid Windows Hello for Business deployment +- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined +- Windows 10, version 1709 to 1809, **Enterprise Edition**. There is no licensing requirement for this feature since version 1903. + +The Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. + +>[!IMPORTANT] +> The Microsoft PIN Reset service only works with **Enterprise Edition** for Windows 10, version 1709 to 1809. The feature works with **Enterprise Edition** and **Pro** edition with Windows 10, version 1903 and newer. + +### Onboarding the Microsoft PIN reset service to your Intune tenant + +Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage. + +### Connect Azure Active Directory with the PIN reset service + +1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. +2. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. +![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) +3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. +4. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. + +> [!NOTE] +> After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. + +![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) + +5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. +![PIN reset service permissions page](images/pinreset/pin-reset-applications.png) + +### Configure Windows devices to use PIN reset using Group Policy + +You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. +2. Edit the Group Policy object from step 1. +3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. + +#### Create a PIN Reset Device configuration profile using Microsoft Intune + +1. Sign-in to [Enpoint Manager admin center](https://endpoint.microsoft.com/) using a Global administrator account. +2. Click **Endpoint Security**-> **Account Protection**-> **Properties**. +3. Set **Enable PIN recovery** to **Yes**. + +> [!NOTE] +> You can also setup PIN recovery using configuration profiles. +> 1. Sign in to Endpoint Manager. +> 2. Click **Devices** -> **Configuration Profiles** -> Create a new profile or edit an existing profile using the Identity Protection profile type. +> 3. Set **Enable PIN recovery** to **Yes**. + +#### Assign the PIN Reset Device configuration profile using Microsoft Intune + +1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account. +2. Navigate to the Microsoft Intune blade. Choose **Device configuration** > **Profiles**. From the list of device configuration profiles, choose the profile that contains the PIN reset configuration. +3. In the device configuration profile, select **Assignments**. +4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. + +## On-premises Deployments + +**Requirements** + +* Active Directory +* On-premises Windows Hello for Business deployment +* Reset from settings - Windows 10, version 1703, Professional +* Reset above Lock - Windows 10, version 1709, Professional + +On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business. + +>[!IMPORTANT] +>Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs. + +### Reset PIN from Settings + +1. Sign-in to Windows 10, version 1703 or later using an alternate credential. +2. Open **Settings**, click **Accounts**, click **Sign-in options**. +3. Under **PIN**, click **I forgot my PIN** and follow the instructions. + +#### Reset PIN above the Lock Screen + + 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in + 2. Enter your password and press enter. + 3. Follow the instructions provided by the provisioning process + 4. When finished, unlock your desktop using your newly created PIN. + +>[!NOTE] +> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video. + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md new file mode 100644 index 0000000000..0ebcd33ec5 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -0,0 +1,74 @@ +--- +title: Remote Desktop +description: Learn how Windows Hello for Business supports using a certificate deployed to a WHFB container to a remote desktop to a server or another device. +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, remote desktop, RDP +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/16/2020 +ms.reviewer: +--- + +# Remote Desktop + +**Requirements** + +- Windows 10 +- Certificate trust deployments +- Hybrid and On-premises Windows Hello for Business deployments +- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices +- Certificate trust deployments + +Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). + +Microsoft continues to investigate supporting using keys trust for supplied credentials in a future release. + +## Remote Desktop with Biometrics + +**Requirements** + +- Hybrid and On-premises Windows Hello for Business deployments +- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices +- Certificate trust deployments +- Biometric enrollments +- Windows 10, version 1809 + +Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. + +### How does it work + +Windows generates and stores cryptographic keys using a software component called a key storage provider (KSP). Software-based keys are created and stored using the Microsoft Software Key Storage Provider. Smart card keys are created and stored using the Microsoft Smart Card Key Storage Provider. Keys created and protected by Windows Hello for Business are created and stored using the Microsoft Passport Key Storage Provider. + +A certificate on a smart card starts with creating an asymmetric key pair using the Microsoft Smart Card KSP. Windows requests a certificate based on the key pair from your enterprises issuing certificate authority, which returns a certificate that is stored in the user's Personal certificate store. The private key remains on the smart card and the public key is stored with the certificate. Metadata on the certificate (and the key) store the key storage provider used to create the key (remember the certificate contains the public key). + +This same concept applies to Windows Hello for Business. Except, the keys are created using the Microsoft Passport KSP and the user's private key remains protected by the device's security module (TPM) and the user's gesture (PIN/biometric). The certificate APIs hide this complexity. When an application uses a certificate, the certificate APIs locate the keys using the saved key storage provider. The key storage providers directs the certificate APIs on which provider they use to find the private key associated with the certificate. This is how Windows knows you have a smart card certificate without the smart card inserted (and prompts you to insert the smart card). + +Windows Hello for Business emulates a smart card for application compatibility. Versions of Windows 10 prior to version 1809, would redirect private key access for Windows Hello for Business certificate to use its emulated smart card using the Microsoft Smart Card KSP, which would enable the user to provide their PIN. Windows 10, version 1809 no longer redirects private key access for Windows Hello for Business certificates to the Microsoft Smart Card KSP-- it continues using the Microsoft Passport KSP. The Microsoft Passport KSP enabled Windows 10 to prompt the user for their biometric gesture or PIN. + +### Compatibility + +Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. + +![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) + +> [!IMPORTANT] +> The remote desktop with biometric feature does not work with [Dual Enrollment](hello-feature-dual-enrollment.md) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md index 37591f1f54..d35d4dea64 100644 --- a/windows/security/identity-protection/hello-for-business/hello-features.md +++ b/windows/security/identity-protection/hello-for-business/hello-features.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Features -description: Windows Hello for Business Features +description: Consider additional features you can use after your organization deploys Windows Hello for Business. ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E ms.reviewer: keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, PIN Reset, Dynamic Lock, Multifactor Unlock, Forgot PIN, Privileged credentials @@ -15,252 +15,35 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 05/05/2018 +ms.date: 11/27/2019 --- # Windows Hello for Business Features **Applies to:** -- Windows 10 -Consider these additional features you can use after your organization deploys Windows Hello for Business. +- Windows 10 -- [Conditional access](#conditional-access) -- [Dynamic lock](#dynamic-lock) -- [PIN reset](#pin-reset) -- [Dual Enrollment](#dual-enrollment) -- [Remote Desktop with Biometrics](#remote-desktop-with-biometrics) +Consider these additional features you can use after your organization deploys Windows Hello for Business. -## Conditional access +## Conditional access -**Requirements:** -* Azure Active Directory -* Hybrid Windows Hello for Business deployment - - -In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, applications, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS applications, IT professionals are faced with two opposing goals:+ -* Empower the end users to be productive wherever and whenever -* Protect the corporate assets at any time - -To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. - -Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. +Azure Active Directory provides a wide set of options for protecting access to corporate resources. Conditional access provides more fine grained control over who can access certain resources and under what conditions. For more information see [Conditional Access](hello-feature-conditional-access.md). ## Dynamic lock -**Requirements:** -* Windows 10, version 1703 - -Dynamic lock enables you to configure Windows 10 devices to automatically lock when Bluetooth paired device signal falls below the maximum Received Signal Strength Indicator (RSSI) value. You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. The name of the policy is **Configure dynamic lock factors**. - -The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: - ->[!IMPORTANT] ->Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. - -``` - - - -``` - -For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** attribute defaults Phones and uses the values from the following table - -|Description|Value| -|:-------------|:-------:| -|Miscellaneous|0| -|Computer|256| -|Phone|512| -|LAN/Network Access Point|768| -|Audio/Video|1024| -|Peripheral|1280| -|Imaging|1536| -|Wearable|1792| -|Toy|2048| -|Health|2304| -|Uncategorized|7936| - -The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. - -RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. +Dynamic lock uses a paired Bluetooth device to determine user presence and locks the device if a user is not present. For more information and configuration steps see [Dynamic Lock](hello-feature-dynamic-lock.md). ## PIN reset -**Applies to:** -- Windows 10, version 1709 or later - - -### Hybrid Deployments - -**Requirements:** -- Azure Active Directory -- Hybrid Windows Hello for Business deployment -- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined -- Windows 10, version 1709 or later, **Enterprise Edition** - -The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. - ->[!IMPORTANT] -> The Microsoft PIN Reset service only works with Windows 10, version 1709 or later **Enterprise Edition**. The feature does not work with the **Pro** edition.] - -#### Onboarding the Microsoft PIN reset service to your Intune tenant - -Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage. - -#### Connect Azure Active Directory with the PIN reset service - -1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. -2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
                  -![PIN reset service application in Azure](images/pinreset/pin-reset-service-home-screen.png)
                  -3. In the Azure portal, you can verify that the Microsoft PIN reset service is integrated from the **Enterprise applications**, **All applications** blade.
                  -![PIN reset service permissions page](images/pinreset/pin-reset-service-application.png) - -#### Configure Windows devices to use PIN reset using Group Policy -You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. - -1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. -2. Edit the Group Policy object from step 1. -3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. -4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. - -#### Configure Windows devices to use PIN reset using Microsoft Intune -To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): - -##### Create a PIN Reset Device configuration profile using Microsoft Intune - -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. -2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
                  - ``` - dsregcmd /status | findstr -snip "tenantid" - ``` -3. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. -4. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. -5. In the **Custom OMA-URI Settings** blade, Click **Add**. -6. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. -7. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. -8. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. - -##### Assign the PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. -2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. -3. In the device configuration profile, click **Assignments**. -4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. - -### On-premises Deployments - -**Requirements** -* Active Directory -* On-premises Windows Hello for Business deployment -* Reset from settings - Windows 10, version 1703, Professional -* Reset above Lock - Windows 10, version 1709, Professional - -On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business. - ->[!IMPORTANT] ->Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs. - -#### Reset PIN from Settings -1. Sign-in to Windows 10, version 1703 or later using an alternate credential. -2. Open **Settings**, click **Accounts**, click **Sign-in options**. -3. Under **PIN**, click **I forgot my PIN** and follow the instructions. - -#### Reset PIN above the Lock Screen - 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in - 2. Enter your password and press enter. - 3. Follow the instructions provided by the provisioning process - 4. When finished, unlock your desktop using your newly created PIN. - ->[!NOTE] -> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video. +Windows Hello for Business supports user self-management of their PIN. If a user forgets their PIN, they have the ability to reset it from Settings or the lock screen. The Microsoft PIN reset service can be used for completing this reset without the user needing to enroll a new Windows Hello for Business credential. For more information and configuration steps see [Pin Reset](hello-feature-pin-reset.md). ## Dual Enrollment -**Requirements** -* Hybrid and On-premises Windows Hello for Business deployments -* Enterprise Joined or Hybrid Azure joined devices -* Windows 10, version 1709 +This feature enables provisioning of administrator Windows Hello for Business credentials that can be used by non-privileged accounts to perform administrative actions. These credentials can be used from the non-privileged accounts using **Run as different user** or **Run as administrator**. For more information and configuration steps see [Dual Enrollment](hello-feature-dual-enrollment.md). -> [!NOTE] -> This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. +## Remote Desktop -> [!IMPORTANT] -> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information. - -Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device. - -By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices. - -With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads. - -> [!IMPORTANT] -> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation. - -### Configure Windows Hello for Business Dual Enroll -In this task you will -- Configure Active Directory to support Domain Administrator enrollment -- Configure Dual Enrollment using Group Policy - -#### Configure Active Directory to support Domain Administrator enrollment -The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. - -Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but will they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. - -Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. - -1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
                  -```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
                  -where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
                  -```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink``` -2. To trigger security descriptor propagation, open **ldp.exe**. -3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**. -4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user. -5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**. -6. Click **Run** to start the task. -7. Close LDP. - -#### Configuring Dual Enrollment using Group Policy -You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object. - -1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users. -2. Edit the Group Policy object from step 1. -3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. -4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. -5. Restart computers targeted by this Group Policy object. - -The computer is ready for dual enrollment. Sign-in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign-out and sign-in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users. - -## Remote Desktop with Biometrics - -> [!Warning] -> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -**Requirements** -- Hybrid and On-premises Windows Hello for Business deployments -- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices -- Certificate trust deployments -- Biometric enrollments -- Windows 10, version 1809 - -Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. - -> [!IMPORTANT] -> The remote desktop with biometrics feature only works with certificate trust deployments. The feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Microsoft continues to investigate supporting this feature for key trust deployments. - -### How does it work -It start with creating cryptographic keys. Windows generates and stores cryptographic keys using a software component called a key storage provider (KSP). Software-based keys are created and stored using the Microsoft Software Key Storage Provider. Smart card keys are created and stored using the Microsoft Smart Card Key Storage Provider. Keys created and protected by Windows Hello for Business are created and stored using the Microsoft Passport Key Storage Provider. - -A certificate on a smart card starts with creating an asymmetric key pair using the Microsoft Smart Card KSP. Windows requests a certificate based on the key pair from your enterprises issuing certificate authority, which returns a certificate that is stored in the user's Personal certificate store. The private key remains on the smart card and the public key is stored with the certificate. Metadata on the certificate (and the key) store the key storage provider used to create the key (remember the certificate contains the public key). - -This same concept applies to Windows Hello for Business. Except, the keys are created using the Microsoft Passport KSP and the user's private key remains protected by the device's security module (TPM) and the user's gesture (PIN/biometric). The certificate APIs hide this complexity. When an application uses a certificate, the certificate APIs locate the keys using the saved key storage provider. The key storage providers directs the certificate APIs on which provider they use to find the private key associated with the certificate. This is how Windows knows you have a smart card certificate without the smart card inserted (and prompts you to insert the smart card). - -Windows Hello for Business emulates a smart card for application compatibility. Versions of Windows 10 prior to version 1809, would redirect private key access for Windows Hello for Business certificate to use its emulated smart card using the Microsoft Smart Card KSP, which would enable the user to provide their PIN. Windows 10, version 1809 no longer redirects private key access for Windows Hello for Business certificates to the Microsoft Smart Card KSP-- it continues using the Microsoft Passport KSP. The Microsoft Passport KSP enabled Windows 10 to prompt the user for their biometric gesture or PIN. - -### Compatibility -Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. - -![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) - -> [!IMPORTANT] -> The remote desktop with biometric feature does not work with [Dual Enrollment](#dual-enrollment) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. +Users with Windows Hello for Business certificate trust can use their credential to authenticate to remote desktop sessions over RDP. When authenticating to the session, biometric gestures can be used if they are enrolled. For more information and configuration steps see [Remote Desktop](hello-feature-remote-desktop.md). ## Related topics diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index d30031df7d..cb21e54fe3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -1,6 +1,6 @@ --- title: How Windows Hello for Business works - Authentication -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Learn about the authentication flow for Windows Hello for Business. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -74,6 +74,9 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
                  The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
                  The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| +> [!IMPORTANT] +> In the above deployment model, a newly provisioned user will not be able to sign in using Windows Hello for Business until (a) Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory and (b) device has line of sight to the domain controller for the first time. + ## Hybrid Azure AD join authentication using a Certificate ![Hybrid Azure AD join authentication using a Certificate](images/howitworks/auth-haadj-certtrust.png) @@ -87,3 +90,5 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
                  The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
                  The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| +> [!IMPORTANT] +> In the above deployment model, a newly provisioned user will not be able to sign in using Windows Hello for Business unless the device has line of sight to the domain controller for the first time. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md index 4cbec54f34..e91ce1f65c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md @@ -63,11 +63,11 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning | Phase | Description | | :----: | :----------- | -| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task.| +| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in.| |B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.| |C | For the managed environment, the task creates an initial authentication credential in the form of a self-signed certificate. The task write the certificate to the userCertificate attribute on the computer object in Active Directory using LDAP. |D |The computer cannot authenticate to Azure DRS until a device object representing the computer that includes the certificate on the userCertificate attribute is created in Azure Active Directory. Azure AD Connect detects an attribute change. On the next synchronization cycle, Azure AD Connect sends the userCertificate, object GUID, and computer SID to Azure DRS. Azure DRS uses the attribute information to create a device object in Azure Active Directory.| -|E | The Automatic Device Join task triggers with each user sign-in and tries to authenticate the computer to Azure Active Directory using the corresponding private key of the public key in the userCertificate attribute. Azure Active Directory authenticates the computer and issues a ID token to the computer.| +|E | The Automatic Device Join task triggers with each user sign-in or every hour, and tries to authenticate the computer to Azure Active Directory using the corresponding private key of the public key in the userCertificate attribute. Azure Active Directory authenticates the computer and issues a ID token to the computer.| |F | The task creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| |G | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then updates the device object in Azure Active Directory and sends the device ID and the device certificate to the client.| |H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.| @@ -78,7 +78,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning | Phase | Description | | :----: | :----------- | -| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task.| +| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in. | |B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.| |C | For the federated environments, the computer authenticates the enterprise device registration endpoint using Windows integrated authentication. The enterprise device registration service creates and returns a token that includes claims for the object GUID, computer SID, and domain joined state. The task submits the token and claims to Azure Active Directory where it is validated. Azure Active Directory returns an ID token to the running task. |D | The application creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 9a2711dc1c..0fb161ccb5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -1,6 +1,6 @@ --- title: How Windows Hello for Business works - Provisioning -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -17,7 +17,7 @@ ms.reviewer: --- # Windows Hello for Business Provisioning -Applies to: +Applies to: - Windows 10 Windows Hello for Business provisioning enables a user to enroll a new, strong, two-factor credential that they can use for passwordless authentication. Provisioning experience vary based on: @@ -32,6 +32,8 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Domain joined provisioning in an On-premises Key Trust deployment](#domain-joined-provisioning-in-an-on-premises-key-trust-deployment)
                  [Domain joined provisioning in an On-premises Certificate Trust deployment](#domain-joined-provisioning-in-an-on-premises-certificate-trust-deployment)
                  +> [!NOTE] +> The flows in this section are not exhaustive for every possible scenario. For example, Federated Key Trust is also a supported configuration. ## Azure AD joined provisioning in a Managed environment @@ -56,7 +58,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed ennvironment](images/howitworks/prov-haadj-keytrust-managed.png) +![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](images/howitworks/prov-haadj-keytrust-managed.png) | Phase | Description | diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md index 723a2e1e54..0e03beb9e3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md @@ -1,6 +1,6 @@ --- -title: How Windows Hello for Business works - Techincal Deep Dive -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +title: How Windows Hello for Business works - Technical Deep Dive +description: Deeply explore how Windows Hello for Business works, and how it can help your users authenticate to services. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, works ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index f32db55329..72cba7a12e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -1,6 +1,6 @@ --- title: How Windows Hello for Business works - Technology and Terms -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Explore technology and terms associated with Windows Hello for Business. Learn how Windows Hello for Business works. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -162,7 +162,7 @@ Primarily for large enterprise organizations with more complex authentication re For more than a decade, many organizations have used the domain join to their on-premises Active Directory to enable: - IT departments to manage work-owned devices from a central location. - Users to sign in to their devices with their Active Directory work or school accounts. -Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use System Center Configuration Manager (SCCM) or group policy (GP) to manage them. +Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use Microsoft Endpoint Configuration Manager or group policy (GP) to manage them. If your environment has an on-premises AD footprint and you also want benefit from the capabilities provided by Azure Active Directory, you can implement hybrid Azure AD joined devices. These are devices that are both, joined to your on-premises Active Directory and your Azure Active Directory. @@ -285,7 +285,7 @@ A TPM implements controls that meet the specification described by the Trusted C - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. -Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). +Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-recommendations). Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index cec799fa3d..528c1b6fe8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -1,6 +1,6 @@ --- title: How Windows Hello for Business works -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Learn how Windows Hello for Business works, and how it can help your users authenticate to services. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -18,16 +18,23 @@ ms.reviewer: # How Windows Hello for Business works **Applies to** + - Windows 10 -Windows Hello for Business is a modern, two-factor credential that is the more secure alternative to passwords. Whether you are cloud or on-premises, Windows Hello for Business has a deployment option for you. For cloud deployments, you can use Windows Hello for Business with Azure Active Directory joined, Hybrid Azure Active Directory joined, or Azure Active Directory registered devices. Windows Hello for Business also works for domain joined devices. +Windows Hello for Business is a modern, two-factor credential that is the more secure alternative to passwords. Whether you are cloud or on-premises, Windows Hello for Business has a deployment option for you. For cloud deployments, you can use Windows Hello for Business with Azure Active Directory joined, Hybrid Azure Active Directory joined, or Azure Active Directory registered devices. Windows Hello for Business also works for domain joined devices. Watch this quick video where Pieter Wigleven gives a simple explanation of how Windows Hello for Business works and some of its supporting features. > [!VIDEO https://www.youtube.com/embed/G-GJuDWbBE8] ## Technical Deep Dive + Windows Hello for Business is a distributed system that uses several components to accomplish device registration, provisioning, and authentication. Use this section to gain a better understanding of each of the components and how they support Windows Hello for Business. +Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business provisioning and authentication work. + +> [!VIDEO https://www.youtube.com/embed/RImGsIjSJ1s] +> [!VIDEO https://www.youtube.com/embed/WPmzoP_vMek] + - [Technology and Terminology](hello-how-it-works-technology.md) - [Device Registration](hello-how-it-works-device-registration.md) - [Provisioning](hello-how-it-works-provisioning.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index d1c11a2a8c..cd9f264b8a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -1,6 +1,6 @@ --- title: Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business -description: Azure Active Directory joined devices in a hybrid Deployment for on-premises single sign-on +description: Before adding Azure Active Directory (Azure AD) joined devices to your existing hybrid deployment, you need to verify the existing deployment can support them. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy @@ -33,6 +33,7 @@ Before adding Azure Active Directory (Azure AD) joined devices to your existing - Certificate Revocation List (CRL) Distribution Point (CDP) - 2016 Domain Controllers - Domain Controller certificate +- Network infrastructure in place to reach your on-premises domain controller. If the machines are external, this can be achieved using any VPN solution. ### Azure Active Directory Connect synchronization Azure AD join, as well as hybrid Azure AD join devices register the user's Windows Hello for Business credential with Azure. To enable on-premises authentication, the credential must be synchronized to the on-premises Active Directory, regardless whether you are using a key or a certificate. Ensure you have Azure AD Connect installed and functioning properly. To learn more about Azure AD Connect, read [Integrate your on-premises directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect). @@ -44,7 +45,7 @@ If you upgraded your Active Directory schema to the Windows Server 2016 schema a A fundamental prerequisite of all cloud and hybrid Windows Hello for Business deployments is device registration. A user cannot provision Windows Hello for Business unless the device from which they are trying to provision has registered with Azure Active Directory. For more information about device registration, read [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/devices/overview). You can use the **dsregcmd.exe** command to determine if your device is registered to Azure Active Directory. -![dsregcmd outpout](images/aadj/dsregcmd.png) +![dsregcmd output](images/aadj/dsregcmd.png) ### CRL Distribution Point (CDP) @@ -58,6 +59,9 @@ To resolve this issue, the CRL distribution point must be a location that is acc If your CRL distribution point does not list an HTTP distribution point, then you need to reconfigure the issuing certificate authority to include an HTTP CRL distribution point, preferably first in the list of distribution points. +> [!NOTE] +> If your CA has published both the Base and the Delta CRL, please make sure you have included publishing the Delta CRL in the HTTP path. Include web server to fetch the Delta CRL by allowing double escaping in the (IIS) web server. + ### Windows Server 2016 Domain Controllers If you are interested in configuring your environment to use the Windows Hello for Business key rather than a certificate, then your environment must have an adequate number of Windows Server 2016 domain controllers. Only Windows Server 2016 domain controllers are capable of authenticating user with a Windows Hello for Business key. What do we mean by adequate? We are glad you asked. Read [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. @@ -72,10 +76,12 @@ Certificate authorities write CRL distribution points in certificates as they ar Windows Hello for Business enforces the strict KDC validation security feature, which imposes more restrictive criteria that must be met by the Key Distribution Center (KDC). When authenticating using Windows Hello for Business, the Windows 10 client validates the reply from the domain controller by ensuring all of the following are met: - The domain controller has the private key for the certificate provided. -- The root CA that issued the domain controller's certificate is in the device's **Trusted Root Certificate Authorities**. +- The root CA that issued the domain controller's certificate is in the device's **Trusted Root Certificate Authorities**. - Use the **Kerberos Authentication certificate template** instead of any other older template. - The domain controller's certificate has the **KDC Authentication** enhanced key usage. - The domain controller's certificate's subject alternate name has a DNS Name that matches the name of the domain. +- The domain controller's certificate's signature hash algorithm is **sha256**. +- The domain controller's certificate's public key is **RSA (2048 Bits)**. > [!Tip] @@ -122,7 +128,7 @@ You need to host your new certificate revocation list of a web server so Azure A 5. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Configuration Editor**. 6. In the **Section** list, navigate to **system.webServer/security/requestFiltering**. ![IIS Configuration Editor requestFiltering](images/aadj/iis-config-editor-requestFiltering.png) - In the list of named value-pairs in the content pane, configure **allowDoubleEscapting** to **True**. Click **Apply** in the actions pane. + In the list of named value-pairs in the content pane, configure **allowDoubleEscaping** to **True**. Click **Apply** in the actions pane. ![IIS Configuration Editor double escaping](images/aadj/iis-config-editor-allowDoubleEscaping.png) 7. Close **Internet Information Services (IIS) Manager**. @@ -151,6 +157,9 @@ These procedures configure NTFS and share permissions on the web server to allow ![CDP Share Permissions](images/aadj/cdp-share-permissions.png) 9. In the **Advanced Sharing** dialog box, click **OK**. +> [!Tip] +> Make sure that users can access **\\\Server FQDN\sharename**. + #### Disable Caching 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. @@ -180,7 +189,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. -4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). +4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). ![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. @@ -218,7 +227,7 @@ The web server is ready to host the CRL distribution point. Now, configure the Validate your new CRL distribution point is working. -1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. +1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. ![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) ### Reissue domain controller certificates @@ -264,7 +273,7 @@ Steps you will perform include: 1. Sign-in a domain controller using administrative credentials. 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. -4. Click the **Certification Path** tab. In the **Certifcation path** view, select the top most node and click **View Certificate**. +4. Click the **Certification Path** tab. In the **Certification path** view, select the top most node and click **View Certificate**. ![Certificate Path](images/aadj/certlm-cert-path-tab.png) 5. In the new **Certificate** dialog box, click the **Details** tab. Click **Copy to File**. ![Details tab and copy to file](images/aadj/certlm-root-cert-details-tab.png) @@ -287,40 +296,42 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted 5. In the **Enterprise Root Certificate** blade, click **Assignments**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**. ![Intune Profile assignment](images/aadj/intune-device-config-enterprise-root-assignment.png) 6. Sign out of the Microsoft Azure Portal. +> [!NOTE] +> After the creation, the **supported platform** parameter of the profile will contain the value "Windows 8.1 and later", as the certificate configuration for Windows 8.1 and Windows 10 is the same. ## Configure Windows Hello for Business Device Enrollment Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Click **device enrollment**. -4. Click **Windows enrollment** -5. Under **Windows enrollment**, click **Windows Hello for Business**. - ![Create Intune Windows Hello for Business Policy](images/aadj/IntuneWHFBPolicy-00.png) -6. Under **Priority**, click **Default**. -7. Under **All users and all devices**, click **Settings**. -8. Select **Enabled** from the **Configure Windows Hello for Business** list. -9. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software based keys. -10. Type the desired **Minimum PIN length** and **Maximum PIN length**. +1. Sign in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**. +3. Choose **Enroll devices**. +4. Select **Windows enrollment**. +5. Under **Windows enrollment**, select **Windows Hello for Business**. + ![Create Windows Hello for Business Policy](images/aadj/MEM.png) +6. Select **Enabled** from the **Configure Windows Hello for Business** list. +7. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software-based keys. +8. Enter the desired **Minimum PIN length** and **Maximum PIN length**. > [!IMPORTANT] - > The default minimum PIN length for Windows Hello for Business on Windows 10 is 6. Microsoft Intune defaults the minimum PIN length to 4, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to 6. + > The default minimum PIN length for Windows Hello for Business on Windows 10 is six. Microsoft Intune defaults the minimum PIN length to four, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to six. -![Intune Windows Hello for Business policy settings](images/aadj/IntuneWHFBPolicy-01.png) - -11. Select the appropriate configuration for the following settings. +9. Select the appropriate configuration for the following settings: * **Lowercase letters in PIN** * **Uppercase letters in PIN** * **Special characters in PIN** * **PIN expiration (days)** * **Remember PIN history** + > [!NOTE] > The Windows Hello for Business PIN is not a symmetric key (a password). A copy of the current PIN is not stored locally or on a server like in the case of passwords. Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs. Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN. If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature. -12. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**. -13. Select **No** to **Allow phone sign-in**. This feature has been deprecated. -14. Click **Save** -15. Sign-out of the Azure portal. +10. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**. +11. Select **No** to **Allow phone sign-in**. This feature has been deprecated. +12. Choose **Save**. +13. Sign out of the Microsoft Endpoint Manager admin center. + +> [!IMPORTANT] +> For more details about the actual experience after everything has been configured, please see [Windows Hello for Business and Authentication](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication). ## Section Review > [!div class="checklist"] @@ -335,6 +346,3 @@ Sign-in a workstation with access equivalent to a _domain user_. If you plan on using certificates for on-premises single-sign on, perform the additional steps in [Using Certificates for On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md). - - - diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 8eb13e3cb1..95638c7735 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -1,6 +1,6 @@ --- title: Using Certificates for AADJ On-premises Single-sign On single sign-on -description: Azure Active Directory joined devices in a hybrid Deployment for on-premises single sign-on +description: If you want to use certificates for on-premises single-sign on for Azure Active Directory joined devices, then follow these additional steps. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy @@ -532,15 +532,12 @@ The Intune Certificate Connector application enables Microsoft Intune to enroll ### Download Intune Certificate Connector Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -![Microsoft Intune Console](images/aadjcert/microsoftintuneconsole.png) -3. Select **Device Configuration**, and then select **Certificate Connectors**. -![Intune Certificate Authority](images/aadjcert/intunedeviceconfigurationcertauthority.png) -4. Click **Add**, and then click **Download the certificate connector software** under the **Steps to install connector for SCEP** section. -![Intune Download Certificate connector](images/aadjcert/intunedownloadcertconnector.png) -5. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. -6. Sign-out of the Azure Portal. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**. +3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section. +![Intune Certificate Authority](images/aadjcert/profile01.png) +4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. +5. Sign-out of the Microsoft Endpoint Manager admin center. ### Install the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. @@ -580,7 +577,7 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role. ![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) > [!IMPORTANT] - > The user account must have a valid Intune licenese asssigned. If the user account does not have a valid Intune license, the sign-in fails. + > The user account must have a valid Intune licenese assigned. If the user account does not have a valid Intune license, the sign-in fails. 4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task. @@ -639,46 +636,42 @@ Sign-in a workstation with access equivalent to a _domain user_. ### Create a SCEP Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Select **Device Configuration**, and then click **Profiles**. -4. Select **Create Profile**. - ![Intune Device Configuration Create Profile](images/aadjcert/intunedeviceconfigurationcreateprofile.png) -5. Next to **Name**, type **WHFB Certificate Enrollment**. -6. Next to **Description**, provide a description meaningful for your environment. -7. Select **Windows 10 and later** from the **Platform** list. -8. Select **SCEP certificate** from the **Profile** list. - ![WHFB Scep Profile Blade](images/aadjcert/intunewhfbscepprofile-00.png) -9. The **SCEP Certificate** blade should open. Configure **Certificate validity period** to match your organization. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**, and then click **Configuration Profiles**. +3. Select **Create Profile**. + ![Intune Device Configuration Create Profile](images/aadjcert/profile02.png) +4. Select **Windows 10 and later** from the **Platform** list. +5. Choose **SCEP certificate** from the **Profile** list, and select **Create**. +6. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. +7. Next to **Description**, provide a description meaningful for your environment, then select **Next**. +8. Select **User** as a certificate type. +9. Configure **Certificate validity period** to match your organization. > [!IMPORTANT] - > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. + > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. 10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. -11. Select **Custom** from the **Subject name format** list. -12. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. -13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. -14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. - ![WHFB SCEP certificate profile Trusted Certificate selection](images/aadjcert/intunewhfbscepprofile-01.png) -15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. +11. Next to **Subject name format**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. +12. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** parameter. Set its value as {{UserPrincipalName}}. +13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to the configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. +14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile. +15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. 16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. - ![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) -17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests amongst the URLs listed in the SCEP certificate profile. -18. Click **OK**. -19. Click **Create**. + ![WHFB SCEP certificate Profile EKUs](images/aadjcert/profile03.png) +17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. +18. Click **Next**. +19. Click **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Select **Device Configuration**, and then click **Profiles**. -4. Click **WHFB Certificate Enrollment**. -![WHFB Scep Profile landing](images/aadjcert/intunewhfbscepprofile-04.png) -5. Click **Assignments**. -6. In the **Assignments** pane, Click **Include**. Select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. -![WHFB SCEP Profile Assignment](images/aadjcert/intunewhfbscepprofileassignment.png) -7. Select the **AADJ WHFB Certificate Users** group. Click **Select**. -8. Click **Save**. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**, and then click **Configuration Profiles**. +3. Click **WHFB Certificate Enrollment**. +4. Select **Properties**, and then click **Edit** next to the **Assignments** section. +5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. +![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) +6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. +7. Click **Review + Save**, and then **Save**. You have successfully completed the configuration. Add users that need to enroll a Windows Hello for Business authentication certificate to the **AADJ WHFB Certificate Users** group. This group, combined with the device enrollment Windows Hello for Business configuration prompts the user to enroll for Windows Hello for Business and enroll a certificate that can be used to authentication to on-premises resources. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index c0d84c47c0..4eed2e7435 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -1,6 +1,6 @@ --- -title: Azure AD Join Single Sign-on Deployment Guides -description: Azure Active Directory joined devices in a hybrid Deployment for on-premises single sign-on +title: Azure AD Join Single Sign-on Deployment +description: Learn how to provide single sign-on to your on-premises resources for Azure Active Directory joined devices, using Windows Hello for Business. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy @@ -16,7 +16,7 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Azure AD Join Single Sign-on Deployment Guides +# Azure AD Join Single Sign-on Deployment **Applies to** - Windows 10 diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index c2550cdfa7..c4c503e778 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Trust New Installation (Windows Hello for Business) -description: Windows Hello for Business Hybrid baseline deployment +description: Learn about new installations for Windows Hello for Business certificate trust and the various technologies hybrid certificate trust depoyments rely on. keywords: identity, PIN, biometric, Hello, passport, WHFB ms.prod: w10 ms.mktglfcycl: deploy @@ -100,12 +100,12 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h ## Multifactor Authentication Services Windows Hello for Business uses multi-factor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multi-factor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA -Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. +Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. -### Azure Multi-Factor Authentication (MFA) Cloud ### +### Azure AD Multi-Factor Authentication (MFA) Cloud ### > [!IMPORTANT] -> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: -> * Azure Multi-Factor Authentication +> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> * Azure AD Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security > @@ -115,7 +115,7 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant. #### Configure Azure MFA Settings #### -Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. +Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. #### Azure MFA User States #### After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. @@ -126,12 +126,12 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ### Section Review > [!div class="checklist"] -> * Review the overview and uses of Azure Multifactor Authentication. -> * Review your Azure Active Directory subscription for Azure Multifactor Authentication. -> * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentication features and settings. -> * Understand the different User States and their effect on Azure Multifactor Authentication. -> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary. +> * Review the overview and uses of Azure AD Multi-Factor Authentication. +> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication. +> * Create an Azure AD Multi-Factor Authentication Provider, if necessary. +> * Configure Azure AD Multi-Factor Authentication features and settings. +> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication Authentication. +> * Consider using Azure AD Multi-Factor Authentication Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary. > [!div class="nextstepaction"] > [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 433457239a..81afb0421e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -57,12 +57,12 @@ To do this, follow the **Configure device settings** steps under [Setting up Azu Azure Active Directory is now configured for device registration. Next, you need to configure the on-premises Active Directory to support synchronizing hybrid Azure AD joined devices. Begin with upgrading the Active Directory Schema -### Upgrading Active Directory to the Windows Server 2016 Schema +### Upgrading Active Directory to the Windows Server 2016 or later Schema -To use Windows Hello for Business with Hybrid Azure AD joined devices, you must first upgrade your Active Directory schema to Windows Server 2016. +To use Windows Hello for Business with Hybrid Azure AD joined devices, you must first upgrade your Active Directory schema to Windows Server 2016 or later. > [!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your forest, you can skip **Upgrading Active Directory to the Windows Server 2016 Schema** (this section). +> If you already have a Windows Server 2016 or later domain controller in your forest, you can skip **Upgrading Active Directory to the Windows Server 2016 or later Schema** (this section). #### Identify the schema role domain controller @@ -78,7 +78,7 @@ The command should return the name of the domain controller where you need to ru Windows Hello for Business uses asymmetric keys as user credentials (rather than passwords). During enrollment, the public key is registered in an attribute on the user object in Active Directory. The schema update adds this new attribute to Active Directory. -Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. +Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 or later DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. Sign-in to the domain controller hosting the schema master operational role using enterprise administrator equivalent credentials. @@ -107,7 +107,7 @@ Federation server proxies are computers that run AD FS software that have been c Use the [Setting of a Federation Proxy](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/checklist--setting-up-a-federation-server-proxy) checklist to configure AD FS proxy servers in your environment. ### Deploy Azure AD Connect -Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). +Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771). When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**. @@ -205,7 +205,7 @@ When you're using AD FS, you need to enable the following WS-Trust endpoints: `/adfs/services/trust/13/certificatemixed` > [!WARNING] -> Both **adfs/services/trust/2005/windowstransport** or **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust WIndows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**. +> Both **adfs/services/trust/2005/windowstransport** and **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust Windows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**. > [!NOTE] >If you don’t have AD FS as your on-premises federation service, follow the instructions from your vendor to make sure they support WS-Trust 1.3 or 2005 endpoints and that these are published through the Metadata Exchange file (MEX). @@ -506,7 +506,7 @@ The following script helps you with the creation of the issuance transform rules #### Configure Device Authentication in AD FS Using an elevated PowerShell command window, configure AD FS policy by executing the following command -`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod All` +`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod SignedToken` #### Check your configuration For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index cd40458897..09d9929b85 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -1,6 +1,6 @@ --- -title: Hybrid Windows Hello for Business Prerequisites (Windows Hello for Business) -description: Prerequisites for Hybrid Windows Hello for Business Deployments +title: Hybrid Windows Hello for Business Prerequisites +description: Learn these prerequisites for hybrid Windows Hello for Business deployments using certificate trust. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -39,7 +39,7 @@ Hybrid Windows Hello for Business needs two directories: on-premises Active Dire A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. Different deployment configurations are supported by different Azure subscriptions. The hybrid-certificate trust deployment needs an Azure Active Directory premium subscription because it uses the device write-back synchronization feature. Other deployments, such as the hybrid key-trust deployment, may not require Azure Active Directory premium subscription. -Windows Hello for Business can be deployed in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory schema. +Windows Hello for Business can be deployed in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory or later schema. Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. @@ -49,7 +49,7 @@ Review these requirements and those from the Windows Hello for Business planning > * Active Directory Domain Functional Level > * Active Directory Forest Functional Level > * Domain Controller version -> * Windows Server 2016 Schema +> * Windows Server 2016 or later Schema > * Azure Active Directory subscription > * Correct subscription for desired features and outcomes @@ -118,6 +118,11 @@ Hybrid certificate trust deployments need the device write back feature. Authen > [!NOTE] > Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory, and therefore the device writeback is used to update the msDS-KeyCredentialLink on the computer object. +## Provisioning + +You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. + + ### Section Checklist ### > [!div class="checklist"] > * Azure Active Directory Device writeback diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index ea04aadb72..2857501f75 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -1,6 +1,6 @@ --- title: Hybrid Certificate Trust Deployment (Windows Hello for Business) -description: Hybrid Certificate Trust Deployment Overview +description: Learn the information you need to successfully deploy Windows Hello for Business in a hybrid certificate trust scenario. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 8b3b535bc4..c9ea9e18f9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -1,6 +1,6 @@ --- title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business) -description: Provisioning for Hybrid Windows Hello for Business Deployments +description: In this article, learn about provisioning for hybrid certificate trust deployments of Windows Hello for Businesss. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index a6df7720f8..b186880166 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid Windows Hello for Business - Active Directory (AD) +title: Configure Hybrid Windows Hello for Business - Active Directory (AD) description: Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, ad ms.prod: w10 @@ -16,7 +16,7 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Configuring Windows Hello for Business: Active Directory +# Configure Windows Hello for Business: Active Directory **Applies to** - Windows 10, version 1703 or later diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index 388da08d52..8a9763ebcd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -19,12 +19,14 @@ ms.reviewer: # Configure Windows Hello for Business: Active Directory Federation Services **Applies to** -- Windows10, version 1703 or later -- Hybrid deployment -- Certificate trust + +- Windows 10, version 1703 or later +- Hybrid deployment +- Certificate trust ## Federation Services -The Windows Server 2016 Active Directory Federation Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. + +The Windows Server 2016 Active Directory Federation Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. @@ -36,35 +38,50 @@ The Windows Hello for Business Authentication certificate template is configured Sign-in the AD FS server with *Domain Admin* equivalent credentials. 1. Open a **Windows PowerShell** prompt. -2. Type the following command +2. Enter the following command: ```PowerShell Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication -WindowsHelloCertificateProxyEnabled $true ``` - ->[!NOTE] -> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. - + >[!NOTE] + > If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the preceding command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template by using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name by using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. ### Group Memberships for the AD FS Service Account The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. +> [!TIP] +> The adfssvc account is the AD FS service account. + Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. -3. Right-click **Windows Hello for Business Users** group -4. Click the **Members** tab and click **Add** -5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. +3. Right-click **Windows Hello for Business Users** group. +4. Click the **Members** tab and click **Add**. +5. In the **Enter the object names to select** text box, type **adfssvc** or substitute the name of the AD FS service account in your AD FS deployment. Click **OK**. 6. Click **OK** to return to **Active Directory Users and Computers**. 7. Restart the AD FS server. +> [!NOTE] +>For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: +> +> 1. Launch AD FS management console. Browse to "Services > Scope Descriptions". +> 2. Right click "Scope Descriptions" and select "Add Scope Description". +> 3. Under name type "ugs" and Click Apply > OK. +> 4. Launch Powershell as Administrator. +> 5. Execute the command "Get-AdfsApplicationPermission". Look for the ScopeNames :{openid, aza} that has the ClientRoleIdentifier is equal to 38aa3b87-a06d-4817-b275-7a316988d93b and make a note of the ObjectIdentifier. +> 6. Execute the command "Set-AdfsApplicationPermission -TargetIdentifier -AddScope 'ugs'. +> 7. Restart the ADFS service. +> 8. On the client: Restart the client. User should be prompted to provision WHFB. +> 9. If the provisioning window does not pop up then need to collect NGC trace logs and further troubleshoot. + ### Section Review + > [!div class="checklist"] -> * Configure the registration authority -> * Update group memberships for the AD FS service account +> * Configure the registration authority. +> * Update group memberships for the AD FS service account. > > > [!div class="step-by-step"] diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 2e7fe96f8c..efeaaacd05 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid Windows Hello for Business - Directory Synchronization +title: Configure Hybrid Windows Hello for Business Directory Synch description: Discussing Directory Synchronization in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect ms.prod: w10 @@ -16,22 +16,23 @@ localizationpriority: medium ms.date: 10/23/2017 ms.reviewer: --- + # Configure Hybrid Windows Hello for Business: Directory Synchronization **Applies to** - Windows 10, version 1703 or later - Hybrid deployment -- Certificate trust +- Key trust ## Directory Synchronization -In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. +In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. -The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. +The key-trust model needs Windows Server 2016 domain controllers, which configure the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. > [!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. +> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use the pre-created group KeyAdmins in step 3 of the "Group Memberships for the Azure AD Connect Service Account" section of this article. ### Configure Permissions for Key Synchronization @@ -45,31 +46,34 @@ Sign-in a domain controller or management workstations with *Domain Admin* equiv 6. In the **Applies to** list box, select **Descendant User objects**. 7. Using the scroll bar, scroll to the bottom of the page and click **Clear all**. 8. In the **Properties** section, select **Read msDS-KeyCredentialLink** and **Write msDS-KeyCredentialLink**. -9. Click **OK** three times to complete the task. +9. Click **OK** three times to complete the task. ### Group Memberships for the Azure AD Connect Service Account -The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. +The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. - >[!IMPORTANT] - > If you already have a Windows Server 2016 domain controller in your domain, use the Keyadmins group in the next step, otherwise use the KeyCredential admins group you previously created. - 3. Right-click either the **KeyAdmins** or **KeyCredential Admins** in the details pane and click **Properties**. 4. Click the **Members** tab and click **Add** 5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. 6. Click **OK** to return to **Active Directory Users and Computers**. +> [!NOTE] +> If your AD forest has multiple domains, make sure you add the ADConnect sync service account (ie. MSOL_12121212) into "Enterprise Key Admins" group to gain permission across the domains in the forest. + +> [!NOTE] +> Transfer the PDC emulator FSMO role to a domain controller running Windows Server 2016 (or later) to be able to search the Key Admins and Enterprise Key Admins groups (domain controllers running previous versions of Windows Server cannot translate the security identifier to a name for these groups). + ### Section Review > [!div class="checklist"] > * Configure Permissions for Key Synchronization > * Configure group membership for Azure AD Connect -> +> > [!div class="step-by-step"] > [< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) > [Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 1cf7fcb2cd..8bd8f3e995 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -39,20 +39,29 @@ Clients need to trust domain controllers and the best way to do this is to ensur Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template. -By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template a baseline to create an updated domain controller certificate template. +By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template as a baseline to create an updated domain controller certificate template. #### Create a Domain Controller Authentication (Kerberos) Certificate Template Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. 1. Open the **Certificate Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. + 5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. - **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. + 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. + 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. + 8. Close the console. #### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template @@ -66,19 +75,27 @@ The auto-enrollment feature in Windows enables you to effortlessly replace these Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. 1. Open the **Certificate Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. + 4. Click the **Superseded Templates** tab. Click **Add**. + 5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. + 6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. + 7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. + 8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. + 9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. ->[!NOTE] ->The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. +> [!NOTE] +> The domain controller's certificate must chain to a root in the NTAuth store. By default, the Active Directory Certificate Authority's root certificate is added to the NTAuth store. If you are using a third-party CA, this may not be done by default. If the domain controller certificate does not chain to a root in the NTAuth store, user authentication will fail. ### Enrollment Agent certificate template @@ -94,33 +111,54 @@ Approximately 60 days prior to enrollment agent certificate's expiration, the AD Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. 1. Open the **Certificate Authority Management** console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right click on the **Exchange Enrollment Agent (Offline request)** template details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. + 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. -6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. - **Note:** The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. + +6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. + + > [!NOTE] + > The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. + 8. On the **Security** tab, click **Add**. + 9. Click **Object Types**. Select the **Service Accounts** check box and click **OK**. + 10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. -11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. + +11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. + 12. Close the console. -#### Creating an Enrollment Agent certificate for typical Service Acconts +#### Creating an Enrollment Agent certificate for typical Service Accounts Sign-in a certificate authority or management workstations with *Domain Admin* equivalent credentials. 1. Open the **Certificate Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent (Offline request)** template in the details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. + 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. + 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. + 8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. + 9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. + 10. Close the console. ### Creating Windows Hello for Business authentication certificate template @@ -130,30 +168,70 @@ During Windows Hello for Business provisioning, the Windows 10, version 1703 cli Sign-in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. 1. Open the **Certificate Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. - **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. -6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. + +5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. + +6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. + 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. + 8. On the **Issuance Requirements** tab, select the **This number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + + Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. + 10. On the **Request Handling** tab, select the **Renew with same key** check box. + 11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. + 12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Read**, **Enroll**, and **AutoEnroll** permissions. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. + 13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. + 14. Click on the **Apply** to save changes and close the console. #### Mark the template as the Windows Hello Sign-in template Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials. + 1. Open an elevated command prompt. + 2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` ->[!NOTE] ->If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. +If the template was changed successfully, the output of the command will contain old and new values of the template parameters. The new value must contain the **CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY** parameter. Example: + +```console +CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=[yourdomain]:WHFBAuthentication + +Old Value: +msPKI-Private-Key-Flag REG_DWORD = 5050080 (84213888) +CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128) +CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0 +TEMPLATE_SERVER_VER_WINBLUE< [!NOTE] +> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. ## Publish Templates @@ -164,11 +242,17 @@ The certificate authority may only issue certificates for certificate templates #### Publish Certificate Templates to the Certificate Authority Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. + 2. Expand the parent node from the navigation pane. + 3. Click **Certificate Templates** in the navigation pane. + 4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. + +5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. + 6. Close the console. @@ -181,9 +265,13 @@ The newly created domain controller authentication certificate template supersed Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. 1. Open the **Certificate Authority** management console. + 2. Expand the parent node from the navigation pane. + 3. Click **Certificate Templates** in the navigation pane. + 4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. + 5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. @@ -213,4 +301,3 @@ Sign-in to the certificate authority or management workstation with _Enterprise 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: PKI (*You are here*) 6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) - diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index f65eaf8b20..80325188e6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -26,7 +26,7 @@ ms.reviewer: ## Policy Configuration -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index eb54aba4fd..2f6f72752a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -1,6 +1,6 @@ --- title: Configure Hybrid Windows Hello for Business Settings (Windows Hello for Business) -description: Configuring Windows Hello for Business Settings in Hybrid deployment +description: Learn how to configure Windows Hello for Business settings in hybrid certificate trust deployment. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index 653af360e6..aea8c9df8d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -1,6 +1,6 @@ --- -title: Windows Hello for Business Key Trust New Installation (Windows Hello for Business) -description: Windows Hello for Business Hybrid baseline deployment +title: Windows Hello for Business Key Trust New Installation +description: Learn how to configure a hybrid key trust deployment of Windows Hello for Business for systems with no previous installations. keywords: identity, PIN, biometric, Hello, passport, WHFB ms.prod: w10 ms.mktglfcycl: deploy @@ -37,7 +37,10 @@ New installations are considerably more involved than existing implementations b The new installation baseline begins with a basic Active Directory deployment and enterprise PKI. ## Active Directory -This document expects you have Active Directory deployed with an _adequate_ number of Windows Server 2016 domain controllers for each site. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. +This document expects you have Active Directory deployed with an _adequate_ number of Windows Server 2016 or later domain controllers for each site. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. + +> [!NOTE] +>There was an issue with key trust authentication on Windows Server 2019. If you are planning to use Windows Server 2019 domain controllers refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044) to fix this issue. Lab environments and isolated proof of concepts may want to limit the number of domain controllers. The purpose of these environments is to experiment and learn. Reducing the number of domain controllers can prevent troubleshooting issue, such as Active Directory replication, which is unrelated to activity's goal. @@ -93,7 +96,7 @@ If you do not have an existing public key infrastructure, please review [Certifi > * Highly available certificate revocation list (Azure AD Joined devices). ## Azure Active Directory -You’ve prepared your Active Directory. Hybrid Windows Hello for Business deployment needs Azure Active Directory to host your cloud-based identities. +You've prepared your Active Directory. Hybrid Windows Hello for Business deployment needs Azure Active Directory to host your cloud-based identities. The next step of the deployment is to follow the [Creating an Azure AD tenant](https://docs.microsoft.com/azure/active-directory/develop/active-directory-howto-tenant) process to provision an Azure tenant for your organization. @@ -107,26 +110,24 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h ## Multifactor Authentication Services Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA or a third-party MFA adapter -Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. +Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. -### Azure Multi-Factor Authentication (MFA) Cloud +### Azure AD Multi-Factor Authentication Authentication (MFA) Cloud > [!IMPORTANT] -> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: -> * Azure Multi-Factor Authentication +> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> * Azure AD Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security > > If you have one of these subscriptions or licenses, skip the Azure MFA Adapter section. -#### Azure MFA Provider -If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant. #### Configure Azure MFA Settings -Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. +Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. #### Azure MFA User States -After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. +After you have completed configuring your Azure MFA settings, you want to review [How to require two-step verification for a user](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. ### Azure MFA via ADFS Alternatively, you can configure Windows Server 2016 Active Directory Federation Services (AD FS) to provide additional multi-factor authentication. To configure, read the [Configure AD FS 2016 and Azure MFA](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-azure-mfa) section. @@ -134,12 +135,12 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ### Section Review > [!div class="checklist"] -> * Review the overview and uses of Azure Multifactor Authentication. -> * Review your Azure Active Directory subscription for Azure Multifactor Authentication. -> * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentication features and settings. -> * Understand the different User States and their effect on Azure Multifactor Authentication. -> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. +> * Review the overview and uses of Azure AD Multi-Factor Authentication. +> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication. +> * Create an Azure AD Multi-Factor Authentication Provider, if necessary. +> * Configure Azure AD Multi-Factor Authentication features and settings. +> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication. +> * Consider using Azure AD Multi-Factor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. > [!div class="nextstepaction"] > [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index aa99101b75..314df80eac 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -37,9 +37,9 @@ You are ready to configure device registration for your hybrid environment. Hybr ## Configure Azure for Device Registration Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. -To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/) +To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/). -Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark. +Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-manual) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark.

                  @@ -49,7 +49,7 @@ Next, follow the guidance on the [How to configure hybrid Azure Active Directory ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) -3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. Configure Azure Device Registration (*You are here*) 6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index abb29a0a18..0f5cdfa98a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -27,7 +27,7 @@ ms.reviewer: You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises. ## Deploy Azure AD Connect -Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). +Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771). > [!NOTE] diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index e0c85f3020..18959a0f1e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -1,6 +1,6 @@ --- title: Hybrid Key trust Windows Hello for Business Prerequisites (Windows Hello for Business) -description: Prerequisites for Hybrid Windows Hello for Business Deployments +description: Learn about the prerequisites for hybrid Windows Hello for Business deployments using key trust and what the next steps are in the deployment process. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -40,7 +40,12 @@ Hybrid Windows Hello for Business needs two directories: on-premises Active Dire A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription. -You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. +You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. +If using the key trust deployment model, you MUST ensure that you have adequate (1 or more, depending on your authentication load) Windows Server 2016 or later Domain Controllers in each Active Directory site where users will be authenticating for Windows Hello for Business. +Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. + +> [!NOTE] +>There was an issue with key trust authentication on Windows Server 2019. If you are planning to use Windows Server 2019 domain controllers refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044) to fix this issue. Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. @@ -60,15 +65,15 @@ The Windows Hello for Business deployment depends on an enterprise public key in Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. +The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](https://support.microsoft.com/help/291010/requirements-for-domain-controller-certificates-from-a-third-party-ca). -* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. -* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). +* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL, or an Authority Information Access (AIA) extension that points to an Online Certificate Status Protocol (OCSP) responder. +* The certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None]. * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. -* The certificate template must have an extension that has the BMP data value "DomainController". +* The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. * The domain controller certificate must be installed in the local computer's certificate store. @@ -99,8 +104,8 @@ Organizations using older directory synchronization technology, such as DirSync
                  -## Federation with Azure ## -You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) or [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. +## Federation with Azure +You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/hybrid/whatis-phs) or [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. > [!div class="checklist"] > * Non-federated environments @@ -112,7 +117,7 @@ You can deploy Windows Hello for Business key trust in non-federated and federat Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their user name and password as one factor, but needs a second factor of authentication. -Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication (MFA) service or they can use multifactor authentication provided by AD FS beginning with Windows Server 2012 R2, which includes an adapter model that enables third parties to integrate their MFA into AD FS. The MFA enabled by an Office 365 license is sufficient for Azure AD. +Hybrid Windows Hello for Business deployments can use Azure's Multifactor Authentication (MFA) service or they can use multifactor authentication provided by AD FS beginning with Windows Server 2012 R2, which includes an adapter model that enables third parties to integrate their MFA into AD FS. The MFA enabled by an Office 365 license is sufficient for Azure AD. ### Section Review > [!div class="checklist"] @@ -125,7 +130,11 @@ Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Auth ## Device Registration Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. - + +## Provisioning + +You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. + ### Section Checklist diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index cdc50b7691..63743f3ea2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -1,6 +1,6 @@ --- title: Hybrid Key Trust Deployment (Windows Hello for Business) -description: Hybrid Key Trust Deployment Overview +description: Review this deployment guide to successfully deploy Windows Hello for Business in a hybrid key trust scenario. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -19,11 +19,11 @@ ms.reviewer: # Hybrid Azure AD joined Key Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Hybrid deployment -- Key trust - +- Windows 10, version 1703 or later +- Hybrid deployment +- Key trust + Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid key trust scenario. It is recommended that you review the Windows Hello for Business planning guide prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. You can review the [planning guide](https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-planning-guide) and download the [planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514). @@ -31,10 +31,11 @@ It is recommended that you review the Windows Hello for Business planning guide This deployment guide provides guidance for new deployments and customers who are already federated with Office 365. These two scenarios provide a baseline from which you can begin your deployment. ## New Deployment Baseline ## + The new deployment baseline helps organizations who are moving to Azure and Office 365 to include Windows Hello for Business as part of their deployments. This baseline is good for organizations who are looking to deploy proof of concepts as well as IT professionals who want to familiarize themselves Windows Hello for Business by deploying a lab environment. - + This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. - + Your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. > [!div class="nextstepaction"] @@ -42,9 +43,8 @@ Your next step is to familiarize yourself with the prerequisites needed for the

                  -
                  - ## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. Overview (*You are here*) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 99e9682540..5a790c046a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -1,6 +1,6 @@ --- title: Hybrid Windows Hello for Business key trust Provisioning (Windows Hello for Business) -description: Provisioning for Hybrid Windows Hello for Business Deployments +description: Learn about provisioning for hybrid key trust deployments of Windows Hello for Business and learn where to find the hybrid key trust deployment guide. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -19,7 +19,7 @@ ms.reviewer: # Hybrid Windows Hello for Business Provisioning **Applies to** -- Windows�10, version 1703 or later +- Windows 10, version 1703 or later - Hybrid deployment - Key trust @@ -27,7 +27,7 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358](images/Event358.png) +![Event358](images/Event358-2.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. @@ -57,9 +57,6 @@ The remainder of the provisioning includes Windows Hello for Business requesting > **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. -> [!NOTE] -> Microsoft is actively investigating ways to reduce the synchronization latency and delays. -


                  diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 149f51780f..3bd0bbe112 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -1,6 +1,6 @@ --- -title: Configuring Hybrid key trust Windows Hello for Business - Directory Synchronization -description: Configuring Hybrid key trust Windows Hello for Business - Directory Synchronization +title: Hybrid Windows Hello for Business - Directory Synchronization +description: How to configure Hybrid key trust Windows Hello for Business - Directory Synchronization keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect, Windows Hello, AD Connect, key trust, key-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -39,7 +39,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 2. Click the **Users** container in the navigation pane. 3. Right-click **Key Admins** in the details pane and click **Properties**. 4. Click the **Members** tab and click **Add** -5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. +5. In the **Enter the object names to select** text box, type the name of the service account used as an AD DS Connector account and click **OK**. 6. Click **OK** to return to **Active Directory Users and Computers**. ### Section Review @@ -47,9 +47,9 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva > [!div class="checklist"] > * Configure group membership for Azure AD Connect ->[!div class="step-by-step"] -[< Configure Active Directory](hello-hybrid-key-whfb-settings-ad.md) -[Configure PKI >](hello-hybrid-key-whfb-settings-pki.md) +> [!div class="step-by-step"] +> [< Configure Active Directory](hello-hybrid-key-whfb-settings-ad.md) +> [Configure PKI >](hello-hybrid-key-whfb-settings-pki.md)
                  diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index 9e2635b984..87b70bbd2c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid key trust Windows Hello for Business - Public Key Infrastructure (PKI) +title: Configure Hybrid key trust Windows Hello for Business description: Configuring Hybrid key trust Windows Hello for Business - Public Key Infrastructure (PKI) keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI, Windows Hello, key trust, key-trust ms.prod: w10 @@ -55,6 +55,9 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. 8. Close the console. +>[!NOTE] +>Don't confuse the **Request hash** algorithm with the hash argorithm of the certificate. + #### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. @@ -77,8 +80,8 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. ->[!NOTE] ->The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. +> [!NOTE] +> The domain controller's certificate must chain to a root in the NTAuth store. By default, the Active Directory Certificate Authority's root certificate is added to the NTAuth store. If you are using a third-party CA, this may not be done by default. If the domain controller certificate does not chain to a root in the NTAuth store, user authentication will fail. ### Publish Certificate Templates to a Certificate Authority diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index c38ab35a87..d7355b0c32 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid key trust Windows Hello for Business - Group Policy +title: Configure Hybrid Windows Hello for Business - Group Policy description: Configuring Hybrid key trust Windows Hello for Business - Group Policy keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, key trust, key-trust ms.prod: w10 @@ -26,7 +26,7 @@ ms.reviewer: ## Policy Configuration -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -74,9 +74,12 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv The Windows Hello for Business Group Policy object delivers the correct Group Policy settings to the user, which enables them to enroll and use Windows Hello for Business to authenticate to Azure and Active Directory +> [!NOTE] +> If you deployed Windows Hello for Business configuration using both Group Policy and Microsoft Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more details about deploying Windows Hello for Business configuration using Microsoft Intune, see [Windows 10 device settings to enable Windows Hello for Business in Intune](https://docs.microsoft.com/mem/intune/protect/identity-protection-windows-settings) and [PassportForWork CSP](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp). For more details about policy conflicts, see [Policy conflicts from multiple policy sources](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization#policy-conflicts-from-multiple-policy-sources) + #### Enable Windows Hello for Business -The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. +The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 48f2e98a5d..9103431811 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -1,6 +1,6 @@ --- -title: Configure Hybrid Windows Hello for Business key trust Settings (Windows Hello for Business) -description: Configuring Windows Hello for Business Settings in Hybrid deployment +title: Configure Hybrid Windows Hello for Business key trust Settings +description: Begin the process of configuring your hybrid key trust environment for Windows Hello for Business. Start with your Active Directory configuration. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index f00875d1a2..4d3512719a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -17,62 +17,79 @@ ms.topic: article localizationpriority: medium ms.date: 05/05/2018 --- + # Windows Hello for Business In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.
                  Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account. Windows Hello addresses the following problems with passwords: -- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials (passwords). -- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). ->[!div class="mx-tdBreakAll"] ->| | | | ->| :---: | :---: | :---: | ->| [![Overview Icon](images/hello_filter.png)](hello-overview.md)
                  [Overview](hello-overview.md) | [![Why a PIN is better than a password Icon](images/hello_lock.png)](hello-why-pin-is-better-than-password.md)
                  [Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [![Manage Hello Icon](images/hello_gear.png)](hello-manage-in-organization.md)
                  [Manage Windows Hello in your Organization](hello-manage-in-organization.md) | +- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. +- Server breaches can expose symmetric network credentials (passwords). +- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). +- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). -## Prerequisites +> | | | | +> | :---: | :---: | :---: | +> | [![Overview Icon](images/hello_filter.png)](hello-overview.md)
                  [Overview](hello-overview.md) | [![Why a PIN is better than a password Icon](images/hello_lock.png)](hello-why-pin-is-better-than-password.md)
                  [Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [![Manage Hello Icon](images/hello_gear.png)](hello-manage-in-organization.md)
                  [Manage Windows Hello in your Organization](hello-manage-in-organization.md) | + + +## Prerequisites ### Cloud Only Deployment + * Windows 10, version 1511 or later * Microsoft Azure Account * Azure Active Directory -* Azure Multi-factor authentication +* Azure AD Multi-Factor Authentication * Modern Management (Intune or supported third-party MDM), *optional* * Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory ### Hybrid Deployments + The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process. | Key trust
                  Group Policy managed | Certificate trust
                  Mixed managed | Key trust
                  Modern managed | Certificate trust
                  Modern managed | | --- | --- | --- | --- | | Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
                  *Minimum:* Windows 10, version 1703
                  *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).
                  **Azure AD Joined:**
                  Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later | -| Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | +| Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level | | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
                  and
                  Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service | -| Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter| Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter | +| Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                  AD FS w/Azure MFA adapter, or
                  AD FS w/Azure MFA Server adapter, or
                  AD FS w/3rd Party MFA Adapter | | Azure Account | Azure Account | Azure Account | Azure Account | | Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory | | Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect | | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment | -### On-premises Deployments +> [!Important] +> 1. Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
                  +> **Requirements:**
                  +> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> +> 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
                  +> **Requirements:**
                  +> Reset from settings - Windows 10, version 1703, Professional
                  +> Reset above lock screen - Windows 10, version 1709, Professional
                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 + +### On-premises Deployments + The table shows the minimum requirements for each deployment. | Key trust
                  Group Policy managed | Certificate trust
                  Group Policy managed| -| --- | --- | +| --- | --- | | Windows 10, version 1703 or later | Windows 10, version 1703 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema| | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | -| AD FS with Azure MFA Server, or
                  AD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, or
                  AD FS with 3rd Party MFA Adapter | +| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | | Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | ->[!IMPORTANT] -> For Windows Hello for Business deployment, if you have several domains, at least one Windows Server Domain Controller 2016 is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers). +> [!IMPORTANT] +> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers). diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index a6364bad59..a908e96533 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -1,6 +1,6 @@ --- -title: Prepare and Deploy Windows Server 2016 Active Directory Federation Services (Windows Hello for Business) -description: How toPrepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business +title: Prepare & Deploy Windows Active Directory Federation Services with key trust (Windows Hello for Business) +description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business using key trust. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md deleted file mode 100644 index b2c377057f..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md +++ /dev/null @@ -1,549 +0,0 @@ ---- -title: Configure or Deploy Multifactor Authentication Services (Windows Hello for Business) -description: How to Configure or Deploy Multifactor Authentication Services for Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Configure or Deploy Multifactor Authentication Services - -**Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Key trust - - -On-premises deployments must use the On-premises Azure MFA Server using the AD FS adapter model Optionally, you can use a third-party MFA server that provides an AD FS Multifactor authentication adapter. - ->[!TIP] ->Please make sure you've read [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) before proceeding any further. - -## Prerequisites - -The Azure MFA Server and User Portal servers have several perquisites and must have connectivity to the Internet. - -### Primary MFA Server - -The Azure MFA server uses a primary and secondary replication model for its configuration database. The primary Azure MFA server hosts the writable partition of the configuration database. All secondary Azure MFA servers hosts read-only partitions of the configuration database. All production environment should deploy a minimum of two MFA Servers. - -For this documentation, the primary MFA uses the name **mf*a*** or **mfa.corp.contoso.com**. All secondary servers use the name **mfa*n*** or **mfa*n*.corp.contoso.com**, where *n* is the number of the deployed MFA server. - -The primary MFA server is also responsible for synchronizing from Active Directory. Therefore, the primary MFA server should be domain joined and fully patched. - -#### Enroll for Server Authentication - -The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. - -Sign-in the primary MFA server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. -9. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -The Azure MFA server does not require the Web Server role, however, User Portal and the optional Mobile Application server communicate with the MFA server database using the MFA Web Services SDK. The MFA Web Services SDK uses the Web Server role. - -To install the Web Server (IIS) role, please follow [Installing IIS 7 on Windows Server 2008 or Windows Server 2008 R2](https://docs.microsoft.com/iis/install/installing-iis-7/installing-iis-7-and-above-on-windows-server-2008-or-windows-server-2008-r2) or [Installing IIS 8.5 on Windows Server 2012 R2](https://docs.microsoft.com/iis/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2) depending on the host Operating System you're going to use. - -The following services are required: -* Common Parameters > Default Document. -* Common Parameters > Directory Browsing. -* Common Parameters > HTTP Errors. -* Common Parameters > Static Content. -* Health and Diagnostics > HTTP Logging. -* Performance > Static Content Compression. -* Security > Request Filtering. -* Security > Basic Authentication. -* Management Tools > IIS Management Console. -* Management Tools > IIS 6 Management Compatibility. -* Application Development > ASP.NET 4.5. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. - -Sign in the primary MFA server with _administrator_ equivalent credentials. -1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console -2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. -3. In the **Actions** pane, click **Bindings**. -4. In the **Site Bindings** dialog, Click **Add**. -5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. -6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. - -#### Configure the Web Service’s Security - -The Azure MFA Server service runs in the security context of the Local System. The MFA User Portal gets its user and configuration information from the Azure MFA server using the MFA Web Services. Access control to the information is gated by membership to the Phonefactor Admins security group. You need to configure the Web Service’s security to ensure the User Portal and the Mobile Application servers can securely communicate to the Azure MFA Server. Also, all User Portal server administrators must be included in the Phonefactor Admins security group. - -Sign in the domain controller with _domain administrator_ equivalent credentials. - -##### Create Phonefactor Admin group - -1. Open **Active Directory Users and Computers** -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **Group**. -3. In the **New Object – Group** dialog box, type **Phonefactor Admins** in Group name. -4. Click **OK**. - -##### Add accounts to the Phonefactor Admins group - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select Users. In the content pane. Right-click the **Phonefactor Admins** security group and select **Properties**. -3. Click the **Members** tab. -4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the MFA service has enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Services Role was installed with the correct configuration (including Basic Authentication, ASP.NET 4.5, etc). -* Confirm the host has all the available updates from Windows Update. -* Confirm you bound the server authentication certificate to the IIS web site. -* Confirm you created the Phonefactor Admins group. -* Confirm you added the computer account hosting the MFA service to the Phonefactor Admins group and any user account who are responsible for administrating the MFA server or User Portal. - -### User Portal Server - -The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. User Portal Administrators may be set up and granted permission to add new users and update existing users. - -The User Portal web site uses the user database that is synchronized across the MFA Servers, which enables a design to support multiple web servers for the User Portal and those servers can support internal and external customers. While the user portal web site can be installed directly on the MFA server, it is recommended to install the User Portal on a server separate from the MFA Server to protect the MFA user database, as a layered, defense-in-depth security design. - -#### Enroll for Server Authentication - -Internal and external users use the User Portal to manage their multifactor authentication settings. To protect this communication, you need to enroll all User Portal servers with a server authentication certificate. You can use an enterprise certificate to protect communication to internal User Portal servers. - -For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. - -Sign-in the User Portal server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). -9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). -10. Click **Add**. Click **OK** when finished. -11. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -To do this, please follow the instructions mentioned in the previous [Install the Web Server Role](#install-the-web-server-role) section. However, do **not** install Security > Basic Authentication. The user portal server does not require this. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-servers-certificate) section. - -#### Create WebServices SDK user account - -The User Portal and Mobile Application web services need to communicate with the configuration database hosted on the primary MFA server. These services use a user account to communicate to authenticate to the primary MFA server. You can think of the WebServices SDK account as a service account used by other servers to access the WebServices SDK on the primary MFA server. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**. -3. In the **New Object – User** dialog box, type **PFWSDK_\** in the **First name** and **User logon name** boxes, where *\* is the name of the primary MFA server running the Web Services SDK. Click **Next**. -4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account. - -#### Add the MFA SDK user account to the Phonefactor Admins group - -Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactors Admin** security group and select Properties. -3. Click the Members tab. -4. Click **Add**. Click **Object Types..** Type the PFWSDK_\ user name in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * The Webservices SDK user account - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the user portal are properly configure for load balancing and high-availability. -* Confirm the hosts of the user portal have enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Server Role was properly configured on all servers. -* Confirm all the hosts have the latest updates from Windows Update. -* Confirm you created the web service SDK domain account and the account is a member of the Phonefactor Admins group. - -## Installing Primary Azure MFA Server - -When you install Azure Multi-Factor Authentication Server, you have the following options: -1. Install Azure Multi-Factor Authentication Server locally on the same server as AD FS -2. Install the Azure Multi-Factor Authentication adapter locally on the AD FS server, and then install Multi-Factor Authentication Server on a different computer (preferred deployment for production environments) - -See [Configure Azure Multi-Factor Authentication Server to work with AD FS in Windows Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12) to view detailed installation and configuration options. - -Sign-in the federation server with _Domain Admin_ equivalent credentials and follow [To install and configure the Azure Multi-Factor Authentication server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#to-install-and-configure-the-azure-multi-factor-authentication-server) for an express setup with the configuration wizard. You can re-run the authentication wizard by selecting it from the Tools menu on the server. - ->[!IMPORTANT] ->Only follow the above mention article to install Azure MFA Server. Once it is installed, continue configuration using this article. - -### Configuring Company Settings - -You need to configure the MFA server with the default settings it applies to each user account when it is imported or synchronized from Active Directory. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Start the **Multi-Factor Server** application -2. Click **Company Settings**. -3. On the **General** Tab, select **Fail Authentication** from the **When internet is not accessible** list. -4. In **User defaults**, select **Phone Call** or **Text Message** - **Note:** You can use mobile application; however, the configuration is beyond the scope of this document. Read [Getting started the MFA Server Mobile App Web Service](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice) to configure and use mobile application multi-factor authentication or the Install User Portal topic in the Multi-Factor Server help. -5. Select **Enable Global Services** if you want to allow Multi-Factor Authentications to be made to telephone numbers in rate zones that have an associated charge. -6. Clear the **User can change phone** check box to prevent users from changing their phone during the Multi-Factor Authentication call or in the User Portal. A consistent configuration is for users to change their phone numbers in Active Directory and let those changes synchronize to the multi-factor server using the Synchronization features in Directory Integration. -7. Select **Fail Authentication** from the **When user is disabled** list. Users should provision their account through the user portal. -8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. -9. Under default PIN rules, Select the User can change PIN check box to enable users to change their PIN during multi-factor authentication and through the user portal. -10. Configure the minimum length for the PIN. -11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. -12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. -13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. - -![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) - -### Configuring Email Settings and Content - -If you are deploying in a lab or proof-of-concept, then you have the option of skipping this step. In a production environment, ideally, you’ll want to setup the Azure Multifactor Authentication Server and its user portal web interface prior to sending the email. The email gives your users time to visit the user portal and configure the multi-factor settings. - -Now that you have imported or synchronized with your Azure Multi-Factor Authentication server, it is advised that you send your users an email that informs them that they have been enrolled in multi-factor authentication. - -With the Azure Multi-Factor Authentication Server there are various ways to configure your users for using multi-factor authentication. For instance, if you know the users’ phone numbers or were able to import the phone numbers into the Azure Multi-Factor Authentication Server from their company’s directory, the email will let users know that they have been configured to use Azure Multi-Factor Authentication, provide some instructions on using Azure Multi-Factor Authentication and inform the user of the phone number they will receive their authentications on. - -The content of the email will vary depending on the method of authentication that has been set for the user (e.g. phone call, SMS, mobile application). For example, if the user is required to use a PIN when they authenticate, the email will tell them what their initial PIN has been set to. Users are usually required to change their PIN during their first authentication. - -If users’ phone numbers have not been configured or imported into the Azure Multi-Factor Authentication Server, or users are pre-configured to use the mobile application for authentication, you can send them an email that lets them know that they have been configured to use Azure Multi-Factor Authentication and it will direct them to complete their account enrollment through the Azure Multi-Factor Authentication User Portal. A hyperlink will be included that the user clicks on to access the User Portal. When the user clicks on the hyperlink, their web browser will open and take them to their company’s Azure Multi-Factor Authentication User Portal. - -#### Settings - -By clicking the email icon on the left you can setup the settings for sending these emails. This is where you can enter the SMTP information of your mail server and it allows you to send a blanket wide email by adding a check to the Send mails to users check box. - -#### Content - -On the Email Content tab, you will see all of the various email templates that are available to choose from. So, depending on how you have configured your users to use multi-factor authentication, you can choose the template that best suits you. - -##### Edit the Content Settings - -The Azure MFA server does not send emails, even when configured to do so, until you configured the sender information for each email template listed in the Content tab. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. Click **Email** from the list of icons and click the **Email Content** tab. -3. Select an email template from the list of templates. Click **Edit**. -4. In the **Edit Email** dialog, in the **From** text box, type the email address of the person or group that should appear to have sent the email. - ![Edit email dialog within content settings](images/hello-mfa-content-edit-email.png) - -5. Optionally, customize other options in the email template. -6. When finished editing the template, Click **Apply**. -7. Click **Next** to move to the next email in the list. Repeat steps 4 and 6 to edit the changes. -8. Click **Close** when you are done editing the email templates. - -### Configuring Directory Integration Settings and Synchronization - -Synchronization keeps the Multi-Factor Authentication user database synchronized with the users in Active Directory or another LDAP Lightweight Directory Access Protocol directory. The process is similar to Importing Users from Active Directory, but periodically polls for Active Directory user and security group changes to process. It also provides for disabling or removing users removed from a container or security group and removing users deleted from Active Directory. - -It is important to use a different group memberships for synchronizing users from Active Directory and for enabling Windows Hello for Business. Keeping the group memberships separated enables you to synchronize users and configure MFA options without immediately deploying Windows Hello for Business to that user. This deployment approach provides the maximum flexibility, which gives users the ability to configure their settings before they provision Windows Hello for Business. To start provisioning, simply add the group used for synchronization to the Windows Hello for Business Users group (or equivalent if you use custom names). - -#### MultiFactorAuthAdSync Service - -The MultiFactorAuthAdSync service is a Windows service that performs the periodic polling of Active Directory. It is installed in a Stopped state and is started by the MultiFactorAuth service when configured to run. If you have a multi-server Multi-Factor Authentication configuration, the MultiFactorAuthAdSync may only be run on a single server. - -The MultiFactorAuthAdSync service uses the DirSync LDAP server extension provided by Microsoft to efficiently poll for changes. This DirSync control caller must have the "directory get changes" right and DS-Replication-Get-Changes extended control access right. By default, these rights are assigned to the Administrator and LocalSystem accounts on domain controllers. The MultiFactorAuthAdSync service is configured to run as LocalSystem by default. Therefore, it is simplest to run the service on a domain controller. The service can run as an account with lesser permissions if you configure it to always perform a full synchronization. This is less efficient, but requires less account privileges. - -#### Settings - -Configuring the directory synchronization between Active Directory and the Azure MFA server is easy. - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Click the **Synchronization** tab. -4. Select **Use Active Directory**. -5. Select **Include trusted domains** to have the Multi-Factor Authentication Server attempt to connect to domains trusted by the current domain, another domain in the forest, or domains involved in a forest trust. When not importing or synchronizing users from any of the trusted domains, clear the check box to improve performance. - -#### Synchronization - -The MFA server uses synchronization items to synchronize users from Active Directory to the MFA server database. Synchronization items enables you to synchronize a collection of users based security groups or Active Directory containers. - -You can configure synchronization items based on different criteria and filters. For the purpose of configuring Windows Hello for Business, you need to create a synchronization item based membership of the Windows Hello for Business user group. This ensures the same users who receive Windows Hello for Business policy settings are the same users synchronized to the MFA server (and are the same users with permission to enroll in the certificate). This significantly simplifies deployment and troubleshooting. - -See [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint) for more details. - -##### To add a synchronization item - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Select the **Synchronization** tab. -4. On the **Synchronization** tab, click **Add**. - ![Azure MFA Server - add synchronization item screen](images/hello-mfa-sync-item.png) - -5. In the **Add Synchronization Item** dialog, select **Security Groups** from the **View** list. -6. Select the group you are using for replication from the list of groups -7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. -8. Select **Add new users and Update existing users**. -9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. -10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. -11. Select **Enabled** and select **Only New Users with Phone Number** from the list. -12. Select **Send email** and select **New and Updated Users**. - -##### Configure synchronization item defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Method Defaults** tab. -2. Select the default second factor authentication method. For example, if the second factor of authentication is a text message, select **Text message**. Select if the direction of text message authentication and if the authentication should use a one-time password or one-time password and PIN (Ensure users are configured to create a PIN if the default second factor of communication requires a PIN). - -##### Configure synchronization language defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Language Defaults** tab. -2. Select the appropriate default language for these groups of users synchronized by these synchronization item. -3. If creating a new synchronization item, click **Add** to save the item. If editing an existing synchronization item, click **Apply** and then click **Close**. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint). - -### Installing the MFA Web Services SDK - -The Web Service SDK section allows the administrator to install the Multi-Factor Authentication Web Service SDK. The Web Service SDK is an IIS (Internet Information Server) web service that provides an interface for integrating the full features of the Multi-Factor Authentication Server into most any application. The Web Service SDK uses the Multi-Factor Authentication Server as the data store. - -Remember the Web Services SDK is only need on the primary Multi-Factor to easily enable other servers access to the configuration information. The prerequisites section guided you through installing and configuring the items needed for the Web Services SDK, however the installer will validate the prerequisites and make suggest any corrective action needed. - -Please follow the instructions under [Install the web service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice#install-the-web-service-sdk) to install the MFA Web Services SDK. - -## Install Secondary MFA Servers - -Additional MFA servers provided redundancy of the MFA configuration. The MFA server models uses one primary MFA server with multiple secondary servers. Servers within the same group establish communication with the primary server for that group. The primary server replicates to each of the secondary servers. You can use groups to partition the data stored on different servers, for example you can create a group for each domain, forest, or organizational unit. - -Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. - -Sign in the secondary MFA server with _domain administrator_ equivalent credentials. -1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. - **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. -2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. -3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. -4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. -5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you downloaded the latest Azure MFA Server from the Azure Portal. -* Confirm the server has Internet connectivity. -* Confirm you installed and activated the Azure MFA Server. -* Confirm your Azure MFA Server configuration meets your organization’s needs (Company Settings, Email Settings, etc). -* Confirm you created Directory Synchronization items based on your deployment to synchronize users from Active Directory to the Azure MFA server. - * For example, you have security groups representing each collection of users that represent a phase of your deployment and a corresponding synchronization item for each of those groups. - -* Confirm the Azure MFA server properly communicates with the Azure MFA cloud service by testing multifactor authentication with a newly synchronized user account. -* Confirm you installed the Web Service SDK on the primary MFA server. -* Confirm your MFA servers have adequate redundancy, should you need to promote a secondary server to the primary server. - - -## Installing the User Portal Server - -You previously configured the User Portal settings on the primary MFA server. The User Portal web application communicates to the primary MFA server using the Web Services SDK to retrieve these settings. This configuration is ideal to ensure you can scale up the User Portal application to meet the needs of your internal users. - -### Copying the User Portal Installation file - -Sign in the primary MFA server with _local administrator_ equivalent credentials. -1. Open Windows Explorer. -2. Browse to the C:\Program Files\MultiFactor Authentication Server folder. -3. Copy the **MultiFactorAuthenticationUserPortalSetup64.msi** file to a folder on the User Portal server. - -### Configure Virtual Directory name - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to the folder to which you saved the installation file from the previous step. -2. Run the **MultiFactorAuthenticationUserPortalSetup64.msi**. The installation package asks if you want to download **Visual Studio C++ Redistributable for Visual Studio 2015**. Click **Yes**. When prompted, select **Save As**. The downloaded file is missing its file extension. **Save the file with a .exe extension and install the runtime**. -3. Run the installation package again. The installer package asks about the C++ runtime again; however, this is for the X64 version (the previous prompt was for x86). Click **Yes** to download the installation package and select **Save As** so you can save the downloaded file with a .exe extension. **Install** the run time. -4. Run the User Portal installation package. On the **Select Installation Address** page, use the default settings for **Site** and **Application Pool** settings. You can modify the Virtual directory to use a name that is more fitting for the environment, such as **mfa** (This virtual directory must match the virtual directory specified in the User Portal settings). Click **Next**. -5. Click **Close**. - -### Edit MFA User Portal config file - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to C:\inetpub\wwwroot\MultiFactorAuth (or appropriate directory based on the virtual directory name) and edit the **web.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from **“** to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **web.config** file after changes have been made. - -### Create a DNS entry for the User Portal web site - -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. -1. Open the **DNS Management** console. -2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. -3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. -4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. -6. Close the **DNS Management** console. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. - -### Validating your work - -Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. - -Using a web browser, navigate to the URL provided in the *pf_up_pfwssdk_PfWsSdk* named value in the web.config file of any one of the user portal servers. The URL should be protected by a server authentication certificate and should prompt you for authentication. Authenticate to the web site using the username and password provided in the web.config file. Successful authentication and page view confirms the Web SDK configured on the primary MFA server is correctly configured and ready to work with the user portal. - -### Configuring the User Portal - -The User Portal section allows the administrator to install and configure the Multi-Factor Authentication User Portal. The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. -User Portal Administrators may be set up and granted permission to add new users and update existing users. - -#### Settings - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. - ![Azure MFA Server - User Portal settings](images/hello-mfa-user-portal-settings.png) - -3. On the Settings tab, type the URL your users use to access the User Portal. The URL should begin with https, such as `https://mfaportal.corp.contoso.com/mfa`. -The Multi-Factor Authentication Server uses this information when sending emails to users. -4. Select Allow users to log in and Allow user enrollment check boxes. -5. Select Allow users to select method. Select Phone call and select Text message (you can select Mobile application later once you have deployed the Mobile application web service). Select Automatically trigger user’s default method. -6. Select Allow users to select language. -7. Select Use security questions for fallback and select 4 from the Questions to answer list. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Deploy the user portal for the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal). - -#### Administrators - -The User Portal Settings tab allows the administrator to install and configure the User Portal. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. -3. On the Administrators tab, Click Add -4. In the Add Administrator dialog, Click Select User… to pick a user to install and manage the User Portal. Use the default permissions. -5. Click Add. - ->[!TIP] ->For more information on these settings and the behaviors they control, read the **Multi-Factor Authentication Server Help content**. - -#### Security Questions - -[Security questions](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#security-questions) for the User Portal may be customized to meet your requirements. The questions defined here will be offered as options for each of the four security questions a user is prompted to configure during their first log on to User Portal. The order of the questions is important since the first four items in the list will be used as defaults for the four security questions. - -#### Trusted IPs - -The [Trusted IPs](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#trusted-ips) tab allows you to skip Multi-Factor Authentication for User Portal log ins originating from specific IPs. For example, if users use the User Portal from the office and from home, you may decide you don't want their phones ringing for Multi-Factor Authentication while at the office. For this, you would specify the office subnet as a trusted IP entry. - -## Configure the AD FS Server to use the MFA for multifactor authentication - -You need to configure the AD FS server to use the MFA server. You do this by Installing the MFA Adapter on the primary AD FS Server. - -### Install the MFA AD FS Adapter - -Follow [Install a standalone instance of the AD FS adapter by using the Web Service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12#install-a-standalone-instance-of-the-ad-fs-adapter-by-using-the-web-service-sdk). You should follow this instructions on all AD FS servers. You can find the files needed on the MFA server. - -### Edit the MFA AD FS Adapter config file on all ADFS Servers - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to **C:\inetpub\wwwroot\MultiFactorAuth** (or appropriate directory based on the virtual directory name) and edit the **MultiFactorAuthenticationAdfsAdapter.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from “ to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **MultiFactorAuthenticationAdfsAdapter.config** file after changes have been made. - -### Edit the AD FS Adapter Windows PowerShell cmdlet - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. - -Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath ` to the end of the `Register-AdfsAuthenticationProvider` command where **\** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file. - -### Run the AD FS Adapter PowerShell cmdlet - -Sign in the primary AD FS server with local administrator equivalent credentials. - -Run **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script in PowerShell to register the adapter. The adapter is registered as **WindowsAzureMultiFactorAuthentication**. - ->[!NOTE] ->You must restart the AD FS service for the registration to take effect. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. -* Confirm you restarted the AD FS Service after completing the configuration. - -## Test AD FS with the Multifactor Authentication connector - -Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. - -1. In the **Multi-Factor Authentication** server, on the left, click **Users**. -2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. -3. Click **Test**. -4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. - -The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. - - -## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) -2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index 1b30d94278..8042bad1d8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -1,5 +1,5 @@ --- -title: Configure Windows Hello for Business Policy settings (Windows Hello for Business) +title: Configure Windows Hello for Business Policy settings - key trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 @@ -24,10 +24,10 @@ ms.reviewer: - Key trust -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. -Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. +Alternatively, you can create a copy of the .ADMX and .ADML files from a Windows 10, version 1703 installation setup template folder to their respective language folder on a Windows Server, or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. On-premises certificate-based deployments of Windows Hello for Business needs one Group Policy setting: Enable Windows Hello for Business diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 0a0ef7ef5b..51d246f3f4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -1,6 +1,6 @@ --- -title: Validate Active Directory prerequisites (Windows Hello for Business) -description: How to Validate Active Directory prerequisites for Windows Hello for Business +title: Key registration for on-premises deployment of Windows Hello for Business +description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the key trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -8,7 +8,6 @@ ms.sitesec: library ms.pagetype: security, mobile author: DaniHalfin audience: ITPro -author: mikestephens-MS ms.author: dolmont manager: dansimp ms.collection: M365-identity-device-management @@ -25,9 +24,12 @@ ms.reviewer: - Key trust -Key trust deployments need an adequate number of 2016 domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. +Key trust deployments need an adequate number of 2016 or later domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. -The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. +> [!NOTE] +>There was an issue with key trust authentication on Windows Server 2019. If you are planning to use Windows Server 2019 domain controllers refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044) to fix this issue. + +The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. ## Create the Windows Hello for Business Users Security Global Group diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 06aa82ad4b..ce54bf0ffb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -1,6 +1,6 @@ --- -title: Validate and Deploy Multifactor Authentication Services (MFA) (Windows Hello for Business) -description: How to Validate and Deploy Multifactor Authentication Services for Windows Hello for Business +title: Validate and Deploy MFA for Windows Hello for Business with key trust +description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with key trust keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -16,39 +16,22 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Validate and Deploy Multifactor Authentication Services (MFA) +# Validate and Deploy Multi-factor Authentication (MFA) > [!IMPORTANT] -> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- On-premises deployment +- Key trust -Windows Hello for Business requires all users perform an additional factor of authentication prior to creating and registering a Windows Hello for Business credential. Windows Hello for Business deployments use Azure Multi-Factor Authentication (Azure MFA) services for the secondary authentication. On-Premises deployments use Azure MFA server, an on-premises implementation that do not require synchronizing Active Directory credentials to Azure Active Directory. +Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. -Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected. -* **Easy to Use** - Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks. -* **Scalable** - Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom applications. This protection is even extended to your high-volume, mission-critical scenarios. -* **Always Protected** - Azure Multi-Factor Authentication provides strong authentication using the highest industry standards. -* **Reliable** - We guarantee 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification. +For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](https://docs.microsoft.com/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) -## On-Premises Azure MFA Server - -On-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. - -### Infrastructure - -A lab or proof-of-concept environment does not need high-availability or scalability. However, a production environment needs both of these. Ensure your environment considers and incorporates these factors, as necessary. All production environments should have a minimum of two MFA servers—one primary and one secondary server. The environment should have a minimum of two User Portal Servers that are load balanced using hardware or Windows Network Load Balancing. - -Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server. - ->[!IMPORTANT] ->Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use installation instructions provided in the article. - -Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-key-trust-deploy-mfa.md). +Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index 8845f97509..7a49cdb675 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -1,6 +1,6 @@ --- -title: Validate Public Key Infrastructure (Windows Hello for Business) -description: How to Validate Public Key Infrastructure for Windows Hello for Business +title: Validate Public Key Infrastructure - key trust model (Windows Hello for Business) +description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a key trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -16,6 +16,7 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- + # Validate and Configure Public Key Infrastructure **Applies to** @@ -63,14 +64,24 @@ Domain controllers automatically request a domain controller certificate (if pub By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. + 5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. - **Note**If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. + + > [!NOTE] + > If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. + 6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. + 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. + 8. Close the console. ### Superseding the existing Domain Controller certificate @@ -80,14 +91,23 @@ Many domain controllers may have an existing domain controller certificate. The The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. Sign-in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. + 4. Click the **Superseded Templates** tab. Click **Add**. + 5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. + 6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. + 7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. + 8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. + 9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. @@ -97,16 +117,28 @@ The certificate template is configured to supersede all the certificate template Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. - **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. + +5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. + + > [!NOTE] + > If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. + 6. On the **Request Handling** tab, select **Allow private key to be exported**. + 7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. + 8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. -9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. + +9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. + 10. Close the console. ### Unpublish Superseded Certificate Templates @@ -116,10 +148,15 @@ The certificate authority only issues certificates based on published certificat The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. + 2. Expand the parent node from the navigation pane. + 3. Click **Certificate Templates** in the navigation pane. + 4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. + 5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Publish Certificate Templates to the Certificate Authority @@ -127,13 +164,20 @@ Sign-in to the certificate authority or management workstation with _Enterprise The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. + 2. Expand the parent node from the navigation pane. + 3. Click **Certificate Templates** in the navigation pane. + 4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. + 5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. + 6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. - * To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. + + \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. 7. Close the console. @@ -142,23 +186,37 @@ Sign-in to the certificate authority or management workstations with an _Enterpr Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. 1. Start the **Group Policy Management Console** (gpmc.msc) + 2. Expand the domain and select the **Group Policy Object** node in the navigation pane. + 3. Right-click **Group Policy object** and select **New** + 4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. + 5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. + 6. In the navigation pane, expand **Policies** under **Computer Configuration**. + 7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. + 8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. + 9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. + +10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box. + 11. Select the **Update certificates that use certificate templates** check box. + 12. Click **OK**. Close the **Group Policy Management Editor**. ### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in to a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** + +1. Start the **Group Policy Management Console** (gpmc.msc). + +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…**. + 3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. ### Validating your work @@ -195,7 +253,7 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. -## Follow the Windows Hello for Business on premises certificate trust deployment guide +## Follow the Windows Hello for Business on premises key trust deployment guide 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. Validate and Configure Public Key Infrastructure (*You are here*) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 6534a2b0bb..18f6f3dbf0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -15,38 +15,42 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 10/18/2017 +ms.date: 4/16/2017 --- # Manage Windows Hello for Business in your organization **Applies to** -- Windows 10 +- Windows 10 You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. >[!IMPORTANT] ->The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511. +>The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511. > ->Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. +>Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. > >Use **PIN Complexity** policy settings to manage PINs for Windows Hello for Business. - + ## Group Policy settings for Windows Hello for Business -The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. +The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. +> [!NOTE] +> Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**. + + @@ -54,15 +58,41 @@ The following table lists the Group Policy settings that you can configure for W + + + + + + + + + + + + + + + + + + + + + - - + + - + - + - @@ -270,15 +265,17 @@ To better understand each component, review the table below:
                  PolicyScope Options
                  Use Windows Hello for Business Computer or user -

                  Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

                  +

                  Not configured: Device does not provision Windows Hello for Business for any user.

                  Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

                  Disabled: Device does not provision Windows Hello for Business for any user.

                  Use a hardware security device Computer

                  Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

                  -

                  Enabled: Windows Hello for Business will only be provisioned using TPM.

                  +

                  Enabled: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.

                  Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

                  Use certificate for on-premises authenticationComputer or user +

                  Not configured: Windows Hello for Business enrolls a key that is used for on-premises authentication.

                  +

                  Enabled: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.

                  +

                  Disabled: Windows Hello for Business enrolls a key that is used for on-premises authentication.

                  +
                  Use PIN recoveryComputer +

                  Added in Windows 10, version 1703

                  +

                  Not configured: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

                  +

                  Enabled: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

                  +

                  Disabled: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

                  +

                  + +For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md). +

                  +
                  Use biometrics Computer

                  Not configured: Biometrics can be used as a gesture in place of a PIN.

                  Enabled: Biometrics can be used as a gesture in place of a PIN.

                  @@ -72,6 +102,7 @@ The following table lists the Group Policy settings that you can configure for W
                  PIN Complexity Require digitsComputer

                  Not configured: Users must include a digit in their PIN.

                  Enabled: Users must include a digit in their PIN.

                  @@ -80,6 +111,7 @@ The following table lists the Group Policy settings that you can configure for W
                  Require lowercase lettersComputer

                  Not configured: Users cannot use lowercase letters in their PIN.

                  Enabled: Users must include at least one lowercase letter in their PIN.

                  @@ -88,6 +120,7 @@ The following table lists the Group Policy settings that you can configure for W
                  Maximum PIN lengthComputer

                  Not configured: PIN length must be less than or equal to 127.

                  Enabled: PIN length must be less than or equal to the number you specify.

                  @@ -96,6 +129,7 @@ The following table lists the Group Policy settings that you can configure for W
                  Minimum PIN lengthComputer

                  Not configured: PIN length must be greater than or equal to 4.

                  Enabled: PIN length must be greater than or equal to the number you specify.

                  @@ -104,6 +138,7 @@ The following table lists the Group Policy settings that you can configure for W
                  ExpirationComputer

                  Not configured: PIN does not expire.

                  Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

                  @@ -112,6 +147,7 @@ The following table lists the Group Policy settings that you can configure for W
                  HistoryComputer

                  Not configured: Previous PINs are not stored.

                  Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

                  @@ -122,6 +158,7 @@ The following table lists the Group Policy settings that you can configure for W
                  Require special charactersComputer

                  Not configured: Users cannot include a special character in their PIN.

                  Enabled: Users must include at least one special character in their PIN.

                  @@ -130,6 +167,7 @@ The following table lists the Group Policy settings that you can configure for W
                  Require uppercase lettersComputer

                  Not configured: Users cannot include an uppercase letter in their PIN.

                  Enabled: Users must include at least one uppercase letter in their PIN.

                  @@ -137,9 +175,9 @@ The following table lists the Group Policy settings that you can configure for W
                  >Phone Sign-in -

                  Use Phone Sign-in

                  +
                  Phone Sign-inUse Phone Sign-inComputer

                  Not currently supported.

                  @@ -152,7 +190,7 @@ The following table lists the Group Policy settings that you can configure for W The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=692070). >[!IMPORTANT] ->Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. +>Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. @@ -164,7 +202,7 @@ The following table lists the MDM policy settings that you can configure for Win - + - + + + + + + + + + + + + + + + - + - + + + + + + + + + + + + + @@ -250,7 +336,7 @@ The following table lists the MDM policy settings that you can configure for Win @@ -259,29 +345,11 @@ The following table lists the MDM policy settings that you can configure for Win - - - - - - - - - - - -
                  UsePassportForWork DeviceDevice or user True

                  True: Windows Hello for Business will be provisioned for all users on the device.

                  @@ -176,7 +214,7 @@ The following table lists the MDM policy settings that you can configure for Win
                  RequireSecurityDevice DeviceDevice or user False

                  True: Windows Hello for Business will only be provisioned using TPM.

                  @@ -184,6 +222,32 @@ The following table lists the MDM policy settings that you can configure for Win
                  ExcludeSecurityDeviceTPM12DeviceFalse +

                  Added in Windows 10, version 1703

                  +

                  True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.

                  +

                  False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.

                  +
                  EnablePinRecoveryDevice or userFalse +

                  Added in Windows 10, version 1703

                  +

                  True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

                  +

                  False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

                  +

                  + +For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md). +

                  +
                  Biometrics

                  UseBiometrics

                  @@ -214,19 +278,41 @@ The following table lists the MDM policy settings that you can configure for Win
                  Digits Device or user2 1 -

                  1: Numbers are not allowed.

                  -

                  2: At least one number is required.

                  +

                  0: Digits are allowed.

                  +

                  1: At least one digit is required.

                  +

                  2: Digits are not allowed.

                  Lowercase letters Device or user1 2 -

                  1: Lowercase letters are not allowed.

                  -

                  2: At least one lowercase letter is required.

                  +

                  0: Lowercase letters are allowed.

                  +

                  1: At least one lowercase letter is required.

                  +

                  2: Lowercase letters are not allowed.

                  +
                  Special charactersDevice or user2 +

                  0: Special characters are allowed.

                  +

                  1: At least one special character is required.

                  +

                  2: Special characters are not allowed.

                  +
                  Uppercase lettersDevice or user2 +

                  0: Uppercase letters are allowed.

                  +

                  1: At least one uppercase letter is required.

                  +

                  2: Uppercase letters are not allowed.

                  Device or user 0 -

                  Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. +

                  Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.

                  Device or user 0 -

                  Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. +

                  Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.

                  Special charactersDevice or user1 -

                  1: Special characters are not allowed.

                  -

                  2: At least one special character is required.

                  -
                  Uppercase lettersDevice or user1 -

                  1: Uppercase letters are not allowed

                  -

                  2: At least one uppercase letter is required

                  -
                  Remote

                  UseRemotePassport

                  @@ -295,20 +363,53 @@ The following table lists the MDM policy settings that you can configure for Win
                  >[!NOTE] -> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. - +> In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN. + +## Policy conflicts from multiple policy sources + +Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device. + +Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. All PIN complexity policies are grouped together and enforced from a single policy source. + +Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis. + +>[!NOTE] +> Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP. + +>Examples +> +>The following are configured using computer Group Policy: +> +>- Use Windows Hello for Business - Enabled +>- User certificate for on-premises authentication - Enabled +>- Require digits - Enabled +>- Minimum PIN length - 6 +> +>The following are configured using device MDM Policy: +> +>- UsePassportForWork - Disabled +>- UseCertificateForOnPremAuth - Disabled +>- MinimumPINLength - 8 +>- Digits - 1 +>- LowercaseLetters - 1 +>- SpecialCharacters - 1 +> +>Enforced policy set: +> +>- Use Windows Hello for Business - Enabled +>- Use certificate for on-premises authentication - Enabled +>- Require digits - Enabled +>- Minimum PIN length - 6d ## How to use Windows Hello for Business with Azure Active Directory -There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: +There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: -- **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. -- **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. +- **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant's directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. +- **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won't be enabled unless and until the organization's administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. - **Organizations that have subscribed to Azure AD Premium** have access to the full set of Azure AD MDM features. These features include controls to manage Windows Hello for Business. You can set policies to disable or force the use of Windows Hello for Business, require the use of a TPM, and control the length and strength of PINs set on the device. -If you want to use Windows Hello for Business with certificates, you’ll need a device registration system. That means that you set up Configuration Manager, Microsoft Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. - - +If you want to use Windows Hello for Business with certificates, you'll need a device registration system. That means that you set up Configuration Manager, Microsoft Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. ## Related topics @@ -320,4 +421,3 @@ If you want to use Windows Hello for Business with certificates, you’ll need a - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) - [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) - diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 07989c7579..80d8f81611 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -1,7 +1,7 @@ --- -title: Windows Hello for Business (Windows 10) -ms.reviewer: -description: An overview of Windows Hello for Business +title: Windows Hello for Business Overview (Windows 10) +ms.reviewer: An overview of Windows Hello for Business +description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices in Windows 10. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -15,6 +15,7 @@ ms.collection: M365-identity-device-management ms.topic: conceptual localizationpriority: medium --- + # Windows Hello for Business Overview **Applies to** @@ -43,19 +44,12 @@ As an administrator in an enterprise or educational organization, you can create ## Biometric sign-in - Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras. Fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. + Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras. Fingerprint reader hardware can be used or added to devices that don't currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users' credentials. - **Facial recognition**. This type of biometric recognition uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. - **Fingerprint recognition**. This type of biometric recognition uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. -Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. - -## From Windows 10 version 1803, the Windows Hello feature can be used as a safe and secure sign-in method. -Fingerprint scan can be enabled on laptop computers using a built-in fingerprint reader or an external USB fingerprint reader, as follows: -1. Go to **Settings** > **Accounts** > **Sign-in-options** > **Windows Hello Fingerprint** > **Add fingerprint** -2. Users will need to add a PIN after adding their fingerprint(s) to the reader configuration. -3. Windows Biometric data is located in the `C:\Windows\System32\WinBioDatabase\` folder (fingerprint data is stored with the .DAT file name extension). -4. If you are unable to sign in with previously registered fingerprints, delete the entire content of this folder and register your fingerprints again. +Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn't roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there's no single collection point an attacker can compromise to steal biometric data. For more information about biometric authentication with Windows Hello for Business, see [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md). ## The difference between Windows Hello and Windows Hello for Business @@ -100,11 +94,12 @@ For details, see [How Windows Hello for Business works](hello-how-it-works.md). Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing end user certificates can continue to use PKI in combination with Windows Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing user certificates can rely on key-based credentials for Windows Hello but still use certificates on their domain controllers as a root of trust. -Windows Hello for Business with a key does not support RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments. - +Windows Hello for Business with a key does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). ## Learn more +[Implementing strong user authentication with Windows Hello for Business](https://www.microsoft.com/en-us/itshowcase/implementing-strong-user-authentication-with-windows-hello-for-business) + [Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/en-us/itshowcase/implementing-windows-hello-for-business-at-microsoft) [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 207675b3e4..265aa7219d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -1,6 +1,6 @@ --- title: Planning a Windows Hello for Business Deployment -description: A guide to planning a Windows Hello for Business deployment +description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: conceptual -ms.date: 08/19/2018 +ms.date: 09/16/2020 ms.reviewer: --- # Planning a Windows Hello for Business Deployment @@ -21,24 +21,24 @@ ms.reviewer: **Applies to** - Windows 10 -> This guide only applies to Windows 10, version 1511 or higher. - Congratulations! You are taking the first step forward in helping move your organizations away from password to a two-factor, convenience authentication for Windows — Windows Hello for Business. This planning guide helps you understand the different topologies, architectures, and components that encompass a Windows Hello for Business infrastructure. - -This guide explains the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of the infrastructure. Armed with your planning worksheet, you’ll use that information to select the correct deployment guide for your needs. + +This guide explains the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of the infrastructure. Armed with your planning worksheet, you'll use that information to select the correct deployment guide for your needs. + +If you have an Azure tenant, you can use our online, interactive Passwordless Wizard which walks through the same choices instead of using our manual guide below. The Passwordless Wizard is available in the [Microsoft 365 admin center](https://admin.microsoft.com/AdminPortal/Home#/modernonboarding/passwordlesssetup). ## Using this guide -There are many options from which you can choose when deploying Windows Hello for Business. Providing multiple options ensures nearly every organization can deploy Windows Hello for Business. Providing many options makes the deployment appear complex, however, most organization will realize they’ve already implemented most of the infrastructure on which the Windows Hello for Business deployment depends. It is important to understand that Windows Hello for Business is a distributed system and does take proper planning across multiple teams within an organization. +There are many options from which you can choose when deploying Windows Hello for Business. Providing multiple options ensures nearly every organization can deploy Windows Hello for Business. Providing many options makes the deployment appear complex, however, most organization will realize they've already implemented most of the infrastructure on which the Windows Hello for Business deployment depends. It is important to understand that Windows Hello for Business is a distributed system and does take proper planning across multiple teams within an organization. -This guide removes the appearance of complexity by helping you make decisions on each aspect of your Windows Hello for Business deployment and the options you’ll need to consider. Using this guide also identifies the information needed to help you make decisions about the deployment that best suits your environment. Download the [Windows Hello for Business planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514) from the Microsoft Download Center to help track your progress and make your planning easier. +This guide removes the appearance of complexity by helping you make decisions on each aspect of your Windows Hello for Business deployment and the options you'll need to consider. Using this guide also identifies the information needed to help you make decisions about the deployment that best suits your environment. Download the [Windows Hello for Business planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514) from the Microsoft Download Center to help track your progress and make your planning easier. ### How to Proceed Read this document and record your decisions on the worksheet. When finished, your worksheet has all the necessary information for your Windows Hello for Business deployment. There are six major categories you need to consider for a Windows Hello for Business deployment. Those categories are: -* Deployment Options +* Deployment Options * Client * Management * Active Directory @@ -47,7 +47,7 @@ There are six major categories you need to consider for a Windows Hello for Busi ### Baseline Prerequisites -Windows Hello for Business has a few baseline prerequisites with which you can begin. These baseline prerequisites are provided in the worksheet. +Windows Hello for Business has a few baseline prerequisites with which you can begin. These baseline prerequisites are provided in the worksheet. ### Deployment Options @@ -66,22 +66,34 @@ The hybrid deployment model is for organizations that: * Have identities synchronized to Azure Active Directory using Azure Active Directory Connect * Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources +> [!Important] +> Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
                  +> **Requirements:**
                  +> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 + ##### On-premises The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory. +> [!Important] +> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
                  +> **Requirements:**
                  +> Reset from settings - Windows 10, version 1703, Professional
                  +> Reset above lock screen - Windows 10, version 1709, Professional
                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 -It’s fundamentally important to understand which deployment model to use for a successful deployment. Some of aspects of the deployment may already be decided for you based on your current infrastructure. +It's fundamentally important to understand which deployment model to use for a successful deployment. Some aspects of the deployment may have already been decided for you based on your current infrastructure. #### Trust types -A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust. - -The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. +A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust. -The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. +The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 or later domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. ->[!NOTE] ->RDP does not support authentication with Windows Hello for business key trust deployments. RDP is only supported with certificate trust deployments at this tim +The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 or later Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. + +> [!NOTE] +> RDP does not support authentication with Windows Hello for Business key trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). #### Device registration @@ -89,19 +101,22 @@ All devices included in the Windows Hello for Business deployment must go throug #### Key registration -The built-in Windows Hello for Business provisioning experience creates a hardware bound asymmetric key pair as their user’s credentials. The private key is protected by the device’s security modules; however, the credential is a user key (not a device key). The provisioning experience registers the user’s public key with the identity provider. For cloud only and hybrid deployments, the identity provider is Azure Active Directory. For on-premises deployments, the identity provider is the on-premises server running Windows Server 2016 Active Directory Federation Services (AD FS) role. +The built-in Windows Hello for Business provisioning experience creates a hardware bound asymmetric key pair as their user's credentials. The private key is protected by the device's security modules; however, the credential is a user key (not a device key). The provisioning experience registers the user's public key with the identity provider. For cloud only and hybrid deployments, the identity provider is Azure Active Directory. For on-premises deployments, the identity provider is the on-premises server running Windows Server 2016 Active Directory Federation Services (AD FS) role. #### Multifactor authentication -The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user’s weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential. +> [!IMPORTANT] +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure AD Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details. -Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure Multi-factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). ->[!NOTE] -> Azure Multi-Factor Authentication is available through: ->* Microsoft Enterprise Agreement ->* Open Volume License Program ->* Cloud Solution Providers program ->* Bundled with +The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user's weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential. + +Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure AD Multi-Factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). +> [!NOTE] +> Azure AD Multi-Factor Authentication is available through: +> * Microsoft Enterprise Agreement +> * Open Volume License Program +> * Cloud Solution Providers program +> * Bundled with > * Azure Active Directory Premium > * Enterprise Mobility Suite > * Enterprise Cloud Suite @@ -143,9 +158,9 @@ Some deployment combinations require an Azure account, and some require Azure Ac ## Planning a Deployment -Planning your Windows Hello for Business deployment begins with choosing a deployment type. Like all distributed systems, Windows Hello for Business depends on multiple components within your organization’s infrastructure. +Planning your Windows Hello for Business deployment begins with choosing a deployment type. Like all distributed systems, Windows Hello for Business depends on multiple components within your organization's infrastructure. -Use the remainder of this guide to help with planning your deployment. As you make decisions, write the results of those decisions in your planning worksheet. When finished, you’ll have all the information needed to complete the planning process and the appropriate deployment guide that best helps you with your deployment. +Use the remainder of this guide to help with planning your deployment. As you make decisions, write the results of those decisions in your planning worksheet. When finished, you'll have all the information needed to complete the planning process and the appropriate deployment guide that best helps you with your deployment. ### Deployment Model @@ -153,16 +168,13 @@ Choose the deployment model based on the resources your users access. Use the f If your organization does not have on-premises resources, write **Cloud Only** in box **1a** on your planning worksheet. -If your organization is federated with Azure or uses any online service, such as Office365 or OneDrive, or your users' access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. +If your organization is federated with Azure or uses any service, such as AD Connect, Office365 or OneDrive, or your users access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. If your organization does not have cloud resources, write **On-Premises** in box **1a** on your planning worksheet. > [!NOTE] -> If you’re unsure if your organization is federated, run the following Active Directory Windows PowerShell command from an elevated Windows PowerShell prompt and evaluate the results. -> ```Get-AdObject “CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=[forest_root_CN_name],DC=com" -Properties keywords``` -> * If the command returns an error stating it could not find the object, then you have yet to configured AAD Connect or on-premises Device Registration Services using AD FS. Ensure the name is accurate and validate the object does not exist with another Active Directory Management tool such as **ADSIEdit.msc**. If the object truly does not exist, then your environment does not bind you to a specific deployment or require changes to accommodate the desired deployment type. -> * If the command returns a value, compare that value with the values below. The value indicates the deployment model you should implement -> * If the value begins with **azureADName:** – write **Hybrid** in box **1a**on your planning worksheet. -> * If the value begins with **enterpriseDrsName:** – write **On-Premises** in box **1a** on your planning worksheet. +> * Main use case of On-Premises deployment is for "Enhanced Security Administrative Environments" also known as "Red Forests". +> * Migration from on-premise to hybrid deployment will require redeployment. + ### Trust type @@ -196,13 +208,13 @@ If box **1a** on your planning worksheet reads **on-premises**, write **AD FS** ### Directory Synchronization -Windows Hello for Business is strong user authentication, which usually means there is an identity (a user or username) and a credential (typically a key pair). Some operations require writing or reading user data to or from the directory. For example, reading the user’s phone number to perform multi-factor authentication during provisioning or writing the user’s public key. +Windows Hello for Business is strong user authentication, which usually means there is an identity (a user or username) and a credential (typically a key pair). Some operations require writing or reading user data to or from the directory. For example, reading the user's phone number to perform multi-factor authentication during provisioning or writing the user's public key. If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in box **1e**. User information is written directly to Azure Active Directory and there is not another directory with which the information must be synchronized. If box **1a** on your planning worksheet reads **hybrid**, then write **Azure AD Connect** in box **1e** on your planning worksheet. -If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusively uses Active Directory for user information with the exception of the multi-factor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multi-factor authentication while the user’s credentials remain on the on-premises network. +If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusively uses Active Directory for user information with the exception of the multi-factor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multi-factor authentication while the user's credentials remain on the on-premises network. ### Multifactor Authentication @@ -217,7 +229,7 @@ If box **1a** on your planning worksheet reads **hybrid**, then you have a few o * Use AD FS w/3rd Party MFA Adapter You can directly use the Azure MFA cloud service for the second factor of authentication. Users contacting the service must authenticate to Azure prior to using the service. - + If your Azure AD Connect is configured to synchronize identities (usernames only), then your users are redirected to your local on-premises federation server for authentication and then redirected back to the Azure MFA cloud service. Otherwise, your Azure AD Connect is configured to synchronize credentials (username and passwords), which enables your users to authenticate to Azure Active Directory and use the Azure MFA cloud service. If you choose to use the Azure MFA cloud service directly, write **Azure MFA** in box **1f** on your planning worksheet. You can configure your on-premises Windows Server 2016 AD FS role to use the Azure MFA service adapter. In this configuration, users are redirected to the on premises AD FS server (synchronizing identities only). The AD FS server uses the MFA adapter to communicate to the Azure MFA service to perform the second factor of authentication. If you choose to use AD FS with the Azure MFA cloud service adapter, write **AD FS with Azure MFA cloud adapter** in box **1f** on your planning worksheet. @@ -236,7 +248,7 @@ Windows Hello for Business provides organizations with many policy settings and If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in box **2a** on your planning worksheet. You have the option to manage non-domain joined devices. If you choose to manage Azure Active Directory joined devices, write **modern management** in box **2b** on your planning worksheet. Otherwise, write** N/A** in box **2b**. ->[!NOTE] +> [!NOTE] > Azure Active Directory joined devices without modern management automatically enroll in Windows Hello for Business using the default policy settings. Use modern management to adjust policy settings to match the business needs of your organization. If box **1a** on your planning worksheet reads **on-prem**, write **GP** in box **2a** on your planning worksheet. Write **N/A** in box **2b** on your worksheet. @@ -252,8 +264,8 @@ If you use modern management for both domain and non-domain joined devices, writ Windows Hello for Business is a feature exclusive to Windows 10. Some deployments and features are available using earlier versions of Windows 10. Others need the latest versions. If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in box **3a** on your planning worksheet. Optionally, you may write **1511 or later** in box **3b** on your planning worksheet if you plan to manage non-domain joined devices. ->[!NOTE] ->Azure Active Directory joined devices without modern management automatically enroll in Windows Hello for Business using the default policy settings. Use modern management to adjust policy settings to match the business needs of your organization. +> [!NOTE] +> Azure Active Directory joined devices without modern management automatically enroll in Windows Hello for Business using the default policy settings. Use modern management to adjust policy settings to match the business needs of your organization. Write **1511 or later** in box **3a** on your planning worksheet if any of the following are true. * Box **2a** on your planning worksheet read **modern management**. @@ -316,7 +328,7 @@ If box **1a** on your planning worksheet reads **cloud only** or **hybrid**, wri If box **1a** on your planning worksheet reads **on-premises**, and box **1f** reads **AD FS with third party**, write **No** in box **6a** on your planning worksheet. Otherwise, write **Yes** in box **6a** as you need an Azure account for per-consumption MFA billing. Write **No** in box **6b** on your planning worksheet—on-premises deployments do not use the cloud directory. -Windows Hello for Business does not require an Azure AD premium subscription. However, some dependencies do. +Windows Hello for Business does not require an Azure AD premium subscription. However, some dependencies, such as [MDM automatic enrollment](https://docs.microsoft.com/mem/intune/enrollment/quickstart-setup-auto-enrollment) and [Conditional Access](https://docs.microsoft.com/azure/active-directory/conditional-access/overview) do. If box **1a** on your planning worksheet reads **on-premises**, write **No** in box **6c** on your planning worksheet. @@ -328,6 +340,6 @@ Modern managed devices do not require an Azure AD premium subscription. By forg If boxes **2a** or **2b** read **modern management** and you want devices to automatically enroll in your modern management software, write **Yes** in box **6c** on your planning worksheet. Otherwise, write **No** in box **6c**. -## Congratulations, You’re Done +## Congratulations, You're Done -Your Windows Hello for Business planning worksheet should be complete. This guide provided understanding of the components used in the Windows Hello for Business infrastructure and rationalization of why they are used. The worksheet gives you an overview of the requirements needed to continue the next phase of the deployment. With this worksheet, you’ll be able to identify key elements of your Windows Hello for Business deployment. +Your Windows Hello for Business planning worksheet should be complete. This guide provided understanding of the components used in the Windows Hello for Business infrastructure and rationalization of why they are used. The worksheet gives you an overview of the requirements needed to continue the next phase of the deployment. With this worksheet, you'll be able to identify key elements of your Windows Hello for Business deployment. diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index d9ecb9798b..c53586ff18 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Videos -description: Windows Hello for Business Videos +description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10. keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless ms.prod: w10 ms.mktglfcycl: deploy @@ -24,14 +24,33 @@ ms.reviewer: ## Overview of Windows Hello for Business and Features Watch Pieter Wigleven explain Windows Hello for Business, Multi-factor Unlock, and Dynamic Lock + > [!VIDEO https://www.youtube.com/embed/G-GJuDWbBE8] +## Why PIN is more secure than a password + +Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than a password. + +> [!VIDEO https://www.youtube.com/embed/cC24rPBvdhA] + ## Microsoft's passwordless strategy Watch Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less** > [!VIDEO https://www.youtube.com/embed/mXJS615IGLM] +## Windows Hello for Business Provisioning + +Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business provisioning works. + +> [!VIDEO https://www.youtube.com/embed/RImGsIjSJ1s] + +## Windows Hello for Business Authentication + +Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business authentication works. + +> [!VIDEO https://www.youtube.com/embed/WPmzoP_vMek] + ## Windows Hello for Business user enrollment experience The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 375f2be134..d74bd61baa 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -21,13 +21,18 @@ ms.date: 10/23/2017 # Why a PIN is better than a password **Applies to** + - Windows 10 Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. +Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than a password. + +> [!VIDEO https://www.youtube.com/embed/cC24rPBvdhA] ## PIN is tied to the device + One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device. @@ -44,7 +49,7 @@ When the PIN is created, it establishes a trusted relationship with the identity The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. -User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. +User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can't be stolen in cases where the identity provider or websites the user accesses have been compromised. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. @@ -54,10 +59,11 @@ The Windows Hello for Business PIN is subject to the same set of IT management p ## What if someone steals the laptop or phone? -To compromise a Windows Hello credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before [TPM anti-hammering](/windows/device-security/tpm/tpm-fundamentals#anti-hammering) protection locks the device. +To compromise a Windows Hello credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user's biometrics or guess his or her PIN—and all of this must be done before [TPM anti-hammering](/windows/device-security/tpm/tpm-fundamentals#anti-hammering) protection locks the device. You can provide additional protection for laptops that don't have TPM by enabling BitLocker and setting a policy to limit failed sign-ins. **Configure BitLocker without TPM** + 1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: **Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Require additional authentication at startup** @@ -72,7 +78,8 @@ You can provide additional protection for laptops that don't have TPM by enablin 2. Set the number of invalid logon attempts to allow, and then click OK. ## Why do you need a PIN to use biometrics? -Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. + +Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can't use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account and password, which doesn't provide you the same level of protection as Hello. diff --git a/windows/security/identity-protection/hello-for-business/images/aadj/MEM.png b/windows/security/identity-protection/hello-for-business/images/aadj/MEM.png new file mode 100644 index 0000000000..d98d871f21 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadj/MEM.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png new file mode 100644 index 0000000000..46db47b6f0 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png new file mode 100644 index 0000000000..215b22ec23 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png new file mode 100644 index 0000000000..91dc9f58ba Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile04.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile04.png new file mode 100644 index 0000000000..d15801152e Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile04.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/event358-2.png b/windows/security/identity-protection/hello-for-business/images/event358-2.png new file mode 100644 index 0000000000..53fd554323 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/event358-2.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png b/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png index bc2fdb105b..44bbc4a572 100644 Binary files a/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png and b/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-applications.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-applications.png new file mode 100644 index 0000000000..3001e771d8 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-applications.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-prompt.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-prompt.png new file mode 100644 index 0000000000..9e5e339b30 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-prompt.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png deleted file mode 100644 index bacdb127ea..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png deleted file mode 100644 index ae7328c4a4..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt.png new file mode 100644 index 0000000000..e4a92204ee Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt.png differ diff --git a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md index 3878a9b907..d924d3f98c 100644 --- a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md +++ b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md @@ -1,6 +1,6 @@ --- title: Microsoft-compatible security key -description: Windows 10 enables users to sign in to their device using a security key. How is a Microsoft-compatible security key different (and better) than any other FIDO2 security key +description: Learn how a Microsoft-compatible security key for Windows 10 is different (and better) than any other FIDO2 security key. keywords: FIDO2, security key, CTAP, Hello, WHFB ms.prod: w10 ms.mktglfcycl: deploy @@ -21,7 +21,7 @@ ms.reviewer: > Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. +Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. See [FIDO2 security keys features and providers](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys). The [FIDO2 CTAP specification](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html) contains a few optional features and extensions which are crucial to provide that seamless and secure experience. diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 57238c3214..dd1b6b18e0 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -1,6 +1,6 @@ --- title: Passwordless Strategy -description: Reducing Password Usage Surface +description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10. keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index f3d95ae6ee..00b0bd2e95 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -1,6 +1,6 @@ --- title: How Windows Hello for Business works (Windows 10) -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Learn about registration, authentication, key material, and infrastructure for Windows Hello for Business. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md index 8bd5be542e..3913ea8734 100644 --- a/windows/security/identity-protection/hello-for-business/toc.md +++ b/windows/security/identity-protection/hello-for-business/toc.md @@ -7,14 +7,19 @@ ## [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) ## [Windows Hello for Business Features](hello-features.md) +### [Conditional Access](hello-feature-conditional-access.md) +### [Dual Enrollment](hello-feature-dual-enrollment.md) +### [Dynamic Lock](hello-feature-dynamic-lock.md) ### [Multifactor Unlock](feature-multifactor-unlock.md) +### [PIN Reset](hello-feature-pin-reset.md) +### [Remote Desktop](hello-feature-remote-desktop.md) ## [How Windows Hello for Business works](hello-how-it-works.md) ### [Technical Deep Dive](hello-how-it-works.md#technical-deep-dive) -#### [Technology and Terminology](hello-how-it-works-technology.md) #### [Device Registration](hello-how-it-works-device-registration.md) #### [Provisioning](hello-how-it-works-provisioning.md) #### [Authentication](hello-how-it-works-authentication.md) +#### [Technology and Terminology](hello-how-it-works-technology.md) ## [Planning a Windows Hello for Business Deployment](hello-planning-guide.md) @@ -53,13 +58,12 @@ #### [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) #### [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) #### [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -##### [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md) #### [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) ## [Windows Hello and password changes](hello-and-password-changes.md) ## [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) -## [Windows Hello for Business Frequently Asked Questions (FAQ)](hello-faq.md) +## [Windows Hello for Business Frequently Asked Questions (FAQ)](hello-faq.yml) ### [Windows Hello for Business Videos](hello-videos.md) ## [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) diff --git a/windows/security/identity-protection/images/remote-credential-guard-gp.png b/windows/security/identity-protection/images/remote-credential-guard-gp.png index a65253b04e..f7db3ee411 100644 Binary files a/windows/security/identity-protection/images/remote-credential-guard-gp.png and b/windows/security/identity-protection/images/remote-credential-guard-gp.png differ diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index d55a5400cc..98e0bb9835 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -21,6 +21,7 @@ Learn more about identity and access management technologies in Windows 10 and | Section | Description | |-|-| +| [Technical support policy for lost or forgotten passwords](password-support-policy.md)| Outlines the ways in which Microsoft can help you reset a lost or forgotten password, and provides links to instructions for doing so. | | [Access control](access-control/access-control.md) | Describes access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. Key concepts that make up access control are permissions, ownership of objects, inheritance of permissions, user rights, and object auditing. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | diff --git a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md index a181ec72c9..65e353cb81 100644 --- a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/password-support-policy.md b/windows/security/identity-protection/password-support-policy.md new file mode 100644 index 0000000000..b92183cdd3 --- /dev/null +++ b/windows/security/identity-protection/password-support-policy.md @@ -0,0 +1,58 @@ +--- +title: Technical support policy for lost or forgotten passwords +description: Outlines the ways in which Microsoft can help you reset a lost or forgotten password, and provides links to instructions for doing so. +ms.reviewer: kaushika +manager: kaushika +ms.custom: +- CI ID 110060 +- CSSTroubleshoot +ms.author: v-tea +ms.prod: w10 +ms.sitesec: library +ms.pagetype: security +author: Teresa-Motiv +ms.topic: article +ms.localizationpriority: medium +ms.date: 11/20/2019 +audience: ITPro +--- + +# Technical support policy for lost or forgotten passwords + +Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. Be aware that, if these options don’t work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password. + +If you lose or forget a password, you can use the links in this article to find published support information that will help you reset the password. + +## How to reset a password for a domain account + +If you lose or forget the password for a domain account, contact your IT administrator or Helpdesk. For more information, see [Change or reset your Windows password](https://support.microsoft.com/help/4490115). + +## How to reset a password for a Microsoft account + +If you lose or forget the password for your Microsoft Account, use the [Recover your account](https://account.live.com/ResetPassword.aspx) wizard. + +This wizard requests your security proofs. If you have forgotten your security proofs, or no longer have access to them, select **I no longer have these anymore**. After you select this option, fill out a form for the Microsoft Account team. Provide as much information as you can on this form. The Microsoft Account team reviews the information that you provide to determine whether you are the account holder. This decision is final. Microsoft does not influence the team's choice of action. + +## How to reset a password for a local account on a Windows device + +Local accounts on a device include the device's Administrator account. + +### Windows 10 + +If you lose or forget the password for a local account on a device that runs Windows 10, see [Reset your Windows 10 local account password](https://support.microsoft.com/help/4028457). + +### Windows 8.1 or Windows 7 + +If you lose or forget the password for a local account on a device that runs Windows 8.1 or Windows 7, see [Change or reset your Windows password](https://support.microsoft.com/help/4490115). In that article, you can select your operating system version from the **Select Product Version** menu. + +## How to reset a hardware BIOS password + +If you lose or forget the password for the hardware BIOS of a device, contact the device manufacturer for help and support. If you do contact the manufacturer online, make sure that you visit the manufacturer website and not the website of some third party. + +## How to reset a password for an individual file + +Some applications let you password-protect individual files. If you lose or forget such a password, you can rely on that application only to reset or recover it. Microsoft support engineers cannot help you reset, retrieve, or circumvent such passwords. + +## Using third-party password tools + +Some third-party companies claim to be able to circumvent passwords that have been applied to files and features that Microsoft programs use. For legal reasons, we cannot recommend or endorse any one of these companies. If you want help to circumvent or reset a password, you can locate and contact a third party for this help. However, you use such third-party products and services at your own risk. diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 59a2e070cb..60dc685e1e 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -53,12 +53,12 @@ Use the following table to compare different Remote Desktop connection security
                  -| **Feature** | **Remote Desktop** | **Windows Defender Remote Credential Guard** | **Restricted Admin mode** | +| Feature | Remote Desktop | Windows Defender Remote Credential Guard | Restricted Admin mode | |--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the “domain user”. Any attack is local to the server | | **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

                  For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | | **Helps prevent**                    |      N/A          |
                  • Pass-the-Hash
                  • Use of a credential after disconnection
                  |
                  • Pass-the-Hash
                  • Use of domain identity during connection
                  | -| **Credentials supported from the remote desktop client device** |
                  • Signed on credentials
                  • Supplied credentials
                  • Saved credentials
                  |
                  • Signed on credentials only |
                    • Signed on credentials
                    • Supplied credentials
                    • Saved credentials
                    | +| **Credentials supported from the remote desktop client device** |
                    • Signed on credentials
                    • Supplied credentials
                    • Saved credentials
                    |
                    • Signed on credentials only |
                      • Signed on credentials
                      • Supplied credentials
                      • Saved credentials
                      | | **Access** | **Users allowed**, that is, members of Remote Desktop Users group of remote host. | **Users allowed**, that is, members of Remote Desktop Users of remote host. | **Administrators only**, that is, only members of Administrators group of remote host. | | **Network identity** | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as remote host’s identity**. | | **Multi-hop** | From the remote desktop, **you can connect through Remote Desktop to another computer** | From the remote desktop, you **can connect through Remote Desktop to another computer**. | Not allowed for user as the session is running as a local host account | @@ -67,7 +67,7 @@ Use the following table to compare different Remote Desktop connection security
                      For further technical information, see [Remote Desktop Protocol](https://msdn.microsoft.com/library/aa383015(v=vs.85).aspx) -and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot)) +and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot)).
                      @@ -79,7 +79,7 @@ For helpdesk support scenarios in which personnel require administrative access Therefore, we recommend instead that you use the Restricted Admin mode option. For helpdesk support scenarios, RDP connections should only be initiated using the /RestrictedAdmin switch. This helps ensure that credentials and other user resources are not exposed to compromised remote hosts. For more information, see [Mitigating Pass-the-Hash and Other Credential Theft v2](https://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf). -To further harden security, we also recommend that you implement Local Administrator Password Solution (LAPS), a Group Policy client-side extension (CSE) introduced in Windows 8.1 that automates local administrator password management. LAPS mitigates the risk of lateral escalation and other cyberattacks facilitated when customers use the same administrative local account and password combination on all their computers. You can download and install LAPS [here](https://www.microsoft.com/en-us/download/details.aspx?id=46899). +To further harden security, we also recommend that you implement Local Administrator Password Solution (LAPS), a Group Policy client-side extension (CSE) introduced in Windows 8.1 that automates local administrator password management. LAPS mitigates the risk of lateral escalation and other cyberattacks facilitated when customers use the same administrative local account and password combination on all their computers. You can download and install LAPS [here](https://www.microsoft.com/download/details.aspx?id=46899). For further information on LAPS, see [Microsoft Security Advisory 3062591](https://technet.microsoft.com/library/security/3062591.aspx). @@ -92,9 +92,12 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r The Remote Desktop client device: -- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. +- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. + - Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host. + - Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard. + - Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk. The Remote Desktop remote host: @@ -108,9 +111,13 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. > [!NOTE] > Remote Desktop client devices running earlier versions, at minimum Windows 10 version 1607, only support signed-in credentials, so the client device must also be joined to an Active Directory domain. Both Remote Desktop client and server must either be joined to the same domain, or the Remote Desktop server can be joined to a domain that has a trust relationship to the client device's domain. +> +> GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for delegation of non-exportable credentials. - For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication. + - The remote host must be running at least Windows 10 version 1607, or Windows Server 2016. + - The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Windows Defender Remote Credential Guard. ## Enable Windows Defender Remote Credential Guard @@ -118,15 +125,20 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. You must enable Restricted Admin or Windows Defender Remote Credential Guard on the remote host by using the Registry. 1. Open Registry Editor on the remote host. + 2. Enable Restricted Admin and Windows Defender Remote Credential Guard: + - Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa. + - Add a new DWORD value named **DisableRestrictedAdmin**. + - To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0 to turn on Windows Defender Remote Credential Guard. + 3. Close Registry Editor. You can add this by running the following command from an elevated command prompt: -``` +```console reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD ``` @@ -143,13 +155,15 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C ![Windows Defender Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) 3. Under **Use the following restricted mode**: - - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Windows Defender Remote Credential Guard, choose **Prefer Windows Defender Remote Credential Guard**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used. - > **Note:** Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. + - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx) or Windows Defender Remote Credential Guard, choose **Restrict Credential Delegation**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used. - - If you want to require Windows Defender Remote Credential Guard, choose **Require Windows Defender Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic. + > [!NOTE] + > Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. - - If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic. + - If you want to require Windows Defender Remote Credential Guard, choose **Require Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic. + + - If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic. 4. Click **OK**. @@ -162,7 +176,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C If you don't use Group Policy in your organization, or if not all your remote hosts support Remote Credential Guard, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Windows Defender Remote Credential Guard for that connection. -``` +```console mstsc.exe /remoteGuard ``` diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 695c7d15b9..5e5003aa9f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 33bbc7b730..89ddb7fa8a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 2bf4650d4b..997384b9e0 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index cd06dda9a5..17564fc13b 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -185,7 +185,7 @@ Certificate requirements are listed by versions of the Windows operating system. The smart card certificate has specific format requirements when it is used with Windows XP and earlier operating systems. You can enable any certificate to be visible for the smart card credential provider. -| **Component** | **Requirements for Windows 8.1, Windows 8, Windows 7, and Windows Vista** | **Requirements for Windows XP** | +| **Component** | **Requirements for Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows 10** | **Requirements for Windows XP** | |--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | CRL distribution point location | Not required | The location must be specified, online, and available, for example:
                      \[1\]CRL Distribution Point
                      Distribution Point Name:
                      Full Name:
                      URL= | | Key usage | Digital signature | Digital signature | diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 9013c10df6..824c20a5f1 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -1,13 +1,13 @@ --- -title: Smart Cards Debugging Information (Windows 10) -description: This topic explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. +title: Smart Card Troubleshooting (Windows 10) +description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -16,19 +16,19 @@ ms.date: 04/19/2017 ms.reviewer: --- -# Smart Cards Debugging Information +# Smart Card Troubleshooting Applies To: Windows 10, Windows Server 2016 -This topic explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. +This article explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. Debugging and tracing smart card issues requires a variety of tools and approaches. The following sections provide guidance about tools and approaches you can use. - [Certutil](#certutil) -- [Debugging and tracing using WPP](#debugging-and-tracing-using-wpp) +- [Debugging and tracing using Windows software trace preprocessor (WPP)](#debugging-and-tracing-using-wpp) -- [Kerberos protocol, KDC and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing) +- [Kerberos protocol, Key Distribution Center (KDC), and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing) - [Smart Card service](#smart-card-service) @@ -42,21 +42,22 @@ For a complete description of Certutil including examples that show how to use i ### List certificates available on the smart card -To list certificates that are available on the smart card, type certutil -scinfo. +To list certificates that are available on the smart card, type `certutil -scinfo`. -> **Note**  Entering a PIN is not required for this operation. You can press ESC if you are prompted for a PIN. +> [!NOTE] +> Entering a PIN is not required for this operation. You can press ESC if you are prompted for a PIN. ### Delete certificates on the smart card -Each certificate is enclosed in a container. When you delete a certificate on the smart card, you are deleting the container for the certificate. +Each certificate is enclosed in a container. When you delete a certificate on the smart card, you're deleting the container for the certificate. -To find the container value, type certutil -scinfo. +To find the container value, type `certutil -scinfo`. To delete a container, type **certutil -delkey -csp "Microsoft Base Smart Card Crypto Provider"** "<*ContainerValue*>". ## Debugging and tracing using WPP -Windows software trace preprocessor (WPP) simplifies tracing the operation of the trace provider, and it provides a mechanism for the trace provider to log real-time binary messages. Logged messages can subsequently be converted to a human-readable trace of the operation of the trace provider. For more information about WPP, see [Diagnostics with WPP - The NDIS blog](https://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx). +WPP simplifies tracing the operation of the trace provider. It provides a mechanism for the trace provider to log real-time binary messages. Logged messages can be converted to a human-readable trace of the operation. For more information, see [Diagnostics with WPP - The NDIS blog](https://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx). ### Enable the trace @@ -64,33 +65,33 @@ Using WPP, use one of the following commands to enable tracing: - **tracelog.exe -kd -rt -start** <*FriendlyName*> **-guid \#**<*GUID*> **-f .\\**<*LogFileName*>**.etl -flags** <*flags*> **-ft 1** -- **logman start** <*FriendlyName*> **-ets -p {**<*GUID*>**} -**<*Flags*> **-ft 1 -rt -o .\\**<*LogFileName*>**.etl -mode 0x00080000* +- **logman start** <*FriendlyName*> **-ets -p {**<*GUID*>**} -**<*Flags*> **-ft 1 -rt -o .\\**<*LogFileName*>**.etl -mode 0x00080000** You can use the parameters in the following table. -| **Friendly name** | **GUID** | **Flags** | +| Friendly name | GUID | Flags | |-------------------|--------------------------------------|-----------| -| scardsvr | 13038e47-ffec-425d-bc69-5707708075fe | 0xffff | -| winscard | 3fce7c5f-fb3b-4bce-a9d8-55cc0ce1cf01 | 0xffff | -| basecsp | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | -| scksp | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | -| msclmd | fb36caf4-582b-4604-8841-9263574c4f2c | 0x7 | -| credprov | dba0e0e0-505a-4ab6-aa3f-22f6f743b480 | 0xffff | -| certprop | 30eae751-411f-414c-988b-a8bfa8913f49 | 0xffff | -| scfilter | eed7f3c9-62ba-400e-a001-658869df9a91 | 0xffff | -| wudfusbccid | a3c09ba3-2f62-4be5-a50f-8278a646ac9d | 0xffff | +| `scardsvr` | 13038e47-ffec-425d-bc69-5707708075fe | 0xffff | +| `winscard` | 3fce7c5f-fb3b-4bce-a9d8-55cc0ce1cf01 | 0xffff | +| `basecsp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | +| `scksp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | +| `msclmd` | fb36caf4-582b-4604-8841-9263574c4f2c | 0x7 | +| `credprov` | dba0e0e0-505a-4ab6-aa3f-22f6f743b480 | 0xffff | +| `certprop` | 30eae751-411f-414c-988b-a8bfa8913f49 | 0xffff | +| `scfilter` | eed7f3c9-62ba-400e-a001-658869df9a91 | 0xffff | +| `wudfusbccid` | a3c09ba3-2f62-4be5-a50f-8278a646ac9d | 0xffff | Examples To enable tracing for the SCardSvr service: -- tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\\scardsvr.etl -flags 0xffff -ft 1 +- **tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\\scardsvr.etl -flags 0xffff -ft 1** -- logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\\scardsvr.etl -mode 0x00080000 +- **logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\\scardsvr.etl -mode 0x00080000** To enable tracing for scfilter.sys: -tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\\scfilter.etl -flags 0xffff -ft 1 + - **tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\\scfilter.etl -flags 0xffff -ft 1** ### Stop the trace @@ -100,73 +101,74 @@ Using WPP, use one of the following commands to stop the tracing: - **logman -stop** <*FriendlyName*> **-ets** -Examples +#### Examples To stop a trace: -- tracelog.exe -stop scardsvr +- **tracelog.exe -stop scardsvr** -- logman -stop scardsvr -ets +- **logman -stop scardsvr -ets** -## Kerberos protocol, KDC and NTLM debugging and tracing +## Kerberos protocol, KDC, and NTLM debugging and tracing -You can use the following resources to begin troubleshooting these protocols and the KDC: +You can use these resources to troubleshoot these protocols and the KDC: -- [Kerberos and LDAP Troubleshooting Tips](https://technet.microsoft.com/library/bb463167.aspx) +- [Kerberos and LDAP Troubleshooting Tips](https://technet.microsoft.com/library/bb463167.aspx). -- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit)  You can use the trace log tool in this SDK to debug Kerberos authentication failures. +- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit).  You can use the trace log tool in this SDK to debug Kerberos authentication failures. -To begin tracing, you can use Tracelog. Different components use different control GUIDs as explained in the following examples. For more information, see [Tracelog](https://msdn.microsoft.com/library/windows/hardware/ff552994.aspx). +To begin tracing, you can use `Tracelog`. Different components use different control GUIDs as explained in these examples. For more information, see [`Tracelog`](https://msdn.microsoft.com/library/windows/hardware/ff552994.aspx). ### NTLM -To enable tracing for NTLM authentication, run the following at the command line: +To enable tracing for NTLM authentication, run the following command on the command line: -tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1 + - **tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1** -To stop tracing for NTLM authentication, run the following at the command line: +To stop tracing for NTLM authentication, run this command: -tracelog -stop ntlm + - **tracelog -stop ntlm** ### Kerberos authentication -To enable tracing for Kerberos authentication, run the following at the command line: +To enable tracing for Kerberos authentication, run this command: -tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1 + - **tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1** -To stop tracing for Kerberos authentication, run the following at the command line: +To stop tracing for Kerberos authentication, run this command: -tracelog.exe -stop kerb + - **tracelog.exe -stop kerb** ### KDC -To enable tracing for the Key Distribution Center (KDC), run the following at the command line: +To enable tracing for the KDC, run the following command on the command line: -tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\\kdc.etl -flags 0x803 -ft 1 + - **tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\\kdc.etl -flags 0x803 -ft 1** -To stop tracing for the KDC, run the following at the command line: +To stop tracing for the KDC, run the following command on the command line: -tracelog.exe -stop kdc + - **tracelog.exe -stop kdc** -To stop tracing from a remote computer, run the following at the command line: logman.exe -s *<ComputerName>*. +To stop tracing from a remote computer, run this command: logman.exe -s *<ComputerName>*. -> **Note**  The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name. +> [!NOTE] +> The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name. ### Configure tracing with the registry You can also configure tracing by editing the Kerberos registry values shown in the following table. -| **Element** | **Registry Key Setting** | +| Element | Registry Key Setting | |-------------|----------------------------------------------------| | NTLM | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1\_0
                      Value name: NtLmInfoLevel
                      Value type: DWORD
                      Value data: c0015003 | | Kerberos | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos
                      Value name: LogToFile
                      Value type: DWORD
                      Value data: 00000001

                      HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
                      Value name: KerbDebugLevel
                      Value type: DWORD
                      Value data: c0000043

                      HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
                      Value name: LogToFile
                      Value type: DWORD
                      Value data: 00000001 | | KDC | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Kdc
                      Value name: KdcDebugLevel
                      Value type: DWORD
                      Value data: c0000803 | -If you used Tracelog, look for the following log file in your current directory: kerb.etl/kdc.etl/ntlm.etl. +If you used `Tracelog`, look for the following log file in your current directory: kerb.etl/kdc.etl/ntlm.etl. -Otherwise, if you used the registry key settings shown in the previous table, look for the generated trace log files in the following locations: +If you used the registry key settings shown in the previous table, look for the trace log files in the following locations: - NTLM: %systemroot%\\tracing\\msv1\_0 @@ -174,19 +176,19 @@ Otherwise, if you used the registry key settings shown in the previous table, lo - KDC: %systemroot%\\tracing\\kdcsvc  -To decode event trace files, you can use Tracefmt (tracefmt.exe). Tracefmt is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. Tracefmt can display the messages in the Command Prompt window or save them in a text file. It is located in the \\tools\\tracing subdirectory of the Windows Driver Kit (WDK). For more information, see [Tracefmt](https://msdn.microsoft.com/library/ff552974.aspx). +To decode event trace files, you can use `Tracefmt` (tracefmt.exe). `Tracefmt` is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. `Tracefmt` can display the messages in the Command Prompt window or save them in a text file. It is located in the \\tools\\tracing subdirectory of the Windows Driver Kit (WDK). For more information, see [`Tracefmt`](https://msdn.microsoft.com/library/ff552974.aspx). ## Smart Card service -The smart card resource manager service runs in the context of a local service, and it is implemented as a shared service of the services host (svchost) process. +The smart card resource manager service runs in the context of a local service. It's implemented as a shared service of the services host (svchost) process. **To check if Smart Card service is running** -1. Press CTRL+ALT+DEL, and then click **Start Task Manager**. +1. Press CTRL+ALT+DEL, and then select **Start Task Manager**. -2. In the **Windows Task Manager** dialog box, click the **Services** tab. +2. In the **Windows Task Manager** dialog box, select the **Services** tab. -3. Click the **Name** column to sort the list alphabetically, and then type **s**. +3. Select the **Name** column to sort the list alphabetically, and then type **s**. 4. In the **Name** column, look for **SCardSvr**, and then look under the **Status** column to see if the service is running or stopped. @@ -194,17 +196,17 @@ The smart card resource manager service runs in the context of a local service, 1. Run as administrator at the command prompt. -2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. +2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. -3. At the command prompt, type **net stop SCardSvr**. +3. At the command prompt, type `net stop SCardSvr`. -4. At the command prompt, type **net start SCardSvr**. +4. At the command prompt, type `net start SCardSvr`. -You can use the following command at the command prompt to check whether the service is running: **sc queryex scardsvr**. +You can use the following command at the command prompt to check whether the service is running: `sc queryex scardsvr`. -The following is example output from running this command: +The following code sample is an example output from this command: -``` +```console SERVICE_NAME: scardsvr TYPE : 20 WIN32_SHARE_PROCESS STATE : 4 RUNNING @@ -226,19 +228,20 @@ As with any device connected to a computer, Device Manager can be used to view p 1. Navigate to **Computer**. -2. Right-click **Computer**, and then click **Properties**. +2. Right-click **Computer**, and then select **Properties**. -3. Under **Tasks**, click **Device Manager**. +3. Under **Tasks**, select **Device Manager**. -4. In Device Manager, expand **Smart card readers**, select the name of the smart card reader you want to check, and then click **Properties**. +4. In Device Manager, expand **Smart card readers**, select the name of the smart card reader you want to check, and then select **Properties**. -> **Note**  If the smart card reader is not listed in Device Manager, in the **Action** menu, click **Scan for hardware changes**. +> [!NOTE] +> If the smart card reader is not listed in Device Manager, in the **Action** menu, select **Scan for hardware changes**. ## CryptoAPI 2.0 Diagnostics -CryptoAPI 2.0 Diagnostics is a feature that is available in Windows operating systems that supports CryptoAPI 2.0. This feature can help you troubleshoot public key infrastructure (PKI) issues. +CryptoAPI 2.0 Diagnostics is available in Windows versions that support CryptoAPI 2.0 and can help you troubleshoot public key infrastructure (PKI) issues. -CryptoAPI 2.0 Diagnostics logs events in the Windows event log, which contain detailed information about certificate chain validation, certificate store operations, and signature verification. This information makes it easier to identify the causes of issues and reduces the time required for diagnosis. +CryptoAPI 2.0 Diagnostics logs events in the Windows event log. The logs contain detailed information about certificate chain validation, certificate store operations, and signature verification. This information makes it easier to identify the causes of issues and reduces the time required for diagnosis. For more information about CryptoAPI 2.0 Diagnostics, see [Troubleshooting an Enterprise PKI](https://technet.microsoft.com/library/cc771463.aspx). diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index cb5e74736a..d905fbf992 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -97,14 +97,14 @@ The smart card reader device name is constructed in the form <*VendorName*> | 607 | Reader object failed to start monitor thread:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                      %1 = Windows error code | | 608 | Reader monitor failed to create power down timer: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                      %1 = Windows error code | | 609 | Reader monitor failed to create overlapped event:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                      %1 = Windows error code | -| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1  If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.
                      %1 = Windows error code
                      %2 = Name of the smart card reader
                      %3 = IOCTL that was sent
                      %4 = First 4 bytes of the command sent to the smart card | +| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1  If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.
                      %1 = Windows error code
                      %2 = Name of the smart card reader
                      %3 = IOCTL that was sent
                      %4 = First 4 bytes of the command sent to the smart card
                      These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios.| | 611 | Smart Card Reader initialization failed | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve this issue. | | 612 | Reader insertion monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                      %1 = Windows error code | | 615 | Reader removal monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                      %1 = Windows error code | | 616 | Reader monitor '%2' received uncaught error code:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                      %1 = Windows error code
                      %2 = Reader name | | 617 | Reader monitor '%1' exception -- exiting thread | An unknown error occurred while monitoring a smart card reader for smart card insertions and removals. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                      %1 = Smart card reader name | | 618 | Smart Card Resource Manager encountered an unrecoverable internal error. | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. | -| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                      %1 = Windows error code | +| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                      %1 = Windows error code
                      These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios. | | 622 | Server Control failed to access stop event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                      %1 = Windows error code | ## Smart card Plug and Play events diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index dd70a1c7c6..04e43174e8 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -1,13 +1,13 @@ --- title: Smart Card Group Policy and Registry Settings (Windows 10) -description: This topic for the IT professional and smart card developer describes the Group Policy settings, registry key settings, local security policy settings, and credential delegation policy settings that are available for configuring smart cards. +description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -18,9 +18,9 @@ ms.reviewer: # Smart Card Group Policy and Registry Settings -Applies To: Windows 10, Windows Server 2016 +Applies to: Windows 10, Windows Server 2016 -This topic for the IT professional and smart card developer describes the Group Policy settings, registry key settings, local security policy settings, and credential delegation policy settings that are available for configuring smart cards. +This article for IT professionals and smart card developers describes the Group Policy settings, registry key settings, local security policy settings, and credential delegation policy settings that are available for configuring smart cards. The following sections and tables list the smart card-related Group Policy settings and registry keys that can be set on a per-computer basis. If you use domain Group Policy Objects (GPOs), you can edit and apply Group Policy settings to local or domain computers. @@ -66,21 +66,23 @@ The following sections and tables list the smart card-related Group Policy setti ## Primary Group Policy settings for smart cards -The following smart card Group Policy settings are located in Computer Configuration\\Administrative Templates\\Windows Components\\Smart Card. +The following smart card Group Policy settings are in Computer Configuration\\Administrative Templates\\Windows Components\\Smart Card. The registry keys are in the following locations: -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\Policies\\Microsoft\\Windows\\ScPnP\\EnableScPnP +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\Policies\\Microsoft\\Windows\\ScPnP\\EnableScPnP** -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\SmartCardCredentialProvider +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\SmartCardCredentialProvider** -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CertProp +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CertProp** -> **Note**  Smart card reader registry information is located in HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\Readers.
                      Smart card registry information is located in HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\SmartCards. +> [!NOTE] +> Smart card reader registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\Readers**.
                      +Smart card registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\SmartCards**. -The following table lists the default values for these GPO settings. Variations are documented under the policy descriptions in this topic. +The following table lists the default values for these GPO settings. Variations are documented under the policy descriptions in this article. -| **Server Type or GPO** | **Default Value** | +| **Server type or GPO** | **Default value** | |----------------------------------------------|-------------------| | Default Domain Policy | Not configured | | Default Domain Controller Policy | Not configured | @@ -91,13 +93,14 @@ The following table lists the default values for these GPO settings. Variations ### Allow certificates with no extended key usage certificate attribute -This policy setting allows certificates without an enhanced key usage (EKU) set to be used for sign in. +You can use this policy setting to allow certificates without an enhanced key usage (EKU) set to be used for sign in. -> **Note**  Enhanced key usage certificate attribute is also known as extended key usage. +> [!NOTE] +> Enhanced key usage certificate attribute is also known as extended key usage. +> +> In versions of Windows before Windows Vista, smart card certificates that are used to sign in require an EKU extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. -In versions of Windows prior to Windows Vista, smart card certificates that are used to sign in require an EKU extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. - -When this policy setting is enabled, certificates with the following attributes can also be used to sign in with a smart card: +When this policy setting is turned on, certificates with the following attributes can also be used to sign in with a smart card: - Certificates with no EKU @@ -105,7 +108,7 @@ When this policy setting is enabled, certificates with the following attributes - Certificates with a Client Authentication EKU -When this policy setting is disabled or not configured, only certificates that contain the smart card logon object identifier can be used to sign in with a smart card. +When this policy setting isn't turned on, only certificates that contain the smart card logon object identifier can be used to sign in with a smart card. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| @@ -116,68 +119,87 @@ When this policy setting is disabled or not configured, only certificates that c ### Allow ECC certificates to be used for logon and authentication -This policy setting allows you to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to sign in to a domain. When this setting is enabled, ECC certificates on a smart card can be used to sign in to a domain. When this setting is disabled or not configured, ECC certificates on a smart card cannot be used to sign in to a domain. +You can use this policy setting to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to sign in to a domain. + +When this setting is turned on, ECC certificates on a smart card can be used to sign in to a domain. + +When this setting isn't turned on, ECC certificates on a smart card can't be used to sign in to a domain. | **Item** | **Description** | |--------------------------------------|-------------------------------| -| Registry key | EnumerateECCCerts | +| Registry key | **EnumerateECCCerts** | | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | -| Notes and resources | This policy setting only affects a user's ability to sign in to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting.
                      If you use an ECDSA key to sign in, you must also have an associated ECDH key to permit sign-in when you are not connected to the network. | +| Notes and resources | This policy setting only affects a user's ability to sign in to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, aren't affected by this policy setting.
                      If you use an ECDSA key to sign in, you must also have an associated ECDH key to permit sign in when you're not connected to the network. | ### Allow Integrated Unblock screen to be displayed at the time of logon -This policy setting lets you determine whether the integrated unblock feature is available in the sign-in user interface (UI). The feature was introduced as a standard feature in the Credential Security Support Provider in Windows Vista. +You can use this policy setting to determine whether the integrated unblock feature is available in the sign-in user interface (UI). The feature was introduced as a standard feature in the Credential Security Support Provider in Windows Vista. -When this setting is enabled, the integrated unblock feature is available. When this setting is disabled or not configured, the feature is not available. +When this setting is turned on, the integrated unblock feature is available. + +When this setting isn't turned on, the feature is not available. | **Item** | **Description** | |--------------------------------------|---------------------------------------------------------------------------------------------------------------| -| Registry key | AllowIntegratedUnblock | +| Registry key | **AllowIntegratedUnblock** | | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | -| Notes and resources | To use the integrated unblock feature, the smart card must support it. Check with the hardware manufacturer to verify that the smart card supports this feature.
                      You can create a custom message that is displayed when the smart card is blocked by configuring the policy setting [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked). | +| Notes and resources | To use the integrated unblock feature, the smart card must support it. Check with the hardware manufacturer to verify that the smart card supports this feature.
                      You can create a custom message that the user sees when the smart card is blocked by configuring the policy setting [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked). | ### Allow signature keys valid for Logon -This policy setting lets you allow signature key-based certificates to be enumerated and available for sign in. When this setting is enabled, any certificates available on the smart card with a signature-only key are listed on the sign-in screen. When this setting is disabled or not configured, certificates available on the smart card with a signature-only key are not listed on the sign-in screen. +You can use this policy setting to allow signature key–based certificates to be enumerated and available for sign in. + +When this setting is turned on, any certificates that are available on the smart card with a signature-only key are listed on the sign-in screen. + +When this setting isn't turned on, certificates available on the smart card with a signature-only key aren't listed on the sign-in screen. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | AllowSignatureOnlyKeys | +| Registry key | **AllowSignatureOnlyKeys**| | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | | ### Allow time invalid certificates -This policy setting permits those certificates that are expired or not yet valid to be displayed for sign-in. +You can use this policy setting to permit certificates that are expired or not yet valid to be displayed for sign in. -Prior to Windows Vista, certificates were required to contain a valid time and to not expire. To be used, the certificate must be accepted by the domain controller. This policy setting only controls which certificates are displayed on the client computer. +> [!NOTE] +> Before Windows Vista, certificates were required to contain a valid time and to not expire. For a certificate to be used, it must be accepted by the domain controller. This policy setting only controls which certificates are displayed on the client computer. -When this setting is enabled, certificates are listed on the sign-in screen whether they have an invalid time or their time validity has expired. When this setting is disabled or not configured, certificates that are expired or not yet valid are not listed on the sign-in screen. +When this setting is turned on, certificates are listed on the sign-in screen whether they have an invalid time, or their time validity has expired. + +When this policy setting isn't turned on, certificates that are expired or not yet valid aren't listed on the sign-in screen. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | AllowTimeInvalidCertificates | +| Registry key | **AllowTimeInvalidCertificates** | | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | | ### Allow user name hint -This policy setting lets you determine whether an optional field is displayed during sign-in and provides a subsequent elevation process that allows users to enter their user name or user name and domain, which associates a certificate with the user. If this setting is enabled, an optional field is displayed that allows users to enter their user name or user name and domain. If this setting is disabled or not configured, the field is not displayed. +You can use this policy setting to determine whether an optional field appears during sign in and provides a subsequent elevation process where users can enter their username or username and domain, which associates a certificate with the user. + +When this policy setting is turned on, users see an optional field where they can enter their username or username and domain. + +When this policy setting isn't turned on, users don't see this optional field. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | X509HintsNeeded | +| Registry key | **X509HintsNeeded**| | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | | ### Configure root certificate clean up -This policy setting allows you to manage the cleanup behavior of root certificates. Certificates are verified by using a trust chain, and the trust anchor for the digital certificate is the Root Certification Authority (CA). A CA can issue multiple certificates with the root certificate as the top certificate of the tree structure. A private key is used to sign other certificates. This creates an inherited trustworthiness for all certificates immediately under the root certificate. When this setting is enabled, you can set the following cleanup options: +You can use this policy setting to manage the cleanup behavior of root certificates. Certificates are verified by using a trust chain, and the trust anchor for the digital certificate is the Root Certification Authority (CA). A CA can issue multiple certificates with the root certificate as the top certificate of the tree structure. A private key is used to sign other certificates. This creates an inherited trustworthiness for all certificates immediately under the root certificate. + +When this policy setting is turned on, you can set the following cleanup options: - **No cleanup**. When the user signs out or removes the smart card, the root certificates used during their session persist on the computer. @@ -185,122 +207,168 @@ This policy setting allows you to manage the cleanup behavior of root certificat - **Clean up certificates on log off**. When the user signs out of Windows, the root certificates are removed. -When this policy setting is disabled or not configured, root certificates are automatically removed when the user signs out of Windows. +When this policy setting isn't turned on, root certificates are automatically removed when the user signs out of Windows. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | RootCertificateCleanupOption | +| Registry key | **RootCertificateCleanupOption**| | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | | ### Display string when smart card is blocked -When this policy setting is enabled, you can create and manage the displayed message that the user sees when a smart card is blocked. When this setting is disabled or not configured (and the integrated unblock feature is also enabled), the system’s default message is displayed to the user when the smart card is blocked. +You can use this policy setting to change the default message that a user sees if their smart card is blocked. + +When this policy setting is turned on, you can create and manage the displayed message that the user sees when a smart card is blocked. + +When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system’s default message when the smart card is blocked. | **Item** | **Description** | |--------------------------------------|-------------------------| -| Registry key | IntegratedUnblockPromptString | +| Registry key | **IntegratedUnblockPromptString** | | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: This policy setting is only effective when the [Allow Integrated Unblock screen to be displayed at the time of logon](#allow-integrated-unblock-screen-to-be-displayed-at-the-time-of-logon) policy is enabled. | | Notes and resources | | ### Filter duplicate logon certificates -This policy setting lets you use a filtering process to configure which valid sign-in certificates are displayed. During the certificate renewal period, a user’s smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. +You can use this policy setting to configure which valid sign-in certificates are displayed. -Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (this is determined by their UPN). When this policy setting is enabled, filtering occurs so that the user will only see the most current valid certificates from which to select. If this setting is disabled or not configured, all the certificates are displayed to the user. +> [!NOTE] +> During the certificate renewal period, a user’s smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. +> +> If two certificates are issued from the same template with the same major version and they are for the same user (this is determined by their UPN), they are determined to be the same. + +When this policy setting is turned on, filtering occurs so that the user can select from only the most current valid certificates. + +If this policy setting isn't turned on, all the certificates are displayed to the user. This policy setting is applied to the computer after the [Allow time invalid certificates](#allow-time-invalid-certificates) policy setting is applied. | **Item** | **Description** | |--------------------------------------|--------------------------------------------------------------------------------------------------| -| Registry key | FilterDuplicateCerts | +| Registry key | **FilterDuplicateCerts**| | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate that is used to sign in to computers running Windows 2000, Windows XP, or Windows Server 2003 will be displayed. Otherwise, the certificate with the most distant expiration time will be displayed. | ### Force the reading of all certificates from the smart card -This policy setting allows you to manage how Windows reads all certificates from the smart card for sign-in. During sign in, Windows reads only the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This policy setting forces Windows to read all the certificates from the smart card. +You can use this policy setting to manage how Windows reads all certificates from the smart card for sign in. During sign in, Windows reads only the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This policy setting forces Windows to read all the certificates from the smart card. -When this policy setting is enabled, Windows attempts to read all certificates from the smart card regardless of the CSP feature set. When disabled or not configured, Windows attempts to read only the default certificate from smart cards that do not support retrieval of all certificates in a single call. Certificates other than the default are not available for sign in. +When this policy setting is turned on, Windows attempts to read all certificates from the smart card, regardless of the CSP feature set. + +When this policy isn't turned on, Windows attempts to read only the default certificate from smart cards that don't support retrieval of all certificates in a single call. Certificates other than the default aren't available for sign in. | **Item** | **Description** | |--------------------------------------|----------------------------------------------------------------------------| -| Registry key | ForceReadingAllCertificates | +| Registry key | **ForceReadingAllCertificates** | | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None

                      **Important**  Enabling this policy setting can adversely impact performance during the sign in process in certain situations. | +| Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None

                      **Important**: Enabling this policy setting can adversely impact performance during the sign in process in certain situations. | | Notes and resources | Contact the smart card vendor to determine if your smart card and associated CSP support the required behavior. | ### Notify user of successful smart card driver installation -This policy setting allows you to control whether a confirmation message is displayed to the user when a smart card device driver is installed. When this policy setting is enabled, a confirmation message is displayed when a smart card device driver is installed. When this setting is disabled or not configured, a smart card device driver installation message is not displayed. +You can use this policy setting to control whether the user sees a confirmation message when a smart card device driver is installed. + +When this policy setting is turned on, the user sees a confirmation message when a smart card device driver is installed. + +When this setting isn't turned on, the user doesn't see a smart card device driver installation message. | **Item** | **Description** | |--------------------------------------|------------------------------------------------| -| Registry key | ScPnPNotification | +| Registry key | **ScPnPNotification** | | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | ### Prevent plaintext PINs from being returned by Credential Manager -This policy setting prevents Credential Manager from returning plaintext PINs. Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user’s profile. When this policy setting is enabled, Credential Manager does not return a plaintext PIN. When this setting is disabled or not configured, plaintext PINs can be returned by Credential Manager. +You can use this policy setting to prevent Credential Manager from returning plaintext PINs. + +> [!NOTE] +> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user’s profile. + +When this policy setting is turned on, Credential Manager doesn't return a plaintext PIN. + +When this setting isn't turned on, Credential Manager can return plaintext PINs. | **Item** | **Description** | |--------------------------------------|-----------------------------------------------------------------------------------| -| Registry key | DisallowPlaintextPin | +| Registry key | **DisallowPlaintextPin**| | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | -| Notes and resources | If this policy setting is enabled, some smart cards may not work in computers running Windows. Consult the smart card manufacturer to determine whether this policy setting should be enabled. | +| Notes and resources | If this policy setting is enabled, some smart cards might not work in computers running Windows. Consult the smart card manufacturer to determine whether this policy setting should be enabled. | ### Reverse the subject name stored in a certificate when displaying -When this policy setting is enabled, it causes the display of the subject name to be reversed from the way it is stored in the certificate during the sign-in process. +You can use this policy setting to control the way the subject name appears during sign in. + +> [!NOTE] +> To help users distinguish one certificate from another, the user principal name (UPN) and the common name are displayed by default. For example, when this setting is enabled, if the certificate subject is CN=User1, OU=Users, DN=example, DN=com and the UPN is user1@example.com, "User1" is displayed with "user1@example.com." If the UPN is not present, the entire subject name is displayed. This setting controls the appearance of that subject name, and it might need to be adjusted for your organization. + +When this policy setting is turned on, the subject name during sign in appears reversed from the way that it's stored in the certificate. + +When this policy setting isn’t turned on, the subject name appears the same as it’s stored in the certificate. -To help users distinguish one certificate from another, the user principal name (UPN) and the common name are displayed by default. For example, when this setting is enabled, if the certificate subject is CN=User1, OU=Users, DN=example, DN=com and the UPN is user1@example.com, "User1" is displayed with "user1@example.com." If the UPN is not present, the entire subject name is displayed. This setting controls the appearance of that subject name, and it might need to be adjusted for your organization. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | ReverseSubject | +| Registry key | **ReverseSubject** | | Default values | No changes per operating system versions
                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | | ### Turn on certificate propagation from smart card -This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted. The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. +You can use this policy setting to manage the certificate propagation that occurs when a smart card is inserted. +> [!NOTE] +> The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. -If you enable or do not configure this policy setting, certificate propagation occurs when the user inserts the smart card. When this setting is disabled, certificate propagation does not occur and the certificates will not be made available to applications such as Outlook. +When this policy setting is turned on, certificate propagation occurs when the user inserts the smart card. + +When this policy setting is turned off, certificate propagation doesn't occur, and the certificates aren't available to applications, like Outlook. | **Item** | **Description** | |--------------------------------------|----------------| -| Registry key | CertPropEnabled | +| Registry key | **CertPropEnabled**| | Default values | No changes per operating system versions
                      Enabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: This policy setting must be enabled to allow the [Turn on root certificate propagation from smart card](#turn-on-root-certificate-propagation-from-smart-card) setting to work when it is enabled. | | Notes and resources | | ### Turn on root certificate propagation from smart card -This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted. The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. When this policy setting is enabled or not configured, root certificate propagation occurs when the user inserts the smart card. +You can use this policy setting to manage the root certificate propagation that occurs when a smart card is inserted. + +> [!NOTE] +> The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. + +When this policy setting is turned on, root certificate propagation occurs when the user inserts the smart card. + +When this policy setting isn’t turned on, root certificate propagation doesn’t occur when the user inserts the smart card. | **Item** | **Description** | |--------------------------------------|---------------------------------------------------------------------------------------------------------| -| Registry key | EnableRootCertificate Propagation | +| Registry key | **EnableRootCertificate Propagation** | | Default values | No changes per operating system versions
                      Enabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: For this policy setting to work, the [Turn on certificate propagation from smart card](#turn-on-certificate-propagation-from-smart-card) policy setting must also be enabled. | | Notes and resources | | ### Turn on Smart Card Plug and Play service -This policy setting allows you to control whether Smart Card Plug and Play is enabled. This means that your users can use smart cards from vendors who have published their drivers through Windows Update without needing special middleware. These drivers will be downloaded in the same way as drivers for other devices in Windows. If an appropriate driver is not available from Windows Update, a PIV-compliant minidriver that is included with any of the supported versions of Windows is used for these cards. +You can use this policy setting to control whether Smart Card Plug and Play is enabled. -When the Smart Card Plug and Play policy setting is enabled or not configured, and the system attempts to install a smart card device driver the first time a smart card is inserted in a smart card reader. If this policy setting is disabled a device driver is not installed when a smart card is inserted in a smart card reader. +> [!NOTE] +> Your users can use smart cards from vendors who have published their drivers through Windows Update without needing special middleware. These drivers will be downloaded in the same way as drivers for other devices in Windows. If an appropriate driver isn't available from Windows Update, a PIV-compliant mini driver that's included with any of the supported versions of Windows is used for these cards. + +When this policy setting is turned on, the system attempts to install a smart card device driver the first time a smart card is inserted in a smart card reader. + +When this policy setting isn't turned on, a device driver isn't installed when a smart card is inserted in a smart card reader. | **Item** | **Description** | |--------------------------------------|------------------------------------------------| -| Registry key | EnableScPnP | +| Registry key | **EnableScPnP** | | Default values | No changes per operating system versions
                      Enabled and not configured are equivalent | | Policy management | Restart requirement: None
                      Sign off requirement: None
                      Policy conflicts: None | | Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | @@ -309,9 +377,9 @@ When the Smart Card Plug and Play policy setting is enabled or not configured, a The following registry keys can be configured for the base cryptography service provider (CSP) and the smart card key storage provider (KSP). The following tables list the keys. All keys use the DWORD type. -The registry keys for the Base CSP are located in the registry in HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Base Smart Card Crypto Provider. +The registry keys for the Base CSP are in the registry in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Base Smart Card Crypto Provider**. -The registry keys for the smart card KSP are located in HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Cryptography\\Providers\\Microsoft Smart Card Key Storage Provider. +The registry keys for the smart card KSP are in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Cryptography\\Providers\\Microsoft Smart Card Key Storage Provider**. **Registry keys for the base CSP and smart card KSP** @@ -320,7 +388,7 @@ The registry keys for the smart card KSP are located in HKEY\_LOCAL\_MACHINE\\SY | **AllowPrivateExchangeKeyImport** | A non-zero value allows RSA exchange (for example, encryption) private keys to be imported for use in key archival scenarios.
                      Default value: 00000000 | | **AllowPrivateSignatureKeyImport** | A non-zero value allows RSA signature private keys to be imported for use in key archival scenarios.
                      Default value: 00000000 | | **DefaultPrivateKeyLenBits** | Defines the default length for private keys, if desired.
                      Default value: 00000400
                      Default key generation parameter: 1024-bit keys | -| **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that do not support on-card key generation or where key escrow is required.
                      Default value: 00000000 | +| **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that don't support on-card key generation or where key escrow is required.
                      Default value: 00000000 | | **TransactionTimeoutMilliseconds** | Default timeout values allow you to specify whether transactions that take an excessive amount of time will fail.
                      Default value: 000005dc1500
                      The default timeout for holding transactions to the smart card is 1.5 seconds. | **Additional registry keys for the smart card KSP** @@ -332,14 +400,14 @@ The registry keys for the smart card KSP are located in HKEY\_LOCAL\_MACHINE\\SY ## CRL checking registry keys -The following table lists the keys and the corresponding values to turn off certificate revocation list (CRL) checking at the Key Distribution Center (KDC) or client. To manage CRL checking, you need to configure settings for both the KDC and the client. +The following table lists the keys and the corresponding values to turn off certificate revocation list (CRL) checking at the Key Distribution Center (KDC) or client. To manage CRL checking, you must configure settings for both the KDC and the client. **CRL checking registry keys** | **Registry Key** | **Details** | |------------|-----------------------------| -| HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Services\\Kdc\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors | Type = DWORD
                      Value = 1 | -| HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Control\\LSA\\Kerberos\\Parameters\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors | Type = DWORD
                      Value = 1 | +| **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Services\\Kdc\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors**| Type = DWORD
                      Value = 1 | +| **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Control\\LSA\\Kerberos\\Parameters\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors**| Type = DWORD
                      Value = 1 | ## Additional smart card Group Policy settings and registry keys @@ -349,40 +417,41 @@ In a smart card deployment, additional Group Policy settings can be used to enha - Interactive logon: Do not require CTRL+ALT+DEL (not recommended) -The following smart card-related Group Policy settings are located in Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options. +The following smart card-related Group Policy settings are in Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options. **Local security policy settings** -| Group Policy Setting and Registry Key | Default | Description | +| Group Policy setting and registry key | Default | Description | |------------------------------------------|------------|---------------| -| Interactive logon: Require smart card

                      scforceoption | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

                      **Enabled** Users can only sign in to the computer by using a smart card.
                      **Disabled** Users can sign in to the computer by using any method. | -| Interactive logon: Smart card removal behavior

                      scremoveoption | This policy setting is not defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
                      **No Action**
                      **Lock Workstation**: The workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.
                      **Force Logoff**: The user is automatically signed out when the smart card is removed.
                      **Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. This allows the user to reinsert the smart card and resume the session later, or at another computer that is equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

                      **Note**  Remote Desktop Services was called Terminal Services in previous versions of Windows Server. | +| Interactive logon: Require smart card

                      **scforceoption** | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

                      **Enabled** Users can sign in to the computer only by using a smart card.
                      **Disabled** Users can sign in to the computer by using any method. | +| Interactive logon: Smart card removal behavior

                      **scremoveoption** | This policy setting isn't defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
                      **No Action**
                      **Lock Workstation**: The workstation is locked when the smart card is removed, so users can leave the area, take their smart card with them, and still maintain a protected session.
                      **Force Logoff**: The user is automatically signed out when the smart card is removed.
                      **Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. The user can reinsert the smart card and resume the session later, or at another computer that's equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

                      **Note**: In earlier versions of Windows Server, Remote Desktop Services was called Terminal Services. | From the Local Security Policy Editor (secpol.msc), you can edit and apply system policies to manage credential delegation for local or domain computers. -The following smart card-related Group Policy settings are located in Computer Configuration\\Administrative Templates\\System\\Credentials Delegation. +The following smart card-related Group Policy settings are in Computer Configuration\\Administrative Templates\\System\\Credentials Delegation. -Registry keys are located in HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults. +Registry keys are in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults**. -> **Note**  In the following table, fresh credentials are those that you are prompted for when running an application. +> [!NOTE] +> In the following table, fresh credentials are those that you are prompted for when running an application. **Credential delegation policy settings** -| Group Policy Setting and Registry Key | Default | Description | +| Group Policy setting and registry key | Default | Description | |----------------------------------------------------------------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Allow Delegating Fresh Credentials**

                      AllowFreshCredentials | Not Configured | This policy setting applies:
                      When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
                      To applications that use the CredSSP component (for example, Remote Desktop Services).

                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                      **Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
                      **Disabled**: Delegation of fresh credentials to any computer is not permitted.

                      **Note**  This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
                      Use \*TERMSRV/\*\* for Remote Desktop Session Host (RD Session Host) running on any computer.
                      Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
                      Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | -| **Allow Delegating Fresh Credentials with NTLM-only Server Authentication**

                      AllowFreshCredentialsWhenNTLMOnly | Not Configured | This policy setting applies:
                      When server authentication was achieved by using NTLM.
                      To applications that use the CredSSP component (for example, Remote Desktop).

                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                      **Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
                      **Disabled**: Delegation of fresh credentials is not permitted to any computer.

                      **Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                      See the **Allow Delegating Fresh Credentials** policy setting description for examples. | -| **Deny Delegating Fresh Credentials**

                      DenyFreshCredentials | Not Configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

                      **Enabled**: You can specify the servers where the user's fresh credentials cannot be delegated.
                      **Disabled** or **Not Configured**: A server is not specified.

                      **Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials cannot be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                      See the **Allow Delegating Fresh Credentials** policy setting description for examples. | +| Allow Delegating Fresh Credentials

                      **AllowFreshCredentials** | Not configured | This policy setting applies:
                      When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
                      To applications that use the CredSSP component (for example, Remote Desktop Services).

                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                      **Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
                      **Disabled**: Delegation of fresh credentials to any computer isn't permitted.

                      **Note**: This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
                      Use \*TERMSRV/\*\* for Remote Desktop Session Host (RD Session Host) running on any computer.
                      Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
                      Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | +| Allow Delegating Fresh Credentials with NTLM-only Server Authentication

                      **AllowFreshCredentialsWhenNTLMOnly** | Not configured | This policy setting applies:
                      When server authentication was achieved by using NTLM.
                      To applications that use the CredSSP component (for example, Remote Desktop).

                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                      **Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
                      **Disabled**: Delegation of fresh credentials isn't permitted to any computer.

                      **Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                      See the **Allow Delegating Fresh Credentials** policy setting description for examples. | +| Deny Delegating Fresh Credentials

                      **DenyFreshCredentials** | Not configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

                      **Enabled**: You can specify the servers where the user's fresh credentials can't be delegated.
                      **Disabled** or **Not configured**: A server is not specified.

                      **Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can't be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                      For examples, see the "Allow delegating fresh credentials" policy setting. | -If you are using Remote Desktop Services with smart card logon, you cannot delegate default and saved credentials. The registry keys in the following table, which are located at HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults, and the corresponding Group Policy settings are ignored. +If you're using Remote Desktop Services with smart card logon, you can't delegate default and saved credentials. The registry keys in the following table, which are at **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults**, and the corresponding Group Policy settings are ignored. | **Registry key** | **Corresponding Group Policy setting** | |-------------------------------------|---------------------------------------------------------------------------| -| AllowDefaultCredentials | Allow Delegating Default Credentials | -| AllowDefaultCredentialsWhenNTLMOnly | Allow Delegating Default Credentials with NTLM-only Server Authentication | -| AllowSavedCredentials | Allow Delegating Saved Credentials | -| AllowSavedCredentialsWhenNTLMOnly | Allow Delegating Saved Credentials with NTLM-only Server Authentication | +| **AllowDefaultCredentials** | Allow Delegating Default Credentials | +| **AllowDefaultCredentialsWhenNTLMOnly** | Allow Delegating Default Credentials with NTLM-only Server Authentication | +| **AllowSavedCredentials** | Allow Delegating Saved Credentials | +| **AllowSavedCredentialsWhenNTLMOnly** | Allow Delegating Saved Credentials with NTLM-only Server Authentication | ## See also diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index 08f350db77..56228dff85 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 6f0f59e3d1..dd8812970c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index da07ec19a4..a913f4c769 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 63d129266c..794b8e096c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index 747e68618a..53ebc5b4f6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -1,13 +1,13 @@ --- title: Smart Card Technical Reference (Windows 10) -description: This technical reference for the IT professional and smart card developer describes the Windows smart card infrastructure for physical smart cards and how smart card-related components work in Windows. +description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 32d9213cda..254e57e0e9 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -109,9 +109,7 @@ To better understand each component, review the table below:
                  Description
                  -

                  User

                  -
                  User
                  @@ -138,9 +136,7 @@ To better understand each component, review the table below:
                  -

                  System

                  -
                  System
                  @@ -248,8 +244,7 @@ To better understand each component, review the table below:
                  -

                  Kernel

                  +
                  Kernel
                  -The slider will never turn UAC completely off. If you set it to Never notify, it will: +The slider will never turn UAC completely off. If you set it to Never notify, it will: - Keep the UAC service running. - Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt. - Automatically deny all elevation requests for standard users. -> **Important:** In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. -> -> **Warning:** Universal Windows apps will not work when UAC is disabled. +> [!IMPORTANT] +> In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. + +> [!WARNING] +> Some Universal Windows Platform apps may not work when UAC is disabled. ### Virtualization @@ -291,7 +288,9 @@ Most app tasks operate properly by using virtualization features. Although virtu Virtualization is not an option in the following scenarios: - Virtualization does not apply to apps that are elevated and run with a full administrative access token. + - Virtualization supports only 32-bit apps. Non-elevated 64-bit apps simply receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations. + - Virtualization is disabled if the app includes an app manifest with a requested execution level attribute. ### Request execution levels @@ -319,6 +318,8 @@ Before a 32-bit process is created, the following attributes are checked to dete - Key attributes in the resource script data are linked in the executable file. - There are targeted sequences of bytes within the executable file. -> **Note:** The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. -> -> **Note:** The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). +> [!NOTE] +> The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. + +> [!NOTE] +> The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 35ae0d0d3d..e8d50dc97f 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md index ad92df7445..9c9011d7ad 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md @@ -10,11 +10,10 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article -ms.localizationpriority: medium ms.date: 07/27/2017 --- diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index a6bec76e99..9cb4e34436 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -1,6 +1,6 @@ --- title: User Account Control security policy settings (Windows 10) -description: You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. +description: You can use security policies to configure how User Account Control works in your organization. ms.assetid: 3D75A9AC-69BB-4EF2-ACB3-1769791E1B98 ms.reviewer: ms.prod: w10 @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -65,7 +65,7 @@ This policy setting controls the behavior of the elevation prompt for standard u This policy setting controls the behavior of application installation detection for the computer. - **Enabled** (Default) When an app installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -- **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or System Center Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. +- **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or Microsoft Endpoint Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. ## User Account Control: Only elevate executable files that are signed and validated diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 34667eb1f8..5e643f7d75 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index d7653b982e..f0b0220678 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index fd93a5fd19..34daf7a11e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index b81fc4b4cd..aa61d00b97 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -1,13 +1,13 @@ --- title: Virtual Smart Card Overview (Windows 10) -description: This topic for IT professional provides an overview of the virtual smart card technology that was developed by Microsoft, and links to additional topics about virtual smart cards. +description: Learn more about the virtual smart card technology that was developed by Microsoft. Find links to additional topics about virtual smart cards. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: conceptual @@ -26,6 +26,9 @@ This topic for IT professional provides an overview of the virtual smart card te - [Smart Cards](../smart-cards/smart-card-windows-smart-card-technical-reference.md) +> [!NOTE] +> [Windows Hello for Business](../hello-for-business/hello-identity-verification.md) is the modern, two-factor authentication for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date has been set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. We recommend that new Windows 10 deployments use Windows Hello for Business. Virtual smart cards remain supported for Windows 7 and Windows 8. + ## Feature description Virtual smart card technology from Microsoft offers comparable security benefits to physical smart cards by using two-factor authentication. Virtual smart cards emulate the functionality of physical smart cards, but they use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. Virtual smart cards are created in the TPM, where the keys that are used for authentication are stored in cryptographically secured hardware. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index f2ce999ee5..a979d2b781 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -35,12 +35,12 @@ The Create command sets up new virtual smart cards on the user’s system. It re | Parameter | Description | |-----------|-------------| | /name | Required. Indicates the name of the new virtual smart card. | -| /AdminKey | Indicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN.
                  **DEFAULT** Specifies the default value of 010203040506070801020304050607080102030405060708.
                  **PROMPT**  Prompts the user to enter a value for the administrator key.
                  **RANDOM**  Results in a random setting for the administrator key for a card that is not returned to the user. This creates a card that might not be manageable by using smart card management tools. When generated with RANDOM, the administrator key must be entered as 48 hexadecimal characters. | +| /AdminKey | Indicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN.
                  **DEFAULT** Specifies the default value of 010203040506070801020304050607080102030405060708.
                  **PROMPT**  Prompts the user to enter a value for the administrator key.
                  **RANDOM**  Results in a random setting for the administrator key for a card that is not returned to the user. This creates a card that might not be manageable by using smart card management tools. When generated with RANDOM, the administrator key is set as 48 hexadecimal characters. | | /PIN | Indicates desired user PIN value.
                  **DEFAULT**  Specifies the default PIN of 12345678.
                  **PROMPT**  Prompts the user to enter a PIN at the command line. The PIN must be a minimum of eight characters, and it can contain numerals, characters, and special characters. | | /PUK | Indicates the desired PIN Unlock Key (PUK) value. The PUK value must be a minimum of eight characters, and it can contain numerals, characters, and special characters. If the parameter is omitted, the card is created without a PUK.
                  **DEFAULT**  Specifies the default PUK of 12345678.
                  **PROMPT**  Prompts the user to enter a PUK at the command line. | -| /generate | Generates the files in storage that are necessary for the virtual smart card to function. If the /generate parameter is omitted, it is equivalent to creating a card without this file system. A card without a file system can be managed only by a smart card management system such as Microsoft System Center Configuration Manager. | +| /generate | Generates the files in storage that are necessary for the virtual smart card to function. If the /generate parameter is omitted, it is equivalent to creating a card without this file system. A card without a file system can be managed only by a smart card management system such as Microsoft Endpoint Configuration Manager. | | /machine | Allows you to specify the name of a remote computer on which the virtual smart card can be created. This can be used in a domain environment only, and it relies on DCOM. For the command to succeed in creating a virtual smart card on a different computer, the user running this command must be a member in the local administrators group on the remote computer. | -| /pinpolicy | If **/pin prompt** is used, **/pinpolicy** allows you to specify the following PIN policy options:
                  **minlen** <minimum PIN length>
                     If not specificed, defaults to 8. The lower bound is 4.
                  **maxlen** <maximum PIN length>
                     If not specificed, defaults to 127. The upper bound is 127.
                  **uppercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
                  **lowercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
                  **digits**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
                  **specialchars**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**

                  When using **/pinpolicy**, PIN characters must be printable ASCII characters. | +| /pinpolicy | If **/pin prompt** is used, **/pinpolicy** allows you to specify the following PIN policy options:
                  **minlen** <minimum PIN length>
                     If not specified, defaults to 8. The lower bound is 4.
                  **maxlen** <maximum PIN length>
                     If not specified, defaults to 127. The upper bound is 127.
                  **uppercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
                  **lowercase**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
                  **digits**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**
                  **specialchars**  Can be **ALLOWED**, **DISALLOWED**, or **REQUIRED.** Default is **ALLOWED.**

                  When using **/pinpolicy**, PIN characters must be printable ASCII characters. | | /attestation | Configures attestation (subject only). This attestation uses an [Attestation Identity Key (AIK) certificate](https://msdn.microsoft.com/library/mt766230.aspx#gt_89a2ba3c-80af-4d1f-88b3-06ec3489fd5a) as a trust anchor to vouch that the virtual smart card keys and certificates are truly hardware bound. The attestation methods are:
                  **AIK_AND_CERT**  Creates an AIK and obtains an AIK certificate from the Microsoft cloud certification authority (CA). This requires the device to have a TPM with an [EK certificate](https://msdn.microsoft.com/library/cc249746.aspx#gt_6aaaff7f-d380-44fb-91d3-b985e458eb6d). If this option is specified and there is no network connectivity, it is possible that creation of the virtual smart card will fail.
                  **AIK_ONLY**  Creates an AIK but does not obtain an AIK certificate. | | /? | Displays Help for this command. | diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index 42f77aef08..0194ee2c80 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -1,13 +1,13 @@ --- title: Understanding and Evaluating Virtual Smart Cards (Windows 10) -description: This topic for IT professional provides information about how smart card technology can fit into your authentication design, and provides links to additional topics about virtual smart cards. +description: Learn how smart card technology can fit into your authentication design. Find links to additional topics about virtual smart cards. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index bdf8fb184c..0737f18fec 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -48,7 +48,7 @@ Virtual smart cards can also be created and deleted by using APIs. For more info - [ITPMVirtualSmartCardManagerStatusCallBack](https://msdn.microsoft.com/library/windows/desktop/hh707161(v=vs.85).aspx) -You can use APIs that were introduced in the Windows.Device.SmartCards namespace in Windows Server 2012 R2 and Windows 8.1 to build Microsoft Store apps to manage the full lifecycle of virtual smart cards. For information about how to build an app to do this, see [Strong Authentication: Building Apps That Leverage Virtual Smart Cards in Enterprise, BYOD, and Consumer Environments | Build 2013 | Channel 9](http://channel9.msdn.com/events/build/2013/2-041). +You can use APIs that were introduced in the Windows.Device.SmartCards namespace in Windows Server 2012 R2 and Windows 8.1 to build Microsoft Store apps to manage the full lifecycle of virtual smart cards. For information about how to build an app to do this, see [Strong Authentication: Building Apps That Leverage Virtual Smart Cards in Enterprise, BYOD, and Consumer Environments | Build 2013 | Channel 9](https://channel9.msdn.com/events/build/2013/2-041). The following table describes the features that can be developed in a Microsoft Store app: diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md index 73746dfff2..6b9868b0f0 100644 --- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md +++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md @@ -1,12 +1,12 @@ --- title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10) -description: Explains how to secure VPN connections for Diffie Hellman Group 2 +description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp ms.localizationpriority: medium ms.date: 02/08/2018 ms.reviewer: diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index 7b32119ae3..0b6ff85b21 100644 --- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -9,45 +9,45 @@ author: dulcemontemayor ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # How to use single sign on (SSO) over VPN and Wi-Fi connections This topic explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. The scenario is: -- You connect to a network using Wi-Fi or VPN. -- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately. +- You connect to a network using Wi-Fi or VPN. +- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately. For example, you want to connect to a corporate network and access an internal website that requires Windows integrated authentication. -At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session. -Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource. -For VPN, the VPN stack saves its credential as the session default. -For WiFi, EAP does it. +At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session. +Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource. +For VPN, the VPN stack saves its credential as the session default. +For WiFi, EAP does it. -The credentials are put in Credential Manager as a "\*Session" credential. -A "\*Session" credential implies that it is valid for the current user session. -The credentials are also cleaned up when the WiFi or VPN connection is disconnected. +The credentials are put in Credential Manager as a "\*Session" credential. +A "\*Session" credential implies that it is valid for the current user session. +The credentials are also cleaned up when the WiFi or VPN connection is disconnected. -When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so [WinInet](https://msdn.microsoft.com/library/windows/desktop/aa385483.aspx) can release the credentials that it gets from the Credential Manager to the SSP that is requesting it. -For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations). +When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so [WinInet](https://msdn.microsoft.com/library/windows/desktop/aa385483.aspx) can release the credentials that it gets from the Credential Manager to the SSP that is requesting it. +For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations). -The local security authority will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability. -If the app is not UWP, it does not matter. -But if it is a UWP app, it will look at the device capability for Enterprise Authentication. +The local security authority will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability. +If the app is not UWP, it does not matter. +But if it is a UWP app, it will look at the device capability for Enterprise Authentication. If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released. -This behavior helps prevent credentials from being misused by untrusted third parties. +This behavior helps prevent credentials from being misused by untrusted third parties. ## Intranet zone -For the Intranet zone, by default it only allows single-label names, such as Http://finance. -If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx). +For the Intranet zone, by default it only allows single-label names, such as Http://finance. +If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx). ### Setting the ZoneMap -The ZoneMap is controlled using a registry that can be set through MDM. -By default, single-label names such as http://finance are already in the intranet zone. +The ZoneMap is controlled using a registry that can be set through MDM. +By default, single-label names such as http://finance are already in the intranet zone. For multi-label names, such as http://finance.net, the ZoneMap needs to be updated. ## MDM Policy @@ -56,9 +56,9 @@ OMA URI example: ./Vendor/MSFT/Registry/HKU/S-1-5-21-2702878673-795188819-444038987-2781/Software/Microsoft/Windows/CurrentVersion/Internet%20Settings/ZoneMap/Domains/``/* as an Integer Value of 1 for each of the domains that you want to SSO into from your device. This adds the specified domains to the Intranet Zone of the Edge browser. -## Credential requirements +## Credential requirements -For VPN, the following types of credentials will be added to credential manager after authentication: +For VPN, the following types of credentials will be added to credential manager after authentication: - Username and password - Certificate-based authentication: @@ -67,7 +67,7 @@ For VPN, the following types of credentials will be added to credential manager - Smart Card Certificate - Windows Hello for Business Certificate -The username should also include a domain that can be reached over the connection (VPN or WiFi). +The username should also include a domain that can be reached over the connection (VPN or WiFi). ## User certificate templates @@ -82,17 +82,17 @@ If the credentials are certificate-based, then the elements in the following tab ## NDES server configuration -The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used. -For more information, see [Configure certificate infrastructure for SCEP](https://docs.microsoft.com/intune/deploy-use/Configure-certificate-infrastructure-for-scep). +The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used. +For more information, see [Configure certificate infrastructure for SCEP](https://docs.microsoft.com/mem/intune/protect/certificates-scep-configure). ## Active Directory requirements -You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well. +You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well. The domain controllers will need to have appropriate KDC certificates for the client to trust them as domain controllers, and since phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store. -The domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication. -This is because Windows 10 Mobile requires strict KDC validation to be enabled. -This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server. -For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382). +The domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication. +This is because Windows 10 Mobile requires strict KDC validation to be enabled. +This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server. +For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382). diff --git a/windows/security/identity-protection/vpn/images/vpn-connection-intune.png b/windows/security/identity-protection/vpn/images/vpn-connection-intune.png index bf551eabb7..8098b3445e 100644 Binary files a/windows/security/identity-protection/vpn/images/vpn-connection-intune.png and b/windows/security/identity-protection/vpn/images/vpn-connection-intune.png differ diff --git a/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png b/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png index 94cbb2c5cb..c6437e95d1 100644 Binary files a/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png and b/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png differ diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index 7bb106781a..3fe2c08d57 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -1,6 +1,6 @@ --- title: VPN authentication options (Windows 10) -description: tbd +description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN authentication options diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 3038aa0e34..29c8f5e474 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -1,6 +1,6 @@ --- title: VPN auto-triggered profile options (Windows 10) -description: tbd +description: Learn about the types of auto-trigger rules for VPNs in Windows 10, which start a VPN when it is needed to access a resource. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN auto-triggered profile options @@ -61,13 +61,15 @@ When the trigger occurs, VPN tries to connect. If an error occurs or any user in When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers. -Preserving user Always On preference +## Preserving user Always On preference -Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList. -Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference. -Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config -Value: AutoTriggerDisabledProfilesList -Type: REG_MULTI_SZ +Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**. + +Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference. + +**Key:** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config
                  +**Value:** AutoTriggerDisabledProfilesList
                  +**Type:** REG_MULTI_SZ ## Trusted network detection diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 4e6d182cfc..9aee353de2 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -1,12 +1,12 @@ --- title: VPN and conditional access (Windows 10) -description: The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application. +description: Learn how to integrate the VPN client with the Conditional Access Platform, so you can create access rules for Azure Active Directory (Azure AD) connected apps. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.reviewer: ms.localizationpriority: medium @@ -48,44 +48,56 @@ The following client-side components are also required: - Trusted Platform Module (TPM) ## VPN device compliance + At this time, the Azure AD certificates issued to users do not contain a CRL Distribution Point (CDP) and are not suitable for Key Distribution Centers (KDCs) to issue Kerberos tokens. For users to gain access to on-premises resources such as files on a network share, client authentication certificates must be deployed to the Windows profiles of the users, and their VPNv2 profiles must contain the <SSO> section. Server-side infrastructure requirements to support VPN device compliance include: -- The VPN server should be configured for certificate authentication -- The VPN server should trust the tenant-specific Azure AD CA -- For client access using Kerberos/NTLM, a domain-trusted certificate is deployed to the client device and is configured to be used for single sign-on (SSO) +- The VPN server should be configured for certificate authentication. +- The VPN server should trust the tenant-specific Azure AD CA. +- For client access using Kerberos/NTLM, a domain-trusted certificate is deployed to the client device and is configured to be used for single sign-on (SSO). After the server side is set up, VPN admins can add the policy settings for conditional access to the VPN profile using the VPNv2 DeviceCompliance node. Two client-side configuration service providers are leveraged for VPN device compliance. -- VPNv2 CSP DeviceCompliance settings +- VPNv2 CSP DeviceCompliance settings: + - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD. - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication. - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication. - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication. - **Sso/Eku**: comma-separated list of Enhanced Key Usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication. + - HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include: + - Collects TPM data used to verify health states - Forwards the data to the Health Attestation Service (HAS) - Provisions the Health Attestation Certificate received from the HAS - - Upon request, forwards the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification + - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification ->[!NOTE] ->Currently, it is required that certificates be issued from an on-premises CA, and that SSO be enabled in the user’s VPN profile. This will enable the user to obtain Kerberos tickets in order to access resources on-premises. Kerberos currently does not support the use of Azure AD certificates. +> [!NOTE] +> Currently, it is required that certificates used for obtaining Kerberos tickets must be issued from an on-premises CA, and that SSO must be enabled in the user’s VPN profile. This will enable the user to access on-premises resources. +> +> In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero). ## Client connection flow + The VPN client side connection flow works as follows: -![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) +> [!div class="mx-imgBorder"] +> ![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow: 1. The VPN client calls into Windows 10’s Azure AD Token Broker, identifying itself as a VPN client. + 2. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies. -3. If compliant, Azure AD requests a short-lived certificate + +3. If compliant, Azure AD requests a short-lived certificate. + 4. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing. + 5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server. ## Configure conditional access diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index cb033205df..d825487b05 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -1,16 +1,16 @@ --- title: VPN connection types (Windows 10) -description: tbd +description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: dulcemontemayor ms.localizationpriority: medium -ms.date: 07/27/2017 +ms.date: 11/13/2020 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN connection types @@ -61,11 +61,11 @@ There are a number of Universal Windows Platform VPN applications, such as Pulse See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. -The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune. +The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune: ![Available connection types](images/vpn-connection-intune.png) -In Intune, you can also include custom XML for third-party plug-in profiles. +In Intune, you can also include custom XML for third-party plug-in profiles: ![Custom XML](images/vpn-custom-xml-intune.png) diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index d5c7cfca83..ae26cfc95a 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -1,15 +1,15 @@ --- title: Windows 10 VPN technical guide (Windows 10) -description: Use this guide to configure VPN deployment for Windows 10. +description: Learn about decisions to make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: dulcemontemayor ms.localizationpriority: medium -ms.date: 07/27/2017 +ms.date: 11/13/2020 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # Windows 10 VPN technical guide @@ -20,12 +20,12 @@ ms.author: dolmont - Windows 10 - Windows 10 Mobile -This guide will walk you through the decisions you will make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10. +This guide will walk you through the decisions you will make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10. -![Intune VPN policy template](images/vpn-intune-policy.png) +To create a Windows 10 VPN device configuration profile see: [Windows 10 and Windows Holographic device settings to add VPN connections using Intune](https://docs.microsoft.com/mem/intune/configuration/vpn-settings-windows-10). ->[!NOTE] ->This guide does not explain server deployment. +> [!NOTE] +> This guide does not explain server deployment. ## In this guide @@ -43,7 +43,5 @@ This guide will walk you through the decisions you will make for Windows 10 clie ## Learn more -- [VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) - - +- [Create VPN profiles to connect to VPN servers in Intune](https://docs.microsoft.com/mem/intune/configuration/vpn-settings-configure) diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index e4f509397e..3b6a776b1e 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -1,6 +1,6 @@ --- title: VPN name resolution (Windows 10) -description: tbd +description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN name resolution @@ -52,7 +52,7 @@ Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node. ## Persistent -You can also configure *persistent* name resolution rules. Name resolution for specified items will only performed over VPN. +You can also configure *persistent* name resolution rules. Name resolution for specified items will only be performed over the VPN. Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node. diff --git a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md new file mode 100644 index 0000000000..d067b5a21d --- /dev/null +++ b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md @@ -0,0 +1,676 @@ +--- +title: Optimizing Office 365 traffic for remote workers with the native Windows 10 VPN client +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +audience: ITPro +ms.topic: article +author: kelleyvice-msft +ms.localizationpriority: medium +ms.date: 04/07/2020 +ms.reviewer: +manager: dansimp +ms.author: jajo +--- + +# Optimizing Office 365 traffic for remote workers with the native Windows 10 VPN client + +This article describes how to configure the recommendations in the article [Optimize Office 365 connectivity for remote users using VPN split tunneling](https://docs.microsoft.com/office365/enterprise/office-365-vpn-split-tunnel) for the *native Windows 10 VPN client*. This guidance enables VPN administrators to optimize Office 365 usage while still ensuring that all other traffic goes over the VPN connection and through existing security gateways and tooling. + +This can be achieved for the native/built-in Windows 10 VPN client using a _Force Tunneling with Exclusions_ approach. This allows you to define IP-based exclusions *even when using force tunneling* in order to "split" certain traffic to use the physical interface while still forcing all other traffic via the VPN interface. Traffic addressed to specifically defined destinations (like those listed in the Office 365 optimize categories) will therefore follow a much more direct and efficient path, without the need to traverse or "hairpin" via the VPN tunnel and back out of the corporate network. For cloud-services like Office 365, this makes a huge difference in performance and usability for remote users. + +> [!NOTE] +> The term _force tunneling with exclusions_ is sometimes confusingly called "split tunnels" by other vendors and in some online documentation. For Windows 10 VPN, the term _split tunneling_ is defined differently as described in the article [VPN routing decisions](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-routing#split-tunnel-configuration). + +## Solution Overview + +The solution is based upon the use of a VPN Configuration Service Provider Reference profile ([VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp)) and the embedded [ProfileXML](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-profile-xsd). These are used to configure the VPN profile on the device. Various provisioning approaches can be used to create and deploy the VPN profile as discussed in the article [Step 6. Configure Windows 10 client Always On VPN connections](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files). + +Typically, these VPN profiles are distributed using a Mobile Device Management solution like Intune, as described in [VPN profile options](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options#apply-profilexml-using-intune) and [Configure the VPN client by using Intune](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#configure-the-vpn-client-by-using-intune). + +To enable the use of force tunneling in Windows 10 VPN, the `` setting is typically configured with a value of _ForceTunnel_ in your existing Profile XML (or script) by way of the following entry, under the `` section: + +```xml +ForceTunnel +``` + +In order to define specific force tunnel exclusions, you then need to add the following lines to your existing Profile XML (or script) for each required exclusion, and place them outside of the `` section as follows: + +```xml + +
                  [IP addresses or subnet]
                  + [IP Prefix] + true +
                  +``` + +Entries defined by the `[IP Addresses or Subnet]` and `[IP Prefix]` references will consequently be added to the routing table as _more specific route entries_ that will use the Internet-connected interface as the default gateway, as opposed to using the VPN interface. You will need to define a unique and separate `` section for each required exclusion. + +An example of a correctly formatted Profile XML configuration for force tunnel with exclusions is shown below: + +```xml + + + ForceTunnel + + +
                  203.0.113.0
                  + 24 + true +
                  + +
                  198.51.100.0
                  + 22 + true +
                  +
                  +``` + +> [!NOTE] +> The IP addresses and prefix size values in this example are used purely as examples only and should not be used. + +## Solution Deployment + +For Office 365, it is therefore necessary to add exclusions for all IP addresses documented within the optimize categories described in [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges?redirectSourcePath=%252fen-us%252farticle%252fOffice-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) to ensure that they are excluded from VPN force tunneling. + +This can be achieved manually by adding the IP addresses defined within the *optimize* category entries to an existing Profile XML (or script) file, or alternatively the following script can be used which dynamically adds the required entries to an existing PowerShell script, or XML file, based upon directly querying the REST-based web service to ensure the correct IP address ranges are always used. + +An example of a PowerShell script that can be used to update a force tunnel VPN connection with Office 365 exclusions is provided below. + +```powershell +# Copyright (c) Microsoft Corporation. All rights reserved. +# +# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, +# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED +# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. +# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN +# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER. + +<# +.SYNOPSIS + Applies or updates recommended Office 365 optimize IP address exclusions to an existing force tunnel Windows 10 VPN profile +.DESCRIPTION + Connects to the Office 365 worldwide commercial service instance endpoints to obtain the latest published IP address ranges + Compares the optimized IP addresses with those contained in the supplied VPN Profile (PowerShell or XML file) + Adds or updates IP addresses as necessary and saves the resultant file with "-NEW" appended to the file name +.PARAMETERS + Filename and path for a supplied Windows 10 VPN profile file in either PowerShell or XML format +.NOTES + Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later +.VERSION + 1.0 +#> + +param ( + [string]$VPNprofilefile +) + +$usage=@" + +This script uses the following parameters: + +VPNprofilefile - The full path and name of the VPN profile PowerShell script or XML file + +EXAMPLES + +To check a VPN profile PowerShell script file: + +Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF POWERSHELL SCRIPT FILE] + +To check a VPN profile XML file: + +Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF XML FILE] + +"@ + +# Check if filename has been provided # +if ($VPNprofilefile -eq "") +{ + Write-Host "`nWARNING: You must specify either a PowerShell script or XML filename!" -ForegroundColor Red + + $usage + exit +} + +$FileExtension = [System.IO.Path]::GetExtension($VPNprofilefile) + +# Check if XML file exists and is a valid XML file # +if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".xml") +{ + if ( Test-Path $VPNprofilefile ) + { + $xml = New-Object System.Xml.XmlDocument + try + { + $xml.Load((Get-ChildItem -Path $VPNprofilefile).FullName) + + } + catch [System.Xml.XmlException] + { + Write-Verbose "$VPNprofilefile : $($_.toString())" + Write-Host "`nWARNING: The VPN profile XML file is not a valid xml file or incorrectly formatted!" -ForegroundColor Red + $usage + exit + } + }else + { + Write-Host "`nWARNING: VPN profile XML file does not exist or cannot be found!" -ForegroundColor Red + $usage + exit + } +} + +# Check if VPN profile PowerShell script file exists and contains a VPNPROFILE XML section # +if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".ps1") +{ + if ( (Test-Path $VPNprofilefile) ) + { + if (-Not $(Select-String -Path $VPNprofilefile -Pattern "") ) + { + Write-Host "`nWARNING: PowerShell script file does not contain a valid VPN profile XML section or is incorrectly formatted!" -ForegroundColor Red + $usage + exit + } + }else + { + Write-Host "`nWARNING: PowerShell script file does not exist or cannot be found!"-ForegroundColor Red + $usage + exit + } +} + +# Define Office 365 endpoints and service URLs # +$ws = "https://endpoints.office.com" +$baseServiceUrl = "https://endpoints.office.com" + +# Path where client ID and latest version number will be stored # +$datapath = $Env:TEMP + "\endpoints_clientid_latestversion.txt" + +# Fetch client ID and version if data file exists; otherwise create new file # +if (Test-Path $datapath) +{ + $content = Get-Content $datapath + $clientRequestId = $content[0] + $lastVersion = $content[1] + +}else +{ + $clientRequestId = [GUID]::NewGuid().Guid + $lastVersion = "0000000000" + @($clientRequestId, $lastVersion) | Out-File $datapath +} + +# Call version method to check the latest version, and pull new data if version number is different # +$version = Invoke-RestMethod -Uri ($ws + "/version?clientRequestId=" + $clientRequestId) + +if ($version[0].latest -gt $lastVersion) +{ + + Write-Host + Write-Host "A new version of Office 365 worldwide commercial service instance endpoints has been detected!" -ForegroundColor Cyan + + # Write the new version number to the data file # + @($clientRequestId, $version[0].latest) | Out-File $datapath +} + +# Invoke endpoints method to get the new data # +$uri = "$baseServiceUrl" + "/endpoints/worldwide?clientRequestId=$clientRequestId" + +# Invoke endpoints method to get the data for the VPN profile comparison # +$endpointSets = Invoke-RestMethod -Uri ($uri) +$Optimize = $endpointSets | Where-Object { $_.category -eq "Optimize" } +$optimizeIpsv4 = $Optimize.ips | Where-Object { ($_).contains(".") } | Sort-Object -Unique + +# Temporarily include additional IP address until Teams client update is released +$optimizeIpsv4 += "13.107.60.1/32" + +# Process PowerShell script file start # +if ($VPNprofilefile -ne "" -and $FileExtension -eq ".ps1") +{ + Write-host "`nStarting PowerShell script exclusion route check...`n" -ForegroundColor Cyan + + # Clear Variables to allow re-run testing # + + $ARRVPN=$null # Array to hold VPN addresses from VPN profile PowerShell file # + $In_Opt_Only=$null # Variable to hold IP addresses that only appear in the optimize list # + $In_VPN_Only=$null # Variable to hold IP addresses that only appear in the VPN profile PowerShell file # + + # Extract the Profile XML from the ps1 file # + + $regex = '(?sm).*^*.\r?\n(.*?)\r?\n.*' + + # Create xml format variable to compare with the optimize list # + + $xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1' + [xml]$VPNprofilexml=""+$xmlbody+"" + + # Loop through each address found in VPNPROFILE XML section # + foreach ($Route in $VPNprofilexml.VPNProfile.Route) + { + $VPNIP=$Route.Address+"/"+$Route.PrefixSize + [array]$ARRVPN=$ARRVPN+$VPNIP + } + + # In optimize address list only # + $In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_} + + # In VPN list only # + $In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_} + [array]$Inpfile = get-content $VPNprofilefile + + if ($In_Opt_Only.Count -gt 0 ) + { + Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red + + [int32]$insline=0 + + for ($i=0; $i -lt $Inpfile.count; $i++) + { + if ($Inpfile[$i] -match "") + { + $insline += $i # Record the position of the line after the NativeProfile section ends # + } + } + $OFS = "`r`n" + foreach ($NewIP in $In_Opt_Only) + { + # Add the missing IP address(es) # + $IPInfo=$NewIP.Split("/") + $InpFile[$insline] += $OFS+" " + $InpFile[$insline] += $OFS+"
                  "+$IPInfo[0].Trim()+"
                  " + $InpFile[$insline] += $OFS+" "+$IPInfo[1].Trim()+"" + $InpFile[$insline] += $OFS+" true" + $InpFile[$insline] += $OFS+"
                  " + } + # Update fileName and write new PowerShell file # + $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.ps1" + $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName + $InpFile | Set-Content $OutFile + Write-Host "Exclusion routes have been added to VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green + }else + { + Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green + $OutFile=$VPNprofilefile + } + +if ( $In_VPN_Only.Count -gt 0 ) +{ + Write-Host "Unknown exclusion route IP addresses have been found in the VPN profile`n" -ForegroundColor Yellow + + foreach ($OldIP in $In_VPN_Only) + { + [array]$Inpfile = get-content $Outfile + $IPInfo=$OldIP.Split("/") + Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow + $matchstr="
                  "+$IPInfo[0].Trim()+"
                  " + $DelAns=Read-host + if ($DelAns.ToUpper() -eq "Y") + { + [int32]$insline=0 + for ($i=0; $i -lt $Inpfile.count; $i++) + { + if ($Inpfile[$i] -match $matchstr) + { + $insline += $i # Record the position of the line for the string match # + } + } + # Remove entries from XML # + $InpFile[$insline-1]="REMOVETHISLINE" + $InpFile[$insline]="REMOVETHISLINE" + $InpFile[$insline+1]="REMOVETHISLINE" + $InpFile[$insline+2]="REMOVETHISLINE" + $InpFile[$insline+3]="REMOVETHISLINE" + $InpFile=$InpFile | Where-Object {$_ -ne "REMOVETHISLINE"} + + # Update filename and write new PowerShell file # + $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml" + $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName + $Inpfile | Set-content $OutFile + Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green + + }else + { + Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green + } + } + } +} + +# Process XML file start # +if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml") +{ + Write-host "`nStarting XML file exclusion route check...`n" -ForegroundColor Cyan + + # Clear variables to allow re-run testing # + $ARRVPN=$null # Array to hold VPN addresses from the XML file # + $In_Opt_Only=$null # Variable to hold IP Addresses that only appear in optimize list # + $In_VPN_Only=$null # Variable to hold IP Addresses that only appear in the VPN profile XML file # + + # Extract the Profile XML from the XML file # + $regex = '(?sm).*^*.\r?\n(.*?)\r?\n.*' + + # Create xml format variable to compare with optimize list # + $xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1' + [xml]$VPNRulesxml="$xmlbody" + + # Loop through each address found in VPNPROFILE file # + foreach ($Route in $VPNRulesxml.VPNProfile.Route) + { + $VPNIP=$Route.Address+"/"+$Route.PrefixSize + [array]$ARRVPN=$ARRVPN+$VPNIP + } + + # In optimize address list only # + $In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_} + + # In VPN list only # + $In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_} + [System.Collections.ArrayList]$Inpfile = get-content $VPNprofilefile + + if ($In_Opt_Only.Count -gt 0 ) + { + Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red + + foreach ($NewIP in $In_Opt_Only) + { + # Add the missing IP address(es) # + $IPInfo=$NewIP.Split("/") + $routes += "`n"+"`t
                  "+$IPInfo[0].Trim()+"
                  `n"+"`t"+$IPInfo[1].Trim()+"`n"+"`ttrue`n"+"
                  `n" + } + $inspoint = $Inpfile.IndexOf("
                  ") + $Inpfile.Insert($inspoint,$routes) + + # Update filename and write new XML file # + $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml" + $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName + $InpFile | Set-Content $OutFile + Write-Host "Exclusion routes have been added to VPN profile and output to a separate XML file; the original file has not been modified`n`n" -ForegroundColor Green + + }else + { + Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green + $OutFile=$VPNprofilefile + } + + if ( $In_VPN_Only.Count -gt 0 ) + { + Write-Host "Unknown exclusion route IP addresses found in the VPN profile`n" -ForegroundColor Yellow + + foreach ($OldIP in $In_VPN_Only) + { + [array]$Inpfile = get-content $OutFile + $IPInfo=$OldIP.Split("/") + Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow + $matchstr=""+"
                  "+$IPInfo[0].Trim()+"
                  "+""+$IPInfo[1].Trim()+""+"true"+"
                  " + $DelAns=Read-host + if ($DelAns.ToUpper() -eq "Y") + { + # Remove unknown IP address(es) # + $inspoint = $Inpfile[0].IndexOf($matchstr) + $Inpfile[0] = $Inpfile[0].Replace($matchstr,"") + + # Update filename and write new XML file # + $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml" + $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName + $Inpfile | Set-content $OutFile + Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate XML file; the original file has not been modified`n" -ForegroundColor Green + + }else + { + Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green + } + } + } +} +``` + +## Version Support + +This solution is supported with the following versions of Windows: + +- Windows 10 1903/1909 and newer: Included, no action needed +- Windows 10 1809: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481) +- Windows 10 1803: At least [KB4493437](https://support.microsoft.com/help/4493437/windows-10-update-kb4493437) +- Windows 10 1709 and lower: Exclusion routes are not supported + +- Windows 10 Enterprise 2019 LTSC: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481) +- Windows 10 Enterprise 2016 LTSC: Exclusion routes are not supported +- Windows 10 Enterprise 2015 LTSC: Exclusion routes are not supported + +Microsoft strongly recommends that the latest available Windows 10 cumulative update always be applied. + +## Other Considerations + +You should also be able to adapt this approach to include necessary exclusions for other cloud-services that can be defined by known/static IP addresses; exclusions required for [Cisco WebEx](https://help.webex.com/WBX000028782/Network-Requirements-for-Webex-Teams-Services) or [Zoom](https://support.zoom.us/hc/en-us/articles/201362683) are good examples. + +## Examples + +An example of a PowerShell script that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial PowerShell script: + +```powershell +# Copyright (c) Microsoft Corporation. All rights reserved. +# +# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, +# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED +# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. +# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN +# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER. + +<# +.SYNOPSIS + Configures an AlwaysOn IKEv2 VPN Connection using a basic script +.DESCRIPTION + Configures an AlwaysOn IKEv2 VPN Connection with proxy PAC information and force tunneling +.PARAMETERS + Parameters are defined in a ProfileXML object within the script itself +.NOTES + Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later +.VERSION + 1.0 +#> + +<#-- Define Key VPN Profile Parameters --#> +$ProfileName = 'Contoso VPN with Office 365 Exclusions' +$ProfileNameEscaped = $ProfileName -replace ' ', '%20' + +<#-- Define VPN ProfileXML --#> +$ProfileXML = ' + true + corp.contoso.com + true + corp.contoso.com + + edge1.contoso.com + ForceTunnel + IKEv2 + + Certificate + + + +
                  13.107.6.152
                  + 31 + true +
                  + +
                  13.107.18.10
                  + 31 + true +
                  + +
                  13.107.128.0
                  + 22 + true +
                  + +
                  23.103.160.0
                  + 20 + true +
                  + +
                  40.96.0.0
                  + 13 + true +
                  + +
                  40.104.0.0
                  + 15 + true +
                  + +
                  52.96.0.0
                  + 14 + true +
                  + +
                  131.253.33.215
                  + 32 + true +
                  + +
                  132.245.0.0
                  + 16 + true +
                  + +
                  150.171.32.0
                  + 22 + true +
                  + +
                  191.234.140.0
                  + 22 + true +
                  + +
                  204.79.197.215
                  + 32 + true +
                  + +
                  13.107.136.0
                  + 22 + true +
                  + +
                  40.108.128.0
                  + 17 + true +
                  + +
                  52.104.0.0
                  + 14 + true +
                  + +
                  104.146.128.0
                  + 17 + true +
                  + +
                  150.171.40.0
                  + 22 + true +
                  + +
                  13.107.60.1
                  + 32 + true +
                  + +
                  13.107.64.0
                  + 18 + true +
                  + +
                  52.112.0.0
                  + 14 + true +
                  + +
                  52.120.0.0
                  + 14 + true +
                  + + http://webproxy.corp.contoso.com/proxy.pac + +
                  ' + +<#-- Convert ProfileXML to Escaped Format --#> +$ProfileXML = $ProfileXML -replace '<', '<' +$ProfileXML = $ProfileXML -replace '>', '>' +$ProfileXML = $ProfileXML -replace '"', '"' + +<#-- Define WMI-to-CSP Bridge Properties --#> +$nodeCSPURI = './Vendor/MSFT/VPNv2' +$namespaceName = "root\cimv2\mdm\dmmap" +$className = "MDM_VPNv2_01" + +<#-- Define WMI Session --#> +$session = New-CimSession + +<#-- Detect and Delete Previous VPN Profile --#> +try +{ + $deleteInstances = $session.EnumerateInstances($namespaceName, $className, $options) + foreach ($deleteInstance in $deleteInstances) + { + $InstanceId = $deleteInstance.InstanceID + if ("$InstanceId" -eq "$ProfileNameEscaped") + { + $session.DeleteInstance($namespaceName, $deleteInstance, $options) + $Message = "Removed $ProfileName profile $InstanceId" + Write-Host "$Message" + } else { + $Message = "Ignoring existing VPN profile $InstanceId" + Write-Host "$Message" + } + } +} +catch [Exception] +{ + $Message = "Unable to remove existing outdated instance(s) of $ProfileName profile: $_" + Write-Host "$Message" + exit +} + +<#-- Create VPN Profile --#> +try +{ + $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName + $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key') + $newInstance.CimInstanceProperties.Add($property) + $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key') + $newInstance.CimInstanceProperties.Add($property) + $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property') + $newInstance.CimInstanceProperties.Add($property) + + $session.CreateInstance($namespaceName, $newInstance, $options) + $Message = "Created $ProfileName profile." + Write-Host "$Message" + Write-Host "$ProfileName profile summary:" + $session.EnumerateInstances($namespaceName, $className, $options) +} +catch [Exception] +{ + $Message = "Unable to create $ProfileName profile: $_" + Write-Host "$Message" + exit +} + +$Message = "Script Complete" +Write-Host "$Message" + +``` + +An example of an [Intune-ready XML file](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options#apply-profilexml-using-intune) that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial XML file. + +>[!NOTE] +>This XML is formatted for use with Intune and cannot contain any carriage returns or whitespace. + +```xml +truecorp.contoso.comtruecorp.contoso.comedge1.contoso.comForceTunnelIKEv2Certificate
                  13.107.6.152
                  31true
                  13.107.18.10
                  31true
                  13.107.128.0
                  22true
                  23.103.160.0
                  20true
                  40.96.0.0
                  13true
                  40.104.0.0
                  15true
                  52.96.0.0
                  14true
                  131.253.33.215
                  32true
                  132.245.0.0
                  16true
                  150.171.32.0
                  22true
                  191.234.140.0
                  22true
                  204.79.197.215
                  32true
                  13.107.136.0
                  22true
                  40.108.128.0
                  17true
                  52.104.0.0
                  14true
                  104.146.128.0
                  17true
                  150.171.40.0
                  22true
                  13.107.60.1
                  32true
                  13.107.64.0
                  18true
                  52.112.0.0
                  14true
                  52.120.0.0
                  14true
                  http://webproxy.corp.contoso.com/proxy.pac
                  +``` diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index a234d017d0..077c2d4c8f 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -1,6 +1,6 @@ --- title: VPN profile options (Windows 10) -description: Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. +description: Windows 10 adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network. ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp ms.localizationpriority: medium ms.date: 05/17/2018 --- @@ -20,7 +20,7 @@ ms.date: 05/17/2018 - Windows 10 - Windows 10 Mobile -Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or System Center Configuration Manager. All VPN settings in Windows 10 can be configued using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). +Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or Microsoft Endpoint Configuration Manager. All VPN settings in Windows 10 can be configured using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). >[!NOTE] >If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers) first. @@ -34,7 +34,6 @@ The following table lists the VPN settings and whether the setting can be config | Routing: forced-tunnel | yes | | Authentication (EAP) | yes, if connection type is built-in | | Conditional access | yes | -| Proxy settings | yes, by PAC/WPAD file or server and port | | Name resolution: NRPT | yes | | Name resolution: DNS suffix | no | | Name resolution: persistent | no | @@ -45,6 +44,10 @@ The following table lists the VPN settings and whether the setting can be config | LockDown | no | | Windows Information Protection (WIP) | yes | | Traffic filters | yes | +| Proxy settings | yes, by PAC/WPAD file or server and port | + +> [!NOTE] +> VPN proxy settings are only used on Force Tunnel Connections. On Split Tunnel Connections, the general proxy settings are used. The ProfileXML node was added to the VPNv2 CSP to allow users to deploy VPN profile as a single blob. This is particularly useful for deploying profiles with features that are not yet supported by MDMs. You can get additional examples in the [ProfileXML XSD](https://msdn.microsoft.com/library/windows/hardware/mt755930.aspx) topic. @@ -62,8 +65,7 @@ The following is a sample Native VPN profile. This blob would fall under the Pro - Eap - Eap + Eap @@ -300,7 +302,7 @@ The following is a sample plug-in VPN profile. This blob would fall under the Pr After you configure the settings that you want using ProfileXML, you can apply it using Intune and a **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy. 1. Sign into the [Azure portal](https://portal.azure.com). -2. Go to **Intune** > **Device Configuration** > **Properties**. +2. Go to **Intune** > **Device Configuration** > **Profiles**. 3. Click **Create Profile**. 4. Enter a name and (optionally) a description. 5. Choose **Windows 10 and later** as the platform. @@ -317,7 +319,7 @@ After you configure the settings that you want using ProfileXML, you can apply i ## Learn more -- [Learn how to configure VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) +- [Create VPN profiles to connect to VPN servers in Intune](https://docs.microsoft.com/mem/intune/configuration/vpn-settings-configure) - [VPNv2 configuration service provider (CSP) reference](https://go.microsoft.com/fwlink/p/?LinkId=617588) - [How to Create VPN Profiles in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=618028) diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index e9652fe89a..416bc57d04 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -1,6 +1,6 @@ --- title: VPN routing decisions (Windows 10) -description: tbd +description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN routing decisions diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index 250ee154a5..d8f4768540 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -1,6 +1,6 @@ --- title: VPN security features (Windows 10) -description: tbd +description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,14 +10,14 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN security features **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile ## LockDown VPN @@ -29,53 +29,52 @@ A VPN profile configured with LockDown secures the device to only allow network - The user cannot delete or modify the VPN profile. - The VPN LockDown profile uses forced tunnel connection. - If the VPN connection is not available, outbound network traffic is blocked. -- Only one VPN LockDown profile is allowed on a device. +- Only one VPN LockDown profile is allowed on a device. ->[!NOTE] ->For built-in VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. - -Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. +> [!NOTE] +> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. +Deploy this feature with caution, as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. ## Windows Information Protection (WIP) integration with VPN -Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. +Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices, without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. -The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: +The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: - Core functionality: File encryption and file access blocking - UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations - WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN - Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN -The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. +The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip) -## Traffic filters +## Traffic Filters -Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins to effectively add interface specific firewall rules on the VPN Interface.There are two types of Traffic Filter rules: +Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins can use Traffic Filters to effectively add interface specific firewall rules on the VPN Interface. There are two types of Traffic Filter rules: -- App-based rules. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. -- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. +- App-based rules. With app-based rules, a list of applications can be marked to allow only traffic originating from these apps to go over the VPN interface. +- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified to allow only traffic matching these rules to go over the VPN interface. -There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. +There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. -For example, an admin could define rules that specify: +For example, an admin could define rules that specify: -- The Contoso HR App must be allowed to go through the VPN and only access port 4545. -- The Contoso finance apps is allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889. -- All other apps on the device should be able to access only ports 80 or 443. +- The Contoso HR App must be allowed to go through the VPN and only access port 4545. +- The Contoso finance apps are allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889. +- All other apps on the device should be able to access only ports 80 or 443. ## Configure traffic filters -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) for XML configuration. -The following image shows the interface to configure traffic rules in a VPN Profile configuration policy using Microsoft Intune. +The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune. ![Add a traffic rule](images/vpn-traffic-rules.png) diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 701083c55c..26db02bc64 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance.md b/windows/security/includes/improve-request-performance.md similarity index 76% rename from windows/security/threat-protection/microsoft-defender-atp/improve-request-performance.md rename to windows/security/includes/improve-request-performance.md index 880f5e4d11..c2499cf092 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance.md +++ b/windows/security/includes/improve-request-performance.md @@ -16,11 +16,8 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Improve request performance - - >[!NOTE] >For better performance, you can use server closer to your geo location: -> - api-us.securitycenter.windows.com -> - api-eu.securitycenter.windows.com -> - api-uk.securitycenter.windows.com \ No newline at end of file +> - api-us.securitycenter.microsoft.com +> - api-eu.securitycenter.microsoft.com +> - api-uk.securitycenter.microsoft.com diff --git a/windows/security/includes/machineactionsnote.md b/windows/security/includes/machineactionsnote.md new file mode 100644 index 0000000000..542eec5756 --- /dev/null +++ b/windows/security/includes/machineactionsnote.md @@ -0,0 +1,13 @@ +--- +title: Perform a Machine Action via the Microsoft Defender for Endpoint API +description: This page focuses on performing a machine action via the Microsoft Defender for Endpoint API. +ms.date: 08/28/2017 +ms.reviewer: +manager: dansimp +ms.author: macapara +author: mjcaparas +ms.prod: w10 +--- + +>[!Note] +> This page focuses on performing a machine action via API. See [take response actions on a machine](../threat-protection/microsoft-defender-atp/respond-machine-alerts.md) for more information about response actions functionality via Microsoft Defender for Endpoint. diff --git a/windows/security/includes/microsoft-defender.md b/windows/security/includes/microsoft-defender.md new file mode 100644 index 0000000000..27394df0ea --- /dev/null +++ b/windows/security/includes/microsoft-defender.md @@ -0,0 +1,14 @@ +--- +title: Microsoft Defender important guidance +description: A note in regard to important Microsoft Defender guidance. +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +ms.author: dansimp +author: dansimp +ms.prod: w10 +ms.topic: include +--- + +> [!IMPORTANT] +> [Learn how Microsoft is helping to protect customers from Solorigate, a recent sophisticated attack](https://aka.ms/solorigate). diff --git a/windows/security/includes/prerelease.md b/windows/security/includes/prerelease.md new file mode 100644 index 0000000000..a008aa45d7 --- /dev/null +++ b/windows/security/includes/prerelease.md @@ -0,0 +1,13 @@ +--- +title: Microsoft Defender for Endpoint Pre-release Disclaimer +description: Disclaimer for pre-release version of Microsoft Defender for Endpoint. +ms.date: 08/28/2017 +ms.reviewer: +manager: dansimp +ms.author: macapara +author: mjcaparas +ms.prod: w10 +--- + +> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. diff --git a/windows/security/index.yml b/windows/security/index.yml index ca0486b130..d7b6fbe5a3 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -1,80 +1,38 @@ -### YamlMime:YamlDocument +### YamlMime:Hub -documentType: LandingData - -title: Windows 10 Enterprise Security +title: Windows 10 Enterprise Security # < 60 chars +summary: Secure corporate data and manage risk. # < 160 chars +# brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-bi | power-platform | sql | sql-server | vs | visual-studio | windows | xamarin +brand: windows metadata: - - document_id: - - title: Windows 10 Enterprise Security - - description: Learn about enterprise-grade security features for Windows 10. - - keywords: protect, company, data, Windows, device, app, management, Microsoft365, e5, e3 - + title: Windows 10 Enterprise Security # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about enterprise-grade security features for Windows 10. # Required; article description that is displayed in search results. < 160 chars. + services: windows + ms.product: windows + ms.topic: hub-page # Required + ms.collection: M365-security-compliance # Optional; Remove if no collection is used. + author: danihalfin #Required; your GitHub user alias, with correct capitalization. + ms.author: daniha #Required; microsoft alias of author; optional team alias. + ms.date: 01/08/2018 #Required; mm/dd/yyyy format. ms.localizationpriority: high - author: brianlic-msft - - ms.author: brianlic - - manager: brianlic - - ms.date: 08/01/2018 - - ms.topic: article - - ms.devlang: na - -sections: - -- items: - - - type: markdown - - text: Secure corporate data and manage risk. - -- items: - - - type: list - - style: cards - - className: cardsM - - columns: 3 - - items: - - - href: \windows\security\identity-protection\ - - html:

                  Deploy secure enterprise-grade authentication and access control to protect accounts and data

                  - - image: - - src: https://docs.microsoft.com/media/common/i_identity-protection.svg - - title: Identity and access management - - - href: \windows\security\threat-protection\ - - html:

                  Stop cyberthreats and quickly identify and respond to breaches

                  - - image: - - src: https://docs.microsoft.com/media/common/i_threat-protection.svg - - title: Threat protection - - - href: \windows\security\information-protection\ - - html:

                  Identify and secure critical data to prevent data loss

                  - - image: - - src: https://docs.microsoft.com/media/common/i_information-protection.svg - - title: Information protection - +# productDirectory section (optional) +productDirectory: + items: + # Card + - title: Identity and access management + # imageSrc should be square in ratio with no whitespace + imageSrc: https://docs.microsoft.com/media/common/i_identity-protection.svg + summary: Deploy secure enterprise-grade authentication and access control to protect accounts and data + url: ./identity-protection/index.md + # Card + - title: Threat protection + imageSrc: https://docs.microsoft.com/media/common/i_threat-protection.svg + summary: Stop cyberthreats and quickly identify and respond to breaches + url: ./threat-protection/index.md + # Card + - title: Information protection + imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg + summary: Identify and secure critical data to prevent data loss + url: ./information-protection/index.md \ No newline at end of file diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index f6f4fac5a3..442b60a184 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -3,9 +3,9 @@ ## [BitLocker](bitlocker\bitlocker-overview.md) ### [Overview of BitLocker Device Encryption in Windows 10](bitlocker\bitlocker-device-encryption-overview-windows-10.md) ### [BitLocker frequently asked questions (FAQ)](bitlocker\bitlocker-frequently-asked-questions.md) -#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.md) +#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.yml) #### [Upgrading](bitlocker\bitlocker-upgrading-faq.md) -#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.md) +#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.yml) #### [Key management](bitlocker\bitlocker-key-management-faq.md) #### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.md) #### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md) @@ -24,10 +24,21 @@ ### [BitLocker Recovery Guide](bitlocker\bitlocker-recovery-guide-plan.md) ### [BitLocker Countermeasures](bitlocker\bitlocker-countermeasures.md) ### [Protecting cluster shared volumes and storage area networks with BitLocker](bitlocker\protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md) +### Troubleshoot BitLocker +#### [Troubleshoot BitLocker](bitlocker\troubleshoot-bitlocker.md) +#### [BitLocker cannot encrypt a drive: known issues](bitlocker\ts-bitlocker-cannot-encrypt-issues.md) +#### [Enforcing BitLocker policies by using Intune: known issues](bitlocker\ts-bitlocker-intune-issues.md) +#### [BitLocker Network Unlock: known issues](bitlocker\ts-bitlocker-network-unlock-issues.md) +#### [BitLocker recovery: known issues](bitlocker\ts-bitlocker-recovery-issues.md) +#### [BitLocker configuration: known issues](bitlocker\ts-bitlocker-config-issues.md) +#### Troubleshoot BitLocker and TPM issues +##### [BitLocker cannot encrypt a drive: known TPM issues](bitlocker\ts-bitlocker-cannot-encrypt-tpm-issues.md) +##### [BitLocker and TPM: other known issues](bitlocker\ts-bitlocker-tpm-issues.md) +##### [Decode Measured Boot logs to track PCR changes](bitlocker\ts-bitlocker-decode-measured-boot-logs.md) ## [Encrypted Hard Drive](encrypted-hard-drive.md) -## [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md) +## [Kernel DMA Protection](kernel-dma-protection-for-thunderbolt.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md) ### [Create a WIP policy using Microsoft Intune](windows-information-protection\overview-create-wip-policy.md) @@ -36,8 +47,8 @@ ##### [Associate and deploy a VPN policy for WIP using the Azure portal for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md) #### [Create and verify an EFS Data Recovery Agent (DRA) certificate](windows-information-protection\create-and-verify-an-efs-dra-certificate.md) #### [Determine the Enterprise Context of an app running in WIP](windows-information-protection\wip-app-enterprise-context.md) -### [Create a WIP policy using System Center Configuration Manager](windows-information-protection\overview-create-wip-policy-sccm.md) -#### [Create and deploy a WIP policy using System Center Configuration Manager](windows-information-protection\create-wip-policy-using-sccm.md) +### [Create a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\overview-create-wip-policy-configmgr.md) +#### [Create and deploy a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\create-wip-policy-using-configmgr.md) #### [Create and verify an EFS Data Recovery Agent (DRA) certificate](windows-information-protection\create-and-verify-an-efs-dra-certificate.md) #### [Determine the Enterprise Context of an app running in WIP](windows-information-protection\wip-app-enterprise-context.md) ### [Mandatory tasks and settings required to turn on WIP](windows-information-protection\mandatory-settings-for-wip.md) @@ -50,7 +61,6 @@ #### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with WIP](windows-information-protection\recommended-network-definitions-for-wip.md) #### [Using Outlook Web Access with WIP](windows-information-protection\using-owa-with-wip.md) ### [Fine-tune WIP Learning](windows-information-protection\wip-learning.md) -### [How WIP works with sensitivity labels](windows-information-protection\how-wip-works-with-labels.md) ## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) diff --git a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md index d08c6e889a..7dd0eb0898 100644 --- a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BCD settings and BitLocker diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md index 144180cd40..c248a61b46 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -1,6 +1,6 @@ --- title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: ms.prod: w10 @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker and Active Directory Domain Services (AD DS) FAQ @@ -28,16 +29,24 @@ ms.date: 02/28/2019 Stored information | Description -------------------|------------ Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in. -BitLocker recovery password | The recovery password allows you to unlock and access the drive in the event of a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md). -BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, Repair-bde. +BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md). +BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`. ## What if BitLocker is enabled on a computer before the computer has joined the domain? -If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. +If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**. +The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: + +```PowerShell +$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive +$RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } + +Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID +BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID +``` > [!IMPORTANT] > Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). @@ -52,13 +61,13 @@ Ultimately, determining whether a legitimate backup exists in AD DS requires qu No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. -## What happens if the backup initially fails? Will BitLocker retry the backup? +## What happens if the backup initially fails? Will BitLocker retry it? If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. -When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. +When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. +When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index acd70ac9ea..8ad995065c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -1,6 +1,6 @@ --- title: BitLocker basic deployment (Windows 10) -description: This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. +description: This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ms.assetid: 97c646cb-9e53-4236-9678-354af41151c4 ms.reviewer: ms.prod: w10 @@ -8,21 +8,23 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker basic deployment **Applies to** + - Windows 10 -This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. +This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ## Using BitLocker to encrypt volumes @@ -30,69 +32,34 @@ BitLocker provides full volume encryption (FVE) for operating system volumes, as In the event that the drive was prepared as a single contiguous space, BitLocker requires a new volume to hold the boot files. BdeHdCfg.exe can create these volumes. -> **Note:**  For more info about using this tool, see [Bdehdcfg](https://technet.microsoft.com/library/ee732026.aspx) in the Command-Line Reference. - +> [!NOTE] +> For more info about using this tool, see [Bdehdcfg](/windows-server/administration/windows-commands/bdehdcfg) in the Command-Line Reference. + BitLocker encryption can be done using the following methods: - BitLocker control panel - Windows Explorer -- manage-bde command line interface +- manage-bde command-line interface - BitLocker Windows PowerShell cmdlets ### Encrypting volumes using the BitLocker control panel -Encrypting volumes with the BitLocker control panel (click **Start**, type **bitlocker**, click **Manage BitLocker**) is how many users will utilize BitLocker. The name of the BitLocker control panel is BitLocker Drive Encryption. The BitLocker control panel supports encrypting operating system, fixed data and removable data volumes. The BitLocker control panel will organize available drives in the appropriate category based on how the device reports itself to Windows. Only formatted volumes with assigned drive letters will appear properly in the BitLocker control panel applet. +Encrypting volumes with the BitLocker control panel (select **Start**, type *bitlocker*, select **Manage BitLocker**) is how many users will utilize BitLocker. The name of the BitLocker control panel is BitLocker Drive Encryption. The BitLocker control panel supports encrypting operating system, fixed data, and removable data volumes. The BitLocker control panel will organize available drives in the appropriate category based on how the device reports itself to Windows. Only formatted volumes with assigned drive letters will appear properly in the BitLocker control panel applet. To start encryption for a volume, select **Turn on BitLocker** for the appropriate drive to initialize the BitLocker Drive Encryption Wizard. BitLocker Drive Encryption Wizard options vary based on volume type (operating system volume or data volume). ### Operating system volume Upon launch, the BitLocker Drive Encryption Wizard verifies the computer meets the BitLocker system requirements for encrypting an operating system volume. By default, the system requirements are: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  RequirementDescription

                  Hardware configuration

                  The computer must meet the minimum requirements for the supported Windows versions.

                  Operating system

                  BitLocker is an optional feature which can be installed by Server Manager on Windows Server 2012 and later.

                  Hardware TPM

                  TPM version 1.2 or 2.0

                  -

                  A TPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.

                  BIOS configuration

                    -
                  • A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware.

                  • -
                  • The boot order must be set to start first from the hard disk, and not the USB or CD drives.

                  • -
                  • The firmware must be able to read from a USB flash drive during startup.

                  • -

                  File system

                  For computers that boot natively with UEFI firmware, at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive.

                  -

                  For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive.

                  -

                  For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.

                  Hardware encrypted drive prerequisites (optional)

                  To use a hardware encrypted drive as the boot drive, the drive must be in the uninitialized state and in the security inactive state. In addition, the system must always boot with native UEFI version 2.3.1 or higher and the CSM (if any) disabled.

                  - + +|Requirement|Description| +|--- |--- | +|Hardware configuration|The computer must meet the minimum requirements for the supported Windows versions.| +|Operating system|BitLocker is an optional feature that can be installed by Server Manager on Windows Server 2012 and later.| +|Hardware TPM|TPM version 1.2 or 2.0.

                  A TPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.| +|BIOS configuration|

                • A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware.
                • The boot order must be set to start first from the hard disk, and not the USB or CD drives.
                • The firmware must be able to read from a USB flash drive during startup.
                • | +|File system|For computers that boot natively with UEFI firmware, at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive.
                  For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive.
                  For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.| +|Hardware encrypted drive prerequisites (optional)|To use a hardware encrypted drive as the boot drive, the drive must be in the uninitialized state and in the security inactive state. In addition, the system must always boot with native UEFI version 2.3.1 or higher and the CSM (if any) disabled.| + Upon passing the initial configuration, users are required to enter a password for the volume. If the volume does not pass the initial configuration for BitLocker, the user is presented with an error dialog describing the appropriate actions to be taken. Once a strong password has been created for the volume, a recovery key will be generated. The BitLocker Drive Encryption Wizard will prompt for a location to save this key. A BitLocker recovery key is a special key that you can create when you turn on BitLocker Drive Encryption for the first time on each drive that you encrypt. You can use the recovery key to gain access to your computer if the drive that Windows is installed on (the operating system drive) is encrypted using BitLocker Drive Encryption and BitLocker detects a condition that prevents it from unlocking the drive when the computer is starting up. A recovery key can also be used to gain access to your files and folders on a removable data drive (such as an external hard drive or USB flash drive) that is encrypted using BitLocker To Go, if for some reason you forget the password or your computer cannot access the drive. @@ -105,13 +72,14 @@ When the recovery key has been properly stored, the BitLocker Drive Encryption W It is recommended that drives with little to no data utilize the **used disk space only** encryption option and that drives with data or an operating system utilize the **encrypt entire drive** option. -> **Note:**  Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools. - -Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. It is recommended to run this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows. +> [!NOTE] +> Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools. + +Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. We recommend running this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows. After completing the system check (if selected), the BitLocker Drive Encryption Wizard will restart the computer to begin encryption. Upon reboot, users are required to enter the password chosen to boot into the operating system volume. Users can check encryption status by checking the system notification area or the BitLocker control panel. -Until encryption is completed, the only available options for managing BitLocker involve manipulation of the password protecting the operating system volume, backing up the recovery key, and turning BitLocker off. +Until encryption is completed, the only available options for managing BitLocker involve manipulation of the password protecting the operating system volume, backing up the recovery key, and turning off BitLocker. ### Data volume @@ -129,12 +97,12 @@ Encryption status displays in the notification area or within the BitLocker cont There is a new option for storing the BitLocker recovery key using the OneDrive. This option requires that computers are not members of a domain and that the user is using a Microsoft Account. Local accounts do not give the option to utilize OneDrive. Using the OneDrive option is the default, recommended recovery key storage method for computers that are not joined to a domain. -Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder which is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive, +Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder that is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive, they can identify the required recovery key by looking at the file name. The recovery key ID is appended to the end of the file name. ### Using BitLocker within Windows Explorer -Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by right clicking on a volume and selecting **Turn On BitLocker**. This option is available on client computers by default. On servers, you must first install the BitLocker and Desktop-Experience features for this option to be available. After selecting **Turn on BitLocker**, the wizard works exactly as it does when launched using the BitLocker control panel. +Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by right-clicking a volume and selecting **Turn On BitLocker**. This option is available on client computers by default. On servers, you must first install the BitLocker and Desktop-Experience features for this option to be available. After selecting **Turn on BitLocker**, the wizard works exactly as it does when launched using the BitLocker control panel. ## Down-level compatibility @@ -142,53 +110,21 @@ The following table shows the compatibility matrix for systems that have been Bi Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Encryption Type

                  Windows 10 and Windows 8.1

                  Windows 8

                  Windows 7

                  Fully encrypted on Windows 8

                  Presents as fully encrypted

                  N/A

                  Presented as fully encrypted

                  Used Disk Space Only encrypted on Windows 8

                  Presents as encrypt on write

                  N/A

                  Presented as fully encrypted

                  Fully encrypted volume from Windows 7

                  Presents as fully encrypted

                  Presented as fully encrypted

                  N/A

                  Partially encrypted volume from Windows 7

                  Windows 10 and Windows 8.1 will complete encryption regardless of policy

                  Windows 8 will complete encryption regardless of policy

                  N/A

                  +||||| +|--- |--- |--- |--- | +|Encryption Type|Windows 10 and Windows 8.1|Windows 8|Windows 7| +|Fully encrypted on Windows 8|Presents as fully encrypted|N/A|Presented as fully encrypted| +|Used Disk Space Only encrypted on Windows 8|Presents as encrypt on write|N/A|Presented as fully encrypted| +|Fully encrypted volume from Windows 7|Presents as fully encrypted|Presented as fully encrypted|N/A| +|Partially encrypted volume from Windows 7|Windows 10 and Windows 8.1 will complete encryption regardless of policy|Windows 8 will complete encryption regardless of policy|N/A| +## Encrypting volumes using the manage-bde command-line interface -## Encrypting volumes using the manage-bde command line interface +Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). -Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). -Manage-bde offers a multitude of wider options for configuring BitLocker. This means that using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. -Command line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes. +Manage-bde offers a multitude of wider options for configuring BitLocker. So using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. + +Command-line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes. ### Operating system volume @@ -200,7 +136,7 @@ A good practice when using manage-bde is to determine the volume status on the t `manage-bde -status` -This command returns the volumes on the target, current encryption status and volume type (operating system or data) for each volume. Using this information, users can determine the best encryption method for their environment. +This command returns the volumes on the target, current encryption status, and volume type (operating system or data) for each volume. Using this information, users can determine the best encryption method for their environment. **Enabling BitLocker without a TPM** @@ -213,29 +149,29 @@ manage-bde -on C: **Enabling BitLocker with a TPM only** -It is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: +It is possible to encrypt the operating system volume without any defined protectors by using manage-bde. Use this command: `manage-bde -on C:` -This will encrypt the drive using the TPM as the protector. If a user is unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information with the command: +This command will encrypt the drive using the TPM as the protector. If a user is unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information with the command: `manage-bde -protectors -get ` **Provisioning BitLocker with two protectors** -Another example is a user on non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. This is done with the command: +Another example is a user on non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. Use this command: `manage-bde -protectors -add C: -pw -sid ` -This command will require the user to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, the user just needs to turn BitLocker on. +This command will require the user to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, the user just needs to turn on BitLocker. ### Data volume -Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or users can choose to add protectors to the volume. It is recommended that at least one primary protector and a recovery protector be added to a data volume. +Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or users can choose to add protectors to the volume. We recommend that you add at least one primary protector and a recovery protector to a data volume. **Enabling BitLocker with a password** -A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. +A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn on BitLocker. ```powershell manage-bde -protectors -add -pw C: @@ -245,6 +181,7 @@ manage-bde -on C: ## Encrypting volumes using the BitLocker Windows PowerShell cmdlets Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. + @@ -371,80 +308,100 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us
                  - + Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. -A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the Get-BitLocker volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. -Occasionally, all protectors may not be shown when using Get-BitLockerVolume due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors. -> **Note:**  In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID. - -`Get-BitLockerVolume C: | fl` +A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLocker` volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. -If you wanted to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. +Occasionally, all protectors may not be shown when using **Get-BitLockerVolume** due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors. + +> [!NOTE] +> In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID. + +```powershell +Get-BitLockerVolume C: | fl +``` + +If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this task requires the GUID associated with the protector to be removed. A simple script can pipe the values of each **Get-BitLockerVolume** return out to another variable as seen below: + ```powershell $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` -Using this, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector. + +Using this script, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector. Using this information, we can then remove the key protector for a specific volume using the command: + ```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` -> **Note:**  The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. - + +> [!NOTE] +> The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. + ### Operating system volume Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell. -To enable BitLocker with just the TPM protector. This can be done using the command: + +To enable BitLocker with just the TPM protector, use this command: ```powershell Enable-BitLocker C: ``` + The example below adds one additional protector, the StartupKey protectors, and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. ```powershell Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` + ### Data volume -Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. Last, encryption begins. +Data volume encryption using Windows PowerShell is the same as for operating system volumes. Add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user-defined password. Last, encryption begins. ```powershell $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` -### Using a SID based protector in Windows PowerShell -The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover and be unlocked to any member computer of the cluster. +### Using a SID-based protector in Windows PowerShell ->**Warning:**  The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes. - -To add an ADAccountOrGroup protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. +The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly fail over and be unlocked to any member computer of the cluster. + +> [!WARNING] +> The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes. + +To add an ADAccountOrGroup protector to a volume, you need either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. ```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` + For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: ```powershell -get-aduser -filter {samaccountname -eq "administrator"} +Get-ADUser -filter {samaccountname -eq "administrator"} ``` -> **Note:**  Use of this command requires the RSAT-AD-PowerShell feature. -> + +> [!NOTE] +> Use of this command requires the RSAT-AD-PowerShell feature. +> > **Tip:**  In addition to the Windows PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. - -In the example below, the user wishes to add a domain SID based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command: + +In the example below, the user wishes to add a domain SID-based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command: ```powershell Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "" ``` -> **Note:**  Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. - + +> [!NOTE] +> Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. + ## Checking BitLocker status -To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section. +To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command-line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section. ### Checking BitLocker status with the control panel @@ -456,8 +413,8 @@ Checking BitLocker status with the control panel is the most common method used | **Off**| BitLocker is not enabled for the volume | | **Suspended** | BitLocker is suspended and not actively protecting the volume | | **Waiting for Activation**| BitLocker is enabled with a clear protector key and requires further action to be fully protected| - -If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on volume E. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status. + +If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on the volume. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status. Using the control panel, administrators can choose **Turn on BitLocker** to start the BitLocker Drive Encryption wizard and add a protector, like PIN for an operating system volume (or password if no TPM exists), or a password or smart card protector to a data volume. The drive security window displays prior to changing the volume status. Selecting **Activate BitLocker** will complete the encryption process. @@ -465,15 +422,17 @@ Once BitLocker protector activation is completed, the completion notice is displ ### Checking BitLocker status with manage-bde -Administrators who prefer a command line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume. +Administrators who prefer a command-line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume. To check the status of a volume using manage-bde, use the following command: ```powershell manage-bde -status ``` -> **Note:**  If no volume letter is associated with the -status command, all volumes on the computer display their status. - + +> [!NOTE] +> If no volume letter is associated with the -status command, all volumes on the computer display their status. + ### Checking BitLocker status with Windows PowerShell Windows PowerShell commands offer another way to query BitLocker status for volumes. Like manage-bde, Windows PowerShell includes the advantage of being able to check the status of a volume on a remote computer. @@ -483,11 +442,12 @@ Using the Get-BitLockerVolume cmdlet, each volume on the system will display its ```powershell Get-BitLockerVolume -Verbose | fl ``` + This command will display information about the encryption method, volume type, key protectors, etc. ### Provisioning BitLocker during operating system deployment -Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment. This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes. +Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment. This task is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes. ### Decrypting BitLocker volumes @@ -502,18 +462,20 @@ The control panel does not report decryption progress but displays it in the not Once decryption is complete, the drive will update its status in the control panel and is available for encryption. -### Decrypting volumes using the manage-bde command line interface +### Decrypting volumes using the manage-bde command-line interface -Decrypting volumes using manage-bde is very straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is: +Decrypting volumes using manage-bde is straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is: ```powershell manage-bde -off C: ``` + This command disables protectors while it decrypts the volume and removes all protectors when decryption is complete. If a user wishes to check the status of the decryption, they can use the following command: ```powershell manage-bde -status C: ``` + ### Decrypting volumes using the BitLocker Windows PowerShell cmdlets Decryption with Windows PowerShell cmdlets is straightforward, similar to manage-bde. The additional advantage Windows PowerShell offers is the ability to decrypt multiple drives in one pass. In the example below, the user has three encrypted volumes, which they wish to decrypt. @@ -523,16 +485,16 @@ Using the Disable-BitLocker command, they can remove all protectors and encrypti ```powershell Disable-BitLocker ``` + If a user did not want to input each mount point individually, using the `-MountPoint` parameter in an array can sequence the same command into one line without requiring additional user input. An example command is: ```powershell Disable-BitLocker -MountPoint E:,F:,G: ``` + ## See also - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker recovery guide](bitlocker-recovery-guide-plan.md) - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) - [BitLocker overview](bitlocker-overview.md) - - diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 2a85725c2c..6de06c740a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker Countermeasures diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md deleted file mode 100644 index 5431485c7f..0000000000 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: BitLocker frequently asked questions (FAQ) (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. -ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.reviewer: -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 02/28/2019 ---- - -# BitLocker frequently asked questions (FAQ) - -**Applies to** -- Windows 10 - -## Can BitLocker deployment be automated in an enterprise environment? - -Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps). - -## Can BitLocker encrypt more than just the operating system drive? - -Yes. - -## Is there a noticeable performance impact when BitLocker is enabled on a computer? - -Generally it imposes a single-digit percentage performance overhead. - -## How long will initial encryption take when BitLocker is turned on? - -Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting very large drives, you may want to set encryption to occur during times when you will not be using the drive. - -You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. - -## What happens if the computer is turned off during encryption or decryption? - -If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. - -## Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? - -No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. - -## How can I prevent users on a network from storing data on an unencrypted drive? - -You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. - -## What is Used Disk Space Only encryption? - -BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption). - -## What system changes would cause the integrity check on my operating system drive to fail? - -The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: - -- Moving the BitLocker-protected drive into a new computer. -- Installing a new motherboard with a new TPM. -- Turning off, disabling, or clearing the TPM. -- Changing any boot configuration settings. -- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. - -## What causes BitLocker to start into recovery mode when attempting to start the operating system drive? - -Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. -For example: - -- Changing the BIOS boot order to boot another drive in advance of the hard drive. -- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards. -- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. - -In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. -The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. - -## What can prevent BitLocker from binding to PCR 7? - -This happens if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it. - -## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? - -Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. - -## Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? - -Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. - -## Why is "Turn BitLocker on" not available when I right-click a drive? -Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. - -## What type of disk configurations are supported by BitLocker? -Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. - - diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml new file mode 100644 index 0000000000..f873294bba --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml @@ -0,0 +1,97 @@ +### YamlMime:FAQ +metadata: + title: BitLocker deployment and administration FAQ (Windows 10) + description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?" + ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee + ms.reviewer: + ms.prod: w10 + ms.mktglfcycl: explore + ms.sitesec: library + ms.pagetype: security + ms.localizationpriority: medium + author: dansimp + ms.author: dansimp + manager: dansimp + audience: ITPro + ms.collection: M365-security-compliance + ms.topic: conceptual + ms.date: 02/28/2019 + ms.custom: bitlocker + +title: BitLocker frequently asked questions (FAQ) +summary: | + **Applies to** + - Windows 10 + + +sections: + - name: Ignored + questions: + - question: Can BitLocker deployment be automated in an enterprise environment? + answer: | + Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps). + + - question: Can BitLocker encrypt more than just the operating system drive? + answer: Yes. + + - question: Is there a noticeable performance impact when BitLocker is enabled on a computer? + answer: Generally it imposes a single-digit percentage performance overhead. + + - question: How long will initial encryption take when BitLocker is turned on? + answer: | + Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting large drives, you may want to set encryption to occur during times when you will not be using the drive. + + You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. + + - question: What happens if the computer is turned off during encryption or decryption? + answer: If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. + + - question: Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? + answer: No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. + + - question: How can I prevent users on a network from storing data on an unencrypted drive? + answer: | + You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. + + - question: What is Used Disk Space Only encryption? + answer: | + BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption). + + - question: What system changes would cause the integrity check on my operating system drive to fail? + answer: | + The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: + + - Moving the BitLocker-protected drive into a new computer. + - Installing a new motherboard with a new TPM. + - Turning off, disabling, or clearing the TPM. + - Changing any boot configuration settings. + - Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. + + - question: What causes BitLocker to start into recovery mode when attempting to start the operating system drive? + answer: | + Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. + For example: + + - Changing the BIOS boot order to boot another drive in advance of the hard drive. + - Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards. + - Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. + + In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. + The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. + + - question: What can prevent BitLocker from binding to PCR 7? + answer: BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it. + + - question: Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? + answer: Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive. So if you want to prepare a backup operating system or data drive in case a disk fails, make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. + + - question: Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? + answer: Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. + + - question: Why is "Turn BitLocker on" not available when I right-click a drive? + answer: Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. + + - question: What type of disk configurations are supported by BitLocker? + answer: Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. + diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index 8c9c724383..34008453ad 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -6,14 +6,15 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # Overview of BitLocker Device Encryption in Windows 10 @@ -22,7 +23,6 @@ ms.reviewer: - Windows 10 This topic explains how BitLocker Device Encryption can help protect data on devices running Windows 10. -For an architectural overview about how BitLocker Device Encryption works with Secure Boot, see [Secure boot and BitLocker Device Encryption overview](https://docs.microsoft.com/windows-hardware/drivers/bringup/secure-boot-and-device-encryption-overview). For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md). When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives. Windows consistently improves data protection by improving existing options and by providing new strategies. @@ -127,13 +127,13 @@ Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage * Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. * Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. -* Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. +* Provides centralized reporting and hardware management with Microsoft Microsoft Endpoint Configuration Manager. * Reduces the workload on the help desk to assist end users with BitLocker recovery requests. * Enables end users to recover encrypted devices independently by using the Self-Service Portal. * Enables security officers to easily audit access to recovery key information. * Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. * Enforces the BitLocker encryption policy options that you set for your enterprise. -* Integrates with existing management tools, such as System Center Configuration Manager. +* Integrates with existing management tools, such as Microsoft Endpoint Configuration Manager. * Offers an IT-customizable recovery user experience. * Supports Windows 10. diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 26bf69d169..31ee0816da 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -1,6 +1,6 @@ --- -title: BitLocker frequently asked questions (FAQ) (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +title: BitLocker FAQ (Windows 10) +description: Find the answers you need by exploring this brief hub page listing FAQ pages for various aspects of BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: ms.prod: w10 @@ -8,25 +8,26 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- -# BitLocker frequently asked questions (FAQ) +# BitLocker frequently asked questions (FAQ) resources **Applies to** - Windows 10 This topic links to frequently asked questions about BitLocker. BitLocker is a data protection feature that encrypts drives on your computer to help prevent data theft or exposure. BitLocker-protected computers can also delete data more securely when they are decommissioned because it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. -- [Overview and requirements](bitlocker-overview-and-requirements-faq.md) +- [Overview and requirements](bitlocker-overview-and-requirements-faq.yml) - [Upgrading](bitlocker-upgrading-faq.md) -- [Deployment and administration](bitlocker-deployment-and-administration-faq.md) +- [Deployment and administration](bitlocker-deployment-and-administration-faq.yml) - [Key management](bitlocker-key-management-faq.md) - [BitLocker To Go](bitlocker-to-go-faq.md) - [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index e3226ec136..f6f72e035f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -8,31 +8,37 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/17/2019 +ms.custom: bitlocker --- # BitLocker Group Policy settings **Applies to** -- Windows 10 + +- Windows 10 This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. To control what drive encryption tasks the user can perform from the Windows Control Panel or to modify other configuration options, you can use Group Policy administrative templates or local computer policy settings. How you configure these policy settings depends on how you implement BitLocker and what level of user interaction will be allowed. ->**Note:** A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings). +> [!NOTE] +> A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings). BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer is not compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance. If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group -Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. +Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. + +> [!NOTE] +> For more details about Active Directory configuration related to BitLocker enablement, please see [Set up MDT for BitLocker](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker). ## BitLocker Group Policy settings @@ -99,98 +105,43 @@ The following policies are used to support customized deployment scenarios in yo This policy setting allows users on devices that are compliant with Modern Standby or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support Modern Standby or HSTI, while requiring PIN on older devices.

                  Introduced

                  Windows 10, version 1703

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  This setting overrides the Require startup PIN with TPM option of the Require additional authentication at startup policy on compliant hardware. +||| +|--- |--- | +|Policy description|With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support Modern Standby or HSTI, while requiring PIN on older devices.| +|Introduced|Windows 10, version 1703| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|This setting overrides the **Require startup PIN with TPM** option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware.| +|When enabled|Users on Modern Standby and HSTI compliant devices will have the choice to turn on BitLocker without preboot authentication.| +|When disabled or not configured|The options of the [Require additional authentication at startup](#bkmk-unlockpol1) policy apply.| -

                  When enabled

                  Users on Modern Standby and HSTI compliant devices will have the choice to turn on BitLocker without preboot authentication.

                  When disabled or not configured

                  The options of the Require additional authentication at startup policy apply.

                  +**Reference** -Reference - -The preboot authentication option Require startup PIN with TPM of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby. -But visually impaired users have no audible way to know when to enter a PIN. +The preboot authentication option **Require startup PIN with TPM** of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby. But visually impaired users have no audible way to know when to enter a PIN. This setting enables an exception to the PIN-required policy on secure hardware. ### Allow network unlock at startup This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption. + This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control whether a BitLocker-protected computer that is connected to a trusted local area network and joined to a domain can create and use network key protectors on TPM-enabled computers to automatically unlock the operating system drive when the computer is started.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  Clients configured with a BitLocker Network Unlock certificate can create and use Network Key Protectors.

                  When disabled or not configured

                  Clients cannot create and use Network Key Protectors

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether a BitLocker-protected computer that is connected to a trusted local area network and joined to a domain can create and use network key protectors on TPM-enabled computers to automatically unlock the operating system drive when the computer is started.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|Clients configured with a BitLocker Network Unlock certificate can create and use Network Key Protectors.| +|When disabled or not configured|Clients cannot create and use Network Key Protectors| -Reference +**Reference** To use a network key protector to unlock the computer, the computer and the server that hosts BitLocker Drive Encryption Network Unlock must be provisioned with a Network Unlock certificate. The Network Unlock certificate is used to create a network key protector and to protect the information exchange with the server to unlock the computer. You can use the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** on the domain controller to distribute this certificate to computers in your organization. This unlock method uses the TPM on the computer, so computers that do not have a TPM cannot create network key protectors to automatically unlock by using Network Unlock. ->**Note:** For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. +> [!NOTE] +> For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. For more information about Network Unlock, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). @@ -198,46 +149,17 @@ For more information about Network Unlock, see [BitLocker: How to enable Network This policy setting is used to control which unlock options are available for operating system drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  If one authentication method is required, the other methods cannot be allowed.

                  -

                  Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

                  When enabled

                  Users can configure advanced startup options in the BitLocker Setup Wizard.

                  When disabled or not configured

                  Users can configure only basic options on computers with a TPM.

                  -

                  Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|If one authentication method is required, the other methods cannot be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.| +|When enabled|Users can configure advanced startup options in the BitLocker Setup Wizard.| +|When disabled or not configured|Users can configure only basic options on computers with a TPM.

                  Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.| -Reference +**Reference** If you want to use BitLocker on a computer without a TPM, select **Allow BitLocker without a compatible TPM**. In this mode, a password or USB drive is required for startup. The USB drive stores the startup key that is used to encrypt the drive. When the USB drive is inserted, the startup key is authenticated and the operating system drive is accessible. If the USB drive is lost or unavailable, BitLocker recovery is required to access the drive. @@ -275,101 +197,46 @@ There are four options for TPM-enabled computers or devices: This policy setting permits the use of enhanced PINs when you use an unlock method that includes a PIN. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.

                  When disabled or not configured

                  Enhanced PINs will not be used.

                  - +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.| +|When disabled or not configured|Enhanced PINs will not be used.| **Reference** Enhanced startup PINs permit the use of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker. ->**Important:** Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. +> [!IMPORANT] +> Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. ### Configure minimum PIN length for startup This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.

                  When disabled or not configured

                  Users can configure a startup PIN of any length between 6 and 20 digits.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.| +|When disabled or not configured|Users can configure a startup PIN of any length between 6 and 20 digits.| -Reference +**Reference** -This policy setting is applied when you turn on BitLocker. -The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. +This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. Originally, BitLocker allowed from 4 to 20 characters for a PIN. Windows Hello has its own PIN for logon, which can be 4 to 127 characters. Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks. -The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made. +The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made. The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability. For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. @@ -388,61 +255,33 @@ If the minimum PIN length is reduced from the default of six characters, then th This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI ports until a user signs in to Windows. -| | | -| - | - | -| **Policy description** | This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys. | -| **Introduced** | Windows 10, version 1703 | -| **Drive type** | Operating system drives | -| **Policy path** | Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -| **Conflicts** | None | -| **When enabled** | Every time the user locks the screen, DMA will be blocked on hot pluggable PCI ports until the user signs in again. | -| **When disabled or not configured** | DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| +| | | +|---------|---------| +|Policy description|This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys.| +|Introduced|Windows 10, version 1703| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|Every time the user locks the scree, DMA will be blocked on hot pluggable PCI ports until the user signs in again.| +|When disabled or not configured|DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| **Reference** -This policy setting is only enforced when BitLocker or device encyption is enabled. As explained in the [Microoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2018/01/18/issue-with-bitlockerdma-setting-in-windows-10-fall-creators-update-v1709/), in some cases when this setting is enabled, internal, PCI-based peripherals can fail, including wireless network drivers and input and audio peripherals. This problem is fixed in the [April 2018 quality update](https://support.microsoft.com/help/4093105/windows-10-update-kb4093105). +This policy setting is only enforced when BitLocker or device encryption is enabled. As explained in the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2018/01/18/issue-with-bitlockerdma-setting-in-windows-10-fall-creators-update-v1709/), in some cases when this setting is enabled, internal, PCI-based peripherals can fail, including wireless network drivers and input and audio peripherals. This problem is fixed in the [April 2018 quality update](https://support.microsoft.com/help/4093105). ### Disallow standard users from changing the PIN or password This policy setting allows you to configure whether standard users are allowed to change the PIN or password that is used to protect the operating system drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  Standard users are not allowed to change BitLocker PINs or passwords.

                  When disabled or not configured

                  Standard users are permitted to change BitLocker PINs or passwords.

                  - +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|Standard users are not allowed to change BitLocker PINs or passwords.| +|When disabled or not configured|Standard users are permitted to change BitLocker PINs or passwords.| **Reference** @@ -452,55 +291,22 @@ To change the PIN or password, the user must be able to provide the current PIN This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  Passwords cannot be used if FIPS-compliance is enabled.

                  -
                  -Note

                  The System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing policy setting, which is located at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled.

                  -
                  -
                  - -

                  When enabled

                  Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select Require complexity.

                  When disabled or not configured

                  The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.

                  - +||| +|--- |--- | +|Policy description|With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|Passwords cannot be used if FIPS-compliance is enabled.


                  **NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.| +|When enabled|Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select **Require complexity**.| +|When disabled or not configured|The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.| **Reference** If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** must be also enabled. ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there is no password complexity validation. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. @@ -515,44 +321,17 @@ When this policy setting is enabled, you can set the option **Configure password This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.

                  Introduced

                  Windows Server 2008 and Windows Vista

                  Drive type

                  Operating system drives (Windows Server 2008 and Windows Vista)

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  If you choose to require an additional authentication method, other authentication methods cannot be allowed.

                  When enabled

                  The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.

                  When disabled or not configured

                  The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives (Windows Server 2008 and Windows Vista)| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|If you choose to require an additional authentication method, other authentication methods cannot be allowed.| +|When enabled|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.| +|When disabled or not configured|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.| -Reference +**Reference** On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 6-digit to 20-digit startup PIN. @@ -579,97 +358,38 @@ To hide the advanced page on a TPM-enabled computer or device, set these options This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Fixed data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

                  Conflicts

                  To use smart cards with BitLocker, you may also need to modify the object identifier setting in the Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance policy setting to match the object identifier of your smart card certificates.

                  When enabled

                  Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the Require use of smart cards on fixed data drives check box.

                  When disabled

                  Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.

                  When not configured

                  Smart cards can be used to authenticate user access to a BitLocker-protected drive.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| +|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on fixed data drives** check box.| +|When disabled|Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.| +|When not configured|Smart cards can be used to authenticate user access to a BitLocker-protected drive.| -Reference +**Reference** ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. ### Configure use of passwords on fixed data drives This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Fixed data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

                  Conflicts

                  To use password complexity, the Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements policy setting must also be enabled.

                  When enabled

                  Users can configure a password that meets the requirements you define. To require the use of a password, select Require password for fixed data drive. To enforce complexity requirements on the password, select Require complexity.

                  When disabled

                  The user is not allowed to use a password.

                  When not configured

                  Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.| +|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.| +|When disabled|The user is not allowed to use a password.| +|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| -Reference +**Reference** When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled. @@ -679,115 +399,58 @@ When set to **Do not allow complexity**, no password complexity validation is pe Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Password must meet complexity requirements** must also be enabled. This policy setting is configured on a per-computer basis. This means that it applies to local user accounts and domain user accounts. Because the password filter that is used to validate password complexity is located on the domain controllers, local user accounts cannot access the password filter because they are not authenticated for domain access. When this policy setting is enabled, if you sign in with a local user account, and you attempt to encrypt a drive or change a password on an existing BitLocker-protected drive, an "Access denied" error message is displayed. In this situation, the password key protector cannot be added to the drive. Enabling this policy setting requires that connectivity to a domain be established before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they cannot connect to the domain should be made aware of this requirement so that they can schedule a time when they will be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. ->**Important:** Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. +> [!IMPORTANT] +> Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. ### Configure use of smart cards on removable data drives This policy setting is used to require, allow, or deny the use of smart cards with removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Removable data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  To use smart cards with BitLocker, you may also need to modify the object identifier setting in the Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance policy setting to match the object identifier of your smart card certificates.

                  When enabled

                  Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the Require use of smart cards on removable data drives check box.

                  When disabled or not configured

                  Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.

                  When not configured

                  Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| +|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on removable data drives** check box.| +|When disabled or not configured|Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.| +|When not configured|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.| -Reference +**Reference** ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. ### Configure use of passwords on removable data drives This policy setting is used to require, allow, or deny the use of passwords with removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Removable data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  To use password complexity, the Password must meet complexity requirements policy setting, which is located at Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy must also be enabled.

                  When enabled

                  Users can configure a password that meets the requirements you define. To require the use of a password, select Require password for removable data drive. To enforce complexity requirements on the password, select Require complexity.

                  When disabled

                  The user is not allowed to use a password.

                  When not configured

                  Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.

                  - -Reference +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.| +|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.| +|When disabled|The user is not allowed to use a password.| +|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| +**Reference** If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** must also be enabled. ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. @@ -797,52 +460,26 @@ When set to **Allow complexity**, a connection to a domain controller will be at When set to **Do not allow complexity**, no password complexity validation will be done. ->**Note:** Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. +> [!NOTE] +> Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. -For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](https://technet.microsoft.com/library/jj852211.aspx). +For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). ### Validate smart card certificate usage rule compliance This policy setting is used to determine what certificate to use with BitLocker. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Fixed and removable data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

                  Conflicts

                  None

                  When enabled

                  The object identifier that is specified in the Object identifier setting must match the object identifier in the smart card certificate.

                  When disabled or not configured

                  The default object identifier is used.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed and removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|The object identifier that is specified in the **Object identifier** setting must match the object identifier in the smart card certificate.| +|When disabled or not configured|The default object identifier is used.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -850,50 +487,24 @@ The object identifier is specified in the enhanced key usage (EKU) of a certific The default object identifier is 1.3.6.1.4.1.311.67.1.1. ->**Note:** BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. +> [!NOTE] +> BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. ### Enable use of BitLocker authentication requiring preboot keyboard input on slates This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drive

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive

                  Conflicts

                  None

                  When enabled

                  Devices must have an alternative means of preboot input (such as an attached USB keyboard).

                  When disabled or not configured

                  The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive| +|Conflicts|None| +|When enabled|Devices must have an alternative means of preboot input (such as an attached USB keyboard).| +|When disabled or not configured|The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.| -Reference +**Reference** The Windows touch keyboard (such as used by tablets) is not available in the preboot environment where BitLocker requires additional information, such as a PIN or password. @@ -911,44 +522,17 @@ If you do not enable this policy setting, the following options in the **Require This policy setting is used to require encryption of fixed drives prior to granting Write access. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Fixed data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

                  Conflicts

                  See the Reference section for a description of conflicts.

                  When enabled

                  All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.

                  When disabled or not configured

                  All fixed data drives on the computer are mounted with Read and Write access.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|See the Reference section for a description of conflicts.| +|When enabled|All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|When disabled or not configured|All fixed data drives on the computer are mounted with Read and Write access.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -966,48 +550,22 @@ Conflict considerations include: This policy setting is used to require that removable drives are encrypted prior to granting Write access, and to control whether BitLocker-protected removable drives that were configured in another organization can be opened with Write access. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Removable data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  See the Reference section for a description of conflicts.

                  When enabled

                  All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.

                  When disabled or not configured

                  All removable data drives on the computer are mounted with Read and Write access.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|See the Reference section for a description of conflicts.| +|When enabled|All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|When disabled or not configured|All removable data drives on the computer are mounted with Read and Write access.| -Reference +**Reference** If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it is checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting. ->**Note:** You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. +> [!NOTE] +> You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. Conflict considerations include: @@ -1019,52 +577,22 @@ Conflict considerations include: This policy setting is used to prevent users from turning BitLocker on or off on removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control the use of BitLocker on removable data drives.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Removable data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  None

                  When enabled

                  You can select property settings that control how users can configure BitLocker.

                  When disabled

                  Users cannot use BitLocker on removable data drives.

                  When not configured

                  Users can use BitLocker on removable data drives.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control the use of BitLocker on removable data drives.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled|You can select property settings that control how users can configure BitLocker.| +|When disabled|Users cannot use BitLocker on removable data drives.| +|When not configured|Users can use BitLocker on removable data drives.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. -For information about suspending BitLocker protection, see [BitLocker Basic Deployment](https://technet.microsoft.com/library/dn383581.aspx). +For information about suspending BitLocker protection, see [BitLocker Basic Deployment](bitlocker-basic-deployment.md). The options for choosing property settings that control how users can configure BitLocker are: @@ -1075,44 +603,17 @@ The options for choosing property settings that control how users can configure This policy setting is used to control the encryption method and cipher strength. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control the encryption method and strength for drives.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  All drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

                  Conflicts

                  None

                  When enabled

                  You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.

                  When disabled or not configured

                  Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control the encryption method and strength for drives.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.| +|When disabled or not configured|Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.| -Reference +**Reference** The values of this policy determine the strength of the cipher that BitLocker uses for encryption. Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128). @@ -1123,7 +624,8 @@ For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the d Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored. ->**Warning:** This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. +> [!WARNING] +> This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. When this policy setting is disabled or not configured, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method that is specified in the setup script. @@ -1131,51 +633,21 @@ When this policy setting is disabled or not configured, BitLocker will use the d This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they are used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Fixed data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

                  Conflicts

                  None

                  When enabled

                  You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.

                  When disabled

                  BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.

                  When not configured

                  BitLocker software-based encryption is used irrespective of hardware-based encryption ability. -

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|None| +|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|When disabled|BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| -Reference +**Reference** ->**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> [!NOTE] +> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: @@ -1186,52 +658,23 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls how BitLocker reacts when encrypted drives are used as operating system drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.

                  When disabled

                  BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.

                  When not configured

                  BitLocker software-based encryption is used irrespective of hardware-based encryption ability.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|When disabled|BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| -Reference +**Reference** If hardware-based encryption is not available, BitLocker software-based encryption is used instead. ->**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> [!NOTE] +> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: @@ -1242,52 +685,23 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls how BitLocker reacts to encrypted drives when they are used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Removable data drive

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  None

                  When enabled

                  You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.

                  When disabled

                  BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.

                  When not configured

                  BitLocker software-based encryption is used irrespective of hardware-based encryption ability.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Removable data drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|When disabled|BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| -Reference +**Reference** If hardware-based encryption is not available, BitLocker software-based encryption is used instead. ->**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> [!NOTE] +> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: @@ -1298,192 +712,86 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure the encryption type that is used by BitLocker.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Fixed data drive

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

                  Conflicts

                  None

                  When enabled

                  This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.

                  When disabled or not configured

                  The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Fixed data drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|None| +|When enabled|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:** This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> [!NOTE] +> This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). ### Enforce drive encryption type on operating system drives This policy controls whether operating system drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure the encryption type that is used by BitLocker.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drive

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.

                  When disabled or not configured

                  The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:** This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> [!NOTE] +> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). ### Enforce drive encryption type on removable data drives This policy controls whether fixed data drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure the encryption type that is used by BitLocker.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Removable data drive

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  None

                  When enabled

                  The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.

                  When disabled or not configured

                  The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Removable data drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:** This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> [!NOTE] +> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). ### Choose how BitLocker-protected operating system drives can be recovered This policy setting is used to configure recovery methods for operating system drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  You must disallow the use of recovery keys if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

                  -

                  When using data recovery agents, you must enable the Provide the unique identifiers for your organization policy setting.

                  When enabled

                  You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.

                  When disabled or not configured

                  The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

                  When using data recovery agents, you must enable the **Provide the unique identifiers for your organization** policy setting.| +|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.| +|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -1500,50 +808,24 @@ In **Save BitLocker recovery information to Active Directory Domain Services**, Select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. ->**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. +> [!NOTE] +> If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. ### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista) This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.

                  Introduced

                  Windows Server 2008 and Windows Vista

                  Drive type

                  Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

                  Conflicts

                  This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the Do not allow option for both user recovery options, you must enable the Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) policy setting to prevent a policy error.

                  When enabled

                  You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.

                  When disabled or not configured

                  The BitLocker Setup Wizard presents users with ways to store recovery options.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the **Do not allow** option for both user recovery options, you must enable the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting to prevent a policy error.| +|When enabled|You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.| +|When disabled or not configured|The BitLocker Setup Wizard presents users with ways to store recovery options.| -Reference +**Reference** This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. @@ -1551,53 +833,28 @@ Two recovery options can be used to unlock BitLocker-encrypted data in the absen Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving it to a folder stores the 48-digit recovery password as a text file. Printing it sends the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder. -> **Important:** If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. +> [!IMPORTANT] +> If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. > The 48-digit recovery password is not available in FIPS-compliance mode. -> -> **Important:** To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. + +> [!IMPORTANT] +> To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. ### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.

                  Introduced

                  Windows Server 2008 and Windows Vista

                  Drive type

                  Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

                  Conflicts

                  None

                  When enabled

                  BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.

                  When disabled or not configured

                  BitLocker recovery information is not backed up to AD DS.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.| +|When disabled or not configured|BitLocker recovery information is not backed up to AD DS.| -Reference +**Reference** This policy is only applicable to computers running Windows Server 2008 or Windows Vista. @@ -1618,92 +875,38 @@ For more information about this setting, see [TPM Group Policy settings](/window This policy setting is used to configure the default folder for recovery passwords. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.

                  Introduced

                  Windows Vista

                  Drive type

                  All drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

                  Conflicts

                  None

                  When enabled

                  You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.

                  When disabled or not configured

                  The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.| +|Introduced|Windows Vista| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| +|When disabled or not configured|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. ->**Note:** This policy setting does not prevent the user from saving the recovery password in another folder. +> [!NOTE] +> This policy setting does not prevent the user from saving the recovery password in another folder. ### Choose how BitLocker-protected fixed drives can be recovered This policy setting is used to configure recovery methods for fixed data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Fixed data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

                  Conflicts

                  You must disallow the use of recovery keys if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

                  -

                  When using data recovery agents, you must enable and configure the Provide the unique identifiers for your organization policy setting.

                  When enabled

                  You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.

                  When disabled or not configured

                  The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

                  When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.| +|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -1716,55 +919,29 @@ Select **Omit recovery options from the BitLocker setup wizard** to prevent user In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. -For more information about the BitLocker repair tool, see [Repair-bde](https://technet.microsoft.com/library/ff829851.aspx). +For more information about the BitLocker repair tool, see [Repair-bde](/windows-server/administration/windows-commands/repair-bde). Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. ->**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. +> [!NOTE] +> If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. ### Choose how BitLocker-protected removable drives can be recovered This policy setting is used to configure recovery methods for removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Removable data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  You must disallow the use of recovery keys if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

                  -

                  When using data recovery agents, you must enable and configure the Provide the unique identifiers for your organization policy setting.

                  When enabled

                  You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.

                  When disabled or not configured

                  The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. +When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.| +|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -1778,50 +955,24 @@ In **Save BitLocker recovery information to Active Directory Domain Services**, Select the **Do not enable BitLocker until recovery information is stored in AD DS for removable data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. ->**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. +> [!NOTE] +> If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. ### Configure the pre-boot recovery message and URL This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.

                  Introduced

                  Windows 10

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL

                  Conflicts

                  None

                  When enabled

                  The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the Use default recovery message and URL option.

                  When disabled or not configured

                  If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.| +|Introduced|Windows 10| +|Drive type|Operating system drives| +|Policy path|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| +|Conflicts|None| +|When enabled|The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the **Use default recovery message and URL** option.| +|When disabled or not configured|If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| -Reference +**Reference** Enabling the **Configure the pre-boot recovery message and URL** policy setting allows you to customize the default recovery screen message and URL to assist customers in recovering their key. @@ -1831,111 +982,59 @@ Once you enable the setting you have three options: - If you select the **Use custom recovery message** option, type the custom message in the **Custom recovery message option** text box. The message that you type in the **Custom recovery message option** text box will be displayed on the pre-boot recovery screen. If a recovery URL is available, include it in the message. - If you select the **Use custom recovery URL** option, type the custom message URL in the **Custom recovery URL option** text box. The URL that you type in the **Custom recovery URL option** text box replaces the default URL in the default recovery message, which will be displayed on the pre-boot recovery screen. -> **Important:** Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. -> -> **Important:** Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. +> [!IMPORTANT] +> Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. + +> [!IMPORTANT] +> Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. ### Allow Secure Boot for integrity validation This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  All drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  If you enable Allow Secure Boot for integrity validation, make sure the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

                  -

                  For more information about PCR 7, see Platform Configuration Register (PCR) in this topic.

                  When enabled or not configured

                  BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.

                  When disabled

                  BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

                  For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| +|When enabled or not configured|BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.| +|When disabled|BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.| -Reference +**Reference** Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. Secure Boot also provides more flexibility for managing preboot configurations than BitLocker integrity checks prior to Windows Server 2012 and Windows 8. When this policy is enabled and the hardware is capable of using Secure Boot for BitLocker scenarios, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored, and Secure Boot verifies BCD settings according to the Secure Boot policy setting, which is configured separately from BitLocker. ->**Warning:** Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. +> [!WARNING] +> Disabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. ### Provide the unique identifiers for your organization This policy setting is used to establish an identifier that is applied to all drives that are encrypted in your organization. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  All drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

                  Conflicts

                  Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.

                  When enabled

                  You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.

                  When disabled or not configured

                  The identification field is not required.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.| +|When enabled|You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.| +|When disabled or not configured|The identification field is not required.| -Reference +**Reference** -These identifiers are stored as the identification field and the allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. +These identifiers are stored as the identification field and the allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool. An identification field is required to manage certificate-based data recovery agents on BitLocker-protected drives and for potential updates to the BitLocker To Go Reader. BitLocker manages and updates data recovery agents only when the identification field on the drive matches the value that is configured in the identification field. In a similar manner, BitLocker updates the BitLocker To Go Reader only when the identification field on the drive matches the value that is configured for the identification field. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). The allowed identification field is used in combination with the **Deny write access to removable drives not protected by BitLocker** policy setting to help control the use of removable drives in your organization. It is a comma-separated list of identification fields from your organization or external organizations. -You can configure the identification fields on existing drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. +You can configure the identification fields on existing drives by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool. When a BitLocker-protected drive is mounted on another BitLocker-enabled computer, the identification field and the allowed identification field are used to determine whether the drive is from an outside organization. @@ -1945,44 +1044,17 @@ Multiple values separated by commas can be entered in the identification and all This policy setting is used to control whether the computer's memory will be overwritten the next time the computer is restarted. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.

                  Introduced

                  Windows Vista

                  Drive type

                  All drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

                  Conflicts

                  None

                  When enabled

                  The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.

                  When disabled or not configured

                  BitLocker secrets are removed from memory when the computer restarts.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.| +|Introduced|Windows Vista| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.| +|When disabled or not configured|BitLocker secrets are removed from memory when the computer restarts.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. BitLocker secrets include key material that is used to encrypt data. This policy setting applies only when BitLocker protection is enabled. @@ -1990,48 +1062,22 @@ This policy setting is applied when you turn on BitLocker. BitLocker secrets inc This policy setting determines what values the TPM measures when it validates early boot components before it unlocks an operating system drive on a computer with a BIOS configuration or with UEFI firmware that has the Compatibility Support Module (CSM) enabled. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.

                  When disabled or not configured

                  The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| -Reference +**Reference** This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. ->**Important:** This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. +> [!IMPORTANT] +> This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: @@ -2043,7 +1089,8 @@ A platform validation profile consists of a set of PCR indices that range from 0 - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) ->**Note:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. +> [!NOTE] +> Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. The following list identifies all of the PCRs available: @@ -2065,44 +1112,17 @@ The following list identifies all of the PCRs available: This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

                  Introduced

                  Windows Server 2008 and Windows Vista

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.

                  When disabled or not configured

                  The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| -Reference +**Reference** This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. @@ -2116,7 +1136,8 @@ A platform validation profile consists of a set of PCR indices that range from 0 - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) ->**Note:** The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. +> [!NOTE] +> The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. The following list identifies all of the PCRs available: @@ -2134,56 +1155,29 @@ The following list identifies all of the PCRs available: - PCR 11: BitLocker access control - PCR 12 - 23: Reserved for future use ->**Warning:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. +> [!WARNING] +> Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. ### Configure TPM platform validation profile for native UEFI firmware configurations This policy setting determines what values the TPM measures when it validates early boot components before unlocking an operating system drive on a computer with native UEFI firmware configurations. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  Setting this policy with PCR 7 omitted, overrides the Allow Secure Boot for integrity validation Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.

                  -

                  If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

                  -

                  For more information about PCR 7, see Platform Configuration Register (PCR) in this topic.

                  When enabled

                  Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.

                  When disabled or not configured

                  BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation,

                  If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

                  For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| +|When enabled|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|When disabled or not configured|BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.| -Reference +**Reference** This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. ->**Important:** This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. +> [!IMPORTANT] +> This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). @@ -2209,54 +1203,25 @@ The following list identifies all of the PCRs available: - PCR 14: Boot Authorities - PCR 15 – 23: Reserved for future use ->**Warning:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. +> [!WARNING] +> Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. ### Reset platform validation data after BitLocker recovery This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  None

                  When enabled

                  Platform validation data is refreshed when Windows is started following a BitLocker recovery.

                  When disabled

                  Platform validation data is not refreshed when Windows is started following a BitLocker recovery.

                  When not configured

                  Platform validation data is refreshed when Windows is started following a BitLocker recovery.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| +|When disabled|Platform validation data is not refreshed when Windows is started following a BitLocker recovery.| +|When not configured|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| -Reference +**Reference** For more information about the recovery process, see the [BitLocker recovery guide](bitlocker-recovery-guide-plan.md). @@ -2264,95 +1229,40 @@ For more information about the recovery process, see the [BitLocker recovery gui This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.

                  Introduced

                  Windows Server 2012 and Windows 8

                  Drive type

                  Operating system drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

                  Conflicts

                  When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the Use enhanced Boot Configuration Data validation profile Group Policy setting is ignored (as defined by the Allow Secure Boot for integrity validation Group Policy setting).

                  When enabled

                  You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.

                  When disabled

                  The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.

                  When not configured

                  The computer verifies the default BCD settings in Windows.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored (as defined by the **Allow Secure Boot for integrity validation** Group Policy setting).| +|When enabled|You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.| +|When disabled|The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.| +|When not configured|The computer verifies the default BCD settings in Windows.| -Reference +**Reference** ->**Note:** The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. +> [!NOTE] +> The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. ### Allow access to BitLocker-protected fixed data drives from earlier versions of Windows This policy setting is used to control whether access to drives is allowed by using the BitLocker To Go Reader, and if the application is installed on the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Fixed data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

                  Conflicts

                  None

                  When enabled and When not configured

                  Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.

                  When disabled

                  Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|None| +|When enabled and When not configured|Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| +|When disabled|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| -Reference +**Reference** ->**Note:** This policy setting does not apply to drives that are formatted with the NTFS file system. +> [!NOTE] +> This policy setting does not apply to drives that are formatted with the NTFS file system. When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. @@ -2360,46 +1270,20 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go This policy setting controls access to removable data drives that are using the BitLocker To Go Reader and whether the BitLocker To Go Reader can be installed on the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.

                  Introduced

                  Windows Server 2008 R2 and Windows 7

                  Drive type

                  Removable data drives

                  Policy path

                  Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

                  Conflicts

                  None

                  When enabled and When not configured

                  Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.

                  When disabled

                  Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.

                  +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled and When not configured|Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| +|When disabled|Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| -Reference +**Reference** ->**Note:** This policy setting does not apply to drives that are formatted with the NTFS file system. +> [!NOTE] +> This policy setting does not apply to drives that are formatted with the NTFS file system. When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. @@ -2407,44 +1291,17 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users cannot create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                  Policy description

                  Notes

                  Introduced

                  Windows Server 2003 with SP1

                  Drive type

                  System-wide

                  Policy path

                  Local Policies\Security Options\System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing

                  Conflicts

                  Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.

                  When enabled

                  Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup izard to create a recovery password.

                  When disabled or not configured

                  No BitLocker encryption key is generated

                  +||| +|--- |--- | +|Policy description|Notes| +|Introduced|Windows Server 2003 with SP1| +|Drive type|System-wide| +|Policy path|Local Policies\Security Options\System cryptography: **Use FIPS compliant algorithms for encryption, hashing, and signing**| +|Conflicts|Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.| +|When enabled|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.| +|When disabled or not configured|No BitLocker encryption key is generated| -Reference +**Reference** This policy needs to be enabled before any encryption key is generated for BitLocker. Note that when this policy is enabled, BitLocker prevents creating or using recovery passwords, so recovery keys should be used instead. @@ -2452,7 +1309,7 @@ You can save the optional recovery key to a USB drive. Because recovery password You can edit the FIPS setting by using the Security Policy Editor (Secpol.msc) or by editing the Windows registry. You must be an administrator to perform these procedures. -For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://technet.microsoft.com/library/jj852197.aspx). +For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). ## Power management Group Policy settings: Sleep and Hibernate @@ -2476,11 +1333,12 @@ Changing from the default platform validation profile affects the security and m PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides you with greater flexibility to manage the preboot configuration. -PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](https://msdn.microsoft.com/library/windows/hardware/jj923068.aspx). +PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](/windows-hardware/test/hlk/testref/trusted-execution-environment-efi-protocol). PCR 7 measurements are a mandatory logo requirement for systems that support Modern Standby (also known as Always On, Always Connected PCs), such as the Microsoft Surface RT. On such systems, if the TPM with PCR 7 measurement and Secure Boot are correctly configured, BitLocker binds to PCR 7 and PCR 11 by default. ## See also + - [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview) - [TPM Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md index f8d1a6e1f9..4ba7629cc0 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: How to deploy on Windows Server 2012 and later diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 49b3e4f60f..5c7b1190b1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: How to enable Network Unlock @@ -55,7 +56,8 @@ Network Unlock must meet mandatory hardware and software requirements before the The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus, so you need to confirm that the network stack has been enabled in the BIOS before starting the computer. ->**Note:**  To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. +> [!NOTE] +> To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. For Network Unlock to work reliably on computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP and used for Network Unlock. This is especially worth noting when you have multiple adapters, and you wish to configure one without DHCP, such as for a lights-out management protocol. This configuration is necessary because Network Unlock will stop enumerating adapters when it reaches one with a DHCP port failure for any reason. Thus, if the first enumerated adapter does not support DHCP, is not plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. @@ -79,7 +81,9 @@ The server side configuration to enable Network Unlock also requires provisionin 1. The Windows boot manager detects that a Network Unlock protector exists in the BitLocker configuration. 2. The client computer uses its DHCP driver in the UEFI to obtain a valid IPv4 IP address. -3. The client computer broadcasts a vendor-specific DHCP request that contains the Network Key (a 256-bit intermediate key) and an AES-256 session key for the reply. Both of these keys are encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server. +3. The client computer broadcasts a vendor-specific DHCP request that contains: + 1. A Network Key (a 256-bit intermediate key) encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server. + 2. An AES-256 session key for the reply. 4. The Network Unlock provider on the WDS server recognizes the vendor-specific request. 5. The provider decrypts it with the WDS server’s BitLocker Network Unlock certificate RSA private key. 6. The WDS provider then returns the network key encrypted with the session key using its own vendor-specific DHCP reply to the client computer. This forms an intermediate key. @@ -91,7 +95,7 @@ The server side configuration to enable Network Unlock also requires provisionin The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012. -### Install the WDS Server role +### Install the WDS Server role The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager. @@ -103,7 +107,7 @@ Install-WindowsFeature WDS-Deployment You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard. -### Confirm the WDS Service is running +### Confirm the WDS Service is running To confirm the WDS service is running, use the Services Management Console or Windows PowerShell. To confirm the service is running in Services Management Console, open the console using **services.msc** and check the status of the Windows Deployment Services service. @@ -112,7 +116,7 @@ To confirm the service is running using Windows PowerShell, use the following co ```powershell Get-Service WDSServer ``` -### Install the Network Unlock feature +### Install the Network Unlock feature To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Server Manager, select the **BitLocker Network Unlock** feature in the Server Manager console. @@ -121,7 +125,7 @@ To install the feature using Windows PowerShell, use the following command: ```powershell Install-WindowsFeature BitLocker-NetworkUnlock ``` -### Create the certificate template for Network Unlock +### Create the certificate template for Network Unlock A properly configured Active Directory Services Certification Authority can use this certificate template to create and issue Network Unlock certificates. @@ -151,7 +155,7 @@ To add the Network Unlock template to the Certification Authority, open the Cert After adding the Network Unlock template to the Certification Authority, this certificate can be used to configure BitLocker Network Unlock. -### Create the Network Unlock certificate +### Create the Network Unlock certificate Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate. @@ -214,7 +218,7 @@ Certreq example: 3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name: - ``` syntax + ```cmd certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer ``` @@ -222,7 +226,7 @@ Certreq example: 5. Launch Certificates - Local Machine by running **certlm.msc**. 6. Create a .pfx file by opening the **Certificates – Local Computer\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file. -### Deploy the private key and certificate to the WDS server +### Deploy the private key and certificate to the WDS server With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following: @@ -243,7 +247,8 @@ The following steps describe how to enable the Group Policy setting that is a re The following steps describe how to deploy the required Group Policy setting: ->**Note:**  The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. +> [!NOTE] +> The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. 1. Copy the .cer file created for Network Unlock to the domain controller. 2. On the domain controller, launch Group Policy Management Console (gpmc.msc). @@ -254,10 +259,12 @@ The following steps describe how to deploy the required Group Policy setting: 2. Right-click the folder and choose **Add Network Unlock Certificate**. 3. Follow the wizard steps and import the .cer file that was copied earlier. ->**Note:**  Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer. +> [!NOTE] +> Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer. 5. Reboot the clients after deploying the group policy. - >**Note:** The **Network (Certificate Based)** protector will be added only after a reboot with the policy enabled and a valid certificate present in the FVE_NKP store. + > [!NOTE] + > The **Network (Certificate Based)** protector will be added only after a reboot with the policy enabled and a valid certificate present in the FVE_NKP store. ### Subnet policy configuration files on WDS Server (Optional) @@ -274,14 +281,17 @@ SUBNET2=10.185.252.200/28 SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. ``` + Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. ->**Note:**  When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. +> [!NOTE] +> When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. + ```ini -[‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] +[2158a767e1c14e88e27a4c0aee111d2de2eafe60] ;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. ;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. SUBNET1 @@ -291,16 +301,20 @@ SUBNET3 To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED". -## Turning off Network Unlock +## Turning off Network Unlock To turn off the unlock server, the PXE provider can be unregistered from the WDS server or uninstalled altogether. However, to stop clients from creating Network Unlock protectors the **Allow Network Unlock at startup** Group Policy setting should be disabled. When this policy setting is updated to disabled on client computers any Network Unlock key protectors on the computer will be deleted. Alternatively, the BitLocker Network Unlock certificate policy can be deleted on the domain controller to accomplish the same task for an entire domain. ->**Note:**  Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server. +> [!NOTE] +> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server. -## Update Network Unlock certificates +## Update Network Unlock certificates To update the certificates used by Network Unlock, administrators need to import or generate the new certificate for the server and then update the Network Unlock certificate Group Policy setting on the domain controller. +> [!NOTE] +> Servers that do not receive the Group Policy Object (GPO) will require a PIN when booting. In such cases, the reason why the server did not receive the GPO to update the certificate needs to be investigated. + ## Troubleshoot Network Unlock Troubleshooting Network Unlock issues begins by verifying the environment. Many times, a small configuration issue will be the root cause of the failure. Items to verify include: @@ -311,12 +325,13 @@ Troubleshooting Network Unlock issues begins by verifying the environment. Many - Group policy for Network Unlock is enabled and linked to the appropriate domains. - Verify group policy is reaching the clients properly. This can be done using the GPRESULT.exe or RSOP.msc utilities. - Verify the clients were rebooted after applying the policy. -- Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the lcoal computer: +- Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the local computer: ```powershell - manage-bde –protectors –get C: + manage-bde -protectors -get C: ``` - >**Note:** Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock + > [!NOTE] + > Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock Files to gather when troubleshooting BitLocker Network Unlock include: @@ -326,7 +341,7 @@ Files to gather when troubleshooting BitLocker Network Unlock include: 1. Start an elevated command prompt and run the following command: - ``` syntax + ```cmd wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true ``` 2. Open Event Viewer on the WDS server. @@ -358,7 +373,7 @@ The following steps can be used to configure Network Unlock on these older syste 6. Configure registry settings for Network Unlock: Apply the registry settings by running the following certutil script (assuming your network unlock certificate file is called **BitLocker-NetworkUnlock.cer**) on each computer running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. - +```console certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f @@ -367,6 +382,7 @@ The following steps can be used to configure Network Unlock on these older syste reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f +``` 7. Set up a TPM protector on the clients 8. Reboot the clients to add the Network (Certificate Based) protector diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md index fa1f49ee5d..d7338589c5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md @@ -1,6 +1,6 @@ --- title: BitLocker Key Management FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Browse frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: ms.prod: w10 @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker Key Management FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index e6b90ed8bc..78eb7b7715 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -1,19 +1,20 @@ --- title: BitLocker Management Recommendations for Enterprises (Windows 10) -description: This topic explains recommendations for managing BitLocker. +description: Refer to relevant documentation, products, and services to learn about managing BitLocker for enterprises and see recommendations for different computers. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # BitLocker Management for Enterprises @@ -23,22 +24,22 @@ The ideal for BitLocker management is to eliminate the need for IT admins to set Though much Windows BitLocker [documentation](bitlocker-overview.md) has been published, customers frequently ask for recommendations and pointers to specific, task-oriented documentation that is both easy to digest and focused on how to deploy and manage BitLocker. This article links to relevant documentation, products, and services to help answer this and other related frequently-asked questions, and also provides BitLocker recommendations for different types of computers. ->[!IMPORTANT] -> Microsoft BitLocker Administration and Monitoring (MBAM) capabilities will be offered from [SCCM in on-prem scenarios](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology) in the future. +> [!IMPORTANT] +> Microsoft BitLocker Administration and Monitoring (MBAM) capabilities will be offered from [ConfigMgr in on-prem scenarios](https://docs.microsoft.com/configmgr/core/get-started/2019/technical-preview-1909#bkmk_bitlocker/) in the future. ## Managing domain-joined computers and moving to cloud -Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](https://technet.microsoft.com/library/hh846237.aspx#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](https://technet.microsoft.com/library/hh846237.aspx#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](https://technet.microsoft.com/library/ee706521(v=ws.10).aspx). +Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](https://docs.microsoft.com/configmgr/osd/understand/task-sequence-steps#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](https://docs.microsoft.com/configmgr/osd/understand/task-sequence-steps#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings/). -Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201) or they can receive extended support until July 2024. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). +Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201/) or they can receive extended support until April 2026. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). ## Managing devices joined to Azure Active Directory -Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. Without Windows 10, version 1809, only local administrators can enable BitLocker via Intune policy. Starting with Windows 10, version 1809, Intune can enable BitLocker for standard users. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access) to services like Exchange Online and SharePoint Online. +Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. Without Windows 10, version 1809, only local administrators can enable BitLocker via Intune policy. Starting with Windows 10, version 1809, Intune can enable BitLocker for standard users. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider/), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access/) to services like Exchange Online and SharePoint Online. -Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 and on Windows phones. +Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider/) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 and on Windows phones. -For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), admins can use the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) to trigger encryption and store the recovery key in Azure AD. +For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), admins can use the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/) to trigger encryption and store the recovery key in Azure AD. This is applicable to Azure Hybrid AD as well. @@ -52,9 +53,9 @@ For Windows PCs and Windows Phones that enroll using **Connect to work or school Servers are often installed, configured, and deployed using PowerShell, so the recommendation is to also use [PowerShell to enable BitLocker on a server](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell), ideally as part of the initial setup. BitLocker is an Optional Component (OC) in Windows Server, so follow the directions in [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md) to add the BitLocker OC. -The Minimal Server Interface is a prerequisite for some of the BitLocker administration tools. On a [Server Core](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-core) installation, you must add the necessary GUI components first. The steps to add shell components to Server Core are described in [Using Features on Demand with Updated Systems and Patched Images](https://blogs.technet.microsoft.com/server_core/2012/11/05/using-features-on-demand-with-updated-systems-and-patched-images/) and [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/). +The Minimal Server Interface is a prerequisite for some of the BitLocker administration tools. On a [Server Core](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-core/) installation, you must add the necessary GUI components first. The steps to add shell components to Server Core are described in [Using Features on Demand with Updated Systems and Patched Images](https://blogs.technet.microsoft.com/server_core/2012/11/05/using-features-on-demand-with-updated-systems-and-patched-images/) and [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/). -If you are installing a server manually, such as a stand-alone server, then choosing [Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience) is the easiest path because you can avoid performing the steps to add a GUI to Server Core. +If you are installing a server manually, such as a stand-alone server, then choosing [Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience/) is the easiest path because you can avoid performing the steps to add a GUI to Server Core. Additionally, lights out data centers can take advantage of the enhanced security of a second factor while avoiding the need for user intervention during reboots by optionally using a combination of BitLocker (TPM+PIN) and BitLocker Network Unlock. BitLocker Network Unlock brings together the best of hardware protection, location dependence, and automatic unlock, while in the trusted location. For the configuration steps, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). @@ -65,64 +66,60 @@ If you are installing a server manually, such as a stand-alone server, then choo For Azure AD-joined computers, including virtual machines, the recovery password should be stored in Azure Active Directory. *Example: Use PowerShell to add a recovery password and back it up to Azure AD before enabling BitLocker* -``` -PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector +```powershell +Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector -PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:" +$BLV = Get-BitLockerVolume -MountPoint "C:" + +BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId +``` -PS C:\>BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId -``` For domain-joined computers, including servers, the recovery password should be stored in Active Directory Domain Services (AD DS). *Example: Use PowerShell to add a recovery password and back it up to AD DS before enabling BitLocker* -``` -PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector +```powershell +Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector -PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:" +$BLV = Get-BitLockerVolume -MountPoint "C:" -PS C:\>Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId - ``` +Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId +``` Subsequently, you can use PowerShell to enable BitLocker. *Example: Use PowerShell to enable BitLocker with a TPM protector* - ``` -PS C:\>Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector - ``` -*Example: Use PowerShell to enable BitLocker with a TPM+PIN protector, in this case with a PIN set to 123456* - ``` -PS C:\>$SecureString = ConvertTo-SecureString "123456" -AsPlainText -Force +```powershell +Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector +``` -PS C:\> Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -Pin $SecureString -TPMandPinProtector - ``` +*Example: Use PowerShell to enable BitLocker with a TPM+PIN protector, in this case with a PIN set to 123456* +```powershell +$SecureString = ConvertTo-SecureString "123456" -AsPlainText -Force + +Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -Pin $SecureString -TPMandPinProtector +``` ## Related Articles [BitLocker: FAQs](bitlocker-frequently-asked-questions.md) -[Microsoft BitLocker Administration and Management (MBAM)](https://technet.microsoft.com/windows/hh826072.aspx) +[Microsoft BitLocker Administration and Management (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) [Overview of BitLocker Device Encryption in Windows 10](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) -[System Center 2012 Configuration Manager SP1](https://technet.microsoft.com/library/hh846237.aspx#BKMK_PreProvisionBitLocker) *(Pre-provision BitLocker task sequence)* +[BitLocker Group Policy Reference](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings) -[Enable BitLocker task sequence](https://technet.microsoft.com/library/hh846237.aspx#BKMK_EnableBitLocker) - -[BitLocker Group Policy Reference](https://technet.microsoft.com/library/ee706521(v=ws.10).aspx) - -[Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune) +[Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune/) *(Overview)* [Configuration Settings Providers](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) *(Policy CSP: See [Security-RequireDeviceEncryption](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-security#security-policies))* -[BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) - -
                  +[BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/) **Windows Server setup tools** -[Windows Server Installation Options](https://technet.microsoft.com/library/hh831786(v=ws.11).aspx) +[Windows Server Installation Options](https://docs.microsoft.com/windows-server/get-started-19/install-upgrade-migrate-19/) [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/) @@ -134,13 +131,9 @@ PS C:\> Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpace [Shielded VMs and Guarded Fabric](https://blogs.technet.microsoft.com/windowsserver/2016/05/10/a-closer-look-at-shielded-vms-in-windows-server-2016/) -
                  - - - -# **PowerShell** +**PowerShell** [BitLocker cmdlets for Windows PowerShell](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell) -[Surface Pro Specifications](https://www.microsoft.com/surface/support/surface-pro-specs) +[Surface Pro Specifications](https://www.microsoft.com/surface/support/surface-pro-specs/) diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md index 0405362524..264ee0242a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md @@ -1,19 +1,20 @@ --- -title: BitLocker frequently asked questions (FAQ) (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +title: BitLocker Network Unlock FAQ (Windows 10) +description: Familiarize yourself with BitLocker Network Unlock. Learn how it can make desktop and server management easier within domain environments. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # BitLocker Network Unlock FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md deleted file mode 100644 index a6622c810c..0000000000 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: BitLocker overview and requirements FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker. -ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.reviewer: -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 02/28/2019 ---- - -# BitLocker Overview and Requirements FAQ - -**Applies to** -- Windows 10 - -## How does BitLocker work? - -**How BitLocker works with operating system drives** - -You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. - -**How BitLocker works with fixed and removable data drives** - -You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. - -## Does BitLocker support multifactor authentication? - -Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. - -## What are the BitLocker hardware and software requirements? - -For requirements, see [System requirements](bitlocker-overview.md#system-requirements). - -> [!NOTE] -> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker. - -## Why are two partitions required? Why does the system drive have to be so large? - -Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. - -## Which Trusted Platform Modules (TPMs) does BitLocker support? - -BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device. - -> [!NOTE] -> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. - -> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. - -## How can I tell if a TPM is on my computer? - -Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading. - -## Can I use BitLocker on an operating system drive without a TPM? - -Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. -To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. - -## How do I obtain BIOS support for the TPM on my computer? - -Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: - -- It is compliant with the TCG standards for a client computer. -- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. - -## What credentials are required to use BitLocker? - -To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. - -## What is the recommended boot order for computers that are going to be BitLocker-protected? - -You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml new file mode 100644 index 0000000000..63b1488107 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml @@ -0,0 +1,82 @@ +### YamlMime:FAQ +metadata: + title: BitLocker overview and requirements FAQ (Windows 10) + description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker. + ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee + ms.reviewer: + ms.prod: w10 + ms.mktglfcycl: explore + ms.sitesec: library + ms.pagetype: security + ms.localizationpriority: medium + author: dansimp + ms.author: dansimp + manager: dansimp + audience: ITPro + ms.collection: M365-security-compliance + ms.topic: conceptual + ms.date: 02/28/2019 + ms.custom: bitlocker + +title: BitLocker Overview and Requirements FAQ +summary: | + **Applies to** + - Windows 10 + + +sections: + - name: Ignored + questions: + - question: How does BitLocker work? + answer: | + **How BitLocker works with operating system drives** + + You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. + + **How BitLocker works with fixed and removable data drives** + + You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. + + - question: Does BitLocker support multifactor authentication? + answer: Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. + + - question: What are the BitLocker hardware and software requirements? + answer: | + For requirements, see [System requirements](bitlocker-overview.md#system-requirements). + + > [!NOTE] + > Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker. + + - question: Why are two partitions required? Why does the system drive have to be so large? + answer: Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. + + - question: Which Trusted Platform Modules (TPMs) does BitLocker support? + answer: | + BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device. + + > [!NOTE] + > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. + > + > Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. + + - question: How can I tell if a TPM is on my computer? + answer: Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading. + + - question: Can I use BitLocker on an operating system drive without a TPM? + answer: | + Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. + To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. + + - question: How do I obtain BIOS support for the TPM on my computer? + answer: | + Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: + + - It is compliant with the TCG standards for a client computer. + - It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. + + - question: What credentials are required to use BitLocker? + answer: To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. + + - question: What is the recommended boot order for computers that are going to be BitLocker-protected? + answer: You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  + diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index d15b81c76a..91df6ad467 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -3,18 +3,19 @@ title: BitLocker (Windows 10) description: This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. ms.assetid: 40526fcc-3e0d-4d75-90e0-c7d0615f33b2 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 01/26/2018 +ms.custom: bitlocker --- # BitLocker @@ -60,6 +61,9 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. +> [!IMPORTANT] +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://social.technet.microsoft.com/Forums/en-US/eac2cc67-8442-42db-abad-2ed173879751/bitlocker-without-tpm?forum=win10itprosetup). + > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. @@ -70,6 +74,8 @@ The hard disk must be partitioned with at least two drives: - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. - The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space. +A partition subject to encryption cannot be marked as an active partition (this applies to the operating system, fixed data, and removable data drives). + When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker. When installing the BitLocker optional component on a server you will also need to install the Enhanced Storage feature, which is used to support hardware encrypted drives. @@ -90,7 +96,6 @@ When installing the BitLocker optional component on a server you will also need | [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) | This topic for IT professionals describes the BCD settings that are used by BitLocker.| | [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)| This topic for IT professionals describes how to recover BitLocker keys from AD DS. | | [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)| This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. | +| [Troubleshoot BitLocker](troubleshoot-bitlocker.md) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. | | [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.| | [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/docs/securebootandbitlocker) | This topic covers how to use BitLocker with Windows 10 IoT Core | - - diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index bde16da8e3..eaccfb9c9f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -1,28 +1,30 @@ --- title: BitLocker recovery guide (Windows 10) -description: This topic for IT professionals describes how to recover BitLocker keys from AD DS. +description: This article for IT professionals describes how to recover BitLocker keys from AD DS. ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14 -ms.reviewer: +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker recovery guide -**Applies to** -- Windows 10 +**Applies to:** -This topic for IT professionals describes how to recover BitLocker keys from AD DS. +- Windows 10 + +This article for IT professionals describes how to recover BitLocker keys from AD DS. Organizations can use BitLocker recovery information saved in Active Directory Domain Services (AD DS) to access BitLocker-protected data. Creating a recovery model for BitLocker while you are planning your BitLocker deployment is recommended. @@ -30,142 +32,158 @@ This article assumes that you understand how to set up AD DS to back up BitLock This article does not detail how to configure AD DS to store the BitLocker recovery information. + ## What is BitLocker recovery? BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario, you have the following options to restore access to the drive: -- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain). -- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it. -- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). +- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain). +- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it. +- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + ### What causes BitLocker recovery? The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive: -- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](https://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](https://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout. -- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised. -- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD. -- Failing to boot from a network drive before booting from the hard drive. -- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. This means that if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked. -- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition. -- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed. -- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM. -- Turning off, disabling, deactivating, or clearing the TPM. -- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change. -- Forgetting the PIN when PIN authentication has been enabled. -- Updating option ROM firmware. -- Upgrading TPM firmware. -- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards. -- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. -- Changes to the master boot record on the disk. -- Changes to the boot manager on the disk. -- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software. -- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This can prevent the entry of enhanced PINs. -- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change. +- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality, administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor. Or they can use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) (also configurable through [Microsoft Intune](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/microsoft-intune)), to limit the number of failed password attempts before the device goes into Device Lockout. +- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised. +- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD. +- Failing to boot from a network drive before booting from the hard drive. +- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. So if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked. +- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition. +- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed. +- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM. +- Turning off, disabling, deactivating, or clearing the TPM. +- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change. +- Forgetting the PIN when PIN authentication has been enabled. +- Updating option ROM firmware. +- Upgrading TPM firmware. +- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards. +- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. +- Changes to the master boot record on the disk. +- Changes to the boot manager on the disk. +- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software. +- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This problem can prevent the entry of enhanced PINs. +- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change. - >**Note:**  Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different. - -- Moving the BitLocker-protected drive into a new computer. -- Upgrading the motherboard to a new one with a new TPM. -- Losing the USB flash drive containing the startup key when startup key authentication has been enabled. -- Failing the TPM self-test. -- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode. -- Changing the usage authorization for the storage root key of the TPM to a non-zero value. + > [!NOTE] + > Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different. - >**Note:**  The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value. - -- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr). -- Pressing the F8 or F10 key during the boot process. -- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards. -- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive. +- Moving the BitLocker-protected drive into a new computer. +- Upgrading the motherboard to a new one with a new TPM. +- Losing the USB flash drive containing the startup key when startup key authentication has been enabled. +- Failing the TPM self-test. +- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode. +- Changing the usage authorization for the storage root key of the TPM to a non-zero value. + + > [!NOTE] + > The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value. + +- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr). +- Pressing the F8 or F10 key during the boot process. +- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards. +- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive. + +> [!NOTE] +> Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components. ->**Note:**  Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components. - For planned scenarios, such as a known hardware or firmware upgrades, you can avoid initiating recovery by temporarily suspending BitLocker protection. Because suspending BitLocker leaves the drive fully encrypted, the administrator can quickly resume BitLocker protection after the planned task has been completed. Using suspend and resume also reseals the encryption key without requiring the entry of the recovery key. ->**Note:**  If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. +> [!NOTE] +> If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. + +If software maintenance requires the computer to be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method. -If software maintenance requires the computer be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method. - Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user. + ## Testing recovery -Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The –forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation. +Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The -forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation. -**To force a recovery for the local computer** +**To force a recovery for the local computer:** -1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**. -2. At the command prompt, type the following command and then press ENTER: +1. Select the **Start** button, type *cmd* in the **Start Search** box, right-click **cmd.exe**, and then select **Run as administrator**. +2. At the command prompt, type the following command and then press **Enter**: `manage-bde -forcerecovery ` -**To force recovery for a remote computer** +**To force recovery for a remote computer:** + +1. On the Start screen, type **cmd.exe**, and then select **Run as administrator**. +2. At the command prompt, type the following command and then press ENTER: + `manage-bde -ComputerName -forcerecovery ` + + > [!NOTE] + > Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx). -1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**. -2. At the command prompt, type the following command and then press ENTER: - `manage-bde. -ComputerName -forcerecovery ` -> **Note:**  Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx). - ## Planning your recovery process When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model. -Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker -Administration and Monitoring](https://technet.microsoft.com/windows/hh826072.aspx). +Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/mbam-v25/). -After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. You must consider both self-recovery and recovery password retrieval methods for your organization. +After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. Consider both self-recovery and recovery password retrieval methods for your organization. When you determine your recovery process, you should: -- Become familiar with how you can retrieve the recovery password. See: +- Become familiar with how you can retrieve the recovery password. See: - - [Self-recovery](#bkmk-selfrecovery) - - [Recovery password retrieval](#bkmk-recoveryretrieval) + - [Self-recovery](#bkmk-selfrecovery) + - [Recovery password retrieval](#bkmk-recoveryretrieval) -- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See: +- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See: + + - [Post-recovery analysis](#bkmk-planningpostrecovery) - - [Post-recovery analysis](#bkmk-planningpostrecovery) ### Self-recovery -In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag it would be very easy for access to be gained to the PC by an unauthorized user. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified. +In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag, then it's easy for an unauthorized user to access the PC. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified. + ### Recovery password retrieval -If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain the recovery password can be backed up to AD DS. However, this does not happen by default, you must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. +If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain, the recovery password can be backed up to AD DS. However, this does not happen by default. You must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. + +- **Choose how BitLocker-protected operating system drives can be recovered** +- **Choose how BitLocker-protected fixed drives can be recovered** +- **Choose how BitLocker-protected removable drives can be recovered** -- **Choose how BitLocker-protected operating system drives can be recovered** -- **Choose how BitLocker-protected fixed drives can be recovered** -- **Choose how BitLocker-protected removable drives can be recovered** In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds. ->**Note:**  If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required. - +> [!NOTE] +> If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required. + The BitLocker Recovery Password Viewer for Active Directory Users and Computers tool allows domain administrators to view BitLocker recovery passwords for specific computer objects in Active Directory. You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool. -- [Record the name of the user's computer](#bkmk-recordcomputername) -- [Verify the user's identity](#bkmk-verifyidentity) -- [Locate the recovery password in AD DS](#bkmk-locatepassword) -- [Gather information to determine why recovery occurred](#bkmk-gatherinfo) -- [Give the user the recovery password](#bkmk-givepassword) +- [Record the name of the user's computer](#bkmk-recordcomputername) +- [Verify the user's identity](#bkmk-verifyidentity) +- [Locate the recovery password in AD DS](#bkmk-locatepassword) +- [Gather information to determine why recovery occurred](#bkmk-gatherinfo) +- [Give the user the recovery password](#bkmk-givepassword) + ### Record the name of the user's computer You can use the name of the user's computer to locate the recovery password in AD DS. If the user does not know the name of the computer, ask the user to read the first word of the **Drive Label** in the **BitLocker Drive Encryption Password Entry** user interface. This is the computer name when BitLocker was enabled and is probably the current name of the computer. + ### Verify the user's identity -You should verify that the person that is asking for the recovery password is truly the authorized user of that computer. You may also wish to verify that the computer with the name the user provided belongs to the user. +Verify that the person that is asking for the recovery password is truly the authorized user of that computer. You might also want to verify that the computer with the name the user provided belongs to the user. + ### Locate the recovery password in AD DS Locate the Computer object with the matching name in AD DS. Because Computer object names are listed in the AD DS global catalog, you should be able to locate the object even if you have a multi-domain forest. + ### Multiple recovery passwords If multiple recovery passwords are stored under a computer object in AD DS, the name of the BitLocker recovery information object includes the date that the password was created. @@ -174,25 +192,30 @@ If at any time you are unsure what password to provide, or if you think you migh Since the password ID is a unique value that is associated with each recovery password stored in AD DS, running a query using this ID will find the correct password to unlock the encrypted volume. + ### Gather information to determine why recovery occurred Before you give the user the recovery password, you should gather any information that will help determine why the recovery was needed, in order to analyze the root cause during the post-recovery analysis. For more info about post-recovery analysis, see [Post-recovery analysis](#bkmk-planningpostrecovery). + ### Give the user the recovery password -Because the recovery password is 48 digits long the user may need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password. +Because the recovery password is 48 digits long, the user might need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password. + +> [!NOTE] +> Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors. + ->**Note:**  Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors. - ### Post-recovery analysis When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted. -If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator can perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See: +If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See: + +- [Determine the root cause of the recovery](#bkmk-determinecause) +- [Refresh BitLocker protection](#bkmk-refreshprotection) -- [Determine the root cause of the recovery](#bkmk-determinecause) -- [Refresh BitLocker protection](#bkmk-refreshprotection) ### Determine the root cause of the recovery @@ -202,14 +225,15 @@ While an administrator can remotely investigate the cause of recovery in some ca Review and answer the following questions for your organization: -1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC? -2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be? -3. If TPM mode was in effect, was recovery caused by a boot file change? -4. If recovery was caused by a boot file change, is this due to an intended user action (for example, BIOS upgrade), or to malicious software? -5. When was the user last able to start the computer successfully, and what might have happened to the computer since then? -6. Might the user have encountered malicious software or left the computer unattended since the last successful startup? +1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC? +2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be? +3. If TPM mode was in effect, was recovery caused by a boot file change? +4. If recovery was caused by a boot file change, was the change an intended user action (for example, BIOS upgrade), or was it caused by malicious software? +5. When was the user last able to start the computer successfully, and what might have happened to the computer since then? +6. Might the user have encountered malicious software or left the computer unattended since the last successful startup? + +To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if the boot file changed). Both of these capabilities can be performed remotely. -To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if boot file change occurred). Both of these capabilities can be performed remotely. ### Resolve the root cause @@ -217,23 +241,27 @@ After you have identified what caused recovery, you can reset BitLocker protecti The details of this reset can vary according to the root cause of the recovery. If you cannot determine the root cause, or if malicious software or a rootkit might have infected the computer, Helpdesk should apply best-practice virus policies to react appropriately. ->**Note:**  You can perform a BitLocker validation profile reset by suspending and resuming BitLocker. - +> [!NOTE] +> You can perform a BitLocker validation profile reset by suspending and resuming BitLocker. + - [Unknown PIN](#bkmk-unknownpin) - [Lost startup key](#bkmk-loststartup) - [Changes to boot files](#bkmk-changebootknown) - ### Unknown PIN + + +### Unknown PIN If a user has forgotten the PIN, you must reset the PIN while you are logged on to the computer in order to prevent BitLocker from initiating recovery each time the computer is restarted. **To prevent continued recovery due to an unknown PIN** -1. Unlock the computer using the recovery password. -2. Reset the PIN: - 1. Right-click the drive and then click **Change PIN** - 2. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time. - 3. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**. -3. You will use the new PIN the next time you unlock the drive. +1. Unlock the computer using the recovery password. +2. Reset the PIN: + 1. Right-click the drive and then select **Change PIN**. + 2. In the BitLocker Drive Encryption dialog, select **Reset a forgotten PIN**. If you are not logged in with an administrator account, provide administrative credentials at this time. + 3. In the PIN reset dialog, provide and confirm the new PIN to use and then select **Finish**. +3. You will use the new PIN the next time you unlock the drive. + ### Lost startup key @@ -241,78 +269,236 @@ If you have lost the USB flash drive that contains the startup key, then you mus **To prevent continued recovery due to a lost startup key** -1. Log on as an administrator to the computer that has the lost startup key. -2. Open Manage BitLocker. -3. Click **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then click **Save**. +1. Log on as an administrator to the computer that has the lost startup key. +2. Open Manage BitLocker. +3. Select **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then select **Save**. + ### Changes to boot files -This error might occur if you updated the firmware. As a best practice you should suspend BitLocker before making changes the firmware and then resume protection after the update has completed. This prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on you can simply log on to the computer using the recovery password and the platform validation profile will be updated so that recovery will not occur the next time. +This error might occur if you updated the firmware. As a best practice, you should suspend BitLocker before making changes to the firmware and then resume protection after the update has completed. This action prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on, then log on to the computer using the recovery password, and the platform validation profile will be updated so that recovery will not occur the next time. + ## Windows RE and BitLocker Device Encryption -Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair is not able to be run automatically from the PC and instead Windows RE is manually started from a repair disk, the BitLocker recovery key must be provided to unlock the BitLocker–protected drives. +Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair can't run automatically from the PC and instead Windows RE is manually started from a repair disk, then the BitLocker recovery key must be provided to unlock the BitLocker–protected drives. + + +## BitLocker recovery screen + +During BitLocker recovery, Windows can display a custom recovery message and hints that identify where a key can be retrieved from. These improvements can help a user during BitLocker recovery. + + +### Custom recovery message + +BitLocker Group Policy settings in Windows 10, version 1511, let you configure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support. + +This policy can be configured using GPO under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Configure pre-boot recovery message and URL**. + +It can also be configured using Intune mobile device management (MDM) in the BitLocker CSP: +*\./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage\* + +![Custom URL](./images/bl-intune-custom-url.png) + +Example of customized recovery screen: + +![Customized BitLocker Recovery Screen](./images/bl-password-hint1.png) + + +### BitLocker recovery key hints + +BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen. + +![Customized BitLocker recovery screen](./images/bl-password-hint2.png) + +> [!IMPORTANT] +> We don't recommend printing recovery keys or saving them to a file. Instead, use Active Directory backup or a cloud-based backup. Cloud-based backup includes Azure Active Directory (Azure AD) and Microsoft Account. + +There are rules governing which hint is shown during the recovery (in order of processing): + +1. Always display custom recovery message if it has been configured (using GPO or MDM). +2. Always display generic hint: "For more information, go to ". +3. If multiple recovery keys exist on the volume, prioritize the last created (and successfully backed up) recovery key. +4. Prioritize keys with successful backup over keys that have never been backed up. +5. Prioritize backup hints in the following order for remote backup locations: **Microsoft Account > Azure AD > Active Directory**. +6. If a key has been printed and saved to file, display a combined hint, "Look for a printout or a text file with the key," instead of two separate hints. +7. If multiple backups of the same type (remove vs. local) have been performed for the same recovery key, prioritize backup info with latest backed up date. +8. There is no specific hint for keys saved to an on-premises Active Directory. In this case, a custom message (if configured) or a generic message, "Contact your organization's help desk," will be displayed. +9. If two recovery keys are present on the disk, but only one has been successfully backed up, the system will ask for a key that has been backed up, even if another key is newer. + + +#### Example 1 (single recovery key with single backup) + +| Custom URL | Yes | +|----------------------|------------| +| Saved to Microsoft Account | Yes | +| Saved to Azure AD | No | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | + +**Result:** The hint for the Microsoft Account and the custom URL are displayed. + +![Example 1 of Customized BitLocker recovery screen](./images/rp-example1.png) + + +#### Example 2 (single recovery key with single backup) + +| Custom URL | Yes | +|----------------------|------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | No | +| Saved to Active Directory | Yes | +| Printed | No | +| Saved to file | No | + +**Result:** Only the custom URL is displayed. + +![Example 2 of customized BitLocker recovery screen](./images/rp-example2.png) + + +#### Example 3 (single recovery key with multiple backups) + +| Custom URL | No | +|----------------------|------------| +| Saved to Microsoft Account | Yes | +| Saved to Azure AD | Yes | +| Saved to Active Directory | No | +| Printed | Yes | +| Saved to file | Yes | + +**Result:** Only the Microsoft Account hint is displayed. + +![Example 3 of customized BitLocker recovery screen](./images/rp-example3.png) + + +#### Example 4 (multiple recovery passwords) + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | No | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | Yes | +| Creation time | **1PM** | +| Key ID | A564F193 | + +  +  + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | No | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | +| Creation time | **3PM** | +| Key ID | T4521ER5 | + +**Result:** Only the hint for a successfully backed up key is displayed, even if it isn't the most recent key. + +![Example 4 of customized BitLocker recovery screen](./images/rp-example4.png) + + +#### Example 5 (multiple recovery passwords) + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | Yes | +| Saved to Azure AD | Yes | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | +| Creation time | **1PM** | +| Key ID | 99631A34 | + +  +  + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | Yes | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | +| Creation time | **3PM** | +| Key ID | 9DF70931 | + +**Result:** The hint for the most recent key is displayed. + +![Example 5 of customized BitLocker recovery screen](./images/rp-example5.png) + ## Using additional recovery information Besides the 48-digit BitLocker recovery password, other types of recovery information are stored in Active Directory. This section describes how this additional information can be used. + ### BitLocker key package If the recovery methods discussed earlier in this document do not unlock the volume, you can use the BitLocker Repair tool to decrypt the volume at the block level. The tool uses the BitLocker key package to help recover encrypted data from severely damaged drives. You can then use this recovered data to salvage encrypted data, even after the correct recovery password has failed to unlock the damaged volume. We recommend that you still save the recovery password. A key package cannot be used without the corresponding recovery password. ->**Note:**  You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package. - -The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc). +> [!NOTE] +> You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package. + +The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS, you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details about how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc). + ## Resetting recovery passwords -You should invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason. +Invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason. You can reset the recovery password in two ways: -- **Use manage-bde** You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method. -- **Run a script** You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords. +- **Use manage-bde**: You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method. +- **Run a script**: You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords. -**To reset a recovery password using manage-bde** +**To reset a recovery password using manage-bde:** -1. Remove the previous recovery password +1. Remove the previous recovery password ```powershell Manage-bde –protectors –delete C: –type RecoveryPassword ``` -2. Add the new recovery password +2. Add the new recovery password ```powershell Manage-bde –protectors –add C: -RecoveryPassword ``` -3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password. +3. Get the ID of the new recovery password. From the screen, copy the ID of the recovery password. ```powershell Manage-bde –protectors –get C: -Type RecoveryPassword ``` -4. Backup the new recovery password to AD DS +4. Back up the new recovery password to AD DS. ```powershell Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692} ``` - >**Warning:**  You must include the braces in the ID string. - -**To run the sample recovery password script** -1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs. -2. At the command prompt, type a command similar to the following: + > [!WARNING] + > You must include the braces in the ID string. + +**To run the sample recovery password script:** + +1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs. +2. At the command prompt, type a command similar to the following sample script: **cscript ResetPassword.vbs** -> **Important:** This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. -> -> **Note:**  To manage a remote computer, you can specify the remote computer name rather than the local computer name. - -You can use the following sample script to create a VBScript file to reset the recovery passwords. + > [!IMPORTANT] + > This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. + +> [!NOTE] +> To manage a remote computer, you can specify the remote computer name rather than the local computer name. + +You can use the following sample script to create a VBScript file to reset the recovery passwords: ```vb ' Target drive letter @@ -385,23 +571,24 @@ WScript.Echo "A new recovery password has been added. Old passwords have been re 'WScript.Echo "Type ""manage-bde -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords." ``` + ## Retrieving the BitLocker key package You can use two methods to retrieve the key package, as described in [Using Additional Recovery Information](#bkmk-usingaddrecovery): -- **Export a previously-saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS. -- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred. +- **Export a previously saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS. +- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred. -The following sample script exports all previously-saved key packages from AD DS. +The following sample script exports all previously saved key packages from AD DS. -**To run the sample key package retrieval script** +**To run the sample key package retrieval script:** 1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs. -2. At the command prompt, type a command similar to the following: +2. At the command prompt, type a command similar to the following sample script: **cscript GetBitLockerKeyPackageADDS.vbs -?** -You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS. +You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS: ```vb ' -------------------------------------------------------------------------------- @@ -543,10 +730,10 @@ WScript.Quit The following sample script exports a new key package from an unlocked, encrypted volume. -**To run the sample key package retrieval script** +**To run the sample key package retrieval script:** 1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackage.vbs -2. Open an administrator command prompt, type a command similar to the following: +2. Open an administrator command prompt, and then type a command similar to the following sample script: **cscript GetBitLockerKeyPackage.vbs -?** @@ -728,8 +915,7 @@ Function BinaryToString(Binary) End Function ``` + ## See also -- [BitLocker overview](bitlocker-overview.md) - - +- [BitLocker overview](bitlocker-overview.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md new file mode 100644 index 0000000000..9ed6f0f984 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md @@ -0,0 +1,41 @@ +--- +title: Breaking out of a Bitlocker recovery loop +description: This topic for IT professionals describes how to break out of a Bitlocker recovery loop. +ms.assetid: #c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +ms.author: v-maave +author: martyav +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 10/28/2019 +ms.custom: bitlocker +--- + +# Breaking out of a Bitlocker recovery loop + +Sometimes, following a crash, you might be unable to successfully boot into your operating system, due to the recovery screen repeatedly prompting you to enter your recovery key. This can be very frustrating. + +If you've entered the correct Bitlocker recovery key multiple times, and are still unable to continue past the initial recovery screen, follow these steps to break out of the loop. + +> [!NOTE] +> Only try these steps after you have restarted your device at least once. + +1. On the initial recovery screen, don't enter your recovery key. Instead, select **Skip this drive**. + +1. On the next screen, select **Troubleshoot**. + +1. On the Troubleshoot screen, select **Advanced options**. + +1. On the Advanced options screen, select **Command prompt**. + +1. From the WinRE command prompt, manually unlock your drive: `manage-bde.exe -unlock C: -rp ` + +1. Suspend operating system drive protection: `manage-bde.exe -protectors -disable C:` + +1. Once the last command is run, you can safely exit the command prompt and continue to boot into your operating system diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index a12e4c3b02..fb1c2281f8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -1,6 +1,6 @@ --- title: BitLocker Security FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn more about how BitLocker security works. Browse frequently asked questions, such as, "What form of encryption does BitLocker use?" ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: ms.prod: w10 @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker Security FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md index 347a0003b8..871f49b5a8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -1,20 +1,21 @@ --- title: BitLocker To Go FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: "Learn more about BitLocker To Go: BitLocker drive encryption for removable drives." ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 07/10/2018 +ms.custom: bitlocker --- # BitLocker To Go FAQ @@ -24,7 +25,14 @@ ms.date: 07/10/2018 ## What is BitLocker To Go? -BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. +BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of: -As with BitLocker, drives that are encrypted using BitLocker To Go can be opened with a password or smart card on another computer by using **BitLocker Drive Encryption** in Control Panel. +- USB flash drives +- SD cards +- External hard disk drives +- Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. + +Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](https://docs.microsoft.com/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements). + +As with BitLocker, you can open drives that are encrypted by BitLocker To Go by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**. diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md index de4112e3d5..a856063b96 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md @@ -1,19 +1,20 @@ --- title: BitLocker Upgrading FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn more about upgrading systems that have BitLocker enabled. Find frequently asked questions, such as, "Can I upgrade to Windows 10 with BitLocker enabled?" ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # BitLocker Upgrading FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index 20ab73acfb..793722ef06 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -1,6 +1,6 @@ --- title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) -description: This topic for the IT professional describes how to use tools to manage BitLocker. +description: This article for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 ms.reviewer: ms.prod: w10 @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker @@ -22,9 +23,9 @@ ms.date: 02/28/2019 **Applies to** - Windows 10 -This topic for the IT professional describes how to use tools to manage BitLocker. +This article for the IT professional describes how to use tools to manage BitLocker. -BitLocker Drive Encryption Tools include the command line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell. +BitLocker Drive Encryption Tools include the command-line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell. Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel and are appropriate to use for automated deployments and other scripting scenarios. @@ -38,11 +39,11 @@ Repair-bde is a special circumstance tool that is provided for disaster recovery Manage-bde is a command-line tool that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the manage-bde options, see the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line reference. -Manage-bde includes less default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde. +Manage-bde includes fewer default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde. ### Using manage-bde with operating system volumes -Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. It is recommended that at least one primary protector and a recovery protector be added to an operating system volume. +Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. We recommend that you add at least one primary protector and a recovery protector to an operating system volume. A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: @@ -53,7 +54,7 @@ This command returns the volumes on the target, current encryption status, encry ![Using manage-bde to check encryption status](images/manage-bde-status.png) -The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. +The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process, you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. ```powershell manage-bde –protectors -add C: -startupkey E: @@ -62,30 +63,30 @@ manage-bde -on C: >**Note:**  After the encryption is completed, the USB startup key must be inserted before the operating system can be started. -An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command: +An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. To add them, use this command: ```powershell manage-bde -protectors -add C: -pw -sid ``` -This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn BitLocker on. +This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn on BitLocker. -On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: +On computers with a TPM, it is possible to encrypt the operating system volume without any defined protectors using manage-bde. Use this command: ```powershell manage-bde -on C: ``` -This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: +This command encrypts the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: ```powershell manage-bde -protectors -get ``` ### Using manage-bde with data volumes -Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or you can choose to add additional protectors to the volume first. It is recommended that at least one primary protector and a recovery protector be added to a data volume. +Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or you can choose to add additional protectors to the volume first. We recommend that you add at least one primary protector and a recovery protector to a data volume. -A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. +A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn on BitLocker. ```powershell manage-bde -protectors -add -pw C: @@ -100,11 +101,11 @@ The BitLocker Repair Tool (Repair-bde) can be used to access encrypted data on a >**Tip:**  If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume. -The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. You should use Repair-bde if the following conditions are true: +The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. Use Repair-bde if the following conditions are true: -1. You have encrypted the drive by using BitLocker Drive Encryption. -2. Windows does not start, or you cannot start the BitLocker recovery console. -3. You do not have a copy of the data that is contained on the encrypted drive. +- You have encrypted the drive by using BitLocker Drive Encryption. +- Windows does not start, or you cannot start the BitLocker recovery console. +- You do not have a copy of the data that is contained on the encrypted drive. >**Note:**  Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers. @@ -126,11 +127,11 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work -

                  Name

                  -

                  Parameters

                  +

                  Name

                  +

                  Parameters

                  -

                  Add-BitLockerKeyProtector

                  +

                  Add-BitLockerKeyProtector

                  -ADAccountOrGroup

                  -ADAccountOrGroupProtector

                  -Confirm

                  @@ -152,26 +153,26 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work

                  -WhatIf

                  -

                  Backup-BitLockerKeyProtector

                  +

                  Backup-BitLockerKeyProtector

                  -Confirm

                  -KeyProtectorId

                  -MountPoint

                  -WhatIf

                  -

                  Disable-BitLocker

                  +

                  Disable-BitLocker

                  -Confirm

                  -MountPoint

                  -WhatIf

                  -

                  Disable-BitLockerAutoUnlock

                  +

                  Disable-BitLockerAutoUnlock

                  -Confirm

                  -MountPoint

                  -WhatIf

                  -

                  Enable-BitLocker

                  +

                  Enable-BitLocker

                  -AdAccountOrGroup

                  -AdAccountOrGroupProtector

                  -Confirm

                  @@ -196,44 +197,44 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work

                  -WhatIf

                  -

                  Enable-BitLockerAutoUnlock

                  +

                  Enable-BitLockerAutoUnlock

                  -Confirm

                  -MountPoint

                  -WhatIf

                  -

                  Get-BitLockerVolume

                  +

                  Get-BitLockerVolume

                  -MountPoint

                  -

                  Lock-BitLocker

                  +

                  Lock-BitLocker

                  -Confirm

                  -ForceDismount

                  -MountPoint

                  -WhatIf

                  -

                  Remove-BitLockerKeyProtector

                  +

                  Remove-BitLockerKeyProtector

                  -Confirm

                  -KeyProtectorId

                  -MountPoint

                  -WhatIf

                  -

                  Resume-BitLocker

                  +

                  Resume-BitLocker

                  -Confirm

                  -MountPoint

                  -WhatIf

                  -

                  Suspend-BitLocker

                  +

                  Suspend-BitLocker

                  -Confirm

                  -MountPoint

                  -RebootCount

                  -WhatIf

                  -

                  Unlock-BitLocker

                  +

                  Unlock-BitLocker

                  -AdAccountOrGroup

                  -Confirm

                  -MountPoint

                  @@ -248,7 +249,7 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the Get-BitLockerVolume cmdlet. -The Get-BitLockerVolume cmdlet output gives information on the volume type, protectors, protection status and other details. +The Get-BitLockerVolume cmdlet output gives information on the volume type, protectors, protection status, and other details. >**Tip:**  Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. `Get-BitLockerVolume C: | fl` @@ -262,9 +263,9 @@ $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` -Using this, you can display the information in the $keyprotectors variable to determine the GUID for each protector. +By using this script, you can display the information in the $keyprotectors variable to determine the GUID for each protector. -Using this information, you can then remove the key protector for a specific volume using the command: +By using this information, you can then remove the key protector for a specific volume using the command: ```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" @@ -290,8 +291,8 @@ Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTes ### Using the BitLocker Windows PowerShell cmdlets with data volumes -Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a -SecureString value to store the user defined password. +Data volume encryption using Windows PowerShell is the same as for operating system volumes. Add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a +SecureString value to store the user-defined password. ```powershell $pw = Read-Host -AsSecureString @@ -300,11 +301,11 @@ Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` ### Using an AD Account or Group protector in Windows PowerShell -The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover to and be unlocked by any member computer of the cluster. +The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly fail over to and be unlocked by any member computer of the cluster. >**Warning:**  The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes -To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. +To add an **ADAccountOrGroup** protector to a volume, use either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. ```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md index 0e544985b8..1bc4358ba0 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: Use BitLocker Recovery Password Viewer diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md index 8c25c57e76..e71fba3cbd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md @@ -1,6 +1,6 @@ --- title: Using BitLocker with other programs FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn how to integrate BitLocker with other software on your device. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: ms.prod: w10 @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # Using BitLocker with other programs FAQ @@ -36,7 +37,7 @@ BitLocker has a storage driver stack that ensures memory dumps are encrypted whe ## Can BitLocker support smart cards for pre-boot authentication? -BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them very difficult. +BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them difficult. ## Can I use a non-Microsoft TPM driver? @@ -68,7 +69,7 @@ The **Save to USB** option is not shown by default for removable drives. If the ## Why am I unable to automatically unlock my drive? -Automatic unlocking for fixed data drives requires that the operating system drive also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. +Automatic unlocking for fixed data drives requires the operating system drive to also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. ## Can I use BitLocker in Safe Mode? @@ -94,8 +95,8 @@ Yes. However, shadow copies made prior to enabling BitLocker will be automatical ## Does BitLocker support virtual hard disks (VHDs)? BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run. -- With TPM - Yes it is supported -- Without TPM - Yes it is supported (with password protector) +- With TPM: Yes, it is supported. +- Without TPM: Yes, it is supported (with password protector). BitLocker is also supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012. diff --git a/windows/security/information-protection/bitlocker/images/4509186-en-1.png b/windows/security/information-protection/bitlocker/images/4509186-en-1.png new file mode 100644 index 0000000000..11f986fb68 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509186-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509188-en-1.png b/windows/security/information-protection/bitlocker/images/4509188-en-1.png new file mode 100644 index 0000000000..5b5b7b1b4a Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509188-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509189-en-1.png b/windows/security/information-protection/bitlocker/images/4509189-en-1.png new file mode 100644 index 0000000000..8d243a1899 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509189-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509190-en-1.png b/windows/security/information-protection/bitlocker/images/4509190-en-1.png new file mode 100644 index 0000000000..bd37969b5d Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509190-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509191-en-1.png b/windows/security/information-protection/bitlocker/images/4509191-en-1.png new file mode 100644 index 0000000000..00ef607ab3 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509191-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509193-en-1.png b/windows/security/information-protection/bitlocker/images/4509193-en-1.png new file mode 100644 index 0000000000..2085613b3d Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509193-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509194-en-1.png b/windows/security/information-protection/bitlocker/images/4509194-en-1.png new file mode 100644 index 0000000000..f4506c399b Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509194-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509195-en-1.png b/windows/security/information-protection/bitlocker/images/4509195-en-1.png new file mode 100644 index 0000000000..cbecb03c4e Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509195-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509196-en-1.png b/windows/security/information-protection/bitlocker/images/4509196-en-1.png new file mode 100644 index 0000000000..01e94b1243 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509196-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509198-en-1.png b/windows/security/information-protection/bitlocker/images/4509198-en-1.png new file mode 100644 index 0000000000..9056658662 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509198-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509199-en-1.png b/windows/security/information-protection/bitlocker/images/4509199-en-1.png new file mode 100644 index 0000000000..d68a22eef7 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509199-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509200-en-1.png b/windows/security/information-protection/bitlocker/images/4509200-en-1.png new file mode 100644 index 0000000000..689bb19299 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509200-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509201-en-1.png b/windows/security/information-protection/bitlocker/images/4509201-en-1.png new file mode 100644 index 0000000000..d521e86eed Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509201-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509202-en-1.png b/windows/security/information-protection/bitlocker/images/4509202-en-1.png new file mode 100644 index 0000000000..bfcd2326b6 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509202-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509203-en-1.png b/windows/security/information-protection/bitlocker/images/4509203-en-1.png new file mode 100644 index 0000000000..05acc571fe Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509203-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509204-en-1.png b/windows/security/information-protection/bitlocker/images/4509204-en-1.png new file mode 100644 index 0000000000..fa13f38ba9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509204-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509205-en-1.png b/windows/security/information-protection/bitlocker/images/4509205-en-1.png new file mode 100644 index 0000000000..a4f5cc15d2 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509205-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509206-en-1.png b/windows/security/information-protection/bitlocker/images/4509206-en-1.png new file mode 100644 index 0000000000..7b7e449443 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509206-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/bl-intune-custom-url.png b/windows/security/information-protection/bitlocker/images/bl-intune-custom-url.png new file mode 100644 index 0000000000..a563d3153f Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/bl-intune-custom-url.png differ diff --git a/windows/security/information-protection/bitlocker/images/bl-password-hint1.png b/windows/security/information-protection/bitlocker/images/bl-password-hint1.png new file mode 100644 index 0000000000..864e84c6e9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/bl-password-hint1.png differ diff --git a/windows/security/information-protection/bitlocker/images/bl-password-hint2.png b/windows/security/information-protection/bitlocker/images/bl-password-hint2.png new file mode 100644 index 0000000000..01a5f08c42 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/bl-password-hint2.png differ diff --git a/windows/security/information-protection/bitlocker/images/configmgr-imageconfig.jpg b/windows/security/information-protection/bitlocker/images/configmgr-imageconfig.jpg new file mode 100644 index 0000000000..40ddf183f6 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/configmgr-imageconfig.jpg differ diff --git a/windows/security/information-protection/bitlocker/images/pcptool-output.jpg b/windows/security/information-protection/bitlocker/images/pcptool-output.jpg new file mode 100644 index 0000000000..91d10e6c66 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/pcptool-output.jpg differ diff --git a/windows/security/information-protection/bitlocker/images/psget-winevent-1.png b/windows/security/information-protection/bitlocker/images/psget-winevent-1.png new file mode 100644 index 0000000000..21adc928de Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/psget-winevent-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/psget-winevent-2.png b/windows/security/information-protection/bitlocker/images/psget-winevent-2.png new file mode 100644 index 0000000000..2941452109 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/psget-winevent-2.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example1.png b/windows/security/information-protection/bitlocker/images/rp-example1.png new file mode 100644 index 0000000000..1c9b7bc560 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example1.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example2.png b/windows/security/information-protection/bitlocker/images/rp-example2.png new file mode 100644 index 0000000000..eee52f9c54 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example2.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example3.png b/windows/security/information-protection/bitlocker/images/rp-example3.png new file mode 100644 index 0000000000..ed1158c2a1 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example3.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example4.png b/windows/security/information-protection/bitlocker/images/rp-example4.png new file mode 100644 index 0000000000..8cd88812bc Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example4.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example5.png b/windows/security/information-protection/bitlocker/images/rp-example5.png new file mode 100644 index 0000000000..7a588bdd67 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example5.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-default-sddl.png b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-default-sddl.png new file mode 100644 index 0000000000..53b374d26e Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-default-sddl.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-sddl.png b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-sddl.png new file mode 100644 index 0000000000..bc299cc0e9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-sddl.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-1.png b/windows/security/information-protection/bitlocker/images/ts-tpm-1.png new file mode 100644 index 0000000000..1bef01d587 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-2.png b/windows/security/information-protection/bitlocker/images/ts-tpm-2.png new file mode 100644 index 0000000000..d4d825029c Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-2.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-3.png b/windows/security/information-protection/bitlocker/images/ts-tpm-3.png new file mode 100644 index 0000000000..2acac0f3ea Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-3.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-4.png b/windows/security/information-protection/bitlocker/images/ts-tpm-4.png new file mode 100644 index 0000000000..cb5b84d6b9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-4.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-5.png b/windows/security/information-protection/bitlocker/images/ts-tpm-5.png new file mode 100644 index 0000000000..3b3cd2b961 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-5.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-6.png b/windows/security/information-protection/bitlocker/images/ts-tpm-6.png new file mode 100644 index 0000000000..4e82b9b76e Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-6.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-7.png b/windows/security/information-protection/bitlocker/images/ts-tpm-7.png new file mode 100644 index 0000000000..8fb9446d93 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-7.png differ diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index 2f53662c16..baa25d7cf6 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -8,53 +8,44 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/24/2019 +ms.custom: bitlocker --- # Prepare your organization for BitLocker: Planning and policies **Applies to** -- Windows 10 + +- Windows 10 This topic for the IT professional explains how can you plan your BitLocker deployment. When you design your BitLocker deployment strategy, define the appropriate policies and configuration requirements based on the business requirements of your organization. The following topics will help you collect information that you can use to frame your decision-making process about deploying and managing BitLocker systems. -- [Audit your environment](#bkmk-audit) -- [Encryption keys and authentication](#bkk-encrypt) -- [TPM hardware configurations](#bkmk-tpmconfigurations) -- [Non-TPM hardware configurations](#bkmk-nontpm) -- [Disk configuration considerations](#bkmk-disk) -- [BitLocker provisioning](#bkmk-prov) -- [Used Disk Space Only encryption](#bkk-used) -- [Active Directory Domain Services considerations](#bkmk-addscons) -- [FIPS support for recovery password protector](#bkmk-fipssupport) -- [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) - -## Audit your environment +## Audit your environment To plan your enterprise deployment of BitLocker, you must first understand your current environment. Conduct an informal audit to define your current policies, procedures, and hardware environment. Begin by reviewing your existing corporate security policies as they relate to disk encryption software. If your organization is not currently using disk encryption software, none of these policies will exist. If you are using disk encryption software, then you might need to modify your organization's policies to address the capabilities of BitLocker. Use the following questions to help you document your organization's current disk encryption security policies: -1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker? -2. What policies exist to control recovery password and recovery key storage? -3. What are the policies for validating the identity of users that need to perform BitLocker recovery? -4. What policies exist to control who in the organization has access to recovery data? -5. What policies exist to control computer decommissioning or retirement? +1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker? +2. What policies exist to control recovery password and recovery key storage? +3. What are the policies for validating the identity of users that need to perform BitLocker recovery? +4. What policies exist to control who in the organization has access to recovery data? +5. What policies exist to control computer decommissioning or retirement? -## Encryption keys and authentication +## Encryption keys and authentication BitLocker helps prevent unauthorized access to data on lost or stolen computers by: -- Encrypting the entire Windows operating system volume on the hard disk. -- Verifying the boot process integrity. +- Encrypting the entire Windows operating system volume on the hard disk. +- Verifying the boot process integrity. The trusted platform module (TPM) is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline. @@ -72,7 +63,7 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi | Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.| | Recovery password | A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.| | Recovery key| An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.| - + ### BitLocker authentication methods | Authentication method | Requires user interaction | Description | @@ -82,7 +73,7 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi | TPM + Network key | No | The TPM successfully validates early boot components, and a valid encrypted network key has been provided from the WDS server. This authentication method provides automatic unlock of operating system volumes at system reboot while still maintaining multifactor authentication. | | TPM + startup key| Yes| The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.| | Startup key only | Yes| The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.| - + **Will you support computers without TPM version 1.2 or higher?** Determine whether you will support computers that do not have a TPM version 1.2 or higher in your environment. If you choose to support BitLocker on this type of computer, a user must use a USB startup key to boot the system. This requires additional support processes similar to multifactor authentication. @@ -101,7 +92,7 @@ If there are areas of your organization where data residing on user computers is The protection differences provided by multifactor authentication methods cannot be easily quantified. Consider each authentication method's impact on Helpdesk support, user education, user productivity, and automated systems management processes. -## TPM hardware configurations +## TPM hardware configurations In your deployment plan, identify what TPM-based hardware platforms will be supported. Document the hardware models from an OEM of your choice, so that their configurations can be tested and supported. TPM hardware requires special consideration during all aspects of planning and deployment. @@ -117,24 +108,24 @@ An endorsement key can be created at various points in the TPM’s lifecycle, bu For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications (). -## Non-TPM hardware configurations +## Non-TPM hardware configurations Devices that do not include a TPM can still be protected by drive encryption. Windows To Go workspaces can be BitLocker protected using a startup password and PCs without a TPM can use a startup key. Use the following questions to identify issues that might affect your deployment in a non-TPM configuration: -- Are password complexity rules in place? -- Do you have budget for USB flash drives for each of these computers? -- Do your existing non-TPM devices support USB devices at boot time? +- Are password complexity rules in place? +- Do you have budget for USB flash drives for each of these computers? +- Do your existing non-TPM devices support USB devices at boot time? Test your individual hardware platforms with the BitLocker system check option while you are enabling BitLocker. The system check will ensure that BitLocker can read the recovery information from a USB device and encryption keys correctly before it encrypts the volume. CD and DVD drives cannot act as a block storage device and cannot be used to store the BitLocker recovery material. -## Disk configuration considerations +## Disk configuration considerations To function correctly, BitLocker requires a specific disk configuration. BitLocker requires two partitions that meet the following requirements: -- The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system -- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size +- The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system +- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size Windows setup will automatically configure the disk drives of your computer to support BitLocker encryption. @@ -142,7 +133,7 @@ Windows Recovery Environment (Windows RE) is an extensible recovery platform tha Windows RE can also be used from boot media other than the local hard disk. If you choose not to install Windows RE on the local hard disk of BitLocker-enabled computers, you can use alternate boot methods, such as Windows Deployment Services, CD-ROM, or USB flash drive, for recovery. -## BitLocker provisioning +## BitLocker provisioning In Windows Vista and Windows 7, BitLocker was provisioned post installation for system and data volumes through either the manage-bde command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be easily provisioned before the operating system is installed. Preprovisioning requires that the computer have a TPM. @@ -152,7 +143,7 @@ When using the control panel options, administrators can choose to **Turn on Bit Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment (WinPE). This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option this step takes only a few seconds and so incorporates well into regular deployment processes. -## Used Disk Space Only encryption +## Used Disk Space Only encryption The BitLocker Setup wizard provides administrators the ability to choose the Used Disk Space Only or Full encryption method when enabling BitLocker for a volume. Administrators can use the new BitLocker Group Policy setting to enforce either Used Disk Space Only or Full disk encryption. @@ -162,7 +153,7 @@ Used Disk Space Only means that only the portion of the drive that contains data Full drive encryption means that the entire drive will be encrypted, regardless of whether data is stored on it or not. This is useful for drives that have been repurposed and may contain data remnants from their previous use. -## Active Directory Domain Services considerations +## Active Directory Domain Services considerations BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure the following Group Policy setting for each drive type to enable backup of BitLocker recovery information: @@ -172,29 +163,30 @@ By default, only Domain Admins have access to BitLocker recovery information, bu The following recovery data is saved for each computer object: -- **Recovery password** +- **Recovery password** A 48-digit recovery password used to recover a BitLocker-protected volume. Users enter this password to unlock a volume when BitLocker enters recovery mode. -- **Key package data** +- **Key package data** With this key package and the recovery password, you will be able decrypt portions of a BitLocker-protected volume if the disk is severely damaged. Each key package will only work with the volume it was created on, which can be identified by the corresponding volume ID. -## FIPS support for recovery password protector +## FIPS support for recovery password protector Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLocker to be fully functional in FIPS mode. ->**Note:**  The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.  - +> [!NOTE] +> The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm. + Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](https://support.microsoft.com/kb/947249). But on computers running these supported systems with BitLocker enabled: -- FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm. -- Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems. -- Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords. -- When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode. -- FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode. +- FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm. +- Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems. +- Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords. +- When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode. +- FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode. The BitLocker Group Policy settings for recovery passwords work the same for all Windows versions that support BitLocker, whether in FIPs mode or not. diff --git a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index 01c9fe213f..01a07590a5 100644 --- a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -1,6 +1,6 @@ --- title: Protecting cluster shared volumes and storage area networks with BitLocker (Windows 10) -description: This topic for IT pros describes how to protect CSVs and SANs with BitLocker. +description: This article for IT pros describes how to protect CSVs and SANs with BitLocker. ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092 ms.reviewer: ms.prod: w10 @@ -8,13 +8,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # Protecting cluster shared volumes and storage area networks with BitLocker @@ -22,7 +23,7 @@ ms.date: 02/28/2019 **Applies to** - Windows Server 2016 -This topic for IT pros describes how to protect CSVs and SANs with BitLocker. +This article for IT pros describes how to protect CSVs and SANs with BitLocker. BitLocker can protect both physical disk resources and cluster shared volumes version 2.0 (CSV2.0). BitLocker on clustered volumes allows for an additional layer of protection for administrators wishing to protect sensitive, highly available data. By adding additional protectors to the clustered volume, administrators can also add an additional barrier of security to resources within an organization by allowing only certain user accounts access to unlock the BitLocker volume. @@ -37,15 +38,15 @@ BitLocker on volumes within a cluster are managed based on how the cluster servi Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete. -Windows PowerShell or the manage-bde command line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. +Windows PowerShell or the manage-bde command-line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This method is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. >**Note:**  Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption. -For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space. +For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This action is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space. ### Active Directory-based protector -You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order: +You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account, or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order: 1. Clear key 2. Driver-based auto-unlock key @@ -60,7 +61,7 @@ You can also use an Active Directory Domain Services (AD DS) protector for prote ### Turning on BitLocker before adding disks to a cluster using Windows PowerShell -BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster, do the following: +BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster: 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Ensure the disk is formatted NTFS and has a drive letter assigned to it. @@ -83,7 +84,7 @@ BitLocker encryption is available for disks before or after addition to a cluste ### Turning on BitLocker for a clustered disk using Windows PowerShell -When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning BitLocker on for a clustered disk: +When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning on BitLocker for a clustered disk: 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Check the status of the cluster disk using Windows PowerShell. @@ -121,11 +122,11 @@ When the cluster service owns a disk resource already, it needs to be set into m ### Adding BitLocker encrypted volumes to a cluster using manage-bde -You can also use manage-bde to enable BitLocker on clustered volumes. The steps needed to add a physical disk resource or CSV2.0 volume to an existing cluster includes the following: +You can also use manage-bde to enable BitLocker on clustered volumes. Follow these steps to add a physical disk resource or CSV2.0 volume to an existing cluster: 1. Verify the BitLocker Drive Encryption feature is installed on the computer. 2. Ensure new storage is formatted as NTFS. -3. Encrypt the volume, add a recovery key and add the cluster administrator as a protector key using the manage-bde command line interface (see example): +3. Encrypt the volume, add a recovery key, and add the cluster administrator as a protector key by using the manage-bde command-line interface (see example): - `Manage-bde -on -used -RP -sid domain\CNO$ -sync` @@ -134,16 +135,17 @@ You can also use manage-bde to enable BitLocker on clustered volumes. The steps 4. Open the Failover Cluster Manager snap-in or cluster PowerShell cmdlets to enable the disk to be clustered - - Once the disk is clustered it can also be enabled for CSV. + - Once the disk is clustered, it can also be enabled for CSV. 5. During the resource online operation, cluster will check to see if the disk is BitLocker encrypted. 1. If the volume is not BitLocker enabled, traditional cluster online operations occur. 2. If the volume is BitLocker enabled, the following check occurs: - - If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails an event will be logged that the volume could not be unlocked and the online operation will fail. + - If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails, an event will be logged that the volume could not be unlocked and the online operation will fail. + +6. Once the disk is online in the storage pool, it can be added to a CSV by right-clicking the disk resource and choosing **Add to cluster shared volumes**. -6. Once the disk is online in the storage pool, it can be added to a CSV by right clicking on the disk resource and choosing "**Add to cluster shared volumes**". CSVs can include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption, administrators can utilize the manage-bde -status command with a path to the volume inside the CSV namespace as seen in the example command line below. ```powershell @@ -152,11 +154,11 @@ manage-bde -status "C:\ClusterStorage\volume1" ### Physical Disk Resources -Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. This means that operations such as encrypting, decrypting, locking or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available. +Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. So operations such as encrypting, decrypting, locking, or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available. ### Restrictions on BitLocker actions with cluster volumes -The following table contains information about both Physical Disk Resources (i.e. traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation. +The following table contains information about both Physical Disk Resources (that is, traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation. @@ -168,91 +170,91 @@ The following table contains information about both Physical Disk Resources (i.e - - - - - + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -261,13 +263,13 @@ The following table contains information about both Physical Disk Resources (i.e

                  Action

                  On owner node of failover volume

                  On Metadata Server (MDS) of CSV

                  On (Data Server) DS of CSV

                  Maintenance Mode

                  Action

                  On owner node of failover volume

                  On Metadata Server (MDS) of CSV

                  On (Data Server) DS of CSV

                  Maintenance Mode

                  Manage-bde –on

                  Manage-bde –on

                  Blocked

                  Blocked

                  Blocked

                  Allowed

                  Manage-bde –off

                  Manage-bde –off

                  Blocked

                  Blocked

                  Blocked

                  Allowed

                  Manage-bde Pause/Resume

                  Manage-bde Pause/Resume

                  Blocked

                  Blocked

                  Blocked

                  Blocked

                  Allowed

                  Manage-bde –lock

                  Manage-bde –lock

                  Blocked

                  Blocked

                  Blocked

                  Allowed

                  manage-bde –wipe

                  manage-bde –wipe

                  Blocked

                  Blocked

                  Blocked

                  Allowed

                  Unlock

                  Unlock

                  Automatic via cluster service

                  Automatic via cluster service

                  Automatic via cluster service

                  Allowed

                  manage-bde –protector –add

                  manage-bde –protector –add

                  Allowed

                  Allowed

                  Blocked

                  Allowed

                  manage-bde -protector -delete

                  manage-bde -protector -delete

                  Allowed

                  Allowed

                  Blocked

                  Allowed

                  manage-bde –autounlock

                  manage-bde –autounlock

                  Allowed (not recommended)

                  Allowed (not recommended)

                  Blocked

                  Allowed (not recommended)

                  Manage-bde -upgrade

                  Manage-bde -upgrade

                  Allowed

                  Allowed

                  Blocked

                  Allowed

                  Shrink

                  Shrink

                  Allowed

                  Allowed

                  Blocked

                  Allowed

                  Extend

                  Extend

                  Allowed

                  Allowed

                  Blocked

                  ->
                  Note:** Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node +>Note:** Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node In the case where a physical disk resource experiences a failover event during conversion, the new owning node will detect the conversion is not complete and will complete the conversion process. ### Other considerations when using BitLocker on CSV2.0 -Some other considerations to take into account for BitLocker on clustered storage include the following: +Also take these considerations into account for BitLocker on clustered storage: - BitLocker volumes have to be initialized and beginning encryption before they are available to add to a CSV2.0 volume. - If an administrator needs to decrypt a CSV volume, remove the volume from the cluster or put into disk maintenance mode. You can add the CSV back to the cluster while waiting for decryption to complete. - If an administrator needs to start encrypting a CSV volume, remove the volume from the cluster or put it in maintenance mode. diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md new file mode 100644 index 0000000000..e6e97c6293 --- /dev/null +++ b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md @@ -0,0 +1,137 @@ +--- +title: Guidelines for troubleshooting BitLocker +description: Describes approaches for investigating BitLocker issues, including how to gather diagnostic information +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +ms.custom: bitlocker +--- + +# Guidelines for troubleshooting BitLocker + +This article addresses common issues in BitLocker and provides guidelines to troubleshoot these issues. This article also provides pointers to start the troubleshooting process, including what data to collect and what settings to check in order to narrow down the location in which these issues occur. + +## Review the event logs + +Open Event Viewer and review the following logs under Applications and Services logs\\Microsoft\\Windows: + +- **BitLocker-API**. Review the Management log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names: + - Microsoft-Windows-BitLocker-API/BitLocker Operational + - Microsoft-Windows-BitLocker-API/BitLocker Management + +- **BitLocker-DrivePreparationTool**. Review the Admin log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names: + - Microsoft-Windows-BitLocker-DrivePreparationTool/Operational + - Microsoft-Windows-BitLocker-DrivePreparationTool/Admin + +Additionally, review the Windows logs\\System log for events that were produced by the TPM and TPM-WMI event sources. + +To filter and display or export logs, you can use the [wevtutil.exe](https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](https://docs.microsoft.com/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6) cmdlet. + +For example, to use wevtutil to export the contents of the Operational log from the BitLocker-API folder to a text file that is named BitLockerAPIOpsLog.txt, open a Command Prompt window, and run a command that resembles the following: + +```cmd +wevtutil qe "Microsoft-Windows-BitLocker/BitLocker Operational" /f:text > BitLockerAPIOpsLog.txt +``` + +To use the **Get-WinEvent** cmdlet to export the same log to a comma-separated text file, open a Windows Powershell window and run a command that resembles the following: + +```ps +Get-WinEvent -logname "Microsoft-Windows-BitLocker/BitLocker Operational"  | Export-Csv -Path Bitlocker-Operational.csv +``` + +You can use Get-WinEvent in an elevated PowerShell window to display filtered information from the System or Application log by using syntax that resembles the following: + +- To display BitLocker-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'BitLocker' | fl + ``` + + The output of such a command resembles the following. + + ![Display of events that is produced by using Get-WinEvent and a BitLocker filter](./images/psget-winevent-1.png) + +- To export BitLocker-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'BitLocker' | Export-Csv -Path System-BitLocker.csv + ``` + +- To display TPM-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'TPM' | fl + ``` + +- To export TPM-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'TPM' | Export-Csv -Path System-TPM.csv + ``` + + The output of such a command resembles the following. + + ![Display of events that is produced by using Get-WinEvent and a TPM filter](./images/psget-winevent-2.png) + +> [!NOTE] +> If you intend to contact Microsoft Support, we recommend that you export the logs listed in this section. + +## Gather status information from the BitLocker technologies + +Open an elevated Windows PowerShell window, and run each of the following commands. + +|Command |Notes | +| - | - | +|[**get-tpm \> C:\\TPM.txt**](https://docs.microsoft.com/powershell/module/trustedplatformmodule/get-tpm?view=win10-ps) |Exports information about the local computer's Trusted Platform Module (TPM). This cmdlet shows different values depending on whether the TPM chip is version 1.2 or 2.0. This cmdlet is not supported in Windows 7. | +|[**manage-bde –status \> C:\\BDEStatus.txt**](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde-status) |Exports information about the general encryption status of all drives on the computer. | +|[**manage-bde c:
                  -protectors -get \> C:\\Protectors**](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde-protectors) |Exports information about the protection methods that are used for the BitLocker encryption key. | +|[**reagentc /info \> C:\\reagent.txt**](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) |Exports information about an online or offline image about the current status of the Windows Recovery Environment (WindowsRE) and any available recovery image. | +|[**get-BitLockerVolume \| fl**](https://docs.microsoft.com/powershell/module/bitlocker/get-bitlockervolume?view=win10-ps) |Gets information about volumes that BitLocker Drive Encryption can protect. | + +## Review the configuration information + +1. Open an elevated Command Prompt window, and run the following commands. + + |Command |Notes | + | - | - | + |[**gpresult /h \**](https://docs.microsoft.com/windows-server/administration/windows-commands/gpresult) |Exports the Resultant Set of Policy information, and saves the information as an HTML file. | + |[**msinfo /report \ /computer \**](https://docs.microsoft.com/windows-server/administration/windows-commands/msinfo32) |Exports comprehensive information about the hardware, system components, and software environment on the local computer. The **/report** option saves the information as a .txt file. | + +1. Open Registry Editor, and export the entries in the following subkeys: + + - **HKLM\\SOFTWARE\\Policies\\Microsoft\\FVE** + - **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\** + +## Check the BitLocker prerequisites + +Common settings that can cause issues for BitLocker include the following: + +- The TPM must be unlocked. You can check the output of the **get-tpm** command for the status of the TPM. +- Windows RE must be enabled. You can check the output of the **reagentc** command for the status of WindowsRE. +- The system reserved partition must use the correct format. + - On Unified Extensible Firmware Interface (UEFI) computers, the system reserved partition must be formatted as FAT32. + - On legacy computers, the system reserved partition must be formatted as NTFS. +- If the device that you are troubleshooting is a slate or tablet PC, use to verify the status of the **Enable use of BitLocker authentication requiring preboot keyboard input on slates** option. + +For more information about the BitLocker prerequisites, see [BitLocker basic deployment: Using BitLocker to encrypt volumes](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-basic-deployment#using-bitlocker-to-encrypt-volumes) + +## Next steps + +If the information that you have examined so far indicates a specific issue (for example, WindowsRE is not enabled), the issue may have a straightforward fix. + +Resolving issues that do not have obvious causes depends on exactly which components are involved and what behavior you see. The information that you have gathered can help you narrow down the areas to investigate. + +- If you are working on a device that is managed by Microsoft Intune, see [Enforcing BitLocker policies by using Intune: known issues](ts-bitlocker-intune-issues.md). +- If BitLocker does not start or cannot encrypt a drive and you notice errors or events that are related to the TPM, see [BitLocker cannot encrypt a drive: known TPM issues](ts-bitlocker-cannot-encrypt-tpm-issues.md). +- If BitLocker does not start or cannot encrypt a drive, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md). +- If BitLocker Network Unlock does not behave as expected, see [BitLocker Network Unlock: known issues](ts-bitlocker-network-unlock-issues.md). +- If BitLocker does not behave as expected when you recover an encrypted drive, or if you did not expect BitLocker to recover the drive, see [BitLocker recovery: known issues](ts-bitlocker-recovery-issues.md). +- If BitLocker does not behave as expected or the encrypted drive does not behave as expected, and you notice errors or events that are related to the TPM, see [BitLocker and TPM: other known issues](ts-bitlocker-tpm-issues.md). +- If BitLocker does not behave as expected or the encrypted drive does not behave as expected, see [BitLocker configuration: known issues](ts-bitlocker-config-issues.md). + +We recommend that you keep the information that you have gathered handy in case you decide to contact Microsoft Support for help to resolve your issue. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md new file mode 100644 index 0000000000..03b1c67188 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -0,0 +1,104 @@ +--- +title: BitLocker cannot encrypt a drive known issues +description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +ms.custom: bitlocker +--- + +# BitLocker cannot encrypt a drive: known issues + +This article describes common issues that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. + +> [!NOTE] +> If you have determined that your BitLocker issue involves the Trusted Platform Module (TPM), see [BitLocker cannot encrypt a drive: known TPM issues](ts-bitlocker-cannot-encrypt-tpm-issues.md). + +## Error 0x80310059: BitLocker Drive Encryption is already performing an operation on this drive + +When you turn on BitLocker Drive Encryption on a computer that is running Windows 10 Professional, you receive a message that resembles the following: + +> **ERROR:** An error occurred (code 0x80310059):BitLocker Drive Encryption is already performing an operation on this drive. Please complete all operations before continuing.NOTE: If the -on switch has failed to add key protectors or start encryption,you may need to call manage-bde -off before attempting -on again. + +### Cause + +This issue may be caused by settings that are controlled by Group Policy Objects (GPOs). + +### Resolution + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +To resolve this issue, follow these steps: + +1. Start Registry Editor, and navigate to the following subkey: + **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE** + +1. Delete the following entries: + - **OSPlatformValidation\_BIOS** + - **OSPlatformValidation\_UEFI** + - **PlatformValidation** + +1. Exit Registry Editor, and turn on BitLocker Drive Encryption again. + +## "Access is denied" message when you try to encrypt removable drives + +You have a computer that is running Windows 10, version 1709 or version 1607. You try to encrypt a USB drive by following these steps: + +1. In Windows Explorer, right-click the USB drive and select **Turn on BitLocker**. +1. On the **Choose how you want to unlock this drive** page, select **Use a password to unlock the drive**. +1. Follow the instructions on the page to enter your password. +1. On the **Are you ready to encrypt this drive?** page, select **Start encrypting**. +1. The **Starting encryption** page displays the message "Access is denied." + +You receive this message on any computer that runs Windows 10 version 1709 or version 1607, when you use any USB drive. + +### Cause + +The security descriptor of the BitLocker Drive Encryption service (BDESvc) has an incorrect entry. Instead of NT AUTHORITY\Authenticated Users, the security descriptor uses NT AUTHORITY\INTERACTIVE. + +To verify that this issue has occurred, follow these steps: + +1. On an affected computer, open an elevated Command Prompt window and an elevated PowerShell window. + +1. At the command prompt, enter the following command: + + ```cmd + C:\>sc sdshow bdesvc + ``` + + The output of this command resembles the following: + + > D:(A;;CCDCLCSWRPWPDTLORCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLORCWDWO;;;BA)(A;;CCLCSWRPLORC;;;BU)(A;;CCLCSWRPLORC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD) + +1. Copy this output, and use it as part of the [**ConvertFrom-SddlString**](https://docs.microsoft.com/powershell/module/microsoft.powershell.utility/convertfrom-sddlstring?view=powershell-6) command in the PowerShell window, as follows. + + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE](./images/ts-bitlocker-usb-sddl.png) + + If you see NT AUTHORITY\INTERACTIVE (as highlighted), in the output of this command, this is the cause of the issue. Under typical conditions, the output should resemble the following: + + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users](./images/ts-bitlocker-usb-default-sddl.png) + +> [!NOTE] +> GPOs that change the security descriptors of services have been known to cause this issue. + +### Resolution + +1. To repair the security descriptor of BDESvc, open an elevated PowerShell window and enter the following command: + + ```ps + sc sdset bdesvc D:(A;;CCDCLCSWRPWPDTLORCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLORCWDWO;;;BA)(A;;CCLCSWRPLORC;;;BU)(A;;CCLCSWRPLORC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD) + ``` + +1. Restart the computer. + +The issue should now be resolved. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md new file mode 100644 index 0000000000..8e005347db --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -0,0 +1,132 @@ +--- +title: BitLocker cannot encrypt a drive known TPM issues +description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive, and that you can attribute to the TPM +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +ms.custom: bitlocker +--- + +# BitLocker cannot encrypt a drive: known TPM issues + +This article describes common issues that affect the Trusted Platform Module (TPM) and that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. + +> [!NOTE] +> If you have determined that your BitLocker issue does not involve the TPM, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md). + +## The TPM is locked and you see "The TPM is defending against dictionary attacks and is in a time-out period" + +When you turn on BitLocker Drive Encryption, it does not start. Instead, you receive a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period." + +### Cause + +The TPM is locked out. + +### Resolution + +To resolve this issue, follow these steps: + +1. Open an elevated PowerShell window and run the following script: + + ```powershell + $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" + $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus + if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} + ``` + +1. Restart the computer. If you are prompted at the restart screen, press F12 to agree. +1. Try again to start BitLocker Drive Encryption. + +## You cannot prepare the TPM, and you see "The TPM is defending against dictionary attacks and is in a time-out period" + +You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you receive a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period." + +### Cause + +The TPM is locked out. + +### Resolution + +To resolve this issue, disable and re-enable the TPM. To do this, follow these steps: + +1. Restart the device, and change the BIOS configuration to disable the TPM. +1. Restart the device again, and return to the TPM management console. You should receive a message that resembles the following: + > Compatible Trusted Platform Module (TPM) cannot be found on this computer. Verify that this computer has 1.2 TPM and it is turned on in the BIOS. + +1. Restart the device, and change the BIOS configuration to enable the TPM. +1. Restart the device, and return to the TPM management console. + +If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm). + +> [!WARNING] +> Clearing the TPM can cause data loss. + +## Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005 + +You have an environment that enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. You try to turn on BitLocker Drive Encryption on a computer that runs Windows 7, but the operation fails. You receive a message that resembles "Access Denied" or "Insufficient Rights." + +### Cause + +The TPM did not have sufficient permissions on the TPM Devices container in Active Directory Domain Services (AD DS). Therefore, the BitLocker recovery information could not be backed up to AD DS, and BitLocker Drive Encryption could not run. + +This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10. + +### Resolution + +To verify that you have correctly identified this issue, use one of the following methods: + +- Disable the policy or remove the computer from the domain. Then try to turn on BitLocker Drive Encryption again. The operation should now succeed. +- Use LDAP and network trace tools to examine the LDAP exchanges between the client and the AD DS domain controller to identify the cause of the "Access Denied" or "Insufficient Rights" error. In this case, you should see the error when the client tries to access its object in the "CN=TPM Devices,DC=\<*domain*>,DC=com" container. + +1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command: + + ```powershell + Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer + ``` + + In this command, *ComputerName* is the name of the affected computer. + +1. To resolve the issue, use a tool such as dsacls.exe to make sure that the access control list of msTPM-TPMInformationForComputer grants both Read and Write permissions to NTAUTHORITY/SELF. + +## Cannot prepare the TPM, error 0x80072030: "There is no such object on the server" + +Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. + +You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles the following: + +> 0x80072030 There is no such object on the server when a policy to back up TPM information to active directory is enabled + +You have confirmed that the **ms-TPM-OwnerInformation** and **msTPM-TpmInformationForComputer** attributes are present. + +### Cause + +The domain and forest functional level of the environment may still be set to Windows 2008 R2. Additionally, the permissions in AD DS may not be correctly set. + +### Resolution + +To resolve this issue, follow these steps: + +1. Upgrade the functional level of the domain and forest to Windows Server 2012 R2. +2. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). +3. In the script, modify the value of **strPathToDomain** to your domain name. +4. Open an elevated PowerShell window, and run the following command: + + ```powershell + cscript Add-TPMSelfWriteACE.vbs + ``` + + In this command \<*Path*> is the path to the script file. + +For more information, see the following articles: + +- [Back up the TPM recovery information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds) +- [Prepare your organization for BitLocker: Planning and policies](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md new file mode 100644 index 0000000000..e3c4f3f6d4 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md @@ -0,0 +1,183 @@ +--- +title: BitLocker configuration known issues +description: Describes common issues that involve your BitLocker configuration and BitLocker's general functionality, and provides guidance for addressing those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +ms.custom: bitlocker +--- + +# BitLocker configuration: known issues + +This article describes common issues that affect your BitLocker configuration and BitLocker's general functionality. This article also provides guidance to address these issues. + +## BitLocker encryption is slower in Windows 10 + +In both Windows 10 and Windows 7, BitLocker runs in the background to encrypt drives. However, in Windows 10, BitLocker is less aggressive about requesting resources. This behavior reduces the chance that BitLocker will affect the computer's performance. + +To compensate for these changes, BitLocker uses a new conversion model. This model, (referred to as Encrypt-On-Write), makes sure that any new disk writes on all client SKUs and any internal drives are always encrypted *as soon as you turn on BitLocker*. + +> [!IMPORTANT] +> To preserve backward compatibility, BitLocker uses the previous conversion model to encrypt removable drives. + +### Benefits of using the new conversion model + +By using the previous conversion model, you cannot consider an internal drive to be protected (and compliant with data protection standards) until the BitLocker conversion is 100 percent complete. Before the process finishes, the data that existed on the drive before encryption began—that is, potentially compromised data—can still be read and written without encryption. Therefore, you must wait for the encryption process to finish before you store sensitive data on the drive. Depending on the size of the drive, this delay can be substantial. + +By using the new conversion model, you can safely store sensitive data on the drive as soon as you turn on BitLocker. You don't have to wait for the encryption process to finish, and encryption does not adversely affect performance. The tradeoff is that the encryption process for pre-existing data takes more time. + +### Other BitLocker enhancements + +After Windows 7 was released, several other areas of BitLocker were improved: + +- **New encryption algorithm, XTS-AES**. The new algorithm provides additional protection from a class of attacks on encrypted data that rely on manipulating cipher text to cause predictable changes in plain text. + + By default, this algorithm complies with the Federal Information Processing Standards (FIPS). FIPS are United States Government standards that provide a benchmark for implementing cryptographic software. + +- **Improved administration features**. You can manage BitLocker on PCs or other devices by using the following interfaces: + - BitLocker Wizard + - manage-bde + - Group Policy Objects (GPOs) + - Mobile Device Management (MDM) policy + - Windows PowerShell + - Windows Management Interface (WMI) + +- **Integration with Azure Active Directory** (Azure AD). BitLocker can store recovery information in Azure AD to make it easier to recover. + +- **[Direct memory access (DMA) Port Protection](https://docs.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)**. By using MDM policies to manage BitLocker, you can block a device's DMA ports and secure the device during its startup. + +- **[BitLocker Network Unlock](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock)**. If your BitLocker-enabled desktop or server computer is connected to a wired corporate network in a domain environment, you can automatically unlock its operating system volume during a system restart. + +- **Support for [Encrypted Hard Drives](https://docs.microsoft.com/windows/security/information-protection/encrypted-hard-drive)**. Encrypted Hard Drives are a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. By taking on that workload, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. + +- **Support for classes of HDD/SSD hybrid disks**. BitLocker can encrypt a disk that uses a small SSD as a non-volatile cache in front of the HDD, such as Intel Rapid Storage Technology. + +## Hyper-V Gen 2 VM: Cannot access the volume after BitLocker encryption + +Consider the following scenario: + +1. You turn on BitLocker on a generation-2 virtual machine (VM) that runs on Hyper-V. +1. You add data to the data disk as it encrypts. +1. You restart the VM, and observe the following: + - The system volume is not encrypted. + - The encrypted volume is not accessible, and the computer lists the volume's file system as "Unknown." + - You see a message that resembles: "You need to format the disk in \<*x:*> drive before you can use it" + +### Cause + +This issue occurs because the third-party filter driver Stcvsm.sys (from StorageCraft) is installed on the VM. + +### Resolution + +To resolve this issue, remove the third-party software. + +## Production snapshots fail for virtualized domain controllers that use BitLocker-encrypted disks + +You have a Windows Server 2019 or 2016 Hyper-V Server that is hosting VMs (guests) that are configured as Windows domain controllers. BitLocker has encrypted the disks that store the Active Directory database and log files. When you run a “production snapshot” of the domain controller guests, the Volume Snap-Shot (VSS) service does not correctly process the backup. + +This issue occurs regardless of any of the following variations in the environment: + +- How the domain controller volumes are unlocked. +- Whether the VMs are generation 1 or generation 2. +- Whether the guest operating system is Windows Server 2019, 2016 or 2012 R2. + +In the domain controller Application log, the VSS event source records event ID 8229: + +> ID: 8229 +> Level: Warning +> ‎Source: VSS +> Message: A VSS writer has rejected an event with error 0x800423f4, The writer experienced a non-transient error. If the backup process is retried, the error is likely to reoccur. +> +> Changes that the writer made to the writer components while handling the event will not be available to the requester. +> +> Check the event log for related events from the application hosting the VSS writer. +> +> Operation: +> PostSnapshot Event +> +> Context: +> Execution Context: Writer +> Writer Class Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757} +> Writer Name: NTDS +> Writer Instance ID: {d170b355-a523-47ba-a5c8-732244f70e75} +> Command Line: C:\\Windows\\system32\\lsass.exe +> +> Process ID: 680 + +In the domain controller Directory Services event log, you see an event that resembles the following: + +> Error Microsoft-Windows-ActiveDirectory\_DomainService 1168 +> Internal Processing Internal error: An Active Directory Domain Services error has occurred. +> +>‎  Additional Data +> ‎  Error value (decimal): -1022 +> +> Error value (hex): fffffc02 +> +> Internal ID: 160207d9 + +> [!NOTE] +> The internal ID of this event may differ based on your operating system release and path level. + +After this issue occurs, if you run the **VSSADMIN list writers** command, you see output that resembles the following for the Active Directory Domain Services (NTDS) VSS Writer: + +> Writer name: 'NTDS' +>   Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757} +>   Writer Instance Id: {08321e53-4032-44dc-9b03-7a1a15ad3eb8} +>   State: \[11\] Failed +>   Last error: Non-retryable error + +Additionally, you cannot back up the VMs until you restart them. + +### Cause + +After VSS creates a snapshot of a volume, the VSS writer takes "post snapshot" actions. In the case of a "production snapshot," which you initiate from the host server, Hyper-V tries to mount the snapshotted volume. However, it cannot unlock the volume for unencrypted access. BitLocker on the Hyper-V server does not recognize the volume. Therefore, the access attempt fails and then the snapshot operation fails. + +This behavior is by design. + +### Workaround + +There is one supported way to perform backup and restore of a virtualized domain controller: + +- Run Windows Server Backup in the guest operating system. + +If you have to take a production snapshot of a virtualized domain controller, you can suspend BitLocker in the guest operating system before you start the production snapshot. However, this approach is not recommended. + +For more information and recommendations about backing up virtualized domain controllers, see [Virtualizing Domain Controllers using Hyper-V: Backup and Restore Considerations for Virtualized Domain Controllers](https://docs.microsoft.com/windows-server/identity/ad-ds/get-started/virtual-dc/virtualized-domain-controllers-hyper-v#backup-and-restore-considerations-for-virtualized-domain-controllers) + +### More information + +When the VSS NTDS writer requests access to the encrypted drive, the Local Security Authority Subsystem Service (LSASS) generates an error entry that resembles the following: + +``` +\# for hex 0xc0210000 / decimal -1071579136 +‎ STATUS\_FVE\_LOCKED\_VOLUME ntstatus.h +‎ \# This volume is locked by BitLocker Drive Encryption. +``` + +The operation produces the following call stack: + +``` +\# Child-SP RetAddr Call Site +‎ 00 00000086\`b357a800 00007ffc\`ea6e7a4c KERNELBASE\!FindFirstFileExW+0x1ba \[d:\\rs1\\minkernel\\kernelbase\\filefind.c @ 872\] +‎ 01 00000086\`b357abd0 00007ffc\`e824accb KERNELBASE\!FindFirstFileW+0x1c \[d:\\rs1\\minkernel\\kernelbase\\filefind.c @ 208\] +‎ 02 00000086\`b357ac10 00007ffc\`e824afa1 ESENT\!COSFileFind::ErrInit+0x10b \[d:\\rs1\\onecore\\ds\\esent\\src\\os\\osfs.cxx @ 2476\] +‎ 03 00000086\`b357b700 00007ffc\`e827bf02 ESENT\!COSFileSystem::ErrFileFind+0xa1 \[d:\\rs1\\onecore\\ds\\esent\\src\\os\\osfs.cxx @ 1443\] +‎ 04 00000086\`b357b960 00007ffc\`e82882a9 ESENT\!JetGetDatabaseFileInfoEx+0xa2 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 11503\] +‎ 05 00000086\`b357c260 00007ffc\`e8288166 ESENT\!JetGetDatabaseFileInfoExA+0x59 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 11759\] +‎ 06 00000086\`b357c390 00007ffc\`e84c64fb ESENT\!JetGetDatabaseFileInfoA+0x46 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 12076\] +‎ 07 00000086\`b357c3f0 00007ffc\`e84c5f23 ntdsbsrv\!CVssJetWriterLocal::RecoverJetDB+0x12f \[d:\\rs1\\ds\\ds\\src\\jetback\\snapshot.cxx @ 2009\] +‎ 08 00000086\`b357c710 00007ffc\`e80339e0 ntdsbsrv\!CVssJetWriterLocal::OnPostSnapshot+0x293 \[d:\\rs1\\ds\\ds\\src\\jetback\\snapshot.cxx @ 2190\] +‎ 09 00000086\`b357cad0 00007ffc\`e801fe6d VSSAPI\!CVssIJetWriter::OnPostSnapshot+0x300 \[d:\\rs1\\base\\stor\\vss\\modules\\jetwriter\\ijetwriter.cpp @ 1704\] +‎ 0a 00000086\`b357ccc0 00007ffc\`e8022193 VSSAPI\!CVssWriterImpl::OnPostSnapshotGuard+0x1d \[d:\\rs1\\base\\stor\\vss\\modules\\vswriter\\vswrtimp.cpp @ 5228\] +‎ 0b 00000086\`b357ccf0 00007ffc\`e80214f0 VSSAPI\!CVssWriterImpl::PostSnapshotInternal+0xc3b \[d:\\rs1\\base\\stor\\vss\\modules\\vswriter\\vswrtimp.cpp @ 3552\] +``` diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md new file mode 100644 index 0000000000..3e2cdad741 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -0,0 +1,114 @@ +--- +title: Decode Measured Boot logs to track PCR changes +description: Provides instructions for installing and using a tool for analyzing log information to identify changes to PCRs +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +ms.custom: bitlocker +--- + +# Decode Measured Boot logs to track PCR changes + +Platform Configuration Registers (PCRs) are memory locations in the Trusted Platform Module (TPM). BitLocker and its related technologies depend on specific PCR configurations. Additionally, specific change in PCRs can cause a device or computer to enter BitLocker recovery mode. + +By tracking changes in the PCRs, and identifying when they changed, you can gain insight into issues that occur or learn why a device or computer entered BitLocker recovery mode. The Measured Boot logs record PCR changes and other information. These logs are located in the C:\\Windows\\Logs\\MeasuredBoot\\ folder. + +This article describes tools that you can use to decode these logs: TBSLogGenerator and PCPTool. + +For more information about Measured Boot and PCRs, see the following articles: + +- [TPM fundamentals: Measured Boot with support for attestation](https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals#measured-boot-with-support-for-attestation) +- [Understanding PCR banks on TPM 2.0 devices](https://docs.microsoft.com/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices) + +## Use TBSLogGenerator to decode Measured Boot logs + +Use TBSLogGenerator to decode Measured Boot logs that you have collected from Windows 10 and earlier versions. You can install this tool on the following systems: + +- A computer that is running Windows Server 2016 and that has a TPM enabled +- A Gen 2 virtual machine (running on Hyper-V) that is running Windows Server 2016 (you can use the virtual TPM) + +To install the tool, follow these steps: + +1. Download the Windows Hardware Lab Kit from one of the following locations: + + - [Windows Hardware Lab Kit](https://docs.microsoft.com/windows-hardware/test/hlk/) + - Direct download link for Windows Server 2016: [Windows HLK, version 1607](https://go.microsoft.com/fwlink/p/?LinkID=404112) + +1. Accept the default installation path. + + ![Specify Location page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-1.png) + +1. Under **Select the features you want to install**, select **Windows Hardware Lab Kit—Controller + Studio**. + + ![Select features page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-2.png) + +1. Finish the installation. + +To use TBSLogGenerator, follow these steps: + +1. After the installation finishes, open an elevated Command Prompt window and navigate to the following folder: + **C:\\Program Files (x86)\\Windows Kits\\10\\Hardware Lab Kit\\Tests\\amd64\\NTTEST\\BASETEST\\ngscb** + + This folder contains the TBSLogGenerator.exe file. + + ![Properties and location of the TBSLogGenerator.exe file](./images/ts-tpm-3.png) + +1. Run the following command: + ```cmd + TBSLogGenerator.exe -LF \.log > \.txt + ``` + where the variables represent the following values: + - \<*LogFolderName*> = the name of the folder that contains the file to be decoded + - \<*LogFileName*> = the name of the file to be decoded + - \<*DestinationFolderName*> = the name of the folder for the decoded text file + - \<*DecodedFileName*> = the name of the decoded text file + + For example, the following figure shows Measured Boot logs that were collected from a Windows 10 computer and put into the C:\\MeasuredBoot\\ folder. The figure also shows a Command Prompt window and the command to decode the **0000000005-0000000000.log** file: + + ```cmd + TBSLogGenerator.exe -LF C:\MeasuredBoot\0000000005-0000000000.log > C:\MeasuredBoot\0000000005-0000000000.txt + ``` + + ![Command Prompt window that shows an example of how to use TBSLogGenerator](./images/ts-tpm-4.png) + + The command produces a text file that uses the specified name. In the case of the example, the file is **0000000005-0000000000.txt**. The file is located in the same folder as the original .log file. + + ![Windows Explorer window that shows the text file that TBSLogGenerator produces](./images/ts-tpm-5.png) + +The content of this text file resembles the following. + +![Contents of the text file, as shown in NotePad](./images/ts-tpm-6.png) + +To find the PCR information, go to the end of the file. + + ![View of NotePad that shows the PCR information at the end of the text file](./images/ts-tpm-7.png) + +## Use PCPTool to decode Measured Boot logs + +PCPTool is part of the [TPM Platform Crypto-Provider Toolkit](https://www.microsoft.com/download/details.aspx?id=52487). The tool decodes a Measured Boot log file and converts it into an XML file. + +To download and install PCPTool, go to the Toolkit page, select **Download**, and follow the instructions. + +To decode a log, run the following command: +```cmd +PCPTool.exe decodelog \.log > \.xml +``` + +where the variables represent the following values: +- \<*LogFolderPath*> = the path to the folder that contains the file to be decoded +- \<*LogFileName*> = the name of the file to be decoded +- \<*DestinationFolderName*> = the name of the folder for the decoded text file +- \<*DecodedFileName*> = the name of the decoded text file + +The content of the XML file resembles the following. + +![Command Prompt window that shows an example of how to use PCPTool](./images/pcptool-output.jpg) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md new file mode 100644 index 0000000000..895c4eec13 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -0,0 +1,347 @@ +--- +title: Enforcing BitLocker policies by using Intune known issues +description: provides assistance for issues that you may see if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +ms.custom: bitlocker +--- + +# Enforcing BitLocker policies by using Intune: known issues + +This article helps you troubleshoot issues that you may experience if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. The Intune portal indicates whether BitLocker has failed to encrypt one or more managed devices. + +![The BitLocker status indictors on the Intune portal](./images/4509189-en-1.png) + +To start narrowing down the cause of the problem, review the event logs as described in [Troubleshoot BitLocker](troubleshoot-bitlocker.md). Concentrate on the Management and Operations logs in the **Applications and Services logs\\Microsoft\\Windows\\BitLocker-API** folder. The following sections provide more information about how to resolve the indicated events and error messages: + +- [Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer](#issue-1) +- [Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer](#issue-2) +- [Event ID 854: WinRE is not configured](#issue-3) +- [Event ID 851: Contact manufacturer for BIOS upgrade](#issue-4) +- [Error message: The UEFI variable 'SecureBoot' could not be read](#issue-6) +- [Event ID 846, 778, and 851: Error 0x80072f9a](#issue-7) +- [Error message: Conflicting Group Policy settings for recovery options on operating system drives](#issue-5) + +If you do not have a clear trail of events or error messages to follow, other areas to investigate include the following: + +- [Review the hardware requirements for using Intune to manage BitLocker on devices](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-bitlocker#bitlocker-automatic-device-encryption-hardware-requirements) +- [Review your BitLocker policy configuration](#policy) + +For information about how to verify that Intune policies are enforcing BitLocker correctly, see [Verifying that BitLocker is operating correctly](#verifying-that-bitlocker-is-operating-correctly). + +## Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer + +Event ID 853 can carry different error messages, depending on the context. In this case, the Event ID 853 error message indicates that the device does not appear to have a TPM. The event information resembles the following: + +![Details of event ID 853 (TPM is not available, cannot find TPM)](./images/4509190-en-1.png) + +### Cause + +The device that you are trying to secure may not have a TPM chip, or the device BIOS might be configured to disable the TPM. + +### Resolution + +To resolve this issue, verify the following: + +- The TPM is enabled in the device BIOS. +- The TPM status in the TPM management console resembles the following: + - Ready (TPM 2.0) + - Initialized (TPM 1.2) + +For more information, see [Troubleshoot the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm). + +## Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer + +In this case, you see event ID 853, and the error message in the event indicates that bootable media is available to the device. The event information resembles the following. + +![Details of event ID 853 (TPM is not available, bootable media found)](./images/4509191-en-1.png) + +### Cause + +During the provisioning process, BitLocker Drive Encryption records the configuration of the device to establish a baseline. If the device configuration changes later (for example, if you remove the media), BitLocker recovery mode automatically starts. + +To avoid this situation, the provisioning process stops if it detects removable bootable media. + +### Resolution + +Remove the bootable media, and restart the device. After the device restarts, verify the encryption status. + +## Event ID 854: WinRE is not configured + +The event information resembles the following: + +> Failed to enable Silent Encryption. WinRe is not configured. +> +> Error: This PC cannot support device encryption because WinRE is not properly configured. + +### Cause + +Windows Recovery Environment (WinRE) is a minimal Windows operating system that is based on Windows Preinstallation Environment (Windows PE). WinRE includes several tools that an administrator can use to recover or reset Windows and diagnose Windows issues. If a device cannot start the regular Windows operating system, the device tries to start WinRE. + +The provisioning process enables BitLocker Drive Encryption on the operating system drive during the Windows PE phase of provisioning. This action makes sure that the drive is protected before the full operating system is installed. The provisioning process also creates a system partition for WinRE to use if the system crashes. + +If WinRE is not available on the device, provisioning stops. + +### Resolution + +You can resolve this issue by verifying the configuration of the disk partitions, the status of WinRE, and the Windows Boot Loader configuration. To do this, follow these steps. + +#### Step 1: Verify the configuration of the disk partitions + +The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 10 automatically creates a recovery partition that contains the Winre.wim file. The partition configuration resembles the following. + +![Default disk partitions, including the recovery partition](./images/4509194-en-1.png) + +To verify the configuration of the disk partitions, open an elevated Command Prompt window, and run the following commands: + +``` +diskpart +list volume +``` +![Output of the list volume command in the Diskpart app](./images/4509195-en-1.png) + +If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from Microsoft Endpoint Configuration Manager). + +![Windows image configuration in Microsoft Endpoint Configuration Manager](./images/configmgr-imageconfig.jpg) + +#### Step 2: Verify the status of WinRE + +To verify the status of WinRE on the device, open an elevated Command Prompt window and run the following command: + +```cmd +reagentc /info +``` +The output of this command resembles the following. + +![Output of the reagentc /info command](./images/4509193-en-1.png) + +If the **Windows RE status** is not **Enabled**, run the following command to enable it: + +```cmd +reagentc /enable +``` + +#### Step 3: Verify the Windows Boot Loader configuration + +If the partition status is healthy, but the **reagentc /enable** command results in an error, verify that Windows Boot Loader contains the recovery sequence GUID. To do this, run the following command in an elevated Command Prompt window: + +```cmd +bcdedit /enum all +``` + +The output of this command resembles the following. + +![Output of the bcdedit /enum all command](./images/4509196-en-1.png) + +In the output, locate the **Windows Boot Loader** section that includes the line **identifier={current}**. In that section, locate the **recoverysequence** attribute. The value of this attribute should be a GUID value, not a string of zeros. + +## Event ID 851: Contact the manufacturer for BIOS upgrade instructions + +The event information resembles the following: + +> Failed to enable Silent Encryption. +> +> Error: BitLocker Drive Encryption cannot be enabled on the operating system drive. Contact the computer manufacturer for BIOS upgrade instructions. + +### Cause + +The device must have Unified Extensible Firmware Interface (UEFI) BIOS. Silent BitLocker Drive Encryption does not support legacy BIOS. + +### Resolution + +To verify the BIOS mode, use the System Information app. To do this, follow these steps: + +1. Select **Start**, and enter **msinfo32** in the **Search** box. +1. Verify that the **BIOS Mode** setting is **UEFI** and not **Legacy**. + ![System Information app, showing the BIOS Mode setting](./images/4509198-en-1.png) +1. If the **BIOS Mode** setting is **Legacy**, you have to switch the BIOS into **UEFI** or **EFI** mode. The steps for doing this are specific to the device. + > [!NOTE] + > If the device supports only Legacy mode, you cannot use Intune to manage BitLocker Device Encryption on the device. + +## Error message: The UEFI variable 'SecureBoot' could not be read + +You receive an error message that resembles the following: + +> **Error:** BitLocker cannot use Secure Boot for integrity because the UEFI variable 'SecureBoot' could not be read. A required privilege is not held by the client. + +### Cause + +A Platform Configuration Register (PCR) is a memory location in the TPM. In particular, PCR 7 measures the state of Secure Boot. Silent BitLocker Drive Encryption requires that Secure Boot is turned on. + +### Resolution + +You can resolve this issue by verifying the PCR validation profile of the TPM and the Secure Boot state. To do this, follow these steps: + +#### Step 1: Verify the PCR validation profile of the TPM + +To verify that PCR 7 is in use, open an elevated Command Prompt window and run the following command: + +```cmd +Manage-bde -protectors -get %systemdrive% +``` + +In the TPM section of the output of this command, verify that the **PCR Validation Profile** setting includes **7**, as follows. + +![Output of the manage-bde command](./images/4509199-en-1.png) + +If **PCR Validation Profile** doesn't include **7** (for example, the values include **0**, **2**, **4**, and **11**, but not **7**), then Secure Boot is not turned on. + +![Output of the manage-bde command when PCR 7 is not present](./images/4509200-en-1.png) + +#### 2. Verify the Secure Boot state + +To verify the Secure Boot state, use the System Information app. To do this, follow these steps: + +1. Select **Start**, and enter **msinfo32** in the **Search** box. +1. Verify that the **Secure Boot State** setting is **On**, as follows: + ![System Information app, showing a supported Secure Boot State](./images/4509201-en-1.png) +1. If the **Secure Boot State** setting is **Unsupported**, you cannot use Silent BitLocker Encryption on this device. + ![System Information app, showing a unsupported Secure Boot State](./images/4509202-en-1.png) + +> [!NOTE] +> You can also use the [Confirm-SecureBootUEFI](https://docs.microsoft.com/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: +> ```ps +> PS C:\> Confirm-SecureBootUEFI +> ``` +> If the computer supports Secure Boot and Secure Boot is enabled, this cmdlet returns "True." +> +> If the computer supports Secure Boot and Secure Boot is disabled, this cmdlet returns "False." +> +> If the computer does not support Secure Boot or is a BIOS (non-UEFI) computer, this cmdlet returns "Cmdlet not supported on this platform." + +## Event ID 846, 778, and 851: Error 0x80072f9a + +In this case, you are deploying Intune policy to encrypt a Windows 10, version 1809 device and store the recovery password in Azure Active Directory (Azure AD). As part of the policy configuration, you have selected the **Allow standard users to enable encryption during Azure AD Join** option. + +The policy deployment fails and generates the following events (visible in Event Viewer in the **Applications and Services Logs\\Microsoft\\Windows\\BitLocker API** folder): + +> Event ID:846 +> +> Event: +> Failed to backup BitLocker Drive Encryption recovery information for volume C: to your Azure AD. +> +> TraceId: {cbac2b6f-1434-4faa-a9c3-597b17c1dfa3} +> Error: Unknown HResult Error code: 0x80072f9a + +> Event ID:778 +> +> Event: The BitLocker volume C: was reverted to an unprotected state. + +> Event ID: 851 +> +> Event: +> Failed to enable Silent Encryption. +> +> Error: Unknown HResult Error code: 0x80072f9a. + +These events refer to Error code 0x80072f9a. + +### Cause + +These events indicate that the signed-in user does not have permission to read the private key on the certificate that is generated as part of the provisioning and enrollment process. Therefore, the BitLocker MDM policy refresh fails. + +The issue affects Windows 10 version 1809. + +### Resolution + +To resolve this issue, install the [May 21, 2019](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934) update. + +## Error message: There are conflicting Group Policy settings for recovery options on operating system drives + +You receive a message that resembles the following: + +> **Error:** BitLocker Drive Encryption cannot be applied to this drive because there are conflicting Group Policy settings for recovery options on operating system drives. Storing recovery information to Active Directory Domain Services cannot be required when the generation of recovery passwords is not permitted. Please have your system administrator resolve these policy conflicts before attempting to enable BitLocker… + +### Resolution + +To resolve this issue, review your Group Policy Object (GPO) settings for conflicts. For further guidance, see the next section, [Review your BitLocker policy configuration](#policy). + +For more information about GPOs and BitLocker, see [BitLocker Group Policy Reference](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee706521(v=ws.10)?redirectedfrom=MSDN). + +## Review your BitLocker policy configuration + +For information about how to use policy together with BitLocker and Intune, see the following resources: + +- [BitLocker management for enterprises: Managing devices joined to Azure Active Directory](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises#managing-devices-joined-to-azure-active-directory) +- [BitLocker Group Policy Reference](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee706521(v=ws.10)?redirectedfrom=MSDN) +- [Configuration service provider reference](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference) +- [Policy CSP – BitLocker](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-bitlocker) +- [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) +- [Enable ADMX-backed policies in MDM](https://docs.microsoft.com/windows/client-management/mdm/enable-admx-backed-policies-in-mdm) +- [gpresult](https://docs.microsoft.com/windows-server/administration/windows-commands/gpresult) + +Intune offers the following enforcement types for BitLocker: + +- **Automatic** (Enforced when the device joins Azure AD during the provisioning process. This option is available in Windows 10 version 1703 and later.) +- **Silent** (Endpoint protection policy. This option is available in Windows 10 version 1803 and later.) +- **Interactive** (Endpoint policy for Windows versions that are older than Windows 10 version 1803.) + +If your device runs Windows 10 version 1703 or later, supports Modern Standby (also known as Instant Go) and is HSTI-compliant, joining the device to Azure AD triggers automatic device encryption. A separate endpoint protection policy is not required to enforce device encryption. + +If your device is HSTI-compliant but does not support Modern Standby, you have to configure an endpoint protection policy to enforce silent BitLocker Drive Encryption. The settings for this policy should resemble the following: + +![Intune policy settings](./images/4509186-en-1.png) + +The OMA-URI references for these settings are as follows: + +- OMA-URI: **./Device/Vendor/MSFT/BitLocker/RequireDeviceEncryption** + Value Type: **Integer** + Value: **1**  (1 = Require, 0 = Not Configured) + +- OMA-URI: **./Device/Vendor/MSFT/BitLocker/AllowWarningForOtherDiskEncryption** + Value Type: **Integer** + Value: **0** (0 = Blocked, 1 = Allowed) + +> [!NOTE] +> Because of an update to the BitLocker Policy CSP, if the device uses Windows 10 version 1809 or later, you can use an endpoint protection policy to enforce silent BitLocker Device Encryption even if the device is not HSTI-compliant. + +> [!NOTE] +> If the **Warning for other disk encryption** setting is set to **Not configured**, you have to manually start the BitLocker Drive Encryption wizard. + +If the device does not support Modern Standby but is HSTI-compliant, and it uses a version of Windows that is earlier than Windows 10, version 1803, an endpoint protection policy that has the settings that are described in this article delivers the policy configuration to the device. However, Windows then notifies the user to manually enable BitLocker Drive Encryption. To do this, the user selects the notification. This action starts the BitLocker Drive Encryption wizard. + +The Intune 1901 release provides settings that you can use to configure automatic device encryption for Autopilot devices for standard users. Each device must meet the following requirements: + +- Be HSTI-compliant +- Support Modern Standby +- Use Windows 10 version 1803 or later + +![Intune policy setting](./images/4509188-en-1.png) + +The OMA-URI references for these settings are as follows: + +- OMA-URI: **./Device/Vendor/MSFT/BitLocker/AllowStandardUserEncryption** + Value Type: **Integer** + Value: **1** + +> [!NOTE] +> This node works together with the **RequireDeviceEncryption** and **AllowWarningForOtherDiskEncryption** nodes. For this reason, when you set **RequireDeviceEncryption** to **1**, **AllowStandardUserEncryption** to **1**, and **AllowWarningForOtherDiskEncryption** to **0**. Intune can enforce silent BitLocker encryption for Autopilot devices that have standard user profiles. + +## Verifying that BitLocker is operating correctly + +During regular operations, BitLocker Drive Encryption generates events such as Event ID 796 and Event ID 845. + +![Event ID 796, as shown in Event Viewer](./images/4509203-en-1.png) + +![Event ID 845, as shown in Event Viewer](./images/4509204-en-1.png) + +You can also determine whether the BitLocker recovery password has been uploaded to Azure AD by checking the device details in the Azure AD Devices section. + +![BitLocker recovery information as viewed in Azure AD](./images/4509205-en-1.png) + +On the device, check the Registry Editor to verify the policy settings on the device. Verify the entries under the following subkeys: + +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\BitLocker** +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device** + +![Registry subkeys that relate to Intune policy](./images/4509206-en-1.png) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md new file mode 100644 index 0000000000..b5882849d0 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md @@ -0,0 +1,89 @@ +--- +title: BitLocker Network Unlock known issues +description: Describes several known issues that you may encounter while using Network Unlock, and provided guidance for addressing those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/7/2019 +ms.custom: bitlocker +--- + +# BitLocker Network Unlock: known issues + +By using the BitLocker Network Unlock feature, you can manage computers remotely without having to enter a BitLocker PIN when each computer starts up. To do this, You have to configure your environment to meet the following requirements: + +- Each computer belongs to a domain +- Each computer has a wired connection to the corporate network +- The corporate network uses DHCP to manage IP addresses +- Each computer has a DHCP driver implemented in its Unified Extensible Firmware Interface (UEFI) firmware + +For general guidelines about how to troubleshoot Network Unlock, see [How to enable Network Unlock: Troubleshoot Network Unlock](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock#troubleshoot-network-unlock). + +This article describes several known issues that you may encounter when you use Network Unlock, and provides guidance to address these issues. + +## Tip: Detect whether BitLocker Network Unlock is enabled on a specific computer + +You can use the following steps on computers that have either x64 or x32 UEFI systems. You can also script these commands. + +1. Open an elevated Command Prompt window and run the following command: + + ```cmd + manage-bde protectors get + ``` + + where \<*Drive*> is the drive letter, followed by a colon (:), of the bootable drive. + If the output of this command includes a key protector of type **TpmCertificate (9)**, the configuration is correct for BitLocker Network Unlock. + +1. Start Registry Editor, and verify the following settings: + - Entry **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE: OSManageNKP** is set to **1** + - Subkey **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP\\Certificates** has an entry whose name matches the name of the certificate thumbprint of the Network Unlock key protector that you found in step 1. + +## On a Surface Pro 4 device, BitLocker Network Unlock does not work because the UEFI network stack is incorrectly configured + +You have configured BitLocker Network Unlock as described in [BitLocker: How to enable Network Unlock](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock). You have configured the UEFI of the device to use DHCP. However, when you restart the device, it still prompts you for the BitLocker PIN. + +You test another device, such as a different type of tablet or laptop PC, that is configured to use the same infrastructure. The device restarts as expected, without prompting for the BitLocker PIN. You conclude that the infrastructure is correctly configured, and the issue is specific to the device. + +### Cause + +The UEFI network stack on the device was incorrectly configured. + +### Resolution + +To correctly configure the UEFI network stack of the Surface Pro 4, you have to use Microsoft Surface Enterprise Management Mode (SEMM). For information about SEMM, see [Enroll and configure Surface devices with SEMM](https://docs.microsoft.com/surface/enroll-and-configure-surface-devices-with-semm). + +> [!NOTE] +> If you cannot use SEMM, you may be able to configure the Surface Pro 4 to use BitLocker Network Unlock by configuring the device to use the network as its first boot option. + +## Unable to use BitLocker Network Unlock feature on a Windows client computer + +You have configured BitLocker Network Unlock as described in [BitLocker: How to enable Network Unlock](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock). You have a Windows 8-based client computer that is connected to the corporate LAN by using an Ethernet Cable. However, when you restart the computer, it still prompts you for the BitLocker PIN. + +### Cause + +A Windows 8-based or Windows Server 2012-based client computer sometimes does not receive or use the Network Unlock protector, depending on whether the client receives unrelated BOOTP replies from a DHCP server or WDS server. + +DHCP servers may send any DHCP options to a BOOTP client as allowed by the DHCP options and BOOTP vendor extensions. This means that because a DHCP server supports BOOTP clients, the DHCP server replies to BOOTP requests. + +The manner in which a DHCP server handles an incoming message depends in part on whether the message uses the Message Type option: + +- The first two messages that the BitLocker Network Unlock client sends are DHCP DISCOVER\REQUEST messages. They use the Message Type option, so the DHCP server treats them as DHCP messages. +- The third message that the BitLocker Network Unlock client sends does not have the Message Type option. The DHCP server treats the message as a BOOTP request. + +A DHCP server that supports BOOTP clients must interact with those clients according to the BOOTP protocol. The server must create a BOOTP BOOTREPLY message instead of a DHCP DHCPOFFER message. (In other words, the server must not include the DHCP message option type and must not exceed the size limit for BOOTREPLY messages.) After the server sends the BOOTP BOOTREPLY message, the server marks a binding for a BOOTP client as BOUND. A non-DHCP client does not send a DHCPREQUEST message, nor does that client expect a DHCPACK message. + +If a DHCP server that is not configured to support BOOTP clients receives a BOOTREQUEST message from a BOOTP client, that server silently discards the BOOTREQUEST message. + +For more information about DHCP and BitLocker Network Unlock, see [BitLocker: How to enable Network Unlock: Network Unlock sequence](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock#network-unlock-sequence) + +### Resolution + +To resolve this issue, change the configuration of the DHCP server by changing the **DHCP** option from **DHCP and BOOTP** to **DHCP**. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md new file mode 100644 index 0000000000..b9d677c092 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -0,0 +1,291 @@ +--- +title: BitLocker recovery known issues +description: Describes common issues that can occur that prevent BitLocker from behaving as expected when recovering a drive, or may cause BitLocker to start recovery unexpectedly. The article provides guidance for addressing those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +ms.custom: bitlocker +--- + +# BitLocker recovery: known issues + +This article describes common issues that may prevent BitLocker from behaving as expected when you recover a drive, or that may cause BitLocker to start recovery unexpectedly. The article provides guidance to address these issues. + +> [!NOTE] +> In this article, "recovery password" refers to the 48-digit recovery password and "recovery key" refers to 32-digit recovery key. For more information, see [BitLocker key protectors](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bitlocker-key-protectors). + +## Windows 10 prompts for a non-existing BitLocker recovery password + +Windows 10 prompts you for a BitLocker recovery password. However, you did not configure a BitLocker recovery password. + +### Resolution + +The BitLocker and Active Directory Domain Services (AD DS) FAQ addresses situations that may produce this symptom, and provides information about how to resolve the issue: + +- [What if BitLocker is enabled on a computer before the computer has joined the domain?](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) +- [What happens if the backup initially fails? Will BitLocker retry the backup?](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq#what-happens-if-the-backup-initially-fails-will-bitlocker-retry-the-backup) + +## The recovery password for a laptop was not backed up, and the laptop is locked + +You have a Windows 10 Home-based laptop, and you have to recover its hard disk. The disk was encrypted by using BitLocker Driver Encryption. However, the BitLocker recovery password was not backed up, and the usual user of the laptop is not available to provide the password. + +### Resolution + +You can use either of the following methods to manually back up or synchronize an online client's existing recovery information: + +- Create a Windows Management Instrumentation (WMI) script that backs up the information. For more information, see [BitLocker Drive Encryption Provider](https://docs.microsoft.com/windows/win32/secprov/bitlocker-drive-encryption-provider). + +- In an elevated Command Prompt window, use the [manage-bde](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde) command to back up the information. + + For example, to back up all of the recovery information for the C: drive to AD DS, open an elevated Command Prompt window and run the following command: + + ```cmd + manage-bde -protectors -adbackup C: + ``` + +> [!NOTE] +> BitLocker does not automatically manage this backup process. + +## Tablet devices do not support using Manage-bde -forcerecovery to test recovery mode + +You have a tablet or slate device, and you try to test BitLocker Recovery by running the following command: + +```cmd +Manage-bde -forcerecovery +``` + +However, after you enter the recovery password, the device cannot start. + +### Cause + +> [!IMPORTANT] +> Tablet devices do not support the **manage-bde -forcerecovery** command. + +This issue occurs because the Windows Boot Manager cannot process touch input during the pre-boot phase of startup. If Boot Manager detects that the device is a tablet, it redirects the startup process to the Windows Recovery Environment (WinRE), which can process touch input. + +If WindowsRE detects the TPM protector on the hard disk, it does a PCR reseal. However, the **manage-bde -forcerecovery** command deletes the TPM protectors on the hard disk. Therefore, WinRE cannot reseal the PCRs. This failure triggers an infinite BitLocker recovery cycle and prevents Windows from starting. + +This behavior is by design for all versions of Windows. + +### Workaround + +To resolve the restart loop, follow these steps: + +1. On the BitLocker Recovery screen, select **Skip this drive**. +1. Select **Troubleshoot** \> **Advanced Options** \> **Command Prompt**. +1. In the Command Prompt window, run the following commands : + ```cmd + manage-bde –unlock C: -rp <48-digit BitLocker recovery password> + manage-bde -protectors -disable C: + ``` +1. Close the Command Prompt window. +1. Shut down the device. +1. Start the device. Windows should start as usual. + +## After you install UEFI or TPM firmware updates on Surface, BitLocker prompts for the recovery password + +You have a Surface device that has BitLocker Drive Encryption turned on. You update the firmware of the device TPM or install an update that changes the signature of the system firmware. For example, you install the Surface TPM (IFX) update. + +You experience one or more of the following symptoms on the Surface device: + +- At startup, you are prompted for your BitLocker recovery password. You enter the correct recovery password, but Windows doesn’t start up. +- Startup progresses directly into the Surface Unified Extensible Firmware Interface (UEFI) settings. +- The Surface device appears to be in an infinite restart loop. + +### Cause + +This issue occurs if the Surface device TPM is configured to use Platform Configuration Register (PCR) values other than the default values of PCR 7 and PCR 11. For example, the following settings can configure the TPM this way: + +- Secure Boot is turned off. +- PCR values have been explicitly defined, such as by Group Policy. + +Devices that support Connected Standby (also known as *InstantGO* or *Always On, Always Connected PCs*), including Surface devices, must use PCR 7 of the TPM. In its default configuration on such systems, BitLocker binds to PCR 7 and PCR 11 if PCR 7 and Secure Boot are correctly configured. For more information, see "About the Platform Configuration Register (PCR)" at [BitLocker Group Policy Settings](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj679890(v=ws.11)#about-the-platform-configuration-register-pcr)). + +### Resolution + +To verify the PCR values that are in use on a device, open and elevated Command Prompt window and run the following command: + +```cmd +manage-bde.exe -protectors -get : +``` + +In this command, <*OSDriveLetter*> represents the drive letter of the operating system drive. + +To resolve this issue and repair the device, follow these steps. + +#### Step 1: Disable the TPM protectors on the boot drive + +If you have installed a TPM or UEFI update and your device cannot start, even if you enter the correct BitLocker recovery password, you can restore the ability to start by using the BitLocker recovery password and a Surface recovery image to remove the TPM protectors from the boot drive. + +To do this, follow these steps: + +1. Obtain your BitLocker recovery password from [your Microsoft.com account](https://account.microsoft.com/devices/recoverykey). If BitLocker is managed by a different method, such as Microsoft BitLocker Administration and Monitoring (MBAM), contact your administrator for help. +1. Use another computer to download the Surface recovery image from [Download a recovery image for your Surface](https://support.microsoft.com/surfacerecoveryimage). Use the downloaded image to create a USB recovery drive. +1. Insert the USB Surface recovery image drive into the Surface device, and start the device. +1. When you are prompted, select the following items: + 1. Your operating system language. + 1. Your keyboard layout. +1. Select **Troubleshoot** > **Advanced Options** > **Command Prompt**. +1. In the Command Prompt window, run the following commands: + ```cmd + manage-bde -unlock -recoverypassword : + manage-bde -protectors -disable : + ``` + In these commands, \<*Password*\> is the BitLocker recovery password that you obtained in step 1, and \<*DriveLetter*> is the drive letter that is assigned to your operating system drive. + > [!NOTE] + > For more information about how to use this command, see [manage-bde: unlock](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde-unlock). +1. Restart the computer. +1. When you are prompted, enter the BitLocker recovery password that you obtained in step 1. + +> [!NOTE] +> After you disable the TPM protectors, BitLocker Drive Encryption no longer protects your device. To re-enable BitLocker Drive Encryption, select **Start**, type **Manage BitLocker**, and then press Enter. Follow the steps to encrypt your drive. + +#### Step 2: Use Surface BMR to recover data and reset your device + +To recover data from your Surface device if you cannot start Windows, follow steps 1 through 5 of [Step 1](#step-1) to return to the Command Prompt window, and then follow these steps: + +1. At the command prompt, run the following command: + ```cmd + manage-bde -unlock -recoverypassword : + ``` + In this command, \<*Password*\> is the BitLocker recovery password that you obtained in step 1 of [Step 1](#step-1), and \<*DriveLetter*> is the drive letter that is assigned to your operating system drive. +1. After the drive is unlocked, use the **copy** or **xcopy** command to copy the user data to another drive. + > [!NOTE] + > For more information about the these commands, see the [Windows commands](https://docs.microsoft.com/windows-server/administration/windows-commands/windows-commands). + +1. To reset your device by using a Surface recovery image, follow the instructions in the "How to reset your Surface using your USB recovery drive" section in [Creating and using a USB recovery drive](https://support.microsoft.com/help/4023512). + +#### Step 3: Restore the default PCR values + +To prevent this issue from recurring, we strongly recommend that you restore the default configuration of Secure Boot and the PCR values. + +To enable Secure Boot on a Surface device, follow these steps: + +1. Suspend BitLocker. to do this, open an elevated Windows PowerShell window, and run the following cmdlet: + ```ps + Suspend-BitLocker -MountPoint ":" -RebootCount 0 + ``` + In this command, <*DriveLetter*> is the letter that is assigned to your drive. +1. Restart the device, and then edit the BIOS to set the **Secure Boot** option to **Microsoft Only**. +1. Restart the device. +1. Open an elevated PowerShell window, and run the following cmdlet: + ```ps + Resume-BitLocker -MountPoint ":" + ``` + +To reset the PCR settings on the TPM, follow these steps: + +1. Disable any Group Policy Objects that configure the PCR settings, or remove the device from any groups that enforce such policies. + For more information, see [BitLocker Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings). +1. Suspend BitLocker. To do this, open an elevated Windows PowerShell window, and run the following cmdlet: + ```ps + Suspend-BitLocker -MountPoint ":" -RebootCount 0 + ``` + + where <*DriveLetter*> is the letter assigned to your drive. +1. Run the following cmdlet: + ```ps + Resume-BitLocker -MountPoint ":" + +#### Step 4: Suspend BitLocker during TPM or UEFI firmware updates + +You can avoid this scenario when you install updates to system firmware or TPM firmware by temporarily suspending BitLocker before you apply such updates. + +> [!IMPORTANT] +> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps) and set the **Reboot Count** parameter to either of the following values: +> - **2** or greater: This value sets the number of times the device can restart before BitLocker Device Encryption resumes. +> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps) or another mechanism to resume protection. + +To suspend BitLocker while you install TPM or UEFI firmware updates: + +1. Open an elevated Windows PowerShell window, and run the following cmdlet: + ```ps + Suspend-BitLocker -MountPoint ":" -RebootCount 0 + ``` + In this cmdlet <*DriveLetter*> is the letter that is assigned to your drive. +1. Install the Surface device driver and firmware updates. +1. After you install the firmware updates, restart the computer, open an elevated PowerShell window, and then run the following cmdlet: + ```ps + Resume-BitLocker -MountPoint ":" + ``` + +To re-enable BitLocker Drive Encryption, select **Start**, type **Manage BitLocker**, and then press Enter. Follow the steps to encrypt your drive. + +## After you install an update to a Hyper V-enabled computer, BitLocker prompts for the recovery password and returns error 0xC0210000 + +You have a device that runs Windows 10, version 1703, Windows 10, version 1607, or Windows Server 2016. Also, Hyper-V is enabled on the device. After you install an affected update and restart the device, the device enters BitLocker Recovery mode and you see error code 0xC0210000. + +### Workaround + +If your device is already in this state, you can successfully start Windows after suspending BitLocker from the Windows Recovery Environment (WinRE). To do this, follow these steps: + +1. Retrieve the 48-digit BitLocker recovery password for the operating system drive from your organization's portal or from wherever the password was stored when BitLocker Drive Encryption was first turned on. +1. On the Recovery screen, press Enter. When you are prompted, enter the recovery password. +1. If your device starts in the (WinRE) and prompts you for the recovery password again, select **Skip the drive**. +1. Select **Advanced options** > **Troubleshoot** > **Advanced options** > **Command Prompt**. +1. In the Command Prompt window, run the following commands: + ```cmd + Manage-bde -unlock c: -rp <48 digit numerical recovery password separated by “-“ in 6 digit group> + Manage-bde -protectors -disable c: + exit + ``` + + These commands unlock the drive and then suspend BitLocker by disabling the TPM protectors on the drive. The final command closes the Command Prompt window. + > [!NOTE] + > These commands suspend BitLocker for one restart of the device. The **-rc 1** option works only inside the operating system and does not work in the recovery environment. +1. Select **Continue**. Windows should start. +1. After Windows has started, open an elevated Command Prompt window and run the following command: + ```cmd + Manage-bde -protectors -enable c: + ``` + +> [!IMPORTANT] +> Unless you suspend BitLocker before you start the device, this issue recurs. + +To temporarily suspend BitLocker just before you restart the device, open an elevated Command Prompt window and run the following command: + +```cmd +Manage-bde -protectors -disable c: -rc 1 +``` + +### Resolution + +To resolve this issue, install the appropriate update on the affected device: + +- For Windows 10, version 1703: [July 9, 2019—KB4507450 (OS Build 15063.1928)](https://support.microsoft.com/help/4507450/windows-10-update-kb4507450) +- For Windows 10, version 1607 and Windows Server 2016: [July 9, 2019—KB4507460 (OS Build 14393.3085)](https://support.microsoft.com/help/4507460/windows-10-update-kb4507460) + +## Credential Guard/Device Guard on TPM 1.2: At every restart, BitLocker prompts for the recovery password and returns error 0xC0210000 + +You have a device that uses TPM 1.2 and runs Windows 10, version 1809. Also, the device uses [Virtualization-based Security](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-vbs) features such as [Device Guard and Credential Guard](https://docs.microsoft.com/windows-hardware/drivers/bringup/device-guard-and-credential-guard). Every time that you start the device, the device enters BitLocker Recovery mode and you see error code 0xc0210000, and a message that resembles the following. + +> Recovery +> +> Your PC/Device needs to be repaired. +> A required file couldn't be accessed because your BitLocker key wasn't loaded correctly. +> +> Error code 0xc0210000 +> +> You'll need to use recovery tools. If you don't have any installation media (like a disc or USB device), contact your PC administrator or PC/Device manufacturer. + +### Cause + +TPM 1.2 does not support Secure Launch. For more information, see [System Guard Secure Launch and SMM protection: Requirements Met by System Guard Enabled Machines](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection\#requirements-met-by-system-guard-enabled-machines) + +For more information about this technology, see [Windows Defender System Guard: How a hardware-based root of trust helps protect Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) + +### Resolution + +To resolve this issue, do one of the following: + +- Remove any device that uses TPM 1.2 from any group that is subject to Group Policy Objects (GPOs) that enforce Secure Launch. +- Edit the **Turn On Virtualization Based Security** GPO to set **Secure Launch Configuration** to **Disabled**. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md new file mode 100644 index 0000000000..9e19de9f72 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md @@ -0,0 +1,114 @@ +--- +title: BitLocker and TPM other known issues +description: Describes common issues that relate directly to the TPM, and provides guidance for resolving those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +ms.custom: bitlocker +--- + +# BitLocker and TPM: other known issues + +This article describes common issues that relate directly to the Trusted Platform Module (TPM), and provides guidance to address these issues. + +## Azure AD: Windows Hello for Business and single sign-on do not work + +You have an Azure Active Directory (Azure AD)-joined client computer that cannot authenticate correctly. You experience one or more of the following symptoms: + +- Windows Hello for Business does not work. +- Conditional access fails. +- Single sign-on (SSO) does not work. + +Additionally, the computer logs an entry for Event ID 1026, which resembles the following: + +> Log Name: System +> Source: Microsoft-Windows-TPM-WMI +> Date: \ +> Event ID: 1026 +> Task Category: None +> Level: Information +> Keywords: +> User: SYSTEM +> Computer: \ +> Description: +> The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically.  To set up the TPM interactively use the TPM management console (Start-\>tpm.msc) and use the action to make the TPM ready. +> Error: The TPM is defending against dictionary attacks and is in a time-out period. +> Additional Information: 0x840000 + +### Cause + +This event indicates that the TPM is not ready or has some setting that prevents access to the TPM keys. + +Additionally, the behavior indicates that the client computer cannot obtain a [Primary Refresh Token (PRT)](https://docs.microsoft.com/azure/active-directory/devices/concept-primary-refresh-token). + +### Resolution + +To verify the status of the PRT, use the [dsregcmd /status command](https://docs.microsoft.com/azure/active-directory/devices/troubleshoot-device-dsregcmd) to collect information. In the tool output, verify that either **User state** or **SSO state** contains the **AzureAdPrt** attribute. If the value of this attribute is **No**, the PRT was not issued. This may indicate that the computer could not present its certificate for authentication. + +To resolve this issue, follow these steps to troubleshoot the TPM: + +1. Open the TPM management console (tpm.msc). To do this, select **Start**, and enter **tpm.msc** in the **Search** box. +1. If you see a notice to either unlock the TPM or reset the lockout, follow those instructions. +1. If you do not see such a notice, review the BIOS settings of the computer for any setting that you can use to reset or disable the lockout. +1. Contact the hardware vendor to determine whether there is a known fix for the issue. +1. If you still cannot resolve the issue, clear and re-initialize the TPM. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm). + > [!WARNING] + > Clearing the TPM can cause data loss. + +## TPM 1.2 Error: Loading the management console failed. The device that is required by the cryptographic provider is not ready for use + +You have a Windows 10 version 1703-based computer that uses TPM version 1.2. When you try to open the TPM management console, you receive a message that resembles the following: + +> Loading the management console failed. The device that is required by the cryptographic provider is not ready for use. +> HRESULT 0x800900300x80090030 - NTE\_DEVICE\_NOT\_READY +> The device that is required by this cryptographic provider is not ready for use. +> TPM Spec version: TPM v1.2 + +On a different device that is running the same version of Windows, you can open the TPM management console. + +### Cause (suspected) + +These symptoms indicate that the TPM has hardware or firmware issues. + +### Resolution + +To resolve this issue, switch the TPM operating mode from version 1.2 to version 2.0. + +If this does not resolve the issue, consider replacing the device motherboard. After you replace the motherboard, switch the TPM operating mode from version 1.2 to version 2.0. + +## Devices do not join hybrid Azure AD because of a TPM issue + +You have a device that you are trying to join to a hybrid Azure AD. However, the join operation appears to fail. + +To verify that the join succeeded, use the [dsregcmd /status command](https://docs.microsoft.com/azure/active-directory/devices/troubleshoot-device-dsregcmd). In the tool output, the following attributes indicate that the join succeeded: + +- **AzureAdJoined: YES** +- **DomainName: \<*on-prem Domain name*\>** + +If the value of **AzureADJoined** is **No**, the join failed. + +### Causes and Resolutions + +This issue may occur when the Windows operating system is not the owner of the TPM. The specific fix for this issue depends on which errors or events you experience, as shown in the following table: + +|Message |Reason | Resolution| +| - | - | - | +|NTE\_BAD\_KEYSET (0x80090016/-2146893802) |TPM operation failed or was invalid |This issue was probably caused by a corrupted sysprep image. Make sure that you create the sysprep image by using a computer that is not joined to or registered in Azure AD or hybrid Azure AD. | +|TPM\_E\_PCP\_INTERNAL\_ERROR (0x80290407/-2144795641) |Generic TPM error. |If the device returns this error, disable its TPM. Windows 10, version 1809 and later versions automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | +|TPM\_E\_NOTFIPS (0x80280036/-2144862154) |The FIPS mode of the TPM is currently not supported. |If the device gives this error, disable its TPM. Windows 10, version 1809 and later versions automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | +|NTE\_AUTHENTICATION\_IGNORED (0x80090031/-2146893775) |The TPM is locked out. |This error is transient. Wait for the cooldown period, and then retry the join operation. | + +For more information about TPM issues, see the following articles: + +- [TPM fundamentals: Anti-hammering](https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals#anti-hammering) +- [Troubleshooting hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current) +- [Troubleshoot the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm) diff --git a/windows/security/information-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md index cf637532f1..d9b80efe97 100644 --- a/windows/security/information-protection/encrypted-hard-drive.md +++ b/windows/security/information-protection/encrypted-hard-drive.md @@ -4,7 +4,7 @@ description: Encrypted Hard Drive uses the rapid encryption that is provided by ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/images/device_details_tab_1903.png b/windows/security/information-protection/images/device_details_tab_1903.png new file mode 100644 index 0000000000..beb0337379 Binary files /dev/null and b/windows/security/information-protection/images/device_details_tab_1903.png differ diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md index e17bd5c51b..e72f8d6c68 100644 --- a/windows/security/information-protection/index.md +++ b/windows/security/information-protection/index.md @@ -1,11 +1,12 @@ --- title: Information protection (Windows 10) -description: Learn more about how to protect sesnsitive data across your ogranization. +description: Learn more about how to protect sensitive data across your organization. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -21,7 +22,7 @@ Learn more about how to secure documents and other data across your organization |-|-| | [BitLocker](bitlocker/bitlocker-overview.md)| Provides information about BitLocker, which is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. | | [Encrypted Hard Drive](encrypted-hard-drive.md)| Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. | -| [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md)| Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. | +| [Kernel DMA Protection](kernel-dma-protection-for-thunderbolt.md)| Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to PCI accessible ports, such as Thunderbolt™ 3 ports. | | [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection/protect-enterprise-data-using-wip.md)|Provides info about how to create a Windows Information Protection policy that can help protect against potential corporate data leakage.| | [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)| Windows 10 supports features to help prevent rootkits and bootkits from loading during the startup process. | | [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. | diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 53bf9b0641..74e8c2d67c 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -1,12 +1,12 @@ --- -title: Kernel DMA Protection for Thunderbolt™ 3 (Windows 10) +title: Kernel DMA Protection (Windows 10) description: Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -15,17 +15,18 @@ ms.date: 03/26/2019 ms.reviewer: --- -# Kernel DMA Protection for Thunderbolt™ 3 +# Kernel DMA Protection **Applies to** - Windows 10 -In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. +In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to externally accessible PCIe ports (e.g., Thunderbolt™ 3 ports and CFexpress). In Windows 10 version 1903, Microsoft expanded the Kernel DMA Protection support to cover internal PCIe ports (e.g., M.2 slots) + Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely. This feature does not protect against DMA attacks via 1394/FireWire, PCMCIA, CardBus, ExpressCard, and so on. -For Thunderbolt DMA protection on earlier Windows versions and other platforms that lack support for Kernel DMA Protection, please refer to [Intel Thunderbolt™ 3 Security documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf). +For Thunderbolt DMA protection on earlier Windows versions and platforms that lack support for Kernel DMA Protection, please refer to [Intel Thunderbolt™ 3 Security documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf). ## Background @@ -33,9 +34,10 @@ PCI devices are DMA-capable, which allows them to read and write to system memor The DMA capability is what makes PCI devices the highest performing devices available today. These devices have historically existed only inside the PC chassis, either connected as a card or soldered on the motherboard. Access to these devices required the user to turn off power to the system and disassemble the chassis. -Today, this is no longer the case with Thunderbolt™. -Thunderbolt™ technology has provided modern PCs with extensibility that was not available before for PCs. +Today, this is no longer the case with hot plug PCIe ports (e.g., Thunderbolt™ and CFexpress). + +Hot plug PCIe ports such as Thunderbolt™ technology have provided modern PCs with extensibility that was not available before for PCs. It allows users to attach new classes of external peripherals, such as graphics cards or other PCI devices, to their PCs with a hot plug experience identical to USB. Having PCI hot plug ports externally and easily accessible makes PCs susceptible to drive-by DMA attacks. @@ -45,15 +47,15 @@ A simple example would be a PC owner leaves the PC for a quick coffee break, and ## How Windows protects against DMA drive-by attacks Windows leverages the system Input/Output Memory Management Unit (IOMMU) to block external peripherals from starting and performing DMA unless the drivers for these peripherals support memory isolation (such as DMA-remapping). -Peripherals with compatible drivers will be automatically enumerated, started and allowed to perform DMA to their assigned memory regions. -By default, peripherals with incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. +Peripherals with [DMA Remapping compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers) will be automatically enumerated, started and allowed to perform DMA to their assigned memory regions. + +By default, peripherals with DMA Remapping incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using the [DmaGuard MDM policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies). ## User experience ![Kernel DMA protection user experience](images/kernel-dma-protection-user-experience.png) -A peripheral that is incompatible with DMA-remapping will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. -Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. +By default, peripherals with DMA remapping compatible device drivers will be automatically enumerated and started. Peripherals with DMA Remapping incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or logs out of the system. ## System compatibility @@ -73,23 +75,31 @@ Systems running Windows 10 version 1803 that do support Kernel DMA Protection do ### Using Security Center -Beginning with Wndows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. +Beginning with Windows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. ![Kernel DMA protection in Security Center](bitlocker/images/kernel-dma-protection-security-center.png) ### Using System information 1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar. + 2. Check the value of **Kernel DMA Protection**. + ![Kernel DMA protection in System Information](bitlocker/images/kernel-dma-protection.png) -3. If the current state of **Kernel DMA Protection** is OFF and **Virtualization Technology in Firmware** is NO: + +3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO: + - Reboot into BIOS settings - Turn on Intel Virtualization Technology. - Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md). - Reboot system into Windows 10. + + >[!NOTE] + > **Hyper-V - Virtualization Enabled in Firmware** is not available when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is displayed. This means that **Hyper-V - Virtualization Enabled in Firmware** is set to Yes and the **Hyper-V** Windows feature is enabled. Enabling Hyper-V virtualization in Firmware (IOMMU) is required to enable **Kernel DMA Protection**, even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-kernel-dma-protection). + 4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature. -For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. + For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. ## Frequently asked questions @@ -100,21 +110,30 @@ In-market systems, released with Windows 10 version 1709 or earlier, will not su No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It is the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt™ 3 ports during boot. ### How can I check if a certain driver supports DMA-remapping? -DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. +DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (i.e. the device driver does not support DMA-remapping). Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). +![Kernel DMA protection user experience](images/device_details_tab_1903.png) + *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. ![Kernel DMA protection user experience](images/device-details-tab.png) -### What should I do if the drivers for my Thunderbolt™ 3 peripherals do not support DMA-remapping? -If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support this functionality. Details for driver compatibility requirements can be found at the [Microsoft Partner Center](https://partner.microsoft.com/dashboard/collaborate/packages/4142). +### What should I do if the drivers for my PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? + +If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support [DMA Remapping](https://docs.microsoft.com/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers). + +### My system's Kernel DMA Protection is off. Can DMA-remapping for a specific device be turned on? + +Yes. DMA remapping for a specific device can be turned on independent from Kernel DMA Protection. For example, if the driver opts in and VT-d (Virtualization Technology for Directed I/O) is turned on, then DMA remapping will be enabled for the devices driver even if Kernel DMA Protection is turned off. + +Kernel DMA Protection is a policy that allows or blocks devices to perform DMA, based on their remapping state and capabilities. ### Do Microsoft drivers support DMA-remapping? -In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers and Storage NVMe Controllers support DMA-remapping. +In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers and Storage NVMe Controllers support DMA Remapping. ### Do drivers for non-PCI devices need to be compatible with DMA-remapping? -No. Devices for non-PCI peripherals, such as USB devices, do not perform DMA, thus no need for the driver to be compatible with DMA-remapping. +No. Devices for non-PCI peripherals, such as USB devices, do not perform DMA, thus no need for the driver to be compatible with DMA Remapping. ### How can an enterprise enable the External device enumeration policy? The External device enumeration policy controls whether to enumerate external peripherals that are not compatible with DMA-remapping. Peripherals that are compatible with DMA-remapping are always enumerated. Peripherals that don't can be blocked, allowed, or allowed only after the user signs in (default). diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 2090fe9ea8..d3ff0fb615 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -14,7 +14,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 11/16/2018 ms.reviewer: -ms.author: dolmont +ms.author: dansimp --- # Secure the Windows 10 boot process @@ -25,7 +25,7 @@ ms.author: dolmont The Windows operating system has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, the Windows 10 operating system includes a series of security features that can mitigate the impact. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings. -Windows 10 has multiple levels of protection for desktop apps and data, too. Windows Defender uses signatures to detect and quarantine apps that are known to be malicious. The SmartScreen Filter warns users before allowing them to run an untrustworthy app, even if it’s recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. +Windows 10 has multiple levels of protection for desktop apps and data, too. Windows Defender uses signatures to detect and quarantine apps that are known to be malicious. Windows Defender SmartScreen warns users before allowing them to run an untrustworthy app, even if it’s recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. Those are just some of the ways that Windows 10 protects you from malware. However, those security features protect you only after Windows 10 starts. Modern malware—and bootkits specifically—are capable of starting before Windows, completely bypassing operating system security, and remaining completely hidden. @@ -80,11 +80,11 @@ All x86-based Certified For Windows 10 PCs must meet several requirements relat These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems: -- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to . +- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to . - **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems. - **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however. -To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. For more information about Secure Boot, read the blog, [Protecting the pre-OS environment with UEFI](https://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx). +To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. Like most mobile devices, ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system. Fortunately, there is a large market of ARM devices designed to run other operating systems. @@ -96,7 +96,7 @@ Because Secure Boot has protected the bootloader and Trusted Boot has protected Early Launch Anti-Malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it. -An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://www.microsoft.com/en-us/server-cloud/system-center/endpoint-protection-2012.aspx) and several non-Microsoft anti-malware apps. +An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://docs.microsoft.com/lifecycle/products/microsoft-system-center-2012-endpoint-protection) and several non-Microsoft anti-malware apps. ## Measured Boot If a PC in your organization does become infected with a rootkit, you need to know about it. Enterprise anti-malware apps can report malware infections to the IT department, but that doesn’t work with rootkits that hide their presence. In other words, you can’t trust the client to tell you whether it’s healthy. @@ -129,4 +129,4 @@ Measured Boot uses the power of UEFI, TPM, and Windows 10 to give you a way to Secure Boot, Trusted Boot, and Measured Boot create an architecture that is fundamentally resistant to bootkits and rootkits. In Windows 10, these features have the potential to eliminate kernel-level malware from your network. This is the most ground-breaking anti-malware solution that Windows has ever had; it’s leaps and bounds ahead of everything else. With Windows 10, you can truly trust the integrity of your operating system. ## Additional resources -- [Windows 10 Enterprise Evaluation](https://technet.microsoft.com/evalcenter/hh699156.aspx?ocid=wc-tn-wctc) +- [Windows 10 Enterprise LTSC 2019 or v2004 Evaluation](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) diff --git a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md index 090906ffce..3e3fdfd9b5 100644 --- a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md index 39e3573cd8..1cb7f1c281 100644 --- a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md +++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index fbb2f028fd..c802bfae51 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md index 8e25014ef9..cf6d045df3 100644 --- a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/manage-tpm-commands.md b/windows/security/information-protection/tpm/manage-tpm-commands.md index 5a388b1fc3..bd30e9b8f2 100644 --- a/windows/security/information-protection/tpm/manage-tpm-commands.md +++ b/windows/security/information-protection/tpm/manage-tpm-commands.md @@ -3,7 +3,7 @@ title: Manage TPM commands (Windows 10) description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/tpm/manage-tpm-lockout.md b/windows/security/information-protection/tpm/manage-tpm-lockout.md index 05dbc34f16..37f9839c3e 100644 --- a/windows/security/information-protection/tpm/manage-tpm-lockout.md +++ b/windows/security/information-protection/tpm/manage-tpm-lockout.md @@ -3,7 +3,7 @@ title: Manage TPM lockout (Windows 10) description: This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.assetid: bf27adbe-404c-4691-a644-29ec722a3f7b ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index 7f618aa9ba..d9e1befbcd 100644 --- a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -1,6 +1,6 @@ --- title: Understanding PCR banks on TPM 2.0 devices (Windows 10) -description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. +description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE ms.reviewer: ms.prod: w10 @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md index 3d930a2334..e2ae8c85e5 100644 --- a/windows/security/information-protection/tpm/tpm-fundamentals.md +++ b/windows/security/information-protection/tpm/tpm-fundamentals.md @@ -1,6 +1,6 @@ --- title: TPM fundamentals (Windows 10) -description: This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. +description: Inform yourself about the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and how they are used to mitigate dictionary attacks. ms.assetid: ac90f5f9-9a15-4e87-b00d-4adcf2ec3000 ms.reviewer: ms.prod: w10 @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index a1a64bebe4..fb2784e2d5 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -20,8 +20,9 @@ ms.date: 11/29/2018 # TPM recommendations **Applies to** -- Windows 10 -- Windows Server 2016 + +- Windows 10 +- Windows Server 2016 This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. @@ -47,27 +48,27 @@ From an industry standard, Microsoft has been an industry leader in moving and s TPM 2.0 products and systems have important security advantages over TPM 1.2, including: -- The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. +- The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. -- For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. +- For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. -- TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. +- TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. - - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs do not support all algorithms. + - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs do not support all algorithms. - - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). + - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). - - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). + - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). - - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. + - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. -- TPM 2.0 offers a more **consistent experience** across different implementations. +- TPM 2.0 offers a more **consistent experience** across different implementations. - - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. + - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. - - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. + - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. -- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. +- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. @@ -78,11 +79,11 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in There are three implementation options for TPMs: -- Discrete TPM chip as a separate component in its own semiconductor package +- Discrete TPM chip as a separate component in its own semiconductor package -- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components +- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components -- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit +- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions which should suit all needs. @@ -94,39 +95,37 @@ For end consumers, TPM is behind the scenes but is still very relevant. TPM is u ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). +- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). ### IoT Core -- TPM is optional on IoT Core. +- TPM is optional on IoT Core. ### Windows Server 2016 -- TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. +- TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. ## TPM and Windows Features The following table defines which Windows features require TPM support. -| Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | -|-------------------------|--------------|--------------------|--------------------|----------| -| Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot | -| BitLocker | Yes | Yes | Yes | TPM 1.2 or 2.0 is required, but [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support | -| Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. | -| Windows Defender Application Control (Device Guard) | No | Yes | Yes | | -| Windows Defender Exploit Guard | No | N/A | N/A | | -| Windows Defender System Guard | Yes | No | Yes | | -| Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. | -| Device Health Attestation| Yes | Yes | Yes | | -| Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. | -| UEFI Secure Boot | No | Yes | Yes | | -| TPM Platform Crypto Provider Key Storage Provider| Yes | Yes| Yes | | -| Virtual Smart Card | Yes | Yes | Yes | | -| Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. | -| Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | -| SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | -| DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | - + Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | +-|-|-|-|- + Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot + BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support + Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. + Windows Defender Application Control (Device Guard) | No | Yes | Yes + Windows Defender System Guard | Yes | No | Yes + Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. + Device Health Attestation| Yes | Yes | Yes + Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. + UEFI Secure Boot | No | Yes | Yes + TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes + Virtual Smart Card | Yes | Yes | Yes + Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. + Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. + SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. + DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. ## OEM Status on TPM 2.0 system availability and certified parts diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index c3f0286d24..a6c748fa89 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -88,7 +88,7 @@ Some things that you can check on the device are: ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) -- [Details on the TPM standard](https://www.microsoft.com/en-us/research/project/the-trusted-platform-module-tpm/) (has links to features using TPM) +- [Details on the TPM standard](https://www.microsoft.com/research/project/the-trusted-platform-module-tpm/) (has links to features using TPM) - [TPM Base Services Portal](https://docs.microsoft.com/windows/desktop/TBS/tpm-base-services-portal) - [TPM Base Services API](https://docs.microsoft.com/windows/desktop/api/_tbs/) - [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule) diff --git a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md index 1fc294342f..d94485704c 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -41,7 +41,7 @@ This policy setting configured which TPM authorization values are stored in the |--------------|---------------|---------|-----------------|-----------------|------------------| | OwnerAuthAdmin | StorageOwnerAuth | Create SRK | No | Yes | Yes | | OwnerAuthEndorsement | EndorsementAuth | Create or use EK (1.2 only: Create AIK) | No | Yes | Yes | -| OwnerAuthFull | LockoutAuth | Reset/change Dictionary Attack Protection | No | No | No | +| OwnerAuthFull | LockoutAuth | Reset/change Dictionary Attack Protection | No | No | Yes | There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. @@ -131,16 +131,16 @@ Introduced in Windows 10, version 1703, this policy setting configures the TPM t > - Disable it from group policy > - Clear the TPM on the system -# TPM Group Policy settings in the Windows Security app +## TPM Group Policy settings in the Windows Security app You can change what users see about TPM in the Windows Security app. The Group Policy settings for the TPM area in the Windows Security app are located at: **Computer Configuration\\Administrative Templates\\Windows Components\\Windows Security\\Device security** -## Disable the Clear TPM button +### Disable the Clear TPM button If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it with this Group Policy setting. Select **Enabled** to make the **Clear TPM** button unavailable for use. -## Hide the TPM Firmware Update recommendation +### Hide the TPM Firmware Update recommendation If you don't want users to see the recommendation to update TPM firmware, you can disable it with this setting. Select **Enabled** to prevent users from seeing a recommendation to update their TPM firmware when a vulnerable firmware is detected. ## Related topics diff --git a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md index 3558bdf368..45c32cd7da 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md index f8bb770494..97733a4dd7 100644 --- a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md @@ -1,15 +1,14 @@ --- title: Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10) -description: How unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) networking policies, app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames. +description: Learn how unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) network policies, app configuration, and other criteria keywords: WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps ms.prod: w10 ms.mktglfcycl: explore -ms.pagetype: security ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -54,7 +53,7 @@ This table includes info about how unenlightened apps might behave, based on you Name-based policies, using the /*AppCompat*/ string or proxy-based policies - Not required. App connects to enterprise cloud resources directly, using an IP address. + Not required. App connects to enterprise cloud resources directly, using an IP address.
                  • App is entirely blocked from both personal and enterprise cloud resources.
                  • @@ -71,7 +70,7 @@ This table includes info about how unenlightened apps might behave, based on you - Not required. App connects to enterprise cloud resources, using a hostname. + Not required. App connects to enterprise cloud resources, using a hostname.
                    • App is blocked from accessing enterprise cloud resources, but can access other network resources.
                    • @@ -81,7 +80,7 @@ This table includes info about how unenlightened apps might behave, based on you - Allow. App connects to enterprise cloud resources, using an IP address or a hostname. + Allow. App connects to enterprise cloud resources, using an IP address or a hostname.
                      • App can access both personal and enterprise cloud resources.
                      • @@ -91,7 +90,7 @@ This table includes info about how unenlightened apps might behave, based on you - Exempt. App connects to enterprise cloud resources, using an IP address or a hostname. + Exempt. App connects to enterprise cloud resources, using an IP address or a hostname.
                        • App can access both personal and enterprise cloud resources.
                        • @@ -111,7 +110,7 @@ This table includes info about how enlightened apps might behave, based on your Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies - Not required. App connects to enterprise cloud resources, using an IP address or a hostname. + Not required. App connects to enterprise cloud resources, using an IP address or a hostname.
                          • App is blocked from accessing enterprise cloud resources, but can access other network resources.
                          • @@ -121,7 +120,7 @@ This table includes info about how enlightened apps might behave, based on your - Allow. App connects to enterprise cloud resources, using an IP address or a hostname. + Allow. App connects to enterprise cloud resources, using an IP address or a hostname.
                            • App can access both personal and enterprise cloud resources.
                            • @@ -131,7 +130,7 @@ This table includes info about how enlightened apps might behave, based on your - Exempt. App connects to enterprise cloud resources, using an IP address or a hostname. + Exempt. App connects to enterprise cloud resources, using an IP address or a hostname.
                              • App can access both personal and enterprise cloud resources.
                              • diff --git a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md index f38a7aa7c0..78edc9a59e 100644 --- a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md +++ b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md @@ -1,13 +1,13 @@ --- title: How to collect Windows Information Protection (WIP) audit event logs (Windows 10) -description: How to collect and understand your Windows Information Protection audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices only). +description: How to collect & understand Windows Information Protection audit event logs via the Reporting configuration service provider (CSP) or Windows Event Forwarding. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 704773750d..2bcfcf6622 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -1,5 +1,5 @@ --- -title: Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate (Windows 10) +title: Make & verify an EFS Data Recovery Agent certificate (Windows 10) description: Follow these steps to create, verify, and perform a quick recovery by using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection ms.prod: w10 @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -23,12 +23,12 @@ ms.reviewer: - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later -If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. +If you don't already have an EFS DRA certificate, you'll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we'll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. The recovery process included in this topic only works for desktop devices. WIP deletes the data on Windows 10 Mobile devices. >[!IMPORTANT] ->If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. For more info about when to use a PKI and the general strategy you should use to deploy DRA certificates, see the [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) article on TechNet. For more general info about EFS protection, see [Protecting Data by Using EFS to Encrypt Hard Drives](https://msdn.microsoft.com/library/cc875821.aspx).

                                If your DRA certificate has expired, you won’t be able to encrypt your files with it. To fix this, you'll need to create a new certificate, using the steps in this topic, and then deploy it through policy. +>If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. For more info about when to use a PKI and the general strategy you should use to deploy DRA certificates, see the [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) article on TechNet. For more general info about EFS protection, see [Protecting Data by Using EFS to Encrypt Hard Drives](https://msdn.microsoft.com/library/cc875821.aspx).

                                If your DRA certificate has expired, you won't be able to encrypt your files with it. To fix this, you'll need to create a new certificate, using the steps in this topic, and then deploy it through policy. ## Manually create an EFS DRA certificate @@ -47,13 +47,16 @@ The recovery process included in this topic only works for desktop devices. WIP >[!Important] >Because the private keys in your DRA .pfx files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing these files offline, keeping copies on a smart card with strong protection for normal use and master copies in a secured physical location. -4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager](create-wip-policy-using-sccm.md). +4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md). + +> [!NOTE] +> This certificate can be used in Intune for policies both _with_ device enrollment (MDM) and _without_ device enrollment (MAM). ## Verify your data recovery certificate is correctly set up on a WIP client computer -1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it’s encrypted by WIP. +1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it's encrypted by WIP. -2. Open an app on your protected app list, and then create and save a file so that it’s encrypted by WIP. +2. Open an app on your protected app list, and then create and save a file so that it's encrypted by WIP. 3. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: @@ -86,7 +89,7 @@ It's possible that you might revoke data from an unenrolled device only to later Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" * /EFSRAW - Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. + Where "*new_location*" is in a different directory. This can be on the employee's device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**. @@ -106,12 +109,12 @@ It's possible that you might revoke data from an unenrolled device only to later 4. Ask the employee to lock and unlock the device. - The Windows Credential service automatically recovers the employee’s previously revoked keys from the `Recovery\Input` location. + The Windows Credential service automatically recovers the employee's previously revoked keys from the `Recovery\Input` location. ## Auto-recovery of encryption keys Starting with Windows 10, version 1709, WIP includes a data recovery feature that lets your employees auto-recover access to work files if the encryption key is lost and the files are no longer accessible. This typically happens if an employee reimages the operating system partition, removing the WIP key info, or if a device is reported as lost and you mistakenly target the wrong device for unenrollment. -To help make sure employees can always access files, WIP creates an auto-recovery key that’s backed up to their Azure Active Directory (Azure AD) identity. +To help make sure employees can always access files, WIP creates an auto-recovery key that's backed up to their Azure Active Directory (Azure AD) identity. The employee experience is based on sign in with an Azure AD work account. The employee can either: @@ -144,7 +147,7 @@ After signing in, the necessary WIP key info is automatically downloaded and emp - [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) -- [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) +- [Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md) - [Creating a Domain-Based Recovery Agent](https://msdn.microsoft.com/library/cc875821.aspx#EJAA) diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index aeca37426f..6c672171ac 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -1,6 +1,6 @@ --- title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune (Windows 10) -description: After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to associate and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy. +description: After you've created and deployed your Windows Information Protection (WIP) policy, use Microsoft Intune to link it to your Virtual Private Network (VPN) policy keywords: WIP, Enterprise Data Protection ms.prod: w10 ms.mktglfcycl: explore @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md new file mode 100644 index 0000000000..49a57283b7 --- /dev/null +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md @@ -0,0 +1,515 @@ +--- +title: Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10) +description: Use Configuration Manager to make & deploy a Windows Information Protection (WIP) policy. Choose protected apps, WIP-protection level, and find enterprise data. +ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 +ms.reviewer: +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager, MEMCM, Microsoft Endpoint Configuration Manager +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: dulcemontemayor +ms.author: dansimp +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 01/09/2020 +--- + +# Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager +**Applies to:** + +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later +- Microsoft Endpoint Configuration Manager + +Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. + +## Add a WIP policy +After you've installed and set up Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. + +>[!TIP] +> Review the [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) article before creating a new configuration item to avoid common issues. + +**To create a configuration item for WIP** + +1. Open the Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. + + ![Configuration Manager, Configuration Items screen](images/wip-configmgr-addpolicy.png) + +2. Click the **Create Configuration Item** button.

                                +The **Create Configuration Item Wizard** starts. + + ![Create Configuration Item wizard, define the configuration item and choose the configuration type](images/wip-configmgr-generalscreen.png) + +3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. + +4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use Configuration Manager for device management, and then click **Next**. + + - **Settings for devices managed with the Configuration Manager client:** Windows 10 + + -OR- + + - **Settings for devices managed without the Configuration Manager client:** Windows 8.1 and Windows 10 + +5. On the **Supported Platforms** screen, click the **Windows 10** box, and then click **Next**. + + ![Create Configuration Item wizard, choose the supported platforms for the policy](images/wip-configmgr-supportedplat.png) + +6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**. + + ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/wip-configmgr-devicesettings.png) + +The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. + +## Add app rules to your policy + +During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. + +The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. + +>[!IMPORTANT] +>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

                                Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don't get this statement, it's possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. + +### Add a store app rule to your policy +For this example, we're going to add Microsoft OneNote, a store app, to the **App Rules** list. + +**To add a store app** + +1. From the **App rules** area, click **Add**. + + The **Add app rule** box appears. + + ![Create Configuration Item wizard, add a universal store app](images/wip-configmgr-adduniversalapp.png) + +2. Add a friendly name for your app into the **Title** box. In this example, it's *Microsoft OneNote*. + +3. Click **Allow** from the **Windows Information Protection mode** drop-down list. + + Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. + +4. Pick **Store App** from the **Rule template** drop-down list. + + The box changes to show the store app rule options. + +5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. + +If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. + +**To find the Publisher and Product Name values for Store apps without installing them** + +1. Go to the [Microsoft Store for Business](https://businessstore.microsoft.com/store) website, and find your app. For example, Microsoft OneNote. + + > [!NOTE] + > + > If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. + +2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. + +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. + + The API runs and opens a text editor with the app details. + + ``` json + { + "packageIdentityName": "Microsoft.Office.OneNote", + "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" + } + ``` + +4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune. + + > [!IMPORTANT] + > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that's using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as "CN=" followed by the `windowsPhoneLegacyId`.

                                For example:

                                + > ```json + > { + > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + > } + > ``` + +**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** +1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. + + >[!NOTE] + >Your PC and phone must be on the same wireless network. + +2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. + +3. On the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. + +4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. + +5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. + +6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. + +7. Start the app for which you're looking for the publisher and product name values. + +8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. + + > [!IMPORTANT] + > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that's using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as "CN=" followed by the `windowsPhoneLegacyId`. + > For example:

                                + > ```json + > { + > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + > } + > ``` + +### Add a desktop app rule to your policy +For this example, we're going to add Internet Explorer, a desktop app, to the **App Rules** list. + +**To add a desktop app to your policy** +1. From the **App rules** area, click **Add**. + + The **Add app rule** box appears. + + ![Create Configuration Item wizard, add a classic desktop app](images/wip-configmgr-adddesktopapp.png) + +2. Add a friendly name for your app into the **Title** box. In this example, it's *Internet Explorer*. + +3. Click **Allow** from the **Windows Information Protection mode** drop-down list. + + Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. + +4. Pick **Desktop App** from the **Rule template** drop-down list. + + The box changes to show the desktop app rule options. + +5. Pick the options you want to include for the app rule (see table), and then click **OK**. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                OptionManages
                                All fields left as "*"All files signed by any publisher. (Not recommended.)
                                Publisher selectedAll files signed by the named publisher.

                                This might be useful if your company is the publisher and signer of internal line-of-business apps.

                                Publisher and Product Name selectedAll files for the specified product, signed by the named publisher.
                                Publisher, Product Name, and Binary name selectedAny version of the named file or package for the specified product, signed by the named publisher.
                                Publisher, Product Name, Binary name, and File Version, and above, selectedSpecified version or newer releases of the named file or package for the specified product, signed by the named publisher.

                                This option is recommended for enlightened apps that weren't previously enlightened.

                                Publisher, Product Name, Binary name, and File Version, And below selectedSpecified version or older releases of the named file or package for the specified product, signed by the named publisher.
                                Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
                                + +If you're unsure about what to include for the publisher, you can run this PowerShell command: + +```ps1 +Get-AppLockerFileInformation -Path "" +``` +Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. + +In this example, you'd get the following info: + +``` json +Path Publisher +---- --------- +%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... +``` +Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. + +### Add an AppLocker policy file +For this example, we're going to add an AppLocker XML file to the **App Rules** list. You'll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content. + +**To create an app rule and xml file using the AppLocker tool** +1. Open the Local Security Policy snap-in (SecPol.msc). + +2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. + + ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) + +3. Right-click in the right-hand pane, and then click **Create New Rule**. + + The **Create Packaged app Rules** wizard appears. + +4. On the **Before You Begin** page, click **Next**. + + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) + +5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. + + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) + +6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. + + ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) + +7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we're using Microsoft Photos. + + ![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) + +8. On the updated **Publisher** page, click **Create**. + + ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) + +9. Review the Local Security Policy snap-in to make sure your rule is correct. + + ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) + +10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. + + The **Export policy** box opens, letting you export and save your new policy as XML. + + ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) + +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. + + The policy is saved and you'll see a message that says 1 rule was exported from the policy. + + **Example XML file**
                                + This is the XML file that AppLocker creates for Microsoft Photos. + + ```xml + + + + + + + + + + + + + + + + ``` +12. After you've created your XML file, you need to import it by using Configuration Manager. + +**To import your Applocker policy file app rule using Configuration Manager** + +1. From the **App rules** area, click **Add**. + + The **Add app rule** box appears. + + ![Create Configuration Item wizard, add an AppLocker policy](images/wip-configmgr-addapplockerfile.png) + +2. Add a friendly name for your app into the **Title** box. In this example, it's *Allowed app list*. + +3. Click **Allow** from the **Windows Information Protection mode** drop-down list. + + Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. + +4. Pick the **AppLocker policy file** from the **Rule template** drop-down list. + + The box changes to let you import your AppLocker XML policy file. + +5. Click the ellipsis (...) to browse for your AppLocker XML file, click **Open**, and then click **OK** to close the **Add app rule** box. + + The file is imported and the apps are added to your **App Rules** list. + +### Exempt apps from WIP restrictions +If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. + +**To exempt a store app, a desktop app, or an AppLocker policy file app rule** + +1. From the **App rules** area, click **Add**. + + The **Add app rule** box appears. + +2. Add a friendly name for your app into the **Title** box. In this example, it's *Exempt apps list*. + +3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. + + Be aware that when you exempt apps, they're allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. + +4. Fill out the rest of the app rule info, based on the type of rule you're adding: + + - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. + + - **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. + + - **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. + +5. Click **OK**. + +## Manage the WIP-protection level for your enterprise data +After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. + +We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. + +>[!NOTE] +>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + +|Mode |Description | +|-----|------------| +|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. | +|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would've been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| +|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

                                After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn't automatically reapplied if you turn WIP protection back on.| + +![Create Configuration Item wizard, choose your WIP-protection level](images/wip-configmgr-appmgmt.png) + +## Define your enterprise-managed identity domains +Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you've marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. + +You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (contoso.com|newcontoso.com). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list. + +**To add your corporate identity** + +- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. + + ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity](images/wip-configmgr-corp-identity.png) + +## Choose where apps can access enterprise data +After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. + +There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise's range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). + +>[!IMPORTANT] +>Every WIP policy should include policy that defines your enterprise network locations.
                                +>Classless Inter-Domain Routing (CIDR) notation isn't supported for WIP configurations. + +**To define where your protected apps can find and send enterprise data on you network** + +1. Add additional network locations your apps can access by clicking **Add**. + + The **Add or edit corporate network definition** box appears. + +2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. + + ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-configmgr-add-network-domain.png) + + + + + + + + + + + + + + + + + + + + + + + + + +
                                + + + + + + + + + + + + + + +
                                Network location typeFormatDescription
                                Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
                                contoso.visualstudio.com,contoso.internalproxy2.com

                                Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

                                Specify the cloud resources to be treated as corporate and protected by WIP.

                                For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

                                If you have multiple resources, you must separate them using the "|" delimiter. If you don't use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

                                Important
                                In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

                                Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

                                This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

                                If you have multiple resources, you must separate them using the "," delimiter.

                                Proxy serversproxy.contoso.com:80;proxy2.contoso.com:443Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.

                                This list shouldn't include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.

                                If you have multiple resources, you must separate them using the ";" delimiter.
                                Internal proxy serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.

                                This list shouldn't include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

                                If you have multiple resources, you must separate them using the ";" delimiter.
                                Enterprise IPv4 Range (Required)Starting IPv4 Address: 3.4.0.1
                                Ending IPv4 Address: 3.4.255.254
                                Custom URI: 3.4.0.1-3.4.255.254,
                                10.0.0.1-10.255.255.254
                                Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                If you have multiple ranges, you must separate them using the "," delimiter.

                                Enterprise IPv6 RangeStarting IPv6 Address: 2a01:110::
                                Ending IPv6 Address: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
                                Custom URI: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
                                fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
                                Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                If you have multiple ranges, you must separate them using the "," delimiter.

                                Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

                                These locations are considered enterprise or personal, based on the context of the connection before the redirection.

                                If you have multiple resources, you must separate them using the "," delimiter.

                                + +3. Add as many locations as you need, and then click **OK**. + + The **Add or edit corporate network definition** box closes. + +4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer. + + ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-configmgr-optsettings.png) + + - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option. + + - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option. + + - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option. + +5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. + + ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-configmgr-dra.png) + + After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees' local device drive. If somehow the employees' local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + + For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). + +## Choose your optional WIP-related settings +After you've decided where your protected apps can access enterprise data on your network, you'll be asked to decide if you want to add any optional WIP settings. + +![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-configmgr-additionalsettings.png) + +**To set your optional settings** +1. Choose to set any or all of the optional settings: + + - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: + + - **Yes (recommended).** Turns on the feature and provides the additional protection. + + - **No, or not configured.** Doesn't enable this feature. + + - **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: + + - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. + + - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. + + - **Revoke local encryption keys during the unenrollment process.** Determines whether to revoke a user's local encryption keys from a device when it's unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: + + - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. + + - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you're migrating between Mobile Device Management (MDM) solutions. + + - **Allow Azure RMS.** Enables secure sharing of files by using removable media such as USB drives. For more information about how RMS works with WIP, see [Create a WIP policy using Intune](create-wip-policy-using-intune-azure.md). To confirm what templates your tenant has, run [Get-AadrmTemplate](https://docs.microsoft.com/powershell/module/aadrm/get-aadrmtemplate) from the [AADRM PowerShell module](https://docs.microsoft.com/azure/information-protection/administer-powershell). If you don't specify a template, WIP uses a key from a default RMS template that everyone in the tenant will have access to. + +2. After you pick all of the settings you want to include, click **Summary**. + +## Review your configuration choices in the Summary screen +After you've finished configuring your policy, you can review all of your info on the **Summary** screen. + +**To view the Summary screen** +- Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy. + + ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-configmgr-summaryscreen.png) + + A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. + +## Deploy the WIP policy +After you've created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics: +- [Operations and Maintenance for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708224) + +- [How to Create Configuration Baselines for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708225) + +- [How to Deploy Configuration Baselines in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708226) + +## Related topics + +- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md) + +- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) + +- [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 85c7bfae87..7f89a245b5 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -1,12 +1,12 @@ --- title: Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune (Windows 10) -description: The Azure portal for Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, supporting mobile device management (MDM), to let you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +description: Learn how to use the Azure portal for Microsoft Intune to create and deploy your Windows Information Protection (WIP) policy to protect data on your network. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -30,7 +30,7 @@ You can create an app protection policy in Intune either with device enrollment - MAM has additional **Access** settings for Windows Hello for Business. - MAM can [selectively wipe company data](https://docs.microsoft.com/intune/apps-selective-wipe) from a user's personal device. -- MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). +- MAM requires an [Azure Active Directory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). - An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. - MAM supports only one user per device. - MAM can only manage [enlightened apps](enlightened-microsoft-apps-and-wip.md). @@ -40,7 +40,7 @@ You can create an app protection policy in Intune either with device enrollment ## Prerequisites -Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery relies on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. +Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Directory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery relies on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. ## Configure the MDM or MAM provider @@ -129,7 +129,8 @@ If you don't know the Store app publisher or product name, you can find them by If you need to add Windows 10 mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. ->**Note**
                                Your PC and phone must be on the same wireless network. +> [!NOTE] +> Your PC and phone must be on the same wireless network. 1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -160,7 +161,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo All fields marked as “*” - All files signed by any publisher. (Not recommended) + All files signed by any publisher. (Not recommended and may not work) Publisher only @@ -194,19 +195,19 @@ To add another Desktop app, click the ellipsis **…**. After you’ve entered t If you’re unsure about what to include for the publisher, you can run this PowerShell command: -```ps1 +```powershell Get-AppLockerFileInformation -Path "" ``` Where `""` goes to the location of the app on the device. For example: -```ps1 +```powershell Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe" ``` In this example, you'd get the following info: -``` +```console Path Publisher ---- --------- %PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US @@ -214,6 +215,8 @@ Path Publisher Where `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the **Publisher** name and `WORDPAD.EXE` is the **File** name. +Regarding to how to get the Product Name for the Apps you wish to Add, please reach out to our Windows Support Team to request the guidelines + ### Import a list of apps This section covers two examples of using an AppLocker XML file to the **Protected apps** list. You’ll use this option if you want to add multiple apps at the same time. @@ -277,28 +280,30 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com This is the XML file that AppLocker creates for Microsoft Dynamics 365. ```xml - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + ``` 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. ## Create an Executable rule for unsigned apps +The executable rule helps to create an AppLocker rule to sign any unsigned apps. It enables adding the file path or the app publisher contained in the file's digital signature needed for the WIP policy to be applied. + 1. Open the Local Security Policy snap-in (SecPol.msc). 2. In the left pane, click **Application Control Policies** > **AppLocker** > **Executable Rules**. @@ -331,6 +336,7 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. + **To import a list of protected apps using Microsoft Intune** 1. In **Protected apps**, click **Import apps**. @@ -424,7 +430,7 @@ Separate multiple resources with the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: -```code +```console URL <,proxy>|URL <,proxy> ``` @@ -437,7 +443,7 @@ In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the `/*AppCompat*/` string to the setting. For example: -```code +```console URL <,proxy>|URL <,proxy>/*AppCompat*/ ``` @@ -445,24 +451,24 @@ When you use this string, we recommend that you also turn on [Azure Active Direc Value format with proxy: -```code +```console contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com ``` Value format without proxy: -```code -contoso.sharepoint.com|contoso.visualstudio.com +```console +contoso.sharepoint.com,|contoso.visualstudio.com,|contoso.onedrive.com, ``` ### Protected domains Specify the domains used for identities in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. -Separate multiple domains with the "," delimiter. +Separate multiple domains with the "|" delimiter. -```code -exchange.contoso.com,contoso.com,region.contoso.com +```console +exchange.contoso.com|contoso.com|region.contoso.com ``` ### Network domains @@ -471,7 +477,7 @@ Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. Separate multiple resources with the "," delimiter. -```code +```console corp.contoso.com,region.contoso.com ``` @@ -484,7 +490,7 @@ This list shouldn’t include any servers listed in your Internal proxy servers Internal proxy servers must be used only for WIP-protected (enterprise) traffic. Separate multiple resources with the ";" delimiter. -```code +```console proxy.contoso.com:80;proxy2.contoso.com:443 ``` @@ -496,7 +502,7 @@ This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. Separate multiple resources with the ";" delimiter. -```code +```console contoso.internalproxy1.com;contoso.internalproxy2.com ``` @@ -535,7 +541,7 @@ Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection. Separate multiple resources with the "," delimiter. -```code +```console sts.contoso.com,sts.contoso2.com ``` @@ -587,14 +593,14 @@ After you've decided where your protected apps can access enterprise data on you **Use Azure RMS for WIP.** Determines whether WIP uses [Microsoft Azure Rights Management](https://products.office.com/business/microsoft-azure-rights-management) to apply EFS encryption to files that are copied from Windows 10 to USB or other removable drives so they can be securely shared amongst employees. In other words, WIP uses Azure Rights Management "machinery" to apply EFS encryption to files when they are copied to removable drives. You must already have Azure Rights Management set up. The EFS file encryption key is protected by the RMS template’s license. Only users with permission to that template will be able to read it from the removable drive. WIP can also integrate with Azure RMS by using the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings in the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp). -- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files. Curly braces {} are required around the RMS Template ID, but they are removed after you save the policy. +- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files. If you don’t specify an [RMS template](https://docs.microsoft.com/information-protection/deploy-use/configure-custom-templates), it’s a regular EFS file using a default RMS template that all users can access. - **Off, or not configured.** Stops WIP from encrypting Azure Rights Management files that are copied to a removable drive. ->[!NOTE] ->Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders. + > [!NOTE] + > Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders. **Allow Windows Search Indexer to search encrypted files.** Determines whether to allow the Windows Search Indexer to index items that are encrypted, such as WIP protected files. @@ -616,7 +622,7 @@ You can restrict which files are protected by WIP when they are downloaded from - [What is Azure Rights Management?](https://docs.microsoft.com/information-protection/understand-explore/what-is-azure-rms) -- [Create and deploy Windows Information Protection (WIP) app protection policy with Intune and MAM](https://docs.microsoft.com/intune/deploy-use/create-windows-information-protection-policy-with-intune) +- [Create a Windows Information Protection (WIP) protection policy using Microsoft Intune](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy) - [Intune MAM Without Enrollment](https://blogs.technet.microsoft.com/configmgrdogs/2016/02/04/intune-mam-without-enrollment/) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md deleted file mode 100644 index bd212a95e3..0000000000 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ /dev/null @@ -1,508 +0,0 @@ ---- -title: Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) -description: Configuration Manager (version 1606 or later) helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. -ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 -ms.reviewer: -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 05/13/2019 ---- - -# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager -**Applies to:** - -- Windows 10, version 1607 and later -- Windows 10 Mobile, version 1607 and later -- System Center Configuration Manager - -System Center Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. - -## Add a WIP policy -After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. - -**To create a configuration item for WIP** - -1. Open the System Center Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. - - ![System Center Configuration Manager, Configuration Items screen](images/wip-sccm-addpolicy.png) - -2. Click the **Create Configuration Item** button.

                                -The **Create Configuration Item Wizard** starts. - - ![Create Configuration Item wizard, define the configuration item and choose the configuration type](images/wip-sccm-generalscreen.png) - -3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. - -4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use System Center Configuration Manager for device management, and then click **Next**. - - - **Settings for devices managed with the Configuration Manager client:** Windows 10 - - -OR- - - - **Settings for devices managed without the Configuration Manager client:** Windows 8.1 and Windows 10 - -5. On the **Supported Platforms** screen, click the **Windows 10** box, and then click **Next**. - - ![Create Configuration Item wizard, choose the supported platforms for the policy](images/wip-sccm-supportedplat.png) - -6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**. - - ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/wip-sccm-devicesettings.png) - -The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. - -## Add app rules to your policy -During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. - -The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. - ->[!IMPORTANT] ->Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

                                Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. - -### Add a store app rule to your policy -For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. - -**To add a store app** - -1. From the **App rules** area, click **Add**. - - The **Add app rule** box appears. - - ![Create Configuration Item wizard, add a universal store app](images/wip-sccm-adduniversalapp.png) - -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. - -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. - -4. Pick **Store App** from the **Rule template** drop-down list. - - The box changes to show the store app rule options. - -5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. - -If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. - -**To find the Publisher and Product Name values for Store apps without installing them** - -1. Go to the [Microsoft Store for Business](https://businessstore.microsoft.com/store) website, and find your app. For example, Microsoft OneNote. - - > [!NOTE] - > - > If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. - -2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. - -3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. - - The API runs and opens a text editor with the app details. - - ``` json - { - "packageIdentityName": "Microsoft.Office.OneNote", - "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" - } - ``` - -4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune. - - > [!IMPORTANT] - > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.

                                For example:

                                - > ```json - > { - > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - > } - > ``` - -**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** -1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. - - >[!NOTE] - >Your PC and phone must be on the same wireless network. - -2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. - -3. On the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. - -4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. - -5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. - -6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. - -7. Start the app for which you're looking for the publisher and product name values. - -8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. - - > [!IMPORTANT] - > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. - > For example:

                                - > ```json - > { - > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - > } - > ``` - -### Add a desktop app rule to your policy -For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. - -**To add a desktop app to your policy** -1. From the **App rules** area, click **Add**. - - The **Add app rule** box appears. - - ![Create Configuration Item wizard, add a classic desktop app](images/wip-sccm-adddesktopapp.png) - -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. - -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. - -4. Pick **Desktop App** from the **Rule template** drop-down list. - - The box changes to show the desktop app rule options. - -5. Pick the options you want to include for the app rule (see table), and then click **OK**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                OptionManages
                                All fields left as “*”All files signed by any publisher. (Not recommended.)
                                Publisher selectedAll files signed by the named publisher.

                                This might be useful if your company is the publisher and signer of internal line-of-business apps.

                                Publisher and Product Name selectedAll files for the specified product, signed by the named publisher.
                                Publisher, Product Name, and Binary name selectedAny version of the named file or package for the specified product, signed by the named publisher.
                                Publisher, Product Name, Binary name, and File Version, and above, selectedSpecified version or newer releases of the named file or package for the specified product, signed by the named publisher.

                                This option is recommended for enlightened apps that weren't previously enlightened.

                                Publisher, Product Name, Binary name, and File Version, And below selectedSpecified version or older releases of the named file or package for the specified product, signed by the named publisher.
                                Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
                                - -If you’re unsure about what to include for the publisher, you can run this PowerShell command: - -```ps1 -Get-AppLockerFileInformation -Path "" -``` -Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. - -In this example, you'd get the following info: - -``` json -Path Publisher ----- --------- -%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... -``` -Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. - -### Add an AppLocker policy file -For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content. - -**To create an app rule and xml file using the AppLocker tool** -1. Open the Local Security Policy snap-in (SecPol.msc). - -2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - - ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) - -3. Right-click in the right-hand pane, and then click **Create New Rule**. - - The **Create Packaged app Rules** wizard appears. - -4. On the **Before You Begin** page, click **Next**. - - ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) - -5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. - - ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) - -6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. - - ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) - -7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos. - - ![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) - -8. On the updated **Publisher** page, click **Create**. - - ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) - -9. Review the Local Security Policy snap-in to make sure your rule is correct. - - ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) - -10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. - - The **Export policy** box opens, letting you export and save your new policy as XML. - - ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) - -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. - - The policy is saved and you’ll see a message that says 1 rule was exported from the policy. - - **Example XML file**
                                - This is the XML file that AppLocker creates for Microsoft Photos. - - ```xml - - - - - - - - - - - - - - - - ``` -12. After you’ve created your XML file, you need to import it by using System Center Configuration Manager. - -**To import your Applocker policy file app rule using System Center Configuration Manager** -1. From the **App rules** area, click **Add**. - - The **Add app rule** box appears. - - ![Create Configuration Item wizard, add an AppLocker policy](images/wip-sccm-addapplockerfile.png) - -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. - -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. - -4. Pick the **AppLocker policy file** from the **Rule template** drop-down list. - - The box changes to let you import your AppLocker XML policy file. - -5. Click the ellipsis (...) to browse for your AppLocker XML file, click **Open**, and then click **OK** to close the **Add app rule** box. - - The file is imported and the apps are added to your **App Rules** list. - -### Exempt apps from WIP restrictions -If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. - -**To exempt a store app, a desktop app, or an AppLocker policy file app rule** - -1. From the **App rules** area, click **Add**. - - The **Add app rule** box appears. - -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. - -3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. - - Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. - -4. Fill out the rest of the app rule info, based on the type of rule you’re adding: - - - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. - - - **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. - - - **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. - -5. Click **OK**. - -## Manage the WIP-protection level for your enterprise data -After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. - -We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. - ->[!NOTE] ->For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). - -|Mode |Description | -|-----|------------| -|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| -|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. | -|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| -|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

                                After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| - -![Create Configuration Item wizard, choose your WIP-protection level](images/wip-sccm-appmgmt.png) - -## Define your enterprise-managed identity domains -Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. - -You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (contoso.com|newcontoso.com). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list. - -**To add your corporate identity** - -- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. - - ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity](images/wip-sccm-corp-identity.png) - -## Choose where apps can access enterprise data -After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. - -There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). - ->[!IMPORTANT] ->Every WIP policy should include policy that defines your enterprise network locations.
                                ->Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations. - -**To define where your protected apps can find and send enterprise data on you network** - -1. Add additional network locations your apps can access by clicking **Add**. - - The **Add or edit corporate network definition** box appears. - -2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. - - ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-sccm-add-network-domain.png) - - - - - - - - - - - - - - - - - - - - - - - - - -
                                - - - - - - - - - - - - - - -
                                Network location typeFormatDescription
                                Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
                                contoso.visualstudio.com,contoso.internalproxy2.com

                                Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

                                Specify the cloud resources to be treated as corporate and protected by WIP.

                                For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

                                If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

                                Important
                                In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

                                Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

                                This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

                                If you have multiple resources, you must separate them using the "," delimiter.

                                Proxy serversproxy.contoso.com:80;proxy2.contoso.com:443Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

                                This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.

                                If you have multiple resources, you must separate them using the ";" delimiter.
                                Internal proxy serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

                                This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

                                If you have multiple resources, you must separate them using the ";" delimiter.
                                Enterprise IPv4 Range (Required)Starting IPv4 Address: 3.4.0.1
                                Ending IPv4 Address: 3.4.255.254
                                Custom URI: 3.4.0.1-3.4.255.254,
                                10.0.0.1-10.255.255.254
                                Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                If you have multiple ranges, you must separate them using the "," delimiter.

                                Enterprise IPv6 RangeStarting IPv6 Address: 2a01:110::
                                Ending IPv6 Address: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
                                Custom URI: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
                                fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
                                Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                If you have multiple ranges, you must separate them using the "," delimiter.

                                Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

                                These locations are considered enterprise or personal, based on the context of the connection before the redirection.

                                If you have multiple resources, you must separate them using the "," delimiter.

                                - -3. Add as many locations as you need, and then click **OK**. - - The **Add or edit corporate network definition** box closes. - -4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer. - - ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-sccm-optsettings.png) - - - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option. - - - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option. - - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option. - -5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - - ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-sccm-dra.png) - - After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. - - For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). - -## Choose your optional WIP-related settings -After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. - -![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-sccm-additionalsettings.png) - -**To set your optional settings** -1. Choose to set any or all of the optional settings: - - - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: - - - **Yes (recommended).** Turns on the feature and provides the additional protection. - - - **No, or not configured.** Doesn't enable this feature. - - - **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: - - - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. - - - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - - **Revoke local encryption keys during the unenrollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: - - - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. - - - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. - - - **Allow Azure RMS.** Enables secure sharing of files by using removable media such as USB drives. For more information about how RMS works with WIP, see [Create a WIP policy using Intune](create-wip-policy-using-intune-azure.md). To confirm what templates your tenant has, run [Get-AadrmTemplate](https://docs.microsoft.com/powershell/module/aadrm/get-aadrmtemplate) from the [AADRM PowerShell module](https://docs.microsoft.com/azure/information-protection/administer-powershell). If you don’t specify a template, WIP uses a key from a default RMS template that everyone in the tenant will have access to. - -2. After you pick all of the settings you want to include, click **Summary**. - -## Review your configuration choices in the Summary screen -After you've finished configuring your policy, you can review all of your info on the **Summary** screen. - -**To view the Summary screen** -- Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy. - - ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-sccm-summaryscreen.png) - - A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. - -## Deploy the WIP policy -After you’ve created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics: -- [Operations and Maintenance for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708224) - -- [How to Create Configuration Baselines for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708225) - -- [How to Deploy Configuration Baselines in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708226) - -## Related topics - -- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md) - -- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index cb68d68e93..42caa212cd 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 441e6d2b75..ebe3c59220 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -1,6 +1,6 @@ --- title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10) -description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. +description: Learn the difference between enlightened and unenlightened apps. Find out which enlightened apps are provided by Microsoft. Learn how to allow-list them. ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -43,6 +43,8 @@ Apps can be enlightened or unenlightened: ## List of enlightened Microsoft apps Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following: +- Microsoft 3D Viewer + - Microsoft Edge - Internet Explorer 11 @@ -51,7 +53,7 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar -- Office 365 ProPlus apps, including Word, Excel, PowerPoint, OneNote, and Outlook +- Microsoft 365 Apps for enterprise apps, including Word, Excel, PowerPoint, OneNote, and Outlook - OneDrive app @@ -69,22 +71,31 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Microsoft Messaging -- Microsoft Remote Desktop +- Microsoft Remote Desktop ->[!NOTE] ->Microsoft Visio and Microsoft Project are not enlightended apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioining. +- Microsoft To Do + +> [!NOTE] +> Microsoft Visio, Microsoft Office Access, Microsoft Project, and Microsoft Publisher are not enlightened apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioning. ## List of WIP-work only apps from Microsoft Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with WIP and MAM solutions. - Skype for Business +- Microsoft Teams (build 1.3.00.12058 and later) + ## Adding enlightened Microsoft apps to the allowed apps list -You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. + +> [!NOTE] +> As of January 2019 it is no longer necessary to add Intune Company Portal as an exempt app since it is now included in the default list of protected apps. + +You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and Microsoft Endpoint Configuration Manager. | Product name | App info | |------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Microsoft 3D Viewer | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Microsoft3DViewer
                                **App Type:** Universal app | | Microsoft Edge | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.MicrosoftEdge
                                **App Type:** Universal app | | Microsoft People | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.People
                                **App Type:** Universal app | | Word Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Office.Word
                                **App Type:** Universal app | @@ -92,18 +103,19 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li | PowerPoint Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Office.PowerPoint
                                **App Type:** Universal app | | OneNote | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Office.OneNote
                                **App Type:** Universal app | | Outlook Mail and Calendar | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** microsoft.windowscommunicationsapps
                                **App Type:** Universal app | -| Office 365 ProPlus and Office 2019 Professional Plus | Office 365 ProPlus and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
                                We don't recommend setting up Office by using individual paths or publisher rules. | +| Microsoft 365 Apps for enterprise and Office 2019 Professional Plus | Microsoft 365 Apps for enterprise and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
                                We don't recommend setting up Office by using individual paths or publisher rules. | | Microsoft Photos | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Windows.Photos
                                **App Type:** Universal app | | Groove Music | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.ZuneMusic
                                **App Type:** Universal app | | Microsoft Movies & TV | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.ZuneVideo
                                **App Type:** Universal app | | Microsoft Messaging | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Messaging
                                **App Type:** Universal app | | IE11 | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Binary Name:** iexplore.exe
                                **App Type:** Desktop app | | OneDrive Sync Client | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Binary Name:** onedrive.exe
                                **App Type:** Desktop app | -| OneDrive app | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Microsoftskydrive
                                Product Version:Product version: 17.21.0.0 (and later)
                                **App Type:** Universal app | +| OneDrive app | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Microsoftskydrive
                                Product Version:Product version: 17.21.0.0 (and later)
                                **App Type:** Universal app | | Notepad | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Binary Name:** notepad.exe
                                **App Type:** Desktop app | | Microsoft Paint | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Binary Name:** mspaint.exe
                                **App Type:** Desktop app | | Microsoft Remote Desktop | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Binary Name:** mstsc.exe
                                **App Type:** Desktop app | | Microsoft MAPI Repair Tool | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Binary Name:** fixmapi.exe
                                **App Type:** Desktop app | +| Microsoft To Do | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                **Product Name:** Microsoft.Todos
                                **App Type:** Store app | >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md index 78620f0447..576fe7cf71 100644 --- a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md +++ b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md @@ -1,6 +1,6 @@ --- title: General guidance and best practices for Windows Information Protection (WIP) (Windows 10) -description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP). +description: Find resources about apps that can work with Windows Information Protection (WIP) to protect data. Enlightened apps can tell corporate and personal data apart. ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0 ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md deleted file mode 100644 index 8205436cc7..0000000000 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: How Windows Information Protection (WIP) protects files with a sensitivity label (Windows 10) -description: Explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label. -keywords: sensitivity, labels, WIP, Windows Information Protection, EDP, Enterprise Data Protection -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 04/30/2019 -ms.reviewer: ---- - -# How Windows Information Protection (WIP) protects a file that has a sensitivity label - -**Applies to:** - -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows 10, version 1903 -- Windows 10, version 1809 - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -This topic explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label. -Microsoft information protection technologies work together as an integrated solution to help enterprises: - -- Discover corporate data on endpoint devices -- Classify and label information based on its content and context -- Protect corporate data from unintentionally leaving to non-business environments -- Enable audit reports of user interactions with corporate data on endpoint devices - -Microsoft information protection technologies include: - -- [Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) is built in to Windows 10 and protects local data at rest on endpoint devices, and manages apps to protect local data in use. Data that leaves the endpoint device, such as email attachment, is not protected by WIP. - -- [Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection) is a cloud-based solution that can be purchased either standalone or as part of Microsoft 365 Enterprise. It helps an organization classify and protect its documents and emails by applying labels. Azure Information Protection is applied directly to content, and roams with the content as it's moved between locations and cloud services. - -- [Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security) is a cloud access security broker (CASB) solution that allows you to discover, classify, protect, and monitor user data in first-party and third-party Software-as-a-Service (SaaS) apps used by your organization. - -## How WIP protects sensitivity labels with endpoint data loss prevention - -You can create and manage [sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) in the Microsoft 365 compliance center. -When you create a sensitivity label, you can specify that endpoint data loss prevention applies to content with that label. - -![Endpoint data loss prevention](images/sensitivity-label-endpoint-dlp.png) - -Office app users can choose a sensitivity label from a menu and apply it to a file. - -![Sensitivity labels](images/sensitivity-labels.png) - -WIP enforces default endpoint protection as follows: - -- If endpoint data loss prevention is enabled, the device enforces work protection for any file with the label -- If endpoint data loss prevention is not enabled: - - The device enforces work protection to a file downloaded from a work site - - The device does not enforce work protection to a file downloaded from a personal site - -Here's an example where a file remains protected without any work context beyond the sensitivity label: - -1. Sara creates a PDF file on a Mac and labels it as **Confidential**. -1. She emails the PDF from her Gmail account to Laura. -1. Laura opens the PDF file on her Windows 10 device. -1. Windows Defender Advanced Threat Protection (Windows Defender ATP) scans Windows 10 for any file that gets modified or created, including files that were created on a personal site. -1. Windows Defender ATP triggers WIP policy. -1. WIP policy protects the file even though it came from a personal site. - -## How WIP protects automatically classified files - -The next sections cover how Windows Defender ATP extends discovery and protection of sensitive information with improvements in Windows 10 version 1903. - -### Discovery - -Windows Defender ATP can extract the content of the file itself and evaluate whether it contains sensitive information types such as credit card numbers or employee ID numbers. -When you create a sensitivity label, you can specify that the label be added to any file that contains a sensitive information type. - -![Sensitivity labels](images/sensitivity-label-auto-label.png) - -A default set of [sensitive information types](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for) in Microsoft 365 compliance center includes credit card numbers, phone numbers, driver’s license numbers, and so on. -You can also [create a custom sensitive information type](https://docs.microsoft.com/office365/securitycompliance/create-a-custom-sensitive-information-type), which can include any keyword or expression that you want to evaluate. - -### Protection - -When a file is created or edited on a Windows 10 endpoint, Windows Defender ATP extracts the content and evaluates if it contains any default or custom sensitive information types that have been defined. -If the file has a match, Windows Defender ATP applies endpoint data loss prevention even if the file had no label previously. - -Windows Defender ATP is integrated with Azure Information Protection for data discovery and reports sensitive information types that were discovered. -Azure Information Protection aggregates the files with sensitivity labels and the sensitive information types they contain across the enterprise. - -![Image of Azure Information Protection - Data discovery](images/azure-data-discovery.png) - -You can see sensitive information types in Microsoft 365 compliance under **Classifications**. Default sensitive information types have Microsoft as the publisher. The publisher for custom types is the tenant name. - -![Sensitive information types](images/sensitive-info-types.png) - ->[!NOTE] ->Automatic classification does not change the file itself, but it applies protection based on the label. ->WIP protects a file that contains a sensitive information type as a work file. ->Azure Information Protection works differently in that it extends a file with a new attribute so the protection persists if the file is copied. - -## Prerequisites - -- Endpoint data loss prevention requires Windows 10, version 1809 -- Auto labelling requires Windows 10, version 1903 -- Devices need to be onboarded to [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection), which scans content for a label and applies WIP policy -- [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in Microsoft 365 compliance center -- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager (SCCM)](overview-create-wip-policy-sccm.md) - - - - - - - - - diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-add-network-domain.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-add-network-domain.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-add-network-domain.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-add-network-domain.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-addapplockerfile.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-addapplockerfile.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-addapplockerfile.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-addapplockerfile.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-adddesktopapp.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-adddesktopapp.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-additionalsettings.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-additionalsettings.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-addpolicy.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-addpolicy.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-addpolicy.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-addpolicy.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-adduniversalapp.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-adduniversalapp.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-appmgmt.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-appmgmt.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-corp-identity.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-corp-identity.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-corp-identity.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-corp-identity.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-devicesettings.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-devicesettings.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-devicesettings.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-devicesettings.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-dra.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-dra.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-dra.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-dra.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-generalscreen.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-generalscreen.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-network-domain.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-network-domain.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-network-domain.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-network-domain.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-optsettings.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-optsettings.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-summaryscreen.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-summaryscreen.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-summaryscreen.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-summaryscreen.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-supportedplat.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-supportedplat.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-supportedplat.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-supportedplat.png diff --git a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md index e9ee801003..c1cd7193c0 100644 --- a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security -author: dulcemontemayor -ms.author: dolmont +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -33,18 +33,18 @@ This table provides info about the most common problems you might encounter whil Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration. - If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

                                If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. + If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

                                If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

                                We strongly recommend educating employees about how to limit or eliminate the need for this decryption. Direct Access is incompatible with WIP. Direct Access might experience problems with how WIP enforces app behavior and data movement because of how WIP determines what is and isn’t a corporate network resource. - We recommend that you use VPN for client access to your intranet resources.

                                Note
                                VPN is optional and isn’t required by WIP. + We recommend that you use VPN for client access to your intranet resources.

                                Note
                                VPN is optional and isn’t required by WIP. - NetworkIsolation Group Policy setting takes precedence over MDM Policy settings. - The NetworkIsolation Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured. - If you use both Group Policy and MDM to configure your NetworkIsolation settings, you must make sure that those same settings are deployed to your organization using both Group Policy and MDM. + NetworkIsolation Group Policy setting takes precedence over MDM Policy settings. + The NetworkIsolation Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured. + If you use both Group Policy and MDM to configure your NetworkIsolation settings, you must make sure that those same settings are deployed to your organization using both Group Policy and MDM. Cortana can potentially allow data leakage if it’s on the allowed apps list. @@ -53,7 +53,7 @@ This table provides info about the most common problems you might encounter whil WIP is designed for use by a single user per device. - A secondary user on a device might experience app compat issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user’s content can be revoked during the unenrollment process. + A secondary user on a device might experience app compatibility issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user’s content can be revoked during the unenrollment process. We recommend only having one user per managed device. @@ -63,7 +63,7 @@ This table provides info about the most common problems you might encounter whil

                                • Start the installer directly from the file share.

                                  -OR-

                                • Decrypt the locally copied files needed by the installer.

                                  -OR-

                                • -
                                • Mark the file share with the installation media as “personal”. To do this, you’ll need to set the Enterprise IP ranges as Authoritative and then exclude the IP address of the file server, or you’ll need to put the file server on the Enterprise Proxy Server list.
                                • +
                                • Mark the file share with the installation media as “personal”. To do this, you’ll need to set the Enterprise IP ranges as Authoritative and then exclude the IP address of the file server, or you’ll need to put the file server on the Enterprise Proxy Server list.
                                @@ -74,17 +74,17 @@ This table provides info about the most common problems you might encounter whil Redirected folders with Client Side Caching are not compatible with WIP. Apps might encounter access errors while attempting to read a cached, offline file. - Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.

                                Note
                                For more info about Work Folders and Offline Files, see the blog, Work Folders and Offline Files support for Windows Information Protection. If you're having trouble opening files offline while using Offline Files and WIP, see the support article, Can't open files offline when you use Offline Files and Windows Information Protection. + Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.

                                Note
                                For more info about Work Folders and Offline Files, see the blog, Work Folders and Offline Files support for Windows Information Protection. If you're having trouble opening files offline while using Offline Files and WIP, see the support article, Can't open files offline when you use Offline Files and Windows Information Protection. An unmanaged device can use Remote Desktop Protocol (RDP) to connect to a WIP-managed device. -

                                Data copied from the WIP-managed device is marked as Work.

                                Data copied to the WIP-managed device is not marked as Work.

                                Local Work data copied to the WIP-managed device remains Work data.

                                Work data that is copied between two apps in the same session remains data. +

                                Data copied from the WIP-managed device is marked as Work.

                                Data copied to the WIP-managed device is not marked as Work.

                                Local Work data copied to the WIP-managed device remains Work data.

                                Work data that is copied between two apps in the same session remains data. Disable RDP to prevent access because there is no way to restrict access to only devices managed by WIP. RDP is disabled by default. You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer. - A message appears stating that the content is marked as Work and the user isn't given an option to override to Personal. - Open File Explorer and change the file ownership to Personal before you upload. + A message appears stating that the content is marked as Work and the user isn't given an option to override to Personal. + Open File Explorer and change the file ownership to Personal before you upload. ActiveX controls should be used with caution. @@ -97,7 +97,7 @@ This table provides info about the most common problems you might encounter whil Format drive for NTFS, or use a different drive. - WIP isn’t turned on if any of the following folders have the MakeFolderAvailableOfflineDisabled option set to False: + WIP isn’t turned on if any of the following folders have the MakeFolderAvailableOfflineDisabled option set to False:

                                • AppDataRoaming
                                • Desktop
                                • @@ -114,26 +114,49 @@ This table provides info about the most common problems you might encounter whil
                                • SavedGames
                                - WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using System Center Configuration Manager. - Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

                                If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see Can't open files offline when you use Offline Files and Windows Information Protection. + WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using Microsoft Endpoint Configuration Manager. + Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders. You can configure this parameter, as described here.

                                If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see Can't open files offline when you use Offline Files and Windows Information Protection. Only enlightened apps can be managed without device enrollment - If a user enrolls a device for Mobile Application Management (MAM) without device enrollment, only enlightened apps will be managed. This is by design to prevent personal files from being unintenionally encrypted by unenlighted apps. Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment. + If a user enrolls a device for Mobile Application Management (MAM) without device enrollment, only enlightened apps will be managed. This is by design to prevent personal files from being unintentionally encrypted by unenlighted apps. Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment. If all apps need to be managed, enroll the device for MDM. - By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encypted by one user, other users can't access it.
                                + By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encrypted by one user, other users can't access it.
                                Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner. If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it. + + + OneNote notebooks on OneDrive for Business must be properly configured to work with WIP. + OneNote might encounter errors syncing a OneDrive for Business notebook and suggest changing the file ownership to Personal. Attempting to view the notebook in OneNote Online in the browser will show an error and unable to view it. + "OneNote notebooks that are newly copied into the OneDrive for Business folder from File Explorer should get fixed automatically. To do this, follow these steps: +1. Close the notebook in OneNote. +2. Move the notebook folder via File Explorer out of the OneDrive for Business folder to another location, such as the Desktop. +3. Copy the notebook folder and Paste it back into the OneDrive for Business folder. + +Wait a few minutes to allow OneDrive to finish syncing & upgrading the notebook, and the folder should automatically convert to an Internet Shortcut. Opening the shortcut will open the notebook in the browser, which can then be opened in the OneNote client by using the “Open in app” button. + + + Microsoft Office Outlook offline data files (PST and OST files) are not marked as Work files, and are therefore not protected. + + If Microsoft Office Outlook is set to work in cached mode (default setting), or if some emails are stored in a local PST file, the data is unprotected. + + It is recommended to use Microsoft Office Outlook in Online mode, or to use encryption to protect OST and PST files manually. + ->[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). +> [!NOTE] +> When corporate data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files. + + + +> [!NOTE] +> Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md index 36a6fbf255..27d3f1d9c9 100644 --- a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md @@ -1,6 +1,6 @@ --- title: Mandatory tasks and settings required to turn on Windows Information Protection (WIP) (Windows 10) -description: This list provides all of the tasks that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP) in your enterprise. +description: Review all of the tasks required for Windows to turn on Windows Information Protection (WIP), formerly enterprise data protection (EDP), in your enterprise. keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection, protected apps, protected app list, App Rules, Protected apps list ms.prod: w10 ms.mktglfcycl: explore @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md new file mode 100644 index 0000000000..a1e662c65e --- /dev/null +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md @@ -0,0 +1,33 @@ +--- +title: Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10) +description: Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 +ms.reviewer: +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: dulcemontemayor +ms.author: dansimp +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 02/26/2019 +--- + +# Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager +**Applies to:** + +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later + +Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. + +## In this section +|Topic |Description | +|------|------------| +|[Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md) |Microsoft Endpoint Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | +|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md deleted file mode 100644 index 9fe48f688d..0000000000 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Create a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) -description: System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. -ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 -ms.reviewer: -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dolmont -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 02/26/2019 ---- - -# Create a Windows Information Protection (WIP) policy using System Center Configuration Manager -**Applies to:** - -- Windows 10, version 1607 and later -- Windows 10 Mobile, version 1607 and later - -System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. - -## In this section -|Topic |Description | -|------|------------| -|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | -|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | -|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md index 29087982ee..e40c2405a1 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md @@ -1,6 +1,6 @@ --- title: Create a Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) -description: Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +description: Microsoft Intune and Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.reviewer: ms.prod: w10 @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md index 246227f7c4..9af557f950 100644 --- a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -1,6 +1,6 @@ --- title: Protect your enterprise data using Windows Information Protection (WIP) (Windows 10) -description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. +description: Learn how to prevent accidental enterprise data leaks through apps and services, such as email, social media, and the public cloud. ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, DLP, data loss prevention, data leakage protection @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -35,14 +35,14 @@ Windows Information Protection (WIP), previously known as enterprise data protec ## Video: Protect enterprise data from being accidentally copied to the wrong place -> [!Video https://www.microsoft.com/en-us/videoplayer/embed/RE2IGhh] +> [!Video https://www.microsoft.com/videoplayer/embed/RE2IGhh] ## Prerequisites You’ll need this software to run WIP in your enterprise: |Operating system | Management solution | |-----------------|---------------------| -|Windows 10, version 1607 or later | Microsoft Intune

                                -OR-

                                System Center Configuration Manager

                                -OR-

                                Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634.aspx) documentation.| +|Windows 10, version 1607 or later | Microsoft Intune

                                -OR-

                                Microsoft Endpoint Configuration Manager

                                -OR-

                                Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634.aspx) documentation.| ## What is enterprise data control? Effective collaboration means that you need to share data with others in your enterprise. This sharing can be from one extreme where everyone has access to everything without any security, all the way to the other extreme where people can’t share anything and it’s all highly secured. Most enterprises fall somewhere in between the two extremes, where success is balanced between providing the necessary access with the potential for improper data disclosure. @@ -59,7 +59,7 @@ To help address this security insufficiency, companies developed data loss preve - **The ability to specify what happens when data matches a rule, including whether employees can bypass enforcement.** For example, in Microsoft SharePoint and SharePoint Online, the Microsoft data loss prevention system lets you warn your employees that shared data includes sensitive info, and to share it anyway (with an optional audit log entry). -Unfortunately, data loss prevention systems have their own problems. For example, the more detailed the rule set, the more false positives are created, leading employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. But perhaps the biggest problem with data loss preventions systems is that it provides a jarring experience that interrupts the employees’ natural workflow by stopping some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn’t see and can’t understand. +Unfortunately, data loss prevention systems have their own problems. For example, the less detailed the rule set, the more false positives are created, leading employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. But perhaps the biggest problem with data loss prevention systems is that it provides a jarring experience that interrupts the employees’ natural workflow by stopping some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn’t see and can’t understand. ### Using information rights management systems To help address the potential data loss prevention system problems, companies developed information rights management (also known as IRM) systems. Information rights management systems embed protection directly into documents, so that when an employee creates a document, he or she determines what kind of protection to apply. For example, an employee can choose to stop the document from being forwarded, printed, shared outside of the organization, and so on. @@ -79,7 +79,7 @@ WIP provides: - Use of audit reports for tracking issues and remedial actions. -- Integration with your existing management system (Microsoft Intune, System Center Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage WIP for your company. +- Integration with your existing management system (Microsoft Intune, Microsoft Endpoint Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage WIP for your company. ## Why use WIP? WIP is the mobile application management (MAM) mechanism on Windows 10. WIP gives you a new way to manage data policy enforcement for apps and documents on Windows 10 desktop operating systems, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). @@ -90,7 +90,7 @@ WIP is the mobile application management (MAM) mechanism on Windows 10. WIP give - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using a WIP-protected device, WIP encrypts the data on the device. - - **Using protected apps.** Managed apps (apps that you've included on the **Protected apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. + - **Using protected apps.** Managed apps (apps that you've included on the **Protected apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but makes a mistake and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are stopped from accessing your enterprise data, depending on your WIP management-mode. @@ -110,7 +110,7 @@ WIP is the mobile application management (MAM) mechanism on Windows 10. WIP give - **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable. >[!NOTE] - >For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager.
                                System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. + >For management of Surface devices it is recommended that you use the Current Branch of Microsoft Endpoint Configuration Manager.
                                Microsoft Endpoint Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. ## How WIP works WIP helps address your everyday challenges in the enterprise. Including: diff --git a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md index 0852a6c1be..fee621245c 100644 --- a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md @@ -1,5 +1,5 @@ --- -title: Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP) (Windows 10) +title: Recommended URLs for Windows Information Protection (Windows 10) description: Recommended URLs to add to your Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral Resources, WIP and Enterprise Cloud Resources ms.prod: w10 @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -33,11 +33,14 @@ This table includes the recommended URLs to add to your Enterprise Cloud Resourc |If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
                                (Replace "contoso" with your domain name(s)| |-----------------------------|---------------------------------------------------------------------| -|Office 365 for Business |
                                • contoso.sharepoint.com
                                • contoso-my.sharepoint.com
                                • contoso-files.sharepoint.com
                                • tasks.office.com
                                • protection.office.com
                                • meet.lync.com
                                • teams.microsoft.com
                                | +|Sharepoint Online |
                                • contoso.sharepoint.com
                                • contoso-my.sharepoint.com
                                • contoso-files.sharepoint.com
                                | |Yammer |
                                • www.yammer.com
                                • yammer.com
                                • persona.yammer.com
                                | +|Outlook Web Access (OWA) |
                                • outlook.office.com
                                • outlook.office365.com
                                • attachments.office.net
                                | |Microsoft Dynamics |contoso.crm.dynamics.com | |Visual Studio Online |contoso.visualstudio.com | |Power BI |contoso.powerbi.com | +|Microsoft Teams |teams.microsoft.com | +|Other Office 365 services |
                                • tasks.office.com
                                • protection.office.com
                                • meet.lync.com
                                • project.microsoft.com
                                | You can add other work-only apps to the Cloud Resource list, or you can create a packaged app rule for the .exe file to protect every file the app creates or modifies. Depending on how the app is accessed, you might want to add both. diff --git a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md index 96b109ce32..7353daae25 100644 --- a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -39,30 +39,30 @@ You can try any of the processes included in these scenarios, but you should foc Encrypt and decrypt files using File Explorer. - For desktop:

                                + For desktop:

                                  -
                                1. Open File Explorer, right-click a work document, and then click Work from the File Ownership menu.
                                  Make sure the file is encrypted by right-clicking the file again, clicking Advanced from the General tab, and then clicking Details from the Compress or Encrypt attributes area. The file should show up under the heading, This enterprise domain can remove or revoke access: <your_enterprise_identity>. For example, contoso.com.
                                2. -
                                3. In File Explorer, right-click the same document, and then click Personal from the File Ownership menu.
                                  Make sure the file is decrypted by right-clicking the file again, clicking Advanced from the General tab, and then verifying that the Details button is unavailable.
                                4. +
                                5. Open File Explorer, right-click a work document, and then click Work from the File Ownership menu.
                                  Make sure the file is encrypted by right-clicking the file again, clicking Advanced from the General tab, and then clicking Details from the Compress or Encrypt attributes area. The file should show up under the heading, This enterprise domain can remove or revoke access: <your_enterprise_identity>. For example, contoso.com.
                                6. +
                                7. In File Explorer, right-click the same document, and then click Personal from the File Ownership menu.
                                  Make sure the file is decrypted by right-clicking the file again, clicking Advanced from the General tab, and then verifying that the Details button is unavailable.
                                - For mobile:

                                + For mobile:

                                  -
                                1. Open the File Explorer app, browse to a file location, click the elipsis (...), and then click Select to mark at least one file as work-related.
                                2. -
                                3. Click the elipsis (...) again, click File ownership from the drop down menu, and then click Work.
                                  Make sure the file is encrypted, by locating the Briefcase icon next to the file name.
                                4. -
                                5. Select the same file, click File ownership from the drop down menu, and then click Personal.
                                  Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                                6. +
                                7. Open the File Explorer app, browse to a file location, click the elipsis (...), and then click Select to mark at least one file as work-related.
                                8. +
                                9. Click the elipsis (...) again, click File ownership from the drop down menu, and then click Work.
                                  Make sure the file is encrypted, by locating the Briefcase icon next to the file name.
                                10. +
                                11. Select the same file, click File ownership from the drop down menu, and then click Personal.
                                  Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                                Create work documents in enterprise-allowed apps. - For desktop:

                                + For desktop:

                                - For mobile:

                                + For mobile:

                                  -
                                1. Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as Work to a local, work-related location.
                                  Make sure the document is encrypted, by locating the Briefcase icon next to the file name.
                                2. +
                                3. Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as Work to a local, work-related location.
                                  Make sure the document is encrypted, by locating the Briefcase icon next to the file name.
                                4. Open the same document and attempt to save it to a non-work-related location.
                                  WIP should stop you from saving the file to this location.
                                5. -
                                6. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
                                  Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                                7. +
                                8. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
                                  Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.

                                @@ -70,7 +70,7 @@ You can try any of the processes included in these scenarios, but you should foc
                                1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
                                  The app shouldn't be able to access the file.
                                2. -
                                3. Try double-clicking or tapping on the work-encrypted file.
                                  If your default app association is an app not on your allowed apps list, you should get an Access Denied error message.
                                4. +
                                5. Try double-clicking or tapping on the work-encrypted file.
                                  If your default app association is an app not on your allowed apps list, you should get an Access Denied error message.
                                @@ -78,9 +78,9 @@ You can try any of the processes included in these scenarios, but you should foc Copy and paste from enterprise apps to non-enterprise apps.
                                  -
                                1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
                                  You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
                                2. -
                                3. Click Keep at work.
                                  The content isn't pasted into the non-enterprise app.
                                4. -
                                5. Repeat Step 1, but this time click Change to personal, and try to paste the content again.
                                  The content is pasted into the non-enterprise app.
                                6. +
                                7. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
                                  You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
                                8. +
                                9. Click Keep at work.
                                  The content isn't pasted into the non-enterprise app.
                                10. +
                                11. Repeat Step 1, but this time click Change to personal, and try to paste the content again.
                                  The content is pasted into the non-enterprise app.
                                12. Try copying and pasting content between apps on your allowed apps list.
                                  The content should copy and paste between apps without any warning messages.
                                @@ -89,9 +89,9 @@ You can try any of the processes included in these scenarios, but you should foc Drag and drop from enterprise apps to non-enterprise apps.
                                  -
                                1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
                                  You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                2. -
                                3. Click Keep at work.
                                  The content isn't dropped into the non-enterprise app.
                                4. -
                                5. Repeat Step 1, but this time click Change to personal, and try to drop the content again.
                                  The content is dropped into the non-enterprise app.
                                6. +
                                7. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
                                  You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                8. +
                                9. Click Keep at work.
                                  The content isn't dropped into the non-enterprise app.
                                10. +
                                11. Repeat Step 1, but this time click Change to personal, and try to drop the content again.
                                  The content is dropped into the non-enterprise app.
                                12. Try dragging and dropping content between apps on your allowed apps list.
                                  The content should move between the apps without any warning messages.
                                @@ -100,9 +100,9 @@ You can try any of the processes included in these scenarios, but you should foc Share between enterprise apps and non-enterprise apps.
                                  -
                                1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
                                  You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                2. -
                                3. Click Keep at work.
                                  The content isn't shared into Facebook.
                                4. -
                                5. Repeat Step 1, but this time click Change to personal, and try to share the content again.
                                  The content is shared into Facebook.
                                6. +
                                7. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
                                  You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                8. +
                                9. Click Keep at work.
                                  The content isn't shared into Facebook.
                                10. +
                                11. Repeat Step 1, but this time click Change to personal, and try to share the content again.
                                  The content is shared into Facebook.
                                12. Try sharing content between apps on your allowed apps list.
                                  The content should share between the apps without any warning messages.
                                @@ -112,8 +112,8 @@ You can try any of the processes included in these scenarios, but you should foc
                                1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
                                  Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
                                2. -
                                3. Open File Explorer and make sure your modified files are appearing with a Lock icon.
                                4. -
                                5. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

                                  Note
                                  Most Windows-signed components like File Explorer (when running in the user’s context), should have access to enterprise data.

                                  A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
                                6. +
                                7. Open File Explorer and make sure your modified files are appearing with a Lock icon.
                                8. +
                                9. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

                                  Note
                                  Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.

                                  A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
                                @@ -130,7 +130,7 @@ You can try any of the processes included in these scenarios, but you should foc Verify your shared files can use WIP.
                                  -
                                1. Download a file from a protected file share, making sure the file is encrypted by locating the Briefcase icon next to the file name.
                                2. +
                                3. Download a file from a protected file share, making sure the file is encrypted by locating the Briefcase icon next to the file name.
                                4. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.
                                5. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
                                  The app shouldn't be able to access the file share.
                                @@ -142,7 +142,7 @@ You can try any of the processes included in these scenarios, but you should foc
                                1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.
                                2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
                                  Both browsers should respect the enterprise and personal boundary.
                                3. -
                                4. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
                                  IE11 shouldn't be able to access the sites.

                                  Note
                                  Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.
                                5. +
                                6. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
                                  IE11 shouldn't be able to access the sites.

                                  Note
                                  Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.
                                @@ -150,7 +150,7 @@ You can try any of the processes included in these scenarios, but you should foc Verify your Virtual Private Network (VPN) can be auto-triggered.
                                  -
                                1. Set up your VPN network to start based on the WIPModeID setting.
                                  For specific info about how to do this, see the Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune topic.
                                2. +
                                3. Set up your VPN network to start based on the WIPModeID setting.
                                  For specific info about how to do this, see the Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune topic.
                                4. Start an app from your allowed apps list.
                                  The VPN network should automatically start.
                                5. Disconnect from your network and then start an app that isn't on your allowed apps list.
                                  The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
                                @@ -160,7 +160,7 @@ You can try any of the processes included in these scenarios, but you should foc Unenroll client devices from WIP.
                                  -
                                • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
                                  The device should be removed and all of the enterprise content for that managed account should be gone.

                                  Important
                                  On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.
                                • +
                                • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
                                  The device should be removed and all of the enterprise content for that managed account should be gone.

                                  Important
                                  On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.
                                @@ -172,17 +172,7 @@ You can try any of the processes included in these scenarios, but you should foc
                              - - Stop Google Drive from syncing WIP protected files and folders. - -
                                -
                              • In silent configuration, add Google Drive to Protected Apps and set it to Deny. This way, Google Drive will not sync WIP protected files and folders.
                              • -
                              • Google Drive details
                              • - Publisher=O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US - File=GOOGLEDRIVESYNC.EXE -
                              - - + >[!NOTE] diff --git a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md index 7a321fae6b..94df767962 100644 --- a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md @@ -1,5 +1,5 @@ --- -title: Using Outlook on the web with Windows Information Protection (WIP) (Windows 10) +title: Using Outlook on the web with WIP (Windows 10) description: Options for using Outlook on the web with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and OWA configuration, OWA, Outlook Web access ms.prod: w10 @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index dc97c95d0d..5a8333cab2 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index 6edaaf0f7d..7679c60ed8 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -1,6 +1,5 @@ --- -title: -# Fine-tune Windows Information Policy (WIP) with WIP Learning +title: Fine-tune Windows Information Policy (WIP) with WIP Learning description: How to access the WIP Learning report to monitor and apply Windows Information Protection in your company. ms.assetid: 53db29d2-d99d-4db6-b494-90e2b4872ca2 ms.reviewer: @@ -10,8 +9,8 @@ ms.mktglfcycl: ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: stephow-MSFT -ms.author: stephow +author: cabailey +ms.author: cabailey manager: laurawi audience: ITPro ms.collection: M365-security-compliance @@ -33,7 +32,7 @@ In the **Website learning report**, you can view a summary of the devices that h ## Access the WIP Learning reports -1. Open the [Azure portal](http://portal.azure.com/). +1. Open the [Azure portal](https://portal.azure.com/). 1. Click **All services**, type **Intune** in the text box filter, and click the star to add it to **Favorites**. diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index d7d357b651..79487e7cc2 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -2,350 +2,529 @@ ## [Overview]() ### [What is Microsoft Defender Advanced Threat Protection?](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) -### [Overview of Microsoft Defender ATP capabilities](microsoft-defender-atp/overview.md) -### [Threat & Vulnerability Management]() -#### [Next-generation capabilities](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) -#### [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md) -#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) -#### [Configuration score](microsoft-defender-atp/configuration-score.md) -#### [Security recommendation](microsoft-defender-atp/tvm-security-recommendation.md) -#### [Remediation](microsoft-defender-atp/tvm-remediation.md) -#### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) -#### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) -#### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) +### [Minimum requirements](microsoft-defender-atp/minimum-requirements.md) +### [What's new in Microsoft Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) +### [Preview features](microsoft-defender-atp/preview.md) +### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md) +### [Overview of Microsoft Defender Security Center](microsoft-defender-atp/use.md) +### [Portal overview](microsoft-defender-atp/portal-overview.md) +### [Microsoft Defender ATP for US Government Community Cloud High customers](microsoft-defender-atp/gov.md) +### [Microsoft Defender ATP for non-Windows platforms](microsoft-defender-atp/non-windows.md) +## [Evaluate capabilities](microsoft-defender-atp/evaluation-lab.md) + +## [Plan deployment](microsoft-defender-atp/deployment-strategy.md) + +## [Deployment guide]() +### [Deployment phases](microsoft-defender-atp/deployment-phases.md) +### [Phase 1: Prepare](microsoft-defender-atp/prepare-deployment.md) +### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md) +### [Phase 3: Onboard]() +#### [Onboarding overview](microsoft-defender-atp/onboarding.md) +#### [Deployment rings](microsoft-defender-atp/deployment-rings.md) +#### [Onboarding using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/onboarding-endpoint-configuration-manager.md) +#### [Onboarding using Microsoft Endpoint Manager](microsoft-defender-atp/onboarding-endpoint-manager.md) +#### [Onboard supported devices](microsoft-defender-atp/onboard-configure.md) + +## [Migration guides](microsoft-defender-atp/migration-guides.md) +### [Switch from McAfee to Microsoft Defender for Endpoint]() +#### [Overview of migration](microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md) +#### [Phase 1: Prepare](microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md) +#### [Phase 2: Setup](microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md) +#### [Phase 3: Onboard](microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md) +### [Switch from Symantec to Microsoft Defender for Endpoint]() +#### [Overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md) +#### [Phase 1: Prepare](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md) +#### [Phase 2: Setup](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md) +#### [Phase 3: Onboard](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) +### [Switch from your non-Microsoft endpoint security solution to Microsoft Defender for Endpoint]() +#### [Overview of migration](microsoft-defender-atp/switch-to-microsoft-defender-migration.md) +#### [Phase 1: Prepare](microsoft-defender-atp/switch-to-microsoft-defender-prepare.md) +#### [Phase 2: Setup](microsoft-defender-atp/switch-to-microsoft-defender-setup.md) +#### [Phase 3: Onboard](microsoft-defender-atp/switch-to-microsoft-defender-onboard.md) +### [Manage Microsoft Defender for Endpoint after migration]() +#### [Overview of managing Microsoft Defender for Endpoint](microsoft-defender-atp/manage-atp-post-migration.md) +#### [Intune (recommended)](microsoft-defender-atp/manage-atp-post-migration-intune.md) +#### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) +#### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md) +#### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md) + +## [Security administration]() +### [Threat & vulnerability management]() +#### [Overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) +#### [Get started]() +##### [Permissions & prerequisites](microsoft-defender-atp/tvm-prerequisites.md) +##### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) +##### [Assign device value](microsoft-defender-atp/tvm-assign-device-value.md) +#### [Assess your security posture]() +##### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md) +##### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) +##### [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md) +#### [Improve your security posture & reduce risk]() +##### [Address security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) +##### [Remediate vulnerabilities](microsoft-defender-atp/tvm-remediation.md) +##### [Exceptions for security recommendations](microsoft-defender-atp/tvm-exception.md) +##### [Plan for end-of-support software](microsoft-defender-atp/tvm-end-of-support-software.md) +##### [Mitigate zero-day vulnerabilities](microsoft-defender-atp/tvm-zero-day-vulnerabilities.md) +#### [Understand vulnerabilities on your devices]() +##### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) +##### [Vulnerabilities in my organization](microsoft-defender-atp/tvm-weaknesses.md) +##### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md) +##### [Vulnerable devices report](microsoft-defender-atp/tvm-vulnerable-devices-report.md) +##### [Hunt for exposed devices](microsoft-defender-atp/tvm-hunt-exposed-devices.md) ### [Attack surface reduction]() +#### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) +#### [Evaluate attack surface reduction rules](microsoft-defender-atp/evaluate-attack-surface-reduction.md) +#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) +#### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md) + +#### [Attack surface reduction controls]() +##### [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md) +##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) +##### [Customize attack surface reduction rules](microsoft-defender-atp/customize-attack-surface-reduction.md) +##### [View attack surface reduction events](microsoft-defender-atp/event-views.md) + #### [Hardware-based isolation]() ##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) +##### [Hardware-based isolation evaluation](microsoft-defender-application-guard/test-scenarios-md-app-guard.md) ##### [Application isolation]() -###### [Application guard overview](windows-defender-application-guard/wd-app-guard-overview.md) -###### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md) +###### [Application guard overview](microsoft-defender-application-guard/md-app-guard-overview.md) +###### [System requirements](microsoft-defender-application-guard/reqs-md-app-guard.md) +###### [Install Microsoft Defender Application Guard](microsoft-defender-application-guard/install-md-app-guard.md) +###### [Install Microsoft Defender Application Guard Extension](microsoft-defender-application-guard/md-app-guard-browser-extension.md) + +##### [Application control](windows-defender-application-control/windows-defender-application-control.md) +###### [Audit Application control policies](windows-defender-application-control/audit-windows-defender-application-control-policies.md) + +##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) ##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) + +#### [Device control]() +##### [Code integrity](device-guard/enable-virtualization-based-protection-of-code-integrity.md) +##### [Control USB devices](device-control/control-usb-devices-using-intune.md) +##### [Device control report](device-control/device-control-report.md) -#### [Application control](windows-defender-application-control/windows-defender-application-control.md) -#### [Exploit protection](windows-defender-exploit-guard/exploit-protection-exploit-guard.md) -#### [Network protection](windows-defender-exploit-guard/network-protection-exploit-guard.md) -#### [Controlled folder access](windows-defender-exploit-guard/controlled-folders-exploit-guard.md) -#### [Attack surface reduction](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) -#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) +#### [Exploit protection]() +##### [Protect devices from exploits](microsoft-defender-atp/exploit-protection.md) +##### [Exploit protection evaluation](microsoft-defender-atp/evaluate-exploit-protection.md) +##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) +##### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md) +##### [Import, export, and deploy exploit protection configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) +##### [Exploit protection reference](microsoft-defender-atp/exploit-protection-reference.md ) -### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) +#### [Network protection]() +##### [Protect your network](microsoft-defender-atp/network-protection.md) +##### [Evaluate network protection](microsoft-defender-atp/evaluate-network-protection.md) +##### [Turn on network protection](microsoft-defender-atp/enable-network-protection.md) + +#### [Web protection]() +##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md) +##### [Web threat protection]() +###### [Web threat protection overview](microsoft-defender-atp/web-threat-protection.md) +###### [Monitor web security](microsoft-defender-atp/web-protection-monitoring.md) +###### [Respond to web threats](microsoft-defender-atp/web-protection-response.md) +##### [Web content filtering](microsoft-defender-atp/web-content-filtering.md) + +#### [Controlled folder access]() +##### [Protect folders](microsoft-defender-atp/controlled-folders.md) +##### [Evaluate controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) +##### [Enable controlled folder access](microsoft-defender-atp/enable-controlled-folders.md) +##### [Customize controlled folder access](microsoft-defender-atp/customize-controlled-folders.md) + + + +#### [Network firewall]() +##### [Network firewall overview](windows-firewall/windows-firewall-with-advanced-security.md) +##### [Network firewall evaluation](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) + + +### [Next-generation protection]() +#### [Next-generation protection overview](microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md) +#### [Evaluate next-generation protection](microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md) + +#### [Configure next-generation protection]() +##### [Configure Microsoft Defender Antivirus features](microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md) + +##### [Use Microsoft cloud-delivered protection](microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) +###### [Enable cloud-delivered protection](microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) +###### [Specify the cloud-delivered protection level](microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md) +###### [Configure and validate network connections](microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md) +###### [Prevent security settings changes with tamper protection](microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) +###### [Enable Block at first sight](microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md) +###### [Configure the cloud block timeout period](microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) + +##### [Configure behavioral, heuristic, and real-time protection]() +###### [Configuration overview](microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md) +###### [Detect and block Potentially Unwanted Applications](microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) +###### [Enable and configure always-on protection and monitoring](microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) + +##### [Antivirus on Windows Server](microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md) + +##### [Antivirus compatibility]() +###### [Compatibility charts](microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md) +###### [Use limited periodic antivirus scanning](microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md) + +##### [Manage next-generation protection in your business]() +###### [Management overview](microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md) +###### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next-generation protection](microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md) +###### [Use Group Policy settings to manage next-generation protection](microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md) +###### [Use PowerShell cmdlets to manage next-generation protection](microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to manage next-generation protection](microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md) +###### [Use the mpcmdrun.exe command line tool to manage next-generation protection](microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md) +###### [Handle false positives/negatives in Microsoft Defender Antivirus](microsoft-defender-antivirus/antivirus-false-positives-negatives.md) + +##### [Deploy, manage updates, and report on antivirus]() +###### [Preparing to deploy](microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md) +###### [Deploy and enable antivirus](microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md) +###### [Deployment guide for VDI environments](microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md) + +###### [Report on antivirus protection]() +###### [Review protection status and alerts](microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md) +###### [Troubleshoot antivirus reporting in Update Compliance](microsoft-defender-antivirus/troubleshoot-reporting.md) +###### [Learn about the recent updates](microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md) +###### [Manage protection and security intelligence updates](microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md) +###### [Manage event-based forced updates](microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) + +##### [Customize, initiate, and review the results of scans and remediation]() +###### [Configuration overview](microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md) + +###### [Configure and validate exclusions in antivirus scans]() +###### [Exclusions overview](microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure antivirus exclusions Windows Server](microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md) +###### [Common mistakes when defining exclusions](microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md) +###### [Configure scanning antivirus options](microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md) +###### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md) +###### [Configure scheduled scans](microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md) +###### [Configure and run scans](microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md) +###### [Review scan results](microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md) +###### [Run and review the results of an offline scan](microsoft-defender-antivirus/microsoft-defender-offline.md) + +##### [Restore quarantined files](microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md) + +##### [Manage scans and remediation]() +###### [Management overview](microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md) + +###### [Configure and validate exclusions in antivirus scans]() +###### [Exclusions overview](microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure antivirus exclusions on Windows Server](microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md) + +###### [Configure scanning options](microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md) + +##### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md) +###### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md) +###### [Configure scheduled scans](microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md) +###### [Configure and run scans](microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md) +###### [Review scan results](microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md) +###### [Run and review the results of an offline scan](microsoft-defender-antivirus/microsoft-defender-offline.md) +###### [Restore quarantined files](microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md) + +#### [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md) +#### [Better together: Microsoft Defender Antivirus and Office 365](microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md) + + +### [Microsoft Defender Advanced Threat Protection for Mac]() +#### [Overview of Microsoft Defender ATP for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) +#### [What's New](microsoft-defender-atp/mac-whatsnew.md) + +#### [Deploy]() +##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) +##### [JAMF Pro-based deployment]() +###### [Deploying Microsoft Defender ATP for macOS using Jamf Pro](microsoft-defender-atp/mac-install-with-jamf.md) +###### [Login to Jamf Pro](microsoft-defender-atp/mac-install-jamfpro-login.md) +###### [Set up device groups](microsoft-defender-atp/mac-jamfpro-device-groups.md) +###### [Set up policies](microsoft-defender-atp/mac-jamfpro-policies.md) +###### [Enroll devices](microsoft-defender-atp/mac-jamfpro-enroll-devices.md) + +##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) +##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) +#### [Update](microsoft-defender-atp/mac-updates.md) + +#### [Configure]() +##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) +##### [Set preferences](microsoft-defender-atp/mac-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +##### [Schedule scans](microsoft-defender-atp/mac-schedule-scan-atp.md) + +#### [Troubleshoot]() +##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md) +##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) +##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) +##### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md) + +#### [Privacy](microsoft-defender-atp/mac-privacy.md) +#### [Resources](microsoft-defender-atp/mac-resources.md) + + + + +### [Microsoft Defender Advanced Threat Protection for iOS]() +#### [Overview of Microsoft Defender Advanced Threat Protection for iOS](microsoft-defender-atp/microsoft-defender-atp-ios.md) + +#### [Deploy]() +##### [Deploy Microsoft Defender for Endpoint for iOS via Intune](microsoft-defender-atp/ios-install.md) + +#### [Configure]() +##### [Configure iOS features](microsoft-defender-atp/ios-configure-features.md) +#### [Privacy](microsoft-defender-atp/ios-privacy.md) + + +### [Microsoft Defender Advanced Threat Protection for Linux]() +#### [Overview of Microsoft Defender ATP for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) +#### [What's New](microsoft-defender-atp/linux-whatsnew.md) +#### [Deploy]() +##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md) +##### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md) +##### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md) + +#### [Update](microsoft-defender-atp/linux-updates.md) + + +#### [Configure]() +##### [Configure and validate exclusions](microsoft-defender-atp/linux-exclusions.md) +##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) +##### [Set preferences](microsoft-defender-atp/linux-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/linux-pua.md) +##### [Schedule scans with Microsoft Defender ATP for Linux](microsoft-defender-atp/linux-schedule-scan-atp.md) +##### [Schedule an update of the Microsoft Defender for Endpoint (Linux)](microsoft-defender-atp/linux-update-MDE-Linux.md) + +#### [Troubleshoot]() +##### [Troubleshoot installation issues](microsoft-defender-atp/linux-support-install.md) +##### [Troubleshoot cloud connectivity issues](microsoft-defender-atp/linux-support-connectivity.md) +##### [Troubleshoot performance issues](microsoft-defender-atp/linux-support-perf.md) + + +#### [Privacy](microsoft-defender-atp/linux-privacy.md) +#### [Resources](microsoft-defender-atp/linux-resources.md) + + +### [Microsoft Defender Advanced Threat Protection for Android]() +#### [Overview of Microsoft Defender ATP for Android](microsoft-defender-atp/microsoft-defender-atp-android.md) + +#### [Deploy]() +##### [Deploy Microsoft Defender ATP for Android with Microsoft Intune](microsoft-defender-atp/android-intune.md) + +#### [Configure]() +##### [Configure Microsoft Defender ATP for Android features](microsoft-defender-atp/android-configure.md) + +#### [Privacy]() +##### [Microsoft Defender ATP for Android - Privacy information](microsoft-defender-atp/android-privacy.md) + +#### [Troubleshoot]() +##### [Troubleshoot issues](microsoft-defender-atp/android-support-signin.md) + + +### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) + +## [Security operations]() ### [Endpoint detection and response]() #### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md) #### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md) - #### [Incidents queue]() ##### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md) ##### [Manage incidents](microsoft-defender-atp/manage-incidents.md) ##### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md) + #### [Alerts queue]() ##### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md) +##### [Review alerts](microsoft-defender-atp/review-alerts.md) ##### [Manage alerts](microsoft-defender-atp/manage-alerts.md) ##### [Investigate alerts](microsoft-defender-atp/investigate-alerts.md) ##### [Investigate files](microsoft-defender-atp/investigate-files.md) -##### [Investigate machines](microsoft-defender-atp/investigate-machines.md) +##### [Investigate devices](microsoft-defender-atp/investigate-machines.md) ##### [Investigate an IP address](microsoft-defender-atp/investigate-ip.md) ##### [Investigate a domain](microsoft-defender-atp/investigate-domain.md) ###### [Investigate connection events that occur behind forward proxies](microsoft-defender-atp/investigate-behind-proxy.md) ##### [Investigate a user account](microsoft-defender-atp/investigate-user.md) -#### [Machines list]() -##### [View and organize the Machines list](microsoft-defender-atp/machines-view-overview.md) -##### [Manage machine group and tags](microsoft-defender-atp/machine-tags.md) -##### [Alerts related to this machine](microsoft-defender-atp/investigate-machines.md#alerts-related-to-this-machine) - -##### [Machine timeline]() -###### [View machine profile](microsoft-defender-atp/investigate-machines.md#machine-timeline) -###### [Search for specific events](microsoft-defender-atp/investigate-machines.md#search-for-specific-events) -###### [Filter events from a specific date](microsoft-defender-atp/investigate-machines.md#filter-events-from-a-specific-date) -###### [Export machine timeline events](microsoft-defender-atp/investigate-machines.md#export-machine-timeline-events) -###### [Navigate between pages](microsoft-defender-atp/investigate-machines.md#navigate-between-pages) - +#### [Devices list]() +##### [View and organize the Devices list](microsoft-defender-atp/machines-view-overview.md) +##### [Device timeline event flags](microsoft-defender-atp/device-timeline-event-flag.md) +##### [Manage device group and tags](microsoft-defender-atp/machine-tags.md) + #### [Take response actions]() -##### [Take response actions on a machine]() -###### [Response actions on machines](microsoft-defender-atp/respond-machine-alerts.md) -###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines) -###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines) +##### [Take response actions on a device]() +###### [Response actions on devices](microsoft-defender-atp/respond-machine-alerts.md) +###### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags) +###### [Start an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) +###### [Start a Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) +###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-devices) +###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-microsoft-defender-antivirus-scan-on-devices) ###### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution) -###### [Remove app restriction](microsoft-defender-atp/respond-machine-alerts.md#remove-app-restriction) -###### [Isolate machines from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-machines-from-the-network) -###### [Release machine from isolation](microsoft-defender-atp/respond-machine-alerts.md#release-machine-from-isolation) -####### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) +###### [Isolate devices from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-devices-from-the-network) +###### [Consult a threat expert](microsoft-defender-atp/respond-machine-alerts.md#consult-a-threat-expert) +###### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) ##### [Take response actions on a file]() ###### [Response actions on files](microsoft-defender-atp/respond-file-alerts.md) ###### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network) -###### [Remove file from quarantine](microsoft-defender-atp/respond-file-alerts.md#remove-file-from-quarantine) -###### [Block files in your network](microsoft-defender-atp/respond-file-alerts.md#block-files-in-your-network) -###### [Remove file from blocked list](microsoft-defender-atp/respond-file-alerts.md#remove-file-from-blocked-list) +###### [Restore file from quarantine](microsoft-defender-atp/respond-file-alerts.md#restore-file-from-quarantine) +###### [Add indicators to block or allow a file](microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) ###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) +###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) ###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) -###### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis) -###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) -####### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) -##### [Investigate entities using Live response]() -###### [Investigate entities on machines](microsoft-defender-atp/live-response.md) -###### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) +#### [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md) +##### [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md) -### [Automated investigation and remediation]() -#### [Automated investigation and remediation overview](microsoft-defender-atp/automated-investigations.md) -#### [Learn about the automated investigation and remediation dashboard](microsoft-defender-atp/manage-auto-investigation.md) -##### [Manage actions related to automated investigation and remediation](microsoft-defender-atp/auto-investigation-action-center.md) +#### [Investigate entities using Live response]() +##### [Investigate entities on devices](microsoft-defender-atp/live-response.md) +##### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) -### [Secure score](microsoft-defender-atp/overview-secure-score.md) -### [Threat analytics](microsoft-defender-atp/threat-analytics.md) + + +#### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) + +#### [Reporting]() +##### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md) +##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md) +#### [Device health and compliance reports](microsoft-defender-atp/machine-reports.md) + +### [Behavioral blocking and containment]() +#### [Behavioral blocking and containment](microsoft-defender-atp/behavioral-blocking-containment.md) +#### [Client behavioral blocking](microsoft-defender-atp/client-behavioral-blocking.md) +#### [Feedback-loop blocking](microsoft-defender-atp/feedback-loop-blocking.md) +#### [EDR in block mode](microsoft-defender-atp/edr-in-block-mode.md) + +### [Automated investigation and response (AIR)]() +#### [Overview of AIR](microsoft-defender-atp/automated-investigations.md) +#### [Automation levels in AIR](microsoft-defender-atp/automation-levels.md) +#### [Configure AIR capabilities](microsoft-defender-atp/configure-automated-investigations-remediation.md) ### [Advanced hunting]() -#### [Advanced hunting overview](microsoft-defender-atp/overview-hunting.md) -#### [Query data using Advanced hunting](microsoft-defender-atp/advanced-hunting.md) - -##### [Advanced hunting schema reference]() -###### [All tables in the Advanced hunting schema](microsoft-defender-atp/advanced-hunting-reference.md) -###### [AlertEvents table](microsoft-defender-atp/advanced-hunting-alertevents-table.md) -###### [FileCreationEvents table](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) -###### [ImageLoadEvents table](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) -###### [LogonEvents table](microsoft-defender-atp/advanced-hunting-logonevents-table.md) -###### [MachineInfo table](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) -###### [MachineNetworkInfo table](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) -###### [MiscEvents table](microsoft-defender-atp/advanced-hunting-miscevents-table.md) -###### [NetworkCommunicationEvents table](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) -###### [ProcessCreationEvents table](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) -###### [RegistryEvents table](microsoft-defender-atp/advanced-hunting-registryevents-table.md) - -##### [Advanced hunting query language best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) - +#### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md) +#### [Learn, train, & get examples]() +##### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) +##### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) +#### [Work with query results](microsoft-defender-atp/advanced-hunting-query-results.md) +#### [Optimize & handle errors]() +##### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) +##### [Handle errors](microsoft-defender-atp/advanced-hunting-errors.md) +##### [Service limits](microsoft-defender-atp/advanced-hunting-limits.md) +#### [Data schema]() +##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) +##### [DeviceAlertEvents](microsoft-defender-atp/advanced-hunting-devicealertevents-table.md) +##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md) +##### [DeviceImageLoadEvents](microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md) +##### [DeviceLogonEvents](microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md) +##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md) +##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md) +##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md) +##### [DeviceFileCertificateInfo](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md) +##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md) +##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md) +##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md) +##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md) +##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) +##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md) +##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md) #### [Custom detections]() -##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md) -##### [Create custom detections rules](microsoft-defender-atp/custom-detection-rules.md) - -#### [Management and APIs]() -##### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) -##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md) -##### [Microsoft Defender ATP APIs](microsoft-defender-atp/apis-intro.md) -##### [Managed security service provider support](microsoft-defender-atp/mssp-support.md) - -#### [Integrations]() -##### [Microsoft Defender ATP integrations](microsoft-defender-atp/threat-protection-integration.md) -##### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md) -##### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md) - -#### [Information protection in Windows overview]() -##### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) -##### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) +##### [Custom detections overview](microsoft-defender-atp/overview-custom-detections.md) +##### [Create detection rules](microsoft-defender-atp/custom-detection-rules.md) +##### [View & manage detection rules](microsoft-defender-atp/custom-detections-manage.md) ### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md) -### [Portal overview](microsoft-defender-atp/portal-overview.md) -### [Microsoft Defender ATP for US Government Community Cloud High customers](microsoft-defender-atp/commercial-gov.md) - -## [Get started]() -### [What's new in Microsoft Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) -### [Minimum requirements](microsoft-defender-atp/minimum-requirements.md) -### [Validate licensing and complete setup](microsoft-defender-atp/licensing.md) -### [Evaluation lab](microsoft-defender-atp/evaluation-lab.md) -### [Preview features](microsoft-defender-atp/preview.md) -### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md) -### [Assign user access to the portal](microsoft-defender-atp/assign-portal-access.md) +### [Threat analytics overview](microsoft-defender-atp/threat-analytics.md) +#### [Read the analyst report](microsoft-defender-atp/threat-analytics-analyst-reports.md) +## [How-to]() +### [Onboard devices to the service]() +#### [Onboard devices to Microsoft Defender ATP](microsoft-defender-atp/onboard-configure.md) +#### [Onboard previous versions of Windows](microsoft-defender-atp/onboard-downlevel.md) +#### [Onboard Windows 10 devices]() +##### [Onboarding tools and methods](microsoft-defender-atp/configure-endpoints.md) +##### [Onboard devices using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md) +##### [Onboard devices using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md) +##### [Onboard devices using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md) +##### [Onboard devices using a local script](microsoft-defender-atp/configure-endpoints-script.md) +##### [Onboard non-persistent virtual desktop infrastructure (VDI) devices](microsoft-defender-atp/configure-endpoints-vdi.md) +##### [Onboard Windows 10 multi-session devices in Windows Virtual Desktop](microsoft-defender-atp/Onboard-Windows-10-multi-session-device.md) + +#### [Onboard Windows servers](microsoft-defender-atp/configure-server-endpoints.md) +#### [Onboard non-Windows devices](microsoft-defender-atp/configure-endpoints-non-windows.md) +#### [Onboard devices without Internet access](microsoft-defender-atp/onboard-offline-machines.md) +#### [Run a detection test on a newly onboarded device](microsoft-defender-atp/run-detection-test.md) +#### [Run simulated attacks on devices](microsoft-defender-atp/attack-simulations.md) +#### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md) +#### [Create an onboarding or offboarding notification rule](microsoft-defender-atp/onboarding-notification.md) + +#### [Troubleshoot onboarding issues]() +##### [Troubleshoot issues during onboarding](microsoft-defender-atp/troubleshoot-onboarding.md) +##### [Troubleshoot subscription and portal access issues](microsoft-defender-atp/troubleshoot-onboarding-error-messages.md) + +### [Manage device configuration]() +#### [Ensure your devices are configured properly](microsoft-defender-atp/configure-machines.md) +#### [Monitor and increase device onboarding](microsoft-defender-atp/configure-machines-onboarding.md) +#### [Increase compliance to the security baseline](microsoft-defender-atp/configure-machines-security-baseline.md) +#### [Optimize attack surface reduction rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) + +### [Configure portal settings]() +#### [Set up preferences](microsoft-defender-atp/preferences-setup.md) +#### [General]() +##### [Verify data storage location and update data retention settings](microsoft-defender-atp/data-retention-settings.md) +##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md) +##### [Configure advanced features](microsoft-defender-atp/advanced-features.md) + +#### [Permissions]() +##### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md) +##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md) +###### [Create and manage roles](microsoft-defender-atp/user-roles.md) +###### [Create and manage device groups](microsoft-defender-atp/machine-groups.md) +###### [Create and manage device tags](microsoft-defender-atp/machine-tags.md) -### [Evaluate Microsoft Defender ATP]() -#### [Attack surface reduction and next-generation capability evaluation]() -##### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) -##### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) -##### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md) -##### [Exploit protection](windows-defender-exploit-guard/evaluate-exploit-protection.md) -##### [Network Protection](windows-defender-exploit-guard/evaluate-network-protection.md) -##### [Controlled folder access](windows-defender-exploit-guard/evaluate-controlled-folder-access.md) -##### [Attack surface reduction](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) -##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) -##### [Evaluate next generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) +#### [Rules]() +##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md) +##### [Create indicators](microsoft-defender-atp/manage-indicators.md) +###### [Create indicators for files](microsoft-defender-atp/indicator-file.md) +###### [Create indicators for IPs and URLs/domains](microsoft-defender-atp/indicator-ip-domain.md) +###### [Create indicators for certificates](microsoft-defender-atp/indicator-certificates.md) +###### [Manage indicators](microsoft-defender-atp/indicator-manage.md) +##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md) +##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md) -### [Access the Windows Defender Security Center Community Center](microsoft-defender-atp/community.md) +#### [Device management]() +##### [Onboarding devices](microsoft-defender-atp/onboard-configure.md) +##### [Offboarding devices](microsoft-defender-atp/offboard-machines.md) -## [Configure and manage capabilities]() -### [Configure attack surface reduction]() -#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) +#### [Configure Microsoft Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md) -### [Configure and manage capabilities](microsoft-defender-atp/onboard.md) -#### [Microsoft Defender Advanced Threat Protection for Mac](windows-defender-antivirus/microsoft-defender-atp-mac.md) -##### [Deploy Microsoft Defender Advanced Threat Protection for Mac]() -###### [Microsoft Intune-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md) -###### [JAMF-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md) -###### [Deployment with a different Mobile Device Management (MDM) system](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md) -###### [Manual deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md) -##### [Update Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-updates.md) -##### [Set preferences for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md) -##### [Privacy for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md) -##### [Resources for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-resources.md) +### [Configure integration with other Microsoft solutions]() +#### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md) +#### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md) -#### [Hardware-based isolation]() -##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) - -##### [Application isolation]() -###### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -###### [Application control](windows-defender-application-control/windows-defender-application-control.md) - -#### [Device control]() -##### [Control USB devices](device-control/control-usb-devices-using-intune.md) - -##### [Device Guard]() -###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) - -###### [Memory integrity]() -####### [Understand memory integrity](windows-defender-exploit-guard/memory-integrity.md) -####### [Hardware qualifications](windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) -####### [Enable HVCI](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md) - -#### [Exploit protection]() -##### [Enable exploit protection](windows-defender-exploit-guard/enable-exploit-protection.md) -##### [Import/export configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) - -#### [Network protection](windows-defender-exploit-guard/enable-network-protection.md) -#### [Controlled folder access](windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md) - -#### [Attack surface reduction controls]() -##### [Enable attack surface reduction rules](windows-defender-exploit-guard/enable-attack-surface-reduction.md) -##### [Customize attack surface reduction](windows-defender-exploit-guard/customize-attack-surface-reduction.md) -#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) - -### [Configure next generation protection]() -#### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) -#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -##### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) -##### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) -##### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) -##### [Prevent security settings changes with tamper protection](windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) -##### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) -##### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) - -#### [Configure behavioral, heuristic, and real-time protection]() -##### [Configuration overview](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) -##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) - -#### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) - -#### [Antivirus compatibility]() -##### [Compatibility charts](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) -##### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) - -#### [Deploy, manage updates, and report on antivirus]() -##### [Preparing to deploy](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) -##### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) -###### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) - -##### [Report on antivirus protection]() -###### [Review protection status and alerts](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) -###### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) - -##### [Manage updates and apply baselines]() -###### [Learn about the different kinds of updates](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) -###### [Manage protection and security intelligence updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) -###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) -###### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) -###### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) -###### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - -#### [Customize, initiate, and review the results of scans and remediation]() -##### [Configuration overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) - -##### [Configure and validate exclusions in antivirus scans]() -###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) - -##### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) - -#### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) - -#### [Manage antivirus in your business]() -##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -##### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) - -#### [Manage scans and remediation]() -##### [Management overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) - -##### [Configure and validate exclusions in antivirus scans]() -###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) - -##### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) - -#### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) -##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) - -#### [Manage next generation protection in your business]() -##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -##### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) - -### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md) - -### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) - -### [Management and API support]() -#### [Onboard devices to the service]() -##### [Onboard machines to Microsoft Defender ATP](microsoft-defender-atp/onboard-configure.md) -##### [Onboard previous versions of Windows](microsoft-defender-atp/onboard-downlevel.md) -##### [Onboard Windows 10 machines]() -###### [Onboarding tools and methods](microsoft-defender-atp/configure-endpoints.md) -###### [Onboard machines using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md) -###### [Onboard machines using System Center Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md) -###### [Onboard machines using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md) -###### [Onboard machines using a local script](microsoft-defender-atp/configure-endpoints-script.md) -###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](microsoft-defender-atp/configure-endpoints-vdi.md) - -##### [Onboard servers](microsoft-defender-atp/configure-server-endpoints.md) -##### [Onboard non-Windows machines](microsoft-defender-atp/configure-endpoints-non-windows.md) -##### [Onboard machines without Internet access](microsoft-defender-atp/onboard-offline-machines.md) -##### [Run a detection test on a newly onboarded machine](microsoft-defender-atp/run-detection-test.md) -##### [Run simulated attacks on machines](microsoft-defender-atp/attack-simulations.md) -##### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md) - -##### [Troubleshoot onboarding issues]() -###### [Troubleshoot issues during onboarding](microsoft-defender-atp/troubleshoot-onboarding.md) -###### [Troubleshoot subscription and portal access issues](microsoft-defender-atp/troubleshoot-onboarding-error-messages.md) +### [Use audit mode](microsoft-defender-atp/audit-windows-defender.md) +## Reference +### [Management and APIs]() +#### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) #### [Microsoft Defender ATP API]() -##### [Microsoft Defender ATP API license and terms](microsoft-defender-atp/api-terms-of-use.md) -##### [Get started with Microsoft Defender ATP APIs]() -###### [Introduction](microsoft-defender-atp/apis-intro.md) +##### [Get started]() +###### [Microsoft Defender ATP API license and terms](microsoft-defender-atp/api-terms-of-use.md) +###### [Access the Microsoft Defender ATP APIs](microsoft-defender-atp/apis-intro.md) ###### [Hello World](microsoft-defender-atp/api-hello-world.md) ###### [Get access with application context](microsoft-defender-atp/exposed-apis-create-app-webapp.md) ###### [Get access with user context](microsoft-defender-atp/exposed-apis-create-app-nativeapp.md) +###### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md) -##### [APIs]() -###### [Supported Microsoft Defender ATP query APIs](microsoft-defender-atp/exposed-apis-list.md) +##### [Microsoft Defender ATP APIs Schema]() +###### [Supported Microsoft Defender ATP APIs](microsoft-defender-atp/exposed-apis-list.md) +###### [Common REST API error codes](microsoft-defender-atp/common-errors.md) ###### [Advanced Hunting](microsoft-defender-atp/run-advanced-query-api.md) ###### [Alert]() @@ -357,7 +536,7 @@ ####### [Get alert related domains information](microsoft-defender-atp/get-alert-related-domain-info.md) ####### [Get alert related file information](microsoft-defender-atp/get-alert-related-files-info.md) ####### [Get alert related IPs information](microsoft-defender-atp/get-alert-related-ip-info.md) -####### [Get alert related machine information](microsoft-defender-atp/get-alert-related-machine-info.md) +####### [Get alert related device information](microsoft-defender-atp/get-alert-related-machine-info.md) ####### [Get alert related user information](microsoft-defender-atp/get-alert-related-user-info.md) ###### [Machine]() @@ -366,8 +545,13 @@ ####### [Get machine by ID](microsoft-defender-atp/get-machine-by-id.md) ####### [Get machine log on users](microsoft-defender-atp/get-machine-log-on-users.md) ####### [Get machine related alerts](microsoft-defender-atp/get-machine-related-alerts.md) +####### [Get installed software](microsoft-defender-atp/get-installed-software.md) +####### [Get discovered vulnerabilities](microsoft-defender-atp/get-discovered-vulnerabilities.md) +####### [Get security recommendations](microsoft-defender-atp/get-security-recommendations.md) ####### [Add or Remove machine tags](microsoft-defender-atp/add-or-remove-machine-tags.md) ####### [Find machines by IP](microsoft-defender-atp/find-machines-by-ip.md) +####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-machine.md) +####### [Set device value](microsoft-defender-atp/set-device-value.md) ###### [Machine Action]() ####### [Machine Action methods and properties](microsoft-defender-atp/machineaction.md) @@ -382,7 +566,12 @@ ####### [Run antivirus scan](microsoft-defender-atp/run-av-scan.md) ####### [Offboard machine](microsoft-defender-atp/offboard-machine-api.md) ####### [Stop and quarantine file](microsoft-defender-atp/stop-and-quarantine-file.md) -####### [Initiate investigation (preview)](microsoft-defender-atp/initiate-autoir-investigation.md) + +###### [Automated Investigation]() +####### [Investigation methods and properties](microsoft-defender-atp/investigation.md) +####### [List Investigation](microsoft-defender-atp/get-investigation-collection.md) +####### [Get Investigation](microsoft-defender-atp/get-investigation-object.md) +####### [Start Investigation](microsoft-defender-atp/initiate-autoir-investigation.md) ###### [Indicators]() ####### [Indicators methods and properties](microsoft-defender-atp/ti-indicator.md) @@ -394,7 +583,6 @@ ####### [Get domain related alerts](microsoft-defender-atp/get-domain-related-alerts.md) ####### [Get domain related machines](microsoft-defender-atp/get-domain-related-machines.md) ####### [Get domain statistics](microsoft-defender-atp/get-domain-statistics.md) -####### [Is domain seen in organization (Deprecated)](microsoft-defender-atp/is-domain-seen-in-org.md) ###### [File]() ####### [File methods and properties](microsoft-defender-atp/files.md) @@ -405,134 +593,133 @@ ###### [IP]() ####### [Get IP related alerts](microsoft-defender-atp/get-ip-related-alerts.md) -####### [Get IP related machines (Deprecated)](microsoft-defender-atp/get-ip-related-machines.md) ####### [Get IP statistics](microsoft-defender-atp/get-ip-statistics.md) -####### [Is IP seen in organization (Deprecated)](microsoft-defender-atp/is-ip-seen-org.md) ###### [User]() ####### [User methods](microsoft-defender-atp/user.md) ####### [Get user related alerts](microsoft-defender-atp/get-user-related-alerts.md) ####### [Get user related machines](microsoft-defender-atp/get-user-related-machines.md) +###### [Score]() +####### [Score methods and properties](microsoft-defender-atp/score.md) +####### [List exposure score by machine group](microsoft-defender-atp/get-machine-group-exposure-score.md) +####### [Get exposure score](microsoft-defender-atp/get-exposure-score.md) +####### [Get device secure score](microsoft-defender-atp/get-device-secure-score.md) + +###### [Software]() +####### [Software methods and properties](microsoft-defender-atp/software.md) +####### [List software](microsoft-defender-atp/get-software.md) +####### [Get software by Id](microsoft-defender-atp/get-software-by-id.md) +####### [List software version distribution](microsoft-defender-atp/get-software-ver-distribution.md) +####### [List machines by software](microsoft-defender-atp/get-machines-by-software.md) +####### [List vulnerabilities by software](microsoft-defender-atp/get-vuln-by-software.md) +####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-software.md) + +###### [Vulnerability]() +####### [Vulnerability methods and properties](microsoft-defender-atp/vulnerability.md) +####### [List vulnerabilities](microsoft-defender-atp/get-all-vulnerabilities.md) +####### [List vulnerabilities by machine and software](microsoft-defender-atp/get-all-vulnerabilities-by-machines.md) +####### [Get vulnerability by Id](microsoft-defender-atp/get-vulnerability-by-id.md) +####### [List machines by vulnerability](microsoft-defender-atp/get-machines-by-vulnerability.md) + +###### [Recommendation]() +####### [Recommendation methods and properties](microsoft-defender-atp/recommendation.md) +####### [List all recommendations](microsoft-defender-atp/get-all-recommendations.md) +####### [Get recommendation by Id](microsoft-defender-atp/get-recommendation-by-id.md) +####### [Get recommendation by software](microsoft-defender-atp/get-recommendation-software.md) +####### [List machines by recommendation](microsoft-defender-atp/get-recommendation-machines.md) +####### [List vulnerabilities by recommendation](microsoft-defender-atp/get-recommendation-vulnerabilities.md) + ##### [How to use APIs - Samples]() -###### [Advanced Hunting API]() -####### [Schedule advanced Hunting using Microsoft Flow](microsoft-defender-atp/run-advanced-query-sample-ms-flow.md) -####### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md) -####### [Advanced Hunting using Python](microsoft-defender-atp/run-advanced-query-sample-python.md) -####### [Create custom Power BI reports](microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token.md) - -###### [Multiple APIs]() -####### [PowerShell](microsoft-defender-atp/exposed-apis-full-sample-powershell.md) - +###### [Microsoft Flow](microsoft-defender-atp/api-microsoft-flow.md) +###### [Power BI](microsoft-defender-atp/api-power-bi.md) +###### [Advanced Hunting using Python](microsoft-defender-atp/run-advanced-query-sample-python.md) +###### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md) ###### [Using OData Queries](microsoft-defender-atp/exposed-apis-odata-samples.md) -#### [Windows updates (KB) info]() -##### [Get KbInfo collection](microsoft-defender-atp/get-kbinfo-collection.md) +#### [Raw data streaming API]() +##### [Raw data streaming](microsoft-defender-atp/raw-data-export.md) +##### [Stream advanced hunting events to Azure Events hub](microsoft-defender-atp/raw-data-export-event-hub.md) +##### [Stream advanced hunting events to your storage account](microsoft-defender-atp/raw-data-export-storage.md) -#### [Common Vulnerabilities and Exposures (CVE) to KB map]() -##### [Get CVE-KB map](microsoft-defender-atp/get-cvekbmap-collection.md) - -#### [API for custom alerts (Deprecated)]() -##### [Enable the custom threat intelligence application (Deprecated)](microsoft-defender-atp/enable-custom-ti.md) -##### [Use the threat intelligence API to create custom alerts (Deprecated)](microsoft-defender-atp/use-custom-ti.md) -##### [Create custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/custom-ti-api.md) -##### [PowerShell code examples (Deprecated)](microsoft-defender-atp/powershell-example-code.md) -##### [Python code examples (Deprecated)](microsoft-defender-atp/python-example-code.md) -##### [Experiment with custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/experiment-custom-ti.md) -##### [Troubleshoot custom threat intelligence issues (Deprecated)](microsoft-defender-atp/troubleshoot-custom-ti.md) - -#### [Pull alerts to your SIEM tools]() -##### [Learn about different ways to pull alerts](microsoft-defender-atp/configure-siem.md) +#### [SIEM integration]() +##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md) +##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md) ##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) -##### [Configure Splunk to pull alerts](microsoft-defender-atp/configure-splunk.md) -##### [Configure HP ArcSight to pull alerts](microsoft-defender-atp/configure-arcsight.md) -##### [Microsoft Defender ATP SIEM alert API fields](microsoft-defender-atp/api-portal-mapping.md) -##### [Pull alerts using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) +##### [Configure Micro Focus ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md) +##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md) +##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) +##### [Fetch alerts from customer tenant](microsoft-defender-atp/fetch-alerts-mssp.md) ##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md) -#### [Reporting]() -##### [Create and build Power BI reports using Microsoft Defender ATP data](microsoft-defender-atp/powerbi-reports.md) -##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md) -##### [Machine health and compliance reports](microsoft-defender-atp/machine-reports.md) - -#### [Interoperability]() +#### [Partners & APIs]() ##### [Partner applications](microsoft-defender-atp/partner-applications.md) - -#### [Manage machine configuration]() -##### [Ensure your machines are configured properly](microsoft-defender-atp/configure-machines.md) -##### [Monitor and increase machine onboarding](microsoft-defender-atp/configure-machines-onboarding.md) -##### [Increase compliance to the security baseline](microsoft-defender-atp/configure-machines-security-baseline.md) -##### [Optimize ASR rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) - +##### [Connected applications](microsoft-defender-atp/connected-applications.md) +##### [API explorer](microsoft-defender-atp/api-explorer.md) #### [Role-based access control]() ##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md) ##### [Create and manage roles](microsoft-defender-atp/user-roles.md) -##### [Create and manage machine groups]() -###### [Using machine groups](microsoft-defender-atp/machine-groups.md) -###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md) +##### [Create and manage device groups]() +###### [Using device groups](microsoft-defender-atp/machine-groups.md) +###### [Create and manage device tags](microsoft-defender-atp/machine-tags.md) -#### [Configure managed security service provider (MSSP) support](microsoft-defender-atp/configure-mssp-support.md) +#### [Managed security service provider (MSSP) integration]() +##### [Configure managed security service provider integration](microsoft-defender-atp/configure-mssp-support.md) +##### [Supported managed security service providers](microsoft-defender-atp/mssp-list.md) +##### [Grant MSSP access to the portal](microsoft-defender-atp/grant-mssp-access.md) +##### [Access the MSSP customer portal](microsoft-defender-atp/access-mssp-portal.md) +##### [Configure alert notifications](microsoft-defender-atp/configure-mssp-notifications.md) +##### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md) + +### [Partner integration scenarios]() +#### [Technical partner opportunities](microsoft-defender-atp/partner-integration.md) +#### [Managed security service provider opportunity](microsoft-defender-atp/mssp-support.md) +#### [Become a Microsoft Defender ATP partner](microsoft-defender-atp/get-started-partner-integration.md) -### [Configure Microsoft threat protection integration]() -#### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md) -#### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md) -#### [Configure information protection in Windows](microsoft-defender-atp/information-protection-in-windows-config.md) +### [Integrations]() +#### [Microsoft Defender ATP integrations](microsoft-defender-atp/threat-protection-integration.md) +#### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md) +#### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md) -### [Configure portal settings]() -#### [General]() -##### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md) -##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md) -##### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md) -##### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md) -##### [Configure advanced features](microsoft-defender-atp/advanced-features.md) -#### [Permissions]() -##### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md) -##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md) -###### [Create and manage roles](microsoft-defender-atp/user-roles.md) -###### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md) -####### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md) +### [Information protection in Windows overview]() +#### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) -#### [APIs]() -##### [Enable Threat intel (Deprecated)](microsoft-defender-atp/enable-custom-ti.md) -##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) +### [Access the Microsoft Defender ATP Community Center](microsoft-defender-atp/community.md) + +### [Helpful resources](microsoft-defender-atp/helpful-resources.md) + + + +### [Troubleshoot Microsoft Defender ATP]() +#### [Troubleshoot sensor state]() +##### [Check sensor state](microsoft-defender-atp/check-sensor-status.md) +##### [Fix unhealthy sensors](microsoft-defender-atp/fix-unhealthy-sensors.md) +##### [Inactive devices](microsoft-defender-atp/fix-unhealthy-sensors.md#inactive-devices) +##### [Misconfigured devices](microsoft-defender-atp/fix-unhealthy-sensors.md#misconfigured-devices) +##### [Review sensor events and errors on machines with Event Viewer](microsoft-defender-atp/event-error-codes.md) -#### [Rules]() -##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md) -##### [Manage automation allowed/blocked lists](microsoft-defender-atp/manage-automation-allowed-blocked-list.md) -##### [Manage indicators](microsoft-defender-atp/manage-indicators.md) -##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md) -##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md) - -#### [Machine management]() -##### [Onboarding machines](microsoft-defender-atp/onboard-configure.md) -##### [Offboarding machines](microsoft-defender-atp/offboard-machines.md) - -#### [Configure Windows Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md) +#### [Troubleshoot Microsoft Defender ATP service issues]() +##### [Troubleshoot service issues](microsoft-defender-atp/troubleshoot-mdatp.md) +##### [Check service health](microsoft-defender-atp/service-status.md) +##### [Contact Microsoft Defender ATP support](microsoft-defender-atp/contact-support.md) -## [Troubleshoot Microsoft Defender ATP]() -### [Troubleshoot sensor state]() -#### [Check sensor state](microsoft-defender-atp/check-sensor-status.md) -#### [Fix unhealthy sensors](microsoft-defender-atp/fix-unhealthy-sensors.md) -#### [Inactive machines](microsoft-defender-atp/fix-unhealthy-sensors.md#inactive-machines) -#### [Misconfigured machines](microsoft-defender-atp/fix-unhealthy-sensors.md#misconfigured-machines) -#### [Review sensor events and errors on machines with Event Viewer](microsoft-defender-atp/event-error-codes.md) +#### [Troubleshoot live response issues](microsoft-defender-atp/troubleshoot-live-response.md) -### [Troubleshoot Microsoft Defender ATP service issues]() -#### [Troubleshoot service issues](microsoft-defender-atp/troubleshoot-mdatp.md) -#### [Check service health](microsoft-defender-atp/service-status.md) - -### [Troubleshoot live response issues]() -#### [Troubleshoot issues related to live response](microsoft-defender-atp/troubleshoot-live-response.md) - -### [Troubleshoot attack surface reduction]() -#### [Network protection](windows-defender-exploit-guard/troubleshoot-np.md) -#### [Attack surface reduction rules](windows-defender-exploit-guard/troubleshoot-asr.md) +#### [Collect support logs using LiveAnalyzer ](microsoft-defender-atp/troubleshoot-collect-support-log.md) -### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) +#### [Troubleshoot attack surface reduction issues]() +##### [Network protection](microsoft-defender-atp/troubleshoot-np.md) +##### [Attack surface reduction rules](microsoft-defender-atp/troubleshoot-asr.md) + +#### [Troubleshoot next-generation protection](microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md) +#### [Troubleshoot migration issues](microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md) + + + @@ -555,12 +742,11 @@ ### [How Microsoft identifies malware and PUA](intelligence/criteria.md) ### [Submit files for analysis](intelligence/submission-guide.md) ### [Safety Scanner download](intelligence/safety-scanner-download.md) -### [Industry antivirus tests](intelligence/top-scoring-industry-antivirus-tests.md) ### [Industry collaboration programs](intelligence/cybersecurity-industry-partners.md) #### [Virus information alliance](intelligence/virus-information-alliance-criteria.md) #### [Microsoft virus initiative](intelligence/virus-initiative-criteria.md) #### [Coordinated malware eradication](intelligence/coordinated-malware-eradication.md) -### [Information for developers](intelligence/developer-info.md) +### [Information for developers]() #### [Software developer FAQ](intelligence/developer-faq.md) #### [Software developer resources](intelligence/developer-resources.md) @@ -585,11 +771,15 @@ #### [Family options](windows-defender-security-center/wdsc-family-options.md) -### [SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) -#### [SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) -#### [Set up and use SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) +### [Microsoft Defender SmartScreen](microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) +#### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md) +#### [Set up and use Microsoft Defender SmartScreen on individual devices](microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md) +### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md) +#### [Windows Sandbox architecture](windows-sandbox/windows-sandbox-architecture.md) +#### [Windows Sandbox configuration](windows-sandbox/windows-sandbox-configure-using-wsb-file.md) + ### [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) @@ -685,7 +875,7 @@ ####### [Event 4765 S: SID History was added to an account.](auditing/event-4765.md) ####### [Event 4766 F: An attempt to add SID History to an account failed.](auditing/event-4766.md) ####### [Event 4767 S: A user account was unlocked.](auditing/event-4767.md) -####### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](auditing/event-4780.md) +####### [Event 4780 S: The ACL was set on accounts that are members of administrators groups.](auditing/event-4780.md) ####### [Event 4781 S: The name of an account was changed.](auditing/event-4781.md) ####### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](auditing/event-4794.md) ####### [Event 4798 S: A user's local group membership was enumerated.](auditing/event-4798.md) @@ -711,6 +901,8 @@ ####### [Event 4689 S: A process has exited.](auditing/event-4689.md) ###### [Audit RPC Events](auditing/audit-rpc-events.md) ####### [Event 5712 S: A Remote Procedure Call, RPC, was attempted.](auditing/event-5712.md) +###### [Audit Token Right Adjusted](auditing/audit-token-right-adjusted.md) +####### [Event 4703 S: A user right was adjusted.](auditing/event-4703.md) ###### [Audit Detailed Directory Service Replication](auditing/audit-detailed-directory-service-replication.md) ####### [Event 4928 S, F: An Active Directory replica source naming context was established.](auditing/event-4928.md) ####### [Event 4929 S, F: An Active Directory replica source naming context was removed.](auditing/event-4929.md) @@ -1055,7 +1247,7 @@ ###### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) ###### [Network security: Allow LocalSystem NULL session fallback](security-policy-settings/network-security-allow-localsystem-null-session-fallback.md) ###### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md) -###### [Network security: Configure encryption types allowed for Kerberos Win7 only](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) +###### [Network security: Configure encryption types allowed for Kerberos](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) ###### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md) ###### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md) ###### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md) @@ -1076,7 +1268,7 @@ ###### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md) ###### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md) ###### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md) -###### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) +###### [System objects: Strengthen default permissions of internal system objects (Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) ###### [System settings: Optional subsystems](security-policy-settings/system-settings-optional-subsystems.md) ###### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md) ###### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md) @@ -1136,20 +1328,15 @@ ###### [Synchronize directory service data](security-policy-settings/synchronize-directory-service-data.md) ###### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md) -### [Windows security guidance for enterprises](windows-security-configuration-framework/windows-security-compliance.md) +### Windows security guidance for enterprises #### [Windows security baselines](windows-security-configuration-framework/windows-security-baselines.md) ##### [Security Compliance Toolkit](windows-security-configuration-framework/security-compliance-toolkit-10.md) ##### [Get support](windows-security-configuration-framework/get-support-for-security-baselines.md) -#### [Windows security configuration framework](windows-security-configuration-framework/windows-security-configuration-framework.md) -##### [Level 1 enterprise basic security](windows-security-configuration-framework/level-1-enterprise-basic-security.md) -##### [Level 2 enterprise enhanced security](windows-security-configuration-framework/level-2-enterprise-enhanced-security.md) -##### [Level 3 enterprise high security](windows-security-configuration-framework/level-3-enterprise-high-security.md) -##### [Level 4 enterprise dev/ops workstation](windows-security-configuration-framework/level-4-enterprise-devops-security.md) -##### [Level 5 enterprise administrator workstation](windows-security-configuration-framework/level-5-enterprise-administrator-security.md) - ### [MBSA removal and alternatives](mbsa-removal-and-guidance.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ## [Change history for Threat protection](change-history-for-threat-protection.md) + + diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index 8896c08c25..2893cf7ece 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -2,14 +2,14 @@ title: Advanced security audit policy settings (Windows 10) description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 -ms.reviewer: -ms.author: dolmont +ms.reviewer: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -42,7 +42,7 @@ Configuring policy settings in this category can help you document attempts to a - [Audit Credential Validation](audit-credential-validation.md) - [Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md) - [Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md) -- [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md) +- [Audit Other Account Logon Events](audit-other-account-logon-events.md) ## Account Management @@ -64,8 +64,7 @@ Detailed Tracking security policy settings and audit events can be used to monit - [Audit Process Creation](audit-process-creation.md) - [Audit Process Termination](audit-process-termination.md) - [Audit RPC Events](audit-rpc-events.md) -- [Audit Credential Validation](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation) - > **Note:** For more information, see [Security Monitoring](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/) +- [Audit Token Right Adjusted](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-token-right-adjusted) ## DS Access @@ -151,8 +150,8 @@ Auditors will be able to prove that every resource in the system is protected by Resource SACLs are also useful for diagnostic scenarios. For example, setting the Global Object Access Auditing policy to log all the activity for a specific user and enabling the policy to track "Access denied" events for the file system or registry can help administrators quickly identify which object in a system is denying a user access. -> **Note:**  If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object -Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. +> [!NOTE] +> If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md index c0611c6e06..99b8a989c4 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md @@ -3,13 +3,13 @@ title: Advanced security auditing FAQ (Windows 10) description: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md index 63485f34ef..7c55d51d21 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md @@ -1,15 +1,15 @@ --- title: Advanced security audit policies (Windows 10) -description: Advanced security audit policy settings are found in Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies and appear to overlap with basic security audit policies, but they are recorded and applied differently. +description: Advanced security audit policy settings may appear to overlap with basic policies, but they are recorded and applied differently. Learn more about them here. ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md index f416edda8c..505da9bbb0 100644 --- a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md +++ b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md @@ -1,16 +1,16 @@ --- title: Appendix A, Security monitoring recommendations for many audit events (Windows 10) -description: Appendix A, Security monitoring recommendations for many audit events +description: Learn about recommendations for the type of monitoring required for certain classes of security audit events. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # Appendix A: Security monitoring recommendations for many audit events @@ -27,7 +27,7 @@ This document, the [Advanced security audit policy settings](advanced-security-a | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor relevant events for the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor relevant events for the **“Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | Monitor the relevant events for **“Subject\\Security ID”** accounts that are outside the whitelist of accounts. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | Monitor the relevant events for **“Subject\\Security ID”** accounts that are outside the allow list of accounts. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | Identify events that correspond to the actions you want to monitor, and for those events, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index d72c39898d..a18783d92c 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -1,15 +1,15 @@ --- title: Apply a basic audit policy on a file or folder (Windows 10) -description: You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. +description: Apply audit policies to individual files and folders on your computer by setting the permission type to record access attempts in the security log. ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -23,25 +23,26 @@ ms.date: 07/25/2018 - Windows 10 You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. -To complete this procedure, you must be logged on as a member of the built-in Administrators group or you must have been granted the **Manage auditing and security log** right. + +To complete this procedure, you must be signed in as a member of the built-in Administrators group or have **Manage auditing and security log** rights. **To apply or modify auditing policy settings for a local file or folder** -1. Right-click the file or folder that you want to audit, click **Properties**, and then click the **Security** tab. -2. Click **Advanced**. -3. In the **Advanced Security Settings** dialog box, click the **Auditing** tab, and then click **Continue**. +1. Select and hold (or right-click) the file or folder that you want to audit, select **Properties**, and then select the **Security** tab. +2. Select **Advanced**. +3. In the **Advanced Security Settings** dialog box, select the **Auditing** tab, and then select **Continue**. 4. Do one of the following: - - To set up auditing for a new user or group, click **Add**. Click **Select a principal**, type the name of the user or group that you want, and then click **OK**. - - To remove auditing for an existing group or user, click the group or user name, click **Remove**, click **OK**, and then skip the rest of this procedure. - - To view or change auditing for an existing group or user, click its name, and then click **Edit.** + - To set up auditing for a new user or group, select **Add**. Select **Select a principal**, type the name of the user or group that you want, and then select **OK**. + - To remove auditing for an existing group or user, select the group or user name, select **Remove**, select **OK**, and then skip the rest of this procedure. + - To view or change auditing for an existing group or user, select its name, and then select **Edit.** 5. In the **Type** box, indicate what actions you want to audit by selecting the appropriate check boxes: - - To audit successful events, click **Success.** - - To audit failure events, click **Fail.** - - To audit all events, click **All.** + - To audit successful events, select **Success.** + - To audit failure events, select **Fail.** + - To audit all events, select **All.** -6. In the **Applies to** box, select the object(s) that the audit of events will apply to. These include: +6. In the **Applies to** box, select the object(s) to which the audit of events will apply. These include: - **This folder only** - **This folder, subfolders and files** @@ -49,22 +50,24 @@ To complete this procedure, you must be logged on as a member of the built-in Ad - **This folder and files** - **Subfolders and files only** - **Subfolders only** - - **Files only** + - **Files only** 7. By default, the selected **Basic Permissions** to audit are the following: - **Read and execute** - **List folder contents** - **Read** - - Additionally, you can choose **Full control**, **Modify**, and/or **Write** permissions with your selected audit combination. + - Additionally, with your selected audit combination, you can select any combination of the following permissions: + - **Full control** + - **Modify** + - **Write** - - -> **Important:**  Before setting up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md) by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited. +> [!IMPORTANT] +> Before you set up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md). To do this, define auditing policy settings for the object access event category. If you don't enable object access auditing, you'll receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   ## Additional considerations -- After object access auditing is enabled, view the security log in Event Viewer to review the results of your changes. +- After you turn on object access auditing, view the security log in Event Viewer to review the results of your changes. - You can set up file and folder auditing only on NTFS drives. -- Because the security log is limited in size, select the files and folders to be audited carefully. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer. +- Because the security log is limited in size, carefully select the files and folders to be audited. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer.     diff --git a/windows/security/threat-protection/auditing/audit-account-lockout.md b/windows/security/threat-protection/auditing/audit-account-lockout.md index dcd17c9695..1ea3e878e6 100644 --- a/windows/security/threat-protection/auditing/audit-account-lockout.md +++ b/windows/security/threat-protection/auditing/audit-account-lockout.md @@ -1,16 +1,16 @@ --- title: Audit Account Lockout (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Account Lockout, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out. +description: The policy setting, Audit Account Lockout, enables you to audit security events generated by a failed attempt to log on to an account that is locked out. ms.assetid: da68624b-a174-482c-9bc5-ddddab38e589 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 07/16/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md index e880c6b05b..b594ba40ca 100644 --- a/windows/security/threat-protection/auditing/audit-application-generated.md +++ b/windows/security/threat-protection/auditing/audit-application-generated.md @@ -1,16 +1,16 @@ --- title: Audit Application Generated (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Application Generated, which determines whether the operating system generates audit events when applications attempt to use the Windows Auditing application programming interfaces (APIs). +description: The policy setting, Audit Application Generated, determines if audit events are generated when applications attempt to use the Windows Auditing APIs. ms.assetid: 6c58a365-b25b-42b8-98ab-819002e31871 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md index 870ef553dd..8dce282dfa 100644 --- a/windows/security/threat-protection/auditing/audit-application-group-management.md +++ b/windows/security/threat-protection/auditing/audit-application-group-management.md @@ -1,16 +1,16 @@ --- title: Audit Application Group Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Application Group Management, which determines whether the operating system generates audit events when application group management tasks are performed. +description: The policy setting, Audit Application Group Management, determines if audit events are generated when application group management tasks are performed. ms.assetid: 1bcaa41e-5027-4a86-96b7-f04eaf1c0606 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md index f8d37dcdaa..376cab2bcf 100644 --- a/windows/security/threat-protection/auditing/audit-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-audit-policy-change.md @@ -1,16 +1,16 @@ --- title: Audit Audit Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Audit Policy Change, which determines whether the operating system generates audit events when changes are made to audit policy. +description: The Advanced Security Audit policy setting, Audit Audit Policy Change, determines if audit events are generated when changes are made to audit policy. ms.assetid: 7153bf75-6978-4d7e-a821-59a699efb8a9 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md index 0171ab438c..4a6f754c01 100644 --- a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md @@ -1,16 +1,16 @@ --- title: Audit Authentication Policy Change (Windows 10) -description: This topic for the IT professional describes this Advanced Security Audit policy setting, Audit Authentication Policy Change, which determines whether the operating system generates audit events when changes are made to authentication policy. +description: The Advanced Security Audit policy setting, Audit Authentication Policy Change, determines if audit events are generated when authentication policy is changed. ms.assetid: aa9cea7a-aadf-47b7-b704-ac253b8e79be ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md index 329e7259b8..b13bec6cbc 100644 --- a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md @@ -1,16 +1,16 @@ --- title: Audit Authorization Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Authorization Policy Change, which determines whether the operating system generates audit events when specific changes are made to the authorization policy. +description: The policy setting, Audit Authorization Policy Change, determines if audit events are generated when specific changes are made to the authorization policy. ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -25,9 +25,9 @@ Audit Authorization Policy Change allows you to audit assignment and removal of | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
                              However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
                              However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
                              However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
                              However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
                              However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes in user rights policies, or changes of resource attributes or Central Access Policy applied to file system objects.
                              However, if you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md index a9c4011dab..f655b5d8c6 100644 --- a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md +++ b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md @@ -1,16 +1,16 @@ --- title: Audit Central Access Policy Staging (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Central Access Policy Staging, which determines permissions on a Central Access Policy. +description: The Advanced Security Audit policy setting, Audit Central Access Policy Staging, determines permissions on a Central Access Policy. ms.assetid: D9BB11CE-949A-4B48-82BF-30DC5E6FC67D ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md index 1dd10ad26a..a1e50c1538 100644 --- a/windows/security/threat-protection/auditing/audit-certification-services.md +++ b/windows/security/threat-protection/auditing/audit-certification-services.md @@ -1,16 +1,16 @@ --- title: Audit Certification Services (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Certification Services, which determines whether the operating system generates events when Active Directory Certificate Services (ADÂ CS) operations are performed. +description: The policy setting, Audit Certification Services, decides if events are generated when Active Directory Certificate Services (ADA CS) operations are performed. ms.assetid: cdefc34e-fb1f-4eff-b766-17713c5a1b03 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-computer-account-management.md b/windows/security/threat-protection/auditing/audit-computer-account-management.md index 1425e2cb70..ab838fd042 100644 --- a/windows/security/threat-protection/auditing/audit-computer-account-management.md +++ b/windows/security/threat-protection/auditing/audit-computer-account-management.md @@ -1,16 +1,16 @@ --- title: Audit Computer Account Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Computer Account Management, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted. +description: The policy setting, Audit Computer Account Management, determines if audit events are generated when a computer account is created, changed, or deleted. ms.assetid: 6c406693-57bf-4411-bb6c-ff83ce548991 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-credential-validation.md b/windows/security/threat-protection/auditing/audit-credential-validation.md index 68b0305d77..9ce3b5aa5b 100644 --- a/windows/security/threat-protection/auditing/audit-credential-validation.md +++ b/windows/security/threat-protection/auditing/audit-credential-validation.md @@ -1,16 +1,16 @@ --- title: Audit Credential Validation (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Credential Validation, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request. +description: The policy setting, Audit Credential Validation, determines if audit events are generated when user account logon request credentials are submitted. ms.assetid: 6654b33a-922e-4a43-8223-ec5086dfc926 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md index 93757103e6..859859fc2b 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md @@ -1,16 +1,16 @@ --- title: Audit Detailed Directory Service Replication (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Detailed Directory Service Replication, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers. +description: The Audit Detailed Directory Service Replication setting decides if audit events contain detailed tracking info about data replicated between domain controllers ms.assetid: 1b89c8f5-bce7-4b20-8701-42585c7ab993 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-file-share.md b/windows/security/threat-protection/auditing/audit-detailed-file-share.md index 6d6e5b0095..3b223b9331 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-file-share.md +++ b/windows/security/threat-protection/auditing/audit-detailed-file-share.md @@ -1,16 +1,16 @@ --- title: Audit Detailed File Share (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Detailed File Share, which allows you to audit attempts to access files and folders on a shared folder. +description: The Advanced Security Audit policy setting, Audit Detailed File Share, allows you to audit attempts to access files and folders on a shared folder. ms.assetid: 60310104-b820-4033-a1cb-022a34f064ae ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -37,9 +37,9 @@ There are no system access control lists (SACLs) for shared folders. If this pol | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | No | Yes | No | Yes | Audit Success for this subcategory on domain controllers typically will lead to very high volume of events, especially for SYSVOL share.
                              We recommend monitoring Failure access attempts: the volume should not be very high. You will be able to see who was not able to get access to a file or folder on a network share on a computer. | -| Member Server | IF | Yes | IF | Yes | IF – If a server has shared network folders which typically get many access requests (File Server, for example), the volume of events might be very high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use the [Audit File System](audit-file-system.md) subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                              The volume of Failure events for member servers should not be very high (if they are not File Servers). With Failure auditing, you will be able to see who was not able to get access to a file or folder on a network share on this computer. | -| Workstation | IF | Yes | IF | Yes | IF – If a workstation has shared network folders which typically get many access requests, the volume of events might be very high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use Audit File System subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                              The volume of Failure events for workstations should not be very high. With Failure auditing, you will be able to see who was not able to get access to a file or folder on a network share on this computer. | +| Domain Controller | No | Yes | No | Yes | Audit Success for this subcategory on domain controllers typically will lead to high volume of events, especially for SYSVOL share.
                              We recommend monitoring Failure access attempts: the volume should not be high. You will be able to see who was not able to get access to a file or folder on a network share on a computer. | +| Member Server | IF | Yes | IF | Yes | IF – If a server has shared network folders that typically get many access requests (File Server, for example), the volume of events might be high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use the [Audit File System](audit-file-system.md) subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                              The volume of Failure events for member servers should not be high (if they are not File Servers). With Failure auditing, you can see who can't access a file or folder on a network share on this computer. | +| Workstation | IF | Yes | IF | Yes | IF – If a workstation has shared network folders that typically get many access requests, the volume of events might be high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use Audit File System subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                              The volume of Failure events for workstations should not be high. With Failure auditing, you can see who can't access a file or folder on a network share on this computer. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-directory-service-access.md b/windows/security/threat-protection/auditing/audit-directory-service-access.md index a56a269acd..0a13f90a87 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-access.md @@ -1,16 +1,16 @@ --- title: Audit Directory Service Access (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Access, which determines whether the operating system generates audit events when an Active Directory Domain Services (ADÂ DS) object is accessed. +description: The policy setting Audit Directory Service Access determines if audit events are generated when an Active Directory Domain Services (ADA DS) object is accessed. ms.assetid: ba2562ba-4282-4588-b87c-a3fcb771c7d0 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-changes.md b/windows/security/threat-protection/auditing/audit-directory-service-changes.md index 8fc975671d..1a962ee86f 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-changes.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-changes.md @@ -1,16 +1,16 @@ --- title: Audit Directory Service Changes (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Changes, which determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (ADÂ DS). +description: The policy setting Audit Directory Service Changes determines if audit events are generated when objects in Active Directory Domain Services (AD DS) are changed ms.assetid: 9f7c0dd4-3977-47dd-a0fb-ec2f17cad05e ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-directory-service-replication.md index 6580b8f311..dffea817d4 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-replication.md @@ -1,16 +1,16 @@ --- title: Audit Directory Service Replication (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Replication, which determines whether the operating system generates audit events when replication between two domain controllers begins and ends. +description: Audit Directory Service Replication is a policy setting that decides if audit events are created when replication between two domain controllers begins or ends. ms.assetid: b95d296c-7993-4e8d-8064-a8bbe284bd56 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md index 83d36fa376..2bacdbe3a1 100644 --- a/windows/security/threat-protection/auditing/audit-distribution-group-management.md +++ b/windows/security/threat-protection/auditing/audit-distribution-group-management.md @@ -1,16 +1,16 @@ --- title: Audit Distribution Group Management (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Distribution Group Management, which determines whether the operating system generates audit events for specific distribution-group management tasks. +description: The policy setting, Audit Distribution Group Management, determines if audit events are generated for specific distribution-group management tasks. ms.assetid: d46693a4-5887-4a58-85db-2f6cba224a66 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-dpapi-activity.md b/windows/security/threat-protection/auditing/audit-dpapi-activity.md index 3efd600fab..fc94d79d95 100644 --- a/windows/security/threat-protection/auditing/audit-dpapi-activity.md +++ b/windows/security/threat-protection/auditing/audit-dpapi-activity.md @@ -1,16 +1,16 @@ --- title: Audit DPAPI Activity (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit DPAPI Activity, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI). +description: The policy setting, Audit DPAPI Activity, decides if encryption/decryption calls to the data protection application interface (DPAPI) generate audit events. ms.assetid: be4d4c83-c857-4e3d-a84e-8bcc3f2c99cd ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-file-share.md b/windows/security/threat-protection/auditing/audit-file-share.md index ed86354e2b..ccab879b4f 100644 --- a/windows/security/threat-protection/auditing/audit-file-share.md +++ b/windows/security/threat-protection/auditing/audit-file-share.md @@ -1,16 +1,16 @@ --- title: Audit File Share (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File Share, which determines whether the operating system generates audit events when a file share is accessed. +description: The Advanced Security Audit policy setting, Audit File Share, determines if the operating system generates audit events when a file share is accessed. ms.assetid: 9ea985f8-8936-4b79-abdb-35cbb7138f78 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md index 6f97bd7fdd..57ea7bc917 100644 --- a/windows/security/threat-protection/auditing/audit-file-system.md +++ b/windows/security/threat-protection/auditing/audit-file-system.md @@ -1,16 +1,16 @@ --- title: Audit File System (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File System, which determines whether the operating system generates audit events when users attempt to access file system objects. +description: The Advanced Security Audit policy setting, Audit File System, determines if audit events are generated when users attempt to access file system objects. ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md index 187040144e..52475e4276 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md @@ -1,16 +1,16 @@ --- title: Audit Filtering Platform Connection (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Connection, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform. +description: The policy setting, Audit Filtering Platform Connection, decides if audit events are generated when connections are allow/blocked by Windows Filtering Platform. ms.assetid: d72936e9-ff01-4d18-b864-a4958815df59 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md index e37ee47f16..bdaff33b06 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md @@ -1,16 +1,16 @@ --- title: Audit Filtering Platform Packet Drop (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Packet Drop, which determines whether the operating system generates audit events when packets are dropped by the Windows Filtering Platform. +description: The policy setting, Audit Filtering Platform Packet Drop, determines if audit events are generated when packets are dropped by the Windows Filtering Platform. ms.assetid: 95457601-68d1-4385-af20-87916ddab906 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md index 6cd117429a..204a9b6320 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md @@ -1,16 +1,16 @@ --- title: Audit Filtering Platform Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Policy Change, which determines whether the operating system generates audit events for certain IPsec and Windows Filtering Platform actions. +description: The policy setting, Audit Filtering Platform Policy Change, determines if audit events are generated for certain IPsec and Windows Filtering Platform actions. ms.assetid: 0eaf1c56-672b-4ea9-825a-22dc03eb4041 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -32,14 +32,6 @@ Audit Filtering Platform Policy Change allows you to audit events generated by c Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). -This subcategory is outside the scope of this document. - -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|---------------------------------------------------------| -| Domain Controller | - | - | - | - | This subcategory is outside the scope of this document. | -| Member Server | - | - | - | - | This subcategory is outside the scope of this document. | -| Workstation | - | - | - | - | This subcategory is outside the scope of this document. | - - 4709(S): IPsec Services was started. - 4710(S): IPsec Services was disabled. diff --git a/windows/security/threat-protection/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md index 7af1da773b..5775f97220 100644 --- a/windows/security/threat-protection/auditing/audit-group-membership.md +++ b/windows/security/threat-protection/auditing/audit-group-membership.md @@ -1,16 +1,16 @@ --- title: Audit Group Membership (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Group Membership, which enables you to audit group memberships when they are enumerated on the client PC. +description: Using the advanced security audit policy setting, Audit Group Membership, you can audit group memberships when they're enumerated on the client PC. ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -20,8 +20,7 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - -Audit Group Membership enables you to audit group memberships when they are enumerated on the client computer. +By using Audit Group Membership, you can audit group memberships when they're enumerated on the client computer. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. @@ -33,15 +32,15 @@ Multiple events are generated if the group membership information cannot fit in **Event volume**: -- Low on a client computer. +- Low on a client computer. -- Medium on a domain controller or network servers. +- Medium on a domain controller or network servers. | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group or other high value groups).
                              For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group or other high value groups).
                              For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group or other high value groups).
                              For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | Yes | No | Yes | No | Group membership information for a logged-in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group, or other high value groups).
                              For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                              This subcategory doesn’t have Failure events, so this subcategory doesn't have a recommendation to enable Failure auditing. | +| Member Server | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group, or other high value groups).
                              For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                              This subcategory doesn’t have Failure events, so this subcategory doesn't have a recommendation to enable Failure auditing. | +| Workstation | Yes | No | Yes | No | Group membership information for a logged-in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group, or other high value groups).
                              For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                              This subcategory doesn’t have Failure events, so this subcategory doesn't have a recommendation to enable Failure auditing. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md index 4f4f0616af..64fd2edce2 100644 --- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md +++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md @@ -1,16 +1,16 @@ --- title: Audit Handle Manipulation (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Handle Manipulation, which determines whether the operating system generates audit events when a handle to an object is opened or closed. +description: The Advanced Security Audit policy setting, Audit Handle Manipulation, determines if audit events are generated when a handle to an object is opened or closed. ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md index 6b69b8a282..d396f0ed40 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md @@ -1,16 +1,16 @@ --- title: Audit IPsec Driver (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit IPsec Driver, which determines whether the operating system generates audit events for the activities of the IPsec driver. +description: The Advanced Security Audit policy setting, Audit IPsec Driver, determines if audit events are generated for the activities of the IPsec driver. ms.assetid: c8b8c02f-5ad0-4ee5-9123-ea8cdae356a5 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md index 27e7cf7591..37421d3b3e 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md @@ -1,16 +1,16 @@ --- title: Audit IPsec Extended Mode (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Extended Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +description: The setting, Audit IPsec Extended Mode, determines if audit events are generated for the results of IKE protocol and AuthIP during Extended Mode negotiations. ms.assetid: 2b4fee9e-482a-4181-88a8-6a79d8fc8049 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md index 84c5eda210..bf2db28b53 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md @@ -1,16 +1,16 @@ --- title: Audit IPsec Main Mode (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Main Mode, which determines whether the operating system generates events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +description: Learn about the policy setting, Audit IPsec Main Mode, which determines if the results of certain protocols generate events during Main Mode negotiations. ms.assetid: 06ed26ec-3620-4ef4-a47a-c70df9c8827b ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 9f081e8e45..290c41687a 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -1,16 +1,16 @@ --- title: Audit IPsec Quick Mode (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Quick Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +description: The policy setting, Audit IPsec Quick Mode, decides if audit events are generated for the results of the IKE protocol and AuthIP during Quick Mode negotiations. ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md index 995bf11ffc..529003459d 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md @@ -1,16 +1,16 @@ --- title: Audit Kerberos Authentication Service (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Authentication Service, which determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. +description: The policy setting Audit Kerberos Authentication Service decides if audit events are generated for Kerberos authentication ticket-granting ticket (TGT) requests ms.assetid: 990dd6d9-1a1f-4cce-97ba-5d7e0a7db859 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md index 4e685381b1..0c95144cb1 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md @@ -1,16 +1,16 @@ --- title: Audit Kerberos Service Ticket Operations (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Service Ticket Operations, which determines whether the operating system generates security audit events for Kerberos service ticket requests. +description: The policy setting, Audit Kerberos Service Ticket Operations, determines if security audit events are generated for Kerberos service ticket requests. ms.assetid: ddc0abef-ac7f-4849-b90d-66700470ccd6 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -31,7 +31,7 @@ This subcategory contains events about issued TGSs and failed TGS requests. | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | IF | Yes | Yes | Yes | Expected volume is very high on domain controllers.

                              IF - We recommend Success auditing, because you will see all Kerberos Service Ticket requests (TGS requests), which are part of service use and access requests by specific accounts. Also, you can see the IP address from which this account requested TGS, when TGS was requested, which encryption type was used, and so on. For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                              We recommend Failure auditing, because you will see all failed requests and be able to investigate the reason for failure. You will also be able to detect Kerberos issues or possible attack attempts. | +| Domain Controller | IF | Yes | Yes | Yes | Expected volume is very high on domain controllers.

                              IF - We recommend Success auditing, because you will see all Kerberos Service Ticket requests (TGS requests), which are part of service use and access requests by specific accounts. Also, you can see the IP address from which this account requested TGS, when TGS was requested, which encryption type was used, and so on. For recommendations for using and analyzing the collected information, see our [***Security Monitoring Recommendations***](https://docs.microsoft.com/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events).

                              We recommend Failure auditing, because you will see all failed requests and be able to investigate the reason for failure. You will also be able to detect Kerberos issues or possible attack attempts. | | Member Server | No | No | No | No | This subcategory makes sense only on domain controllers. | | Workstation | No | No | No | No | This subcategory makes sense only on domain controllers. | @@ -42,4 +42,3 @@ This subcategory contains events about issued TGSs and failed TGS requests. - [4770](event-4770.md)(S): A Kerberos service ticket was renewed. - [4773](event-4773.md)(F): A Kerberos service ticket request failed. - diff --git a/windows/security/threat-protection/auditing/audit-kernel-object.md b/windows/security/threat-protection/auditing/audit-kernel-object.md index f4c965ec52..60f0a374d8 100644 --- a/windows/security/threat-protection/auditing/audit-kernel-object.md +++ b/windows/security/threat-protection/auditing/audit-kernel-object.md @@ -1,16 +1,16 @@ --- title: Audit Kernel Object (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kernel Object, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. +description: The policy setting, Audit Kernel Object, decides if user attempts to access the system kernel (which includes mutexes and semaphores) generate audit events. ms.assetid: 75619d8b-b1eb-445b-afc9-0f9053be97fb ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md index 3ff2570d46..011a5d397c 100644 --- a/windows/security/threat-protection/auditing/audit-logoff.md +++ b/windows/security/threat-protection/auditing/audit-logoff.md @@ -1,16 +1,16 @@ --- title: Audit Logoff (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logoff, which determines whether the operating system generates audit events when logon sessions are terminated. +description: The Advanced Security Audit policy setting, Audit Logoff, determines if audit events are generated when logon sessions are terminated. ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 07/16/2018 --- @@ -23,7 +23,7 @@ ms.date: 07/16/2018 Audit Logoff determines whether the operating system generates audit events when logon sessions are terminated. -These events occur on the computer that was accessed. In the case of an interactive logon, these events are generated on the computer that was logged on to. +These events occur on the computer that was accessed. For an interactive logon, these events are generated on the computer that was logged on to. There is no failure event in this subcategory because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. @@ -31,13 +31,13 @@ Logon events are essential to understanding user activity and detecting potentia **Event volume**: High. -This subcategory allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +This subcategory allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff, the security audit event is generated on the computer that the user account logged on to. | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It is more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                              Enable Success audit if you want to track, for example, for how long session was active (in correlation with [Audit Logon](audit-logon.md) events) and when user actually logged off.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It is more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                              Enable Success audit if you want to track, for example, for how long session was active (in correlation with [Audit Logon](audit-logon.md) events) and when user actually logged off.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It is more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                              Enable Success audit if you want to track, for example, for how long session was active (in correlation with [Audit Logon](audit-logon.md) events) and when user actually logged off.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It's more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                              Enable Success audit if you want to track, for example, for how long a session was active (in correlation with [Audit Logon](audit-logon.md) events) and when a user logged off.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It's more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                              Enable Success audit if you want to track, for example, for how long a session was active (in correlation with [Audit Logon](audit-logon.md) events) and when a user logged off.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It's more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                              Enable Success audit if you want to track, for example, for how long a session was active (in correlation with [Audit Logon](audit-logon.md) events) and when a user logged off.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-logon.md b/windows/security/threat-protection/auditing/audit-logon.md index a1fa633cae..711c16301c 100644 --- a/windows/security/threat-protection/auditing/audit-logon.md +++ b/windows/security/threat-protection/auditing/audit-logon.md @@ -1,16 +1,16 @@ --- title: Audit Logon (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logon, which determines whether the operating system generates audit events when a user attempts to log on to a computer. +description: The Advanced Security Audit policy setting, Audit Logon, determines if audit events are generated when a user attempts to log on to a computer. ms.assetid: ca968d03-7d52-48c4-ba0e-2bcd2937231b ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md index f756f7d9b5..d58bafa0de 100644 --- a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md @@ -1,16 +1,16 @@ --- title: Audit MPSSVC Rule-Level Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit MPSSVC Rule-Level Policy Change, which determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). +description: Audit MPSSVC Rule-Level Policy Change determines if audit events are generated when policy rules are altered for the Microsoft Protection Service (MPSSVC.exe). ms.assetid: 263461b3-c61c-4ec3-9dee-851164845019 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md index cc023326da..697ae99b16 100644 --- a/windows/security/threat-protection/auditing/audit-network-policy-server.md +++ b/windows/security/threat-protection/auditing/audit-network-policy-server.md @@ -1,16 +1,16 @@ --- title: Audit Network Policy Server (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Network Policy Server, which determines whether the operating system generates audit events for RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny, Discard, Quarantine, Lock, and Unlock). +description: The policy setting, Audit Network Policy Server, determines if audit events are generated for RADIUS (IAS) and NAP activity on user access requests. ms.assetid: 43b2aea4-26df-46da-b761-2b30f51a80f7 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md index 309f195d7d..b75e993891 100644 --- a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md @@ -1,27 +1,27 @@ --- -title: Audit Non Sensitive Privilege Use (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. +title: Audit Non-Sensitive Privilege Use (Windows 10) +description: This article for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. ms.assetid: 8fd74783-1059-443e-aa86-566d78606627 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- -# Audit Non Sensitive Privilege Use +# Audit Non-Sensitive Privilege Use **Applies to** - Windows 10 - Windows Server 2016 -Audit Non Sensitive Privilege Use contains events that show usage of non-sensitive privileges. This is the list of non-sensitive privileges: +Audit Non-Sensitive Privilege Use contains events that show usage of non-sensitive privileges. This is the list of non-sensitive privileges: - Access Credential Manager as a trusted caller diff --git a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md index 218e662e92..959a951636 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md @@ -1,16 +1,16 @@ --- title: Audit Other Account Logon Events (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Other Account Logon Events, which allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. +description: The policy setting, Audit Other Account Logon Events, allows you to audit events generated by responses to credential requests for certain kinds of user logons. ms.assetid: c8c6bfe0-33d2-4600-bb1a-6afa840d75b3 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-account-management-events.md b/windows/security/threat-protection/auditing/audit-other-account-management-events.md index a52ff0d042..2795a0bb73 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-management-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-management-events.md @@ -1,16 +1,16 @@ --- title: Audit Other Account Management Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Account Management Events, which determines whether the operating system generates user account management audit events. +description: The Advanced Security Audit policy setting, Audit Other Account Management Events, determines if user account management audit events are generated. ms.assetid: 4ce22eeb-a96f-4cf9-a46d-6642961a31d5 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md index 77527e8253..9265129828 100644 --- a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md +++ b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md @@ -1,16 +1,16 @@ --- title: Audit Other Logon/Logoff Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, which determines whether Windows generates audit events for other logon or logoff events. +description: The Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, determines if Windows generates audit events for other logon or logoff events. ms.assetid: 76d987cd-1917-4907-a739-dd642609a458 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md index d9513980da..54b132e114 100644 --- a/windows/security/threat-protection/auditing/audit-other-object-access-events.md +++ b/windows/security/threat-protection/auditing/audit-other-object-access-events.md @@ -1,16 +1,16 @@ --- title: Audit Other Object Access Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. +description: The policy setting, Audit Other Object Access Events, determines if audit events are generated for the management of Task Scheduler jobs or COM+ objects. ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 05/29/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md index 2690694166..2ceacf7bd7 100644 --- a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md +++ b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md @@ -1,16 +1,16 @@ --- title: Audit Other Policy Change Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Policy Change Events, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category. +description: The policy setting, Audit Other Policy Change Events, determines if audit events are generated for security policy changes that are not otherwise audited. ms.assetid: 8618502e-c21c-41cc-8a49-3dc1eb359e60 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md index bbe45925d3..9adb4cfd74 100644 --- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md +++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md @@ -1,24 +1,24 @@ --- title: Audit Other Privilege Use Events (Windows 10) -description: This security policy setting is not used. +description: Learn about the audit other privilege use events, an auditing subcategory that should not have any events in it but enables generation of event 4985(S). ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c -ms.reviewer: +ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- # Audit Other Privilege Use Events **Applies to** -- Windows 10 -- Windows Server 2016 +- Windows 10 +- Windows Server 2016 This auditing subcategory should not have any events in it, but for some reason Success auditing will enable generation of event 4985(S): The state of a transaction has changed. @@ -31,7 +31,7 @@ This auditing subcategory should not have any events in it, but for some reason **Events List:** -- [4985](event-4674.md)(S): The state of a transaction has changed. +- [4985](event-4985.md)(S): The state of a transaction has changed. diff --git a/windows/security/threat-protection/auditing/audit-other-system-events.md b/windows/security/threat-protection/auditing/audit-other-system-events.md index 66a05eb6c1..314723a738 100644 --- a/windows/security/threat-protection/auditing/audit-other-system-events.md +++ b/windows/security/threat-protection/auditing/audit-other-system-events.md @@ -1,16 +1,16 @@ --- title: Audit Other System Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other System Events, which determines whether the operating system audits various system events. +description: The Advanced Security Audit policy setting, Audit Other System Events, determines if the operating system audits various system events. ms.assetid: 2401e4cc-d94e-41ec-82a7-e10914295f8b ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-pnp-activity.md b/windows/security/threat-protection/auditing/audit-pnp-activity.md index cc7a689b7c..2d1298584a 100644 --- a/windows/security/threat-protection/auditing/audit-pnp-activity.md +++ b/windows/security/threat-protection/auditing/audit-pnp-activity.md @@ -1,16 +1,16 @@ --- title: Audit PNP Activity (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit PNP Activity, which determines when plug and play detects an external device. +description: The advanced security audit policy setting, Audit PNP Activity, determines when plug and play detects an external device. ms.assetid: A3D87B3B-EBBE-442A-953B-9EB75A5F600E ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md index 0868fa7fe7..2eb2aa20f8 100644 --- a/windows/security/threat-protection/auditing/audit-process-creation.md +++ b/windows/security/threat-protection/auditing/audit-process-creation.md @@ -1,16 +1,16 @@ --- title: Audit Process Creation (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Creation, which determines whether the operating system generates audit events when a process is created (starts). +description: The Advanced Security Audit policy setting, Audit Process Creation, determines if audit events are generated when a process is created (starts). ms.assetid: 67e39fcd-ded6-45e8-b1b6-d411e4e93019 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-process-termination.md b/windows/security/threat-protection/auditing/audit-process-termination.md index 5bf90b6f6a..7ba49fbd59 100644 --- a/windows/security/threat-protection/auditing/audit-process-termination.md +++ b/windows/security/threat-protection/auditing/audit-process-termination.md @@ -1,16 +1,16 @@ --- title: Audit Process Termination (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Termination, which determines whether the operating system generates audit events when an attempt is made to end a process. +description: The Advanced Security Audit policy setting, Audit Process Termination, determines if audit events are generated when an attempt is made to end a process. ms.assetid: 65d88e53-14aa-48a4-812b-557cebbf9e50 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 4db7d65686..4b0d88838f 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -1,16 +1,16 @@ --- title: Audit Registry (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Registry, which determines whether the operating system generates audit events when users attempt to access registry objects. +description: The Advanced Security Audit policy setting, Audit Registry, determines if audit events are generated when users attempt to access registry objects. ms.assetid: 02bcc23b-4823-46ac-b822-67beedf56b32 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-removable-storage.md b/windows/security/threat-protection/auditing/audit-removable-storage.md index f35a441ef8..82d5170b7c 100644 --- a/windows/security/threat-protection/auditing/audit-removable-storage.md +++ b/windows/security/threat-protection/auditing/audit-removable-storage.md @@ -1,16 +1,16 @@ --- title: Audit Removable Storage (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Removable Storage, which determines when there is a read or a write to a removable drive. +description: The Advanced Security Audit policy setting, Audit Removable Storage, determines when there is a read or a write to a removable drive. ms.assetid: 1746F7B3-8B41-4661-87D8-12F734AFFB26 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-rpc-events.md b/windows/security/threat-protection/auditing/audit-rpc-events.md index 1a4b0dbfbc..b35eacaf51 100644 --- a/windows/security/threat-protection/auditing/audit-rpc-events.md +++ b/windows/security/threat-protection/auditing/audit-rpc-events.md @@ -1,16 +1,16 @@ --- title: Audit RPC Events (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit RPC Events, which determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made. +description: Audit RPC Events is an audit policy setting that determines if audit events are generated when inbound remote procedure call (RPC) connections are made. ms.assetid: 868aec2d-93b4-4bc8-a150-941f88838ba6 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-sam.md b/windows/security/threat-protection/auditing/audit-sam.md index 2a7efe94ec..6e60284ead 100644 --- a/windows/security/threat-protection/auditing/audit-sam.md +++ b/windows/security/threat-protection/auditing/audit-sam.md @@ -1,16 +1,16 @@ --- title: Audit SAM (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit SAM, which enables you to audit events that are generated by attempts to access Security Account Manager (SAM) objects. +description: The Advanced Security Audit policy setting, Audit SAM, enables you to audit events generated by attempts to access Security Account Manager (SAM) objects. ms.assetid: 1d00f955-383d-4c95-bbd1-fab4a991a46e ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -56,6 +56,3 @@ For information about reducing the number of events generated in this subcategor **Events List:** - [4661](event-4661.md)(S, F): A handle to an object was requested. - -# - diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md index 91aef3a375..d75b85e522 100644 --- a/windows/security/threat-protection/auditing/audit-security-group-management.md +++ b/windows/security/threat-protection/auditing/audit-security-group-management.md @@ -1,16 +1,16 @@ --- title: Audit Security Group Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Security Group Management, which determines whether the operating system generates audit events when specific security group management tasks are performed. +description: The policy setting, Audit Security Group Management, determines if audit events are generated when specific security group management tasks are performed. ms.assetid: ac2ee101-557b-4c84-b9fa-4fb23331f1aa ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 02/28/2019 --- diff --git a/windows/security/threat-protection/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md index ac8fcf4c32..c10e8072f7 100644 --- a/windows/security/threat-protection/auditing/audit-security-state-change.md +++ b/windows/security/threat-protection/auditing/audit-security-state-change.md @@ -1,16 +1,16 @@ --- title: Audit Security State Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system. +description: The policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system. ms.assetid: decb3218-a67d-4efa-afc0-337c79a89a2d ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-security-system-extension.md b/windows/security/threat-protection/auditing/audit-security-system-extension.md index 97c9f853c7..8c764f65c4 100644 --- a/windows/security/threat-protection/auditing/audit-security-system-extension.md +++ b/windows/security/threat-protection/auditing/audit-security-system-extension.md @@ -1,16 +1,16 @@ --- title: Audit Security System Extension (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security System Extension, which determines whether the operating system generates audit events related to security system extensions. +description: The Advanced Security Audit policy setting, Audit Security System Extension, determines if audit events related to security system extensions are generated. ms.assetid: 9f3c6bde-42b2-4a0a-b353-ed3106ebc005 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -35,9 +35,9 @@ Attempts to install or load security system extensions or services are critical | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                              For other events we strongly recommend monitoring a whitelist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should have “SYSTEM” as value for **“Subject”** field.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                              For other events we strongly recommend monitoring a whitelist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                              For other events we strongly recommend monitoring a whitelist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                              For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should have “SYSTEM” as value for **“Subject”** field.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                              For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                              For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md index c099b898d6..3bdb900b00 100644 --- a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md @@ -1,16 +1,16 @@ --- title: Audit Sensitive Privilege Use (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Sensitive Privilege Use, which determines whether the operating system generates audit events when sensitive privileges (user rights) are used. +description: The policy setting, Audit Sensitive Privilege Use, determines if the operating system generates audit events when sensitive privileges (user rights) are used. ms.assetid: 915abf50-42d2-45f6-9fd1-e7bd201b193d ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-special-logon.md b/windows/security/threat-protection/auditing/audit-special-logon.md index faa994ab12..ec7e84c990 100644 --- a/windows/security/threat-protection/auditing/audit-special-logon.md +++ b/windows/security/threat-protection/auditing/audit-special-logon.md @@ -1,16 +1,16 @@ --- title: Audit Special Logon (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Special Logon, which determines whether the operating system generates audit events under special sign on (or log on) circumstances. +description: The Advanced Security Audit policy setting, Audit Special Logon, determines if audit events are generated under special sign in (or logon) circumstances. ms.assetid: e1501bac-1d09-4593-8ebb-f311231567d3 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -37,9 +37,9 @@ This subcategory allows you to audit events generated by special logons such as | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                              At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                              At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                              At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                              At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                              At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                              At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-system-integrity.md b/windows/security/threat-protection/auditing/audit-system-integrity.md index df2120830a..89d27ff3cb 100644 --- a/windows/security/threat-protection/auditing/audit-system-integrity.md +++ b/windows/security/threat-protection/auditing/audit-system-integrity.md @@ -1,16 +1,16 @@ --- title: Audit System Integrity (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit System Integrity, which determines whether the operating system audits events that violate the integrity of the security subsystem. +description: The policy setting, Audit System Integrity, determines if the operating system audits events that violate the integrity of the security subsystem. ms.assetid: 942a9a7f-fa31-4067-88c7-f73978bf2034 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md new file mode 100644 index 0000000000..bb9d974920 --- /dev/null +++ b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md @@ -0,0 +1,32 @@ +--- +title: Audit Token Right Adjusted (Windows 10) +description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Token Right Adjusted, which determines whether the operating system generates audit events when specific changes are made to the privileges of a token. +manager: dansimp +author: dansimp +ms.author: dansimp +ms.pagetype: security +ms.prod: w10 +--- + +# Audit Token Right Adjusted + +**Applies to** +- Windows 10 +- Windows Server 2016 + + +Audit Token Right Adjusted allows you to audit events generated by adjusting the privileges of a token. + +For more information, see [Security Monitoring: A Possible New Way to Detect Privilege Escalation](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/). + +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                              However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                              However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                              However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                              If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                              This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | + +**Events List:** + +- [4703](event-4703.md)(S): A user right was adjusted. + +**Event volume**: High. diff --git a/windows/security/threat-protection/auditing/audit-user-account-management.md b/windows/security/threat-protection/auditing/audit-user-account-management.md index 82f8975fd5..5b2d45cc98 100644 --- a/windows/security/threat-protection/auditing/audit-user-account-management.md +++ b/windows/security/threat-protection/auditing/audit-user-account-management.md @@ -1,16 +1,16 @@ --- title: Audit User Account Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit User Account Management, which determines whether the operating system generates audit events when specific user account management tasks are performed. +description: Audit User Account Management is an audit policy setting that determines if the operating system generates audit events when certain tasks are performed. ms.assetid: f7e72998-3858-4197-a443-19586ecc4bfb ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-user-device-claims.md b/windows/security/threat-protection/auditing/audit-user-device-claims.md index 7877fe6b80..bea0be45b0 100644 --- a/windows/security/threat-protection/auditing/audit-user-device-claims.md +++ b/windows/security/threat-protection/auditing/audit-user-device-claims.md @@ -1,16 +1,16 @@ --- title: Audit User/Device Claims (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit User/Device Claims, which enables you to audit security events that are generated by user and device claims. +description: Audit User/Device Claims is an audit policy setting that enables you to audit security events that are generated by user and device claims. ms.assetid: D3D2BFAF-F2C0-462A-9377-673DB49D5486 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -25,7 +25,7 @@ Audit User/Device Claims allows you to audit user and device claims information For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. -***Important***: [Audit Logon](audit-logon.md) subcategory must also be enabled in order to get events from this subcategory. +***Important***: Enable the [Audit Logon](audit-logon.md) subcategory in order to get events from this subcategory. **Event volume**: diff --git a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md index 07f239f4d3..f345a84336 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md @@ -3,13 +3,13 @@ title: Audit account logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md index 3d6f35ef9d..e699a88ac1 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-management.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md @@ -3,13 +3,13 @@ title: Audit account management (Windows 10) description: Determines whether to audit each event of account management on a device. ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md index 65f6a0672b..530a4255bc 100644 --- a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md @@ -1,15 +1,15 @@ --- -title: Audit directory service access (Windows 10) +title: Basic audit directory service access (Windows 10) description: Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index edba7f71a5..66c1906086 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -3,13 +3,13 @@ title: Audit logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from a device. ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -38,33 +38,12 @@ You can configure this security setting by opening the appropriate policy under | Logon events | Description | | - | - | -| 528 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | -| 529 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | -| 530 | Logon failure. A logon attempt was made user account tried to log on outside of the allowed time. | -| 531 | Logon failure. A logon attempt was made using a disabled account. | -| 532 | Logon failure. A logon attempt was made using an expired account. | -| 533 | Logon failure. A logon attempt was made by a user who is not allowed to log on at this computer. | -| 534 | Logon failure. The user attempted to log on with a type that is not allowed. | -| 535 | Logon failure. The password for the specified account has expired. | -| 536 | Logon failure. The Net Logon service is not active. | -| 537 | Logon failure. The logon attempt failed for other reasons. | -| 538 | The logoff process was completed for a user. | -| 539 | Logon failure. The account was locked out at the time the logon attempt was made. | -| 540 | A user successfully logged on to a network. | -| 541 | Main mode Internet Key Exchange (IKE) authentication was completed between the local computer and the listed peer identity (establishing a security association), or quick mode has established a data channel. | -| 542 | A data channel was terminated. | -| 543 | Main mode was terminated. | -| 544 | Main mode authentication failed because the peer did not provide a valid certificate or the signature was not validated. | -| 545 | Main mode authentication failed because of a Kerberos failure or a password that is not valid. | -| 546 | IKE security association establishment failed because the peer sent a proposal that is not valid. A packet was received that contained data that is not valid. | -| 547 | A failure occurred during an IKE handshake. | -| 548 | Logon failure. The security ID (SID) from a trusted domain does not match the account domain SID of the client. | -| 549 | Logon failure. All SIDs corresponding to untrusted namespaces were filtered out during an authentication across forests. | -| 550 | Notification message that could indicate a possible denial-of-service attack. | -| 551 | A user initiated the logoff process. | -| 552 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | -| 682 | A user has reconnected to a disconnected terminal server session. | -| 683 | A user disconnected a terminal server session without logging off. | +| 4624 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | +| 4625 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | +| 4634 | The logoff process was completed for a user. | +| 4647 | A user initiated the logoff process. | +| 4648 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | +| 4779 | A user disconnected a terminal server session without logging off. | When event 528 is logged, a logon type is also listed in the event log. The following table describes each logon type. diff --git a/windows/security/threat-protection/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md index ae6a25d613..c3bada3ea8 100644 --- a/windows/security/threat-protection/auditing/basic-audit-object-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-object-access.md @@ -1,15 +1,15 @@ --- title: Audit object access (Windows 10) -description: Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified. +description: The policy setting, Audit object access, determines whether to audit the event generated when a user accesses an object that has its own SACL specified. ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -28,7 +28,8 @@ If you define this policy setting, you can specify whether to audit successes, a To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. -> **Note:** You can set a SACL on a file system object using the **Security** tab in that object's **Properties** dialog box. +> [!NOTE] +> You can set a SACL on a file system object using the **Security** tab in that object's **Properties** dialog box. **Default:** No auditing. @@ -41,10 +42,10 @@ You can configure this security setting by opening the appropriate policy under |----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 560 | Access was granted to an already existing object. | | 562 | A handle to an object was closed. | -| 563 | An attempt was made to open an object with the intent to delete it.
                              \*\*Note: \*\* This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile(). | +| 563 | An attempt was made to open an object with the intent to delete it.
                              **Note:** This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile(). | | 564 | A protected object was deleted. | | 565 | Access was granted to an already existing object type. | -| 567 | A permission associated with a handle was used.
                              \*\*Note: \*\* A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | +| 567 | A permission associated with a handle was used.
                              **Note:** A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | | 568 | An attempt was made to create a hard link to a file that is being audited. | | 569 | The resource manager in Authorization Manager attempted to create a client context. | | 570 | A client attempted to access an object.
                              **Note:** An event will be generated for every attempted operation on the object. | diff --git a/windows/security/threat-protection/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md index a98760482c..b80e5788af 100644 --- a/windows/security/threat-protection/auditing/basic-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/basic-audit-policy-change.md @@ -3,13 +3,13 @@ title: Audit policy change (Windows 10) description: Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md index 4a0ea891c0..a3e7893fe6 100644 --- a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md +++ b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md @@ -3,13 +3,13 @@ title: Audit privilege use (Windows 10) description: Determines whether to audit each instance of a user exercising a user right. ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md index c99e882563..4f02eab9a3 100644 --- a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md +++ b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md @@ -3,13 +3,13 @@ title: Audit process tracking (Windows 10) description: Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md index 6283d5a530..7811de4253 100644 --- a/windows/security/threat-protection/auditing/basic-audit-system-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-system-events.md @@ -3,13 +3,13 @@ title: Audit system events (Windows 10) description: Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md index 80170efbf6..3856637432 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md @@ -1,15 +1,15 @@ --- title: Basic security audit policies (Windows 10) -description: Before you implement auditing, you must decide on an auditing policy. +description: Learn about basic security audit policies that specify the categories of security-related events that you want to audit for the needs of your organization. ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index 997ee3cfee..686cdfdc71 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -3,13 +3,13 @@ title: Basic security audit policy settings (Windows 10) description: Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md index a99bb14e40..745c787671 100644 --- a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -3,13 +3,13 @@ title: Create a basic audit policy for an event category (Windows 10) description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/event-1100.md b/windows/security/threat-protection/auditing/event-1100.md index 5f995bb735..251aa8834c 100644 --- a/windows/security/threat-protection/auditing/event-1100.md +++ b/windows/security/threat-protection/auditing/event-1100.md @@ -6,11 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # 1100(S): The event logging service has shut down. diff --git a/windows/security/threat-protection/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md index 1edce314ef..4a9b1e8b3a 100644 --- a/windows/security/threat-protection/auditing/event-1102.md +++ b/windows/security/threat-protection/auditing/event-1102.md @@ -1,16 +1,16 @@ --- title: 1102(S) The audit log was cleared. (Windows 10) -description: Describes security event 1102(S) The audit log was cleared. +description: Though you shouldn't normally see it, this event generates every time Windows Security audit log is cleared. This is for event 1102(S). ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # 1102(S): The audit log was cleared. diff --git a/windows/security/threat-protection/auditing/event-1104.md b/windows/security/threat-protection/auditing/event-1104.md index d70f00eeb9..fbcbb7dad9 100644 --- a/windows/security/threat-protection/auditing/event-1104.md +++ b/windows/security/threat-protection/auditing/event-1104.md @@ -1,16 +1,16 @@ --- title: 1104(S) The security log is now full. (Windows 10) -description: Describes security event 1104(S) The security log is now full. +description: This event generates every time Windows security log becomes full and the event log retention method is set to "Do not overwrite events." ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # 1104(S): The security log is now full. diff --git a/windows/security/threat-protection/auditing/event-1105.md b/windows/security/threat-protection/auditing/event-1105.md index cd3b89cac3..bd4e2bb72a 100644 --- a/windows/security/threat-protection/auditing/event-1105.md +++ b/windows/security/threat-protection/auditing/event-1105.md @@ -1,6 +1,6 @@ --- title: 1105(S) Event log automatic backup. (Windows 10) -description: Describes security event 1105(S) Event log automatic backup. +description: This event generates every time Windows security log becomes full and new event log file was created. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -13,7 +13,7 @@ manager: dansimp ms.author: dansimp --- -# 1105(S): Event log automatic backup. +# 1105(S): Event log automatic backup **Applies to** - Windows 10 @@ -71,7 +71,7 @@ This event generates, for example, if the maximum size of Security Event Log fil ***Field Descriptions:*** -**Log** \[Type = UnicodeString\]: the name of the log which was archived (new event log file was created and previous event log was archived). Always “**Security”** for Security Event Logs. +**Log** \[Type = UnicodeString\]: the name of the log that was archived (new event log file was created and previous event log was archived). Always “**Security”** for Security Event Logs. **File**: \[Type = FILETIME\]: full path and filename of archived log file. diff --git a/windows/security/threat-protection/auditing/event-1108.md b/windows/security/threat-protection/auditing/event-1108.md index 148ab10880..0aaa3b6a99 100644 --- a/windows/security/threat-protection/auditing/event-1108.md +++ b/windows/security/threat-protection/auditing/event-1108.md @@ -1,5 +1,5 @@ --- -title: 1108(S) The event logging service encountered an error while processing an incoming event published from %1. (Windows 10) +title: The event logging service encountered an error (Windows 10) description: Describes security event 1108(S) The event logging service encountered an error while processing an incoming event published from %1. ms.pagetype: security ms.prod: w10 diff --git a/windows/security/threat-protection/auditing/event-4608.md b/windows/security/threat-protection/auditing/event-4608.md index 22a7d07d71..5f0730407d 100644 --- a/windows/security/threat-protection/auditing/event-4608.md +++ b/windows/security/threat-protection/auditing/event-4608.md @@ -1,6 +1,6 @@ --- title: 4608(S) Windows is starting up. (Windows 10) -description: Describes security event 4608(S) Windows is starting up. +description: Describes security event 4608(S) Windows is starting up. This event is logged when the LSASS.EXE process starts and the auditing subsystem is initialized. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -20,7 +20,7 @@ ms.author: dansimp - Windows Server 2016 -Event 4608 illustration +Event 4608 illustration ***Subcategory:*** [Audit Security State Change](audit-security-state-change.md) @@ -30,12 +30,13 @@ This event is logged when LSASS.EXE process starts and the auditing subsystem is It typically generates during operating system startup process. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
                              ***Event XML:*** -``` +```xml - - diff --git a/windows/security/threat-protection/auditing/event-4611.md b/windows/security/threat-protection/auditing/event-4611.md index d245a30f27..6862a8d6a8 100644 --- a/windows/security/threat-protection/auditing/event-4611.md +++ b/windows/security/threat-protection/auditing/event-4611.md @@ -108,7 +108,7 @@ For 4611(S): A trusted logon process has been registered with the Local Security - Because this event is typically triggered by the SYSTEM account, we recommend that you report it whenever **“Subject\\Security ID”** is not SYSTEM. -- Typically this event has an informational purpose. If you defined the list of allowed Logon Processes in the system, then you can check is “**Logon Process Name”** field value in the whitelist or not. +- Typically this event has an informational purpose. If you defined the list of allowed Logon Processes in the system, then you can check is “**Logon Process Name”** field value in the allow list or not. - diff --git a/windows/security/threat-protection/auditing/event-4614.md b/windows/security/threat-protection/auditing/event-4614.md index 8dd6e72adc..f86b22408c 100644 --- a/windows/security/threat-protection/auditing/event-4614.md +++ b/windows/security/threat-protection/auditing/event-4614.md @@ -78,5 +78,5 @@ Each time a system starts, it loads the notification package DLLs from **HKEY\_L For 4614(S): A notification package has been loaded by the Security Account Manager. -- Typically this event has an informational purpose. If you defined the list of allowed Notification Packages in the system, then you can check is “**Notification Package Name”** field value in the whitelist or not. +- Typically this event has an informational purpose. If you defined the list of allowed Notification Packages in the system, then you can check is “**Notification Package Name”** field value in the allow list or not. diff --git a/windows/security/threat-protection/auditing/event-4615.md b/windows/security/threat-protection/auditing/event-4615.md index 9231f28b82..0490e0ae3e 100644 --- a/windows/security/threat-protection/auditing/event-4615.md +++ b/windows/security/threat-protection/auditing/event-4615.md @@ -1,6 +1,6 @@ --- title: 4615(S) Invalid use of LPC port. (Windows 10) -description: Describes security event 4615(S) Invalid use of LPC port. +description: Describes security event 4615(S) Invalid use of LPC port. It appears that the Invalid use of LPC port event never occurs. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4616.md b/windows/security/threat-protection/auditing/event-4616.md index 8681a67e8f..3f700f0719 100644 --- a/windows/security/threat-protection/auditing/event-4616.md +++ b/windows/security/threat-protection/auditing/event-4616.md @@ -1,6 +1,6 @@ --- title: 4616(S) The system time was changed. (Windows 10) -description: Describes security event 4616(S) The system time was changed. +description: Describes security event 4616(S) The system time was changed. This event is generated every time system time is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -20,7 +20,7 @@ ms.author: dansimp - Windows Server 2016 -Event 4616 illustration +Event 4616 illustration ***Subcategory:*** [Audit Security State Change](audit-security-state-change.md) @@ -32,12 +32,13 @@ This event is always logged regardless of the "Audit Security State Change" sub- You will typically see these events with “**Subject\\Security ID**” = “**LOCAL SERVICE**”, these are normal time correction actions. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
                              ***Event XML:*** -``` +```xml - - @@ -87,7 +88,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L - **Security ID** \[Type = SID\]**:** SID of account that requested the “change system time” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “change system time” operation. @@ -161,7 +163,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L For 4616(S): The system time was changed. -> **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). +> [!IMPORTANT] +> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). - Report all “**Subject\\Security ID**” not equals **“LOCAL SERVICE”**, which means that the time change was not made not by Windows Time service. diff --git a/windows/security/threat-protection/auditing/event-4618.md b/windows/security/threat-protection/auditing/event-4618.md index 9dcc575df1..4155868172 100644 --- a/windows/security/threat-protection/auditing/event-4618.md +++ b/windows/security/threat-protection/auditing/event-4618.md @@ -32,7 +32,7 @@ Account must have **SeAuditPrivilege** (Generate security audits) to be able to - Only **OrgEventID**, **ComputerName**, and **EventCount** are required—others are optional. Fields not specified appear with “**-**“ in the event description field. -- If a field doesn’t match the expected data type, the event is not generated. (i.e., if **EventCount** = “XYZ” then no event is generated.) +- If a field doesn’t match the expected data type, the event is not generated. That is, if **EventCount** = “XYZ”, then no event is generated. - **UserSid**, **UserName**, and **UserDomain** are not related to each other (think **SubjectUser** fields, where they are) @@ -98,5 +98,5 @@ Account must have **SeAuditPrivilege** (Generate security audits) to be able to For 4618(S): A monitored security event pattern has occurred. -- This event can be invoked only manually/intentionally, it is up to you how interpret this event depends on information you put inside of it. +- This event can be invoked only manually/intentionally, it is up to you how to interpret this event depends on information you put inside of it. diff --git a/windows/security/threat-protection/auditing/event-4622.md b/windows/security/threat-protection/auditing/event-4622.md index e425430b75..385f508b09 100644 --- a/windows/security/threat-protection/auditing/event-4622.md +++ b/windows/security/threat-protection/auditing/event-4622.md @@ -100,5 +100,5 @@ These are some Security Package DLLs loaded by default in Windows 10: For 4622(S): A security package has been loaded by the Local Security Authority. -- Typically this event has an informational purpose. If you defined the list of allowed Security Packages in the system, then you can check is “**Security Package Name”** field value in the whitelist or not. +- Typically this event has an informational purpose. If you defined the list of allowed Security Packages in the system, then you can check is “**Security Package Name”** field value in the allow list or not. diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 2ca7e8267c..b310cd06ca 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -33,55 +33,55 @@ This event generates when a logon session is created (on destination machine). I
                              ***Event XML:*** -``` -- -- - - 4624 - 2 - 0 - 12544 - 0 - 0x8020000000000000 - - 211 - - - Security - WIN-GG82ULGC9GO - - -- - S-1-5-18 - WIN-GG82ULGC9GO$ - WORKGROUP - 0x3e7 - S-1-5-21-1377283216-344919071-3415362939-500 - Administrator - WIN-GG82ULGC9GO - 0x8dcdc - 2 - User32 - Negotiate - WIN-GG82ULGC9GO - {00000000-0000-0000-0000-000000000000} - - - - - 0 - 0x44c - C:\\Windows\\System32\\svchost.exe - 127.0.0.1 - 0 - %%1833 - - - - - - - %%1843 - 0x0 - %%1842 - - - +```xml + + + + + 4624 + 2 + 0 + 12544 + 0 + 0x8020000000000000 + + 211 + + + Security + WIN-GG82ULGC9GO + + + + S-1-5-18 + WIN-GG82ULGC9GO$ + WORKGROUP + 0x3e7 + S-1-5-21-1377283216-344919071-3415362939-500 + Administrator + WIN-GG82ULGC9GO + 0x8dcdc + 2 + User32 + Negotiate + WIN-GG82ULGC9GO + {00000000-0000-0000-0000-000000000000} + - + - + 0 + 0x44c + C:\\Windows\\System32\\svchost.exe + 127.0.0.1 + 0 + %%1833 + - + - + - + %%1843 + 0x0 + %%1842 + + ``` ***Required Server Roles:*** None. @@ -144,21 +144,24 @@ This event generates when a logon session is created (on destination machine). I ## Logon types and descriptions -| Logon Type | Logon Title | Description | -|------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 2 | Interactive | A user logged on to this computer. | -| 3 | Network | A user or computer logged on to this computer from the network. | -| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | -| 5 | Service | A service was started by the Service Control Manager. | -| 7 | Unlock | This workstation was unlocked. | -| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | -| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | -| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | -| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | +| Logon Type | Logon Title | Description | +|:----------:|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `0` | `System` | Used only by the System account, for example at system startup. | +| `2` | `Interactive` | A user logged on to this computer. | +| `3` | `Network` | A user or computer logged on to this computer from the network. | +| `4` | `Batch` | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | +| `5` | `Service` | A service was started by the Service Control Manager. | +| `7` | `Unlock` | This workstation was unlocked. | +| `8` | `NetworkCleartext` | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | +| `9` | `NewCredentials` | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | +| `10` | `RemoteInteractive` | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | +| `11` | `CachedInteractive` | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | +| `12` | `CashedRemoteInteractive` | Same as RemoteInteractive. This is used for internal auditing. | +| `13` | `CachedUnlock` | Workstation logon. | - **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. - Reference: . + Reference: . If not a **RemoteInteractive** logon, then this will be "-" string. @@ -230,7 +233,7 @@ This event generates when a logon session is created (on destination machine). I **Network Information:** -- **Workstation Name** \[Type = UnicodeString\]**:** machine name from which logon attempt was performed. +- **Workstation Name** \[Type = UnicodeString\]**:** machine name to which logon attempt was performed. - **Source Network Address** \[Type = UnicodeString\]**:** IP address of machine from which logon attempt was performed. @@ -277,7 +280,7 @@ For 4624(S): An account was successfully logged on. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“New Logon\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“New Logon\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“New Logon\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“New Logon\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“New Logon\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md index 08fcff8219..293e52c57f 100644 --- a/windows/security/threat-protection/auditing/event-4625.md +++ b/windows/security/threat-protection/auditing/event-4625.md @@ -1,6 +1,6 @@ --- title: 4625(F) An account failed to log on. (Windows 10) -description: Describes security event 4625(F) An account failed to log on. +description: Describes security event 4625(F) An account failed to log on. This event is generated if an account logon attempt failed for a locked out account. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -20,7 +20,7 @@ ms.author: dansimp - Windows Server 2016 -Event 4625 illustration +Event 4625 illustration ***Subcategories:*** [Audit Account Lockout](audit-account-lockout.md) and [Audit Logon](audit-logon.md) @@ -32,12 +32,13 @@ It generates on the computer where logon attempt was made, for example, if logon This event generates on domain controllers, member servers, and workstations. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
                              ***Event XML:*** -``` +```xml - - @@ -93,11 +94,12 @@ This event generates on domain controllers, member servers, and workstations. - **Security ID** \[Type = SID\]**:** SID of account that reported information about logon failure. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about logon failure. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** subject's domain or computer name. Here are some examples of formats: - Domain NETBIOS name example: CONTOSO @@ -109,31 +111,34 @@ This event generates on domain controllers, member servers, and workstations. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. -**Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field. +- **Logon Type** \[Type = UInt32\]**:** the type of logon that was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field. -| Logon Type | Logon Title | Description | -|-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 2 | Interactive | A user logged on to this computer. | -| 3 | Network | A user or computer logged on to this computer from the network. | -| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | -| 5 | Service | A service was started by the Service Control Manager. | -| 7 | Unlock | This workstation was unlocked. | -| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | -| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | -| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | -| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | -> Table: Windows Logon Types + **Table 11: Windows Logon Types** + + | Logon Type | Logon Title | Description | + |-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| + | 2 | Interactive | A user logged on to this computer. | + | 3 | Network | A user or computer logged on to this computer from the network. | + | 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | + | 5 | Service | A service was started by the Service Control Manager. | + | 7 | Unlock | This workstation was unlocked. | + | 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | + | 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | + | 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | + | 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | + **Account For Which Logon Failed:** - **Security ID** \[Type = SID\]**:** SID of the account that was specified in the logon attempt. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that was specified in the logon attempt. -- **Account Domain** \[Type = UnicodeString\]**:** domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** domain or computer name. Here are some examples of formats: - Domain NETBIOS name example: CONTOSO @@ -149,45 +154,46 @@ This event generates on domain controllers, member servers, and workstations. **Failure Information:** -- **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event it typically has “**Account locked out**” value. +- **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event, it typically has “**Account locked out**” value. -- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event it typically has “**0xC0000234**” value. The most common status codes are listed in “Table 12. Windows logon status codes.” +- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event, it typically has “**0xC0000234**” value. The most common status codes are listed in Table 12. Windows logon status codes. -| Status\\Sub-Status Code | Description | -|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0XC000005E | There are currently no logon servers available to service the logon request. | -| 0xC0000064 | User logon with misspelled or bad user account | -| 0xC000006A | User logon with misspelled or bad password | -| 0XC000006D | This is either due to a bad username or authentication information | -| 0XC000006E | Unknown user name or bad password. | -| 0xC000006F | User logon outside authorized hours | -| 0xC0000070 | User logon from unauthorized workstation | -| 0xC0000071 | User logon with expired password | -| 0xC0000072 | User logon to account disabled by administrator | -| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. | -| 0XC0000133 | Clocks between DC and other computer too far out of sync | -| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine | -| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. | -| 0XC0000192 | An attempt was made to logon, but the N**etlogon** service was not started. | -| 0xC0000193 | User logon with expired account | -| 0XC0000224 | User is required to change password at next logon | -| 0XC0000225 | Evidently a bug in Windows and not a risk | -| 0xC0000234 | User logon with account locked | -| 0XC00002EE | Failure Reason: An Error occurred during Logon | -| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. | -| 0x0 | Status OK. | + **Table 12: Windows logon status codes.** -> Table: Windows logon status codes. -> -> **Note**  To see the meaning of other status\\sub-status codes you may also check for status code in the Window header file ntstatus.h in Windows SDK. + | Status\\Sub-Status Code | Description | + |-------------------------|------------------------------------------------------------------------------------------------------| + | 0XC000005E | There are currently no logon servers available to service the logon request. | + | 0xC0000064 | User logon with misspelled or bad user account | + | 0xC000006A | User logon with misspelled or bad password | + | 0XC000006D | The cause is either a bad username or authentication information | + | 0XC000006E | Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions). | + | 0xC000006F | User logon outside authorized hours | + | 0xC0000070 | User logon from unauthorized workstation | + | 0xC0000071 | User logon with expired password | + | 0xC0000072 | User logon to account disabled by administrator | + | 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. | + | 0XC0000133 | Clocks between DC and other computer too far out of sync | + | 0XC000015B | The user has not been granted the requested logon type (also called the *logon right*) at this machine | + | 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. | + | 0XC0000192 | An attempt was made to logon, but the **Netlogon** service was not started. | + | 0xC0000193 | User logon with expired account | + | 0XC0000224 | User is required to change password at next logon | + | 0XC0000225 | Evidently a bug in Windows and not a risk | + | 0xC0000234 | User logon with account locked | + | 0XC00002EE | Failure Reason: An Error occurred during Logon | + | 0XC0000413 | Logon Failure: The machine you are logging on to is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. | + | 0x0 | Status OK. | + +> [!NOTE] +> To see the meaning of other status or substatus codes, you might also check for status code in the Window header file ntstatus.h in Windows SDK. More information: -- **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure. The most common sub-status codes listed in the “Table 12. Windows logon status codes.”. +- **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure. The most common substatus codes listed in the “Table 12. Windows logon status codes.”. **Process Information:** -- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): +- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):

                              Task manager illustration @@ -207,7 +213,7 @@ More information: - ::1 or 127.0.0.1 means localhost. -- **Source Port** \[Type = UnicodeString\]: source port which was used for logon attempt from remote machine. +- **Source Port** \[Type = UnicodeString\]: source port that was used for logon attempt from remote machine. - 0 for interactive logons. @@ -215,7 +221,7 @@ More information: - **Logon Process** \[Type = UnicodeString\]**:** the name of the trusted logon process that was used for the logon attempt. See event “[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority” description for more information. -- **Authentication Package** \[Type = UnicodeString\]**:** The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “[4622](event-4622.md): A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are: +- **Authentication Package** \[Type = UnicodeString\]**:** The name of the authentication package that was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “[4622](event-4622.md): A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are: - **NTLM** – NTLM-family Authentication @@ -225,7 +231,7 @@ More information: - **Transited Services** \[Type = UnicodeString\] \[Kerberos-only\]**:** the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see -- **Package Name (NTLM only)** \[Type = UnicodeString\]**:** The name of the LAN Manager sub-package ([NTLM-family](https://msdn.microsoft.com/library/cc236627.aspx) protocol name) that was used during the logon attempt. Possible values are: +- **Package Name (NTLM only)** \[Type = UnicodeString\]**:** The name of the LAN Manager subpackage ([NTLM-family](https://msdn.microsoft.com/library/cc236627.aspx) protocol name) that was used during the logon attempt. Possible values are: - “NTLM V1” @@ -235,13 +241,14 @@ More information: Only populated if “**Authentication Package” = “NTLM”**. -- **Key Length** \[Type = UInt32\]**:** the length of [NTLM Session Security](https://msdn.microsoft.com/library/cc236650.aspx) key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if “**Authentication Package” = “Kerberos”**, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using **Negotiate** authentication package. +- **Key Length** \[Type = UInt32\]**:** the length of [NTLM Session Security](https://msdn.microsoft.com/library/cc236650.aspx) key. Typically, it has a length of 128 bits or 56 bits. This parameter is always 0 if **"Authentication Package" = "Kerberos"**, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using **Negotiate** authentication package. ## Security Monitoring Recommendations For 4625(F): An account failed to log on. -> **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). +> [!IMPORTANT] +> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). - If you have a pre-defined “**Process Name**” for the process reported in this event, monitor all events with “**Process Name**” not equal to your defined value. @@ -257,9 +264,9 @@ For 4625(F): An account failed to log on. - If you have a high-value domain or local account for which you need to monitor every lockout, monitor all [4625](event-4625.md) events with the **“Subject\\Security ID”** that corresponds to the account. -- We recommend monitoring all [4625](event-4625.md) events for local accounts, because these accounts typically should not be locked out. This is especially relevant for critical servers, administrative workstations, and other high value assets. +- We recommend monitoring all [4625](event-4625.md) events for local accounts, because these accounts typically should not be locked out. Monitoring is especially relevant for critical servers, administrative workstations, and other high-value assets. -- We recommend monitoring all [4625](event-4625.md) events for service accounts, because these accounts should not be locked out or prevented from functioning. This is especially relevant for critical servers, administrative workstations, and other high value assets. +- We recommend monitoring all [4625](event-4625.md) events for service accounts, because these accounts should not be locked out or prevented from functioning. Monitoring is especially relevant for critical servers, administrative workstations, and other high value assets. - If your organization restricts logons in the following ways, you can use this event to monitor accordingly: @@ -277,17 +284,17 @@ For 4625(F): An account failed to log on. - Monitor for all events with the fields and values in the following table: -| **Field** | Value to monitor for | -|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.”
                              This is typically not a security issue but it can be an infrastructure or availability issue. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”.
                              Especially if you get a number of these in a row, it can be a sign of user enumeration attack. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts.
                              Especially watch for a number of such events in a row. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts.
                              Especially watch for a number of such events in a row. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”.
                              This is typically not a security issue but it can be an infrastructure or availability issue. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. | -| **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. | + | Field | Value to monitor for | + |----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.”
                              This issue is typically not a security issue, but it can be an infrastructure or availability issue. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”.
                              Especially if you get several of these events in a row, it can be a sign of a user enumeration attack. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts.
                              Especially watch for a number of such events in a row. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts.
                              Especially watch for a number of such events in a row. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”.
                              This issue is typically not a security issue but it can be an infrastructure or availability issue. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. | + | **Failure Information\\Status** or
                              **Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. | diff --git a/windows/security/threat-protection/auditing/event-4626.md b/windows/security/threat-protection/auditing/event-4626.md index d0474f5941..2adc4b2f1b 100644 --- a/windows/security/threat-protection/auditing/event-4626.md +++ b/windows/security/threat-protection/auditing/event-4626.md @@ -1,6 +1,6 @@ --- title: 4626(S) User/Device claims information. (Windows 10) -description: Describes security event 4626(S) User/Device claims information. +description: Describes security event 4626(S) User/Device claims information. This event is generated for new account logons. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -157,7 +157,7 @@ This event generates on the computer to which the logon was performed (target co - “dadmin” – claim value. -**Device Claims** \[Type = UnicodeString\]**:** list of device claims for new logon session. For user accounts this field typically has “**-**“ value. For computer accounts this field has device claims listed. +**Device Claims** \[Type = UnicodeString\]**:** list of device claims for new logon session. For user accounts this field typically has “**-**“ value. For computer accounts this field has device claims listed. ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index 37bc83b16f..fb47564ea9 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -1,6 +1,6 @@ --- title: 4627(S) Group membership information. (Windows 10) -description: Describes security event 4627(S) Group membership information. +description: Describes security event 4627(S) Group membership information. This event is generated with event 4624(S) An account was successfully logged on. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4634.md b/windows/security/threat-protection/auditing/event-4634.md index c7fd725041..d76dc2df61 100644 --- a/windows/security/threat-protection/auditing/event-4634.md +++ b/windows/security/threat-protection/auditing/event-4634.md @@ -1,6 +1,6 @@ --- title: 4634(S) An account was logged off. (Windows 10) -description: Describes security event 4634(S) An account was logged off. +description: Describes security event 4634(S) An account was logged off. This event is generated when a logon session is terminated and no longer exists. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4647.md b/windows/security/threat-protection/auditing/event-4647.md index 3cb68ae77c..26bbcd86f8 100644 --- a/windows/security/threat-protection/auditing/event-4647.md +++ b/windows/security/threat-protection/auditing/event-4647.md @@ -1,6 +1,6 @@ --- title: 4647(S) User initiated logoff. (Windows 10) -description: Describes security event 4647(S) User initiated logoff. +description: Describes security event 4647(S) User initiated logoff. This event is generated when a logoff is initiated. No further user-initiated activity can occur. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md index 97bb3eda59..5a44bd38f1 100644 --- a/windows/security/threat-protection/auditing/event-4648.md +++ b/windows/security/threat-protection/auditing/event-4648.md @@ -178,7 +178,7 @@ The following table is similar to the table in [Appendix A: Security monitoring | **High-value accounts**: You might have high value domain or local accounts for which you need to monitor each action.
                              Examples of high value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that correspond to the high value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” for accounts that are outside the whitelist. | +| **Account allow list**: You might have a specific allow list of accounts that are allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” for accounts that are outside the allow list. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform the action corresponding to this event. | Monitor for the **“Subject\\Account Domain”** or “**Account Whose Credentials Were Used\\Security ID**” corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that you are concerned about.
                              For example, you might monitor to ensure that “**Account Whose Credentials Were Used\\Security ID**” is not used to log on to a certain computer. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Subject\\Account Name”** and “**Account Whose Credentials Were Used\\Security ID**” for names that don’t comply with naming conventions. | diff --git a/windows/security/threat-protection/auditing/event-4649.md b/windows/security/threat-protection/auditing/event-4649.md index 0c3b10dff5..dce0305250 100644 --- a/windows/security/threat-protection/auditing/event-4649.md +++ b/windows/security/threat-protection/auditing/event-4649.md @@ -1,6 +1,6 @@ --- title: 4649(S) A replay attack was detected. (Windows 10) -description: Describes security event 4649(S) A replay attack was detected. +description: Describes security event 4649(S) A replay attack was detected. This event is generated when a KRB_AP_ERR_REPEAT Kerberos response is sent to the client. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4657.md b/windows/security/threat-protection/auditing/event-4657.md index f27a05c4d3..cb009c97df 100644 --- a/windows/security/threat-protection/auditing/event-4657.md +++ b/windows/security/threat-protection/auditing/event-4657.md @@ -1,6 +1,6 @@ --- title: 4657(S) A registry value was modified. (Windows 10) -description: Describes security event 4657(S) A registry value was modified. +description: Describes security event 4657(S) A registry value was modified. This event is generated when a registry key value is modified. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4658.md b/windows/security/threat-protection/auditing/event-4658.md index 1569c43d0f..c461aa3d20 100644 --- a/windows/security/threat-protection/auditing/event-4658.md +++ b/windows/security/threat-protection/auditing/event-4658.md @@ -1,6 +1,6 @@ --- title: 4658(S) The handle to an object was closed. (Windows 10) -description: Describes security event 4658(S) The handle to an object was closed. +description: Describes security event 4658(S) The handle to an object was closed. This event is generated when the handle to an object is closed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4660.md b/windows/security/threat-protection/auditing/event-4660.md index 7c03634e8e..0823b6ae3e 100644 --- a/windows/security/threat-protection/auditing/event-4660.md +++ b/windows/security/threat-protection/auditing/event-4660.md @@ -1,6 +1,6 @@ --- title: 4660(S) An object was deleted. (Windows 10) -description: Describes security event 4660(S) An object was deleted. +description: Describes security event 4660(S) An object was deleted. This event is generated when an object is deleted. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md index 45dcd000c9..bc6d20907b 100644 --- a/windows/security/threat-protection/auditing/event-4670.md +++ b/windows/security/threat-protection/auditing/event-4670.md @@ -274,5 +274,5 @@ For file system and registry objects, the following recommendations apply. - If you have critical registry objects for which you need to monitor all modifications (especially permissions changes and owner changes), monitor for the specific **Object\\Object Name.** -- If you have high-value computers for which you need to monitor all changes for all or specific objects (for example, file system or registry objects), monitor for all [4670](event-4670.md) events on these computers. For example, you could monitor the **ntds.dit** file on domain controllers. +- If you have high-value computers for which you need to monitor all changes for all or specific objects (for example, file system or registry objects), monitor for all [4670](event-4670.md) events on these computers. For example, you could monitor the **ntds.dit** file on domain controllers. diff --git a/windows/security/threat-protection/auditing/event-4672.md b/windows/security/threat-protection/auditing/event-4672.md index 1641acbc10..81b9fd94a0 100644 --- a/windows/security/threat-protection/auditing/event-4672.md +++ b/windows/security/threat-protection/auditing/event-4672.md @@ -22,7 +22,7 @@ ms.author: dansimp Event 4672 illustration
                              -Subcategory: Audit Special Logon +Subcategory: Audit Special Logon ***Event Description:*** diff --git a/windows/security/threat-protection/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md index 1caa24d32d..c647485d66 100644 --- a/windows/security/threat-protection/auditing/event-4673.md +++ b/windows/security/threat-protection/auditing/event-4673.md @@ -1,6 +1,6 @@ --- title: 4673(S, F) A privileged service was called. (Windows 10) -description: Describes security event 4673(S, F) A privileged service was called. +description: Describes security event 4673(S, F) A privileged service was called. This event is generated for an attempt to perform privileged system service operations. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -135,40 +135,40 @@ Failure event generates when service call attempt fails. | **Subcategory of event** | **Privilege Name:
                              User Right Group Policy Name** | **Description** | |-----------------------------------|-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                              Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                              With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | -| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                              Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | -| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                              Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | -| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                              Create permanent shared objects | Required to create a permanent object.
                              This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | -| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                              Create symbolic links | Required to create a symbolic link. | -| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                              Increase scheduling priority | Required to increase the base priority of a process.
                              With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | -| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                              Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                              With this privilege, the user can change the maximum memory that can be consumed by a process. | -| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                              Increase a process working set | Required to allocate more memory for applications that run in the context of users. | -| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory.
                              With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                              Add workstations to domain | With this privilege, the user can create a computer account.
                              This privilege is valid only on domain controllers. | -| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                              Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | -| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                              Profile single process | Required to gather profiling information for a single process.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | -| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                              Modify an object label | Required to modify the mandatory integrity level of an object. | -| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                              Force shutdown from a remote system | Required to shut down a system using a network request. | -| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                              Shut down the system | Required to shut down a local system. | -| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                              Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                              With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | -| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                              Profile system performance | Required to gather profiling information for the entire system.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | -| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                              Change the system time | Required to modify the system time. With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs.
                              If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | -| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                              Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | -| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                              Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | -| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                              Remove computer from docking station | Required to undock a laptop.
                              With this privilege, the user can undock a portable computer from its docking station without logging on. | +| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                              Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                              With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | +| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                              Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | +| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                              Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | +| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                              Create permanent shared objects | Required to create a permanent object.
                              This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | +| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                              Create symbolic links | Required to create a symbolic link. | +| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                              Increase scheduling priority | Required to increase the base priority of a process.
                              With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | +| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                              Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                              With this privilege, the user can change the maximum memory that can be consumed by a process. | +| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                              Increase a process working set | Required to allocate more memory for applications that run in the context of users. | +| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory.
                              With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                              Add workstations to domain | With this privilege, the user can create a computer account.
                              This privilege is valid only on domain controllers. | +| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                              Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | +| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                              Profile single process | Required to gather profiling information for a single process.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | +| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                              Modify an object label | Required to modify the mandatory integrity level of an object. | +| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                              Force shutdown from a remote system | Required to shut down a system using a network request. | +| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                              Shut down the system | Required to shut down a local system. | +| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                              Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                              With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | +| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                              Profile system performance | Required to gather profiling information for the entire system.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | +| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                              Change the system time | Required to modify the system time. With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs.
                              If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | +| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                              Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | +| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                              Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | +| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                              Remove computer from docking station | Required to undock a laptop.
                              With this privilege, the user can undock a portable computer from its docking station without logging on. | | **Subcategory of event** | **Privilege Name:
                              User Right Group Policy Name** | **Description** | |-------------------------------|------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                              Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process. With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | -| Audit Sensitive Privilege Use | SeAuditPrivilege:
                              Generate security audits | With this privilege, the user can add entries to the security log. | -| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                              Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs. When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | -| Audit Sensitive Privilege Use | SeDebugPrivilege:
                              Debug programs | Required to debug and adjust the memory of a process owned by another account. With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides complete access to sensitive and critical operating system components. | -| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                              Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | -| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                              Load and unload device drivers | Required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | -| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory. With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                              Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | -| Audit Sensitive Privilege Use | SeTcbPrivilege:
                              Act as part of the operating system | This privilege identifies its holder as part of the trusted computer base. This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. | -| Audit Sensitive Privilege Use | SeEnableDelegationPrivilege:
                              Enable computer and user accounts to be trusted for delegation | Required to mark user and computer accounts as trusted for delegation. With this privilege, the user can set the **Trusted for Deleg**ation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using the delegated credentials of a client, as long as the account of the client does not have the **Account cannot be delegated** account control flag set. | +| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                              Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process. With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | +| Audit Sensitive Privilege Use | SeAuditPrivilege:
                              Generate security audits | With this privilege, the user can add entries to the security log. | +| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                              Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs. When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | +| Audit Sensitive Privilege Use | SeDebugPrivilege:
                              Debug programs | Required to debug and adjust the memory of a process owned by another account. With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides complete access to sensitive and critical operating system components. | +| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                              Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | +| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                              Load and unload device drivers | Required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | +| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory. With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                              Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | +| Audit Sensitive Privilege Use | SeTcbPrivilege:
                              Act as part of the operating system | This privilege identifies its holder as part of the trusted computer base. This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. | +| Audit Sensitive Privilege Use | SeEnableDelegationPrivilege:
                              Enable computer and user accounts to be trusted for delegation | Required to mark user and computer accounts as trusted for delegation. With this privilege, the user can set the **Trusted for Deleg**ation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using the delegated credentials of a client, as long as the account of the client does not have the **Account cannot be delegated** account control flag set. | ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4674.md b/windows/security/threat-protection/auditing/event-4674.md index b4146f681a..5781254277 100644 --- a/windows/security/threat-protection/auditing/event-4674.md +++ b/windows/security/threat-protection/auditing/event-4674.md @@ -157,42 +157,42 @@ Failure event generates when operation attempt fails. | **Subcategory of event** | **Privilege Name:
                              User Right Group Policy Name** | **Description** | |-----------------------------------|-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                              Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                              With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | -| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                              Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | -| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                              Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | -| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                              Create permanent shared objects | Required to create a permanent object.
                              This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | -| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                              Create symbolic links | Required to create a symbolic link. | -| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                              Increase scheduling priority | Required to increase the base priority of a process.
                              With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | -| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                              Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                              With this privilege, the user can change the maximum memory that can be consumed by a process. | -| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                              Increase a process working set | Required to allocate more memory for applications that run in the context of users. | -| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory.
                              With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                              Add workstations to domain | With this privilege, the user can create a computer account. This privilege is valid only on domain controllers. | -| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                              Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | -| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                              Profile single process | Required to gather profiling information for a single process.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | -| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                              Modify an object label | Required to modify the mandatory integrity level of an object. | -| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                              Force shutdown from a remote system | Required to shut down a system using a network request. | -| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                              Shut down the system | Required to shut down a local system. | -| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                              Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                              With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | -| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                              Profile system performance | Required to gather profiling information for the entire system.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | -| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                              Change the system time | Required to modify the system time.
                              With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | -| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                              Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | -| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                              Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | -| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                              Remove computer from docking station | Required to undock a laptop.
                              With this privilege, the user can undock a portable computer from its docking station without logging on. | +| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                              Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                              With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | +| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                              Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | +| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                              Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | +| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                              Create permanent shared objects | Required to create a permanent object.
                              This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | +| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                              Create symbolic links | Required to create a symbolic link. | +| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                              Increase scheduling priority | Required to increase the base priority of a process.
                              With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | +| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                              Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                              With this privilege, the user can change the maximum memory that can be consumed by a process. | +| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                              Increase a process working set | Required to allocate more memory for applications that run in the context of users. | +| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory.
                              With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                              Add workstations to domain | With this privilege, the user can create a computer account. This privilege is valid only on domain controllers. | +| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                              Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | +| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                              Profile single process | Required to gather profiling information for a single process.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | +| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                              Modify an object label | Required to modify the mandatory integrity level of an object. | +| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                              Force shutdown from a remote system | Required to shut down a system using a network request. | +| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                              Shut down the system | Required to shut down a local system. | +| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                              Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                              With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | +| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                              Profile system performance | Required to gather profiling information for the entire system.
                              With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | +| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                              Change the system time | Required to modify the system time.
                              With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | +| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                              Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | +| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                              Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | +| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                              Remove computer from docking station | Required to undock a laptop.
                              With this privilege, the user can undock a portable computer from its docking station without logging on. | | **Subcategory of event** | **Privilege Name:
                              User Right Group Policy Name** | **Description** | |-------------------------------|-----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                              Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process.
                              With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | -| Audit Sensitive Privilege Use | SeAuditPrivilege:
                              Generate security audits | With this privilege, the user can add entries to the security log. | -| Audit Sensitive Privilege Use | SeBackupPrivilege:
                              Back up files and directories | - Required to perform backup operations.
                              With this privilege, the user can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This privilege causes the system to grant all read access control to any file, regardless of the [*access control list*](https://msdn.microsoft.com/library/windows/desktop/ms721532(v=vs.85).aspx#_security_access_control_list_gly) (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.
                              The following access rights are granted if this privilege is held:
                              READ\_CONTROL
                              ACCESS\_SYSTEM\_SECURITY
                              FILE\_GENERIC\_READ
                              FILE\_TRAVERSE | -| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                              Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.
                              When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | -| Audit Sensitive Privilege Use | SeDebugPrivilege:
                              Debug programs | Required to debug and adjust the memory of a process owned by another account.
                              With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right.
                              This user right provides complete access to sensitive and critical operating system components. | -| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                              Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | -| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                              Load and unload device drivers | Required to load or unload a device driver.
                              With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | -| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory.
                              With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Sensitive Privilege Use | SeRestorePrivilege:
                              Restore files and directories | Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. The following access rights are granted if this privilege is held:
                              WRITE\_DAC
                              WRITE\_OWNER
                              ACCESS\_SYSTEM\_SECURITY
                              FILE\_GENERIC\_WRITE
                              FILE\_ADD\_FILE
                              FILE\_ADD\_SUBDIRECTORY
                              DELETE
                              With this privilege, the user can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories and determines which users can set any valid security principal as the owner of an object. | -| Audit Sensitive Privilege Use | SeSecurityPrivilege:
                              Manage auditing and security log | Required to perform a number of security-related functions, such as controlling and viewing audit events in security event log.
                              With this privilege, the user can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. A user with this privilege can also view and clear the security log. | -| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                              Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | -| Audit Sensitive Privilege Use | SeTakeOwnershipPrivilege:
                              Take ownership of files or other objects | Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.
                              With this privilege, the user can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. | +| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                              Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process.
                              With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | +| Audit Sensitive Privilege Use | SeAuditPrivilege:
                              Generate security audits | With this privilege, the user can add entries to the security log. | +| Audit Sensitive Privilege Use | SeBackupPrivilege:
                              Back up files and directories | - Required to perform backup operations.
                              With this privilege, the user can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This privilege causes the system to grant all read access control to any file, regardless of the [*access control list*](https://msdn.microsoft.com/library/windows/desktop/ms721532(v=vs.85).aspx#_security_access_control_list_gly) (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.
                              The following access rights are granted if this privilege is held:
                              READ\_CONTROL
                              ACCESS\_SYSTEM\_SECURITY
                              FILE\_GENERIC\_READ
                              FILE\_TRAVERSE | +| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                              Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.
                              When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | +| Audit Sensitive Privilege Use | SeDebugPrivilege:
                              Debug programs | Required to debug and adjust the memory of a process owned by another account.
                              With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right.
                              This user right provides complete access to sensitive and critical operating system components. | +| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                              Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | +| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                              Load and unload device drivers | Required to load or unload a device driver.
                              With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | +| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                              Lock pages in memory | Required to lock physical pages in memory.
                              With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Sensitive Privilege Use | SeRestorePrivilege:
                              Restore files and directories | Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. The following access rights are granted if this privilege is held:
                              WRITE\_DAC
                              WRITE\_OWNER
                              ACCESS\_SYSTEM\_SECURITY
                              FILE\_GENERIC\_WRITE
                              FILE\_ADD\_FILE
                              FILE\_ADD\_SUBDIRECTORY
                              DELETE
                              With this privilege, the user can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories and determines which users can set any valid security principal as the owner of an object. | +| Audit Sensitive Privilege Use | SeSecurityPrivilege:
                              Manage auditing and security log | Required to perform a number of security-related functions, such as controlling and viewing audit events in security event log.
                              With this privilege, the user can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. A user with this privilege can also view and clear the security log. | +| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                              Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | +| Audit Sensitive Privilege Use | SeTakeOwnershipPrivilege:
                              Take ownership of files or other objects | Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.
                              With this privilege, the user can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. | ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4675.md b/windows/security/threat-protection/auditing/event-4675.md index 20ed1e1911..978d25bf39 100644 --- a/windows/security/threat-protection/auditing/event-4675.md +++ b/windows/security/threat-protection/auditing/event-4675.md @@ -1,6 +1,6 @@ --- title: 4675(S) SIDs were filtered. (Windows 10) -description: Describes security event 4675(S) SIDs were filtered. +description: Describes security event 4675(S) SIDs were filtered. This event is generated when SIDs were filtered for a specific Active Directory trust. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md index 94d84a85cf..4c48e4623a 100644 --- a/windows/security/threat-protection/auditing/event-4688.md +++ b/windows/security/threat-protection/auditing/event-4688.md @@ -1,6 +1,6 @@ --- title: 4688(S) A new process has been created. (Windows 10) -description: Describes security event 4688(S) A new process has been created. +description: Describes security event 4688(S) A new process has been created. This event is generated when a new process starts. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -81,29 +81,29 @@ This event generates every time a new process starts. - 1 - Windows Server 2012 R2, Windows 8.1. - - Added “Process Command Line” field. + - Added "Process Command Line" field. - 2 - Windows 10. - **Subject** renamed to **Creator Subject**. - - Added “**Target Subject**” section. + - Added "**Target Subject**" section. - - Added “**Mandatory Label**” field. + - Added "**Mandatory Label**" field. - - Added “**Creator Process Name**” field. + - Added "**Creator Process Name**" field. ***Field Descriptions:*** **Creator Subject** \[Value for versions 0 and 1 – **Subject**\]**:** -- **Security ID** \[Type = SID\]**:** SID of account that requested the “create process” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. +- **Security ID** \[Type = SID\]**:** SID of account that requested the "create process" operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. > **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). -- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “create process” operation. +- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the "create process" operation. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** subject's domain or computer name. Formats vary, and include the following: - Domain NETBIOS name example: CONTOSO @@ -111,11 +111,11 @@ This event generates every time a new process starts. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. + - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". -- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4624](event-4624.md): An account was successfully logged on.” +- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4624](event-4624.md): An account was successfully logged on." **Target Subject** \[Version 2\]**:** @@ -127,7 +127,7 @@ This event generates every time a new process starts. - **Account Name** \[Type = UnicodeString\] \[Version 2\]**:** the name of the target account. -- **Account Domain** \[Type = UnicodeString\] \[Version 2\]**:** target account’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\] \[Version 2\]**:** target account's domain or computer name. Formats vary, and include the following: - Domain NETBIOS name example: CONTOSO @@ -135,11 +135,11 @@ This event generates every time a new process starts. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. + - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". -- **Logon ID** \[Type = HexInt64\] \[Version 2\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4624](event-4624.md): An account was successfully logged on.” +- **Logon ID** \[Type = HexInt64\] \[Version 2\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4624](event-4624.md): An account was successfully logged on." **Process Information:** @@ -173,11 +173,11 @@ This event generates every time a new process starts. - **Creator Process ID** \[Type = Pointer\]**:** hexadecimal Process ID of the process which ran the new process. If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager. -> You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**. +> You can also correlate this process ID with a process ID in other events, for example, "[4688](event-4688.md): A new process has been created" **Process Information\\New Process ID**. - **Creator Process Name** \[Version 2\] \[Type = UnicodeString\]**:** full path and the name of the executable for the process. -- **Process Command Line** \[Version 1, 2\] \[Type = UnicodeString\]**:** contains the name of executable and arguments which were passed to it. You must enable “Administrative Templates\\System\\Audit Process Creation\\Include command line in process creation events” group policy to include command line in process creation events: +- **Process Command Line** \[Version 1, 2\] \[Type = UnicodeString\]**:** contains the name of executable and arguments which were passed to it. You must enable "Administrative Templates\\System\\Audit Process Creation\\Include command line in process creation events" group policy to include command line in process creation events: Group policy illustration @@ -189,28 +189,27 @@ For 4688(S): A new process has been created. | **Type of monitoring required** | **Recommendation** | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor all events with the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that corresponds to the high-value account or accounts. | -| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | -| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor all events with the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Creator Subject\\Security ID”** and **“Target Subject\\Security ID”** for accounts that are outside the whitelist. | -| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** to see whether the account type is as expected. | -| **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** corresponding to accounts from another domain or “external” accounts. | -| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that you are concerned about. | -| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** for names that don’t comply with naming conventions. | +| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the high-value account or accounts. | +| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** (with other information) to monitor how or when a particular account is being used. | +| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the accounts that should never be used. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "whitelist-only" action, review the **"Creator Subject\\Security ID"** and **"Target Subject\\Security ID"** for accounts that are outside the allow list. | +| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** to see whether the account type is as expected. | +| **External accounts**: You might be monitoring accounts from another domain, or "external" accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** corresponding to accounts from another domain or "external" accounts. | +| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that you are concerned about. | +| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** for names that don't comply with naming conventions. | -- If you have a pre-defined “**New** **Process Name**” or **“Creator Process Name**” for the process reported in this event, monitor all events with “**New** **Process Name**” or **“Creator Process Name**” not equal to your defined value. +- If you have a pre-defined "**New** **Process Name**" or **"Creator Process Name**" for the process reported in this event, monitor all events with "**New** **Process Name**" or **"Creator Process Name**" not equal to your defined value. -- You can monitor to see if “**New** **Process Name**” or **“Creator Process Name**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). +- You can monitor to see if "**New** **Process Name**" or **"Creator Process Name**" is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). -- If you have a pre-defined list of restricted substrings or words in process names (for example “**mimikatz**” or “**cain.exe**”), check for these substrings in “**New** **Process Name**” or **“Creator Process Name**.” +- If you have a pre-defined list of restricted substrings or words in process names (for example "**mimikatz**" or "**cain.exe**"), check for these substrings in "**New** **Process Name**" or **"Creator Process Name**." - It can be unusual for a process to run using a local account in either **Creator Subject\\Security ID** or in **Target** **Subject\\Security ID**. -- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol. Typically this means that UAC is disabled for this account for some reason. +- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn't contain the $ symbol. Typically this means that UAC is disabled for this account for some reason. -- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol. This means that a user ran a program using administrative privileges. +- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn't contain the $ symbol. This means that a user ran a program using administrative privileges. - You can also monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when a computer object was used to run the process, but that computer object is not the same computer where the event occurs. -- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the “**Mandatory Label**” in this event. - +- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the "**Mandatory Label**" in this event. \ No newline at end of file diff --git a/windows/security/threat-protection/auditing/event-4689.md b/windows/security/threat-protection/auditing/event-4689.md index cf6f0fce07..81c27d0423 100644 --- a/windows/security/threat-protection/auditing/event-4689.md +++ b/windows/security/threat-protection/auditing/event-4689.md @@ -1,6 +1,6 @@ --- title: 4689(S) A process has exited. (Windows 10) -description: Describes security event 4689(S) A process has exited. +description: Describes security event 4689(S) A process has exited. This event is generates when a process exits. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4692.md b/windows/security/threat-protection/auditing/event-4692.md index 15199dbda5..dc84c4c3d6 100644 --- a/windows/security/threat-protection/auditing/event-4692.md +++ b/windows/security/threat-protection/auditing/event-4692.md @@ -30,7 +30,7 @@ This event generates every time that a backup is attempted for the [DPAPI](https When a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. When a Master Key is generated, DPAPI communicates with a domain controller. Domain controllers have a domain-wide public/private key pair, associated solely with DPAPI. The local DPAPI client gets the domain controller public key from a domain controller by using a mutually authenticated and privacy protected RPC call. The client encrypts the Master Key with the domain controller public key. It then stores this backup Master Key along with the Master Key protected by the user's password. -Periodically, a domain-joined machine will try to send an RPC request to a domain controller to back up the user’s master key so that the user can recover secrets in case his or her password has to be reset. Although the user's keys are stored in the user profile, a domain controller must be contacted to encrypt the master key with a domain recovery key. +Periodically, a domain-joined machine tries to send an RPC request to a domain controller to back up the user’s master key so that the user can recover secrets in case their password has to be reset. Although the user's keys are stored in the user profile, a domain controller must be contacted to encrypt the master key with a domain recovery key. This event also generates every time a new DPAPI Master Key is generated, for example. @@ -91,7 +91,7 @@ Failure event generates when a Master Key backup operation fails for some reason - **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested backup operation. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Here are some examples of formats: - Domain NETBIOS name example: CONTOSO @@ -107,17 +107,17 @@ Failure event generates when a Master Key backup operation fails for some reason **Key Information:** -- **Key Identifier** \[Type = UnicodeString\]: unique identifier of a master key which backup was created. The Master Key is used, with some additional data, to generate an actual symmetric session key to encrypt\\decrypt the data using DPAPI. All of user's Master Keys are located in user profile -> %APPDATA%\\Roaming\\Microsoft\\Windows\\Protect\\%SID% folder. The name of every Master Key file is it’s ID. +- **Key Identifier** \[Type = UnicodeString\]: unique identifier of a master key which backup was created. The Master Key is used, with some additional data, to generate an actual symmetric session key to encrypt\\decrypt the data using DPAPI. All of user's Master Keys are located in user profile -> %APPDATA%\\Roaming\\Microsoft\\Windows\\Protect\\%SID% folder. The name of every Master Key file is its ID. - **Recovery Server** \[Type = UnicodeString\]: the name (typically – DNS name) of the computer that you contacted to back up your Master Key. For domain joined machines, it’s typically a name of a domain controller. This parameter might not be captured in the event, and in that case will be empty. -- **Recovery Key ID** \[Type = UnicodeString\]**:** unique identifier of a recovery key. The recovery key is generated when a user chooses to create a Password Reset Disk (PRD) from the user's Control Panel or when first Master Key is generated. First, DPAPI generates a RSA public/private key pair, which is the recovery key. In this field you will see unique Recovery key ID which was used for Master key backup operation. +- **Recovery Key ID** \[Type = UnicodeString\]**:** unique identifier of a recovery key. The recovery key is generated when a user chooses to create a Password Reset Disk (PRD) from the user's Control Panel or when first Master Key is generated. First, DPAPI generates an RSA public/private key pair, which is the recovery key. In this field, you will see unique Recovery key ID that was used for Master key backup operation. - For Failure events this field is typically empty. + For Failure events, this field is typically empty. **Status Information:** -- **Status Code** \[Type = HexInt32\]**:** hexadecimal unique status code of performed operation. For Success events this field is typically “**0x0**”. To see the meaning of status code you need to convert it to decimal value and us “**net helpmsg STATUS\_CODE**” command to see the description for specific STATUS\_CODE. Here is an example of “net helpmsg” command output for status code 0x3A: +- **Status Code** \[Type = HexInt32\]**:** hexadecimal unique status code of performed operation. For Success events, this field is typically “**0x0**”. To see the meaning of status code you need to convert it to decimal value and us “**net helpmsg STATUS\_CODE**” command to see the description for specific STATUS\_CODE. Here is an example of “net helpmsg” command output for status code 0x3A: > \[Net helpmsg 58 illustration](..images/net-helpmsg-58.png) diff --git a/windows/security/threat-protection/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md index cc31b9e54f..0268cd25a8 100644 --- a/windows/security/threat-protection/auditing/event-4696.md +++ b/windows/security/threat-protection/auditing/event-4696.md @@ -152,7 +152,7 @@ For 4696(S): A primary token was assigned to process. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and **“New Token Information\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and **“New Token Information\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md index 2742b717ce..a6f3256c16 100644 --- a/windows/security/threat-protection/auditing/event-4698.md +++ b/windows/security/threat-protection/auditing/event-4698.md @@ -1,6 +1,6 @@ --- title: 4698(S) A scheduled task was created. (Windows 10) -description: Describes security event 4698(S) A scheduled task was created. +description: Describes security event 4698(S) A scheduled task was created. This event is generated when a scheduled task is created. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -62,6 +62,17 @@ This event generates every time a new scheduled task is created.
                              ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4699.md b/windows/security/threat-protection/auditing/event-4699.md index 280aad111e..48148e6246 100644 --- a/windows/security/threat-protection/auditing/event-4699.md +++ b/windows/security/threat-protection/auditing/event-4699.md @@ -1,6 +1,6 @@ --- title: 4699(S) A scheduled task was deleted. (Windows 10) -description: Describes security event 4699(S) A scheduled task was deleted. +description: Describes security event 4699(S) A scheduled task was deleted. This event is generated every time a scheduled task is deleted. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -62,6 +62,17 @@ This event generates every time a scheduled task was deleted.
                              ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4700.md b/windows/security/threat-protection/auditing/event-4700.md index a53997c7b8..8d39b0e38d 100644 --- a/windows/security/threat-protection/auditing/event-4700.md +++ b/windows/security/threat-protection/auditing/event-4700.md @@ -1,6 +1,6 @@ --- title: 4700(S) A scheduled task was enabled. (Windows 10) -description: Describes security event 4700(S) A scheduled task was enabled. +description: Describes security event 4700(S) A scheduled task was enabled. This event is generated every time a scheduled task is enabled. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -62,6 +62,17 @@ This event generates every time a scheduled task is enabled.
                              ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4701.md b/windows/security/threat-protection/auditing/event-4701.md index d1991b0941..ef24c397fc 100644 --- a/windows/security/threat-protection/auditing/event-4701.md +++ b/windows/security/threat-protection/auditing/event-4701.md @@ -1,6 +1,6 @@ --- title: 4701(S) A scheduled task was disabled. (Windows 10) -description: Describes security event 4701(S) A scheduled task was disabled. +description: Describes security event 4701(S) A scheduled task was disabled. This event is generated every time a scheduled task is disabled. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -62,6 +62,17 @@ This event generates every time a scheduled task is disabled. ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4702.md b/windows/security/threat-protection/auditing/event-4702.md index 01ef0250a8..393a0619d6 100644 --- a/windows/security/threat-protection/auditing/event-4702.md +++ b/windows/security/threat-protection/auditing/event-4702.md @@ -1,6 +1,6 @@ --- title: 4702(S) A scheduled task was updated. (Windows 10) -description: Describes security event 4702(S) A scheduled task was updated. +description: Describes security event 4702(S) A scheduled task was updated. This event is generated when a scheduled task is updated/changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -62,6 +62,17 @@ This event generates every time scheduled task was updated/changed. ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md index a04ae9c4c5..7483483ea2 100644 --- a/windows/security/threat-protection/auditing/event-4703.md +++ b/windows/security/threat-protection/auditing/event-4703.md @@ -1,6 +1,6 @@ --- title: 4703(S) A user right was adjusted. (Windows 10) -description: Describes security event 4703(S) A user right was adjusted. +description: Describes security event 4703(S) A user right was adjusted. This event is generated when token privileges are enabled or disabled for a specific account. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -26,7 +26,7 @@ ms.author: dansimp ***Event Description:*** -This event generates when [token privileges](https://msdn.microsoft.com/library/windows/desktop/aa446619(v=vs.85).aspx) were enabled or disabled for a specific account’s token. As of Windows 10, event 4703 is also logged by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory (Audit Authorization Policy Change), or work with a very high volume of event 4703. +This event generates when [token privileges](https://msdn.microsoft.com/library/windows/desktop/aa446619(v=vs.85).aspx) were enabled or disabled for a specific account’s token. As of Windows 10, event 4703 is also logged by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory (Audit Authorization Policy Change), or work with a very high volume of event 4703. > **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. @@ -185,7 +185,7 @@ Token privileges provide the ability to take certain system-level actions that y For 4703(S): A user right was adjusted. -As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory, [Audit Authorization Policy Change](audit-authorization-policy-change.md), or work with a very high volume of event 4703. +As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is Microsoft Endpoint Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from svchost.exe). If you are using an application or system service that makes changes to system privileges through the AdjustPrivilegesToken API, you might need to disable Success auditing for this subcategory, [Audit Authorization Policy Change](audit-authorization-policy-change.md), or work with a very high volume of event 4703. Otherwise, see the recommendations in the following table. @@ -194,7 +194,7 @@ Otherwise, see the recommendations in the following table. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\Security ID**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. Also check the “**Target Account\\Security ID**” and **“Enabled Privileges”** to see what was enabled. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Security ID**” and **“Enabled Privileges”** to see what was enabled. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about.
                              Also check **“Target Account\\Security ID”** to see whether the change in privileges should be made on that computer for that account. | diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md index f78b83ef3c..bc3e9d5c3a 100644 --- a/windows/security/threat-protection/auditing/event-4704.md +++ b/windows/security/threat-protection/auditing/event-4704.md @@ -1,6 +1,6 @@ --- title: 4704(S) A user right was assigned. (Windows 10) -description: Describes security event 4704(S) A user right was assigned. +description: Describes security event 4704(S) A user right was assigned. This event is generated when a user right is assigned to an account. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -152,7 +152,7 @@ For 4704(S): A user right was assigned. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\ Account Name**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. Also check the “**Target Account\\Account Name**” and **“New Right”** to see what was enabled. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Account Name**” and **“New Right”** to see what was enabled. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about.
                              Also check **“Target Account\\ Account Name”** to see whether the change in rights should be made on that computer for that account. | diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md index 09c240e026..5b337c9941 100644 --- a/windows/security/threat-protection/auditing/event-4705.md +++ b/windows/security/threat-protection/auditing/event-4705.md @@ -1,6 +1,6 @@ --- title: 4705(S) A user right was removed. (Windows 10) -description: Describes security event 4705(S) A user right was removed. +description: Describes security event 4705(S) A user right was removed. This event is generated when a user right is removed from an account. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -151,7 +151,7 @@ For 4705(S): A user right was removed. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                              Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\Account Name**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist.
                              If you have specific user rights policies, for example, a whitelist of accounts that can perform certain actions, monitor this event to confirm that it was appropriate that the “**Removed Right**” was removed from “**Target** **Account\\Account Name**.” | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
                              If you have specific user rights policies, for example, an allow list of accounts that can perform certain actions, monitor this event to confirm that it was appropriate that the “**Removed Right**” was removed from “**Target** **Account\\Account Name**.” | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** and “**Target Account\\Account Name”** to see whether the account type is as expected.
                              For example, if some accounts have critical user rights which should never be removed, monitor this event for the **“Target** **Account\\Account Name”** and the appropriate rights.
                              As another example, if non-administrative accounts should never be granted certain user rights (for example, **SeAuditPrivilege**), you might monitor this event, because a right can be removed only after it was previously granted. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. Also be sure to check “**Target Account\\Account Name**” to see whether user rights should be removed from that account (or whether that account should have any rights on that computer).
                              For high-value servers or other computers, we recommend that you track this event and investigate whether the specific “**Removed Right**” should be removed from “**Target** **Account\\Account Name**” in each case. | diff --git a/windows/security/threat-protection/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md index c566c246bf..2a57c47db5 100644 --- a/windows/security/threat-protection/auditing/event-4706.md +++ b/windows/security/threat-protection/auditing/event-4706.md @@ -1,6 +1,6 @@ --- title: 4706(S) A new trust was created to a domain. (Windows 10) -description: Describes security event 4706(S) A new trust was created to a domain. +description: Describes security event 4706(S) A new trust was created to a domain. This event is generated when a new trust is created for a domain. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md index f998718c41..dc7e2f5419 100644 --- a/windows/security/threat-protection/auditing/event-4707.md +++ b/windows/security/threat-protection/auditing/event-4707.md @@ -1,6 +1,6 @@ --- title: 4707(S) A trust to a domain was removed. (Windows 10) -description: Describes security event 4707(S) A trust to a domain was removed. +description: Describes security event 4707(S) A trust to a domain was removed. This event is generated when a domain trust is removed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md index a4809630b7..69c6f2f153 100644 --- a/windows/security/threat-protection/auditing/event-4713.md +++ b/windows/security/threat-protection/auditing/event-4713.md @@ -1,6 +1,6 @@ --- title: 4713(S) Kerberos policy was changed. (Windows 10) -description: Describes security event 4713(S) Kerberos policy was changed. +description: Describes security event 4713(S) Kerberos policy was changed. This event is generated when Kerberos policy is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md index 505106fe5e..4ab122d7f1 100644 --- a/windows/security/threat-protection/auditing/event-4716.md +++ b/windows/security/threat-protection/auditing/event-4716.md @@ -154,3 +154,69 @@ For 4716(S): Trusted domain information was modified. - Any changes in Active Directory domain trust settings must be monitored and alerts should be triggered. If this change was not planned, investigate the reason for the change. +## Anonymous Logon account + +If the account reported in the event is **Anonymous Logon**, it means the password is changed by system automatic password reset. For example: + +``` +Log Name: Security +Source: Microsoft-Windows-Security-Auditing +Date: